diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn index 4a22e37c62..82c001e81f 100644 --- a/.acrolinx-config.edn +++ b/.acrolinx-config.edn @@ -1,5 +1,23 @@ {:allowed-branchname-matches ["master"] :allowed-filename-matches ["windows/"] + + :targets + { + :counts { + ;;:spelling 10 + ;;:grammar 3 + ;;:total 15 ;; absolute flag count but i don't know the difference between this and issues + ;;:issues 15 ;; coming from the platform, will need to be tested. + } + :scores { + ;;:terminology 100 + :qualityscore 80 ;; Confirmed with Hugo that you just comment out the single score and leave the structure in place + ;;:spelling 40 + } + } + + :guidance-profile "d2b6c2c8-00ee-47f1-8d10-b280cc3434c1" ;; Profile ID for "M365-specific" + :acrolinx-check-settings { "languageId" "en" @@ -9,7 +27,7 @@ "TERMINOLOGY_VALID" "VOICE_GUIDANCE" ] - "termSetNames" ["M365"] + "termSetNames" ["M365" "Products" "Microsoft"] } :template-header @@ -17,7 +35,15 @@ " ## Acrolinx Scorecards -**A minimum Acrolinx score of 20 is required.** +**The minimum Acrolinx topic score of 65 is required for all MARVEL content merged to the default branch.** + +If you need a scoring exception for content in this PR, add the *Sign off* and the *Acrolinx exception* labels to the PR. The PubOps Team will review the exception request and may take one or more of the following actions: + +- Work with you to resolve the issues requiring the exception. +- Escalate the exception request to the Acrolinx Review Team for review. +- Approve the exception and work with the GitHub Admin Team to merge the PR to the default branch. + +For more information about the exception criteria and exception process, see [Minimum Acrolinx topic scores for publishing](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-min-score?branch=master). Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology: @@ -33,6 +59,6 @@ Click the scorecard links for each article to review the Acrolinx feedback on gr " **More info about Acrolinx** -You are helping M365 test Acrolinx while we merge to the Microsoft instance. We have set the minimum score to 20 to test that the minimum score script works. This is effectively *not* setting a minimum score. If you need to bypass this score, please contact krowley or go directly to the marveldocs-admins. Thanks for your patience while we continue with roll out! +Use the Acrolinx extension, or sidebar, in Visual Studio Code to check spelling, grammar, style, tone, clarity, and key terminology when you're creating or updating content. For more information, see [Use the Visual Studio Code extension to run Acrolinx locally](https://review.docs.microsoft.com/en-us/office-authoring-guide/acrolinx-vscode?branch=master). " } diff --git a/.gitignore b/.gitignore index 4d2ce285a9..9841e0daea 100644 --- a/.gitignore +++ b/.gitignore @@ -5,9 +5,11 @@ obj/ _site/ Tools/NuGet/ .optemp/ -Thumbs.db +*.db .DS_Store - +*.ini +_themes*/ +common/ .openpublishing.build.mdproj .openpublishing.buildcore.ps1 packages.config diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 2ffc227a40..f9ebdac192 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -65,22 +65,6 @@ "build_entry_point": "docs", "template_folder": "_themes" }, - { - "docset_name": "mdop", - "build_source_folder": "mdop", - "build_output_subfolder": "mdop", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, { "docset_name": "microsoft-edge", "build_source_folder": "browsers/edge", @@ -145,38 +129,6 @@ "build_entry_point": "docs", "template_folder": "_themes" }, - { - "docset_name": "surface", - "build_source_folder": "devices/surface", - "build_output_subfolder": "surface", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "surface-hub", - "build_source_folder": "devices/surface-hub", - "build_output_subfolder": "surface-hub", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, { "docset_name": "win-access-protection", "build_source_folder": "windows/access-protection", @@ -438,7 +390,7 @@ "elizapo@microsoft.com" ], "sync_notification_subscribers": [ - "daniha@microsoft.com" + "dstrome@microsoft.com" ], "branches_to_filter": [ "" @@ -479,6 +431,9 @@ "template_folder": "_themes.pdf" } }, + "docs_build_engine": { + "name": "docfx_v3" + }, "need_generate_pdf": false, "need_generate_intellisense": false -} +} \ No newline at end of file diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index f4483bee95..f072b252df 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,15859 +1,16539 @@ { -"redirections": [ -{ -"source_path": "security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-whats-new.md", -"redirect_url": "https://docs.microsoft.com/hololens/hololens-release-notes", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-upgrade-enterprise.md", -"redirect_url": "https://docs.microsoft.com/hololens/hololens-requirements#upgrade-to-windows-holographic-for-business", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-install-localized.md", -"redirect_url": "https://docs.microsoft.com/hololens/hololens1-install-localized", -"redirect_document_id": false -}, -{ -"source_path": "devices/hololens/hololens-install-apps.md", -"redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps", -"redirect_document_id": false -}, -{ -"source_path": "devices/hololens/hololens-setup.md", -"redirect_url": "https://docs.microsoft.com/hololens/hololens1-setup", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-use-apps.md", -"redirect_url": "https://docs.microsoft.com/hololens/holographic-home#using-apps-on-hololens", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-get-apps.md", -"redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-spaces-on-hololens.md", -"redirect_url": "https://docs.microsoft.com/hololens/hololens-spaces", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-clicker.md", -"redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-clicker-restart-recover.md", -"redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker#restart-or-recover-the-clicker", -"redirect_document_id": false -}, -{ - "source_path": "devices/hololens/hololens-find-and-save-files.md", - "redirect_url": "https://docs.microsoft.com/hololens/holographic-data", - "redirect_document_id": false -}, -{ - "source_path": "devices/hololens/hololens-management-overview.md", - "redirect_url": "https://docs.microsoft.com/hololens", - "redirect_document_id": false -}, -{ -"source_path": "devices/surface/manage-surface-pro-3-firmware-updates.md", -"redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", -"redirect_document_id": false -}, -{ -"source_path": "devices/surface/update.md", -"redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/windows-update-sources.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/how-windows-update-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/update-compliance-perspectives.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", -"redirect_document_id": true -}, -{ -"source_path": "browsers/edge/hardware-and-software-requirements.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge", -"redirect_document_id": true -}, -{ -"source_path": "browsers/edge/security-enhancements-microsoft-edge.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp", -"redirect_document_id": true -}, -{ -"source_path": "browsers/edge/new-policies.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/change-history-for-microsoft-edge", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/intelligence/av-tests.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/intelligence/transparency-report.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/intelligence/av-tests", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/waas-windows-insider-for-business-aad.md", -"redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-add", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/waas-windows-insider-for-business-faq.md", -"redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/encrypted-hard-drive.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/encrypted-hard-drive", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/secure-the-windows-10-boot-process.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/secure-the-windows-10-boot-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/change-the-tpm-owner-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/how-windows-uses-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/manage-tpm-commands.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/manage-tpm-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/manage-tpm-lockout.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/manage-tpm-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/tpm-fundamentals.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-fundamentals", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/tpm-recommendations.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-recommendations", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-top-node", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/waas-windows-insider-for-business.md", -"redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agress.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protectionsecurity-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/applocker/administer-applocker-using-mdm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/administer-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-architecture-and-components.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-functions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-policies-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-policies-design-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-policy-use-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-processes-and-interactions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/applocker-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-the-application-identity-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/configure-the-appLocker-reference-device.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-applocker-default-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-your-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/create-your-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/delete-an-applocker-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/determine-your-application-control-objectives.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/dll-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/document-your-application-list.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/document-your-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/edit-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/edit-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/enable-the-dll-rule-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/enforce-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/applocker/executable-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/how-applocker-works-techref.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/maintain-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-manually.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/monitor-application-usage-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/optimize-applocker-performance.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/plan-for-applocker-policy-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/refresh-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/requirements-to-use-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/script-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/security-considerations-for-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/select-types-of-rules-to-create.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/test-and-update-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/tools-to-use-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understand-applocker-enforcement-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-default-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-behavior.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-collections.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/using-event-viewer-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/what-is-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/windows-installer-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/working-with-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/applocker/working-with-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-enable-virtualization-based-security.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/enable-virtualization-based-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", -"redirect_url": "hhttps://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-family-options.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/microsoft-defender-atp/customize-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-views", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/graphics.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/prerelease.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/apis-intro.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/apis-intro", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/api-hello-world.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-hello-world", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-simulations", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/community", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-attack-surface-reduction.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction", -"redirect_document_id": true -}, - -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configuration-score.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-siem", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-splunk", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-retention-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/deprecate.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/deprecate", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/evaluate-atp.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-error-codes", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-files", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-ip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-user", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/licensing", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-reports", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-tags", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-edr.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-edr", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/management-apis.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/management-apis", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-incidents", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mssp-support", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/offboard-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-configure", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/onboard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-offline-machines.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/partner-applications.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/partner-applications", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/portal-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/powershell-example-code.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/use-apis.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preferences-setup", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/prerelease.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/prerelease", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/prerelease.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/python-example-code", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/python-example-code.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/rbac", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/response-actions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/response-actions", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-detection-test", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/service-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/time-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/use-custom-ti.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/whats-new-in-microsoft-defender-atp", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-security-center", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/block-untrusted-fonts-in-enterprise.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/block-untrusted-fonts-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/change-history-for-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/change-history-for-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/access-this-computer-from-the-network.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-duration.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-duration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-threshold.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-administrator-account-status.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-guest-account-status.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-rename-administrator-account.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-rename-guest-account.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/add-workstations-to-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/administer-security-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/allow-log-on-locally.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/allow-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/back-up-files-and-directories.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/bypass-traverse-checking.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/change-the-system-time.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/change-the-system-time", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/change-the-time-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/change-the-time-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-a-pagefile.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-a-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-a-token-object.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-a-token-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-global-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-global-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-permanent-shared-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-symbolic-links.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-symbolic-links", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": false -}, -{ -"source_path": "windows/device-security/security-policy-settings/debug-programs.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/debug-programs", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-locally.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enforce-password-history.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enforce-password-history", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/generate-security-audits.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/generate-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/increase-a-process-working-set.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/increase-scheduling-priority.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/kerberos-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/kerberos-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/load-and-unload-device-drivers.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/lock-pages-in-memory.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/log-on-as-a-batch-job.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/log-on-as-a-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/manage-auditing-and-security-log.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-password-age.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/minimum-password-age.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/minimum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/minimum-password-length.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/minimum-password-length", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/modify-an-object-label.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/modify-an-object-label", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/modify-firmware-environment-values.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-list-manager-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-list-manager-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/password-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/password-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/profile-single-process.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/profile-single-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/profile-system-performance.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/profile-system-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/remove-computer-from-docking-station.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/replace-a-process-level-token.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/restore-files-and-directories.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/restore-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-options.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-policy-settings-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shut-down-the-system.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shut-down-the-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/synchronize-directory-service-data.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-settings-optional-subsystems.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-rights-assignment.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-rights-assignment", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/device-guard-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/device-guard-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/advanced-security-audit-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/advanced-security-auditing-faq.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-account-lockout.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-application-generated", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-application-group-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-audit-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-authentication-policy-change.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-authorization-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-central-access-policy-staging.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-certification-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-computer-account-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-detailed-directory-service-replication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-detailed-file-share", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-directory-service-access.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-directory-service-replication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-distribution-group-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-dpapi-activity.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-file-share", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-file-system.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-connection", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-filtering-platform-packet-drop.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-group-membership.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-handle-manipulation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-ipsec-driver.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-extended-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-ipsec-main-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-quick-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-kerberos-authentication-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-kernel-object.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-logoff", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-logon.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-network-policy-server.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-account-logon-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-account-management-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-logonlogoff-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-object-access-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-policy-change-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-privilege-use-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-system-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-pnp-activity", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-process-creation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-process-termination", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-registry.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-removable-storage", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-rpc-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sam", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-security-group-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-security-state-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-security-system-extension.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sensitive-privilege-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-special-logon.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-system-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-user-account-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-user-device-claims", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-account-logon-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-account-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-directory-service-access.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-logon-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-object-access.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-privilege-use.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-process-tracking", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-system-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-security-audit-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-security-audit-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1100.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1102", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1104.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1105", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1108.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4608", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4610.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4611", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4612.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4614", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4615.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4616", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4618.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4621", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4622.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4624", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4625.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4626", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4627.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4634", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4647.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4648", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4649.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4656", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4657.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4658", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4660.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4661", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4662.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4663", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4664.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4671.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4672", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4673.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4674", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4675.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4688", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4689.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4690", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4691.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4692", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4693.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4694", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4695.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4696", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4697.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4698", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4699.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4700", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4701.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4702", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4703.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4704", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4705.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4706", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4707.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4713", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4714.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4715", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4716.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4717", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4718.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4719", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4720.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4722", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4723.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4724", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4725.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4726", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4731.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4732", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4733.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4734", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4735.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4738", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4739.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4740", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4741.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4742", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4743.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4749", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4750.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4751", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4752.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4753", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4764.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4765", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4766.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4767", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4768.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4769", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4770.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4771", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4772.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4773", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4774.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4775", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4776.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4777", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4778.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4779", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4780.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4781", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4782.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4793", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4794.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4798", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4799.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4800", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4801.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4802", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4803.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4816", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4817.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4818", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4819.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4826", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4864.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4865", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4866.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4867", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4902.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4904", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4905.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4906", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4907.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4908", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4909.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4910", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4911.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4912", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4913.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4928", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4929.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4930", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4931.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4932", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4933.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4934", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4935.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4936", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4937.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4944", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4945.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4946", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4947.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4948", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4949.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4950", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4951.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4952", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4953.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4954", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4956.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4957", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4958.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4964", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4985.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5024", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5025.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5027", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5028.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5029", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5030.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5031", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5032.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5033", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5034.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5035", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5037.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5038", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5039.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5051", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5056.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5057", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5058.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5059", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5060.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5061", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5062.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5063", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5064.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5065", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5066.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5067", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5068.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5069", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5070.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5136", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5137.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5138", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5139.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5140", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5141.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5142", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5143.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5144", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5145.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5148", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5149.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5150", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5151.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5152", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5153.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5154", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5155.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5156", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5157.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5158", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5159.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5168", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5376.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5377", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5378.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5447", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5632.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5633", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5712.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5888", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5889.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5890", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6144.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6145", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6281.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6400", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6401.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6402", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6403.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6404", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6405.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6406", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6407.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6408", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6409.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6410", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6416.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6419", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6420.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6421", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6422.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6423", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6424.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/file-system-global-object-access-auditing", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-claim-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-resource-attribute-definitions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/other-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/registry-global-object-access-auditing.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/security-auditing-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/view-the-security-event-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/administer-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/administer-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-architecture-and-components.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-architecture-and-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-functions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-functions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policies-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policies-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policies-design-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policies-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policy-use-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policy-use-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-processes-and-interactions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-processes-and-interactions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-the-application-identity-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-the-application-identity-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-the-appLocker-reference-device.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-the-appLocker-reference-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-for-packaged-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-applocker-default-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-planning-document.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-planning-document", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/delete-an-applocker-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/delete-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/deploy-the-applocker-policy-into-production.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-your-application-control-objectives.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-your-application-control-objectives", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/dll-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/dll-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-application-control-management-processes.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-application-control-management-processes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-application-list.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-application-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/edit-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/edit-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/edit-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/edit-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/enable-the-dll-rule-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/enable-the-dll-rule-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/enforce-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/enforce-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/executable-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/executable-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/how-applocker-works-techref.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/how-applocker-works-techref", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/maintain-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/manage-packaged-apps-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/merge-applocker-policies-manually.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/merge-applocker-policies-manually", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/monitor-application-usage-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/monitor-application-usage-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/optimize-applocker-performance.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/optimize-applocker-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/plan-for-applocker-policy-management.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/plan-for-applocker-policy-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/refresh-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/refresh-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/requirements-for-deploying-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/requirements-to-use-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/requirements-to-use-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/script-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/script-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/security-considerations-for-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/security-considerations-for-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/select-types-of-rules-to-create.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/test-and-update-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/test-and-update-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/tools-to-use-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/tools-to-use-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-enforcement-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-enforcement-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-policy-design-decisions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-default-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-behavior.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-collections.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-collections", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-condition-types.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-exceptions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/using-event-viewer-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/using-event-viewer-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/what-is-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/what-is-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/windows-installer-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/windows-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/working-with-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/working-with-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/working-with-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/working-with-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/change-history-for-device-security.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/change-history-for-device-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/enable-virtualization-based-protection-of-code-integrity.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/enable-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/get-support-for-security-baselines.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/get-support-for-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-compliance-toolkit-10.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/windows-10-mobile-security-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-10-mobile-security-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/windows-security-baselines.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/app-behavior-with-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/app-behavior-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/limitations-with-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/limitations-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/using-owa-with-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/using-owa-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/encrypted-hard-drive.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/encrypted-hard-drive", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/secure-the-windows-10-boot-process.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/secure-the-windows-10-boot-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/change-the-tpm-owner-password.md", -"redirect_url": "https://docs.microsoft.com/windows/securityhardware-protection/tpm/change-the-tpm-owner-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/how-windows-uses-the-tpm.md", -"redirect_url": "https://docs.microsoft.com/windows/securityhardware-protection/tpm/how-windows-uses-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/manage-tpm-commands.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/manage-tpm-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/manage-tpm-lockout.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/manage-tpm-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/tpm-fundamentals.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-fundamentals", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/tpm-recommendations.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-recommendations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-top-node.md", -"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-top-node", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bcd-settings-and-bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-basic-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-basic-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-countermeasures.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-group-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-management-for-enterprises.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-credential-theft-mitigation-guide-abstract.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/change-history-for-access-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/change-history-for-access-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/configure-s-mime.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/configure-s-mime", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/enterprise-certificate-pinning.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/enterprise-certificate-pinning", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/installing-digital-certificates-on-windows-10-mobile.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/remote-credential-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/basic-firewall-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/boundary-zone-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/boundary-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/boundary-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-group-policy-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-authentication-methods.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-authentication-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-windows-firewall-log.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-a-group-account-in-active-directory.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-a-group-policy-object.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-a-group-policy-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-authentication-request-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-icmp-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-port-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-outbound-port-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/documenting-the-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/documenting-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design-example.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/enable-predefined-inbound-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/enable-predefined-outbound-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/encryption-zone-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/encryption-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/encryption-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/exempt-icmp-from-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/exemption-list.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/exemption-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/firewall-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/firewall-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/firewall-policy-design-example.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/firewall-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-other-relevant-information.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-the-information-you-need.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-boundary.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-encryption.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-firewall.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolated-domain-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolated-domain-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolated-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolating-apps-on-your-network.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/link-the-gpo-to-the-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-certificate-based-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-domain-isolation-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-gpo-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-gpo-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-network-access-groups.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-network-access-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-server-isolation-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-the-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-the-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/procedures-used-in-this-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design-example.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-auto-trigger-profile.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-auto-trigger-profile", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-conditional-access.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-connection-type.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-connection-type", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-name-resolution.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-name-resolution", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-profile-options.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-routing.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-routing", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-security-features.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-security-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/how-user-account-control-works.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/how-user-account-control-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-security-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-debugging-information.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-debugging-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-events.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-removal-policy-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-tools-and-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-and-remote-desktop-services.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-architecture.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-certificate-propagation-service.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-and-password-changes.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-and-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-biometrics-in-enterprise.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-adfs.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-deploy-mfa.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-pki.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-cert-trust.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-key-trust.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-errors-during-pin-creation.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-event-300.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-event-300", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-features.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-how-it-works.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-identity-verification.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-adfs.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-manage-in-organization.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-planning-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-planning-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-prepare-people-to-use.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/additional-mitigations.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/additional-mitigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-considerations.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-how-it-works.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-known-issues.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-known-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-manage.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-not-protected-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-protection-limits.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-protection-limits", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-scripts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/access-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/active-directory-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/active-directory-security-groups.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/dynamic-access-control.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/dynamic-access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/local-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/microsoft-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/security-identifiers.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/security-identifiers", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/security-principals.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/security-principals", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/service-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/service-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/special-identities.md", -"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/special-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-steps.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface/surface-device-compatibility-with-windows-10-ltsb.md", -"redirect_url": "https://docs.microsoft.com/surface/surface-device-compatibility-with-windows-10-ltsc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/windows-diagnostic-data-1709.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-diagnostic-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/EventName.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/enhanced-telemetry-windows-analytics-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "education/windows/windows-10-pro-to-pro-edu-upgrade.md", -"redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", -"redirect_document_id": false -}, -{ -"source_path": "education/windows/switch-to-pro-education.md", -"redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", -"redirect_document_id": false -}, -{ - "source_path": "education/windows/swithc-to-pro-de.md", - "redirect_url": "https://docs.microsoft.com/education/windows/switch-to-pro-education", - "redirect_document_id": false + "redirections": [ + { + "source_path": "security/threat-protection/windows-defender-application-control/signing-policies-with-signtool.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering", + "redirect_document_id": true }, -{ -"source_path": "windows/client-management/mdm/policy-admx-backed.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", -"redirect_document_id": true -}, -{ -"source_path": "windows/client-management/mdm/policy-csp-location.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/configure-windows-defender-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-pua-windows-defender-for-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/get-started-with-windows-defender-for-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-block-at-first-sight.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-enhanced-notifications.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-7.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface/surface-diagnostic-toolkit.md", -"redirect_url": "https://docs.microsoft.com/surface/index", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface/manage-surface-dock-firmware-updates.md", -"redirect_url": "https://docs.microsoft.com/surface/indexdevices/surface/update", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md", -"redirect_url": "https://docs.microsoft.com/surface-hub/finishing-your-surface-hub-meeting", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-microsoft-layout-app.md", -"redirect_url": "https://docs.microsoft.com/hololens/hololens-microsoft-dynamics-365-layout-app", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-microsoft-dynamics-365-layout-app.md", -"redirect_url": "https://docs.microsoft.com/dynamics365/mixed-reality/layout/", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-microsoft-remote-assist-app.md", -"redirect_url": "https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/", -"redirect_document_id": true -}, -{ -"source_path": "devices/hololens/hololens-public-preview-apps.md", -"redirect_url": "https://docs.microsoft.com/dynamics365/#pivot=mixed-reality-apps", -"redirect_document_id": true -}, -{ - "source_path": "devices/hololens/hololens-restart-recover.md", - "redirect_url": "/hololens/hololens-recovery", - "redirect_document_id": false -}, -{ - "source_path": "devices/hololens/holographic-photos-and-video.md", - "redirect_url": "/hololens/holographic-photos-and-videos", - "redirect_document_id": false -}, -{ -"source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", -"redirect_url": "https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md", -"redirect_url": "https://docs.microsoft.com/surface-hub/admin-group-management-for-surface-hub", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/surface-hub-administrators-guide.md", -"redirect_url": "/surface-hub/index", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/intro-to-surface-hub.md", -"redirect_url": "https://docs.microsoft.com/surface-hub/index", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/waas-quick-start.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-quick-start", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-servicing-strategy-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-deployment-rings-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-branches-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/update-compliance-monitor.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/update-compliance-get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/update-compliance-wdav-status.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/update-compliance-using.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-optimize-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-delivery-optimization.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-branchcache.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-branchcache", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-mobile-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-mobile-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-manage-updates-wufb.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-configure-wufb.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-integrate-wufb.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-integrate-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-wufb-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-wufb-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-manage-updates-wsus.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-manage-updates-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-restart.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-restart", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/waas-update-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/lockdown-features-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/set-up-shared-or-guest-pc.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", -"redirect_document_id": false -}, -{ -"source_path": "windows/configuration/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/guidelines-for-assigned-access-app.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/lock-down-windows-10-to-specific-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/lockdown-xml.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/lockdown-xml", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/settings-that-can-be-locked-down.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/settings-that-can-be-locked-down", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/product-ids-in-windows-10-mobile.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-tips-and-suggestions.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-tips-and-suggestions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-10-start-layout-options-and-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/configure-windows-10-taskbar.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration//configure-windows-10-taskbar", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/customize-and-export-start-layout.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration//customize-and-export-start-layout", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/start-layout-xml-desktop.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/start-layout-xml-mobile.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/start-layout-xml-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/customize-windows-10-start-screens-by-using-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-testing-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-1.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-2.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-3.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-4.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-5.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-scenario-6.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-o365.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-crm.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-crm", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-powerbi.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-powerbi", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-voice-commands.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-feedback.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-feedback", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/stop-employees-from-using-the-windows-store.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-the-windows-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/stop-employees-from-using-the-windows-store.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/configure-devices-without-mdm.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/changes-to-start-policies-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/changes-to-start-policies-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/how-it-pros-can-use-configuration-service-providers.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/lock-down-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-wifi-sense-in-enterprise.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-wifi-sense-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-how-it-works.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-install-icd.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-install-icd", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-create-package.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-apply-package.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-uninstall-package.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-uninstall-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provision-pcs-for-initial-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provision-pcs-with-apps-and-certificates.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-script-to-install-app.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-script-to-install-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-nfc.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-nfc", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-command-line.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-command-line", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/provisioning-multivariant.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-multivariant", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-edp-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-edp-policy-using-sccm.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-vpn-and-edp-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-enable-phone-signin.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/deploy-edp-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/guidance-and-best-practices-edp.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/overview-create-edp-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/overview-create-wip-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-enterprise-data-using-edp.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/testing-scenarios-for-edp.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/wip-enterprise-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/enlightened-microsoft-apps-and-edp.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/update-windows-10-images-with-provisioning-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": false -}, -{ -"source_path": "windows/deploy/upgrade-analytics-prepare-your-environment.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-release-notes.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-review-site-discovery.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md", -"redirect_url": "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj635854(v=ws.11)", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/device-guard-certification-and-compliance.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-enable-phone-signin", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/implement-microsoft-passport-in-your-organization.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-manage-in-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-identity-verification-using-microsoft-passport.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-passport-and-password-changes.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-and-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-passport-errors-during-pin-creation.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-passport-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/passport-event-300.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-event-300", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/prepare-people-to-use-microsoft-passport.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-prepare-people-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/why-a-pin-is-better-than-a-password.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-hello-in-enterprise.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/app-inventory-managemement-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/app-inventory-management-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/application-development-for-windows-as-a-service.md", -"redirect_url": "https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-accessibility.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-getting-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-accessing-the-client-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-using-the-client-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/disconnect-your-organization-from-microsoft.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/introduction-to-windows-10-servicing.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-cortana-in-enterprise.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/cortana-at-work-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/manage-inventory-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/app-inventory-managemement-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-accessibility.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-privacy-statement.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-security-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/act-community-ratings-and-process.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/act-database-configuration.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-database-migration.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-deployment-options.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-glossary.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/activating-and-closing-windows-in-acm.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-lps-share-permissions.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-operatingsystem-application-report.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-operatingsystem-computer-report.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-operatingsystem-device-report.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-product-and-documentation-resources.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-settings-dialog-box-preferences-tab.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-settings-dialog-box-settings-tab.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-toolbar-icons-in-acm.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-tools-packages-and-services.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/act-user-interface-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/adding-or-editing-an-issue.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/adding-or-editing-a-solution.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/analyzing-your-compatibility-data.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/application-dialog-box.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/categorizing-your-compatibility-data.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/chromebook-migration-guide.md", -"redirect_url": "edu/windows/chromebook-migration-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/common-compatibility-issues.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/compatibility-monitor-users-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/computer-dialog-box.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/configuring-act.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/creating-and-editing-issues-and-solutions.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/creating-an-inventory-collector-package.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/creating-a-runtime-analysis-package.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/customizing-your-report-views.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deciding-which-applications-to-test.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deleting-a-data-collection-package.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deploying-an-inventory-collector-package.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deploying-a-runtime-analysis-package.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/deploy-windows-10-in-a-school.md", -"redirect_url": "/edu/windows/deploy-windows-10-in-a-school", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/example-filter-queries.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/exporting-a-data-collection-package.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/filtering-your-compatibility-data.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/fixing-compatibility-issues.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/identifying-computers-for-inventory-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/integration-with-management-solutions-.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/internet-explorer-web-site-report.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/labeling-data-in-acm.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/log-file-locations-for-data-collection-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/managing-your-data-collection-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/organizational-tasks-for-each-report-type.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/organizing-your-compatibility-data.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/prioritizing-your-compatibility-data.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/ratings-icons-in-acm.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/resolving-an-issue.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/saving-opening-and-exporting-reports.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/selecting-the-send-and-receive-status-for-an-application.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/selecting-your-compatibility-rating.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/selecting-your-deployment-status.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/sending-and-receiving-compatibility-data.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/settings-for-acm.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/setup-and-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/software-requirements-for-act.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/software-requirements-for-rap.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/taking-inventory-of-your-organization.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/testing-compatibility-on-the-target-platform.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/troubleshooting-act.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/troubleshooting-act-database-issues.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/troubleshooting-the-act-configuration-wizard.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/troubleshooting-the-act-log-processing-service.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/using-act.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/using-compatibility-monitor-to-send-feedback.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/viewing-your-compatibility-reports.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/websiteurl-dialog-box.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/welcome-to-act.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/whats-new-in-act-60.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/windows-10-guidance-for-education-environments.md", -"redirect_url": "https://docs.microsoft.com/education/windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-servicing-options.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/plan/windows-update-for-business.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/change-history-for-what-s-new-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/whats-new/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/credential-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/device-guard-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/device-management.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/index", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/edge-ie11-whats-new-overview.md", -"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/edp-whats-new-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/lockdown-features-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/microsoft-passport.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/new-provisioning-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/security-auditing.md", -"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/trusted-platform-module.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/user-account-control.md", -"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/whats-new/windows-spotlight.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/windows-store-for-business-overview.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/windows-store-for-business-overview.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/microsoft-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/windows-update-for-business.md", -"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/windows-10-security-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/whats-new/security.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": false -}, -{ -"source_path": "windows/configure/basic-level-windows-diagnostic-events-and-fields-1703.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/change-history-for-configure-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/change-history-for-configure-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/changes-to-start-policies-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/changes-to-start-policies-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/configure-devices-without-mdm.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-devices-without-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/configure-devices-without-mdm.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/configure-mobile.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/configure-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/configure-windows-10-taskbar.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-10-taskbar", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-crm.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-crm", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-feedback.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-feedback", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-o365.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-powerbi.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-powerbi", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-1.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-2.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-3.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-4.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-5.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-6.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-scenario-7.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-testing-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/cortana-at-work-voice-commands.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/customize-and-export-start-layout.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-and-export-start-layout", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/customize-windows-10-start-screens-by-using-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/guidelines-for-assigned-access-app.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/how-it-pros-can-use-configuration-service-providers.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/kiosk-shared-pc.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/kiosk-shared-pc.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/setup-kiosk-digital-signage.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-single-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/multi-app-kiosk-xml.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-xml", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/multi-app-kiosk-troubleshoot.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-troubleshoot", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/lock-down-windows-10-to-specific-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/lock-down-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/lockdown-features-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/lockdown-xml.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/lockdown-xml", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/manage-tips-and-suggestions.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-tips-and-suggestions", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/manage-wifi-sense-in-enterprise.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-wifi-sense-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/mobile-lockdown-designer.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/mobile-lockdown-designer", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/product-ids-in-windows-10-mobile.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provision-pcs-for-initial-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provision-pcs-with-apps-and-certificates.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provision-pcs-with-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-apply-package.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-command-line.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-command-line", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-configure-mobile.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-configure-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-create-package.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-how-it-works.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-install-icd.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-install-icd", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-multivariant.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-multivariant", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-nfc.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-nfc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-package-splitter.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-package-splitter", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-script-to-install-app.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-script-to-install-app", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/provisioning-uninstall-package.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-uninstall-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-device-for-anyone-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", -"redirect_document_id": true -}, -{ - "source_path": "windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", - "redirect_url": "https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage", - "redirect_document_id": true -}, -{ -"source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/set-up-shared-or-guest-pc.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/settings-that-can-be-locked-down.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/settings-that-can-be-locked-down", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/start-layout-xml-desktop.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/start-layout-xml-mobile.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/start-layout-xml-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/start-secondary-tiles.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/start-secondary-tiles", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/start-taskbar-lockscreen.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/start-taskbar-lockscreen", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/start-taskbar-lockscreen.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/stop-employees-from-using-the-windows-store.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-the-windows-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/windows-10-start-layout-options-and-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/windows-diagnostic-data-1703.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-diagnostic-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/windows-spotlight.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-spotlight.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-forest-by-proxy-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-by-proxy-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-forest-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-using-active-directory-based-activation-client.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-using-key-management-service-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-using-key-management-service-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/activate-windows-10-clients-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-windows-10-clients-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/active-directory-based-activation-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/active-directory-based-activation-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-manage-products-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-manage-products-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-remove-computers-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-remove-computers-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/add-remove-product-key-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-remove-product-key-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/assign-applications-using-roles-in-mdt-2013.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/assign-applications-using-roles-in-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/change-history-for-deploy-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/change-history-for-deploy-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-a-pxe-server-to-load-windows-pe.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/configure-a-pxe-server-to-load-windows-pe", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-client-computers-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/configure-client-computers-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-2013-for-userexit-scripts.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-2013-for-userexit-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-2013-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-2013-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-deployment-share-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-for-userexit-scripts.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/configure-mdt-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/create-a-windows-10-reference-image.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-a-windows-10-image-using-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-whats-new.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-whats-new", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/deploy-windows-to-go.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/getting-started-with-the-user-state-migration-tool.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/import-export-vamt-data.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/import-export-vamt-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/install-configure-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-configure-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/install-kms-client-key-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-kms-client-key-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/install-product-key-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-product-key-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/install-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/introduction-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/introduction-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/key-features-in-mdt-2013.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/key-features-in-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/key-features-in-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/key-features-in-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/kms-activation-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/kms-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/local-reactivation-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/local-reactivation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-activations-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-activations-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-product-keys-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-product-keys-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-vamt-data.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-vamt-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-analytics.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-readiness.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/mbr-to-gpt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/mbr-to-gpt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/mdt-2013-lite-touch-components.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/mdt-2013-lite-touch-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/mdt-lite-touch-components.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/migrate-application-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/migrate-application-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/migration-store-types-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/migration-store-types-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/monitor-activation-client.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/monitor-activation-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/offline-migration-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/offline-migration-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/online-activation-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/online-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/plan-for-volume-activation-client.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/plan-for-volume-activation-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/proxy-activation-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/proxy-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/refresh-a-windows-7-computer-with-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/remove-products-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/remove-products-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/resolve-windows-10-upgrade-errors.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/resolve-windows-10-upgrade-errors", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/scenario-kms-activation-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-kms-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/scenario-online-activation-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-online-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/scenario-proxy-activation-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-proxy-activation-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/set-up-mdt-2013-for-bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-2013-for-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/set-up-mdt-for-bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/sideload-apps-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/sideload-apps-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/troubleshoot-upgrade-analytics.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/troubleshoot-upgrade-readiness.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", -"redirect_document_id": false -}, -{ -"source_path": "windows/deploy/understanding-migration-xml-files.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/understanding-migration-xml-files", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/update-product-status-vamt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/update-product-status-vamt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-additional-insights.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-architecture.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-deploy-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deploy-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-deployment-script.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-identify-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-resolve-issues.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-resolve-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-analytics-upgrade-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-additional-insights.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-architecture.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-deploy-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deploy-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-deployment-script.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-identify-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-release-notes.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-release-notes", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-resolve-issues.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-resolve-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-upgrade-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-windows-phone-8-1-to-10.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-the-volume-activation-management-tool-client.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-upgrade-readiness-to-manage-windows-upgrades.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", -"redirect_document_id": false -}, -{ -"source_path": "windows/deploy/use-vamt-in-windows-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/use-vamt-in-windows-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-web-services-in-mdt-2013.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt-2013", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/use-web-services-in-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-best-practices.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-best-practices", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-choose-migration-store-type.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-choose-migration-store-type", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-command-line-syntax.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-command-line-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-common-issues.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-common-migration-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-common-migration-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-configxml-file.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-configxml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-conflicts-and-precedence.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-conflicts-and-precedence", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-custom-xml-examples.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-custom-xml-examples", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-customize-xml-files.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-customize-xml-files", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-determine-what-to-migrate.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-determine-what-to-migrate", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-estimate-migration-store-size.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-estimate-migration-store-size", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-exclude-files-and-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-exclude-files-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-faq.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-faq", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-general-conventions.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-general-conventions", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-hard-link-migration-store.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-hard-link-migration-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-how-it-works.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-how-to.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-how-to", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-identify-application-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-application-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-identify-file-types-files-and-folders.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-file-types-files-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-identify-operating-system-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-operating-system-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-identify-users.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-include-files-and-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-include-files-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-loadstate-syntax.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-loadstate-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-log-files.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-log-files", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-migrate-efs-files-and-certificates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-migrate-user-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migrate-user-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-migration-store-encryption.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migration-store-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-plan-your-migration.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-plan-your-migration", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-recognized-environment-variables.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-recognized-environment-variables", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-reroute-files-and-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-reroute-files-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-resources.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-resources", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-return-codes.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-return-codes", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-scanstate-syntax.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-scanstate-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-test-your-migration.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-test-your-migration", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-topics.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-topics", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-troubleshooting.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-troubleshooting", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-utilities.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-utilities", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-what-does-usmt-migrate.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-what-does-usmt-migrate", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-xml-elements-library.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-xml-elements-library", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/usmt-xml-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-xml-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/vamt-known-issues.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-known-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/vamt-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/vamt-step-by-step.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-step-by-step", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/verify-the-condition-of-a-compressed-migration-store.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/volume-activation-management-tool.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-management-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/volume-activation-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-deployment-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-deployment-tools-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-tools-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-edition-upgrades.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-enterprise-e3-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-enterprise-e3-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-poc-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc-mdt", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-poc-sc-config-mgr.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc-sc-config-mgr", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-poc.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-10-upgrade-paths.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-upgrade-paths", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-adk-scenarios-for-it-pros.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-adk-scenarios-for-it-pros", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-deployment-scenarios-and-tools.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-deployment-scenarios-and-tools", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/windows-upgrade-and-migration-considerations.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-upgrade-and-migration-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/xml-file-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/xml-file-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/access-control.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/access-credential-manager-as-a-trusted-caller.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/access-this-computer-from-the-network.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/access-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/account-lockout-duration.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-duration", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/account-lockout-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/account-lockout-threshold.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/account-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-administrator-account-status.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-administrator-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-block-microsoft-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-guest-account-status.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-guest-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-rename-administrator-account.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-rename-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/accounts-rename-guest-account.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-rename-guest-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/act-as-part-of-the-operating-system.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/active-directory-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/active-directory-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/active-directory-security-groups.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/active-directory-security-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/add-workstations-to-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/add-workstations-to-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/additional-mitigations.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/additional-mitigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/adjust-memory-quotas-for-a-process.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/administer-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/administer-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/administer-security-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/administer-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/advanced-security-audit-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/advanced-security-auditing-faq.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-auditing-faq", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/advanced-security-auditing.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-auditing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/allow-log-on-locally.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/allow-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/allow-log-on-through-remote-desktop-services.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/app-behavior-with-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/app-behavior-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-architecture-and-components.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-architecture-and-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-functions.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-functions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-policies-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policies-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-policies-design-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policies-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-policy-use-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policy-use-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-processes-and-interactions.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-processes-and-interactions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/applocker-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/assign-security-group-filters-to-the-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-account-lockout.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-account-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-application-generated.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-application-generated", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-application-group-management.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-application-group-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-audit-policy-change.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-audit-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-audit-the-access-of-global-system-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-authentication-policy-change.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-authentication-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-authorization-policy-change.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-authorization-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-central-access-policy-staging.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-central-access-policy-staging", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-certification-services.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-certification-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-computer-account-management.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-computer-account-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-credential-validation.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-credential-validation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-detailed-directory-service-replication.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-detailed-directory-service-replication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-detailed-file-share.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-detailed-file-share", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-directory-service-access.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-directory-service-changes.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-directory-service-replication.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-replication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-distribution-group-management.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-distribution-group-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-dpapi-activity.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-dpapi-activity", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-file-share.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-file-share", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-file-system.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-file-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-filtering-platform-connection.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-connection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-filtering-platform-packet-drop.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-packet-drop", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-filtering-platform-policy-change.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-group-membership.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-group-membership", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-handle-manipulation.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-handle-manipulation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-ipsec-driver.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-driver", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-ipsec-extended-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-extended-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-ipsec-main-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-main-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-ipsec-quick-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-quick-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-kerberos-authentication-service.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kerberos-authentication-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-kerberos-service-ticket-operations.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kerberos-service-ticket-operations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-kernel-object.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kernel-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-logoff.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-logoff", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-logon.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-mpssvc-rule-level-policy-change.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-network-policy-server.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-network-policy-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-non-sensitive-privilege-use.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-non-sensitive-privilege-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-account-logon-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-account-logon-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-account-management-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-account-management-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-logonlogoff-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-logonlogoff-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-object-access-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-object-access-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-policy-change-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-policy-change-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-privilege-use-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-privilege-use-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-other-system-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-system-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-pnp-activity.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-pnp-activity", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-process-creation.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-process-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-process-termination.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-process-termination", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-registry.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-registry", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-removable-storage.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-removable-storage", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-rpc-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-rpc-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-sam.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-sam", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-security-group-management.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-group-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-security-state-change.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-state-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-security-system-extension.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-system-extension", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-sensitive-privilege-use.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-sensitive-privilege-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-special-logon.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-special-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-system-integrity.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-system-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-user-account-management.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-user-account-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/audit-user-device-claims.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-user-device-claims", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/back-up-files-and-directories.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/back-up-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-account-logon-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-account-logon-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-account-management.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-account-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-directory-service-access.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-directory-service-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-logon-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-logon-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-object-access.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-object-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-policy-change.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-policy-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-privilege-use.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-privilege-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-process-tracking.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-process-tracking", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-audit-system-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-system-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-firewall-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-security-audit-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-security-audit-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/basic-security-audit-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bcd-settings-and-bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bcd-settings-and-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-basic-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-basic-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-countermeasures.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-countermeasures", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-device-encryption-overview-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-frequently-asked-questions.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-frequently-asked-questions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-group-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-how-to-enable-network-unlock.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-recovery-guide-plan.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-recovery-guide-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/block-untrusted-fonts-in-enterprise.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/block-untrusted-fonts-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/boundary-zone-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/boundary-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/boundary-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/bypass-traverse-checking.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/bypass-traverse-checking", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/certificate-based-isolation-policy-design-example.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/certificate-based-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-rules-from-request-to-require-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-the-system-time.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/change-the-system-time", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-the-time-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/change-the-time-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-the-tpm-owner-password.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/change-the-tpm-owner-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-basic-firewall-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-creating-group-policy-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-group-policy-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-creating-inbound-firewall-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-creating-outbound-firewall-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/command-line-arguments-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configuration-management-reference-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-authentication-methods.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-authentication-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-data-protection-quick-mode-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-email-notifications-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-key-exchange-main-mode-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-network-connections-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-notifications-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-protection-features-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-remediation-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-s-mime.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/configure-s-mime", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-application-identity-service.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-the-application-identity-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-appLocker-reference-device.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-the-appLocker-reference-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-rules-to-require-encryption.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-windows-firewall-log.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-windows-firewall-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-the-workstation-authentication-certificate-template.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-windows-defender-antivirus-features.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-group-account-in-active-directory.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-a-group-account-in-active-directory", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-group-policy-object.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-a-group-policy-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-pagefile.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-rule-for-packaged-apps.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-for-packaged-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-a-token-object.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-token-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-authentication-exemption-list-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-authentication-request-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-authentication-request-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-inbound-icmp-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-icmp-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-inbound-port-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-inbound-program-or-service-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-outbound-port-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-outbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-an-outbound-program-or-service-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-and-verify-an-efs-dra-certificate.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-applocker-default-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-global-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-global-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-inbound-rules-to-support-rpc.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-permanent-shared-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-permanent-shared-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-symbolic-links.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-symbolic-links", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-wip-policy-using-sccm.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-wmi-filters-for-the-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-your-applocker-planning-document.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-planning-document", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-your-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/create-your-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-considerations.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-how-it-works.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-manage.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-manage", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-not-protected-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-not-protected-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-protection-limits.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-protection-limits", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard-scripts.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/credential-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/customize-run-review-remediate-scans-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/debug-programs.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/debug-programs", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/delete-an-applocker-rule.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/delete-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-access-to-this-computer-from-the-network.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-log-on-as-a-batch-job.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-log-on-as-a-service.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-log-on-locally.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deny-log-on-through-remote-desktop-services.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-code-integrity-policies-steps.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-code-integrity-policies-steps", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-the-applocker-policy-into-production.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/deploy-the-applocker-policy-into-production", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-wip-policy-using-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deployment-vdi-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/determine-your-application-control-objectives.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-your-application-control-objectives", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/determining-the-trusted-state-of-your-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/device-guard-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-allow-undock-without-having-to-log-on.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dll-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/dll-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/document-your-application-control-management-processes.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-application-control-management-processes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/document-your-application-list.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-application-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/document-your-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/documenting-the-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/documenting-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-controller-ldap-server-signing-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-isolation-policy-design-example.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/domain-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-disable-machine-account-password-changes.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-maximum-machine-account-password-age.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/dynamic-access-control.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/dynamic-access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/edit-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/edit-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/edit-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/edit-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-predefined-inbound-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/enable-predefined-inbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-predefined-outbound-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/enable-predefined-outbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-the-dll-rule-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/enable-the-dll-rule-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/encrypted-hard-drive.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/encrypted-hard-drive", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/encryption-zone-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/encryption-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/encryption-zone.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enforce-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/enforce-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enforce-password-history.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enforce-password-history", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enforce-user-logon-restrictions.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enforce-user-logon-restrictions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enlightened-microsoft-apps-and-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enterprise-certificate-pinning.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/enterprise-certificate-pinning", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/evaluate-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1100.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1100", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1102.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1102", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1104.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1104", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1105.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1105", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-1108.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1108", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4608.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4608", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4610.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4610", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4611.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4611", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4612.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4612", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4614.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4614", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4615.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4615", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4616.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4616", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4618.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4618", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4621.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4621", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4622.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4622", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4624.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4624", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4625.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4625", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4626.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4626", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4627.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4627", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4634.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4634", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4647.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4647", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4648.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4648", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4649.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4649", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4656.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4656", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4657.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4657", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4658.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4658", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4660.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4660", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4661.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4661", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4662.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4662", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4663.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4663", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4664.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4664", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4670.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4670", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4671.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4671", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4672.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4672", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4673.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4673", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4674.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4674", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4675.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4675", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4688.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4688", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4689.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4689", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4690.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4690", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4691.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4691", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4692.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4692", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4693.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4693", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4694.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4694", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4695.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4695", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4696.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4696", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4697.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4697", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4698.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4698", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4699.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4699", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4700.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4700", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4701.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4701", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4702.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4702", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4703.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4703", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4704.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4704", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4705.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4705", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4706.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4706", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4707.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4707", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4713.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4713", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4714.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4714", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4715.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4715", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4716.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4716", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4717.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4717", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4718.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4718", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4719.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4719", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4720.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4720", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4722.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4722", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4723.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4723", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4724.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4724", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4725.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4725", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4726.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4726", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4731.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4731", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4732.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4732", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4733.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4733", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4734.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4734", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4735.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4735", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4738.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4738", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4739.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4739", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4740.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4740", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4741.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4741", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4742.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4742", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4743.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4743", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4749.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4749", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4750.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4750", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4751.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4751", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4752.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4752", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4753.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4753", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4764.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4764", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4765.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4765", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4766.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4766", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4767.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4767", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4768.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4768", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4769.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4769", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4770.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4770", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4771.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4771", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4772.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4772", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4773.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4773", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4774.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4774", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4775.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4775", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4776.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4776", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4777.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4777", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4778.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4778", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4779.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4779", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4780.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4780", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4781.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4781", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4782.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4782", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4793.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4793", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4794.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4794", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4798.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4798", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4799.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4799", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4800.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4800", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4801.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4801", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4802.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4802", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4803.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4803", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4816.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4816", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4817.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4817", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4818.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4818", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4819.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4819", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4826.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4826", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4864.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4864", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4865.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4865", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4866.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4866", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4867.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4867", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4902.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4902", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4904.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4904", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4905.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4905", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4906.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4906", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4907.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4907", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4908.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4908", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4909.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4909", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4910.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4910", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4911.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4911", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4912.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4912", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4913.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4913", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4928.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4928", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4929.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4929", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4930.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4930", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4931.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4931", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4932.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4932", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4933.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4933", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4934.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4934", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4935.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4935", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4936.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4936", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4937.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4937", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4944.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4944", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4945.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4945", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4946.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4946", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4947.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4947", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4948.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4948", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4949.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4949", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4950.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4950", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4951.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4951", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4952.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4952", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4953.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4953", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4954.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4954", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4956.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4956", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4957.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4957", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4958.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4958", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4964.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4964", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-4985.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4985", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5024.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5024", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5025.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5025", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5027.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5027", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5028.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5028", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5029.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5029", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5030.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5030", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5031.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5031", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5032.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5032", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5033.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5033", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5034.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5034", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5035.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5035", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5037.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5037", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5038.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5038", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5039.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5039", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5051.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5051", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5056.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5056", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5057.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5057", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5058.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5058", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5059.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5059", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5060.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5060", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5061.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5061", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5062.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5062", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5063.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5063", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5064.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5064", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5065.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5065", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5066.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5066", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5067.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5067", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5068.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5068", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5069.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5069", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5070.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5070", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5136.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5136", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5137.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5137", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5138.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5138", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5139.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5139", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5140.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5140", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5141.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5141", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5142.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5142", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5143.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5143", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5144.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5144", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5145.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5145", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5148.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5148", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5149.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5149", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5150.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5150", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5151.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5151", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5152.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5152", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5153.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5153", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5154.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5154", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5155.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5155", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5156.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5156", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5157.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5157", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5158.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5158", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5159.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5159", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5168.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5168", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5376.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5376", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5377.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5377", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5378.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5378", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5447.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5447", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5632.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5632", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5633.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5633", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5712.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5712", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5888.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5888", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5889.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5889", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-5890.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5890", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6144.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6144", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6145.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6145", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6281.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6281", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6400.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6400", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6401.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6401", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6402.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6402", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6403.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6403", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6404.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6404", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6405.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6405", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6406.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6406", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6407.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6407", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6408.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6408", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6409.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6409", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6410.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6410", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6416.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6416", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6419.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6419", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6420.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6420", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6421.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6421", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6422.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6422", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6423.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6423", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-6424.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6424", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/executable-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/executable-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/exempt-icmp-from-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/exempt-icmp-from-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/exemption-list.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/exemption-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/file-system-global-object-access-auditing.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/file-system-global-object-access-auditing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/firewall-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/firewall-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/firewall-policy-design-example.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/firewall-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/force-shutdown-from-a-remote-system.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-information-about-your-active-directory-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-information-about-your-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-other-relevant-information.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-other-relevant-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gathering-the-information-you-need.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-the-information-you-need", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/generate-security-audits.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/generate-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-boundary.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-boundary", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-encryption.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-firewall.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-isolateddomain-clients.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/gpo-domiso-isolateddomain-servers.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/guidance-and-best-practices-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-and-password-changes.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-and-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-biometrics-in-enterprise.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-errors-during-pin-creation.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-event-300.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-event-300", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-how-it-works.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-identity-verification.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-manage-in-organization.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-manage-in-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-prepare-people-to-use.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-prepare-people-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/hello-why-pin-is-better-than-password.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/how-applocker-works-techref.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/how-applocker-works-techref", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/how-to-configure-security-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/how-user-account-control-works.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/how-user-account-control-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/impersonate-a-client-after-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/import-an-applocker-policy-from-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/increase-a-process-working-set.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/increase-a-process-working-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/increase-scheduling-priority.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/increase-scheduling-priority", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/installing-digital-certificates-on-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-do-not-display-last-user-name.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-machine-inactivity-limit.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-require-smart-card.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-require-smart-card", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/interactive-logon-smart-card-removal-behavior.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/isolated-domain-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolated-domain-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/isolated-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/isolating-apps-on-your-network.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolating-apps-on-your-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/kerberos-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/kerberos-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/limitations-with-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/limitations-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/link-the-gpo-to-the-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/link-the-gpo-to-the-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/load-and-unload-device-drivers.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/load-and-unload-device-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/local-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/lock-pages-in-memory.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/lock-pages-in-memory", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/log-on-as-a-batch-job.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/log-on-as-a-service.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maintain-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-auditing-and-security-log.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/manage-auditing-and-security-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-packaged-apps-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/manage-packaged-apps-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-tpm-commands.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/manage-tpm-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-tpm-lockout.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/manage-tpm-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-updates-baselines-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/mandatory-settings-for-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-lifetime-for-service-ticket.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-password-age.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/merge-applocker-policies-manually.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/merge-applocker-policies-manually", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/minimum-password-age.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/minimum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/minimum-password-length.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/minimum-password-length", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/modify-an-object-label.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/modify-an-object-label", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/modify-firmware-environment-values.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/modify-firmware-environment-values", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-application-usage-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/monitor-application-usage-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-claim-types.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-claim-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-resource-attribute-definitions.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-resource-attribute-definitions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-the-use-of-removable-storage-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-allow-anonymous-sidname-translation.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-list-manager-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-list-manager-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-lan-manager-authentication-level.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-ldap-client-signing-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/open-windows-firewall-with-advanced-security.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/optimize-applocker-performance.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/optimize-applocker-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/other-events.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/other-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/override-mitigation-options-for-app-related-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/overview-create-wip-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/overview-create-wip-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/password-must-meet-complexity-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/password-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/password-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/perform-volume-maintenance-tasks.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/plan-for-applocker-policy-management.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/plan-for-applocker-policy-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-certificate-based-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-certificate-based-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-domain-isolation-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-domain-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-gpo-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-gpo-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-isolation-groups-for-the-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-network-access-groups.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-network-access-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-server-isolation-zones.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-server-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-the-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-the-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/prevent-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/preview-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/procedures-used-in-this-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/procedures-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/profile-single-process.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/profile-single-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/profile-system-performance.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/profile-system-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-devices-from-unwanted-network-traffic.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-enterprise-data-using-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/recommended-network-definitions-for-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/refresh-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/refresh-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/registry-global-object-access-auditing.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/registry-global-object-access-auditing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/remote-credential-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/remote-credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/remove-computer-from-docking-station.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/remove-computer-from-docking-station", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/replace-a-process-level-token.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/replace-a-process-level-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/report-monitor-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/requirements-for-deploying-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/requirements-for-deploying-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/requirements-to-use-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/requirements-to-use-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/reset-account-lockout-counter-after.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/reset-account-lockout-counter-after", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/restore-files-and-directories.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/restore-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/restrict-access-to-only-trusted-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/review-scan-results-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/run-scan-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/run-the-automatically-generate-rules-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/script-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/script-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/secpol-advanced-security-audit-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-auditing-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/security-auditing-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-considerations-for-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/security-considerations-for-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-identifiers.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/security-identifiers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-options.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-policy-settings-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-policy-settings-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-principals.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/security-principals", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/select-types-of-rules-to-create.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/server-isolation-gpos.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/server-isolation-policy-design-example.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/server-isolation-policy-design.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/service-accounts.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/service-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/service-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/shut-down-the-system.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shut-down-the-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-and-remote-desktop-services.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-and-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-architecture.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-certificate-propagation-service.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-certificate-propagation-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-certificate-requirements-and-enumeration.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-debugging-information.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-debugging-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-events.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-group-policy-and-registry-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-how-smart-card-sign-in-works-in-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-removal-policy-service.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-removal-policy-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-smart-cards-for-windows-service.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-tools-and-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-tools-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/smart-card-windows-smart-card-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/special-identities.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/special-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/store-passwords-using-reversible-encryption.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/synchronize-directory-service-data.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/synchronize-directory-service-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-settings-optional-subsystems.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-settings-optional-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/take-ownership-of-files-or-other-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/test-and-update-an-applocker-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/test-and-update-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/testing-scenarios-for-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/tools-to-use-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/tools-to-use-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/tpm-fundamentals.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/tpm-fundamentals", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/tpm-recommendations.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/tpm-recommendations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/trusted-platform-module-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/trusted-platform-module-top-node.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-top-node", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understand-applocker-enforcement-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-enforcement-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understand-applocker-policy-design-decisions.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-policy-design-decisions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-the-applocker-policy-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-default-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-rule-behavior.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-rule-collections.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-collections", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-rule-condition-types.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-condition-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-applocker-rule-exceptions.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-exceptions", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/understanding-the-windows-firewall-with-advanced-security-design-process.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-group-policy-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-intune-config-manager-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-wmi-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-security-policy-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/user-rights-assignment.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-rights-assignment", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/using-event-viewer-with-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/using-event-viewer-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/using-owa-with-wip.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/using-owa-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/verify-that-network-traffic-is-authenticated.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/view-the-security-event-log.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/view-the-security-event-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-deploy-virtual-smart-cards.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-evaluate-security.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-tpmvscmgr.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-understanding-and-evaluating.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/virtual-smart-card-use-virtual-smart-cards.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-authentication.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-auto-trigger-profile.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-auto-trigger-profile", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-conditional-access.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-connection-type.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-connection-type", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-name-resolution.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-name-resolution", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-profile-options.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-profile-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-routing.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-routing", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/vpn-security-features.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-security-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/what-is-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/what-is-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-10-mobile-security-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/windows-10-mobile-security-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-credential-theft-mitigation-guide-abstract", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-antivirus-compatibility.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-antivirus-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-offline.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-offline", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-security-center-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-firewall-with-advanced-security.md", -"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-installer-rules-in-applocker.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/windows-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-security-baselines.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/windows-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/wip-app-enterprise-context.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/wip-app-enterprise-context", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/working-with-applocker-policies.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/working-with-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/working-with-applocker-rules.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/working-with-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/acquire-apps-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/acquire-apps-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/add-unsigned-app-to-code-integrity-policy.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/add-unsigned-app-to-code-integrity-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/administrative-tools-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/administrative-tools-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/app-inventory-management-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/apps-in-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/apps-in-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-about-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-about-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-administering-appv-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-administering-appv-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-administering-virtual-applications-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-allow-administrators-to-enable-connection-groups.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-application-publishing-and-client-interaction.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-application-publishing-and-client-interaction", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-apply-the-user-configuration-file-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-auto-batch-sequencing.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-batch-sequencing", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-auto-batch-updating.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-batch-updating", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-auto-clean-unpublished-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-clean-unpublished-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-auto-provision-a-vm.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-provision-a-vm", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-available-mdm-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-available-mdm-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-capacity-planning.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-capacity-planning", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-client-configuration-settings.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-client-configuration-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-configure-access-to-packages-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-connect-to-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connect-to-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-connection-group-file.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connection-group-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-connection-group-virtual-environment.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connection-group-virtual-environment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-connection-group.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-connection-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-package-accelerator-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-package-accelerator.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-package-accelerator", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-a-virtual-application-package-package-accelerator.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-create-and-use-a-project-template.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-and-use-a-project-template", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-creating-and-managing-virtualized-applications.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-delete-a-connection-group.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-delete-a-connection-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-delete-a-package-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-delete-a-package-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploy-appv-databases-with-sql-scripts.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploy-the-appv-server-with-a-script.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploy-the-appv-server.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-the-appv-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-microsoft-office-2013-with-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-microsoft-office-2016-with-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-the-appv-sequencer-and-client.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deploying-the-appv-server.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-deployment-checklist.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deployment-checklist", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-dynamic-configuration.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-dynamic-configuration", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-enable-the-app-v-desktop-client.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-the-app-v-desktop-client", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-evaluating-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-evaluating-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-for-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-getting-started.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-getting-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-high-level-architecture.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-high-level-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-management-server-on-a-standalone-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-install-the-sequencer.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-sequencer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-maintaining-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-maintaining-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-managing-connection-groups.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-managing-connection-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-migrating-to-appv-from-a-previous-version.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-modify-an-existing-virtual-application-package.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-modify-client-configuration-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-modify-client-configuration-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-move-the-appv-server-to-another-computer.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-operations.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-operations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-performance-guidance.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-performance-guidance", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-checklist.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-checklist", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-folder-redirection-with-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-folder-redirection-with-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-appv-server-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-appv-server-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-high-availability-with-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-high-availability-with-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-sequencer-and-client-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-for-using-appv-with-office.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-using-appv-with-office", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-planning-to-deploy-appv.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-to-deploy-appv", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-preparing-your-environment.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-preparing-your-environment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-prerequisites.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-prerequisites", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-publish-a-connection-group.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-publish-a-connection-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-publish-a-packages-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-register-and-unregister-a-publishing-server-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-release-notes-for-appv-for-windows-1703.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-release-notes-for-appv-for-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-release-notes-for-appv-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-reporting.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-reporting", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-running-locally-installed-applications-inside-a-virtual-environment.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-security-considerations.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-security-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-sequence-a-new-application.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-sequence-a-new-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-sequence-a-package-with-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-sequence-a-package-with-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-supported-configurations.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-supported-configurations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-troubleshooting.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-troubleshooting", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-using-the-client-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-using-the-client-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/appv-viewing-appv-server-publishing-metadata.md", -"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/assign-apps-to-employees.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/assign-apps-to-employees", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/configure-mdm-provider-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/configure-mdm-provider-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/connect-to-remote-aadj-pc.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/connect-to-remote-aadj-pc", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/device-guard-signing-portal.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/device-guard-signing-portal", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/distribute-apps-from-your-private-store.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-from-your-private-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/distribute-apps-to-your-employees-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/distribute-apps-with-management-tool.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-with-management-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/distribute-offline-apps.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-offline-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/find-and-acquire-apps-overview.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/find-and-acquire-apps-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/group-policies-for-enterprise-and-education-editions.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/group-policies-for-enterprise-and-education-editions", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/join-windows-10-mobile-to-azure-active-directory.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/join-windows-10-mobile-to-azure-active-directory", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-access-to-private-store.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-access-to-private-store", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-apps-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/manage-apps-windows-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/manage-apps-windows-store-for-business-overview.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-apps-microsoft-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-corporate-devices.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-orders-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/manage-orders-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-private-store-settings.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-private-store-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-settings-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/manage-settings-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-users-and-groups-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/manage-users-and-groups-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-windows-10-in-your-organization-modern-management.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/mandatory-user-profile.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mandatory-user-profile", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/new-policies-for-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/new-policies-for-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/prerequisites-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/prerequisites-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/reset-a-windows-10-mobile-device.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/reset-a-windows-10-mobile-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/roles-and-permissions-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/roles-and-permissions-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/settings-reference-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/settings-reference-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-microsoft-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/sign-code-integrity-policy-with-device-guard-signing.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-code-integrity-policy-with-device-guard-signing", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/sign-up-windows-store-for-business-overview.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/sign-up-windows-store-for-business-overview.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/sign-up-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/sign-up-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/troubleshoot-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-windows-store-for-business", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/troubleshoot-windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-microsoft-store-for-business", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-administering-uev.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-administering-uev", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-application-template-schema-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-application-template-schema-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-configuring-uev-with-group-policy-objects.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-deploy-required-features.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-deploy-required-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-deploy-uev-for-custom-applications.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-for-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-getting-started.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-getting-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-manage-administrative-backup-and-restore.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-manage-configurations.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-manage-configurations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-migrating-settings-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-migrating-settings-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-prepare-for-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-prepare-for-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-release-notes-1607.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-release-notes-1607", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-security-considerations.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-security-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-sync-methods.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-sync-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-sync-trigger-events.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-sync-trigger-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-synchronizing-microsoft-office-with-uev.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-troubleshooting.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-troubleshooting", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-upgrade-uev-from-previous-releases.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-using-uev-with-application-virtualization-applications.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-whats-new-in-uev-for-windows.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/update-windows-store-for-business-account-settings.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/update-windows-store-for-business-account-settings", -"redirect_document_id": true -}, -{ -"source_path": "store-for-business/update-windows-store-for-business-account-settings.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings", -"redirect_document_id": false -}, -{ -"source_path": "store-for-business/work-with-partner-microsoft-store-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/commerce/manage-partners", -"redirect_document_id": false -}, -{ -"source_path": "windows/manage/windows-10-mobile-and-mdm.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-libraries.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/windows-libraries", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-store-for-business-overview.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/working-with-line-of-business-apps.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/act-technical-reference.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/act-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/applying-filters-to-data-in-the-sua-tool.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/available-data-types-and-operators-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/best-practice-recommendations-for-windows-to-go.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/best-practice-recommendations-for-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/change-history-for-plan-for-windows-10-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/compatibility-administrator-users-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-administrator-users-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/compatibility-fix-database-management-strategies-and-deployment.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/deployment-considerations-for-windows-to-go.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/deployment-considerations-for-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/device-dialog-box.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/device-dialog-box", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/fixing-applications-by-using-the-sua-tool.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/fixing-applications-by-using-the-sua-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/prepare-your-organization-for-windows-to-go.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/prepare-your-organization-for-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/security-and-data-protection-considerations-for-windows-to-go.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/showing-messages-generated-by-the-sua-tool.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/showing-messages-generated-by-the-sua-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/sua-users-guide.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/sua-users-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/tabs-on-the-sua-tool-interface.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/tabs-on-the-sua-tool-interface", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/testing-your-application-mitigation-packages.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/testing-your-application-mitigation-packages", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/understanding-and-using-compatibility-fixes.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/understanding-and-using-compatibility-fixes", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/using-the-compatibility-administrator-tool.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-compatibility-administrator-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/using-the-sdbinstexe-command-line-tool.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sdbinstexe-command-line-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/using-the-sua-tool.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sua-tool", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/using-the-sua-wizard.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sua-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/viewing-the-events-screen-in-compatibility-administrator.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-compatibility.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-deployment-considerations.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-deployment-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-enterprise-faq-itpro.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-10-infrastructure-requirements.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-infrastructure-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-to-go-frequently-asked-questions.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-to-go-frequently-asked-questions", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/windows-to-go-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-to-go-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/change-history-for-update-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/change-history-for-update-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/update-compliance-get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/update-compliance-monitor.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/update-compliance-using.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-branchcache.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-branchcache", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-configure-wufb.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-delivery-optimization.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-deployment-rings-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-integrate-wufb.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-integrate-wufb", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-manage-updates-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-configuration-manager", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-manage-updates-wsus.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-manage-updates-wufb.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": false -}, -{ -"source_path": "windows/update/waas-mobile-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-mobile-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-optimize-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-quick-start.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-quick-start", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-restart.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-restart", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-branches-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-servicing-strategy-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-windows-insider-for-business-aad.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business-aad", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-windows-insider-for-business.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-wufb-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/waas-wufb-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/manage-settings-app-with-group-policy.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/manage-settings-app-with-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/client-management/mdm/create-a-custom-configuration-service-provider.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/client-management/mdm/design-a-custom-windows-csp.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/iconfigserviceprovider2.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/iconfigserviceprovider2getnode.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnode.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodeadd.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodeclear.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodecopy.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodedeletechild.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodedeleteproperty.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodeexecute.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodegetchildnodenames.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodegetproperty.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodegetpropertyidentifiers.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodegetvalue.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodemove.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodesetproperty.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodesetvalue.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspnodetransactioning.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/icspvalidate.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md", -"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/collect-wip-audit-event-logs.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/deploy-managed-installer-for-device-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-managed-installer-for-device-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/upgrade-readiness-data-sharing.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-data-sharing", -"redirect_document_id": true -}, -{ -"source_path": "windows/index.md", -"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/index.md", -"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/deploy/index.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/plan/index.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/index.md", -"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/windows-store-for-business.md", -"redirect_url": "https://docs.microsoft.com/microsoft-store/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/update/index.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/configure/index.md", -"redirect_url": "https://docs.microsoft.com/windows/configuration/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/security-technologies.md", -"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "education/get-started/index.md", -"redirect_url": "/education/get-started/get-started-with-microsoft-education", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-10-enterprise-security-guides.md", -"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/change-history-for-keep-windows-10-secure.md", -"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/manage/change-history-for-manage-and-update-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/update/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-10-enterprise-activation-subscription.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-10-auto-pilot.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/privacy/basic-level-windows-diagnostic-events-and-fields.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/configure-windows-diagnostic-data-in-your-organization.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/diagnostic-data-viewer-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/gdpr-win10-whitepaper.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/gdpr-win10-whitepaper", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/manage-windows-endpoints-version-1709.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/manage-windows-endpoints", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/windows-diagnostic-data-1703.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/windows-diagnostic-data-1703", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/windows-diagnostic-data.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/windows-diagnostic-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/upgrade/windows-10-edition-downgrades.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades", -"redirect_document_id": true -}, -{ -"source_path": "education/windows/windows-automatic-redeployment.md", -"redirect_url": "https://docs.microsoft.com/education/windows/autopilot-reset", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-10-autopilot.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot", -"redirect_document_id": false -}, -{ -"source_path": "windows/privacy/manage-windows-endpoints.md", -"redirect_url": "https://docs.microsoft.com/windows/privacy/manage-windows-1809-endpoints", -"redirect_document_id": true -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp", -"redirect_document_id": false - }, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-list.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alerts", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-filemachineaction-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-filemachineactions-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machineaction-object", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/get-started.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/index", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/isolate-machine", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-av-scan", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicator-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-analytics", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/files", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machineaction", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/machineactionsnote.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/ti-indicator", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/update-alert", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/incidents-queue.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/incidents-queue", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", -"redirect_document_id": false -}, -{ -"source_path":"windows/security/threat-protection/windows-defender-atp/use-apis.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/user-alert-windows-defender-advanced-threat-protection-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/planning/windows-10-fall-creators-deprecation.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1709-removed-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/planning/windows-10-creators-update-deprecation.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1703-removed-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-indicators", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/windows-10-enterprise-subscription-activation.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation", -"redirect_document_id": true -}, -{ -"source_path": "windows/hub/windows-10-landing.yml", -"redirect_url": "https://docs.microsoft.com/windows/windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-network.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/windows-autopilot/user-driven-aad.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/user-driven-hybrid.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/windows-autopilot/intune-connector.md", -"redirect_url": "https://docs.microsoft.com/intune/windows-autopilot-hybrid", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-reset", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-local.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-reset", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/windows-autopilot/configure-autopilot.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/windows-autopilot/administer.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices", -"redirect_document_id": false -}, -{ -"source_path": "windows/hub/release-information.md", -"redirect_url": "https://docs.microsoft.com/windows/release-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/windows-10-architecture-posters.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/index.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md", -"redirect_url": "https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11", -"redirect_document_id": true -}, -{ -"source_path": "education/get-started/change-history-ms-edu-get-started.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", -"redirect_document_id": true -}, -{ -"source_path": "education/get-started/get-started-with-microsoft-education.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", -"redirect_document_id": false -}, -{ -"source_path": "education/get-started/configure-microsoft-store-for-education.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/microsoft-store-for-education", -"redirect_document_id": false -}, -{ -"source_path": "education/get-started/enable-microsoft-teams.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-teams-for-education", -"redirect_document_id": false -}, -{ -"source_path": "education/get-started/finish-setup-and-other-tasks.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", -"redirect_document_id": false -}, -{ -"source_path": "education/get-started/inclusive-classroom-it-admin.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/inclusive-classroom-it-admin", -"redirect_document_id": false -}, -{ -"source_path": "education/get-started/set-up-office365-edu-tenant.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/create-your-office-365-tenant", -"redirect_document_id": false -}, -{ -"source_path": "education/get-started/set-up-windows-10-education-devices.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices", -"redirect_document_id": false -}, -{ -"source_path": "education/get-started/set-up-windows-education-devices.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices", -"redirect_document_id": false -}, -{ -"source_path": "education/get-started/use-intune-for-education.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education", -"redirect_document_id": false -}, -{ - "source_path": "devices/surface/surface-dock-updater.md", - "redirect_url": "/surface/surface-dock-firmware-update", - "redirect_document_id": true + { + "source_path": "devices/hololens/hololens-whats-new.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens-release-notes", + "redirect_document_id": false }, -{ -"source_path": "education/get-started/use-school-data-sync.md", -"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew", -"redirect_document_id": true -}, -{ -"source_path": "windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-exclusions.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-pua", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-perf.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-kext.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-privacy", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-resources", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md", -"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md", -"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md", -"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-2-enterprise-enhanced-security.md", -"redirect_document_id": false -}, -{ - "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md", -"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-3-enterprise-high-security.md", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-4-enterprise-devops-security.md", -"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-4-enterprise-devops-security.md", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-5-enterprise-administrator-security.md", -"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-5-enterprise-administrator-security.md", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-compliance.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/product-brief.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", -"redirect_document_id": false -}, -{ -"source_path": "windows/security/threat-protection/microsoft-defender-atp/licensing.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/release-information/status-windows-10-1703.yml", -"redirect_url": "https://docs.microsoft.com/windows/release-information/windows-message-center", -"redirect_document_id": true -}, -{ -"source_path": "windows/release-information/resolved-issues-windows-10-1703.yml", -"redirect_url": "https://docs.microsoft.com/windows/release-information/windows-message-center", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/planning/windows-10-1703-removed-features.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/planning/windows-10-1709-removed-features.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/planning/windows-10-1803-removed-features.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", -"redirect_document_id": false -}, -{ -"source_path": "devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md", -"redirect_url": "/surface/manage-surface-driver-and-firmware-updates", -"redirect_document_id": true -}, -{ -"source_path": "windows/deployment/planning/windows-10-1809-removed-features.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/planning/windows-10-1903-removed-features.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/windows-analytics-azure-portal.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/windows-analytics-FAQ-troubleshooting.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/windows-analytics-get-started.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/windows-analytics-overview.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/windows-analytics-privacy.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/device-health-get-started.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/device-health-monitor.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/device-health-using.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-additional-insights.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-architecture.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-data-sharing.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-deployment-script.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-deploy-windows.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-get-started.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-identify-apps.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-requirements.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-resolve-issues.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-target-new-OS.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md", -"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/update/waas-manage-updates-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#mdt-lite-touch-components", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-mdt/key-features-in-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#key-features-in-mdt", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/upgrade-to-windows-10-with-configuraton-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-a-task-sequence-with-configuration-manager-and-mdt", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/create-a-task-sequence-with-configuration-manager-and-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager#procedures", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/upgrade-to-windows-10-with-configuraton-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/get-started-with-configuraton-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-configuration-manager.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", -"redirect_document_id": false -}, -{ -"source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", -"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", "redirect_document_id": false -} -] + { + "source_path": "devices/hololens/hololens-upgrade-enterprise.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens-requirements#upgrade-to-windows-holographic-for-business", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-install-localized.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens1-install-localized", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-install-apps.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-setup.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens1-setup", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-use-apps.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-home#using-apps-on-hololens", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-get-apps.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-spaces-on-hololens.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens-spaces", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-clicker.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-clicker-restart-recover.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker#restart-or-recover-the-clicker", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-find-and-save-files.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-data", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-management-overview.md", + "redirect_url": "https://docs.microsoft.com/hololens", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/manage-surface-pro-3-firmware-updates.md", + "redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/update.md", + "redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/ios-privacy-statement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/ios-privacy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-ios-privacy-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/ios-privacy", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-containers-help-protect-windows", + "redirect_document_id": false + }, + { + "source_path": "browsers/edge/enterprise-guidance-using-microsoft-edge-and-ie11.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/windows-update-sources.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/how-windows-update-works", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/update-compliance-perspectives.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", + "redirect_document_id": true + }, + { + "source_path": "browsers/edge/hardware-and-software-requirements.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge", + "redirect_document_id": true + }, + { + "source_path": "browsers/edge/security-enhancements-microsoft-edge.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp", + "redirect_document_id": true + }, + { + "source_path": "browsers/edge/new-policies.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/change-history-for-microsoft-edge", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/intelligence/av-tests.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/security/mtp/top-scoring-industry-tests", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", + "redirect_document_id": true + }, + { + "source_path": "windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/intelligence/transparency-report.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/intelligence/av-tests", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/waas-windows-insider-for-business-aad.md", + "redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-add", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/waas-windows-insider-for-business-faq.md", + "redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started", + "redirect_document_id": false + }, + { + "source_path": "windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/encrypted-hard-drive.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/encrypted-hard-drive", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/secure-the-windows-10-boot-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/secure-the-windows-10-boot-process", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/change-the-tpm-owner-password", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/how-windows-uses-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/manage-tpm-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/manage-tpm-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/manage-tpm-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/manage-tpm-lockout", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/tpm-fundamentals.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-fundamentals", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/tpm-recommendations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-recommendations", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-top-node", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/waas-windows-insider-for-business.md", + "redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agress.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protectionsecurity-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/applocker/administer-applocker-using-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/administer-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-architecture-and-components.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-functions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-policies-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-policies-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-policy-use-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-processes-and-interactions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/applocker-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-the-application-identity-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/configure-the-appLocker-reference-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-your-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/create-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/delete-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/determine-your-application-control-objectives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/dll-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/document-your-application-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/document-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/edit-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/edit-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/enable-the-dll-rule-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/enforce-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/applocker/executable-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/how-applocker-works-techref.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-manually.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/monitor-application-usage-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/optimize-applocker-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/plan-for-applocker-policy-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/refresh-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/requirements-to-use-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/script-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/security-considerations-for-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/select-types-of-rules-to-create.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/test-and-update-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/tools-to-use-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understand-applocker-enforcement-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-collections.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/using-event-viewer-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/what-is-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/windows-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/working-with-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/applocker/working-with-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-enable-virtualization-based-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/enable-virtualization-based-security", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", + "redirect_url": "hhttps://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-family-options.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/microsoft-defender-atp/customize-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-views", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/graphics.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/prerelease.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/apis-intro.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/apis-intro", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/api-hello-world.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-hello-world", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-simulations", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/community", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/conditional-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-siem", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-splunk", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-siem", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-retention-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/deprecate.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/deprecate", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/evaluate-atp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-error-codes", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-files", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-ip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-user", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/licensing", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-reports", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-tags", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-edr.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-edr", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/management-apis.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/management-apis", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-incidents", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mssp-support", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/offboard-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-configure", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/onboard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/onboard-offline-machines.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/configuration-score.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-secure-score.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configuration-score.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/partner-applications.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/partner-applications", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/portal-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-power-bi", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/powershell-example-code.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/use-apis.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preferences-setup", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/prerelease.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/prerelease", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/prerelease.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/python-example-code", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/python-example-code.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/rbac", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/response-actions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/response-actions", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-detection-test", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/service-status", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/time-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/use-custom-ti.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/whats-new-in-microsoft-defender-atp", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-security-center", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/block-untrusted-fonts-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/block-untrusted-fonts-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/change-history-for-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/change-history-for-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md", + "redirect_url": "https://www.microsoft.com/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/", + "redirect_document_id": false + }, + { + "source_path": "windows/threat-protection/windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/access-this-computer-from-the-network.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/account-lockout-duration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-duration", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/account-lockout-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/account-lockout-threshold.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-threshold", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/account-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-administrator-account-status.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-guest-account-status.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-rename-administrator-account.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/accounts-rename-guest-account.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/add-workstations-to-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/administer-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/allow-log-on-locally.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/allow-log-on-locally", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/back-up-files-and-directories.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/bypass-traverse-checking.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/change-the-system-time.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/change-the-system-time", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/change-the-time-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/change-the-time-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-a-pagefile.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-a-pagefile", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-a-token-object.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-a-token-object", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-global-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-global-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-permanent-shared-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/create-symbolic-links.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-symbolic-links", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": false + }, + { + "source_path": "windows/device-security/security-policy-settings/debug-programs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/debug-programs", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-log-on-locally.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-locally", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/enforce-password-history.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enforce-password-history", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/generate-security-audits.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/generate-security-audits", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/increase-a-process-working-set.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/increase-scheduling-priority.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/kerberos-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/kerberos-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/load-and-unload-device-drivers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/lock-pages-in-memory.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/log-on-as-a-batch-job.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/log-on-as-a-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/log-on-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/manage-auditing-and-security-log.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/minimum-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/minimum-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/minimum-password-length.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/minimum-password-length", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/modify-an-object-label.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/modify-an-object-label", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/modify-firmware-environment-values.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-list-manager-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-list-manager-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/password-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/password-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/profile-single-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/profile-single-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/profile-system-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/profile-system-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/remove-computer-from-docking-station.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/replace-a-process-level-token.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/restore-files-and-directories.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/restore-files-and-directories", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/security-options.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-options", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/security-policy-settings-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/shut-down-the-system.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shut-down-the-system", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/synchronize-directory-service-data.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-settings-optional-subsystems.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-policy-settings/user-rights-assignment.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-rights-assignment", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/device-guard-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/device-guard-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/advanced-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/advanced-security-auditing-faq.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-account-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-application-generated", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-application-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-audit-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-authentication-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-authorization-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-central-access-policy-staging.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-certification-services", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-computer-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-detailed-directory-service-replication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-detailed-file-share", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-directory-service-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-directory-service-replication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-distribution-group-management", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-dpapi-activity.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-file-share", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-file-system.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-connection", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-filtering-platform-packet-drop.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-group-membership.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-handle-manipulation", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-ipsec-driver.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-extended-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-ipsec-main-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-quick-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-kerberos-authentication-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-kernel-object.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-logoff", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-network-policy-server.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-other-account-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-account-management-events", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-other-logonlogoff-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-object-access-events", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-other-policy-change-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-privilege-use-events", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-other-system-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-pnp-activity", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-process-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-process-termination", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-registry.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-removable-storage", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-rpc-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sam", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-security-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-security-state-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-security-system-extension.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sensitive-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-special-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-system-integrity", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/audit-user-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-user-device-claims", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-account-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-account-management", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-directory-service-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-logon-events", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-object-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-privilege-use.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-process-tracking", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-audit-system-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-security-audit-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/basic-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-1100.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1102", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-1104.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1105", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-1108.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4608", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4610.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4611", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4612.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4614", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4615.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4616", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4618.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4621", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4622.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4624", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4625.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4626", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4627.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4634", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4647.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4648", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4649.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4656", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4657.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4658", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4660.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4661", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4662.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4663", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4664.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4671.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4672", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4673.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4674", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4675.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4688", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4689.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4690", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4691.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4692", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4693.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4694", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4695.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4696", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4697.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4698", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4699.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4700", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4701.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4702", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4703.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4704", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4705.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4706", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4707.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4713", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4714.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4715", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4716.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4717", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4718.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4719", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4720.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4722", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4723.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4724", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4725.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4726", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4731.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4732", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4733.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4734", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4735.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4738", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4739.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4740", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4741.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4742", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4743.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4749", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4750.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4751", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4752.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4753", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4764.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4765", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4766.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4767", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4768.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4769", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4770.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4771", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4772.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4773", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4774.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4775", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4776.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4777", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4778.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4779", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4780.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4781", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4782.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4793", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4794.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4798", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4799.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4800", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4801.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4802", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4803.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4816", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4817.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4818", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4819.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4826", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4864.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4865", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4866.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4867", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4902.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4904", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4905.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4906", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4907.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4908", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4909.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4910", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4911.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4912", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4913.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4928", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4929.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4930", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4931.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4932", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4933.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4934", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4935.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4936", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4937.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4944", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4945.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4946", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4947.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4948", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4949.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4950", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4951.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4952", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4953.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4954", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4956.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4957", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4958.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4964", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-4985.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5024", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5025.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5027", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5028.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5029", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5030.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5031", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5032.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5033", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5034.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5035", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5037.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5038", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5039.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5051", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5056.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5057", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5058.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5059", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5060.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5061", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5062.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5063", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5064.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5065", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5066.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5067", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5068.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5069", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5070.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5136", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5137.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5138", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5139.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5140", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5141.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5142", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5143.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5144", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5145.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5148", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5149.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5150", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5151.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5152", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5153.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5154", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5155.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5156", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5157.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5158", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5159.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5168", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5376.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5377", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5378.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5447", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5632.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5633", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5712.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5888", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-5889.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5890", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6144.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6145", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6281.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6400", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6401.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6402", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6403.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6404", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6405.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6406", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6407.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6408", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6409.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6410", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6416.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6419", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6420.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6421", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6422.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6423", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/event-6424.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/file-system-global-object-access-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-claim-types", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/monitor-resource-attribute-definitions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/other-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/registry-global-object-access-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/security-auditing-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/view-the-security-event-log", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/administer-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/administer-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-architecture-and-components.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-architecture-and-components", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-functions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-functions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-policies-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policies-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-policies-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policies-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-policy-use-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policy-use-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-processes-and-interactions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-processes-and-interactions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/applocker-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-the-application-identity-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-the-application-identity-service", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/configure-the-appLocker-reference-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-the-appLocker-reference-device", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-a-rule-for-packaged-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-your-applocker-planning-document.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-planning-document", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-your-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/create-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/delete-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/delete-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/deploy-the-applocker-policy-into-production.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/determine-your-application-control-objectives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-your-application-control-objectives", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/dll-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/dll-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/document-your-application-control-management-processes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-application-control-management-processes", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/document-your-application-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-application-list", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/document-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/edit-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/edit-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/edit-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/edit-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/enable-the-dll-rule-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/enable-the-dll-rule-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/enforce-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/enforce-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/executable-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/executable-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/how-applocker-works-techref.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/how-applocker-works-techref", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/manage-packaged-apps-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/merge-applocker-policies-manually.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/merge-applocker-policies-manually", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/monitor-application-usage-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/monitor-application-usage-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/optimize-applocker-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/optimize-applocker-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/plan-for-applocker-policy-management.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/plan-for-applocker-policy-management", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/refresh-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/refresh-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/requirements-for-deploying-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/requirements-to-use-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/requirements-to-use-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/script-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/script-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/security-considerations-for-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/security-considerations-for-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/select-types-of-rules-to-create.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/select-types-of-rules-to-create", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/test-and-update-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/test-and-update-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/tools-to-use-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/tools-to-use-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understand-applocker-enforcement-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-enforcement-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understand-applocker-policy-design-decisions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-rule-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-rule-collections.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-collections", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-rule-condition-types.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-applocker-rule-exceptions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/using-event-viewer-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/using-event-viewer-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/what-is-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/what-is-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/windows-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/windows-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/working-with-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/working-with-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/applocker/working-with-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/working-with-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/change-history-for-device-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/change-history-for-device-security", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/enable-virtualization-based-protection-of-code-integrity.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/enable-virtualization-based-protection-of-code-integrity", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/get-support-for-security-baselines.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/get-support-for-security-baselines", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/security-compliance-toolkit-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/windows-10-mobile-security-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-10-mobile-security-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/windows-security-baselines.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/app-behavior-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/app-behavior-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/limitations-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/limitations-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/using-owa-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/using-owa-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/encrypted-hard-drive.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/encrypted-hard-drive", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/how-hardware-based-containers-help-protect-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/secure-the-windows-10-boot-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/secure-the-windows-10-boot-process", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/change-the-tpm-owner-password.md", + "redirect_url": "https://docs.microsoft.com/windows/securityhardware-protection/tpm/change-the-tpm-owner-password", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/how-windows-uses-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/securityhardware-protection/tpm/how-windows-uses-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/manage-tpm-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/manage-tpm-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/manage-tpm-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/manage-tpm-lockout", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/tpm-fundamentals.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-fundamentals", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/tpm-recommendations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-recommendations", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/trusted-platform-module-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/tpm/trusted-platform-module-top-node.md", + "redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-top-node", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bcd-settings-and-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-basic-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-basic-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-countermeasures.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-management-for-enterprises.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md", + "redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-credential-theft-mitigation-guide-abstract.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/change-history-for-access-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/change-history-for-access-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/configure-s-mime.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/configure-s-mime", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/enterprise-certificate-pinning.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/enterprise-certificate-pinning", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/installing-digital-certificates-on-windows-10-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/remote-credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/basic-firewall-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/boundary-zone-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/boundary-zone-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/boundary-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/boundary-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-creating-group-policy-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-authentication-methods.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-authentication-methods", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-the-windows-firewall-log.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-a-group-account-in-active-directory.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-a-group-policy-object.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-a-group-policy-object", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-authentication-request-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-inbound-icmp-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-inbound-port-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-outbound-port-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/documenting-the-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/documenting-the-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/enable-predefined-inbound-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/enable-predefined-outbound-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/encryption-zone-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/encryption-zone-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/encryption-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/encryption-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/exempt-icmp-from-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/exemption-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/exemption-list", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/firewall-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/firewall-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/firewall-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/firewall-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-other-relevant-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gathering-the-information-you-need.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-boundary.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-firewall.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/isolated-domain-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolated-domain-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/isolated-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolated-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/isolating-apps-on-your-network.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/link-the-gpo-to-the-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-certificate-based-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-domain-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-gpo-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-gpo-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-network-access-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-network-access-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-server-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-the-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-the-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/procedures-used-in-this-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/server-isolation-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-auto-trigger-profile.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-auto-trigger-profile", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-conditional-access.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-conditional-access", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-connection-type.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-connection-type", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-name-resolution.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-name-resolution", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-profile-options.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-routing.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-routing", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/vpn/vpn-security-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-security-features", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/user-account-control/how-user-account-control-works.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/how-user-account-control-works", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/user-account-control/user-account-control-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/user-account-control/user-account-control-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-debugging-information.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-debugging-information", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-events.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-events", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-removal-policy-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-tools-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-and-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/smart-cards/smart-card-certificate-propagation-service.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-and-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-and-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-biometrics-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-adfs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-deploy-mfa.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-pki.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-deployment-cert-trust.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-deployment-key-trust.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-errors-during-pin-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-event-300.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-event-300", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-identity-verification.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-adfs.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-manage-in-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-planning-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-planning-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-prepare-people-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/additional-mitigations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/additional-mitigations", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-known-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-known-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-manage.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-not-protected-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-protection-limits.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-protection-limits", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/credential-guard/credential-guard-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/access-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/access-control", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/active-directory-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/active-directory-security-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/dynamic-access-control.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/dynamic-access-control", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/local-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/local-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/microsoft-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/security-identifiers.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/security-identifiers", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/security-principals.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/security-principals", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/service-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/service-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/access-protection/access-control/special-identities.md", + "redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/special-identities", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-steps.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", + "redirect_document_id": true + }, + { + "source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", + "redirect_document_id": true + }, + { + "source_path": "devices/surface/surface-device-compatibility-with-windows-10-ltsb.md", + "redirect_url": "https://docs.microsoft.com/surface/surface-device-compatibility-with-windows-10-ltsc", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/windows-diagnostic-data-1709.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-diagnostic-data", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/EventName.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/enhanced-telemetry-windows-analytics-events-and-fields", + "redirect_document_id": true + }, + { + "source_path": "education/windows/windows-10-pro-to-pro-edu-upgrade.md", + "redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", + "redirect_document_id": false + }, + { + "source_path": "education/windows/switch-to-pro-education.md", + "redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", + "redirect_document_id": false + }, + { + "source_path": "education/windows/swithc-to-pro-de.md", + "redirect_url": "https://docs.microsoft.com/education/windows/switch-to-pro-education", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-admx-backed.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", + "redirect_document_id": true + }, + { + "source_path": "windows/client-management/mdm/policy-csp-location.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/configure-windows-defender-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-pua-windows-defender-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/get-started-with-windows-defender-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-block-at-first-sight.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-enhanced-notifications.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-7.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", + "redirect_document_id": true + }, + { + "source_path": "devices/surface/surface-diagnostic-toolkit.md", + "redirect_url": "https://docs.microsoft.com/surface/index", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/manage-surface-dock-firmware-updates.md", + "redirect_url": "https://docs.microsoft.com/surface/indexdevices/surface/update", + "redirect_document_id": false + }, + { + "source_path": "devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md", + "redirect_url": "https://docs.microsoft.com/surface-hub/finishing-your-surface-hub-meeting", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-microsoft-layout-app.md", + "redirect_url": "https://docs.microsoft.com/hololens/hololens-microsoft-dynamics-365-layout-app", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-microsoft-dynamics-365-layout-app.md", + "redirect_url": "https://docs.microsoft.com/dynamics365/mixed-reality/layout/", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-microsoft-remote-assist-app.md", + "redirect_url": "https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/", + "redirect_document_id": true + }, + { + "source_path": "devices/hololens/hololens-public-preview-apps.md", + "redirect_url": "https://docs.microsoft.com/dynamics365/#pivot=mixed-reality-apps", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/hololens-restart-recover.md", + "redirect_url": "/hololens/hololens-recovery", + "redirect_document_id": false + }, + { + "source_path": "devices/hololens/holographic-photos-and-video.md", + "redirect_url": "/hololens/holographic-photos-and-videos", + "redirect_document_id": false + }, + { + "source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub", + "redirect_document_id": true + }, + { + "source_path": "devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/surface-hub/admin-group-management-for-surface-hub", + "redirect_document_id": true + }, + { + "source_path": "devices/surface-hub/surface-hub-administrators-guide.md", + "redirect_url": "/surface-hub/index", + "redirect_document_id": true + }, + { + "source_path": "devices/surface-hub/intro-to-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/surface-hub/index", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/waas-quick-start.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-quick-start", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-servicing-strategy-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-deployment-rings-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-servicing-branches-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-branches-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/update-compliance-monitor.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/update-compliance-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/update-compliance-wdav-status.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/update-compliance-using.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-optimize-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-delivery-optimization.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-branchcache.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-branchcache", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-mobile-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-mobile-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-manage-updates-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-configure-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-integrate-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-integrate-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-wufb-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-wufb-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune.md", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-manage-updates-wsus.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-manage-updates-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-restart.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-restart", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/waas-update-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/configure-windows-telemetry-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/lockdown-features-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/set-up-shared-or-guest-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/set-up-a-device-for-anyone-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/set-up-a-device-for-anyone-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/guidelines-for-assigned-access-app.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/lock-down-windows-10-to-specific-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/lockdown-xml.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/lockdown-xml", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/settings-that-can-be-locked-down.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/settings-that-can-be-locked-down", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/product-ids-in-windows-10-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-tips-and-suggestions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-tips-and-suggestions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-10-start-layout-options-and-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/configure-windows-10-taskbar.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration//configure-windows-10-taskbar", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/customize-and-export-start-layout.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration//customize-and-export-start-layout", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/start-layout-xml-desktop.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/start-layout-xml-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/start-layout-xml-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/customize-windows-10-start-screens-by-using-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-testing-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-1.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-2.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-3.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-4.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-5.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-scenario-6.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-o365.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-crm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-crm", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-powerbi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-powerbi", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-voice-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-feedback.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-feedback", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/stop-employees-from-using-the-windows-store.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-the-windows-store", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/stop-employees-from-using-the-windows-store.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/configure-devices-without-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/changes-to-start-policies-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/changes-to-start-policies-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/how-it-pros-can-use-configuration-service-providers.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/lock-down-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-wifi-sense-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-wifi-sense-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-install-icd.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-install-icd", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-create-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-apply-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-uninstall-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-uninstall-package", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provision-pcs-for-initial-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provision-pcs-with-apps-and-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-script-to-install-app.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-script-to-install-app", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-nfc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-nfc", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-command-line.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-command-line", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/provisioning-multivariant.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-multivariant", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-edp-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-edp-policy-using-sccm.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-vpn-and-edp-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-enable-phone-signin.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/deploy-edp-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/guidance-and-best-practices-edp.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/overview-create-edp-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/overview-create-wip-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-enterprise-data-using-edp.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/testing-scenarios-for-edp.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/wip-enterprise-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/enlightened-microsoft-apps-and-edp.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/update-windows-10-images-with-provisioning-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/deploy/upgrade-analytics-prepare-your-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-release-notes.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-review-site-discovery.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md", + "redirect_url": "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj635854(v=ws.11)", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/device-guard-certification-and-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-enable-phone-signin", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/implement-microsoft-passport-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-manage-in-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-identity-verification-using-microsoft-passport.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-passport-and-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-and-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-passport-errors-during-pin-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-passport-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/passport-event-300.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-event-300", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/prepare-people-to-use-microsoft-passport.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-prepare-people-to-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/why-a-pin-is-better-than-a-password.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-hello-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/app-inventory-managemement-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/app-inventory-management-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/application-development-for-windows-as-a-service.md", + "redirect_url": "https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-accessibility.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-getting-started", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-accessing-the-client-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-using-the-client-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/disconnect-your-organization-from-microsoft.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/introduction-to-windows-10-servicing.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-cortana-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/cortana-at-work-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/manage-inventory-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/app-inventory-managemement-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-accessibility.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-privacy-statement.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-security-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/act-community-ratings-and-process.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/act-database-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-database-migration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-deployment-options.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-glossary.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/activating-and-closing-windows-in-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-lps-share-permissions.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-operatingsystem-application-report.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-operatingsystem-computer-report.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-operatingsystem-device-report.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-product-and-documentation-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-settings-dialog-box-preferences-tab.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-settings-dialog-box-settings-tab.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-toolbar-icons-in-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-tools-packages-and-services.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/act-user-interface-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/adding-or-editing-an-issue.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/adding-or-editing-a-solution.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/analyzing-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/application-dialog-box.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/categorizing-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/chromebook-migration-guide.md", + "redirect_url": "edu/windows/chromebook-migration-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/common-compatibility-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/compatibility-monitor-users-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/computer-dialog-box.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/configuring-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/creating-and-editing-issues-and-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/creating-an-inventory-collector-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/creating-a-runtime-analysis-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/customizing-your-report-views.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deciding-which-applications-to-test.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deleting-a-data-collection-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deploying-an-inventory-collector-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deploying-a-runtime-analysis-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/deploy-windows-10-in-a-school.md", + "redirect_url": "/edu/windows/deploy-windows-10-in-a-school", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/example-filter-queries.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/exporting-a-data-collection-package.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/filtering-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/fixing-compatibility-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/identifying-computers-for-inventory-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/integration-with-management-solutions-.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/internet-explorer-web-site-report.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/labeling-data-in-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/log-file-locations-for-data-collection-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/managing-your-data-collection-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/organizational-tasks-for-each-report-type.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/organizing-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/prioritizing-your-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/ratings-icons-in-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/resolving-an-issue.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/saving-opening-and-exporting-reports.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/selecting-the-send-and-receive-status-for-an-application.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/selecting-your-compatibility-rating.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/selecting-your-deployment-status.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/sending-and-receiving-compatibility-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/settings-for-acm.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/setup-and-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/software-requirements-for-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/software-requirements-for-rap.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/taking-inventory-of-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/testing-compatibility-on-the-target-platform.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/troubleshooting-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/troubleshooting-act-database-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/troubleshooting-the-act-configuration-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/troubleshooting-the-act-log-processing-service.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/using-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/using-compatibility-monitor-to-send-feedback.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/viewing-your-compatibility-reports.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/websiteurl-dialog-box.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/welcome-to-act.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/whats-new-in-act-60.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/windows-10-guidance-for-education-environments.md", + "redirect_url": "https://docs.microsoft.com/education/windows", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-servicing-options.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/plan/windows-update-for-business.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/change-history-for-what-s-new-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/index", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/device-guard-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/device-management.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/index", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/edge-ie11-whats-new-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/edp-whats-new-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/lockdown-features-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/microsoft-passport.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/new-provisioning-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/security-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/trusted-platform-module.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/user-account-control.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/whats-new/windows-spotlight.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/microsoft-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/windows-update-for-business.md", + "redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/windows-10-security-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/whats-new/security.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/configure/basic-level-windows-diagnostic-events-and-fields-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/change-history-for-configure-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/change-history-for-configure-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/changes-to-start-policies-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/changes-to-start-policies-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/configure-devices-without-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-devices-without-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/configure-devices-without-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/configure-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/configure-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/configure-windows-10-taskbar.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-10-taskbar", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/configure-windows-telemetry-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/configure-windows-telemetry-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-crm.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-crm", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-feedback.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-feedback", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-o365.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-powerbi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-powerbi", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-1.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-2.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-3.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-4.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-5.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-6.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-scenario-7.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-testing-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/cortana-at-work-voice-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/customize-and-export-start-layout.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-and-export-start-layout", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/customize-windows-10-start-screens-by-using-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/guidelines-for-assigned-access-app.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/how-it-pros-can-use-configuration-service-providers.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/kiosk-shared-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/kiosk-shared-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-methods", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/setup-kiosk-digital-signage.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-single-app", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/multi-app-kiosk-xml.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-xml", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/multi-app-kiosk-troubleshoot.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-troubleshoot", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/lock-down-windows-10-to-specific-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/lock-down-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/lockdown-features-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/lockdown-xml.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/lockdown-xml", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/manage-tips-and-suggestions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-tips-and-suggestions", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/manage-wifi-sense-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/manage-wifi-sense-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/mobile-lockdown-designer.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/mobile-lockdown-designer", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/product-ids-in-windows-10-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provision-pcs-for-initial-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provision-pcs-with-apps-and-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provision-pcs-with-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-apply-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-command-line.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-command-line", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-configure-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-configure-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-create-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-install-icd.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-install-icd", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-multivariant.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-multivariant", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-nfc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-nfc", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-package-splitter.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-package-splitter", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-script-to-install-app.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-script-to-install-app", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/provisioning-uninstall-package.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-uninstall-package", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/set-up-a-device-for-anyone-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-device-for-anyone-to-use", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/set-up-shared-or-guest-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/settings-that-can-be-locked-down.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/settings-that-can-be-locked-down", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/start-layout-xml-desktop.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/start-layout-xml-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/start-layout-xml-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/start-secondary-tiles.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/start-secondary-tiles", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/start-taskbar-lockscreen.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/start-taskbar-lockscreen", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/start-taskbar-lockscreen.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/stop-employees-from-using-the-windows-store.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-the-windows-store", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/windows-10-start-layout-options-and-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/windows-diagnostic-data-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-diagnostic-data", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/windows-spotlight.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-spotlight.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-forest-by-proxy-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-by-proxy-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-forest-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-using-active-directory-based-activation-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-using-key-management-service-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-using-key-management-service-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/activate-windows-10-clients-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-windows-10-clients-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/active-directory-based-activation-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/active-directory-based-activation-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-manage-products-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-manage-products-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-remove-computers-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-remove-computers-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/add-remove-product-key-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-remove-product-key-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/assign-applications-using-roles-in-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/assign-applications-using-roles-in-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/change-history-for-deploy-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/change-history-for-deploy-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-a-pxe-server-to-load-windows-pe.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/configure-a-pxe-server-to-load-windows-pe", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-client-computers-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/configure-client-computers-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-2013-for-userexit-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-2013-for-userexit-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-2013-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-2013-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-deployment-share-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-for-userexit-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/configure-mdt-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/create-a-windows-10-reference-image.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-a-windows-10-image-using-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-whats-new.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-whats-new", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/deploy-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/getting-started-with-the-user-state-migration-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/import-export-vamt-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/import-export-vamt-data", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/install-configure-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-configure-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/install-kms-client-key-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-kms-client-key-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/install-product-key-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-product-key-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/install-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/introduction-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/introduction-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/key-features-in-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/key-features-in-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/key-features-in-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/key-features-in-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/kms-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/kms-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/local-reactivation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/local-reactivation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-activations-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-activations-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-product-keys-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-product-keys-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-vamt-data.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-vamt-data", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-analytics.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-readiness.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/mbr-to-gpt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/mbr-to-gpt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/mdt-2013-lite-touch-components.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/mdt-2013-lite-touch-components", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/mdt-lite-touch-components.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/migrate-application-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/migrate-application-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/migration-store-types-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/migration-store-types-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/monitor-activation-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/monitor-activation-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/offline-migration-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/offline-migration-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/online-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/online-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/plan-for-volume-activation-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/plan-for-volume-activation-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/proxy-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/proxy-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/refresh-a-windows-7-computer-with-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/remove-products-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/remove-products-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/resolve-windows-10-upgrade-errors.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/resolve-windows-10-upgrade-errors", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/scenario-kms-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-kms-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/scenario-online-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-online-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/scenario-proxy-activation-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-proxy-activation-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/set-up-mdt-2013-for-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-2013-for-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/set-up-mdt-for-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/sideload-apps-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/sideload-apps-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/troubleshoot-upgrade-analytics.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/troubleshoot-upgrade-readiness.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", + "redirect_document_id": false + }, + { + "source_path": "windows/deploy/understanding-migration-xml-files.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/understanding-migration-xml-files", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/update-product-status-vamt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/update-product-status-vamt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-additional-insights.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-deploy-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deploy-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-deployment-script.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-identify-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-resolve-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-resolve-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-analytics-upgrade-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-additional-insights.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-deploy-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deploy-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-deployment-script.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-identify-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-release-notes.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-release-notes", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-resolve-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-resolve-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-upgrade-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-windows-phone-8-1-to-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-the-volume-activation-management-tool-client.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-upgrade-readiness-to-manage-windows-upgrades.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", + "redirect_document_id": false + }, + { + "source_path": "windows/deploy/use-vamt-in-windows-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/use-vamt-in-windows-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-web-services-in-mdt-2013.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt-2013", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/use-web-services-in-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-best-practices.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-best-practices", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-choose-migration-store-type.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-choose-migration-store-type", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-command-line-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-command-line-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-common-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-common-migration-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-common-migration-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-configxml-file.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-configxml-file", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-conflicts-and-precedence.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-conflicts-and-precedence", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-custom-xml-examples.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-custom-xml-examples", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-customize-xml-files.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-customize-xml-files", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-determine-what-to-migrate.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-determine-what-to-migrate", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-estimate-migration-store-size.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-estimate-migration-store-size", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-exclude-files-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-exclude-files-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-faq.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-faq", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-general-conventions.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-general-conventions", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-hard-link-migration-store.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-hard-link-migration-store", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-how-to.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-how-to", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-identify-application-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-application-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-identify-file-types-files-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-file-types-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-identify-operating-system-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-operating-system-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-identify-users.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-users", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-include-files-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-include-files-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-loadstate-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-loadstate-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-log-files.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-log-files", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-migrate-efs-files-and-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-migrate-user-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migrate-user-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-migration-store-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migration-store-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-plan-your-migration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-plan-your-migration", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-recognized-environment-variables.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-recognized-environment-variables", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-reroute-files-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-reroute-files-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-resources", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-return-codes.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-return-codes", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-scanstate-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-scanstate-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-test-your-migration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-test-your-migration", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-topics.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-topics", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-troubleshooting", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-utilities.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-utilities", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-what-does-usmt-migrate.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-what-does-usmt-migrate", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-xml-elements-library.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-xml-elements-library", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/usmt-xml-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-xml-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/vamt-known-issues.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-known-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/vamt-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/vamt-step-by-step.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-step-by-step", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/verify-the-condition-of-a-compressed-migration-store.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/volume-activation-management-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-management-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/volume-activation-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-deployment-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-deployment-tools-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-tools-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-edition-upgrades.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-enterprise-e3-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-enterprise-e3-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-poc-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc-mdt", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-poc-sc-config-mgr.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc-sc-config-mgr", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-poc.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-10-upgrade-paths.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-upgrade-paths", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-adk-scenarios-for-it-pros.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-adk-scenarios-for-it-pros", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-deployment-scenarios-and-tools.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-deployment-scenarios-and-tools", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/windows-upgrade-and-migration-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-upgrade-and-migration-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/xml-file-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/xml-file-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/access-control.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/access-control", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/access-credential-manager-as-a-trusted-caller.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/access-this-computer-from-the-network.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/access-this-computer-from-the-network", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/account-lockout-duration.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-duration", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/account-lockout-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/account-lockout-threshold.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-threshold", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/account-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-administrator-account-status.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-administrator-account-status", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-block-microsoft-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-guest-account-status.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-guest-account-status", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-rename-administrator-account.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-rename-administrator-account", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/accounts-rename-guest-account.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-rename-guest-account", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/act-as-part-of-the-operating-system.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/active-directory-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/active-directory-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/active-directory-security-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/active-directory-security-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/add-workstations-to-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/add-workstations-to-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/additional-mitigations.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/additional-mitigations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/adjust-memory-quotas-for-a-process.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/administer-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/administer-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/administer-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/administer-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/advanced-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/advanced-security-auditing-faq.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-auditing-faq", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/advanced-security-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/allow-log-on-locally.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/allow-log-on-locally", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/allow-log-on-through-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/app-behavior-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/app-behavior-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-architecture-and-components.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-architecture-and-components", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-functions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-functions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-policies-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policies-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-policies-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policies-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-policy-use-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policy-use-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-processes-and-interactions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-processes-and-interactions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/applocker-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/assign-security-group-filters-to-the-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-account-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-account-lockout", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-application-generated.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-application-generated", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-application-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-application-group-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-audit-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-audit-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-audit-the-access-of-global-system-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-authentication-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-authentication-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-authorization-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-authorization-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-central-access-policy-staging.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-central-access-policy-staging", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-certification-services.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-certification-services", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-computer-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-computer-account-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-credential-validation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-credential-validation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-detailed-directory-service-replication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-detailed-directory-service-replication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-detailed-file-share.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-detailed-file-share", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-directory-service-access.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-directory-service-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-directory-service-replication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-replication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-distribution-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-distribution-group-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-dpapi-activity.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-dpapi-activity", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-file-share.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-file-share", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-file-system.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-file-system", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-filtering-platform-connection.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-connection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-filtering-platform-packet-drop.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-packet-drop", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-filtering-platform-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-group-membership.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-group-membership", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-handle-manipulation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-handle-manipulation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-ipsec-driver.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-driver", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-ipsec-extended-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-extended-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-ipsec-main-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-main-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-ipsec-quick-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-quick-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-kerberos-authentication-service.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kerberos-authentication-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-kerberos-service-ticket-operations.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kerberos-service-ticket-operations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-kernel-object.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kernel-object", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-logoff.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-logoff", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-logon", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-mpssvc-rule-level-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-network-policy-server.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-network-policy-server", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-non-sensitive-privilege-use.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-non-sensitive-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-account-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-account-logon-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-account-management-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-account-management-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-logonlogoff-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-logonlogoff-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-object-access-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-object-access-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-policy-change-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-policy-change-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-privilege-use-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-privilege-use-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-other-system-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-system-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-pnp-activity.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-pnp-activity", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-process-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-process-creation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-process-termination.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-process-termination", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-registry.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-registry", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-removable-storage.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-removable-storage", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-rpc-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-rpc-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-sam.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-sam", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-security-group-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-group-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-security-state-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-state-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-security-system-extension.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-system-extension", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-sensitive-privilege-use.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-sensitive-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-special-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-special-logon", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-system-integrity.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-system-integrity", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-user-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-user-account-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/audit-user-device-claims.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-user-device-claims", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/back-up-files-and-directories.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/back-up-files-and-directories", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-account-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-account-logon-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-account-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-account-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-directory-service-access.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-directory-service-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-logon-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-logon-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-object-access.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-object-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-policy-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-policy-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-privilege-use.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-privilege-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-process-tracking.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-process-tracking", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-audit-system-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-system-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-firewall-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/basic-firewall-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-security-audit-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-security-audit-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/basic-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bcd-settings-and-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bcd-settings-and-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-basic-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-basic-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-countermeasures.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-countermeasures", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-device-encryption-overview-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-frequently-asked-questions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-frequently-asked-questions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-how-to-enable-network-unlock.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-recovery-guide-plan.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-recovery-guide-plan", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/block-untrusted-fonts-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/block-untrusted-fonts-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/boundary-zone-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/boundary-zone-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/boundary-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/boundary-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/bypass-traverse-checking.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/bypass-traverse-checking", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/certificate-based-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/certificate-based-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-rules-from-request-to-require-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-the-system-time.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/change-the-system-time", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-the-time-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/change-the-time-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-the-tpm-owner-password.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/change-the-tpm-owner-password", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-basic-firewall-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-creating-group-policy-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-group-policy-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-creating-inbound-firewall-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-creating-outbound-firewall-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/choose-the-right-bitlocker-countermeasure.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/command-line-arguments-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configuration-management-reference-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-an-applocker-policy-for-audit-only.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-authentication-methods.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-authentication-methods", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-data-protection-quick-mode-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-email-notifications-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-exceptions-for-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-key-exchange-main-mode-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-network-connections-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-notifications-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-protection-features-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-remediation-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-s-mime.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/configure-s-mime", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-application-identity-service.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-the-application-identity-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-appLocker-reference-device.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-the-appLocker-reference-device", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-rules-to-require-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-windows-firewall-log.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-windows-firewall-log", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-the-workstation-authentication-certificate-template.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-windows-defender-antivirus-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-group-account-in-active-directory.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-a-group-account-in-active-directory", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-group-policy-object.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-a-group-policy-object", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-pagefile.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-pagefile", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-rule-for-packaged-apps.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-for-packaged-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-rule-that-uses-a-path-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-a-token-object.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-token-object", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-authentication-exemption-list-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-authentication-request-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-authentication-request-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-inbound-icmp-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-icmp-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-inbound-port-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-port-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-inbound-program-or-service-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-outbound-port-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-outbound-port-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-an-outbound-program-or-service-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-and-verify-an-efs-dra-certificate.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-global-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-global-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-inbound-rules-to-support-rpc.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-permanent-shared-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-permanent-shared-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-symbolic-links.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-symbolic-links", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-vpn-and-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-wip-policy-using-sccm.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-wmi-filters-for-the-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-your-applocker-planning-document.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-planning-document", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-your-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/create-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-manage.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-manage", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-not-protected-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-not-protected-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-protection-limits.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-protection-limits", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/customize-run-review-remediate-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/debug-programs.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/debug-programs", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/delete-an-applocker-rule.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/delete-an-applocker-rule", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-access-to-this-computer-from-the-network.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-log-on-as-a-batch-job.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-log-on-as-a-service.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-log-on-locally.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-locally", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deny-log-on-through-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-code-integrity-policies-steps.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-code-integrity-policies-steps", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-the-applocker-policy-into-production.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/deploy-the-applocker-policy-into-production", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-wip-policy-using-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deployment-vdi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/determine-your-application-control-objectives.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-your-application-control-objectives", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/determining-the-trusted-state-of-your-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/device-guard-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-allow-undock-without-having-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dll-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/dll-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/document-your-application-control-management-processes.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-application-control-management-processes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/document-your-application-list.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-application-list", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/document-your-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/documenting-the-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/documenting-the-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-controller-ldap-server-signing-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/domain-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/domain-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-disable-machine-account-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-maximum-machine-account-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/dynamic-access-control.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/dynamic-access-control", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/edit-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/edit-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/edit-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/edit-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-predefined-inbound-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/enable-predefined-inbound-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-predefined-outbound-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/enable-predefined-outbound-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enable-the-dll-rule-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/enable-the-dll-rule-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/encrypted-hard-drive.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/encrypted-hard-drive", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/encryption-zone-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/encryption-zone-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/encryption-zone.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/encryption-zone", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enforce-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/enforce-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enforce-password-history.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enforce-password-history", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enforce-user-logon-restrictions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enforce-user-logon-restrictions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enlightened-microsoft-apps-and-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/enterprise-certificate-pinning.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/enterprise-certificate-pinning", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/evaluate-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1100.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1100", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1102.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1102", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1104.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1104", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1105.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1105", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-1108.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1108", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4608.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4608", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4610.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4610", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4611.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4611", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4612.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4612", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4614.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4614", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4615.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4615", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4616.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4616", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4618.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4618", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4621.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4621", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4622.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4622", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4624.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4624", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4625.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4625", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4626.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4626", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4627.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4627", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4634.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4634", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4647.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4647", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4648.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4648", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4649.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4649", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4656.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4656", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4657.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4657", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4658.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4658", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4660.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4660", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4661.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4661", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4662.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4662", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4663.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4663", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4664.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4664", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4670.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4670", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4671.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4671", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4672.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4672", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4673.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4673", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4674.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4674", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4675.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4675", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4688.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4688", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4689.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4689", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4690.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4690", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4691.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4691", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4692.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4692", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4693.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4693", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4694.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4694", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4695.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4695", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4696.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4696", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4697.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4697", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4698.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4698", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4699.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4699", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4700.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4700", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4701.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4701", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4702.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4702", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4703.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4703", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4704.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4704", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4705.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4705", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4706.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4706", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4707.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4707", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4713.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4713", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4714.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4714", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4715.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4715", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4716.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4716", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4717.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4717", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4718.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4718", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4719.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4719", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4720.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4720", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4722.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4722", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4723.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4723", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4724.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4724", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4725.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4725", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4726.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4726", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4731.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4731", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4732.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4732", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4733.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4733", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4734.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4734", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4735.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4735", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4738.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4738", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4739.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4739", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4740.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4740", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4741.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4741", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4742.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4742", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4743.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4743", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4749.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4749", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4750.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4750", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4751.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4751", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4752.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4752", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4753.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4753", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4764.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4764", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4765.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4765", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4766.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4766", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4767.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4767", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4768.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4768", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4769.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4769", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4770.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4770", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4771.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4771", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4772.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4772", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4773.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4773", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4774.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4774", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4775.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4775", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4776.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4776", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4777.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4777", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4778.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4778", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4779.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4779", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4780.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4780", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4781.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4781", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4782.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4782", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4793.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4793", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4794.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4794", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4798.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4798", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4799.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4799", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4800.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4800", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4801.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4801", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4802.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4802", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4803.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4803", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4816.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4816", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4817.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4817", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4818.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4818", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4819.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4819", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4826.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4826", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4864.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4864", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4865.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4865", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4866.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4866", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4867.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4867", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4902.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4902", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4904.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4904", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4905.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4905", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4906.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4906", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4907.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4907", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4908.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4908", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4909.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4909", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4910.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4910", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4911.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4911", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4912.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4912", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4913.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4913", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4928.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4928", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4929.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4929", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4930.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4930", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4931.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4931", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4932.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4932", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4933.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4933", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4934.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4934", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4935.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4935", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4936.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4936", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4937.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4937", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4944.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4944", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4945.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4945", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4946.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4946", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4947.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4947", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4948.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4948", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4949.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4949", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4950.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4950", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4951.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4951", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4952.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4952", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4953.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4953", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4954.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4954", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4956.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4956", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4957.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4957", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4958.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4958", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4964.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4964", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-4985.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4985", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5024.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5024", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5025.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5025", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5027.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5027", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5028.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5028", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5029.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5029", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5030.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5030", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5031.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5031", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5032.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5032", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5033.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5033", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5034.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5034", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5035.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5035", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5037.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5037", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5038.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5038", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5039.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5039", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5051.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5051", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5056.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5056", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5057.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5057", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5058.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5058", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5059.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5059", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5060.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5060", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5061.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5061", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5062.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5062", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5063.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5063", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5064.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5064", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5065.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5065", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5066.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5066", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5067.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5067", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5068.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5068", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5069.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5069", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5070.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5070", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5136.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5136", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5137.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5137", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5138.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5138", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5139.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5139", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5140.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5140", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5141.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5141", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5142.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5142", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5143.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5143", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5144.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5144", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5145.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5145", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5148.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5148", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5149.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5149", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5150.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5150", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5151.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5151", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5152.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5152", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5153.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5153", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5154.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5154", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5155.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5155", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5156.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5156", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5157.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5157", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5158.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5158", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5159.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5159", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5168.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5168", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5376.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5376", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5377.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5377", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5378.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5378", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5447.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5447", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5632.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5632", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5633.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5633", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5712.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5712", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5888.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5888", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5889.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5889", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-5890.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5890", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6144.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6144", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6145.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6145", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6281.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6281", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6400.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6400", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6401.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6401", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6402.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6402", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6403.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6403", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6404.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6404", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6405.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6405", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6406.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6406", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6407.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6407", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6408.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6408", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6409.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6409", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6410.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6410", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6416.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6416", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6419.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6419", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6420.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6420", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6421.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6421", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6422.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6422", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6423.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6423", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-6424.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6424", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/executable-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/executable-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/exempt-icmp-from-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/exempt-icmp-from-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/exemption-list.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/exemption-list", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/export-an-applocker-policy-from-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/file-system-global-object-access-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/file-system-global-object-access-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/firewall-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/firewall-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/firewall-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/firewall-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/force-shutdown-from-a-remote-system.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-information-about-your-active-directory-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-information-about-your-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-other-relevant-information.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-other-relevant-information", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gathering-the-information-you-need.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-the-information-you-need", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/generate-security-audits.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/generate-security-audits", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-boundary.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-boundary", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-firewall.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-firewall", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-isolateddomain-clients.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/gpo-domiso-isolateddomain-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/guidance-and-best-practices-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-and-password-changes.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-and-password-changes", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-biometrics-in-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-errors-during-pin-creation.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-event-300.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-event-300", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-how-it-works.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-how-it-works", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-identity-verification.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-manage-in-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-manage-in-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-prepare-people-to-use.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-prepare-people-to-use", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/hello-why-pin-is-better-than-password.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/how-applocker-works-techref.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/how-applocker-works-techref", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/how-to-configure-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/how-user-account-control-works.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/how-user-account-control-works", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/impersonate-a-client-after-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/import-an-applocker-policy-from-another-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/import-an-applocker-policy-from-another-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/import-an-applocker-policy-into-a-gpo.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/increase-a-process-working-set.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/increase-a-process-working-set", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/increase-scheduling-priority.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/increase-scheduling-priority", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/installing-digital-certificates-on-windows-10-mobile", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-do-not-display-last-user-name.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-machine-inactivity-limit.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-require-smart-card.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-require-smart-card", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/interactive-logon-smart-card-removal-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/isolated-domain-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolated-domain-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/isolated-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolated-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/isolating-apps-on-your-network.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolating-apps-on-your-network", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/kerberos-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/kerberos-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/limitations-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/limitations-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/link-the-gpo-to-the-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/link-the-gpo-to-the-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/load-and-unload-device-drivers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/load-and-unload-device-drivers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/local-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/local-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/lock-pages-in-memory.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/lock-pages-in-memory", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/log-on-as-a-batch-job.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/log-on-as-a-batch-job", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/log-on-as-a-service.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/log-on-as-a-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-auditing-and-security-log.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/manage-auditing-and-security-log", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-packaged-apps-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/manage-packaged-apps-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-tpm-commands.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/manage-tpm-commands", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-tpm-lockout.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/manage-tpm-lockout", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-updates-baselines-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/mandatory-settings-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-lifetime-for-service-ticket.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/merge-applocker-policies-manually.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/merge-applocker-policies-manually", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/microsoft-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/minimum-password-age.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/minimum-password-age", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/minimum-password-length.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/minimum-password-length", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/modify-an-object-label.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/modify-an-object-label", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/modify-firmware-environment-values.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/modify-firmware-environment-values", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-application-usage-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/monitor-application-usage-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-claim-types.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-claim-types", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-resource-attribute-definitions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-resource-attribute-definitions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-the-use-of-removable-storage-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-allow-anonymous-sidname-translation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-list-manager-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-list-manager-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-lan-manager-authentication-level.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-ldap-client-signing-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/open-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/optimize-applocker-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/optimize-applocker-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/other-events.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/other-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/override-mitigation-options-for-app-related-security-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/overview-create-wip-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/overview-create-wip-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/password-must-meet-complexity-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/password-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/password-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/perform-volume-maintenance-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/plan-for-applocker-policy-management.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/plan-for-applocker-policy-management", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-certificate-based-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-certificate-based-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-domain-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-domain-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-gpo-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-gpo-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-isolation-groups-for-the-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-network-access-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-network-access-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-server-isolation-zones.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-server-isolation-zones", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-the-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-the-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/prevent-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/preview-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/procedures-used-in-this-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/procedures-used-in-this-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/profile-single-process.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/profile-single-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/profile-system-performance.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/profile-system-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-devices-from-unwanted-network-traffic.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-enterprise-data-using-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/recommended-network-definitions-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/refresh-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/refresh-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/registry-global-object-access-auditing.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/registry-global-object-access-auditing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/remote-credential-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/remote-credential-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/remove-computer-from-docking-station.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/remove-computer-from-docking-station", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/replace-a-process-level-token.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/replace-a-process-level-token", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/report-monitor-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/requirements-for-deploying-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/requirements-for-deploying-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/requirements-to-use-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/requirements-to-use-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/reset-account-lockout-counter-after.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/reset-account-lockout-counter-after", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/restore-files-and-directories.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/restore-files-and-directories", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/restrict-access-to-only-trusted-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/review-scan-results-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/run-scan-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/run-the-automatically-generate-rules-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/run-the-automatically-generate-rules-wizard", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/script-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/script-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/secpol-advanced-security-audit-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-auditing-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/security-auditing-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-considerations-for-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/security-considerations-for-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-identifiers.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/security-identifiers", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-options.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-options", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-policy-settings-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-policy-settings-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/security-principals.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/security-principals", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/select-types-of-rules-to-create.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/select-types-of-rules-to-create", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/server-isolation-gpos.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-gpos", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/server-isolation-policy-design-example.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-policy-design-example", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/server-isolation-policy-design.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-policy-design", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/service-accounts.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/service-accounts", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/service-status-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/settings-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/shut-down-the-system.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shut-down-the-system", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-and-remote-desktop-services.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-and-remote-desktop-services", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-certificate-propagation-service.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-certificate-propagation-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-certificate-requirements-and-enumeration.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-debugging-information.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-debugging-information", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-events.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-events", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-group-policy-and-registry-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-how-smart-card-sign-in-works-in-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-removal-policy-service.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-removal-policy-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-smart-cards-for-windows-service.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-tools-and-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-tools-and-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/smart-card-windows-smart-card-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/special-identities.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/special-identities", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/store-passwords-using-reversible-encryption.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/synchronize-directory-service-data.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/synchronize-directory-service-data", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-settings-optional-subsystems.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-settings-optional-subsystems", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/take-ownership-of-files-or-other-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/test-and-update-an-applocker-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/test-and-update-an-applocker-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/testing-scenarios-for-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/tools-to-use-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/tools-to-use-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/tpm-fundamentals.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/tpm-fundamentals", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/tpm-recommendations.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/tpm-recommendations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/troubleshoot-siem-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/trusted-platform-module-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/trusted-platform-module-services-group-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/trusted-platform-module-top-node.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-top-node", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understand-applocker-enforcement-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-enforcement-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understand-applocker-policy-design-decisions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-policy-design-decisions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understand-the-applocker-policy-deployment-process.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-the-applocker-policy-deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-default-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-default-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-rule-behavior.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-behavior", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-rule-collections.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-collections", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-rule-condition-types.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-condition-types", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-applocker-rule-exceptions.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-exceptions", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/understanding-the-windows-firewall-with-advanced-security-design-process.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-group-policy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-intune-config-manager-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/use-wmi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-security-policy-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-security-policy-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/user-rights-assignment.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-rights-assignment", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/using-event-viewer-with-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/using-event-viewer-with-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/using-owa-with-wip.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/using-owa-with-wip", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/verify-that-network-traffic-is-authenticated.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/view-the-security-event-log.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/view-the-security-event-log", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-deploy-virtual-smart-cards.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-evaluate-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-tpmvscmgr.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-understanding-and-evaluating.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/virtual-smart-card-use-virtual-smart-cards.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-authentication.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-authentication", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-auto-trigger-profile.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-auto-trigger-profile", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-conditional-access.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-conditional-access", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-connection-type.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-connection-type", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-name-resolution.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-name-resolution", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-profile-options.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-profile-options", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-routing.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-routing", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/vpn-security-features.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-security-features", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/what-is-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/what-is-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-10-mobile-security-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/windows-10-mobile-security-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-credential-theft-mitigation-guide-abstract", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-antivirus-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-antivirus-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-offline.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/windows-defender-offline", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-security-center-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-firewall-with-advanced-security.md", + "redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-installer-rules-in-applocker.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/windows-installer-rules-in-applocker", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-security-baselines.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/windows-security-baselines", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/wip-app-enterprise-context.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/wip-app-enterprise-context", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/working-with-applocker-policies.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/working-with-applocker-policies", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/working-with-applocker-rules.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/working-with-applocker-rules", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/acquire-apps-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/acquire-apps-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/add-unsigned-app-to-code-integrity-policy.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/add-unsigned-app-to-code-integrity-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/administrative-tools-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/administrative-tools-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/app-inventory-management-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/apps-in-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/apps-in-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-about-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-about-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-administering-appv-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-administering-appv-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-administering-virtual-applications-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-allow-administrators-to-enable-connection-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-application-publishing-and-client-interaction.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-application-publishing-and-client-interaction", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-apply-the-user-configuration-file-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-auto-batch-sequencing.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-batch-sequencing", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-auto-batch-updating.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-batch-updating", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-auto-clean-unpublished-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-clean-unpublished-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-auto-provision-a-vm.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-provision-a-vm", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-available-mdm-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-available-mdm-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-capacity-planning.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-capacity-planning", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-client-configuration-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-client-configuration-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-configure-access-to-packages-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-connect-to-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connect-to-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-connection-group-file.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connection-group-file", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-connection-group-virtual-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connection-group-virtual-environment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-connection-group.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-connection-group", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-package-accelerator-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-package-accelerator.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-package-accelerator", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-a-virtual-application-package-package-accelerator.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-create-and-use-a-project-template.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-and-use-a-project-template", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-creating-and-managing-virtualized-applications.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-delete-a-connection-group.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-delete-a-connection-group", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-delete-a-package-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-delete-a-package-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploy-appv-databases-with-sql-scripts.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploy-the-appv-server-with-a-script.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploy-the-appv-server.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-the-appv-server", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-microsoft-office-2013-with-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-microsoft-office-2016-with-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-the-appv-sequencer-and-client.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deploying-the-appv-server.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-server", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-deployment-checklist.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deployment-checklist", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-dynamic-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-dynamic-configuration", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-enable-the-app-v-desktop-client.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-the-app-v-desktop-client", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-evaluating-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-evaluating-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-for-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-getting-started.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-getting-started", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-high-level-architecture.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-high-level-architecture", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-management-server-on-a-standalone-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-install-the-sequencer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-sequencer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-maintaining-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-maintaining-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-managing-connection-groups.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-managing-connection-groups", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-migrating-to-appv-from-a-previous-version.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-modify-an-existing-virtual-application-package.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-modify-client-configuration-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-modify-client-configuration-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-move-the-appv-server-to-another-computer.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-operations.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-operations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-performance-guidance.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-performance-guidance", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-checklist.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-checklist", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-folder-redirection-with-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-folder-redirection-with-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-appv-server-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-appv-server-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-high-availability-with-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-high-availability-with-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-sequencer-and-client-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-for-using-appv-with-office.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-using-appv-with-office", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-planning-to-deploy-appv.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-to-deploy-appv", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-preparing-your-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-preparing-your-environment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-prerequisites.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-prerequisites", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-publish-a-connection-group.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-publish-a-connection-group", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-publish-a-packages-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-register-and-unregister-a-publishing-server-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-release-notes-for-appv-for-windows-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-release-notes-for-appv-for-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-release-notes-for-appv-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-reporting.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-reporting", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-running-locally-installed-applications-inside-a-virtual-environment.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-security-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-security-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-sequence-a-new-application.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-sequence-a-new-application", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-sequence-a-package-with-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-sequence-a-package-with-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-supported-configurations.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-supported-configurations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-troubleshooting", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-using-the-client-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-using-the-client-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/appv-viewing-appv-server-publishing-metadata.md", + "redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/assign-apps-to-employees.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/assign-apps-to-employees", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/configure-mdm-provider-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/configure-mdm-provider-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/connect-to-remote-aadj-pc.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/connect-to-remote-aadj-pc", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/device-guard-signing-portal.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/device-guard-signing-portal", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/distribute-apps-from-your-private-store.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-from-your-private-store", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/distribute-apps-to-your-employees-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/distribute-apps-with-management-tool.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-with-management-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/distribute-offline-apps.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-offline-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/find-and-acquire-apps-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/find-and-acquire-apps-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/group-policies-for-enterprise-and-education-editions.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/group-policies-for-enterprise-and-education-editions", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/join-windows-10-mobile-to-azure-active-directory.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/join-windows-10-mobile-to-azure-active-directory", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-access-to-private-store.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-access-to-private-store", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-apps-windows-store-for-business-overview.md", + "redirect_url": "/microsoft-store/manage-apps-windows-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/manage-apps-windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-apps-microsoft-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-corporate-devices.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-orders-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/manage-orders-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-private-store-settings.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-private-store-settings", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-settings-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/manage-settings-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-users-and-groups-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/manage-users-and-groups-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-windows-10-in-your-organization-modern-management.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/mandatory-user-profile.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mandatory-user-profile", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/new-policies-for-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/new-policies-for-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/prerequisites-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/prerequisites-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/reset-a-windows-10-mobile-device.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/reset-a-windows-10-mobile-device", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/roles-and-permissions-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/roles-and-permissions-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/settings-reference-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/settings-reference-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-microsoft-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/sign-code-integrity-policy-with-device-guard-signing.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-code-integrity-policy-with-device-guard-signing", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/sign-up-windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/sign-up-windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/sign-up-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/sign-up-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/troubleshoot-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-windows-store-for-business", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/troubleshoot-windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-microsoft-store-for-business", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-administering-uev.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-administering-uev", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-application-template-schema-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-application-template-schema-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-configuring-uev-with-group-policy-objects.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-deploy-required-features.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-deploy-required-features", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-deploy-uev-for-custom-applications.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-for-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-getting-started.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-getting-started", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-manage-administrative-backup-and-restore.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-manage-configurations.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-manage-configurations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-migrating-settings-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-migrating-settings-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-prepare-for-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-prepare-for-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-release-notes-1607.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-release-notes-1607", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-security-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-security-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-sync-methods.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-sync-methods", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-sync-trigger-events.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-sync-trigger-events", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-synchronizing-microsoft-office-with-uev.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-troubleshooting", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-upgrade-uev-from-previous-releases.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-using-uev-with-application-virtualization-applications.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-whats-new-in-uev-for-windows.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/update-windows-store-for-business-account-settings.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/update-windows-store-for-business-account-settings", + "redirect_document_id": true + }, + { + "source_path": "store-for-business/update-windows-store-for-business-account-settings.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings", + "redirect_document_id": false + }, + { + "source_path": "store-for-business/work-with-partner-microsoft-store-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/commerce/manage-partners", + "redirect_document_id": false + }, + { + "source_path": "windows/manage/windows-10-mobile-and-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-libraries.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/windows-libraries", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-store-for-business-overview.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/working-with-line-of-business-apps.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/act-technical-reference.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/act-technical-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/applying-filters-to-data-in-the-sua-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/available-data-types-and-operators-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/best-practice-recommendations-for-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/best-practice-recommendations-for-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/change-history-for-plan-for-windows-10-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/compatibility-administrator-users-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-administrator-users-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/compatibility-fix-database-management-strategies-and-deployment.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/deployment-considerations-for-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/deployment-considerations-for-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/device-dialog-box.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/device-dialog-box", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/fixing-applications-by-using-the-sua-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/fixing-applications-by-using-the-sua-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/prepare-your-organization-for-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/prepare-your-organization-for-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/security-and-data-protection-considerations-for-windows-to-go.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/showing-messages-generated-by-the-sua-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/showing-messages-generated-by-the-sua-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/sua-users-guide.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/sua-users-guide", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/tabs-on-the-sua-tool-interface.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/tabs-on-the-sua-tool-interface", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/testing-your-application-mitigation-packages.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/testing-your-application-mitigation-packages", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/understanding-and-using-compatibility-fixes.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/understanding-and-using-compatibility-fixes", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/using-the-compatibility-administrator-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-compatibility-administrator-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/using-the-sdbinstexe-command-line-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sdbinstexe-command-line-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/using-the-sua-tool.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sua-tool", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/using-the-sua-wizard.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sua-wizard", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/viewing-the-events-screen-in-compatibility-administrator.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-deployment-considerations.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-deployment-considerations", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-enterprise-faq-itpro.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-10-infrastructure-requirements.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-infrastructure-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-to-go-frequently-asked-questions.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-to-go-frequently-asked-questions", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/windows-to-go-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-to-go-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/update/change-history-for-update-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/change-history-for-update-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/update/update-compliance-get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/update/update-compliance-monitor.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor", + "redirect_document_id": true + }, + { + "source_path": "windows/update/update-compliance-using.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-branchcache.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-branchcache", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-configure-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-delivery-optimization.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-deployment-rings-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-integrate-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-integrate-wufb", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-manage-updates-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-configuration-manager", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-manage-updates-wsus.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-manage-updates-wufb.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", + "redirect_document_id": false + }, + { + "source_path": "windows/update/waas-mobile-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-mobile-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-optimize-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-quick-start.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-quick-start", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-restart.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-restart", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-servicing-branches-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-branches-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-servicing-strategy-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-windows-insider-for-business-aad.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business-aad", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-windows-insider-for-business.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business", + "redirect_document_id": true + }, + { + "source_path": "windows/update/waas-wufb-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/manage-settings-app-with-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/manage-settings-app-with-group-policy", + "redirect_document_id": true + }, + { + "source_path": "windows/client-management/mdm/create-a-custom-configuration-service-provider.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/client-management/mdm/design-a-custom-windows-csp.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/iconfigserviceprovider2.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/iconfigserviceprovider2getnode.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnode.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodeadd.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodeclear.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodecopy.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodedeletechild.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodedeleteproperty.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodeexecute.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodegetchildnodenames.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodegetproperty.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodegetpropertyidentifiers.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodegetvalue.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodemove.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodesetproperty.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodesetvalue.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspnodetransactioning.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/icspvalidate.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-surface-hub", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-surface-hub.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-iot-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-iot-enterprise", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-iot-enterprise.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-enterprise", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-iot-core.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-iot-core", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-iot-core.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-hololens2.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-hololens2", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-hololens2.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-hololens-1st-gen-development-edition.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-hololens-1st-gen-development-edition", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-hololens-1st-gen-development-edition.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-hololens-1st-gen-commercial-suite.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-hololens-1st-gen-commercial-suite", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-hololens-1st-gen-commercial-suite.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-admx-backed.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-admx-backed", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-admx-backed.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-admx-backed", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policies-supported-by-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-csps-supported-by-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-supported-by-group-policy.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy", + "redirect_document_id": false + }, + { + "source_path": "windows/client-management/mdm/policy-csps-that-can-be-set-using-eas.md", + "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/collect-wip-audit-event-logs.md", + "redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/deploy-managed-installer-for-device-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-managed-installer-for-device-guard", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/upgrade-readiness-data-sharing.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-data-sharing", + "redirect_document_id": true + }, + { + "source_path": "windows/index.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/index.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/deploy/index.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/index", + "redirect_document_id": true + }, + { + "source_path": "windows/plan/index.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/index", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/index.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/windows-store-for-business.md", + "redirect_url": "https://docs.microsoft.com/microsoft-store/index", + "redirect_document_id": true + }, + { + "source_path": "windows/update/index.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", + "redirect_document_id": true + }, + { + "source_path": "windows/configure/index.md", + "redirect_url": "https://docs.microsoft.com/windows/configuration/index", + "redirect_document_id": true + }, + { + "source_path": "browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md", + "redirect_url": "https://docs.microsoft.com/internet-explorer/kb-support/ie-edge-faqs", + "redirect_document_id": false + }, + { + "source_path": "windows/keep-secure/security-technologies.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "education/get-started/index.md", + "redirect_url": "/education/get-started/get-started-with-microsoft-education", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/windows-10-enterprise-security-guides.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/keep-secure/change-history-for-keep-windows-10-secure.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/manage/change-history-for-manage-and-update-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/windows-10/index", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/update/waas-servicing-branches-windows-10-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-10-enterprise-activation-subscription.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-10-auto-pilot.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/privacy/basic-level-windows-diagnostic-events-and-fields.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/configure-windows-diagnostic-data-in-your-organization.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/diagnostic-data-viewer-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/gdpr-win10-whitepaper.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/gdpr-win10-whitepaper", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/manage-windows-endpoints-version-1709.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/manage-windows-endpoints", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/windows-diagnostic-data-1703.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-diagnostic-data-1703", + "redirect_document_id": true + }, + { + "source_path": "windows/configuration/windows-diagnostic-data.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-diagnostic-data", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/upgrade/windows-10-edition-downgrades.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades", + "redirect_document_id": true + }, + { + "source_path": "education/windows/windows-automatic-redeployment.md", + "redirect_url": "https://docs.microsoft.com/education/windows/autopilot-reset", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-10-autopilot.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot", + "redirect_document_id": false + }, + { + "source_path": "windows/privacy/manage-windows-endpoints.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/manage-windows-2004-endpoints", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alerts", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-information", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-filemachineaction-object", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-filemachineactions-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machineaction-object", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-started", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/get-started.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/index", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/isolate-machine", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-av-scan", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-information", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicator-by-id-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-analytics", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/files", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machineaction", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/machineactionsnote.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/ti-indicator", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/update-alert", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/incidents-queue.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/incidents-queue", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/use-apis.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/user-alert-windows-defender-advanced-threat-protection-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/planning/windows-10-fall-creators-deprecation.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1709-removed-features", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/planning/windows-10-creators-update-deprecation.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1703-removed-features", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators-windows-defender-advanced-threat-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-indicators", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-10-enterprise-subscription-activation.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation", + "redirect_document_id": true + }, + { + "source_path": "windows/hub/windows-10-landing.yml", + "redirect_url": "https://docs.microsoft.com/windows/windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-network.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/user-driven-aad.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/user-driven-hybrid.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/intune-connector.md", + "redirect_url": "https://docs.microsoft.com/intune/windows-autopilot-hybrid", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-reset", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-local.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-reset", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/configure-autopilot.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/administer.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices", + "redirect_document_id": false + }, + { + "source_path": "windows/hub/release-information.md", + "redirect_url": "https://docs.microsoft.com/windows/release-health/release-information", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-10-architecture-posters.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/device-security/index.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection", + "redirect_document_id": true + }, + { + "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md", + "redirect_url": "https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11", + "redirect_document_id": true + }, + { + "source_path": "education/get-started/change-history-ms-edu-get-started.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/get-started-with-microsoft-education.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/configure-microsoft-store-for-education.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/microsoft-store-for-education", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/enable-microsoft-teams.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-teams-for-education", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/finish-setup-and-other-tasks.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/inclusive-classroom-it-admin.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/inclusive-classroom-it-admin", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/set-up-office365-edu-tenant.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/create-your-office-365-tenant", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/set-up-windows-10-education-devices.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/set-up-windows-education-devices.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices", + "redirect_document_id": false + }, + { + "source_path": "education/get-started/use-intune-for-education.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/surface-dock-updater.md", + "redirect_url": "/surface/surface-dock-firmware-update", + "redirect_document_id": true + }, + { + "source_path": "education/get-started/use-school-data-sync.md", + "redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/endpoint-detection-response-mac-preview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew", + "redirect_document_id": true + }, + { + "source_path": "windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-exclusions.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-pua", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-perf.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-kext.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-privacy", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-resources", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-2-enterprise-enhanced-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-3-enterprise-high-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-4-enterprise-devops-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-4-enterprise-devops-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-5-enterprise-administrator-security.md", + "redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-5-enterprise-administrator-security.md", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/product-brief.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/licensing.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment", + "redirect_document_id": true + }, + { + "source_path": "windows/release-information/status-windows-10-1703.yml", + "redirect_url": "https://docs.microsoft.com/windows/release-health/windows-message-center", + "redirect_document_id": true + }, + { + "source_path": "windows/release-information/resolved-issues-windows-10-1703.yml", + "redirect_url": "https://docs.microsoft.com/windows/release-health/windows-message-center", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-1703-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-1709-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-1803-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md", + "redirect_url": "/surface/manage-surface-driver-and-firmware-updates", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/planning/windows-10-1809-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-1903-removed-features.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-azure-portal.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-FAQ-troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-get-started.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-overview.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/windows-analytics-privacy.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/device-health-get-started.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/device-health-monitor.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/device-health-using.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-additional-insights.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-architecture.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-data-sharing.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-deployment-script.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-deploy-windows.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-get-started.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-identify-apps.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-requirements.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-resolve-issues.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-target-new-OS.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md", + "redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/update/waas-manage-updates-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/mdt-lite-touch-components.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#mdt-lite-touch-components", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/key-features-in-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit#key-features-in-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/upgrade-to-windows-10-with-configuraton-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-a-task-sequence-with-configuration-manager-and-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-mdt/deploy-windows-10-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/create-a-task-sequence-with-configuration-manager-and-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager#procedures", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/upgrade-to-windows-10-with-configuraton-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/get-started-with-configuraton-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/deploy-windows-10-with-configuration-manager.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/get-started-with-configuraton-manager", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/deploy-windows-sccm/integrate-configuration-manager-with-mdt.md", + "redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager#integrate-configuration-manager-with-mdt", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device", + "redirect_document_id": false + }, + { + "source_path": "surface/step-by-step-surface-deployment-accelerator.md", + "redirect_url": "https://docs.microsoft.com/surface/microsoft-surface-deployment-accelerator", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode", + "redirect_document_id": true + }, + { + "source_path": "devices/surface/using-the-sda-deployment-share.md", + "redirect_url": "https://docs.microsoft.com/surface/microsoft-surface-deployment-accelerator", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/gov", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/office-365-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/windows-defender-offline", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/privacy/gdpr-win10-whitepaper.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": true + }, + { + "source_path": "windows/privacy/gdpr-it-guidance.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": false + }, + { + "source_path": "windows/privacy/windows-personal-data-services-configuration.md", + "redirect_url": "https://docs.microsoft.com/windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/windows-autopilot/add-devices.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/add-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-device-guidelines.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-device-guidelines", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-faq.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-faq", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-mbr.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-mbr", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-support.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-support", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/autopilot-update.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/autopilot-update", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/bitlocker.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/bitlocker", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/deployment-process.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/deployment-process", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/dfci-management.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/dfci-management", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/enrollment-status.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/enrollment-status", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/existing-devices.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/existing-devices", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/known-issues.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/known-issues", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/policy-conflicts.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/policy-conflicts", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/profiles.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/profiles", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/registration-auth.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/registration-auth", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/self-deploying.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/self-deploying", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/troubleshooting.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/troubleshooting", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/user-driven.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/user-driven", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/white-glove.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/white-glove", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot-requirements", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot-reset", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-scenarios.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot-scenarios", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot-whats-new.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot-whats-new", + "redirect_document_id": true + }, + { + "source_path": "windows/deployment/windows-autopilot/windows-autopilot.md", + "redirect_url": "https://docs.microsoft.com/mem/autopilot/windows-autopilot", + "redirect_document_id": true + }, + { + "source_path": "windows/hub/windows-10.yml", + "redirect_url": "https://docs.microsoft.com/windows/windows-10", + "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr", + "redirect_document_id": false + } + ] } diff --git a/.vscode/extensions.json b/.vscode/extensions.json deleted file mode 100644 index af02986a5a..0000000000 --- a/.vscode/extensions.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "recommendations": [ - "docsmsft.docs-authoring-pack" - ] -} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json index 9c0086e560..f66a07d2e4 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -1,8 +1,5 @@ { - "cSpell.words": [ - "intune", - "kovter", - "kovter's", - "poshspy" - ] + "cSpell.words": [ + "emie" + ] } \ No newline at end of file diff --git a/bcs/docfx.json b/bcs/docfx.json index 2fa639d038..02fe77ff2d 100644 --- a/bcs/docfx.json +++ b/bcs/docfx.json @@ -36,7 +36,16 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/microsoft-365/business/breadcrumb/toc.json", - "extendBreadcrumb": true + "extendBreadcrumb": true, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/browsers/edge/TOC.md b/browsers/edge/TOC.md index 3314f77577..bae1f59877 100644 --- a/browsers/edge/TOC.md +++ b/browsers/edge/TOC.md @@ -28,6 +28,6 @@ ## [Change history for Microsoft Edge](change-history-for-microsoft-edge.md) -## [Microsoft Edge Frequently Asked Questions (FAQs)](microsoft-edge-faq.md) +## [Microsoft Edge Frequently Asked Questions (FAQ)](microsoft-edge-faq.yml) diff --git a/browsers/edge/about-microsoft-edge.md b/browsers/edge/about-microsoft-edge.md index e2453e5990..e0085148dd 100644 --- a/browsers/edge/about-microsoft-edge.md +++ b/browsers/edge/about-microsoft-edge.md @@ -11,7 +11,6 @@ ms.prod: edge ms.mktglfcycl: general ms.topic: reference ms.sitesec: library -title: Microsoft Edge for IT Pros ms.localizationpriority: medium ms.date: 10/02/2018 --- diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 37bef54e3a..48d52140c5 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -1,5 +1,5 @@ --- -description: You can customize your organization’s browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. +description: You can customize your organization's browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. ms.assetid: 2e849894-255d-4f68-ae88-c2e4e31fa165 ms.reviewer: author: dansimp @@ -18,7 +18,10 @@ ms.localizationpriority: medium > Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile -You can customize your organization’s browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. For example, you can set up multiple security settings in a Group Policy Object (GPO) linked to a domain, and then apply those settings to every computer in the domain. +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +You can customize your organization's browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. For example, you can set up multiple security settings in a Group Policy Object (GPO) linked to a domain, and then apply those settings to every computer in the domain. Other policy settings in Microsoft Edge include allowing Adobe Flash content to play automatically, provision a favorites list, set default search engine, and more. You configure a Group Policy setting in the Administrative Templates folders, which are registry-based policy settings that Group Policy enforces. Group Policy stores these settings in a specific registry location, which users cannot change. Also, Group Policy-aware Windows features and applications look for these settings in the registry, and if found the policy setting gets used instead of the regular settings. diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md index 2529a88fea..af27551fc8 100644 --- a/browsers/edge/change-history-for-microsoft-edge.md +++ b/browsers/edge/change-history-for-microsoft-edge.md @@ -60,7 +60,7 @@ We have discontinued the **Configure Favorites** group policy, so use the [Provi |New or changed topic | Description | |---------------------|-------------| -|[Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros](microsoft-edge-faq.md) | New | +|[Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros](microsoft-edge-faq.yml) | New | ## February 2017 diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index 640106062b..1ef3407e17 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -42,7 +42,16 @@ "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Edge" + "titleSuffix": "Edge", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "externalReference": [], "template": "op.html", diff --git a/browsers/edge/group-policies/index.yml b/browsers/edge/group-policies/index.yml index cb590ce308..8fb16843d8 100644 --- a/browsers/edge/group-policies/index.yml +++ b/browsers/edge/group-policies/index.yml @@ -1,231 +1,80 @@ -### YamlMime:YamlDocument +### YamlMime:Landing -documentType: LandingData - -title: Microsoft Edge Legacy group policies +title: Microsoft Edge Legacy group policies # < 60 chars +summary: Microsoft Edge Legacy works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. # < 160 chars metadata: - - document_id: - - title: Microsoft Edge Legacy group policies - - description: Learn how to configure group policies in Microsoft Edge Legacy on Windows 10. - - text: Some of the features in Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. (To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) - + title: Microsoft Edge Legacy # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # Required; article description that is displayed in search results. < 160 chars. keywords: Microsoft Edge Legacy, Windows 10, Windows 10 Mobile - ms.localizationpriority: medium - + ms.prod: edge author: shortpatti - ms.author: pashort - - ms.date: 10/02/2018 - - ms.topic: article - + ms.topic: landing-page ms.devlang: na - -sections: - -- title: - -- items: - - - type: markdown - - text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Microsoft Edge Legacy works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. - -- items: - - - type: list - - style: cards - - className: cardsE - - columns: 3 - - items: - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/address-bar-settings-gp - - html:

Learn how you can configure Microsoft Edge to show search suggestions in the address bar.

- - image: - - src: https://docs.microsoft.com/media/common/i_http.svg - - title: Address bar - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/adobe-settings-gp - - html:

Learn how you can configure Microsoft Edge to load Adobe Flash content automatically.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Adobe Flash - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/books-library-management-gp - - html:

Learn how you can set up and use the books library, such as using a shared books folder for students and teachers.

- - image: - - src: https://docs.microsoft.com/media/common/i_library.svg - - title: Books Library - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/browser-settings-management-gp - - html:

Learn how you can customize the browser settings, such as printing and saving browsing history, plus more.

- - image: - - src: https://docs.microsoft.com/media/common/i_management.svg - - title: Browser experience - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/developer-settings-gp - - html:

Learn how to configure Microsoft Edge for development and testing.

- - image: - - src: https://docs.microsoft.com/media/common/i_config-tools.svg - - title: Developer tools - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/extensions-management-gp - - html:

Learn how you can configure Microsoft Edge to either prevent or allow users to install and run unverified extensions.

- - image: - - src: https://docs.microsoft.com/media/common/i_extensions.svg - - title: Extensions - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/favorites-management-gp - - html:

Learn how you can provision a standard favorites list as well as keep the favorites lists in sync between IE11 and Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_link.svg - - title: Favorites - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/home-button-gp - - html:

Learn how you can customize the home button or hide it.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Home button - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp - - html:

Learn how you use Microsoft Edge and Internet Explorer together for a full browsing experience.

- - image: - - src: https://docs.microsoft.com/media/common/i_management.svg - - title: Interoperability and enterprise guidance - - - href: https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy - - html:

Learn how Microsoft Edge kiosk mode works with assigned access to let IT administrators create a tailored browsing experience designed for kiosk devices.

- - image: - - src: https://docs.microsoft.com/media/common/i_categorize.svg - - title: Kiosk mode deployment in Microsoft Edge - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/new-tab-page-settings-gp - - html:

Learn how to configure the New Tab page in Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: New Tab page - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/prelaunch-preload-gp - - html:

Learn how pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Prelaunch Microsoft Edge and preload tabs - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/search-engine-customization-gp - - html:

Learn how you can set the default search engine and configure additional ones.

- - image: - - src: https://docs.microsoft.com/media/common/i_search.svg - - title: Search engine customization - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp - - html:

Learn how you can keep your environment and users safe from attacks.

- - image: - - src: https://docs.microsoft.com/media/common/i_security-management.svg - - title: Security and privacy - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/start-pages-gp - - html:

Learn how to configure the Start pages in Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Start page - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/sync-browser-settings-gp - - html:

Learn how to you can prevent the "browser" group from syncing and prevent users from turning on the Sync your Settings toggle.

- - image: - - src: https://docs.microsoft.com/media/common/i_sync.svg - - title: Sync browser - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/telemetry-management-gp - - html:

Learn how you can configure Microsoft Edge to collect certain data.

- - image: - - src: https://docs.microsoft.com/media/common/i_data-collection.svg - - title: Telemetry and data collection - - - href: https://docs.microsoft.com/microsoft-edge/deploy/available-policies - - html:

View all available group policies for Microsoft Edge on Windows 10.

- - image: - - src: https://docs.microsoft.com/media/common/i_policy.svg - - title: All group policies + ms.date: 08/28/2020 #Required; mm/dd/yyyy format. + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: What's new + linkLists: + - linkListType: whats-new + links: + - text: Documentation for Microsoft Edge version 77 or later + url: https://docs.microsoft.com/DeployEdge/ + - text: Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021 + url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 + + # Card (optional) + - title: Group policies configure guidance part 1 + linkLists: + - linkListType: reference + links: + - text: All group policies + url: /microsoft-edge/deploy/available-policies + - text: Address bar + url: /microsoft-edge/deploy/group-policies/address-bar-settings-gp + - text: Adobe Flash + url: /microsoft-edge/deploy/group-policies/adobe-settings-gp + - text: Books Library + url: /microsoft-edge/deploy/group-policies/books-library-management-gp + - text: Browser experience + url: /microsoft-edge/deploy/group-policies/browser-settings-management-gp + - text: Developer tools + url: /microsoft-edge/deploy/group-policies/developer-settings-gp + - text: Extensions + url: /microsoft-edge/deploy/group-policies/extensions-management-gp + - text: Favorites + url: /microsoft-edge/deploy/group-policies/favorites-management-gp + - text: Home button + url: /microsoft-edge/deploy/group-policies/home-button-gp + + # Card (optional) + - title: Group policies configure guidance part 2 + linkLists: + - linkListType: reference + links: + - text: Interoperability and enterprise mode + url: /microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp + - text: New Tab page + url: /microsoft-edge/deploy/group-policies/new-tab-page-settings-gp + - text: Kiosk mode deployment in Microsoft Edge + url: /microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy + - text: Prelaunch Microsoft Edge and preload tabs + url: /microsoft-edge/deploy/group-policies/prelaunch-preload-gp + - text: Search engine customization + url: /microsoft-edge/deploy/group-policies/search-engine-customization-gp + - text: Security and privacy + url: /microsoft-edge/deploy/group-policies/security-privacy-management-gp + - text: Start page + url: /microsoft-edge/deploy/group-policies/start-pages-gp + - text: Sync browser + url: /microsoft-edge/deploy/group-policies/sync-browser-settings-gp + - text: Telemetry and data collection + url: /microsoft-edge/deploy/group-policies/telemetry-management-gp + diff --git a/browsers/edge/group-policies/sync-browser-settings-gp.md b/browsers/edge/group-policies/sync-browser-settings-gp.md index cdce19d2e5..d948b2c862 100644 --- a/browsers/edge/group-policies/sync-browser-settings-gp.md +++ b/browsers/edge/group-policies/sync-browser-settings-gp.md @@ -6,17 +6,17 @@ manager: dansimp ms.author: dansimp author: dansimp ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: ms.localizationpriority: medium ms.topic: reference --- -# Sync browser settings +# Sync browser settings > [!NOTE] > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). -By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. You can configure Microsoft Edge to prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. +By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. You can configure Microsoft Edge to prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. ## Relevant policies @@ -38,7 +38,7 @@ You can find the Microsoft Edge Group Policy settings in the following location To verify the settings: 1. In the upper-right corner of Microsoft Edge, click **More** \(**...**\). 2. Click **Settings**. -3. Under Account, see if the setting is toggled on or off.

![Verify configuration](../images/sync-settings.PNG) +3. Under Account, see if the setting is toggled on or off.

![Verify configuration](../images/sync-settings.png) ## Do not sync browser settings diff --git a/browsers/edge/images/allow-smart-screen-validation.PNG b/browsers/edge/images/allow-smart-screen-validation.png similarity index 100% rename from browsers/edge/images/allow-smart-screen-validation.PNG rename to browsers/edge/images/allow-smart-screen-validation.png diff --git a/browsers/edge/images/sync-settings.PNG b/browsers/edge/images/sync-settings.png similarity index 100% rename from browsers/edge/images/sync-settings.PNG rename to browsers/edge/images/sync-settings.png diff --git a/browsers/edge/includes/configure-windows-defender-smartscreen-include.md b/browsers/edge/includes/configure-windows-defender-smartscreen-include.md index c17f639024..375951a25c 100644 --- a/browsers/edge/includes/configure-windows-defender-smartscreen-include.md +++ b/browsers/edge/includes/configure-windows-defender-smartscreen-include.md @@ -2,7 +2,7 @@ author: eavena ms.author: eravena ms.date: 10/02/2018 -ms.reviewer: +ms.reviewer: audience: itpro manager: dansimp ms.prod: edge @@ -25,9 +25,9 @@ ms.topic: include --- -To verify Windows Defender SmartScreen is turned off (disabled): +To verify Windows Defender SmartScreen is turned off (disabled): 1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. -2. Verify the setting **Help protect me from malicious sites and download with Windows Defender SmartScreen** is disabled.

![Verify that Windows Defender SmartScreen is turned off (disabled)](../images/allow-smart-screen-validation.PNG) +2. Verify the setting **Help protect me from malicious sites and download with Windows Defender SmartScreen** is disabled.

![Verify that Windows Defender SmartScreen is turned off (disabled)](../images/allow-smart-screen-validation.png) ### ADMX info and settings @@ -40,7 +40,7 @@ To verify Windows Defender SmartScreen is turned off (disabled): #### MDM settings - **MDM name:** Browser/[AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen) - **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSmartScreen - **Data type:** Integer #### Registry settings diff --git a/browsers/edge/index.yml b/browsers/edge/index.yml index 61b851adf2..0533a4dcb2 100644 --- a/browsers/edge/index.yml +++ b/browsers/edge/index.yml @@ -1,163 +1,93 @@ -### YamlMime:YamlDocument +### YamlMime:Landing -documentType: LandingData - -title: Microsoft Edge Legacy Group Policy configuration options +title: Microsoft Edge Group Legacy Policy configuration options # < 60 chars +summary: Learn how to deploy and configure group policies in Microsoft Edge Legacy on Windows 10. Some of the features coming to Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. # < 160 chars metadata: - - document_id: - - title: Microsoft Edge Group Legacy Policy configuration options - - description: - - text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Learn how to deploy and configure group policies in Microsoft Edge Legacy on Windows 10. Some of the features coming to Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. - + title: Microsoft Edge Group Legacy Policy configuration options # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. # Required; article description that is displayed in search results. < 160 chars. + ms.prod: microsoft-edge keywords: Microsoft Edge Legacy, Windows 10 - ms.localizationpriority: medium - - author: shortpatti - - ms.author: pashort - - ms.date: 08/09/2018 - - ms.topic: article - - ms.devlang: na - -sections: - -- title: - -- items: - - - type: markdown - - text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. - -- items: - - - type: list - - style: cards - - className: cardsE - - columns: 3 - - items: - - - href: https://docs.microsoft.com/microsoft-edge/deploy/change-history-for-microsoft-edge - - html:

Learn more about the latest group policies and features added to Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_whats-new.svg - - title: What's new - - - href: https://docs.microsoft.com/microsoft-edge/deploy/about-microsoft-edge - - html:

Learn about the system requirements and language support for Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_overview.svg - - title: System requirements and supported languages - - - href: https://www.microsoft.com/en-us/WindowsForBusiness/Compare - - html:

Learn about the supported features & functionality in each Windows edition.

- - image: - - src: https://docs.microsoft.com/media/common/i_config-tools.svg - - title: Compare Windows 10 Editions - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/security-privacy-management-gp - - html:

Learn how Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows.

- - image: - - src: https://docs.microsoft.com/media/common/i_security-management.svg - - title: Security & protection - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp - - html:

Learn how you can use the Enterprise Mode site list for websites and apps that have compatibility problems in Microsoft Edge.

- - image: - - src: https://docs.microsoft.com/media/common/i_management.svg - - title: Interoperability & enterprise guidance - - - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/index - - html:

Learn about the advanced VPN features you can add to improve the security and availability of your VPN connection.

- - image: - - src: https://docs.microsoft.com/media/common/i_policy.svg - - title: Group policies & configuration options - -- items: - - - type: list - - style: cards - - className: cardsL - - items: - - - title: Microsoft Edge resources - - html:

Minimum system requirements

- -

Supported languages

- -

Document change history

- -

Compare Windows 10 Editions

- -

Microsoft Edge Dev blog

- -

Microsoft Edge Dev on Twitter

- -

Microsoft Edge changelog

- -

Measuring the impact of Microsoft Edge

- - - title: IE11 resources - - html:

Deploy Internet Explorer 11 (IE11) - IT Pros

- -

Internet Explorer Administration Kit 11 (IEAK 11)

- -

Download Internet Explorer 11

- - - title: Additional resources - - html:

Group Policy and the Group Policy Management Console (GPMC)

- -

Group Policy and the Local Group Policy Editor

- -

Group Policy and the Advanced Group Policy Management (AGPM)

- -

Group Policy and Windows PowerShell

- - - - - - + ms.topic: landing-page # Required + ms.collection: collection # Optional; Remove if no collection is used. + author: shortpatti #Required; your GitHub user alias, with correct capitalization. + ms.author: pashort #Required; microsoft alias of author; optional team alias. + ms.date: 07/07/2020 #Required; mm/dd/yyyy format. + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: About Microsoft Edge + linkLists: + - linkListType: whats-new + links: + - text: Documentation for Microsoft Edge version 77 or later + url: /DeployEdge + - text: Microsoft 365 apps say farewell to Internet Explorer 11 and Windows 10 sunsets Microsoft Edge Legacy + url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 + - text: Latest group policies and features added to Microsoft Edge + url: /microsoft-edge/deploy/change-history-for-microsoft-edge + - linkListType: overview + links: + - text: System requirements and supported languages + url: /microsoft-edge/deploy/about-microsoft-edge + - text: Compare Windows 10 editions + url: https://www.microsoft.com/en-us/WindowsForBusiness/Compare + - text: Security & protection + url: /microsoft-edge/deploy/group-policies/security-privacy-management-gp + - text: Interoperability & enterprise guidance + url: /microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp + - text: Group policies & configuration options + url: /microsoft-edge/deploy/group-policies/ + + # Card (optional) + - title: Microsoft Edge resources + linkLists: + - linkListType: overview + links: + - text: Minimum system requirements + url: /microsoft-edge/deploy/about-microsoft-edge#minimum-system-requirements + - text: Supported languages + url: /microsoft-edge/deploy/about-microsoft-edge#supported-languages + - text: Document change history + url: /microsoft-edge/deploy/change-history-for-microsoft-edge + - text: Microsoft Edge Dev blog + url: https://blogs.windows.com/msedgedev + - text: Microsoft Edge Dev on Twitter + url: /microsoft-edge/deploy/about-microsoft-edge#supported-languages + - text: Microsoft Edge changelog + url: /microsoft-edge/deploy/change-history-for-microsoft-edge + - text: Measuring the impact of Microsoft Edge + url: https://blogs.windows.com/msedgedev + + # Card (optional) + - title: IE11 resources + linkLists: + - linkListType: overview + links: + - text: Deploy Internet Explorer 11 (IE11) - IT Pros + url: https://go.microsoft.com/fwlink/p/?LinkId=760644 + - text: Internet Explorer Administration Kit 11 (IEAK 11) + url: /internet-explorer/ie11-ieak + - linkListType: download + links: + - text: Download Internet Explorer 11 + url: https://go.microsoft.com/fwlink/p/?linkid=290956 + + # Card (optional) + - title: Additional resources + linkLists: + - linkListType: overview + links: + - text: Group Policy and the Group Policy Management Console (GPMC) + url: https://go.microsoft.com/fwlink/p/?LinkId=617921 + - text: Group Policy and the Local Group Policy Editor + url: https://go.microsoft.com/fwlink/p/?LinkId=617922 + - text: Group Policy and the Advanced Group Policy Management (AGPM) + url: https://go.microsoft.com/fwlink/p/?LinkId=617923 + - text: Group Policy and Windows PowerShell + url: https://go.microsoft.com/fwlink/p/?LinkId=617924 diff --git a/browsers/edge/microsoft-edge-faq.md b/browsers/edge/microsoft-edge-faq.md deleted file mode 100644 index 632905e3cb..0000000000 --- a/browsers/edge/microsoft-edge-faq.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros -ms.reviewer: -audience: itpro -manager: dansimp -description: Answers to frequently asked questions about Microsoft Edge features, integration, support, and potential problems. -author: dansimp -ms.author: dansimp -ms.prod: edge -ms.topic: article -ms.mktglfcycl: general -ms.sitesec: library -ms.localizationpriority: medium ---- - -# Frequently Asked Questions (FAQs) for IT Pros - ->Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile - -> [!NOTE] -> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). - -## How can I get the next major version of Microsoft Edge, based on Chromium? -In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). - -## What’s the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use? -Microsoft Edge is the default browser for all Windows 10 devices. It’s built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](emie-to-improve-compatibility.md) to automatically send users to Internet Explorer 11. - -For more information on how Internet Explorer and Microsoft Edge work together to support your legacy web apps, while still defaulting to the higher security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). - -## Does Microsoft Edge work with Enterprise Mode? -[Enterprise Mode](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) helps you run many legacy web applications with better backward compatibility. You can configure both Microsoft Edge and Internet Explorer to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. - -## How do I customize Microsoft Edge and related settings for my organization? -You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/group-policies/) for a list of policies currently available for Microsoft Edge and configuration information. Note that the preview release of Chromium-based Microsoft Edge might not include management policies or other enterprise functionality; our focus during the preview is modern browser fundamentals. - -## Is Adobe Flash supported in Microsoft Edge? -Adobe Flash is currently supported as a built-in feature of Microsoft Edge on PCs running Windows 10. In July 2017, Adobe announced that Flash support will end after 2020. With this change to Adobe support, we’ve started to phase Flash out of Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting group policy](https://docs.microsoft.com/microsoft-edge/deploy/available-policies#configure-the-adobe-flash-click-to-run-setting) - this lets you control which websites can run Adobe Flash content. - -To learn more about Microsoft’s plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). - -## Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? -No. Microsoft Edge doesn’t support ActiveX controls and BHOs like Silverlight or Java. If you’re running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and standards support. - -## How often will Microsoft Edge be updated? -In Windows 10, we’re delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. - -## How can I provide feedback on Microsoft Edge? -Microsoft Edge is an evergreen browser - we’ll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. - -## Will Internet Explorer 11 continue to receive updates? -We’re committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it’s installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. - -## How do I find out what version of Microsoft Edge I have? -In the upper right corner of Microsoft Edge, click the ellipses icon (**...**), and then click **Settings**. Look in the **About Microsoft Edge** section to find your version. - -## What is Microsoft EdgeHTML? -Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform. (As opposed to *Microsoft Edge, based on Chromium*.) diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml new file mode 100644 index 0000000000..751f40f4ea --- /dev/null +++ b/browsers/edge/microsoft-edge-faq.yml @@ -0,0 +1,74 @@ +### YamlMime:FAQ +metadata: + title: Microsoft Edge - Frequently Asked Questions (FAQ) for IT Pros + ms.reviewer: + audience: itpro + manager: dansimp + description: Answers to frequently asked questions about Microsoft Edge features, integration, support, and potential problems. + author: dansimp + ms.author: dansimp + ms.prod: edge + ms.topic: article + ms.mktglfcycl: general + ms.sitesec: library + ms.localizationpriority: medium + +title: Frequently Asked Questions (FAQ) for IT Pros +summary: | + Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile + + > [!NOTE] + > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + + +sections: + - name: Ignored + questions: + - question: How can I get the next major version of Microsoft Edge, based on Chromium? + answer: | + In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). + + - question: What's the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use? + answer: | + Microsoft Edge is the default browser for all Windows 10 devices. It's built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](emie-to-improve-compatibility.md) to automatically send users to Internet Explorer 11. + + For more information on how Internet Explorer and Microsoft Edge work together to support your legacy web apps, while still defaulting to the higher security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). + + - question: Does Microsoft Edge work with Enterprise Mode? + answer: | + [Enterprise Mode](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) helps you run many legacy web applications with better backward compatibility. You can configure both Microsoft Edge and Internet Explorer to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. + + - question: How do I customize Microsoft Edge and related settings for my organization? + answer: | + You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/group-policies/) for a list of policies currently available for Microsoft Edge and configuration information. Note that the preview release of Chromium-based Microsoft Edge might not include management policies or other enterprise functionality; our focus during the preview is modern browser fundamentals. + + - question: Is Adobe Flash supported in Microsoft Edge? + answer: | + Adobe Flash is currently supported as a built-in feature of Microsoft Edge on PCs running Windows 10. In July 2017, Adobe announced that Flash support will end after 2020. With this change to Adobe support, we've started to phase Flash out of Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting group policy](https://docs.microsoft.com/microsoft-edge/deploy/available-policies#configure-the-adobe-flash-click-to-run-setting) - this lets you control which websites can run Adobe Flash content. + + To learn more about Microsoft's plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). + + - question: Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? + answer: | + No, Microsoft Edge doesn't support ActiveX controls and Browser Helper Objects (BHOs) like Silverlight or Java. If you're running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in Internet Explorer 11. Internet Explorer 11 offers additional security, manageability, performance, backward compatibility, and standards support. + + - question: How often will Microsoft Edge be updated? + answer: | + In Windows 10, we're delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. + + - question: How can I provide feedback on Microsoft Edge? + answer: | + Microsoft Edge is an evergreen browser - we'll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. + + - question: Will Internet Explorer 11 continue to receive updates? + answer: | + We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. + + - question: How do I find out which version of Microsoft Edge I have? + answer: | + In the upper-right corner of Microsoft Edge, select the ellipses icon (**...**), and then select **Settings**. Look in the **About Microsoft Edge** section to find your version. + + - question: What is Microsoft EdgeHTML? + answer: | + Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform (as opposed to *Microsoft Edge, based on Chromium*). + diff --git a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md index 8249262926..7c44ef1c3b 100644 --- a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md +++ b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md @@ -11,16 +11,18 @@ ms.prod: edge ms.sitesec: library ms.topic: article ms.localizationpriority: medium -ms.date: 01/17/2020 +ms.date: 02/16/2021 --- # Deploy Microsoft Edge Legacy kiosk mode +> [!IMPORTANT] +> Microsoft 365 apps and services will not support Internet Explorer 11 starting August 17, 2021 (Microsoft Teams will not support Internet Explorer 11 earlier, starting November 30, 2020). [Learn more](https://aka.ms/AA97tsw). Please note that Internet Explorer 11 will remain a supported browser. Internet Explorer 11 is a component of the Windows operating system and [follows the Lifecycle Policy](https://docs.microsoft.com/lifecycle/faq/internet-explorer-microsoft-edge) for the product on which it is installed. > Applies to: Microsoft Edge Legacy (version 45 and earlier) on Windows 10, version 1809 or later > Professional, Enterprise, and Education > [!NOTE] -> You've reached the documentation for Microsoft Edge Legacy (version 45 and earlier.) To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). For information about kiosk mode in the new version of Microsoft Edge, see [Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-kiosk-mode). +> You've reached the documentation for Microsoft Edge Legacy (version 45 and earlier.) To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). For information about kiosk mode in the new version of Microsoft Edge, see [Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-configure-kiosk-mode). In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge Legacy as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge Legacy in kiosk mode. diff --git a/browsers/edge/microsoft-edge.yml b/browsers/edge/microsoft-edge.yml index 5c105dcdc2..797d881911 100644 --- a/browsers/edge/microsoft-edge.yml +++ b/browsers/edge/microsoft-edge.yml @@ -1,61 +1,144 @@ -### YamlMime:YamlDocument +### YamlMime:Landing + +title: Microsoft Edge Legacy # < 60 chars +summary: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # < 160 chars -documentType: LandingData -title: Microsoft Edge metadata: - document_id: - title: Microsoft Edge - description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. + title: Microsoft Edge Legacy # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. # Required; article description that is displayed in search results. < 160 chars. keywords: Microsoft Edge, issues, fixes, announcements, Windows Server, advisories + ms.prod: edge ms.localizationpriority: medium author: lizap ms.author: elizapo manager: dougkim - ms.topic: article + ms.topic: landing-page ms.devlang: na + ms.date: 08/19/2020 #Required; mm/dd/yyyy format. -sections: -- items: - - type: markdown - text: " - Find the tools and resources you need to help deploy and use Microsoft Edge in your organization. - " -- title: What's new -- items: - - type: markdown - text: " - Find out the latest and greatest news on Microsoft Edge.
- -

**The latest in Microsoft Edge**
See what's new for users and developers in the next update to Microsoft Edge - now available with the Windows 10 April 2018 update!
Find out more

**Evaluate the impact**
Review the latest Forrester Total Economic Impact (TEI) report to learn about the impact Microsoft Edge can have in your organization.
Download the reports

**Microsoft Edge for iOS and Android**
Microsoft Edge brings familiar features across your PC and phone, which allows browsing to go with you, no matter what device you use.
Learn more

**Application Guard**
Microsoft Edge with Windows Defender Application Guard is the most secure browser on Windows 10 Enterprise.
Learn more
- " -- title: Compatibility -- items: - - type: markdown - text: " - Even if you still have legacy apps in your organization, you can default to the secure, modern experience of Microsoft Edge and provide a consistent level of compatibility with existing legacy applications.
- -

**Test your site on Microsoft Edge**
Test your site on Microsoft Edge for free instantly, with remote browser testing powered by BrowserStack. You can also use the linting tool sonarwhal to assess your site's accessibility, speed, security, and more.
Test your site on Microsoft Edge for free on BrowserStack
Use sonarwhal to improve your website.

**Improve compatibility with Enterprise Mode**
With Enterprise Mode you can use Microsoft Edge as your default browser, while ensuring apps continue working on IE11.
Use Enterprise mode to improve compatibility
Turn on Enterprise Mode and use a site list
Enterprise Site List Portal
Ultimate browser strategy on Windows 10

**Web Application Compatibility Lab Kit**
The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge.
Find out more
- " -- title: Security -- items: - - type: markdown - text: " - Microsoft Edge uses Windows Hello and Windows Defender SmartScreen to defend against phishing and malware. Take a look at some of the additional features behind the strong defense that Microsoft Edge provides against web-based attacks.
- -

**NSS Labs web browser security reports**
See the results of two global tests measuring how effective browsers are at protecting against socially engineered malware and phishing attacks.
Download the reports

**Microsoft Edge sandbox**
See how Microsoft Edge has significantly reduced the attack surface of the sandbox by configuring the app container to further reduce its privilege.
Find out more

**Windows Defender SmartScreen**
Manage your organization's computer settings with Group Policy and MDM settings to display a warning page to employees or block a site entirely.
Read the docs
- " -- title: Deployment and end user readiness -- items: - - type: markdown - text: " - Find resources and learn about features to help you deploy Microsoft Edge in your organization to get your users up and running quickly.
- -

**Deployment**
Find resources, learn about features, and get answers to commonly asked questions to help you deploy Microsoft Edge in your organization.
Microsoft Edge deployment guide
Microsoft Edge FAQ
System requirements and language support
Group Policy and MDM settings in Microsoft Edge
Download the Web Application Compatibility Lab Kit
Microsoft Edge training and demonstrations

**End user readiness**
Help your users get started on Microsoft Edge quickly and learn about features like tab management, instant access to Office files, and more.
Quick Start: Microsoft Edge (PDF, .98 MB)
Find it faster with Microsoft Edge (PDF, 605 KB)
Use Microsoft Edge to collaborate (PDF, 468 KB)
Import bookmarks
Password management
Microsoft Edge tips and tricks (video, 20:26)
- " -- title: Stay informed -- items: - - type: markdown - text: " - -

**Sign up for the Windows IT Pro Insider**
Get the latest tools, tips, and expert guidance on deployment, management, security, and more.
Learn more

**Microsoft Edge Dev blog**
Keep up with the latest browser trends, security tips, and news for IT professionals.
Read the blog

**Microsoft Edge Dev on Twitter**
Get the latest news and updates from the Microsoft Web Platform team.
Visit Twitter
- " +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: What's new + linkLists: + - linkListType: whats-new + links: + - text: Documentation for Microsoft Edge version 77 or later + url: https://docs.microsoft.com/DeployEdge/ + - text: Microsoft Edge Legacy desktop app will reach end of support on March 9, 2021 + url: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666 + - text: The latest in Microsoft Edge + url: https://blogs.windows.com/msedgedev/2018/04/30/edgehtml-17-april-2018-update/#C7jCBdbPSG6bCXHr.97 + - text: Microsoft Edge for iOS and Android + url: https://blogs.windows.com/windowsexperience/2017/11/30/microsoft-edge-now-available-for-ios-and-android + - text: Application Guard + url: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview + - linkListType: download + links: + - text: Evaluate the impact + url: /microsoft-edge/deploy/microsoft-edge-forrester + + # Card (optional) + - title: Test your site on Microsoft Edge + linkLists: + - linkListType: overview + links: + - text: Test your site on Microsoft Edge for free on BrowserStack + url: https://developer.microsoft.com/microsoft-edge/tools/remote/ + - text: Use sonarwhal to improve your website + url: https://sonarwhal.com/ + + # Card (optional) + - title: Improve compatibility with Enterprise Mode + linkLists: + - linkListType: how-to-guide + links: + - text: Use Enterprise mode to improve compatibility + url: /microsoft-edge/deploy/emie-to-improve-compatibility + - text: Turn on Enterprise Mode and use a site list + url: https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list + - text: Enterprise Site List Portal + url: https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal + + # Card (optional) + - title: Web Application Compatibility Lab Kit + linkLists: + - linkListType: overview + links: + - text: Overview + url: /microsoft-edge/deploy/emie-to-improve-compatibility + + # Card (optional) + - title: Security + linkLists: + - linkListType: download + links: + - text: NSS Labs web browser security reports + url: https://www.microsoft.com/download/details.aspx?id=54773 + - linkListType: overview + links: + - text: Microsoft Edge sandbox + url: https://blogs.windows.com/msedgedev/2017/03/23/strengthening-microsoft-edge-sandbox/ + - text: Windows Defender SmartScreen + url: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview + + # Card (optional) + - title: Deployment + linkLists: + - linkListType: overview + links: + - text: Microsoft Edge deployment guide + url: /microsoft-edge/deploy/ + - text: Microsoft Edge FAQ + url: /microsoft-edge/deploy/microsoft-edge-faq + - text: System requirements and language support + url: /microsoft-edge/deploy/hardware-and-software-requirements + - text: Group Policy and MDM settings in Microsoft Edge + url: /microsoft-edge/deploy/available-policies + - text: Microsoft Edge training and demonstrations + url: /microsoft-edge/deploy/edge-technical-demos + - linkListType: download + links: + - text: Web Application Compatibility Lab Kit + url: https://www.microsoft.com/itpro/microsoft-edge/web-app-compat-toolkit + + # Card (optional) + - title: End user readiness + linkLists: + - linkListType: video + links: + - text: Microsoft Edge tips and tricks (video, 20:26) + url: https://myignite.microsoft.com/sessions/56630?source=sessions + - linkListType: download + links: + - text: Quick Start - Microsoft Edge (PDF, .98 MB) + url: https://go.microsoft.com/fwlink/?linkid=825648 + - text: Find it faster with Microsoft Edge (PDF, 605 KB) + url: https://go.microsoft.com/fwlink/?linkid=825661 + - text: Use Microsoft Edge to collaborate (PDF, 468 KB) + url: https://go.microsoft.com/fwlink/?linkid=825653 + - text: Group Policy and MDM settings in Microsoft Edge + url: /microsoft-edge/deploy/available-policies + - text: Microsoft Edge training and demonstrations + url: /microsoft-edge/deploy/edge-technical-demos + - linkListType: how-to-guide + links: + - text: Import bookmarks + url: https://microsoftedgetips.microsoft.com/2/39 + - text: Password management + url: https://microsoftedgetips.microsoft.com/2/18 + + # Card (optional) + - title: Stay informed + linkLists: + - linkListType: overview + links: + - text: Sign up for the Windows IT Pro Insider + url: https://aka.ms/windows-it-pro-insider + - text: Microsoft Edge Dev blog + url: https://blogs.windows.com/msedgedev + - text: Microsoft Edge Dev on Twitter + url: https://twitter.com/MSEdgeDev diff --git a/browsers/edge/troubleshooting-microsoft-edge.md b/browsers/edge/troubleshooting-microsoft-edge.md index 3c50d4d50e..5479f689f3 100644 --- a/browsers/edge/troubleshooting-microsoft-edge.md +++ b/browsers/edge/troubleshooting-microsoft-edge.md @@ -9,7 +9,6 @@ author: dansimp ms.author: dansimp ms.prod: edge ms.sitesec: library -title: Deploy Microsoft Edge kiosk mode ms.localizationpriority: medium ms.date: 10/15/2018 --- diff --git a/browsers/edge/use-powershell-to manage-group-policy.md b/browsers/edge/use-powershell-to manage-group-policy.md index 58a6b06b27..1b6d2e9338 100644 --- a/browsers/edge/use-powershell-to manage-group-policy.md +++ b/browsers/edge/use-powershell-to manage-group-policy.md @@ -5,7 +5,6 @@ ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security -title: Security enhancements for Microsoft Edge (Microsoft Edge for IT Pros) ms.localizationpriority: medium ms.date: 10/02/2018 ms.reviewer: diff --git a/browsers/internet-explorer/TOC.md b/browsers/internet-explorer/TOC.md index ceb4d9b0f2..060f6ffb99 100644 --- a/browsers/internet-explorer/TOC.md +++ b/browsers/internet-explorer/TOC.md @@ -188,5 +188,4 @@ ### [Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) ## KB Troubleshoot -### [Clear the Internet Explorer cache from a command line](kb-support/clear-ie-cache-from-command-line.md) ### [Internet Explorer and Microsoft Edge FAQ for IT Pros](kb-support/ie-edge-faqs.md) diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index 50208546bb..a796135a6b 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -7,6 +7,7 @@ "**/*.yml" ], "exclude": [ + "**/includes/**", "**/obj/**" ] } @@ -38,7 +39,16 @@ "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Internet Explorer" + "titleSuffix": "Internet Explorer", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "externalReference": [], "template": "op.html", diff --git a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md index 8fe62f2f79..f09832c403 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md @@ -1,49 +1,53 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: How to use Group Policy to install ActiveX controls. -author: dansimp -ms.prod: ie11 -ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy and ActiveX installation - -ActiveX controls are installed and invoked using the HTML object tag with the CODEBASE attribute. This attribute, through a URL, makes Internet Explorer: - -- Get the ActiveX control if it's not already installed. - -- Download the installation package. - -- Perform trust verification on the object. - -- Prompt for installation permission, using the IE Information Bar. - -During installation, the rendering page registers and invokes the control, so that after installation, any standard user can invoke the control. - -**Important**
ActiveX control installation requires administrator-level permissions. - -## Group Policy for the ActiveX Installer Service - -You use the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. The AXIS-related settings can be changed using either the Group Policy Management Console (GPMC) or the Local Group Policy Editor, and include: - -- **Approved Installation Sites for ActiveX Controls.** A list of approved installation sites used by AXIS to determine whether it can install a particular ActiveX control. - -- **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. - -For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=214503). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: How to use Group Policy to install ActiveX controls. +author: dansimp +ms.prod: ie11 +ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy and ActiveX installation + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +ActiveX controls are installed and invoked using the HTML object tag with the CODEBASE attribute. This attribute, through a URL, makes Internet Explorer: + +- Get the ActiveX control if it's not already installed. + +- Download the installation package. + +- Perform trust verification on the object. + +- Prompt for installation permission, using the IE Information Bar. + +During installation, the rendering page registers and invokes the control, so that after installation, any standard user can invoke the control. + +**Important**
ActiveX control installation requires administrator-level permissions. + +## Group Policy for the ActiveX Installer Service + +You use the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. The AXIS-related settings can be changed using either the Group Policy Management Console (GPMC) or the Local Group Policy Editor, and include: + +- **Approved Installation Sites for ActiveX Controls.** A list of approved installation sites used by AXIS to determine whether it can install a particular ActiveX control. + +- **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. + +For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=214503). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md index 664bc596e1..455bae28bd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md @@ -1,68 +1,72 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to add employees to the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp ---- - -# Add employees to the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After you get the Enterprise Mode Site List Portal up and running, you must add your employees. During this process, you'll also assign roles and groups. - -The available roles are: - -- **Requester.** The primary role to assign to employees that need to access the Enterprise Mode Site List Portal. The Requester can create change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal change requests, and sign off and close personal change requests. - -- **App Manager.** This role is considered part of the Approvers group. The App Manager can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Group Head.** This role is considered part of the Approvers group. The Group Head can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Administrator.** The role with the highest-level rights; we recommend limiting the number of employees you grant this role. The Administrator can perform any task that can be performed by the other roles, in addition to adding employees to the portal, assigning employee roles, approving registrations to the portal, configuring portal settings (for example, determining the freeze schedule, determining the pre-production and production XML paths, and determining the attachment upload location), and using the standalone Enterprise Mode Site List Manager page. - -**To add an employee to the Enterprise Mode Site List Portal** -1. Open the Enterprise Mode Site List Portal and click the **Employee Management** icon in the upper-right area of the page. - - The **Employee management** page appears. - -2. Click **Add a new employee**. - - The **Add a new employee** page appears. - -3. Fill out the fields for each employee, including: - - - **Email.** Add the employee's email address. - - - **Name.** This box autofills based on the email address. - - - **Role.** Pick a single role for the employee, based on the list above. - - - **Group name.** Pick the name of the employee's group. The group association also assigns a group of Approvers. - - - **Comments.** Add optional comments about the employee. - - - **Active.** Click the check box to make the employee active in the system. If you want to keep the employee in the system, but you want to prevent access, clear this check box. - -4. Click **Save**. - -**To export all employees to an Excel spreadsheet** -1. On the **Employee management** page, click **Export to Excel**. - -2. Save the EnterpriseModeUsersList.xlsx file. - - The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how to add employees to the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Add employees to the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +After you get the Enterprise Mode Site List Portal up and running, you must add your employees. During this process, you'll also assign roles and groups. + +The available roles are: + +- **Requester.** The primary role to assign to employees that need to access the Enterprise Mode Site List Portal. The Requester can create change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal change requests, and sign off and close personal change requests. + +- **App Manager.** This role is considered part of the Approvers group. The App Manager can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. + +- **Group Head.** This role is considered part of the Approvers group. The Group Head can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. + +- **Administrator.** The role with the highest-level rights; we recommend limiting the number of employees you grant this role. The Administrator can perform any task that can be performed by the other roles, in addition to adding employees to the portal, assigning employee roles, approving registrations to the portal, configuring portal settings (for example, determining the freeze schedule, determining the pre-production and production XML paths, and determining the attachment upload location), and using the standalone Enterprise Mode Site List Manager page. + +**To add an employee to the Enterprise Mode Site List Portal** +1. Open the Enterprise Mode Site List Portal and click the **Employee Management** icon in the upper-right area of the page. + + The **Employee management** page appears. + +2. Click **Add a new employee**. + + The **Add a new employee** page appears. + +3. Fill out the fields for each employee, including: + + - **Email.** Add the employee's email address. + + - **Name.** This box autofills based on the email address. + + - **Role.** Pick a single role for the employee, based on the list above. + + - **Group name.** Pick the name of the employee's group. The group association also assigns a group of Approvers. + + - **Comments.** Add optional comments about the employee. + + - **Active.** Click the check box to make the employee active in the system. If you want to keep the employee in the system, but you want to prevent access, clear this check box. + +4. Click **Save**. + +**To export all employees to an Excel spreadsheet** +1. On the **Employee management** page, click **Export to Excel**. + +2. Save the EnterpriseModeUsersList.xlsx file. + + The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md index 8ead60630e..57c8991c7d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md @@ -1,112 +1,116 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. -author: dansimp -ms.prod: ie11 -ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) - -**Applies to:** - -- Windows 8.1 -- Windows 7 - -You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager. You can only add specific URLs, not Internet or Intranet Zones. - -If you want to add your websites one at a time, see Add sites to the [Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - -## Create an Enterprise Mode site list (TXT) file -You can create and use a custom text file to add multiple sites to your Enterprise Mode site list at the same time.

**Important**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. - -You must separate each site using commas or carriage returns. For example: - -``` -microsoft.com, bing.com, bing.com/images -``` -**-OR-** - -``` -microsoft.com -bing.com -bing.com/images -``` - -## Create an Enterprise Mode site list (XML) file using the v.1 version of the Enterprise Mode schema -You can create and use a custom XML file with the Enterprise Mode Site List Manager to add multiple sites to your Enterprise Mode site list at the same time. For more info about the v.1 version of the Enterprise Mode schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -Each XML file must include: - -- **Version number.** This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser. - -- **<emie> tag.** This tag specifies the domains and domain paths that must be rendered using IE7 Enterprise Mode, IE8 Enterprise Mode, or the default IE11 browser environment.

**Important**
If you decide a site requires IE7 Enterprise Mode, you must add `forceCompatView=”true”` to your XML file. That code tells Enterprise Mode to check for a `DOCTYPE` tag on the specified webpage. If there is, the site renders using Windows Internet Explorer 7. If there’s no tag, the site renders using Microsoft Internet Explorer 5. - -- <docMode> tag.This tag specifies the domains and domain paths that need either to appear using the specific doc mode you assigned to the site. Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -### Enterprise Mode v.1 XML schema example -The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -``` - - - www.cpandl.com - www.woodgrovebank.com - adatum.com - contoso.com - relecloud.com - /about - - fabrikam.com - /products - - - - contoso.com - /travel - - fabrikam.com - /products - - - -``` - -To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY\CURRENT\USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (. - -## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) -After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). - - **To add multiple sites** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. - -2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

-Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -4. On the **File** menu, click **Save to XML**, and save your file.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. +author: dansimp +ms.prod: ie11 +ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 8.1 +- Windows 7 + +You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager. You can only add specific URLs, not Internet or Intranet Zones. + +If you want to add your websites one at a time, see Add sites to the [Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). + +## Create an Enterprise Mode site list (TXT) file +You can create and use a custom text file to add multiple sites to your Enterprise Mode site list at the same time.

**Important**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. + +You must separate each site using commas or carriage returns. For example: + +``` +microsoft.com, bing.com, bing.com/images +``` +**-OR-** + +``` +microsoft.com +bing.com +bing.com/images +``` + +## Create an Enterprise Mode site list (XML) file using the v.1 version of the Enterprise Mode schema +You can create and use a custom XML file with the Enterprise Mode Site List Manager to add multiple sites to your Enterprise Mode site list at the same time. For more info about the v.1 version of the Enterprise Mode schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + +Each XML file must include: + +- **Version number.** This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser. + +- **<emie> tag.** This tag specifies the domains and domain paths that must be rendered using IE7 Enterprise Mode, IE8 Enterprise Mode, or the default IE11 browser environment.

**Important**
If you decide a site requires IE7 Enterprise Mode, you must add `forceCompatView=”true”` to your XML file. That code tells Enterprise Mode to check for a `DOCTYPE` tag on the specified webpage. If there is, the site renders using Windows Internet Explorer 7. If there’s no tag, the site renders using Microsoft Internet Explorer 5. + +- <docMode> tag.This tag specifies the domains and domain paths that need either to appear using the specific doc mode you assigned to the site. Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +### Enterprise Mode v.1 XML schema example +The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + +``` + + + www.cpandl.com + www.woodgrovebank.com + adatum.com + contoso.com + relecloud.com + /about + + fabrikam.com + /products + + + + contoso.com + /travel + + fabrikam.com + /products + + + +``` + +To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY\CURRENT\USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (. + +## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) +After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). + + **To add multiple sites** + +1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. + +2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

+Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +3. Click **OK** to close the **Bulk add sites to the list** menu. + +4. On the **File** menu, click **Save to XML**, and save your file.

+You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +## Next steps +After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Related topics +- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index 78f0903d6f..37ef55dea6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -16,7 +16,10 @@ ms.date: 10/24/2017 --- -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) +# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + **Applies to:** diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md index 8b8435daff..8c5e4b4426 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md @@ -1,66 +1,70 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: dansimp -ms.prod: ie11 -ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) - -**Applies to:** - -- Windows 8.1 -- Windows 7 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. - -

Note
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and 8.1 Enterprise Mode Site List Manager. - -## Adding a site to your compatibility list -You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager. -

Note
If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2). - - **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. - -2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

-Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. - -3. Type any comments about the website into the **Notes about URL** box.

-Administrators can only see comments while they’re in this tool. - -4. Choose **IE7 Enterprise Mode**, **IE8 Enterprise Mode**, or the appropriate document mode for sites that must be rendered using the emulation of a previous version of IE, or pick **Default IE** if the site should use the latest version of IE. - -The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. - -Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -5. Click **Save** to validate your website and to add it to the site list for your enterprise.

- If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. - -6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

- You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. +author: dansimp +ms.prod: ie11 +ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 8.1 +- Windows 7 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. + +

Note
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and 8.1 Enterprise Mode Site List Manager. + +## Adding a site to your compatibility list +You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager. +

Note
If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2). + + **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** + +1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. + +2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

+Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. + +3. Type any comments about the website into the **Notes about URL** box.

+Administrators can only see comments while they’re in this tool. + +4. Choose **IE7 Enterprise Mode**, **IE8 Enterprise Mode**, or the appropriate document mode for sites that must be rendered using the emulation of a previous version of IE, or pick **Default IE** if the site should use the latest version of IE. + +The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. + +Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +5. Click **Save** to validate your website and to add it to the site list for your enterprise.

+ If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. + +6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

+ You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Next steps +After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md index 0977b87b94..63f0d7bd6f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md @@ -16,7 +16,10 @@ ms.date: 07/27/2017 --- -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) +# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + **Applies to:** diff --git a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md index f08c08fcdb..23bb9ee14a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md @@ -1,82 +1,86 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Administrative templates and Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Administrative templates and Internet Explorer 11 - -Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: - -- What registry locations correspond to each setting. - -- What value options or restrictions are associated with each setting. - -- The default value for many settings. - -- Text explanations about each setting and the supported version of Internet Explorer. - -For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). - -## What are Administrative Templates? -Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: - -- **ADMX.** A language-neutral setup file that states the number and type of policy setting, and the location by category, as it shows up in the Local Group Policy Editor. - -- **ADML.** A language-specific setup file that provides language-related information to the ADMX file. This file lets the policy setting show up in the right language in the Local Group Policy Editor. You can add new languages by adding new ADML files in the required language. - -## How do I store Administrative Templates? -As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). -

Important
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see Scenario 1: Editing the Local GPO Using ADMX Files. - -## Administrative Templates-related Group Policy settings -When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. -

Note
You won't see the new policy settings if you try to view or edit your policy settings on a computer that isn't running IE11. To fix this, you can either install IE11, or you can copy the updated Inetres.admx and Inetres.adml files from another computer to the PolicyDefinitions folder on this computer. - -IE11 provides these new policy settings, which are editable in the Local Group Policy Editor, and appear in the following policy paths: - -- Computer Configuration\\Administrative Templates\\Windows Components\\ - -- User Configuration\\Administrative Templates\\Windows Components\\ - - -|Catalog |Description | -| ------------------------------------------------ | --------------------------------------------| -|IE |Turns standard IE configuration on and off. | -|Internet Explorer\Accelerators |Sets up and manages Accelerators. | -|Internet Explorer\Administrator Approved Controls |Turns ActiveX controls on and off. | -|Internet Explorer\Application Compatibility |Turns the **Cut**, **Copy**, or **Paste** operations on or off. This setting also requires that `URLACTION_SCRIPT_PASTE` is set to **Prompt**. | -|Internet Explorer\Browser Menus |Shows or hides the IE menus and menu options.| -|Internet Explorer\Corporate Settings |Turns off whether you specify the code download path for each computer. | -|Internet Explorer\Delete Browsing History |Turns the **Delete Browsing History** settings on and off. | -|Internet Explorer\Internet Control Panel |Turns pages on and off in the **Internet Options** dialog box. Also turns on and off the subcategories that manage settings on the **Content**, **General**, **Security** and **Advanced** pages. | -|Internet Explorer\Internet Settings |Sets up and manages the **Advanced settings**, **AutoComplete**, **Display Settings**, and **URL Encoding** options. | -|Internet Explorer\Persistence Behavior |Sets up and manages the file size limits for Internet security zones. | -|Internet Explorer\Privacy |Turns various privacy-related features on and off. | -|Internet Explorer\Security Features |Turns various security-related features on and off in the browser, Windows Explorer, and other applications. | -|Internet Explorer\Toolbars |Turns on and off the ability for users to edit toolbars in the browser. You can also set the default toolbar buttons here. | -|RSS Feeds |Sets up and manages RSS feeds in the browser. | - - -## Editing Group Policy settings -Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: - -- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. - -- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. - -## Related topics -- [Administrative templates (.admx) for Windows 10 April 2018 Update](https://www.microsoft.com/download/details.aspx?id=56880) -- [Administrative templates (.admx) for Windows 10 October 2018 Update](https://www.microsoft.com/download/details.aspx?id=57576) -- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Administrative templates and Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Administrative templates and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: + +- What registry locations correspond to each setting. + +- What value options or restrictions are associated with each setting. + +- The default value for many settings. + +- Text explanations about each setting and the supported version of Internet Explorer. + +For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). + +## What are Administrative Templates? +Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: + +- **ADMX.** A language-neutral setup file that states the number and type of policy setting, and the location by category, as it shows up in the Local Group Policy Editor. + +- **ADML.** A language-specific setup file that provides language-related information to the ADMX file. This file lets the policy setting show up in the right language in the Local Group Policy Editor. You can add new languages by adding new ADML files in the required language. + +## How do I store Administrative Templates? +As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). +

Important
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see Scenario 1: Editing the Local GPO Using ADMX Files. + +## Administrative Templates-related Group Policy settings +When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. +

Note
You won't see the new policy settings if you try to view or edit your policy settings on a computer that isn't running IE11. To fix this, you can either install IE11, or you can copy the updated Inetres.admx and Inetres.adml files from another computer to the PolicyDefinitions folder on this computer. + +IE11 provides these new policy settings, which are editable in the Local Group Policy Editor, and appear in the following policy paths: + +- Computer Configuration\\Administrative Templates\\Windows Components\\ + +- User Configuration\\Administrative Templates\\Windows Components\\ + + +|Catalog |Description | +| ------------------------------------------------ | --------------------------------------------| +|IE |Turns standard IE configuration on and off. | +|Internet Explorer\Accelerators |Sets up and manages Accelerators. | +|Internet Explorer\Administrator Approved Controls |Turns ActiveX controls on and off. | +|Internet Explorer\Application Compatibility |Turns the **Cut**, **Copy**, or **Paste** operations on or off. This setting also requires that `URLACTION_SCRIPT_PASTE` is set to **Prompt**. | +|Internet Explorer\Browser Menus |Shows or hides the IE menus and menu options.| +|Internet Explorer\Corporate Settings |Turns off whether you specify the code download path for each computer. | +|Internet Explorer\Delete Browsing History |Turns the **Delete Browsing History** settings on and off. | +|Internet Explorer\Internet Control Panel |Turns pages on and off in the **Internet Options** dialog box. Also turns on and off the subcategories that manage settings on the **Content**, **General**, **Security** and **Advanced** pages. | +|Internet Explorer\Internet Settings |Sets up and manages the **Advanced settings**, **AutoComplete**, **Display Settings**, and **URL Encoding** options. | +|Internet Explorer\Persistence Behavior |Sets up and manages the file size limits for Internet security zones. | +|Internet Explorer\Privacy |Turns various privacy-related features on and off. | +|Internet Explorer\Security Features |Turns various security-related features on and off in the browser, Windows Explorer, and other applications. | +|Internet Explorer\Toolbars |Turns on and off the ability for users to edit toolbars in the browser. You can also set the default toolbar buttons here. | +|RSS Feeds |Sets up and manages RSS feeds in the browser. | + + +## Editing Group Policy settings +Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: + +- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. + +- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. + +## Related topics +- [Administrative templates (.admx) for Windows 10 April 2018 Update](https://www.microsoft.com/download/details.aspx?id=56880) +- [Administrative templates (.admx) for Windows 10 October 2018 Update](https://www.microsoft.com/download/details.aspx?id=57576) +- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) diff --git a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md index 977e17394e..07687792a3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md @@ -1,62 +1,66 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. -author: dansimp -ms.prod: ie11 -title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp ---- - -# Approve a change request using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After a change request is successfully submitted to the pre-defined Approver(s), employees granted the role of **App Manager**, **Group Head**, or **Administrator**, they must approve the changes. - -## Approve or reject a change request -The Approvers get an email stating that a Requester successfully opened, tested, and submitted the change request to the Approvers group. The Approvers can accept or reject a change request. - -**To approve or reject a change request** -1. The Approver logs onto the Enterprise Mode Site List Portal, **All Approvals** page. - - The Approver can also get to the **All Approvals** page by clicking **Approvals Pending** from the left pane. - -2. The Approver clicks the expander arrow (**\/**) to the right side of the change request, showing the list of Approvers and the **Approve** and **Reject** buttons. - -3. The Approver reviews the change request, making sure it's correct. If the info is correct, the Approver clicks **Approve** to approve the change request. If the info seems incorrect, or if the app shouldn't be added to the site list, the Approver clicks **Reject**. - - An email is sent to the Requester, the Approver(s) group, and the Administrator(s) group, with the updated status of the request. - - -## Send a reminder to the Approver(s) group -If the change request is sitting in the approval queue for too long, the Requester can send a reminder to the group. - -- From the **My Approvals** page, click the checkbox next to the name of each Approver to be reminded, and then click **Send reminder**. - - An email is sent to the selected Approver(s). - - -## View rejected change requests -The original Requester, the Approver(s) group, and the Administrator(s) group can all view the rejected change request. - -**To view the rejected change request** - -- In the Enterprise Mode Site List Portal, click **Rejected** from the left pane. - - All rejected change requests appear, with role assignment determining which ones are visible. - - -## Next steps -After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + +# Approve a change request using the Enterprise Mode Site List Portal + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +After a change request is successfully submitted to the pre-defined Approver(s), employees granted the role of **App Manager**, **Group Head**, or **Administrator**, they must approve the changes. + +## Approve or reject a change request +The Approvers get an email stating that a Requester successfully opened, tested, and submitted the change request to the Approvers group. The Approvers can accept or reject a change request. + +**To approve or reject a change request** +1. The Approver logs onto the Enterprise Mode Site List Portal, **All Approvals** page. + + The Approver can also get to the **All Approvals** page by clicking **Approvals Pending** from the left pane. + +2. The Approver clicks the expander arrow (**\/**) to the right side of the change request, showing the list of Approvers and the **Approve** and **Reject** buttons. + +3. The Approver reviews the change request, making sure it's correct. If the info is correct, the Approver clicks **Approve** to approve the change request. If the info seems incorrect, or if the app shouldn't be added to the site list, the Approver clicks **Reject**. + + An email is sent to the Requester, the Approver(s) group, and the Administrator(s) group, with the updated status of the request. + + +## Send a reminder to the Approver(s) group +If the change request is sitting in the approval queue for too long, the Requester can send a reminder to the group. + +- From the **My Approvals** page, click the checkbox next to the name of each Approver to be reminded, and then click **Send reminder**. + + An email is sent to the selected Approver(s). + + +## View rejected change requests +The original Requester, the Approver(s) group, and the Administrator(s) group can all view the rejected change request. + +**To view the rejected change request** + +- In the Enterprise Mode Site List Portal, click **Rejected** from the left pane. + + All rejected change requests appear, with role assignment determining which ones are visible. + + +## Next steps +After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md index d45374e404..7dbfc19776 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md @@ -1,62 +1,66 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto configuration and auto proxy problems with Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto configuration and auto proxy problems with Internet Explorer 11 -You might experience some problems using automatic configuration and auto-proxy with Internet Explorer 11. - -## Branding changes aren't distributed using automatic configuration -If you've turned on the **Disable external branding of Internet Explorer** Group Policy Object, you won't be able to use automatic configuration to distribute your branding changes to your users' computers. When this object is turned on, it prevents the branding of IE by a non-Microsoft company or entity, such as an Internet service provider or Internet content provider. For more information about automatic configuration, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) and [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). For more information about Group Policy settings, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). - -## Proxy server setup issues -If you experience issues while setting up your proxy server, you can try these troubleshooting steps: - -- Check to make sure the proxy server address is right. - -- Check that both **Automatically detect settings** and **Automatic configuration** are turned on in the browser. - -- Check that the browser is pointing to the right automatic configuration script location. - - **To check your proxy server address** - -1. On the **Tools** menu, click **Internet Options**, and then **Connections**. - -2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. - -3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). - - **To check that you've turned on the correct settings** - -4. On the **Tools** menu, click **Internet Options**, and then click **Connections**. - -5. Click **Settings** or **LAN Settings**. - -6. In the **Automatic configuration** area, check that you've clicked the **Automatically detect settings** box. If you've turned on automatic configuration, check to make sure that you've also clicked the **Use automatic configuration script** box.

**Note**
If at this point everything is set up correctly, but the proxy server still isn't behaving properly, click the **Detect my network settings** box in the **Error** dialog box to try to detect the proxy server, again. - - **To check that you're pointing to the correct automatic configuration script location** - -7. On the **Tools** menu, click **Internet Options**, and then click **Connections**. - -8. Click **Settings** or **LAN Settings**. - -9. In the **Automatic configuration** area, check that you've chosen the **Use automatic configuration script** box, and that it has the correct location to your automatic configuration script or for your automatic proxy URL. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto configuration and auto proxy problems with Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto configuration and auto proxy problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +You might experience some problems using automatic configuration and auto-proxy with Internet Explorer 11. + +## Branding changes aren't distributed using automatic configuration +If you've turned on the **Disable external branding of Internet Explorer** Group Policy Object, you won't be able to use automatic configuration to distribute your branding changes to your users' computers. When this object is turned on, it prevents the branding of IE by a non-Microsoft company or entity, such as an Internet service provider or Internet content provider. For more information about automatic configuration, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) and [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). For more information about Group Policy settings, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). + +## Proxy server setup issues +If you experience issues while setting up your proxy server, you can try these troubleshooting steps: + +- Check to make sure the proxy server address is right. + +- Check that both **Automatically detect settings** and **Automatic configuration** are turned on in the browser. + +- Check that the browser is pointing to the right automatic configuration script location. + + **To check your proxy server address** + +1. On the **Tools** menu, click **Internet Options**, and then **Connections**. + +2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. + +3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). + + **To check that you've turned on the correct settings** + +4. On the **Tools** menu, click **Internet Options**, and then click **Connections**. + +5. Click **Settings** or **LAN Settings**. + +6. In the **Automatic configuration** area, check that you've clicked the **Automatically detect settings** box. If you've turned on automatic configuration, check to make sure that you've also clicked the **Use automatic configuration script** box.

**Note**
If at this point everything is set up correctly, but the proxy server still isn't behaving properly, click the **Detect my network settings** box in the **Error** dialog box to try to detect the proxy server, again. + + **To check that you're pointing to the correct automatic configuration script location** + +7. On the **Tools** menu, click **Internet Options**, and then click **Connections**. + +8. Click **Settings** or **LAN Settings**. + +9. In the **Automatic configuration** area, check that you've chosen the **Use automatic configuration script** box, and that it has the correct location to your automatic configuration script or for your automatic proxy URL. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md index 1b9a0ba9c8..82857ac50e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md @@ -1,74 +1,78 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto configuration settings for Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto configuration settings for Internet Explorer 11 -Automatic configuration lets you apply custom branding and graphics to your internal Internet Explorer installations, running on Windows 8.1 or Windows Server 2012 R2. For more information about adding custom branding and graphics to your IE package, see [Customize the toolbar button and Favorites List icons using IEAK 11](../ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md).

**Important**
You'll only see and be able to use the **IE Customization Wizard 11 - Automatic Configuration** page if you're creating an internal IE installation package. For more information about the **IE Customization Wizard 11 - Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). - -## Adding the automatic configuration registry key -For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry key to your IE installation package.

**Important**
Follow these directions carefully because serious problems can occur if you update your registry incorrectly. For added protection, back up your registry so you can restore it if a problem occurs. - - **To add the registry key** - -1. On the **Start** screen, type **regedit**, and then click **Regedit.exe**. - -2. Right-click the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl` subkey, point to **New**, and then click **Key**. - -3. Enter the new key name, `FEATURE\AUTOCONFIG\BRANDING`, and then press Enter. - -4. Right-click `FEATURE\AUTOCONFIG\BRANDING`, point to **New**, and then click **DWORD (32-bit) Value**. - -5. Enter the new DWORD value name, **iexplore.exe**, and then press Enter. - -6. Right-click **iexplore.exe**, and then click **Modify**. - -7. In the **Value data** box, enter **1**, and then click **OK**. - -8. Exit the registry editor. - -## Updating your automatic configuration settings -After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. -

Important
Your branding changes won't be added or updated if you've previously chosen the Disable external branding of IE setting in the User Configuration\Administrative Templates\Windows Components\Internet Explorer Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the Group Policy TechCenter. - - **To update your settings** - -1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** check box to allow automatic detection of browser settings. - -3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: - - - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that automatic configuration only happens when the computer restarts. - - - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. - - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. - -If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). - -## Locking your automatic configuration settings -You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. - -- **Using Microsoft Active Directory.** Choose **Disable changing Automatic Configuration settings** from the Administrative Templates setting. - -- **Not Using Active Directory.** Choose the **Disable changing Automatic Configuration settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto configuration settings for Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto configuration settings for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Automatic configuration lets you apply custom branding and graphics to your internal Internet Explorer installations, running on Windows 8.1 or Windows Server 2012 R2. For more information about adding custom branding and graphics to your IE package, see [Customize the toolbar button and Favorites List icons using IEAK 11](../ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md).

**Important**
You'll only see and be able to use the **IE Customization Wizard 11 - Automatic Configuration** page if you're creating an internal IE installation package. For more information about the **IE Customization Wizard 11 - Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). + +## Adding the automatic configuration registry key +For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry key to your IE installation package.

**Important**
Follow these directions carefully because serious problems can occur if you update your registry incorrectly. For added protection, back up your registry so you can restore it if a problem occurs. + + **To add the registry key** + +1. On the **Start** screen, type **regedit**, and then click **Regedit.exe**. + +2. Right-click the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl` subkey, point to **New**, and then click **Key**. + +3. Enter the new key name, `FEATURE\AUTOCONFIG\BRANDING`, and then press Enter. + +4. Right-click `FEATURE\AUTOCONFIG\BRANDING`, point to **New**, and then click **DWORD (32-bit) Value**. + +5. Enter the new DWORD value name, **iexplore.exe**, and then press Enter. + +6. Right-click **iexplore.exe**, and then click **Modify**. + +7. In the **Value data** box, enter **1**, and then click **OK**. + +8. Exit the registry editor. + +## Updating your automatic configuration settings +After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. +

Important
Your branding changes won't be added or updated if you've previously chosen the Disable external branding of IE setting in the User Configuration\Administrative Templates\Windows Components\Internet Explorer Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the Group Policy TechCenter. + + **To update your settings** + +1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +2. Choose the **Automatically detect configuration settings** check box to allow automatic detection of browser settings. + +3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: + + - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that automatic configuration only happens when the computer restarts. + + - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. + + - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. + +If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). + +## Locking your automatic configuration settings +You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. + +- **Using Microsoft Active Directory.** Choose **Disable changing Automatic Configuration settings** from the Administrative Templates setting. + +- **Not Using Active Directory.** Choose the **Disable changing Automatic Configuration settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md index 6d58aac85b..3e2c898988 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md @@ -1,55 +1,59 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto detect settings Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto detect settings Internet Explorer 11 -After you specify the specific settings related to automatic detection on your Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) servers, you can set up your users' browser settings from a central location. - -Automatic detection works even if the browser wasn't originally set up or installed by the administrator. - -- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. - -- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses.

**Note**
DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. - -## Updating your automatic detection settings -To use automatic detection, you have to set up your DHCP and DNS servers.

**Note**
Your DHCP servers must support the `DHCPINFORM` message, to obtain the DHCP options. - - **To turn on automatic detection for DHCP servers** - -1. Open the Internet Explorer Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). - -3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). - - **To turn on automatic detection for DNS servers** - -4. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -5. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. - -6. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651). - -7. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

**Note**
Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto detect settings Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto detect settings Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +After you specify the specific settings related to automatic detection on your Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) servers, you can set up your users' browser settings from a central location. + +Automatic detection works even if the browser wasn't originally set up or installed by the administrator. + +- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. + +- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses.

**Note**
DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. + +## Updating your automatic detection settings +To use automatic detection, you have to set up your DHCP and DNS servers.

**Note**
Your DHCP servers must support the `DHCPINFORM` message, to obtain the DHCP options. + + **To turn on automatic detection for DHCP servers** + +1. Open the Internet Explorer Customization Wizard 11, and go to the **Automatic Configuration** page. + +2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). + +3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). + + **To turn on automatic detection for DNS servers** + +4. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +5. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. + +6. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651). + +7. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

**Note**
Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md index bd7bd5c030..f285933bcb 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md @@ -1,50 +1,54 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto proxy configuration settings for Internet Explorer 11 -author: dansimp -ms.prod: ie11 -ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto proxy configuration settings for Internet Explorer 11 -Configure and maintain your proxy settings, like pointing your users' browsers to your automatic proxy script, through the Internet Explorer Customization Wizard 11 running on either Windows 8.1 or Windows Server 2012 R2. - -## Updating your auto-proxy settings -You can use your Internet settings (.ins) files to set up your standard proxy settings. You can also specify script files (.js, .jvs, or .pac) to configure and maintain your advanced proxy settings. IE uses your auto-proxy script files to dynamically determine whether to connect to a host or use a proxy server. If a proxy server connection fails, Internet Explorer 11 automatically attempts to connect to another proxy server that you have specified. - - **To update your settings** - -1. Create a script file with your proxy information, copying it to a server location. - -2. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: - - - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that updates only happen when the computer restarts. - - - **Automatic Configuration URL (.INS file) box:** Type the location of the .ins file you want to use for automatic configuration. For more information about setting up **Automatic Configuration**, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md). - - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script. This script runs whenever IE11 makes a network request and can include multiple proxy servers for each protocol type.

**Important**
IE11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. - -## Locking your auto-proxy settings -You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. - -- **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. - -- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto proxy configuration settings for Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto proxy configuration settings for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Configure and maintain your proxy settings, like pointing your users' browsers to your automatic proxy script, through the Internet Explorer Customization Wizard 11 running on either Windows 8.1 or Windows Server 2012 R2. + +## Updating your auto-proxy settings +You can use your Internet settings (.ins) files to set up your standard proxy settings. You can also specify script files (.js, .jvs, or .pac) to configure and maintain your advanced proxy settings. IE uses your auto-proxy script files to dynamically determine whether to connect to a host or use a proxy server. If a proxy server connection fails, Internet Explorer 11 automatically attempts to connect to another proxy server that you have specified. + + **To update your settings** + +1. Create a script file with your proxy information, copying it to a server location. + +2. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: + + - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that updates only happen when the computer restarts. + + - **Automatic Configuration URL (.INS file) box:** Type the location of the .ins file you want to use for automatic configuration. For more information about setting up **Automatic Configuration**, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md). + + - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script. This script runs whenever IE11 makes a network request and can include multiple proxy servers for each protocol type.

**Important**
IE11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. + +## Locking your auto-proxy settings +You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. + +- **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. + +- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md index 12bd5502e3..17f6488e0a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md +++ b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md @@ -1,43 +1,47 @@ ---- -title: Blocked out-of-date ActiveX controls -description: This page is periodically updated with new ActiveX controls blocked by this feature. -author: dansimp -ms.author: dansimp -audience: itpro manager: dansimp -ms.date: 05/10/2018 -ms.topic: article -ms.prod: ie11 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -ms.assetid: '' -ms.reviewer: -ms.sitesec: library ---- - -# Blocked out-of-date ActiveX controls - -ActiveX controls are small apps that let websites provide content, like videos and games, and let you interact with content, like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. It's very important that you keep your ActiveX controls up to date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a security feature called _out-of-date ActiveX control blocking_. - -We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list. - -You will receive a notification if a webpage tries to load one of the following of ActiveX control versions: - -**Java** - -| Java 2 Platform, Standard Edition (J2SE) 1.4, everything below (but not including) update 43 | -|----------------------------------------------------------------------------------------------| -| J2SE 5.0, everything below (but not including) update 99 | -| Java SE 6, everything below (but not including) update 181 | -| Java SE 7, everything below (but not including) update 171 | -| Java SE 8, everything below (but not including) update 161 | -| Java SE 9, everything below (but not including) update 4 | - -**Silverlight** - - -| Everything below (but not including) Silverlight 5.1.50907.0 | -|--------------------------------------------------------------| -| | - -For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](https://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](https://go.microsoft.com/fwlink/?LinkId=403864). +--- +title: Blocked out-of-date ActiveX controls +description: This page is periodically updated with new ActiveX controls blocked by this feature. +author: dansimp +ms.author: dansimp +audience: itpro +manager: dansimp +ms.date: 05/10/2018 +ms.topic: article +ms.prod: ie11 +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +ms.assetid: '' +ms.reviewer: +ms.sitesec: library +--- + +# Blocked out-of-date ActiveX controls + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +ActiveX controls are small apps that let websites provide content, like videos and games, and let you interact with content, like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. It's very important that you keep your ActiveX controls up to date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a security feature called _out-of-date ActiveX control blocking_. + +We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list. + +You will receive a notification if a webpage tries to load one of the following of ActiveX control versions: + +**Java** + +| Java 2 Platform, Standard Edition (J2SE) 1.4, everything below (but not including) update 43 | +|----------------------------------------------------------------------------------------------| +| J2SE 5.0, everything below (but not including) update 99 | +| Java SE 6, everything below (but not including) update 181 | +| Java SE 7, everything below (but not including) update 171 | +| Java SE 8, everything below (but not including) update 161 | +| Java SE 9, everything below (but not including) update 4 | + +**Silverlight** + + +| Everything below (but not including) Silverlight 5.1.50907.0 | +|--------------------------------------------------------------| +| | + +For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](https://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](https://go.microsoft.com/fwlink/?LinkId=403864). diff --git a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md index fe61c67cf5..9aca832f3e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md +++ b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md @@ -1,38 +1,42 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: performance -description: Browser cache changes and roaming profiles -author: dansimp -ms.prod: ie11 -ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/16/2017 ---- - - -# Browser cache changes and roaming profiles -We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. - -You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](https://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Microsoft Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). - -To get the best results while using roaming profiles, we strongly recommend the following: - -- Create a separate roaming repository for each domain account that uses roaming. - -- Restrict roaming user profiles so they work on only one computer at a time. Using a single roaming profile on multiple computers isn’t supported (via console or Remote Desktop) and can cause unpredictable results, including cookie loss. - -- Allow all computers that let users sign-on with a roaming profile have identical IE cookie policies and settings. - -- Make sure to delete the user’s local roaming profile at sign off for any computer using user profile roaming. You can do this by turning on the **Delete cached copies of roaming profiles** Group Policy Object. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: performance +description: Browser cache changes and roaming profiles +author: dansimp +ms.prod: ie11 +ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 10/16/2017 +--- + + +# Browser cache changes and roaming profiles + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. + +You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](https://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Microsoft Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). + +To get the best results while using roaming profiles, we strongly recommend the following: + +- Create a separate roaming repository for each domain account that uses roaming. + +- Restrict roaming user profiles so they work on only one computer at a time. Using a single roaming profile on multiple computers isn’t supported (via console or Remote Desktop) and can cause unpredictable results, including cookie loss. + +- Allow all computers that let users sign-on with a roaming profile have identical IE cookie policies and settings. + +- Make sure to delete the user’s local roaming profile at sign off for any computer using user profile roaming. You can do this by turning on the **Delete cached copies of roaming profiles** Group Policy Object. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md index d3cae2a67a..f358312bbc 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md @@ -1,56 +1,60 @@ ---- -ms.localizationpriority: medium -title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) -description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10 and Windows 10 Mobile. -ms.mktglfcycl: deploy -ms.prod: ie11 -ms.sitesec: library -author: dansimp -ms.date: 07/27/2017 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp ---- - - -# Change history for Internet Explorer 11 -This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile. - -## April 2017 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md)|Updates to the Enterprise Mode section to include info about the Enterprise Mode Site List Portal. | - -## March 2017 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to add the Allow VBScript to run in Internet Explorer and the Hide the button (next to the New Tab button) that opens Microsoft Edge settings. | - -## November 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Updated the DocMode reason section to correct Code 8 and to add Code 9.| - -## August 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | - -## July 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. | - -## June 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. | - - -## May 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | - +--- +ms.localizationpriority: medium +title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) +description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10 and Windows 10 Mobile. +ms.mktglfcycl: deploy +ms.prod: ie11 +ms.sitesec: library +author: dansimp +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +--- + + +# Change history for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile. + +## April 2017 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md)|Updates to the Enterprise Mode section to include info about the Enterprise Mode Site List Portal. | + +## March 2017 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to add the Allow VBScript to run in Internet Explorer and the Hide the button (next to the New Tab button) that opens Microsoft Edge settings. | + +## November 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Updated the DocMode reason section to correct Code 8 and to add Code 9.| + +## August 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | + +## July 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. | + +## June 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. | + + +## May 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | + diff --git a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md index 0b2d9ff141..9b4b3e6f1f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md +++ b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md @@ -1,51 +1,55 @@ ---- -title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) -description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. -ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: ie11 -ms.mktglfcycl: deploy -ms.pagetype: appcompat -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.date: 08/14/2017 -ms.localizationpriority: medium ---- - - -# Check for a new Enterprise Mode site list xml file - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. You can add and remove sites from your XML list as frequently as you want, changing which sites should render in Enterprise Mode for your employees. For information about turning on Enterprise Mode and using site lists, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -The information in this topic only covers HTTPS protocol. We strongly recommend that you use HTTPS protocol instead of file protocol due to increased performance. - -**How Internet Explorer 11 looks for an updated site list** - -1. Internet Explorer starts up and looks for an updated site list in the following places: - - 1. **In the cache container.** IE first checks the cache container to see if it finds your XML site list. - - 2. **In the local cache.** If there’s nothing in the cache container, IE checks your local cache for the site list. - - 3. **On the server.** Based on standard IE caching rules, IE might look for a copy of your site list in the location you put specified in the **SiteList** value of the registry. - -2. If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

**Note**
If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. - -   - -  - -  - - - +--- +title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) +description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. +ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: ie11 +ms.mktglfcycl: deploy +ms.pagetype: appcompat +ms.sitesec: library +author: dansimp +ms.author: dansimp +ms.date: 08/14/2017 +ms.localizationpriority: medium +--- + + +# Check for a new Enterprise Mode site list xml file + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. You can add and remove sites from your XML list as frequently as you want, changing which sites should render in Enterprise Mode for your employees. For information about turning on Enterprise Mode and using site lists, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +The information in this topic only covers HTTPS protocol. We strongly recommend that you use HTTPS protocol instead of file protocol due to increased performance. + +**How Internet Explorer 11 looks for an updated site list** + +1. Internet Explorer starts up and looks for an updated site list in the following places: + + 1. **In the cache container.** IE first checks the cache container to see if it finds your XML site list. + + 2. **In the local cache.** If there’s nothing in the cache container, IE checks your local cache for the site list. + + 3. **On the server.** Based on standard IE caching rules, IE might look for a copy of your site list in the location you put specified in the **SiteList** value of the registry. + +2. If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

**Note**
If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. + +   + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md index c35d115df7..810264c501 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md @@ -1,31 +1,35 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Choose how to deploy Internet Explorer 11 (IE11) -author: dansimp -ms.prod: ie11 -ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Choose how to deploy Internet Explorer 11 (IE11) -In this section, you can learn about how to deploy your custom version of Internet Explorer using Automatic Version Synchronization (AVS) or using your software distribution tools. - -## In this section - -| Topic | Description | -|------------------------------------------------------------- | ------------------------------------------------------ | -|[Deploy IE11 using Automatic Version Synchronization (AVS)](deploy-ie11-using-automatic-version-synchronization-avs.md) |Guidance about how to deploy your custom browser packages using Automatic Version Synchronization (AVS). | -|[Deploy IE11 using software distribution tools](deploy-ie11-using-software-distribution-tools.md) |Guidance about how to deploy your custom browser packages using System Center 2012 R2, Windows Server Update Services (WSUS), Group Policy software installation, or Microsoft Deployment toolkit (MDT). | - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Choose how to deploy Internet Explorer 11 (IE11) +author: dansimp +ms.prod: ie11 +ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Choose how to deploy Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +In this section, you can learn about how to deploy your custom version of Internet Explorer using Automatic Version Synchronization (AVS) or using your software distribution tools. + +## In this section + +| Topic | Description | +|------------------------------------------------------------- | ------------------------------------------------------ | +|[Deploy IE11 using Automatic Version Synchronization (AVS)](deploy-ie11-using-automatic-version-synchronization-avs.md) |Guidance about how to deploy your custom browser packages using Automatic Version Synchronization (AVS). | +|[Deploy IE11 using software distribution tools](deploy-ie11-using-software-distribution-tools.md) |Guidance about how to deploy your custom browser packages using System Center 2012 R2, Windows Server Update Services (WSUS), Group Policy software installation, or Microsoft Deployment toolkit (MDT). | + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md index 563f38160c..72a5766494 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md @@ -1,37 +1,41 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Choose how to install Internet Explorer 11 (IE11) -author: dansimp -ms.prod: ie11 -ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Choose how to install Internet Explorer 11 (IE11) -Before you install Internet Explorer 11, you should: - -- **Migrate Group Policy Objects.** Decide if your Group Policy Objects should migrate to the new version. - -- **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. - -- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. - -- **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. - - - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/cloud-platform/microsoft-intune). - - - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Choose how to install Internet Explorer 11 (IE11) +author: dansimp +ms.prod: ie11 +ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Choose how to install Internet Explorer 11 (IE11) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Before you install Internet Explorer 11, you should: + +- **Migrate Group Policy Objects.** Decide if your Group Policy Objects should migrate to the new version. + +- **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. + +- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. + +- **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. + + - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/cloud-platform/microsoft-intune). + + - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index 12049fdcb9..0ffe059374 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Collect data using Enterprise Site Discovery +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md index d01fccf729..db62af6aab 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md @@ -16,6 +16,9 @@ ms.author: dansimp # Use the Settings page to finish setting up the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md index 278408ab38..ad4441c9e3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md @@ -16,6 +16,9 @@ ms.author: dansimp # Create a change request using the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md index 6c260e93aa..395703b43d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Create packages for multiple operating systems or languages + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You'll create multiple versions of your custom browser package if: - You support more than 1 version of Windows®. diff --git a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md index fc43585ae7..342b139714 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Customize Internet Explorer 11 installation packages + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You can customize Internet Explorer 11 to support various browser behaviors, multiple operating system versions and languages, and Setup information (.inf) files. |Topic |Description | diff --git a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index b2c4c0f80a..843d917596 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md index b9089ee16a..0f0c56de35 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md @@ -15,6 +15,9 @@ ms.date: 07/27/2017 --- # Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). ## What is Automatic Version Synchronization? diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md index dc31c3230e..c3940fbefd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Deploy Internet Explorer 11 using software distribution tools + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + If you already manage software distribution and updates on your network through software distribution tools, you can also use these tools for ongoing deployments of Internet Explorer. Software distribution tools include: - **System Center R2 2012 System Center 2012 R2 Configuration Manager.** Deploy and install Internet Explorer 11 on your user's computers through a software distribution package. For more information about using this tool, see [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664). diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md index 567b8fbeb8..0177418299 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md index f0f44c2897..e8d1ec3d7d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Deprecated document modes and Internet Explorer 11 +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md index 8ad5f3e6ad..29574ab860 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md index cb419efe7f..e21f3e41ed 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md @@ -17,6 +17,9 @@ ms.date: 4/12/2018 # Enable and disable add-ons using administrative templates and group policy + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Add-ons let your employees personalize Internet Explorer. You can manage IE add-ons using Group Policy and Group Policy templates. There are four types of add-ons: diff --git a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md index d0998607dc..7f00307378 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Enhanced Protected Mode problems with Internet Explorer + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Enhanced Protected Mode further restricts Protected Mode to deny potential attackers access to sensitive or personal information. If this feature is turned on, users might start to see errors asking them to turn it off, like **This webpage wants to run "npctrl.dll. If you trust this site, you can disable Enhanced Protected Mode for this site to run the control**. If your users click the **Disable** box, Enhanced Protected Mode is turned off for only the single visit to that specific site. After the user leaves the site, Enhanced Protected Mode is automatically turned back on. You can use your company’s Group Policy to turn Enhanced Protected Mode on or off for all users. For more information, see the [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md) information in this guide. diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md index 71104a8786..e5e3c31095 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Enterprise Mode for Internet Explorer 11 +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md index 09160baadd..6832c2797b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Enterprise Mode schema v.1 guidance +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md index a321e5a744..299c6c093f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md @@ -18,6 +18,9 @@ ms.date: 12/04/2017 # Enterprise Mode schema v.2 guidance +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md index cf235b25aa..ce2f14b162 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Export your Enterprise Mode site list from the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md index f1d72eb1a1..a5abdb8400 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Fix web compatibility issues using document modes and the Enterprise Mode site list + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The Internet Explorer 11 Enterprise Mode site list lets you specify document modes for specific websites, helping you fix compatibility issues without changing a single line of code on the site. This addition to the site list is a continuation of our commitment to help you upgrade and stay up-to-date on the latest version of Internet Explorer, while still preserving your investments in existing apps. ## What does this mean for me? diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md index c3c7ead8ff..54da1d4ba1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Fix validation problems using the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md index d2fadc609c..93486e7113 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Advanced Group Policy Management (AGPM) is an add-on license that available for the Microsoft Desktop Optimization Pack (MDOP). This license gives you change control and a role assignment-model that helps optimize Group Policy management and reduce the risk of widespread failures. From AGPM you can: diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md index df5754f0b6..e1e763af4c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + A Microsoft Management Console (MMC)-based tool that uses scriptable interfaces to manage Group Policy. The 32-bit and 64-bit versions are included with Windows Server R2 with Service Pack 1 (SP1) and Windows Server 2012 R2. ## Why use the GPMC? diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md index d80c5af350..7e8c419582 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Group Policy and Internet Explorer 11 (IE11) +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md index 4ca3868ed5..dce572d812 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group Policy, the Local Group Policy Editor, and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + A Microsoft Management Console (MMC)-based tool that manages both computer and user-related configurations for an individual computer policy. This tool is included with Windows® 7 Service Pack 1 (SP1) and Windows 8.1. Here's a list of the policy settings you can use, based on the configuration type. For more info, see [Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=294912). diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md index 8a5b6d7859..12b360b126 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group Policy and compatibility with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Internet Explorer 11 has many Group Policy entries that can be configured for keeping your environment managed and safe. This table includes all of our recommendations around security, performance, and compatibility with the previous versions of Internet Explorer, regardless of which Zone the website is in. |Activity |Location |Setting the policy object | diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md index 403471f4c7..3eafec01ac 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group Policy management tools + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Group Policy, based on Microsoft Active Directory Domain Services (AD DS), lets you manage your organization's computer and user settings as part of your Group Policy objects (GPOs), which are added and changed in the Group Policy Management Console (GPMC). GPOs can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. The most effective way to target a specific GPO is to use Windows Management Instrumentation (WMI) filters. Like, creating a WMI filter that applies a GPO only to computers with a specific make and model. By using Group Policy, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple Internet Explorer 11 security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md index ae5c5f783e..938e3e036e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group policy preferences and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Group Policy preferences are less strict than Group Policy settings, based on: | |Group Policy preferences |Group Policy settings | diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md index d94601a9d5..26cf3ae659 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group Policy problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + If you're having problems with Group Policy and Internet Explorer 11, or if you're looking for high-level information about the concepts and techniques used to troubleshoot Group Policy, as well as links to detailed reference topics, procedures, and troubleshooting scenario guides, see [Group Policy Analysis and Troubleshooting Overview](https://go.microsoft.com/fwlink/p/?LinkId=279872). ## Group Policy Object-related Log Files diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md index 1f0caf9bc3..cd9e8a1740 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group Policy, Shortcut Extensions, and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Group Policy includes the Shortcuts preference extension, which lets you configure shortcuts to: - **File system objects.** Traditional shortcuts that link to apps, files, folders, drives, shares, or computers. For example, linking a shortcut to an app from the **Start** screen. diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md index 2de349942d..6f57e982ec 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Group Policy, Windows Powershell, and Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Your domain-joined Group Policy Objects (GPOs) can use any of Group Policy-related “cmdlets” that run within Windows PowerShell. Each cmdlet is a single-function command-line tool that can: diff --git a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md index 9fe7dca247..bd0befaee9 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md +++ b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md @@ -17,6 +17,9 @@ ms.date: 05/22/2018 --- # Internet Explorer 11 delivery through automatic updates + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Internet Explorer 11 makes browsing the web faster, easier, safer, and more reliable than ever. To help customers become more secure and up-to-date, Microsoft will distribute Internet Explorer 11 through Automatic Updates and the Windows Update and Microsoft Update sites. Internet Explorer 11 will be available for users of the 32-bit and 64-bit versions of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1. This article provides an overview of the delivery process and options available for IT administrators to control how and when Internet Explorer 11 is deployed to their organization through Automatic Updates. - [Automatic updates delivery process](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates#automatic-updates-delivery-process) @@ -65,7 +68,7 @@ Additional information on Internet Explorer 11, including a Readiness Toolkit, t ## Availability of Internet Explorer 11 -Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the Microsoft Endpoint Configuration Manager and WSUS. +Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the Microsoft Endpoint Manager and WSUS. ## Prevent automatic installation of Internet Explorer 11 with WSUS diff --git a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md index 6b34fcc195..30de0a2c97 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md +++ b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md @@ -11,6 +11,9 @@ ms.author: dansimp # Full-sized flowchart detailing how document modes are chosen in IE11 +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)

diff --git a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md index 5ab9dd5e58..f585e3210d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Import your Enterprise Mode site list to the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/index.md b/browsers/internet-explorer/ie11-deploy-guide/index.md index 74f09e116d..c40ba230ff 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/index.md +++ b/browsers/internet-explorer/ie11-deploy-guide/index.md @@ -14,6 +14,9 @@ manager: dansimp # Internet Explorer 11 (IE11) - Deployment Guide for IT Pros +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md index e9fcf44f0e..47a4d07569 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Install and Deploy Internet Explorer 11 (IE11) +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md index 7dd92ecc08..027cf25129 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md @@ -15,6 +15,9 @@ ms.date: 07/27/2017 # Install Internet Explorer 11 (IE11) using Microsoft Intune + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Internet Explorer 11 is available as an update in Microsoft Intune. Microsoft Intune uses Windows cloud services to help you manage updates, monitor and protect your computers, provide remote assistance, track hardware and software inventory, and set security policies. For more information, see the [Documentation Library for Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=301805). ## Adding and deploying the IE11 package diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md index 5dade69199..c6bd4e15e8 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + You can install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images. You'll need to extract the .cab file for each supported operating system and platform combination and the .msu file for each prerequisite update. Download the IE11 update and prerequisites here: diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md index 2b40174159..e08ca5dffe 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You can install Internet Explorer 11 (IE11) by using [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?linkid=276664). Complete these steps for each operating system and platform combination. **To install IE11** diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md index 9da3cd91fa..d0d9d17be1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Install Internet Explorer 11 (IE11) using your network + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You can install Internet Explorer 11 (IE11) over your network by putting your custom IE11 installation package in a shared network folder and letting your employees run the Setup program on their own computers. You can create the network folder structure manually, or you can run Internet Explorer Administration Kit 11 (IEAK 11). **Note**
If you support multiple architectures and operating systems, create a subfolder for each combination. If you support multiple languages, create a subfolder for each localized installation file. diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md index 5d230773e3..d593de27c6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Install Internet Explorer 11 (IE11) using third-party tools + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You can install Internet Explorer 11 (IE11) using third-party electronic software distribution (ESD) systems and these command-line options: ## Setup Modes diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md index 62bfab42b9..662514e102 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Windows Server Update Services (WSUS) lets you download a single copy of the Microsoft product update and cache it on your local WSUS servers. You can then configure your computers to get the update from your local servers instead of Windows Update. For more information about WSUS, see [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790). **To import from Windows Update to WSUS** diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md index 3ebe727aeb..3e6ffbfad8 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Install problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Most Internet Explorer 11 installations are straightforward and work the way they should. But it's possible that you might have problems. If you do, you can: diff --git a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md index 16331ab49c..803fc7fb83 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Fix intranet search problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + After upgrading to Internet Explorer 11, you might experience search issues while using your intranet site. ## Why is my intranet redirecting me to search results? diff --git a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md index 2270749c81..66b29a20c4 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md +++ b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Manage Internet Explorer 11 +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md index c0087953b7..e0dbd2bdab 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Missing Internet Explorer Maintenance settings for Internet Explorer 11 +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md index fbc40cbf73..faa927931e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md +++ b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Missing the Compatibility View Button +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md index 3e564954a6..6c68a1ec01 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md @@ -16,6 +16,12 @@ ms.date: 07/27/2017 # .NET Framework problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +## Summary + If you’re having problems launching your legacy apps while running Internet Explorer 11, it’s most likely because Internet Explorer no longer starts apps that use managed browser hosting controls, like in .NET Framework 1.1 and 2.0. **To turn managed browser hosting controls back on** @@ -24,11 +30,14 @@ If you’re having problems launching your legacy apps while running Internet Ex 2. **For 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. -For more information, see the [Web Applications](https://go.microsoft.com/fwlink/p/?LinkId=308903) section of the Application Compatibility in the .NET Framework 4.5 page. +## More information -  - -  +IEHost is a Microsoft .NET Framework 1.1-based technology that provides a better model than ActiveX controls to host controls within the browser. The IEHost controls are lightweight and are operated under the .NET security model where they are operated inside a sandbox.  +From the .NET Framework 4, we remove the IEHost.dll file for the following reasons: +- IEHost/HREF-EXE-style controls are exposed to the Internet. This poses a high security risk, and most customers who install the Framework are benefiting very little from this security risk. +- Managed hosting controls and invoking random ActiveX controls may be unsafe, and this risk cannot be countered in the .NET Framework. Therefore, the ability to host is disabled. We strongly suggest that IEHost should be disabled in any production environment. +- Potential security vulnerabilities and assembly versioning conflicts in the default application domain. By relying on COM Interop wrappers to load your assembly, it is implicitly loaded in the default application domain. If other browser extensions do the same function, they have the risks in the default application domain such as disclosing information, and so on. If you are not using strong-named assemblies as dependencies, type loading exceptions can occur. You cannot freely configure the common language runtime (CLR), because you do not own the host process, and you cannot run any code before your extension is loaded. +For more information about .NET Framework application compatibility, see [Application compatibility in the .NET Framework](/dotnet/framework/migration-guide/application-compatibility). diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md index 65e099eb37..9b8ab9eb33 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # New group policy settings for Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Internet Explorer 11 gives you some new Group Policy settings to help you manage your company's web browser configurations, including: diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md index 5591606f32..a2f12352fd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md +++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md @@ -18,6 +18,9 @@ ms.date: 05/10/2018 # Out-of-date ActiveX control blocking +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 @@ -105,7 +108,10 @@ reg add "HKCU\Software\Microsoft\Internet Explorer\VersionManager" /v DownloadVe ``` Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. Use this configuration option at your own risk. -## Out-of-date ActiveX control blocking on managed devices +## Out-of-date ActiveX control blocking + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + on managed devices Out-of-date ActiveX control blocking includes four new Group Policy settings that you can use to manage your web browser configuration, based on your domain controller. You can download the administrative templates, including the new settings, from the [Administrative templates (.admx) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=746579) page or the [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) page, depending on your operating system. ### Group Policy settings diff --git a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md index 80a59c9305..fbcbcbadb9 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md @@ -16,6 +16,9 @@ ms.date: 10/16/2017 # Problems after installing Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + After you install Internet Explorer 11 in your organization, you might run into the following issues. By following these suggestions, you should be able to fix them. ## Internet Explorer is in an unusable state diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index df8a2b1707..4c973ffad6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md index 4995a12e9a..f30c495bb3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Remove sites from a local compatibility view list +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md index c9b859509b..93b323b78a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Remove sites from a local Enterprise Mode site list +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md index bb22b43b3f..acfe82d2a5 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/review-neutral-sites-with-site-list-manager.md @@ -17,6 +17,9 @@ ms.date: 04/02/2020 # Review neutral sites for Internet Explorer mode using the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md index 28b18117e1..7b80dd178d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Save your site list to XML in the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md index 4565b9f0c1..4d5e66ec80 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md @@ -16,6 +16,9 @@ ms.author: dansimp # Schedule approved change requests for production using the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 0f35b04d1c..f96a952626 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Search your Enterprise Mode site list in the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md index b6c1af8258..6edccdda73 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Set the default browser using Group Policy + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You can use the Group Policy setting, **Set a default associations configuration file**, to set the default browser for your company devices running Windows 10. **To set the default browser as Internet Explorer 11** diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md index fd55a40ebd..94f9336c89 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Set up Enterprise Mode logging and data collection +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md index 7b0dd491aa..c022c08569 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md @@ -16,6 +16,9 @@ ms.author: dansimp # Set up the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md index 7dd3e837c0..70d197c391 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Setup problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Installing Internet Explorer creates the following log files, which are stored in the Windows installation folder (typically, the C:\\Windows folder): - `IE11_main.log` diff --git a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md index a8953ad3f4..37b7bc16cf 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # System requirements and language support for Internet Explorer 11 (IE11) +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md index 1f9a047156..14bd40e745 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md +++ b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md @@ -17,6 +17,9 @@ ms.date: 05/10/2018 # Tips and tricks to manage Internet Explorer compatibility +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + Find out how to achieve better backward compatibility for your legacy web applications with the Enterprise Mode Site List. Jump to: diff --git a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md index 39d999c947..bf8ceeb867 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Troubleshoot Internet Explorer 11 (IE11) +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md index 1df0d6b95e..7e4561fa2a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Turn off Enterprise Mode +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md index 90442b3bbc..178085c2ad 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Fix font rendering problems by turning off natural metrics + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + By default, Internet Explorer 11 uses “natural metrics”. Natural metrics use inter-pixel spacing that creates more accurately rendered and readable text, avoiding many common font rendering problems with Windows Internet Explorer 9 or older sites. However, you might find that many intranet sites need you to use Windows Graphics Device Interface (GDI) metrics. To avoid potential compatibility issues, you must turn off natural metrics for those sites. diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md index 744df8c766..8c84054dc3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md @@ -18,6 +18,9 @@ ms.localizationpriority: medium # Turn on Enterprise Mode and use a site list +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md index 1324c12963..b4db0fb7a4 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Turn on local control and logging for Enterprise Mode +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md index 446375289c..750bca0e82 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # List of updated features and tools - Internet Explorer 11 (IE11) +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md index c26e39ddcc..fe55abfdc6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md @@ -16,6 +16,9 @@ author: dansimp # Use the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md index 3cbc140f4b..cbfcfecf93 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md @@ -18,6 +18,9 @@ ms.date: 12/04/2017 # Use the Enterprise Mode Site List Manager +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md index 14fcd048fc..b7669cf1ca 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # User interface problems with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Some of the features in both Internet Explorer 11 and IEAK 11 have moved around. Here are some of the more common changes. ## Where did features go in the Internet Explorer Customization Wizard 11? diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md index 6bff79cc82..677f1c974a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md @@ -18,6 +18,9 @@ ms.date: 07/27/2017 # Using IE7 Enterprise Mode or IE8 Enterprise Mode +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md index 07e3ce2e2b..7015595563 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Internet Explorer Administration Kit 11 (IEAK 11) helps you set up, deploy, and maintain Internet Explorer 11. **Note**
IEAK 11 works in network environments, with or without Microsoft Active Directory. diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md index 1f7b62dfa5..afc27104af 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Using Setup Information (.inf) files to create install packages + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + IEAK 11 uses Setup information (.inf) files to provide uninstallation instructions. Uninstallation instructions let your employees remove components, like files, registry entries, or shortcuts, through the **Uninstall or change a program** box. For details about .inf files, see [INF File Sections and Directives](https://go.microsoft.com/fwlink/p/?LinkId=327959). **To add uninstallation instructions to the .inf files** diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md index a3fce1731d..a31c831abd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md @@ -16,6 +16,9 @@ ms.author: dansimp # Verify your changes using the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md index 42db6c85c5..1ccd3e4d0c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md @@ -16,6 +16,9 @@ ms.author: dansimp # Verify the change request update in the production environment using the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md index 2be252275c..9aa736bacb 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md @@ -16,6 +16,9 @@ ms.author: dansimp # View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md index 20ad5ac557..f2db72080d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md @@ -16,6 +16,9 @@ ms.author: dansimp # View the available Enterprise Mode reports from the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md index e5de6fffdd..771f7b3439 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Virtualization and compatibility with Internet Explorer 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + If your company is considering upgrading to the latest version of Internet Explorer, but is hesitant because of a large number of web apps that need to be tested and moved, we recommend that you consider virtualization. Virtualization lets you set up a virtual environment where you can run earlier versions of IE. **Important**
diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md index 1a2c6fc17a..b9fb67f961 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md @@ -18,6 +18,9 @@ ms.date: 10/25/2018 # Enterprise Mode and the Enterprise Mode Site List +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 @@ -61,7 +64,10 @@ Download the [Enterprise Mode Site List Manager (schema v.2)](https://go.microso - **Data gathering.** You can configure Enterprise Mode to collect local override data, posting back to a named server. This lets you "crowd source" compatibility testing from key users; gathering their findings to add to your central site list. -## Enterprise Mode and the Enterprise Mode Site List XML file +## Enterprise Mode and the Enterprise Mode Site List + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + XML file The Enterprise Mode Site List is an XML document that specifies a list of sites, their compat mode, and their intended browser. Using [Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853), you can automatically start a webpage using a specific browser. In the case of IE11, the webpage can also be launched in a specific compat mode, so it always renders correctly. Your employees can easily view this site list by typing _about:compat_ in either Microsoft Edge or IE11. Starting with Windows 10, version 1511 (also known as the Anniversary Update), you can also [restrict IE11 to only the legacy web apps that need it](https://blogs.windows.com/msedgedev/2016/05/19/edge14-ie11-better-together/), automatically sending sites not included in the Enterprise Mode Site List to Microsoft Edge. diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md index 4f1c56a922..1fd67f656b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md +++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md @@ -19,6 +19,9 @@ ms.date: 05/10/2018 # What is the Internet Explorer 11 Blocker Toolkit? +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md index de71b3a8ff..dd8e3bcce6 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md @@ -17,6 +17,9 @@ ms.author: dansimp # Workflow-based processes for employees using the Enterprise Mode Site List Portal +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows 10 diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md index 8917b1de22..c27e670fd6 100644 --- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md +++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md @@ -16,6 +16,9 @@ ms.date: 10/16/2017 # Internet Explorer 11 - FAQ for IT Pros + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Answering frequently asked questions about Internet Explorer 11 (IE11) features, operating system support, integration with the Windows operating system, Group Policy, and general configuration. ## Frequently Asked Questions diff --git a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md index e35b64b8a4..cf59b670d6 100644 --- a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md +++ b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md @@ -16,6 +16,9 @@ ms.date: 05/10/2018 # Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit. > [!Important] diff --git a/browsers/internet-explorer/ie11-faq/faq-ieak11.md b/browsers/internet-explorer/ie11-faq/faq-ieak11.md index 7405392094..929acbed39 100644 --- a/browsers/internet-explorer/ie11-faq/faq-ieak11.md +++ b/browsers/internet-explorer/ie11-faq/faq-ieak11.md @@ -18,6 +18,9 @@ ms.date: 05/10/2018 # IEAK 11 - Frequently Asked Questions +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + Get answers to commonly asked questions about the Internet Explorer Administration Kit 11 (IEAK 11), and find links to additional material you might find helpful. **What is IEAK 11?** diff --git a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md index b211933353..40a7886b0a 100644 --- a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Accelerators page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Accelerators** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you add accelerators to your employee computers. Accelerators are contextual menu options that can quickly get to a web service from any webpage. For example, an accelerator can look up a highlighted word in the dictionary or a selected location on a map. **Note**
diff --git a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md index 7e89dab65d..b4d0459c78 100644 --- a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Add and approve ActiveX controls using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + There are two main approaches to how you can control the use of ActiveX controls in your company. For more info about ActiveX controls, including how to manage the controls using Group Policy, see [Group Policy and ActiveX installation](../ie11-deploy-guide/activex-installation-using-group-policy.md) in the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). **Note**
diff --git a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md index eae4f678e5..c04501eea7 100644 --- a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Add a Root Certificate page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + We’re sorry. While we continue to recommend that you digitally sign your package, we’ve removed all of the functionality that allowed you to add a root certificate using the Internet Explorer Customization Wizard 11. The wizard page itself will be removed in a future version of the IEAK. Click **Next** to go to the [Programs](programs-ieak11-wizard.md) page or **Back** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page. diff --git a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md index 60be35bc0d..ebff04a24a 100644 --- a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Additional Settings page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Additional Settings** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you pick additional custom, corporate, and Internet settings that relate to your employee’s desktop, operating system, and security. If you don’t change a setting, it’ll be ignored. The additional settings appear in administration (.adm) files that are stored in your `:\Program Files\Windows IEAK 11\policies` folder. You can also create your own .adm files with options that can be configured using the wizard. Any edits you make to your own .adm file are stored as .ins files, which are used to build the .inf files for your custom install package. diff --git a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md index d3883b39ca..879c328e43 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Automatic Configuration page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Automatic Configuration** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you provide URLs to the files that’ll automatically configure Internet Explorer 11 for a group of employees or devices. **Note**
diff --git a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md index 1a46247c5c..7d4f9344c9 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Set up auto detection for DHCP or DNS servers using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Set up your network to automatically detect and customize Internet Explorer 11 when it’s first started. Automatic detection is supported on both Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS), letting your servers detect and set up your employee’s browser settings from a central location, using a configuration URL (.ins file) or a JavaScript proxy configuration file (.js, .jvs, or .pac). Before you can set up your environment to use automatic detection, you need to turn the feature on. diff --git a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md index c317a46e0e..b4565ed485 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Automatic Version Synchronization page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Automatic Version Synchronization** page of the Internet Explorer Customization Wizard 11 runs the synchronization process every time you run the wizard, downloading the Internet Explorer 11 Setup file to your computer. The Setup file includes the required full and express packages. **Important**
diff --git a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md index 3508c186af..7271837b2e 100644 --- a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md @@ -18,6 +18,9 @@ ms.date: 04/24/2018 # Before you start using IEAK 11 +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + Before you run IEAK 11 and the Customization Wizard, make sure you have met the following requirements: - Have you determined which licensing version of the Internet Explorer Administration Kit 11 to install? For info, see [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md). diff --git a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md index 5c9c189f24..351b1bbb76 100644 --- a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Branding .INS file to create custom branding and setup info + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about the custom branding and setup information in your browser package. |Name |Value | Description | diff --git a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md index c1f3999a3a..0116384f6d 100644 --- a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Browser User Interface page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Browser User Interface** page of the Internet Explorer Customization Wizard 11 lets you change the toolbar buttons and the title bar text in IE. **Note**
The customizations you make on this page apply only to Internet Explorer for the desktop. diff --git a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md index b2b123ff69..05fb2324f7 100644 --- a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about how to customize the Internet Explorer toolbar. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md index a39adaff3e..3214ea32c0 100644 --- a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Browsing Options page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Browsing Options** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you decide how you want to manage items in the **Favorites, Favorites Bar, and Feeds** section, including the Microsoft-provided default items. The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. diff --git a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md index e5bf7ebb40..321f45caf5 100644 --- a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the CabSigning .INS file to customize the digital signature info for your apps + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about how to customize the digital signature info for your apps. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md index cda9702eb4..b6138064be 100644 --- a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md @@ -17,6 +17,9 @@ ms.date: 07/27/2017 # Use the Compatibility View page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + We’re sorry. We’ve changed the way Compatibility View works in Internet Explorer 11 and have removed all of the functionality included on the **Compatibility View** page of the Internet Explorer Customization Wizard 11. For more info about the changes we’ve made to the Compatibility View functionality, see [Missing the Compatibility View Button](../ie11-deploy-guide/missing-the-compatibility-view-button.md). Click **Next** to go to the [Programs](programs-ieak11-wizard.md) page or **Back** to go to the [Security and Privacy Settings](security-and-privacy-settings-ieak11-wizard.md) page. diff --git a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md index aaec7b0fa2..e9051c955b 100644 --- a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Connection Manager page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + We're sorry. We've removed all of the functionality included on the Connection Manager page of the Internet Explorer Customization Wizard 11. Click **Next** to go to the [Connection Settings](connection-settings-ieak11-wizard.md) page or **Back** to go to the [Compatibility View](compat-view-ieak11-wizard.md) page. diff --git a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md index 66beabdbca..bc00c58bec 100644 --- a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Connection Settings page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Connection Settings** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you import the connection settings from your computer, to preset the connection settings on your employee’s computers. **Note**
Using the options on the **Additional Settings** page of the wizard, you can let your employees change their connection settings. For more information see the [Additional Settings](additional-settings-ieak11-wizard.md) page. You can also customize additional connection settings using the **Automatic Configuration** page in the wizard. For more information see the [Automatic Configuration](auto-config-ieak11-wizard.md) page. diff --git a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md index 779e024e57..0e7777a64e 100644 --- a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the ConnectionSettings .INS file to review the network connections for install + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about the network connection settings used to install your custom package. This section creates a common configuration on all of your employee’s computers. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md index 91f26adf5b..0befbc922f 100644 --- a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Create the build computer folder structure using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Create your build environment on the computer that you’ll use to build your custom browser package. Your license agreement determines your folder structure and which version of Internet Explorer Administration Kit 11 (IEAK 11) you’ll use: **Internal** or **External**. |Name |Version |Description | diff --git a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md index 3e8043c959..e2a0fb48a9 100644 --- a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Tasks and references to consider before creating and deploying custom packages using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Review this list of tasks and references to help you use the Internet Explorer Administration Kit 11 (IEAK 11) to set up, deploy, and manage Internet Explorer 11 in your company. |Task |References | diff --git a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md index 6196fabf79..5d88bfa81a 100644 --- a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Create multiple versions of your custom package using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You'll need to create multiple versions of your custom browser package if: - You support more than 1 version of the Windows operating system. diff --git a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md index 3cf498605c..ba3904ae39 100644 --- a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md +++ b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use uninstallation .INF files to uninstall custom components + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The Internet Explorer Administration Kit 11 (IEAK 11) uses Setup information (.inf) files to provide installation instructions for your custom browser packages. You can also use this file to uninstall your custom components by removing the files, registry entries, and shortcuts, and adding your custom component to the list of programs that can be uninstalled from **Uninstall or change a program**. **To uninstall your custom components** diff --git a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md index 571b73d327..1a981a5a16 100644 --- a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Custom Components page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Custom Components** page of the Internet Explorer Customization Wizard 11 lets you add up to 10 additional components that your employees can install at the same time they install IE. These components can be created by Microsoft or your organization as either compressed cabinet (.cab) or self-extracting executable (.exe) files. If you’re using Microsoft components, make sure you have the latest version and software patches from the [Microsoft Support](https://go.microsoft.com/fwlink/p/?LinkId=258658) site. To include Microsoft Update components, you must bundle the associated files into a custom component. **Important**
You should sign any custom code that’s being downloaded over the Internet. The default settings of Internet Explorer 11 will automatically reject any unsigned code. For more info about digitally signing custom components, see [Security features and IEAK 11](security-and-ieak11.md). diff --git a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md index e7469fa864..7a5556235d 100644 --- a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the CustomBranding .INS file to create custom branding and setup info + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Provide the URL to your branding cabinet (.cab) file. diff --git a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md index 3c0af97192..9ed59cf64e 100644 --- a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md +++ b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Customize Automatic Search for Internet Explorer using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Internet Explorer lets websites advertise any search provider that uses the open search standard described at the A9 website ( [OpenSearch 1.1 Draft 5](https://go.microsoft.com/fwlink/p/?LinkId=208582)). When IE detects new search providers, the **Search** box becomes active and adds the new providers to the drop-down list of providers. Using the **Administrative Templates** section of Group Policy, you can prevent the search box from appearing, you can add a list of acceptable search providers, or you can restrict your employee’s ability to add or remove search providers. diff --git a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md index 06e8d6c3f3..7d0a2f9882 100644 --- a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the ExtRegInf .INS file to specify installation files and mode + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about how to specify your Setup information (.inf) files and the installation mode for your custom components. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md index 47bf04d6e2..030dc054d2 100644 --- a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Favorites, Favorites Bar, and Feeds** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you add: - **Links.** Used so your employees can quickly connect with your important websites. These links can appear in the **Links** folder or on the **Favorites Bar**. diff --git a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md index 694b8d994d..ac736e20df 100644 --- a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the FavoritesEx .INS file for your Favorites icon and URLs + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about where you store your **Favorites** icon file, whether your **Favorites** are available offline, and the URLs for each **Favorites** site. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md index b27bc3273a..f72747f486 100644 --- a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md @@ -15,6 +15,9 @@ ms.sitesec: library # Use the Feature Selection page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Feature Selection** page of the Internet Explorer Customization Wizard 11 lets you choose which parts of the setup processes and Internet Explorer 11 to change for your company, including: - **Setup Customizations.** Lets you add custom components, decide which components to install, provide your download site information, and modify the Setup title bar and graphics. diff --git a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md index f3224c2055..0aee908cd4 100644 --- a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the File Locations page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **File Locations** page of the Internet Explorer Customization Wizard 11 lets you change the location of your folders, including: - Where you’ll create and store your custom installation package. diff --git a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md index 38703f9131..616e3b9938 100644 --- a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # File types used or created by IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + A list of the file types used or created by tools in IEAK 11: |File type |Description | diff --git a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md index 507450938d..9d6fe74f8a 100644 --- a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **First Run Wizard and Welcome Page Options** page of the Internet Explorer Customization Wizard 11 lets you decide what your employee’s see the first time they log on to IE, based on their operating system. - **Windows 8.1 Update and newer.** No longer includes a **Welcome** page, so if you pick the **Use Internet Explorer 11 Welcome Page** or the **Use a custom Welcome page** option, IEAK creates an initial **Home** page that loads before all other **Home** pages, as the first tab. This only applies to the Internet Explorer for the desktop. diff --git a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md index 0864538448..e3d95badec 100644 --- a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Customize the Toolbar button and Favorites List icons using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Use these customization guidelines to change the browser toolbar button and the **Favorites List** icons, using your own branding and graphics. **Important**
Check your license agreement to make sure this customization is available. diff --git a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md index 0ba0f580a8..2da43b7f38 100644 --- a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Hardware and software requirements for Internet Explorer 11 and the IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Before you can use the Internet Explorer Administration Kit 11 and the Internet Explorer Customization Wizard 11, you must first install Internet Explorer 11. For more info about installing IE11, see the [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md) page. ## Hardware requirements diff --git a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md index 7d50512355..6c46e306f3 100644 --- a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the HideCustom .INS file to hide the GUID for each custom component + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about whether to hide the globally unique identifier (GUID) for each of your custom components. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md index 51dc959759..c9d24160a9 100644 --- a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md +++ b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Internet Explorer Setup command-line options and return codes + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + You can use command-line options along with a tool like IExpress to package your custom version of Internet Explorer and to perform a batch installation across your organization. ## IE Setup command-line options diff --git a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md index b8c3d25c24..1d8b34786a 100644 --- a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md +++ b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md @@ -18,6 +18,9 @@ ms.date: 05/10/2018 # Internet Explorer Administration Kit (IEAK) information and downloads +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + >Applies to: Windows 10 The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. To find more information on the IEAK, see [What IEAK can do for you](what-ieak-can-do-for-you.md). diff --git a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md index f27ec8b5b9..0aa9964807 100644 --- a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md +++ b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Use the Internet Explorer Administration Kit 11 (IEAK 11) and the Internet Explorer Customization Wizard 11 to customize your browser install packages for deployment to your employee's devices. ## IE Customization Wizard 11 options diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md index cd7c730569..57128dfefe 100644 --- a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md +++ b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # IExpress Wizard command-line options +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + **Applies to:** - Windows Server 2008 R2 with SP1 diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md index 35dc9f9cc5..fe4bb3a985 100644 --- a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md +++ b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # IExpress Wizard for Windows Server 2008 R2 with SP1 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Use the IExpress Wizard and its associated command-line options to create self-extracting files that automatically run your custom Internet Explorer Setup (.inf or .exe file) program that’s contained inside. ## IExpress Wizard location diff --git a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md index 022767b179..b32b5bacab 100644 --- a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Important URLS – Home Page and Support** page of the Internet Explorer Customization Wizard 11 lets you choose one or more **Home** pages and an online support page for your customized version of IE. **To use the Important URLS – Home Page and Support page** diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md index 29b8c0ceca..946a42e72a 100644 --- a/browsers/internet-explorer/ie11-ieak/index.md +++ b/browsers/internet-explorer/ie11-ieak/index.md @@ -14,6 +14,9 @@ manager: dansimp # Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment. Use this guide to learn about the several options and processes you'll need to consider while you're using the Internet Explorer Administration Kit 11 (IEAK 11) to customize, deploy, and manage Internet Explorer 11 for your employee's devices. diff --git a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md index 15db2bc20f..6936f198d0 100644 --- a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Internal Install page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Internal Install** page of the Internet Explorer Customization Wizard 11 lets you customize Setup for the default browser and the latest browser updates, based on your company’s guidelines. **Note**
The customizations made on this page only apply to Internet Explorer for the desktop on Windows 7. diff --git a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md index b625916fd1..666c5f8b17 100644 --- a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the ISP_Security .INS file to add your root certificate + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about where you store the root certificate you’re adding to your custom package. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md index b2f66781b7..a343a30e51 100644 --- a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Language Selection page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Language Selection** page of the Internet Explorer Customization Wizard 11 lets you choose the language for your Internet Explorer Administration Kit 11 (IEAK 11) custom package. You can create custom Internet Explorer 11 packages in any of the languages your operating system version is available in. **Important**
Make sure that the language of your IEAK 11 installation matches the language of your custom IE11 package. If the languages don’t match, IEAK 11 won’t work properly. diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index ea1f1cb9e1..4c14f5ec98 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -16,6 +16,9 @@ ms.date: 10/23/2018 # Determine the licensing version and features to use in IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + In addition to the Software License Terms for the Internet Explorer Administration Kit 11 (IEAK 11, referred to as the "software"), these Guidelines further define how you may and may not use the software to create versions of Internet Explorer 11 with optional customizations (referred to as the "customized browser") for internal use and distribution in accordance with the IEAK 11 Software License Terms. IEAK 11 is for testing purposes only and is not intended to be used in a production environment. During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment. diff --git a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md index a441fe7be2..f628def610 100644 --- a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Media .INS file to specify your install media + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The types of media on which your custom install package is available. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md index ce2517bf60..ae7b3c6150 100644 --- a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Package Type Selection page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Package Type Selection** page of the Internet Explorer Customization Wizard 11 lets you pick which type of media you’ll use to distribute your custom installation package. You can pick more than one type, if you need it. **Important**
You can't create a full installation package for deployment to Windows 10 computers. That option only works for computers running Windows 7 or Windows 8.1. diff --git a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md index 342ac46d58..67d9caac65 100644 --- a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md @@ -15,6 +15,9 @@ ms.date: 07/27/2017 # Use the Platform Selection page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Platform Selection** page of the Internet Explorer Customization Wizard 11 lets you pick the operating system and architecture (32-bit or 64-bit) for the devices on which you’re going to install the custom installation package. **To use the Platform Selection page** diff --git a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md index 809110fc8b..4720c446af 100644 --- a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Before you install your package over your network using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Employees can install the custom browser package using a network server. However, you must either lower the intranet security level or make the server a trusted site. **To lower your intranet security** diff --git a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md index 8b46cc1615..acfbbc74ae 100644 --- a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md @@ -15,6 +15,9 @@ ms.date: 07/27/2017 # Use the Programs page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Programs** page of the Internet Explorer Customization Wizard 11 lets you pick the default programs to use for Internet services, like email, contact lists, and newsgroups, by importing settings from your computer. **Important**
The customizations you make on this page only apply to Internet Explorer for the desktop. diff --git a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md index 06213a78ae..56a0823f9a 100644 --- a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md +++ b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use proxy auto-configuration (.pac) files with IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + These are various ways you can use a proxy auto-configuration (.pac) file to specify an automatic proxy URL. We've included some examples here to help guide you, but you'll need to change the proxy names, port numbers, and IP addresses to match your organization's info. Included examples: diff --git a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md index 80e2e5d2c0..9def48f2d3 100644 --- a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Proxy .INS file to specify a proxy server + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about whether to use a proxy server. If yes, this also includes the host names for the proxy server. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md index a99dc70ae0..ba113af6cc 100644 --- a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Proxy Settings page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Proxy Settings** page of the Internet Explorer Customization Wizard 11 lets you pick the proxy servers used by your employees to connect for services required by the custom install package. Using a proxy server lets you limit access to the Internet. You can also use the **Additional Settings** page of the wizard to further restrict your employees from changing the proxy settings. diff --git a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md index c6fb131002..f3b4414183 100644 --- a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md @@ -15,6 +15,9 @@ ms.date: 07/27/2017 # Register an uninstall app for custom components using IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Register the uninstall apps for any custom components you’ve included in your Internet Explorer 11 package. Registering these apps lets your employees remove the components later, using **Uninstall or change a program** in the Control Panel. ## Register your uninstallation program diff --git a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md index 8bf7232c7c..340327e916 100644 --- a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Using the Resultant Set of Policy (RSoP) snap-in to review policy settings + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + After you’ve deployed your custom Internet Explorer package to your employees, you can use the Resultant Set of Policy (RSoP) snap-in to view your created policy settings. The RSoP snap-in is a two-step process. First, you run the RSoP wizard to determine what information should be viewed. Second, you open the specific items in the console window to view the settings. For complete instructions about how to use RSoP, see [Resultant Set of Policy](https://go.microsoft.com/fwlink/p/?LinkId=259479). **To add the RSoP snap-in** diff --git a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md index f66425a743..c092a2101b 100644 --- a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Search Providers page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Search Providers** page of the Internet Explorer Customization Wizard 11 lets you add a default search provider (typically, Bing®) and additional providers to your custom version of IE. **Note**
The Internet Explorer Customization Wizard 11 offers improved and extended search settings. However, you can still optionally include support for Search Suggestions and Favicons, as well as Accelerator previews by using an .ins file from a previous version of IEAK. diff --git a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md index 71d99f8b9f..336ad87ef1 100644 --- a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Security features and IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Use Internet Explorer in conjunction with your new and existing security measures, to make sure the computers in your company aren’t compromised while on the Internet. ## Enhanced Protection Mode diff --git a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md index 16ffc69435..c78a131719 100644 --- a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Security and Privacy Settings page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + The **Security and Privacy Settings** page of the Internet Explorer Customization Wizard 11 lets you manage your security zones, privacy settings, and content ratings. These settings help restrict the types of content your employees can access from the Internet, including any content that might be considered offensive or otherwise inappropriate in a corporate setting. **To use the Security and Privacy Settings page** diff --git a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md index e65b0e2b77..b4fd0c45b2 100644 --- a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Use the Security Imports .INS file to import security info + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + Info about how to import security information from your local device to your custom package. |Name |Value |Description | diff --git a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md index 9ae559b4b4..e4fcd7c739 100644 --- a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md @@ -16,6 +16,9 @@ ms.date: 07/27/2017 # Troubleshoot custom package and IEAK 11 problems + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + While the Internet Explorer Customization Wizard has been around for quite a while, there are still some known issues that you might encounter while deploying or managing your custom IE install package. ## I am unable to locate some of the wizard pages diff --git a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md index 965fda174e..06a1d3c029 100644 --- a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md +++ b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md @@ -1,40 +1,44 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use the \[URL\] .INS file setting to decide whether to use an auto-configured proxy server. -author: dansimp -ms.prod: ie11 -ms.assetid: 05b09dfa-cf11-408d-92c2-b4ae434a59a7 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Use the URL .INS file to use an auto-configured proxy server (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the URL .INS file to use an auto-configured proxy server -Info about whether to use an auto-configured proxy server. If yes, this also includes the URLs to the pages that appear when your employees first connect to that server. - -|Name |Value |Description | -|-----|------|------------| -|AutoConfig |

|Determines whether to automatically configure the customized browser on your employee’s device. | -|AutoConfigJSURL |`` |The URL for the proxy auto-config file (.js or .jvs) | -|AutoConfigTime |*integer* |Automatically configures the browser on your employee’s device after its run for a specified length of time. | -|AutoConfigURL |`` |The URL for the proxy auto-config (.pac) file. | -|FirstHomePage |`` |The page (URL) that appears the first time the custom browser is opened on the employee’s device. | -|Help_Page |`` |The URL to your internal technical support site. | -|Home_Page |`` |The URL to your default **Home** page. | -|NoWelcome |
  • **0.** Display the **Welcome** page.
  • **1.** Don’t display the **Welcome** page.
|Determines whether to show the **Welcome** page the first time the browser’s used on an employee’s device. | -|Quick_Link_1 |`` |The URL to your first Quick Link. | -|Quick_Link_1_Name |`` |The name of the site associated with Quick_Link_1. | -|Quick_Link_2 |`` |The URL to your second Quick Link. | -|Quick_Link_2_Name |`` |The name of the site associated with Quick_Link_2. | -|Quick_Link_X |`` |The URL to another Quick Link. | -|Quick_Link_X_Icon |`` |A Quick Links icon (.ico) file. | -|Quick_Link_X_Name |`` |The name of the site associated with another Quick Link. | -|Quick_Link_X_Offline |
  • **0.** Don’t make the Quick Links available offline.
  • **1.** Make the Quick Links available offline.
|Determines whether to make the Quick Links available for offline browsing. | -|Search_Page |`` |The URL to the default search page. | -|UseLocalIns |
  • **0.** Don’t use a local .ins file.
  • **1.** Use a local .ins file.
|Determines whether to use a local Internet Settings (.ins) file | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use the \[URL\] .INS file setting to decide whether to use an auto-configured proxy server. +author: dansimp +ms.prod: ie11 +ms.assetid: 05b09dfa-cf11-408d-92c2-b4ae434a59a7 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the URL .INS file to use an auto-configured proxy server (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the URL .INS file to use an auto-configured proxy server + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Info about whether to use an auto-configured proxy server. If yes, this also includes the URLs to the pages that appear when your employees first connect to that server. + +|Name |Value |Description | +|-----|------|------------| +|AutoConfig |
  • **0.** Don’t automatically configure the browser.
  • **1.** Automatically configure the browser.
|Determines whether to automatically configure the customized browser on your employee’s device. | +|AutoConfigJSURL |`` |The URL for the proxy auto-config file (.js or .jvs) | +|AutoConfigTime |*integer* |Automatically configures the browser on your employee’s device after its run for a specified length of time. | +|AutoConfigURL |`` |The URL for the proxy auto-config (.pac) file. | +|FirstHomePage |`` |The page (URL) that appears the first time the custom browser is opened on the employee’s device. | +|Help_Page |`` |The URL to your internal technical support site. | +|Home_Page |`` |The URL to your default **Home** page. | +|NoWelcome |
  • **0.** Display the **Welcome** page.
  • **1.** Don’t display the **Welcome** page.
|Determines whether to show the **Welcome** page the first time the browser’s used on an employee’s device. | +|Quick_Link_1 |`` |The URL to your first Quick Link. | +|Quick_Link_1_Name |`` |The name of the site associated with Quick_Link_1. | +|Quick_Link_2 |`` |The URL to your second Quick Link. | +|Quick_Link_2_Name |`` |The name of the site associated with Quick_Link_2. | +|Quick_Link_X |`` |The URL to another Quick Link. | +|Quick_Link_X_Icon |`` |A Quick Links icon (.ico) file. | +|Quick_Link_X_Name |`` |The name of the site associated with another Quick Link. | +|Quick_Link_X_Offline |
  • **0.** Don’t make the Quick Links available offline.
  • **1.** Make the Quick Links available offline.
|Determines whether to make the Quick Links available for offline browsing. | +|Search_Page |`` |The URL to the default search page. | +|UseLocalIns |
  • **0.** Don’t use a local .ins file.
  • **1.** Use a local .ins file.
|Determines whether to use a local Internet Settings (.ins) file | + diff --git a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md index ed8f2be8f1..364daedbbc 100644 --- a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md @@ -1,60 +1,64 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the User Experience page in the IEAK 11 Customization Wizard to decide user interaction with the Setup process. -author: dansimp -ms.prod: ie11 -ms.assetid: d3378058-e4f0-4a11-a888-b550af994bfa -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Use the User Experience page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the User Experience page in the IEAK 11 Wizard -The **User Experience** page of the Internet Explorer Customization Wizard 11 lets you decide how much you want your employees to interact with the custom package’s Setup process. - -**Note**
You’ll only see this page if you are running the **Internal** version of the Internet Explorer Customization Wizard 11.

The customizations you make on this page only apply to Internet Explorer for the desktop on Windows 7. - -**To use the User Experience page** - -1. Choose how your employee should interact with Setup, including: - - - **Interactive installation**. Lets your employees change installation options while installing your custom package. This experience shows all of the progress and error messages throughout the process. - - - **Hands-free installation**. Lets you make all of the decisions for your employees. However, they’ll still see all of the progress and error messages throughout the process. - - - **Completely silent installation**. Lets you make all of the decisions for your employees and hides all of the progress and error messages. Because this mode is completely silent, if the installation fails, your employees won’t know and they won’t be able to run the installation package again. -

Both the hands-free and completely silent installation options will: - - - Answer prompts so Setup can continue. - - - Accept the license agreement. - - - Determine that Internet Explorer 11 is installed and not just downloaded. - - - Perform your specific installation type. - - - Install IE in the default location, unless it is already installed. In that case, the new version of the browser is installed in the same location as the previous version. - -2. Choose if your employee’s device will restart at the end of Setup. - - - **Default**. Prompts your employees to restart after installing IE. - - - **No restart**. Doesn’t restart the computer after installing IE. The employee will have to manually restart later. - - - **Force restart**. Automatically restarts the computer after installing IE. - -3. Click **Next** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page or **Back** to go to the [Internal Install](internal-install-ieak11-wizard.md) page. - - - - - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the User Experience page in the IEAK 11 Customization Wizard to decide user interaction with the Setup process. +author: dansimp +ms.prod: ie11 +ms.assetid: d3378058-e4f0-4a11-a888-b550af994bfa +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the User Experience page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the User Experience page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **User Experience** page of the Internet Explorer Customization Wizard 11 lets you decide how much you want your employees to interact with the custom package’s Setup process. + +**Note**
You’ll only see this page if you are running the **Internal** version of the Internet Explorer Customization Wizard 11.

The customizations you make on this page only apply to Internet Explorer for the desktop on Windows 7. + +**To use the User Experience page** + +1. Choose how your employee should interact with Setup, including: + + - **Interactive installation**. Lets your employees change installation options while installing your custom package. This experience shows all of the progress and error messages throughout the process. + + - **Hands-free installation**. Lets you make all of the decisions for your employees. However, they’ll still see all of the progress and error messages throughout the process. + + - **Completely silent installation**. Lets you make all of the decisions for your employees and hides all of the progress and error messages. Because this mode is completely silent, if the installation fails, your employees won’t know and they won’t be able to run the installation package again. +

Both the hands-free and completely silent installation options will: + + - Answer prompts so Setup can continue. + + - Accept the license agreement. + + - Determine that Internet Explorer 11 is installed and not just downloaded. + + - Perform your specific installation type. + + - Install IE in the default location, unless it is already installed. In that case, the new version of the browser is installed in the same location as the previous version. + +2. Choose if your employee’s device will restart at the end of Setup. + + - **Default**. Prompts your employees to restart after installing IE. + + - **No restart**. Doesn’t restart the computer after installing IE. The employee will have to manually restart later. + + - **Force restart**. Automatically restarts the computer after installing IE. + +3. Click **Next** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page or **Back** to go to the [Internal Install](internal-install-ieak11-wizard.md) page. + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md index 3efd12ffa8..c9bb888bed 100644 --- a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md +++ b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md @@ -1,37 +1,41 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Info about how to use Internet Settings (.ins) files and the IEAK 11 to configure your custom browser package. -author: dansimp -ms.prod: ie11 -ms.assetid: a24a7cdb-681e-4f34-a53c-6d8383c5f977 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Using Internet Settings (.INS) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Using Internet Settings (.INS) files with IEAK 11 -Use the Internet Settings (.ins) files and the Internet Explorer Administration Kit 11 (IEAK 11) to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file. - -Here's a list of the available .INS file settings: - -|Setting |Description | -|-----------------------------------------|------------------------------------------------------------------------------| -|[Branding](branding-ins-file-setting.md) |Customize the branding and setup information in your browser package. | -|[BrowserToolbars](browsertoolbars-ins-file-setting.md) |Customize the appearance of the IE toolbar. | -|[CabSigning](cabsigning-ins-file-setting.md) |Digital signature information for your programs. | -|[ConnectionSettings](connectionsettings-ins-file-setting.md) |Info about the networking connection settings used to install your custom package. | -|[CustomBranding](custombranding-ins-file-setting.md) |URL location to your branding cabinet (.cab) file. | -|[ExtRegInf](extreginf-ins-file-setting.md) |Names of your Setup information (.inf) files and the installation mode for components. | -|[FavoritesEx](favoritesex-ins-file-setting.md) |Add a path to your icon file for **Favorites**, decide whether **Favorites** are available offline, and add URLs to each**Favorites** site. | -|[HideCustom](hidecustom-ins-file-setting.md) |Whether to hide the globally unique identifier (GUID) for each custom component. | -|[ISP_Security](isp-security-ins-file-setting.md) |The root certificate you’re adding to your custom package. | -|[Media](media-ins-file-setting.md) |Types of media in which your custom installation package is available. | -|[Proxy](proxy-ins-file-setting.md) |Whether to use a proxy server. | -|[Security Imports](security-imports-ins-file-setting.md) |Whether to import security information for your custom package. | -|[URL](url-ins-file-setting.md) |Whether to use an auto-configured proxy server. | - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Info about how to use Internet Settings (.ins) files and the IEAK 11 to configure your custom browser package. +author: dansimp +ms.prod: ie11 +ms.assetid: a24a7cdb-681e-4f34-a53c-6d8383c5f977 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Using Internet Settings (.INS) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Using Internet Settings (.INS) files with IEAK 11 + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +Use the Internet Settings (.ins) files and the Internet Explorer Administration Kit 11 (IEAK 11) to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file. + +Here's a list of the available .INS file settings: + +|Setting |Description | +|-----------------------------------------|------------------------------------------------------------------------------| +|[Branding](branding-ins-file-setting.md) |Customize the branding and setup information in your browser package. | +|[BrowserToolbars](browsertoolbars-ins-file-setting.md) |Customize the appearance of the IE toolbar. | +|[CabSigning](cabsigning-ins-file-setting.md) |Digital signature information for your programs. | +|[ConnectionSettings](connectionsettings-ins-file-setting.md) |Info about the networking connection settings used to install your custom package. | +|[CustomBranding](custombranding-ins-file-setting.md) |URL location to your branding cabinet (.cab) file. | +|[ExtRegInf](extreginf-ins-file-setting.md) |Names of your Setup information (.inf) files and the installation mode for components. | +|[FavoritesEx](favoritesex-ins-file-setting.md) |Add a path to your icon file for **Favorites**, decide whether **Favorites** are available offline, and add URLs to each**Favorites** site. | +|[HideCustom](hidecustom-ins-file-setting.md) |Whether to hide the globally unique identifier (GUID) for each custom component. | +|[ISP_Security](isp-security-ins-file-setting.md) |The root certificate you’re adding to your custom package. | +|[Media](media-ins-file-setting.md) |Types of media in which your custom installation package is available. | +|[Proxy](proxy-ins-file-setting.md) |Whether to use a proxy server. | +|[Security Imports](security-imports-ins-file-setting.md) |Whether to import security information for your custom package. | +|[URL](url-ins-file-setting.md) |Whether to use an auto-configured proxy server. | + diff --git a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md index 06b86bce15..d62e11e507 100644 --- a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md +++ b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md @@ -1,68 +1,72 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: support -ms.pagetype: security -description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. -author: dansimp -ms.author: dansimp -ms.manager: elizapo -ms.prod: ie11 -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -title: What IEAK can do for you -ms.sitesec: library -ms.date: 05/10/2018 ---- - -# What IEAK can do for you - -Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. - -IEAK 10 and newer includes the ability to install using one of the following installation modes: - -- Internal - -- External - -## IEAK 11 users -Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. - -IEAK 10 and newer includes the ability to install using one of the following installation modes: -- Internal -- External - -> [!NOTE] -> IEAK 11 works in network environments, with or without Microsoft Active Directory service. - - -### Corporations -IEAK helps corporate administrators establish version control, centrally distribute and manage browser installation, configure automatic connection profiles, and customize large portions of Internet Explorer, including features, security, communications settings, and other important functionality. - -Corporate administrators install IEAK using Internal mode (for Internet Explorer 10 or newer) or Corporate mode (for Internet Explorer 9 or older). - -### Internet service providers -IEAK helps ISPs customize, deploy and distribute, add third-party add-ons, search providers, and custom components, as well as include web slices and accelerators all as part of a custom Internet Explorer installation package. - -ISPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Service Provider (ISP) mode (for Internet Explorer 9 or older). - -### Internet content providers -IEAK helps ICPs customize the appearance of Internet Explorer and its Setup program, including letting you add your company name or specific wording to the Title bar, set up a customer support webpage, set up the user home page and search providers, add links to the Favorites and the Explorer bars, add optional components, web slices and accelerators, and determine which compatibility mode Internet Explorer should use. - -ICPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older) - -### Independent software vendors -IEAK helps ISVs distribute (and redistribute) a custom version of Internet Explorer that can include custom components, programs, and controls (like the web browser control) that you create for your users. ISVs can also determine home pages, search providers, and add websites to the Favorites bar. - -ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older). - -## Additional resources - -- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md) -- [Download IEAK 11](ieak-information-and-downloads.md) -- [IEAK 11 overview](index.md) -- [IEAK 11 administrators guide](https://docs.microsoft.com/internet-explorer/ie11-ieak/index) -- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) -- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md) -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) -- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643) +--- +ms.localizationpriority: medium +ms.mktglfcycl: support +ms.pagetype: security +description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. +author: dansimp +ms.author: dansimp +ms.manager: elizapo +ms.prod: ie11 +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +title: What IEAK can do for you +ms.sitesec: library +ms.date: 05/10/2018 +--- + +# What IEAK can do for you + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + + +Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. + +IEAK 10 and newer includes the ability to install using one of the following installation modes: + +- Internal + +- External + +## IEAK 11 users +Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. + +IEAK 10 and newer includes the ability to install using one of the following installation modes: +- Internal +- External + +> [!NOTE] +> IEAK 11 works in network environments, with or without Microsoft Active Directory service. + + +### Corporations +IEAK helps corporate administrators establish version control, centrally distribute and manage browser installation, configure automatic connection profiles, and customize large portions of Internet Explorer, including features, security, communications settings, and other important functionality. + +Corporate administrators install IEAK using Internal mode (for Internet Explorer 10 or newer) or Corporate mode (for Internet Explorer 9 or older). + +### Internet service providers +IEAK helps ISPs customize, deploy and distribute, add third-party add-ons, search providers, and custom components, as well as include web slices and accelerators all as part of a custom Internet Explorer installation package. + +ISPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Service Provider (ISP) mode (for Internet Explorer 9 or older). + +### Internet content providers +IEAK helps ICPs customize the appearance of Internet Explorer and its Setup program, including letting you add your company name or specific wording to the Title bar, set up a customer support webpage, set up the user home page and search providers, add links to the Favorites and the Explorer bars, add optional components, web slices and accelerators, and determine which compatibility mode Internet Explorer should use. + +ICPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older) + +### Independent software vendors +IEAK helps ISVs distribute (and redistribute) a custom version of Internet Explorer that can include custom components, programs, and controls (like the web browser control) that you create for your users. ISVs can also determine home pages, search providers, and add websites to the Favorites bar. + +ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older). + +## Additional resources + +- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md) +- [Download IEAK 11](ieak-information-and-downloads.md) +- [IEAK 11 overview](index.md) +- [IEAK 11 administrators guide](https://docs.microsoft.com/internet-explorer/ie11-ieak/index) +- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md) +- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md) +- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md) +- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643) diff --git a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md index e81b0eedea..03de7ed423 100644 --- a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md @@ -1,31 +1,35 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Wizard Complete - Next Steps page in the IEAK 11 Customization Wizard to build your custom Internet Explorer install package. -author: dansimp -ms.prod: ie11 -ms.assetid: aaaac88a-2022-4d0b-893c-b2404b45cabc -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard -The **Wizard Complete – Next Steps** page of the Internet Explorer Customization Wizard 11 lets you build your custom installation package, after you click **Finish**. - -In most cases, your next steps will be to prepare your files for installation from your network or from another distribution method. If you haven’t already done it, you’ll need to digitally sign any program or .cab files that are going to be distributed over the Internet or over an intranet that isn’t configured to allow downloads. - -After that, the steps you’ll use to distribute your customized browser will vary, depending on your version of IEAK (Internal or External) and the media you’re using to distribute the package. For more information, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Wizard Complete - Next Steps page in the IEAK 11 Customization Wizard to build your custom Internet Explorer install package. +author: dansimp +ms.prod: ie11 +ms.assetid: aaaac88a-2022-4d0b-893c-b2404b45cabc +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard + +[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)] + +The **Wizard Complete – Next Steps** page of the Internet Explorer Customization Wizard 11 lets you build your custom installation package, after you click **Finish**. + +In most cases, your next steps will be to prepare your files for installation from your network or from another distribution method. If you haven’t already done it, you’ll need to digitally sign any program or .cab files that are going to be distributed over the Internet or over an intranet that isn’t configured to allow downloads. + +After that, the steps you’ll use to distribute your customized browser will vary, depending on your version of IEAK (Internal or External) and the media you’re using to distribute the package. For more information, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md). + +  + +  + + + + + diff --git a/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md b/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md new file mode 100644 index 0000000000..96a04e5f70 --- /dev/null +++ b/browsers/internet-explorer/includes/microsoft-365-ie-end-of-support.md @@ -0,0 +1,13 @@ +--- +author: pamgreen-msft +ms.author: pamgreen +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: pamgreen +ms.prod: ie11 +ms.topic: include +--- + +> [!IMPORTANT] +> Microsoft 365 apps and services will not support Internet Explorer 11 starting August 17, 2021 (Microsoft Teams will not support Internet Explorer 11 earlier, starting November 30, 2020). [Learn more](https://aka.ms/AA97tsw). Please note that Internet Explorer 11 will remain a supported browser. Internet Explorer 11 is a component of the Windows operating system and [follows the Lifecycle Policy](https://docs.microsoft.com/lifecycle/faq/internet-explorer-microsoft-edge) for the product on which it is installed. \ No newline at end of file diff --git a/browsers/internet-explorer/internet-explorer.yml b/browsers/internet-explorer/internet-explorer.yml index 4c11b5c85e..7a2759960e 100644 --- a/browsers/internet-explorer/internet-explorer.yml +++ b/browsers/internet-explorer/internet-explorer.yml @@ -1,69 +1,174 @@ -### YamlMime:YamlDocument +### YamlMime:Landing -documentType: LandingData -title: Internet Explorer 11 +title: Internet Explorer 11 documentation +summary: Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. metadata: - document_id: - title: Internet Explorer 11 - description: Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. - keywords: Internet Explorer 11. IE11 - ms.localizationpriority: medium - author: lizap + title: Internet Explorer 11 documentation + description: Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. + ms.topic: landing-page + author: lizap ms.author: elizapo - manager: dougkim - ms.topic: article - ms.devlang: na + ms.date: 07/06/2020 -sections: -- items: - - type: markdown - text: " - Consistent, reliable web browsing on Windows 7, Windows 8.1, and Windows 10, with the security, performance, backward compatibility, and modern standards support that large organizations need. - " -- title: Explore -- items: - - type: markdown - text: " - Find tools, step-by-step guides, updates, and other resources to help you get started.
- -

**Get started**
Get information om tools, frequently asked questions, requirements, and guidelines.
IE11 features and tools
System requirements and language support
Frequently asked questions
Internet Explorer 11 deployment guide
Use Enterprise Mode to improve compatibility
Lifecycle FAQ - Internet Explorer

**Downloads and tools**
Find tools and resources to help you address compatibility and get up to date.
Download IE11 with Windows 10
Enterprise Mode Site List Manager (schema, v.2)
Web Application Compatibility Lab Kit
Cumulative security updates for Internet Explorer 11

**Find training**
Find online training and hands-on labs for common configuration and management tasks.
Getting started with Windows 10 for IT professionals
Windows 10: Top Features for IT Pros
Manage and modernize Internet Explorer with Enterprise Mode
Virtual Lab: Enterprise Mode
- " -- title: Plan -- items: - - type: markdown - text: " - Find information and tips to help you assess compatibility and prioritize processes as you plan for Internet Explorer 11.
- -

**Get started with compatibility**
Find out how to extend your company's investment in older web apps through higher compatibility with older rendering engines while moving forward to a more modern browser like Internet Explorer 11.
What is Enterprise Mode?
Tips and tricks to manage Internet Explorer compatibility
Download the Enterprise Site Discovery Toolkit
Collect data using Enterprise Site Discovery
Manage Windows upgrades with Upgrade Readiness
Demo: Plan and manage Windows 10 upgrades and feature updates with Upgrade Readiness

**Using Enterprise Mode**
Learn how to avoid the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer by using Enterprise Mode.
Turn on Enterprise Mode and use a site list
Add sites to the Enterprise Mode site list
Edit the Enterprise Mode site list
Turn on local control and logging for Enterprise Mode
- " -- title: Deploy -- items: - - type: markdown - text: " - Find the resources you need to successfully deploy Internet Explorer 11 in your organization.
- -

**Customize Internet Explorer 11**
The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after deployment.
Download IEAK 11
IEAK 11 user's guide
Frequently asked questions about IEAK 11
Customization and distribution guidelines

**Install Internet Explorer 11**
Explore the different options for installation.
Through Automatic Updates (recommended)
As part of an operating system deployment
Over the network
With System Center 2012 R2 Configuration Manager
With Windows Server Update Services (WSUS)
With Microsoft Intune
With third-party tools
- " -- title: Manage -- items: - - type: markdown - text: " - Find everything you need to manage Internet Explorer 11 effectively in your organization. Get information on Group Policy, blocked out-of-date ActiveX controls, scripts, and more.
- -

**Enforce settings with Group Policy**
Learn how to use Group Policy to enforce settings on the computers in your organization.
Group Policy for beginners
New Group Policy settings for IE11
Administrative templates for IE11

**Standardize with Group Policy preferences**
Group Policy preferences simplify deployment and standardize configurations, but unlike Group Policy, they can later be changed by users.
Group Policy preferences for IE11
Configure Group Policy preferences

**Blocked out-of-date ActiveX controls**
Find out more about the out-of-date ActiveX control blocking security feature available in Internet Explorer.
Blocked out-of-date ActiveX controls
Out-of-date ActiveX control blocking
Update to block out-of-date ActiveX controls in Internet Explorer

**Scripts for IT professionals**
Find scripts to help you save time and automate common tasks.
Batch loop: Check is a process running, if yes, wait in loop
Script to join user to AD with automatic Local user Profile Migration
Find-IE Citrix receiver Version
See all scripts
- " -- title: Support -- items: - - type: markdown - text: " - Get help from product specialists and community experts, and find solutions to commonly encountered issues.
- -

**Troubleshoot common issues**
Find solutions to common issues and get tips from Microsoft product teams and community experts.
Change or reset Internet Explorer settings
Troubleshoot custom package and IEAK 11 problems
Troubleshoot problems with setup, installation, auto configuration, and more
Disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone

**Find answers and community support**
Find FAQs or visit the forums to ask a question or find answers.
Lifecycle FAQ - Internet Explorer
Frequently asked questions about IEAK 11
Microsoft Edge FAQ
Internet Explorer 8, 9, 10, 11 forum
Internet Explorer development forums
Windows 8.1 forums
Windows 10: General (includes Microsoft Edge)

**Contact Microsoft for additional help**
Explore the support options that are available from Microsoft.
Contact a Microsoft support professional
Support options for Microsoft Partners
Microsoft Services Premier Support
Microsoft Small Business Support Center
General support
- " -- title: Stay informed -- items: - - type: markdown - text: " - -

**Sign up for the Windows IT Pro Insider**
Get the latest tools, tips, and expert guidance on deployment, management, security, and more.
Learn more

**Microsoft Edge Dev blog**
Keep up with the latest browser trends, security tips, and news for IT professionals.
Read the blog

**Microsoft Edge Dev on Twitter**
Get the latest news and updates from the Microsoft Web Platform team.
Visit Twitter
- " +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card + - title: Explore + linkLists: + - linkListType: get-started + links: + - text: IE11 features and tools + url: /internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11 + - text: System requirements and language support + url: /internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11 + - text: Frequently asked questions + url: /internet-explorer/ie11-faq/faq-for-it-pros-ie11 + - text: Internet Explorer 11 deployment guide + url: /internet-explorer/ie11-deploy-guide/ + - text: Use Enterprise Mode to improve compatibility + url: /microsoft-edge/deploy/emie-to-improve-compatibility + - text: Lifecycle FAQ - Internet Explorer + url: https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer + - linkListType: download + links: + - text: Download IE11 with Windows 10 + url: https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise + - text: Enterprise Mode Site List Manager (schema, v.2) + url: https://www.microsoft.com/download/details.aspx?id=49974 + - text: Cumulative security updates for Internet Explorer 11 + url: https://www.catalog.update.microsoft.com/Search.aspx?q=cumulative%20security%20update%20for%20internet%20explorer%2011 + - linkListType: learn + links: + - text: Getting started with Windows 10 for IT professionals + url: https://mva.microsoft.com/training-courses/getting-started-with-windows-10-for-it-professionals-10629?l=fCowqpy8_5905094681 + - text: 'Windows 10: Top Features for IT Pros' + url: https://mva.microsoft.com/training-courses/windows-10-top-features-for-it-pros-16319?l=xBnT2ihhC_7306218965 + - text: Manage and modernize Internet Explorer with Enterprise Mode + url: https://channel9.msdn.com/events/teched/newzealand/2014/pcit307 + - text: 'Virtual Lab: Enterprise Mode' + url: https://www.microsoft.com/handsonlabs/SelfPacedLabs/?storyGuid=e4155067-2c7e-4b46-8496-eca38bedca02 + + # Card + - title: Plan + linkLists: + - linkListType: get-started + links: + - text: What is Enterprise Mode? + url: /internet-explorer/ie11-deploy-guide/what-is-enterprise-mode + - text: Tips and tricks to manage Internet Explorer compatibility + url: /internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility + - text: Download the Enterprise Site Discovery Toolkit + url: https://www.microsoft.com/download/details.aspx?id=44570 + - text: Collect data using Enterprise Site Discovery + url: /internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery + - text: Manage Windows upgrades with Upgrade Readiness + url: /windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness + - text: 'Demo: Plan and manage Windows 10 upgrades and feature updates with' + url: https://techcommunity.microsoft.com/t5/Microsoft-Ignite-Content-2017/Windows-Analytics-Plan-and-manage-Windows-10-upgrades-and/td-p/98639 + - linkListType: how-to-guide + links: + - text: Turn on Enterprise Mode and use a site list + url: /internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list + - text: Add sites to the Enterprise Mode site list + url: /internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool + - text: Edit the Enterprise Mode site list + url: /internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager + - text: Turn on local control and logging for Enterprise Mode + url: /internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode + + # Card + - title: Deploy + linkLists: + - linkListType: get-started + links: + - text: IEAK 11 user's guide + url: /internet-explorer/ie11-ieak/ + - text: Download IEAK 11 + url: /internet-explorer/ie11-ieak/ieak-information-and-downloads + - text: Frequently asked questions about IEAK 11 + url: /internet-explorer/ie11-faq/faq-ieak11 + - text: Customization and distribution guidelines + url: /internet-explorer/ie11-ieak/licensing-version-and-features-ieak11#customization-guidelines + - linkListType: deploy + links: + - text: Install Internet Explorer 11 through automatic updates (recommended) + url: /internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates + - text: Install Internet Explorer 11 as part of an operating system deployment + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems + - text: Install Internet Explorer 11 over the network + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-the-network + - text: Install Internet Explorer 11 with System Center 2012 R2 Configuration Manager + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager + - text: Install Internet Explorer 11 with Windows Server Update Services (WSUS) + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus + - text: Install Internet Explorer 11 with Microsoft Intune + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune + - text: Install Internet Explorer 11 with third-party tools + url: /internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools + + # Card + - title: Manage + linkLists: + - linkListType: tutorial + links: + - text: Group Policy for beginners + url: /previous-versions/windows/it-pro/windows-7/hh147307(v=ws.10) + - text: New Group Policy settings for IE11 + url: /internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11 + - text: Administrative templates for IE11 + url: https://www.microsoft.com/download/details.aspx?id=40905 + - text: Group Policy preferences for IE11 + url: /internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11 + - text: Configure Group Policy preferences + url: https://support.microsoft.com/help/2898604/how-to-configure-group-policy-preference-settings-for-internet-explorer-11-in-windows-8.1-or-windows-server-2012-r2 + - text: Blocked out-of-date ActiveX controls + url: /internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls + - text: Out-of-date ActiveX control blocking + url: /internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking + - text: Update to block out-of-date ActiveX controls in Internet Explorer + url: https://support.microsoft.com/help/2991000/update-to-block-out-of-date-activex-controls-in-internet-explorer + - text: Script to join user to AD with automatic Local user Profile Migration + url: https://gallery.technet.microsoft.com/scriptcenter/script-to-join-active-7b16d9d3 + - text: Scripts for IT professionals + url: https://gallery.technet.microsoft.com/scriptcenter/site/search?query=Microsoft%20Edge%20or%20Internet + + # Card + - title: Support + linkLists: + - linkListType: get-started + links: + - text: Change or reset Internet Explorer settings + url: https://support.microsoft.com/help/17441/windows-internet-explorer-change-reset-settings + - text: Troubleshoot problems with setup, installation, auto configuration, and more + url: /internet-explorer/ie11-deploy-guide/troubleshoot-ie11 + - text: Disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone + url: https://support.microsoft.com/help/4012494/option-to-disable-vbscript-execution-in-internet-explorer-for-internet + - text: Frequently asked questions about IEAK 11 + url: /internet-explorer/ie11-faq/faq-ieak11 + - text: Internet Explorer 8, 9, 10, 11 forum + url: https://social.technet.microsoft.com/forums/ie/home?forum=ieitprocurrentver + - text: Contact a Microsoft support professional + url: https://support.microsoft.com/contactus + - text: Support options for Microsoft Partners + url: https://mspartner.microsoft.com/Pages/Support/get-support.aspx + - text: Microsoft Services Premier Support + url: https://www.microsoft.com/en-us/microsoftservices/support.aspx + - text: Microsoft Small Business Support Center + url: https://smallbusiness.support.microsoft.com/product/internet-explorer + - text: General support + url: https://support.microsoft.com/products/internet-explorer + + # Card + - title: Stay informed + linkLists: + - linkListType: get-started + links: + - text: Sign up for the Windows IT Pro Insider + url: https://aka.ms/windows-it-pro-insider + - text: Microsoft Edge Dev blog + url: https://blogs.windows.com/msedgedev + - text: Microsoft Edge Dev on Twitter + url: https://twitter.com/MSEdgeDev diff --git a/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md b/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md deleted file mode 100644 index 7adcb24c17..0000000000 --- a/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Clear the Internet Explorer cache from a command line -description: Introduces command-line commands and a sample batch file for clearing the IE cache. -audience: ITPro -manager: msmets -author: ramakoni1 -ms.author: ramakoni -ms.reviewer: ramakoni, DEV_Triage -ms.prod: internet-explorer -ms.technology: -ms.topic: kb-support -ms.custom: CI=111026 -ms.localizationpriority: Normal -# localization_priority: medium -# ms.translationtype: MT -ms.date: 01/23/2020 ---- -# How to clear Internet Explorer cache by using the command line - -This article outlines the procedure to clear the Internet Explorer cache by using the command line. - -## Command line commands to clear browser cache - -1. Delete history from the Low folder - `del /s /q C:\Users\\%username%\AppData\Local\Microsoft\Windows\History\low\* /ah` - -2. Delete history - `RunDll32.exe InetCpl.cpl, ClearMyTracksByProcess 1` - -3. Delete cookies - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2` - -4. Delete temporary internet files - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8` - -5. Delete form data - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16` - -6. Delete stored passwords - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32` - -7. Delete all - `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255` - -8. Delete files and settings stored by add-ons - `InetCpl.cpl,ClearMyTracksByProcess 4351` - -If you upgraded from a previous version of Internet Explorer, you have to use the following commands to delete the files from older versions: -`RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 9` - -Command to reset Internet Explorer settings: -`Rundll32.exe inetcpl.cpl ResetIEtoDefaults` - -## Sample batch file to clear Internet Explorer cache files - -A sample batch file is available that you can use to clear Internet Explorer cache files and other items. You can download the file from [https://msdnshared.blob.core.windows.net/media/2017/09/ClearIE_Cache.zip](https://msdnshared.blob.core.windows.net/media/2017/09/ClearIE_Cache.zip). - -The batch file offers the following options: - -- Delete Non-trusted web History (low-level hidden cleanup) -- Delete History -- Delete Cookies -- Delete Temporary Internet Files -- Delete Form Data -- Delete Stored Passwords -- Delete All -- Delete All "Also delete files and settings stored by add-ons" -- Delete IE10 and IE9 Temporary Internet Files -- Resets IE Settings -- EXIT - -**Contents of the batch file** - -```dos -@echo off -# This sample script is not supported under any Microsoft standard support program or service. -# The sample script is provided AS IS without warranty of any kind. Microsoft further disclaims -# all implied warranties including, without limitation, any implied warranties of merchantability -# or of fitness for a particular purpose. The entire risk arising out of the use or performance of -# the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, -# or anyone else involved in the creation, production, or delivery of the scripts be liable for any -# damages whatsoever (including, without limitation, damages for loss of business profits, business -# interruption, loss of business information, or other pecuniary loss) arising out of the use of or -# inability to use the sample scripts or documentation, even if Microsoft has been advised of the -# possibility of such damages - -:home -cls -COLOR 00 -echo Delete IE History -echo Please select the task you wish to run. -echo Pick one: -echo. -echo 1. Delete History -echo 2. Delete Cookies -echo 3. Delete Temporary Internet Files -echo 4. Delete Form Data -echo 5. Delete Stored Passwords -echo 6. Delete All -echo 7. Delete All "Also delete files and settings stored by add-ons" -echo 8. Delete IE10 and 9 Temporary Internet Files -echo 9. Reset IE Settings -echo 00. EXIT -:choice -Echo Hit a number [1-10] and press enter. -set /P CH=[1-10] - -if "%CH%"=="1" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1 -if "%CH%"=="2" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2 -if "%CH%"=="3" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8 -if "%CH%"=="4" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16 -if "%CH%"=="5" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32 -if "%CH%"=="6" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255 -if "%CH%"=="7" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351 -if "%CH%"=="8" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 9 -if "%CH%"=="9" set x=rundll32.exe inetcpl.cpl ResetIEtoDefaults -if "%CH%"=="00" goto quit - -%x% - -goto Home -:quit -``` diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.md b/browsers/internet-explorer/kb-support/ie-edge-faqs.md index ef07a2a337..5c29be5126 100644 --- a/browsers/internet-explorer/kb-support/ie-edge-faqs.md +++ b/browsers/internet-explorer/kb-support/ie-edge-faqs.md @@ -1,6 +1,6 @@ --- title: IE and Microsoft Edge FAQ for IT Pros -description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals. +description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals. audience: ITPro manager: msmets author: ramakoni1 @@ -10,9 +10,7 @@ ms.prod: internet-explorer ms.technology: ms.topic: kb-support ms.custom: CI=111020 -ms.localizationpriority: Normal -# localization_priority: medium -# ms.translationtype: MT +ms.localizationpriority: medium ms.date: 01/23/2020 --- # Internet Explorer and Microsoft Edge frequently asked questions (FAQ) for IT Pros diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md deleted file mode 100644 index 330bc3286e..0000000000 --- a/devices/hololens/TOC.md +++ /dev/null @@ -1,75 +0,0 @@ -# [Microsoft HoloLens](index.md) - -# Get started with HoloLens 2 -## [HoloLens 2 hardware](hololens2-hardware.md) -## [Get your HoloLens 2 ready to use](hololens2-setup.md) -## [Set up your HoloLens 2](hololens2-start.md) -## [HoloLens 2 fit and comfort FAQ](hololens2-fit-comfort-faq.md) -## [Frequently asked questions about cleaning HoloLens 2 devices](hololens2-maintenance.md) -## [Supported languages for HoloLens 2](hololens2-language-support.md) -## [Getting around HoloLens 2](hololens2-basic-usage.md) - -# Get started with HoloLens (1st gen) -## [HoloLens (1st gen) hardware](hololens1-hardware.md) -## [Get your HoloLens (1st gen) ready to use](hololens1-setup.md) -## [Set up your HoloLens (1st gen)](hololens1-start.md) -## [HoloLens (1st gen) fit and comfort FAQ](hololens1-fit-comfort-faq.md) -## [Install localized version of HoloLens (1st gen)](hololens1-install-localized.md) -## [Getting around HoloLens (1st gen)](hololens1-basic-usage.md) - -# Deploy HoloLens and mixed-reality apps in commercial environments -## [Commercial features](hololens-commercial-features.md) -## [Deploy HoloLens in a commercial environment](hololens-requirements.md) -## [Determine what licenses you need](hololens-licenses-requirements.md) -## [Configure your network for HoloLens](hololens-commercial-infrastructure.md) -## [Unlock Windows Holographic for Business features](hololens1-upgrade-enterprise.md) -## [Use a provisioning package to configure HoloLens](hololens-provisioning.md) -## [Enroll HoloLens in MDM](hololens-enroll-mdm.md) -## [Manage HoloLens updates](hololens-updates.md) -## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) - -# Navigating Windows Holographic -## [Start menu and mixed reality home](holographic-home.md) -## [Use your voice with HoloLens](hololens-cortana.md) -## [Find, open, and save files](holographic-data.md) -## [Create mixed reality photos and videos](holographic-photos-and-videos.md) - -# User management and access management -## [Manage user identity and sign-in for HoloLens](hololens-identity.md) -## [Share your HoloLens with multiple people](hololens-multiple-users.md) -## [Set up HoloLens as a kiosk for specific applications](hololens-kiosk.md) - -# Holographic applications -## [Use 3D Viewer on HoloLens](holographic-3d-viewer-beta.md) -## [Find, install, and uninstall applications](holographic-store-apps.md) -## [Manage custom apps for HoloLens](holographic-custom-apps.md) - -# Accessories and connectivity -## [Connect to Bluetooth and USB-C devices](hololens-connect-devices.md) -## [Use the HoloLens (1st gen) clicker](hololens1-clicker.md) -## [Connect to a network](hololens-network.md) -## [Manage connection endpoints for HoloLens](hololens-offline.md) - -# Hologram optics and placement in space -## [Improve visual quality and comfort](hololens-calibration.md) -## [Environment considerations for HoloLens](hololens-environment-considerations.md) -## [Map physical spaces with HoloLens](hololens-spaces.md) - -# Update, troubleshoot, or recover HoloLens -## [Update HoloLens](hololens-update-hololens.md) -## [Restart, reset, or recover HoloLens](hololens-recovery.md) -## [Troubleshoot HoloLens issues](hololens-troubleshooting.md) -## [Collect diagnostic information from HoloLens devices](hololens-diagnostic-logs.md) -## [Known issues for HoloLens](hololens-known-issues.md) -## [Frequently asked questions](hololens-faq.md) -## [Frequently asked security questions](hololens-faq-security.md) -## [Status of the HoloLens services](hololens-status.md) -## [Get support](https://support.microsoft.com/supportforbusiness/productselection?sapid=3ec35c62-022f-466b-3a1e-dbbb7b9a55fb) - -# Resources -## [Windows Autopilot for HoloLens 2 evaluation guide](hololens2-autopilot.md) - -# [HoloLens release notes](hololens-release-notes.md) -# [Give us feedback](hololens-feedback.md) -# [Insider preview for Microsoft HoloLens](hololens-insider.md) -# [Change history for Microsoft HoloLens documentation](change-history-hololens.md) diff --git a/devices/hololens/breadcrumb/toc.yml b/devices/hololens/breadcrumb/toc.yml deleted file mode 100644 index 2ac60b3585..0000000000 --- a/devices/hololens/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Hololens - tocHref: /hololens - topicHref: /hololens/index \ No newline at end of file diff --git a/devices/hololens/change-history-hololens.md b/devices/hololens/change-history-hololens.md deleted file mode 100644 index 9a1b48b3eb..0000000000 --- a/devices/hololens/change-history-hololens.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Change history for Microsoft HoloLens documentation -ms.reviewer: -manager: laurawi -description: This topic lists new and updated topics for HoloLens. -keywords: change history -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Change history for Microsoft HoloLens documentation - -This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md). - -## April 2019 - -New or changed topic | Description ---- | --- -[Restore HoloLens 2 using Advanced Recovery Companion](hololens-recovery.md) | New - -## November 2018 - -New or changed topic | Description ---- | --- -[How HoloLens stores data for spaces](hololens-spaces.md) | New - -## Windows 10 Holographic for Business, version 1809 - -The topics in this library have been updated for Windows 10 Holographic for Business, version 1809. - - -## October 2018 - -New or changed topic | Description ---- | --- -[Preview new mixed reality apps for HoloLens](hololens-public-preview-apps.md) | Removed, and redirected to [Mixed reality apps](https://docs.microsoft.com/dynamics365/#pivot=mixed-reality-apps) -[Microsoft Remote Assist app](hololens-microsoft-remote-assist-app.md) | Removed, and redirected to [Overview of Dynamics 365 Remote Assist](https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/) -[Microsoft Dynamics 365 Layout app](hololens-microsoft-dynamics-365-layout-app.md) | Removed, and redirected to [Overview of Dynamics 365 Layout](https://docs.microsoft.com/dynamics365/mixed-reality/layout/) -[Insider preview for Microsoft HoloLens](hololens-insider.md) | Added instructions for opting out of Insider builds. - - -## July 2018 - -New or changed topic | Description ---- | --- -Insider preview for Microsoft HoloLens | New (topic retired on release of Windows 10, version 1809) - - -## May 2018 - -New or changed topic | Description ---- | --- -[Preview new mixed reality apps for HoloLens](hololens-public-preview-apps.md) | New -[Microsoft Remote Assist app](hololens-microsoft-remote-assist-app.md) | New -[Microsoft Layout app](hololens-microsoft-layout-app.md) | New -[Set up HoloLens in kiosk mode](hololens-kiosk.md) | Added instructions for setting up a guest account for kiosk mode. - -## Windows 10 Holographic for Business, version 1803 - -The topics in this library have been updated for Windows 10 Holographic for Business, version 1803. The following new topics have been added: - -- [What's new in Microsoft HoloLens](hololens-whats-new.md) -- [Manage updates to HoloLens](hololens-updates.md) -- [Share HoloLens with multiple people](hololens-multiple-users.md) - - -## February 2018 - -New or changed topic | Description ---- | --- -[Unlock Windows Holographic for Business features](hololens1-upgrade-enterprise.md) | Replaced the instructions for upgrading to Windows Holographic for Business using Microsoft Intune with a link to the new Intune topic. - -## December 2017 - -New or changed topic | Description ---- | --- -[Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | New - -## January 2017 - -| New or changed topic | Description | -| --- | --- | -| All topics | Changed all references from **Windows Holographic Enterprise** to **Windows Holographic for Business** | diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index 4f53494c32..6d55b1a859 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -45,12 +45,19 @@ "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, - "template": [ - null - ], + "template": [], "dest": "devices/hololens", "markdownEngineName": "markdig" }, diff --git a/devices/hololens/holographic-3d-viewer-beta.md b/devices/hololens/holographic-3d-viewer-beta.md deleted file mode 100644 index 90c5b236fd..0000000000 --- a/devices/hololens/holographic-3d-viewer-beta.md +++ /dev/null @@ -1,205 +0,0 @@ ---- -title: Using 3D Viewer Beta on HoloLens -description: Describes the types of files and features that 3D Viewer Beta on HoloLens (1st gen) supports, and how to use and troubleshoot the app. -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -ms.localizationpriority: high -ms.date: 10/30/2019 -ms.reviewer: scooley -audience: ITPro -manager: jarrettr -appliesto: -- HoloLens (1st gen) ---- - -# Using 3D Viewer Beta on HoloLens - -3D Viewer Beta lets you view 3D models on HoloLens (1st gen). You can open and view *supported* .fbx files from Microsoft Edge, OneDrive, and other apps. - ->[!NOTE] ->This article applies to the immersive Unity **3D Viewer Beta** app, which supports .fbx files and is only available on HoloLens (1st gen). The pre-installed **3D Viewer** app on HoloLens 2 supports opening custom .glb 3D models in the mixed reality home (see [Asset requirements overview](https://docs.microsoft.com/windows/mixed-reality/creating-3d-models-for-use-in-the-windows-mixed-reality-home#asset-requirements-overview) for more details. - -If you're having trouble opening a 3D model in 3D Viewer Beta, or certain features of your 3D model are unsupported, see [Supported content specifications](#supported-content-specifications). - -To build or optimize 3D models for use with 3D Viewer Beta, see [Optimizing 3D models for 3D Viewer Beta](#optimizing-3d-models-for-3d-viewer-beta). - -There are two ways to open a 3D model on HoloLens. See [Viewing FBX files on HoloLens](#viewing-fbx-files-on-hololens) to learn more. - -If you're having trouble after reading these topics, see [Troubleshooting](#troubleshooting). - -## Supported content specifications - -### File format - -- FBX format -- Maximum FBX release 2015.1.0 - -### File size - -- Minimum 5 KB -- Maximum 500 MB - -### Geometry - -- Polygonal models only. No subdivision surfaces or NURBs -- Right-handed coordinate system -- Shear in transformation matrices is not supported - -### Textures - -- Texture maps must be embedded in the FBX file -- Supported image formats - - JPEG and PNG images - - BMP images (24-bit RGB true-color) - - TGA images (24-bit RGB and 32-bit RGBQ true-color) -- Maximum texture resolution of 2048x2048 -- Maximum of one diffuse map, one normal map, and one reflection cube map per mesh -- Alpha channel in diffuse textures causes pixels to be discarded if below 50% - -### Animation - -- Scale/rotation/translation animation on individual objects -- Skeletal (rigged) animation with skinning - - Maximum of 4 influences per vertex - -### Materials - -- Lambert and Phong materials are supported, with adjustable parameters -- Supported material properties for Lambert - - Main Texture (RGB + Alpha Test) - - Diffuse Color (RGB) - - Ambient Color (RGB) -- Supported material properties for Phong - - Main Texture (RGB + Alpha Test) - - Diffuse Color (RGB) - - Ambient Color (RGB) - - Specular Color (RGB) - - Shininess - - Reflectivity -- Custom materials are not supported -- Maximum of one material per mesh -- Maximum of one material layer -- Maximum of 8 materials per file - -### File and model limitations - -There are hard limits on the size of files, as well as the number of models, vertices, and meshes that can be open simultaneously in 3D Viewer Beta: - -- 500 MB maximum file size per model -- Vertices: 600,000 combined on all open models -- Meshes: 1,600 combined on all open models -- Maximum of 40 models open at one time - -## Optimizing 3D models for 3D Viewer Beta - -### Special considerations - -- Avoid black materials or black areas in texture maps. Holograms are made of light, thus HoloLens renders black (the absence of light) as transparent. -- Before exporting to FBX from your creation tool, ensure all geometry is visible and unlocked and no layers that contain geometry are turned off or templated. Visibility is not respected. -- Avoid very large translation offsets between nodes (for example, 100,000 units). This can cause the model to jitter while being moved/scaled/rotated. - -### Performance optimization - -Keep performance in mind while authoring content and validate in the 3D Viewer Beta app on HoloLens during the authoring process for best results. 3D Viewer Beta renders content real-time and performance is subject to HoloLens hardware capabilities. - -There are many variables in a 3D model that can impact performance. 3D Viewer Beta will show a warning on load if there are more than 150,000 vertices or more than 400 meshes. Animations can have an impact on the performance of other open models. There are also hard limits on the total number models, vertices, and meshes that can be open simultaneously in 3D Viewer Beta (see [File and model limitations](#file-and-model-limitations)). - -If the 3D model isn't running well due to model complexity, consider: - -- Reducing polygon count -- Reducing number of bones in rigged animation -- Avoiding self-occlusion - -Double-sided rendering is supported in 3D Viewer Beta, although it is turned off by default for performance reasons. This can be turned on via the **Double Sided** button on the **Details** page. For best performance, avoid the need for double-sided rendering in your content. - -### Validating your 3D model - -Validate your model by opening it in 3D Viewer Beta on HoloLens. Select the **Details** button to view your model's characteristics and warnings of unsupported content (if present). - -### Rendering 3D models with true-to-life dimensions - -By default, 3D Viewer Beta displays 3D models at a comfortable size and position relative to the user. However, if rendering a 3D model with true-to-life measurements is important (for example, when evaluating furniture models in a room), the content creator can set a flag within the file's metadata to prevent resizing of that model by both the application and the user. - -To prevent scaling of the model, add a Boolean custom attribute to any object in the scene named Microsoft_DisableScale and set it to true. 3D Viewer Beta will then respect the FbxSystemUnit information baked into the FBX file. Scale in 3D Viewer Beta is 1 meter per FBX unit. - -## Viewing FBX files on HoloLens - -### Open an FBX file from Microsoft Edge - -FBX files can be opened directly from a website using Microsoft Edge on HoloLens. - -1. In Microsoft Edge, navigate to the webpage containing the FBX file you want to view. -1. Select the file to download it. -1. When the download is complete, select the **Open** button in Microsoft Edge to open the file in 3D Viewer Beta. - -The downloaded file can be accessed and opened again later by using Downloads in Microsoft Edge. To save a 3D model and ensure continued access, download the file on your PC and save it to your OneDrive account. The file can then be opened from the OneDrive app on HoloLens. - -> [!NOTE] -> Some websites with downloadable FBX models provide them in compressed ZIP format. 3D Viewer Beta cannot open ZIP files directly. Instead, use your PC to extract the FBX file and save it to your OneDrive account. The file can then be opened from the OneDrive app on HoloLens. - -### Open an FBX file from OneDrive - -FBX files can be opened from OneDrive by using the OneDrive app on HoloLens. Be sure you've installed OneDrive using Microsoft Store app on HoloLens and that you've already uploaded the FBX file to OneDrive on your PC. - -Once in OneDrive, FBX files can be opened on HoloLens using 3D Viewer Beta in one of two ways: - -- Launch OneDrive on HoloLens and select the FBX file to open it in 3D Viewer Beta. -- Launch 3D Viewer Beta, air tap to show the toolbar, and select **Open File**. OneDrive will launch, allowing you to select an FBX file. - -## Troubleshooting - -### I see a warning when I open a 3D model - -You will see a warning if you attempt to open a 3D model that contains features that are not supported by 3D Viewer Beta, or if the model is too complex and performance may be affected. 3D Viewer Beta will still load the 3D model, but performance or visual fidelity may be compromised. - -For more info, see [Supported content specifications](#supported-content-specifications) and [Optimizing 3D models for 3D Viewer Beta](#optimizing-3d-models-for-3d-viewer-beta). - -### I see a warning and the 3D model doesn't load - -You will see an error message when 3D Viewer Beta cannot load a 3D model due to complexity or file size, or if the FBX file is corrupt or invalid. You will also see an error message if you have reached the limit on the total number of models, vertices, or meshes that can be open simultaneously. - -For more info, see [Supported content specifications](#supported-content-specifications) and [File and model limitations](#file-and-model-limitations). - -If you feel your model meets the supported content specifications and has not exceeded the file or model limitations, you may send your FBX file to the 3D Viewer Beta team at holoapps@microsoft.com. We are not able to respond personally, but having examples of files that do not load properly will help our team improve on future versions of the app. - -### My 3D model loads, but does not appear as expected - -If your 3D model does not look as expected in 3D Viewer Beta, air tap to show the toolbar, then select **Details**. Aspects of the file which are not supported by 3D Viewer Beta will be highlighted as warnings. - -The most common issue you might see is missing textures, likely because they are not embedded in the FBX file. In this case, the model will appear white. This issue can be addressed in the creation process by exporting from your creation tool to FBX with the embed textures option selected. - -For more info, see [Supported content specifications](#supported-content-specifications) and [Optimizing 3D models for 3D Viewer Beta](#optimizing-3d-models-for-3d-viewer-beta). - -### I experience performance drops while viewing my 3D model - -Performance when loading and viewing a 3D model can be affected by the complexity of the model, number of models open simultaneously, or number of models with active animations. - -For more info, see [Optimizing 3D models for 3D Viewer Beta](#optimizing-3d-models-for-3d-viewer-beta) and [File and model limitations](#file-and-model-limitations). - -### When I open an FBX file on HoloLens, it doesn't open in 3D Viewer Beta - -3D Viewer Beta is automatically associated with the .fbx file extension when it is installed. - -If you try to open an FBX file and see a dialog box that directs you to Microsoft Store, you do not currently have an app associated with the .fbx file extension on HoloLens. - -Verify that 3D Viewer Beta is installed. If it is not installed, download it from Microsoft Store on HoloLens. - -If 3D Viewer Beta is already installed, launch 3D Viewer Beta, then try opening the file again. If the issue persists, uninstall and reinstall 3D Viewer Beta. This will re-associate the .fbx file extension with 3D Viewer Beta. - -If attempting to open an FBX file opens an app other than 3D Viewer Beta, that app was likely installed after 3D Viewer Beta and has taken over association with the .fbx file extension. If you prefer 3D Viewer Beta to be associated with the .fbx file extension, uninstall and reinstall 3D Viewer Beta. - -### The Open File button in 3D Viewer Beta doesn't launch an app - -The **Open File** button will open the app associated with the file picker function on HoloLens. If OneDrive is installed, the **Open File** button should launch OneDrive. However, if there is currently no app associated with the file picker function installed on HoloLens, you will be directed to Microsoft Store. - -If the **Open File** button launches an app other than OneDrive, that app was likely installed after OneDrive and has taken over association with the file picker function. If you prefer OneDrive to launch when selecting the **Open File** button in 3D Viewer Beta, uninstall and reinstall OneDrive. - -If the **Open File** button is not active, it's possible that you have reached the limit of models that can be open in 3D Viewer Beta at one time. If you have 40 models open in 3D Viewer Beta, you will need to close some before you will be able to open additional models. - -## Additional resources - -- [Support forums](http://forums.hololens.com/categories/3d-viewer-beta) -- [Third-party notices](https://www.microsoft.com/{lang-locale}/legal/products) diff --git a/devices/hololens/holographic-custom-apps.md b/devices/hololens/holographic-custom-apps.md deleted file mode 100644 index 3cc01691d6..0000000000 --- a/devices/hololens/holographic-custom-apps.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Manage custom apps for HoloLens -description: Side load custom apps on HoloLens. Learn more about installing, and uninstalling holographic apps. -ms.assetid: 6bd124c4-731c-4bcc-86c7-23f9b67ff616 -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens, sideload, side load, side-load, store, uwp, app, install -ms.prod: hololens -ms.sitesec: library -author: mattzmsft -ms.author: mazeller -ms.topic: article -ms.localizationpriority: medium -ms.custom: -- CI 111456 -- CSSTroubleshooting -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Manage custom apps for HoloLens - -HoloLens supports many existing applications from the Microsoft Store, as well as new apps built specifically for HoloLens. This article focuses on custom holographic applications. - -For more information about store apps, see [Manage apps with the store](holographic-store-apps.md). - -## Install custom apps - -You can install your own applications on HoloLens either by using the Device Portal or by deploying the apps from Visual Studio. - -### Installing an application package with the Device Portal - -1. Establish a connection from [Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal) to the target HoloLens. -1. In the left navigation, navigate to the **Apps** page . -1. Under **App Package** browse to the .appx file that is associated with your application. - > [!IMPORTANT] - > Make sure to reference any associated dependency and certificate files. - -1. Select **Go**. - ![Install app form in Windows Device Portal on Microsoft HoloLens](images/deviceportal-appmanager.jpg) - -### Deploying from Microsoft Visual Studio 2015 - -1. Open your app's Visual Studio solution (.sln file). -1. Open the project's **Properties**. -1. Select the following build configuration: **Master/x86/Remote Machine**. -1. When you select **Remote Machine**: - - Make sure the address points to the Wi-Fi IP address of your HoloLens. - - Set authentication to **Universal (Unencrypted Protocol)**. -1. Build your solution. -1. To deploy the app from your development PC to your HoloLens, select **Remote Machine**. If you already have an existing build on the HoloLens, select **Yes** to install this newer version. - - ![Remote Machine deployment for apps to Microsoft HoloLens in Visual Studio](images/vs2015-remotedeployment.jpg) -1. The application will install and auto launch on your HoloLens. - -After you've installed an app, you'll find it in the **All apps** list​ (**Start** > **All apps**). diff --git a/devices/hololens/holographic-data.md b/devices/hololens/holographic-data.md deleted file mode 100644 index 1f28c4fac9..0000000000 --- a/devices/hololens/holographic-data.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: Find and save files on HoloLens -description: Use File Explorer on HoloLens to view and manage files on your device -keywords: how-to, file picker, files, photos, videos, pictures, OneDrive, storage, file explorer -ms.assetid: 77d2e357-f65f-43c8-b62f-6cd9bf37070a -author: mattzmsft -ms.author: mazeller -manager: v-miegge -ms.reviewer: jarrettrenshaw -ms.date: 12/30/2019 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -ms.topic: article -audience: ITPro -ms.localizationpriority: medium -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Find, open, and save files on HoloLens - -Files you create on HoloLens, including photos and videos, are saved directly to your HoloLens device. View and manage them in the same way you would manage files on Windows 10: - -- Using the File Explorer app to access local folders. -- Within an app's storage. -- In a special folder (such as the video or music library). -- Using a storage service that includes an app and file picker (such as OneDrive). -- Using a desktop PC connected to your HoloLens by using a USB cable, using MTP (Media Transfer Protocol) support. - -## View files on HoloLens using File Explorer - -> Applies to all HoloLens 2 devices and HoloLens (1st gen) as of the [Windows 10 April 2018 Update (RS4) for HoloLens](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018). - -Use File Explorer on HoloLens to view and manage files on your device, including 3D objects, documents, and pictures. Go to **Start** > **All apps** > **File Explorer** to get started. - -> [!TIP] -> If there are no files listed in File Explorer, select **This Device** in the top left pane. - -If you don’t see any files in File Explorer, the "Recent" filter may be active (clock icon is highlighted in left pane). To fix this, select the **This Device** document icon in the left pane (beneath the clock icon), or open the menu and select **This Device**. - -## Find and view your photos and videos - -[Mixed reality capture](holographic-photos-and-videos.md) lets you take mixed reality photos and videos on HoloLens. These photos and videos are saved to the device's Camera Roll folder. - -You can access photos and videos taken with HoloLens by: - -- accessing the Camera Roll directly through the [Photos app](holographic-photos-and-videos.md). -- uploading photos and videos to cloud storage by syncing your photos and videos to OneDrive. -- using the Mixed Reality Capture page of the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#mixed-reality-capture). - -### Photos app - -The Photos app is one of the default apps on the **Start** menu, and comes built-in with HoloLens. Learn more about [using the Photos app to view content](holographic-photos-and-videos.md). - -You can also install the [OneDrive app](https://www.microsoft.com/p/onedrive/9wzdncrfj1p3) from the Microsoft Store to sync photos to other devices. - -### OneDrive app - -[OneDrive](https://onedrive.live.com/) lets you access, manage, and share your photos and videos with any device and with any user. To access the photos and videos captured on HoloLens, download the [OneDrive app](https://www.microsoft.com/p/onedrive/9wzdncrfj1p3) from the Microsoft Store on your HoloLens. Once downloaded, open the OneDrive app and select **Settings** > **Camera upload**, and turn on **Camera upload**. - -### Connect to a PC - -If your HoloLens is running the [Windows 10 April 2018 update](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018) or later, you can connect your HoloLens to a Windows 10 PC by using a USB cable to browse photos and videos on the device by using MTP (media transfer protocol). You'll need to make sure the device is unlocked to browse files if you have a PIN or password set up on your device. - -If you have enabled the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal), you can use it to browse, retrieve, and manage the photos and videos stored on your device. - -## Access files within an app - -If an application saves files on your device, you can use that application to access them. - -### Requesting files from another app - -An application can request to save a file or open a file from another app by using [file pickers](https://docs.microsoft.com/windows/mixed-reality/app-model#file-pickers). - -### Known folders - -HoloLens supports a number of [known folders](https://docs.microsoft.com/windows/mixed-reality/app-model#known-folders) that apps can request permission to access. - -## View HoloLens files on your PC - -Similar to other mobile devices, connect HoloLens to your desktop PC using MTP (Media Transfer Protocol) and open File Explorer on the PC to access your HoloLens libraries for easy transfer. - -To see your HoloLens files in File Explorer on your PC: - -1. Sign in to HoloLens, then plug it into the PC using the USB cable that came with the HoloLens. - -1. Select **Open Device to view files with File Explorer**, or open File Explorer on the PC and navigate to the device. - -To see info about your HoloLens, right-click the device name in File Explorer on your PC, then select **Properties**. - -> [!NOTE] -> HoloLens (1st gen) does not support connecting to external hard drives or SD cards. - -## Sync to the cloud - -To sync photos and other files from your HoloLens to the cloud, install and set up OneDrive on HoloLens. To get OneDrive, search for it in the Microsoft Store on your HoloLens. - -HoloLens doesn't back up app files and data, so it's a good idea to save your important stuff to OneDrive. That way, if you reset your device or uninstall an app, your info will be backed up. diff --git a/devices/hololens/holographic-home.md b/devices/hololens/holographic-home.md deleted file mode 100644 index 9b554c0638..0000000000 --- a/devices/hololens/holographic-home.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: Start menu and mixed reality home -description: Navigate the mixed reality home in Windows Holographic. -ms.assetid: 742bc126-7996-4f3a-abb2-cf345dff730c -ms.date: 08/07/2019 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Start menu and mixed reality home - -Just like the Windows PC experience starts with the desktop, Windows Holographic starts with mixed reality home. Using the Start menu you can open and place app windows, immersive app launchers, and 3D content in mixed reality home, and their placement in your physical space will be remembered. - -## Use the Start menu - -The Start menu on HoloLens is where you'll open apps, see important status info, and access tools like the camera. - -Wherever you are in HoloLens, you can always open the Start menu by using **Start gesture**. On HoloLens (1st gen) the Start gesture is [bloom](https://support.microsoft.com/help/12644/hololens-use-gestures). On HoloLens 2, the [Start gesture](hololens2-basic-usage.md#start-gesture) is to tap the Start icon that appears on your wrist. You can also open the Start menu using your voice by saying "Go to Start". - -> [!TIP] -> When the Start menu is open, use the Start gesture to close it, or look at the Start menu and say "Close". - -At the top of the Start menu, you'll see status indicators for Wi-Fi, battery, volume, and a clock. On HoloLens 2 there is also a listening indicator that shows whether the device is speech enabled and is listening for voice commands. At the bottom you'll find the **Photo** and **Video** buttons which allow you to take photos and video recordings. There is also a **Connect** button that allows you to project what you see to another device using Miracast. - -### Find apps on Start menu - -The Start menu has a **Pinned apps** list and an **All apps** list. - -- The **Pinned apps** list shows apps that have been pinned. You can add and remove apps from the **Pinned apps** list using the context menu that appears when you **select and hold** on an app tile. - -- The **All apps** list shows all apps that are installed on the device. Select the **All apps** button on the right side of the **Start** menu to get to the list. - -On both app lists, use the **Page up** and **Page down** buttons on the right side of the Start menu to page through all the apps in the list. Both app lists will automatically open to the page that was last used during a device session. - -> [!TIP] -> On HoloLens 2, you can directly scroll the app lists using your index finger. Just touch the list with your finger tip and drag upwards or downwards. - -### Open apps from Start menu - -To open an app from the Start menu, simply **select** an **app tile**. You can also say the name of an app to open it. - -When you open an app from the Start menu, one of the following will happen, depending on how the app is designed: - -- An **app window** is placed. The app is then loaded in the window and you can use it like a touch screen. -- A **3D app launcher** for an immersive app is placed. You need to then **select** the launcher to open the immersive app. -- An app window is placed which acts as a **launcher** for an immersive app. The immersive app will proceed to launch automatically. - -App windows and app launchers placed in mixed reality home will stay around until you decide to remove them. They give you a convenient shortcut in the world to use those app windows or to launch immersive apps without having to open them again from the Start menu. - -> [!NOTE] ->Like on a phone, system resources is managed automatically on HoloLens. For example, when you open a new immersive app, all other running apps will immediately become inactive. There is no need to remove app windows and launchers in mixed reality home to free up system resources. - -## Using apps on HoloLens - -Apps on HoloLens can use app window view or immersive view. With app window view the app simply shows its content inside a window. With immersive view an app takes you away from mixed realty home where it can then display its content in the physical environment all around you. Apps can also choose to use both views. - -### Use app windows - -On HoloLens (1st gen) app windows are placed and used in mixed reality home, where you can [move, resize, and rotate](hololens1-basic-usage.md#move-resize-and-rotate-apps) them as you like. In addition to using app windows with gaze and gesture, you can also use them with Bluetooth connected mouse and keyboard. - -On HoloLens 2, in addition to using app windows in mixed reality home, you can also use one app window at a time inside an immersive app. You can also put an app window into **Follow me** mode where it will stay in front of you as you walk around. When you open an app window while inside an immersive app, it will open in **Follow me** mode automatically. You can [move, resize, and rotate](hololens2-basic-usage.md#move-resize-and-rotate-holograms) app windows directly using your hands in both mixed reality home and inside an immersive app. - -> [!NOTE] -> -> - Up to three app windows can be active in mixed reality home at a time. You can open more, but only three will remain active. -> - When an app window is not active, it will show content that looks darkened compared to an active window. Some will simply show the app icon instead of any content. To activate an inactive window simply **select** it. -> - Each open app can have one active window at a time, except Microsoft Edge, which can have up to three. - -### Close apps - -To close an app that uses an app window, simply close the app window with the **Close** button on the title bar. You can also look at the window and say "Close". - -To exit an app that uses immersive view, use the Start gesture to bring up the **Start menu**, then select the **Mixed reality home** button. - -If an immersive app is in a broken state and you need to restart it, you can make sure the app is first completely shut down by closing its launcher in mixed reality home, then launching it from the Start menu. - -## Related info - -[Find, Install, and Uninstall applications from the Microsoft Store](holographic-store-apps.md) diff --git a/devices/hololens/holographic-photos-and-videos.md b/devices/hololens/holographic-photos-and-videos.md deleted file mode 100644 index 10e6bb4756..0000000000 --- a/devices/hololens/holographic-photos-and-videos.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Capture and manage mixed reality photos and videos -description: Learn how to capture, view, and share mixed reality photos and videos, using HoloLens. -keywords: hololens, photo, video, capture, mrc, mixed reality capture, photos, camera, stream, livestream, demo -ms.assetid: 1b636ec3-6186-4fbb-81b2-71155aef0593 -ms.prod: hololens -ms.sitesec: library -author: mattzmsft -ms.author: mazeller -ms.topic: article -audience: ITPro -ms.localizationpriority: medium -ms.date: 10/28/2019 -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Create mixed reality photos and videos - -HoloLens gives users the experience of mixing the real world with the digital world. Mixed reality capture (MRC) lets you capture that experience as a photo or video, or share what you see with others in real-time. - -Mixed reality capture uses a first-person point of view so other people can see holograms as you see them. For a third-person point of view, use [spectator view](https://docs.microsoft.com/windows/mixed-reality/spectator-view). Spectator view is especially useful for demos. - -While it's fun to share videos amongst friends and colleagues, videos can also help teach other people to use an app or to communicate problems with apps and experiences. - -> [!NOTE] -> If you can't launch mixed reality capture experiences and your HoloLens is a work device, check with your system administrator. Access to the camera can be restricted through company policy. - -## Capture a mixed reality photo - -There are several ways to take a photo of mixed reality on HoloLens; you can use hardware buttons, voice, or the Start menu. - -### Hardware buttons to take photos - -To take a quick photo of your current view, press the volume up and volume down buttons at the same time. This is a bit like the HoloLens version of a screenshot or print screen. - -- [Button locations on HoloLens 2](hololens2-hardware.md) -- [Button locations on HoloLens (1st gen)](hololens1-hardware.md#hololens-components) - -> [!NOTE] -> Holding the **volume up** and **volume down** buttons for three seconds will start recording a video rather than taking a photo. To stop recording, tap both **volume up** and **volume down** buttons simultaneously. - -### Voice commands to take photos - -Cortana can also take a picture. Say: "Hey Cortana, take a picture." - -### Start menu to take photos - -Use the Start gesture to go to **Start**, then select the **camera** icon. - -Point your head in the direction of what you want to capture, then [air tap](hololens2-basic-usage.md#touch-holograms-near-you) to take a photo. You can continue to air tap and capture additional photos. Any photos you capture will be saved to your device. - -Use the Start gesture again to end photo capture. - -## Capture a mixed reality video - -There are several ways to record a video of mixed reality on HoloLens; you can use hardware buttons, voice, or the Start menu. - -### Hardware buttons to record videos - -The quickest way to record a video is to press and hold the **volume up** and **volume down** buttons simultaneously until a three-second countdown begins. To stop recording, tap both buttons simultaneously. - -> [!NOTE] -> Quickly pressing the **volume up** and **volume down** buttons at the same time will take a photo rather than recording a video. - -### Voice to record videos - -Cortana can also record a video. Say: "Hey Cortana, start recording." To stop a video, say "Hey Cortana, stop recording." - -### Start menu to record videos - -Use the Start gesture to go to **Start**, then select the **video** icon. Point your head in the direction of what you want to capture, then [air tap](hololens2-basic-usage.md#touch-holograms-near-you) to start recording. There will be a three second countdown and your recording will begin. - -To stop recording, use the Start gesture and select the highlighted **video** icon. The video will be saved to your device. - -> [!NOTE] -> **Applies to HoloLens (1st gen) only** -> The [Windows 10 October 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-october-2018) changes how the Start gesture and Windows button behave on HoloLens (1st gen). Before the update, the Start gesture or Windows button would stop a video recording. After the update, however, the Start gesture or Windows button opens the **Start** menu (or the **quick actions menu** if you are in an immersive app), from which you can select the highlighted **video** icon to stop recording. - -## Share what you see in real-time - -You can share what you see in HoloLens with friends and colleagues in real-time. There are a few methods available: - -1. Connecting to a Miracast-enabled device or adapter to watch on a TV. -1. Using [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal) to watch on a PC -1. Using the [Microsoft HoloLens companion app](https://www.microsoft.com/store/productId/9NBLGGH4QWNX) to watch on a PC. -1. Deploying the [Microsoft Dynamics 365 Remote Assist](https://dynamics.microsoft.com/en-us/mixed-reality/remote-assist) app, which enables front-line workers to stream what they see to a remote expert. The remote expert can then guide the front-line worker verbally or by annotating in their world. - -> [!NOTE] -> Sharing what you see via Windows Device Portal or Microsoft HoloLens companion app requires your HoloLens to be in [Developer mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#setting-up-hololens-to-use-windows-device-portal). - -### Stream video with Miracast - -Use the Start gesture to go to **Start**, then select the **connect** icon. From the picker that appears, select the Miracast-enabled device or adapter to which you want to connect. - -To stop sharing, use the Start gesture and select the highlighted **connect** icon. Because you were streaming, nothing will be saved to your device. - -> [!NOTE] -> Miracast support was enabled on HoloLens (1st gen) beginning with the [Windows 10 October 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-october-2018). - -### Real time video with Windows Device Portal - -Because sharing via Windows Device Portal requires Developer mode to be enabled on HoloLens, follow the instructions in our developer documentation to [set up Developer mode and navigate Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). - -### Microsoft HoloLens companion app - -Because sharing via the Microsoft HoloLens companion app requires Developer mode to be enabled on HoloLens, follow the instructions in our developer documentation to [set up Developer mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). Then, download the [Microsoft HoloLens companion app](https://www.microsoft.com/store/productId/9NBLGGH4QWNX) and follow the instructions within the app to connect to your HoloLens. - -Once the app is set up with your HoloLens, select the **Live stream** option from the app's main menu. - -## View your mixed reality photos and videos - -Mixed reality photos and videos are saved to the device's "Camera Roll". You can browse the contents of this folder on your HoloLens with the File Explorer app (navigate to Pictures > Camera Roll). - -You can also view your mixed reality photos and videos in the Photos app, which is pre-installed on HoloLens. To pin a photo in your world, select it in the Photos app and choose **Place in mixed world**. You can move the photo around your world after it's been placed. - -To view and/or save your mixed reality photos and videos on a PC connected to HoloLens, you can use [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#mixed-reality-capture) or your [PC's File Explorer via MTP](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018#new-features-for-hololens). - -## Share your mixed reality photos and videos - -After capturing a mixed reality photo or video, a preview will appear. Select the **share** icon above the preview to bring up the share assistant. From there, you can select the end point to which you'd like to share that photo or video. - -You can also share mixed reality photos and videos from OneDrive, by automatically uploading your mixed reality photos and videos. Open the OneDrive app on HoloLens and sign in with a personal [Microsoft account](https://account.microsoft.com) if you haven't already. Select the **settings** icon and choose **Camera upload**. Turn Camera upload on. Your mixed reality photos and videos will now be uploaded to OneDrive each time you launch the app on HoloLens. - -> [!NOTE] -> You can only enable camera upload in OneDrive if you’re signed into OneDrive with a personal Microsoft account. If you set up HoloLens with a work or school account, you can add a personal Microsoft account in the OneDrive app to enable this feature. - -## Limitations of mixed reality capture - -- While using mixed reality capture, the framerate of HoloLens will be halved to 30 Hz. -- Videos have a maximum length of five minutes. -- The resolution of photos and videos may be reduced if the photo/video camera is already in use by another application, while live streaming, or when system resources are low. - -## Default file format and resolution - -### Default photo format and resolution - -| Device | Format | Extension | Resolution | -|----------|----------|----------|----------| -| HoloLens 2 | [JPEG](https://en.wikipedia.org/wiki/JPEG) | .jpg | 3904x2196px | -| HoloLens (1st gen) | [JPEG](https://en.wikipedia.org/wiki/JPEG) | .jpg | 1408x792px | - -### Recorded video format and resolution - -| Device | Format | Extension | Resolution | Speed | Audio | -|----------|----------|----------|----------|----------|----------| -| HoloLens 2 | [MPEG-4](https://en.wikipedia.org/wiki/MPEG-4) | .mp4 | 1920x1080px | 30fps | 48kHz Stereo | -| HoloLens (1st gen) | [MPEG-4](https://en.wikipedia.org/wiki/MPEG-4) | .mp4 | 1216x684px | 24fps | 48kHz Stereo | diff --git a/devices/hololens/holographic-store-apps.md b/devices/hololens/holographic-store-apps.md deleted file mode 100644 index 085f14c50e..0000000000 --- a/devices/hololens/holographic-store-apps.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Find, install, and uninstall applications -description: The Microsoft Store is your source for apps and games that work with HoloLens. Learn more about finding, installing, and uninstalling holographic apps. -ms.assetid: cbe9aa3a-884f-4a92-bf54-8d4917bc3435 -ms.reviewer: v-miegge -ms.date: 08/30/2019 -manager: jarrettr -keywords: hololens, store, uwp, app, install -ms.prod: hololens -ms.sitesec: library -author: mattzmsft -ms.author: mazeller -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Find, install, and uninstall applications from the Microsoft Store - -The Microsoft Store is your go-to source for apps and games that work with HoloLens. When you go to the Store on your HoloLens, any apps you see there will run on it. - -Apps on HoloLens use either 2D view or holographic view. Apps that use 2D view look like windows and can be positioned all around you. Apps that use holographic view surround you and become the only app you see. - -HoloLens supports many existing applications from the Microsoft Store, as well as new apps built specifically for HoloLens. This article focuses on holographic applications from the Microsoft Store. - -To learn more about installing and running custom apps, read [Custom holographic applications](holographic-custom-apps.md). - -## Find apps - -Open the Microsoft Store from the **Start** menu. Then browse for apps and games. You can use Cortana to search by saying "Hey, Cortana" and then saying your search terms. - -## Install apps - -To download apps, you'll need to be signed in with a Microsoft account. To buy them, you'll need a payment method associated with the Microsoft account you use on your HoloLens. To set up a payment method, go to [account.microsoft.com](https://account.microsoft.com/) and select **Payment & billing** > **Payment options** > **Add a payment option**. - -1. To open the [**Start** menu](holographic-home.md), perform a [bloom](hololens1-basic-usage.md) gesture or tap your wrist. -2. Select the Store app and then tap to place this tile into your world. -3. Once the Store app opens, use the search bar to look for any desired application. -4. Select **Get** or **Install** on the application's page (a purchase may be required). - -## Uninstall apps - -There are two ways to uninstall applications. You can uninstall applications through the Microsoft Store or Start menu. - -### Uninstall from the Start menu - -On the **Start** menu or in the **All apps** list, gaze at the app. Tap and hold until the menu appears, then select **Uninstall**. - -### Uninstall from the Microsoft Store - -Open the Microsoft Store from the **Start** menu, and then browse for the application you'd like to uninstall. On the Store page, each application that you have installed has an **Uninstall** button. diff --git a/devices/hololens/hololens-FAQ.md b/devices/hololens/hololens-FAQ.md deleted file mode 100644 index 38964c7a7d..0000000000 --- a/devices/hololens/hololens-FAQ.md +++ /dev/null @@ -1,293 +0,0 @@ ---- -title: Frequently asked questions about HoloLens devices and holograms -description: Do you have a quick question about HoloLens or interacting with holograms? This article provides a quick answer and more resources. -keywords: hololens, faq, known issue, help -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -audience: ITPro -ms.localizationpriority: medium -ms.date: 02/27/2020 -ms.reviewer: -ms.custom: -- CI 114606 -- CSSTroubleshooting -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Frequently asked questions about HoloLens devices and holograms - -This article answers some questions that you may have about how to use HoloLens, including how to place holograms, work with spaces, and more. - -Any time that you have problems, make sure that HoloLens is [charged up](https://support.microsoft.com/help/12627/hololens-charge-your-hololens). Try [restarting it](hololens-restart-recover.md) to see whether that fixes things. And please use the Feedback app to send us information about the issue. You'll find the Feedback app on the [**Start** menu](holographic-home.md). - -For tips about hwo to wear your HoloLens, see [HoloLens (1st gen) fit and comfort frequently asked questions](hololens1-fit-comfort-faq.md). - -This article addresses the following questions and issues: - - -- [My holograms don't look right or are moving around](#my-holograms-dont-look-right-or-are-moving-around) -- [I see a message that says "Finding your space"](#i-see-a-message-that-says-finding-your-space) -- [I'm not seeing the holograms that I expect to see in my space](#im-not-seeing-the-holograms-that-i-expect-to-see-in-my-space) -- [I can't place holograms where I want to](#i-cant-place-holograms-where-i-want-to) -- [Holograms disappear or are encased in other holograms or objects](#holograms-disappear-or-are-encased-in-other-holograms-or-objects) -- [I can see holograms that are on the other side of a wall](#i-can-see-holograms-that-are-on-the-other-side-of-a-wall) -- [When I place a hologram on a wall, the hologram seems to float](#when-i-place-a-hologram-on-a-wall-the-hologram-seems-to-float) -- [Apps appear too close to me when I'm trying to move them](#apps-appear-too-close-to-me-when-im-trying-to-move-them) -- [I'm getting a low disk space error](#im-getting-a-low-disk-space-error) -- [HoloLens doesn't respond to my gestures](#hololens-doesnt-respond-to-my-gestures) -- [HoloLens doesn't respond to my voice](#hololens-doesnt-respond-to-my-voice) -- [I'm having problems pairing or using a Bluetooth device](#im-having-problems-pairing-or-using-a-bluetooth-device) -- [HoloLens Settings lists devices as available, but the devices don't work](#hololens-settings-lists-devices-as-available-but-the-devices-dont-work) -- [I'm having problems using the HoloLens clicker](#im-having-problems-using-the-hololens-clicker) -- [I can't connect to Wi-Fi](#i-cant-connect-to-wi-fi) -- [My HoloLens isn't running well, is unresponsive, or won't start](#my-hololens-isnt-running-well-is-unresponsive-or-wont-start) -- [I can't sign in to a HoloLens device because it was previously set up for someone else](#i-cant-sign-in-to-a-hololens-device-because-it-was-previously-set-up-for-someone-else) -- [Questions about managing HoloLens devices](#questions-about-managing-hololens-devices) -- [Questions about securing HoloLens devices](#questions-about-securing-hololens-devices) -- [How do I delete all spaces?](#how-do-i-delete-all-spaces) -- [I cannot find or use the keyboard to type in the HoloLens 2 Emulator](#i-cannot-find-or-use-the-keyboard-to-type-in-the-hololens-2-emulator) - -## My holograms don't look right or are moving around - -If your holograms don't look right (for example, they're jittery or shaky, or you see black patches on top of them), try one of these fixes: - -- [Clean your device visor](hololens1-hardware.md#care-and-cleaning) and make sure nothing is blocking the sensors. -- Make sure that you're in a well-lit room that does not have a lot of direct sunlight. -- Try walking around and gazing at your surroundings so that HoloLens can scan them more completely. -- If you've placed a lot of holograms, try removing some. - -If you're still having problems, trying running the Calibration app. This app calibrates your HoloLens just for you to help keep your holograms looking their best. To do this, go to **Settings** > **System** > **Utilities**. Under **Calibration**, select **Open Calibration**. - -[Back to list](#list) - -## I see a message that says "Finding your space" - -When HoloLens is learning or loading a space, you may see a brief message that says "Finding your space." If this message displays for more than a few seconds, you'll see another message under the Start menu that says "Still looking for your space." - -These messages mean that HoloLens is having trouble mapping your space. When this happens, you can open apps, but you can't place holograms in your environment. - -If you see these messages often, try one or more of the following fixes: - -- Make sure that you're in a well-lit room that does not have a lot of direct sunlight. -- Make sure that your device visor is clean. [Learn how to clean your visor](hololens1-hardware.md#care-and-cleaning). -- Make sure that you have a strong Wi-Fi signal. If you enter a new environment that has no Wi-Fi or a weak Wi-Fi signal, HoloLens won't be able find your space. Check your Wi-Fi connection by going to **Settings** > **Network & Internet** > **Wi-Fi**. -- Try moving more slowly. - -[Back to list](#list) - -## I'm not seeing the holograms that I expect to see in my space - -If you don't see the holograms that you placed, or if you're seeing some that you don't expect, try one or more of the following fixes: - -- Turn on some lights. HoloLens works best in a well-lit space. -- Remove holograms that you don't need by going to **Settings** > **System** > **Holograms** > **Remove nearby holograms**. Or, if needed, select **Remove all holograms**. - - > [!NOTE] - > If the layout or lighting in your space changes significantly, your device might have trouble identifying your space and showing your holograms. - -[Back to list](#list) - -## I can't place holograms where I want to - -Here are some things to try if you're having trouble placing holograms: - -- Stand between one and three meters from where you're trying to place the hologram. -- Don't place holograms on black or reflective surfaces. -- Make sure that you're in a well-lit room that does not have a lot of direct sunlight. -- Walk around the rooms so HoloLens can rescan your surroundings. To see what's already been scanned, air tap to reveal the mapping mesh graphic. - -[Back to list](#list) - -## Holograms disappear or are encased in other holograms or objects - -If you get too close to a hologram, it will temporarily disappear—to restore the hologram, just move away from it. Also, if you've placed several holograms close together, some may disappear. Try removing a few. - -Holograms can also be blocked or encased by other holograms or by objects such as walls. If this happens, try one of the following fixes: - -- If the hologram is encased in another hologram, move the encased hologram to another location. To do this, select **Adjust**, then tap and hold to position it. -- If the hologram is encased in a wall, select **Adjust**, then walk toward the wall until the hologram appears. Tap and hold, then pull the hologram forward and out of the wall. -- If you can't move the hologram by using gestures, use your voice to remove it. Gaze at the hologram, then say "Remove." Then reopen the hologram and place it in a new location. - -[Back to list](#list) - -## I can see holograms that are on the other side of a wall - -If you're very close to a wall, or if HoloLens hasn't scanned the wall yet, you can see holograms that are in the next room. To scan the wall, stand between one and three meters from the wall and gaze at it. - -A black or reflective object (for example, a black couch or a stainless steel refrigerator) near the wall may cause problems when HoloLens tries to scan the wall. If there is such an object, scan the other side of the wall. - -[Back to list](#list) - -## When I place a hologram on a wall, the hologram seems to float - -A hologram that you place on a wall typically appears to be an inch or so away from the wall. If it appears to be farther away, try one or more of the following fixes: - -- When you place a hologram on a wall, stand between one and three meters from the wall and face the wall straight on. -- Air tap the wall to reveal the mapping mesh graphic. Make sure that the mesh aligns with the wall. If it doesn't, remove the hologram, rescan the wall, and then try again. -- If the issue persists, run the Calibration app. You'll find it in **Settings** > **System** > **Utilities**. - -[Back to list](#list) - -## Apps appear too close to me when I'm trying to move them - -Try walking around and looking at the area where you're placing the app so that HoloLens scans the area from different angles. [Cleaning your device visor](hololens1-hardware.md#care-and-cleaning) may also help. - -[Back to list](#list) - -## I'm getting a low disk space error - -Free up some storage space by doing one or more of the following: - -- Remove some of the holograms that you've placed, or remove some saved data from within apps. [How do I find my data?](holographic-data.md) -- Delete some pictures and videos in the Photos app. -- Uninstall some apps from your HoloLens. In the **All apps** list, tap and hold the app you want to uninstall, then select **Uninstall**. (Uninstalling the app also deletes any data that the app stores on the device.) - -[Back to list](#list) - -## HoloLens doesn't respond to my gestures - -To make sure that HoloLens can see your gestures, keep your hand in the gesture frame. The gesture frame extends a couple of feet on either side of you. HoloLens can also best see your hand when you hold it about 18 inches in front of your body (though you don't have to be precise about this). When HoloLens can see your hand, the cursor changes from a dot to a ring. Learn more about [using gestures in HoloLens 2](hololens2-basic-usage.md) or [using gestures in HoloLens (1st gen)](hololens1-basic-usage.md). - -[Back to list](#list) - -## HoloLens doesn't respond to my voice - -HoloLens (1st gen) and HoloLens 2 have built-in speech recognition, and also support Cortana (online speech recognition). - -### Built-in voice commands do not work - -On HoloLens (1st gen), built-in speech recognition is not configurable. It is always turned on. On HoloLens 2, you can choose whether to turn on both speech recognition and Cortana during device setup. - -If your HoloLens 2 is not responding to your voice, make sure Speech recognition is turned on. Go to **Start** > **Settings** > **Privacy** > **Speech** and turn on **Speech recognition**. - -### Cortana or Dictation doesn't work - -If Cortana or Dictation isn't responding to your voice, make sure online speech recognition is turned on. Go to **Start** > **Settings** > **Privacy** > **Speech** and verify the **Online speech recognition** settings. - -If Cortana is still not responding, do one of the following to verify that Cortana itself is turned on: - -- In **All apps**, select **Cortana** > select **Menu** > **Notebook** > **Settings** to make changes. -- On HoloLens 2, select the **Speech settings** button or say "Speech settings." - -To learn more about what you can say, see [Use your voice with HoloLens](hololens-cortana.md). - -[Back to list](#list) - -## I'm having problems pairing or using a Bluetooth device - -If you're having problems [pairing a Bluetooth device](hololens-connect-devices.md), try the following: - -- Go to **Settings** > **Devices**, and make sure that Bluetooth is turned on. If it is, turn it off and on again. -- Make sure that your Bluetooth device is fully charged or has fresh batteries. -- If you still can't connect, [restart the HoloLens](hololens-recovery.md). - -[Back to list](#list) - -## HoloLens Settings lists devices as available, but the devices don't work - -HoloLens doesn't support Bluetooth audio profiles. Bluetooth audio devices, such as speakers and headsets, may appear as available in HoloLens settings, but they aren't supported. - -If you're having trouble using a Bluetooth device, make sure that it's a supported device. Supported devices include the following: - -- English-language QWERTY Bluetooth keyboards (you can use these anywhere that you use the holographic keyboard). -- Bluetooth mice. -- The [HoloLens clicker](hololens1-clicker.md). - -You can pair other Bluetooth HID and GATT devices together with your HoloLens. However, you may have to install corresponding companion apps from Microsoft Store to actually use the devices. - -[Back to list](#list) - -## I'm having problems using the HoloLens clicker - -Use the [clicker](hololens1-clicker.md) to select, scroll, move, and resize holograms. Individial apps may support additional clicker gestures. - -If you're having trouble using the clicker, make sure that it's charged and paired with your HoloLens. If the battery is low, the indicator light blinks amber. To verify that the clicker is paired, go to **Settings** > **Devices** and see if it shows up there. For more information, see [Pair the clicker](hololens-connect-devices.md#hololens-1st-gen-pair-the-clicker). - -If the clicker is charged and paired and you're still having problems, reset it by holding down the main button and the pairing button for 15 seconds. Then pair the clicker with your HoloLens again. - -If resetting the clicker doesn't help, see [Restart or recover the HoloLens clicker](hololens1-clicker.md#restart-or-recover-the-clicker). - -[Back to list](#list) - -## I can't connect to Wi-Fi - -Here are some things to try if you can't connect your HoloLens to a Wi-Fi network: - -- Make sure that Wi-Fi is turned on. To check, use the Start gesture, then select **Settings** > **Network & Internet** > **Wi-Fi**. If Wi-Fi is on, try turning it off and then on again. -- Move closer to the router or access point. -- Restart your Wi-Fi router, then [restart HoloLens](hololens-recovery.md). Try connecting again. -- If none of these things work, check to make sure that your router is using the latest firmware. You can find this information on the manufacturer website. - -[Back to list](#list) - -## My HoloLens isn't running well, is unresponsive, or won't start - -If your device isn't performing properly, see [Restart, reset, or recover HoloLens](hololens-recovery.md). - -[Back to list](#list) - -## I can't sign in to a HoloLens device because it was previously set up for someone else - -If your device was previously set up for someone else, either for a client or for a former employee, and you don't have their password to unlock the device, you can do one of the following: - -- For a device that is enrolled in Intune mobile device management (MDM), you can use Intune to remotely [wipe](https://docs.microsoft.com/intune/remote-actions/devices-wipe) the device. The device then re-flashes itself. - > [!IMPORTANT] - > When you wipe the device, make sure to leave **Retain enrollment state and user account** unchecked. -- For a non-MDM device, you can [put the device into **Flashing Mode** and use Advanced Recovery Companion](hololens-recovery.md#re-install-the-operating-system) to recover the device. - -[Back to list](#list) - -## Questions about managing HoloLens devices - -### Can I use System Center Configuration Manager (SCCM) to manage HoloLens devices? - -No. You have to use an MDM system to manage HoloLens devices. - -### Can I use Active Directory Domain Services (AD DS) to manage HoloLens user accounts? - -No. You have to use Azure Active Directory (AAD) to manage user accounts for HoloLens devices. - -### Is HoloLens capable of Automated Data Capture Systems (ADCS) auto-enrollment? - -No. - -### Can HoloLens participate in Integrated Windows Authentication? - -No. - -### Does HoloLens support branding? - -No. However, you can work around this issue by using one of the following approaches: - -- Create a custom app, and then [enable Kiosk mode](hololens-kiosk.md). The custom app can have branding, and can launch other apps (such as Remote Assist). -- Change all of the user profile pictures in AAD to your company logo. However, this may not be desirable for all scenarios. - -### What logging capabilities do HoloLens (1st gen) and HoloLens 2 offer? - -Logging is limited to traces that can be captured in development or troubleshooting scenarios, or telemetry that the devices send to Microsoft servers. - -[Back to list](#list) - -## Questions about securing HoloLens devices - -See [frequently asked questions about securing HoloLens devices](hololens-faq-security.md). - -[Back to list](#list) - -## How do I delete all spaces? - -*Coming soon* - -[Back to list](#list) - -## I cannot find or use the keyboard to type in the HoloLens 2 Emulator - -*Coming soon* - -[Back to list](#list) diff --git a/devices/hololens/hololens-calibration.md b/devices/hololens/hololens-calibration.md deleted file mode 100644 index b03fb4479f..0000000000 --- a/devices/hololens/hololens-calibration.md +++ /dev/null @@ -1,154 +0,0 @@ ---- -title: Improve visual quality and comfort -description: Calibrating your IPD (interpupillary distance) can improve the quality of your visuals. Both HoloLens and Windows Mixed Reality immersive headsets offer ways to customize IPD. -author: Teresa-Motiv -ms.author: xerxesb -ms.date: 9/13/2019 -ms.topic: article -keywords: calibration, comfort, visuals, quality, ipd -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.localizationpriority: high -ms.reviewer: -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Improve visual quality and comfort - -HoloLens 2 and HoloLens (1st gen) both work better when they're calibrated to your unique eyes. - -While both devices need to calibrate for the best hologram viewing experience, they use different calibration technologies and techniques. Jump to [HoloLens 2 calibration](#calibrating-your-hololens-2) or [HoloLens (1st gen) calibration](#calibrating-your-hololens-1st-gen). - -## Calibrating your HoloLens 2 - -HoloLens 2 uses eye-tracking technology to improve your experience seeing and interacting with the virtual environment. Calibrating the HoloLens 2 ensures that it can accurately track your eyes (and the eyes of anyone else who uses the device). After calibration, holograms will appear correctly even as the visor shifts on your head. - -HoloLens 2 prompts a user to calibrate the device under the following circumstances: - -- The user is using the device for the first time -- The user previously opted out of the calibration process -- The calibration process did not succeed the last time the user used the device -- The user has deleted their calibration profiles -- The device is taken off and put back on and any of the above circumstances apply - - -![Calibration prompt](./images/07-et-adjust-for-your-eyes.png) - -During this process, you'll look at a set of targets (gems). It's fine if you blink or close your eyes during calibration but try not to stare at other objects in the room. This allows HoloLens to learn about your eye position to render your holographic world. - -![Calibration prompt](./images/07-et-hold-head-still.png) - -![Calibration prompt](./images/08-et-gems.png) - -![Calibration prompt](./images/09-et-adjusting.png) - -If calibration was successful, you'll see a success screen. If not, read more about diagnosing calibration failures [here](#troubleshooting-hololens-2-calibration). - -![Calibration prompt](./images/10-et-success.png) - -### Calibration when sharing a device or session - -Multiple users can share a HoloLens 2 device, without a need for each person to go through device setup. When a new user puts the device on their head for th first time, HoloLens 2 automatically prompts the user to calibrate visuals. When a user that has previously calibrated visuals puts the device on their head, the display seamlessly adjusts for quality and a comfortable viewing experience. - -### Manually starting the calibration process - -1. Use the start gesture to open the [**Start** menu](hololens2-basic-usage.md#start-gesture). -1. If the Settings app isn't pinned to **Start**, select **All Apps**. -1. Select **Settings**, and then select **System** > **Calibration** > **Eye Calibration** > **Run eye calibration**. - - ![The Settings app, showing the Run eye calibration option](./images/C-Settings.Calibration.png) - -### Troubleshooting HoloLens 2 calibration - -Calibration should work for most people, but there are cases where calibration fails. - -Some potential reasons for calibration failure include: - -- Getting distracted and not following the calibration targets -- Dirty or scratched device visor or device visor not positioned properly -- Dirty or scratched glasses -- Certain types of contact lenses and glasses (colored contact lenses, some toric contact lenses, IR blocking glasses, some high prescription glasses, sunglasses, or similar) -- More-pronounced makeup and some eyelash extensions -- Hair or thick eyeglass frames if they are blocking the device from seeing your eyes -- Certain eye physiology, eye conditions or eye surgery such as narrow eyes, long eyelashes, amblyopia, nystagmus, some cases of LASIK or other eye surgeries - -If calibration is unsuccessful try: - -- Cleaning your device visor -- Cleaning your glasses -- Pushing your device visor as close to your eyes as possible -- Moving objects in your visor out of the way (such as hair) -- Turning on a light in your room or moving out of direct sunlight - -If you followed all guidelines and calibration is still failing, please let us know by filing feedback in [Feedback Hub](hololens-feedback.md). - -Note that setting IPD is not applicable for Hololens 2, since eye positions are computed by the system. - -### Calibration data and security - -Calibration information is stored locally on the device and is not associated with any account information. There is no record of who has used the device without calibration. This mean new users will get prompted to calibrate visuals when they use the device for the first time, as well as users who opted out of calibration previously or if calibration was unsuccessful. - -Calibration information can always be deleted from the device in **Settings** > **Privacy** > **Eye tracker**. - -### Disable calibration - -You can also disable the calibration prompt by following these steps: - -1. Select **Settings** > **System** > **Calibration**. -1. Turn off **When a new person uses this HoloLens, automatically ask to run eye calibration**. - -> [!IMPORTANT] -> This setting may adversely affect hologram rendering quality and comfort. When you turn off this setting, features that depend on eye tracking (such as text scrolling) no longer work in immersive applications. - -### HoloLens 2 eye-tracking technology - -The device uses its eye-tracking technology to improve display quality, and to ensure that all holograms are positioned accurately and comfortable to view in 3D. Because it uses the eyes as landmarks, the device can adjust itself for every user and tune its visuals as the headset shifts slightly throughout use. All adjustments happen on the fly without a need for manual tuning. -> [!NOTE] -> Setting the IPD is not applicable for Hololens 2, since eye positions are computed by the system. - -HoloLens applications use eye tracking to track where you are looking in real time. This is the main capability developers can leverage to enable a whole new level of context, human understanding and interactions within the Holographic experience. Developers don’t need to do anything to leverage this capability. - -## Calibrating your HoloLens (1st gen) - -HoloLens (1st gen) adjusts hologram display according to the your [interpupillary distance](https://en.wikipedia.org/wiki/Interpupillary_distance) (IPD). If the IPD is not accurate, holograms may appear unstable or at an incorrect distance. You can improve the quality of your visuals by calibrating the device to your interpupillary distance (IPD). - -When you set up your Hololens (1st gen) device, it prompts to calibrate your visuals after Cortana introduces herself. It's recommended that you complete the calibration step during this setup phase. However you can skip it by waiting until Cortana prompts you and then saying "Skip." - -During the calibration process, HoloLens asks you to align your finger with a series of six targets per eye. HoloLens uses this process to set the IPD correctly for your eyes. - -![IPD finger-alignment screen at second step](./images/ipd-finger-alignment-300px.jpg) - -### Manually start the calibration process - -If you need to update the calibration or if a new user needs to adjust it, you can manually run the Calibration app at any time. The Calibration app is installed by default. You can access it by using eihter the **Start** menu or the Settings app. - -To use the **Start** menu to run the Calibration app, follow these steps: - -1. Use the [bloom](hololens1-basic-usage.md) gesture to open the **Start** menu. -1. To view all apps, select **+**. -1. Select **Calibration**. - -![Accessing the calibration app from the shell](./images/calibration-shell.png) - -![The calibration app displayed as a Live Cube after being launched](./images/calibration-livecube-200px.png) - -To use the Settings app to run the Calibration app, follow these steps: - -1. Use the [bloom](hololens1-basic-usage.md) gesture to open the **Start** menu. -1. If **Settings** isn't pinned to **Start**, select **+** to view all apps. -1. Select **Settings**. -1. Select **System** > **Utilities** > **Open Calibration**. - -![Launching the calibration app from the settings app](./images/calibration-settings-500px.jpg) - -## Immersive headsets - -Some immersive headsets provide the ability to customize the IPD setting. To change the IPD for your headset, open the Settings app and select **Mixed reality** > **Headset display**, and then move the slider control. You’ll see the changes in real time in your headset. If you know your IPD, maybe from a visit to the optometrist, you can enter it directly as well. - -You can also adjust this setting on your PC by selecting **Settings** > **Mixed reality** > **Headset display**. - -If your headset does not support IPD customization, this setting will be disabled. diff --git a/devices/hololens/hololens-commercial-features.md b/devices/hololens/hololens-commercial-features.md deleted file mode 100644 index f53558ec75..0000000000 --- a/devices/hololens/hololens-commercial-features.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Commercial features -description: The Microsoft HoloLens Commercial Suite includes features that make it easier for businesses to manage HoloLens devices. HoloLens 2 devices are equipped with commercial features by default. -keywords: HoloLens, commercial, features, mdm, mobile device management, kiosk mode -author: scooley -ms.author: scooley -ms.date: 08/26/2019 -ms.custom: -- CI 111456 -- CSSTroubleshooting -ms.topic: article -audience: ITPro -ms.prod: hololens -ms.sitesec: library -ms.localizationpriority: high -ms.reviewer: -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Commercial features - -HoloLens includes features that make it easier for businesses to manage HoloLens devices. - -Every HoloLens 2 device has commercial features available. - -HoloLens (1st gen) came with two licensing options, the developer license and a commercial license. To unlock HoloLens's commercial capabilities, upgrade from the developer license to a commercial license. To purchase the Microsoft HoloLens Commercial Suite, contact your local Microsoft account manager. - ->[!VIDEO https://www.youtube.com/embed/tNd0e2CiAkE] - -## Key commercial features - -- **Kiosk mode.** You can use HoloLens in demo or showcase experiences by using kiosk mode, to limit which apps can run. - - ![Using kiosk mode, HoloLens launches directly into the app of your choice.](images/201608-kioskmode-400px.png) - -- **Mobile Device Management (MDM) for HoloLens.** Your IT department can manage multiple HoloLens devices simultaneously by using solutions such as Microsoft Intune. You can manage settings, select apps to install, and set security configurations that are tailored to your organization's needs. - - ![Mobile Device Management on HoloLens provides enterprise-grade device management across multiple devices.](images/201608-enterprisemanagement-400px.png) - -- **Windows Update for Business.** Windows Update for Business provides controlled operating system updates to devices and support for the long-term servicing channel. -- **Data security.** BitLocker data encryption is enabled on HoloLens to provide the same level of security protection as any other Windows device. -- **Work access.** Anyone in your organization can remotely connect to the corporate network through virtual private network (VPN) on a HoloLens. HoloLens can also access Wi-Fi networks that require credentials. -- **Microsoft Store for Business.** Your IT department can also set up an enterprise private store, containing only your company's apps for your specific HoloLens usage. Securely distribute your enterprise software to selected group of enterprise users. - -## Feature comparison between editions - -|Features |HoloLens Development Edition |HoloLens Commercial Suite |HoloLens 2 | -|---|:---:|:---:|:---:| -|Device Encryption (BitLocker) | |✔️ |✔️ | -|Virtual Private Network (VPN) | |✔️ |✔️ | -|[Kiosk mode](hololens-kiosk.md) | |✔️ |✔️ | -|**Management and deployment** | | | | -|Mobile Device Management (MDM) | |✔️ |✔️ | -|Ability to block unenrollment | |✔️ |✔️ | -|Cert-based corporate Wi-Fi access | |✔️ |✔️ | -|Microsoft Store (Consumer) |Consumer |Filter by using MDM |Filter by using MDM | -|[Business Store Portal](https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps) | |✔️ |✔️ | -|**Security and identity** | | | | -|Sign in by using Azure Active Directory (AAD) account |✔️ |✔️ |✔️ | -|Sign in by using Microsoft Account (MSA) |✔️ |✔️ |✔️ | -|Next Generation Credentials with PIN unlock |✔️ |✔️ |✔️ | -|[Secure boot](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-secure-boot) |✔️ |✔️ |✔️ | -|**Servicing and support** | | | | -|Automatic system updates as they arrive |✔️ |✔️ |✔️ | -|[Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) | |✔️ |✔️ | -|Long-Term Servicing Channel (LTSC) | |✔️ |✔️ | - -## Enabling commercial features - -Your organization's IT admin can set up commercial features such as Microsoft Store for Business, kiosk mode, and enterprise Wi-Fi access. The [Microsoft HoloLens](index.md) documentation provides step-by-step instructions for enrolling devices and installing apps from Microsoft Store for Business. - -## See also - -- [Microsoft HoloLens](index.md) -- [Kiosk mode](hololens-kiosk.md) -- [CSPs supported in HoloLens devices](/windows/client-management/mdm/configuration-service-provider-reference#csps-supported-in-hololens-devices) -- [Microsoft Store For Business and line of business applications](https://blogs.technet.microsoft.com/sbucci/2016/04/13/windows-store-for-business-and-line-of-business-applications/) -- [Working with line-of-business apps](/microsoft-store/working-with-line-of-business-apps) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md deleted file mode 100644 index 98ec5c6e06..0000000000 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: Infrastructure Guidelines for HoloLens -description: -ms.prod: hololens -ms.sitesec: library -author: pawinfie -ms.author: pawinfie -audience: ITPro -ms.topic: article -ms.localizationpriority: high -ms.date: 1/23/2020 -ms.reviewer: -audience: ITPro -manager: bradke -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Configure Your Network for HoloLens - -This portion of the document will require the following people: - -1. Network Admin with permissions to make changes to the proxy/firewall -2. Azure Active Directory Admin -3. Mobile Device Manager Admin - -## Infrastructure Requirements - -HoloLens is, at its core, a Windows mobile device integrated with Azure. It works best in commercial environments with wireless network availability (wi-fi) and access to Microsoft services. - -Critical cloud services include: - -- Azure active directory (AAD) -- Windows Update (WU) - -Commercial customers will need enterprise mobility management (EMM) or mobile device management (MDM) infrastructure to manage HoloLens devices at scale. This guide uses [Microsoft Intune](https://www.microsoft.com/enterprise-mobility-security/microsoft-intune) as an example, though any provider with full support for Microsoft Policy can support HoloLens. Ask your mobile device management provider if they support HoloLens 2. - -HoloLens does support a limited set of cloud disconnected experiences. - -### Wireless network EAP support - -- PEAP-MS-CHAPv2 -- PEAP-TLS -- TLS -- TTLS-CHAP -- TTLS-CHAPv2 -- TTLS-MS-CHAPv2 -- TTLS-PAP -- TTLS-TLS - -### HoloLens Specific Network Requirements - -Make sure that [this list](hololens-offline.md) of endpoints are allowed on your network firewall. This will enable HoloLens to function properly. - -### Remote Assist Specific Network Requirements - -1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** -1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). - -### Guides Specific Network Requirements - -Guides only require network access to download and use the app. - -## Azure Active Directory Guidance - -> [!NOTE] -> This step is only necessary if your company plans on managing the HoloLens. - -1. Ensure that you have an Azure AD License. -Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for additional information. - -1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) - -1. Ensure that your company’s users are in Azure Active Directory (Azure AD). -Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). - -1. We suggest that users who need similar licenses are added to the same group. - 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) - 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) - -1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. -Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). - -1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company’s users (or a group of users) can add devices. - 1. **Option 1:** Give all users permission to join devices to Azure AD. -**Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > -**Set Users may join devices to Azure AD to *All*** - - 1. **Option 2:** Give selected users/groups permission to join devices to Azure AD -**Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > -**Set Users may join devices to Azure AD to *Selected*** -![Image that shows Configuration of Azure AD Joined Devices](images/azure-ad-image.png) - - 1. **Option 3:** You can block all users from joining their devices to the domain. This means that all devices will need to be manually enrolled. - -## Mobile Device Manager Guidance - -### Ongoing device management - -> [!NOTE] -> This step is only necessary if your company plans to manage the HoloLens. - -Ongoing device management will depend on your mobile device management infrastructure. Most have the same general functionality but the user interface may vary widely. - -1. [CSPs (Configuration Service Providers)](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#csps-supported-in-hololens-devices) allows you to create and deploy management settings for the devices on your network. A list of CSPs for HoloLens can be found [here](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#csps-supported-in-hololens-devices). - -1. [Compliance policies](https://docs.microsoft.com/intune/device-compliance-get-started) are rules and settings that devices must meet to be compliant in your corporate infrastructure. Use these policies with Conditional Access to block access to company resources for devices that are non-compliant. For example, you can create a policy that requires Bitlocker be enabled. - -1. [Create Compliance Policy](https://docs.microsoft.com/intune/protect/compliance-policy-create-windows). - -1. Conditional Access allows/denies mobile devices and mobile applications from accessing company resources. Two documents you may find helpful are [Plan your CA Deployment](https://docs.microsoft.com/azure/active-directory/conditional-access/plan-conditional-access) and [Best Practices](https://docs.microsoft.com/azure/active-directory/conditional-access/best-practices). - -1. [This article](https://docs.microsoft.com/intune/fundamentals/windows-holographic-for-business) talks about Intune's management tools for HoloLens. - -1. [Create a device profile](https://docs.microsoft.com/intune/configuration/device-profile-create) - -### Manage updates - -Intune includes a feature called Update rings for Windows 10 devices, including HoloLens 2 and HoloLens v1 (with Holographic for Business). Update rings include a group of settings that determine how and when updates are installed. - -For example, you can create a maintenance window to install updates, or choose to restart after updates are installed. You can also choose to pause updates indefinitely until you're ready to update. - -Read more about [configuring update rings with Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure). - -### Application management - -Manage HoloLens applications through: - -1. Microsoft Store - The Microsoft Store is the best way to distribute and consume applications on HoloLens. There is a great set of core HoloLens applications already available in the store or you can [publish your own](https://docs.microsoft.com/windows/uwp/publish/). - All applications in the store are available publicly to everyone, but if it isn't acceptable, checkout the Microsoft Store for Business. - -1. [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/) - Microsoft Store for Business and Education is a custom store for your corporate environment. It lets you use the Microsoft Store built into Windows 10 and HoloLens to find, acquire, distribute, and manage apps for your organization. It also lets you deploy apps that are specific to your commercial environment but not to the world. - -1. Application deployment and management via Intune or another mobile device management solution - Most mobile device management solutions, including Intune, provide a way to deploy line of business applications directly to a set of enrolled devices. See this article for [Intune app install](https://docs.microsoft.com/intune/apps-deploy). - -1. _not recommended_ Device Portal - Applications can also be installed on HoloLens directly using the Windows Device Portal. This isn't recommended since Developer Mode has to be enabled to use the device portal. - -Read more about [installing apps on HoloLens](https://docs.microsoft.com/hololens/hololens-install-apps). - -### Certificates - -You can distribute certificates through your MDM provider. If your company requires certificates, Intune supports PKCS, PFX, and SCEP. It is important to understand which certificate is right for your company. Please visit [here](https://docs.microsoft.com/intune/protect/certificates-configure) to determine which cert is best for you. If you plan to use certificates for HoloLens Authentication, PFX or SCEP may be right for you. - -Steps for SCEP can be found [here](https://docs.microsoft.com/intune/protect/certificates-profile-scep). - -### How to Upgrade to Holographics for Business Commercial Suite - -> [!NOTE] -> Windows Holographics for Business (commercial suite) is only intended for HoloLens 1st gen devices. The profile will not be applied to HoloLens 2 devices. - -Directions for upgrading to the commercial suite can be found [here](https://docs.microsoft.com/intune/configuration/holographic-upgrade). - -### How to Configure Kiosk Mode Using Microsoft Intune - -1. Sync Microsoft Store to Intune ([Here](https://docs.microsoft.com/intune/apps/windows-store-for-business)). - -1. Check your app settings - 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** - >[!NOTE] - >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. - 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. - -1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) - -> [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. - -![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) - -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) - -## Certificates and Authentication - -Certificates can be deployed via you MDM (see "certificates" in the [MDM Section](hololens-commercial-infrastructure.md#mobile-device-manager-guidance)). Certificates can also be deployed to the HoloLens through package provisioning. Please see [HoloLens Provisioning](hololens-provisioning.md) for additional information. - -### Additional Intune Quick Links - -1. [Create Profiles:](https://docs.microsoft.com/intune/configuration/device-profile-create) Profiles allow you to add and configure settings that will be pushed to the devices in your organization. - -## Next (Optional) Step: [Configure HoloLens using a provisioning package](hololens-provisioning.md) - -## Next Step: [Enroll your device](hololens-enroll-mdm.md) diff --git a/devices/hololens/hololens-connect-devices.md b/devices/hololens/hololens-connect-devices.md deleted file mode 100644 index 7926dab884..0000000000 --- a/devices/hololens/hololens-connect-devices.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Connect to Bluetooth and USB-C devices -description: This guide walks through connecting to Bluetooth and USB-C devices and accessories. -ms.assetid: 01af0848-3b36-4c13-b797-f38ad3977e30 -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -ms.localizationpriority: high -ms.date: 03/11/2020 -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Connect to Bluetooth and USB-C devices - -## Pair Bluetooth devices - -HoloLens 2 supports the following classes of Bluetooth devices: - -- Mouse -- Keyboard -- Bluetooth audio output (A2DP) devices - -HoloLens (1st gen) supports the following classes of Bluetooth devices: - -- Mouse -- Keyboard -- HoloLens (1st gen) clicker - -> [!NOTE] -> Other types of Bluetooth devices, such as speakers, headsets, smartphones, and game pads, may be listed as available in HoloLens settings. However, these devices aren't supported on HoloLens (1st gen). For more information, see [HoloLens Settings lists devices as available, but the devices don't work](hololens-FAQ.md#hololens-settings-lists-devices-as-available-but-the-devices-dont-work). - -### Pair a Bluetooth keyboard or mouse - -1. Turn on your keyboard or mouse, and make it discoverable. To learn how to make the device discoverable, look for information on the device (or its documentation) or visit the manufacturer's website. - -1. Use the bloom gesture (HoloLens (1st gen)) or the start gesture (HoloLens 2) to go to **Start**, and then select **Settings**. -1. Select **Devices**, and make sure that Bluetooth is on. -1. When you see the device name, select **Pair**, and then follow the instructions. - -### HoloLens (1st gen): Pair the clicker - -1. Use the bloom gesture to go to **Start**, and then select **Settings**. -1. Select **Devices**, and make sure that Bluetooth is on. -1. Use the tip of a pen to press and hold the clicker pairing button until the clicker status light blinks white. Make sure to hold down the button until the light starts blinking. - The pairing button is on the underside of the clicker, next to the finger loop. - ![The pairing button is beside the finger loop](images/use-hololens-clicker-1.png) -1. On the pairing screen, select **Clicker** > **Pair**. - -## HoloLens 2: Connect USB-C devices - -HoloLens 2 supports the following classes of USB-C devices: - -- Mass storage devices (such as thumb drives) -- Ethernet adapters (including ethernet plus charging) -- USB-C-to-3.5mm digital audio adapters -- USB-C digital audio headsets (including headset adapters plus charging) -- Wired mouse -- Wired keyboard -- Combination PD hubs (USB A plus PD charging) - -## Connect to Miracast - -To use Miracast, follow these steps: - -1. Do one of the following: - - - Open the **Start** menu, and select the display icon. - - Say "Connect" while you gaze at the **Start** menu. - -1. On the list of devices that appears, select an available device. -1. Complete the pairing to begin projecting. diff --git a/devices/hololens/hololens-cortana.md b/devices/hololens/hololens-cortana.md deleted file mode 100644 index 89a01c0628..0000000000 --- a/devices/hololens/hololens-cortana.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Use your voice with HoloLens -description: Cortana can help you do all kinds of things on your HoloLens -ms.assetid: fd96fb0e-6759-4dbe-be1f-58bedad66fed -ms.date: 03/10/2020 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -audience: ITPro -ms.author: v-tea -ms.topic: article -manager: jarrettr -ms.localizationpriority: high -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Use your voice with HoloLens - -You can use your voice to do almost anything on HoloLens, such as taking a quick photo or opening an app. Many voice commands are built into HoloLens, while others are available through Cortana. - -This article teaches you how to control HoloLens and your holographic world with your voice and with Cortana. - -> [!NOTE] -> Speech is only supported in [some languages](hololens2-language-support.md). The speech language is based on the Windows display language, not the keyboard language. -> -> You can verify the Windows display language by selecting **Settings** > **Time and Language** > **Language**. - -## Built-in voice commands - -Get around HoloLens faster with these basic commands. In order to use these, you need to enable Speech during the first run of the device or in **Settings** > **Privacy** > **Speech**. You can always check whether speech is enabled by looking at the status at the top of the Start menu. For the best speech recognition results, HoloLens 2 uses the Microsoft cloud-based services. However, you can use Settings to disable this feature. To do this, in Settings, turn off **Online speech recognition**. After you change this setting, HoloLens 2 will only process voice data locally to recognize commands and dictation, and Cortana will not be available. - -### General speech commands - -Use these commands throughout Windows Mixed Reality to get around faster. Some commands use the gaze cursor, which you bring up by saying “select.” - -> [!NOTE] -> Hand rays are not supported on HoloLens (1st Gen). - -| Say this | To do this | -| - | - | -| "Select" | Say "select" to bring up the gaze cursor. Then, turn your head to position the cursor on the thing you want to select, and say “select” again. | -|Open the Start menu | "Go to Start" | -|Close the Start menu | "Close" | -|Leave an immersive app | Say "Go to Start" to bring up the quick actions menu, then say "Mixed reality home." | -|Hide and show hand ray | "Hide hand ray" / "Show hand ray" | -|See available speech commands | "What can I say?" | - -Starting with version 19041.x of HoloLens 2, you can also use these commands: - -| Say this | To do this | -| - | - | -| "Restart device" | Bring up a dialogue to confirm you want to restart the device. You can say "yes" to restart. | -| "Shutdown device" | Bring up a dialogue to confirm you want to turn off the device. You can say "yes" to confirm. | -| "Brightness up/down" | Increase or decrease the display brightness by 10%. | -| "Volume up/down" | Increase or decrease the volume by 10%. | -| "What's my IP address" | Bring up a dialogue displaying your device's current IP address on the local network. | -| "Take a picture" | Capture a mixed reality photo of what you are currently seeing. | -| "Take a video" | Start recording a mixed reality video. | -| "Stop recording" | Stops the current mixed reality video recording if one is in progress. | - -### Hologram commands - -To use these commands, gaze at a 3D object, hologram, or app window. - -| Say this | To do this | -| - | - | -| "Bigger" | Make it bigger | -| "Smaller" | Make it smaller | -| "Face me" | Turn it to face you | -| "Move this" | Move it (follow your gaze) | -| "Close" | Close it | -| "Follow me" / "Stop following" | Make it follow you as you move around | - -### See it, say it - -Many buttons and other elements on HoloLens also respond to your voice—for example, **Follow me** and **Close** on the app bar, or the **Back** button in Edge. To find out if a button is voice-enabled, rest your **gaze cursor**,**touch cursor** or one **hand ray** on it for a moment. If the button is voice-enabled, you'll see a voice tip. - -### Dictation mode - -Tired of typing? Switch to dictation mode any time that the holographic keyboard is active. To get started, select the microphone button or say "Start dictating." To stop dictating, select the button again or say "Stop dictating." To delete what you just dictated, say "Delete that." - -> [!NOTE] -> To use dictation mode, you have to have an internet connection. - -HoloLens dictation uses explicit punctuation, meaning that you say the name of the punctuation you want to use. For instance, you might say "Hey **comma** what are you up to **question mark**." - -Here are the punctuation keywords that you can use: - -- Period, comma, question mark, exclamation point/exclamation mark -- New line/new paragraph -- Semicolon, colon -- Open quote(s), close quote(s) -- Hashtag, smiley/smiley face, frowny, winky -- Dollar, percent - -Sometimes it's helpful to spell out things like email addresses. For instance, to dictate example@outlook.com, you'd say "E X A M P L E at outlook dot com." - -## Do more with Cortana - -Cortana can help you do all kinds of things on your HoloLens, but depending on which version of Windows Holographic you're using, the capablities may be different. You can learn more about the updated capabilites of the latest version of Cortana [here](https://blogs.windows.com/windowsexperience/2020/02/28/cortana-in-the-upcoming-windows-10-release-focused-on-your-productivity-with-enhanced-security-and-privacy/). - -![Hey Cortana!](images/cortana-on-hololens.png) - -Here are some things you can try saying (remember to say "Hey Cortana" first). - -**Hey, Cortana**... - -- What can I say? -- Launch <*app name*>. -- What time is it? -- Show me the latest NBA scores. -- Tell me a joke. - -If you're using *version 18362.x or earlier*, you can also use these commands: - -**Hey, Cortana**... - -- Increase the volume. -- Decrease the brightness. -- Shut down. -- Restart. -- Go to sleep. -- Mute. -- Move <*app name*> here (gaze at the spot that you want the app to move to). -- Go to Start. -- Take a picture. -- Start recording. (Starts recording a video.) -- Stop recording. (Stops recording a video.) -- How much battery do I have left? - -Some Cortana features that you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens, and the Cortana experience may vary from one region to another. - -### Turn Cortana off - -Cortana is on the first time you use HoloLens when you enable speech. You can turn her off in Cortana's settings. In the **All apps** list, select **Cortana** > **Settings**. Then turn off Cortana can give you suggestions, ideas, reminders, alerts, and more. - -If Cortana isn't responding to "Hey Cortana," check that speech is enabled on Start and go to Cortana's settings and check to make sure she's on. diff --git a/devices/hololens/hololens-diagnostic-logs.md b/devices/hololens/hololens-diagnostic-logs.md deleted file mode 100644 index 212f936079..0000000000 --- a/devices/hololens/hololens-diagnostic-logs.md +++ /dev/null @@ -1,269 +0,0 @@ ---- -title: Collect and use diagnostic information from HoloLens devices -description: -author: Teresa-Motiv -ms.author: v-tea -ms.date: 03/23/2020 -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -ms.topic: article -ms.custom: -- CI 115131 -- CSSTroubleshooting -audience: ITPro -ms.localizationpriority: medium -keywords: -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Collect and use diagnostic information from HoloLens devices - -HoloLens users and administrators can choose from among four different methods to collect diagnostic information from HoloLens: - -- Feedback Hub app -- DiagnosticLog CSP -- Settings app -- Fallback diagnostics - -> [!IMPORTANT] -> Device diagnostic logs contain personally identifiable information (PII), such as about what processes or applications the user starts during typical operations. When multiple users share a HoloLens device (for example, users sign in to the same device by using different Microsoft Azure Active Directory (AAD) accounts) the diagnostic logs may contain PII information that applies to multiple users. For more information, see [Microsoft Privacy statement](https://privacy.microsoft.com/privacystatement). - -The following table compares the four collection methods. The method names link to more detailed information in the sections that follow the table. - -|Method |Prerequisites |Data locations |Data access and use |Data retention | -| --- | --- | --- | --- | --- | -|[Feedback Hub](#feedback-hub) |Network and internet connection

Feedback Hub app

Permission to upload files to the Microsoft cloud |Microsoft cloud

HoloLens device (optional) |User requests assistance, agrees to the terms of use, and uploads the data

Microsoft employees view the data, as consistent with the terms of use |Data in the cloud is retained for the period that is defined by Next Generation Privacy (NGP). Then the data is deleted automatically.

Data on the device can be deleted at any time by a user who has **Device owner** or **Admin** permissions. | -|[Settings Troubleshooter](#settings-troubleshooter) |Settings app |HoloLens device

Connected computer (optional) |The user stores the data, and only the user accesses the data (unless the user specifically shares the data with another user). |The data is retained until the user deletes it. | -|[DiagnosticLog CSP](#diagnosticlog-csp) |Network connection

MDM environment that supports the DiagnosticLog CSP |Administrator configures storage locations |In the managed environment, the user implicitly consents to administrator access to the data.

Administrator configures access roles and permissions. | Administrator configures retention policy. | -|[Fallback diagnostics](#fallback-diagnostics) |Device configuration:

  • Powered on and connected to computer
  • Power and Volume buttons functioning
|HoloLens device

Connected computer |The user stores the data, and only the user accesses the data (unless the user specifically shares the data with another user). |The data is retained until the user deletes it. | - -## Feedback Hub - -A HoloLens user can use the Microsoft Feedback Hub desktop app to send diagnostic information to Microsoft Support. For details and complete instructions, see [Give us feedback](hololens-feedback.md). - -> [!NOTE] -> **Commercial or enterprise users:** If you use the Feedback Hub app to report a problem that relates to MDM, provisioning, or any other device management aspect, change the app category to **Enterprise Management** > **Device category**. - -### Prerequisites - -- The device is connected to a network. -- The Feedback Hub app is available on the user's desktop computer, and the user can upload files to the Microsoft cloud. - -### Data locations, access, and retention - -By agreeing to the terms-of-use of the Feedback Hub, the user explicitly consents to the storage and usage of the data (as defined by that agreement). - -The Feedback Hub provides two places for the user to store diagnostic information: - -- **The Microsoft cloud**. Data that the user uploads by using the Feedback Hub app is stored for the number of days that is consistent with Next Generation Privacy (NGP) requirements. Microsoft employees can use an NGP-compliant viewer to access the information during this period. - > [!NOTE] - > These requirements apply to data in all Feedback Hub categories. - -- **The HoloLens device**. While filing a report in Feedback Hub, the user can select **Save a local copy of diagnostics and attachments created when giving feedback**. If the user selects this option, the Feedback Hub stores a copy of the diagnostic information on the HoloLens device. This information remains accessible to the user (or anyone that uses that account to sign in to HoloLens). To delete this information, a user must have **Device owner** or **Admin** permissions on the device. A user who has the appropriate permissions can sign in to the Feedback Hub, select **Settings** > **View diagnostics logs**, and delete the information. - -## Settings Troubleshooter - -A HoloLens user can use the Settings app on the device to troubleshoot problems and collect diagnostic information. To do this, follow these steps: - -1. Open the Settings app and select **Update & Security** > **Troubleshoot** page. -1. Select the appropriate area, and select **Start**. -1. Reproduce the issue. -1. After you reproduce the issue, return to Settings and then select **Stop**. - -### Prerequisites - -- The Settings app is installed on the device and is available to the user. - -### Data locations, access, and retention - -Because the user starts the data collection, the user implicitly consents to the storage of the diagnostic information. Only the user, or anyone with whom that the user shares the data, can access the data. - -The diagnostic information is stored on the device. If the device is connected to the user's computer, the information also resides on the computer in the following file: - -> This PC\\\<*HoloLens device name*>\\Internal Storage\\Documents\\Trace\<*ddmmyyhhmmss*>.etl - -> [!NOTE] -> In this file path and name, \<*HoloLens device name*> represents the name of the HoloLens device, and \<*ddmmyyhhmmss*> represents the date and time that the file was created. - -The diagnostic information remains in these locations until the user deletes it. - -## DiagnosticLog CSP - -In a Mobile Device Management (MDM) environment, the IT administrator can use the the [DiagnosticLog configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/diagnosticlog-csp) to configure diagnostic settings on enrolled HoloLens devices. The IT administrator can configure these settings to collect logs from enrolled devices. - -### Prerequisites - -- The device is connected to a network. -- The device is enrolled in an MDM environment that supports the DiagnosticLog CSP. - -### Data locations, access, and retention - -Because the device is part of the managed environment, the user implicitly consents to administrative access to diagnostic information. - -The IT administrator uses the DiagnosticLog CSP to configure the data storage, retention, and access policies, including the policies that govern the following: - -- The cloud infrastructure that stores the diagnostic information. -- The retention period for the diagnostic information. -- Permissions that control access to the diagnostic information. - -## Fallback diagnostics - -While device telemetry usually provides an initial understanding of a problem report, some issues require a broader and deeper understanding of the device state. When you (as a user or an administrator) investigate such issues, diagnostic logs that reside on the device are more useful than the basic device telemetry. - -The fallback diagnostics process provides a way for you to gather diagnostic information if no other methods are available. Such scenarios include the following: - -- The network or network-based resources (such as the Feedback Hub, MDM, and so on) are not available. -- The device is "stuck" or locked in a state in which usual troubleshooting capabilities (such as the Settings app) are not available. Such scenarios include the Out-of-Box-Experience (OOBE), kiosk mode, and a locked or "hung" user interface. - -> [!IMPORTANT] -> - On HoloLens 2 devices, you can use fallback diagnostics under the following conditions only: -> - During the Out-of-the-Box-Experience (OOBE) and when you select **Send Full Diagnostics Data**. -> - If the environment's Group Policy enforces the **System\AllowTelemetry** policy value of **Full**. -> - On HoloLens (1st gen) devices, you can use fallback diagnostics on HoloLens version 17763.316 or a later version. This version is the version that the Windows Device Recovery Tool restores when it resets the device. - -### How to use fallback diagnostics - -Before you start the fallback diagnostics process, make sure of the following: - -- The device is connected to a computer by using a USB cable. -- The device is powered on. -- The Power and Volume buttons on the device are functioning correctly. - -To collect fallback diagnostic information, follow these steps: - -1. On the device, press the Power and Volume Down buttons at the same time and then release them. -1. Wait for few seconds while the device collects the data. - -### Data locations - -The device stores the data locally. You can access that information from the connected desktop computer at the following location: - -> This PC\\\<*HoloLens device name*>\\Internal Storage\\Documents - -For more information about the files that the fallback diagnostics process collects, see [What diagnostics files does the fallback diagnostics process collect?](#what-diagnostics-files-does-the-fallback-diagnostics-process-collect). - -### Data access, use, and retention - -Because you store the data yourself, only you have access to the data. If you choose to share the data with another user, you implicitly grant permission for that user to access or store the data. - -The data remains until you delete it. - -### Frequently asked questions about fallback diagnostics on HoloLens - -#### Does the device have to be enrolled with an MDM system? - -No. - -#### How can I use fallback diagnostics on HoloLens? - -Before you start the fallback diagnostics process, make sure of the following: - -- The device is connected to a computer by using a USB cable. -- The device is powered on. -- The Power and Volume buttons on the device are functioning correctly. - -To collect fallback diagnostic information, follow these steps: - -1. On the device, press the Power and Volume Down buttons at the same time and then release them. -1. Wait for few seconds while the device collects the data. - -#### How would I know that data collection finished? - -The fallback diagnostics process does not have a user interface. On HoloLens 2, when the process starts to collect data, it creates a file that is named HololensDiagnostics.temp. When the process finishes, it removes the file. - -#### What diagnostics files does the fallback diagnostics process collect? - -The fallback diagnostics process collects one or more .zip files, depending on the version of HoloLens. The following table lists each of the possible .zip files, and the applicable versions of HoloLens. - -|File |Contents |HoloLens (1st gen) |HoloLens 2 10.0.18362+ |HoloLens 2 10.0.19041+ | -| --- | --- | --- | --- | --- | -|HololensDiagnostics.zip |Files for tracing sessions that ran on the device.

Diagnostic information that's specific to Hololens. |✔️ |✔️ |✔️ | -|DeviceEnrollmentDiagnostics.zip |Information that's related to MDM, device enrollment, CSPs, and policies. | |✔️ |✔️ | -|AutoPilotDiagnostics.zip |Information that's related to autopilot and licensing.| | |✔️ | -|TPMDiagnostics.zip |Information that's related to the trusted platform module (TPM) on the device | | |✔️ | - -> [!NOTE] -> Starting on May 2, 2019, the fallback diagnostics process collects EventLog*.etl files only if the signed-in user is the device owner. This is because these files may contain PII data. Such data is accessible to device owners only. This behavior matches the behavior of Windows desktop computers, where administrators have access to event log files but other users do not. - -**Sample diagnostic content for HoloLens (1st gen)** - -HololensDiagnostics.zip contains files such as the following: - -- AuthLogon.etl -- EventLog-HupRe.etl.001 -- FirstExperience.etl.001 -- HetLog.etl -- HoloInput.etl.001 -- HoloShell.etl.001 -- WiFi.etl.001 - -**Sample diagnostic content for HoloLens 2 10.0.18362+** - -HololensDiagnostics.zip contains files such as the following: - -- EventLog-Application.etl.001* -- EventLog-System.etl.001* -- AuthLogon.etl -- EventLog-HupRe.etl.001 -- FirstExperience.etl.001 -- HetLog.etl -- HoloInput.etl.001 -- HoloShell.etl.001 -- WiFi.etl.001 -- CSPsAndPolicies.etl.001 -- RadioMgr.etl -- WiFiDriverIHVSession.etl - -DeviceEnrollmentDiagnostics.zip contains files such as the following: - -- MDMDiagHtmlReport.html -- MdmDiagLogMetadata.json -- MDMDiagReport.xml -- MdmDiagReport_RegistryDump.reg -- MdmLogCollectorFootPrint.txt - -**Sample diagnostic content for HoloLens 2 10.0.19041+** - -HololensDiagnostics.zip contains files such as the following: - -- EventLog-Application.etl.001* -- EventLog-System.etl.001* -- AuthLogon.etl -- EventLog-HupRe.etl.001 -- FirstExperience.etl.001 -- HetLog.etl -- HoloInput.etl.001 -- HoloShell.etl.001 -- WiFi.etl.001 -- CSPsAndPolicies.etl.001 -- RadioMgr.etl -- WiFiDriverIHVSession.etl -- DisplayDiagnosticData.json -- HUP dumps - -DeviceEnrollmentDiagnostics.zip contains files such as the following: - -- MDMDiagHtmlReport.html -- MdmDiagLogMetadata.json -- MDMDiagReport.xml -- MdmDiagReport_RegistryDump.reg -- MdmLogCollectorFootPrint.txt - -AutoPilotDiagnostics.zip contains files such as the following: - -- DeviceHash_HoloLens-U5603.csv -- LicensingDiag.cab -- LicensingDiag_Output.txt -- TpmHliInfo_Output.txt -- DiagnosticLogCSP_Collector_DeviceEnrollment_\*.etl -- DiagnosticLogCSP_Collector_Autopilot_*.etl - -TPMDiagnostics.zip contains files such as the following: - -- CertReq_enrollaik_Output.txt -- CertUtil_tpminfo_Output.txt -- TPM\*.etl diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md deleted file mode 100644 index 6b2cfb74bc..0000000000 --- a/devices/hololens/hololens-encryption.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Enable Bitlocker encryption for HoloLens (HoloLens) -description: Enable Bitlocker device encryption to protect files stored on the HoloLens -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 01/26/2019 -ms.reviewer: -manager: laurawi -appliesto: -- HoloLens (1st gen) ---- - -# Enable encryption for HoloLens - -HoloLens (1st gen) and HoloLens 2 both support device encryption using BitLocker, however, BitLocker is always enabled on HoloLens 2. - -This article will help you enable and manage BitLocker on HoloLens (1st gen). - -On HoloLens (1st gen) you can enable BitLocker device encryption manually or using mobile device management (MDM). Follow these instructions to enable [BitLocker device encryption](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) to protect files and information stored on the HoloLens. Device encryption helps protect your data using the AES-CBC 128 encryption method, which is equivalent to [EncryptionMethodByDriveType method 3](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype) in the BitLocker configuration service provider (CSP). Personnel who have the correct encryption key (such as a password) can decrypt it or perform a data recovery. - -## Enable device encryption using MDM - -You can use your Mobile Device Management (MDM) provider to apply a policy that requires device encryption. The policy to use is the [Security/RequireDeviceEncryption setting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-security#security-requiredeviceencryption) in the Policy CSP. - -[See instructions for enabling device encryption using Microsoft Intune.](https://docs.microsoft.com/intune/compliance-policy-create-windows#windows-holographic-for-business) - -For other MDM tools, see your MDM provider's documentation for instructions. If your MDM provider requires custom URI for device encryption, use the following configuration: - -- **Name**: a name of your choice -- **Description**: optional -- **OMA-URI**: `./Vendor/MSFT/Policy/Config/Security/RequireDeviceEncryption` -- **Data type**: integer -- **Value**: `1` - -## Enable device encryption using a provisioning package - -Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device. - -### Create a provisioning package that upgrades the Windows Holographic edition and enables encryption - -1. [Create a provisioning package for HoloLens.](hololens-provisioning.md) -1. Go to **Runtime settings** > **Policies** > **Security**, and select **RequireDeviceEncryption**. - - ![Require device encryption setting configured to yes](images/device-encryption.png) - -1. Find the XML license file that was provided when you purchased the Commercial Suite. - -1. Browse to and select the XML license file that was provided when you purchased the Commercial Suite. - > [!NOTE] - > You can configure [additional settings in the provisioning package](hololens-provisioning.md). - -1. On the **File** menu, click **Save**. - -1. Read the warning explaining that project files may contain sensitive information and click **OK**. - - > [!IMPORTANT] - > When you build a provisioning package, you may include sensitive information in the project files and provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when no longer needed. - -1. On the **Export** menu, click **Provisioning package**. -1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**. -1. Set a value for **Package Version**. - - > [!TIP] - > You can make changes to existing packages and change the version number to update previously applied packages. - -1. On the **Select security details for the provisioning package**, click **Next**. -1. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. - - Optionally, you can click Browse to change the default output location. - -1. Click **Next**. -1. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. -1. When the build completes, click **Finish**. - -### Apply the provisioning package to HoloLens - -1. Connect the device via USB to a PC and start the device, but do not continue past the **fit** page of the initial setup experience (the first page with the blue box). -1. Briefly press and release the **Volume Down** and **Power** buttons simultaneously. -1. HoloLens will show up as a device in File Explorer on the PC. -1. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. -1. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. -1. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. -1. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup. - -> [!NOTE] -> If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package. - -## Verify device encryption - -Encryption is silent on HoloLens. To verify the device encryption status: - -- On HoloLens, go to **Settings** > **System** > **About**. **BitLocker** is **enabled** if the device is encrypted. - - ![About screen showing BitLocker enabled](images/about-encryption.png) diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md deleted file mode 100644 index 0e557e9c50..0000000000 --- a/devices/hololens/hololens-enroll-mdm.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Enroll HoloLens in MDM -description: Enroll HoloLens in mobile device management (MDM) for easier management of multiple devices. -ms.prod: hololens -ms.sitesec: library -ms.assetid: 2a9b3fca-8370-44ec-8b57-fb98b8d317b0 -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: medium -ms.date: 07/15/2019 -ms.reviewer: -manager: laurawi -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Enroll HoloLens in MDM - -You can manage multiple Microsoft HoloLens devices simultaneously using solutions like [Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business). You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. See [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business), the [configuration service providers (CSPs) that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens), and the [policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies). - -> [!NOTE] -> Mobile device management (MDM), including the VPN, Bitlocker, and kiosk mode features, is only available when you [upgrade to Windows Holographic for Business](hololens1-upgrade-enterprise.md). - -## Requirements - - Your organization will need to have Mobile Device Management (MDM) set up in order to manage HoloLens devices. Your MDM provider can be Microsoft Intune or a 3rd party provider that uses Microsoft MDM APIs. - -## Auto-enrollment in MDM - -If your organization uses Azure Active Directory (Azure AD) and an MDM solution that accepts an AAD token for authentication (currently, only supported in Microsoft Intune and AirWatch), your IT admin can configure Azure AD to automatically allow MDM enrollment after the user signs in with their Azure AD account. [Learn how to configure Azure AD enrollment.](https://docs.microsoft.com/mem/intune/enrollment/windows-enroll#enable-windows-10-automatic-enrollment) - -When auto-enrollment is enabled, no additional manual enrollment is needed. When the user signs in with an Azure AD account, the device is enrolled in MDM after completing the first-run experience. - -## Enroll through Settings app - - When the device is not enrolled in MDM during the first-run experience, the user can manually enroll the device with the organization's MDM server using the Settings app. - -1. Go to **Settings** > **Accounts** > **Work access**. -1. Select **Enroll into device management** and enter your organizational account. You will be redirected to your organization's sign in page. -1. Upon successful authentication to the MDM server, a success message is shown. - -Your device is now enrolled with your MDM server. The device will need to restart to acquire policies, certificates, and apps. The Settings app will now reflect that the device is enrolled in device management. - -## Unenroll HoloLens from Intune - -You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard. diff --git a/devices/hololens/hololens-environment-considerations.md b/devices/hololens/hololens-environment-considerations.md deleted file mode 100644 index bdd500b298..0000000000 --- a/devices/hololens/hololens-environment-considerations.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: Environment considerations for HoloLens -description: Get the best possible experience using HoloLens when you optimize the device for your eyes and environment. Many different environmental factors are fused together to enable tracking, but as a Mixed Reality developer, there are several factors you can keep in mind to tune a space for better holograms. -keywords: holographic frame, field of view, fov, calibration, spaces, environment, how-to -author: dorreneb -ms.author: dobrown -manager: jarrettr -ms.date: 8/29/2019 -ms.prod: hololens -ms.topic: article -audience: ITPro -ms.localizationpriority: high -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Environment considerations for HoloLens - -HoloLens blends the holographic with the "real" world, placing holograms in your surroundings. A holographic app window "hangs" on the wall, a holographic ballerina spins on the tabletop, bunny ears sit on top of your unwitting friend’s head. When you’re using an immersive game or app, the holographic world will spread to fill your surroundings but you’ll still be able to see and move around the space. - -The holograms you place will stay where you’ve put them, even if you turn off your device. - -## Setting up an environment - -HoloLens devices know how to place stable and accurate holograms by *tracking* users in a space. Without proper tracking, the device does not understand the environment or the user within it so holograms can appear in the wrong places, not appear in the same spot every time, or not appear at all. The data used to track users is represented in the *spatial map*. - -Tracking performance is heavily influenced by the environment the user is in, and tuning an environment to induce stable and consistent tracking is an art rather than a science. Many different environmental factors are fused together to enable tracking, but as a Mixed Reality developer, there are several factors you can keep in mind to tune a space for better tracking. - -### Lighting - -Windows Mixed Reality uses visual light to track the user's location. When an environment is too bright, the cameras can get saturated, and nothing is seen. If the environment is too dark, the cameras cannot pick up enough information, and nothing is seen. Lighting should be even and sufficiently bright that a human can see without effort, but not so bright that the light is painful to look at. - -Areas where there are points of bright light in an overall dim area are also problematic, as the camera has to adjust when moving in and out of bright spaces. This can cause the device to "get lost" and think that the change in light equates to a change in location. Stable light levels in an area will lead to better tracking. - -Any outdoor lighting can also cause instability in the tracker, as the sun may vary considerably over time. For example, tracking in the same space in the summer vs. winter can produce drastically different results, as the secondhand light outside may be higher at different times of year. - -If you have a luxmeter, a steady 500-1000 lux is a good place to start. - -#### Types of lighting - -Different types of light in a space can also influence tracking. Light bulbs pulse with the AC electricity running through it - if the AC frequency is 50Hz, then the light pulses at 50Hz. For a human, this pulsing is not noticed. However, HoloLens' 30fps camera sees these changes - some frames will be well-lit, some will be poorly lit, and some will be over-exposed as the camera tries to compensate for light pulses. - -In the USA, electricity frequency standard is 60Hz, so light bulb pulses are harmonized with HoloLens' framerate - 60Hz pulses align with HoloLens' 30 FPS framerate. However, many countries have an AC frequency standard of 50Hz, which means some HoloLens frames will be taken during pulses, and others will not. In particular, fluorescent lighting in Europe has been known to cause issues. - -There are a few things you can try to resolve flickering issues. Temperature, bulb age, and warm-up cycles are common causes of fluorescent flickering and replacing bulbs may help. Tightening bulbs and making sure current draws are constant can also help. - -### Items in a space - -HoloLens uses unique environmental landmarks, also known as *features*, to locate itself in a space. - -A device can almost never track in a feature-poor area, as the device has no way of knowing where in space it is. Adding features to the walls of a space is usually a good way to improve tracking. Posters, symbols taped to a wall, plants, unique objects, or other similar items all help. A messy desk is a good example of an environment that leads to good tracking - there are a lot of different features in a single area. - -Additionally, use unique features in the same space. The same poster repeated multiple times over a wall, for example, will cause device confusion as the HoloLens won't know which of the repetitive posters it is looking at. One common way of adding unique features is to use lines of masking tape to create unique, non-repetitive patterns along the walls and floor of a space. - -A good question to ask yourself is: if you saw just a small amount of the scene, could you uniquely locate yourself in the space? If not, it's likely the device will have problems tracking as well. - -#### Wormholes - -If you have two areas or regions that look the same, the tracker may think they are the same. This results in the device tricking itself into thinking it is somewhere else. We call these types of repetitive areas *wormholes*. - -To prevent wormholes, try to prevent identical areas in the same space. Identical areas can sometimes include factory stations, windows on a building, server racks, or work stations. Labelling areas or adding unique features to each similar-looking areas can help mitigate wormholes. - -### Movement in a space - -If your environment is constantly shifting and changing, the device has no stable features to locate against. - -The more moving objects that are in a space, including people, the easier it is to lose tracking. Moving conveyor belts, items in different states of construction, and lots of people in a space have all been known to cause tracking issues. - -The HoloLens can quickly adapt to these changes, but only when that area is clearly visible to the device. Areas that are not seen as frequently may lag behind reality, which can cause errors in the spatial map. For example, a user scans a friend and then turns around while the friend leaves the room. A 'ghost' representation of the friend will persist in the spatial mapping data until the user re-scans the now empty space. - -### Proximity of the user to items in the space - -Similarly to how humans cannot focus well on objects close to the eyes, HoloLens struggles when objects are close to it's cameras. If an object is too close to be seen with both cameras, or if an object is blocking one camera, the device will have far more issues with tracking against the object. - -The cameras can see no closer than 15cm from an object. - -### Surfaces in a space - -Strongly reflective surfaces will likely look different depending on the angle, which affects tracking. Think of a brand new car - when you move around it, light reflects and you see different objects in the surface as you move. To the tracker, the different objects reflected in the surface represent a changing environment, and the device loses tracking. - -Less shiny objects are easier to track against. - -### Wi-Fi fingerprint considerations - -As long as Wi-Fi is enabled, map data will be correlated with a Wi-Fi fingerprint, even when not connected to an actual WiFi network/router. Without Wi-Fi info, the space and holograms may be slightly slower to recognize. If the Wi-Fi signals change significantly, the device may think it is in a different space altogether. - -Network identification (such as SSID or MAC address) is not sent to Microsoft, and all Wi-Fi references are kept local on the HoloLens. - -## Mapping new spaces - -When you enter a new space (or load an existing one), you’ll see a mesh graphic spreading over the space. This means your device is mapping your surroundings. While a HoloLens will learn a space over time, there are tips and tricks to map spaces. - -## Environment management - -There are two settings which enable users to “clean up” holograms and cause HoloLens to “forget" a space. They exist in **Holograms and environments** in the settings app, with the second setting also appearing under **Privacy** in the settings app. - -1. **Delete nearby holograms**. When you select this setting, HoloLens will erase all anchored holograms and all stored map data for the “current space” where the device is located. A new map section would be created and stored in the database for that location once holograms are again placed in that same space. - -1. **Delete all holograms**.By selecting this setting, HoloLens will erase ALL map data and anchored holograms in the entire databases of spaces. No holograms will be rediscovered and any holograms need to be newly placed to again store map sections in the database. - -## Hologram quality - -Holograms can be placed throughout your environment—high, low, and all around you—but you’ll see them through a [holographic frame](https://docs.microsoft.com/windows/mixed-reality/holographic-frame) that sits in front of your eyes. To get the best view, make sure to adjust your device so you can see the entire frame. And don’t hesitate to walk around your environment and explore! - -For your [holograms](https://docs.microsoft.com/windows/mixed-reality/hologram) to look crisp, clear, and stable, your HoloLens needs to be calibrated just for you. When you first set up your HoloLens, you’ll be guided through this process. Later on, if holograms don’t look right or you’re seeing a lot of errors, you can make adjustments. - -If you are having trouble mapping spaces, try deleting nearby holograms and remapping the space. - -### Calibration - -If your holograms look jittery or shaky, or if you’re having trouble placing holograms, the first thing to try is the [Calibration app](hololens-calibration.md). This app can also help if you’re experiencing any discomfort while using your HoloLens. - -To get to the Calibration app, go to **Settings** > **System** > **Utilities**. Select **Open Calibration** and follow the instructions. - -If someone else is going to be using your HoloLens, they should run the Calibration app first so the device is set up properly for them. - -## See also - -- [Spatial mapping design](https://docs.microsoft.com/windows/mixed-reality/spatial-mapping) -- [Holograms](https://docs.microsoft.com/windows/mixed-reality/hologram) diff --git a/devices/hololens/hololens-faq-security.md b/devices/hololens/hololens-faq-security.md deleted file mode 100644 index 85f66c8318..0000000000 --- a/devices/hololens/hololens-faq-security.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Frequently Asked Security Questions -description: security questions frequently asked about the hololens -ms.assetid: bd55ecd1-697a-4b09-8274-48d1499fcb0b -author: pawinfie -ms.author: pawinfie -ms.date: 02/19/2020 -keywords: hololens, Windows Mixed Reality, security -ms.prod: hololens -ms.sitesec: library -ms.topic: article -audience: ITPro -ms.localizationpriority: high -ms.custom: -- CI 111456 -- CSSTroubleshooting -manager: bradke -appliesto: -- HoloLens 1 (1st gen) -- HoloLens 2 ---- - -# Frequently asked questions about HoloLens security - -## HoloLens (1st gen) Security Questions - -1. **What type of wireless is used?** - 1. 802.11ac and Bluetooth 4.1 LE -1. **What type of architecture is incorporated? For example: point to point, mesh or something else?** - 1. Wi-Fi can be used in infrastructure mode to communicate with other wireless access points. - 1. Bluetooth can be used to talk peer to peer between multiple HoloLens if the customers application supports it or to other Bluetooth devices. -1. **What is FCC ID?** - 1. C3K1688 -1. **What frequency range and channels does the device operate on and is it configurable?** - 1. Wi-Fi: The frequency range is not user configurable and depends on the country of use. In the US Wi-Fi uses both 2.4 GHz (1-11) channels and 5 GHz (36-64, 100-165) channels. - 1. Bluetooth: Bluetooth uses the standard 2.4-2.48 GHz range. -1. **Can the device blacklist or white list specific frequencies?** - 1. This is not controllable by the user/device -1. **What is the power level for both transmit and receive? Is it adjustable? What is the range of operation?** - 1. Our emissions testing standards can be found [here](https://fccid.io/C3K1688). Range of operation is highly dependent on the access point and environment - but is roughly equivalent to other high-quality phones, tablets, or PCs. -1. **What is the duty cycle/lifetime for normal operation?** - 1. 2-3hrs of active use and up to 2 weeks of standby time - 1. Battery lifetime is unavailable. -1. **What is transmit and receive behavior when a tool is not in range?** - 1. HoloLens transmit/receive follows the standard Wi-Fi/Bluetooth pattern. At the edge of its range, you'll probably notice input getting choppy until it fully disconnects, but after you get back in range it should quickly reconnect. -1. **What is deployment density per square foot?** - 1. This is dependent on your network infrastructure. -1. **Can device use the infrastructure as a client?** - 1. Yes -1. **What protocol is used?** - 1. HoloLens does not use any proprietary protocols -1. **OS update frequency – What is the frequency of OS updates for the HL? Is there a set schedule? Does Microsoft release security patches as needed, etc.** - 1. Microsoft does provide OS updates to HoloLens exactly the same way it is done for Windows 10. There are normally two major updates per year, one in spring, one in fall. As HoloLens is a Windows device, the update concept is the same as with any other Windows device. Microsoft releases Security patches as needed and follows the same concept as done on any other Windows device. -1. **OS hardening – What options are there to harden the OS? Can we remove or shutdown unnecessary apps or services?** - 1. HoloLens behaves like a smartphone. It is comparable to other modern Windows devices. HoloLens can be managed by either Microsoft Intune or other Modern Device Management Solutions, like MobileIron, Airwatch, or Soti. There are Policies you can set in these Management Systems to put Security policies on the device and in order to harden the device. There is also the option in deleting any unnecessary applications if wanted. -1. **How will software applications be managed and updated? What control do we have to define what apps are loaded and app update process for apps that are living in the Microsoft store?** - 1. HoloLens gets software applications only through the Windows store. Only Appx Application Packages can be installed, which are developed for the Use of HoloLens. You can see this in the Microsoft Store with a little logo next to the application which shows the HoloLens device. Any control that you have over the management of Store applications also applies to HoloLens. You can use the concept of the official store or the store for business. Apps can either be side-loaded (manual process to load an app on a Windows device) or can be managed through an MDM so that apps are automatically pulled from the store when needed. -1. **What is the frequency of updates to apps in the store for HoloLens?** - 1. As we follow the same concept of the Microsoft Store and pull apps from there, the update cycle is determined by the developer of the Application. All management options that you have to control the update mechanism in the store apply to HoloLens as well. -1. **Is there a secure boot capability for the HoloLens?** - 1. Yes -1. **Is there an ability to disable or disconnect peripheral support from the device?** - 1. Yes -1. **Is there an ability to control or disable the use of ports on the device?** - 1. The HoloLens only contains 2 ports (one for headphones and one for charging or connecting to PCs). There is not ability to disable the port due to functionality and recovery reasons. -1. **Antivirus, end point detection, IPS, app control whitelist – Any ability to run antivirus, end point detection, IPS, app control whitelist, etc.** - 1. Windows Holographic for Business (commercial suite) does support Windows Defender Smart Screen. If an antivirus company were to create and publish their app to the Universal Windows Platform, it could be downloaded on HoloLens. At present, no companies have done this for HoloLens. - 1. Whitelisting apps is possible by using the Microsoft Enterprise Store, where you can choose only what specific apps can be downloaded. Also, through MDM you can lock what specific apps can be run or even seen on the device. -1. **Can we quarantine the device from prod network until we update the device if it has been offline for an extended period of time? Ex. Device has been sitting in a drawer not powered up for a period (6 months) and has not received any updates, patches, etc. When it tries to come on the network can we flag it and say you must update on another network prior to being complaint to join the network.** - 1. This is something that can be managed on the infrastructure level by either an MDM or an on-prem server. The device can be flagged as not compliant if it does not meet a specified Update version. -1. **Does Microsoft include any back doors or access to services that allows Microsoft to connect to the device for screen sharing or remote support at will?** - 1. No -1. **When a PKI cert is being generated for trusted communication, we want the cert to be generated on the device so that we know it's only on that device, unique to that device, and can't be exported or used to impersonate the device. Is this true on HoloLens? If not is there a potential mitigation?** - 1. CSR for SCEP is generated on the device itself. Intune and the on premise SCEP connector help secure the requests themselves by adding and verifying a challenge string that's sent to the client. - 1. Since HoloLens (1st Gen and 2nd Gen) have a TPM module, these certs would be stored in the TPM module, and are unable to be extracted. Additionally, even if it could be extracted, the challenge strings couldn't be verified on a different device, rendering the certs/key unusable on different devices. - -## HoloLens 2nd Gen Security Questions - -1. **What type of wireless is used?** - 1. 802.11ac and Bluetooth 5.0 -1. **What type of architecture is incorporated? For example: point to point, mesh or something else?** - 1. Wi-Fi can be used in infrastructure mode to communicate with other wireless access points. - 1. Bluetooth can be used to talk peer to peer between multiple HoloLens if the customers application supports it or to other Bluetooth devices. -1. **What is FCC ID?** - 1. C3K1855 -1. **What frequency range and channels does the device operate on and is it configurable?** - 1. Wi-Fi: The frequency range is not user configurable and depends on the country of use. In the US Wi-Fi uses both 2.4 GHz (1-11) channels and 5 GHz (36-64, 100-165) channels. -1. **Can the device blacklist or white list specific frequencies?** - 1. This is not controllable by the user/device -1. **What is the power level for both transmit and receive? Is it adjustable? What is the range of operation?** - 1. Wireless power levels depend on the channel of operation. Devices are calibrated to perform at the highest power levels allowed based on the region's regulatory rules. -1. **What is the duty cycle/lifetime for normal operation?** - 1. *Currently unavailable.* -1. **What is transmit and receive behavior when a tool is not in range?** - 1. HoloLens transmit/receive follows the standard Wi-Fi/Bluetooth pattern. At the edge of its range, you'll probably notice input getting choppy until it fully disconnects, but after you get back in range it should quickly reconnect. -1. **What is deployment density per square foot?** - 1. This is dependent on your network infrastructure. -1. **Can device use the infrastructure as a client?** - 1. Yes -1. **What protocol is used?** - 1. HoloLens does not use any proprietary protocols -1. **OS update frequency – What is the frequency of OS updates for the HL? Is there a set schedule? Does Microsoft release security patches as needed, etc.** - 1. Microsoft does provide OS updates to HoloLens exactly the same way it is done for Windows 10. There are normally two major updates per year, one in spring, one in fall. As HoloLens is a Windows device, the update concept is the same as with any other Windows device. Microsoft releases Security patches as needed and follows the same concept as done on any other Windows device. -1. **OS hardening – What options are there to harden the OS? Can we remove or shutdown unnecessary apps or services?** - 1. HoloLens behaves like a smartphone. It is comparable to other modern Windows devices. HoloLens can be managed by either Microsoft Intune or other Modern Device Management Solutions, like MobileIron, Airwatch, or Soti. There are Policies you can set in these Management Systems to put Security policies on the device and in order to harden the device. There is also the option in deleting any unnecessary applications if wanted. -1. **How will software applications be managed and updated? What control do we have to define what apps are loaded and app update process for apps that are living in the Microsoft store?** - 1. HoloLens gets software applications only through the Windows store. Only Appx Application Packages can be installed, which are developed for the Use of HoloLens. You can see this in the Microsoft Store with a little logo next to the application which shows the HoloLens device. Any control that you have over the management of Store applications also applies to HoloLens. You can use the concept of the official store or the store for business. Apps can either be side-loaded (manual process to load an app on a Windows device) or can be managed through an MDM so that apps are automatically pulled from the store when needed. -1. **What is the frequency of updates to apps in the store for HoloLens?** - 1. As we follow the same concept of the Microsoft Store and pull apps from there, the update cycle is determined by the developer of the Application. All management options that you have to control the update mechanism in the store apply to HoloLens as well. -1. **Is there a secure boot capability for the HoloLens?** - 1. Yes -1. **Is there an ability to disable or disconnect peripheral support from the device?** - 1. Yes -1. **Is there an ability to control or disable the use of ports on the device?** - 1. The HoloLens only contains 2 ports (one for headphones and one for charging or connecting to PCs). There is not ability to disable the port due to functionality and recovery reasons. -1. **Antivirus, end point detection, IPS, app control whitelist – Any ability to run antivirus, end point detection, IPS, app control whitelist, etc.** - 1. HoloLens 2nd Gen supports Windows Defender Smart Screen. If an antivirus company were to create and publish their app to the Universal Windows Platform, it could be downloaded on HoloLens. At present, no companies have done this for HoloLens. - 1. Whitelisting apps is possible by using the Microsoft Enterprise Store, where you can choose only what specific apps can be downloaded. Also, through MDM you can lock what specific apps can be run or even seen on the device. -1. **Can we quarantine the device from prod network until we update the device if it has been offline for an extended period of time? Ex. Device has been sitting in a drawer not powered up for a period (6 months) and has not received any updates, patches, etc. When it tries to come on the network can we flag it and say you must update on another network prior to being complaint to join the network.** - 1. This is something that can be managed on the infrastructure level by either an MDM or an on-prem server. The device can be flagged as not compliant if it does not meet a specified Update version. -1. **Does Microsoft include any back doors or access to services that allows Microsoft to connect to the device for screen sharing or remote support at will?** - 1. No -1. **When a PKI cert is being generated for trusted communication, we want the cert to be generated on the device so that we know it's only on that device, unique to that device, and can't be exported or used to impersonate the device. Is this true on HoloLens? If not is there a potential mitigation?** - 1. CSR for SCEP is generated on the device itself. Intune and the on premise SCEP connector help secure the requests themselves by adding and verifying a challenge string that's sent to the client. - 1. Since HoloLens (1st Gen and 2nd Gen) have a TPM module, these certs would be stored in the TPM module, and are unable to be extracted. Additionally, even if it could be extracted, the challenge strings couldn't be verified on a different device, rendering the certs/key unusable on different devices. diff --git a/devices/hololens/hololens-feedback.md b/devices/hololens/hololens-feedback.md deleted file mode 100644 index 3199517a90..0000000000 --- a/devices/hololens/hololens-feedback.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Give us feedback -description: Create actionable feedback for HoloLens and Windows Mixed Reality developers by using the Feedback Hub. -ms.assetid: b9b24c72-ff86-44a9-b30d-dd76c49479a9 -author: mattzmsft -ms.author: mazeller -ms.date: 09/13/2019 -ms.prod: hololens -ms.topic: article -keywords: feedback, bug, issue, error, troubleshoot, help -manager: jarrettr -ms.localizationpriority: medium -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Give us feedback - -Use the Feedback Hub to tell us which features you love, which features you could do without, or when something could be better. - -## Feedback for Windows Mixed Reality immersive headset on PC - -> [!IMPORTANT] -> Before you report an issue, make sure that your environment meets the following requirements so that you can successfully upload logs and other information: -> -> - Have a minimum of 3GB free disk space available on the main drive of the device. -> - To upload cabs or other large files, connect to a non-metered network. - -1. Make sure that you have the immersive headset connected to your PC, and then on the desktop, select **Feedback Hub**. -1. In the left pane, select **Feedback**. - ![Feedback tab](images/feedback1-600px.png) -1. To enter new feedback, select **Add new feedback**. - ![Add new feedback](images/feedback2-600px.png) -1. To make feedback actionable, in **What kind of feedback is this?** select **Problem**. -1. In **Summarize your issue**, enter a meaningful title for your feedback. -1. In **Give us more detail**, provide details and repro steps. - ![Details and repro steps](images/feedback3-600px.png) - - As the top category, select **Mixed Reality**. Then select an applicable subcategory, as explained in the following table: - - |Subcategory |Description | - |----------|----------| - | Apps | Issues about a specific application. | - | Developer | Issues about authoring or running an app for Mixed Reality. | - | Device | Issues about the head-mounted device (HMD) itself. | - | Home experience | Issues about your VR environment and your interactions with the your mixed reality home. | - | Input | Issues about input methods, such as motion controllers, speech, gamepad, or mouse and keyboard. | - | Set up | Anything that is preventing you from setting up the device. | - | All other issues | Anything else. | - -1. If possible, add traces or video to your feedback to help us identify and fix the issue more quickly. To do this, follow these steps: - 1. To start collecting traces, select **Start capture**. The app starts collecting traces and a video capture of your mixed reality scenario. - - ![Start Capture](images/feedback4-600px.png) - 1. Do not close the Feedback Hub app, but switch to the scenario that produces the issue. Run through the scenario to produce the circumstances that you have described. - 1. After you finish your scenario, go back to the Feedback Hub app and select **Stop capture**. The app stops collecting information, stores the information in a file, and attaches the file to your feedback. -1. Select **Submit**. - ![Submit](images/feedback5-600px.png) - The Thank You page indicates that your feedback has been successfully submitted. - ![Thank You](images/feedback6-600px.png) - -To easily direct other people (such as co-workers, Microsoft staff, [forum](https://forums.hololens.com/) readers et al) to the issue, go to **Feedback** > **My Feedback**, select the issue, select **Share**. This action provides a shortened URL that you can give to others so that they can upvote or escalate your issue. - -## Feedback for HoloLens - -1. Use the **bloom** gesture to open the **Start** menu, and then select **Feedback Hub**. - - ![Start menu on Microsoft HoloLens](images/startmenu.jpg) -1. Place the app in your environment and then select the app to launch it. -1. To see if someone else has given similar feedback, in the Feedback search box, enter a few keywords about the topic. - - ![Search Feedback](images/searchfeedback-500px.jpg) -1. If you find similar feedback, select it, add any details, then select **Upvote**. - - ![Upvote existing Feedback](images/upvotefeedback-500px.jpg) -1. If you don’t find any similar feedback, select **Add new feedback**, select a topic from **Select a category**, and then select a subcategory from **Select a subcategory**. - - ![Add new Feedback](images/addnewfeedback-500px.jpg) -1. Enter your feedback. -1. If you are reporting a reproducible issue, you can select **Reproduce**. Without closing Feedback Hub, reproduce the issue. After you finish, come back to Feedback Hub and select **I’m done**. The app adds a mixed reality capture of your repro and relevant diagnostic logs to your feedback. -1. Select **Post feedback**, and you’re done. diff --git a/devices/hololens/hololens-identity.md b/devices/hololens/hololens-identity.md deleted file mode 100644 index e1fab33818..0000000000 --- a/devices/hololens/hololens-identity.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Manage user identity and sign-in for HoloLens -description: Manage user identity, security, and sign-in for HoloLens. -keywords: HoloLens, user, account, aad, adfs, microsoft account, msa, credentials, reference -ms.assetid: 728cfff2-81ce-4eb8-9aaa-0a3c3304660e -author: scooley -ms.author: scooley -ms.date: 1/6/2020 -ms.prod: hololens -ms.custom: -- CI 111456 -- CSSTroubleshooting -ms.topic: article -ms.sitesec: library -ms.topic: article -ms.localizationpriority: medium -audience: ITPro -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Manage user identity and sign-in for HoloLens - -> [!NOTE] -> This article is a technical reference for IT Pros and tech enthusiasts. If you're looking for HoloLens set up instructions, read "[Setting up your HoloLens (1st gen)](hololens1-start.md)" or "[Setting up your HoloLens 2](hololens2-start.md)". - -Like other Windows devices, HoloLens always operates under a user context. There is always a user identity. HoloLens treats identity in almost the same manner as other Windows 10 devices do. This article is a deep-dive reference for identity on HoloLens, and focuses on how HoloLens differs from other Windows 10 devices. - -HoloLens supports several kinds of user identities. You can use one or more user accounts to sign in. Here's an overview of the identity types and authentication options on HoloLens: - -| Identity type | Accounts per device | Authentication options | -| --- | --- | --- | -| [Azure Active Directory (AAD)](https://docs.microsoft.com/azure/active-directory/) | 32 (see details) |
  • Azure web credential provider
  • Azure Authenticator App
  • Biometric (Iris) – HoloLens 2 only
  • PIN – Optional for HoloLens (1st gen), required for HoloLens 2
  • Password
| -| [Microsoft Account (MSA)](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts) | 1 |
  • Biometric (Iris) – HoloLens 2 only
  • PIN – Optional for HoloLens (1st gen), required for HoloLens 2
  • Password
| -| [Local account](https://docs.microsoft.com/windows/security/identity-protection/access-control/local-accounts) | 1 | Password | - -Cloud-connected accounts (AAD and MSA) offer more features because they can use Azure services. - -## Setting up users - -The most common way to set up a new user is during the HoloLens out-of-box experience (OOBE). During setup, HoloLens prompts for a user to sign in by using the account that they want to use on the device. This account can be a consumer Microsoft account or an enterprise account that has been configured in Azure. See Setting up your [HoloLens (1st gen)](hololens1-start.md) or [HoloLens 2](hololens2-start.md). - -Like Windows on other devices, signing in during setup creates a user profile on the device. The user profile stores apps and data. The same account also provides Single Sign-on for apps such as Edge or Skype by using the Windows Account Manager APIs. - -If you use an enterprise or organizational account to sign in to HoloLens, HoloLens enrolls in the organization's IT infrastructure. This enrollment allows your IT Admin to configure Mobile Device Management (MDM) to send group policies to your HoloLens. - -By default, as for other Windows 10 devices, you'll have to sign in again when HoloLens restarts or resumes from standby. You can use the Settings app to change this behavior, or the behavior can be controlled by group policy. - -### Linked accounts - -As in the Desktop version of Windows, you can link additional web account credentials to your HoloLens account. Such linking makes it easier to access resources across or within apps (such as the Store) or to combine access to personal and work resources. After you connect an account to the device, you can grant permission to use the device to apps so that you don't have to sign in to each app individually. - -Linking accounts does not separate the user data created on the device, such as images or downloads. - -### Setting up multi-user support (AAD only) - -> [!NOTE] -> **HoloLens (1st gen)** began supporting multiple AAD users in the [Windows 10 April 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018) as part of [Windows Holographic for Business](hololens-upgrade-enterprise.md). - -HoloLens supports multiple users from the same AAD tenant. To use this feature, you must use an account that belongs to your organization to set up the device. Subsequently, other users from the same tenant can sign in to the device from the sign-in screen or by tapping the user tile on the Start panel. Only one user can be signed in at a time. When a user signs in, HoloLens signs out the previous user. - -All users can use the apps installed on the device. However, each user has their own app data and preferences. Removing an app from the device removes it for all users. - -## Removing users - -You can remove a user from the device by going to **Settings** > **Accounts** > **Other people**. This action also reclaims space by removing all of that user's app data from the device. - -## Using single sign-on within an app - -As an app developer, you can take advantage of linked identities on HoloLens by using the [Windows Account Manager APIs](https://docs.microsoft.com/uwp/api/Windows.Security.Authentication.Web.Core), just as you would on other Windows devices. Some code samples for these APIs are available [here](https://go.microsoft.com/fwlink/p/?LinkId=620621). - -Any account interrupts that might occur, such as requesting user consent for account information, two-factor authentication, and so forth, must be handled when the app requests an authentication token. - -If your app requires a specific account type that hasn't been linked previously, your app can ask the system to prompt the user to add one. This request triggers the account settings pane to launch as a modal child of your app. For 2D apps, this window renders directly over the center of your app. For Unity apps, this request briefly takes the user out of your holographic app to render the child window. For information about customizing the commands and actions on this pane, see [WebAccountCommand Class](https://docs.microsoft.com/uwp/api/Windows.UI.ApplicationSettings.WebAccountCommand). - -## Enterprise and other authentication - -If your app uses other types of authentication, such as NTLM, Basic, or Kerberos, you can use [Windows Credential UI](https://docs.microsoft.com/uwp/api/Windows.Security.Credentials.UI) to collect, process, and store the user's credentials. The user experience for collecting these credentials is very similar to other cloud-driven account interrupts, and appears as a child app on top of your 2D app or briefly suspends a Unity app to show the UI. - -## Deprecated APIs - -One way in which developing for HoloLens differs from developing for Desktop is that the [OnlineIDAuthenticator](https://docs.microsoft.com/uwp/api/Windows.Security.Authentication.OnlineId.OnlineIdAuthenticator) API is not fully supported. Although the API returns a token if the primary account is in good-standing, interrupts such as those described in this article do not display any UI for the user and fail to correctly authenticate the account. - -## Frequently asked questions - -### Is Windows Hello for Business supported on HoloLens? - -Windows Hello for Business (which supports using a PIN to sign in) is supported for HoloLens. To allow Windows Hello for Business PIN sign-in on HoloLens: - -1. The HoloLens device must be [managed by MDM](hololens-enroll-mdm.md). -1. You must enable Windows Hello for Business for the device. ([See instructions for Microsoft Intune.](https://docs.microsoft.com/intune/windows-hello)) -1. On HoloLens, the user can then use **Settings** > **Sign-in Options** > **Add PIN** to set up a PIN. - -> [!NOTE] -> Users who sign in by using a Microsoft account can also set up a PIN in **Settings** > **Sign-in Options** > **Add PIN**. This PIN is associated with [Windows Hello](https://support.microsoft.com/help/17215/windows-10-what-is-hello), rather than [Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview). - -#### Does the type of account change the sign-in behavior? - -Yes, the behavior for the type of account affects the sign-in behavior. If you apply policies for sign-in, the policy is always respected. If no policy for sign-in is applied, these are the default behaviors for each account type: - -- **Microsoft account**: signs in automatically -- **Local account**: always asks for password, not configurable in **Settings** -- **Azure AD**: asks for password by default, and configurable by **Settings** to no longer ask for password. - -> [!NOTE] -> Inactivity timers are currently not supported, which means that the **AllowIdleReturnWithoutPassword** policy is only respected when the device goes into StandBy. - -## Additional resources - -Read much more about user identity protection and authentication on [the Windows 10 security and identity documentation](https://docs.microsoft.com/windows/security/identity-protection/). - -Learn more about setting up hybrid identity infrastructure thorough the [Azure Hybrid identity documentation](https://docs.microsoft.com/azure/active-directory/hybrid/). diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md deleted file mode 100644 index c4d1cee1a2..0000000000 --- a/devices/hololens/hololens-insider.md +++ /dev/null @@ -1,142 +0,0 @@ ---- -title: Insider preview for Microsoft HoloLens -description: It's simple to get started with Insider builds and to provide valuable feedback for our next major operating system update for HoloLens. -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: article -ms.custom: -- CI 111456 -- CSSTroubleshooting -ms.localizationpriority: medium -audience: ITPro -ms.date: 4/14/2020 -ms.reviewer: -manager: laurawi -appliesto: -- HoloLens 2 ---- - -# Insider preview for Microsoft HoloLens - -Welcome to the latest Insider Preview builds for HoloLens! It's simple to get started and provide valuable feedback for our next major operating system update for HoloLens. - -## Start receiving Insider builds - -On a HoloLens 2 device go to **Settings** -> **Update & Security** -> **Windows Insider Program** and select **Get started**. Link the account you used to register as a Windows Insider. - -Then, select **Active development of Windows**, choose whether you'd like to receive **Fast** or **Slow** builds, and review the program terms. - -Select **Confirm -> Restart Now** to finish up. After your device has rebooted, go to **Settings -> Update & Security -> Check for updates** to get the latest build. - -## Stop receiving Insider builds - -If you no longer want to receive Insider builds of Windows Holographic, you can opt out when your HoloLens is running a production build, or you can [recover your device](hololens-recovery.md) using the Advanced Recovery Companion to recover your device to a non-Insider version of Windows Holographic. - -To verify that your HoloLens is running a production build: - -1. Go to **Settings > System > About**, and find the build number. -1. [See the release notes for production build numbers.](hololens-release-notes.md) - -To opt out of Insider builds: - -1. On a HoloLens running a production build, go to **Settings > Update & Security > Windows Insider Program**, and select **Stop Insider builds**. -1. Follow the instructions to opt out your device. - -## Provide feedback and report issues - -Please use [the Feedback Hub app](hololens-feedback.md) on your HoloLens to provide feedback and report issues. Using Feedback Hub ensures that all necessary diagnostics information is included to help our engineers quickly debug and resolve the problem. Issues with the Chinese and Japanese version of HoloLens should be reported the same way. - -> [!NOTE] -> Be sure to accept the prompt that asks whether you'd like Feedback Hub to access your Documents folder (select **Yes** when prompted). - -## Note for developers - -You are welcome and encouraged to try developing your applications using Insider builds of HoloLens. Check out the [HoloLens Developer Documentation](https://developer.microsoft.com/windows/mixed-reality/development) to get started. Those same instructions work with Insider builds of HoloLens. You can use the same builds of Unity and Visual Studio that you're already using for HoloLens development. - - -## Windows Insider Release Notes - -HoloLens 2 Windows Insider builds are full of new features and improvements. Sign up for Windows Insider Fast or Slow flights to test them out! -Here's a quick summary of what's new: - -- Support for FIDO2 Security Keys to enable secure and easy authentication for shared devices -- Seamlessly apply a provisioning package from a USB drive to your HoloLens -- Use a provisioning packages to enroll your HoloLens to your Mobile Device Management system -- Use Windows Autopilot to set up and pre-configure new devices, quickly getting them ready for productive use. To participate in the program you'll need to meet a few requirements. While the program is in preview mode you'll need to be using Microsoft Intune. You'll need to use a tenant that is flighted for HoloLens. Lastly you'll need to have installed an insider preview buildon your HoloLens 2. To praticipate in the preview of this new program send a note to hlappreview@microsoft.com to join the preview. -- Dark Mode - HoloLens customers can now choose the default mode for apps that support both color schemes! Based on customer feedback, with this update we are setting the default app mode to "dark," but you can easily change this setting at any time. -- Support for additional system voice commands -- An updated Cortana app with a focus on productivity -- Hand Tracking improvements to reduce the tendency to close the index finger when pointing. This should make button pressing and 2D slate usage feel more accurate -- Performance and stability improvements across the product -- More information in settings on HoloLens about the policy pushed to the device - -Once you've had a chance to explore these new capabilities, use the Feedback Hub app to let us know what you think. Feedback you provide in the Feedback Hub goes directly to our engineers. - -### FIDO 2 support -Many of you share a HoloLens with lots of people in a work or school environment. Whether devices are shared between students in a classroom or they're checked out from a device locker, it's important to be able to change users quickly and easily without typing long user names and passwords. FIDO lets anyone in your organization (AAD tenant) seamlessly sign in to HoloLens without entering a username or password. - -Read the [passwordless security docs](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-security-key) to get started. - -### Provisioning package updates -Provisioning packages let you set HoloLens configuration through a config file rather than going through the HoloLens out of box experience. Previously, provisioning packages had to be copied onto HoloLens' internal memory, now they can be on a USB drive so they're easier to re-use on multiple HoloLens and so more people can provision HoloLens in parallel. - -1. To try it out, download the latest version of the Windows Configuration Designer from the Windows store onto your PC. -1. Select **Provision HoloLens Devices** > Select **Provision HoloLens 2 devices** -1. Build your configuration profile and, when you're done, copy all files created to a USB-C storage device. -1. Plug it into any freshly flashed HoloLens and press **Volume down + Power** to apply your provisioning package. - -### System voice commands -You can now can access these commands with your voice: -- "Restart device" -- "Shutdown device" -- "Brightness up" -- "Brightness down" -- "Volume up" -- "Volume down" -- "What is my IP address?" -- "Take a picture" -- "Take a video" / "Stop recording" - -If you're running your system with a different language, please try the appropriate commands in that language. - -### Cortana updates -The updated app integrates with Microsoft 365, currently in English (United States) only, to help you get more done across your devices. On HoloLens 2, Cortana will no longer support certain device-specific commands like adjusting the volume or restarting the device, which are now supported with the new system voice commands above. Learn more about the new Cortana app and its direction on our blog [here](https://blogs.windows.com/windowsexperience/2020/02/28/cortana-in-the-upcoming-windows-10-release-focused-on-your-productivity-with-enhanced-security-and-privacy/). - -There's currently an issue we're investigating that requires you to launch the app once after booting the device in order to use the "Hey Cortana" keyword activation, and if you updated from a 18362 build, you may see an app tile for the previous version of the Cortana app in Start that no longer works. - -### Dark mode -Many Windows apps support both dark and light modes, and now HoloLens customers can choose the default mode for apps that support both. Once updated, the default app mode will be "dark," but can be changed easily. Navigate to **Settings > System > Colors to find "Choose your default app mode."** -Here are some of the in-box apps that support Dark mode! -- Settings -- Microsoft Store -- Mail -- Calendar -- File Explorer -- Feedback Hub -- OneDrive -- Photos -- 3D Viewer -- Movies & TV - -### Windows Autopilot for HoloLens 2 - -This Autopilot program supports Autopilot self-deploying mode to provision HoloLens 2 devices as shared devices under your tenant. Self-deploying mode leverages the device's preinstalled OEM image and drivers during the provisioning process. A user can provision the device without putting the device on and going through the Out-of-the-box Experience (OOBE). - -When a user starts the Autopilot self-deploying process, the process completes the following steps: -1. Join the device to Azure Active Directory (Azure AD). -2. Use Azure AD to enroll the device in Microsoft Intune (or another MDM service). -3. Download the device-targeted policies, certificates, and networking profiles. -4. Provision the device. -5. Present the sign-in screen to the user. - -For full information about Autopilot, see [Windows Autopilot for HoloLens 2 evaluation guide](hololens2-autopilot.md). - -### FFU download and flash directions -To test with a flight signed ffu, you first have to flight unlock your device prior to flashing the flight signed ffu. -1. On PC - 1. Download ffu to your PC from: [https://aka.ms/hololenspreviewdownload](https://aka.ms/hololenspreviewdownload) - 1. Install ARC (Advanced Recovery Companion) from the Microsoft Store: [https://www.microsoft.com/store/productId/9P74Z35SFRS8](https://www.microsoft.com/store/productId/9P74Z35SFRS8) -1. On HoloLens - Flight Unlock: Open **Settings** > **Update & Security** > **Windows Insider Program** then sign up, reboot device -1. Flash FFU - Now you can flash the flight signed FFU using ARC diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md deleted file mode 100644 index 2043128011..0000000000 --- a/devices/hololens/hololens-kiosk.md +++ /dev/null @@ -1,219 +0,0 @@ ---- -title: Set up HoloLens as a kiosk for specific applications -description: Use a kiosk configuration to lock down the apps on HoloLens. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 11/13/2018 -ms.custom: -- CI 111456 -- CSSTroubleshooting -ms.reviewer: -manager: laurawi -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Set up HoloLens as a kiosk for specific applications - -In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks. You can also configure guest access for a HoloLens kiosk device by [designating a SpecialGroup account in your XML file.](#add-guest-access-to-the-kiosk-configuration-optional) - -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. - -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. - -The following table lists the device capabilities in the different kiosk modes. - -Kiosk mode | Voice and Bloom commands | Quick actions menu | Camera and video | Miracast ---- | --- | --- | --- | --- -Single-app kiosk | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) -Multi-app kiosk | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) with **Home** and **Volume** (default)

Photo and video buttons shown in Quick actions menu if the Camera app is enabled in the kiosk configuration.

Miracast is shown if the Camera app and device picker app are enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app is enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app and device picker app are enabled in the kiosk configuration. - -> [!NOTE] -> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. - -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. - -> [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. -> -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. - -For HoloLens devices running Windows 10, version 1803, there are three methods that you can use to configure the device as a kiosk: -- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. - -For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. - -## Start layout for HoloLens - -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. - -> [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. - -### Start layout file for MDM (Intune and others) - -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). - -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). - -```xml - - - - - - - - - -``` - -### Start layout for a provisioning package - -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. - -```xml - - - - - - - - - - - - - - - ]]> - - -``` - -## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803) - -For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - -## Set up kiosk mode using a provisioning package (Windows 10, version 1803) - -Process: -1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) -2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) -3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) - -### Create a kiosk configuration XML file - -Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: - -- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. -- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. - -#### Add guest access to the kiosk configuration (optional) - -In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. - -Use the following snippet in your kiosk configuration XML to enable the **Guest** account: - -```xml - - - - - - -``` - -### Add the kiosk configuration XML file to a provisioning package - -1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). -2. Choose **Advanced provisioning**. -3. Name your project, and click **Next**. -4. Choose **Windows 10 Holographic** and click **Next**. -5. Select **Finish**. The workspace for your package opens. -6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. -7. In the center pane, click **Browse** to locate and select the kiosk configuration XML file that you created. - - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) - -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. -10. On the **File** menu, select **Save.** -11. On the **Export** menu, select **Provisioning package**. -12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -13. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. - -14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. - -15. Click **Next**. - -16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - - -### Apply the provisioning package to HoloLens - -1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box). - -3. HoloLens will show up as a device in File Explorer on the PC. - -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE. - - -## Set up kiosk mode using the Windows Device Portal (Windows 10, version 1607 and version 1803) - -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. - - > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). - -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. - - > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). - -4. In the Windows Device Portal, click **Kiosk Mode**. - - ![Kiosk Mode](images/kiosk.png) - - > [!NOTE] - > The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens1-upgrade-enterprise.md). - -5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**. - -## Kiosk app recommendations - -- You cannot select Microsoft Edge, Microsoft Store, or the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app and the File Explorer app as a kiosk app. -- You can select Cortana as a kiosk app. -- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - -## More information - -Watch how to configure a kiosk in a provisioning package. -> [!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false] diff --git a/devices/hololens/hololens-known-issues.md b/devices/hololens/hololens-known-issues.md deleted file mode 100644 index de39da5999..0000000000 --- a/devices/hololens/hololens-known-issues.md +++ /dev/null @@ -1,198 +0,0 @@ ---- -title: Known issues for HoloLens -description: This is the list of known issues that may affect HoloLens developers. -keywords: troubleshoot, known issue, help -author: mattzmsft -ms.author: mazeller -ms.date: 4/20/2020 -ms.topic: article -ms.custom: -- CI 111456 -- CSSTroubleshooting -HoloLens and holograms: Frequently asked questions -manager: jarrettr -ms.prod: hololens -appliesto: -- HoloLens (1st Gen) -- HoloLens 2 ---- - -# Known issues for HoloLens - -This is the current list of known issues for HoloLens devices. Check here first if you are seeing an odd behavior. This list will be kept updated as new issues are discovered or reported, or as issues are addressed in future HoloLens software updates. - ->[!NOTE] -> - If you discover an issue that is not blocking you please report it on your HoloLens device via [Feedback Hub](hololens-feedback.md). -> - If the issue you are facing is blocking you, in addtion to filing feedback, please [file a support request](https://aka.ms/hlsupport). - -- [Known issues for all HoloLens generations](#known-issues-for-all-hololens-generations) -- [Known issues for HoloLens 2 devices](#known-issues-for-hololens-2-devices) -- [Known issues for HoloLens (1st Gen)](#known-issues-for-hololens-1st-gen) -- [Known issues for HoloLens emulator](#known-issues-for-hololens-emulator) - -## Known issues for all HoloLens generations - -### Unity - -- See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Unity recommended for HoloLens development. -- Known issues with the Unity HoloLens Technical Preview are documented in the [HoloLens Unity forums](https://forum.unity3d.com/threads/known-issues.394627/). - -### Windows Device Portal - -- The Live Preview feature in Mixed Reality capture may exhibit several seconds of latency. -- On the Virtual Input page, the Gesture and Scroll controls under the Virtual Gestures section are not functional. Using them will have no effect. The virtual keyboard on the same page works correctly. -- After enabling Developer Mode in Settings, it may take a few seconds before the switch to turn on the Device Portal is enabled. - -## Known issues for HoloLens 2 devices - -### Blue screen is shown after unenrolling from Insider preview builds on a device reflashed with a Insider build - -This is an issue affecting that affects users who are were on an Insider preview build, reflashed their HoloLens 2 with a new insider preview build, and then unenrolled from the Insider program. - -This does not affect: -- Users who are not enrolled in Windows Insider -- Insiders: - - If a device has been enrolled since Insider builds were version 18362.x - - If they flashed a Insider signed 19041.x build AND stay enrolled in the Insider program - -Work-around: -- Avoid the issue - - Flash a non-insider build. One of the regular monthly updates. - - Stay on Insider Preview -- Reflash the device - 1. Put the [HoloLens 2 into flashing mode](https://review.docs.microsoft.com/hololens/hololens-recovery?branch=master#hololens-2) manually by fully powering down while not connect. Then while holding Volume up, tap the Power button. - 1. Connect to the PC and open Advanced Recovery Companion. - 1. Flash the HoloLens 2 to the default build. - -## Known issues for HoloLens (1st Gen) - -### Unable to connect and deploy to HoloLens through Visual Studio - -> [!NOTE] -> Last Update: 8/8 @ 5:11PM - Visual Studio has released VS 2019 Version 16.2 which includes a fix to this issue. We recommend updating to this newest version to avoid experiencing this error. - -Visual Studio has released VS 2019 Version 16.2 which includes a fix to this issue. We recommend updating to this newest version to avoid experiencing this error. - -Issue root-cause: Users who used Visual Studio 2015 or early releases of Visual Studio 2017 to deploy and debug applications on their HoloLens and then subsequently used the latest versions of Visual Studio 2017 or Visual Studio 2019 with the same HoloLens will be affected. The newer releases of Visual Studio deploy a new version of a component, but files from the older version are left over on the device, causing the newer version to fail. This causes the following error message: DEP0100: Please ensure that target device has developer mode enabled. Could not obtain a developer license on \ due to error 80004005. - -#### Workaround - -Our team is currently working on a fix. In the meantime, you can use the following steps to work around the issue and help unblock deployment and debugging: - -1. Open Visual Studio -1. Select **File** > **New** > **Project**. -1. Select **Visual C#** > **Windows Desktop** > **Console App (.NET Framework)**. -1. Give the project a name (such as "HoloLensDeploymentFix") and make sure the Framework is set to at least .NET Framework 4.5, then Select **OK**. -1. Right-click on the **References** node in Solution Explorer and add the following references (select to the **Browse** section and select **Browse**): - - ```CMD - C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\Microsoft.Tools.Deploy.dll - C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\Microsoft.Tools.Connectivity.dll - C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\SirepInterop.dll - ``` - - > [!NOTE] - > If you don't have 10.0.18362.0 installed, use the most recent version that you have. - -1. Right-click on the project in Solution Explorer and select **Add** > **Existing Item**. -1. Browse to C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86 and change the filter to **All Files (\*.\*)**. -1. Select both SirepClient.dll and SshClient.dll, and Select **Add**. -1. Locate and select both files in Solution Explorer (they should be at the bottom of the list of files) and change **Copy to Output Directory** in the **Properties** window to **Copy always**. -1. At the top of the file, add the following to the existing list of `using` statements: - - ```CMD - using Microsoft.Tools.Deploy; - using System.Net; - ``` - -1. Inside of `static void Main(...)`, add the following code: - - ```PowerShell - RemoteDeployClient client = RemoteDeployClient.CreateRemoteDeployClient(); - client.Connect(new ConnectionOptions() - { - Credentials = new NetworkCredential("DevToolsUser", string.Empty), - IPAddress = IPAddress.Parse(args[0]) - }); - client.RemoteDevice.DeleteFile(@"C:\Data\Users\DefaultAccount\AppData\Local\DevelopmentFiles\VSRemoteTools\x86\CoreCLR\mscorlib.ni.dll"); - ``` - -1. Select **Build** > **Build Solution**. -1. Open a Command Prompt Window and cd to the folder that contains the compiled .exe file (for example, C:\MyProjects\HoloLensDeploymentFix\bin\Debug) -1. Run the executable and provide the device's IP address as a command-line argument. (If connected using USB, you can use 127.0.0.1, otherwise use the device's Wi-Fi IP address.) For example, "HoloLensDeploymentFix 127.0.0.1" - -1. After the tool has exited without any messages (this should only take a few seconds), you will now be able to deploy and debug from Visual Studio 2017 or newer. Continued use of the tool is not necessary. - -We will provide further updates as they become available. - -### Issues launching the Microsoft Store and apps on HoloLens - -> [!NOTE] -> Last Update: 4/2 @ 10 AM - Issue resolved. - -You may experience issues when trying to launch the Microsoft Store and apps on HoloLens. We've determined that the issue occurs when background app updates deploy a newer version of framework packages in specific sequences while one or more of their dependent apps are still running. In this case, an automatic app update delivered a new version of the .NET Native Framework (version 10.0.25531 to 10.0.27413) caused the apps that are running to not correctly update for all running apps consuming the prior version of the framework. The flow for framework update is as follows: - -1. The new framework package is downloaded from the store and installed -1. All apps using the older framework are 'updated' to use the newer version - -If step 2 is interrupted before completion then any apps for which the newer framework wasn't registered will fail to launch from the start menu. We believe any app on HoloLens could be affected by this issue. - -Some users have reported that closing hung apps and launching other apps such as Feedback Hub, 3D Viewer or Photos resolves the issue for them—however, this does not work 100% of the time. - -We have root caused that this issue was not caused the update itself, but a bug in the OS that resulted in the .NET Native framework update being handled incorrectly. We are pleased to announce that we have identified a fix and have released an update (OS version 17763.380) containing the fix. - -To see if your device can take the update, please: - -1. Go to the Settings app and open **Update & Security**. -1. Select **Check for Updates**. -1. If update to 17763.380 is available, please update to this build to receive the fix for the App Hang bug -1. Upon updating to this version of the OS, the Apps should work as expected. - -Additionally, as we do with every HoloLens OS release, we have posted the FFU image to the [Microsoft Download Center](https://aka.ms/hololensdownload/10.0.17763.380). - -If you would not like to take the update, we have released a new version of the Microsoft Store UWP app as of 3/29. After you have the updated version of the Store: - -1. Open the Store and confirm that it loads. -1. Use the bloom gesture to open the menu. -1. Attempt to open previously broken apps. -1. If it still cannot be launched, tap and hold the icon of the broken app and select uninstall. -1. Resinstall these apps from the store. - -If your device is still unable to load apps, you can sideload a version of the .NET Native Framework and Runtime through the download center by following these steps: - -1. Please download [this zip file](https://download.microsoft.com/download/8/5/C/85C23745-794C-419D-B8D7-115FBCCD6DA7/netfx_1.7.zip) from the Microsoft Download Center. Unzipping will produce two files. Microsoft.NET.Native.Runtime.1.7.appx and Microsoft.NET.Native.Framework.1.7.appx -1. Please verify that your device is dev unlocked. If you haven't done that before the instructions to do that are [here](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). -1. You then want to get into the Windows Device Portal. Our recommendation is to do this over USB and you would do that by typing http://127.0.0.1:10080 into your browser. -1. After you have the Windows Device Portal up we need you to "side load" the two files that you downloaded. To do that you need to go down the left side bar until you get to the **Apps** section and select **Apps**. -1. You will then see a screen that is similar to the below. You want to go to the section that says **Install App** and browse to where you unzipped those two APPX files. You can only do one at a time, so after you select the first one, then click on "Go" under the Deploy section. Then do this for the second APPX file. - - ![Windows Device Portal to Install Side-Loaded app](images/20190322-DevicePortal.png) -1. At this point we believe your applications should start working again and that you can also get to the Store. -1. In some cases, it is necessary run the additional step of launching the 3D Viewer app before affected apps will launch. - -We appreciate your patience as we have gone through the process to get this issue resolved, and we look forward to continued working with our community to create successful Mixed Reality experiences. - -### Device Update - -- 30 seconds after a new update, the shell may disappear one time. Please perform the **bloom** gesture to resume your session. - -### Visual Studio - -- See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Visual Studio that is recommended for HoloLens development. -- When deploying an app from Visual Studio to your HoloLens, you may see the error: **The requested operation cannot be performed on a file with a user-mapped section open. (Exception from HRESULT: 0x800704C8)**. If this happens, try again and your deployment will generally succeed. - -### API - -- If the application sets the [focus point](https://docs.microsoft.com/windows/mixed-reality/focus-point-in-unity) behind the user or the normal to camera.forward, holograms will not appear in Mixed Reality Capture photos or videos. Until this bug is fixed in Windows, if applications actively set the [focus point](https://docs.microsoft.com/windows/mixed-reality/focus-point-in-unity) they should ensure the plane normal is set opposite camera-forward (for example, normal = -camera.forward). - -### Xbox Wireless Controller - -- Xbox Wireless Controller S must be updated before it can be used with HoloLens. Ensure you are [up to date](https://support.xbox.com/xbox-one/accessories/update-controller-for-stereo-headset-adapter) before attempting to pair your controller with a HoloLens. -- If you reboot your HoloLens while the Xbox Wireless Controller is connected, the controller will not automatically reconnect to HoloLens. The Guide button light will flash slowly until the controller powers off after 3 minutes. To reconnect your controller immediately, power off the controller by holding the Guide button until the light turns off. When you power your controller on again, it will reconnect to HoloLens. -- If your HoloLens enters standby while the Xbox Wireless Controller is connected, any input on the controller will wake the HoloLens. You can prevent this by powering off your controller when you are done using it. - -## Known issues for HoloLens emulator - -- Not all apps in the Microsoft Store are compatible with the emulator. For example, Young Conker and Fragments are not playable on the emulator. -- You cannot use the PC webcam in the Emulator. -- The Live Preview feature of the Windows Device Portal does not work with the emulator. You can still capture Mixed Reality videos and images. diff --git a/devices/hololens/hololens-licenses-requirements.md b/devices/hololens/hololens-licenses-requirements.md deleted file mode 100644 index ef727bfc77..0000000000 --- a/devices/hololens/hololens-licenses-requirements.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Licenses for Mixed Reality Deployment -description: -ms.prod: hololens -ms.sitesec: library -author: pawinfie -ms.author: pawinfie -audience: ITPro -ms.topic: article -ms.localizationpriority: high -ms.date: 1/23/2020 -ms.reviewer: -audience: ITPro -manager: bradke -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Determine what licenses you need - -## Mobile Device Management (MDM) Licenses Guidance - -If you plan on managing your HoloLens devices, you will need Azure AD and an MDM. Active Director (AD) cannot be used to manage HoloLens devices. -If you plan on using an MDM other than Intune, an [Azure Active Directory Licenses](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) is required. -If you plan on using Intune as your MDM, [here](https://docs.microsoft.com/intune/fundamentals/licenses) are a list of suites that includes Intune licenses. **Please note that Azure AD is included in the majority of these suites.** - -## Identify the licenses needed for your scenario and products - -### HoloLens Licenses Requirements - -You may need to upgrade your HoloLens 1st Gen Device to Windows Holographic for Business. (See [HoloLens commercial features](holoLens-commercial-features.md#feature-comparison-between-editions) to determine if you need to upgrade). - - If so, you will need to do the following: - -- Acquire a HoloLens Enterprise license XML file -- Apply the XML file to the HoloLens. You can do this through a [Provisioning package](hololens-provisioning.md) or through your [Mobile Device Manager](https://docs.microsoft.com/intune/configuration/holographic-upgrade) - -### Remote Assist License Requirements - -Make sure you have the required licensing and device. Updated licensing and product requirements can be found [here](https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/requirements). - -1. [Remote Assist License](https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/buy-and-deploy-remote-assist) -1. [Teams Freemium/Teams](https://products.office.com/microsoft-teams/free) -1. [Azure Active Directory (Azure AD) License](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) - -If you plan on implementing **[this cross-tenant scenario](https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/cross-tenant-overview#scenario-2-leasing-services-to-other-tenants)**, you may need an Information Barriers license. Please see [this article](https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/cross-tenant-licensing-implementation#step-1-determine-if-information-barriers-are-necessary) to determine if an Information Barrier License is required. - -### Guides License Requirements - -Updated licensing and device requirements can be found [here](https://docs.microsoft.com/dynamics365/mixed-reality/guides/requirements). - -1. [Azure Active Directory (Azure AD) License](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) -1. [Power BI](https://powerbi.microsoft.com/desktop/) -1. [Guides](https://docs.microsoft.com/dynamics365/mixed-reality/guides/setup) - -### Scenario 1: Kiosk Mode - -1. If you are **not** planning to manage your device and you are planning to use a local account or an MSA as the login identity, you will not need any additional licenses. Kiosk mode can be accomplished using a provisioning packages. -1. If you are planning to use an MDM to implement Kiosk mode, you will need an [Azure Active Directory (Azure AD) License](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis). - -Additional information regarding kiosk mode will be covered in [Configuring your Network for HoloLens](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - -## Next Step: [Configure your network for HoloLens](hololens-commercial-infrastructure.md) \ No newline at end of file diff --git a/devices/hololens/hololens-multiple-users.md b/devices/hololens/hololens-multiple-users.md deleted file mode 100644 index d65929d676..0000000000 --- a/devices/hololens/hololens-multiple-users.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Share your HoloLens with multiple people -description: You can configure HoloLens to be shared by multiple Azure Active Directory accounts, or by multiple users that use a single account. -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: medium -ms.date: 09/16/2019 -ms.reviewer: -manager: laurawi -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Share your HoloLens with multiple people - -It's common to share one HoloLens with many people or to have many people share a set of HoloLens devices. This article describes the different ways in which you can share a device. - -## Share with multiple people, each using their own account - -**Prerequisite**: The HoloLens device must be running Windows 10, version 1803 or later. HoloLens (1st gen) also need to be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md). - -When they use their own Azure Active Directory (Azure AD) accounts, multiple users can each keep their own user settings and user data on the device. - -To make sure that multiple people can use their own accounts on your HoloLens, follow these steps to configure it: - -1. Make sure the the device is running Windows 10, version 1803 or later. - > [!IMPORTANT] - > If you are using a HoloLens (1st gen) device, [upgrade the device to Windows Holographic for Business](hololens1-upgrade-enterprise.md). -1. When you set up the device, select **My work or school owns it** and sign in by using an Azure AD account. -1. After you finish setup, make sure that the account settings (**Settings** > **Accounts**) includes **Other users**. - -To use HoloLens, each user follows these steps: - -1. If another user has been using the device, do one of the following: - - Press the power button once to go to standby, and then press the power button again to return to the lock screen - - HoloLens 2 users may select the user tile on the top of the Pins panel to sign out the current user. - -1. Use your Azure AD account credentials to sign in to the device. - If this is the first time that you have used the device, you have to [calibrate](hololens-calibration.md) HoloLens to your own eyes. - -To see a list of the device users or to remove a user from the device, go to **Settings** > **Accounts** > **Other users**. - -## Share with multiple people, all using the same account - -Multiple users can also share a HoloLens device while using a single user account. - -**On HoloLens 2**, when a new user puts the device on their head for the first time (while keeping the same account signed in), the device prompts the new user to quickly calibrate and personalize the viewing experience. The device can store the calibration information so that in the future, the device can automatically optimize the quality and comfort of each user's viewing experience. The users do not need to calibrate the device again. - -**On HoloLens (1st gen)** users sharing an account will need to ask to recalibrate in the Settings app. Read more about [calibration](hololens-calibration.md). diff --git a/devices/hololens/hololens-network.md b/devices/hololens/hololens-network.md deleted file mode 100644 index bd9286a91e..0000000000 --- a/devices/hololens/hololens-network.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Connect to a network -description: Instructions on how to connect to internet with HoloLens and how to identify the device's IP address. -ms.assetid: 0895606e-96c0-491e-8b1c-52e56b00365d -author: mattzmsft -ms.author: mazeller -keywords: HoloLens, wifi, wireless, internet, ip, ip address -ms.prod: hololens -ms.sitesec: library -ms.localizationpriority: high -ms.reviewer: -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Connect to a network - -To do most things on your HoloLens, you have to be connected to a network. This guide will help you: - -- Connect to a network using Wi-Fi or (for HoloLens 2 only) Ethernet over USB-C -- Disable and re-enable Wi-Fi - -Read more about [using HoloLens offline](hololens-offline.md). - -## Connecting for the first time - -The first time you use your HoloLens, you'll be guided through connecting to a Wi-Fi network. If you have trouble connecting to Wi-Fi during setup, make sure that your network is either an open, password-protected network or a captive portal network. Make sure that the network doesn't require you to use a certificate to connect. After setup, you can connect to other types of Wi-Fi networks. - -## Connecting to Wi-Fi after setup - -1. Select **Start** > **Settings**. - - *HoloLens (1st gen) only*: Use your gaze to position the Settings app, then air tap to place it, or say "Place." -1. Select **Network & Internet** > **Wi-Fi**. If you don't see your network, scroll down the list. -1. Select a network, then select **Connect**. -1. If you are prompted for a network password type it and then select **Next**. - -## Connecting to Wi-Fi on HoloLens (1st gen) - -HoloLens contains a 802.11ac-capable, 2x2 Wi-Fi radio. Connecting HoloLens to a Wi-Fi network is similar to connecting a Windows 10 Desktop or Mobile device to a Wi-Fi network. - -![HoloLens Wi-Fi settings](./images/wifi-hololens-600px.jpg) - -1. Open the **Start** menu. -1. Select the Settings app from **Start** or from the **All Apps** list on the right of the **Start** menu. The Settings app will be auto-placed in front of you. -1. Select **Network & Internet**. -1. Make sure Wi-Fi is turned on. -1. Select a Wi-Fi network from the list. -1. If needed, type in the Wi-Fi network password. - -You can also confirm you are connected to a Wi-Fi network by checking the Wi-Fi status in the **Start** menu: - -1. Open the **Start** menu. -1. Look at the top left of the **Start** menu for Wi-Fi status. The state of Wi-Fi and the SSID of the connected network will be shown. - -## Troubleshooting your connection to Wi-Fi - -If you experience problems connecting to Wi-Fi, see [I can't connect to Wi-Fi](./hololens-faq.md#i-cant-connect-to-wi-fi). - -When you sign into an enterprise or organizational account on the device, it may also apply Mobile Device Management (MDM) policy, if the policy is configured by your IT administrator. - -## Disabling Wi-Fi on HoloLens (1st gen) - -### Using the Settings app on HoloLens - -1. Open the **Start** menu. -1. Select the **Settings** app from **Start** or from the **All Apps** list on the right of the **Start** menu. The **Settings** app will be auto-placed in front of you. -1. Select **Network & Internet**. -1. Select the Wi-Fi slider switch to move it to the **Off** position. This will turn off the RF components of the Wi-Fi radio and disable all Wi-Fi functionality on HoloLens. - - > [!WARNING] - > When the Wi-Fi radio is disabled, HoloLens will not be able to automatically load your [spaces](hololens-spaces.md). - -1. Move the slider switch to the **On** position to turn on the Wi-Fi radio and restore Wi-Fi functionality on Microsoft HoloLens. The selected Wi-Fi radio state (**On** or **Off**) will persist across reboots. - -## Identifying the IP Address of your HoloLens on the Wi-Fi network - -### By using the Settings app - -1. Open the **Start** menu. -1. Select the **Settings** app from **Start** or from the **All Apps** list on the right of the **Start** menu. The **Settings** app will be auto-placed in front of you. -1. Select **Network & Internet**. -1. Scroll down to beneath the list of available Wi-Fi networks and select **Hardware properties**. - - ![Hardware properties in Wi-Fi settings](./images/wifi-hololens-hwdetails.jpg) - - The IP address appears next to **IPv4 address**. - -### By using Cortana - -Say "Hey Cortana, What's my IP address?" and Cortana will display and read out your IP address. - -### By using Windows Device Portal - -1. In a web browser on your PC, open the [device portal](/windows/mixed-reality/using-the-windows-device-portal.md#networking). -1. Navigate to the **Networking** section. - This section displays your IP address and other network information. By using this method, you can copy and paste of the IP address on your development PC. diff --git a/devices/hololens/hololens-offline.md b/devices/hololens/hololens-offline.md deleted file mode 100644 index b9ee084421..0000000000 --- a/devices/hololens/hololens-offline.md +++ /dev/null @@ -1,163 +0,0 @@ ---- -title: Manage connection endpoints for HoloLens -description: To set up HoloLens, you'll need to connect to a Wi-Fi network -keywords: hololens, offline, OOBE -audience: ITPro -ms.date: 07/01/2019 -ms.assetid: b86f603c-d25f-409b-b055-4bbc6edcd301 -author: Teresa-Motiv -ms.author: v-tea -ms.custom: -- CI 111456 -- CSSTroubleshooting -manager: jarrettr -ms.topic: article -ms.prod: hololens -ms.sitesec: library -ms.localizationpriority: high -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Manage connection endpoints for HoloLens - -Some HoloLens components, apps, and related services transfer data to Microsoft network endpoints. This article lists different endpoints and URLs that need to be whitelisted in your network configuration (e.g. proxy or firewall) for those components to be functional. - -## Near-offline setup - -HoloLens supports a limited set of offline experiences for customers who have network environment restrictions. However, HoloLens needs network connection to go through initial device set up and the following URLs have to be enabled: - -| Purpose | URL | -|------|------| -| IDPS | https://sdx.microsoft.com/frx/idps | -| [NCSI](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-ncsi) | http://www.msftconnecttest.com/connecttest.txt | -| AADv9 | https://login.microsoftonline.com/WebApp/CloudDomainJoin/9 | -| AADv10 | https://login.microsoftonline.com/WebApp/CloudDomainJoin/10 | -| AAD Pin | https://account.live.com/aadngc?uiflavor=win10&showSuccess=1 | -| MSA | https://login.live.com/ppsecure/inlineconnect.srf?id=80600 | -| MSA Pin | https://account.live.com/msangc?fl=enroll | - -## Endpoint configuration - -In addition to the list above, to take full advantage of HoloLens functionality, the following endpoints need to be enabled in your network configuration. - - -| Purpose | URL | -|------|------| -| Azure | wd-prod-fe.cloudapp.azure.com | | | -| | ris-prod-atm.trafficmanager.net | | | | -| | validation-v2.sls.trafficmanager.net | | | | -| Azure AD Multi-Factor Authentication | https://secure.aadcdn.microsoftonline-p.com | | | | -| Intune and MDM Configurations | activation-v2.sls.microsoft.com/* | | | | -| | cdn.onenote.net | | | | -| | client.wns.windows.com | | | | -| | crl.microsoft.com/pki/crl/* | | | | -| | ctldl.windowsupdate.com | | | | -| | *displaycatalog.mp.microsoft.com | | | | -| | dm3p.wns.windows.com | | | | -| | *microsoft.com/pkiops/* | | | | -| | ocsp.digicert.com/* | | | | -| | r.manage.microsoft.com | | | | -| | tile-service.weather.microsoft.com | | | | -| | settings-win.data.microsoft.com | | | | -| Certificates | activation-v2.sls.microsoft.com/* | | | | -| | crl.microsoft.com/pki/crl/* | | | | -| | ocsp.digicert.com/* | | | | -| | https://www.microsoft.com/pkiops/* | | | | -| Cortana and Search | store-images.*microsoft.com | | | | -| | www.bing.com/client | | | | -| | www.bing.com | | | | -| | www.bing.com/proactive | | | | -| | www.bing.com/threshold/xls.aspx | | | | -| | exo-ring.msedge.net | | | | -| | fp.msedge.net | | | | -| | fp-vp.azureedge.net | | | | -| | odinvzc.azureedge.net | | | | -| | spo-ring.msedge.net | | | | -| Device Authentication | login.live.com* | | | | -| Device metadata | dmd.metaservices.microsoft.com | | | | -| Location | inference.location.live.net | | | | -| | location-inference-westus.cloudapp.net | | | | -| Diagnostic Data | v10.events.data.microsoft.com | | | | -| | v10.vortex-win.data.microsoft.com/collect/v1 | | | | -| | https://www.microsoft.com | | | | -| | co4.telecommand.telemetry.microsoft.com | | | | -| | cs11.wpc.v0cdn.net | | | | -| | cs1137.wpc.gammacdn.net | | | | -| | modern.watson.data.microsoft.com* | | | | -| | watson.telemetry.microsoft.com | | | | -| Licensing | licensing.mp.microsoft.com | | | | -| Microsoft Account | login.msa.akadns6.net | | | | -| | us.configsvc1.live.com.akadns.net | | | | -| Microsoft Edge | iecvlist.microsoft.com | | | | -| Microsoft forward link redirection service (FWLink) | go.microsoft.com | | | | -| Microsoft Store | *.wns.windows.com | | | | -| | storecatalogrevocation.storequality.microsoft.com | | | | -| | img-prod-cms-rt-microsoft-com* | | | | -| | store-images.microsoft.com | | | | -| | .md.mp.microsoft.com | | | -| | *displaycatalog.mp.microsoft.com | | | | -| | pti.store.microsoft.com | | | | -| | storeedgefd.dsx.mp.microsoft.com | | | | -| | markets.books.microsoft.com | | | | -| | share.microsoft.com | | | | -| Network Connection Status Indicator (NCSI) | www.msftconnecttest.com* | | | | -| Office | *.c-msedge.net | | | | -| | *.e-msedge.net | | | | -| | *.s-msedge.net | | | | -| | nexusrules.officeapps.live.com | | | | -| | ocos-office365-s2s.msedge.net | | | | -| | officeclient.microsoft.com | | | | -| | outlook.office365.com | | | | -| | client-office365-tas.msedge.net | | | | -| | https://www.office.com | | | | -| | onecollector.cloudapp.aria | | | | -| | v10.events.data.microsoft.com/onecollector/1.0/ | | | | -| | self.events.data.microsoft.com | | | | -| | to-do.microsoft.com | | | | -| OneDrive | g.live.com/1rewlive5skydrive/* | | | | -| | msagfx.live.com | | | | -| | oneclient.sfx.ms | | | | -| Photos App | evoke-windowsservices-tas.msedge.net | | | | -| Settings | cy2.settings.data.microsoft.com.akadns.net | | | | -| | settings.data.microsoft.com | | | | -| | settings-win.data.microsoft.com | | | | -| Windows Defender | wdcp.microsoft.com | | | | -| | definitionupdates.microsoft.com | | | | -| | go.microsoft.com | | | | -| | *smartscreen.microsoft.com | | | | -| | smartscreen-sn3p.smartscreen.microsoft.com | | | | -| | unitedstates.smartscreen-prod.microsoft.com | | | | -| Windows Spotlight | *.search.msn.com | | | | -| | arc.msn.com | | | | -| | g.msn.com* | | | | -| | query.prod.cms.rt.microsoft.com | | | | -| | ris.api.iris.microsoft.com | | | | -| Windows Update | *.prod.do.dsp.mp.microsoft.com | | | | -| | cs9.wac.phicdn.net | | | | -| | emdl.ws.microsoft.com | | | | -| | *.dl.delivery.mp.microsoft.com | | | | -| | *.windowsupdate.com | | | | -| | *.delivery.mp.microsoft.com | | | | -| | *.update.microsoft.com | | | | - - - -## References - -> [!NOTE] -> If you are deploying D365 Remote Assist, you will have to enable the endpoints on this [list](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams) -- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) -- [Manage connection endpoints for Windows 10 Enterprise, version 1903](https://docs.microsoft.com/windows/privacy/manage-windows-1903-endpoints) -- [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) -- [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) -- [Intune network configuration requirements and bandwidth](https://docs.microsoft.com/intune/fundamentals/network-bandwidth-use#network-communication-requirements) -- [Network endpoints for Microsoft Intune](https://docs.microsoft.com/intune/fundamentals/intune-endpoints) -- [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges) -- [Prerequisites for Azure AD Connect](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-install-prerequisites) - - -## HoloLens limitations - -After your HoloLens is set up, you can use it without a Wi-Fi connection, but apps that use Internet connections will have limited capabilities when you use HoloLens offline. diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md deleted file mode 100644 index 5eea91fcbe..0000000000 --- a/devices/hololens/hololens-provisioning.md +++ /dev/null @@ -1,206 +0,0 @@ ---- -title: Configure HoloLens by using a provisioning package (HoloLens) - -description: Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. -ms.prod: hololens -ms.sitesec: library -ms.custom: -- CI 111456 -- CSSTroubleshooting -author: dansimp -ms.author: dansimp -ms.topic: article -ms.custom: -- CI 115190 -- CSSTroubleshooting -ms.localizationpriority: medium -ms.date: 03/10/2020 -ms.reviewer: Teresa-Motiv -manager: laurawi -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Configure HoloLens by using a provisioning package - -[Windows provisioning](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages) makes it easy for IT administrators to configure end-user devices without imaging. Windows Configuration Designer is a tool for configuring images and runtime settings which are then built into provisioning packages. - -Some of the HoloLens configurations that you can apply in a provisioning package include the following: - -- Upgrade to Windows Holographic for Business [here](hololens1-upgrade-enterprise.md) -- Set up a local account -- Set up a Wi-Fi connection -- Apply certificates to the device -- Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). - -## Provisioning package HoloLens wizard - -The HoloLens wizard helps you configure the following settings in a provisioning package: - -- Upgrade to the enterprise edition - - > [!NOTE] - > This should only be used for HoloLens 1st gen devices. Settings in a provisioning package are only be applied if the provisioning package includes an edition upgrade license to Windows Holographic for Business or if [the device has already been upgraded to Windows Holographic for Business](hololens1-upgrade-enterprise.md). - -- Configure the HoloLens first experience (OOBE) -- Configure the Wi-Fi network -- Enroll the device in Azure Active Directory, or create a local account -- Add certificates -- Enable Developer Mode -- Configure kiosk mode (for detailed instructions,see [Set up kiosk mode using a provisioning package](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) - -> [!WARNING] -> You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. - -Provisioning packages can include management instructions and policies, custom network connections and policies, and more. - -> [!TIP] -> Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc. - -## Steps for creating provisioning packages - -1. **Option 1:** [From Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). This includes HoloLens 2 capabilities. -2. **Option 2:** [From the Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). If you install Windows Configuration Designer from the Windows ADK, select **Configuration Designer** from the **Select the features you want to install** dialog box. This option does not include HoloLens 2 capabilities. - - -### 2. Create the provisioning package - -Use the Windows Configuration Designer tool to create a provisioning package. - -1. Open Windows Configuration Designer (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe). - -2. Select **Provision HoloLens devices**. - - ![ICD start options](images/icd-create-options-1703.png) - -3. Name your project and select **Finish**. - -4. Read the instructions on the **Getting started** page and select **Next**. The pages for desktop provisioning walk you through the following steps. - -> [!IMPORTANT] -> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -### Configure settings - - - - - - - - -
step oneset up device

Browse to and select the enterprise license file to upgrade the HoloLens edition.

You can also toggle Yes or No to hide parts of the first experience.

To set up the device without the need to connect to a Wi-Fi network, toggle Skip Wi-Fi setup to On.

Select a region and timezone in which the device will be used.
Select enterprise licence file and configure OOBE
step two set up network

In this section, you can enter the details of the Wi-Fi wireless network that the device should automatically connect to. To do this, select On, enter the SSID, the network type (Open or WPA2-Personal), and (if WPA2-Personal) the password for the wireless network.
Enter network SSID and type
step three account management

You can enroll the device in Azure Active Directory, or create a local account on the device

Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Select Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Select Accept to give Windows Configuration Designer the necessary permissions.

To create a local account, select that option and enter a user name and password.

Important:
(For Windows 10, version 1607 only) If you create a local account in the provisioning package, you must change the password using the Settings app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.
join  Azure AD or create a local  account
step four add certificates

To provision the device with a certificate, click Add a certificate. Enter a name for the certificate, and then browse to and select the certificate to be used.
add a certificate
step five Developer Setup

Toggle Yes or No to enable Developer Mode on the HoloLens. Learn more about Developer Mode.
Enable Developer Mode
step six finish

Do not set a password to protect your provisioning package. If the provisioning package is protected by a password, provisioning the HoloLens device will fail.
Protect your package
- -After you're done, select **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. - -### 3. Create a provisioning package for HoloLens by using advanced provisioning - -> [!NOTE] -> A provisioning package that you create in **Advanced provisioning** does not need to include an edition upgrade license to Windows Holographic for Business to succesfully apply to a HoloLens (1st gen). [See more on Windows Holographic for Business for HoloLens (1st gen)](hololens1-upgrade-enterprise.md). - -1. On the Windows Configuration Designer start page, select **Advanced provisioning**. -2. In the **Enter project details** window, specify a name for your project and the location for your project. Optionally, enter a brief description to describe your project. - -3. Select **Next**. - -4. In the **Choose which settings to view and configure** window, select **Windows 10 Holographic**, and then select **Next**. - -5. Select **Finish**. - -6. Expand **Runtime settings** and customize the package by using any of the settings [described later in this article](#what-you-can-configure). - - > [!IMPORTANT] - > (For Windows 10, version 1607 only) If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/mixed-reality/reset_or_recover_your_hololens#perform_a_full_device_recovery). - -7. Select **File** > **Save**. - -8. Read the warning that project files may contain sensitive information, and select **OK**. - - > [!IMPORTANT] - > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -9. Select **Export** > **Provisioning package**. - -10. Change **Owner** to **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages applied to this device from other sources. Select **Next**. - -11. Set a value for **Package Version**. - - > [!TIP] - > You can make changes to existing packages and change the version number to update previously applied packages. - -12. On the **Select security details for the provisioning package**, select **Next**. - - > [!WARNING] - > If you encrypt the provisioning package, provisioning the HoloLens device will fail. - -13. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows Configuration Designer uses the project folder as the output location. - - Optionally, you can select **Browse** to change the default output location. - -14. Select **Next**. - -15. Select **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. - -16. When the build completes, select **Finish**. - - - -## Apply a provisioning package to HoloLens during setup - -1. Use the USB cable to connect the device to a PC, and then start the device. Do not continue past the **First interactable moment** page of OOBE. - - On HoloLens (1st gen), this page contains a blue box. - - On HoloLens 2, this page contains the hummingbird. - -2. Briefly press and release the **Volume Down** and **Power** buttons simultaneously. - -3. HoloLens shows up as a device in File Explorer on the PC. - -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device asks you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE. - -> [!NOTE] -> If the device was purchased before August 2016, you will need to sign in to the device by using a Microsoft account, get the latest operating system update, and then reset the operating system in order to apply the provisioning package. - -### 4. Apply a provisioning package to HoloLens after setup - -> [!NOTE] -> These steps apply only toWindows 10, version 1809. - -On your PC, follow these steps: -1. Create a provisioning package as described at [Create a provisioning package for HoloLens using the HoloLens wizard](hololens-provisioning.md). -2. Connect the HoloLens device to a PC by using a USB cable. HoloLens shows up as a device in File Explorer on the PC. -3. Drag and drop the provisioning package to the Documents folder on the HoloLens. - -On your HoloLens, follow these steps: -1. Go to **Settings** > **Accounts** > **Access work or school**. -2. In **Related Settings**, select **Add or remove a provisioning package**. -3. On the next page, select **Add a package** to launch the file picker and select your provisioning package. If the folder is empty, make sure you select **This Device** and select **Documents**. - -After your package has been applied, it shows up in the list of **Installed packages**. To view the package details or to remove the package from the device, select the listed package. - -## What you can configure - -Provisioning packages make use of configuration service providers (CSPs). If you're not familiar with CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers). - -In Windows Configuration Designer, when you create a provisioning package for Windows Holographic, the settings in **Available customizations** are based on [CSPs that are supported in Windows Holographic](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#csps-supported-in-hololens-devices). The following table describes settings that you might want to configure for HoloLens. - -![Common runtime settings for HoloLens](images/icd-settings.png) - -| Setting | Description | -| --- | --- | -| **Certificates** | Deploy a certificate to HoloLens. | -| **ConnectivityProfiles** | Deploy a Wi-Fi profile to HoloLens. | -| **EditionUpgrade** | [Upgrade to Windows Holographic for Business.](hololens1-upgrade-enterprise.md) | -| **Policies** | Allow or prevent developer mode on HoloLens. [Policies supported by Windows Holographic for Business](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#hololenspolicies) | - -> [!NOTE] -> HoloLens does not currently support installing apps (**UniversalAppInstall**) by using a provisioning package. - -## Next Step: [Enroll your device](hololens-enroll-mdm.md) diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md deleted file mode 100644 index 60d46d7e1c..0000000000 --- a/devices/hololens/hololens-recovery.md +++ /dev/null @@ -1,134 +0,0 @@ ---- -title: Restart, reset, or recover HoloLens -ms.reviewer: Both basic and advanced instructions for rebooting or resetting your HoloLens. -description: How to use Advanced Recovery Companion to flash an image to HoloLens 2. -keywords: how-to, reboot, reset, recover, hard reset, soft reset, power cycle, HoloLens, shut down, arc, advanced recovery companion -ms.prod: hololens -ms.sitesec: library -author: mattzmsft -ms.author: mazeller -ms.date: 08/30/2019 -ms.custom: -- CI 111456 -- CSSTroubleshooting -ms.topic: article -ms.localizationpriority: high -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Restart, reset, or recover HoloLens - -If you're experiencing problems with your HoloLens you may want to try a restart, reset, or even re-flash with device recovery. - -Here are some things to try if your HoloLens isn't running well. This article will guide you through the recommended recovery steps in succession. - -This article focuses on the HoloLens device and software, if your holograms don't look right, [this article](hololens-environment-considerations.md) talks about environmental factors that improve hologram quality. - -## Restart your HoloLens - -First, try restarting the device. - -### Perform a safe restart by using Cortana - -The safest way to restart the HoloLens is by using Cortana. This is generally a great first-step when experiencing an issue with HoloLens: - -1. Put on your device -1. Make sure it's powered on, a user is logged in, and the device is not waiting for a password to unlock it. -1. Say "Hey Cortana, reboot" or "Hey Cortana, restart." -1. When she acknowledges she will ask you for confirmation. Wait a second for a sound to play after she has finished her question, indicating she is listening to you and then say "Yes." -1. The device will now restart. - -### Perform a safe restart by using the power button - -If you still can't restart your device, you can try to restart it by using the power button: - -1. Press and hold the power button for five seconds. - 1. After one second, you will see all five LEDs illuminate, then slowly turn off from right to left. - 1. After five seconds, all LEDs will be off, indicating the shutdown command was issued successfully. - 1. Note that it's important to stop pressing the button immediately after all the LEDs have turned off. -1. Wait one minute for the shutdown to cleanly succeed. Note that the shutdown may still be in progress even if the displays are turned off. -1. Power on the device again by pressing and holding the power button for one second. - -### Perform a safe restart by using Windows Device Portal - -> [!NOTE] -> To do this, HoloLens has to be configured as a developer device. -> Read more about [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). - -If the previous procedure doesn't work, you can try to restart the device by using [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). In the upper right corner, there is an option to restart or shut down the device. - -### Perform an unsafe forced restart - -If none of the previous methods are able to successfully restart your device, you can force a restart. This method is equivalent to pulling the battery from the HoloLens. It is a dangerous operation which may leave your device in a corrupt state. If that happens, you'll have to flash your HoloLens. - -> [!WARNING] -> This is a potentially harmful method and should only be used in the event none of the above methods work. - -1. Press and hold the power button for at least 10 seconds. - - - It's okay to hold the button for longer than 10 seconds. - - It's safe to ignore any LED activity. -1. Release the button and wait for two or three seconds. -1. Power on the device again by pressing and holding the power button for one second. -If you're still having problems, press the power button for 4 seconds, until all of the battery indicators fade out and the screen stops displaying holograms. Wait 1 minute, then press the power button again to turn on the device. - -## Reset to factory settings - -> [!NOTE] -> The battery needs at least 40 percent charge to reset. - -If your HoloLens is still experiencing issues after restarting, try resetting it to factory state. Resetting your HoloLens keeps the version of the Windows Holographic software that's installed on it and returns everything else to factory settings. - -If you reset your device, all your personal data, apps, and settings will be erased. Resetting will only install the latest installed version of Windows Holographic and you will have to redo all the initialization steps (calibrate, connect to Wi-Fi, create a user account, download apps, and so forth). - -1. Launch the Settings app, and then select **Update** > **Reset**. -1. Select the **Reset device** option and read the confirmation message. -1. If you agree to reset your device, the device will restart and display a set of spinning gears with a progress bar. -1. Wait about 30 minutes for this process to complete. -1. The reset will complete and the device will restart into the out-of-the-box experience. - -## Re-install the operating system - -If the device is still having a problem after rebooting and resetting, you can use a recovery tool on your computer to reinstall the HoloLens' operating system and firmware. - -HoloLens (1st gen) and HoloLens 2 use different tools but both tools will auto-detect your HoloLens and install new software. - -All of the data HoloLens needs to reset is packaged in a Full Flash Update (ffu). This is similar to an iso, wim, or vhd. [Learn about FFU image file formats.](https://docs.microsoft.com/windows-hardware/manufacture/desktop/wim-vs-ffu-image-file-formats) - -### HoloLens 2 - -The Advanced Recovery Companion is a new app in Microsoft Store restore the operating system image to your HoloLens 2 device. - -1. On your computer, get [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from Microsoft Store. -2. Connect HoloLens 2 to your computer. -3. Start Advanced Recovery Companion. -4. On the **Welcome** page, select your device. -5. On the **Device info** page, select **Install software** to install the default package. (If you have a Full Flash Update (FFU) image that you want to install instead, select **Manual package selection**.) -6. Software installation will begin. Do not use the device or disconnect the cable during installation. When you see the **Installation finished** page, you can disconnect and use your device. - -> [!TIP] -> In the event that a HoloLens 2 gets into a state where Advanced Recovery Companion cannot recognize the device, and it does not boot, try forcing the device into Flashing Mode and recovering it with Advanced Recovery Companion: - -1. Connect the HoloLens 2 to a PC with Advanced Recovery Companion installed. -1. Press and hold the **Volume Up and Power buttons** until the device reboots. Release the Power button, but continue to hold the Volume Up button until the third LED is lit. -1. The device should be visible in **Device Manager** as a **Microsoft HoloLens Recovery** device. -1. Launch Advanced Recovery Companion, and follow the on-screen prompts to reflash the OS to the HoloLens 2. - -### HoloLens (1st gen) - -If necessary, you can install a completely new operating system on your HoloLens (1st gen) with the Windows Device Recovery Tool. - -Before you use this tool, determine if restarting or resetting your HoloLens fixes the problem. The recovery process may take some time. When you're done, the latest version of the Windows Holographic software approved for your HoloLens will be installed. - -To use the tool, you'll need a computer running Windows 10 or later, with at least 4 GB of free storage space. Please note that you can't run this tool on a virtual machine. - -To recover your HoloLens - -1. Download and install the [Windows Device Recovery Tool](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq) on your computer. -1. Connect the HoloLens (1st gen) to your computer using the Micro USB cable that came with your HoloLens. -1. Run the Windows Device Recovery Tool and follow the instructions. - -If the HoloLens (1st gen) isn't automatically detected, select **My device was not detected** and follow the instructions to put your device into recovery mode. diff --git a/devices/hololens/hololens-release-notes.md b/devices/hololens/hololens-release-notes.md deleted file mode 100644 index b289b56df1..0000000000 --- a/devices/hololens/hololens-release-notes.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: HoloLens release notes -description: Learn about updates in each new HoloLens release. -author: scooley -ms.author: scooley -manager: laurawi -ms.prod: hololens -ms.sitesec: library -ms.topic: article -ms.localizationpriority: medium -ms.date: 12/02/2019 -ms.custom: -- CI 111456 -- CSSTroubleshooting -audience: ITPro -appliesto: -- HoloLens 1 -- HoloLens 2 - ---- - -# HoloLens release notes - -## HoloLens 2 - -> [!Note] -> HoloLens Emulator Release Notes can be found [here](https://docs.microsoft.com/windows/mixed-reality/hololens-emulator-archive). - -### April Update - build 18362.1059 - -**Dark mode for supported apps** - -Many Windows apps support both dark and light modes, and soon HoloLens 2 customers can choose the default mode for apps that support both color schemes! Based on overwhelmingly positive customer feedback, with this update we are setting the default app mode to "dark," but you can easily change this setting at any time. -Navigate to **Settings > System > Colors** to find **"Choose your default app mode."** - -Here are some of the in-box apps that support dark mode: -- Settings -- Microsoft Store -- Mail -- Calendar -- File Explorer -- Feedback Hub -- OneDrive -- Photos -- 3D Viewer -- Movies & TV - -**Improvements and fixes also in the update:** -- Ensure shell overlays are included in mixed reality captures. -- Unreal developers are now able to use the 3D View page in Device Portal to test and debug their applications. -- Improve hologram stability in mixed reality capture when the HolographicDepthReprojectionMethod DepthReprojection algorithm is used. -- Fixed WinRT IStreamSocketListener API Class Not Registered error on 32-bit ARM app. - -### March Update - build 18362.1056 - -- Improve hologram stability in mixed reality capture when the HolographicDepthReprojectionMethod AutoPlanar algorithm is used. -- Ensures the coordinate system attached to a depth MF sample is consistent with public documentation. -- Developers productivity improvement by enabling customers to paste large amount of text through device portal. - -### February Update - build 18362.1053 - -- Temporarily disabled the HolographicSpace.UserPresence API for Unity applications to avoid an issue which causes some apps to pause when the visor is flipped up, even if the setting to run in the background is enabled. -- Fixed a random HUP crash cased by hand tracking, in which user will notice an UI freeze then back to shell after several seconds. -- We made an improvement in hand tracking so that while poking using index finger, the upper part of that finger will be less likely to curl unexpectedly. -- Improved reliability of head tracking, spatial mapping, and other runtimes. - -### January Update - build 18362.1043 - -- Stability improvements for exclusive apps when working with the HoloLens 2 emulator. - -### December Update - build 18362.1042 - -- Introduces LSR (Last Stage Reproduction) fixes. Improves visual rendering of holograms to appear more stable and crisp by more accurately accounting for their depth. This will be more noticeable if apps do not set the depth of holograms correctly, after this update. -- Fixes stability of exclusive apps and navigation between exclusive apps. -- Resolves an issue where Mixed Reality Capture couldn't record video after device is left in standby state for multiple days. -- Improves hologram stability. - -### November Update - build 18362.1039 - -- Fixes for **"Select"** voice commands during initial set-up for en-CA and en-AU. -- Improvements in visual quality of objects placed far away in latest Unity and MRTK versions. -- Fixes addressing issues with holographic applications being stuck in a paused state on launch until the pins panel is brought up and dismissed again. -- OpenXR runtime conformance fixes and improvements for HoloLens 2 and the emulator. - -## HoloLens (1st gen) - -### Windows 10 Holographic, version 1809 - -> **Applies to:** Hololens (1st gen) - -| Feature | Details | -|---|---| -| **Quick actions menu** | When you're in an app, the Bloom gesture will now open a Quick actions menu to give you quick access to commonly used system features without having to leave the app.
See [Set up HoloLens in kiosk mode](hololens-kiosk.md) for information about the Quick actions menu in kiosk mode.

![sample of the Quick actions menu](images/minimenu.png) | -| **Stop video capture from the Start or quick actions menu** | If you start video capture from the Start menu or quick actions menu, you'll be able to stop recording from the same place. (Don't forget, you can always do this with voice commands too.) | -| **Project to a Miracast-enabled device** | Project your HoloLens content to a nearby Surface device or TV/Monitor if using Microsoft Display adapter. On **Start**, select **Connect**, and then select the device you want to project to. **Note:** You can deploy HoloLens to use Miracast projection without enabling developer mode. | -| **New notifications** | View and respond to notification toasts on HoloLens, just like you do on a PC. Gaze to respond to or dismiss them (or if you're in an immersive experience, use the bloom gesture). | -| **HoloLens overlays**
(file picker, keyboard, dialogs, etc.) | You'll now see overlays such as the keyboard, dialogs, file picker, etc. when using immersive apps. | -| **Visual feedback overlay UI for volume change** | When you use the volume up/down buttons on your HoloLens you'll see a visual display of the volume level. | -| **New UI for device boot** | A loading indicator was added during the boot process to provide visual feedback that the system is loading. Reboot your device to see the new loading indicator—it's between the "Hello" message and the Windows boot logo. | -| **Nearby sharing** | Addition of the Windows Nearby Sharing experience, allowing you to share a capture with a nearby Windows device. When you capture a photo or video on HoloLens (or use the share button from an app such as Microsoft Edge), select a nearby Windows device to share with. | -| **Share from Microsoft Edge** | Share button is now available on Microsoft Edge windows on HoloLens. In Microsoft Edge, select **Share**. Use the HoloLens share picker to share web content. | - -#### For international customers - -| Feature | Details | -| --- | --- | -| Localized Chinese and Japanese builds | Use HoloLens with localized user interface for Simplified Chinese or Japanese, including localized Pinyin keyboard, dictation, and voice commands.
[Learn how to install the Chinese and Japanese versions of HoloLens.](hololens1-install-localized.md) | -| Speech Synthesis (TTS) | Speech synthesis feature now supports Chinese, Japanese, and English. | - -#### For administrators - -| Feature | Details | -|---|----| -| [Enable post-setup provisioning](hololens-provisioning.md) | You can now apply a runtime provisioning package at any time using **Settings**. | -| Assigned access with Azure AD groups | You can now use Azure AD groups for configuration of Windows assigned access to set up single or multi-app kiosk configuration. | -| PIN sign-in on profile switch from sign-in screen | PIN sign-in is now available for **Other User**. | -| Sign in with Web Credential Provider using password | You can now select the Globe sign-in option to launch web sign-in with your password. From the sign-in screen, select **Sign-In options** and select the Globe option to launch web sign-in. Enter your user name if needed, then your password.
**Note:** You can choose to bypass any PIN/Smartcard options when prompted during web sign-in. | -| Read device hardware info through MDM so devices can be tracked by serial number | IT administrators can see and track HoloLens by device serial number in their MDM console. Refer to your MDM documentation for feature availability and instructions. | -| Set HoloLens device name through MDM (rename) | IT administrators can see and rename HoloLens devices in their MDM console. Refer to your MDM documentation for feature availability and instructions. | - -### Windows 10, version 1803 for Microsoft HoloLens - -> **Applies to:** Hololens (1st gen) - -Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. This update introduces the following changes: - -- Previously, you could only verify that upgrade license for Commercial Suite had been applied to your HoloLens device by checking to see if VPN was an available option on the device. Now, **Settings** > **System** will display **Windows Holographic for Business** after the upgrade license is applied. [Learn how to unlock Windows Holographic for Business features](hololens1-upgrade-enterprise.md). - -- You can view the operating system build number in device properties in the File Explorer app and in the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq). -- Provisioning a HoloLens device is now easier with the new **Provision HoloLens devices** wizard in the Windows Configuration Designer tool. In the wizard, you can configure the setup experience and network connections, set developer mode, and obtain bulk Azure AD tokens. [Learn how to use the simple provisioning wizard for HoloLens](hololens-provisioning.md#provisioning-package-hololens-wizard). - - ![Provisioning HoloLens devices](images/provision-hololens-devices.png) - -- When you create a local account in a provisioning package, the password no longer expires every 42 days. - -- You can [configure HoloLens as a single-app or multi-app kiosk](hololens-kiosk.md). Multi-app kiosk mode lets you set up a HoloLens to only run the apps that you specify, and prevents users from making changes. - -- Media Transfer Protocol (MTP) is enabled so that you can connect the HoloLens device to a PC by USB and transfer files between HoloLens and the PC. You can also use the File Explorer app to move and delete files from within HoloLens. - -- Previously, after you signed in to the device with an Azure Active Directory (Azure AD) account, you then had to **Add work access** in **Settings** to get access to corporate resources. Now, you sign in with an Azure AD account and enrollment happens automatically. - -- Before you sign in, you can choose the network icon below the password field to choose a different Wi-Fi network to connect to. You can also connect to a guest network, such as at a hotel, conference center, or business. - -- You can now easily [share HoloLens with multiple people](hololens-multiple-users.md) using Azure AD accounts. - -- When setup or sign-in fails, choose the new **Collect info** option to get diagnostic logs for troubleshooting. - -- Individual users can sync their corporate email without enrolling their device in mobile device management (MDM). You can use the device with a Microsoft Account, download and install the Mail app, and add an email account directly. - -- You can check the MDM sync status for a device in **Settings** > **Accounts** > **Access Work or School** > **Info**. In the **Device sync status** section, you can start a sync, see areas managed by MDM, and create and export an advanced diagnostics report. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md deleted file mode 100644 index 6cfcb281b0..0000000000 --- a/devices/hololens/hololens-requirements.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Set up HoloLens in a commercial environment -description: Learn more about deploying and managing HoloLens in enterprise environments. -ms.prod: hololens -ms.sitesec: library -ms.assetid: 88bf50aa-0bac-4142-afa4-20b37c013001 -author: scooley -ms.author: scooley -audience: ITPro -ms.topic: article -ms.localizationpriority: medium -ms.date: 07/15/2019 ---- - -# Deploy HoloLens in a commercial environment - -You can deploy and configure HoloLens at scale in a commercial setting. This article provides instructions for deploying HoloLens devices in a commercial environment. This guide assumes basic familiarity with HoloLens. Follow the [get started guide](hololens1-setup.md) to set up HoloLens for the first time. - -This document also assumes that the HoloLens has been evaluated by security teams as safe to use on the corporate network. Frequently asked security questions can be found [here](hololens-faq-security.md) - -## Overview of Deployment Steps - -1. [Determine what features you need](hololens-requirements.md#step-1-determine-what-you-need) -1. [Determine what licenses you need](hololens-licenses-requirements.md) -1. [Configure your network for HoloLens](hololens-commercial-infrastructure.md). - 1. This section includes bandwidth requirements, URL, and ports that need to be whitelisted on your firewall; Azure AD guidance; Mobile Device Management (MDM) Guidance; app deployment/management guidance; and certificate guidance. -1. (Optional) [Configure HoloLens using a provisioning package](hololens-provisioning.md) -1. [Enroll Device](hololens-enroll-mdm.md) -1. [Set up ring based updates for HoloLens](hololens-updates.md) -1. [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) - -## Step 1. Determine what you need - -Before deploying the HoloLens in your environment, it is important to first determine what features, apps, and type of identities are needed. It is also important to ensure that your security team has approved of the use of the HoloLens on the company's network. Please see [Frequently ask security questions](hololens-faq-security.md) for additional security information. - -### Type of Identity - -Determine the type of identity that will be used to sign into the device. - -1. **Local Accounts:** This account is local to the device (like a local admin account on a windows PC). This will allow only 1 user to log into the device. -2. **MSA:** This is a personal account (like outlook, hotmail, gmail, yahoo, etc.) This will allow only 1 user to log into the device. -3. **Azure Active Directory (Azure AD) accounts:** This is an account created in Azure AD. This grants your corporation the ability to manage the HoloLens device. This will allow multiple users to log into the HoloLens 1st Gen Commercial Suite/the HoloLens 2 device. - -For more detailed information about identity types, please visit our [HoloLens Identity](hololens-identity.md) article. - -### Type of Features - -Your feature requirements will determine which HoloLens you need. One popular feature that we see deployed in customer environments frequently is Kiosk Mode. A list of HoloLens key features, and the editions of HoloLens that support them, can be found [here](hololens-commercial-features.md). - -**What is Kiosk Mode?** - -Kiosk mode is a way to restrict the apps that a user has access to. This means that users will only be allowed to access certain apps. - -**What Kiosk Mode do I require?** - -There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk mode allows user to only access one app while multi-app kiosk mode allows users to access multiple, specified apps. To determine which kiosk mode is right for your corporation, the following two questions need to be answered: - -1. **Do different users require different experiences/restrictions?** Consider the following example: User A is a field service engineer who only needs access to Remote Assist. User B is a trainee who only needs access to Guides. - 1. If yes, you will require the following: - 1. Azure AD Accounts as the method of signing into the device. - 1. **Multi-app** kiosk mode. - 1. If no, continue to question two -1. **Do you require a multi-app experience?** - 1. If yes, **Multi-app** kiosk is mode is needed - 1. If your answer to question 1 and 2 are both no, **single-app** kiosk mode can be used - -**How to Configure Kiosk Mode:** - -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. - -### Apps and App Specific Scenarios - -The majority of the steps found in this document will also apply to the following apps: - -| App | App Specific Scenarios | -| --- | --- | -| Remote Assist | [Cross Tenant Communication](https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/cross-tenant-overview)| -| Guides | *Coming Soon* | -|Custom Apps | *Coming Soon* | - -### Determine your enrollment method - -1. Bulk enrollment with a security token in a provisioning package. - Pros: this is the most automated approach\ - Cons: takes initial server-side setup -1. Auto-enroll on user sign in. - Pros: easiest approach - Cons: users will need to complete set up after the provisioning package has been applied -1. _not recommended_ - Manually enroll post-setup. - Pros: possible to enroll after set up - Cons: most manual approach and devices aren't centrally manageable until they're manually enrolled. - - More information can be found [here](hololens-enroll-mdm.md) - -### Determine if you need to create a provisioning package - -There are two methods to configure a HoloLens device (Provisioning packages and MDMs). We suggest using your MDM to configure you HoloLens device. However, there are some scenarios where using a provisioning package is the better choice: - -1. You want to configure the HoloLens to skip the Out of Box Experience (OOBE) -1. You are having trouble deploying certificate in a complex network. The majority of the time you can deploy certificates using MDM (even in complex environments). However, some scenarios require certificates to be deployed through the provisioning package. - -Some of the HoloLens configurations you can apply in a provisioning package: - -- Apply certificates to the device -- Set up a Wi-Fi connection -- Pre-configure out of box questions like language and locale -- (HoloLens 2) bulk enroll in mobile device management -- (HoloLens v1) Apply key to enable Windows Holographic for Business - -If you decide to use provisioning packages, follow [this guide](hololens-provisioning.md). - -## Next Step: [Determine what licenses you need](hololens-licenses-requirements.md) - -## Get support - -Get support through the Microsoft support site. - -[File a support request](https://support.microsoft.com/supportforbusiness/productselection?sapid=e9391227-fa6d-927b-0fff-f96288631b8f) diff --git a/devices/hololens/hololens-spaces.md b/devices/hololens/hololens-spaces.md deleted file mode 100644 index 485e56773e..0000000000 --- a/devices/hololens/hololens-spaces.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: Map physical spaces with HoloLens -description: HoloLens learns what a space looks like over time. Users can facilitate this process by moving the HoloLens in certain ways through the space. -ms.assetid: bd55ecd1-697a-4b09-8274-48d1499fcb0b -author: dorreneb -ms.author: dobrown -ms.custom: -- CI 111456 -- CSSTroubleshooting -ms.date: 09/16/2019 -keywords: hololens, Windows Mixed Reality, design, spatial mapping, HoloLens, surface reconstruction, mesh, head tracking, mapping -ms.prod: hololens -ms.sitesec: library -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens 1 (1st gen) -- HoloLens 2 ---- - -# Map physical spaces with HoloLens - -HoloLens blends holograms with your physical world. To do that, HoloLens has to learn about the physical world around you and remember where you place holograms within that space. - -Over time, the HoloLens builds up a *spatial map* of the environment that it has seen. HoloLens updates the map as the environment changes. As long as you are logged in and the device is turned on, HoloLens creates and updates your spatial maps. If you hold or wear the device with the cameras pointed at a space, the HoloLens tries to map the area. While the HoloLens learns a space naturally over time, there are ways in which you can help HoloLens map your space more quickly and efficiently. - -> [!NOTE] -> If your HoloLens can't map your space or is out of calibration, HoloLens may enter Limited mode. In Limited mode, you won't be able to place holograms in your surroundings. - -This article explains how HoloLens maps spaces, how to improve spatial mapping, and how to manage the spatial data that HoloLens collects. - -## Choosing and setting up and your space - -Features in your environment can make it difficult for the HoloLens to interpret a space. Light levels, materials in the space, the layout of objects, and more can all affect how HoloLens maps an area. - -HoloLens works best in certain kinds of environments. To produce the best spatial map, choose a room that has adequate light and plenty of space. Avoid dark spaces and rooms that have a lot of dark, shiny, or translucent surfaces (for instance, mirrors or gauzy curtains). - -HoloLens is optimized for indoor use. Spatial mapping also works best when Wi-Fi is turned on, although it doesn't have to be connected to a network. HoloLens can obtain Wi-Fi access points even if it is not connected or authenticated. HoloLens functionality does not change whether the access points are internet-connected or intranet/local only. - -Only use HoloLens in safe places with no tripping hazards. [More on safety](https://support.microsoft.com/help/4023454/safety-information). - -## Mapping your space - -Now you're ready to start mapping your spare. When HoloLens starts mapping your surroundings, you'll see a mesh graphic spreading over the space. In mixed reality home, you can trigger the map to show by selecting on a mapped surface. - -Here are guidelines for building a great spatial map. - -### Understand the scenarios for the area - -It is important to spend the most time where you will be using the HoloLens, so that the map is relevant and complete. For example, if a user scenario for HoloLens involves moving from Point A to Point B, walk that path two to three times, looking in all directions as you move. - -### Walk slowly around the space - -If you walk too quickly around the area, it's likely that the HoloLens will miss mapping areas. Walk slowly around the space, stopping every 5-8 feet to look around at your surroundings. - -Smooth movements also help the HoloLens map more efficiently. - -### Look in all directions - -Looking around as you map the space gives the HoloLens more data on where points are relative to each other. - -If you don't look up, for example, the HoloLens may not know where the ceiling in a room is. - -Don't forget to look down at the floor as you map the space. - -### Cover key areas multiple times - -Moving through an area multiple times will help pick up features you may have missed on the first walkthrough. To build an ideal map, try traversing an area two to three times. - -If possible, while repeating these movements, spend time walking through an area in one direction, then turn around and walk back the way you came. - -### Take your time mapping the area - -It can take between 15 and 20 minutes for the HoloLens to fully map and adjust itself to its surroundings. If you have a space in which you plan to use a HoloLens frequently, taking that time up front to map the space can prevent issues later on. - -## Possible errors in the spatial map - -Errors in spatial mapping data fall into a few categories: - -- *Holes*: Real-world surfaces are missing from the spatial mapping data. -- *Hallucinations*: Surfaces exist in the spatial mapping data that do not exist in the real world. -- *Wormholes*: HoloLens 'loses' part of the spatial map by thinking it is in a different part of the map than it actually is. -- *Bias*: Surfaces in the spatial mapping data are imperfectly aligned with real-world surfaces, either pushed in or pulled out. - -If you see any of these errors please use the [FeedbackHub](hololens-feedback.md) to send feedback. - -## Security and storage for spatial data - -Windows 10 version 1803 update for Microsoft HoloLens and later stores mapping data in a local (on-device) database. - -HoloLens users cannot directly access the map database, even when the device is plugged into a PC or when using the File Explorer app. When BitLocker is enabled on HoloLens, the stored map data is also encrypted along with the entire volume. - -### Remove map data and known spaces from HoloLens - -There are two options for deleting map data in **Settings > System > Holograms**: - -- To delete nearby holograms, select **Remove nearby holograms**. This command clears the map data and anchored holograms for the current space. If you continue to use the device in the same space, it creates and stores a brand new map section to replace the deleted information. - - > [!NOTE] - > "Nearby" holograms are holograms that are anchored within the same map section in the current space. - - For example, you can use this option to clear work-related map data without affecting any home-related map data. - -- To delete all holograms, select **Remove all holograms**. This command clears all map data that is stored on the device as well as all anchored holograms. You will need to explicitly place any holograms. You will not be able to rediscover the previously-placed holograms. - -> [!NOTE] -> After you remove nearby or all holograms, HoloLens immediately starts scanning and mapping the current space. - -### Wi-Fi data in spatial maps - -HoloLens stores Wi-Fi characteristics to help correlate hologram locations and map sections that are stored within the HoloLens database of known spaces. Information about Wi-Fi characteristics is not accessible to users, and not sent to Microsoft using the cloud or using telemetry. - -As long as Wi-Fi is enabled, HoloLens correlates map data with nearby Wi-Fi access points. There is no difference in behavior whether a network is connected or just detected nearby. If Wi-Fi is disabled, HoloLens still searches the space. However, HoloLens has to search more of the map data within the spaces database, and may need more time to find holograms. Without the Wi-Fi info, the HoloLens has to compare active scans to all hologram anchors and map sections that are stored on the device in order to locate the correct portion of the map. - -## Related topics - -- [Spatial mapping design](https://docs.microsoft.com/windows/mixed-reality/spatial-mapping-design) diff --git a/devices/hololens/hololens-status.md b/devices/hololens/hololens-status.md deleted file mode 100644 index a1209dd3c8..0000000000 --- a/devices/hololens/hololens-status.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Status of the HoloLens services -description: Shows the status of HoloLens online services. -author: Teresa-Motiv -ms.author: v-tea -ms.reviewer: luoreill -manager: jarrettr -audience: Admin -ms.custom: -- CI 111456 -- CSSTroubleshooting -ms.topic: article -ms.prod: hololens -ms.localizationpriority: high -ms.sitesec: library ---- - -# Status of the HoloLens services - -✔️ **All services are active** - -**Key** ✔️ Good, ⓘ Information, ⚠ Warning, ❌ Critical - -Area|HoloLens (1st gen)|HoloLens 2 -----|:----:|:----: -[Azure services](https://status.azure.com/status)|✔️|✔️ -[Store app](https://www.microsoft.com/store/collections/hlgettingstarted/hololens)|✔️|✔️ -[Apps](https://www.microsoft.com/hololens/apps)|✔️|✔️ -[MDM](https://docs.microsoft.com/hololens/hololens-enroll-mdm)|✔️|✔️ - -## Notes and related topics - -[Frequently asked questions about using Skype for HoloLens](https://support.skype.com/faq/FA34641/frequently-asked-questions-about-using-skype-for-hololens) - -For more details about the status of the myriad Azure Services that can connect to HoloLens, see [Azure status](https://azure.microsoft.com/status/). - -For more details about current known issues, see [HoloLens known issues](hololens-known-issues.md). - -Follow HoloLens on [Twitter](https://twitter.com/HoloLens) and subscribe on [Reddit](https://www.reddit.com/r/HoloLens/). diff --git a/devices/hololens/hololens-troubleshooting.md b/devices/hololens/hololens-troubleshooting.md deleted file mode 100644 index b4d107902a..0000000000 --- a/devices/hololens/hololens-troubleshooting.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Troubleshoot HoloLens issues -description: Solutions for common HoloLens issues. -author: mattzmsft -ms.author: mazeller -ms.date: 12/02/2019 -ms.prod: hololens -ms.topic: article -ms.custom: CSSTroubleshooting -audience: ITPro -ms.localizationpriority: medium -keywords: issues, bug, troubleshoot, fix, help, support, HoloLens -manager: jarrettr -ms.custom: -- CI 111456 -- CSSTroubleshooting -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Troubleshoot HoloLens issues - -This article describes how to resolve several common HoloLens issues. - -## My HoloLens is unresponsive or won't start - -If your HoloLens won't start: - -- If the LEDs next to the power button don't light up, or only one LED briefly blinks, you may need to charge your HoloLens. -- If the LEDs light up when you press the power button but you can't see anything on the displays, hold the power button until all five of the LEDs turn off. - -If your HoloLens becomes frozen or unresponsive: - -- Turn off your HoloLens by pressing the power button until all five of the LEDs turn themselves off, or for 10 seconds if the LEDs are unresponsive. To start your HoloLens, press the power button again. - -If these steps don't work, you can try [recovering your device](hololens-recovery.md). - -## Holograms don't look good - -If your holograms are unstable, jumpy, or don't look right, try: - -- Cleaning your device visor and sensor bar on the front of your HoloLens. -- Increasing the light in your room. -- Walking around and looking at your surroundings so that HoloLens can scan them more completely. -- Calibrating your HoloLens for your eyes. Go to **Settings** > **System** > **Utilities**. Under **Calibration**, select **Open Calibration**. - -## HoloLens doesn't respond to gestures - -To make sure that HoloLens can see your gestures. Keep your hand in the gesture frame - when HoloLens can see your hand, the cursor changes from a dot to a ring. - -Learn more about using gestures on [HoloLens (1st gen)](hololens1-basic-usage.md#use-hololens-with-your-hands) or [HoloLens 2](hololens2-basic-usage.md#the-hand-tracking-frame). - -If your environment is too dark, HoloLens might not see your hand, so make sure that there's enough light. - -If your visor has fingerprints or smudges, use the microfiber cleaning cloth that came with the HoloLens to clean your visor gently. - -## HoloLens doesn't respond to my voice commands - -If Cortana isn't responding to your voice commands, make sure Cortana is turned on. On the All apps list, select **Cortana** > **Menu** > **Notebook** > **Settings** to make changes. To learn more about what you can say, see [Use your voice with HoloLens](hololens-cortana.md). - -## I can't place holograms or see holograms that I previously placed - -If HoloLens can't map or load your space, it enters Limited mode and you won't be able to place holograms or see holograms that you've placed. Here are some things to try: - -- Make sure that there's enough light in your environment so HoloLens can see and map the space. -- Make sure that you're connected to a Wi-Fi network. If you're not connected to Wi-Fi, HoloLens can't identify and load a known space. -- If you need to create a new space, connect to Wi-Fi, then restart your HoloLens. -- To see if the correct space is active, or to manually load a space, go to **Settings** > **System** > **Spaces**. -- If the correct space is loaded and you're still having problems, the space may be corrupt. To fix this issue, select the space, then select **Remove**. After you remove the space, HoloLens starts to map your surroundings and create a new space. - -## My HoloLens can't tell what space I'm in - -If your HoloLens can't identify and load the space you're in automatically, check the following factors: - -- Make sure that you're connected to Wi-Fi -- Make sure that there's plenty of light in the room -- Make sure that there haven't been any major changes to the surroundings. - -You can also load a space manually or manage your spaces by going to **Settings** > **System** > **Spaces**. - -## I'm getting a "low disk space" error - -You'll need to free up some storage space by doing one or more of the following: - -- Delete some unused spaces. Go to **Settings** > **System** > **Spaces**, select a space that you no longer need, and then select **Remove**. -- Remove some of the holograms that you've placed. -- Delete some pictures and videos from the Photos app. -- Uninstall some apps from your HoloLens. In the **All apps** list, tap and hold the app you want to uninstall, and then select **Uninstall**. - -## My HoloLens can't create a new space - -The most likely problem is that you're running low on storage space. Try one of the [previous tips](#im-getting-a-low-disk-space-error) to free up some disk space. - -## The HoloLens emulators isn't working - -Information about the HoloLens emulator is located in our developer documentation. Read more about [troubleshooting the HoloLens emulator](https://docs.microsoft.com/windows/mixed-reality/using-the-hololens-emulator#troubleshooting). diff --git a/devices/hololens/hololens-update-hololens.md b/devices/hololens/hololens-update-hololens.md deleted file mode 100644 index 14d8993c95..0000000000 --- a/devices/hololens/hololens-update-hololens.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Update HoloLens -description: Check your HoloLens' build number, update, and roll back updates. -keywords: how-to, update, roll back, HoloLens, check build, build number -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: medium -ms.date: 11/27/2019 -audience: ITPro -ms.reviewer: -manager: jarrettr -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Update HoloLens - -HoloLens uses Windows Update, just like other Windows 10 devices. Your HoloLens will automatically download and install system updates whenever it is plugged-in to power and connected to the Internet, even when it is in standby. - -This article will walk through HoloLens tools for: - -- viewing your current operating system version (build number) -- checking for updates -- manually updating HoloLens -- rolling back to an older update - -## Check your operating system version (build number) - -You can verify the system version number, (build number) by opening the Settings app and selecting **System** > **About**. - -## Check for updates and manually update - -You can check for updates any time in settings. To see available updates and check for new updates: - -1. Open the **Settings** app. -1. Navigate to **Update & Security** > **Windows Update**. -1. Select **Check for updates**. - -If an update is available, it will start downloading the new version. After the download is complete, select the **Restart Now** button to trigger the installation. If your device is below 40% and not plugged in, restarting will not start installing the update. - -While your HoloLens is installing the update, it will display spinning gears and a progress indicator. Do not turn off your HoloLens during this time. It will restart automatically once it has completed the installation. - -HoloLens applies one update at a time. If your HoloLens is more than one version behind the latest you may need to run through the update process multiple times to get it fully up to date. - -## Go back to a previous version - HoloLens 2 - -In some cases, you might want to go back to a previous version of the HoloLens software. You can do this by using the Advanced Recovery Companion to reset your HoloLens to the earlier version. - -> [!NOTE] -> Going back to an earlier version deletes your personal files and settings. - -To go back to a previous version of HoloLens 2, follow these steps: - -1. Make sure that you don't have any phones or Windows devices plugged in to your PC. -1. On your PC, download the [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from the Microsoft Store. -1. Download the [most recent HoloLens 2 release](https://aka.ms/hololens2download). -1. When you have finished these downloads, open **File explorer** > **Downloads**. Right-click the zipped folder that you just downloaded, and select **Extract all** > **Extract** to unzip it. -1. Connect your HoloLens to your PC using a USB-A to USB-C cable. (Even if you've been using other cables to connect your HoloLens, this one works best.) -1. The Advanced Recovery Companion automatically detects your HoloLens. Select the **Microsoft HoloLens** tile. -1. On the next screen, select **Manual package selection** and then select the installation file contained in the folder that you unzipped in step 4. (Look for a file with the .ffu extension.) -1. Select **Install software**, and follow the instructions. - -## Go back to a previous version - HoloLens (1st Gen) - -In some cases, you might want to go back to a previous version of the HoloLens software. You can do this by using the Windows Device Recovery Tool to reset your HoloLens to the earlier version. - -> [!NOTE] -> Going back to an earlier version deletes your personal files and settings. - -To go back to a previous version of HoloLens 1, follow these steps: - -1. Make sure that you don't have any phones or Windows devices plugged in to your PC. -1. On your PC, download the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379). -1. Download the [HoloLens Anniversary Update recovery package](https://aka.ms/hololensrecovery). -1. When the downloads finish, open **File explorer** > **Downloads**. Right-click the zipped folder you just downloaded, and select **Extract all** > **Extract** to unzip it. -1. Connect your HoloLens to your PC using the micro-USB cable that it came with. (Even if you've been using other cables to connect your HoloLens, this one works best.) -1. The WDRT will automatically detect your HoloLens. Select the **Microsoft HoloLens** tile. -1. On the next screen, select **Manual package selection** and choose the installation file contained in the folder you unzipped in step 4. (Look for a file with the .ffu extension.) -1. Select **Install software**, and follow the instructions. - -> [!NOTE] -> If the WDRT doesn't detect your HoloLens, try restarting your PC. If that doesn't work, select **My device was not detected**, select **Microsoft HoloLens**, and then follow the instructions. - -## Windows Insider Program on HoloLens - -Want to see the latest features in HoloLens? If so, join the Windows Insider Program; you'll get access to preview builds of HoloLens software updates before they're available to the general public. - -[Get Windows Insider preview for Microsoft HoloLens](hololens-insider.md). diff --git a/devices/hololens/hololens-updates.md b/devices/hololens/hololens-updates.md deleted file mode 100644 index 2b4e28a971..0000000000 --- a/devices/hololens/hololens-updates.md +++ /dev/null @@ -1,216 +0,0 @@ ---- -title: Manage HoloLens updates -description: Administrators can use mobile device management to manage updates to HoloLens devices. -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -audience: ITPro -ms.topic: article -ms.localizationpriority: high -ms.date: 03/24/2020 -ms.reviewer: jarrettr -manager: jarrettr -ms.custom: -- CI 115825 -- CI 111456 -- CSSTroubleshooting -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Manage HoloLens updates - -HoloLens uses Windows Update in the same manner as other Windows 10 devices. When an update is available, it is automatically downloaded and installed the next time that your device is plugged in and connected to the internet. This article describes how to manage updates in an enterprise or other managed environment. For information about managing updates to individual HoloLens devices, see [Update HoloLens](hololens-update-hololens.md). - -## Manage updates automatically - -Windows Holographic for Business can use [Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) to manage updates. All HoloLens 2 devices can use Windows Holographic for Business. Make sure that they use Windows Holographic for Business build 10.0.18362.1042 or a later build. If you have HoloLens (1st gen) devices, you have to [upgrade them to Windows Holographic for Business](hololens1-upgrade-enterprise.md) to manage their updates. - -Windows Update for Business connects HoloLens devices directly to the Windows Update service. By using Windows Update for Business, you can control multiple aspects of the update process—that is, which devices get which updates at what time. For example, you can roll out updates to a subset of devices for testing, then roll out updates to the remaining devices at a later date. Or, you can define different update schedules for different types of updates. - -> [!NOTE] -> For HoloLens devices, you can automatically manage feature updates (released twice a year) and quality updates (released monthly or as required, including critical security updates). For more information about update types, see [Types of updates managed by Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb#types-of-updates-managed-by-windows-update-for-business). - -You can configure Windows Update for Business settings for HoloLens by using policies in a Mobile Device Management (MDM) solution such as Microsoft Intune. - -For a detailed discussion about how to use Intune to configure Windows Update for Business, see [Manage Windows 10 software updates in Intune](https://docs.microsoft.com/intune/protect/windows-update-for-business-configure). - -> [!IMPORTANT] -> Intune provides two policy types for managing updates: *Windows 10 update ring* and *Windows 10 feature updates*. The Windows 10 feature update policy type is in public preview at this time and is not supported for HoloLens. -> -> You can use Windows 10 update ring policies to manage HoloLens 2 updates. - -### Configure update policies for HoloLens 2 or HoloLens (1st gen) - -This section describes the policies that you can use to manage updates for either HoloLens 2 or HoloLens (1st gen). For information about additional functionality that is available for HoloLens 2, see [Plan and configure update rollouts for HoloLens 2](#plan-and-configure-update-rollouts-for-hololens-2). - -The [Policy configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update) defines the policies that configure Windows Update for Business. - -> [!NOTE] -> For details about specific policies that are supported by specific editions of HoloLens, see [Policies supported by HoloLens devices](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#policies-supported-by-hololens-devices). - -#### Configure automatic checks for updates - -You can use the **Update/AllowAutoUpdate** policy to manage automatic update behavior, such as scanning, downloading, and installing updates. - -This policy supports the following values: - -- **0** - Notify the user when there is an update that is ready to download that applies to the device. -- **1** - Automatically install the update, and then notify the user to schedule a device restart. -- **2** - Automatically install the update, and then restart the device. This is the recommended value, and it is the default value for this policy. - -- **3** - Automatically install the update, and then restart at a specified time. Specify the installation day and time. If no day and time are specified, the default is daily at 3 A.M. - -- **4** - Automatically install the update, and then restart the device. This option also sets the Settings page to read-only. - -- **5** - Turn off automatic updates. - -For more details about the available settings for this policy, see [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate). - -> [!NOTE] -> In Microsoft Intune, you can use **Automatic Update Behavior** to change this policy. For more information, see [Manage software updates in Microsoft Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure). - -#### Configure an update schedule - -To configure how and when updates are applied, use the following policies: - -- [Update/ScheduledInstallDay](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday). - - Values: **0**–**7** (0 = every day, 1 = Sunday, 7 = Saturday) - - Default value: **0** (every day) -- [Update/ScheduledInstallTime](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime). - - Values: 0–23 (0 = midnight, 23 = 11 P.M.) - - Default value: 3 P.M. - -#### For devices that run Windows 10, version 1607 only - -You can use the following update policies to configure devices to get updates from the Windows Server Update Service (WSUS), instead of Windows Update: - -- [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice) -- [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval) -- [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl) - -### Plan and configure update rollouts for HoloLens 2 - -HoloLens 2 supports more update automation features than HoloLens (1st gen). this is especially true if you use Microsoft Intune to manage Windows Update for Business policy. These features make it easier for you to plan and implement update rollouts across your organization. - -#### Plan the update strategy - -Windows Updates for Business supports deferral policies. After Microsoft releases an update, you can use a deferral policy to define how long to wait before installing that update on devices. By associating subsets of your devices (referred to as *update rings*) with different deferral policies, you can coordinate an update rollout strategy for your organization. - -For example, consider an organization that has 1,000 devices and has to update them in five ways. The organization can create five update rings, as shown in the following table. - -|Group |Number of devices |Deferral (days) | -| ---| :---: | :---: | -|Grp 1 (IT staff) |5 |0 | -|Grp 2 (early adopters) |50 |60 | -|Grp 3 (main 1) |250 |120 | -|Grp 4 (main 2) |300 |150 | -|Grp 5 (main 3) |395 |180 | - -Here's how the rollout progresses over time to the entire organization. - -![Timeline for deploying updates](./images/hololens-updates-timeline.png) - -#### Configure an update deferral policy - -A deferral policy specifies the number of days between the date that an update becomes available and the date that the update is offered to a device. - -You can configure different deferrals for feature updates and quality updates. The following table lists the specific policies to use for each type, as well as the maximum deferral for each. - -|Category |Policy |Maximum deferral | -| --- | --- | --- | -|Feature updates |DeferFeatureUpdatesPeriodInDays |365 days | -|Quality updates |DeferQualityUpdatesPeriodInDays |30 days | - -#### Examples: Using Intune to manage updates - -**Example 1: Create and assign an update ring** - -For a more detailed version of this example, see [Create and assign update rings](https://docs.microsoft.com/mem/intune/protect/windows-update-for-business-configure#create-and-assign-update-rings). - -1. Sign in to the [Microsoft Endpoint Manager Admin Center](https://go.microsoft.com/fwlink/?linkid=2109431), and navigate to your Intune profiles. -1. Select **Software Updates** > **Windows 10 update rings** > **Create**. -1. Under **Basics**, specify a name and a description (optional), and then select **Next**. -1. Under **Update ring settings**, for **Servicing channel**, select **Semi-Annual Channel**, and then change **Feature update deferral period** to **120**. Then, select **Next**. -1. Under **Assignments**, select **+ Select groups to include**, and then assign the update ring to one or more groups. Use **+ Select groups to exclude** to fine-tune the assignments. Then, select **Next**. -1. Under **Review + create**, review the settings. When you're ready to save the update ring configuration, select **Create**. - -The list of update rings now includes the new Windows 10 update ring. - -**Example 2: Pause an update ring** - -If you encounter a problem when you deploy a feature or quality update, you can pause the update for 35 days (starting from a specified date). This pause prevents other devices from installing the update until you resolve or mitigate the issue. If you pause a feature update, quality updates are still offered to devices to make sure that they stay secure. After the specified time has passed, the pause automatically expires. At that point, the update process resumes. - -To pause an update ring in Intune, follow these steps: - -1. On the overview page for the update ring, select **Pause**. -1. Select the type of update (**Feature** or **Quality**) to pause, and then select **OK**. - -When an update type is paused, the Overview pane for that ring displays how many days remain before that update type resumes. - -While the update ring is paused, you can select either of the following options: - -- To extend the pause period for an update type for 35 days, select **Extend**. -- To restore updates for that ring to active operation, select **Resume**. You can pause the update ring again if it is necessary. - -> [!NOTE] -> The **Uninstall** operation for update rings is not supported for HoloLens 2 devices. - -## Manually check for updates - -Although HoloLens periodically checks for system updates so that you don't have to, there may be circumstances in which you want to manually check. - -To manually check for updates, go to **Settings** > **Update & Security** > **Check for updates**. If the Settings app indicates that your device is up to date, you have all the updates that are currently available. - -## Manually revert an update - -In some cases, you might want to go back to a previous version of the HoloLens software. The process for doing this depends on whether you are using HoloLens 2 or HoloLens (1st gen). - -### Go back to a previous version (HoloLens 2) - -You can roll back updates and return to a previous version of HoloLens 2 by using the Advanced Recovery Companion to reset your HoloLens to the earlier version. - -> [!NOTE] -> Reverting to an earlier version deletes your personal files and settings. - -To go back to a previous version of HoloLens 2, follow these steps: - -1. Make sure that you don't have any phones or Windows devices plugged in to your computer. -1. On your computer, download the [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from the Microsoft Store. -1. Download the [most recent HoloLens 2 release](https://aka.ms/hololens2download). -1. When you have finished these downloads, open **File explorer** > **Downloads**, right-click the compressed (zipped) folder that you just downloaded, and then select **Extract all** > **Extract** to expand the file. -1. Use a USB-A to USB-C cable to connect your HoloLens device to your computer. Even if you've been using other cables to connect your HoloLens, this kind of cable works best. -1. The Advanced Recovery Companion automatically detects your HoloLens device. Select the **Microsoft HoloLens** tile. -1. On the next screen, select **Manual package selection**, and then open the folder that you previously expanded. -1. Select the installation file (the file that has an .ffu extension). -1. Select **Install software**, and then follow the instructions. - -### Go back to a previous version (HoloLens (1st gen)) - -You can roll back updates and return to a previous version of HoloLens (1st gen) by using the Windows Device Recovery Tool to reset your HoloLens to the earlier version. - -> [!NOTE] -> Reverting to an earlier version deletes your personal files and settings. - -To go back to a previous version of HoloLens (1st gen), follow these steps: - -1. Make sure that you don't have any phones or Windows devices plugged in to your computer. -1. On your computer, download the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379). -1. Download the [HoloLens Anniversary Update recovery package](https://aka.ms/hololensrecovery). -1. After the downloads finish, open **File explorer** > **Downloads**, right-click the compressed (zipped) folder that you just downloaded, and then select **Extract all** > **Extract** to expand the file. -1. Use the micro-USB cable that was provided together with your HoloLens device to connect your HoloLens device to your computer. Even if you've been using other cables to connect your HoloLens device, this one works best. -1. The WDRT automatically detects your HoloLens device. Select the **Microsoft HoloLens** tile. -1. On the next screen, select **Manual package selection**, and then open the folder that you previously expanded. -1. Select the installation file (the file that has an .ffu extension). -1. Select **Install software**, and then follow the instructions. - -> [!NOTE] -> If the WDRT doesn't detect your HoloLens device, try restarting your computer. If that doesn't work, select **My device was not detected**, select **Microsoft HoloLens**, and then follow the instructions. - -## Related articles - -- [Deploy updates using Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) -- [Assign devices to servicing channels for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates) -- [Manage Windows 10 software updates in Intune](https://docs.microsoft.com/mem/intune/protect/windows-update-for-business-configure) diff --git a/devices/hololens/hololens1-basic-usage.md b/devices/hololens/hololens1-basic-usage.md deleted file mode 100644 index 282eaada0a..0000000000 --- a/devices/hololens/hololens1-basic-usage.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Getting around HoloLens (1st gen) -description: A brief tour of the HoloLens (1st gen) interface -ms.assetid: 064f7eb0-190e-4643-abeb-ed3b09312042 -ms.date: 9/16/2019 -ms.reviewer: jarrettr -manager: jarrettr -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens (1st gen) ---- - -# Getting around HoloLens (1st gen) - -Ready to step into the world of holograms? Here's some information to get started. - -This guide provides an intro to mixed reality, gestures for interacting with holograms, and an intro to Windows Holographic. - -## Discover mixed reality - -On HoloLens, holograms blend with your physical environment to look and sound like they're part of your world. Even when holograms are all around you, you can still see your surroundings, move freely, and interact with other people and objects. We call this experience "mixed reality." - -The holographic frame positions your holograms where your eyes are most sensitive to detail, and the see-through lenses leave your peripheral vision unobscured. With spatial sound, you can pinpoint a hologram even if it’s behind you. And because HoloLens learns and understands your environment, you can place holograms on and around real objects—and so can your apps and games. So a character in a game might sit down on your sofa, or [space robots could bust out of your walls](https://www.microsoft.com/store/apps/9nblggh5fv3j). - -## Use HoloLens with your hands - -Getting around HoloLens is a lot like using your smart phone. You can use your hands to manipulate holographic windows, menus, and buttons. Instead of pointing, clicking, or tapping, you'll use your gaze, your [voice](hololens-cortana.md), and gestures to select apps and holograms and to get around HoloLens. - -When you know these basic interactions, getting around on HoloLens will be a snap. - -We'll walk you through the basics the first time you use your HoloLens. You'll also find a gesture tutorial on your **Start** menu—look for the Learn Gestures app. - -### The hand-tracking frame - -HoloLens has sensors that can see a few feet to either side of you. When you use your hands, you'll need to keep them inside that frame, or HoloLens won't see them. As you move around, the frame moves with you. - -![Image that shows the HoloLens hand-tracking frame](./images/hololens-2-gesture-frame.png) - -### Open the Start menu with bloom - -To open the **Start** menu: - -1. Hold your hand in front of you so it's in the gesture frame. -1. Bloom: bring all of your fingers together then open your hand. - ![Animation that shows the bloom gesture](./images/hololens-bloom.gif) - -### Select holograms with gaze and air tap - -To select an app or other hologram, air tap it while looking directly at the hologram you're selecting. To do this, follow these steps: - -1. Gaze at the hologram you want to select. -1. Point your index finger straight up toward the ceiling. -1. Air tap: lower your finger, then quickly raise it. - ![Air-tap gesture animation](./images/hololens-air-tap.gif) - -### Select a hologram by using your voice - -1. The gaze cursor is a dot that you move around by moving your head. You can use it to target voice commands with precision. -1. Gaze at the hologram that you want to select. -1. To select the hologram, say "Select." - -## Holograms and apps - -Now it's time to put gestures to the test! - -You'll find your installed apps in the [Start menu](holographic-home.md) and there are more apps for HoloLens (1st gen) in the Microsoft Store. - -Open the **Start** menu and select an app! - -Using apps on HoloLens is a little different from on a PC: Some apps use a 2D view and look like other Windows applications. Other apps (immersive apps) use a 3D view and when you launch them, they become the only app you see. - -When you place an app window or app launcher, it will stay put until you remove it. You can move or resize these holograms in your mixed reality home at any time. - -## Move, resize, and rotate apps - -Moving and resizing apps on HoloLens works a bit differently than it does on a PC. Instead of dragging the app, you'll use your gaze, along with a [gesture](https://support.microsoft.com/help/12644/hololens-use-gestures) or the [clicker](hololens1-clicker.md). You can also rotate an app window in 3D space. - -> [!TIP] -> Rearrange apps using your voice - gaze at an app and say "Face me," "Bigger," or "Smaller." Or have Cortana move an app for you: say "Hey Cortana, move \**app name\** here." - -### Move an app - -Gaze at the app (at the title bar of an app window), and then do one of the following. - -- Tap and hold to select the app. Move your hand to position the app, and raise your finger to place it. -- Select **Adjust**, tap and hold, and move your hand to position the app. Raise your finger to place it, then select **Done**. -- Select **Adjust**, click and hold the clicker, and move your hand to position the app. Release the clicker, then select **Done**. - -> [!TIP] -> If you drop apps when you move them, make sure to keep your hand in the gesture frame by following it with your gaze. - -### Resize an app - -Gaze at the app, and then do one of the following. - -- Gaze at a corner or edge of an app window, and tap and hold. Move your hand to change the app's size, and raise your finger when you're done. -- Select **Adjust**. Gaze at one of the blue squares at the corners of the app, tap and hold, then move your hand to resize the app. Raise your finger to release it, then select **Done**. -- Select **Adjust**. Gaze at one of the blue squares at the corners of the app, click and hold the clicker, then move your hand to resize the app. Release the clicker, then select **Done**. - -> [!TIP] -> In Adjust mode, you can move or resize any hologram. - -### Rotate an app - -Gaze at the app, and tap and hold with both hands to select it. Rotate the app by keeping one hand steady and moving your other hand around it. When you're done, raise both index fingers. - -### Scroll content in an app window - -Gaze at the content of the app window. Tap and hold and then move your hand slightly upwards or downwards to scroll the content. - -## Meet the HoloLens (1st gen) Clicker - -The [HoloLens (1st Gen) clicker](hololens1-clicker.md) gives you another way to interact with holograms. [Pair it](hololens-connect-devices.md) with your HoloLens and then use it along with your gaze to select, scroll, and more. - -## Next steps - -Congratulations! you're ready to use HoloLens (1st gen). - -Now you can configure your HoloLens (1st gen) to meet your specific needs. - -[Connect bluetooth devices like mouse and keyboard](hololens-connect-devices.md) - -[Learn more about Voice and Cortana](hololens-cortana.md) - -### Help! I don't see my holograms - -If you don’t see holograms that you’ve placed while using HoloLens, here are some things to try: - -- Make sure that you’re looking in the right area—remember, holograms stay where you left them! -- Make sure that you're in a well-lit room without a lot of direct sunlight. -- Wait. When HoloLens has trouble recognizing your space, previously placed holograms can take up to a minute to reappear. -- If issue persists, you may want to clear out your Holograms storage data in **Settings** > **System** > **Holograms**, then place holograms in mixed reality home again. diff --git a/devices/hololens/hololens1-clicker.md b/devices/hololens/hololens1-clicker.md deleted file mode 100644 index 9da6a40ba5..0000000000 --- a/devices/hololens/hololens1-clicker.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Use the HoloLens clicker -description: This article outlines how to use the HoloLens clicker, including clicker pairing, charging, and recovery. -ms.assetid: 7d4a30fd-cf1d-4c9a-8eb1-1968ccecbe59 -ms.date: 09/16/2019 -manager: jarrettr -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens (1st gen) ---- - -# Use the HoloLens (1st gen) clicker - -The clicker was designed specifically for HoloLens (1st gen) and gives you another way to interact with holograms. It comes with HoloLens (1st gen), in a separate box. - -Use it in place of hand gestures to select, scroll, move, and resize apps. - -## Clicker hardware and pairing - -The HoloLens (1st gen) clicker has a finger loop to make it easier to hold, and an indicator light. - -![The HoloLens Clicker](images/use-hololens-clicker-1.png) - -### Clicker indicator lights - -Here's what the lights on the clicker mean. - -- **Blinking white**. The clicker is in pairing mode. -- **Fast-blinking white**. Pairing was successful. -- **Solid white**. The clicker is charging. -- **Blinking amber**. The battery is low. -- **Solid amber**. The clicker ran into an error and you'll need to restart it. While pressing the pairing button, click and hold for 15 seconds. - -### Pair the clicker with your HoloLens (1st gen) - -1. Use the bloom gesture to go to **Start**, then select **Settings** > **Devices** and verify that Bluetooth is on. -1. On the clicker, press and hold the pairing button until the status light blinks white. -1. On the pairing screen, select **Clicker** > **Pair**. - -### Charge the clicker - -When the clicker battery is low, the battery indicator will blink amber. Plug the Micro USB cable into a USB power supply to charge the device. - -## Use the clicker with HoloLens (1st gen) - -### Hold the clicker - -To put on the clicker, slide the loop over your ring or middle finger so that the Micro USB port faces toward your wrist. Rest your thumb in the indentation. - -![How to hold the Clicker](images/use-hololens-clicker-2.png) - -### Clicker gestures - -Clicker gestures are small wrist rotations, not the larger movements used for HoloLens hand gestures. And HoloLens recognizes your gestures and clicks even if the clicker is outside the [gesture frame](hololens1-basic-usage.md), so you can hold the clicker in the position that's most comfortable for you​. - -- **Select**. To select a hologram, button, or other element, gaze at it, then click. - -- **Click and hold**. Click and hold your thumb down on the button to do some of the same things you would with tap and hold, such as move or resize a hologram. - -- **Scroll**. On the app bar, select **Scroll Tool**. Click and hold, then rotate the clicker up, down, left, or right. To scroll faster, move your hand farther from the center of the scroll tool. - -- **Zoom**. On the app bar, select **Zoom Tool**. Click and hold, then rotate the clicker up to zoom in, or down to zoom out. - -> [!TIP] -> To zoom in or out when using Microsoft Edge, gaze at a page and double-click. - -## Restart or recover the clicker - -Here are some things to try if the HoloLens clicker is unresponsive or isn’t working well. - -### Restart the clicker - -Use the tip of a pen to press and hold the pairing button. At the same time, click and hold the clicker for 15 seconds. If the clicker was already paired with your HoloLens, it will stay paired after it restarts. - -If the clicker won't turn on or restart, try charging it by using the HoloLens charger. If the battery is very low, it might take a few minutes for the white indicator light to turn on. - -### Re-pair the clicker - -Select **Settings** > **Devices** and select the clicker. Select **Remove**, wait a few seconds, then pair the clicker again. - -### Recover the clicker - -If restarting and re-pairing the clicker don’t fix the problem, the Windows Device Recovery Tool can help you recover it. The recovery process may take some time, and it will install the latest version of the clicker software. To use the tool, you’ll need a computer running Windows 10 or later that has at least 4 GB of free storage space. - -To recover the clicker: - -1. Download and install the [Windows Device Recovery Tool](https://dev.azure.com/ContentIdea/ContentIdea/_queries/query/8a004dbe-73f8-4a32-94bc-368fc2f2a895/) on your computer. -1. Connect the clicker to your computer by using the Micro USB cable that came with your HoloLens. -1. Run the Windows Device Recovery Tool and follow the instructions. - -If the clicker isn’t automatically detected, select **My device was not detected** and follow the instructions to put your device into recovery mode. diff --git a/devices/hololens/hololens1-fit-comfort-faq.md b/devices/hololens/hololens1-fit-comfort-faq.md deleted file mode 100644 index d76375918c..0000000000 --- a/devices/hololens/hololens1-fit-comfort-faq.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: HoloLens (1st gen) fit and comfort frequently asked questions -description: Answers to frequently asked questions about how to fit your HoloLens (1st gen). -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -ms.localizationpriority: high -ms.date: 10/09/2019 -ms.reviewer: jarrettr -audience: ITPro -manager: jarrettr -appliesto: -- HoloLens (1st gen) ---- - -# HoloLens (1st gen) fit and comfort frequently asked questions - -Here are some tips on how to stay comfortable and have the best experience using your HoloLens. - -For step-by-step instructions and a video about putting on and adjusting your device, see [Get your HoloLens (1st gen) ready to use](hololens1-setup.md). - -> [!NOTE] -> The fit and comfort tips in this topic are meant only as general guidance—they don't replace any laws or regulations, or your good judgment when using HoloLens. Stay safe, and have fun! - -Here are some tips on how to stay comfortable and have the best experience using your HoloLens. - -## I'm experiencing discomfort when I use my device. What should I do? - -If you experience discomfort, take a break until you feel better. Try sitting in a well-lit room and relaxing for a bit. The next time your use your HoloLens, try using it for a shorter period of time at first. - -For more information, see [Health and safety on HoloLens](https://go.microsoft.com/fwlink/p/?LinkId=746661). - -## I can't see the whole holographic frame, or my holograms are cut off - -To see the top edge of the holographic frame, move the device so it sits higher on your head, or angle the headband up slightly in front. To see the bottom edge, move the device to sit lower on your head, or angle the headband down slightly in front. If the left or right edge of the view frame isn't visible, make sure the HoloLens visor is centered on your forehead. - -## I need to look up or down to see holograms - -Try adjusting the position of your device visor so the holographic frame matches your natural gaze. Here's how: - -- **If you need to look up to see holograms**. First, shift the back of the headband a bit higher on your head. Then use one hand to hold the headband in place and the other to gently rotate the visor so you have a good view of the holographic frame. -- **If you need to look down to see holograms**. First, shift the back of the headband a bit lower on your head. Then place your thumbs under the device arms and your index fingers on top of the headband, and gently squeeze with your thumbs to rotate the visor so you have a good view of the holographic frame. - -## The device slides down when I'm using it, or I need to make the headband too tight to keep it secure - -The overhead strap can help keep your HoloLens secure on your head, particularly if you're moving around a lot. The strap may also let you loosen the headband a bit. [Learn how to use it](hololens1-setup.md#adjust-fit). - -You can also experiment with the positioning of the headband—depending on your head size and shape, you may need to slide it up or down to reposition it on your forehead. - -## My HoloLens feels heavy on my nose - -If your HoloLens is adjusted correctly, the nose pad should rest lightly on your nose. If it feels heavy on your nose, try rotating the visor up or adjusting the angle of the headband. You can also slide the device visor out—grasp the device arms just behind the visor and pull forward gently. - -## How can I adjust HoloLens to fit with my glasses? - -The device visor can slide in and out to accommodate eyewear. Grasp the device arms just behind the visor and pull forward gently to adjust it. - -## My arm gets tired when I use gestures. What can I do? - -When using gestures, there's no need to extend your arm out far from your body. Keep it closer to your side, where it's more comfortable and will get less tired. [Learn more about gestures](hololens1-basic-usage.md#use-hololens-with-your-hands). - -And be sure to try out [voice commands](hololens-cortana.md) and the [HoloLens clicker](hololens1-clicker.md). diff --git a/devices/hololens/hololens1-hardware.md b/devices/hololens/hololens1-hardware.md deleted file mode 100644 index 285f44dd6a..0000000000 --- a/devices/hololens/hololens1-hardware.md +++ /dev/null @@ -1,166 +0,0 @@ ---- -title: HoloLens (1st gen) hardware -description: An outline of the components that make up Microsoft HoloLens (1st gen), the world's first fully untethered holographic computer running Windows. -ms.assetid: 527d494e-2ab6-46ca-bd5a-bfc6b43cc833 -ms.date: 09/16/2019 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: mattzmsft -ms.author: mazeller -ms.topic: article -manager: jarrettr -ms.localizationpriority: medium -appliesto: -- HoloLens (1st gen) ---- - -# HoloLens (1st gen) hardware - -![Microsoft HoloLens (1st gen)](images/see-through-400px.jpg) - -Microsoft HoloLens (1st gen) is the world's first fully untethered holographic computer. HoloLens redefines personal computing through holographic experiences to empower you in new ways. HoloLens blends cutting-edge optics and sensors to deliver 3D holograms pinned to the real world around you. - -## HoloLens components - -![Image that shows the contents of the box](images/hololens-box-contents.png) - -Your HoloLens includes the following features: - -- **Visor**. Contains the HoloLens sensors and displays. You can rotate the visor up while you are wearing the HoloLens. -- **Headband**. To put the HoloLens on, use the adjustment wheel to expand the headband. With the HoloLens in place, tighten the adjustment wheel until the headband is comfortable. -- **Brightness buttons**. When you're wearing the HoloLens, the brightness buttons are on the left side of the device. -- **Volume buttons**. When you're wearing the HoloLens, the volume buttons are on the right side of the device. -- **Device arms**. When you pick up, put on, or take off your HoloLens, always grasp or hold it by the device arms. - -## In the box - -> [!VIDEO https://www.microsoft.com/videoplayer/embed/c7ceb904-9d5f-4194-9e10-e8a949dbad7d] - -The HoloLens box contains the following items: - -- **Nose pads**. Select a nose pad that fits the shape of your nose and accommodates your eyewear. -- **Overhead strap**. When you're wearing the HoloLens while you move around, use the overhead strap to help keep the device in place. Additionally, if you're wearing the HoloLens for extended periods, using the overhead strap may make the device more comfortable to wear. -- **Micro USB cable**. Use the micro-USB cable to connect your HoloLens to the power supply for charging, or use it to connect your HoloLens to your computer. -- **Power supply**. Plugs into a power outlet. -- **Microfiber cloth**. Use the cloth to clean your HoloLens visor. - ->[!TIP] ->The [clicker](hololens1-clicker.md) ships with HoloLens (1st Gen), in a separate box. - -### Power Supply details - -The power supply and the USB cable that come with the device are the best supported mechanism for charging. The power supply is an 18W charger. It supplies 9V at 2A. - -Charging rate and speed may vary depending on the environment in which the device is running. - -In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger. - -## Device specifications - -### Display - -![HoloLens has see-through holographic lenses](images/displays-400px.jpg) - -| | | -| - | - | -| Optics | See-through holographic lenses (waveguides) | -| Holographic resolution | 2 HD 16:9 light engines producing 2.3M total light points | -| Holographic density | \>2.5k radiants (light points per radian) | -| Eye-based rendering | Automatic pupillary distance calibration | - -### Sensors - -![HoloLens has sensors for understanding its environment and user actions](images/sensor-bar-400px.jpg) - -- 1 inertial measurement unit (IMU) -- 4 environment understanding cameras -- 1 depth camera -- 1 2MP photo / HD video camera -- Mixed reality capture -- 4 microphones -- 1 ambient light sensor - -### Input, output, and connectivity - -- Built-in speakers -- Audio 3.5mm jack -- Volume up/down -- Brightness up/down -- Power button -- Battery status LEDs -- Wi-Fi 802.11ac -- Micro USB 2.0 -- Bluetooth 4.1 LE - -### Power - -- Battery Life -- 2-3 hours of active use -- Up to 2 weeks of standby time -- Fully functional when charging -- Passively cooled (no fans) - -### Processors - -![The motherboard for Microsoft HoloLens](images/motherboard-400px.jpg) - -- Intel 32-bit architecture with TPM 2.0 support -- Custom-built Microsoft Holographic Processing Unit (HPU 1.0) - -### Memory - -- 64 GB Flash -- 2 GB RAM - -### Fit - -| | | -| - | - | -| Sizing | Single size with adjustable band. Fits over glasses | -| Weight | 579 grams | - -## Device capabilities - -Using the following to understand user actions: - -- Gaze tracking -- Gesture input -- Voice support - -Using the following to understand the environment: - -- Spatial sound - -## Pre-installed software - -- Windows 10 -- Windows Store -- Holograms -- Microsoft Edge -- Photos -- Settings -- Windows Feedback -- Calibration -- Learn Gestures - -## Device certifications - -### Safety - -HoloLens has been tested and found to conform to the basic impact protection requirements of ANSI Z87.1, CSA Z94.3 and EN 166. - -## Care and cleaning - -Handle your HoloLens carefully. To lift, carry, and adjust your HoloLens, use the device arms—not the overhead strap. To keep the visor free of dust and fingerprints and avoid touching it. Repeated cleaning could damage the visor, so try to keep your device clean. - -Don't use any cleaners or solvents on your HoloLens, and don't submerge it in water or apply water directly to it. - -To clean the visor, remove any dust using a camel or goat hair lens brush or a bulb-style lens blower. Lightly moisten the microfiber cloth with a small amount of distilled water, then use it to wipe the visor gently in a circular motion. - -To clean the rest of the device, including the headband and device arms, use a lint-free cloth moistened with mild soap and water. Let your HoloLens dry completely before using it again. - -![Image that shows how to clean the visor](images/hololens-cleaning-visor.png) - -> [!div class="nextstepaction"] -> [Set up and start your HoloLens (1st gen)](hololens1-setup.md) diff --git a/devices/hololens/hololens1-install-localized.md b/devices/hololens/hololens1-install-localized.md deleted file mode 100644 index 52e4862bbe..0000000000 --- a/devices/hololens/hololens1-install-localized.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Install localized versions of HoloLens -description: Learn how to install the Chinese or Japanese versions of HoloLens -ms.prod: hololens -ms.mktglfcycl: manage -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: high -ms.date: 9/16/2019 -ms.reviewer: -manager: jarrettr -appliesto: -- HoloLens (1st gen) ---- - -# Install localized versions of HoloLens (1st gen) - -In order to switch to the Chinese or Japanese version of HoloLens, you’ll need to use the Windows Device Recovery Tool (WDRT) to download the build for the language on a PC and then install it on your HoloLens. - -> [!IMPORTANT] -> Using WDRT to install the Chinese or Japanese builds of HoloLens deletes existing data, such as personal files and settings, from your HoloLens. - -1. On your PC, download and install [the Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379). -1. Download the package for the language you want to your PC: [Simplified Chinese](https://aka.ms/hololensdownload-ch) or [Japanese](https://aka.ms/hololensdownload-jp). -1. When the download finishes, select **File Explorer** > **Downloads**. Right-click the zipped folder that you just downloaded, and select **Extract all** > **Extract** to unzip it. -1. Connect your HoloLens to your PC using the micro-USB cable that it shipped with. (Even if you've been using other cables to connect your HoloLens, this one works best.) -1. After the tool automatically detects your HoloLens, select the Microsoft HoloLens tile. -1. On the next screen, select **Manual package selection** and select the installation file that resides in the folder that you unzipped in step 4. (Look for a file that has the extension “.ffu”.) -1. Select **Install software** and follow the instructions. -1. After the build installs, HoloLens setup automatically starts. Put on the device and follow the setup directions. - -When you’re done with setup, go to **Settings** > **Update & Security** > **Windows Insider Program**, and check that you’re configured to receive the latest preview builds. Like the English preview builds, the Windows Insider Program keeps the Chinese and Japanese versions of HoloLens up-to-date with the latest preview builds. - -> [!NOTE] -> -> - You can’t use the Settings app to change the system language between English, Japanese, and Chinese. Flashing a new build is the only supported way to change the device system language. -> - While you can use the on-screen Pinyin keyboard to enter Simplified Chinese or Japanese text, using a Bluetooth hardware keyboard to type Simplified Chinese or Japanese text is not supported at this time. However, on Chinese or Japanese HoloLens, you can continue to use a Bluetooth keyboard to type in English (to toggle a hardware keyboard to type in English, press the ~ key). diff --git a/devices/hololens/hololens1-setup.md b/devices/hololens/hololens1-setup.md deleted file mode 100644 index cbbc2315b7..0000000000 --- a/devices/hololens/hololens1-setup.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Prepare a new HoloLens -description: This guide walks through first time set up. -ms.prod: hololens -ms.sitesec: library -author: JesseMcCulloch -ms.author: jemccull -ms.topic: article -ms.localizationpriority: high -ms.date: 8/12/2019 -ms.reviewer: -manager: jarrettr -appliesto: -- Hololens (1st gen) ---- - -# Get your HoloLens (1st gen) ready to use - -Follow along to set up a HoloLens (1st gen) for the first time. - -## Charge your HoloLens (1st gen) - -To charge your HoloLens, connect the power supply to the charging port by using the included Micro USB cable. Then plug the power supply into a power outlet. When the device is charging, the battery indicator will light up in a wave pattern. - -![Image that shows how to attach the Micro USB cable to the HoloLens](./images/hololens-charging.png) - -When your HoloLens is on, the battery indicator shows the battery level in increments. When only one of the five lights is on, the battery level is below 20 percent. If the battery level is critically low and you try to turn on the device, one light will blink briefly, then go out. - -> [!TIP] -> To get an estimate of your current battery level, say "Hey Cortana, how much battery do I have left?" - -The power supply and USB cable that come with the device are the best way to charge your HoloLens (1st gen). The power supply provides 18W of power (9V 2A). - -Charging rate and speed may vary depending on the environment in which the device is running. - -## Adjust fit - -> [!VIDEO https://www.microsoft.com/videoplayer/embed/be3cb527-f2f1-4f85-b4f7-a34fbaba980d] - -| | | -|:--- |:--- | -|1. Rotate the headband up to about 20-30 degrees.|![Step one, rotate the headband](./images/FitGuideStep1.png)| -|2. Push the headband back. Do not pull it back, or manipulate the band behind the hinge, because over time this can break the band.|![Step two, push the headband back](./images/FitGuideStep2.png)| -|3. Turn the adjustment wheel to extend the headband all the way out. |![Step three, use the adjustment wheel to extend the headband](./images/FitGuideStep3.png)| -|4. Hold the device by the device arms, and place it on your head. Make sure that the headband sits at the top of your forehead, and then tighten the adjustment wheel.|![Step four, put on the device and adjust the headband](./images/FitGuideStep4.png)| -|5. Slide the visor back, and then check the fit of the device. The headband should sit at the top of the forehead, just below your hairline, with the speakers above your ears. The lenses should be centered over your eyes.|![Step five, slide the visor back and check the fit](./images/FitGuideSetep5.png)| - -## Turn on your HoloLens - -Use the power button to turn HoloLens on and off or to put it in standby mode. - -![Image that shows the HoloLens power button](./images/hololens-power.png) - -If your device doesn't respond or won't start, see [Restart, reset, or recover HoloLens](hololens-restart-recover.md). - -When your HoloLens is off or in standby, turn it on by pressing the power button for one second. If it doesn't turn on, plug it in and charge it for at least 30 minutes. - -> [!TIP] -> To restart HoloLens, say "Hey Cortana, reboot the device." - -### Put HoloLens in standby - -To put your HoloLens in standby while it's turned on, press the power button once. The battery indicators blink off. To wake it from standby, press the power button again. - -HoloLens automatically goes into standby after 3 minutes of inactivity. When it's in standby, it automatically shuts down after 4 hours, or after the battery level drops by 10 percent. - -### Shut down HoloLens - -To shut down (turn off) HoloLens, hold the power button down for four seconds. The battery indicators turn off one by one and the device shuts down. - -HoloLens automatically shuts down when the battery level drops to one percent, even if it's plugged in. After you've recharged the battery to three percent, you'll be able to turn HoloLens on again. - -## Adjust volume and brightness - -The brightness and volume buttons are on top of the device arms—volume to your right and brightness to your left. - -![Image that shows the HoloLens buttons](./images/hololens-buttons.jpg) - -## HoloLens indicator lights - -![Image that shows the HoloLens indicator lights](./images/hololens-lights.png) - -Not sure what the indicator lights on your HoloLens mean? Here's some help. - -|When the lights do this |It means | -| - | - | -|Scroll from the center outward. |HoloLens is starting up. | -|Stay lit (all or some). |HoloLens is on and ready to use. Battery life is shown in 20 percent increments. | -|Scroll, then light up, then scroll. |HoloLens is on and charging. Battery life is shown in 20 percent increments. | -|Turn off one by one. |HoloLens is shutting down. | -|Turn off all at once. |HoloLens is going into standby. | -|All light up, then one blinks briefly, then all turn off. |Battery is critically low. HoloLens needs to charge. | -|All scroll, then one blinks, then all scroll. |Battery is critically low. HoloLens is charging. | - -## Safety and comfort - -### Use in safe surroundings - -Use your HoloLens in a safe space that’s free of obstructions and tripping hazards. Don’t use it when you need a clear field of view and your full attention, such as while you’re operating a vehicle or doing other potentially hazardous activities. - -### Stay comfortable - -Keep your first few sessions with HoloLens brief and be sure to take breaks. If you experience discomfort, stop and rest until you feel better. This might include temporary feelings of nausea, motion sickness, dizziness, disorientation, headache, fatigue, eye strain, or dry eyes. - -> [!div class="nextstepaction"] -> [Start and configure your HoloLens (1st gen)](hololens1-start.md) diff --git a/devices/hololens/hololens1-start.md b/devices/hololens/hololens1-start.md deleted file mode 100644 index 8cb970020a..0000000000 --- a/devices/hololens/hololens1-start.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Set up HoloLens (1st gen) -description: This guide walks through first time set up. You'll need a Wi-Fi network and either a Microsoft (MSA) or Azure Active Directory (Azure AD) account. -ms.assetid: 0136188e-1305-43be-906e-151d70292e87 -ms.prod: hololens -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -ms.date: 8/12/2019 -manager: jarrettr -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens (1st gen) ---- - -# Set up your HoloLens (1st gen) - -The first time you turn on your HoloLens, you'll be guided through calibrating your device, setting up your device, and signing in. This article walks through the HoloLens (1st gen) first start and setup experience. - -In the next section, you'll learn how to work with HoloLens and interact with holograms. To skip ahead to that article, see [Get started with HoloLens (1st gen)](hololens1-basic-usage.md). - -## Before you start - -Before you get started, make sure you have the following available: - -**A Wi-Fi connection**. You'll need to connect your HoloLens to a Wi-Fi network to set it up. The first time you connect, you'll need an open or password-protected network that doesn't require navigating to a website or using certificates to connect. [Learn more about the websites that HoloLens uses](hololens-offline.md). - -**A Microsoft account or a work account**. You'll also need to use a Microsoft account (or a work account, if your organization owns the device) to sign in to HoloLens. If you don't have a Microsoft account, go to [account.microsoft.com](https://account.microsoft.com) and set one up for free. - -**A safe, well-lit space with no tripping hazards**. [Health and safety info](https://go.microsoft.com/fwlink/p/?LinkId=746661). - -**The optional comfort accessories** that came with your HoloLens, to help you get the most comfortable fit. [More on fit and comfort](https://support.microsoft.com/help/12632/hololens-fit-your-hololens). - -> [!NOTE] -> -> - The first time that you use your HoloLens, [Cortana](hololens-cortana.md) is already on and ready to guide you (though she won't be able to respond to your questions until after you set up your device). You can turn Cortana off at any time in Cortana's settings. -> - In order to switch to the Chinese or Japanese version of HoloLens, you’ll need to download the build for the language on a PC and then install it on your HoloLens. For more information, see [Install localized versions of HoloLens (1st gen)](hololens1-install-localized.md). - -## Start your Hololens and set up Windows - -The first time you start your HoloLens, your first task is to set up Windows Holographic on your device. - -1. Connect to the internet (HoloLens guides you to select Wi-Fi network). - -1. Sign in to your user account. Choose between **My work or school owns it** and **I own it**. - - When you choose **My work or school owns it**, you sign in by using an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens automatically enrolls in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available, so you will need to [manually enroll HoloLens in device management](hololens-enroll-mdm.md#enroll-through-settings-app). To sign in to your device the first time by using a work or school account, follow these steps: - 1. Enter your organizational account information. - 1. Accept the privacy statement. - 1. Sign in by using your Azure AD credentials. This may redirect to your organization's sign-in page. - 1. Continue setting up the device. - - When you choose **I own it**, you sign in by using a Microsoft account. After setup is complete, you can [manually enroll HoloLens in device management](hololens-enroll-mdm.md#enroll-through-settings-app). - 1. Enter your Microsoft account information. - 1. Enter your password. If your Microsoft account requires [two-step verification (2FA)](https://blogs.technet.microsoft.com/microsoft_blog/2013/04/17/microsoft-account-gets-more-secure/), complete the verification process. - -1. The device sets your time zone based on information that it obtains from the Wi-Fi network. - -## Calibration - -After Cortana introduces herself, the next setup step is calibration. For the best HoloLens experience, you should complete the calibration process during setup. - -HoloLens (1st gen) uses the distance between your pupils (IPD or [interpupillary distance](https://en.wikipedia.org/wiki/Interpupillary_distance)) to make holograms clear and easy to interact with. If the IPD is not correct, holograms may appear to be unstable or at an incorrect distance. - -During calibration, HoloLens asks you to align your finger with a series of six targets per eye. HoloLens uses this process to set the correct IPD for your eyes. If the calibration needs to be updated or adjusted for a new user, the new user can run the Calibration app outside of setup. - -![IPD finger-alignment screen at second step](./images/ipd-finger-alignment-300px.jpg) - -*IPD finger-alignment screen at second step* - -Congratulations! Setup is complete and you can begin using HoloLens. - -## Next steps - -> [!div class="nextstepaction"] -> [Get started with HoloLens (1st gen)](hololens1-basic-usage.md) diff --git a/devices/hololens/hololens1-upgrade-enterprise.md b/devices/hololens/hololens1-upgrade-enterprise.md deleted file mode 100644 index 5e535af10d..0000000000 --- a/devices/hololens/hololens1-upgrade-enterprise.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Unlock Windows Holographic for Business features -description: When you upgrade to Windows Holographic for Business, HoloLens provides extra features that are designed for business. -ms.prod: hololens -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium -ms.date: 9/16/2019 -ms.reviewer: -manager: jarrettr -appliesto: -- HoloLens (1st gen) ---- - -# Unlock Windows Holographic for Business features - -Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 that is designed for HoloLens), and in the [Commercial Suite](hololens-commercial-features.md), which provides extra features designed for business. - -When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic for Business. You can apply this license to the device either by using the organization's [mobile device management (MDM) provider](#edition-upgrade-by-using-mdm) or a [provisioning package](#edition-upgrade-by-using-a-provisioning-package). - -> [!TIP] -> In Windows 10, version 1803, you can check that the HoloLens has been upgraded to the business edition by selecting **Settings** > **System**. - -## Edition upgrade by using MDM - -The enterprise license can be applied by any MDM provider that supports the [WindowsLicensing configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn904983.aspx). The latest version of the Microsoft MDM API will support WindowsLicensing CSP. - -For step-by-step instructions for upgrading HoloLens by using Microsoft Intune, see [Upgrade devices running Windows Holographic to Windows Holographic for Business](https://docs.microsoft.com/intune/holographic-upgrade). - - On other MDM providers, the specific steps for setting up and deploying the policy might vary. - -## Edition upgrade by using a provisioning package - -Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device. - -### Create a provisioning package that upgrades the Windows Holographic edition - -1. [Create a provisioning package for HoloLens.](hololens-provisioning.md) -1. Go to **Runtime settings** > **EditionUpgrade**, and select **EditionUpgradeWithLicense**. - - ![Upgrade edition with license setting selected](images/icd1.png) - -1. Find the XML license file that was provided when you purchased the Commercial Suite. - - > [!NOTE] - > You can configure [additional settings in the provisioning package](hololens-provisioning.md). - -1. On the **File** menu, select **Save**. - -1. Read the warning that project files may contain sensitive information and click **OK**. - - > [!IMPORTANT] - > When you build a provisioning package, you may include sensitive information in the project files and provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when no longer needed. - -1. On the **Export** menu, select **Provisioning package**. - -1. Change **Owner** to **IT Admin**, which sets the precedence of this provisioning package to be higher than others applied to this device from different sources, and then select **Next**. - -1. Set a value for **Package Version**. - - > [!TIP] - > You can make changes to existing packages and change the version number to update previously applied packages. - -1. On **Select security details for the provisioning package**, select **Next**. - -1. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. - - Optionally, you can select **Browse** to change the default output location. - -1. Select **Next**. - -1. Select **Build** to start building the package. The build page displays the project information, and the progress bar indicates the build status. - -1. When the build completes, select **Finish**. - -### Apply the provisioning package to HoloLens - -1. Using the USB cable, connect the device to a PC. Start the device, but do not continue past the **fit** page of the initial setup experience (the first page with the blue box). On the PC, HoloLens shows up as a device in File Explorer. - - > [!NOTE] - > If the HoloLens device is running Windows 10, version 1607 or earlier, open File Explorer by briefly pressing and releasing the **Volume Down** and **Power** buttons simultaneously on the device. - -1. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -1. While HoloLens is still on the **fit** page, briefly press and release the **Volume Down** and **Power** buttons simultaneously again. - -1. HoloLens asks you if you trust the package and would like to apply it. Confirm that you trust the package. - -1. You will see whether the package was applied successfully or not. If it was not applied successfully, you can fix your package and try again. If successful, proceed with device setup. diff --git a/devices/hololens/hololens2-autopilot.md b/devices/hololens/hololens2-autopilot.md deleted file mode 100644 index 5589ec096d..0000000000 --- a/devices/hololens/hololens2-autopilot.md +++ /dev/null @@ -1,248 +0,0 @@ ---- -title: Windows Autopilot for HoloLens 2 evaluation guide -description: -author: Teresa-Motiv -ms.author: v-tea -ms.date: 4/10/2020 -ms.prod: hololens -ms.topic: article -ms.custom: -- CI 116283 -- CSSTroubleshooting -audience: ITPro -ms.localizationpriority: high -keywords: autopilot -manager: jarrettr -appliesto: -- HoloLens 2 ---- - -# Windows Autopilot for HoloLens 2 evaluation guide - -When you set up HoloLens 2 devices for the Windows Autopilot program, your users can follow a simple process to provision the devices from the cloud. - -This Autopilot program supports Autopilot self-deploying mode to provision HoloLens 2 devices as shared devices under your tenant. Self-deploying mode leverages the device's preinstalled OEM image and drivers during the provisioning process. A user can provision the device without putting the device on and going through the Out-of-the-box Experience (OOBE). - -![The Autopilot self-deploying process configures shared devices in "headless" mode by using a network connection.](./images/hololens-ap-intro.png) - -When a user starts the Autopilot self-deploying process, the process completes the following steps: - -1. Join the device to Azure Active Directory (Azure AD). - > [!NOTE] - > Autopilot for HoloLens does not support Active Directory join or Hybrid Azure AD join. -1. Use Azure AD to enroll the device in Microsoft Intune (or another MDM service). -1. Download the device-targeted policies, user-targeted apps, certificates, and networking profiles. -1. Provision the device. -1. Present the sign-in screen to the user. - -## Windows Autopilot for HoloLens 2: Get started - -The following steps summarize the process of setting up your environment for the Windows Autopilot for HoloLens 2. The rest of this section provides the details of these steps. - -1. Make sure that you meet the requirements for Windows Autopilot for HoloLens. -1. Enroll in the Windows Autopilot for HoloLens 2 program. -1. Verify that your tenant is flighted (enrolled to participate in the program). -1. Register devices in Windows Autopilot. -1. Create a device group. -1. Create a deployment profile. -1. Verify the ESP configuration. -1. Configure a custom configuration profile for HoloLens devices (known issue). -1. Verify the profile status of the HoloLens devices. - -### 1. Make sure that you meet the requirements for Windows Autopilot for HoloLens -For the latest information about how to participate in the program, review [Windows Insider Release Notes](hololens-insider.md#windows-insider-release-notes). - -Review the following sections of the Windows Autopilot requirements article: - -- [Network requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#networking-requirements) -- [Licensing requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#licensing-requirements) -- [Configuration requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements#configuration-requirements) -> [!IMPORTANT] -> Unlike other Windows Autopilot programs, Windows Autopilot for HoloLens 2 has specific operating system requirements. - -Review the "[Requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/self-deploying#requirements)" section of the Windows Autopilot Self-Deploying mode article. Your environment has to meet these requirements as well as the standard Windows Autopilot requirements. - -> [!NOTE] -> You do not have to review the "Step by step" and "Validation" sections of the article. The procedures later in this article provide corresponding steps that are specific to HoloLens. - -> [!IMPORTANT] -> For information about how to register devices and configure profiles, see [4. Register devices in Windows Autopilot](#4-register-devices-in-windows-autopilot) and [6. Create a deployment profile](#6-create-a-deployment-profile) in this article. These sections provide steps that are specific to HoloLens. - -Before you start the OOBE and provisioning process, make sure that the HoloLens devices meet the following requirements: - -- The devices are not already members of Azure AD, and are not enrolled in Intune (or another MDM system). The Autopilot self-deploying process completes these steps. To make sure that all the device-related information is cleaned up, check the **Devices** pages in both Azure AD and Intune. -- Every device can connect to the internet. You can use a wired or wireless connection. -- Every device can connect to a computer by using a USB-C cable, and that computer has the following available: - - Advanced Recovery Companion (ARC) - - The latest Windows update: Windows 10, version 19041.1002.200107-0909 or a later version) - -To configure and manage the Autopilot self-deploying mode profiles, make sure that you have access to [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com). - -### 2. Enroll in the Windows Autopilot for HoloLens 2 program - -To participate in the program, you have to use a tenant that is flighted for HoloLens. To do this, go to [Windows Autopilot for HoloLens Private Preview request](https://aka.ms/APHoloLensTAP) or use the following QR code to submit a request. - -![Autopilot QR code](./images/hololens-ap-qrcode.png) - -In this request, provide the following information: - -- Tenant domain -- Tenant ID -- Number of HoloLens 2 devices that are participating in this evaluation -- Number of HoloLens 2 devices that you plan to deploy by using Autopilot self-deploying mode - -### 3. Verify that your tenant is flighted - -To verify that your tenant is flighted for the Autopilot program after you submit your request, follow these steps: - -1. Sign in to [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com). -1. Select **Devices** > **Windows** > **Windows enrollment** > **Windows Autopilot deployment profiles** > **Create profile**. - - ![Create profile dropdown includes a HoloLens item.](./images/hololens-ap-enrollment-profiles.png) - You should see a list that includes **HoloLens**. If this option is not present, use one of the [Feedback](#feedback) options to contact us. - -### 4. Register devices in Windows Autopilot - -To register a HoloLens device in the Windows Autopilot program, you have to obtain the hardware hash of the device (also known as the hardware ID). The device can record its hardware hash in a CSV file during the OOBE process, or later when a device owner starts the diagnostic log collection process (described in the following procedure). Typically, the device owner is the first user to sign in to the device. - -**Retrieve a device hardware hash** - -1. Start the HoloLens 2 device. -1. On the device, press the Power and Volume Down buttons at the same time and then release them. The device collects diagnostic logs and the hardware hash, and stores them in a set of .zip files. -1. Use a USB-C cable to connect the device to a computer. -1. On the computer, open File Explorer. Open **This PC\\\<*HoloLens device name*>\\Internal Storage\\Documents**, and locate the AutopilotDiagnostics.zip file. - - > [!NOTE] - > The .zip file may not immediately be available. If the file is not ready yet you may see a HoloLensDiagnostics.temp file in the Documents folder. To update the list of files, refresh the window. - -1. Extract the contents of the AutopilotDiagnostics.zip file. -1. In the extracted files, locate the CSV file that has a file name prefix of "DeviceHash." Copy that file to a drive on the computer where you can access it later. - > [!IMPORTANT] - > The data in the CSV file should use the following header and line format: - > ``` - > Device Serial Number,Windows Product ID,Hardware Hash,Group Tag,Assigned User ,,,, - >``` - -**Register the device in Windows Autopilot** - -1. In Microsoft Endpoint Manager Admin Center, select **Devices** > **Windows** > **Windows enrollment**, and then select **Devices** > **Import** under **Windows Autopilot Deployment Program**. - -1. Under **Add Windows Autopilot devices**, select the DeviceHash CSV file, select **Open**, and then select **Import**. - - ![Use the Import command to import the hardware hash.](./images/hololens-ap-hash-import.png) -1. After the import finishes, select **Devices** > **Windows** > **Windows enrollment** > **Devices** > **Sync**. The process might take a few minutes to complete, depending on how many devices are being synchronized. To see the registered device, select **Refresh**. - - ![Use the Sync and Refresh commands to view the device list.](./images/hololens-ap-devices-sync.png) - -### 5. Create a device group - -1. In Microsoft Endpoint Manager admin center, select **Groups** > **New group**. -1. For **Group type**, select **Security**, and then enter a group name and description. -1. For **Membership type**, select either **Assigned** or **Dynamic Device**. -1. Do one of the following: - - - If you selected **Assigned** for **Membership type** in the previous step, select **Members**, and then add Autopilot devices to the group. Autopilot devices that aren't yet enrolled are listed by using the device serial number as the device name. - - If you selected **Dynamic Devices** for **Membership type** in the previous step, select **Dynamic device members**, and then enter code in **Advanced rule** that resembles the following: - - If you want to create a group that includes all of your Autopilot devices, type: `(device.devicePhysicalIDs -any _ -contains "[ZTDId]")` - - Intune's group tag field maps to the **OrderID** attribute on Azure AD devices. If you want to create a group that includes all of your Autopilot devices that have a specific group tag (the Azure AD device OrderID), you must type: `(device.devicePhysicalIds -any _ -eq "[OrderID]:179887111881")` - - If you want to create a group that includes all your Autopilot devices that have a specific Purchase Order ID, type: `(device.devicePhysicalIds -any _ -eq "[PurchaseOrderId]:76222342342")` - - > [!NOTE] - > These rules target attributes that are unique to Autopilot devices. -1. Select **Save**, and then select **Create**. - -### 6. Create a deployment profile - -1. In Microsoft Endpoint Manager admin center, select **Devices** > **Windows** > **Windows enrollment** > **Windows Autopilot deployment profiles** > **Create profile** > **HoloLens**. -1. Enter a profile name and description, and then select **Next**. - - ![Add a profile name and description](./images/hololens-ap-profile-name.png) -1. On the **Out-of-box experience (OOBE)** page, most of the settings are pre-configured to streamline OOBE for this evaluation. Optionally, you can configure the following settings: - - - **Language (Region)**: Select the language for OOBE. We recommend that you select a language from the list of [supported languages for HoloLens 2](hololens2-language-support.md). - - **Automatically configure keyboard**: To make sure that the keyboard matches the selected language, select **Yes**. - - **Apply device name template**: To automatically set the device name during OOBE, select **Yes** and then enter the template phrase and placeholders in **Enter a name** For example, enter a prefix and `%RAND:4%`—a placeholder for a four-digit random number. - > [!NOTE] - > If you use a device name template, the OOBE process restarts the device one additional time after it applies the device name and before it joins the device to Azure AD. This restart enables the new name to take effect. - - ![Configure OOBE settings](./images/hololens-ap-profile-oobe.png) -1. After you configure the settings, select **Next**. -1. On the **Scope tags** page, optionally add the scope tags that you want to apply to this profile. For more information about scope tags, see [Use role-based access control and scope tags for distributed IT](https://docs.microsoft.com/mem/intune/fundamentals/scope-tags.md). When finished, select **Next**. -1. On the **Assignments** page, select **Selected groups** for **Assign to**. -1. Under **SELECTED GROUPS**, select **+ Select groups to include**. -1. In the **Select groups to include** list, select the device group that you created for the Autopilot HoloLens devices, and then select **Next**. - - If you want to exclude any groups, select **Select groups to exclude**, and select the groups that you want to exclude. - - ![Assigning a device group to the profile.](./images/hololens-ap-profile-assign-devicegroup.png) -1. On the **Review + Create** page, review the settings and then select **Create** to create the profile. - - ![Review + create](./images/hololens-ap-profile-summ.png) - -### 7. Verify the ESP configuration - -The Enrollment Status Page (ESP) displays the status of the complete device configuration process that runs when an MDM managed user signs into a device for the first time. Make sure that your ESP configuration resembles the following, and verify that the assignments are correct. - -![ESP configuration](./images/hololens-ap-profile-settings.png) - -### 8. Configure a custom configuration profile for HoloLens devices (known issue) - -1. In [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com), select **Devices** > **Configuration profiles** > **Create profile**. -1. For **Platform**, specify **Windows 10 and later**, and for **Profile**, select **Custom**. -1. Select **Create**. -1. Enter a name for the profile, and then select **Settings** > **Configure**. - - ![Settings for the custom configuration profile.](./images/hololens-ap-profile-settings-oma.png) -1. Select **Add**, and then specify the following information: - - - **Name**: SidecarPath - - **OMA-URI**: ./images/Device/Vendor/MSFT/EnrollmentStatusTracking/DevicePreparation/PolicyProviders/Sidecar/InstallationState - - **Data type**: Integer - - **Value**: 2 -1. Select **OK** two times, and then select **Create** to create the profile. -1. After Intune creates the configuration profile, assign the configuration profile to the device group for the HoloLens devices. - -### 9. Verify the profile status of the HoloLens devices - -1. In Microsoft Endpoint Manager Admin Center, select **Devices** > **Windows** > **Windows enrollment** > **Devices**. -1. Verify that the HoloLens devices are listed, and that their profile status is **Assigned**. - > [!NOTE] - > It may take a few minutes for the profile to be assigned to the device. - - ![Device and profile assignments.](./images/hololens-ap-devices-assignments.png) - -## Windows Autopilot for HoloLens 2 User Experience - -Your HoloLens users can follow these steps to provision HoloLens devices. - -1. Use the USB-C cable to connect the HoloLens device to a computer that has Advanced Recovery Companion (ARC) installed and has the appropriate Windows update downloaded. -1. Use ARC to flash the appropriate version of Windows on to the device. -1. Connect the device to the network, and then restart the device. - > [!IMPORTANT] - > You must connect the device to the network before the Out-of-the-Box-Experience (OOBE) starts. The device determines whether it is provisioning as an Autopilot device while on the first OOBE screen. If the device cannot connect to the network, or if you choose not to provision the device as an Autopilot device, you cannot change to Autopilot provisioning at a later time. Instead, you would have to start this procedure over in order to provision the device as an Autopilot device. - - The device should automatically start OOBE. Do not interact with OOBE. Instead sit, back and relax! Let HoloLens 2 detect network connectivity and allow it complete OOBE automatically. The device may restart during OOBE. The OOBE screens should resemble the following. - - ![OOBE step 1](./images/hololens-ap-uex-1.png) - ![OOBE step 2](./images/hololens-ap-uex-2.png) - ![OOBE step 3](./images/hololens-ap-uex-3.png) - ![OOBE step 4](./images/hololens-ap-uex-4.png) - -At the end of OOBE, you can sign in to the device by using your user name and password. - - ![OOBE step 5](./images/hololens-ap-uex-5.png) - -## Known Issues - -- The list of supported languages for Autopilot deployment profiles includes languages that HoloLens does not support. Select a language that [HoloLens supports](hololens2-language-support.md). - -## Feedback - -To provide feedback or report issues, use one of the following methods: - -- Use the Feedback Hub app. You can find this app on a HoloLens-connected computer. In Feedback Hub, select the **Enterprise Management** > **Device** category. - - When you provide feedback or report an issue, provide a detailed description. If applicable, include screenshots and logs. -- Send an email message to [hlappreview@microsoft.com](mailto:hlappreview@microsoft.com). For the email subject, enter **\<*Tenant*> Autopilot for HoloLens 2 evaluation feedback** (where \<*Tenant*> is the name of your Intune tenant). - - Provide a detailed description in your message. However, unless Support personnel specifically request it, do not include data such as screenshots or logs. Such data might include private or personally identifiable information (PII). diff --git a/devices/hololens/hololens2-basic-usage.md b/devices/hololens/hololens2-basic-usage.md deleted file mode 100644 index 59426de18e..0000000000 --- a/devices/hololens/hololens2-basic-usage.md +++ /dev/null @@ -1,192 +0,0 @@ ---- -title: Getting around HoloLens 2 -description: A guide to using HoloLens 2 with your hands -ms.assetid: 5f791a5c-bdb2-4c5d-bf46-4a198de68f21 -ms.date: 9/17/2019 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens 2 ---- - -# Getting around HoloLens 2 - -Ready to explore the world of holograms? - -This guide provides an intro to: - -- Interacting with mixed reality -- Using your hands and voice for interacting with holograms on HoloLens 2 -- Navigating Windows 10 on HoloLens (Windows Holographic) - -## Discover mixed reality - -On HoloLens, holograms blend the digital world with your physical environment to look and sound like they're part of your world. Even when holograms are all around you, you can always see your surroundings, move freely, and interact with people and objects. We call this experience "mixed reality". - -The holographic frame positions your holograms where your eyes are most sensitive to detail and the see-through lenses leave your peripheral vision clear. With spatial sound, you can pinpoint a hologram by listening, even if it’s behind you. And, because HoloLens understands your physical environment, you can place holograms on and around real objects such as tables and walls. - -Getting around HoloLens is a lot like using your smart phone. You can use your hands to touch and manipulate holographic windows, menus, and buttons. - -Once you know these basic interactions, getting around on HoloLens will be a snap. - -> [!TIP] -> If you have a HoloLens near you right now, the **Tips** app provides literal hands-on tutorials for hand interactions on HoloLens. -> Use the start gesture to go to **Start** or say "Go to Start" and select **Tips**. - -## The hand-tracking frame - -HoloLens has sensors that can see a few feet to either side of you. When you use your hands, you'll need to keep them inside that frame, or HoloLens won't see them. However, the frame moves with you as you move around. - -![Image that shows the HoloLens hand-tracking frame](./images/hololens-2-gesture-frame.png) - -## Touch holograms near you - -When a hologram is near you, bring your hand close to it and a white ring should appear on the tip of your index finger. This is the **touch cursor** which helps you touch and interact with holograms with precision. To **select** something, simply **tap** it with the touch cursor. **Scroll** content by **swiping** on the surface of the content with your finger, just like you're using a touch screen. - -To **grab** a hologram near you, pinch your **thumb** and **index finger** together on the hologram and hold. To let go, release your fingers. Use this **grab gesture** to move, resize, and rotate 3D objects and app windows in mixed reality home. - -To bring up a **context menu**, like the ones you'll find on an app tile in the Start menu, **tap and hold** like you do on a touch screen. - -## Use hand ray for holograms out of reach - -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3ZOum] - -When there are no holograms near your hands, the **touch cursor** will hide automatically and **hand rays** will appear from the palm of your hands. Hand rays allow you to interact with holograms from a distance. - -> [!TIP] -> If you find hand rays distracting, you can hide them by saying “Hide hand rays”. To make them reappear, say "Show hand rays." - -### Select using air tap - -To select something using **hand ray**, follow these steps: - -1. Use a hand ray from your palm to target the item. You don't need to raise your entire arm, you can keep your elbow low and comfortable. -1. Point your index finger straight up toward the ceiling. -1. To perform the **air tap** gesture, pinch your thumb and index finger together and then quickly release them. - - ![Air-tap gesture animation](./images/hololens-air-tap.gif) - -### Grab using air tap and hold - -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3Wxnh] - -To grab a hologram or scroll app window content using **hand ray**, start with an **air tap**, but keep your fingers together instead of releasing them. - -Use **air tap and hold** to perform the following actions with hand ray: - -- **Scroll**. To scroll app window content, air tap and hold on the content and then move your hand ray up and down or side to side. -- **Grab**. To grab an app window or hologram, target the app title bar or hologram with your hand ray and then air tap and hold. -- **Open context menus**. To open context menus, air tap and hold with your hand ray. - -## Start gesture - -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3Wxng] - -The Start gesture opens the **Start menu**. To perform the Start gesture, hold out your hand with your palm facing you. You’ll see a **Start icon** appear over your inner wrist. Tap this icon using your other hand. The Start menu will open **where you’re looking**. - -> [!TIP] -> -> - You can use the Start gesture as long as your hands are inside the hand-tracking frame. You do not need to be looking down at the Start icon. Keep your elbow low and comfortable, and look in the direction where you want the Start menu to open. -> - If the Start menu didn't open at the position you want, simply move your head around to reposition it. -> - If you have trouble reading the smaller text on the Start menu, step closer to it after it opens. -> - If your hand is slightly off to the side of the frame, you may still be able to view the Start menu by tapping your inner wrist, even if you don't see the icon. - -![Image that shows the Start icon and the Start gesture](./images/hololens-2-start-gesture.png) - -To **close** the Start menu, do the Start gesture when the Start menu is open. You can also look at the Start menu and say "Close". - -### One-handed Start gesture - -> [!IMPORTANT] -> For the one-handed Start gesture to work: -> -> 1. You must update to the November 2019 update (build 18363.1039) or later. -> 1. Your eyes must be calibrated on the device so that eye tracking functions correctly. If you do not see orbiting dots around the Start icon when you look at it, your eyes are not [calibrated](https://docs.microsoft.com/hololens/hololens-calibration#calibrating-your-hololens-2) on the device. - -You can also perform the Start gesture with only one hand. To do this, hold out your hand with your palm facing you and look at the **Start icon** on your inner wrist. **While keeping your eye on the icon**, pinch your thumb and index finger together. - -![Image that shows the Start icon and the one-handed start gesture](./images/hololens-2-start-alternative.png) - -## Start menu, mixed reality home, and apps - -Ready to put all these hand interactions to the test?! - -You'll find your installed apps in the [Start menu](holographic-home.md) and you can find additional apps for HoloLens in the [Microsoft Store](holographic-store-apps.md). - -Just as Windows PC always starts its experience at the desktop, HoloLens always starts in **mixed reality home** when turned on. Using the Start menu, you can open and place app windows, as well as app launchers and 3D content in mixed reality home. Their placements in your physical space will be remembered by HoloLens. - -Open the **Start menu**, then select the **Settings** app tile. An app window will open in front of you. - -Settings is an example of a HoloLens app that uses a 2D **app window**. It's very similar to a Windows application on PC. - -Now you can open the **Start menu** again and select the **Tips** app tile. A 3D **app launcher** for the app will appear in front of you. To open the app, you need to select the **play** button on the launcher. - -Tips is an example of an **immersive app**. An immersive app takes you away from mixed reality home when it runs and becomes the only app you see. To exit, you need to bring up the Start menu and select the **mixed reality home** button at the bottom. - -[Go here to learn more](holographic-home.md) about Start menu and mixed reality home, including info on how to use and manage apps on HoloLens 2. - -## Move, resize, and rotate holograms - -In mixed reality home you can move, resize, and rotate app windows and 3D objects using your hands, hand ray and voice commands. - -### Moving holograms - -Move a hologram or app by following these steps: - -1. Grab the hologram by pinching your index finger and thumb on the hologram or face your hand down and then close your fist over it. Grab a 3D hologram anywhere inside its blue bounding box. For an app window, grab its title bar. -1. Without letting go, move your hand to position the hologram. When moving an app window this way, the app window automatically turns to face you as it moves, making it easier to use at its new position. -1. Release your fingers to place it. - -### Resizing holograms - -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3ZYIb] - -Grab and use the **resize handles** that appear on the corners of 3D holograms and app windows to resize them. - -For an app window, when resized this way the window content correspondingly increases in size and becomes easier to read. - -If you want to resize an app window so that **more content** appears in the window, use the resize handles located on the sides and bottom edges of the app window. - -There are two ways to resize a hologram that's further away from you. You can either grab two corners of the hologram, or use the resize controls. - -### Rotating holograms - -For 3D holograms, grab and use the rotate handles that appear on the vertical edges of the bounding box. - -For app windows, moving an app window will cause it to automatically rotate and face you. - -You can also grab a 3D hologram or app window with **both hands** (or hand ray) at once and then: - -- Move your hands closer together or further apart to resize the hologram. -- Move your hands closer and further away from your body to rotate the hologram. - -### Follow me, stop following - -Holograms and app windows stay where you placed them in the world. That's not always convenient if you need to move around and you want an application to stay visible. To ask an app to start or stop following you, select **Follow me** in the top right corner of the app window (next to the **Close** button). An app window that is following you will also follow you into, an out of, an immersive app. - -## Use HoloLens with your voice - -You can use your voice to do most of the same things you do with hands on HoloLens, like taking a quick photo or opening an app. - -| To do this | Say this | -| - | - | -| Open the Start menu | "Go to Start" | -| Select | Say "select" to bring up the gaze cursor. Then, turn your head to position the cursor on the thing you want to select, and say “select” again. | -| See available speech commands | "What can I say?" | - - [See more voice commands and ways to use speech with HoloLens](hololens-cortana.md) - -## Next steps - -Congratulations! You're ready to use HoloLens 2! - -Now you can configure your HoloLens 2 to meet your specific needs. Other things you may want to try include: - -- [Connecting bluetooth devices like a mouse and keyboard](hololens-connect-devices.md) -- [Installing apps from the store](holographic-store-apps.md) -- [Sharing your HoloLens with other people](hololens-multiple-users.md) diff --git a/devices/hololens/hololens2-fit-comfort-faq.md b/devices/hololens/hololens2-fit-comfort-faq.md deleted file mode 100644 index e97e03f502..0000000000 --- a/devices/hololens/hololens2-fit-comfort-faq.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: HoloLens 2 fit and comfort FAQ -description: Answers to frequently asked questions about how to fit your HoloLens 2. -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -audience: ItPro -ms.localizationpriority: high -ms.date: 11/07/2019 -ms.reviewer: jarrettr -manager: jarrettr -appliesto: -- HoloLens 2 ---- - -# HoloLens 2 fit and comfort frequently asked questions - -Here are some tips on how to stay comfortable and have the best experience using your HoloLens. - -For step-by-step instructions and a video about putting on and adjusting your device, see [Get your HoloLens 2 ready to use](hololens2-setup.md). - -> [!NOTE] -> The fit and comfort tips in this topic are meant only as general guidance—they don't replace any laws or regulations, or your good judgment when using HoloLens. Stay safe, and have fun! - -Here are some tips on how to stay comfortable and have the best experience using your HoloLens. - -## I'm experiencing discomfort when I use my device. What should I do? - -If you experience discomfort, take a break until you feel better. Try sitting in a well-lit room and relaxing for a bit. The next time your use your HoloLens, try using it for a shorter period of time at first. - -For more information, see [Health and safety on HoloLens](https://go.microsoft.com/fwlink/p/?LinkId=746661). - -## I can't see the whole holographic frame, or my holograms are cut off - -To see the top edge of the holographic frame, move the device so it sits higher on your head, or angle the headband up slightly in front. To see the bottom edge, move the device to sit lower on your head, or angle the headband down slightly in front. If the left or right edge of the view frame isn't visible, make sure the HoloLens visor is centered on your forehead. - -## I need to look up or down to see holograms - -Try adjusting the position of your device visor so the holographic frame matches your natural gaze. Here's how: - -- **If you need to look up to see holograms**. First, shift the back of the headband a bit higher on your head. Then use one hand to hold the headband in place and the other to gently rotate the visor so you have a good view of the holographic frame. -- **If you need to look down to see holograms**. First, shift the back of the headband a bit lower on your head. Then place your thumbs under the device arms and your index fingers on top of the headband, and gently squeeze with your thumbs to rotate the visor so you have a good view of the holographic frame. - -## Hologram image color or brightness does not look right - -For HoloLens 2, take the following steps to ensure the highest visual quality of holograms presented in displays: - -- **Increase brightness of the display.** Holograms look best when the display is at its brightest level. -- **Bring visor closer to your eyes.** Swing the visor down to the closest position to your eyes. -- **Shift visor down.** Try moving the brow pad on your forehead down, which will result in the visor moving down closer to your nose. -- **Run eye calibration.** The display uses your IPD and eye gaze to optimize images on the display. If you don't run eye calibration, the image quality may be made worse. - -## The device slides down when I'm using it, or I need to make the headband too tight to keep it secure - -The overhead strap can help keep your HoloLens secure on your head, particularly if you're moving around a lot. The strap may also let you loosen the headband a bit. [Learn how to use it](hololens2-setup.md#adjust-fit). - -You can also experiment with the positioning of the headband—depending on your head size and shape, you may need to slide it up or down to reposition it on your forehead. - -## How can I adjust HoloLens to fit with my glasses? - -To accommodate eyewear, you can tilt the visor. - -## My arm gets tired when I use gestures. What can I do? - -When using gestures, there's no need to extend your arm out far from your body. Keep it closer to your side, where it's more comfortable and will get less tired. You can also use hand rays to interact with holograms without raising your arms [Learn more about gestures and hand rays](hololens2-basic-usage.md#the-hand-tracking-frame). - -And be sure to try out [voice commands](hololens-cortana.md). diff --git a/devices/hololens/hololens2-hardware.md b/devices/hololens/hololens2-hardware.md deleted file mode 100644 index ca62dbf852..0000000000 --- a/devices/hololens/hololens2-hardware.md +++ /dev/null @@ -1,162 +0,0 @@ ---- -title: HoloLens 2 hardware -description: An outline of the components that make up Microsoft HoloLens 2, the latest evolution of Microsoft's fully untethered holographic computer running Windows 10. -ms.assetid: 651d0430-bfbc-4685-a4fd-db7c33ce9325 -ms.date: 9/17/2019 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens 2 ---- - -# HoloLens 2 hardware - -![HoloLens 2 side view](images/hololens2-exploded-medium.png) - -Microsoft HoloLens 2 is an untethered holographic computer. It refines the holographic computing journey started by HoloLens (1st gen) to provide a more comfortable and immersive experience paired with more options for collaborating in mixed reality. - -## HoloLens components - -- **Visor**. Contains the HoloLens sensors and displays. You can rotate the visor up while wearing the HoloLens. -- **Headband**. To put the HoloLens on, use the adjustment wheel to expand the headband. With the HoloLens in place, tighten the adjustment wheel by turning to the right, until the headband is comfortable. -- **Brightness buttons**. When wearing the HoloLens, the brightness buttons are on the left side of the device. -- **Volume buttons**. When wearing the HoloLens, the volume buttons are on the right side of the device. - -## In the box - -- **Brow pad**. You can remove and replace the brow pad, as needed. -- **Overhead strap**. When you're wearing the HoloLens while moving around, use the overhead strap to help keep the device in place. When wearing the HoloLens for extended periods, the overhead strap may make the device more comfortable to wear. -- **USB-C cable**. Use the USB-C cable to connect your HoloLens to the power supply for charging, or to connect your HoloLens to your computer. -- **Power supply**. Plugs into a power outlet. -- **Microfiber cloth**. Use to clean your HoloLens visor. - -### Power Supply details - -The power supply and the USB cable that come with the device are the best supported mechanism for charging. The power supply is an 18W charger. It's supplies 9V at 2A. - -Charging rate and speed may vary depending on the environment in which the device is running. - -In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger. - -## Device specifications - -### Display - -| | | -| - | - | -| Optics | See-through holographic lenses (waveguides) | -| Holographic resolution | 2k 3:2 light engines | -| Holographic density | >2.5k radiants (light points per radian) | -| Eye-based rendering | Display optimization for 3D eye position | - -### Sensors - -| | | -| - | - | -| Head tracking | 4 visible light cameras | -| Eye tracking | 2 Infrared (IR) cameras | -| Depth | 1-MP Time-of-Flight depth sensor | -| Inertial measurement unit (IMU) | Accelerometer, gyroscope, magnetometer | -| Camera | 8-MP stills, 1080p30 video | - -### Audio and speech - -| | | -| - | - | -| Microphone array | 5 channels | -| Speakers | Built-in spatial sound | - -### Compute and connectivity - -| | | -| - | - | -| System on chip | Qualcomm Snapdragon 850 Compute Platform [details](https://www.qualcomm.com/products/snapdragon-850-mobile-compute-platform) | -| Holographic processing unit | Second-generation custom-built holographic processing unit | -| Memory | 4-GB LPDDR4x system DRAM | -| Storage | 64-GB UFS 2.1 | -| WiFi | 802.11ac 2x2 | -| Bluetooth | 5.0 | -| USB | USB Type-C | - -### Power - -| | | -| - | - | -| Battery Life | 2-3 hours of active use. Up to 2 weeks of standby time. | -| Battery technology | [Lithium batteries](https://www.microsoft.com/download/details.aspx?id=43388) | -| Charging behavior | Fully functional when charging | -| Cooling type | Passively cooled (no fans) | -| Power draw | In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger. | - -### Fit - -| | | -| - | - | -| Sizing | Single size with adjustable band. Fits over eyeglasses | -| Weight | 566 grams | - -## Device capabilities - -### Human understanding - -| | | -| - | - | -| Hand tracking | Two-handed fully articulated model, direct manipulation | -| Eye tracking | Real-time tracking | -| Voice | Command and control on-device; Cortana natural language with internet connectivity | - -### Environment understanding - -| | | -| - | - | -| Six Degrees of Freedom (6DoF) tracking | World-scale positional tracking | -| Spatial mapping | Real-time environment mesh | -| Mixed reality capture | Mixed hologram and physical environment photos and videos | - -## Pre-installed software - -- Windows Holographic Operating System -- Microsoft Edge -- Dynamics 365 Remote Assist -- Dynamics 365 Layout -- Dynamics 365 Guides -- 3D Viewer -- OneDrive for Business -- HoloLens Tips -- Cortana - -## Device certifications - -### Safety - -HoloLens 2 has been tested and conforms to the basic impact protection requirements of ANSI Z87.1, CSA Z94.3 and EN 166. - -## Care and cleaning - -Handle your HoloLens carefully. Use the headband to lift and carry the HoloLens 2. - -As you would for eyeglasses or protective eye-wear, try to keep the HoloLens visor free of dust and fingerprints. When possible, avoid touching the visor. Repeated cleaning could damage the visor, so keep your device clean! - -Don't use any cleaners or solvents on your HoloLens, and don't submerge it in water or apply water directly to it. - -To clean the visor, remove any dust by using a camel or goat hair lens brush or a bulb-style lens blower. Lightly moisten the microfiber cloth with a small amount of distilled water, then use it to wipe the visor gently in a circular motion. - -Clean the rest of the device, including the headband and device arms, with a lint-free microfiber cloth moistened with mild soap and water. Let your HoloLens dry completely before reuse. - -![Image that shows how to clean the visor](images/hololens-cleaning-visor.png) - -### Replace the brow pad - -The brow pad is magnetically attached to the device. To detach it, pull gently away. To replace it, snap it back into place. - -![Remove or replace the brow pad](images/hololens2-remove-browpad.png) - -## Next step - -> [!div class="nextstepaction"] -> [Set up and start your HoloLens 2](hololens2-setup.md) diff --git a/devices/hololens/hololens2-language-support.md b/devices/hololens/hololens2-language-support.md deleted file mode 100644 index 955eec82e6..0000000000 --- a/devices/hololens/hololens2-language-support.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Supported languages for HoloLens 2 -description: -ms.prod: hololens -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -ms.localizationpriority: medium -ms.custom: -- CI 115225 -- CSSTroubleshooting -keywords: localize, language support, display language, keyboard language, IME, keyboard layout -ms.date: 03/12/2020 -audience: ITPro -ms.reviewer: jarrettr -manager: jarrettr -appliesto: -- HoloLens 2 ---- - -# Supported languages for HoloLens 2 - -HoloLens 2 is localized into the following languages. The localization features include speech commands and dictation, keyboard layouts, and OCR recognition within apps. - -- Chinese Simplified (China) -- English (Australia) -- English (Canada) -- English (Great Britain) -- English (United States) -- French (Canada) -- French (France) -- German (Germany) -- Italian (Italy) -- Japanese (Japan) -- Spanish (Spain) - -HoloLens 2 also supports the following languages. However, this support does not include speech commands or dictation features. - -- Chinese Traditional (Taiwan and Hong Kong) -- Dutch (Netherlands) -- Korean (Korea) - -Some features of HoloLens 2 use the Windows display language. The Windows display language affects the following settings for Windows and for apps that support localization: - -- The user interface text language. -- The speech language. -- The default layout of the on-screen keyboard. - -## Change the language or keyboard layout - -The setup process configures your HoloLens for a specific region and language. You can change this configuration by using the **Time & language** section of **Settings**. - -> [!NOTE] -> Your speech and dictation language depends on (and is the same as) the Windows display language. - -### To change the Windows display language - -1. Open the **Start** menu, and then select **Settings** > **Time and language** > **Language**. -2. Select **Windows display language**, and then select a language. - -If the supported language that you're looking for is not in the menu, follow these steps: - -1. Under **Preferred languages**, select **Add a language**. -2. Locater and add the language. -3. Select the **Windows display language** menu again, and then select the language that you added in the previous step. - -### To change the keyboard layout - -To add or remove a keyboard layout, open the **Start** menu, and then select **Settings** > **Time & language** > **Keyboard**. - -If your HoloLens has more than one keyboard layout, use the **Layout** key to switch between them. The **Layout** key is in the lower right corner of the on-screen keyboard. - -> [!NOTE] -> The on-screen keyboard can use Input Method Editor (IME) to enter characters in languages such as Chinese. However, HoloLens does not support external Bluetooth keyboards that use IME. -> -> While you use IME together with the on-screen keyboard, you can continue to use a Bluetooth keyboard to type in English. To switch between keyboards, press the tilde character button (**~**). diff --git a/devices/hololens/hololens2-maintenance.md b/devices/hololens/hololens2-maintenance.md deleted file mode 100644 index 845e36cba1..0000000000 --- a/devices/hololens/hololens2-maintenance.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: HoloLens 2 device care and cleaning FAQ -description: -author: Teresa-Motiv -ms.author: v-tea -ms.date: 4/14/2020 -ms.prod: hololens -ms.topic: article -ms.custom: -- CI 115560 -- CSSTroubleshooting -audience: ITPro -ms.localizationpriority: medium -keywords: -manager: jarrettr -appliesto: -- HoloLens 2 ---- - -# Frequently asked questions about cleaning HoloLens 2 devices - -> [!IMPORTANT] -> Microsoft cannot make a determination of the effectiveness of any given disinfectant product in fighting pathogens such as COVID-19. Please refer to your local public health authority's guidance about how to stay safe from potential infection. - -## What are the general cleaning instructions for HoloLens 2 devices? - -**To clean the device** - -1. Remove any dust by using a dry, lint-free microfiber cloth to gently wipe the surface of the device. -1. Lightly moisten the cloth by using medical "70%" isopropyl alcohol, and then use the moistened cloth to gently wipe the surface of the device. - - ![Image that shows how to clean the visor](images/hololens-cleaning-visor.png) - -1. Let the device dry completely. - -**To clean the brow pad** - -1. Use water and a mild, antibiotic soap to moisten a cloth, and then use the moistened cloth to wipe the brow pad. -1. Let the brow pad dry completely. - -## Can I use any lens cleaner for cleaning the HoloLens visor? - -No. Lens cleaners can be abrasive to the coatings on the visor. To clean the visor, follow these steps: - -1. Remove any dust by using a dry lint-free microfiber cloth to gently wipe the visor. -1. Lightly moisten a cloth by using medical "70%" isopropyl alcohol, and then gently wipe the visor. -1. Let the visor dry completely. - -## Can I use disinfecting wipes to clean the device? - -Yes, if the wipes do not contain bleach. You can use non-bleach disinfecting wipes to [gently wipe the HoloLens surfaces](#what-are-the-general-cleaning-instructions-for-hololens-2-devices). - -> [!CAUTION] -> Avoid using disinfecting wipes that contains bleach to clean the HoloLens surfaces. It is acceptable to use bleach wipes in critical situations, when nothing else is available. However, bleach may damage the HoloLens visor or other surfaces. - -## Can I use alcohol to clean the device? - -Yes. You can use a solution of "70%" isopropyl alcohol and water to clean the hard surfaces of the device, including the visor. Lightly moisten the cloth by using a mix of isopropyl alcohol and water, and then gently wipe the surface of the device - -## Is the brow pad replaceable? - -Yes. The brow pad is magnetically attached to the device. To detach it, pull it gently away from the headband. To replace it, snap it back into place. - -![Remove or replace the brow pad](images/hololens2-remove-browpad.png) - -## How can I clean the brow pad? - -To clean the brow pad, wipe it by using a cloth that's moistened by using water and a mild antibiotic soap. Let the brow pad dry completely before you use it again. - -## Can I use ultraviolet (UV) light to sanitize the device? - -UV-C germicidal irradiation has not been tested on HoloLens 2. - -> [!CAUTION] -> High levels of UV-A and UV-B exposure can degrade the display quality of the device and damage the visor coating. Over-exposure to UV-A and UV-B radiation has the following effects, in order of the duration and intensity of exposure: -> -> 1. The brow pad and device closures become discolored. -> 1. Defects appear in the anti-reflective (AR) coating on the visor and on the sensor windows. -> 1. Defects appear in the base materials of the visor and on the sensor windows. -> 1. SRG performance degrades. - -## Is the rear pad replaceable? - -No. diff --git a/devices/hololens/hololens2-setup.md b/devices/hololens/hololens2-setup.md deleted file mode 100644 index 79189a7cf6..0000000000 --- a/devices/hololens/hololens2-setup.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: Prepare a new HoloLens 2 -description: This guide walks through first time set up and hardware guide. -keywords: hololens, lights, fit, comfort, parts -ms.assetid: 02692dcf-aa22-4d1e-bd00-f89f51048e32 -ms.date: 9/17/2019 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens 2 ---- - -# Get your HoloLens 2 ready to use - -The procedures below will help you set up a HoloLens 2 for the first time. - -## Charge your HoloLens - -Connect the power supply to the charging port by using the USB-C cable (included). Plug the power supply into a power outlet. The power supply and USB-C-to-C cable that come with the device are the best way to charge your HoloLens 2. The charger supplies 18W of power (9V at 2A). - -Charging rate and speed may vary depending on the environment in which the device is running. - -- When the device is charging, the battery indicator lights up to indicate the current level of charge. The last light will fade in and out to indicate active charging. -- When your HoloLens is on, the battery indicator displays the battery level in increments. -- When only one of the five lights is on, the battery level is below 20 percent. -- If the battery level is critically low and you try to turn on the device, one light will blink briefly, then go out. - -## Adjust fit - -Place the HoloLens 2 on your head. If you wear eyeglasses, leave them on. The brow pad should sit comfortably on your forehead and the back band should sit in the middle-back of your head. - -If necessary, extend the headband by turning the adjustment wheel, and then loosen the overhead strap. - -![HoloLens 2 fit and adjustments](images/hololens2-fit.png) - -### Attach and detach the overhead strap - -The overhead strap isn't required, but it can make wearing HoloLens 2 more comfortable during long periods of use. - -To detach the front of the overhead strap, unhook the strap and slide it through the retractable loop on the brow pad. To reattach it, pull out the loop and slide the strap back through. - -To detach the back of the overhead strap, press the button below each connection tab and pull gently. To reattach it, push the connection tabs back into the slots until they click. - -![attach or remove the HoloLens 2 head strap](images/hololens2-headstrap.png) - -## Turn on the HoloLens 2 - -To turn on your HoloLens 2, press the Power button. The LED lights below the Power button display the battery level. - -> [!NOTE] -> To power on HoloLens 2 for the very first time, after unboxing, press and hold the power button for at least 4 seconds to turn it on. Next time you power on HoloLens 2, it’ll start after a short power button press. - -### Power button actions for different power transitions - -| To do this | Perform this action | The HoloLens 2 will do this | -| - | - | - | -| To turn on | Single button press. | All five lights turn on, then change to indicate the battery level. After four seconds, a sound plays. | -| To sleep | Single button press. | All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." | -| To wake from sleep | Single button press. | All five lights turn on, then change to indicate the battery level. A sound immediately plays. | -| To turn off | Press and hold for 5s. | All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." | -| To force the Hololens to restart if it is unresponsive | Press and hold for 10s. | All five lights turn on, then fade off one at a time. After the lights turn off. | - -## HoloLens behavior reference - -Not sure what the indicator lights on your HoloLens mean? Want to know how HoloLens should behave while charging? Here's some help! - -### Charging behavior - -| State of the Device | Action | HoloLens 2 will do this | -| - | - | - | -| OFF | Plug in USB Cable | Device transitions to ON with indicator lights showing battery level and device starts charging. -| ON | Remove USB Cable | Device stops charging -| ON | Plug in USB Cable | Device starts charging -| SLEEP | Plug in USB Cable | Device starts charging -| SLEEP | Remove USB Cable | Device stops charging -| ON with USB cable plugged in | Turn off Device | Device transitions to ON with indicator lights showing battery level and device will start charging | - -### Lights that indicate the battery level - -| Number of lights | Battery level | -| - | - | -| Four solid lights, one light fading in and out | Between 100% and 81% (fully charged) | -| Three solid lights, one light fading in and out | Between 80% and 61% | -| Two solid lights, one light fading in and out | Between 60% and 41% | -| One solid light, one light fading in and out | Between 40% and 21% | -| One light fading in and out | Between 20% and 5% or lower (critical battery) | - -### Sleep Behavior - -| State of the Device | Action | HoloLens 2 will do this | -| - | - | - | -| ON | Single Power button press | Device transitions to SLEEP and turns off all indicator lights | -| ON | No movement for 3 minutes | Device transition to SLEEP and turns off all indicator lights | -| SLEEP | Single Power button Press | Device transitions to ON and turns on indicator lights | - -### Lights to indicate problems - -| When you do this | The lights do this | It means this | -| - | - | - | -| You press the Power button. | One light flashes five times, then turns off. | The HoloLens battery is critically low. Charge your HoloLens. | -| You press the Power button. | All five lights flash five times, then turn off. | HoloLens cannot start correctly and is in an error state. [Reinstall the operating system](hololens-recovery.md) to recover your device. | -| You press the Power button. | The 1st, 3rd, and 5th lights flash together continually. | HoloLens may have a hardware failure. To be sure, [reinstall the OS](hololens-recovery.md#hololens-2), and try again. After reinstalling the OS, if the light-flash pattern persists, contact [support](https://support.microsoft.com/en-us/supportforbusiness/productselection?sapid=3ec35c62-022f-466b-3a1e-dbbb7b9a55fb). | - -## Safety and comfort - -### Use HoloLens in safe surroundings - -Use your HoloLens in a safe space, free of obstructions and tripping hazards. Don’t use it when you need a clear field of view or can't commit your full attention, such as while you’re operating a vehicle or doing other potentially hazardous activities. - -### Stay comfortable - -Keep your first few sessions with HoloLens brief and be sure to take breaks. If you experience discomfort, stop and rest until you feel better. This might include temporary feelings of nausea, motion sickness, dizziness, disorientation, headache, fatigue, eye strain, or dry eyes. - -> [!div class="nextstepaction"] -> [Start and configure your HoloLens 2](hololens2-start.md) diff --git a/devices/hololens/hololens2-start.md b/devices/hololens/hololens2-start.md deleted file mode 100644 index 78d3697f03..0000000000 --- a/devices/hololens/hololens2-start.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Set up your HoloLens 2 -description: This guide walks through first time set up. You'll need a Wi-Fi network and either a Microsoft (MSA) or Azure Active Directory (AAD) account. -ms.assetid: 507305f4-e85a-47c5-a055-a3400ae8a10e -ms.date: 9/17/2019 -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: high -appliesto: -- HoloLens 2 ---- - -# Set up your HoloLens 2 - -The first time you turn on your HoloLens, you'll be guided through setting up your device, signing in with a user account, and calibrating the HoloLens to your eyes. This section walks through the HoloLens 2 initial setup experience. - -In the next section, you'll learn how to work with HoloLens and interact with holograms. To skip ahead to that article, see [Get started with HoloLens 2](hololens2-basic-usage.md). - -## Before you start - -Before you get started, make sure you have the following available: - -**A network connection**. You'll need to connect your HoloLens to a network to set it up. With HoloLens 2, you can connect with Wi-Fi or by using ethernet (you'll need a USB-C-to-Ethernet adapter). The first time you connect, you'll need an open or password-protected network that doesn't require navigating to a website or using certificates to connect. [Learn more about the websites that HoloLens uses](hololens-offline.md). - -**A Microsoft account**. You'll also need to sign in to HoloLens with a Microsoft account (or with your work account, if your organization owns the device). If you don't have a Microsoft account, go to [account.microsoft.com](https://account.microsoft.com) and set one up for free. - -**A safe, well-lit space with no tripping hazards**. [Health and safety info](https://go.microsoft.com/fwlink/p/?LinkId=746661). - -**The optional comfort accessories** that came with your HoloLens, to help you get the most comfortable fit. [More on fit and comfort](hololens2-setup.md#adjust-fit). - -## Set up Windows - -The first time you start your HoloLens 2, your first task is to set up Windows Holographic. When you start your HoloLens, you will hear music and see a Windows logo. - -![First screen during first boot](images/01-magic-moment.png) - -HoloLens 2 will walk you through the following steps: - -1. Select your language. - ![Select language](images/04-language.png) - -1. Select your region. - ![Select region](images/05-region.png) - -1. Calibrate HoloLens to your eyes. If you choose to skip calibration, you'll be prompted the next time you log in. - - To calibrate, you'll look at a set of targets (referred to as gems). It's fine if you blink or close your eyes during calibration, but try not to stare at other objects in the room or physical space. HoloLens uses this process to learn about your eye position so that it can better render your holographic world. After calibration, holograms will appear correctly even as the visor shifts on your head. - - Calibration information is stored locally on the device and is not associated with any account information. For more information, see [Calibration data and security](hololens-calibration.md#calibration-data-and-security). - - ![Calibration selection screen](images/06-et-corners.png) - -1. Connect to the internet (select Wi-Fi or your ethernet connection). - HoloLens sets your time zone automatically based on information obtained from the Wi-Fi network. After setup finishes, you can change the time zone by using the Settings app. - - ![Connect to Wi-Fi](images/11-network.png) -> [!NOTE] -> If you progress past the Wi-Fi step and later need to switch to a different network while still in setup, you can press the **Volume Down** and **Power** buttons simultaneously to return to this step if you are running an OS version from October 2019 or later. For earlier versions, you may need to [reset the device](hololens-recovery.md) or restart it in a location where the Wi-Fi network is not available to prevent it from automatically connecting. -> -> Also note that during HoloLens Setup, there is a credential timeout of two minutes. The username/password needs to be entered within two minutes otherwise the username field will be automatically cleared. - -1. Sign in to your user account. You'll choose between **My work or school owns it** and **I own it**. - - When you choose **My work or school owns it**, you sign in with an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens automatically enrolls in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available. In that case, you need to [manually enroll HoloLens in device management](hololens-enroll-mdm.md#enroll-through-settings-app). - 1. Enter your organizational account information. - 1. Accept the privacy statement and the end user license agreement. - 1. Sign in by using your Azure AD credentials. This may redirect to your organization's sign-in page. - 1. Continue setting up the device. - - When you choose **I own it**, you sign in with a Microsoft account. After setup is complete, you can [manually enroll HoloLens in device management](hololens-enroll-mdm.md#enroll-through-settings-app). - 1. Enter your Microsoft account information. - 2. Enter your password. If your Microsoft account requires [two-step verification (2FA)](https://blogs.technet.microsoft.com/microsoft_blog/2013/04/17/microsoft-account-gets-more-secure/), complete the verification process. - - ![Set user](images/13-device-owner.png) - -1. Select whether to enable speech on HoloLens 2, and whether to send diagnostic telemetry. - ![Enable Cortana](images/22-do-more-with-voice.png) - -1. Select your telemetry level. If you can, please enable Full telemetry. This information really helps the HoloLens engineering team. - ![Telemetry level](images/24-telemetry.png) - -1. Learn how to use the start gesture on HoloLens 2. - ![Learn how to use the start gesture, image 1](images/26-01-startmenu-learning.png) - ![Learn how to use the start gesture, image 2](images/26-02-startmenu-learning.png) - -Congratulations! Setup is complete and you're ready to use HoloLens! - -## Next steps - -> [!div class="nextstepaction"] -> [Get started with HoloLens 2](hololens2-basic-usage.md) diff --git a/devices/hololens/images/01-magic-moment.png b/devices/hololens/images/01-magic-moment.png deleted file mode 100644 index 0d55443b55..0000000000 Binary files a/devices/hololens/images/01-magic-moment.png and /dev/null differ diff --git a/devices/hololens/images/02-00-magic-moment.png b/devices/hololens/images/02-00-magic-moment.png deleted file mode 100644 index ae76fb70ea..0000000000 Binary files a/devices/hololens/images/02-00-magic-moment.png and /dev/null differ diff --git a/devices/hololens/images/02-01-magic-moment-bird-intro.png b/devices/hololens/images/02-01-magic-moment-bird-intro.png deleted file mode 100644 index ae76fb70ea..0000000000 Binary files a/devices/hololens/images/02-01-magic-moment-bird-intro.png and /dev/null differ diff --git a/devices/hololens/images/02-02-bird-palm.png b/devices/hololens/images/02-02-bird-palm.png deleted file mode 100644 index fda1f3dcdd..0000000000 Binary files a/devices/hololens/images/02-02-bird-palm.png and /dev/null differ diff --git a/devices/hololens/images/02-03-bird-button.png b/devices/hololens/images/02-03-bird-button.png deleted file mode 100644 index 749a1ab6fc..0000000000 Binary files a/devices/hololens/images/02-03-bird-button.png and /dev/null differ diff --git a/devices/hololens/images/04-language.png b/devices/hololens/images/04-language.png deleted file mode 100644 index 1106322c29..0000000000 Binary files a/devices/hololens/images/04-language.png and /dev/null differ diff --git a/devices/hololens/images/05-region.png b/devices/hololens/images/05-region.png deleted file mode 100644 index f350298813..0000000000 Binary files a/devices/hololens/images/05-region.png and /dev/null differ diff --git a/devices/hololens/images/06-et-corners.png b/devices/hololens/images/06-et-corners.png deleted file mode 100644 index af48472f60..0000000000 Binary files a/devices/hololens/images/06-et-corners.png and /dev/null differ diff --git a/devices/hololens/images/07-et-adjust-for-your-eyes.png b/devices/hololens/images/07-et-adjust-for-your-eyes.png deleted file mode 100644 index e127ba9a9d..0000000000 Binary files a/devices/hololens/images/07-et-adjust-for-your-eyes.png and /dev/null differ diff --git a/devices/hololens/images/07-et-hold-head-still.png b/devices/hololens/images/07-et-hold-head-still.png deleted file mode 100644 index a4952767bf..0000000000 Binary files a/devices/hololens/images/07-et-hold-head-still.png and /dev/null differ diff --git a/devices/hololens/images/08-et-gems.png b/devices/hololens/images/08-et-gems.png deleted file mode 100644 index 8eaba193f0..0000000000 Binary files a/devices/hololens/images/08-et-gems.png and /dev/null differ diff --git a/devices/hololens/images/09-et-adjusting.png b/devices/hololens/images/09-et-adjusting.png deleted file mode 100644 index 038dcab588..0000000000 Binary files a/devices/hololens/images/09-et-adjusting.png and /dev/null differ diff --git a/devices/hololens/images/10-et-failure1.png b/devices/hololens/images/10-et-failure1.png deleted file mode 100644 index 249abff7f6..0000000000 Binary files a/devices/hololens/images/10-et-failure1.png and /dev/null differ diff --git a/devices/hololens/images/10-et-failure2.png b/devices/hololens/images/10-et-failure2.png deleted file mode 100644 index f4b2f34334..0000000000 Binary files a/devices/hololens/images/10-et-failure2.png and /dev/null differ diff --git a/devices/hololens/images/10-et-success.png b/devices/hololens/images/10-et-success.png deleted file mode 100644 index c74c89056e..0000000000 Binary files a/devices/hololens/images/10-et-success.png and /dev/null differ diff --git a/devices/hololens/images/11-network.png b/devices/hololens/images/11-network.png deleted file mode 100644 index 1fc3884721..0000000000 Binary files a/devices/hololens/images/11-network.png and /dev/null differ diff --git a/devices/hololens/images/12-agreement.png b/devices/hololens/images/12-agreement.png deleted file mode 100644 index 96695c1888..0000000000 Binary files a/devices/hololens/images/12-agreement.png and /dev/null differ diff --git a/devices/hololens/images/13-device-owner.png b/devices/hololens/images/13-device-owner.png deleted file mode 100644 index fe66cd5386..0000000000 Binary files a/devices/hololens/images/13-device-owner.png and /dev/null differ diff --git a/devices/hololens/images/14-sign-in-msa.png b/devices/hololens/images/14-sign-in-msa.png deleted file mode 100644 index c0e3aa4d9e..0000000000 Binary files a/devices/hololens/images/14-sign-in-msa.png and /dev/null differ diff --git a/devices/hololens/images/15-iris-enrollment.png b/devices/hololens/images/15-iris-enrollment.png deleted file mode 100644 index 6bda392726..0000000000 Binary files a/devices/hololens/images/15-iris-enrollment.png and /dev/null differ diff --git a/devices/hololens/images/16-iris-hold-head-still.png b/devices/hololens/images/16-iris-hold-head-still.png deleted file mode 100644 index 09205015c0..0000000000 Binary files a/devices/hololens/images/16-iris-hold-head-still.png and /dev/null differ diff --git a/devices/hololens/images/17-iris-dots.png b/devices/hololens/images/17-iris-dots.png deleted file mode 100644 index 2ac6119b89..0000000000 Binary files a/devices/hololens/images/17-iris-dots.png and /dev/null differ diff --git a/devices/hololens/images/18-iris-enrollment-done.png b/devices/hololens/images/18-iris-enrollment-done.png deleted file mode 100644 index 6405ab8581..0000000000 Binary files a/devices/hololens/images/18-iris-enrollment-done.png and /dev/null differ diff --git a/devices/hololens/images/19-pin-create.png b/devices/hololens/images/19-pin-create.png deleted file mode 100644 index fd0c1ee5e8..0000000000 Binary files a/devices/hololens/images/19-pin-create.png and /dev/null differ diff --git a/devices/hololens/images/20-pin-setup.png b/devices/hololens/images/20-pin-setup.png deleted file mode 100644 index 752fc54e5c..0000000000 Binary files a/devices/hololens/images/20-pin-setup.png and /dev/null differ diff --git a/devices/hololens/images/201608-enterprisemanagement-400px.png b/devices/hololens/images/201608-enterprisemanagement-400px.png deleted file mode 100644 index 11c204f0f6..0000000000 Binary files a/devices/hololens/images/201608-enterprisemanagement-400px.png and /dev/null differ diff --git a/devices/hololens/images/201608-kioskmode-400px.png b/devices/hololens/images/201608-kioskmode-400px.png deleted file mode 100644 index 8d21453b8f..0000000000 Binary files a/devices/hololens/images/201608-kioskmode-400px.png and /dev/null differ diff --git a/devices/hololens/images/20190322-DevicePortal.png b/devices/hololens/images/20190322-DevicePortal.png deleted file mode 100644 index 7fdd2e34b3..0000000000 Binary files a/devices/hololens/images/20190322-DevicePortal.png and /dev/null differ diff --git a/devices/hololens/images/22-do-more-with-voice.png b/devices/hololens/images/22-do-more-with-voice.png deleted file mode 100644 index 2bf874c80d..0000000000 Binary files a/devices/hololens/images/22-do-more-with-voice.png and /dev/null differ diff --git a/devices/hololens/images/23-do-more-with-voice-learn.png b/devices/hololens/images/23-do-more-with-voice-learn.png deleted file mode 100644 index b805befc49..0000000000 Binary files a/devices/hololens/images/23-do-more-with-voice-learn.png and /dev/null differ diff --git a/devices/hololens/images/24-telemetry.png b/devices/hololens/images/24-telemetry.png deleted file mode 100644 index 004d1d5dff..0000000000 Binary files a/devices/hololens/images/24-telemetry.png and /dev/null differ diff --git a/devices/hololens/images/25-telemetry-info.png b/devices/hololens/images/25-telemetry-info.png deleted file mode 100644 index 4c4075a68f..0000000000 Binary files a/devices/hololens/images/25-telemetry-info.png and /dev/null differ diff --git a/devices/hololens/images/26-01-startmenu-learning.png b/devices/hololens/images/26-01-startmenu-learning.png deleted file mode 100644 index e24da1b854..0000000000 Binary files a/devices/hololens/images/26-01-startmenu-learning.png and /dev/null differ diff --git a/devices/hololens/images/26-02-startmenu-learning.png b/devices/hololens/images/26-02-startmenu-learning.png deleted file mode 100644 index 1a81a79178..0000000000 Binary files a/devices/hololens/images/26-02-startmenu-learning.png and /dev/null differ diff --git a/devices/hololens/images/26-03-startmenu-learning.png b/devices/hololens/images/26-03-startmenu-learning.png deleted file mode 100644 index 55d59d18f5..0000000000 Binary files a/devices/hololens/images/26-03-startmenu-learning.png and /dev/null differ diff --git a/devices/hololens/images/26-04-startmenu-learning.png b/devices/hololens/images/26-04-startmenu-learning.png deleted file mode 100644 index b7d62f5650..0000000000 Binary files a/devices/hololens/images/26-04-startmenu-learning.png and /dev/null differ diff --git a/devices/hololens/images/B-Calibration-4-Gem.png b/devices/hololens/images/B-Calibration-4-Gem.png deleted file mode 100644 index fbfd95cb32..0000000000 Binary files a/devices/hololens/images/B-Calibration-4-Gem.png and /dev/null differ diff --git a/devices/hololens/images/C-Settings.Calibration.png b/devices/hololens/images/C-Settings.Calibration.png deleted file mode 100644 index d27f3d754c..0000000000 Binary files a/devices/hololens/images/C-Settings.Calibration.png and /dev/null differ diff --git a/devices/hololens/images/D-CheckThisOut-Prompt.png b/devices/hololens/images/D-CheckThisOut-Prompt.png deleted file mode 100644 index a81a75a153..0000000000 Binary files a/devices/hololens/images/D-CheckThisOut-Prompt.png and /dev/null differ diff --git a/devices/hololens/images/FitGuideSetep5.png b/devices/hololens/images/FitGuideSetep5.png deleted file mode 100644 index 9529fe69b0..0000000000 Binary files a/devices/hololens/images/FitGuideSetep5.png and /dev/null differ diff --git a/devices/hololens/images/FitGuideStep1.png b/devices/hololens/images/FitGuideStep1.png deleted file mode 100644 index 846ef9fc0b..0000000000 Binary files a/devices/hololens/images/FitGuideStep1.png and /dev/null differ diff --git a/devices/hololens/images/FitGuideStep2.png b/devices/hololens/images/FitGuideStep2.png deleted file mode 100644 index 6ac59ff43b..0000000000 Binary files a/devices/hololens/images/FitGuideStep2.png and /dev/null differ diff --git a/devices/hololens/images/FitGuideStep3.png b/devices/hololens/images/FitGuideStep3.png deleted file mode 100644 index e255da8f15..0000000000 Binary files a/devices/hololens/images/FitGuideStep3.png and /dev/null differ diff --git a/devices/hololens/images/FitGuideStep4.png b/devices/hololens/images/FitGuideStep4.png deleted file mode 100644 index 77e99f3d55..0000000000 Binary files a/devices/hololens/images/FitGuideStep4.png and /dev/null differ diff --git a/devices/hololens/images/HoloLens2_AppBarFollowing.gif b/devices/hololens/images/HoloLens2_AppBarFollowing.gif deleted file mode 100644 index 84d7f2589e..0000000000 Binary files a/devices/hololens/images/HoloLens2_AppBarFollowing.gif and /dev/null differ diff --git a/devices/hololens/images/HoloLens2_BoundingBox.gif b/devices/hololens/images/HoloLens2_BoundingBox.gif deleted file mode 100644 index 451bcae997..0000000000 Binary files a/devices/hololens/images/HoloLens2_BoundingBox.gif and /dev/null differ diff --git a/devices/hololens/images/HoloLens2_BoundingBox_Rotate.gif b/devices/hololens/images/HoloLens2_BoundingBox_Rotate.gif deleted file mode 100644 index 43a764a954..0000000000 Binary files a/devices/hololens/images/HoloLens2_BoundingBox_Rotate.gif and /dev/null differ diff --git a/devices/hololens/images/HoloLens2_Loader.gif b/devices/hololens/images/HoloLens2_Loader.gif deleted file mode 100644 index 81d8232494..0000000000 Binary files a/devices/hololens/images/HoloLens2_Loader.gif and /dev/null differ diff --git a/devices/hololens/images/HoloLens2_Proximity.gif b/devices/hololens/images/HoloLens2_Proximity.gif deleted file mode 100644 index f39f326ea7..0000000000 Binary files a/devices/hololens/images/HoloLens2_Proximity.gif and /dev/null differ diff --git a/devices/hololens/images/aad-kioskmode.PNG b/devices/hololens/images/aad-kioskmode.PNG deleted file mode 100644 index c058f25241..0000000000 Binary files a/devices/hololens/images/aad-kioskmode.PNG and /dev/null differ diff --git a/devices/hololens/images/about-encryption.png b/devices/hololens/images/about-encryption.png deleted file mode 100644 index 348e493503..0000000000 Binary files a/devices/hololens/images/about-encryption.png and /dev/null differ diff --git a/devices/hololens/images/account-management-details.png b/devices/hololens/images/account-management-details.png deleted file mode 100644 index 20816830a4..0000000000 Binary files a/devices/hololens/images/account-management-details.png and /dev/null differ diff --git a/devices/hololens/images/account-management.PNG b/devices/hololens/images/account-management.PNG deleted file mode 100644 index da53cb74b8..0000000000 Binary files a/devices/hololens/images/account-management.PNG and /dev/null differ diff --git a/devices/hololens/images/add-certificates-details.PNG b/devices/hololens/images/add-certificates-details.PNG deleted file mode 100644 index 966a826a46..0000000000 Binary files a/devices/hololens/images/add-certificates-details.PNG and /dev/null differ diff --git a/devices/hololens/images/add-certificates.PNG b/devices/hololens/images/add-certificates.PNG deleted file mode 100644 index 7a16dffd26..0000000000 Binary files a/devices/hololens/images/add-certificates.PNG and /dev/null differ diff --git a/devices/hololens/images/addnewfeedback-500px.jpg b/devices/hololens/images/addnewfeedback-500px.jpg deleted file mode 100644 index 8948dd2dae..0000000000 Binary files a/devices/hololens/images/addnewfeedback-500px.jpg and /dev/null differ diff --git a/devices/hololens/images/adk-install.png b/devices/hololens/images/adk-install.png deleted file mode 100644 index c087d3bae5..0000000000 Binary files a/devices/hololens/images/adk-install.png and /dev/null differ diff --git a/devices/hololens/images/apps.png b/devices/hololens/images/apps.png deleted file mode 100644 index 4e00aa96fc..0000000000 Binary files a/devices/hololens/images/apps.png and /dev/null differ diff --git a/devices/hololens/images/azure-ad-image.PNG b/devices/hololens/images/azure-ad-image.PNG deleted file mode 100644 index e0215265f6..0000000000 Binary files a/devices/hololens/images/azure-ad-image.PNG and /dev/null differ diff --git a/devices/hololens/images/backicon.png b/devices/hololens/images/backicon.png deleted file mode 100644 index 3007e448b1..0000000000 Binary files a/devices/hololens/images/backicon.png and /dev/null differ diff --git a/devices/hololens/images/calibration-livecube-200px.png b/devices/hololens/images/calibration-livecube-200px.png deleted file mode 100644 index 44b0142e40..0000000000 Binary files a/devices/hololens/images/calibration-livecube-200px.png and /dev/null differ diff --git a/devices/hololens/images/calibration-settings-500px.jpg b/devices/hololens/images/calibration-settings-500px.jpg deleted file mode 100644 index 0419f0307f..0000000000 Binary files a/devices/hololens/images/calibration-settings-500px.jpg and /dev/null differ diff --git a/devices/hololens/images/calibration-shell.png b/devices/hololens/images/calibration-shell.png deleted file mode 100644 index f833452cc5..0000000000 Binary files a/devices/hololens/images/calibration-shell.png and /dev/null differ diff --git a/devices/hololens/images/check_blu.png b/devices/hololens/images/check_blu.png deleted file mode 100644 index d5c703760f..0000000000 Binary files a/devices/hololens/images/check_blu.png and /dev/null differ diff --git a/devices/hololens/images/check_grn.png b/devices/hololens/images/check_grn.png deleted file mode 100644 index f9f04cd6bd..0000000000 Binary files a/devices/hololens/images/check_grn.png and /dev/null differ diff --git a/devices/hololens/images/checklistbox.gif b/devices/hololens/images/checklistbox.gif deleted file mode 100644 index cbcf4a4f11..0000000000 Binary files a/devices/hololens/images/checklistbox.gif and /dev/null differ diff --git a/devices/hololens/images/checklistdone.png b/devices/hololens/images/checklistdone.png deleted file mode 100644 index 7e53f74d0e..0000000000 Binary files a/devices/hololens/images/checklistdone.png and /dev/null differ diff --git a/devices/hololens/images/checkmark.png b/devices/hololens/images/checkmark.png deleted file mode 100644 index f9f04cd6bd..0000000000 Binary files a/devices/hololens/images/checkmark.png and /dev/null differ diff --git a/devices/hololens/images/cortana-on-hololens.png b/devices/hololens/images/cortana-on-hololens.png deleted file mode 100644 index 6205d3d2fd..0000000000 Binary files a/devices/hololens/images/cortana-on-hololens.png and /dev/null differ diff --git a/devices/hololens/images/crossmark.png b/devices/hololens/images/crossmark.png deleted file mode 100644 index 69432ff71c..0000000000 Binary files a/devices/hololens/images/crossmark.png and /dev/null differ diff --git a/devices/hololens/images/developer-setup-details.png b/devices/hololens/images/developer-setup-details.png deleted file mode 100644 index d445bf5759..0000000000 Binary files a/devices/hololens/images/developer-setup-details.png and /dev/null differ diff --git a/devices/hololens/images/developer-setup.png b/devices/hololens/images/developer-setup.png deleted file mode 100644 index a7e49873b0..0000000000 Binary files a/devices/hololens/images/developer-setup.png and /dev/null differ diff --git a/devices/hololens/images/device-encryption.PNG b/devices/hololens/images/device-encryption.PNG deleted file mode 100644 index 651429dfe0..0000000000 Binary files a/devices/hololens/images/device-encryption.PNG and /dev/null differ diff --git a/devices/hololens/images/deviceportal-appmanager.jpg b/devices/hololens/images/deviceportal-appmanager.jpg deleted file mode 100644 index 68576fcfc7..0000000000 Binary files a/devices/hololens/images/deviceportal-appmanager.jpg and /dev/null differ diff --git a/devices/hololens/images/displays-400px.jpg b/devices/hololens/images/displays-400px.jpg deleted file mode 100644 index 0ed5558bdc..0000000000 Binary files a/devices/hololens/images/displays-400px.jpg and /dev/null differ diff --git a/devices/hololens/images/doneicon.png b/devices/hololens/images/doneicon.png deleted file mode 100644 index d80389f35b..0000000000 Binary files a/devices/hololens/images/doneicon.png and /dev/null differ diff --git a/devices/hololens/images/encrypt-assign.png b/devices/hololens/images/encrypt-assign.png deleted file mode 100644 index f5b0c85a3c..0000000000 Binary files a/devices/hololens/images/encrypt-assign.png and /dev/null differ diff --git a/devices/hololens/images/encrypt-create-profile.png b/devices/hololens/images/encrypt-create-profile.png deleted file mode 100644 index b0f06ef40f..0000000000 Binary files a/devices/hololens/images/encrypt-create-profile.png and /dev/null differ diff --git a/devices/hololens/images/encrypt-custom.png b/devices/hololens/images/encrypt-custom.png deleted file mode 100644 index b3635e9ee4..0000000000 Binary files a/devices/hololens/images/encrypt-custom.png and /dev/null differ diff --git a/devices/hololens/images/encrypt-oma-uri.png b/devices/hololens/images/encrypt-oma-uri.png deleted file mode 100644 index e2754b7db4..0000000000 Binary files a/devices/hololens/images/encrypt-oma-uri.png and /dev/null differ diff --git a/devices/hololens/images/feedback1-600px.png b/devices/hololens/images/feedback1-600px.png deleted file mode 100644 index ba7cec37da..0000000000 Binary files a/devices/hololens/images/feedback1-600px.png and /dev/null differ diff --git a/devices/hololens/images/feedback2-600px.png b/devices/hololens/images/feedback2-600px.png deleted file mode 100644 index 89d44622a6..0000000000 Binary files a/devices/hololens/images/feedback2-600px.png and /dev/null differ diff --git a/devices/hololens/images/feedback3-600px.png b/devices/hololens/images/feedback3-600px.png deleted file mode 100644 index 0431687b55..0000000000 Binary files a/devices/hololens/images/feedback3-600px.png and /dev/null differ diff --git a/devices/hololens/images/feedback4-600px.png b/devices/hololens/images/feedback4-600px.png deleted file mode 100644 index 35594f2ca8..0000000000 Binary files a/devices/hololens/images/feedback4-600px.png and /dev/null differ diff --git a/devices/hololens/images/feedback5-600px.png b/devices/hololens/images/feedback5-600px.png deleted file mode 100644 index 967987d6ae..0000000000 Binary files a/devices/hololens/images/feedback5-600px.png and /dev/null differ diff --git a/devices/hololens/images/feedback6-600px.png b/devices/hololens/images/feedback6-600px.png deleted file mode 100644 index 431a4da9da..0000000000 Binary files a/devices/hololens/images/feedback6-600px.png and /dev/null differ diff --git a/devices/hololens/images/finish-details.png b/devices/hololens/images/finish-details.png deleted file mode 100644 index ff3f53e5c8..0000000000 Binary files a/devices/hololens/images/finish-details.png and /dev/null differ diff --git a/devices/hololens/images/finish.PNG b/devices/hololens/images/finish.PNG deleted file mode 100644 index 975caba764..0000000000 Binary files a/devices/hololens/images/finish.PNG and /dev/null differ diff --git a/devices/hololens/images/five.png b/devices/hololens/images/five.png deleted file mode 100644 index 961f0e15b7..0000000000 Binary files a/devices/hololens/images/five.png and /dev/null differ diff --git a/devices/hololens/images/four.png b/devices/hololens/images/four.png deleted file mode 100644 index 0fef213b37..0000000000 Binary files a/devices/hololens/images/four.png and /dev/null differ diff --git a/devices/hololens/images/hololens-2-air-tap.gif b/devices/hololens/images/hololens-2-air-tap.gif deleted file mode 100644 index 9139718cdb..0000000000 Binary files a/devices/hololens/images/hololens-2-air-tap.gif and /dev/null differ diff --git a/devices/hololens/images/hololens-2-button-sleep.png b/devices/hololens/images/hololens-2-button-sleep.png deleted file mode 100644 index 29f75da34f..0000000000 Binary files a/devices/hololens/images/hololens-2-button-sleep.png and /dev/null differ diff --git a/devices/hololens/images/hololens-2-button-turn-off.png b/devices/hololens/images/hololens-2-button-turn-off.png deleted file mode 100644 index 8e3f4a2c72..0000000000 Binary files a/devices/hololens/images/hololens-2-button-turn-off.png and /dev/null differ diff --git a/devices/hololens/images/hololens-2-button-turn-on.png b/devices/hololens/images/hololens-2-button-turn-on.png deleted file mode 100644 index 25ce3fcc58..0000000000 Binary files a/devices/hololens/images/hololens-2-button-turn-on.png and /dev/null differ diff --git a/devices/hololens/images/hololens-2-button-wake.png b/devices/hololens/images/hololens-2-button-wake.png deleted file mode 100644 index 135b1e3a04..0000000000 Binary files a/devices/hololens/images/hololens-2-button-wake.png and /dev/null differ diff --git a/devices/hololens/images/hololens-2-gesture-frame.png b/devices/hololens/images/hololens-2-gesture-frame.png deleted file mode 100644 index cc1a9f667d..0000000000 Binary files a/devices/hololens/images/hololens-2-gesture-frame.png and /dev/null differ diff --git a/devices/hololens/images/hololens-2-screenshot-with-callouts.png b/devices/hololens/images/hololens-2-screenshot-with-callouts.png deleted file mode 100644 index 769310e749..0000000000 Binary files a/devices/hololens/images/hololens-2-screenshot-with-callouts.png and /dev/null differ diff --git a/devices/hololens/images/hololens-2-start-alternative.png b/devices/hololens/images/hololens-2-start-alternative.png deleted file mode 100644 index 763cd8600e..0000000000 Binary files a/devices/hololens/images/hololens-2-start-alternative.png and /dev/null differ diff --git a/devices/hololens/images/hololens-2-start-gesture.png b/devices/hololens/images/hololens-2-start-gesture.png deleted file mode 100644 index 109c6235bb..0000000000 Binary files a/devices/hololens/images/hololens-2-start-gesture.png and /dev/null differ diff --git a/devices/hololens/images/hololens-air-tap.gif b/devices/hololens/images/hololens-air-tap.gif deleted file mode 100644 index 9139718cdb..0000000000 Binary files a/devices/hololens/images/hololens-air-tap.gif and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-devices-assignments.png b/devices/hololens/images/hololens-ap-devices-assignments.png deleted file mode 100644 index f99eaa367d..0000000000 Binary files a/devices/hololens/images/hololens-ap-devices-assignments.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-devices-sync.png b/devices/hololens/images/hololens-ap-devices-sync.png deleted file mode 100644 index fe970f7983..0000000000 Binary files a/devices/hololens/images/hololens-ap-devices-sync.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-enrollment-profiles.png b/devices/hololens/images/hololens-ap-enrollment-profiles.png deleted file mode 100644 index 1e3e8dfaa4..0000000000 Binary files a/devices/hololens/images/hololens-ap-enrollment-profiles.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-hash-import.png b/devices/hololens/images/hololens-ap-hash-import.png deleted file mode 100644 index 078e73d78c..0000000000 Binary files a/devices/hololens/images/hololens-ap-hash-import.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-intro.png b/devices/hololens/images/hololens-ap-intro.png deleted file mode 100644 index 8095114167..0000000000 Binary files a/devices/hololens/images/hololens-ap-intro.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-profile-assign-devicegroup.png b/devices/hololens/images/hololens-ap-profile-assign-devicegroup.png deleted file mode 100644 index 9e6dc92a3c..0000000000 Binary files a/devices/hololens/images/hololens-ap-profile-assign-devicegroup.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-profile-name.png b/devices/hololens/images/hololens-ap-profile-name.png deleted file mode 100644 index a427b437b8..0000000000 Binary files a/devices/hololens/images/hololens-ap-profile-name.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-profile-oobe.png b/devices/hololens/images/hololens-ap-profile-oobe.png deleted file mode 100644 index e14226d7ad..0000000000 Binary files a/devices/hololens/images/hololens-ap-profile-oobe.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-profile-settings-oma.png b/devices/hololens/images/hololens-ap-profile-settings-oma.png deleted file mode 100644 index 7528f55292..0000000000 Binary files a/devices/hololens/images/hololens-ap-profile-settings-oma.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-profile-settings.png b/devices/hololens/images/hololens-ap-profile-settings.png deleted file mode 100644 index 5753814e1b..0000000000 Binary files a/devices/hololens/images/hololens-ap-profile-settings.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-profile-summ.png b/devices/hololens/images/hololens-ap-profile-summ.png deleted file mode 100644 index 4fb955bbdf..0000000000 Binary files a/devices/hololens/images/hololens-ap-profile-summ.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-qrcode.png b/devices/hololens/images/hololens-ap-qrcode.png deleted file mode 100644 index c5296e3e91..0000000000 Binary files a/devices/hololens/images/hololens-ap-qrcode.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-uex-1.png b/devices/hololens/images/hololens-ap-uex-1.png deleted file mode 100644 index f89faa366a..0000000000 Binary files a/devices/hololens/images/hololens-ap-uex-1.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-uex-2.png b/devices/hololens/images/hololens-ap-uex-2.png deleted file mode 100644 index 5bf1beb3f0..0000000000 Binary files a/devices/hololens/images/hololens-ap-uex-2.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-uex-3.png b/devices/hololens/images/hololens-ap-uex-3.png deleted file mode 100644 index 59a7362269..0000000000 Binary files a/devices/hololens/images/hololens-ap-uex-3.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-uex-4.png b/devices/hololens/images/hololens-ap-uex-4.png deleted file mode 100644 index f17557b5c4..0000000000 Binary files a/devices/hololens/images/hololens-ap-uex-4.png and /dev/null differ diff --git a/devices/hololens/images/hololens-ap-uex-5.png b/devices/hololens/images/hololens-ap-uex-5.png deleted file mode 100644 index 0bd23da48e..0000000000 Binary files a/devices/hololens/images/hololens-ap-uex-5.png and /dev/null differ diff --git a/devices/hololens/images/hololens-bloom.gif b/devices/hololens/images/hololens-bloom.gif deleted file mode 100644 index db7d8378e5..0000000000 Binary files a/devices/hololens/images/hololens-bloom.gif and /dev/null differ diff --git a/devices/hololens/images/hololens-box-contents.png b/devices/hololens/images/hololens-box-contents.png deleted file mode 100644 index 51b4b5e163..0000000000 Binary files a/devices/hololens/images/hololens-box-contents.png and /dev/null differ diff --git a/devices/hololens/images/hololens-buttons.jpg b/devices/hololens/images/hololens-buttons.jpg deleted file mode 100644 index 868487b0bf..0000000000 Binary files a/devices/hololens/images/hololens-buttons.jpg and /dev/null differ diff --git a/devices/hololens/images/hololens-charging.png b/devices/hololens/images/hololens-charging.png deleted file mode 100644 index a5dd4d7dcd..0000000000 Binary files a/devices/hololens/images/hololens-charging.png and /dev/null differ diff --git a/devices/hololens/images/hololens-cleaning-visor.png b/devices/hololens/images/hololens-cleaning-visor.png deleted file mode 100644 index 68f990d43b..0000000000 Binary files a/devices/hololens/images/hololens-cleaning-visor.png and /dev/null differ diff --git a/devices/hololens/images/hololens-clicker-500px.jpg b/devices/hololens/images/hololens-clicker-500px.jpg deleted file mode 100644 index 4dd7d954f4..0000000000 Binary files a/devices/hololens/images/hololens-clicker-500px.jpg and /dev/null differ diff --git a/devices/hololens/images/hololens-frame.png b/devices/hololens/images/hololens-frame.png deleted file mode 100644 index 5789f1b8c8..0000000000 Binary files a/devices/hololens/images/hololens-frame.png and /dev/null differ diff --git a/devices/hololens/images/hololens-gaze.png b/devices/hololens/images/hololens-gaze.png deleted file mode 100644 index d21ffef0b2..0000000000 Binary files a/devices/hololens/images/hololens-gaze.png and /dev/null differ diff --git a/devices/hololens/images/hololens-lights.png b/devices/hololens/images/hololens-lights.png deleted file mode 100644 index f3a19b84a3..0000000000 Binary files a/devices/hololens/images/hololens-lights.png and /dev/null differ diff --git a/devices/hololens/images/hololens-power.png b/devices/hololens/images/hololens-power.png deleted file mode 100644 index 80c3e7c215..0000000000 Binary files a/devices/hololens/images/hololens-power.png and /dev/null differ diff --git a/devices/hololens/images/hololens-updates-timeline.png b/devices/hololens/images/hololens-updates-timeline.png deleted file mode 100644 index 4b1e986948..0000000000 Binary files a/devices/hololens/images/hololens-updates-timeline.png and /dev/null differ diff --git a/devices/hololens/images/hololens-vector-white.png b/devices/hololens/images/hololens-vector-white.png deleted file mode 100644 index 583a307449..0000000000 Binary files a/devices/hololens/images/hololens-vector-white.png and /dev/null differ diff --git a/devices/hololens/images/hololens.png b/devices/hololens/images/hololens.png deleted file mode 100644 index ce54ae4281..0000000000 Binary files a/devices/hololens/images/hololens.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-exploded-large.png b/devices/hololens/images/hololens2-exploded-large.png deleted file mode 100644 index fc639a0f62..0000000000 Binary files a/devices/hololens/images/hololens2-exploded-large.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-exploded-medium.png b/devices/hololens/images/hololens2-exploded-medium.png deleted file mode 100644 index 3e1fbea7de..0000000000 Binary files a/devices/hololens/images/hololens2-exploded-medium.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-fit.png b/devices/hololens/images/hololens2-fit.png deleted file mode 100644 index dacaf4cbd7..0000000000 Binary files a/devices/hololens/images/hololens2-fit.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-headstrap.png b/devices/hololens/images/hololens2-headstrap.png deleted file mode 100644 index 805637214b..0000000000 Binary files a/devices/hololens/images/hololens2-headstrap.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-lift-visor.png b/devices/hololens/images/hololens2-lift-visor.png deleted file mode 100644 index 4d83f2c730..0000000000 Binary files a/devices/hololens/images/hololens2-lift-visor.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-remove-browpad.png b/devices/hololens/images/hololens2-remove-browpad.png deleted file mode 100644 index 619f14e4fd..0000000000 Binary files a/devices/hololens/images/hololens2-remove-browpad.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-side-render-medium.png b/devices/hololens/images/hololens2-side-render-medium.png deleted file mode 100644 index d4650c05e2..0000000000 Binary files a/devices/hololens/images/hololens2-side-render-medium.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-side-render-small.png b/devices/hololens/images/hololens2-side-render-small.png deleted file mode 100644 index a1a612e05a..0000000000 Binary files a/devices/hololens/images/hololens2-side-render-small.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-side-render-xs.png b/devices/hololens/images/hololens2-side-render-xs.png deleted file mode 100644 index 08d5f966cd..0000000000 Binary files a/devices/hololens/images/hololens2-side-render-xs.png and /dev/null differ diff --git a/devices/hololens/images/hololens2-side-render.png b/devices/hololens/images/hololens2-side-render.png deleted file mode 100644 index 143fb8fc50..0000000000 Binary files a/devices/hololens/images/hololens2-side-render.png and /dev/null differ diff --git a/devices/hololens/images/icd-create-options-1703.PNG b/devices/hololens/images/icd-create-options-1703.PNG deleted file mode 100644 index 007e740683..0000000000 Binary files a/devices/hololens/images/icd-create-options-1703.PNG and /dev/null differ diff --git a/devices/hololens/images/icd-export-menu.png b/devices/hololens/images/icd-export-menu.png deleted file mode 100644 index 20bd5258eb..0000000000 Binary files a/devices/hololens/images/icd-export-menu.png and /dev/null differ diff --git a/devices/hololens/images/icd-install.PNG b/devices/hololens/images/icd-install.PNG deleted file mode 100644 index a0c80683ff..0000000000 Binary files a/devices/hololens/images/icd-install.PNG and /dev/null differ diff --git a/devices/hololens/images/icd-settings.png b/devices/hololens/images/icd-settings.png deleted file mode 100644 index 111b7f38c7..0000000000 Binary files a/devices/hololens/images/icd-settings.png and /dev/null differ diff --git a/devices/hololens/images/icd-simple-edit.png b/devices/hololens/images/icd-simple-edit.png deleted file mode 100644 index 421159ac17..0000000000 Binary files a/devices/hololens/images/icd-simple-edit.png and /dev/null differ diff --git a/devices/hololens/images/icd1.PNG b/devices/hololens/images/icd1.PNG deleted file mode 100644 index 25f905d4fe..0000000000 Binary files a/devices/hololens/images/icd1.PNG and /dev/null differ diff --git a/devices/hololens/images/intune1.PNG b/devices/hololens/images/intune1.PNG deleted file mode 100644 index c87c58d36a..0000000000 Binary files a/devices/hololens/images/intune1.PNG and /dev/null differ diff --git a/devices/hololens/images/intune2.PNG b/devices/hololens/images/intune2.PNG deleted file mode 100644 index 61ca386c3c..0000000000 Binary files a/devices/hololens/images/intune2.PNG and /dev/null differ diff --git a/devices/hololens/images/intune3.png b/devices/hololens/images/intune3.png deleted file mode 100644 index 39a812a1a7..0000000000 Binary files a/devices/hololens/images/intune3.png and /dev/null differ diff --git a/devices/hololens/images/ipd-finger-alignment-300px.jpg b/devices/hololens/images/ipd-finger-alignment-300px.jpg deleted file mode 100644 index 7a4c929867..0000000000 Binary files a/devices/hololens/images/ipd-finger-alignment-300px.jpg and /dev/null differ diff --git a/devices/hololens/images/keyboard.png b/devices/hololens/images/keyboard.png deleted file mode 100644 index 6962567b83..0000000000 Binary files a/devices/hololens/images/keyboard.png and /dev/null differ diff --git a/devices/hololens/images/kiosk.png b/devices/hololens/images/kiosk.png deleted file mode 100644 index 9cc771c779..0000000000 Binary files a/devices/hololens/images/kiosk.png and /dev/null differ diff --git a/devices/hololens/images/launchicon.png b/devices/hololens/images/launchicon.png deleted file mode 100644 index d469c68a2c..0000000000 Binary files a/devices/hololens/images/launchicon.png and /dev/null differ diff --git a/devices/hololens/images/mdm-enrollment-error.png b/devices/hololens/images/mdm-enrollment-error.png deleted file mode 100644 index 77b695d1cf..0000000000 Binary files a/devices/hololens/images/mdm-enrollment-error.png and /dev/null differ diff --git a/devices/hololens/images/minimenu.png b/devices/hololens/images/minimenu.png deleted file mode 100644 index 7aa0018011..0000000000 Binary files a/devices/hololens/images/minimenu.png and /dev/null differ diff --git a/devices/hololens/images/motherboard-400px.jpg b/devices/hololens/images/motherboard-400px.jpg deleted file mode 100644 index 5a2a085477..0000000000 Binary files a/devices/hololens/images/motherboard-400px.jpg and /dev/null differ diff --git a/devices/hololens/images/multiappassignedaccesssettings.png b/devices/hololens/images/multiappassignedaccesssettings.png deleted file mode 100644 index 86e2e0a451..0000000000 Binary files a/devices/hololens/images/multiappassignedaccesssettings.png and /dev/null differ diff --git a/devices/hololens/images/one.png b/devices/hololens/images/one.png deleted file mode 100644 index 7766e7d470..0000000000 Binary files a/devices/hololens/images/one.png and /dev/null differ diff --git a/devices/hololens/images/provision-hololens-devices.png b/devices/hololens/images/provision-hololens-devices.png deleted file mode 100644 index c5ece7102f..0000000000 Binary files a/devices/hololens/images/provision-hololens-devices.png and /dev/null differ diff --git a/devices/hololens/images/recover-clicker-1.png b/devices/hololens/images/recover-clicker-1.png deleted file mode 100644 index ad54e6ee09..0000000000 Binary files a/devices/hololens/images/recover-clicker-1.png and /dev/null differ diff --git a/devices/hololens/images/recover-clicker-2.png b/devices/hololens/images/recover-clicker-2.png deleted file mode 100644 index d7a9d6fd0d..0000000000 Binary files a/devices/hololens/images/recover-clicker-2.png and /dev/null differ diff --git a/devices/hololens/images/searchfeedback-500px.jpg b/devices/hololens/images/searchfeedback-500px.jpg deleted file mode 100644 index 952e29a6ec..0000000000 Binary files a/devices/hololens/images/searchfeedback-500px.jpg and /dev/null differ diff --git a/devices/hololens/images/see-through-400px.jpg b/devices/hololens/images/see-through-400px.jpg deleted file mode 100644 index d9fba1c9e0..0000000000 Binary files a/devices/hololens/images/see-through-400px.jpg and /dev/null differ diff --git a/devices/hololens/images/sensor-bar-400px.jpg b/devices/hololens/images/sensor-bar-400px.jpg deleted file mode 100644 index bf0b8f7f21..0000000000 Binary files a/devices/hololens/images/sensor-bar-400px.jpg and /dev/null differ diff --git a/devices/hololens/images/set-up-device-details.PNG b/devices/hololens/images/set-up-device-details.PNG deleted file mode 100644 index 7325e06e86..0000000000 Binary files a/devices/hololens/images/set-up-device-details.PNG and /dev/null differ diff --git a/devices/hololens/images/set-up-device.PNG b/devices/hololens/images/set-up-device.PNG deleted file mode 100644 index 577117a26a..0000000000 Binary files a/devices/hololens/images/set-up-device.PNG and /dev/null differ diff --git a/devices/hololens/images/set-up-network-details-desktop.PNG b/devices/hololens/images/set-up-network-details-desktop.PNG deleted file mode 100644 index 83911ccbd0..0000000000 Binary files a/devices/hololens/images/set-up-network-details-desktop.PNG and /dev/null differ diff --git a/devices/hololens/images/set-up-network.PNG b/devices/hololens/images/set-up-network.PNG deleted file mode 100644 index 19fd3ff7bb..0000000000 Binary files a/devices/hololens/images/set-up-network.PNG and /dev/null differ diff --git a/devices/hololens/images/seven.png b/devices/hololens/images/seven.png deleted file mode 100644 index 285a92df0b..0000000000 Binary files a/devices/hololens/images/seven.png and /dev/null differ diff --git a/devices/hololens/images/six.png b/devices/hololens/images/six.png deleted file mode 100644 index e8906332ec..0000000000 Binary files a/devices/hololens/images/six.png and /dev/null differ diff --git a/devices/hololens/images/startmenu.jpg b/devices/hololens/images/startmenu.jpg deleted file mode 100644 index b685db51ee..0000000000 Binary files a/devices/hololens/images/startmenu.jpg and /dev/null differ diff --git a/devices/hololens/images/three.png b/devices/hololens/images/three.png deleted file mode 100644 index 887fa270d7..0000000000 Binary files a/devices/hololens/images/three.png and /dev/null differ diff --git a/devices/hololens/images/two.png b/devices/hololens/images/two.png deleted file mode 100644 index b8c2d52eaf..0000000000 Binary files a/devices/hololens/images/two.png and /dev/null differ diff --git a/devices/hololens/images/upvotefeedback-500px.jpg b/devices/hololens/images/upvotefeedback-500px.jpg deleted file mode 100644 index f1eda89efa..0000000000 Binary files a/devices/hololens/images/upvotefeedback-500px.jpg and /dev/null differ diff --git a/devices/hololens/images/use-hololens-clicker-1.png b/devices/hololens/images/use-hololens-clicker-1.png deleted file mode 100644 index ad54e6ee09..0000000000 Binary files a/devices/hololens/images/use-hololens-clicker-1.png and /dev/null differ diff --git a/devices/hololens/images/use-hololens-clicker-2.png b/devices/hololens/images/use-hololens-clicker-2.png deleted file mode 100644 index d7a9d6fd0d..0000000000 Binary files a/devices/hololens/images/use-hololens-clicker-2.png and /dev/null differ diff --git a/devices/hololens/images/uwp-dependencies.PNG b/devices/hololens/images/uwp-dependencies.PNG deleted file mode 100644 index 4e2563169f..0000000000 Binary files a/devices/hololens/images/uwp-dependencies.PNG and /dev/null differ diff --git a/devices/hololens/images/uwp-license.PNG b/devices/hololens/images/uwp-license.PNG deleted file mode 100644 index ccb5cf7cf4..0000000000 Binary files a/devices/hololens/images/uwp-license.PNG and /dev/null differ diff --git a/devices/hololens/images/vs2015-remotedeployment.jpg b/devices/hololens/images/vs2015-remotedeployment.jpg deleted file mode 100644 index a7d6b43dc3..0000000000 Binary files a/devices/hololens/images/vs2015-remotedeployment.jpg and /dev/null differ diff --git a/devices/hololens/images/wifi-hololens-600px.jpg b/devices/hololens/images/wifi-hololens-600px.jpg deleted file mode 100644 index eb6930a29f..0000000000 Binary files a/devices/hololens/images/wifi-hololens-600px.jpg and /dev/null differ diff --git a/devices/hololens/images/wifi-hololens-hwdetails.jpg b/devices/hololens/images/wifi-hololens-hwdetails.jpg deleted file mode 100644 index e4b45047cf..0000000000 Binary files a/devices/hololens/images/wifi-hololens-hwdetails.jpg and /dev/null differ diff --git a/devices/hololens/images/windows-device-portal-home-page.png b/devices/hololens/images/windows-device-portal-home-page.png deleted file mode 100644 index 55e4b0eaad..0000000000 Binary files a/devices/hololens/images/windows-device-portal-home-page.png and /dev/null differ diff --git a/devices/hololens/images/wizard-steps.png b/devices/hololens/images/wizard-steps.png deleted file mode 100644 index d97bae9a05..0000000000 Binary files a/devices/hololens/images/wizard-steps.png and /dev/null differ diff --git a/devices/hololens/images/wsfb-private.png b/devices/hololens/images/wsfb-private.png deleted file mode 100644 index 35ce83829b..0000000000 Binary files a/devices/hololens/images/wsfb-private.png and /dev/null differ diff --git a/devices/hololens/index.md b/devices/hololens/index.md deleted file mode 100644 index 47862d7138..0000000000 --- a/devices/hololens/index.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Microsoft HoloLens -description: Landing page for Microsoft HoloLens. -ms.prod: hololens -ms.sitesec: library -ms.assetid: 0947f5b3-8f0f-42f0-aa27-6d2cad51d040 -author: scooley -ms.author: scooley -ms.topic: article -ms.localizationpriority: medium -ms.date: 10/14/2019 -audience: ITPro -ms.custom: -- CI 111456 -- CSSTroubleshooting -appliesto: -- HoloLens (1st gen) -- HoloLens 2 - ---- - -# Microsoft HoloLens - - - - - -
-

Microsoft HoloLens is the first fully self-contained holographic computer running Windows 10.

- -

Now, with the introduction of HoloLens 2, every device provides commercial ready management enhanced by the reliability, security, and scalability of cloud and AI services from Microsoft.

- -

To learn more about HoloLens 2 for developers, check out the mixed reality developer documentation.

- -

To buy HoloLens, check out HoloLens pricing and sales on microsoft.com/HoloLens.

-
HoloLens 2 side view
- -## Guides in this section - -| Guide | Description | -| --- | --- | -| [Get started with HoloLens 2](hololens2-setup.md) | Set up HoloLens 2 for the first time. | -| [Get started with HoloLens (1st gen)](hololens1-setup.md) | Set up HoloLens (1st gen) for the first time. | -| [Get started with HoloLens in a commercial or classroom environment](hololens-requirements.md) | Plan for a multi-device HoloLens deployment and create a strategy for ongoing device management.
This section is tailored to IT professionals managing devices with existing device management infrastructure. | - -## Quick reference by topic - -| Topic | Description | -| --- | --- | -| [What's new in HoloLens](hololens-whats-new.md) | Discover new features in the latest updates via HoloLens release notes. | -| [Install and manage applications on HoloLens](hololens-install-apps.md) | Install and manage important applications on HoloLens at scale. | -| [HoloLens update management](hololens-updates.md) | Use mobile device management (MDM) policies to configure settings for updates. | -| [HoloLens user management](hololens-multiple-users.md) | Multiple users can share a HoloLens device by using their Azure Active Directory accounts. | -| [HoloLens application access management](hololens-kiosk.md) | Manage application access for different user groups. | -| [Recover and troubleshoot HoloLens issues](https://support.microsoft.com/products/hololens) | Learn how to gather logs from HoloLens, recover a misbehaving device, or reset HoloLens when necessary. | -| [Contact Support](https://support.microsoft.com/supportforbusiness/productselection) | Create a new support request for the business support team. | -| [More support options](https://support.microsoft.com/products/hololens) | Connect with Microsoft support resources for HoloLens in the enterprise. | - -## Related resources - -* [Documentation for Holographic app development](https://developer.microsoft.com/windows/mixed-reality/development) -* [HoloLens release notes](https://docs.microsoft.com/hololens/hololens-release-notes) diff --git a/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md b/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md deleted file mode 100644 index e499178078..0000000000 --- a/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: General Data Privacy Regulation and Surface Hub -description: Informs users who are subject to EU data protection laws of their options regarding how to delete or restrict diagnostic data produced by Surface Hub. -ms.assetid: 087713CF-631D-477B-9CC6-EFF939DE0186 -keywords: GDPR -ms.prod: surface-hub -ms.sitesec: library -author: Teresa-MOTIV -ms.author: v-tea -ms.topic: article -ms.localizationpriority: medium ---- - -# General Data Privacy Regulation and Surface Hub - -In May 2018, a European privacy law, the General Data Protection Regulation (GDPR), took effect. The GDPR imposes new rules on companies, government agencies, non-profits, and other organizations that offer goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents. - -Surface Hub customers concerned about privacy under the new GDPR regulations can manage their device privacy with the following options that are provided by Microsoft: - -* **Option 1:** Surface Hub devices in regions enforcing GDPR regulations will install KB4284830 when publicly available to automatically reduce diagnostic data emission to basic. Customers opting to provide a higher level of diagnostic data can use the Surface Hub Settings application or Mobile Device Management to override the default basic setting. - -* **Option 2:** Surface Hub customers who want to remove any existing diagnostic data can download the **Surface Hub Delete Diagnostic Data** application from the Microsoft Store. This app will allow customers to request deletion of associated diagnostic data directly from their Surface Hub device. - -Microsoft has extensive expertise in protecting data, championing privacy, and complying with complex regulations, and currently complies with both EU-U.S. Privacy Shield and EU Model Clauses. We believe that the GDPR is an important step forward for clarifying and enabling individual privacy rights. We want to help you focus on your core business while efficiently preparing for the GDPR. - diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md deleted file mode 100644 index 67516c9773..0000000000 --- a/devices/surface-hub/TOC.md +++ /dev/null @@ -1,132 +0,0 @@ -# [Microsoft Surface Hub](index.yml) - -# Surface Hub 2S - -## Overview -### [What's new in Surface Hub 2S for IT admins](surface-hub-2s-whats-new.md) -### [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) -### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md) -### [Adjust Surface Hub 2S brightness, volume, and input](surface-hub-2s-onscreen-display.md) -### [Use Microsoft Whiteboard on a Surface Hub](https://support.office.com/article/use-microsoft-whiteboard-on-a-surface-hub-5c594985-129d-43f9-ace5-7dee96f7621d) - -## Plan -### [Surface Hub 2S Site Readiness Guide](surface-hub-2s-site-readiness-guide.md) -#### [Site planning for Surface Hub 2S](surface-hub-2s-site-planning.md) -#### [Surface Hub 2S quick start](surface-hub-2s-quick-start.md) -#### [Install and mount Surface Hub 2S](surface-hub-2s-install-mount.md) -#### [Customize wall mount of Surface Hub 2S](surface-hub-2s-custom-install.md) -#### [Setup worksheet](setup-worksheet-surface-hub.md) -#### [Surface Hub 2S ports and keypad overview](surface-hub-2s-port-keypad-overview.md) -#### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md) -### [Prepare your environment for Microsoft Surface Hub 2S](surface-hub-2s-prepare-environment.md) -### [Configure Easy Authentication for Surface Hub 2S](surface-hub-2s-phone-authenticate.md) - -## Deploy -### [Surface Hub 2S adoption and training](surface-hub-2s-adoption-kit.md) -### [Surface Hub 2S adoption videos](surface-hub-2s-adoption-videos.md) - -### [First time setup for Surface Hub 2S](surface-hub-2s-setup.md) -### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md) -### [Surface Hub 2S deployment checklist](surface-hub-2s-deploy-checklist.md) -### [Create Surface Hub 2S device account](surface-hub-2s-account.md) -### [Create provisioning packages for Surface Hub 2S](surface-hub-2s-deploy.md) -### [Deploy apps to Surface Hub 2S using Intune](surface-hub-2s-deploy-apps-intune.md) -### [Create Surface Hub 2S on-premises accounts with PowerShell](surface-hub-2s-onprem-powershell.md) - -## Manage -### [Manage Surface Hub 2S with Microsoft Intune](surface-hub-2s-manage-intune.md) -### [Local management for Surface Hub 2S settings](local-management-surface-hub-settings.md) -### [Manage device account password rotation](surface-hub-2s-manage-passwords.md) -### [Manage Windows updates](manage-windows-updates-for-surface-hub.md) -### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) -### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) -### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) -### [Applying ActiveSync policies to device accounts](apply-activesync-policies-for-surface-hub-device-accounts.md) -### [Update pen firmware on Surface Hub 2S](surface-hub-2s-pen-firmware.md) - -## Secure -### [Surface Hub security overview](surface-hub-security.md) -### [Secure and manage Surface Hub 2S with SEMM and UEFI](surface-hub-2s-secure-with-uefi-semm.md) -### [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) - -## Troubleshoot -### [Recover and reset Surface Hub 2S](surface-hub-2s-recover-reset.md) -### [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) -### [How to pack and ship your Surface Hub 2S for service](surface-hub-2s-pack-components.md) -### [Change history](surface-hub-2s-change-history.md) - -# Surface Hub -## Overview -### [What's new in Windows 10, version 1703 for Surface Hub?](surfacehub-whats-new-1703.md) -### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md) -### [Technical information for 55" Microsoft Surface Hub](surface-hub-technical-55.md) -### [Technical information for 84" Microsoft Surface Hub](surface-hub-technical-84.md) -### [Use Microsoft Whiteboard on a Surface Hub](https://support.office.com/article/use-microsoft-whiteboard-on-a-surface-hub-5c594985-129d-43f9-ace5-7dee96f7621d) - -## Plan -### [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md) -### [Surface Hub Site Readiness Guide](surface-hub-site-readiness-guide.md) -### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md) - -## Deploy -### [Create and test a device account](create-and-test-a-device-account-surface-hub.md) -#### [Online deployment](online-deployment-surface-hub-device-accounts.md) -#### [On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md) -#### [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) -#### [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) -#### [Online or hybrid deployment using Skype Hybrid Voice environment](skype-hybrid-voice.md) -#### [Create a device account using UI](create-a-device-account-using-office-365.md) -#### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) -#### [Applying ActiveSync policies to device accounts](apply-activesync-policies-for-surface-hub-device-accounts.md) -#### [Password management](password-management-for-surface-hub-device-accounts.md) -#### [Create provisioning packages](provisioning-packages-for-surface-hub.md) -#### [Admin group management](admin-group-management-for-surface-hub.md) -### [Set up Microsoft Surface Hub](set-up-your-surface-hub.md) -#### [Setup worksheet](setup-worksheet-surface-hub.md) -#### [First-run program](first-run-program-surface-hub.md) - -## Manage -### [Manage Microsoft Surface Hub](manage-surface-hub.md) -### [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) -### [Remote Surface Hub management](remote-surface-hub-management.md) -#### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) -#### [Monitor your Surface Hub](monitor-surface-hub.md) -#### [Windows updates](manage-windows-updates-for-surface-hub.md) -### [Manage Surface Hub settings](manage-surface-hub-settings.md) -#### [Local management for Surface Hub settings](local-management-surface-hub-settings.md) -#### [Accessibility](accessibility-surface-hub.md) -#### [Change the Surface Hub device account](change-surface-hub-device-account.md) -#### [Device reset](device-reset-surface-hub.md) -#### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md) -#### [Wireless network management](wireless-network-management-for-surface-hub.md) -### [Implement Quality of Service on Surface Hub](surface-hub-qos.md) -### [Install apps on your Surface Hub](install-apps-on-surface-hub.md) -### [Configure Surface Hub Start menu](surface-hub-start-menu.md) -### [Set up and use Microsoft Whiteboard](whiteboard-collaboration.md) -### [End a Surface Hub meeting with End session](i-am-done-finishing-your-surface-hub-meeting.md) -### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) -### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) -### [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) -### [Using a room control system](use-room-control-system-with-surface-hub.md) - -## Secure -### [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) -### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) -### [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) - -## Troubleshoot -### [Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) -### [Surface Hub SSD replacement](surface-hub-ssd-replacement.md) -### [Top support solutions for Surface Hub](support-solutions-surface-hub.md) -### [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md) -### [Surface Hub Update History](surface-hub-update-history.md) -### [Known issues and additional information about Microsoft Surface Hub](known-issues-and-additional-info-about-surface-hub.md) -### [How to use cloud recovery for BitLocker on a Surface Hub](use-cloud-recovery-for-bitlocker-on-surfacehub.md) -### [Using the Surface Hub Hardware Diagnostic Tool to test a device account](use-surface-hub-diagnostic-test-device-account.md) -### [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) -### [Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel](surfacehub-miracast-not-supported-europe-japan-israel.md) -### [What to do if the Connect app in Surface Hub exits unexpectedly](connect-app-in-surface-hub-unexpectedly-exits.md) -### [Surface Hub may install updates and restart outside maintenance hours](surface-hub-installs-updates-and-restarts-outside-maintenance-hours.md) -### [General Data Privacy Regulation and Surface Hub](general-data-privacy-regulation-and-surface-hub.md) -### [Useful downloads for Surface Hub administrators](surface-hub-downloads.md) -### [Change history for Surface Hub](change-history-surface-hub.md) diff --git a/devices/surface-hub/accessibility-surface-hub.md b/devices/surface-hub/accessibility-surface-hub.md deleted file mode 100644 index 8237e61a08..0000000000 --- a/devices/surface-hub/accessibility-surface-hub.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Accessibility (Surface Hub) -description: Accessibility settings for the Microsoft Surface Hub can be changed by using the Settings app. You'll find them under Ease of Access. Your Surface Hub has the same accessibility options as Windows 10. -ms.assetid: 1D44723B-1162-4DF6-99A2-8A3F24443442 -ms.reviewer: -manager: laurawi -keywords: Accessibility settings, Settings app, Ease of Access -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Accessibility (Surface Hub) - -Microsoft Surface Hub has the same accessibility options as Windows 10. - - -## Default accessibility settings - -The full list of accessibility settings are available to IT admins in the **Settings** app. The default accessibility settings for Surface Hub include: - -| Accessibility feature | Default settings | -| --------------------- | ----------------- | -| Magnifier | Off | -| High contrast | No theme selected | -| Closed captions | Defaults selected for Font and Background and window | -| Keyboard | **On-screen Keyboard**, **Sticky Keys**, **Toggle Keys**, and **Filter Keys** are all off. | -| Mouse | Defaults selected for **Pointer size**, **Pointer color** and **Mouse keys**. | -| Other options | Defaults selected for **Visual options** and **Touch feedback**. | - -The accessibility feature Narrator is not available in the **Settings** app. By default, Narrator is turned off. To change the default settings for Narrator, perform the following steps using a keyboard and mouse. - -1. Dismiss the Welcome screen. -2. Open **Quick Actions** > **Ease of Access** from the status bar. - - ![Screenshot of Ease of Access tile](images/ease-of-access.png) - -3. Turn Narrator on. -4. Click **Task Switcher**. -5. Select **Narrator Settings** from Task Switcher. You can now edit the default Narrator settings. - -Additionally, these accessibility features and apps are returned to default settings when users press [End session](finishing-your-surface-hub-meeting.md): -- Narrator -- Magnifier -- High contrast -- Filter keys -- Sticky keys -- Toggle keys -- Mouse keys - - -## Change accessibility settings during a meeting - -During a meeting, users can toggle accessibility features and apps in a couple ways: -- [Keyboard shortcuts](https://support.microsoft.com/help/13813/windows-10-microsoft-surface-hub-keyboard-shortcuts) -- **Quick Actions** > **Ease of Access** from the status bar - -> ![Image showing Quick Action center on Surface Hub](images/sh-quick-action.png) - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) diff --git a/devices/surface-hub/admin-group-management-for-surface-hub.md b/devices/surface-hub/admin-group-management-for-surface-hub.md deleted file mode 100644 index 81c03b484c..0000000000 --- a/devices/surface-hub/admin-group-management-for-surface-hub.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Admin group management (Surface Hub) -description: Every Microsoft Surface Hub can be configured individually by opening the Settings app on the device. -ms.assetid: FA67209E-B355-4333-B903-482C4A3BDCCE -ms.reviewer: -manager: laurawi -keywords: admin group management, Settings app, configure Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Admin group management (Surface Hub) - - -Every Surface Hub can be configured locally using the Settings app on the device. To prevent unauthorized users from changing settings, the Settings app requires admin credentials to open the app. - - -## Admin Group Management - -You can set up administrator accounts for the device in one of three ways: - -- Create a local admin account -- Domain join the device to Active Directory (AD) -- Azure Active Directory (Azure AD) join the device - - -### Create a local admin account - -To create a local admin, [choose to use a local admin during first run](first-run-program-surface-hub.md#use-a-local-admin). This will create a single local admin account on the Surface Hub with the username and password of your choice. Use these credentials to open the Settings app. - -Note that the local admin account information is not backed by any directory service. We recommend you only choose a local admin if the device does not have access to Active Directory (AD) or Azure Active Directory (Azure AD). If you decide to change the local admin’s password, you can do so in Settings. However, if you want to change from using the local admin account to using a group from your domain or Azure AD tenant, then you’ll need to [reset the device](device-reset-surface-hub.md) and go through the first-time program again. - -### Domain join the device to Active Directory (AD) - -You can domain join the Surface Hub to your AD domain to allow users from a specified security group to configure settings. During first run, choose to use [Active Directory Domain Services](first-run-program-surface-hub.md#use-active-directory-domain-services). You'll need to provide credentials that are capable of joining the domain of your choice, and the name of an existing security group. Anyone who is a member of that security group can enter their credentials and unlock Settings. - -#### What happens when you domain join your Surface Hub? -Surface Hubs use domain join to: -- Grant admin rights to members of a specified security group in AD. -- Backup the device's BitLocker recovery key by storing it under the computer object in AD. See [Save your BitLocker key](save-bitlocker-key-surface-hub.md) for details. -- Synchronize the system clock with the domain controller for encrypted communication - -Surface Hub does not support applying group policies or certificates from the domain controller. - -> [!NOTE] -> If your Surface Hub loses trust with the domain (for example, if you remove the Surface Hub from the domain after it is domain joined), you won't be able to authenticate into the device and open up Settings. If you decide to remove the trust relationship of the Surface Hub with your domain, [reset the device](device-reset-surface-hub.md) first. - - -### Azure Active Directory (Azure AD) join the device - -You can Azure AD join the Surface Hub to allow IT pros from your Azure AD tenant to configure settings. During first run, choose to use [Microsoft Azure Active Directory](first-run-program-surface-hub.md#use-microsoft-azure-active-directory). You will need to provide credentials that are capable of joining the Azure AD tenant of your choice. After you successfully Azure AD join, the appropriate people will be granted admin rights on the device. - -By default, all **global administrators** will be given admin rights on an Azure AD joined Surface Hub. With **Azure AD Premium** or **Enterprise Mobility Suite (EMS)**, you can add additional administrators: -1. In the [Azure classic portal](https://manage.windowsazure.com/), click **Active Directory**, and then click the name of your organization's directory. -2. On the **Configure** page, under **Devices** > **Additional administrators on Azure AD joined devices**, click **Selected**. -3. Click **Add**, and select the users you want to add as administrators on your Surface Hub and other Azure AD joined devices. -4. When you have finished, click the checkmark button to save your change. - -#### What happens when you Azure AD join your Surface Hub? -Surface Hubs use Azure AD join to: -- Grant admin rights to the appropriate users in your Azure AD tenant. -- Backup the device's BitLocker recovery key by storing it under the account that was used to Azure AD join the device. See [Save your BitLocker key](save-bitlocker-key-surface-hub.md) for details. - -### Automatic enrollment via Azure Active Directory join - -Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory. - -For more information, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment). - -### Which should I choose? - -If your organization is using AD or Azure AD, we recommend you either domain join or Azure AD join, primarily for security reasons. People will be able to authenticate and unlock Settings with their own credentials, and can be moved in or out of the security groups associated with your domain. - -| Option | Requirements | Which credentials can be used to access the Settings app? | -|---------------------------------------------------|-----------------------------------------|-------| -| Create a local admin account | None | The user name and password specified during first run | -| Domain join to Active Directory (AD) | Your organization uses AD | Any AD user from a specific security group in your domain | -| Azure Active Directory (Azure AD) join the device | Your organization uses Azure AD Basic | Global administrators only | -|   | Your organization uses Azure AD Premium or Enterprise Mobility Suite (EMS) | Global administrators and additional administrators | - - diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md deleted file mode 100644 index f74f2297fa..0000000000 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ /dev/null @@ -1,1692 +0,0 @@ ---- -title: PowerShell for Surface Hub (Surface Hub) -description: PowerShell scripts to help set up and manage your Microsoft Surface Hub. -ms.assetid: 3EF48F63-8E4C-4D74-ACD5-461F1C653784 -ms.reviewer: -manager: laurawi -keywords: PowerShell, set up Surface Hub, manage Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/10/2018 -ms.localizationpriority: medium ---- - -# PowerShell for Surface Hub - - -PowerShell scripts to help set up and manage your Microsoft Surface Hub. - -- [PowerShell scripts for Surface Hub admins](#scripts-for-admins) - - [Create an on-premises account](#create-on-premises-ps-scripts) - - [Create a device account using Office 365](#create-os356-ps-scripts) - - [Account verification script](#acct-verification-ps-scripts) - - [Enable Skype for Business (EnableSfb.ps1)](#enable-sfb-ps-scripts) -- [Useful cmdlets](#useful-cmdlets) - - [Creating a Surface Hub-compatible Exchange ActiveSync policy](#create-compatible-as-policy) - - [Allowing device IDs for ActiveSync](#whitelisting-device-ids-cmdlet) - - [Auto-accepting and declining meeting requests](#auto-accept-meetings-cmdlet) - - [Accepting external meeting requests](#accept-ext-meetings-cmdlet) - - -## Prerequisites - -To successfully execute these PowerShell scripts, you will need to install the following prerequisites: - -- [Microsoft Online Services Sign-in Assistant for IT Professionals RTW](https://www.microsoft.com/download/details.aspx?id=41950) -- [Microsoft Azure Active Directory Module for Windows PowerShell (64-bit version)](https://www.powershellgallery.com/packages/MSOnline/1.1.183.17) -- [Windows PowerShell Module for Skype for Business Online](https://www.microsoft.com/download/details.aspx?id=39366) - -## PowerShell scripts for Surface Hub administrators - - -What do the scripts do? - -- Create device accounts for setups using pure single-forest on-premises (Microsoft Exchange and Skype 2013 and later only) or online (Microsoft Office 365), that are configured correctly for your Surface Hub. -- Validate existing device accounts for any setup (on-premises or online) to make sure they're compatible with Surface Hub. -- Provide a base template for anyone wanting to create their own device account creation or validation scripts. - -What do you need in order to run the scripts? - -- Remote PowerShell access to your organization's domain or tenant, Exchange servers, and Skype for Business servers. -- Admin credentials for your organization's domain or tenant, Exchange servers, and Skype for Business servers. - ->[!NOTE] ->Whether you’re creating a new account or modifying an already-existing account, the validation script will verify that your device account is configured correctly. You should always run the validation script before adding a device account to Surface Hub. - -  - -## Running the scripts - - -The account creation scripts will: - -- Ask for administrator credentials -- Create device accounts in your domain/tenant -- Create or assign a Surface Hub-compatible ActiveSync policy to the device account(s) -- Set various attributes for the created account(s) in Exchange and Skype for Business. -- Assign licenses and permissions to the created account(s) - -These are the attributes that are set by the scripts: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
CmdletAttributeValue

Set-Mailbox

RoomMailboxPassword

User-provided

EnableRoomMailboxAccount

True

Type

Room

Set-CalendarProcessing

AutomateProcessing

AutoAccept

RemovePrivateProperty

False

DeleteSubject

False

DeleteComments

False

AddOrganizerToSubject

False

AddAdditionalResponse

True

AdditionalResponse

"This is a Surface Hub room!"

New-MobileDeviceMailboxPolicy

PasswordEnabled

False

AllowNonProvisionableDevices

True

Enable-CSMeetingRoom

RegistrarPool

User-provided

SipAddress

Set to the User Principal Name (UPN) of the device account

Set-MsolUserLicense (O365 only)

AddLicenses

User-provided

Set-MsolUser (O365 only)

PasswordNeverExpires

True

Set-AdUser (On-prem only)

Enabled

True

Set-AdUser (On-prem only)

PasswordNeverExpires

True

- -  - -## Account creation scripts - - -These scripts will create a device account for you. You can use the [Account verification script](#acct-verification-ps-scripts) to make sure they ran correctly. - -The account creation scripts cannot modify an already existing account, but can be used to help you understand which cmdlets need to be run to configure the existing account correctly. - -### Create an on-premises account - -Creates an account as described in [On-premises deployment](on-premises-deployment-surface-hub-device-accounts.md). - -```PowerShell -# SHAccountCreateOnPrem.ps1 - -$Error.Clear() -$ErrorActionPreference = "Stop" -$status = @{} - -# Cleans up set state such as remote powershell sessions -function Cleanup() -{ - if ($sessExchange) - { - Remove-PSSession $sessExchange - } - if ($sessCS) - { - Remove-PSSession $sessCS - } -} - -function PrintError($strMsg) -{ - Write-Host $strMsg -foregroundcolor Red -} - -function PrintSuccess($strMsg) -{ - Write-Host $strMsg -foregroundcolor Green -} - -function PrintAction($strMsg) -{ - Write-Host $strMsg -ForegroundColor Cyan -} - - -# Cleans up and prints an error message -function CleanupAndFail($strMsg) -{ - if ($strMsg) - { - PrintError($strMsg); - } - Cleanup - exit 1 -} - -# Exits if there is an error set and prints the given message -function ExitIfError($strMsg) -{ - if ($Error) - { - CleanupAndFail($strMsg); - } -} - -## Collect account data ## -$credNewAccount = (Get-Credential -Message "Enter the desired UPN and password for this new account") -$strUpn = $credNewAccount.UserName -$strDisplayName = Read-Host "Please enter the display name you would like to use for $strUpn" -if (!$credNewAccount -Or [System.String]::IsNullOrEmpty($strDisplayName) -Or [System.String]::IsNullOrEmpty($credNewAccount.UserName) -Or $credNewAccount.Password.Length -le 0) -{ - CleanupAndFail "Please enter all of the requested data to continue." - exit 1 -} - - -## Sign in to remote powershell for exchange and lync online ## - -$credExchange = $null -$credExchange=Get-Credential -Message "Enter credentials of an Exchange user with mailbox creation rights" -if (!$credExchange) -{ - CleanupAndFail("Valid credentials are required to create and prepare the account."); -} -$strExchangeServer = Read-Host "Please enter the FQDN of your exchange server (e.g. exch.contoso.com)" - -# Lync info -$credLync = Get-Credential -Message "Enter credentials of a Skype for Business admin (or cancel if they are the same as Exchange)" -if (!$credLync) -{ - $credLync = $credExchange -} -$strLyncFQDN = Read-Host "Please enter the FQDN of your Lync server (e.g. lync.contoso.com) or enter to use [$strExchangeServer]" -if ([System.String]::IsNullOrEmpty($strLyncFQDN)) -{ - $strLyncFQDN = $strExchangeServer -} - - -PrintAction "Connecting to remote sessions. This can occasionally take a while - please do not enter input..." -try -{ - $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $credExchange -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue -} -catch -{ - CleanupAndFail("Failed to connect to exchange. Please check your credentials and try again. If this continues to fail, you may not have permission for remote powershell - if not, please perform the setup manually. Error message: $_") -} -PrintSuccess "Connected to Remote Exchange Shell" - -try -{ - $sessLync = New-PSSession -Credential $credLync -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue -} -catch -{ - CleanupAndFail("Failed to connect to Lync. Please check your credentials and try again. Error message: $_") -} -PrintSuccess "Connected to Lync Server Remote PowerShell" - - -Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue -Import-PSSession $sessLync -AllowClobber -WarningAction SilentlyContinue - -## Create the Exchange mailbox ## -# Note: These exchange commandlets do not always throw their errors as exceptions - -# Because Get-Mailbox will throw an error if the mailbox is not found -$Error.Clear() -PrintAction "Creating a new account..." -try -{ - $mailbox = $null - $mailbox = (New-Mailbox -UserPrincipalName $credNewAccount.UserName -Alias $credNewAccount.UserName.substring(0,$credNewAccount.UserName.indexOf('@')) -room -Name $strDisplayName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true) -} catch { } -ExitIfError "Failed to create a new mailbox on exchange."; -$status["Mailbox Setup"] = "Successfully created a mailbox for the new account" - - -$strEmail = $mailbox.WindowsEmailAddress -PrintSuccess "The following mailbox has been created for this room: $strEmail" - - -## Create or retrieve a policy that will be applied to surface hub devices ## -# The policy disables requiring a device password so that the SurfaceHub does not need to be lockable to use Active Sync -$strPolicy = Read-Host 'Please enter the name for a new Surface Hub ActiveSync policy that will be created and applied to this account. -We will configure that policy to be compatible with Surface Hub devices. -If this script has been used before, please enter the name of the existing policy.' - -$easpolicy = $null -try { - $easpolicy = Get-MobileDeviceMailboxPolicy $strPolicy -} -catch {} - -if ($easpolicy) -{ - if (!$easpolicy.PasswordEnabled -and ($easpolicy.AllowNonProvisionableDevices -eq $null -or $easpolicy.AllowNonProvisionableDevices )) - { - PrintSuccess "An existing policy has been found and will be applied to this account." - } - else - { - PrintError "The policy you provided is incompatible with the surface hub." - $easpolicy = $null - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account because the policy was invalid." - } -} -else -{ - $Error.Clear() - PrintAction "Creating policy..." - $easpolicy = New-MobileDeviceMailboxPolicy -Name $strPolicy -PasswordEnabled $false -AllowNonProvisionableDevices $true - if ($easpolicy) - { - PrintSuccess "A new device policy has been created; you can use this same policy for all future Surface Hub device accounts." - } - else - { - PrintError "Could not create $strPolicy" - } -} - -if ($easpolicy) -{ - # Convert mailbox to user type so we can apply the policy (necessary) - # Sometimes it takes a while for this change to take affect so we have some nasty retry loops - $Error.Clear(); - try - { - Set-Mailbox $credNewAccount.UserName -Type Regular - } catch {} - if ($Error) - { - $Error.Clear() - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account." - } - else - { - # Loop until resource type goes away, up to 5 times - for ($i = 0; $i -lt 5 -And (Get-Mailbox $credNewAccount.UserName).ResourceType; $i++) - { - Start-Sleep -s 5 - } - # If the mailbox is still a Room we cannot apply the policy - if (!((Get-Mailbox $credNewAccount.UserName).ResourceType)) - { - $Error.Clear() - # Set policy for account - Set-CASMailbox $credNewAccount.UserName -ActiveSyncMailboxPolicy $strPolicy - if (!$Error) - { - $status["ActiveSync Policy"] = "Successfully applied $strPolicy to the account" - } - else - { - $status["ActiveSync Policy"] = "Failed to apply the EAS policy to the account." - } - $Error.Clear() - - # Convert back to room mailbox - Set-Mailbox $credNewAccount.UserName -Type Room - # Loop until resource type goes back to room - for ($i = 0; ($i -lt 5) -And ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room"); $i++) - { - Start-Sleep -s 5 - } - if ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room") - { - # A failure to convert the mailbox back to a room is unfortunate but means the mailbox is unusable. - $status["Mailbox Setup"] = "A mailbox was created but we could not set it to a room resource type." - } - else - { - try - { - Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - } catch { } - if ($Error) - { - $status["Mailbox Setup"] = "A room mailbox was created but we could not set its password." - } - $Error.Clear() - } - - } - } -} -PrintSuccess "Account creation completed." - -PrintAction "Setting calendar processing rules..." - -$Error.Clear(); -## Prepare the calendar for automatic meeting responses ## -try { - Set-CalendarProcessing -Identity $credNewAccount.UserName -AutomateProcessing AutoAccept -} catch { } -if ($Error) -{ - $status["Calendar Acceptance"] = "Failed to configure the account to automatically accept/decline meeting requests" -} -else -{ - $status["Calendar Acceptance"] = "Successfully configured the account to automatically accept/decline meeting requests" -} - - -$Error.Clear() -try { - Set-CalendarProcessing -Identity $credNewAccount.UserName -RemovePrivateProperty $false -AddOrganizerToSubject $false -AddAdditionalResponse $true -DeleteSubject $false -DeleteComments $false -AdditionalResponse "This is a Surface Hub room!" -} catch { } -if ($Error) -{ - $status["Calendar Response Configuration"] = "Failed to configure the account's response properties" -} -else -{ - $status["Calendar Response Configuration"] = "Successfully configured the account's response properties" -} - -$Error.Clear() -## Configure the Account to not expire ## -PrintAction "Configuring password not to expire..." -Start-Sleep -s 20 -try -{ - Set-AdUser $mailbox.UserPrincipalName -PasswordNeverExpires $true -Enabled $true -} -catch -{ - -} - -if ($Error) -{ - $status["Password Expiration Policy"] = "Failed to set the password to never expire" -} -else -{ - $status["Password Expiration Policy"] = "Successfully set the password to never expire" -} - -PrintSuccess "Completed Exchange configuration" - -## Setup Skype for Business. This is somewhat optional and if it fails we SfbEnable can be used later ## -PrintAction "Configuring account for Skype for Business." - -# Getting registrar pool -$strRegPool = $strLyncFQDN -$Error.Clear() -$strRegPoolEntry = Read-Host "Enter a Skype for Business Registrar Pool, or leave blank to use [$strRegPool]" -if (![System.String]::IsNullOrEmpty($strRegPoolEntry)) -{ - $strRegPool = $strRegPoolEntry -} - -# Try to SfB-enable the account. Note that it may not work right away as the account needs to propagate to active directory -PrintAction "Enabling Skype for Business..." -Start-Sleep -s 10 -$Error.Clear() -try { - Enable-CsMeetingRoom -Identity $credNewAccount.UserName -RegistrarPool $strRegPool -SipAddressType EmailAddress -} -catch { } - -if ($Error) -{ - $status["Skype for Business Account Setup"] = "Failed to setup the Skype for Business meeting room - you can run EnableSfb.ps1 to try again." - $Error.Clear(); -} -else -{ - $status["Skype for Business Account Setup"] = "Successfully enabled account as a Skype for Business meeting room" -} - -Write-Host - -## Cleanup and print results ## -Cleanup -$strDisplay = $mailbox.DisplayName -$strUsr = $credNewAccount.UserName -PrintAction "Summary for creation of $strUsr ($strDisplay)" -if ($status.Count -gt 0) -{ - ForEach($k in $status.Keys) - { - $v = $status[$k] - $color = "yellow" - if ($v[0] -eq "S") { $color = "green" } - elseif ($v[0] -eq "F") - { - $color = "red" - $v += " Go to https://aka.ms/shubtshoot" - } - - Write-Host -NoNewline $k -ForegroundColor $color - Write-Host -NoNewline ": " - Write-Host $v - } -} -else -{ - PrintError "The account could not be created" -} -``` - -### Create a device account using Office 365 - -Creates an account as described in [Create a device account using Office 365](create-a-device-account-using-office-365.md) - -```PowerShell -# SHAccountCreateO365.ps1 - -$Error.Clear() -$ErrorActionPreference = "Stop" -$status = @{} - -# Cleans up set state such as remote powershell sessions -function Cleanup() -{ - if ($sessExchange) - { - Remove-PSSession $sessExchange - } - if ($sessCS) - { - Remove-PSSession $sessCS - } -} - -function PrintError($strMsg) -{ - Write-Host $strMsg -foregroundcolor Red -} - -function PrintSuccess($strMsg) -{ - Write-Host $strMsg -foregroundcolor Green -} - -function PrintAction($strMsg) -{ - Write-Host $strMsg -ForegroundColor Cyan -} - - -# Cleans up and prints an error message -function CleanupAndFail($strMsg) -{ - if ($strMsg) - { - PrintError($strMsg); - } - Cleanup - exit 1 -} - -# Exits if there is an error set and prints the given message -function ExitIfError($strMsg) -{ - if ($Error) - { - CleanupAndFail($strMsg); - } -} - - -## Check dependencies ## -try { - Import-Module SkypeOnlineConnector - Import-Module MSOnline -} -catch -{ - PrintError "Some dependencies are missing" - PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to https://www.microsoft.com/download/details.aspx?id=39366" - PrintError "Please install the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297" - CleanupAndFail -} - - - -## Collect account data ## -$credNewAccount = (Get-Credential -Message "Enter the desired UPN and password for this new account") -$strUpn = $credNewAccount.UserName -$strDisplayName = Read-Host "Please enter the display name you would like to use for $strUpn" -if (!$credNewAccount -Or [System.String]::IsNullOrEmpty($strDisplayName) -Or [System.String]::IsNullOrEmpty($credNewAccount.UserName) -Or $credNewAccount.Password.Length -le 0) -{ - CleanupAndFail "Please enter all of the requested data to continue." - exit 1 -} - - -## Sign in to remote powershell for exchange and lync online ## -$credAdmin = $null -$credAdmin=Get-Credential -Message "Enter credentials of an Exchange and Skype for Business admin" -if (!$credadmin) -{ - CleanupAndFail "Valid admin credentials are required to create and prepare the account." -} -PrintAction "Connecting to remote sessions. This can occasionally take a while - please do not enter input..." -try -{ - $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $credAdmin -AllowRedirection -Authentication basic -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -WarningAction SilentlyContinue -} -catch -{ - CleanupAndFail "Failed to connect to exchange. Please check your credentials and try again. Error message: $_" -} - -try -{ - $sessCS = New-CsOnlineSession -Credential $credAdmin -} -catch -{ - CleanupAndFail "Failed to connect to Skype for Business Online Datacenter. Please check your credentials and try again. Error message: $_" -} - -try -{ - Connect-MsolService -Credential $credAdmin -} -catch -{ - CleanupAndFail "Failed to connect to Azure Active Directory. Please check your credentials and try again. Error message: $_" -} - -Import-PSSession $sessExchange -AllowClobber -WarningAction SilentlyContinue -Import-PSSession $sessCS -AllowClobber -WarningAction SilentlyContinue - -## Create the Exchange mailbox ## -# Note: These exchange commandlets do not always throw their errors as exceptions - -# Because Get-Mailbox will throw an error if the mailbox is not found -$Error.Clear() -PrintAction "Creating a new account..." -try -{ - $mailbox = $null - $mailbox = (New-Mailbox -MicrosoftOnlineServicesID $credNewAccount.UserName -room -Name $strDisplayName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true) -} catch { } -ExitIfError "Failed to create a new mailbox on exchange."; -$status["Mailbox Setup"] = "Successfully created a mailbox for the new account" - - -$strEmail = $mailbox.WindowsEmailAddress -PrintSuccess "The following mailbox has been created for this room: $strEmail" - - -## Create or retrieve a policy that will be applied to surface hub devices ## -# The policy disables requiring a device password so that the SurfaceHub does not need to be lockable to use Active Sync -$strPolicy = Read-Host 'Please enter the name for a new Surface Hub ActiveSync policy that will be created and applied to this account. -We will configure that policy to be compatible with Surface Hub devices. -If this script has been used before, please enter the name of the existing policy.' - -$easpolicy = $null -try { - $easpolicy = Get-MobileDeviceMailboxPolicy $strPolicy -} -catch {} - -if ($easpolicy) -{ - if (!$easpolicy.PasswordEnabled -and ($easpolicy.AllowNonProvisionableDevices -eq $null -or $easpolicy.AllowNonProvisionableDevices )) - { - PrintSuccess "An existing policy has been found and will be applied to this account." - } - else - { - PrintError "The policy you provided is incompatible with the surface hub." - $easpolicy = $null - $status["ActiveSync Policy"] = "Failed to apply the EAS policy to the account because the policy was invalid." - } -} -else -{ - $Error.Clear() - PrintAction "Creating policy..." - $easpolicy = New-MobileDeviceMailboxPolicy -Name $strPolicy -PasswordEnabled $false -AllowNonProvisionableDevices $true - if ($easpolicy) - { - PrintSuccess "A new device policy has been created; you can use this same policy for all future Surface Hub device accounts." - } - else - { - PrintError "Could not create $strPolicy" - } -} - -if ($easpolicy) -{ - # Convert mailbox to user type so we can apply the policy (necessary) - # Sometimes it takes a while for this change to take affect so we have some nasty retry loops - $Error.Clear(); - try - { - Set-Mailbox $credNewAccount.UserName -Type Regular - } catch {} - if ($Error) - { - $Error.Clear() - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account." - PrintError "Failed to convert to regular account" - } - else - { - # Loop until resource type goes away, up to 5 times - for ($i = 0; $i -lt 5 -And (Get-Mailbox $credNewAccount.UserName).ResourceType; $i++) - { - Start-Sleep -s 5 - } - # If the mailbox is still a Room we cannot apply the policy - if (!((Get-Mailbox $credNewAccount.UserName).ResourceType)) - { - $Error.Clear() - # Set policy for account - Set-CASMailbox $credNewAccount.UserName -ActiveSyncMailboxPolicy $strPolicy - if (!$Error) - { - $status["Device Password Policy"] = "Successfully applied $strPolicy to the account" - } - else - { - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account." - PrintError "Failed to apply policy" - } - $Error.Clear() - - # Convert back to room mailbox - Set-Mailbox $credNewAccount.UserName -Type Room - # Loop until resource type goes back to room - for ($i = 0; ($i -lt 5) -And ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room"); $i++) - { - Start-Sleep -s 5 - } - if ((Get-Mailbox $credNewAccount.UserName).ResourceType -ne "Room") - { - # A failure to convert the mailbox back to a room is unfortunate but means the mailbox is unusable. - $status["Mailbox Setup"] = "A mailbox was created but we could not set it to a room resource type." - } - else - { - Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - if ($Error) - { - $status["Mailbox Setup"] = "A room mailbox was created but we could not set its password." - } - $Error.Clear() - } - - } - } -} -else -{ - $status["Device Password Policy"] = "Failed to apply the EAS policy to the account." - PrintError "Failed to obtain policy" -} -PrintSuccess "Account creation completed." - -PrintAction "Setting calendar processing rules..." - -$Error.Clear(); -## Prepare the calendar for automatic meeting responses ## -try { - Set-CalendarProcessing -Identity $credNewAccount.UserName -AutomateProcessing AutoAccept -} catch { } -if ($Error) -{ - $status["Calendar Acceptance"] = "Failed to configure the account to automatically accept/decline meeting requests" -} -else -{ - $status["Calendar Acceptance"] = "Successfully configured the account to automatically accept/decline meeting requests" -} - - -$Error.Clear() -try { - Set-CalendarProcessing -Identity $credNewAccount.UserName -RemovePrivateProperty $false -AddOrganizerToSubject $false -AddAdditionalResponse $true -DeleteSubject $false -DeleteComments $false -AdditionalResponse "This is a Surface Hub room!" -} catch { } -if ($Error) -{ - $status["Calendar Response Configuration"] = "Failed to configure the account's response properties" -} -else -{ - $status["Calendar Response Configuration"] = "Successfully configured the account's response properties" -} - -$Error.Clear() -## Configure the Account to not expire ## -PrintAction "Configuring password not to expire..." -try -{ - Set-MsolUser -UserPrincipalName $credNewAccount.UserName -PasswordNeverExpires $true -} -catch -{ - -} - -if ($Error) -{ - $status["Password Expiration Policy"] = "Failed to set the password to never expire" -} -else -{ - $status["Password Expiration Policy"] = "Successfully set the password to never expire" -} - -PrintSuccess "Completed Exchange configuration" - -## Setup Skype for Business. This is somewhat optional and if it fails we SfbEnable can be used later ## -PrintAction "Configuring account for Skype for Business." - -# Getting registrar pool -$strRegPool = $null -try { - $strRegPool = (Get-CsTenant).TenantPoolExtension -} -catch {} -$Error.Clear() -if (![System.String]::IsNullOrEmpty($strRegPool)) -{ - $strRegPool = $strRegPool.Substring($strRegPool[0].IndexOf(':') + 1) -} -<# -$strRegPoolEntry = Read-Host "Enter a Skype for Business Registrar Pool, or leave blank to use [$strRegPool]" -if (![System.String]::IsNullOrEmpty($strRegPoolEntry)) -{ - $strRegPool = $strRegPoolEntry -} -#> - -# Try to SfB-enable the account. Note that it may not work right away as the account needs to propagate to active directory -PrintAction "Enabling Skype for Business on $strRegPool" -Start-Sleep -s 10 -$Error.Clear() -try { - Enable-CsMeetingRoom -Identity $credNewAccount.UserName -RegistrarPool $strRegPool -SipAddressType EmailAddress -} -catch { } - -if ($Error) -{ - $status["Skype for Business Account Setup"] = "Failed to setup the Skype for Business meeting room - you can run EnableSfb.ps1 to try again." - $Error.Clear(); -} -else -{ - $status["Skype for Business Account Setup"] = "Successfully enabled account as a Skype for Business meeting room" -} - -## Now we need to assign a Skype for Business license to the account ## -# Assign a license to thes -$countryCode = (Get-CsTenant).CountryAbbreviation -$loc = Read-Host "Please enter the usage location for this device account (where the account is being used). This is a 2-character code that is used to assign licenses (e.g. $countryCode)" -try { - $Error.Clear() - Set-MsolUser -UserPrincipalName $credNewAccount.UserName -UsageLocation $loc -} -catch{} -if ($Error) -{ - $status["Office 365 License"] = "Failed to assign an Office 365 license to the account" - $Error.Clear() -} -else -{ - PrintAction "We found the following licenses available for your tenant:" - $skus = (Get-MsolAccountSku | Where-Object { !$_.AccountSkuID.Contains("INTUNE"); }) - $i = 1 - $skus | % { - Write-Host -NoNewline $i - Write-Host -NoNewLine ": AccountSKUID: " - Write-Host -NoNewLine $_.AccountSkuid - Write-Host -NoNewLine " Active Units: " - Write-Host -NoNewLine $_.ActiveUnits - Write-Host -NoNewLine " Consumed Units: " - Write-Host $_.ConsumedUnits - $i++ - } - $iLicenseIndex = 0; - do - { - $iLicenseIndex = Read-Host 'Choose the number for the SKU you want to pick' - } while ($iLicenseIndex -lt 1 -or $iLicenseIndex -gt $skus.Length) - $strLicenses = $skus[$iLicenseIndex - 1].AccountSkuId - - if (![System.String]::IsNullOrEmpty($strLicenses)) - { - try - { - $Error.Clear() - Set-MsolUserLicense -UserPrincipalName $credNewAccount.UserName -AddLicenses $strLicenses - } - catch - { - - } - if ($Error) - { - $Error.Clear() - $status["Office 365 License"] = "Failed to add a license to the account. Make sure you have remaining licenses." - } - else - { - $status["Office 365 License"] = "Successfully added license to the account" - } - } - else - { - $status["Office 365 License"] = "You opted not to install a license on this account" - } -} - - -Write-Host - -## Cleanup and print results ## -Cleanup -$strDisplay = $mailbox.DisplayName -$strUsr = $credNewAccount.UserName -PrintAction "Summary for creation of $strUsr ($strDisplay)" -if ($status.Count -gt 0) -{ - ForEach($k in $status.Keys) - { - $v = $status[$k] - $color = "yellow" - if ($v[0] -eq "S") { $color = "green" } - elseif ($v[0] -eq "F") - { - $color = "red" - $v += " Go to https://aka.ms/shubtshoot for help" - } - - Write-Host -NoNewline $k -ForegroundColor $color - Write-Host -NoNewline ": " - Write-Host $v - } -} -else -{ - PrintError "The account could not be created" -} -``` - -## Account verification script - - -This script will validate the previously-created device account on a Surface Hub, no matter which method was used to create it. This script is basically pass/fail. If one of the test errors out, it will show a detailed error message, but if all tests pass, the end result will be a summary report. For example, you might see: - -``` syntax -15 tests executed -0 failures -2 warnings -15 passed -``` - -Details of specific settings will not be shown. - -```PowerShell -# SHAccountValidate.ps1 - -$Error.Clear() -$ErrorActionPreference = "Stop" - - -# Cleans up set state such as remote powershell sessions -function Cleanup() -{ - if ($sessEx) - { - Remove-PSSession $sessEx - } - if ($sessSfb) - { - Remove-PSSession $sessSfb - } -} - -function PrintError($strMsg) -{ - Write-Host $strMsg -foregroundcolor "red" -} - -function PrintSuccess($strMsg) -{ - Write-Host $strMsg -foregroundcolor "green" -} - -function PrintAction($strMsg) -{ - Write-Host $strMsg -ForegroundColor Cyan -} - - -# Cleans up and prints an error message -function CleanupAndFail($strMsg) -{ - if ($strMsg) - { - PrintError($strMsg); - } - Cleanup - exit 1 -} - -# Exits if there is an error set and prints the given message -function ExitIfError($strMsg) -{ - if ($Error) - { - CleanupAndFail($strMsg); - } -} - -$strUpn = Read-Host "What is the email address of the account you wish to validate?" -if (!$strUpn.Contains('@')) -{ - CleanupAndFail "$strUpn is not a valid email address" -} -$strExServer = Read-Host "What is your exchange server? (leave blank for online tenants)" -if ($strExServer.Equals("")) -{ - $fExIsOnline = $true -} -else -{ - $fExIsOnline = $false -} -$credEx = Get-Credential -Message "Please provide exchange user credentials" - -$strRegistrarPool = Read-Host ("What is the Skype for Business registrar pool for $strUpn" + "? (leave blank for online tenants)") -$fSfbIsOnline = $strRegistrarPool.Equals("") - -$fHasOnPrem = $true -if ($fSfbIsOnline -and $fExIsOnline) -{ - do - { - $strHasOnPrem = (Read-Host "Do you have an on-premises Active Directory (Y/N) (No if your domain services are hosted entirely online)").ToUpper() - } while ($strHasOnPrem -ne "Y" -and $strHasOnPrem -ne "N") - $fHasOnPrem = $strHasOnPrem.Equals("Y") -} - -$fHasOnline = $false -if ($fSfbIsOnline -or $fExIsOnline) -{ - $fHasOnline = $true -} - -if ($fSfbIsOnline) -{ - try { - Import-Module SkypeOnlineConnector - } - catch - { - CleanupAndFail "To verify Skype for Business in online tenants you need the Lync Online Connector module from https://www.microsoft.com/download/details.aspx?id=39366" - } -} -else -{ - $credSfb = (Get-Credential -Message "Please enter Skype for Business admin credentials") -} - -if ($fHasOnline) -{ - $credSfb = $credEx - try { - Import-Module MSOnline - } - catch - { - CleanupAndFail "To verify accounts in online tenants you need the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297" - } -} - -PrintAction "Connecting to Exchange Powershell Session..." -[System.Management.Automation.Runspaces.AuthenticationMechanism] $authType = [System.Management.Automation.Runspaces.AuthenticationMechanism]::Kerberos -if ($fExIsOnline) -{ - $authType = [System.Management.Automation.Runspaces.AuthenticationMechanism]::Basic -} -try -{ - $sessEx = $null - if ($fExIsOnline) - { - $sessEx = New-PSSession -ConfigurationName microsoft.exchange -Credential $credEx -AllowRedirection -Authentication $authType -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -WarningAction SilentlyContinue - } - else - { - $sessEx = New-PSSession -ConfigurationName microsoft.exchange -Credential $credEx -AllowRedirection -Authentication $authType -ConnectionUri https://$strExServer/powershell -WarningAction SilentlyContinue - } -} -catch -{ -} - -if (!$sessEx) -{ - CleanupAndFail "Connecting to Exchange Powershell failed, please validate your server is accessible and credentials are correct" -} - -PrintSuccess "Connected to Exchange Powershell Session" - -PrintAction "Connecting to Skype for Business Powershell Session..." - -if ($fSfbIsOnline) -{ - $sessSfb = New-CsOnlineSession -Credential $credSfb -} -else -{ - $sessSfb = New-PSSession -Credential $credSfb -ConnectionURI "https://$strRegistrarPool/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue -} - -if (!$sessSfb) -{ - CleanupAndFail "Connecting to Skype for Business Powershell failed, please validate your server is accessible and credentials are correct" -} - -PrintSuccess "Connected to Skype for Business Powershell" - -if ($fHasOnline) -{ - $credMsol = $null - if ($fExIsOnline) - { - $credMsol = $credEx - } - elseif ($fSfbIsOnline) - { - $credMsol = $credSfb - } - else - { - CleanupAndFail "Internal error - could not determine MS Online credentials" - } - try - { - PrintAction "Connecting to Azure Active Directory Services..." - Connect-MsolService -Credential $credMsol - PrintSuccess "Connected to Azure Active Directory Services" - } - catch - { - # This really shouldn't happen unless there is a network error - CleanupAndFail "Failed to connect to MSOnline" - } -} - - -PrintAction "Importing remote sessions into the local session..." -try -{ - $importEx = Import-PSSession $sessEx -AllowClobber -WarningAction SilentlyContinue -DisableNameChecking - $importSfb = Import-PSSession $sessSfb -AllowClobber -WarningAction SilentlyContinue -DisableNameChecking -} -catch -{ -} -if (!$importEx -or !$importSfb) -{ - CleanupAndFail "Import failed" -} -PrintSuccess "Import successful" - - -$mailbox = $null -try -{ - $mailbox = Get-Mailbox -Identity $strUpn -} -catch -{ -} - -if (!$mailbox) -{ - CleanupAndFail "Account exists check failed. Unable to find the mailbox for $strUpn - please make sure the Exchange account exists on $strExServer" -} - -$exchange = $null -if (!$fExIsOnline) -{ - $exchange = Get-ExchangeServer - if (!$exchange -or !$exchange.IsE14OrLater) - { - CleanupAndFail "A compatible exchange server version was not found. Please use at least exchange 2010." - } -} - - -$strAlias = $mailbox.UserPrincipalName -$strDisplayName = $mailbox.DisplayName - -$strLinkedAccount = $strLinkedDomain = $strLinkedUser = $strLinkedServer = $null -$credLinkedDomain = $Null -if (!$fExIsOnline -and ![System.String]::IsNullOrEmpty($mailbox.LinkedMasterAccount) -and !$mailbox.LinkedMasterAccount.EndsWith("\SELF")) -{ - $strLinkedAccount = $mailbox.LinkedMasterAccount - $strLinkedDomain = $strLinkedAccount.substring(0,$strLinkedAccount.IndexOf('\')) - $strLinkedUser = $strLinkedAccount.substring($strLinkedAccount.IndexOf('\') + 1) - $strLinkedServer = Read-Host "What is the domain controller for the $strLinkedDomain" - $credLinkedDomain = (Get-Credential -Message "Please provide credentials for $strLinkedDomain") -} - - - - - - - -Write-Host -Write-Host -Write-Host -PrintAction "Performing verification checks on $strDisplayName..." -$Global:iTotalFailures = 0 -$global:iTotalWarnings = 0 -$Global:iTotalPasses = 0 - -function Validate() -{ - Param( - [string]$Test, - [bool] $Condition, - [string]$FailureMsg, - [switch]$WarningOnly - ) - - Write-Host -NoNewline -ForegroundColor White $Test.PadRight(100,'.') - if ($Condition) - { - Write-Host -ForegroundColor Green "Passed" - $global:iTotalPasses++ - } - else - { - if ($WarningOnly) - { - Write-Host -ForegroundColor Yellow ("Warning: "+$FailureMsg) - $global:iTotalWarnings++ - } - else - { - Write-Host -ForegroundColor Red ("Failed: "+$FailureMsg) - $global:iTotalFailures++ - } - } -} - -## Exchange ## - -Validate -WarningOnly -Test "The mailbox $strUpn is enabled as a room account" -Condition ($mailbox.RoomMailboxAccountEnabled -eq $True) -FailureMsg "RoomMailboxEnabled - without a device account, the Surface Hub will not be able to use various key features." -$calendarProcessing = Get-CalendarProcessing -Identity $strUpn -WarningAction SilentlyContinue -ErrorAction SilentlyContinue -Validate -Test "The mailbox $strUpn is configured to accept meeting requests" -Condition ($calendarProcessing -ne $null -and $calendarProcessing.AutomateProcessing -eq 'AutoAccept') -FailureMsg "AutomateProcessing - the Surface Hub will not be able to send mail or sync its calendar." -Validate -WarningOnly -Test "The mailbox $strUpn will not delete meeting comments" -Condition ($calendarProcessing -ne $null -and !$calendarProcessing.DeleteComments) -FailureMsg "DeleteComments - the Surface Hub may be missing some meeting information on the welcome screen and Skype." -Validate -WarningOnly -Test "The mailbox $strUpn keeps private meetings private" -Condition ($calendarProcessing -ne $null -and !$calendarProcessing.RemovePrivateProperty) -FailureMsg "RemovePrivateProperty - the Surface Hub will make show private meetings." -Validate -Test "The mailbox $strUpn keeps meeting subjects" -Condition ($calendarProcessing -ne $null -and !$calendarProcessing.DeleteSubject) -FailureMsg "DeleteSubject - the Surface Hub will not keep meeting subject information." -Validate -WarningOnly -Test "The mailbox $strUpn does not prepend meeting organizers to subjects" -Condition ($calendarProcessing -ne $null -and !$calendarProcessing.AddOrganizerToSubject) -FailureMsg "AddOrganizerToSubject - the Surface Hub will not display meeting subjects as intended." - -if ($fExIsOnline) -{ - #No online specifics -} -else -{ - #No onprem specifics -} - -#ActiveSync -$casMailbox = Get-Casmailbox $strUpn -WarningAction SilentlyContinue -ErrorAction SilentlyContinue -Validate -Test "The mailbox $strUpn has a mailbox policy" -Condition ($casMailbox -ne $null) -FailureMsg "PasswordEnabled - unable to find policy - the Surface Hub will not be able to send mail or sync its calendar." -if ($casMailbox) -{ - $policy = $null - if ($fExIsOnline -or $exchange.IsE15OrLater) - { - $strPolicy = $casMailbox.ActiveSyncMailboxPolicy - $policy = Get-MobileDeviceMailboxPolicy -Identity $strPolicy -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - Validate -Test "The policy $strPolicy does not require a device password" -Condition ($policy.PasswordEnabled -ne $True) -FailureMsg "PasswordEnabled - policy requires a device password - the Surface Hub will not be able to send mail or sync its calendar." - } - else - { - $strPolicy = $casMailbox.ActiveSyncMailboxPolicy - $policy = Get-ActiveSyncMailboxPolicy -Identity $strPolicy -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - Validate -Test "The policy $strPolicy does not require a device password" -Condition ($policy.PasswordEnabled -ne $True) -FailureMsg "PasswordEnabled - policy requires a device password - the Surface Hub will not be able to send mail or sync its calendar." - } - - if ($policy -ne $null) - { - Validate -Test "The policy $strPolicy allows non-provisionable devices" -Condition ($policy.AllowNonProvisionableDevices -eq $null -or $policy.AllowNonProvisionableDevices -eq $true) -FailureMsg "AllowNonProvisionableDevices - policy will not allow the SurfaceHub to sync" - } - -} - - -# Check the default access level -$orgSettings = Get-ActiveSyncOrganizationSettings -$strDefaultAccessLevel = $orgSettings.DefaultAccessLevel -Validate -Test "ActiveSync devices are allowed" -Condition ($strDefaultAccessLevel -eq 'Allow') -FailureMsg "DeviceType Windows Mail is accessible - devices are not allowed by default - the surface hub will not be able to send mail or sync its calendar." - -# Check if there exists a device access rule that bans the device type Windows Mail -$blockingRules = Get-ActiveSyncDeviceAccessRule | where {($_.AccessLevel -eq 'Block' -or $_.AccessLevel -eq 'Quarantine') -and $_.Characteristic -eq 'DeviceType'-and $_.QueryString -eq 'WindowsMail'} -Validate -Test "Windows mail devices are not blocked or quarantined" -Condition ($blockingRules -eq $null -or $blockingRules.Length -eq 0) -FailureMsg "DeviceType Windows Mail is accessible - devices are blocked or quarantined - the surface hub will not be able to send mail or sync its calendar." - -## End Exchange ## - - - -## SfB ## -$strLyncIdentity = $null -if ($fSfbIsOnline) -{ - $strLyncIdentity = $strUpn -} -else -{ - $strLyncIdentity = $strAlias -} - -$lyncAccount = $null -try { - $lyncAccount = Get-CsMeetingRoom -Identity $strLyncIdentity -WarningAction SilentlyContinue -ErrorAction SilentlyContinue -} catch { - try { - $lyncAccount = Get-CsUser -Identity $strLyncIdentity -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - } catch { } -} -Validate -Test "There is a Lync or Skype for Business account for $strLyncIdentity" -Condition ($lyncAccount -ne $null -and $lyncAccount.Enabled) -FailureMsg "SfB Enabled - there is no Skype for Business account - meetings will not support Skype for Business" -if ($lyncAccount) -{ - Validate -Test "The meeting room has a SIP address" -Condition (![System.String]::IsNullOrEmpty($lyncAccount.SipAddress)) -FailureMsg "SfB Enabled - there is no SIP Address - the device account cannot be used to sign into Skype for Business." -} -## End SFB ## - - -if ($fHasOnline) -{ - #License validation and password expiry - $accountOnline = Get-MsolUser -UserPrincipalName $strUpn -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - Validate -Test "There is an online user account for $strUpn" -Condition ($accountOnline -ne $null) -FailureMsg "Could not find a Microsoft Online account for this user even though some services are online" - if ($accountOnline) - { - Validate -Test "The password for $strUpn will not expire" -Condition ($accountOnline.PasswordNeverExpires -eq $True) -FailureMsg "PasswordNeverExpires - the admin will need to update the device account's password on the Surface Hub when it expires." - if ($fIsSfbOnline -and !$fIsExOnline) - { - $strLicenseFailureMsg = "Has O365 license - The devices will not be able to use Skype for Business services." - } - elseif ($fIsExOnline -and !$fIsSfbOnline) - { - $strLicenseFailureMsg = "Has O365 license - The devices will not be able to use Exchange Online services." - } - else - { - $strLicenseFailureMsg = "Has O365 license - The devices will not be able to use Skype for Business or Exchange Online services." - } - Validate -Test "$strUpn is licensed" -Condition ($accountOnline.IsLicensed -eq $True) -FailureMsg $strLicenseFailureMsg - - Validate -Test "$strUpn is allowed to sign in" -Condition ($accountOnline.BlockCredential -ne $True) -FailureMsg "BlockCredential - This user is not allowed to sign in." - } -} - -#If there is an on-prem component, we can get the authoritative AD user from mailbox -if ($fHasOnPrem) -{ - $accountOnPrem = $null - if ($strLinkedAccount) - { - $accountOnPrem = Get-AdUser $strLinkedUser -server $strLinkedServer -credential $credLinkedDomain -properties PasswordNeverExpires -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - } - else - { - #AD User enabled validation - $accountOnPrem = Get-AdUser $mailbox.UserPrincipalName -properties PasswordNeverExpires -WarningAction SilentlyContinue -ErrorAction SilentlyContinue - } - $strOnPremUpn = $accountOnPrem.UserPrincipalName - Validate -Test "There is a user account for $strOnPremUpn" -Condition ($accountOnprem -ne $null) -FailureMsg "Could not find an Active Directory account for this user" - if ($accountOnPrem) - { - Validate -WarningOnly -Test "The password for $strOnPremUpn will not expire" -Condition ($accountOnprem.PasswordNeverExpires -eq $True) -FailureMsg "PasswordNeverExpires - the admin will need to update the device account's password on the Surface Hub when it expires." - Validate -Test "$strOnPremUpn is enabled" -Condition $accountOnPrem.Enabled -FailureMsg "AccountEnabled - this device account will not sign in" - } -} - - -$global:iTotalTests = ($global:iTotalFailures + $global:iTotalPasses + $global:iTotalWarnings) - -Write-Host -NoNewline $global:iTotalTests "tests executed: " -Write-Host -NoNewline -ForegroundColor Red $Global:iTotalFailures "failures " -Write-Host -NoNewline -ForegroundColor Yellow $Global:iTotalWarnings "warnings " -Write-Host -ForegroundColor Green $Global:iTotalPasses "passes " - -Cleanup -``` - -## Enable Skype for Business - - -This script will enable Skype for Business on a device account. Use it only if Skype for Business wasn't previously enabled during account creation. - -```PowerShell -## This script performs only the Enable for Skype for Business step on an account. It should only be run if this step failed in SHAccountCreate and the other steps have been completed ## -# EnableSfb.ps1 - -$Error.Clear() -$ErrorActionPreference = "Stop" - -# Cleans up set state such as remote powershell sessions -function Cleanup() -{ - if ($sessCS) - { - Remove-PSSession $sessCS - } -} - -function PrintError($strMsg) -{ - Write-Host $strMsg -foregroundcolor "red" -} - -function PrintSuccess($strMsg) -{ - Write-Host $strMsg -foregroundcolor "green" -} - -# Cleans up and prints an error message -function CleanupAndFail($strMsg) -{ - if ($strMsg) - { - PrintError($strMsg); - } - Cleanup - exit 1 -} - -# Exits if there is an error set and prints the given message -function ExitIfError($strMsg) -{ - if ($Error) - { - CleanupAndFail($strMsg); - } -} - -## Check dependencies ## - -$input = Read-Host "Is the account you wish to enable part of an online environment (enter O) or on-premises environment (enter P)" -if ($input -eq "P") -{ - $online = $false -} -elseif ($input -eq "O") -{ - $online = $true -} -else -{ - CleanupAndFail "Invalid selection" -} -if ($online) -{ - try { - Import-Module SkypeOnlineConnector - } - catch - { - PrintError "Some dependencies are missing" - PrintError "Please install the Windows PowerShell Module for Lync Online. For more information go to https://www.microsoft.com/download/details.aspx?id=39366" - PrintError "Please install the Azure Active Directory module for PowerShell from https://go.microsoft.com/fwlink/p/?linkid=236297" - CleanupAndFail - } -} -else -{ - $strRegPool = Read-Host "Enter the FQDN of your Skype for Business Registrar Pool" -} - - -## Collect account data ## -Write-Host "----------- Enter info for the account to enable -----------." -foregroundcolor "magenta" -$strRoomUri=Read-Host 'Please enter the UPN of the account you are enabling (e.g. confroom@surfacehub.microsoft.com)' - -if ([System.String]::IsNullOrEmpty($strRoomUri)) -{ - CleanupAndFail "Please enter all of the requested data to continue." - exit 1 -} -Write-Host "--------------------------------------------------------------." -foregroundcolor "magenta" - - - -## Sign in to remote powershell for exchange and lync online ## -Write-Host "`n------------------ Establishing connection -----------------." -foregroundcolor "magenta" -$credAdmin=Get-Credential -Message "Enter credentials of a Skype for Business admin" -if (!$credadmin) -{ - CleanupAndFail("Valid admin credentials are required to create and prepare the account."); -} -Write-Host "Connecting to remote sessions. This can occasionally take a while - please do not enter input..." - -try -{ - if ($online) - { - $sessCS = New-CsOnlineSession -Credential $credAdmin - } - else - { - $sessCS = New-PSSession -Credential $credAdmin -ConnectionURI "https://$strRegPool/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue - } -} -catch -{ - CleanupAndFail("Failed to connect to Skype for Business server. Please check your credentials and try again. Error message: $_") -} - -Import-PSSession $sessCS -AllowClobber - - -Write-Host "--------------------------------------------------------------." -foregroundcolor "magenta" - -# Getting registrar pool -if ($online) -{ - try { - $strRegPool = $null; - $strRegPool = (Get-CsTenant).RegistrarPool - } catch {} - if ($Error) - { - $Error.Clear(); - $strRegPool = ""; - Write-Host "We failed to lookup your Skype for Business Registrar Pool, but you can still enter it manually" - } - else - { - $strRegPool = $strRegPool[0].Substring($strRegPool[0].IndexOf(':') + 1) - } -} - - -$Error.Clear() -try { - Enable-CsMeetingRoom -Identity $strRoomUri -RegistrarPool $strRegPool -SipAddressType EmailAddress -} -catch {} - -ExitIfError("Failed to setup Skype for Business meeting room") - -PrintSuccess "Successfully enabled $strRoomUri as a Skype for Business meeting room" - -Cleanup -``` - -## Useful cmdlets - - -### Creating a Surface Hub-compatible ActiveSync policy - -For Surface Hub to use Exchange services, a device account configured with a compatible ActiveSync policy must be provisioned on the device. This policy has the following requirements: - -``` syntax -PasswordEnabled == 0 -``` - -In the following cmdlets, `$strPolicy` is the name of the ActiveSync policy, and `$strRoomUpn` is the UPN of the device account you want to apply the policy to. - -Note that in order to run the cmdlets, you need to set up a remote PowerShell session and: - -- Your admin account must be remote-PowerShell-enabled. This allows the admin to use the PowerShell cmdlets that are needed by the script. (This permission can be set using `set-user $admin -RemotePowerShellEnabled $true`) -- Your admin account must have the "Reset Password" role if you plan to run the creation scripts. This allows the admin to change the password of the account, which is needed for the script. The Reset Password Role can be enabled using the Exchange Admin Center. - -Create the policy. - -```PowerShell -# Create new policy with PasswordEnabled == false -New-MobileDeviceMailboxPolicy -Name $strPolicy -PasswordEnabled $false –AllowNonProvisionableDevices $true -``` - -To apply the policy, the mailbox cannot be a room type, so it has to be converted into a user first. - -```PowerShell -# Convert user to regular type -Set-Mailbox $strRoomUpn -Type Regular -# Set policy for account -Set-CASMailbox $strRoomUpn -ActiveSyncMailboxPolicy $strPolicy -``` - -Now the device account just needs to be converted back into a room type. - -```PowerShell -# Convert back to room mailbox -Set-Mailbox $strRoomUpn -Type Room -``` - -### Allowing device IDs for ActiveSync - -To allow an account `$strRoomUpn`, run the following command: - -```PowerShell -Set-CASMailbox –Identity $strRoomUpn –ActiveSyncAllowedDeviceIDs “” -``` - -To find a device's ID, run: - -```PowerShell -Get-ActiveSyncDevice -Mailbox $strRoomUpn -``` - -This retrieves device information for every device that the account has been provisioned on, Including the `DeviceId` property. - -### Auto-accepting and declining meeting requests - -For a device account to automatically accept or decline meeting requests based on its availability, the **AutomateProcessing** attribute must be set to **AutoAccept**. This is recommended as to prevent overlapping meetings. - -```PowerShell -Set-CalendarProcessing $strRoomUpn -AutomateProcessing AutoAccept -``` - -### Accepting external meeting requests - -For a device account to accept external meeting requests (a meeting request from an account not in the same tenant/domain), the device account must be set to allow processing of external meeting requests. Once set, the device account will automatically accept or decline meeting requests from external accounts as well as local accounts. - ->**Note**  If the **AutomateProcessing** attribute is not set to **AutoAccept**, then setting this will have no effect. - -  - -```PowerShell -Set-CalendarProcessing $strRoomUpn -ProcessExternalMeetingMessages $true -``` - -  - -  - - - - - diff --git a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md deleted file mode 100644 index 66dd43f75c..0000000000 --- a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Applying ActiveSync policies to device accounts (Surface Hub) -description: The Microsoft Surface Hub's device account uses ActiveSync to sync mail and calendar. This allows people to join and start scheduled meetings from the Surface Hub, and allows them to email any whiteboards they have made during their meeting. -ms.assetid: FAABBA74-3088-4275-B58E-EC1070F4D110 -ms.reviewer: -manager: laurawi -keywords: Surface Hub, ActiveSync policies -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: medium ---- - -# Applying ActiveSync policies to device accounts (Surface Hub) - - -The Microsoft Surface Hub's device account uses ActiveSync to sync mail and calendar. This allows people to join and start scheduled meetings from the Surface Hub, and allows them to email any whiteboards they have made during their meeting. - -For these features to work, the ActiveSync policies for your organization must be configured as follows: - -- There can't be any global policies that block synchronization of the resource mailbox that's being used by the Surface Hub’s device account. If there is such a blocking policy, you need to whitelist the Surface Hub as an allowed device. -- You must set a mobile device mailbox policy where the **PasswordEnabled** setting is set to False. Other mobile device mailbox policy settings are not compatible with the Surface Hub. - -## Whitelisting the DeviceID - - -Your organization may have a global policy that prevents syncing of device accounts provisioned on Surface Hubs. To configure this property, see [Allowing device IDs for ActiveSync](appendix-a-powershell-scripts-for-surface-hub.md#whitelisting-device-ids-cmdlet). - -## Setting PasswordEnabled - - -The device account must have an ActiveSync policy where the **PasswordEnabled** attribute is set to False or 0. To configure this property, see [Creating a Surface Hub-compatible Microsoft Exchange ActiveSync policy](appendix-a-powershell-scripts-for-surface-hub.md#create-compatible-as-policy). - -  - -  - - - - - diff --git a/devices/surface-hub/breadcrumb/toc.yml b/devices/surface-hub/breadcrumb/toc.yml deleted file mode 100644 index d846a15189..0000000000 --- a/devices/surface-hub/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Surface Hub - tocHref: /surface-hub - topicHref: /surface-hub/index \ No newline at end of file diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md deleted file mode 100644 index 77ce204725..0000000000 --- a/devices/surface-hub/change-history-surface-hub.md +++ /dev/null @@ -1,195 +0,0 @@ ---- -title: Change history for Surface Hub -ms.reviewer: -manager: laurawi -description: This topic lists new and updated topics for Surface Hub. -keywords: change history -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Change history for Surface Hub - -This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md). - -## April 2019 - -New or changed topic | Description ---- | --- -[Surface Hub Site Readiness Guide](surface-hub-site-readiness-guide.md) | New; previously available for download only -[Technical information for 55” Microsoft Surface Hub](surface-hub-technical-55.md) | New; previously available for download and on [Surface Hub Tech Spec](https://support.microsoft.com/help/4483539/surface-hub-tech-spec) -[Technical information for 84” Microsoft Surface Hub](surface-hub-technical-84.md) | New; previously available for download and on [Surface Hub Tech Spec](https://support.microsoft.com/help/4483539/surface-hub-tech-spec) -[Surface Hub SSD replacement](surface-hub-ssd-replacement.md) | New; previously available for download only -[Implement Quality of Service on Surface Hub](surface-hub-qos.md) | New - -## July 2018 - -New or changed topic | Description ---- | --- -[Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Added information and links for new Microsoft Whiteboard app release. - -## June 2018 - -New or changed topic | Description ---- | --- -[On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md) and [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | Added (prerelease) instructions for disabling anonymous email and IM. - -## May 2018 - -New or changed topic | Description ---- | --- -[Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) | New - -## April 2018 - -New or changed topic | Description ---- | --- -[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions for Skype for Business Hybrid. - - -## March 2018 - -New or changed topic | Description ---- | --- -[Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Added section for account verification and testing, with link to new Surface Hub Hardware Diagnostic app. - -## February 2018 - -New or changed topic | Description ---- | --- -[Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Updated instructions for custom settings using Microsoft Intune. -[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions and scripts. -| [Online deployment](online-deployment-surface-hub-device-accounts.md) | Updated instructions and scripts. - -## January 2018 - -New or changed topic | Description ---- | --- -[Configure Surface Hub Start menu](surface-hub-start-menu.md) | New -[PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) | Added prerequisites for running the scripts - -## November 2017 - -New or changed topic | Description ---- | --- -[Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | New -[Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Added settings for 802.1x wired authentication. - -## October 2017 - -New or changed topic | Description | ---- | --- -[Install apps on your Microsoft Surface Hub](install-apps-on-surface-hub.md) | Updated instructions to use Windows Team device family -[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated the instructions for Exchange on-premises -[Create a device account using UI](create-a-device-account-using-office-365.md) | Updated the instructions -[Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | Clarified user sign-in on Surface Hub -[Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Removed **How to control and manage Whiteboard to Whiteboard collaboration** due to issues with the EnterpriseModernAppmanagement CSP losing state during End Session. -| [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Removed settings for managing Whiteboard collaboration. | -[Top support solutions for Surface Hub](support-solutions-surface-hub.md) | Added link to Surface Hub warranty information - - -## September 2017 - -New or changed topic | Description ---- | --- -[Top support solutions for Surface Hub](support-solutions-surface-hub.md) | New -[PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) | Updated account creation scripts - -## August 2017 - - -| New or changed topic | Description | -| --- | --- | -[Accessibility](accessibility-surface-hub.md) | Added information about Narrator -[Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) | New - - - - - -## July 2017 - -| New or changed topic | Description | -| --- | --- | -| [Windows updates](manage-windows-updates-for-surface-hub.md) | Changed deferral recommendations for Windows Updates | -| [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Added Whiteboard URLs to prerequisites | -| [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md#skype-for-business-online) | Updated the Skype for Business Online requirements | -| [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) | Added that Surface Hub supports 802.1X using PEAP-MSCHAPv2 | - -## June 2017 - -| New or changed topic | Description | -| --- | --- | -| [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | New | -| [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Added settings for managing Whiteboard collaboration | - -## RELEASE: Windows 10, version 1703 - -The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following new topics have been added: - -- [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) - ->[Looking for the Surface Hub admin guide for Windows 10, version 1607?](https://download.microsoft.com/download/7/2/5/7252051B-7E97-4781-B5DF-58D4B1A4BB88/surface-hub-admin-guide-1607.pdf) - - -## May 2017 - -| New or changed topic | Description | -| --- | --- | -| [Online or hybrid deployment using Skype Hybrid Voice environment](skype-hybrid-voice.md) | New | - - -## February 2017 - -| New or changed topic | Description | -| --- | --- | -| [Useful downloads for Surface Hub administrators](surface-hub-downloads.md) | New | - -## January 2017 - -| New or changed topic | Description | -| --- | --- | -| [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) | New | -| [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | New | -| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added graphics cards verified to work with 84" Surface Hubs and added information about the lengths of cables. | -| [Online deployment](online-deployment-surface-hub-device-accounts.md) | Updated procedures for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. | - -## December 2016 - -| New or changed topic | Description| -| --- | --- | -| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added information about Bluetooth accessories. | -| [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) | Updated example procedures to include screenshots. | - -## November 2016 - -| New or changed topic | Description | -| --- | --- | -| [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | New | -| [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) | Added information for Video Out and a table to help select a display method. | -| [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Added instructions for creating accounts for Surface Hub in a Skype for Business hybrid environment. | - - - -## RELEASE: Windows Anniversary Update for Surface Hub (Windows 10, version 1607) -The topics in this library have been updated for Windows 10, version 1607 (also known as Windows Anniversary Update for Surface Hub). These topics had significant updates for this release: -- [Windows Updates (Surface Hub)](manage-windows-updates-for-surface-hub.md) -- [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) -- [Monitor your Microsoft Surface Hub](monitor-surface-hub.md) -- [Create provisioning packages (Surface Hub)](provisioning-packages-for-certificates-surface-hub.md) -- [Install apps on your Microsoft Surface Hub](install-apps-on-surface-hub.md) -- [Device reset (Surface Hub)](device-reset-surface-hub.md) - -## October 2016 -| New or changed topic | Description | -| --- | --- | -| [Admin group management (Surface Hub)](admin-group-management-for-surface-hub.md) |Add note about automatic enrollment, and update table. | -| [Password management (Surface Hub)](password-management-for-surface-hub-device-accounts.md) | Updates to content. | -| [Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Reorganize and streamline guidance on creating a device account. | -| [Introduction to Surface Hub](intro-to-surface-hub.md) | Move Surface Hub dependencies table to [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md). | -| [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) | Add dependency table and reorganize topic. | -| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | New topic. | diff --git a/devices/surface-hub/change-surface-hub-device-account.md b/devices/surface-hub/change-surface-hub-device-account.md deleted file mode 100644 index d20e57a184..0000000000 --- a/devices/surface-hub/change-surface-hub-device-account.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Change the Microsoft Surface Hub device account -description: You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned. -ms.assetid: AFC43043-3319-44BC-9310-29B1F375E672 -ms.reviewer: -manager: laurawi -keywords: change device account, change properties, Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Change the Microsoft Surface Hub device account - - -You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned. - -## Details - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ValueDescription

User Principal Name

The user principal name (UPN) of the device account.

Password

The corresponding password of the device account.

Domain

The domain that the device account belongs to. This field does not need to be provided for Office 365 accounts.

User name

The user name of the device account. This field does not need to be provided for Office 365 accounts.

Session Initiation Protocol (SIP) address

The SIP address of the device account.

Microsoft Exchange server

This is the Exchange server of the device account. The device account’s username and password must be able to authenticate to the specified Exchange server.

Enable Exchange services

When checked, all Exchange services will be enabled (for example, calendar on the welcome screen, emailing whiteboards). When not checked, all Exchange services will be disabled, and the Exchange server does not need to be provided.

- -  - -## What happens? - - -The UPN and password are used to validate the account in AD or Azure AD. If the validation fails, you may need to provide the domain and user name. - -Using the credentials provided, we will try to discover the SIP address. If a SIP address can't be found, then Skype for Business will use the UPN as the SIP address. If this is not the SIP address for the account, you will need to provide the SIP address. - -The Exchange server address will need to be provided if the device can't find a server associated with the login credentials. Microsoft Surface Hub will use the Exchange server to talk to ActiveSync, which enables several key features on the device. - -## Related topics - - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface-hub/connect-and-display-with-surface-hub.md b/devices/surface-hub/connect-and-display-with-surface-hub.md deleted file mode 100644 index d5f39c55db..0000000000 --- a/devices/surface-hub/connect-and-display-with-surface-hub.md +++ /dev/null @@ -1,494 +0,0 @@ ---- -title: Connect other devices and display with Surface Hub -description: You can connect other device to your Surface Hub to display content. -ms.assetid: 8BB80FA3-D364-4A90-B72B-65F0F0FC1F0D -ms.reviewer: -manager: laurawi -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Connect other devices and display with Surface Hub - - -You can connect other devices to your Microsoft Surface Hub to display content. This topic describes the Guest Mode, Replacement PC Mode, and Video Out functionality available through wired connections, and also lists accessories that you can connect to Surface Hub using [Bluetooth](#bluetooth-accessories). - ->[!NOTE] ->Surface Hub will use the video input that you select until a new connection is made, the existing connection is disrupted, or the Connect App is closed. - -## Which method should I choose? - -When connecting external devices and displays to a Surface Hub, there are several available options. The method you use will depend upon your scenario and needs. - -| When you want to: | Use this method: | -| --- | --- | -| Mirror the Surface Hub's display on another device. | [Video Out](#video-out) | -| Present another device's display on the Surface Hub screen and interact with both the device's content and the built-in Surface Hub experience. | [Guest Mode](#guest-mode) | -| Power the Surface Hub from an external Windows 10 PC, turning off the embedded computer of the Surface Hub. Cameras, microphones, speakers, and other peripherals, are sent to the external PC, in addition to pen and touch. | [Replacement PC Mode](#replacement-pc-mode) | - - -## Guest Mode - - -Guest Mode uses a wired connection, so people can display content from their devices to the Surface Hub. If the source device is Windows-based, that device can also provide Touchback and Inkback. Surface Hub's internal PC takes video and audio from the connected device and presents them on the Surface Hub. If Surface Hub encounters a High-Bandwidth Digital Content Protection (HDCP) signal, the source will be displayed as a black image. To display your content without violating HDCP requirements, use the keypad on the right side of the Surface Hub to directly choose the external source. - ->[!NOTE] ->When an HDCP source is connected, use the side keypad to change source inputs. - -### Ports - -Use these ports on the Surface Hub for Guest Mode. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
InterfaceTypeDescriptionCapabilities

Display Port 1.1a

Video input

Guest input #1

    -
  • Support simultaneous guest input display with guest input #2 and guest input #3 (one full resolution, two thumbnail).

  • -
  • HDCP compliant in bypass mode

  • -
  • Touchback enabled

  • -

HDMI 1.4

Video input

Guest input #2

    -
  • Support simultaneous guest input display with guest input #1 and guest input #3 (one full resolution, two thumbnail).

  • -
  • HDCP compliant in bypass mode

  • -
  • Touchback enabled

  • -

VGA

Video input

Guest input #3

    -
  • Support simultaneous guest input display with guest input #1 and guest input #2 (one full resolution, two thumbnail).

  • -
  • HDCP compliant in bypass mode

  • -
  • Touchback enabled

  • -

3.5 mm jack

Audio input

Analog audio input

    -
  • Ingest into Surface Hub PC, usually with the VGA video input.

  • -

USB 2.0, type B

USB out

Touchback

    -
  • Provides access to the HID input devices mouse, touch, keyboard, and stylus back to the guest PC.

  • -
- - - -### Port locations - -These are the port connections used for Guest Mode on the 55" and 84" Surface Hubs. - -![image showing guest ports on 55" surface hub.](images/sh-55-guest-ports.png) - -Wired port connections on 55" Surface Hub - -![image showing guest ports on 84" surface hub.](images/sh-84-guest-ports.png) - -Wired port connections on 84" Surface Hub - -### Port enumeration - -When a Surface hub is connected to a guest computer with the wired connect USB port, a number of USB devices are discovered and configured. These peripheral devices are created for Touchback and Inkback. The peripheral devices can be viewed in Device Manager. Device Manager will show duplicate names for some devices. - -**Human interface devices** - -- HID-compliant consumer control device - -- HID-compliant pen - -- HID-compliant pen (duplicate item) - -- HID-compliant pen (duplicate item) - -- HID-compliant touch screen - -- USB Input Device - -- USB Input Device (duplicate item) - -**Keyboards** - -- Standard PS/2 keyboard - -**Mice and other pointing devices** - -- HID-compliant mouse - -**Universal serial bus controllers** - -- Generic USB hub - -- USB composite device - -### Guest Mode connectivity - -Your choice of video cable will be determined by what is available from your source input. The Surface Hub has three choices of video input: DisplayPort, HDMI, and VGA. See the following chart for available resolutions. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Signal TypeResolutionFrame rateHDMI - RGBDisplayPortVGA

PC

640 x 480

59.94/60

X

X

X

PC

720 x 480

59.94/60

X

X

PC

1024 x 768

60

X

X

X

HDTV

720p

59.94/60

X

X

X

HDTV

1080p

59.94/60

X

X

X

- - - -Source audio is provided by DisplayPort and HDMI cables. If you must use VGA, Surface Hub has an audio input port that uses a 3.5 mm plug. Surface Hub also uses a USB cable that provides Touchback and Inkback from the Surface Hub to compatible Windows 10 devices. The USB cable can be used with any video input that is already connected with a cable. - -Someone using Guest Mode to connect a PC would use one of these options: - -**DisplayPort** -- DisplayPort cable and USB 2.0 cable - -**HDMI** -- HDMI cable and USB 2.0 cable - -**VGA** -- VGA cable, 3.5 mm audio cable, and USB 2.0 cable - -If the computer you are using for Guest Mode is not compatible with Touchback and Inkback, then you won't need the USB cable. - -## Replacement PC Mode - - -In Replacement PC Mode, the embedded computer of the Surface Hub is turned off and an external PC is connected to the Surface Hub. Connections to replacement PC ports give access to key peripherals on the Surface Hub, including the screen, pen, and touch features. This does mean that your Surface Hub won’t have the benefit of the Windows Team experience, but you will have the flexibility offered by providing and managing your own Windows computer. - -### Software requirements - -You can run Surface Hub in Replacement PC Mode with 64-bit versions of Windows 10 Home, Windows 10 Pro, and Windows 10 Enterprise. You can download the [Surface Hub Replacement PC driver package](https://www.microsoft.com/download/details.aspx?id=52210) from the Microsoft Download Center. We recommend that you install these drivers on any computer you plan to use as a replacement PC. - -### Hardware requirements - -Surface Hub is compatible with a range of hardware. Choose the processor and memory confirmation for your replacement PC so that it supports the programs you'll be using. Your replacement PC hardware needs to support 64-bit versions of Windows 10. - -### Graphics adapter - -In Replacement PC Mode, Surface Hub supports any graphics adapter that can produce a DisplayPort signal. You'll improve your experience with a graphics adapter that can match Surface Hub's resolution and refresh rate. For example, the best and recommended replacement PC experience on the Surface Hub is with a 120Hz video signal. - -**55" Surface Hubs** - For best experience, use a graphics card capable of 1080p resolution at 120Hz. - -**84" Surface Hubs** - For best experience, use a graphics card capable of outputting four DisplayPort 1.2 streams to produce 2160p at 120Hz (3840 x 2160 at 120Hz vertical refresh). We've verified that this works with the NVIDIA Quadro K2200, NVIDIA Quadro K4200, NVIDIA Quadro M6000, AMD FirePro W5100, AMD FirePro W7100, and AMD FirePro W9100. These are not the only graphics cards - others are available from other vendors. - -Check directly with graphics card vendors for the latest drivers. - - ---- - - - - - - - - - - - - - - - - - - - - -
Graphics vendorDriver download page

NVIDIA

http://nvidia.com/Download/index.aspx

AMD

http://support.amd.com/en-us/download

Intel

https://downloadcenter.intel.com/

- - - -### Ports - -Replacement PC ports on 55" Surface Hub - -![image showing replacement pc ports on 55" surface hub.](images/sh-55-rpc-ports.png) - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
DescriptionTypeInterfaceDetails

PC video

Video input

DP 1.2

    -
  • Full screen display of 1080p at 120 Hz, plus audio

  • -
  • HDCP compliant

  • -

Internal peripherals

USB output

USB 2.0 type B

    -
  • Touch

  • -
  • Pen

  • -
  • Speakers

  • -
  • Microphone

  • -
  • Cameras

  • -
  • NFC sensor

  • -
  • Ambient light sensor

  • -
  • Passive infrared sensor

  • -

USB hub

USB output

USB 2.0 type B

    -
  • Underneath USB ports

  • -
- - - -Replacement PC ports on 84" Surface Hub - -![image showing replacement pc ports on 84" surface hub.](images/sh-84-rpc-ports.png) - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
DescriptionTypeInterfaceDetails

PC video

Video input

DP 1.2 (2x)

    -
  • Full screen display of 2160p at 120 Hz, plus audio

  • -
  • HDCP compliant

  • -

Internal peripherals

USB output

USB 2.0 type B

    -
  • Touch

  • -
  • Pen

  • -
  • Speakers

  • -
  • Microphone

  • -
  • Cameras

  • -
  • NFC sensor

  • -
  • Ambient light sensor

  • -
  • Passive infrared sensor

  • -

USB hub

USB output

USB 2.0 type B

    -
  • Underneath USB ports

  • -
- - - -### Replacement PC setup instructions - -**To use Replacement PC Mode** - -1. Download and install the [Surface Hub Replacement PC driver package](https://www.microsoft.com/download/details.aspx?id=52210) on the replacement PC. - - >[!NOTE] - >We recommend that you set sleep or hibernation on the replacement PC so the Surface Hub will turn off the display when it isn't being used. - -2. Turn off the Surface Hub using the power switch next to the power cable. - -3. Connect the cables from the Surface Hub's replacement PC ports to the replacement PC. These ports are usually covered by a removable plastic cover. - - 55" Surface Hub -- connect one DisplayPort cable, and two USB cables. - - 84" Surface Hub -- connect two DisplayPort cables, and two USB cables. - -4. Toggle the Mode switch to **Replacement PC**. The Mode switch is next to the Replacement PC ports. - -5. Turn on the Surface Hub using the power switch next to the power cable. - -6. Press the power button on the right side of the Surface Hub. - -You can switch the Surface Hub to use the internal PC. - -**To switch back to internal PC** - -1. Turn off the Surface Hub using the power switch next to the power cable. - -2. Toggle the Mode switch to Internal PC. The Mode switch is next to the Replacement PC ports. - -3. Turn on the Surface Hub using the power switch next to the power cable. - - -## Video Out - -The Surface Hub includes a Video Out port for mirroring visual content from the Surface Hub to another display. - -### Ports - -Video Out port on the 55" Surface Hub - -![Illustration of video output port](images/video-out-55.png) - -Video Out port on the 84" Surface Hub - -![Illustration of video output port](images/video-out-84.png) - - - - - - - - - - - - - - - - - - -
DescriptionTypeInterfaceCapabilities

Video Output Mirror

Video Output

Video Output

    -
  • Supports connection to a standard DisplayPort monitor (only supports an x4 Link displaying 1080p60 resolution at 24bpp)

  • -
  • Supports use with HDMI monitors (supporting 1080p60) by using a DisplayPort-to-HDMI adaptor

  • -
- -## Cables - -Both the 55” and 84” Surface Hub devices have been tested to work with Certified DisplayPort and HDMI cables. While vendors do sell longer cables that may work with the Surface Hub, only those cables that have been certified by testing labs are certain to work with the Hub. For example, DisplayPort cables are certified only up to 3 meters, however many vendors sell cables that are 3 times that length. If a long cable is necessary, we strongly suggest using HDMI. HDMI has many cost-effective solutions for long-haul cables, including the use of repeaters. Nearly every DisplayPort source will automatically switch to HDMI signaling if a HDMI sink is detected. - - -## Bluetooth accessories - -You can connect the following accessories to Surface Hub using Bluetooth: - -- Mice -- Keyboards -- Headsets -- Speakers - ->[!NOTE] ->After you connect a Bluetooth headset or speaker, you might need to change the [default microphone and speaker settings](local-management-surface-hub-settings.md). diff --git a/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md b/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md deleted file mode 100644 index 439d3c68d7..0000000000 --- a/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: What to do if the Connect app in Surface Hub exits unexpectedly -description: Describes how to resolve an issue where the Connect app in Surface Hub exits to the Welcome screen after cycling through inputs. -ms.assetid: 9576f4e4-d936-4235-8a03-d8a6fe9e8fec -keywords: surface, hub, connect, input, displayport -ms.prod: surface-hub -ms.sitesec: library -author: todmccoy -ms.author: v-todmc -ms.topic: article -ms.localizationpriority: medium ---- - -# What to do if the Connect app in Surface Hub exits unexpectedly - -At times, a wired Connect session that is started from the Welcome screen by connecting a DisplayPort input will exit back to the Welcome screen after using the side keypad or the source button to cycle through all source inputs. - -This is an issue in the Connect app and its default full-screen state. By changing the size of the app, or by selecting a DisplayPort input thumbnail in the Connect app, you can prevent input cycling from affecting the app. - -The way to resolve this issue is to first launch the Connect app from the Welcome screen, and THEN connect a DisplayPort input. If the input is already connected, manually select the thumbnail. \ No newline at end of file diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md deleted file mode 100644 index 29f9557045..0000000000 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ /dev/null @@ -1,387 +0,0 @@ ---- -title: Create a device account using UI (Surface Hub) -description: If you prefer to use a graphical user interface, you can create a device account for your Microsoft Surface Hub with either the Office 365 UI or the Exchange Admin Center. -ms.assetid: D11BCDC4-DABA-4B9A-9ECB-58E02CC8218C -ms.reviewer: -manager: laurawi -keywords: create device account, Office 365 UI, Exchange Admin center, Microsoft 365 admin center, Skype for Business, mobile device mailbox policy -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 05/04/2018 -ms.localizationpriority: medium ---- - -# Create a device account using UI (Surface Hub) - - -If you prefer to use a graphical user interface, you can create a device account for your Microsoft Surface Hub with either the [Office 365 UI](#create-device-acct-o365) or the [Exchange Admin Center](#create-device-acct-eac). - -## Create a device account using Office 365 - - -1. [Create the account in the Microsoft 365 Admin Center](#create-device-acct-o365-admin-ctr). -2. [Create a mobile device mailbox (ActiveSync) policy from the Microsoft Exchange Admin Center](#create-device-acct-o365-mbx-policy). -3. [Use PowerShell to complete device account creation](#create-device-acct-o365-complete-acct). -4. [Use PowerShell to configure Exchange properties of the account](#create-device-acct-o365-configure-exch-prop). -5. [Enable the account with Skype for Business](#create-device-acct-o365-skype-for-business). - -### Create the account in the admin center - -1. Sign in to Office 365 by visiting https://portal.office.com -2. Provide the admin credentials for your Office 365 tenant. This will take you to your Microsoft 365 Admin Center. - - ![Microsoft 365 admin center.](images/setupdeviceaccto365-02.png) - -3. In the admin center, navigate to **Resources** in the left panel, and then click **Rooms & equipment**. - - ![Rooms & equipment option in admin center](images/room-equipment.png) - -4. Click **Add** to create a new Room account. Enter a display name and email address for the account, and then click **Add**. - - ![Create new room account window](images/room-add.png) - -5. Select the Room account you just created in the Active Users list. In the right panel, you can see the account properties and several optional actions. Click **Reset password** to change the password, and unselect **Make this user change their password when they first sign in**, because it is not possible to change the password from the Surface Hub sign-in flow. - -6. In the **Assigned license** section, click **Edit**, and then click the dropdown arrow next to the appropriate license to expand the details. Select a user location, and in the list of licenses, toggle on **Skype for Business Online (Plan 2)**, and then click **Save**. The license may vary depending on your organization (for example, you might have Plan 2 or Plan 3). - -### Create a mobile device mailbox (ActiveSync) policy from the Exchange Admin Center - -1. In the admin center’s left panel, click **ADMIN**, and then click **Exchange**. - - ![admin center, showing exchange active users.](images/setupdeviceaccto365-08.png) - -2. This will open another tab on your browser to take you to the Exchange Admin Center, where you can create and set the Mailbox Setting for Surface Hub. - - ![Exchange admin center.](images/setupdeviceaccto365-09.png) - -3. To create a Mobile Device Mailbox Policy, click **Mobile** from the left panel and then click **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts. - - ![Exchange admin center - creating a mobile device mailbox policy.](images/setupdeviceaccto365-10.png) - -4. To create a New Surface Hub mobile device mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name, provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). Make sure the policy does not require a password for the devices assigned to, so make sure **Require a Password** remains unchecked, then click **Save**. - - ![Image showing new mobile device policy.](images/setupdeviceaccto365-11.png) - -5. After you have created the new mobile device mailbox policy, go back to the **Exchange Admin Center** and you will see the new policy listed. - - ![Image with new mobile device mailbox policy in Exchange admin center.](images/setupdeviceaccto365-12.png) - - - -### Use PowerShell to complete device account creation - -From here on, you'll need to finish the account creation process using PowerShell to set up some configuration. - -In order to run cmdlets used by these PowerShell scripts, the following must be installed for the admin PowerShell console: - -- [Microsoft Online Services Sign-In Assistant for IT Professionals RTW](https://www.microsoft.com/download/details.aspx?id=41950) -- [Windows Azure Active Directory Module for Windows PowerShell](https://www.microsoft.com/web/handlers/webpi.ashx/getinstaller/WindowsAzurePowershellGet.3f.3f.3fnew.appids) -- [Skype for Business Online, Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366) - -Install the following module in Powershell -``` syntax - install-module AzureAD - Install-module MsOnline -``` - -### Connecting to online services - -1. Run Windows PowerShell as Administrator. - - ![Image showing how to start Windows PowerShell and run as administrator.](images/setupdeviceaccto365-17.png) - -2. Create a Credentials object, then create a new session that connects to Skype for Business Online, and provide the global tenant administrator account, then click **OK**. - - ![Image for Windows PowerShell credential request.](images/setupdeviceaccto365-18.png) - -3. To connect to Microsoft Online Services, run: - - ``` syntax - Connect-MsolService -Credential $Cred - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-19.png) - -4. Now to connect to Skype for Business Online Services, run: - - ``` syntax - $sfbsession = New-CsOnlineSession -Credential $cred - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-20.png) - -5. Finally, to connect to Exchange Online Services, run: - - ``` syntax - $exchangeSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "https://outlook.office365.com/powershell-liveid/" -Credential $cred -Authentication "Basic" –AllowRedirection - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-21.png) - -6. Now you have to import the Skype for Business Online Session and the Exchange Online session you have just created, which will import the Exchange and Skype Commands so you can use them locally. - - ``` syntax - Import-PSSession $exchangesession -AllowClobber -WarningAction SilentlyContinue - Import-PSSession $sfbsession -AllowClobber -WarningAction SilentlyContinue - ``` - - Note that this could take a while to complete. - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-22.png) - -7. Once you’re connected to the online services you need to run a few more cmdlets to configure this account as a Surface Hub device account. - -### Use PowerShell to configure Exchange properties of the account - -Now that you're connected to the online services, you can finish setting up the device account. You'll use the device account email address to: - -- Change the mailbox type from regular to room. -- Set the password and enable the room mailbox account -- Change various Exchange properties -- Set the user account password to never expire. - -1. You’ll need to enter the account’s mail address and create a variable with that value: - - ```powershell - $mailbox = (Get-Mailbox ) - ``` - - To store the value get it from the mailbox: - - ```powershell - $strEmail = $mailbox.WindowsEmailAddress - ``` - - Print the value: - - ```powershell - $strEmail - ``` - - You will see the correct email address. - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-23.png) - -2. Run the following cmdlet: - - ```powershell - Set-CASMailbox $strEmail -ActiveSyncMailboxPolicy "SurfaceHubDeviceMobilePolicy" - ``` - -4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ``` syntax - Set-CalendarProcessing -Identity $strEmail -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity $strEmail -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-26.png) - -5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. - - ``` syntax - Set-MsolUser -UserPrincipalName $strEmail -PasswordNeverExpires $True - ``` - -### Enable the account with Skype for Business - -Enable the device account with Skype for Business. - -In order to enable Skype for Business, your environment will need to meet the following prerequisites: - -- You'll need to have Skype for Business Online Standalone Plan 2 or higher in your O365 plan. The plan needs to support conferencing capability. -- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Skype for Business Online Standalone Plan 3. -- Your tenant users must have Exchange mailboxes. -- Your Surface Hub account does require a Skype for Business Online Standalone Plan 2 or Skype for Business Online Standalone Plan 3 license, but it does not require an Exchange Online license. - -1. Start by creating a remote PowerShell session from a PC. - - ```PowerShell - Import-Module SkypeOnlineConnector - $cssess=New-CsOnlineSession -Credential $cred - Import-PSSession $cssess -AllowClobber - ``` - -2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress - ``` - - If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - - ```PowerShell - Get-CsOnlineUser -Identity ‘alice@contoso.microsoft.com’| fl *registrarpool* - ``` - -## Create a device account using the Exchange Admin Center - ->[!NOTE] ->This method will only work if you are syncing from an on-premises Active Directory. - -You can use the Exchange Admin Center to create a device account: - -1. [Create an account and mailbox with the Exchange Admin Center](#create-device-acct-exch-admin-ctr). -2. [Create a mobile device mailbox policy from the Exchange Admin Center](#create-device-acct-exch-mbx-policy). -3. [Use PowerShell to configure the account](#create-device-acct-exch-powershell-conf). -4. [Enable the account with Skype for Business](#create-device-acct-exch-skype-for-business). - -### Create an account and mailbox with the Exchange Admin Center - -1. Sign in to your Exchange Admin Center using Exchange admin credentials. -2. Once you are at the Exchange Admin Center (EAC), navigate to **Recipients** in the left panel. - - ![Image showing mailboxes in Exchange admin center.](images/setupdeviceacctexch-01.png) - -3. On the controls above the list of mailboxess, choose **+** to create a new one, and provide a **Display name**, **Name**, and **User logon name**, and then click **Save**. - - ![Image showing creating a new mailbox.](images/setupdeviceacctexch-02.png) - -### Create a mobile device mailbox policy from the Exchange Admin Center - ->[!NOTE] ->If you want to create and assign a policy to the account you created, and are using Exchange 2010, look up the corresponding information regarding policy creation and policy assignment when using the EMC (Exchange management console). - - - -1. Go to the Exchange Admin Center. - - ![Image showing Exchange admin center.](images/setupdeviceacctexch-03.png) - -2. To create a mobile device mailbox policy, click **Mobile** from the left panel, then **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts. - - ![Image showing using Exchange admin center to create a mobile device mailbox policy.](images/setupdeviceacctexch-05.png) - -3. To create a new mobile device account mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). The policy must not be password-protected, so make sure **Require a Password** remains unchecked, then click **Save**. - - ![Image showing new mobile device mailbox policy.](images/setupdeviceacctexch-06.png) - -4. After you have created the new mobile device mailbox policy, go back to the Exchange Admin Center and you will see the new policy listed. - - ![Image showing new mobile device mailbox policy in Exchange admin center.](images/setupdeviceacctexch-07.png) - -5. To apply the ActiveSync policy without using PowerShell, you can do the following: - - - In the EAC, click **Recipients** > **Mailboxes** and select a mailbox. - - ![image showing exchange admin center.](images/setupdeviceacctexch-08.png) - - - In the **Details** pane, scroll to **Phone and Voice Features** and click **View details** to display the **Mobile Device Details** screen. - - ![image showing mailbox details.](images/setupdeviceacctexch-09.png) - - - The mobile device mailbox policy that’s currently assigned is displayed. To change the mobile device mailbox policy, click **Browse**. - - ![image showing the currently assigned mobile device mailbox policy.](images/setupdeviceacctexch-10.png) - - - Choose the appropriate mobile device mailbox policy from the list, click **OK** and then click **Save**. - - ![image showing list of mobile device mailbox policies.](images/setupdeviceacctexch-11.png) - -### Use PowerShell to configure the account - -Now that you're connected to the online services, you can finish setting up the device account. You'll use the device account email address to: - -- Change the mailbox type from regular to room. -- Change various Exchange properties -- Set the user account password to never expire. - -1. You’ll need to enter the account’s mail address and create a variable with that value: - - ``` syntax - $mailbox = (Get-Mailbox ) - ``` - - To store the value got it from the mailbox: - - ``` syntax - $strEmail = $mailbox.WindowsEmailAddress - ``` - - Print the value by running: - - ``` syntax - $strEmail - ``` - - You will see the correct email address. - -2. You need to convert the account into a room mailbox, so run: - - ``` syntax - Set-Mailbox $strEmail -Type Room - ``` - -3. In order for the device account to be authenticated on a Surface Hub, you need to enable the room mailbox account and set a password, so the account can be used by the device to get meeting information using ActiveSync and log in to Skype for Business. - - ``` syntax - Set-Mailbox $strEmail -RoomMailboxPassword (ConvertTo-SecureString -String "" -AsPlainText -Force) -EnableRoomMailboxAccount $true - ``` - -4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ``` syntax - Set-CalendarProcessing -Identity $strEmail -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity $strEmail -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. Now we have to set some properties in AD. To do that, you need the alias of the account (this is the part of the UPN that becomes before the “@”). - - ``` syntax - $strAlias = “” - ``` - -6. The user needs to be enabled in AD before it can authenticate with a Surface Hub. Run: - - ``` syntax - Set-ADUser $strAlias -Enabled $True - ``` - -7. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. - - ``` syntax - Set-ADUser $strAlias -PasswordNeverExpires $True - ``` - -### Enable the account with Skype for Business - -Enable the device account with Skype for Business. - -In order to enable Skype for Business, your environment will need to meet the following prerequisites: - -- You'll need to have Skype for Business Online Standalone Plan 2 or higher in your O365 plan. The plan needs to support conferencing capability. -- If you need Enterprise Voice (PSTN telephony) using telephony service providers for the Surface Hub, you need Skype for Business Online Standalone Plan 3. -- Your tenant users must have Exchange mailboxes. -- Your Surface Hub account does require a Skype for Business Online Standalone Plan 2 or Skype for Business Online Standalone Plan 3 license, but it does not require an Exchange Online license. - -1. Start by creating a remote PowerShell session from a PC. - - ```PowerShell - Import-Module SkypeOnlineConnector - $cssess=New-CsOnlineSession -Credential $cred - Import-PSSession $cssess -AllowClobber - ``` - -2. Retrieve your Surface Hub account Registrar Pool - -If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - - ```PowerShell - Get-CsOnlineUser -Identity ‘alice@contoso.microsoft.com’| fl *registrarpool* - ``` - -3. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress - ``` - - - - - - - diff --git a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md deleted file mode 100644 index 8985f70c9d..0000000000 --- a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Create and test a device account (Surface Hub) -description: This topic introduces how to create and test the device account that Microsoft Surface Hub uses to communicate with Microsoft Exchange and Skype. -ms.assetid: C8605B5F-2178-4C3A-B4E0-CE32C70ECF67 -ms.reviewer: rikot -manager: laurawi -keywords: create and test device account, device account, Surface Hub and Microsoft Exchange, Surface Hub and Skype -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 03/06/2018 -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Create and test a device account (Surface Hub) - - -This topic introduces how to create and test the device account that Microsoft Surface Hub uses to communicate with Microsoft Exchange and Skype. - -A **device account** is an Exchange resource account that Surface Hub uses to: - -- Display its meeting calendar -- Join Teams or Skype for Business calls -- Send email (for example, email whiteboard content from a meeting) - -Once the device account is provisioned to a Surface Hub, people can add this account to a meeting invitation the same way that they would invite a meeting room. - -## Configuration overview - -This table explains the main steps and configuration decisions when you create a device account. - -| Step | Description | Purpose | -|------|---------------------------------|--------------------------------------| -| 1 | Created a logon-enabled Exchange resource mailbox (Exchange 2013 or later, or Exchange Online) | This resource mailbox allows the device to maintain a meeting calendar, receive meeting requests, and send mail. It must be logon-enabled to be provisioned to a Surface Hub. | -| 2 | Configure mailbox properties | The mailbox must be configured with the correct properties to enable the best meeting experience on Surface Hub. For more information on mailbox properties, see [Mailbox properties](exchange-properties-for-surface-hub-device-accounts.md). | -| 3 | Apply a compatible mobile device mailbox policy to the mailbox | Surface Hub is managed using mobile device management (MDM) rather than through mobile device mailbox policies. For compatibility, the device account must have a mobile device mailbox policy where the **PasswordEnabled** setting is set to False. Otherwise, Surface Hub can't sync mail and calendar info. | -| 4 | Enable mailbox with Skype for Business (Lync Server 2013 or later, or Skype for Business Online) | Skype for Business must be enabled to use conferencing features like video calls, IM, and screen sharing. | -| 5 | (Optional) Whitelist ActiveSync Device ID | Your organization may have a global policy that prevents device accounts from syncing mail and calendar info. If so, you need to whitelist the ActiveSync Device ID of your Surface Hub. | -| 6 | (Optional) Disable password expiration | To simplify management, you can turn off password expiration for the device account and allow Surface Hub to automatically rotate the device account password. For more information about password management, see [Password management](password-management-for-surface-hub-device-accounts.md). | - -## Detailed configuration steps - -We recommend setting up your device accounts using remote PowerShell. There are PowerShell scripts available to help create and validate device accounts For more information on PowerShell scripts and instructions, see [Appendix A: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md). - -For detailed steps using PowerShell to provision a device account, choose an option from the table, based on your organization deployment. - -| Organization deployment | Description | -|---------------------------------|--------------------------------------| -| [Online deployment (Office 365)](online-deployment-surface-hub-device-accounts.md) | Your organization's environment is deployed entirely on Office 365. | -| [On-premises deployment (single-forest)](on-premises-deployment-surface-hub-device-accounts.md) | Your organization has servers that it controls and uses to host Active Directory, Exchange, and Skype for Business (or Lync) in a single-forest environment. | -| [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) | Your organization has servers that it controls and uses to host Active Directory, Exchange, and Skype for Business (or Lync) in a multi-forest environment. | -| [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Your organization has a mix of services, with some hosted on-premises and some hosted online through Office 365. | -| [Online or hybrid deployment using Skype Hybrid Voice environment](skype-hybrid-voice.md) | Your organization has Skype for Business home pools and Exchange servers in the cloud, and uses an on-premises pool of Skype for Business 2015 or Cloud Connector edition connected via Public Switched Telephone Network (PSTN). | - - -If you prefer to use a graphical user interface (UI), some steps can be done using UI instead of PowerShell. -For more information, see [Creating a device account using UI](create-a-device-account-using-office-365.md). - -## Account verification and testing - -There are two methods available that you can use to validate and test a Surface Hub device account: [account verifications scripts](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts) and the [Surface Hub Hardware Diagnostic app](https://www.microsoft.com/store/apps/9nblggh51f2g). The account verification script will validate a previously-created device account using PowerShell from your desktop. The Surface Hub Hardware Diagnostic app is installed on your Surface Hub and provides detailed feedback about signin and communication failures. Both are valuable tools to test newly created device accounts and should be used to ensure optimal account availability. - -  - -  - -  - - - - - diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md deleted file mode 100644 index 8eb3486d7d..0000000000 --- a/devices/surface-hub/device-reset-surface-hub.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Reset or recover a Surface Hub -description: Describes the reset and recovery processes for the Surface Hub, and provides instructions. -ms.assetid: 44E82EEE-1905-464B-A758-C2A1463909FF -ms.reviewer: -manager: laurawi -keywords: reset Surface Hub, recover -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/31/2019 -ms.localizationpriority: medium ---- - -# Reset or recover a Surface Hub - -This article describes how to reset or recover a Microsoft Surface Hub. - -[Resetting the Surface Hub](#reset-a-surface-hub) returns its operating system to the last cumulative Windows update, and removes all local user files and configuration information. The information that is removed includes the following: - -- The device account -- Account information for the device's local administrators -- Domain-join or Azure AD-join information -- Mobile Device Management (MDM) enrollment information -- Configuration information that was set by using MDM or the Settings app - -[Recovering a Surface Hub from the cloud](#recover-a-surface-hub-from-the-cloud) also removes this information. In addition, the Surface Hub downloads a new operating system image and installs it. You can specify whether the recovery process preserves other information that is stored on the Surface Hub. - -## Reset a Surface Hub - -You may have to reset your Surface Hub for reasons such as the following: - -- You are re-purposing the device for a new meeting space and want to reconfigure it. -- You want to change how you locally manage the device. -- The user name or password for the device account or the Administrator account has been lost. -- After you install an update, the performance of the device decreases. - -During the reset process, if you see a blank screen for long periods of time, please wait and do not take any action. - -> [!WARNING] -> The device reset process may take up to six hours. Do not turn off or unplug the Surface Hub until the process has finished. If you interrupt the process, the device becomes inoperable. The device requires warranty service in order to become functional again. - -1. On your Surface Hub, open **Settings**. - - ![Image that shows Settings app for Surface Hub.](images/sh-settings.png) - -1. Select **Update & Security**. - - ![Image that shows Update & Security group in Settings app for Surface Hub.](images/sh-settings-update-security.png) - -1. Select **Recovery**, and then, under **Reset device**, select **Get started**. - - ![Image that shows the Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png) - - After the reset process finishes, the Surface Hub starts the [first run program](first-run-program-surface-hub.md) again. If the reset process encounters a problem, it rolls the Surface Hub back to the previously-existing operating system image and then displays the Welcome screen. - - - -## Recover a Surface Hub from the cloud - -If for some reason the Surface Hub becomes unusable, you can still recover it from the cloud without assistance from Microsoft Support. The Surface Hub can download a fresh operating system image from the cloud, and use that image to reinstall its operating system. - -You may have to use this type of recovery process under the following circumstances: - -- [The Surface Hub or its related accounts have entered an unstable state](#recover-a-surface-hub-in-a-bad-state) -- [The Surface Hub is locked](#recover-a-locked-surface-hub) - ->[!IMPORTANT] ->The **Recover from the cloud** process requires an open internet connection (no proxy or other authentications). An ethernet connection is recommended. - -### Recover a Surface Hub in a bad state - -If the device account gets into an unstable state or if the administrator account encounters problems, you can use the Settings app to start the cloud recovery process. You should only use the cloud recovery process when the [device reset](#reset-a-surface-hub) process doesn't fix the problem. - -1. On your Surface Hub, select **Settings** > **Update & security** > **Recovery**. - -1. Under **Recover from the cloud**, select **Restart now**. - - ![recover from the cloud](images/recover-from-the-cloud.png) - -### Recover a locked Surface Hub - -On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device automatically restarts and tries the operation again. But if this operation fails repeatedly, the device automatically locks to protect user data. To unlock it, you must [reset the device](#reset-a-surface-hub) or, if that doesn't work, recover it from the cloud. - -1. Locate the power switch on the bottom of Surface Hub. The power switch is next to the power cord connection. For more information about the power switch, see the [Surface Hub Site Readiness Guide (PDF)](surface-hub-site-readiness-guide.md). - -1. While the Surface Hub displays the Welcome screen, use the power switch to turn off the Surface Hub. - -1. Use the power switch to turn the Surface Hub back on. The device starts and displays the Surface Hub Logo screen. When you see spinning dots under the Surface Hub Logo, use the power switch to turn the Surface Hub off again. - -1. Repeat step 3 three times, or until the Surface Hub displays the "Preparing Automatic Repair" message. After it displays this message, the Surface Hub displays the Windows RE screen. - -1. Select **Advanced Options**. - -1. Select **Recover from the cloud**. (Optionally, you can select **Reset**. However, **Recover from the cloud** is the recommended approach.) - - ![Recover from the cloud](images/recover-from-cloud.png) -1. If you are prompted to enter the Bitlocker key, do one of the following: - - - To preserve the information that Bitlocker protects on the Surface Hub, enter the Bitlocker key. - - To discard the protected information, select **Skip this drive** - -1. When you are prompted, select **Reinstall**. - - ![Reinstall](images/reinstall.png) - -1. To repartition the disk, select **Yes**. - - ![Repartition](images/repartition.png) - - First, the recovery process downloads the operating system image from the cloud. - - ![downloading 97&](images/recover-progress.png) - - When the download finishes, the recovery process restores the Surface Hub according to the options that you selected. - - -## Contact Support - -If you have questions or need help, you can [create a support request](https://support.microsoft.com/supportforbusiness/productselection). - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) diff --git a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md deleted file mode 100644 index 9309e9b2a3..0000000000 --- a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: Operating system essentials (Surface Hub) -description: This topic explains unique aspects of the Windows 10 Team operating system and how it differs from Windows 10 Enterprise. -keywords: change history -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Operating system essentials (Surface Hub) - -The Surface Hub operating system, Windows 10 Team, is based on Windows 10 Enterprise, providing rich support for enterprise management, security, and other features. However, there are important differences between them. While the Enterprise edition is designed for PCs, Windows 10 Team is designed from the ground up for large screens and meeting rooms. When you evaluate security and management requirements for Surface Hub, it's best to consider it as a new operating system. This article is designed to help highlight the key differences between Windows 10 Team on Surface Hub and Windows 10 Enterprise, and what the differences mean for your organization. - -## User interface - -### Shell (OS user interface) - -The Surface Hub's shell is designed from the ground up to be large screen and touch optimized. It doesn't use the same shell as Windows 10 Enterprise. - -*Organization policies that this may affect:*
Settings related to controls in the Windows 10 Enterprise shell don't apply for Surface Hub. - -### Lock screen and screensaver - -Surface Hub doesn't have a lock screen or a screen saver, but it has a similar feature called the welcome screen. The welcome screen shows scheduled meetings from the device account's calendar, and easy entry points to the Surface Hub's top apps - Skype for Business, Whiteboard, and Connect. - -*Organization policies that this may affect:*
Settings for lock screen, screen timeout, and screen saver don't apply for Surface Hub. - -### User sign-in - -Surface Hub is designed to be used in communal spaces, such as meeting rooms. Unlike Windows PCs, anyone can walk up and use a Surface Hub without requiring a user to sign in. To enable this communal functionality, Surface Hub does not support Windows sign-in the same way that Windows 10 Enterprise does (e.g., signing in a user to the OS and using those credentials throughout the OS). Instead, there is always a local, auto signed-in, low-privilege user signed in to the Surface Hub. It doesn't support signing in any additional users, including admin users (e.g., when an admin signs in, they are not signed in to the OS). - -Users can sign in to a Surface Hub, but they will not be signed in to the OS. For example, when a user signs in to Apps or My Meetings and Files, the users is signed in only to the apps or services, not to the OS. As a result, the signed-in user is able to retrieve their cloud files and personal meetings stored in the cloud, and these credentials are discarded when **End session** is activated. - - -*Organization policies that this may affect:*
Generally, Surface Hub uses lockdown features rather than user access control to enforce security. Policies related to password requirements, interactive logon, user accounts, and access control don't apply for Surface Hub. - -### Saving and browsing files - -Users have access to a limited set of directories on the Surface Hub: -- Music -- Videos -- Documents -- Pictures -- Downloads - -Files saved locally in these directories are deleted when users press **End session**. To save content created during a meeting, users should save files to a USB drive or to OneDrive. - -*Organization policies that this may affect:*
Policies related to access permissions and ownership of files and folders don't apply for Surface Hub. Users can't browse and save files to system directories and network folders. - -## Applications - -### Default applications - -With few exceptions, the default Universal Windows Platform (UWP) apps on Surface Hub are also available on Windows 10 PCs. - -UWP apps pre-installed on Surface Hub: -- Alarms & Clock -- Calculator -- Connect -- Excel Mobile -- Feedback Hub -- File Explorer* -- Get Started -- Maps -- Microsoft Edge -- Microsoft Power BI -- OneDrive -- Photos -- PowerPoint Mobile -- Settings* -- Skype for Business* -- Store -- Whiteboard* -- Word Mobile - -*Apps with an asterisk (*) are unique to Surface Hub* - -*Organization policies that this may affect:*
Use guidelines for Windows 10 Enterprise to determine the features and network requirements for default apps on the Surface Hub. - -### Installing apps, drivers, and services - -To help preserve the appliance-like nature of the device, Surface Hub only supports installing Universal Windows Platform (UWP) apps, and does not support installing classic Win32 apps, services and drivers. Furthermore, only admins have access to install UWP apps. - -*Organization policies that this may affect:*
Employees can only use the apps that have been installed by admins, helping mitigate against unintended use. Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools. - -## Security and lockdown - -For Surface Hub to be used in communal spaces, such as meeting rooms, its custom OS implements many of the security and lockdown features available in Windows 10. - -Surface Hub implements these Windows 10 security features: -- [UEFI Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) -- [User Mode Code Integrity (UMCI) with Device Guard](https://technet.microsoft.com/itpro/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies) -- [Application restriction policies using AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) -- [BitLocker Drive Encryption](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview) -- [Trusted Platform Module (TPM)](https://technet.microsoft.com/itpro/windows/keep-secure/trusted-platform-module-overview) -- [Windows Defender](https://technet.microsoft.com/itpro/windows/keep-secure/windows-defender-in-windows-10) -- [User Account Control (UAC)](https://technet.microsoft.com/itpro/windows/keep-secure/user-account-control-overview) for access to the Settings app - -These Surface Hub features provide additional security: -- Custom UEFI firmware -- Custom shell and Start menu limits device to meeting functions -- Custom File Explorer only grants access to files and folders under My Documents -- Custom Settings app only allows admins to modify device settings -- Downloading advanced Plug and Play drivers is disabled - -*Organization policies that this may affect:*
Consider these features when performing your security assessment for Surface Hub. - -## Management - -### Device settings - -Device settings can be configured through the Settings app. The Settings app is customized for Surface Hub, but also contains many familiar settings from Windows 10 Desktop. A User Accounts Control (UAC) prompt appears when opening up the Settings app to verify the admin's credentials, but this does not sign in the admin. - -*Organization policies that this may affect:*
Employees can use the Surface Hub for meetings, but cannot modify any device settings. In addition to lockdown features, this ensures that employees only use the device for meeting functions. - -### Administrative features - -The administrative features in Windows 10 Enterprise, such as the Microsoft Management Console, Run, Command Prompt, PowerShell, registry editor, event viewer, and task manager are not supported on Surface Hub. The Settings app contains all of the administrative features locally available on Surface Hub. - -*Organization policies that this may affect:*
Surface Hubs are not managed like traditional PCs. Use MDM to configure settings and OMS to monitor your Surface Hub. - -### Remote management and monitoring - -Surface Hub supports remote management through mobile device management (MDM) solutions such as [Microsoft Intune](https://docs.microsoft.com/intune/) and monitoring through [Azure Monitor](https://azure.microsoft.com/services/monitor/). - -*Organization policies that this may affect:*
Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools, such as System Center Operations Manager. - -### Group Policy - -Surface Hub does not support Windows Group Policy, including auditing. Instead, use MDM to apply policies to your Surface Hub. For more information about MDM, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md). - -*Organization policies that this may affect:*
Use MDM to manage Surface Hub rather than group policy. - -### Remote assistance - -Surface Hub does not support remote assistance. - -*Organization policies that this may affect:*
Policies related to remote assistance don't apply for Surface Hub. - -## Network - -### Domain join and Azure Active Directory (Azure AD) join - -Surface Hub uses domain join and Azure AD join primarily to provide a directory-backed admin group. Users can't sign in with a domain account. For more information, see [Admin group management](admin-group-management-for-surface-hub.md). - -*Organization policies that this may affect:*
Group policies are not applied when a Surface Hub is joined to your domain. Policies related to domain membership don't apply for Surface Hub. - -### Accessing domain resources - -Users can sign in to Microsoft Edge to access intranet sites and online resources (such as Office 365). If your Surface Hub is configured with a device account, the system uses it to access Exchange and Skype for Business. However, Surface Hub doesn't support accessing domain resources such as file shares and printers. - -*Organization policies that this may affect:*
Policies related to accessing domain objects don't apply for Surface Hub. - - - -### Diagnostic data - -The Surface Hub OS uses the Windows 10 Connected User Experience and Telemetry component to gather and transmit diagnostic data. For more information, see [Configure Windows diagnostic data in your organization](https://technet.microsoft.com/itpro/windows/manage/configure-windows-diagnostic-data-in-your-organization). - -*Organization policies that this may affect:*
Configure diagnostic data levels for Surface Hub in the same way as you do for Windows 10 Enterprise. diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx deleted file mode 100644 index b06a6e8b44..0000000000 Binary files a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx and /dev/null differ diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx deleted file mode 100644 index 4fa5e3abd9..0000000000 Binary files a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx and /dev/null differ diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx deleted file mode 100644 index 210102de52..0000000000 Binary files a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx and /dev/null differ diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx deleted file mode 100644 index 6d39d374a7..0000000000 Binary files a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx and /dev/null differ diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf deleted file mode 100644 index 6c5b52d377..0000000000 Binary files a/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf deleted file mode 100644 index ae296c8c08..0000000000 Binary files a/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf deleted file mode 100644 index 9f64a7c4f2..0000000000 Binary files a/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCConnectYourPC.pdf b/devices/surface-hub/downloads/QRCConnectYourPC.pdf deleted file mode 100644 index fbdb9d9164..0000000000 Binary files a/devices/surface-hub/downloads/QRCConnectYourPC.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf deleted file mode 100644 index 62b86d2a00..0000000000 Binary files a/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf deleted file mode 100644 index a6af26dcf9..0000000000 Binary files a/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCNavigationBasics.pdf b/devices/surface-hub/downloads/QRCNavigationBasics.pdf deleted file mode 100644 index 6d8eb75ad5..0000000000 Binary files a/devices/surface-hub/downloads/QRCNavigationBasics.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf deleted file mode 100644 index a33cf1b1e1..0000000000 Binary files a/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCShareSendFile.pdf b/devices/surface-hub/downloads/QRCShareSendFile.pdf deleted file mode 100644 index 56d5c9f8c2..0000000000 Binary files a/devices/surface-hub/downloads/QRCShareSendFile.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf b/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf deleted file mode 100644 index 61caa64f94..0000000000 Binary files a/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf deleted file mode 100644 index d7a7c89268..0000000000 Binary files a/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf b/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf deleted file mode 100644 index aed2f55671..0000000000 Binary files a/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/QRCWhiteboardTools.pdf b/devices/surface-hub/downloads/QRCWhiteboardTools.pdf deleted file mode 100644 index c6dfcc3523..0000000000 Binary files a/devices/surface-hub/downloads/QRCWhiteboardTools.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf b/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf deleted file mode 100644 index 79675aaaaa..0000000000 Binary files a/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf deleted file mode 100644 index 9fa82b77c5..0000000000 Binary files a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf deleted file mode 100644 index 36d552a91a..0000000000 Binary files a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf and /dev/null differ diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf deleted file mode 100644 index 216737e393..0000000000 Binary files a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf and /dev/null differ diff --git a/devices/surface-hub/enable-8021x-wired-authentication.md b/devices/surface-hub/enable-8021x-wired-authentication.md deleted file mode 100644 index 8ac2baccb6..0000000000 --- a/devices/surface-hub/enable-8021x-wired-authentication.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Enable 802.1x wired authentication -description: 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 11/15/2017 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Enable 802.1x wired authentication - -The [November 14, 2017 update to Windows 10](https://support.microsoft.com/help/4048954/windows-10-update-kb4048954) (build 15063.726) enables 802.1x wired authentication MDM policies on Surface Hub devices. The feature allows organizations to enforce standardized wired network authentication using the [IEEE 802.1x authentication protocol](http://www.ieee802.org/1/pages/802.1x-2010.html). This is already available for wireless authentication using WLAN profiles via MDM. This topic explains how to configure a Surface Hub for use with wired authentication. - -Enforcement and enablement of 802.1x wired authentication on Surface Hub can be done through MDM [OMA-URI definition](https://docs.microsoft.com/intune-classic/deploy-use/windows-10-policy-settings-in-microsoft-intune#oma-uri-settings). - -The primary configuration to set is the **LanProfile** policy. Depending on the authentication method selected, other policies may be required, either the **EapUserData** policy or through MDM policies for adding user or machine certificates (such as [ClientCertificateInstall](https://docs.microsoft.com/windows/client-management/mdm/clientcertificateinstall-csp) for user/device certificates or [RootCATrustedCertificates](https://docs.microsoft.com/windows/client-management/mdm/rootcacertificates-csp) for device certificates). - -## LanProfile policy element - -To configure Surface Hub to use one of the supported 802.1x authentication methods, utilize the following OMA-URI. - -``` -./Vendor/MSFT/SurfaceHub/Dot3/LanProfile -``` - -This OMA-URI node takes a text string of XML as a parameter. The XML provided as a parameter should conform to the [Wired LAN Profile Schema](https://msdn.microsoft.com/library/cc233002.aspx) including elements from the [802.1X schema](https://msdn.microsoft.com/library/cc233003.aspx). - -In most instances, an administrator or user can export the LanProfile XML from an existing PC that is already configured on the network for 802.1X using this following NETSH command. - -``` -netsh lan export profile folder=. -``` - -Running this command will give the following output and place a file titled **Ethernet.xml** in the current directory. - -``` -Interface: Ethernet -Profile File Name: .\Ethernet.xml -1 profile(s) were exported successfully. -``` - -## EapUserData policy element - -If your selected authentication method requires a username and password as opposed to a certificate, you can use the **EapUserData** element to specify credentials for the device to use to authenticate to the network. - -``` -./Vendor/MSFT/SurfaceHub/Dot3/EapUserData -``` - -This OMA-URI node takes a text string of XML as a parameter. The XML provided as a parameter should conform to the [PEAP MS-CHAPv2 User Properties example](https://msdn.microsoft.com/library/windows/desktop/bb891979). In the example, you will need to replace all instances of *test* and *ias-domain* with your information. - - - -## Adding certificates - -If your selected authentication method is certificate-based, you will need to [create a provisioning package](provisioning-packages-for-surface-hub.md), [utilize MDM](https://docs.microsoft.com/windows/client-management/mdm/clientcertificateinstall-csp), or import a certificate from settings (**Settings** > **Update and Security** > **Certificates**) to deploy those certificates to your Surface Hub device in the appropriate Certificate Store. When adding certificates, each PFX must contain only one certificate (a PFX cannot have multiple certificates). - diff --git a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md deleted file mode 100644 index 9a100d4a60..0000000000 --- a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Microsoft Exchange properties (Surface Hub) -description: Some Microsoft Exchange properties of the device account must be set to particular values to have the best meeting experience on Microsoft Surface Hub. -ms.assetid: 3E84393B-C425-45BF-95A6-D6502BA1BF29 -ms.reviewer: -manager: laurawi -keywords: Microsoft Exchange properties, device account, Surface Hub, Windows PowerShell cmdlet -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: medium ---- - -# Microsoft Exchange properties (Surface Hub) - - -Some Microsoft Exchange properties of the device account must be set to particular values to have the best meeting experience on Microsoft Surface Hub. The following table lists various Exchange properties based on PowerShell cmdlet parameters, their purpose, and the values they should be set to. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PropertyDescriptionValueImpact

AutomateProcessing

The AutomateProcessing parameter enables or disables calendar processing on the mailbox.

AutoAccept

The Surface Hub will be able to automatically accept or decline meeting requests based on its availability.

AddOrganizerToSubject

The AddOrganizerToSubject parameter specifies whether the meeting organizer's name is used as the subject of the meeting request.

$False

The welcome screen will not show the meeting organizer twice (instead of showing it as both the organizer and in the meeting subject).

AllowConflicts

The AllowConflicts parameter specifies whether to allow conflicting meeting requests.

$False

The Surface Hub will decline meeting requests that conflict with another meeting’s time.

DeleteComments

The DeleteComments parameter specifies whether to remove or keep any text in the message body of incoming meeting requests.

$False

The message body of meetings can be retained and retrieved from a Surface Hub if you need it during a meeting.

DeleteSubject

The DeleteSubject parameter specifies whether to remove or keep the subject of incoming meeting requests.

$False

Meeting request subjects can be shown on the Surface Hub.

RemovePrivateProperty

The RemovePrivateProperty parameter specifies whether to clear the private flag for incoming meeting requests.

$False

Private meeting subjects will show as Private on the welcome screen.

AddAdditionalResponse

The AddAdditionalResponse parameter specifies whether additional information will be sent from the resource mailbox when responding to meeting requests.

$True

When a response is sent to a meeting request, custom text will be provided in the response.

AdditionalResponse

The AdditionalResponse parameter specifies the additional information to be included in responses to meeting requests.

-
-Note  This text will not be sent unless AddAdditionalResponse is set to $True. -
-
-  -

Your choice—the additional response can be used to inform people how to use a Surface Hub or point them towards resources.

Adding an additional response message can provide people an introduction to how they can use a Surface Hub in their meeting.

- -  - -  - -  - - - - - diff --git a/devices/surface-hub/finishing-your-surface-hub-meeting.md b/devices/surface-hub/finishing-your-surface-hub-meeting.md deleted file mode 100644 index 3e02c9bb0a..0000000000 --- a/devices/surface-hub/finishing-your-surface-hub-meeting.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: End session - ending a Surface Hub meeting -description: To end a Surface Hub meeting, tap End session. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. -keywords: I am Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# End a Surface Hub meeting with End session -Surface Hub is a collaboration device designed to be used in meeting spaces by different groups of people. At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting. Surface Hub will clean up, or reset, the following states: -- Applications -- Operating system -- User interface - -This topic explains what **End session** resets for each of these states. - -## Applications -When you start apps on Surface Hub, they are stored in memory and data is stored at the application level. Data is available to all users during that session (or meeting) until date is removed or overwritten. When **End session** is selected, Surface Hub application state is cleared out by closing applications, deleting browser history, resetting applications, and removing Skype logs. - -### Close applications -Surface Hub closes all visible windows, including Win32 and Universal Windows Platform (UWP) applications. The application close stage uses the multitasking view to query the visible windows. Win32 windows that do not close within a certain timeframe are closed using **TerminateProcess**. - -### Delete browser history -Surface Hub uses Delete Browser History (DBH) in Edge to clear Edge history and cached data. This is similar to how a user can clear out their browser history manually, but **End session** also ensures that application states are cleared and data is removed before the next session, or meeting, starts. - -### Reset applications -**End session** resets the state of each application that is installed on the Surface Hub. Resetting an application clears all background tasks, application data, notifications, and user consent dialogs. Applications are returned to their first-run state for the next people that use Surface Hub. - -### Remove Skype logs -Skype does not store personally-identifiable information on Surface Hub. Information is stored in the Skype service to meet existing Skype for Business guidance. Local Skype logging information is the only data removed when **End session** is selected. This includes Unified Communications Client Platform (UCCP) logs and media logs. - -## Operating System -The operating system hosts a variety of information about the state of the sessions that needs to be cleared after each Surface Hub meeting. - -### File System -Meeting attendees have access to a limited set of directories on the Surface Hub. When **End session** is selected, Surface Hub clears these directories:
-- Music -- Videos -- Documents -- Pictures -- Downloads - -Surface Hub also clears these directories, since many applications often write to them: -- Desktop -- Favorites -- Recent -- Public Documents -- Public Music -- Public Videos -- Public Downloads - -### Credentials -User credentials that are stored in **TokenBroker**, **PasswordVault**, or **Credential Manager** are cleared when you tap **End session**. - -## User interface -User interface (UI) settings are returned to their default values when **End session** is selected. - -### UI items -- Reset Quick Actions to default state -- Clear Toast notifications -- Reset volume levels -- Reset sidebar width -- Reset tablet mode layout -- Sign user out of Office 365 meetings and files - -### Accessibility -Accessibility features and apps are returned to default settings when **End session** is selected. -- Filter keys -- High contrast -- Sticky keys -- Toggle keys -- Mouse keys -- Magnifier -- Narrator - -### Clipboard -The clipboard is cleared to remove data that was copied to the clipboard during the session. - -## Frequently asked questions -**What happens if I forget to tap End session at the end of a meeting, and someone else uses the Surface Hub later?**
-Surface Hub only cleans up meeting content when users tap **End session**. If you leave the meeting without tapping **End session**, the device will return to the welcome screen after some time. From the welcome screen, users have the option to resume the previous session or start a new one. You can also disable the ability to resume a session if **End session** is not pressed. - -**Are documents recoverable?**
-Removing files from the hard drive when **End session** is selected is just like any other file deletion from a hard disk drive. Third-party software might be able to recover data from the hard disk drive, but file recovery is not a supported feature on Surface Hub. To prevent data loss, always save the data you need before leaving a meeting. - -**Do the clean-up actions from End session comply with the US Department of Defense clearing and sanitizing standard: DoD 5220.22-M?**
-No. Currently, the clean-up actions from **End session** do not comply with this standard. - diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md deleted file mode 100644 index 8a3bfc6e91..0000000000 --- a/devices/surface-hub/first-run-program-surface-hub.md +++ /dev/null @@ -1,461 +0,0 @@ ---- -title: First-run program (Surface Hub) -description: The term \ 0034;first run \ 0034; refers to the series of steps you'll go through the first time you power up your Microsoft Surface Hub, and means the same thing as \ 0034;out-of-box experience \ 0034; (OOBE). This section will walk you through the process. -ms.assetid: 07C9E84C-1245-4511-B3B3-75939AD57C49 -ms.reviewer: -manager: laurawi -keywords: first run, Surface Hub, out-of-box experience, OOBE -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# First-run program (Surface Hub) - - -The term "first run" refers to the series of steps you'll go through the first time you power up your Microsoft Surface Hub, and means the same thing as "out-of-box experience" (OOBE). This section will walk you through the process. - -By now, you should have gone through all of the previous steps: - -- [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) -- [Physically install your Surface Hub device](physically-install-your-surface-hub-device.md), and -- [Setup worksheet](setup-worksheet-surface-hub.md) - -Assuming that's the case, first run should be both simple and quick. -The normal procedure goes through six steps: - -1. [Hi there page](#first-page) -2. [Set up for you page](#set-up-for-you) -3. [Device account page](#device-account) -4. [Name this device page](#name-this-device) -5. [Set up admins for this device page](#setup-admins) -6. [Update the Surface Hub](#update-surface-hub) - -Each of these sections also contains information about paths you might take when something is different. For example, most Surface Hubs will use a wired network connection, but some of them will be set up with wireless instead. Details are described where appropriate. - ->[!NOTE] ->You should have the separate keyboard that came with your Surface Hub set up and ready before beginning. See the Surface Hub Setup Guide for details. - - - -## Hi there page - - -This is the first screen you'll see when you power up the Surface Hub for the first time. It's where you input localization information for your device. - ->[!NOTE] ->This is also where you begin the optional process of deploying a provisioning package. See [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md) if that's what you're doing. - - Select a language and the initial setup options are displayed. - -![Image showing ICD options checklist.](images/setuplocale.png) - -### Details - -If the default values shown are correct, then you can click **Next** to go on. Otherwise, you'll need to enter data in the appropriate boxes. - -- **Country/region:** Select the country or region where the Surface Hub will be used. -- **App language:** Apps and features will display in this language and language format. -- **Keyboard layout:** Select the keyboard layout for the on-screen and physical keyboards that will be used with your device. -- **Time zone:** Select the time zone where the Surface Hub will be used. - -### What happens? - ->[!NOTE] -> Once the settings on this page are entered, you can't come back to this screen unless you reset the device (see [Device reset](device-reset-surface-hub.md)). Make sure that the settings are properly configured before proceeding. - - - -When the settings are accepted, the device will check for a wired network connection. If the connection is fine, it will display the [Set up for you page](#set-up-for-you). If there is a problem with the wired connection, the device will display the [Network setup page](#network-setup). - -If no wired connection can be found, then the device will attempt to set up a wireless connection, and will display the [Network setup page](#network-setup). - -## Network setup page - - -If your device does not detect a wired connection that it can use to connect to a network or the Internet, you will see this page. Here you can either connect to a wireless network, or skip making the network connection. - -![Image shoring Network setup page.](images/setupnetworksetup-1.png) - -### Details - -This screen is shown only if the device fails to detect a wired network. If you see this screen, you have three choices: - -- You can select one of the wireless networks shown. If the network is secured, you'll be taken to a login page. See [Wireless network setup](#wireless) for details. -- Click **Skip this step** to skip connecting to a network. You'll be taken to the [Set up for you page](#set-up-for-you). - >[!NOTE] - >If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including system updates and email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)). - - - -- You can plug in a network cable while this screen is visible. The device will detect it, and will add **Next** to the screen. Click **Next** to continue with making the wired connection. - -### What happens? - -If the device has a wired connection when it starts, and can establish a network or Internet connection, then this page will not be displayed. If you want to connect the device to a wireless connection, make sure no Ethernet cable is plugged in at first run, which will bring you to this screen. No matter what you choose to set up now, you can [use Settings](wireless-network-management-for-surface-hub.md) to set up different connections later. - -If you want to connect to a secured wireless network from this page, click on the network of your choice, and then provide the necessary information (password or account credentials) to connect. See [Wireless network setup](#wireless). - -## Wireless network setup - - -This page will be shown when you've selected a secured wireless network. - -![Image showing wireless network setup page.](images/setupnetworksetup-3.png) - -### Details - -- **User name:** Enter the user name for the selected wireless network. -- **Password:** This is the password for the network. - -### What happens? - -The device will attempt to connect to the specified network. If it's successful, you'll be taken to the [Set up for you page](#set-up-for-you). - -## Network proxy setup - - -This page will be shown when the device detects a wired connection with limited connectivity. You have three options: - -- You can select a wireless network to use instead of the limited wired connection. -- You can skip connecting to a network by selecting **Skip this step**. You'll be taken to the [Set up for you page](#set-up-for-you). - **Note**  If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including things like email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)). - - - -- You can select **Enter proxy settings** which will allow you to specify how to use the network proxy. You'll be taken to the next screen. - -![Image showing network proxy page.](images/setupnetworksetup-2.png) - -This is the screen you'll see if you clicked **Enter proxy settings** on the previous screen. - -![Image showing proxy server setting details.](images/setupnetworksetup-4.png) - -### Details - -In order to make a network connection, you'll need to fill in either a script name, or the proxy server and port info. - -- **Proxy script:** Provide the address of a proxy script. -- **Proxy server and port:** You can provide the proxy server address and port. - -### What happens? - -When you click **Next**, the device will attempt to connect to the proxy server. If successful, you'll be taken to the [Set up for you page](#set-up-for-you). - -You can skip connecting to a network by selecting **Skip this step**. You'll be taken to the [Set up for you page](#set-up-for-you). - ->[!NOTE] ->If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including things like email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)). - - - -## Set up for you page - - -This screen is purely informational, and shows which recommended settings have been enabled by default. - -![Image showing set up for you page.](images/setupsetupforyou.png) - -### Details - -You should read this screen and note which services have been enabled by default. All of them can be changed using the Settings app if need be, but you should be careful about the effects of doing so. See [Intro to Surface Hub](intro-to-surface-hub.md) for details. - -Once you're done reviewing the settings, click **Next** to go on. - -### What happens? - -The settings shown on the page have already been made, and can't be changed until after first run is completed. - -## Device account page - - -On this page, the Surface Hub will ask for credentials for the device account that you previously configured. (See [Create and test a device account](create-and-test-a-device-account-surface-hub.md).) The Surface Hub will attempt to discover various properties of the account, and may ask for more information on another page if it does not succeed. - ->[!NOTE] ->This section does not cover specific errors that can happen during first run. See [Troubleshoot Surface Hub](troubleshoot-surface-hub.md) for more information on errors. - - -![Image showing Enter device account info page.](images/setupdeviceacct.png) - -### Details - -Use either a **user principal name (UPN)** or a **domain\\user name** as the account identifier in the first entry field. Use the format that matches your environment, and enter the password. - - -| Environment | Required format for device account | -|-------------------------------------------------------|------------------------------------| -| Device account is hosted only online. | username@domain.com | -| Device account is hosted only on-prem. | DOMAIN\username | -| Device account is hosted online and on-prem (hybrid). | DOMAIN\username | - -Click **Skip setting up a device account** to skip setting up a device account. However, if you don't set up a device account, the device will not be fully integrated into your infrastructure. For example, people won't be able to: - -- See a meeting calendar on the Welcome screen -- Start a meeting from the Welcome screen -- Email whiteboards from OneNote -- Use Skype for Business for meetings - -If you skip setting it up now, you can add a device account later by using the Settings app. - -If you click **Skip setting up a device account**, the device will display a dialog box showing what will happen if the device doesn't have a device account. If you choose **Yes, skip this**, you will be sent to the [Name this device page](#name-this-device). - -![Image showing message the is displayed to confirm you want to skip creating a device account.](images/setupskipdeviceacct.png) - -### What happens? - -The device will use the UPN or DOMAIN\\User name and password for the device account to do the following: - -- Check if the account exists in Active Directory (AD) or Azure Active Directory (Azure AD): - - - If a UPN was entered: the device will look for the account in Azure AD. - - If a DOMAIN\\User name was entered: the device will look for the account in AD. -- Look up the Microsoft Exchange server for the account’s mailbox. -- Look up the Session Initiation Protocol (SIP) address for the account. -- Pull the account’s display name and alias attributes. - -## Exchange server page - - -This page will only be shown if there's a problem. Typically, it means that the device account that you provided was found in Active Directory (AD) or Azure Active Directory (Azure AD), but the Exchange server for the account was not discovered. - -![Image showing Exchange server page.](images/setupexchangeserver-01.png) - -### Details - -Enter the name of the Exchange server where the device account's mailbox is hosted. - -Click **Skip setting up Exchange services** to skip this step. If you do, people will not be able to: - -- See a meeting calendar on the welcome screen. -- Start a meeting from the welcome screen. -- Email whiteboards from OneNote. - -See [Intro to Surface Hub](intro-to-surface-hub.md) for details on setup dependencies. - -You can enable Exchange services for a device account later by using the Settings app. - -If you click **Skip setting up Exchange services**, the device will display a dialog showing what will happen. If you choose **Yes, skip this**, then Exchange services will not be set up. - -![Image showing confirmation message that is displayed when you skip setting up Exchange services.](images/setupexchangeserver-02.png) - -### What happens? - -The Surface Hub will attempt to validate the device account on the Exchange server that you enter here. If the Exchange server can be reached and validates, then first run will proceed. - -If you choose to skip setting up Exchange services, the Surface Hub will stop looking for the Exchange server, and no Exchange services (mail and calendar) will be enabled. - -## Exchange policies page - - -This page will be shown when: - -- The device account is using an Exchange Active Sync (EAS) policy where the PasswordEnabled policy is set to 1. -- There’s no connection to Exchange. -- Exchange returns a status code indicating an error. (For example: The account has been provisioned to too many devices.) -- Exchange supported protocols are not supported by the Surface Hub. -- Exchange returns incorrect XML. - -![Image showing Exchange policis page.](images/setupexchangepolicies.png) - -### Details - -This page is purely informational, so no input is required. However, you have two options for proceeding: either skipping ahead or retrying the validation that caused the error. Before deciding which option is best, please read the following **What happens?** section. You may be able to fix the problem elsewhere before you click on one of the options. - -- **Click here to continue using unsupported policies**: click on this to continue first run. The Surface Hub will not be able to use Exchange services, or sync. -- **Retry**: check the policy on the Exchange server again. - -### What happens? - -The Surface Hub checks whether the device account’s EAS policy has the PasswordEnabled policy set to 0 (False). If this is not the case, mail and calendar can't be synced and the Surface Hub can't use any Exchange services. You can use your Exchange management tools from a PC to check that the device account has the PasswordEnabled policy set to 0. If that's not the case, you can reconfigure the account and click **Retry** here. - -If the policy has already been configured properly, check that your device is properly connected to the network or Internet, and can reach your Exchange server, because this page will also be shown if the Surface Hub can't reach the Exchange server. - -Another possible reason for not being able to reach Exchange is because of certificate-based authentication. You may wind up on this page because of certificate issues. Note that if the device displays error codes 0x80072F0D or 0X800C0019, then a certificate is required. Because provisioning is done on the first page of the first run process, you must disable Exchange services by clicking **Click here to continue using unsupported policies**, and then install the correct certificates through the Settings app. - -If you choose to skip this check, the Surface Hub will stop looking for the Exchange server and validating EAS policies, and no Exchange services will be enabled. See [Intro to Surface Hub](intro-to-surface-hub.md) for details on setup dependencies. - -## Name this device page - - -This page asks you to provide two names that will be used for identifying the Surface Hub. - -![Image showing Name this device page.](images/setupnamedevice.png) - -### Details - -If the default values shown are correct, then you can click **Next** to go on. Otherwise, enter data in one or both of the text boxes. - -- **Friendly name:** This is the name that people will see when they want to wirelessly connect to the Surface Hub. -- **Device name:** Can be set to any unique name as described on the screen. - -As long as both names are within the length requirements and do not use restricted characters, clicking **Next** will take you to the next page, [Set up admins for this device](#setup-admins). - -### What happens? - -The Surface Hub requires two names for the device, which will default to: - -- **Friendly name:** Defaults to the Display Name of the device account -- **Device name:** Defaults to the alias of the device account - -While either of the names can be changed later, keep in mind that: - -- The friendly name should be recognizable and different so that people can distinguish one Surface Hub from another when trying to wirelessly connect. -- If you decide to domain join the device, the device name must not be the same as any other device on the account’s Active Directory domain. The device can't join the domain if it is using the same name as another domain-joined device. - ->[!NOTE] ->If you want to enable [Miracast over Infrastructure](miracast-over-infrastructure.md), the device name needs to be discoverable via DNS. You can achieve this by either allowing your Surface Hub to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the Surface Hub's device name. - -## Set up admins for this device page - - -On this page, you will choose from several options for how you want to set up admin accounts to locally manage your device. - -Because every Surface Hub can be used by any number of authenticated employees, settings are locked down so that they can't change from session to session. Only admins can configure the settings on the device, and on this page, you’ll choose which type of admins have that privilege. - ->[!NOTE] ->The purpose of this page is primarily to determine who can configure the device from the device’s UI; that is, who can actually visit a device, log in, open up the Settings app, and make changes to the Settings. - - - -![Image showing Set up admins for this device page.](images/setupsetupadmins.png) - -### Details - -Choose one of the three available options: - -- **Use Microsoft Azure Active Directory** -- **Use Active Directory Domain Services** -- **Use a local admin** - -### What happens? - -This is what happens when you choose an option. - -- **Use Microsoft Azure Active Directory** - - Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. Members of the Azure Global Admins role from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization. - - > [!IMPORTANT] - > Administrators added to the Azure Device Administrators role after you join the device to Azure AD will be unable to use the Settings app. - > - > If you join Surface Hub to Azure AD during first-run setup, single sign-on (SSO) for Office apps will not work properly. Users will have to sign in to each Office app individually. - -- **Use Active Directory Domain Services** - - Click this option to join the device to AD. Once you click **Next**, you’ll be taken to the [Use Active Directory Domain Services](#use-active-directory) page and asked to enter credentials that allow you to join the specified domain. After joining, you can pick a security group from the joined domain, and people from that security group will be able to use the Settings app. - -- **Use a local admin** - - Choosing this option will allow you to create a single local admin. This admin won’t be backed by any directory service, so we recommend you only choose this case if the device does not have access to Azure AD or AD. Once you create an admin’s user name and password on the [Use a local admin](#use-a-local-admin) page, you will need to re-enter those same credentials whenever you open the Settings app. - - Note that a local admin must have physical access to the Surface Hub to log in. - ->[!NOTE] ->After you finish this process, you won't be able to change the device's admin option unless you reset the device. - - - -### Use Microsoft Azure Active Directory - -If you've decided to join your Surface Hub to Azure Active Directory (Azure AD), you'll see this **What happens next** page. Read it and click **Next** to go to the **Let's get you signed in page**. - -Joining Azure AD has two primary benefits: - -1. Some employees from your organization will be able to access the device as admins, and will be able to start the Settings app and configure the device. People that have admin permissions will be defined in your Azure AD subscription. -2. If your Azure AD is connected to a mobile device management (MDM) solution, the device will enroll with that MDM solution so you can apply policies and configuration. - -![Image showing message when you join your Surface Hub to Azure Active Directory.](images/setupjoiningazuread-1.png) - -### Details - -The following input is required: - -- **User's UPN:** The user principal name (UPN) of an account that can join Azure AD. -- **Password:** The password of the account you’re using to join Azure AD. - -![Image showing account log in info.](images/setupjoiningazuread-2.png) - -If you get to this point and don't have valid credentials for an Azure AD account, the device will allow you to continue by creating a local admin account. Click **Set up Windows with a local account instead**. - -![Image showing Set up an admin account page.](images/setupjoiningazuread-3.png) - -### What happens? - -Once you enter valid Azure AD account credentials, the device will try to join the associated Azure AD organization. If this succeeds, then the device will provision employees in that organization to be local admins on the device. If your Azure AD tenant was configured for it, the device will also enroll into MDM. - -### Use Active Directory Domain Services - -This page will ask for credentials to join a domain so that the Surface Hub can provision a security group as administrators of the device. - -Once the device has been domain joined, you must specify a security group from the domain you joined. This security group will be provisioned as administrators on the Surface Hub, and anyone from the security group can enter their domain credentials to access Settings. - -![Image showing Set up admins using domain join page.](images/setupdomainjoin.png) - -### Details - -The following input is required: - -- **Domain:** This is the fully qualified domain name (FQDN) of the domain that you want to join. A security group from this domain can be used to manage the device. -- **User name:** The user name of an account that has sufficient permission to join the specified domain. -- **Password:** The password for the account. - -After the credentials are verified, you will be asked to type a security group name. This input is required. - -![Image showing Enter a security group page.](images/setupsecuritygroup-1.png) - -### What happens? - -Using the provided domain, account credentials from the [Use Active Directory Domain Services page](#use-active-directory) and the device name from the [Name this device](#name-this-device) page, the Surface Hub will attempt to join the domain. If the join is successful, first run will continue, and will ask for a security group. If the join is not successful, first run will halt and ask you to change the information provided. - -If the join is successful, you'll see the **Enter a security group** page. When you click the **Select** button on this page, the device will search for the specified security group on your domain. If found, the group will be verified. Click **Finish** to complete the first run process. - ->[!NOTE] ->If you domain join the Surface Hub, you can't unjoin the device without resetting it. - - - -### Use a local admin - -If you decide not to use Azure Active Directory (Azure AD) or Active Directory (AD) to manage the Surface Hub, you'll need to create a local admin account. - -![Image showing Set up an admin account for local admin.](images/setuplocaladmin.png) - -### Details - -The following input is required: - -- **User name:** This is the user name of the local admin account that will be created for this Surface Hub. -- **Password:** This is the password of the device account. -- **Re-enter password:** Verifying the password as in the previous box. - -### What happens? - -This page will attempt to create a new admin account using the credentials that you enter here. If it's successful, then first run will end. If not, you'll be asked for different credentials. - -## Update the Surface Hub - - ->[!IMPORTANT] ->Before you do the updates, make sure you read [Save your BitLocker key](save-bitlocker-key-surface-hub.md) in order to make sure you have a backup of the key. - - - -In order to get the latest features and fixes, you should update your Surface Hub as soon as you finish all of the preceding first-run steps. - -1. Make sure the device has access to the Windows Update servers or to Windows Server Update Services (WSUS). To configure WSUS, see [Using WSUS](manage-windows-updates-for-surface-hub.md#use-windows-server-update-services). -2. Open Settings, click **Update & security**, then **Windows Update**, and then click **Check for updates**. -3. If updates are available, they will be downloaded. Once downloading is complete, click the **Update now** button to install the updates. -4. Follow the onscreen prompts after the updates are installed. You may need to restart the device. - - - - - - - - - diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md deleted file mode 100644 index 329f00f931..0000000000 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ /dev/null @@ -1,413 +0,0 @@ ---- -title: Hybrid deployment (Surface Hub) -description: A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. -ms.assetid: 7BFBB7BE-F587-422E-9CE4-C9DDF829E4F1 -ms.reviewer: -manager: laurawi -keywords: hybrid deployment, device account for Surface Hub, Exchange hosted on-prem, Exchange hosted online -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 08/30/2018 -ms.localizationpriority: medium ---- - -# Hybrid deployment (Surface Hub) - -A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-premises), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).) - -> [!NOTE] -> In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-premises). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet. - -## Exchange on-premises - -Use this procedure if you use Exchange on-premises. - -1. For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. This account will be synced to Office 365. - -- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**. -- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.

- -![New object box for creating a new user in active directory.](images/hybriddeployment-01a.png) - -- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected. - -> **Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account. - -![Image showing password dialog box.](images/hybriddeployment-02a.png) - -- Click **Finish** to create the account. - -![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png) - -2. Enable the remote mailbox. - -Open your on-premises Exchange Management Shell with administrator permissions, and run this cmdlet. - -```PowerShell -Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room -``` - -> [!NOTE] -> If you don't have an on-premises Exchange environment to run this cmdlet, you can make the same changes directly to the Active Directory object for the account. -> -> msExchRemoteRecipientType = 33 -> -> msExchRecipientDisplayType = -2147481850 -> -> msExchRecipientTypeDetails = 8589934592 - -3. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Microsoft 365 admin center and verify that the account created in the previous steps has merged to online. - -4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365. - -Start a remote PowerShell session on a PC and connect to Microsoft Exchange. Be sure you have the right permissions set to run the associated cmdlets. - -The next steps will be run on your Office 365 tenant. - -```PowerShell -Set-ExecutionPolicy RemoteSigned -$cred=Get-Credential -Message "Please use your Office 365 admin credentials" -$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $cred -Authentication Basic -AllowRedirection -Import-PSSession $sess -``` - -5. Create a new Exchange ActiveSync policy, or use a compatible existing policy. - -After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy or use a compatible existing policy. - -Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - -If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - -```PowerShell -$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false -``` - -Once you have a compatible policy, you will need to apply the policy to the device account. - -```PowerShell -Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id -``` - -6. Set Exchange properties. - -Setting Exchange properties on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - -```PowerShell -Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse 'This is a Surface Hub room!' -``` - -7. Connect to Azure AD. - -You first need to install Azure AD module for PowerShell version 2. In an elevated PowerShell prompt, run the following command: - -```PowerShell -Install-Module -Name AzureAD -``` - -You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect. - -```PowerShell -Import-Module AzureAD -Connect-AzureAD -Credential $cred -``` - -8. Assign an Office 365 license. - -The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account. - -You can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - -Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. - -```PowerShell -Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" - -Get-AzureADSubscribedSku | Select Sku*,*Units -$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense -$License.SkuId = SkuId You selected - -$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses -$AssignedLicenses.AddLicenses = $License -$AssignedLicenses.RemoveLicenses = @() - -Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses -``` - -Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid). - -### Skype for Business Online - -To enable Skype for Business online, your tenant users must have Exchange mailboxes (at least one Exchange mailbox in the tenant is required). The following table explains which plans or additional services you need. - -| Skype room system scenario | If you have Office 365 Premium, Microsoft 365 Apps for enterprise, or Skype for Business Standalone Plan 2, you need: | If you have an Enterprise-based plan, you need: | If you have Skype for Business Server 2015 (on-premises or hybrid), you need: | -| --- | --- | --- | --- | -| Join a scheduled meeting | Skype for Business Standalone Plan 1 | E1, 3, 4, or 5 | Skype for Business Server Standard CAL | -| Initiate an ad-hoc meeting | Skype for Business Standalone Plan 2 | E 1, 3, 4, or 5 | Skype for Business Server Standard CAL or Enterprise CAL | -| Initiate an ad-hoc meeting and dial out from a meeting to phone numbers | Skype for Business Standalone Plan 2 with Audio Conferencing

**Note** PSTN consumption billing is optional | E1 or E3 with Audio Conferencing, or E5| Skype for Business Server Standard CAL or Enterprise CAL | -| Give the room a phone number and make or receive calls from the room or join a dial-in conference using a phone number | Skype for Business Standalone Plan 2 with Phone System and a PSTN Voice Calling plan | E1 or E3 with Phone System and a PSTN Voice Calling plan, or E5 | Skype for Business Server Standard CAL or Plus CAL | - -The following table lists the Office 365 plans and Skype for Business options. - -| O365 Plan | Skype for Business | Phone System | Audio Conferencing | Calling Plans | -| --- | --- | --- | --- | --- | -| O365 Business Essentials | Included | | | | -| O365 Business Premium | Included | | | | -| E1 | Included | Add-on | Add-on | Add-on (requires Phone System add-on) | -| E3 | Included | Add-on | Add-on | Add-on (requires Phone System add-on) | -| E5 | Included | Included | Included | Add-on | - -1. Start by creating a remote PowerShell session from a PC to the Skype for Business online environment. - -```PowerShell -Import-Module SkypeOnlineConnector -$cssess=New-CsOnlineSession -Credential $cred -Import-PSSession $cssess -AllowClobber -``` - -2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - -```PowerShell -Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName -``` - -If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - -```PowerShell -Get-CsOnlineUser -Identity ‘HUB01@contoso.com’| fl *registrarpool* -``` - -3. Assign Skype for Business license to your Surface Hub account. - - Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) license to the device. - -- Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app. - -- Click on **Users and Groups** and then **Add users, reset passwords, and more**. - -- Click the Surface Hub account, and then click the pen icon to edit the account information. - -- Click **Licenses**. - -- In **Assign licenses**, select Skype for Business (Plan 1) or Skype for Business (Plan 2), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 2 license if you want to use Enterprise Voice on your Surface Hub. - -- Click **Save**. - -> [!NOTE] -> You can also use the Windows Azure Active Directory Module for Windows Powershell to run the cmdlets needed to assign one of these licenses, but that's not covered here. - -For validation, you should be able to use any Skype for Business client (PC, Android, etc.) to sign in to this account. - -### Skype for Business on-premises - -To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run: - -```PowerShell -Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName -``` - -### Skype for Business hybrid - -If your organization has set up [hybrid connectivity between Skype for Business Server and Skype for Business Online](https://technet.microsoft.com/library/jj205403.aspx), the guidance for creating accounts differs from a standard Surface Hub deployment. - -The Surface Hub requires a Skype account of the type `meetingroom`, while a normal user would use a user type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account. - -In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet. - -> [!NOTE] -> To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p). - - -## Exchange online - -Use this procedure if you use Exchange online. - -1. Create an email account in Office 365. - -Start a remote PowerShell session on a PC and connect to Exchange. Be sure you have the right permissions set to run the associated cmdlets. - -```PowerShell -Set-ExecutionPolicy RemoteSigned -$cred=Get-Credential -Message "Please use your Office 365 admin credentials" -$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/PowerShell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection -Import-PSSession $sess -``` - -2. Set up a mailbox. - -After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub. - -If you're changing an existing resource mailbox: - -```PowerShell -Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) -``` - -If you’re creating a new resource mailbox: - -```PowerShell -New-Mailbox -MicrosoftOnlineServicesID 'HUB01@contoso.com' -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) -``` - -3. Create Exchange ActiveSync policy. - -After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - -Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, Exchange services on the Surface Hub (mail, calendar, and joining meetings) will not be enabled. - -If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - -```PowerShell -$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false -``` - -Once you have a compatible policy, you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too. - -```PowerShell -Set-Mailbox 'HUB01@contoso.com' -Type Regular -Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id -Set-Mailbox 'HUB01@contoso.com' -Type Room -$credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password" -Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true -``` - -4. Set Exchange properties. - -Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - -```PowerShell -Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" -``` - -5. Add an email address for your on-premises domain account. - -For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. - -- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**. -- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**. - -![New object box for creating a new user in Active Directory.](images/hybriddeployment-01a.png) - -- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected. - -> [!IMPORTANT] -> Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account. - -![Image showing password dialog box.](images/hybriddeployment-02a.png) - -- Click **Finish** to create the account. - -![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png) - -6. Run directory synchronization. - -After you've created the account, run a directory synchronization. When it's complete, go to the users page and verify that the two accounts created in the previous steps have merged. - -7. Connect to Azure AD. - -You first need to install Azure AD module for PowerShell version 2. In an elevated PowerShell prompt, run the following command: - -```PowerShell -Install-Module -Name AzureAD -``` - -You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect: - -```PowerShell -Import-Module AzureAD -Connect-AzureAD -Credential $cred -``` - -8. Assign an Office 365 license. - -The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account. - -Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - -Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. - -```PowerShell -Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" - -Get-AzureADSubscribedSku | Select Sku*,*Units -$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense -$License.SkuId = SkuId You selected - -$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses -$AssignedLicenses.AddLicenses = $License -$AssignedLicenses.RemoveLicenses = @() - -Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses -``` - -Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid). - -### Skype for Business Online - -In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](#skype-for-business-online). - -1. Start by creating a remote PowerShell session to the Skype for Business online environment from a PC. - -```PowerShell -Import-Module SkypeOnlineConnector -$cssess=New-CsOnlineSession -Credential $cred -Import-PSSession $cssess -AllowClobber -``` - -2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet: - -```PowerShell -Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool -'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName -``` - - If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet: - -```PowerShell -Get-CsOnlineUser -Identity 'HUB01@contoso.com'| fl *registrarpool* -``` - -10. Assign Skype for Business license to your Surface Hub account - -Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) license to the device. - -- Sign in as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app. - -- Click on **Users and Groups** and then **Add users, reset passwords, and more**. - -- Click the Surface Hub account, and then click the pen icon to edit the account information. - -- Click **Licenses**. - -- In **Assign licenses**, select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub. - -- Click **Save**. - -> [!NOTE] -> You can also use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here. - -For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account. - -### Skype for Business on-premises - -To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run: - -```PowerShell -Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName -``` - -### Skype for Business hybrid - -If your organization has set up [hybrid connectivity between Skype for Business Server and Skype for Business Online](https://technet.microsoft.com/library/jj205403.aspx), the guidance for creating accounts differs from a standard Surface Hub deployment. - -The Surface Hub requires a Skype account of the type *meetingroom*, while a normal user would use a *user* type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account. - -In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet. - -> [!NOTE] -> To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p). diff --git a/devices/surface-hub/images/01-diagnostic.png b/devices/surface-hub/images/01-diagnostic.png deleted file mode 100644 index fde5951776..0000000000 Binary files a/devices/surface-hub/images/01-diagnostic.png and /dev/null differ diff --git a/devices/surface-hub/images/01-escape.png b/devices/surface-hub/images/01-escape.png deleted file mode 100644 index badfc5883d..0000000000 Binary files a/devices/surface-hub/images/01-escape.png and /dev/null differ diff --git a/devices/surface-hub/images/02-all-apps.png b/devices/surface-hub/images/02-all-apps.png deleted file mode 100644 index a29e9d8428..0000000000 Binary files a/devices/surface-hub/images/02-all-apps.png and /dev/null differ diff --git a/devices/surface-hub/images/02-skip-this-drive.png b/devices/surface-hub/images/02-skip-this-drive.png deleted file mode 100644 index 930f0b26d3..0000000000 Binary files a/devices/surface-hub/images/02-skip-this-drive.png and /dev/null differ diff --git a/devices/surface-hub/images/03-recover-from-cloud.png b/devices/surface-hub/images/03-recover-from-cloud.png deleted file mode 100644 index be422cecc8..0000000000 Binary files a/devices/surface-hub/images/03-recover-from-cloud.png and /dev/null differ diff --git a/devices/surface-hub/images/03-welcome.png b/devices/surface-hub/images/03-welcome.png deleted file mode 100644 index b71ebe0752..0000000000 Binary files a/devices/surface-hub/images/03-welcome.png and /dev/null differ diff --git a/devices/surface-hub/images/04-test-results-1.png b/devices/surface-hub/images/04-test-results-1.png deleted file mode 100644 index e0b53f2dc3..0000000000 Binary files a/devices/surface-hub/images/04-test-results-1.png and /dev/null differ diff --git a/devices/surface-hub/images/04-yes.png b/devices/surface-hub/images/04-yes.png deleted file mode 100644 index 9c26b795ce..0000000000 Binary files a/devices/surface-hub/images/04-yes.png and /dev/null differ diff --git a/devices/surface-hub/images/05-test-results-2.png b/devices/surface-hub/images/05-test-results-2.png deleted file mode 100644 index 55b7c7abed..0000000000 Binary files a/devices/surface-hub/images/05-test-results-2.png and /dev/null differ diff --git a/devices/surface-hub/images/05a-reinstall.png b/devices/surface-hub/images/05a-reinstall.png deleted file mode 100644 index 60d90928ba..0000000000 Binary files a/devices/surface-hub/images/05a-reinstall.png and /dev/null differ diff --git a/devices/surface-hub/images/05b-downloading.png b/devices/surface-hub/images/05b-downloading.png deleted file mode 100644 index 59393e7162..0000000000 Binary files a/devices/surface-hub/images/05b-downloading.png and /dev/null differ diff --git a/devices/surface-hub/images/06-account-settings.png b/devices/surface-hub/images/06-account-settings.png deleted file mode 100644 index 35a92f2ff8..0000000000 Binary files a/devices/surface-hub/images/06-account-settings.png and /dev/null differ diff --git a/devices/surface-hub/images/06-out-of-box.png b/devices/surface-hub/images/06-out-of-box.png deleted file mode 100644 index a513b46c5b..0000000000 Binary files a/devices/surface-hub/images/06-out-of-box.png and /dev/null differ diff --git a/devices/surface-hub/images/07-account-settings-details.png b/devices/surface-hub/images/07-account-settings-details.png deleted file mode 100644 index 421f372b03..0000000000 Binary files a/devices/surface-hub/images/07-account-settings-details.png and /dev/null differ diff --git a/devices/surface-hub/images/07-cancel.png b/devices/surface-hub/images/07-cancel.png deleted file mode 100644 index a788960011..0000000000 Binary files a/devices/surface-hub/images/07-cancel.png and /dev/null differ diff --git a/devices/surface-hub/images/08-test-account.png b/devices/surface-hub/images/08-test-account.png deleted file mode 100644 index d7cbf9620d..0000000000 Binary files a/devices/surface-hub/images/08-test-account.png and /dev/null differ diff --git a/devices/surface-hub/images/08-troubleshoot.png b/devices/surface-hub/images/08-troubleshoot.png deleted file mode 100644 index d2af1969bd..0000000000 Binary files a/devices/surface-hub/images/08-troubleshoot.png and /dev/null differ diff --git a/devices/surface-hub/images/09-network.png b/devices/surface-hub/images/09-network.png deleted file mode 100644 index d69f2d67ec..0000000000 Binary files a/devices/surface-hub/images/09-network.png and /dev/null differ diff --git a/devices/surface-hub/images/09-recover-from-cloud2.png b/devices/surface-hub/images/09-recover-from-cloud2.png deleted file mode 100644 index 64650a91bb..0000000000 Binary files a/devices/surface-hub/images/09-recover-from-cloud2.png and /dev/null differ diff --git a/devices/surface-hub/images/10-cancel.png b/devices/surface-hub/images/10-cancel.png deleted file mode 100644 index ffef745522..0000000000 Binary files a/devices/surface-hub/images/10-cancel.png and /dev/null differ diff --git a/devices/surface-hub/images/10-environment.png b/devices/surface-hub/images/10-environment.png deleted file mode 100644 index 376e077249..0000000000 Binary files a/devices/surface-hub/images/10-environment.png and /dev/null differ diff --git a/devices/surface-hub/images/11-certificates.png b/devices/surface-hub/images/11-certificates.png deleted file mode 100644 index 13b45396b3..0000000000 Binary files a/devices/surface-hub/images/11-certificates.png and /dev/null differ diff --git a/devices/surface-hub/images/12-trust-model.png b/devices/surface-hub/images/12-trust-model.png deleted file mode 100644 index 996bb4fdd4..0000000000 Binary files a/devices/surface-hub/images/12-trust-model.png and /dev/null differ diff --git a/devices/surface-hub/images/2s-mount-pattern.png b/devices/surface-hub/images/2s-mount-pattern.png deleted file mode 100644 index 92262fb428..0000000000 Binary files a/devices/surface-hub/images/2s-mount-pattern.png and /dev/null differ diff --git a/devices/surface-hub/images/35mm.png b/devices/surface-hub/images/35mm.png deleted file mode 100644 index 7a414337b6..0000000000 Binary files a/devices/surface-hub/images/35mm.png and /dev/null differ diff --git a/devices/surface-hub/images/ICDstart-option.PNG b/devices/surface-hub/images/ICDstart-option.PNG deleted file mode 100644 index 1ba49bb261..0000000000 Binary files a/devices/surface-hub/images/ICDstart-option.PNG and /dev/null differ diff --git a/devices/surface-hub/images/OOBE-2.jpg b/devices/surface-hub/images/OOBE-2.jpg deleted file mode 100644 index 0c615a2ec4..0000000000 Binary files a/devices/surface-hub/images/OOBE-2.jpg and /dev/null differ diff --git a/devices/surface-hub/images/account-management-details.PNG b/devices/surface-hub/images/account-management-details.PNG deleted file mode 100644 index 66712394ec..0000000000 Binary files a/devices/surface-hub/images/account-management-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/account-management.PNG b/devices/surface-hub/images/account-management.PNG deleted file mode 100644 index 34165dfcd6..0000000000 Binary files a/devices/surface-hub/images/account-management.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-applications-details.PNG b/devices/surface-hub/images/add-applications-details.PNG deleted file mode 100644 index 2efd3483ae..0000000000 Binary files a/devices/surface-hub/images/add-applications-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-applications.PNG b/devices/surface-hub/images/add-applications.PNG deleted file mode 100644 index 2316deb2fd..0000000000 Binary files a/devices/surface-hub/images/add-applications.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-certificates-details.PNG b/devices/surface-hub/images/add-certificates-details.PNG deleted file mode 100644 index 78cd783282..0000000000 Binary files a/devices/surface-hub/images/add-certificates-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-certificates.PNG b/devices/surface-hub/images/add-certificates.PNG deleted file mode 100644 index 24cb605d1c..0000000000 Binary files a/devices/surface-hub/images/add-certificates.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-config-file-details.PNG b/devices/surface-hub/images/add-config-file-details.PNG deleted file mode 100644 index c7b4db97e6..0000000000 Binary files a/devices/surface-hub/images/add-config-file-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-config-file.PNG b/devices/surface-hub/images/add-config-file.PNG deleted file mode 100644 index 5b779509d9..0000000000 Binary files a/devices/surface-hub/images/add-config-file.PNG and /dev/null differ diff --git a/devices/surface-hub/images/adjust-room-audio.png b/devices/surface-hub/images/adjust-room-audio.png deleted file mode 100644 index 3d0eef5ed7..0000000000 Binary files a/devices/surface-hub/images/adjust-room-audio.png and /dev/null differ diff --git a/devices/surface-hub/images/analog.png b/devices/surface-hub/images/analog.png deleted file mode 100644 index 1f1666903b..0000000000 Binary files a/devices/surface-hub/images/analog.png and /dev/null differ diff --git a/devices/surface-hub/images/approve-signin.png b/devices/surface-hub/images/approve-signin.png deleted file mode 100644 index 7736b95431..0000000000 Binary files a/devices/surface-hub/images/approve-signin.png and /dev/null differ diff --git a/devices/surface-hub/images/approve-signin2.png b/devices/surface-hub/images/approve-signin2.png deleted file mode 100644 index 2ccfc40ecc..0000000000 Binary files a/devices/surface-hub/images/approve-signin2.png and /dev/null differ diff --git a/devices/surface-hub/images/apps.png b/devices/surface-hub/images/apps.png deleted file mode 100644 index 5cb3b7ec8f..0000000000 Binary files a/devices/surface-hub/images/apps.png and /dev/null differ diff --git a/devices/surface-hub/images/attendees.png b/devices/surface-hub/images/attendees.png deleted file mode 100644 index fd468aa971..0000000000 Binary files a/devices/surface-hub/images/attendees.png and /dev/null differ diff --git a/devices/surface-hub/images/caution.PNG b/devices/surface-hub/images/caution.PNG deleted file mode 100644 index 0f87b07c0f..0000000000 Binary files a/devices/surface-hub/images/caution.PNG and /dev/null differ diff --git a/devices/surface-hub/images/choose-package.png b/devices/surface-hub/images/choose-package.png deleted file mode 100644 index 2bf7a18648..0000000000 Binary files a/devices/surface-hub/images/choose-package.png and /dev/null differ diff --git a/devices/surface-hub/images/configmgr-additional.png b/devices/surface-hub/images/configmgr-additional.png deleted file mode 100644 index 7c8fbf8e2f..0000000000 Binary files a/devices/surface-hub/images/configmgr-additional.png and /dev/null differ diff --git a/devices/surface-hub/images/configmgr-create.png b/devices/surface-hub/images/configmgr-create.png deleted file mode 100644 index 1db436d3ad..0000000000 Binary files a/devices/surface-hub/images/configmgr-create.png and /dev/null differ diff --git a/devices/surface-hub/images/configmgr-oma-uri.png b/devices/surface-hub/images/configmgr-oma-uri.png deleted file mode 100644 index 699bc054a1..0000000000 Binary files a/devices/surface-hub/images/configmgr-oma-uri.png and /dev/null differ diff --git a/devices/surface-hub/images/configmgr-platform.png b/devices/surface-hub/images/configmgr-platform.png deleted file mode 100644 index e857c50cc3..0000000000 Binary files a/devices/surface-hub/images/configmgr-platform.png and /dev/null differ diff --git a/devices/surface-hub/images/configmgr-team.png b/devices/surface-hub/images/configmgr-team.png deleted file mode 100644 index f99acd5738..0000000000 Binary files a/devices/surface-hub/images/configmgr-team.png and /dev/null differ diff --git a/devices/surface-hub/images/connect-aad.png b/devices/surface-hub/images/connect-aad.png deleted file mode 100644 index 8583866165..0000000000 Binary files a/devices/surface-hub/images/connect-aad.png and /dev/null differ diff --git a/devices/surface-hub/images/deploy1.png b/devices/surface-hub/images/deploy1.png deleted file mode 100644 index 1c5c119303..0000000000 Binary files a/devices/surface-hub/images/deploy1.png and /dev/null differ diff --git a/devices/surface-hub/images/deploy2.png b/devices/surface-hub/images/deploy2.png deleted file mode 100644 index 2b035e979f..0000000000 Binary files a/devices/surface-hub/images/deploy2.png and /dev/null differ diff --git a/devices/surface-hub/images/deploy3.png b/devices/surface-hub/images/deploy3.png deleted file mode 100644 index 56621a24dc..0000000000 Binary files a/devices/surface-hub/images/deploy3.png and /dev/null differ diff --git a/devices/surface-hub/images/deploymentoptions-01.png b/devices/surface-hub/images/deploymentoptions-01.png deleted file mode 100644 index 05a5eb45c6..0000000000 Binary files a/devices/surface-hub/images/deploymentoptions-01.png and /dev/null differ diff --git a/devices/surface-hub/images/developer-setup.PNG b/devices/surface-hub/images/developer-setup.PNG deleted file mode 100644 index 8c93d5ed91..0000000000 Binary files a/devices/surface-hub/images/developer-setup.PNG and /dev/null differ diff --git a/devices/surface-hub/images/device-family.png b/devices/surface-hub/images/device-family.png deleted file mode 100644 index 1efe12fc57..0000000000 Binary files a/devices/surface-hub/images/device-family.png and /dev/null differ diff --git a/devices/surface-hub/images/dport.png b/devices/surface-hub/images/dport.png deleted file mode 100644 index 2842f96ad4..0000000000 Binary files a/devices/surface-hub/images/dport.png and /dev/null differ diff --git a/devices/surface-hub/images/dportio.png b/devices/surface-hub/images/dportio.png deleted file mode 100644 index 02bf145d60..0000000000 Binary files a/devices/surface-hub/images/dportio.png and /dev/null differ diff --git a/devices/surface-hub/images/dportout.png b/devices/surface-hub/images/dportout.png deleted file mode 100644 index 4b6bb87663..0000000000 Binary files a/devices/surface-hub/images/dportout.png and /dev/null differ diff --git a/devices/surface-hub/images/ease-of-access.png b/devices/surface-hub/images/ease-of-access.png deleted file mode 100644 index 2cb79254f8..0000000000 Binary files a/devices/surface-hub/images/ease-of-access.png and /dev/null differ diff --git a/devices/surface-hub/images/end-session.png b/devices/surface-hub/images/end-session.png deleted file mode 100644 index 4b28583af4..0000000000 Binary files a/devices/surface-hub/images/end-session.png and /dev/null differ diff --git a/devices/surface-hub/images/enroll-mdm-details.PNG b/devices/surface-hub/images/enroll-mdm-details.PNG deleted file mode 100644 index f3a7fea8da..0000000000 Binary files a/devices/surface-hub/images/enroll-mdm-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/enroll-mdm.PNG b/devices/surface-hub/images/enroll-mdm.PNG deleted file mode 100644 index b7cfdbc767..0000000000 Binary files a/devices/surface-hub/images/enroll-mdm.PNG and /dev/null differ diff --git a/devices/surface-hub/images/express-settings.png b/devices/surface-hub/images/express-settings.png deleted file mode 100644 index 99e9c4825a..0000000000 Binary files a/devices/surface-hub/images/express-settings.png and /dev/null differ diff --git a/devices/surface-hub/images/finish-details.png b/devices/surface-hub/images/finish-details.png deleted file mode 100644 index 727efac696..0000000000 Binary files a/devices/surface-hub/images/finish-details.png and /dev/null differ diff --git a/devices/surface-hub/images/finish.PNG b/devices/surface-hub/images/finish.PNG deleted file mode 100644 index 7c65da1799..0000000000 Binary files a/devices/surface-hub/images/finish.PNG and /dev/null differ diff --git a/devices/surface-hub/images/five.png b/devices/surface-hub/images/five.png deleted file mode 100644 index 961f0e15b7..0000000000 Binary files a/devices/surface-hub/images/five.png and /dev/null differ diff --git a/devices/surface-hub/images/four.png b/devices/surface-hub/images/four.png deleted file mode 100644 index 0fef213b37..0000000000 Binary files a/devices/surface-hub/images/four.png and /dev/null differ diff --git a/devices/surface-hub/images/getstarted.png b/devices/surface-hub/images/getstarted.png deleted file mode 100644 index e5b85dd8ae..0000000000 Binary files a/devices/surface-hub/images/getstarted.png and /dev/null differ diff --git a/devices/surface-hub/images/h2gen-platemount.png b/devices/surface-hub/images/h2gen-platemount.png deleted file mode 100644 index 4a8ca76fd4..0000000000 Binary files a/devices/surface-hub/images/h2gen-platemount.png and /dev/null differ diff --git a/devices/surface-hub/images/h2gen-railmount.png b/devices/surface-hub/images/h2gen-railmount.png deleted file mode 100644 index 0c8bf8ffb6..0000000000 Binary files a/devices/surface-hub/images/h2gen-railmount.png and /dev/null differ diff --git a/devices/surface-hub/images/hdmi.png b/devices/surface-hub/images/hdmi.png deleted file mode 100644 index a2c69ace45..0000000000 Binary files a/devices/surface-hub/images/hdmi.png and /dev/null differ diff --git a/devices/surface-hub/images/hub-sec-1.png b/devices/surface-hub/images/hub-sec-1.png deleted file mode 100644 index fe4e25d084..0000000000 Binary files a/devices/surface-hub/images/hub-sec-1.png and /dev/null differ diff --git a/devices/surface-hub/images/hub-sec-2.png b/devices/surface-hub/images/hub-sec-2.png deleted file mode 100644 index fdf7af7ca6..0000000000 Binary files a/devices/surface-hub/images/hub-sec-2.png and /dev/null differ diff --git a/devices/surface-hub/images/hub2s-rear.png b/devices/surface-hub/images/hub2s-rear.png deleted file mode 100644 index f30a81159c..0000000000 Binary files a/devices/surface-hub/images/hub2s-rear.png and /dev/null differ diff --git a/devices/surface-hub/images/hub2s-schematic.png b/devices/surface-hub/images/hub2s-schematic.png deleted file mode 100644 index 28c328a005..0000000000 Binary files a/devices/surface-hub/images/hub2s-schematic.png and /dev/null differ diff --git a/devices/surface-hub/images/hybriddeployment-01a.png b/devices/surface-hub/images/hybriddeployment-01a.png deleted file mode 100644 index 9eb84f777f..0000000000 Binary files a/devices/surface-hub/images/hybriddeployment-01a.png and /dev/null differ diff --git a/devices/surface-hub/images/hybriddeployment-02a.png b/devices/surface-hub/images/hybriddeployment-02a.png deleted file mode 100644 index 85229d2d0d..0000000000 Binary files a/devices/surface-hub/images/hybriddeployment-02a.png and /dev/null differ diff --git a/devices/surface-hub/images/hybriddeployment-03a.png b/devices/surface-hub/images/hybriddeployment-03a.png deleted file mode 100644 index 42cd08d900..0000000000 Binary files a/devices/surface-hub/images/hybriddeployment-03a.png and /dev/null differ diff --git a/devices/surface-hub/images/icd-common-settings.png b/devices/surface-hub/images/icd-common-settings.png deleted file mode 100644 index c2a8eb807f..0000000000 Binary files a/devices/surface-hub/images/icd-common-settings.png and /dev/null differ diff --git a/devices/surface-hub/images/icd-new-project.png b/devices/surface-hub/images/icd-new-project.png deleted file mode 100644 index 8a5c64fa4e..0000000000 Binary files a/devices/surface-hub/images/icd-new-project.png and /dev/null differ diff --git a/devices/surface-hub/images/icd-simple-edit.png b/devices/surface-hub/images/icd-simple-edit.png deleted file mode 100644 index aea2e24c8a..0000000000 Binary files a/devices/surface-hub/images/icd-simple-edit.png and /dev/null differ diff --git a/devices/surface-hub/images/idcfeatureschecklist.png b/devices/surface-hub/images/idcfeatureschecklist.png deleted file mode 100644 index a58d20fcb2..0000000000 Binary files a/devices/surface-hub/images/idcfeatureschecklist.png and /dev/null differ diff --git a/devices/surface-hub/images/iec.png b/devices/surface-hub/images/iec.png deleted file mode 100644 index 7ca6e9237b..0000000000 Binary files a/devices/surface-hub/images/iec.png and /dev/null differ diff --git a/devices/surface-hub/images/intune-save-policy.png b/devices/surface-hub/images/intune-save-policy.png deleted file mode 100644 index f53cc85602..0000000000 Binary files a/devices/surface-hub/images/intune-save-policy.png and /dev/null differ diff --git a/devices/surface-hub/images/intune-template.png b/devices/surface-hub/images/intune-template.png deleted file mode 100644 index 047aed6502..0000000000 Binary files a/devices/surface-hub/images/intune-template.png and /dev/null differ diff --git a/devices/surface-hub/images/key-55.png b/devices/surface-hub/images/key-55.png deleted file mode 100644 index d0ee9a5d13..0000000000 Binary files a/devices/surface-hub/images/key-55.png and /dev/null differ diff --git a/devices/surface-hub/images/license-terms.png b/devices/surface-hub/images/license-terms.png deleted file mode 100644 index 8dd34b0a18..0000000000 Binary files a/devices/surface-hub/images/license-terms.png and /dev/null differ diff --git a/devices/surface-hub/images/manage1.png b/devices/surface-hub/images/manage1.png deleted file mode 100644 index 4caf53b809..0000000000 Binary files a/devices/surface-hub/images/manage1.png and /dev/null differ diff --git a/devices/surface-hub/images/manage2.png b/devices/surface-hub/images/manage2.png deleted file mode 100644 index cb232cffa6..0000000000 Binary files a/devices/surface-hub/images/manage2.png and /dev/null differ diff --git a/devices/surface-hub/images/manage3.png b/devices/surface-hub/images/manage3.png deleted file mode 100644 index 9da88b808e..0000000000 Binary files a/devices/surface-hub/images/manage3.png and /dev/null differ diff --git a/devices/surface-hub/images/manage4.png b/devices/surface-hub/images/manage4.png deleted file mode 100644 index 5c9553718e..0000000000 Binary files a/devices/surface-hub/images/manage4.png and /dev/null differ diff --git a/devices/surface-hub/images/managesettingsmdm-enroll.png b/devices/surface-hub/images/managesettingsmdm-enroll.png deleted file mode 100644 index fe33277b4e..0000000000 Binary files a/devices/surface-hub/images/managesettingsmdm-enroll.png and /dev/null differ diff --git a/devices/surface-hub/images/mfa-options.png b/devices/surface-hub/images/mfa-options.png deleted file mode 100644 index 5bd3defd01..0000000000 Binary files a/devices/surface-hub/images/mfa-options.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwired-01.png b/devices/surface-hub/images/networkmgtwired-01.png deleted file mode 100644 index d2c1748b0b..0000000000 Binary files a/devices/surface-hub/images/networkmgtwired-01.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwired-02.png b/devices/surface-hub/images/networkmgtwired-02.png deleted file mode 100644 index 7312b644d0..0000000000 Binary files a/devices/surface-hub/images/networkmgtwired-02.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwireless-01.png b/devices/surface-hub/images/networkmgtwireless-01.png deleted file mode 100644 index 0ccdc9f5c7..0000000000 Binary files a/devices/surface-hub/images/networkmgtwireless-01.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwireless-02.png b/devices/surface-hub/images/networkmgtwireless-02.png deleted file mode 100644 index 5e9ccb9d99..0000000000 Binary files a/devices/surface-hub/images/networkmgtwireless-02.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwireless-03.png b/devices/surface-hub/images/networkmgtwireless-03.png deleted file mode 100644 index 33954daf1a..0000000000 Binary files a/devices/surface-hub/images/networkmgtwireless-03.png and /dev/null differ diff --git a/devices/surface-hub/images/networkmgtwireless-04.png b/devices/surface-hub/images/networkmgtwireless-04.png deleted file mode 100644 index c1d0e6ec6d..0000000000 Binary files a/devices/surface-hub/images/networkmgtwireless-04.png and /dev/null differ diff --git a/devices/surface-hub/images/new-user-hybrid-voice.png b/devices/surface-hub/images/new-user-hybrid-voice.png deleted file mode 100644 index e291f9ebca..0000000000 Binary files a/devices/surface-hub/images/new-user-hybrid-voice.png and /dev/null differ diff --git a/devices/surface-hub/images/new-user-password-hybrid-voice.png b/devices/surface-hub/images/new-user-password-hybrid-voice.png deleted file mode 100644 index 1ae4d5560b..0000000000 Binary files a/devices/surface-hub/images/new-user-password-hybrid-voice.png and /dev/null differ diff --git a/devices/surface-hub/images/oma-uri.png b/devices/surface-hub/images/oma-uri.png deleted file mode 100644 index b6d4a325d0..0000000000 Binary files a/devices/surface-hub/images/oma-uri.png and /dev/null differ diff --git a/devices/surface-hub/images/one.png b/devices/surface-hub/images/one.png deleted file mode 100644 index 42b4742c49..0000000000 Binary files a/devices/surface-hub/images/one.png and /dev/null differ diff --git a/devices/surface-hub/images/oobe.jpg b/devices/surface-hub/images/oobe.jpg deleted file mode 100644 index 53a5dab6bf..0000000000 Binary files a/devices/surface-hub/images/oobe.jpg and /dev/null differ diff --git a/devices/surface-hub/images/plan1.png b/devices/surface-hub/images/plan1.png deleted file mode 100644 index 891e1e43a6..0000000000 Binary files a/devices/surface-hub/images/plan1.png and /dev/null differ diff --git a/devices/surface-hub/images/plan2.png b/devices/surface-hub/images/plan2.png deleted file mode 100644 index 3ad1f2b9fc..0000000000 Binary files a/devices/surface-hub/images/plan2.png and /dev/null differ diff --git a/devices/surface-hub/images/plan3.png b/devices/surface-hub/images/plan3.png deleted file mode 100644 index 1891d1d2b5..0000000000 Binary files a/devices/surface-hub/images/plan3.png and /dev/null differ diff --git a/devices/surface-hub/images/ppkg-config.png b/devices/surface-hub/images/ppkg-config.png deleted file mode 100644 index 10a2b7de58..0000000000 Binary files a/devices/surface-hub/images/ppkg-config.png and /dev/null differ diff --git a/devices/surface-hub/images/ppkg-csv.png b/devices/surface-hub/images/ppkg-csv.png deleted file mode 100644 index 0648f555e1..0000000000 Binary files a/devices/surface-hub/images/ppkg-csv.png and /dev/null differ diff --git a/devices/surface-hub/images/product-license-hybrid-voice.png b/devices/surface-hub/images/product-license-hybrid-voice.png deleted file mode 100644 index 3d16aeb467..0000000000 Binary files a/devices/surface-hub/images/product-license-hybrid-voice.png and /dev/null differ diff --git a/devices/surface-hub/images/prov.jpg b/devices/surface-hub/images/prov.jpg deleted file mode 100644 index 1593ccb36b..0000000000 Binary files a/devices/surface-hub/images/prov.jpg and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackageoobe-01.png b/devices/surface-hub/images/provisioningpackageoobe-01.png deleted file mode 100644 index 72774987c7..0000000000 Binary files a/devices/surface-hub/images/provisioningpackageoobe-01.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackageoobe-02.png b/devices/surface-hub/images/provisioningpackageoobe-02.png deleted file mode 100644 index 43d283a316..0000000000 Binary files a/devices/surface-hub/images/provisioningpackageoobe-02.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackageoobe-03.png b/devices/surface-hub/images/provisioningpackageoobe-03.png deleted file mode 100644 index 84b037292f..0000000000 Binary files a/devices/surface-hub/images/provisioningpackageoobe-03.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackageoobe-04.png b/devices/surface-hub/images/provisioningpackageoobe-04.png deleted file mode 100644 index 9c854e8084..0000000000 Binary files a/devices/surface-hub/images/provisioningpackageoobe-04.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackagesettings-01.png b/devices/surface-hub/images/provisioningpackagesettings-01.png deleted file mode 100644 index b42614c566..0000000000 Binary files a/devices/surface-hub/images/provisioningpackagesettings-01.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackagesettings-02.png b/devices/surface-hub/images/provisioningpackagesettings-02.png deleted file mode 100644 index f6cae68e8b..0000000000 Binary files a/devices/surface-hub/images/provisioningpackagesettings-02.png and /dev/null differ diff --git a/devices/surface-hub/images/provisioningpackagesettings-03.png b/devices/surface-hub/images/provisioningpackagesettings-03.png deleted file mode 100644 index e4538d7368..0000000000 Binary files a/devices/surface-hub/images/provisioningpackagesettings-03.png and /dev/null differ diff --git a/devices/surface-hub/images/proxy-details.PNG b/devices/surface-hub/images/proxy-details.PNG deleted file mode 100644 index fcc7b06a41..0000000000 Binary files a/devices/surface-hub/images/proxy-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/proxy.PNG b/devices/surface-hub/images/proxy.PNG deleted file mode 100644 index cdfc02c454..0000000000 Binary files a/devices/surface-hub/images/proxy.PNG and /dev/null differ diff --git a/devices/surface-hub/images/qos-create.png b/devices/surface-hub/images/qos-create.png deleted file mode 100644 index 7cd4726ddb..0000000000 Binary files a/devices/surface-hub/images/qos-create.png and /dev/null differ diff --git a/devices/surface-hub/images/qos-setting.png b/devices/surface-hub/images/qos-setting.png deleted file mode 100644 index d775d9a46f..0000000000 Binary files a/devices/surface-hub/images/qos-setting.png and /dev/null differ diff --git a/devices/surface-hub/images/recover-from-cloud.png b/devices/surface-hub/images/recover-from-cloud.png deleted file mode 100644 index 7d409edc5f..0000000000 Binary files a/devices/surface-hub/images/recover-from-cloud.png and /dev/null differ diff --git a/devices/surface-hub/images/recover-from-the-cloud.png b/devices/surface-hub/images/recover-from-the-cloud.png deleted file mode 100644 index 07c1e22851..0000000000 Binary files a/devices/surface-hub/images/recover-from-the-cloud.png and /dev/null differ diff --git a/devices/surface-hub/images/recover-progress.png b/devices/surface-hub/images/recover-progress.png deleted file mode 100644 index 316d830a57..0000000000 Binary files a/devices/surface-hub/images/recover-progress.png and /dev/null differ diff --git a/devices/surface-hub/images/reinstall.png b/devices/surface-hub/images/reinstall.png deleted file mode 100644 index 2f307841aa..0000000000 Binary files a/devices/surface-hub/images/reinstall.png and /dev/null differ diff --git a/devices/surface-hub/images/repartition.png b/devices/surface-hub/images/repartition.png deleted file mode 100644 index 26725a8c54..0000000000 Binary files a/devices/surface-hub/images/repartition.png and /dev/null differ diff --git a/devices/surface-hub/images/replacement-port-55.PNG b/devices/surface-hub/images/replacement-port-55.PNG deleted file mode 100644 index 5bf0b51b02..0000000000 Binary files a/devices/surface-hub/images/replacement-port-55.PNG and /dev/null differ diff --git a/devices/surface-hub/images/replacement-port-84.PNG b/devices/surface-hub/images/replacement-port-84.PNG deleted file mode 100644 index 45284b4ab9..0000000000 Binary files a/devices/surface-hub/images/replacement-port-84.PNG and /dev/null differ diff --git a/devices/surface-hub/images/rj11.png b/devices/surface-hub/images/rj11.png deleted file mode 100644 index f044354caa..0000000000 Binary files a/devices/surface-hub/images/rj11.png and /dev/null differ diff --git a/devices/surface-hub/images/rj45.png b/devices/surface-hub/images/rj45.png deleted file mode 100644 index ca88423217..0000000000 Binary files a/devices/surface-hub/images/rj45.png and /dev/null differ diff --git a/devices/surface-hub/images/room-add.png b/devices/surface-hub/images/room-add.png deleted file mode 100644 index 6b0597c41a..0000000000 Binary files a/devices/surface-hub/images/room-add.png and /dev/null differ diff --git a/devices/surface-hub/images/room-control-wiring-diagram.png b/devices/surface-hub/images/room-control-wiring-diagram.png deleted file mode 100644 index 5a2ecf613e..0000000000 Binary files a/devices/surface-hub/images/room-control-wiring-diagram.png and /dev/null differ diff --git a/devices/surface-hub/images/room-equipment.png b/devices/surface-hub/images/room-equipment.png deleted file mode 100644 index 131f8b8c75..0000000000 Binary files a/devices/surface-hub/images/room-equipment.png and /dev/null differ diff --git a/devices/surface-hub/images/roomcontrolwiring.png b/devices/surface-hub/images/roomcontrolwiring.png deleted file mode 100644 index 78da10ce77..0000000000 Binary files a/devices/surface-hub/images/roomcontrolwiring.png and /dev/null differ diff --git a/devices/surface-hub/images/select-room-hybrid-voice.png b/devices/surface-hub/images/select-room-hybrid-voice.png deleted file mode 100644 index 961f8355e8..0000000000 Binary files a/devices/surface-hub/images/select-room-hybrid-voice.png and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-admins-details.PNG b/devices/surface-hub/images/set-up-device-admins-details.PNG deleted file mode 100644 index 42c04b4b3b..0000000000 Binary files a/devices/surface-hub/images/set-up-device-admins-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-admins.PNG b/devices/surface-hub/images/set-up-device-admins.PNG deleted file mode 100644 index e0e037903c..0000000000 Binary files a/devices/surface-hub/images/set-up-device-admins.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-details.PNG b/devices/surface-hub/images/set-up-device-details.PNG deleted file mode 100644 index be565ac8d9..0000000000 Binary files a/devices/surface-hub/images/set-up-device-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device.PNG b/devices/surface-hub/images/set-up-device.PNG deleted file mode 100644 index 0c9eb0e3ff..0000000000 Binary files a/devices/surface-hub/images/set-up-device.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-network-details.PNG b/devices/surface-hub/images/set-up-network-details.PNG deleted file mode 100644 index 7e1391326c..0000000000 Binary files a/devices/surface-hub/images/set-up-network-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-network.PNG b/devices/surface-hub/images/set-up-network.PNG deleted file mode 100644 index a0e856c103..0000000000 Binary files a/devices/surface-hub/images/set-up-network.PNG and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacct.png b/devices/surface-hub/images/setupdeviceacct.png deleted file mode 100644 index 23c2f22171..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacct.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-01.png b/devices/surface-hub/images/setupdeviceacctexch-01.png deleted file mode 100644 index 10710fa4ca..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-01.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-02.png b/devices/surface-hub/images/setupdeviceacctexch-02.png deleted file mode 100644 index b55cb6b87e..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-02.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-03.png b/devices/surface-hub/images/setupdeviceacctexch-03.png deleted file mode 100644 index 4f15b6e025..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-03.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-05.png b/devices/surface-hub/images/setupdeviceacctexch-05.png deleted file mode 100644 index 40dced3c01..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-05.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-06.png b/devices/surface-hub/images/setupdeviceacctexch-06.png deleted file mode 100644 index f4f1686037..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-06.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-07.png b/devices/surface-hub/images/setupdeviceacctexch-07.png deleted file mode 100644 index aebb0ae29e..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-07.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-08.png b/devices/surface-hub/images/setupdeviceacctexch-08.png deleted file mode 100644 index 85c013f98d..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-08.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-09.png b/devices/surface-hub/images/setupdeviceacctexch-09.png deleted file mode 100644 index f36fb9817c..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-09.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-10.png b/devices/surface-hub/images/setupdeviceacctexch-10.png deleted file mode 100644 index 4a5d1aaee4..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-10.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceacctexch-11.png b/devices/surface-hub/images/setupdeviceacctexch-11.png deleted file mode 100644 index 03d320cd55..0000000000 Binary files a/devices/surface-hub/images/setupdeviceacctexch-11.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-02.png b/devices/surface-hub/images/setupdeviceaccto365-02.png deleted file mode 100644 index e0694bac42..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-02.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-03.png b/devices/surface-hub/images/setupdeviceaccto365-03.png deleted file mode 100644 index f93f0f1594..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-03.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-04.png b/devices/surface-hub/images/setupdeviceaccto365-04.png deleted file mode 100644 index 8484394faa..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-04.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-05.png b/devices/surface-hub/images/setupdeviceaccto365-05.png deleted file mode 100644 index 51150e3bcb..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-05.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-06.png b/devices/surface-hub/images/setupdeviceaccto365-06.png deleted file mode 100644 index 3f6567feca..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-06.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-07.png b/devices/surface-hub/images/setupdeviceaccto365-07.png deleted file mode 100644 index ce0eb99af2..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-07.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-08.png b/devices/surface-hub/images/setupdeviceaccto365-08.png deleted file mode 100644 index e174c7d54c..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-08.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-09.png b/devices/surface-hub/images/setupdeviceaccto365-09.png deleted file mode 100644 index 4820c18f0f..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-09.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-10.png b/devices/surface-hub/images/setupdeviceaccto365-10.png deleted file mode 100644 index bb461ddf8d..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-10.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-11.png b/devices/surface-hub/images/setupdeviceaccto365-11.png deleted file mode 100644 index f88d1246aa..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-11.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-12.png b/devices/surface-hub/images/setupdeviceaccto365-12.png deleted file mode 100644 index 29a2fa31d3..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-12.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-13.png b/devices/surface-hub/images/setupdeviceaccto365-13.png deleted file mode 100644 index 3e079c3092..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-13.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-14.png b/devices/surface-hub/images/setupdeviceaccto365-14.png deleted file mode 100644 index da2175f3d1..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-14.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-15.png b/devices/surface-hub/images/setupdeviceaccto365-15.png deleted file mode 100644 index 00e066f97e..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-15.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-16.png b/devices/surface-hub/images/setupdeviceaccto365-16.png deleted file mode 100644 index b6e467c72f..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-16.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-17.png b/devices/surface-hub/images/setupdeviceaccto365-17.png deleted file mode 100644 index e1501c92a1..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-17.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-18.png b/devices/surface-hub/images/setupdeviceaccto365-18.png deleted file mode 100644 index 8f1f3aba04..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-18.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-19.png b/devices/surface-hub/images/setupdeviceaccto365-19.png deleted file mode 100644 index 3e9b2a86fc..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-19.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-20.png b/devices/surface-hub/images/setupdeviceaccto365-20.png deleted file mode 100644 index 210cfb54c8..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-20.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-21.png b/devices/surface-hub/images/setupdeviceaccto365-21.png deleted file mode 100644 index 6ea80e548d..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-21.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-22.png b/devices/surface-hub/images/setupdeviceaccto365-22.png deleted file mode 100644 index cacd3294ad..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-22.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-23.png b/devices/surface-hub/images/setupdeviceaccto365-23.png deleted file mode 100644 index f15727c542..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-23.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-24.png b/devices/surface-hub/images/setupdeviceaccto365-24.png deleted file mode 100644 index a335591f17..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-24.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-25.png b/devices/surface-hub/images/setupdeviceaccto365-25.png deleted file mode 100644 index b49e3e9066..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-25.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdeviceaccto365-26.png b/devices/surface-hub/images/setupdeviceaccto365-26.png deleted file mode 100644 index 5a2841ec32..0000000000 Binary files a/devices/surface-hub/images/setupdeviceaccto365-26.png and /dev/null differ diff --git a/devices/surface-hub/images/setupdomainjoin.png b/devices/surface-hub/images/setupdomainjoin.png deleted file mode 100644 index c42a637981..0000000000 Binary files a/devices/surface-hub/images/setupdomainjoin.png and /dev/null differ diff --git a/devices/surface-hub/images/setupexchangepolicies.png b/devices/surface-hub/images/setupexchangepolicies.png deleted file mode 100644 index 63a4396364..0000000000 Binary files a/devices/surface-hub/images/setupexchangepolicies.png and /dev/null differ diff --git a/devices/surface-hub/images/setupexchangeserver-01.png b/devices/surface-hub/images/setupexchangeserver-01.png deleted file mode 100644 index f3b9dc9e18..0000000000 Binary files a/devices/surface-hub/images/setupexchangeserver-01.png and /dev/null differ diff --git a/devices/surface-hub/images/setupexchangeserver-02.png b/devices/surface-hub/images/setupexchangeserver-02.png deleted file mode 100644 index 58462ec244..0000000000 Binary files a/devices/surface-hub/images/setupexchangeserver-02.png and /dev/null differ diff --git a/devices/surface-hub/images/setupjoiningazuread-1.png b/devices/surface-hub/images/setupjoiningazuread-1.png deleted file mode 100644 index cd24be2c90..0000000000 Binary files a/devices/surface-hub/images/setupjoiningazuread-1.png and /dev/null differ diff --git a/devices/surface-hub/images/setupjoiningazuread-2.png b/devices/surface-hub/images/setupjoiningazuread-2.png deleted file mode 100644 index 9ec163f679..0000000000 Binary files a/devices/surface-hub/images/setupjoiningazuread-2.png and /dev/null differ diff --git a/devices/surface-hub/images/setupjoiningazuread-3.png b/devices/surface-hub/images/setupjoiningazuread-3.png deleted file mode 100644 index abe6691d92..0000000000 Binary files a/devices/surface-hub/images/setupjoiningazuread-3.png and /dev/null differ diff --git a/devices/surface-hub/images/setuplocaladmin.png b/devices/surface-hub/images/setuplocaladmin.png deleted file mode 100644 index 30ac056c5a..0000000000 Binary files a/devices/surface-hub/images/setuplocaladmin.png and /dev/null differ diff --git a/devices/surface-hub/images/setuplocale.png b/devices/surface-hub/images/setuplocale.png deleted file mode 100644 index e9aa468697..0000000000 Binary files a/devices/surface-hub/images/setuplocale.png and /dev/null differ diff --git a/devices/surface-hub/images/setupmsg.jpg b/devices/surface-hub/images/setupmsg.jpg deleted file mode 100644 index 12935483c5..0000000000 Binary files a/devices/surface-hub/images/setupmsg.jpg and /dev/null differ diff --git a/devices/surface-hub/images/setupnamedevice.png b/devices/surface-hub/images/setupnamedevice.png deleted file mode 100644 index 5baa35c487..0000000000 Binary files a/devices/surface-hub/images/setupnamedevice.png and /dev/null differ diff --git a/devices/surface-hub/images/setupnetworksetup-1.png b/devices/surface-hub/images/setupnetworksetup-1.png deleted file mode 100644 index 49dfbde566..0000000000 Binary files a/devices/surface-hub/images/setupnetworksetup-1.png and /dev/null differ diff --git a/devices/surface-hub/images/setupnetworksetup-2.png b/devices/surface-hub/images/setupnetworksetup-2.png deleted file mode 100644 index 4d96e95782..0000000000 Binary files a/devices/surface-hub/images/setupnetworksetup-2.png and /dev/null differ diff --git a/devices/surface-hub/images/setupnetworksetup-3.png b/devices/surface-hub/images/setupnetworksetup-3.png deleted file mode 100644 index 62d6e0a772..0000000000 Binary files a/devices/surface-hub/images/setupnetworksetup-3.png and /dev/null differ diff --git a/devices/surface-hub/images/setupnetworksetup-4.png b/devices/surface-hub/images/setupnetworksetup-4.png deleted file mode 100644 index 836bb208fb..0000000000 Binary files a/devices/surface-hub/images/setupnetworksetup-4.png and /dev/null differ diff --git a/devices/surface-hub/images/setupsecuritygroup-1.png b/devices/surface-hub/images/setupsecuritygroup-1.png deleted file mode 100644 index bab6e2f197..0000000000 Binary files a/devices/surface-hub/images/setupsecuritygroup-1.png and /dev/null differ diff --git a/devices/surface-hub/images/setupsetupadmins.png b/devices/surface-hub/images/setupsetupadmins.png deleted file mode 100644 index 109cb1ea92..0000000000 Binary files a/devices/surface-hub/images/setupsetupadmins.png and /dev/null differ diff --git a/devices/surface-hub/images/setupsetupforyou.png b/devices/surface-hub/images/setupsetupforyou.png deleted file mode 100644 index c0ea230caf..0000000000 Binary files a/devices/surface-hub/images/setupsetupforyou.png and /dev/null differ diff --git a/devices/surface-hub/images/setupskipdeviceacct.png b/devices/surface-hub/images/setupskipdeviceacct.png deleted file mode 100644 index 7a71c7f982..0000000000 Binary files a/devices/surface-hub/images/setupskipdeviceacct.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-bottom.png b/devices/surface-hub/images/sh-55-bottom.png deleted file mode 100644 index 3d718d1226..0000000000 Binary files a/devices/surface-hub/images/sh-55-bottom.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-clearance.png b/devices/surface-hub/images/sh-55-clearance.png deleted file mode 100644 index 12fc35ec49..0000000000 Binary files a/devices/surface-hub/images/sh-55-clearance.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-front.png b/devices/surface-hub/images/sh-55-front.png deleted file mode 100644 index e1268ee328..0000000000 Binary files a/devices/surface-hub/images/sh-55-front.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-guest-ports.png b/devices/surface-hub/images/sh-55-guest-ports.png deleted file mode 100644 index af42c738f8..0000000000 Binary files a/devices/surface-hub/images/sh-55-guest-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-hand-rear.png b/devices/surface-hub/images/sh-55-hand-rear.png deleted file mode 100644 index b1ff007ec2..0000000000 Binary files a/devices/surface-hub/images/sh-55-hand-rear.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-hand.png b/devices/surface-hub/images/sh-55-hand.png deleted file mode 100644 index 6f8d96ba8e..0000000000 Binary files a/devices/surface-hub/images/sh-55-hand.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-rear.png b/devices/surface-hub/images/sh-55-rear.png deleted file mode 100644 index 840b941e03..0000000000 Binary files a/devices/surface-hub/images/sh-55-rear.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-rpc-ports.png b/devices/surface-hub/images/sh-55-rpc-ports.png deleted file mode 100644 index 7df98f2277..0000000000 Binary files a/devices/surface-hub/images/sh-55-rpc-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-55-top.png b/devices/surface-hub/images/sh-55-top.png deleted file mode 100644 index f8c93f5d1b..0000000000 Binary files a/devices/surface-hub/images/sh-55-top.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-bottom.png b/devices/surface-hub/images/sh-84-bottom.png deleted file mode 100644 index d7252537e4..0000000000 Binary files a/devices/surface-hub/images/sh-84-bottom.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-clearance.png b/devices/surface-hub/images/sh-84-clearance.png deleted file mode 100644 index 8fd0cd2c32..0000000000 Binary files a/devices/surface-hub/images/sh-84-clearance.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-front.png b/devices/surface-hub/images/sh-84-front.png deleted file mode 100644 index 8afa0de18b..0000000000 Binary files a/devices/surface-hub/images/sh-84-front.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-guest-ports.png b/devices/surface-hub/images/sh-84-guest-ports.png deleted file mode 100644 index 6c7060154b..0000000000 Binary files a/devices/surface-hub/images/sh-84-guest-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-hand-top.png b/devices/surface-hub/images/sh-84-hand-top.png deleted file mode 100644 index 1e52446eb0..0000000000 Binary files a/devices/surface-hub/images/sh-84-hand-top.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-hand.png b/devices/surface-hub/images/sh-84-hand.png deleted file mode 100644 index 3e84a8a434..0000000000 Binary files a/devices/surface-hub/images/sh-84-hand.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-rear.png b/devices/surface-hub/images/sh-84-rear.png deleted file mode 100644 index 5837d4e185..0000000000 Binary files a/devices/surface-hub/images/sh-84-rear.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-rpc-ports.png b/devices/surface-hub/images/sh-84-rpc-ports.png deleted file mode 100644 index f3a0a52327..0000000000 Binary files a/devices/surface-hub/images/sh-84-rpc-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-side.png b/devices/surface-hub/images/sh-84-side.png deleted file mode 100644 index 6b1ad8385b..0000000000 Binary files a/devices/surface-hub/images/sh-84-side.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-top.png b/devices/surface-hub/images/sh-84-top.png deleted file mode 100644 index badc94af0b..0000000000 Binary files a/devices/surface-hub/images/sh-84-top.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-84-wall.png b/devices/surface-hub/images/sh-84-wall.png deleted file mode 100644 index 15d2e5a848..0000000000 Binary files a/devices/surface-hub/images/sh-84-wall.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-device-family-availability.png b/devices/surface-hub/images/sh-device-family-availability.png deleted file mode 100644 index 30b8a954af..0000000000 Binary files a/devices/surface-hub/images/sh-device-family-availability.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-org-licensing.png b/devices/surface-hub/images/sh-org-licensing.png deleted file mode 100644 index 48c7033715..0000000000 Binary files a/devices/surface-hub/images/sh-org-licensing.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-quick-action.png b/devices/surface-hub/images/sh-quick-action.png deleted file mode 100644 index 3003e464b3..0000000000 Binary files a/devices/surface-hub/images/sh-quick-action.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-select-template.png b/devices/surface-hub/images/sh-select-template.png deleted file mode 100644 index 58ab21481e..0000000000 Binary files a/devices/surface-hub/images/sh-select-template.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-settings-reset-device.png b/devices/surface-hub/images/sh-settings-reset-device.png deleted file mode 100644 index f3a9a6dc5c..0000000000 Binary files a/devices/surface-hub/images/sh-settings-reset-device.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-settings-update-security.png b/devices/surface-hub/images/sh-settings-update-security.png deleted file mode 100644 index 59212d1805..0000000000 Binary files a/devices/surface-hub/images/sh-settings-update-security.png and /dev/null differ diff --git a/devices/surface-hub/images/sh-settings.png b/devices/surface-hub/images/sh-settings.png deleted file mode 100644 index 0134fda740..0000000000 Binary files a/devices/surface-hub/images/sh-settings.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-account2.png b/devices/surface-hub/images/sh2-account2.png deleted file mode 100644 index 2a2267ab7c..0000000000 Binary files a/devices/surface-hub/images/sh2-account2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-account3.png b/devices/surface-hub/images/sh2-account3.png deleted file mode 100644 index b67ff0da37..0000000000 Binary files a/devices/surface-hub/images/sh2-account3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-account4.png b/devices/surface-hub/images/sh2-account4.png deleted file mode 100644 index 7495f28607..0000000000 Binary files a/devices/surface-hub/images/sh2-account4.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-account5.png b/devices/surface-hub/images/sh2-account5.png deleted file mode 100644 index 3dc9061733..0000000000 Binary files a/devices/surface-hub/images/sh2-account5.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-add-group.png b/devices/surface-hub/images/sh2-add-group.png deleted file mode 100644 index eb44ad8cf9..0000000000 Binary files a/devices/surface-hub/images/sh2-add-group.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-add-room.png b/devices/surface-hub/images/sh2-add-room.png deleted file mode 100644 index c53ee340bc..0000000000 Binary files a/devices/surface-hub/images/sh2-add-room.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-apps-assign.png b/devices/surface-hub/images/sh2-apps-assign.png deleted file mode 100644 index f6a91864c8..0000000000 Binary files a/devices/surface-hub/images/sh2-apps-assign.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-assign-group.png b/devices/surface-hub/images/sh2-assign-group.png deleted file mode 100644 index a2d79bcd34..0000000000 Binary files a/devices/surface-hub/images/sh2-assign-group.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-cartridge.png b/devices/surface-hub/images/sh2-cartridge.png deleted file mode 100644 index 3c7a2e83be..0000000000 Binary files a/devices/surface-hub/images/sh2-cartridge.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-config-file.png b/devices/surface-hub/images/sh2-config-file.png deleted file mode 100644 index d8293c8ff6..0000000000 Binary files a/devices/surface-hub/images/sh2-config-file.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-deploy-apps-sync.png b/devices/surface-hub/images/sh2-deploy-apps-sync.png deleted file mode 100644 index 060c29c17f..0000000000 Binary files a/devices/surface-hub/images/sh2-deploy-apps-sync.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-keepout-zones.png b/devices/surface-hub/images/sh2-keepout-zones.png deleted file mode 100644 index bf318963df..0000000000 Binary files a/devices/surface-hub/images/sh2-keepout-zones.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-keypad.png b/devices/surface-hub/images/sh2-keypad.png deleted file mode 100644 index 595bb19341..0000000000 Binary files a/devices/surface-hub/images/sh2-keypad.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-mobile-stand.png b/devices/surface-hub/images/sh2-mobile-stand.png deleted file mode 100644 index 75c64f06f3..0000000000 Binary files a/devices/surface-hub/images/sh2-mobile-stand.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-mount-config.png b/devices/surface-hub/images/sh2-mount-config.png deleted file mode 100644 index 5cde6108a1..0000000000 Binary files a/devices/surface-hub/images/sh2-mount-config.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-onscreen-display.png b/devices/surface-hub/images/sh2-onscreen-display.png deleted file mode 100644 index 4605f50734..0000000000 Binary files a/devices/surface-hub/images/sh2-onscreen-display.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-pen-1.png b/devices/surface-hub/images/sh2-pen-1.png deleted file mode 100644 index 71693c021e..0000000000 Binary files a/devices/surface-hub/images/sh2-pen-1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-pen-pressure.png b/devices/surface-hub/images/sh2-pen-pressure.png deleted file mode 100644 index 67054ca972..0000000000 Binary files a/devices/surface-hub/images/sh2-pen-pressure.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-pen.png b/devices/surface-hub/images/sh2-pen.png deleted file mode 100644 index 06b344d8c5..0000000000 Binary files a/devices/surface-hub/images/sh2-pen.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-ports.png b/devices/surface-hub/images/sh2-ports.png deleted file mode 100644 index 2d30422911..0000000000 Binary files a/devices/surface-hub/images/sh2-ports.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-proxy.png b/devices/surface-hub/images/sh2-proxy.png deleted file mode 100644 index 81946a9906..0000000000 Binary files a/devices/surface-hub/images/sh2-proxy.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-reset.png b/devices/surface-hub/images/sh2-reset.png deleted file mode 100644 index 06b306ec5d..0000000000 Binary files a/devices/surface-hub/images/sh2-reset.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run1.png b/devices/surface-hub/images/sh2-run1.png deleted file mode 100644 index 15aa540166..0000000000 Binary files a/devices/surface-hub/images/sh2-run1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run10.png b/devices/surface-hub/images/sh2-run10.png deleted file mode 100644 index 5e980fa334..0000000000 Binary files a/devices/surface-hub/images/sh2-run10.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run11.png b/devices/surface-hub/images/sh2-run11.png deleted file mode 100644 index 02362bc5da..0000000000 Binary files a/devices/surface-hub/images/sh2-run11.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run12.png b/devices/surface-hub/images/sh2-run12.png deleted file mode 100644 index f619ac4c42..0000000000 Binary files a/devices/surface-hub/images/sh2-run12.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run13.png b/devices/surface-hub/images/sh2-run13.png deleted file mode 100644 index 77b9e3e2a6..0000000000 Binary files a/devices/surface-hub/images/sh2-run13.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run14.png b/devices/surface-hub/images/sh2-run14.png deleted file mode 100644 index d88ca872ca..0000000000 Binary files a/devices/surface-hub/images/sh2-run14.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run2.png b/devices/surface-hub/images/sh2-run2.png deleted file mode 100644 index fd379b2b05..0000000000 Binary files a/devices/surface-hub/images/sh2-run2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run3.png b/devices/surface-hub/images/sh2-run3.png deleted file mode 100644 index 8171beecbf..0000000000 Binary files a/devices/surface-hub/images/sh2-run3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run4.png b/devices/surface-hub/images/sh2-run4.png deleted file mode 100644 index 1a132dfebb..0000000000 Binary files a/devices/surface-hub/images/sh2-run4.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run5.png b/devices/surface-hub/images/sh2-run5.png deleted file mode 100644 index ebfe53f3cb..0000000000 Binary files a/devices/surface-hub/images/sh2-run5.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run6.png b/devices/surface-hub/images/sh2-run6.png deleted file mode 100644 index 896531f4ec..0000000000 Binary files a/devices/surface-hub/images/sh2-run6.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run7.png b/devices/surface-hub/images/sh2-run7.png deleted file mode 100644 index 59e60d84de..0000000000 Binary files a/devices/surface-hub/images/sh2-run7.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run8.png b/devices/surface-hub/images/sh2-run8.png deleted file mode 100644 index ec2daf8e4f..0000000000 Binary files a/devices/surface-hub/images/sh2-run8.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-run9.png b/devices/surface-hub/images/sh2-run9.png deleted file mode 100644 index 5bd3abea88..0000000000 Binary files a/devices/surface-hub/images/sh2-run9.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune1.png b/devices/surface-hub/images/sh2-set-intune1.png deleted file mode 100644 index 9993225210..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune3.png b/devices/surface-hub/images/sh2-set-intune3.png deleted file mode 100644 index f931d828fc..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune5.png b/devices/surface-hub/images/sh2-set-intune5.png deleted file mode 100644 index 9afb1c1445..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune5.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune6.png b/devices/surface-hub/images/sh2-set-intune6.png deleted file mode 100644 index 155cbb9930..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune6.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-set-intune8.png b/devices/surface-hub/images/sh2-set-intune8.png deleted file mode 100644 index a8d9bfe874..0000000000 Binary files a/devices/surface-hub/images/sh2-set-intune8.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-setup-1.png b/devices/surface-hub/images/sh2-setup-1.png deleted file mode 100644 index 1204020f9f..0000000000 Binary files a/devices/surface-hub/images/sh2-setup-1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-setup-2.png b/devices/surface-hub/images/sh2-setup-2.png deleted file mode 100644 index 0d6501782b..0000000000 Binary files a/devices/surface-hub/images/sh2-setup-2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-setup-3.png b/devices/surface-hub/images/sh2-setup-3.png deleted file mode 100644 index 2b827f4405..0000000000 Binary files a/devices/surface-hub/images/sh2-setup-3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-setup-4.png b/devices/surface-hub/images/sh2-setup-4.png deleted file mode 100644 index 0825dadce4..0000000000 Binary files a/devices/surface-hub/images/sh2-setup-4.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-thermal-audio.png b/devices/surface-hub/images/sh2-thermal-audio.png deleted file mode 100644 index 5d9640df9b..0000000000 Binary files a/devices/surface-hub/images/sh2-thermal-audio.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-token.png b/devices/surface-hub/images/sh2-token.png deleted file mode 100644 index 115153a767..0000000000 Binary files a/devices/surface-hub/images/sh2-token.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-token2.png b/devices/surface-hub/images/sh2-token2.png deleted file mode 100644 index 324bc27f63..0000000000 Binary files a/devices/surface-hub/images/sh2-token2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-token3.png b/devices/surface-hub/images/sh2-token3.png deleted file mode 100644 index 04e173d391..0000000000 Binary files a/devices/surface-hub/images/sh2-token3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi1.png b/devices/surface-hub/images/sh2-uefi1.png deleted file mode 100644 index ecb5aad455..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi1.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi10.png b/devices/surface-hub/images/sh2-uefi10.png deleted file mode 100644 index eafc0617a2..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi10.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi2.png b/devices/surface-hub/images/sh2-uefi2.png deleted file mode 100644 index 8dbcb3df84..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi2.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi3.png b/devices/surface-hub/images/sh2-uefi3.png deleted file mode 100644 index f9b0fdb754..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi3.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi4.png b/devices/surface-hub/images/sh2-uefi4.png deleted file mode 100644 index ae6f427772..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi4.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi5.png b/devices/surface-hub/images/sh2-uefi5.png deleted file mode 100644 index 18a780074f..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi5.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi6.png b/devices/surface-hub/images/sh2-uefi6.png deleted file mode 100644 index 7b4390574a..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi6.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi7.png b/devices/surface-hub/images/sh2-uefi7.png deleted file mode 100644 index 0302b41a43..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi7.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi8.png b/devices/surface-hub/images/sh2-uefi8.png deleted file mode 100644 index c5ccc27628..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi8.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-uefi9.png b/devices/surface-hub/images/sh2-uefi9.png deleted file mode 100644 index 4747c398c8..0000000000 Binary files a/devices/surface-hub/images/sh2-uefi9.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-wall-front.png b/devices/surface-hub/images/sh2-wall-front.png deleted file mode 100644 index 349e124bb0..0000000000 Binary files a/devices/surface-hub/images/sh2-wall-front.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-wall-side.png b/devices/surface-hub/images/sh2-wall-side.png deleted file mode 100644 index f09cbda81e..0000000000 Binary files a/devices/surface-hub/images/sh2-wall-side.png and /dev/null differ diff --git a/devices/surface-hub/images/sh2-wcd.png b/devices/surface-hub/images/sh2-wcd.png deleted file mode 100644 index 8a945dfca4..0000000000 Binary files a/devices/surface-hub/images/sh2-wcd.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-complete.png b/devices/surface-hub/images/shrt-complete.png deleted file mode 100644 index 64525f76a3..0000000000 Binary files a/devices/surface-hub/images/shrt-complete.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-done.png b/devices/surface-hub/images/shrt-done.png deleted file mode 100644 index ea05c13051..0000000000 Binary files a/devices/surface-hub/images/shrt-done.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-download.png b/devices/surface-hub/images/shrt-download.png deleted file mode 100644 index 8eee758a54..0000000000 Binary files a/devices/surface-hub/images/shrt-download.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-drive-start.png b/devices/surface-hub/images/shrt-drive-start.png deleted file mode 100644 index 490998f214..0000000000 Binary files a/devices/surface-hub/images/shrt-drive-start.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-drive.png b/devices/surface-hub/images/shrt-drive.png deleted file mode 100644 index 9afeb4b7f3..0000000000 Binary files a/devices/surface-hub/images/shrt-drive.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-guidance.png b/devices/surface-hub/images/shrt-guidance.png deleted file mode 100644 index c878761704..0000000000 Binary files a/devices/surface-hub/images/shrt-guidance.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-shortcut.png b/devices/surface-hub/images/shrt-shortcut.png deleted file mode 100644 index d71d3e163c..0000000000 Binary files a/devices/surface-hub/images/shrt-shortcut.png and /dev/null differ diff --git a/devices/surface-hub/images/shrt-start.png b/devices/surface-hub/images/shrt-start.png deleted file mode 100644 index 93356c889b..0000000000 Binary files a/devices/surface-hub/images/shrt-start.png and /dev/null differ diff --git a/devices/surface-hub/images/sign-in-prov.png b/devices/surface-hub/images/sign-in-prov.png deleted file mode 100644 index 55c9276203..0000000000 Binary files a/devices/surface-hub/images/sign-in-prov.png and /dev/null differ diff --git a/devices/surface-hub/images/sign-in.png b/devices/surface-hub/images/sign-in.png deleted file mode 100644 index bd34f642a7..0000000000 Binary files a/devices/surface-hub/images/sign-in.png and /dev/null differ diff --git a/devices/surface-hub/images/six.png b/devices/surface-hub/images/six.png deleted file mode 100644 index 2816328ec3..0000000000 Binary files a/devices/surface-hub/images/six.png and /dev/null differ diff --git a/devices/surface-hub/images/ssd-click.PNG b/devices/surface-hub/images/ssd-click.PNG deleted file mode 100644 index 5dfcc57c42..0000000000 Binary files a/devices/surface-hub/images/ssd-click.PNG and /dev/null differ diff --git a/devices/surface-hub/images/ssd-lift-door.PNG b/devices/surface-hub/images/ssd-lift-door.PNG deleted file mode 100644 index d395ce91aa..0000000000 Binary files a/devices/surface-hub/images/ssd-lift-door.PNG and /dev/null differ diff --git a/devices/surface-hub/images/ssd-location.PNG b/devices/surface-hub/images/ssd-location.PNG deleted file mode 100644 index 9b774456b1..0000000000 Binary files a/devices/surface-hub/images/ssd-location.PNG and /dev/null differ diff --git a/devices/surface-hub/images/ssd-lock-tab.PNG b/devices/surface-hub/images/ssd-lock-tab.PNG deleted file mode 100644 index 17c11dc7a2..0000000000 Binary files a/devices/surface-hub/images/ssd-lock-tab.PNG and /dev/null differ diff --git a/devices/surface-hub/images/ssd-pull-tab.PNG b/devices/surface-hub/images/ssd-pull-tab.PNG deleted file mode 100644 index a306f08a13..0000000000 Binary files a/devices/surface-hub/images/ssd-pull-tab.PNG and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-1.png b/devices/surface-hub/images/surface-hub-2s-repack-1.png deleted file mode 100644 index c78a536083..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-1.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-10.png b/devices/surface-hub/images/surface-hub-2s-repack-10.png deleted file mode 100644 index ae99a0697a..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-10.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-11.png b/devices/surface-hub/images/surface-hub-2s-repack-11.png deleted file mode 100644 index 1d79a116ef..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-11.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-12.png b/devices/surface-hub/images/surface-hub-2s-repack-12.png deleted file mode 100644 index 67108c5110..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-12.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-13.png b/devices/surface-hub/images/surface-hub-2s-repack-13.png deleted file mode 100644 index 565d0469c5..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-13.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-2.png b/devices/surface-hub/images/surface-hub-2s-repack-2.png deleted file mode 100644 index 117f0d5899..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-2.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-3.png b/devices/surface-hub/images/surface-hub-2s-repack-3.png deleted file mode 100644 index 53afdbd11c..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-3.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-4.png b/devices/surface-hub/images/surface-hub-2s-repack-4.png deleted file mode 100644 index cc213389d9..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-4.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-5.png b/devices/surface-hub/images/surface-hub-2s-repack-5.png deleted file mode 100644 index 202963bcb5..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-5.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-6.png b/devices/surface-hub/images/surface-hub-2s-repack-6.png deleted file mode 100644 index d7617b8f1b..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-6.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-7.png b/devices/surface-hub/images/surface-hub-2s-repack-7.png deleted file mode 100644 index 18310ea9cb..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-7.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-8.png b/devices/surface-hub/images/surface-hub-2s-repack-8.png deleted file mode 100644 index fb5b8929bb..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-8.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-repack-9.png b/devices/surface-hub/images/surface-hub-2s-repack-9.png deleted file mode 100644 index be9ceb2bee..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-repack-9.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png b/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png deleted file mode 100644 index 57ed3f50a6..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png b/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png deleted file mode 100644 index 888d417b0e..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png deleted file mode 100644 index 5924546a4c..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png deleted file mode 100644 index a1d6d6d163..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png deleted file mode 100644 index ddb0ccfc7d..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png deleted file mode 100644 index 1e9156e94f..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png deleted file mode 100644 index 9885cc6c7a..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png deleted file mode 100644 index 54cb393ff4..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png deleted file mode 100644 index e74270f93b..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png deleted file mode 100644 index 39fd3da31f..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png deleted file mode 100644 index c68b5fab64..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png and /dev/null differ diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png deleted file mode 100644 index 6acb8a627d..0000000000 Binary files a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png and /dev/null differ diff --git a/devices/surface-hub/images/surfaceblog.png b/devices/surface-hub/images/surfaceblog.png deleted file mode 100644 index ae996a918c..0000000000 Binary files a/devices/surface-hub/images/surfaceblog.png and /dev/null differ diff --git a/devices/surface-hub/images/surfacehub.png b/devices/surface-hub/images/surfacehub.png deleted file mode 100644 index 1b9b484ab8..0000000000 Binary files a/devices/surface-hub/images/surfacehub.png and /dev/null differ diff --git a/devices/surface-hub/images/surfacemechanics.png b/devices/surface-hub/images/surfacemechanics.png deleted file mode 100644 index ad674466fa..0000000000 Binary files a/devices/surface-hub/images/surfacemechanics.png and /dev/null differ diff --git a/devices/surface-hub/images/switch.png b/devices/surface-hub/images/switch.png deleted file mode 100644 index 5ea0d21909..0000000000 Binary files a/devices/surface-hub/images/switch.png and /dev/null differ diff --git a/devices/surface-hub/images/system-settings-add-fqdn.png b/devices/surface-hub/images/system-settings-add-fqdn.png deleted file mode 100644 index ef00872a16..0000000000 Binary files a/devices/surface-hub/images/system-settings-add-fqdn.png and /dev/null differ diff --git a/devices/surface-hub/images/three.png b/devices/surface-hub/images/three.png deleted file mode 100644 index 887fa270d7..0000000000 Binary files a/devices/surface-hub/images/three.png and /dev/null differ diff --git a/devices/surface-hub/images/trust-package.png b/devices/surface-hub/images/trust-package.png deleted file mode 100644 index 8a293ea4da..0000000000 Binary files a/devices/surface-hub/images/trust-package.png and /dev/null differ diff --git a/devices/surface-hub/images/twitter.png b/devices/surface-hub/images/twitter.png deleted file mode 100644 index 25143adcf6..0000000000 Binary files a/devices/surface-hub/images/twitter.png and /dev/null differ diff --git a/devices/surface-hub/images/two.png b/devices/surface-hub/images/two.png deleted file mode 100644 index b8c2d52eaf..0000000000 Binary files a/devices/surface-hub/images/two.png and /dev/null differ diff --git a/devices/surface-hub/images/usb.png b/devices/surface-hub/images/usb.png deleted file mode 100644 index a743c6b634..0000000000 Binary files a/devices/surface-hub/images/usb.png and /dev/null differ diff --git a/devices/surface-hub/images/vga.png b/devices/surface-hub/images/vga.png deleted file mode 100644 index 016b42d1f4..0000000000 Binary files a/devices/surface-hub/images/vga.png and /dev/null differ diff --git a/devices/surface-hub/images/video-out-55.png b/devices/surface-hub/images/video-out-55.png deleted file mode 100644 index e386b7f3d9..0000000000 Binary files a/devices/surface-hub/images/video-out-55.png and /dev/null differ diff --git a/devices/surface-hub/images/video-out-84.png b/devices/surface-hub/images/video-out-84.png deleted file mode 100644 index 672ae78556..0000000000 Binary files a/devices/surface-hub/images/video-out-84.png and /dev/null differ diff --git a/devices/surface-hub/images/wb-collab-example.png b/devices/surface-hub/images/wb-collab-example.png deleted file mode 100644 index 0ed67c03ea..0000000000 Binary files a/devices/surface-hub/images/wb-collab-example.png and /dev/null differ diff --git a/devices/surface-hub/images/wb-collab-link.png b/devices/surface-hub/images/wb-collab-link.png deleted file mode 100644 index 9b0531d0c0..0000000000 Binary files a/devices/surface-hub/images/wb-collab-link.png and /dev/null differ diff --git a/devices/surface-hub/images/wcd-wizard.PNG b/devices/surface-hub/images/wcd-wizard.PNG deleted file mode 100644 index 706771f756..0000000000 Binary files a/devices/surface-hub/images/wcd-wizard.PNG and /dev/null differ diff --git a/devices/surface-hub/images/whats-new-video-thumbnail.PNG b/devices/surface-hub/images/whats-new-video-thumbnail.PNG deleted file mode 100644 index 44cbffcbb3..0000000000 Binary files a/devices/surface-hub/images/whats-new-video-thumbnail.PNG and /dev/null differ diff --git a/devices/surface-hub/images/who-owns-pc.png b/devices/surface-hub/images/who-owns-pc.png deleted file mode 100644 index d3ce1def8d..0000000000 Binary files a/devices/surface-hub/images/who-owns-pc.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-02a.png b/devices/surface-hub/images/wicd-screen-apps-02a.png deleted file mode 100644 index caf88b011e..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-02a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-03a.png b/devices/surface-hub/images/wicd-screen-apps-03a.png deleted file mode 100644 index 20d4218c6b..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-03a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-04a.png b/devices/surface-hub/images/wicd-screen-apps-04a.png deleted file mode 100644 index 494a661420..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-04a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-06a.png b/devices/surface-hub/images/wicd-screen-apps-06a.png deleted file mode 100644 index 44e6e2cee7..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-06a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-08a.png b/devices/surface-hub/images/wicd-screen-apps-08a.png deleted file mode 100644 index 19ce342449..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-08a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-10a.png b/devices/surface-hub/images/wicd-screen-apps-10a.png deleted file mode 100644 index 820fd3efff..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-10a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-11a.png b/devices/surface-hub/images/wicd-screen-apps-11a.png deleted file mode 100644 index 2bf0a692ef..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-11a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen-apps-12a.png b/devices/surface-hub/images/wicd-screen-apps-12a.png deleted file mode 100644 index 8ab9d524f4..0000000000 Binary files a/devices/surface-hub/images/wicd-screen-apps-12a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen01a.png b/devices/surface-hub/images/wicd-screen01a.png deleted file mode 100644 index 34b528951e..0000000000 Binary files a/devices/surface-hub/images/wicd-screen01a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen02a.png b/devices/surface-hub/images/wicd-screen02a.png deleted file mode 100644 index f76eec1efb..0000000000 Binary files a/devices/surface-hub/images/wicd-screen02a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen02b.png b/devices/surface-hub/images/wicd-screen02b.png deleted file mode 100644 index 6686186f8b..0000000000 Binary files a/devices/surface-hub/images/wicd-screen02b.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen02c.png b/devices/surface-hub/images/wicd-screen02c.png deleted file mode 100644 index eb8fd6b307..0000000000 Binary files a/devices/surface-hub/images/wicd-screen02c.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen03a.png b/devices/surface-hub/images/wicd-screen03a.png deleted file mode 100644 index afec8ef352..0000000000 Binary files a/devices/surface-hub/images/wicd-screen03a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen04a.png b/devices/surface-hub/images/wicd-screen04a.png deleted file mode 100644 index 62ea7e595c..0000000000 Binary files a/devices/surface-hub/images/wicd-screen04a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen06a.png b/devices/surface-hub/images/wicd-screen06a.png deleted file mode 100644 index 53c223746b..0000000000 Binary files a/devices/surface-hub/images/wicd-screen06a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen07a.png b/devices/surface-hub/images/wicd-screen07a.png deleted file mode 100644 index e44f5cf0b7..0000000000 Binary files a/devices/surface-hub/images/wicd-screen07a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen08a.png b/devices/surface-hub/images/wicd-screen08a.png deleted file mode 100644 index 7a2b5bbefb..0000000000 Binary files a/devices/surface-hub/images/wicd-screen08a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen09a.png b/devices/surface-hub/images/wicd-screen09a.png deleted file mode 100644 index 29e14902bd..0000000000 Binary files a/devices/surface-hub/images/wicd-screen09a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen10a.png b/devices/surface-hub/images/wicd-screen10a.png deleted file mode 100644 index 556c9fbdb5..0000000000 Binary files a/devices/surface-hub/images/wicd-screen10a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen11a.png b/devices/surface-hub/images/wicd-screen11a.png deleted file mode 100644 index 9f7bf2ba64..0000000000 Binary files a/devices/surface-hub/images/wicd-screen11a.png and /dev/null differ diff --git a/devices/surface-hub/images/wicd-screen12a.png b/devices/surface-hub/images/wicd-screen12a.png deleted file mode 100644 index 7c55111ae4..0000000000 Binary files a/devices/surface-hub/images/wicd-screen12a.png and /dev/null differ diff --git a/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx b/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx deleted file mode 100644 index 1d44312447..0000000000 Binary files a/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx and /dev/null differ diff --git a/devices/surface-hub/index.yml b/devices/surface-hub/index.yml deleted file mode 100644 index 249deba5a0..0000000000 --- a/devices/surface-hub/index.yml +++ /dev/null @@ -1,127 +0,0 @@ -### YamlMime:Hub - -title: Surface Hub documentation # < 60 chars -summary: Surface Hub 2S is an all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device. # < 160 chars -# brand: aspnet | azure | dotnet | dynamics | m365 | ms-graph | office | power-bi | power-platform | sql | sql-server | vs | visual-studio | windows | xamarin -brand: windows - -metadata: - title: Surface Hub documentation # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Get started with Microsoft Surface Hub. # Required; article description that is displayed in search results. < 160 chars. - services: product-insights - ms.service: product-insights #Required; service per approved list. service slug assigned to your service by ACOM. - ms.topic: hub-page # Required - ms.prod: surface-hub - ms.technology: windows - audience: ITPro - ms.localizationpriority: medium - author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. - ms.author: greglin #Required; microsoft alias of author; optional team alias. - manager: laurawi - -# highlightedContent section (optional) -# Maximum of 8 items -highlightedContent: -# itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new - items: - # Card - - title: What's new in Surface Hub 2S? - itemType: whats-new - url: surface-hub-2s-whats-new.md - # Card - - title: Surface Hub security overview - itemType: learn - url: surface-hub-security.md - # Card - - title: Manage Surface Hub 2S with Intune - itemType: how-to-guide - url: surface-hub-2s-manage-intune.md - # Card - - title: Operating system essentials - itemType: learn - url: differences-between-surface-hub-and-windows-10-enterprise.md - # Card - - title: Surface Hub 2S Site Readiness Guide - itemType: learn - url: surface-hub-2s-site-readiness-guide.md - # Card - - title: Customize Surface Hub 2S installation - itemType: how-to-guide - url: surface-hub-2s-custom-install.md - -# productDirectory section (optional) -productDirectory: - title: Deploy, manage, and support your Surface Hub devices # < 60 chars (optional) - summary: Find related links to deploy, manage and support your Surface Hub devices. # < 160 chars (optional) - items: - # Card - - title: Deploy - # imageSrc should be square in ratio with no whitespace - imageSrc: https://docs.microsoft.com/office/media/icons/deploy-blue.svg - links: - - url: surface-hub-2s-adoption-kit.md - text: Surface Hub 2S adoption and training - - url: surface-hub-2s-deploy-checklist.md - text: Surface Hub 2S deployment checklist - - url: surface-hub-2s-account.md - text: Create device account - # Card - - title: Manage - imageSrc: https://docs.microsoft.com/office/media/icons/process-flow-blue.svg - links: - - url: surface-hub-2s-manage-intune.md - text: Manage with Intune - - url: local-management-surface-hub-settings.md - text: Manage local settings - # Card - - title: Secure - imageSrc: https://docs.microsoft.com/office/media/icons/security-blue.svg - links: - - url: surface-hub-2s-secure-with-uefi-semm.md - text: Secure with UEFI and SEMM - - url: surface-hub-wifi-direct.md - text: Wi-Fi security considerations - # Card - - title: Troubleshoot - imageSrc: https://docs.microsoft.com/office/media/icons/connector-blue.svg - links: - - url: https://support.microsoft.com/help/4493926 - text: Service and warranty - - url: surface-hub-2s-recover-reset.md - text: Recover & reset Surface Hub 2S - - url: support-solutions-surface-hub.md - text: Surface Hub support solutions - - url: https://support.office.com/article/Enable-Microsoft-Whiteboard-on-Surface-Hub-b5df4539-f735-42ff-b22a-0f5e21be7627 - text: Enable Microsoft Whiteboard on Surface Hub - -# additionalContent section (optional) -# Card with links style -additionalContent: - # Supports up to 3 sections - sections: - - title: Other content # < 60 chars (optional) - summary: Find related links for videos, community and support. # < 160 chars (optional) - items: - # Card - - title: Get ready for Surface Hub 2S - links: - - text: Ordering Surface Hub 2S - url: https://www.microsoft.com/p/surface-hub-2S/8P62MW6BN9G4?activetab=pivot:overviewtab - - text: Prepare your environment for Surface Hub 2S - url: surface-hub-2s-prepare-environment.md - # Card - - title: Surface Hub 2S Videos - links: - - text: Adoption and training videos - url: surface-hub-2s-adoption-videos.md - - text: Surface Hub 2S with Teams - url: https://www.youtube.com/watch?v=CH2seLS5Wb0 - - text: Surface Hub 2S with Microsoft 365 - url: https://www.youtube.com/watch?v=I4N2lQX4WyI&list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ&index=7 - # Card - - title: Community - links: - - text: Join the Surface Hub Technical Community - url: https://techcommunity.microsoft.com/t5/Surface-Hub/bd-p/SurfaceHub - - text: Join the Surface Devices Technical Community - url: https://techcommunity.microsoft.com/t5/Surface-Devices/ct-p/SurfaceDevices diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md deleted file mode 100644 index 9e1c8767f5..0000000000 --- a/devices/surface-hub/install-apps-on-surface-hub.md +++ /dev/null @@ -1,188 +0,0 @@ ---- -title: Install apps on your Microsoft Surface Hub -description: Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business. -ms.assetid: 3885CB45-D496-4424-8533-C9E3D0EDFD94 -ms.reviewer: -manager: laurawi -keywords: install apps, Microsoft Store, Microsoft Store for Business -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 10/23/2018 -ms.localizationpriority: medium -audience: ITPro ---- - -# Install apps on your Microsoft Surface Hub - -You can install additional apps on your Surface Hub to fit your team or organization's needs. There are different methods for installing apps depending on whether you are developing and testing an app, or deploying a released app. This topic describes methods for installing apps for either scenario. - -A few things to know about apps on Surface Hub: -- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). Apps created using the [Desktop App Converter](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) will not run on Surface Hub. -- Apps must be targeted for the [Universal device family](https://msdn.microsoft.com/library/windows/apps/dn894631) or Windows Team device family. -- Surface Hub only supports [offline-licensed apps](https://docs.microsoft.com/microsoft-store/distribute-offline-apps) from [Microsoft Store for Business](https://businessstore.microsoft.com/store). -- By default, apps must be Store-signed to be installed. During testing and development, you can also choose to run developer-signed UWP apps by placing the device in developer mode. -- When submitting an app to the Microsoft Store, developers need to set Device family availability and Organizational licensing options to make sure an app will be available to run on Surface Hub. -- You need admin credentials to install apps on your Surface Hub. Since the device is designed to be used in communal spaces like meeting rooms, people can't access the Microsoft Store to download and install apps. - - -## Develop and test apps -While you're developing your own app, there are a few options for testing apps on Surface Hub. - -### Developer Mode -By default, Surface Hub only runs UWP apps that have been published to and signed by the Microsoft Store. Apps submitted to the Microsoft Store go through security and compliance tests as part of the [app certification process](https://msdn.microsoft.com/windows/uwp/publish/the-app-certification-process), so this helps safeguard your Surface Hub against malicious apps. - -By enabling developer mode, you can also install developer-signed UWP apps. - -> [!IMPORTANT] -> After developer mode has been enabled, you will need to reset the Surface Hub to disable it. Resetting the device removes all local user files and configurations and then reinstalls Windows. - -**To turn on developer mode** -1. From your Surface Hub, start **Settings**. -2. Type the device admin credentials when prompted. -3. Navigate to **Update & security** > **For developers**. -4. Select **Developer mode** and accept the warning prompt. - -### Visual Studio -During development, the easiest way to test your app on a Surface Hub is using Visual Studio. Visual Studio's remote debugging feature helps you discover issues in your app before deploying it broadly. For more information, see [Test Surface Hub apps using Visual Studio](https://msdn.microsoft.com/windows/uwp/debug-test-perf/test-surface-hub-apps-using-visual-studio). - -### Provisioning package -Use Visual Studio to [create an app package](https://msdn.microsoft.com/library/windows/apps/hh454036.aspx) for your UWP app, signed using a test certificate. Then use Windows Imaging and Configuration Designer (ICD) to create a provisioning package containing the app package. For more information, see [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md). - - -## Submit apps to the Microsoft Store -Once an app is ready for release, developers need to submit and publish it to the Microsoft Store. For more information, see [Publish Windows apps](https://developer.microsoft.com/store/publish-apps). - -During app submission, developers need to set **Device family availability** and **Organizational licensing** options to make sure the app will be available to run on Surface Hub. - -**To set device family availability** -1. On the [Windows Dev Center](https://developer.microsoft.com), navigate to your app submission page. -2. Select **Packages**. -3. Under **Device family availability**, select these options: - - - **Windows 10 Team** - - **Let Microsoft decide whether to make the app available to any future device families** - -![Image showing Device family availability page - part of Microsoft Store app submission process.](images/device-family.png) - -For more information, see [Device family availability](https://msdn.microsoft.com/windows/uwp/publish/upload-app-packages#device-family-availability). - -**To set organizational licensing** -1. On the [Windows Dev Center](https://developer.microsoft.com), navigate to your app submission page. -2. Select **Pricing and availability**. -3. Under Organizational licensing, select **Allow disconnected (offline) licensing for organizations**. - -![Image showing Organizational licensing page - part of Microsoft Store app submission process.](images/sh-org-licensing.png) - -> [!NOTE] -> **Make my app available to organizations with Store-managed (online) licensing and distribution** is selected by default. - -> [!NOTE] -> Developers can also publish line-of-business apps directly to enterprises without making them broadly available in the Store. For more information, see [Distribute LOB apps to enterprises](https://msdn.microsoft.com/windows/uwp/publish/distribute-lob-apps-to-enterprises). - -For more information, see [Organizational licensing options](https://msdn.microsoft.com/windows/uwp/publish/organizational-licensing). - - -## Deploy released apps - -There are several options for installing apps that have been released to the Microsoft Store, depending on whether you want to evaluate them on a few devices, or deploy them broadly to your organization. - -To install released apps: -- Download the app using the Microsoft Store app, or -- Download the app package from the Microsoft Store for Business, and distribute it using a provisioning package or a supported MDM provider. - -### Microsoft Store app -To evaluate apps released on the Microsoft Store, use the Microsoft Store app on the Surface Hub to browse and download apps. - -> [!NOTE] -> Using the Microsoft Store app is not the recommended method of deploying apps at scale to your organization: -> - To download apps, you must sign in to the Microsoft Store app with a Microsoft account or organizational account. However, you can only connect an account to a maximum of 10 devices at once. If you have more than 10 Surface Hubs, you will need to create multiple accounts or remove devices from your account between app installations. -> - To install apps, you will need to manually sign in to the Microsoft Store app on each Surface Hub you own. - -**To browse the Microsoft Store on Surface Hub** -1. From your Surface Hub, start **Settings**. -2. Type the device admin credentials when prompted. -3. Navigate to **This device** > **Apps & features**. -4. Select **Open Store**. - -### Download app packages from Microsoft Store for Business -To download the app package you need to install apps on your Surface Hub, visit the [Microsoft Store for Business](https://www.microsoft.com/business-store). The Store for Business is where you can find, acquire, and manage apps for the Windows 10 devices in your organization, including Surface Hub. - -> [!NOTE] -> Currently, Surface Hub only supports offline-licensed apps available through the Store for Business. App developers set offline-license availability when they submit apps. - -Find and acquire the app you want, then download: -- The offline-licensed app package (either an .appx or an .appxbundle) -- The *unencoded* license file (if you're using provisioning packages to install the app) -- The *encoded* license file (if you're using MDM to distribute the app) -- Any necessary dependency files - -For more information, see [Download an offline-licensed app](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app). - -### Provisioning package -You can manually install the offline-licensed apps that you downloaded from the Store for Business on a few Surface Hubs using provisioning packages. Use Windows Imaging and Configuration Designer (ICD) to create a provisioning package containing the app package and *unencoded* license file that you downloaded from the Store for Business. For more information, see [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md). - -### Supported MDM provider -To deploy apps to a large number of Surface Hubs in your organization, use a supported MDM provider. The table below shows which MDM providers support deploying offline-licensed app packages. - -| MDM provider | Supports offline-licensed app packages | -|-----------------------------|----------------------------------------| -| On-premises MDM with Configuration Manager (beginning in version 1602) | Yes | -| -| Third-party MDM provider | Check to make sure your MDM provider supports deploying offline-licensed app packages. | - -**To deploy apps remotely using Microsoft Endpoint Configuration Manager** - -> [!NOTE] -> These instructions are based on the current branch of Microsoft Endpoint Configuration Manager. - -1. Enroll your Surface Hubs to Configuration Manager. For more information, see [Enroll a Surface Hub into MDM](manage-settings-with-mdm-for-surface-hub.md#enroll-into-mdm). -2. Download the offline-licensed app package, the *encoded* license file, and any necessary dependency files from the Store for Business. For more information, see [Download an offline-licensed app](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app). Place the downloaded files in the same folder on a network share. -3. In the **Software Library** workspace of the Configuration Manager console, click **Overview** > **Application Management** > **Applications**. -4. On the **Home** tab, in the **Create** group, click **Create Application**. -5. On the **General** page of the **Create Application Wizard**, select the **Automatically detect information about this application from installation files** check box. -6. In the **Type** drop-down list, select **Windows app package (\*.appx, \*.appxbundle)**. -7. In the **Location** field, specify the UNC path in the form \\server\share\\filename for the offline-licensed app package that you downloaded from the Store for Business. Alternatively, click **Browse** to browse to the app package. -8. On the **Import Information** page, review the information that was imported, and then click **Next**. If necessary, you can click **Previous** to go back and correct any errors. -9. On the **General Information** page, complete additional details about the app. Some of this information might already be populated if it was automatically obtained from the app package. -10. Click **Next**, review the application information on the Summary page, and then complete the Create Application Wizard. -11. Create a deployment type for the application. For more information, see [Create deployment types for the application](https://docs.microsoft.com/sccm/apps/deploy-use/create-applications#create-deployment-types-for-the-application). -12. Deploy the application to your Surface Hubs. For more information, see [Deploy applications with Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications). -13. As needed, update the app by downloading a new package from the Store for Business, and publishing an application revision in Configuration Manager. For more information, see [Update and retire applications with Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt595704.aspx). - -> [!NOTE] -> If you are using Microsoft Endpoint Configuration Manager (current branch), you can bypass the above steps by connecting the Store for Business to Configuration Manager. By doing so, you can synchronize the list of apps you've purchased with Configuration Manager, view these in the Configuration Manager console, and deploy them like you would any other app. For more information, see [Manage apps from the Microsoft Store for Business with Configuration Manager](https://technet.microsoft.com/library/mt740630.aspx). - - -## Summary - -There are a few different ways to install apps on your Surface Hub depending on whether you are developing apps, evaluating apps on a small number of devices, or deploying apps broadly to your organization. This table summarizes the supported methods: - -| Install method | Developing apps | Evaluating apps on
a few devices | Deploying apps broadly
to your organization | -| -------------------------- | --------------- | ------------------------------------- | ---------------------- | -| Visual Studio | X | | | -| Provisioning package | X | X | | -| Microsoft Store app | | X | | -| Supported MDM provider | | | X | - -## More information - -- [Blog post: Deploy Windows Store apps to Surface Hub using Intune](https://blogs.technet.microsoft.com/y0av/2018/01/18/7-2/) - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface-hub/juneworkspace.code-workspace b/devices/surface-hub/juneworkspace.code-workspace deleted file mode 100644 index f23e17c3ca..0000000000 --- a/devices/surface-hub/juneworkspace.code-workspace +++ /dev/null @@ -1,11 +0,0 @@ -{ - "folders": [ - { - "path": "C:\\github\\windows-docs-pr" - }, - { - "path": "." - } - ], - "settings": {} -} \ No newline at end of file diff --git a/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md b/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md deleted file mode 100644 index 003795ec22..0000000000 --- a/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Known issues and additional information about Microsoft Surface Hub -description: Outlines known issues with Microsoft Surface Hub. -ms.assetid: aee90a0c-fb05-466e-a2b1-92de89d0f2b7 -keywords: surface, hub, issues -ms.prod: surface-hub -ms.sitesec: library -author: todmccoy -ms.author: v-todmc -ms.topic: article -ms.localizationpriority: medium ---- - -# Known issues and additional information about Microsoft Surface Hub - -We're listening. Quality is a top priority, and we want to keep you informed about issues impacting customers. The following are some known issues of Microsoft Surface Hub: - -- **Skype for Business isn't using proxy for media traffic with RS2** -
For some Surface Hub users who are behind a proxy, Skype for Business won't use the proxy server for media. However, the Surface Hub will be able to sign in to the account. We received your feedback and are aware of the media traffic issue when you are using proxy. We're actively investigating this issue and will release fixes as soon as a solution is identified and tested. - -- **For AAD joined devices, when a user tries to sign in to "My meetings & files", Surface Hub reports that there is no Internet connection** -
We’re aware of a set of issues that affect sign-in and document access on Surface Hub. We're actively investigating these issues. As a workaround until a resolution is released, customers can reset their devices and set up their Hub to use a local admin account. After reconfiguring to use the local admin account, "My meetings and files" will work as expected. -- **Single sign-in when Azure AD joined** -
Surface Hub was designed for communal spaces, which impacts the way user credentials are stored. Because of this, there are currently limitations in how single sign-in works when devices are Azure AD joined. Microsoft is aware of this limitation and is actively investigating options for a resolution. -- **Miracast over Infrastructure projection to Surface Hub fails if the Surface Hub has a dot character (.) in the friendly name** -
Surface Hub users may experience issues projecting to their device if the Friendly Name includes a period or dot in the name (.) -- for example, "Conf.Room42". To work around the issue, change the Friendly Name of the Hub in **Settings** > **Surface Hub** > **About**, and then restart the device. Microsoft is working on a solution to this issue. \ No newline at end of file diff --git a/devices/surface-hub/local-management-surface-hub-settings.md b/devices/surface-hub/local-management-surface-hub-settings.md deleted file mode 100644 index 886e4b79f3..0000000000 --- a/devices/surface-hub/local-management-surface-hub-settings.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Local management Surface Hub settings -description: How to manage Surface Hub settings with Settings. -keywords: manage Surface Hub, Surface Hub settings -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/08/2019 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Local management for Surface Hub settings - -After initial setup of Microsoft Surface Hub, the device’s settings can be locally managed through **Settings**. - -## Surface Hub settings - -Surface Hubs have many settings that are common to other Windows devices, but also have settings which are only configurable on Surface Hubs. This table lists settings only configurable on Surface Hubs. - -| Setting | Location | Description | -| ------- | -------- | ----------- | -| Device account | Surface Hub > Accounts | Set or change the Surface Hub's device account. | -| Device account sync status | Surface Hub > Accounts | Check the sync status of the device account’s mail and calendar on the Surface Hub. | -| Password rotation | Surface Hub > Accounts | Choose whether to let the Surface Hub automatically rotate the device account's password.| -| Change admin account password | Surface Hub > Accounts | Change the password for the local admin account. This is only available if you configured the device to use a local admin during first run. | -| Device Management | Surface Hub > Device management | Manage policies and business applications using mobile device management (MDM). | -| Provisioning packages | Surface Hub > Device management | Set or change provisioning packages installed on the Surface Hub. | -| Open the Microsoft Store app | Surface Hub > Apps & features | The Microsoft Store app is only available to admins through the Settings app. | -| Skype for Business domain name | Surface Hub > Calling & Audio | Configure a domain name for your Skype for Business server. | -| Default Speaker volume | Surface Hub > Calling & Audio | Configure the default speaker volume for the Surface Hub when it starts a session. | -| Default microphone and speaker settings | Surface Hub > Calling & Audio | Configure a default microphone and speaker for calls, and a default speaker for media playback. | -| Enable Dolby Audio X2 | Surface Hub > Calling & Audio | Configure the Dolby Audio X2 speaker enhancements. | -| Open Connect App automatically | Surface Hub > Projection | Choose whether projection will automatically open the Connect app or wait for user input before opening. | -| Turn off wireless projection using Miracast | Surface Hub > Projection | Choose whether presenters can wirelessly project to the Surface Hub using Miracast. | -| Require a PIN for wireless projection | Surface Hub > Projection | Choose whether people are required to enter a PIN before they use wireless projection. | -| Wireless projection (Miracast) channel | Surface Hub > Projection | Set the channel for Miracast projection. | -| Meeting info shown on the welcome screen | Surface Hub > Welcome screen | Choose whether meeting organizer, time, and subject show up on the welcome screen. | -| Welcome screen background | Surface Hub > Welcome screen | Choose a background image for the welcome screen. | -| Idle timeout to Welcome screen | Surface Hub > Session & Power | Choose how long until the Surface Hub returns to the welcome screen after no motion is detected. | -| Resume session | Surface Hub > Session & Power | Choose to allow users to resume a session after no motion is detected or to automatically clean up a session. | -| Access to Office 365 meetings and files | Surface Hub > Session & Power | Choose whether a user can sign in to Office 365 to get access to their meetings and files. | -| Turn on screen with motion sensors | Surface Hub > Session & clean up | Choose whether the screen turns on when motion is detected. | -| Session time out | Surface Hub > Session & clean up | Choose how long the device needs to be inactive before returning to the welcome screen. | -| Sleep time out | Surface Hub > Session & clean up | Choose how long the device needs to be inactive before going to sleep mode. | -| Friendly name | Surface Hub > About | Set the Surface Hub name that people will see when connecting wirelessly. | -| Maintenance hours | Update & security > Windows Update > Advanced options | Configure when updates can be installed. | -| Configure Windows Server Update Services (WSUS) server | Update & security > Windows Update > Advanced options | Change whether Surface Hub receives updates from a WSUS server instead of Windows Update. | -| Recover from the cloud | Update & security > Recovery | Reinstall the operating system on Surface Hub to a manufacturer build from the cloud. | -| Save BitLocker key | Update & security > Recovery | Backup your Surface Hub's BitLocker key to a USB drive. | -| Collect logs | Update & security > Recovery | Save logs to a USB drive to send to Microsoft later. | - -## Related topics - -[Manage Surface Hub settings](manage-surface-hub-settings.md) - -[Remote Surface Hub management](remote-surface-hub-management.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md deleted file mode 100644 index 3762de36a4..0000000000 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ /dev/null @@ -1,280 +0,0 @@ ---- -title: Manage settings with an MDM provider (Surface Hub) -description: Microsoft Surface Hub provides an enterprise management solution to help IT administrators manage policies and business applications on these devices using a mobile device management (MDM) solution. -ms.assetid: 18EB8464-6E22-479D-B0C3-21C4ADD168FE -ms.reviewer: -manager: laurawi -keywords: mobile device management, MDM, manage policies -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 03/07/2018 -ms.localizationpriority: medium ---- - -# Manage settings with an MDM provider (Surface Hub) - -Surface Hub and other Windows 10 devices allow IT administrators to manage settings and policies using a mobile device management (MDM) provider. A built-in management component communicates with the management server, so there is no need to install additional clients on the device. For more information, see [Windows 10 mobile device management](https://msdn.microsoft.com/library/windows/hardware/dn914769.aspx). - -Surface Hub has been validated with Microsoft's first-party MDM providers: -- Microsoft Intune standalone -- On-premises MDM with Microsoft Endpoint Configuration Manager - -You can also manage Surface Hubs using any third-party MDM provider that can communicate with Windows 10 using the MDM protocol. - -## Enroll a Surface Hub into MDM -You can enroll your Surface Hubs using bulk, manual, or automatic enrollment. - -### Bulk enrollment -**To configure bulk enrollment** -- Surface Hub supports the [Provisioning CSP](https://msdn.microsoft.com/library/windows/hardware/mt203665.aspx) for bulk enrollment into MDM. For more information, see [Windows 10 bulk enrollment](https://msdn.microsoft.com/library/windows/hardware/mt613115.aspx).
---OR-- -- If you have an on-premises Microsoft Endpoint Configuration Manager infrastructure, see [How to bulk enroll devices with On-premises Mobile Device Management in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm). - -### Manual enrollment -**To configure manual enrollment** -1. On your Surface Hub, open **Settings**. -2. Type the device admin credentials when prompted. -3. Select **This device**, and navigate to **Device management**. -4. Under **Device management**, select **+ Device management**. -5. Follow the instructions in the dialog to connect to your MDM provider. - -### Automatic enrollment via Azure Active Directory join - -Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory. - -First step is to set up Automatic MDM enrollment. See [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment). - -Then, when devices are setup during First-run, pick the option to join to Azure Active Directory, see [Set up admins for this device page](https://docs.microsoft.com/surface-hub/first-run-program-surface-hub#set-up-admins-for-this-device-page) - -## Manage Surface Hub settings with MDM - -You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings), and some [Windows 10 settings](#supported-windows-10-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and Microsoft Endpoint Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML. - -### Supported Surface Hub CSP settings - -You can configure the Surface Hub settings in the following table using MDM. The table identifies if the setting is supported with Microsoft Intune, Microsoft Endpoint Configuration Manager, or SyncML. - -For more information, see [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323). - - -| Setting | Node in the SurfaceHub CSP | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Maintenance hours | MaintenanceHoursSimple/Hours/StartTime
MaintenanceHoursSimple/Hours/Duration | Yes | Yes | Yes | -| Automatically turn on the screen using motion sensors | InBoxApps/Welcome/AutoWakeScreen | Yes | Yes | Yes | -| Require a pin for wireless projection | InBoxApps/WirelessProjection/PINRequired | Yes | Yes | Yes | -| Enable wireless projection | InBoxApps/WirelessProjection/Enabled | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Miracast channel to use for wireless projection | InBoxApps/WirelessProjection/Channel | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Connect to your Operations Management Suite workspace | MOMAgent/WorkspaceID
MOMAgent/WorkspaceKey | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Welcome screen background image | InBoxApps/Welcome/CurrentBackgroundPath | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Meeting information displayed on the welcome screen | InBoxApps/Welcome/MeetingInfoOption | Yes | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager | Yes | -| Friendly name for wireless projection | Properties/FriendlyName | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Device account, including password rotation | DeviceAccount/*``*
See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). | No | No | Yes | -| Specify Skype domain | InBoxApps/SkypeForBusiness/DomainName | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Auto launch Connect App when projection is initiated | InBoxApps/Connect/AutoLaunch | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Set default volume | Properties/DefaultVolume | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Set screen timeout | Properties/ScreenTimeout | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Set session timeout | Properties/SessionTimeout | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Set sleep timeout | Properties/SleepTimeout | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow session to resume after screen is idle | Properties/AllowSessionResume | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow device account to be used for proxy authentication | Properties/AllowAutoProxyAuth | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Disable auto-populating the sign-in dialog with invitees from scheduled meetings | Properties/DisableSignInSuggestions | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Disable "My meetings and files" feature in Start menu | Properties/DoNotShowMyMeetingsAndFiles | Yes
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Set the LanProfile for 802.1x Wired Auth | Dot3/LanProfile | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Set the EapUserData for 802.1x Wired Auth | Dot3/EapUserData | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -### Supported Windows 10 settings - -In addition to Surface Hub-specific settings, there are numerous settings common to all Windows 10 devices. These settings are defined in the [Configuration service provider reference](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference). - -The following tables include info on Windows 10 settings that have been validated with Surface Hub. There is a table with settings for these areas: security, browser, Windows Updates, Windows Defender, remote reboot, certificates, and logs. Each table identifies if the setting is supported with Microsoft Intune, Microsoft Endpoint Configuration Manager, or SyncML. - -#### Security settings - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|--------------------|------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes.
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
. | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
| Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Browser settings - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|-----------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow developer tools | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Allow Windows Defender SmartScreen | Keep this enabled to turn on Windows Defender SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Prevent ignoring Windows Defender SmartScreen warnings for websites | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Prevent ignoring Windows Defender SmartScreen warnings for files | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Windows Update settings - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Defer feature updates | See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Configure device to use WSUS | Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Windows Defender settings - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|-------------------|----------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Defender policies | Use to configure various Defender settings, including a scheduled scan time. | Defender/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Defender status | Use to initiate a Defender scan, force a Security intelligence update, query any threats detected. | [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/mt187856.aspx) | Yes | Yes | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Remote reboot - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Reboot the device immediately | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes | No | Yes | -| Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | -| Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Install certificates - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|---------------------------------|--------------------------------------------------------------|----------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------| -| Install trusted CA certificates | Use to deploy trusted root and intermediate CA certificates. | [RootCATrustedCertificates CSP](https://msdn.microsoft.com/library/windows/hardware/dn904970.aspx) | Yes.
See [Configure Intune certificate profiles](https://docs.microsoft.com/intune/deploy-use/configure-intune-certificate-profiles). | Yes.
See [How to create certificate profiles in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/create-certificate-profiles). | Yes | - - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Collect logs - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|------------------|----------------------------------------------------|----------------------------------------------------------------------------------------|---------------------------|------------------------------------------|-----------------------------| -| Collect ETW logs | Use to remotely collect ETW logs from Surface Hub. | [DiagnosticLog CSP](https://msdn.microsoft.com/library/windows/hardware/mt219118.aspx) | No | No | Yes | - - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Set network quality of service (QoS) policy - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|------------------------|--------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Set Network QoS Policy | Use to set a QoS policy to perform a set of actions on network traffic. This is useful for prioritizing Skype network packets. | [NetworkQoSPolicy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Set network proxy - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|-------------------|---------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -#### Configure Start menu - -| Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | -|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------| -| Configure Start menu | Use to configure which apps are displayed on the Start menu. For more information, see [Configure Surface Hub Start menu](surface-hub-start-menu.md) | [Policy CSP: Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Yes
[Use a custom policy.](#example-manage-surface-hub-settings-with-microsoft-intune) | Yes.
[Use a custom setting.](#example-manage-surface-hub-settings-with-microsoft-endpoint-configuration-manager) | Yes | - -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -### Generate OMA URIs for settings -You need to use a setting's OMA URI to create a custom policy in Intune, or a custom setting in Microsoft Endpoint Configuration Manager. - -**To generate the OMA URI for any setting in the CSP documentation** -1. In the CSP documentation, identify the root node of the CSP. Generally, this looks like `./Vendor/MSFT/`
-*For example, the root node of the [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) is `./Vendor/MSFT/SurfaceHub`.* -2. Identify the node path for the setting you want to use.
-*For example, the node path for the setting to enable wireless projection is `InBoxApps/WirelessProjection/Enabled`.* -3. Append the node path to the root node to generate the OMA URI.
-*For example, the OMA URI for the setting to enable wireless projection is `./Vendor/MSFT/SurfaceHub/InBoxApps/WirelessProjection/Enabled`.* - -The data type is also stated in the CSP documentation. The most common data types are: -- char (String) -- int (Integer) -- bool (Boolean) - - -## Example: Manage Surface Hub settings with Microsoft Intune - -You can use Microsoft Intune to manage Surface Hub settings. For custom settings, follow the instructions in [How to configure custom device settings in Microsoft Intune](https://docs.microsoft.com/intune/custom-settings-configure). For **Platform**, select **Windows 10 and later**, and in **Profile type**, select **Device restrictions (Windows 10 Team)**. - - - -## Example: Manage Surface Hub settings with Microsoft Endpoint Configuration Manager -Configuration Manager supports managing modern devices that do not require the Configuration Manager client to manage them, including Surface Hub. If you already use Configuration Manager to manage other devices in your organization, you can continue to use the Configuration Manager console as your single location for managing Surface Hubs. - -> [!NOTE] -> These instructions are based on the current branch of Configuration Manager. - -**To create a configuration item for Surface Hub settings** - -1. On the **Assets and Compliance** workspace of the Configuration Manager console, click **Overview** > **Compliance Settings** > **Configuration Items**. -2. On the **Home** tab, in the **Create** group, click **Create Configuration Item**. -3. On the **General** page of the Create Configuration Item Wizard, specify a name and optional description for the configuration item. -4. Under **Settings for devices managed without the Configuration Manager client**, select **Windows 8.1 and Windows 10**, and then click **Next**. - - ![example of UI](images/configmgr-create.png) -5. On the **Supported Platforms** page, expand **Windows 10** and select **All Windows 10 Team and higher**. Unselect the other Windows platforms, and then click **Next**. - - ![select platform](images/configmgr-platform.png) -7. On the **Device Settings** page, under **Device settings groups**, select **Windows 10 Team**. - - -8. On the **Windows 10 Team** page, configure the settings you require. - - ![Windows 10 Team](images/configmgr-team.png) -9. You'll need to create custom settings to manage settings that are not available in the Windows 10 Team page. On the **Device Settings** page, select the check box **Configure additional settings that are not in the default setting groups**. - - ![additional settings](images/configmgr-additional.png) -10. On the **Additional Settings** page, click **Add**. -11. In the **Browse Settings** dialog, click **Create Setting**. -12. In the **Create Setting** dialog, under the **General** tab, specify a name and optional description for the custom setting. -13. Under **Setting type**, select **OMA URI**. -14. Complete the form to create a new setting, and then click **OK**. - - ![OMA URI setting](images/configmgr-oma-uri.png) -15. On the **Browse Settings** dialog, under **Available settings**, select the new setting you created, and then click **Select**. -16. On the **Create Rule** dialog, complete the form to specify a rule for the setting, and then click **OK**. -17. Repeat steps 9 to 15 for each custom setting you want to add to the configuration item. -18. When you're done, on the **Browse Settings** dialog, click **Close**. -19. Complete the wizard.
You can view the new configuration item in the **Configuration Items** node of the **Assets and Compliance** workspace. - -For more information, see [Create configuration items for Windows 8.1 and Windows 10 devices managed without the Microsoft Endpoint Configuration Manager client](https://docs.microsoft.com/configmgr/compliance/deploy-use/create-configuration-items-for-windows-8.1-and-windows-10-devices-managed-without-the-client). - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - - - - - - - - - - - diff --git a/devices/surface-hub/manage-surface-hub-settings.md b/devices/surface-hub/manage-surface-hub-settings.md deleted file mode 100644 index b217ccee4d..0000000000 --- a/devices/surface-hub/manage-surface-hub-settings.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Manage Surface Hub settings -description: This section lists topics for managing Surface Hub settings. -keywords: Surface Hub accessibility settings, device account, device reset, windows updates, wireless network management -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Manage Surface Hub settings - -## In this section - -|Topic | Description| -| ------ | --------------- | -| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | Learn about Surface Hub settings. | -| [Accessibility](accessibility-surface-hub.md) | Accessibility settings for the Surface Hub can be changed by using the Settings app. You'll find them under Ease of Access. Your Surface Hub has the same accessibility options as Windows 10.| -| [Change the Surface Hub device account](change-surface-hub-device-account.md) | You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned.| -| [Device reset](device-reset-surface-hub.md) | You may need to reset your Surface Hub.| -| [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md) | Options to configure domain name with Surface Hub. | -| [Wireless network management](wireless-network-management-for-surface-hub.md) | Surface Hub offers two options for network connectivity to your corporate network and Internet: wireless, and wired. While both provide network access, we recommend you use a wired connection. | diff --git a/devices/surface-hub/manage-surface-hub.md b/devices/surface-hub/manage-surface-hub.md deleted file mode 100644 index 10240a192f..0000000000 --- a/devices/surface-hub/manage-surface-hub.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Manage Microsoft Surface Hub -description: How to manage your Surface Hub after finishing the first-run program. -ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1 -ms.reviewer: -manager: laurawi -keywords: manage Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/17/2018 -ms.localizationpriority: medium ---- - -# Manage Microsoft Surface Hub - -After initial setup of Microsoft Surface Hub, the device’s settings and configuration can be modified or changed in a couple ways: - -- **Local management** - Every Surface Hub can be configured locally using the **Settings** app on the device. To prevent unauthorized users from changing settings, the Settings app requires admin credentials to open the app. For more information, see [Local management for Surface Hub settings](local-management-surface-hub-settings.md). -- **Remote management** - Surface Hub allow IT admins to manage settings and policies using a mobile device management (MDM) provider, such as Microsoft Intune, Microsoft Endpoint Configuration Manager, and other third-party providers. Additionally, admins can monitor Surface Hubs using Microsoft Operations Management Suite (OMS). For more information, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md), and [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). - -> [!NOTE] -> These management methods are not mutually exclusive. Devices can be both locally and remotely managed if you choose. However, MDM policies and settings will overwrite any local changes when the Surface Hub syncs with the management server. - -## In this section - -Learn about managing and updating Surface Hub. - -| Topic | Description | -| ----- | ----------- | -| [Remote Surface Hub management](remote-surface-hub-management.md) |Topics related to managing your Surface Hub remotely. Include install apps, managing settings with MDM and monitoring with Operations Management Suite. | -| [Manage Surface Hub settings](manage-surface-hub-settings.md) |Topics related to managing Surface Hub settings: accessibility, device account, device reset, fully qualified domain name, Windows Update settings, and wireless network | -| [Install apps on your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/install-apps-on-surface-hub) | Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business.| -[Configure Surface Hub Start menu](surface-hub-start-menu.md) | Use MDM to customize the Start menu for Surface Hub. -| [Set up and use Microsoft Whiteboard](whiteboard-collaboration.md) | Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. | -| [End a meeting with End session](https://technet.microsoft.com/itpro/surface-hub/i-am-done-finishing-your-surface-hub-meeting) | At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting.| -| [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md) | You can sign in to a Surface Hub without a password using the Microsoft Authenticator app, available on Android and iOS. | -| [Save your BitLocker key](https://technet.microsoft.com/itpro/surface-hub/save-bitlocker-key-surface-hub) | Every Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.| -| [Connect other devices and display with Surface Hub](https://technet.microsoft.com/itpro/surface-hub/connect-and-display-with-surface-hub) | You can connect other device to your Surface Hub to display content.| -| [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) | You can use Miracast on your wireless network or LAN to connect to Surface Hub. | - [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices. -| [Using a room control system](https://technet.microsoft.com/itpro/surface-hub/use-room-control-system-with-surface-hub) | Room control systems can be used with your Microsoft Surface Hub.| -[Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) | Use the Surface Hub Recovery Tool to re-image the Surface Hub SSD. -[Surface Hub SSD replacement](surface-hub-ssd-replacement.md) | Learn how to remove and replace the solid state drive in your Surface Hub. - -## Related topics - -- [View Power BI presentation mode on Surface Hub & Windows 10](https://powerbi.microsoft.com/documentation/powerbi-mobile-win10-app-presentation-mode/) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md deleted file mode 100644 index 9dee3e2a4b..0000000000 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Manage Windows updates on Surface Hub -description: You can manage Windows updates on your Microsoft Surface Hub or Surface Hub 2S by setting the maintenance window, deferring updates, or using Windows Server Update Services (WSUS). -ms.assetid: A737BD50-2D36-4DE5-A604-55053D549045 -ms.reviewer: -manager: laurawi -keywords: manage Windows updates, Surface Hub, Windows Server Update Services, WSUS -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Manage Windows updates on Surface Hub - -New releases of the Surface Hub operating system are published through Windows Update, just like releases of Windows 10. There are a couple of ways you can manage which updates are installed on your Surface Hubs, and the timing for when updates are applied. -- **Windows Update for Business** - New in Windows 10, Windows Update for Business is a set of features designed to provide enterprises additional control over how and when Windows Update installs releases, while reducing device management costs. Using this method, Surface Hubs are directly connected to Microsoft’s Windows Update service. -- **Windows Server Update Services (WSUS)** - Set of services that enable IT administrators to obtain the updates that Windows Update determines are applicable to the devices in their enterprise, perform additional testing and evaluation on the updates, and select the updates they want to install. Using this method, Surface Hubs will receive updates from WSUS rather than Windows Update. - -You can also configure Surface Hub to receive updates from both Windows Update for Business and WSUS. See [Integrate Windows Update for Business with Windows Server Update Services](https://technet.microsoft.com/itpro/windows/manage/waas-integrate-wufb#integrate-windows-update-for-business-with-windows-server-update-services) for details. - -| Capabilities | Windows Update for Business | Windows Server Update Services (WSUS) | -| ------------ | --------------------------- | ------------------------------------- | -| Receive updates directly from Microsoft's Windows Update service, with no additional infrastructure required. | Yes | No | -| Defer updates to provide additional time for testing and evaluation. | Yes | Yes | -| Deploy updates to select groups of devices. | Yes | Yes | -| Define maintenance windows for installing updates. | Yes | Yes | - -> [!TIP] -> Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Optimize update delivery for Windows 10 updates](https://technet.microsoft.com/itpro/windows/manage/waas-optimize-windows-10-updates) for details. - -> [!NOTE] -> Surface Hub does not currently support rolling back updates. - - -## Surface Hub servicing model - -Surface Hub uses the Windows 10 servicing model, referred to as [Windows as a Service (WaaS)](https://docs.microsoft.com/windows/deployment/update/waas-overview). Traditionally, new features were added only in new versions of Windows that were released every few years. Each new version required lengthy and expensive processes to deploy in an organization. As a result, end users and organizations don't frequently enjoy the benefits of new innovation. The goal of Windows as a Service is to continually provide new capabilities while maintaining a high level of quality. - -Microsoft publishes two types of Surface Hub releases broadly on an ongoing basis: -- **Feature updates** - Updates that install the latest new features, experiences, and capabilities. Microsoft expects to publish two new feature updates per year. -- **Quality updates** - Updates that focus on the installation of security fixes, drivers, and other servicing updates. Microsoft expects to publish one cumulative quality update per month. - -In order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10, including Surface Hub, will be cumulative. This means new feature updates and quality updates will contain the payloads of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 quality update. For example, if a quality update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes. - -The Surface Hub operating system receives updates on the [Semi-Annual Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes). Like other editions of Windows 10, the servicing lifetime is finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates. - -For more information on Windows as a Service, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). - - -## Use Windows Update for Business -Surface Hubs, like all Windows 10 devices, include **Windows Update for Business (WUfB)** to enable you to control how your devices are being updated. Windows Update for Business helps reduce device management costs, provide controls over update deployment, offer quicker access to security updates, as well as provide access to the latest innovations from Microsoft on an ongoing basis. For more information, see [Manage updates using Windows Update for Business](https://technet.microsoft.com/itpro/windows/manage/waas-manage-updates-wufb). - -**To set up Windows Update for Business:** -1. [Group Surface Hub into deployment rings](#group-surface-hub-into-deployment-rings) -2. [Configure when Surface Hub receives updates](#configure-when-surface-hub-receives-updates). - -> [!NOTE] -> You can use Microsoft Intune, Microsoft Endpoint Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune) - - -### Group Surface Hub into deployment rings -Use deployment rings to control when updates roll out to your Surface Hubs, giving you time to validate them. For example, you can update a small pool of devices first to verify quality before a broader roll-out to your organization. Depending on who manages Surface Hub in your organization, consider incorporating Surface Hub into the deployment rings that you've built for your other Windows 10 devices. For more information about deployment rings, see [Build deployment rings for Windows 10 updates](https://technet.microsoft.com/itpro/windows/manage/waas-deployment-rings-windows-10-updates). - -This table gives examples of deployment rings. - -| Deployment ring | Ring size | Servicing branch | Deferral for feature updates | Deferral for quality updates (security fixes, drivers, and other updates) | Validation step | -| --------- | --------- | --------- | --------- | --------- | --------- | -| Preview (e.g. non-critical or test devices) | Small | Windows Insider Preview | None. | None. | Manually test and evaluate new functionality. Pause updates if there are issues. | -| Release (e.g. devices used by select teams) | Medium | Semi-annual channel | None. | None. | Monitor device usage and user feedback. Pause updates if there are issues. | -| Broad deployment (e.g. most of the devices in your organization) | Large | Semi-annual channel | 120 days after release. | 7-14 days after release. | Monitor device usage and user feedback. Pause updates if there are issues. | -| Mission critical (e.g. devices in executive boardrooms) | Small | Semi-annual channel | 180 days after release (maximum deferral for feature updates). | 30 days after release (maximum deferral for quality updates). | Monitor device usage and user feedback. | - - - - - -### Configure when Surface Hub receives updates -Once you've determined deployment rings for your Surface Hubs, configure update deferral policies for each ring: -- To defer feature updates, set an appropriate [Update/DeferFeatureUpdatesPeriodInDays](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays) policy for each ring. -- To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-deferqualityupdatesperiodindays) policy for each ring. - -> [!NOTE] -> If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-pausefeatureupdates) and [Update/PauseQualityUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-pausequalityupdates). - - -## Use Windows Server Update Services - -You can connect Surface Hub to your Windows Server Update Services (WSUS) server to manage updates. Updates will be controlled through approvals or automatic deployment rules configured in your WSUS server, so new upgrades will not be deployed until you choose to deploy them. - -**To manually connect a Surface Hub to a WSUS server:** -1. Open **Settings** on your Surface Hub. -2. Enter the device admin credentials when prompted. -3. Navigate to **Update & security** > **Windows Update** > **Advanced options** > **Configure Windows Server Update Services (WSUS) server**. -4. Click **Use WSUS Server to download updates** and type the URL of your WSUS server. - -To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) policy. - -**If you use a proxy server or other method to block URLs** - -If you use a method other than WSUS to block specific URLs and prevent updates, you will need to add the following Windows update trusted site URLs to the “allow list”: -- `http(s)://*.update.microsoft.com` -- `http://download.windowsupdate.com` -- `http://windowsupdate.microsoft.com` - -Once the Windows 10 Team Anniversary Update is installed, you can remove these addresses to return your Surface Hub to its previous state. - -## Maintenance window - -To ensure the device is always available for use during business hours, Surface Hub performs its administrative functions during a specified maintenance window. During the maintenance window, the Surface Hub automatically installs updates through Windows Update or WSUS, and reboots the device if needed. - -Surface Hub follows these guidelines to apply updates: -- Install the update during the next maintenance window. If a meeting is scheduled to start during a maintenance window, or the Surface Hub sensors detect that the device is being used, the pending update will be postponed to the following maintenance window. -- If the next maintenance window is past the update’s prescribed grace period, the device will calculate the next available slot during business hours using the estimated install time from the update’s metadata. It will continue to postpone the update if a meeting is scheduled, or the Surface Hub sensors detect that the device is being used. -- If the next maintenance window is **not** past the update's grace period, the Surface Hub will continue to postpone the update. -- If a reboot is needed, the Surface Hub will automatically reboot during the next maintenance window. - -> [!NOTE] -> Allow time for updates when you first setup your Surface Hub. For example, a backlog of virus definitions may be available, which should be immediately installed. - -A default maintenance window is set for all new Surface Hubs: -- **Start time:** 3:00 AM -- **Duration:** 1 hour - -**To manually change the maintenance window:** -1. Open **Settings** on your Surface Hub. -2. Navigate to **Update & security** > **Windows Update** > **Advanced options**. -3. Under **Maintenance hours**, select **Change**. - -To change the maintenance window using MDM, set the **MOMAgent** node in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for more details. - - -## More information - -- [Blog post: Servicing, Flighting, and Managing updates for Surface Hub (With Intune, of course!)](https://blogs.technet.microsoft.com/y0av/2018/05/31/7-3/) - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md deleted file mode 100644 index 5ef43af85c..0000000000 --- a/devices/surface-hub/miracast-over-infrastructure.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Miracast on existing wireless network or LAN -description: Windows 10 enables you to send a Miracast stream over a local network. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 04/24/2020 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Miracast over infrastructure - -In the Windows 10, version 1703, Microsoft has extended the ability to send a Miracast stream over a local network rather than over a direct wireless link. This functionality is based on the [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx). - -Miracast over Infrastructure offers a number of benefits: - -- Windows automatically detects when sending the video stream over this path is applicable. -- Windows will only choose this route if the connection is over Ethernet or a secure Wi-Fi network. -- Users do not have to change how they connect to a Miracast receiver. They use the same UX as for standard Miracast connections. -- No changes to current wireless drivers or PC hardware are required. -- It works well with older wireless hardware that is not optimized for Miracast over Wi-Fi Direct. -- It leverages an existing connection which both reduces the time to connect and provides a very stable stream. - - -## How it works - -Users attempt to connect to a Miracast receiver through their Wi-Fi adapter as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection. - -> [!NOTE] -> For more information on the connection negotiation sequence, see [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx) - - - - -## Enabling Miracast over Infrastructure - -If you have a Surface Hub or other Windows 10 device that has been updated to Windows 10, version 1703, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: - -- The Surface Hub or device (Windows PC or phone) needs to be running Windows 10, version 1703. -- Open TCP port: **7250**. -- A Surface Hub or Windows PC can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. - - As a Miracast receiver, the Surface Hub or device must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Surface Hub or device is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. - - As a Miracast source, the Windows PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. -- The DNS Hostname (device name) of the Surface Hub or device needs to be resolvable via your DNS servers. You can achieve this by either allowing your Surface Hub to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the Surface Hub's hostname. -- Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. -- On Windows 10 PCs, the **Projecting to this PC** feature must be enabled in System Settings, and the device must have a Wi-Fi interface enabled in order to respond to discovery requests that only occur through the Wi-Fi adapter. - - -It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network. Users who are guests to a particular location and don’t have access to the enterprise network will continue to connect using the Wi-Fi Direct connection method. - -The **InBoxApps/WirelessProjection/PinRequired** setting in the [SurfaceHub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) is not required for Miracast over Infrastructure. This is because Miracast over Infrastructure only works when both devices are connected to the same enterprise network. This removes the security restriction that was previously missing from Miracast. We recommend that you continue using this setting (if you used it previously) as Miracast will fall back to regular Miracast if the infrastructure connection does not work. - -## FAQ -**Why do I still need Wi-Fi to use Miracast over infrastructure?**
-Discovery requests to identify Miracast receivers can only occur through the Wi-Fi adapter. Once the receivers have been identified, Windows 10 can then attempt the connection to the network. diff --git a/devices/surface-hub/miracast-troubleshooting.md b/devices/surface-hub/miracast-troubleshooting.md deleted file mode 100644 index c4e2ff5b3e..0000000000 --- a/devices/surface-hub/miracast-troubleshooting.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Troubleshoot Miracast on Surface Hub -description: Learn how to resolve issues with Miracast on Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Troubleshoot Miracast on Surface Hub - -Surface Hub supports wireless projection through the Miracast protocol. Most wireless monitors and adapters available today use the original implementation of Miracast. Surface Hub uses a slightly different version of Miracast known as **Miracast Autonomous Group Owner (AGO)**. A common troubleshooting step when projecting wirelessly to Surface Hub fails is to test projecting to another wireless monitor or adapter. However, in most cases, these devices are not using Miracast AGO and do not handle wireless projection the same way that Surface Hub does. - -In traditional Miracast, the projecting device will connect the access point set up by the Miracast-enabled monitor, and then the monitor will send traffic back to the projecting device using the network channel of the projecting device. Miracast AGO is a two-step connection process: - -- The first step is an initial connection using 2.4GHz. -- After that initial handshake, the projecting device sends traffic to the monitor using the wireless channel settings on the monitor. If Surface Hub is connected to a Wi-Fi network, the access point, it will use the same channel as the connected network, otherwise it will use the Miracast channel from Settings. - -There are generally two types of issues with Miracast to Surface Hub: [connection](#connect-issues) and [performance](#performance-issues). In either case, it is a good idea to get a general picture of wireless network activity in the Surface Hub's location. Running a network scanning tool will show you the available networks and channel usage in the environment. - -## Connect issues - -Ensure both Wi-Fi and Miracast are both enabled in Settings on Surface Hub. - -If you ran a network scan, you should see Surface Hub Miracast listed as an access point. If Surface Hub's Miracast network shows up on the scan, but you cannot not see it as an available device, you can try to adjust the Miracast channel used by Surface Hub. - -When Surface Hub is connected to a Wi-Fi network it will use the same channel settings as the Wi-Fi access point for its Miracast access point. For troubleshooting purposes, disconnect Surface Hub from any Wi-Fi networks (but keep Wi-Fi enabled), so you can control the channel used for Miracast. You can manually select the Miracast channel in Settings. You will need to restart Surface Hub after each change. Generally speaking, you will want to use channels that do not show heavy utilization from the network scan. - -It is also possible that the connect issue can be the result of a problem on the connecting device. If the projecting device is running Windows, it should be Windows 8.1 or newer for full Miracast support. Again, for troubleshooting, disconnect the projecting device from any Wi-Fi networks. This will eliminate any channel switching between the access point channel and the Miracast channel set on Surface Hub. Also, some Group Policy and firewall settings may be tied to a Wi-Fi network. - -### Check drivers - -It is also a good idea to ensure the latest drivers and updates are installed on the projecting device. In Device Manager, open the Wi-Fi adapter and video adapter and check for an updated driver version. [Hotfix 3120232](https://support.microsoft.com/help/3120232/poor-wireless-performance-on-5-ghz-connections-on-surface-pro-3-and-surface-3) is highly recommended for Surface Pro 3 and Surface Pro 4 if they are on an older Wi-Fi driver. - -### Check for Miracast support - -Next, ensure Miracast is supported on the device. - -1. Press Windows Key + R and type `dxdiag`. -2. Click "Save all information". -3. Open the saved dxdiag.txt and find **Miracast**. It should say **Available, with HDCP**. - -### Check firewall - -The Windows firewall can block Miracast traffic. The simplest test is to disable the firewall and test projection. If Miracast works with the firewall disabled, add an exception for - - C:\Windows\System32\WUDFHost.exe - Allow In/Out connections for TCP and UDP, Ports: All. - -### Check Group Policy settings - -On domain-joined devices, Group Policy can also block Miracast. - -1. Use the Windows Key + R and type `rsop.msc` to execute the **Resultant Set of Policy** snap-in. This will show the current policies applied to the PC. -2. Review **Computer Configuration** > **Windows Settings** > **Security Settings** > **Wireless Network (IEEE 802.11) Policies**. There should be a setting for wireless policies. -3. Double click the setting for wireless policies and a dialog box will appear. -4. Open the **Network Permissions** tab and select **Allow everyone to create all user profiles**. - -### Check event logs - -The last place to check is in the Event logs. Miracast events will be logged to **Wlanautoconfig**. This is true on both Surface Hub and the projecting device. If you export Surface Hub logs, you can view Surface Hub's Wlanautoconfig in the **WindowsEventLog** folder. Errors in the event log can provide some additional details on where the connection fails. - -## Performance issues - -After wireless projection is connected, it is possible to see performance issues causing latency. This is generally a result of overall channel saturation or a situation that causes channel switching. - -For channel saturation, refer to the network scan and try to use channels with less traffic. - -Channel switching is caused when the Wi-Fi adapter needs to send traffic to multiple channels. Certain channels support Dynamic Frequency Selection (DFS). DFS is used on channels 49 through 148. Some Wi-Fi drivers will show poor performance when connected to a DFS channel. If you are seeing poor Miracast performance while connected to a DFS channel, try the projection on a non-DFS channel. Both Surface Hub and projecting device should use non-DFS channels. - -If Surface Hub and the projecting device are both connected to Wi-Fi but using different access points with different channels, this will force Surface Hub and the projecting device to channel switch while Miracast is connected. This will result in both poor wireless project and poor network performance over Wi-Fi. The channel switching will affect the performance of all wireless traffic, not just wireless projection. - -Channel switching will also occur if the projecting device is connected to an Wi-Fi network using a different channel than the channel that Surface Hub uses for Miracast. So, a best practice is to set Surface Hub's Miracast channel to the same channel as the most commonly used access point. - -If there are multiple Wi-Fi networks or access points in the environment, some channel switching is unavoidable. This is best addressed by ensuring all Wi-Fi drivers are up to date. - -## Contact Support - -If you have questions or need help, you can [create a support request](https://support.microsoft.com/supportforbusiness/productselection). diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md deleted file mode 100644 index 9828a8a268..0000000000 --- a/devices/surface-hub/monitor-surface-hub.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Monitor your Microsoft Surface Hub -description: Monitoring for Microsoft Surface Hub devices is enabled through Microsoft Operations Management Suite (OMS). -ms.assetid: 1D2ED317-DFD9-423D-B525-B16C2B9D6942 -ms.reviewer: -manager: laurawi -keywords: monitor Surface Hub, Microsoft Operations Management Suite, OMS -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Monitor your Microsoft Surface Hub - -Monitoring for Microsoft Surface Hub devices is enabled through Microsoft Operations Management Suite (OMS). The [Operations Management Suite](https://go.microsoft.com/fwlink/?LinkId=718138) is Microsoft's IT management solution that helps you manage and protect your entire IT infrastructure, including your Surface Hubs. - - -Surface Hub is offered as a Log Analytics solution in OMS, allowing you to collect and view usage and reliability data across all your Surface Hubs. Use the Surface Hub solution to: -- Inventory your Surface Hubs. -- View a snapshot of usage and reliability data for Skype meetings, wired and wireless projection, and apps on your Surface Hubs. -- Create custom alerts to respond quickly if your Surface Hubs report software or hardware issues. - -## Add Surface Hub to Operations Management Suite - -1. **Sign in to Operations Management Suite (OMS)**. You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS. -2. **Create a new OMS workspace**. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Select **Create**. -3. **Link Azure subscription to your workspace**. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. - - > [!NOTE] - > If your organization does not have an Azure subscription, create a new one or select the default OMS Azure subscription from the list. Your workspace opens. - -4. **Add Surface Hub solution**. In the Solutions Gallery, select the **Surface Hub** tile in the gallery and then select **Add** on the solution’s details page. The solution is now visible on your workspace. - -## Use the Surface Hub dashboard -From the **Overview** page in your OMS workspace, click the Surface Hub tile to see the Surface Hub dashboard. Use the dashboard to get a snapshot of usage and reliability data across your Surface Hubs. Click into each view on the dashboard to see detailed data, modify the query as desired, and create alerts. - -> [!NOTE] -> Most of these views show data for the past 30 days, but this is subject to your subscription's data retention policy. - -**Active Surface Hubs** - -Use this view to get an inventory of all your Surface Hubs. Once connected to OMS, each Surface Hub periodically sends a "heartbeat" event to the server. This view shows Surface Hubs that have reported a heartbeat in the past 24 hours. - - - -**Wireless projection** - -Use this view to get usage and reliability data for wireless projection over the past 30 days. The graph shows the total number of wireless connections across all your Surface Hubs, which provides an indication whether people in your organization are using this feature. If it's a low number, it may suggest a need to provide training to help people in your organization learn how to wirelessly connect to a Surface Hub. - -Also, the graph shows a breakdown of successful and unsuccessful connections. If you see a high number of unsuccessful connections, devices may not properly support wireless projection using Miracast. For best performance, Microsoft suggests that devices run a WDI Wi-Fi driver and a WDDM 2.0 graphics driver. Use the details view to learn if wireless projection problems are common with particular devices. - -When a connection fails, users can also do the following if they are using a Windows laptop or phone: -- Remove the paired device from **Settings** > **Devices** > **Connected devices**, then try to connect again. -- Reboot the device. - -**Wired projection** - -Use this view to get usage and reliability data for wired projection over the past 30 days. If the graph shows a high number of unsuccessful connections, it may indicate a connectivity issue in your audio-visual pipeline. For example, if you use a HDMI repeater or a center-of-room control panel, they may need to be restarted. - -**Application usage** - -Use this view to get usage data for apps on your Surface Hubs over the past 30 days. The data comes from app launches on your Surface Hubs, not including Skype for Business. This view helps you understand which Surface Hub apps are the most valuable in your organization. If you are deploying new line-of-business apps in your environment, this can also help you understand how often they are being used. - -**Application Crashes** - -Use this view to get reliability data for apps on your Surface Hubs over the past 30 days. The data comes from app crashes on your Surface Hubs. This view helps you detect and notify app developers of poorly behaving in-box and line-of-business apps. - -**Sample Queries** - -Use this to create custom alerts based on a recommended set of queries. Alerts help you respond quickly if your Surface Hubs report software or hardware issues. For more inforamtion, see [Set up alerts using sample queries](#set-up-alerts-with-sample-queries). - -## Set up alerts with sample queries - -Use alerts to respond quickly if your Surface Hubs report software or hardware issues. Alert rules automatically run log searches according to a schedule, and runs one or more actions if the results match specific criteria. For more information, see [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/). - -The Surface Hub Log Analytics solution comes with a set of sample queries to help you set up the appropriate alerts and understand how to resolve issues you may encounter. Use them as a starting point to plan your monitoring and support strategy. - -This table describes the sample queries in the Surface Hub solution: - -| Alert type | Impact | Recommended remediation | Details | -| ---------- | ------ | ----------------------- | ------- | -| Software | Error | **Reboot the device**.
Reboot manually, or using the [Reboot configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt720802(v=vs.85).aspx).
Suggest doing this between meetings to minimize impact to your people in your organization. | Trigger conditions:
- A critical process in the Surface Hub operating system, such as the shell, projection, or Skype, crashes or becomes non-responsive.
- The device hasn't reported a heartbeat in the past 24 hours. This may be due to network connectivity issue or network-related hardware failure, or an error with the diagnostic data reporting system. | -| Software | Error | **Check your Exchange service**.
Verify:
- The service is available.
- The device account password is up to date – see [Password management](password-management-for-surface-hub-device-accounts.md) for details.| Triggers when there's an error syncing the device calendar with Exchange. | -| Software | Error | **Check your Skype for Business service**.
Verify:
- The service is available.
- The device account password is up to date – see [Password management](password-management-for-surface-hub-device-accounts.md) for details.
- The domain name for Skype for Business is properly configured - see [Configure a domain name](use-fully-qualified-domain-name-surface-hub.md). | Triggers when Skype fails to sign in. | -| Software | Error | **Reset the device**.
This takes some time, so you should take the device offline.
For more information, see [Device reset](device-reset-surface-hub.md).| Triggers when there is an error cleaning up user and app data at the end of a session. When this operation repeatedly fails, the device is locked to protect user data. You must reset the device to continue. | -| Hardware | Warning | **None**. Indicates negligible impact to functionality.| Triggers when there is an error with any of the following hardware components:
- Virtual pen slots
- NFC driver
- USB hub driver
- Bluetooth driver
- Proximity sensor
- Graphical performance (video card driver)
- Mismatched hard drive
- No keyboard/mouse detected | -| Hardware | Error | **Contact Microsoft support**.
Indicates impact to core functionality (such as Skype, projection, touch, and internet connectivity).
**Note** Some events, including heartbeat, include the device’s serial number that you can use when contacting support.| Triggers when there is an error with any of the following hardware components.
**Components that affect Skype**:
- Speaker driver
- Microphone driver
- Camera driver
**Components that affect wired and wireless projection**:
- Wired touchback driver
- Wired ingest driver
- Wireless adapter driver
- Wi-Fi Direct error
**Other components**:
- Touch digitizer driver
- Network adapter error (not reported to OMS)| - -**To set up an alert** -1. From the Surface Hub solution, select one of the sample queries. -2. Modify the query as desired. See Log Analytics search reference to learn more. -3. Click **Alert** at the top of the page to open the **Add Alert Rule** screen. See [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/) for details on the options to configure the alert. -4. Click **Save** to complete the alert rule. It will start running immediately. - -## Enroll your Surface Hub - -For Surface Hub to connect to and register with the OMS service, it must have access to the port number of your domains and the URLs. This table list the ports that OMS needs. For more information, see [Configure proxy and firewall settings in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-proxy-firewall/). - ->[!NOTE] ->Surface Hub does not currently support the use of a proxy server to communicate with the OMS service. - -| Agent resource | Ports | Bypass HTTPS inspection? | -| --------------------------- | ----- | ------------------------ | -| *.ods.opinsights.azure.com | 443 | Yes | -| *.oms.opinsights.azure.com | 443 | Yes | -| *.blob.core.windows.net | 443 | Yes | -| ods.systemcenteradvisor.com | 443 | No | - -The Microsoft Monitoring Agent, used to connect devices to OMS, is integrated with the Surface Hub operating system, so there is no need to install additional clients to connect Surface Hub to OMS. - -Once your OMS workspace is set up, there are several ways to enroll your Surface Hub devices: -- [Settings app](#enroll-using-the-settings-app) -- [Provisioning package](#enroll-using-a-provisioning-package) -- [MDM provider](#enroll-using-a-mdm-provider), such as Microsoft Intune and Configuration Manager - -You'll need the workspace ID and primary key of your OMS workspace. You can get these from the OMS portal. - -### Enroll using the Settings app - -**To Enroll using the settings app** - -1. From your Surface Hub, start **Settings**. -2. Enter the device admin credentials when prompted. -3. Select **This device**, and navigate to **Device management**. -4. Under **Monitoring**, select **Configure OMS settings**. -5. In the OMS settings dialog, select **Enable monitoring**. -6. Type the workspace ID and primary key of your OMS workspace. You can get these from the OMS portal. -7. Click **OK** to complete the configuration. - -A confirmation dialog will appear telling you whether or not the OMS configuration was successfully applied to the device. If it was, the device will start sending data to OMS. - -### Enroll using a provisioning package -You can use a provisioning package to enroll your Surface Hub. For more information, see [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md). - -### Enroll using a MDM provider -You can enroll Surface Hub into OMS using the SurfaceHub CSP. Intune and Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. For more information, see [Manage Surface Hub settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md). - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md deleted file mode 100644 index d35f03b804..0000000000 --- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: On-premises deployment single forest (Surface Hub) -description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a single-forest, on-premises deployment. -ms.assetid: 80E12195-A65B-42D1-8B84-ECC3FCBAAFC6 -ms.reviewer: -manager: laurawi -keywords: single forest deployment, on prem deployment, device account, Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.date: 08/28/2018 -ms.localizationpriority: medium ---- - -# On-premises deployment for Surface Hub in a single-forest environment - - -This topic explains how you add a device account for your Microsoft Surface Hub when you have a single-forest, on-premises deployment. - -If you have a single-forest on-premises deployment with Microsoft Exchange 2013 or later and Skype for Business 2013 or later, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-on-premises-ps-scripts) to create device accounts. If you’re using a multi-forest deployment, see [On-premises deployment for Surface Hub in a multi-forest environment](on-premises-deployment-surface-hub-multi-forest.md). - -1. Start a remote PowerShell session from a PC and connect to Exchange. - - Be sure you have the right permissions set to run the associated cmdlets. - - Note here that `$strExchangeServer` is the fully qualified domain name (FQDN) of your Exchange server, and `$strLyncFQDN` is the FQDN of your Skype for Business server. - - ```PowerShell - Set-ExecutionPolicy Unrestricted - $org='contoso.microsoft.com' - $cred=Get-Credential $admin@$org - $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $cred -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue - $sessLync = New-PSSession -Credential $cred -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue - Import-PSSession $sessExchange - Import-PSSession $sessLync - ``` - -2. After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub. - - If you're changing an existing resource mailbox: - - ```PowerShell - Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - - If you’re creating a new resource mailbox: - - ```PowerShell - New-Mailbox -UserPrincipalName HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` -> [!IMPORTANT] -> ActiveSync Virtual Directory Basic Authentication is required to be enabled as the Surface Hub is unable to authenticate using other authentication methods. - -3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - - ```PowerShell - $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false - ``` - - Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too. - - ```PowerShell - $acctUpn = Get-Mailbox -Identity "" - $credNewAccount.Password = ConvertTo-SecureString -String -AsPlainText -Force - Set-Mailbox $acctUpn -Type Regular - Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy - Set-Mailbox $acctUpn -Type Room - Set-Mailbox $acctUpn -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - ``` - -4. Various Exchange properties can be set on the device account to improve the meeting experience for people. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ```PowerShell - Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. - - ```PowerShell - Set-AdUser $acctUpn -PasswordNeverExpires $true - ``` - -6. Enable the account in Active Directory so it will authenticate to the Surface Hub. - - ```PowerShell - Set-AdUser $acctUpn -Enabled $true - ``` - -7. Enable the device account with Skype for Business by enabling your Surface Hub AD account on a Skype for Business Server pool: - - ```PowerShell - Enable-CsMeetingRoom -SipAddress "sip:HUB01@contoso.com" - -DomainController DC-ND-001.contoso.com -RegistrarPool LYNCPool15.contoso.com - -Identity HUB01 - ``` - - You'll need to use the Session Initiation Protocol (SIP) address and domain controller for the Surface Hub, along with your own Skype for Business Server pool identifier and user identity. - -8. OPTIONAL: You can also allow your Surface Hub to make and receive public switched telephone network (PSTN) phone calls by enabling Enterprise Voice for your account. Enterprise Voice isn't a requirement for Surface Hub, but if you want PSTN dialing functionality for the Surface Hub client, here's how to enable it: - - ```PowerShell - Set-CsMeetingRoom -Identity HUB01 -DomainController DC-ND-001.contoso.com -LineURI "tel:+14255550555;ext=50555" -EnterpriseVoiceEnabled $true - ``` - - Again, you need to replace the provided domain controller and phone number examples with your own information. The parameter value `$true` stays the same. - - - ## Disable anonymous email and IM - - - - -Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account. - -Assume you have a per-user client policy assigned to each meeting room device with an identity of **SurfaceHubPolicy**. To disable anonymous email and messaging, you add a clientPolicyEntry to this client policy by using the following commands. - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $false -$clientPolicy = Get-CsClientPolicy -Identity SurfaceHubPolicy -$clientPolicy.PolicyEntry.Add($policyEntry) -Set-CsClientPolicy -Instance $clientPolicy -``` - -To verify that the policy has been set: - -``` -Select-Object -InputObject $clientPolicy -Property PolicyEntry -``` - -The output should be: - -``` -PolicyEntry ------------ -{Name=AllowResourceAccountSendMessage;Value=False} -``` - - -To change the policy entry: - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true -$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Replace = $policyEntry} -``` - -To remove the policy entry: - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true -$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Remove = $policyEntry} -``` - - - - - - - diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md deleted file mode 100644 index 170dd03968..0000000000 --- a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md +++ /dev/null @@ -1,148 +0,0 @@ ---- -title: On-premises deployment multi-forest (Surface Hub) -description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a multi-forest, on-premises deployment. -keywords: multi forest deployment, on prem deployment, device account, Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.date: 08/28/2018 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# On-premises deployment for Surface Hub in a multi-forest environment - - -This topic explains how you add a device account for your Microsoft Surface Hub when you have a multi-forest, on-premises deployment. - -If you have a multi-forest on-premises deployment with Microsoft Exchange 2013 or later and Skype for Business 2013 or later, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-on-premises-ps-scripts) to create device accounts. If you’re using a single-forest deployment, see [On-premises deployment for Surface Hub in a single-forest environment](on-premises-deployment-surface-hub-device-accounts.md). - -1. Start a remote PowerShell session from a PC and connect to Exchange. - - Be sure you have the right permissions set to run the associated cmdlets. - - Note here that `$strExchangeServer` is the fully qualified domain name (FQDN) of your Exchange server, and `$strLyncFQDN` is the FQDN of your Skype for Business server. - - ```PowerShell - Set-ExecutionPolicy Unrestricted - $org='contoso.microsoft.com' - $cred=Get-Credential $admin@$org - $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $cred -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue - $sessLync = New-PSSession -Credential $cred -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue - Import-PSSession $sessExchange - Import-PSSession $sessLync - ``` - -2. After establishing a session, create a new mailbox in the Resource Forest. This will allow the account to authenticate into the Surface Hub. - - If you're changing an existing resource mailbox: - - ```PowerShell - New-Mailbox -UserPrincipalName HUB01@contoso.com -Alias HUB01 -Name "Hub-01" - ``` - -3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to **False**. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet-—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - - ```PowerShell - $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false - ``` - - Once you have a compatible policy, then you will need to apply the policy to the device account. - - ```PowerShell - Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy -ActiveSyncEnabled $true - Set-Mailbox $acctUpn -Type Room - ``` - -4. Various Exchange properties can be set on the device account to improve the meeting experience for people. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ```PowerShell - Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. This should be set in the User Forest. - - ```PowerShell - Set-AdUser $acctUpn -PasswordNeverExpires $true - ``` - -6. Enable the account in Active Directory so it will authenticate to the Surface Hub. This should be set in the User Forest. - - ```PowerShell - Set-AdUser $acctUpn -Enabled $true - ``` - -6. You now need to change the room mailbox to a linked mailbox: - - ```PowerShell - $cred=Get-Credential AuthForest\ADAdmin - Set-mailbox -Alias LinkedRoomTest1 -LinkedMasterAccount AuthForest\LinkedRoomTest1 -LinkedDomainController AuthForest-4939.AuthForest.extest.contoso.com -Name LinkedRoomTest1 -LinkedCredential $cred -Identity LinkedRoomTest1 - ``` - -7. Enable the device account with Skype for Business by enabling your Surface Hub AD account on a Skype for Business Server pool: - - ```PowerShell - Enable-CsMeetingRoom -SipAddress "sip:HUB01@contoso.com" - -DomainController DC-ND-001.contoso.com -RegistrarPool LYNCPool15.contoso.com - -Identity HUB01 - ``` - - You'll need to use the Session Initiation Protocol (SIP) address and domain controller for the Surface Hub, along with your own Skype for Business Server pool identifier and user identity. - - -## Disable anonymous email and IM - - - -Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account. - -Assume you have a per-user client policy assigned to each meeting room device with an identity of **SurfaceHubPolicy**. To disable anonymous email and messaging, you add a clientPolicyEntry to this client policy by using the following commands. - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $false -$clientPolicy = Get-CsClientPolicy -Identity SurfaceHubPolicy -$clientPolicy.PolicyEntry.Add($policyEntry) -Set-CsClientPolicy -Instance $clientPolicy -``` - -To verify that the policy has been set: - -``` -Select-Object -InputObject $clientPolicy -Property PolicyEntry -``` - -The output should be: - -``` -PolicyEntry ------------ -{Name=AllowResourceAccountSendMessage;Value=False} -``` - - -To change the policy entry: - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true -$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Replace = $policyEntry} -``` - -To remove the policy entry: - -``` -$policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true -$clientPolicy | Set-CsClientPolicy -PolicyEntry @{Remove = $policyEntry} -``` -  - - - - - diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md deleted file mode 100644 index 30f0e34b1f..0000000000 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Online deployment with Office 365 (Surface Hub) -description: This topic has instructions for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. -ms.assetid: D325CA68-A03F-43DF-8520-EACF7C3EDEC1 -ms.reviewer: -manager: laurawi -keywords: device account for Surface Hub, online deployment -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 02/21/2018 -ms.localizationpriority: medium ---- - -# Online deployment with Office 365 (Surface Hub) - - -This topic has instructions for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment. - -If you have a pure, online (O365) deployment, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-os356-ps-scripts) to create device accounts. - -1. Start a remote PowerShell session on a PC and connect to Exchange. - - Be sure you have the right permissions set to run the associated cmdlets. - - ```PowerShell - Set-ExecutionPolicy RemoteSigned - $org='contoso.microsoft.com' - $cred=Get-Credential admin@$org - $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection - Import-PSSession $sess - ``` - -2. After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub. - - If you're changing an existing resource mailbox: - - ```PowerShell - Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - - If you’re creating a new resource mailbox: - - ```PowerShell - New-Mailbox -MicrosoftOnlineServicesID HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - -3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts. - - ```PowerShell - $easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false -AllowNonProvisionableDevices $True - ``` - - Once you have a compatible policy, then you will need to apply the policy to the device account. - - ```PowerShell - Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.Id - ``` - -4. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. - - ```PowerShell - Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -5. Connect to Azure AD. - - You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command : - - ```PowerShell - Install-Module -Name AzureAD - ``` - You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect. - - ```PowerShell - Import-Module AzureAD - Connect-AzureAD -Credential $cred - ``` - -6. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information. - - ```PowerShell - Set-AzureADUser -ObjectId "HUB01@contoso.com" -PasswordPolicies "DisablePasswordExpiration" - ``` - -7. Surface Hub requires a license for Skype for Business functionality. In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](hybrid-deployment-surface-hub-device-accounts.md#skype-for-business-online). - - Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant. - - Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable. - - ```PowerShell - Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US" - - Get-AzureADSubscribedSku | Select Sku*,*Units - $License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense - $License.SkuId = SkuId You selected - - $AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses - $AssignedLicenses.AddLicenses = $License - $AssignedLicenses.RemoveLicenses = @() - - Set-AzureADUserLicense -ObjectId "HUB01@contoso.com" -AssignedLicenses $AssignedLicenses - ``` - -8. Enable the device account with Skype for Business. - If the Skype for Business PowerShell module is not installed, [download the Skype for Business Online Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366). - - - Start by creating a remote PowerShell session from a PC. - - ```PowerShell - Import-Module SkypeOnlineConnector - $cssess=New-CsOnlineSession -Credential $cred - Import-PSSession $cssess -AllowClobber - ``` - - - Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, alice@contoso.com): - - ```PowerShell - Get-CsOnlineUser -Identity 'alice@contoso.com' | fl registrarpool - ``` - OR by setting a variable - - ```PowerShell - $strRegistrarPool = Get-CsOnlineUser -Identity 'alice@contoso.com' | fl registrarpool | out-string - $strRegistrarPool = $strRegistrarPool.Substring($strRegistrarPool.IndexOf(':') + 2) - ``` - - - Enable the Surface Hub account with the following cmdlet: - - ```PowerShell - Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress - ``` - - OR using the $strRegistarPool variable from above - - ```PowerShell - Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool $strRegistrarPool -SipAddressType EmailAddress - ``` - -For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account. - - - - - diff --git a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md deleted file mode 100644 index 1ef2fcaa46..0000000000 --- a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Password management (Surface Hub) -description: Every Microsoft Surface Hub device account requires a password to authenticate and enable features on the device. -ms.assetid: 0FBFB546-05F0-430E-905E-87111046E4B8 -ms.reviewer: -manager: laurawi -keywords: password, password management, password rotation, device account -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Password management (Surface Hub) - -Every Microsoft Surface Hub device account requires a password to authenticate and enable features on the device. For security reasons, you may want to change (or "rotate") this password regularly. However, if the device account’s password changes, the password that was previously stored on the Surface Hub will be invalid, and all features that depend on the device account will be disabled. You will need to update the device account’s password on the Surface Hub from the Settings app to re-enable these features. - -To simplify password management for your Surface Hub device accounts, there are two options: - -1. Turn off password expiration for the device account. -2. Allow the Surface Hub to automatically rotate the device account’s password. - - -## Turn off password rotation for the device account - -Set the device account’s **PasswordNeverExpires** property to True. You should verify whether this meets your organization’s security requirements. - - -## Allow the Surface Hub to automatically rotate the device account’s password - -The Surface Hub can manage a device account’s password by changing it frequently without requiring you to manually update the device account’s information. You can enable this feature in **Settings**. Once enabled, the device account's password will change weekly during maintenance hours. - -Note that when the device account’s password is changed, you will not be shown the new password. If you need to sign in to the account, or to provide the password again (for example, if you want to change the device account settings on the Surface Hub), then you'll need use Active Directory or the Office 365 admin portal to reset the password. - -> [!IMPORTANT] -> If your organization uses a hybrid topology (some services are hosted on-premises and some are hosted online through Office 365), you must setup the device account in **domain\username** format. Otherwise, password rotation will not work. diff --git a/devices/surface-hub/physically-install-your-surface-hub-device.md b/devices/surface-hub/physically-install-your-surface-hub-device.md deleted file mode 100644 index aeadcb900a..0000000000 --- a/devices/surface-hub/physically-install-your-surface-hub-device.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Physically install Microsoft Surface Hub -description: The Microsoft Surface Hub Readiness Guide will help make sure that your site is ready for the installation. -ms.assetid: C764DBFB-429B-4B29-B4E8-D7F0073BC554 -ms.reviewer: -manager: laurawi -keywords: Surface Hub, readiness guide, installation location, mounting options -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Physically install Microsoft Surface Hub - - -The [Microsoft Surface Hub Readiness Guide](surface-hub-site-readiness-guide.md) will help make sure that your site is ready for the installation. It includes planning information for both the 55" and 84" devices, as well as info on moving the Surface Hub from receiving to the installation location, mounting options, and a list of what's in the box. - -You may also want to check out the Unpacking Guide. It will show you how to unpack the devices efficiently and safely. There are two guides, one for the 55" and one for the 84". A printed version of the Unpacking Guide is attached to the outside front of each unit's shipping crate. - -- Download the 55" Unpacking Guide from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=718145). -- Download the 84" version from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=718146). - -  - -  - - - - - diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md deleted file mode 100644 index 69ca8e6c3e..0000000000 --- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Prepare your environment for Microsoft Surface Hub -description: This section contains an overview of the steps required to prepare your environment so that you can use all of the features of Microsoft Surface Hub. -ms.assetid: 336A206C-5893-413E-A270-61BFF3DF7DA9 -ms.reviewer: -manager: laurawi -keywords: prepare environment, features of Surface Hub, create and test device account, check network availability -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 12/04/2017 -ms.localizationpriority: medium ---- - -# Prepare your environment for Microsoft Surface Hub - - -This section contains an overview of setup dependencies and the setup process. Review the info in this section to help you prepare your environment and gather information needed to set up your Surface Hub. - - -## Review infrastructure dependencies -Review these dependencies to make sure Surface Hub features will work in your IT infrastructure. - -| Dependency | Purpose | -|-------------|------------------| -| Active Directory or Azure Active Directory (Azure AD) |

The Surface Hub's uses an Active Directory or Azure AD account (called a **device account**) to access Exchange and Skype for Business services. The Surface Hub must be able to connect to your Active Directory domain controller or to your Azure AD tenant in order to validate the device account’s credentials, as well as to access information like the device account’s display name, alias, Exchange server, and Session Initiation Protocol (SIP) address.

You can also domain join or Azure AD join your Surface Hub to allow a group of authorized users to configure settings on the Surface Hub. | -| Exchange (Exchange 2013 or later, or Exchange Online) and Exchange ActiveSync |

Exchange is used for enabling mail and calendar features, and also lets people who use the device send meeting requests to the Surface Hub, enabling one-touch meeting join.

ActiveSync is used to sync the device account’s calendar and mail to the Surface Hub. If the device cannot use ActiveSync, it will not show meetings on the welcome screen, and joining meetings and emailing whiteboards will not be enabled. | -| Skype for Business (Lync Server 2013 or later, or Skype for Business Online) | Skype for Business is used for various conferencing features, like video calls, instant messaging, and screen sharing.| -| Mobile device management (MDM) solution (Microsoft Intune, Microsoft Endpoint Configuration Manager, or supported third-party MDM provider) | If you want to apply settings and install apps remotely, and to multiple devices at a time, you must set up a MDM solution and enroll the device to that solution. See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for details. | -| Microsoft Operations Management Suite (OMS) | OMS is used to monitor the health of Surface Hub devices. See [Monitor your Surface Hub](monitor-surface-hub.md) for details. | -| Network and Internet access | In order to function properly, the Surface Hub should have access to a wired or wireless network. Overall, a wired connection is preferred. 802.1X Authentication is supported for both wired and wireless connections.


**802.1X authentication:** In Windows 10, version 1703, 802.1X authentication for wired and wireless connections is enabled by default in Surface Hub. If your organization doesn't use 802.1X authentication, there is no configuration required and Surface Hub will continue to function as normal. If you use 802.1X authentication, you must ensure that the authentication certification is installed on Surface Hub. You can deliver the certificate to Surface Hub using the [ClientCertificateInstall CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/clientcertificateinstall-csp) in MDM, or you can [create a provisioning package](provisioning-packages-for-surface-hub.md) and install it during first run or through the Settings app. After the certificate is applied to Surface Hub, 802.1X authentication will start working automatically.
**Note:** For more information on enabling 802.1X wired authentication on Surface Hub, see [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md).

**Dynamic IP:** The Surface Hub cannot be configured to use a static IP. It must use DHCP to assign an IP address.

**Proxy servers:** If your topology requires a connection to a proxy server to reach Internet services, then you can configure it during first run, or in Settings. Proxy credentials are stored across Surface Hub sessions and only need to be set once. | - -Additionally, note that Surface Hub requires the following open ports: -- HTTPS: 443 -- HTTP: 80 -- NTP: 123 - -If you are using Surface Hub with Skype for Business, you will need to open additional ports. Please follow the guidance below: -- If you use Skype for Business Online, see [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). -- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols). -- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://docs.microsoft.com/SkypeForBusiness/plan-your-deployment/network-requirements/ports-and-protocols?toc=/SkypeForBusiness/toc.json&bc=/SkypeForBusiness/breadcrumb/toc.json). - -Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list: -- Diagnostic data client endpoint: `https://vortex.data.microsoft.com/` -- Diagnostic data settings endpoint: `https://settings.data.microsoft.com/` - -### Proxy configuration - -If your organization restricts computers on your network from connecting to the Internet, there is a set of URLs that need to be available for devices to use Microsoft Store for Business. Some of the Store for Business features use Microsoft Store app and Microsoft Store services. Devices using Store for Business – either to acquire, install, or update apps – will need access to these URLs. If you use a proxy server to block traffic, your configuration needs to allow these URLs: - -- login.live.com -- login.windows.net -- account.live.com -- clientconfig.passport.net -- windowsphone.com -- *.wns.windows.com -- *.microsoft.com -- www.msftncsi.com (prior to Windows 10, version 1607) -- www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com starting with Windows 10, version 1607) - - -## Work with other admins - -Surface Hub interacts with a few different products and services. Depending on the size of your organization, there could be multiple people supporting different products in your environment. You'll want to include people who manage Exchange, Active Directory (or Azure Active Directory), mobile device management (MDM), and network resources in your planning and prep for Surface Hub deployments. - - -## Create and verify device account - -A device account is an Exchange resource account that Surface Hub uses to display its meeting calendar, join Skype for Business calls, send email, and (optionally) to authenticate to Exchange. See [Create and test a device account](create-and-test-a-device-account-surface-hub.md) for details. - -After you've created your device account, to verify that it's setup correctly, run Surface Hub device account validation PowerShell scripts. For more information, see [PowerShell scripts for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) later in this guide. - - - -## Prepare for first-run program -There are a few more item to consider before you start the [first-run program](first-run-program-surface-hub.md). - -### Create provisioning packages (optional) -You can use provisioning packages to add certificates, customize settings and install apps. See [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md) for details. You can [install provisioning packages at first-run](first-run-program-surface-hub.md#first-page). - -### Set up admin groups -Every Surface Hub can be configured locally using the Settings app on the device. To prevent unauthorized users from changing settings, the Settings app requires admin credentials to open the app. See [Admin group management](admin-group-management-for-surface-hub.md) for details on how admin groups are set up and managed. You will [set up admins for the device at first run](first-run-program-surface-hub.md#setup-admins). - -### Review and complete Surface Hub setup worksheet (optional) -When you go through the first-run program for your Surface Hub, there's some information that you'll need to supply. The setup worksheet summarizes that info, and provides lists of environment-specific info that you'll need when you go through the first-run program. For more information, see [Setup worksheet](setup-worksheet-surface-hub.md). - - -## In this section - - ---- - - - - - - - - - - - - - - - - - - - - -
TopicDescription

Create and test a device account

This topic introduces how to create and test the device account that Surface Hub uses to communicate with and Skype.

Create provisioning packages

For Windows 10, settings that use the registry or a content services platform (CSP) can be configured using provisioning packages. You can also add certificates during first run using provisioning.

Admin group management

Every Surface Hub can be configured individually by opening the Settings app on the device. However, to prevent people who are not administrators from changing the settings, the Settings app requires administrator credentials to open the app and change settings.

-

The Settings app requires local administrator credentials to open the app.

- -## More information - -- [Blog post: Surface Hub and the Skype for Business Trusted Domain List](https://blogs.technet.microsoft.com/y0av/2017/10/25/95/) -- [Blog post: Surface Hub in a Multi-Domain Environment](https://blogs.technet.microsoft.com/y0av/2017/11/08/11/) -- [Blog post: Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/) - - - - - - - - - diff --git a/devices/surface-hub/provisioning-packages-for-surface-hub.md b/devices/surface-hub/provisioning-packages-for-surface-hub.md deleted file mode 100644 index 305403b9dc..0000000000 --- a/devices/surface-hub/provisioning-packages-for-surface-hub.md +++ /dev/null @@ -1,322 +0,0 @@ ---- -title: Create provisioning packages (Surface Hub) -description: For Windows 10, settings that use the registry or a configuration service provider (CSP) can be configured using provisioning packages. -ms.assetid: 8AA25BD4-8A8F-4B95-9268-504A49BA5345 -ms.reviewer: -manager: laurawi -keywords: add certificate, provisioning package -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 03/16/2019 -ms.localizationpriority: medium ---- - -# Create provisioning packages (Surface Hub) - -This topic explains how to create a provisioning package using the Windows Configuration Designer, and apply it to Surface Hub devices. For Surface Hub, you can use provisioning packages to add certificates, install Universal Windows Platform (UWP) apps, and customize policies and settings. - -You can apply a provisioning package using a USB stick during first-run setup, or through the **Settings** app. - - -## Advantages -- Quickly configure devices without using a mobile device management (MDM) provider. - -- No network connectivity required. - -- Simple to apply. - -[Learn more about the benefits and uses of provisioning packages.](https://technet.microsoft.com/itpro/windows/configure/provisioning-packages) - - -## Requirements - -To create and apply a provisioning package to a Surface Hub, you'll need the following: - -- Windows Configuration Designer, which can be installed from Microsoft Store or from the Windows 10 Assessment and Deployment Kit (ADK). [Learn how to install Windows Configuration Designer.](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd) -- A USB stick. -- If you apply the package using the **Settings** app, you'll need device admin credentials. - -You create the provisioning package on a PC running Windows 10, save the package to a USB drive, and then deploy it to your Surface Hub. - - -## Supported items for Surface Hub provisioning packages - -Using the **Provision Surface Hub devices** wizard, you can: - -- Enroll in Active Directory, Azure Active Directory, or MDM -- Create an device administrator account -- Add applications and certificates -- Configure proxy settings -- Add a Surface Hub configuration file - ->[!WARNING] ->You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using the wizard. - -Using the advanced provisioning editor, you can add these items to provisioning packages for Surface Hub: - -- **Policies** - Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#surfacehubpolicies). -- **Settings** - You can configure any setting in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). - ->[!TIP] -> Use the wizard to create a package with the common settings, then switch to the advanced editor to add other settings. -> ->![open advanced editor](images/icd-simple-edit.png) - -## Use the Surface Hub provisioning wizard - -After you [install Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd), you can create a provisioning package. - -### Create the provisioning package - -1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, - - or - - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. - -2. Click **Provision Surface Hub devices**. - -3. Name your project and click **Next**. - -### Configure settings - - - - - - - - - -
step one add certificates

To provision the device with a certificate, click Add a certificate. Enter a name for the certificate, and then browse to and select the certificate to be used.
add a certificate
step two configure proxy settings

Toggle Yes or No for proxy settings. The default configuration for Surface Hub is to automatically detect proxy settings, so you can select No if that is the setting that you want. However, if your infrastructure previously required using a proxy server and has changed to not require a proxy server, you can use a provisioning package to revert your Surface Hub devices to the default settings by selecting Yes and Automatically detect settings.

If you toggle Yes, you can select to automatically detect proxy settings, or you can manually configure the settings by entering a URL to a setup script, or a static proxy server address. You can also identify whether to use the proxy server for local addresses, and enter exceptions (addresses that Surface Hub should connect to directly without using the proxy server).
configure proxy settings
step three device admins

You can enroll the device in Active Directory and specify a security group to use the Settings app, enroll in Azure Active Directory to allow global admins to use the Settings app, or create a local administrator account on the device.

To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain, and specify the security group to have admin credentials on Surface Hub. If a provisioning package that enrolls a device in Active Directory is going to be applied to a Surface Hub that was reset, the same domain account can only be used if the account listed is a domain administrator or is the same account that set up the Surface Hub initially. Otherwise, a different domain account must be used in the provisioning package.

Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Click Accept to give Windows Configuration Designer the necessary permissions.

To create a local administrator account, select that option and enter a user name and password.

Important: If you create a local account in the provisioning package, you must change the password using the Settings app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.
join Active Directory, Azure AD, or create a local admin account
step four enroll in device management

Toggle Yes or No for enrollment in MDM.

If you toggle Yes, you must provide a service account and password or certificate thumbprint that is authorized to enroll the device, and also specify the authentication type. If required by your MDM provider, also enter the URLs for the discovery service, enrollment service, and policy service. Learn more about managing Surface Hub with MDM.
enroll in mobile device management
step five add applications

You can install multiple Universal Windows Platform (UWP) apps in a provisioning package. For help with the settings, see Provision PCs with apps.

Important: Although the wizard interface allows you to select a Classic Win32 app, only include UWP apps in a provisioning package that will be applied to Surface Hub. If you include a Classic Win32 app, provisioning will fail.
add an application
step six Add configuration file

You don't configure any settings in this step. It provides instructions for including a configuration file that contains a list of device accounts. The configuration file must not contain column headers. When you apply the provisioning package to Surface Hub, if a Surface Hub configuration file is included on the USB drive, you can select the account and friendly name for the device from the file. See Sample configuration file for an example.

Important: The configuration file can only be applied during the out-of-box setup experience (OOBE) and can only be used with provisioning packages created using the Windows Configuration Designer released with Windows 10, version 1703.
Add a Surface Hub configuration file
finish

You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.
Protect your package
- -After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. - -## Sample configuration file - -A Surface Hub configuration file contains a list of device accounts that your device can use to connect to Exchange and Skype for Business. When you apply a provisioning package to Surface Hub, you can include a configuration file in the root directory of the USB flash drive, and then select the desired account to apply to that device. The configuration file can only be applied during the out-of-box setup experience (OOBE) and can only be used with provisioning packages created using the Windows Configuration Designer released with Windows 10, version 1703. - -Use Microsoft Excel or other CSV editor to create a CSV file named `SurfaceHubConfiguration.csv`. In the file, enter a list of device accounts and friendly names in this format: - -``` -,, -``` ->[!IMPORTANT] ->Because the configuration file stores the device account passwords in plaintext, we recommend that you update the passwords after you've applied the provisioning package to your devices. You can use the [DeviceAccount node](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp#deviceaccount) in the [Surface Hub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) to update the passwords via MDM. - - -The following is an example of `SurfaceHubConfiguration.csv`. - -``` -Rainier@contoso.com,password,Rainier Surface Hub -Adams@contoso.com,password,Adams Surface Hub -Baker@contoso.com,password,Baker Surface Hub -Glacier@constoso.com,password,Glacier Surface Hub -Stuart@contoso.com,password,Stuart Surface Hub -Fernow@contoso.com,password,Fernow Surface Hub -Goode@contoso.com,password,Goode Surface Hub -Shuksan@contoso.com,password,Shuksan Surface Hub -Buckner@contoso.com,password,Buckner Surface Hub -Logan@contoso.com,password,Logan Surface Hub -Maude@consoto.com,password,Maude Surface hub -Spickard@contoso.com,password,Spickard Surface Hub -Redoubt@contoso.com,password,Redoubt Surface Hub -Dome@contoso.com,password,Dome Surface Hub -Eldorado@contoso.com,password,Eldorado Surface Hub -Dragontail@contoso.com,password,Dragontail Surface Hub -Forbidden@contoso.com,password,Forbidden Surface Hub -Oval@contoso.com,password,Oval Surface Hub -StHelens@contoso.com,password,St Helens Surface Hub -Rushmore@contoso.com,password,Rushmore Surface Hub -``` - -## Use advanced provisioning - -After you [install Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd), you can create a provisioning package. - -### Create the provisioning package (advanced) - -1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, - - or - - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. - -2. Click **Advanced provisioning**. - -3. Name your project and click **Next**. - -4. Select **Common to Windows 10 Team edition**, click **Next**, and then click **Finish**. - - ![ICD new project](images/icd-new-project.png) - -5. In the project, under **Available customizations**, select **Common Team edition settings**. - - ![ICD common settings](images/icd-common-settings.png) - - -### Add a certificate to your package -You can use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange. - -> [!NOTE] -> Provisioning packages can only install certificates to the device (local machine) store, and not to the user store. If your organization requires that certificates must be installed to the user store, use Mobile Device Management (MDM) to deploy these certificates. See your MDM solution documentation for details. - -1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. - -2. Enter a **CertificateName** and then click **Add**. - -2. Enter the **CertificatePassword**. - -3. For **CertificatePath**, browse and select the certificate. - -4. Set **ExportCertificate** to **False**. - -5. For **KeyLocation**, select **Software only**. - - -### Add a Universal Windows Platform (UWP) app to your package -Before adding a UWP app to a provisioning package, you need the app package (either an .appx, or .appxbundle) and any dependency files. If you acquired the app from the Microsoft Store for Business, you will also need the *unencoded* app license. See [Distribute offline apps](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app) to learn how to download these items from the Microsoft Store for Business. - -1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextApp**. - -2. Enter a **PackageFamilyName** for the app and then click **Add**. For consistency, use the app's package family name. If you acquired the app from the Microsoft Store for Business, you can find the package family name in the app license. Open the license file using a text editor, and use the value between the \...\ tags. - -3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). - -4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. For Surface Hub, you will only need the x64 versions of these dependencies. - -If you acquired the app from the Microsoft Store for Business, you will also need to add the app license to your provisioning package. - -1. Make a copy of the app license, and rename it to use a **.ms-windows-store-license** extension. For example, "example.xml" becomes "example.ms-windows-store-license". - -2. In ICD, in the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextAppLicense**. - -3. Enter a **LicenseProductId** and then click **Add**. For consistency, use the app's license ID from the app license. Open the license file using a text editor. Then, in the \ tag, use the value in the **LicenseID** attribute. - -4. Select the new **LicenseProductId** node. For **LicenseInstall**, click **Browse** to find and select the license file that you renamed in Step 1. - - -### Add a policy to your package -Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD. - -1. In the **Available customizations** pane, go to **Runtime settings** > **Policies**. - -2. Select one of the available policy areas. - -3. Select and set the policy you want to add to your provisioning package. - - -### Add Surface Hub settings to your package - -You can add settings from the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) to your provisioning package. - -1. In the **Available customizations** pane, go to **Runtime settings** > **WindowsTeamSettings**. - -2. Select one of the available setting areas. - -3. Select and set the setting you want to add to your provisioning package. - - -## Build your package - -1. When you are done configuring the provisioning package, on the **File** menu, click **Save**. - -2. Read the warning that project files may contain sensitive information, and click **OK**. - - > [!IMPORTANT] - > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -3. On the **Export** menu, click **Provisioning package**. - -4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources. - -5. Set a value for **Package Version**, and then select **Next.** - - > [!TIP] - > You can make changes to existing packages and change the version number to update previously applied packages. - -6. Optional: You can choose to encrypt the package and enable package signing. - - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse...** and choosing the certificate you want to use to sign the package. - - > [!IMPORTANT] - > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.  - -7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

-Optionally, you can click **Browse** to change the default output location. - -8. Click **Next**. - -9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

-If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. - -10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

-If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - - - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. - -11. Select the **output location** link to go to the location of the package. Copy the .ppkg to an empty USB flash drive. - - -## Apply a provisioning package to Surface Hub - -There are two options for deploying provisioning packages to a Surface Hub. [During the first run wizard](#apply-a-provisioning-package-during-first-run), you can apply a provisioning package that installs certificates, or after the first-run program is complete, you can apply a provisioning package that configures settings, apps, and certificates by using [Settings](#apply-a-package-using-settings). - - -### Apply a provisioning package during first run - -> [!IMPORTANT] -> During the first-run program, you can only use provisioning packages to install certificates. Use the **Settings** app to install apps and apply other settings. - -1. When you turn on the Surface Hub for the first time, the first-run program will display the [**Hi there page**](first-run-program-surface-hub.md#first-page). Make sure that the settings are properly configured before proceeding. - -2. Insert the USB flash drive containing the .ppkg file into the Surface Hub. If the package is in the root directory of the drive, the first-run program will recognize it and ask if you want to set up the device. Select **Set up**. - - ![Set up device?](images/provisioningpackageoobe-01.png) - -3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - - ![Provision this device](images/provisioningpackageoobe-02.png) - -4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. Note that you can only install one package during first run. - - ![Choose a package](images/provisioningpackageoobe-03.png) - -5. The first-run program will show you a summary of the changes that the provisioning package will apply. Select **Yes, add it**. - - ![Do you trust this package?](images/provisioningpackageoobe-04.png) - -6. If a configuration file is included in the root directory of the USB flash drive, you will see **Select a configuration**. The first device account in the configuration file will be shown with a summary of the account information that will be applied to the Surface Hub. - - ![select a configuration](images/ppkg-config.png) - -7. In **Select a configuration**, select the device name to apply, and then click **Next**. - - ![select a friendly device name](images/ppkg-csv.png) - -The settings from the provisioning package will be applied to the device and OOBE will be complete. After the device restarts, you can remove the USB flash drive. - -### Apply a package using Settings - -1. Insert the USB flash drive containing the .ppkg file into the Surface Hub. - -2. From the Surface Hub, start **Settings** and enter the admin credentials when prompted. - -3. Navigate to **Surface Hub** > **Device management**. Under **Provisioning packages**, select **Add or remove a provisioning package**. - -4. Select **Add a package**. - -5. Choose your provisioning package and select **Add**. You may have to re-enter the admin credentials if prompted. - -6. You'll see a summary of the changes that the provisioning package will apply. Select **Yes, add it**. - - diff --git a/devices/surface-hub/remote-surface-hub-management.md b/devices/surface-hub/remote-surface-hub-management.md deleted file mode 100644 index 1794a9bcac..0000000000 --- a/devices/surface-hub/remote-surface-hub-management.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Remote Surface Hub management -description: This section lists topics for managing Surface Hub. -keywords: remote management, MDM, install apps, monitor Surface Hub, Operations Management Suite, OMS -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Remote Surface Hub management - -## In this section - -|Topic | Description| -| ------ | --------------- | -| [Manage settings with an MDM provider]( https://technet.microsoft.com/itpro/surface-hub/manage-settings-with-mdm-for-surface-hub) | Surface Hub provides an enterprise management solution to help IT administrators manage policies and business applications on these devices using a mobile device management (MDM) solution.| -| [Monitor your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/monitor-surface-hub) | Monitoring for Surface Hub devices is enabled through Microsoft Operations Management Suite.| -| [Windows updates](https://technet.microsoft.com/itpro/surface-hub/manage-windows-updates-for-surface-hub) | You can manage Windows updates on your Surface Hub by setting the maintenance window, deferring updates, or using WSUS.| diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md deleted file mode 100644 index 12e59349d6..0000000000 --- a/devices/surface-hub/save-bitlocker-key-surface-hub.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Save your BitLocker key (Surface Hub) -description: Every Microsoft Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys. -ms.assetid: E11E4AB6-B13E-4ACA-BCE1-4EDC9987E4F2 -ms.reviewer: -manager: laurawi -keywords: Surface Hub, BitLocker, Bitlocker recovery keys -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/08/2019 -ms.localizationpriority: medium ---- - -# Save your BitLocker key (Surface Hub) - - -Every Microsoft Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys. - -There are several ways to manage your BitLocker key on the Surface Hub. - -1. If you’ve joined the Surface Hub to a domain, the device will back up the key on the domain and store it under the computer object. - - If you can’t find the BitLocker key after joining the device to a domain, it’s likely that your Active Directory schema doesn’t support BitLocker key backup. If you don’t want to change the schema, you can save the BitLocker key by going to Settings and following the procedure for using a local admin account, which is detailed later in this list. - -2. If you’ve joined the Surface Hub to Azure Active Directory (Azure AD), the BitLocker key will be stored under the account that was used to join the device. - -3. If you’re using a local admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive. - - -## Related topics - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md deleted file mode 100644 index 08ca875984..0000000000 --- a/devices/surface-hub/set-up-your-surface-hub.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Set up Microsoft Surface Hub -description: Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program. -ms.assetid: 4D1722BC-704D-4471-BBBE-D0500B006221 -ms.reviewer: -manager: laurawi -keywords: set up instructions, Surface Hub, setup worksheet, first-run program -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Set up Microsoft Surface Hub - - -Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program. - -Before you turn on your Microsoft Surface Hub for the first time, make sure you've completed the checklist at the end of the [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) section, and that you have the information listed in the [Setup worksheet](setup-worksheet-surface-hub.md). When you do power it on, the device will walk you through a series of setup screens. If you haven't properly set up your environment, or don't have the required information, you'll have to do extra work afterward making sure the settings are correct. - -## In this section - - - ---- - - - - - - - - - - - - - - - - -
TopicDescription

Setup worksheet

When you've finished pre-setup and are ready to start first-time setup for your Surface Hub, make sure you have all the information listed in this section.

First-run program

The term "first run" refers to the series of steps you'll go through the first time you power up your Surface Hub, and means the same thing as "out-of-box experience" (OOBE). This section will walk you through the process.

- - - - - - - - - - - diff --git a/devices/surface-hub/setup-worksheet-surface-hub.md b/devices/surface-hub/setup-worksheet-surface-hub.md deleted file mode 100644 index e7352a5dbe..0000000000 --- a/devices/surface-hub/setup-worksheet-surface-hub.md +++ /dev/null @@ -1,252 +0,0 @@ ---- -title: Setup worksheet (Surface Hub) -description: When you've finished pre-setup and are ready to start first-time setup for your Microsoft Surface Hub, make sure you have all the information listed in this section. -ms.assetid: AC6F925B-BADE-48F5-8D53-8B6FFF6EE3EB -ms.reviewer: -manager: laurawi -keywords: Setup worksheet, pre-setup, first-time setup -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: medium ---- - -# Setup worksheet (Surface Hub) - - -When you've finished pre-setup and are ready to start first-time setup for your Microsoft Surface Hub, make sure you have all the information listed in this section. - -You should fill out one list for each Surface Hub you need to configure, although some information can be used on all Surface Hubs, like the proxy information or domain credentials. Some of this information may not be needed, depending on how you've decided to configure your device, or depending on how the environment is configured for your organization's infrastructure. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PropertyWhat this is used forExampleActual value
-

Proxy information

-
-

If your network uses a proxy for network and/or Internet access, you must provide a script or server/port information.

-
-

Proxy script: http://contoso/proxy.pa
-- OR -
-Server and port info: 10.10.10.100, port 80 -

-
-

-
-

Wireless network credentials (username and password)

-
-

If you decide to connect your device to Wi-Fi, and your wireless network requires user credentials.

-
-

admin1@contoso.com, #MyPassw0rd

-
-

-
-

Device account UPN or Domain\username and device account password

-
-

This is the User Principal Name (UPN) or the domain\username, and the password of the device account. Mail, calendar, and Skype for Business depend on a compatible device account.

-
-

UPN: ConfRoom15@contoso.com, #Passw0rd1
-- OR -
-Domain and username: CONTOSO\ConfRoom15, #Passw0rd1

-
-

-
-

Device account Microsoft Exchange server

-
-

This is the device account's Exchange server. -Mail, calendar, and Skype for Business depend on a compatible device account. -For mail and calendar to work, the device account must have a valid Exchange server. The device will try to find this automatically.

-
-

outlook.office365.com

-
-

-
-

Device account Session Initiation Protocol (SIP) address

-
-

This is the device account's Skype for Business SIP address. -Mail, calendar, and Skype for Business depend on a compatible device account. -For Skype for Business to work, the device account must have a valid SIP address. The device will try to find this automatically.

-
-

sip: ConfRoom15@contoso.com

-
-

-
-

Friendly name

-
-

The friendly name of the device is the broadcast name that people will see when they try to wirelessly connect to the Surface Hub. This name will be displayed prominently on the Surface Hub's screen. -We suggest that the friendly name you choose is recognizable and unique so that people can distinguish one Surface Hub from another when trying to connect.

-
-

Conference Room 15

-
-

-
-

Device name

-
-

The device name is the name that will be used for domain join, and is the identity you will see in your MDM provider if the device is enrolled into MDM. -The device name you choose must not be the same name as any other device on the user’s Active Directory domain (if you decide to domain join the device). The device cannot join the domain if its name is not unique. -

-
-

confroom15

-
-

-
-

IF YOU'RE JOINING AZURE AD

-
-

Azure AD tenant user credentials (username and password)

-
-

If you decide to have people in your Azure Active Directory (Azure AD) organization become admins on the device, then you'll need to join Azure AD. -To join Azure AD, you will need valid user credentials.

-
-

admin1@contoso.com, #MyPassw0rd

-
-

-
-

IF YOU'RE JOINING A DOMAIN

-
-

Domain to join

-
-

This is the domain you will need to join so that a security group of your choice can be admins for the device. -You may need the fully qualified domain name (FQDN).

-
-

contoso (short name) OR contoso.corp.com (FQDN)

-
-

-
-

Domain account credentials (username and password)

-
-

A domain can't be joined unless you provide sufficient account credentials to join the domain. Once you provide a domain to join and credentials to join the domain, then a security group of your choice can change settings on the device.

-
-

admin1, #MyPassw0rd

-
-

-
-

Admin security group alias

-
-

This is a security group in your Active Directory (AD); any members of this security group can change settings on the device.

-
-

SurfaceHubAdmins

-
-

-
-

IF YOU'RE USING A LOCAL ADMIN

-
-

Local admin account credentials (username and password)

-
-

If you decide not to join an AD domain or Azure AD, you can create a local admin account on the device.

-
-

admin1, #MyPassw0rd

-
-

-
-

IF YOU NEED TO INSTALL CERTIFICATES OR APPS

-
-

USB drive

-
-

If you know before first run that you want to install certificates or universal apps, follow the steps in Create provisioning packages. Your provisioning packages will be created on a USB drive.

-
-

-
-

-
  - - - - - diff --git a/devices/surface-hub/skype-hybrid-voice.md b/devices/surface-hub/skype-hybrid-voice.md deleted file mode 100644 index 910f2d0129..0000000000 --- a/devices/surface-hub/skype-hybrid-voice.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: Online or hybrid deployment using Skype Hybrid Voice environment (Surface Hub) -description: This topic explains how to enable Skype for Business Cloud PBX with on premises PSTN connectivity via Cloud Connector Edition or Skype for Business 2015 pool. -keywords: hybrid deployment, Skype Hybrid Voice -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Online or hybrid deployment using Skype Hybrid Voice environment (Surface Hub) - -This topic explains how to enable Skype for Business Cloud PBX with on-premises Public Switched Telephone Network (PSTN) connectivity via Cloud Connector Edition or Skype for Business 2015 pool. In this option. your Skype for Business home pools and Exchange servers are in the cloud, and are connected by PSTN via an on-premises pool running Skype for Business 2015 or Cloud Connector edition. [Learn more about different Cloud PBX options](https://technet.microsoft.com/library/mt612869.aspx). - -If you deployed Skype for Business Cloud PBX with one of the hybrid voice options, follow the steps below to enable the room account for Surface Hub. It is important to create a regular user account first, assign all hybrid voice options and phone numbers, and then convert the account to a room account. If you do not follow this order, you will not be able to assign a hybrid phone number. - ->[!WARNING] ->If you create an account before configuration of Hybrid voice (you run Enable-CSMeetingRoom command), you will not be able to configure required hybrid voice parameters. In order to configure hybrid voice parameters for a previously configured account or to reconfigure a phone number, delete the E5 or E3 + Cloud PBX add-on license, and then follow the steps below, starting at step 3. - -1. Create a new user account for Surface Hub. This example uses surfacehub2@adatum.com. The account can be created in local Active Directory and synchronized to the cloud, or created directly in the cloud. - - ![new object user](images/new-user-hybrid-voice.png) - -2. Select **Password Never Expires**. This is important for a Surface Hub device. - - ![Password never expires](images/new-user-password-hybrid-voice.png) - -3. In Office 365, add **E5** license or **E3 and Cloud PBX** add-on to the user account created for the room. This is required for Hybrid Voice to work. - - ![Add product license](images/product-license-hybrid-voice.png) - -4. Wait approximately 15 minutes until the user account for the room appears in Skype for Business Online. - -5. After the user account for room is created in Skype for Business Online, enable it for Hybrid Voice in Skype for Business Remote PowerShell by running the following cmdlet: - - ``` - Set-csuser surfacehub2@adatum.com EnterpriseVoiceEnabled $true -HostedVoiceMail $true -onpremlineuri tel:+15005000102 - ``` - -6. Validate Hybrid Voice call flow by placing test calls from the Surface Hub. - -7. Start a remote PowerShell session on a PC and connect to Exchange by running the following cmdlets. - - ``` - Set-ExecutionPolicy Unrestricted - $cred=Get-Credential -Message "Please use your Office 365 admin credentials" - $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/ps1-liveid/ -Credential $cred -Authentication Basic -AllowRedirection - Import-PSSession $sess - ``` - -8. After establishing a session, modify the user account for the room to enable it as a **RoomMailboxAccount** by running the following cmdlets. This allows the account to authenticate with Surface Hub. - - ``` - Set-Mailbox surfacehub2@adatum.com -Type Room - Set-Mailbox surfacehub2@adatum.com -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) - ``` - -9. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. - - Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to **False**. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled. - - If you haven’t created a compatible policy yet, use the following cmdlet (this one creates a policy called "Surface Hubs"). After it’s created, you can apply the same policy to other device accounts. - - ``` - $easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false - ``` - - After you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. Run the following cmdlets to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox (you may need to re-enable the account and set the password again). - - ``` - Set-Mailbox surfacehub2@adatum.com -Type Regular - Set-CASMailbox surfacehub2@adatum.com -ActiveSyncMailboxPolicy $easPolicy.id - Set-Mailbox surfacehub2@adatum.com -Type Room - $credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password" - Set-Mailbox surfacehub2@adatum.com -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true - ``` - -10. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties can be set in [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md). The following cmdlets provide an example of setting Exchange properties. - - ``` - Set-CalendarProcessing surfacehub2@adatum.com -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false - Set-CalendarProcessing surfacehub2@adatum.com -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" - ``` - -11. Enable the mailbox as a meeting device in Skype for Business Online. Run the following cmdlet which enables the account as a meeting device. - - ``` - Get-CsTenant | select registrarpool - Enable-CsMeetingRoom surfacehub2@adatum.com -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName - ``` - - As a result of running this cmdlet, users will be asked if they are in a meeting room, as shown in the following image. **Yes** will mute the microphone and speaker. - - ![](images/adjust-room-audio.png) - - - -At this moment the room account is fully configured, including Hybrid Voice. If you use Skype on-premises, you can configure additional attributes, like description, location, etc., on-premises. If you create a room in Skype Online, these parameters can be set online. - -In the following image, you can see how the device appears to users. - - -![](images/select-room-hybrid-voice.png) diff --git a/devices/surface-hub/support-solutions-surface-hub.md b/devices/surface-hub/support-solutions-surface-hub.md deleted file mode 100644 index 9de0b753f9..0000000000 --- a/devices/surface-hub/support-solutions-surface-hub.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Top support solutions for Microsoft Surface Hub -description: Find top solutions for common issues using Surface Hub. -ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A -ms.reviewer: -manager: laurawi -keywords: Troubleshoot common problems, setup issues -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 10/24/2017 -ms.localizationpriority: medium ---- - -# Top support solutions for Microsoft Surface Hub - -Microsoft regularly releases both updates and solutions for Surface Hub. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface Hub devices updated. For a complete listing of the update history, see [Surface Hub update history](https://www.microsoft.com/surface/support/surface-hub/surface-hub-update-history) and [Known issues and additional information about Microsoft Surface Hub](https://support.microsoft.com/help/4025643). - ->[!TIP] ->Looking for [Surface Hub warranty information](https://support.microsoft.com/help/4040687/surface-surface-documents)? - -These are the top Microsoft Support solutions for common issues experienced when using Surface Hub. - -## Setup and install issues - -- [Setup troubleshooting](troubleshoot-surface-hub.md#setup-troubleshooting) -- [Exchange ActiveSync errors](troubleshoot-surface-hub.md#exchange-activesync-errors) - -## Miracast issues - -- [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) - -## Download updates issues - -- [Surface Hub can't download updates from Windows Update](https://support.microsoft.com/help/3191418/surface-hub-can-t-download-updates-from-windows-update) - -## Connect app issues - -- [The Connect app in Surface Hub exits unexpectedly](https://support.microsoft.com/help/3157417/the-connect-app-in-surface-hub-exits-unexpectedly) - - -  - - -  - - - - - diff --git a/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md b/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md deleted file mode 100644 index 98ad30890e..0000000000 --- a/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Surface Hub may install updates and restart outside maintenance hours -description: troubleshooting information for Surface Hub regarding automatic updates -ms.assetid: 6C09A9F8-F9CF-4491-BBFB-67A1A1DED0AA -keywords: surface hub, maintenance window, update -ms.prod: surface-hub -ms.sitesec: library -author: Teresa-MOTIV -ms.author: v-tea -ms.topic: article -ms.localizationpriority: medium ---- - -# Surface Hub may install updates and restart outside maintenance hours - -Under specific circumstances, Surface Hub installs updates during business hours instead of during the regular maintenance window. The device then restarts if it is necessary. You cannot use the device until the process is completed. - -> [!NOTE] -> This isn't expected behavior for missing a maintenance window. It occurs only if the device is out-of-date for a long time. - -## Cause -To ensure that Surface Hub remains available for use during business hours, the Hub is configured to perform administrative functions during a maintenance window that is defined in Settings (see "References," below). During this maintenance period, the Hub automatically installs any available updates through Windows Update or Windows Server Update Service (WSUS). Once updates are complete, the Hub may restart. - -Updates can be installed during the maintenance window only if the Surface Hub is turned on but not in use or reserved. For example, if the Surface Hub is scheduled for a meeting that lasts 24 hours, any updates that are scheduled to be installed will be deferred until the Hub is available during the next maintenance window. If the Hub continues to be busy and misses multiple maintenance windows, the Hub will eventually begin to install and download updates. This can occur during or outside the maintenance window. Once the download and installation has begun, the device may restart. - -## To avoid this issue - -It's important that you set aside maintenance time for Surface Hub to perform administrative functions. Reserving the Surface Hub for 24 hour intervals or using the device during the maintenance window delays installing updates. We recommend that you not use or reserve the Hub during scheduled maintenance period. A two-hour window should be reserved for updating. - -One option that you can use to control the availability of updates is Windows Server Update Service (WSUS). WSUS provides control over what updates are installed and when. - -## References - -[Update the Surface Hub](first-run-program-surface-hub.md#update-the-surface-hub) - -[Maintenance window](manage-windows-updates-for-surface-hub.md#maintenance-window) - -[Deploy Windows 10 updates using Windows Server Update Services (WSUS)](/windows/deployment/update/waas-manage-updates-wsus) - - diff --git a/devices/surface-hub/surface-hub-2s-account.md b/devices/surface-hub/surface-hub-2s-account.md deleted file mode 100644 index fb93b0e7d9..0000000000 --- a/devices/surface-hub/surface-hub-2s-account.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: "Create Surface Hub 2S device account" -description: "This page describes the procedure for creating the Surface Hub 2S device account." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Create Surface Hub 2S device account - -Creating a Surface Hub device account (also known as a Room mailbox) allows Surface Hub 2S to receive, approve, or decline meeting requests and join meetings using Microsoft Teams or Skype for Business. Configure the device account during OOBE setup. If needed you can change it later (without going through OOBE setup). - -Unlike standard Room mailboxes that remain disabled by default, you need to enable the Surface Hub 2S device account to sign on to Microsoft Teams and Skype for Business. Surface Hub 2S relies on Exchange ActiveSync, which requires an ActiveSync mailbox policy on the device account. Apply the default ActiveSync mailbox policy that comes with Exchange Online. - -Create the account using the Microsoft 365 admin center or by using PowerShell. You can use Exchange Online PowerShell to configure specific features including: - -- Calendar processing for every Surface Hub device account. -- Custom auto replies to scheduling requests. -- If the default ActiveSync mailbox policy has already been modified by someone else or another process, you will likely have to create and assign a new ActiveSync mailbox policy - -## Create account using Microsoft 365 admin center - -1. In the Microsoft 365 admin center, go to **Resources** and choose **Rooms & Equipment** and then select **+ Room**. - -2. Provide a name and email address for the device account. Leave remaining settings unchanged in the default state. - -![Provide a name and email address](images/sh2-account2.png) - -![Leave remaining settings unchanged in the default state](images/sh2-account3.png) - -3. Set the password for the device account. To set the password, choose **Users** and then select **Active Users**. Now search for the newly created user to set the password. Ensure that you **do not** select the option **Make this user change their password when they first sign in.** - -![Set the password for the device account](images/sh2-account4.png) - -4. Assign the room with an Office 365 license. It’s recommended to assign the Office 365 **Meeting Room** license, a new option that automatically enables the account for Skype for Business Online and Microsoft Teams. - -![Assign Office 365 license](images/sh2-account5.png) - -### Finalize setup via PowerShell - -- **Skype for Business:** For Skype for Business only (on-premises or online), you can enable the Skype for Business object by running **Enable-CsMeetingRoom** to enable features such as Meeting room prompt for audio and Lobby hold. - -- **Microsoft Teams and Skype for Business Calendar:** Set [**Calendar Auto processing**](https://docs.microsoft.com/surface-hub/surface-hub-2s-account?source=docs#set-calendar-auto-processing) for this account. - -## Create account using PowerShell -Instead of using the Microsoft Admin Center portal, you can create the account using PowerShell. - -### Connect to Exchange Online PowerShell - -```powershell -$365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential (Get-Credential) -Authentication Basic –AllowRedirection -$ImportResults = Import-PSSession $365Session -``` - -### Create a new Room Mailbox - -```powershell -New-Mailbox -MicrosoftOnlineServicesID account@YourDomain.com -Alias SurfaceHub2S -Name SurfaceHub2S -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String "" -AsPlainText -Force) -``` - -### Set Calendar Auto processing - -```powershell -Set-CalendarProcessing -Identity "account@YourDomain.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -AddAdditionalResponse $true -AdditionalResponse "This room is equipped with a Surface Hub" -``` - -### Assign a license - -```powershell -Connect-MsolService -Set-Msoluser -UserPrincipalName account@YourDomain.com -UsageLocation IE -Set-MsolUserLicense -UserPrincipalName "account@YourDomain.com" -AddLicenses "contoso:MEETING_ROOM" -``` - -## Connect to Skype for Business Online using PowerShell - -### Install prerequisites - -- [Visual C++ 2017 Redistributable](https://aka.ms/vs/15/release/vc_redist.x64.exe) -- [Skype for Business Online PowerShell Module](https://www.microsoft.com/download/confirmation.aspx?id=39366) - -```powershell -Import-Module LyncOnlineConnector -$SfBSession = New-CsOnlineSession -Credential (Get-Credential) -Import-PSSession $SfBSession -AllowClobber - -# Enable the Skype for Business meeting room -Enable-CsMeetingRoom -Identity account@YourDomain.com -RegistrarPool(Get-CsTenant).Registrarpool -SipAddressType EmailAddress -``` diff --git a/devices/surface-hub/surface-hub-2s-adoption-kit.md b/devices/surface-hub/surface-hub-2s-adoption-kit.md deleted file mode 100644 index 2cc29c519b..0000000000 --- a/devices/surface-hub/surface-hub-2s-adoption-kit.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: "Surface Hub 2S Adoption and training guides" -description: "Microsoft has developed downloadable materials that you can make available for your users to aid in adoption of Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 11/04/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S adoption and training guides - -Whether you're a small or large business, a Surface Hub adoption plan is critical in generating the right use cases and helping your users become comfortable with the device. Check out these downloadable guides designed to help you deliver training across your organization. - -## On-demand training - -- [Surface Hub 2S adoption and training videos](surface-hub-2s-adoption-videos.md) - -## Adoption toolkit - -- [Surface Hub adoption toolkit](downloads/SurfaceHubAdoptionToolKit.pdf) - -## Training guides - -- [Training guide – end user](downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf) -- [Training guide – power user](downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf) -- [Training guide – help desk](downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf) -- [Training guide – Microsoft Teams desktop](downloads/Guide-SurfaceHub2S-Teams.pptx) - -[Download all training guides](https://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) - -## End user guides - -- [Guide to Navigation on Surface Hub](downloads/Guide-SurfaceHub2S-Navigation.pptx) -- [Guide to Office 365 on Surface Hub](downloads/Guide-SurfaceHub2S-Office365.pptx) -- [Guide to Microsoft Whiteboard on Surface Hub](downloads/Guide-SurfaceHub2S-Whiteboard.pptx) -- [Guide to Microsoft Teams on Surface Hub](downloads/Guide-SurfaceHub2S-Teams.pptx) - -[Download all end user guides](https://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) - -## Quick reference cards - -- [Connect your PC](downloads/QRCConnectYourPC.pdf) -- [Join a Teams Meeting](downloads/QRCJoinTeamsMeeting.pdf) -- [Manage a Teams meeting](downloads/QRCManageTeamsMeeting.pdf) -- [Navigation basics](downloads/QRCNavigationBasics.pdf) -- [Schedule a Teams meeting](downloads/QRCScheduleTeamsMeeting.pdf) -- [Start a new Teams meeting](downloads/QRCStartNewTeamsMeeting.pdf) -- [Share or send a file](downloads/QRCShareSendFile.pdf) -- [Sign in to view meetings and files](downloads/QRCSignInToViewMeetingsFiles.pdf) -- [Whiteboard advanced](downloads/QRCWhiteboardAdvanced.pdf) -- [Whiteboard tools](downloads/QRCWhiteboardTools.pdf) - -[Download all quick reference cards](https://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) diff --git a/devices/surface-hub/surface-hub-2s-adoption-videos.md b/devices/surface-hub/surface-hub-2s-adoption-videos.md deleted file mode 100644 index 5e0419624f..0000000000 --- a/devices/surface-hub/surface-hub-2s-adoption-videos.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: "Surface Hub 2S on-demand adoption and training videos" -description: "This page contains on-demand training for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 11/04/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S on-demand adoption and training videos - -This page contains comprehensive training for Surface Hub 2S, available on demand. - -## Chapter 1 - Training overview - -> ![VIDEO ]
- -- Welcome and introduction -- Training overview and agenda -- Software and technology reference -- Surface Hub messaging -- Industries and user roles -- Overview of training services -- Training best practices - -## Chapter 2 - Getting started with Surface Hub - -> ![VIDEO ]
- -- What is Surface Hub? -- Technical overview -- Steelcase Roam and the mobility story -- Surface Hub services -- Getting started with Surface Hub -- Gathering expectations - -## Chapter 3 - Navigating Surface Hub - -> ![VIDEO ]
- -- Welcome screen -- Start menu -- Full screen -- Clip to Whiteboard -- Task bar menu -- Teams/Skype -- End Session - -## Chapter 4 - Whiteboarding and collaboration - -> ![VIDEO ]
- -- Whiteboard introduction -- Starting the Whiteboard -- Whiteboard tools -- Inserting pictures -- Changing the background -- Sharing the whiteboard -- Export the Whiteboard - -## Chapter 5 - Exploring Surface Hub apps - -> ![VIDEO ]
- -- Surface Hub apps introduction -- PowerPoint overview -- Microsoft Word -- Microsoft Excel -- Microsoft Edge - -## Chapter 6 - Advanced apps and Office 365 - -> ![VIDEO ]
- -- Advanced apps introduction -- Microsoft Maps -- Photos -- Power BI -- Sign in to Office 365 -- OneDrive -- CoAuthor documents - -## Chapter 7 - Connecting devices - -> ![VIDEO ]
- -- Connect introduction -- Miracast overview -- Touch and Pen Input -- Wired connect overview -- Line of Business app workflows -- Troubleshooting Miracast and wired connect - -## Chapter 8 - Skype for Business meetings - -> ![VIDEO ]
- -- Introduction to Skype for Business --Scheduling Skype for Business meetings -- Start a meeting -- Start an ad hoc meeting -- Join a meeting on your calendar -- Managing a Skype for Business meeting -- Present content - -## Chapter 9 - Microsoft Teams meetings - -> ![VIDEO ]
- -- Introduction to Microsoft Teams -- Scheduling Microsoft Teams meetings -- Start a meeting -- Start an ad hoc meeting -- Join a meeting on your calendar -- Managing a Microsoft Teams meeting -- Present content -- Conclusion - -## Chapter 10 - Basic troubleshooting - -> ![VIDEO ]
- -- Introduction to Surface Hub troubleshooting -- Application troubleshooting -- End Session -- Restart the device -- Power cycle the device -- Factory reset -- Settings -- Manage Surface Hub -- Conclusion \ No newline at end of file diff --git a/devices/surface-hub/surface-hub-2s-change-history.md b/devices/surface-hub/surface-hub-2s-change-history.md deleted file mode 100644 index f629bd6bd6..0000000000 --- a/devices/surface-hub/surface-hub-2s-change-history.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: "Change history for Surface Hub 2S" -description: "This page shows change history for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -audience: Admin -ms.manager: laurawi -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Change history for Surface Hub 2S - -This topic summarizes new and updated content in the Surface Hub 2S documentation library. - -## August 2019 - -Changes | Description -|:--- |:--- -|Connect devices to Surface Hub 2S| Updated with guidance for connecting to a second display. - -## July 2019 - -Changes | Description -|:--- |:--- | -| Reset and recovery for Surface Hub 2S | Added link to Surface recovery website that enables customers to download a recovery image for Surface Hub 2S | -| Surface Hub 2S tech specs | Updated power consumption data | -| Surface Hub 2S Adoption Kit | New | - -## June 2019 - -Changes | Description -|:--- |:--- | -| Published new guidance for Surface Hub 2S | New | diff --git a/devices/surface-hub/surface-hub-2s-connect.md b/devices/surface-hub/surface-hub-2s-connect.md deleted file mode 100644 index a09044e60d..0000000000 --- a/devices/surface-hub/surface-hub-2s-connect.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: "Connect devices to Surface Hub 2S" -description: "This page explains how to connect external devices to Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 02/24/2020 -ms.localizationpriority: Medium ---- - -# Connect devices to Surface Hub 2S -Surface Hub 2S enables you to connect external devices, mirror the display on Surface Hub 2S to another device, and connect multiple third-party peripherals including video conference cameras, conference phones, and room system devices. - -You can display content from your devices to Surface Hub 2S. If the source device is Windows-based, that device can also provide TouchBack and InkBack, which takes video and audio from the connected device and presents them on Surface Hub 2S. If Surface Hub 2S encounters a High-Bandwidth Digital Content Protection (HDCP) signal, such as a Blu-ray DVD player, the source is displayed as a black image. - -> [!NOTE] -> Surface Hub 2S uses the video input selected until a new connection is made, the existing connection is disrupted, or the Connect app is closed. - -## Recommended wired configurations - -In general, it’s recommended to use native cable connections whenever possible such as USB-C to USB-C or HDMI to HDMI. Other combinations such as MiniDP to HDMI or MiniDP to USB-C will also work. Some additional configuration may be required to optimize the video-out experience, as described on this page. - -| **Connection** | **Functionality** | **Description**| -| --- | --- | ---| -| HDMI + USB-C | HDMI-in for audio and video

USB-C for TouchBack and InkBack | USB-C supports TouchBack and InkBack with the HDMI A/V connection.

Use USB-C to USB-A to connect to legacy computers.

**NOTE:** For best results, connect HDMI before connecting a USB-C cable. If the computer you're using for HDMI is not compatible with TouchBack and InkBack, you won't need a USB-C cable. | -| USB-C
(via compute module) | Video-in
Audio-in | Single cable needed for A/V

TouchBack and InkBack is supported

HDCP enabled | -| HDMI (in port) | Video, Audio into Surface Hub 2S | Single cable needed for A/V

TouchBack and InkBack not supported

HDCP enabled | -| MiniDP 1.2 output | Video-out such as mirroring to a larger projector. | Single cable needed for A/V | - -When you connect a guest computer to Surface Hub 2S via the USB-C port, several USB devices are discovered and configured. These peripheral devices are created for TouchBack and InkBack. As shown in the following table, the peripheral devices can be viewed in Device Manager, which will show duplicate names for some devices, as shown in the following table. - - -|**Peripheral**| **Listing in Device Manager** | -| ---------------------------- |------------- | ------------------------------| -| Human interface devices | HID-compliant consumer control device
HID-compliant pen
HID-compliant pen (duplicate item)
HID-compliant pen (duplicate item)
HID-compliant touch screen
USB Input Device
USB Input Device (duplicate item) | -| Keyboards | Standard PS/2 keyboard | -| Mice and other pointing devices | HID-compliant mouse | -| USB controllers | Generic USB hub
USB composite device | - -## Connecting video-in to Surface Hub 2S - -You can input video to Surface Hub 2S using USB-C or HDMI, as indicated in the following table. - -### Surface Hub 2S video-in settings - -| **Signal Type** | **Resolution** | **Frame rate** | **HDMI** | **USB-C** | -| --------------- | -------------- | -------------- | -------- | --------- | -| PC | 640 x 480 | 60 | X | X | -| PC | 720 x 480 | 60 | X | X | -| PC | 1024 x 768 | 60 | X | X | -| PC | 1920 x 1080 | 60 | X | X | -| PC | 3840x2560 | 30 | X | X | -| HDTV | 720p | 60 | X | X | -| HDTV | 1080p | 60 | X | X | -| 4K UHD | 3840x2560 | 30 | X | X | - -> [!NOTE] -> The 4K UHD resolution (3840×2560) is only supported when connecting to ports on the compute module. It is not supported on the “guest” USB ports located on the left, top, and right sides of the device. - -> [!NOTE] -> Video from a connected external PC may appear smaller when displayed on Surface Hub 2S. - -## Mirroring Surface Hub 2S display on another device - -You can output video to another display using MiniDP, as indicated in the following table. - -### Surface Hub 2S video-out settings - -| **Signal Type** | **Resolution** | **Frame rate** | **MiniDP** | -| --------------- | -------------- | -------------- | ---------- | -| PC | 640 x 480 | 60 | X | -| PC | 720 x 480 | 60 | X | -| PC | 1024 x 768 | 60 | X | -| PC | 1920 x 1080 | 60 | X | -| PC | 3840 x 2560 | 60 | X | -| HDTV | 720p | 60 | X | -| HDTV | 1080p | 60 | X | -| 4K UHD | 3840 x 2560 | 60 | X | - - - -Surface Hub 2S includes a MiniDP video-out port for projecting visual content from Surface Hub 2S to another display. If you plan to use Surface Hub 2S to project to another display, note the following recommendations: - -- **Keyboard required.** Before you begin, you’ll need to connect either a wired or Bluetooth-enabled external keyboard to Surface Hub 2S. Note that unlike the original Surface Hub, a keyboard for Surface Hub 2S is sold separately and is not included in the shipping package.

-- **Set duplicate mode.** Surface Hub 2S supports video-out in duplicate mode only. However, you will still need to manually configure the display mode when you connect for the first time: - 1. Enter the **Windows logo key** + **P**, which opens the Project pane on the right side of Surface Hub 2S, and then select **Duplicate** mode. - 2. When you’re finished with your Surface Hub 2S session, select **End Session**. This ensures that the duplicate setting is saved for the next session.

-- **Plan for different aspect ratios.** Like other Surface devices, Surface Hub 2S uses a 3:2 display aspect ratio (the relationship between the width and the height of the display). Projecting Surface Hub 2S onto displays with different aspect ratios is supported. Note however that because Surface Hub 2S duplicates the display, the MiniDP output will also only display in a 3:2 aspect ratio, which may result in letterboxing or curtaining depending on the aspect ratio of the receiving display. - -> [!NOTE] -> if your second monitor uses a 16:9 aspect ratio (the predominant ratio for most TV monitors), black bars may appear on the left and right sides of the mirrored display. If this occurs, you may wish to inform your users that there is no need to adjust the second display. - -## Selecting cables - -Note the following recommendations: - -- **USB.** USB 3.1 Gen 2 cables. -- **MiniDP.** DisplayPort cables certified for up to 3 meters in length. -- **HDMI.** If a long cable is necessary, HDMI is recommended due to the wide availability of cost-effective, long-haul cables with the ability to install repeaters if needed. - -> [!NOTE] -> Most DisplayPort sources will automatically switch to HDMI signaling if HDMI is detected. - -## Wirelessly connect to Surface Hub 2S - -Windows 10 natively supports Miracast, which lets you wireless connect to Surface Hub 2S.

- -### To connect using Miracast: - -1. On your Windows 10 device, enter **Windows logo key** + **K**. -2. In the Connect window, look for the name of your Surface Hub 2S in the list of nearby devices. You can find the name of your Surface Hub 2S in the bottom left corner of the display. -3. Enter a PIN if your system administrator has enabled the PIN setting for Miracast connections. This requires you to enter a PIN number when you connect to Surface Hub 2S for the first time. - -> [!NOTE] ->If you do not see the name of the Surface Hub 2S device as expected, it’s possible the previous session was prematurely closed. If so, sign into Surface Hub 2S directly to end the previous session and then connect from your external device. - -## Connecting peripherals to Surface Hub 2S - -### Bluetooth accessories - -You can connect the following accessories to Surface Hub-2S using Bluetooth: - -- Mice -- Keyboards -- Headsets -- Speakers -- Surface Hub 2 pens - -> [!NOTE] -> After you connect a Bluetooth headset or speaker, you might need to change the default microphone and speaker settings. For more information, see [**Local management for Surface Hub settings**](https://docs.microsoft.com/surface-hub/local-management-surface-hub-settings). diff --git a/devices/surface-hub/surface-hub-2s-custom-install.md b/devices/surface-hub/surface-hub-2s-custom-install.md deleted file mode 100644 index c86ac8b4b3..0000000000 --- a/devices/surface-hub/surface-hub-2s-custom-install.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: "Customize wall mount of Surface Hub 2S" -description: "Learn how to perform a custom install of Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Customize wall mount of Surface Hub 2S - -If you’re not using certified mounting solutions, you can mount Surface Hub 2S using readily available retail hardware. - -## Set wall mount measurements - -Surface Hub 2S recommended mounting measurements: - -|**Item**|**Description**|**Notes**| -|:------ |:------------- |:------- | -|**Height from bottom of Surface Hub 2S**| 1026.5 mm (40.41”) | Recommended | -|**Height from top of Surface Hub 2S**| 1767.2 mm (69.57”) | Recommended | -|**Height from center of mount**| 1397 mm (55”) | Recommended | - -1. Measure 1026.5 mm (40.41”) from the floor level to set the recommended minimum height. -2. Measure 1767.2 mm (69.57”) from the floor level to set the recommended top height. - -![*Surface Hub 2S wall mount front view*](images/sh2-wall-front.png)
- -3. Measure 1397 mm (55”) mm from the floor level to set the recommended center height. - -![*Surface Hub 2S wall mount side view*](images/sh2-wall-side.png)
- -## Obstruction free mounting - -In addition to the visible ports on the sides of the device, certain integrated components must remain free of obstruction in order to function correctly. These include the Bluetooth, Wi-Fi, occupancy, and mic sensors as well thermal cooling vents. - Keep out zones - -|**Item**|**Description**|**Notes**| -|:---- |:----------- |:----- | -|**Access**| Ensure unimpeded access to input/output ports, the compute cartridge, Bluetooth radio, Bluetooth sensor, Wi-Fi radio, Wi-Fi sensor, occupancy sensor. | See Figure 1. | -|**Air flow**| Avoid blocking inlet and outlet air vent zones. | See Figure 2 | -|**Audio**| Avoid blocking audio exit zone on rear of Surface Hub 2S. | See Figure 2. | - -![*Figure 1. Keep out zones for Surface Hub 2S components*](images/sh2-keepout-zones.png)
-***Figure 1. Keep out zones for Surface Hub 2S components*** - -![*Figure 2. Avoid blocking thermal inlet/outlet and audio exit zones*](images/sh2-thermal-audio.png)
-***Figure 2. Avoid blocking thermal inlet/outlet and audio exit zones.
*** - -The removable compute cartridge containing the I/O ports must remain free of any obstructions or impediments of any kind. - -![*Figure 3.View of compute cartridge on the underside of Surface Hub 2s.*](images/sh2-ports.png)
-***Figure 3.View of compute cartridge on the underside of Surface Hub 2s.*** - -![*Figure 4. Unimpeded removal of compute cartridge *](images/sh2-cartridge.png)
-***Figure 4. Unimpeded removal of compute cartridge*** - -## Selecting a mounting system - -Surface Hub 2S uses a 350 mm x 350 mm mounting framework that meets most — but not all — of the criteria listed in the VESA Flat Display Mounting Interface Standard. You can install Surface Hub 2S using any of various off-the-shelf display brackets designed to accommodate displays that diverge from exact VESA specifications, as shown below. - -On the back of Surface Hub 2S, you’ll find a square pattern of four M6 x 1.0 threaded holes centered on the circular bump (565 mm in diameter). Attach your mount using four M6 x 1.0–12 mm-long metric bolts. Or, depending on preference, you can use longer bolts up to a maximum of 20 mm. -Important considerations for mounting systems - -|**Item**|**Description**|**Notes**| -|:------ |:------------- |:------- | -|**Strength**| Only choose mounts that can safely support devices of at least 28 kg (62 lbs.). | Required | -|**Stiffness**| Avoid flexible display mounts that can diminish the interactive pen and touch use experience. Most TV mounts are not designed to support touch displays. | Recommended | -|**Depth**| Keep the device mounted tightly to the wall especially in corridors and along circulation paths within rooms.| Recommended | -|**Versatility**| Ensure your mounting solution remains hidden from view in both the existing landscape mode and any potential portrait mode (subject to future availability). | Recommended | - -![*Figure 5. Surface Hub 2S mounting configuration*](images/sh2-mount-config.png)
-***Figure 5. Surface Hub 2S mounting configuration*** - -## Mounting methods compatible with Surface Hub 2S - -Surface Hub 2S is compatible with mounts that allow you to place it at angles of 10-70 degrees from the vertical plane. Rail mounts typically have multiple holes and a set of slots, enabling compatibility across a wide range of displays. A rail attached to the wall and two mounts attached to the display enable you to securely install Surface Hub 2S to a wall. When evaluating rail mounts for compatibility, ensure they meet versatility requirements listed earlier. - -![*Figure 6. Rail mounts*](images/h2gen-railmount.png)
-***Figure 6. Surface Hub 2S rail mounts*** diff --git a/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md b/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md deleted file mode 100644 index 77fe0fa1ca..0000000000 --- a/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: "Deploy apps to Surface Hub 2S using Intune" -description: "Learn how you can deploy apps to Surface Hub 2S using Intune." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Deploy apps to Surface Hub 2S using Intune - -You can install additional apps to fit your team or organization's needs. - -## Developer guidelines - -- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). Apps created using the [Desktop App Converter](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) will not run on Surface Hub. -- Apps must be targeted for the [Universal device family](https://msdn.microsoft.com/library/windows/apps/dn894631) or Windows Team device family. -- Surface Hub only supports [offline-licensed apps](https://docs.microsoft.com/microsoft-store/distribute-offline-apps) from [Microsoft Store for Business](https://businessstore.microsoft.com/store). -- By default, apps must be Store-signed to be installed. During testing and development, you can also choose to run developer-signed UWP apps by placing the device in developer mode. -- When developing and submitting apps to the Microsoft Store, set Device family availability and Organizational licensing options to ensure that apps are available to run on Surface Hub. -- You need admin credentials to install apps on Surface Hub. Designed for use in meeting rooms and other shared spaces, Surface Hub prevents regular users from accessing the Microsoft Store to download and install apps. - -## Deployment guidelines - -You can deploy Universal Windows Platform (UWP) apps to Surface Hub 2S using Intune, easing app deployment to devices. - -1. To deploy apps, enable MDM for your organization. In the Intune portal, select **Intune** as your MDM Authority (recommended).
- - ![Choose MDM authority](images/sh2-set-intune5.png) - -2. Enable the Microsoft Store for Business in Intune. Open Intune, select **Client apps** > **Microsoft Store for Business.**
- - ![Enable Store for Business](images/sh2-deploy-apps-sync.png) - -3. In Intune open **Microsoft Store for Business** and select **Settings** > **Distribute** > **Management tools**. Choose **Microsoft Intune** as your management tool.
- - ![Add Intune as your management tool](images/sh2-set-intune8.png) - -4. In Microsoft Store for Business, select **Settings** > **Shop** > **Shopping Experience**, and then select **Show offline apps**. Offline apps refer to apps that can be synced to Intune and centrally deployed to a device. -5. After enabling Offline shopping, you can acquire offline licenses for apps that you can sync to Intune and deploy as Device licensing. -6. In **Intune** > **Client apps** > **Microsoft Store for Business**, select **Sync**. -7. In the Client apps page, search for the app in the apps list. Assign the apps to the desired device group or groups. Select **Assignments** > **Add group**.
- -![*Assigning apps to groups *](images/sh2-assign-group.png)
- -8. Under assignment type, choose **Required**.
- -![*Assigning apps to groups *](images/sh2-add-group.png)
- -9. For the selected groups, choose **Device licensing** and then select **OK** and save the assignment.
- -![*Assigning apps to groups *](images/sh2-apps-assign.png) diff --git a/devices/surface-hub/surface-hub-2s-deploy-checklist.md b/devices/surface-hub/surface-hub-2s-deploy-checklist.md deleted file mode 100644 index 08421ad2f6..0000000000 --- a/devices/surface-hub/surface-hub-2s-deploy-checklist.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: "Surface Hub 2S deployment checklists" -description: "Verify your deployment of Surface Hub 2S using pre- and post-deployment checklists." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S deployment checklists - -## Surface Hub 2S pre-deployment checklist - -|**Item**|**Response**| -|:------ |:------ | -|**Device account name**| | -|**Device account UPN**| | -|**ActiveSync Policy**| | -|**Calendar processing configuration completed**| ☐ Yes
☐ No | -|**Device-friendly name**| | -|**Device host name**| | -|**Affiliation**| ☐ None
☐ Active Directory affiliation
☐ Azure Active Directory | -|**Microsoft Teams Mode**| ☐ Mode 0
☐ Mode 1
☐ Mode 2 | -|**Device Management**| ☐ Yes, Microsoft Intune
☐ Yes, other mobile device manager [MDM]
☐ None | -|**Proxy**| ☐ Automatic configuration
☐ Proxy server
☐ Proxy auto-config (PAC) file | -|**Proxy authentication**| ☐ Device account credentials
☐ Prompt for credentials | -|**Password rotation**| ☐ On
☐ Off | -|**Skype for Business additional domain names (on-premises only)**| | -|**Session timeout time**| | -|**Session timeout action**| ☐ End session
☐ Allow resume | -|**My meetings and files**| ☐ Enabled
☐ Disabled | -|**Lock screen timeout**| | -|**Sleep idle timeout**| | -|**Bluetooth**| ☐ On
☐ Off | -|**Use only BitLocker USB drives**| ☐ On
☐ Off | -|**Install additional certificates (on-premises only)**| | -|**Windows update**| ☐ Windows Update for Business
☐ Windows Server Update Services [WSUS] | -|**Surface app speaker setting**| ☐ Rolling stand
☐ Wall-mounted | -|**IP Address**| ☐ Wired — DHCP
☐ Wired — DHCP reservation
☐ Wireless — DHCP
☐ Wireless — DHCP reservation | - -## Surface Hub 2S post-deployment checklist - -|**Check**|**Response**| -|:------|:---------| -|**Device account syncing**| ☐ Yes
☐ No | -|**Bitlocker key**| ☐ Saved to file (no affiliation)
☐ Saved in Active Directory (AD affiliation)
☐ Saved in Azure AD (Azure AD affiliation) | -|**Device OS updates**| ☐ Completed | -|**Windows Store updates**| ☐ Automatic
☐ Manual | -|**Microsoft Teams scheduled meeting**| ☐ Confirmation email received
☐ Meeting appears on start screen
☐ One-touch join functions
☐ Able to join audio
☐ Able to join video
☐ Able to share screen || -|**Skype for Business scheduled meeting**| ☐ Confirmation email received
☐ Meeting appears on start screen
☐ One-touch join functions correctly
☐ Able to join audio
☐ Able to join video
☐ Able to share screen
☐ Able to send/receive IM | -|**Scheduled meeting when already invited**| ☐ Meeting declined | -|**Microsoft Teams ad-hoc meeting**| ☐ Invite other users work
☐ Able to join audio
☐ Able to join video
☐ Able to share screen | -|**Skype for Business scheduled meeting**| ☐ Invite other users work
☐ Able to join audio
☐ Able to join video
☐ Able to share screen
☐ Able to send/receive IM | -|**Microsoft Whiteboard**| ☐ Launch from Welcome / Start screen
☐ Launch from Microsoft Teams | -|**Incoming Skype/Teams call**| ☐ Able to join audio
☐ Able to join video
☐ Able to share screen
☐ Able to send/receive IM (Skype for Business only) | -|**Incoming live video streams**| ☐ Maximum 2 (Skype for Business)
☐ Maximum 4 (Microsoft Teams) | -|**Microsoft Teams Mode 0 behavior**| ☐ Skype for Business tile on Welcome/Start screen
☐ Can join scheduled Skype for Business meetings (Skype UI)
☐ Can join scheduled Teams meetings (Teams UI) | -|**Microsoft Teams Mode 1 behavior**| ☐ Teams tile on Welcome/Start screen
☐ Can join scheduled Skype for Business meetings (Skype UI)
☐ Can join scheduled Teams meetings (Teams UI) | -|**Microsoft Teams Mode 2 behavior**| ☐ Teams tile on Welcome / Start screen
☐ Can join scheduled Teams meetings
☐ Fail to join Skype for Business meetings | diff --git a/devices/surface-hub/surface-hub-2s-deploy.md b/devices/surface-hub/surface-hub-2s-deploy.md deleted file mode 100644 index 87908ed944..0000000000 --- a/devices/surface-hub/surface-hub-2s-deploy.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: "Create provisioning packages for Surface Hub 2S" -description: "This page describes how to deploy Surface Hub 2S using provisioning packages and other tools." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Create provisioning packages for Surface Hub 2S - -You can use Windows Configuration Designer (WCD) to create provisioning packages to automate the deployment process of Surface Hub 2S. Use provisioning packages to add certificates, configure proxies, set up device administrators and device accounts. You can also use provisioning packages along with a configuration file to deploy multiple Surface Hubs with a single USB thumb drive. - -### Install Windows Configuration Designer - -Install Windows Configuration Designer from the Windows Assessment and Deployment Kit (ADK) for Windows 10. Download and install the [ADK for Windows 10, version 1703](https://go.microsoft.com/fwlink/p/?LinkId=845542). For more information, see [Download and install the Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install). - -### Add certificates - -You can import Certificate Authority certificates to Surface Hub 2S. -To add certificates to Surface Hub 2S, you need a copy of each certificate as X.509 in .cer format. You cannot import .crt, .pfx or other container formats. Certificates must be imported into Windows Configuration Designer and arranged by hierarchy: - - ![Add certificates](images/sh2-wcd.png) - -### Configure proxy during OOBE - -In Windows Configuration Designer, go to the Configure proxy settings tab and enter the appropriate settings as shown below. - - ![Configure proxy settings](images/sh2-proxy.png) - -> [!NOTE] -> When configuring proxy settings, turn off **Automatically detect settings** if you intend to use a setup script or a proxy server. You can use a setup script *or* a proxy server, not both. - -### Affiliate Surface Hub 2S with Azure Active Directory - -You can affiliate Surface Hub 2S with Azure Active Directory using a provisioning package: -As an Azure Active Directory Global Administrator, you can join large numbers of new Windows devices to Azure Active Directory and Intune using a bulk token. - -To create a bulk token, give it a friendly name, configure the expiration date (maximum of 30 days) and use your Admin credentials to acquire the token as shown below: - - ![Set up device admins](images/sh2-token.png)

- ![Set up device admins](images/sh2-token2.png)

- ![Set up device admins](images/sh2-token3.png)

- -### Provisioning multiple devices (.csv file) - -In addition to the provisioning package, you can use a Surface Hub configuration file to make it even easier to set up your devices. A Surface Hub configuration file contains a list of device accounts and friendly names for wireless projection. During first run, you get an option to choose a device account and friendly name from a configuration file. - -### To create a Surface Hub configuration file - -1. Using Microsoft Excel or another CSV editor, create a CSV file named: **SurfaceHubConfiguration.csv** -2. Enter a list of device accounts and friendly names in this format: - -``` -,, -``` - -3. Save the file to the root of the USB thumb drive where you copied the PPKG file. - - ![Configuration file example](images/sh2-config-file.png) diff --git a/devices/surface-hub/surface-hub-2s-install-mount.md b/devices/surface-hub/surface-hub-2s-install-mount.md deleted file mode 100644 index 1ae4dcadb6..0000000000 --- a/devices/surface-hub/surface-hub-2s-install-mount.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Install and mount Surface Hub 2S" -description: "Learn how to install and mount Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Install and mount Surface Hub 2S - -Surface Hub 2S is designed for ease of mobility with a form factor that enables you to quickly install and begin using the device. Microsoft has partnered with Steelcase on the following certified mounting solutions: Roam Mobile Stand and Roam Wall Mount. Both fully integrate with the design of Surface Hub 2S, enabling unimpeded access to the compute cartridge, power, USB-A, USB-C, and other ports. - -You can mount Surface Hub 2S with the certified wall mount or the certified mobile stand, both developed in partnership with Steelcase. Both fully integrate with the design of Surface Hub 2S, enabling unimpeded access to the compute cartridge along with all I/O ports and power. - -For more information, see [Officially licensed third-party accessories](http://licensedhardware.azurewebsites.net/surface) and view installation demos from the Surface product team at [Steelcase mobile stand and APC battery set up](https://youtu.be/VTzdu4Skpkg). - - ![Surface Hub 2S on Roam Mobile Stand](images/sh2-mobile-stand.png)
- -If you’re not using licensed accessories, see [Customize wall mount of Surface Hub 2S](surface-hub-2s-custom-install.md). - -| 1. **Set up your mount first** | | -|:------ |:-------- | -| Leave your Surface Hub in the box until the mount is set up and mounting hardware is applied. Mount is not included. Your mount is sold separately. | ![* Set up your mount first *](images/sh2-setup-1.png)
| -| 2. **Attach hardware to the Surface Hub** | | -| Mounting hardware and specific instructions are found in the box for your mount. | ![* Attach hardware to the Surface Hub *](images/sh2-setup-2.png)
| -| 3. **Remove the instructional label before mounting.** | | -| Get someone to help you lift and mount your Surface Hub. Make sure to hold and lift the Surface Hub from the bottom. | ![* Remove the instructional label before mounting *](images/sh2-setup-3.png)
| -| 4. **Attach accessories and power on** | | -| Install accessories and attach power cable as shown. See guides on the screen cling. Remove cling wrap from the screen. Press the power button to power on. | ![* Attach accessories and power on *](images/sh2-setup-4.png)
| diff --git a/devices/surface-hub/surface-hub-2s-manage-intune.md b/devices/surface-hub/surface-hub-2s-manage-intune.md deleted file mode 100644 index c36d53f1f6..0000000000 --- a/devices/surface-hub/surface-hub-2s-manage-intune.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: "Manage Surface Hub 2S with Intune" -description: "Learn how to update and manage Surface Hub 2S using Intune." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 02/28/2020 -ms.localizationpriority: Medium ---- - -# Manage Surface Hub 2S with Intune - -## Register Surface Hub 2S with Intune - -Surface Hub 2S allows IT administrators to manage settings and policies using a mobile device management (MDM) provider. Surface Hub 2S has a built-in management component to communicate with the management server, so there is no need to install additional clients on the device. - -### Manual registration - -1. Sign in as a local administrator on Surface Hub 2S and open the **Settings** app. Select **Surface Hub** > **Device management** and then select **+** to add. -2. After authenticating, the device will automatically register with Intune. - - ![Register Surface Hub 2S with Intune](images/sh2-set-intune1.png)
- -### Auto registration — Azure Active Directory Affiliated - -During the initial setup process, when affiliating a Surface Hub with an Azure AD tenant that has Intune auto enrollment enabled, the device will automatically enroll with Intune. For more information, refer to [Intune enrollment methods for Windows devices](https://docs.microsoft.com/intune/enrollment/windows-enrollment-methods). Azure AD affiliation and Intune auto enrollment is required for the Surface Hub to be a "compliant device" in Intune. - -## Windows 10 Team Edition settings - -Select Windows 10 Team for preset device restriction settings for Surface Hub and Surface Hub 2S. - - ![Set device restrictions for Surface Hub 2S.](images/sh2-set-intune3.png)
- -These settings include user experience and app behavior, Azure Log Analytics registration, Maintenance windows configuration, Session settings, and Miracast settings. For a complete list of available Windows 10 Team settings, see [SurfaceHub CSP](https://docs.microsoft.com/windows/client-management/mdm/surfacehub-csp). - -## Additional supported configuration service providers (CSPs) - -For additional supported CSPs, see [Surface Hub CSPs in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#surfacehubcspsupport). - -## Quality of Service (QoS) settings - -To ensure optimal video and audio quality on Surface Hub 2S, add the following QoS settings to the device. - -### Microsoft Teams QoS settings - -|**Name**|**Description**|**OMA-URI**|**Type**|**Value**| -|:------ |:------------- |:--------- |:------ |:------- | -|**Audio Ports**| Audio Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/TeamsAudio/DestinationPortMatchCondition | String | 3478-3479 | -|**Audio DSCP**| Audio ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/TeamsAudio/DSCPAction | Integer | 46 | -|**Video Port**| Video Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/TeamsVideo/DestinationPortMatchCondition | String | 3480 | -|**Video DSCP**| Video ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/TeamsVideo/DSCPAction | Integer | 34 | -|**P2P Audio Ports**| Audio Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/TeamsP2PAudio/DestinationPortMatchCondition | String | 50000-50019 | -|**P2P Audio DSCP**| Audio ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/TeamsP2PAudio/DSCPAction | Integer | 46 | -|**P2P Video Ports**| Video Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/TeamsP2PVideo/DestinationPortMatchCondition | String | 50020-50039 | -|**P2P Video DSCP**| Video ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/TeamsP2PVideo/DSCPAction | Integer | 34 | - - -### Skype for Business QoS settings - -| Name | Description | OMA-URI | Type | Value | -| ------------------ | ------------------- | ------------------------------------------------------------------------ | ------- | ------------------------------ | -| Audio Ports | Audio Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/SfBAudio/SourcePortMatchCondition | String | 50000-50019 | -| Audio DSCP | Audio ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/SfBAudio/DSCPAction | Integer | 46 | -| Audio Media Source | Skype App name | ./Device/Vendor/MSFT/NetworkQoSPolicy/SfBAudio/AppPathNameMatchCondition | String | Microsoft.PPISkype.Windows.exe | -| Video Ports | Video Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/SfBVideo/SourcePortMatchCondition | String | 50020-50039 | -| Video DSCP | Video ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/SfBVideo/DSCPAction | Integer | 34 | -| Video Media Source | Skype App name | ./Device/Vendor/MSFT/NetworkQoSPolicy/SfBVideo/AppPathNameMatchCondition | String | Microsoft.PPISkype.Windows.exe | - -> [!NOTE] -> Both tables show default port ranges. Administrators may change the port ranges in the Skype for Business and Teams control panel. - -## Microsoft Teams Mode settings - -You can set the Microsoft Teams app mode using Intune. Surface Hub 2S comes installed with Microsoft Teams in mode 0, which supports both Microsoft Teams and Skype for Business. You can adjust the modes as shown below. - -### Modes: - -- Mode 0 — Skype for Business with Microsoft Teams functionality for scheduled meetings. -- Mode 1 — Microsoft Teams with Skype for Business functionality for scheduled meetings. -- Mode 2 — Microsoft Teams only. - -To set modes, add the following settings to a custom Device Configuration Profile. - -|**Name**|**Description**|**OMA-URI**|**Type**|**Value**| -|:--- |:--- |:--- |:--- |:--- | -|**Teams App ID**|App name|./Vendor/MSFT/SurfaceHub/Properties/VtcAppPackageId|String| Microsoft.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe!Teams| -|**Teams App Mode**|Teams mode|./Vendor/MSFT/SurfaceHub/Properties/SurfaceHubMeetingMode|Integer| 0 or 1 or 2| diff --git a/devices/surface-hub/surface-hub-2s-manage-passwords.md b/devices/surface-hub/surface-hub-2s-manage-passwords.md deleted file mode 100644 index accd5d7e84..0000000000 --- a/devices/surface-hub/surface-hub-2s-manage-passwords.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: "Manage device account password rotation" -description: "Learn how to configure Surface Hub 2S on-premises accounts with PowerShell" -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- -# Manage device account password rotation - -You can configure Surface Hub 2S to automatically change a device account password without requiring you to manually update the device account information. - -If you turn on Password Rotation, Surface Hub 2S changes the password every 7 days. The automatically generated passwords contain 15-32 characters including a combination of uppercase and lowercase letters, numbers, and special characters. - -Passwords do not change during a meeting. If Surface Hub 2S is turned off, it attempts to change the password immediately when turned on or every 10 minutes until successful. diff --git a/devices/surface-hub/surface-hub-2s-onprem-powershell.md b/devices/surface-hub/surface-hub-2s-onprem-powershell.md deleted file mode 100644 index 6a0553f72e..0000000000 --- a/devices/surface-hub/surface-hub-2s-onprem-powershell.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: "Configure Surface Hub 2S on-premises accounts with PowerShell" -description: "Learn how to configure Surface Hub 2S on-premises accounts with PowerShell" -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Configure Surface Hub 2S on-premises accounts with PowerShell - -## Connect to Exchange Server PowerShell - -> [!IMPORTANT] -> You'll need the Fully Qualified Domain Name (FQDN) for the Client Access service of the on-premises Exchange server for some of these cmdlets. - -```PowerShell -$ExchServer = Read-Host "Please Enter the FQDN of your Exchange Server" -$ExchSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://$ExchServer/PowerShell/ -Authentication Kerberos -Credential (Get-Credential) -Import-PSSession $ExchSession -``` - -## Create the device account - -```PowerShell -New-Mailbox -UserPrincipalName Hub01@contoso.com -Alias Hub01 -Name "Hub 01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) -``` - -## Set automatic calendar processing - -```PowerShell -Set-CalendarProcessing -Identity "HUB01@contoso.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -AddAdditionalResponse $true -AdditionalResponse "This room is equipped with a Surface Hub" -``` - -## Enable the Skype for Business object - -> [!NOTE] -> It is important that you know the FQDN of the Skype for Business Registrar Pool. - -```PowerShell -Enable-CsMeetingRoom -Identity Contoso\HUB01 -SipAddressType emailaddress -RegistrarPool SfbIEFE01.contoso.local -``` - -## Mobile Device Mailbox Policy - -You may need to create a Mobile Device Mailbox Policy (also known as ActiveSync Policy) to allow your Surface Hub to connect to your online or on-premises environment. - -## Create a Surface Hub mobile device mailbox policy - -```PowerShell -New-MobileDeviceMailboxPolicy -Name “Surface Hubs” -PasswordEnabled $false -``` - -## Additional settings - -It is recommended to add a MailTip to Surface Hub rooms so users remember to make the meeting a Skype for Business or Teams meeting: - -```PowerShell -Set-Mailbox "Surface Hub 2S" -MailTip "This is a Surface Hub room. Please make sure this is a Microsoft Teams meeting." -``` diff --git a/devices/surface-hub/surface-hub-2s-onscreen-display.md b/devices/surface-hub/surface-hub-2s-onscreen-display.md deleted file mode 100644 index da4712505e..0000000000 --- a/devices/surface-hub/surface-hub-2s-onscreen-display.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: "Adjust Surface Hub 2S brightness, volume, and input" -description: "Learn how to use the onscreen display to adjust brightness and other settings in Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 07/09/2019 -ms.localizationpriority: Medium ---- -# Adjust Surface Hub 2S brightness, volume, and input - -Surface Hub 2S provides an on-screen display for volume, brightness, and input control. The Source button functions as a toggle key to switch between the volume, brightness, and input control menus. - -## To show the on-screen display - -- Press and hold the **Source** button for 4 seconds. - - ![Surface Hub 2S on-screen display](images/sh2-onscreen-display.png)
- - When the on-screen display is visible, use one or more buttons to reach desired settings. - -## To adjust volume - -- Use the **Volume up/down** button to increase or decrease volume. - -## To adjust brightness - -1. Press the **Source** button again to switch to the brightness menu. -2. Use the **Volume up/down** button to increase or decrease brightness. - -## To adjust input - -1. Press the **Source** button twice to switch to the Source menu. -2. Use the **Volume up/down** button to switch between PC, HDMI, and USB-C inputs. diff --git a/devices/surface-hub/surface-hub-2s-pack-components.md b/devices/surface-hub/surface-hub-2s-pack-components.md deleted file mode 100644 index 2c713a0a21..0000000000 --- a/devices/surface-hub/surface-hub-2s-pack-components.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: "How to pack and ship your Surface Hub 2S for service" -description: "Instructions for packing Surface Hub 2S components, replacing the Compute cartridge, and replacing the camera" -keywords: pack, replace components, camera, compute cartridge -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 02/06/2019 -ms.localizationpriority: Medium ---- - -# How to pack and ship your Surface Hub 2S for service - -If you replace your Surface Hub 2S, one of its components, or a related accessory, use the instructions in this article when you pack the device for shipment. - ->[!IMPORTANT] ->When packing your device for shipment, make sure that you use the packaging in which your replacement device arrived. - -## How to pack your Surface Hub 2S 50” - -Use the following steps to pack your Surface Hub 2S 50" for shipment. - - -| | | | -| - | ----------------------------------------------------------------------------------------------------------------------------------------------- | ----- | -| **1.** | Remove the pen and the camera. Do not pack them with the unit. | ![Remove the pen and the camera. Do not pack them with the unit.](images/surface-hub-2s-repack-2.png) | -| **2.** | Remove the drive and the power cable. Do not pack them with the unit. Do not pack the Setup guide with the unit. | ![Remove the drive and the power cable. Do not pack them with the unit.](images/surface-hub-2s-repack-3.png) | -| **3.** | Unplug all cables, slide the cover sideways, and unscrew the locking screw of the Compute Cartridge. | ![Unplug all cables, slide the cover sideways, and unscrew the locking screw of the Compute Cartridge.](images/surface-hub-2s-repack-5.png) | -| **4.** | Slide the Compute Cartridge out of the unit. | ![Slide the Compute Cartridge out of the unit.](images/surface-hub-2s-repack-6.png) | -| **5.** | You will need the Compute Cartridge and a screwdriver. | ![You will need the Compute Cartridge and a screwdriver.](images/surface-hub-2s-repack-7.png)| -| **6.** | Remove the cover screw and the cover from the Compute Cartridge, and then remove the solid state drive (SSD). | ![Remove the cover screw and the cover from the Compute Cartridge, and then remove the solid state drive (SSD).](images/surface-hub-2s-repack-8.png)| -| **7.** | Replace the cover and slide the Compute Cartridge back into the unit. | ![Replace the cover and slide the Compute Cartridge back into the unit.](images/surface-hub-2s-repack-9.png)| -| **8.** | Re-fasten the locking screw and slide the cover into place. | ![Re-fasten the locking screw and slide the cover into place.](images/surface-hub-2s-repack-10.png)| -| **9.** | Remove any base or mounting hardware. Using two people, place the unit in the base of the shipping container. | ![Remove any base or mounting hardware. Using two people, place the unit in the base of the shipping container.](images/surface-hub-2s-repack-11.png)| -| **10.** | Replace the cover of the shipping container, and insert the four clips. | ![Replace the cover of the shipping container, and insert the four clips.](images/surface-hub-2s-repack-12.png)| -| **11.** | Close the four clips. | ![Close the four clips.](images/surface-hub-2s-repack-13.png)| - - -## How to replace and pack your Surface Hub 2S Compute Cartridge - -Use the following steps to remove the Surface Hub 2S Compute Cartridge, pack it for shipment, and install the new Compute Cartridge.
- ![Image of the compute cartridge.](images/surface-hub-2s-replace-cartridge-1.png) - -| | | | -| - | ----------------------------------------------------------------------------------------------------------------------------------------------- | ----- | -| **1.** | Unplug all cables, slide the cover sideways, and unscrew the locking screw of the Compute Cartridge. | ![Unplug all cables, slide the cover sideways, and unscrew the locking screw of the Compute Cartridge.](images/surface-hub-2s-replace-cartridge-2.png) | -| **2.** | Slide the Compute Cartridge out of the unit. | ![Slide the Compute Cartridge out of the unit.](images/surface-hub-2s-replace-cartridge-3.png) | -| **3.** | You will need the Compute Cartridge and a screwdriver. | ![You will need the Compute Cartridge and a screwdriver.](images/surface-hub-2s-replace-cartridge-4.png) | -| **4.** | Remove the cover screw and the cover from the Compute Cartridge, and then remove the solid state drive (SSD). When finished, replace the cover. | ![Remove the cover screw and the cover from the Compute Cartridge, and then remove the solid state drive (SSD). When finished, replace the cover.](images/surface-hub-2s-repack-8.png) | -| **5.**| You will need the packaging fixtures that were used to package your replacement Compute Cartridge. | ![You will need the packaging fixtures that were used to package your replacement Compute Cartridge.](images/surface-hub-2s-replace-cartridge-6.png) | -| **6.**| Place the old Compute Cartridge in the packaging fixtures. | ![Place the old Compute Cartridge in the packaging fixtures.](images/surface-hub-2s-replace-cartridge-7.png) | -| **7.** | Place the old Compute Cartridge and its packaging into the box that was used for the replacement Compute Cartridge. Reseal the box. | ![Place the old Compute Cartridge and its packaging into the box that was used for the replacement Compute Cartridge. Reseal the box.](images/surface-hub-2s-replace-cartridge-8.png)| -| **8.**| Slide the replacement Compute Cartridge into the unit. | ![Slide the replacement Compute Cartridge into the unit.](images/surface-hub-2s-replace-cartridge-9.png) | -| **9.**| Fasten the locking screw and slide the cover into place | ![Fasten the locking screw and slide the cover into place.](images/surface-hub-2s-replace-cartridge-10.png) | - -## How to replace your Surface Hub 2S Camera - -Use the following steps to remove the Surface Hub 2S camera and install the new camera. - - -| | | | -| - | ----------------------------------------------------------------------------------------------------------------------------------------------- | ----- | -| **1.** | You will need the new camera and the two-millimeter allen wrench. |![You will need the new camera and the two-millimeter allen wrench](images/surface-hub-2s-replace-camera-1.png) | -| **2.** | Unplug the old camera from the unit. If needed, use the allen wrench to adjust the new camera. Plug the new camera into the unit. | ![Unplug the old camera from the unit. If needed, use the allen wrench to adjust the new camera. Plug the new camera into the unit.](images/surface-hub-2s-replace-camera-2.png) | diff --git a/devices/surface-hub/surface-hub-2s-pen-firmware.md b/devices/surface-hub/surface-hub-2s-pen-firmware.md deleted file mode 100644 index ce16a5cad3..0000000000 --- a/devices/surface-hub/surface-hub-2s-pen-firmware.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: "Update pen firmware on Surface Hub 2S" -description: "This page describes how to update firmware for the Surface Hub 2 pen." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 02/26/2020 -ms.localizationpriority: Medium ---- - -# Update pen firmware on Surface Hub 2S - -You can update firmware on Surface Hub 2 pen from Windows Update for Business or by downloading the firmware update to a separate PC. Updated firmware is available from Windows Update beginning February 26, 2020. - -## Update pen firmware using Windows Update for Business - -This section describes how to update pen firmware via the automated maintenance cycles for Windows Update, configured by default to occur nightly at 3 a.m. You will need to plan for two maintenance cycles to complete before applying the update to the Surface Hub 2 pen. Alternately, like any other update, you can use Windows Server Update Services (WSUS) to apply the pen firmware. For more information, see [Managing Windows updates on Surface Hub](manage-windows-updates-for-surface-hub.md). - -1. Ensure the Surface Hub 2 pen is paired to Surface Hub 2S: Press and hold the **top** button until the white indicator LED light begins to blink.
-![Surface Hub 2 pen](images/sh2-pen-1.png)
-2. On Surface Hub, login as an Admin, open **Settings**, and then scan for new Bluetooth devices. -3. Select the pen to complete the pairing process. -4. Press the **top** button on the pen to apply the update. It may take up to two hours to complete. - -## Update pen firmware by downloading to separate PC - -You can update the firmware on Surface Hub 2 pen from a separate PC running Windows 10. This method also enables you to verify that the pen firmware has successfully updated to the latest version. - -1. Pair the Surface Hub 2 pen to your Bluetooth-capable PC: Press and hold the **top** button until the white indicator LED light begins to blink.
-![Surface Hub 2 pen](images/sh2-pen-1.png)
-2. On the PC, scan for new Bluetooth devices. -3. Select the pen to complete the pairing process. -4. Disconnect all other Surface Hub 2s pens before starting a new update. -3. Download the [Surface Hub 2 Pen Firmware Update Tool](https://download.microsoft.com/download/8/3/F/83FD5089-D14E-42E3-AF7C-6FC36F80D347/Pen_Firmware_Tool.zip) to your PC. -4. Run **PenCfu.exe.** The install progress is displayed in the tool. It may take several minutes to finish updating. - - -## Check firmware version of Surface Hub 2 pen - -1. Run **get_version.bat** and press the **top** button on the pen. -2. The tool will report the firmware version of the pen. Example: - - Old firmware is 468.2727.368 - - New firmware is 468.2863.369 - -## Command line options - -You can run Surface Hub 2 Pen Firmware Update Tool (PenCfu.exe) from the command line. - -1. Pair the pen to your PC and click the **top** button on the pen. -2. Double click **PenCfu.exe** to initiate the firmware update. Note that the configuration file and the firmware image files must be stored in the same folder as the tool. -3. For additional options, run **PenCfu.exe -h** to display the available parameters, as listed in the following table. - - Example: PenCfu.exe -h -4. Enter **Ctrl+C** to safely shut down the tool. - - - -| **Command** | **Description** | -| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| -h help | Display tool command line interface help and exit. | -| -v version | Display tool version and exit. | -| -l log-filter | Set a filter level for the log file. Log messages have 4 possible levels: DEBUG (lowest), INFO, WARNING and ERROR (highest). Setting a log filter level filters log messages to only message with the same level or higher. For example, if the filter level is set to WARNING, only WARNING and ERROR messages will be logged. By default, this option is set to OFF, which disables logging. | -| -g get-version | If specified, the tool will only get the FW version of the connected pen that matches the configuration file that is stored in the same folder as the tool. \ No newline at end of file diff --git a/devices/surface-hub/surface-hub-2s-phone-authenticate.md b/devices/surface-hub/surface-hub-2s-phone-authenticate.md deleted file mode 100644 index f79bbca0d4..0000000000 --- a/devices/surface-hub/surface-hub-2s-phone-authenticate.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Configure password-less phone sign-in for Surface Hub 2S" -description: "Learn how to simplify signing in to Surface Hub 2S using password-less phone sign-in on your mobile device." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Configure password-less phone sign-in for Surface Hub 2S - -Password-less phone sign-in simplifies signing-in to your meetings and files on Surface Hub 2S. - -> [!NOTE] -> Password-less phone sign-in requires that your primary email address must match your UPN. - -## To set up password-less phone sign-in - -1. Download the [Microsoft Authenticator](https://www.microsoft.com/account/authenticator) app for iPhone or Android to your phone. -2. From your PC, go to [https://aka.ms/MFASetup](https://aka.ms/MFASetup) , sign in with your account, and select **Next.** -3. In the Additional security verification screen, select Mobile App and Use verification code, and then select **Setup**. - -## To configure mobile app - -1. In the Microsoft authenticator app on your phone, add an account, choose **Work or School Account**, and then scan the QR code displayed on your PC -2. Send a notification to your phone and then approve the sign-in request. -3. In the Authenticator app on your phone, use the drop-down menu next to your account and select **Enable phone sign-in**. -4. If required, register your device with your organization and follow the on-screen instructions. - -## To sign in to Surface Hub - -1. On Surface Hub, sign into **My meetings and files** and select **Send notification** when prompted. -2. Match the number displayed on your phone with the number displayed on Surface Hub to approve your sign-in request. -3. If prompted, enter the PIN or biometric ID on your phone to complete sign-in. - -## Learn more -For more information, see [Password-less phone sign-in with the Microsoft Authenticator app](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-phone-sign-in). diff --git a/devices/surface-hub/surface-hub-2s-port-keypad-overview.md b/devices/surface-hub/surface-hub-2s-port-keypad-overview.md deleted file mode 100644 index 8a667d95ac..0000000000 --- a/devices/surface-hub/surface-hub-2s-port-keypad-overview.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Surface Hub 2S ports and keypad overview" -description: "This page describes the ports, physical buttons, and configuration information essential for connecting to Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S ports and keypad overview - -This page describes the ports, physical buttons, and configuration information essential for connecting to Surface Hub 2S whether via wired, Wi-Fi, or Bluetooth methods. It also includes best practice recommendations for key connectivity scenarios. - -> [!NOTE] -> You can find the serial number on the outside of the packaging, on the display by the power cord, or by using the Surface app. - -The figure below shows the location of ports and physical buttons on a keypad attached to the underside of the device. The table includes detailed descriptions of each element. - - ![Front facing and underside view of I/O connections and physical buttons](images/hub2s-schematic.png) - -## Port and keypad component reference - -|**Key**|**Component**|**Description**|**Key parameters**| -|:--- |:--------- |:----------- |:-------------- | -| 1 | **USB C** | **USB 3.1 Gen 1**
Use as a walk-up port for plugging in peripherals such as thumb-drives. Guest ports are on each side of the device (4).

*NOTE: This is the recommended port for connecting an external camera. Additional camera mount features are incorporated into the design to help support retention of attached cameras.*

NOTE: TouchBack and video ingest are not supported on these ports. | Type C

15 W Port (5V/3A) | -| 2 | **AC power** | **100-240 V input**
Connect to standard AC power and Surface Hub 2S will auto switch to the local power standard such as110 volts in the US and Canada or 220 volts in the UK. | IEC 60320 C14 | -| 3 | **DC power** | **24V DC input port**
Use for connecting to mobile battery. | Xbox1 Dual barrel to Anderson connector | -| 4 | **Ethernet** | **1000/100/10 Base-T**
Use for providing a continuous connection in a corporate environment and related scenarios requiring maximum stability or capacity. | RJ45 | -| 5 | **USB-A** | **USB 3.1 Gen 1**
Use as a walk-up port for plugging in peripherals such as thumb-drives. | Type A
7.5 W Port (5V/1.5A) | -| 6 | **USB-C** | **USB 3.1 Gen 1**
Use as a walk-up port for connecting external PCs and related devices or plugging in peripherals such as thumb-drives.

*NOTE: This is the recommended input port for video, TouchBack, and InkBack.* | Type C
18 W Port (5V/3A, 9V/2A) | -| 7 | **HDMI-in** | **HDMI 2.0, HDCP 2.2 /1.4**
Use for multiple scenarios including HDMI-to-HDMI guest input. | Standard HDMI | -| 8 | **Mini DP-out** | **Mini DP 1.2 output**
Use for video-out scenarios such as mirroring the Surface Hub 2S display to a larger projector.

*NOTE: This supports a maximum resolution of 3840 x 2160 (4K UHD) @60Hz.* | Mini DP | -| 9 | **Source** | Use to toggle among connected ingest sources — external PC, HDMI, and Mini DP modes. | n/a | -| 10 | **Volume** | Use +/- to adjust audio locally on the device.

*NOTE: When navigating to the brightness control, use +/- on the volume slider to control display brightness.* | n/a | -| 11 | **Power** | Power device on/off.
Use also to navigate display menus and select items. | n/a | - - ![Rear facing view of wireless, audio, & related components](images/hub2s-rear.png) diff --git a/devices/surface-hub/surface-hub-2s-prepare-environment.md b/devices/surface-hub/surface-hub-2s-prepare-environment.md deleted file mode 100644 index 5f10258934..0000000000 --- a/devices/surface-hub/surface-hub-2s-prepare-environment.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: "Prepare your environment for Surface Hub 2S" -description: "Learn what you need to do to prepare your environment for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 11/21/2019 -ms.localizationpriority: Medium ---- - -# Prepare your environment for Surface Hub 2S - -## Office 365 readiness - -If you use Exchange Online, Skype for Business Online, Microsoft Teams, or Microsoft Whiteboard, and intend to manage Surface Hub 2S with Intune, first review the [Office 365 requirements for endpoints](https://docs.microsoft.com/office365/enterprise/office-365-endpoints). - -Office 365 endpoints help optimize your network by sending all trusted Office 365 network requests directly through your firewall, bypassing all additional packet-level inspection or processing. This feature reduces latency and your perimeter capacity requirements. - -Microsoft regularly updates the Office 365 service with new features and functionality, which may alter required ports, URLs, and IP addresses. To evaluate, configure, and stay up to date with changes, subscribe to the [Office 365 IP Address and URL Web service](https://docs.microsoft.com/office365/enterprise/office-365-ip-web-service). - -## Device affiliation - -Use Device affiliation to manage user access to the Settings app on Surface Hub 2S. -With the Windows 10 Team Edition operating system (that runs on Surface Hub 2S), only authorized users can adjust settings using the Settings app. Since choosing the affiliation can impact feature availability, plan appropriately to ensure that users can access features as intended. - -> [!NOTE] -> You can only set Device affiliation during the initial out-of-box experience (OOBE) setup. If you need to reset Device affiliation, you’ll have to repeat OOBE setup. - -## No affiliation - -No affiliation is like having Surface Hub 2S in a workgroup with a different local Administrator account on each Surface Hub 2S. If you choose No affiliation, you must locally save the [BitLocker Key to a USB thumb drive](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-key-management-faq). You can still enroll the device with Intune; however, only the local admin can access the Settings app using the account credentials configured during OOBE. You can change the Administrator account password from the Settings app. - -## Active Directory Domain Services - -If you affiliate Surface Hub 2S with on-premises Active Directory Domain Services, you need to manage access to the Settings app using a security group on your domain. This helps ensure that all security group members have permissions to change settings on Surface Hub 2S. Also note the following: - -- When Surface Hub 2S affiliates with your on-premises Active Directory Domain Services, the BitLocker key can be saved in the Active Directory Schema. For more information, see [Prepare your organization for BitLocker: Planning and policies](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies). -- Your organization’s Trusted Root CAs are pushed to the same container in Surface Hub 2S, which means you don’t need to import them using a provisioning package. -- You can still enroll the device with Intune to centrally manage settings on your Surface Hub 2S. - -## Azure Active Directory - -When you choose to affiliate your Surface Hub 2S with Azure Active Directory (Azure AD), any user in the Global Admins Security Group can sign in to the Settings app on Surface Hub 2S. Currently, no other group can be delegated to sign in to the Settings app on Surface Hub 2S. - -If you enabled Intune Automatic Enrollment for your organization, Surface Hub 2S will automatically enroll itself with Intune. The device’s BitLocker key is automatically saved in Azure AD. When affiliating Surface Hub 2S with Azure AD, single sign-on and Easy Authentication will not work. diff --git a/devices/surface-hub/surface-hub-2s-quick-start.md b/devices/surface-hub/surface-hub-2s-quick-start.md deleted file mode 100644 index 3d7f08641a..0000000000 --- a/devices/surface-hub/surface-hub-2s-quick-start.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: "Surface Hub 2S quick start" -description: "View the quick start steps to begin using Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S quick start - -## Unpack Surface Hub 2S - -1. Use the handles on each side of the box to move it to the space where you'll set it up. -2. Before opening, remove the clips (4) on the front and back, and then lift the top off the box using the handles. -3. In the base of the Surface Hub 2S, open the accessories box containing the setup guide, Surface Hub 2 pen, Surface Hub 2 camera, and the power cable. -4. On the back of the Surface Hub, there's an instructional label showing you where to attach the mounting hardware. Install them in place and remove the label. - -See this video for more information about [unboxing and set up](https://youtu.be/fCrxdNXvru4). - -## Install and adjust pen - -1. Attach Surface Hub 2 pen magnetically to your preferred side of the device. - -![*Surface Hub 2 pen comes ready to use. To replace AAA battery, pull off the top button and insert battery as shown. The indicator light will turn red when the battery is low.*](images/sh2-pen.png)
- -2. To adjust pen pressure, open the Surface app on Surface Hub 2S, select Pen, and adjust the slider. - -![*Adjust the slider to change pen pressure *](images/sh2-pen-pressure.png)
- -## Install camera - -Remove the lens cling from the camera and attach it to the USB-C port on the top of the Surface Hub 2S. - -## Start Surface Hub 2S - -1. Insert the power cable into the back of the device and plug it into a power outlet. Run the cable through any cable guides on your mounting solution and remove the screen clang. -2. To begin, press the power button on the bottom right. - -![* Keypad showing source, volume and power buttons*](images/sh2-keypad.png)
diff --git a/devices/surface-hub/surface-hub-2s-recover-reset.md b/devices/surface-hub/surface-hub-2s-recover-reset.md deleted file mode 100644 index 7493e10c3c..0000000000 --- a/devices/surface-hub/surface-hub-2s-recover-reset.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: "Reset and recovery for Surface Hub 2S" -description: "Learn how to recover and reset Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 12/05/2019 -ms.localizationpriority: Medium ---- - -# Reset and recovery for Surface Hub 2S - -If you encounter problems with Surface Hub 2S, you can reset the device to factory settings or restore by using a USB drive. - -To begin, sign in to Surface Hub 2S with admin credentials, open the **Settings** app, select **Update & security**, and then select **Recovery**. - -## Reset the device - -1. To reset the device, select **Get Started**. -2. When the **Ready to reset this device** window appears, select **Reset**. - - >[!NOTE] - >Surface Hub 2S reinstalls the operating system from the recovery partition. This may take up to one hour to complete. - -3. To reconfigure the device, run the first-time Setup program. -4. If you manage the device using Microsoft Intune or another mobile device management solution, retire and delete the previous record, and then re-enroll the new device. For more information, see [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/devices-wipe). - -![*Reset and recovery for Surface Hub 2S*](images/sh2-reset.png)
-*Figure 1. Reset and recovery for Surface Hub 2S* - -## Recover Surface Hub 2S by using a USB recovery drive - -New in Surface Hub 2S, you can now reinstall the device by using a recovery image. - -### Recovery from a USB drive - -Using Surface Hub 2S, you can reinstall the device by using a recovery image. By doing this, you can reinstall the device to the factory settings if you lost the BitLocker key, or if you no longer have admin credentials to the Settings app. - ->[!NOTE] ->Use a USB 3.0 drive with 8 GB or 16 GB of storage, formatted as FAT32. - -1. From a separate PC, download the .zip file recovery image from the [Surface Recovery website](https://support.microsoft.com/surfacerecoveryimage?devicetype=surfacehub2s) and then return to these instructions. -1. Unzip the downloaded file onto the root of the USB drive. -1. Connect the USB drive to any USB-C or USB-A port on Surface Hub 2S. -1. Turn off the device: - 1. While holding down the Volume down button, press the Power button. - 1. Keep holding both buttons until you see the Windows logo. - 1. Release the Power button but continue to hold the Volume until the Install UI begins. - - ![*Use Volume down and power buttons to initiate recovery*](images/sh2-keypad.png)
- **Figure 2. Volume and Power buttons** - -1. On the language selection screen, select the display language for your Surface Hub 2S. -1. Select **Recover from a drive** and **Fully clean the drive**, and then select **Recover**. If you're prompted for a BitLocker key, select **Skip this drive**. Surface Hub 2S reboots several times and takes approximately 30 minutes to complete the recovery process. - -When the first-time setup screen appears,remove the USB drive. - -## Recover a locked Surface Hub - -At the end of a session, Surface Hub 2S may occasionally encounter an error during the cleanup of user and app data at the end of a session. If this occurs, the device automatically reboots and resumes the data cleanup. However, if this operation repeatedly fails, the device automatically locks to protect user data. - -**To unlock a Surface Hub 2S:**
-- Reset or recover the device from the Windows Recovery Environment. For more information, see [What is Windows RE?](https://technet.microsoft.com/library/cc765966.aspx) - -> [!NOTE] -> To enter recovery mode, unplug the power cord and plug it in again three times. - -## Contact Support - -If you have questions or need help, you can [create a support request](https://support.microsoft.com/supportforbusiness/productselection). diff --git a/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md b/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md deleted file mode 100644 index 8d0768ba93..0000000000 --- a/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: "Secure and manage Surface Hub 2S with SEMM" -description: "Learn more about securing Surface Hub 2S with SEMM." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Secure and manage Surface Hub 2S with SEMM and UEFI - -New in Surface Hub 2S, you can use SEMM to manage the UEFI setting of the device. -Use the Microsoft Surface UEFI Configurator to control the following components: - -- Wired LAN -- Cameras -- Bluetooth -- Wi-Fi -- Occupancy sensor - -Use the Microsoft Surface UEFI Configurator to turn on or off the following UEFI settings: - -- Boot - - - IPv6 for PXE Boot - - Alternate Boot - - Boot Order Lock - - USB Boot -- UEFI Front Page - - - Devices - - Boot - - Date/Time - -## Create UEFI configuration image - -Unlike other Surface devices, you cannot use an MSI file or a Win PE image to apply these settings on Surface Hub 2S. Instead, you need to create a USB image to load into the device. To create a Surface Hub 2S UEFI configuration image, download and install the latest version of the Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. For more information about using UEFI and SEMM, see [Microsoft Surface Enterprise Management Mode](https://docs.microsoft.com/surface/surface-enterprise-management-mode). - -## To configure UEFI on Surface Hub 2S - -1. Start the UEFI Configurator and on the first screen, choose **Configuration Package**.

-![* Start the UEFI Configurator and choose Configuration Package*](images/sh2-uefi1.png)

-2. To add the certificate to your package, you must have a valid certificate with the private key in a .pfx file format to sign and protect the package. Select **+ Certificate Protection.**
-![* Select + Certificate Protection *](images/sh2-uefi2.png)

-3. Enter the certificate’s private key’s password.
-![* Enter the certificate’s private key’s password *](images/sh2-uefi3.png)

-4. After importing the private key, continue creating the package.
-![* Continue creating the package *](images/sh2-uefi4.png)

-5. Choose **Hub** and **Surface Hub 2S** as the target for the UEFI configuration package.
-![* Choose Hub and Surface Hub 2S as the target for the UEFI configuration package *](images/sh2-uefi5.png)

-6. Choose the components and settings you want to activate or deactivate on Surface Hub 2S.
-![* Choose the components and settings you want to activate or deactivate *](images/sh2-uefi6.png)

-7. Use the USB option to export the file.
-![* Use the USB option to export the file *](images/sh2-uefi8.png)

-8. Insert and choose the USB drive you’d like to use for this package. The USB drive will be formatted and you lose any information you have on it.
-![* Insert and choose the USB drive for your package *](images/sh2-uefi9.png)

-9. Upon successful creation of the package, the Configurator will display the last two characters of your certificate’s thumbprint. You need these characters when you import to the configuration to Surface Hub 2S.
-![* Successful configuration of package *](images/sh2-uefi10.png)
- -## To boot into UEFI - -Turn off Surface Hub 2S. Press and hold the **Volume Up** button and press the **Power** Button. Keep holding the Volume Up button until the UEFI menu appears. diff --git a/devices/surface-hub/surface-hub-2s-setup.md b/devices/surface-hub/surface-hub-2s-setup.md deleted file mode 100644 index 08318020fb..0000000000 --- a/devices/surface-hub/surface-hub-2s-setup.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: "First time Setup for Surface Hub 2S" -description: "Learn how to complete first time Setup for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 07/03/2019 -ms.localizationpriority: Medium ---- - -# First time Setup for Surface Hub 2S - -When you first start Surface Hub 2S, the device automatically enters first time Setup mode to guide you through account configuration and related settings. - -## Configuring Surface Hub 2S account - -1. **Configure your locale.** Enter region, language, keyboard layout and time zone information. Select **Next**. - - ![* Configure your locale *](images/sh2-run1.png)
-1. **Connect to a wireless network.** Choose your preferred wireless network and select **Next.** - -- This option is not shown if connected using an Ethernet cable. -- You cannot connect to a wireless network in hotspots (captive portals) that redirect sign-in requests to a provider’s website. - -3. **Enter device account info.** Use **domain\user** for on-premises and hybrid environments and **user\@example.com** for online environments. Select **Next.** - - ![* Enter device account info *](images/sh2-run2.png)
-1. **Enter additional info.** If requested, provide your Exchange server address and then select **Next.** - - ![* Enter more info; for example, Exchange server name*](images/sh2-run3.png)
- -1. **Name this device.** Enter a name for your device or use the suggested one based on your account’s display name and user principle name [UPN]. **Select Next**. - -- The **Friendly name** is visible on the bottom left corner of Surface Hub 2S and is shown when projecting to the device. - -- The **Device name** identifies the device when affiliated with Active Directory or Azure Active Directory, and when enrolling the device with Intune. - - ![* Name this device*](images/sh2-run4.png)
- -## Configuring device admin accounts - -You can only set up device admins during first time Setup. For more information, refer to [Surface Hub 2S device affiliation](https://docs.microsoft.com/surface-hub/surface-hub-2s-prepare-environment#device-affiliation). - - In the **Setup admins for this device** window, select one of the following options: Active Directory Domain Services, Azure Active Directory, or Local admin. - - ![* Setup admins for this device *](images/sh2-run5.png)
- -### Active Directory Domain Services - -1. Enter the credentials of a user who has permissions to join the device to Active Directory. - - ![* Setup admins using domain join *](images/sh2-run6.png)
- -2. Select the Active Directory Security Group containing members allowed to log on to the Settings app on Surface Hub 2S. - - ![* Enter a security group *](images/sh2-run7.png)
-1. Select **Finish**. The device will restart. - -### Azure Active Directory - -When choosing to affiliate your device with Azure Active Directory, the device will immediately restart and display the following page. Select **Next**. - -![* If your organization uses Office 365 or other business services from Microsoft, we’ll enrolll this device with your organization*](images/sh2-run8.png)
- -1. Enter the email address or UPN of an account **with Intune Plan 1** or greater and then select **Next.** - - ![* Enter work or school account*](images/sh2-run9.png)
- -2. If redirected, authenticate using your organization’s sign-in page and provide additional logon information if requested. The device will restart. - -## Local Administrator account - -- Enter a username and password for your local admin. The device will restart. - - ![* Set up an admin account*](images/sh2-run10.png)
- -## Using provisioning packages - -If you insert a USB thumb drive with a provisioning package into one of the USB ports when you start Surface Hub 2S, the device displays the following page. - -1. Enter the requested settings and select **Set up**. - - ![* Enter regional settings for provisioning package*](images/sh2-run11.png)
- - ![* Provision this device from removable media*](images/sh2-run12.png)
-2. Choose the provisioning package you’d like to use. - - ![* Choose provisioning package to use*](images/sh2-run13.png)
- -3. If you created a multiple devices CSV file, you will be able to choose a device configuration. For more information, refer to [Create provisioning packages for Surface Hub 2S](https://docs.microsoft.com/surface-hub/surface-hub-2s-deploy#provisioning-multiple-devices-csv-file). - - - ![* Select a device account and friendly name from your configuration file*](images/sh2-run14.png)
- -4. Follow the instructions to complete first time Setup. diff --git a/devices/surface-hub/surface-hub-2s-site-planning.md b/devices/surface-hub/surface-hub-2s-site-planning.md deleted file mode 100644 index 9b04ea0174..0000000000 --- a/devices/surface-hub/surface-hub-2s-site-planning.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: "Surface Hub 2S site planning" -description: "Learn more about rooms for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S site planning - -## Introduction - -Designed for team collaboration, Surface Hub 2S can transform the way you work — not only in the conference rooms but any place you want to work. One of the biggest advantages of Surface Hub 2S is the ability to move it from one space to another when used with the Steelcase Roam mobile stand and mobile battery. Providing unplugged, uninterrupted teamwork capabilities, Surface Hub 2S can be integrated into almost any workspace. - -## Room considerations - -Designed for interactive use in smaller conference rooms and huddle spaces, Surface Hub 2S provides a 4K camera, microphone array, crystal clear speakers, and a brilliant 4K+ resolution display. Optimizing the user experience in larger spaces with more people further away from the display may require peripherals such as an extra camera, microphone, or room systems solution such as Microsoft Teams Rooms. - -As a general guideline, install Surface Hub 2S in a space that meets the following criteria: - -- People can reach all four edges of the touchscreen. -- The screen is not in direct sunlight, which could affect viewing or damage the screen. -- Ventilation openings are not blocked. -- Microphones are not affected by noise sources, such as fans or vents. -- Space is well lit with no reflective sources. - -Whether mounted to a wall or installed on the mobile stand, the areas where you use the device should maintain: - -- Room temperatures no cooler than 10°C (50° F) and no hotter than 35°C (95° F). -- Relative humidity no lower than 20 percent and no higher than 80 percent. - -For detailed room planning guidance and more information about Microsoft Teams Rooms see [Plan Microsoft Teams Rooms.](https://docs.microsoft.com/MicrosoftTeams/room-systems/skype-room-systems-v2-0) - -## Managing Surface Hub 2S location - -If you plan to use Surface Hub 2S on a mobile stand, you may wish to explore third-party solutions that enable location services. For example, active RFID systems can provide real-time tracking throughout complex office or industrial spaces. For more information, see your A/V provider or other third-party expertise for guidance. diff --git a/devices/surface-hub/surface-hub-2s-site-readiness-guide.md b/devices/surface-hub/surface-hub-2s-site-readiness-guide.md deleted file mode 100644 index 8db9d3818e..0000000000 --- a/devices/surface-hub/surface-hub-2s-site-readiness-guide.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: "Surface Hub 2S site readiness guide" -description: "Get familiar with site readiness requirements and recommendations for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S site readiness guide - -|**Topic**|**Description**| -|:-------|:-------| -| [Site planning for Surface Hub 2S](surface-hub-2s-site-planning.md) | Review room considerations and planning for peripherals. | -| [Surface Hub 2S quick start](surface-hub-2s-quick-start.md) | Get an overview of required steps to unpack and start Surface Hub 2S. | -| [Install and mount Surface Hub 2S](surface-hub-2s-install-mount.md) | Learn about licensed accessories to install and mount Surface Hub 2S. | -| [Customizing installation of Surface Hub 2S](surface-hub-2s-custom-install.md) | Learn how to custom install without licensed mounting accessories.| -| [Surface Hub 2S ports and keypad overview](surface-hub-2s-port-keypad-overview.md) | Get details for I/O ports and keypad power and selection controls. | -| [Connect to Surface Hub 2S](surface-hub-2s-connect.md) | Learn about wired and wireless methods to connect to Surface Hub.| diff --git a/devices/surface-hub/surface-hub-2s-techspecs.md b/devices/surface-hub/surface-hub-2s-techspecs.md deleted file mode 100644 index 4e40f9ae25..0000000000 --- a/devices/surface-hub/surface-hub-2s-techspecs.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: "Surface Hub 2S tech specs" -description: "View tech specs for Surface Hub 2S including pen, camera, and optional mobile battery specifications." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -manager: laurawi -ms.author: greglin -audience: Admin -ms.topic: article -ms.date: 11/19/2019 -ms.localizationpriority: Medium ---- - -# Surface Hub 2S tech specs - -|**Item**|**Details**| -|:------ |:--------- | -|**Dimensions**| 29.2" x 43.2" x 3.0” (741 mm x 1097 mm x 76 mm) | -|**Shipping dimensions**| 47.64" x 36.89" x 9.92" (1,210 mm x 937 mm x 252 mm)| -|**Weight**| 61.6 lbs. (28 kg) | -|**Shipping Weight**| 81.08 lbs. (36.77 kg) | -|**Resolution**| 3840 x 2560 | -|**Display**| PixelSense Display, 3:2 aspect ratio, 10-bit color, 15.5 mm border, anti-glare, IPS LCD | -|**Processor**| Quad-core 8th Generation Intel Core i5 processor, 8 GB RAM, 128 GB SSD 1 | -|**Graphics**| Intel UHD Graphics 620 | -|**Wireless**| Wi-Fi 5 (IEEE 802.11 a/b/g/n/ac compatible) Bluetooth Wireless 4.1 technology
Miracast display | -|**Connections**| USB-A
Mini-DisplayPort 1.2 video output
RJ45 gigabit Ethernet (1000/100/10 BaseT)
HDMI video input (HDMI 2.0, HDCP 2.2 /1.4)
USB-C with DisplayPort input
Four USB-C (on display) | -|**Sensors**| Doppler occupancy 2
Accelerometer
Gyroscope | -|**Audio/Video**| Full-range, front facing 3-way stereo speakers
Full band 8-element MEMS microphone array
Microsoft Surface Hub 2 Camera, 4K, USB-C connection, 90-degree HFOV | -|**Pen**| Microsoft Surface Hub 2 Pen (active) | -|**Software**| Windows 10
Microsoft Teams for Surface Hub 3
Skype for Business
Microsoft Whiteboard
Microsoft Office (Mobile)
Microsoft Power BI 2 | -|**Exterior**| Casing: Precision machined aluminum with mineral-composite resin
Color: Platinum
Physical Buttons: Power, Volume, Source | -|**What’s in the box**| One Surface Hub 2S
One Surface Hub 2 Pen
One Surface Hub 2 Camera
2.5 m AC Power Cable
Quick Start Guide | -|**Warranty**| 1-year limited hardware warranty | -|**BTU**| 1518 BTU/hr | -|**Input Voltage**| 50/60Hz 110/230v nominal, 90-265v max | -|**Input power, operating**| 445 W (495 W Surge Load) | -|**Input Current**| 5.46 A | -|**Input Power, standby**| 5 W max | - -> [!NOTE] -> 1 System software uses significant storage space. Available storage is subject to change based on system software updates and apps usage. 1 GB= 1 billion bytes. See Surface.com/Storage for more details.
2 Doppler sensor not available in Hong Kong, India, Kuwait, and Oman due to government regulations. -
3 Software license required for some features. Sold separately.
diff --git a/devices/surface-hub/surface-hub-2s-unpack.md b/devices/surface-hub/surface-hub-2s-unpack.md deleted file mode 100644 index 950a5caa6f..0000000000 --- a/devices/surface-hub/surface-hub-2s-unpack.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: "Unpack Surface Hub 2S" -description: "This page includes information about safely unpacking Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# Unpack Surface Hub 2S - -## Unpacking the Surface Hub 2S - -Before you remove Surface Hub 2S from the box, make sure that you have your mounting solution assembled and someone available to help you. - -1. Use the handles on each side of the box to move it to the space where you'll set it up. -2. Before opening, remove the clips (4) on the front and back, and then lift the top off the box using the handles. -3. In the base of the Surface Hub 2S, open the accessories box containing the setup guide, Surface Hub 2 pen, Surface Hub 2 camera, and the power cable. -4. On the back of the surface hub, there's an instructional label that shows you where to attach the mounting hardware. Install them in place and remove the label. -5. If you're using a mobile stand remember to lock the wheels to keep the stand in place -6. Be sure to lift the Surface Hub 2S with both hands and support the bottom of the device. -7. Align the installed hardware with the slots on the mount so it rests firmly in place. -8. Follow any further instructions that came with your mounting solution. - -## Install pen and camera - -1. Unwrap your Surface Hub 2 pen and attach it magnetically to your preferred side of the device. -2. Remove the lens cling from the camera and attach it to the USB-C port on the top of the Surface Hub 2S. -3. Insert the power cable into the back of the device and plug it into a power outlet. Run the cable through any cable guides on your mounting solution and remove the screen clang. -4. To begin, press the power button on the bottom right. diff --git a/devices/surface-hub/surface-hub-2s-whats-new.md b/devices/surface-hub/surface-hub-2s-whats-new.md deleted file mode 100644 index 82589b360e..0000000000 --- a/devices/surface-hub/surface-hub-2s-whats-new.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: "What's new in Surface Hub 2S for IT admins" -description: "Learn more about new features in Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 06/20/2019 -ms.localizationpriority: Medium ---- - -# What's new in Surface Hub 2S for IT admins - -Surface Hub 2S is an all-in-one collaboration canvas that’s built for teamwork delivering a digital whiteboard, meetings platform, and a Windows 10 computing experience in one device. - -|**Capability**|**Summary**|**Learn more**| -|:-------|:------|:----| -|**Mobile Device Management and UEFI manageability**| Manage settings and policies using a mobile device management (MDM) provider.

Full integration with Surface Enterprise Management Mode (SEMM) lets you manage hardware components and firmware. | [Managing Surface Hub 2S with Microsoft Intune](surface-hub-2s-manage-intune.md)

[Surface Enterprise Management Mode](https://docs.microsoft.com/surface/surface-enterprise-management-mode) | -|**Cloud and on-premises coexistence**| Supports on-premises, hybrid, or online. | [Prepare your environment for Microsoft Surface Hub 2S](surface-hub-2s-prepare-environment.md) | -|**Reset and recovery**| Restore from the cloud or USB drive. | [Recover and reset Surface Hub 2S](surface-hub-2s-recover-reset.md) | -|**Microsoft Whiteboard**| Office 365 integration, intelligent ink, and Bing search bring powerful new capabilities, enabling a persistent digital canvas shareable across most browsers, Windows and iOS devices. | [Announcing a new whiteboard for your Surface Hub](https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-a-new-Whiteboard-for-your-Surface-Hub/ba-p/637050) | -|**Microsoft Teams Meeting Room License**| Extends Office 365 licensing options across Skype for Business, Microsoft Teams, and Intune. | [Teams Meeting Room Licensing Update](https://docs.microsoft.com/MicrosoftTeams/room-systems/skype-room-systems-v2-0) | -|**On-screen display**| Adjust volume, brightness, and input control directly on the display. | | -|**Sensor-activated Connected Standby**| Doppler sensor activates Connected Standby after 1 minute of inactivity.

Manage this setting remotely using Intune or directly on the device from the Settings app. | [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) | -|**Surface Hub pen**| Ergonomically redesigned and easily attachable on the sides of the device. | | -|**Surface app for Surface Hub 2S**| Change audio settings and view your device's information from the Surface app | | -|**Ready for tomorrow**| Removable cartridge facilitates upgrading to new features. | | - -For more information about what’s new in Surface Hub 2S, see: - -- [Surface Hub 2S product site](https://www.microsoft.com/p/surface-hub-2S/8P62MW6BN9G4?activetab=pivot:overviewtab) -- [Behind the Design Surface Hub 2S](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Behind-the-design-Surface-Hub-2S/ba-p/464099) - -## Surface Hub 2S compared with Surface Hub - -The following table details the differences between Surface Hub and Surface Hub 2S: - -|**Component**| **Surface Hub 55”**|**Surface Hub 84”**| **Surface Hub 2S**| -|:----- |:---- |:---- |:----- | -|**Form Factor**| 55” | 84” | 50” | -|**Dimension**| 31.75” x 59.62” x 3.38”
(806.4 mm x 1514.3 mm x 85.8 mm) | 46.12” x 86.7” x 4.15”
(1171.5 mm x 2202.9 mm x 105.4 mm) | 29.2" x 43.2" x 3.0"
(741 mm x 1097 mm x 76 mm) | -|**Weight**| 105 lbs. (48 kg) | 280 lbs. (127 kg) | 61.6 lbs. (28 kg) | -|**Display**| Resolution:
1920 x 1080 @ 120 Hz
Contrast ratio:
1300:1
Touch:
100-point multi-touch
Projective Capacitance optically bonded sensor | Resolution:
3840 x 2160 @ 120 Hz
Contrast Ratio:
1400:1
Touch:
100-point multi-touch
Projective Capacitance optically bonded sensor | Resolution:
3840 x 2560 @ 60 Hz | -|**Aspect Ratio**| 16:9 | 16:9 | 3:2 | -|**Storage**| SSD 128 GB | SSD 128 GB | SSD 128 GB | -|**RAM**| 8 GB RAM | 8 GB RAM | 8 GB RAM | -|**Processor**| 4th Generation Intel® Core i5 | 4th Generation Intel Core i7 | Quad-core 8th Generation Intel Core i5 processor | -|**Graphics**| Intel HD 4600 | NVIDIA Quadro K2200 | Intel UHD Graphics 620 | -|**Network**| Wi-Fi (802.11 a/b/g/n/ac)
Ethernet 1 Gbps
Bluetooth 4.0 low energy
Miracast enabled | Wi-Fi (802.11 a/b/g/n/ac)
Ethernet 1 Gbps
Bluetooth 4.0 low energy
Miracast enabled | Wi-Fi 5 (IEEE 802.11 a/b/g/n/ac)
Ethernet 1 Gbps
Bluetooth Wireless 4.1 technology
Miracast Display | -|**Ports**| (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
(2) USB 2.0
DisplayPort Video Output
3.5 mm Stereo Out
RJ11 Connector for system-level control

DisplayPort Video Input
HDMI Video Input
VGA Video Input
3.5 mm Stereo Input
(1) USB 2.0 type B Touchback Output | (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
(4) USB 2.0
DisplayPort Video Output
3.5 mm Stereo Out
RJ11 Connector for system-level control

DisplayPort Video Input
HDMI Video Input
VGA Video Input
3.5 mm Stereo Input
(1) USB 2.0 type B Touchback Output | (1) USB-A
Mini-DisplayPort Video Output
HDMI Video Input
USB-C with DisplayPort Input
(4) USB-C (on display)
RJ45 Gigabit Ethernet | -|**Sensors**| (2) Passive Infrared Presence Sensors, Ambient Light Sensors | (2) Passive Infrared Presence Sensors, Ambient Light Sensors | Doppler occupancy sensor,
Accelerometer,
Gyroscope | -|**NFC**| NFC reader | NFC reader | N/A | -|**Speakers**| (2) Front-facing stereo speakers | (2) Front-facing stereo speakers | Full range front facing 3-way stereo speakers | -|**Microphone**| High-Performance, 4-Element Array | High-Performance, 4-Element Array | Full band 8-element MEMS microphone array | -|**Camera**| (2) Wide angle HD cameras 1080p @ 30 fps | (2) Wide angle HD cameras 1080p @ 30 fps | (1) Microsoft Surface Hub 2 Camera, 4K, USB-C connection, 90-degree horizontal field of view | -|**Pen**| (2) Powered, active, subpixel accuracy | (2) Powered, active, subpixel accuracy | (1) Microsoft Surface Hub 2 Pen (active) | -|**Physical buttons**| Power, Input Select, Volume, Brightness | Power, Input Select, Volume, Brightness | Power, Volume, Source | -|**Software**| Windows 10 + Office (Word, PowerPoint, Excel) | Windows 10 + Office (Word, PowerPoint, Excel) | Windows 10 + Office (Word, PowerPoint, Excel) | - -> [!NOTE] -> The NFC reader available in the original Surface Hub is discontinued in Surface Hub 2S and is no longer available. diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md deleted file mode 100644 index 80c7dbefd1..0000000000 --- a/devices/surface-hub/surface-hub-authenticator-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Sign in to Surface Hub with Microsoft Authenticator -description: Use Microsoft Authenticator on your mobile device to sign in to Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 08/28/2017 -ms.reviewer: -manager: laurawi -localizationpriority: medium ---- - -# Sign in to Surface Hub with Microsoft Authenticator - -People in your organization can sign in to a Surface Hub without a password using the Microsoft Authenticator app, available on Android and iOS. - -## Organization prerequisites - -To let people in your organization sign in to Surface Hub with their phones and other devices instead of a password, you’ll need to make sure that your organization meets these prerequisites: - -- Your organization must be a hybrid or cloud-only organization, backed by Azure Active Directory (Azure AD). For more information, see [What is Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/active-directory-whatis) - -- Make sure you have at minimum an Office 365 E3 subscription. - -- [Configure Multi-Factor Authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-mfasettings). Make sure **Notification through mobile app** is selected. - - ![multi-factor authentication options](images/mfa-options.png) - -- Enable content hosting on Azure AD services such as Office, SharePoint, etc. - -- Surface Hub must be running Windows 10, version 1703 or later. - -- Surface Hub is set up with either a local or domain-joined account. - -Currently, you cannot use Microsoft Authenticator to sign in to Surface Hubs that are joined to Azure AD. - -## Individual prerequisites - -- An Android phone running 6.0 or later, or an iPhone or iPad running iOS9 or later - -- The most recent version of the Microsoft Authenticator app from the appropriate app store - - >[!NOTE] - >On iOS, the app version must be 5.4.0 or higher. - > - >The Microsoft Authenticator app on phones running a Windows operating system can't be used to sign in to Surface Hub. - -- Passcode or screen lock on your device is enabled - -- A standard SMTP email address (example: joe@contoso.com). Non-standard or vanity SMTP email addresses (example: firstname.lastname@contoso.com) currently don’t work. - -## How to set up the Microsoft Authenticator app - ->[!NOTE] ->If Company Portal is installed on your Android device, uninstall it before you set up Microsoft Authenticator. After you set up the app, you can reinstall Company Portal. -> ->If you have already set up Microsoft Authenticator on your phone and registered your device, go to the sign-in instructions. - -1. Add your work or school account to Microsoft Authenticator for Multi-Factor Authentication. You will need a QR code provided by your IT department. For help, see [Get started with the Microsoft Authenticator app](https://docs.microsoft.com/azure/multi-factor-authentication/end-user/microsoft-authenticator-app-how-to). -2. Go to **Settings** and register your device. -3. Return to the accounts page and choose **Enable phone sign-in** from the account dropdown menu. - -## How to sign in to Surface Hub during a meeting - -1. After you’ve set up a meeting, go to the Surface Hub and select **Sign in to see your meetings and files**. - - >[!NOTE] - >If you’re not sure how to schedule a meeting on a Surface Hub, see [Schedule a meeting on Surface Hub](https://support.microsoft.com/help/17325/surfacehub-schedulemeeting). - - ![screenshot of Sign in option on Surface Hub](images/sign-in.png) - -2. You’ll see a list of the people invited to the meeting. Select yourself (or the person who wants to sign in – make sure this person has gone through the steps to set up their device before your meeting), and then select **Continue**. - - ![screenshot of list of attendees in a meeting](images/attendees.png) - - You'll see a code on the Surface Hub. - - ![screenshot of code for Approve Sign in](images/approve-signin.png) - -3. To approve the sign-in, open the Authenticator app, enter the four-digit code that’s displayed on the Surface Hub, and select **Approve**. You will then be asked to enter the PIN or use your fingerprint to complete the sign in. - - ![screenshot of the Approve sign-in screen in Microsoft Authenticator](images/approve-signin2.png) - -You can now access all files through the OneDrive app. \ No newline at end of file diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md deleted file mode 100644 index 79ff342ba9..0000000000 --- a/devices/surface-hub/surface-hub-downloads.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Useful downloads for Microsoft Surface Hub -description: Downloads related to the Microsoft Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 08/22/2017 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Useful downloads for Microsoft Surface Hub - -This topic provides links to useful Surface Hub documents, such as product datasheets and user's guide. - -| Link | Description | -| --- | --- | -| [Surface Hub Setup Guide (English, French, Spanish) (PDF)](https://download.microsoft.com/download/0/1/6/016363A4-8602-4F01-8281-9BE5C814DC78/Setup-Guide_EN-FR-SP.pdf) | Get a quick overview of how to set up the environment for your new Surface Hub. | -| [Surface Hub Quick Reference Guide (PDF)](https://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface%20Hub%20Quick%20Reference%20Guide_en-us.pdf) | Use this quick reference guide to get information about key features and functions of the Surface Hub. | -| [Surface Hub User Guide (PDF)](https://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) | Learn how to use Surface Hub in scheduled or ad-hoc meetings. Invite remote participants, use the built-in tools, save data from your meeting, and more. | -| [Surface Hub Replacement PC Drivers](https://www.microsoft.com/download/details.aspx?id=52210) | The Surface Hub Replacement PC driver set is available for those customers who have chosen to disable the Surface Hub’s internal PC and use an external computer with their 84” or 55” Surface Hub. This download is meant to be used with the Surface Hub Admin Guide , which contains further details on configuring a Surface Hub Replacement PC. | -| [Microsoft Surface Hub Rollout and Adoption Success Kit (ZIP)](https://download.microsoft.com/download/F/A/3/FA3ADEA4-4966-456B-8BDE-0A594FD52C6C/Surface_Hub_Adoption_Kit_Final_0519.pdf) | Best practices for generating awareness and implementing change management to maximize adoption, usage, and benefits of Microsoft Surface Hub. The Rollout and Adoption Success Kit zip file includes the Rollout and Adoption Success Kit detailed document, Surface Hub presentation, demo guidance, awareness graphics, and more. | -| [Unpacking Guide for 84-inch Surface Hub (PDF)](https://download.microsoft.com/download/5/2/B/52B4007E-D8C8-4EED-ACA9-FEEF93F6055C/84_Unpacking_Guide_English_French-Spanish.pdf) | Learn how to unpack your 84-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/75/2b/752b73dc-6e9d-4692-8ba1-0f9fc03bff6b.mov?n=04.07.16_installation_video_03_unpacking_84.mov) | -| [Unpacking Guide for 55-inch Surface Hub (PDF)](https://download.microsoft.com/download/2/E/7/2E7616A2-F936-4512-8052-1E2D92DFD070/55_Unpacking_Guide_English-French-Spanish.PDF) | Learn how to unpack your 55-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/a9/d6/a9d6b4d7-d33f-4e8b-be92-28f7fc2c06d7.mov?n=04.07.16_installation_video_02_unpacking_55.mov) | -| [Wall Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Wall_Mounts_EN-FR-ES-NL-DE-IT-PT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the wall brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/bf/4d/bf4d6f06-370c-45ee-88e6-c409873914e8.mov?n=04.07.16_installation_video_05_wall_mount.mov) | -| [Floor-Supported Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Floor_Support_Mount_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the floor-supported brackets, and how to mount your Surface Hub onto them. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/ed/de/edde468a-e1d4-4ce8-8b61-c4527dd25c81.mov?n=04.07.16_installation_video_06_floor_support_mount.mov) | -| [Rolling Stand Mounting and Assembly Guide (PDF)](https://download.microsoft.com/download/7/0/2/702485E3-B55E-4DE8-B5DD-3B56F90DCF5D/SH-Guide_WACG_Rolling_Stands_EN-FR-ES-NL-DE-IT-AR-DA-FI-NO-SV.pdf) | Detailed instructions on how to safely and securely assemble the rolling stand, and how to mount your Surface Hub onto it. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/1f/94/1f949613-3e4a-41e3-ad60-fe8aa7134115.mov?n=04.07.16_installation_video_04_rolling_stand_mount.mov) | -| [Mounts and Stands Datasheet (PDF)](https://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf) | Specifications and prices for all Surface Hub add-on stands and mounts that turn your workspace into a Surface Hub workspace. | -| [Surface Hub Stand and Wall Mount Specifications (PDF)](https://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf) | Illustrated specifications for the 55” and 84” Surface Hub rolling stands, wall mounts, and floor-supported wall mounts. | - - - - diff --git a/devices/surface-hub/surface-hub-qos.md b/devices/surface-hub/surface-hub-qos.md deleted file mode 100644 index aa1b746b8d..0000000000 --- a/devices/surface-hub/surface-hub-qos.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Implement Quality of Service on Surface Hub -ms.reviewer: -manager: laurawi -description: Learn how to configure QoS on Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Implement Quality of Service (QoS) on Surface Hub - -Quality of Service (QoS) is a combination of network technologies that allows the administrators to optimize the experience of real time audio/video and application sharing communications. - -Configuring [QoS for Skype for Business](https://docs.microsoft.com/windows/client-management/mdm/networkqospolicy-csp) on the Surface Hub can be done using your [mobile device management (MDM) provider](manage-settings-with-mdm-for-surface-hub.md) or through a [provisioning package](provisioning-packages-for-surface-hub.md). - - -This procedure explains how to configure QoS for Surface Hub using Microsoft Intune. - -1. In Intune, [create a custom policy](https://docs.microsoft.com/intune/custom-settings-configure). - - ![Screenshot of custom policy creation dialog in Intune](images/qos-create.png) - -2. In **Custom OMA-URI Settings**, select **Add**. For each setting that you add, you will enter a name, description (optional), data type, OMA-URI, and value. - - ![Screenshot of a blank OMA-URI setting dialog box](images/qos-setting.png) - -3. Add the following custom OMA-URI settings: - - Name | Data type | OMA-URI
./Device/Vendor/MSFT/NetworkQoSPolicy | Value - --- | --- | --- | --- - Audio Source Port | String | /HubAudio/SourcePortMatchCondition | Get the values from your Skype administrator - Audio DSCP | Integer | /HubAudio/DSCPAction | 46 - Video Source Port | String | /HubVideo/SourcePortMatchCondition | Get the values from your Skype administrator - Video DSCP | Integer | /HubVideo/DSCPAction | 34 - Audio Process Name | String | /HubAudio/AppPathNameMatchCondition | Microsoft.PPISkype.Windows.exe - Video Process Name | String | /HubVideo/AppPathNameMatchCondition | Microsoft.PPISkype.Windows.exe - - >[!IMPORTANT] - >Each **OMA-URI** path begins with `./Device/Vendor/MSFT/NetworkQoSPolicy`. The full path for the audio source port setting, for example, will be `./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/SourcePortMatchCondition`. - - - - -4. When the policy has been created, [deploy it to the Surface Hub.](manage-settings-with-mdm-for-surface-hub.md#manage-surface-hub-settings-with-mdm) - - ->[!WARNING] ->Currently, you cannot configure the setting **IPProtocolMatchCondition** in the [NetworkQoSPolicy CSP](https://docs.microsoft.com/windows/client-management/mdm/networkqospolicy-csp). If this setting is configured, the policy will fail to apply. - diff --git a/devices/surface-hub/surface-hub-recovery-tool.md b/devices/surface-hub/surface-hub-recovery-tool.md deleted file mode 100644 index 2db5f9706e..0000000000 --- a/devices/surface-hub/surface-hub-recovery-tool.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Using the Surface Hub Recovery Tool -description: How to use the Surface Hub Recovery Tool to re-image the SSD. -ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1 -ms.reviewer: -manager: laurawi -keywords: manage Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 05/22/2018 -ms.localizationpriority: medium ---- - -# Using the Surface Hub Recovery Tool - -The [Microsoft Surface Hub Recovery Tool](https://www.microsoft.com/download/details.aspx?id=52210) helps you re-image your Surface Hub Solid State Drive (SSD) using a Windows 10 desktop device, without calling support or replacing the SSD. With this tool, you can reimage an SSD that has an unknown Administrator password, boot errors, was unable to complete a cloud recovery, or for a device that has an older version of the operating system. The tool will not fix physically damaged SSDs. - -To re-image the Surface Hub SSD using the Recovery Tool, you'll need to remove the SSD from the Surface Hub, connect the drive to the USB-to-SATA cable, and then connect the cable to the desktop PC on which the Recovery Tool is installed. For more information on how to remove the existing drive from your Surface Hub, see [Surface Hub SSD replacement](surface-hub-ssd-replacement.md). - -> [!IMPORTANT] -> Do not let the device go to sleep or interrupt the download of the image file. - -If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support). - -## Prerequisites - -### Mandatory - -- Host PC running 64-bit version of Windows 10, version 1607 or higher. -- Internet access -- Open USB 2.0 or greater port -- USB-to-SATA cable -- 10 GB of free disk space on the host computer -- SSDs shipped with Surface Hub or a SSD provided by Support as a replacement. SSDs not supplied by Microsoft are not supported. - -### Recommended - -- High-speed Internet connection -- Open USB 3.0 port -- USB 3.0 or higher USB-to-SATA cable -- The imaging tool was tested with the following make and model of cables: - - Startech USB312SAT3CB - - Rosewill RCUC16001 - - Ugreen 20231 - -## Download Surface Hub Recovery Tool - -Surface Hub Recovery Tool is available for download from [Surface Hub Tools for IT](https://www.microsoft.com/download/details.aspx?id=52210) under the file name **SurfaceHub_Recovery_v1.14.137.0.msi**. - -To start the download, click **Download**, choose **SurfaceHub_Recovery_v1.14.137.0.msi** from the list, and click **Next**. From the pop-up, choose one of the following: - -- Click **Run** to start the installation immediately. -- Click **Save** to copy the download to your computer for later installation. - -Install Surface Hub Recovery Tool on the host PC. - -## Run Surface Hub Recovery Tool - -1. On the host PC, select the **Start** button, scroll through the alphabetical list on the left, and select the recovery tool shortcut. - - ![Microsoft Surface Hub Recovery Tool shortcut](images/shrt-shortcut.png) - -2. Click **Start**. - - ![Recovery Tool Start button](images/shrt-start.png) - -3. In the **Guidance** window, click **Next**. - - ![Do not let your machine go to sleep guidance](images/shrt-guidance.png) - -4. click **Yes** to download the image. Time to download the recovery image is dependent on internet connection speeds. On an average corporate connection, it can take up to an hour to download the 8GB image file. - - ![Download the image?](images/shrt-download.png) - -5. When the download is complete, the tool instructs you to connect an SSD drive. If the tool is unable to locate the attached drive, there is a good chance that the cable being used is not reporting the name of the SSD to Windows. The imaging tool must find the name of the drive as "LITEON L CH-128V2S USB Device" before it can continue. For more information on how to remove the existing drive from your Surface Hub, see [Surface Hub SSD replacement](surface-hub-ssd-replacement.md). - - ![Connect SSD](images/shrt-drive.png) - -6. When the drive is recognized, click **Start** to begin the re-imaging process. On the warning that all data on the drive will be erased, click **OK**. - - ![Start re-imaging the SSD](images/shrt-drive-start.png) - - Prior to applying the system image to the drive, the SSD is repartitioned and formatted. Copying the system binaries will take approximately 30 minutes, but can take longer depending on the speed of your USB bus, the cable being used, or antivirus software installed on your system. - - ![Copying done](images/shrt-done.png) - - ![Reimaging complete](images/shrt-complete.png) - -## Troubleshooting and common problems - -Issue | Notes ---- | --- -The tool fails to image the SSD | Make sure you are using a factory-supplied SSD and one of the tested cables. -The reimaging process appears halted/frozen | It is safe to close and restart the Surface Hub Recovery Tool with no ill effect to the SSD. -The drive isn’t recognized by the tool | Verify that the Surface Hub SSD is enumerated as a Lite-On drive, "LITEON L CH-128V2S USB Device". If the drive is recognized as another named device, your current cable isn’t compatible. Try another cable or one of the tested cable listed above. -Error: -2147024809 | Open Disk Manager and remove the partitions on the Surface Hub drive. Disconnect and reconnect the drive to the host machine. Restart the imaging tool again. - -If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support). diff --git a/devices/surface-hub/surface-hub-security.md b/devices/surface-hub/surface-hub-security.md deleted file mode 100644 index 4dc2b7518e..0000000000 --- a/devices/surface-hub/surface-hub-security.md +++ /dev/null @@ -1,158 +0,0 @@ ---- -title: "Surface Hub security overview" -description: "This page explains the Defense in Depth design of Surface Hub and describes security enhancements in Surface Hub 2S, wireless security protections, and related features." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: coveminer -ms.author: v-jokai -manager: laurawi -audience: Admin -ms.topic: article -ms.date: 03/27/2020 -ms.localizationpriority: High ---- -# Surface Hub security overview - -Surface Hub provides a locked-down computing appliance with custom platform firmware running the Windows 10 Team Edition operating system. The resulting device takes the traditional, "single use" secure kiosk, "only run what you need" philosophy and delivers a modern take on it. Built to support a rich collaborative user experience, Surface Hub is protected against continually evolving security threats. - -Built on Windows 10, Surface Hub delivers enterprise-grade modern security enabling IT admins to enforce data protection with BitLocker, Trusted Platform Module 2.0 (TPM), plus cloud-powered security with Windows Defender (also known as Microsoft Defender). - -## Defense in Depth security - -Security protocols begin as soon as Surface Hub is turned on. Starting at the firmware level, Surface Hub will only load the operating system and its components in response to multiple security checks. Surface Hub employs a strategy called Defense in Depth that involves layering independent defensive sub-components to protect the whole of the system in the event of partial failure. This industry practice has proven to be highly effective in mitigating against potential unilateral exploits and weakness in sub-components. - -The modern Unified Extensible Firmware Interface (UEFI) is statically and securely configured by Microsoft to only boot an authenticated Windows 10 Team Edition operating system from internal storage. Every line of code that runs on Surface Hub has its signature verified prior to execution. Only applications signed by Microsoft, either as part of the operating system or installed via the Microsoft Store, can run on the Surface Hub. Code or apps not meeting these requirements are blocked. - -Surface Hub security systems include the following: - -- **Boot-time defenses.** Loads only trusted Surface Hub operating system components. -- **Operating system defenses.** Protects against execution of unintended or malicious software or code. -- **User interface defenses.** Provides a user interface that's safe for end users, preventing access to potentially risky activities such as running executables from the command line. - -### Boot-time defenses - -The SoC has a security processor that's separate from every other core. When you first start Surface Hub, only the security processor starts before anything else can be loaded. - -![Hub startup boot phases showing security processor protections](images/hub-sec-1.png) - -#### Secure Boot - -Secure Boot is used to verify that the components of the boot process, including drivers and the operating system, are validated against a database of valid and known signatures. On Surface Hub, a platform-specific signature must first be validated before the authorized Windows Team operating system can be loaded. This helps prevent attacks from a cloned or modified system running malicious code hidden in what appears to be an otherwise normal user experience. For more information, see [Secure Boot overview](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-secure-boot). - -### Operating system defenses - -Once the operating system is verified as originating from Microsoft and Surface Hub successfully completes the boot process, the device scrutinizes the executable code. Our approach to securing the operating system involves identifying the code signature of all executables, allowing only those that pass our restrictions to be loaded into the runtime. This code signing method enables the operating system to verify the author and confirm that code was not altered prior to running on the device. - -Surface Hub uses a code signing feature known as User Mode Code Integrity (UMCI) in Windows Application Control (formerly known as Device Guard). Policy settings are configured to only allow apps that meet one of these requirements: - -- Universal Windows Platform (Microsoft Store) apps that are [officially certified](https://docs.microsoft.com/windows/uwp/publish/the-app-certification-process). -- Apps signed with the unique Microsoft Production Root Certification Authority (CA), which can only be signed by Microsoft employees with authorized access to those certificates. -- Apps signed with the unique Surface Hub Production Root C. - -The configuration file is signed using the Microsoft Production Root CA designed to prevent restrictions from being removed or modified by a third party. All other executables at this point are simply blocked at the operating system runtime level and prevented from accessing processing power. This attack surface reduction provides the following protections: - -- No legacy document modes -- No legacy script engines -- No Vector Markup Language -- No Browser Helper Objects -- No ActiveX controls - -In addition to blocking unsigned or incorrectly signed code via UMCI, Surface Hub uses Windows Application Control to block Windows components, such as the Command Prompt, PowerShell, and Task Manager. These safeguards reflect a key design feature of Surface Hub as a secure computing appliance. For more information, see the following: - -- [Application Control overview](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) - -- [Windows Defender Application Control and virtualization-based protection of code integrity](https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control) - -### User interface defenses - -While boot-time defenses and operating system lockdown safeguards deliver foundational security, the user interface provides an additional layer designed to further reduce risk. To prevent malicious code from reaching the device through drivers, Surface Hub does not download advanced drivers for plug and play (PnP) devices. Devices that leverage basic drivers, such as USB flash drives or certified Surface Hub peripherals (speakers, microphones, cameras) work as expected, but advanced systems, such as printers, will not. - -User interface defenses also simplify the UI, further preventing the execution of malicious software or code. The following Surface Hub UI elements layer the core security provided by code signing: - -- **File Explorer.** Surface Hub has a custom File Explorer that enables quick access to Music, Videos, Documents, Pictures, and Downloads folders — without exposing users to system or program files. Other locations on the local hard drive are not available through File Explorer. In addition, many file types running such as .exe, and .msi installation files cannot run providing another layer of safety against potentially malicious executables. - -- **Start & All Apps.** The Start and All Apps components of Surface Hub do not expose access to Command Prompt, PowerShell, or other Windows components blocked via Application Control. In addition, Windows run functionality typically accessed on PCs from the Search box is turned off for Surface Hub. - -## Security enhancements in Surface Hub 2S - -Although Surface Hub and Surface Hub 2S both run the same operating system software, some features unique to Surface Hub 2S provide additional management and security capabilities enabling IT admins to perform the following tasks: - -- Manage UEFI settings with SEMM -- Recover Hub with bootable USB -- Harden device account with password rotation - -### Manage UEFI settings with SEMM - -UEFI is an interface between the underlying hardware platform pieces and the operating system. On Surface Hub, a custom UEFI implementation allows granular control over these settings and prevents any non-Microsoft entity from changing the UEFI settings of the device — or booting to a removable drive to modify or change the operating system. - -At a high level, during the factory provisioning process, Surface Hub UEFI is preconfigured to enable Secure Boot and is set to only boot from the internal solid-state drive (SSD), with access to UEFI menus locked down and shortcuts removed. This seals UEFI access and ensures the device can only boot into the Windows Team operating system installed on Surface Hub. - -When managed via Microsoft Surface Enterprise Management Mode (SEMM), IT admins can deploy UEFI settings on Hub devices across an organization. This includes the ability to enable or disable built-in hardware components, protect UEFI settings from being changed by unauthorized users, and adjust boot settings. - -![Surface Hub UEFI settings](images/hub-sec-2.png) - -Admins can implement SEMM and enrolled Surface Hub 2S devices using the downloadable [Microsoft Surface UEFI Configurator](https://www.microsoft.com/download/details.aspx?id=46703). For more information, see [Secure and manage Surface Hub 2S with SEMM and UEFI](https://docs.microsoft.com/surface-hub/surface-hub-2s-secure-with-uefi-semm). -Secured using a certificate to protect the configuration from unauthorized tampering or removal, SEMM enables management of the following components: - -- Wired LAN -- Camera -- Bluetooth -- Wi-Fi -- Occupancy sensor -- IPv6 for PXE Boot -- Alternate Boot -- Boot Order Lock -- USB Boot -- UEFI front page interface - - Devices - - Boot - - Date/Time - - -### Recover Hub with bootable USB - -Surface Hub 2S enables admins to reinstall the device to factory settings using a recovery image in as little as 20 minutes. Typically, you would only need to do this if your Surface Hub is no longer functioning. Recovery is also useful if you have lost the Bitlocker key or no longer have admin credentials to the Settings app. - -### Harden device account with password rotation - -Surface Hub uses a device account, also known as a "room account" to authenticate with Exchange, Microsoft Teams, and other services. When you enable password rotation, Hub 2S automatically generates a new password every 7 days, consisting of 15-32 characters with a combination of uppercase and lowercase letters, numbers, and special characters. Because no one knows the password, the device account password rotation effectively mitigates associated risk from human error and potential social engineering security attacks. - -## Windows 10 enterprise-grade security - -In addition to Surface Hub-specific configurations and features addressed in this document, Surface Hub also uses the standard security features of Windows 10. These include: - -- **BitLocker**. The Surface Hub SSD is equipped with BitLocker to protect the data on the device. Its configuration follows industry standards. For more information, see [BitLocker overview](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-secure-boot). -- **Windows Defender.** The Windows Defender anti-malware engine runs continuously on Surface Hub and works to automatically remediate threats found on Surface Hub. The Windows Defender engine receives updates automatically and is manageable via remote management tools for IT admins. The Windows Defender engine is a perfect example of our Defense in Depth approach: If malware can find a way around our core code-signage-based security solution, it will be caught here. For more information, see [Windows Defender Application Control and virtualization-based protection of code integrity](https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control). -- **Plug and play drivers.** To prevent malicious code from reaching the device through drivers, Surface Hub does not download advanced drivers for PnP devices. This allows devices that leverage basic drivers such as USB flash drives to work as expected while blocking more advanced systems such as printers. -- **Trusted Platform Module 2.0.** Surface Hub has an industry standard discrete Trusted Platform Module (dTPM) for generating and storing cryptographic keys and hashes. The dTPM protects keys used for the verification of boot phases, the BitLocker master key, password-less sign-on key, and more. The dTPM meets [FIPS 140-2 Level 2](https://docs.microsoft.com/windows/security/threat-protection/fips-140-validation) certification, the U.S. government computer security standard, and is compliant with [Common Criteria](https://docs.microsoft.com/windows/security/threat-protection/windows-platform-common-criteria) certification used worldwide. - -## Wireless security for Surface Hub - -Surface Hub uses Wi-Fi Direct / Miracast technology and the associated 802.11, Wi-Fi Protected Access (WPA2), and Wireless Protected Setup (WPS) standards. Since the device only supports WPS (as opposed to WPA2 Pre-Shared Key (PSK) or WPA2 Enterprise), issues traditionally associated with 802.11 encryption are simplified by design. - -Miracast is part of the Wi-Fi Display standard, which itself is supported by the Wi-Fi Direct protocol. These standards are supported in modern mobile devices for screen sharing and collaboration. - -Wi-Fi Direct or Wi-Fi "peer to peer" (P2P) is a standard released by the Wi-Fi Alliance for "Ad-Hoc" networks. This allows supported devices to communicate directly and create groups of networks without requiring a traditional Wi-Fi Access Point or an Internet connection. - -Security for Wi-Fi Direct is provided by WPA2 using the WPS standard. Devices can be authenticated using a numerical pin, a physical or virtual push button, or an out-of-band message using near-field communication. Surface Hub supports both push button by default as well PIN methods. For more information, see [How Surface Hub addresses Wi-Fi Direct security issues](https://docs.microsoft.com/surface-hub/surface-hub-wifi-direct). - -## Learn more - -- [Secure Boot overview](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-secure-boot) - -- [BitLocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) - -- [Application Control overview](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) - -- [Secure and manage Surface Hub 2S with SEMM and UEFI](https://docs.microsoft.com/surface-hub/surface-hub-2s-secure-with-uefi-semm) - -- [How Surface Hub addresses Wi-Fi Direct security issues](https://docs.microsoft.com/surface-hub/surface-hub-wifi-direct) - -- [Windows Defender Application Control and virtualization-based protection of code integrity](https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control) - -- [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) - -- [FIPS 140-2 Level 2](https://docs.microsoft.com/windows/security/threat-protection/fips-140-validation) - -- [Common Criteria certification](https://docs.microsoft.com/windows/security/threat-protection/windows-platform-common-criteria) diff --git a/devices/surface-hub/surface-hub-site-readiness-guide.md b/devices/surface-hub/surface-hub-site-readiness-guide.md deleted file mode 100644 index d12281f55b..0000000000 --- a/devices/surface-hub/surface-hub-site-readiness-guide.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Surface Hub Site Readiness Guide -ms.reviewer: -manager: laurawi -description: Use this Site Readiness Guide to help plan your Surface Hub installation. -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -ms.topic: article -ms.localizationpriority: medium ---- - -# Surface Hub Site Readiness Guide - -Use this Site Readiness Guide to help plan your Surface Hub installation. In this guide, you’ll find: -- Site readiness topics -- Detailed hardware specifications on power, ports, and cables -- Recommendations for moving and storage -- Links to guidance on unpacking and mounting - -## Site readiness planning - -The room needs to be large enough to provide good viewing angles, but small enough for the microphones to pick up clear signals from the people in the room. Most rooms that are about 22 feet (seven meters) long will provide a good meeting experience. In the conference area, mount Surface Hub where: - -- Everyone in the room can see it. -- People can reach all four edges of the touchscreen. -- The screen is not in direct sunlight, which could affect viewing or damage the screen. -- Ventilation openings are not blocked. -- Microphones are not affected by noise sources, such as fans or vents. -You can find more details in the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections. For cleaning, care, and safety information, see the mounting guides and user guide at https://www.microsoft.com/surface/support/surface-hub. - -### Hardware considerations - -Surface Hub arrives with: -- Two Microsoft Surface Hub pens -- A Microsoft wireless keyboard, customized for Surface Hub -- A 9-foot NEMA 5-15P (US Standard) to C13 power cable - -You’ll need to provide: -- Cat-5e or Cat-6 network cables -- Display cables (optional) -- Audio cable (optional) -- Type A to B USB cable (optional) - -For details about cable ports, see the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections. For details about cables, see [Wired Connect](#wired). - -Microsoft Surface Hub has an internal PC and does not require an external computer system. - -For power recommendations, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md). For power cable safety warnings, see the mounting guides at https://www.microsoft.com/surface/support/surface-hub. - -### Data and other connections - -To use Surface Hub, you need an active Ethernet port and a standard power outlet. In addition, you may want to: - -- Equip the conference table for Wired Connect. -- Expand the wall outlet configuration to include: - - Additional AC outlets - - Ethernetports - - Audio ports - - Video ports (DisplayPort, HDMI, VGA, etc.) - - -## When Surface Hub arrives - -Surface Hub is large and heavy, so let Receiving know when it will arrive and what they should do to handle it safely. For details on the packing weights and other specifications, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md). - -Consider the following: -- Wait to unpack Surface Hub from the shipping container until you’ve moved it to the conference area where you plan to install it. -- Make sure your loading dock can accept a shipment on a pallet and hold it securely until it can be installed. -- Check for local labor union rules that would require you to use union labor to unload or move Surface Hub. -- Do not leave Surface Hub in a hot or humid environment. As with any computer-based or display equipment, heat and humidity can damage Surface Hub. The recommended storage temperatures are 32°F to 95°F with a relative humidity of less than 70 percent. - -### Moving Surface Hub - -Before you move Surface Hub, make sure that all the doorways, thresholds, hallways, and elevators are big enough to accommodate it. For information on the dimensions and weight of your Surface Hub in its shipping container, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md). - -### Unpacking Surface Hub - -For unpacking information, refer to the unpacking guide included in the shipping container. You can open the unpacking instructions before you open the shipping container. These instructions can also be found here: https://www.microsoft.com/surface/support/surface-hub - ->[!IMPORTANT] ->Retain and store all Surface Hub shipping materials—including the pallet, container, and screws—in case you need to ship Surface Hub to a new location or send it -for repairs. For the 84” Surface Hub, retain the lifting handles. - -### Lifting Surface Hub - -The 55” Surface Hub requires two people to safely lift and mount. The 84” Surface Hub requires four people to safely lift and mount. Those assisting must be able to lift 70 pounds to waist height. Review the unpacking and mounting guide for details on lifting Surface Hub. You can find it at https://www.microsoft.com/surface/support/surface-hub. - -## Mounting and setup - -See your mounting guide at https://www.microsoft.com/surface/support/surface-hub for detailed instructions. - -There are three ways to mount your Surface Hub: - -- **Wall mount**: Lets you permanently hang Surface Hub on a conference space wall. -- **Floor support mount**: Supports Surface Hub on the floor while it is permanently anchored to a conference space wall. -- **Rolling stand**: Supports Surface Hub and lets you move it to other conference locations. For links to guides that provide details about each mounting method, including building requirements, see https://www.microsoft.com/surface/support/surface-hub. - -For specifications on available mounts for the original Surface Hub, see the following: - -- [Surface Hub Mounts and Stands Datasheet](https://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf) -- [Surface Hub Stand and Wall Mount Specifications](https://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf) - -## The Connect experience - -Connect lets people project their laptop, tablet, or phone to the Surface Hub screen. Connect allows wireless or wired connection types. - -#### Wireless connect - -Since wireless connect is based on Miracast, you don’t need cables or additional setup planning to use it. Your users can load Miracast on most Miracast-enabled Windows 8.1 and Windows 10 devices. Then they can project their display from their computer or phone to the Surface Hub screen. - - -#### Wired connect - -With wired connect, a cable transmits information from computers, tablets, or phones to Surface Hub. There are three video cable options, and they all use the same USB 2.0 cable. The cable bundle can include one or all of these connection options. - -- DisplayPort (DisplayPort cable + USB 2.0 cable) -- HDMI (HDMI cable + USB 2.0 cable) -- VGA (VGA cable + 3.5mm audio cable + USB 2.0 cable) - -For example, to provide audio, video, and touchback capability to all three video options, your Wired Connect cable bundle must include: - -- A DisplayPort cable -- An HDMI cable -- A VGA cable -- A USB 2.0 cable -- A 3.5mm cable - -When you create your wired connect cable bundles, check the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections for specific technical and physical details and port locations for each type of Surface Hub. Make the cables long enough to reach from Surface Hub to where the presenter will sit or stand. - -For details on Touchback and Inkback, see the user guide at https://www.microsoft.com/surface/support/surface-hub. - - - -## See also - -[Watch the video (opens in a pop-up media player)](https://compass.xbox.com/assets/27/aa/27aa7dd7-7cb7-40ea-9bd6-c7de0795f68c.mov?n=04.07.16_installation_video_01_site_readiness.mov) diff --git a/devices/surface-hub/surface-hub-ssd-replacement.md b/devices/surface-hub/surface-hub-ssd-replacement.md deleted file mode 100644 index 12f256388d..0000000000 --- a/devices/surface-hub/surface-hub-ssd-replacement.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Surface Hub SSD replacement -ms.reviewer: -manager: laurawi -description: Learn how to replace the solid state drive in a Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Surface Hub SSD replacement - -You might need to remove the solid state drive (SSD) from your Surface Hub so that you can reimage it using the [Surface Hub Recovery Tool](surface-hub-recovery-tool.md) or because you've been sent a replacement drive. You would reimage your SSD when the operating system is no longer bootable, such as from a Windows update failure, BitLocker issues, reset failure, or hardware failure. - - ->[!WARNING] ->Make sure the Surface Hub is turned off at the AC switch. - -1. Locate the SSD compartment door on the rear, upper portion of the Surface Hub in the locations illustrated below. The door is identifiable as it doesn't have open ventilation slots. - - ![SSD compartment door](images/ssd-location.png) - - *Surface Hub hard drive locations* - -2. Locate the locking tab on the hard drive compartment door. On the Surface Hub 55, the locking tab will be located on the left-hand side of the door. On the Surface Hub 84, it will be on the right-hand side as shown in the illustration. - - ![SSD compartment locking tab](images/ssd-lock-tab.png) - - *Locking tab on hard drive compartment door* - -3. Lift open the compartment door to access the hard drive. - - ![Lift](images/ssd-lift-door.png) - - *Lift compartment door* - -4. Locate the pull tab, which may be partially hidden under the rear cover. Pull on the tab to eject the hard drive from the compartment. - - ![Pull](images/ssd-pull-tab.png) - - *Pull tab* - -5. Slide the replacement drive into place until you hear it click. - - ![Slide in drive](images/ssd-click.png) - - *Slide replacement drive into place* - -6. Close the compartment door. - -7. Apply power to the Surface Hub. diff --git a/devices/surface-hub/surface-hub-start-menu.md b/devices/surface-hub/surface-hub-start-menu.md deleted file mode 100644 index 468e0d3329..0000000000 --- a/devices/surface-hub/surface-hub-start-menu.md +++ /dev/null @@ -1,184 +0,0 @@ ---- -title: Configure Surface Hub Start menu -description: Use MDM to customize the Start menu on Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -ms.topic: article -ms.date: 08/15/2018 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Configure Surface Hub Start menu - -The [January 17, 2018 update to Windows 10](https://support.microsoft.com/help/4057144) (build 15063.877) enables customized Start menus on Surface Hub devices. You apply the customized Start menu layout using mobile device management (MDM). - -When you apply a customized Start menu layout to Surface Hub, users cannot pin, unpin, or uninstall apps from Start. - -## How to apply a customized Start menu to Surface Hub - -The customized Start menu is defined in a Start layout XML file. You have two options for creating your Start layout XML file: - -- Edit the [default Surface Hub Start XML](#default) - - -or- - -- Configure the desired Start menu on a desktop (pinning only apps that are available on Surface Hub), and then [export the layout](https://docs.microsoft.com/windows/configuration/customize-and-export-start-layout#export-the-start-layout). - ->[!TIP] ->To add a tile with a web link to your desktop start menu, go to the link in Microsoft Edge, select `...` in the top right corner, and select **Pin this page to Start**. See [a Start layout that includes a Microsoft Edge link](#edge) for an example of how links will appear in the XML. - -To edit the default XML or the exported layout, familiarize yourself with the [Start layout XML](https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop). There are a few [differences between Start layout on a deskop and a Surface Hub.](#differences) - -When you have your Start menu defined in a Start layout XML, [create an MDM policy to apply the layout.](https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management#a-href-idbkmk-domaingpodeploymentacreate-a-policy-for-your-customized-start-layout) - - -## Differences between Surface Hub and desktop Start menu - -There are a few key differences between Start menu customization for Surface Hub and a Windows 10 desktop: - -- You cannot use **DesktopApplicationTile** (https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop#startdesktopapplicationtile) in your Start layout XML because Windows desktop applications (Win32) are not supported on Surface Hub. -- You cannot use the Start layout XML to configure the taskbar or the Welcome screen for Surface Hub. -- Surface Hub supports a maximum of 6 columns (6 1x1 tiles), however, you **must** define `GroupCellWidth=8` even though Surface Hub will only display tiles in columns 0-5, not columns 6 and 7. -- Surface Hub supports a maximum 6 rows (6 1x1 tiles) -- `SecondaryTile`, which is used for links, will open the link in Microsoft Edge. - - - -## Example: Default Surface Hub Start layout - -```xml - - - - - - - - - - - - - - - - - - - -``` - - -## Example: Start layout that includes a Microsoft Edge link - -This example shows a link to a website and a link to a .pdf file. The secondary tile for Microsoft Edge uses a 150 x 150 pixel icon. - -```xml - - - - - - - - - - - - - - - - - - - -``` - ->[!NOTE] ->The default value for `ForegroundText` is light; you don't need to include `ForegroundText` in your XML unless you're changing the value to dark. diff --git a/devices/surface-hub/surface-hub-technical-55.md b/devices/surface-hub/surface-hub-technical-55.md deleted file mode 100644 index 209e77df4c..0000000000 --- a/devices/surface-hub/surface-hub-technical-55.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Technical information for 55" Surface Hub -ms.reviewer: -manager: laurawi -description: Specifications for the 55" Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Technical information for 55" Surface Hub - -## Measurements - -| ---- | --- -Pricing | Starting at $8,999 -Size | 31.75” x 59.62” x 3.38” (806.4mm x 1514.3mm x 85.8mm) -Storage/RAM | SSD 128GB with 8GB RAM -Processor | 4th Generation Intel® Core™ i5 -Graphics | Intel® HD 4600 -Ports | **Internal PC**
• (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
• (2) USB 2.0
• Ethernet 1000 Base-T
• DisplayPort
• Video Output
• 3.5mm Stereo Out
• RJ11 Connector for system-level control
**Alternate PC**
• (2) USB 2.0 type B output
• Connection for Camera, Sensors, Microphone, Speakers
• (1) DisplayPort Video Input
**Guest PC**
• DisplayPort Video Input
• HDMI Video Input
• VGA Video Input
• 3.5mm Stereo Input
• (1) USB 2.0 type B Touchback™ Output -Sensors | (2) Passive Infrared Presence Sensors, Ambient Light Sensors -Speakers | (2) Front-facing stereo speakers -Microphone | High-Performance, 4-Element Array -Camera | (2) Wide angle HD cameras 1080p @ 30fps -Pen | (2) Powered, active, subpixel accuracy -Physical side buttons | Power, Input Select, Volume, Brightness -Software | Windows 10 + Office (Word, PowerPoint, Excel) -What’s in the box | • Surface Hub 55”
• (2) Surface Hub Pens
• Power Cable
• Setup Guide
• Start Guide
• Safety and Warranty documents
• Wireless All-in-One Keyboard -Mounting features | 4X VESA standard, 400mm x 400mm plus 1150mm x 400mm pattern, 8X M6 X 1.0 threaded mounting locations -Display height from floor | Recommended height of 55 inches (139.7 cm) to center of screen -Product weight | Approx. 105 lb. (47.6 kg) without accessories -Product shipping weight | Approx. 150 lb. (68 kg) -Product dimensions HxWxD | 31.63 x 59.62 x 3.2 inches (80.34 x 151.44 x 8.14 cm) -Product shipping dimensions HxWxD | 43 x 65 x 20 inches (109 x 165 x 51 cm) -Product thickness | Touch surface to mounting surface: ≤ 2.4 inches (6 cm) -Orientation | Landscape only. Display cannot be used in a portrait orientation. -BTU | 1706 BTU/h -Image resolution | 1920 x 1080 -Frame rate | 120Hz -EDID preferred timing, replacement PC | 1920 x 1080, 120Hz vertical refresh -EDID preferred timing, wired connect | 1920 x 1080, 60Hz vertical refresh -Input voltage | (50/60Hz) 110/230v nominal, 90-265v max -Input power, operating | 500W max -Input power, standby | 5W nominal - - -## Replacement PC connections - -Connector and location | Label | Description ---- | --- | --- -Switch, bottom I/O | ![](images/switch.png) | Switches the function between using internal PC or external PC. -Display port, bottom I/O | ![](images/dport.png) | Provides input for replacement PC. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for replacement PC to internal peripherals. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for integrated hub. - - -## Wired connect connections - -Connector and location | Label | Description ---- | --- | --- -Display port, bottom I/O | ![](images/dportio.png) | Provides input for wired connect PC. -HDMI, bottom I/O | ![](images/hdmi.png) | Provides HDMI input for wired connect PC. -VGA, bottom I/O | ![](images/vga.png) | Provides VGA input for wired connect PC. -3.5mm, bottom I/O | ![](images/35mm.png) | Provides analog audio input. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for video ingest touchback. - -## Additional connections - -Connector and location | Label | Description ---- | --- | --- -USB type A, side I/O | ![](images/usb.png) | Provides 1 USB 3.0 connection for USB devices. Wake-on USB capable. -USB type A, bottom I/O with blue insulator | ![](images/usb.png) | Provides USB 3.0 connection. -3.5mm, bottom I/O | ![](images/analog.png) | Provides analog audio out. -Display port, bottom I/O | ![](images/dportout.png) | Provides mirrored video out function to another display. -IEC/EN60320-C13 receptacle with hard switch | ![](images/iec.png) | Provides AC input and compliance with EU power requirements. -RJ45, bottom I/O | ![](images/rj45.png) | Connects to Ethernet. -RJ11, bottom I/O | ![](images/rj11.png) | Connects to room control systems. - - - - - - - -## Diagrams of ports and clearances - -***Top view of 55" Surface Hub*** - -![](images/sh-55-top.png) - ---- - - -***Front view of 55" Surface Hub*** - -![](images/sh-55-front.png) - - ---- - -***Bottom view of 55" Surface Hub*** - -![](images/sh-55-bottom.png) - - ---- - -***Replacement PC ports on 55" Surface Hub*** - -![](images/sh-55-rpc-ports.png) - - ---- - -***Keypad on right side of 55" Surface Hub*** - -![](images/key-55.png) - - ---- - -***Rear view of 55" Surface Hub*** - -![](images/sh-55-rear.png) - - ---- - -***Clearances for 55" Surface Hub*** - -![](images/sh-55-clearance.png) - ---- - - -***Front and bottom handholds and clearances for 55" Surface Hub*** - -![](images/sh-55-hand.png) - - ---- - - -***Rear handholds and clearances for 55" Surface Hub*** - -![](images/sh-55-hand-rear.png) - - diff --git a/devices/surface-hub/surface-hub-technical-84.md b/devices/surface-hub/surface-hub-technical-84.md deleted file mode 100644 index 1c08da5a6b..0000000000 --- a/devices/surface-hub/surface-hub-technical-84.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Technical information for 84" Surface Hub -ms.reviewer: -manager: laurawi -description: Specifications for the 84" Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.localizationpriority: medium ---- - -# Technical information for 84" Surface Hub - -## Measurements - -| ---- | --- -Pricing | Starting at $21,999 -Size | 46.12” x 86.7” x 4.15” (1171.5mm x 2202.9mm x 105.4mm) -Storage/RAM | SSD 128GB with 8GB RAM -Processor | 4th Generation Intel® Core™ i7 -Graphics | NVIDIA Quadro K2200 -Ports | **Internal PC**
• (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
• (4) USB 2.0
• Ethernet 1000 Base-T
• DisplayPort Video Output
• 3.5mm Stereo Out
• RJ11 Connector for system-level control
**Alternate PC**
• (2) USB 2.0 type B output
• connection for Camera, Sensors, Microphone, Speakers
• (2) DisplayPort Video Input
**Guest PC**
• DisplayPort Video Input
• HDMI Video Input
• VGA Video Input
• 3.5mm Stereo Input
• (1) USB 2.0 type B Touchback™ Output -Sensors | (2) Passive Infrared Presence Sensors, Ambient Light Sensors -Speakers | (2) Front-facing stereo speakers -Microphone | High-Performance, 4-Element Array -Camera | (2) Wide angle HD cameras 1080p @ 30fps -Pen | (2) Powered, active, subpixel accuracy -Physical side buttons | Power, Input Select, Volume, Brightness -Software | Windows 10 + Office (Word, PowerPoint, Excel) -What’s in the box | • Surface Hub 84”
• (2) Surface Hub Pens
• Power Cable
• Setup Guide
• Safety and Warranty documents
• Wireless All-in-One Keyboard -Mounting features | 4X VESA standard, 1200mm x 600mm pattern, 8X M8 X 1.25 threaded mounting locations -Display height from floor | Recommended height of 54 inches (139.7 cm) to center of screen -Product weight | Approx. 280 lb. (127 kg.) -Product shipping weight | Approx. 580 lb. (263 kg.) -Product dimensions HxWxD | 46 x 86.9 x 4.1 inches (116.8 x 220.6 x 10.4 cm) -Product shipping dimensions HxWxD | 66.14 x 88.19 x 24.4 inches (168 x 224 x 62 cm) -Product thickness | Touch surface to mounting surface: ≤ 3.1 inches (7.8 cm) -Orientation | Landscape only. Display cannot be used in a portrait orientation. -BTU | 3070.8 BTU/h -Image resolution | 3840 x 2160 -Frame rate | 120Hz -Contrast Ratio | 1400:1 -EDID preferred timing, replacement PC | 3840 x 2140, 120Hz vertical refresh -EDID preferred timing, wired connect | 1920 x 1080, 60Hz vertical refresh -Input voltage | 110/230v nominal, 90-265v max -Input power, operating | 900W max -Input power, standby | 5W nominal, 1-10W max - - -## Replacement PC connections - -Connector and location | Label | Description ---- | --- | --- -Switch, bottom I/O | ![](images/switch.png) | Switches the function between using internal PC or external PC. -Display port, bottom I/O | ![](images/dport.png) | Provides input for replacement PC. -Display port, bottom I/O | ![](images/dport.png) | Provides second input for replacement PC. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for replacement PC to internal peripherals. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for integrated hub. - - -## Wired connect connections - -Connector and location | Label | Description ---- | --- | --- -Display port, bottom I/O | ![](images/dportio.png) | Provides input for wired connect PC. -HDMI, bottom I/O | ![](images/hdmi.png) | Provides HDMI input for wired connect PC. -VGA, bottom I/O | ![](images/vga.png) | Provides VGA input for wired connect PC. -3.5mm, bottom I/O | ![](images/35mm.png) | Provides analog audio input. -USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for video ingest touchback. - -## Additional connections - -Connector and location | Label | Description ---- | --- | --- -USB type A, side I/O | ![](images/usb.png) | Provides 1 USB 3.0 connection for USB devices. Wake-on USB capable. -USB type A, bottom I/O with blue insulator | ![](images/usb.png) | Provides USB 3.0 connection. -3.5mm, bottom I/O | ![](images/analog.png) | Provides analog audio out. -Display port, bottom I/O | ![](images/dportout.png) | Provides mirrored video out function to another display. -IEC/EN60320-C13 receptacle with hard switch | ![](images/iec.png) | Provides AC input and compliance with EU power requirements. -RJ45, bottom I/O | ![](images/rj45.png) | Connects to Ethernet. -RJ11, bottom I/O | ![](images/rj11.png) | Connects to room control systems. - - - - - - - -## Diagrams of ports and clearances - -***Top view of 84" Surface Hub*** - -![](images/sh-84-top.png) - ---- - - -***Front view of 84" Surface Hub*** - -![](images/sh-84-front.png) - - ---- - -***Bottom view of 84" Surface Hub*** - -![](images/sh-84-bottom.png) - - ---- - -***Replacement PC ports on 84" Surface Hub*** - -![](images/sh-84-rpc-ports.png) - - - ---- - -***Rear view of 84" Surface Hub*** - -![](images/sh-84-rear.png) - - ---- - -***Clearances for 84" Surface Hub*** - -![](images/sh-84-clearance.png) - ---- - - -***Removable lifting handles on 84” Surface Hub *** - -![](images/sh-84-hand.png) - - ---- - - -***Wall mount threads on back of 84” Surface Hub *** - -![](images/sh-84-wall.png) - ---- -***Lifting handles in top view of 84” Surface Hub*** - -![](images/sh-84-hand-top.png) - ---- -***Side view of 84” Surface Hub*** - -![](images/sh-84-side.png) - - diff --git a/devices/surface-hub/surface-hub-update-history.md b/devices/surface-hub/surface-hub-update-history.md deleted file mode 100644 index 8e584f17b3..0000000000 --- a/devices/surface-hub/surface-hub-update-history.md +++ /dev/null @@ -1,564 +0,0 @@ ---- -title: Surface Hub update history -description: Surface Hub update history -ms.assetid: d66a9392-2b14-4cb2-95c3-92db0ae2de34 -keywords: -ms.prod: surface-hub -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Surface Hub update history - -Windows 10 was designed to be a service, which means it automatically gets better through periodic software updates. The great news is that you usually don’t have to do anything to get the latest Windows 10 updates—they'll download and install whenever they’re available. - -Most Windows updates focus on performance and security improvements to keep you going 24/7. - -One thing we’re hearing from you is that you want to know more about what's in our Windows 10 updates, so we're providing more details on this page. In the list below, the most recent Windows update is listed first. Installing the most recent update ensures that you also get any previous updates you might have missed, including security updates. Microsoft Store apps are updated through the Microsoft Store (managed by the Surface Hub's system administrator). Details about app updates are provided on a per-app basis. -We'll be refreshing this page as new updates are released, so stay tuned for the latest info. And thank you for helping us learn and get better with each update! - -Please refer to the “[Surface Hub Important Information](https://support.microsoft.com/products/surface-devices/surface-hub)” page for related topics on current and past releases that may require your attention. - -## Windows 10 Team Creators Update 1703 - -

-February 28, 2020—update for Surface Hub 2S - -This update is specific to the Surface Hub 2S and provides the driver and firmware updates outlined below: - -* Surface Integration driver - 13.46.139.0 - * Improves display brightness scenarios. -* Intel(R) Management Engine Interface driver - 1914.12.0.1256 - * Improves system stability. -* Surface SMC Firmware update - 1.161.139.0 - * Improves pen battery performance. -* Surface UEFI update - 694.2938.768.0 - * Improves system stability. -
- -
-February 11, 2020—update for Team edition based on KB4537765* (OS Build 15063.2284) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves an issue where the Hub 2S cannot be heard well by other participants during Skype for Business calls. -* Improves reliability for some Arabic, Hebrew, and other RTL language usage scenarios on Surface Hub. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4537765](https://support.microsoft.com/help/4537765) -
- -
-January 14, 2020—update for Team edition based on KB4534296* (OS Build 15063.2254) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Addresses an issue with log collection for Microsoft Surface Hub 2S. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4534296](https://support.microsoft.com/help/4534296) -
- -
-September 24, 2019—update for Team edition based on KB4516059* (OS Build 15063.2078) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - - * Update to Surface Hub 2S Recovery Settings page to accurately reflect recovery options. - * Update to Surface Hub 2S Welcome screen to improve device recognizability. - * Addressed an issue with the Windows Team Edition shell background displaying incorrectly. - * Addressed an issue with Start Menu layout persistence when configured using MDM policy. - * Fixed an issue in Microsoft Edge that occurs when browsing some internal websites. - * Fixed an issue in Skype for Business that occurs when presenting in full-screen mode. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4503289](https://support.microsoft.com/help/4503289) -
- -
-August 17, 2019—update for Team edition based on KB4512474* (OS Build 15063.2021) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - - * Ensures that Video Out on Hub 2S defaults to "Duplicate" mode. - * Improves reliability for some Arabic language usage scenarios on Surface Hub. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4503289](https://support.microsoft.com/help/4503289) -
- -
-June 18, 2019—update for Team edition based on KB4503289* (OS Build 15063.1897) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Addresses an issue preventing a user from signing in to a Microsoft Surface Hub device with an Azure Active Directory account. This issue occurs because a previous session did not end successfully. -* Adds support for TLS 1.2 connections to identity providers and Exchange in device account setup scenarios. -* Fixes to improve reliability of Hardware Diagnostic App on Hub 2S. -* Fix to improve consistency of first-run setup experience on Hub 2S. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4503289](https://support.microsoft.com/help/4503289) -
- -
-May 28, 2019—update for Team edition based on KB4499162* (OS Build 15063.1835) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Ensures that Surface Hub users aren't prompted to enter proxy credentials after the "Use device account credentials" feature has been enabled. -* Resolves an issue where Skype connections fail periodically because audio/video isn't using the correct proxy. -* Adds support for TLS 1.2 in Skype for Business. -* Resolves a SIP connection failure in the Skype client when the Skype server has TLS 1.0 or TLS 1.1 disabled. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4499162](https://support.microsoft.com/help/4499162) -
- -
-April 25, 2019—update for Team edition based on KB4493436* (OS Build 15063.1784) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves video and audio sync issue with some USB devices that are connected to the Surface Hub. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4493436](https://support.microsoft.com/help/4493436) -
- -
-November 27, 2018—update for Team edition based on KB4467699* (OS Build 15063.1478) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Addresses an issue that prevents some users from Signing-In to “My Meetings and Files.” - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KBKB4467699](https://support.microsoft.com/help/KB4467699) -
- -
-October 18, 2018 —update for Team edition based on KB4462939* (OS Build 15063.1418) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Skype for Business fixes: - * Resolves Skype for Business connection issue when resuming from sleep - * Resolves Skype for Business network connection issue, when device is connected to Internet - * Resolves Skype for Business crash when searching for users from directory -* Resolves issue where the Hub mistakenly reports “No Internet connection” in enterprise proxy environments. -* Implemented a feature allowing customers to op-in to a new Whiteboard experience. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4462939](https://support.microsoft.com/help/4462939) -
- -
-August 31, 2018 —update for Team edition based on KB4343889* (OS Build 15063.1292) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Adds support for Microsoft Teams -* Resolves task management issue with Intune registration -* Enables Administrators to disable Instant Messaging and Email services for the Hub -* Additional bug fixes and reliability improvements for the Surface Hub Skype for Business App - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4343889](https://support.microsoft.com/help/4343889) -
- -
-June 21, 2018 —update for Team edition based on KB4284830* (OS Build 15063.1182) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Telemetry change in support of GDPR requirements in EMEA - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4284830](https://support.microsoft.com/help/KB4284830) -
- -
-April 17, 2018 —update for Team edition based on KB4093117* (OS Build 15063.1058) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves a wired projection issue -* Enables bulk update for certain MDM (Mobile Device Management) policies -* Resolves phone dialer issue with international calls -* Addresses image resolution issue when 2 Surface Hubs join the same meeting -* Resolves OMS (Operations Management Suite) certificate handling error -* Addresses a security issue when cleaning up at the end of a session -* Addresses Miracast issue, when Surface Hub is specified to channels 149 through 165 - * Channels 149 through 165 will continue to be unusable in Europe, Japan or Israel due to regional governmental regulations - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4093117](https://support.microsoft.com/help/4093117) -
- -
-February 23, 2018 —update for Team edition based on KB4077528* (OS Build 15063.907) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolved an issue where MDM settings were not being correctly applied -* Improved Cleanup process - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4077528](https://support.microsoft.com/help/4077528) -
- -
-January 16, 2018 —update for Team edition based on KB4057144* (OS Build 15063.877) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Adds ability to manage Start Menu tile layout via MDM -* MDM bug fix on password rotation configuration - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4057144](https://support.microsoft.com/help/4057144) -
- -
-December 12, 2017 —update for Team edition based on KB4053580* (OS Build 15063.786) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves camera video flashes (tearing or flickers) during Skype for Business calls -* Resolves Notification Center SSD ID issue - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4053580](https://support.microsoft.com/help/4053580) -
- -
-November 14, 2017 —update for Team edition based on KB4048954* (OS Build 15063.726) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Feature update that allows customers to enable 802.1x wired network authentication using MDM policy. -* A feature update that enables users to dynamically select an application of their choice when opening a file. -* Fix that ensures that End Session cleanup fully removes all connections between the user’s account and the device. -* Performance fix that improves cleanup time as well as Miracast connection time. -* Introduces Easy Authentication utilization during ad-hock meetings. -* Fix that ensures service components to use the same proxy that is configured across the device. -* Reduces and more thoroughly secures the telemetry transmitted by the device, reducing bandwidth utilization. -* Enables a feature allowing users to provide feedback to Microsoft after a meeting concludes. - -Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. -*[KB4048954](https://support.microsoft.com/help/4048954) -
- -
-October 10, 2017 —update for Team edition based on KB4041676* (OS Build 15063.674) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Skype for Business - * Resolves issue that required a device reboot when resuming from sleep. - * Fixes issue where external contacts did not resolve through Skype Online Hub account. -* PowerPoint - * Fixes problem where some PowerPoint presentations would not project on Hub. -* General - * Fix to resolve issue where USB port could not be disabled by System Administrator. - -*[KB4041676](https://support.microsoft.com/help/4041676) -
- -
-September 12, 2017 —update for Team edition based on KB4038788* (OS Build 15063.605) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Security - * Resolves issue with Bitlocker when device wakes from sleep. -* General - * Reduces frequency/amount of device health telemetry, improving system performance. - * Fixes issue that prevented device from collecting system logs. - -*[KB4038788](https://support.microsoft.com/help/4038788) -
- -
-August 1, 2017 — update for Team edition based on KB4032188* (OS Build 15063.498) - -* Skype for Business - * Resolves Skype for Business Sign-In issue, which required retry or system reboot. - * Resolves Skype for Business meeting time being incorrectly displayed. - * Fixes to improve Surface Hub Skype for Business reliability. - -*[KB4032188](https://support.microsoft.com/help/4032188) -
- -
-June 27, 2017 — update for Team edition based on KB4022716* (OS Build 15063.442) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Address NVIDIA driver crashes that may necessitate sleeping 84” Surface Hub to power down, requiring a manual restart. -* Resolved an issue where some apps fail to launch on an 84” Surface Hub. - -*[KB4022716](https://support.microsoft.com/help/4022716) -
- -
-June 13, 2017 — update for Team edition based on KB4022725* (OS Build 15063.413) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* General - * Resolved Pen ink dropping issues with pens - * Resolved issue causing extended time to “cleanup” meeting - -*[KB4022725](https://support.microsoft.com/help/4022725) -
- -
-May 24, 2017 — update for Team edition based on KB4021573* (OS Build 15063.328) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* General - * Resolved issue with proxy setting retention during update issue - -*[KB4021573](https://support.microsoft.com/help/4021573) -
- -
-May 9, 2017 — update for Team edition based on KB4016871* (OS Build 15063.296) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* General - * Addressed sleep/wake cycle issue - * Resolved several Reset and Recovery issues - * Addressed Update History tab issue - * Resolved Miracast service launch issue -* Apps - * Fixed App package update error - -*[KB4016871](https://support.microsoft.com/help/4016871) -
- -
-Windows 10 Team Creators Update 1703 for Surface Hub — General Release notes (OS Build 15063.0) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Evolving the large screen experience - * Improved the meeting carousel in Welcome and Start - * Join meetings and end the session directly from the Start menu - * Apps can utilize more of the screen during a session - * Simplified Skype controls - * Improved mechanisms for providing feedback -* Access My Personal Content* - * Personal single sign-on from Welcome or Start - * Join meetings and end the session directly from the Start menu - * Access personal files through OneDrive for Business directly from Start - * Pre-populated attendee sign-in - * Streamlined authentication flows with “Authenticator” app** -* Deployment & Manageability - * Simplified OOBE experience through bulk provisioning - * Cloud-based device recovery service - * Enterprise client certificate support - * Improved proxy credential support - * Added and /improved Skype Quality of Service (QoS) configuration support - * Added ability to set default device volume in Settings - * Improved MDM support for Surface Hub [settings](https://docs.microsoft.com/surface-hub/remote-surface-hub-management) -* Improved Security - * Added ability to restrict USB drives to BitLocker only - * Added ability to disable USB ports via MDM - * Added ability to disable “Resume session” functionality on timeout - * Addition of wired 802.1x support -* Audio and Projection - * Dolby Audio “Human Speaker” enhancements - * Reduced “pen tap” sounds when using Pen during Skype for Business calls - * Added support for Miracast infrastructure connections -* Reliability and Performance fixes - * Resolved several Reset and Recovery issues - * Resolved Surface Hub Exchange authentication issue when utilizing client certificates - * Improved Wi-Fi network connection and credentials stability - * Fixed Miracast audio popping and sync issues during video playback - * Included setting to disable auto connect behavior - -*Single sign-in feature requires use of Office365 and OneDrive for Business -**Refer to Admin Guide for service requirements - -
- -## Windows 10 Team Anniversary Update 1607 - -
-March 14th, 2017 — update for Team edition based on KB4013429* (OS Build 14393.953) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* General - * Security fix for File Explorer to prevent navigation to restricted file locations -* Skype for Business - * Fix to address latency during Remote Desktop based screen sharing - -*[KB4013429](https://support.microsoft.com/help/4013429) -
- -
-January 10th, 2017 — update for Team edition based on KB4000825* (OS Build 14393.693) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Enabled selection of 106/109 Keyboard Layouts for use with physical Japanese keyboards - -*[KB4000825](https://support.microsoft.com/help/4000825) -
- -
-December 13, 2016 — update for Team edition based on KB3206632* (OS Build 14393.576) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Resolves wired connection audio distortion issue - -*[KB3206632](https://support.microsoft.com/help/3206632) -
- -
-November 4, 2016 — update for Windows 10 Team Anniversary edition based on KB3200970* (OS Build 14393.447) - -This update to the Windows 10 Team Anniversary Update (version 1607) for Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Skype for Business bug fixes to improve reliability - -*[KB3200970](https://support.microsoft.com/help/3200970) -
- -
-October 25, 2016 — update for Team edition based on KB3197954* (OS Build 14393.351) - -This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Enabling new Sleep feature in OS and Bios to reduce the Surface Hub’s power consumption and improve its long-term reliability -* General - * Resolves scenarios where the on-screen keyboard would sometimes not appear - * Resolves Whiteboard application shift that occasionally occurs when opening scheduled meeting - * Resolves issue that prevented Admins from changing the local administrator password, after device has been Reset - * BIOS change resolving issue with status bar tracking during device Reset - * UEFI update to resolve powering down issues - -*[KB3197954](https://support.microsoft.com/help/3197954) -
- -
-October 11, 2016 — update for Team edition based on KB3194496* (OS Build 14393.222) - -This update brings the Windows 10 Team Anniversary Update to Surface Hub and includes quality improvements and security fixes. (Your device will be running Windows 10 Version 1607 after it's installed.) Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Skype for Business - * Performance improvements when joining meetings, including issues when joining a meeting using federated accounts - * Video Based Screen Sharing (VBSS) support now available on Skype for Business for Surface Hub - * Resolved disconnection after 5 minutes of idle time issue - * Resolved Skype Hub-to-Hub screen sharing failure - * Improvements to Skype video, including: - * Loss of video during meeting with multiple video presenters - * Video cropping during calls - * Outgoing call video not displaying for other participants - * Addressed issue with UPN sign in error - * Addressed issue with dial pad during use of Session Initiation Protocol (SIP) calls -* Whiteboard - * User can now save and recall Whiteboard sessions using OneDrive online service (via Share functionality) - * Improved launching Whiteboard when removing pen from dock -* Apps - * Pre-installed OneDrive app, for access to your personal and work files - * Pre-installed Photos app, to view photos and video - * Pre-installed PowerBI app, to view dashboards - * The Office apps – Word, Excel, PowerPoint – are all ink-enabled - * Edge on Surface Hub now supports Flash-based websites -* General - * Enabled Audio Device Selection (for Surface Hubs attached using external audio devices) - * Enabled support for HDCP on DisplayPort output connector - * System UI changes to settings for usability optimization (refer to [User and Admin Guides](https://www.microsoft.com/surface/support/surface-hub) for additional details) - * Bug fixes and performance optimizations to speed up the Azure Active Directory sign-in flow - * Significantly improved time needed to reset and restore Surface Hub - * Windows Defender UI has been added within settings - * Improved UX touch to start - * Enabled support for greater than 1080p wireless projection via Miracast, on supported devices - * Resolved “There’s no internet connection” and “Appointments may be out of date” false notification states from launch - * Improved reliability of on-screen keyboard - * Additional support for creating Surface Hub provisioning packages using Windows Imaging & Configuration Designer (ICD) and improved Surface Hub monitoring solution on Operations Management Suite (OMS) - -*[KB3194496](https://support.microsoft.com/help/3194496) -
- -## Updates for Windows 10 Version 1511 - -
-November 4, 2016 — update for Windows 10 Team (version 1511) on KB3198586* (OS Build 10586.679) - -This update to the Windows 10 Team edition (version 1511) to Surface Hub includes quality improvements and security fixes that are outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history). There are no Surface Hub specific items in this update. - -*[KB3198586](https://support.microsoft.com/help/3198586) -
- -
-July 12, 2016 — KB3172985* (OS Build 10586.494) - -This update includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key changes specific to the Surface Hub (those not already included in the [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history)), include: - -* Fixed issue that caused Windows system crashes -* Fixed issue that caused repeated Edge crashes -* Fixed issue causing pre-shutdown service crashes -* Fixed issue where some app data wasn’t properly removed after a session -* Updated Broadcom NFC driver to improve NFC performance -* Updated Marvell Wi-Fi driver to improve Miracast performance -* Updated Nvidia driver to fix a display bug in which 84" Surface Hub devices show dim or fuzzy content -* Numerous Skype for Business issues fixed, including: - * Issue that caused Skype for Business to disconnect during meetings - * Issue in which users were unable to join meetings when the meeting organizer was on a federated configuration - * Enabling Skype for Business application sharing - * Issue that caused Skype application crashes -* Added a prompt in “Settings” to inform users that the OS can become corrupted if device reset is interrupted before completion - -*[KB3172985](https://support.microsoft.com/help/3172985) -
- -
-June 14, 2016 — KB3163018* (OS Build 10586.420) - -This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Constrained release. Refer to July 12, 2016 — [KB3172985](https://support.microsoft.com/en-us/help/3172985) (OS Build 10586.494) for Surface Hub specific package details - -*[KB3163018](https://support.microsoft.com/help/3163018) -
- -
-May 10, 2016 — KB3156421* (OS Build 10586.318) - -This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Fixed issue that prevented certain Store apps (OneDrive) from installing -* Fixed issue that caused touch input to stop responding in applications - -*[KB3156421](https://support.microsoft.com/help/3156421) -
- -
-April 12, 2016 — KB3147458* (OS Build 10586.218) - -This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: - -* Fixed issue where volume level wasn’t properly reset between sessions - -*[KB3147458](https://support.microsoft.com/help/3147458) -
- -## Related topics - -* [Windows 10 release information](https://go.microsoft.com/fwlink/p/?LinkId=724328) -* [Windows 10 November update: FAQ](https://windows.microsoft.com/windows-10/windows-update-faq) -* [Microsoft Surface update history](https://go.microsoft.com/fwlink/p/?LinkId=724327) -* [Microsoft Lumia update history](https://go.microsoft.com/fwlink/p/?LinkId=785968) -* [Get Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=616447) diff --git a/devices/surface-hub/surface-hub-wifi-direct.md b/devices/surface-hub/surface-hub-wifi-direct.md deleted file mode 100644 index fc1ada3230..0000000000 --- a/devices/surface-hub/surface-hub-wifi-direct.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: How Surface Hub addresses Wi-Fi Direct security issues -description: Guidance about Wi-Fi Direct security risks. -keywords: change history -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 11/27/2019 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# How Surface Hub addresses Wi-Fi Direct security issues - -Microsoft Surface Hub is an all-in-one productivity device that enables teams to better brainstorm, collaborate, and share ideas. Surface Hub relies on Miracast for wireless projection through Wi-Fi Direct. - -This article describes Wi-Fi Direct security vulnerabilities, how Surface Hub addresses those risks, and how administrators can configure Surface Hub for the highest level of security. This information will help customers who have high security requirements protect their Surface Hub-connected networks and data in transit. - -The intended audiences for this article are IT and network administrators who want to deploy Surface Hub in their corporate environment with optimal security settings. - -## Overview - -Security for Surface Hub depends extensively on Wi-Fi Direct/Miracast and the associated 802.11, Wi-Fi Protected Access (WPA2), and Wireless Protected Setup (WPS) standards. Because the device only supports WPS (as opposed to WPA2 Pre-Shared Key [PSK] or WPA2 Enterprise), the issues often associated with 802.11 encryption are simplified. - -Surface Hub operates on par with the field of Miracast receivers. So, it's vulnerable to a similar set of exploits as all WPS-based wireless network devices. But the Surface Hub implementation of WPS has extra precautions built in. Also, its internal architecture helps prevent an attacker who has compromised the Wi-Fi Direct/Miracast layer from moving past the network interface onto other attack surfaces and connected enterprise networks. - -## Wi-Fi Direct background - -Miracast is part of the Wi-Fi Display standard, which is supported by the Wi-Fi Direct protocol. These standards are supported in modern mobile devices for screen sharing and collaboration. - -Wi-Fi Direct or Wi-Fi "peer to peer" (P2P) is a standard from the Wi-Fi Alliance for "Ad-Hoc" networks. Supported devices can communicate directly and create groups of networks without a conventional Wi-Fi access point or Internet connection. - -Security for Wi-Fi Direct is provided by WPA2 under the WPS standard. The authentication mechanism for devices can be a numerical pin (WPS-PIN), a physical or virtual push button (WPS-PBC), or an out-of-band message such as near field communication (WPS-OOO). Surface Hub supports both the PIN method and the push-button method, which is the default. - -In Wi-Fi Direct, groups are created as one of the following types: -- *Persistent*, in which automatic reconnection can occur by using stored key material -- *Temporary*, in which devices can't re-authenticate without user action - -Wi-Fi Direct groups determine a *group owner* (GO) through a negotiation protocol, which mimics the "station" or "access point" functionality for the established Wi-Fi Direct group. The Wi-Fi Direct GO provides authentication (via an "internal registrar") and facilitates upstream network connections. For Surface Hub, this GO negotiation doesn't occur. The network only operates in "autonomous" mode, and Surface Hub is always the group owner. Finally, Surface Hub itself doesn't join other Wi-Fi Direct networks as a client. - -## How Surface Hub addresses Wi-Fi Direct vulnerabilities - -**Vulnerabilities and attacks in the Wi-Fi Direct invitation, broadcast, and discovery process:** Wi-Fi Direct/Miracast attacks may target weaknesses in the group establishment, peer discovery, device broadcast, or invitation processes. - -|Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| The discovery process may remain active for an extended period of time, which could allow invitations and connections to be established without the approval of the device owner. | Surface Hub only operates as the group owner, which doesn't perform the client discovery or GO negotiation processes. You can fully disable wireless projection to turn off broadcast. | -| Invitation and discovery through PBC allows an unauthenticated attacker to perform repeated connection attempts, or unauthenticated connections are automatically accepted. | By requiring WPS PIN security, administrators can reduce the potential for such unauthorized connections or "invitation bombs," in which invitations are repeatedly sent until a user mistakenly accepts one. | - -**Wi-Fi Protected Setup (WPS) push button connect (PBC) vs PIN entry:** Public weaknesses have been demonstrated in WPS-PIN method design and implementation. WPS-PBC has other vulnerabilities that could allow active attacks against a protocol that's designed for one-time use. - -| Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| WPS-PBC is vulnerable to active attackers. The WPS specification states: "The PBC method has zero bits of entropy and only protects against passive eavesdropping attacks. PBC protects against eavesdropping attacks and takes measures to prevent a device from joining a network that was not selected by the device owner. The absence of authentication, however, means that PBC does not protect against active attack." Attackers can use selective wireless jamming or other denial-of-service techniques to trigger an unintended Wi-Fi Direct GO or connection. Also, an active attacker who merely has physical proximity can repeatedly tear down any Wi-Fi Direct group and attempt the attack until it succeeds. | Enable WPS-PIN security in Surface Hub configuration. The Wi-Fi WPS specification states: "The PBC method should only be used if no PIN-capable registrar is available and the WLAN user is willing to accept the risks associated with PBC." | -| WPS-PIN implementations can be subject to brute-force attacks that target a vulnerability in the WPS standard. The design of split PIN verification led to multiple implementation vulnerabilities over the past several years across a range of Wi-Fi hardware manufacturers. In 2011, researchers Stefan Viehböck and Craig Heffner released information about this vulnerability and tools such as "Reaver" as a proof of concept. | The Microsoft implementation of WPS in Surface Hub changes the PIN every 30 seconds. To crack the PIN, an attacker must complete the entire exploit in less than 30 seconds. Given the current state of tools and research in this area, a brute-force PIN-cracking attack through WPS is unlikely to succeed. | -| WPS-PIN can be cracked by an offline attack because of weak initial key (E-S1,E S2) entropy. In 2014, Dominique Bongard described a "Pixie Dust" attack where poor initial randomness for the pseudo random number generator (PRNG) in the wireless device allowed an offline brute-force attack. | The Microsoft implementation of WPS in Surface Hub is not susceptible to this offline PIN brute-force attack. The WPS-PIN is randomized for each connection. | - -**Unintended exposure of network services:** Network daemons that are intended for Ethernet or WLAN services may be accidentally exposed because of misconfiguration (such as binding to "all"/0.0.0.0 interfaces). Other possible causes include a poorly configured device firewall or missing firewall rules. - -| Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| Misconfiguration binds a vulnerable or unauthenticated network service to "all" interfaces, which includes the Wi-Fi Direct interface. This can expose services that shouldn't be accessible to Wi-Fi Direct clients, which may be weakly or automatically authenticated. | In Surface Hub, the default firewall rules only permit the required TCP and UDP network ports and by default deny all inbound connections. Configure strong authentication by enabling the WPS-PIN mode.| - -**Bridging Wi-Fi Direct and other wired or wireless networks:** Network bridging between WLAN or Ethernet networks is a violation of the Wi-Fi Direct specification. Such a bridge or misconfiguration may effectively lower or remove wireless access controls for the internal corporate network. - -| Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| Wi-Fi Direct devices could allow unauthenticated or poorly authenticated access to bridged network connections. This might allow Wi-Fi Direct networks to route traffic to internal Ethernet LAN or other infrastructure or to enterprise WLAN networks in violation of existing IT security protocols. | Surface Hub can't be configured to bridge wireless interfaces or allow routing between disparate networks. The default firewall rules add defense in depth to any such routing or bridge connections. | - -**The use of Wi-Fi Direct "legacy" mode:** Exposure to unintended networks or devices may occur when you operate in "legacy" mode. Device spoofing or unintended connections could occur if WPS-PIN is not enabled. - -| Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| By supporting both Wi-Fi Direct and 802.11 infrastructure clients, the system is operating in a "legacy" support mode. This may expose the connection-setup phase indefinitely, allowing groups to be joined or devices invited to connect well after their intended setup phase terminates. | Surface Hub doesn't support Wi-Fi Direct legacy clients. Only Wi-Fi Direct connections can be made to Surface Hub even when WPS-PIN mode is enabled. | - -**Wi-Fi Direct GO negotiation during connection setup:** The group owner in Wi-Fi Direct is analogous to the "access point" in a conventional 802.11 wireless network. The negotiation can be gamed by a malicious device. - -|Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| If groups are dynamically established or the Wi-Fi Direct device can be made to join new groups, the group owner negotiation can be won by a malicious device that always specifies the maximum group owner "intent" value of 15. (But the connection fails if the device is configured to always be a group owner.) | Surface Hub takes advantage of Wi-Fi Direct "Autonomous mode," which skips the GO negotiation phase of connection setup. And Surface Hub is always the group owner. | - -**Unintended or malicious Wi-Fi deauthentication:** Wi-Fi deauthentication is an old attack in which a local attacker can expedite information leaks in the connection-setup process, trigger new four-way handshakes, target Wi-Fi Direct WPS-PBC for active attacks, or create denial-of-service attacks. - -| Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| Deauthentication packets can be sent by an unauthenticated attacker to cause the station to re-authenticate then to sniff the resulting handshake. Cryptographic or brute-force attacks can be attempted on the resulting handshake. Mitigation for these attack includes enforcing length and complexity policies for pre-shared keys, configuring the access point (if applicable) to detect malicious levels of deauthentication packets, and using WPS to automatically generate strong keys. In PBC mode, the user interacts with a physical or virtual button to allow arbitrary device association. This process should happen only at setup, within a short window. After the button is automatically "pushed," the device will accept any station that associates via a canonical PIN value (all zeros). Deauthentication can force a repeated setup process. | Surface Hub uses WPS in PIN or PBC mode. No PSK configuration is permitted. This method helps enforce generation of strong keys. It's best to enable WPS-PIN security for Surface Hub. | -| In addition to denial-of-service attacks, deauthentication packets can be used to trigger a reconnect that re-opens the window of opportunity for active attacks against WPS-PBC. | Enable WPS-PIN security in the Surface Hub configuration. | - -**Basic wireless information disclosure:** Wireless networks, 802.11 or otherwise, are inherently at risk of information disclosure. Although this information is mostly connection or device metadata, this problem remains a known risk for any 802.11 network administrator. Wi-Fi Direct with device authentication via WPS-PIN effectively reveals the same information as a PSK or Enterprise 802.11 network. - -| Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| During broadcast, connection setup, or even normal operation of already-encrypted connections, basic information about devices and packet sizes is wirelessly transmitted. At a basic level, a local attacker who's within wireless range can examine the relevant 802.11 information elements to determine the names of wireless devices, the MAC addresses of communicating equipment, and possibly other details, such as the version of the wireless stack, packet sizes, or the configured access point or group owner options. | The Wi-Fi Direct network that Surface Hub uses can't be further protected from metadata leaks, just like for 802.11 Enterprise or PSK wireless networks. Physical security and removal of potential threats from wireless proximity can help reduce potential information leaks. | - -**Wireless evil twin or spoofing attacks:** Spoofing the wireless name is a simple, well-known exploit a local attacker can use to lure unsuspecting or mistaken users to connect. - -| Wi-Fi Direct vulnerability | Surface Hub mitigation | -| --- | --- | -| By spoofing or cloning the wireless name or "SSID" of the target network, an attacker may trick the user into connecting to a fake, malicious network. By supporting unauthenticated, auto-join Miracast, an attacker could capture the intended display materials or launch network attacks on the connecting device. | While there are no specific protections against joining a spoofed Surface Hub, this vulnerability is partially mitigated in two ways. First, any potential attack must be physically within Wi-Fi range. Second, this attack is only possible during the first connection. Subsequent connections use a persistent Wi-Fi Direct group, and Windows will remember and prioritize this prior connection during future Hub use. (Note: Spoofing the MAC address, Wi-Fi channel, and SSID simultaneously was not considered for this report and may result in inconsistent Wi-Fi behavior.) Overall, this weakness is a fundamental problem for any 802.11 wireless network that lacks Enterprise WPA2 protocols such as EAP-TLS or EAP-PWD, which Wi-Fi Direct doesn't support. | - -## Surface Hub hardening guidelines - -Surface Hub is designed to facilitate collaboration and allow users to start or join meetings quickly and efficiently. The default Wi-Fi Direct settings for Surface Hub are optimized for this scenario. - -For additional wireless interface security, Surface Hub users should enable the WPS-PIN security setting. This setting disables WPS-PBC mode and offers client authentication. It provides the strongest level of protection by preventing unauthorized connection to Surface Hub. - -If you still have concerns about authentication and authorization for Surface Hub, we recommend that you connect the device to a separate network. You could use Wi-Fi (such as a "guest" Wi-Fi network) or a separate Ethernet network, preferably an entirely different physical network. But a VLAN can also provide added security. Of course, this approach may preclude connections to internal network resources or services and may require additional network configuration to regain access. - -Also recommended: -- [Install regular system updates](manage-windows-updates-for-surface-hub.md) -- Update the Miracast settings to disable auto-present mode - -## Learn more - -- [Wi-Fi Direct specifications](http://www.wi-fi.org/discover-wi-fi/wi-fi-direct) -- [Wireless Protected Setup (WPS) specification](http://www.wi-fi.org/discover-wi-fi/wi-fi-protected-setup) - - - diff --git a/devices/surface-hub/surface-hub.yml b/devices/surface-hub/surface-hub.yml deleted file mode 100644 index dac70e8f37..0000000000 --- a/devices/surface-hub/surface-hub.yml +++ /dev/null @@ -1,62 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Surface Hub -metadata: - document_id: - title: Surface Hub - description: Find tools and resources to help you install, set up, and manage a Surface Hub in your organization. - keywords: Surface Hub, Windows 10 - ms.localizationpriority: medium - author: lizap - ms.author: elizapo - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find tools and resources to help you install, set up, and manage a Surface Hub in your organization. - " -- title: Explore -- items: - - type: markdown - text: " - Discover how this all-in-one productivity device enables teams to better brainstorm, collaborate, and share ideas.
-
- -
Explore the key features and product specifications of Surface Hub.
Get real-world examples of how you can increase productivity and improve collaboration.
Differences between Surface Hub and Windows 10 Enterprise
Surface Hub FAQ'
- " -- title: Plan -- items: - - type: markdown - text: " - Prepare to deploy Surface Hub in your organization. Explore site readiness, assembly, configuration, and Exchange and ActiveSync policies.
- -

**Get ready for Surface Hub**
Explore the steps you'll need to take to set up Surface Hub.
Surface Hub Site Readiness Guide (PDF, 1.48 MB)
Unpacking guides

**Assembly for Surface Hub**
Learn how to assemble your Surface Hub.
Surface Hub Setup Guide (PDF, 1.43 MB)
Mounting and assembling guides

**Prepare your environment**
Learn about setup dependencies and account requirements.
Prepare your environment
Create and test a device account
- " -- title: Deploy -- items: - - type: markdown - text: " - Get information for setup, app management and installation, and network management of your Surface Hub.
- -

**Set up your Surface Hub**
Review info needed to prepare for using the out-of-box experience to set up your Surface Hub.
Setup worksheet
First-run program
PowerShell scripts

**Install apps**
Options for installing and managing apps on your Surface Hub.
Install apps
Whiteboard to Whiteboard collaboration
Create provisioning packages

**Network your Surface Hub**
Network scenarios for your Surface Hub.
Wireless network management
Using a room control system
Connect other devices with Surface Hub.
- " -- title: Manage -- items: - - type: markdown - text: " - Learn how to manage Surface Hub updates and maintain the security and integrity of corporate devices.
- -

**Manage the device**
Monitoring for Surface Hub is performed through Microsoft Operations Management Suite (OMS).
Monitor your Surface Hub
Accessibility and Surface Hub

**Manage account**
Learn about options for managing accounts used with Surface Hub.
Change the Surface Hub device account
Admin account management

**Stay secure and up to date**
Learn how Surface Hub stays current.
Manage Windows updates
Surface Hub update history
Save your BitLocker key

**Training for your employees**
Find resources to help employees be productive with Surface Hub.
Surface Hub User Guide (PDF, 1.69 MB)
How-to videos
- " -- title: Stay informed -- items: - - type: markdown - text: " - -

**Surface IT Pro Blog**
Get insight into new Surface products plus tips and tricks for IT professionals.
Learn more

**Surface on Microsoft Mechanics**
View technical demos and walkthroughs of Surface devices, features, and functionality.
Get started

**Follow us on Twitter**
Keep up with the latest news and see the latest product demonstrations.
Visit Twitter
- " diff --git a/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md b/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md deleted file mode 100644 index 7a30ff1e37..0000000000 --- a/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel -description: Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel -ms.assetid: 8af3a832-0537-403b-823b-12eaa7a1af1f -keywords: -ms.prod: surface-hub -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Summary - -In compliance with regional governmental regulations, all 5-GHz wireless devices in Europe, Japan, and Israel do not support the U-NII-3 band. In Surface Hub, the channels that are associated with U-NII-3 are 149 through 165. This includes Miracast connection on these channels. Therefore, Surface Hubs that are used in Europe, Japan, and Israel can't use channels 149 through 165 for Miracast connection. - -## More Information - -For more information see the [U-NII](https://en.wikipedia.org/wiki/U-NII) topic on Wikipedia. - -> [!NOTE] -> Microsoft provides third-party contact information to help you find additional information about this topic. This information may change without notice. Microsoft does not guarantee the accuracy of third-party information. \ No newline at end of file diff --git a/devices/surface-hub/surfacehub-whats-new-1703.md b/devices/surface-hub/surfacehub-whats-new-1703.md deleted file mode 100644 index 4c324d33ce..0000000000 --- a/devices/surface-hub/surfacehub-whats-new-1703.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: What's new in Windows 10, version 1703 for Surface Hub -description: Windows 10, version 1703 (Creators Update) brings new features to Microsoft Surface Hub. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 01/18/2018 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# What's new in Windows 10, version 1703 for Microsoft Surface Hub? - -Watch Surface Hub engineer Jordan Marchese present updates to Microsoft Surface Hub with Windows 10, version 1703 (Creators Update). - - Link to Surface Hub video on Youtube - -Windows 10, version 1703 (also called the Creators Update), introduces the following changes for Microsoft Surface Hub. - -## New settings - -Settings have been added to mobile device management (MDM) and configuration service providers (CSPs) to expand the Surface Hub management capabilities. [New settings include](manage-settings-with-mdm-for-surface-hub.md): - -- InBoxApps/SkypeForBusiness/DomainName -- InBoxApps/Connect/AutoLaunch -- Properties/DefaultVolume -- Properties/ScreenTimeout -- Properties/SessionTimeout -- Properties/SleepTimeout -- Properties/AllowSessionResume -- Properties/AllowAutoProxyAuth -- Properties/DisableSigninSuggestions -- Properties/DoNotShowMyMeetingsAndFiles -- System/AllowStorageCard - -Plus settings based on the new [NetworkQoSPolicy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) and [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp). -
- -## Provisioning wizard - -An easy-to-use wizard helps you quickly create provisioning packages that you can apply to multiple Surface Hub devices, and includes bulk join to Azure Active Directory. [Learn how to create a provisioning package for Surface Hub.](provisioning-packages-for-certificates-surface-hub.md) - -![steps in the provision Surface Hub devices wizard](images/wcd-wizard.png) - -## Miracast on your existing wireless network or LAN - -Microsoft has extended the ability to [send a Miracast stream over a local network](miracast-over-infrastructure.md) rather than over a direct wireless link. - -## Cloud recovery - -When you reset a Surface Hub device, you now have the ability to download and install a factory build of the operating system from the cloud. [Learn more about cloud recovery.](device-reset-surface-hub.md#cloud-recovery) - ->[!NOTE] ->Cloud recovery doesn't work if you use proxy servers. - -![Reinstall](images/reinstall.png) - -## End session - -**I'm done** is now **End session**. [Learn how to use End session.](i-am-done-finishing-your-surface-hub-meeting.md) - -![end session](images/end-session.png) - - - - - - diff --git a/devices/surface-hub/troubleshoot-surface-hub.md b/devices/surface-hub/troubleshoot-surface-hub.md deleted file mode 100644 index 4a30281eff..0000000000 --- a/devices/surface-hub/troubleshoot-surface-hub.md +++ /dev/null @@ -1,619 +0,0 @@ ---- -title: Troubleshoot Microsoft Surface Hub -description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. -ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A -ms.reviewer: -manager: laurawi -keywords: Troubleshoot common problems, setup issues, Exchange ActiveSync errors -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 03/16/2018 -ms.localizationpriority: medium ---- - -# Troubleshoot Microsoft Surface Hub - - -Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. - -The [Surface Hub Hardware Diagnostic tool](https://www.microsoft.com/store/p/surface-hub-hardware-diagnostic/9nblggh51f2g?rtc=1&activetab=pivot%3aoverviewtab) contains interactive tests which allow you to confirm essential functionality of your Hub is working as expected. In addition to testing hardware, the diagnostic can test the resource account to verify that it is configured properly for your environment. If problems are encountered, results can be saved and shared with the Surface Hub Support Team. For usage information, see [Using the Surface Hub Hardware Diagnostic Tool to test a device account](https://support.microsoft.com/help/4077574/using-the-surface-hub-hardware-diagnostic-tool-to-test-a-device-accoun). - -Common issues are listed in the following table, along with causes and possible fixes. The [Setup troubleshooting](#setup-troubleshooting) section contains a listing of on-device problems, along with several types of issues that may be encountered during the first-run experience. The [Exchange ActiveSync errors](#exchange-activesync-errors) section lists common errors the device may encounter when trying to synchronize with an Microsoft Exchange ActiveSync server. - - - - -## Setup troubleshooting - - -This section lists causes, and possible fixes to help troubleshoot issues you might find when you set up your Microsoft Surface Hub. - -### On-device - -Possible fixes for issues on the Surface Hub after you've completed the first-run program. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IssueCausesPossible fixes
-

Not receiving automatic accept/decline messages.

-
-

The device account isn't configured to automatically accept/decline messages.

-
-

Use PowerShell cmdlet Set-CalendarProcessing $upn -AutomateProcessing AutoAccept.

-
-

The device account isn't configured to process external meeting requests.

-
-

Use PowerShell cmdlet Set-CalendarProcessing $upn -ProcessExternalMeetingMessages $true.

-
-

Calendar is not showing on the Welcome screen, or message "Appointments of date (no account provisioned)" is being displayed.

-
-

No device account is set up on this Surface Hub.

-
-

Provision a device account through Settings.

-
-

Calendar is not showing on the Welcome screen or message "Appointments of date (overprovisioned)" is being displayed.

-
-

The device account is provisioned on too many devices.

-
-

Remove the device account from other devices that it's provisioned to. This can be done using the Exchange admin portal.

-
-

Calendar is not showing on the Welcome screen or message "Appointments of date (invalid credentials)" is being displayed.

-
-

The device account's password has expired and is no longer valid.

-
-

Update the account's password in Settings. Also see Password management.

-
-

Calendar is not showing on the Welcome screen or message "Appointments of date (account policy)" is being displayed.

-
-

The device account is using an invalid ActiveSync policy.

-
-

Make sure the device account has an ActiveSync policy where PasswordEnabled == False.

-
-

Calendar is not showing on the Welcome screen or message "Appointments may be out of date" is being displayed.

-
-

Exchange is not enabled.

-
Enable the device account for Exchange services through Settings. You need to make sure you have the right set of ActiveSync policies and have also installed any necessary certificates for Exchange services to work.
-

Can't log in to Skype for Business.

-
-

The device account does not have a Session Initiation Protocol (SIP) address property.

-
-

The account does not have a SIP address property and its User Principal Name (UPN) does not match the actual SIP address. The account must have its SIP address set, or the SIP address should be added using the Settings app.

-
-

Can't log in to Skype for Business.

-
-

The device account requires a certificate to authenticate into Skype for Business.

-
-

Install the appropriate certificate using provisioning packages.

-
-  - -### First run - -Possible fixes for issues with Surface Hub first-run program. - - ----- - - - - - - - - - - - - - - -
IssueCausesPossible fixes

Cannot find account when asked for domain and user name.

Domain needs to be the fully qualified domain name (FQDN).

The FQDN should be provided in the domain field.

- -  - -### Device account page, issues for new account settings - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IssueCausesPossible fixes

Unable to find the provided account in Azure AD.

The provided account's User Principal Name (UPN) has a tenant that can't be reached in Azure AD.

Make sure that you have a working Internet connection, and that the device can reach Microsoft Online Services. Make sure the account credentials are entered correctly.

Unable to reach the specified directory.

The provided account domain specifies a domain that can't be reached.

Make sure that you have a working network connection, and that the device can reach the domain controller. Make sure the account credentials are entered correctly. You can also try using the FQDN instead.

Can't auto-discover Exchange server.

The Exchange server isn't configured for auto-discovery.

Enable auto-discovery of the Exchange server for the device account, or enter the account's Exchange server address manually.

Could not discover the SIP address after entering the account credentials.

There was no SIP address entry in Active Directory or Azure AD.

Make sure the account is enabled with Skype for Business and has a SIP address. If not, you can enter the SIP address manually into the text box.

- -  - -### Device account page, issues for existing account settings - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
IssueCausesError codesPossible fixes
-

Account could not authenticate with the specified credentials.

-
-

The account is not enabled as a user in Active Directory (AD), needs a password to authenticate, or the password is incorrect.

-
-

None

-
-

Make sure the credentials are entered correctly. Enable the account as a user in AD and add a password, or set the RoomMailboxPassword

.
-

Error 0x800C0019 is displayed when providing an Exchange server.

-
-

The device account requires a certificate to authenticate.

-
-

0x800C0019

-
-

Install the appropriate certificate using provisioning packages.

-
-

Device account credentials are not valid for the provided Exchange server.

-
-

The provided Exchange server is not where the device account's mailbox is hosted.

-
-

None

-
-

Make sure you are providing the correct Exchange mail server for the device account.

-
-

HTTP timeout while trying to reach Exchange server.

-
-

0x80072EE2

-
-

Couldn't find the provided Exchange server.

-
-

The Exchange server provided could not be found.

-
-

None

-
-

Ensure that you have a working network or Internet connection, and that the Exchange server you provided is correct.

-
-

http not supported.

-
-

An Exchange server with http:// instead of https:// was provided.

-
-

None

-
-

Use an Exchange server that uses https.

-
-

People land on the page titled "There's a problem with this account" regarding ActiveSync.

-
-
 
-
-

The ActiveSync policy PasswordEnabled is set to True (or 1).

-
-

None

-
-

Create a new ActiveSync policy where PasswordEnabled is set to False (or 0), and then apply that policy to the account.

-
-

The Surface Hub doesn't have a connection to Exchange.

-
-

None

-
-

Make sure that you have a working network or Internet connection.

-
-

Exchange returns a status code indicating an error.

-
-

None

-
-

Make sure that you have a working network or Internet connection.

-
-  - -### First run, Domain join page issues - - ----- - - - - - - - - - - - - - - - - - - - -
IssueCausesPossible fixes

When trying to join a domain, an error shows that the account couldn't authenticate using the specified credentials.

The credentials provided are not capable of joining the specified domain.

Enter correct credentials for an account that exists in the specified domain.

When specifying a group from a domain, an error shows that the group couldn't be found on the domain.

The group may have been removed or no longer exists.

Verify that the group exists within the domain.

- -  - -### First run, Exchange server page - - ----- - - - - - - - - - - - - - - -
IssueCausesPossible fixes

People land on this page and are asked for the Exchange server address.

The Exchange server isn't configured for auto-discovery.

Enable auto-discovery of the Exchange server for the device account, or enter the account's Exchange server address manually.

- -  - -### First run, On-device issues - - ------ - - - - - - - - - - - - - - - - -
IssueCausesError codesPossible fixes

Can't sync mail/calendar.

The account has not allowed the Surface Hub as an allowed device.

0x86000C1C

Add the Surface Hub device ID to the whitelist by setting the ActiveSyncAllowedDeviceIds property for the mailbox.

- -  - - - -  - -## Exchange ActiveSync errors - - -This section lists status codes, mapping, user messages, and actions an admin can take to solve Exchange ActiveSync errors. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Hex CodeMappingUser-Friendly MessageAction admin should take

0x85010002

E_HTTP_DENIED

The password must be updated.

Update the password.

0x80072EFD

WININET_E_CANNOT_CONNECT

Can't connect to the server right now. Wait a while and try again, or check the account settings.

Verify that the server name is correct and reachable. Verify that the device is connected to the network.

0x86000C29

E_NEXUS_STATUS_DEVICE_NOTPROVISIONED (policies don't match)

The account is configured with policies not compatible with Surface Hub.

Disable the PasswordEnabled policy for this account.

-

We have a bug were we may surface policy errors if the account doesn't receive any server notifications within the policy refresh interval.

0x86000C4C

E_NEXUS_STATUS_MAXIMUMDEVICESREACHED

The account has too many device partnerships.

Delete one or more partnerships on the server.

0x86000C0A

E_NEXUS_STATUS_SERVERERROR_RETRYLATER

Can't connect to the server right now.

Wait until the server comes back online. If the issue persists, re-provision the account.

0x85050003

E_CREDENTIALS_EXPIRED (Credentials have expired and need to be updated)

The password must be updated.

Update the password.

0x8505000D

E_AIRSYNC_RESET_RETRY

Can't connect to the server right now. Wait a while or check the account's settings.

This is normally a transient error but if the issue persists check the number of devices associated with the account and delete some of them if the number is large.

0x86000C16

E_NEXUS_STATUS_USER_HASNOMAILBOX

The mailbox was migrated to a different server.

You should never see this error. If the issue persists, re-provision the account.

0x85010004

E_HTTP_FORBIDDEN

Can't connect to the server right now. Wait a while and try again, or check the account's settings.

Verify the server name to make sure it is correct. If the account is using cert based authentication make sure the certificate is still valid and update it if not.

0x85030028

E_ACTIVESYNC_PASSWORD_OR_GETCERT

The account's password or client certificate are missing or invalid.

Update the password and/or deploy the client certificate.

0x86000C2A

E_NEXUS_STATUS_DEVICE_POLICYREFRESH

The account is configured with policies not compatible with Surface Hub.

Disable the PasswordEnabled policy for this account.

0x85050002

E_CREDENTIALS_UNAVAILABLE

The password must be updated.

Update the password.

0x80072EE2

WININET_E_TIMEOUT

The network doesn't support the minimum idle timeout required to receive server notification, or the server is offline.

Verify that the server is running. Verify the NAT settings.

0x85002004

E_FAIL_ABORT

This error is used to interrupt the hanging sync, and will not be exposed to users. It will be shown in the diagnostic data if you force an interactive sync, delete the account, or update its settings.

Nothing.

0x85010017

E_HTTP_SERVICE_UNAVAIL

Can't connect to the server right now. Wait a while or check the account's settings.

Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account.

0x86000C0D

E_NEXUS_STATUS_MAILBOX_SERVEROFFLINE

Can't connect to the server right now. Wait a while or check the account's settings.

Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account.

0x85030027

E_ACTIVESYNC_GETCERT

The Exchange server requires a certificate.

Import the appropriate EAS certificate on the Surface Hub.

0x86000C2B

E_NEXUS_STATUS_INVALID_POLICYKEY

The account is configured with policies not compatible with Surface Hub.

Disable the PasswordEnabled policy for this account.

-

We have a bug were we may surface policy errors if the account doesn't receive any server notifications within the policy refresh interval.

0x85010005

E_HTTP_NOT_FOUND

The server name is invalid.

Verify the server name to make sure it is correct. If the issue persists, re-provision the account.

0x85010014

E_HTTP_SERVER_ERROR

Can't connect to the server.

Verify the server name to make sure it is correct. Trigger a sync and, if the issue persists, re-provision the account.

0x80072EE7

WININET_E_NAME_NOT_RESOLVED

The server name or address could not be resolved.

Make sure the server name is entered correctly.

0x8007052F

ERROR_ACCOUNT_RESTRICTION

While auto-discovering the Exchange server, a policy is applied that prevents the logged-in user from logging in to the server.

This is a timing issue. Re-verify the account's credentials. Try to re-provision when they're correct.

0x800C0019

INET_E_INVALID_CERTIFICATE

Security certificate required to access this resource is invalid.

Install the correct ActiveSync certificate needed for the provided device account.

0x80072F0D

WININET_E_INVALID_CA

The certificate authority is invalid or is incorrect. Could not auto-discover the Exchange server because a certificate is missing.

Install the correct ActiveSync certificate needed for the provided device account.

0x80004005

E_FAIL

The domain provided couldn't be found. The Exchange server could not be auto-discovered and was not provided in the settings.

Make sure that the domain entered is the FQDN, and that there is an Exchange server entered in the Exchange server text box.

- -## Contact Support - -If you have questions or need help, you can [create a support request](https://support.microsoft.com/supportforbusiness/productselection). - - -  -## Related content - -- [Troubleshooting Miracast connection to the Surface Hub](https://docs.microsoft.com/surface-hub/miracast-troubleshooting) -  - - - - - diff --git a/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md b/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md deleted file mode 100644 index d03cfe3055..0000000000 --- a/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to use cloud recovery for BitLocker on a Surface Hub -description: How to use cloud recovery for BitLocker on a Surface Hub -ms.assetid: c0bde23a-49de-40f3-a675-701e3576d44d -keywords: Accessibility settings, Settings app, Ease of Access -ms.prod: surface-hub -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Summary - -This article describes how to use the cloud recovery function if you are unexpectedly prompted by BitLocker on a Surface Hub device. - -> [!NOTE] -> You should follow these steps only if a BitLocker recovery key isn't available. - -> [!WARNING] -> * This recovery process deletes the contents of the internal drive. If the process fails, the internal drive will become completely unusable. If this occurs, you will have to log a service request with Microsoft for a resolution. -> * After the recovery process is complete, the device will be reset to the factory settings and returned to its Out of Box Experience state. -> * After the recovery, the Surface Hub must be completely reconfigured. - -> [!IMPORTANT] -> This process requires an open Internet connection that does not use a proxy or other authentication method. - -## Cloud recovery process - -To perform a cloud recovery, follow these steps: - -1. Select **Press Esc for more recovery options**. - - ![Screenshot of Escape](images/01-escape.png) - -1. Select **Skip this drive**. - - ![Screenshot of Skip this drive](images/02-skip-this-drive.png) - -1. Select **Recover from the cloud**. - - ![Screenshot of Recover from the cloud](images/03-recover-from-cloud.png) - -1. Select **Yes**. - - ![Screenshot of Yes](images/04-yes.png) - -1. Select **Reinstall**. - - ![Screenshot of Reinstall](images/05a-reinstall.png) - - ![Screenshot of Downloading](images/05b-downloading.png) - -1. After the cloud recovery process is complete, start the reconfiguration by using the **Out of Box Experience**. - - ![Screenshot of Out of the Box](images/06-out-of-box.png) - -## "Something went Wrong" error message - -This error is usually caused by network issues that occur during the recovery download. When this issue occurs, don't turn off the Hub because you won't be able to restart it. If you receive this error message, return to the "Recover from the cloud" step, and then restart the recovery process. - -1. Select **Cancel**. - - ![Screenshot of Cancel](images/07-cancel.png) - -1. Select **Troubleshoot**. - - ![Screenshot of Troubleshoot](images/08-troubleshoot.png) - -1. Select **Recover from the cloud**. - - ![Screenshot of Recover from the cloud](images/09-recover-from-cloud2.png) - -1. If the **Wired network isn't found** error occurs, select **Cancel**, and then let the Surface Hub rediscover the wired network. - - ![Screenshot of Wired network isn't found](images/10-cancel.png) \ No newline at end of file diff --git a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md deleted file mode 100644 index cf9f2b6339..0000000000 --- a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Use fully qualified domain name with Surface Hub -description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. -keywords: ["Troubleshoot common problems", "setup issues", "Exchange ActiveSync errors"] -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium -ms.prod: surface-hub -ms.sitesec: library ---- - -# Configure domain name for Skype for Business - -There are a few scenarios where you need to specify the domain name of your Skype for Business server: -- **Multiple DNS suffixes** - When your Skype for Business infrastructure has disjointed namespaces such that one or more servers have a DNS suffix that doesn't match the suffix of the sign-in address (SIP) for Skype for Business. -- **Skype for Business and Exchange suffixes are different** - When the suffix of the sign-in address for Skype for Business differs from the suffix of the Exchange address used for the device account. -- **Working with certificates** - Large organizations with on-premises Skype for Business servers commonly use certificates with their own root certificate authority (CA). It is common for the CA domain to be different than the domain of the Skype for Business server which causes the certificate to not be trusted, and sign-in fails. Skype needs to know the domain name of the certificate in order to set up a trust relationship. Enterprises typically use Group Policy to push this out to Skype desktop, but Group Policy is not supported on Surface Hub. - -**To configure the domain name for your Skype for Business server**
-1. On Surface Hub, open **Settings**. -2. Click **Surface Hub**, and then click **Calling & Audio**. -3. Under **Skype for Business configuration**, click **Configure domain name**. -4. Type the domain name for your Skype for Business server, and then click **Ok**. - > [!TIP] - > You can type multiple domain names, separated by commas.
For example: lync.com, outlook.com, lync.glbdns.microsoft.com - - ![Add Skype for Business FQDN to Settings](images/system-settings-add-fqdn.png) diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md deleted file mode 100644 index 1ec1e19ab5..0000000000 --- a/devices/surface-hub/use-room-control-system-with-surface-hub.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: Using a room control system (Surface Hub) -description: Room control systems can be used with your Microsoft Surface Hub. -ms.assetid: DC365002-6B35-45C5-A2B8-3E1EB0CB8B50 -ms.reviewer: -manager: laurawi -keywords: room control system, Surface Hub -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Using a room control system (Surface Hub) - - -Room control systems can be used with your Microsoft Surface Hub. - -Using a room control system with your Surface Hub involves connecting room control hardware to the Surface Hub, usually through the RJ11 serial port on the bottom of the Surface Hub. - -## Terminal settings - -To connect to a room control system control panel, you don't need to configure any terminal settings on the Surface Hub. If you want to connect a PC or laptop to your Surface Hub and send serial commands from the Surface Hub, you can use a terminal emulator program like Tera Term or PuTTY. - -| Setting | Value | -| --- | --- | -| Baud rate | 115200 | -| Data bits | 8 | -| Stop bits | 1 | -| Parity | none | -| Flow control | none | -| Line feed | every carriage return | - - -## Wiring diagram - -You can use a standard RJ-11 (6P6C) connector to connect the Surface Hub serial port to a room control system. This is the recommended method. You can also use an RJ-11 4-conductor cable, but we do not recommend this method. - -This diagram shows the correct pinout used for an RJ-11 (6P6C) to DB9 cable. - -![Image showing the wiring diagram.](images/room-control-wiring-diagram.png) - -## Command sets - -Room control systems use common meeting-room scenarios for commands. Commands originate from the room control system, and are communicated over a serial connection to a Surface Hub. Commands are ASCII based, and the Surface Hub will acknowledge when state changes occur. - -The following command modifiers are available. Commands terminate with a new line character (\n). Responses can come at any time in response to state changes not triggered directly by a management port command. - -| Modifier | Result | -| --- | --- | -| + | Increment a value | -| - | Decrease a value | -| = | Set a discrete value | -| ? | Queries for a current value | - - -## Power - -Surface Hub can be in one of these power states. - -| State | Energy Star state| Description | -| --- | --- | --- | -| 0 | S5 | Off | -| 1 | - | Power up (indeterminate) | -| 2 | S3 | Sleep | -| 5 | S0 | Ready | - - -In Replacement PC mode, the power states are only Ready and Off and only change the display. The management port can't be used to power on the replacement PC. - -| State | Energy Star state| Description | -| --- | --- | --- | -| 0 | S5 | Off | -| 5 | S0 | Ready | - -For a control device, anything other than 5 / Ready should be considered off. Each PowerOn command results in two state changes and responses. - -| Command | State change| Response | -| --- | --- | --- | -| PowerOn | Device turns on (display + PC).

PC service notifies SMC that the PC is ready. | Power=0

Power=5 | -| PowerOff | Device transitions to ambient state (PC on, display dim). | Power=0 | -| Power? | SMC reports the last-known power state. | Power=<#> | - - - -## Brightness - -The current brightness level is a range from 0 to 100. - -Changes to brightness levels can be sent by a room control system, or other system. - -| Command | State change |Response | -| --- | --- | --- | -| Brightness+ | System management controller (SMC) sends the brightness up command.

PC service on the room control system notifies SMC of new brightness level. | Brightness = 51 | -| Brightness- | SMC sends the brightness down command.

PC service notifies SMC of new brightness level. | Brightness = 50 | - -## Volume - -The current volume level is a range from 0 to 100. - -Changes to volume levels can be sent by a room control system, or other system. - ->[!NOTE] ->The Volume command will only control the volume for embedded or Replacement PC mode, not from [Guest sources](connect-and-display-with-surface-hub.md). - -| Command | State change | Response
(On in [Replacement PC mode](connect-and-display-with-surface-hub.md#replacement-pc-mode)) | -| --- | --- | --- | -| Volume+ | SMC sends the volume up command.

PC service notifies SMC of new volume level. | Volume = 51 | -| Volume- | SMC sends the volume down command.

PC service notifies SMC of new volume level. | Volume = 50 | - - - - -## Mute for audio - -Audio can be muted. - -| Command | State change | Response | -| --- | --- | --- | -| AudioMute+ | SMC sends the audio mute command.

PC service notifies SMC that audio is muted. | none | - - - - -## Video source - -Several display sources can be used. - -| State | Description | -| --- | --- | -| 0 | Onboard PC | -| 1 | DisplayPort | -| 2 | HDMI | -| 3 | VGA | - - - - -Changes to display source can be sent by a room control system, or other system. - -| Command | State change | Response | -| --- | --- | --- | -| Source=# | SMC changes to the desired source.

PC service notifies SMC that the display source has switched. | Source=<#> | -| Source+ | SMC cycles to the next active input source.

PC service notifies SMC of the current input source. | Source=<#> | -| Source- | SMC cycles to the previous active input source.

PC service notifies SMC of the current input source. | Source=<#> | -| Source? | SMC queries PC service for the active input source.

PC service notifies SMC of the current in;put source. | Source=<#> | - -## Errors - -Errors are returned following the format in this table. - -| Error | Notes | -| --- | --- | -| Error: Unknown command '<input>'. | The instruction contains an unknown initial command. For example, "VOL+" would be invalid and return " Error: Unknown command 'VOL'". | -| Error: Unknown operator '<input>'. | The instruction contains an unknown operator. For example, "Volume!" would be invalid and return " Error: Unknown operator '!'". | -| Error: Unknown parameter '<input>'. | The instruction contains an unknown parameter. For example, "Volume=abc" would be invalid and return " Error: Unknown parameter 'abc'". | -| Error: Command not available when off '<input>'. | When the Surface Hub is off, commands other than Power return this error. For example, "Volume+" would be invalid and return " Error: Command not available when off 'Volume'". | - - - - -## Related topics - - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - - - - - - - - - diff --git a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md deleted file mode 100644 index e01737c52e..0000000000 --- a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Using the Surface Hub Hardware Diagnostic Tool to test a device account -description: Using the Surface Hub Hardware Diagnostic Tool to test a device account -ms.assetid: a87b7d41-d0a7-4acc-bfa6-b9070f99bc9c -keywords: Accessibility settings, Settings app, Ease of Access -ms.prod: surface-hub -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium ---- - -# Using the Surface Hub Hardware Diagnostic Tool to test a device account - -## Introduction - -> [!NOTE] -> The "Account Settings" section of the Surface Hub Hardware Diagnostic tool doesn’t collect any information. The email and password that are entered as input are used only directly on your environment and not collected or transferred to anyone. The login information persists only until the application is closed or you end the current session on the Surface Hub. - -> [!IMPORTANT] -> * Administrator privileges are not required to run this application. -> * The results of the diagnostic should be discussed with your local administrator before you open a service call with Microsoft. - -### Surface Hub Hardware Diagnostic - -By default, the [Surface Hub Hardware Diagnostic](https://www.microsoft.com/store/apps/9nblggh51f2g) application isn’t installed in earlier versions of the Surface Hub system. The application is available for free from the Microsoft Store. Administrator privileges are required to install the application. - - ![Screenshot of Hardware Diagnostic](images/01-diagnostic.png) - -## About the Surface Hub Hardware Diagnostic Tool - -The Surface Hub Hardware Diagnostic tool is an easy-to-navigate tool that lets the user test many of the hardware components within the Surface Hub device. This tool can also test and verify a Surface Hub device account. This article describes how to use the Account Settings test within the Surface Hub Hardware Diagnostic tool. - -> [!NOTE] -> The device account for the Surface Hub should be created before any testing is done. The Surface Hub Administrator Guide provides instructions and PowerShell scripts to help you create on-premises, online (Office365), or hybrid device accounts. For more information, go to the [Create and test a device account (Surface Hub)](https://docs.microsoft.com/surface-hub/create-and-test-a-device-account-surface-hub) topic in the guide. - -### Device account testing process - -1. Navigate to **All Apps**, and then locate the Surface Hub Hardware Diagnostic application. - - ![Screenshot of All Apps](images/02-all-apps.png) - -1. When the application starts, the **Welcome** page provides a text window to document the reason why you are testing the Hub. This note can be saved to USB together with the diagnostic results at the conclusion of testing. After you finish entering a note, select the **Continue** button. - - ![Screenshot of Welcome](images/03-welcome.png) - -1. The next screen provides you the option to test all or some of the Surface Hub components. To begin testing the device account, select the **Test Results** icon. - - ![Screenshot of Test Results](images/04-test-results-1.png) - - ![Screenshot of Test Results](images/05-test-results-2.png) - -1. Select **Account Settings**. - - ![Screenshot of Account Settings](images/06-account-settings.png) - - The Account Settings screen is used to test your device account. - - ![Screenshot of Account Settings Details](images/07-account-settings-details.png) - -1. Enter the email address of your device account. The password is optional but is recommended. Select the **Test Account** button when you are ready to continue. - - ![Screenshot of Test Account](images/08-test-account.png) - -1. After testing is finished, review the results for the four areas of testing. Each section can be expanded or collapsed by selecting the Plus or Minus sign next to each topic. - - **Network** - - ![Screenshot of Network](images/09-network.png) - - **Environment** - - ![Screenshot of Environment](images/10-environment.png) - - **Certificates** - - ![Screenshot of Certificates](images/11-certificates.png) - - **Trust Model** - - ![Screenshot of Trust Model](images/12-trust-model.png) - -## Appendix - -### Field messages and resolution - -#### Network - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -Internet Connectivity |Device does have Internet connectivity |Device does not have Internet connectivity |Verifies internet connectivity, including proxy connection | -HTTP Version |1.1 |1.0 |If HTTP 1.0 found, it will cause issue with WU and Store | -Direct Internet Connectivity |Device has a Proxy configured Device has no Proxy configured |N/A |Informational. Is your device behind a proxy? | -Proxy Address | | |If configured, returns proxy address. | -Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated through the proxy. | -Proxy Auth Types | | |If proxy authentication is used, return the Authentication methods advertised by the proxy. | - -#### Environment - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -SIP Domain | | |Informational. | -Skype Environment |Skype for Business Online, Skype for Business OnPrem, Skype for Business Hybrid |Informational. |What type of environment was detected. Note: Hybrid can only be detected if the password is entered. -LyncDiscover FQDN | | |Informational. Displays the LyncDiscover DNS result | -LyncDiscover URI | | |Informational. Displays the URL used to perform a LyncDiscover on your environment.| -LyncDiscover |Connection Successful |Connection Failed |Response from LyncDiscover web service. | -SIP Pool Hostname | | |Informational. Display the SIP pool name discovered from LyncDiscover | - -#### Certificates (in-premises hybrid only) - -LyncDiscover Certificate - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -LyncDiscover Cert CN | | |Informational. Displays the LD cert Common name | -LyncDiscover Cert CA | | |Informational. Displays the LD Cert CA | -LyncDiscover Cert Root CA | | |Informational. Displays the LD Cert Root CA, if available. | -LD Trust Status |Certificate is Trusted. |Certificate is not trusted, please add the Root CA. |Verify the certificate against the local cert store. Returns positive if the machine trusts the certificate.|[Download and deploy Skype for Business certificates using PowerShell](https://blogs.msdn.microsoft.com/surfacehub/2016/06/07/download-and-deploy-skype-for-business-certificates-using-powershell/)/[Supported items for Surface Hub provisioning packages](https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub#supported-items-for-surface-hub-provisioning-packages) - -SIP Pool Certification - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -SIP Pool Cert CN | | |(CONTENTS) | -SIP Pool Cert CA | | |(CONTENTS) | -SIP Pool Trust Status |Certificate is Trusted. |Certificate is not trusted, please add the Root CA. |Verify the certificate against the local cert store and return a positive if the devices trusts the certificate. | -SIP Pool Cert Root CA | | |Information. Display the SIP Pool Cert Root CA, if available. | - -#### Trust Model (on-premises hybrid only) - -Field |Success |Failure |Comment |Reference -|------|------|------|------|------| -Trust Model Status |No Trust Model Issue Detected. |SIP Domain and server domain are different please add the following domains. |Check the LD FQDN/ LD Server Name/ Pool Server name for Trust model issue. -Domain Name(s) | | |Return the list of domains that should be added for SFB to connect. | diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md deleted file mode 100644 index a1e05d92b5..0000000000 --- a/devices/surface-hub/whiteboard-collaboration.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Set up and use Microsoft Whiteboard -description: Microsoft Whiteboard's latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 03/18/2019 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium ---- - -# Set up and use Microsoft Whiteboard - -The Microsoft Whiteboard app includes the capability for Surface Hubs and other devices with the Microsoft Whiteboard app installed to collaborate in real time on the same board. - -## Prerequisites - -To use whiteboard collaboration complete the following actions: - -- Add Whiteboard.ms, whiteboard.microsoft.com, and wbd.ms to your list of allowed sites. -- Open port: **HTTPS: 443** (normally configured when you first run Surface Hub.) - -## Office 365 requirements - -- Whiteboard collaboration is only supported in the Office 365 commercial environment and requires Office 365 with cloud-based Azure Active Directory (Azure AD). -- You can only run collaborative sessions among users belonging to the same Office 365 tenant. -- Office 365 Germany or Office 365 operated by 21Vianet do not support whiteboard collaboration. - -## Collaborating with whiteboards - -To start a collaboration session: - -1. In the Whiteboard app, tap the **Sign in** button. -2. Sign in with your organization ID. -3. Tap the **Invite** button next to your name at the top of the app. -4. Write or type the names of the colleagues you wish to collaborate with. - -On the other device, such as a Surface Hub, when you are signed in, the shared board will now appear in the board gallery. - -### User tips -- Log in to access your whiteboards. As you work, changes are saved automatically. -- Name your whiteboards to help organize your content and find it quickly. Select the … to open the menu. Select the **Options** gear icon to access more tools and features of the Whiteboard. -- Use **Ink to shape** to turn drawing into actual shapes like circles, squares, and triangles. -- Use **Ink to table** to turn a drawn grid into a table with rows and columns. -- You can also change the background color and design from solid to grid or dots. Pick the background, then choose the color from the wheel around it. -- You can export a copy of the Whiteboard collaboration for yourself through the Share charm and leave the board for others to continue working. - -For more information, see [Use Microsoft Whiteboard on a Surface Hub](https://support.office.com/article/use-microsoft-whiteboard-on-a-surface-hub-5c594985-129d-43f9-ace5-7dee96f7621d). - -> [!NOTE] -> If you are using Whiteboard and cannot sign in, you can collaborate by joining a Teams or Skype for Business meeting, and then sharing your screen. After you're done, tap **Settings** > **Export to email** or save a copy of the board. If you choose to export to SVG, it exports vector graphics and provides higher resolution than PNG and can be opened in a web browser. - -## New features in Whiteboard - -The Microsoft Whiteboard app, updated for Surface Hub on July 1, 2019 includes a host of new features including: - -- **Automatic Saving** - Boards are saved to the cloud automatically when you sign in, and can be found in the board gallery. There is no local folder name or directory. -- **Extended collaboration across devices** - You can collaborate using new apps for Windows 10 PC and iOS, and a web version for other devices. -- **Richer canvas** - In addition to ink and images, Whiteboard now includes sticky notes, text and GIFs, with more objects coming soon. -- **Intelligence** – In addition to ink to shape and table, Whiteboard now includes ink beautification to improve handwriting and ink grab to convert images to ink. -- **More color and background options** - Whiteboard now includes more pen colors and thickness options along with additional background colors and designs. -- **Teams Integration** – You can automatically launch Whiteboard from a Teams meeting and share with participants (currently in preview). - - -## Related topics - -- [Windows 10 Creators Update for Surface Hub](https://www.microsoft.com/surface/support/surface-hub/windows-10-creators-update-surface-hub) - -- [Support documentation for Microsoft Whiteboard](https://support.office.com/article/Whiteboard-Help-0c0f2aa0-b1bb-491c-b814-fd22de4d7c01) - -- [Use Microsoft Whiteboard on a Surface Hub](https://support.office.com/article/use-microsoft-whiteboard-on-a-surface-hub-5c594985-129d-43f9-ace5-7dee96f7621d) diff --git a/devices/surface-hub/wireless-network-management-for-surface-hub.md b/devices/surface-hub/wireless-network-management-for-surface-hub.md deleted file mode 100644 index 96162edafe..0000000000 --- a/devices/surface-hub/wireless-network-management-for-surface-hub.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Wireless network management (Surface Hub) -description: Microsoft Surface Hub offers two options for network connectivity to your corporate network and Internet wireless, and wired. While both provide network access, we recommend you use a wired connection. -ms.assetid: D2CFB90B-FBAA-4532-B658-9AA33CAEA31D -ms.reviewer: -manager: laurawi -keywords: network connectivity, wired connection -ms.prod: surface-hub -ms.sitesec: library -author: dansimp -ms.author: dansimp -ms.topic: article -ms.date: 07/27/2017 -ms.localizationpriority: medium ---- - -# Wireless network management (Surface Hub) - - -Microsoft Surface Hub offers two options for network connectivity to your corporate network and Internet: wireless, and wired. While both provide network access, we recommend you use a wired connection. - -## Modifying, adding, or reviewing a network connection - - -If a wired network connection is not available, the Surface Hub can use a wireless network for internet access. A properly connected and configured Wi-Fi access point must be available and within range of the Surface Hub. - -### Choose a wireless access point - -1. On the Surface Hub, open **Settings** and enter your admin credentials. -2. Click **Network & Internet**. Under **Wi-Fi**, choose an access point. If you want Surface Hub to automatically connect to this access point, click **Connect automatically**. Click **Connect**. - - ![Image showing Wi-Fi settings, Network & Internet page.](images/networkmgtwireless-01.png) - -3. If the network is secured, you'll be asked to enter the security key. Click **Next** to connect. - - ![Image showing security key and password prompts for connecting to secured Wi-Fi.](images/networkmgtwireless-02.png) - -### Review wireless settings - -1. On the Surface Hub, open **Settings** and enter your admin credentials. -2. Click **Network & Internet**, then **Wi-Fi**, and then click **Advanced options**. -3. Surface Hub shows you the properties for the wireless network connection. - - ![Image showing properties for connected Wi-Fi.](images/networkmgtwireless-04.png) - -### Review wired settings - -1. On the Surface Hub, open **Settings** and enter your admin credentials. -2. Click **System**, click **Network & Internet**, then click on the network under Ethernet. - - ![Image showing Network & Internet, Ethernet settings page.](images/networkmgtwired-01.png) - -3. The system will show you the properties for the wired network connection. - - ![Image showing properties for ethernet connection.](images/networkmgtwired-02.png) - -## Related topics - - -[Manage Microsoft Surface Hub](manage-surface-hub.md) - -[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) - -  - -  - - - - - diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md deleted file mode 100644 index 7245176edd..0000000000 --- a/devices/surface/TOC.md +++ /dev/null @@ -1,69 +0,0 @@ -# [Surface](index.yml) - -## [Surface devices documentation](get-started.yml) - -## Overview - -### [Surface Pro 7 for Business](https://www.microsoft.com/surface/business/surface-pro-7) -### [Surface Pro X for Business](https://www.microsoft.com/surface/business/surface-pro-x) -### [Surface Laptop 3 for Business](https://www.microsoft.com/surface/business/surface-laptop-3) -### [Surface Book 2 for Business](https://www.microsoft.com/surface/business/surface-book-2) -### [Surface Studio 2 for Business](https://www.microsoft.com/surface/business/surface-studio-2) -### [Surface Go](https://www.microsoft.com/surface/business/surface-go) -### [Secure, work-anywhere mobility with LTE Advanced](https://www.microsoft.com/surface/business/lte-laptops-and-tablets) - -## Plan - -### [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md) -### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md) -### [Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) -### [Considerations for Surface and Endpoint Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) -### [Deploy Surface app with Microsoft Store for Business](deploy-surface-app-with-windows-store-for-business.md) -### [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md) -### [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md) - -## Deploy - -### [Deploy Surface devices](deploy.md) -### [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) -### [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) -### [Surface Pro X app compatibility](surface-pro-arm-app-performance.md) -### [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) -### [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md) -### [Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md) -### [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) -### [Enable the Surface Laptop keyboard during MDT deployment](enable-surface-keyboard-for-windows-pe-deployment.md) -### [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md) -### [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md) -### [Using the Surface Deployment Accelerator deployment share](using-the-sda-deployment-share.md) -### [Surface System SKU reference](surface-system-sku-reference.md) - -## Manage - -### [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) -### [Optimize Wi-Fi connectivity for Surface devices](surface-wireless-connect.md) -### [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md) -### [Surface Dock Firmware Update](surface-dock-firmware-update.md) -### [Battery Limit setting](battery-limit.md) -### [Surface Brightness Control](microsoft-surface-brightness-control.md) -### [Surface Asset Tag](assettag.md) - - -## Secure -### [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md) -### [Manage Surface UEFI settings](manage-surface-uefi-settings.md) -### [Advanced UEFI security features for Surface Pro 3](advanced-uefi-security-features-for-surface-pro-3.md) -### [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) -### [Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md) -### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md) -### [Use Microsoft Endpoint Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) -### [Surface Data Eraser](microsoft-surface-data-eraser.md) - -## Troubleshoot -### [Top support solutions for Surface devices](support-solutions-surface.md) -### [Fix common Surface problems using the Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-for-business-intro.md) -#### [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) -#### [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) -#### [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) - -### [Change history for Surface documentation](change-history-for-surface.md) diff --git a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md deleted file mode 100644 index 017f34559f..0000000000 --- a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md +++ /dev/null @@ -1,171 +0,0 @@ ---- -title: Advanced UEFI security features for Surface Pro 3 (Surface) -description: This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices. -ms.assetid: 90F790C0-E5FC-4482-AD71-60589E3C9C93 -ms.reviewer: -manager: laurawi -keywords: security, features, configure, hardware, device, custom, script, update -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article ---- - -# Advanced UEFI security features for Surface Pro 3 - - -This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices. - -To address more granular control over the security of Surface devices, the v3.11.760.0 UEFI update provides additional security options that allow you to disable specific hardware devices or to prevent starting from those devices. After the UEFI update is installed on a device, you can configure it manually or automatically by running a script. - -## Manually install the UEFI update - - -Before you can configure the advanced security features of your Surface device, you must first install the v3.11.760.0 UEFI update. This update is installed automatically if you receive your updates from Windows Update. For more information about how to configure Windows to update automatically by using Windows Update, see [How to configure and use Automatic Updates in Windows](https://support.microsoft.com/kb/306525). - -To update the UEFI on Surface Pro 3, you can download and install the Surface UEFI updates as part of the Surface Pro 3 Firmware and Driver Pack. These firmware and driver packs are available from the [Surface Pro 3 page](https://www.microsoft.com/download/details.aspx?id=38826) on the Microsoft Download Center. You can find out more about the firmware and driver packs at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices). The firmware and driver packs are available as both self-contained Windows Installer (.msi) and archive (.zip) formats. You can find out more about these two formats and how you can use them to update your drivers at [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). - -## Manually configure additional security settings - - ->[!NOTE] ->To enter firmware setup on a Surface device, begin with the device powered off, press and hold the **Volume Up** button, then press and release the **Power** button, then release the **Volume Up** button after the device has begun to boot. - -After the v3.11.760.0 UEFI update is installed on a Surface device, an additional UEFI menu named **Advanced Device Security** becomes available. If you click this menu, the following options are displayed: - -| Option | Description | Available settings (default listed in bold) | -|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------| -| Network Boot | Enables or disables the ability of your Surface device to boot from the network (also known as PXE boot). | **Enabled**, Not Bootable | -| Side USB | Enables or disables the USB port on the side of the Surface device. Additionally, the USB port can be enabled, but not allow booting. | **Enabled**, Not Bootable, Disabled | -| Docking Port | Enables or disables the ports on the Surface docking station. Additionally, the docking port can be enabled, but block booting from any USB or Ethernet port in the docking station. | **Enabled**, Not Bootable, Disabled | -| Front Camera | Enables or disables the camera on the front of the Surface device. | **Enabled**, Disabled | -| Rear Camera | Enables or disables the camera on the rear of the Surface device. | **Enabled**, Disabled | -| On Board Audio | Enables or disables audio on the Surface device. | **Enabled**, Disabled | -| microSD | Enables or disables the microSD slot on the Surface device. | **Enabled**, Disabled | -| WiFi | Enables or disables the built-in Wi-Fi transceiver in the Surface device. This also disables Bluetooth. | **Enabled**, Disabled | -| Bluetooth | Enables or disables the built-in Bluetooth transceiver in the Surface device. | **Enabled**, Disabled | - -  - -## Automate additional security settings - - -As an IT professional with administrative privileges, you can automate the configuration of UEFI settings by leveraging [Surface Pro 3 Firmware Tools (476 KB)](https://go.microsoft.com/fwlink/p/?LinkID=618038) available from the Microsoft Download Center. These tools install a .NET assembly that can be called from any custom application or script. - -**Prerequisites** - -- The sample scripts below leverage the previously mentioned extension and therefore assume that the tool has been installed on the device being managed. -- The scripts must be run with administrative privilege. -- The Windows PowerShell command [**Set-ExecutionPolicy Unrestricted**](https://technet.microsoft.com/library/ee176961.aspx) must be called prior to running sample scripts if they are not digitally signed. - -**Sample scripts** - ->**Note**:  The UEFI password used in the sample scripts below is presented in clear text. We strongly recommend saving the scripts in a protected location and running them in a controlled environment. - - -Show all configurable options: - -``` -# Load the extension -[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705") - -# Get the collection of all configurable settings -$uefiOptions = [Microsoft.Surface.FirmwareOption]::All() - -foreach ($uefiOption in $uefiOptions) -{ - Write-Host "Name:" $uefiOption.Name - Write-Host " Description =" $uefiOption.Description - Write-Host " Current Value =" $uefiOption.CurrentValue - Write-Host " Default Value =" $uefiOption.DefaultValue - Write-Host " Proposed Value =" $uefiOption.ProposedValue - - # This gives usage and validation information - Write-Host " Allowed Values =" $uefiOption.FriendlyRegEx - Write-Host " Regular Expression =" $uefiOption.RegEx - - Write-Host -} -``` - -Set or change UEFI password: - -``` -# Load the extension -[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705") - -# Must supply UEFI administrator Password if set -# If it is not currently set this is ignored -[Microsoft.Surface.FirmwareOption]::Unlock("1234") - -$Password = [Microsoft.Surface.FirmwareOption]::Find("Password") - -# Set New value to 12345 -$Password.ProposedValue = "12345" -``` - -Check status of proposed changes: - -``` -# Load the extension -[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705") - -# Check update status -$updateStatus = [Microsoft.Surface.FirmwareOption]::UpdateStatus -$updateIteration = [Microsoft.Surface.FirmwareOption]::UpdateIteration -Write-Host "Last Update Status =" $updateStatus -Write-Host "Last Update Iteration =" $updateIteration - -# Get the individual results for the last proposed update -# If the device has never had an update attempt this will be an empty list -$details = [Microsoft.Surface.FirmwareOption]::UpdateStatusDetails -Write-Host $details.Count "Settings were proposed" -if ($details.Count -gt 0) -{ - Write-Host "Result Details" - foreach ($detail in $details.GetEnumerator()) - { - Write-Host " " $detail.Key "=" $detail.Value - } -} -``` - -Revert UEFI to default values: - -``` -# Load the extension -[System.Reflection.Assembly]::Load("SurfaceUefiManager, Version=1.0.5483.22783, Culture=neutral, PublicKeyToken=20606f4b5276c705") - -# Must supply UEFI administrator Password if set -# If it is not currently set this is ignored -[Microsoft.Surface.FirmwareOption]::Unlock("1234") - -# Get the collection of all configurable settings -$uefiOptions = [Microsoft.Surface.FirmwareOption]::All() - -# Reset all options to the factory default -foreach ($uefiOption in $uefiOptions) -{ - $uefiOption.ProposedValue = $uefiOption.DefaultValue -} -``` - -Status code interpretation - -- 00 - The proposed update was a success -- 02 - One of the proposed values had an invalid value -- 03 - There was a proposed value set that was not recognized -- 0F - The unlock password did not match currently set password - -  - -  - - - - - diff --git a/devices/surface/assettag.md b/devices/surface/assettag.md deleted file mode 100644 index 296a57b10e..0000000000 --- a/devices/surface/assettag.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: Surface Asset Tag Tool -description: This topic explains how to use the Surface Asset Tag Tool. -ms.prod: w10 -ms.mktglfcycl: manage -ms.localizationpriority: medium -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: hachidan -manager: laurawi ---- - -# Surface Asset Tag Tool - -Surface Asset Tag is a command line interface (CLI) utility -that allows you to view, assign, and modify an assigned asset tag value -for Surface devices. It works on Surface Pro 3 and all newer Surface devices. - -## System requirements - -- Surface Pro 3 or later - -- UEFI firmware version 3.9.150.0 or later - -## Using Surface Asset Tag - -To run Surface Asset Tag: - -1. On the Surface device, download **Surface Asset Tag.zip** from the [Microsoft Download - Center](https://www.microsoft.com/download/details.aspx?id=46703), - extract the zip file, and save AssetTag.exe in desired folder (in - this example, C:\\assets). - - > [!NOTE] - > For Surface Pro X, use the application named **AssetTag_x86** in the ZIP file. - -2. Open a command console as an Administrator and run AssetTag.exe, - entering the full path to the tool. - -3. Restart Surface. - -### Asset Tag tool commands -In the following examples, AssetTag.exe is saved in a directory on a local machine (C:\assets). - -To get the proposed asset tag, run AssetTag -g. - -**Example** - - ``` - C:\assets\AssetTag.exe -g - ``` - - To clear the proposed asset tag, run AssetTag -s. - - **Example** - - ``` -C:\assets\AssetTag.exe -s - ``` -To set the proposed asset tag, run AssetTag -s testassettag12. - -**Example** - -``` -C:\assets\AssetTag.exe -s testassettag12 -``` - ->[!NOTE] ->The asset tag value must contain between 1 and 36 characters. Valid characters include A-Z, a-z, 0-9, period (.) and hyphen (-). - - -## Managing asset tags - -You can view the existing asset tag in the UEFI settings under Device -Information (**Control Panel > Recovery > Advanced Startup > Restart -now**.) - -The figure below shows the results of running the Asset Tag Tool on -Surface Go. - -![Results of running Surface Asset Tag tool on Surface Go. -](images/assettag-fig1.png) - -> **Figure 1.** Results of running Surface Asset Tag tool on Surface Go - -Alternately, you can use WMI to query the existing asset tag on a device: - -(Get-WmiObject -query “Select * from Win32_SystemEnclosure”) - -**Example** - - ``` -C:\Windows\System32> (Get-WmiObject -query “Select * from Win32_SystemEnclosure”) - ``` - -### Using PowerShell - -You can use the script below as a way of getting the proposed value and -interpreting any errors. - - ``` -AssetTag -g \> $asset\_tag 2\> $error\_message -$asset\_tag\_return\_code = $LASTEXITCODE -$asset\_tag = $asset\_tag.Trim(“\`r\`n”) - -if ($asset\_tag\_return\_code -eq 0) { -Write-Output (“Good Tag = ” + $asset\_tag) -} else { -Write-Output ( -“Failure: Code = ” + $asset\_tag\_return\_code + -“Tag = ” + $asset\_tag + -“Message = ” + $error\_message) - -} - ``` diff --git a/devices/surface/battery-limit.md b/devices/surface/battery-limit.md deleted file mode 100644 index c260718254..0000000000 --- a/devices/surface/battery-limit.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Battery Limit setting (Surface) -description: Battery Limit is a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.reviewer: -manager: laurawi -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Battery Limit setting - -Battery Limit option is a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. This setting is recommended in cases in which the device is continuously connected to power, for example when devices are integrated into kiosk solutions. - -## How Battery Limit works - -Setting the device on Battery Limit changes the protocol for charging the device battery. When Battery Limit is enabled, the battery charge will be limited to 50% of its maximum capacity. The charge level reported in Windows will reflect this limit. Therefore, it will show that the battery is charged up to 50% and will not charge beyond this limit. If you enable Battery Limit while the device is above 50% charge, the Battery icon will show that the device is plugged in but discharging until the device reaches 50% of its maximum charge capacity. - -## Supported devices -The Battery Limit UEFI setting is built into the latest Surface devices including Surface Pro 7 and Surface Laptop 3. Earlier devices require a - [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the [Surface Support site](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface). Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. - -## Enabling Battery Limit in Surface UEFI (Surface Pro 4 and later) - -The Surface UEFI Battery Limit setting can be configured by booting into Surface UEFI (**Power + Vol Up** when turning on the device). Choose **boot configuration**, and then, under **Advanced Options**, toggle **Enable Battery Limit Mode** to **On**. - -![Screenshot of Advanced options](images/enable-bl.png) - -## Enabling Battery Limit in Surface UEFI (Surface Pro 3) - -The Surface UEFI Battery Limit setting can be configured by booting into Surface UEFI (**Power + Vol Up** when turning on the device). Choose **Kiosk Mode**, select **Battery Limit**, and then choose **Enabled**. - -![Screenshot of Advanced options](images/enable-bl-sp3.png) - -![Screenshot of Advanced options](images/enable-bl-sp3-2.png) - -## Enabling Battery Limit using Surface Enterprise Management Mode (SEMM) or Surface Pro 3 firmware PowerShell scripts - -The Surface UEFI battery limit is also available for configuration via the following methods: - -- Surface Pro 4 and later - - [Microsoft Surface UEFI Configurator](https://docs.microsoft.com/surface/surface-enterprise-management-mode) - - Surface UEFI Manager Powershell scripts (SEMM_Powershell.zip) in the [Surface Tools for IT downloads](https://www.microsoft.com/download/details.aspx?id=46703) -- Surface Pro 3 - - [SP3_Firmware_Powershell_Scripts.zip](https://www.microsoft.com/download/details.aspx?id=46703) - -### Using Microsoft Surface UEFI Configurator - -To configure Battery Limit mode, set the **Kiosk Overrides** setting on the **Advanced Settings** configuration page in SEMM (Surface Pro 4 and later). - -![Screenshot of advanced settings](images/semm-bl.png) - -### Using Surface UEFI Manager PowerShell scripts - -The battery limit feature is controlled via the following setting: - -`407 = Battery Profile` - -**Description**: Active management scheme for battery usage pattern - -**Default**: `0` - -Set this to `1` to enable Battery Limit. - -### Using Surface Pro 3 firmware tools - -The battery limit feature is controlled via the following setting: - -**Name**: BatteryLimitEnable - -**Description**: BatteryLimit - -**Current Value**: `0` - -**Default Value**: `0` - -**Proposed Value**: `0` - -Set this to `1` to enable Battery Limit. - ->[!NOTE] ->To configure this setting, you must use [SP3_Firmware_Powershell_Scripts.zip](https://www.microsoft.com/download/details.aspx?id=46703). - diff --git a/devices/surface/breadcrumb/toc.yml b/devices/surface/breadcrumb/toc.yml deleted file mode 100644 index 1ab1f047c2..0000000000 --- a/devices/surface/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Surface - tocHref: /surface - topicHref: /surface/index \ No newline at end of file diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md deleted file mode 100644 index 35be5e736d..0000000000 --- a/devices/surface/change-history-for-surface.md +++ /dev/null @@ -1,189 +0,0 @@ ---- -title: Change history for Surface documentation (Windows 10) -ms.reviewer: -manager: laurawi -description: This topic lists new and updated topics in the Surface documentation library. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Change history for Surface documentation - -This topic lists new and updated topics in the Surface documentation library. - -## January 2020 -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -| [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)| Updated with the latest information and links to related articles.| - - -## October 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -| [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md)| New document explaining how to configure a DFCI environment in Microsoft Intune and manage firmware settings for targeted Surface devices.| -| [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)| New document highlighting key considerations for deploying, managing, and servicing Surface Pro X.| -|Multiple topics| Updated with information on Surface Pro 7, Surface Pro X, and Surface Laptop 3.| - -## September 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -| [Surface Dock Firmware Update](surface-dock-firmware-update.md)| New document for Microsoft Surface Dock Firmware Update, newly redesigned to update Surface Dock firmware while running in the background on your Surface device.| - -## August 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -| [Optimizing wireless connectivity for Surface devices](surface-wireless-connect.md) | New document highlights key wireless connectivity considerations for Surface devices in mobile scenarios. | -| [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Updated to reflect minor changes in the file naming convention for Surface MSI files. | - - -## July 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -| [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) | Renamed to reflect focus on deployment guidance for IT professionals. Covers minor changes in Version 2.41.139.0. | - - - -## June 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -|[Fix common Surface problems using the Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-for-business-intro.md) | New introductory page for the Surface Diagnostic Toolkit for Business. | -| [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md) |Updated with summary of recommendations for managing power settings and optimizing battery life. | - - -## March 2019 - -| **New or changed topic** | **Description** | -| ------------------------ | --------------- | -| [Surface System SKU reference](surface-system-sku-reference.md) | New | - - -## February 2019 - -New or changed topic | Description ---- | --- -[Surface Asset Tag](assettag.md) | New - - -## January 2019 - -New or changed topic | Description ---- | --- -[Surface Brightness Control](microsoft-surface-brightness-control.md) | New -[Maintain optimal power settings on Surface devices](maintain-optimal-power-settings-on-Surface-devices.md) | New -|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added Surface Studio 2 | - - -## November 2018 - -New or changed topic | Description ---- | --- -|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added Surface Pro 6 | -[Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) | New -[Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) | New -[Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) | New - -## October 2018 - -New or changed topic | Description ---- | --- -[Battery Limit setting](battery-limit.md) | New -|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added Surface GO | - -## May 2018 - -|New or changed topic | Description | -| --- | --- | -|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.58.0 information | -|[Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)](surface-device-compatibility-with-windows-10-ltsc.md) | Removed note box around content | - -## February 2018 - -|New or changed topic | Description | -| --- | --- | -|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.46.0 information | - -## January 2018 - -|New or changed topic | Description | -| --- | --- | -|[Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) | New article | -|[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.45.0 information | -|[Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)](surface-device-compatibility-with-windows-10-ltsc.md) | Updated Current Branch (CB) or Current Branch for Business (CBB) servicing options with Semi-Annual Channel (SAC) information | -|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | Added Surface Book 2, Surface Laptop, Surface Pro, Surface Pro with LTE Advanced, and Surface Pro information | - -## December 2017 - -|New or changed topic | Description | -| --- | --- | -|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added Surface Book 2, Surface Laptop, Surface Pro, and Surface Pro with LTE Advanced information | - -## October 2017 - -New or changed topics | Description ---- | --- -Microsoft Surface Diagnostic Toolkit | Topic removed. The Microsoft Surface Diagnostic Toolkit is no longer available for download. - -## September 2017 - -New or changed topic | Description ---- | --- -[Top support solutions for Surface devices](support-solutions-surface.md) | New - -## June 2017 - -|New or changed topic | Description | -| --- | --- | -|[Surface Data Eraser](microsoft-surface-data-eraser.md) | Update compatible devices, added version 3.2.36 information | -|[Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md) | Added version 2.0.8.0 information | - - -## April 2017 - -|New or changed topic | Description | -| --- | --- | -|[Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md) | New (supersedes [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md))| - - -## January 2017 - -|New or changed topic | Description | -| --- | --- | -|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | New | - -## December 2016 - -|New or changed topic | Description | -| --- | --- | -|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added driver info for Surface Studio; updated info for Surface Book and Surface Pro 4 (Windows 10 .zip cumulative update), Surface Pro 3 (Windows8.1-KB2969817-x64.msu), and Surface 3 (UEFI Asset Tag management tool)| - -## November 2016 - -|New or changed topic | Description | -| --- | --- | -|[Surface Enterprise Management Mode](surface-enterprise-management-mode.md) | Added procedure for viewing certificate thumbprint. | -|[Use Microsoft Endpoint Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) | New | - - - -## October 2016 - -| New or changed topic | Description | -| --- | --- | -| [Considerations for Surface and Microsoft Endpoint Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) | New | -| [Long-term servicing branch for Surface devices](ltsb-for-surface.md) | New | - - - - -  diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md deleted file mode 100644 index f68989b045..0000000000 --- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Considerations for Surface and Microsoft Endpoint Configuration Manager -description: The management and deployment of Surface devices with Configuration Manager is fundamentally the same as any other PC; this article describes scenarios that may require additional considerations. -keywords: manage, deployment, updates, driver, firmware -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro -ms.reviewer: -manager: laurawi ---- - -# Considerations for Surface and Microsoft Endpoint Configuration Manager - -Fundamentally, management and deployment of Surface devices with Microsoft Endpoint Configuration Manager is the same as the management and deployment of any other PC. Like any other PC, a deployment to Surface devices includes importing drivers, importing a Windows image, preparing a deployment task sequence, and then deploying the task sequence to a collection. After deployment, Surface devices are like any other Windows client; to publish apps, settings, and policies, you use the same process as you would use for any other device. - -You can find more information about how to use Configuration Manager to deploy and manage devices in the [Documentation for Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm/index). - -Although the deployment and management of Surface devices is fundamentally the same as any other PC, there are some scenarios that may require additional considerations or steps. This article provides descriptions and guidance for these scenarios. The solutions documented in this article may apply to other devices and manufacturers as well. - -> [!NOTE] -> For management of Surface devices it is recommended that you use the Current Branch of Microsoft Endpoint Configuration Manager. - -## Updating Surface device drivers and firmware - -For devices that recieve updates through Windows Update, drivers for Surface components (and even firmware updates) are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS) or Configuration Manager, see [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates/). - -> [!NOTE] -> Surface device drivers and firmware are signed with SHA-256, which is not natively supported by Windows Server 2008 R2. A workaround is available for Configuration Manager environments running on Windows Server 2008 R2. For more information, see [Can't import drivers into Microsoft Endpoint Configuration Manager (KB3025419)](https://support.microsoft.com/kb/3025419). - -## Surface Ethernet adapters and Configuration Manager deployment - -The default mechanism that Configuration Manager uses to identify devices during deployment is the Media Access Control (MAC) address. Because the MAC address is associated with the Ethernet controller, an Ethernet adapter shared among multiple devices will cause Configuration Manager to identify each of the devices as only a single device. This can cause a Configuration Manager deployment of Windows to not be applied to intended devices. - -To ensure that Surface devices using the same Ethernet adapter are identified as unique devices during deployment, you can instruct Configuration Manager to identify devices using another method. This other method could be the MAC address of the wireless network adapter or the System Universal Unique Identifier (System UUID). You can specify that Configuration Manager use other identification methods with the following options: - -* Add an exclusion for the MAC addresses of Surface Ethernet adapters, which forces Configuration Manager to overlook the MAC address in preference of the System UUID, as documented in the [Reusing the same NIC for multiple PXE initiated deployments in SMicrosoft Endpoint Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. - -* Prestage devices by System UUID as documented in the [Reusing the same NIC for multiple PXE initiated deployments in Microsoft Endpoint Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post. - -* Use a script to identify a newly deployed Surface device by the MAC address of its wireless adapter, as documented in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post. - -Another consideration for the Surface Ethernet adapter during deployments with Configuration Manager is the driver for the Ethernet controller. Beginning in Windows 10, version 1511, the driver for the Surface Ethernet adapter is included by default in Windows. For organizations that want to deploy the latest version of Windows 10 and use the latest version of WinPE, use of the Surface Ethernet adapter requires no additional actions. - -For versions of Windows prior to Windows 10, version 1511 (including Windows 10 RTM and Windows 8.1), you may still need to install the Surface Ethernet adapter driver and include the driver in your WinPE boot media. With its inclusion in Windows 10, the driver is no longer available for download from the Microsoft Download Center. To download the Surface Ethernet adapter driver, download it from the Microsoft Update Catalog as documented in the [Surface Ethernet Drivers](https://blogs.technet.microsoft.com/askcore/2016/08/18/surface-ethernet-drivers/) blog post from the Ask The Core Team blog. - -## Deploy Surface app with Configuration Manager - -With the release of Microsoft Store for Business, Surface app is no longer available as a driver and firmware download. Organizations that want to deploy Surface app to managed Surface devices or during deployment with the use of Configuration Manager, must acquire Surface app through Microsoft Store for Business and then deploy Surface app with PowerShell. You can find the PowerShell commands for deployment of Surface app, instructions to download Surface app, and prerequisite frameworks from Microsoft Store for Business in the [Deploy Surface app with Microsoft Store for Business](https://technet.microsoft.com/itpro/surface/deploy-surface-app-with-windows-store-for-business) article in the TechNet Library. - -## Use prestaged media with Surface clients - -If your organization uses prestaged media to pre-load deployment resources on to machines prior to deployment with Configuration Manager, the nature of Surface devices as UEFI devices may require you to take additional steps. Specifically, a native UEFI environment requires that you create multiple partitions on the boot disk of the system. If you are following along with the [documentation for prestaged media](https://technet.microsoft.com/library/79465d90-4831-4872-96c2-2062d80f5583?f=255&MSPPError=-2147217396#BKMK_CreatePrestagedMedia), the instructions provide for only single partition boot disks and therefore will fail when applied to Surface devices. - -Instructions for applying prestaged media to UEFI devices, such as Surface devices, can be found in the [How to apply Task Sequence Prestaged Media on multi-partitioned disks for BIOS or UEFI PCs in Microsoft Endpoint Configuration Manager](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2014/04/02/how-to-apply-task-sequence-prestaged-media-on-multi-partitioned-disks-for-bios-or-uefi-pcs-in-system-center-configuration-manager/) blog post. - -## Licensing conflicts with OEM Activation 3.0 - -Surface devices come preinstalled with a licensed copy of Windows. For example, Surface Pro 4 is preinstalled with Windows 10 Professional. The license key for this preinstalled copy of Windows is embedded in the firmware of the device with OEM Activation 3.0 (OA 3.0). When you run Windows installation media on a device with an OA 3.0 key, Windows setup automatically reads the license key and uses it to install and activate Windows. In most situations, this simplifies the reinstallation of Windows, because the user does not have to find or enter a license key. - -When you reimage a device by using Windows Enterprise, this embedded license key does not cause a conflict. This is because the installation media for Windows Enterprise is configured to install only an Enterprise edition of Windows and therefore is incompatible with the license key embedded in the system firmware. If a product key is not specified (such as when you intend to activate with Key Management Services [KMS] or Active Directory Based Activation), a Generic Volume License Key (GVLK) is used until Windows is activated by one of those technologies. - -However, issues may arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. For more information, see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/library/hh824952.aspx). If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center. - -## Apply an asset tag during deployment - -Surface Studio, Surface Book, Surface Pro 4, Surface Pro 3, and Surface 3 devices all support the application of an asset tag in UEFI. This asset tag can be used to identify the device from UEFI even if the operating system fails, and it can also be queried from within the operating system. To read more about the Surface Asset Tag function, see the [Asset Tag Tool for Surface Pro 3](https://blogs.technet.microsoft.com/askcore/2014/10/20/asset-tag-tool-for-surface-pro-3/) blog post. - -To apply an asset tag using the [Surface Asset Tag CLI Utility](https://www.microsoft.com/download/details.aspx?id=44076) during a Configuration Manager deployment task sequence, use the script and instructions found in the [Set Surface Asset Tag During a Configuration Manager Task Sequence](https://blogs.technet.microsoft.com/jchalfant/set-surface-pro-3-asset-tag-during-a-configuration-manager-task-sequence/) blog post. - -## Configure push-button reset - -When you deploy Windows to a Surface device, the push-button reset functionality of Windows is configured by default to revert the system back to a state where the environment is not yet configured. When the reset function is used, the system discards any installed applications and settings. Although in some situations it can be beneficial to restore the system to a state without applications and settings, in a professional environment this effectively renders the system unusable to the end user. - -Push-button reset can be configured, however, to restore the system configuration to a state where it is ready for use by the end user. Follow the process outlined in [Deploy push-button reset features](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/deploy-push-button-reset-features) to customize the push-button reset experience for your devices. diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md deleted file mode 100644 index 70d53dae71..0000000000 --- a/devices/surface/customize-the-oobe-for-surface-deployments.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Customize the OOBE for Surface deployments (Surface) -description: This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization. -ms.assetid: F6910315-9FA9-4297-8FA8-2C284A4B1D87 -ms.reviewer: -manager: laurawi -keywords: deploy, customize, automate, network, Pen, pair, boot -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.audience: itpro ---- - -# Customize the OOBE for Surface deployments - -This article describes customizing the Surface out-of-box experience for end users in your organization. - -It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE. - ->[!NOTE] ->OOBE is also often used to describe the phase, or configuration pass, of Windows setup during which the user experience is displayed. For more information about the OOBE phase of setup, see [How Configuration Passes Work](https://msdn.microsoft.com/library/windows/hardware/dn898581.aspx). - -In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome. - -> [!NOTE] -> This article does not apply to Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) - -This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image). - ->[!NOTE] ->Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or Microsoft Endpoint Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
->- [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit) ->- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager) - -  - -## Scenario 1: Wireless networking in OOBE with MDT 2013 - - -When a wireless network adapter is present during OOBE, the **Join a wireless network** page is displayed, which prompts a user to connect to a wireless network. This page is not automatically hidden by deployment technologies, including MDT 2013, and therefore will be displayed even when a deployment is configured for complete automation. - -To ensure that an automated deployment is not stopped by this page, the page must be hidden by configuring an additional setting in the answer file, **HideWirelessSetupInOOBE**. You can find additional information about the **HideWirelessSetupInOOBE** setting in [Unattended Windows Setup Reference](https://technet.microsoft.com/library/ff716213.aspx). - -## Scenario 2: Surface Pen pairing in OOBE - - -When you first take a Surface Pro 3, Surface Pro 4, Surface Book, or Surface Studio out of the package and start it up, the first-run experience of the factory image includes a prompt that asks you to pair the included Surface Pen to the device. This prompt is only provided by the factory image that ships with the device and is not included in other images used for deployment, such as the Windows Enterprise installation media downloaded from the Volume Licensing Service Center. Because pairing the Bluetooth Surface Pen outside of this experience requires that you enter the Control Panel or PC Settings and manually pair a Bluetooth device, you may want to have users or a technician use this prompt to perform the pairing operation. - -To provide the factory Surface Pen pairing experience in OOBE, you must copy four files from the factory Surface image into the reference image. You can copy these files into the reference environment before you capture the reference image, or you can add them later by using Deployment Image Servicing and Management (DISM) to mount the image. The four required files are: - -- %windir%\\system32\\oobe\\info\\default\\1033\\oobe.xml -- %windir%\\system32\\oobe\\info\\default\\1033\\PenPairing\_en-US.png -- %windir%\\system32\\oobe\\info\\default\\1033\\PenError\_en-US.png -- %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png - ->[!NOTE] ->You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 7 to deploy to Surface Pro 7, and the files from Surface Book 2 to deploy Surface Book 2, but you should not use the files from a Surface Pro 7 to deploy Surface Book or Surface Pro 6. - -  - -The step-by-step process for adding these required files to an image is described in [Deploying Surface Pro 3 Pen and OneNote Tips](https://blogs.technet.microsoft.com/askcore/2014/07/15/deploying-surface-pro-3-pen-and-onenote-tips/). This blog post also includes tips to ensure that the necessary updates for the Surface Pen Quick Note-Taking Experience are installed, which allows users to send notes to OneNote with a single click. - -  - -  - - - - - diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md deleted file mode 100644 index 121be61007..0000000000 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ /dev/null @@ -1,185 +0,0 @@ ---- -title: Deploy Surface app with Microsoft Store for Business or Microsoft Store for Education (Surface) -description: Find out how to add and download Surface app with Microsoft Store for Business or Microsoft Store for Education, as well as install Surface app with PowerShell and MDT. -keywords: surface app, app, deployment, customize -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, store -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro -ms.reviewer: -manager: laurawi ---- - -# Deploy Surface app with Microsoft Store for Business and Education - -**Applies to** - -- Surface Pro 7 -- Surface Laptop 3 -- Surface Pro 6 -- Surface Laptop 2 -- Surface Go -- Surface Go with LTE -- Surface Book 2 -- Surface Pro with LTE Advanced (Model 1807) -- Surface Pro (Model 1796) -- Surface Laptop -- Surface Studio -- Surface Studio 2 -- Surface Book -- Surface Pro 4 -- Surface 3 LTE -- Surface 3 -- Surface Pro 3 - - -The Surface app is a lightweight Microsoft Store app that provides control of many Surface-specific settings and options, including: - -* Enable or disable the Windows button on the Surface device - -* Adjust the sensitivity of a Surface Pen - -* Customize Surface Pen button actions - -* Enable or disable Surface audio enhancements - -* Quick access to support documentation and information for your device - -Customers using Windows Update will ordinarily receive Surface app as part of automatic updates. But if your organization is preparing images for deployment to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Microsoft Store or your Microsoft Store for Business. - -> [!NOTE] -> This article does not apply to Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) - -## Surface app overview - -The Surface app is available as a free download from the [Microsoft Store](https://www.microsoft.com/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Microsoft Store, but if your organization uses Microsoft Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Microsoft Store for Business, see [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/) in the Windows TechCenter. - -## Add Surface app to a Microsoft Store for Business account - -Before users can install or deploy an app from a company’s Microsoft Store for Business account, the desired app(s) must first be made available and licensed to the users of a business. - -1. If you have not already done so, create a [Microsoft Store for Business account](https://www.microsoft.com/business-store). - -2. Log on to the portal. - -3. Enable offline licensing: click **Manage->Store settings**, and then select the **Show offline licensed apps to people shopping in the store** checkbox, as shown in Figure 1. For more information about Microsoft Store for Business app licensing models, see [Apps in Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/).

- ![Show offline licenses apps checkbox](images/deploysurfapp-figure1-enablingapps.png "Show offline licenses apps checkbox")
- *Figure 1. Enable apps for offline use* - -4. Add Surface app to your Microsoft Store for Business account by following this procedure: - * Click the **Shop** menu. - * In the search box, type **Surface app**, and then click the search icon. - * After the Surface app is presented in the search results, click the app’s icon. - * You are presented with a choice (select **Online** or **Offline**), as shown in Figure 2.

- - ![Select the Offline licensing mode and add the app to your inventory](images/deploysurfapp-fig2-selectingofflinelicense.png "Select the Offline licensing mode and add the app to your inventory") - - *Figure 2. Select the Offline licensing mode and add the app to your inventory* - - * Click **Offline** to select the Offline licensing mode. - * Click **Get the app** to add the app to your Microsoft Store for Business inventory. As shown in Figure 3, you’ll see a dialog box that prompts you to acknowledge that offline apps can be deployed using a management tool or downloaded from the company’s inventory page in their private store. - - ![Offline-licensed app acknowledgement window](images/deploysurfapp-fig3-acknowledge.png "Offline-licensed app acknowledgement window") - - *Figure 3. Offline-licensed app acknowledgement* - * Click **OK**. - -## Download Surface app from a Microsoft Store for Business account -After you add an app to the Microsoft Store for Business account in Offline mode, you can download and add the app as an AppxBundle to a deployment share. -1. Log on to the Microsoft Store for Business account at https://businessstore.microsoft.com. -2. Click **Manage->Apps & software**. A list of all of your company’s apps is displayed, including the Surface app you added in the [Add Surface app to a Microsoft Store for Business account](#add-surface-app-to-a-microsoft-store-for-business-account) section of this article. -3. Under **Actions**, click the ellipsis (**…**), and then click **Download for offline use** for the Surface app. -4. Select the desired **Platform** and **Architecture** options from the available selections for the selected app, as shown in Figure 4. - - ![Example of the AppxBundle package](images/deploysurfapp-fig4-downloadappxbundle.png "Example of the AppxBundle package") - - *Figure 4. Download the AppxBundle package for an app* -5. Click **Download**. The AppxBundle package will be downloaded. Make sure you note the path of the downloaded file because you’ll need that later in this article. -6. Click either the **Encoded license** or **Unencoded license** option. Use the Encoded license option with management tools like Microsoft Endpoint Configuration Manager or when you use Windows Configuration Designer to create a provisioning package. Select the Unencoded license option when you use Deployment Image Servicing and Management (DISM) or deployment solutions based on imaging, including the Microsoft Deployment Toolkit (MDT). -7. Click **Generate** to generate and download the license for the app. Make sure you note the path of the license file because you’ll need that later in this article. - ->[!NOTE] ->When you download an app for offline use, such as the Surface app, you may notice a section at the bottom of the page labeled **Required frameworks**. Your target computers must have the frameworks installed for the app to run, so you may need to repeat the download process for each of the required frameworks for your architecture (either x86 or x64) and also include them as part of your Windows deployment discussed later in this article. - -Figure 5 shows the required frameworks for the Surface app. - -![Required frameworks for the Surface app](images/deploysurfapp-fig5-requiredframework.png "Required frameworks for the Surface app") - -*Figure 5. Required frameworks for the Surface app* - ->[!NOTE] ->The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Microsoft Store for Business. Always use the Surface app and recommended framework versions as provided by Microsoft Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes. - -To download the required frameworks for the Surface app, follow these steps: -1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. -2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder. - ->[!NOTE] ->Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks. - -## Install Surface app on your computer with PowerShell -The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards. -1. Using the procedure described in the [How to download Surface app from a Microsoft Store for Business account](#download-surface-app-from-a-microsoft-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. -2. Begin an elevated PowerShell session. - - >[!NOTE] - >If you don’t run PowerShell as an Administrator, the session won’t have the required permissions to install the app. - -3. In the elevated PowerShell session, copy and paste the following command: - ``` - Add-AppxProvisionedPackage –Online –PackagePath \ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath \ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml - ``` - - Where `` is the folder where you downloaded the AppxBundle and license file from the Microsoft Store for Business account. - - For example, if you downloaded the files to c:\Temp, the command you run is: - ```` - Add-AppxProvisionedPackage –Online –PackagePath c:\Temp\ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath c:\Temp\ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml - ``` - -4. The Surface app will now be available on your current Windows computer. - -Before the Surface app is functional on the computer where it has been provisioned, you must also provision the frameworks described earlier in this article. To provision these frameworks, use the following procedure in the elevated PowerShell session you used to provision the Surface app. - -5. In the elevated PowerShell session, copy and paste the following command: - ``` - Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath \Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx - ``` -6. In the elevated PowerShell session, copy and paste the following command: - ``` - Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath \Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx - ``` - -## Install Surface app with MDT -The following procedure uses MDT to automate installation of the Surface app at the time of deployment. The application is provisioned automatically by MDT during deployment and thus you can use this process with existing images. This is the recommended process to deploy the Surface app as part of a Windows deployment to Surface devices because it does not reduce the cross platform compatibility of the Windows image. -1. Using the procedure described [earlier in this article](#download-surface-app-from-a-microsoft-store-for-business-account), download the Surface app AppxBundle and license file. -2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. -3. On the **Command Details** page of the New Application Wizard, specify the default **Working Directory** and for the **Command** specify the file name of the AppxBundle, as follows: - - * Command: - ``` - Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle - ``` - * Working Directory: %DEPLOYROOT%\Applications\SurfaceApp - -For the Surface app to function on the target computer, it will also require the frameworks described earlier in this article. Use the following procedure to import the frameworks required for the Surface app into MDT and to configure them as dependencies. -1. Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder. -2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**. -3. On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory. - -To configure the frameworks as dependencies of the Surface app, use this process: -1. Open the properties of the Surface app in the MDT Deployment Workbench. -2. Click the **Dependencies** tab, and then click **Add**. -3. Select the check box for each framework using the name you provided in the New Application Wizard. - -After import, the Surface app will be available for selection in the **Applications** step of the Windows Deployment Wizard. You can also install the application automatically by specifying the application in the deployment task sequence by following this process: -1. Open your deployment task sequence in the MDT Deployment Workbench. -2. Add a new **Install Application** task in the **State Restore** section of deployment. -3. Select **Install a single application** and specify the **Surface App** as the **Application to be installed**. - -For more information about including apps into your Windows deployments, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit). diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md deleted file mode 100644 index 47f14939db..0000000000 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit (Surface) -description: Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit. -keywords: windows 10 surface, automate, customize, mdt -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro -ms.reviewer: -manager: laurawi -ms.date: 04/24/2020 ---- - -# Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit - -**Applies to** - -- Surface Studio and later -- Surface Pro 4 and later -- Surface Book and later -- Surface Laptop and later -- Surface Go -- Surface 3 -- Windows 10 - -> [!NOTE] -> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md). - -For the latest information about using MDT, refer to [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt). - diff --git a/devices/surface/deploy.md b/devices/surface/deploy.md deleted file mode 100644 index a7220315da..0000000000 --- a/devices/surface/deploy.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Deploy Surface devices (Surface) -description: Get deployment guidance for your Surface devices including information about MDT, OOBE customization, Ethernet adaptors, and Surface Deployment Accelerator. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.reviewer: -manager: laurawi -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Deploy Surface devices - -Learn about about deploying ARM- and Intel-based Surface devices. - -## Deploying ARM-based devices - -| Topic | Description | -| --- | --- | -| [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) | Get an overview of key considerations for deploying, managing, and servicing Surface Pro X running the Microsoft SQ1 ARM processor. | -| [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) | Learn about Autopilot, the recommended method for deploying Surface Pro X. | -| [Windows 10 ARM-based PC app compatibility](surface-pro-arm-app-performance.md) | Review app compatibility guidance for Surface Pro X. | - - -## Deploying Intel-based devices - -| Topic | Description | -| --- | --- | -| [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) | Find out how to remotely deploy and configure devices with Windows Autopilot. | -| [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md) | Find out about compatibility and limitations of Surface devices running Windows 10 Enterprise LTSC edition. | -| [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md) | Walk through the recommended process of how to deploy Windows 10 to your Surface devices with the Microsoft Deployment Toolkit.| -| [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)| Find out how to perform a Windows 10 upgrade deployment to your Surface devices. | -| [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)| Walk through the process of customizing the Surface out-of-box experience for end users in your organization.| -| [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)| Get guidance and answers to help you perform a network deployment to Surface devices.| -| [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)| See how Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices. | -[Battery Limit setting](battery-limit.md) | Learn how to use Battery Limit, a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. - -## Related topics - -[Surface IT Pro Blog](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/bg-p/SurfaceITPro) - diff --git a/devices/surface/documentation/surface-system-sku-reference.md b/devices/surface/documentation/surface-system-sku-reference.md deleted file mode 100644 index 0d49be965e..0000000000 --- a/devices/surface/documentation/surface-system-sku-reference.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Surface System SKU reference -description: This topic provides a reference of System SKU names that you can use to quickly determine the machine state of a specific device. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article ---- -# Surface System SKU Reference -This document provides a reference of System SKU names that you can use to quickly determine the machine state of a specific device using PowerShell, WMI, and related tools. - -System SKU is a variable (along with System Model and others) stored in System Management BIOS (SMBIOS) tables in the UEFI layer of Surface devices. Use the System SKU name whenever you need to differentiate between devices with the same System Model name, such as Surface Pro and Surface Pro with LTE Advanced. - -| **Device**| **System Model** | **System SKU**| -| --- | ---| --- | -| Surface 3 WiFI | Surface 3 | Surface_3 | -| Surface 3 LTE AT&T | Surface 3 | Surface_3_US1 | -| Surface 3 LTE Verizon | Surface 3 | Surface_3_US2 | -| Surface 3 LTE North America | Surface 3 | Surface_3_NAG | -| Surface 3 LTE Outside of North America and T-Mobile In Japan | Surface 3 | Surface_3_ROW | -| Surface Pro | Surface Pro | Surface_Pro_1796 | -| Surface Pro with LTE Advanced | Surface Pro | Surface_Pro_1807 | -| Surface Book 2 13inch | Surface Book 2 | Surface_Book_1832 | -| Surface Book 2 15inch | Surface Book 2 | Surface_Book_1793 | -| Surface Go Consumer | Surface Go | Surface_Go_1824_Consumer | -| Surface Go Commercial | Surface Go | Surface_Go_1824_Commercial | -| Surface Pro 6 Consumer | Surface Pro 6 | Surface_Pro_6_1796_Consumer | -| Surface Pro 6 Commercial | Surface Pro 6 | Surface_Pro_6_1796_Commercial | -| Surface Laptop 2 Consumer | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer | -| Surface Laptop 2 Commercial | Surface Laptop 2 | Surface_Laptop_2_1769_Commercial | - -## Using System SKU variables - -### PowerShell - - gwmi -namespace root\wmi -class MS_SystemInformation | select SystemSKU - -### System Information -You can also find the System SKU and System Model for a device in System Information. -- Click **Start** > **MSInfo32**. - -### WMI -You can use System SKU variables in a Task Sequence WMI Condition in the Microsoft Deployment Toolkit (MDT) or Microsoft Endpoint Configuration Manager. For example: - - - WMI Namespace – Root\WMI - - WQL Query – SELECT * FROM MS_SystemInformation WHERE SystemSKU = "Surface_Pro_1796" - - - - - - diff --git a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md deleted file mode 100644 index d51a90413e..0000000000 --- a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices (Surface) -description: Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device. -ms.assetid: A281EFA3-1552-467D-8A21-EB151E58856D -ms.reviewer: -manager: laurawi -keywords: network, wireless, device, deploy, authentication, protocol -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article ---- - -# Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices - - -Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device. - -If you use PEAP, EAP-FAST, or Cisco LEAP in your enterprise network, you probably already know that these three wireless authentication protocols are not supported by Surface devices out of the box. Some users may discover this when they attempt to connect to your wireless network; others may discover it when they are unable to gain access to resources inside the network, like file shares and internal sites. For more information, see [Extensible Authentication Protocol](https://technet.microsoft.com/network/bb643147). - -You can add support for each protocol by executing a small MSI package from a USB stick or from a file share. For organizations that want to enable EAP support on their Surface devices, the MSI package format supports deployment with many management and deployment tools, like the Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager. - -## Download PEAP, EAP-FAST, or Cisco LEAP installation files - - -You can download the MSI installation files for PEAP, EAP-FAST, or Cisco LEAP in a single zip archive file from the Microsoft Download Center. To download this file, go to the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center, click **Download**, and then select the **Cisco EAP-Supplicant Installer.zip** file. - -## Deploy PEAP, EAP-FAST, or Cisco LEAP with MDT - - -If you are already performing a Windows deployment to Surface devices in your organization, it is quick and easy to add the installation files for each protocol to your deployment share and configure automatic installation during deployment. You can even configure a task sequence that updates previously deployed Surface devices to provide support for these protocols using the same process. - -To enable support for PEAP, EAP-FAST, or Cisco LEAP on newly deployed Surface devices, follow these steps: - -1. Download and extract the installation files for each protocol to separate folders in an easily accessible location. - -2. Open the MDT Deployment Workbench and expand your deployment share to the **Applications** folder. - -3. Select **New Application** from the **Action** pane. - -4. Choose **Application with source files** to copy the MSI files into the Deployment Share. - -5. Select the folder you created in step 1 for the desired protocol. - -6. Name the folder in the deployment share where the installation files will be stored. - -7. Specify the command line to deploy the application: - - - For PEAP use **EAP-PEAP.msi /qn /norestart**. - - - For LEAP use **EAP-LEAP.msi /qn /norestart**. - - - For EAP-FAST use **EAP-FAST.msi /qn /norestart**. - -8. Use the default options to complete the New Application Wizard. - -9. Repeat steps 3 through 8 for each desired protocol. - -After you’ve performed these steps to import the three MSI packages as applications into MDT, they will be available for selection in the Applications page of the Windows Deployment Wizard. Although in some simple deployment scenarios it might be sufficient to have technicians select each package at the time of deployment, it is not recommended. This practice introduces the possibility that a technician could attempt to apply these packages to computers other than Surface devices, or that a Surface device could be deployed without EAP support due to human error. - -To hide these applications from the Install Applications page, select the **Hide this application in the Deployment Wizard** checkbox in the properties of each application. After the applications are hidden, they will not be displayed as optional applications during deployment. To deploy them in your Surface deployment task sequence, they must be explicitly defined for installation through a separate step in the task sequence. - -To specify the protocol(s) explicitly, follow these steps: - -1. Open your Surface deployment task sequence properties from the MDT Deployment Workbench. - -2. On the **Task Sequence** tab, select the **Install Applications** step under **State Restore**. This is typically found between the pre-application and post-application Windows Update steps. - -3. Use the **Add** button to create a new **Install Application** step from the **General** category. - -4. Select **Install a single application** in the step **Properties** tab. - -5. Select the desired EAP protocol from the list. - -6. Repeat steps 2 through 5 for each desired protocol. - -## Deploy PEAP, EAP-FAST, or Cisco LEAP with Configuration Manager - - -For organizations that manage Surface devices with Configuration Manager, it is even easier to deploy PEAP, EAP-FAST, or Cisco LEAP support to Surface devices. Simply import each MSI file as an application from the Software Library and configure a deployment to your Surface device collection. - -For more information on how to deploy applications with Configuration Manager see [How to Create Applications in Configuration Manager](https://technet.microsoft.com/library/gg682159.aspx) and [How to Deploy Applications in Configuration Manager](https://technet.microsoft.com/library/gg682082.aspx). - -  - -  - - - - - diff --git a/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md b/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md deleted file mode 100644 index 18011a1ca5..0000000000 --- a/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: How to enable the Surface Laptop keyboard during MDT deployment -description: When you use MDT to deploy Windows 10 to Surface laptops, you need to import keyboard drivers to use in the Windows PE environment. -keywords: windows 10 surface, automate, customize, mdt -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface -ms.sitesec: library -author: Teresa-Motiv -ms.author: v-tea -ms.topic: article -ms.reviewer: scottmca -ms.localizationpriority: medium -ms.audience: itpro -manager: jarrettr -appliesto: -- Surface Laptop (1st Gen) -- Surface Laptop 2 -- Surface Laptop 3 ---- - -# How to enable the Surface Laptop keyboard during MDT deployment - -This article addresses a deployment approach that uses Microsoft Deployment Toolkit (MDT). You can also apply this information to other deployment methodologies. On most types of Surface devices, the keyboard should work during Lite Touch Installation (LTI). However, Surface Laptop requires some additional drivers to enable the keyboard. For Surface Laptop (1st Gen) and Surface Laptop 2 devices, you must prepare the folder structure and selection profiles that allow you to specify keyboard drivers for use during the Windows Preinstallation Environment (Windows PE) phase of LTI. For more information about this folder structure, see [Deploy a Windows 10 image using MDT: Step 5: Prepare the drivers repository](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt?redirectedfrom=MSDN#step-5-prepare-the-drivers-repository). - -> [!NOTE] -> It is currently not supported to add Surface Laptop 2 and Surface Laptop 3 keyboard drivers in the same Windows PE boot instance due to a driver conflict; use separate instances instead. - -> [!IMPORTANT] -> If you are deploying a Windows 10 image to a Surface Laptop that has Windows 10 in S mode preinstalled, see KB [4032347, Problems when deploying Windows to Surface devices with preinstalled Windows 10 in S mode](https://support.microsoft.com/help/4032347/surface-preinstall-windows10-s-mode-issues). - -To add the keyboard drivers to the selection profile, follow these steps: - -1. Download the latest Surface Laptop MSI file from the appropriate locations: - - [Surface Laptop (1st Gen) Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=55489) - - [Surface Laptop 2 Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=57515) - - [Surface Laptop 3 with Intel Processor Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=100429) - -2. Extract the contents of the Surface Laptop MSI file to a folder that you can easily locate (for example, c:\surface_laptop_drivers). To extract the contents, open an elevated Command Prompt window and run the command from the following example: - - ```cmd - Msiexec.exe /a SurfaceLaptop_Win10_15063_1703008_1.msi targetdir=c:\surface_laptop_drivers /qn - ``` - -3. Open the Deployment Workbench and expand the **Deployment Shares** node and your deployment share, then navigate to the **WindowsPEX64** folder. - - ![Image that shows the location of the WindowsPEX64 folder in the Deployment Workbench](./images/surface-laptop-keyboard-1.png) - -4. Right-click the **WindowsPEX64** folder and select **Import Drivers**. -5. Follow the instructions in the Import Driver Wizard to import the driver folders into the WindowsPEX64 folder. - -> [!NOTE] -> Check the downloaded MSI package to determine the format and directory structure. The directory structure will start with either SurfacePlatformInstaller (older MSI files) or SurfaceUpdate (Newer MSI files) depending on when the MSI was released. - -To support Surface Laptop (1st Gen), import the following folders: - - - SurfacePlatformInstaller\Drivers\System\GPIO - - SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver - - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver - - SurfacePlatformInstaller\Drivers\System\PreciseTouch - -Or for newer MSI files beginning with "SurfaceUpdate", use: - -- SurfaceUpdate\SerialIOGPIO -- SurfaceUpdate\SurfaceHidMiniDriver -- SurfaceUpdate\SurfaceSerialHubDriver -- SurfaceUpdate\Itouch - -To support Surface Laptop 2, import the following folders: - - - SurfacePlatformInstaller\Drivers\System\GPIO - - SurfacePlatformInstaller\Drivers\System\SurfaceHIDMiniDriver - - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver - - SurfacePlatformInstaller\Drivers\System\I2C - - SurfacePlatformInstaller\Drivers\System\SPI - - SurfacePlatformInstaller\Drivers\System\UART - - SurfacePlatformInstaller\Drivers\System\PreciseTouch - -Or for newer MSI files beginning with "SurfaceUpdate", use: - -- SurfaceUpdate\SerialIOGPIO -- SurfaceUpdate\IclSerialIOI2C -- SurfaceUpdate\IclSerialIOSPI -- SurfaceUpdate\IclSerialIOUART -- SurfaceUpdate\SurfaceHidMini -- SurfaceUpdate\SurfaceSerialHub -- SurfaceUpdate\Itouch - - -To support Surface Laptop 3 with Intel Processor, import the following folders: - -- SurfaceUpdate\IclSerialIOGPIO -- SurfaceUpdate\IclSerialIOI2C -- SurfaceUpdate\IclSerialIOSPI -- SurfaceUpdate\IclSerialIOUART -- SurfaceUpdate\SurfaceHidMini -- SurfaceUpdate\SurfaceSerialHub -- SurfaceUpdate\SurfaceHotPlug -- SurfaceUpdate\Itouch - > [!NOTE] - > Check the downloaded MSI package to determine the format and directory structure. The directory structure will start with either SurfacePlatformInstaller (older MSI files) or SurfaceUpdate (Newer MSI files) depending on when the MSI was released. - - To support Surface Laptop (1st Gen), import the following folders: - - - SurfacePlatformInstaller\Drivers\System\GPIO - - SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver - - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver - - SurfacePlatformInstaller\Drivers\System\PreciseTouch - - Or for newer MSI files beginning with "SurfaceUpdate", use: - - - SurfaceUpdate\SerialIOGPIO - - SurfaceUpdate\SurfaceHidMiniDriver - - SurfaceUpdate\SurfaceSerialHubDriver - - SurfaceUpdate\Itouch - - To support Surface Laptop 2, import the following folders: - - - SurfacePlatformInstaller\Drivers\System\GPIO - - SurfacePlatformInstaller\Drivers\System\SurfaceHIDMiniDriver - - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver - - SurfacePlatformInstaller\Drivers\System\I2C - - SurfacePlatformInstaller\Drivers\System\SPI - - SurfacePlatformInstaller\Drivers\System\UART - - SurfacePlatformInstaller\Drivers\System\PreciseTouch - - Or for newer MSI files beginning with "SurfaceUpdate", use: - - - SurfaceUpdate\SerialIOGPIO - - SurfaceUpdate\IclSerialIOI2C - - SurfaceUpdate\IclSerialIOSPI - - SurfaceUpdate\IclSerialIOUART - - SurfaceUpdate\SurfaceHidMini - - SurfaceUpdate\SurfaceSerialHub - - SurfaceUpdate\Itouch - - To support Surface Laptop 3 with Intel Processor, import the following folders: - - - SurfaceUpdate\IclSerialIOGPIO - - SurfaceUpdate\IclSerialIOI2C - - SurfaceUpdate\IclSerialIOSPI - - SurfaceUpdate\IclSerialIOUART - - SurfaceUpdate\SurfaceHidMini - - SurfaceUpdate\SurfaceSerialHub - - SurfaceUpdate\SurfaceHotPlug - - SurfaceUpdate\Itouch - - > [!NOTE] - > For Surface Laptop 3 with Intel processor, the model is Surface Laptop 3. The remaining Surface Laptop drivers are located in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop 3 folder. - -6. Verify that the WindowsPEX64 folder now contains the imported drivers. The folder should resemble the following: - - ![Image that shows the newly imported drivers in the WindowsPEX64 folder of the Deployment Workbench](./images/surface-laptop-keyboard-2.png) - -7. Configure a selection profile that uses the WindowsPEX64 folder. The selection profile should resemble the following: - - ![Image that shows the WindowsPEX64 folder selected as part of a selection profile](./images/surface-laptop-keyboard-3.png) - -8. Configure the Windows PE properties of the MDT deployment share to use the new selection profile, as follows: - - - For **Platform**, select **x64**. - - For **Selection profile**, select the new profile. - - Select **Include all drivers from the selection profile**. - - ![Image that shows the Windows PE properties of the MDT Deployment Share](./images/surface-laptop-keyboard-4.png) - -9. Verify that you have configured the remaining Surface Laptop drivers by using either a selection profile or a **DriverGroup001** variable. - - For Surface Laptop (1st Gen), the model is **Surface Laptop**. The remaining Surface Laptop drivers should reside in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop folder as shown in the figure that follows this list. - - For Surface Laptop 2, the model is **Surface Laptop 2**. The remaining Surface Laptop drivers should reside in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop 2 folder. - - For Surface Laptop 3 with Intel processor, the model is Surface Laptop 3. The remaining Surface Laptop drivers are located in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop 3 folder. - - ![Image that shows the regular Surface Laptop (1st Gen) drivers in the Surface Laptop folder of the Deployment Workbench](./images/surface-laptop-keyboard-5.png) - -After configuring the MDT Deployment Share to use the new selection profile and related settings, continue the deployment process as described in [Deploy a Windows 10 image using MDT: Step 6: Create the deployment task sequence](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt#step-6-create-the-deployment-task-sequence). diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md deleted file mode 100644 index 0147596761..0000000000 --- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: Enroll and configure Surface devices with SEMM (Surface) -description: Learn how to create a Surface UEFI configuration package to control the settings of Surface UEFI, as well as enroll a Surface device in SEMM. -keywords: surface enterprise management -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro -ms.reviewer: -manager: laurawi ---- - -# Enroll and configure Surface devices with SEMM - -With Microsoft Surface Enterprise Management Mode (SEMM), you can securely configure the settings of Surface UEFI on a Surface device and manage those settings on Surface devices in your organization. When a Surface device is managed by SEMM, that device is considered to be *enrolled* (sometimes referred to as activated). This article shows you how to create a Surface UEFI configuration package that will not only control the settings of Surface UEFI, but will also enroll a Surface device in SEMM. - -For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). - -A streamlined method of managing firmware from the cloud on Surface Pro 7,Surface Pro X and Surface Laptop 3 is now available via public preview. For more information,refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). - -> [!NOTE] -> SEMM is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md). - -#### Download and install Microsoft Surface UEFI Configurator -The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. -Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu. - ->[!NOTE] ->Microsoft Surface UEFI Configurator is supported only on Windows 10. - -## Create a Surface UEFI configuration package - -The Surface UEFI configuration package performs both the role of applying a new configuration of Surface UEFI settings to a Surface device managed with SEMM and the role of enrolling Surface devices in SEMM. The creation of a configuration package requires you to have a signing certificate to be used with SEMM to secure the configuration of UEFI settings on each Surface device. For more information about the requirements for the SEMM certificate, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). - -To create a Surface UEFI configuration package, follow these steps: - -1. Open Microsoft Surface UEFI Configurator from the Start menu. -2. Click **Start**. -3. Click **Configuration Package**, as shown in Figure 1. - - ![Create a package for SEMM enrollment](images/surface-ent-mgmt-fig1-uefi-configurator.png "Create a package for SEMM enrollment") - - *Figure 1. Select Configuration Package to create a package for SEMM enrollment and configuration* - -4. Click **Certificate Protection** to add your exported certificate file with private key (.pfx), as shown in Figure 2. Browse to the location of your certificate file, select the file, and then click **OK**. - - ![Add the SEM certificate and Surface UEFI password to configuration package](images/surface-ent-mgmt-fig2-securepackage.png "Add the SEM certificate and Surface UEFI password to configuration package") - - *Figure 2. Add the SEMM certificate and Surface UEFI password to a Surface UEFI configuration package* - -5. When you are prompted to confirm the certificate password, enter and confirm the password for your certificate file, and then click **OK**. -6. Click **Password Protection** to add a password to Surface UEFI. This password will be required whenever you boot to UEFI. If this password is not entered, only the **PC information**, **About**, **Enterprise management**, and **Exit** pages will be displayed. This step is optional. -7. When you are prompted, enter and confirm your chosen password for Surface UEFI, and then click **OK**. If you want to clear an existing Surface UEFI password, leave the password field blank. -8. If you do not want the Surface UEFI package to apply to a particular device, on the **Choose which Surface type you want to target** page, click the slider beneath the corresponding Surface Book or Surface Pro 4 image so that it is in the **Off** position. (As shown in Figure 3.) - - ![Choose devices for package compatibility](images/surface-semm-enroll-fig3.png "Choose devices for package compatibility") - - *Figure 3. Choose the devices for package compatibility* - -9. Click **Next**. -10. If you want to deactivate a component on managed Surface devices, on the **Choose which components you want to activate or deactivate** page, click the slider next to any device or group of devices you want to deactivate so that the slider is in the **Off** position. (Shown in Figure 4.) The default configuration for each device is **On**. Click the **Reset** button if you want to return all sliders to the default position. - - ![Disable or enable Surface components](images/surface-ent-mgmt-fig3-enabledisable.png "Disable or enable Surface components") - - *Figure 4. Disable or enable individual Surface components* - -11. Click **Next**. -12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package. - - ![Control advanced Surface UEFI settings and Surface UEFI pages](images/surface-ent-mgmt-fig4-advancedsettings.png "Control advanced Surface UEFI settings and Surface UEFI pages") - - *Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM* - -13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**. -14. When the package is created and saved, the **Successful** page is displayed. - ->[!NOTE] ->Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. - -![Display of certificate thumbprint characters](images/surface-ent-mgmt-fig5-success.png "Display of certificate thumbprint characters") - -*Figure 6. The last two characters of the certificate thumbprint are displayed on the Successful page* - -Now that you have created your Surface UEFI configuration package, you can enroll or configure Surface devices. - ->[!NOTE] ->When a Surface UEFI configuration package is created, a log file is created on the desktop with details of the configuration package settings and options. - -## Enroll a Surface device in SEMM -When the Surface UEFI configuration package is executed, the SEMM certificate and Surface UEFI configuration files are staged in the firmware storage of the Surface device. When the Surface device reboots, Surface UEFI processes these files and begins the process of applying the Surface UEFI configuration or enrolling the Surface device in SEMM, as shown in Figure 7. - -![SEMM process for configuration of Surface UEFI or enrollment](images/surface-semm-enroll-fig7.png "SEMM process for configuration of Surface UEFI or enrollment") - -*Figure 7. The SEMM process for configuration of Surface UEFI or enrollment of a Surface device* - -Before you begin the process to enroll a Surface device in SEMM, ensure that you have the last two characters of the certificate thumbprint on hand. You will need these characters to confirm the device’s enrollment (see Figure 6). - -To enroll a Surface device in SEMM with a Surface UEFI configuration package, follow these steps: - -1. Run the Surface UEFI configuration package .msi file on the Surface device you want to enroll in SEMM. This will provision the Surface UEFI configuration file in the device’s firmware. -2. Select the **I accept the terms in the License Agreement** check box to accept the End User License Agreement (EULA), and then click **Install** to begin the installation process. -3. Click **Finish** to complete the Surface UEFI configuration package installation and restart the Surface device when you are prompted to do so. -4. Surface UEFI will load the configuration file and determine that SEMM is not enabled on the device. Surface UEFI will then begin the SEMM enrollment process, as follows: - * Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate. - * Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8. - - ![SEMM enrollment requires last two characters of certificate thumbprint](images/surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint") - - *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint* - - * Surface UEFI will store the SEMM certificate in firmware and apply the configuration settings that are specified in the Surface UEFI configuration file. - -5. The Surface device is now enrolled in SEMM and will boot to Windows. - -You can verify that a Surface device has been successfully enrolled in SEMM by looking for **Microsoft Surface Configuration Package** in **Programs and Features** (as shown in Figure 9), or in the events stored in the **Microsoft Surface UEFI Configurator** log, found under **Applications and Services Logs** in Event Viewer (as shown in Figure 10). - -![Verify enrollment of Surface device in SEMM in Programs and Features](images/surface-semm-enroll-fig9.png "Verify enrollment of Surface device in SEMM in Programs and Features") - -*Figure 9. Verify the enrollment of a Surface device in SEMM in Programs and Features* - -![Verify enrollment of Surface device in SEMM in Event Viewer](images/surface-semm-enroll-fig10.png "Verify enrollment of Surface device in SEMM in Event Viewer") - -*Figure 10. Verify the enrollment of a Surface device in SEMM in Event Viewer* - -You can also verify that the device is enrolled in SEMM in Surface UEFI – while the device is enrolled, Surface UEFI will contain the **Enterprise management** page (as shown in Figure 11). - -![Surface UEFI Enterprise management page](images/surface-semm-enroll-fig11.png "Surface UEFI Enterprise management page") - -*Figure 11. The Surface UEFI Enterprise management page* - - -## Configure Surface UEFI settings with SEMM - -After a device is enrolled in SEMM, you can run Surface UEFI configuration packages signed with the same SEMM certificate to apply new Surface UEFI settings. These settings are applied automatically the next time the device boots, without any interaction from the user. You can use application deployment solutions like Microsoft Endpoint Configuration Manager to deploy Surface UEFI configuration packages to Surface devices to change or manage the settings in Surface UEFI. - -For more information about how to deploy Windows Installer (.msi) files with Configuration Manager, see [Deploy and manage applications with Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt627959). - -If you have secured Surface UEFI with a password, users without the password who attempt to boot to Surface UEFI will only have the **PC information**, **About**, **Enterprise management**, and **Exit** pages displayed to them. - -If you have not secured Surface UEFI with a password or a user enters the password correctly, settings that are configured with SEMM will be dimmed (unavailable) and the text Some settings are managed by your organization will be displayed at the top of the page, as shown in Figure 12. - -![Settings managed by SEMM disabled in Surface UEFI](images/surface-semm-enroll-fig12.png "Settings managed by SEMM disabled in Surface UEFI") - -*Figure 12. Settings managed by SEMM will be disabled in Surface UEFI* diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md deleted file mode 100644 index c35dbe0630..0000000000 --- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Ethernet adapters and Surface deployment (Surface) -description: This article provides guidance and answers to help you perform a network deployment to Surface devices. -ms.assetid: 5273C59E-6039-4E50-96B3-426BB38A64C0 -ms.reviewer: -manager: laurawi -keywords: ethernet, deploy, removable, network, connectivity, boot, firmware, device, adapter, PXE boot, USB -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.audience: itpro ---- - -# Ethernet adapters and Surface deployment - - -This article provides guidance and answers to help you perform a network deployment to Surface devices including Surface Pro 3 and later. - -Network deployment to Surface devices can pose some unique challenges for system administrators. Due to the lack of a native wired Ethernet adapter, administrators must provide connectivity through a removable Ethernet adapter. - -## Select an Ethernet adapter for Surface devices - - -Before you can address the concerns of how you will boot to your deployment environment or how devices will be recognized by your deployment solution, you have to use a wired network adapter. - -The primary concern when selecting an Ethernet adapter is how that adapter will boot your Surface device from the network. If you are pre-staging clients with Windows Deployment Services (WDS) or if you are using Microsoft Endpoint Configuration Manager, you may also want to consider whether the removable Ethernet adapters will be dedicated to a specific Surface device or shared among multiple devices. See the [Manage MAC addresses with removable Ethernet adapters](#manage-mac-addresses) section of this article for more information on potential conflicts with shared adapters. - -Booting from the network (PXE boot) is only supported when you use an Ethernet adapter or docking station from Microsoft. To boot from the network, the chipset in the Ethernet adapter or dock must be detected and configured as a boot device in the firmware of the Surface device. Microsoft Ethernet adapters, such as the Surface Ethernet Adapter and the [Surface Dock](https://www.microsoft.com/surface/accessories/surface-dock) use a chipset that is compatible with the Surface firmware. - -The following Ethernet devices are supported for network boot with Surface devices: - -- Surface USB-C to Ethernet and USB 3.0 Adapter - -- Surface USB 3.0 to Gigabit Ethernet Adapter - -- Surface Dock - -- Surface 3 Docking Station - -- Surface Pro 3 Docking Station - -- Docking Station for Surface Pro and Surface Pro 2 - -Third-party Ethernet adapters are also supported for network deployment, although they do not support PXE boot. To use a third-party Ethernet adapter, you must load the drivers into the deployment boot image and you must launch that boot image from a separate storage device, such as a USB stick. - -## Boot Surface devices from the network - -To boot from the network or a connected USB stick, you must instruct the Surface device to boot from an alternate boot device. You can alter the boot order in the system firmware to prioritize USB boot devices, or you can instruct it to boot from an alternate boot device during the boot up process. - -To boot a Surface device from an alternative boot device, follow these steps: - -1. Ensure the Surface device is powered off. -2. Press and hold the **Volume Down** button. -3. Press and release the **Power** button. -4. After the system begins to boot from the USB stick or Ethernet adapter, release the **Volume Down** button. - ->[!NOTE] ->In addition to an Ethernet adapter, a keyboard must also be connected to the Surface device to enter the preinstallation environment and navigate the deployment wizard. - -  -For Windows 10, version 1511 and later – including the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10, version 1511 – the drivers for Microsoft Surface Ethernet Adapters are present by default. If you are using a deployment solution that uses Windows Preinstallation Environment (WinPE), like the Microsoft Deployment Toolkit, and booting from the network with PXE, ensure that your deployment solution is using the latest version of the Windows ADK. - -## Manage MAC addresses with removable Ethernet adapters - - -Another consideration for administrators performing Windows deployment over the network is how you will identify computers when you use the same Ethernet adapter to deploy to more than one computer. A common identifier used by deployment technologies is the Media Access Control (MAC) address that is associated with each Ethernet adapter. However, when you use the same Ethernet adapter to deploy to multiple computers, you cannot use a deployment technology that inspects MAC addresses because there is no way to differentiate the MAC address of the removable adapter when used on the different computers. - -The simplest solution to avoid MAC address conflicts is to provide a dedicated removable Ethernet adapter for each Surface device. This can make sense in many scenarios where the Ethernet adapter or the additional functionality of the docking station will be used regularly. However, not all scenarios call for the additional connectivity of a docking station or support for wired networks. - -Another potential solution to avoid conflict when adapters are shared is to use the [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741) to perform deployment to Surface devices. MDT does not use the MAC address to identify individual computers and thus is not subject to this limitation. However, MDT does use Windows Deployment Services to provide PXE boot functionality, and is subject to the limitations regarding pre-staged clients which is covered later in this section. - -When you use a shared adapter for deployment, the solution for affected deployment technologies is to use another means to identify unique systems. For Configuration Manager and WDS, both of which can be affected by this issue, the solution is to use the System Universal Unique Identifier (System UUID) that is embedded in the computer firmware by the computer manufacturer. For Surface devices, you can see this entry in the computer firmware under **Device Information**. - -To access the firmware of a Surface device, follow these steps: - -1. Ensure the Surface device is powered off. -2. Press and hold the **Volume Up** button. -3. Press and release the **Power** button. -4. After the device begins to boot, release the **Volume Up** button. - -When deploying with WDS, the MAC address is only used to identify a computer when the deployment server is configured to respond only to known, pre-staged clients. When pre-staging a client, an administrator creates a computer account in Active Directory and defines that computer by the MAC address or the System UUID. To avoid the identity conflicts caused by shared Ethernet adapters, you should use [System UUID to define pre-staged clients](https://technet.microsoft.com/library/cc742034). Alternatively, you can configure WDS to respond to unknown clients that do not require definition by either MAC address or System UUID by selecting the **Respond to all client computers (known and unknown)** option on the [**PXE Response** tab](https://technet.microsoft.com/library/cc732360) in **Windows Deployment Server Properties**. - -The potential for conflicts with shared Ethernet adapters is much higher with Configuration Manager. Where WDS only uses MAC addresses to define individual systems when configured to do so, Configuration Manager uses the MAC address to define individual systems whenever performing a deployment to new or unknown computers. This can result in improperly configured devices or even the inability to deploy more than one system with a shared Ethernet adapter. There are several potential solutions for this situation that are described in detail in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post on the Ask Premier Field Engineering (PFE) Platforms TechNet blog. - -  - -  - - - - - diff --git a/devices/surface/get-started.yml b/devices/surface/get-started.yml deleted file mode 100644 index edb22aac8c..0000000000 --- a/devices/surface/get-started.yml +++ /dev/null @@ -1,122 +0,0 @@ -### YamlMime:Landing - -title: Surface devices documentation # < 60 chars -summary: Harness the power of Surface, Windows, and Office connected together through the cloud. # < 160 chars - -metadata: - title: Surface devices documentation # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Get started with Microsoft Surface devices # Required; article description that is displayed in search results. < 160 chars. - ms.service: product-insights #Required; service per approved list. service slug assigned to your service by ACOM. - ms.topic: landing-page # Required - manager: laurawi - author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. - ms.author: greglin #Required; microsoft alias of author; optional team alias. - audience: itpro - ms.localizationpriority: High - -# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new - -landingContent: -# Cards and links should be based on top customer tasks or top subjects -# Start card title with a verb - # Card (optional) - - title: Surface devices - linkLists: - - linkListType: overview - links: - - text: Surface Pro 7 for Business - url: https://www.microsoft.com/surface/business/surface-pro-7 - - text: Surface Pro X for Business - url: https://www.microsoft.com/surface/business/surface-pro-x - - text: Surface Laptop 3 for Business - url: https://www.microsoft.com/surface/business/surface-laptop-3 - - text: Surface Book 2 for Business - url: https://www.microsoft.com/surface/business/surface-book-2 - - text: Surface Studio 2 for Business - url: https://www.microsoft.com/surface/business/surface-studio-2 - - text: Surface Go - url: https://www.microsoft.com/surface/business/surface-go - - linkListType: video - links: - - text: Microsoft Mechanics Surface videos - url: https://www.youtube.com/watch?v=Uk2kJ5FUZxY&list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ - - # Card (optional) - - title: Get started - linkLists: - - linkListType: get-started - links: - - text: Surface and Endpoint Configuration Manager considerations - url: considerations-for-surface-and-system-center-configuration-manager.md - - text: Wake On LAN for Surface devices - url: wake-on-lan-for-surface-devices.md - - # Card - - title: Deploy Surface devices - linkLists: - - linkListType: deploy - links: - - text: Manage and deploy Surface driver and firmware updates - url: manage-surface-driver-and-firmware-updates.md - - text: Autopilot and Surface devices - url: windows-autopilot-and-surface-devices.md - - text: Deploying, managing, and servicing Surface Pro X - url: surface-pro-arm-app-management.md - - # Card - - title: Manage Surface devices - linkLists: - - linkListType: how-to-guide - links: - - text: Optimize Wi-Fi connectivity for Surface devices - url: surface-wireless-connect.md - - text: Best practice power settings for Surface devices - url: maintain-optimal-power-settings-on-Surface-devices.md - - text: Manage battery limit with UEFI - url: battery-limit.md - - # Card - - title: Secure Surface devices - linkLists: - - linkListType: how-to-guide - links: - - text: Intune management of Surface UEFI settings - url: surface-manage-dfci-guide.md - - text: Surface Enterprise Management Mode (SEMM) - url: surface-enterprise-management-mode.md - - text: Surface Data Eraser tool - url: microsoft-surface-data-eraser.md - - # Card - - title: Discover Surface tools - linkLists: - - linkListType: how-to-guide - links: - - text: Surface Dock Firmware Update - url: surface-dock-firmware-update.md - - text: Surface Diagnostic Toolkit for Business - url: surface-diagnostic-toolkit-for-business-intro.md - - text: SEMM and UEFI - url: surface-enterprise-management-mode.md - - text: Surface Brightness Control - url: microsoft-surface-brightness-control.md - - text: Battery Limit setting - url: battery-limit.md - - # Card - - title: Support and community - linkLists: - - linkListType: learn - links: - - text: Top support solutions - url: support-solutions-surface.md - - text: Maximize your Surface battery life - url: https://support.microsoft.com/help/4483194/maximize-surface-battery-life - - text: Troubleshoot Surface Dock and docking stations - url: https://support.microsoft.com/help/4023468/surface-troubleshoot-surface-dock-and-docking-stations - - linkListType: reference - links: - - text: Surface IT Pro blog - url: https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/bg-p/SurfaceITPro - - text: Surface Devices Tech Community - url: https://techcommunity.microsoft.com/t5/Surface-Devices/ct-p/SurfaceDevices diff --git a/devices/surface/images/Surface-Devices-400x140.svg b/devices/surface/images/Surface-Devices-400x140.svg deleted file mode 100644 index 4414de0f16..0000000000 --- a/devices/surface/images/Surface-Devices-400x140.svg +++ /dev/null @@ -1,25 +0,0 @@ - - - - -Surface-Devices-400x140 - - - - - - - - - - - diff --git a/devices/surface/images/Surface-Hub-400x140.svg b/devices/surface/images/Surface-Hub-400x140.svg deleted file mode 100644 index f5a5c12a56..0000000000 --- a/devices/surface/images/Surface-Hub-400x140.svg +++ /dev/null @@ -1,51 +0,0 @@ - - - - -win_it-pro-6 - - - - - - - - - - - - - DevicesLaptopTablet-blue - - - - - - - - - - - - - - - - diff --git a/devices/surface/images/Surface-Workplace-400x140.svg b/devices/surface/images/Surface-Workplace-400x140.svg deleted file mode 100644 index 9bb3779192..0000000000 --- a/devices/surface/images/Surface-Workplace-400x140.svg +++ /dev/null @@ -1,33 +0,0 @@ - - - - -SharePoint_Doc_3_400x140 - - users_group - - - - - - - - - - - - - - diff --git a/devices/surface/images/assettag-fig1.png b/devices/surface/images/assettag-fig1.png deleted file mode 100644 index 5ccb36c85f..0000000000 Binary files a/devices/surface/images/assettag-fig1.png and /dev/null differ diff --git a/devices/surface/images/config-mgr-semm-fig1.png b/devices/surface/images/config-mgr-semm-fig1.png deleted file mode 100644 index 7ff888c2e2..0000000000 Binary files a/devices/surface/images/config-mgr-semm-fig1.png and /dev/null differ diff --git a/devices/surface/images/config-mgr-semm-fig2.png b/devices/surface/images/config-mgr-semm-fig2.png deleted file mode 100644 index 33836c09eb..0000000000 Binary files a/devices/surface/images/config-mgr-semm-fig2.png and /dev/null differ diff --git a/devices/surface/images/config-mgr-semm-fig3.png b/devices/surface/images/config-mgr-semm-fig3.png deleted file mode 100644 index e699359552..0000000000 Binary files a/devices/surface/images/config-mgr-semm-fig3.png and /dev/null differ diff --git a/devices/surface/images/data-eraser-3.png b/devices/surface/images/data-eraser-3.png deleted file mode 100644 index eed3836aa7..0000000000 Binary files a/devices/surface/images/data-eraser-3.png and /dev/null differ diff --git a/devices/surface/images/dataeraser-arch.png b/devices/surface/images/dataeraser-arch.png deleted file mode 100644 index 5010120cf1..0000000000 Binary files a/devices/surface/images/dataeraser-arch.png and /dev/null differ diff --git a/devices/surface/images/dataeraser-complete-process.png b/devices/surface/images/dataeraser-complete-process.png deleted file mode 100644 index c7d0ee1d09..0000000000 Binary files a/devices/surface/images/dataeraser-complete-process.png and /dev/null differ diff --git a/devices/surface/images/dataeraser-start-tool.png b/devices/surface/images/dataeraser-start-tool.png deleted file mode 100644 index a727d8a870..0000000000 Binary files a/devices/surface/images/dataeraser-start-tool.png and /dev/null differ diff --git a/devices/surface/images/dataeraser-usb-selection.png b/devices/surface/images/dataeraser-usb-selection.png deleted file mode 100644 index 6c5382c7b0..0000000000 Binary files a/devices/surface/images/dataeraser-usb-selection.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-fig2-selectingofflinelicense.png b/devices/surface/images/deploysurfapp-fig2-selectingofflinelicense.png deleted file mode 100644 index eb7a2ef787..0000000000 Binary files a/devices/surface/images/deploysurfapp-fig2-selectingofflinelicense.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-fig3-acknowledge.png b/devices/surface/images/deploysurfapp-fig3-acknowledge.png deleted file mode 100644 index dd59593baf..0000000000 Binary files a/devices/surface/images/deploysurfapp-fig3-acknowledge.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-fig4-downloadappxbundle.png b/devices/surface/images/deploysurfapp-fig4-downloadappxbundle.png deleted file mode 100644 index 59b96e327b..0000000000 Binary files a/devices/surface/images/deploysurfapp-fig4-downloadappxbundle.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-fig5-requiredframework.png b/devices/surface/images/deploysurfapp-fig5-requiredframework.png deleted file mode 100644 index 24d6e7edd8..0000000000 Binary files a/devices/surface/images/deploysurfapp-fig5-requiredframework.png and /dev/null differ diff --git a/devices/surface/images/deploysurfapp-figure1-enablingapps.png b/devices/surface/images/deploysurfapp-figure1-enablingapps.png deleted file mode 100644 index 78bfef9e8b..0000000000 Binary files a/devices/surface/images/deploysurfapp-figure1-enablingapps.png and /dev/null differ diff --git a/devices/surface/images/df1.png b/devices/surface/images/df1.png deleted file mode 100644 index 92aff587bc..0000000000 Binary files a/devices/surface/images/df1.png and /dev/null differ diff --git a/devices/surface/images/df2a.png b/devices/surface/images/df2a.png deleted file mode 100644 index 2a755ac374..0000000000 Binary files a/devices/surface/images/df2a.png and /dev/null differ diff --git a/devices/surface/images/df3.png b/devices/surface/images/df3.png deleted file mode 100644 index c5263ce83f..0000000000 Binary files a/devices/surface/images/df3.png and /dev/null differ diff --git a/devices/surface/images/df3b.png b/devices/surface/images/df3b.png deleted file mode 100644 index 60370c5541..0000000000 Binary files a/devices/surface/images/df3b.png and /dev/null differ diff --git a/devices/surface/images/dfciconfig.png b/devices/surface/images/dfciconfig.png deleted file mode 100644 index 2e8b0b4fee..0000000000 Binary files a/devices/surface/images/dfciconfig.png and /dev/null differ diff --git a/devices/surface/images/discovertools.png b/devices/surface/images/discovertools.png deleted file mode 100644 index 2568398824..0000000000 Binary files a/devices/surface/images/discovertools.png and /dev/null differ diff --git a/devices/surface/images/enable-bl-sp3-2.png b/devices/surface/images/enable-bl-sp3-2.png deleted file mode 100644 index f1940c403f..0000000000 Binary files a/devices/surface/images/enable-bl-sp3-2.png and /dev/null differ diff --git a/devices/surface/images/enable-bl-sp3.png b/devices/surface/images/enable-bl-sp3.png deleted file mode 100644 index 7fa99786f1..0000000000 Binary files a/devices/surface/images/enable-bl-sp3.png and /dev/null differ diff --git a/devices/surface/images/enable-bl.png b/devices/surface/images/enable-bl.png deleted file mode 100644 index a99cb994fb..0000000000 Binary files a/devices/surface/images/enable-bl.png and /dev/null differ diff --git a/devices/surface/images/fig1-downloads-msi.png b/devices/surface/images/fig1-downloads-msi.png deleted file mode 100644 index 4d8b1410ff..0000000000 Binary files a/devices/surface/images/fig1-downloads-msi.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-dock-fig1-updateprocess.png b/devices/surface/images/manage-surface-dock-fig1-updateprocess.png deleted file mode 100644 index e779fa33ef..0000000000 Binary files a/devices/surface/images/manage-surface-dock-fig1-updateprocess.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig10.png b/devices/surface/images/manage-surface-uefi-fig10.png deleted file mode 100644 index daccc0efbb..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig10.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig11.png b/devices/surface/images/manage-surface-uefi-fig11.png deleted file mode 100644 index 34d2dc5342..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig11.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig12.png b/devices/surface/images/manage-surface-uefi-fig12.png deleted file mode 100644 index b7a58d16c2..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig12.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig13.png b/devices/surface/images/manage-surface-uefi-fig13.png deleted file mode 100644 index ee4691bf9e..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig13.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig14.png b/devices/surface/images/manage-surface-uefi-fig14.png deleted file mode 100644 index 8224fb5bab..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig14.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig15.png b/devices/surface/images/manage-surface-uefi-fig15.png deleted file mode 100644 index 8973b83528..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig15.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig16.png b/devices/surface/images/manage-surface-uefi-fig16.png deleted file mode 100644 index cac0f7c1c1..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig16.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig17.png b/devices/surface/images/manage-surface-uefi-fig17.png deleted file mode 100644 index 8b66d3605f..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig17.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig18.png b/devices/surface/images/manage-surface-uefi-fig18.png deleted file mode 100644 index 8845608fbd..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig18.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig19.png b/devices/surface/images/manage-surface-uefi-fig19.png deleted file mode 100644 index 8845608fbd..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig19.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig2.png b/devices/surface/images/manage-surface-uefi-fig2.png deleted file mode 100644 index 6d8e4b41c8..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig2.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig3.png b/devices/surface/images/manage-surface-uefi-fig3.png deleted file mode 100644 index 4ae63c2a49..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig3.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig4.png b/devices/surface/images/manage-surface-uefi-fig4.png deleted file mode 100644 index 480b1d7f46..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig4.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig5-a.png b/devices/surface/images/manage-surface-uefi-fig5-a.png deleted file mode 100644 index 7605291e93..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig5-a.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig5.png b/devices/surface/images/manage-surface-uefi-fig5.png deleted file mode 100644 index 00bb44ea76..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig5.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig5a.png b/devices/surface/images/manage-surface-uefi-fig5a.png deleted file mode 100644 index 7baecb2fff..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig5a.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig6.png b/devices/surface/images/manage-surface-uefi-fig6.png deleted file mode 100644 index e424e84f4b..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig6.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig7.png b/devices/surface/images/manage-surface-uefi-fig7.png deleted file mode 100644 index b0a49134f3..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig7.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig7a.png b/devices/surface/images/manage-surface-uefi-fig7a.png deleted file mode 100644 index 62e6536ea8..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig7a.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig8.png b/devices/surface/images/manage-surface-uefi-fig8.png deleted file mode 100644 index 2269fe6c17..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig8.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-fig9.png b/devices/surface/images/manage-surface-uefi-fig9.png deleted file mode 100644 index 7d36f66808..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-fig9.png and /dev/null differ diff --git a/devices/surface/images/manage-surface-uefi-figure-1.png b/devices/surface/images/manage-surface-uefi-figure-1.png deleted file mode 100644 index cd5a789d70..0000000000 Binary files a/devices/surface/images/manage-surface-uefi-figure-1.png and /dev/null differ diff --git a/devices/surface/images/managefirmware.png b/devices/surface/images/managefirmware.png deleted file mode 100644 index 392bcc601c..0000000000 Binary files a/devices/surface/images/managefirmware.png and /dev/null differ diff --git a/devices/surface/images/managesettings.png b/devices/surface/images/managesettings.png deleted file mode 100644 index 0f0567f97c..0000000000 Binary files a/devices/surface/images/managesettings.png and /dev/null differ diff --git a/devices/surface/images/mdt.png b/devices/surface/images/mdt.png deleted file mode 100644 index e185c8c501..0000000000 Binary files a/devices/surface/images/mdt.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig1.png b/devices/surface/images/powerintrofig1.png deleted file mode 100644 index d33b9922fd..0000000000 Binary files a/devices/surface/images/powerintrofig1.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig1a.png b/devices/surface/images/powerintrofig1a.png deleted file mode 100644 index e704b940c9..0000000000 Binary files a/devices/surface/images/powerintrofig1a.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig2.png b/devices/surface/images/powerintrofig2.png deleted file mode 100644 index eea52a8f3d..0000000000 Binary files a/devices/surface/images/powerintrofig2.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig2a.png b/devices/surface/images/powerintrofig2a.png deleted file mode 100644 index e00fe81105..0000000000 Binary files a/devices/surface/images/powerintrofig2a.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig3.png b/devices/surface/images/powerintrofig3.png deleted file mode 100644 index 08e9cd36a3..0000000000 Binary files a/devices/surface/images/powerintrofig3.png and /dev/null differ diff --git a/devices/surface/images/powerintrofig4.png b/devices/surface/images/powerintrofig4.png deleted file mode 100644 index f983673f35..0000000000 Binary files a/devices/surface/images/powerintrofig4.png and /dev/null differ diff --git a/devices/surface/images/preparewindowsdeployment.png b/devices/surface/images/preparewindowsdeployment.png deleted file mode 100644 index d7c04abc9e..0000000000 Binary files a/devices/surface/images/preparewindowsdeployment.png and /dev/null differ diff --git a/devices/surface/images/regeditDock.png b/devices/surface/images/regeditDock.png deleted file mode 100644 index e074712665..0000000000 Binary files a/devices/surface/images/regeditDock.png and /dev/null differ diff --git a/devices/surface/images/sccm.png b/devices/surface/images/sccm.png deleted file mode 100644 index 754f2ef89f..0000000000 Binary files a/devices/surface/images/sccm.png and /dev/null differ diff --git a/devices/surface/images/sda-fig1-select-steps.png b/devices/surface/images/sda-fig1-select-steps.png deleted file mode 100644 index cb5c24c2e0..0000000000 Binary files a/devices/surface/images/sda-fig1-select-steps.png and /dev/null differ diff --git a/devices/surface/images/sda-fig2-specify-local.png b/devices/surface/images/sda-fig2-specify-local.png deleted file mode 100644 index a7eb4d5b33..0000000000 Binary files a/devices/surface/images/sda-fig2-specify-local.png and /dev/null differ diff --git a/devices/surface/images/sda-fig5-erase.png b/devices/surface/images/sda-fig5-erase.png deleted file mode 100644 index 8ac3e174a7..0000000000 Binary files a/devices/surface/images/sda-fig5-erase.png and /dev/null differ diff --git a/devices/surface/images/sda.png b/devices/surface/images/sda.png deleted file mode 100644 index b9433dcd4a..0000000000 Binary files a/devices/surface/images/sda.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig1.png b/devices/surface/images/sdasteps-fig1.png deleted file mode 100644 index 2f83597305..0000000000 Binary files a/devices/surface/images/sdasteps-fig1.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig10-rules.png b/devices/surface/images/sdasteps-fig10-rules.png deleted file mode 100644 index 581c6f1492..0000000000 Binary files a/devices/surface/images/sdasteps-fig10-rules.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig11-bootstrap.ini.png b/devices/surface/images/sdasteps-fig11-bootstrap.ini.png deleted file mode 100644 index 64a4bd9aad..0000000000 Binary files a/devices/surface/images/sdasteps-fig11-bootstrap.ini.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig12-updatemedia.png b/devices/surface/images/sdasteps-fig12-updatemedia.png deleted file mode 100644 index 01a677ba02..0000000000 Binary files a/devices/surface/images/sdasteps-fig12-updatemedia.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig13-taskseq.png b/devices/surface/images/sdasteps-fig13-taskseq.png deleted file mode 100644 index 1fe51f0b60..0000000000 Binary files a/devices/surface/images/sdasteps-fig13-taskseq.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig14-credentials.png b/devices/surface/images/sdasteps-fig14-credentials.png deleted file mode 100644 index d2944325f4..0000000000 Binary files a/devices/surface/images/sdasteps-fig14-credentials.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig15-deploy.png b/devices/surface/images/sdasteps-fig15-deploy.png deleted file mode 100644 index 14cc461225..0000000000 Binary files a/devices/surface/images/sdasteps-fig15-deploy.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig16-computername.png b/devices/surface/images/sdasteps-fig16-computername.png deleted file mode 100644 index 1960c5b138..0000000000 Binary files a/devices/surface/images/sdasteps-fig16-computername.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig17-installprogresswindow.png b/devices/surface/images/sdasteps-fig17-installprogresswindow.png deleted file mode 100644 index ab2c456857..0000000000 Binary files a/devices/surface/images/sdasteps-fig17-installprogresswindow.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig2.png b/devices/surface/images/sdasteps-fig2.png deleted file mode 100644 index 4edeb35ca3..0000000000 Binary files a/devices/surface/images/sdasteps-fig2.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig3.png b/devices/surface/images/sdasteps-fig3.png deleted file mode 100644 index 728ddab514..0000000000 Binary files a/devices/surface/images/sdasteps-fig3.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig4-select.png b/devices/surface/images/sdasteps-fig4-select.png deleted file mode 100644 index 15d4df2af7..0000000000 Binary files a/devices/surface/images/sdasteps-fig4-select.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig5-installwindow.png b/devices/surface/images/sdasteps-fig5-installwindow.png deleted file mode 100644 index 66f1814146..0000000000 Binary files a/devices/surface/images/sdasteps-fig5-installwindow.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig6-specify-driver-app-files.png b/devices/surface/images/sdasteps-fig6-specify-driver-app-files.png deleted file mode 100644 index cb82d3fec7..0000000000 Binary files a/devices/surface/images/sdasteps-fig6-specify-driver-app-files.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig7-diskpart.png b/devices/surface/images/sdasteps-fig7-diskpart.png deleted file mode 100644 index 70b517f3f1..0000000000 Binary files a/devices/surface/images/sdasteps-fig7-diskpart.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig8-mediafolder.png b/devices/surface/images/sdasteps-fig8-mediafolder.png deleted file mode 100644 index f6a862e60f..0000000000 Binary files a/devices/surface/images/sdasteps-fig8-mediafolder.png and /dev/null differ diff --git a/devices/surface/images/sdasteps-fig9-location.png b/devices/surface/images/sdasteps-fig9-location.png deleted file mode 100644 index c8247de908..0000000000 Binary files a/devices/surface/images/sdasteps-fig9-location.png and /dev/null differ diff --git a/devices/surface/images/sdt-1.png b/devices/surface/images/sdt-1.png deleted file mode 100644 index fb10753608..0000000000 Binary files a/devices/surface/images/sdt-1.png and /dev/null differ diff --git a/devices/surface/images/sdt-2.png b/devices/surface/images/sdt-2.png deleted file mode 100644 index be951967f0..0000000000 Binary files a/devices/surface/images/sdt-2.png and /dev/null differ diff --git a/devices/surface/images/sdt-3.png b/devices/surface/images/sdt-3.png deleted file mode 100644 index 0d3077cc1b..0000000000 Binary files a/devices/surface/images/sdt-3.png and /dev/null differ diff --git a/devices/surface/images/sdt-4.png b/devices/surface/images/sdt-4.png deleted file mode 100644 index babddbb240..0000000000 Binary files a/devices/surface/images/sdt-4.png and /dev/null differ diff --git a/devices/surface/images/sdt-5.png b/devices/surface/images/sdt-5.png deleted file mode 100644 index 5c5346d93a..0000000000 Binary files a/devices/surface/images/sdt-5.png and /dev/null differ diff --git a/devices/surface/images/sdt-6.png b/devices/surface/images/sdt-6.png deleted file mode 100644 index acf8e684b3..0000000000 Binary files a/devices/surface/images/sdt-6.png and /dev/null differ diff --git a/devices/surface/images/sdt-7.png b/devices/surface/images/sdt-7.png deleted file mode 100644 index 5e16961c6b..0000000000 Binary files a/devices/surface/images/sdt-7.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-1.png b/devices/surface/images/sdt-desk-1.png deleted file mode 100644 index f1ecc03b30..0000000000 Binary files a/devices/surface/images/sdt-desk-1.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-2.png b/devices/surface/images/sdt-desk-2.png deleted file mode 100644 index 3d066cb3e5..0000000000 Binary files a/devices/surface/images/sdt-desk-2.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-3.png b/devices/surface/images/sdt-desk-3.png deleted file mode 100644 index bbd9709300..0000000000 Binary files a/devices/surface/images/sdt-desk-3.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-4.png b/devices/surface/images/sdt-desk-4.png deleted file mode 100644 index f533646605..0000000000 Binary files a/devices/surface/images/sdt-desk-4.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-5.png b/devices/surface/images/sdt-desk-5.png deleted file mode 100644 index 664828762e..0000000000 Binary files a/devices/surface/images/sdt-desk-5.png and /dev/null differ diff --git a/devices/surface/images/sdt-desk-6.png b/devices/surface/images/sdt-desk-6.png deleted file mode 100644 index 1b9ce9f7e2..0000000000 Binary files a/devices/surface/images/sdt-desk-6.png and /dev/null differ diff --git a/devices/surface/images/sdt-install.png b/devices/surface/images/sdt-install.png deleted file mode 100644 index ce0fe297d7..0000000000 Binary files a/devices/surface/images/sdt-install.png and /dev/null differ diff --git a/devices/surface/images/semm-bl.png b/devices/surface/images/semm-bl.png deleted file mode 100644 index 3f8a375057..0000000000 Binary files a/devices/surface/images/semm-bl.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig1.png b/devices/surface/images/surface-deploymdt-fig1.png deleted file mode 100644 index d2fe0995a7..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig10.png b/devices/surface/images/surface-deploymdt-fig10.png deleted file mode 100644 index 96cb86b56f..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig10.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig11.png b/devices/surface/images/surface-deploymdt-fig11.png deleted file mode 100644 index a78c147322..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig11.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig12.png b/devices/surface/images/surface-deploymdt-fig12.png deleted file mode 100644 index 6200a677ec..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig12.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig13.png b/devices/surface/images/surface-deploymdt-fig13.png deleted file mode 100644 index c04c8f6d19..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig13.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig14.png b/devices/surface/images/surface-deploymdt-fig14.png deleted file mode 100644 index f02bc1fdb9..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig14.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig15.png b/devices/surface/images/surface-deploymdt-fig15.png deleted file mode 100644 index 4eb72e98cc..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig15.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig16.png b/devices/surface/images/surface-deploymdt-fig16.png deleted file mode 100644 index 0c5abc40a3..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig16.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig17.png b/devices/surface/images/surface-deploymdt-fig17.png deleted file mode 100644 index 3ccd548a70..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig17.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig18.png b/devices/surface/images/surface-deploymdt-fig18.png deleted file mode 100644 index f510c5b884..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig18.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig19.png b/devices/surface/images/surface-deploymdt-fig19.png deleted file mode 100644 index 535a139991..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig19.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig2.png b/devices/surface/images/surface-deploymdt-fig2.png deleted file mode 100644 index ad18f2ad58..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig2.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig20.png b/devices/surface/images/surface-deploymdt-fig20.png deleted file mode 100644 index 045801b6ac..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig20.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig21.png b/devices/surface/images/surface-deploymdt-fig21.png deleted file mode 100644 index 7660a618c8..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig21.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig22.png b/devices/surface/images/surface-deploymdt-fig22.png deleted file mode 100644 index 1852197dc7..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig22.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig23.png b/devices/surface/images/surface-deploymdt-fig23.png deleted file mode 100644 index 306a662236..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig23.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig24.png b/devices/surface/images/surface-deploymdt-fig24.png deleted file mode 100644 index 546a310733..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig24.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig25.png b/devices/surface/images/surface-deploymdt-fig25.png deleted file mode 100644 index a58b7fba71..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig25.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig3.png b/devices/surface/images/surface-deploymdt-fig3.png deleted file mode 100644 index 7d87a1c986..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig3.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig4.png b/devices/surface/images/surface-deploymdt-fig4.png deleted file mode 100644 index 944fd37f41..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig4.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig5.png b/devices/surface/images/surface-deploymdt-fig5.png deleted file mode 100644 index 8fa0679886..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig5.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig6.png b/devices/surface/images/surface-deploymdt-fig6.png deleted file mode 100644 index 53c923be28..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig6.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig7.png b/devices/surface/images/surface-deploymdt-fig7.png deleted file mode 100644 index 48892a9ef0..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig7.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig8.png b/devices/surface/images/surface-deploymdt-fig8.png deleted file mode 100644 index 59028f2a82..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig8.png and /dev/null differ diff --git a/devices/surface/images/surface-deploymdt-fig9.png b/devices/surface/images/surface-deploymdt-fig9.png deleted file mode 100644 index 6044405883..0000000000 Binary files a/devices/surface/images/surface-deploymdt-fig9.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-fig1-options.png b/devices/surface/images/surface-diagnostic-kit-fig1-options.png deleted file mode 100644 index 8e10b877f9..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-fig1-options.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-fig2-testdepth.png b/devices/surface/images/surface-diagnostic-kit-fig2-testdepth.png deleted file mode 100644 index 061c7748b3..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-fig2-testdepth.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-fig3-results.png b/devices/surface/images/surface-diagnostic-kit-fig3-results.png deleted file mode 100644 index e02087d6d9..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-fig3-results.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-fig4-notes.png b/devices/surface/images/surface-diagnostic-kit-fig4-notes.png deleted file mode 100644 index 02726648db..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-fig4-notes.png and /dev/null differ diff --git a/devices/surface/images/surface-diagnostic-kit-gear-icon.png b/devices/surface/images/surface-diagnostic-kit-gear-icon.png deleted file mode 100644 index fe6be488b1..0000000000 Binary files a/devices/surface/images/surface-diagnostic-kit-gear-icon.png and /dev/null differ diff --git a/devices/surface/images/surface-enroll-semm-fig1.png b/devices/surface/images/surface-enroll-semm-fig1.png deleted file mode 100644 index 0db814ae84..0000000000 Binary files a/devices/surface/images/surface-enroll-semm-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig1-uefi-configurator.png b/devices/surface/images/surface-ent-mgmt-fig1-uefi-configurator.png deleted file mode 100644 index e8fb93a1a7..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig1-uefi-configurator.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig2-securepackage.png b/devices/surface/images/surface-ent-mgmt-fig2-securepackage.png deleted file mode 100644 index fa47419ca0..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig2-securepackage.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig3-enabledisable.png b/devices/surface/images/surface-ent-mgmt-fig3-enabledisable.png deleted file mode 100644 index 0a34907def..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig3-enabledisable.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig4-advancedsettings.png b/devices/surface/images/surface-ent-mgmt-fig4-advancedsettings.png deleted file mode 100644 index f425466056..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig4-advancedsettings.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig5-success.png b/devices/surface/images/surface-ent-mgmt-fig5-success.png deleted file mode 100644 index e671570fee..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig5-success.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig6-enrollconfirm.png b/devices/surface/images/surface-ent-mgmt-fig6-enrollconfirm.png deleted file mode 100644 index a1421da21c..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig6-enrollconfirm.png and /dev/null differ diff --git a/devices/surface/images/surface-ent-mgmt-fig7-semmrecovery.png b/devices/surface/images/surface-ent-mgmt-fig7-semmrecovery.png deleted file mode 100644 index 91c03fef5e..0000000000 Binary files a/devices/surface/images/surface-ent-mgmt-fig7-semmrecovery.png and /dev/null differ diff --git a/devices/surface/images/surface-laptop-keyboard-1.png b/devices/surface/images/surface-laptop-keyboard-1.png deleted file mode 100644 index 090ca2b58e..0000000000 Binary files a/devices/surface/images/surface-laptop-keyboard-1.png and /dev/null differ diff --git a/devices/surface/images/surface-laptop-keyboard-2.png b/devices/surface/images/surface-laptop-keyboard-2.png deleted file mode 100644 index 2a2cb8b3be..0000000000 Binary files a/devices/surface/images/surface-laptop-keyboard-2.png and /dev/null differ diff --git a/devices/surface/images/surface-laptop-keyboard-3.png b/devices/surface/images/surface-laptop-keyboard-3.png deleted file mode 100644 index 80ccc1fc3c..0000000000 Binary files a/devices/surface/images/surface-laptop-keyboard-3.png and /dev/null differ diff --git a/devices/surface/images/surface-laptop-keyboard-4.png b/devices/surface/images/surface-laptop-keyboard-4.png deleted file mode 100644 index cf08e7a292..0000000000 Binary files a/devices/surface/images/surface-laptop-keyboard-4.png and /dev/null differ diff --git a/devices/surface/images/surface-laptop-keyboard-5.png b/devices/surface/images/surface-laptop-keyboard-5.png deleted file mode 100644 index cf4bc9109c..0000000000 Binary files a/devices/surface/images/surface-laptop-keyboard-5.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig1.png b/devices/surface/images/surface-semm-enroll-fig1.png deleted file mode 100644 index 0db814ae84..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig10.png b/devices/surface/images/surface-semm-enroll-fig10.png deleted file mode 100644 index e61cf3d70a..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig10.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig11.png b/devices/surface/images/surface-semm-enroll-fig11.png deleted file mode 100644 index 91c03fef5e..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig11.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig12.png b/devices/surface/images/surface-semm-enroll-fig12.png deleted file mode 100644 index d6c0505c16..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig12.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig3.png b/devices/surface/images/surface-semm-enroll-fig3.png deleted file mode 100644 index 2d66b485f9..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig3.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig4.png b/devices/surface/images/surface-semm-enroll-fig4.png deleted file mode 100644 index 39b0c797e7..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig4.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig5.png b/devices/surface/images/surface-semm-enroll-fig5.png deleted file mode 100644 index b3d3db34c7..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig5.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig6.png b/devices/surface/images/surface-semm-enroll-fig6.png deleted file mode 100644 index 95b1c1b24b..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig6.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig7.png b/devices/surface/images/surface-semm-enroll-fig7.png deleted file mode 100644 index 26a640ac0c..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig7.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig8.png b/devices/surface/images/surface-semm-enroll-fig8.png deleted file mode 100644 index a1421da21c..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig8.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enroll-fig9.png b/devices/surface/images/surface-semm-enroll-fig9.png deleted file mode 100644 index 9229ee255d..0000000000 Binary files a/devices/surface/images/surface-semm-enroll-fig9.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-enrollment-fig2.png b/devices/surface/images/surface-semm-enrollment-fig2.png deleted file mode 100644 index 1a5649b01e..0000000000 Binary files a/devices/surface/images/surface-semm-enrollment-fig2.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig1.png b/devices/surface/images/surface-semm-unenroll-fig1.png deleted file mode 100644 index b0247d3871..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig10.png b/devices/surface/images/surface-semm-unenroll-fig10.png deleted file mode 100644 index 968bf44d8c..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig10.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig11.png b/devices/surface/images/surface-semm-unenroll-fig11.png deleted file mode 100644 index c5e86d2b65..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig11.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig12.png b/devices/surface/images/surface-semm-unenroll-fig12.png deleted file mode 100644 index d9a3e0617b..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig12.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig13.png b/devices/surface/images/surface-semm-unenroll-fig13.png deleted file mode 100644 index cfe16c3a99..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig13.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig14.png b/devices/surface/images/surface-semm-unenroll-fig14.png deleted file mode 100644 index 5c95097c8d..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig14.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig2.png b/devices/surface/images/surface-semm-unenroll-fig2.png deleted file mode 100644 index 5affd8cef6..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig2.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig3.png b/devices/surface/images/surface-semm-unenroll-fig3.png deleted file mode 100644 index 45c1ae38ed..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig3.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig4.png b/devices/surface/images/surface-semm-unenroll-fig4.png deleted file mode 100644 index c4ecf92b1b..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig4.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig5.png b/devices/surface/images/surface-semm-unenroll-fig5.png deleted file mode 100644 index 9229ee255d..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig5.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig6.png b/devices/surface/images/surface-semm-unenroll-fig6.png deleted file mode 100644 index 91c03fef5e..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig6.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig7.png b/devices/surface/images/surface-semm-unenroll-fig7.png deleted file mode 100644 index 0dcbace491..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig7.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig8.png b/devices/surface/images/surface-semm-unenroll-fig8.png deleted file mode 100644 index 77e7e05407..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig8.png and /dev/null differ diff --git a/devices/surface/images/surface-semm-unenroll-fig9.png b/devices/surface/images/surface-semm-unenroll-fig9.png deleted file mode 100644 index b40ccb2449..0000000000 Binary files a/devices/surface/images/surface-semm-unenroll-fig9.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig1.png b/devices/surface/images/surface-upgrademdt-fig1.png deleted file mode 100644 index 094f5d700b..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig1.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig2.png b/devices/surface/images/surface-upgrademdt-fig2.png deleted file mode 100644 index 88ec207691..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig2.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig3.png b/devices/surface/images/surface-upgrademdt-fig3.png deleted file mode 100644 index 7660a618c8..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig3.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig4.png b/devices/surface/images/surface-upgrademdt-fig4.png deleted file mode 100644 index 1852197dc7..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig4.png and /dev/null differ diff --git a/devices/surface/images/surface-upgrademdt-fig5.png b/devices/surface/images/surface-upgrademdt-fig5.png deleted file mode 100644 index 306a662236..0000000000 Binary files a/devices/surface/images/surface-upgrademdt-fig5.png and /dev/null differ diff --git a/devices/surface/images/surfaceblog.png b/devices/surface/images/surfaceblog.png deleted file mode 100644 index d5bef3dc3d..0000000000 Binary files a/devices/surface/images/surfaceblog.png and /dev/null differ diff --git a/devices/surface/images/surfacebook.png b/devices/surface/images/surfacebook.png deleted file mode 100644 index d27cf05820..0000000000 Binary files a/devices/surface/images/surfacebook.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig1-uptodate-568pix.png b/devices/surface/images/surfacedockupdater-fig1-uptodate-568pix.png deleted file mode 100644 index 900ffd9269..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig1-uptodate-568pix.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig2a-needsupdating.png b/devices/surface/images/surfacedockupdater-fig2a-needsupdating.png deleted file mode 100644 index 4c690e0a7f..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig2a-needsupdating.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig3-progress.png b/devices/surface/images/surfacedockupdater-fig3-progress.png deleted file mode 100644 index aa56e090e9..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig3-progress.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig4-disconnect.png b/devices/surface/images/surfacedockupdater-fig4-disconnect.png deleted file mode 100644 index 4892dce1ba..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig4-disconnect.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig5-success.png b/devices/surface/images/surfacedockupdater-fig5-success.png deleted file mode 100644 index 790ff235e9..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig5-success.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig6-countdown.png b/devices/surface/images/surfacedockupdater-fig6-countdown.png deleted file mode 100644 index fa208e0e4a..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig6-countdown.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig7-error.png b/devices/surface/images/surfacedockupdater-fig7-error.png deleted file mode 100644 index c18ef16b4c..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig7-error.png and /dev/null differ diff --git a/devices/surface/images/surfacedockupdater-fig8-737test.png b/devices/surface/images/surfacedockupdater-fig8-737test.png deleted file mode 100644 index c101313b96..0000000000 Binary files a/devices/surface/images/surfacedockupdater-fig8-737test.png and /dev/null differ diff --git a/devices/surface/images/surfacemechanics.png b/devices/surface/images/surfacemechanics.png deleted file mode 100644 index 3d42daaed2..0000000000 Binary files a/devices/surface/images/surfacemechanics.png and /dev/null differ diff --git a/devices/surface/images/surfacepro.png b/devices/surface/images/surfacepro.png deleted file mode 100644 index c036b2ad3a..0000000000 Binary files a/devices/surface/images/surfacepro.png and /dev/null differ diff --git a/devices/surface/images/surfacestudio.png b/devices/surface/images/surfacestudio.png deleted file mode 100644 index c41bbbf0f7..0000000000 Binary files a/devices/surface/images/surfacestudio.png and /dev/null differ diff --git a/devices/surface/images/twitter.png b/devices/surface/images/twitter.png deleted file mode 100644 index c61827284e..0000000000 Binary files a/devices/surface/images/twitter.png and /dev/null differ diff --git a/devices/surface/images/uefidfci.png b/devices/surface/images/uefidfci.png deleted file mode 100644 index ec95181145..0000000000 Binary files a/devices/surface/images/uefidfci.png and /dev/null differ diff --git a/devices/surface/images/using-sda-driverfiles-fig1.png b/devices/surface/images/using-sda-driverfiles-fig1.png deleted file mode 100644 index 51244bfe16..0000000000 Binary files a/devices/surface/images/using-sda-driverfiles-fig1.png and /dev/null differ diff --git a/devices/surface/images/using-sda-installcommand-fig2.png b/devices/surface/images/using-sda-installcommand-fig2.png deleted file mode 100644 index 61a4fbd1f2..0000000000 Binary files a/devices/surface/images/using-sda-installcommand-fig2.png and /dev/null differ diff --git a/devices/surface/images/using-sda-newinstall-fig3.png b/devices/surface/images/using-sda-newinstall-fig3.png deleted file mode 100644 index ff18b67e3e..0000000000 Binary files a/devices/surface/images/using-sda-newinstall-fig3.png and /dev/null differ diff --git a/devices/surface/images/wifi-band.png b/devices/surface/images/wifi-band.png deleted file mode 100644 index 38681a9dc8..0000000000 Binary files a/devices/surface/images/wifi-band.png and /dev/null differ diff --git a/devices/surface/images/wifi-roaming.png b/devices/surface/images/wifi-roaming.png deleted file mode 100644 index eb539c9bd6..0000000000 Binary files a/devices/surface/images/wifi-roaming.png and /dev/null differ diff --git a/devices/surface/images/windows10.png b/devices/surface/images/windows10.png deleted file mode 100644 index e48690853c..0000000000 Binary files a/devices/surface/images/windows10.png and /dev/null differ diff --git a/devices/surface/images/windows10upgradepath.png b/devices/surface/images/windows10upgradepath.png deleted file mode 100644 index c008e446ea..0000000000 Binary files a/devices/surface/images/windows10upgradepath.png and /dev/null differ diff --git a/devices/surface/index.yml b/devices/surface/index.yml deleted file mode 100644 index d9d7043dc2..0000000000 --- a/devices/surface/index.yml +++ /dev/null @@ -1,64 +0,0 @@ -### YamlMime:Hub - -title: Microsoft Surface # < 60 chars -summary: Learn how to plan, deploy, and manage Microsoft Surface and Surface Hub devices. # < 160 chars -# brand: aspnet | azure | dotnet | dynamics | m365 | ms-graph | office | power-platform | project | sharepoint | sql | sql-server | teams | vs | visual-studio | windows | xamarin -brand: windows - -metadata: - title: Microsoft Surface # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Learn how to plan, deploy, and manage Microsoft Surface and Surface Hub devices. # Required; article description that is displayed in search results. < 160 chars. - ms.prod: surface #Required; service per approved list. service slug assigned to your service by ACOM. - ms.topic: hub-page # Required - audience: ITPro - author: samanro #Required; your GitHub user alias, with correct capitalization. - ms.author: samanro #Required; microsoft alias of author; optional team alias. - ms.date: 07/03/2019 #Required; mm/dd/yyyy format. - localization_priority: Priority - -# additionalContent section (optional) -# Card with summary style -additionalContent: - # Supports up to 3 sections - sections: - - title: For IT Professionals # < 60 chars (optional) - items: - # Card - - title: Surface devices documentation - summary: Harness the power of Surface, Windows, and Office connected together through the cloud. Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. - url: https://docs.microsoft.com/en-us/surface/get-started - # Card - - title: Surface Hub documentation - summary: Learn how to deploy and manage Surface Hub 2S, the all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device. - url: https://docs.microsoft.com/surface-hub/index - # Card - - title: Surface Hub adoption guidance - summary: Get best practices for technical readiness and adoption across your lines of business. - url: https://docs.microsoft.com/surface-hub/surface-hub-2s-adoption-kit - - - title: Other resources # < 60 chars (optional) - items: - # Card - - title: Communities - links: - - text: Surface IT Pro blog - url: https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/bg-p/SurfaceITPro - - text: Surface Devices Tech Community - url: https://techcommunity.microsoft.com/t5/Surface-Devices/ct-p/SurfaceDevices - # Card - - title: Learn - links: - - text: Surface training on Microsoft Learn - url: https://docs.microsoft.com/learn/browse/?term=Surface - - text: Microsoft Mechanics Surface videos - url: https://www.youtube.com/watch?v=Uk2kJ5FUZxY&list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ - - # Card - - title: Need help? - links: - - text: Surface devices - url: https://support.microsoft.com/products/surface-devices - - text: Surface Hub - url: https://support.microsoft.com/hub/4343507/surface-hub-help - - text: Contact Surface Hub Support - url: https://support.microsoft.com/supportforbusiness/productselection?sapId=bb7066fb-e329-c1c0-9c13-8e9949c6a64e diff --git a/devices/surface/ltsb-for-surface.md b/devices/surface/ltsb-for-surface.md deleted file mode 100644 index c250085467..0000000000 --- a/devices/surface/ltsb-for-surface.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Long-Term Servicing Channel for Surface devices (Surface) -description: LTSB is not supported for general-purpose Surface devices and should be used for specialized devices only. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Long-Term Servicing Channel (LTSC) for Surface devices - ->[!WARNING] ->For updated information on this topic, see [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md). For additional information on this update, see the [Documentation Updates for Surface and Windows 10 LTSB Compatibility](https://blogs.technet.microsoft.com/surface/2017/04/11/documentation-updates-for-surface-and-windows-10-ltsb-compatibility) post on the Surface Blog for IT Pros. - -General-purpose Surface devices in the Long-Term Servicing Channel (LTSC) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSC and should instead be on the Semi-Annual Channel. - ->[!NOTE] ->For more information about the servicing branches, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). - -LTSC prevents Surface devices from receiving critical Windows 10 feature updates and certain non-security servicing updates. Customers with poor experiences using Surface devices in the LTSC configuration will be instructed to switch to the Semi-Annual Channel. Furthermore, the Windows 10 Enterprise LTSB edition removes core features of Surface devices, including seamless inking and touch-friendly applications. It does not contain key in-box applications including Microsoft Edge, OneNote, Calendar or Camera. Therefore, productivity is impacted and functionality is limited. LTSC is not supported as a suitable servicing solution for general-purpose Surface devices. - -General-purpose Surface devices are intended to run on the Semi-Annual Channel to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. In the Semi-Annual Channel, feature updates are available as soon as Microsoft releases them. - -Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–might consider the use of LTSC. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. - -## Related topics - -- [Surface IT Pro Blog](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/bg-p/SurfaceITPro) - diff --git a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md b/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md deleted file mode 100644 index 36197ca93f..0000000000 --- a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md +++ /dev/null @@ -1,181 +0,0 @@ ---- -title: Best practice power settings for Surface devices -description: This topic provides best practice recommendations for maintaining optimal power settings and explains how Surface streamlines the power management experience. This article applies to all currently supported Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro -ms.date: 10/28/2019 ---- - -# Best practice power settings for Surface devices - -Surface devices are designed to take advantage of the latest advances in -mobile device energy consumption to deliver a streamlined experience -optimized across workloads. Depending on what you’re doing, Surface -dynamically fine tunes how power flows to individual hardware -components, momentarily waking up system components to handle background -tasks -- such as an incoming email or network traffic -- before returning to a -low power idle state (S0ix). - -## Summary of recommendations for IT administrators - -To ensure Surface devices across your organization fully benefit from Surface power optimization features: - -- Install the latest drivers and firmware from Windows Update or the Surface Driver and Firmware MSI. This creates the balanced power plan (aka power profile) by default and configures optimal power settings. For more information, refer to [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md). -- Avoid creating custom power profiles or adjusting advanced power settings not visible in the default UI (**System** > **Power & sleep**). -- If you must manage the power profile of devices across your network (such as in highly managed organizations), use the powercfg command tool to export the power plan from the factory image of the Surface device and then import it into the provisioning package for your Surface devices. - - >[!NOTE] - >You can only export a power plan across the same type of Surface device. For example, you cannot export a power plan from Surface Laptop and import it on Surface Pro. For more information, refer to [Configure power settings](https://docs.microsoft.com/windows-hardware/customize/power-settings/configure-power-settings). - -- Exclude Surface devices from any existing power management policy settings. - -## Background - -The way Surface implements power management differs significantly from -the earlier OS standard that gradually reduces and turns off power via a -series of sleep states; for example, cycling through S1, S2, S3, and so on. - -Instead, Surface is imaged with a custom power profile that replaces -legacy sleep and energy consumption functionality with modern standby -features and dynamic fine tuning. This custom power profile is -implemented via the Surface Serial Hub Driver and the system aggregator -module (SAM). The SAM chip functions as the Surface device power-policy -owner, using algorithms to calculate optimal power requirements. It -works in conjunction with Windows power manager to allocate or throttle -only the exact amount of power required for hardware components to -function. This article applies to all currently supported Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3. - -## Utilizing the custom power profile in Surface - -If you go into the power options on a surface device, you'll see that there's a single power plan available. This is the custom power profile. And if you go to the advanced power settings, you’ll see a much smaller subset of power options compared to a generic PC running Windows 10. Unlike generic devices, Surface has firmware and custom components to manage these power options. - - -## Modern Standby - -The algorithmically embedded custom power profile enables modern standby -connectivity for Surface by maintaining a low power state for -instant on/instant off functionality typical of smartphones. S0ix, also -known as Deepest Runtime Idle Platform State (DRIPS), is the default -power mode for Surface devices. Modern standby has two modes: - -- **Connected standby.** The default mode for up-to-the minute - delivery of emails, messaging, and cloud-synced data, connected - standby keeps Wi-Fi on and maintains network connectivity. - -- **Disconnected standby.** An optional mode for extended battery - life, disconnected standby delivers the same instant-on experience - and saves power by turning off Wi-Fi, Bluetooth, and related network - connectivity. - -To learn more about modern standby, refer to the [Microsoft Hardware Dev -Center](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-wake-sources). - -## How Surface streamlines the power management experience - -Surface integrates the following features designed to help users -optimize the power management experience: - -- [Singular power plan](#singular-power-plan) - -- [Simplified power settings user - interface](#simplified-power-settings-user-interface) - -- [Windows performance power - slider](#windows-performance-power-slider) - -### Singular power plan - -Surface is designed for a streamlined power management experience that -eliminates the need to create custom power plans or manually configure -power settings. Microsoft streamlines the user -experience by delivering a single power plan (balanced) that replaces -the multiple power plans from standard Windows builds. - -### Simplified power settings user interface - -Surface provides a simplified UI in accord with best practice power -setting recommendations. In general, it's recommended to only adjust settings visible in the default user interface and avoid configuring advanced power settings or Group Policy settings. Using the default screen and sleep timeouts while avoiding maximum -brightness levels are the most effective ways for users to maintain -extended battery life. - -![Figure 1. Simplified power & sleep settings](images/powerintrofig1.png) - -Figure 1. Simplified power and sleep settings - -### Windows performance power slider - -Surface devices running Windows 10 build 1709 and later include a power -slider allowing you to prioritize battery life when needed or favor performance if desired. You -can access the power slider from the taskbar by clicking on the battery -icon. Slide left for longer battery life (battery saver mode) or slide -right for faster performance. - -![Figure 2. Power slider](images/powerintrofig2a.png) - -Figure 2. Power slider - -Power slider enables four states as described in the following table: - -| Slider mode| Description | -|---|---| -| Battery saver| Helps conserve power and prolong battery life when the system is disconnected from a power source. When battery saver is on, some Windows features are disabled, throttled, or behave differently. Screen brightness is also reduced. Battery saver is only available when using battery power (DC). To learn more, see [Battery Saver](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver).| -| Recommended | Delivers longer battery life than the default settings in earlier versions of Windows. | -| Better Performance | Slightly favors performance over battery life, functioning as the default slider mode. | -| Best Performance | Favors performance over power for workloads requiring maximum performance and responsiveness, regardless of battery power consumption.| - -Power slider modes directly control specific hardware components shown -in the following table. - -| Component | Slider functionality | -|---|---| -| Intel Speed Shift (CPU energy registers) and Energy Performance Preference hint. | Selects the best operating frequency and voltage for optimal performance and power. The Energy Performance Preference (PERFEPP) is a global power efficiency hint to the CPU. | -| Fan speed (RPM)| Where applicable, adjusts for changing conditions such as keeping fan silent in battery saver slider mode.| -| Processor package power limits (PL1/PL2).| Requires the CPU to manage its frequency choices to accommodate a running average power limit for both steady state (PL1) and turbo (PL2) workloads.| -| Processor turbo frequency limits (IA turbo limitations). | Adjusts processor and graphics performance allowing processor cores to run faster or slower than the rated operating frequency. | - ->[!NOTE] ->The power slider is entirely independent of operating system power settings whether configured from Control Panel/ Power Options, Group Policy, or related methods. - -To learn more, see: - -- [Customize the Windows performance power - slider](https://docs.microsoft.com/windows-hardware/customize/desktop/customize-power-slider) - -- [Battery - saver.](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver) - -## Best practices for extended battery life - - -| Best practice | Go to | Next steps | -|---|---|---| -| Ensure your Surface device is up to date| Windows Update | In the taskbar search box, type **Windows Update** and select **Check for updates**. | -| Choose the best power setting for what you’re doing | Power slider | In the taskbar, select the battery icon, then choose **Best performance**, **Best battery life**, or somewhere in between.| -| Conserve battery when it’s low | Battery saver | In the taskbar, select the battery icon and click **Battery settings**. Select **Turn battery saver on automatically if my battery falls below** and then move the slider further to the right for longer battery life. | -| Configure optimal screen brightness | Battery saver | In the taskbar, select the battery icon and click **Battery settings**, select **Lower screen brightness while in battery saver**. | -| Conserve power whenever you’re not plugged in | Battery saver| Select **Turn on battery saver status until next charge**.| -| Investigate problems with your power settings. | Power troubleshooter | In the Taskbar search for troubleshoot, select **Troubleshoot**, and then select **Power** and follow the instructions.| -| Check app usage | Your apps | Close apps.| -| Check your power cord for any damage.| Your power cord | Replace power cord if worn or damaged.| - -## Learn more - -- [Modern - standby](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-wake-sources) - - - -- [Customize the Windows performance power - slider](https://docs.microsoft.com/windows-hardware/customize/desktop/customize-power-slider) - -- [Battery - saver](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver) -- [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) diff --git a/devices/surface/manage-surface-driver-and-firmware-updates.md b/devices/surface/manage-surface-driver-and-firmware-updates.md deleted file mode 100644 index 75ccff3070..0000000000 --- a/devices/surface/manage-surface-driver-and-firmware-updates.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: Manage and deploy Surface driver and firmware updates -description: This article describes the available options to manage and deploy firmware and driver updates for Surface devices. -ms.assetid: CD1219BA-8EDE-4BC8-BEEF-99B50C211D73 -ms.reviewer: -manager: laurawi -keywords: Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.audience: itpro ---- - -# Manage and deploy Surface driver and firmware updates - -How you manage Surface driver and firmware updates varies depending on your environment and organizational requirements. On Surface devices, firmware is exposed to the operating system as a driver and is visible in Device Manager, enabling device firmware and drivers to be automatically updated using Windows Update or Windows Update for Business. Although this simplified approach may be feasible for startups and small or medium-sized businesses, larger organizations typically need IT admins to distribute updates internally. This may involve comprehensive planning, application compatibility testing, piloting and validating updates, before final approval and distribution across the network. - -> [!NOTE] -> This article is intended for technical support agents and IT professionals and applies to Surface devices only. If you're looking for help to install Surface updates or firmware on a home device, see [Update Surface firmware and Windows 10](https://support.microsoft.com/help/4023505). - -While enterprise-grade software distribution solutions continue to evolve, the business rationale for centrally managing updates remains the same: Maintain the security of Surface devices and keep them updated with the latest operating system and feature improvements. This is essential for sustaining a stable production environment and ensuring users aren't blocked from being productive. This article provides an overview of recommended tools and processes for larger organizations to accomplish these goals. - -## Central update management in commercial environments - -Microsoft has streamlined tools for managing devices – including driver and firmware updates -- into a single unified experience called [Microsoft Endpoint Manager admin center](https://devicemanagement.microsoft.com/) accessed from devicemanagement.microsoft.com. - -### Manage updates with Configuration Manager and Intune - -Microsoft Endpoint Configuration Manager allows you to synchronize and deploy Surface firmware and driver updates with the Configuration Manager client. Integration with Microsoft Intune lets you see all your managed, co-managed, and partner-managed devices in one place. This is the recommended solution for large organizations to manage Surface updates. - -For detailed steps, see the following resources: - -- [How to manage Surface driver updates in Configuration Manager.](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager) -- [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications). -- [Endpoint Configuration Manager documentation](https://docs.microsoft.com/configmgr/) - - -### Manage updates with Microsoft Deployment Toolkit - -Included in Endpoint Configuration Manager, the Microsoft Deployment Toolkit (MDT) contains optional deployment tools that you may wish to use depending on your environment. These include the Windows Assessment and Deployment Kit (Windows ADK), Windows System Image Manager (Windows SIM), Deployment Image Servicing and Management (DISM), and User State Migration Tool (USMT). You can download the latest version of MDT from the [Microsoft Deployment Toolkit download page](https://www.microsoft.com/download/details.aspx?id=54259). - -For detailed steps, see the following resources: - -- [Microsoft Deployment Toolkit documentation](https://docs.microsoft.com/configmgr/mdt/) -- [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit) -- [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://docs.microsoft.com/surface/deploy-windows-10-to-surface-devices-with-mdt) - -Surface driver and firmware updates are packaged as Windows Installer (*.msi) files. To deploy these Windows Installer packages, you can use Endpoint Configuration Manager or MDT. For information about selecting the correct .msi file for a device and operating system, refer to the guidance below about downloading .msi files. - -For instructions on how to deploy updates by using Endpoint Configuration Manager refer to [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications). For instructions on how to deploy updates by using MDT, see [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt). - - -**WindowsPE and Surface firmware and drivers** - -Endpoint Configuration Manager and MDT both use the Windows Preinstallation Environment (WindowsPE) during the deployment process. WindowsPE only supports a limited set of basic drivers such as those for network adapters and storage controllers. Drivers for Windows components that are not part of WindowsPE might produce errors. As a best practice, you can prevent such errors by configuring the deployment process to use only the required drivers during the WindowsPE phase. - -### Endpoint Configuration Manager - -Starting in Endpoint Configuration Manager, you can synchronize and deploy Microsoft Surface firmware and driver updates by using the Configuration Manager client. For additional information, see KB 4098906, [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager). - -## Supported devices - -Downloadable .msi files are available for Surface devices from Surface Pro 2 and later. Information about .msi files for the newest Surface devices such as Surface Pro 7, Surface Pro X, and Surface Laptop 3 will be available from this page upon release. - - -## Managing firmware with DFCI - -With Device Firmware Configuration Interface (DFCI) profiles built into Intune (now available in [public preview](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. For more information, see: - -- [Intune management of Surface UEFI settings](https://docs.microsoft.com/surface/surface-manage-dfci-guide) -- [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333). - -## Best practices for update deployment processes - -To maintain a stable environment, it's strongly recommended to maintain parity with the most recent version of Windows 10. For best practice recommendations, see [Build deployment rings for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates). - -## Downloadable Surface update packages - -Specific versions of Windows 10 have separate .msi files, each containing all required cumulative driver and firmware updates for Surface devices. Update packages may include some or all of the following components: - -- Wi-Fi and LTE -- Video -- Solid state drive -- System aggregator module (SAM) -- Battery -- Keyboard controller -- Embedded controller (EC) -- Management engine (ME) -- Unified extensible firmware interface (UEFI) - - -### Downloading .msi files - -1. Browse to [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware) on the Microsoft Download Center. -2. Select the .msi file name that matches the Surface model and version of Windows. The .msi file name includes the minimum supported Windows build number required to install the drivers and firmware. For example, as shown in the following figure, to update a Surface Book 2 with build 18362 of Windows 10, choose **SurfaceBook2_Win10_18362_19.101.13994.msi.** For a Surface Book 2 with build 16299 of Windows 10, choose **SurfaceBook2_Win10_16299_1803509_3.msi**. - - ![Figure 1. Downloading Surface updates](images/fig1-downloads-msi.png) - - *Figure 1. Downloading Surface updates* - - -### Surface .msi naming convention - -Since August 2019, .msi files have used the following naming convention: - -- *Product*_*Windows release*_*Windows build number*_*Version number*_*Revision of version number (typically zero)*. - -**Example** - -- SurfacePro6_Win10_18362_19.073.44195_0.msi - -This file name provides the following information: - -- **Product:** SurfacePro6 -- **Windows release:** Win10 -- **Build:** 18362 -- **Version:** 19.073.44195 – This shows the date and time that the file was created, as follows: - - **Year:** 19 (2019) - - **Month and week:** 073 (third week of July) - - **Minute of the month:** 44195 -- **Revision of version:** 0 (first release of this version) - -### Legacy Surface .msi naming convention -Legacy .msi files (files built before August 2019) followed the same overall naming formula but used a different method to derive the version number. - **** -**Example** - -- SurfacePro6_Win10_16299_1900307_0.msi - -This file name provides the following information: - -- **Product:** SurfacePro6 -- **Windows release:** Win10 -- **Build:** 16299 -- **Version:** 1900307 – This shows the date that the file was created and its position in the release sequence, as follows: - - **Year:** 19 (2019) - - **Number of release:** 003 (third release of the year) - - **Product version number:** 07 (Surface Pro 6 is officially the seventh version of Surface Pro) -- **Revision of version:** 0 (first release of this version) - - - -## Learn more - -- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware) -- [How to manage Surface driver updates in Configuration Manager.](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager) -- [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications). -- [Endpoint Configuration Manager documentation](https://docs.microsoft.com/configmgr/) -- [Microsoft Deployment Toolkit documentation](https://docs.microsoft.com/configmgr/mdt/) -- [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit) -- [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://docs.microsoft.com/surface/deploy-windows-10-to-surface-devices-with-mdt) -- [Intune management of Surface UEFI settings](https://docs.microsoft.com/surface/surface-manage-dfci-guide) -- [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333). -- [Build deployment rings for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) - diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md deleted file mode 100644 index c5f41821d3..0000000000 --- a/devices/surface/manage-surface-uefi-settings.md +++ /dev/null @@ -1,221 +0,0 @@ ---- -title: Manage Surface UEFI settings -description: Use Surface UEFI settings to enable or disable devices or components, configure security settings, and adjust Surface device boot settings. -keywords: firmware, security, features, configure, hardware -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: devices, surface -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: -manager: laurawi ---- - -# Manage Surface UEFI settings - -All current and future generations of Surface devices use a unique Unified Extensible Firmware Interface (UEFI) engineered by Microsoft specifically for these devices. Surface UEFI settings provide the ability to enable or disable built-in devices and components, protect UEFI settings from being changed, and adjust the Surface device boot settings. - -## Support for cloud-based management - -With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in public preview), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. DFCI is currently available for Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information, refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). - -## Open Surface UEFI menu - -To adjust UEFI settings during system startup: - -1. Shut down your Surface and wait about 10 seconds to make sure it's off. -2. Press and hold the **Volume-up** button and - at the same time - press and release the **Power button.** -3. As the Microsoft or Surface logo appears on your screen, continue to hold the **Volume-up** button until the UEFI screen appears. - -## UEFI PC information page - -The PC information page includes detailed information about your Surface device: - -- **Model** – Your Surface device’s model will be displayed here, such as Surface Book 2 or Surface Pro 7. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). -- **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. - -- **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios. -- **Asset Tag** – The asset tag is assigned to the Surface device with the [Asset Tag Tool](https://docs.microsoft.com/surface/assettag). - -You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC information** page (as shown in Figure 1): - -- System UEFI - -- SAM Controller - -- Intel Management Engine - -- System Embedded Controller - -- Touch Firmware - -![System information and firmware version information](images/manage-surface-uefi-figure-1.png "System information and firmware version information") - -*Figure 1. System information and firmware version information* - -You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) for your device. - -## UEFI Security page - -![Configure Surface UEFI security settings](images/manage-surface-uefi-fig4.png "Configure Surface UEFI security settings") - -*Figure 2. Configure Surface UEFI security settings* - -The Security page allows you to set a password to protect UEFI settings. This password must be entered when you boot the Surface device to UEFI. The password can contain the following characters (as shown in Figure 3): - -- Uppercase letters: A-Z - -- Lowercase letters: a-z - -- Numbers: 1-0 - -- Special characters: !@#$%^&*()?<>{}[]-_=+|.,;:’`” - -The password must be at least 6 characters and is case sensitive. - -![Add a password to protect Surface UEFI settings](images/manage-surface-uefi-fig2.png "Add a password to protect Surface UEFI settings") - -*Figure 3. Add a password to protect Surface UEFI settings* - -On the Security page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 4. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library. - -![Configure Secure Boot](images/manage-surface-uefi-fig3.png "Configure Secure Boot") - -*Figure 4. Configure Secure Boot* - -Depending on your device, you may also be able to see if your TPM is enabled or disabled. If you do not see the **Enable TPM** setting, open tpm.msc in Windows to check the status, as shown in Figure 5. The TPM is used to authenticate encryption for your device’s data with BitLocker. To learn more, see [BitLocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview). - -![TPM console](images/manage-surface-uefi-fig5-a.png "TPM console") - -*Figure 5. TPM console* - - -## UEFI menu: Devices - -The Devices page allows you to enable or disable specific devices and components including: - -- Docking and USB Ports - -- MicroSD or SD Card Slot - -- Rear Camera - -- Front Camera - -- Infrared (IR) Camera - -- Wi-Fi and Bluetooth - -- Onboard Audio (Speakers and Microphone) - -Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 6. - -![Enable and disable specific devices](images/manage-surface-uefi-fig5a.png "Enable and disable specific devices") - -*Figure 6. Enable and disable specific devices* - -## UEFI menu: Boot configuration - -The Boot Configuration page allows you to change the order of your boot devices as well as enable or disable boot of the following devices: - -- Windows Boot Manager - -- USB Storage - -- PXE Network - -- Internal Storage - -You can boot from a specific device immediately, or you can swipe left on that device’s entry in the list using the touchscreen. You can also boot immediately to a USB device or USB Ethernet adapter when the Surface device is powered off by pressing the **Volume Down** button and the **Power** button simultaneously. - -For the specified boot order to take effect, you must set the **Enable Alternate Boot Sequence** option to **On**, as shown in Figure 7. - -![Configure the boot order for your Surface device](images/manage-surface-uefi-fig6.png "Configure the boot order for your Surface device") - -*Figure 7. Configure the boot order for your Surface device* - -You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only. - -## UEFI menu: Management -The Management page allows you to manage use of Zero Touch UEFI Management and other features on eligible devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3. - -![Manage access to Zero Touch UEFI Management and other features](images/manage-surface-uefi-fig7a.png "Manage access to Zero Touch UEFI Management and other features") -*Figure 8. Manage access to Zero Touch UEFI Management and other features* - - -Zero Touch UEFI Management lets you remotely manage UEFI settings by using a device profile within Intune called Device Firmware Configuration Interface (DFCI). If you do not configure this setting, the ability to manage eligible devices with DFCI is set to **Ready**. To prevent DFCI, select **Opt-Out**. - -> [!NOTE] -> The UEFI Management settings page and use of DFCI is only available on Surface Pro 7, Surface Pro X, and Surface Laptop 3. - -For more information, refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). - -## UEFI menu: Exit - -Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 9. - -![Exit Surface UEFI and restart the device](images/manage-surface-uefi-fig7.png "Exit Surface UEFI and restart the device") - -*Figure 9. Click Restart Now to exit Surface UEFI and restart the device* - -## Surface UEFI boot screens - -When you update Surface device firmware, by using either Windows Update or manual installation, the updates are not applied immediately to the device, but instead during the next reboot cycle. You can find out more about the Surface firmware update process in [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates). The progress of the firmware update is displayed on a screen with progress bars of differing colors to indicate the firmware for each component. Each component’s progress bar is shown in Figures 9 through 18. - -![Surface UEFI firmware update with blue progress bar](images/manage-surface-uefi-fig8.png "Surface UEFI firmware update with blue progress bar") - -*Figure 10. The Surface UEFI firmware update displays a blue progress bar* - -![System Embedded Controller firmware with green progress bar](images/manage-surface-uefi-fig9.png "System Embedded Controller firmware with green progress bar") - -*Figure 11. The System Embedded Controller firmware update displays a green progress bar* - -![SAM Controller firmware update with orange progress bar](images/manage-surface-uefi-fig10.png "SAM Controller firmware update with orange progress bar") - -*Figure 12. The SAM Controller firmware update displays an orange progress bar* - -![Intel Management Engine firmware with red progress bar](images/manage-surface-uefi-fig11.png "Intel Management Engine firmware with red progress bar") - -*Figure 13. The Intel Management Engine firmware update displays a red progress bar* - -![Surface touch firmware with gray progress bar](images/manage-surface-uefi-fig12.png "Surface touch firmware with gray progress bar") - -*Figure 14. The Surface touch firmware update displays a gray progress bar* - -![Surface KIP firmware with light green progress bar](images/manage-surface-uefi-fig13.png "Surface touch firmware with light green progress bar") - -*Figure 15. The Surface KIP firmware update displays a light green progress bar* - -![Surface ISH firmware with pink progress bar](images/manage-surface-uefi-fig14.png "Surface ISH firmware with pink progress bar") - -*Figure 16 The Surface ISH firmware update displays a light pink progress bar* - -![Surface Trackpad firmware with gray progress bar](images/manage-surface-uefi-fig15.png "Surface Trackpad firmware with gray progress bar") - -*Figure 17. The Surface Trackpad firmware update displays a pink progress bar* - -![Surface TCON firmware with light gray progress bar](images/manage-surface-uefi-fig16.png "Surface TCON firmware with light gray progress bar") - -*Figure 18. The Surface TCON firmware update displays a light gray progress bar* - - -![Surface TPM firmware with light purple progress bar](images/manage-surface-uefi-fig17.png "Surface TPM firmware with purple progress bar") - -*Figure 19. The Surface TPM firmware update displays a purple progress bar* - - ->[!NOTE] ->An additional warning message that indicates Secure Boot is disabled is displayed, as shown in Figure 19. - -![Surface boot screen that indicates Secure Boot has been disabled](images/manage-surface-uefi-fig18.png "Surface boot screen that indicates Secure Boot has been disabled") - -*Figure 20. Surface boot screen that indicates Secure Boot has been disabled in Surface UEFI settings* - -## Related topics - -- [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md) - -- [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) diff --git a/devices/surface/microsoft-surface-brightness-control.md b/devices/surface/microsoft-surface-brightness-control.md deleted file mode 100644 index f0e6c5d221..0000000000 --- a/devices/surface/microsoft-surface-brightness-control.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Surface Brightness Control -description: This topic describes how you can use the Surface Brightness Control app to manage display brightness in point-of-sale and kiosk scenarios. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: hachidan -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Surface Brightness Control - -When deploying Surface devices in point of sale or other “always-on” -kiosk scenarios, you can optimize power management using the new Surface -Brightness Control app. - -Available for download with [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703). -Surface Brightness Control is designed to help reduce thermal load and lower the overall carbon footprint for deployed Surface devices. -If you plan to get only this tool from the download page, select the file **Surface_Brightness_Control_v1.16.137.0.msi** in the available list. -The tool automatically dims the screen when not in use and includes the following configuration options: - -- Period of inactivity before dimming the display. - -- Brightness level when dimmed. - -- Maximum brightness level when in use. - -**To run Surface Brightness Control:** - -- Install surfacebrightnesscontrol.msi on the target device and Surface Brightness Control - will begin working immediately. - -## Configuring Surface Brightness Control - -You can adjust the default values via the Windows Registry. For more -information about using the Windows Registry, refer to the [Registry -documentation](https://docs.microsoft.com/windows/desktop/sysinfo/registry). - -1. Run regedit from a command prompt to open the Windows Registry - Editor. - - - Computer\HKEY\_LOCAL\_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Surface\Surface - Brightness Control\ - - If you're running an older version of Surface Brightness control, run the following command instead: - - - Computer\HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Surface\Surface - Brightness Control\ - - -| Registry Setting | Data| Description -|-----------|------------|--------------- -| Brightness Control Enabled | Default: 01
Option: 01, 00
Type: REG_BINARY | This setting allows you to turn Surface Brightness Control on or off. To disable Surface Brightness Control, set the value to 00. If you do not configure this setting, Surface Brightness Control is on. | -| Brightness Control On Power Enabled| Default: 01
Options: 01, 00
Type: REG_BINARY | This setting allows you to turn off Surface Brightness Control when the device is directly connected to power. To disable Surface Brightness Control when power is plugged in, set the value to 00. If you do not configure this setting, Surface Brightness Control is on. | -| Dimmed Brightness | Default: 20
Option: Range of 0-100 percent of screen brightness
Data Type: Positive integer
Type: REG_DWORD | This setting allows you to manage brightness range during periods of inactivity. If you do not configure this setting, the brightness level will drop to 20 percent of full brightness after 30 seconds of inactivity. | -Full Brightness | Default: 100
Option: Range of 0-100 percent of screen brightness
Data Type: Positive integer
Type: REG_DWORD | This setting allows you to manage the maximum brightness range for the device. If you do not configure this setting, the maximum brightness range is 100 percent.| -| Inactivity Timeout| Default: 30 seconds
Option: Any numeric value
Data Type: Integer
Type: REG_DWORD | This setting allows you to manage the period of inactivity before dimming the device. If you do not configure this setting, the inactivity timeout is 30 seconds.| -| Telemetry Enabled | Default: 01
Option: 01, 00
Type: REG_BINARY | This setting allows you to manage the sharing of app usage information to improve software and provide better user experience. To disable telemetry, set the value to 00. If you do not configure this setting, telemetry information is shared with Microsoft in accordance with the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). | - -## Changes and updates - -### Version 1.16.137
-*Release Date: 22 October 2019*
-This version of Surface Brightness Control adds support for the following: --Recompiled for x86, adding support for Surface Pro 7, Surface Pro X, and Surface Laptop 3. - -### Version 1.12.239.0 -*Release Date: 26 April 2019*
-This version of Surface Brightness Control adds support for the following: -- Touch delay fixes. - - -## Related topics - -- [Battery limit setting](battery-limit.md) diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md deleted file mode 100644 index 0cbf9dac52..0000000000 --- a/devices/surface/microsoft-surface-data-eraser.md +++ /dev/null @@ -1,242 +0,0 @@ ---- -title: Microsoft Surface Data Eraser (Surface) -description: Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. -ms.assetid: 8DD3F9FE-5458-4467-BE26-E9200341CF10 -ms.reviewer: hachidan -manager: laurawi -ms.localizationpriority: medium -keywords: tool, USB, data, erase -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.audience: itpro ---- - -# Microsoft Surface Data Eraser - - -Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. - -[Microsoft Surface Data Eraser](https://www.microsoft.com/download/details.aspx?id=46703) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB stick is easy to create by using the provided wizard, the Microsoft Surface Data Eraser wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](https://www.microsoft.com/surface/support/security-sign-in-and-accounts/data-wiping-policy). - ->[!IMPORTANT] ->Microsoft Surface Data Eraser uses the NVM Express (NVMe) format command to erase data as authorized in [NIST Special Publication 800-88 Revision 1](http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf). - -Compatible Surface devices include: - -* Surface Pro 7 -* Surface Pro X -* Surface Laptop 3 -* Surface Pro 6 -* Surface Laptop 2 -* Surface Go -* Surface Book 2 -* Surface Pro with LTE Advanced (Model 1807) -* Surface Pro (Model 1796) -* Surface Laptop -* Surface Studio -* Surface Studio 2 -* Surface Book -* Surface Pro 4 -* Surface 3 LTE -* Surface 3 -* Surface Pro 3 -* Surface Pro 2 - -Some scenarios where Microsoft Surface Data Eraser can be helpful include: - -- Prepare a Surface device to be sent for repair - -- Decommission a Surface device to be removed from corporate or organizational use - -- Repurpose a Surface device for use in a new department or for use by a new user - -- Standard practice when performing reimaging for devices used with sensitive data - ->[!NOTE] ->Third-party devices, Surface devices running Windows RT (including Surface and Surface 2), and Surface Pro are not compatible with Microsoft Surface Data Eraser. - ->[!NOTE] ->Because the ability to boot to USB is required to run Microsoft Surface Data Eraser, if the device is not configured to boot from USB or if the device is unable to boot or POST successfully, the Microsoft Surface Data Eraser tool will not function. - ->[!NOTE] ->Surface Data Eraser on Surface Studio and Surface Studio 2 can take up to 6 minutes to boot into WinPE before disk erasure can occur. - - -## How to create a Microsoft Surface Data Eraser USB stick - - -To create a Microsoft Surface Data Eraser USB stick, first install the Microsoft Surface Data Eraser setup tool from the Microsoft Download Center using the link provided at the beginning of this article. You do not need a Surface device to *create* the USB stick. After you have downloaded the installation file to your computer, follow these steps to install the Microsoft Surface Data Eraser creation tool: - -1. Run the DataEraserSetup.msi installation file that you downloaded from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=46703). - -2. Select the check box to accept the terms of the license agreement, and then click **Install**. - -3. Click **Finish** to close the Microsoft Surface Data Eraser setup window. - -After the creation tool is installed, follow these steps to create a Microsoft Surface Data Eraser USB stick. Before you begin these steps, ensure that you have a USB 3.0 stick that is 4 GB or larger connected to the computer. - -1. Start Microsoft Surface Data Eraser from the Start menu or Start screen. - -2. Click **Build** to begin the Microsoft Surface Data Eraser USB creation process. - -3. Click **Start** to acknowledge that you have a USB stick of at least 4 GB connected, as shown in Figure 1. - - ![Start the Microsoft Surface Data Eraser tool](images/dataeraser-start-tool.png "Start the Microsoft Surface Data Eraser tool") - - *Figure 1. Start the Microsoft Surface Data Eraser tool* -4. Choose **x64** for most Surface devices or **ARM64** for Surface Pro X from the **Architecture Selection** page, as shown in Figure 2. Select **Continue**. - - ![Architecture selection](images/dataeraser-arch.png "Architecture Selection")
- *Figure 2. Select device architecture* - - -4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 3, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost. - - >[!NOTE] - >If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB. - - ![USB thumb drive selection](images/dataeraser-usb-selection.png "USB thumb drive selection") - - *Figure 3. USB thumb drive selection* - -5. After the creation process is finished, the USB drive has been formatted and all binaries are copied to the USB drive. Click **Success**. - -6. When the **Congratulations** screen is displayed, you can eject and remove the thumb drive. This thumb drive is now ready to be inserted into a Surface device, booted from, and wipe any data on the device. Click **Complete** to finish the USB creation process, as shown in Figure 4. - - ![Surface Data Eraser USB creation process](images/dataeraser-complete-process.png "Surface Data Eraser USB creation process") - - *Figure 4. Complete the Microsoft Surface Data Eraser USB creation process* - -7. Click **X** to close Microsoft Surface Data Eraser. - -## How to use a Microsoft Surface Data Eraser USB stick - - -After you create a Microsoft Surface Data Eraser USB stick, you can boot a supported Surface device from the USB stick by following this procedure: - -1. Insert the bootable Microsoft Surface Data Eraser USB stick into the supported Surface device. - -2. Boot your Surface device from the Microsoft Surface Data Eraser USB stick. To boot your device from the USB stick follow these steps: - - a. Turn off your Surface device. - - b. Press and hold the **Volume Down** button. - - c. Press and release the **Power** button. - - d. Release the **Volume Down** button. - - >[!NOTE] - >If your device does not boot to USB using these steps, you may need to turn on the **Enable Alternate Boot Sequence** option in Surface UEFI. You can read more about Surface UEFI boot configuration in [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings). - -3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed, as shown in Figure 5. - - ![Booting the Microsoft Surface Data Eraser USB stick](images/data-eraser-3.png "Booting the Microsoft Surface Data Eraser USB stick") - - *Figure 5. Booting the Microsoft Surface Data Eraser USB stick* - -4. Read the software license terms, and then close the Notepad file. - -5. Accept or decline the software license terms by typing **Accept** or **Decline**. You must accept the license terms to continue. - -6. The Microsoft Surface Data Eraser script detects the storage devices that are present in your Surface device and displays the details of the native storage device. To continue, press **Y** (this action runs Microsoft Surface Data Eraser and removes all data from the storage device) or press **N** (this action shuts down the device without removing data). - - >[!NOTE] - >The Microsoft Surface Data Eraser tool will delete all data, including Windows operating system files required to boot the device, in a secure and unrecoverable way. To boot a Surface device that has been wiped with Microsoft Surface Data Eraser, you will first need to reinstall the Windows operating system. To remove data from a Surface device without removing the Windows operating system, you can use the **Reset your PC** function. However, this does not prevent your data from being recovered with forensic or data recovery capabilities. See [Recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options) for more information. - - ![Partition to be erased is displayed](images/sda-fig5-erase.png "Partition to be erased is displayed") - - *Figure 6. Partition to be erased is displayed in Microsoft Surface Data Eraser* - -7. If you pressed **Y** in step 6, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice. - -8. Click the **Yes** button to continue erasing data on the Surface device. - - >[!NOTE] - >When you run Surface Data Eraser on the Surface Data Eraser USB drive, a log file is generated in the **SurfaceDataEraserLogs** folder. - -## Changes and updates - -Microsoft Surface Data Eraser is periodically updated by Microsoft. For information about the changes provided in each new version, see the following: - -### 3.28.137 -*Release Date: 11 Nov 2019* -This version of Surface Data Eraser: - -- Includes bug fixes - -### Version 3.21.137 -*Release Date: 21 Oct 2019* -This version of Surface Data Eraser is compiled for x86 and adds support for the following devices: - -- Supports Surface Pro 7, Surface Pro X, and Surface Laptop 3 - -### Version 3.2.78.0 -*Release Date: 4 Dec 2018* - -This version of Surface Data Eraser: - -- Includes bug fixes - - -### Version 3.2.75.0 -*Release Date: 12 November 2018* - -This version of Surface Data Eraser: - -- Adds support to Surface Studio 2 -- Fixes issues with SD card - -### Version 3.2.69.0 -*Release Date: 12 October 2018* - -This version of Surface Data Eraser adds support for the following: - -- Surface Pro 6 -- Surface Laptop 2 - -### Version 3.2.68.0 -This version of Microsoft Surface Data Eraser adds support for the following: - -- Surface Go - - -### Version 3.2.58.0 -This version of Microsoft Surface Data Eraser adds support for the following: - -- Additional storage devices (drives) for Surface Pro and Surface Laptop devices - - -### Version 3.2.46.0 -This version of Microsoft Surface Data Eraser adds support for the following: - -- Surface Pro with LTE Advanced - - -### Version 3.2.45.0 - -This version of Microsoft Surface Data Eraser adds support for the following: - -- Surface Book 2 - -- Surface Pro 1TB - - >[!NOTE] - >Surface Data Eraser v3.2.45.0 and above can be used to restore Surface Pro or Surface Laptop devices with the 1TB storage option in the scenario that the device shows two separate 512GB volumes or encounters errors when attempting to deploy or install Windows 10. See [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/help/4046105/surface-pro-model-1796-and-surface-laptop-1tb-display-two-drives) for more information. - - -### Version 3.2.36.0 - -This version of Microsoft Surface Data Eraser adds support for the following: - -- Surface Pro - -- Surface Laptop - ->[!NOTE] ->The Microsoft Surface Data Eraser USB drive creation tool is unable to run on Windows 10 S. To wipe a Surface Laptop running Windows 10 S, you must first create the Microsoft Surface Data Eraser USB drive on another computer with Windows 10 Pro or Windows 10 Enterprise. diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md deleted file mode 100644 index 6c25746e2a..0000000000 --- a/devices/surface/microsoft-surface-deployment-accelerator.md +++ /dev/null @@ -1,144 +0,0 @@ ---- -title: Microsoft Surface Deployment Accelerator (Surface) -description: Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices. -ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4 -ms.reviewer: hachidan -manager: laurawi -ms.localizationpriority: medium -keywords: deploy, install, tool -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.audience: itpro ---- - -# Microsoft Surface Deployment Accelerator - -Microsoft Surface Deployment Accelerator (SDA) automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. - -> [!NOTE] -> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md). - -SDA is built on the powerful suite of deployment tools available from Microsoft including the Windows Assessment and Deployment Kit (ADK), the Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). The resulting deployment share encompasses the recommended best practices for managing drivers during deployment and automating image creation and can serve as a starting point upon which you build your own customized deployment solution. - -**Download Microsoft Surface Deployment Accelerator** - -You can download the installation files for SDA from the Microsoft Download Center. To download the installation files: - -1. Go to the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center. - -2. Click the **Download** button, select the **Surface\_Deployment\_Accelerator\_xxxx.msi** file, and then click **Next**. - -## Microsoft Surface Deployment Accelerator prerequisites - - -Before you install SDA, your environment must meet the following prerequisites: - -- SDA must be installed on Windows Server 2012 R2 or later - -- PowerShell Script Execution Policy must be set to **Unrestricted** - -- DHCP and DNS must be enabled on the network where the Windows Server 2012 R2 environment is connected - -- To download Surface drivers and apps automatically the Windows Server 2012 R2 environment must have Internet access and Internet Explorer Enhanced Security Configuration must be disabled - -- To support network boot, the Windows Server 2012 R2 environment must have Windows Deployment Services installed and configured to respond to PXE requests - -- Access to Windows source files or installation media is required when you prepare a deployment with SDA - -- At least 6 GB of free space for each version of Windows you intend to deploy - -## How Microsoft Surface Deployment Accelerator works - - -As you progress through the SDA wizard, you will be asked some basic questions about how your deployment solution should be configured. As you select the desired Surface models to be supported and apps to be installed (see Figure 1), the wizard will prepare scripts that download, install, and configure everything needed to perform a complete deployment and capture of a reference image. By using the network boot (PXE) capabilities of Windows Deployment Services (WDS), the resulting solution enables you to boot a Surface device from the network and perform a clean deployment of Windows. - -![Software and driver selection window](images/sda-fig1-select-steps.png "Software and driver selection window") - -*Figure 1. Select desired apps and drivers* - -When the SDA completes, you can use the deployment share to deploy over the network immediately. Simply boot your Surface device from the network using a Surface Ethernet Adapter and select the Surface deployment share you created with the SDA wizard. Select the **1- Deploy Microsoft Surface** task sequence and the wizard will walk you through an automated deployment of Windows to your Surface device. - -You can modify the task sequence in the MDT Deployment Workbench to [include your own apps](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt#sec04), or to [pause the automated installation routine](https://blogs.technet.microsoft.com/mniehaus/2009/06/26/mdt-2010-new-feature-3-suspend-and-resume-a-lite-touch-task-sequence/). While the installation is paused, you can make changes to customize your reference image. After the image is captured, you can configure a deployment task sequence and distribute this custom configuration by using the same network boot capabilities as before. - ->[!NOTE] ->With SDA v1.9.0258, Surface Pro 3, Surface Pro 4, and Surface Book are supported for Windows 10 deployment, and Surface Pro 3 is supported for Windows 8.1 deployment. - -  - -## Use Microsoft Surface Deployment Accelerator without an Internet connection - - -For environments where the SDA server will not be able to connect to the Internet, the required Surface files can be downloaded separately. To specify a local source for Surface driver and app files, select the **Copy from a local directory** option and specify the location of your downloaded files (see Figure 2). All of the driver and app files for your selected choices must be placed in the specified folder. - -![Specify a local source for Surface driver and app files](images/sda-fig2-specify-local.png "Specify a local source for Surface driver and app files") - -*Figure 2. Specify a local source for Surface driver and app files* - -You can find a full list of available driver downloads at [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) - ->[!NOTE] ->Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder. - ->[!NOTE] ->Using files from a local directory is not supported when including Office 365 in your deployment share. To include Office 365 in your deployment share, select the **Download from the Internet** check box. - -## Changes and updates - -SDA is periodically updated by Microsoft. For instructions on how these features are used, see [Step-by-Step: Microsoft Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator). - ->[!NOTE] ->To install a newer version of SDA on a server with a previous version of SDA installed, you only need to run the installation file for the new version of SDA. The installer will handle the upgrade process automatically. If you used SDA to create a deployment share prior to the upgrade and want to use new features of the new version of SDA, you will need to create a new deployment share. SDA does not support upgrades of an existing deployment share. - -### Version 2.8.136.0 -This version of SDA supports deployment of the following: -* Surface Book 2 -* Surface Laptop -* Surface Pro LTE - -### Version 2.0.8.0 -This version of SDA supports deployment of the following: -* Surface Pro - ->[!NOTE] ->SDA version 2.0.8.0 includes support only for Surface Pro, and does not support other Surface devices such as Surface Pro 4 or Surface Book. To deploy these devices, please continue to use SDA version 1.96.0405. -  -### Version 1.96.0405 -This version of SDA adds support for the following: -* Microsoft Deployment Toolkit (MDT) 2013 Update 2 -* Office 365 Click-to-Run -* Surface 3 and Surface 3 LTE -* Reduced Windows Assessment and Deployment Kit (Windows ADK) footprint, only the following Windows ADK components are installed: - * Deployment tools - * Windows Preinstallation Environment (WinPE) - * User State Migration Tool (USMT) - -### Version 1.90.0258 -This version of SDA adds support for the following: -* Surface Book -* Surface Pro 4 -* Windows 10 - -### Version 1.90.0000 -This version of SDA adds support for the following: -* Local driver and app files can be used to create a deployment share without access to the Internet - -### Version 1.70.0000 -This version is the original release of SDA. This version of SDA includes support for: -* MDT 2013 Update 1 -* Windows ADK -* Surface Pro 3 -* Windows 8.1 - - -## Related topics - -[Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md) - -[Using the Surface Deployment Accelerator deployment share](using-the-sda-deployment-share.md) - - diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md deleted file mode 100644 index e10b8209c9..0000000000 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ /dev/null @@ -1,410 +0,0 @@ ---- -title: Step by step Surface Deployment Accelerator (Surface) -description: This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices. -ms.assetid: A944FB9C-4D81-4868-AFF6-B9D1F5CF1032 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium -keywords: deploy, configure -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.date: 10/31/2019 ---- - -# Step by step: Surface Deployment Accelerator - -This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices. This article also contains instructions on how to perform these tasks without an Internet connection or without support for Windows Deployment Services network boot (PXE). - -> [!NOTE] -> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md). - -## How to install Surface Deployment Accelerator - -For information about prerequisites and instructions for how to download and install SDA, see [Microsoft Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md). - -1. Download SDA, which is included in [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) on the Microsoft Download Center. - -2. Run the SDA installation file, named **Surface\_Deployment\_Accelerator\_*xxxx*.msi**, where *xxxx* is the current version number. - -3. Accept the End User License Agreement (EULA) by selecting the check box, and then click **Install**, as shown in Figure 1. - - ![Surface Deployment Accelerator setup](images/sdasteps-fig1.png "Surface Deployment Accelerator setup") - - *Figure 1. SDA setup* - -4. Click **Finish** to complete the installation of SDA. - -The tool installs in the SDA program group, as shown in Figure 2. - -![SDA program group and icon](images/sdasteps-fig2.png "SDA program group and icon") - -*Figure 2. The SDA program group and icon* - ->[!NOTE] ->At this point, the tool has not yet prepared any deployment environment or downloaded any materials from the Internet. - -## Create a deployment share - -The following steps show you how to create a deployment share for Windows 10 that supports Surface 3, Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, the Surface Asset Tag Tool, and Office 365. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps. - ->[!NOTE] ->SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice. - -1. Open the SDA wizard by double-clicking the icon in the **Surface Deployment Accelerator** program group on the Start screen. - -2. On the **Welcome** page, click **Next** to continue. - -3. On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 2. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue. - - >[!NOTE] - >As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows: - > * Deployment tools - > * User State Migration Tool (USMT) - > * Windows Preinstallation Environment (WinPE) - - > [!NOTE] - > As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1. - -4. On the **Windows 8.1** page, to create a Windows 10 deployment share, do not select the **Would you like to support Windows 8.1** check box. Click **Next** to continue. - -5. On the **Windows 10** page, to create a Windows 10 deployment share, select the **Would you like to support Windows 10** check box. Supply the following information before you click **Next** to continue: - - - **Configure Deployment Share for Windows 10** - - - **Local Path** – Specify or browse to a location on the local storage device where you would like to store the deployment share files for the Windows 10 SDA deployment share. For example, **E:\\SDAWin10\\** is the location specified in Figure 3. - - - **Share Name** – Specify a name for the file share that will be used to access the deployment share on this server from the network. For example, **SDAWin10** is the deployment share name shown in Figure 3. The local path folder is automatically shared by the SDA scripts under this name to the group **Everyone** with a permission level of **Full Control**. - - - **Windows 10 Deployment Services** - - - Select the **Import boot media into the local Windows Deployment Service** check box if you would like to boot your Surface devices from the network to perform the Windows deployment. Windows Deployment Services must be installed and configured to respond to PXE boot requests. See [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx) for more information about how to configure Windows Deployment Services for PXE boot. - - - **Windows 10 Source Files** - - - **Local Path** – Specify or browse to the root directory of Windows 10 installation files. If you have an ISO file, mount it and browse to the root of the mounted drive. You must have a full set of source files, not just **Install.wim**. - - ![Specify Windows 10 deployment share options](images/sdasteps-fig3.png "Specify Windows 10 deployment share options") - - *Figure 3. Specify Windows 10 deployment share options* - -6. On the **Configure** page, select the check box next to each device or app that you want to include in your deployment share. Note that Surface Pro 4 and Surface Book only support Windows 10 and are not available for the deployment of Windows 8.1. The Surface Firmware Tool is only applicable to Surface 3 and Surface Pro 3 and cannot be selected unless Surface 3 or Surface Pro 3 drivers are selected, as shown in Figure 4. Click **Next** to continue. - - ![Firmware tool selection](images/sdasteps-fig4-select.png "Firmware tool selection") - - *Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers* - - >[!NOTE] - >You cannot select both Surface 3 and Surface 3 LTE models at the same time. - -7. On the **Summary** page confirm your selections and click **Finish** to begin the creation of your deployment share. The process can take several minutes as files are downloaded, the tools are installed, and the deployment share is created. While the SDA scripts are creating your deployment share, an **Installation Progress** window will be displayed, as shown in Figure 5. A typical SDA process includes: - - - Download of Windows ADK - - - Installation of Windows ADK - - - Download of MDT - - - Installation of MDT - - - Download of Surface apps and drivers - - - Creation of the deployment share - - - Import of Windows installation files into the deployment share - - - Import of the apps and drivers into the deployment share - - - Creation of rules and task sequences for Windows deployment - - ![The installation progress window](images/sdasteps-fig5-installwindow.png "The installation progress window") - - *Figure 5. The Installation Progress window* - - ### Optional: Workaround for Webclient exception - - You may see this error message while installing the latest version of ADK or MDT: _An exception occurred during a WebClient request._ This is due to incompatibility between the Surface Deployment Accelerator (SDA) and Background Intelligent Transfer Service (BITS). To work around this issue, do the following. - - In the two PowerShell scripts: - - ```PowerShell - %ProgramFiles%\Microsoft\Surface\Deployment Accelerator\Data\PowerShell\Install-MDT.ps1 - %ProgramFiles%\Microsoft\Surface\Deployment Accelerator\Data\PowerShell\INSTALL-WindowsADK.ps1 - ``` - - Edit the $BITSTransfer variable in the input parameters to $False as shown below: - - ```PowerShell - Param( - [Parameter( - Position=0, - Mandatory=$False, - HelpMessage="Download via BITS bool true/false" - )] - [string]$BITSTransfer = $False - ) - ``` - -8. When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices. - - ### Optional: Create a deployment share without an Internet connection - - If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver and app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6. - - >[!NOTE] - >All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step. - - >[!NOTE] - >The driver and app files do not need to be extracted from the downloaded .zip files. - - >[!NOTE] - >Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files. - - ![Specify Surface driver and app files](images/sdasteps-fig6-specify-driver-app-files.png "Specify Surface driver and app files") - - *Figure 6. Specify the Surface driver and app files from a local path* - - >[!NOTE] - >The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later. - - ### Optional: Prepare offline USB media - - You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection. - - >[!NOTE] - >The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended. - - Before you can create bootable media files within the MDT Deployment Workbench or copy those files to a USB drive, you must first configure that USB drive to be bootable. Using [DiskPart](https://go.microsoft.com/fwlink/p/?LinkId=761073), create a partition, format the partition as FAT32, and set the partition to be active. To run DiskPart, open an administrative PowerShell or Command Prompt window, and then run the following sequence of commands, as shown in Figure 7: - - 1. **diskpart** – Opens DiskPart to manage disks and partitions. - - 2. **list disk** – Displays a list of the disks available in your system; use this list to identify the disk number that corresponds with your USB drive. - - 3. **sel disk 2** – Selects your USB drive; use the number that corresponds with the disk in your system. - - 4. **clean** – Removes all configuration from your USB drive. - - >[!WARNING] - >This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command. - - 5. **create part pri** – Creates a primary partition on the USB drive. - - 6. **format fs=fat32 quick** – Formats the partition with the FAT32 file system, performing a quick format. FAT32 is required to boot the device from UEFI systems like Surface devices. - - 7. **assign** – Assigns the next available drive letter to the newly created FAT32 volume. - - 8. **active** – Sets the partition to be active, which is required to boot the volume. - - 9. **exit** – Exits DiskPart, after which you can close the PowerShell or Command Prompt window. - - ![Use DiskPart to prepare a USB drive for boot](images/sdasteps-fig7-diskpart.png "Use DiskPart to prepare a USB drive for boot") - - *Figure 7. Use DiskPart to prepare a USB drive for boot* - - >[!NOTE] - >You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly. - - After you have prepared the USB drive for boot, the next step is to generate offline media from the SDA deployment share. To create this media, follow these steps: - - 1. Open the **Deployment Workbench** from the **Microsoft Deployment Toolkit** group on your Start screen. - - 2. Expand the **Deployment Shares** node and the **Microsoft Surface Deployment Accelerator** deployment share. - - 3. Expand the folder **Advanced Configuration** and select the **Media** folder. - -4. Right-click the **Media** folder and click **New Media** as shown in Figure 8 to start the New Media Wizard. - - ![The Media folder of the SDA deployment share](images/sdasteps-fig8-mediafolder.png "The Media folder of the SDA deployment share") - - *Figure 8. The Media folder of the SDA deployment share* - - 5. On the **General Settings** page in the **Media path** field, enter or browse to a folder where you will create the files for the new offline media. See the example **E:\\SDAMedia** in Figure 9. Leave the default profile **Everything** selected in the **Selection profile** drop-down menu, and then click **Next**. - - ![Specify a location and selection profile for your offline media](images/sdasteps-fig9-location.png "Specify a location and selection profile for your offline media") - - *Figure 9. Specify a location and selection profile for your offline media* - - 6. On the **Summary** page verify your selections, and then click **Next** to begin creation of the media. - - 7. A **Progress** page is displayed while the media is created. - - 8. On the **Confirmation** page, click **Finish** to complete creation of the media. - - 9. Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab as shown in Figure 10. - - ![Rules of the SDA deployment share](images/sdasteps-fig10-rules.png "Rules of the SDA deployment share") - - *Figure 10. Rules of the SDA deployment share* - - 10. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+C** to copy the text. - - 11. Click **OK** to close the **Microsoft Surface Deployment Accelerator** deployment share properties. - - 12. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab. - - 13. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+V** to paste the text you copied from the **Microsoft Surface Deployment Accelerator** deployment share rules. - - 14. Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad. - - 15. Press **Ctrl+A** to select all of the text in the window, and then press **Ctrl+C** to copy the text. - - 16. Close Bootstrap.ini and click **OK** in **Microsoft Surface Deployment Accelerator** deployment share properties to close the window. - - 17. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad. - - 18. Press **Ctrl+A** to select all of the text in the window, then press **Ctrl+V** to paste the text from the SDA deployment share Bootstrap.ini file. - - 19. Delete the following lines from the Bootstrap.ini as shown in Figure 11, and then save the file: - - ```PowerShell - UserID= - UserDomain= - UserPassword= - DeployRoot=\\SDASERVER\SDAWin10 - UserID= - UserDomain= - UserPassword= - ``` - - ![The Bootstrap.ini file](images/sdasteps-fig11-bootstrap.ini.png "The Bootstrap.ini file") - - *Figure 11. The Bootstrap.ini file of MEDIA001* - - 20. Close Bootstrap.ini and click **OK** in **MEDIA001** deployment share properties to close the window. - - 21. In the **Deployment Workbench** under the **Media** folder, right-click the newly created **MEDIA001** and click **Update Media Content**, as shown in Figure 12. This will update the media files with the content of the **Microsoft Surface Deployment Accelerator** deployment share. - - ![Select the Update Media Content option](images/sdasteps-fig12-updatemedia.png "Select the Update Media Content option") - - *Figure 12. Select the Update Media Content option* - - 22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.** - - The final step is to copy the offline media files to your USB drive. - - 1. In File Explorer, open the path you specified in Step 5, for example **E:\\SDAMedia**. - - 2. Copy all of the files from the Content folder to the root of the USB drive. - - Your USB drive is now configured as bootable offline media that contains all of the resources required to perform a deployment to a Surface device. - -## SDA task sequences - -The SDA deployment share is configured with all of the resources required to perform a Windows deployment to a Surface device. These resources include Windows source files, image, Surface drivers, and Surface apps. The deployment share also contains two pre-configured task sequences, as shown in Figure 13. These task sequences contain the steps required to perform a deployment to a Surface device using the default Windows image from the installation media or to create a reference image complete with Windows updates and applications. To learn more about task sequences, see [MDT 2013 Update 2 Lite Touch components](https://technet.microsoft.com/itpro/windows/deploy/mdt-2013-lite-touch-components). - -![Task sequences in the Deployment Workbench](images/sdasteps-fig13-taskseq.png "Task sequences in the Deployment Workbench") - -*Figure 13. Task sequences in the Deployment Workbench* - -### Deploy Microsoft Surface - -The **1 – Deploy Microsoft Surface** task sequence is used to perform a complete deployment of Windows to a Surface device. This task sequence is pre-configured by the SDA wizard and is ready to perform a deployment as soon as the wizard completes. Running this task sequence on a Surface device deploys the unaltered Windows image copied directly from the Windows installation media you specified in the SDA wizard, along with the Surface drivers for your device. The drivers for your Surface device will be automatically selected through the pre-configured deployment share rules. - -When you run the task sequence, you will be prompted to provide the following information: - -- A computer name - -- Your domain information and the credentials required to join the domain - -- A product key, if one is required - - >[!NOTE] - >If you are deploying the same version of Windows as the version that came on your device, no product key is required. - -- A time zone - -- An Administrator password - -The Surface apps you specified on the **Configure** page of the SDA wizard are automatically installed when you run this task sequence on a Surface device. - -### Create Windows reference image - -The **2 – Create Windows Reference Image** task sequence is used to perform a deployment to a virtual machine for the purpose of capturing an image complete with Windows Updates for use in a deployment to Surface devices. By installing Windows Updates in your reference image, you eliminate the need to download and install those updates on each deployed Surface device. The deployment process with an up-to-date image is significantly faster and more efficient than performing a deployment first and then installing Windows Updates on each device. - -Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations. - ->[!NOTE] ->Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and Microsoft Endpoint Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt). - -In addition to the information required by the **1 – Deploy Microsoft Surface** task sequence, you will also be prompted to capture an image when you run this task sequence on your reference virtual machine. The **Location** and **File name** fields are automatically populated with the proper information for your deployment share. All that you need to do is select the **Capture an image of this reference computer** option when you are prompted on the **Capture Image** page of the Windows Deployment Wizard. - -## Deployment to Surface devices - - -To perform a deployment from the SDA deployment share, follow this process on the Surface device: - -1. Boot the Surface device to MDT boot media for the SDA deployment share. You can do this over the network by using PXE boot, or from a USB drive as described in the [Optional: Prepare offline USB media](#optional) section of this article. - -2. Select the deployment share for the version of Windows you intend to deploy and enter your credentials when you are prompted. - -3. Select the task sequence you want to run, usually the **1 – Deploy Microsoft Surface** task sequence. - -4. Address the task sequence prompts to pick applications, supply a password, and so on. - -5. The task sequence performs the automated deployment using the options specified. - -### Boot the Surface device from the network - -To boot the Surface device from the network, the Microsoft Surface Deployment Accelerator wizard must have been run on a Windows Server 2012 R2 or later environment that was configured with the Windows Deployment Services (WDS). WDS must have been configured to respond to network boot (PXE boot) requests and the boot files must have been imported into WDS. The SDA wizard will import these file automatically if the **Import boot media into the local Windows Deployment Service** check box was selected on the page for the version of Windows you intend to deploy. - -To boot the Surface device from the network, you must also use a Microsoft Surface Ethernet Adapter or the Ethernet port on a Microsoft Surface Dock. Third-party Ethernet adapters are not supported for network boot (PXE boot). A keyboard is also required. Both the Microsoft Surface Type Cover and keyboards connected via USB to the device or dock are supported. - -To instruct your Surface device to boot from the network, start with the device powered off and follow these steps: - -1. Press and hold the **Volume Down** button, press and release the **Power** button. Continue holding the **Volume Down** button until the device has begun to boot from the network. - -2. Press **Enter** when prompted by the dialog on the screen. This prompt indicates that your device has found the WDS PXE server over the network. - -3. If you have configured more than one deployment share on this device, you will be prompted to select between the boot images for each deployment share. For example, if you created both a Windows 10 and a Windows 8.1 deployment share, you will be prompted to choose between these two options. - -4. Enter the domain credentials that you use to log on to the server where SDA is installed when you are prompted, as shown in Figure 14. - - ![Prompt for credentials to the deployment share](images/sdasteps-fig14-credentials.png "Prompt for credentials to the deployment share") - - *Figure 14. The prompt for credentials to the deployment share* - -5. The Windows Deployment Wizard will start from the deployment share to walk you through the deployment process. - -### Alternatively boot the devices from the USB stick - -To boot a device from the USB stick: - -1. Press and hold the **Volume Down** button, press and release the **Power** button. Continue holding the **Volume Down** button until the device has begun to boot from the USB drive. - -2. The Windows Deployment Wizard will start from the deployment share to walk you through the deployment process. - -### Run the Deploy Microsoft Surface task sequence - -To run the Deploy Microsoft Surface task sequence: - -1. On the **Task Sequence** page, select the **1 – Deploy Microsoft Surface** task sequence as shown in Figure 15, and then click **Next.** - - ![Select the task sequence](images/sdasteps-fig15-deploy.png "Select the task sequence") - - *Figure 15. Select the 1 – Deploy Microsoft Surface task sequence* - -2. On the **Computer Details** page, type a name for the Surface device in the **Computer Name** box. In the **Join a domain** section, type your domain name and credentials as shown in Figure 16, and then click **Next**. - - ![Computer name and domain credentials](images/sdasteps-fig16-computername.png "Computer name and domain credentials") - - *Figure 16. Enter the computer name and domain information* - -3. On the **Product Key** page, keep the **No product key is required** check box selected if you are deploying the same version and edition of Windows to your Surface devices as they came with from the factory. If you are deploying a different version or edition of Windows to the device, such as Windows Enterprise, select the licensing option that is applicable to your scenario. - -4. On the **Locale and Time** page, select your desired **Language Settings** and **Time Zone**, and then click **Next.** - -5. On the **Administrator Password** page, type a password for the local Administrator account on the Surface device, and then click **Next.** - -6. On the **BitLocker** page, select the **Enable BitLocker** option along with your desired configuration of BitLocker protectors if you want to encrypt the device. Otherwise, keep the **Do not enable BitLocker for this computer** check box selected, and then click **Next.** - -7. On the **Ready** page, verify your selections and then click **Begin** to start the automated deployment to this device. The deployment will not require user interaction again. The Windows Deployment Wizard will close and an **Installation Progress** window is displayed to show progress of the task sequence as the image is applied and applications are installed (Figure 17). - - ![Installation progress window](images/sdasteps-fig17-installprogresswindow.png "Installation progress window") - - *Figure 17. The Installation Progress window* - -8. When the deployment task sequence completes, a **Success** window is displayed. Click **Finish** to complete the deployment and begin using your Surface device. diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md deleted file mode 100644 index ab4c3a46c4..0000000000 --- a/devices/surface/support-solutions-surface.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Top support solutions for Surface devices in the enterprise -description: Find top solutions for common issues using Surface devices in the enterprise. -ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A -ms.reviewer: -manager: laurawi -keywords: Troubleshoot common problems, setup issues -ms.prod: w10 -ms.mktglfcycl: support -ms.sitesec: library -ms.pagetype: surfacehub -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.date: 09/26/2019 -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Top support solutions for Surface devices - -> [!Note] -> **Home users**: This article is only intended for use by IT professionals and technical support agents, and applies only to Surface devices. If you're looking for help with a problem with your home device, please see [Surface Devices Help](https://support.microsoft.com/products/surface-devices). - -These are the Microsoft Support solutions for common issues you may experience using Surface devices in an enterprise. If your issue is not listed here, [contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection). - -## Surface Drivers and Firmware - -Microsoft regularly releases both updates and solutions for Surface devices. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface devices updated. - -- [Surface update history](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) -- [Install Surface and Windows updates](https://www.microsoft.com/surface/support/performance-and-maintenance/install-software-updates-for-surface?os=windows-10&=undefined) -- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482) -- [Deploy the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) -- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates) -- [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906) - -## Surface Dock Issues - -- [Troubleshoot Surface Dock and docking stations](https://support.microsoft.com/help/4023468/surface-troubleshoot-surface-dock-and-docking-stations) - -- [Troubleshoot connecting Surface to a second screen](https://support.microsoft.com/help/4023496) - -- [Microsoft Surface Dock Firmware Update](https://docs.microsoft.com/surface/surface-dock-updater) - -## Device cover or keyboard issues - -- [Troubleshoot your Surface Type Cover or keyboard](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-surface-keyboards) - -## Screen cracked or scratched issues - -- [Contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection) - -## Surface Power or battery Issues - -- [How to Charge Surface(Surface PSU information)](https://support.microsoft.com/help/4023496) - -- [Surface battery won’t charge or Surface won’t run on battery](https://support.microsoft.com/help/4023536) - -- [Surface won’t turn on or wake from sleep](https://support.microsoft.com/help/4023537) - -- [Maximize your Surface battery life](https://support.microsoft.com/help/4483194) - -## Reset device - -- [Creating and using a USB recovery drive for Surface](https://support.microsoft.com/help/4023512) - -- [FAQ: Protecting your data if you send your Surface in for Service](https://support.microsoft.com/help/4023508) - -- [Microsoft Surface Data Eraser](https://docs.microsoft.com/surface/microsoft-surface-data-eraser) - -## Deployment Issues - -- [DISK0 not found when you deploy Windows on Surface Pro Model 1796 or Surface Laptop](https://support.microsoft.com/help/4046108) - -- [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/help/4046105) - -- [System SKU reference](https://docs.microsoft.com/surface/surface-system-sku-reference) diff --git a/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md b/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md deleted file mode 100644 index 044b0e0437..0000000000 --- a/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Surface device compatibility with Windows 10 Long-Term Servicing Channel (Surface) -description: Find out about compatibility and limitations of Surface devices running Windows 10 Enterprise LTSB edition. -keywords: ltsb, update, surface servicing options -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro -ms.reviewer: scottmca -manager: laurawi ---- - -# Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC) - -Surface devices are designed to provide best-in-class experiences in productivity and general-purpose scenarios. Regular updates enable Surface devices to bring to life new innovations and to evolve with the new capabilities delivered by Windows 10 Feature Updates. Feature Updates are available only in Windows 10 Pro or Windows 10 Enterprise editions that receive continuous updates through the Semi-Annual Channel (SAC). - -In contrast to the SAC servicing option, formerly known as the Current Branch (CB) or Current Branch for Business (CBB) servicing options, you cannot select the Long-Term Servicing Channel (LTSC) option in Windows 10 settings. To use the LTSC servicing option, you must install a separate edition of Windows 10 Enterprise, known as Windows 10 Enterprise LTSC, formerly known as Windows 10 Enterprise LTSB (Long-Term Servicing Branch. In addition to providing an extended servicing model, the Windows 10 Enterprise LTSC edition also provides an environment with several Windows components removed. The core Surface experiences that are impacted by LTSC include: - -* Windows Feature Updates, including enhancements such as: - - * Improvements to Direct Ink and palm rejection provided in Windows 10, version 1607 (also referred to as the Anniversary Update) - * Improved support for high DPI applications provided in Windows 10, version 1703 (also referred to as the Creators Update) - -* Pressure sensitivity settings provided by the Surface app - -* The Windows Ink Workspace - -* Key touch-optimized in-box applications including Microsoft Edge, OneNote, Calendar, and Camera - -The use of the Windows 10 Enterprise LTSC environment on Surface devices results in sub-optimal end-user experiences and you should avoid using it in environments where users want and expect a premium, up-to-date user experience. - -The LTSC servicing option is designed for device types and scenarios where the key attribute is for features or functionality to never change. Examples include systems that power manufacturing or medical equipment, or embedded systems in kiosks, such as ATMs or airport ticketing systems. - ->[!NOTE] ->For general information about Windows servicing branches, including LTSC, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/update/waas-overview#long-term-servicing-branch). - -As a general guideline, devices that fulfill the following criteria are considered general-purpose devices and should be paired with Windows 10 Pro or Windows 10 Enterprise using the Semi-Annual Channel servicing option: - -* Devices that run productivity software such as Microsoft Office - -* Devices that use Microsoft Store applications - -* Devices that are used for general Internet browsing (for example, research or access to social media) - -Before you choose to use Windows 10 Enterprise LTSC edition on Surface devices, consider the following limitations: - -* Driver and firmware updates are not explicitly tested against releases of Windows 10 Enterprise LTSC. - -* If you encounter problems, Microsoft Support will provide troubleshooting assistance. However, due to the servicing nature of the Windows LTSC, issue resolution may require that devices be upgraded to a more recent version of Windows 10 Enterprise LTSC, or to Windows 10 Pro or Enterprise with the SAC servicing option. - -* Surface device replacements (for example, devices replaced under warranty) may contain subtle variations in hardware components that require updated device drivers and firmware. Compatibility with these updates may require the installation of a more recent version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise with the SAC servicing option. - ->[!NOTE] ->Organizations that standardize on a specific version of Windows 10 Enterprise LTSC may be unable to adopt new generations of Surface hardware such as Surface Pro 7, Surface Pro X, or Surface Laptop 3 without also updating to a later version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise. For more information, see the **How will Windows 10 LTSBs be supported?** topic in the **Supporting the latest processor and chipsets on Windows** section of [Lifecycle Policy FAQ—Windows products](https://support.microsoft.com/help/18581/lifecycle-policy-faq-windows-products#b4). - -Surface devices running Windows 10 Enterprise LTSC edition will not receive new features. In many cases these features are requested by customers to improve the usability and capabilities of Surface hardware. For example, new improvements for High DPI applications in Windows 10, version 1703. Customers that use Surface devices in the LTSC configuration will not see the improvements until they either update to a new Windows 10 Enterprise LTSC release or upgrade to a version of Windows 10 with support for the SAC servicing option. - -Devices can be changed from Windows 10 Enterprise LTSC to a more recent version of Windows 10 Enterprise, with support for the SAC servicing option, without the loss of user data by performing an upgrade installation. You can also perform an upgrade installation on multiple devices by leveraging the Upgrade Task Sequence Templates available in the Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager. For more information, see [Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/upgrade-surface-devices-to-windows-10-with-mdt). diff --git a/devices/surface/surface-diagnostic-toolkit-business.md b/devices/surface/surface-diagnostic-toolkit-business.md deleted file mode 100644 index 11a032fb45..0000000000 --- a/devices/surface/surface-diagnostic-toolkit-business.md +++ /dev/null @@ -1,199 +0,0 @@ ---- -title: Deploy Surface Diagnostic Toolkit for Business -description: This topic explains how to use the Surface Diagnostic Toolkit for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.localizationpriority: medium -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.date: 10/31/2019 -ms.reviewer: hachidan -manager: laurawi -ms.audience: itpro ---- - -# Deploy Surface Diagnostic Toolkit for Business - -The Microsoft Surface Diagnostic Toolkit for Business (SDT) enables IT administrators to quickly investigate, troubleshoot, and resolve hardware, software, and firmware issues with Surface devices. You can run a range of diagnostic tests and software repairs in addition to obtaining device health insights and guidance for resolving issues. - -Specifically, SDT for Business enables you to: - -- [Customize the package.](#create-custom-sdt) -- [Run the app using commands.](surface-diagnostic-toolkit-command-line.md) -- [Run multiple hardware tests to troubleshoot issues.](surface-diagnostic-toolkit-desktop-mode.md#multiple) -- [Generate logs for analyzing issues.](surface-diagnostic-toolkit-desktop-mode.md#logs) -- [Obtain detailed report comparing device vs optimal configuration.](surface-diagnostic-toolkit-desktop-mode.md#detailed-report) - - -## Primary scenarios and download resources - -To run SDT for Business, download the components listed in the following table. - - -Mode | Primary scenarios | Download | Learn more ---- | --- | --- | --- -Desktop mode | Assist users in running SDT on their Surface devices to troubleshoot issues.
Create a custom package to deploy on one or more Surface devices allowing users to select specific logs to collect and analyze. | SDT distributable MSI package:
Microsoft Surface Diagnostic Toolkit for Business Installer
[Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) | [Use Surface Diagnostic Toolkit in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) -Command line | Directly troubleshoot Surface devices remotely without user interaction, using standard tools such as Configuration Manager. It includes the following commands:
`-DataCollector` collects all log files
`-bpa` runs health diagnostics using Best Practice Analyzer.
`-windowsupdate` checks Windows Update for missing firmware or driver updates.
`-warranty` checks warranty information.

| SDT console app:
Microsoft Surface Diagnostics App Console
[Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) | [Run Surface Diagnostic Toolkit using commands](surface-diagnostic-toolkit-command-line.md) - -## Supported devices - -SDT for Business is supported on Surface 3 and later devices, including: - -- Surface Pro 7 -- Surface Laptop 3 -- Surface Pro 6 -- Surface Laptop 2 -- Surface Go -- Surface Go with LTE -- Surface Book 2 -- Surface Pro with LTE Advanced (Model 1807) -- Surface Pro (Model 1796) -- Surface Laptop -- Surface Studio -- Surface Studio 2 -- Surface Book -- Surface Pro 4 -- Surface 3 LTE -- Surface 3 -- Surface Pro 3 - -## Installing Surface Diagnostic Toolkit for Business - -To create an SDT package that you can distribute to users in your organization: - -1. Sign in to your Surface device using the Administrator account. -2. Download SDT Windows Installer Package (.msi) from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703) and copy it to a preferred location on your Surface device, such as Desktop. -3. The SDT setup wizard appears, as shown in figure 1. Click **Next**. - - >[!NOTE] - >If the setup wizard does not appear, ensure that you are signed into the Administrator account on your computer. - - ![welcome to the Surface Diagnostic Toolkit setup wizard](images/sdt-1.png) - - *Figure 1. Surface Diagnostic Toolkit setup wizard* - -4. When the SDT setup wizard appears, click **Next**, accept the End User License Agreement (EULA) - -5. On the Install Options screen, change the default install location if desired. -6. Under Setup Type, select **Advanced**. - - >[!NOTE] - >The standard option allows users to run the diagnostic tool directly on their Surface device provided they are signed into their device using an Administrator account. - - ![Install Options: Advanced](images/sdt-install.png) - -7. Click **Next** and then click **Install**. - -## Installing using the command line -If desired, you can install SDT at a command prompt and set a custom flag to install the tool in admin mode. SDT contains the following install option flags: - -- `SENDTELEMETRY` sends telemetry data to Microsoft. The flag accepts `0` for disabled or `1` for enabled. The default value is `1` to send telemetry. -- `ADMINMODE` configures the tool to be installed in admin mode. The flag accepts `0` for client mode or `1` for IT Administrator mode. The default value is `0`. - -### To install SDT from the command line: - -1. Open a command prompt and enter: - - ``` - msiexec.exe /i ADMINMODE=1. - ``` - **Example:** - - ``` - C:\Users\Administrator> msiexec.exe/I"C:\Users\Administrator\Desktop\Microsoft_Surface_Diagnostic_Toolkit_for_Business_Installer.msi" ADMINMODE=1 - ``` - -## Locating SDT on your Surface device - -Both SDT and the SDT app console are installed at `C:\Program Files\Microsoft\Surface\Microsoft Surface Diagnostic Toolkit for Business`. - -In addition to the .exe file, SDT installs a JSON file and an admin.dll file (modules\admin.dll), as shown in figure 2. - -![list of SDT installed files in File Explorer](images/sdt-2.png) - -*Figure 2. Files installed by SDT* - - -## Preparing the SDT package for distribution - -Creating a custom package allows you to target the tool to specific known issues. - -1. Click **Start > Run**, enter **Surface** and then click **Surface Diagnostic Toolkit for Business**. -2. When the tool opens, click **Create Custom Package**, as shown in figure 3. - - ![Create custom package option](images/sdt-3.png) - - *Figure 3. Create custom package* - -### Language and telemetry settings - - When creating a package, you can select language settings or opt out of sending telemetry information to Microsoft. By default, SDT sends telemetry to Microsoft that is used to improve the application in accordance with the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). If you wish to decline, clear the check box when creating a custom package, as shown below. Or clear the **Send telemetry to Microsoft** check box on the **Install Options** page during SDT Setup. - ->[!NOTE] ->This setting does not affect the minimal telemetry automatically stored on Microsoft servers when running tests and repairs that require an Internet connection, such as Windows Update and Software repair, or providing feedback using the Smile or Frown buttons in the app toolbar. - - -![Select language and telemetry settings](images/sdt-4.png) - -*Figure 4. Select language and telemetry settings* - - -### Windows Update page - -Select the option appropriate for your organization. Most organizations with multiple users will typically select to receive updates via Windows Server Update Services (WSUS), as shown in figure 5. If using local Windows Update packages or WSUS, enter the path as appropriate. - -![Select Windows Update option](images/sdt-5.png) - -*Figure 5. Windows Update option* - -### Software repair page - -This allows you to select or remove the option to run software repair updates. - -![Select software repair option](images/sdt-6.png) - -*Figure 6. Software repair option* - -### Collecting logs and saving package page - -You can select to run a wide range of logs across applications, drivers, hardware, and the operating system. Click the appropriate area and select from the menu of available logs. You can then save the package to a software distribution point or equivalent location that users can access. - -![Select log options](images/sdt-7.png) - -*Figure 7. Log option and save package* - -## Next steps - -- [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) -- [Use Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) - -## Changes and updates -### Version 2.43.139.0 -*Release date: October 21, 2019*
-This version of Surface Diagnostic Toolkit for Business adds support for the following: - -- Surface Pro 7 -- Surface Laptop 3 - -### Version 2.42.139.0 -*Release date: September 24, 2019*
-This version of Surface Diagnostic Toolkit for Business adds support for the following: -- Ability to download hardware reports. -- Ability to contact Microsoft Support directly from the tool.
- -### Version 2.41.139.0 -*Release date: June 24, 2019*
-This version of Surface Diagnostic Toolkit for Business adds support for the following: -- Driver version information included in logs and report. -- Ability to provide feedback about the app.
- - -### Version 2.36.139.0 -*Release date: April 26, 2019*
-This version of Surface Diagnostic Toolkit for Business adds support for the following: -- Advanced Setup option to unlock admin capabilities through the installer UI, without requiring command line configuration. -- Accessibility improvements. -- Surface brightness control settings included in logs. -- External monitor compatibility support link in report generator. diff --git a/devices/surface/surface-diagnostic-toolkit-command-line.md b/devices/surface/surface-diagnostic-toolkit-command-line.md deleted file mode 100644 index 035eec60da..0000000000 --- a/devices/surface/surface-diagnostic-toolkit-command-line.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: Run Surface Diagnostic Toolkit for Business using commands -description: How to run Surface Diagnostic Toolkit in a command console -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: hachidan -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Run Surface Diagnostic Toolkit for Business using commands - -Running the Surface Diagnostic Toolkit (SDT) at a command prompt requires downloading the STD app console. After it's installed, you can run SDT at a command prompt via the Windows command console (cmd.exe) or using Windows PowerShell, including PowerShell Integrated Scripting Environment (ISE), which provides support for autocompletion of commands, copy/paste, and other features. For a list of supported Surface devices in SDT, refer to [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md). - ->[!NOTE] ->To run SDT using commands, you must be signed in to the Administrator account or signed in to an account that is a member of the Administrator group on your Surface device. - -## Running SDT app console - -Download and install SDT app console from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703). You can use the Windows command prompt (cmd.exe) or Windows PowerShell to: - -- Collect all log files. -- Run health diagnostics using Best Practice Analyzer. -- Check update for missing firmware or driver updates. - ->[!NOTE] ->In this release, the SDT app console supports single commands only. Running multiple command line options requires running the console exe separately for each command. - -By default, output files are saved in the same location as the console app. Refer to the following table for a complete list of commands. - -Command | Notes ---- | --- --DataCollector "output file" | Collects system details into a zip file. "output file" is the file path to create system details zip file.

**Example**:
`Microsoft.Surface.Diagnostics.App.Console.exe -DataCollector SDT_DataCollection.zip` --bpa "output file" | Checks several settings and health indicators in the device. “output file" is the file path to create the HTML report.

**Example**:
`Microsoft.Surface.Diagnostics.App.Console.exe -bpa BPA.html` --windowsupdate | Checks Windows Update online servers for missing firmware and/or driver updates.

**Example**:
Microsoft.Surface.Diagnostics.App.Console.exe -windowsupdate --warranty "output file" | Checks warranty information on the device (valid or invalid). The optional “output file” is the file path to create the xml file.

**Example**:
Microsoft.Surface.Diagnostics.App.Console.exe –warranty “warranty.xml” - - ->[!NOTE] ->To run the SDT app console remotely on target devices, you can use a configuration management tool such as Microsoft Endpoint Configuration Manager. Alternatively, you can create a .zip file containing the console app and appropriate console commands and deploy per your organization’s software distribution processes. - -## Running Best Practice Analyzer - -You can run BPA tests across key components such as BitLocker, Secure Boot, and Trusted Platform Module (TPM) and then output the results to a shareable file. The tool generates a series of tables with color-coded headings and condition descriptors along with guidance about how to approach resolving the issue. - -- Green indicates the component is running in an optimal condition (optimal). -- Orange indicates the component is not running in an optimal condition (not optimal). -- Red indicates the component is in an abnormal state. - -### Sample BPA results output - - - - - - - -
BitLocker
Description:Checks if BitLocker is enabled on the system drive.
Value:Protection On
Condition:Optimal
Guidance:It is highly recommended to enable BitLocker to protect your data.
- - - - - - - -
Secure Boot
Description:Checks if Secure Boot is enabled.
Value:True
Condition:Optimal
Guidance:It is highly recommended to enable Secure Boot to protect your PC.
- - - - - - - -
Trusted Platform Module
Description:Ensures that the TPM is functional.
Value:True
Condition:Optimal
Guidance:Without a functional TPM, security-based functions such as BitLocker may not work properly.
- - - - - - - -
Connected Standby
Description:Checks if Connected Standby is enabled.
Value:True
Condition:Optimal
Guidance:Connected Standby allows a Surface device to receive updates and notifications while not being used. For best experience, Connected Standby should be enabled.
- - - - - - - -
Bluetooth
Description:Checks if Bluetooth is enabled.
Value:Enabled
Condition:Optimal
Guidance:
- - - - - - - -
Debug Mode
Description:Checks if the operating system is in Debug mode.
Value:Normal
Condition:Optimal
Guidance:The debug boot option enables or disables kernel debugging of the Windows operating system. Enabling this option can cause system instability and can prevent DRM (digital rights managemend) protected media from playing.
- - - - - - - -
Test Signing
Description:Checks if Test Signing is enabled.
Value:Normal
Condition:Optimal
Guidance:Test Signing is a Windows startup setting that should only be used to test pre-release drivers.
- - - - - - - -
Active Power Plan
Description:Checks that the correct power plan is active.
Value:Balanced
Condition:Optimal
Guidance:It is highly recommended to use the "Balanced" power plan to maximize productivity and battery life.
- - - - - - - -
Windows Update
Description:Checks if the device is up to date with Windows updates.
Value:Microsoft Silverlight (KB4023307), Definition Update for Windows Defender Antivirus - KB2267602 (Definition 1.279.1433.0)
Condition:Not Optimal
Guidance:Updating to the latest windows makes sure you are on the latest firmware and drivers. It is recommended to always keep your device up to date
- - - - - - - -
Free Hard Drive Space
Description:Checks for low free hard drive space.
Value:66%
Condition:Optimal
Guidance:For best performance, your hard drive should have at least 10% of its capacity as free space.
- - - - - - - -
Non-Functioning Devices
Description:List of non-functioning devices in Device Manager.
Value:
Condition:Optimal
Guidance:Non-functioning devices in Device Manager may cause unpredictable problems with Surface devices such as, but not limited to, no power savings for the respective hardware component.
- - - - - - - -
External Monitor
Description:Checks for an external monitor that may have compatibility issues.
Value:
Condition:Optimal
Guidance:Check with the original equipment manufacturer for compatibility with your Surface device.
diff --git a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md deleted file mode 100644 index 795bff7f7f..0000000000 --- a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Use Surface Diagnostic Toolkit for Business in desktop mode -description: How to use SDT to help users in your organization run the tool to identify and diagnose issues with the Surface device. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: hachidan -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Use Surface Diagnostic Toolkit for Business in desktop mode - -This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help users in your organization run the tool to identify and diagnose issues with the Surface device. Successfully running SDT can quickly determine if a reported issue is caused by failed hardware or user error. For a list of supported Surface devices in SDT, refer to [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md). - - -1. Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. - -2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1. - - ![Start SDT in desktop mode](images/sdt-desk-1.png) -*Figure 1. SDT in desktop mode* - -3. When SDT indicates the device has the latest updates, click **Continue** to advance to the catalog of available tests, as shown in figure 2. - - ![Select from SDT options](images/sdt-desk-2.png) -*Figure 2. Select from SDT options* - -4. You can choose to run all the diagnostic tests. Or, if you already suspect a particular issue such as a faulty display or a power supply problem, click **Select** to choose from the available tests and click **Run Selected**, as shown in figure 3. See the following table for details of each test. - - ![Select hardware tests](images/sdt-desk-3.png) -*Figure 3. Select hardware tests* - - Hardware test | Description - --- | --- - Power Supply and Battery | Checks Power supply is functioning optimally - Display and Sound | Checks brightness, stuck or dead pixels, speaker and microphone functioning - Ports and Accessories | Checks accessories, screen attach and USB functioning - Connectivity | Checks Bluetooth, wireless and LTE connectivity - Security | Checks security related issues - Touch | Checks touch related issues - Keyboard and touch | Checks integrated keyboard connection and type cover - Sensors | Checks functioning of different sensors in the device - Hardware | Checks issues with different hardware components such as graphics card and camera - - - - - - - -## Running multiple hardware tests to troubleshoot issues - -SDT is designed as an interactive tool that runs a series of tests. For each test, SDT provides instructions summarizing the nature of the test and what users should expect or look for in order for the test to be successful. For example, to diagnose if the display brightness is working properly, SDT starts at zero and increases the brightness to 100 percent, asking users to confirm – by answering **Yes** or **No** -- that brightness is functioning as expected, as shown in figure 4. - -For each test, if functionality does not work as expected and the user clicks **No**, SDT generates a report of the possible causes and ways to troubleshoot it. - -![Running hardware diagnostics](images/sdt-desk-4.png) -*Figure 4. Running hardware diagnostics* - -1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. -2. If the brightness fails to adjust from 0-100 percent as expected, direct the user to click **No** and then click **Continue**. -3. Guide users through remaining tests as appropriate. When finished, SDT automatically provides a high-level summary of the report, including the possible causes of any hardware issues along with guidance for resolution. - - -### Repairing applications - -SDT enables you to diagnose and repair applications that may be causing issues, as shown in figure 5. - -![Running repairs](images/sdt-desk-5.png) -*Figure 5. Running repairs* - - -### Generating logs for analyzing issues - -SDT provides extensive log-enabled diagnosis support across applications, drivers, hardware, and operating system issues, as shown in figure 6. - -![Generating logs](images/sdt-desk-6.png) -*Figure 6. Generating logs* - - - -### Generating detailed report comparing device vs. optimal configuration - -Based on the logs, SDT generates a report for software- and firmware-based issues that you can save to a preferred location. - -## Related topics - -- [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) - diff --git a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md b/devices/surface/surface-diagnostic-toolkit-for-business-intro.md deleted file mode 100644 index 2b19282899..0000000000 --- a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Fix common Surface problems using the Surface Diagnostic Toolkit for Business -description: This page provides an introduction to the Surface Diagnostic Toolkit for Business for use in commercial environments. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: cottmca -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Fix common Surface problems using the Surface Diagnostic Toolkit for Business - -If your Surface isn’t working properly, the Microsoft Surface Diagnostic Toolkit for Business can help you or your administrator find and solve problems. - -> [!NOTE] -> Surface Diagnostic Toolkit for Business is built for commercial devices. If your device is a personal device and not managed by your work or school run the [Surface Diagnostic Toolkit](https://support.microsoft.com/en-us/help/4037239/surface-fix-common-surface-problems-using-surface-diagnostic-toolkit) instead. - -## Run the Surface Diagnostic Toolkit for Business - -Before you run the diagnostic tool, make sure you have the latest Windows updates. Go to [Install Surface and Windows 10 updates](https://support.microsoft.com/en-us/help/4023505/surface-install-surface-and-windows-updates) for more information. If that doesn't solve the problem, you'll need to run the diagnostic tool. - -> [!NOTE] -> The Surface Diagnostic Toolkit for Business only works on Surface devices running Windows 10. It does not work on Surface Pro, Surface Pro 2, or Surface devices configured in S mode. - -**To run the Surface Diagnostic Toolkit for Business:** - -1. Download the Surface Diagnostic Toolkit for Business. To do this, go to the [**Surface Tools for IT** download page](https://www.microsoft.com/download/details.aspx?id=46703), choose **Download**, select **Surface Diagnostic Toolkit for Business** from the provided list, and choose **Next**. -2. Select Run and follow the on-screen instructions. For full details, refer to [Deploy Surface Diagnostic Toolkit for Business](https://docs.microsoft.com/surface/surface-diagnostic-toolkit-business). - -The diagnosis and repair time averages 15 minutes but could take an hour or longer, depending on internet connection speed and the number of updates or repairs required. - -## If you still need help - -If the Surface Diagnostic Toolkit for Business didn’t fix the problem, you can also: - -- Make an in-store appointment: We might be able to fix the problem or provide a replacement Surface at your local Microsoft Store. [Locate a Microsoft Store near you](https://www.microsoft.com/store/locations/find-a-store?WT.mc_id=MSC_Solutions_en_us_scheduleappt). -- Contact customer support: If you want to talk to someone about how to fix your problem, [contact us](https://support.microsoft.com/en-us/help/4037645/contact-surface-warranty-and-software-support-for-business). -- Get your Surface serviced: If your Surface product needs service, [request it online](https://mybusinessservice.surface.com/). diff --git a/devices/surface/surface-dock-firmware-update.md b/devices/surface/surface-dock-firmware-update.md deleted file mode 100644 index 26264b1509..0000000000 --- a/devices/surface/surface-dock-firmware-update.md +++ /dev/null @@ -1,235 +0,0 @@ ---- -title: Microsoft Surface Dock Firmware Update - Technical information for IT administrators -description: This article explains how to use Microsoft Surface Dock Firmware Update to update Surface Dock firmware. When installed on your Surface device, it will update any Surface Dock attached to your Surface device. -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: greg-lindsay -ms.author: greglin -ms.topic: article -ms.reviewer: scottmca -manager: laurawi -ms.audience: itpro ---- -# Microsoft Surface Dock Firmware Update: Technical information for IT administrators - -> [!IMPORTANT] -> This article contains technical instructions for IT administrators. If you are a home user, please see [How to update your Surface Dock Firmware](https://support.microsoft.com/help/4023478/surface-update-your-surface-dock) on the Microsoft Support site. The instructions at the support site are the same as the general installation steps below, but this article has additional information for monitoring, verifying, and deploying the update to multiple devices on a network. - -This article explains how to use Microsoft Surface Dock Firmware Update to update Surface Dock firmware. When installed on your Surface device, it will update any Surface Dock attached to your Surface device. - -This tool supersedes the earlier Microsoft Surface Dock Updater tool, previously available for download as part of Surface Tools for IT. The earlier tool was named Surface_Dock_Updater_vx.xx.xxx.x.msi (where x indicates the version number) and is no longer available for download and should not be used. - -## Install the Surface Dock Firmware Update - -This section describes how to manually install the firmware update. - -> [!NOTE] -> Microsoft periodically releases new versions of Surface Dock Firmware Update. The MSI file is not self-updating. If you have deployed the MSI to Surface devices and a new version of the firmware is released, you will need to deploy the new version. - -1. Download and install [Microsoft Surface Dock Firmware Update](https://www.microsoft.com/download/details.aspx?id=46703). - - The update requires a Surface device running Windows 10, version 1803 or later. - - Installing the MSI file might prompt you to restart Surface. However, restarting is not required to perform the update. - -2. Disconnect your Surface device from the Surface Dock (using the power adapter), wait ~5 seconds, and then reconnect. The Surface Dock Firmware Update will update the dock silently in background. The process can take a few minutes to complete and will continue even if interrupted. - -## Monitor the Surface Dock Firmware Update - -This section is optional and provides an overview of how to monitor installation of the firmware update. - -To monitor the update: - -1. Open Event Viewer, browse to **Windows Logs > Application**, and then under **Actions** in the right-hand pane click **Filter Current Log**, enter **SurfaceDockFwUpdate** next to **Event sources**, and then click **OK**. - -2. Type the following command at an elevated command prompt: - - ```cmd - Reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services\SurfaceDockFwUpdate\Parameters" - ``` -3. Install the update as described in the [next section](#install-the-surface-dock-firmware-update) of this article. -4. Event 2007 with the following text indicates a successful update: **Firmware update finished. hr=0 DriverTelementry EventCode = 2007**. - - If the update is not successful, then event ID 2007 will be displayed as an **Error** event rather than **Information**. Additionally, the version reported in the Windows Registry will not be current. -5. When the update is complete, updated DWORD values will be displayed in the Windows Registry, corresponding to the current version of the tool. See the [Versions reference](#versions-reference) section in this article for details. For example: - - Component10CurrentFwVersion 0x04ac3970 (78395760) - - Component20CurrentFwVersion 0x04915a70 (76634736) - ->[!TIP] ->If you see "The description for Event ID xxxx from source SurfaceDockFwUpdate cannot be found" in event text, this is expected and can be ignored. - -Also see the following sections in this article: - - [How to verify completion of firmware update](#how-to-verify-completion-of-the-firmware-update) - - [Event logging](#event-logging) - - [Troubleshooting tips](#troubleshooting-tips) - - [Versions reference](#versions-reference) - -## Network deployment - -You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firmware Update to multiple devices across your network. When using Microsoft Endpoint Configuration Manager or other deployment tool, enter the following syntax to ensure the installation is silent: - -- **Msiexec.exe /i \ /quiet /norestart** - - For example: - ``` - msiexec /i "\\share\folder\Surface_Dock_FwUpdate_1.42.139_Win10_17134_19.084.31680_0.msi" /quiet /norestart - ``` - - > [!NOTE] - > A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]". For example: Msiexec.exe /i \ /l*v %windir%\logs\ SurfaceDockFWI.log" - - For more information, refer to [Command line options](https://docs.microsoft.com/windows/win32/msi/command-line-options) documentation. - -> [!IMPORTANT] -> If you want to keep your Surface Dock updated using any other method, refer to [Update your Surface Dock](https://support.microsoft.com/help/4023478/surface-update-your-surface-dock) for details. - -## Intune deployment - -You can use Intune to distribute Surface Dock Firmware Update to your devices. First you will need to convert the MSI file to the .intunewin format, as described in the following documentation: [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps/apps-win32-app-management). - -Use the following command: - - **msiexec /i \ /quiet /q** - -## How to verify completion of the firmware update - -Surface dock firmware consists of two components: - -- **Component10:** Micro controller unit (MCU) firmware -- **Component20:** Display port (DP) firmware. - -Successful completion of Surface Dock Firmware Update results in new registry key values for these firmware components. - -**To verify updates:** - -1. Open Regedit and navigate to the following registry path: - - - **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services\SurfaceDockFwUpdate\Parameters** - -2. Look for the registry keys: **Component10CurrentFwVersion and Component20CurrentFwVersion**, which refer to the firmware that is currently on the device. - - ![Surface Dock Firmware Update installation process](images/regeditDock.png) - -3. Verify the new registry key values match the updated registry key values listed in the Versions reference at the end of this document. If the values match, the firmware was updated successfully. - -4. If unable to verify, review Event logging and Troubleshooting tips in the next section. - -## Event logging - -**Table 1. Log files for Surface Dock Firmware Update** - -| Log | Location | Notes | -| -------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Surface Dock Firmware Update log | Path needs to be specified (see note) | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. | -| Windows Device Install log | %windir%\inf\setupapi.dev.log | For more information about using Device Install Log, refer to [SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-) documentation. | - - -**Table 2. Event log IDs for Surface Dock Firmware Update**
-Events are logged in the Application Event Log. Note: Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater. - -| Event ID | Event type | -| -------- | -------------------------------------------------------------------- | -| 2001 | Dock firmware update has started. | -| 2002 | Dock firmware update skipped because dock is known to be up to date. | -| 2003 | Dock firmware update failed to get firmware version. | -| 2004 | Querying the firmware version. | -| 2005 | Dock firmware failed to start update. | -| 2006 | Failed to send offer/payload pairs. | -| 2007 | Firmware update finished. | -| 2008 | BEGIN dock telemetry. | -| 2011 | END dock telemetry. | - -## Troubleshooting tips - -- Completely disconnect power for Surface dock from the AC power to reset the Surface Dock. -- Disconnect all peripherals except for the Surface Dock. -- Uninstall any current Surface Dock Firmware Update and then install the latest version. -- Ensure that the Surface Dock is disconnected, and then allow enough time for the update to complete as monitored via an LED in the Ethernet port of the dock. Wait until the LED stops blinking before you unplug Surface Dock from power. -- Connect the Surface Dock to a different device to see if it is able to update the dock. - -## Versions reference - ->[!NOTE] ->The installation file is released with the following naming format: **Surface_Dock_FwUpdate_X.XX.XXX_Win10_XXXXX_XX.XXX.XXXXX_X.MSI** (ex: Surface_Dock_FwUpdate_1.42.139_Win10_17134_19.084.31680_0.msi) and installs by default to C:\Program Files\SurfaceUpdate. - -### Version 1.42.139 -*Release Date: September 18 2019* - -This version, contained in Surface_Dock_FwUpdate_1.42.139_Win10_17134_19.084.31680_0.MSI, updates firmware in the background. -**Updated registry key values:**
- -- Component10CurrentFwVersion updated to **4ac3970**. -- Component20CurrentFwVersion updated to **4a1d570**. - -It adds support for Surface Pro 7 and Surface Laptop 3. - -## Legacy versions - -### Version 2.23.139.0 -*Release Date: 10 October 2018* - -This version of Surface Dock Updater adds support for the following: - -- Add support for Surface Pro 6 -- Add support for Surface Laptop 2 - - -### Version 2.22.139.0 -*Release Date: 26 July 2018* - -This version of Surface Dock Updater adds support for the following: - -- Increase update reliability -- Add support for Surface Go - -### Version 2.12.136.0 -*Release Date: 29 January 2018* - -This version of Surface Dock Updater adds support for the following: -* Update for Surface Dock Main Chipset Firmware -* Update for Surface Dock DisplayPort Firmware -* Improved display stability for external displays when used with Surface Book or Surface Book 2 - -Additionally, installation of this version of Surface Dock Updater on Surface Book devices includes the following: -* Update for Surface Book Base Firmware -* Added support for Surface Dock firmware updates with improvements targeted to Surface Book devices - - -### Version 2.9.136.0 -*Release date: November 3, 2017* - -This version of Surface Dock Updater adds support for the following: - -* Update for Surface Dock DisplayPort Firmware -* Resolves an issue with audio over passive display port adapters - -### Version 2.1.15.0 -*Release date: June 19, 2017* - -This version of Surface Dock Updater adds support for the following: - -* Surface Laptop -* Surface Pro - -### Version 2.1.6.0 -*Release date: April 7, 2017* - -This version of Surface Dock Updater adds support for the following: - -* Update for Surface Dock DisplayPort firmware -* Requires Windows 10 - -### Version 2.0.22.0 -*Release date: October 21, 2016* - -This version of Surface Dock Updater adds support for the following: - -* Update for Surface Dock USB firmware -* Improved reliability of Ethernet, audio, and USB ports - -### Version 1.0.8.0 -*Release date: April 26, 2016* - -This version of Surface Dock Updater adds support for the following: - -* Update for Surface Dock Main Chipset firmware -* Update for Surface Dock DisplayPort firmware - diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md deleted file mode 100644 index fc88993c64..0000000000 --- a/devices/surface/surface-enterprise-management-mode.md +++ /dev/null @@ -1,268 +0,0 @@ ---- -title: Surface Enterprise Management Mode (Surface) -description: See how this feature of Surface devices with Surface UEFI helps you secure and manage firmware settings within your organization. -keywords: uefi, configure, firmware, secure, semm -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: scottmca -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Microsoft Surface Enterprise Management Mode - -Microsoft Surface Enterprise Management Mode (SEMM) is a feature of Surface devices with Surface UEFI that allows you to secure and manage firmware settings within your organization. With SEMM, IT professionals can prepare configurations of UEFI settings and install them on a Surface device. In addition to the ability to configure UEFI settings, SEMM also uses a certificate to protect the configuration from unauthorized tampering or removal. - ->[!NOTE] ->SEMM is only available on devices with Surface UEFI firmware. This includes most Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3 commercial SKUs with an Intel processor. SEMM is not supported on the 15" Surface Laptop 3 SKU with AMD processor (only available as a retail SKU). - -When Surface devices are configured by SEMM and secured with the SEMM certificate, they are considered *enrolled* in SEMM. When the SEMM certificate is removed and control of UEFI settings is returned to the user of the device, the Surface device is considered *unenrolled* in SEMM. - -There are two administrative options you can use to manage SEMM and enrolled Surface devices – a standalone tool or integration with Microsoft Endpoint Configuration Manager. The SEMM standalone tool, called the Microsoft Surface UEFI Configurator, is described in this article. For more information about how to manage SEMM with Microsoft Endpoint Configuration Manager, see [Use Microsoft Endpoint Configuration Manager to manage devices with SEMM](https://technet.microsoft.com/itpro/surface/use-system-center-configuration-manager-to-manage-devices-with-semm). - - -## Microsoft Surface UEFI Configurator - -The primary workspace of SEMM is Microsoft Surface UEFI Configurator, as shown in Figure 1. Microsoft Surface UEFI Configurator is a tool that is used to create Windows Installer (.msi) packages or WinPE images that are used to enroll, configure, and unenroll SEMM on a Surface device. These packages contain a configuration file where the settings for UEFI are specified. SEMM packages also contain a certificate that is installed and stored in firmware and used to verify the signature of configuration files before UEFI settings are applied. - -![Microsoft Surface UEFI Configurator](images/surface-ent-mgmt-fig1-uefi-configurator.png "Microsoft Surface UEFI Configurator") - -*Figure 1. Microsoft Surface UEFI Configurator* - - -You can use the Microsoft Surface UEFI Configurator tool in three modes: - -* [Surface UEFI Configuration Package](#configuration-package). Use this mode to create a Surface UEFI configuration package to enroll a Surface device in SEMM and to configure UEFI settings on enrolled devices. -* [Surface UEFI Reset Package](#reset-package). Use this mode to unenroll a Surface device from SEMM. -* [Surface UEFI Recovery Request](#recovery-request). Use this mode to respond to a recovery request to unenroll a Surface device from SEMM where a Reset Package operation is not successful. - - -#### Download Microsoft Surface UEFI Configurator - -You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. - -### Configuration package - -Surface UEFI configuration packages are the primary mechanism to implement and manage SEMM on Surface devices. These packages contain a configuration file of UEFI settings specified during creation of the package in Microsoft Surface UEFI Configurator and a certificate file, as shown in Figure 2. When a configuration package is run for the first time on a Surface device that is not already enrolled in SEMM, it provisions the certificate file in the device’s firmware and enrolls the device in SEMM. When enrolling a device in SEMM, you will be prompted to confirm the operation by providing the last two digits of the SEMM certificate thumbprint before the certificate file is stored and the enrollment can complete. This confirmation requires that a user be present at the device at the time of enrollment to perform the confirmation. - -![Secure a SEMM configuration package with a certificate](images/surface-ent-mgmt-fig2-securepackage.png "Secure a SEMM configuration package with a certificate") - -*Figure 2. Secure a SEMM configuration package with a certificate* - -See the [Surface Enterprise Management Mode certificate requirements](#surface-enterprise-management-mode-certificate-requirements) section of this article for more information about the requirements for the SEMM certificate. - ->[!NOTE] ->You can also specify a UEFI password with SEMM that is required to view the **Security**, **Devices**, **Boot Configuration**, or **Enterprise Management** pages of Surface UEFI. - -After a device is enrolled in SEMM, the configuration file is read and the settings specified in the file are applied to UEFI. When you run a configuration package on a device that is already enrolled in SEMM, the signature of the configuration file is checked against the certificate that is stored in the device firmware. If the signature does not match, no changes are applied to the device. - -### Enable or disable devices in Surface UEFI with SEMM - -The following list shows all the available devices you can manage in SEMM: - -* Docking USB Port -* On-board Audio -* DGPU -* Type Cover -* Micro SD Card -* Front Camera -* Rear Camera -* Infrared Camera, for Windows Hello -* Bluetooth Only -* Wi-Fi and Bluetooth -* LTE - - >[!NOTE] ->The built-in devices that appear in the UEFI Devices page may vary depending on your device or corporate environment. For example, the UEFI Devices page is not supported on Surface Pro X; LTE only appears on LTE-equipped devices. -### Configure advanced settings with SEMM -**Table 1. Advanced settings** - -| Setting | Description | -| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| IPv6 for PXE Boot | Allows you to manage Ipv6 support for PXE boot. If you do not configure this setting, IPv6 support for PXE boot is disabled. | -| Alternate Boot | Allows you to manage use of an Alternate boot order to boot directly to a USB or Ethernet device by pressing both the Volume Down button and Power button during boot. If you do not configure this setting, Alternate boot is enabled. | -| Boot Order Lock | Allows you to lock the boot order to prevent changes. If you do not configure this setting, Boot Order Lock is disabled. | -| USB Boot | Allows you to manage booting to USB devices. If you do not configure this setting, USB Boot is enabled. | -| Network Stack | Allows you to manage Network Stack boot settings. If you do not configure this setting, the ability to manage Network Stack boot settings is disabled. | -| Auto Power On | Allows you to manage Auto Power On boot settings. If you do not configure this setting, Auto Power on is enabled. | -| Simultaneous Multi-Threading (SMT) | Allows you to manage Simultaneous Multi-Threading (SMT) to enable or disable hyperthreading. If you do not configure this setting, SMT is enabled. | -|Enable Battery limit| Allows you to manage Battery limit functionality. If you do not configure this setting, Battery limit is enabled | -| Security | Displays the Surface UEFI **Security** page. If you do not configure this setting, the Security page is displayed. | -| Devices | Displays the Surface UEFI **Devices** page. If you do not configure this setting, the Devices page is displayed. | -| Boot | Displays the Surface UEFI **Boot** page. If you do not configure this setting, the DateTime page is displayed. | -| DateTime | Displays the Surface UEFI **DateTime** page. If you do not configure this setting, the DateTime page is displayed. | - - - ->[!NOTE] ->When you create a SEMM configuration package, two characters are shown on the **Successful** page, as shown in Figure 3. - -![Certificate thumbprint display](images/surface-ent-mgmt-fig5-success.png "Certificate thumbprint display") - -*Figure 3. Display of the last two characters of the certificate thumbprint on the Successful page* - -These characters are the last two characters of the certificate thumbprint and should be written down or recorded. The characters are required to confirm enrollment in SEMM on a Surface device, as shown in Figure 4. - -![Enrollment confirmation in SEMM](images/surface-ent-mgmt-fig6-enrollconfirm.png "Enrollment confirmation in SEMM") - -*Figure 4. Enrollment confirmation in SEMM with the SEMM certificate thumbprint* - ->[!NOTE] ->Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process: ->1. Right-click the .pfx file, and then click **Open**. ->2. Expand the folder in the navigation pane. ->3. Click **Certificates**. ->4. Right-click your certificate in the main pane, and then click **Open**. ->5. Click the **Details** tab. ->6. **All** or **Properties Only** must be selected in the **Show** drop-down menu. ->7. Select the field **Thumbprint**. - -To enroll a Surface device in SEMM or to apply the UEFI configuration from a configuration package, all you need to do is run the .msi file with administrative privileges on the intended Surface device. You can use application deployment or operating system deployment technologies such as [Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt346023) or the [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). When you enroll a device in SEMM you must be present to confirm the enrollment on the device. User interaction is not required when you apply a configuration to devices that are already enrolled in SEMM. - -For a step-by-step walkthrough of how to enroll a Surface device in SEMM or apply a Surface UEFI configuration with SEMM, see [Enroll and configure Surface devices with SEMM](https://technet.microsoft.com/itpro/surface/enroll-and-configure-surface-devices-with-semm). - -### Reset package - -A Surface UEFI reset package is used to perform only one task — to unenroll a Surface device from SEMM. The reset package contains signed instructions to remove the SEMM certificate from the device’s firmware and to reset UEFI settings to factory default. Like a Surface UEFI configuration package, a reset package must be signed with the same SEMM certificate that is provisioned on the Surface device. When you create a SEMM reset package, you are required to supply the serial number of the Surface device you intend to reset. SEMM reset packages are not universal and are specific to one device. - -### Recovery request - -In some scenarios, it may be impossible to use a Surface UEFI reset package. (For example, if Windows becomes unusable on the Surface device.) In these scenarios you can unenroll the Surface device from SEMM through the **Enterprise Management** page of Surface UEFI (shown in Figure 5) with a Recovery Request operation. - -![Initiate a SEMM recovery request](images/surface-ent-mgmt-fig7-semmrecovery.png "Initiate a SEMM recovery request") - -*Figure 5. Initiate a SEMM recovery request on the Enterprise Management page* - -When you use the process on the **Enterprise Management** page to reset SEMM on a Surface device, you are provided with a Reset Request. This Reset Request can be saved as a file to a USB drive, copied as text, or read as a QR Code with a mobile device to be easily emailed or messaged. Use the Microsoft Surface UEFI Configurator Reset Request option to load a Reset Request file or enter the Reset Request text or QR Code. Microsoft Surface UEFI Configurator will generate a verification code that can be entered on the Surface device. If you enter the code on the Surface device and click **Restart**, the device will be unenrolled from SEMM. - ->[!NOTE] ->A Reset Request expires two hours after it is created. - -For a step-by-step walkthrough of how to unenroll Surface devices from SEMM, see [Unenroll Surface devices from SEMM](https://technet.microsoft.com/itpro/surface/unenroll-surface-devices-from-semm). - -## Surface Enterprise Management Mode certificate requirements - ->[!NOTE] ->The SEMM certificate is required to perform any modification to SEMM or Surface UEFI settings on enrolled Surface devices. If the SEMM certificate is corrupted or lost, SEMM cannot be removed or reset. Manage your SEMM certificate accordingly with an appropriate solution for backup and recovery. - -Packages created with the Microsoft Surface UEFI Configurator tool are signed with a certificate. This certificate ensures that after a device is enrolled in SEMM, only packages created with the approved certificate can be used to modify the settings of UEFI. The following settings are recommended for the SEMM certificate: - -* **Key Algorithm** – RSA -* **Key Length** – 2048 -* **Hash Algorithm** – SHA-256 -* **Type** – SSL Server Authentication -* **Key Usage** – Digital signature, Key Encipherment -* **Provider** – Microsoft Enhanced RSA and AES Cryptographic Provider -* **Expiration Date** – 15 Months from certificate creation -* **Key Export Policy** – Exportable - -It is also recommended that the SEMM certificate be authenticated in a two-tier public key infrastructure (PKI) architecture where the intermediate certification authority (CA) is dedicated to SEMM, enabling certificate revocation. For more information about a two-tier PKI configuration, see [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](https://technet.microsoft.com/library/hh831348). - ->[!NOTE] ->You can use the following PowerShell script to create a self-signed certificate for use in proof-of-concept scenarios. - > To use this script, copy the following text into Notepad and save the file as a PowerShell script (.ps1). This script creates a certificate with a password of `12345678`.

The certificate generated by this script is not recommended for production environments. - - ``` -if (-not (Test-Path "Demo Certificate")) { New-Item -ItemType Directory -Force -Path "Demo Certificate" } -if (Test-Path "Demo Certificate\TempOwner.pfx") { Remove-Item "Demo Certificate\TempOwner.pfx" } - -# Generate the Ownership private signing key with password 12345678 -$pw = ConvertTo-SecureString "12345678" -AsPlainText -Force - -$TestUefiV2 = New-SelfSignedCertificate ` - -Subject "CN=Surface Demo Kit, O=Contoso Corporation, C=US" ` - -Type SSLServerAuthentication ` - -HashAlgorithm sha256 ` - -KeyAlgorithm RSA ` - -KeyLength 2048 ` - -KeyUsage KeyEncipherment ` - -KeyUsageProperty All ` - -Provider "Microsoft Enhanced RSA and AES Cryptographic Provider" ` - -NotAfter (Get-Date).AddYears(25) ` - -TextExtension @("2.5.29.37={text}1.2.840.113549.1.1.1") ` - -KeyExportPolicy Exportable - -$TestUefiV2 | Export-PfxCertificate -Password $pw -FilePath "Demo Certificate\TempOwner.pfx" - ``` - -For use with SEMM and Microsoft Surface UEFI Configurator, the certificate must be exported with the private key and with password protection. Microsoft Surface UEFI Configurator will prompt you to select the SEMM certificate file (.pfx) and certificate password when it is required. - ->[!NOTE] ->For organizations that use an offline root in their PKI infrastructure, Microsoft Surface UEFI Configurator must be run in an environment connected to the root CA to authenticate the SEMM certificate. The packages generated by Microsoft Surface UEFI Configurator can be transferred as files and therefore can be transferred outside the offline network environment with removable storage, such as a USB stick. - -### Managing certificates FAQ - -The recommended *minimum* length is 15 months. You can use a -certificate that expires in less than 15 months or use a certificate -that expires in longer than 15 months. - ->[!NOTE] ->When a certificate expires, it does not automatically renew. - -**Will existing machines continue to apply the bios settings after 15 -months?** - -Yes, but only if the package itself was signed when the certificate was -valid. - -**Will** **the SEMM package and certificate need to be updated on all -machines that have it?** - -If you want SEMM reset or recovery to work, the certificate needs to be -valid and not expired. - -**Can bulk reset packages be created for each surface that we order? Can -one be built that resets all machines in our environment?** - -The PowerShell samples that create a config package for a specific -device type can also be used to create a reset package that is -serial-number independent. If the certificate is still valid, you can -create a reset package using PowerShell to reset SEMM. - -## Version History - -### Version 2.59. -* Support to Surface Pro 7, Surface Pro X, and Surface Laptop 3 13.5" and 15" models with Intel processor. Note: Surface Laptop 3 15" AMD processor is not supported. -- Support to Wake on Power feature - -### Version 2.54.139.0 -* Support to Surface Hub 2S -* Bug fixes - -### Version 2.43.136.0 -* Support to enable/disable simulatenous multithreating -* Separate options for WiFi and Bluetooth for some devices -* Battery Limit removed for Surface Studio - -### Version 2.26.136.0 -* Add support to Surface Studio 2 -* Battery Limit feature - -### Version 2.21.136.0 -* Add support to Surface Pro 6 -* Add support to Surface Laptop 2 - -### Version 2.14.136.0 -* Add support to Surface Go - -### Version 2.9.136.0 -* Add support to Surface Book 2 -* Add support to Surface Pro LTE -* Accessibility improvements - -### Version 1.0.74.0 -* Add support to Surface Laptop -* Add support to Surface Pro -* Bug fixes and general improvement - -## Related topics - -[Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md) - -[Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md) diff --git a/devices/surface/surface-manage-dfci-guide.md b/devices/surface/surface-manage-dfci-guide.md deleted file mode 100644 index f21805f1a7..0000000000 --- a/devices/surface/surface-manage-dfci-guide.md +++ /dev/null @@ -1,188 +0,0 @@ ---- -title: Intune management of Surface UEFI settings -description: This article explains how to configure a DFCI environment in Microsoft Intune and manage firmware settings for targeted Surface devices. -ms.localizationpriority: medium -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.date: 11/13/2019 -ms.reviewer: jesko -manager: laurawi -ms.audience: itpro ---- -# Intune management of Surface UEFI settings - -## Introduction - -The ability to manage devices from the cloud has dramatically simplified IT deployment and provisioning across the lifecycle. With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in [public preview](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. For answers to frequently asked questions, see [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333). - -### Background - -Like any computer running Windows 10, Surface devices rely on code stored in the SoC that enables the CPU to interface with hard drives, display devices, USB ports, and other devices. The programs stored in this read-only memory (ROM) are known as firmware (while programs stored in dynamic media are known as software). - -In contrast to other Windows 10 devices available in the market today, Surface provides IT admins with the ability to configure and manage firmware through a rich set of UEFI configuration settings. This provides a layer of hardware control on top of software-based policy management as implemented via mobile device management (MDM) policies, Configuration Manager or Group Policy. For example, organizations deploying devices in highly secure areas with sensitive information can prevent camera use by removing functionality at the hardware level. From a device standpoint, turning the camera off via a firmware setting is equivalent to physically removing the camera. Compare the added security of managing at the firmware level to relying only on operating system software settings. For example, if you disable the Windows audio service via a policy setting in a domain environment, a local admin could still re-enable the service. - -### DFCI versus SEMM - -Until now, managing firmware required enrolling devices into Surface Enterprise Management Mode (SEMM) with the overhead of ongoing manual IT-intensive tasks. As an example, SEMM requires IT staff to physically access each PC to enter a two-digit pin as part of the certificate management process. Although SEMM remains a good solution for organizations in a strictly on-premises environment, its complexity and IT-intensive requirements make it costly to use. - -Now with newly integrated UEFI firmware management capabilities in Microsoft Intune, the ability to lock down hardware is simplified and easier to use with new features for provisioning, security, and streamlined updating all in a single console, now unified as [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager). The following figure shows UEFI settings viewed directly on the device (left) and viewed in the Endpoint Manager console (right). - -![UEFI settings shown on device (left) and in the Endpoint Manager console (right) ](images/uefidfci.png) - -Crucially, DFCI enables zero touch management, eliminating the need for manual interaction by IT admins. DFCI is deployed via Windows Autopilot using the device profiles capability in Intune. A device profile allows you to add and configure settings which can then be deployed to devices enrolled in management within your organization. Once the device receives the device profile, the features and settings are applied automatically. Examples of common device profiles include Email, Device restrictions, VPN, Wi-Fi, and Administrative templates. DFCI is simply an additional device profile that enables you to manage UEFI configuration settings from the cloud without having to maintain on-premises infrastructure. - -## Supported devices - -At this time, DFCI is supported in the following devices: - -- Surface Pro 7 -- Surface Pro X -- Surface Laptop 3 - -> [!NOTE] -> Surface Pro X does not support DFCI settings management for built-in camera, audio, and Wi-Fi/Bluetooth. - -## Prerequisites - -- Devices must be registered with Windows Autopilot by a [Microsoft Cloud Solution Provider (CSP) partner](https://partner.microsoft.com/membership/cloud-solution-provider) or OEM distributor. - -- Before configuring DFCI for Surface, you should be familiar with Autopilot configuration requirements in [Microsoft Intune](https://docs.microsoft.com/intune/) and [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/) (Azure AD). - -## Before you begin - -Add your target Surface devices to an Azure AD security group. For more information about creating and managing security groups, refer to [Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#create-your-azure-ad-security-groups). - -## Configure DFCI management for Surface devices - -A DFCI environment requires setting up a DFCI profile that contains the settings and an Autopilot profile to apply the settings to registered devices. An enrollment status profile is also recommended to ensure settings are pushed down during OOBE setup when users first start the device. This guide explains how to configure the DFCI environment and manage UEFI configuration settings for targeted Surface devices. - -## Create DFCI profile - -Before configuring DFCI policy settings, first create a DFCI profile and assign it to the Azure AD security group that contains your target devices. - -1. Sign into your tenant at devicemanagement.microsoft.com. -2. In the Microsoft Endpoint Manager Admin Center, select **Devices > Configuration profiles > Create profile** and enter a name; for example, **DFCI Configuration Policy.** -3. Select **Windows 10 and later** for platform type. -4. In the Profile type drop down list, select **Device Firmware Configuration Interface** to open the DFCI blade containing all available policy settings. For information on DFCI settings, refer to Table 1 on this page or the [Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows). You can configure DFCI settings during the initial setup process or later by editing the DFCI profile. - - ![Create DFCI profile](images/df1.png) - -5. Click **OK** and then select **Create**. -6. Select **Assignments** and under **Select groups to include** select the Azure AD security group that contains your target devices, as shown in the following figure. Click **Save**. - - ![Assign security group](images/df2a.png) - -## Create Autopilot profile - -1. In Endpoint Manager at devicemanagement.microsoft.com, select **devices > Windows enrollment** and scroll down to **Deployment profiles**. -2. Select **Create profile** and enter a name; for example, **My Autopilot profile**, and select **Next**. -3. Select the following settings: - - - Deployment mode: **User-Driven**. - - Join type: Azure **AD joined**. - -4. Leave the remaining default settings unchanged and select **Next**, as shown in the following figure. - - ![Create Autopilot profile](images/df3b.png) - -5. On the Assignments page, choose **Select groups to include** and click your Azure AD security group. Select **Next**. -6. Accept the summary and then select **Create**. The Autopilot profile is now created and assigned to the group. - -## Configure Enrollment Status Page - -To ensure that devices apply the DFCI configuration during OOBE before users sign in, you need to configure enrollment status. - -For more information, refer to [Set up an enrollment status page](https://docs.microsoft.com/intune/enrollment/windows-enrollment-status). - - -## Configure DFCI settings on Surface devices - -DFCI includes a streamlined set of UEFI configuration policies that provide an extra level of security by locking down devices at the hardware level. DFCI is designed to be used in conjunction with mobile device management settings at the software level. Note that DFCI settings only affect hardware components built into Surface devices and do not extend to attached peripherals such as USB webcams. (However, you can use Device restriction policies in Intune to turn off access to attached peripherals at the software level). - -You configure DFCI policy settings by editing the DFCI profile from Endpoint Manager, as shown in the figure below. - -- In Endpoint Manager at devicemanagement.microsoft.com, select **Devices > Windows > Configuration Profiles > “DFCI profile name” > Properties > Settings**. - - ![Configure DFCI settings](images/dfciconfig.png) - -### Block user access to UEFI settings - -For many customers, the ability to block users from changing UEFI settings is critically important and a primary reason to use DFCI. As listed in Table 1, this is managed via the setting **Allow local user to change UEFI settings**. If you do not edit or configure this setting, local users will be able to change any UEFI setting not managed by Intune. Therefore, it’s highly recommended to disable **Allow local user to change UEFI settings.** -The rest of the DFCI settings enable you to turn off functionality that would otherwise be available to users. For example, if you need to protect sensitive information in highly secure areas, you can disable the camera, and if you don’t want users booting from USB drives, you can disable that also. - -### Table 1. DFCI scenarios - -| Device management goal | Configuration steps | -| --------------------------------------------- | --------------------------------------------------------------------------------------------- | -| Block local users from changing UEFI settings | Under **Security Features > Allow local user to change UEFI settings**, select **None**. | -| Disable cameras | Under **Built in Hardware > Cameras**, select **Disabled**. | -| Disable Microphones and speakers | Under **Built in Hardware > Microphones and speakers**, select **Disabled**. | -| Disable radios (Bluetooth, Wi-Fi) | Under **Built in Hardware > Radios (Bluetooth, Wi-Fi, etc…)**, select **Disabled**. | -| Disable Boot from external media (USB, SD) | Under **Built in Hardware > Boot Options > Boot from external media (USB, SD)**, select **Disabled**. | - -> [!CAUTION] -> The **Disable radios (Bluetooth, Wi-Fi)** setting should only be used on devices that have a wired Ethernet connection. - -> [!NOTE] -> DFCI in Intune includes two settings that do not currently apply to Surface devices: (1) CPU and IO virtualization and (2) Disable Boot from network adapters. - -Intune provides Scope tags to delegate administrative rights and Applicability Rules to manage device types. For more information about policy management support and full details on all DFCI settings, refer to [Microsoft Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows). - -## Register devices in Autopilot - -As stated above, DFCI can only be applied on devices registered in Windows Autopilot by your reseller or distributor and is only supported, at this time, on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For security reasons, it’s not possible to “self-provision” your devices into Autopilot. - -## Manually Sync Autopilot devices - -Although Intune policy settings typically get applied almost immediately, there may be a delay of 10 minutes before the settings take effect on targeted devices. In rare circumstances, delays of up to 8 hours are possible. To ensure settings apply as soon as possible, (such as in test scenarios), you can manually sync the target devices. - -- In Endpoint Manager at devicemanagement.microsoft.com, go to **Devices > Device enrollment > Windows enrollment > Windows Autopilot Devices** and select **Sync**. - - For more information, refer to [Sync your Windows device manually](https://docs.microsoft.com/intune-user-help/sync-your-device-manually-windows). - -> [!NOTE] -> When adjusting settings directly in UEFI, you need to ensure the device fully restarts to the standard Windows login. - -## Verifying UEFI settings on DFCI-managed devices - -In a test environment, you can verify settings in the Surface UEFI interface. - -1. Open Surface UEFI, which involves pressing the **Volume +** and **Power** buttons at the same time. -2. Select **Devices**. The UEFI menu will reflect configured settings, as shown in the following figure. - - ![Surface UEFI](images/df3.png) - - Note how: - - - The settings are greyed out because **Allow local user to change UEFI setting** is set to None. - - Audio is set to off because **Microphones and speakers** are set to **Disabled**. - -## Removing DFCI policy settings - -When you create a DFCI profile, all configured settings will remain in effect across all devices within the profile’s scope of management. You can only remove DFCI policy settings by editing the DFCI profile directly. - -If the original DFCI profile has been deleted, you can remove policy settings by creating a new profile and then editing the settings, as appropriate. - -## Removing DFCI management - -**To remove DFCI management and return device to factory new state:** - -1. Retire the device from Intune: - 1. In Endpoint Manager at devicemanagement.microsoft.com, choose **Groups > All Devices**. Select the devices you want to retire, and then choose **Retire/Wipe.** To learn more refer to [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/remote-actions/devices-wipe). -2. Delete the Autopilot registration from Intune: - 1. Choose **Device enrollment > Windows enrollment > Devices**. - 2. Under Windows Autopilot devices, choose the devices you want to delete, and then choose **Delete**. -3. Connect device to wired internet with Surface-branded ethernet adapter. Restart device and open the UEFI menu (press and hold the volume-up button while also pressing and releasing the power button). -4. Select **Management > Configure > Refresh from Network** and then choose **Opt-out.** - -To keep managing the device with Intune, but without DFCI management, self-register the device to Autopilot and enroll it to Intune. DFCI will not be applied to self-registered devices. - -## Learn more -- [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333) -[Windows Autopilot](https://www.microsoft.com/microsoft-365/windows/windows-autopilot) -- [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) -- [Use DFCI profiles on Windows devices in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows) diff --git a/devices/surface/surface-pro-arm-app-management.md b/devices/surface/surface-pro-arm-app-management.md deleted file mode 100644 index f3d922c048..0000000000 --- a/devices/surface/surface-pro-arm-app-management.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Deploying, managing, and servicing Surface Pro X -description: This article provides an overview of key considerations for deploying, managing, and servicing Surface Pro X. -ms.prod: w10 -ms.mktglfcycl: manage -ms.localizationpriority: high -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.date: 4/15/2020 -ms.reviewer: jessko -manager: laurawi -ms.audience: itpro ---- -# Deploying, managing, and servicing Surface Pro X - -## Introduction - -Built to handle high performance commercial requirements, Surface Pro X breaks new ground by incorporating the most powerful processor ever released on an ARM device, the Microsoft SQ1 ARM chipset. - -Powered by a 3GHz CPU and a 2.1 teraflop GPU, Surface Pro X provides a full Windows experience. Its 13-hour battery life and built-in 4G LTE make it ideally suited for mobile first-line workers and professionals across the financial, legal, and medical fields or any role demanding extended battery life and continuous connectivity capabilities. - -Surface Pro X is designed almost exclusively for a modern, cloud-based environment centered around Microsoft 365, Intune and Windows Autopilot. This article highlights what that looks like and outlines key considerations for deploying, managing, and servicing Surface Pro X. - -## Deploying Surface Pro X - -For the best experience, deploy Surface Pro X using Windows Autopilot either with the assistance of a Microsoft Cloud Solution Provider or self-provisioned using Autopilot deployment profiles and related features. For more information, refer to: - -- [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) -- [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) - -Autopilot deployment has several advantages: It allows you to use the factory provisioned operating system, streamlined for zero-touch deployment, to include pre-installation of Office Pro Plus. - -Organizations already using modern management, security, and productivity solutions are well positioned to take advantage of the unique performance features in Surface Pro X. Customers using modernized line of business apps, Microsoft store (UWP) apps, or remote desktop solutions also stand to benefit. - -## Image-based deployment considerations - -Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager (formerly System Center Configuration Manager) currently do not support Surface Pro X for operating system deployment. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud. - -## Managing Surface Pro X devices - -### Intune - -A component of Microsoft Enterprise Mobility + Security, Intune integrates with Azure Active Directory for identity and access control and provides granular management of enrolled Surface Pro X devices. Intune mobile device management (MDM) policies have a number of advantages over older on-premises tools such as Windows Group Policy. This includes faster device login times and a more streamlined catalog of policies enabling full device management from the cloud. For example, you can manage LTE using eSIM profiles to configure data plans and deploy activation codes to multiple devices.
- -For more information about using Intune, refer to the [Intune documentation](https://docs.microsoft.com/intune/). - -### Co-management - -Once deployed in Autopilot, you can join Surface Pro X devices to Azure AD or Active Directory (Hybrid Azure AD Join) where you will be able to manage the devices with Intune or co-manage them with Endpoint Configuration Manager, which will install the 32-bit x86 ConfigMgr client. - -### Third party MDM solutions - -You may be able to use third-party MDM tools to manage Surface Pro X devices. For details, contact your MDM provider. - -### Antivirus software - -Windows Defender will help protect Windows 10 on ARM-based PCs for the supported lifetime of the Windows 10 device. - -Some third-party antivirus software cannot be installed on a Windows 10 PC running on an ARM-based processor. Collaboration with third-party antivirus software providers is continuing for AV app readiness on ARM-based PCs. Contact your antivirus software provider to understand when their apps will be available. - -## Servicing Surface Pro X - -Surface Pro X supports Windows 10, version 1903 and later. As an ARM-based device, it has specific requirements for maintaining the latest drivers and firmware. - -Surface Pro X was designed to use Windows Update to simplify the process of keeping drivers and firmware up to date for both home users and small business users. Use the default settings to receive Automatic updates. To verify: - -1. Go to **Start** > **Settings > Update & Security > Windows Update** > **Advanced Options.** -2. Under **Choose how updates are installed,** select **Automatic (recommended)**. - -### Recommendations for commercial customers - -- Use Windows Update or Windows Update for Business for maintaining the latest drivers and firmware. For more information, see [Deploy Updates using Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb). -- If your procedures require using a Windows Installer .msi file, contact [Surface for Business support](https://support.microsoft.com/help/4037645). -- For more information about deploying and managing updates on Surface devices, see [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md). -- Note that Windows Server Update Services (WSUS) does not support the ability to deliver drivers and firmware to Surface Pro X. - -## Running apps on Surface Pro X - -Most apps run on ARM-based Windows 10 PCs with limited exclusions. - -### Supported apps - -- Most x86 Win32 apps run on Surface Pro X. -- Native ARM64 and Microsoft Store UWP apps provide an excellent user experience utilizing the full native speed of the ARM-based processor while optimizing battery life. -- Apps that use drivers designed for a Windows 10 PC running on an ARM-based processor. - -### Not supported - -- x64 apps won't run on a Windows 10 PC on an ARM-based processor. - -For more information about running apps on Surface Pro X, refer to: - -- [Windows 10 ARM-based PCs Support FAQ](https://support.microsoft.com/help/4521606) -- [Windows 10 on ARM documentation](https://docs.microsoft.com/windows/arm) - -## Virtual Desktops (VDI) - -Windows Virtual Desktop enables access to Windows desktops,applications, and data on any computing device or platform, from any location. To learn more, refer to the [Windows Virtual Desktop site](https://aka.ms/wvd). - -## Browsing with Surface Pro X - -Popular browsers run on Surface Pro X: - -- In-box Edge, Firefox, Chrome, and Internet Explorer all run on Surface Pro X. -- In-box Edge and Firefox run natively and therefore have enhanced performance on a Windows 10 PC on an ARM-based processor. - -## Installing and using Microsoft Office - -- Use Office 365 for the best experience on a Windows 10 PC on an ARM-based processor. -- Office 365 "click-to-run" installs Outlook, Word, Excel, and PowerPoint, optimized to run on a Windows 10 PC on an ARM-based processor. -- Microsoft Teams runs great on Surface Pro X. -- For "perpetual versions" of Office such as Office 2019, install the 32-bit version. - -## VPN - -To confirm if a specific third-party VPN supports a Windows 10 PC on an ARM-based processor, contact the VPN provider. - -## Comparing key features - -The following tables show the availability of selected key features on Surface Pro X with Windows 10 on ARM compared to Intel-based Surface Pro 7. - -| Deployment | Surface Pro 7 | Surface Pro X | Notes | -| --------------------------------------- | ------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------- | -| Windows Autopilot | Yes | Yes | | -| Support for Network Boot (PXE) | Yes | No | | -| Windows Configuration Designer | Yes | No | Not recommended for Surface Pro X. | -| WinPE | Yes | Yes | Not recommended for Surface Pro X. Microsoft does not provide the necessary .ISO and drivers to support WinPE with Surface Pro X. | -| Endpoint Configuration Manager: Operating System Deployment (OSD) | Yes | No | Not supported on Surface Pro X. | -| MDT | Yes | No | Not supported on Surface Pro X. | - - -| Management | Surface Pro 7 | Surface Pro X | Notes | -| --------------------------------------------- | ------------------- | ------------- | ------------------------------------------------------------------------------------- | -| Intune | Yes | Yes | Manage LTE with eSIM profiles. | -| Windows Autopilot | Yes | Yes | | -| Azure AD (co-management) | Yes | Yes | Ability to join Surface Pro X to Azure AD or Active Directory (Hybrid Azure AD Join). | -| Endpoint Configuration Manager | Yes | Yes | | -| Power on When AC Restore | Yes | Yes | | -| Surface Diagnostic Toolkit (SDT) for Business | Yes | Yes | | -| Surface Dock Firmware Update | Yes | Yes | | -| Asset Tag Utility | Yes | Yes | | -| Surface Enterprise management Mode (SEMM) | Yes | Partial | No option to disable hardware on Surface Pro X at the firmware level. | -| Surface UEFI Configurator | Yes | | No option to disable hardware. on Surface Pro X at the firmware level. | -| Surface UEFI Manager | Yes | Partial | No option to disable hardware on Surface Pro X at the firmware level. | - - -| Security | Surface Pro 7 | Surface Pro X | Notes | -| --------------------------------- | ------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| BitLocker | Yes | Yes | | -| Windows Defender | Yes | Yes | | -| Support for third-party antivirus | Yes | See note |Some third-party antivirus software cannot be installed on a Windows 10 PC running on an ARM-based processor. Collaboration with third-party antivirus software providers is continuing for AV app readiness on ARM-based PCs. Contact your antivirus software provider to understand when their apps will be available. | -| Conditional Access | Yes | Yes | | -| Secure Boot | Yes | Yes | | -| Windows Information Protection | Yes | Yes | | -| Surface Data Eraser (SDE) | Yes | Yes | -## FAQ - -### Can I deploy Surface Pro X with MDT or Endpoint Configuration Manager? - -The Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager currently do not support Surface Pro X for operating system deployment.Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud. - -### How can I deploy Surface Pro X? - -Deploy Surface Pro X using Windows Autopilot. - -### Will a BMR be available? - -Yes. - -### Is Intune required to manage Surface Pro X? - -Intune is recommended but not required. Once deployed in Autopilot, you can join Surface Pro X devices to Azure AD or Active Directory (Hybrid Azure AD Join) where you will be able to manage the devices with Intune or co-manage them with Endpoint Configuration Manager, which will install the 32-bit x86 ConfigMgr client. diff --git a/devices/surface/surface-pro-arm-app-performance.md b/devices/surface/surface-pro-arm-app-performance.md deleted file mode 100644 index 4459d6052b..0000000000 --- a/devices/surface/surface-pro-arm-app-performance.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Surface Pro X app compatibility -description: This article provides introductory app compatibility information for Surface Pro X ARM-based PCs. -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.date: 10/03/2019 -ms.reviewer: jessko -manager: laurawi -ms.audience: itpro ---- -# Surface Pro X app compatibility - -Applications run differently on ARM-based Windows 10 PCs such as Surface Pro X. Limitations include the following: - -- **Drivers for hardware, games and apps will only work if they're designed for a Windows 10 ARM-based PC**. For more info, check with the hardware manufacturer or the organization that developed the driver. Drivers are software programs that communicate with hardware devices—they're commonly used for antivirus and antimalware software, printing or PDF software, assistive technologies, CD and DVD utilities, and virtualization software. If a driver doesn’t work, the app or hardware that relies on it won’t work either (at least not fully). Peripherals and devices only work if the drivers they depend on are built into Windows 10, or if the hardware developer has released ARM64 drivers for the device. -- **64-bit (x64) apps won’t work**. You'll need 64-bit (ARM64) apps, 32-bit (ARM32) apps, or 32-bit (x86) apps. You can usually find 32-bit (x86) versions of apps, but some app developers only offer 64-bit (x64) apps. -- **Certain games won’t work**. Games and apps won't work if they use a version of OpenGL greater than 1.1, or if they rely on "anti-cheat" drivers that haven't been made for Windows 10 ARM-based PCs. Check with your game publisher to see if a game will work. -- **Apps that customize the Windows experience might have problems**. This includes some input method editors (IMEs), assistive technologies, and cloud storage apps. The organization that develops the app determines whether their app will work on a Windows 10 ARM-based PC. -- **Some third-party antivirus software can’t be installed**. You won't be able to install some third-party antivirus software on a Windows 10 ARM-based PC. However, Windows Security will help keep you safe for the supported lifetime of your Windows 10 device. -- **Windows Fax and Scan isn’t available**. This feature isn’t available on a Windows 10 ARM-based PC. - -For more information about app compatibility, refer to [Windows 10 ARM-based PCs FAQ](https://support.microsoft.com/en-us/help/4521606) diff --git a/devices/surface/surface-system-sku-reference.md b/devices/surface/surface-system-sku-reference.md deleted file mode 100644 index c0de20193f..0000000000 --- a/devices/surface/surface-system-sku-reference.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: System SKU reference (Surface) -description: See a reference of System Model and System SKU names. -keywords: uefi, configure, firmware, secure, semm -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.date: 03/09/2020 -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# System SKU reference - -This document provides a reference of System Model and System SKU names that you can use to quickly determine the machine state of a specific device by using PowerShell or WMI. - -System Model and System SKU are variables that are stored in the System Management BIOS (SMBIOS) tables in the UEFI layer of Surface devices. The System SKU name is required to differentiate between devices that have the same System Model name, such as Surface Pro and Surface Pro with LTE Advanced. - -| Device | System Model | System SKU | -| ---------- | ----------- | -------------- | -| Surface 3 WiFI | Surface 3 | Surface_3 | -| Surface 3 LTE AT&T | Surface 3 | Surface_3_US1 | -| Surface 3 LTE Verizon | Surface 3 | Surface_3_US2 | -| Surface 3 LTE North America | Surface 3 | Surface_3_NAG | -| Surface 3 LTE outside of North America and Y!mobile in Japan | Surface 3 | Surface_3_ROW | -| Surface Pro | Surface Pro | Surface_Pro_1796 | -| Surface Pro with LTE Advanced | Surface Pro | Surface_Pro_1807 | -| Surface Book 2 13" | Surface Book 2 | Surface_Book_1832 | -| Surface Book 2 15" | Surface Book 2 | Surface_Book_1793 | -| Surface Go LTE Consumer | Surface Go | Surface_Go_1825_Consumer | -| Surface Go LTE Commercial | System Go | Surface_Go_1825_Commercial | -| Surface Go Consumer | Surface Go | Surface_Go_1824_Consumer | -| Surface Go Commercial | Surface Go | Surface_Go_1824_Commercial | -| Surface Pro 6 Consumer | Surface Pro 6 | Surface_Pro_6_1796_Consumer | -| Surface Pro 6 Commercial | Surface Pro 6 | Surface_Pro_6_1796_Commercial | -| Surface Laptop | Surface Laptop | Surface_Laptop | -| Surface Laptop 2 Consumer | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer | -| Surface Laptop 2 Commercial | Surface Laptop 2 | Surface_Laptop_2_1769_Commercial | -| Surface Pro 7 | Surface Pro 7 | Surface_Pro_7_1866 | -| Surface Pro X | Surface Pro X | Surface_Pro_X_1876 | -| Surface Laptop 3 13" Intel | Surface Laptop 3 | Surface_Laptop_3_1867:1868 | -| Surface Laptop 3 15" Intel | Surface Laptop 3 | Surface_Laptop_3_1872 | -| Surface Laptop 3 15" AMD | Surface Laptop 3 | Surface_Laptop_3_1873 | - -## Examples - -**Retrieving the SKU by using PowerShell** -Use the following PowerShell command to pull the System SKU information: - - ``` powershell -gwmi -namespace root\wmi -class MS_SystemInformation | select SystemSKU -``` - -**Retrieving the SKU by using System Information** -You can also find the System SKU and System Model for a device in **System Information**. To do this, follow these steps: - -1. Select **Start**, and then type **MSInfo32** in the search box. -1. Select **System Information**. - -**Using the SKU in a task sequence WMI condition** -You can use the System SKU information in the Microsoft Deployment Toolkit (MDT) or Microsoft Endpoint Configuration Manager as part of a task sequence WMI condition. - - ``` powershell - - WMI Namespace – Root\WMI - - WQL Query – SELECT * FROM MS_SystemInformation WHERE SystemSKU = "Surface_Pro_1796" - ``` diff --git a/devices/surface/surface-wireless-connect.md b/devices/surface/surface-wireless-connect.md deleted file mode 100644 index 24a358065b..0000000000 --- a/devices/surface/surface-wireless-connect.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Optimize Wi-Fi connectivity for Surface devices -description: This topic describes recommended Wi-Fi settings to ensure Surface devices stay connected in congested network environments and mobile scenarios. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: coveminer -ms.audience: itpro -ms.localizationpriority: medium -ms.author: v-jokai -ms.topic: article -ms.reviewer: tokatz -manager: laurawi ---- -# Optimize Wi-Fi connectivity for Surface devices - - -To stay connected with all-day battery life, Surface devices implement wireless connectivity settings that balance performance and power conservation. Outside of the most demanding mobility scenarios, users can maintain sufficient wireless connectivity without modifying default network adapter or related settings. - -In congested network environments, organizations can implement purpose-built wireless protocols across multiple network access points to facilitate roaming. This page highlights key wireless connectivity considerations in mobile scenarios utilizing Surface Pro 3 and later, Surface Book, Surface Laptop, and Surface Go. - -## Prerequisites - -This document assumes you have successfully deployed a wireless network that supports 802.11n (Wi-Fi 4) or later in accordance with best practice recommendations from leading equipment vendors. - -## Configuring access points for optimal roaming capabilities - -If you’re managing a wireless network that’s typically accessed by many different types of client devices, it’s recommended to enable specific protocols on access points (APs) in your WLAN, as described in [Fast Roaming with 802.11k, 802.11v, and 802.11r](https://docs.microsoft.com/windows-hardware/drivers/network/fast-roaming-with-802-11k--802-11v--and-802-11r). Surface devices can take advantage of the following wireless protocols: - -- **802.11r.** “**Fast BSS Transition”** accelerates connecting to new wireless access points by reducing the number of frames required before your device can access another AP as you move around with your device. -- **802.11k.** **“Neighbor Reports”** provides devices with information on current conditions at neighboring access points. It can help your Surface device choose the best AP using criteria other than signal strength such as AP utilization. - -Specific Surface devices can also use 802.11v “BSS Transition Management Frames,” which functions much like 802.11k in providing information on nearby candidate APs. These include Surface Go, Surface Pro 7, Surface Pro X, and Surface Laptop 3. - -## Managing user settings - -You can achieve optimal roaming capabilities through a well-designed network that supports 802.11r and 802.11k across all access points. Ensuring that your network is properly configured to provide users with the best wireless experience is the recommended approach versus attempting to manage user settings on individual devices. Moreover, in many corporate environments Surface device users won’t be able to access advanced network adapter settings without explicit permissions or local admin rights. In other lightly managed networks, users can benefit by knowing how specific settings can impact their ability to remain connected. - -### Recommended user settings and best practices - -In certain situations, modifying advanced network adapter settings built into Surface devices may facilitate a more reliable connection. Keep in mind however that an inability to connect to wireless resources is more often due to an access point issue, networking design flaw, or environmental site issue. - -> [!NOTE] -> How you hold your Surface Pro or Surface Go can also affect signal strength. If you’re experiencing a loss of bandwidth, check that you’re not holding the top of the display, where the Wi-Fi radio receiver is located. Although holding the top of the display does not block wireless signals, it can trigger the device driver to initiate changes that reduce connectivity. - -### Keep default Auto setting for dual bandwidth capability -On most Surface devices, you can configure client network adapter settings to only connect to wireless APs over 5 gigahertz (GHz), only connect over 2.4 GHz, or let the operating system choose the best option (default Auto setting). - -**To access network adapter settings go to:** - -- **Start** > **Control panel** > **Network and Sharing Center** > **your Wi-Fi adapter** > **Properties** > **Configure** > **Advanced**. - -![* wifi-band settings*](images/wifi-band.png)
- -Keep in mind that 2.4 GHz has some advantages over 5 GHz: It extends further and more easily penetrates through walls or other solid objects. Unless you have a clear use case that warrants connecting to 5 GHz, it’s recommended to leave the Band setting in the default state to avoid possible adverse consequences. For example: - - -- Many hotspots found in hotels, coffee shops, and airports still only use 2.4 GHz, effectively blocking access to devices if Band is set to 5 GHz Only. -- Since Miracast wireless display connections require the initial handshake to be completed over 2.4 GHz channels, devices won’t be able to connect at 5 GHz Only. - -> [!NOTE] -> By default Surface devices will prefer connecting to 5 GHz if available. However, to preserve power in a low battery state, Surface will first look for a 2.4 GHz connection. - -You can also toggle the band setting as needed to suit your environment. For example, users living in high density apartment buildings with multiple Wi-Fi hotspots — amid the presence of consumer devices all broadcasting via 2.4 GHz — will likely benefit by setting their Surface device to connect on 5 GHz only and then revert to Auto when needed. - -### Roaming aggressiveness settings on Surface Go - -Front-line workers using Surface Go may wish to select a signal strength threshold that prompts the device to search for a new access point when signal strength drops (roaming aggressiveness). By default, Surface devices attempt to roam to a new access point if the signal strength drops below **Medium** (50 percent signal strength). Note that whenever you increase roaming aggressiveness, you accelerate battery power consumption. - -Leave the roaming aggressiveness setting in the default state unless you’re encountering connectivity issues in specific mobile scenarios such as conducting environmental site inspections while also maintaining voice and video connectivity during a conference meeting. If you don’t notice any improvement revert to the default **Medium** state. - -**To enable roaming aggressiveness on Surface Go:** - -1. Go to **Start > Control Panel** > **Network and Internet** > **Network and Sharing Center.** -2. Under **Connections** select **Wi-Fi** and then select **Properties.** -3. Select **Client for Microsoft Networks** and then select **Configure** -4. Select **Advanced** > **Roaming Aggressiveness** and choose your preferred value from the drop-down menu. - -![* Roaming aggressiveness settings *](images/wifi-roaming.png)
- -## Conclusion - -Surface devices are designed with default settings for optimal wireless connectivity balanced alongside the need to preserve battery life. The most effective way of enabling reliable connectivity for Surface devices is through a well-designed network that supports 802.11r and 802.11k. Users can adjust network adapter settings or roaming aggressiveness but should only do so in response to specific environmental factors and revert to default state if there’s no noticeable improvement. diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md deleted file mode 100644 index 0caea932ab..0000000000 --- a/devices/surface/unenroll-surface-devices-from-semm.md +++ /dev/null @@ -1,158 +0,0 @@ ---- -title: Unenroll Surface devices from SEMM (Surface) -description: Learn how to unenroll a device from SEMM by using a Surface UEFI reset package or the Recovery Request option. -keywords: surface enterprise management -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices, security -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Unenroll Surface devices from SEMM - -When a Surface device is enrolled in Surface Enterprise Management Mode (SEMM), a certificate is stored in the firmware of that device. The presence of that certificate and the enrollment in SEMM prevent any unauthorized changes to Surface UEFI settings or options while the device is enrolled in SEMM. To restore control of Surface UEFI settings to the user, the Surface device must be unenrolled from SEMM, a process sometimes described as reset or recovery. There are two methods you can use to unenroll a device from SEMM—a Surface UEFI reset package and a Recovery Request. - ->[!WARNING] ->To unenroll a device from SEMM and restore user control of Surface UEFI settings, you must have the SEMM certificate that was used to enroll the device in SEMM. If this certificate becomes lost or corrupted, it is not possible to unenroll from SEMM. Back up and protect your SEMM certificate accordingly. - -For more information about SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode). - -## Unenroll a Surface device from SEMM with a Surface UEFI reset package - -The Surface UEFI reset package is the primary method you use to unenroll a Surface device from SEMM. Like a Surface UEFI configuration package, the reset package is a Windows Installer (.msi) file that configures SEMM on the device. Unlike the configuration package, the reset package will reset the Surface UEFI configuration on a Surface device to its default settings, remove the SEMM certificate, and unenroll the device from SEMM. - -Reset packages are created specifically for an individual Surface device. To begin the process of creating a reset package, you will need the serial number of the device you want to unenroll, as well as the SEMM certificate used to enroll the device. You can find the serial number of your Surface device on the **PC information** page of Surface UEFI, as shown in Figure 1. This page is displayed even if Surface UEFI is password protected and the incorrect password is entered. - -![Serial number of Surface device is displayed](images/surface-semm-unenroll-fig1.png "Serial number of Surface device is displayed") - -*Figure 1. The serial number of the Surface device is displayed on the Surface UEFI PC information page* - ->[!NOTE] ->To boot to Surface UEFI, press **Volume Up** and **Power** simultaneously while the device is off. Hold **Volume Up** until the Surface logo is displayed and the device begins to boot. - -To create a Surface UEFI reset package, follow these steps: - -1. Open Microsoft Surface UEFI Configurator from the Start menu. -2. Click **Start**. -3. Click **Reset Package**, as shown in Figure 2. - - ![Select Reset Package to create a package to unenroll Surface device from SEMM](images/surface-semm-unenroll-fig2.png "Select Reset Package to create a package to unenroll Surface device from SEMM") - - *Figure 2. Click Reset Package to create a package to unenroll a Surface device from SEMM* - -4. Click **Certificate Protection** to add your SEMM certificate file with private key (.pfx), as shown in Figure 3. Browse to the location of your certificate file, select the file, and then click **OK**. - - ![Add the SEMM certificate to Surface UEFI reset package](images/surface-semm-unenroll-fig3.png "Add the SEMM certificate to Surface UEFI reset package") - - *Figure 3. Add the SEMM certificate to a Surface UEFI reset package* - -5. Click **Next**. -6. Type the serial number of the device you want to unenroll from SEMM (as shown in Figure 4), and then click **Build** to generate the Surface UEFI reset package. - - ![Create a Surface UEFI reset package with serial number of Surface device](images/surface-semm-unenroll-fig4.png "Create a Surface UEFI reset package with serial number of Surface device") - - *Figure 4. Use the serial number of your Surface device to create a Surface UEFI reset package* - -7. In the **Save As** dialog box, specify a name for the Surface UEFI reset package, browse to the location where you would like to save the file, and then click **Save**. -8. When the package generation has completed, the **Successful** page is displayed. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator. - -Run the Surface UEFI reset package Windows Installer (.msi) file on the Surface device to unenroll the device from SEMM. The reset package will require a reboot to perform the unenroll operation. After the device has been unenrolled, you can verify the successful removal by ensuring that the **Microsoft Surface Configuration Package** item in **Programs and Features** (shown in Figure 5) is no longer present. - -![Screen that shows device is enrolled in SEMM](images/surface-semm-unenroll-fig5.png "Screen that shows device is enrolled in SEMM") - -*Figure 5. The presence of the Microsoft Surface Configuration Package item in Programs and Features indicates that the device is enrolled in SEMM* - -## Unenroll a Surface device from SEMM with a Recovery Request - -In some scenarios, a Surface UEFI reset package may not be a viable option to unenroll a Surface device from SEMM (for example, where Windows has become unusable). In these scenarios you can unenroll the device by using a Recovery Request generated from within Surface UEFI. The Recovery Request process can be initiated even on devices where you do not have the Surface UEFI password. - -The Recovery Request process is initiated from Surface UEFI on the Surface device, approved with Microsoft Surface UEFI Configurator on another computer, and then completed in Surface UEFI. Like the reset package, approving a Recovery Request with Microsoft Surface UEFI Configurator requires access to the SEMM certificate that was used to enroll the Surface device. - -To initiate a Recovery Request, follow these steps: - -1. Boot the Surface device that is to be unenrolled from SEMM to Surface UEFI. -2. Type the Surface UEFI password if you are prompted to do so. -3. Click the **Enterprise management** page, as shown in Figure 6. - - ![Enterprise Management page](images/surface-semm-unenroll-fig6.png "Enterprise Management page") - - *Figure 6. The Enterprise management page is displayed in Surface UEFI on devices enrolled in SEMM* - -4. Click or press **Get Started**. -5. Click or press **Next** to begin the Recovery Request process. - >[!NOTE] - >A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process. -6. Select **SEMM Certificate** from the list of certificates displayed on the **Choose a SEMM reset key** page (shown in Figure 7), and then click or press **Next**. - - ![Select SEMM certificate for your Recovery Request](images/surface-semm-unenroll-fig7.png "Select SEMM certificate for your Recovery Request") - - *Figure 7. Choose SEMM Certificate for your Recovery Request (Reset Request)* - -7. On the **Enter SEMM reset verification code** page you can click the **QR Code** or **Text** buttons to display your Recovery Request (Reset Request) as shown in Figure 8, or the **USB** button to save your Recovery Request (Reset Request) as a file to a USB drive, as shown in Figure 9. - - ![Recovery Request displayed as a QR Code](images/surface-semm-unenroll-fig8.png "Recovery Request displayed as a QR Code") - - *Figure 8. A Recovery Request (Reset Request) displayed as a QR Code* - - ![Save a recovery request to a USB drive](images/surface-semm-unenroll-fig9.png "Save a recovery request to a USB drive") - - *Figure 9. Save a Recovery Request (Reset Request) to a USB drive* - - * To use a QR Code Recovery Request (Reset Request), use a QR reader app on a mobile device to read the code. The QR reader app will translate the QR code into an alphanumeric string. You can then email or message that string to the administrator that will produce the reset verification code with Microsoft Surface UEFI Configurator. - * To use a Recovery Request (Reset Request) saved to a USB drive as a file, use the USB drive to transfer the file to the computer where Microsoft Surface UEFI Configurator will be used to produce the Reset Verification Code. The file can also be copied from the USB drive on another device to be emailed or transferred over the network. - * To use the Recovery Request (Reset Request) as text, simply type the text directly into Microsoft Surface UEFI Configurator. - -8. Open Microsoft Surface UEFI Configurator from the Start menu on another computer. - >[!NOTE] - >Microsoft Surface UEFI Configurator must run in an environment that is able to authenticate the certificate chain for the SEMM certificate. -9. Click **Start**. -10. Click **Recovery Request**, as shown in Figure 10. - - ![Start process to approve a Recovery Request](images/surface-semm-unenroll-fig10.png "Start process to approve a Recovery Request") - - *Figure 10. Click Recovery Request to begin the process to approve a Recovery Request* - -11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate. -12. Browse to and select your SEMM certificate file, and then click **OK**. -13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**. - - ![Type password for SEMM certificate](images/surface-semm-unenroll-fig11.png "Type password for SEMM certificate") - - *Figure 11. Type the password for the SEMM certificate* - -14. Click **Next**. -15. Enter the Recovery Request (Reset Request), and then click **Generate** to create a reset verification code (as shown in Figure 12). - - ![Enter the recovery request](images/surface-semm-unenroll-fig12.png "Enter the recovery request") - - *Figure 12. Enter the Recovery Request (Reset Request)* - - * If you displayed the Recovery Request (Reset Request) as text on the Surface device being reset, use the keyboard to type the Recovery Request (Reset Request) in the provided field. - * If you displayed the Recovery Request (Reset Request) as a QR Code and then used a messaging or email application to send the code to the computer with Microsoft Surface UEFI Configurator, copy and paste the code into the provided field. - * If you saved the Recovery Request (Reset Request) as a file to a USB drive, click the **Import** button, browse to and select the Recovery Request (Reset Request) file, and then click **OK**. - -16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13. - - ![Display of the reset verification code](images/surface-semm-unenroll-fig13.png "Display of the reset verification code") - - *Figure 13. The reset verification code displayed in Microsoft Surface UEFI Configurator* - - * Click the **Share** button to send the reset verification code by email. - -17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM. -18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14. - - ![Example display of successful unenrollment from SEMM](images/surface-semm-unenroll-fig14.png "Example display of successful unenrollment from SEMM") - - *Figure 14. Successful unenrollment from SEMM* - -19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator. - - diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md deleted file mode 100644 index c9345502d8..0000000000 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit (Surface) -description: Find out how to perform a Windows 10 upgrade deployment to your Surface devices. -keywords: windows 10 surface, upgrade, customize, mdt -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro -ms.reviewer: -manager: laurawi -ms.date: 04/24/2020 ---- - -# Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit - -#### Applies to -- Surface Pro 6 -- Surface Laptop 2 -- Surface Go -- Surface Go with LTE -- Surface Book 2 -- Surface Pro with LTE Advanced (Model 1807) -- Surface Pro (Model 1796) -- Surface Laptop -- Surface Studio -- Surface Studio 2 -- Surface Book -- Surface Pro 4 -- Surface 3 LTE -- Surface 3 -- Surface Pro 3 -- Surface Pro 2 -- Surface Pro -- Windows 10 - -In addition to the traditional deployment method of reimaging devices, administrators who want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. - -For the latest information about upgrading surface devices using MDT, refer to [Perform an in-place upgrade to Windows 10 with MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit). - diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md deleted file mode 100644 index 42c6d6f42f..0000000000 --- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md +++ /dev/null @@ -1,536 +0,0 @@ ---- -title: Use Microsoft Endpoint Configuration Manager to manage devices with SEMM (Surface) -description: Learn how to manage Microsoft Surface Enterprise Management Mode (SEMM) with Endpoint Configuration Manager. -keywords: enroll, update, scripts, settings -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: -manager: laurawi -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Use Microsoft Endpoint Configuration Manager to manage devices with SEMM - -The Microsoft Surface Enterprise Management Mode (SEMM) feature of Surface UEFI devices lets administrators manage and help secure the configuration of Surface UEFI settings. For most organizations, this process is accomplished by creating Windows Installer (.msi) packages with the Microsoft Surface UEFI Configurator tool. These packages are then run or deployed to the client Surface devices to enroll the devices in SEMM and to update the Surface UEFI settings configuration. - -For organizations with Microsoft Endpoint Configuration Manager there is an alternative to using the Microsoft Surface UEFI Configurator .msi process to deploy and administer SEMM. Microsoft Surface UEFI Manager is a lightweight installer that makes required assemblies for SEMM management available on a device. By installing these assemblies with Microsoft Surface UEFI Manager on a managed client, SEMM can be administered by Configuration Manager with PowerShell scripts, deployed as applications. With this process, SEMM management is performed within Configuration Manager, which eliminates the need for the external Microsoft Surface UEFI Configurator tool. - -> [!Note] -> Although the process described in this article may work with earlier versions of Endpoint Configuration Manager or with other third-party management solutions, management of SEMM with Microsoft Surface UEFI Manager and PowerShell is supported only with the Current Branch of Endpoint Configuration Manager. - -#### Prerequisites - -Before you begin the process outlined in this article, familiarize yourself with the following technologies and tools: - -* [Surface UEFI](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings) -* [Surface Enterprise Management Mode (SEMM)](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode) -* [PowerShell scripting](https://technet.microsoft.com/scriptcenter/dd742419) -* [System Center Configuration Manager application deployment](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications) -* Certificate management - -> [!Note] -> You will also need access to the certificate that you intend to use to secure SEMM. For details about the requirements for this certificate, see [Surface Enterprise Management Mode certificate requirements](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode#surface-enterprise-management-mode-certificate-requirements). -> -> It is very important that this certificate be kept in a safe location and properly backed up. If this certificate becomes lost or unusable, it is not possible to reset Surface UEFI, change managed Surface UEFI settings, or remove SEMM from an enrolled Surface device. - -#### Download Microsoft Surface UEFI Manager - -Management of SEMM with Configuration Manager requires the installation of Microsoft Surface UEFI Manager on each client Surface device. You can download Microsoft Surface UEFI Manager (SurfaceUEFIManager.msi) from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page on the Microsoft Download Center. - -#### Download SEMM scripts for Configuration Manager - -After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://www.microsoft.com/download/details.aspx?id=46703) from the Download Center. - -## Deploy Microsoft Surface UEFI Manager - -Deployment of Microsoft Surface UEFI Manager is a typical application deployment. The Microsoft Surface UEFI Manager installer file is a standard Windows Installer file that you can install with the [standard quiet option](https://msdn.microsoft.com/library/windows/desktop/aa367988). - -The command to install Microsoft Surface UEFI Manager is as follows. - -`msiexec /i "SurfaceUEFIManagerSetup.msi" /q` - -The command to uninstall Microsoft Surface UEFI Manager is as follows. - -`msiexec /x {541DA890-1AEB-446D-B3FD-D5B3BB18F9AF} /q` - -To create a new application and deploy it to a collection that contains your Surface devices, perform the following steps: - -1. Open Configuration Manager Console from the **Start** screen or **Start** menu. -2. Select **Software Library** in the bottom left corner of the window. -3. Expand the **Application Management** node of the Software Library, and then select **Applications**. -4. Select the **Create Application** button under the **Home** tab at the top of the window. This starts the Create Application Wizard. -5. The Create Application Wizard presents a series of steps: - - * **General** – The **Automatically detect information about this application from installation files** option is selected by default. In the **Type** field, **Windows Installer (.msi file)** is also selected by default. Select **Browse** to navigate to and select **SurfaceUEFIManagerSetup.msi**, and then select **Next**. - - > [!Note] - > The location of SurfaceUEFIManagerSetup.msi must be on a network share and located in a folder that contains no other files. A local file location cannot be used. - - * **Import Information** – The Create Application Wizard will parse the .msi file and read the **Application Name** and **Product Code**. SurfaceUEFIManagerSetup.msi should be listed as the only file under the line **Content Files**, as shown in Figure 1. Select **Next** to proceed. - - ![Information from Surface UEFI Manager setup is automatically parsed](images/config-mgr-semm-fig1.png "Information from Surface UEFI Manager setup is automatically parsed") - - *Figure 1. Information from Microsoft Surface UEFI Manager setup is automatically parsed* - - * **General Information** – You can modify the name of the application and information about the publisher and version, or add comments on this page. The installation command for Microsoft Surface UEFI Manager is displayed in the Installation Program field. The default installation behavior of Install for system will allow Microsoft Surface UEFI Manager to install the required assemblies for SEMM even if a user is not logged on to the Surface device. Select **Next** to proceed. - * **Summary** – The information that was parsed in the **Import Information** step and your selections from the **General Information** step is displayed on this page. Select **Next** to confirm your selections and create the application. - * **Progress** – Displays a progress bar and status as the application is imported and added to the Software Library. - * **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Select **Close** to finish the Create Application Wizard. - -After the application is created in Configuration Manager, you can distribute it to your distribution points and deploy it to the collections including your Surface devices. This application will not install or enable SEMM on the Surface device. It only provides the assemblies required for SEMM to be enabled using the PowerShell script. - -If you do not want to install the Microsoft Surface UEFI Manager assemblies on devices that will not be managed with SEMM, you can configure Microsoft Surface UEFI Manager as a dependency of the SEMM Configuration Manager scripts. This scenario is covered in the [Deploy SEMM Configuration Manager Scripts](#deploy-semm-configuration-manager-scripts) section later in this article. - -## Create or modify the SEMM Configuration Manager scripts - -After the required assemblies have been installed on the devices, the process of enrolling the devices in SEMM and configuring Surface UEFI is done with PowerShell scripts and deployed as a script application with Configuration Manager. These scripts can be modified to fit the needs of your organization and environment. For example, you can create multiple configurations for managed Surface devices in different departments or roles. You can download samples of the scripts for SEMM and Configuration Manager from the link in the [Prerequisites](#prerequisites) section at the beginning of this article. - -There are two primary scripts you will need in order to perform a SEMM deployment with Configuration Manager: - -* **ConfigureSEMM.ps1** – Use this script to create configuration packages for your Surface devices with your desired Surface UEFI settings to apply the specified settings to a Surface device, to enroll the device in SEMM, and to set a registry key used to identify the enrollment of the device in SEMM. -* **ResetSEMM.ps1** – Use this script to reset SEMM on a Surface device, which unenrolls it from SEMM and removes the control over Surface UEFI settings. - -The sample scripts include examples of how to set Surface UEFI settings and how to control permissions to those settings. These settings can be modified to secure Surface UEFI and set Surface UEFI settings according to the needs of your environment. The following sections of this article explain the ConfigureSEMM.ps1 script and explore the modifications you need to make to the script to fit your requirements. - -> [!NOTE] -> The SEMM Configuration Manager scripts and the exported SEMM certificate file (.pfx) should be placed in the same folder with no other files before they are added to Configuration Manager. - -### Specify certificate and package names - -The first region of the script that you need to modify is the portion that specifies and loads the SEMM certificate, and also indicates SurfaceUEFIManager version, and the names for the SEMM configuration package and SEMM reset package. The certificate name and SurfaceUEFIManager version are specified on lines 56 through 73 in the ConfigureSEMM.ps1 script. - - ```powershell - 56 $WorkingDirPath = split-path -parent $MyInvocation.MyCommand.Definition - 57 $packageRoot = "$WorkingDirPath\Config" - 58 $certName = "FabrikamSEMMSample.pfx" - 59 $DllVersion = "2.26.136.0" - 60 - 61 $certNameOnly = [System.IO.Path]::GetFileNameWithoutExtension($certName) - 62 $ProvisioningPackage = $certNameOnly + "ProvisioningPackage.pkg" - 63 $ResetPackage = $certNameOnly + "ResetPackage.pkg" - 64 - 65 if (-not (Test-Path $packageRoot)) { New-Item -ItemType Directory -Force -Path $packageRoot } - 66 Copy-Item "$WorkingDirPath\$certName" $packageRoot - 67 - 68 $privateOwnerKey = Join-Path -Path $packageRoot -ChildPath $certName - 69 $ownerPackageName = Join-Path -Path $packageRoot -ChildPath $ProvisioningPackage - 70 $resetPackageName = Join-Path -Path $packageRoot -ChildPath $ResetPackage - 71 - 72 # If your PFX file requires a password then it can be set here, otherwise use a blank string. - 73 $password = "1234" - ``` - -Replace the **FabrikamSEMMSample.pfx** value for the **$certName** variable with the name of your SEMM Certificate file on line 58. The script will create a working directory (named Config) in the folder where your scripts are located, and then copies the certificate file to this working directory. - -Owner package and reset package will also be created in the Config directory and hold the configuration for Surface UEFI settings and permissions generated by the script. - -On line 73, replace the value of the **$password** variable, from **1234** to the password for your certificate file. If a password is not required, delete the **1234** text. - -> [!Note] -> The last two characters of the certificate thumbprint are required to enroll a device in SEMM. This script will display these digits to the user, which allows the user or technician to record these digits before the system reboots to enroll the device in SEMM. The script uses the following code, found on lines 150-155, to accomplish this. - -```powershell -150 # Device owners will need the last two characters of the thumbprint to accept SEMM ownership. -151 # For convenience we get the thumbprint here and present to the user. -152 $pw = ConvertTo-SecureString $password -AsPlainText -Force -153 $certPrint = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -154 $certPrint.Import($privateOwnerKey, $pw, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::DefaultKeySet) -155 Write-Host "Thumbprint =" $certPrint.Thumbprint -``` - -Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process: - -1. Right-click the .pfx file, and then select **Open**. -2. Expand the folder in the navigation pane. -3. Select **Certificates**. -4. Right-click your certificate in the main pane, and then select **Open**. -5. Select the **Details** tab. -6. **All** or **Properties Only** must be selected in the **Show** drop-down menu. -7. Select the field **Thumbprint**. - -> [!NOTE] -> The SEMM certificate name and password must also be entered in this section of the ResetSEMM.ps1 script to enable Configuration Manager to remove SEMM from the device with the uninstall action. - -### Configure permissions - -The first region of the script where you will specify the configuration for Surface UEFI is the **Configure Permissions** region. This region begins at line 210 in the sample script with the comment **# Configure Permissions** and continues to line 247. The following code fragment first sets permissions to all Surface UEFI settings so that they may be modified by SEMM only, then adds explicit permissions to allow the local user to modify the Surface UEFI password, TPM, and front and rear cameras. - -```powershell -210 # Configure Permissions -211 foreach ($uefiV2 IN $surfaceDevices.Values) { -212 if ($uefiV2.SurfaceUefiFamily -eq $Device.Model) { -213 Write-Host "Configuring permissions" -214 Write-Host $Device.Model -215 Write-Host "=======================" -216 -217 # Here we define which "identities" will be allowed to modify which settings -218 # PermissionSignerOwner = The primary SEMM enterprise owner identity -219 # PermissionLocal = The user when booting to the UEFI pre-boot GUI -220 # PermissionSignerUser, PermissionSignerUser1, PermissionSignerUser2 = -221 # Additional user identities created so that the signer owner -222 # can delegate permission control for some settings. -223 $ownerOnly = [Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -224 $ownerAndLocalUser = ([Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -bor [Microsoft.Surface.IUefiSetting]::PermissionLocal) -225 -226 # Make all permissions owner only by default -227 foreach ($setting IN $uefiV2.Settings.Values) { -228 $setting.ConfiguredPermissionFlags = $ownerOnly -229 } -230 -231 # Allow the local user to change their own password -232 $uefiV2.SettingsById[501].ConfiguredPermissionFlags = $ownerAndLocalUser -233 -234 Write-Host "" -235 -236 # Create a unique package name based on family and LSV. -237 # We will choose a name that can be parsed by later scripts. -238 $packageName = $uefiV2.SurfaceUefiFamily + "^Permissions^" + $lsv + ".pkg" -239 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName -240 -241 # Build and sign the Permission package then save it to a file. -242 $permissionPackageStream = $uefiV2.BuildAndSignPermissionPackage($privateOwnerKey, $password, "", $null, $lsv) -243 $permissionPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) -244 $permissionPackageStream.CopyTo($permissionPackage) -245 $permissionPackage.Close() -246 } -247 } -``` - -Each **$uefiV2** variable identifies a Surface UEFI setting by setting name or ID, and then configures the permissions to one of the following values: - -* **$ownerOnly** – Permission to modify this setting is granted only to SEMM. -* **$ownerAndLocalUser** – Permission to modify this setting is granted to a local user booting to Surface UEFI, as well as to SEMM. - -You can find information about the available settings names and IDs for Surface UEFI in the [Settings Names and IDs](#settings-names-and-ids) section of this article. - -### Configure settings - -The second region of the script where you will specify the configuration for Surface UEFI is the **Configure Settings** region of the ConfigureSEMM.ps1 script, which configures whether each setting is enabled or disabled. The sample script includes instructions to set all settings to their default values. The script then provides explicit instructions to disable IPv6 for PXE Boot and to leave the Surface UEFI Administrator password unchanged. You can find this region beginning with the **# Configure Settings** comment at line 291 through line 335 in the sample script. The region appears as follows. - -```powershell -291 # Configure Settings -292 foreach ($uefiV2 IN $surfaceDevices.Values) { -293 if ($uefiV2.SurfaceUefiFamily -eq $Device.Model) { -294 Write-Host "Configuring settings" -295 Write-Host $Device.Model -296 Write-Host "====================" -297 -298 # In this demo, we will start by setting every setting to the default factory setting. -299 # You may want to start by doing this in your scripts -300 # so that every setting gets set to a known state. -301 foreach ($setting IN $uefiV2.Settings.Values) { -302 $setting.ConfiguredValue = $setting.DefaultValue -303 } -304 -305 $EnabledValue = "Enabled" -306 $DisabledValue = "Disabled" -307 -308 # If you want to set something to a different value from the default, -309 # here are examples of how to accomplish this. -310 # This disables IPv6 PXE boot by name: -311 $uefiV2.Settings["IPv6 for PXE Boot"].ConfiguredValue = $DisabledValue -312 -313 # This disables IPv6 PXE Boot by ID: -314 $uefiV2.SettingsById[400].ConfiguredValue = $DisabledValue -315 -316 Write-Host "" -317 -318 # If you want to leave the setting unmodified, set it to $null -319 # PowerShell has issues setting things to $null so ClearConfiguredValue() -320 # is supplied to do this explicitly. -321 # Here is an example of leaving the UEFI administrator password as-is, -322 # even after we initially set it to factory default above. -323 $uefiV2.SettingsById[501].ClearConfiguredValue() -324 -325 # Create a unique package name based on family and LSV. -326 # We will choose a name that can be parsed by later scripts. -327 $packageName = $uefiV2.SurfaceUefiFamily + "^Settings^" + $lsv + ".pkg" -328 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName -329 -330 # Build and sign the Settings package then save it to a file. -331 $settingsPackageStream = $uefiV2.BuildAndSignSecuredSettingsPackage($privateOwnerKey, $password, "", $null, $lsv) -332 $settingsPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) -333 $settingsPackageStream.CopyTo($settingsPackage) -334 $settingsPackage.Close() -335 } -``` - -Like the permissions set in the **Configure Permissions** section of the script, the configuration of each Surface UEFI setting is performed by defining the **$uefiV2** variable. For each line defining the **$uefiV2** variable, a Surface UEFI setting is identified by setting name or ID and the configured value is set to **Enabled** or **Disabled**. - -If you do not want to alter the configuration of a Surface UEFI setting, for example to ensure that the Surface UEFI administrator password is not cleared by the action of resetting all Surface UEFI settings to their default, you can use **ClearConfiguredValue()** to enforce that this setting will not be altered. In the sample script, this is used on line 323 to prevent the clearing of the Surface UEFI Administrator password, identified in the sample script by its setting ID, **501**. - -You can find information about the available settings names and IDs for Surface UEFI in the [Settings Names and IDs](#settings-names-and-ids) section later in this article. - -### Settings registry key - -To identify enrolled systems for Configuration Manager, the ConfigureSEMM.ps1 script writes registry keys that can be used to identify enrolled systems as having been installed with the SEMM configuration script. These keys can be found at the following location. - -`HKLM\SOFTWARE\Microsoft\Surface\SEMM` - -The following code fragment, found on lines 380-477, is used to write these registry keys. - -```powershell -380 # For Endpoint Configuration Manager or other management solutions that wish to know what version is applied, tattoo the LSV and current DateTime (in UTC) to the registry: -381 $UTCDate = (Get-Date).ToUniversalTime().ToString() -382 $certIssuer = $certPrint.Issuer -383 $certSubject = $certPrint.Subject -384 -385 $SurfaceRegKey = "HKLM:\SOFTWARE\Microsoft\Surface\SEMM" -386 New-RegKey $SurfaceRegKey -387 $LSVRegValue = Get-ItemProperty $SurfaceRegKey LSV -ErrorAction SilentlyContinue -388 $DateTimeRegValue = Get-ItemProperty $SurfaceRegKey LastConfiguredUTC -ErrorAction SilentlyContinue -389 $OwnershipSessionIdRegValue = Get-ItemProperty $SurfaceRegKey OwnershipSessionId -ErrorAction SilentlyContinue -390 $PermissionSessionIdRegValue = Get-ItemProperty $SurfaceRegKey PermissionSessionId -ErrorAction SilentlyContinue -391 $SettingsSessionIdRegValue = Get-ItemProperty $SurfaceRegKey SettingsSessionId -ErrorAction SilentlyContinue -392 $IsResetRegValue = Get-ItemProperty $SurfaceRegKey IsReset -ErrorAction SilentlyContinue -393 $certUsedRegValue = Get-ItemProperty $SurfaceRegKey CertName -ErrorAction SilentlyContinue -394 $certIssuerRegValue = Get-ItemProperty $SurfaceRegKey CertIssuer -ErrorAction SilentlyContinue -395 $certSubjectRegValue = Get-ItemProperty $SurfaceRegKey CertSubject -ErrorAction SilentlyContinue -396 -397 -398 If ($LSVRegValue -eq $null) -399 { -400 New-ItemProperty -Path $SurfaceRegKey -Name LSV -PropertyType DWORD -Value $lsv | Out-Null -401 } -402 Else -403 { -404 Set-ItemProperty -Path $SurfaceRegKey -Name LSV -Value $lsv -405 } -406 -407 If ($DateTimeRegValue -eq $null) -408 { -409 New-ItemProperty -Path $SurfaceRegKey -Name LastConfiguredUTC -PropertyType String -Value $UTCDate | Out-Null -410 } -411 Else -412 { -413 Set-ItemProperty -Path $SurfaceRegKey -Name LastConfiguredUTC -Value $UTCDate -414 } -415 -416 If ($OwnershipSessionIdRegValue -eq $null) -417 { -418 New-ItemProperty -Path $SurfaceRegKey -Name OwnershipSessionId -PropertyType String -Value $ownerSessionIdValue | Out-Null -419 } -420 Else -421 { -422 Set-ItemProperty -Path $SurfaceRegKey -Name OwnershipSessionId -Value $ownerSessionIdValue -423 } -424 -425 If ($PermissionSessionIdRegValue -eq $null) -426 { -427 New-ItemProperty -Path $SurfaceRegKey -Name PermissionSessionId -PropertyType String -Value $permissionSessionIdValue | Out-Null -428 } -429 Else -430 { -431 Set-ItemProperty -Path $SurfaceRegKey -Name PermissionSessionId -Value $permissionSessionIdValue -432 } -433 -434 If ($SettingsSessionIdRegValue -eq $null) -435 { -436 New-ItemProperty -Path $SurfaceRegKey -Name SettingsSessionId -PropertyType String -Value $settingsSessionIdValue | Out-Null -437 } -438 Else -439 { -440 Set-ItemProperty -Path $SurfaceRegKey -Name SettingsSessionId -Value $settingsSessionIdValue -441 } -442 -443 If ($IsResetRegValue -eq $null) -444 { -445 New-ItemProperty -Path $SurfaceRegKey -Name IsReset -PropertyType DWORD -Value 0 | Out-Null -446 } -447 Else -448 { -449 Set-ItemProperty -Path $SurfaceRegKey -Name IsReset -Value 0 -450 } -451 -452 If ($certUsedRegValue -eq $null) -453 { -454 New-ItemProperty -Path $SurfaceRegKey -Name CertName -PropertyType String -Value $certName | Out-Null -455 } -456 Else -457 { -458 Set-ItemProperty -Path $SurfaceRegKey -Name CertName -Value $certName -459 } -460 -461 If ($certIssuerRegValue -eq $null) -462 { -463 New-ItemProperty -Path $SurfaceRegKey -Name CertIssuer -PropertyType String -Value $certIssuer | Out-Null -464 } -465 Else -466 { -467 Set-ItemProperty -Path $SurfaceRegKey -Name CertIssuer -Value $certIssuer -468 } -469 -470 If ($certSubjectRegValue -eq $null) -471 { -472 New-ItemProperty -Path $SurfaceRegKey -Name CertSubject -PropertyType String -Value $certSubject | Out-Null -473 } -474 Else -475 { -476 Set-ItemProperty -Path $SurfaceRegKey -Name CertSubject -Value $certSubject -477 } -``` - -### Settings names and IDs - -To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from SEMM_Powershell.zip in [Surface Tools for IT Downloads](https://www.microsoft.com/download/details.aspx?id=46703) - -The computer where ShowSettingsOptions.ps1 is run must have Microsoft Surface UEFI Manager installed, but the script does not require a Surface device. - -The following tables show the available settings for Surface Pro 4 and later including Surface Pro 7, Surface Book, Surface Laptop 3, and Surface Go. - -*Table 1. Surface UEFI settings for Surface Pro 4* - -| Setting ID | Setting Name | Description | Default Setting | -| --- | --- | --- | --- | -|501| Password | UEFI System Password | | -|200| Secure Boot Keys | Secure Boot signing keys to enable for EFI applications | MsPlus3rdParty | -|300| Trusted Platform Module (TPM) | TPM device enabled or disabled | Enabled | -|301| Docking USB Port | Docking USB Port enabled or disabled | Enabled | -|302| Front Camera | Front Camera enabled or disabled | Enabled | -|303| Bluetooth | Bluetooth radio enabled or disabled | Enabled | -|304| Rear Camera | Rear Camera enabled or disabled | Enabled | -|305| IR Camera | InfraRed Camera enabled or disabled | Enabled | -|308| Wi-Fi and Bluetooth | Wi-Fi and Bluetooth enabled or disabled | Enabled | -|310| Type Cover | Surface Type Cover connector | Enabled | -|320| On-board Audio | On-board audio enabled or disabled | Enabled | -|330| Micro SD Card | Micro SD Card enabled or disabled | Enabled | -|370| USB Port 1 | Side USB Port (1) | UsbPortEnabled | -|400| IPv6 for PXE Boot | Enable IPv6 PXE boot before IPv4 PXE boot |Disabled | -|401| Alternate Boot | Alternate Boot allows users to override the boot order by holding the volume down button when powering up the device | Enabled | -|402| Boot Order Lock | Boot Order variable lock enabled or disabled | Disabled | -|403| USB Boot | Enable booting from USB devices | Enabled | -|500| TPM clear EFI protocol | Enable EFI protocol for invoking TPM clear | Disabled | -|600| Security | UEFI Security Page Display enabled or disabled | Enabled | -|601| Devices | UEFI Devices Page Display enabled or disabled | Enabled | -|602| Boot | UEFI Boot Manager Page Display enabled or disabled | Enabled | - -*Table 2. Surface UEFI settings for Surface Book* - -| Setting ID | Setting Name | Description | Default Setting | -| --- | --- | --- | --- | -| 501 | Password | UEFI System Password | | -| 200 | Secure Boot Keys | Secure Boot signing keys to enable for EFI applications | MsPlus3rdParty | -| 300 | Trusted Platform Module (TPM) | TPM device enabled or disabled | Enabled | -| 301 | Docking USB Port | Docking USB Port enabled or disabled | Enabled | -| 302 | Front Camera | Front Camera enabled or disabled | Enabled | -| 303 | Bluetooth | Bluetooth radio enabled or disabled | Enabled | -| 304 | Rear Camera | Rear Camera enabled or disabled | Enabled | -| 305 | IR Camera | InfraRed Camera enabled or disabled | Enabled | -| 308 | Wi-Fi and Bluetooth | Wi-Fi and Bluetooth enabled or disabled | Enabled | -| 320 | On-board Audio | On-board audio enabled or disabled | Enabled | -| 400 | IPv6 for PXE Boot Enable | IPv6 PXE boot before IPv4 PXE boot | Disabled | -| 401 | Alternate Boot | Alternate Boot allows users to override the boot order by holding the volume down button when powering up the device | Enabled | -| 402 | Boot Order Lock | Boot Order variable lock enabled or disabled | Disabled | -| 403 | USB Boot | Enable booting from USB devices | Enabled | -| 500 | TPM clear EFI protocol | Enable EFI protocol for invoking TPM clear | Disabled | -| 600 | Security | UEFI Security Page Display enabled or disabled | Enabled | -| 601 | Devices | UEFI Devices Page Display enabled or disabled | Enabled | -| 602 | Boot | UEFI Boot Manager Page Display enabled or disabled | Enabled | - -## Deploy SEMM Configuration Manager scripts - -After your scripts are prepared to configure and enable SEMM on the client device, the next step is to add these scripts as an application in Configuration Manager. Before you open Configuration Manager, ensure that the following files are in a shared folder that does not include other files: - -* ConfigureSEMM.ps1 -* ResetSEMM.ps1 -* Your SEMM certificate (for example SEMMCertificate.pfx) - -The SEMM Configuration Manager scripts will be added to Configuration Manager as a script application. The command to install SEMM with ConfigureSEMM.ps1 is as follows. - -`Powershell.exe -file ".\ConfigureSEMM.ps1"` - -The command to uninstall SEMM with ResetSEMM.ps1 is as follows. - -`Powershell.exe -file ".\ResetSEMM.ps1"` - -To add the SEMM Configuration Manager scripts to Configuration Manager as an application, use the following process: - -1. Start the Create Application Wizard using Step 1 through Step 5 from the [Deploy Microsoft Surface UEFI Manager](#deploy-microsoft-surface-uefi-manager) section earlier in this article. - -2. Proceed through The Create Application Wizard as follows: - - - **General** – Select **Manually specify the application information**, and then select **Next**. - - - **General Information** – Enter a name for the application (for example SEMM) and any other information you want such as publisher, version, or comments on this page. Select **Next** to proceed. - - - **Application Catalog** – The fields on this page can be left with their default values. Select **Next**. - - - **Deployment Types** – Select **Add** to start the Create Deployment Type Wizard. - - - Proceed through the steps of the Create Deployment Type Wizard, as follows: - - * **General** – Select **Script Installer** from the **Type** drop-down menu. The **Manually specify the deployment type information** option will automatically be selected. Select **Next** to proceed. - * **General Information** – Enter a name for the deployment type (for example SEMM Configuration Scripts), and then select **Next** to continue. - * **Content** – Select **Browse** next to the **Content Location** field, and then select the folder where your SEMM Configuration Manager scripts are located. In the **Installation Program** field, type the [installation command](#deploy-semm-configuration-manager-scripts) found earlier in this article. In the **Uninstall Program** field, enter the [uninstallation command](#deploy-semm-configuration-manager-scripts) found earlier in this article (shown in Figure 2). Select **Next** to move to the next page. - - ![Set the SEMM Configuration Manager scripts as the install and uninstall commands](images/config-mgr-semm-fig2.png "Set the SEMM Configuration Manager scripts as the install and uninstall commands") - - *Figure 2. Set the SEMM Configuration Manager scripts as the install and uninstall commands* - - * **Detection Method** – Select **Add Clause** to add the SEMM Configuration Manager script registry key detection rule. The **Detection Rule** window is displayed, as shown in Figure 3. Use the following settings: - - - Select **Registry** from the **Setting Type** drop-down menu. - - Select **HKEY_LOCAL_MACHINE** from the **Hive** drop-down menu. - - Enter **SOFTWARE\Microsoft\Surface\SEMM** in the **Key** field. - - Enter **CertName** in the **Value** field. - - Select **String** from the **Data Type** drop-down menu. - - Select the **This registry setting must satisfy the following rule to indicate the presence of this application** button. - - Enter the name of the certificate you entered in line 58 of the script in the **Value** field. - - Select **OK** to close the **Detection Rule** window. - - ![Use a registry key to identify devices enrolled in SEMM](images/config-mgr-semm-fig3.png "Use a registry key to identify devices enrolled in SEMM") - - *Figure 3. Use a registry key to identify devices enrolled in SEMM* - - * Select **Next** to proceed to the next page. - - * **User Experience** – Select **Install for system** from the **Installation Behavior** drop-down menu. If you want your users to record and enter the certificate thumbprint themselves, leave the logon requirement set to **Only when a user is logged on**. If you want your administrators to enter the thumbprint for users and the users do not need to see the thumbprint, select **Whether or not a user is logged on** from the **Logon Requirement** drop-down menu. - - * **Requirements** – The ConfigureSEMM.ps1 script automatically verifies that the device is a Surface device before attempting to enable SEMM. However, if you intend to deploy this script application to a collection with devices other than those to be managed with SEMM, you could add requirements here to ensure this application would run only on Surface devices or devices you intend to manage with SEMM. Select **Next** to continue. - - * **Dependencies** – Select **Add** to open the **Add Dependency** window. - - * Select **Add** to open the **Specify Required Application** window. - - - Enter a name for the SEMM dependencies in the **Dependency Group Name** field (for example, *SEMM Assemblies*). - - - Select **Microsoft Surface UEFI Manager** from the list of **Available Applications** and the MSI deployment type, and then select **OK** to close the **Specify Required Application** window. - - * Keep the **Auto Install** check box selected if you want Microsoft Surface UEFI Manager installed automatically on devices when you attempt to enable SEMM with the Configuration Manager scripts. Select **OK** to close the **Add Dependency** window. - - * Select **Next** to proceed. - - * **Summary** – The information you have entered throughout the Create Deployment Type wizard is displayed on this page. Select **Next** to confirm your selections. - - * **Progress** – A progress bar and status as the deployment type is added for the SEMM script application is displayed on this page. - - * **Completion** – Confirmation of the deployment type creation is displayed when the process is complete. Select **Close** to finish the Create Deployment Type Wizard. - - - **Summary** – The information that you entered throughout the Create Application Wizard is displayed. Select **Next** to create the application. - - - **Progress** – A progress bar and status as the application is added to the Software Library is displayed on this page. - - - **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Select **Close** to finish the Create Application Wizard. - -After the script application is available in the Software Library of Configuration Manager, you can distribute and deploy SEMM using the scripts you prepared to devices or collections. If you have configured the Microsoft Surface UEFI Manager assemblies as a dependency that will be automatically installed, you can deploy SEMM in a single step. If you have not configured the assemblies as a dependency, they must be installed on the devices you intend to manage before you enable SEMM. - -When you deploy SEMM using this script application and with a configuration that is visible to the end user, the PowerShell script will start and the thumbprint for the certificate will be displayed by the PowerShell window. You can have your users record this thumbprint and enter it when prompted by Surface UEFI after the device reboots. - -Alternatively, you can configure the application installation to reboot automatically and to install invisibly to the user. In this scenario, a technician will be required to enter the thumbprint on each device as it reboots. Any technician with access to the certificate file can read the thumbprint by viewing the certificate with CertMgr. Instructions for viewing the thumbprint with CertMgr are in the [Create or modify the SEMM Configuration Manager scripts](#create-or-modify-the-semm-configuration-manager-scripts) section of this article. - -Removal of SEMM from a device deployed with Configuration Manager using these scripts is as easy as uninstalling the application with Configuration Manager. This action starts the ResetSEMM.ps1 script and properly unenrolls the device with the same certificate file that was used during the deployment of SEMM. - -> [!NOTE] -> Microsoft Surface recommends that you create reset packages only when you need to unenroll a device. These reset packages are typically valid for only one device, identified by its serial number. You can, however, create a universal reset package that would work for any device enrolled in SEMM with this certificate. -> -> We strongly recommend that you protect your universal reset package as carefully as the certificate you used to enroll devices in SEMM. Please remember that, just like the certificate itself, this universal reset package can be used to unenroll any of your organization’s Surface devices from SEMM. -> -> When you install a reset package, the Lowest Supported Value (LSV) is reset to a value of 1. You can reenroll a device by using an existing configuration package. The device will prompt for the certificate thumbprint before ownership is taken. -> -> For this reason, the reenrollment of a device in SEMM would require a new package to be created and installed on that device. Because this action is a new enrollment and not a change in configuration on a device already enrolled in SEMM, the device will prompt for the certificate thumbprint before ownership is taken. diff --git a/devices/surface/using-the-sda-deployment-share.md b/devices/surface/using-the-sda-deployment-share.md deleted file mode 100644 index 0309d071ec..0000000000 --- a/devices/surface/using-the-sda-deployment-share.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: Using the Microsoft Surface Deployment Accelerator deployment share (Surface) -description: Explore the scenarios where you can use SDA to meet the deployment needs of your organization including Proof of Concept, pilot deployment, as well as import additional drivers and applications. -keywords: deploy, install, automate, deployment solution -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro -ms.reviewer: -manager: laurawi ---- - -# Using the Microsoft Surface Deployment Accelerator deployment share - -With Microsoft Surface Deployment Accelerator (SDA), you can quickly and easily set up a deployment solution that is ready to deploy Windows to Surface devices. The prepared environment is built on powerful deployment technologies available from Microsoft, such as the [Microsoft Deployment Toolkit (MDT)](https://technet.microsoft.com/windows/dn475741), and is capable of immediately performing a deployment after configuration. See [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator) for a comprehensive walkthrough of using the SDA wizard to set up a deployment share and perform a deployment. - -For more information about SDA and information on how to download SDA, see [Microsoft Surface Deployment Accelerator (SDA)](https://technet.microsoft.com/itpro/surface/microsoft-surface-deployment-accelerator). - -> [!NOTE] -> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md). - -Using SDA provides these primary benefits: - -* With SDA, you can create a ready-to-deploy environment that can deploy to target devices as fast as your download speeds allow. The wizard experience enables you to check a few boxes and then the automated process builds your deployment environment for you. - -* With SDA, you prepare a deployment environment built on the industry leading deployment solution of MDT. With MDT you can scale from a relatively basic deployment of a few Surface devices to a solution capable of deploying to thousands of devices including all of the different makes and models in your organization and all of the applications required by each device and user. - -This article explores four scenarios where you can use SDA to meet the needs of your organization. See [Deploy Windows 10](https://technet.microsoft.com/itpro/windows/deploy/index) to explore the capabilities of MDT and the Windows deployment technologies available from Microsoft in greater detail. - -## Perform a Proof of Concept deployment - -One of the primary scenarios for use of SDA is as a Proof of Concept. A *Proof of Concept* (PoC) enables you to test or evaluate the capabilities of a solution or technology. A PoC is often used to illustrate the benefits of the solution or technology to decision makers. For example, if you want to recommend Surface devices as a replacement of older point of sale (POS) systems, you could perform a PoC to demonstrate how Surface devices provide superior computing power, flexibility, and connectivity when compared to alternate options. - -Using SDA to prepare a PoC of Surface devices enables you to very quickly prepare a demonstration of Surface device or devices, which gives you more time for customization or preparation. The flexibility of SDA even lets you import resources, like applications and drivers, from existing MDT deployment infrastructure. See the [Work with existing deployment shares](#work-with-existing-deployment-shares) section later in this article for more information. - -SDA is also an excellent PoC of the capabilities of MDT. SDA demonstrates just how quickly an MDT deployment environment can be prepared and made ready for deployment to devices. It also shows just how flexible and customizable the MDT solution can be, with support for Windows 10 and Windows 8.1, for Microsoft Store and desktop applications, and several models of Surface devices. - -Some recommendations for a successful PoC with SDA are: - -* Keep your SDA deployment environment separate from your production network. This ensures optimal performance and reduces potential for conflicts during your PoC deployment. - -* Use a fresh and updated instance of Windows Server to house your SDA deployment share to maintain the simplicity and performance of the demonstration environment. - -* Test the deployment process before you demonstrate your PoC. This reduces the potential for unexpected situations and keeps the demonstration focused on the deployment process and Surface devices. - -* Use offline files with SDA to further reduce installation times. - -* For help with your PoC, contact [Surface Support](https://www.microsoft.com/surface/support/contact-us-business). - -## Perform a pilot deployment - -A pilot deployment differs from a PoC. Where a PoC is usually a closed demonstration that is performed prior to the deployment process in order to get approval for the use of certain technologies or solutions, a *pilot deployment* is performed during the deployment process as a limited scope deployment for testing and validation. The focus of a pilot deployment can be as narrow as only a handful of devices, or wide enough to include a significant portion of your organization. - ->[!NOTE] ->A pilot deployment should not replace the testing process that should be performed regularly in the lab as the deployment environment is built and developed. A deployment solution should be tested in virtual and physical environments as new applications and drivers are added and when task sequences are modified and before a pilot deployment is performed. - -For example, you are tasked with deploying Surface devices to mobile workers and you want to test the organization’s MDT deployment process by providing a small number of devices to executives. You can use SDA to create an isolated Surface deployment environment and then copy the task sequence, applications, and drivers needed from the production deployment share. This not only enables you to quickly create a Surface deployment, but it also minimizes the risk to the production deployment process used for other types of devices. - -For small organizations, the pilot deployment environment of SDA may suffice as a complete deployment solution. Even if you do not have an existing deployment environment, you can import drivers and applications (covered later in this article) to provide a complete deployment solution based on MDT. Even without previous knowledge of MDT or Windows deployment, you can follow the [Step-by-Step: Surface Deployment Accelerator](https://technet.microsoft.com/itpro/surface/step-by-step-surface-deployment-accelerator) article to get started with a deployment to Surface devices. - -## Import additional drivers - -The SDA deployment share includes all of the drivers needed for Surface devices. This includes the drivers for the components inside the Surface device, such as the wireless network adapter and the main chipset, as well as drivers for Surface accessories, such as the Surface Dock or Surface USB Ethernet adapters. The SDA deployment share does not, however, include drivers for third-party devices or peripherals. - -For example, you may intend to use your Surface device with a thermal printer, credit card reader, and barcode scanner as a POS terminal. In this scenario, the thermal printer, credit card reader, and barcode scanner will very likely require installation of drivers to operate properly. You could potentially download and install these drivers from Windows Update when each peripheral is connected, or you could install the driver package from the manufacturer manually on each Surface device, but the ideal solution is to have these drivers already present in Windows so that when the peripheral is connected, it will just work. - -Because SDA is built on MDT, adding the drivers to the SDA deployment share is easy and simple. - ->[!NOTE] ->The drivers must be in the Setup Information File (.inf) format. If the drivers for your device come as an executable file (.exe), they may need to be extracted or installed to procure the .inf file. Some device drivers come packaged with applications, for example an all-in-one printer bundled with scan software. These applications will need to be installed separately from the drivers. - -To import drivers for a peripheral device: - -1. Download the drivers for your device from the manufacturer web site. - -2. Open the MDT Deployment Workbench. - -3. Expand the **Deployment Shares** node and expand the SDA deployment share. - -4. Expand the **Out-of-Box Drivers** folder. - -5. Select the folder of the Surface model for which you would like to include this driver. - -6. Click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 1. - - ![Provide the location of your driver files](images/using-sda-driverfiles-fig1.png "Provide the location of your driver files") - - *Figure 1. Provide the location of your driver files* - -7. The Import Drivers Wizard presents a series of steps: - - - **Specify Directory** – Click **Browse** and navigate to the folder where you stored the drivers in Step 1. - - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - - **Progress** – While the drivers are imported, a progress bar is displayed on this page. - - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard. - -8. Repeat Steps 5-7 for each Surface model on which you would like to include this driver. - -9. Close the Deployment Workbench. - -After the drivers are imported for the Surface model, the deployment task sequence will automatically select the drivers during the deployment process and include them in the Windows environment. When you connect your device, such as the barcode scanner in the example, Windows should automatically detect the device and you should be able to use it immediately. - ->[!NOTE] ->You can even import drivers for other computer makes and models to support other devices. See **Step 5: Prepare the drivers repository** in [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt) for more information about how to import drivers for other makes and models. - -## Import additional applications - -As with drivers, the SDA deployment share can be pre-configured with apps like the Surface App and Microsoft Office 365. You can also add applications to the SDA deployment share and configure them to be installed on your Surface devices during deployment of Windows. In the ideal scenario, your Surface devices deployed with the SDA deployment share will include all of the applications needed to be ready for your end users. - -In the previous example for including drivers for a POS system, you would also need to include POS software for processing transactions and recording the input from the barcode scanner and credit card reader. To import an application and prepare it for installation on your Surface devices during Windows deployment: - -1. Download the application installation files or locate the installation media for your application. - -2. Determine the command line instruction for silent installation, usually provided by the developer of the application. For Windows Installer files (.msi), see [Standard Installer Command-Line Options](https://msdn.microsoft.com/library/windows/desktop/aa372024) in the Windows Dev Center. - -3. Open the MDT Deployment Workbench. - -4. Expand the **Deployment Shares** node and expand the SDA deployment share. - -5. Expand the **Applications** folder. - -6. Click **New Application** to start the New Application Wizard, as shown in Figure 2. - - ![Provide the command to install your application](images/using-sda-installcommand-fig2.png "Provide the command to install your application") - - *Figure 2: Provide the command to install your application* - -7. Follow the steps of the New Application Wizard: - - - **Application Type** – Click **Application with Source Files**, and then click **Next**. - - **Details** – Enter a name for the application in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**. - - **Source** – Click **Browse** to navigate to and select the folder with the application installation files procured in Step 1, and then click **Next**. - - **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name. - - **Command Details** – Enter the silent command-line instruction, for example `setup.msi /quiet /norestart` - - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process. - - **Progress** – While the installation files are imported, a progress bar is displayed on this page. - - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard. - -8. Click the **Task Sequences** folder, right-click **1 - Deploy Microsoft Surface**, and then click **Properties**. - -9. Click the **Task Sequence** tab to view the steps that are included in the new task sequence. - -10. Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**. - -11. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3. - - ![A new Install Application step for Sample POS App](images/using-sda-newinstall-fig3.png "A new Install Application step for Sample POS App") - - *Figure 3. A new Install Application step for Sample POS App* - -12. On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app. - -13. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share. - -14. Select your app from the list of applications, and then click **OK**. - -15. Click **OK** to close the task sequence properties. - -16. Close the Deployment Workbench. - -## Work with existing deployment shares - -One of the many benefits of an MDT deployment share is the simplicity of how deployment resources are stored. The MDT deployment share is, at its core, just a standard network file share. All deployment resources, such as Windows images, application installation files, and drivers, are stored in a share that can be browsed with File Explorer, copied and pasted, and moved just like any other file share, provided that you have the necessary permissions. This makes working with deployment resources extremely easy. MDT even allows you to make it easier by allowing you to open multiple deployment shares from the Deployment Workbench and to transfer or copy resources between them. - -This ability gives SDA some extra capabilities when used in an environment with an existing MDT infrastructure. For example, if you install SDA on an isolated server to prepare a PoC and then log on to your production MDT deployment share from the Deployment Workbench on your SDA server, you can copy applications, drivers, task sequences, and other components into the SDA deployment share that is prepared with Surface apps and drivers. With this process, in a very short amount time, you can have a deployment environment ready to deploy your organization’s precise requirements to Surface devices. - -You can also use this capability in reverse. For example, you can copy the Surface drivers, deployment task sequences, and apps directly into a lab or testing environment following a successful PoC. Using these resources, you can immediately begin to integrate Surface deployment into your existing deployment infrastructure. diff --git a/devices/surface/wake-on-lan-for-surface-devices.md b/devices/surface/wake-on-lan-for-surface-devices.md deleted file mode 100644 index a6686dcf69..0000000000 --- a/devices/surface/wake-on-lan-for-surface-devices.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Wake On LAN for Surface devices (Surface) -description: See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically – even if the devices are powered down. -keywords: update, deploy, driver, wol, wake-on-lan -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: surface, devices -ms.sitesec: library -ms.localizationpriority: medium -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.reviewer: scottmca -manager: laurawi -ms.audience: itpro ---- - -# Wake On LAN for Surface devices - -Surface devices that run Windows 10, version 1607 (also known as Windows 10 Anniversary Update) or later and use a Surface Ethernet adapter to connect to a wired network, are capable of Wake On LAN (WOL) from Connected Standby. With WOL, you can remotely wake up devices to perform management or maintenance tasks or enable management solutions (such as Microsoft Endpoint Configuration Manager) automatically. For example, you can deploy applications to Surface devices left docked with a Surface Dock or Surface Pro 3 Docking Station by using Microsoft Endpoint Configuration Manager during a window in the middle of the night, when the office is empty. - ->[!NOTE] ->Surface devices must be connected to AC power and in Connected Standby (Sleep) to support WOL. WOL is not possible from devices that are in hibernation or powered off. - -## Supported devices - -The following devices are supported for WOL: - -* Surface Ethernet adapter -* Surface USB-C to Ethernet and USB Adapter -* Surface Dock -* Surface Docking Station for Surface Pro 3 -* Surface 3 -* Surface Pro 3 -* Surface Pro 4 -* Surface Pro (5th Gen) -* Surface Pro (5th Gen) with LTE Advanced -* Surface Book -* Surface Laptop (1st Gen) -* Surface Pro 6 -* Surface Book 2 -* Surface Laptop 2 -* Surface Go -* Surface Go with LTE Advanced -* Surface Studio 2 (see Surface Studio 2 instructions below) -* Surface Pro 7 -* Surface Laptop 3 - -## WOL driver - -To enable WOL support on Surface devices, a specific driver for the Surface Ethernet adapter is required. This driver is not included in the standard driver and firmware pack for Surface devices – you must download and install it separately. You can download the Surface WOL driver (SurfaceWOL.msi) from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. - -You can run this Microsoft Windows Installer (.msi) file on a Surface device to install the Surface WOL driver, or you can distribute it to Surface devices with an application deployment solution, such as Microsoft Endpoint Configuration Manager. To include the Surface WOL driver during deployment, you can install the .msi file as an application during the deployment process. You can also extract the Surface WOL driver files to include them in the deployment process. For example, you can include them in your Microsoft Deployment Toolkit (MDT) deployment share. You can read more about Surface deployment with MDT in [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/deploy-windows-10-to-surface-devices-with-mdt). - -> [!NOTE] -> During the installation of SurfaceWOL.msi, the following registry key is set to a value of 1, which allows easy identification of systems where the WOL driver has been installed. If you chose to extract and install these drivers separately during deployment, this registry key will not be configured and must be configured manually or with a script. -> -> **HKLM\SYSTEM\CurrentControlSet\Control\Power AllowSystemRequiredPowerRequests** - -To extract the contents of SurfaceWOL.msi, use the MSIExec administrative installation option (**/a**), as shown in the following example, to extract the contents to the C:\WOL\ folder: - - `msiexec /a surfacewol.msi targetdir=C:\WOL /qn` - -## Surface Studio 2 instructions - -To enable WOL on Surface Studio 2, you must use the following procedure - -1. Create the following registry keys: - - ```console - ; Set CONNECTIVITYINSTANDBY to 1: - [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\F15576E8-98B7-4186-B944-EAFA664402D9] - "Attributes"=dword:00000001 - ; Set EnforceDisconnectedStandby to 0 and AllowSystemRequiredPowerRequests to 1: - [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power] - "EnforceDisconnectedStandby"=dword:00000000 - "AllowSystemRequiredPowerRequests"=dword:00000001 - ``` - -2. Run the following command - - ```powercfg /SETACVALUEINDEX SCHEME_BALANCED SUB_NONE CONNECTIVITYINSTANDBY 1``` - -## Using Surface WOL - -The Surface WOL driver conforms to the WOL standard, whereby the device is woken by a special network communication known as a magic packet. The magic packet consists of 6 bytes of 255 (or FF in hexadecimal) followed by 16 repetitions of the target computer’s MAC address. You can read more about the magic packet and the WOL standard on [Wikipedia](https://wikipedia.org/wiki/Wake-on-LAN#Magic_packet). - ->[!NOTE] ->To send a magic packet and wake up a device by using WOL, you must know the MAC address of the target device and Ethernet adapter. Because the magic packet does not use the IP network protocol, it is not possible to use the IP address or DNS name of the device. - -Many management solutions, such as Configuration Manager, provide built-in support for WOL. There are also many solutions, including Microsoft Store apps, PowerShell modules, third-party applications, and third-party management solutions that allow you to send a magic packet to wake up a device. For example, you can use the [Wake On LAN PowerShell module](https://gallery.technet.microsoft.com/scriptcenter/Wake-On-Lan-815424c4) from the TechNet Script Center. - ->[!NOTE] ->After a device has been woken up with a magic packet, the device will return to sleep if an application is not actively preventing sleep on the system or if the AllowSystemRequiredPowerRequests registry key is not configured to 1, which allows applications to prevent sleep. See the [WOL driver](#wol-driver) section of this article for more information about this registry key. diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md deleted file mode 100644 index 0860600d05..0000000000 --- a/devices/surface/windows-autopilot-and-surface-devices.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Windows Autopilot and Surface devices -ms.reviewer: -manager: laurawi -description: Find out about Windows Autopilot deployment options for Surface devices. -keywords: autopilot, windows 10, surface, deployment -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: surface, devices -ms.sitesec: library -author: coveminer -ms.author: v-jokai -ms.topic: article -ms.localizationpriority: medium -ms.audience: itpro ---- - -# Windows Autopilot and Surface devices - -Windows Autopilot is a cloud-based deployment technology in Windows 10. You can use Windows Autopilot to remotely deploy and configure devices in a zero-touch process right out of the box. - -Windows Autopilot-registered devices are identified over the Internet at first startup through a unique device signature that's called a *hardware hash*. They're automatically enrolled and configured by using modern management solutions such as Azure Active Directory (Azure AD) and mobile device management. - -You can register Surface devices at the time of purchase from a Surface partner that's enabled for Windows Autopilot. These partners can ship new devices directly to your users. The devices will be automatically enrolled and configured when they are first turned on. This process eliminates reimaging during deployment, which lets you implement new, agile methods of device management and distribution. - -## Modern management - -Autopilot is the recommended deployment option for Surface devices, including Surface Pro 7, Surface Laptop 3, and Surface Pro X, which is specifically designed for deployment through Autopilot. - - It's best to enroll your Surface devices with the help of a Microsoft Cloud Solution Provider. This step allows you to manage UEFI firmware settings on Surface directly from Intune. It eliminates the need to physically touch devices for certificate management. See [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md) for details. - -## Windows version considerations - -Broad deployment of Surface devices through Windows Autopilot, including enrollment by Surface partners at the time of purchase, requires Windows 10 Version 1709 (Fall Creators Update) or later. - -These Windows versions support a 4,000-byte (4k) hash value that uniquely identifies devices for Windows Autopilot, which is necessary for deployments at scale. All new Surface devices, including Surface Pro 7, Surface Pro X, and Surface Laptop 3, ship with Windows 10 Version 1903 or later. - -## Exchange experience on Surface devices in need of repair or replacement - -Microsoft automatically checks every Surface for Autopilot enrollment and will deregister the device from the customer’s tenant. Microsoft ensures the replacement device is enrolled into Windows Autopilot once a replacement is shipped back to the customer. This service is available on all device exchange service orders directly with Microsoft. - -> [!NOTE] -> When customers use a Partner to return devices, the Partner is responsible for managing the exchange process including deregistering and enrolling devices into Windows Autopilot. - -## Surface partners enabled for Windows Autopilot - -Select Surface partners can enroll Surface devices in Windows Autopilot for you at the time of purchase. They can also ship enrolled devices directly to your users. The devices can be configured entirely through a zero-touch process by using Windows Autopilot, Azure AD, and mobile device management. - -Surface partners that are enabled for Windows Autopilot include: - -| US partners | Global partners | US distributors | -|--------------|---------------|-------------------| -| * [CDW](https://www.cdw.com/) | * [ALSO](https://www.also.com/ec/cms5/de_1010/1010_anbieter/microsoft/windows-autopilot/index.jsp) | * [Synnex](https://www.synnexcorp.com/us/microsoft/surface-autopilot/) | -| * [Connection](https://www.connection.com/brand/microsoft/microsoft-surface) | * [ATEA](https://www.atea.com/) | * [Techdata](https://www.techdata.com/) | -| * [Insight](https://www.insight.com/en_US/buy/partner/microsoft/surface/windows-autopilot.html) | * [Bechtle](https://www.bechtle.com/marken/microsoft/microsoft-windows-autopilot) | | -| * [SHI](https://www.shi.com/Surface) | * [Cancom](https://www.cancom.de/) | | -| * [LDI Connect](https://www.myldi.com/managed-it/) | * [Computacenter](https://www.computacenter.com/uk) | | -| * [F1](https://www.functiononeit.com/#empower) | | - -## Learn more - -For more information about Windows Autopilot, see: -- [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) -- [Windows Autopilot requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements) \ No newline at end of file diff --git a/education/developers.yml b/education/developers.yml index 9e21b6d27f..6533d8c51c 100644 --- a/education/developers.yml +++ b/education/developers.yml @@ -18,16 +18,16 @@ additionalContent: # Card - title: UWP apps for education summary: Learn how to write universal apps for education. - url: https://docs.microsoft.com/en-us/windows/uwp/apps-for-education/ + url: https://docs.microsoft.com/windows/uwp/apps-for-education/ # Card - title: Take a test API summary: Learn how web applications can use the API to provide a locked down experience for taking tests. - url: https://docs.microsoft.com/en-us/windows/uwp/apps-for-education/take-a-test-api + url: https://docs.microsoft.com/windows/uwp/apps-for-education/take-a-test-api # Card - title: Office Education Dev center summary: Integrate with Office 365 across devices and services to extend Microsoft enterprise-scale compliance and security to students, teachers, and staff in your education app - url: https://dev.office.com/industry-verticals/edu + url: https://developer.microsoft.com/office/edu # Card - title: Data Streamer summary: Bring new STEM experiences into the classroom with real-time data in Excel using Data Streamer. Data Streamer can send data to Excel from a sensor or application. - url: https://docs.microsoft.com/en-us/microsoft-365/education/data-streamer \ No newline at end of file + url: https://docs.microsoft.com/microsoft-365/education/data-streamer diff --git a/education/docfx.json b/education/docfx.json index 809a2da28f..8ba1394c6d 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -7,7 +7,8 @@ "**/**.yml" ], "exclude": [ - "**/obj/**" + "**/obj/**", + "**/includes/**" ] } ], @@ -19,7 +20,8 @@ "**/*.svg" ], "exclude": [ - "**/obj/**" + "**/obj/**", + "**/includes/**" ] } ], diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md new file mode 100644 index 0000000000..156feee1de --- /dev/null +++ b/education/includes/education-content-updates.md @@ -0,0 +1,11 @@ + + + + +## Week of January 11, 2021 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 1/14/2021 | [Chromebook migration guide (Windows 10)](/education/windows/chromebook-migration-guide) | modified | +| 1/14/2021 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified | diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index e74ce568f1..8ba6fec5bb 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -64,7 +64,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo **To trigger Autopilot Reset** -1. From the Windows device lock screen, enter the keystroke: **CTRL + ![Windows key](images/windows_glyph.png) + R**. +1. From the Windows device lock screen, enter the keystroke: **CTRL + Windows key + R**. ![Enter CTRL+Windows key+R on the Windows lockscreen](images/autopilot-reset-lockscreen.png) diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index cbbdb3502b..3cd18bebdd 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -457,7 +457,7 @@ Table 5. Select on-premises AD DS, Azure AD, or hybrid X -Use Microsoft Endpoint Configuration Manager for management +Use Microsoft Endpoint Manager for management X X diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 688b66c92b..71f603bec9 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -9,7 +9,7 @@ ms.pagetype: edu ms.localizationpriority: medium author: dansimp ms.author: dansimp -ms.date: 08/31/2017 +ms.date: ms.reviewer: manager: dansimp --- @@ -32,7 +32,7 @@ In Windows 10, version 1703 (Creators Update), it is straightforward to configur | **Microsoft consumer experiences** | **SetEduPolicies** | Disables suggested content from Windows such as app recommendations | This is already set | This is already set | The policy must be set | | **Cortana** | **AllowCortana** | Disables Cortana

* Cortana is enabled by default on all editions in Windows 10, version 1703 | If using Windows 10 Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana.

See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | If using Windows 10 Pro Education, upgrading from Windows 10, version 1607 to Windows 10, version 1703 will enable Cortana.

See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | See the [Recommended configuration](#recommended-configuration) section below for recommended Cortana settings. | | **Safe search** | **SetEduPolicies** | Locks Bing safe search to Strict in Microsoft Edge | This is already set | This is already set | The policy must be set | -| **Bing search advertising** | Ad free search with Bing | Disables ads when searching the internet with Bing in Microsoft Edge | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | Depending on your specific requirements, there are different ways to configure this as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | +| **Bing search advertising** | Ad free search with Bing | Disables ads when searching the internet with Bing in Microsoft Edge. See [Ad-free search with Bing](#ad-free-search-with-bing | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | View configuration instructions as detailed in [Ad-free search with Bing](#ad-free-search-with-bing) | | **Apps** | **SetEduPolicies** | Preinstalled apps like Microsoft Edge, Movies & TV, Groove, and Skype become education ready

* Any app can detect Windows is running in an education ready configuration through [IsEducationEnvironment](https://docs.microsoft.com/uwp/api/windows.system.profile.educationsettings) | This is already set | This is already set | The policy must be set | @@ -150,34 +150,10 @@ For example: ![Set SetEduPolicies to True in Windows Configuration Designer](images/setedupolicies_wcd.png) ## Ad-free search with Bing -Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. Additional information is available at https://www.bing.com/classroom/about-us. - -> [!NOTE] -> If you enable the guest account in shared PC mode, students using the guest account will not have an ad-free experience searching with Bing in Microsoft Edge unless the PC is connected to your school network and your school network has been configured as described in [IP registration for entire school network using Microsoft Edge](#ip-registration-for-entire-school-network-using-microsoft-edge). +Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. ### Configurations -#### IP registration for entire school network using Microsoft Edge -Ad-free searching with Bing in Microsoft Edge can be configured at the network level. To configure this, email bingintheclassroom@microsoft.com with the subject "New Windows 10, version 1703 (Creators Update) Registration: [School District Name]" and the include the following information in the body of the email. - -**District information** -- **District or School Name:** -- **Outbound IP Addresses (IP Range + CIDR):** -- **Address:** -- **City:** -- **State Abbreviation:** -- **Zip Code:** - -**Registrant information** -- **First Name:** -- **Last Name:** -- **Job Title:** -- **Email Address:** -- **Opt-In for Email Announcements?:** -- **Phone Number:** - -This will suppress ads when searching with Bing on Microsoft Edge when the PC is connected to the school network. - #### Azure AD and Office 365 Education tenant To suppress ads when searching with Bing on Microsoft Edge on any network, follow these steps: @@ -185,6 +161,8 @@ To suppress ads when searching with Bing on Microsoft Edge on any network, follo 2. Domain join the Windows 10 PCs to your Azure AD tenant (this is the same as your Office 365 tenant). 3. Configure **SetEduPolicies** according to one of the methods described in the previous sections in this topic. 4. Have students sign in with their Azure AD identity, which is the same as your Office 365 identity, to use the PC. +> [!NOTE] +> If you are verifying your Office 365 domain to prove education status (step 1 above), you may need to wait up to 7 days for the ad-free experience to take effect. Microsoft recommends not to roll out the browser to your students until that time. #### Office 365 sign-in to Bing To suppress ads only when the student signs into Bing with their Office 365 account in Microsoft Edge, follow these steps: @@ -192,8 +170,6 @@ To suppress ads only when the student signs into Bing with their Office 365 acco 1. Configure **SetEduPolicies** according to one of the methods described in the previous sections in this topic. 2. Have students sign into Bing with their Office 365 account. -### More information -For more information on all the possible Bing configuration methods, see https://aka.ms/e4ahor. ## Related topics [Deployment recommendations for school IT administrators](edu-deployment-recommendations.md) diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 280778ccb4..d2a18c7393 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -26,69 +26,106 @@ This guide shows you how to deploy the Windows 10 operating system in a school d Proper preparation is essential for a successful district deployment. To avoid common mistakes, your first step is to plan a typical district configuration. Just as with building a house, you need a blueprint for what your district and individual schools should look like when it’s finished. The second step in preparation is to learn how you will manage the users, apps, and devices in your district. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your district. ->**Note**  This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/cloud-platform/mobile-device-management). +> [!NOTE] +> This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/cloud-platform/mobile-device-management). ### Plan a typical district configuration As part of preparing for your district deployment, you need to plan your district configuration — the focus of this guide. Figure 1 illustrates a typical finished district configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. -![Typical district configuration for this guide](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") +> [!div class="mx-imgBorder"] +> ![Typical district configuration for this guide](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") *Figure 1. Typical district configuration for this guide* A *district* consists of multiple schools, typically at different physical locations. Figure 2 illustrates a typical school configuration within the district that this guide uses. -![Typical school configuration for this guide](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") +> [!div class="mx-imgBorder"] +> ![Typical school configuration for this guide](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") *Figure 2. Typical school configuration for this guide* Finally, each school consists of multiple classrooms. Figure 3 shows the classroom configuration this guide uses. -![Typical classroom configuration in a school](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") +> [!div class="mx-imgBorder"] +> ![Typical classroom configuration in a school](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") *Figure 3. Typical classroom configuration in a school* This district configuration has the following characteristics: * It contains one or more admin devices. + * It contains two or more schools. + * Each school contains two or more classrooms. + * Each classroom contains one teacher device. + * The classrooms connect to each other through multiple subnets. + * All devices in each classroom connect to a single subnet. + * All devices have high-speed, persistent connections to each other and to the Internet. + * All teachers and students have access to Microsoft Store or Microsoft Store for Business. + * You install a 64-bit version of Windows 10 on the admin device. + * You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. + * You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device. - >**Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. + + > [!NOTE] + > In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. + * The devices use Azure AD in Office 365 Education for identity management. + * If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](https://azure.microsoft.com/documentation/articles/active-directory-aadconnect/). + * Use [Intune](https://docs.microsoft.com/intune/), [Mobile Device Management for Office 365](https://support.office.com/en-us/article/Set-up-Mobile-Device-Management-MDM-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy in AD DS](https://technet.microsoft.com/library/cc725828.aspx) to manage devices. + * Each device supports a one-student-per-device or multiple-students-per-device scenario. + * The devices can be a mixture of different make, model, and processor architecture (32-bit or 64-bit) or be identical. + * To initiate Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment (PXE) boot. + * The devices can be a mixture of different Windows 10 editions, such as Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education. Use these characteristics at a minimum as you deploy your schools. If your district deployment is less complex, you may want to review the guidance in [Deploy Windows 10 in a school](https://technet.microsoft.com/edu/windows/deploy-windows-10-in-a-school). ->**Note**  This guide focuses on Intune as the mobile device management (MDM) solution. If you want to use an MDM solution other than Intune, ignore the Intune-specific content in this guide. For each section, contact your MDM provider to determine the features and management capabilities for your institution. +> [!NOTE] +> This guide focuses on Intune as the mobile device management (MDM) solution. If you want to use an MDM solution other than Intune, ignore the Intune-specific content in this guide. For each section, contact your MDM provider to determine the features and management capabilities for your institution. Office 365 Education allows: * Students and faculty to use Microsoft Office to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser. + * Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students. + * Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, the administration, and faculty. + * Teachers to employ Sway to create interactive educational digital storytelling. + * Students and faculty to use email and calendars, with mailboxes up to 50 GB per user. + * Faculty to use advanced email features like email archiving and legal hold capabilities. + * Faculty to help prevent unauthorized users from accessing documents and email by using Microsoft Azure Rights Management. + * Faculty to use advanced compliance tools on the unified eDiscovery pages in the Office 365 Compliance Center. + * Faculty to host online classes, parent–teacher conferences, and other collaboration in Skype for Business. + * Students and faculty to access up to 1 TB of personal cloud storage that users inside and outside the educational institution can share through OneDrive for Business. + * Teachers to provide collaboration in the classroom through Microsoft SharePoint Online team sites. + * Students and faculty to use Office 365 Video to manage videos. + * Students and faculty to use Yammer to collaborate through private social networking. + * Students and faculty to access classroom resources from anywhere on any device (including Windows 10 Mobile, iOS, and Android devices). For more information about Office 365 Education features and an FAQ, go to [Office 365 Education plans and pricing](https://products.office.com/en-us/academic). @@ -105,7 +142,7 @@ This guide focuses on LTI deployments to deploy the reference device. You can us MDT includes the Deployment Workbench, a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps, and migration of user settings on existing devices. -LTI performs deployment from a *deployment share* — a network-shared folder on the device on which you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You will learn more about MDT in the [Prepare the admin device](#prepare-the-admin-device) section. +LTI performs deployment from a *deployment share* — a network-shared folder on the device on which you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You will learn more about MDT in [Prepare the admin device](#prepare-the-admin-device), earlier in this article. The focus of MDT is deployment, so you also need tools that help you manage your Windows 10 devices and apps. You can manage Windows 10 devices and apps with Intune, the Compliance Management feature in Office 365, or Group Policy in AD DS. You can use any combination of these tools based on your school requirements. @@ -114,9 +151,13 @@ ZTI performs fully automated deployments using Configuration Manager and MDT. Al The configuration process requires the following devices: * **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK, MDT, and the Configuration Manager Console on this device. + * **Reference devices.** These are the devices that you will use as a template for the faculty and student devices. You install Windows 10 and Windows desktop apps on these devices, and then capture an image (.wim file) of the devices. + You will have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/windows/view-all). + * **Faculty and staff devices.** These are the devices that the teachers, faculty, and staff use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices. + * **Student devices.** The students will use these devices. You will use the admin device deploy (or upgrade) Windows 10 and apps to them. The high-level process for deploying and configuring devices within individual classrooms, individual schools, and the district as a whole is as follows and illustrated in Figure 4: @@ -139,7 +180,8 @@ The high-level process for deploying and configuring devices within individual c 9. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS–Azure AD integration. -![How district configuration works](images/edu-districtdeploy-fig4.png "How district configuration works") +> [!div class="mx-imgBorder"] +> ![How district configuration works](images/edu-districtdeploy-fig4.png "How district configuration works") *Figure 4. How district configuration works* @@ -160,7 +202,7 @@ Before you select the deployment and management methods, you need to review the |Scenario feature |Cloud-centric|On-premises and cloud| |---|---|---| |Identity management | Azure AD (stand-alone or integrated with on-premises AD DS) | AD DS integrated with Azure AD | -|Windows 10 deployment | MDT only | Microsoft Endpoint Configuration Manager with MDT | +|Windows 10 deployment | MDT only | Microsoft Endpoint Manager with MDT | |Configuration setting management | Intune | Group Policy

Intune| |App and update management | Intune |Microsoft Endpoint Configuration Manager

Intune| @@ -174,14 +216,14 @@ These scenarios assume the need to support: Some constraints exist in these scenarios. As you select the deployment and management methods for your device, keep the following constraints in mind: * You can use Group Policy or Intune to manage configuration settings on a device but not both. -* You can use Microsoft Endpoint Configuration Manager or Intune to manage apps and updates on a device but not both. +* You can use Microsoft Endpoint Manager or Intune to manage apps and updates on a device but not both. * You cannot manage multiple users on a device with Intune if the device is AD DS domain joined. Use the cloud-centric scenario and on-premises and cloud scenario as a guide for your district. You may need to customize these scenarios, however, based on your district. As you go through the [Select the deployment methods](#select-the-deployment-methods), [Select the configuration setting management methods](#select-the-configuration-setting-management-methods), and the [Select the app and update management products](#select-the-app-and-update-management-products) sections, remember these scenarios and use them as the basis for your district. ### Select the deployment methods -To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Configuration Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution. +To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution. @@ -249,7 +291,7 @@ Select this method when you:

The disadvantages of this method are that it:

    -
  • Carries an additional cost for Microsoft Endpoint Configuration Manager server licenses (if the institution does not have Configuration Manager already).
  • +
  • Carries an additional cost for Microsoft Endpoint Manager server licenses (if the institution does not have Configuration Manager already).
  • Can deploy Windows 10 only to domain-joined (institution-owned devices).
  • Requires an AD DS infrastructure (if the institution does not have AD DS already).
@@ -265,7 +307,7 @@ Record the deployment methods you selected in Table 3. |Selection | Deployment method| |--------- | -----------------| | |MDT by itself | -| |Microsoft Endpoint Configuration Manager and MDT| +| |Microsoft Endpoint Manager and MDT| *Table 3. Deployment methods selected* @@ -441,12 +483,12 @@ Select this method when you:

- + - + @@ -867,7 +868,7 @@ The following list shows the apps that may be included in the inbox. -## Whitelist examples +## Allow list examples The following example disables the calendar application. @@ -1754,7 +1755,7 @@ In this example, Contoso is the node name. We recommend using a GUID for this no - + diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index fde531cbc9..4ea2ef6556 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -1,6 +1,6 @@ --- title: AppLocker DDF file -description: AppLocker DDF file +description: Learn about the OMA DM device description framework (DDF) for the AppLocker DDF file configuration service provider. ms.assetid: 79E199E0-5454-413A-A57A-B536BDA22496 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/applocker-xsd.md b/windows/client-management/mdm/applocker-xsd.md index d07e9eea71..3e03f501a8 100644 --- a/windows/client-management/mdm/applocker-xsd.md +++ b/windows/client-management/mdm/applocker-xsd.md @@ -1,6 +1,6 @@ --- title: AppLocker XSD -description: Here's the XSD for the AppLocker CSP. +description: View the XSD for the AppLocker CSP. The AppLocker CSP XSD provides an example of how the schema is organized. ms.assetid: 70CF48DD-AD7D-4BCF-854F-A41BFD95F876 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/appv-deploy-and-config.md b/windows/client-management/mdm/appv-deploy-and-config.md index cd4c993d17..15937b2e7c 100644 --- a/windows/client-management/mdm/appv-deploy-and-config.md +++ b/windows/client-management/mdm/appv-deploy-and-config.md @@ -1,6 +1,6 @@ --- title: Deploy and configure App-V apps using MDM -description: Deploy and configure App-V apps using MDM +description: Configure, deploy, and manage Microsoft Application Virtualization (App-V) apps using Microsoft Endpoint Manager or App-V server. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -15,7 +15,7 @@ manager: dansimp ## Executive summary -

Microsoft Application Virtualization (App-V) apps have typically been configured, deployed, and managed through on-premises group policies using Microsoft Endpoint Configuration Manager or App-V server. In Windows 10, version 1703, App-V apps can be configured, deployed, and managed using mobile device management (MDM), matching their on-premises counterparts.

+

Microsoft Application Virtualization (App-V) apps have typically been configured, deployed, and managed through on-premises group policies using Microsoft Endpoint Manager or App-V server. In Windows 10, version 1703, App-V apps can be configured, deployed, and managed using mobile device management (MDM), matching their on-premises counterparts.

MDM services can be used to publish App-V packages to clients running Windows 10, version 1703 (or later). All capabilities such as App-V enablement, configuration, and publishing can be completed using the EnterpriseAppVManagement CSP.

diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index b8eb37197c..3a48ac399e 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -14,8 +14,6 @@ ms.date: 09/18/2018 # AssignedAccess CSP -**Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.** - The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, then the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration. For a step-by-step guide for setting up devices to run in kiosk mode, see [Set up a kiosk on Windows 10 Pro, Enterprise, or Education.](https://go.microsoft.com/fwlink/p/?LinkID=722211) diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index c4844e943d..703958aa0e 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,6 +1,6 @@ --- title: AssignedAccess DDF -description: AssignedAccess DDF +description: Learn how the OMA DM device description framework (DDF) for the AssignedAccess configuration service provider. ms.assetid: 224FADDB-0EFD-4E5A-AE20-1BD4ABE24306 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md index 413f6d9c1e..b511fd100f 100644 --- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md @@ -81,7 +81,7 @@ To support Azure AD enrollment, MDM vendors must host and expose a Terms of Use **Terms of Use endpoint** Use this endpoint to inform users of the ways in which their device can be controlled by their organization. The Terms of Use page is responsible for collecting user’s consent before the actual enrollment phase begins. -It’s important to understand that the Terms of Use flow is a "black box" to Windows and Azure AD. The whole web view is redirected to the Terms of Use URL, and the user is expected to be redirected back after approving (or in some cases rejecting) the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios (e.g., different levels of control are applied on BYOD vs. company-owned devices) or implement user/group based targeting (e.g., users in certain geographies may be subject to stricter device management policies). +It’s important to understand that the Terms of Use flow is an "opaque box" to Windows and Azure AD. The whole web view is redirected to the Terms of Use URL, and the user is expected to be redirected back after approving (or in some cases rejecting) the Terms. This design allows the MDM vendor to customize their Terms of Use for different scenarios (e.g., different levels of control are applied on BYOD vs. company-owned devices) or implement user/group based targeting (e.g., users in certain geographies may be subject to stricter device management policies). The Terms of Use endpoint can be used to implement additional business logic, such as collecting a one-time PIN provided by IT to control device enrollment. However, MDM vendors must not use the Terms of Use flow to collect user credentials, which could lead to a highly degraded user experience. It’s not needed, since part of the MDM integration ensures that the MDM service can understand tokens issued by Azure AD. @@ -165,7 +165,10 @@ The following image illustrates how MDM applications will show up in the Azure a ### Add cloud-based MDM to the app gallery -You should work with the Azure AD engineering team if your MDM application is cloud-based. The following table shows the required information to create an entry in the Azure AD app gallery. +> [!NOTE] +> You should work with the Azure AD engineering team if your MDM application is cloud-based and needs to be enabled as a multi-tenant MDM application + +The following table shows the required information to create an entry in the Azure AD app gallery.
Microsoft Endpoint Configuration Manager and Intune (hybrid)Microsoft Endpoint Manager and Intune (hybrid)

Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune.

Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.

Select this method when you:

    -
  • Selected Microsoft Endpoint Configuration Manager to deploy Windows 10.
  • +
  • Selected Microsoft Endpoint Manager to deploy Windows 10.
  • Want to manage institution-owned and personal devices (does not require that the device be domain joined).
  • Want to manage domain-joined devices.
  • Want to manage Azure AD domain-joined devices.
  • @@ -483,9 +525,9 @@ Record the app and update management methods that you selected in Table 7. |Selection | Management method| |----------|------------------| -| |Microsoft Endpoint Configuration Manager by itself| +| |Microsoft Endpoint Manager by itself| | |Intune by itself| -| |Microsoft Endpoint Configuration Manager and Intune (hybrid mode)| +| |Microsoft Endpoint Manager and Intune (hybrid mode)| *Table 7. App and update management methods selected* @@ -512,7 +554,8 @@ For more information about installing the Windows ADK, see [Step 2-2: Install Wi Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windows 10 and app deployment. It is a free tool available directly from Microsoft. You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems. ->**Note**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32-bit versions of the operating system. +> [!NOTE] +> If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32-bit versions of the operating system. For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com/library/dn759415.aspx#InstallingaNewInstanceofMDT). @@ -526,15 +569,17 @@ For more information about how to create a deployment share, see [Step 3-1: Crea ### Install the Configuration Manager console ->**Note**  If you selected Microsoft Endpoint Configuration Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next. +> [!NOTE] +> If you selected Microsoft Endpoint Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next. You can use Configuration Manager to manage Windows 10 deployments, Windows desktop apps, Microsoft Store apps, and software updates. To manage Configuration Manager, you use the Configuration Manager console. You must install the Configuration Manager console on every device you use to manage Configuration Manager (specifically, the admin device). The Configuration Manager console is automatically installed when you install Configuration Manager primary site servers. -For more information about how to install the Configuration Manager console, see [Install Microsoft Endpoint Configuration Manager consoles](https://technet.microsoft.com/library/mt590197.aspx#bkmk_InstallConsole). +For more information about how to install the Configuration Manager console, see [Install Microsoft Endpoint Manager consoles](https://technet.microsoft.com/library/mt590197.aspx#bkmk_InstallConsole). ### Configure MDT integration with the Configuration Manager console ->**Note**  If you selected MDT only to deploy Windows 10 and your apps (and not Microsoft Endpoint Configuration Manager) in the [Select the deployment methods](#select-the-deployment-methods) section, then skip this section and continue to the next. +> [!NOTE] +> If you selected MDT only to deploy Windows 10 and your apps (and not Microsoft Endpoint Configuration Manager) in [Select the deployment methods](#select-the-deployment-methods), earlier in this article, then skip this section and continue to the next. You can use MDT with Configuration Manager to make ZTI operating system deployment easier. To configure MDT integration with Configuration Manager, run the Configure ConfigMgr Integration Wizard. This wizard is installed when you install MDT. @@ -544,7 +589,7 @@ For more information, see [Enable Configuration Manager Console Integration for #### Summary -In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you will configure and use later to capture a reference image. You can also use the MDT deployment share to deploy Windows 10 and your apps to faculty and students (if that’s the method you selected in the [Select the deployment methods](#select-the-deployment-methods) section). Finally, you installed the Configuration Manager console and configured MDT integration with the Configuration Manager console. +In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you will configure and use later to capture a reference image. You can also use the MDT deployment share to deploy Windows 10 and your apps to faculty and students (if that’s the method you selected in [Select the deployment methods](#select-the-deployment-methods), earlier in this article). Finally, you installed the Configuration Manager console and configured MDT integration with the Configuration Manager console. ## Create and configure Office 365 @@ -590,13 +635,19 @@ You will use the Office 365 Education license plan information you record in Tab To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions. ->**Note**  If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Create user accounts in Office 365](#create-user-accounts-in-office-365). +> [!NOTE] +> If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Create user accounts in Office 365](#create-user-accounts-in-office-365). #### To create a new Office 365 subscription 1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. - > **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods: - >
    • In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap More actions), and then click or tap New InPrivate window.
    • In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap Settings), click or tap Safety, and then click or tap InPrivate Browsing.
    + + > [!NOTE] + > If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods: + > + > - In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap More actions), and then click or tap New InPrivate window. + > + > - In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap Settings), click or tap Safety, and then click or tap InPrivate Browsing. 2. On the **Get started** page, in **Enter your school email address**, type your school email address, and then click **Sign up**. @@ -631,7 +682,8 @@ Now that you have created your new Office 365 Education subscription, add the do To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. ->**Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush). +> [!NOTE] +> By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush). Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: @@ -640,7 +692,8 @@ Office 365 uses the domain portion of the user’s email address to know which O You will always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before you allow other faculty and students to join Office 365. ->**Note**  You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. +> [!NOTE] +> You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. By default, all new Office 365 Education subscriptions have automatic tenant join enabled, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 10. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). @@ -651,13 +704,15 @@ By default, all new Office 365 Education subscriptions have automatic tenant joi *Table 10. Windows PowerShell commands to enable or disable automatic tenant join* ->**Note**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. +> [!NOTE] +> If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. ### Disable automatic licensing To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that do not require administrative approval. ->**Note**  By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. +> [!NOTE] +> By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 11. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). @@ -678,7 +733,7 @@ The following Azure AD Premium features are not in Azure AD Basic: * Allow designated users to manage group membership * Dynamic group membership based on user metadata -* Azure multifactor authentication (MFA; see [What is Azure Multi-Factor Authentication](https://azure.microsoft.com/documentation/articles/multi-factor-authentication/)) +* Azure AD Multi-Factor Authentication (MFA; see [What is Azure AD Multi-Factor Authentication](https://azure.microsoft.com/documentation/articles/multi-factor-authentication/)) * Identify cloud apps that your users run * Self-service recovery of BitLocker * Add local administrator accounts to Windows 10 devices @@ -709,9 +764,11 @@ Now that you have an Office 365 subscription, you must determine how you’ll cr In this method, you have an on-premises AD DS domain. As shown in Figure 5, the Azure AD Connector tool automatically synchronizes AD DS with Azure AD. When you add or change any user accounts in AD DS, the Azure AD Connector tool automatically updates Azure AD. ->**Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/library/dn510997.aspx). +> [!NOTE] +> Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/library/dn510997.aspx). -![Automatic synchronization between AD DS and Azure AD](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") +> [!div class="mx-imgBorder"] +> ![Automatic synchronization between AD DS and Azure AD](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") *Figure 5. Automatic synchronization between AD DS and Azure AD* @@ -721,7 +778,8 @@ For more information about how to perform this step, see the [Integrate on-premi In this method, you have no on-premises AD DS domain. As shown in Figure 6, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. -![Bulk import into Azure AD from other sources](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") +> [!div class="mx-imgBorder"] +> ![Bulk import into Azure AD from other sources](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") *Figure 6. Bulk import into Azure AD from other sources* @@ -742,7 +800,8 @@ In this section, you selected the method for creating user accounts in your Offi You can integrate your on-premises AD DS domain with Azure AD to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Azure AD with the Azure AD Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS. ->**Note**  If your institution does not have an on-premises AD DS domain, you can skip this section. +> [!NOTE] +> If your institution does not have an on-premises AD DS domain, you can skip this section. ### Select a synchronization model @@ -752,13 +811,15 @@ You can deploy the Azure AD Connect tool: - **On premises.** As shown in Figure 7, Azure AD Connect runs on premises, which has the advantage of not requiring a VPN connection to Azure. It does, however, require a virtual machine (VM) or physical server. - ![Azure AD Connect on premises](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") + > [!div class="mx-imgBorder"] + > ![Azure AD Connect on premises](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") *Figure 7. Azure AD Connect on premises* - **In Azure.** As shown in Figure 8, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. - ![Azure AD Connect in Azure](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") + > [!div class="mx-imgBorder"] + > ![Azure AD Connect in Azure](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") *Figure 8. Azure AD Connect in Azure* @@ -815,7 +876,8 @@ In this section, you selected your synchronization model, deployed Azure AD Conn You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS. ->**Note**  If your institution doesn’t have an on-premises AD DS domain, you can skip this section. +> [!NOTE] +> If your institution doesn’t have an on-premises AD DS domain, you can skip this section. ### Select the bulk import method @@ -823,7 +885,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T |Method |Description and reason to select this method | |-------|---------------------------------------------| -|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| +|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren't comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).| |VBScript|This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/scriptcenter/dd939958.aspx).| |Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).| @@ -845,7 +907,8 @@ After you have selected your user and group account bulk import method, you’re With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. ->**Note**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. +> [!NOTE] +> Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. For more information about how to import user accounts into AD DS by using: @@ -865,7 +928,8 @@ You can bulk-import user and group accounts directly into Office 365, reducing t Now that you have created your new Office 365 Education subscription, you need to create user accounts. You can add user accounts for the teachers, other faculty, and students who will use the classroom. ->**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +> [!NOTE] +> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. You can use the Microsoft 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users). @@ -873,7 +937,8 @@ The bulk-add process assigns the same Office 365 Education license plan to all u For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365 - Admin help](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US). ->**Note**  If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. +> [!NOTE] +> If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. The email accounts are assigned temporary passwords on creation. You must communicate these temporary passwords to your users before they can sign in to Office 365. @@ -881,13 +946,15 @@ The email accounts are assigned temporary passwords on creation. You must commun Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources. ->**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +> [!NOTE] +> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. For information about creating security groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US). You can add and remove users from security groups at any time. ->**Note**  Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may have to sign out, and then sign in again for the change to take effect. +> [!NOTE] +> Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may have to sign out, and then sign in again for the change to take effect. ### Create email distribution groups @@ -895,7 +962,8 @@ Microsoft Exchange Online uses an email distribution group as a single email rec You can create email distribution groups based on job role (such as teacher, administration, or student) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. ->**Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps. +> [!NOTE] +> Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps. For information about creating email distribution groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US). @@ -957,7 +1025,8 @@ After you create the Microsoft Store for Business portal, configure it by using Now that you have created your Microsoft Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this from the **Inventory** page in Microsoft Store for Business. ->**Note**  Your educational institution can now use a credit card or purchase order to pay for apps in Microsoft Store for Business. +> [!NOTE] +> Your educational institution can now use a credit card or purchase order to pay for apps in Microsoft Store for Business. You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users to install the apps. @@ -989,13 +1058,15 @@ Depending on your school’s requirements, you may need any combination of the f * Upgrade institution-owned devices to Windows 10 Education. * Deploy new instances of Windows 10 Education so that new devices have a known configuration. ->**Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades). +> [!NOTE] +> Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades). For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32-bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. ->**Note**  On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. +> [!NOTE] +> On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). Of course, you cannot standardize personal devices on a specific operating system version or processor architecture. @@ -1077,7 +1148,7 @@ At the end of this section, you should know the Windows 10 editions and processo ## Prepare for deployment -Before you can deploy Windows 10 and your apps to devices, you need to prepare your MDT environment, Windows Deployment Services, and Microsoft Endpoint Configuration Manager (if you selected it to do operating system deployment in the [Select the deployment methods](#select-the-deployment-methods) section). In this section, you ensure that the deployment methods you selected in the [Select the deployment methods](#select-the-deployment-methods) section have the necessary Windows 10 editions and versions, Windows desktop apps, Microsoft Store apps, and device drivers. +Before you can deploy Windows 10 and your apps to devices, you need to prepare your MDT environment, Windows Deployment Services, and Microsoft Endpoint Manager (if you selected it to do operating system deployment in the [Select the deployment methods](#select-the-deployment-methods) section). In this section, you ensure that the deployment methods you selected in the [Select the deployment methods](#select-the-deployment-methods) section have the necessary Windows 10 editions and versions, Windows desktop apps, Microsoft Store apps, and device drivers. ### Configure the MDT deployment share @@ -1173,7 +1244,8 @@ For more information about how to update a deployment share, see #enforceLockdown ``` diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index 80555a4b90..4197cf6869 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -30,10 +30,10 @@ Windows 10, version 1607 introduces two editions designed for the unique needs o Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools. Windows 10 Pro Education is effectively a variant of Windows 10 Pro that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627). -For Cortana[1](#footnote1), +For Cortana[1](#footnote1): - If you're using version 1607, Cortana is removed. -- If you're using new devices with version 1703, Cortana is turned on by default. -- If you're upgrading from version 1607 to version 1703, Cortana will be enabled. +- If you're using new devices with version 1703 or later, Cortana is turned on by default. +- If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled. You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). @@ -49,10 +49,10 @@ Customers who deploy Windows 10 Pro are able to configure the product to have si Windows 10 Education builds on Windows 10 Enterprise and provides the enterprise-grade manageability and security desired by many schools. Windows 10 Education is effectively a variant of Windows 10 Enterprise that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627). -For Cortana1, +For Cortana1: - If you're using version 1607, Cortana1 is removed. -- If you're using new devices with version 1703, Cortana is turned on by default. -- If you're upgrading from version 1607 to version 1703, Cortana will be enabled. +- If you're using new devices with version 1703 or later, Cortana is turned on by default. +- If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled. You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). diff --git a/gdpr/docfx.json b/gdpr/docfx.json index 2fd5e0e9f9..9b8ee64f65 100644 --- a/gdpr/docfx.json +++ b/gdpr/docfx.json @@ -34,7 +34,16 @@ "ms.author": "lizross", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app" + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/images/sc-image402.png b/images/sc-image402.png new file mode 100644 index 0000000000..8bfe73fd87 Binary files /dev/null and b/images/sc-image402.png differ diff --git a/mdop/TOC.md b/mdop/TOC.md deleted file mode 100644 index 91a625282c..0000000000 --- a/mdop/TOC.md +++ /dev/null @@ -1,21 +0,0 @@ -# [Microsoft Desktop Optimization Pack](index.md) -## [Advanced Group Policy Management](agpm/index.md) -## Application Virtualization -### [Application Virtualization 5](appv-v5/index.md) -### [Application Virtualization 4](appv-v4/index.md) -### [SoftGrid Application Virtualization](softgrid-application-virtualization.md) -## Diagnostics and Recovery Toolset -### [Diagnostics and Recovery Toolset 10](dart-v10/index.md) -### [Diagnostics and Recovery Toolset 8](dart-v8/index.md) -### [Diagnostics and Recovery Toolset 7](dart-v7/index.md) -### [Diagnostics and Recovery Toolset 6.5](dart-v65.md) -## Microsoft Bitlocker Administration and Monitoring -### [Microsoft Bitlocker Administration and Monitoring 2.5](mbam-v25/index.md) -### [Microsoft Bitlocker Administration and Monitoring 2](mbam-v2/index.md) -### [Microsoft Bitlocker Administration and Monitoring 1](mbam-v1/index.md) -## Microsoft Enterprise Desktop Virtualization -### [Microsoft Enterprise Desktop Virtualization 2](medv-v2/index.md) -## User Experience Virtualization -### [User Experience Virtualization 2](uev-v2/index.md) -### [User Experience Virtualization 1](uev-v1/index.md) -## [MDOP Solutions and Scenarios](solutions/index.md) \ No newline at end of file diff --git a/mdop/agpm/TOC.md b/mdop/agpm/TOC.md deleted file mode 100644 index 319eeaf746..0000000000 --- a/mdop/agpm/TOC.md +++ /dev/null @@ -1,245 +0,0 @@ -# [Advanced Group Policy Management](index.md) -## [Technical Overview of AGPM](technical-overview-of-agpm.md) -## [Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md) -## [AGPM 4.0 SP3](agpm-40-sp3-navengl.md) -### [What's New in AGPM 4.0 SP3](whats-new-in-agpm-40-sp3.md) -#### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3](release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md) -## [AGPM 4.0 SP2](agpm-40-sp2-navengl.md) -### [What's New in AGPM 4.0 SP2](whats-new-in-agpm-40-sp2.md) -#### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2](release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md) -## [AGPM 4.0 SP1](agpm-40-sp1-navengl.md) -### [What's New in AGPM 4.0 SP1](whats-new-in-agpm-40-sp1.md) -### [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1](release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md) -## [AGPM 4](agpm-4-navengl.md) -### [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) -### [What's New in AGPM 4.0](whats-new-in-agpm-40.md) -### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md) -### [Operations Guide for Microsoft Advanced Group Policy Management 4.0](operations-guide-for-microsoft-advanced-group-policy-management-40.md) -#### [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm40.md) -#### [Best Practices for Version Control](best-practices-for-version-control-agpm40.md) -#### [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive-agpm40.md) -#### [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm40.md) -#### [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md) -#### [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) -##### [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) -###### [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md) -###### [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md) -###### [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm40.md) -###### [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm40.md) -###### [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md) -##### [Managing the Archive](managing-the-archive-agpm40.md) -###### [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm40.md) -###### [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md) -###### [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm40.md) -###### [Import a GPO from a File](import-a-gpo-from-a-file-agpmadmin.md) -###### [Back Up the Archive](back-up-the-archive-agpm40.md) -###### [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) -##### [Managing the AGPM Service](managing-the-agpm-service-agpm40.md) -###### [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md) -###### [Modify the AGPM Service](modify-the-agpm-service-agpm40.md) -##### [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) -#### [Performing Editor Tasks](performing-editor-tasks-agpm40.md) -##### [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) -###### [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm40.md) -###### [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) -###### [Import a GPO from Production](import-a-gpo-from-production-agpm40-ed.md) -##### [Editing a GPO](editing-a-gpo-agpm40.md) -###### [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md) -###### [Label the Current Version of a GPO](label-the-current-version-of-a-gpo-agpm40.md) -###### [Rename a GPO or Template](rename-a-gpo-or-template-agpm40.md) -##### [Using a Test Environment](using-a-test-environment.md) -###### [Export a GPO to a File](export-a-gpo-to-a-file.md) -###### [Import a GPO from a File](import-a-gpo-from-a-file-ed.md) -###### [Test a GPO in a Separate Organizational Unit](test-a-gpo-in-a-separate-organizational-unit-agpm40.md) -##### [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md) -##### [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm40.md) -###### [Create a Template](create-a-template-agpm40.md) -###### [Set a Default Template](set-a-default-template-agpm40.md) -##### [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md) -###### [Request Deletion of a GPO](request-deletion-of-a-gpo-agpm40.md) -###### [Request Restoration of a Deleted GPO](request-restoration-of-a-deleted-gpo-agpm40.md) -#### [Performing Approver Tasks](performing-approver-tasks-agpm40.md) -##### [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md) -##### [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) -###### [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm40.md) -###### [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm40.md) -###### [Delegate Management of a Controlled GPO](delegate-management-of-a-controlled-gpo-agpm40.md) -###### [Import a GPO from Production](import-a-gpo-from-production-agpm40-app.md) -##### [Check In a GPO](check-in-a-gpo-agpm40.md) -##### [Deploy a GPO](deploy-a-gpo-agpm40.md) -##### [Roll Back to an Earlier Version of a GPO](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md) -##### [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) -###### [Delete a Controlled GPO](delete-a-controlled-gpo-agpm40.md) -###### [Restore a Deleted GPO](restore-a-deleted-gpo-agpm40.md) -###### [Destroy a GPO](destroy-a-gpo-agpm40.md) -#### [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) -##### [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md) -##### [Review GPO Settings](review-gpo-settings-agpm40.md) -##### [Review GPO Links](review-gpo-links-agpm40.md) -##### [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md) -#### [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) -#### [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) -##### [Contents Tab](contents-tab-agpm40.md) -###### [Contents Tab Features](contents-tab-features-agpm40.md) -###### [History Window](history-window-agpm40.md) -###### [Controlled GPO Commands](controlled-gpo-commands-agpm40.md) -###### [Uncontrolled GPO Commands](uncontrolled-gpo-commands-agpm40.md) -###### [Pending GPO Commands](pending-gpo-commands-agpm40.md) -###### [Template Commands](template-commands-agpm40.md) -###### [Recycle Bin Commands](recycle-bin-commands-agpm40.md) -##### [Domain Delegation Tab](domain-delegation-tab-agpm40.md) -##### [AGPM Server Tab](agpm-server-tab-agpm40.md) -##### [Production Delegation Tab](production-delegation-tab-agpm40.md) -##### [Administrative Templates Folder](administrative-templates-folder-agpm40.md) -###### [Logging and Tracing Settings](logging-and-tracing-settings-agpm40.md) -###### [AGPM Server Connection Settings](agpm-server-connection-settings-agpm40.md) -###### [Feature Visibility Settings](feature-visibility-settings-agpm40.md) -### [Release Notes for Microsoft Advanced Group Policy Management 4.0](release-notes-for-microsoft-advanced-group-policy-management-40.md) -## [AGPM 3](agpm-3-navengl.md) -### [What's New in AGPM 3.0](whats-new-in-agpm-30.md) -### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md) -### [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) -#### [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm30ops.md) -#### [Best Practices for Version Control](best-practices-for-version-control.md) -#### [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive.md) -#### [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm30ops.md) -#### [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) -##### [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) -###### [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md) -###### [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md) -###### [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm30ops.md) -###### [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm30ops.md) -###### [Configure Logging and Tracing](configure-logging-and-tracing-agpm30ops.md) -##### [Managing the Archive](managing-the-archive.md) -###### [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm30ops.md) -###### [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md) -###### [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm30ops.md) -###### [Back Up the Archive](back-up-the-archive.md) -###### [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) -##### [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md) -###### [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md) -###### [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md) -##### [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) -#### [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) -##### [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) -###### [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm30ops.md) -###### [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) -###### [Import a GPO from Production](import-a-gpo-from-production-agpm30ops.md) -##### [Editing a GPO](editing-a-gpo-agpm30ops.md) -###### [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md) -###### [Use a Test Environment](use-a-test-environment-agpm30ops.md) -###### [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm30ops.md) -###### [Label the Current Version of a GPO](label-the-current-version-of-a-gpo-agpm30ops.md) -###### [Rename a GPO or Template](rename-a-gpo-or-template-agpm30ops.md) -##### [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm30ops.md) -###### [Create a Template](create-a-template-agpm30ops.md) -###### [Set a Default Template](set-a-default-template-agpm30ops.md) -##### [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm30ops.md) -###### [Request Deletion of a GPO](request-deletion-of-a-gpo-agpm30ops.md) -###### [Request Restoration of a Deleted GPO](request-restoration-of-a-deleted-gpo-agpm30ops.md) -#### [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) -##### [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md) -##### [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) -###### [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm30ops.md) -###### [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm30ops.md) -###### [Delegate Management of a Controlled GPO](delegate-management-of-a-controlled-gpo-agpm30ops.md) -###### [Import a GPO from Production](import-a-gpo-from-production-editor-agpm30ops.md) -##### [Check In a GPO](check-in-a-gpo-agpm30ops.md) -##### [Deploy a GPO](deploy-a-gpo-agpm30ops.md) -##### [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md) -##### [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) -###### [Delete a Controlled GPO](delete-a-controlled-gpo-agpm30ops.md) -###### [Restore a Deleted GPO](restore-a-deleted-gpo-agpm30ops.md) -###### [Destroy a GPO](destroy-a-gpo-agpm30ops.md) -#### [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) -##### [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md) -##### [Review GPO Settings](review-gpo-settings-agpm30ops.md) -##### [Review GPO Links](review-gpo-links-agpm30ops.md) -##### [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md) -#### [Troubleshooting AGPM](troubleshooting-advanced-group-policy-management-agpm30ops.md) -#### [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) -##### [Contents Tab](contents-tab-agpm30ops.md) -###### [Contents Tab Features](contents-tab-features-agpm30ops.md) -###### [History Window](history-window-agpm30ops.md) -###### [Controlled GPO Commands](controlled-gpo-commands-agpm30ops.md) -###### [Uncontrolled GPO Commands](uncontrolled-gpo-commands-agpm30ops.md) -###### [Pending GPO Commands](pending-gpo-commands-agpm30ops.md) -###### [Template Commands](template-commands-agpm30ops.md) -###### [Recycle Bin Commands](recycle-bin-commands-agpm30ops.md) -##### [Domain Delegation Tab](domain-delegation-tab-agpm30ops.md) -##### [AGPM Server Tab](agpm-server-tab-agpm30ops.md) -##### [Production Delegation Tab](production-delegation-tab-agpm30ops.md) -##### [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md) -###### [Logging and Tracing Settings](logging-and-tracing-settings-agpm30ops.md) -###### [AGPM Server Connection Settings](agpm-server-connection-settings-agpm30ops.md) -###### [Feature Visibility Settings](feature-visibility-settings-agpm30ops.md) -## [AGPM 2.5](agpm-25-navengl.md) -### [Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5](step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md) -### [Operations Guide for Microsoft Advanced Group Policy Management 2.5](operations-guide-for-microsoft-advanced-group-policy-management-25.md) -#### [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management.md) -#### [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md) -#### [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) -##### [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md) -##### [Configure E-Mail Notification](configure-e-mail-notification.md) -##### [Delegate Domain-Level Access](delegate-domain-level-access.md) -##### [Delegate Access to an Individual GPO](delegate-access-to-an-individual-gpo.md) -##### [Configure Logging and Tracing](configure-logging-and-tracing.md) -##### [Managing the AGPM Service](managing-the-agpm-service.md) -###### [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md) -###### [Modify the Archive Path](modify-the-archive-path.md) -###### [Modify the AGPM Service Account](modify-the-agpm-service-account.md) -###### [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md) -#### [Performing Editor Tasks](performing-editor-tasks.md) -##### [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) -###### [Request Control of a Previously Uncontrolled GPO](request-control-of-a-previously-uncontrolled-gpo.md) -###### [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) -###### [Import a GPO from Production](import-a-gpo-from-production-editor.md) -##### [Editing a GPO](editing-a-gpo.md) -###### [Edit a GPO Offline](edit-a-gpo-offline.md) -###### [Use a Test Environment](use-a-test-environment.md) -###### [Request Deployment of a GPO](request-deployment-of-a-gpo.md) -###### [Label the Current Version of a GPO](label-the-current-version-of-a-gpo.md) -###### [Rename a GPO or Template](rename-a-gpo-or-template.md) -##### [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) -###### [Create a Template](create-a-template.md) -###### [Set a Default Template](set-a-default-template.md) -##### [Delete a GPO](delete-a-gpo-editor.md) -#### [Performing Approver Tasks](performing-approver-tasks.md) -##### [Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md) -##### [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) -###### [Control a Previously Uncontrolled GPO](control-a-previously-uncontrolled-gpo.md) -###### [Create a New Controlled GPO](create-a-new-controlled-gpo.md) -###### [Delegate Access to a GPO](delegate-access-to-a-gpo.md) -###### [Import a GPO from Production](import-a-gpo-from-production-approver.md) -##### [Check In a GPO](check-in-a-gpo-approver.md) -##### [Deploy a GPO](deploy-a-gpo.md) -##### [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo.md) -##### [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) -###### [Delete a GPO](delete-a-gpo-approver.md) -###### [Restore a Deleted GPO](restore-a-deleted-gpo.md) -###### [Destroy a GPO](destroy-a-gpo.md) -#### [Performing Reviewer Tasks](performing-reviewer-tasks.md) -##### [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md) -##### [Review GPO Settings](review-gpo-settings.md) -##### [Review GPO Links](review-gpo-links.md) -##### [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates.md) -#### [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management.md) -#### [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) -##### [Contents Tab](contents-tab.md) -###### [Controlled Tab](controlled-tab.md) -###### [Uncontrolled Tab](uncontrolled-tab.md) -###### [Pending Tab](pending-tab.md) -###### [Templates Tab](templates-tab.md) -###### [Recycle Bin Tab](recycle-bin-tab.md) -###### [Common Secondary Tab Features](common-secondary-tab-features.md) -###### [History Window](history-window.md) -##### [Domain Delegation Tab](domain-delegation-tab.md) -##### [AGPM Server Tab](agpm-server-tab.md) -##### [Administrative Template Settings](administrative-template-settings.md) -###### [Logging and Tracing Settings](logging-and-tracing-settings.md) -###### [AGPM Server Connection Settings](agpm-server-connection-settings.md) -###### [Feature Visibility Settings](feature-visibility-settings.md) -##### [Other Enhancements to the GPMC](other-enhancements-to-the-gpmc.md) -## [Troubleshooting AGPM Upgrades](troubleshooting-agpm40-upgrades.md) -## [Resources for AGPM](resources-for-agpm.md) - diff --git a/mdop/agpm/administrative-template-settings.md b/mdop/agpm/administrative-template-settings.md deleted file mode 100644 index 7d675b587e..0000000000 --- a/mdop/agpm/administrative-template-settings.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Administrative Template Settings -description: Administrative Template Settings -author: dansimp -ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrative Template Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM clients and servers to which a Group Policy object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** node and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. - -- [Logging and Tracing Settings](logging-and-tracing-settings.md) - -- [AGPM Server Connection Settings](agpm-server-connection-settings.md) - -- [Feature Visibility Settings](feature-visibility-settings.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/administrative-templates-folder-agpm30ops.md b/mdop/agpm/administrative-templates-folder-agpm30ops.md deleted file mode 100644 index 357c524122..0000000000 --- a/mdop/agpm/administrative-templates-folder-agpm30ops.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Administrative Templates Folder -description: Administrative Templates Folder -author: dansimp -ms.assetid: 0cc5b570-b6d3-4841-9646-02521c13519c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrative Templates Folder - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Clients and AGPM Servers to which a Group Policy Object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. - -- [Logging and Tracing Settings](logging-and-tracing-settings-agpm30ops.md) - -- [AGPM Server Connection Settings](agpm-server-connection-settings-agpm30ops.md) - -- [Feature Visibility Settings](feature-visibility-settings-agpm30ops.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/administrative-templates-folder-agpm40.md b/mdop/agpm/administrative-templates-folder-agpm40.md deleted file mode 100644 index daec342d3b..0000000000 --- a/mdop/agpm/administrative-templates-folder-agpm40.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Administrative Templates Folder -description: Administrative Templates Folder -author: dansimp -ms.assetid: abc41968-4505-4b09-94f2-67ee0e6c9aaf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrative Templates Folder - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Clients and AGPM Servers to which a Group Policy Object (GPO) with these settings is applied. Similarly, these settings enable you to centrally configure archive locations and the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a GPO with these settings is applied. - -- [Logging and Tracing Settings](logging-and-tracing-settings-agpm40.md) - -- [AGPM Server Connection Settings](agpm-server-connection-settings-agpm40.md) - -- [Feature Visibility Settings](feature-visibility-settings-agpm40.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/advanced-group-policy-management-40.md b/mdop/agpm/advanced-group-policy-management-40.md deleted file mode 100644 index 5fccc1a30d..0000000000 --- a/mdop/agpm/advanced-group-policy-management-40.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Advanced Group Policy Management 4.0 -description: Advanced Group Policy Management 4.0 -author: dansimp -ms.assetid: 9873a1f7-97fc-4546-9538-b4c0308529c0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Advanced Group Policy Management 4.0 - - -You can use Microsoft Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC). AGPM provides comprehensive change control and improved management of Group Policy Objects (GPOs). - -Using AGPM, you can do these tasks: - -- Perform offline editing of GPOs so that you can create and test them before you deploy them to a production environment. - -- Maintain multiple versions of a GPO in a central archive so that you can roll back if a problem occurs. - -- Share the responsibility for editing, approving, and reviewing GPOs among multiple people by using role-based delegation. - -- Eliminate the danger of multiple Group Policy administrators overwriting one another's work by using the check-in and check-out capability for GPOs. - -- Analyze changes to a GPO, comparing it to another GPO or another version of the same GPO by using difference reporting. - -- Simplify creating new GPOs by using GPO templates, storing common policy settings and preference settings to use as starting points for new GPOs. - -- Delegate access to the production environment. - -- Search for GPOs with specific attributes and filter the list of GPOs displayed. - -- Export a GPO to a file so that you can copy it from a domain in a test forest to a domain in a production forest. - -AGPM adds a **Change Control** folder under each domain displayed in the GPMC, in addition to a **History** tab for each GPO and Group Policy link displayed in the GPMC. - -- [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm40.md) - -- [Best Practices for Version Control](best-practices-for-version-control-agpm40.md) - -- [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive-agpm40.md) - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm40.md) - -- [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -- [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-25-navengl.md b/mdop/agpm/agpm-25-navengl.md deleted file mode 100644 index 3eab801c30..0000000000 --- a/mdop/agpm/agpm-25-navengl.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: AGPM 2.5 -description: AGPM 2.5 -author: dansimp -ms.assetid: 6db42f2e-88b2-4305-ab6b-d3cd0c5d686c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 2.5 - - -- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5](step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md) - -- [Operations Guide for Microsoft Advanced Group Policy Management 2.5](operations-guide-for-microsoft-advanced-group-policy-management-25.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-3-navengl.md b/mdop/agpm/agpm-3-navengl.md deleted file mode 100644 index b22f23bf00..0000000000 --- a/mdop/agpm/agpm-3-navengl.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: AGPM 3 -description: AGPM 3 -author: dansimp -ms.assetid: b0d0051d-2900-4a0f-8307-552ad26b0e3b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 3 - - -- [What's New in AGPM 3.0](whats-new-in-agpm-30.md) - -- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md) - -- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-4-navengl.md b/mdop/agpm/agpm-4-navengl.md deleted file mode 100644 index d9b63043f8..0000000000 --- a/mdop/agpm/agpm-4-navengl.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: AGPM 4 -description: AGPM 4 -author: dansimp -ms.assetid: 81693f30-1b8e-4e63-b1ac-e6de1bc30cc0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 4 - - -- [What's New in AGPM 4.0](whats-new-in-agpm-40.md) - -- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md) - -- [Operations Guide for Microsoft Advanced Group Policy Management 4.0](operations-guide-for-microsoft-advanced-group-policy-management-40.md) - -- [Release Notes for Microsoft Advanced Group Policy Management 4.0](release-notes-for-microsoft-advanced-group-policy-management-40.md) - -> [!NOTE] -> Advanced Group Policy Management (AGPM) 4.0 will be end of life on January 12, 2021. Please upgrade to a supported version, such as AGPM 4.0 with Service Pack 3 prior to this date. - -  - - - - - diff --git a/mdop/agpm/agpm-40-sp1-navengl.md b/mdop/agpm/agpm-40-sp1-navengl.md deleted file mode 100644 index 94076ee683..0000000000 --- a/mdop/agpm/agpm-40-sp1-navengl.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: AGPM 4.0 SP1 -description: AGPM 4.0 SP1 -author: dansimp -ms.assetid: 4e55d9e6-635c-4ba6-acbb-ed1d1b580a5b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 4.0 SP1 - - -- [What's New in AGPM 4.0 SP1](whats-new-in-agpm-40-sp1.md) - -- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1](release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-40-sp2-navengl.md b/mdop/agpm/agpm-40-sp2-navengl.md deleted file mode 100644 index cc07406cc0..0000000000 --- a/mdop/agpm/agpm-40-sp2-navengl.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: AGPM 4.0 SP2 -description: AGPM 4.0 SP2 -author: dansimp -ms.assetid: 915c9791-ac07-43db-bd53-957b641c700f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 4.0 SP2 - - -- [What's New in AGPM 4.0 SP2](whats-new-in-agpm-40-sp2.md) - -- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2](release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-40-sp3-navengl.md b/mdop/agpm/agpm-40-sp3-navengl.md deleted file mode 100644 index daf9dd9544..0000000000 --- a/mdop/agpm/agpm-40-sp3-navengl.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: AGPM 4.0 SP3 -description: AGPM 4.0 SP3 -author: dansimp -ms.assetid: cd80eea9-601f-4e45-b89e-c3904addee37 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM 4.0 SP3 - - -- [What's New in AGPM 4.0 SP3](whats-new-in-agpm-40-sp3.md) - -- [Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3](release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md b/mdop/agpm/agpm-server-connection-settings-agpm30ops.md deleted file mode 100644 index bc916bbcd2..0000000000 --- a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: AGPM Server Connection Settings -description: AGPM Server Connection Settings -author: dansimp -ms.assetid: 5f03e397-b868-4c49-9cbf-a5f5d0ddcc39 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Connection Settings - - -You can use Administrative template settings for Advanced Group Policy Management (AGPM) to centrally configure AGPM Server connections for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. - - ---- - - - - - - - - - - - - - - - - -
    SettingEffect

    AGPM: Specify default AGPM Server (all domains)

    This policy setting allows you to specify a default AGPM Server for all domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to another archive. You can override this default for individual domains using the AGPM: Specify AGPM Servers setting.

    AGPM: Specify AGPM Servers

    This policy setting allows you to specify the AGPM Servers for individual domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to a different archive for the specified domain. To specify a default AGPM Server, use the AGPM: Specify default AGPM Server (all domains) setting and use this policy setting to override the default on a per domain basis.

    - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-server-connection-settings-agpm40.md b/mdop/agpm/agpm-server-connection-settings-agpm40.md deleted file mode 100644 index c713631290..0000000000 --- a/mdop/agpm/agpm-server-connection-settings-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: AGPM Server Connection Settings -description: AGPM Server Connection Settings -author: dansimp -ms.assetid: cc67f122-6309-4820-92c2-f6a27d897123 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Connection Settings - - -You can use Administrative template settings for Advanced Group Policy Management (AGPM) to centrally configure AGPM Server connections for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. - - ---- - - - - - - - - - - - - - - - - -
    SettingEffect

    AGPM: Specify default AGPM Server (all domains)

    This policy setting allows you to specify a default AGPM Server for all domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to another archive. You can override this default for individual domains using the AGPM: Specify AGPM Servers setting.

    AGPM: Specify AGPM Servers

    This policy setting allows you to specify the AGPM Servers for individual domains. This is used only by AGPM Clients, and restricts Group Policy administrators from connecting to a different archive for the specified domain. To specify a default AGPM Server, use the AGPM: Specify default AGPM Server (all domains) setting and use this policy setting to override the default on a per domain basis.

    - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-server-connection-settings.md b/mdop/agpm/agpm-server-connection-settings.md deleted file mode 100644 index a615120897..0000000000 --- a/mdop/agpm/agpm-server-connection-settings.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: AGPM Server Connection Settings -description: AGPM Server Connection Settings -author: dansimp -ms.assetid: faf78e5b-2b0d-4069-9b8c-910add892200 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Connection Settings - - -You can use Administrative template settings for Advanced Group Policy Management (AGPM) to centrally configure AGPM Server connections for Group Policy administrators to whom a Group Policy object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. If this path is not visible, right-click **Administrative Templates**, and add the agpm.admx or agpm.adm template. - - ---- - - - - - - - - - - - - - - - - -
    SettingEffect

    AGPM Server (all domains)

    If enabled, this setting centrally configures one AGPM Server connection for use by all domains and disables the settings on the AGPM Server tab for Group Policy administrators. For multiple AGPM Servers, configure this setting with a default server and then configure the AGPM Server setting in the Administrative template to override this server for other domains.

    -

    If disabled or not configured, each Group Policy administrator must select the AGPM Server to display for each domain on the AGPM Server tab in AGPM.

    AGPM Server

    If enabled, this setting centrally configures multiple domain-specific AGPM Servers, overriding the AGPM Server (all domains) setting in the Administrative template. If your environment requires only a single AGPM Server, use only the AGPM Server (all domains) setting in the Administrative template.

    -

    If disabled or not configured, the AGPM Server (all domains) setting in the Administrative template configures the AGPM Server connection.

    - -  - -### Additional references - -- [Administrative Template Settings](administrative-template-settings.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/agpm-server-tab-agpm30ops.md b/mdop/agpm/agpm-server-tab-agpm30ops.md deleted file mode 100644 index 1732bd6a6e..0000000000 --- a/mdop/agpm/agpm-server-tab-agpm30ops.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: AGPM Server Tab -description: AGPM Server Tab -author: dansimp -ms.assetid: fb3b0265-53ed-4bf6-88a4-c409f5f1bed4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Tab - - -The **AGPM Server** tab on the **Change Control** pane enables you to select an AGPM Server by entering a fully-qualified computer name and port, and to delete older versions of Group Policy Objects (GPOs) from the archive to conserve disk space on the AGPM Server. - -## Specifying the AGPM Server - - -The AGPM Server selected determines which archive is displayed for you on the **Contents** tab and to which location the **Domain Delegation** settings are applied. The default port for Advanced Group Policy Management (AGPM) is port 4600. - -If the AGPM Server connection is centrally configured using Administrative template settings, the options on this tab for configuring the connection are unavailable. For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - -## Deleting old GPO versions - - -By default, all versions of every controlled GPO are retained in the archive. However, you can configure the AGPM Service to limit the number of versions retained for each GPO and automatically delete the oldest version when that limit is exceeded. Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit. - -**Note**   -The maximum number of unique versions to store for each GPO does not include the current version, so entering 0 retains only the current version. The limit must be no greater than 999 versions. - -When a GPO version is deleted, a record of that version remains in the history of the GPO, but the GPO version itself is deleted from the archive. You can prevent a GPO version from being deleted by marking it in the history as not deletable. - - - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/agpm-server-tab-agpm40.md b/mdop/agpm/agpm-server-tab-agpm40.md deleted file mode 100644 index b2974b2c84..0000000000 --- a/mdop/agpm/agpm-server-tab-agpm40.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: AGPM Server Tab -description: AGPM Server Tab -author: dansimp -ms.assetid: a6689437-233e-4f33-a0d6-f7d432c96c00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Tab - - -The **AGPM Server** tab on the **Change Control** pane enables you to select an AGPM Server by entering a fully-qualified computer name and port, and to delete older versions of Group Policy Objects (GPOs) from the archive to conserve disk space on the AGPM Server. - -## Specifying the AGPM Server - - -The AGPM Server selected determines which archive is displayed for you on the **Contents** tab and to which location the **Domain Delegation** settings are applied. The default port for Advanced Group Policy Management (AGPM) is port 4600. - -If the AGPM Server connection is centrally configured using Administrative template settings, the options on this tab for configuring the connection are unavailable. For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - -## Deleting old GPO versions - - -By default, all versions of every controlled GPO are retained in the archive. However, you can configure the AGPM Service to limit the number of versions retained for each GPO and automatically delete the oldest version when that limit is exceeded. Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit. - -**Note**   -The maximum number of unique versions to store for each GPO does not include the current version, so entering 0 retains only the current version. The limit must be no greater than 999 versions. - -When a GPO version is deleted, a record of that version remains in the history of the GPO, but the GPO version itself is deleted from the archive. You can prevent a GPO version from being deleted by marking it in the history as not deletable. - - - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/agpm-server-tab.md b/mdop/agpm/agpm-server-tab.md deleted file mode 100644 index ad3006d8b0..0000000000 --- a/mdop/agpm/agpm-server-tab.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: AGPM Server Tab -description: AGPM Server Tab -author: dansimp -ms.assetid: ce4490b7-b564-49af-8962-858ee39e0016 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# AGPM Server Tab - - -The **AGPM Server** tab on the **Change Control** pane enables you to select an AGPM Server by entering a fully-qualified computer name and port. The default port for Advanced Group Policy Management (AGPM) is port 4600. - -The AGPM Server selected determines which archive is displayed for you on the **Contents** tab and to which location the **Domain Delegation** settings are applied. - -If the AGPM Server connection is centrally configured using Administrative template settings, the options on this tab are unavailable. For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md). - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md b/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md deleted file mode 100644 index 3d7d96b30b..0000000000 --- a/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Approve or Reject a Pending Action -description: Approve or Reject a Pending Action -author: dansimp -ms.assetid: 6d78989a-b600-4876-9dd9-bc6207ff2ce7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Approve or Reject a Pending Action - - -The core responsibility of an Approver is to evaluate and then approve or reject requests for Group Policy Object (GPO) creation, deployment, and deletion from Editors or Reviewers who do not have permission to complete those actions. Reports can assist an Approver with evaluating a new version of a GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To approve or reject a pending request** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -3. Right-click a pending GPO, and then click either **Approve** or **Reject**. - -4. If approving deployment, click **Advanced** in the **Approve Pending Operation** dialog box to review links to the GPO. Pause the mouse pointer on an item in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes** or **OK** to confirm approval or rejection of the pending action. If you have approved the request, the GPO is moved to the appropriate tab for the action performed. - - **Note**   - If an Approver's e-mail address is included in the **To e-mail address** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have the permissions required to perform the request that you are approving. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md b/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md deleted file mode 100644 index c03d30ec60..0000000000 --- a/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Approve or Reject a Pending Action -description: Approve or Reject a Pending Action -author: dansimp -ms.assetid: 078ea8b5-9ac5-45fc-9ac1-a1aa629c10b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Approve or Reject a Pending Action - - -The core responsibility of an Approver is to evaluate and then approve or reject requests for Group Policy Object (GPO) creation, deployment, and deletion from Editors or Reviewers who do not have permission to complete those actions. Reports can assist an Approver with evaluating a new version of a GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To approve or reject a pending request** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -3. Right-click a pending GPO, and then click either **Approve** or **Reject**. - -4. If approving deployment, click **Advanced** in the **Approve Pending Operation** dialog box to review links to the GPO. Pause the mouse pointer on an item in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes** or **OK** to confirm approval or rejection of the pending action. If you have approved the request, the GPO is moved to the appropriate tab for the action performed. - - **Note**   - If an Approver's e-mail address is included in the **To e-mail address** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have the permissions required to perform the request that you are approving. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/approve-or-reject-a-pending-action.md b/mdop/agpm/approve-or-reject-a-pending-action.md deleted file mode 100644 index 7d7dea9ee8..0000000000 --- a/mdop/agpm/approve-or-reject-a-pending-action.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Approve or Reject a Pending Action -description: Approve or Reject a Pending Action -author: dansimp -ms.assetid: 22921a51-50fb-4a47-bec1-4f563f523675 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Approve or Reject a Pending Action - - -The core responsibility of an Approver is to evaluate and then approve or reject requests for Group Policy object (GPO) creation, deployment, and deletion from Editors or Reviewers who do not have permission to complete those actions. The report capabilities of Advanced Group Policy Management (AGPM) can assist an Approver with evaluating a new version of a GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To approve or reject a pending request** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -3. Right-click a pending GPO, and then click either **Approve** or **Reject**. - -4. If approving deployment, click **Advanced** in the **Approve Pending Operation** dialog box to review links to the GPO. Pause the mouse pointer on a node in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes** or **OK** to confirm approval or rejection of the pending action. If you have approved the request, the GPO is moved to the appropriate tab for the action performed. - - **Note**   - If an Approver's e-mail address is included in the **To** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have the permissions required to perform the request that you are approving. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/back-up-the-archive-agpm40.md b/mdop/agpm/back-up-the-archive-agpm40.md deleted file mode 100644 index af468e9671..0000000000 --- a/mdop/agpm/back-up-the-archive-agpm40.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Back Up the Archive -description: Back Up the Archive -author: dansimp -ms.assetid: 538d85eb-3596-4c1d-bbd7-26bc28857c28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Back Up the Archive - - -To help in the recovery of the archive for Advanced Group Policy Management (AGPM) if there is a disaster, an AGPM Administrator (Full Control) should back up the archive frequently. By default, the archive is created in %ProgramData%\\Microsoft\\AGPM. However, you can specify a different path during the setup of Microsoft Advanced Group Policy Management - Server. - -A user account that has access to both the AGPM Server—the computer on which the AGPM Service is installed—and to the folder that contains the archive is required to complete this procedure. - -**To back up the archive** - -1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - -2. Back up the archive folder by using Windows Explorer, Xcopy, Windows Server® Backup, or another backup tool. Make sure that you back up hidden, system, and read-only files. - -3. Store the archive backup in a secure location. - -4. Restart the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - -**Note**   -If an AGPM Administrator backs up the archive infrequently, the Group Policy Objects (GPOs) in the archive backup will not be current. To better ensure that the archive backup is current, back up the archive as part of your organization’s daily backup strategy. - - - -### Additional references - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) - -- [Managing the Archive](managing-the-archive-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/back-up-the-archive.md b/mdop/agpm/back-up-the-archive.md deleted file mode 100644 index 71c30b98c3..0000000000 --- a/mdop/agpm/back-up-the-archive.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Back Up the Archive -description: Back Up the Archive -author: dansimp -ms.assetid: 400176da-3518-4475-ad19-c96cda6ca7ba -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Back Up the Archive - - -To help in the recovery of the archive for Advanced Group Policy Management (AGPM) if there is a disaster, an AGPM Administrator (Full Control) should back up the archive frequently. By default, the archive is created in %ProgramData%\\Microsoft\\AGPM. However, you can specify a different path during the setup of Microsoft Advanced Group Policy Management - Server. - -A user account that has access to both the AGPM Server—the computer on which the AGPM Service is installed—and to the folder that contains the archive is required to complete this procedure. - -**To back up the archive** - -1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - -2. Back up the archive folder by using Windows Explorer, Xcopy, Windows Server® Backup, or another backup tool. Make sure that you back up hidden, system, and read-only files. - -3. Store the archive backup in a secure location. - -4. Restart the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - -**Note**   -If an AGPM Administrator backs up the archive infrequently, the Group Policy Objects (GPOs) in the archive backup will not be current. To better ensure that the archive backup is current, back up the archive as part of your organization’s daily backup strategy. - - - -### Additional references - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) - -- [Managing the Archive](managing-the-archive.md) - - - - - - - - - diff --git a/mdop/agpm/best-practices-for-version-control-agpm40.md b/mdop/agpm/best-practices-for-version-control-agpm40.md deleted file mode 100644 index 59b5394a61..0000000000 --- a/mdop/agpm/best-practices-for-version-control-agpm40.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Best Practices for Version Control -description: Best Practices for Version Control -author: dansimp -ms.assetid: 4a2a1ac7-67f3-4ba3-ab07-860d33da0efe -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Best Practices for Version Control - - -Microsoft Advanced Group Policy Management (AGPM) provides version control for Group Policy Objects (GPOs) much like Microsoft Visual SourceSafe® provides version control for source code. Developers can use Visual SourceSafe to manage multiple versions of each source file. Group Policy administrators can use AGPM to do the same for GPOs. When you use AGPM, Group Policy administrators should be aware of best practices that apply to any version control system: - -- **Date and time:** AGPM stamps each version of a GPO with the date and time. To ensure that history is accurate, especially when you edit GPOs on more than one computer, make sure that each computer synchronizes its clock with one authoritative time source. - -- **Check in GPOs when you are finished editing them:** It is common for Editors to check out GPOs and forget to check them back into the archive. However, this can prevent other Group Policy administrators from changing the GPO. Always check GPOs back in to AGPM immediately when you are finished editing. - -- **Save changes frequently:** When you edit a GPO, save changes frequently. Most Editors check out a GPO, make many changes, and then check the GPO into the archive. Instead, check the GPO into the archive regularly, and then check it out again. The detail can be as small as checking in the GPO after you change every setting (not recommended) or checking in the GPO after you make groups of related changes. The result is a better-documented history for each GPO that can help when troubleshooting issues. - -- **Deploy GPOs frequently:** Do not let new and edited GPOs that have not yet been deployed accumulate in large numbers in the archive. Instead, deploy new and edited GPOs as soon as possible so that they have a minimum effect on the production environment. Deploying many new and edited GPOs at one time can jeopardize the production environment. - -- **Document the purpose of changes when you check in GPOs:** Any Reviewer can compare versions of a GPO to see specific changes between the two. Documenting those specific changes adds no value. Instead, document the intent and purpose of a change instead of documenting what Reviewers can see by viewing difference reports. Version comments should add value to the comparison report and help a Reviewer understand why the Editor changed the GPO. - -- **Test GPOs in a test environment:** Deploying GPOs to the production environment without testing them is risky. Instead, test your GPOs in a domain in a test forest, and then export the GPOs to files and import them to a domain in a production forest. Also, you can link GPOs to an organizational unit that contains test computers and users. Verify that each GPO functions correctly in the test environment and then deploy the GPOs to the production environment. - -### Additional references - -- [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - -  - -  - - - - - diff --git a/mdop/agpm/best-practices-for-version-control.md b/mdop/agpm/best-practices-for-version-control.md deleted file mode 100644 index e9e4d02c9b..0000000000 --- a/mdop/agpm/best-practices-for-version-control.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Best Practices for Version Control -description: Best Practices for Version Control -author: dansimp -ms.assetid: 89067f6a-f7ea-4dad-999d-118284cf6c5a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Best Practices for Version Control - - -Microsoft Advanced Group Policy Management (AGPM) provides version control for Group Policy Objects (GPOs) much like Microsoft Visual SourceSafe® provides version control for source code. Developers can use Visual SourceSafe to manage multiple versions of each source file. Group Policy administrators can use AGPM to do the same for GPOs. When you use AGPM, Group Policy administrators should be aware of best practices that apply to any version control system: - -- **Date and time:** AGPM stamps each version of a GPO with the date and time. To ensure that history is accurate, especially when you edit GPOs on more than one computer, make sure that each computer synchronizes its clock with one authoritative time source. - -- **Check in GPOs when you are finished editing them:** It is common for Editors to check out GPOs and forget to check them back into the archive. However, this can prevent other Group Policy administrators from changing the GPO. Always check GPOs back in to AGPM immediately when you are finished editing. - -- **Save changes frequently:** When you edit a GPO, save changes frequently. Most Editors check out a GPO, make many changes, and then check the GPO into the archive. Instead, check the GPO into the archive regularly, and then check it out again. The detail can be as small as checking in the GPO after you change every setting (not recommended) or checking in the GPO after you make groups of related changes. The result is a better-documented history for each GPO that can help when troubleshooting issues. - -- **Deploy GPOs frequently:** Do not let new and edited GPOs that have not yet been deployed accumulate in large numbers in the archive. Instead, deploy new and edited GPOs as soon as possible so that they have a minimum effect on the production environment. Deploying many new and edited GPOs at one time can jeopardize the production environment. - -- **Document the purpose of changes when you check in GPOs:** Any Reviewer can compare versions of a GPO to see specific changes between the two. Documenting those specific changes adds no value. Instead, document the intent and purpose of a change instead of documenting what Reviewers can see by viewing difference reports. Version comments should add value to the comparison report and help a Reviewer understand why the Editor changed the GPO. - -- **Test GPOs in a lab before you deploy:** Deploying GPOs to the production environment without first testing them is risky. Instead, test GPOs in a lab environment by linking them to an organizational unit that contains test computers and users, and then verifying that they function correctly. After verifying each GPO in the lab, deploy the GPO to the production environment. - -### Additional references - -- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/check-in-a-gpo-agpm30ops.md b/mdop/agpm/check-in-a-gpo-agpm30ops.md deleted file mode 100644 index f23e725ea1..0000000000 --- a/mdop/agpm/check-in-a-gpo-agpm30ops.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Check In a GPO -description: Check In a GPO -author: dansimp -ms.assetid: 437397db-c94b-4940-b1a4-05442619ebee -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Check In a GPO - - -Ordinarily, Editors should check in Group Policy Objects (GPOs) that they have edited when their modifications are complete. (For details, see [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md).) However, if the Editor is unavailable, an Approver can also check in a GPO. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To check in a GPO that has been checked out by an Editor** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - - - To discard any changes made by the Editor, right-click the GPO, click **Undo Check Out**, and then click **Yes** to confirm. - - - To retain changes made by the Editor, right-click the GPO and then click **Check In**. - -3. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/check-in-a-gpo-agpm40.md b/mdop/agpm/check-in-a-gpo-agpm40.md deleted file mode 100644 index fb203386c7..0000000000 --- a/mdop/agpm/check-in-a-gpo-agpm40.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Check In a GPO -description: Check In a GPO -author: dansimp -ms.assetid: b838c8a2-eb9e-4e5b-8740-d7701a4294ac -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Check In a GPO - - -Ordinarily, Editors should check in Group Policy Objects (GPOs) that they have edited when their modifications are complete. (For details, see [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md).) However, if the Editor is unavailable, an Approver can also check in a GPO. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To check in a GPO that has been checked out by an Editor** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - - - To discard any changes made by the Editor, right-click the GPO, click **Undo Check Out**, and then click **Yes** to confirm. - - - To retain changes made by the Editor, right-click the GPO and then click **Check In**. - -3. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/check-in-a-gpo-approver.md b/mdop/agpm/check-in-a-gpo-approver.md deleted file mode 100644 index 7547a20849..0000000000 --- a/mdop/agpm/check-in-a-gpo-approver.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Check In a GPO -description: Check In a GPO -author: dansimp -ms.assetid: e428cfff-651f-4903-bf01-d742714d2fa9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Check In a GPO - - -Ordinarily, Editors should check in Group Policy objects (GPOs) that they have edited when their modifications are complete. (For details, see [Edit a GPO Offline](edit-a-gpo-offline.md).) However, if the Editor is unavailable, an Approver can also check in a GPO. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To check in a GPO that has been checked out by an Editor** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - - - To discard any changes made by the Editor, right-click the GPO, click **Undo Check Out**, and then click **Yes** to confirm. - - - To retain changes made by the Editor, right-click the GPO and then click **Check In**. - -3. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Edit a GPO Offline](edit-a-gpo-offline.md) - -  - -  - - - - - diff --git a/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md b/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md deleted file mode 100644 index f04859c49f..0000000000 --- a/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Checklist Administer the AGPM Server and Archive -description: Checklist Administer the AGPM Server and Archive -author: dansimp -ms.assetid: d9c60203-90c2-48a7-9318-197e0ec5038b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Administer the AGPM Server and Archive - - -In Advanced Group Policy Management (AGPM), both the AGPM Service and the archive are managed by AGPM Administrators (Full Control). The following are typical tasks for an AGPM Administrator. - - ---- - - - - - - - - - - - - - - - - -
    Frequent TaskReference

    Delegate access to Group Policy Objects (GPOs) in the archive.

    Delegate Domain-Level Access to the Archive

    -

    Delegate Access to an Individual GPO in the Archive

    Back up the archive to enable disaster recovery.

    Back Up the Archive

    - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Infrequent TaskReference

    Restore the archive from a backup to recover from a disaster.

    Restore the Archive from a Backup

    Move the AGPM Service, the archive, or both to a different server.

    Move the AGPM Server and the Archive

    Change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens.

    Modify the AGPM Service

    Troubleshoot common problems with the AGPM Server.

    Troubleshooting AGPM

    -

    Configure Logging and Tracing

    - - - -### Additional references - -- [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - - - - - - - - - diff --git a/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md b/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md deleted file mode 100644 index ff4a199b6e..0000000000 --- a/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Checklist Administer the AGPM Server and Archive -description: Checklist Administer the AGPM Server and Archive -author: dansimp -ms.assetid: 0b2eb536-c3cc-462f-a42f-27a53f57bc55 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Administer the AGPM Server and Archive - - -In Advanced Group Policy Management (AGPM), both the AGPM Service and the archive are managed by AGPM Administrators (Full Control). The following are typical tasks for an AGPM Administrator. - - ---- - - - - - - - - - - - - - - - - -
    Frequent TaskReference

    Delegate access to Group Policy Objects (GPOs) in the archive.

    Delegate Domain-Level Access to the Archive

    -

    Delegate Access to an Individual GPO in the Archive

    Back up the archive to enable disaster recovery.

    Back Up the Archive

    - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Infrequent TaskReference

    Restore the archive from a backup to recover from a disaster.

    Restore the Archive from a Backup

    Move the AGPM Service, the archive, or both to a different server.

    Move the AGPM Server and the Archive

    Change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens.

    Modify the AGPM Service

    Troubleshoot common problems with the AGPM Server.

    Troubleshooting Advanced Group Policy Management

    -

    Configure Logging and Tracing

    - - - -### Additional references - -- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md deleted file mode 100644 index 5c37765df2..0000000000 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Checklist Create, Edit, and Deploy a GPO -description: Checklist Create, Edit, and Deploy a GPO -author: dansimp -ms.assetid: a7a17706-304a-4455-9ada-52508ec620f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Create, Edit, and Deploy a GPO - - -In an environment where multiple people make changes to Group Policy Objects (GPOs) using Advanced Group Policy Management (AGPM), an AGPM Administrator (Full Control) delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. The following is a typical GPO development process for an Editor and an Approver. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReference

    Editor requests the creation of a new GPO or an Approver creates a new GPO.

    Request the Creation of a New Controlled GPO

    -

    Create a New Controlled GPO

    Approver approves the creation of the GPO if it was requested by an Editor.

    Approve or Reject a Pending Action

    Editor checks out a copy of the GPO from the archive, so no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.

    Edit a GPO Offline

    Editor requests deployment of the GPO to the production environment.

    Request Deployment of a GPO

    Reviewers, such as Approvers or Editors, analyze the GPO.

    Performing Reviewer Tasks

    Approver approves and deploys the GPO to the production environment or rejects the GPO.

    Approve or Reject a Pending Action

    - - - -### Additional references - -[Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md deleted file mode 100644 index 7df4177133..0000000000 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Checklist Create, Edit, and Deploy a GPO -description: Checklist Create, Edit, and Deploy a GPO -author: dansimp -ms.assetid: 44631bed-16d2-4b5a-af70-17a73fb5f6af -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Create, Edit, and Deploy a GPO - - -In an environment where multiple people change Group Policy Objects (GPOs) by using Advanced Group Policy Management (AGPM), an AGPM Administrator (Full Control) delegates permission to Editors, Approvers, and Reviewers either as groups or as individuals. The following is a typical GPO development process for an Editor and an Approver. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReference

    Editor requests that a new GPO be created or an Approver creates a new GPO.

    Request the Creation of a New Controlled GPO

    -

    Create a New Controlled GPO

    Approver approves the creation of the GPO if it was requested by an Editor.

    Approve or Reject a Pending Action

    Editor checks out a copy of the GPO from the archive so that no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.

    Edit a GPO Offline

    If developing in a test forest, Editor exports the GPO to a file, transfers the file to the production forest, and imports the file. Additionally, an Editor can link the GPO to an organizational unit that contains test computers and users.

    Using a Test Environment

    Editor requests deployment of the GPO to the production environment of the domain.

    Request Deployment of a GPO

    Reviewers, such as Approvers or Editors, analyze the GPO.

    Performing Reviewer Tasks

    Approver approves and deploys the GPO to the production environment of the domain or rejects the GPO.

    Approve or Reject a Pending Action

    - - - -### Additional references - -[Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - - - - - - - - - diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md deleted file mode 100644 index a6b860cc5d..0000000000 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Checklist Create, Edit, and Deploy a GPO -description: Checklist Create, Edit, and Deploy a GPO -author: dansimp -ms.assetid: 614e2d9a-c18b-4f62-99fd-e17a2ac8559d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist: Create, Edit, and Deploy a GPO - - -In an environment where multiple people make changes to Group Policy objects (GPOs), an AGPM Administrator (Full Control) delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. The following is a typical GPO development process for an Editor and an Approver. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReference

    Editor requests the creation of a new GPO or an Approver creates a new GPO.

    Request the Creation of a New Controlled GPO

    -

    Create a New Controlled GPO

    Approver approves the creation of the GPO if it was requested by an Editor.

    Approve or Reject a Pending Action

    Editor checks out a copy of the GPO from the archive, so no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.

    Edit a GPO Offline

    Editor requests deployment of the GPO to the production environment.

    Request Deployment of a GPO

    Reviewers, such as Approvers or Editors, analyze the GPO.

    Performing Reviewer Tasks

    Approver approves and deploys the GPO to the production environment or rejects the GPO.

    Approve or Reject a Pending Action

    - - - - - - - - - - - diff --git a/mdop/agpm/choosing-which-version-of-agpm-to-install.md b/mdop/agpm/choosing-which-version-of-agpm-to-install.md deleted file mode 100644 index 792101fd83..0000000000 --- a/mdop/agpm/choosing-which-version-of-agpm-to-install.md +++ /dev/null @@ -1,309 +0,0 @@ ---- -title: Choosing Which Version of AGPM to Install -description: Choosing Which Version of AGPM to Install -author: dansimp -ms.assetid: 31357d2a-bc23-4e15-93f4-0beda8ab7a7b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/05/2017 ---- - - -# Choosing Which Version of AGPM to Install - - -Each release of Microsoft Advanced Group Policy Management (AGPM) supports specific versions of the Windows operating system. We strongly recommend that you run the AGPM Client and AGPM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. - -We recommend that you install the AGPM Server on the most recent version of the operating system in the domain. AGPM uses the Group Policy Management Console (GPMC) to back up and restore Group Policy Objects (GPOs). Because newer versions of the GPMC provide additional policy settings that are not available in earlier versions, you can manage more policy settings by using the most recent version of the operating system. - -All versions of AGPM can manage only the policy settings that were introduced in the same version or an earlier version of the operating system on which AGPM is running. For example, if you install AGPM 4.0 SP2 on Windows Server 2012, you can manage policy settings that were introduced in Windows Server 2012 or earlier, but you cannot manage policy settings that were introduced later, in Windows 8.1 or Windows Server 2012 R2. - -If the version of the GPMC on your AGPM Server is older than the version on the computers that administrators use to manage Group Policy, the AGPM Server will be unable to store any policy settings that are not available in the older version of the GPMC. For a spreadsheet of Group Policy settings included in Windows, see [Group Policy Settings Reference for Windows and Windows Server](https://go.microsoft.com/fwlink/p/?LinkId=613627). - -## AGPM 4.0 SP3 - - -If you are using computers that are running Windows 10 to manage GPOs, you must use AGPM 4.0 SP3. You cannot install earlier versions of AGPM on computers that are running the Windows 10 operating system. - -Table 1 lists the operating systems on which you can install AGPM 4.0 SP3, and the policy settings that you can manage by using AGPM 4.0 SP3. - -**Table 1: AGPM  4.0 SP3 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

    Windows Server 2016 or Windows 10

    Windows Server 2016 or Windows 10

    Supported

    Windows Server 2012 R2

    Windows 10

    Supported with the caveats outlined in KB 4015786 -

    Windows Server 2012 R2 or Windows 8.1

    Windows Server 2012 R2 or Windows 8.1

    Supported

    Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

    Windows Server 2012 or Windows 8.1

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

    Windows Server 2012, Windows Server 2008 R2, or Windows 7

    Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

    Not supported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

    - - - -## AGPM 4.0 SP2 - - -If you are using computers that are running Windows Server 2012 R2 or Windows 8.1 to manage GPOs, you must use AGPM 4.0 SP2. You cannot install earlier versions of AGPM on computers that are running those operating systems. - -Table 1 lists the operating systems on which you can install AGPM 4.0 SP2, and the policy settings that you can manage by using AGPM 4.0 SP2. - -**Table 2: AGPM 4.0 SP2 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

    Windows Server 2012 R2 or Windows 8.1

    Windows Server 2012 R2 or Windows 8.1

    Supported

    Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

    Windows Server 2012 or Windows 8.1

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

    Windows Server 2012, Windows Server 2008 R2, or Windows 7

    Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2012, Windows Server 2008 R2, or Windows 7

    Not supported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

    - - - -## AGPM 4.0 SP1 - - -Table 2 lists the operating systems on which you can install AGPM 4.0 SP1, and the policy settings that you can manage by using AGPM 4.0 SP1. - -**Table 3: AGPM 4.0 SP1 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

    Windows Server 2012

    Windows Server 2012

    Supported

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

    Windows Server 2012, Windows Server 2008 R2, or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2, or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2012, Windows Server 2008 R2, or Windows 7

    Supported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2, or Windows 7

    - - - -## AGPM 4.0 - - -Table 3 lists the operating systems on which you can install AGPM 4.0, and the policy settings that you can manage by using AGPM 4.0. - -**Table 4: AGPM 4.0 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported operating systems for the AGPM ServerSupported operating systems for the AGPM ClientAGPM Support

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 R2 or Windows 7

    Not supported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

    - - - -## Versions of AGPM that precede AGPM 4.0 - - -Table 4 lists the operating systems on which you can install the versions of AGPM that precede AGPM 4.0. If an operating system is not listed, you cannot install AGPM on that operating system. - -**Table 5: Supported operating systems for versions of AGPM that precede AGPM 4.0** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemVersion of AGPM that can be installed

    Windows Server 2008

    3.0

    Windows Vista with SP1

    3.0

    Windows Vista with no service pack installed (32-bit)

    2.5

    Windows Server 2003 (32-bit)

    2.5

    - - - -## How to Get MDOP Technologies - - -AGPM 4.0 SP2 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Advanced Group Policy Management](index.md) - - - - - - - - - diff --git a/mdop/agpm/common-secondary-tab-features.md b/mdop/agpm/common-secondary-tab-features.md deleted file mode 100644 index b54804d0eb..0000000000 --- a/mdop/agpm/common-secondary-tab-features.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: Common Secondary Tab Features -description: Common Secondary Tab Features -author: dansimp -ms.assetid: 44a15c28-944c-49c1-8534-115ce1c362ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Common Secondary Tab Features - - -Each secondary tab has two sections—**Group Policy objects** and **Groups and Users**. - -## Group Policy objects section - - -The **Group Policy objects** section displays a filtered list of Group Policy objects (GPOs) and identifies the following characteristics for each GPO: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    GPO CharacteristicDescription

    Name

    Name of the Group Policy object.

    Computer (Comp.)

    Automatically generated version of the Computer Configuration portion of the GPO.

    User

    Automatically generated version of the User Configuration portion of the GPO.

    State

    The state of the selected GPO:

    -

    Deployed GPO icon Uncontrolled: Not managed by AGPM.

    -

    Checked in GPO icon Checked In: Available for authorized Editors to check out for editing or for a Group Policy administrator to deploy.

    -

    Checked out GPO icon Checked Out: Currently being edited. Unavailable for other Editors to check out until the Editor who checked it out or an AGPM Administrator checks it in.

    -

    Pending GPO icon Pending: Awaiting approval from a Group Policy administrator before being created, controlled, deployed, or deleted.

    -

    Checked in GPO icon Deleted: Deleted from the archive, but still able to be restored.

    -

    Template icon Template: A static version of a GPO for use as a starting point when creating new GPOs.

    -

    Default template icon Template (default): By default, this template is the starting point used when creating a new GPO.

    GPO Status

    The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled.

    WMI Filter

    Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters node for the domain in the console tree of the GPMC.

    Modified

    For a controlled GPO, the most recent date when it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified.

    Owner

    The Editor who checked in or the Approver who deployed the selected GPO.

    - -  - -## Groups and Users section - - -When a GPO is selected, the **Groups and Users** section displays a list of the groups and users with access to that GPO. The allowed permissions and inheritance are displayed for each group or user. An AGPM Administrator can configure permissions using either standard AGPM roles (Editor, Approver, and Reviewer) or a customized combination of permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ButtonEffect

    Add

    Add a new entry to the security descriptor. Any user or group in Active Directory can be added.

    Remove

    Remove the selected entry from the Access Control List.

    Properties

    Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers.

    Advanced

    Open the Access Control List Editor.

    - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md), [Performing Editor Tasks](performing-editor-tasks.md), [Performing Approver Tasks](performing-approver-tasks.md), and [Performing Reviewer Tasks](performing-reviewer-tasks.md). - -### Additional references - -- [Contents Tab](contents-tab.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-agpm-server-connections-agpm30ops.md b/mdop/agpm/configure-agpm-server-connections-agpm30ops.md deleted file mode 100644 index 01c078c958..0000000000 --- a/mdop/agpm/configure-agpm-server-connections-agpm30ops.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configure AGPM Server Connections -description: Configure AGPM Server Connections -author: dansimp -ms.assetid: 6062b77b-2fd7-442c-ad1b-6f14419ebd5f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure AGPM Server Connections - - -All versions of each controlled Group Policy Object (GPO) are stored in a central archive so that Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO used in these procedures, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete these procedures for centrally configuring archive locations for all Group Policy administrators. Review the details in "Additional considerations" in this topic. - -## Configuring AGPM Server connections - - -As an AGPM Administrator, you can ensure that all Group Policy administrators connect to the same AGPM Server by centrally configuring the associated setting. If your environment requires separate AGPM Servers for some or all domains, configure those additional AGPM Servers as exceptions to the default. If you do not centrally configure AGPM Server connections, each Group Policy administrator must manually configure the AGPM Server to be displayed for each domain. - -- [Configure an AGPM Server connection for all Group Policy administrators](#bkmk-defaultarchiveloc) - -- [Configure additional AGPM Server connections for all Group Policy administrators](#bkmk-additionalarchiveloc) - -- [Manually configure an AGPM Server connection for your account](#bkmk-manuallyconfigurearchiveloc) - -###
    - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo-agpm30ops.md).) - -2. In the **Group Policy Management Editor** window, click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -3. In the details pane, double-click **AGPM: Specify default AGPM Server (all domains)**. - -4. In the **Properties** window, select the **Enabled** check box, and type the fully-qualified computer name and port (for example, server.contoso.com:4600). - -5. Click **OK**. Unless you want to configure additional AGPM Server connections, close the **Group Policy Management Editor** window and deploy the GPO. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md).) When Group Policy is updated, the AGPM Server connection is configured for all Group Policy administrators. - -### - -**To configure additional AGPM Server connections for all Group Policy administrators** - -1. If no AGPM Server connection has been configured, follow the preceding procedure to configure a default AGPM Server for all domains. - -2. To configure separate AGPM Servers for some or all domains (overriding the default AGPM Server), in the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo-agpm30ops.md).) - -3. In the **Group Policy Management Editor** window, click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and then **AGPM**. - -4. In the details pane, double-click **AGPM: Specify AGPM Servers**. - -5. In the **Properties** window, select the **Enabled** check box, and click **Show**. - -6. In the **Show Contents** window: - - 1. Click **Add**. - - 2. For **Value Name**, type the domain name (for example, server1.contoso.com). - - 3. For **Value**, type the AGPM Server name and port to use for this domain (for example, server2.contoso.com:4600), and then click **OK**. (By default, the AGPM Service listens on port 4600. To use a different port, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md).) - - 4. Repeat for each domain not using the default AGPM Server. - -7. Click **OK** to close the **Show Contents** and **Properties** windows. - -8. Close the **Group Policy Management Editor** window. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md).) When Group Policy is updated, the new AGPM Server connections are configured for all Group Policy administrators. - -### - -If you have centrally configured the AGPM Server connection, the option to manually configure it is unavailable for all Group Policy administrators. - -**To manually configure which AGPM Server to display for your account** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Enter the fully-qualified computer name for the AGPM Server that manages the archive used for this domain (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). - -4. Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- You must be able to edit and deploy a GPO to perform the procedures for centrally configuring AGPM Server connections for all Group Policy administrators. See [Editing a GPO](editing-a-gpo-agpm30ops.md) and [Deploy a GPO](deploy-a-gpo-agpm30ops.md) for additional detail. - -- The selected AGPM Server determines which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-agpm-server-connections-agpm40.md b/mdop/agpm/configure-agpm-server-connections-agpm40.md deleted file mode 100644 index c41c27ec1a..0000000000 --- a/mdop/agpm/configure-agpm-server-connections-agpm40.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Configure AGPM Server Connections -description: Configure AGPM Server Connections -author: dansimp -ms.assetid: bbbb15e8-35e7-403c-b695-7a6ebeb87839 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure AGPM Server Connections - - -All versions of each controlled Group Policy Object (GPO) are stored in a central archive so that Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO used in these procedures, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete these procedures for centrally configuring archive locations for all Group Policy administrators. Review the details in "Additional considerations" in this topic. - -## Configuring AGPM Server connections - - -As an AGPM Administrator, you can ensure that all Group Policy administrators connect to the same AGPM Server by centrally configuring the associated setting. If your environment requires separate AGPM Servers for some or all domains, configure those additional AGPM Servers as exceptions to the default. If you do not centrally configure AGPM Server connections, each Group Policy administrator must manually configure the AGPM Server to be displayed for each domain. - -- [Configure an AGPM Server connection for all Group Policy administrators](#bkmk-defaultarchiveloc) - -- [Configure additional AGPM Server connections for all Group Policy administrators](#bkmk-additionalarchiveloc) - -- [Manually configure an AGPM Server connection for your account](#bkmk-manuallyconfigurearchiveloc) - -### - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo-agpm40.md).) - -2. In the **Group Policy Management Editor** window, click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -3. In the details pane, double-click **AGPM: Specify default AGPM Server (all domains)**. - -4. In the **Properties** window, select the **Enabled** check box, and type the fully-qualified computer name and port (for example, server.contoso.com:4600). - -5. Click **OK**. Unless you want to configure additional AGPM Server connections, close the **Group Policy Management Editor** window and deploy the GPO. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm40.md).) When Group Policy is updated, the AGPM Server connection is configured for all Group Policy administrators. - -### - -**To configure additional AGPM Server connections for all Group Policy administrators** - -1. If no AGPM Server connection has been configured, follow the preceding procedure to configure a default AGPM Server for all domains. - -2. To configure separate AGPM Servers for some or all domains (overriding the default AGPM Server), in the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo-agpm40.md).) - -3. In the **Group Policy Management Editor** window, click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and then **AGPM**. - -4. In the details pane, double-click **AGPM: Specify AGPM Servers**. - -5. In the **Properties** window, select the **Enabled** check box, and click **Show**. - -6. In the **Show Contents** window: - - 1. Click **Add**. - - 2. For **Value Name**, type the domain name (for example, server1.contoso.com). - - 3. For **Value**, type the AGPM Server name and port to use for this domain (for example, server2.contoso.com:4600), and then click **OK**. (By default, the AGPM Service listens on port 4600. To use a different port, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md).) - - 4. Repeat for each domain not using the default AGPM Server. - -7. Click **OK** to close the **Show Contents** and **Properties** windows. - -8. Close the **Group Policy Management Editor** window. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm40.md).) When Group Policy is updated, the new AGPM Server connections are configured for all Group Policy administrators. - -### - -If you have centrally configured the AGPM Server connection, the option to manually configure it is unavailable for all Group Policy administrators. - -**To manually configure which AGPM Server to display for your account** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Enter the fully-qualified computer name for the AGPM Server that manages the archive used for this domain (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). - -4. Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- You must be able to edit and deploy a GPO to perform the procedures for centrally configuring AGPM Server connections for all Group Policy administrators. See [Editing a GPO](editing-a-gpo-agpm40.md) and [Deploy a GPO](deploy-a-gpo-agpm40.md) for additional detail. - -- The selected AGPM Server determines which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-an-agpm-server-connection-agpm40.md b/mdop/agpm/configure-an-agpm-server-connection-agpm40.md deleted file mode 100644 index 3fec7b9300..0000000000 --- a/mdop/agpm/configure-an-agpm-server-connection-agpm40.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Configure an AGPM Server Connection -description: Configure an AGPM Server Connection -author: dansimp -ms.assetid: 409cbbcf-3b0e-459d-9bd2-75cb7b9430b0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure an AGPM Server Connection - - -To ensure that you are connected to the correct central archive, review the configuration of the AGPM Server connection. If an AGPM Administrator (Full Control) has not configured an AGPM Server connection for you, then you must manually configure it. - -**To select an AGPM Server** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab: - - - If the options on the **AGPM Server** tab are unavailable, they have been centrally configured by an AGPM Administrator. - - - If the options on the **AGPM Server** tab are available, type the fully-qualified computer name for the AGPM Server (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- The AGPM Servers selected determine which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md b/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md deleted file mode 100644 index 196bbbed79..0000000000 --- a/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configure an AGPM Server Connection -description: Configure an AGPM Server Connection -author: dansimp -ms.assetid: ae78dc74-111d-4509-b0a6-e8b8b451c22a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure an AGPM Server Connection - - -To ensure that you are connected to the correct central archive, review the configuration of the AGPM Server connection. If an AGPM Administrator (Full Control) has not configured an AGPM Server connection for you, then you must manually configure it. - -**To select an AGPM Server** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab: - - - If the options on the **AGPM Server** tab are unavailable, they have been centrally configured by an AGPM Administrator. - - - If the options on the **AGPM Server** tab are available, type the fully-qualified computer name for the AGPM Server (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- The AGPM Servers selected determine which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-e-mail-notification-agpm30ops.md b/mdop/agpm/configure-e-mail-notification-agpm30ops.md deleted file mode 100644 index 7a4f5887a8..0000000000 --- a/mdop/agpm/configure-e-mail-notification-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Configure E-Mail Notification -description: Configure E-Mail Notification -author: dansimp -ms.assetid: b32ce395-d1b9-4c5b-b765-97cdbf455f9e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Notification - - -When an Editor or a Reviewer attempts to create, deploy, or delete a Group Policy Object (GPO), a request for this action is sent to a designated e-mail address or addresses so that an Approver can evaluate the request and implement or deny it. You determine the e-mail address or addresses to which notifications are sent, as well as the alias from which notifications are sent. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To configure e-mail notification for AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To e-mail address** field, type a comma-delimited list of e-mail addresses of Approvers who should receive requests for approval. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. - -7. Click **Apply**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- E-mail notification for AGPM is a domain-level setting. You can provide different Approver e-mail addresses or AGPM e-mail aliases on each domain's **Domain Delegation** tab, or use the same e-mail addresses throughout your environment. - -- By default, e-mail messages sent as a result of actions in Advanced Group Policy Management (AGPM) are not encrypted. However, you can configure e-mail security for AGPM using registry settings to specify whether to use Secure Sockets Layer (SSL) encryption and which SMTP port to use. For more information, see [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm30ops.md) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-e-mail-notification-agpm40.md b/mdop/agpm/configure-e-mail-notification-agpm40.md deleted file mode 100644 index 19f24e340c..0000000000 --- a/mdop/agpm/configure-e-mail-notification-agpm40.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Configure E-Mail Notification -description: Configure E-Mail Notification -author: dansimp -ms.assetid: 06f19556-f296-4a80-86a4-4f446c992204 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Notification - - -When an Editor or a Reviewer attempts to create, deploy, or delete a Group Policy Object (GPO), a request for this action is sent to a designated e-mail address or addresses so that an Approver can evaluate the request and implement or deny it. You determine the e-mail address or addresses to which notifications are sent, as well as the alias from which notifications are sent. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To configure e-mail notification for AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To e-mail address** field, type a comma-delimited list of e-mail addresses of Approvers who should receive requests for approval. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. - -7. Click **Apply**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- E-mail notification for AGPM is a domain-level setting. You can provide different Approver e-mail addresses or AGPM e-mail aliases on each domain's **Domain Delegation** tab, or use the same e-mail addresses throughout your environment. - -- By default, e-mail messages sent as a result of actions in Advanced Group Policy Management (AGPM) are not encrypted. However, you can configure e-mail security for AGPM using registry settings to specify whether to use Secure Sockets Layer (SSL) encryption and which SMTP port to use. For more information, see [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm40.md). - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-e-mail-notification.md b/mdop/agpm/configure-e-mail-notification.md deleted file mode 100644 index 7bda0b1a9c..0000000000 --- a/mdop/agpm/configure-e-mail-notification.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Configure E-Mail Notification -description: Configure E-Mail Notification -author: dansimp -ms.assetid: 6e152de0-4376-4963-8d1a-3e7f5866d30f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Notification - - -When an Editor or a Reviewer attempts to create, deploy, or delete a Group Policy object (GPO), a request for this action is sent to a designated e-mail address or addresses so that an Approver can evaluate the request and implement or deny it. You determine the e-mail address or addresses to which notifications are sent, as well as the alias from which notifications are sent. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To configure e-mail notification for AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To** field, type a comma-delimited list of e-mail addresses of Approvers who should receive requests for approval. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. - -7. Click **Apply**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- E-mail notification for AGPM is a domain-level setting. You can provide different Approver e-mail addresses or AGPM e-mail aliases on each domain's **Domain Delegation** tab, or use the same e-mail addresses throughout your environment. - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md b/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md deleted file mode 100644 index ed184df8d5..0000000000 --- a/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Configure E-Mail Security for AGPM -description: Configure E-Mail Security for AGPM -author: dansimp -ms.assetid: 4850ed8e-a1c6-43f0-95c5-853aa66a94ae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Security for AGPM - - -By default, e-mail notifications sent because of actions in Advanced Group Policy Management (AGPM) are not encrypted and are sent through SMTP port 25. However, you can configure e-mail security for AGPM by using registry settings to specify whether to use Secure Sockets Layer (SSL) encryption and which SMTP port to use. - -By encrypting AGPM e-mail notifications, you can better protect those that could reveal sensitive information about your organization’s security. Encrypting e-mail notifications is recommended when they are being relayed through remote mail servers, and may be required by some compliance regulations. - -**Caution**   -Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. - - - -A user account that has the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account that has the necessary permissions in AGPM is required to complete these procedures. Review the details in "Additional considerations" in this topic. - -**To configure e-mail security for AGPM by using Group Policy preferences** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all AGPM Servers for which you want to configure e-mail security. (For more information, see [Editing a GPO](editing-a-gpo-agpm30ops.md).) - -2. In the **Group Policy Management Editor** window, expand the **Computer Configuration**, **Preferences**, **Windows Settings**, and **Registry** folders. - -3. In the console tree, right-click **Registry**, point to **New**, click **Collection Item**, and type **AGPM e-mail security**. - -4. Create a Registry preference item to turn on encryption: - - 1. In the console tree, right-click **AGPM e-mail security**, point to **New**, and then click **Registry Item**. - - 2. In the **New Registry Properties** dialog box, select the **Update** action. - - 3. For **Hive**, select **HKEY\_LOCAL\_MACHINE**. - - 4. For **Key Path**, type **SOFTWARE\\Microsoft\\AGPM**. - - 5. For **Value name**, type **EncryptSmtp**. - - 6. For **Value type**, select **REG\_DWORD**. - - 7. For **Base**, select **Decimal**, and for **Value data**, type **1** to use SSL encryption, or **0** to let e-mail to be sent without encryption. By default, e-mail is sent without encryption. - - 8. Click **OK**. - -5. Create a Registry preference item to specify the SMTP port: - - 1. In the console tree, right-click **AGPM E-mail security**, point to **New**, and then click **Registry Item**. - - 2. In the **New Registry Properties** dialog box, select the **Update** action. - - 3. For **Hive**, select **HKEY\_LOCAL\_MACHINE**. - - 4. For **Key Path** dialog box, type **SOFTWARE\\Microsoft\\AGPM**. - - 5. For **Value name**, type **SmtpPort**. - - 6. For **Value type**, select **REG\_DWORD**. - - 7. For **Base**, select **Decimal**, and for **Value data**, type a port number for the SMTP port. By default, the SMTP port is port 25 if encryption is not enabled or port 587 if SSL encryption is enabled. - - 8. Click **OK**. - -6. Close the **Group Policy Management Editor** window, and then check in and deploy the GPO. For more information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md). - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure registry settings by using Group Policy Preferences. See [Editing a GPO](editing-a-gpo-agpm30ops.md) and [Deploy a GPO](deploy-a-gpo-agpm30ops.md) for additional detail. - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - - - - - - - - - diff --git a/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md b/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md deleted file mode 100644 index 6b62a3bc2a..0000000000 --- a/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Configure E-Mail Security for AGPM -description: Configure E-Mail Security for AGPM -author: dansimp -ms.assetid: b9c48894-0a10-4d03-8027-50ed3b02485a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure E-Mail Security for AGPM - - -By default, e-mail notifications sent because of actions in Advanced Group Policy Management (AGPM) are not encrypted and are sent through SMTP port 25. However, you can configure e-mail security for AGPM by using registry settings to specify whether to use Secure Sockets Layer (SSL) encryption and which SMTP port to use. - -By encrypting AGPM e-mail notifications, you can better protect those that could reveal sensitive information about your organization’s security. Encrypting e-mail notifications is recommended when they are being relayed through remote mail servers, and may be required by some compliance regulations. - -**Caution**   -Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. - - - -A user account that has the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account that has the necessary permissions in AGPM is required to complete these procedures. Review the details in "Additional considerations" in this topic. - -**To configure e-mail security for AGPM by using Group Policy preferences** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all AGPM Servers for which you want to configure e-mail security. (For more information, see [Editing a GPO](editing-a-gpo-agpm40.md).) - -2. In the **Group Policy Management Editor** window, expand the **Computer Configuration**, **Preferences**, **Windows Settings**, and **Registry** folders. - -3. In the console tree, right-click **Registry**, point to **New**, click **Collection Item**, and type **AGPM e-mail security**. - -4. Create a Registry preference item to turn on encryption: - - 1. In the console tree, right-click **AGPM e-mail security**, point to **New**, and then click **Registry Item**. - - 2. In the **New Registry Properties** dialog box, select the **Update** action. - - 3. For **Hive**, select **HKEY\_LOCAL\_MACHINE**. - - 4. For **Key Path**, type **SOFTWARE\\Microsoft\\AGPM**. - - 5. For **Value name**, type **EncryptSmtp**. - - 6. For **Value type**, select **REG\_DWORD**. - - 7. For **Base**, select **Decimal**, and for **Value data**, type **1** to use SSL encryption, or **0** to let e-mail to be sent without encryption. By default, e-mail is sent without encryption. Click **OK**. - -5. Create a Registry preference item to specify the SMTP port: - - 1. In the console tree, right-click **AGPM E-mail security**, point to **New**, and then click **Registry Item**. - - 2. In the **New Registry Properties** dialog box, select the **Update** action. - - 3. For **Hive**, select **HKEY\_LOCAL\_MACHINE**. - - 4. For **Key Path** dialog box, type **SOFTWARE\\Microsoft\\AGPM**. - - 5. For **Value name**, type **SmtpPort**. - - 6. For **Value type**, select **REG\_DWORD**. - - 7. For **Base**, select **Decimal**, and for **Value data**, type a port number for the SMTP port. By default, the SMTP port is port 25 if encryption is not enabled or port 587 if SSL encryption is enabled. Click **OK**. - -6. Close the **Group Policy Management Editor** window, and then check in and deploy the GPO. For more information, see [Deploy a GPO](deploy-a-gpo-agpm40.md). - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure registry settings by using Group Policy Preferences. See [Editing a GPO](editing-a-gpo-agpm40.md) and [Deploy a GPO](deploy-a-gpo-agpm40.md) for additional detail. - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/configure-logging-and-tracing-agpm30ops.md b/mdop/agpm/configure-logging-and-tracing-agpm30ops.md deleted file mode 100644 index dd666e4815..0000000000 --- a/mdop/agpm/configure-logging-and-tracing-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Configure Logging and Tracing -description: Configure Logging and Tracing -author: dansimp -ms.assetid: 4f89552f-e949-48b0-9325-23746034eaa4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Logging and Tracing - - -You can centrally configure optional logging and tracing using Administrative templates. This may be helpful when diagnosing any problems related to Advanced Group Policy Management (AGPM). - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account with the necessary permissions in AGPM is required to complete these procedures. Additionally, a user account with access to the AGPM Server is required to initiate logging on the AGPM Server. Review the details in "Additional considerations" in this topic. - -**To configure logging and tracing for AGPM** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators for which you want to turn on logging and tracing. (For more information, see [Editing a GPO](editing-a-gpo-agpm30ops.md).) - -2. In the **Group Policy Management Editor** window, click **Computer Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -3. In the details pane, double-click **AGPM: Configure logging**. - -4. In the **Properties** window, click **Enabled**, and configure the level of detail to record in the logs. - -5. Click **OK**. - -6. Close the **Group Policy Management Editor** window. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md).) After Group Policy is updated, you must restart the AGPM Service to start, modify, or stop logging on the AGPM Server. Group Policy administrators must close and restart the GPMC to start, modify, or stop logging on their computers. - - **Trace file locations**: - - - Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - - - Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure AGPM logging and tracing. See [Editing a GPO](editing-a-gpo-agpm30ops.md) and [Deploy a GPO](deploy-a-gpo-agpm30ops.md) for additional detail. - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-logging-and-tracing-agpm40.md b/mdop/agpm/configure-logging-and-tracing-agpm40.md deleted file mode 100644 index c1e150c7bd..0000000000 --- a/mdop/agpm/configure-logging-and-tracing-agpm40.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Configure Logging and Tracing -description: Configure Logging and Tracing -author: dansimp -ms.assetid: 2418cb6a-7189-4080-8fe2-9c8d47dec62c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Logging and Tracing - - -You can centrally configure optional logging and tracing using Administrative templates. This may be helpful when diagnosing any problems related to Advanced Group Policy Management (AGPM). - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account with the necessary permissions in AGPM is required to complete these procedures. Additionally, a user account with access to the AGPM Server is required to initiate logging on the AGPM Server. Review the details in "Additional considerations" in this topic. - -**To configure logging and tracing for AGPM** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators for which you want to turn on logging and tracing. (For more information, see [Editing a GPO](editing-a-gpo-agpm40.md).) - -2. In the **Group Policy Management Editor** window, click **Computer Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -3. In the details pane, double-click **AGPM: Configure logging**. - -4. In the **Properties** window, click **Enabled**, and configure the level of detail to record in the logs. - -5. Click **OK**. - -6. Close the **Group Policy Management Editor** window. (For more information, see [Deploy a GPO](deploy-a-gpo-agpm40.md).) After Group Policy is updated, you must restart the AGPM Service to start, modify, or stop logging on the AGPM Server. Group Policy administrators must close and restart the GPMC to start, modify, or stop logging on their computers. - - **Trace file locations**: - - - Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - - - Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure AGPM logging and tracing. See [Editing a GPO](editing-a-gpo-agpm40.md) and [Deploy a GPO](deploy-a-gpo-agpm40.md) for additional detail. - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-logging-and-tracing.md b/mdop/agpm/configure-logging-and-tracing.md deleted file mode 100644 index 8f9b6b9e07..0000000000 --- a/mdop/agpm/configure-logging-and-tracing.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Configure Logging and Tracing -description: Configure Logging and Tracing -author: dansimp -ms.assetid: 419231f9-e9db-4f91-a7cf-a0a73db25256 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Logging and Tracing - - -You can centrally configure optional logging and tracing for Advanced Group Policy Management (AGPM) using Administrative templates. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO used in these procedures, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete these procedures. Additionally, a user account with access to the AGPM Server is required to initiate logging on the AGPM Server. Review the details in "Additional considerations" in this topic. - -**To configure logging and tracing for AGPM** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators for which you want to turn on logging and tracing. (For more information, see [Editing a GPO](editing-a-gpo.md).) - -2. In the **Group Policy Object Editor**, click **Computer Configuration**, **Administrative Templates**, and **Windows Components**. - -3. If **AGPM** is not listed under **Windows Components**: - - 1. Right-click **Administrative Templates** and click **Add/Remove Templates**. - - 2. Click **Add**, select **agpm.admx** or **agpm.adm**, click **Open**, and then click **Close**. - -4. Under **Windows Components**, double-click **AGPM**. - -5. In the details pane, double-click **AGPM Logging**. - -6. In the **AGPM Logging Properties** window, click **Enabled**, and configure the level of detail to record in the logs. - -7. Click **OK**. - -8. Close the **Group Policy Object Editor**. (For more information, see [Deploy a GPO](deploy-a-gpo.md).) After Group Policy is updated, you must restart the AGPM Service to begin logging on the AGPM Server. Group Policy administrators must close and restart the GPMC to begin logging on their computers. - - **Trace file locations**: - - - Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - - - Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - -### Additional considerations - -- You must be able to edit and deploy a GPO to configure AGPM logging and tracing. See [Editing a GPO](editing-a-gpo.md) and [Deploy a GPO](deploy-a-gpo.md) for additional detail. - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-the-agpm-server-connection-reviewer.md b/mdop/agpm/configure-the-agpm-server-connection-reviewer.md deleted file mode 100644 index ba9b7f9381..0000000000 --- a/mdop/agpm/configure-the-agpm-server-connection-reviewer.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configure the AGPM Server Connection -description: Configure the AGPM Server Connection -author: dansimp -ms.assetid: 74e8f348-a8ed-4d69-a8e0-9c974aaeca2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure the AGPM Server Connection - - -To ensure that you are connected to the correct central archive, review the configuration of the AGPM Server connection. If an AGPM Administrator (Full Control) has not configured the AGPM Server connection for you, then you must manually configure it. - -**To select an AGPM Server** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab: - - - If the options on the **AGPM Server** tab are unavailable, they have been centrally configured by an AGPM Administrator. - - - If the options on the **AGPM Server** tab are available, type the fully-qualified computer name for the AGPM Server (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- The AGPM Servers selected determine which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/configure-the-agpm-server-connection.md b/mdop/agpm/configure-the-agpm-server-connection.md deleted file mode 100644 index a6322bd687..0000000000 --- a/mdop/agpm/configure-the-agpm-server-connection.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Configure the AGPM Server Connection -description: Configure the AGPM Server Connection -author: dansimp -ms.assetid: 9a42b5bc-41be-44ef-a6e2-6f56e2cf1996 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure the AGPM Server Connection - - -Advanced Group Policy Management (AGPM) stores all versions of each controlled Group Policy object (GPO) in a central archive, so Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO used in these procedures, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete these procedures for centrally configuring archive locations for all Group Policy administrators. Review the details in "Additional considerations" in this topic. - -## Configuring the AGPM Server connection - - -As an AGPM Administrator (Full Control), you can ensure that all Group Policy administrators connect to the same AGPM Server by centrally configuring the setting. If your environment requires separate AGPM Servers for some or all domains, configure those additional AGPM Servers as exceptions to the default. If you do not centrally configure AGPM Server connections, each Group Policy administrator must manually configure the AGPM Server to be displayed for each domain. - -- [Configure an AGPM Server for all Group Policy administrators](#bkmk-defaultarchiveloc) - -- [Configure additional AGPM Servers for all Group Policy administrators](#bkmk-additionalarchiveloc) - -- [Manually configure an AGPM Server for your account](#bkmk-manuallyconfigurearchiveloc) - -### - -**To configure an AGPM Server for all Group Policy administrators** - -1. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo.md).) - -2. In the **Group Policy Object Editor**, click **User Configuration**, **Administrative Templates**, and **Windows Components**. - -3. If **AGPM** is not listed under **Windows Components**: - - 1. Right-click **Administrative Templates** and click **Add/Remove Templates**. - - 2. Click **Add**, select **agpm.admx** or **agpm.adm**, click **Open**, and then click **Close**. - -4. Under **Windows Components**, double-click **AGPM**. - -5. In the details pane, double-click **AGPM Server (all domains)**. - -6. In the **AGPM Server (all domains) Properties** window, select the **Enabled** check box, and type the fully-qualified computer name and port (for example, server.contoso.com:4600). - -7. Click **OK**. Unless you want to configure additional AGPM Server connections, close the **Group Policy Object Editor** and deploy the GPO. (For more information, see [Deploy a GPO](deploy-a-gpo.md).) When Group Policy is updated, the AGPM Server connection is configured for all Group Policy administrators. - -### - -**To configure additional AGPM Servers for all Group Policy administrators** - -1. If no AGPM Server connection has been configured, follow the preceding procedure to configure a default AGPM Server for all domains. - -2. To configure separate AGPM Servers for some or all domains (overriding the default AGPM Server), in the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. (For more information, see [Editing a GPO](editing-a-gpo.md).) - -3. Under **User Configuration** in the **Group Policy Object Editor**, double-click **Administrative Templates**, **Windows Components**, and then **AGPM**. - -4. In the details pane, double-click **AGPM Server**. - -5. In the **AGPM Server Properties** window, select the **Enabled** check box, and click **Show**. - -6. In the **Show Contents** window: - - 1. Click **Add**. - - 2. For **Value Name**, type the domain name (for example, server1.contoso.com). - - 3. For **Value**, type the AGPM Server name and port to use for this domain (for example, server2.contoso.com:4600), and then click **OK**. (By default, the AGPM Service listens on port 4600. To use a different port, see [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md).) - - 4. Repeat for each domain not using the default AGPM Server. - -7. Click **OK** to close the **Show Contents** and **AGPM Server Properties** windows. - -8. Close the **Group Policy Object Editor**. (For more information, see [Deploy a GPO](deploy-a-gpo.md).) When Group Policy is updated, the new AGPM Server connections are configured for all Group Policy administrators. - -### - -If you have centrally configured the AGPM Server connection, the option to manually it is unavailable for all Group Policy administrators. - -**To manually configure the AGPM Server to display for your account** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Enter the fully-qualified computer name for the AGPM Server that manages the archive used for this domain (for example, server.contoso.com) and the port on which the AGPM Service listens (by default, port 4600). - -4. Click **Apply**, then click **Yes** to confirm. - -### Additional considerations - -- You must be able to edit and deploy a GPO to perform the procedures for centrally configuring AGPM Server connections for all Group Policy administrators. See [Editing a GPO](editing-a-gpo.md) and [Deploy a GPO](deploy-a-gpo.md) for additional detail. - -- The AGPM Server selected determines which GPOs are displayed on the **Contents** tab and to what location the **Domain Delegation** tab settings are applied. If not centrally managed through the Administrative Template, each Group Policy administrator must configure this setting to point to the AGPM Server for the domain. - -- Membership in the Group Policy Creator Owners group should be restricted so that it is not used to circumvent the management of access to GPOs by AGPM. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md b/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md deleted file mode 100644 index 837ee68502..0000000000 --- a/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Configuring Advanced Group Policy Management -description: Configuring Advanced Group Policy Management -author: dansimp -ms.assetid: 8c978ddf-2789-44e4-9c08-de7b4cd1afa0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Advanced Group Policy Management - - -In Advanced Group Policy Management (AGPM), as an AGPM Administrator (Full Control), you can centrally configure AGPM Server connections for Group Policy administrators, configure e-mail notification for AGPM, configure optional e-mail security for AGPM, delegate access to Group Policy Objects (GPOs) in the production environment of the domain, and configure logging and tracing for troubleshooting. - -- [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md) - -- [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md) - -- [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm40.md) - -- [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm40.md) - -- [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md) - -### Additional references - -- For information about delegating access to GPOs in the archive, see [Managing the Archive](managing-the-archive-agpm40.md). - -- For information about how to restrict the number of versions of each GPO stored in the archive, see [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm40.md). - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/configuring-advanced-group-policy-management.md b/mdop/agpm/configuring-advanced-group-policy-management.md deleted file mode 100644 index 2617957e16..0000000000 --- a/mdop/agpm/configuring-advanced-group-policy-management.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Configuring Advanced Group Policy Management -description: Configuring Advanced Group Policy Management -author: dansimp -ms.assetid: 836f4a49-2c77-4f6b-8727-9df7ef443141 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Advanced Group Policy Management - - -In Advanced Group Policy Management (AGPM), as an AGPM Administrator (Full Control), you can centrally configure AGPM Server connections for Group Policy administrators, configure e-mail notification for AGPM, configure optional e-mail security for AGPM, delegate access to Group Policy Objects (GPOs) in the production environment, and configure logging and tracing for troubleshooting. - -- [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md) - -- [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md) - -- [Configure E-Mail Security for AGPM](configure-e-mail-security-for-agpm-agpm30ops.md) - -- [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm30ops.md) - -- [Configure Logging and Tracing](configure-logging-and-tracing-agpm30ops.md) - -### Additional references - -- For information about delegating access to GPOs in the archive, see [Managing the Archive](managing-the-archive.md). - -- For information about how to restrict the number of versions of each GPO stored in the archive, see [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm30ops.md). - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab-agpm30ops.md b/mdop/agpm/contents-tab-agpm30ops.md deleted file mode 100644 index 4e3f28a7a2..0000000000 --- a/mdop/agpm/contents-tab-agpm30ops.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Contents Tab -description: Contents Tab -author: dansimp -ms.assetid: 6ada6430-cd93-47aa-af6e-d7f5b5620132 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab - - -The **Contents** tab on the **Change Control** pane provides access to Group Policy Objects (GPOs) and a shortcut menu for managing GPOs. The options displayed when right-clicking items are dependent on your role, your permissions, and your ownership stake in the GPO being managed. Additionally, these shortcut menus differ with the state of the GPO being managed. - -The following secondary tabs filter the list of GPOs displayed: - -- **Controlled**: GPOs managed by Advanced Group Policy Management (AGPM) - -- **Uncontrolled**: GPOs not managed by AGPM - -- **Pending**: GPO changes awaiting approval by an Approver - -- **Templates**: GPO templates for creating new GPOs and comparing to existing GPOs - -- **Recycle Bin**: Deleted GPOs - -The **Contents** tab and its secondary tabs provide details about each GPO and access to the history of each GPO: - -- [Contents Tab Features](contents-tab-features-agpm30ops.md) - -- [History Window](history-window-agpm30ops.md) - -When you right-click GPOs on any secondary tab, a shortcut menu unique to that tab is displayed, providing commands for managing the GPOs: - -- [Controlled GPO Commands](controlled-gpo-commands-agpm30ops.md) - -- [Uncontrolled GPO Commands](uncontrolled-gpo-commands-agpm30ops.md) - -- [Pending GPO Commands](pending-gpo-commands-agpm30ops.md) - -- [Template Commands](template-commands-agpm30ops.md) - -- [Recycle Bin Commands](recycle-bin-commands-agpm30ops.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab-agpm40.md b/mdop/agpm/contents-tab-agpm40.md deleted file mode 100644 index 695acca3e9..0000000000 --- a/mdop/agpm/contents-tab-agpm40.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Contents Tab -description: Contents Tab -author: dansimp -ms.assetid: cf9d1f17-3c3d-422f-bd6b-3db87be45554 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab - - -The **Contents** tab on the **Change Control** pane provides access to Group Policy Objects (GPOs) and a shortcut menu for managing GPOs. The options displayed when right-clicking items are dependent on your role, your permissions, and your ownership stake in the GPO being managed. Additionally, these shortcut menus differ with the state of the GPO being managed. - -The following secondary tabs filter the list of GPOs displayed: - -- **Controlled**: GPOs managed by Advanced Group Policy Management (AGPM) - -- **Uncontrolled**: GPOs not managed by AGPM - -- **Pending**: GPO changes awaiting approval by an Approver - -- **Templates**: GPO templates for creating new GPOs and comparing to existing GPOs - -- **Recycle Bin**: Deleted GPOs - -The **Contents** tab and its secondary tabs provide details about each GPO and access to the history of each GPO: - -- [Contents Tab Features](contents-tab-features-agpm40.md) - -- [History Window](history-window-agpm40.md) - -When you right-click GPOs on any secondary tab, a shortcut menu unique to that tab is displayed, providing commands for managing the GPOs: - -- [Controlled GPO Commands](controlled-gpo-commands-agpm40.md) - -- [Uncontrolled GPO Commands](uncontrolled-gpo-commands-agpm40.md) - -- [Pending GPO Commands](pending-gpo-commands-agpm40.md) - -- [Template Commands](template-commands-agpm40.md) - -- [Recycle Bin Commands](recycle-bin-commands-agpm40.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab-features-agpm30ops.md b/mdop/agpm/contents-tab-features-agpm30ops.md deleted file mode 100644 index b902fc0724..0000000000 --- a/mdop/agpm/contents-tab-features-agpm30ops.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Contents Tab Features -description: Contents Tab Features -author: dansimp -ms.assetid: 725f025a-c30a-4d07-add1-4e0ed9a1a5fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab Features - - -Each secondary tab within the **Contents** tab has two sections—**Group Policy objects** and **Groups and Users**. - -## Group Policy objects section - - -The **Group Policy objects** section displays a filtered list of Group Policy Objects (GPOs) and identifies the following attributes for each GPO: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    GPO attributeDescription

    Name

    Name of the GPO.

    State

    The state of the selected GPO

    Changed By

    The Editor who checked in or the Approver who deployed the selected GPO.

    Change Date

    For a controlled GPO, the most recent date it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified.

    Comment

    A comment entered by the person who checked in or deployed a GPO at the time that it was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version.

    Computer Version

    Automatically generated version of the Computer Configuration portion of the GPO.

    User Version

    Automatically generated version of the User Configuration portion of the GPO.

    GPO Status

    The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled.

    WMI Filter

    Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC.

    - -  - -## Groups and Users section - - -When a GPO is selected, the **Groups and Users** section displays a list of the groups and users with access to that GPO. The allowed permissions and inheritance are displayed for each group or user. An AGPM Administrator can configure permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ButtonEffect

    Add

    Add a new entry to the security descriptor. Any user or group in Active Directory can be added.

    Remove

    Remove the selected entry from the Access Control List.

    Properties

    Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers.

    Advanced

    Open the Access Control List Editor.

    - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md), [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md), [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md), and [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md). - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab-features-agpm40.md b/mdop/agpm/contents-tab-features-agpm40.md deleted file mode 100644 index 7b909fc508..0000000000 --- a/mdop/agpm/contents-tab-features-agpm40.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Contents Tab Features -description: Contents Tab Features -author: dansimp -ms.assetid: f1f4849d-bf94-47d5-ad81-0eee33abcaca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab Features - - -Each secondary tab within the **Contents** tab has two sections—**Group Policy objects** and **Groups and Users**. - -## Group Policy objects section - - -The **Group Policy objects** section displays a filtered list of Group Policy Objects (GPOs) and identifies the following attributes for each GPO. You can use the **Search** box to search for GPOs with specific attributes. For more information, see [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    GPO attributeDescription

    Name

    Name of the GPO.

    State

    The state of the selected GPO

    Changed By

    The Editor who checked in or the Approver who deployed the selected GPO.

    Change Date

    For a controlled GPO, the most recent date it was checked in after being modified or checked out to be modified. For an uncontrolled GPO, the date when it was last modified.

    Comment

    A comment entered by the person who checked in or deployed a GPO at the time that it was modified. Useful for identifying the specifics of the version in case of the need to roll back to an earlier version.

    Computer Version

    Automatically generated version of the Computer Configuration part of the GPO.

    User Version

    Automatically generated version of the User Configuration part of the GPO.

    GPO Status

    The Computer Configuration and the User Configuration can be managed separately. The GPO Status indicates which portions of the GPO are enabled.

    WMI Filter

    Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC.

    - -  - -## Groups and Users section - - -When a GPO is selected, the **Groups and Users** section displays a list of the groups and users with access to that GPO. The allowed permissions and inheritance are displayed for each group or user. An AGPM Administrator can configure permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ButtonEffect

    Add

    Add a new entry to the security descriptor. Any user or group in Active Directory can be added.

    Remove

    Remove the selected entry from the Access Control List.

    Properties

    Display the properties for the selected object. The properties page is the same one displayed for an object in Active Directory Users and Computers.

    Advanced

    Open the Access Control List Editor.

    - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md), [Performing Editor Tasks](performing-editor-tasks-agpm40.md), [Performing Approver Tasks](performing-approver-tasks-agpm40.md), and [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md). - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/contents-tab.md b/mdop/agpm/contents-tab.md deleted file mode 100644 index 4d154e05f6..0000000000 --- a/mdop/agpm/contents-tab.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Contents Tab -description: Contents Tab -author: dansimp -ms.assetid: 8a756bc1-3900-4d83-93c4-7ebc4705d956 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Contents Tab - - -The **Contents** tab on the **Change Control** pane provides access to Group Policy objects (GPOs) and a shortcut menu for managing GPOs. The options displayed when right-clicking items are dependent on your role, your permissions, and your ownership stake in the GPO being managed. Additionally, these shortcut menus differ with the state of the GPO being managed. - -The secondary tabs filter the list of GPOs displayed. - -- [Controlled Tab](controlled-tab.md): GPOs managed by AGPM - -- [Uncontrolled Tab](uncontrolled-tab.md): GPOs not managed by AGPM - -- [Pending Tab](pending-tab.md): GPO changes awaiting approval by an Approver - -- [Templates Tab](templates-tab.md): GPO templates for creating new GPOs and comparing to existing GPOs - -- [Recycle Bin Tab](recycle-bin-tab.md): Deleted GPOs - -Additionally, the secondary tabs provide access to the History of each GPO and to other features: - -- [Common Secondary Tab Features](common-secondary-tab-features.md) - -- [History Window](history-window.md) - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/control-a-previously-uncontrolled-gpo.md b/mdop/agpm/control-a-previously-uncontrolled-gpo.md deleted file mode 100644 index 6932d224a9..0000000000 --- a/mdop/agpm/control-a-previously-uncontrolled-gpo.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Control a Previously Uncontrolled GPO -description: Control a Previously Uncontrolled GPO -author: dansimp -ms.assetid: 452689a9-4e32-4e3b-8208-56353a82bf36 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Control a Previously Uncontrolled GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy object (GPO), you must first control the GPO with AGPM. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control a previously uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md b/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md deleted file mode 100644 index 87d980d262..0000000000 --- a/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Control an Uncontrolled GPO -description: Control an Uncontrolled GPO -author: dansimp -ms.assetid: 603f00f9-1e65-4b2f-902a-e53dafedbd8d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Control an Uncontrolled GPO - - -To provide change control for a Group Policy Object (GPO), you must first control the GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control an uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md b/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md deleted file mode 100644 index 438609f31c..0000000000 --- a/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Control an Uncontrolled GPO -description: Control an Uncontrolled GPO -author: dansimp -ms.assetid: dc81545c-8da5-4b6f-b266-f01a82e27c6b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Control an Uncontrolled GPO - - -To provide change control for a Group Policy Object (GPO), you must first control the GPO. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control an uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - -  - -  - - - - - diff --git a/mdop/agpm/controlled-gpo-commands-agpm30ops.md b/mdop/agpm/controlled-gpo-commands-agpm30ops.md deleted file mode 100644 index 494e7b2c47..0000000000 --- a/mdop/agpm/controlled-gpo-commands-agpm30ops.md +++ /dev/null @@ -1,211 +0,0 @@ ---- -title: Controlled GPO Commands -description: Controlled GPO Commands -author: dansimp -ms.assetid: 82db4772-154a-4a8d-99cd-2c69e1738698 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Controlled GPO Commands - - -The **Controlled** tab: - -- Displays a list of Group Policy Objects (GPOs) managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for managing GPOs and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    New Controlled GPO

    Create a new GPO with change control managed through AGPM and deploy it to the production environment. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Editing - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Edit

    Open the Group Policy Management Editor window to make changes to the selected GPO.

    Check Out

    Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing it until it is checked back into the archive. (Check Out can be overridden by an AGPM Administrator (Full Control).)

    Check In

    Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy it to the production environment.

    Undo Check Out

    Return a checked out GPO to the archive without any changes.

    - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Import from Production

    For the selected GPO, copy the version in the production environment to the archive.

    Delete

    Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete it as well as the version in the archive. If you do not have permission to delete a GPO, you will be prompted to submit a request.

    Deploy

    Move the selected GPO that is checked into the archive to the production environment. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request.

    Label

    Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window, enabling you to easily identify previous versions of a GPO identified with a particular label, so you can roll back if a problem occurs.

    Rename

    Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment when the GPO is redeployed.

    Save as Template

    Create a new template based on the settings of the selected GPO.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/controlled-gpo-commands-agpm40.md b/mdop/agpm/controlled-gpo-commands-agpm40.md deleted file mode 100644 index 38253ca7d8..0000000000 --- a/mdop/agpm/controlled-gpo-commands-agpm40.md +++ /dev/null @@ -1,219 +0,0 @@ ---- -title: Controlled GPO Commands -description: Controlled GPO Commands -author: dansimp -ms.assetid: 370d3db9-4efc-4799-983d-e29ba5f32b07 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Controlled GPO Commands - - -The **Controlled** tab: - -- Displays a list of Group Policy Objects (GPOs) managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for managing GPOs and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu. This menu includes whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    New Controlled GPO

    Create a new GPO with change control managed through AGPM and deploy it to the production environment of the domain. If you do not have permission to create a GPO, you are prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Editing - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Edit

    Open the Group Policy Management Editor window to change the selected GPO.

    Check Out

    Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing the GPO until it is checked back into the archive. Check Out can be overridden by an AGPM Administrator (Full Control).

    Check In

    Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy the GPO to the production environment of the domain.

    Undo Check Out

    Return a checked out GPO to the archive without any changes.

    - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Import from Production

    For the selected GPO, copy the version in the production environment of the domain to the archive.

    Import from File

    Replace the policy settings of the selected, checked-out GPO with those from a GPO backup file.

    Delete

    Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete the deployed version in addition to the version in the archive. If you do not have permission to delete a GPO, you are prompted to submit a request.

    Deploy

    Move the selected GPO that is checked into the archive to the production environment of the domain. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request.

    Export to

    Save the selected GPO to a backup file so that you can copy it to another domain.

    Label

    Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window. They help you identify earlier versions of a GPO so that you can roll back if a problem occurs.

    Rename

    Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment of the domain when the GPO is redeployed.

    Save as Template

    Create a new template based on the settings of the selected GPO.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/controlled-tab.md b/mdop/agpm/controlled-tab.md deleted file mode 100644 index 64d9853749..0000000000 --- a/mdop/agpm/controlled-tab.md +++ /dev/null @@ -1,211 +0,0 @@ ---- -title: Controlled Tab -description: Controlled Tab -author: dansimp -ms.assetid: 8995a9e1-ace4-40b7-a47b-e1e9924541ba -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Controlled Tab - - -The **Controlled** tab: - -- Displays a list of Group Policy objects (GPOs) managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for managing GPOs and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    New Controlled GPO

    Create a new GPO with change control managed through AGPM and deploy it to the production environment. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPO(s) from organizational units as of when the GPO(s) was most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Editing - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Edit

    Open the Group Policy Object Editor to make changes to the selected GPO.

    Check Out

    Obtain a copy of the selected GPO from the archive for offline editing and prohibit anyone else from editing it until it is checked back into the archive. (Check Out can be overridden by an AGPM Administrator (Full Control).)

    Check In

    Check the edited version of the selected GPO into the archive, so other authorized Editors can make changes or an Approver can deploy it to the production environment.

    Undo Check Out

    Return a checked out GPO to the archive without any changes.

    - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Import from Production

    For the selected GPO, copy the version in the production environment to the archive.

    Delete

    Move the selected GPO to the Recycle Bin and indicate whether to leave the deployed version (if one exists) in production or to delete it as well as the version in the archive. If you do not have permission to delete a GPO, you will be prompted to submit a request.

    Deploy

    Move the selected GPO that is checked into the archive to the production environment. This action makes it active on the network and overwrites the previously active version of the GPO if one existed. If you do not have permission to deploy a GPO, you will be prompted to submit a request.

    Label

    Mark the selected GPO with a descriptive label (such as "Known good") and comment for record keeping. Labels appear in the State column and comments in the Comment column of the History window, enabling you to easily identify previous versions of a GPO identified with a particular label, so you can roll back if a problem occurs.

    Rename

    Change the name of the selected GPO. If the GPO has already been deployed, the name will be updated in the production environment when the GPO is redeployed.

    Save as Template

    Create a new template based on the settings of the selected GPO.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md b/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md deleted file mode 100644 index 2b6c82070c..0000000000 --- a/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Create a New Controlled GPO -description: Create a New Controlled GPO -author: dansimp -ms.assetid: f89eaae8-7858-4222-ba3f-a93a9d7ea5a3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a New Controlled GPO - - -New Group Policy Objects (GPOs) created through the **Change Control** folder will automatically be controlled, enabling you to manage them. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click **Change Control**, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. Type a name for the new GPO. - - 2. Optional: Type a comment for the new GPO to be displayed in the **History** for the GPO. - - 3. To immediately deploy the new GPO to the production environment, click **Create live**. To create the new GPO offline without immediately deploying it, click **Create offline**. - - 4. Select the GPO template to use as a starting point for the new GPO. - - 5. Click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/create-a-new-controlled-gpo-agpm40.md b/mdop/agpm/create-a-new-controlled-gpo-agpm40.md deleted file mode 100644 index e688f80ebc..0000000000 --- a/mdop/agpm/create-a-new-controlled-gpo-agpm40.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Create a New Controlled GPO -description: Create a New Controlled GPO -author: dansimp -ms.assetid: 5ce760f6-9f05-42b4-b787-7835ab8e324e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a New Controlled GPO - - -New Group Policy Objects (GPOs) created through the **Change Control** folder will automatically be controlled, enabling you to manage them. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click **Change Control**, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. Type a name for the new GPO. - - 2. Optional: Type a comment for the new GPO to be displayed in the **History** for the GPO. - - 3. To immediately deploy the new GPO to the production environment of the domain, click **Create live**. To create the new GPO offline without immediately deploying it, click **Create offline**. - - 4. Select the GPO template to use as a starting point for the new GPO, and then click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - -  - -  - - - - - diff --git a/mdop/agpm/create-a-new-controlled-gpo.md b/mdop/agpm/create-a-new-controlled-gpo.md deleted file mode 100644 index dc4d11b70b..0000000000 --- a/mdop/agpm/create-a-new-controlled-gpo.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Create a New Controlled GPO -description: Create a New Controlled GPO -author: dansimp -ms.assetid: b43ce0f4-4519-4278-83c4-c7d5163ddd11 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a New Controlled GPO - - -New Group Policy objects (GPOs) created through the **Change Control** node will automatically be controlled, enabling you to manage them with Advanced Group Policy Management (AGPM). - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. Type a name for the new GPO. - - 2. Optional: Type a comment for the new GPO to be displayed in the **History** for the GPO. - - 3. To immediately deploy the new GPO to the production environment, click **Create live**. To create the new GPO offline without immediately deploying it, click **Create offline**. - - 4. Select the GPO template to use as a starting point for the new GPO. - - 5. Click **OK**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create GPO** permissions for the domain. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/create-a-template-agpm30ops.md b/mdop/agpm/create-a-template-agpm30ops.md deleted file mode 100644 index 0af27e71f6..0000000000 --- a/mdop/agpm/create-a-template-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Create a Template -description: Create a Template -author: dansimp -ms.assetid: 8208f14a-5c18-43a7-8564-118230398cca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a Template - - -Creating a template enables you to save all of the settings of a particular version of a Group Policy Object (GPO) to use as a starting point for creating new GPOs. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a template based on an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Uncontrolled** tab to display available GPOs. - -3. Right-click the GPO from which you want to create a template, and then click **Save as Template**. - -4. Type a name for the template and a comment, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm30ops.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/create-a-template-agpm40.md b/mdop/agpm/create-a-template-agpm40.md deleted file mode 100644 index bb0d209a5b..0000000000 --- a/mdop/agpm/create-a-template-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Create a Template -description: Create a Template -author: dansimp -ms.assetid: b38423af-7d24-437a-98bc-01f1ae891127 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a Template - - -Creating a template enables you to save all of the settings of a particular version of a Group Policy Object (GPO) to use as a starting point for creating new GPOs. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a template based on an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Uncontrolled** tab to display available GPOs. - -3. Right-click the GPO from which you want to create a template, and then click **Save as Template**. - -4. Type a name for the template and a comment, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm40.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/create-a-template.md b/mdop/agpm/create-a-template.md deleted file mode 100644 index f25308b5ea..0000000000 --- a/mdop/agpm/create-a-template.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Create a Template -description: Create a Template -author: dansimp -ms.assetid: 6992bd55-4a4f-401f-9815-c468bac598ef -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a Template - - -Creating a template enables you to save all of the settings of a particular version of a Group Policy object (GPO) to use as a starting point for creating new GPOs. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a template based on an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Uncontrolled** tab to display available GPOs. - -3. Right-click the GPO from which you want to create a template, then click **Save as Template**. - -4. Type a name for the template and a comment, then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) - - - - - - - - - diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md deleted file mode 100644 index 946f6e4a3c..0000000000 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Creating a Template and Setting a Default Template -description: Creating a Template and Setting a Default Template -author: dansimp -ms.assetid: acce0e0f-7e67-479c-9daa-e678fccd7ced -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a Template and Setting a Default Template - - -Creating a template enables you to save all the settings of a particular version of a Group Policy Object (GPO) to use as a starting point for creating new GPOs. As an Editor, you can also specify which of the available templates will be the default template for all Group Policy administrators creating new GPOs. - -Some potential uses for a template include the following: - -- Create a security baseline that your organization can reuse across domains. - -- Create a template to manage folder redirection and offline files that your organization can customize for each department. - -- Create a wireless networking template that your organization can use to configure wireless network connections for different geographical areas. - -- Create regulatory compliance templates for local network administrators. - -- Create a read-only snapshot of an existing GPO. - -**Note**   -A template is a static version of a GPO that cannot be edited, yet can be used as a starting point for creating new, editable GPOs. Renaming or deleting a template does not affect GPOs created from that template. - - - -- [Create a Template](create-a-template-agpm30ops.md) - -- [Set a Default Template](set-a-default-template-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md deleted file mode 100644 index 7b81b2a43d..0000000000 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Creating a Template and Setting a Default Template -description: Creating a Template and Setting a Default Template -author: dansimp -ms.assetid: ffa72c2a-64eb-4492-8072-c3a66179b546 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a Template and Setting a Default Template - - -Creating a template enables you to save all the settings of a particular version of a Group Policy Object (GPO) to use as a starting point for creating new GPOs. As an Editor, you can also specify which of the available templates will be the default template for all Group Policy administrators creating new GPOs. - -Some potential uses for a template include the following: - -- Create a security baseline that your organization can reuse across domains. - -- Create a template to manage folder redirection and offline files that your organization can customize for each department. - -- Create a wireless networking template that your organization can use to configure wireless network connections for different geographical areas. - -- Create regulatory compliance templates for local network administrators. - -- Create a read-only snapshot of an existing GPO. - -**Note**   -A template is a static version of a GPO that cannot be edited, yet can be used as a starting point for creating new, editable GPOs. Renaming or deleting a template does not affect GPOs created from that template. - - - -- [Create a Template](create-a-template-agpm40.md) - -- [Set a Default Template](set-a-default-template-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template.md b/mdop/agpm/creating-a-template-and-setting-a-default-template.md deleted file mode 100644 index 049e02aff3..0000000000 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Creating a Template and Setting a Default Template -description: Creating a Template and Setting a Default Template -author: dansimp -ms.assetid: 8771b4b5-4dea-4be1-a675-f60cfd3ec5dc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a Template and Setting a Default Template - - -Creating a template enables you to save all of the settings of a particular version of a Group Policy object (GPO) to use as a starting point for creating new GPOs. As an Editor, you can also specify which of the available templates will be the default template for all Group Policy administrators creating new GPOs. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. Renaming or deleting a template does not impact GPOs created from that template. - - - -- [Create a Template](create-a-template.md) - -- [Set a Default Template](set-a-default-template.md) - - - - - - - - - diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md deleted file mode 100644 index 5415bea6ec..0000000000 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Creating, Controlling, or Importing a GPO -description: Creating, Controlling, or Importing a GPO -author: dansimp -ms.assetid: ce8b232e-7758-4a6a-9e2f-18967da6cdad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating, Controlling, or Importing a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy Object (GPO), the GPO must first be controlled by AGPM. New GPOs created through the **Change Control** folder will automatically be controlled. As an Editor, you may not have permission to complete the control, creation, or deletion of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm30ops.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) - -- [Import a GPO from Production](import-a-gpo-from-production-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md deleted file mode 100644 index 99e2495711..0000000000 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Creating, Controlling, or Importing a GPO -description: Creating, Controlling, or Importing a GPO -author: dansimp -ms.assetid: f2c8bef5-b654-4864-99d4-9207cfb0a137 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating, Controlling, or Importing a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy object (GPO), you must first control the GPO with AGPM. New GPOs created through the **Change Control** node will automatically be controlled. - -- [Control a Previously Uncontrolled GPO](control-a-previously-uncontrolled-gpo.md) - -- [Create a New Controlled GPO](create-a-new-controlled-gpo.md) - -- [Delegate Access to a GPO](delegate-access-to-a-gpo.md) - -- [Import a GPO from Production](import-a-gpo-from-production-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md deleted file mode 100644 index 489ce5e692..0000000000 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Creating, Controlling, or Importing a GPO -description: Creating, Controlling, or Importing a GPO -author: dansimp -ms.assetid: 0cc1b6ee-3335-4d84-9e1c-d1aefabfef51 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating, Controlling, or Importing a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy Object (GPO), you must first control the GPO with AGPM. New GPOs created through the **Change Control** folder will automatically be controlled. - -- [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm30ops.md) - -- [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm30ops.md) - -- [Delegate Management of a Controlled GPO](delegate-management-of-a-controlled-gpo-agpm30ops.md) - -- [Import a GPO from Production](import-a-gpo-from-production-editor-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md deleted file mode 100644 index 39ac25e986..0000000000 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Creating, Controlling, or Importing a GPO -description: Creating, Controlling, or Importing a GPO -author: dansimp -ms.assetid: 5259ce25-f570-4346-9f50-6b051724a998 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating, Controlling, or Importing a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy object (GPO), the GPO must first be controlled by AGPM. New GPOs created through the **Change Control** node will automatically be controlled. As an Editor, you may not have permission to complete the control, creation, or deletion of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Control of a Previously Uncontrolled GPO](request-control-of-a-previously-uncontrolled-gpo.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) - -- [Import a GPO from Production](import-a-gpo-from-production-editor.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md deleted file mode 100644 index 2206a562b7..0000000000 --- a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Creating or Controlling a GPO -description: Creating or Controlling a GPO -author: dansimp -ms.assetid: ca2fa40e-c6e9-4c57-9da1-e5375df4a2fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating or Controlling a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy Object (GPO), you must first control the GPO with AGPM. New GPOs created through the **Change Control** folder will automatically be controlled. - -- [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm40.md) - -- [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm40.md) - -- [Delegate Management of a Controlled GPO](delegate-management-of-a-controlled-gpo-agpm40.md) - -- [Import a GPO from Production](import-a-gpo-from-production-agpm40-app.md) - -  - -  - - - - - diff --git a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md deleted file mode 100644 index 37b7564e65..0000000000 --- a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Creating or Controlling a GPO -description: Creating or Controlling a GPO -author: dansimp -ms.assetid: 807f3b3f-ad3d-4851-9772-7f54a065632a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating or Controlling a GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for a Group Policy Object (GPO), the GPO must first be controlled by AGPM. New GPOs created through the **Change Control** folder will automatically be controlled. As an Editor, you may not have permission to complete the control, creation, or deletion of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm40.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) - -- [Import a GPO from Production](import-a-gpo-from-production-agpm40-ed.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-access-to-a-gpo.md b/mdop/agpm/delegate-access-to-a-gpo.md deleted file mode 100644 index 86bb7646c4..0000000000 --- a/mdop/agpm/delegate-access-to-a-gpo.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Delegate Access to a GPO -description: Delegate Access to a GPO -author: dansimp -ms.assetid: f1d6bb6c-d5bf-4080-a6cb-32774689f804 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to a GPO - - -An Approver can delegate the management of a controlled Group Policy object (GPO) that was **created by that Approver**. Like an AGPM Administrator (Full Control), the Approver can delegate access to such a GPO, so selected Editors can edit it, Reviewers can review it, and other Approvers can approve it. By default, an Approver cannot delegate access to GPOs created by another Group Policy administrator. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate. - -3. Click the **Add** button, select the users or groups to be permitted access, and then click **OK**. - -4. To customize the permissions for each, click the **Advanced** button on the **Contents** tab and check role permissions to allow or deny. (For more detailed control, click **Advanced** in the **Permissions** dialog box.) - -5. Click **Apply**, and then click **OK** in the **Permissions** dialog box. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md deleted file mode 100644 index 12617d0f27..0000000000 --- a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Delegate Access to an Individual GPO in the Archive -description: Delegate Access to an Individual GPO in the Archive -author: dansimp -ms.assetid: 7b37b188-2b6b-4e52-be97-8ef899e9893b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to an Individual GPO in the Archive - - -As an AGPM Administrator (Full Control), you can delegate the management of a controlled Group Policy Object (GPO) in the archive so that selected groups and Editors can edit it, Reviewers can review it, and Approvers can approve it. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and click the **Remove** button. - - **Note**   - If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab. - - - - 3. To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Managing the Archive](managing-the-archive.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md deleted file mode 100644 index d8d548450f..0000000000 --- a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Delegate Access to an Individual GPO in the Archive -description: Delegate Access to an Individual GPO in the Archive -author: dansimp -ms.assetid: 284d2aa2-7c10-4ffa-8978-bbe30867c1c1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to an Individual GPO in the Archive - - -As an AGPM Administrator (Full Control), you can delegate the management of a controlled Group Policy Object (GPO) in the archive so that selected groups and Editors can edit it, Reviewers can review it, and Approvers can approve it. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and click the **Remove** button. - - **Note**   - If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab. - - - - 3. To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Managing the Archive](managing-the-archive-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo.md b/mdop/agpm/delegate-access-to-an-individual-gpo.md deleted file mode 100644 index ef1ebe53fa..0000000000 --- a/mdop/agpm/delegate-access-to-an-individual-gpo.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Delegate Access to an Individual GPO -description: Delegate Access to an Individual GPO -author: dansimp -ms.assetid: b2a7d550-14bf-4b41-b6e4-2cc091eedd2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to an Individual GPO - - -As an AGPM Administrator (Full Control), you can delegate the management of a controlled Group Policy object (GPO), so selected groups and Editors can edit it, Reviewers can review it, and Approvers can approve it. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate. - -3. Click the **Add** button, select the users or groups to be permitted access, and then click **OK**. - -4. To customize the permissions for each user or group, click the **Advanced** button on the **Contents** tab and check role permissions to allow or deny. (For more detailed control, click **Advanced** in the **Permissions** dialog box.) - -5. Click **Apply**, and then click **OK** in the **Permissions** dialog box. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Set the permission to apply to **This object and nested objects**. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted so that it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md b/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md deleted file mode 100644 index 6a0eaaf9c7..0000000000 --- a/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Delegate Access to the Production Environment -description: Delegate Access to the Production Environment -author: dansimp -ms.assetid: c1ebae2e-909b-4e64-b368-b7d3cc67b1eb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to the Production Environment - - -You can change access to Group Policy Objects (GPOs) in the production environment, replacing any existing permissions on those GPOs. You can configure permissions at the domain level to either allow or prevent users from editing, deleting, or modifying the security of GPOs in the production environment when they are not using the **Change Control** folder in the Group Policy Management Console (GPMC). - -**Note**   -- Delegating access to the production environment does not affect users’ ability to link GPOs. - -- When GPOs are controlled or deployed, access for any other accounts except those with **Read** and **Apply** permissions is removed. - -  - -A user account that has either the necessary permissions in Advanced Group Policy Management (AGPM) or the role of AGPM Administrator (Full Control) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To change access to GPOs in the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Production Delegation** tab. - -3. To add permissions for a user or group that does not have access to the production environment, or to replace the permissions for a user or group that does have access: - - 1. Click **Add**, select a user or group, and then click **OK**. - - 2. Select permissions to delegate to that user or group for the production environment, and then click **OK**. - -4. To remove all permissions to the production environment for a user or group, select the user or group, click **Remove**, and then click **OK**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- Permissions for the AGPM Service Account cannot be changed on the **Production Delegation** tab. - -- By default, the following accounts have permissions for GPOs in the production environment: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    AccountDefault Permissions for GPOs

    <AGPM Service Account>

    Edit Settings, Delete, Modify Security

    Authenticated Users

    Read, Apply

    Domain Admins

    Edit Settings, Delete, Modify Security

    Enterprise Admins

    Edit Settings, Delete, Modify Security

    Enterprise Domain Controllers

    Read

    System

    Edit Settings, Delete, Modify Security

    - -   - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md b/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md deleted file mode 100644 index 79476c9882..0000000000 --- a/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Delegate Access to the Production Environment -description: Delegate Access to the Production Environment -author: dansimp -ms.assetid: 4c670581-8c47-41ea-80eb-02846ff1ec1f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Access to the Production Environment - - -In Advanced Group Policy Management (AGPM), you can change access to Group Policy Objects (GPOs) in the production environment of the domain, replacing any existing permissions on those GPOs. You can configure permissions at the domain level to either allow or prevent users from editing, deleting, or modifying the security of GPOs in the production environment when they are not using the **Change Control** folder in the Group Policy Management Console (GPMC). - -**Note**   -- Changing how access to the production environment is delegated does not affect users' ability to link GPOs. - -- When GPOs are controlled or deployed, access for any other accounts except those with **Read** and **Apply** permissions is removed. - -  - -A user account that has either the role of AGPM Administrator (Full Control) or the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To change access to GPOs in the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Production Delegation** tab. - -3. To add permissions for a user or group that does not have access to the production environment, or to replace the permissions for a user or group that does have access: - - 1. Click **Add**, select a user or group, and then click **OK**. - - 2. Select permissions to delegate to that user or group for the production environment, and then click **OK**. - -4. To remove all permissions to the production environment for a user or group, select the user or group, click **Remove**, and then click **OK**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- Permissions for the AGPM Service Account cannot be changed on the **Production Delegation** tab. - -- By default, the following accounts have permissions for GPOs in the production environment: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    AccountDefault Permissions for GPOs

    <AGPM Service Account>

    Edit Settings, Delete, Modify Security

    Authenticated Users

    Read, Apply

    Domain Admins

    Edit Settings, Delete, Modify Security

    Enterprise Admins

    Edit Settings, Delete, Modify Security

    Enterprise Domain Controllers

    Read

    System

    Edit Settings, Delete, Modify Security

    - -   - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md deleted file mode 100644 index 367806c7ef..0000000000 --- a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Delegate Domain-Level Access to the Archive -description: Delegate Domain-Level Access to the Archive -author: dansimp -ms.assetid: d232069e-71d5-4b4d-b22e-bef11de1cfd4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Domain-Level Access to the Archive - - -Set up delegation for your environment so that Group Policy administrators have the appropriate access to and control over Group Policy Objects (GPOs) in the archive. There are baseline permissions you can apply to make operation more efficient. You can grant permissions in any manner that meets the needs of your organization. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate access so that users and groups have appropriate permissions to all GPOs throughout a domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Domain Delegation** tab, and configure access to all GPOs in the domain: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and click the **Remove** button. - - 3. To modify the roles and permissions delegated to a user or group, select click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must be granted **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Managing the Archive](managing-the-archive.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md deleted file mode 100644 index 2a6a673529..0000000000 --- a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Delegate Domain-Level Access to the Archive -description: Delegate Domain-Level Access to the Archive -author: dansimp -ms.assetid: 11ca1d40-4b5c-496e-8922-d01412717858 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Domain-Level Access to the Archive - - -Set up delegation for your environment so that Group Policy administrators have the appropriate access to and control over Group Policy Objects (GPOs) in the archive. There are baseline permissions you can apply to make operation more efficient. You can grant permissions in any manner that meets the needs of your organization. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate access so that users and groups have appropriate permissions to all GPOs throughout a domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Domain Delegation** tab, and configure access to all GPOs in the domain: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and click the **Remove** button. - - 3. To modify the roles and permissions delegated to a user or group, select click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must be granted **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted, so it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Managing the Archive](managing-the-archive-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-domain-level-access.md b/mdop/agpm/delegate-domain-level-access.md deleted file mode 100644 index 3facfda7f0..0000000000 --- a/mdop/agpm/delegate-domain-level-access.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Delegate Domain-Level Access -description: Delegate Domain-Level Access -author: dansimp -ms.assetid: 64c8e773-38cc-4991-9ed2-5a801094d06e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Domain-Level Access - - -Set up delegation for your environment so Group Policy administrators have the appropriate access to and control over Group Policy objects (GPOs). There are baseline permissions you can apply to make the operation of Advanced Group Policy Management (AGPM) more efficient. You can grant permissions in any manner that meets the needs of your organization. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate access so users and groups have appropriate permissions to all GPOs throughout a domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Click the **Domain Delegation** tab, then click the **Advanced** button. - -3. In the **Permissions** dialog box, click the check box for each role to be assigned to an individual, and then click the **Advanced** button. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -4. In the **Advanced Security Settings** dialog box, select a Group Policy administrator, and then click **Edit**. - -5. For **Apply onto**, select **This object and nested objects**, configure any special permissions beyond the standard AGPM roles, then click **OK** in the **Permission** **Entry** dialog box. - -6. In the **Advanced Security Settings** dialog box, click **OK**. - -7. In the **Permissions** dialog box, click **OK**. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **Modify Security** permission for the domain. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Set the permission to apply to **This object and nested objects**. Other permissions must be explicitly delegated. - -- Editors must be granted **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -- Membership in the Group Policy Creator Owners group should be restricted so that it is not used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - -### Additional references - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md deleted file mode 100644 index 20c4c7176a..0000000000 --- a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Delegate Management of a Controlled GPO -description: Delegate Management of a Controlled GPO -author: dansimp -ms.assetid: 509b02e7-ce0b-4919-b58a-c3a33051152e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Management of a Controlled GPO - - -An Approver can delegate the management of a controlled Group Policy Object (GPO) that was created by that Approver. Like an AGPM Administrator (Full Control), the Approver can delegate access to such a GPO so that selected Editors can edit it, Reviewers can review it, and other Approvers can approve it. By default, an Approver cannot delegate access to GPOs created by another Group Policy administrator. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and then click the **Remove** button. - - **Note**   - If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab. - - - - 3. To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md deleted file mode 100644 index 6401b24ac5..0000000000 --- a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Delegate Management of a Controlled GPO -description: Delegate Management of a Controlled GPO -author: dansimp -ms.assetid: 96b4bfb3-5657-4267-8326-85d7a0db87ce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delegate Management of a Controlled GPO - - -An Approver can delegate the management of a controlled Group Policy Object (GPO) that was created by that Approver. Like an AGPM Administrator (Full Control), the Approver can delegate access to such a GPO so that selected Editors can edit it, Reviewers can review it, and other Approvers can approve it. By default, an Approver cannot delegate access to GPOs created by another Group Policy administrator. - -A user account with the AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delegate the management of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display controlled GPOs, and then click the GPO to delegate: - - 1. To add access for a user or group, click the **Add** button, select the user or group, and click **OK**. In the **Add Group or User** dialog box, select a role and click **OK**. - - 2. To remove access for a user or group, select the user or group, and then click the **Remove** button. - - **Note**   - If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab. - - - - 3. To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**. - - **Note**   - Editor and Approver include Reviewer permissions. - - - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain and **Modify Security** permission for the GPO. - -- To delegate read access to Group Policy administrators who use AGPM, you must grant them **List Contents** as well as **Read Settings** permissions. This enables them to view GPOs on the **Contents** tab of AGPM. Other permissions must be explicitly delegated. - -- Editors must have **Read** permission for the deployed copy of a GPO to make full use of Group Policy Software Installation. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - - - - - - - - - diff --git a/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md b/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md deleted file mode 100644 index 15a7b0ca84..0000000000 --- a/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Delete a Controlled GPO -description: Delete a Controlled GPO -author: dansimp -ms.assetid: f51c1737-c116-4faf-a6f6-c72303f60a3b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delete a Controlled GPO - - -Approvers can delete a controlled Group Policy Object (GPO), moving it to the Recycle Bin. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delete a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO you want to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only**. - - - To delete the GPO from both the archive and production environment, click **Delete GPO from archive and production**. - -4. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. If the GPO was deleted only from the archive, it is also displayed on the **Uncontrolled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/delete-a-controlled-gpo-agpm40.md b/mdop/agpm/delete-a-controlled-gpo-agpm40.md deleted file mode 100644 index df8fd91963..0000000000 --- a/mdop/agpm/delete-a-controlled-gpo-agpm40.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Delete a Controlled GPO -description: Delete a Controlled GPO -author: dansimp -ms.assetid: 2a461018-aa0b-4ae3-b079-efc554ca4a3d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delete a Controlled GPO - - -Approvers can delete a controlled Group Policy Object (GPO), moving it to the Recycle Bin. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delete a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO you want to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only**. - - - To delete the GPO from both the archive and production environment of the domain, click **Delete GPO from archive and production**. - -4. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. If the GPO was deleted only from the archive, it is also displayed on the **Uncontrolled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/delete-a-gpo-approver.md b/mdop/agpm/delete-a-gpo-approver.md deleted file mode 100644 index b690ae67d6..0000000000 --- a/mdop/agpm/delete-a-gpo-approver.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Delete a GPO -description: Delete a GPO -author: dansimp -ms.assetid: 85fca371-5707-49c1-aa51-813fc3a58dfc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delete a GPO - - -Advanced Group Policy Management (AGPM) enables Approvers to delete a controlled Group Policy object (GPO), moving it to the Recycle Bin. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To delete a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only (uncontrol)**. - - - To delete the GPO from both the archive and production environment, click **Delete GPO from archive and production**. - -4. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. If the GPO was deleted only from the archive, it is also displayed on the **Uncontrolled** tab. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to delete a deployed GPO. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to delete a GPO from the archive. Specifically, you must have **List Contents** and either **Edit Settings** or **Delete GPO** permissions for the GPO. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/delete-a-gpo-editor.md b/mdop/agpm/delete-a-gpo-editor.md deleted file mode 100644 index 151980b771..0000000000 --- a/mdop/agpm/delete-a-gpo-editor.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Delete a GPO -description: Delete a GPO -author: dansimp -ms.assetid: 66be3dde-653e-4c25-8cb7-00e7090c8d31 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Delete a GPO - - -As an Editor, you may not have permission to complete the deletion of a Group Policy object (GPO), but you do have the permission necessary to begin the process and submit your request to an Approver. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deletion of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only (uncontrol)**. - - - To delete the GPO from both the archive and production environment, click **Delete GPO from archive and production**. - - Unless you have special permission to delete GPOs, you must submit a request for deletion of the deployed GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Recycle Bin** tab, where it can be restored or destroyed. - -### Additional considerations - -- By default, you must be an Editor to request the deletion of a deployed GPO. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to delete a GPO from the archive. Specifically, you must have **List Contents** and either **Edit Settings** or **Delete GPO** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md b/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md deleted file mode 100644 index b50eaff2eb..0000000000 --- a/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Deleting or Restoring a GPO -description: Deleting or Restoring a GPO -author: dansimp -ms.assetid: ee4a467a-187a-48e3-8f0d-548de0606a56 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting or Restoring a GPO - - -To use Advanced Group Policy Management (AGPM) to delete a Group Policy Object (GPO) from the archive or restore a deleted GPO from the Recycle Bin, the GPO must be controlled by AGPM. As an Editor, you may not have permission to complete the deletion or restoration of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Deletion of a GPO](request-deletion-of-a-gpo-agpm30ops.md) - -- [Request Restoration of a Deleted GPO](request-restoration-of-a-deleted-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md b/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md deleted file mode 100644 index f45ac8dc42..0000000000 --- a/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Deleting or Restoring a GPO -description: Deleting or Restoring a GPO -author: dansimp -ms.assetid: d4f92f4d-eba7-4e6e-b166-13670864d298 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting or Restoring a GPO - - -To use Advanced Group Policy Management (AGPM) to delete a Group Policy Object (GPO) from the archive or restore a deleted GPO from the Recycle Bin, the GPO must be controlled by AGPM. As an Editor, you may not have permission to complete the deletion or restoration of a GPO, but you do have the permission necessary to begin the process and submit your request to an Approver. - -- [Request Deletion of a GPO](request-deletion-of-a-gpo-agpm40.md) - -- [Request Restoration of a Deleted GPO](request-restoration-of-a-deleted-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md deleted file mode 100644 index 2c2c5983b2..0000000000 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Deleting, Restoring, or Destroying a GPO -description: Deleting, Restoring, or Destroying a GPO -author: dansimp -ms.assetid: 3e1b862e-007a-4b60-900f-0489069f5c75 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting, Restoring, or Destroying a GPO - - -As an Approver, you can delete a Group Policy Object (GPO) (moving it to the Recycle Bin), restore a GPO from the Recycle Bin (returning it to the archive), or destroy a GPO (permanently deleting it so that it can no longer be restored). - -- [Delete a Controlled GPO](delete-a-controlled-gpo-agpm30ops.md) - -- [Restore a Deleted GPO](restore-a-deleted-gpo-agpm30ops.md) - -- [Destroy a GPO](destroy-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md deleted file mode 100644 index 7373c4011f..0000000000 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Deleting, Restoring, or Destroying a GPO -description: Deleting, Restoring, or Destroying a GPO -author: dansimp -ms.assetid: 3af6c396-61c8-4b32-9fd8-28e9f15e575c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting, Restoring, or Destroying a GPO - - -As an Approver, you can delete a Group Policy Object (GPO) (moving it to the Recycle Bin), restore a GPO from the Recycle Bin (returning it to the archive), or destroy a GPO (permanently deleting it so that it can no longer be restored). - -- [Delete a Controlled GPO](delete-a-controlled-gpo-agpm40.md) - -- [Restore a Deleted GPO](restore-a-deleted-gpo-agpm40.md) - -- [Destroy a GPO](destroy-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md deleted file mode 100644 index 86d70a45a4..0000000000 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Deleting, Restoring, or Destroying a GPO -description: Deleting, Restoring, or Destroying a GPO -author: dansimp -ms.assetid: 089c68e7-c1a5-418a-8776-cf23960f10c4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deleting, Restoring, or Destroying a GPO - - -As an Approver, you can delete a Group Policy object (GPO) (moving it to the Recycle Bin), restore a GPO from the Recycle Bin (returning it to the archive), or destroy a GPO (permanently deleting it so that it can no longer be restored). - -- [Delete a GPO](delete-a-gpo-approver.md) - -- [Restore a Deleted GPO](restore-a-deleted-gpo.md) - -- [Destroy a GPO](destroy-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/deploy-a-gpo-agpm30ops.md b/mdop/agpm/deploy-a-gpo-agpm30ops.md deleted file mode 100644 index 1e51162115..0000000000 --- a/mdop/agpm/deploy-a-gpo-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deploy a GPO -description: Deploy a GPO -author: dansimp -ms.assetid: 3767b722-db43-40f1-a714-bb8e38bcaa10 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy a GPO - - -An Approver can deploy a new or edited Group Policy Object (GPO) to the production environment. For information about redeploying a previous version of a GPO, see [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md). - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed and then click **Deploy**. - -4. To review links to the GPO, click **Advanced**. Pause the mouse pointer on an item in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes**. When the **Progress** window indicates that overall progress is complete, click **Close**. - -**Note**   -To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/deploy-a-gpo-agpm40.md b/mdop/agpm/deploy-a-gpo-agpm40.md deleted file mode 100644 index 6c16327cc3..0000000000 --- a/mdop/agpm/deploy-a-gpo-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deploy a GPO -description: Deploy a GPO -author: dansimp -ms.assetid: a6febeaa-144b-4c02-99af-d972f0f2b544 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy a GPO - - -An Approver can deploy a new or edited Group Policy Object (GPO) to the production environment. For information about redeploying an earlier version of a GPO, see [Roll Back to an Earlier Version of a GPO](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md). - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed and then click **Deploy**. - -4. To review links to the GPO, click **Advanced**. Pause the mouse pointer on an item in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes**. When the **Progress** window indicates that overall progress is complete, click **Close**. - -**Note**   -To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/deploy-a-gpo.md b/mdop/agpm/deploy-a-gpo.md deleted file mode 100644 index fcb0ff6fe7..0000000000 --- a/mdop/agpm/deploy-a-gpo.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deploy a GPO -description: Deploy a GPO -author: dansimp -ms.assetid: a0a3f292-e3ab-46ae-a0fd-d7b2b4ad8883 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy a GPO - - -Advanced Group Policy Management (AGPM) enables an Approver to deploy a new or edited Group Policy object (GPO) to the production environment. For information about redeploying a previous version of a GPO, see [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo.md). - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed and then click **Deploy**. - -4. To review links to the GPO, click **Advanced**. Pause the mouse pointer on a node in the tree to display details. - - - By default, all links to the GPO will be restored. - - - To prevent a link from being restored, clear the check box for that link. - - - To prevent all links from being restored, clear the **Restore Links** check box in the **Deploy GPO** dialog box. - -5. Click **Yes**. When the **Progress** window indicates that overall progress is complete, click **Close**. - -**Note**   -To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/destroy-a-gpo-agpm30ops.md b/mdop/agpm/destroy-a-gpo-agpm30ops.md deleted file mode 100644 index 12697f828f..0000000000 --- a/mdop/agpm/destroy-a-gpo-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Destroy a GPO -description: Destroy a GPO -author: dansimp -ms.assetid: bfabd71a-47f3-462e-b86f-5f15762b9e28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Destroy a GPO - - -Approvers can destroy a Group Policy Object (GPO), removing it from the Recycle Bin and permanently deleting it so that it can no longer be restored. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To permanently delete a GPO so it can no longer be restored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to destroy, and then click **Destroy**. - -4. Click **Yes** to confirm that you want to permanently delete the selected GPO and all backups from the archive. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is permanently deleted. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/destroy-a-gpo-agpm40.md b/mdop/agpm/destroy-a-gpo-agpm40.md deleted file mode 100644 index 9762120942..0000000000 --- a/mdop/agpm/destroy-a-gpo-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Destroy a GPO -description: Destroy a GPO -author: dansimp -ms.assetid: 09bce8c4-f75b-4633-b80b-d894bbec95c9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Destroy a GPO - - -Approvers can destroy a Group Policy Object (GPO), removing it from the Recycle Bin and permanently deleting it so that it can no longer be restored. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To permanently delete a GPO so it can no longer be restored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to destroy, and then click **Destroy**. - -4. Click **Yes** to confirm that you want to permanently delete the selected GPO and all backups from the archive. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is permanently deleted. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/destroy-a-gpo.md b/mdop/agpm/destroy-a-gpo.md deleted file mode 100644 index f1b33449d2..0000000000 --- a/mdop/agpm/destroy-a-gpo.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Destroy a GPO -description: Destroy a GPO -author: dansimp -ms.assetid: d74941a3-beef-46cd-a4ca-80a324dcfadf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Destroy a GPO - - -Advanced Group Policy Management (AGPM) enables Approvers to destroy a Group Policy object (GPO), removing it from the Recycle Bin and permanently deleting it so that it can no longer be restored. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To permanently delete a GPO so it can no longer be restored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to destroy, and then click **Destroy**. - -4. Click **Yes** to confirm that you want to permanently delete the selected GPO and all backups from the archive. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is permanently deleted. - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/domain-delegation-tab-agpm30ops.md b/mdop/agpm/domain-delegation-tab-agpm30ops.md deleted file mode 100644 index d2989bdb1a..0000000000 --- a/mdop/agpm/domain-delegation-tab-agpm30ops.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Domain Delegation Tab -description: Domain Delegation Tab -author: dansimp -ms.assetid: 523cdf39-f4b8-4d20-a917-3485756658ce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Domain Delegation Tab - - -The **Domain Delegation** tab on the **Change Control** pane provides a list of Group Policy administrators who have domain-level access to the archive and indicates the roles of each. Additionally, this tab enables AGPM Administrators (Full Control) to configure domain-level permissions for Editors, Approvers, Reviewers, and other AGPM Administrators. There are two sections on the **Domain Delegation** tab—configuration of e-mail notification and role-based delegation for Advanced Group Policy Management (AGPM) at the domain level. - -## Configuration of e-mail notification - - -The e-mail notification section of this tab identifies the Approvers that will receive notification when operations are pending in AGPM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription

    From e-mail address

    The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain.

    To e-mail address

    A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent

    SMTP server

    The name of the e-mail server, such as mail.contoso.com

    User name

    A user with access to the SMTP server

    Password

    User's password for authentication to the SMTP server

    Confirm password

    Confirm user's password

    - -  - -## Domain-level role-based delegation - - -The role-based delegation section of this tab displays and enables an AGPM Administrator to delegate allowed, denied, and inherited permissions for each group and user on the domain with access to the archive. An AGPM Administrator can configure domain-wide permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions for each Group Policy administrator. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ButtonEffect

    Add

    Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators.

    Remove

    Remove the selected Group Policy administrators from the Access Control List.

    Properties

    Display the properties for the selected Group Policy administrators.

    Advanced

    Open the Access Control List Editor.

    - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md), [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md), [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md), and [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md). - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/domain-delegation-tab-agpm40.md b/mdop/agpm/domain-delegation-tab-agpm40.md deleted file mode 100644 index 4a847fcdba..0000000000 --- a/mdop/agpm/domain-delegation-tab-agpm40.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Domain Delegation Tab -description: Domain Delegation Tab -author: dansimp -ms.assetid: 5be5841e-92fb-4af6-aa68-0ae50f8d5141 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Domain Delegation Tab - - -The **Domain Delegation** tab on the **Change Control** pane provides a list of Group Policy administrators who have domain-level access to the archive and indicates the roles of each. Additionally, this tab enables AGPM Administrators (Full Control) to configure domain-level permissions for Editors, Approvers, Reviewers, and other AGPM Administrators. There are two sections on the **Domain Delegation** tab—configuration of e-mail notification and role-based delegation for Advanced Group Policy Management (AGPM) at the domain level. - -## Configuration of e-mail notification - - -The e-mail notification section of this tab identifies the Approvers that will receive notification when operations are pending in AGPM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription

    From e-mail address

    The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain.

    To e-mail address

    A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent

    SMTP server

    The name of the e-mail server, such as mail.contoso.com

    User name

    A user with access to the SMTP server

    Password

    User's password for authentication to the SMTP server

    Confirm password

    Confirm user's password

    - -  - -## Domain-level role-based delegation - - -The role-based delegation section of this tab displays and enables an AGPM Administrator to delegate allowed, denied, and inherited permissions for each group and user on the domain with access to the archive. An AGPM Administrator can configure domain-wide permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions for each Group Policy administrator. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ButtonEffect

    Add

    Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators.

    Remove

    Remove the selected Group Policy administrators from the Access Control List.

    Properties

    Display the properties for the selected Group Policy administrators.

    Advanced

    Open the Access Control List Editor.

    - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md), [Performing Editor Tasks](performing-editor-tasks-agpm40.md), [Performing Approver Tasks](performing-approver-tasks-agpm40.md), and [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md). - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/domain-delegation-tab.md b/mdop/agpm/domain-delegation-tab.md deleted file mode 100644 index 01cb0b02be..0000000000 --- a/mdop/agpm/domain-delegation-tab.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Domain Delegation Tab -description: Domain Delegation Tab -author: dansimp -ms.assetid: 15a9bfff-e25b-4b62-9ebc-521a5f4eae96 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Domain Delegation Tab - - -The **Domain Delegation** tab on the **Change Control** pane provides a list of Group Policy administrators who have domain-level access to the archive and indicates the roles of each. Additionally, this tab enables AGPM Administrators (Full Control) to configure domain-level permissions for Editors, Approvers, Reviewers, and other AGPM Administrators. There are two sections on the **Domain Delegation** tab—configuration of e-mail notification and role-based delegation for Advanced Group Policy Management (AGPM) at the domain level. - -## Configuration of e-mail notification - - -The e-mail notification section of this tab identifies the Approvers that will receive notification when operations are pending in AGPM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription

    From

    The AGPM alias from which notification is sent to Approvers. In an environment with multiple domains, this can be the same alias throughout the environment or a different alias for each domain.

    To

    A comma-delimited list of e-mail addresses of Approvers to whom notification is to be sent

    SMTP server

    The name of the e-mail server, such as mail.contoso.com

    User name

    A user with access to the SMTP server

    Password

    User's password for authentication to the SMTP server

    Confirm password

    Confirm user's password

    - -  - -## Domain-level role-based delegation - - -The role-based delegation section of this tab displays and enables an AGPM Administrator to delegate allowed, denied, and inherited permissions for each group and user on the domain with access to the archive. An AGPM Administrator can configure domain-wide permissions using either standard AGPM roles (Editor, Approver, Reviewer, and AGPM Administrator) or a customized combination of permissions for each Group Policy administrator. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ButtonEffect

    Add

    Add a new entry to the security descriptor. Any users or groups in Active Directory can be added as Group Policy administrators.

    Remove

    Remove the selected Group Policy administrators from the Access Control List.

    Properties

    Display the properties for the selected Group Policy administrators. The properties page is the same one displayed for an object in Active Directory User and Computers.

    Advanced

    Open the Access Control List Editor.

    - -  - -### Additional considerations - -- For information about roles and permissions related to specific tasks, see the tasks under [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md), [Performing Editor Tasks](performing-editor-tasks.md), [Performing Approver Tasks](performing-approver-tasks.md), and [Performing Reviewer Tasks](performing-reviewer-tasks.md). - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/edit-a-gpo-offline-agpm30ops.md b/mdop/agpm/edit-a-gpo-offline-agpm30ops.md deleted file mode 100644 index 8e84747307..0000000000 --- a/mdop/agpm/edit-a-gpo-offline-agpm30ops.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Edit a GPO Offline -description: Edit a GPO Offline -author: dansimp -ms.assetid: 51677d8a-6209-41b5-82ed-4f3be817abc0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit a GPO Offline - - -To make changes to a controlled Group Policy Object (GPO), you must first check out a copy of the GPO from the archive. No one else will be able to modify the GPO until it is checked in again, preventing the introduction of conflicting changes by multiple Group Policy administrators. When you have finished modifying the GPO, you check it into the archive so that it can be reviewed and deployed to the production environment. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Editing a GPO offline - - -To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and then check the GPO into the archive so that it can be reviewed and deployed (or modified by other Editors). - -- [Check out a GPO from the archive for editing](#bkmk-checkout) - -- [Edit a GPO offline](#bkmk-edit) - -- [Check a GPO into the archive](#bkmk-checkin) - -### - -**To check out a GPO from the archive for editing** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be edited, and then click **Check Out**. - -4. Type a comment to be displayed in the History of the GPO while it is checked out, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is now identified as **Checked Out**. - -### - -**To edit a GPO offline** - -1. On the **Controlled** tab, right-click the GPO to be edited, and then click **Edit**. - -2. In the **Group Policy Management Editor** window, make changes to an offline copy of the GPO. - - **Note**   - To disable all Computer Configuration settings or all User Configuration settings, right-click the GPO in the **Group Policy Management Editor** window and click **Properties**. Select **Disable Computer Configuration settings** or **Disable User Configuration settings** as appropriate. - - - -3. When you have finished modifying the GPO, close the **Group Policy Management Editor** window. - -### - -**To check a GPO into the archive** - -1. On the **Controlled** tab: - - - If you have made no changes to the GPO, right-click the GPO and click **Undo Check Out**, and then click **Yes** to confirm. - - - If you have made changes to the GPO, right-click the GPO and click **Check In**. - -2. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -3. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- To check out and edit a GPO, by default you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. Additionally, to edit the GPO you must be the individual who has checked out the GPO. - -- To check in a GPO, by default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -- When editing a GPO, any Group Policy Software Installation upgrade of a package in another GPO should reference the deployed GPO, and not the checked-out copy. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -- Reviewing a GPO - - - [Review GPO Settings](review-gpo-settings-agpm30ops.md) - - - [Review GPO Links](review-gpo-links-agpm30ops.md) - - - [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md) - -- Deploying a GPO - - - [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm30ops.md) - - - [Deploy a GPO](deploy-a-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/edit-a-gpo-offline-agpm40.md b/mdop/agpm/edit-a-gpo-offline-agpm40.md deleted file mode 100644 index 6288426883..0000000000 --- a/mdop/agpm/edit-a-gpo-offline-agpm40.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Edit a GPO Offline -description: Edit a GPO Offline -author: dansimp -ms.assetid: 9c75eb3c-d4d5-41e0-b65e-8b4464a42cd9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit a GPO Offline - - -To make changes to a controlled Group Policy Object (GPO), you must first check out a copy of the GPO from the archive. No one else will be able to modify the GPO until it is checked in again, preventing the introduction of conflicting changes by multiple Group Policy administrators. When you have finished modifying the GPO, you check it into the archive so that it can be reviewed and deployed to the production environment. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Editing a GPO offline - - -To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and then check the GPO into the archive so that it can be reviewed and deployed (or modified by other Editors). - -- [Check out a GPO from the archive for editing](#bkmk-checkout) - -- [Edit a GPO offline](#bkmk-edit) - -- [Check a GPO into the archive](#bkmk-checkin) - -### - -**To check out a GPO from the archive for editing** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be edited, and then click **Check Out**. - -4. Type a comment to be displayed in the History of the GPO while it is checked out, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is now identified as **Checked Out**. - -### - -**To edit a GPO offline** - -1. On the **Controlled** tab, right-click the GPO to be edited, and then click **Edit**. - -2. In the **Group Policy Management Editor** window, make changes to an offline copy of the GPO. - - **Note**   - To disable all Computer Configuration settings or all User Configuration settings, right-click the GPO in the **Group Policy Management Editor** window and click **Properties**. Select **Disable Computer Configuration settings** or **Disable User Configuration settings** as appropriate. - - - -3. When you have finished modifying the GPO, close the **Group Policy Management Editor** window. - -### - -**To check a GPO into the archive** - -1. On the **Controlled** tab: - - - If you have made no changes to the GPO, right-click the GPO and click **Undo Check Out**, and then click **Yes** to confirm. - - - If you have made changes to the GPO, right-click the GPO and click **Check In**. - -2. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -3. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- To check out and edit a GPO, by default you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. Additionally, to edit the GPO you must be the individual who has checked out the GPO. - -- To check in a GPO, by default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -- When editing a GPO, any Group Policy Software Installation upgrade of a package in another GPO should reference the deployed GPO, and not the checked-out copy. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm40.md) - -- Reviewing a GPO - - - [Review GPO Settings](review-gpo-settings-agpm40.md) - - - [Review GPO Links](review-gpo-links-agpm40.md) - - - [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md) - -- Deploying a GPO - - - [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md) - - - [Deploy a GPO](deploy-a-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/edit-a-gpo-offline.md b/mdop/agpm/edit-a-gpo-offline.md deleted file mode 100644 index bc1aba3836..0000000000 --- a/mdop/agpm/edit-a-gpo-offline.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Edit a GPO Offline -description: Edit a GPO Offline -author: dansimp -ms.assetid: 4a148952-9fe9-4ec4-8df1-b25e37c97a54 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit a GPO Offline - - -To make changes to a controlled Group Policy object (GPO), you must first check out a copy of the GPO from the archive. No one else will be able to modify the GPO until it is checked in again, preventing the introduction of conflicting changes by multiple Group Policy administrators. When you have finished modifying the GPO, you check it into the archive, so it can be reviewed and deployed to the production environment. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Editing a GPO offline - - -To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and then check the GPO into the archive, so it can be reviewed and deployed (or modified by other Editors). - -- [Check out a GPO](#bkmk-checkout) - -- [Edit a GPO](#bkmk-edit) - -- [Check in a GPO](#bkmk-checkin) - -### - -**To check out a GPO from the archive for editing** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be edited, and then click **Check Out**. - -4. Type a comment to be displayed in the History of the GPO while it is checked out, then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is now identified as **Checked Out**. - -### - -**To edit a GPO offline** - -1. On the **Controlled** tab, right-click the GPO to be edited, and then click **Edit**. - -2. In the **Group Policy Object Editor**, make changes to an offline copy of the GPO. - -3. When you have finished modifying the GPO, close the **Group Policy Object Editor**. - -### - -**To check a GPO into the archive** - -1. On the **Controlled** tab: - - - If you have made no changes to the GPO, right-click the GPO and click **Undo Check Out**, then click **Yes** to confirm. - - - If you have made changes to the GPO, right-click the GPO and click **Check In**. - -2. Type a comment to be displayed in the audit trail of the GPO, and then click **OK**. - -3. When the **Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -### Additional considerations - -- To check out and edit a GPO, by default, you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. Additionally, to edit the GPO you must be the individual who has checked out the GPO. - -- To check in a GPO, by default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control). Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. If you are not an Approver or AGPM Administrator (or other Group Policy administrator with **Deploy GPO** permission), you must be the Editor who has checked out the GPO. - -- When editing a GPO, any Group Policy Software Installation upgrade of a package in another GPO should reference the deployed GPO, not the checked-out copy. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -- Reviewing a GPO - - - [Review GPO Settings](review-gpo-settings.md) - - - [Review GPO Links](review-gpo-links.md) - - - [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates.md) - -- Deploying a GPO - - - [Request Deployment of a GPO](request-deployment-of-a-gpo.md) - - - [Deploy a GPO](deploy-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/editing-a-gpo-agpm30ops.md b/mdop/agpm/editing-a-gpo-agpm30ops.md deleted file mode 100644 index 59b629a5c0..0000000000 --- a/mdop/agpm/editing-a-gpo-agpm30ops.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Editing a GPO -description: Editing a GPO -author: dansimp -ms.assetid: 3024051a-ff33-46d0-9c3e-68ebae7f6b60 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Editing a GPO - - -A Group Policy Object (GPO) must be controlled by Advanced Group Policy Management (AGPM) before you can edit it. See [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) for more information about controlling a GPO. - -To make changes to a GPO offline without immediately impacting the deployed copy of the GPO in the production environment, check out a copy of the GPO from the archive. When changes are complete, check the GPO back into the archive and request deployment of the GPO to the production environment. - -- [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md) - -- [Use a Test Environment](use-a-test-environment-agpm30ops.md) - -- [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm30ops.md) - -- [Label the Current Version of a GPO](label-the-current-version-of-a-gpo-agpm30ops.md) - -- [Rename a GPO or Template](rename-a-gpo-or-template-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/editing-a-gpo-agpm40.md b/mdop/agpm/editing-a-gpo-agpm40.md deleted file mode 100644 index affa8b706e..0000000000 --- a/mdop/agpm/editing-a-gpo-agpm40.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Editing a GPO -description: Editing a GPO -author: dansimp -ms.assetid: ef42eefe-7705-46b2-954d-18966335cbbf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Editing a GPO - - -A Group Policy Object (GPO) must be controlled by Advanced Group Policy Management (AGPM) before you can edit it. See [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) for more information about controlling a GPO. - -To make changes to a GPO offline without immediately impacting the deployed copy of the GPO in the production environment, check out a copy of the GPO from the archive. When changes are complete, check the GPO back into the archive, test it, and request deployment of the GPO to the production environment. - -- [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md) - -- [Label the Current Version of a GPO](label-the-current-version-of-a-gpo-agpm40.md) - -- [Rename a GPO or Template](rename-a-gpo-or-template-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/editing-a-gpo.md b/mdop/agpm/editing-a-gpo.md deleted file mode 100644 index 8569b51552..0000000000 --- a/mdop/agpm/editing-a-gpo.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Editing a GPO -description: Editing a GPO -author: dansimp -ms.assetid: ec77d3bb-8a64-4d8e-9c28-87763de02ec0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Editing a GPO - - -A Group Policy object (GPO) must be controlled by Advanced Group Policy Management (AGPM) before you can edit it. See [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) for more information about controlling a GPO. - -To make changes to a GPO offline without immediately impacting the deployed copy of the GPO in the production environment, check out a copy of the GPO from the archive. When changes are complete, check the GPO back into the archive and request deployment of the GPO to the production environment. - -- [Edit a GPO Offline](edit-a-gpo-offline.md) - -- [Use a Test Environment](use-a-test-environment.md) - -- [Request Deployment of a GPO](request-deployment-of-a-gpo.md) - -- [Label the Current Version of a GPO](label-the-current-version-of-a-gpo.md) - -- [Rename a GPO or Template](rename-a-gpo-or-template.md) - -  - -  - - - - - diff --git a/mdop/agpm/export-a-gpo-to-a-file.md b/mdop/agpm/export-a-gpo-to-a-file.md deleted file mode 100644 index 6cbcfe2245..0000000000 --- a/mdop/agpm/export-a-gpo-to-a-file.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Export a GPO to a File -description: Export a GPO to a File -author: dansimp -ms.assetid: 0d01b1f7-a6a4-4d0d-9aa7-2d6f1ae93d9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Export a GPO to a File - - -You can export a controlled Group Policy Object (GPO) to a CAB file so that you can copy it to a domain in another forest and import the GPO into Advanced Group Policy Management (AGPM) in that domain. For information about how to import GPO settings into a new or existing GPO, see [Import a GPO from a File](import-a-gpo-from-a-file-ed.md). - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To export a GPO to a file** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Export to**. - -4. Enter a file name for the file to which you want to export the GPO, and then click **Export**. If the file does not exist, it is created. If it already exists, it is replaced. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents**, **Read Settings**, and **Export GPO** permissions for the GPO. - -### Additional references - -- [Using a Test Environment](using-a-test-environment.md) - -  - -  - - - - - diff --git a/mdop/agpm/feature-visibility-settings-agpm30ops.md b/mdop/agpm/feature-visibility-settings-agpm30ops.md deleted file mode 100644 index 5a6f4b5583..0000000000 --- a/mdop/agpm/feature-visibility-settings-agpm30ops.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Feature Visibility Settings -description: Feature Visibility Settings -author: dansimp -ms.assetid: 6a844478-a6b0-490d-923f-5a6f82467831 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Feature Visibility Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Management Console\\Restricted/Permitted Snap-ins\\Extension Snap-ins when editing a GPO. - - ---- - - - - - - - - - - - - - - - - - - - - -
    SettingEffect

    AGPM: Show Change Control tab

    This policy setting allows you to control the visibility of the Change Control folder in the Group Policy Management Console (GPMC).

    AGPM: Show History tab for linked GPOs

    This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a linked GPO in the GPMC.

    AGPM: Show History tab for GPOs

    This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a GPO in the GPMC.

    - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/feature-visibility-settings-agpm40.md b/mdop/agpm/feature-visibility-settings-agpm40.md deleted file mode 100644 index 126b1eb425..0000000000 --- a/mdop/agpm/feature-visibility-settings-agpm40.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Feature Visibility Settings -description: Feature Visibility Settings -author: dansimp -ms.assetid: d3c0b02a-b943-4001-8b9c-dfac8fe58789 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Feature Visibility Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure the visibility of the **Change Control** folder and **History** tab for Group Policy administrators to whom a Group Policy Object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Policies\\Administrative Templates\\Windows Components\\Microsoft Management Console\\Restricted/Permitted Snap-ins\\Extension Snap-ins when editing a GPO. - - ---- - - - - - - - - - - - - - - - - - - - - -
    SettingEffect

    AGPM: Show Change Control tab

    This policy setting allows you to control the visibility of the Change Control folder in the Group Policy Management Console (GPMC).

    AGPM: Show History tab for linked GPOs

    This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a linked GPO in the GPMC.

    AGPM: Show History tab for GPOs

    This policy setting allows you to control the visibility of the History tab provided by AGPM when you view a GPO in the GPMC.

    - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/feature-visibility-settings.md b/mdop/agpm/feature-visibility-settings.md deleted file mode 100644 index 7a3848854c..0000000000 --- a/mdop/agpm/feature-visibility-settings.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Feature Visibility Settings -description: Feature Visibility Settings -author: dansimp -ms.assetid: 9db2ba03-fb75-4f95-9138-ec89b9fc8d01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Feature Visibility Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure the visibility of the **Change Control** node and **History** tab for Group Policy administrators to whom a Group Policy object (GPO) with these settings is applied. - -The following settings are available under User Configuration\\Administrative Templates\\Windows Components\\Microsoft Management Console\\Restricted/Permitted Snap-ins\\Extension Snap-ins in the **Group Policy Object Editor** when editing a GPO in the Group Policy Management Console (GPMC). If this path is not visible, right-click **Administrative Templates**, and add the agpm.admx or agpm.adm template. - - ---- - - - - - - - - - - - - - - - - - - - - -
    SettingEffect

    AGPM Change Control

    If enabled or not configured, the Change Control node is visible in the GPMC.

    -

    If disabled, the Change Control node is not visible in the GPMC.

    AGPM Link Extension

    If enabled or not configured, a History tab appears in the GPMC for each linked GPO.

    -

    If disabled, the History tab is not visible for linked GPOs.

    AGPM GPO Extension

    If enabled or not configured, a History tab appears in the GPMC for each GPO.

    -

    If disabled, the History tab is not visible for GPOs.

    - -  - -### Additional references - -- [Administrative Template Settings](administrative-template-settings.md) - -  - -  - - - - - diff --git a/mdop/agpm/history-window-agpm30ops.md b/mdop/agpm/history-window-agpm30ops.md deleted file mode 100644 index bc85f0fee8..0000000000 --- a/mdop/agpm/history-window-agpm30ops.md +++ /dev/null @@ -1,204 +0,0 @@ ---- -title: History Window -description: History Window -author: dansimp -ms.assetid: 114f50a4-508d-4589-b006-6cd05cffe6b7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# History Window - - -The history of a Group Policy Object (GPO) can be displayed by double-clicking a GPO or by right-clicking a GPO and then clicking **History**. It is also displayed in the **Group Policy Management Console** (GPMC) as a tab for each GPO. - -The history provides a record of events in the lifetime of the selected GPO. From the **History** window, you can obtain a report of the settings within a version of the GPO, compare multiple versions of a GPO, or roll back to a previous version of a GPO. - -## Filtering events in the History window - - -The tabs within the **History** window filter the states in the history of the GPO. - - ---- - - - - - - - - - - - - - - - - -
    TabsFiltering

    All States

    Display all states in the history of the GPO.

    Unique Versions

    Display only unique versions of the GPO checked into the archive. The version deployed to the production environment, shortcuts to unique versions, and informational states are omitted from this list.

    - - - -## Event information - - -Information is provided for each state in the history of the GPO. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    GPO attributeDescription

    Change Date

    Time stamp of when the action in the State column was performed.

    State

    A state in the history of the GPO.

    Changed By

    The person who checked in or deployed the GPO.

    Comment

    A comment entered by the person who checked in or deployed a GPO at the time that this version was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version.

    Deletable

    Whether this version of the GPO can be deleted if the number of unique versions of each GPO retained in the archive is limited.

    -
    -Note

    You can modify whether a version of a GPO is deletable by right-clicking it and then clicking Do Not Allow Deletion or Allow Deletion.

    -
    -
    - -

    Computer Version

    Automatically generated version of the Computer Configuration portion of the GPO.

    User Version

    Automatically generated version of the User Configuration portion of the GPO.

    GPO Status

    The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled.

    WMI Filter

    Display any WMI filters that are applied to this GPO. WMI filters are managed under the WMI Filters folder for the domain in the console tree of the GPMC.

    - - - -## Reports - - -The **Settings** and **Differences** buttons display reports about GPO settings for the GPO version or versions selected. Right-clicking GPO versions provides the option to display XML-based reports as well. - - ---- - - - - - - - - - - - - - - - - -
    ButtonEffect

    Settings

    Generate an HTML-based report displaying the settings within the selected version of the GPO.

    Differences

    Generate an HTML-based report comparing the settings within multiple selected versions of the GPO.

    - - - -### Key to difference reports - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SymbolMeaningColor

    None

    Item exists with identical settings in both GPOs

    Varies with level

    [#]

    Item exists in both GPOs, but with changed settings

    Blue

    [-]

    Item exists only in the first GPO

    Red

    [+]

    Item exists only in the second GPO

    Green

    - - - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second), rather than as one item that has changed. - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/history-window-agpm40.md b/mdop/agpm/history-window-agpm40.md deleted file mode 100644 index 0d1f91b021..0000000000 --- a/mdop/agpm/history-window-agpm40.md +++ /dev/null @@ -1,204 +0,0 @@ ---- -title: History Window -description: History Window -author: dansimp -ms.assetid: 5bea62e7-d267-40b2-a66d-fb1be7373a1c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# History Window - - -The history of a Group Policy Object (GPO) can be displayed by double-clicking a GPO or by right-clicking a GPO and then clicking **History**. It is also displayed in the Group Policy Management Console (GPMC) as a tab for each GPO. - -The history provides a record of events in the lifetime of the selected GPO. From the **History** window, you can obtain a report of the settings in a version of the GPO, compare multiple versions of a GPO, or roll back to an earlier version of a GPO. - -## Filtering events in the History window - - -The tabs within the **History** window filter the states in the history of the GPO. - - ---- - - - - - - - - - - - - - - - - -
    TabsFiltering

    All States

    Display all states in the history of the GPO.

    Unique Versions

    Display only unique versions of the GPO checked into the archive. The version deployed to the production environment, shortcuts to unique versions, and informational states are omitted from this list.

    - - - -## Event information - - -Information is provided for each state in the history of the GPO. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    GPO attributeDescription

    Change Date

    Time stamp of when the action in the State column was performed.

    State

    A state in the history of the GPO.

    Changed By

    The person who checked in or deployed the GPO.

    Comment

    A comment entered by the person who checked in or deployed a GPO at the time that this version was changed, useful for identifying the specifics of the version in case of the need to roll back to an earlier version.

    Deletable

    Whether this version of the GPO can be deleted if the number of unique versions of each GPO retained in the archive is limited.

    -
    -Note

    You can change whether a version of a GPO can be deleted by right-clicking the GPO and then clicking Do Not Allow Deletion or Allow Deletion.

    -
    -
    - -

    Computer Version

    Automatically generated version of the Computer Configuration part of the GPO.

    User Version

    Automatically generated version of the User Configuration part of the GPO.

    GPO Status

    The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled.

    Source GPO Information

    For a GPO that has been imported from another forest, the original GPO name, domain, and user and date associated with the last change.

    - - - -## Reports - - -The **Settings** and **Differences** buttons display reports about GPO settings for the GPO version or versions selected. Also, right-clicking a GPO version or versions provides the option to display XML-based reports. - - ---- - - - - - - - - - - - - - - - - -
    ButtonEffect

    Settings

    Generate an HTML-based report displaying the settings within the selected version of the GPO.

    Differences

    Generate an HTML-based report comparing the settings within multiple selected versions of the GPO.

    - - - -### Key to difference reports - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SymbolMeaningColor

    None

    Item exists with identical settings in both GPOs

    Varies with level

    [#]

    Item exists in both GPOs, but with changed settings

    Blue

    [-]

    Item exists only in the first GPO

    Red

    [+]

    Item exists only in the second GPO

    Green

    - - - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two items (one present only in the first GPO, one present only in the second), instead of one item that has changed. - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/history-window.md b/mdop/agpm/history-window.md deleted file mode 100644 index 7de100917a..0000000000 --- a/mdop/agpm/history-window.md +++ /dev/null @@ -1,199 +0,0 @@ ---- -title: History Window -description: History Window -author: dansimp -ms.assetid: f11f9ad9-bffe-4c56-8c46-fe9c0a8e55c1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# History Window - - -The history of a Group Policy object (GPO) can be displayed by double-clicking a GPO or by right-clicking a GPO and then clicking **History**. It is also displayed in the **Group Policy Management Console** (GPMC) as a tab for each GPO. - -The history provides a list of all versions of the selected GPO saved within the archive. From the **History** window, you can obtain a report of the settings within a GPO, compare multiple versions of a GPO, or roll back to a previous version of a GPO. - -## Filtering events in the History window - - -The tabs within the **History** window filter the events displayed. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TabsFiltering

    Show All

    Display all versions of the GPO.

    Checked In

    Display only checked-in versions of the GPO. The deployed version is omitted from this list.

    Labels Only

    Display only GPOs that have labels associated with them.

    - -  - -## Event information - - -Information is provided for each event in the history of the selected GPO. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    GPO CharacteristicDescription

    Computer

    Automatically generated version of the Computer Configuration portion of the GPO.

    User

    Automatically generated version of the User Configuration portion of the GPO.

    Time

    Timestamp of the version of the GPO when the action in the status field was performed.

    State

    The state of the selected version of the GPO:

    -

    Deployed GPO icon Deployed: This version of the GPO is currently live in the production environment.

    -

    Checked in GPO icon Checked In: This version of the GPO is available for authorized Editors to check out for editing or for a Group Policy administrator to deploy.

    -

    Checked out GPO icon Checked Out: This version of the GPO is currently checked out by an Editor and is unavailable for other Editors. (The checked out state is not recorded in the History except to indicate if a GPO is currently checked out.)

    -

    Created GPO icon Created: Identifies the date and time of the initial creation of the GPO.

    -

    Labeled GPO icon Labeled: Identifies a labeled version of the GPO.

    GPO Status

    The Computer Configuration and the User Configuration can be managed separately from each other. This status shows which portions of the GPO are enabled.

    Owner

    The person who checked in or deployed the GPO.

    Comment

    A comment entered by the owner of a GPO at the time that this version was modified. Useful for identifying the specifics of the version in case of the need to roll back to a previous version.

    - -  - -## Reports - - -Depending on whether a single GPO version or multiple GPO versions are selected, the **Settings** and **Differences** buttons display reports on GPO settings. Right-clicking GPO versions provides the option to display XML-based reports as well. - - ---- - - - - - - - - - - - - - - - - -
    ButtonEffect

    Settings

    Generate an HTML-based report displaying the settings within the selected version of the GPO.

    Differences

    Generate an HTML-based report comparing the settings within multiple selected versions of the GPO.

    - -  - -### Key to difference reports - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SymbolMeaningColor

    None

    Item exists with identical settings in both GPOs

    Varies with level

    [#]

    Item exists in both GPOs, but with changed settings

    Blue

    [-]

    Item exists only in the first GPO

    Red

    [+]

    Item exists only in the second GPO

    Green

    - -  - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second), rather than as one item that has changed. - -### Additional references - -- [Contents Tab](contents-tab.md) - -  - -  - - - - - diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md deleted file mode 100644 index b7d575576e..0000000000 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: Identify Differences Between GPOs, GPO Versions, or Templates -description: Identify Differences Between GPOs, GPO Versions, or Templates -author: dansimp -ms.assetid: e391fa91-3956-4150-9d43-900cfc88d543 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identify Differences Between GPOs, GPO Versions, or Templates - - -You can generate HTML-based or XML-based difference reports to analyze the differences between Group Policy Objects (GPOs), templates, or different versions of a GPO. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Identifying differences between GPOs, GPO versions, or templates - - -- [Between two GPOs or templates](#bkmk-two-gpos) - -- [Between a GPO and a template](#bkmk-gpo-and-template) - -- [Between two versions of one GPO](#bkmk-two-versions) - -- [Between a GPO version and a template](#bkmk-gpo-version-and-template) - -## - - -**To identify differences between two GPOs or templates** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Select the two GPOs or templates. - -4. Right-click one of the GPOs or templates, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs or templates. - -### - -**To identify differences between a GPO and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Right-click the GPO, click **Differences**, and then click **Template**. - -4. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO and template. - -### - -**To identify differences between two versions of one GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history, and then highlight the versions to be compared. - -4. Right-click one of the versions, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs. - -### - -**To identify differences between a GPO version and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version of interest, click **Differences**, and then click **Template**. - -5. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO version and template. - -## Key to difference reports - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SymbolMeaningColor

    None

    Item exists with identical settings in both GPOs

    Varies with level

    [#]

    Item exists in both GPOs, but with changed settings

    Blue

    [-]

    Item exists only in the first GPO

    Red

    [+]

    Item exists only in the second GPO

    Green

    - -  - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second) rather than as one item that has changed. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md deleted file mode 100644 index 6201499127..0000000000 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: Identify Differences Between GPOs, GPO Versions, or Templates -description: Identify Differences Between GPOs, GPO Versions, or Templates -author: dansimp -ms.assetid: 3f03c368-162b-450f-be6c-2807c3e8d741 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identify Differences Between GPOs, GPO Versions, or Templates - - -You can generate HTML-based or XML-based difference reports to analyze the differences between Group Policy Objects (GPOs), templates, or different versions of a GPO. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Identifying differences between GPOs, GPO versions, or templates - - -- [Between two GPOs or templates](#bkmk-two-gpos) - -- [Between a GPO and a template](#bkmk-gpo-and-template) - -- [Between two versions of one GPO](#bkmk-two-versions) - -- [Between a GPO version and a template](#bkmk-gpo-version-and-template) - -## - - -**To identify differences between two GPOs or templates** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Select the two GPOs or templates. - -4. Right-click one of the GPOs or templates, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs or templates. - -### - -**To identify differences between a GPO and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Right-click the GPO, click **Differences**, and then click **Template**. - -4. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO and template. - -### - -**To identify differences between two versions of one GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history, and then highlight the versions to be compared. - -4. Right-click one of the versions, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs. - -### - -**To identify differences between a GPO version and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version of interest, click **Differences**, and then click **Template**. - -5. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO version and template. - -## Key to difference reports - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SymbolMeaningColor

    None

    Item exists with identical settings in both GPOs

    Varies with level

    [#]

    Item exists in both GPOs, but with changed settings

    Blue

    [-]

    Item exists only in the first GPO

    Red

    [+]

    Item exists only in the second GPO

    Green

    - -  - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second) rather than as one item that has changed. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md deleted file mode 100644 index 684eac2b0a..0000000000 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: Identify Differences Between GPOs, GPO Versions, or Templates -description: Identify Differences Between GPOs, GPO Versions, or Templates -author: dansimp -ms.assetid: 6320afc4-af81-47e8-9f4c-463ff99d5a53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identify Differences Between GPOs, GPO Versions, or Templates - - -You can generate HTML-based or XML-based difference reports to analyze the differences between Group Policy objects (GPOs), templates, or different versions of a GPO. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Identifying differences between GPOs, GPO versions, or templates - - -- [Between two GPOs or templates](#bkmk-two-gpos) - -- [Between a GPO and a template](#bkmk-gpo-and-template) - -- [Between two versions of one GPO](#bkmk-two-versions) - -- [Between a GPO version and a template](#bkmk-gpo-version-and-template) - -## - - -**To identify differences between two GPOs or templates** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Select the two GPOs or templates. - -4. Right-click one of the GPOs or templates, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs or templates. - -### - -**To identify differences between a GPO and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Right-click the GPO, click **Differences**, and then click **Template**. - -4. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO and template. - -### - -**To identify differences between two versions of one GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history, and then highlight the versions to be compared. - -4. Right-click one of the versions, click **Differences**, and then click **HTML Report** or **XML Report** to display a difference report summarizing the settings of the GPOs. - -### - -**To identify differences between a GPO version and a template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs (or templates, if comparing two templates). - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version of interest, click **Differences**, and then click **Template**. - -5. Select the template and type of report, and then click **OK** to display a difference report summarizing the settings of the GPO version and template. - -## Key to difference reports - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SymbolMeaningColor

    None

    Item exists with identical settings in both GPOs

    Varies with level

    [#]

    Item exists in both GPOs, but with changed settings

    Blue

    [-]

    Item exists only in the first GPO

    Red

    [+]

    Item exists only in the second GPO

    Green

    - -  - -- For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report. - -- Some changes to settings may cause an item to be reported as two different items (one present only in the first GPO, one present only in the second) rather than as one item that has changed. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/images/0840a6a3-54a6-4528-98a9-7b122243c1a5.gif b/mdop/agpm/images/0840a6a3-54a6-4528-98a9-7b122243c1a5.gif deleted file mode 100644 index 92fb2d9983..0000000000 Binary files a/mdop/agpm/images/0840a6a3-54a6-4528-98a9-7b122243c1a5.gif and /dev/null differ diff --git a/mdop/agpm/images/327623bd-0842-4372-be1f-bdc4b8c3481c.gif b/mdop/agpm/images/327623bd-0842-4372-be1f-bdc4b8c3481c.gif deleted file mode 100644 index c44fbda129..0000000000 Binary files a/mdop/agpm/images/327623bd-0842-4372-be1f-bdc4b8c3481c.gif and /dev/null differ diff --git a/mdop/agpm/images/36f6b687-f5cc-40d1-805f-b191d1fb1ace.gif b/mdop/agpm/images/36f6b687-f5cc-40d1-805f-b191d1fb1ace.gif deleted file mode 100644 index 08cd486435..0000000000 Binary files a/mdop/agpm/images/36f6b687-f5cc-40d1-805f-b191d1fb1ace.gif and /dev/null differ diff --git a/mdop/agpm/images/57b610a5-1c71-4d26-9173-d04abd495fcc.gif b/mdop/agpm/images/57b610a5-1c71-4d26-9173-d04abd495fcc.gif deleted file mode 100644 index 7cde9d24a1..0000000000 Binary files a/mdop/agpm/images/57b610a5-1c71-4d26-9173-d04abd495fcc.gif and /dev/null differ diff --git a/mdop/agpm/images/8356fcdc-1279-425b-ab14-a23bcfe391da.gif b/mdop/agpm/images/8356fcdc-1279-425b-ab14-a23bcfe391da.gif deleted file mode 100644 index a911ef77d0..0000000000 Binary files a/mdop/agpm/images/8356fcdc-1279-425b-ab14-a23bcfe391da.gif and /dev/null differ diff --git a/mdop/agpm/images/8e7a7c4e-809a-435a-8b29-30d797936210.gif b/mdop/agpm/images/8e7a7c4e-809a-435a-8b29-30d797936210.gif deleted file mode 100644 index 9514d106f5..0000000000 Binary files a/mdop/agpm/images/8e7a7c4e-809a-435a-8b29-30d797936210.gif and /dev/null differ diff --git a/mdop/agpm/images/9b65829d-253c-4f30-9295-c816a6521ed2.gif b/mdop/agpm/images/9b65829d-253c-4f30-9295-c816a6521ed2.gif deleted file mode 100644 index 7fa479c173..0000000000 Binary files a/mdop/agpm/images/9b65829d-253c-4f30-9295-c816a6521ed2.gif and /dev/null differ diff --git a/mdop/agpm/images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif b/mdop/agpm/images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif deleted file mode 100644 index e5c857fb6a..0000000000 Binary files a/mdop/agpm/images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif and /dev/null differ diff --git a/mdop/agpm/images/cd349b8d-c4d8-45ff-b17f-7db882502c58.gif b/mdop/agpm/images/cd349b8d-c4d8-45ff-b17f-7db882502c58.gif deleted file mode 100644 index 0a689c5b02..0000000000 Binary files a/mdop/agpm/images/cd349b8d-c4d8-45ff-b17f-7db882502c58.gif and /dev/null differ diff --git a/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md b/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md deleted file mode 100644 index ae05829359..0000000000 --- a/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Import a GPO from a File -description: Import a GPO from a File -author: dansimp -ms.assetid: 2cbcda72-4de3-47ad-aaf8-4fc7341d5a00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from a File - - -In Advanced Group Policy Management (AGPM), if you are an AGPM Administrator (Full Control) and you have exported a Group Policy Object (GPO) to a CAB file, you can import the policy settings from that GPO into a new GPO or an existing GPO in a domain in another forest. For information about exporting GPO settings to a CAB file, see [Export a GPO to a File](export-a-gpo-to-a-file.md). - -A user account with the AGPM Administrator role or the necessary permissions in AGPM is required to import policy settings into a new controlled GPO. A user account with the Editor or AGPM Administrator role or necessary permissions in AGPM is required to import policy settings into an existing GPO. Review the details in "Additional considerations" in this topic. - -## Importing policy settings from a file - - -When you import policy settings from a file, you can import them into a new GPO or an existing GPO. However, if you import policy settings into an existing GPO, all policy settings within it are replaced. - -- [Import policy settings into a new controlled GPO](#bkmk-new) - -- [Import policy settings into an existing GPO](#bkmk-existing) - -### - -**To import policy settings into a new controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the domain to which you want to import policy settings. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Create a new controlled GPO. In the **New Controlled GPO** dialog box, click **Import** and then click **Launch Wizard**. For more information about how to create a GPO, see [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm40.md). - -4. Follow the instructions in the **Import Settings Wizard** to select a GPO backup, import policy settings from it for the new GPO, and enter a comment for the audit trail of the new GPO. - -### - -**To import policy settings into an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the domain to which you want to import policy settings. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Check out the destination GPO to which you want to import policy settings. - -4. Right-click the destination GPO, point to **Import from**, and then click **File**. - -5. Follow the instructions in the **Import Settings Wizard** to select a GPO backup, import its policy settings to replace those in the destination GPO, and enter a comment for the audit trail of the destination GPO. By default, the destination GPO is checked in when the wizard is finished. - -### Additional considerations - -- To import policy settings to a new controlled GPO, you must have **List Contents**, **Import GPO**, and **Create GPO** permissions for the domain. By default, you must be an AGPM Administrator to perform this procedure. - -- To import policy settings to an existing GPO, you must have **List Contents**, **Edit Settings**, and **Import GPO** permissions for the domain, and the GPO must be checked out by you. By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. - -### Additional references - -- [Managing the Archive](managing-the-archive-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-a-file-ed.md b/mdop/agpm/import-a-gpo-from-a-file-ed.md deleted file mode 100644 index 7029d3c69e..0000000000 --- a/mdop/agpm/import-a-gpo-from-a-file-ed.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Import a GPO from a File -description: Import a GPO from a File -author: dansimp -ms.assetid: 6e901a52-1101-4fed-9f90-3819b573b378 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from a File - - -In Advanced Group Policy Management (AGPM), if you have exported a Group Policy Object (GPO) to a CAB file, you can import the policy settings from that GPO into an existing GPO in a domain in another forest. Importing policy settings into an existing GPO replaces all policy settings within that GPO. For information about exporting GPO settings to a CAB file, see [Export a GPO to a File](export-a-gpo-to-a-file.md). - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## - - -**To import policy settings into an existing GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the domain to which you want to import policy settings. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Check out the destination GPO to which you want to import policy settings. - -4. Right-click the destination GPO, point to **Import from**, and then click **File**. - -5. Follow the instructions in the **Import Settings Wizard** to select a GPO backup, import its policy settings to replace those in the destination GPO, and enter a comment for the audit trail of the destination GPO. By default, the destination GPO is checked in when the wizard is finished. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents**, **Edit Settings**, and **Import GPO** permissions for the domain, and the GPO must be checked out by you. - -- Although an Editor cannot import policy settings into a new GPO during its creation, an Editor can request the creation of a new GPO and then import policy settings into it after it is created. - -### Additional references - -- [Using a Test Environment](using-a-test-environment.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-agpm30ops.md b/mdop/agpm/import-a-gpo-from-production-agpm30ops.md deleted file mode 100644 index 7754206dd0..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-agpm30ops.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: dansimp -ms.assetid: 35c2a682-ece8-4577-a083-7e3e9facfd13 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy Object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm30ops.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in AGPM is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-agpm40-app.md b/mdop/agpm/import-a-gpo-from-production-agpm40-app.md deleted file mode 100644 index cc8288be07..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-agpm40-app.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: dansimp -ms.assetid: c5b2f40d-1dc7-4dbf-b8b3-4d97ad73e1e5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy Object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment of the domain and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm40.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in AGPM is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md b/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md deleted file mode 100644 index fcddfd97af..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: dansimp -ms.assetid: ad14203a-2e6a-41d4-a05e-4508c80045fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy Object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment of the domain and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Request Control of an Uncontrolled GPO](request-control-of-an-uncontrolled-gpo-agpm40.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in AGPM is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-approver.md b/mdop/agpm/import-a-gpo-from-production-approver.md deleted file mode 100644 index 0f31b8a9c4..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-approver.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: dansimp -ms.assetid: 071270fa-1890-40ce-ab89-ce070a54aa59 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Control a Previously Uncontrolled GPO](control-a-previously-uncontrolled-gpo.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md b/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md deleted file mode 100644 index 272f402550..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: dansimp -ms.assetid: ad90f13e-e73c-400f-b86f-c12f2e75d19d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy Object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Control an Uncontrolled GPO](control-an-uncontrolled-gpo-agpm30ops.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in AGPM is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, and then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/import-a-gpo-from-production-editor.md b/mdop/agpm/import-a-gpo-from-production-editor.md deleted file mode 100644 index 15f7c96a1f..0000000000 --- a/mdop/agpm/import-a-gpo-from-production-editor.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Import a GPO from Production -description: Import a GPO from Production -author: dansimp -ms.assetid: ffa02b2a-2a43-4fc0-a06e-7d4b59022cc3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Import a GPO from Production - - -If changes are made to a controlled Group Policy object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See [Request Control of a Previously Uncontrolled GPO](request-control-of-a-previously-uncontrolled-gpo.md).) - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To import a GPO from the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO, and then click **Import from Production**. - -4. Type a comment for the audit trail of the GPO, then click **OK**. - -### Additional considerations - -- By default, you must be an Editor, Approver, or AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) - -  - -  - - - - - diff --git a/mdop/agpm/index.md b/mdop/agpm/index.md deleted file mode 100644 index bd78561b83..0000000000 --- a/mdop/agpm/index.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Advanced Group Policy Management -description: Advanced Group Policy Management -author: dansimp -ms.assetid: 493ca3c3-c3d6-4bb1-9430-dc1e43c86bb0 -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/23/2017 ---- - - -# Advanced Group Policy Management - - -Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of the Group Policy Management Console (GPMC) to provide comprehensive change control and improved management for Group Policy Objects (GPOs). AGPM is available as part of the Microsoft Desktop Optimization Pack (MDOP) for Software Assurance. - -## AGPM Version Information - - -[AGPM 4.0 SP3](agpm-40-sp3-navengl.md) supports Windows 10, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. - -[AGPM 4.0 SP2](agpm-40-sp2-navengl.md) supports Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. - -[AGPM 4.0 SP1](agpm-40-sp1-navengl.md) supports Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. - -[AGPM 4](agpm-4-navengl.md) supports Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1. - -[AGPM 3](agpm-3-navengl.md) supports Windows Server 2008 and Windows Vista with SP1. - -[AGPM 2.5](agpm-25-navengl.md) supports Windows Vista (32-bit) with no service pack and Windows Server 2003 (32-bit). - -## Supplemental MDOP Product Guidance - - -In addition to the product documentation available online, supplemental product guidance such as informational videos and virtual labs are available for most MDOP products. - - ---- - - - - - - - - - - -

    MDOP Virtual Labs

    For a list of available MDOP virtual labs, go to Microsoft Desktop Optimization Pack (MDOP) Virtual Labs (https://go.microsoft.com/fwlink/?LinkId=234276).

    MDOP TechCenter

    For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to MDOP TechCenter (https://go.microsoft.com/fwlink/?LinkId=225286)

    -

    - - - -## How to Get MDOP - - -MDOP is a suite of products that can help streamline desktop deployment, management, and support across the enterprise. MDOP is available as an additional subscription for Software Assurance customers. - -**Evaluate MDOP** -MDOP is also available for test and evaluation to [MSDN](https://msdn.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) and [TechNet](https://technet.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) subscribers in accordance with MSDN and TechNet agreements. - -**Download MDOP** -MDOP subscribers can download the software at the [Microsoft Volume Licensing website (MVLS)](https://go.microsoft.com/fwlink/?LinkId=166331). - -**Purchase MDOP** -Visit the enterprise [Purchase Windows Enterprise Licensing](https://www.microsoft.com/windows/enterprise/how-to-buy.aspx) website to find out how to purchase MDOP for your business. - - - - - - - - - diff --git a/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md b/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md deleted file mode 100644 index 12807c514e..0000000000 --- a/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Label the Current Version of a GPO -description: Label the Current Version of a GPO -author: dansimp -ms.assetid: 3845211a-0bc9-4875-9906-cb758c443825 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Label the Current Version of a GPO - - -You can label the current version of a Group Policy Object (GPO) for easy identification in its history. You can use a label to identify a known good version to which you could roll back if a problem occurs. Also, by labeling multiple GPOs with the same label at one time, you can mark related GPOs that should be rolled back to the same point if rollback should later be necessary. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To label the current version of GPOs in their histories** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Click a GPO for which to label the current version. To select multiple GPOs, press SHIFT and click the last GPO in a contiguous group of GPOs, or press CTRL and click individual GPOs. Right-click a selected GPO, and then click **Label**. - -4. Type a label and a comment to be displayed in the history of each GPO selected, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md b/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md deleted file mode 100644 index 9374aa08cd..0000000000 --- a/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Label the Current Version of a GPO -description: Label the Current Version of a GPO -author: dansimp -ms.assetid: cadc8769-21da-44b0-8122-6cafdb448913 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Label the Current Version of a GPO - - -You can label the current version of a Group Policy Object (GPO) for easy identification in its history. You can use a label to identify a known good version to which you could roll back if a problem occurs. Also, by labeling multiple GPOs with the same label at one time, you can mark related GPOs that should be rolled back to the same point if rollback should later be necessary. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To label the current version of GPOs in their histories** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Click a GPO for which to label the current version. To select multiple GPOs, press SHIFT and click the last GPO in a contiguous group of GPOs, or press CTRL and click individual GPOs. Right-click a selected GPO, and then click **Label**. - -4. Type a label and a comment to be displayed in the history of each GPO selected, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/label-the-current-version-of-a-gpo.md b/mdop/agpm/label-the-current-version-of-a-gpo.md deleted file mode 100644 index e4608abdad..0000000000 --- a/mdop/agpm/label-the-current-version-of-a-gpo.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Label the Current Version of a GPO -description: Label the Current Version of a GPO -author: dansimp -ms.assetid: 5e4e50f8-e4a8-4bda-aac4-1569d5fbd6a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Label the Current Version of a GPO - - -You can label the current version of a Group Policy object (GPO) for easy identification in its history. You can use a label to identify a known good version to which you could roll back if a problem occurs. Also, by labeling multiple GPOs with the same label at one time, you can mark related GPOs that should be rolled back to the same point if rollback should later be necessary. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To label the current version of GPOs in their histories** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Click a GPO for which to label the current version. To select multiple GPOs, press SHIFT and click the last GPO in a contiguous group of GPOs, or press CTRL and click individual GPOs. Right-click a selected GPO, and then click **Label**. - -4. Type a label and a comment to be displayed in the history of each GPO selected, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings** or **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md b/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md deleted file mode 100644 index 35f49b04fd..0000000000 --- a/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Limit the GPO Versions Stored -description: Limit the GPO Versions Stored -author: dansimp -ms.assetid: da14edc5-0c36-4c54-b122-861c86b99eb1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Limit the GPO Versions Stored - - -By default, all versions of every controlled Group Policy Object (GPO) are retained in the archive on the AGPM Server. However, you can limit the number of versions retained for each GPO and delete older versions when that limit is exceeded. When GPO versions are deleted, a record of the version remains in the history of the GPO, but the GPO version itself is deleted from the archive. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To limit the number of GPO versions stored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Select the **Delete old versions of each GPO from the archive** check box, and type the maximum number of GPO versions to store for each GPO, not including the current version. To retain only the current version, enter 0. The maximum must be no greater than 999. - - **Important**   - Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit. - - - -4. Click the **Apply** button. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- You can prevent a GPO version from being deleted by marking it in the history as ineligible for deletion. To do so, right-click the version in the history of the GPO and click **Do Not Delete**. - -### Additional references - -- [Managing the Archive](managing-the-archive.md) - - - - - - - - - diff --git a/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md b/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md deleted file mode 100644 index 6d48c8c1eb..0000000000 --- a/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Limit the GPO Versions Stored -description: Limit the GPO Versions Stored -author: dansimp -ms.assetid: d802c7b6-f303-4b23-aefd-f19f1300b0ff -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Limit the GPO Versions Stored - - -By default, all versions of every controlled Group Policy Object (GPO) are retained in the archive on the AGPM Server. However, you can limit the number of versions retained for each GPO and delete older versions when that limit is exceeded. When GPO versions are deleted, a record of the version remains in the history of the GPO, but the GPO version itself is deleted from the archive. - -A user account with the AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To limit the number of GPO versions stored** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **AGPM Server** tab. - -3. Select the **Delete old versions of each GPO from the archive** check box, and type the maximum number of GPO versions to store for each GPO, not including the current version. To retain only the current version, enter 0. The maximum must be no greater than 999. - - **Important**   - Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit. - - - -4. Click the **Apply** button. - -### Additional considerations - -- By default, you must be an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Modify Options** permissions for the domain. - -- You can prevent a GPO version from being deleted by marking it in the history as ineligible for deletion. To do so, right-click the version in the history of the GPO and click **Do Not Delete**. - -### Additional references - -- [Managing the Archive](managing-the-archive-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/logging-and-tracing-settings-agpm30ops.md b/mdop/agpm/logging-and-tracing-settings-agpm30ops.md deleted file mode 100644 index 82b6e1ce94..0000000000 --- a/mdop/agpm/logging-and-tracing-settings-agpm30ops.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Logging and Tracing Settings -description: Logging and Tracing Settings -author: dansimp -ms.assetid: 858b6fbf-65b4-42fa-95a9-69b04e5734d7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Logging and Tracing Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Servers and clients to which a Group Policy Object (GPO) with these settings is applied. - -The following setting is available under Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. - -**Trace file locations**: - -- Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - -- Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - - ---- - - - - - - - - - - - - -
    SettingEffect

    AGPM: Configure logging

    This policy setting allows you to turn on and configure logging for AGPM. This setting affects both client and server components of AGPM.

    - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/logging-and-tracing-settings-agpm40.md b/mdop/agpm/logging-and-tracing-settings-agpm40.md deleted file mode 100644 index fd2477a527..0000000000 --- a/mdop/agpm/logging-and-tracing-settings-agpm40.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Logging and Tracing Settings -description: Logging and Tracing Settings -author: dansimp -ms.assetid: 66d03306-80d8-4132-bf71-2827157b1fc9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Logging and Tracing Settings - - -The Administrative template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Servers and clients to which a Group Policy Object (GPO) with these settings is applied. - -The following setting is available under Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\AGPM when editing a GPO. - -**Trace file locations**: - -- Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - -- Server: %ProgramData%\\Microsoft\\AGPM\\agpmserv.log - - ---- - - - - - - - - - - - - -
    SettingEffect

    AGPM: Configure logging

    This policy setting allows you to turn on and configure logging for AGPM. This setting affects both client and server components of AGPM.

    - -  - -### Additional references - -- [Administrative Templates Folder](administrative-templates-folder-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/logging-and-tracing-settings.md b/mdop/agpm/logging-and-tracing-settings.md deleted file mode 100644 index ff3a6190db..0000000000 --- a/mdop/agpm/logging-and-tracing-settings.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Logging and Tracing Settings -description: Logging and Tracing Settings -author: dansimp -ms.assetid: db6b43c7-fdde-4d11-b5ab-a81346e56940 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Logging and Tracing Settings - - -The Administrative Template settings for Advanced Group Policy Management (AGPM) enable you to centrally configure logging and tracing options for AGPM Servers and clients to which a Group Policy object (GPO) with these settings is applied. - -The following setting is available under Computer Configuration\\Administrative Templates\\Windows Components\\AGPM in the **Group Policy Object Editor** when editing a GPO in the Group Policy Management Console (GPMC). If this path is not visible, right-click **Administrative Templates**, and add the agpm.admx or agpm.adm template. - -**Trace file locations**: - -- Client: %LocalAppData%\\Microsoft\\AGPM\\agpm.log - -- Server: %CommonAppData%\\Microsoft\\AGPM\\agpmserv.log - - ---- - - - - - - - - - - - - -
    SettingEffect

    AGPM Logging

    If enabled, this setting configures whether tracing is turned on and the level of detail. This setting affects both client and server components of AGPM.

    -

    If disabled or not configured, this setting has no effect.

    - -  - -### Additional references - -- [Administrative Template Settings](administrative-template-settings.md) - -  - -  - - - - - diff --git a/mdop/agpm/managing-the-agpm-service-agpm30ops.md b/mdop/agpm/managing-the-agpm-service-agpm30ops.md deleted file mode 100644 index 91793ce0d5..0000000000 --- a/mdop/agpm/managing-the-agpm-service-agpm30ops.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Managing the AGPM Service -description: Managing the AGPM Service -author: dansimp -ms.assetid: a522b1f1-c57b-43aa-9d75-acc6f9bedbf9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment. It enforces Advanced Group Policy Management (AGPM) delegation and provides an enhanced level of security. The AGPM Service is hosted on the server on which the Microsoft Advanced Group Policy Management - Server is installed. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -- [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md) - -- [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md) - -### Additional references - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/managing-the-agpm-service-agpm40.md b/mdop/agpm/managing-the-agpm-service-agpm40.md deleted file mode 100644 index 01b91e94ad..0000000000 --- a/mdop/agpm/managing-the-agpm-service-agpm40.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Managing the AGPM Service -description: Managing the AGPM Service -author: dansimp -ms.assetid: 48ca02aa-6acf-403b-afd4-66ae8a953246 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment of the domain. It enforces Advanced Group Policy Management (AGPM) delegation and provides an enhanced level of security. The AGPM Service is hosted on the server on which the Microsoft Advanced Group Policy Management - Server is installed. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -- [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md) - -- [Modify the AGPM Service](modify-the-agpm-service-agpm40.md) - -### Additional references - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/managing-the-agpm-service.md b/mdop/agpm/managing-the-agpm-service.md deleted file mode 100644 index 43064fd9ba..0000000000 --- a/mdop/agpm/managing-the-agpm-service.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Managing the AGPM Service -description: Managing the AGPM Service -author: dansimp -ms.assetid: 331f64d2-1236-4711-81b4-1b92f019bfa5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. It enforces Advanced Group Policy Management (AGPM) delegation and provides an enhanced level of security. The AGPM Service is hosted on the server on which the Microsoft Advanced Group Policy Management - Server is installed. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -- [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md) - -- [Modify the Archive Path](modify-the-archive-path.md) - -- [Modify the AGPM Service Account](modify-the-agpm-service-account.md) - -- [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md) - - - - - - - - - diff --git a/mdop/agpm/managing-the-archive-agpm40.md b/mdop/agpm/managing-the-archive-agpm40.md deleted file mode 100644 index ea712c84ad..0000000000 --- a/mdop/agpm/managing-the-archive-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Managing the Archive -description: Managing the Archive -author: dansimp -ms.assetid: b11a3d71-74ea-4dd7-b243-6f2880b7af2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the Archive - - -In Advanced Group Policy Management (AGPM), as an AGPM Administrator (Full Control), you manage access to the archive and have the option to limit the number of versions of each Group Policy Object (GPO) stored in the archive. You can delegate access to GPOs in the archive at the domain level or GPO level. Additionally, you can back up the archive so that you may be able to recover it if a disaster occurs. - -As an AGPM Administrator, you can export a GPO to a file, copy the file to another forest, and then import the GPO into a domain in that forest. Unlike an Editor, you can import policy settings from a GPO backup directly into a new controlled GPO when you create it. For information about how to export a GPO, see [Export a GPO to a File](export-a-gpo-to-a-file.md). - -- [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm40.md) - -- [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md) - -- [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm40.md) - -- [Import a GPO from a File](import-a-gpo-from-a-file-agpmadmin.md) - -- [Back Up the Archive](back-up-the-archive-agpm40.md) - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) - -### Additional references - -- For information about how to delegate access to GPOs in the production environment, see [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm40.md). - -- For information about how to move the archive, see [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md). - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/managing-the-archive.md b/mdop/agpm/managing-the-archive.md deleted file mode 100644 index eeacbaf3a0..0000000000 --- a/mdop/agpm/managing-the-archive.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Managing the Archive -description: Managing the Archive -author: dansimp -ms.assetid: 7c7654e9-ab0e-4531-8ef7-ae77ef391620 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the Archive - - -In Advanced Group Policy Management (AGPM), as an AGPM Administrator (Full Control), you manage access to the archive and have the option to limit the number of versions of each Group Policy Object (GPO) stored in the archive. You can delegate access to GPOs in the archive at the domain level or GPO level. - -- [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm30ops.md) - -- [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md) - -- [Limit the GPO Versions Stored](limit-the-gpo-versions-stored-agpm30ops.md) - -- [Back Up the Archive](back-up-the-archive.md) - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) - -### Additional references - -- For information about how to delegate access to GPOs in the production environment, see [Delegate Access to the Production Environment](delegate-access-to-the-production-environment-agpm30ops.md). - -- For information about how to move the archive, see [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md). - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/modify-the-agpm-service-account.md b/mdop/agpm/modify-the-agpm-service-account.md deleted file mode 100644 index 4481c6d031..0000000000 --- a/mdop/agpm/modify-the-agpm-service-account.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Modify the AGPM Service Account -description: Modify the AGPM Service Account -author: dansimp -ms.assetid: 0d8d8c7b-f299-4fee-8414-406492156942 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the AGPM Service Account - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. If this service is stopped or disabled, AGPM clients cannot perform operations through the server. - -The archive path and AGPM Service Account are configured during the installation of AGPM Server and can be changed afterward through **Add or Remove Programs** on the AGPM Server. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. - -**Important**   -The AGPM Service Account must have full access to the GPOs that it will manage and will be granted **Log On As A Service** permission. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account. - -If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains. - - - -**To modify the AGPM Service Account** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server is installed, click **Start**, click **Control Panel**, click **Add or Remove Programs**. - -2. Click **Microsoft Advanced Group Policy Management - Server**, and then click **Change**. - -3. Click **Next**, and then click **Modify**. - -4. Follow the instructions on screen to configure settings for the AGPM Service: - - 1. For the archive path, confirm or change the location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server. - - 2. Enter new credentials for the AGPM Service Account. - - 3. For the archive owner, enter the credentials of an AGPM Administrator (Full Control). - -5. Click **Change**, and when the installation is complete click **Finish**. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - - - - - - - diff --git a/mdop/agpm/modify-the-agpm-service-agpm30ops.md b/mdop/agpm/modify-the-agpm-service-agpm30ops.md deleted file mode 100644 index 814f3ad6d7..0000000000 --- a/mdop/agpm/modify-the-agpm-service-agpm30ops.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Modify the AGPM Service -description: Modify the AGPM Service -author: dansimp -ms.assetid: 3485f85f-59d1-48dc-8748-36826214dcb1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment. If this service is stopped or disabled, AGPM Clients cannot perform operations through the server. You can modify the archive path, the AGPM Service Account, and the port on which the AGPM Service listens. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to complete this procedure. - -**To modify the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server is installed: - - - For Windows Server 2008, click **Start**, **Control Panel**, and **Programs and Features**. - - - For Windows Vista, click **Start**, **Control Panel**, **Programs**, and **Programs and Features**. - -2. Right-click **Microsoft Advanced Group Policy Management - Server**, and then click **Change**. - -3. Click **Next**, and then click **Modify**. - -4. Follow the instructions to configure the AGPM Service: - - 1. In the **Archive Path** dialog box, enter a new location for the archive relative to the AGPM Server, or confirm the current archive path, and then click **Next**. - - **Important**   - The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server. - - - - 2. In the **AGPM Service Account** dialog box, enter credentials for a service account under which the AGPM Service will run, and click **Next**. - - **Important**   - Modifying the installation clears the credentials for the AGPM Service Account. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - The AGPM Service Account must have full access to the GPOs that it will manage and will be granted **Log On As A Service** permission. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account. - - If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains. - - - - 3. In the **Archive Owner** dialog box, enter the user name of an AGPM Administrator (Full Control) or group of AGPM Administrators, and click **Next**. - - **Note**   - Modifying the installation clears the credentials for the Archive Owner. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - - - 4. In the **Port Configuration** dialog box, type a new port on which the AGPM Service should listen or confirm the port currently selected, and click **Next**. - - **Note**   - By default, the AGPM Service listens on port 4600. - - If you manually configure port exceptions or have rules configuring port exceptions, you can clear the **Add port exception to firewall** check box. - - - -5. Click **Change**, and when the installation is complete click **Finish**. - -6. If you have changed the port on which the AGPM Service listens, modify the port in the AGPM Server connection for each Group Policy administrator. (For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md).) - -7. Repeat for each AGPM Server to which the configuration changes should be applied. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/modify-the-agpm-service-agpm40.md b/mdop/agpm/modify-the-agpm-service-agpm40.md deleted file mode 100644 index 31925f9da1..0000000000 --- a/mdop/agpm/modify-the-agpm-service-agpm40.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Modify the AGPM Service -description: Modify the AGPM Service -author: dansimp -ms.assetid: 3239d088-bb86-4ec4-bc56-dbe8f1c710f5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment of the domain. If this service is stopped or disabled, AGPM Clients cannot perform operations through the server. You can modify the archive path, the AGPM Service Account, and the port on which the AGPM Service listens. - -**Caution**   -Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to complete this procedure. - -**To modify the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server is installed, click **Start**, **Control Panel**, **Programs**, and **Programs and Features**. - -2. Right-click **Microsoft Advanced Group Policy Management - Server**, and then click **Change**. - -3. Click **Next**, and then click **Modify**. - -4. Follow the instructions to configure the AGPM Service: - - 1. In the **Archive Path** dialog box, enter a new location for the archive relative to the AGPM Server, or confirm the current archive path, and then click **Next**. - - **Important**   - The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server. - - - - 2. In the **AGPM Service Account** dialog box, enter credentials for a service account under which the AGPM Service will run, and click **Next**. - - **Important**   - Modifying the installation clears the credentials for the AGPM Service Account. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - The AGPM Service Account must have full access to the GPOs that it will manage and will be granted **Log On As A Service** permission. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account. - - If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains. - - - - 3. In the **Archive Owner** dialog box, enter the user name of an AGPM Administrator (Full Control) or group of AGPM Administrators, and click **Next**. - - **Note**   - Modifying the installation clears the credentials for the Archive Owner. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - - - 4. In the **Port Configuration** dialog box, type a new port on which the AGPM Service should listen or confirm the port currently selected, and click **Next**. - - **Note**   - By default, the AGPM Service listens on port 4600. - - If you manually configure port exceptions or have rules configuring port exceptions, you can clear the **Add port exception to firewall** check box. - - - -5. Click **Change**, and when the installation is complete click **Finish**. - -6. If you have changed the port on which the AGPM Service listens, modify the port in the AGPM Server connection for each Group Policy administrator. (For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md).) - -7. Repeat for each AGPM Server to which the configuration changes should be applied. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/modify-the-archive-path.md b/mdop/agpm/modify-the-archive-path.md deleted file mode 100644 index a442dba78a..0000000000 --- a/mdop/agpm/modify-the-archive-path.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Modify the Archive Path -description: Modify the Archive Path -author: dansimp -ms.assetid: 6d90daf9-58db-4166-b5b3-e84bb261164a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the Archive Path - - -The archive path is the location of the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or on another server in the same forest. - -The archive path and AGPM Service Account are configured during the installation of AGPM Server and can be changed afterward through **Add or Remove Programs** on the AGPM Server. - -A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. - -**To modify the archive path** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server is installed, click **Start**, click **Control Panel**, click **Add or Remove Programs**. - -2. Click **Microsoft Advanced Group Policy Management - Server**, and then click **Change**. - -3. Click **Next**, and then click **Modify**. - -4. Follow the instructions on screen to configure settings for the AGPM Service: - - 1. For the archive path, enter a new location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server. - - 2. Enter credentials for the AGPM Service Account. - - **Important**   - Modifying the installation clears the credentials for the AGPM Service Account. You must re-enter credentials, but they are not required to match the credentials used during the original installation. - - The AGPM Service Account must have full access to the GPOs that it will manage. If you will be managing GPOs on a single domain, you can make the Local System account for the primary domain controller the AGPM Service Account. - - If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains. - - - - 3. For the archive owner, enter the credentials of an AGPM Administrator (Full Control). - -5. Click **Change**, and when the installation is complete click **Finish**. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - - - - - - - diff --git a/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md b/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md deleted file mode 100644 index d4481a3d70..0000000000 --- a/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Modify the Port on Which the AGPM Service Listens -description: Modify the Port on Which the AGPM Service Listens -author: dansimp -ms.assetid: a82c6873-e916-4a04-b263-aa612cd6956b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Modify the Port on Which the AGPM Service Listens - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. By default, the AGPM Service listens on port 4600. You can change this port by modifying the Advanced Group Policy Management (AGPM) archive index file for each archive. - -**Note**   -Before modifying the port on which the AGPM Service listens, it is recommended that you back up the AGPM archive index file (gpostate.xml). This file is located in the folder entered as the archive path during the installation of Advanced Group Policy Management - Server. By default, this location of this file is %CommonAppData%\\Microsoft\\AGPM\\gpostate.xml on the AGPM Server. If you do not know which computer hosts the archive, you can follow the procedure for modifying the archive path to display the current archive path. For more information, see [Modify the Archive Path](modify-the-archive-path.md). - - - -A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) and the archive index file is required to complete this procedure. - -**To modify the port on which the AGPM Service listens** - -1. On the computer hosting the archive, open the archive index file (gpostate.xml) in a text editor. - -2. In the file, search for **agpm:port="4600"**. - -3. Replace **4600** with the port on which the AGPM Service should listen; then, save and close the file. - -4. On the AGPM Server, restart the AGPM Service. (For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md).) - -5. Modify the port in the AGPM Server connection for each Group Policy administrator. (For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md).) - -6. Repeat for each archive and AGPM Server. - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - - - - - - - diff --git a/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md b/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md deleted file mode 100644 index 065322c6a7..0000000000 --- a/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Move the AGPM Server and the Archive -description: Move the AGPM Server and the Archive -author: dansimp -ms.assetid: 9ec48d3a-c293-45f0-8939-32ccdc062303 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Move the AGPM Server and the Archive - - -If you are replacing the AGPM Server and the server on which the archive is hosted, you must move the AGPM Service and the archive. If you prefer, you can move the AGPM Service and the archive separately. - -**Note**   -- The AGPM Server is the computer that hosts the AGPM Service and the computer on which Microsoft Advanced Group Policy Management – Server is installed. - -- By default, the archive is hosted on the AGPM Server, but you can specify an archive path to host it on another server instead. - - - -A user account that is a member of the Domain Admins group and has access to the previous and new AGPM Servers is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to be used by the new AGPM Server to complete this procedure. - -**To move the AGPM Service and the archive to a different server or servers** - -1. Back up the archive. For more information, see [Back Up the Archive](back-up-the-archive-agpm40.md). - -2. Move the AGPM Service: - - 1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - - 2. Install Microsoft Advanced Group Policy Management - Server on the new server that will host the AGPM Service. During this process, you specify the new archive path, the location for the archive in relation to the AGPM Server. For more information, see [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](https://go.microsoft.com/fwlink/?LinkId=153505) (https://go.microsoft.com/fwlink/?LinkId=153505) and [Planning Guide for Microsoft Advanced Group Policy Management](https://go.microsoft.com/fwlink/?LinkId=156883) (https://go.microsoft.com/fwlink/?LinkId=156883). - - 3. Either an AGPM Administrator (Full Control) must configure the AGPM Server connection for all Group Policy administrators who will use the new AGPM Server and remove the connection for the old AGPM Server, or else each Group Policy administrator must manually configure the new AGPM Server connection and remove the old AGPM Server connection for the AGPM snap-in on their computer. For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - - **Note**   - As a best practice, you should uninstall Microsoft Advanced Group Policy Management – Server from the previous AGPM Server. This will ensure that the AGPM Service cannot be unintentionally restarted on that server and potentially cause confusion if any AGPM Server connections to it remain. - - - -3. Copy the archive from the backup to the new server that will host the archive. For more information, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md). - - **Important**   - If you moved the archive without moving the AGPM Service at the same time: - - 1. You must change the archive path to point to the new location for the archive in relation to the AGPM Server. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md). - - 2. You must re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md). - - - -### Additional references - -- [Back Up the Archive](back-up-the-archive-agpm40.md) - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md) - -- [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md) - -- [Modify the AGPM Service](modify-the-agpm-service-agpm40.md) - -- [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](https://go.microsoft.com/fwlink/?LinkId=153505) (https://go.microsoft.com/fwlink/?LinkId=153505) - -- [Planning Guide for Microsoft Advanced Group Policy Management](https://go.microsoft.com/fwlink/?LinkId=156883) (https://go.microsoft.com/fwlink/?LinkId=156883) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/move-the-agpm-server-and-the-archive.md b/mdop/agpm/move-the-agpm-server-and-the-archive.md deleted file mode 100644 index 1c4ba6015e..0000000000 --- a/mdop/agpm/move-the-agpm-server-and-the-archive.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Move the AGPM Server and the Archive -description: Move the AGPM Server and the Archive -author: dansimp -ms.assetid: 13cb83c4-bb42-4e81-8660-5b7540f473d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Move the AGPM Server and the Archive - - -If you are replacing the AGPM Server and the server on which the archive is hosted, you must move the AGPM Service and the archive. If you prefer, you can move the AGPM Service and the archive separately. - -**Note**   -- The AGPM Server is the computer that hosts the AGPM Service and the computer on which Microsoft Advanced Group Policy Management – Server is installed. - -- By default, the archive is hosted on the AGPM Server, but you can specify an archive path to host it on another server instead. - - - -A user account that is a member of the Domain Admins group and has access to the previous and new AGPM Servers is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to be used by the new AGPM Server to complete this procedure. - -**To move the AGPM Service and the archive to a different server or servers** - -1. Back up the archive. For more information, see [Back Up the Archive](back-up-the-archive.md). - -2. Move the AGPM Service: - - 1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - - 2. Install Microsoft Advanced Group Policy Management - Server on the new server that will host the AGPM Service. During this process, you specify the new archive path, the location for the archive in relation to the AGPM Server. For more information, see Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 () and Planning Guide for Microsoft Advanced Group Policy Management (). - - 3. Either an AGPM Administrator (Full Control) must configure the AGPM Server connection for all Group Policy administrators who will use the new AGPM Server and remove the connection for the old AGPM Server, or else each Group Policy administrator must manually configure the new AGPM Server connection and remove the old AGPM Server connection for the AGPM snap-in on their computer. For more information, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - - **Note**   - As a best practice, you should uninstall Microsoft Advanced Group Policy Management – Server from the previous AGPM Server. This will ensure that the AGPM Service cannot be unintentionally restarted on that server and potentially cause confusion if any AGPM Server connections to it remain. - - - -3. Copy the archive from the backup to the new server that will host the archive. For more information, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md). - - **Important**   - If you moved the archive without moving the AGPM Service at the same time: - - 1. You must change the archive path to point to the new location for the archive in relation to the AGPM Server. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md). - - 2. You must re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md). - - - -### Additional references - -- [Back Up the Archive](back-up-the-archive.md) - -- [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md) - -- [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md) - -- [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md) - -- Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 () - -- Planning Guide for Microsoft Advanced Group Policy Management () - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md deleted file mode 100644 index d84f580b21..0000000000 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations Guide for Microsoft Advanced Group Policy Management 2.5 -description: Operations Guide for Microsoft Advanced Group Policy Management 2.5 -author: dansimp -ms.assetid: 005f0bb5-789f-42a9-bcaf-7e8c31a8df66 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations Guide for Microsoft Advanced Group Policy Management 2.5 - - -You can use Microsoft Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC), providing comprehensive change control and enhanced management for Group Policy objects (GPOs). - -With AGPM you can: - -- Perform offline editing of GPOs, so you can create and test them before deploying to a production environment. - -- Retain multiple versions of a GPO in a central archive, so you can roll back if a problem occurs. - -- Share the responsibility for editing, approving, and reviewing GPOs among multiple people using role-based delegation. - -- Eliminate the danger of multiple Group Policy administrators overwriting each other's work by using a check-in/check-out capability for GPOs. - -- Analyze changes to a GPO, comparing it to another GPO or another version of the same GPO using difference reporting. - -- Simplify the creation of new GPOs by using GPO templates, storing standard settings to use as starting points for new GPOs. - -AGPM adds a **Change Control** node under each domain displayed in the GPMC, as well as **History** and **Extensions** tabs for each GPO and Group Policy link displayed in the GPMC. - -- [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management.md) - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -- [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md deleted file mode 100644 index 1b9ebfc6e4..0000000000 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Operations Guide for Microsoft Advanced Group Policy Management 3.0 -description: Operations Guide for Microsoft Advanced Group Policy Management 3.0 -author: dansimp -ms.assetid: aaefe6d1-a9e5-43eb-b4d8-85880798cb8b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations Guide for Microsoft Advanced Group Policy Management 3.0 - - -You can use Microsoft Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC), providing comprehensive change control and enhanced management for Group Policy Objects (GPOs). - -With AGPM you can: - -- Perform offline editing of GPOs, so you can create and test them before deploying to a production environment. - -- Retain multiple versions of a GPO in a central archive, so you can roll back if a problem occurs. - -- Share the responsibility for editing, approving, and reviewing GPOs among multiple people using role-based delegation. - -- Eliminate the danger of multiple Group Policy administrators overwriting each other's work by using a check-in/check-out capability for GPOs. - -- Analyze changes to a GPO, comparing it to another GPO or another version of the same GPO using difference reporting. - -- Simplify the creation of new GPOs by using GPO templates, storing standard settings to use as starting points for new GPOs. - -AGPM adds a **Change Control** folder under each domain displayed in the GPMC, as well as a **History** tab for each GPO and Group Policy link displayed in the GPMC. - -- [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm30ops.md) - -- [Best Practices for Version Control](best-practices-for-version-control.md) - -- [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive.md) - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -- [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management-agpm30ops.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md deleted file mode 100644 index c4c260282d..0000000000 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Operations Guide for Microsoft Advanced Group Policy Management 4.0 -description: Operations Guide for Microsoft Advanced Group Policy Management 4.0 -author: dansimp -ms.assetid: 0bafeba3-20a9-4360-be5d-03f786df11ee -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations Guide for Microsoft Advanced Group Policy Management 4.0 - - -You can use Microsoft Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC). AGPM provides comprehensive change control and improved management of Group Policy Objects (GPOs). - -Using AGPM, you can do these tasks: - -- Perform offline editing of GPOs so that you can create and test them before you deploy them to a production environment. - -- Maintain multiple versions of a GPO in a central archive so that you can roll back if a problem occurs. - -- Share the responsibility for editing, approving, and reviewing GPOs among multiple people by using role-based delegation. - -- Eliminate the danger of multiple Group Policy administrators overwriting one another's work by using the check-in and check-out capability for GPOs. - -- Analyze changes to a GPO, comparing it to another GPO or another version of the same GPO by using difference reporting. - -- Simplify creating new GPOs by using GPO templates, storing common policy settings and preference settings to use as starting points for new GPOs. - -- Delegate access to the production environment. - -- Search for GPOs with specific attributes and filter the list of GPOs displayed. - -- Export a GPO to a file so that you can copy it from a domain in a test forest to a domain in a production forest. - -AGPM adds a **Change Control** folder under each domain displayed in the GPMC, in addition to a **History** tab for each GPO and Group Policy link displayed in the GPMC. - -- [Overview of Advanced Group Policy Management](overview-of-advanced-group-policy-management-agpm40.md) - -- [Best Practices for Version Control](best-practices-for-version-control-agpm40.md) - -- [Checklist: Administer the AGPM Server and Archive](checklist-administer-the-agpm-server-and-archive-agpm40.md) - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm40.md) - -- [Search and Filter the List of GPOs](search-and-filter-the-list-of-gpos.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -- [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/other-enhancements-to-the-gpmc.md b/mdop/agpm/other-enhancements-to-the-gpmc.md deleted file mode 100644 index b4bf662f24..0000000000 --- a/mdop/agpm/other-enhancements-to-the-gpmc.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Other Enhancements to the GPMC -description: Other Enhancements to the GPMC -author: dansimp -ms.assetid: ef344101-17e1-4e06-9dc8-2f20ca796774 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Other Enhancements to the GPMC - - -Advanced Group Policy Management (AGPM) adds a **History** tab and an **Extensions** tab to extend the functionality of the **Group Policy Management Console** (GPMC). - -## History tab - - -AGPM adds a **History** tab to all Group Policy objects (GPOs) and Group Policy links displayed in the GPMC. The features of the **History** tab in the details pane of a GPO are the same as those of the **History** window displayed through the **Change Control** tab. For information about these features, see [History Window](history-window.md). - -## Extensions tab - - -In the Microsoft Windows Server® 2003 operating system, AGPM adds an **Extensions** tab to all GPOs and Group Policy links displayed in the GPMC. This tab lists all extensions that have settings in the GPO (or all registered extensions if **Show all registered extensions** is checked) and identifies them as part of the user or computer context. - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md deleted file mode 100644 index 19cb9b5a66..0000000000 --- a/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Overview of Advanced Group Policy Management -description: Overview of Advanced Group Policy Management -author: dansimp -ms.assetid: 3a8d1e58-12b9-42bd-898f-6d57514dfbb9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of Advanced Group Policy Management - - -You can use Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC) to provide comprehensive change control and improved management for Group Policy Objects (GPOs). - -## Group Policy object development with change control - - -With AGPM, you can store a copy of each GPO in a central archive so that Group Policy administrators can view and change it offline without immediately affecting the deployed version of the GPO. Additionally, AGPM stores a copy of each version of each controlled GPO in the archive so that you can roll back to an earlier version if necessary. - -The terms "check in" and "check out" are used just as in a library (or in applications that provide change control, version control, or source control for programming development). To use a book that is in a library, you check it out from the library. No one else can use it while you have it checked out. When you are finished with the book, you check it back into the library, so others can use it. - -When you develop GPOs by using AGPM: - -1. Create a new controlled GPO or control a previously uncontrolled GPO. - -2. Check out the GPO, so that you and only you can change it. - -3. Edit the GPO. - -4. Check in the edited GPO, so that others can change it, or so that it can be deployed. - -5. Review the changes. - -6. Deploy the GPO to the production environment. - -## Role-based delegation - - -AGPM provides comprehensive, easy-to-use role-based delegation for managing access to GPOs in the archive. Domain-level permissions enable AGPM Administrators to provide access to individual domains without providing access to other domains. GPO-based delegation enables AGPM Administrators to provide access to specific GPOs without providing domain-wide access. - -Within AGPM, there are specifically defined roles: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. The AGPM Administrator role includes the permissions for all other roles. By default, only Approvers have the power to deploy GPOs to the production environment, protecting the environment from mistakes by less experienced Editors. Also by default, all roles include the Reviewer role and therefore the ability to view GPO settings in reports. However, AGPM provides an AGPM Administrator with the flexibility to customize GPO access to fit the needs of your organization. - -## Delegation in a multiple Group Policy administrator environment - - -In an environment where multiple people change GPOs, an AGPM Administrator delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. For a typical GPO development process for an Editor and an Approver, see [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm30ops.md). - -### Additional references - -- [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md b/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md deleted file mode 100644 index a9b6c13c20..0000000000 --- a/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Overview of Advanced Group Policy Management -description: Overview of Advanced Group Policy Management -author: dansimp -ms.assetid: 2c12f3b4-8472-4c5b-b7f8-1c98a80d6b47 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of Advanced Group Policy Management - - -You can use Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC) to provide comprehensive change control and improved management for Group Policy Objects (GPOs). - -## Group Policy object development with change control - - -With AGPM, you can store a copy of each GPO in a central archive so that Group Policy administrators can view and change it offline without immediately affecting the deployed version of the GPO. Additionally, AGPM stores a copy of each version of each controlled GPO in the archive so that you can roll back to an earlier version if necessary. - -The terms "check in" and "check out" are used just as in a library (or in applications that provide change control, version control, or source control for programming development). To use a book that is in a library, you check it out from the library. No one else can use it while you have it checked out. When you are finished with the book, you check it back into the library, so others can use it. - -To use these GPO control features, you will click a Change Control node in the Group Policy Management editor. The Change Control node appears only if you have installed the AGPM Client. - -When you develop GPOs by using AGPM: - -1. Create a new controlled GPO or control a previously uncontrolled GPO. - -2. Check out the GPO, so that you and only you can change it. - -3. Edit the GPO. - -4. Check in the edited GPO, so that others can change it, or so that it can be deployed. - -5. Review the changes. - -6. Deploy the GPO to the production environment. - -## Role-based delegation - - -AGPM provides comprehensive, easy-to-use role-based delegation for managing access to GPOs in the archive. Domain-level permissions enable AGPM Administrators to provide access to individual domains without providing access to other domains. GPO-based delegation enables AGPM Administrators to provide access to specific GPOs without providing domain-wide access. - -Within AGPM, there are specifically defined roles: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. The AGPM Administrator role includes the permissions for all other roles. By default, only Approvers have the power to deploy GPOs to the production environment of a domain, protecting the environment from mistakes by less experienced Editors. Also by default, all roles include the Reviewer role and therefore the ability to view GPO settings in reports. However, AGPM provides an AGPM Administrator with the flexibility to customize GPO access to fit the needs of your organization. - -## Delegation in a multiple Group Policy administrator environment - - -In an environment where multiple people change GPOs, an AGPM Administrator delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. For a typical GPO development process for an Editor and an Approver, see [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo-agpm40.md). - -### Additional references - -- [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - -  - -  - - - - - diff --git a/mdop/agpm/overview-of-advanced-group-policy-management.md b/mdop/agpm/overview-of-advanced-group-policy-management.md deleted file mode 100644 index ab987de9d0..0000000000 --- a/mdop/agpm/overview-of-advanced-group-policy-management.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Overview of Advanced Group Policy Management -description: Overview of Advanced Group Policy Management -author: dansimp -ms.assetid: 028de9dd-848b-42bc-a982-65ba5c433772 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of Advanced Group Policy Management - - -You can use Advanced Group Policy Management (AGPM) to extend the capabilities of the Group Policy Management Console (GPMC), providing comprehensive change control and enhanced management for Group Policy objects (GPOs). - -## Group Policy object development with change control - - -With AGPM, you can store a copy of each GPO in a central archive, so Group Policy administrators can view and modify it offline without immediately impacting the deployed version of the GPO. Additionally, AGPM stores a copy of each version of each controlled GPO in the archive so that you can roll back to an earlier version if needed. - -The terms "check in" and "check out" are used in much the same way as in a library (or in applications that provide change control, version control, or source code control for programming development). To use a book that is in a library, you check it out from the library. No one else can use it while you have it checked out. When you are finished with the book, you check it back into the library, so others can use it. - -When developing GPOs using AGPM: - -1. Create a new controlled GPO or control a previously uncontrolled GPO. - -2. Check out the GPO, so you and only you can modify it. - -3. Edit the GPO. - -4. Check in the edited GPO, so others can modify it, or so it can be deployed. - -5. Review the changes. - -6. Deploy the GPO to the production environment. - -## Role-based delegation - - -AGPM provides comprehensive, easy-to-use role-based delegation. Domain-level permissions allow AGPM Administrators to provide access to individual domains without providing access to other domains. GPO-based delegation enables AGPM Administrators to allow access only to specific GPOs. - -Within AGPM, there are specifically defined roles: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. The AGPM Administrator role includes the permissions for all other roles. By default, only Approvers have the power to deploy GPOs to the production environment, protecting the environment from inadvertent mistakes by less experienced Editors. Also by default, all roles include the Reviewer role and therefore the ability to view GPO settings in reports. However, AGPM provides an AGPM Administrator with the flexibility to customize GPO access to fit the needs of your organization. - -## Delegation in a multiple Group Policy administrator environment - - -In an environment where multiple people make changes to GPOs, an AGPM Administrator delegates permission to Editors, Approvers, and Reviewers, either as groups or as individuals. For a typical GPO development process for an Editor and an Approver, see [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md). - -### Additional references - -- [Checklist: Create, Edit, and Deploy a GPO](checklist-create-edit-and-deploy-a-gpo.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -- [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management.md) - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management.md) - -  - -  - - - - - diff --git a/mdop/agpm/pending-gpo-commands-agpm30ops.md b/mdop/agpm/pending-gpo-commands-agpm30ops.md deleted file mode 100644 index 335ce54580..0000000000 --- a/mdop/agpm/pending-gpo-commands-agpm30ops.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Pending GPO Commands -description: Pending GPO Commands -author: dansimp -ms.assetid: 3868dda0-8a41-4bba-9b0c-9f656f9a3cd5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Pending GPO Commands - - -The **Pending** tab: - -- Displays a list of Group Policy Objects (GPOs) with pending requests for GPO management actions (such as creation, control, deployment, or deletion). - -- Provides a shortcut menu with commands for responding to pending requests and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

    Withdraw

    Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved.

    Approve

    Complete a pending request from an Editor to create, control, or delete the selected GPO.

    Reject

    Deny a pending request from an Editor to create, control, or delete the selected GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/pending-gpo-commands-agpm40.md b/mdop/agpm/pending-gpo-commands-agpm40.md deleted file mode 100644 index 828e0f34aa..0000000000 --- a/mdop/agpm/pending-gpo-commands-agpm40.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Pending GPO Commands -description: Pending GPO Commands -author: dansimp -ms.assetid: b62f49e1-43ab-4c93-8102-96cd97a4adad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Pending GPO Commands - - -The **Pending** tab: - -- Displays a list of Group Policy Objects (GPOs) with pending requests for GPO management actions (such as creation, control, deployment, or deletion). - -- Provides a shortcut menu with commands for responding to pending requests and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO.

    Withdraw

    Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved.

    Approve

    Complete a pending request from an Editor to create, control, or delete the selected GPO.

    Reject

    Deny a pending request from an Editor to create, control, or delete the selected GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/pending-tab.md b/mdop/agpm/pending-tab.md deleted file mode 100644 index b3797e17cc..0000000000 --- a/mdop/agpm/pending-tab.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Pending Tab -description: Pending Tab -author: dansimp -ms.assetid: 54a9a977-c0bc-4553-922b-b2e10e162df9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Pending Tab - - -The **Pending** tab: - -- Displays a list of Group Policy objects (GPOs) with pending requests for GPO management actions (such as creation, control, deployment, or deletion). - -- Provides a shortcut menu with commands for responding to pending requests and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

    Withdraw

    Withdraw your pending request to create, control, or delete the selected GPO before the request has been approved.

    Approve

    Complete a pending request from an Editor to create, control, or delete the selected GPO.

    Reject

    Deny a pending request from an Editor to create, control, or delete the selected GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs are most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md b/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md deleted file mode 100644 index d3dd8dcca6..0000000000 --- a/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Performing AGPM Administrator Tasks -description: Performing AGPM Administrator Tasks -author: dansimp -ms.assetid: 9678b0f4-70a5-411e-a896-afa4dc9ea6c4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing AGPM Administrator Tasks - - -In Advanced Group Policy Management (AGPM), an AGPM Administrator (Full Control) configures domain-wide options and delegates permissions to Approvers, Editors, Reviewers, and other AGPM Administrators. By default, an AGPM Administrator is an individual with Full Control—all AGPM permissions—and who therefore can perform tasks associated with any role. - -In an environment in which multiple people develop Group Policy Objects (GPOs), you can choose whether all AGPM users perform the same tasks and have the same level of access or whether AGPM Administrators delegate permissions to Editors who make changes to GPOs and to Approvers who deploy GPOs to the production environment. AGPM Administrators can configure permissions to meet the needs of your organization. - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md): Configure the AGPM Server Connection and e-mail notification, delegate access to GPOs in the production environment, and configure logging and tracing for troubleshooting. - -- [Managing the Archive](managing-the-archive.md): Delegate access to GPOs in the archive and limit the number of versions of each GPO stored. - -- [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md): Stop and start the AGPM Service or change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens. - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md): Move the AGPM Service, the archive, or both to a different server. - -Also, because the AGPM Administrator role includes the permissions for all other roles, an AGPM Administrator can perform the tasks normally associated with any other role. - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md), such as creating, deploying, or deleting GPOs - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md), such as editing, renaming, labeling, or importing GPOs, creating templates, or setting a default template - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md), such as reviewing settings and comparing GPOs - -### Additional considerations - -By default, the AGPM Administrator role has Full Control—all AGPM permissions: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -- Modify Options - -- Modify Security - -- Create Template - -The **Modify Options** and **Modify Security** permissions are unique to the role of AGPM Administrator. - -  - -  - - - - - diff --git a/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md b/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md deleted file mode 100644 index 73153462b6..0000000000 --- a/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Performing AGPM Administrator Tasks -description: Performing AGPM Administrator Tasks -author: dansimp -ms.assetid: bc746f39-bdc9-4e2a-bc48-c3c7905de098 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing AGPM Administrator Tasks - - -Advanced Group Policy Management (AGPM) lets an AGPM Administrator (Full Control) configure domain-wide options and delegate permissions to Approvers, Editors, Reviewers, and AGPM Administrators. By default, an AGPM Administrator is someone who has Full Control— all AGPM permissions—and who therefore can perform tasks associated with any role. - -In an environment in which multiple people develop Group Policy Objects (GPOs), you can choose to let all Group Policy administrators perform the same tasks and have the same level of access. Or, you can choose to let AGPM Administrators delegate permissions to Editors who can change GPOs and to Approvers who deploy GPOs to the production environment. AGPM Administrators can configure permissions to meet the needs of your organization. - -- [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md): Configure the AGPM Server Connection and e-mail notification, delegate access to GPOs in the production environment, and configure logging and tracing for troubleshooting. - -- [Managing the Archive](managing-the-archive-agpm40.md): Delegate access to GPOs in the archive, limit the number of versions of each GPO stored, import a GPO from another domain, and back up and restore the archive. - -- [Managing the AGPM Service](managing-the-agpm-service-agpm40.md): Stop and start the AGPM Service or change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens. - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md): Move the AGPM Service, the archive, or both to a different server. - -**Note**   -Because the AGPM Administrator role includes the permissions for all other roles, an AGPM Administrator can perform the tasks usually associated with any other role. - -[Performing Approver Tasks](performing-approver-tasks-agpm40.md), such as creating, deploying, or deleting GPOs - -[Performing Editor Tasks](performing-editor-tasks-agpm40.md), such as editing, renaming, labeling, or importing GPOs, creating templates, or setting a default template - -[Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md), such as reviewing settings and comparing GPOs - - - -### Additional considerations - -By default, the AGPM Administrator role has Full Control—all AGPM permissions: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -- Export GPO - -- Import GPO - -- Create Template - -- Modify Options - -- Modify Security - -The **Modify Options** and **Modify Security** permissions are unique to the role of AGPM Administrator. - - - - - - - - - diff --git a/mdop/agpm/performing-agpm-administrator-tasks.md b/mdop/agpm/performing-agpm-administrator-tasks.md deleted file mode 100644 index 621841c925..0000000000 --- a/mdop/agpm/performing-agpm-administrator-tasks.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Performing AGPM Administrator Tasks -description: Performing AGPM Administrator Tasks -author: dansimp -ms.assetid: 32e694a7-be64-4943-bce2-2a3a15e5341f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing AGPM Administrator Tasks - - -An AGPM Administrator (Full Control) configures domain-wide options and delegates permissions to Approvers, Editors, Reviewers, and other AGPM Administrators. By default, an AGPM Administrator is an individual with Full Control (all Advanced Group Policy Management \[AGPM\] permissions) and therefore can also perform tasks associated with any role. - -In an environment in which multiple people develop Group Policy objects (GPOs), you can choose whether all Advanced Group Policy Management (AGPM) users perform the same tasks and have the same level of access or whether AGPM Administrators delegate permissions to Editors who make changes to GPOs and to Approvers who deploy GPOs to the production environment. AGPM Administrators can configure permissions to meet the needs of your organization. - -- [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md) - -- [Configure E-Mail Notification](configure-e-mail-notification.md) - -- [Delegate Domain-Level Access](delegate-domain-level-access.md) - -- [Delegate Access to an Individual GPO](delegate-access-to-an-individual-gpo.md) - -- [Configure Logging and Tracing](configure-logging-and-tracing.md) - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md) - - - [Modify the Archive Path](modify-the-archive-path.md) - - - [Modify the AGPM Service Account](modify-the-agpm-service-account.md) - - - [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md) - -Also, because the AGPM Administrator role includes the permissions for all other roles, an AGPM Administrator can perform the tasks normally associated with any other role. - -- [Performing Approver Tasks](performing-approver-tasks.md), such as creating, deploying, or deleting GPOs - -- [Performing Editor Tasks](performing-editor-tasks.md), such as editing, renaming, labeling, or importing GPOs, creating templates, or setting a default template - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md), such as reviewing settings and comparing GPOs - -### Additional considerations - -By default, the AGPM Administrator role has Full Control—all AGPM permissions: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -- Modify Options - -- Modify Security - -- Create Template - -The **Modify Options** and **Modify Security** permissions are unique to the role of AGPM Administrator. - -  - -  - - - - - diff --git a/mdop/agpm/performing-approver-tasks-agpm30ops.md b/mdop/agpm/performing-approver-tasks-agpm30ops.md deleted file mode 100644 index 354cf61ee9..0000000000 --- a/mdop/agpm/performing-approver-tasks-agpm30ops.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Performing Approver Tasks -description: Performing Approver Tasks -author: dansimp -ms.assetid: 9f711824-191b-4b4b-a1c6-a3b2116006a4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Approver Tasks - - -An Approver is a person authorized by an AGPM Administrator (Full Control) to create, deploy, and delete Group Policy Objects (GPOs) and to approve or reject requests (typically from Editors) to create, deploy, or delete GPOs. - -**Important**   -Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md). - - - -- [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md) - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md) - -- [Check In a GPO](check-in-a-gpo-agpm30ops.md) - -- [Deploy a GPO](deploy-a-gpo-agpm30ops.md) - -- [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md) - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - -**Note**   -Before approving a GPO, an Approver should review the policy settings that it contains. The Approver role includes the permissions for the Reviewer role, so that an Approver can review policy settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Approver role: - -- List Contents - -- Read Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -Also, an Approver has full control over GPOs that he created or controlled. - - - - - - - - - diff --git a/mdop/agpm/performing-approver-tasks-agpm40.md b/mdop/agpm/performing-approver-tasks-agpm40.md deleted file mode 100644 index 85377d6b65..0000000000 --- a/mdop/agpm/performing-approver-tasks-agpm40.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Performing Approver Tasks -description: Performing Approver Tasks -author: dansimp -ms.assetid: e0a4b7fe-ce69-4755-9104-c7f523ea6b62 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Approver Tasks - - -An Approver is a person authorized by an AGPM Administrator (Full Control) to create, deploy, and delete Group Policy Objects (GPOs) and to approve or reject requests (typically from Editors) to create, deploy, or delete GPOs. - -**Important**   -Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md). - - - -- [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md) - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md) - -- [Check In a GPO](check-in-a-gpo-agpm40.md) - -- [Deploy a GPO](deploy-a-gpo-agpm40.md) - -- [Roll Back to an Earlier Version of a GPO](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md) - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) - -**Note**   -Before approving a GPO, an Approver should review the policy settings that it contains. The Approver role includes the permissions for the Reviewer role, so that an Approver can review policy settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Approver role: - -- List Contents - -- Read Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -Also, an Approver has full control over GPOs that he created or controlled. - - - - - - - - - diff --git a/mdop/agpm/performing-approver-tasks.md b/mdop/agpm/performing-approver-tasks.md deleted file mode 100644 index 643f462b96..0000000000 --- a/mdop/agpm/performing-approver-tasks.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Performing Approver Tasks -description: Performing Approver Tasks -author: dansimp -ms.assetid: 6f6310b3-19c1-47c9-8615-964ddd10ce14 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Approver Tasks - - -An Approver is a person authorized by an AGPM Administrator (Full Control) to create, deploy, and delete Group Policy objects (GPOs) and to approve or reject requests (typically from Editors) to create, deploy, or delete GPOs. - -**Important**   -Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md). - - - -- [Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md) - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-approver.md) - -- [Check In a GPO](check-in-a-gpo-approver.md) - -- [Deploy a GPO](deploy-a-gpo.md) - -- [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo.md) - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) - -**Note**   -Because the Approver role includes the permissions for the Reviewer role, an Approver can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Approver role: - -- List Contents - -- Read Settings - -- Create GPO - -- Deploy GPO - -- Delete GPO - -Also, an Approver has full control over GPOs that he created or controlled. - - - - - - - - - diff --git a/mdop/agpm/performing-editor-tasks-agpm30ops.md b/mdop/agpm/performing-editor-tasks-agpm30ops.md deleted file mode 100644 index 56a79bf8fa..0000000000 --- a/mdop/agpm/performing-editor-tasks-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Performing Editor Tasks -description: Performing Editor Tasks -author: dansimp -ms.assetid: d4ac3277-2557-41cf-ac90-5adb6c30687c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Editor Tasks - - -An Editor is a person authorized by an AGPM Administrator (Full Control) to make changes to Group Policy Objects (GPOs) and create GPO templates. Additionally, an Editor can initiate the process of creating, deleting, or restoring a GPO, but by default must request approval from an Approver. - -**Important**   -Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md). - - - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm30ops.md) - -- [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm30ops.md) - -**Note**   -Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Editor role: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create Template - - - - - - - - - diff --git a/mdop/agpm/performing-editor-tasks-agpm40.md b/mdop/agpm/performing-editor-tasks-agpm40.md deleted file mode 100644 index cdac449d72..0000000000 --- a/mdop/agpm/performing-editor-tasks-agpm40.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Performing Editor Tasks -description: Performing Editor Tasks -author: dansimp -ms.assetid: 81976a01-2a95-4256-b703-9fb3c884ef34 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Editor Tasks - - -In Advanced Group Policy Management (AGPM), an Editor is a person authorized by an AGPM Administrator (Full Control) to change Group Policy Objects (GPOs) and create GPO templates. Additionally, an Editor can request that a GPO be created, deleted, or restored. An Approver must approve the request for it to be implemented. An Editor can export a GPO to a file so that it can be copied to a domain in another forest, and import a GPO that was copied from another domain. - -**Important**   -Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md). - - - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) - -- [Editing a GPO](editing-a-gpo-agpm40.md) - -- [Using a Test Environment](using-a-test-environment.md) - -- [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md) - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm40.md) - -- [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md) - -**Note**   -Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Editor role: - -- List Contents - -- Read Settings - -- Edit Settings - -- Export GPO - -- Import GPO - -- Create Template - - - - - - - - - diff --git a/mdop/agpm/performing-editor-tasks.md b/mdop/agpm/performing-editor-tasks.md deleted file mode 100644 index e2b158f4f9..0000000000 --- a/mdop/agpm/performing-editor-tasks.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Performing Editor Tasks -description: Performing Editor Tasks -author: dansimp -ms.assetid: b1e62615-2e02-460e-81d1-4a3fbe59f62d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Editor Tasks - - -An Editor is a person authorized by an AGPM Administrator (Full Control) to make changes to Group Policy objects (GPOs) and create GPO templates. Additionally, an Editor can initiate the process of creating or deleting a GPO, but by default must request approval from an Approver. - -**Important**   -Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md). - - - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) - -- [Editing a GPO](editing-a-gpo.md) - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) - -- [Delete a GPO](delete-a-gpo-editor.md) - -**Note**   -Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks.md) for more information. - - - -### Additional considerations - -By default, the following permissions are provided for the Editor role: - -- List Contents - -- Read Settings - -- Edit Settings - -- Create Template - - - - - - - - - diff --git a/mdop/agpm/performing-reviewer-tasks-agpm30ops.md b/mdop/agpm/performing-reviewer-tasks-agpm30ops.md deleted file mode 100644 index dc9f09707d..0000000000 --- a/mdop/agpm/performing-reviewer-tasks-agpm30ops.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Performing Reviewer Tasks -description: Performing Reviewer Tasks -author: dansimp -ms.assetid: 1faf396d-be0d-49ac-b063-0722fda2e43d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Reviewer Tasks - - -A Reviewer is a person authorized by an AGPM Administrator (Full Control) to review or audit Group Policy Objects (GPOs). An individual with only the Reviewer role cannot modify GPOs; however, all other roles include the Reviewer role. - -- [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md) - -- [Review GPO Settings](review-gpo-settings-agpm30ops.md) - -- [Review GPO Links](review-gpo-links-agpm30ops.md) - -- [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md) - -### Additional considerations - -By default, the following permissions are provided for the Reviewer role: - -- List Contents - -- Read Settings - -  - -  - - - - - diff --git a/mdop/agpm/performing-reviewer-tasks-agpm40.md b/mdop/agpm/performing-reviewer-tasks-agpm40.md deleted file mode 100644 index 03929f7e0b..0000000000 --- a/mdop/agpm/performing-reviewer-tasks-agpm40.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Performing Reviewer Tasks -description: Performing Reviewer Tasks -author: dansimp -ms.assetid: b5f0805c-da55-45a5-a94c-2473af92b54a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Reviewer Tasks - - -A Reviewer is a person authorized by an AGPM Administrator (Full Control) to review or audit Group Policy Objects (GPOs). An individual with only the Reviewer role cannot modify GPOs; however, all other roles include the Reviewer role. - -- [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md) - -- [Review GPO Settings](review-gpo-settings-agpm40.md) - -- [Review GPO Links](review-gpo-links-agpm40.md) - -- [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md) - -### Additional considerations - -By default, the following permissions are provided for the Reviewer role: - -- List Contents - -- Read Settings - -  - -  - - - - - diff --git a/mdop/agpm/performing-reviewer-tasks.md b/mdop/agpm/performing-reviewer-tasks.md deleted file mode 100644 index efab9279e1..0000000000 --- a/mdop/agpm/performing-reviewer-tasks.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Performing Reviewer Tasks -description: Performing Reviewer Tasks -author: dansimp -ms.assetid: 4bdd43fa-5c73-4900-8947-b45906f47f60 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing Reviewer Tasks - - -A Reviewer is a person authorized by an AGPM Administrator (Full Control) to review or audit Group Policy objects (GPOs). An individual with only the Reviewer role cannot modify GPOs; however, all other roles include the Reviewer role. - -- [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md) - -- [Review GPO Settings](review-gpo-settings.md) - -- [Review GPO Links](review-gpo-links.md) - -- [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates.md) - -### Additional considerations - -By default, the following permissions are provided for the Reviewer role: - -- List Contents - -- Read Settings - -  - -  - - - - - diff --git a/mdop/agpm/production-delegation-tab-agpm30ops.md b/mdop/agpm/production-delegation-tab-agpm30ops.md deleted file mode 100644 index a66636f4d2..0000000000 --- a/mdop/agpm/production-delegation-tab-agpm30ops.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Production Delegation Tab -description: Production Delegation Tab -author: dansimp -ms.assetid: 9851637d-d5c1-4d29-8582-e8779500a14e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Production Delegation Tab - - -The **Production Delegation** tab on the **Change Control** pane provides a list of users and groups who have domain-level access to controlled Group Policy Objects (GPOs) in the production environment and indicates the allowed permissions of each user or group. - -This tab allows an AGPM Administrator (Full Control) to modify the default delegation of access to GPOs in the production environment, adding or removing users and groups, and modifying the allowed permissions for each user and group. - - ---- - - - - - - - - - - - - - - - - - - - - -
    ButtonEffect

    Add

    Add a new entry to the security descriptor.

    Remove

    Remove the selected users or groups from the Access Control List.

    Properties

    Display the properties for the selected user or group. The properties page is the same one displayed for an object in Active Directory User and Computers.

    - -  - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm30ops.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/production-delegation-tab-agpm40.md b/mdop/agpm/production-delegation-tab-agpm40.md deleted file mode 100644 index 12e0ac126a..0000000000 --- a/mdop/agpm/production-delegation-tab-agpm40.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Production Delegation Tab -description: Production Delegation Tab -author: dansimp -ms.assetid: 046bb9bc-769a-4306-bc49-c159a9533552 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Production Delegation Tab - - -The **Production Delegation** tab on the **Change Control** pane provides a list of users and groups who have domain-level access to controlled Group Policy Objects (GPOs) in the production environment and indicates the allowed permissions of each user or group. - -This tab allows an AGPM Administrator (Full Control) to modify the default delegation of access to GPOs in the production environment of the domain, adding or removing users and groups, and modifying the allowed permissions for each user and group. - - ---- - - - - - - - - - - - - - - - - - - - - -
    ButtonEffect

    Add

    Add a new entry to the security descriptor.

    Remove

    Remove the selected users or groups from the Access Control List.

    Properties

    Display the properties for the selected user or group. The properties page is the same one displayed for an object in Active Directory User and Computers.

    - -  - -### Additional references - -- [User Interface: Advanced Group Policy Management](user-interface-advanced-group-policy-management-agpm40.md) - -- [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/recycle-bin-commands-agpm30ops.md b/mdop/agpm/recycle-bin-commands-agpm30ops.md deleted file mode 100644 index 7f252a28e7..0000000000 --- a/mdop/agpm/recycle-bin-commands-agpm30ops.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Recycle Bin Commands -description: Recycle Bin Commands -author: dansimp -ms.assetid: ffe8f020-7aa9-40ad-8019-cc99901a7840 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recycle Bin Commands - - -The **Recycle Bin** tab: - -- Displays a list of Group Policy Objects (GPOs) that have been deleted from the archive. - -- Provides a shortcut menu with commands for managing GPOs and for displaying reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable: - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Destroy

    Remove the selected GPO from the Recycle Bin, so it can no longer be restored.

    Restore

    Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for Advanced Group Policy Management (AGPM).

    - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/recycle-bin-commands-agpm40.md b/mdop/agpm/recycle-bin-commands-agpm40.md deleted file mode 100644 index e25387fa75..0000000000 --- a/mdop/agpm/recycle-bin-commands-agpm40.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Recycle Bin Commands -description: Recycle Bin Commands -author: dansimp -ms.assetid: 347a101f-0ba0-4afc-bd59-752cc06bb904 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recycle Bin Commands - - -The **Recycle Bin** tab: - -- Displays a list of Group Policy Objects (GPOs) that have been deleted from the archive. - -- Provides a shortcut menu with commands for managing GPOs and for displaying reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable: - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Destroy

    Remove the selected GPO from the Recycle Bin, so it can no longer be restored.

    Restore

    Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for Advanced Group Policy Management (AGPM).

    - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/recycle-bin-tab.md b/mdop/agpm/recycle-bin-tab.md deleted file mode 100644 index 5b47c0650b..0000000000 --- a/mdop/agpm/recycle-bin-tab.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Recycle Bin Tab -description: Recycle Bin Tab -author: dansimp -ms.assetid: 9ce62e98-c03e-4a75-90e0-51be83c6d2db -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recycle Bin Tab - - -The **Recycle Bin** tab: - -- Displays a list of Group Policy objects (GPOs) that have been deleted from the archive. - -- Provides a shortcut menu with commands for managing GPOs and for displaying reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable: - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO or display links to the selected GPOs from organizational units as of when the GPOs were most recently controlled, imported, or checked in.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Version management - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Destroy

    Remove the selected GPO from the Recycle Bin, so it can no longer be restored.

    Restore

    Move the selected GPO from the Recycle Bin to the Controlled tab. This does not restore the GPO to the production environment.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md deleted file mode 100644 index d727f2d26b..0000000000 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1 -description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1 -author: dansimp -ms.assetid: 91835bf8-e53c-4202-986e-8d37050d1267 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft Advanced Group Policy Management (AGPM) 4.0 SP1. These release notes contain information that is required to successfully install AGPM 4.0 SP1 and contain information that is not available in the product documentation. If there is a difference between these release notes and other AGPM documentation, the latest change should be considered authoritative. These release notes supersede the content included with this product. - -## AGPM 4.0 SP1 known issues - - -This section contains release notes for AGPM 4.0 SP1. - -### Control Panel’s “Uninstall” tool may not work when you try to change AGPM Server settings - -The tool in Control Panel that lets you uninstall or change a program may not work when you try to change AGPM server settings. - -WORKAROUND: Before you try to change AGPM server settings by using Control Panel, make a copy of the AGPM Archive folder. You can then use Setup.exe to reinstall the AGPM server and choose the configuration parameters that you want. - -### Reports do not display the links that were added to a Group Policy Object - -The AGPM settings and difference reports do not display the links that were added to a Group Policy Object (GPO). - -WORKAROUND: To view the links in the reports, select the GPO in the Group Policy Management Console (GPMC), and click the **Settings** tab in the right pane. - -### Reports do not display all “Choice Options Properties” settings - -The AGPM settings and difference reports do not display all of the settings that were selected on the Choice Options Properties window in the Group Policy Object Editor. - -WORKAROUND: Use the GPMC to view the selected Choice Options Properties settings in the reports. - -### Reports do not display the Show and Hide tabs in certain browsers - -The Show and Hide tabs, shown on the right side of the AGPM settings and difference reports, are not displayed when you view the reports in Google Chrome or Mozilla Firefox. - -WORKAROUND: View the reports by using Internet Explorer. - -### AGPM settings and difference reports may show different content from GPMC reports - -The AGPM settings and difference reports may not show the same content as reports in the Group Policy Management Console (GPMC). - -WORKAROUND: Use the GPMC to view the AGPM reports. - -### AGPM Service does not start if the domain controller is not online - -When the AGPM Service is installed on a domain controller on Windows 8, the Service does not start if the domain controller is not online. - -WORKAROUND: Manually start the AGPM Service after the domain controller is online. - -### Upgrade of AGPM Server to AGPM 4.0 SP1 is blocked when you upgrade from the AGPM 4.0 release plus the hotfix - -If you try to upgrade the AGPM server to AGPM 4.0. SP1 after installing AGPM 4.0 and then installing the AGPM hotfix (see Knowledge Base article [2643502](https://go.microsoft.com/fwlink/?LinkId=254474)), the upgrade fails and cannot be completed. - -WORKAROUND: Uninstall the AGPM 4.0 Server and then install AGPM 4.0 SP1. - -### Reports do not display organizational unit links - -If you link an uncontrolled GPO to an organizational unit and then control that GPO using AGPM, the AGPM settings and difference reports do not display the organizational unit links. - -WORKAROUND: From the **Controlled** tab of the **Change Settings** node, right-click the GPO and click **Settings** and then click **GPO Links** to view the organizational links. Alternatively, you can use the GPMC to view the links to a GPO from the **Scope** tab. - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[What's New in AGPM 4.0 SP1](whats-new-in-agpm-40-sp1.md) - -  - -  - - - - - diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md deleted file mode 100644 index 5ce4c30b65..0000000000 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2 -description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2 -author: dansimp -ms.assetid: 0593cd11-3308-4942-bf19-8a7bb9447f01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft Advanced Group Policy Management (AGPM) 4.0 Service Pack 2 (SP2). These release notes contain information that is required to successfully install AGPM 4.0 SP2 and contain information that is not available in the product documentation. If there is a difference between these release notes and other AGPM documentation, consider the latest change authoritative. These release notes supersede the content included with this product. - -## AGPM 4.0 SP2 known issues - - -This section describes the known issues for AGPM 4.0 SP2. - -### Control Panel’s “Uninstall” tool may not work when you try to change AGPM Server settings - -The tool in Control Panel that you use to uninstall or change a program may not work when you try to change AGPM Server settings. - -**Workaround:** Before you try to change AGPM Server settings by using Control Panel, make a copy of the AGPM Archive folder. You can then use Setup.exe to reinstall the AGPM Server and choose the configuration parameters that you want. - -### Reports do not display the links that were added to a Group Policy Object - -The AGPM settings and difference reports do not display the links that were added to a Group Policy Object (GPO). - -**Workaround:** To view the links in the reports, select the GPO in the Group Policy Management Console (GPMC), and then click the **Settings** tab in the right pane. - -### Reports do not display all Choice Options Properties settings - -The AGPM settings and difference reports do not display all of the settings that were selected in the **Choice Options Properties** window in the Group Policy Object Editor. - -**Workaround:** Use the GPMC to view the selected **Choice Options Properties** settings in the reports. - -### Reports may not display the Show and Hide tabs in certain browsers - -The **Show** and **Hide** tabs, on the right side of the AGPM settings and difference reports, may not appear when you view the reports in Google Chrome or Mozilla Firefox. - -**Workaround:** View the reports by using the Internet Explorer browser. - -### AGPM settings and difference reports may show different content from GPMC reports - -The AGPM settings and difference reports may not show the same content as reports in the GPMC. - -**Workaround:** Use the GPMC to view the AGPM reports. - -### AGPM Service does not start if the domain controller is offline - -When the AGPM Service is installed on a domain controller on the Windows® 8 operating systems or later operating systems, the service does not start if the domain controller is offline. - -**Workaround:** Manually start the AGPM Service after the domain controller is online. - -### Upgrade of AGPM Server to AGPM 4.0 SP2 is blocked when you upgrade from the AGPM 4.0 release plus hotfix 1 - -If you try to upgrade the AGPM server to AGPM 4.0. SP2 after installing AGPM 4.0 Server and then installing the AGPM hotfix named AGPM 4.0 reports incorrect differences in the HTML report (see Knowledge Base article [2643502](https://go.microsoft.com/fwlink/?LinkId=254474)), the upgrade fails and cannot be completed. - -**Workaround:** Uninstall the AGPM 4.0 Server and then install AGPM 4.0 SP2. - -### Reports do not display organizational unit links - -If you link an uncontrolled GPO to an organizational unit and then control that GPO by using AGPM, the AGPM settings and difference reports do not display the organizational unit links. - -**Workaround:** On the **Controlled** tab of the **Change Settings** node, right-click the GPO, click **Settings**, and then click **GPO Links** to view the organizational links. Alternatively, you can use the GPMC to view the links to a GPO from the **Scope** tab. - -### AGPM displays an error if you click the Back button from the Change, Repair, or Remove AGPM Client dialog box - -If you browse to **Programs and Features** in Control Panel and then select **Microsoft Advanced Group Policy Management – Client**, AGPM displays an error if you click **Modify** and then click the **Back** button in the **Change, Repair, or Remove AGPM Client** dialog box. - -**Workaround:** Click **Cancel** to clear the error, and then start the process again. Do not click the **Back** button after you click **Modify** . - -### Comment fails to appear in the History window when the Approver deploys a GPO and enters a comment - -If a user who has the Editor role submits a request to deploy a GPO, and the user who has the Approver role then deploys the GPO and enters a comment, the comment fails to appear in the **History** window. - -**Workaround:** None. - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[What's New in AGPM 4.0 SP2](whats-new-in-agpm-40-sp2.md) - -  - -  - - - - - diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md deleted file mode 100644 index 24f3ccb1f0..0000000000 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md +++ /dev/null @@ -1,113 +0,0 @@ ---- -title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3 -description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3 -author: dansimp -ms.assetid: 955d7674-a8d9-4fc5-b18a-5a1639e38014 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 09/27/2016 ---- - - -# Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft Advanced Group Policy Management (AGPM) 4.0 Service Pack 3 (SP3). These release notes contain information that is required to successfully install AGPM 4.0 SP3 and contain information that is not available in the product documentation. If there is a difference between these release notes and other AGPM documentation, consider the latest change authoritative. These release notes supersede the content included with this product. - -## AGPM 4.0 SP3 known issues - - -This section describes the known issues for AGPM 4.0 SP3. - -### AGPM installation fails in Windows 10 - -AGPM internally enables the Windows Communication Foundation (WCF)-NonHTTP-Activation feature during installation. In Windows 10, WCF now includes a requirement to restart Windows after enabling the WCF NonHTTP-Activation feature. However, the current AGPM installer code does not handle this restart requirement and stops responding while it waits for the service to be activated. - -**Workaround:** Before you run the AGPM installer, enable the WCF Non-HTTP Activation feature and then restart Windows. - -### Control Panel’s “Uninstall” tool may not work when you try to change AGPM Server settings - -The tool in Control Panel that you use to uninstall or change a program may not work when you try to change AGPM Server settings. - -**Workaround:** Before you try to change AGPM Server settings by using Control Panel, make a copy of the AGPM Archive folder. You can then use Setup.exe to reinstall the AGPM Server and choose the configuration parameters that you want. - -### Reports do not display the links that were added to a Group Policy Object - -The AGPM settings and difference reports do not display the links that were added to a Group Policy Object (GPO). - -**Workaround:** To view the links in the reports, select the GPO in the Group Policy Management Console (GPMC), and then click the **Settings** tab in the right pane. - -### Reports do not display all Choice Options Properties settings - -The AGPM settings and difference reports do not display all of the settings that were selected in the **Choice Options Properties** window in the Group Policy Object Editor. - -**Workaround:** Use the GPMC to view the selected **Choice Options Properties** settings in the reports. - -### Reports may not display the Show and Hide tabs in certain browsers - -The **Show** and **Hide** tabs, on the right side of the AGPM settings and difference reports, may not appear when you view the reports in Google Chrome or Mozilla Firefox. - -**Workaround:** View the reports by using the Internet Explorer browser. - -### AGPM settings and difference reports may show different content from GPMC reports - -The AGPM settings and difference reports may not show the same content as reports in the GPMC. - -**Workaround:** Use the GPMC to view the AGPM reports. - -### AGPM Service does not start if the domain controller is offline - -When the AGPM Service is installed on a domain controller on the Windows® 8 operating systems or later operating systems, the service does not start if the domain controller is offline. - -**Workaround:** Manually start the AGPM Service after the domain controller is online. - -### Upgrade of AGPM Server to AGPM 4.0 SP2 is blocked when you upgrade from the AGPM 4.0 release plus hotfix 1 - -If you try to upgrade the AGPM server to AGPM 4.0. SP2 after installing AGPM 4.0 Server and then installing the AGPM hotfix named AGPM 4.0 reports incorrect differences in the HTML report (see Knowledge Base article [2643502](https://go.microsoft.com/fwlink/?LinkId=254474)), the upgrade fails and cannot be completed. - -**Workaround:** Uninstall the AGPM 4.0 Server and then install AGPM 4.0 SP2. - -### Reports do not display organizational unit links - -If you link an uncontrolled GPO to an organizational unit and then control that GPO by using AGPM, the AGPM settings and difference reports do not display the organizational unit links. - -**Workaround:** On the **Controlled** tab of the **Change Settings** node, right-click the GPO, click **Settings**, and then click **GPO Links** to view the organizational links. Alternatively, you can use the GPMC to view the links to a GPO from the **Scope** tab. - -### AGPM displays an error if you click the Back button from the Change, Repair, or Remove AGPM Client dialog box - -If you browse to **Programs and Features** in Control Panel and then select **Microsoft Advanced Group Policy Management – Client**, AGPM displays an error if you click **Modify** and then click the **Back** button in the **Change, Repair, or Remove AGPM Client** dialog box. - -**Workaround:** Click **Cancel** to clear the error, and then start the process again. Do not click the **Back** button after you click **Modify** . - -### Comment fails to appear in the History window when the Approver deploys a GPO and enters a comment - -If a user who has the Editor role submits a request to deploy a GPO, and the user who has the Approver role then deploys the GPO and enters a comment, the comment fails to appear in the **History** window. - -**Workaround:** None. - -### Added mechanism to override AGPM default behavior of removing GPO permission changes - -As of HF02, AGPM has added a registry key to enable overriding the default AGPM GPO permission behavior. For more information, please see [Changes to Group Policy object permissions through AGPM are ignored](https://support.microsoft.com/kb/3174540) - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[What's New in AGPM 4.0 SP3](whats-new-in-agpm-40-sp3.md) - -  - -  - - - - - diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md deleted file mode 100644 index 5fa848da03..0000000000 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Release Notes for Microsoft Advanced Group Policy Management 4.0 -description: Release Notes for Microsoft Advanced Group Policy Management 4.0 -author: dansimp -ms.assetid: 44c19e61-c8e8-48aa-a2c2-20396d14d5bb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for Microsoft Advanced Group Policy Management 4.0 - - -October 2009 - -## About Microsoft Advanced Group Policy Management 4.0 - - -Microsoft Advanced Group Policy Management (AGPM) 4.0 extends the capabilities of the Group Policy Management Console (GPMC). AGPM provides comprehensive change control and improved management of Group Policy Objects (GPOs). - -The following documents can help you get started with AGPM 4.0. - -- For an overview of the capabilities of AGPM, see [Overview of Microsoft Advanced Group Policy Management](https://go.microsoft.com/fwlink/?LinkID=162671) (https://go.microsoft.com/fwlink/?LinkID=162671). - -- For information about how AGPM 4.0 differs from AGPM 3.0, see [What's New in AGPM 4.0](https://go.microsoft.com/fwlink/?LinkId=160058) (https://go.microsoft.com/fwlink/?LinkId=160058). - -- For guidance about how to determine whether AGPM 4.0, AGPM 3.0, or AGPM 2.5 is appropriate for your environment, see [Choosing Which Version of AGPM to Install](https://go.microsoft.com/fwlink/?LinkId=145981) (https://go.microsoft.com/fwlink/?LinkId=145981). - -- For basic guidance about how to install AGPM and a sample scenario for using AGPM, see [Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0](https://go.microsoft.com/fwlink/?LinkID=153505) (https://go.microsoft.com/fwlink/?LinkID=153505). This guide is primarily designed to help evaluators and first-time users. - -- For information about how to upgrade from an earlier version of AGPM or detailed guidance about how to plan the deployment of AGPM in your organization, see the [Planning Guide for Microsoft Advanced Group Policy Management 4.0](https://go.microsoft.com/fwlink/?LinkID=156883) (https://go.microsoft.com/fwlink/?LinkID=156883). - -- For information about how to use AGPM to perform specific tasks, see the Advanced Group Policy Management 4.0 Help, which is also available on TechNet as the [Operations Guide for AGPM 4.0](https://go.microsoft.com/fwlink/?LinkId=159872) (https://go.microsoft.com/fwlink/?LinkId=159872). - -## More information - - -For more information about AGPM, see the following: - -- [Advanced Group Policy Management TechNet Library](https://go.microsoft.com/fwlink/?LinkID=146846) (https://go.microsoft.com/fwlink/?LinkID=146846) - -- [Microsoft Desktop Optimization Pack TechCenter](https://go.microsoft.com/fwlink/?LinkId=159870) (https://www.microsoft.com/technet/mdop) - -- [Group Policy TechCenter](https://go.microsoft.com/fwlink/?LinkId=145531) (https://www.microsoft.com/gp) - -## Providing feedback - - -You can post feedback or questions about AGPM to the [Group Policy Forum](https://go.microsoft.com/fwlink/?LinkId=145532) (https://go.microsoft.com/fwlink/?LinkId=145532). - -## Known issues with AGPM 4.0 - - -### Import from Production command does not import settings into a GPO that is checked out - -If you edit a GPO in the production environment, you must import the GPO from production to update the GPO in the offline archive. The **Import from Production** command is intended to let you perform a final production backup before you finish editing so that you can roll back to the production backup if it is necessary. - -If the GPO is checked out when you run the **Import from Production** command, then the production changes are not incorporated into the checked out version of the GPO. However, the imported version of the GPO is added to the history of the GPO even though that version is not available to be edited. When the GPO is checked in, that version will supersede the imported version in the archive, but both are available in the history of the GPO. - -**Workaround:** Make sure that the GPO is checked in before you import it from production. If the GPO was not checked in before you imported it, you can use the **Undo Check Out** command to discard your changes and roll back to the version of the GPO that you imported from production. - -### Checked out GPOs cannot be edited for several minutes in an environment that uses a multiple site Active Directory topology - -AGPM uses a client/server model. The AGPM Server and the AGPM Client each determine their own closest domain controller for Group Policy operations. When you check out a GPO by using an AGPM Client, it is actually the AGPM Server that checks the GPO out from the offline archive to a temporary folder in the SYSVOL folder. - -If the AGPM Server and the AGPM Client are in different sites, then the temporary checked out GPO may not be present on the local site's domain controller for several minutes or up to 30 minutes due to SYSVOL replication latency. In this situation, you cannot edit the checked out GPO using the GPMC on an AGPM Client until SYSVOL replication of the checked out GPO has occurred. - -**Workaround:** As a best practice, you should position AGPM Clients in the same site as the AGPM Server to which they connect so that you do not have to wait for SYSVOL replication to occur before you can edit a checked out GPO. - -### AGPM cannot read the backup limit if your account does not have permissions for the archive - -On an AGPM Client, if you log on by using an account that has not been delegated permissions to the AGPM archive, start the Group Policy Management Console (GPMC), and then click **Change Control**, you receive the following error. - -``` syntax -Failed to read backup purge limit for this domain. - -The following error occurred: -You do not have sufficient permissions to perform this operation. -Microsoft.Agpm.AccessDeniedException (80070005) -``` - -**Workaround:** Contact an AGPM Administrator (Full Control) and request that they delegate access to AGPM for your account. If you are an AGPM Administrator, log on by using an account to which the AGPM Administrator role is assigned so that you can delegate access for the additional account. For more information, see "Delegate Domain-Level Access to the Archive" in the AGPM Help. - -## Release notes copyright information - - -Information in this document, including URL and other Internet Web site references, is subject to change without notice, and is provided for informational purposes only. The entire risk of the use or results of the use of this document remains with the user, and Microsoft Corporation makes no warranties, either express or implied. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. - -Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. - - - -Microsoft, MS-DOS, Windows, Windows Server, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. - -The names of actual companies and products mentioned herein may be the trademarks of their respective owners. - -  - -  - - - - - diff --git a/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md b/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md deleted file mode 100644 index 891a770b95..0000000000 --- a/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Rename a GPO or Template -description: Rename a GPO or Template -author: dansimp -ms.assetid: 19d17ddf-8b58-4677-929e-9550fa388b93 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Rename a GPO or Template - - -You can rename a controlled Group Policy Object (GPO) or a template. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To rename a GPO or template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** or **Templates** tab to display the item to rename. - -3. Right-click the GPO or template to rename and click **Rename**. - -4. Type the new name for the GPO or template and a comment, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO or template appears under the new name on the **Contents** tab. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- When you rename a GPO that has been deployed, the name is immediately changed in the archive. The name is changed in the production environment only when the GPO is redeployed. Until the GPO is redeployed (or the production copy is deleted), the old name is still in use in the production environment and therefore cannot be used for another GPO. Likewise, the GPO in the archive cannot be renamed back to its original name until the GPO has been deployed (changing the name of the production copy) or the production copy has been deleted. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/rename-a-gpo-or-template-agpm40.md b/mdop/agpm/rename-a-gpo-or-template-agpm40.md deleted file mode 100644 index 6eddae8e9e..0000000000 --- a/mdop/agpm/rename-a-gpo-or-template-agpm40.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Rename a GPO or Template -description: Rename a GPO or Template -author: dansimp -ms.assetid: 84293f7a-4ff7-497e-bdbc-cabb70189a03 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Rename a GPO or Template - - -You can rename a controlled Group Policy Object (GPO) or a template. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To rename a GPO or template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** or **Templates** tab to display the item to rename. - -3. Right-click the GPO or template to rename and click **Rename**. - -4. Type the new name for the GPO or template and a comment, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO or template appears under the new name on the **Contents** tab. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- When you rename a GPO that has been deployed, the name is immediately changed in the archive. The name is changed in the production environment only when the GPO is redeployed. Until the GPO is redeployed (or the production copy is deleted), the old name is still in use in the production environment and therefore cannot be used for another GPO. Likewise, the GPO in the archive cannot be renamed back to its original name until the GPO has been deployed (changing the name of the production copy) or the production copy has been deleted. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/rename-a-gpo-or-template.md b/mdop/agpm/rename-a-gpo-or-template.md deleted file mode 100644 index b4f6b328cf..0000000000 --- a/mdop/agpm/rename-a-gpo-or-template.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Rename a GPO or Template -description: Rename a GPO or Template -author: dansimp -ms.assetid: 64a1aaf4-f672-48b5-94c6-473bf1076cf3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Rename a GPO or Template - - -You can rename a controlled Group Policy object (GPO) or a template. - -A user account with the Editor or AGPM Administrator (Full Control) role, the user account of the Approver who created the GPO, or a user account with the necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To rename a GPO or template** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** or **Templates** tab to display the item to rename. - -3. Right-click the GPO or template to rename and click **Rename**. - -4. Type the new name for the GPO or template and a comment, then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO or template appears under the new name on the **Contents** tab. - -### Additional considerations - -- By default, you must be the Approver who created or controlled the GPO, an Editor, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- When you rename a GPO that has been deployed, the name is immediately changed in the archive. The name is changed in the production environment only when the GPO is redeployed. - - Until the GPO is redeployed (or the production copy is deleted), the old name is still in use in the production environment and therefore cannot be used for another GPO. Likewise, the GPO in the archive cannot be renamed back to its original name until the GPO has been deployed (changing the name of the production copy) or the production copy has been deleted. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md b/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md deleted file mode 100644 index 48168f5274..0000000000 --- a/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Control of a Previously Uncontrolled GPO -description: Request Control of a Previously Uncontrolled GPO -author: dansimp -ms.assetid: 00e8725d-5d7f-4eed-a5e6-c3631632cfbd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Control of a Previously Uncontrolled GPO - - -To use Advanced Group Policy Management (AGPM) to provide change control for an existing Group Policy object (GPO), the GPO must be controlled with AGPM. Unless you are an Approver or an AGPM Administrator (Full Control), you must request that the GPO be controlled. - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control a previously uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Unless you have special permission to control GPOs, you must submit a request for control. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** of the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Uncontrolled** tab. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md deleted file mode 100644 index 90dde7498f..0000000000 --- a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Control of an Uncontrolled GPO -description: Request Control of an Uncontrolled GPO -author: dansimp -ms.assetid: b668a67a-5a2c-4f6a-8b1c-efa3ca0794d4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Control of an Uncontrolled GPO - - -To provide change control for an existing Group Policy Object (GPO), the GPO must be controlled. Unless you are an Approver or an AGPM Administrator (Full Control), you must request that the GPO be controlled. - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control an uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Unless you have special permission to control GPOs, you must submit a request for control. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** of the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Uncontrolled** tab. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md deleted file mode 100644 index aca66f0620..0000000000 --- a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Control of an Uncontrolled GPO -description: Request Control of an Uncontrolled GPO -author: dansimp -ms.assetid: a34e0aeb-33a1-4c9f-b187-1d08493a785c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Control of an Uncontrolled GPO - - -To provide change control for an existing Group Policy Object (GPO), the GPO must be controlled. Unless you are an Approver or an AGPM Administrator (Full Control), you must request that the GPO be controlled. - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To control an uncontrolled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Uncontrolled** tab to display the uncontrolled GPOs. - -3. Right-click the GPO to be controlled with AGPM, and then click **Control**. - -4. Unless you have special permission to control GPOs, you must submit a request for control. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** of the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the list on the **Uncontrolled** tab and added to the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Uncontrolled** tab. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md b/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md deleted file mode 100644 index 6ef7e4a702..0000000000 --- a/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Request Deletion of a GPO -description: Request Deletion of a GPO -author: dansimp -ms.assetid: 576ece5c-dc6d-4b5e-8628-01c15ae2c9a8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deletion of a GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the deletion of a Group Policy Object (GPO). - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deletion of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO you want to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only**. - - - To delete the GPO from both the archive and production environment, click **Delete GPO from archive and production**. - -4. Unless you have special permission to delete GPOs, you must submit a request for deletion of the deployed GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Recycle Bin** tab, where it can be restored or destroyed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deletion-of-a-gpo-agpm40.md b/mdop/agpm/request-deletion-of-a-gpo-agpm40.md deleted file mode 100644 index 7d9ad25c8e..0000000000 --- a/mdop/agpm/request-deletion-of-a-gpo-agpm40.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Request Deletion of a GPO -description: Request Deletion of a GPO -author: dansimp -ms.assetid: 2410f7a1-ccca-44cf-ab26-76ad474409e7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deletion of a GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the deletion of a Group Policy Object (GPO). - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deletion of a controlled GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO you want to delete, and then click **Delete**. - - - To delete the GPO from the archive while leaving the deployed version of the GPO untouched in the production environment, click **Delete GPO from archive only**. - - - To delete the GPO from both the archive and production environment of the domain, click **Delete GPO from archive and production**. - -4. Unless you have special permission to delete GPOs, you must submit a request for deletion of the deployed GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Recycle Bin** tab, where it can be restored or destroyed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -- To delete an uncontrolled GPO from the production environment without first controlling it, in the **Group Policy Management Console**, click **Forest**, click **Domains**, click **<MyDomain>**, and then click **Group Policy Objects**. Right-click the uncontrolled GPO, and then click **Delete**. - -### Additional references - -- [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md b/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md deleted file mode 100644 index 7179891f76..0000000000 --- a/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Deployment of a GPO -description: Request Deployment of a GPO -author: dansimp -ms.assetid: f44ae0fb-bcf7-477b-b99e-9dd6a55ee597 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deployment of a GPO - - -After you have modified and checked in a Group Policy Object (GPO), deploy the GPO, so it will take effect in the production environment. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deployment of a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed, and then click **Deploy**. - -4. Unless you are an Approver or AGPM Administrator or have special permission to deploy GPOs, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Controlled** tab and be deployed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deployment-of-a-gpo-agpm40.md b/mdop/agpm/request-deployment-of-a-gpo-agpm40.md deleted file mode 100644 index 11a8af4db4..0000000000 --- a/mdop/agpm/request-deployment-of-a-gpo-agpm40.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Deployment of a GPO -description: Request Deployment of a GPO -author: dansimp -ms.assetid: 5783cfd0-bd93-46b4-8fa0-684bd39aa8fc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deployment of a GPO - - -After you have modified and checked in a Group Policy Object (GPO), deploy the GPO, so it will take effect in the production environment. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deployment of a GPO to the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed, and then click **Deploy**. - -4. Unless you are an Approver or AGPM Administrator or have special permission to deploy GPOs, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Controlled** tab and be deployed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -### Additional references - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-deployment-of-a-gpo.md b/mdop/agpm/request-deployment-of-a-gpo.md deleted file mode 100644 index 6c6043c1c1..0000000000 --- a/mdop/agpm/request-deployment-of-a-gpo.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Request Deployment of a GPO -description: Request Deployment of a GPO -author: dansimp -ms.assetid: 9aa9af29-4754-4f72-b624-bb3e1087cbe1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Deployment of a GPO - - -After you have modified and checked in a Group Policy object (GPO), deploy the GPO, so it will take effect in the production environment. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the deployment of a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -3. Right-click the GPO to be deployed, and then click **Deploy**. - -4. Unless you are an Approver or AGPM Administrator or have special permission to deploy GPOs, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is displayed on the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved from the **Pending** tab to the **Controlled** tab and be deployed. - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permissions for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Controlled** tab. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md deleted file mode 100644 index 0b1f4ef213..0000000000 --- a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Request Restoration of a Deleted GPO -description: Request Restoration of a Deleted GPO -author: dansimp -ms.assetid: dcc3baea-8af7-4886-a301-98b6ac5819cd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Restoration of a Deleted GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the restoration of a deleted Group Policy Object (GPO) from the Recycle Bin to return it to the archive. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the restoration of a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO you want to restore, and then click **Restore**. - -4. Unless you have special permission to restore GPOs, you must submit a request for restoration of the deleted GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md). - - - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Recycle Bin** tab. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md deleted file mode 100644 index 2ce8f77638..0000000000 --- a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Request Restoration of a Deleted GPO -description: Request Restoration of a Deleted GPO -author: dansimp -ms.assetid: bac5ca3b-be47-49b5-bf1b-96280625fda8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request Restoration of a Deleted GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the restoration of a deleted Group Policy Object (GPO) from the Recycle Bin to return it to the archive. - -A user account with the Editor role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To request the restoration of a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO you want to restore, and then click **Restore**. - -4. Unless you have special permission to restore GPOs, you must submit a request for restoration of the deleted GPO. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the audit trail for the GPO, and then click **Submit**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md). - - - -### Additional considerations - -- By default, you must be an Editor to perform this procedure. Specifically, you must have **List Contents** and **Edit Settings** permission for the GPO. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, and then click **Withdraw**. The GPO will be returned to the **Recycle Bin** tab. - -### Additional references - -- [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md deleted file mode 100644 index 7a8c1a3ab6..0000000000 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Request the Creation of a New Controlled GPO -description: Request the Creation of a New Controlled GPO -author: dansimp -ms.assetid: 4194c2f3-8116-4a35-be1a-81c84072daec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request the Creation of a New Controlled GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the creation of a new Group Policy Object (GPO). - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click **Change Control**, and then click **New Controlled GPO**. - -3. Unless you have special permission to create GPOs, you must submit a request for creation. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, enter your e-mail address in the **Cc** field. - - 2. Type a name for the new GPO. - - 3. Optional: Type a comment for the new GPO. - - 4. To deploy the new GPO to the production environment immediately upon approval, click **Create live**. To create the new GPO offline without immediately deploying it upon approval, click **Create offline**. - - 5. Select the GPO template to use as a starting point for the new GPO. - - 6. Click **Submit**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** permission for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, then click **Withdraw**. The GPO will be destroyed. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md deleted file mode 100644 index bee0c5410d..0000000000 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Request the Creation of a New Controlled GPO -description: Request the Creation of a New Controlled GPO -author: dansimp -ms.assetid: cb265238-386f-4780-a59a-0c9a4a87d736 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request the Creation of a New Controlled GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the creation of a new Group Policy Object (GPO). - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click **Change Control**, and then click **New Controlled GPO**. - -3. Unless you have special permission to create GPOs, you must submit a request for creation. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, enter your e-mail address in the **Cc** field. - - 2. Type a name for the new GPO. - - 3. Optional: Type a comment for the new GPO. - - 4. To deploy the new GPO to the production environment of the domain immediately upon approval, click **Create live**. To create the new GPO offline without immediately deploying it upon approval, click **Create offline**. - - 5. Select the GPO template to use as a starting point for the new GPO. - - 6. Click **Submit**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** permission for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, then click **Withdraw**. The GPO will be destroyed. - -### Additional references - -- [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md) - -  - -  - - - - - diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md deleted file mode 100644 index d7c1fe6de4..0000000000 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Request the Creation of a New Controlled GPO -description: Request the Creation of a New Controlled GPO -author: dansimp -ms.assetid: e1875d81-8553-42ee-8f3a-023d6ced86ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Request the Creation of a New Controlled GPO - - -Unless you are an Approver or an AGPM Administrator (Full Control), you must request the creation of a new Group Policy object (GPO) if it is to be managed using Advanced Group Policy Management (AGPM). - -A user account with the Editor or Reviewer role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To create a new GPO with change control managed through AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. Unless you have special permission to create GPOs, you must submit a request for creation. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, enter your e-mail address in the **Cc** field. - - 2. Type a name for the new GPO. - - 3. Optional: Type a comment for the new GPO. - - 4. To deploy the new GPO to the production environment immediately upon approval, click **Create live**. To create the new GPO offline without immediately deploying it upon approval, click **Create offline**. - - 5. Select the GPO template to use as a starting point for the new GPO. - - 6. Click **Submit**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed in the list of GPOs on the **Pending** tab. When an Approver has approved your request, the GPO will be moved to the **Controlled** tab. - -### Additional considerations - -- By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have **List Contents** permission for the domain. - -- To withdraw your request before it has been approved, click the **Pending** tab. Right-click the GPO, then click **Withdraw**. The GPO will be destroyed. - -### Additional references - -- [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md) - -  - -  - - - - - diff --git a/mdop/agpm/resources-for-agpm.md b/mdop/agpm/resources-for-agpm.md deleted file mode 100644 index 5aa2774df3..0000000000 --- a/mdop/agpm/resources-for-agpm.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Resources for AGPM -description: Resources for AGPM -author: dansimp -ms.assetid: b44b58c0-2810-40d6-9677-f2f64e1add75 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Resources for AGPM - - -### Documents for download - -- [Advanced Group Policy Management 4.0 documents](https://www.microsoft.com/download/details.aspx?id=13975) - -### Microsoft Desktop Optimization Pack resources - -- [Microsoft Desktop Optimization Pack (MDOP) for Software Assurance TechCenter](https://go.microsoft.com/fwlink/?LinkID=159870) (https://www.microsoft.com/technet/mdop): Links to MDOP videos and resources. - -- [Enterprise products: MDOP](https://go.microsoft.com/fwlink/?LinkID=160297): Overviews and information about the benefits of applications in MDOP. - -### Group Policy resources - -- [Group Policy TechCenter](https://go.microsoft.com/fwlink/?LinkID=145531) (https://www.microsoft.com/grouppolicy): Links to Group Policy documentation, tools, and downloads. - -- [Group Policy Team Blog](https://go.microsoft.com/fwlink/?LinkID=75192) (https://blogs.technet.com/GroupPolicy): Stay current on the latest news about Group Policy with articles by the Group Policy Team and other experts. - -- [Group Policy Forum](https://go.microsoft.com/fwlink/?LinkID=145532): Do you have questions about Group Policy or AGPM? You can post your questions to the forum, and receive answers from the experts. - -  - -  - - - - - diff --git a/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md b/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md deleted file mode 100644 index 37a1bcf1c0..0000000000 --- a/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Restore a Deleted GPO -description: Restore a Deleted GPO -author: dansimp -ms.assetid: 853feb0a-d2d9-4be9-a07e-e113a56a9968 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore a Deleted GPO - - -Approvers can restore a deleted Group Policy Object (GPO) from the Recycle Bin, returning it to the archive. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To restore a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to restore, and then click **Restore**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md). - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Deploy GPO** or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/restore-a-deleted-gpo-agpm40.md b/mdop/agpm/restore-a-deleted-gpo-agpm40.md deleted file mode 100644 index 173a4d8932..0000000000 --- a/mdop/agpm/restore-a-deleted-gpo-agpm40.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Restore a Deleted GPO -description: Restore a Deleted GPO -author: dansimp -ms.assetid: 0a131d26-a741-4a51-b612-c0bc7dbba06b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore a Deleted GPO - - -Approvers can restore a deleted Group Policy Object (GPO) from the Recycle Bin, returning it to the archive. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To restore a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to restore, and then click **Restore**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm40.md). - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Deploy GPO** or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/restore-a-deleted-gpo.md b/mdop/agpm/restore-a-deleted-gpo.md deleted file mode 100644 index a70c7bb3ae..0000000000 --- a/mdop/agpm/restore-a-deleted-gpo.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Restore a Deleted GPO -description: Restore a Deleted GPO -author: dansimp -ms.assetid: e6953296-7b7d-4d1e-ad82-d4a23044cdd7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore a Deleted GPO - - -Advanced Group Policy Management (AGPM) enables Approvers to restore a deleted Group Policy object (GPO) from the Recycle Bin, returning it to the archive. - -A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To restore a deleted GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Recycle Bin** tab to display the deleted GPOs. - -3. Right-click the GPO to restore, and then click **Restore**. - -4. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - -**Note**   -If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo.md). - - - -### Additional considerations - -- By default, you must be an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and either **Edit Settings**, **Deploy GPO**, or **Delete GPO** permissions for the GPO. - -### Additional references - -- [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md) - - - - - - - - - diff --git a/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md b/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md deleted file mode 100644 index 48e9b29395..0000000000 --- a/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Restore the Archive from a Backup -description: Restore the Archive from a Backup -author: dansimp -ms.assetid: b83f6173-a236-4da2-b16e-8df20920d4cc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore the Archive from a Backup - - -If a disaster occurs and the archive for Advanced Group Policy Management (AGPM) is damaged or destroyed, an AGPM Administrator (Full Control) can restore the archive from a backup copy prepared in advance and then import from the production environment of the domain any Group Policy Objects (GPOs) that are not in the archive or for which the version in production is more current than that in the archive. For information about how to restore an archive backup to a different server, see [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md). - -A user account that has access to the AGPM Server (the computer on which the AGPM Service is installed) and to the folder that contains the archive is required to complete this procedure. - -**To restore the archive from a backup** - -1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - -2. Remove the existing archive. By default, the archive folder is %ProgramData%\\Microsoft\\AGPM, however the AGPM Administrator who installed Microsoft Advanced Group Policy Management - Server may have entered a different location during setup. - -3. Re-create the archive folder by configuring the archive path, AGPM Service Account, Archive Owner, and listening port. Using the same values as used during the original installation is not necessary. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md). - -4. Copy the contents of the archive backup to the archive folder, copying the subfolders and files to make sure that each subfolder and file inherits the permissions of the archive folder. Be careful not to overwrite the archive folder. - -5. If you not sure about whether a GPO in the archive backup is more current than the copy of that GPO in production, generate a difference report and compare their settings. For more information, see [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md). - -6. Restart the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - -### Additional references - -- [Back Up the Archive](back-up-the-archive-agpm40.md) - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md) - -- [Managing the Archive](managing-the-archive-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/restore-the-archive-from-a-backup.md b/mdop/agpm/restore-the-archive-from-a-backup.md deleted file mode 100644 index 14a140fd80..0000000000 --- a/mdop/agpm/restore-the-archive-from-a-backup.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Restore the Archive from a Backup -description: Restore the Archive from a Backup -author: dansimp -ms.assetid: 49666337-d72c-4e44-99e4-9eb59b2355a9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restore the Archive from a Backup - - -If a disaster occurs and the archive for Advanced Group Policy Management (AGPM) is damaged or destroyed, an AGPM Administrator (Full Control) can restore the archive from a backup copy prepared in advance and then import from the production environment any Group Policy Objects (GPOs) that are not in the archive or for which the version in production is more current than that in the archive. For information about how to restore an archive backup to a different server, see [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md). - -A user account that has access to the AGPM Server (the computer on which the AGPM Service is installed) and to the folder that contains the archive is required to complete this procedure. - -**To restore the archive from a backup** - -1. Stop the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - -2. Remove the existing archive. By default, the archive folder is %ProgramData%\\Microsoft\\AGPM, however the AGPM Administrator who installed Microsoft Advanced Group Policy Management - Server may have entered a different location during setup. - -3. Re-create the archive folder by configuring the archive path, AGPM Service Account, Archive Owner, and listening port. Using the same values as used during the original installation is not necessary. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md). - -4. Copy the contents of the archive backup to the archive folder, copying the subfolders and files to make sure that each subfolder and file inherits the permissions of the archive folder. Be careful not to overwrite the archive folder. - -5. If you not sure about whether a GPO in the archive backup is more current than the copy of that GPO in production, generate a difference report and compare their settings. For more information, see [Identify Differences Between GPOs, GPO Versions, or Templates](identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md). - -6. Restart the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - -### Additional references - -- [Back Up the Archive](back-up-the-archive.md) - -- [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md) - -- [Managing the Archive](managing-the-archive.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-links-agpm30ops.md b/mdop/agpm/review-gpo-links-agpm30ops.md deleted file mode 100644 index 344d2114e2..0000000000 --- a/mdop/agpm/review-gpo-links-agpm30ops.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Review GPO Links -description: Review GPO Links -author: dansimp -ms.assetid: 5ae95afc-2b89-45cf-916c-efe2d43b2211 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Links - - -You can display a diagram showing where a Group Policy Object (GPO) or GPOs that you select are linked to organizational units. GPO link diagrams are updated each time the GPO is controlled, imported, or checked in. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Reviewing GPO links - - -- [For one or more GPOs](#bkmk-gpos) - -- [For one or more versions of a GPO](#bkmk-gpo-versions) - -### - -**To display GPO links for one or more GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled**, **Pending**, or **Recycle Bin** tab to display GPOs. - -3. Select one or more GPOs for which to display links, right-click a selected GPO, click **Settings**, and then click **GPO Links** to display a diagram of domains and organizational units with links to the selected GPO(s). - -### - -**To display GPO links for one or more versions of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Recycle Bin** tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-links-agpm40.md b/mdop/agpm/review-gpo-links-agpm40.md deleted file mode 100644 index 0aa1c8288a..0000000000 --- a/mdop/agpm/review-gpo-links-agpm40.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Review GPO Links -description: Review GPO Links -author: dansimp -ms.assetid: 3aaba9da-f0aa-466f-bd1c-49f11d00ea54 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Links - - -You can display a diagram showing where a Group Policy Object (GPO) or GPOs that you select are linked to organizational units. GPO link diagrams are updated each time the GPO is controlled, imported, or checked in. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Reviewing GPO links - - -- [For one or more GPOs](#bkmk-gpos) - -- [For one or more versions of a GPO](#bkmk-gpo-versions) - -### - -**To display GPO links for one or more GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled**, **Pending**, or **Recycle Bin** tab to display GPOs. - -3. Select one or more GPOs for which to display links, right-click a selected GPO, click **Settings**, and then click **GPO Links** to display a diagram of domains and organizational units with links to the selected GPO(s). - -### - -**To display GPO links for one or more versions of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Recycle Bin** tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-links.md b/mdop/agpm/review-gpo-links.md deleted file mode 100644 index 5df2d37d92..0000000000 --- a/mdop/agpm/review-gpo-links.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Review GPO Links -description: Review GPO Links -author: dansimp -ms.assetid: 3c472448-f16a-493c-a229-5ca60a470965 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Links - - -You can display a diagram showing where a Group Policy object (GPO) or GPOs that you select are linked to organizational units. GPO link diagrams are updated each time the GPO is controlled, imported, or checked in. - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -## Reviewing GPO links - - -- [For one or more GPOs](#bkmk-gpos) - -- [For one or more versions of a GPO](#bkmk-gpo-versions) - -### - -**To display GPO links for one or more GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled**, **Pending**, or **Recycle Bin** tab to display GPOs. - -3. Select one or more GPOs for which to display links, right-click a selected GPO, click **Settings**, and then click **GPO Links** to display a diagram of domains and organizational units with links to the selected GPO(s). - -### - -**To display GPO links for one or more versions of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Controlled** or **Recycle Bin** tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-settings-agpm30ops.md b/mdop/agpm/review-gpo-settings-agpm30ops.md deleted file mode 100644 index e8287b80ff..0000000000 --- a/mdop/agpm/review-gpo-settings-agpm30ops.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Review GPO Settings -description: Review GPO Settings -author: dansimp -ms.assetid: bed956d0-082e-4fa9-bf1e-572d0d3d02ec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Settings - - -You can generate HTML-based and XML-based reports for reviewing settings within any version of a Group Policy Object (GPO). - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To review settings in any version of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-settings-agpm40.md b/mdop/agpm/review-gpo-settings-agpm40.md deleted file mode 100644 index 86d54adf3c..0000000000 --- a/mdop/agpm/review-gpo-settings-agpm40.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Review GPO Settings -description: Review GPO Settings -author: dansimp -ms.assetid: c346bcde-dd6a-4775-aeab-721ca3a361b2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Settings - - -You can generate HTML-based and XML-based reports for reviewing settings within any version of a Group Policy Object (GPO). - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To review settings in any version of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/review-gpo-settings.md b/mdop/agpm/review-gpo-settings.md deleted file mode 100644 index 31cdb5b678..0000000000 --- a/mdop/agpm/review-gpo-settings.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Review GPO Settings -description: Review GPO Settings -author: dansimp -ms.assetid: e82570b2-d8ce-4bf0-8ad7-8910409f3041 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Review GPO Settings - - -You can generate HTML-based and XML-based reports for reviewing settings within any version of a Group Policy object (GPO). - -A user account with the Reviewer, Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To review settings in any version of a GPO** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click a tab to display GPOs. - -3. Double-click the GPO to display its history. - -4. Right-click the GPO version for which to review the settings, click **Settings**, and then click **HTML Report** or **XML Report** to display a summary of the GPO's settings. - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Read Settings** permissions for the GPO. Also, to display the list of GPOs, you must have **List Contents** permission for the domain. - -### Additional references - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md deleted file mode 100644 index 5317c7cad8..0000000000 --- a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Roll Back to a Previous Version of a GPO -description: Roll Back to a Previous Version of a GPO -author: dansimp -ms.assetid: 2a98ad8f-32cb-41eb-ab99-0318f2a55d81 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Roll Back to a Previous Version of a GPO - - -An Approver can roll back changes to a Group Policy Object (GPO) by redeploying an earlier version of the GPO from its history. Deploying an earlier version of a GPO overwrites the version of the GPO currently in production. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a previous version of a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Double-click the GPO to be deployed to display its **History**. - -4. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - -**Note**   -To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md deleted file mode 100644 index 1f984420dd..0000000000 --- a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Roll Back to a Previous Version of a GPO -description: Roll Back to a Previous Version of a GPO -author: dansimp -ms.assetid: 028631c0-4cb9-4642-90ad-04cd813051b7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Roll Back to a Previous Version of a GPO - - -Advanced Group Policy Management (AGPM) enables an Approver to roll back changes to a Group Policy object (GPO) by redeploying an earlier version of the GPO from its history. Deploying an earlier version of a GPO overwrites the version of the GPO currently in production. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy a previous version of a GPO to the production environment** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Double-click the GPO to be deployed to display its **History**. - -4. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - -**Note**   -To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md b/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md deleted file mode 100644 index eda0e2c1fe..0000000000 --- a/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Roll Back to an Earlier Version of a GPO -description: Roll Back to an Earlier Version of a GPO -author: dansimp -ms.assetid: 06ce9251-95e0-46d0-99c2-b9a0690e5891 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Roll Back to an Earlier Version of a GPO - - -An Approver can roll back changes to a Group Policy Object (GPO) by redeploying an earlier version of the GPO from its history. Deploying an earlier version of a GPO overwrites the version of the GPO currently in production. - -A user account with the Approver or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To deploy an earlier version of a GPO to the production environment of the domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -3. Double-click the GPO to be deployed to display its **History**. - -4. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - -**Note**   -To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**. - - - -### Additional considerations - -- By default, you must be an Approver or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Deploy GPO** permissions for the GPO. - -### Additional references - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/search-and-filter-the-list-of-gpos.md b/mdop/agpm/search-and-filter-the-list-of-gpos.md deleted file mode 100644 index 0266fdfa89..0000000000 --- a/mdop/agpm/search-and-filter-the-list-of-gpos.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: Search and Filter the List of GPOs -description: Search and Filter the List of GPOs -author: dansimp -ms.assetid: 1bc58a38-033c-4aed-9eb4-c239827f5501 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Search and Filter the List of GPOs - - -In Advanced Group Policy Management (AGPM), you can search the list of Group Policy Objects (GPOs) and their attributes to filter the list of GPOs displayed. For example, you can search for GPOs with a particular name, state, or comment. You can also search for GPOs that were last changed by a particular Group Policy administrator or on a particular date. - -## Performing a complex search - - -You can perform a complex search by using the format *GPO attribute 1: search string 1 GPO attribute 2: search string 2…all-column search strings*. The search is not case-sensitive. - -- **GPO attribute:** Any column heading in the list of GPOs in AGPM other than **Computer Version** or **User Version**. GPO attributes include the GPO name, state, user who most recently changed the GPO, date and time when the GPO was most recently changed, comment, GPO status, and WMI filter applied to the GPO. - -- **Search string:** Text for which to search in the specified column. If a string includes spaces, you must enclose the string with quotation marks. - -- **All-column search strings:** Text for which to search in all columns in the list of GPOs in AGPM other than **Computer Version** and **User Version**. You can include multiple strings separated by spaces. If a string includes spaces, you must enclose the string with quotation marks. - -Each GPO attribute and search string pair and each all-column search string are combined by using a logical AND operation. The result is a list of all GPOs for which each specified attribute includes the specified search string and for which any all-column search strings appear in at least one column. The search returns any partial matches for strings so that you can enter part of a GPO name or user name and view a list of all GPOs that include that text in their name. - -The following are examples of searches: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Description of search resultSearch query

    All GPOs with names that include the text security and North America.

    name: security name: "North America"

    All checked out GPOs.

    state: "checked out"

    All GPOs most recently changed by the user named Administrator and most recently changed within the previous month.

    changed by: Administrator change date: lastmonth

    All GPOs in which the word firewall is included in the most recent comment and in which the word security appears in any column.

    comment: firewall security

    All GPOs that have a status of All Settings Disabled.

    gpo status: all

    All GPOs that have a WMI filter named My WMI Filter applied and that have a status of User Configuration Settings Disabled.

    wmi filter: "My WMI Filtergpo status: user

    - -  - -## Specifying dates - - -You can search for GPOs changed on a specific date, at a specific time, or during a span of time by using the same special terms available when you search in Windows. If entering a specific date or time, you must use the format that is used in the **Change Date** column. The following are examples of searches of the **Change Date** column: - -- **change date:** **10/10/2009** - -- **change date:** **10/10/2009 9:00:00 AM** - -- **change date:** **thisweek** - -You can use the following special terms, which are not case-sensitive, when you search the **Change Date** column: - -- **Today** - -- **Yesterday** - -- **ThisWeek** - -- **LastWeek** - -- **ThisMonth** - -- **LastMonth** - -- **TwoMonths** - -- **ThreeMonths** - -- **ThisYear** - -- **LastYear** - -### Additional considerations - -- By default, you must be a Reviewer, an Editor, an Approver, or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** permission for the domain. - -- For more information about GPO attributes, see [Contents Tab Features](contents-tab-features-agpm40.md). - -### Additional references - -- [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md) - -  - -  - - - - - diff --git a/mdop/agpm/set-a-default-template-agpm30ops.md b/mdop/agpm/set-a-default-template-agpm30ops.md deleted file mode 100644 index 8da4e564b8..0000000000 --- a/mdop/agpm/set-a-default-template-agpm30ops.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Set a Default Template -description: Set a Default Template -author: dansimp -ms.assetid: 84edbd69-451b-4c10-a898-781d4b75d09c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Set a Default Template - - -As an Editor, you can specify which of the available templates will be the default template suggested for all Group Policy administrators creating new Group Policy Objects (GPOs). - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To set the default template for use when creating new GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Templates** tab to display available templates. - -3. Right-click the template that you want to set as the default, and then click **Set as Default**. - -4. Click **Yes** to confirm. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The default template has a blue icon and the state is identified as **Template (default)** on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- After you set a template as the default, that template will be the one initially selected in the **New Controlled GPO** dialog box when Group Policy administrators create new GPOs. However, they will have the option to select any other GPO template, including **<Empty GPO>**, which does not include any settings. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm30ops.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/set-a-default-template-agpm40.md b/mdop/agpm/set-a-default-template-agpm40.md deleted file mode 100644 index c6b0a93381..0000000000 --- a/mdop/agpm/set-a-default-template-agpm40.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Set a Default Template -description: Set a Default Template -author: dansimp -ms.assetid: 07208b6b-cb3a-4f6c-9c84-36d4dc1486d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Set a Default Template - - -As an Editor, you can specify which of the available templates will be the default template suggested for all Group Policy administrators creating new Group Policy Objects (GPOs). - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To set the default template for use when creating new GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Templates** tab to display available templates. - -3. Right-click the template that you want to set as the default, and then click **Set as Default**. - -4. Click **Yes** to confirm. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The default template has a blue icon and the state is identified as **Template (default)** on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- After you set a template as the default, that template will be the one initially selected in the **New Controlled GPO** dialog box when Group Policy administrators create new GPOs. However, they will have the option to select any other GPO template, including **<Empty GPO>**, which does not include any settings. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template-agpm40.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/set-a-default-template.md b/mdop/agpm/set-a-default-template.md deleted file mode 100644 index 26a7b044a5..0000000000 --- a/mdop/agpm/set-a-default-template.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Set a Default Template -description: Set a Default Template -author: dansimp -ms.assetid: e0acf980-437f-4357-b237-298aaebe490d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Set a Default Template - - -As an Editor, you can specify which of the available templates will be the default template suggested for all Group Policy administrators creating new Group Policy objects (GPOs). - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. - -**To set the default template for use when creating new GPOs** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Contents** tab in the details pane, click the **Templates** tab to display available templates. - -3. Right-click the template that you want to set as the default, and then click **Set as Default**. - -4. Click **Yes** to confirm. - -5. When the **Progress** window indicates that overall progress is complete, click **Close**. The default template has a blue icon and the state is identified as **Template (default)** on the **Templates** tab. - -### Additional considerations - -- By default, you must be an Editor or an AGPM Administrator (Full Control) to perform this procedure. Specifically, you must have **List Contents** and **Create Template** permissions for the domain. - -- After you set a template as the default, that template will be the one initially selected in the **New Controlled GPO** dialog box when Group Policy administrators create new GPOs. However, they will have the option to select any other GPO template, including **<Empty GPO>**, which does not include any settings. - -- Renaming or deleting a template does not impact GPOs created from that template. - -- Because it cannot be altered, a template does not have a history. - -### Additional references - -- [Creating a Template and Setting a Default Template](creating-a-template-and-setting-a-default-template.md) - -- [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md) - - - - - - - - - diff --git a/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md b/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md deleted file mode 100644 index 4618d3c9fd..0000000000 --- a/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Start and Stop the AGPM Service -description: Start and Stop the AGPM Service -author: dansimp -ms.assetid: b9d26920-c439-4992-9a78-73e4fba8309d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Start and Stop the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment. - -**Important**   -Stopping or disabling the AGPM Service will prevent AGPM Clients from performing any operations (such as listing or editing GPOs) through the server. - - - -A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure. - -**To start or stop the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server (and therefore the AGPM Service) is installed, click **Start**, click **Control Panel**, click **Administrative Tools**, and then click **Services**. - -2. In the list of services, right-click **AGPM Service** and select **Start**, **Restart**, or **Stop**. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md b/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md deleted file mode 100644 index 3cc649d89b..0000000000 --- a/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Start and Stop the AGPM Service -description: Start and Stop the AGPM Service -author: dansimp -ms.assetid: dcc9566c-c515-4fbe-b7f5-8ac030141307 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Start and Stop the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy Objects (GPOs) in the archive and production environment. - -**Important**   -Stopping or disabling the AGPM Service will prevent AGPM Clients from performing any operations (such as listing or editing GPOs) through the server. - - - -A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure. - -**To start or stop the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server (and therefore the AGPM Service) is installed, click **Start**, click **Control Panel**, click **Administrative Tools**, and then click **Services**. - -2. In the list of services, right-click **AGPM Service** and select **Start**, **Restart**, or **Stop**. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. - - - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/start-and-stop-the-agpm-service.md b/mdop/agpm/start-and-stop-the-agpm-service.md deleted file mode 100644 index e81cfefbbd..0000000000 --- a/mdop/agpm/start-and-stop-the-agpm-service.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Start and Stop the AGPM Service -description: Start and Stop the AGPM Service -author: dansimp -ms.assetid: 769aa0ce-224a-446f-9958-9518af4ad159 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Start and Stop the AGPM Service - - -The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. - -**Important**   -Stopping or disabling the AGPM Service will prevent AGPM clients from performing any operations (such as listing or editing GPOs) through the server. - - - -A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure. - -**To start or stop the AGPM Service** - -1. On the computer on which Microsoft Advanced Group Policy Management - Server (and therefore the AGPM Service) is installed, click **Start**, click **Control Panel**, click **Administrative Tools**, and then click **Services**. - -2. In the list of services, right-click **AGPM Service** and select **Start**, **Restart**, or **Stop**. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. To modify settings for the service, see [Managing the AGPM Service](managing-the-agpm-service.md). - - - -### Additional references - -- [Managing the AGPM Service](managing-the-agpm-service.md) - - - - - - - - - diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md deleted file mode 100644 index e177ef9954..0000000000 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md +++ /dev/null @@ -1,541 +0,0 @@ ---- -title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5 -description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5 -author: dansimp -ms.assetid: 454298c9-0fab-497a-9808-c0246a4c8db5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5 - - -This step-by-step guide demonstrates advanced techniques for Group Policy management using the Group Policy Management Console (GPMC) and Microsoft Advanced Group Policy Management (AGPM). AGPM increases the capabilities of the GPMC, providing: - -- Standard roles for delegating permissions to manage Group Policy objects (GPOs) to multiple Group Policy administrators. - -- An archive to enable Group Policy administrators to create and modify GPOs offline before deploying them to a production environment. - -- The ability to roll back to any previous version of a GPO. - -- Check-in/check-out capability for GPOs to ensure that Group Policy administrators do not inadvertently overwrite each other's work. - -## AGPM scenario overview - - -For this scenario, you will use a separate user account for each role in AGPM to demonstrate how Group Policy can be managed in an environment with multiple Group Policy administrators who have different levels of permissions. Specifically, you will perform the following tasks: - -- Using an account that is a member of the Domain Admins group, install AGPM Server and assign the AGPM Administrator role to an account or group. - -- Using accounts to which you will assign AGPM roles, install AGPM Client. - -- Using an account with the AGPM Administrator role, configure AGPM and delegate access to GPOs by assigning roles to other accounts. - -- Using an account with the Editor role, request the creation of a GPO, which you then approve using an account with the Approver role. With the Editor account, check the GPO out of the archive, edit the GPO, check the GPO into the archive, and request deployment. - -- Using an account with the Approver role, review the GPO and deploy it to your production environment. - -- Using an account with the Editor role, create a GPO template and use it as a starting point to create a new GPO. - -- Using an account with the Approver role, delete and restore a GPO. - -![group policy object development process](images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif) - -## Requirements - - -Computers on which you want to install AGPM must meet the following requirements, and you must create accounts for use in this scenario. - -### AGPM Server requirements - -AGPM Server 2.5 requires Windows Vista® (32-bit version) with no service packs installed or Windows Server® 2003 (32-bit version), as well as the GPMC. Additionally, you must be a member of the Domain Admins group to install AGPM Server. - -You should install AGPM Server on a member server or domain controller with the most recent version of the GPMC that is available to you and supported by AGPM. AGPM uses the GPMC to back up and restore GPOs, and newer versions of the GPMC provide additional policy settings not available in preceding versions. If the version of the GPMC on your AGPM Server is older than the version on the computers that administrators use to manage Group Policy, the AGPM Server will be unable to store those policy settings not available in the older version of the GPMC. - -Specifically, if your AGPM Server is running Windows Server 2003 and the version of the GPMC that accompanied it, and your Group Policy administrators’ computers are running Windows Vista and the version of the GPMC that accompanied it, you can still manage most policy settings. However, policy settings from the GPMC in Windows Vista that are not available in the GPMC in Windows Server 2003—such as those related to folder redirection, wireless networking (IEEE 802.11), and deployed printers—cannot be stored by the AGPM Server, even though administrators can configure them using AGPM on their computers. - -If you must install AGPM Server on a computer with an older version of GPMC than your Group Policy administrators are running, see the Group Policy Settings Reference for details about which policy settings are available with which operating systems. To download the Group Policy Settings Reference, see . - -**Note**   -Archives cannot be migrated from an AGPM Server or a GPOVault Server running Windows Server 2003 to an AGPM Server running Windows Vista. - -For Windows Server 2003, if GPOVault Server is installed on the computer on which you want to install AGPM Server, it is recommended that you do not uninstall GPOVault Server before beginning the installation. The installation of AGPM Server will uninstall GPOVault Server and automatically transfer your existing GPOVault archive data to an AGPM archive. - - - -### AGPM Client requirements - -AGPM Client 2.5 requires Windows Vista (32-bit version) with no service packs installed or Windows Server 2003 (32-bit version), as well as the GPMC. AGPM Client can be installed on a computer running AGPM Server. - -### Scenario requirements - -Before you begin this scenario, create four user accounts. During the scenario, you will assign one of the following AGPM roles to each of these accounts: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. These accounts must be able to send and receive e-mail messages. Assign **Link GPOs** permission to the accounts with the AGPM Administrator, Approver, and (optionally) Editor roles. - -**Note**   -**Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts with the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which to assign the permission. - - - -For this scenario, you perform actions with different accounts. You can either log on with each account as indicated, or you can use the **Run as** command to start the GPMC with the indicated account. - -**Note**   -To use the **Run as** command with GPMC on Windows Server 2003, click **Start**, point to **Administrative Tools**, right-click **Group Policy Management**, and click **Run as**. Click **The following user** and enter credentials for an account. - -To use the **Run as** command with GPMC on Windows Vista, click the **Start** button, point to **Run**, and type **runas /user:**DomainName\\UserName**"mmc %windir%\\system32\\gpmc.msc"**, and click **OK**. Type the password for the account when prompted. - - - -## Steps for installing and configuring AGPM - - -You must complete the following steps to install and configure AGPM. - -[Step 1: Install AGPM Server](#bkmk-config1) - -[Step 2: Install AGPM Client](#bkmk-config2) - -[Step 3: Configure an AGPM Server connection](#bkmk-config3) - -[Step 4: Configure e-mail notification](#bkmk-config4) - -[Step 5: Delegate access](#bkmk-config5) - -### Step 1: Install AGPM Server - -In this step, you install AGPM Server on the member server or domain controller that will run the AGPM Service, and you configure the archive. All AGPM operations are managed through this Windows service and are executed with the service's credentials. The archive managed by an AGPM Server can be hosted on that server or on another server in the same forest. - -**To install AGPM Server on the computer that will host the AGPM Service** - -1. Log on with an account that is a member of the Domain Admins group. - -2. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Server**. - -3. In the **Welcome** dialog box, click **Next**. - -4. In the **Microsoft Software License Terms** dialog box, accept the terms and click **Next**. - -5. In the **Application Path** dialog box, select a location in which to install AGPM Server. The computer on which AGPM Server is installed will host the AGPM Service and manage the archive. Click **Next**. - -6. In the **Archive Path** dialog box, select a location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but you should select a location with sufficient space to store all GPOs and history data managed by this AGPM Server. Click **Next**. - -7. In the **AGPM Service Account** dialog box, select a service account under which the AGPM Service will run and then click **Next**. - -8. In the **Archive Owner** dialog box, select an account or group to which to initially assign the AGPM Administrator (Full Control) role. This AGPM Administrator can assign AGPM roles and permissions to other Group Policy administrators (including the role of AGPM Administrator). For this scenario, select the account to serve in the AGPM Administrator role. Click **Next**. - -9. Click **Install**, and then click **Finish** to exit the Setup Wizard. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. For information on how to modify settings for the service, see Help for Advanced Group Policy Management. - - - -### Step 2: Install AGPM Client - -Each Group Policy administrator—anyone who creates, edits, deploys, reviews, or deletes GPOs—must have AGPM Client installed on computers that they use to manage GPOs. For this scenario, you install AGPM Client on at least one computer. You do not need to install AGPM Client on the computers of end users who do not perform Group Policy administration. - -**To install AGPM Client on the computer of a Group Policy administrator** - -1. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Client**. - -2. In the **Welcome** dialog box, click **Next**. - -3. In the **Microsoft Software License Terms** dialog box, accept the terms and click **Next**. - -4. In the **Application Path** dialog box, select a location in which to install AGPM Client. Click **Next**. - -5. In the **AGPM Server** dialog box, type the fully-qualified computer name and the port for the AGPM Server to which to connect. The default port for the AGPM Service is 4600. Click **Next**. - -6. Click **Install**, and then click **Finish** to exit the Setup Wizard. - -### Step 3: Configure an AGPM Server connection - -AGPM stores all versions of each controlled Group Policy object (GPO)—a GPO for which AGPM provides change control—in a central archive, so Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -In this step, you configure an AGPM Server connection and ensure that all Group Policy administrators connect to the same AGPM Server. (For information about configuring multiple AGPM Servers, see Help for Advanced Group Policy Management.) - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. On a computer on which you have installed AGPM Client, log on with the user account that you selected as the Archive Owner. This user has the role of AGPM Administrator (Full Control). - -2. Click **Start**, point to **Administrative Tools**, and click **Group Policy Management** to open the **Group Policy Management Console (GPMC)**. - -3. In the **Group Policy Management Console** tree, edit a GPO that is applied to all Group Policy administrators. - -4. In the **Group Policy Object Editor** window, click **User Configuration**, **Administrative Templates**, and **Windows Components**. - -5. If **AGPM** is not listed under **Windows Components**: - - 1. Right-click **Administrative Templates** and select **Add/Remove Templates**. - - 2. Click **Add**, select **agpm.admx** or **agpm.adm**, click **Open**, and then click **Close**. - -6. Under **Windows Components**, double-click **AGPM**. - -7. In the details pane, double-click **AGPM Server (all domains)**. - -8. In the **AGPM Server (all domains) Properties** window, select **Enabled** and type the fully-qualified computer name and port (for example, server.contoso.com:4600) for the server hosting the archive. The port used by the AGPM Service is port 4600. - -9. Click **OK**, and then close the **Group Policy Object Editor** window. When Group Policy is updated, the AGPM Server connection is configured for each Group Policy administrator. - -### Step 4: Configure e-mail notification - -As an AGPM Administrator (Full Control), you designate the e-mail addresses of Approvers and AGPM Administrators to whom an e-mail message containing a request is sent when an Editor attempts to create, deploy, or delete a GPO. You also determine the alias from which these messages are sent. - -**To configure e-mail notification for AGPM** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To** field, type the e-mail address for the user account to which you intend to assign the Approver role. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. - -7. Click **Apply**. - -### Step 5: Delegate access - -As an AGPM Administrator (Full Control), you delegate domain-level access to GPOs, assigning roles to the account of each Group Policy administrator. - -**Note**   -You can also delegate access at the GPO level rather than the domain level. For details, see Help for Advanced Group Policy Management. - - - -**Important**   -You should restrict membership in the Group Policy Creator Owners group, so it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - - - -**To delegate access to all GPOs throughout a domain** - -1. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -2. On the **Domain Delegation** tab, click the **Advanced** button. - -3. In the **Permissions** dialog box: - - 1. Click the user account of a Group Policy administrator, and then select the **Approver** check box to assign that role to the account. Clear the **Editor** check box. (This role includes the Reviewer role.) - - 2. Click the user account of another Group Policy administrator, and then select the **Editor** check box to assign that role to the account. (This role includes the Reviewer role.) - - 3. Click a third account and then select the **Reviewer** check box to assign only the Reviewer role to the account of that Group Policy administrator. Clear the **Editor** check box. - - 4. Click the **Advanced** button. - -4. In the **Advanced Security Settings** dialog box: - - 1. Select a Group Policy administrator, and then click **Edit**. - - 2. For **Apply onto**, select **This object and nested objects**, and then click **OK** in the **Permission** **Entry** dialog box. - - 3. Repeat for each Group Policy administrator. - -5. In the **Advanced Security Settings** dialog box, click **OK**. - -6. In the **Permissions** dialog box, click **OK**. - -## Steps for managing GPOs - - -You must complete the following steps to create, edit, review, and deploy GPOs using AGPM. Additionally, you will create a template, delete a GPO, and restore a deleted GPO. - -[Step 1: Create a GPO](#bkmk-manage1) - -[Step 2: Edit a GPO](#bkmk-manage2) - -[Step 3: Review and deploy a GPO](#bkmk-manage3) - -[Step 4: Use a template to create a GPO](#bkmk-manage4) - -[Step 5: Delete and restore a GPO](#bkmk-manage5) - -### Step 1: Create a GPO - -In an environment with multiple Group Policy administrators, those with the Editor role have the ability to request the creation of new GPOs, but such a request must be approved by someone with the Approver role because the creation of a new GPO impacts the production environment. - -In this step, you use an account with the Editor role to request the creation of a new GPO. Using an account with the Approver role, you approve this request and complete the creation of a GPO. - -**To request the creation of a new GPO managed through AGPM** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the Editor role in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -4. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live** so the new GPO will be deployed to the production environment immediately upon approval. - - 5. Click **Submit**. - -5. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -**To approve the pending request to create a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. - -2. Open the e-mail inbox for the account, and note that you have received an e-mail message from the AGPM alias with the Editor's request to create a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -5. Right-click **MyGPO**, and then click **Approve**. - -6. Click **Yes** to confirm approval of the creation of the GPO. The GPO is moved to the **Controlled** tab. - -### Step 2: Edit a GPO - -You can use GPOs to configure computer or user settings and deploy them to many computers or users. In this step, you use an account with the Editor role to check out a GPO from the archive, edit the GPO offline, check the edited GPO into the archive, and request deployment of the GPO to the production environment. For this scenario, you configure a setting in the GPO to require that the password be at least eight characters in length. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Check Out**. - -5. Type a comment to be displayed in the **History** of the GPO while it is checked out, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the minimum password length** - -1. On the **Controlled** tab, right-click **MyGPO**, and then click **Edit** to open the **Group Policy Object Editor** window and make changes to an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Windows Settings**, double-click **Security Settings**, double-click **Account Policies**, and double-click **Password Policy**. - - 2. In the details pane, double-click **Minimum password length**. - - 3. In the properties window, select the **Define this policy setting** check box, set the number of characters to **8**, and then click **OK**. - -2. Close the **Group Policy Object Editor** window. - -**To check the GPO into the archive** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Check In**. - -2. Type a comment, and then click **OK**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -**To request the deployment of the GPO to the production environment** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Deploy**. - -2. Because this account is not an Approver or AGPM Administrator, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the **History** of the GPO, and then click **Submit**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. **MyGPO** is displayed on the list of GPOs on the **Pending** tab. - -### Step 3: Review and deploy a GPO - -In this step, you act as an Approver, creating reports and analyzing the settings and changes to settings in the GPO to determine whether you should approve them. After evaluating the GPO, you deploy it to the production environment and link it to a domain or an organizational unit (OU) so that it takes effect when Group Policy is refreshed for computers in that domain or OU. - -**To review settings in the GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. (Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.) - -2. Open the e-mail inbox for the account and note that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab in the details pane, click the **Pending** tab. - -5. Double-click **MyGPO** to display its history. - -6. Review the settings in the most recent version of MyGPO: - - 1. In the **History** window, right-click the GPO version with the most recent timestamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings. - - 2. In the Web browser, click **show all** to display all of the settings in the GPO. - - 3. Close the browser. - -7. Compare the most recent version of MyGPO to the first version checked in to the archive: - - 1. In the **History** window, click the GPO version with the most recent timestamp. Press **CTRL** and click the oldest GPO version that has a state of **Checked In**. - - 2. Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**, indicating that this setting is configured only in the latter version of the GPO. - - 3. Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO. - - 4. Close the Web browser. - -**To deploy the GPO to the production environment** - -1. On the **Pending** tab, right-click **MyGPO** and then click **Approve**. - -2. Type a comment to include in the history of the GPO. - -3. Click **Yes**. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is deployed to the production environment. - -**To link the GPO to a domain or organizational unit** - -1. In the GPMC, right-click the domain or an OU to which to apply the GPO that you configured, and then click **Link an Existing GPO**. - -2. In the **Select GPO** dialog box, click **MyGPO**, and then click **OK**. - -### Step 4: Use a template to create a GPO - -In this step, you use an account with the Editor role to create a template—an uneditable, static version of a GPO for use as a starting point for creating new GPOs—and then create a new GPO based upon that template. Templates are useful for quickly creating multiple GPOs that include many of the same settings. - -**To create a template based on an existing GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab. - -4. Right-click **MyGPO**, and then click **Save as Template** to create a template incorporating all settings currently in MyGPO. - -5. Type **MyTemplate** as the name for the template and a comment, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -**To request the creation of a new GPO managed through AGPM** - -1. Click the **Controlled** tab. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyOtherGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live**, so the new GPO will be deployed to the production environment immediately upon approval. - - 5. For **From GPO template**, select **MyTemplate**. - - 6. Click **Submit**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -Use an account that has been assigned the role of Approver to approve the pending request to create the GPO as you did in [Step 1: Create a GPO](#bkmk-manage1). MyTemplate incorporates all of the settings that you configured in MyGPO. Because MyOtherGPO was created using MyTemplate, it initially contains all of the settings that MyGPO contained at the time that MyTemplate was created. You can confirm this by generating a difference report to compare MyOtherGPO to MyTemplate. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. Right-click **MyOtherGPO**, and then click **Check Out**. - -3. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the account lockout duration** - -1. On the **Controlled** tab, right-click **MyOtherGPO**, and then click **Edit** to open the **Group Policy Object Editor** window and make changes to an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Windows Settings**, double-click **Security Settings**, double-click **Account Policies**, and double-click **Account Lockout Policy**. - - 2. In the details pane, double-click **Account lockout duration**. - - 3. In the properties window, check **Define this policy setting**, set the duration to **30** minutes, and then click **OK**. - -2. Close the **Group Policy Object Editor** window. - -Check MyOtherGPO into the archive and request deployment as you did for MyGPO in [Step 2: Edit a GPO](#bkmk-manage2). You can compare MyOtherGPO to MyGPO or to MyTemplate using difference reports. Any account that includes the Reviewer role (AGPM Administrator \[Full Control\], Approver, Editor, or Reviewer) can generate reports. - -**To compare a GPO to another GPO and to a template** - -1. To compare MyGPO and MyOtherGPO: - - 1. On the **Controlled** tab, click **MyGPO**. Press **CTRL** and then click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and click **HTML Report**. - -2. To compare MyOtherGPO and MyTemplate: - - 1. On the **Controlled** tab, click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and click **Template**. - - 3. Select **MyTemplate** and **HTML Report**, and then click **OK**. - -### Step 5: Delete and restore a GPO - -In this step, you act as an Approver to delete a GPO. - -**To delete a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Delete**. Click **Delete GPO from archive and production** to delete both the version in the archive as well as the deployed version of the GPO in the production environment. - -5. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. - -Occasionally you may discover after deleting a GPO that it is still needed. In this step, you act as an Approver to restore a GPO that has been deleted. - -**To restore a deleted GPO** - -1. On the **Contents** tab, click the **Recycle Bin** tab to display deleted GPOs. - -2. Right-click **MyGPO**, and then click **Restore**. - -3. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - - **Note**   - Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3). - - - -After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to a previous version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made. - -**To roll back to a previous version of a GPO** - -1. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -2. Double-click **MyGPO** to display its history. - -3. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - - **Note**   - To verify that the version that has been redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**. - - - - - - - - - - - diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md deleted file mode 100644 index f0fa732a4c..0000000000 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md +++ /dev/null @@ -1,530 +0,0 @@ ---- -title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 -description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 -author: dansimp -ms.assetid: d067f465-d7c8-4f6d-b311-66b9b06874f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 - - -This step-by-step guide demonstrates advanced techniques for Group Policy management using the Group Policy Management Console (GPMC) and Microsoft Advanced Group Policy Management (AGPM). AGPM increases the capabilities of the GPMC, providing: - -- Standard roles for delegating permissions to manage Group Policy objects (GPOs) to multiple Group Policy administrators, as well as the ability to delegate access to GPOs in the production environment. - -- An archive to enable Group Policy administrators to create and modify GPOs offline before deploying them to a production environment. - -- The ability to roll back to any previous version of a GPO in the archive and to limit the number of versions stored in the archive. - -- Check-in/check-out capability for GPOs to ensure that Group Policy administrators do not inadvertently overwrite each other's work. - -## AGPM scenario overview - - -For this scenario, you will use a separate user account for each role in AGPM to demonstrate how Group Policy can be managed in an environment with multiple Group Policy administrators who have different levels of permissions. Specifically, you will perform the following tasks: - -- Using an account that is a member of the Domain Admins group, install AGPM Server and assign the AGPM Administrator role to an account or group. - -- Using accounts to which you will assign AGPM roles, install AGPM Client. - -- Using an account with the AGPM Administrator role, configure AGPM and delegate access to GPOs by assigning roles to other accounts. - -- Using an account with the Editor role, request the creation of a GPO, which you then approve using an account with the Approver role. With the Editor account, check the GPO out of the archive, edit the GPO, check the GPO into the archive, and request deployment. - -- Using an account with the Approver role, review the GPO and deploy it to your production environment. - -- Using an account with the Editor role, create a GPO template and use it as a starting point to create a new GPO. - -- Using an account with the Approver role, delete and restore a GPO. - -![group policy object development process](images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif) - -## Requirements - - -Computers on which you want to install AGPM must meet the following requirements, and you must create accounts for use in this scenario. - -**Note**   -If you have AGPM 2.5 installed and are upgrading from Windows Server® 2003 to Windows Server 2008 or Windows Vista® with no service packs installed to Windows Vista with Service Pack 1, you must upgrade the operating system before you can upgrade to AGPM 3.0. - - - -### AGPM Server requirements - -AGPM Server 3.0 requires Windows Server 2008 or Windows Vista with Service Pack 1 and the GPMC from Remote Server Administration Tools (RSAT) installed. Both 32-bit and 64-bit versions are supported. - -Before you install AGPM Server, you must be a member of the Domain Admins group and the following Windows features must be present unless otherwise noted: - -- GPMC - - - Windows Server 2008: The GPMC is automatically installed by AGPM if not present. - - - Windows Vista: You must install the GPMC from RSAT before you install AGPM. For more information, see . - -- .NET Framework 3.5 - -The following Windows features are required by AGPM Server and will be automatically installed if not present: - -- WCF Activation; Non-HTTP Activation - -- Windows Process Activation Service - - - Process Model - - - .NET Environment - - - Configuration APIs - -### AGPM Client requirements - -AGPM Client 3.0 requires Windows Server 2008 or Windows Vista with Service Pack 1 and the GPMC from Remote Server Administration Tools (RSAT) installed. Both 32-bit and 64-bit versions are supported. AGPM Client can be installed on a computer running AGPM Server. - -The following Windows features are required by AGPM Client and will be automatically installed if not present unless otherwise noted: - -- GPMC - - - Windows Server 2008: The GPMC is automatically installed by AGPM if not present. - - - Windows Vista: You must install the GPMC from RSAT before you install AGPM. For more information, see . - -- .NET Framework 3.0 - -### Scenario requirements - -Before you begin this scenario, create four user accounts. During the scenario, you will assign one of the following AGPM roles to each of these accounts: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. These accounts must be able to send and receive e-mail messages. Assign **Link GPOs** permission to the accounts with the AGPM Administrator, Approver, and (optionally) Editor roles. - -**Note**   -**Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts with the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which to assign the permission. - - - -## Steps for installing and configuring AGPM - - -You must complete the following steps to install and configure AGPM. - -[Step 1: Install AGPM Server](#bkmk-config1) - -[Step 2: Install AGPM Client](#bkmk-config2) - -[Step 3: Configure an AGPM Server connection](#bkmk-config3) - -[Step 4: Configure e-mail notification](#bkmk-config4) - -[Step 5: Delegate access](#bkmk-config5) - -### Step 1: Install AGPM Server - -In this step, you install AGPM Server on the member server or domain controller that will run the AGPM Service, and you configure the archive. All AGPM operations are managed through this Windows service and are executed with the service's credentials. The archive managed by an AGPM Server can be hosted on that server or on another server in the same forest. - -**To install AGPM Server on the computer that will host the AGPM Service** - -1. Log on with an account that is a member of the Domain Admins group. - -2. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Server**. - -3. In the **Welcome** dialog box, click **Next**. - -4. In the **Microsoft Software License Terms** dialog box, accept the terms and click **Next**. - -5. In the **Application Path** dialog box, select a location in which to install AGPM Server. The computer on which AGPM Server is installed will host the AGPM Service and manage the archive. Click **Next**. - -6. In the **Archive Path** dialog box, select a location for the archive relative to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere, but you should select a location with sufficient space to store all GPOs and history data managed by this AGPM Server. Click **Next**. - -7. In the **AGPM Service Account** dialog box, select a service account under which the AGPM Service will run and then click **Next**. - -8. In the **Archive Owner** dialog box, select an account or group to which to initially assign the AGPM Administrator (Full Control) role. This AGPM Administrator can assign AGPM roles and permissions to other Group Policy administrators (including the role of AGPM Administrator). For this scenario, select the account to serve in the AGPM Administrator role. Click **Next**. - -9. In the **Port Configuration** dialog box, type a port on which the AGPM Service should listen. Do not clear the **Add port exception to firewall** check box unless you manually configure port exceptions or use rules to configure port exceptions. Click **Next**. - -10. In the **Languages** dialog box, select one or more display languages to install for AGPM Server. - -11. Click **Install**, and then click **Finish** to exit the Setup Wizard. - - **Caution**   - Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. For information on how to modify settings for the service, see Help for Advanced Group Policy Management. - - - -### Step 2: Install AGPM Client - -Each Group Policy administrator—anyone who creates, edits, deploys, reviews, or deletes GPOs—must have AGPM Client installed on computers that they use to manage GPOs. For this scenario, you install AGPM Client on at least one computer. You do not need to install AGPM Client on the computers of end users who do not perform Group Policy administration. - -**To install AGPM Client on the computer of a Group Policy administrator** - -1. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Client**. - -2. In the **Welcome** dialog box, click **Next**. - -3. In the **Microsoft Software License Terms** dialog box, accept the terms and click **Next**. - -4. In the **Application Path** dialog box, select a location in which to install AGPM Client. Click **Next**. - -5. In the **AGPM Server** dialog box, type the fully-qualified computer name for the AGPM Server and the port to which to connect. The default port for the AGPM Service is 4600. Do not clear the **Allow Microsoft Management Console through the firewall** check box unless you manually configure port exceptions or use rules to configure port exceptions. Click **Next**. - -6. In the **Languages** dialog box, select one or more display languages to install for AGPM Client. - -7. Click **Install**, and then click **Finish** to exit the Setup Wizard. - -### Step 3: Configure an AGPM Server connection - -AGPM stores all versions of each controlled Group Policy object (GPO)—a GPO for which AGPM provides change control—in a central archive, so Group Policy administrators can view and modify GPOs offline without immediately impacting the deployed version of each GPO. - -In this step, you configure an AGPM Server connection and ensure that all Group Policy administrators connect to the same AGPM Server. (For information about configuring multiple AGPM Servers, see Help for Advanced Group Policy Management.) - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. On a computer on which you have installed AGPM Client, log on with the user account that you selected as the Archive Owner. This user has the role of AGPM Administrator (Full Control). - -2. Click **Start**, point to **Administrative Tools**, and click **Group Policy Management** to open the GPMC. - -3. Edit a GPO that is applied to all Group Policy administrators. - -4. In the **Group Policy Management Editor** window, double-click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -5. In the details pane, double-click **AGPM: Specify default AGPM Server (all domains)**. - -6. In the **Properties** window, select **Enabled** and type the fully-qualified computer name and port (for example, **server.contoso.com:4600**) for the server hosting the archive. By default, the AGPM Service uses port 4600. - -7. Click **OK**, and then close the **Group Policy Management Editor** window. When Group Policy is updated, the AGPM Server connection is configured for each Group Policy administrator. - -### Step 4: Configure e-mail notification - -As an AGPM Administrator (Full Control), you designate the e-mail addresses of Approvers and AGPM Administrators to whom an e-mail message containing a request is sent when an Editor attempts to create, deploy, or delete a GPO. You also determine the alias from which these messages are sent. - -**To configure e-mail notification for AGPM** - -1. In the details pane, click the **Domain Delegation** tab. - -2. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. - -3. In the **To e-mail address** field, type the e-mail address for the user account to which you intend to assign the Approver role. - -4. In the **SMTP server** field, type a valid SMTP mail server. - -5. In the **User name** and **Password** fields, type the credentials of a user with access to the SMTP service. Click **Apply**. - -### Step 5: Delegate access - -As an AGPM Administrator (Full Control), you delegate domain-level access to GPOs, assigning roles to the account of each Group Policy administrator. - -**Note**   -You can also delegate access at the GPO level rather than the domain level. For details, see Help for Advanced Group Policy Management. - - - -**Important**   -You should restrict membership in the Group Policy Creator Owners group, so it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - - - -**To delegate access to all GPOs throughout a domain** - -1. On the **Domain Delegation** tab, click the **Add** button, select the user account of the Group Policy administrator to serve as Approver, and then click **OK**. - -2. In the **Add Group or User** dialog box, select the **Approver** role to assign that role to the account, and then click **OK**. (This role includes the Reviewer role.) - -3. Click the **Add** button, select the user account of the Group Policy administrator to serve as Editor, and then click **OK**. - -4. In the **Add Group or User** dialog box, select the **Editor** role to assign that role to the account, and then click **OK**. (This role includes the Reviewer role.) - -5. Click the **Add** button, select the user account of the Group Policy administrator to serve as Reviewer, and then click **OK**. - -6. In the **Add Group or User** dialog box, select the **Reviewer** role to assign only that role to the account. - -## Steps for managing GPOs - - -You must complete the following steps to create, edit, review, and deploy GPOs using AGPM. Additionally, you will create a template, delete a GPO, and restore a deleted GPO. - -[Step 1: Create a GPO](#bkmk-manage1) - -[Step 2: Edit a GPO](#bkmk-manage2) - -[Step 3: Review and deploy a GPO](#bkmk-manage3) - -[Step 4: Use a template to create a GPO](#bkmk-manage4) - -[Step 5: Delete and restore a GPO](#bkmk-manage5) - -### Step 1: Create a GPO - -In an environment with multiple Group Policy administrators, those with the Editor role have the ability to request the creation of new GPOs, but such a request must be approved by someone with the Approver role because the creation of a new GPO impacts the production environment. - -In this step, you use an account with the Editor role to request the creation of a new GPO. Using an account with the Approver role, you approve this request and complete the creation of a GPO. - -**To request the creation of a new GPO managed through AGPM** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the Editor role in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -4. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live** so the new GPO will be deployed to the production environment immediately upon approval. Click **Submit**. - -5. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -**To approve the pending request to create a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. - -2. Open the e-mail inbox for the account, and note that you have received an e-mail message from the AGPM alias with the Editor's request to create a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -5. Right-click **MyGPO**, and then click **Approve**. - -6. Click **Yes** to confirm approval of the creation of the GPO. The GPO is moved to the **Controlled** tab. - -### Step 2: Edit a GPO - -You can use GPOs to configure computer or user settings and deploy them to many computers or users. In this step, you use an account with the Editor role to check out a GPO from the archive, edit the GPO offline, check the edited GPO into the archive, and request deployment of the GPO to the production environment. For this scenario, you configure a setting in the GPO to require that the password be at least eight characters in length. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Check Out**. - -5. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the minimum password length** - -1. On the **Controlled** tab, right-click **MyGPO**, and then click **Edit** to open the **Group Policy Management Editor** window and make changes to an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Policies**, **Windows Settings**, **Security Settings**, **Account Policies**, and **Password Policy**. - - 2. In the details pane, double-click **Minimum password length**. - - 3. In the properties window, select the **Define this policy setting** check box, set the number of characters to **8**, and then click **OK**. - -2. Close the **Group Policy Management Editor** window. - -**To check the GPO into the archive** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Check In**. - -2. Type a comment, and then click **OK**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -**To request the deployment of the GPO to the production environment** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Deploy**. - -2. Because this account is not an Approver or AGPM Administrator, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the history of the GPO, and then click **Submit**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. **MyGPO** is displayed on the list of GPOs on the **Pending** tab. - -### Step 3: Review and deploy a GPO - -In this step, you act as an Approver, creating reports and analyzing the settings and changes to settings in the GPO to determine whether you should approve them. After evaluating the GPO, you deploy it to the production environment and link it to a domain or an organizational unit (OU) so that it takes effect when Group Policy is refreshed for computers in that domain or OU. - -**To review settings in the GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. (Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.) - -2. Open the e-mail inbox for the account and note that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab in the details pane, click the **Pending** tab. - -5. Double-click **MyGPO** to display its history. - -6. Review the settings in the most recent version of MyGPO: - - 1. In the **History** window, right-click the GPO version with the most recent timestamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings. - - 2. In the Web browser, click **show all** to display all of the settings in the GPO. Close the browser. - -7. Compare the most recent version of MyGPO to the first version checked in to the archive: - - 1. In the **History** window, click the GPO version with the most recent time stamp. Press CTRL and click the oldest GPO version for which the **Computer Version** is not **\\***. - - 2. Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**, indicating that this setting is configured only in the latter version of the GPO. - - 3. Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO. - - 4. Close the Web browser. - -**To deploy the GPO to the production environment** - -1. On the **Pending** tab, right-click **MyGPO** and then click **Approve**. - -2. Type a comment to include in the history of the GPO. - -3. Click **Yes**. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is deployed to the production environment. - -**To link the GPO to a domain or organizational unit** - -1. In the GPMC, right-click the domain or an OU to which to apply the GPO that you configured, and then click **Link an Existing GPO**. - -2. In the **Select GPO** dialog box, click **MyGPO**, and then click **OK**. - -### Step 4: Use a template to create a GPO - -In this step, you use an account with the Editor role to create a template—an uneditable, static version of a GPO for use as a starting point for creating new GPOs—and then create a new GPO based upon that template. Templates are useful for quickly creating multiple GPOs that include many of the same settings. - -**To create a template based on an existing GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab. - -4. Right-click **MyGPO**, and then click **Save as Template** to create a template incorporating all settings currently in MyGPO. - -5. Type **MyTemplate** as the name for the template and a comment, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -**To request the creation of a new GPO managed through AGPM** - -1. Click the **Controlled** tab. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyOtherGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live**, so the new GPO will be deployed to the production environment immediately upon approval. - - 5. For **From GPO template**, select **MyTemplate**. Click **Submit**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -Use an account that has been assigned the role of Approver to approve the pending request to create the GPO as you did in [Step 1: Create a GPO](#bkmk-manage1). MyTemplate incorporates all of the settings that you configured in MyGPO. Because MyOtherGPO was created using MyTemplate, it initially contains all of the settings that MyGPO contained at the time that MyTemplate was created. You can confirm this by generating a difference report to compare MyOtherGPO to MyTemplate. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Editor in AGPM. - -2. Right-click **MyOtherGPO**, and then click **Check Out**. - -3. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the account lockout duration** - -1. On the **Controlled** tab, right-click **MyOtherGPO**, and then click **Edit** to open the **Group Policy Management Editor** window and make changes to an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Policies**, **Windows Settings**, **Security Settings**, **Account Policies**, and **Account Lockout Policy**. - - 2. In the details pane, double-click **Account lockout duration**. - - 3. In the properties window, check **Define this policy setting**, set the duration to **30** minutes, and then click **OK**. - -2. Close the **Group Policy Management Editor** window. - -Check MyOtherGPO into the archive and request deployment as you did for MyGPO in [Step 2: Edit a GPO](#bkmk-manage2). You can compare MyOtherGPO to MyGPO or to MyTemplate using difference reports. Any account that includes the Reviewer role (AGPM Administrator \[Full Control\], Approver, Editor, or Reviewer) can generate reports. - -**To compare a GPO to another GPO and to a template** - -1. To compare MyGPO and MyOtherGPO: - - 1. On the **Controlled** tab, click **MyGPO**. Press CTRL and then click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and click **HTML Report**. - -2. To compare MyOtherGPO and MyTemplate: - - 1. On the **Controlled** tab, click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and click **Template**. - - 3. Select **MyTemplate** and **HTML Report**, and then click **OK**. - -### Step 5: Delete and restore a GPO - -In this step, you act as an Approver to delete a GPO. - -**To delete a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Delete**. Click **Delete GPO from archive and production** to delete both the version in the archive as well as the deployed version of the GPO in the production environment. - -5. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. - -Occasionally you may discover after deleting a GPO that it is still needed. In this step, you act as an Approver to restore a GPO that has been deleted. - -**To restore a deleted GPO** - -1. On the **Contents** tab, click the **Recycle Bin** tab to display deleted GPOs. - -2. Right-click **MyGPO**, and then click **Restore**. - -3. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - - **Note**   - Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3). - - - -After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to a previous version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made. - -**To roll back to a previous version of a GPO** - -1. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -2. Double-click **MyGPO** to display its history. - -3. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - - **Note**   - To verify that the version that has been redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**. - - - - - - - - - - - diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md deleted file mode 100644 index fa3516b9a3..0000000000 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md +++ /dev/null @@ -1,601 +0,0 @@ ---- -title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0 -description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0 -author: dansimp -ms.assetid: dc6f9b16-b1d4-48f3-88bb-f29301f0131c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0 - - -This step-by-step guide demonstrates advanced techniques for Group Policy management that use the Group Policy Management Console (GPMC) and Microsoft Advanced Group Policy Management (AGPM). AGPM increases the capabilities of the GPMC, providing: - -- Standard roles for delegating permissions to manage Group Policy Objects (GPOs) to multiple Group Policy administrators, in addition to the ability to delegate access to GPOs in the production environment. - -- An archive to enable Group Policy administrators to create and modify GPOs offline before the GPOs are deployed into a production environment. - -- The ability to roll back to any earlier version of a GPO in the archive and to limit the number of versions stored in the archive. - -- Check-in and check-out capability for GPOs to make sure that Group Policy administrators do not unintentionally overwrite each other's work. - -- The ability to search for GPOs with specific attributes and to filter the list of GPOs displayed. - -## AGPM scenario overview - - -For this scenario, you will use a separate user account for each role in AGPM to demonstrate how Group Policy can be managed in an environment that has multiple Group Policy administrators who have different levels of permissions. Specifically, you will perform the following tasks: - -- Using an account that is a member of the Domain Admins group, install AGPM Server and assign the AGPM Administrator role to an account or group. - -- Using accounts to which you will assign AGPM roles, install AGPM Client. - -- Using an account that has the AGPM Administrator role, configure AGPM and delegate access to GPOs by assigning roles to other accounts. - -- From an account that has the Editor role, request that a new GPO be created that you then approve by using an account that has the Approver role. Use the Editor account to check the GPO out of the archive, edit the GPO, check the GPO into the archive, and then request deployment. - -- Using an account that has the Approver role, review the GPO and deploy it to your production environment. - -- Using an account that has the Editor role, create a GPO template and use it as a starting point to create a new GPO. - -- Using an account that has the Approver role, delete and restore a GPO. - -![group policy object development process](images/ab77a1f3-f430-4e7d-be58-ee8f9bd1140e.gif) - -## Requirements - - -Computers on which you want to install AGPM must meet the following requirements, and you must create accounts for use in this scenario. - -**Note**   -If you have AGPM 2.5 installed and are upgrading from Windows Server® 2003 to Windows Server 2008 R2 or Windows Server 2008, or are upgrading from Windows Vista with no service packs installed to Windows 7 or Windows Vista® with Service Pack 1 (SP1), you must upgrade the operating system before you can upgrade to AGPM 4.0. - -If you have AGPM 3.0 installed, you do not have to upgrade the operating system before you upgrade to AGPM 4.0 - - - -In a mixed environment that includes both newer and older operating systems, there are some limitations to functionality, as indicated in the following table. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating system on which AGPM Server 4.0 runsOperating system on which AGPM Client 4.0 runsStatus of AGPM 4.0 support

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 R2 or Windows 7

    Unsupported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

    - - - -### AGPM Server requirements - -AGPM Server 4.0 requires Windows Server 2008 R2, Windows Server 2008, Windows 7 and the GPMC from Remote Server Administration Tools (RSAT), or Windows Vista with SP1 and the GPMC from RSAT installed. Both 32-bit and 64-bit versions are supported. - -Before you install AGPM Server, you must be a member of the Domain Admins group and the following Windows features must be present unless otherwise noted: - -- GPMC - - - Windows Server 2008 R2 or Windows Server 2008: If the GPMC is not present, it is automatically installed by AGPM. - - - Windows 7: You must install the GPMC from RSAT before you install AGPM. For more information, see [Remote Server Administration Tools for Windows 7](https://go.microsoft.com/fwlink/?LinkID=131280) (https://go.microsoft.com/fwlink/?LinkID=131280). - - - Windows Vista with SP1: You must install the GPMC from RSAT before you install AGPM. For more information, see [Remote Server Administration Tools for Windows Vista with Service Pack 1](https://go.microsoft.com/fwlink/?LinkID=116179) (https://go.microsoft.com/fwlink/?LinkID=116179). - -- The .NET Framework 3.5 or later versions - - - Windows Server 2008 R2 or Windows 7: If the .NET Framework 3.5 or later version is not present, the .NET Framework 3.5 is automatically installed by AGPM. - - - Windows Server 2008 or Windows Vista with SP1: You must install the .NET Framework 3.5 or a later version before you install AGPM. - -The following Windows features are required by AGPM Server and will be automatically installed if they are not present: - -- WCF Activation; Non-HTTP Activation - -- Windows Process Activation Service - - - Process Model - - - The .NET Environment - - - Configuration APIs - -### AGPM Client requirements - -AGPM Client 4.0 requires Windows Server 2008 R2, Windows Server 2008, Windows 7 and the GPMC from RSAT, or Windows Vista with SP1 and the GPMC from RSAT installed. Both 32-bit and 64-bit versions are supported. AGPM Client can be installed on a computer that is running AGPM Server. - -The following Windows features are required by AGPM Client and unless otherwise noted are automatically installed if they are not present: - -- GPMC - - - Windows Server 2008 R2 or Windows Server 2008: If the GPMC is not present, it is automatically installed by AGPM. - - - Windows 7: You must install the GPMC from RSAT before you install AGPM. For more information, see [Remote Server Administration Tools for Windows 7](https://go.microsoft.com/fwlink/?LinkID=131280) (https://go.microsoft.com/fwlink/?LinkID=131280). - - - Windows Vista with SP1: You must install the GPMC from RSAT before you install AGPM. For more information, see [Remote Server Administration Tools for Windows Vista with Service Pack 1](https://go.microsoft.com/fwlink/?LinkID=116179) (https://go.microsoft.com/fwlink/?LinkID=116179). - -- The .NET Framework 3.0 or later version - - - Windows Server 2008 R2 or Windows 7: If the .NET Framework 3.0 or later version is not present, the .NET Framework 3.5 is automatically installed by AGPM. - - - Windows Server 2008 or Windows Vista with SP1: If the .NET Framework 3.0 or later version is not present, the .NET Framework 3.0 is automatically installed by AGPM. - -### Scenario requirements - -Before you begin this scenario, create four user accounts. During the scenario, you will assign one of the following AGPM roles to each of these accounts: AGPM Administrator (Full Control), Approver, Editor, and Reviewer. These accounts must be able to send and receive e-mail messages. Assign **Link GPOs** permission to the accounts that have the AGPM Administrator, Approver, and (optionally) Editor roles. - -**Note**   -**Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts that have the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which you want to assign the permission. - - - -## Steps for installing and configuring AGPM - - -You must complete the following steps to install and configure AGPM. - -[Step 1: Install AGPM Server](#bkmk-config1) - -[Step 2: Install AGPM Client](#bkmk-config2) - -[Step 3: Configure an AGPM Server connection](#bkmk-config3) - -[Step 4: Configure e-mail notification](#bkmk-config4) - -[Step 5: Delegate access](#bkmk-config5) - -### Step 1: Install AGPM Server - -In this step, you install AGPM Server on the member server or domain controller that will run the AGPM Service, and you configure the archive. All AGPM operations are managed through this Windows service and are executed with the service's credentials. The archive managed by an AGPM Server can be hosted on that server or on another server in the same forest. - -**To install AGPM Server on the computer that will host the AGPM Service** - -1. Log on with an account that is a member of the Domain Admins group. - -2. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Server**. - -3. In the **Welcome** dialog box, click **Next**. - -4. In the **Microsoft Software License Terms** dialog box, accept the terms and then click **Next**. - -5. In the **Application Path** dialog box, select a location in which to install AGPM Server. The computer on which AGPM Server is installed will host the AGPM Service and manage the archive. Click **Next**. - -6. In the **Archive Path** dialog box, select a location for the archive in relation to the AGPM Server. The archive path can point to a folder on the AGPM Server or elsewhere. However, you should select a location with sufficient space to store all GPOs and history data managed by this AGPM Server. Click **Next**. - -7. In the **AGPM Service Account** dialog box, select a service account under which the AGPM Service will run and then click **Next**. - - This account must be a member of the either the Domain Admins group or, for a least-privilege configuration, the following groups in each domain managed by the AGPM Server: - - - Group Policy Creator Owners - - - Backup Operators - - Additionally, this account requires Full Control permission for the following folders: - - - The AGPM archive folder, for which this permission is automatically granted during the installation of AGPM Server if it is installed on a local drive. - - - The local system temp folder, typically %windir%\\temp. - -8. In the **Archive Owner** dialog box, select an account or group to which you assign the AGPM Administrator (Full Control) role. AGPM Administrators can assign AGPM roles and permissions to other Group Policy administrators, so that later you can assign the role of AGPM Administrator to additional Group Policy administrators. For this scenario, select the account to serve in the AGPM Administrator role. Click **Next**. - -9. In the **Port Configuration** dialog box, type a port on which the AGPM Service should listen. Do not clear the **Add port exception to firewall** check box unless you manually configure port exceptions or use rules to configure port exceptions. Click **Next**. - -10. In the **Languages** dialog box, select one or more display languages to install for AGPM Server. - -11. Click **Install**, and then click **Finish** to exit the Setup Wizard. - - **Caution**   - Do not change settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing this can prevent the AGPM Service from starting. For information about how to change settings for the service, see Help for Advanced Group Policy Management. - - - -### Step 2: Install AGPM Client - -Each Group Policy administrator—anyone who creates, edits, deploys, reviews, or deletes GPOs—must have AGPM Client installed on computers that they use to manage GPOs. The Change Control node, which you use to perform many of the GPO management tasks, appears in the Group Policy Management Console only if you install the AGPM Client. For this scenario, you install AGPM Client on at least one computer. You do not need to install AGPM Client on the computers of end users who do not perform Group Policy administration. - -**To install AGPM Client on the computer of a Group Policy administrator** - -1. Start the Microsoft Desktop Optimization Pack CD and follow the instructions on screen to select **Advanced Group Policy Management - Client**. - -2. In the **Welcome** dialog box, click **Next**. - -3. In the **Microsoft Software License Terms** dialog box, accept the terms and then click **Next**. - -4. In the **Application Path** dialog box, select a location in which to install AGPM Client. Click **Next**. - -5. In the **AGPM Server** dialog box, type the DNS name or IP address for the AGPM Server and the port to which you want to connect. The default port for the AGPM Service is 4600. Do not clear the **Allow Microsoft Management Console through the firewall** check box unless you manually configure port exceptions or use rules to configure port exceptions. Click **Next**. - -6. In the **Languages** dialog box, select one or more display languages to install for AGPM Client. - -7. Click **Install**, and then click **Finish** to exit the Setup Wizard. - -### Step 3: Configure an AGPM Server connection - -AGPM stores all versions of each controlled Group Policy Object (GPO), that is, each GPO for which AGPM provides change control, in a central archive. This lets Group Policy administrators view and change GPOs offline without immediately affecting the deployed version of each GPO. - -In this step, you configure an AGPM Server connection and ensure that all Group Policy administrators connect to the same AGPM Server. (For information about how to configure multiple AGPM Servers, see Help for Advanced Group Policy Management.) - -**To configure an AGPM Server connection for all Group Policy administrators** - -1. On a computer on which you have installed AGPM Client, log on with the user account that you selected as the Archive Owner. This user has the role of AGPM Administrator (Full Control). - -2. Click **Start**, point to **Administrative Tools**, and then click **Group Policy Management** to open the GPMC. - -3. Edit a GPO that is applied to all Group Policy administrators. - -4. In the **Group Policy Management Editor** window, double-click **User Configuration**, **Policies**, **Administrative Templates**, **Windows Components**, and **AGPM**. - -5. In the details pane, double-click **AGPM: Specify default AGPM Server (all domains)**. - -6. In the **Properties** window, select **Enabled** and type the DNS name or IP address and port (for example, **server.contoso.com:4600**) for the server hosting the archive. By default, the AGPM Service uses port 4600. - -7. Click **OK**, and then close the **Group Policy Management Editor** window. When Group Policy is updated, the AGPM Server connection is configured for each Group Policy administrator. - -### Step 4: Configure e-mail notification - -As an AGPM Administrator (Full Control), you designate the e-mail addresses of Approvers and AGPM Administrators to whom an e-mail message that contains a request is sent when an Editor tries to create, deploy, or delete a GPO. You also determine the alias from which these messages are sent. - -**To configure e-mail notification for AGPM** - -1. In **Group Policy Management Editor** , navigate to the **Change Control** folder - -2. In the details pane, click the **Domain Delegation** tab. - -3. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. - -4. In the **To e-mail address** field, type the e-mail address for the user account to which you intend to assign the Approver role. - -5. In the **SMTP server** field, type a valid SMTP mail server. - -6. In the **User name** and **Password** fields, type the credentials of a user who has access to the SMTP service. Click **Apply**. - -### Step 5: Delegate access - -As an AGPM Administrator (Full Control), you delegate domain-level access to GPOs, assigning roles to the account of each Group Policy administrator. - -**Note**   -You can also delegate access at the GPO level instead of the domain level. For more information, see Help for Advanced Group Policy Management. - - - -**Important**   -You should restrict membership in the Group Policy Creator Owners group so that it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.) - - - -**To delegate access to all GPOs throughout a domain** - -1. On the **Domain Delegation** tab, click the **Add** button, select the user account of the Group Policy administrator to serve as Approver, and then click **OK**. - -2. In the **Add Group or User** dialog box, select the **Approver** role to assign that role to the account, and then click **OK**. (This role includes the Reviewer role.) - -3. Click the **Add** button, select the user account of the Group Policy administrator to serve as Editor, and then click **OK**. - -4. In the **Add Group or User** dialog box, select the **Editor** role to assign that role to the account, and then click **OK**. (This role includes the Reviewer role.) - -5. Click the **Add** button, select the user account of the Group Policy administrator to serve as Reviewer, and then click **OK**. - -6. In the **Add Group or User** dialog box, select the **Reviewer** role to assign only that role to the account. - -## Steps for managing GPOs - - -You must complete the following steps to create, edit, review, and deploy GPOs by using AGPM. Additionally, you will create a template, delete a GPO, and restore a deleted GPO. - -[Step 1: Create a GPO](#bkmk-manage1) - -[Step 2: Edit a GPO](#bkmk-manage2) - -[Step 3: Review and deploy a GPO](#bkmk-manage3) - -[Step 4: Use a template to create a GPO](#bkmk-manage4) - -[Step 5: Delete and restore a GPO](#bkmk-manage5) - -### Step 1: Create a GPO - -In an environment that has multiple Group Policy administrators, those with the Editor role can request that new GPOs be created. However, that request must be approved by someone with the Approver role. - -In this step, you use an account that has the Editor role to request that a new GPO be created. Using an account that has the Approver role, you approve this request to create the GPO. - -**To request that a new GPO be created and managed through AGPM** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the Editor role in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -4. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live** so that the new GPO will be deployed to the production environment immediately upon approval. Click **Submit**. - -5. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -**To approve the pending request to create a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has the role of Approver in AGPM. - -2. Open the e-mail inbox for the account, and notice that you have received an e-mail message from the AGPM alias with the Editor's request to create a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab, click the **Pending** tab to display the pending GPOs. - -5. Right-click **MyGPO**, and then click **Approve**. - -6. Click **Yes** to confirm approval and move the GPO to the **Controlled** tab. - -### Step 2: Edit a GPO - -You can use GPOs to configure computer or user settings and deploy them to many computers or users. In this step, you use an account that has the Editor role to check out a GPO from the archive, edit the GPO offline, check the edited GPO into the archive, and request deployment of the GPO to the production environment. For this scenario, you configure a setting in the GPO to require that the password be at least eight characters long. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that has the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Check Out**. - -5. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the minimum password length** - -1. On the **Controlled** tab, right-click **MyGPO**, and then click **Edit** to open the **Group Policy Management Editor** window and change an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Policies**, **Windows Settings**, **Security Settings**, **Account Policies**, and **Password Policy**. - - 2. In the details pane, double-click **Minimum password length**. - - 3. In the properties window, select the **Define this policy setting** check box, set the number of characters to **8**, and then click **OK**. - -2. Close the **Group Policy Management Editor** window. - -**To check the GPO into the archive** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Check In**. - -2. Type a comment, and then click **OK**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked In**. - -**To request the deployment of the GPO to the production environment** - -1. On the **Controlled** tab, right-click **MyGPO** and then click **Deploy**. - -2. Because this account is not an Approver or AGPM Administrator, you must submit a request for deployment. To receive a copy of the request, type your e-mail address in the **Cc** field. Type a comment to be displayed in the history of the GPO, and then click **Submit**. - -3. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. **MyGPO** is displayed on the list of GPOs on the **Pending** tab. - -### Step 3: Review and deploy a GPO - -In this step, you act as an Approver, creating reports and analyzing the settings and changes to settings in the GPO to determine whether you should approve them. After you evaluate the GPO, you deploy it to the production environment and link the GPO to a domain or an organizational unit (OU). The GPO takes effect when Group Policy is refreshed for computers in that domain or OU. - -**To review settings in the GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Approver in AGPM. Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO. - -2. Open the e-mail inbox for the account and notice that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO. - -3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -4. On the **Contents** tab in the details pane, click the **Pending** tab. - -5. Double-click **MyGPO** to display its history. - -6. Review the settings in the most recent version of MyGPO: - - 1. In the **History** window, right-click the GPO version with the most recent time stamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings. - - 2. In the Web browser, click **show all** to display all the settings in the GPO. Close the browser. - -7. Compare the most recent version of MyGPO to the first version checked in to the archive: - - 1. In the **History** window, click the GPO version with the most recent time stamp. Press CTRL and then click the oldest GPO version for which the **Computer Version** is not **\\***. - - 2. Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**. This indicates that the setting is configured only in the latter version of the GPO. - - 3. Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO. - - 4. Close the Web browser. - -**To deploy the GPO to the production environment** - -1. On the **Pending** tab, right-click **MyGPO** and then click **Approve**. - -2. Type a comment to include in the history of the GPO. - -3. Click **Yes**. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is deployed to the production environment. - -**To link the GPO to a domain or organizational unit** - -1. In the GPMC, right-click either the domain or an organizational unit (OU) to which you want to apply the GPO that you configured, and then click **Link an Existing GPO**. - -2. In the **Select GPO** dialog box, click **MyGPO**, and then click **OK**. - -### Step 4: Use a template to create a GPO - -In this step, you use an account that has the Editor role to create and use a template. That template is a static version of a GPO for use as a starting point for creating new GPOs. Although you cannot edit a template, you can create a new GPO based on a template. Templates are useful for quickly creating multiple GPOs that include many of the same policy settings. - -**To create a template based on an existing GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Editor in AGPM. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab in the details pane, click the **Controlled** tab. - -4. Right-click **MyGPO**, and then click **Save as Template** to create a template incorporating all settings currently in MyGPO. - -5. Type **MyTemplate** as the name for the template and a comment, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new template appears on the **Templates** tab. - -**To request that a new GPO be created and managed through AGPM** - -1. Click the **Controlled** tab. - -2. Right-click the **Change Control** node, and then click **New Controlled GPO**. - -3. In the **New Controlled GPO** dialog box: - - 1. To receive a copy of the request, type your e-mail address in the **Cc** field. - - 2. Type **MyOtherGPO** as the name for the new GPO. - - 3. Type a comment for the new GPO. - - 4. Click **Create live** so that the new GPO will be deployed to the production environment immediately upon approval. - - 5. For **From GPO template**, select **MyTemplate**. Click **Submit**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The new GPO is displayed on the **Pending** tab. - -Use an account that is assigned the role of Approver to approve the pending request to create the GPO as you did in [Step 1: Create a GPO](#bkmk-manage1). MyTemplate incorporates all the settings that you configured in MyGPO. Because MyOtherGPO was created using MyTemplate, it at first contains all the settings that MyGPO contained at the time that MyTemplate was created. You can confirm this by generating a difference report to compare MyOtherGPO to MyTemplate. - -**To check the GPO out from the archive for editing** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Editor in AGPM. - -2. Right-click **MyOtherGPO**, and then click **Check Out**. - -3. Type a comment to be displayed in the history of the GPO while it is checked out, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. On the **Controlled** tab, the state of the GPO is identified as **Checked Out**. - -**To edit the GPO offline and configure the account lockout duration** - -1. On the **Controlled** tab, right-click **MyOtherGPO**, and then click **Edit** to open the **Group Policy Management Editor** window and change an offline copy of the GPO. For this scenario, configure the minimum password length: - - 1. Under **Computer Configuration**, double-click **Policies**, **Windows Settings**, **Security Settings**, **Account Policies**, and **Account Lockout Policy**. - - 2. In the details pane, double-click **Account lockout duration**. - - 3. In the properties window, check **Define this policy setting**, set the duration to **30** minutes, and then click **OK**. - -2. Close the **Group Policy Management Editor** window. - -Check MyOtherGPO into the archive and request deployment as you did for MyGPO in [Step 2: Edit a GPO](#bkmk-manage2). You can compare MyOtherGPO to MyGPO or to MyTemplate by using difference reports. Any account that includes the Reviewer role (AGPM Administrator \[Full Control\], Approver, Editor, or Reviewer) can generate reports. - -**To compare a GPO to another GPO and to a template** - -1. To compare MyGPO and MyOtherGPO: - - 1. On the **Controlled** tab, click **MyGPO**. Press CTRL and then click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and then click **HTML Report**. - -2. To compare MyOtherGPO and MyTemplate: - - 1. On the **Controlled** tab, click **MyOtherGPO**. - - 2. Right-click **MyOtherGPO**, point to **Differences**, and then click **Template**. - - 3. Select **MyTemplate** and **HTML Report**, and then click **OK**. - -### Step 5: Delete and restore a GPO - -In this step, you act as an Approver to delete a GPO. - -**To delete a GPO** - -1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Approver. - -2. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs. - -3. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -4. Right-click **MyGPO**, and then click **Delete**. Click **Delete GPO from archive and production** to delete both the version in the archive and the deployed version of the GPO in the production environment. - -5. Type a comment to be displayed in the audit trail for the GPO, and then click **OK**. - -6. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Controlled** tab and is displayed on the **Recycle Bin** tab, where it can be restored or destroyed. - -Occasionally you may discover after you delete a GPO that it is still needed. In this step, you act as an Approver to restore a GPO that was deleted. - -**To restore a deleted GPO** - -1. On the **Contents** tab, click the **Recycle Bin** tab to display deleted GPOs. - -2. Right-click **MyGPO**, and then click **Restore**. - -3. Type a comment to be displayed in the history of the GPO, and then click **OK**. - -4. When the **AGPM Progress** window indicates that overall progress is complete, click **Close**. The GPO is removed from the **Recycle Bin** tab and is displayed on the **Controlled** tab. - - **Note**   - Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3). - - - -After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to an earlier version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made. - -**To roll back to an earlier version of a GPO** - -1. On the **Contents** tab, click the **Controlled** tab to display the controlled GPOs. - -2. Double-click **MyGPO** to display its history. - -3. Right-click the version to be deployed, click **Deploy**, and then click **Yes**. - -4. When the **Progress** window indicates that overall progress is complete, click **Close**. In the **History** window, click **Close**. - - **Note**   - To verify that the version that was redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**. - - - - - - - - - - - diff --git a/mdop/agpm/technical-overview-of-agpm.md b/mdop/agpm/technical-overview-of-agpm.md deleted file mode 100644 index 3ea90686e5..0000000000 --- a/mdop/agpm/technical-overview-of-agpm.md +++ /dev/null @@ -1,284 +0,0 @@ ---- -title: Technical Overview of AGPM -description: Technical Overview of AGPM -author: dansimp -ms.assetid: 36bc0ab5-f752-474c-8559-721ea95169c2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Technical Overview of AGPM - - -Microsoft Advanced Group Policy Management (AGPM) is a client/server application. The AGPM Server stores Group Policy Objects (GPOs) offline in the archive that AGPM creates on the server's file system. Group Policy administrators use the AGPM snap-in for the Group Policy Management Console (GPMC) to work with GPOs on the server that hosts the archive. Understanding the parts of AGPM and related items, how they store GPOs in the file system, and how permissions control the actions available to each user role can improve Group Policy administrators' effectiveness with AGPM. - -## Terminology - - -The following explains the basic AGPM terms. - -- **AGPM Client:** A computer that runs the AGPM snap-in for the Group Policy Management Console (GPMC) and from which Group Policy administrators manage GPOs. - -- **AGPM snap-in:** The software component of AGPM installed on AGPM Clients so that they can manage GPOs. - -- **AGPM Server:** A server that runs the AGPM Service and manages an archive. Each AGPM Server can manage only one archive, but one AGPM Server can manage archive data for multiple domains in one archive. An archive can be hosted on a computer other than an AGPM Server. - -- **AGPM Service:** The software component of AGPM that runs on an AGPM Server as a service. The service manages GPOs in the archive and in the production environment in that forest. - -- **Archive:** In AGPM, a central store that contains the controlled GPOs that the associated AGPM Server manages, in addition to the history for each of those GPOs. This includes all previous controlled versions of each GPO. An archive consists of an archive index file and associated archive data that may include data for GPOs in multiple domains. An archive can be hosted on a computer other than an AGPM Server. - -- **Controlled GPO:** A GPO that is being managed by AGPM. AGPM manages the history and permissions of controlled GPOs, which it stores in the archive. - -- **Uncontrolled GPO:** A GPO in the production environment for a domain and not managed by AGPM. - -## What AGPM installs, creates, and affects - - -On an AGPM Server, the AGPM Setup program installs the AGPM Service. AGPM does not alter the Active Directory® directory service or the schema. By default, the AGPM Server program files are installed in %ProgramFiles%\\Microsoft\\AGPM\\Server. You can install the AGPM Service on a domain controller if you have to; however, we recommend that you install the AGPM Service on a member server. - -On an AGPM Client, the AGPM Setup program installs the AGPM snap-in, adding a **Change Control** folder to each domain that appears in the GPMC. By default, the AGPM Client program files are installed in %ProgramFiles%\\Microsoft\\AGPM\\Client. - -Table 1 describes both the items that AGPM installs or creates and the parts of the operating system that affect AGPM operation. - -**Table 1: Items installed, created, or affected by AGPM** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ItemDescription

    AGPM Service

    The AGPM Service runs on the AGPM Server. The service manages the archive, which contains offline GPOs, and controlled GPOs in the production environment. The default configuration of the AGPM Service is as follows:

    -
      -
    • Service name: AGPM Service

    • -
    • Display name: AGPM Service

    • -
    • Path to executable: %ProgramFiles%\Microsoft\AGPM\Server\Agpm.exe

    • -
    • Startup: Automatic

    • -
    • Log on as: AGPM Service Account specified during installation of AGPM Server, which can be changed using Programs and Features in the Control Panel.

    • -

    AGPM archive

    By default, AGPM creates the archive in %ProgramData%\Microsoft\AGPM on the AGPM Server. The archive provides storage for offline GPOs, and it can store multiple versions of each GPO. Changes that AGPM makes to GPOs in the archive do not affect the production environment until an AGPM Administrator or Approver deploys the GPO to the production environment and links the GPO to an organizational unit (OU).

    Windows Firewall

    During installation, AGPM enables an inbound Windows Firewall rule that allows the AGPM Client to communicate with the AGPM Server. The default Windows Firewall rule is the following:

    -
      -
    • Name: AGPM Service

    • -
    • Action: Allow the connection

    • -
    • Programs: All programs that meet the specified conditions

    • -
    • Protocol type: TCP

    • -
    • Local port: 4600

    • -
    • Remote port: All ports

    • -
    • Local IP address: Any

    • -
    • Remote IP address: Any

    • -

    E-mail server

    AGPM uses Simple Mail Transfer Protocol (SMTP) to send e-mail requests to the addresses configured on the Domain Delegation tab. For example, when an Editor requests that a new GPO be created, AGPM notifies each e-mail address specified on the Domain Delegation tab.

    AGPM snap-in

    The AGPM snap-in for the GPMC runs on AGPM Clients and is used by Group Policy administrators to manage GPOs. The snap-in appears in the GPMC as a Change Control folder in each domain.

    - - - -### Additional references - -For more information about the files installed by AGPM, see the [Planning Guide for AGPM](https://go.microsoft.com/fwlink/?LinkId=160060). - -## Archive - - -By default, the AGPM Server installation process creates the archive on the local hard disk of the AGPM Server at %ProgramData%\\Microsoft\\AGPM. However, you can change the path during installation and even create the archive on a server other than the AGPM Server. - -The archive contains a subfolder for each version of each GPO the archive contains. The name of each subfolder is a GUID that identifies a version of the GPO. - -The gpostate.xml file records the state of each GPO in the archive. The file is a manifest that describes the contents of the archive. For example, a GPO can have many versions, and each version is in its own subfolder in the archive. The gpostate.xml file indicates which subfolders contain different versions of a single GPO. Additionally, GPO templates have subfolders in the archive, but gpostate.xml indicates that these are templates and not controlled GPOs. Similarly, when Group Policy administrators delete GPOs, AGPM changes their states in gpostate.xml to indicate that they are in the **Recycle Bin** but does not actually remove the GPOs' subfolders from the archive. - -**Caution**   -Do not manually edit gpostate.xml or the GPOs the archive contains. This information is provided only to enhance understanding of the AGPM archive. Instead, use the AGPM snap-in to change GPOs. - - - -When AGPM creates the archive, it gives Full Control to SYSTEM, Administrators, and the AGPM Service Account (specified in the setup of AGPM Server). Changing permissions by using the AGPM user interface on the AGPM snap-in does not alter permissions on the archive, because the AGPM Service Account performs all operations on behalf of the logged-on user. - -### Additional references - -For information about how to back up the archive, restore the archive from a backup, or move both the AGPM Server and the archive, see the "Performing AGPM Administrator Tasks" section in the [Operations Guide for AGPM](https://go.microsoft.com/fwlink/?LinkId=160061). - -## Roles and permissions - - -Roles simplify delegation. Instead of assigning detailed permissions to Group Policy administrators, AGPM Administrators can assign one of four roles to Group Policy administrators to let them perform work related to that role: - -- **AGPM Administrator:** Group Policy administrators assigned the AGPM Administrator (Full Control) role can perform any task in AGPM. AGPM Administrators can configure domain-wide options and delegate permissions to other Group Policy administrators. - -- **Approver:** Group Policy administrators assigned the Approver role can deploy GPOs to the production environment for a domain. Approvers can also create and delete GPOs and approve or reject requests from Editors. Approvers can view the list of GPOs in a domain, view the policy settings in GPOs, and create and view reports of the policy settings in a GPO. They cannot edit the policy settings in GPOs unless they are also assigned the Editor role. - -- **Editor:** Group Policy administrators assigned the Editor role can view the list of GPOs in a domain, view the policy settings in GPOs, edit the policy settings in GPOs, and create and view reports of the policy settings in a GPO. Unless they are also assigned the Approver role, Editors cannot create, deploy, or delete GPOs. However, they can request that GPOs be created, deployed, or deleted. - -- **Reviewer:** Group Policy administrators assigned the Reviewer role can view the list of GPOs in a domain and create and view reports of the policy settings in a GPO. Unless they are also assigned the Editor role, they cannot edit policy settings in a GPO. - -AGPM gives AGPM Administrators the flexibility to configure permissions at a more detailed level than roles by using the AGPM snap-in. Table 2 describes these permissions and indicates the permissions granted to each role by default. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PermissionDescriptionAGPM AdministratorApproverEditorReviewer

    Full Control

    Have all permissions.

    Yes

    Create GPO

    Create GPOs in a domain.

    Yes

    Yes

    List Contents

    List the GPOs in a domain.

    Yes

    Yes

    Yes

    Yes

    Read Settings

    Read the policy settings within a GPO.

    Yes

    Yes

    Yes

    Yes

    Edit Settings

    Change the policy settings in a GPO.

    Yes

    Yes

    Delete GPO

    Delete a GPO.

    Yes

    Yes

    Modify Security

    Delegate domain-level access, delegate access to a single GPO, and delegate access to the production environment.

    Yes

    Deploy GPO

    Deploy a GPO from the archive to the production environment.

    Yes

    Yes

    Create Template

    Create a GPO template in AGPM.

    Yes

    Yes

    Modify Options

    Configure AGPM e-mail notification and limit the GPO versions stored in the archive.

    Yes

    Export GPO

    Export a GPO to a file.

    Yes

    Yes

    Import GPO

    Import a GPO from a file.

    Yes

    Yes

    - - - -**Note**   -**Export GPO** and **Import GPO** permissions are not available in AGPM 3.0 or 2.5. - -The ability to delegate access to GPOs in the production environment for a domain and the ability to limit the number of GPO versions stored are not available in AGPM 2.5. - - - -### Additional references - -For information about what tasks can be performed by Group Policy administrators assigned a particular role or about which permissions are required to perform a specific task, see the [Operations Guide for AGPM](https://go.microsoft.com/fwlink/?LinkId=160061). - - - - - - - - - diff --git a/mdop/agpm/template-commands-agpm30ops.md b/mdop/agpm/template-commands-agpm30ops.md deleted file mode 100644 index cd6beac689..0000000000 --- a/mdop/agpm/template-commands-agpm30ops.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Template Commands -description: Template Commands -author: dansimp -ms.assetid: 2ec11b3f-0c5c-4788-97bd-bd4bf64ba51a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Template Commands - - -The **Templates** tab: - -- Displays a list of available templates that you can use to create new Group Policy Objects (GPOs). - -- Provides a shortcut menu with commands for creating a GPO based on a selected template, managing templates, and displaying reports for templates. - -- Displays a list of the groups and users who have permission to access a selected template. - -Because a template cannot be altered, templates have no history. However, like any GPO version, the settings of a template can be displayed with a settings report or compared to another GPO with a difference report. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control - - - ---- - - - - - - - - - - - - -
    CommandEffect

    New Controlled GPO

    Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

    - - - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates.

    - - - -## Template management - - - ---- - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Set as Default

    Set the selected template as the default to be used automatically when creating a new GPO.

    Delete

    Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request.

    Rename

    Change the name of the selected template.

    - - - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for Advanced Group Policy Management (AGPM).

    - - - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - - - - - - - - - diff --git a/mdop/agpm/template-commands-agpm40.md b/mdop/agpm/template-commands-agpm40.md deleted file mode 100644 index ad999f7a40..0000000000 --- a/mdop/agpm/template-commands-agpm40.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Template Commands -description: Template Commands -author: dansimp -ms.assetid: 243a9b18-bf3f-44fa-94d7-5c793f7322da -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Template Commands - - -The **Templates** tab: - -- Displays a list of available templates that you can use to create new Group Policy Objects (GPOs). - -- Provides a shortcut menu with commands for creating a GPO based on a selected template, managing templates, and displaying reports for templates. - -- Displays a list of the groups and users who have permission to access a selected template. - -Because a template cannot be altered, templates have no history. However, like any GPO version, the settings of a template can be displayed with a settings report or compared to another GPO with a difference report. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control - - - ---- - - - - - - - - - - - - -
    CommandEffect

    New Controlled GPO

    Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment of the domain is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

    - - - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates.

    - - - -## Template management - - - ---- - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Set as Default

    Set the selected template as the default to be used automatically when creating a new GPO.

    Delete

    Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request.

    Rename

    Change the name of the selected template.

    - - - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for Advanced Group Policy Management (AGPM).

    - - - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - - - - - - - - - diff --git a/mdop/agpm/templates-tab.md b/mdop/agpm/templates-tab.md deleted file mode 100644 index 75b67d4b89..0000000000 --- a/mdop/agpm/templates-tab.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Templates Tab -description: Templates Tab -author: dansimp -ms.assetid: 5676e9f9-eb52-49e1-a55d-15c1059af368 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Templates Tab - - -The **Templates** tab: - -- Displays a list of available templates that you can use to create new Group Policy objects (GPOs). - -- Provides a shortcut menu with commands for creating a GPO based on a selected template, managing templates, and displaying reports for templates. - -- Displays a list of the groups and users who have permission to access a selected template. - -Because a template cannot be altered, templates have no history. However, like any GPO version, the settings of a template can be displayed with a settings report or compared to another GPO with a difference report. - -**Note**   -A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. - - - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control - - - ---- - - - - - - - - - - - - -
    CommandEffect

    New Controlled GPO

    Create a new GPO based on the selected template. The option to deploy the new GPO to the production environment is provided. If you do not have permission to create a GPO, you will be prompted to submit a request. (This option is displayed if no GPO is selected when right-clicking in the Group Policy Objects list.)

    - - - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPO templates.

    - - - -## Template management - - - ---- - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    Set as Default

    Set the selected template as the default to be used automatically when creating a new GPO.

    Delete

    Move the selected template to the Recycle Bin. If you do not have permission to delete a GPO, you will be prompted to submit a request.

    Rename

    Change the name of the selected template.

    - - - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for Advanced Group Policy Management (AGPM).

    - - - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - - - - - - - - - diff --git a/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md b/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md deleted file mode 100644 index e3ebc0c30b..0000000000 --- a/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Test a GPO in a Separate Organizational Unit -description: Test a GPO in a Separate Organizational Unit -author: dansimp -ms.assetid: 9a9e6d22-74e6-41d8-ac2f-12a1b76ad5a0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Test a GPO in a Separate Organizational Unit - - -If you use a testing organizational unit (OU) to test Group Policy Objects (GPOs) within the same domain before deployment to the production environment, you must have the necessary permissions to access the test OU. Using a test OU is optional. - -**To use a test OU** - -1. Although you have the GPO checked out for editing, in the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you are managing GPOs. - -2. Click the checked out copy of the GPO to be tested. The name will be preceded by **\[AGPM\]**. (If it is not listed, click **Action**, then **Refresh**. Sort the names alphabetically, and **\[AGPM\]** GPOs will typically appear at the top of the list.) - -3. Drag the GPO to the test OU. - -4. Click **OK** in the dialog box that asks whether to create a link to the GPO in the test OU. - -### Additional considerations - -- When testing is complete, checking in the GPO automatically deletes the link to the checked-out copy of the GPO. - -### Additional references - -- [Using a Test Environment](using-a-test-environment.md) - -  - -  - - - - - diff --git a/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md deleted file mode 100644 index 9b374f5a81..0000000000 --- a/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: Troubleshooting Advanced Group Policy Management -description: Troubleshooting Advanced Group Policy Management -author: dansimp -ms.assetid: f7ece97c-e9f8-4b18-8c7a-a615c98d5c60 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Advanced Group Policy Management - - -This section lists common issues that you may encounter when you use Advanced Group Policy Management (AGPM) to manage Group Policy Objects (GPOs). To diagnose issues not listed here, it may be helpful for an AGPM Administrator (Full Control) to use logging and tracing. For more information, see [Configure Logging and Tracing](configure-logging-and-tracing-agpm30ops.md). - -**Note**   -- For information about rolling back to an earlier version of a GPO if there are problems, see [Roll Back to a Previous Version of a GPO](roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md). - -- For information about how to recover from a disaster by restoring the complete archive from a backup, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md). - -  - -## What problems are you having? - - -- [I am unable to access an archive](#bkmk-access-an-archive) - -- [The GPO state varies for different Group Policy administrators](#bkmk-state-varies) - -- [I am unable to modify the AGPM Server connection](#bkmk-modify-archive-location) - -- [I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs](#bkmk-perform-task) - -- [I am unable to use a particular GPO name](#bkmk-use-particular-name) - -- [I am not receiving AGPM e-mail notifications](#bkmk-email) - -- [I cannot use port 4600 for the AGPM Service](#bkmk-port) - -- [The AGPM Service will not start](#bkmk-not-start) - -- [Group Policy Software Installation fails to install software](#bkmk-software-installation) - -- [An error occurred when I restored the archive to a new AGPM Server](#bkmk-error-on-restore) - -### I am unable to access an archive - -- **Cause**: You have not selected the correct server and port for the archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md). - -- **Cause**: The AGPM Service is not running. - -- **Solution**: - - - If you are an AGPM Administrator: Start the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md). - - - If you are not an AGPM Administrator: Contact an AGPM Administrator for assistance. - -### The GPO state varies for different Group Policy administrators - -- **Cause**: Different Group Policy administrators have selected different AGPM Servers for the same archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md). - -### I am unable to modify the AGPM Server connection - -- **Cause**: If the settings on the **AGPM Server** tab are unavailable, the AGPM Server has been centrally configured using an Administrative template. - -- **Solution**: - - - If you are an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm30ops.md). - - - If you are not an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, you do not need to modify the AGPM Server. - -### I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs - -- **Cause**: You have not been assigned a role with the permissions required to perform the task or tasks. - -- **Solution**: - - - If you are an AGPM Administrator: See [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm30ops.md) and [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md). AGPM permissions will cascade from the domain to all GPOs currently in the archive. For details about which roles can perform a task and which permissions are necessary to perform a task, refer to the help for that task. - - - If you are not an AGPM Administrator and you require additional roles or permissions: Contact an AGPM Administrator for assistance. Be aware that if you are an Editor, you can begin the process of creating a GPO, deploying a GPO, or deleting a GPO from the production environment, but an Approver or AGPM Administrator must approve your request. - -### I am unable to use a particular GPO name - -- **Cause**: Either the GPO name is already in use or you lack permission to list the GPO. - -- **Solution**: - - - If the GPO name appears on the **Controlled**, **Uncontrolled**, or **Pending** tab, choose another name. If a GPO that was deployed is renamed but not yet redeployed, it will be displayed under its old name in the production environment. Therefore, the old name is still being used. Redeploy the GPO to update its name in the production environment and release that name for use by another GPO. - - - If the GPO name does not appear on the **Controlled**, **Uncontrolled**, or **Pending** tab, you may lack permission to list the GPO. To request permission, contact an AGPM Administrator. - -### I am not receiving AGPM e-mail notifications - -- **Cause**: A valid SMTP e-mail server and e-mail address has not been provided, or no action has been taken that generates an e-mail notification. - -- **Solution**: - - - If you are an AGPM Administrator: For e-mail notifications about pending actions to be sent by AGPM, an AGPM Administrator must provide a valid SMTP e-mail server and e-mail addresses for Approvers on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md). - - - E-mail notifications are generated only when an Editor, Reviewer, or other Group Policy administrator who lacks the permission necessary to create, deploy, or delete a GPO submits a request for one of those actions to occur. There is no automatic notification of approval or rejection of a request. - -### I cannot use port 4600 for the AGPM Service - -- **Cause**: By default, the port on which the AGPM Service listens is port 4600. - -- **Solution**: If port 4600 is not available for the AGPM Service, modify the port configuration on the AGPM Server to use another port and then update the port in the AGPM Server connection for AGPM Clients. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md). - -### The AGPM Service will not start - -- **Cause**: You have modified settings for the AGPM Service in the operating system under **Administrative Tools** and **Services**. - -- **Solution**: Modify the settings for **Microsoft Advanced Group Policy Management - Server** under **Programs and Features** in Control Panel. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md). - -### Group Policy Software Installation fails to install software - -- **Cause**: AGPM preserves the integrity of Group Policy Software Installation packages. Although GPOs are edited offline, links between packages in addition to cached client information are preserved. This is by design. - -- **Solution**: When you edit a GPO offline with AGPM, configure any Group Policy Software Installation upgrade of a package in another GPO to reference the deployed GPO, not the checked-out copy. The Editor must have **Read** permission for the deployed GPO. - -### An error occurred when I restored the archive to a new AGPM Server - -- **Cause**: For security reasons, the encryption protecting the password entered on the **Domain Delegation** tab causes the password to fail if the archive is moved to another computer. - -- **Solution**: Re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md). - -  - -  - - - - - diff --git a/mdop/agpm/troubleshooting-advanced-group-policy-management.md b/mdop/agpm/troubleshooting-advanced-group-policy-management.md deleted file mode 100644 index 4284e54ffd..0000000000 --- a/mdop/agpm/troubleshooting-advanced-group-policy-management.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: Troubleshooting Advanced Group Policy Management -description: Troubleshooting Advanced Group Policy Management -author: dansimp -ms.assetid: f58849cf-6c5b-44d8-b356-0ed7a5b24cee -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Advanced Group Policy Management - - -This section lists a few common issues you may encounter when using Advanced Group Policy Management (AGPM) to manage Group Policy objects (GPOs). - -## What problems are you having? - - -- [I am unable to access an archive](#bkmk-access-an-archive) - -- [The GPO state varies for different Group Policy administrators](#bkmk-state-varies) - -- [I am unable to modify the AGPM Server connection](#bkmk-modify-archive-location) - -- [I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs](#bkmk-perform-task) - -- [I am unable to use a particular GPO name](#bkmk-use-particular-name) - -- [I am not receiving AGPM e-mail notifications](#bkmk-email) - -- [I cannot use port 4600 for the AGPM Service](#bkmk-port) - -- [The AGPM Service will not start](#bkmk-not-start) - -- [Group Policy Software Installation fails to install software](#bkmk-software-installation) - -### I am unable to access an archive - -- **Cause**: You have not selected the correct server and port for the archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md). - -- **Cause**: The Advanced Group Policy Management Service is not running. - -- **Solution**: - - - If you are an AGPM Administrator: Start the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md). - - - If you are not an AGPM Administrator: Contact an AGPM Administrator for assistance. - -### The GPO state varies for different Group Policy administrators - -- **Cause**: Different Group Policy administrators have selected different AGPM Servers for the same archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md). - -### I am unable to modify the AGPM Server connection - -- **Cause**: If the settings on the **AGPM Server** tab are unavailable, the AGPM Server has been centrally configured using an Administrative template. - -- **Solution**: - - - If you are an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection.md). - - - If you are not an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, you do not need to modify the AGPM Server. - -### I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs - -- **Cause**: You have not been assigned a role with the permissions required to perform the task or tasks. - -- **Solution**: - - - If you are an AGPM Administrator: See [Delegate Domain-Level Access](delegate-domain-level-access.md) and [Delegate Access to an Individual GPO](delegate-access-to-an-individual-gpo.md). AGPM permissions will cascade from the domain to all GPOs currently in the archive. As new Group Policy administrators are added at the domain level, their permissions must be set to apply to **This object and nested objects**. For details about which roles can perform a task and what permissions are necessary to perform a task, refer to the help for that task. - - - If you are not an AGPM Administrator and you require additional roles or permissions: Contact an AGPM Administrator for assistance. Note that if you are an Editor, you can begin the process of creating a GPO, deploying a GPO, or deleting a GPO from the production environment, but an Approver or AGPM Administrator must approve your request. - -### I am unable to use a particular GPO name - -- **Cause**: Either the GPO name is already in use or you lack permission to list the GPO. - -- **Solution**: - - - If the GPO name appears on the **Controlled**, **Uncontrolled**, or **Pending** tab, choose another name. If a GPO that has been deployed is renamed but not yet redeployed, it will be displayed under its old name in the production environment—therefore, the old name is still in use. Redeploy the GPO to update its name in the production environment and release that name for use by another GPO. - - - If the GPO name does not appear on the **Controlled**, **Uncontrolled**, or **Pending** tab, you may lack permission to list the GPO. To request permission, contact an AGPM Administrator. - -### I am not receiving AGPM e-mail notifications - -- **Cause**: A valid SMTP e-mail server and e-mail address has not been provided, or no action has been taken that generates an e-mail notification. - -- **Solution**: - - - If you are an AGPM Administrator: For e-mail notifications about pending actions to be sent by AGPM, an AGPM Administrator must provide a valid SMTP e-mail server and e-mail addresses for Approvers on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification.md). - - - E-mail notifications are generated only when an Editor, Reviewer, or other Group Policy administrator who lacks the permission necessary to create, deploy, or delete a GPO submits a request for one of those actions to occur. There is no automatic notification of approval or rejection of a request. - -### I cannot use port 4600 for the AGPM Service - -- **Cause**: By default, the port on which the AGPM Service listens is port 4600. - -- **Solution**: If port 4600 is not available for the AGPM Service, modify each archive index file to use another port and then update the AGPM Server for all Group Policy administrators. For more information, see [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md). - -### The AGPM Service will not start - -- **Cause**: You have modified settings for the AGPM Service in the operating system under **Administrative Tools** and **Services**. - -- **Solution**: Modify the settings for **Microsoft Advanced Group Policy Management - Server** under **Add or Remove Programs**. For more information, see [Modify the AGPM Service Account](modify-the-agpm-service-account.md). - -### Group Policy Software Installation fails to install software - -- **Cause**: AGPM preserves the integrity of Group Policy Software Installation packages. Although GPOs are edited offline, links between packages as well as cached client information are preserved. This is by design. - -- **Solution**: When editing a GPO offline with AGPM, configure any Group Policy Software Installation upgrade of a package in another GPO to reference the deployed GPO, not the checked-out copy. The Editor must have **Read** permission for the deployed GPO. - -  - -  - - - - - diff --git a/mdop/agpm/troubleshooting-agpm-agpm40.md b/mdop/agpm/troubleshooting-agpm-agpm40.md deleted file mode 100644 index 27451ca6e3..0000000000 --- a/mdop/agpm/troubleshooting-agpm-agpm40.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: Troubleshooting AGPM -description: Troubleshooting AGPM -author: dansimp -ms.assetid: bedcd817-beb2-47bf-aebd-e3923c4fd06f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting AGPM - - -This section lists common issues that you may encounter when you use Advanced Group Policy Management (AGPM) to manage Group Policy Objects (GPOs). To diagnose issues not listed here, it may be helpful for an AGPM Administrator (Full Control) to use logging and tracing. For more information, see [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md). - -**Note**   -- For information about rolling back to an earlier version of a GPO if there are problems, see [Roll Back to an Earlier Version of a GPO](roll-back-to-an-earlier-version-of-a-gpo-agpm40.md). - -- For information about how to recover from a disaster by restoring the complete archive from a backup, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md). - -  - -## What problems are you having? - - -- [I am unable to access an archive](#bkmk-access-an-archive) - -- [The GPO state varies for different Group Policy administrators](#bkmk-state-varies) - -- [I am unable to modify the AGPM Server connection](#bkmk-modify-archive-location) - -- [I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs](#bkmk-perform-task) - -- [I am unable to use a particular GPO name](#bkmk-use-particular-name) - -- [I am not receiving AGPM e-mail notifications](#bkmk-email) - -- [I cannot use port 4600 for the AGPM Service](#bkmk-port) - -- [The AGPM Service will not start](#bkmk-not-start) - -- [Group Policy Software Installation fails to install software](#bkmk-software-installation) - -- [An error occurred when I restored the archive to a new AGPM Server](#bkmk-error-on-restore) - -### I am unable to access an archive - -- **Cause**: You have not selected the correct server and port for the archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md). - -- **Cause**: The AGPM Service is not running. - -- **Solution**: - - - If you are an AGPM Administrator: Start the AGPM Service. For more information, see [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md). - - - If you are not an AGPM Administrator: Contact an AGPM Administrator for assistance. - -### The GPO state varies for different Group Policy administrators - -- **Cause**: Different Group Policy administrators have selected different AGPM Servers for the same archive. - -- **Solution**: - - - If you are an AGPM Administrator: See [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - - - If you are not an AGPM Administrator: Request connection details for the AGPM Server from an AGPM Administrator. See [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md). - -### I am unable to modify the AGPM Server connection - -- **Cause**: If the settings on the **AGPM Server** tab are unavailable, the AGPM Server has been centrally configured using an Administrative template. - -- **Solution**: - - - If you are an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, see [Configure AGPM Server Connections](configure-agpm-server-connections-agpm40.md). - - - If you are not an AGPM Administrator: If the settings on the **AGPM Server** tab are unavailable, you do not need to modify the AGPM Server. - -### I am unable to change the default template or view, create, edit, rename, deploy, or delete GPOs - -- **Cause**: You have not been assigned a role with the permissions required to perform the task or tasks. - -- **Solution**: - - - If you are an AGPM Administrator: See [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm40.md) and [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md). AGPM permissions will cascade from the domain to all GPOs currently in the archive. For details about which roles can perform a task and which permissions are necessary to perform a task, refer to the help for that task. - - - If you are not an AGPM Administrator and you require additional roles or permissions: Contact an AGPM Administrator for assistance. Be aware that if you are an Editor, you can begin the process of creating a GPO, deploying a GPO, or deleting a GPO from the production environment of the domain, but an Approver or AGPM Administrator must approve your request. - -### I am unable to use a particular GPO name - -- **Cause**: Either the GPO name is already in use or you lack permission to list the GPO. - -- **Solution**: - - - If the GPO name appears on the **Controlled**, **Uncontrolled**, or **Pending** tab, choose another name. If a GPO that was deployed is renamed but not yet redeployed, it will be displayed under its old name in the production environment of the domain. Therefore, the old name is still being used. Redeploy the GPO to update its name in the production environment and release that name for use by another GPO. - - - If the GPO name does not appear on the **Controlled**, **Uncontrolled**, or **Pending** tab, you may lack permission to list the GPO. To request permission, contact an AGPM Administrator. - -### I am not receiving AGPM e-mail notifications - -- **Cause**: A valid SMTP e-mail server and e-mail address has not been provided, or no action has been taken that generates an e-mail notification. - -- **Solution**: - - - If you are an AGPM Administrator: For e-mail notifications about pending actions to be sent by AGPM, an AGPM Administrator must provide a valid SMTP e-mail server and e-mail addresses for Approvers on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md). - - - E-mail notifications are generated only when an Editor, Reviewer, or other Group Policy administrator who lacks the permission necessary to create, deploy, or delete a GPO submits a request for one of those actions to occur. There is no automatic notification of approval or rejection of a request. - -### I cannot use port 4600 for the AGPM Service - -- **Cause**: By default, the port on which the AGPM Service listens is port 4600. - -- **Solution**: If port 4600 is not available for the AGPM Service, modify the port configuration on the AGPM Server to use another port and then update the port in the AGPM Server connection for AGPM Clients. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md). - -### The AGPM Service will not start - -- **Cause**: You have modified settings for the AGPM Service in the operating system under **Administrative Tools** and **Services**. - -- **Solution**: Modify the settings for **Microsoft Advanced Group Policy Management - Server** under **Programs and Features** in Control Panel. For more information, see [Modify the AGPM Service](modify-the-agpm-service-agpm40.md). - -### Group Policy Software Installation fails to install software - -- **Cause**: AGPM preserves the integrity of Group Policy Software Installation packages. Although GPOs are edited offline, links between packages in addition to cached client information are preserved. This is by design. - -- **Solution**: When you edit a GPO offline with AGPM, configure any Group Policy Software Installation upgrade of a package in another GPO to reference the deployed GPO, not the checked-out copy. The Editor must have **Read** permission for the deployed GPO. - -### An error occurred when I restored the archive to a new AGPM Server - -- **Cause**: For security reasons, the encryption protecting the password entered on the **Domain Delegation** tab causes the password to fail if the archive is moved to another computer. - -- **Solution**: Re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md). - -  - -  - - - - - diff --git a/mdop/agpm/troubleshooting-agpm40-upgrades.md b/mdop/agpm/troubleshooting-agpm40-upgrades.md deleted file mode 100644 index 0275e8dc91..0000000000 --- a/mdop/agpm/troubleshooting-agpm40-upgrades.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Troubleshooting AGPM Upgrades -description: Troubleshooting AGPM Upgrades -author: dansimp -ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting AGPM Upgrades - -This section lists common issues that you may encounter when you upgrade your Advanced Group Policy Management (AGPM) server to a newer version (e.g. AGPM 4.0 to AGPM 4.3). To diagnose issues not listed here, it may be helpful to view the [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) or for an AGPM Administrator (Full Control) to use logging and tracing. For more information, see [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md). - -## What problems are you having? - -- [Failed to generate a HTML GPO difference report (Error code 80004003)](#bkmk-error-80004003) - -### Failed to generate a HTML GPO difference report (Error code 80004003) - -- **Cause**: You have installed the AGPM upgrade package with an incorrect account. - -- **Solution**: You will need to be an AGPM administrator in order to fix this issue. - - - Ensure you know the username & password of your **AGPM service account**. - - - Log onto your AGPM server interactively as your AGPM service account. - - - This is critically important, as the install will fail if you use a different account. - - - Shutdown the AGPM service. - - - Install the required hotfix. - - - Connect to AGPM using an AGPM client to test that your difference reports are now functioning. - -## Install Hotfix Package 1 for Microsoft Advanced Group Policy Management 4.0 SP3 - -**Issue fixed in this hotfix**: AGPM can't generate difference reports when it controls or manages new Group Policy Objects (GPOs). - -**How to get this update**: Install the latest version of Microsoft Desktop Optimization Pack ([March 2017 Servicing Release](https://www.microsoft.com/download/details.aspx?id=54967)). See [KB 4014009](https://support.microsoft.com/help/4014009/) for more information. - -More specifically, you can choose to download only the first file, `AGPM4.0SP1_Server_X64_KB4014009.exe`, from the list presented after pressing the download button. - -The download link to the Microsoft Desktop Optimization Pack (March 2017 Servicing Release) can be found [here](https://www.microsoft.com/download/details.aspx?id=54967). - - -## Reference link -https://support.microsoft.com/help/3127165/hotfix-package-1-for-microsoft-advanced-group-policy-management-4-0-sp - diff --git a/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md b/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md deleted file mode 100644 index 1ad9a2806a..0000000000 --- a/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Uncontrolled GPO Commands -description: Uncontrolled GPO Commands -author: dansimp -ms.assetid: 94c07b09-cb96-4ff2-b963-b25f103e73e9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Uncontrolled GPO Commands - - -The **Uncontrolled** tab: - -- Displays a list of Group Policy Objects (GPOs) not managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for bringing uncontrolled GPOs under the management of AGPM and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

    Control

    Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request.

    Save as Template

    Create a new template based on the settings of the selected GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm30ops.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm30ops.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/uncontrolled-gpo-commands-agpm40.md b/mdop/agpm/uncontrolled-gpo-commands-agpm40.md deleted file mode 100644 index 0b74dd5b18..0000000000 --- a/mdop/agpm/uncontrolled-gpo-commands-agpm40.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Uncontrolled GPO Commands -description: Uncontrolled GPO Commands -author: dansimp -ms.assetid: 05a8050f-adc3-465b-8524-bbe95745165c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Uncontrolled GPO Commands - - -The **Uncontrolled** tab: - -- Displays a list of Group Policy Objects (GPOs) not managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for bringing uncontrolled GPOs under the management of AGPM and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to an earlier version of a GPO.

    Control

    Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request.

    Save as Template

    Create a new template based on the settings of the selected GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console (GPMC) to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab-agpm40.md) - -- [Performing Editor Tasks](performing-editor-tasks-agpm40.md) - -- [Performing Approver Tasks](performing-approver-tasks-agpm40.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) - -  - -  - - - - - diff --git a/mdop/agpm/uncontrolled-tab.md b/mdop/agpm/uncontrolled-tab.md deleted file mode 100644 index 49a863ddc3..0000000000 --- a/mdop/agpm/uncontrolled-tab.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Uncontrolled Tab -description: Uncontrolled Tab -author: dansimp -ms.assetid: d7e658bf-a72b-4813-bdc8-2fdb7251e742 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Uncontrolled Tab - - -The **Uncontrolled** tab: - -- Displays a list of Group Policy objects (GPOs) not managed by Advanced Group Policy Management (AGPM). - -- Provides a shortcut menu with commands for bringing uncontrolled GPOs under the management of AGPM and for displaying the history and reports for GPOs. - -- Displays a list of the groups and users who have permission to access a selected GPO. - -Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable. - -## Control and history - - - ---- - - - - - - - - - - - - - - - - - - - - -
    CommandEffect

    History

    Open a window listing all versions of the selected GPO saved within the archive. From the history, you can obtain a report of the settings within a GPO, compare two versions of a GPO, compare a GPO to a template, or roll back to a previous version of a GPO.

    Control

    Bring the selected uncontrolled GPO under the change control management of AGPM. If you do not have permission to control a GPO, you will be prompted to submit a request.

    Save as Template

    Create a new template based on the settings of the selected GPO.

    - -  - -## Reports - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Settings

    Generate an HTML-based or XML-based report displaying the settings within the selected GPO.

    Differences

    Generate an HTML-based or XML-based report comparing the settings within two selected GPOs or within the selected GPO and a template.

    - -  - -## Miscellaneous - - - ---- - - - - - - - - - - - - - - - - -
    CommandEffect

    Refresh

    Update the display of the Group Policy Management Console to incorporate any changes. Some changes are not visible until the display is refreshed.

    Help

    Display help for AGPM.

    - -  - -### Additional references - -- [Contents Tab](contents-tab.md) - -- [Performing Editor Tasks](performing-editor-tasks.md) - -- [Performing Approver Tasks](performing-approver-tasks.md) - -- [Performing Reviewer Tasks](performing-reviewer-tasks.md) - -  - -  - - - - - diff --git a/mdop/agpm/use-a-test-environment-agpm30ops.md b/mdop/agpm/use-a-test-environment-agpm30ops.md deleted file mode 100644 index 825a592d62..0000000000 --- a/mdop/agpm/use-a-test-environment-agpm30ops.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Use a Test Environment -description: Use a Test Environment -author: dansimp -ms.assetid: 86295084-b39e-4040-bb3f-15c3c1e99b1a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Use a Test Environment - - -If you use a testing organizational unit (OU) to test Group Policy Objects (GPOs) before deployment to the production environment, you must have the necessary permissions to access the test OU. The use of a test OU is optional. - -**To use a test OU** - -1. While you have the GPO checked out for editing, in the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you are managing GPOs. - -2. Click the checked out copy of the GPO to be tested. The name will be preceded with **\[Checked Out\]**. (If it is not listed, click **Action**, then **Refresh**. Sort the names alphabetically, and **\[Checked Out\]** GPOs will typically appear at the top of the list.) - -3. Drag and drop the GPO to the test OU. - -4. Click **OK** in the dialog box asking whether to create a link to the GPO in the test OU. - -### Additional considerations - -- When testing is complete, checking in the GPO automatically deletes the link to the checked-out copy of the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo-agpm30ops.md) - -  - -  - - - - - diff --git a/mdop/agpm/use-a-test-environment.md b/mdop/agpm/use-a-test-environment.md deleted file mode 100644 index ca6badb289..0000000000 --- a/mdop/agpm/use-a-test-environment.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Use a Test Environment -description: Use a Test Environment -author: dansimp -ms.assetid: b8d7b3ee-030a-4b5b-8223-4a3276fd47a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Use a Test Environment - - -If you use a testing organizational unit (OU) to test Group Policy objects (GPOs) before deployment to the production environment, you must have the necessary permissions to access the test OU. The use of a test OU is optional. - -**To use a test OU** - -1. While you have the GPO checked out for editing, in the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you are managing GPOs. - -2. Click the checked out copy of the GPO to be tested. The name will be preceded with **\[AGPM\]**. (If it is not listed, click **Action**, then **Refresh**. Sort the names alphabetically, and **\[AGPM\]** GPOs will typically appear at the top of the list.) - -3. Drag and drop the GPO to the test OU. - -4. Click **OK** in the dialog box asking whether to create a link to the GPO in the test OU. - -### Additional considerations - -- When testing is complete, checking in the GPO automatically deletes the link to the checked-out copy of the GPO. - -### Additional references - -- [Editing a GPO](editing-a-gpo.md) - -  - -  - - - - - diff --git a/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md deleted file mode 100644 index 870b709194..0000000000 --- a/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: User Interface Advanced Group Policy Management -description: User Interface Advanced Group Policy Management -author: dansimp -ms.assetid: 19aab694-8283-4d97-9425-1845404b461f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# User Interface: Advanced Group Policy Management - - -Advanced Group Policy Management (AGPM) adds a **Change Control** folder to each domain displayed in the **Group Policy Management Console** (GPMC). In an environment where multiple domains are managed with the GPMC, each domain is listed under the **Domains** folder in the console tree. Each domain has a **Change Control** folder under it, and there is one archive of Group Policy Objects (GPOs) per domain. - -Within the details pane there are four primary tabs, providing access to both GPO-level settings and domain-level settings and commands for AGPM. Additionally, there are Administrative template settings specific to AGPM. - -- [Contents Tab](contents-tab-agpm30ops.md): GPO settings and commands and GPO-level delegation - -- [Domain Delegation Tab](domain-delegation-tab-agpm30ops.md): AGPM e-mail notification settings and domain-level delegation - -- [AGPM Server Tab](agpm-server-tab-agpm30ops.md): Domain-level archive connection settings - -- [Production Delegation Tab](production-delegation-tab-agpm30ops.md): Production environment delegation - -- [Administrative Templates Folder](administrative-templates-folder-agpm30ops.md): Central configuration of logging and tracking, archive locations, and the visibility of features - -  - -  - - - - - diff --git a/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md b/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md deleted file mode 100644 index 7104e96d2a..0000000000 --- a/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: User Interface Advanced Group Policy Management -description: User Interface Advanced Group Policy Management -author: dansimp -ms.assetid: 1bf67f6a-4f24-4020-a8c1-fe440de9caa3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# User Interface: Advanced Group Policy Management - - -Advanced Group Policy Management (AGPM) adds a **Change Control** folder to each domain displayed in the **Group Policy Management Console** (GPMC). In an environment where multiple domains are managed with the GPMC, each domain is listed under the **Domains** folder in the console tree. Each domain has a **Change Control** folder under it, and there is one archive of Group Policy Objects (GPOs) per domain. - -Within the details pane there are four primary tabs, providing access to both GPO-level settings and domain-level settings and commands for AGPM. Additionally, there are Administrative template settings specific to AGPM. - -- [Contents Tab](contents-tab-agpm40.md): GPO settings and commands and GPO-level delegation - -- [Domain Delegation Tab](domain-delegation-tab-agpm40.md): AGPM e-mail notification settings and domain-level delegation - -- [AGPM Server Tab](agpm-server-tab-agpm40.md): Domain-level archive connection settings - -- [Production Delegation Tab](production-delegation-tab-agpm40.md): Production environment delegation - -- [Administrative Templates Folder](administrative-templates-folder-agpm40.md): Central configuration of logging and tracking, archive locations, and the visibility of features - -  - -  - - - - - diff --git a/mdop/agpm/user-interface-advanced-group-policy-management.md b/mdop/agpm/user-interface-advanced-group-policy-management.md deleted file mode 100644 index b8a2fbc5b2..0000000000 --- a/mdop/agpm/user-interface-advanced-group-policy-management.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: User Interface Advanced Group Policy Management -description: User Interface Advanced Group Policy Management -author: dansimp -ms.assetid: 73324c99-adca-46dc-b516-ef78b7235f59 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# User Interface: Advanced Group Policy Management - - -Advanced Group Policy Management (AGPM) adds a **Change Control** node to each domain displayed in the **Group Policy Management Console** (GPMC). In an environment where multiple domains are managed with the GPMC, each domain is listed under the **Domains** node in the console tree. Each domain has a **Change Control** node under it, and there is one archive of Group Policy objects (GPOs) per domain. - -Within the details pane there are three primary tabs, providing access to both GPO-level settings and domain-level settings and commands for AGPM. - -- [Contents Tab](contents-tab.md): GPO settings and commands and GPO-level delegation - -- [Domain Delegation Tab](domain-delegation-tab.md): AGPM e-mail notification settings and domain-level delegation - -- [AGPM Server Tab](agpm-server-tab.md): Domain-level archive connection settings - -Other enhancements and settings: - -- [Administrative Template Settings](administrative-template-settings.md): Central configuration of logging and tracing, archive locations, and the visibility of features - -- [Other Enhancements to the GPMC](other-enhancements-to-the-gpmc.md): AGPM adds a **History** tab and an **Extensions** tab for each GPO and Group Policy link - -  - -  - - - - - diff --git a/mdop/agpm/using-a-test-environment.md b/mdop/agpm/using-a-test-environment.md deleted file mode 100644 index 37535bf276..0000000000 --- a/mdop/agpm/using-a-test-environment.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Using a Test Environment -description: Using a Test Environment -author: dansimp -ms.assetid: fc5fcc7c-1ac8-483a-a6bd-2279ae2ee3fb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using a Test Environment - - -Before you request that a Group Policy Object (GPO) be deployed to the production environment, you should test the GPO in a lab environment. If you develop the GPO in a domain in a test forest, you can export the GPO to a file and import the file to a domain in the production forest. You can then test the GPO by linking it to an organizational unit (OU) that contains test computers and users. - -- [Export a GPO to a File](export-a-gpo-to-a-file.md) - -- [Import a GPO from a File](import-a-gpo-from-a-file-ed.md) - -- [Test a GPO in a Separate Organizational Unit](test-a-gpo-in-a-separate-organizational-unit-agpm40.md) - -**Note**   -You can also import a GPO from the production environment of the domain. For more information, see [Import a GPO from Production](import-a-gpo-from-production-agpm40-ed.md). - - - - - - - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-30.md b/mdop/agpm/whats-new-in-agpm-30.md deleted file mode 100644 index 0483edc1f5..0000000000 --- a/mdop/agpm/whats-new-in-agpm-30.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: What's New in AGPM 3.0 -description: What's New in AGPM 3.0 -author: dansimp -ms.assetid: 0d082b86-63c5-45ce-9529-6e5f37254f9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in AGPM 3.0 - - -Microsoft Advanced Group Policy Management (AGPM) 3.0 includes the following new or changed features: - -- Support for Windows Server 2008 and Windows Vista with Service Pack 1 that includes 32-bit and 64-bit versions - -- Improved installation process - -- Simplified procedure for modifying the port on which the AGPM Server listens - -- More detailed information in the History of each GPO - -- Ability to delegate access to the production environment from AGPM - -- Ability to limit the number of GPO versions stored in the archive - -- Ability to configure e-mail security for AGPM - -- Friendlier names for AGPM policy settings - -- The Editor role now requires permission to delete GPOs from the archive - -Additionally, AGPM 3.0 is localized for the following languages: - -- Chinese (Simplified) - -- Chinese (Taiwan) - -- English (U.S.) - -- French - -- German - -- Italian - -- Japanese - -- Korean - -- Portuguese (Brazil) - -- Russian - -- Spanish - -### Additional considerations - -AGPM 3.0 supports Windows Server 2008 and Windows Vista with SP1. It does not support Windows Server 2003 or Windows Vista with no service packs installed. AGPM 2.5 supports those environments. For more information, see [Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md). - -  - -  - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-40-sp1.md b/mdop/agpm/whats-new-in-agpm-40-sp1.md deleted file mode 100644 index 6151532df1..0000000000 --- a/mdop/agpm/whats-new-in-agpm-40-sp1.md +++ /dev/null @@ -1,213 +0,0 @@ ---- -title: What's New in AGPM 4.0 SP1 -description: What's New in AGPM 4.0 SP1 -author: dansimp -ms.assetid: c6a3d94a-13c3-44e6-a466-c3011879999e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# What's New in AGPM 4.0 SP1 - - -This “What’s New” content describes enhancements and supported configurations for Microsoft Advanced Group Policy Management (AGPM) 4.0 SP1. If there is a difference between this content and other AGPM documentation, this content should be considered authoritative and should supersede the content included with this product. - -## What’s new - - -AGPM 4.0 SP1 supports the following enhancements: - -### New and changed client-side extensions - -Group Policy client-side extensions (CSEs) have been added or changed for AGPM to support new Group Policies in Windows 8 and Windows Server 2012. These group policies enable Group Policy administrators to manage and track Windows 8-specific Group Policy settings that change between two Group Policy Objects (GPOs) or templates. You can also create custom GPOs, with Windows 8-specific settings, and configure and save the GPOs as a template. To view your CSEs, use the settings and difference reports that are available in the AGPM 4.0 SP1 client. - -The new and changed Group Policy client-side extensions are: - -- **Central Access Policy:** Enables Group Policy administrators to specify Central Access Policies on Group Policy servers, for example, file servers. Central Access Policy is an authorization policy that is specified by a GPO item and applied to policy targets to facilitate centralized access and control of resources. These Central Access Policies must be configured on a Group Policy client computer from within Active Directory. A Group Policy distributes the knowledge of an applicable Central Access Policy to the computers that have to enforce it. - -- **Name Resolution Policy changes:** Enables Group Policy administrators to configure settings for DNS security and DirectAccess on DNS client computers. New tabs for configuring Generic DNS Server settings and Encoding settings have been added. - -- **Group Policy Preference changes:** Adds support for the configuration and management of Internet Explorer 10 settings that were added for Windows 8. - -- **Remote Application and Desktop Connections:** Lets Group Policy administrators specify the default connection URL that is used for Remote Application and Desktop Connections. - -- **Windows To Go Startup Options:** Lets Group Policy administrators configure whether the computer will boot to Windows To Go if a USB device that contains a Windows To Go workspace is connected. - -- **Windows To Go Hibernate Options:** Lets Group Policy administrators configure whether a computer can use the hibernation sleep state (S4) when the computer is started from a Windows To Go workspace. - -### Customer feedback and hotfix rollup - -AGPM 4.0 SP1 includes a rollup of fixes to address issues found since the AGPM 4.0 release. AGPM 4.0 SP1 contains the latest fixes up to and including Microsoft Advanced Group Policy Management 4.0 Hotfix 1. - -### Settings and difference reports show new Group Policy extensions - -The new Group Policy extensions have been added to the settings and difference reports. - -### Installer changes and support - -The changes and support for the AGPM 4.0 SP1 installer are: - -- If you install AGPM 4.0 SP1 on Windows 8 or Windows Server 2012, the AGPM installer verifies that the required prerequisite software (Group Policy Management Console and the .NET 3.5 Framework) is installed. If these prerequisites are not installed, the AGPM 4.0 SP1 installation is blocked. - -- When you install AGPM 4.0 SP1, WCF Activation, Non-HTTP Activation, and Windows Process Activation Service are automatically enabled. - -- On Windows Vista, Windows 7, and Windows 8 client operating systems, download the appropriate version of the Remote System Administration Toolkit for your operating system before you install AGPM 4.0 SP1. - -- Backward compatibility with older supported operating systems is supported. - -### Ability to upgrade or update to AGPM 4.0 SP1 without re-entering configuration parameters - -You can upgrade the AGPM client or server to AGPM 4.0 SP1 only from AGPM 4.0 without being prompted to re-enter configuration parameters (called “Smart Upgrade”), as shown in the following table. If you are upgrading to AGPM 4.0 SP1 from other versions of AGPM, as shown in the table, you must use the “Classic Upgrade,” which requires you to re-enter the configuration parameters. Since each version of AGPM is associated with a particular operating system, refer to [Choosing Which Version of AGPM to Install](https://go.microsoft.com/fwlink/?LinkId=254350), and be sure to upgrade your operating system as appropriate before performing an upgrade. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    AGPM Version From Which You Can Upgrade

    2.5

    3.0

    4.0

    4.0 SP1

    2.5

    Not Applicable

    Classic Upgrade

    Classic Upgrade

    Installation is blocked

    3.0

    Not Applicable

    Not Applicable

    Classic Upgrade

    Installation is blocked

    4.0

    Not Applicable

    Not Applicable

    Not Applicable

    Smart Upgrade

    - -  - -## Supported configurations - - -AGPM supports the configurations in the following table. Although AGPM supports mixed configurations, it is strongly recommended that you run the AGPM client and server on the same operating system family, for example, Windows 8 with Windows Server 2012, Windows 7 with Windows Server 2008 R2, and so on. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Supported Configurations for AGPM 4.0 SP1 Server

    Supported Configurations for AGPM 4.0 SP1 Client

    AGPM 4.0 SP1 Support

    Windows 8 or Windows Server 2012

    Windows 8 or Windows Server 2012

    Supported

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8

    Windows Server 2008 R2 or Windows 7 or Windows 8 or Windows Server 2012

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 or Windows 8.

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 R2 or Windows 7 or Windows 8 or Windows Server 2012

    Supported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7 or Windows 8

    - -  - -## Prerequisites for installing AGPM 4.0 SP1 - - -The following table describes the behavior on Windows 8 of AGPM 4.0 SP1 client and server installers when .NET 3.5 or the Group Policy Management Console in the Remote Server Administration Tools (RSAT) is missing. - -**AGPM Client 4.0 SP1** - -**AGPM Server 4.0 SP1** - -**Operating System** - -**.NET** - -**RSAT** - -**.NET** - -**RSAT** - -**Windows 8** - -If .NET 3.5 is not enabled or installed, the installer blocks the installation. - -If GPMC is not enabled or installed on the system, the installer blocks the installation. - -If .NET 3.5 is not enabled or installed, the installer blocks the installation. - -If GPMC is not enabled or installed on the system, the installer blocks the installation. - -**Windows Server 2012** - -If .NET 3.5 is not enabled or installed, the installer blocks the installation. - -If GPMC is not enabled, the installer enables it during the installation. - -If .NET 3.5 is not enabled or installed, the installer blocks the installation. - -If GPMC is not enabled, the installer enables it during the installation. - -  - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1](release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md) - -  - -  - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-40-sp2.md b/mdop/agpm/whats-new-in-agpm-40-sp2.md deleted file mode 100644 index 407487d485..0000000000 --- a/mdop/agpm/whats-new-in-agpm-40-sp2.md +++ /dev/null @@ -1,242 +0,0 @@ ---- -title: What's New in AGPM 4.0 SP2 -description: What's New in AGPM 4.0 SP2 -author: dansimp -ms.assetid: 5c0dcab4-f27d-4153-8b8e-b280b080be51 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# What's New in AGPM 4.0 SP2 - - -This content describes enhancements and supported configurations for Microsoft Advanced Group Policy Management (AGPM) 4.0 Service Pack 2 (SP2). If there is a difference between this content and other AGPM documentation, consider this content authoritative and assume that it supersedes the other documentation. - -## What’s new - - -AGPM 4.0 SP2 supports the following features and functionality. - -### Support for Windows 8.1 and Windows Server 2012 R2 - -AGPM 4.0 SP2 adds support for the Windows 8.1 and Windows Server 2012 R2 operating systems. - -### New and changed client-side extensions - -Group Policy client-side extensions have been added or changed for AGPM to support new policy settings in Windows 8.1. These policy settings enable Group Policy administrators to manage and track Windows 8.1–specific policy settings that change between two Group Policy Objects (GPOs) or templates. To view your client-side extensions, use the settings and difference reports that are available in the AGPM Client. - -The new and changed Group Policy client-side extensions are: - -- **Specify Work Folders settings**. If you enable this policy setting, IT administrators can configure Work Folders to be created automatically. The Work Folders feature enables end users to synchronize files from their Windows desktop devices to their other devices. Use this policy setting to create the synchronization relationship on an end user’s devices and to configure how to identify the file server that stores the user’s Work Folders. If you select the **Auto provision synchronization** check box, the synchronization partnership will be created without user input, and data will automatically start synchronizing to the user’s device. If you do not select the **Auto provision synchronization** check box, users must provide input to start the synchronization. - -- **Force automatic setup for all users**. If you enable this policy setting, IT administrators can determine whether to create the Work Folders partnership automatically on end-user devices without input from end users. If you enable this policy setting, the synchronization will be set up according to how you configure the **Specify Work Folders settings** policy setting. If you set the **Force automatic setup for all users** policy setting to **Disabled** or **Not configured**, the Work Folders partnership will be configured according to how you set the **Automatic Provisioning** option in the **Specify Work Folders settings** policy setting. - -For more information about the Work Folders feature, see [Work Folders Overview](https://go.microsoft.com/fwlink/?LinkId=330444). - -### Customer feedback and hotfix rollup - -AGPM 4.0 SP2 includes a rollup of hotfixes to address issues found since the AGPM 4.0 Service Pack 1 (SP1) release. AGPM 4.0 SP2 contains the latest fixes up to and including Microsoft Advanced Group Policy Management 4.0 SP1 Hotfix 1. For more information, see Knowledge Base article [2873472](https://go.microsoft.com/fwlink/?LinkId=325400)). - -### New Group Policy extensions in settings and difference reports - -The new Group Policy extensions have been added to the settings and difference reports. - -### Installer changes and support - -The changes and support for the AGPM 4.0 SP2 installer are: - -- If you install AGPM 4.0 SP2 on the Windows 8 or Windows Server 2012 operating system or later operating systems, the AGPM installer verifies that the required prerequisite software (the Group Policy Management Console (GPMC) and the Microsoft .NET Framework 3.5) is installed. If this prerequisite software is not installed, the AGPM 4.0 SP2 installation is blocked. - -- When you install the AGPM Server, WCF Activation, Non-HTTP Activation, and Windows Process Activation Service are automatically enabled. - -- On the Windows Vista client operating system and later operating systems, download the appropriate version of the Remote System Administration Tools for your operating system before you install AGPM 4.0 SP2. - -- AGPM 4.0 SP2 supports backward compatibility with older supported operating systems. - -### Ability to upgrade to AGPM 4.0 SP2 without reentering configuration parameters - -You can upgrade the AGPM Client or AGPM Server to AGPM 4.0 SP2 without being prompted to reenter configuration parameters (called the Smart Upgrade) only from AGPM 4.0 onward, as shown in the following table. If you are upgrading to AGPM 4.0 SP2 from other versions of AGPM, as shown in the table, you must use the Classic Upgrade, which requires you to reenter the configuration parameters. Because each version of AGPM is associated with a particular operating system, see [Choosing Which Version of AGPM to Install](https://go.microsoft.com/fwlink/?LinkId=254350) and make sure that you upgrade your operating system as appropriate before you upgrade AGPM. - -**AGPM 4.0 SP2 supported upgrades** - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    AGPM version from which you can upgrade

    2.5

    3.0

    4.0

    4.0 SP1

    4.0 SP2

    2.5

    Not applicable

    Classic Upgrade

    Classic Upgrade

    Installation is blocked

    Installation is blocked

    3.0

    Not applicable

    Not applicable

    Classic Upgrade

    Installation is blocked

    Installation is blocked

    4.0

    Not applicable

    Not applicable

    Not applicable

    Smart Upgrade

    Smart Upgrade

    4.0 SP1

    Not applicable

    Not applicable

    Not applicable

    Not applicable

    Smart Upgrade

    - -  - -## Supported configurations - - -AGPM 4.0 SP2 supports the configurations in the following table. Although AGPM supports mixed configurations, we strongly recommend that you run the AGPM Client and AGPM Server on the same operating system line—for example, Windows 8.1 with Windows Server 2012 R2, Windows 8 with Windows Server 2012, and so on. - -**AGPM 4.0 SP2 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

    Windows Server 2012 R2 or Windows 8.1

    Windows Server 2012 R2 or Windows 8.1

    Supported

    Windows Server 2012 R2, Windows Server 2012, Windows 8.1, or Windows 8

    Windows Server 2012 or Windows 8

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1 or Windows 8

    Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

    Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

    Not supported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, Windows 8, or Windows 7

    - -  - -## Prerequisites for installing AGPM 4.0 SP2 - - -The following table describes the behavior of AGPM 4.0 SP2 Client and Server installers on Windows 8.1 when the .NET Framework 3.5 or the GPMC in the Remote Server Administration Tools is missing. - -**AGPM Client** - -**AGPM Server** - -**Operating system** - -**.NET Framework** - -**Remote Server Administration Tools** - -**.NET Framework** - -**Remote Server Administration Tools** - -**Windows 8.1** - -If the .NET Framework 3.5 is not enabled or installed, the installer blocks the installation. - -If the GPMC is not enabled or installed, the installer blocks the installation. - -If the .NET Framework 3.5 is not enabled or installed, the installer blocks the installation. - -If the GPMC is not enabled or installed, the installer blocks the installation. - -**Windows Server 2012 R2** - -If the .NET Framework 3.5 is not enabled or installed, the installer blocks the installation. - -If the GPMC is not enabled, the installer enables it during the installation. - -If the .NET Framework 3.5 is not enabled or installed, the installer blocks the installation. - -If the GPMC is not enabled, the installer enables it during the installation. - -  - -## How to Get MDOP Technologies - - -AGPM 4.0 SP2 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2](release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md) - -[Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md) - -  - -  - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-40-sp3.md b/mdop/agpm/whats-new-in-agpm-40-sp3.md deleted file mode 100644 index d60031b011..0000000000 --- a/mdop/agpm/whats-new-in-agpm-40-sp3.md +++ /dev/null @@ -1,210 +0,0 @@ ---- -title: What's New in AGPM 4.0 SP3 -description: What's New in AGPM 4.0 SP3 -author: dansimp -ms.assetid: df495d55-9fbf-4f7e-a7af-3905f4f8790e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 09/27/2016 ---- - - -# What's New in AGPM 4.0 SP3 - - -This content describes enhancements and supported configurations for Microsoft Advanced Group Policy Management (AGPM) 4.0 Service Pack 3 (SP3). If there is a difference between this content and other AGPM documentation, consider this content authoritative and assume that it supersedes the other documentation. - -## What’s new - - -AGPM 4.0 SP3 supports the following features and functionality. - -### Support for Windows 10 - -AGPM 4.0 SP3 adds support for the Windows 10 and Windows Server 2016 operating systems. - -### Support for PowerShell - -AGPM 4.0 SP3 adds support for PowerShell cmdlets. For a list of the cmdlets available in AGPM 4.0 SP3, including descriptions and syntax, see [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://docs.microsoft.com/powershell/mdop/get-started?view=win-mdop2-ps). - -### Customer feedback and hotfix rollup - -AGPM 4.0 SP3 includes a rollup of all fixes up to and including Microsoft Advanced Group Policy Management 4.0 SP2 and any fixes for issues found since AGPM 4.0 SP2. - -### Ability to upgrade to AGPM 4.0 SP3 without re-entering configuration parameters - -You can upgrade the AGPM Client or AGPM Server to AGPM 4.0 SP3 without being prompted to re-enter configuration parameters (called the Smart Upgrade) only from AGPM 4.0 and later, as shown in the following table. If you are upgrading to AGPM 4.0 SP3 from other versions of AGPM, as shown in the table, you must use the Classic Upgrade, which requires you to re-enter the configuration parameters. Because each version of AGPM is associated with a particular operating system, see [Choosing Which Version of AGPM to Install](https://go.microsoft.com/fwlink/?LinkId=254350) and make sure that you upgrade your operating system as appropriate before you upgrade AGPM. - -**AGPM 4.0 SP3 supported upgrades** - - --------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    AGPM version from which you can upgrade

    2.5

    3.0

    4.0

    4.0 SP1

    4.0 SP2

    4.0 SP3

    2.5

    Not applicable

    Classic Upgrade

    Classic Upgrade

    Installation is blocked

    Installation is blocked

    Installation is blocked

    3.0

    Not applicable

    Not applicable

    Classic Upgrade

    Installation is blocked

    Installation is blocked

    Installation is blocked

    4.0

    Not applicable

    Not applicable

    Not applicable

    Smart Upgrade

    Smart Upgrade

    Smart Upgrade

    4.0 SP1

    Not applicable

    Not applicable

    Not applicable

    Not applicable

    Smart Upgrade

    Smart Upgrade

    4.0 SP2

    Not applicable

    Not applicable

    Not applicable

    Not applicable

    Not applicable

    Smart Upgrade

    - -  - -## Supported configurations - - -AGPM 4.0 SP3 supports the configurations in the following table. Although AGPM supports mixed configurations, we strongly recommend that you run the AGPM Client and AGPM Server on the same operating system line—for example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. - -**AGPM 4.0 SP3 supported operating systems and policy settings** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported configurations for the AGPM ServerSupported configurations for the AGPM ClientAGPM Support

    Windows Server 2016 or Windows 10

    Windows 10

    Supported

    Windows Server 2012 R2 or Windows 8.1

    Windows Server 2012 R2 or Windows 8.1

    Supported

    Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

    Windows Server 2012

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

    Windows Server 2012, Windows Server 2008 R2, or Windows 7

    Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2012, Windows Server 2008 R2, or Windows 7

    Not supported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

    - -  - -## Prerequisites for installing AGPM 4.0 SP3 - -The following table describes the behavior of AGPM 4.0 SP3 Client and Server installers when the .NET Framework 4.5.1, PowerShell 3.0, or the GPMC in the Remote Server Administration Tools is missing. - -| AGPM Client | | | AGPM Server | | | -|------------------------|-------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------|---------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------| -| Operating system | .NET Framework | PowerShell | Remote Server Administration Tools | .NET Framework | Remote Server Administration Tools | -| Windows 10 | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If Powershell 3.0 is not installed, the installer blocks the installation. | If the GPMC is not enabled or installed, the installer blocks the installation. | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If the GPMC is not enabled or installed, the installer blocks the installation. | -| Windows 8.1 | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If Powershell 3.0 is not installed, the installer blocks the installation. | If the GPMC is not enabled or installed, the installer blocks the installation. | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If the GPMC is not enabled or installed, the installer blocks the installation. | -| Windows Server 2012 R2 | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If Powershell 3.0 is not installed, the installer blocks the installation. | If the GPMC is not enabled, the installer enables it during the installation. | If the .NET Framework 4.5.1 is not enabled or installed, the installer blocks the installation. | If the GPMC is not enabled, the installer enables it during the installation. | - -  - -## How to Get MDOP Technologies - - -AGPM 4.0 SP3 is a part of the Microsoft Desktop Optimization Pack (MDOP) since MDOP 2015. MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Advanced Group Policy Management](index.md) - -[Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3](release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md) - -[Choosing Which Version of AGPM to Install](choosing-which-version-of-agpm-to-install.md) - -  - -  - - - - - diff --git a/mdop/agpm/whats-new-in-agpm-40.md b/mdop/agpm/whats-new-in-agpm-40.md deleted file mode 100644 index 280c395196..0000000000 --- a/mdop/agpm/whats-new-in-agpm-40.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: What's New in AGPM 4.0 -description: What's New in AGPM 4.0 -author: dansimp -ms.assetid: 31775f7f-a59c-4e64-a875-0adc9f5bc835 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in AGPM 4.0 - - -Microsoft Advanced Group Policy Management (AGPM) 4.0 includes new features that let you search for Group Policy Objects (GPOs), filter the list of GPOs displayed, export and import a GPO to a different forest, and install AGPM on computers running Windows 7 and Windows Server 2008 R2. - -## Search and filter GPOs - - -In AGPM 4.0, you can search the list of GPOs for specific attributes to filter the list of GPOs displayed. For example, you can search for GPOs with a particular name, state, or comment. You can also search for GPOs that were last changed by a particular Group Policy administrator or on a particular date. - -You can create a complex search string by using the format *GPO attribute 1: search text 1 GPO attribute 2: search text 2…*, where a GPO attribute is any column heading in the list of GPOs in AGPM. For example, to search for all GPOs with names including the text "MyGPO" that are checked in and were last changed by the user Editor03, you would type the following in the Search box: **name: MyGPO state:** **checked in** **changed by: Editor03**. The search returns partial matches so that you can enter part of a GPO name or user name and view a list of all GPOs that include that text in their name. - -Additionally, you can use the same special terms available when you search in Windows to search for GPOs changed on a specific date or range of dates. For example, **change date:** **lastmonth** or **change date:** **thisweek**. - -## Export and import GPOs to different forests - - -Using AGPM 4.0, you can copy a controlled GPO from a domain in one forest to a domain in a second forest. For example, you can export a GPO from a domain in one forest to a CAB file by using AGPM, copy that CAB file to a USB drive, plug the USB drive into a computer in a domain in a second forest, and import the GPO into AGPM in a domain in the second forest. You can either import the GPO as a new controlled GPO, or import it to replace the settings of an existing GPO that is checked out. - -## Support for Windows Server 2008 R2 and Windows 7 - - -AGPM 4.0 supports Windows Server 2008 R2 and Windows 7, yet still supports Windows Server 2008 and Windows Vista® with Service Pack 1 (SP1). However, there are limitations in a mixed environment that includes both the newer and older operating systems, as indicated in the following table. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating system on which AGPM Server 4.0 runsOperating system on which AGPM Client 4.0 runsStatus of AGPM 4.0 support

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 R2 or Windows 7

    Supported

    Windows Server 2008 R2 or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 R2 or Windows 7

    Unsupported

    Windows Server 2008 or Windows Vista with SP1

    Windows Server 2008 or Windows Vista with SP1

    Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2008 R2 or Windows 7

    - -  - -  - -  - - - - - diff --git a/mdop/appv-v4/TOC.md b/mdop/appv-v4/TOC.md deleted file mode 100644 index 743199d765..0000000000 --- a/mdop/appv-v4/TOC.md +++ /dev/null @@ -1,649 +0,0 @@ -# [Application Virtualization 4](index.md) -## [Getting Started Guide](microsoft-application-virtualization-getting-started-guide.md) -### [Overview of Application Virtualization](overview-of-application-virtualization.md) -### [Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) -#### [Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -#### [Planning the Application Virtualization Sequencer Implementation](planning-the-application-virtualization-sequencer-implementation.md) -#### [Using Electronic Software Distribution as a Package Management Solution](using-electronic-software-distribution-as-a-package-management-solution.md) -##### [Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md) -##### [Planning Your Streaming Solution in an Electronic Software Distribution Implementation](planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md) -#### [Using Application Virtualization Servers as a Package Management Solution](using-application-virtualization-servers-as-a-package-management-solution.md) -##### [Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) -##### [Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) -##### [Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) -#### [Planning for Application Virtualization Client Deployment](planning-for-application-virtualization-client-deployment.md) -#### [Planning for Migration from Previous Versions](planning-for-migration-from-previous-versions.md) -#### [Planning for Security and Protection](planning-for-security-and-protection.md) -##### [Security and Protection Overview](security-and-protection-overview.md) -##### [Planning for Server Security](planning-for-server-security.md) -##### [Planning for Client Security](planning-for-client-security.md) -##### [Planning for Sequencer Security](planning-for-sequencer-security.md) -### [Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations-copy.md) -#### [Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) -##### [Application Virtualization System Requirements](application-virtualization-system-requirements.md) -##### [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) -##### [Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) -#### [Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) -##### [App-V Pre-Installation Checklist](app-v-pre-installation-checklist.md) -##### [App-V Installation Checklist](app-v-installation-checklist.md) -##### [App-V Postinstallation Checklist](app-v-postinstallation-checklist.md) -##### [App-V Upgrade Checklist](app-v-upgrade-checklist.md) -#### [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) -##### [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) -##### [How to Install the Application Virtualization Streaming Server](how-to-install-the-application-virtualization-streaming-server.md) -##### [How to Install the Management Web Service](how-to-install-the-management-web-service.md) -##### [How to Install the Management Console](how-to-install-the-management-console.md) -##### [How to Install a Database](how-to-install-a-database.md) -##### [How to Remove the Application Virtualization System Components](how-to-remove-the-application-virtualization-system-components.md) -#### [How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -#### [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) -#### [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) -#### [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) -#### [How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) -### [About Microsoft Application Virtualization 4.5](about-microsoft-application-virtualization-45.md) -#### [App-V 4.5 Release Notes](microsoft-application-virtualization-management-system-release-notes.md) -### [About Microsoft Application Virtualization 4.5 SP1](about-microsoft-application-virtualization-45-sp1.md) -#### [App-V 4.5 SP1 Release Notes](microsoft-application-virtualization-management-system-release-notes-45-sp1.md) -### [About Microsoft Application Virtualization 4.5 SP2](about-microsoft-application-virtualization-45-sp2.md) -#### [App-V 4.5 SP2 Release Notes](app-v-45-sp2-release-notes.md) -### [About Microsoft Application Virtualization 4.6](about-microsoft-application-virtualization-46.md) -#### [App-V 4.6 Release Notes](app-v-46-release-notes.md) -### [About Microsoft Application Virtualization 4.6 SP1](about-microsoft-application-virtualization-46-sp1.md) -#### [App-V 4.6 SP1 Release Notes](app-v-46-sp1-release-notes.md) -### [About Microsoft Application Virtualization 4.6 SP2](about-microsoft-application-virtualization-46-sp2.md) -#### [App-V 4.6 SP2 Release Notes](app-v-46-sp2-release-notes.md) -### [About Microsoft Application Virtualization 4.6 SP3](about-microsoft-application-virtualization-46-sp3.md) -#### [App-V 4.6 SP3 Release Notes](app-v-46-sp3-release-notes.md) -## [Planning and Deployment](planning-and-deployment-guide-for-the-application-virtualization-system.md) -### [Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) -#### [Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -#### [Planning the Application Virtualization Sequencer Implementation](planning-the-application-virtualization-sequencer-implementation.md) -#### [Using Electronic Software Distribution as a Package Management Solution](using-electronic-software-distribution-as-a-package-management-solution.md) -##### [Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md) -##### [Planning Your Streaming Solution in an Electronic Software Distribution Implementation](planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md) -#### [Using Application Virtualization Servers as a Package Management Solution](using-application-virtualization-servers-as-a-package-management-solution.md) -##### [Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) -##### [Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) -##### [Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) -#### [Planning for Application Virtualization Client Deployment](planning-for-application-virtualization-client-deployment.md) -#### [Planning for Migration from Previous Versions](planning-for-migration-from-previous-versions.md) -#### [Planning for Security and Protection](planning-for-security-and-protection.md) -##### [Security and Protection Overview](security-and-protection-overview.md) -##### [Planning for Server Security](planning-for-server-security.md) -##### [Planning for Client Security](planning-for-client-security.md) -##### [Planning for Sequencer Security](planning-for-sequencer-security.md) -### [Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) -#### [Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) -##### [Application Virtualization System Requirements](application-virtualization-system-requirements.md) -##### [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) -##### [Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) -##### [Configuring Prerequisite Groups in Active Directory for App-V](configuring-prerequisite-groups-in-active-directory-for-app-v.md) -##### [How to Configure Windows Server 2008 for App-V Management Servers](how-to-configure-windows-server-2008-for-app-v-management-servers.md) -#### [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) -#### [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) -#### [How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) -#### [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) -### [Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) -#### [Electronic Software Distribution-Based Scenario Overview](electronic-software-distribution-based-scenario-overview.md) -##### [Determine Your Publishing Method](determine-your-publishing-method.md) -##### [Determine Your Streaming Method](determine-your-streaming-method.md) -#### [How to Configure Servers for ESD-Based Deployment](how-to-configure-servers-for-esd-based-deployment.md) -##### [How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) -##### [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) -##### [How to Configure the File Server](how-to-configure-the-file-server.md) -#### [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) -##### [How to Install the App-V Client by Using Setup.exe](how-to-install-the-app-v-client-by-using-setupexe-new.md) -##### [How to Install the App-V Client by Using Setup.msi](how-to-install-the-app-v-client-by-using-setupmsi-new.md) -#### [How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md) -#### [How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) -### [Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) -#### [Application Virtualization Server-Based Scenario Overview](application-virtualization-server-based-scenario-overview.md) -#### [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) -##### [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) -##### [How to Install the Application Virtualization Streaming Server](how-to-install-the-application-virtualization-streaming-server.md) -##### [How to Install the Management Web Service](how-to-install-the-management-web-service.md) -##### [How to Install the Management Console](how-to-install-the-management-console.md) -##### [How to Install a Database](how-to-install-a-database.md) -##### [How to Remove the Application Virtualization System Components](how-to-remove-the-application-virtualization-system-components.md) -#### [How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) -##### [How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) -##### [How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) -##### [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) -##### [How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md) -##### [Configuring the Firewall for the App-V Servers](configuring-the-firewall-for-the-app-v-servers.md) -##### [How to Install and Configure the Default Application](how-to-install-and-configure-the-default-application.md) -#### [How to Configure a Read-only Cache on the App-V Client (VDI)](how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md) -#### [How to Configure a Read-only Cache on the App-V Client (RDS)](how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md) -#### [How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) -### [Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) -#### [Stand-Alone Delivery Scenario Overview](stand-alone-delivery-scenario-overview.md) -#### [How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -#### [How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) -### [Application Virtualization Reference](application-virtualization-reference.md) -#### [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) -#### [SFTMIME Command Reference](sftmime--command-reference.md) -##### [ADD APP](add-app.md) -##### [ADD PACKAGE](add-package.md) -##### [ADD SERVER](add-server.md) -##### [ADD TYPE](add-type.md) -##### [CLEAR APP](clear-app.md) -##### [CLEAR OBJ](clear-obj.md) -##### [CONFIGURE APP](configure-app.md) -##### [CONFIGURE PACKAGE](configure-package.md) -##### [CONFIGURE SERVER](configure-server.md) -##### [CONFIGURE TYPE](configure-type.md) -##### [DELETE APP](delete-app.md) -##### [DELETE OBJ](delete-obj.md) -##### [DELETE PACKAGE](delete-package.md) -##### [DELETE SERVER](delete-server.md) -##### [DELETE TYPE](delete-type.md) -##### [HELP](help.md) -##### [LOAD APP](load-app.md) -##### [LOAD PACKAGE](load-package.md) -##### [LOCK APP](lock-app.md) -##### [PUBLISH APP](publish-app.md) -##### [PUBLISH PACKAGE](publish-package.md) -##### [QUERY OBJ](query-obj.md) -##### [REFRESH SERVER](refresh-server.md) -##### [REPAIR APP](repair-app.md) -##### [UNLOAD APP](unload-app.md) -##### [UNLOAD PACKAGE](unload-package.md) -##### [UNLOCK APP](unlock-app.md) -##### [UNPUBLISH PACKAGE](unpublish-package.md) -## [Operations](operations-guide-for-the-application-virtualization-system.md) -### [Application Virtualization Client](application-virtualization-client.md) -#### [How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) -##### [How to Refresh Virtual Applications from the Desktop Notification Area](how-to-refresh-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Load Virtual Applications from the Desktop Notification Area](how-to-load-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Cancel Loading of Virtual Applications from the Desktop Notification Area](how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Work Offline or Online with Application Virtualization](how-to-work-offline-or-online-with-application-virtualization.md) -##### [How to Exit the App-V Client from the Notification Area](how-to-exit-the-app-v-client-from-the-notification-area.md) -#### [How to Manage Virtual Applications Manually](how-to-manage-virtual-applications-manually.md) -##### [How to Load or Unload an Application](how-to-load-or-unload-an-application.md) -##### [How to Clear an Application](how-to-clear-an-application.md) -##### [How to Repair an Application](how-to-repair-an-application.md) -##### [How to Import an Application](how-to-import-an-application.md) -##### [How to Lock or Unlock an Application](how-to-lock-or-unlock-an-application.md) -##### [How to Delete an Application](how-to-delete-an-application.md) -##### [How to Change an Application Icon](how-to-change-an-application-icon.md) -##### [How to Add an Application](how-to-add-an-application.md) -##### [How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) -##### [How to Add a File Type Association](how-to-add-a-file-type-association.md) -##### [How to Delete a File Type Association](how-to-delete-a-file-type-association.md) -#### [How to Configure the Application Virtualization Client Settings Manually](how-to-configure-the-application-virtualization-client-settings-manually.md) -##### [How to Perform General Administrative Tasks in the App-V Client Management Console](how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md) -###### [How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) -###### [How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) -###### [How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) -###### [User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) -###### [Disconnected Operation Mode](disconnected-operation-mode.md) -##### [How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) -###### [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) -###### [How to Change the Log Reporting Levels and Reset the Log Files](how-to-change-the-log-reporting-levels-and-reset-the-log-files.md) -###### [How to Change User Access Permissions](how-to-change-user-access-permissions.md) -###### [How to Change Import Search Paths](how-to-change-import-search-paths.md) -###### [How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) -###### [How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) -#### [How to Manage Virtual Applications by Using the Command Line](how-to-manage-virtual-applications-by-using-the-command-line.md) -##### [How to Add a Package by Using the Command Line](how-to-add-a-package-by-using-the-command-line.md) -##### [How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md) -##### [How to Delete All Virtual Applications by Using the Command Line](how-to-delete-all-virtual-applications-by-using-the-command-line.md) -##### [How to Manage the App-V Client Cache Using Performance Counters](how-to-manage-the-app-v-client-cache-using-performance-counters.md) -#### [How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) -##### [How to Reset the FileSystem Cache](how-to-reset-the-filesystem-cache.md) -##### [How to Change the Size of the FileSystem Cache](how-to-change-the-size-of-the-filesystem-cache.md) -##### [How to Use the Cache Space Management Feature](how-to-use-the-cache-space-management-feature.md) -##### [How to Configure the Client Log File](how-to-configure-the-client-log-file.md) -##### [How to Configure User Permissions](how-to-configure-user-permissions.md) -##### [How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md) -##### [How to Configure the Client for Disconnected Operation Mode](how-to-configure-the-client-for-disconnected-operation-mode.md) -##### [How to Configure Shortcut and File Type Association Behavior](how-to-configure-shortcut-and-file-type-association-behavior-46-only.md) -##### [How to Configure the Client for MIT Kerberos Realm Support](how-to-configure-the-client-for-mit-kerberos-realm-support.md) -#### [Troubleshooting Information for the Application Virtualization Client](troubleshooting-information-for-the-application-virtualization-client.md) -#### [Application Virtualization Client Reference](application-virtualization-client-reference.md) -##### [SFTMIME Command Reference](sftmime--command-reference.md) -###### [ADD APP](add-app.md) -###### [ADD PACKAGE](add-package.md) -###### [ADD SERVER](add-server.md) -###### [ADD TYPE](add-type.md) -###### [CLEAR APP](clear-app.md) -###### [CLEAR OBJ](clear-obj.md) -###### [CONFIGURE APP](configure-app.md) -###### [CONFIGURE PACKAGE](configure-package.md) -###### [CONFIGURE SERVER](configure-server.md) -###### [CONFIGURE TYPE](configure-type.md) -###### [DELETE APP](delete-app.md) -###### [DELETE OBJ](delete-obj.md) -###### [DELETE PACKAGE](delete-package.md) -###### [DELETE SERVER](delete-server.md) -###### [DELETE TYPE](delete-type.md) -###### [HELP](help.md) -###### [LOAD APP](load-app.md) -###### [LOAD PACKAGE](load-package.md) -###### [LOCK APP](lock-app.md) -###### [PUBLISH APP](publish-app.md) -###### [PUBLISH PACKAGE](publish-package.md) -###### [QUERY OBJ](query-obj.md) -###### [REFRESH SERVER](refresh-server.md) -###### [REPAIR APP](repair-app.md) -###### [UNLOAD APP](unload-app.md) -###### [UNLOAD PACKAGE](unload-package.md) -###### [UNLOCK APP](unlock-app.md) -###### [UNPUBLISH PACKAGE](unpublish-package.md) -##### [SFTTRAY Command Reference](sfttray-command-reference.md) -##### [Application Virtualization Client WMI Provider](application-virtualization-client-wmi-provider.md) -###### [App-V Application WMI Class](app-v-application-wmi-class.md) -###### [App-V Package WMI Class](app-v-package-wmi-class.md) -##### [Log File for the Application Virtualization Client](log-file-for-the-application-virtualization-client.md) -##### [App-V Client Registry Values](app-v-client-registry-values-sp1.md) -##### [App-V Interoperability with Windows AppLocker](app-v-interoperability-with-windows-applocker.md) -##### [Support for Client Reporting over HTTP](support-for-client-reporting-over-http.md) -### [Application Virtualization Server](application-virtualization-server.md) -#### [Monitoring Application Virtualization Servers](monitoring-application-virtualization-servers.md) -#### [How to Load Files and Packages](how-to-load-files-and-packages.md) -#### [How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) -##### [How to Connect to an Application Virtualization System](how-to-connect-to-an-application-virtualization-system.md) -##### [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) -###### [How to Import an Application](how-to-import-an-applicationserver.md) -###### [How to Rename an Application](how-to-rename-an-application.md) -###### [How to Delete an Application](how-to-delete-an-application-server.md) -###### [How to Manually Add an Application](how-to-manually-add-an-application.md) -###### [How to Move an Application](how-to-move-an-application.md) -###### [How to Grant Access to an Application](how-to-grant-access-to-an-application.md) -###### [How to Deny Access to an Application](how-to-deny-access-to-an-application.md) -###### [How to Change an Application Icon](how-to-change-an-application-iconserver.md) -##### [How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) -###### [How to Create an Application Group](how-to-create-an-application-group.md) -###### [How to Move an Application Group](how-to-move-an-application-group.md) -###### [How to Rename an Application Group](how-to-rename-an-application-group.md) -###### [How to Remove an Application Group](how-to-remove-an-application-group.md) -##### [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) -###### [How to Add a Package](how-to-add-a-package.md) -###### [How to Add a Package Version](how-to-add-a-package-version.md) -###### [How to Delete a Package](how-to-delete-a-packageserver.md) -###### [How to Delete a Package Version](how-to-delete-a-package-version.md) -###### [How to Upgrade a Package](how-to-upgrade-a-package.md) -##### [How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) -###### [Application Virtualization Report Types](application-virtualization-report-types.md) -####### [System Utilization Report](system-utilization-reportserver.md) -####### [Software Audit Report](software-audit-reportserver.md) -####### [Application Utilization Report](application-utilization-reportserver.md) -####### [System Error Report](system-error-reportserver.md) -###### [How to Create a Report](how-to-create-a-reportserver.md) -###### [How to Run a Report](how-to-run-a-reportserver.md) -###### [How to Print a Report](how-to-print-a-reportserver.md) -###### [How to Export a Report](how-to-export-a-reportserver.md) -###### [How to Delete a Report](how-to-delete-a-reportserver.md) -##### [How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) -###### [How to Create a Server Group](how-to-create-a-server-group.md) -###### [How to Remove a Server Group](how-to-remove-a-server-group.md) -###### [How to Add a Server](how-to-add-a-server.md) -###### [How to Remove a Server](how-to-remove-a-server.md) -###### [How to Change the Server Cache Size](how-to-change-the-server-cache-size.md) -###### [How to Change the Server Port](how-to-change-the-server-port.md) -##### [How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) -###### [How to Create an Application License Group](how-to-create-an-application-license-group.md) -###### [How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) -###### [How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) -###### [How to Remove an Application License Group](how-to-remove-an-application-license-group.md) -###### [How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) -###### [How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) -###### [How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) -##### [How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) -###### [How to Set Up and Enable or Disable Authentication](how-to-set-up-and-enable-or-disable-authentication.md) -###### [How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md) -###### [How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md) -###### [How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md) -###### [How to Add an Administrator Group](how-to-add-an-administrator-group.md) -###### [How to Delete an Administrator Group](how-to-delete-an-administrator-group.md) -##### [How to Change the Server Logging Level and the Database Parameters](how-to-change-the-server-logging-level-and-the-database-parameters.md) -#### [How to Configure the App-V System for Package Upgrade](how-to-configure-the-app-v-system-for-package-upgrade.md) -#### [Troubleshooting Information for the Application Virtualization Server](troubleshooting-information-for-the-application-virtualization-server.md) -#### [How to Migrate the App-V SQL Database to a Different SQL Server](how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md) -### [Application Virtualization Sequencer](application-virtualization-sequencer.md) -#### [Application Virtualization Sequencer Console Overview](application-virtualization-sequencer-console-overview.md) -#### [About Sequencing Phases](about-sequencing-phases.md) -#### [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md) -#### [How to Determine Whether to Edit or Upgrade a Virtual Application Package](how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md) -#### [How to Configure the App-V Sequencer](how-to-configure-the-app-v-sequencer.md) -##### [How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md) -##### [How to Create the Sequencer Package Root Directory](how-to-create-the-sequencer-package-root-directory.md) -##### [How to Modify the Scratch Directory Location](how-to-modify-the-scratch-directory-location.md) -#### [Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md) -##### [How to Install the Sequencer (App-V 4.6 SP1)](how-to-install-the-sequencer---app-v-46-sp1-.md) -##### [How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md) -#### [How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) -##### [How to Sequence an Application](how-to-sequence-an-application.md) -##### [How to Sequence a New Application (App-V 4.6)](how-to-sequence-a-new-application--app-v-46-.md) -##### [How to Edit an Existing Virtual Application](how-to-edit-an-existing-virtual-application.md) -##### [How to Modify a Virtual Application Package (App-V 4.6)](how-to-modify-a-virtual-application-package--app-v-46-.md) -##### [How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md) -##### [How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md) -##### [How to Modify the Operating Systems Associated With an Existing Windows Installer File](how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md) -##### [How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md) -##### [How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md) -##### [How To Use Dynamic Suite Composition](how-to-use-dynamic-suite-composition.md) -##### [How to Use the Differential SFT File](how-to-use-the-differential-sft-file.md) -#### [Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) -##### [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) -##### [How to Sequence a New Standard Application (App-V 4.6 SP1)](how-to-sequence-a-new-standard-application--app-v-46-sp1-.md) -##### [How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)](how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md) -##### [How to Sequence a New Middleware Application (App-V 4.6 SP1)](how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md) -##### [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md) -##### [How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md) -##### [How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md) -##### [How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md) -#### [Troubleshooting Application Virtualization Sequencer Issues](troubleshooting-application-virtualization-sequencer-issues.md) -#### [Application Virtualization Sequencer Reference](application-virtualization-sequencer-reference.md) -##### [Log Files for the Application Virtualization Sequencer](log-files-for-the-application-virtualization-sequencer.md) -##### [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) -##### [Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) -##### [Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) -###### [Incompatible Installer Dialog Box (App-V 4.6 SP1)](incompatible-installer-dialog-box--app-v-46-sp1-.md) -###### [Failed Launch Dialog Box (App-V 4.6 SP1)](failed-launch-dialog-box--app-v-46-sp1-.md) -###### [Oversized Package Dialog Box (App-V 4.6 SP1)](oversized-package-dialog-box--app-v-46-sp1-.md) -###### [Restart Task Failure Dialog Box (App-V 4.6 SP1)](restart-task-failure-dialog-box--app-v-46-sp1-.md) -###### [Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1)](side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md) -###### [SXS Conflict Detected Dialog Box (App-V 4.6 SP1)](sxs-conflict-detected-dialog-box--app-v-46-sp1-.md) -###### [Files Excluded Page Dialog Box (App-V 4.6 SP1)](files-excluded-page-dialog-box--app-v-46-sp1-.md) -###### [Defender Running Dialog Box (App-V 4.6 SP1)](defender-running-dialog-box--app-v-46-sp1-.md) -###### [Defrag Running Dialog Box (App-V 4.6 SP1)](defrag-running-dialog-box--app-v-46-sp1-.md) -###### [Antivirus Running Dialog Box (App-V 4.6 SP1)](antivirus-running-dialog-box--app-v-46-sp1-.md) -##### [Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) -###### [Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) -####### [About Sharing Package Accelerators Page](about-sharing-package-accelerators-page.md) -####### [Select Package (Learn More) Page](select-package--learn-more--page.md) -####### [Installation Files Page](installation-files-page.md) -####### [Gathering Information Page (Learn More)](gathering-information-page--learn-more-.md) -####### [Select Files Page](select-files-page.md) -####### [Verify Applications Page (Package Accelerators)](verify-applications-page--package-accelerators-.md) -####### [Select Guidance Page (Package Accelerators)](select-guidance-page--package-accelerators-.md) -####### [Create Package Accelerator Page](create-package-accelerator-page.md) -####### [Create Package Accelerator (Review Errors) Page](create-package-accelerator--review-errors--page.md) -####### [Completion Page](completion-page.md) -###### [Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) -####### [Packaging Method Page (Learn More)](packaging-method-page--learn-more-.md) -####### [Prepare Computer Page (Learn More)](prepare-computer-page--learn-more-.md) -####### [Type of Application Page (Learn More)](type-of-application-page--learn-more-.md) -####### [Select Installer Page (Learn More)](select-installer-page--learn-more-.md) -####### [Package Name Page (Learn More)](package-name-page---learn-more-.md) -####### [Installation Page (Learn More)](installation-page--learn-more-.md) -####### [Configure Software Page (Learn More)](configure-software-page--learn-more-.md) -####### [Installation Report Page (Learn More)](installation-report-page--learn-more-.md) -####### [Customize Page (Learn More)](customize-page--learn-more-.md) -######## [Edit Shortcuts](edit-shortcuts-learn-more.md) -######## [Streaming Page](streaming-page-learn-more.md) -######## [Target OS Page](target-os-page-learn-more.md) -####### [Select Primary Page (Learn More)](select-primary-page--learn-more-.md) -###### [Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) -####### [Select Task Page (Learn More)](select-task-page--learn-more-.md) -####### [Packaging Method (Learn More)](packaging-method--learn-more-.md) -###### [Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) -####### [Select Package Accelerator Page](select-package-accelerator-page.md) -####### [Select Package Accelerator (Learn More) Page](select-package-accelerator--learn-more--page.md) -####### [Guidance Page [App-V 4.6 SP1]](guidance-page-app-v-46-sp1.md) -####### [Select Installation Files Page [App-V 4.6 SP1]](select-installation-files-page-app-v-46-sp1.md) -####### [Package Name Page [App-V 4.6 SP1]](package-name-page--app-v-46-sp1.md) -####### [Create Package Page [App-V 4.6 SP1]](create-package-page--app-v-46-sp1.md) -####### [Configure Software Page [App-V 4.6 SP1]](configure-software-page-app-v-46-sp1.md) -####### [Run Each Program Page [App-V 4.6 SP1]](run-each-program-page-app-v-46-sp1.md) -####### [Completion Page [Package Accelerator]](completion-page-package-accelerator.md) -## [Online Help for Application Virtualization](online-help-for-application-virtualization.md) -### [Application Virtualization Client Help](microsoft-application-virtualization-client-management-help.md) -#### [Application Virtualization Client Management Console Roadmap](application-virtualization-client-management-console-roadmap.md) -#### [About Virtual Environments](about-virtual-environments.md) -#### [How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) -##### [How to Refresh Virtual Applications from the Desktop Notification Area](how-to-refresh-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Load Virtual Applications from the Desktop Notification Area](how-to-load-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Cancel Loading of Virtual Applications from the Desktop Notification Area](how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md) -##### [How to Work Offline or Online with Application Virtualization](how-to-work-offline-or-online-with-application-virtualization.md) -##### [How to Exit the App-V Client from the Notification Area](how-to-exit-the-app-v-client-from-the-notification-area.md) -#### [Application Virtualization Client Management Console](application-virtualization-client-management-console.md) -##### [Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) -###### [About Application Virtualization Servers](about-application-virtualization-servers.md) -###### [User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) -###### [Disconnected Operation Mode](disconnected-operation-mode.md) -##### [How to Perform General Administrative Tasks in the Client Management Console](how-to-perform-general-administrative-tasks-in-the-client-management-console.md) -###### [How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) -###### [How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) -###### [How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) -##### [How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md) -###### [How to Load or Unload an Application](how-to-load-or-unload-an-application.md) -###### [How to Clear an Application](how-to-clear-an-application.md) -###### [How to Repair an Application](how-to-repair-an-application.md) -###### [How to Import an Application](how-to-import-an-application.md) -###### [How to Lock or Unlock an Application](how-to-lock-or-unlock-an-application.md) -###### [How to Delete an Application](how-to-delete-an-application.md) -###### [How to Change an Application Icon](how-to-change-an-application-icon.md) -##### [How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) -###### [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) -###### [How to Change the Log Reporting Levels and Reset the Log Files](how-to-change-the-log-reporting-levels-and-reset-the-log-files.md) -###### [How to Change User Access Permissions](how-to-change-user-access-permissions.md) -###### [How to Change Import Search Paths](how-to-change-import-search-paths.md) -###### [How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) -###### [How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) -##### [How to Manually Manage Applications in the Client Management Console](how-to-manually-manage-applications-in-the-client-management-console.md) -###### [How to Add an Application](how-to-add-an-application.md) -###### [How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) -###### [How to Add a File Type Association](how-to-add-a-file-type-association.md) -###### [How to Delete a File Type Association](how-to-delete-a-file-type-association.md) -#### [Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) -##### [Client Management Console: Application Virtualization Node](client-management-console-application-virtualization-node.md) -##### [Client Management Console: About Dialog Boxes](client-management-console-about-dialog-boxes.md) -##### [Client Management Console: Applications Node](client-management-console-applications-node.md) -###### [Applications Node](applications-node.md) -###### [Applications Results Pane](applications-results-pane.md) -###### [Applications Results Pane Columns](applications-results-pane-columns.md) -##### [Client Management Console: File Type Associations Node](client-management-console-file-type-associations-node.md) -###### [File Type Associations Node](file-type-associations-node-client.md) -###### [File Type Association Results Pane](file-type-association-results-pane.md) -###### [File Type Association Results Pane Columns](file-type-association-results-pane-columns.md) -##### [Client Management Console: Publishing Servers Node](client-management-console-publishing-servers-node.md) -###### [Publishing Servers Node](publishing-servers-node.md) -###### [Publishing Servers Results Pane](publishing-servers-results-pane.md) -###### [Publishing Servers Results Pane Columns](publishing-servers-results-pane-columns.md) -##### [Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) -###### [Application Virtualization Properties: General Tab](application-virtualization-properties-general-tab.md) -###### [Application Virtualization Properties: Interface Tab](application-virtualization-properties-interface-tab.md) -###### [Application Virtualization Properties: File System Tab](application-virtualization-properties-file-system-tab.md) -###### [Application Virtualization Properties: Import Search Path Tab](application-virtualization-properties-import-search-path-tab.md) -###### [Application Virtualization Properties: Connectivity Tab](application-virtualization-properties-connectivity-tab.md) -###### [Application Virtualization Properties: Permissions Tab](application-virtualization-properties-permissions-tab.md) -### [Application Virtualization Server Help](application-virtualization-server-management-help.md) -#### [About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) -##### [About Application Virtualization Applications](about-application-virtualization-applications.md) -##### [About Application Virtualization Packages](about-application-virtualization-packages.md) -##### [About Publishing](about-publishing.md) -##### [About Application Licensing](about-application-licensing.md) -#### [How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) -##### [How to Connect to an Application Virtualization System](how-to-connect-to-an-application-virtualization-system.md) -##### [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) -###### [How to Import an Application](how-to-import-an-applicationserver.md) -###### [How to Rename an Application](how-to-rename-an-application.md) -###### [How to Delete an Application](how-to-delete-an-application-server.md) -###### [How to Manually Add an Application](how-to-manually-add-an-application.md) -###### [How to Move an Application](how-to-move-an-application.md) -###### [How to Grant Access to an Application](how-to-grant-access-to-an-application.md) -###### [How to Deny Access to an Application](how-to-deny-access-to-an-application.md) -###### [How to Change an Application Icon](how-to-change-an-application-iconserver.md) -##### [How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) -###### [How to Create an Application Group](how-to-create-an-application-group.md) -###### [How to Move an Application Group](how-to-move-an-application-group.md) -###### [How to Rename an Application Group](how-to-rename-an-application-group.md) -###### [How to Remove an Application Group](how-to-remove-an-application-group.md) -##### [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) -###### [How to Add a Package](how-to-add-a-package.md) -###### [How to Add a Package Version](how-to-add-a-package-version.md) -###### [How to Delete a Package](how-to-delete-a-packageserver.md) -###### [How to Delete a Package Version](how-to-delete-a-package-version.md) -###### [How to Upgrade a Package](how-to-upgrade-a-package.md) -##### [How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) -###### [Application Virtualization Report Types](application-virtualization-report-types.md) -####### [System Utilization Report](system-utilization-reportserver.md) -####### [Software Audit Report](software-audit-reportserver.md) -####### [Application Utilization Report](application-utilization-reportserver.md) -####### [System Error Report](system-error-reportserver.md) -###### [How to Create a Report](how-to-create-a-reportserver.md) -###### [How to Run a Report](how-to-run-a-reportserver.md) -###### [How to Print a Report](how-to-print-a-reportserver.md) -###### [How to Export a Report](how-to-export-a-reportserver.md) -###### [How to Delete a Report](how-to-delete-a-reportserver.md) -##### [How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) -###### [How to Create a Server Group](how-to-create-a-server-group.md) -###### [How to Remove a Server Group](how-to-remove-a-server-group.md) -###### [How to Add a Server](how-to-add-a-server.md) -###### [How to Remove a Server](how-to-remove-a-server.md) -###### [How to Change the Server Cache Size](how-to-change-the-server-cache-size.md) -###### [How to Change the Server Port](how-to-change-the-server-port.md) -##### [How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) -###### [How to Create an Application License Group](how-to-create-an-application-license-group.md) -###### [How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) -###### [How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) -###### [How to Remove an Application License Group](how-to-remove-an-application-license-group.md) -###### [How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) -###### [How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) -###### [How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) -##### [How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) -###### [How to Set Up and Enable or Disable Authentication](how-to-set-up-and-enable-or-disable-authentication.md) -###### [How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md) -###### [How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md) -###### [How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md) -###### [How to Add an Administrator Group](how-to-add-an-administrator-group.md) -###### [How to Delete an Administrator Group](how-to-delete-an-administrator-group.md) -##### [How to Change the Server Logging Level and the Database Parameters](how-to-change-the-server-logging-level-and-the-database-parameters.md) -##### [How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) -#### [Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) -##### [Server Management Console: Application Virtualization System Node](server-management-console-application-virtualization-system-node.md) -##### [Server Management Console: About Dialog Boxes](server-management-console-about-dialog-boxes.md) -##### [Server Management Console: Applications Node](server-management-console-applications-node.md) -###### [Applications Node](applications-node-in-server-management-console.md) -###### [Applications Results Pane](applications-results-pane-in-server-management-console.md) -###### [Applications Results Pane Columns](applications-results-pane-columns-in-server-management-console.md) -##### [Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) -###### [File Type Associations Node](file-type-associations-node.md) -###### [File Type Associations Results Pane](file-type-associations-results-pane.md) -###### [File Type Associations Results Pane Columns](file-type-associations-results-pane-columns.md) -##### [Server Management Console: Packages Node](server-management-console-packages-node.md) -###### [Packages Node](packages-node.md) -###### [Package Results Pane](package-results-pane.md) -###### [Package Results Pane Columns](package-results-pane-columns.md) -##### [Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) -###### [Applications Licenses Node](applications-licenses-node.md) -###### [Applications Licenses Results Pane](applications-licenses-results-pane.md) -###### [Applications Licenses Results Pane Columns](applications-licenses-results-pane-columns.md) -##### [Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) -###### [Server Groups Node](server-groups-node.md) -###### [Server Groups Results Pane](server-groups-results-pane.md) -###### [Server Groups Results Pane Columns](server-groups-results-pane-columns.md) -##### [Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) -###### [Provider Policies Node](provider-policies-node.md) -###### [Provider Policies Results Pane](provider-policies-results-pane.md) -###### [Provider Policies Results Pane Columns](provider-policies-results-pane-columns.md) -##### [Server Management Console: Administrators Node](server-management-console-administrators-node.md) -###### [Administrators Node](administrators-node.md) -###### [Administrators Results Pane](administrators-results-pane.md) -###### [Administrators Results Pane Columns](administrators-results-pane-columns.md) -##### [Server Management Console: Reports Node](server-management-console-reports-node.md) -###### [Reports Node](reports-node.md) -###### [Reports Results Pane](reports-results-pane.md) -###### [Reports Results Pane Columns](reports-results-pane-columns.md) -### [Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) -#### [Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) -##### [About the Application Virtualization Sequencer](about-the-application-virtualization-sequencer.md) -##### [About the Sequencer Console](about-the-sequencer-console.md) -##### [About Using the Sequencer Command Line](about-using-the-sequencer-command-line.md) -##### [Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -#### [Sequencer Hardware and Software Requirements](sequencer-hardware-and-software-requirements.md) -#### [Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) -##### [How to Install the Sequencer](how-to-install-the-sequencer.md) -##### [How to Create the Package Root Directory](how-to-create-the-package-root-directory.md) -##### [How to Modify the Location of the Log Directory](how-to-modify-the-location-of-the-log-directory.md) -##### [How to Modify the Location of the Scratch Directory](how-to-modify-the-location-of-the-scratch-directory.md) -#### [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) -##### [How to Sequence a New Application](how-to-sequence-a-new-application.md) -##### [How to Create a Virtual Environment for a Web-Based Application](how-to-create-a-virtual-environment-for-a-web-based-application.md) -##### [How to Upgrade a Sequenced Virtual Application Package](how-to-upgrade-a-sequenced-virtual-application-package.md) -##### [How to Branch a Package](how-to-branch-a-package.md) -##### [How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md) -##### [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) -###### [How to Open a Sequenced Application Using the Command Line](how-to-open-a-sequenced-application-using-the-command-line.md) -###### [How to Sequence a New Application Package Using the Command Line](how-to-sequence-a-new-application-package-using-the-command-line.md) -###### [How to Upgrade a Sequenced Application Package Using the Command Line](how-to-upgrade-a-sequenced-application-package-using-the-command-line.md) -#### [Troubleshooting the Application Virtualization Sequencer](troubleshooting-the-application-virtualization-sequencer.md) -#### [Application Virtualization Sequencer Technical Reference](application-virtualization-sequencer-technical-reference-keep.md) -##### [Sequencer Dialog Boxes](sequencer-dialog-boxes.md) -###### [Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) -####### [General Tab](general-tab-keep.md) -####### [Parse Items Tab](parse-items-tab-keep.md) -####### [Exclusion Items Tab](exclusion-items-tab-keep.md) -####### [Exclusion Item Dialog Box](exclusion-item-dialog-box.md) -###### [Application Virtualization Sequencing Wizard-Add Application Dialog Box](application-virtualization-sequencing-wizard-add-application-dialog-box.md) -###### [Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box](application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md) -###### [Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box](application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md) -##### [Sequencing Wizard](sequencing-wizard.md) -###### [Package Information Page](application-virtualization-sequencing-wizard-package-information-page-keep.md) -###### [Advanced Options Page](application-virtualization-sequencing-wizard-advanced-options-page.md) -###### [Monitor Installation Page](application-virtualization-sequencing-wizard-monitor-installation-page.md) -###### [Add Files to Virtual File System Page](application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md) -###### [Virtual Application Package Additional Components](virtual-application-package-additional-components.md) -###### [Configure Application Page](application-virtualization-sequencing-wizard-configure-application-page-keep.md) -###### [Launch Applications Page](application-virtualization-sequencing-wizard-launch-applications-page.md) -###### [Sequence Package Page](application-virtualization-sequencing-wizard-sequence-package-page.md) -##### [Sequencer Console](sequencer-console.md) -###### [Properties Tab](properties-tab-keep.md) -####### [About the Properties Tab](about-the-properties-tab.md) -####### [How to Change Package Properties](how-to-change-package-properties.md) -###### [Deployment Tab](deployment-tab.md) -####### [About the Deployment Tab](about-the-deployment-tab.md) -####### [How to Change Deployment Properties](how-to-change-deployment-properties.md) -###### [Change History Tab](change-history-tab-keep.md) -###### [Files Tab](files-tab-keep.md) -####### [About the Files Tab](about-the-files-tab.md) -####### [How to Modify the Files Included in a Package](how-to-modify-the-files-included-in-a-package.md) -###### [Virtual Registry Tab](virtual-registry-tab-keep.md) -####### [About the Virtual Registry Tab](about-the-virtual-registry-tab.md) -####### [How to Modify Virtual Registry Key Information](how-to-modify-virtual-registry-key-information.md) -###### [Virtual File System Tab](virtual-file-system-tab-keep.md) -####### [About the Virtual File System Tab](about-the-virtual-file-system-tab.md) -####### [How to Modify File-Mapping Information](how-to-modify-file-mapping-information.md) -###### [Virtual Services Tab](virtual-services-tab-keep.md) -####### [About the Virtual Services Tab](about-the-virtual-services-tab.md) -####### [How to Modify Attributes of Embedded Services](how-to-modify-attributes-of-embedded-services.md) -###### [OSD Tab](osd-tab-keep.md) -####### [About the OSD Tab](about-the-osd-tab.md) -######## [OSD File Elements](osd-file-elements.md) -####### [How to Edit an OSD File](how-to-edit-an-osd-file.md) -####### [How to Edit an OSD File Using a Text Editor](how-to-edit-an-osd-file-using-a-text-editor.md) -##### [Application Virtualization Sequencer Command Line](application-virtualization-sequencer-command-line.md) -###### [Command-Line Parameters](command-line-parameters.md) -###### [Command-Line Errors](command-line-errors.md) -## [Glossary](application-virtualization-glossary.md) -## [Application Virtualization Technical Publications](application-virtualization-technical-publications-white-papers.md) -### [Microsoft Application Virtualization Security Guide](microsoft-application-virtualization-security-guide.md) -#### [Introduction](introduction-to-the-application-virtualization-security-guide.md) -#### [Installing App-V Management Server or Streaming Server Securely](installing-app-v-management-server-or-streaming-server-securely.md) -##### [Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md) -##### [How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md) -##### [Configuring Certificates to Support App-V Management Server or Streaming Server](configuring-certificates-to-support-app-v-management-server-or-streaming-server.md) -#### [Configuring Management or Streaming Server for Secure Communications Post-Installation](configuring-management-or-streaming-server-for-secure-communications-post-installation.md) -##### [How to Configure Management Server Security Post-Installation](how-to-configure-management-server-security-post-installation.md) -##### [How to Configure Streaming Server Security Post-Installation](how-to-configure-streaming-server-security-post-installation.md) -##### [Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md) -#### [Configuring Windows Firewall for App-V](configuring-windows-firewall-for-app-v.md) -##### [How to Configure Windows Server 2003 Firewall for App-V](how-to-configure-windows-server-2003-firewall-for-app-v.md) -##### [How to Configure Windows Server 2008 Firewall for App-V](how-to-configure-windows-server-2008-firewall-for-app-v.md) -#### [Configuring App-V for Secure Administration](configuring-app-v-for-secure-administration.md) -##### [Configuring Certificates to Support the App-V Web Management Service](configuring-certificates-to-support-the-app-v-web-management-service.md) -##### [How to Install and Configure the App-V Management Console for a More Secure Environment](how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md) -#### [Configuring App-V Administration for a Distributed Environment](configuring-app-v-administration-for-a-distributed-environment.md) -#### [Configuring IIS for Secure Streaming](configuring-iis-for-secure-streaming.md) -#### [App-V Desktop Client Security](app-v-desktop-client-security.md) -#### [Improving Security During App-V Sequencing](improving-security-during-app-v-sequencing.md) -#### [Internet-Facing Server Scenarios for Perimeter Networks](internet-facing-server-scenarios-for-perimeter-networks.md) -#### [Internet-Facing Considerations for App-V Clients](internet-facing-considerations-for-app-v-clients.md) -##### [Domain-Joined and Non-Domain-Joined Clients](domain-joined-and-non-domain-joined-clients.md) -##### [How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md) -##### [How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md) -## [Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement](microsoft-application-virtualization-46-service-pack-1-privacy-statement.md) -## [Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement](microsoft-application-virtualization-46-service-pack-2-privacy-statement.md) - diff --git a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md deleted file mode 100644 index 638fd0e895..0000000000 --- a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: About App-V Package Accelerators (App-V 4.6 SP1) -description: About App-V Package Accelerators (App-V 4.6 SP1) -author: manikadhiman -ms.assetid: fc2d2375-8f17-4a6d-b374-771cb947cb8c -ms.reviewer: -manager: dansimp -ms.author: v-madhi -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V Package Accelerators (App-V 4.6 SP1) - - -You can use App-V Package Accelerators to automatically sequence large, complex applications. Additionally, when you apply an App-V Package Accelerator, you are not always required to manually install an application to create the virtual application package. - -**Note**   -In some cases, you are prompted to install an application locally to the computer running the App-V Sequencer before you can use the Package Accelerator. If you have to install an application, you must install the application to the application’s default location. This installation is not monitored by App-V Sequencer. When the App-V Package Accelerator is created, the author of the Package Accelerator determines whether to install an application locally is required. - - - -App-V Sequencer extracts the required files from the App-V Package Accelerator and associated installation media to create a virtual package without having to monitor the installation of the application. - -**Important**   -Disclaimer: The Microsoft Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer. - - - -App-V Package Accelerators and project templates differ from each other. Package Accelerators are application-specific. Project templates enable users to save commonly used settings specific to an organization and apply them to multiple applications. You can also create project templates at the command prompt, while in contrast, you must use the App-V Sequencer console to create Package Accelerators. Additionally, creating a package by using a Package Accelerator and applying a project template is not supported. - -## Sharing App-V Package Accelerators - - -This section provides best practice information about how to share Package Accelerators. If you plan to share Package Accelerators, information such as computer names, user account information, and information about the associated applications might be included in the Package Accelerators.The following list describes methods you should consider when creating Package Accelerators: - -- **User name**. When you log on to the computer running App-V Sequencer, you should use a generic user account, such as the built-in **administrator** account for administering the computer / domain. You should not use an account that is based on an existing user name. - -- **Computer Name**. Specify a general, non-identifying name for the computer running the Sequencer. - -- **Server URL**. In the Sequencer console, on the **Deployment** tab, use the default settings for the server URL configuration information. - -- **Applications**. If you do not want to share the list of applications that were installed on the computer running the Sequencer when you created the Package Accelerator, you must delete the **appv\_manifest.xml** file. This file is located in the package root directory of the virtual application package. - -You should also review any settings or configuration files associated with the virtual application package to ensure the applications do not contain any personal information. - -## Securing App-V Package Accelerators - - -Always save App-V Package Accelerators and any associated installation media in a secure location on the network to protect the App-V Package Accelerators and the installation files from being tampered with or becoming corrupted. Because Package Accelerators can also contain password and user-specific information, you must save App-V Package Accelerators in a secure location, and you must digitally sign the Package Accelerator after you create it so that the publisher can be verified when the Package Accelerator is applied. For more information about digital signatures, see [Application Guidelines on Digital Signature Practices for Common Criteria Security](https://go.microsoft.com/fwlink/?LinkId=204705) (https://go.microsoft.com/fwlink/?LinkId=204705). - -## Related topics - - -[How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md) - -[How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-application-licensing.md b/mdop/appv-v4/about-application-licensing.md deleted file mode 100644 index 039444d39d..0000000000 --- a/mdop/appv-v4/about-application-licensing.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: About Application Licensing -description: About Application Licensing -author: dansimp -ms.assetid: 6b487641-1627-4e91-b829-04f001008176 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Application Licensing - - -You can manage application licenses directly from the Application Virtualization Server Management Console. - -## License Types - - -The System Center Application Virtualization System currently supports the following license types: - -- **Unlimited License**—Allows access to the application by any number of simultaneous users. This method of licensing is appropriate when you want to associate an enterprise-wide license with an application. - -- **Concurrent License**—Enables you to define the maximum number of concurrent users who are allowed to use the application. - -- **Named License**—Enables you to assign a license to an individual user. A named license can be used to ensure that a particular user will always be able to run the application. - -You can combine concurrent and named licenses for the same application. - -Licensing is disabled by default, but you can enable it from the **Provider Pipeline** tab of the **Provider Properties** dialog. For details about enabling and disabling licensing, see [How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md). - -## Provider Policies - - -Provider policies were developed for the Application Service Provider (ASP) model. In this model, a single ASP can host a single Application Virtualization System for multiple clients, where each client needs to remain isolated. Clients might have dramatically different requirements—for example, one client might require authentication while another does not. You can use provider policies to associate permissions with clients so that only the approved users can access each virtual application or virtual application package. - -For the enterprise customer, you can use this feature when you have strict licensing requirements for one or more applications. Under this situation, the licensing component is disabled on the **Provider Pipeline** tab of the **Provider Properties** dialog. - -The **Provider Pipeline** tab also has check boxes to enable authentication, authorization (**Enforce Access Permission Settings**), and metering (**Log Usage Information**). If your configuration has special requirements, you can write your own pipeline components and add them to the system by clicking the **Advanced** button. - -## Account Authorities - - -The account authority is the domain in which the Application Virtualization Server is installed. As you proceed through the server installation, you are prompted to supply a domain name; the domain in which the computer is installed is detected and used by default. When users attempt to log in to the system, they are prompted for their credentials before they can access that domain. - -The Application Virtualization System supports multiple domains. You can grant application access to user groups in other domains if a trust relationship is established between domains. Users must supply credentials that are recognized by each domain. - -In the Application Virtualization Server Management Console, you can change the primary domain (account authority) and the credentials that are used to access it. - -## Authentication - - -Authentication is the mechanism used to confirm a user's identity. Any user with a recognized user name and password has access. - -In the Application Virtualization System, you can enable or disable authentication through a check box on the **Provider Pipeline** tab. By default, Windows Authentication is enabled. - -## Authorization - - -Authorization is the process used to confirm a user’s identity. After confirming the user's identity, the system determines whether the user was granted access to the system and to which applications the user was granted access. The Application Virtualization Server Management Console has an **Enforce Access Permission Settings** check box on the **Provider Pipeline** tab to enable or disable authorization. - -In the Application Virtualization System, access is granted to a user group only, not to individual users. - -## Related topics - - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md) - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-application-virtualization-applications.md b/mdop/appv-v4/about-application-virtualization-applications.md deleted file mode 100644 index 81f4351171..0000000000 --- a/mdop/appv-v4/about-application-virtualization-applications.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: About Application Virtualization Applications -description: About Application Virtualization Applications -author: dansimp -ms.assetid: 3bf833b7-d172-4eef-a9e8-4b4f0c7eb15b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Application Virtualization Applications - - -In Application Virtualization, an *application* is an executable program, such as Microsoft Visio, that is streamed to the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) from an Application Virtualization Management Server. Before an application can be streamed to a client, the application must be prepared for streaming by processing it with the Application Virtualization Sequencer. - -## Managing Applications - - -You must add applications to the system before you can make the applications available to users. The most common method for adding applications to the system is to import them. To access this feature, right-click the **Applications** node in the Application Virtualization Server Management Console and choose **Import Applications**. - -You can import more than one Open Software Descriptor (OSD) file at the same time, or you can import a Sequencer Project file (SPRJ) that can contain multiple OSD files. This functionality enables you to configure related applications similarly. - -You can also use the following features to help you manage your applications: - -- **Application Groups**—Enables you to create logical groups of applications for simplified management. When changes are made to a group (for example, access permissions), the changes are applied to all applications in the group. Applications in a group can come from different packages. - -- **Multi Select**—Enables you to select multiple applications at once by holding the CTRL key when you click an application to modify the application properties. However, if you want to maintain a relationship between the applications, you should create an application group to hold the applications. - -- **Cross System Copy**—Enables you to copy applications from one environment to another environment that is running the same version of App-V in one step. For example, you might have a user acceptance test environment where you initially deploy and configure applications. After you finish your testing phase, you might want to replicate the same set of applications (including permissions) to the production environment. - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-application-virtualization-packages.md b/mdop/appv-v4/about-application-virtualization-packages.md deleted file mode 100644 index 63e1915d67..0000000000 --- a/mdop/appv-v4/about-application-virtualization-packages.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: About Application Virtualization Packages -description: About Application Virtualization Packages -author: dansimp -ms.assetid: 69bd35c1-7af3-43db-931b-3074780aa926 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Application Virtualization Packages - - -In Application Virtualization, a *package* is the output of the sequencing process. You use packages when you first deploy applications on your servers and when you upgrade applications with a new version. Packages enable you to control virtual application versions on your Application Virtualization Management Servers. A single package can contain one or more applications. Each application package contains a set of files as a self-contained unit. - -## Managing Packages - - -After the Sequencer creates a package of one or more applications as part of its process, you can copy the Sequencer-generated files to a Application Virtualization Management Server and make them available for streaming. - -Available packages appear under the **Packages** container in the left pane of the Application Virtualization Management Console. When you import an application with a Sequencer Project (SPRJ) file or an Open Software Descriptor (OSD) file, a related entry appears in the **Packages** container. From the Application Virtualization Server Management Console, you can then deploy, upgrade, or delete packages and versions of them. - -Each virtual application has an associated package. This package includes the following files: - -- SFT—The file that streams the application to clients. - -- OSD—The Open Software Descriptor file contains the information needed to find and launch the application. - -- ICO—The icon file that visually represents the application in user interfaces and shortcuts. - -- SPRJ—The Sequencer Project file. - -When you import the SPRJ file, all sequenced applications are available for deployment, by default, but the applications are not enabled for streaming. You can choose to stream all or some of the applications in the package. For example, if you sequenced and imported Microsoft Office, you can choose not to deploy some applications, such as the Save My Settings Wizard. In this case, right-click each application you want to deploy, choose **Properties**, and make sure that the **Enabled** box is cleared (blank). Only the applications with the **Enabled** box selected will stream to client computers. - -After you resequence a package and produce a new SFT file for streaming, you can upgrade the old package quickly and easily through the Application Virtualization Server Management Console. - -The only operational scenario that requires you to use the **Packages** node is when you introduce a new version (SFT file) for the package. Whenever you import applications, assign access and licenses to applications, and so on, the Application Virtualization System tracks this information at the package level. This means that when you authorize a user to use an application, you are giving the user permission to run any application in the same package. - -### Package Version - -A package version is represented by a specific SFT file. When you upgrade a package (apply an update to an application or add an application to a package), you generate a new SFT file. Each time you create a new SFT file, you are creating a new package version. - -When you import applications through the Application Virtualization Server Management Console, the software automatically creates a package and a package version if they do not already exist. - -## Related topics - - -[About Application Virtualization Applications](about-application-virtualization-applications.md) - -[About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-application-virtualization-servers.md b/mdop/appv-v4/about-application-virtualization-servers.md deleted file mode 100644 index 6078a1f5cb..0000000000 --- a/mdop/appv-v4/about-application-virtualization-servers.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: About Application Virtualization Servers -description: About Application Virtualization Servers -author: dansimp -ms.assetid: 60a45509-2112-44ca-8e28-c73b0c2ff85e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Application Virtualization Servers - - -Application Virtualization Management Servers, also called *application publishing servers*, control access to the applications that are processed to run in a virtual environment. Virtual applications are stored on the Application Virtualization Management Servers. When a virtual application is called for by the client, the application package is streamed to the client from the Application Virtualization Management Servers. - -**Note**   -You can also stream applications to clients from Application Virtualization Streaming Servers. Streaming Servers do not offer some of the services that are available from the Management Servers, such as publishing, management, and reporting. - -You can stream applications to the client directly from a file or disk. Some application virtualization deployment scenarios, which are characterized by low or unreliable connectivity or where bandwidth is limited, are ideally suited for streaming from file or disk. - - - -One or more Application Virtualization Management Servers that share a single data store make up an *Application Virtualization system*. - -## Related topics - - -[Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) - -[How to Refresh Virtual Applications from the Desktop Notification Area](how-to-refresh-virtual-applications-from-the-desktop-notification-area.md) - -[How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md deleted file mode 100644 index 2379da3dff..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.5 SP1 -description: About Microsoft Application Virtualization 4.5 SP1 -author: dansimp -ms.assetid: f5dcff12-5956-41ef-bc36-b59200f90807 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About Microsoft Application Virtualization 4.5 SP1 - - -This service pack contains the following changes: - -- Support for Windows 7 and Windows Server 2008 R2: App-V 4.5 SP1 provides support for Windows 7 and Windows Server 2008 R2, including support for Windows 7 features such as the taskbar, AppLocker, BranchCache, and BitLocker To Go.  Windows Server 2008 R2 support applies only to Application Virtualization Server. For more information about AppLocker support in Windows 7, see [Windows AppLocker](https://go.microsoft.com/fwlink/?LinkID=156732) (https://go.microsoft.com/fwlink/?LinkID=156732). - -- Support for third-party Kerberos realms: App-V 4.5 SP1 provides support for environments that have a trust relationship and mapped user accounts between a Windows domain and an MIT Kerberos realm, which is a scenario commonly used at many universities. For information about how to enable this support, see [How to Configure the Client for MIT Kerberos Realm Support](https://go.microsoft.com/fwlink/?LinkId=166004) (https://go.microsoft.com/fwlink/?LinkId=166004). - -- Improved support for application publishing and streaming through HTTP/HTTPS: App-V 4.5 SP1 provides support for application publishing and streaming through the HTTP/HTTPS protocols for Windows XP Home Edition, Windows Vista Home Basic, and Windows 7 Home Basic. - -- Customer Feedback and Hotfix Rollup: App-V 4.5 SP1 also includes a rollup of fixes to address issues found after the Microsoft Application Virtualization (App-V) 4.5 CU1 release. The updates result from a combination of known issues and customer feedback from our internal teams, partners, and customers who are using App-V 4.5. For a full list of the updates, see [article 976338](https://go.microsoft.com/fwlink/?LinkId=167121) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=167121). - -## In This Section - - -[Microsoft Application Virtualization Management System Release Notes 4.5 SP1](microsoft-application-virtualization-management-system-release-notes-45-sp1.md) -Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.5 SP1. - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md deleted file mode 100644 index 80134f7a39..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.5 SP2 -description: About Microsoft Application Virtualization 4.5 SP2 -author: dansimp -ms.assetid: c498adbe-e331-42c8-99fe-29623fae2345 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About Microsoft Application Virtualization 4.5 SP2 - - -This service pack contains the following changes: - -- Support for Office 2010: Microsoft Application Virtualization (App-V) 4.5 SP2 now supports the virtualization of Microsoft Office 2010. For prescriptive guidance for sequencing Office 2010 with App-V 4.5 SP2, see [Prescriptive guidance for sequencing Office 2010 in Microsoft App-V 4.6](https://go.microsoft.com/fwlink/?LinkId=191539) (https://go.microsoft.com/fwlink/?LinkId=191539). - -- Support for Database Mirroring: App-V 4.5 SP2 now supports Microsoft SQL Server Database Mirroring. For more information about configuring database mirroring in your App-V environment, see [How to Configure Microsoft SQL Server Mirroring Support for App-V](https://go.microsoft.com/fwlink/?LinkId=190880) (https://go.microsoft.com/fwlink/?LinkId=190880). - -- Customer Feedback and Hotfix Rollup: App-V 4.5 SP2 also includes a rollup of fixes to address issues found after the App-V  4.5 SP1 release. The updates address a combination of known issues and customer feedback from Microsoft internal teams, partners, and customers who are using App-V 4.5. For a full list of the updates, see article 980847 in the Microsoft Knowledge Base (KB) at [Description of Microsoft Application Virtualization 4.5 Service Pack 2](https://go.microsoft.com/fwlink/?LinkId=191540) (https://go.microsoft.com/fwlink/?LinkId=191540). - -## In This Section - - -[App-V 4.5 SP2 Release Notes](app-v-45-sp2-release-notes.md) -Provides the most up-to-date information about known issues with App-V 4.5 SP2. - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45.md b/mdop/appv-v4/about-microsoft-application-virtualization-45.md deleted file mode 100644 index 40b58ca9d6..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.5 -description: About Microsoft Application Virtualization 4.5 -author: dansimp -ms.assetid: 39f45a6f-ac55-4fd7-8a83-865e1a7034f8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Microsoft Application Virtualization 4.5 - - -Formerly known as SoftGrid Application Virtualization, Microsoft Application Virtualization (App-V) 4.5 is the first Microsoft-branded release of the product. It includes new capabilities that make it easy for enterprise IT organizations to support large-scale, global application virtualization implementations. - -- Dynamic Virtualization: App-V 4.5 provides the flexibility to control virtual application interaction. Administrators who want to consolidate virtual environments and enable faster, easier administration, can use the product’s Dynamic Suite Composition, which sequences and manages packages for middleware applications separately from the main application. It shrinks potential package size by eliminating redundant packaging of middleware. This lets multiple Web applications communicate with the same single instance of a virtualized application of, for example, Microsoft .NET Framework or Sun Java Runtime Environment (JRE). Updates for the common virtual middleware are simplified and one virtual application is updated instead of several. This “many-to-one” capability greatly reduces the cost of updates. It also makes it easier to deploy and manage applications that use multiple plug-ins and add-ins, and improves management of plug-in distribution to different user groups. - -- Extended Scalability: Choose among three flexible deployment modes: - - 1. Application Virtualization Management Server, which ships as part of the Microsoft Desktop Optimization Pack and Microsoft Application Virtualization for Remote Desktop Services packages, enables dynamic streaming including package and active upgrades, and requires Microsoft Active Directory Domain Services and Microsoft SQL Server. - - 2. Application Virtualization Streaming Server, a lightweight version which also ships as part of the Microsoft Desktop Optimization Pack and Microsoft Application Virtualization for Remote Desktop Services packages, offers application streaming including package and active upgrades without the Active Directory Domain Services and database overheads, and enables administrators to deploy to existing servers or add streaming to Electronic Software Delivery (ESD) systems. - - 3. Standalone mode enables virtual applications to run without streaming and is interoperable with Microsoft Endpoint Configuration Manager and third-party ESD systems. - -- Globalization: The product is localized across 11 languages, includes support for foreign language applications that use special characters, and supports foreign language Active Directory and servers and runtime locale detection. - -- Microsoft Security Standards: Microsoft Application Virtualization (App-V) 4.5 complies with Microsoft security standards including Trustworthy Computing, Secure Windows Initiative and Security Development Lifecycle. It includes support for Internet-facing scenarios and provides Secure by Default configuration out of the box. - -## In This Section - - -[Microsoft Application Virtualization Management System Release Notes](microsoft-application-virtualization-management-system-release-notes.md) -Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.5. - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md deleted file mode 100644 index f2d49596f4..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.6 SP1 -description: About Microsoft Application Virtualization 4.6 SP1 -author: dansimp -ms.assetid: 20917eb6-c998-43f8-aefa-307eb322dc8d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Microsoft Application Virtualization 4.6 SP1 - - -Microsoft Application Virtualization (App-V) 4.6 SP1 provides the following enhancements and new features: - -- Improved App-V sequencer – the App-V 4.6 SP1 sequencer has been updated to help improve the sequencing process. The enhancements include a more predictable packaging experience, and help at each step of the sequencing process. Click any of the following links for more information about the new version of the App-V sequencer. - - - App-V Package Accelerators can be used to automatically sequence large, complex applications. Additionally, when you apply an App-V Package Accelerator, you are not always required to manually install an application to create the virtual application package. For more information about App-V package accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - - - Enhanced support for sequencing different types of applications. For more information about the different types of applications, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - - - Enhanced support for using App-V project templates. For more information about App-V project templates, see [How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md). - - - Step-by-step help during sequencing. For an example of the new step-by-step see [Type of Application Page (Learn More)](type-of-application-page--learn-more-.md). - - - Enhanced reporting to help identify sequencing issues. For an example of the new reporting, see [Files Excluded Page Dialog Box (App-V 4.6 SP1)](files-excluded-page-dialog-box--app-v-46-sp1-.md). - -- Support for using a read-only cache on RDS - App-V 4.6 SP1 now supports using a shared, read-only cache in both VDI and RDS environments. For more information about sharing a read-only cache on RDS, see [How to Configure a Read-only Cache on the App-V Client (RDS)](how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md). - -- Support for sequencing the Microsoft .NET Framework 4 - App-V 4.6 SP1 now supports sequencing the Microsoft .NET Framework 4. - -- Customer Feedback and Hotfix Rollup – App-V 4.6 SP1 also includes a rollup up of fixes to address issues found since the App-V 4.6 release. - -## In This Section - - -[App-V 4.6 SP1 Release Notes](app-v-46-sp1-release-notes.md) -Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.6 SP1. - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md deleted file mode 100644 index ece900187a..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.6 SP2 -description: About Microsoft Application Virtualization 4.6 SP2 -author: dansimp -ms.assetid: 1429e314-9c38-472b-8687-3bed6cf0015c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About Microsoft Application Virtualization 4.6 SP2 - - -Microsoft Application Virtualization (App-V) 4.6 SP2 provides several enhancements and new features, which are described in this topic. - -**Caution**   -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -**Support for Windows 8 and Windows Server 2012** - -App-V 4.6 SP2 adds support for Windows 8 and Windows Server 2012 Remote Desktop Services. - -**Support for coexistence with App-V 5.0 client** - -App-V 4.6 SP2 provides support for coexistence with the Microsoft Application Virtualization 5.0 client. Review the App-V 5.0 documentation for instructions on how to configure the App-V 5.0 client for coexistence with the App-V 4.6 SP2 client. For more information about App-V 5.0, see [Application Virtualization 5](https://go.microsoft.com/fwlink/?LinkId=267599) on TechNet. - -**Ability to virtualize Adobe Reader X with Protected Mode** - -You can virtualize Adobe Reader X with its Protected Mode feature turned on by using the following procedures. Previously you had to disable Protected Mode in order to virtualize Adobe Reader X. - -Before launching the App-V Sequencer, create the following registry value under HKEY\_LOCAL\_MACHINE\\SOFTWARE \\Microsoft\\SoftGrid\\4.5\\SystemGuard\\Overrides: - - ------ - - - - - - - - - - - - - - -

    Name

    Type

    Data

    Description

    EnableVFSPassthrough

    DWORD

    1

    Set this value to 1 in order to start Adobe Reader X in Protected Mode during the launch phase.

    - - - -**Note**   -On a computer running a 64-bit operating system, create the registry value under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\Overrides. - - - -For each OSD-file in your Adobe Reader X package, add the following items under the <POLICIES> element: - -`TRUE` - -`TRUE` - -`TRUE` - -**New Sequencer command-line parameter** - -When you create a Package Accelerator (PA) through the Sequencer GUI, you can select an RTF or TXT file that provides packaging and deployment guidance to the administrators who will apply the Package Accelerator. This functionality is now available using the Sequencer CLI. - -`/ACCELERATORDESCRIPTIONFILE:PathToDescriptionFile` - -Specify a path to an RTF or TXT file that provides packaging and deployment guidance when creating a Package Accelerator. - -**Microsoft Application Error Reporting no longer needs to be installed** - -When you are installing the App-V 4.6 SP2 client by using setup.msi, you no longer need to install Microsoft Application Error Reporting (dw20shared.msi). App-V 4.6 SP2 now uses Microsoft Error Reporting. For more information, see [How to Install the App-V Client by Using Setup.msi](https://go.microsoft.com/fwlink/?LinkId=267237). - -**Customer feedback and hotfix rollup** - -App-V 4.6 SP2 includes a rollup of fixes to address issues found since the App-V 4.6 SP1 release. App-V 4.6 SP2 contains the latest fixes up to and including Microsoft Application Virtualization 4.6 SP1 Hotfix 6. - -## In This Section - - -[App-V 4.6 SP2 Release Notes](https://go.microsoft.com/fwlink/?LinkId=267600) -Provides the most up-to-date information about known issues with App-V 4.6 SP2. - - - - - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md deleted file mode 100644 index ef4f01c277..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.6 SP3 -description: About Microsoft Application Virtualization 4.6 SP3 -author: dansimp -ms.assetid: a6374fb0-1dfa-41f7-9a6a-3d2688492a8b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About Microsoft Application Virtualization 4.6 SP3 - - -Microsoft Application Virtualization (App-V) 4.6 SP3 provides the following enhancements and new features, which are described in this topic. - -## Support for Windows Server 2012 R2 and Windows 8.1 - - -App-V 4.6 SP3 includes support for Windows Server 2012 R2 and Windows 8.1 - -## How to Get MDOP Technologies - - -App-V is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[App-V 4.6 SP3 Release Notes](app-v-46-sp3-release-notes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46.md b/mdop/appv-v4/about-microsoft-application-virtualization-46.md deleted file mode 100644 index 4e2161b45f..0000000000 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: About Microsoft Application Virtualization 4.6 -description: About Microsoft Application Virtualization 4.6 -author: dansimp -ms.assetid: 34150f34-ee74-45a6-957e-9ea6c5a497de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Microsoft Application Virtualization 4.6 - - -Microsoft Application Virtualization (App-V) 4.6 provides the following enhancements and new features for the App-V Desktop Client, Client for Remote Desktop Services and App-V Sequencer: - -- Support for 64-bit applications—provides the ability to sequence and run 32-bit and 64-bit applications on 64-bit versions of Windows 7, Windows Vista, Windows XP, Windows Server 2008, Windows Server 2008 R2, Windows Server 2003 and Windows Server 2003 R2. For more information about supported operating systems, see [Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md). - -- Support for Windows 7 and Windows Server 2008 R2—provides support for Windows 7 and Windows Server 2008 R2, including support for Windows 7 features such as the taskbar, Jump Lists, AppLocker, BranchCache, and BitLocker To Go. - -- Expands globalization and localization—provides support for 12 additional languages. - -- Support for Virtual Desktop Infrastructure (VDI) systems—provides the capability for the read-only shared cache to help optimize server disk storage in VDI scenarios. - -- Improved sequencing experience—provides improvements to the sequencing wizard and support for sequencing 32-bit and 64-bit applications. - -**Note**   -The App-V Management Server and Streaming Server have not been updated to version 4.6. Until they are updated, use App-V Management Server and Streaming Server 4.5 with the most recent service pack. - - - -## In This Section - - -[App-V 4.6 Release Notes](app-v-46-release-notes.md) -Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.6. - - - - - - - - - diff --git a/mdop/appv-v4/about-publishing.md b/mdop/appv-v4/about-publishing.md deleted file mode 100644 index 0aab27b334..0000000000 --- a/mdop/appv-v4/about-publishing.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: About Publishing -description: About Publishing -author: dansimp -ms.assetid: 295074d7-123f-4740-b938-e4a371ee72fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Publishing - - -You can centrally manage publishing applications to the Application Virtualization Client from the Application Virtualization Server Management Console. For example, you can assign access to applications and define when and how often the Application Virtualization Desktop Client and Client for Remote Desktop Services (formerly Terminal Services) need to refresh that information. You can set the clients to refresh this information on a set schedule or every time the user logs in to the client. Also, you can use the console's application publishing functionality to enable users to see which applications are published (or available) to the client. - -**Note**   -Before the client can refresh the publishing information, the client must know about the Application Virtualization Management Server. You configure the client with the necessary information about the server when you install the client. - - - -When a client contacts the server for application publishing information, the server provides the client with the list of applications that the user has permission to access and the location of the corresponding Open Software Descriptor (OSD) files. The server also provides the relevant information about icons, file type associations, and shortcuts. - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[About Application Virtualization Applications](about-application-virtualization-applications.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-sequencing-phases.md b/mdop/appv-v4/about-sequencing-phases.md deleted file mode 100644 index e9f821e89a..0000000000 --- a/mdop/appv-v4/about-sequencing-phases.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: About Sequencing Phases -description: About Sequencing Phases -author: dansimp -ms.assetid: c1cb7b6c-204c-48f2-848c-4bd5a3d5ecb6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Sequencing Phases - - -Sequencing is the process by which you create a sequenced application package by using the Microsoft Application Virtualization (App-V) Sequencer. During sequencing, the Sequencer monitors and records all installation and setup processes for an application and creates the following files: ICO, OSD, SFT, and SPRJ. These files contain all the necessary information about an application, and they allow that application to run in a virtual environment. - -The four phases to sequencing an application and creating a virtual application package are installation, launch, customization, and save. The following list provides information about each of the phases: - -1. **Installation phase**—During the installation phase, you specify the package name and an optional associated comment that will be associated with the package. You can also configure advanced monitoring options during this phase. Advanced monitoring options include specifying the block size and whether you will install automatic updates during monitoring. The sequencer records all necessary information and configurations required to create a virtual application package and the associated file and registry settings. - - **Important**   - To view the advanced options select **Show Advanced Monitoring Options** on the **Package Information** page. - - - -2. **Launch phase**—During the launch phase, you can specify any required file associations and security descriptors that should be configured with the package. You should open the application as many times as necessary to ensure application functionality and stability. - -3. **Customization phase**—During the customization phase, you can configure your package by using the associated .osd files. You can specify whether any associated scripts should run inside or outside of the virtual environment, specify additional actions that should be performed, specify how associated scripts run (synchronously or asynchronously), and specify any additional scripts that should be run under the user context. - -4. **Save phase**—During the save phase, all required files for the virtual application package are created. The files created are .sprj, .sft, .osd, .ico, .xml manifest, and the Windows installer (.msi) file. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-sharing-package-accelerators-page.md b/mdop/appv-v4/about-sharing-package-accelerators-page.md deleted file mode 100644 index 880688dd13..0000000000 --- a/mdop/appv-v4/about-sharing-package-accelerators-page.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: About Sharing Package Accelerators Page -description: About Sharing Package Accelerators Page -author: dansimp -ms.assetid: 9630cde0-e2c3-476f-8fa1-58b3c9f7d3f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Sharing Package Accelerators Page - - -This following information provides best practice information about how to share Package Accelerators. If you plan to share Package Accelerators files, information such as computer names, user account information, and information about applications included in the transforms might be included in the Package Accelerators file. You should review any settings or configuration files associated with the virtual application package to ensure the applications do not contain any personal information.This page contains the following elements. - -- **Username**. When you log on to the computer running the Microsoft App-V Sequencer, you should use a generic user account, such as the built-in **administrator** account. You should not use an account that is based on an existing user name. - -- **Computer Name**. Specify a general, non-identifying name of the computer running the Sequencer. - -- **Server URL**. In the App-V Sequencer console, on the **Deployment** tab, use the default settings for the server URL configuration information. - -- **Applications**. If you do not want to share the list of applications that were installed on the computer running the Sequencer when you created the Package Accelerator, you must delete the **appv\_manifest.xml** file. This file is located in the package root directory of the virtual application package. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -[About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-application-virtualization-sequencer.md b/mdop/appv-v4/about-the-application-virtualization-sequencer.md deleted file mode 100644 index c51d335407..0000000000 --- a/mdop/appv-v4/about-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: About the Application Virtualization Sequencer -description: About the Application Virtualization Sequencer -author: dansimp -ms.assetid: bee193ca-58bd-40c9-b41a-310435633895 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Application Virtualization Sequencer - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records all installation and setup processes for an application and creates the following files: **ICO**, **OSD**, **SFT**, and **SPRJ**. These files contain all the necessary information about an application so the application can run in a virtual environment on target computers. You can use the Microsoft Application Virtualization (App-V) Sequencer to create virtual applications. After you sequence an application, it can be streamed to target computers, or target computers can run the virtual application by downloading the contents of the virtual application package and running the application locally. - -**Important**   -To run a virtual application package the target computer must be running the appropriate version of the App-V client. - - - -Virtual application packages run on target computers without interacting with the underlying operating system on the target computer because each application runs in a virtual environment and is isolated from other applications that are installed or running on the target computer. This isolation can reduce application conflicts and can help decrease the required amount of application pre-deployment testing. - -## Sequencer Terminology - - -Application Virtualization drive -The application virtualization drive is the default drive (Q:\) on the target computer from which sequenced applications are run. - -ICO file -The icon file on the client desktop which is used to launch a sequenced application. - -Installation directory -The directory used by the sequencer to place installation files during setup. - -Open Software Descriptor (OSD) file -An XML-based file that instructs the App-V client how to retrieve the sequenced application from the App-V streaming server and how to run the sequenced application in the virtual environment. - -Package root directory -The directory on the sequencing computer on which files for the sequenced application package are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed. - -Sequenced application -An application that has been monitored by the sequencer, broken up into primary and secondary feature blocks, streamed to a target computer running the App-V client t, and runs a virtual environment. - -Sequenced application package -The files that comprise a virtual application and allow a virtual application to run. These files are created after sequencing and specifically include **.osd**, **.sft**, **.sprj**, and **.ico** files. - -Sequencing -The process of creating an application package using the App-V Sequencer. In this process, an application is monitored, its shortcuts are configured, and a sequenced application package is created. - -Sequencing computer -The computer used to sequence an application. - -Virtual application -An application packaged by the Sequencer to run in a self-contained, virtual environment. The virtual environment contains the information necessary to run the application on the client without installing the application locally. - -Primary feature block -The minimum content in a virtual application package that is necessary for an application to run on a target computer. The content in the primary feature block is identified during the application phase of sequencing and typically consists of the content for the most used application features. - -## Sequencing Applications - - -There are two methods to create and modify virtual application packages in your environment. The first method is by using the **Sequencing** wizard. The **Sequencing** wizard allows you to create new, or modify existing virtual application packages. For more information about using the **Sequencing** wizard see, [How to Sequence a New Application](how-to-sequence-a-new-application.md). The second method is by using the command-line. The command-line allows you to create new, or modify existing virtual application packages using the command prompt. For more information about using the command line see, [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md). - -The **Sequencing** wizard provides the following functions for creating virtual application packages: - -1. **Package Configuration**: The **Sequencing** Wizard prompts for package configuration information necessary to complete the Open Software Descriptor (OSD) file, which is a required file for starting a sequenced application package. - -2. **Application Installation**: The **Sequencing** Wizard gathers information about an application’s installation and startup configurations. It monitors and records the installation and startup information associated with the application to create the files necessary for a virtual application package. - -3. **Application Startup**: The **Sequencing** Wizard gathers information for compiling and ordering the blocks of code necessary to perform the initial startup of the sequenced application package on the target computer. The compilation of the code block is referred to as the primary feature block. - -## Application Virtualization Sequencer Security Considerations - - -The App-V Sequencer runs all services detected at sequencing time using the Local System account and does not enforce security descriptors on service control requests. If the service was installed using a different user account or if the security descriptors are intended to grant different user groups specific service permissions, consider carefully whether the service should be virtualized. In some cases, you should install the service locally to ensure that the intended service security is preserved. - -**Important**   -You should always save virtual application packages in a secure location. - - - -## Related topics - - -[Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-the-application-virtualization-server-management-console.md b/mdop/appv-v4/about-the-application-virtualization-server-management-console.md deleted file mode 100644 index e3654b07e0..0000000000 --- a/mdop/appv-v4/about-the-application-virtualization-server-management-console.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: About the Application Virtualization Server Management Console -description: About the Application Virtualization Server Management Console -author: dansimp -ms.assetid: 108d0e4b-08fa-47b4-a737-d2c36c2641de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Application Virtualization Server Management Console - - -This section of the Application Virtualization Server Management Help describes some of the concepts you should understand while working with the Application Virtualization Server Management Console. - -## In This Section - - -[About Application Virtualization Applications](about-application-virtualization-applications.md) -Provides an overview of managing applications from the Application Virtualization Server Management Console. - -[About Application Virtualization Packages](about-application-virtualization-packages.md) -Provides an overview of managing packages from the Application Virtualization Server Management Console. - -[About Publishing](about-publishing.md) -Provides an overview of how you can publish applications from the Application Virtualization Server Management Console. - -[About Application Licensing](about-application-licensing.md) -Provides an overview of how you can manage application licensing from the Application Virtualization Server Management Console and the types of licenses available. - -## Reference - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -## Related Sections - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-deployment-tab.md b/mdop/appv-v4/about-the-deployment-tab.md deleted file mode 100644 index 7a0a6c25b4..0000000000 --- a/mdop/appv-v4/about-the-deployment-tab.md +++ /dev/null @@ -1,154 +0,0 @@ ---- -title: About the Deployment Tab -description: About the Deployment Tab -author: dansimp -ms.assetid: 12891798-baa4-45a5-b845-b9505ab95633 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About the Deployment Tab - - -Use the **Deployment** tab in the Application Virtualization Sequencer Console to change the information for an application you are about to sequence. This tab contains the following elements. - -## Server URL - - -Use the **Server URL** controls to specify the virtual application server configuration settings. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ControlDescription

    Protocol

    Enables you to select the protocol that will stream the sequenced application package from a virtual application server to an Application Virtualization Desktop Client. The following protocols are available:

    -
      -
    • RTSP—The default, it specifies that the Real-Time Streaming Protocol controls the exchange of virtualization-enabled applications.

    • -
    • RTSPS—Specifies that the Real-Time Streaming Protocol with Transport Layer Security controls the exchange of a sequenced application package.

    • -
    • File—Specifies that the sequenced application will be streamed from a file share.

    • -
    • HTTPS—Specifies that Secure Hypertext Transport Protocol controls the exchange of a package.

    • -

    Hostname

    Enables you to select the virtual application server or the load balancer in front of a group of virtual application servers that will stream the software package to an Application Virtualization Desktop Client. You must complete this item to create a sequenced application package, but you can change from the default %SFT_SOFTGRIDSERVER% environment variable to the actual hostname or IP address of a virtual application server.

    -
    -Note

    If you choose not to specify a static hostname or IP address, on each Application Virtualization Desktop Client you must set up an environment variable called SFT_SOFTGRIDSERVER. Its value must be the hostname or IP address of the virtual application server or load balancer that is this client's source of applications. You should make this environment variable a system variable rather than a user variable. Any Application Virtualization Desktop Client session that is running on this computer during your assignment of this variable must be closed and then opened so that the resumed session will be aware of its new application source.

    -
    -
    - -

    Port

    Enables you to specify the port on which the virtual application server or the load balancer will listen for an Application Virtualization Desktop Client's request for the package. This information is required to create a package, but you can change it. The default port is 554.

    Path

    Enables you to specify the relative path on the virtual application server where the software package is stored and from which it will be streamed. This information is required to create a package if the SFT file will be stored in a subdirectory of CONTENT; otherwise, this information is not required.

    - - - -## Operating Systems - - -Use the **Operating Systems** controls to specify the application's operating system requirements. If an Application Virtualization Desktop Client cannot support any of the selected operating systems, the application will not start. - - ---- - - - - - - - - - - - - - - - - -
    ControlsDescription

    Available Operating Systems

    Displays a list of operating systems that can support the applications in the package.

    Selected Operating Systems

    Displays a list of selected operating systems that support the applications in the package.

    - - - -## Output Options - - -Use the **Output Options** controls to specify the output options for the application to be installed. - - ---- - - - - - - - - - - - - - - - - - - - - -
    ControlDescription

    Compression Algorithm

    Use to select the method for compressing the SFT file for streaming across a network. Select one of the following compression methods:

    -
      -
    • Compressed—Specifies that the SFT file be compressed in the ZLIB format.

    • -
    • Not Compressed—The default; specifies that the SFT file not be compressed.

    • -

    Enforce Security Descriptors

    Select to enforce security descriptors of the applications in the package after it is deployed to the client.

    Generate Microsoft Windows Installer (MSI) Package

    Select to install or deploy a sequenced application package with the Windows Installer. If you have made any changes using the sequencer the changes will not be included with the Windows Installer file. The Windows Installer file will always be created using the .sft file saved on the hard disk.

    - - - -## Related topics - - -[How to Change Deployment Properties](how-to-change-deployment-properties.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-the-files-tab.md b/mdop/appv-v4/about-the-files-tab.md deleted file mode 100644 index 2281e4a415..0000000000 --- a/mdop/appv-v4/about-the-files-tab.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: About the Files Tab -description: About the Files Tab -author: dansimp -ms.assetid: 3c20e720-4b0f-465b-b7c4-3013dae1c815 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Files Tab - - -The **Files** tab displays the complete list of files that are included in a sequenced application package. The left pane displays, in a standard file browse format, the complete list of files in the package that was created during the application sequencing. These files include the package root directory (the directory you specified during the application installation phase), the Virtual File System (VFS) folder, and the virtual environment files. The right pane displays the file name, file attributes, and the Sequencer attributes. - -## File Name and Short Name - - -**File Name** -The name of the file is in the left pane. The files displayed in the left pane are created during sequencing. - -**Short Name** -This is the name of a file selected in the left pane, written in the 8.3 format naming convention. - -## File Attributes - - -**File Size** -The size of the file in bytes. - -**File Version** -The version of the selected file. - -**Date Created** -The date and time the selected file was created. - -**Date Modified** -The date and time the selected file was last modified. - -**File ID** -The file GUID. - -## Sequencer Attributes - - -**User Data** -Select this attribute to specify that an application must retain the information of an individual user. - -**Application Data** -Select this attribute to specify that an application must retain the general information of a group of users. - -**Override** -When selected, the Application Virtualization Desktop Client overwrites the corresponding file when the sequenced application package is upgraded and streamed to the client. If this check box is not selected, the client determines whether or not to overwrite the selected file. - -## Related topics - - -[How to Modify the Files Included in a Package](how-to-modify-the-files-included-in-a-package.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-osd-tab.md b/mdop/appv-v4/about-the-osd-tab.md deleted file mode 100644 index cd15ddc088..0000000000 --- a/mdop/appv-v4/about-the-osd-tab.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: About the OSD Tab -description: About the OSD Tab -author: dansimp -ms.assetid: 7c78cd3a-91f2-4377-8c62-e52912906197 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the OSD Tab - - -An OSD (Open Software Descriptor) file is produced after sequencing. It provides instructions for how a client is to retrieve and run a sequenced application package. Use the **OSD** tab to display and modify the OSD files in the sequenced application package. - -## Drop-Down List - - -**Drop down** -Displays a list of sequenced applications. Select a sequenced application package to modify the elements of an OSD file. - -## Navigation Pane - - -**Navigation Pane** -Displays a list of elements in the OSD file. - -## Results Pane - - -**Attribute** -Displays one or more attributes of an element. - -**Value** -Displays the value that corresponds to an attribute. - -**Element Text** -Displays an editable comment that corresponds to an element. - -## Related topics - - -[How to Edit an OSD File Using a Text Editor](how-to-edit-an-osd-file-using-a-text-editor.md) - -[How to Edit an OSD File](how-to-edit-an-osd-file.md) - -[OSD File Elements](osd-file-elements.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-properties-tab.md b/mdop/appv-v4/about-the-properties-tab.md deleted file mode 100644 index 49f24affb3..0000000000 --- a/mdop/appv-v4/about-the-properties-tab.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: About the Properties Tab -description: About the Properties Tab -author: dansimp -ms.assetid: a6cf6f51-3778-4c8d-9632-3af4005775d2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Properties Tab - - -Use the **Properties** tab to view basic statistical information about a sequenced application package. The information is automatically generated unless otherwise noted. This tab contains the following elements. - -## Package Information - - -**Package Name** -The single name used for a sequenced application package that might contain one or more applications—for example, Microsoft Office could be used to label a sequenced application package that contains Microsoft Word and Microsoft Excel applications that run in the same virtual environment. - -**Comments** -Displays a short description of the software package that will appear in the Open Software Descriptor (OSD) file ABSTRACT element. This item is optional. - -**Package Version** -The sequenced application package version. - -**Package GUID** -The globally unique identifier (GUID) automatically assigned to the sequenced application package to distinguish it from other sequenced application packages that might be running on the computer to which a sequenced application package is streamed. - -**Package Version GUID** -The sequenced application package version GUID. - -**Root Directory** -The directory on the sequencing computer in which files for the sequenced application package are installed. This directory is also created on the computer to which a sequenced application package will be streamed. It is recommended for backwards compatibility that this be an 8.3 format directory name at the root of the Q drive, such as Q:\\MyApp.1\\. - -**Created** -The date and time the sequenced application package was created. - -**Modified** -The date and time the sequenced application package was last modified. - -**Package Size** -The size of the package in megabytes. - -**Launch Size** -The size in megabytes of the portion of the SFT file that is required to start the application. - -## Sequencing Parameters - - -**Block Size** -Specifies the size of the primary and secondary feature blocks into which the SFT file is divided for streaming across a network. All blocks equal the specified size; however, the last block might be smaller than specified. You will see one of the following values: - -- 4 KB - -- 16 KB - -- 32 KB - -- 64 KB - -**Note**   -After the initial package has been created, the block size value is not changeable. - - - -## Related topics - - -[How to Change Package Properties](how-to-change-package-properties.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-the-sequencer-console.md b/mdop/appv-v4/about-the-sequencer-console.md deleted file mode 100644 index c9ade6aad8..0000000000 --- a/mdop/appv-v4/about-the-sequencer-console.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: About the Sequencer Console -description: About the Sequencer Console -author: dansimp -ms.assetid: 36ecba89-a0f5-4d4d-981c-7f581aa43695 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Sequencer Console - - -Before you start using the Microsoft Application Virtualization (App-V) sequencer, you should be familiar with the following information about the App-V sequencer console. The following sections describe the tools available in the Sequencer console. - -## Application Virtualization Sequencer Console Menu Options - - -The following menu items are available in the App-V Sequencer Console: - -- **File** - Contains various commands to help create, open, modify, and save sequenced applications. - -- **Edit** - Contains various commands for editing existing virtual applications. - -- **View** - Contains various commands for viewing properties of a virtual application. - -- **Tools** - Contains various tools and diagnostics for configuring virtual applications. - -## Application Virtualization Sequencer Console Toolbar Options - - -The following toolbar buttons are available in the App-V Sequencer Console: - -- **New Package** - Click to create a new sequenced application. - -- **Open** - Click to open a sequenced application package in the App-V Sequencer Console. - -- **Open for Upgrade** - Click to open a sequenced application to upgrade or apply an update. - -- **Save** - Click to save a sequenced virtual application. - -- **Sequencing Wizard** - Click to open the Sequencing Wizard. You should use this button to start the Sequencing Wizard if you make any changes on the **General** tab under **Tools** / **Options**. - -## Virtual Application Tabs - - -The following tabs are displayed when you view a virtual application in the App-V Sequencer Console: - -- **Properties** - Displays information about the selected virtual application. You can update the Package Name and Comments associated with the virtual application. - -- **Deployment** - Displays information about how the virtual application will be accessed by target computers. You can configure the virtual application delivery method, and you can configure which operating systems must be running on the target computer. You can also configure the associated output options. If you plan to have clients access a virtual application from a file, use the following format when specifying the path: **File://server/share/path/.sft**. Select **Enforce Security Descriptors** to preserve security associated with the package during an upgrade, or the permissions will be reset during the upgrade. - -- **Change History** - Displays information about updates that have been made to the virtual application. - -- **Files** - Displays the files associated with the selected virtual application. You can make minor revisions to the associated file properties by using the appropriate fields. - -- **Virtual Registry** - Displays the virtual registry associated with the selected virtual application. You can add or delete registry keys by right-clicking the appropriate entry. - -- **Virtual File System** - Displays the virtual file systems associated with the selected virtual application. You can add, delete, or edit file system entries on this tab by right-clicking the appropriate entry and selecting the option. - -- **Virtual Services** - Displays the services associated with the selected virtual application. - -- **OSD** - Displays information about the Open Software Descriptor (OSD) associated with the virtual application. You can update the files associated with the OSD file by right-clicking the appropriate entry and selecting the action that you want. - -## Related topics - - -[Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-virtual-file-system-tab.md b/mdop/appv-v4/about-the-virtual-file-system-tab.md deleted file mode 100644 index c63df76467..0000000000 --- a/mdop/appv-v4/about-the-virtual-file-system-tab.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: About the Virtual File System Tab -description: About the Virtual File System Tab -author: dansimp -ms.assetid: 4d2e344d-3f3b-49fd-bbbd-fa5177e7af50 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About the Virtual File System Tab - - -The virtual file system is created during sequencing. It maps directories and files that are added or modified outside the package root directory. The **Virtual File System** tab displays the entire virtual file system for a sequenced application package. It also allows you to add, edit, and delete file associations. - -For information about the virtual file system and its use, see the section “VFS Installs” of [Advanced Sequencing Topics](https://go.microsoft.com/fwlink/?LinkId=114543), at https://go.microsoft.com/fwlink/?LinkId=114543. - -## Columns - - -**From** -Displays the application's component files in the SFT file as they will be distributed on an Application Virtualization Desktop Client. - -**To** -Displays the application's component files as they have been distributed by the application installer on the Application Virtualization Sequencer. - -## Related topics - - -[How to Modify File-Mapping Information](how-to-modify-file-mapping-information.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-the-virtual-registry-tab.md b/mdop/appv-v4/about-the-virtual-registry-tab.md deleted file mode 100644 index 580a4456c0..0000000000 --- a/mdop/appv-v4/about-the-virtual-registry-tab.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: About the Virtual Registry Tab -description: About the Virtual Registry Tab -author: dansimp -ms.assetid: ca8d837f-8218-4f86-95fd-13a44dccd022 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Virtual Registry Tab - - -A virtual registry is created during sequencing. The **Virtual Registry** tab displays all the registry keys and values that are required for a sequenced application package to run. Use this tab to add, edit, and delete registry keys and registry values. - -You can also choose to ignore the hosting system’s keys by selecting **Override Local Key**, or you can create a merged view of the key from within the virtual environment by selecting **Merge with Local Key**. - -The changes to the virtual registry **Settings** tab affect applications that are part of the specific sequenced application package, but they do not affect the operation of other applications that are streamed to or locally installed on the Application Virtualization Desktop Client. - -**Note**   - Exercise caution when changing virtual registry keys and values. Changing these keys and values might render your sequenced application package inoperable. - - - -The left pane of the **Virtual Registry** tab displays the full list of virtual registries created during the sequencing of an application. - -## Columns - - -**Name** -The name for the entry in the virtual registry. - -**Type** -How the entry stores its data. - -**Data** -The value stored by the entry. - -**Attributes** -Displays the file attributes. - -## Related topics - - -[How to Modify Virtual Registry Key Information](how-to-modify-virtual-registry-key-information.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-the-virtual-services-tab.md b/mdop/appv-v4/about-the-virtual-services-tab.md deleted file mode 100644 index 9da1a5c4f1..0000000000 --- a/mdop/appv-v4/about-the-virtual-services-tab.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: About the Virtual Services Tab -description: About the Virtual Services Tab -author: dansimp -ms.assetid: d31eea1b-9a37-42f1-8d7c-95881716e753 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Virtual Services Tab - - -During sequencing, a list of embedded services are identified and sequenced. Embedded services help an operating system run. The **Virtual Services** tab displays a list of embedded services. It also allows you to edit the properties of the individual services. - -## Columns - - -**Name** -The name of the service. - -**Description** -A description of the service. - -**Startup Type** -Indicates whether virtual services on the client are set to manual or automatic start-up. - -**Logon As** -Indicates the client log-on identity—for example, LocalSystem. - -**Services Type** -Indicates the type of service running on the Client. - -## Related topics - - -[How to Modify Attributes of Embedded Services](how-to-modify-attributes-of-embedded-services.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/about-using-the-sequencer-command-line.md b/mdop/appv-v4/about-using-the-sequencer-command-line.md deleted file mode 100644 index b54eeb6152..0000000000 --- a/mdop/appv-v4/about-using-the-sequencer-command-line.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: About Using the Sequencer Command Line -description: About Using the Sequencer Command Line -author: dansimp -ms.assetid: 0fd5f81b-17f9-4065-bce2-8785e8aac7c7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Using the Sequencer Command Line - - -You can use the command line to create sequenced application packages. Using the command line to create virtual applications is useful in the following scenarios: - -- You need to create a large number of sequenced application packages. - -- You need to create a sequenced application package on a recurring basis. - -**Important**   -Sequencing at the command prompt allows for default sequencing only. If you need to change default sequencing parameters, you must either manually modify a sequenced application package or re-sequence the application. - - - -All subsequent modifications to existing sequenced application packages must be made using the sequencing wizard. - -## Prerequisites - - -To sequence an application by using the command prompt, the following conditions must be met: - -- The application that is about to be sequenced must not require changes or workarounds made to it outside the installer or Windows Installer package. - -- Before sequencing, you must prepare a list of batch files for creating the sequenced application packages. - -- Review For more information about the command line parameters, see [Command-Line Parameters](command-line-parameters.md). - -- Review the errors that might be displayed when creating a sequenced application package by using the command line. For more information, see these errors, see [Command-Line Errors](command-line-errors.md). - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/about-virtual-environments.md b/mdop/appv-v4/about-virtual-environments.md deleted file mode 100644 index 263e550a58..0000000000 --- a/mdop/appv-v4/about-virtual-environments.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: About Virtual Environments -description: About Virtual Environments -author: dansimp -ms.assetid: e03a8c72-56c1-4ae9-aa45-0283c50a154c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Virtual Environments - - -Virtual applications run in virtual environments. Virtual environments enable each application to run on a desktop, laptop, or Remote Desktop Session Host (RD Session Host) server without installation and alteration of the host operating system. Each application carries its own configuration information in the virtual environment. As a result, many applications run side by side with other applications on the same computer without any conflicts. - -Virtual applications run locally, so they run with the full performance, functionality, and access to local services that you would expect from any application installed locally. - -Because each application runs in a virtual environment, the following problems are reduced: - -- Application conflicts—In environments that do not use Application Virtualization, you must thoroughly test every application to ensure that it does not interfere with other installed applications. - -- Regression testing—Because the application does not change the underlying operating system, lengthy regression testing is eliminated. - -- Version incompatibilities—Different versions of the same application can run simultaneously on the same computer. - -- Multiuser access—Applications that do not run in multiuser mode, and therefore cannot run within an RD Session Host, can now do so and function correctly for multiple users on a single RD Session Host. - -- Multitenancy issues—Two instances of the same application that use different configurations can run on the same computer at the same time. - -- Server siloing—The need for many separate server farms is eliminated. - -Virtual environments include a virtual registry for each application. Registry settings created by one application cannot be seen by other applications or utilities such as Regedit. Rather than copying the entire registry, the virtual registry uses an *overlay* method. Items in the client registry can be read by the application as long as a virtual copy of that registry item is not included in the virtual registry. All application writes to the registry are contained in the virtual registry. - -Virtual environments also include a virtual file system and other virtual components, including virtual services and virtual COM. - -## Related topics - - -[Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/add-app.md b/mdop/appv-v4/add-app.md deleted file mode 100644 index be8e8866ee..0000000000 --- a/mdop/appv-v4/add-app.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: ADD APP -description: ADD APP -author: dansimp -ms.assetid: 329fd0c8-a795-49be-b0fd-1367c5b4a34b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# ADD APP - - -Adds an application record. - -`SFTMIME ADD APP:application /OSD osd-pathname [/ICON icon-pathname] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application.

    /OSD <osd-pathname>

    The path or URL for the OSD file.

    /ICON <icon-pathname>

    The path or URL for the icon file.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - - - -**Note**   -The resulting name of the application will be taken from the OSD file and not from the name provided in APP:<application>. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/add-package.md b/mdop/appv-v4/add-package.md deleted file mode 100644 index 80ed132da5..0000000000 --- a/mdop/appv-v4/add-package.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: ADD PACKAGE -description: ADD PACKAGE -author: dansimp -ms.assetid: aa83928d-a234-4395-831e-2a7ef786ff53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# ADD PACKAGE - - -Adds a package record. If the package already exists, this command will update the configuration of the existing package. - -`SFTMIME ADD PACKAGE:package-name /MANIFEST manifest-path [/OVERRIDEURL url [/AUTOLOADONREFRESH] [/AUTOLOADONLOGIN] [/AUTOLOADONLAUNCH] [/AUTOLOADTARGET {NONE|ALL|PREVUSED}] [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    PACKAGE:<package-name>

    User-visible and user-friendly name for the package.

    /MANIFEST <manifest-path>

    The path of the manifest file that lists the applications included in the package and all of their publishing information.

    /OVERRIDEURL <URL>

    The location of the package's SFT file.

    /AUTOLOADONREFRESH

    Background loading is performed after a publishing refresh.

    /AUTOLOADONLOGIN

    Background loading is performed when a user logs in.

    /AUTOLOADONLAUNCH

    Background loading is performed after a user starts an application from the package.

    /AUTOLOADTARGET target

    Indicates which applications from the package will be autoloaded.

    NONE

    No autoloading will be performed, despite the presence of any /AUTOLOADONxxx flags.

    ALL

    If an autoload trigger is enabled, all applications in the package will be loaded into cache whether or not they have been previously started.

    PREVUSED

    If an autoload trigger is enabled, the package will load if any applications in this package have previously been started by a user.

    /GLOBAL

    If present, the package will be available for all users on this computer.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/add-server.md b/mdop/appv-v4/add-server.md deleted file mode 100644 index 546c6c2e3a..0000000000 --- a/mdop/appv-v4/add-server.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: ADD SERVER -description: ADD SERVER -author: dansimp -ms.assetid: 4be2ac2e-a410-4711-9f84-f305393c8fa7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# ADD SERVER - - -Adds a publishing server. - -`SFTMIME ADD SERVER:server-name /HOST hostname /TYPE {HTTP|RTSP} /PATH path [/PORT port] [/REFRESH {ON|OFF}] [/SECURE] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    SERVER:<server-name>

    The display name for the publishing server.

    /HOST <hostname>

    The host name or IP address for the publishing server.

    /TYPE {HTTP|RTSP}

    Indicates whether the publishing server is a Web server ("HTTP") or an Application Virtualization Server ("RTSP").

    /PORT <port>

    The port on which the publishing server listens. Defaults to 80 for normal HTTP servers, 443 for HTTP servers using enhanced security, 554 for normal Application Virtualization Servers, and 322 for servers using enhanced security.

    /PATH <path>

    The path portion of the URL used in a publishing request. If the TYPE parameter is set to RTSP, the path is optional and defaults to "/".

    /REFRESH

    If set to ON, publishing information will be refreshed when the user logs in. Defaults to ON.

    /SECURE

    If present, indicates that a connection with enhanced security should be established to the publishing server.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/add-type.md b/mdop/appv-v4/add-type.md deleted file mode 100644 index cfcbb9e6fb..0000000000 --- a/mdop/appv-v4/add-type.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: ADD TYPE -description: ADD TYPE -author: dansimp -ms.assetid: 8f1d3978-9977-4851-9f46-fee6aefa3535 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# ADD TYPE - - -Adds the specified file type association. - -`SFTMIME ADD TYPE:file-extension /APP application [/ICON icon-pathname] [/DESCRIPTION type-desc] [/CONTENT-TYPE content-type] [/GLOBAL] [/PERCEIVED-TYPE perceived-type] [/PROGID progid] [/CONFIRMOPEN {YES|NO}] [/SHOWEXT {YES|NO}] [/NEWMENU {YES|NO}] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    TYPE:<file-extension>

    The file name extension that will be associated with the application specified.

    /APP <application>

    The name and version (optional) of the application.

    /ICON <icon-pathname>

    The path or URL for the icon file.

    /DESCRIPTION <type-desc>

    The user-friendly name for the file type. Defaults to "EXTENSION File."

    /CONTENT-TYPE <content-type>

    The content type of the file. Defaults to "application/softricity-extension."

    /GLOBAL

    If present, the package will be available for all users on this computer.

    /PERCEIVED-TYPE <perceived-type>

    The perceived type of the file. Defaults to nothing.

    /PROGID <progid>

    The programmatic identifier for the file type. Defaults to App Virt.extension.File.

    /CONFIRMOPEN

    Indicates whether users downloading a file of this type should be asked whether to open or save the file. Defaults to YES.

    /SHOWEXT

    Indicates whether the file's extension should always be shown, even if the user has requested that all extensions be hidden. Defaults to NO.

    /NEWMENU

    Indicates whether an entry should be added to the shell's New menu. Defaults to NO.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/administrators-node.md b/mdop/appv-v4/administrators-node.md deleted file mode 100644 index 633c1da358..0000000000 --- a/mdop/appv-v4/administrators-node.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Administrators Node -description: Administrators Node -author: dansimp -ms.assetid: 5f462a0d-af53-4464-9891-7b712193c7e8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrators Node - - -The **Administrators** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of administrator groups. Right-click the **Administrators** node to display a pop-up menu that contains the following elements. - -**Add Administrator Group** -Displays the **Select Groups** dialog to find and add the desired administrator group. Click **Finish** to add the group. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -[Server Management Console: Administrators Node](server-management-console-administrators-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/administrators-results-pane-columns.md b/mdop/appv-v4/administrators-results-pane-columns.md deleted file mode 100644 index 57de6d3cde..0000000000 --- a/mdop/appv-v4/administrators-results-pane-columns.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Administrators Results Pane Columns -description: Administrators Results Pane Columns -author: dansimp -ms.assetid: 2ac86625-15a8-471a-846b-a42eae37ed72 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrators Results Pane Columns - - -The **Administrators Results** pane in the Application Virtualization Server Management Console displays two columns that are described in the following table. - - ---- - - - - - - - - - - - - - - - - -
    ColumnContents

    Domain

    Displays the name of the domain.

    Group

    Displays the name of the administrators group.

    - -  - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -[Server Management Console: Administrators Node](server-management-console-administrators-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/administrators-results-pane.md b/mdop/appv-v4/administrators-results-pane.md deleted file mode 100644 index 88516a4348..0000000000 --- a/mdop/appv-v4/administrators-results-pane.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Administrators Results Pane -description: Administrators Results Pane -author: dansimp -ms.assetid: 92f4f924-c73b-45d6-8905-26f0f30aa189 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administrators Results Pane - - -The **Administrators Results** pane in the Application Virtualization Server Management Console displays a list of the available administrator groups. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -[Server Management Console: Administrators Node](server-management-console-administrators-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 4eec31af83..0000000000 --- a/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Antivirus Running Dialog Box (App-V 4.6 SP1) -description: Antivirus Running Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: b720e308-8597-4470-a03e-fc36ffef84aa -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Antivirus Running Dialog Box (App-V 4.6 SP1) - - -Antivirus software is running on the computer running the App-V Sequencer. Running antivirus software during the creation of a virtual application package can interfere with the process by accessing required files that must to be added to the virtual application package or by adding extraneous data to the virtual application package. - -Use the following procedure to stop the antivirus software from running during sequencing: - -- On the computer running the App-V Sequencer, you must scan the computer and then stop the antivirus software from running. - - **Important**   - Remember to restart the antivirus software when you have finished sequencing the application. - - - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-45-sp2-release-notes.md b/mdop/appv-v4/app-v-45-sp2-release-notes.md deleted file mode 100644 index ab0e856ca4..0000000000 --- a/mdop/appv-v4/app-v-45-sp2-release-notes.md +++ /dev/null @@ -1,222 +0,0 @@ ---- -title: App-V 4.5 SP2 Release Notes -description: App-V 4.5 SP2 Release Notes -author: dansimp -ms.assetid: 1b3a8a83-4523-4634-9f75-29bc22ca5815 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.5 SP2 Release Notes - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Microsoft Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. These Release Notes contain information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative. - - - -For updated information about known issues, please visit the Microsoft TechNet Library at [App-V 4.5 SP2 Release Notes](https://go.microsoft.com/fwlink/?LinkId=184640) (https://go.microsoft.com/fwlink/?LinkId=184640). - -## About Microsoft Application Virtualization 4.5 Service Pack 2 - - -These Release Notes have been updated to reflect the changes introduced with Microsoft Application Virtualization (App-V) 4.5 Service Pack 2 (SP2). This service pack contains the following changes: - -- Support for Office 2010: App-V 4.5 SP2 now supports the virtualization of Microsoft Office 2010. For prescriptive guidance for sequencing Microsoft Office 2010 with App-V 4.5 SP2, see [Prescriptive guidance for sequencing Office 2010 in Microsoft App-V 4.6](https://go.microsoft.com/fwlink/?LinkId=191539) (https://go.microsoft.com/fwlink/?LinkId=191539). - -- Support for Database Mirroring: App-V 4.5 SP2 now supports Microsoft SQL Server Database Mirroring. For more information about configuring database mirroring in your App-V environment, see [How to Configure Microsoft SQL Server Mirroring Support for App-V](https://go.microsoft.com/fwlink/?LinkId=190880) (https://go.microsoft.com/fwlink/?LinkId=190880). - -- Customer Feedback and Hotfix Rollup: App-V 4.5 SP2 also includes a rollup of fixes to address issues found after the App-V  4.5 SP1 release. The updates address a combination of known issues and customer feedback from Microsoft internal teams, partners, and customers who are using App-V 4.5. For a full list of the updates, see article 980847 in the Microsoft Knowledge Base (KB) at [Description of Microsoft Application Virtualization 4.5 Service Pack 2](https://go.microsoft.com/fwlink/?LinkId=191540) (https://go.microsoft.com/fwlink/?LinkId=191540). - -## About the Product Documentation - - -Comprehensive documentation for Application Virtualization (App-V) is available on Microsoft TechNet in the [Application Virtualization TechCenter Library](https://go.microsoft.com/fwlink/?LinkId=122939) (https://go.microsoft.com/fwlink/?LinkId=122939). The TechNet documentation includes the online Help for the Application Virtualization Sequencer, the Application Virtualization Clients, and the Application Virtualization Server. It also includes the Application Virtualization Planning and Deployment Guide and the Application Virtualization Operations Guide. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, we recommend that you install the latest available security updates for any new software being installed. For more information, see [Microsoft Security](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Provide Feedback - - -You can provide feedback, make a suggestion, or report an issue with the Microsoft Application Virtualization (App-V) Management System through the community forum on the Application Virtualization TechCenter [App-V Documentation Forum](https://go.microsoft.com/fwlink/?LinkId=122917) (https://go.microsoft.com/fwlink/?LinkId=122917). - -You can also send your documentation feedback directly to the App-V documentation team at . - -## Known Issues with Application Virtualization 4.5 SP2 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.5 SP2. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases of the software. - -### Guidance for installing Server Management Console - -If you have to install management software on systems other than the primary Application Virtualization publishing and streaming server, the server installation supports installing the Application Virtualization Management Console and Application Virtualization Management Web service on separate servers from the primary App-V Management Server. To distribute the management components across multiple servers, Kerberos delegation must be enabled on the server where the Application Virtualization Web service is installed. For information about how to enable this support, see [How to Configure the Server to be Trusted for Delegation](https://go.microsoft.com/fwlink/?LinkId=166682) (https://go.microsoft.com/fwlink/?LinkId=166682). - -### Guidance for installing or upgrading clients to App-V 4.5 SP2 by using Setup.msi - -When installing or upgrading your App-V Clients to App-V 4.5 SP2 by using Setup.msi, the prerequisites are not installed automatically. - -WORKAROUND   You must manually install the prerequisites before installing or upgrading the App-V Clients to App-V 4.5 SP2. For detailed procedures about how to install the prerequisites and the App-V Client, see [How to Install the Client by Using the Command Line](https://go.microsoft.com/fwlink/?LinkId=144106) (https://go.microsoft.com/fwlink/?LinkId=144106). - -When this has been completed, install the App-V 4.5 SP2 Clients by using Setup.msi with administrative credentials. This file is available on the App-V 4.5 SP2 release media in the Installers\\Client folder. - -When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 SP2 Desktop Client: - -**msiexec /i dw20shared.msi APPGUID={C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus** - -Alternatively, if you are installing or upgrading to the App-V 4.5 SP2 Client for Remote Desktop Services (formerly Terminal Services), use the following command: - -**msiexec /i dw20shared.msi APPGUID={ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus** - -**Note**   -- The APPGUID parameter references the product code of the App-V Clients that you install or upgrade. The product code is unique for each Setup.msi. You can use the Orca Database Editor or a similar tool to examine Windows Installer files and determine the product code. This step is required for all installations or upgrades to App-V 4.5 SP2. - -- This step is not required if you are upgrading and have previously installed Dw20shared.msi. - - - -### Improving performance when sequencing the .NET Framework - -When sequencing the Microsoft .NET Framework, you might experience reduced system performance because the .NET Framework NGEN service attempts to precompile assemblies as a background task. - -WORKAROUND   When sequencing the .NET Framework, disable the .NET Framework NGEN service (Mscorsvw.exe) after completing the monitoring phase. You must use the **Virtual Services** tab in the App-V Sequencer and change the startup type to **Disabled**. - -### When you uninstall the Microsoft Application Virtualization Client, user settings associated with the user performing the uninstallation are deleted - -When you uninstall the App-V Client, the Windows Installer removes Application Virtualization settings from the current user's profile. If your computer uses roaming profiles, do not use your personal network account to uninstall the client because it will remove settings for your virtual applications on all of your computers. - -WORKAROUND   You must uninstall the App-V Client with an administrative account that is not used for running virtual applications. - -### Edits made on the virtual file system and virtual registry tabs must be saved while running the Sequencing wizard - -If you open a package to perform an upgrade, or if you have already run the Sequencing wizard with a new package and make changes to the package in the virtual file system or virtual registry tabs, those changes are not automatically saved. - -WORKAROUND   Save the changes before re-running the wizard, to ensure that they are reflected inside the wizard’s virtual environment. - -### Command-line Sequencer must be run from an elevated command prompt - -When you use the command-line Sequencer, it does not prompt for elevation. - -WORKAROUND   Run the command-line Sequencer by using an elevated command prompt. - -### Short path variable names in OSD files can cause errors - -If you receive error 450478-1F702339-0000010B "The directory name is invalid" when starting a virtual application on the client, it is possible that the variable in the OSD is set incorrectly. This can happen if the application’s installer sets a short path name during sequencing. - -WORKAROUND   Remove the trailing tilde from any CSIDL variable that exists in the OSD file. - -### Correct syntax for DECODEPATH parameter for command-line Sequencer - -In the command-line Sequencer, when opening a package for upgrade and decoding it to the root of drive Q, the syntax for the *DECODEPATH* parameter should not include a trailing slash. - -WORKAROUND   You can use **Q:** rather than **Q:\\** (omitting the trailing "\\" character). - -### When upgrading APP-V 4.2 packages, you encounter problems caused by Windows Installer files in the Virtual File System - -When upgrading a package from APP-V 4.2, you might experience issues relating to a mismatch of Windows Installer system files that were included by default in APP-V 4.2 and the Windows Installer libraries locally installed on your Sequencing workstation. The following files are located in CSIDL\_SYSTEM\\: - -Cabinet.dll - -Msi.dll - -Msiexec.exe - -Msihnd.dll - -Msimsg.dlll - -WORKAROUND   Delete all of the preceding files from the package. Delete the mappings on the **VFS** tab and the actual files in the CSIDL\_SYSTEM folder in your decode path. - -### On Windows XP, by default, client installation logging is not enabled - -When installing the client, to ensure that any install errors are captured for troubleshooting, you must enable logging by using the command line. - -WORKAROUND   Add the parameter */l\*vx! log.txt* to the command line, as shown in the following example: - -**setup.exe /s /v”/qn /l\*vx! log.txt”** - -**msiexec.exe /i setup.msi /qn /l\*vx! log.txt** - -Alternatively, you can set the registry key to the following value: - -**\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\] "Logging"="voicewarmupx!"** - -### For Kerberos authentication to work, Service Principal Names (SPNs) must be registered for IIS - -When using Internet Information Services (IIS) 6.0 or IIS 7.0 for icon or OSD file retrieval and streaming of packages, to enable Kerberos authentication, the SPNs must be registered as follows: - -- On the IIS server, run the following commands by using the SETSPN.EXE Resource Kit tool. The server fully qualified domain name (FQDN) must be used. - - **Setspn -r SOFTGRID/<Server FQDN>** - - **Setspn -r HTTP/<Server FQDN>** - -For more information, see [Integrated Windows Authentication (IIS 6.0)](https://go.microsoft.com/fwlink/?LinkId=131407) (https://go.microsoft.com/fwlink/?LinkId=131407). - -### .NET compatibility changes - -Microsoft Application Virtualization (App-V) Cumulative Update 1 or later supports sequencing the .NET Framework on Windows XP SP2 or later. Sequencing routines for .NET applications that were written for SoftGrid 4.2 might have to be updated when used with the App-V 4.5 Sequencer. For details and workarounds, see the Application Virtualization TechCenter article at [Support for .NET in Microsoft Application Virtualization 4.5](https://go.microsoft.com/fwlink/?LinkId=123412) (https://go.microsoft.com/fwlink/?LinkId=123412). - -### After client upgrade from App-V 4.2, some applications are not shown - -Check for the following error in the log: "The Application Virtualization Client could not parse the OSD file". The App-V 4.5 Client filters out applications that have an OSD file that contains an empty OS tag (<OS></OS>). - -WORKAROUND   Delete the empty OS tag from the OSD file. - -### The App-V server requires exemptions in its firewall for certain processes - -For the server to stream applications correctly, the server's core processes, including the dispatcher, require access through the firewall. - -WORKAROUND   Set exemptions in the server's firewall for the following processes: Sghwsvr.exe and Sghwdsptr.exe. This applies to the App-V Management Server and App-V Streaming Server. - -### When the server installer is run in silent mode, it does not correctly check for MSXML6 - -The App-V Management Server depends on MSXML6. However, if you run the installer in silent mode—for example, by using the command **msiexec -i setup.msi /qn** on a system where MSXML6 is not already installed—the installer does not detect the missing dependency and installs anyway. Therefore, when clients attempt to refresh publishing information from the App-V Management Server, they will get errors. - -WORKAROUND   Verify that MSXML6 is installed on the system before attempting a silent installation of the App-V Management Server. - -### Error code 000C800 when attempting to connect to the Application Virtualization Management Console - -An Application Virtualization administrator who is not a local administrator on the App-V Management Web Service server receives an error (Error code: 000C800) when attempting to connect to the App-V Management Console, and the Sftmmc.log entry indicates that access to SftMgmt.udl is denied. To successfully connect to the App-V Management Console, an administrator who does not have local administrator rights on the App-V Management Web Service server must have at least Read and Execute permissions to the SftMgmt.udl file. - -Application Virtualization administrators must have Read and Execute permissions to the SftMgmt.UDL file in folder %systemdrive%\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Service. - -### Client installer command-line parameters are ignored when used in conjunction with KEEPCURRENTSETTINGS=1 - -When used in conjunction with KEEPCURRENTSETTINGS=1, the following client installer command-line parameters are ignored: SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, SWIUSERDATA, and REQUIRESECURECONNECTION. - -WORKAROUND   If you have settings you want to retain, use KEEPCURRENTSETTINGS=1, and then set the other parameters after deployment. The App-V ADM Template can be used to set the following client settings: APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, AUTOLOADTARGET, AUTOLOADTRIGGERS, DOTIMEOUTMINUTES, and ALLOWINDEPENDENTFILESTREAMING. You can download the ADM Template from the Microsoft DownLoad Center at [Microsoft Application Virtualization Administrative Template (ADM Template)](https://go.microsoft.com/fwlink/?LinkId=121835) (https://go.microsoft.com/fwlink/?LinkId=121835). - -### Release Notes Copyright Information - -This document is provided "as-is". Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious.  No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. - - - -Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-46-release-notes.md b/mdop/appv-v4/app-v-46-release-notes.md deleted file mode 100644 index 08a8ca5d64..0000000000 --- a/mdop/appv-v4/app-v-46-release-notes.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: App-V 4.6 Release Notes -description: App-V 4.6 Release Notes -author: dansimp -ms.assetid: a3eba129-edac-48bf-a933-3bf43a9873e5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.6 Release Notes - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Microsoft Application Virtualization (App-V) Management System. These Release Notes contain information that you need to successfully install Application Virtualization (App-V) 4.6. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other App-V documentation, the latest change should be considered authoritative. - - - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, it is important to install the latest available security updates for any new software being installed. For more information, see the [Microsoft Security Web site](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with Application Virtualization 4.6 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.6. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases. - -### Load/install error running a Windows Installer file generated by the App-V 4.5 Sequencer - -Running a Windows Installer file generated by the App-V 4.5 Sequencer produces a load/install error when trying to run it on an App-V 4.6 client. You will see the following message: "This package requires Microsoft Application Virtualization Client 4.5 or later". Please use the following workaround. - -WORKAROUND   Open the old package with either the App-V 4.5 SP1 Sequencer or the App-V 4.6 Sequencer and generate a new .msi file for the package. - -**Note**   -Alternatively, at the command prompt, the App-V Sequencer can generate the new .msi file by using the */OPEN* and */MSI* parameters, for example, `SFTSequencer /Open:”package.sprj” /MSI`. For more information, see [How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md). - - - -### Release Notes Copyright Information - -This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious.  No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. - - - -Microsoft, Active Directory, ActiveSync, ActiveX, Excel, SQL Server, Windows, Windows PowerShell, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-46-sp1-release-notes.md b/mdop/appv-v4/app-v-46-sp1-release-notes.md deleted file mode 100644 index dd7fa73a1b..0000000000 --- a/mdop/appv-v4/app-v-46-sp1-release-notes.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: App-V 4.6 SP1 Release Notes -description: App-V 4.6 SP1 Release Notes -author: dansimp -ms.assetid: aeb6784a-864a-4f4e-976b-40c34dcfd8d6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.6 SP1 Release Notes - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Microsoft Application Virtualization (App-V) Management System. These Release Notes contain information that helps you successfully install Application Virtualization (App-V) 4.6 SP1. This document contains information that is not available in the product documentation. If there is a difference between these Release Notes and other App-V documentation, the latest change should be considered authoritative. - - - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, it is important to install the latest available security updates for any new software being installed. For more information, see the [Microsoft Security website](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with Application Virtualization 4.6 SP1 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.6 SP1. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. When it is possible, these issues will be addressed in later releases. - -### Path from SPRT is lost if it does not end in forward slash ( / ) - -When the path in an HREF in a project template does not end with a forward slash (**/**), the generated HREF does not include the path. This occurs when the user manually manipulates the **.sprt** file. If you use the sequencer it always adds the forward slash (**/**) after the path. - -WORKAROUND Make sure that the HREF has a trailing forward slash (**/**). - -### User folder name do not correspond to the package name - -Folders that contain user and global .pkg files no longer include the package name. Previously, the App-V client used to use the package root folder 8.3 short name as part of the folder name. This lets you easily identify it. When you use the App-V 4.6 SP1 sequencer, the package root folder 8.3 short names are now random strings. This makes it difficult to identify the folders that contain the package’s **.pkg** files on the computer that is running the App-V client. - -WORKAROUND Use one of the following methods to more easily identify these package folders: - -1. When you create the package by using the Sequencer, specify a folder name that follows the 8.3 naming convention for the primary application folder. This name will then be used as part of the user folder name as was the case in App-V 4.6. - -2. The .sprj file now contains a tag that displays the string that is used as the beginning of the user folder name. You can use the **SHORTNAME** element of the **PACKAGEROOTFOLDER** element to determine the name. - -### Running App-V 4.6 SP1 on computers that have more than 64 processors - -When you run App-V 4.6 SP1 on computers that have more than 64 processors installed, the App-V client fails. - -WORKAROUND None. This configuration is not supported. You must run App-V 4.6 SP1on computers that have fewer than 64 processors. - -### Application Virtualization 4.6 SP1 update is not offered on all locales that use Microsoft Update - -When you use Microsoft Update, the update for App-V 4.6 SP1 is not available for the following language locales: - -- Kazakh - -- Hindi - -- Serbian-Cyrillic - -WORKAROUND If you are using Microsoft Windows Server Update Services (WSUS) use the English version of the update or download the update from the Microsoft Update Catalog. - -### After expanding the parent package, you cannot sequence a plug-in with side by side components - -When you expand a parent package by using **Tools** / **Expand Package to Local System** in the App-V Sequencer console and you sequence a plug-in with side by side components, an installation error is returned. For example: - -- **HRESULT 0x80073712** - -This is caused when the sequencer writes the side-by-side component to the registry but does not clear the value for the following registry key: - -HKEY\_LOCAL\_MACHINE\\COMPONENTS\\StoreDirty - -WORKAROUND After expanding the parent package on the computer that is running the sequencer, you have to delete the value for the following registry key: - -HKEY\_LOCAL\_MACHINE\\COMPONENTS\\StoreDirty - -After you have deleted the value, sequence the plug-in. - -### Release Notes Copyright Information - -This document is provided “as-is”. Information and views expressed in this document, such as URL and other Internet website references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. - - - -Microsoft, Active Directory, ActiveSync, ActiveX, Excel, SQL Server, Windows, Windows PowerShell, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-46-sp2-release-notes.md b/mdop/appv-v4/app-v-46-sp2-release-notes.md deleted file mode 100644 index 227967a34a..0000000000 --- a/mdop/appv-v4/app-v-46-sp2-release-notes.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: App-V 4.6 SP2 Release Notes -description: App-V 4.6 SP2 Release Notes -author: dansimp -ms.assetid: abb536f0-e187-4c5b-952a-f837abd10ad2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.6 SP2 Release Notes - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Application Virtualization (App-V) 4.6 SP2. - -These release notes contain information that is required to successfully install Application Virtualization 4.6 SP2. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other App-V 4.6 SP2 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For more information about documentation for App-V, see the [Application Virtualization](https://go.microsoft.com/fwlink/?LinkID=232982) page on Microsoft TechNet. - -## Providing feedback - - -We are interested in your feedback on App-V 4.6 SP2. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan future changes for our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with App-V 4.6 SP2 - - -### Short file name support is disabled for non-system physical drives when you sequence - -When you sequence on Windows 8 or Windows Server 2012, support for short file names (8.3) is disabled by default for non-system physical drives. - -The underlying physical drive associated with the primary virtual application directory (for example, “Q:\\appname”) on the sequencing station must provide short file name (8.3) support in order for the App-V 4.6 SP2 Sequencer to generate short file names when creating virtual application packages. Short file name (8.3) support is disabled by default for non-system physical drives on Windows 8 or Windows Server 2012. - -**Workaround:** Enable short file name (8.3) support on non-system physical drives. You can use the following command to enable short file name support on Windows 8 or Windows Server 2012. - -``` syntax -fsutil 8dot3name set : -``` - -For example, use the following command if the drive letter is “Q:”: - -``` syntax -fsutil 8dot3name set Q: 0 -``` - -**Note**   -You do not need to change this setting on the App-V client because the App-V file system properly handles short paths on Windows 8 or Windows Server 2012. - - - -### App-V does not override the default handler for file type or protocol associations on Windows 8 - -If you select a default application by using **Default Programs** in **Control Panel** on Windows 8, App-V will not override the associated file type associations for that application. - -**Workaround:** None. - -### Virtualized Outlook 2010 is not offered as an option for mailto clickable links on Windows 8 - -The mailto shell extension does not offer virtualized Outlook 2010 on Windows 8. For example, if you click a mailto: link from virtualized Outlook 2010 that is running on Windows 8, a new email window is not created. This option works correctly on Windows 7 and earlier versions of the Windows operating system. - -**Workaround:** None. - -### Application Virtualization 4.6 SP2 update is not offered on all locales that use Microsoft Update - -When you use Microsoft Update, the update for App-V 4.6 SP2 is not available for the following language locales: - -- Kazakh - -- Hindi - -- Serbian-Cyrillic - -**Workaround:** If you are using Microsoft Windows Server Update Services (WSUS), use the English version of the update or download the update from the Microsoft Update Catalog. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - -## Related topics - - -[About Microsoft Application Virtualization 4.6 SP2](about-microsoft-application-virtualization-46-sp2.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-46-sp3-release-notes.md b/mdop/appv-v4/app-v-46-sp3-release-notes.md deleted file mode 100644 index d62afda16b..0000000000 --- a/mdop/appv-v4/app-v-46-sp3-release-notes.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: App-V 4.6 SP3 Release Notes -description: App-V 4.6 SP3 Release Notes -author: dansimp -ms.assetid: 206fadeb-59cc-47b4-836f-191ab1c27ff8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 4.6 SP3 Release Notes - - -To search these Release Notes, press CTRL+F. - -Read these Release Notes thoroughly before you install the Microsoft Application Virtualization (App-V) Management System. These Release Notes contain information that helps you successfully install Application Virtualization (App-V) 4.6 SP3. This document contains information that is not available in the product documentation. If there is a difference between these Release Notes and other App-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, it is important to install the latest available security updates for any new software being installed. For more information, see the [Microsoft Security website](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with Application Virtualization 4.6 SP3 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.6 SP3. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. When it is possible, these issues will be addressed in later releases. - -### Unable to open hyperlinks using Internet Explorer 11 on Microsoft Windows 8.1 within the Virtual Environment - -Attempting to open hyperlinks from within a virtual environment will fail on Windows 8.1 using Internet Explorer 11. This is because Internet Explorer 11 now ships with the Enhanced Protection Mode (EPM) enabled by default and this causes App-V to be unable to access required registry keys, files and communication port objects. - -WORKAROUND: Disable EPM in Internet Explorer 11 before opening an App-V package. This will allow you to open Internet Explorer from within the virtual environment. - -## Related topics - - -[About Microsoft Application Virtualization 4.6 SP3](about-microsoft-application-virtualization-46-sp3.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/app-v-application-wmi-class.md b/mdop/appv-v4/app-v-application-wmi-class.md deleted file mode 100644 index 3567a8da0e..0000000000 --- a/mdop/appv-v4/app-v-application-wmi-class.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: App-V Application WMI Class -description: App-V Application WMI Class -author: dansimp -ms.assetid: b79b0d5a-ba57-442f-8bb4-d7154fc056f9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V Application WMI Class - - -In the Application Virtualization (App-V) Client, the **Application** class is a Windows Management Instrumentation (WMI) class that represents all the virtual applications on the client. - -The following syntax is simplified from Managed Object Format (MOF) code. The code includes all the inherited properties. - -## Syntax - - -``` syntax -class Application -{ - string Name; - string Version; - string PackageGUID; - datetime LastLaunchOnSystem; - uint32 GlobalRunningCount; - boolean Loading; - string OriginalOsdPath; - string CachedOsdPath; -}; -``` - -## Requirements - - -## Properties - - -**Name** -Data type: **String** - -Access type: Read-only - -Qualifiers: Key - -The display name of the virtual application. - -**Version** -Data type: **String** - -Access type: Read-only - -Qualifiers: Key - -The version of the virtual application. - -**PackageGUID** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The GUID of the package that the virtual application is associated with. - -**LastLaunchOnSystem** -Data type: **DateTime** - -Access type: Read-only - -Qualifiers: None - -The last date and time that the virtual application was launched. - -**GlobalRunningCount** -Data type: **UInt32** - -Access type: Read-only - -Qualifiers: None - -A count of the running instances of the virtual application that were started directly. - -**Loading** -Data type: **Boolean** - -Access type: Read-only - -Qualifiers: None - -**true** if the virtual application is being started; otherwise **false**. - -**OriginalOsdPath** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The original file path of the OSD file that was registered with the App-V Client. - -**CachedOsdPath** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The file path of the OSD file if the App-V Client has cached the OSD file locally. - -  - -  - - - - - diff --git a/mdop/appv-v4/app-v-client-registry-values-sp1.md b/mdop/appv-v4/app-v-client-registry-values-sp1.md deleted file mode 100644 index 5edc5870e2..0000000000 --- a/mdop/appv-v4/app-v-client-registry-values-sp1.md +++ /dev/null @@ -1,826 +0,0 @@ ---- -title: App-V Client Registry Values -description: App-V Client Registry Values -author: dansimp -ms.assetid: 46af5209-9762-47b9-afdb-9a2947e013f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Client Registry Values - - -The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists all the Application Virtualization (App-V) client registry keys and explains their uses. - -**Important** -On a computer running a 64-bit operating system, the keys and values described in the following sections will be under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client. - - - -## Configuration Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeData (Examples)Description

    ProductName

    String

    Microsoft Application Virtualization Desktop Client

    Do not modify.

    Version

    String

    4.5.0.xxx

    Do not modify.

    Drivers

    String

    Sftfs.sys

    If this key value is present, it contains the name of the driver that caused a stop error the last time the core was starting. After you have fixed the stop error, you must delete this key value so that sftlist can start.

    InstallPath

    String

    Default=C:\Program Files\Microsoft Application Virtualization Client

    The location where the client is installed. Do not modify.

    LogFileName

    String

    Default=CSIDL_COMMON_APPDATA\Microsoft\Application Virtualization Client\sftlog.txt

    The path and name for the client log file.

    -
    -Note

    If you are running an earlier version than App-V 4.6, SP1 and you modify the log file name or location, you must restart the sftlist service for the change to take effect.

    -
    -
    - -
    -

    LogMinSeverity

    DWORD

    Default=4, Informational

    Controls which messages are written to the log. The value indicates a threshold of what is logged—everything less than or equal to that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged.

    -

    Value Range: 0x0 = None, 0x1 = Critical, 0x2 = Error, 0x3 = Warning, 0x4 = Information (Default), 0x5 = Verbose.

    -

    The log level is configurable from the Application Virtualization (App-V) client console and from the command prompt. At a command prompt, the command sftlist.exe /verboselog will increase the log level to verbose. For more information on command-line details see

    -

    https://go.microsoft.com/fwlink/?LinkId=141467https://go.microsoft.com/fwlink/?LinkId=141467

    -

    .

    LogRolloverCount

    DWORD

    Default=4

    Defines the number of backup copies of the log file that are kept when it is reset. The valid range is 0–9999. The default is 4. A value of 0 means no copies will be kept.

    LogMaxSize

    DWORD

    Default=256

    Defines the maximum size in megabytes (MB) that the log file can grow before being reset. The default size is 256 MB. When this size is reached, a log reset will be forced on the next write attempt.

    SystemEventLogLevel

    DWORD

    Default=0x4 (App-V 4.5)

    -

    Default=0x3 (App-V 4.6)

    Indicates the logging level at which log messages are written to the NT event log. The value indicates a threshold of what is logged—that is, everything equal to or less than that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged.

    -

    Value Range

    -

    0x0 = None

    -

    0x1 = Critical

    -

    0x2 = Error

    -

    0x3 = Warning

    -

    0x4 = Information (Default)

    -

    0x5 = Verbose

    AllowIndependentFileStreaming

    DWORD

    Default=0

    Indicates whether streaming from file will be enabled regardless of how the client has been configured with the APPLICATIONSOURCEROOT parameter. If set to FALSE, the transport will not enable streaming from files even if the OSD HREF or the APPLICATIONSOURCEROOT parameter contains a file path.

    -

    0x0=False (default)

    -

    0x1=True

    ApplicationSourceRoot

    String

    rtsps://mainserver:322/prodapps

    -

    https://mainserver:443/prodapps

    -

    file://\uncserver\share\prodapps

    -

    file://\uncserver\share

    Enables an administrator or electronic software distribution (ESD) system to ensure application loading is performed according to the topology management scheme. Use this key value to override the OSD CODEBASE for the HREF element (for example, the source location) for an application. Application Source Root supports URLs and Universal Naming Convention (UNC) path formats.

    -

    The correct format for the URL path is protocol://servername:[port][/path][/], where port and path are optional. If a port is not specified, the default port for the protocol is used. Only the protocol://server:port portion of the OSD URL is replaced.

    -

    The correct format for the UNC path is \computername\sharefolder[folder][], where folder is optional. The computer name can be a fully qualified domain name (FQDN) or an IP address, and sharefolder can be a drive letter. Only the \computername\sharefolder or drive letter portion of the OSD path is replaced.

    OSDSourceRoot

    String

    \computername\sharefolder\resource

    -

    \computername\content

    -

    C:\foldername

    -

    http://computername/productivity/

    -

    https://computername/productivity/

    Enables an administrator to specify a source location for OSD file retrieval for a sequenced application package during publication. Acceptable formats for the OSDSourceRoot include UNC paths and URLs (http or https).

    IconSourceRoot

    String

    \computername\sharefolder\resource

    -

    \computername\content

    -

    C:\foldername

    -

    http://computername/productivity/

    -

    https://computername/productivity/

    Enables an administrator to specify a source location for icon file retrieval for a sequenced application package during publication. Acceptable formats for the IconSourceRoot include UNC paths and URLs (http or https).

    AutoLoadTriggers

    DWORD

    Default=5

    AutoLoad is a client runtime policy configuration parameter that enables the secondary feature block of a virtualized application to be streamed to the client automatically in the background. The AutoLoad triggers are flags to indicate events that initiate auto-loading of applications. AutoLoad implicitly uses background streaming to enable the application to be fully loaded into cache. The primary feature block will be loaded first, and the remaining feature blocks will be loaded in the background to enable foreground operations, such as user interaction with applications, to take place and provide optimal perceived performance.

    -

    Bit mask values:

    -

    (0) Never: No bits are set (value is 0), no auto loading will be performed, because there are no triggers set.

    -

    (1) OnLaunch: Loading starts when a user starts an application.

    -

    (2) OnRefresh: Loading starts when the application is published. This occurs whenever the package record is added or updated—for example, when a publishing refresh occurs.

    -

    (4) OnLogin: Loading starts when a user logs in.

    -

    (5) OnLaunch and OnLogin: Default.

    AutoLoadTarget

    DWORD

    Default=1

    Indicates what will be auto-loaded when any given AutoLoad triggers occur. Bit mask values:

    -

    (0) None: No auto-loading, regardless of what triggers may be set.

    -

    (1) PreviouslyUsed (default): If any AutoLoad trigger is enabled, load only the packages where at least one application in the package has been previously used—that is, started or precached.

    -

    (2) All: If any AutoLoad trigger is enabled, all applications in the package (per package) or all packages (set for client) will be automatically loaded, whether or not they have ever been started.

    RequireAuthorizationIfCached

    DWORD

    Default=1

    Indicates that authorization is always required, whether or not an application is already in cache. Possible values:

    -

    0=False: Always try to connect to the server. If a connection to the server cannot be established, the client still allows the user to launch an application that has previously been loaded into cache.

    -

    1=True (default): Application always must be authorized at startup. For RTSP streamed applications, the user authorization token is sent to the server for authorization. For file-based applications, file ACLs control whether a user may access the application.

    -

    Restart the sftlist service for the change to take effect.

    UserDataDirectory

    String

    %APPDATA%

    Location where the icon cache and user settings are stored.

    GlobalDataDirectory

    String

    C:\Users\Public\Documents

    Directory to use for global App-V data, including caches for OSD files, icon files, shortcut information, and SystemGuard resources such as .ini files.

    AllowCrashes

    DWORD

    0 or 1

    Default=0: A value of 0 means that the client tries to catch internal program exceptions so that other user applications can recover and continue when a crash happens. A value of 1 means that the client allows the internal program exceptions to occur so that they can be captured in a debugger.

    CoreInternalTimeout

    DWORD

    60

    Time-out in seconds for internal IPC requests between core and front-end. Do not modify.

    DefaultSuiteCombineTime

    DWORD

    10

    This value is used to indicate how soon after being started that a program can shut down and not generate any error messages when another application in the same suite is running.

    SerializedSuiteLaunchTimeout

    DWORD

    Default=60000

    Defines how long in milliseconds the client will wait as it tries to serialize program starts in the same suite. If the client times out, the program start will continue but it will not be serialized.

    ScriptTimeout

    DWORD

    300

    Default time-out in seconds for scripts in OSD file if WAIT=TRUE. You can specify per-script time-outs with TIMEOUT instead of WAIT. A value of 0 means no wait, and 0xFFFFFFFF means wait forever.

    LaunchRecordLogPath

    String

    If, under either HKLM or HKCU, this value contains a valid path to a log file, SFTTray will write to this log when programs start, shut down, fail to launch, and enter or exit disconnected mode.

    LaunchRecordMask

    DWORD

    0x1A (26) log launch errors and disconnected mode entry and exit activity.

    -

    0x1F (31) logs everything.

    -

    0x0 (0) logs nothing.

    Specifies which of the five events are logged (bitmask values):

    -

    1 for program starts

    -

    2 for launch failure errors

    -

    4 for shutdowns

    -

    8 for entering disconnected mode

    -

    16 for exiting disconnected mode to reconnect to a server

    -

    Add any combination of those numbers to turn on the respective messages. Defaults to 0x1F if not in registry.

    LaunchRecordWriteTimeout

    DWORD

    Default=3000

    Specifies in milliseconds how long the tray will wait when trying to write to the launch record log if another process is using it.

    ImportSearchPath

    String

    d:\files;C:\documents and settings\user1\SFTs

    A semicolon delimited list of up to five directories to search for portable SFT files before prompting the user to select a directory. Trailing backslash in paths is optional. This value is not present by default and must be set manually.

    UserImportPath

    String

    D:\SFTs\

    Valid only under HKCU. The last location the user browsed to while finding a SFT file for package import. Set automatically if the SFT is found successfully. This is used on successive imports when trying to automatically locate SFT files.

    - - - -## Shared Key - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Shared key controls values that are shared across App-V components. The following table provides information about the registry values associated with the Shared key. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Name Type Data (Examples) Description

    DumpPath

    String

    Default=C:\

    Default path to create dump files when generating a minidump on an exception. This defaults to C:\ if not specified. The Client installer sets this key to the <App Virtualization global data directory>\Dumps. The Sequencer installer sets this key to the installation directory.

    DumpPathSizeLimit

    DWORD

    1000

    Specifies the maximum total amount of disk space in megabytes that can be used to store minidumps. Default = 1000 MB.

    - - - -## Network Key - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network key controls a variety of network-related parameters. This key is primarily used by the network transport agent. The following table provides information about the registry values associated with the Network key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Name Type Data (Examples) Description

    Online

    DWORD

    Default=1

    Enables or disables offline mode. If set to 0, the client will not communicate with App-V Management Servers or publishing servers. In disconnected operations, the client can start a loaded application even when it is not connected to an App-V Management Server. In offline mode, the client does not attempt to connect to an App-V Management Server or publishing server. You must allow disconnected operations to be able to work offline. Default value is 1 enabled (online), and 0 is disabled (offline).

    AllowDisconnectedOperation

    DWORD

    Default=1

    Enables or disables disconnected operation. Default value is 1 enabled, and 0 is disabled. When disconnected operations are enabled, the App-V client can start a loaded application even when it is not connected to an App-V Management Server.

    FastConnectTimeout

    DWORD

    Default=1000

    This value specifies the TCP connect time-out in milliseconds to determine when to go into disconnected operations mode. This value can be used to override the default ConnectTimeout of 20 seconds (App-V connect time-out for network transactions) or the system’s TCP time-out of approximately 25 seconds. This brings the client into disconnected operations mode quickly. Applied on the next connect.

    LimitDisconnectedOperation

    DWORD

    Default=1

    Applicable only if AllowDisconnectedOperation is 1, enabled. This value determines whether there will be a time limit for how long the client will be allowed to operate in disconnected operations. 1=limited. 0=unlimited.

    DOTimeoutMinutes

    DWORD

    Default=129,600

    Indicates how many minutes an application may be used in disconnected operation mode.

    The valid values are 1–999,999 in days expressed in minutes (1–1,439,998,560 minutes). The default value is 90 days or 129,600 minutes.

    Protocol

    DWORD

    Default=8

    Default protocol to use (TCP vs SSL). Configure in Options Dialog.

    ReadTimeout

    DWORD

    20

    Read time-out for network transactions, in seconds. Do not modify.

    WriteTimeout

    DWORD

    20

    Write time-out for network transactions, in seconds. Do not modify.

    ConnectTimeout

    DWORD

    20

    Connect time-out for network transactions, in seconds. Do not modify.

    ReestablishmentRetries

    DWORD

    3

    The number of times to try to reestablish a dropped session.

    ReestablishmentInterval

    DWORD

    15

    The number of seconds to wait between tries to reestablish a dropped session.

    - - - -## Http Key - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\Http key controls the parameters that are related to Http streaming. This key is used primarily by the network transport agent. The following table provides information about the registry values that are associated with the Http key. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Name Type Data (Examples) Description

    LaunchIfNotFound

    DWORD

    Default=0

    Controls the behavior of HTTP streaming when a connection to the HTTP server can be established and the package file no longer exists on the HTTP server. If the value does not exist or if it is not set to 1, the App-V client does not let you launch an application that has previously been loaded into cache.

    1

    If this value is set to 1, the App-V client lets you launch an application that has previously been loaded into cache.

    - - - -## File System Key - - -The values that are contained under the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS key control the file system parameters for App-V. The following table provides information about the registry values associated with the AppFS key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Name Type Data (Examples) Description

    FileSize

    DWORD

    4096

    Maximum size in megabytes of file system cache file. If you change this value in the registry, you must set State to 0 and reboot.

    FileName

    String

    C:\Users\Public\Documents\SoftGrid Client\sftfs.fsd

    Location of file system cache file. If you change this value in the registry, you must either leave FileSize the same and reboot or set State to 0 and reboot.

    DriveLetter

    String

    Q:

    Drive where App-V file system will be mounted, if it is available. This value is set either by the listener or the installer, and it is read by the file system.

    State

    DWORD

    0x100

    State of file system. Set to 0 and reboot to completely clear the file system cache.

    FileSystemStorage

    String

    C:\Profiles\Joe\SG

    Path for symlinks, set under HKCU. Do not modify (use data directory under Configuration to change).

    GlobalFileSystemStorage

    String

    C:\Users\Public\Documents\SoftGrid Client\AppFS Storage

    Path for global file system data. Do not modify.

    MaxPercentToLockInCache

    DWORD

    Default=90

    Specifies the maximum percentage of the file system cache file that can be locked. Do not modify.

    UnloadLeastRecentlyUsed

    DWORD

    Default=1

    The file system cache space management feature uses a Least Recently Used (LRU) algorithm and is enabled by default. If the space that is required for a new package would exceed the available free space in the cache, the App-V Client uses this feature to determine which, if any, existing packages it can delete from the cache to make room for the new package. The client deletes the package with the oldest last-accessed date if it is older than the value specified in the MinPkgAge registry value. Values are 0 (disabled) and 1 (default, enabled).

    MinPackageAge

    DWORD

    1

    To determine when the package can be selected for discard, set this registry value to equal the minimum number of days you want to elapse since the package was last accessed. Packages that have been used more recently are not discarded.

    - - - -## Permissions Key - - -To help to prevent users from making mistakes, administrators can use the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions key to control access to some actions for non-administrative users—for example, to prevent users from accidentally unloading programs. Users with administrative rights can give themselves any of these permissions. On shared systems, such as a Remote Desktop Session Host (RD Session Host) server (formerly Terminal Server) system, be careful when granting additional permissions to users because some of these permissions would enable users to control the applications used by all users on the system. Possible values for these settings are 1 (allow) and 0 (disallow). - -The Permissions key settings control all interfaces that enable the named actions. This includes the Options Dialog, SFTTray, and SFTMime. These settings do not affect administrators. The following table provides information about the registry values associated with the Permissions key. - -Name -Type -Data (Examples) -Description -ChangeFSDrive - -DWORD - -Default=0 - -A value of 1 allows users to pick a different drive letter to be used as the file system drive. - -ChangeCacheSize - -DWORD - -Default=0 - -A value of 1 allows users to change the cache size. - -ChangeLogSettings - -DWORD - -Default=0 - -A value of 1 allows users to modify the log level, change its location, and reset it through the user interface. - -AddApp - -DWORD - -Default=0 - -A value of 1 allows users to add applications explicitly. This does not affect applications that are added through publishing refresh nor does it prevent users from starting (and thereby implicitly adding) applications that have not already been added. Values are 0 or 1. - -LoadApp - -DWORD - -0 - -Does not allow a user to load an application. This is the default for RD Session Hosts. If you are a mobile user, you might want to fully load your applications in the cache to use them during disconnected operation or offline mode. To stream applications from the App-V Management Server or the App-V Streaming Server, you must be connected to a server to load applications. - -1 - -Allows a user to load an application. This is the default for Windows desktops. - -UnloadApp - -DWORD - -0 - -Does not allow a user to unload an application. When you load or unload a package, all the applications in the package are loaded into or removed from cache. - -1 - -Allows a user to unload an application. - -LockApp - -DWORD - -0 - -Does not allow a user to lock and unlock an application. This is the default for RD Session Hosts. A locked application cannot be removed from the cache to make room for new applications. To remove a locked application from the App-V Desktop or Client for Remote Desktop Services (formerly Terminal Services) cache, you must unlock it. - -1 - -Allows a user to lock and unlock an application. This is the default for Windows Desktops. - -ManageTypes - -DWORD - -0 - -Does not allow a user to add, edit, or remove file type associations for that User alone. This is the default for RD Session Hosts. - -1 - -Allows a user to add, edit, and remove file type associations for that user only and not globally. This is the default for Windows Desktops. - -RefreshServer - -DWORD - -0 - -Does not allow a user to trigger a refresh of MIME settings. This is the default for RD Session Hosts. - -1 - -Enables a user to trigger a refresh of MIME settings. This is the default for Windows Desktops. - -UpdateOSDFile - -DWORD - -Default= 0 - -A value of 1 enables a user to use a modified OSD file. - -ImportApp - -DWORD - -0 - -Does not allow a user to import applications into cache. The difference between Load and Import is that when a Load is triggered, the client gets the package from the currently configured location contained in the OSD, ASR, or Override URL. When using Import, a location to get the package from must be specified. - -1 - -Allows a user to import applications into cache. - -ChangeRefreshSettings - -DWORD - -Default=0 - -A value of 1 allows users to modify the refresh settings for servers (refresh on login and periodic refresh). This does not imply that the user can modify other server settings (path, host, and so on). - -ManageServers - -DWORD - -Default=0 - -A value of 1 allows the user to add, edit, and remove servers, except for editing the refresh settings, which is controlled by the ChangeRefreshSettings permission. - -PublishShortcut - -DWORD - -Default=0 - -A value of 1 allows users to publish shortcuts through the user interface. This does not affect shortcuts that are published during a publishing refresh. - -ViewAllApplications - -DWORD - -Default=0 - -A value of 1 displays all applications through the user interface; otherwise, only the user’s applications are displayed. - -RepairApp - -DWORD - -Default=1 - -A value of 1 allows the user to use the Repair action on applications in SFTMime or the Client Management Console. When you repair an application, you remove any custom user settings and restore the default settings. This action does not change or delete shortcuts or file type associations, and it does not remove the application from cache. - -ClearApp - -DWORD - -Default=1 - -A value of 1 allows the user to use the Clear action on applications in SFTMime or the Client Management Console. When you clear an application from the console, you can no longer use that application. However, the application remains in cache and is still available to other users on the same system. After a publishing refresh, the cleared applications will again become available to you. - -DeleteApp - -DWORD - -Default=0 - -A value of 1 allows the user to use the Delete action on applications in SFTMime or the Client Management Console. When you delete an application, the selected application will no longer be available to any users on that client. Shortcuts and file type associations are deleted and the application is deleted from cache. However, if another application refers to data in the file system cache or settings data for the selected application, these items will not be deleted. - -After a publishing refresh, the deleted applications will again become available to you. - -ToggleOfflineMode - -DWORD - -A value of 1 allows the users to select to run the client in Offline Mode. In Offline Mode, the Application Virtualization client can start a loaded application even when it is not connected to an Application Virtualization Server. - - - -## Custom Settings - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\CustomSettings key contains values specific to front-end components. All custom settings are stored as strings. The following table provides information about the registry values associated with the CustomSettings key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Name Type Data (Examples) Description

    TrayErrorDelay

    DWORD

    Default=30

    Time in seconds that the Application Virtualization notification area will display error messages like "Launch failed". Minimum value of 1.

    TraySuccessDelay

    DWORD

    Default=10

    Time in seconds that the appvmed notification area will display success messages like "Word launched" or "Excel shut down". If 0, those messages will be suppressed.

    TrayVisibility

    DWORD

    Default=0

    0=Show Tray when virtualized applications are in use.

    -

    1=Show Tray always.

    -

    2=Never show Tray.

    TrayShowRefresh

    DWORD

    When present and set to a value of 1, allows menu item Refresh Applications to be displayed on the Tray menu and is accessible by the user.

    TrayShowLoad

    DWORD

    When present and set to a value of 1, allows menu item Load Applications to be displayed on the Tray menu and is accessible by the user.

    - - - -## Reporting Settings - - -The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Reporting key contains values specific to reporting to an App-V Management Server. The following table provides information about the registry values associated with the Reporting key. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Name Type Data (Examples) Description

    DataCacheLimit

    DWORD

    Default=20

    This value specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. When a new record is added (bottom of the list), one or more of the oldest records (top of the list) will be deleted to make room. A warning will be logged to the Client log and the event log the first time this occurs, and it will not be logged again until after the cache has been successfully cleared on transmission and the log has filled up again.

    DataBlockSize

    DWORD

    Default=65536

    This value specifies the maximum size in bytes to transmit to the server at once on publishing refresh, to avoid permanent transmission failures when the log has reached a significant size. The default value is 65536. When transmitting report data to the server, one block of application records—less than or equal to the block size in bytes of XML data—will be removed from the cache and sent to the server. Each block will have the general Client data and global package list data prepended, and these will not factor into the block size calculations; the potential exists for an extremely large package list to result in transmission failures over low bandwidth or unreliable connections.

    - - - -## Related topics - - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-desktop-client-security.md b/mdop/appv-v4/app-v-desktop-client-security.md deleted file mode 100644 index 2bf8723032..0000000000 --- a/mdop/appv-v4/app-v-desktop-client-security.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: App-V Desktop Client Security -description: App-V Desktop Client Security -author: dansimp -ms.assetid: 216b9c16-7bb4-4f94-b9d8-810501285008 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Desktop Client Security - - -The App-V Desktop Client provides many security enhancements that were not available in previous versions of the product. These changes provide higher levels of security by default and through configuration of the client settings. - -**Note**   -When you install the App-V Desktop Client on a computer, the software defaults to the most secure settings. However, when upgrading, the previous settings of the client persist. - - - -By default, the App-V Desktop Client is configured only with the permissions required to allow a non-administrative user to perform a publishing refresh and stream applications. Additional security enhancements provided in the App-V Desktop Client include the following: - -- By default, an OSD cache update is allowed only by the publishing refresh process. - -- The log file (`sftlog.txt`) is accessible only by accounts with local administrative access to the client. - -- The log file now has a maximum size. - -- The log files are managed through archive settings. - -- System Event logging is now performed. - -## Permissions - - -After you install the Desktop Client, you can configure other security settings through the MMC, or on an individual client by using the registry or the ADM Template provided by Microsoft. The App-V Desktop Client has permissions that you can set to restrict non-administrative users from accessing all the features of the Desktop Client. For a full list of permissions, please see the App-V Client Help file or App-V Operations Guide. - -**Important**   -Carefully consider the consequences of changing access rights, especially on systems that are shared by multiple users, such as Terminal Servers. - - - -**Note**   -If users in the environment have local administrator privileges for their computers, the permissions are ignored. - - - -### ADM Template - -Microsoft Application Virtualization (App-V) introduces an ADM Template that you can use to configure the most common client settings through Group Policies. This template enables administrators to implement and change many of the client settings through a centralized administration model. Some of the settings available in the ADM Template are security settings. - -**Important**   -When using the ADM Template, remember that the settings are Group Policy preference settings and not fully managed Group Policies. - - - -For a full description of the ADM Template, the specific settings, and guidance to successfully deploy clients in your environment, see the App-V ADM Template white paper at [https://go.microsoft.com/fwlink/LinkId=122063](https://go.microsoft.com/fwlink/?LinkId=122063). - -## Removing OSD File Type Associations - - -If your organization does not require users to open applications directly from an OSD file, you can enhance security by removing the file type associations on the client. Remove the `HKEY_CURRENT_USERS` keys for OSD and `Softgird.osd.file` by using the registry editor. You can put this process into a logon script or into a post-installation script to automate these changes. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-installation-checklist.md b/mdop/appv-v4/app-v-installation-checklist.md deleted file mode 100644 index 68208f051d..0000000000 --- a/mdop/appv-v4/app-v-installation-checklist.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: App-V Installation Checklist -description: App-V Installation Checklist -author: dansimp -ms.assetid: b17efaab-cd6d-4c30-beb7-c6e7c9c87657 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V Installation Checklist - - -The following checklist is intended to provide a high-level list of items to consider and outlines the steps you should take to install the Microsoft Application Virtualization (App-V) servers. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Install the App-V Management Server. If you are installing the Management Web Service, Management Console, or the Data Store on different servers, you can use the custom installation option.

    How to Install Application Virtualization Management Server

    Install the App-V Management Web Service. (Optional ¹)

    How to Install the Management Web Service

    Install the App-V Management Console. (Optional ¹)

    How to Install the Management Console

    Install the App-V Data Store. (Optional ¹)

    How to Install a Database

    Install the App-V client.

    How to Manually Install the Application Virtualization Client

    Install the App-V Sequencer.

    How to Install the Application Virtualization Sequencer

    Install the App-V Streaming Server. (This is optional and required only if you are installing the Streaming Server).

    How to Install the Application Virtualization Streaming Server

    Create Content directories on the servers that will be used for streaming applications to users’ computers.

    How to Configure the Application Virtualization Management Servers

    -

    How to Configure the Application Virtualization Streaming Servers

    -

    How to Configure the Server for IIS

    -

    How to Configure the File Server

    - - - -¹ This is required only if you are installing the App-V Management Web Service, Management Console, or the Data Store on a different computer. - -## Related topics - - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) - -[App-V Postinstallation Checklist](app-v-postinstallation-checklist.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md b/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md deleted file mode 100644 index b4fc7f6ba0..0000000000 --- a/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: App-V Interoperability with Windows AppLocker -description: App-V Interoperability with Windows AppLocker -author: dansimp -ms.assetid: 9a488034-607d-411c-b495-ff184c726f49 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Interoperability with Windows AppLocker - - -Version 4.5 SP1 of the Microsoft Application Virtualization (App-V) client supports the AppLocker feature of Windows 7. The AppLocker feature enables IT administrators to specify which applications are restricted from running on computers. This document describes how to configure the AppLocker rules to work with the App-V virtual environment and virtualized applications. - -**Note**   -Windows AppLocker must first be enabled before configuring Windows AppLocker rules for virtual applications. For more information about enabling Windows AppLocker, [Windows AppLocker](https://go.microsoft.com/fwlink/?LinkId=156732) (https://go.microsoft.com/fwlink/?LinkId=156732). - - - -## Configuring Windows AppLocker Rules for Virtual Applications - - -Local administrators can create Windows AppLocker rules that restrict the running of program executables (.exe files), Windows Installer files (.msi and .msp files), and scripts (.ps, .bat, .cmd, .vbs and .js files). The administrator does this by using a reference computer that has the App-V client installed and that has all the relevant virtual applications streamed to the client cache. The administrator then uses the Windows AppLocker section of the Local Security Policy Microsoft Management Console (MMC) snap-in on the reference computer to create the rules. - -When you browse to find a directory path or specific file for which you want to create a rule, you can access the App-V drive by using the path to the hidden share. For example, you can browse to \\\\localhost\\Q$, where the App-V drive is drive Q. However, to create the rule, you must edit the path to remove the reference to \\\\localhost\\Q$ and use Q:\\ instead. You must start each application on the reference computer to access the application’s files, and administrative rights are required to browse to \\\\localhost\\Q$. - - - - - - - - - diff --git a/mdop/appv-v4/app-v-package-wmi-class.md b/mdop/appv-v4/app-v-package-wmi-class.md deleted file mode 100644 index f9efeee4ce..0000000000 --- a/mdop/appv-v4/app-v-package-wmi-class.md +++ /dev/null @@ -1,161 +0,0 @@ ---- -title: App-V Package WMI Class -description: App-V Package WMI Class -author: dansimp -ms.assetid: 0fc26c3b-9706-4804-be2d-645771dc33ae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V Package WMI Class - - -In the Application Virtualization (App-V) Client, the **Package** class is a Windows Management Instrumentation (WMI) class that represents all the virtual packages on the client. The virtual packages can contain many virtual applications. - -## Syntax - - -``` syntax -class Package -{ - string Name; - string Version; - string PackageGUID; - string SftPath; - uint64 TotalSize; - uint64 CachedSize; - uint64 LaunchSize; - uint64 CachedLaunchSize; - boolean InUse; - boolean Locked; - uint16 CachedPercentage; - string VersionGUID; - }; -``` - -## Properties - - -**Name** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The user-friendly name of the virtual package. - -**Version** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The version of the virtual package. - -**PackageGUID** -Data type: **String** - -Access type: Read-only - -Qualifiers: Key - -The GUID identifier of the package configuration and source files. - -**SftPath** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The file path of the SFT file. - -**TotalSize** -Data type: **UInt64** - -Access type: Read-only - -Qualifiers: None - -The total size of the virtual package, in kilobytes. - -**CachedSize** -Data type: **UInt64** - -Access type: Read-only - -Qualifiers: None - -The total size of the cache for the virtual package, in kilobytes. - -**LaunchSize** -Data type: **UInt64** - -Access type: Read-only - -Qualifiers: None - -The total size of the virtual package’s primary feature block, in kilobytes. - -**CachedLaunchSize** -Data type: **UInt64** - -Access type: Read-only - -Qualifiers: None - -Total size of the virtual package’s primary feature block that has been cached, in kilobytes. - -**InUse** -Data type: **Boolean** - -Access type: Read-only - -Qualifiers: None - -**true** if any virtual application in the virtual package is running; otherwise **false**. - -**Locked** -Data type: **Boolean** - -Access type: Read-only - -Qualifiers: None - -**true** if the virtual package is locked; otherwise **false**. - -**CachedPercentage** -Data type: **UInt16** - -Access type: Read-only - -Qualifiers: None - -The percentage of the cache files. Based on the following formula: CachedSize / TotalSize × 100. - -**VersionGUID** -Data type: **String** - -Access type: Read-only - -Qualifiers: None - -The GUID identifier of the package version. - -  - -  - - - - - diff --git a/mdop/appv-v4/app-v-postinstallation-checklist.md b/mdop/appv-v4/app-v-postinstallation-checklist.md deleted file mode 100644 index 814811b75f..0000000000 --- a/mdop/appv-v4/app-v-postinstallation-checklist.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: App-V Postinstallation Checklist -description: App-V Postinstallation Checklist -author: dansimp -ms.assetid: 74db297e-a744-4287-bcc6-0e096ca8b57a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V Postinstallation Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps you should take after you have completed the installation of the Microsoft Application Virtualization (App-V) Management Server, App-V Streaming Server, and the App-V Desktop Client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Create firewall exceptions for the App-V Management Server or Streaming Server services.

    Configuring the Firewall for the App-V Servers

    Verify that the App-V system is functioning correctly by publishing, streaming, and testing the default application.

    How to Install and Configure the Default Application

    Configure the App-V Client to use the App-V Streaming Server or other server for streaming by means of the ApplicationSourceRoot, IconSourceRoot, and OSDSourceRoot settings.

    How to Configure the Client for Application Package Retrieval

    Understand how to use the .msi file version of sequenced application packages for offline deployment.

    How to Publish a Virtual Application on the Client

    (Optional) Configure SQL Server database mirroring for the App-V database.

    How to Configure Microsoft SQL Server Mirroring Support for App-V

    - - - -## Related topics - - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-pre-installation-checklist.md b/mdop/appv-v4/app-v-pre-installation-checklist.md deleted file mode 100644 index 4de02e6032..0000000000 --- a/mdop/appv-v4/app-v-pre-installation-checklist.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: App-V Pre-Installation Checklist -description: App-V Pre-Installation Checklist -author: dansimp -ms.assetid: 3af609b1-2c09-4edb-b083-b913b6d5e8c4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Pre-Installation Checklist - - -The following checklist is intended to provide a high-level list of items to consider and outlines the steps you should take before you install the Microsoft Application Virtualization (App-V) servers. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Ensure your computing environment meets the supported configurations required for App-V.

    Application Virtualization Deployment Requirements

    Configure the necessary Active Directory groups and accounts.

    Configuring Prerequisite Groups in Active Directory for App-V

    Configure the Internet Information Services (IIS) settings on the server that is running IIS.

    How to Configure Windows Server 2008 for App-V Management Servers

    Configure the server that is running IIS to be trusted for delegation.

    -
    -Note

    This is required only if you are installing the App-V Management Server by using a distributed system architecture, that is, if you install the App-V Management Console, the Management Web Service, and the database on different computers.

    -
    -
    - -

    How to Configure the Server to be Trusted for Delegation

    Install Microsoft SQL Server 2008.

    Install SQL Server 2008 (https://go.microsoft.com/fwlink/?LinkId=181924).

    - - - -## Related topics - - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) - -[App-V Installation Checklist](app-v-installation-checklist.md) - - - - - - - - - diff --git a/mdop/appv-v4/app-v-upgrade-checklist.md b/mdop/appv-v4/app-v-upgrade-checklist.md deleted file mode 100644 index b81818e567..0000000000 --- a/mdop/appv-v4/app-v-upgrade-checklist.md +++ /dev/null @@ -1,213 +0,0 @@ ---- -title: App-V Upgrade Checklist -description: App-V Upgrade Checklist -author: dansimp -ms.assetid: 64e317d2-d260-4b67-8a49-ba9ac513087a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V Upgrade Checklist - - -Before trying to upgrade to Microsoft Application Virtualization (App-V) 4.5 or later versions, any version earlier than App-V 4.1 must be upgraded to App-V 4.1. You should plan to upgrade clients first, and then upgrade the server components. App-V clients that have been upgraded to App-V 4.5 continue to work with App-V servers that have not yet been upgraded. Earlier versions of the client are not supported on servers that have been upgraded to App-V 4.5. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Upgrade the App-V clients.

    How to Upgrade the Application Virtualization Client

    Upgrade the App-V servers and database.

    -
    -Important

    If you have more than one server sharing access to the App-V database, all those servers must be taken offline while the database is being upgraded. You should follow your regular business practices for the database upgrade, but we recommend that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the App-V software on the other servers.

    -
    -
    - -

    How to Upgrade the Servers and System Components

    Upgrade the App-V Management Web Service.

    -

    This step applies only if the Management Web Service is on a separate server, which would require that you run the server installer program on that separate server to upgrade the Management Web service. Otherwise, the previous server upgrade step will automatically upgrade the Management Web Service.

    How to Upgrade the Servers and System Components

    Upgrade the App-V Management Console.

    -

    This step applies only if the Management Console is on a separate computer, which would require that you run the server installer program on that separate computer to upgrade the console. Otherwise, the previous server upgrade step will upgrade the Management Console.

    How to Upgrade the Servers and System Components

    Upgrade the App-V Sequencer.

    How to Upgrade the Application Virtualization Sequencer

    - - - -## Additional Upgrade Considerations - - -- Any virtual application packages sequenced in version 4.2 will not have to be sequenced again for use with version 4.5. However, you should consider upgrading the virtual packages to the Microsoft Application Virtualization 4.5 format if you want to apply default access control lists (ACLs) or generate a Windows Installer file. This is a simple process and requires only that the existing virtual application package be opened and saved with the App-V 4.5 Sequencer. This can be automated by using the App-VSequencer command-line interface. For more information, see [How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - -- One of the features of the 4.5 Sequencer is the ability to create Windows Installer (.msi) files as control points for virtual application package interoperability with electronic software distribution (ESD) systems, such as Microsoft Endpoint Configuration Manager. Previous Windows Installer files created with the MSI tool for Application Virtualization that were installed on a App-V 4.1 or 4.2 client that is subsequently upgraded to App-V 4.5 will continue to work, although they cannot be installed on the App-V 4.5 client. However, they cannot be removed or upgraded unless they are upgraded in the App-V 4.5 Sequencer. The original App-V package earlier than 4.5 has to be opened in the App-V 4.5 Sequencer and then saved as a Windows Installer File. - - **Note** - If the App-V 4.2 Client has already been upgraded to App-V 4.5, it is possible to script a workaround to preserve the version 4.2 packages on version 4.5 clients and allow them to be managed. This script must copy two files, msvcp71.dll and msvcr71.dll, to the App-V installation folder and set the following registry key values under the registry key:\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\]: - - "ClientVersion"="4.2.1.20" - - "GlobalDataDirectory"="C:\\\\Documents and Settings\\\\All Users\\\\Documents\\\\" (a globally writeable location) - - - -- Windows Installer files generated by the App-V 4.5 Sequencer display the error message "This package requires Microsoft Application Virtualization Client 4.5 or later" when trying to run them on an App-V 4.6 Client. Open the old package with either the App-V 4.5 SP1 Sequencer or the App-V 4.6 Sequencer and generate a new .msi file for the package. - -- Any version 4.2 reports that were created and saved will be overwritten when the server is upgraded to version 4.5. If you have to keep these reports, you must save a backup copy of the SftMMC.msc file located in the SoftGrid Management Console folder on the server and use that copy to replace the new SftMMC.msc that is installed during the upgrade. - -- For additional information about upgrading from previous versions, see [Upgrading to Microsoft Application Virtualization 4.5 FAQ](https://go.microsoft.com/fwlink/?LinkId=120358) (https://go.microsoft.com/fwlink/?LinkId=120358). - -## App-V 4.6 Client Package Support - - -You can deploy packages created in previous versions of App-V to App-V 4.6 clients. However, you must modify the associated .osd file so that it includes the appropriate operating system and chip architecture information. The following values can be used: - - --- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    OS Value

    <OS VALUE=”Win2003TS”/>

    <OS VALUE=”Win2003TS64”/>

    <OS VALUE=”Win2008TS”/>

    <OS VALUE=”Win2008TS64”/>

    <OS VALUE=”Win2008R2TS64”/>

    <OS VALUE=”Win7”/>

    <OS VALUE=”Win764”/>

    <OS VALUE=”WinVista”/>

    <OS VALUE=”WinVista64”/>

    <OS VALUE=”WinXP”/>

    <OS VALUE=”WinXP64”/>

    - - - -To run a newly created 32-bit package, you must sequence the application on a computer running a 32-bit operating system with the App-V 4.6 Sequencer installed. After you have sequenced the application, in the Sequencer console, click the **Deployment** tab and then specify the appropriate operating system and chip architecture as required. - -**Important** -Applications sequenced on a computer running a 64-bit operating system must be deployed to computers running a 64-bit operating system. New 32-bit packages created by using the App-V 4.6 Sequencer do not run on computers running the App-V 4.5 client. - - - -To run new 64-bit packages on the App-V 4.6 Client, you must sequence the application on a computer running the App-V 4.6 Sequencer and that is running a 64-bit operating system. After you have sequenced the application, in the Sequencer console, click the **Deployment** tab, and then specify the appropriate operating system and chip architecture as required. - -The following table lists which client versions will run packages created by using the various versions of the sequencer. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Sequenced by using the App-V 4.2 SequencerSequenced by using the App-V 4.5 SequencerSequenced by using the 32-bit App-V 4.6 SequencerSequenced by using the 64-bit App-V 4.6 Sequencer

    4.2 Client

    Yes

    No

    No

    No

    4.5 Client ¹

    Yes

    Yes

    No

    No

    4.6 Client (32-bit)

    Yes

    Yes

    Yes

    No

    4.6 Client (64-bit)

    Yes

    Yes

    Yes

    Yes

    - - - -¹Applies to all versions of the App-V 4.5 client, including App-V 4.5, App-V 4.5 CU1, and App-V 4.5 SP1. - - - - - - - - - diff --git a/mdop/appv-v4/application-utilization-reportserver.md b/mdop/appv-v4/application-utilization-reportserver.md deleted file mode 100644 index 78ed55aaad..0000000000 --- a/mdop/appv-v4/application-utilization-reportserver.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Application Utilization Report -description: Application Utilization Report -author: dansimp -ms.assetid: cb961969-c9a3-4d46-8303-121d737d76d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Utilization Report - - -Use the Application Utilization Report to track usage information for a specified application defined in the database. You can use this report to determine how heavily a specific application is used. - -This report generates a graph that displays the total daily usage over time during the reporting period. - -This report also lists the following information: - -- Number of sessions—Number of times an application was used - -The Application Utilization Report also includes a summary of the total usage. - -When you create a report, you specify the parameters that are used for collecting the data when the report is run. - -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run a report is determined by the amount of data collected in the data store. - -After you run a report and the output is displayed in the Application Virtualization Server Management Console, you can export the report into the following formats: - -- Adobe Acrobat (PDF) - -- Microsoft Office Excel - -## Related topics - - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md deleted file mode 100644 index e7bf14bd06..0000000000 --- a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md +++ /dev/null @@ -1,274 +0,0 @@ ---- -title: Application Virtualization Client Hardware and Software Requirements -description: Application Virtualization Client Hardware and Software Requirements -author: dansimp -ms.assetid: 8b877a2c-5721-4b22-a47f-e2838d58ab12 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Application Virtualization Client Hardware and Software Requirements - - -This topic describes the recommended minimum hardware and software configuration for the installation of the Application Virtualization Desktop Client and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services). - -## Application Virtualization Desktop Client - - -The following list includes the recommended minimum hardware and software requirements for the Application Virtualization Desktop Client. The requirements are listed first for Microsoft Application Virtualization (App-V) 4.6 SP2, followed by the requirements for versions that preceded App-V 4.6 SP2. - -**Note**   -The Application Virtualization (App-V) Desktop Client requires no additional processor or RAM resources beyond the requirements of the host operating system. - - - -### Hardware Requirements - -The hardware requirements are applicable to all versions. - -- Processor—See recommended system requirements for the operating system you are using. - -- RAM—See recommended system requirements for the operating system you are using. - -- Disk—30 MB for installation and 6 GB for the cache. - -### Software Requirements for App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackArchitectural SKU

    Windows XP

    Professional Edition

    SP3

    x86

    Windows Vista

    Business, Enterprise, or Ultimate Edition

    SP2

    x86

    Windows 7

    Professional, Enterprise, or Ultimate Edition

    No service pack or SP1

    x86 and x64

    Windows 8

    Pro or Enterprise Edition

    x86 and x64

    - -The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first. -- **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360). - - **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266). - -For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed. - -- **Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=150700) (https://go.microsoft.com/fwlink/?LinkId=150700). - -### Software Requirements for Versions that Precede App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackArchitectural SKU

    Windows XP

    Professional Edition

    SP2 or SP3

    x86 and x64

    Windows Vista

    Business, Enterprise, or Ultimate Edition

    No service pack, SP1, or SP2

    x86 and x64

    Windows 7¹

    Professional, Enterprise, or Ultimate Edition

    No service pack or SP1

    x86 and x64

    -¹Supported for App-V 4.5 SP1 and SP2, App-V 4.6 and 4.6 SP1 only - -The Application Virtualization (App-V) 4.6 Desktop Client supports x86 and x64 SKUs of these operating systems. - -The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first. - -- Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist_x86.exe from Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update (https://go.microsoft.com/fwlink/?LinkId=169360). - -- Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) (https://go.microsoft.com/fwlink/?LinkId=63266). - -- Microsoft Application Error Reporting—The installation program for this software is included in the Support\Watson folder in the self-extracting archive file. - -For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed. - -- Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) (https://go.microsoft.com/fwlink/?LinkId=150700). - -## Application Virtualization Client for Remote Desktop Services - -Following are the recommended hardware and software requirements for the Application Virtualization Client for Remote Desktop Services. The requirements are listed first for appv461_3, followed by the requirements for versions that preceded App-V 4.6 SP2. - -The Application Virtualization (App-V) Client for Remote Desktop Services requires no additional processor or RAM resources beyond the requirements of the host operating system. - -### Hardware Requirements - -The hardware requirements are applicable to all versions. - -- Processor—See recommended system requirements for the operating system you are using. - -- RAM—See recommended system requirements for the operating system you are using. These requirements also depend on the number of users and applications. - -- Disk—30 MB for installation and 6 GB for the cache. - -### Software Requirements for App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackArchitectural SKU

    Windows Server 2003 R2

    Standard Edition, Enterprise Edition, or Datacenter Edition

    SP2

    x86 and x64

    Windows Server 2008

    Standard, Enterprise, or Datacenter Edition

    SP2

    x86 and x64

    Windows Server 2008 R2

    Standard, Enterprise, or Datacenter Edition

    No service pack or SP1

    x64

    Windows Server 2012

    Standard, Enterprise, or Datacenter Edition

    x64

    - -The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first. - -- **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360). - -- **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266). - -- **Microsoft Application Error Reporting**—The installation program for this software is included in the **Support\\Watson** folder in the self-extracting archive file. - -For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed. - -- **Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=150700) (https://go.microsoft.com/fwlink/?LinkId=150700). - -### Software Requirements for Versions that Precede App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackArchitectural SKU

    Windows Server 2003

    Standard Edition, Enterprise Edition, or Datacenter Edition

    SP1 or SP2

    x86 and x64

    Windows Server 2003 R2

    Standard Edition, Enterprise Edition, or Datacenter Edition

    No service pack or SP2

    x86 and x64

    Windows Server 2008

    Standard, Enterprise, or Datacenter Edition

    SP1 or SP2

    x86 and x64

    Windows Server 2008 R2

    Standard, Enterprise, or Datacenter Edition

    No service pack or SP1

    x64

    - -The Application Virtualization (App-V) 4.6 Client for Remote Desktop Services supports x86 and x64 SKUs of these operating systems. - -## Related topics -- [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) -- [Application Virtualization System Requirements](application-virtualization-system-requirements.md) -- [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) -- [How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -- [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) diff --git a/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md b/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md deleted file mode 100644 index 2f13cd29a0..0000000000 --- a/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md +++ /dev/null @@ -1,311 +0,0 @@ ---- -title: Application Virtualization Client Installer Command-Line Parameters -description: Application Virtualization Client Installer Command-Line Parameters -author: dansimp -ms.assetid: 508fa404-52a5-4919-8788-2a3dfb00639b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Application Virtualization Client Installer Command-Line Parameters - - -The following table lists all available Microsoft Application Virtualization Client installer command-line parameters, their values, and a brief description of each parameter. Parameters are case-sensitive and must be entered as all-uppercase letters. All parameter values must be enclosed in double quotes. - -**Note** -- For App-V version 4.6, command-line parameters cannot be used during a client upgrade. - -- The *SWICACHESIZE* and *MINFREESPACEMB* parameters cannot be combined on the command line. If both are used, the *SWICACHESIZE* parameter will be ignored. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterValuesDescription

    ALLOWINDEPENDENTFILESTREAMING

    TRUE

    -

    FALSE

    Indicates whether streaming from file will be enabled regardless of how the client has been configured with the APPLICATIONSOURCEROOT parameter. If set to FALSE, the transport will not enable streaming from files even if the OSD HREF or the APPLICATIONSOURCEROOT parameter contains a file path.

    -

    Possible values:

    -
      -
    • TRUE—Manually deployed application may be loaded from disk.

    • -
    • FALSE—All applications must come from source streaming server.

    • -

    APPLICATIONSOURCEROOT

    RTSP:// URL (for dynamic package delivery)

    -

    File:// URL or UNC (for load from file package delivery)

    To enable an administrator or an electronic software distribution system to ensure that application loading is performed in compliance with the topology management scheme, allows an override of the OSD CODEBASE for the application HREF element (the source location). If the value is “”, which is the default value, the existing OSD file settings are used.

    -

    A URL has several parts:

    -

    <protocol>://<server>:<port>/<path>/<?query><#fragment>

    -

    A UNC path has three parts:

    -

    &lt;computername>&lt;share folder>&lt;resource>

    -

    If the APPLICATIONSOURCEROOT parameter is specified on a client, the client will break the URL or UNC path from an OSD file into its constituent parts and replace the OSD sections with the corresponding APPLICATIONSOURCEROOT sections.

    -
    -Important

    Be sure to use the correct format when using file:// with a UNC path. The correct format is file://&lt;server>&lt;share>.

    -
    -
    - -

    ICONSOURCEROOT

    UNC

    -

    HTTP://URL or HTTPS://URL

    Enables an administrator to specify a source location for icon retrieval for a sequenced application package during publication. Icon source roots support UNC paths and URLs (HTTP or HTTPS). If the value is “”, which is the default value, the existing OSD file settings are used.

    -

    A URL has several parts:

    -

    <protocol>://<server>:<port>/<path>/<?query><#fragment>

    -

    A UNC path has three parts:

    -

    &lt;computername>&lt;share folder>&lt;resource>

    -
    -Important

    Be sure to use the correct format when using a UNC path. Acceptable formats are &lt;server>&lt;share> or <drive letter>:&lt;folder>.

    -
    -
    - -

    OSDSOURCEROOT

    UNC

    -

    HTTP://URL or HTTPS://URL

    Enables an administrator to specify a source location for OSD file retrieval for an application package during publication. OSD source roots support UNC paths and URLs (HTTP or HTTPS). If the value is “”, which is the default value, the existing OSD file settings are used.

    -

    A URL has several parts:

    -

    <protocol>://<server>:<port>/<path>/<?query><#fragment>

    -

    A UNC path has three parts:

    -

    &lt;computername>&lt;share folder>&lt;resource>

    -
    -Important

    Be sure to use the correct format when using a UNC path. Acceptable formats are &lt;server>&lt;share> or <drive letter>:&lt;folder>.

    -
    -
    - -

    AUTOLOADONLOGIN

    -

    AUTOLOADONLAUNCH

    -

    AUTOLOADONREFRESH

    [0|1]

    The AutoLoad triggers that define the events that initiate auto-loading of applications. AutoLoad implicitly uses background streaming to enable the application to be fully loaded into cache.

    -

    The primary feature block will be loaded as quickly as possible. Remaining feature blocks will be loaded in the background to enable foreground operations, such as user interaction with applications, to take priority and provide optimal performance.

    -
    -Note

    The AUTOLOADTARGET parameter determines which applications are auto-loaded. By default, packages that have been used are auto-loaded unless AUTOLOADTARGET is set.

    -
    -
    - -
    -

    Each parameter affects loading behavior as follows:

    -
      -
    • AUTOLOADONLOGIN—Loading starts when the user logs in.

    • -
    • AUTOLOADONLAUNCH—Loading starts when the user starts an application.

    • -
    • AUTOLOADONREFRESH—Loading starts when a publishing refresh occurs.

    • -
    -

    The three values can be combined. In the following example, AutoLoad triggers are enabled both at user login and when publishing refresh occurs:

    -

    AUTOLOADONLOGIN AUTOLOADONREFRESH

    -
    -Note

    If the client is configured with these values at first install, Autoload will not be triggered until the next time the user logs off and logs back on.

    -
    -
    - -

    AUTOLOADTARGET

    NONE

    -

    ALL

    -

    PREVUSED

    Indicates what will be auto-loaded when any given AutoLoad triggers occur.

    -

    Possible values:

    -
      -
    • NONE—No auto-loading, regardless of what triggers might be set.

    • -
    • ALL—If any AutoLoad trigger is enabled, all packages are automatically loaded, whether or not they have ever been launched.

      -
      -Note

      This setting is configured for individual packages by using the SFTMIME ADD PACKAGE and CONFIGURE PACKAGE commands. For more information about these commands, see SFTMIME Command Reference.

      -
      -
      - -
    • -
    • PREVUSED—If any AutoLoad trigger is enabled, load only the packages where at least one application in the package has been previously used (that is, launched or precached).

    • -
    -
    -Note

    When you install the App-V client to use a read-only cache, (for example, as a VDI server implementation), you must set the AUTOLOADTARGET parameter to NONE to prevent the client from trying to update applications in the read-only cache.

    -
    -
    - -

    DOTIMEOUTMINUTES

    29600 (default)

    -

    1–1439998560 minutes (range)

    Indicates how many minutes an application may be used in disconnected operation.

    INSTALLDIR

    <pathname>

    Specifies the installation directory of the App-V Client.

    -

    Example: INSTALLDIR="C:\Program Files\Microsoft Application Virtualization Client"

    OPTIN

    “TRUE”

    -

    “”

    Microsoft Application Virtualization Client components will be upgradable through Microsoft Update when updates are made available to the general public. The Microsoft Update Agent installed on Windows operating systems requires a user to explicitly opt-in to use the service. This opt-in is required only one time for all applications on the device. If you have already opted into Microsoft Update, the Microsoft Application Virtualization components on the device will automatically take advantage of the service.

    -

    For command-line installation, use of Microsoft Update is by default opt-out (unless a previous application already enabled the device to be opted in) due to the requirement for manually opting into Microsoft Update. Therefore, opting in must be explicit for command-line installations. Setting the command-line parameter OPTIN to TRUE forces the Microsoft Update opt-in to be set.

    REQUIREAUTHORIZATIONIFCACHED

    TRUE

    -

    FALSE

    Indicates whether authorization is always required, whether or not an application is already in cache.

    -

    Possible values:

    -
      -
    • TRUE—Application always must be authorized at startup. For RTSP streamed applications, the user authorization token is sent to the server for authorization. For file-based applications, file ACLs dictate whether a user may access the application.

    • -
    • FALSE—Always try to connect to the server. If a connection to the server cannot be established, the client still allows the user to launch an application that has previously been loaded into cache.

    • -

    SWICACHESIZE

    Cache size in MB

    Specifies the size in megabytes of the client cache. The default size is 4096 MB, and the maximum size is 1,048,576 MB (1 TB). The system checks for the available space at installation time, but the space is not reserved.

    -

    Example: SWICACHESIZE="1024"

    SWIPUBSVRDISPLAY

    Display name

    Specifies the displayed name of the publishing server; required when SWIPUBSVRHOST is used.

    -

    Example: SWIPUBSVRDISPLAY="PRODUCTION ENVIRONMENT"

    SWIPUBSVRTYPE

    [HTTP|RTSP]

    Specifies the publishing server type. The default server type is Application Virtualization Server. The /secure switch is not case sensitive.

    -
      -
    • HTTP—Standard HTTP Server

    • -
    • HTTP /secure—Enhanced Security HTTP Server

    • -
    • RTSP—Application Virtualization Server

    • -
    • RTSP /secure—Enhanced Security Application Virtualization Server

    • -
    -

    Example: SWIPUBSVRTYPE="HTTP /secure"

    SWIPUBSVRHOST

    IP address|host name

    Specifies either the IP address of the Application Virtualization Server or a host name of the server that resolves into the server's IP address; required when SWIPUBSVRDISPLAY is used.

    -

    Example: SWIPUBSVRHOST="SERVER01"

    SWIPUBSVRPORT

    Port number

    Specifies the logical port that is used by this Application Virtualization Server to listen for requests from the client (default = 554).

    -
      -
    • Standard HTTP server—Default = 80.

    • -
    • Enhanced Security HTTP Server—Default = 443.

    • -
    • Application Virtualization Server—Default = 554.

    • -
    • Enhanced Security Application Virtualization Server—Default = 322.

    • -
    -

    Example: SWIPUBSVRPORT="443"

    SWIPUBSVRPATH

    Path name

    Specifies the location on the publishing server of the file that defines file type associations (default = /); required when the SWIPUBSVRTYPE parameter value is HTTP.

    -

    Example: SWIPUBSVRPATH="/AppVirt/appsntypes.xml"

    SWIPUBSVRREFRESH

    [ON|OFF]

    Specifies whether the client automatically queries the publishing server for file type associations and applications when a user logs in to the client (default = ON).

    -

    Example: SWIPUBSVRREFRESH="off"

    SWIGLOBALDATA

    Global data directory

    Specifies the directory where data will be stored that is not specific to particular users (default = C:\Documents and Settings\All Users\Documents).

    -

    Example: SWIGLOBALDATA="D:\Microsoft Application Virtualization Client\Global"

    SWIUSERDATA

    User data directory

    Specifies the directory where data will be stored that is specific to particular users (default = %APPDATA%).

    -

    Example: SWIUSERDATA="H:\Windows\Microsoft Application Virtualization Client"

    SWIFSDRIVE

    Preferred drive letter

    Corresponds to the drive letter that you selected for the virtual drive.

    -

    Example: SWIFSDRIVE="S"

    SYSTEMEVENTLOGLEVEL

    0–4

    Indicates the logging level at which log messages are written to the NT event Log. The value indicates a threshold of what is logged—that is, everything equal to or less than that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged.

    -

    Possible values:

    -
      -
    • 0 == None

    • -
    • 1 == Critical

    • -
    • 2 == Error

    • -
    • 3 == Warning

    • -
    • 4 == Information

    • -

    MINFREESPACEMB

    In MB

    Specifies the amount of free space (in megabytes) that must be available on the host before the cache size can increase. The following example would configure the client to ensure at least 5 GB of free space on the disk before allowing the size of the cache to increase. The default is 5000 MB of free space available on disk at installation time.

    -

    Example: MINFREESPACEMB ="5000" (5 GB)

    KEEPCURRENTSETTINGS

    [0|1]

    Used when you have applied registry settings prior to deploying a client—for example, by using Group Policy. When a client is deployed, set this parameter to a value of 1 so that it will not overwrite the registry settings.

    -
    -Important

    If set to a value of 1, the following client installer command-line parameters are ignored:

    -

    SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, and SWIUSERDATA.

    -

    For further information about setting these values after installation, see “How to Configure the App-V Client Registry Settings by Using the Command Line” in the Application Virtualization (App-V) Operations Guide (https://go.microsoft.com/fwlink/?LinkId=122939).

    -
    -
    - -
    - - - -## Related topics - - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-management-console-overview.md b/mdop/appv-v4/application-virtualization-client-management-console-overview.md deleted file mode 100644 index 1f514c7ba3..0000000000 --- a/mdop/appv-v4/application-virtualization-client-management-console-overview.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Application Virtualization Client Management Console Overview -description: Application Virtualization Client Management Console Overview -author: dansimp -ms.assetid: 21d648cc-eca5-475c-be42-228879b7a45a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Management Console Overview - - -The Microsoft Application Virtualization Client Management Console is a snap-in to the Microsoft Management Console. Administrators and users can use the Application Virtualization Management Console to configure the Desktop Client and Client for Remote Desktop Services (formerly Terminal Services) and manage applications. - -## In This Section - - -[About Application Virtualization Servers](about-application-virtualization-servers.md) -Provides a brief description of the Application Virtualization Management Servers. - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) -Provides the list of user access permissions. - -[Disconnected Operation Mode](disconnected-operation-mode.md) -Describes the disconnected operation mode and circumstances that affect it. - -## Related topics - - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-management-console-reference.md b/mdop/appv-v4/application-virtualization-client-management-console-reference.md deleted file mode 100644 index e13ceabe61..0000000000 --- a/mdop/appv-v4/application-virtualization-client-management-console-reference.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Application Virtualization Client Management Console Reference -description: Application Virtualization Client Management Console Reference -author: dansimp -ms.assetid: aa27537d-e053-45b5-b0ee-cf6606849e0c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Management Console Reference - - -The topics in this section provide detailed information about each of the functional areas of the Application Virtualization Client Management Console. - -## In This Section - - -[Client Management Console: Application Virtualization Node](client-management-console-application-virtualization-node.md) -Describes the screens in the **Application Virtualization** node. - -[Client Management Console: About Dialog Boxes](client-management-console-about-dialog-boxes.md) -Describes the screens in the **About Dialog** node. - -[Client Management Console: Applications Node](client-management-console-applications-node.md) -Describes the screens in the **Applications** node. - -[Client Management Console: File Type Associations Node](client-management-console-file-type-associations-node.md) -Describes the screens in the **File Type Association** node. - -[Client Management Console: Publishing Servers Node](client-management-console-publishing-servers-node.md) -Describes the screens in the **Publishing Servers** node. - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) -Describes the screens for **Application Virtualization Properties**. - -## Related topics - - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md b/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md deleted file mode 100644 index a65de90286..0000000000 --- a/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Application Virtualization Client Management Console Roadmap -description: Application Virtualization Client Management Console Roadmap -author: dansimp -ms.assetid: 3aca02c4-728c-4c34-b90f-4e6f188937b0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Management Console Roadmap - - -The Application Virtualization Client Management Console is a snap-in to the Microsoft Management Console. Administrators and users can use the Application Virtualization Client Management Console to configure the Desktop Client and Client for Remote Desktop Services (formerly Terminal Services) and manage desktops and applications. The following lists represent some of the available procedures in the Client Management Console. - -The following topics detail some general administrative tasks you can perform: - -- [How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) - -- [How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) - -The following topics detail what you can do when configuring the Application Virtualization client: - -- [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) - -- [How to Change the Log Reporting Levels and Reset the Log Files](how-to-change-the-log-reporting-levels-and-reset-the-log-files.md) - -- [How to Change User Access Permissions](how-to-change-user-access-permissions.md) - -- [How to Change Import Search Paths](how-to-change-import-search-paths.md) - -- [How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) - -- [How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) - -The following topics detail what you can do when managing applications: - -- [How to Delete an Application](how-to-delete-an-application.md) - -- [How to Load or Unload an Application](how-to-load-or-unload-an-application.md) - -- [How to Clear an Application](how-to-clear-an-application.md) - -- [How to Import an Application](how-to-import-an-application.md) - -- [How to Change an Application Icon](how-to-change-an-application-icon.md) - -- [How to Lock or Unlock an Application](how-to-lock-or-unlock-an-application.md) - -## Related topics - - -[About Virtual Environments](about-virtual-environments.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-management-console.md b/mdop/appv-v4/application-virtualization-client-management-console.md deleted file mode 100644 index e8e5980d13..0000000000 --- a/mdop/appv-v4/application-virtualization-client-management-console.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Application Virtualization Client Management Console -description: Application Virtualization Client Management Console -author: dansimp -ms.assetid: 18635688-8cbe-40d1-894e-acb2749b4e69 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Management Console - - -The Microsoft Application Virtualization Client Management Console is a snap-in to the Microsoft Management Console. Administrators and users can use the Application Virtualization Management Console to configure the Desktop Client and Client for Remote Desktop Services (formerly Terminal Services) and manage applications. - -## In This Section - - -[Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) -Provides general information about the tasks you can perform by using the Virtualization Client Management Console. - -[How to Perform General Administrative Tasks in the Client Management Console](how-to-perform-general-administrative-tasks-in-the-client-management-console.md) -Provides procedures that you can use to set up the Publishing Server and to refresh applications. - -[How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md) -Provides procedures that you can use to manage applications. - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) -Provides procedures that you can use to configure Desktop Client and Client for Remote Desktop Services. - -[How to Manually Manage Applications in the Client Management Console](how-to-manually-manage-applications-in-the-client-management-console.md) -Provides procedures that you can use to manually manage applications. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-reference.md b/mdop/appv-v4/application-virtualization-client-reference.md deleted file mode 100644 index bc3dbef0d8..0000000000 --- a/mdop/appv-v4/application-virtualization-client-reference.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Application Virtualization Client Reference -description: Application Virtualization Client Reference -author: dansimp -ms.assetid: 5107f567-9ac8-43e1-89c8-5e0762e3ddd8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client Reference - - -This section provides reference information that is related to installing and managing the Application Virtualization (App-V) Client and the virtual application packages that are created by the Application Virtualization (App-V) Sequencer. - -## In This Section - - -[SFTMIME Command Reference](sftmime--command-reference.md) -Provides a detailed list of all SFTMIME parameters. - -[SFTTRAY Command Reference](sfttray-command-reference.md) -Lists and describes all SFTTRAY commands and command-line switches. - -[Application Virtualization Client WMI Provider](application-virtualization-client-wmi-provider.md) -Describes the Windows Management Instrumentation (WMI) classes that are available in the App-V Client WMI Provider. - -[Log File for the Application Virtualization Client](log-file-for-the-application-virtualization-client.md) -Provides information about the log file for the App-V Client. - -[App-V Client Registry Values](app-v-client-registry-values-sp1.md) -Provides a detailed list and descriptions of registry key values. - -[App-V Interoperability with Windows AppLocker](app-v-interoperability-with-windows-applocker.md) -Provides information on how to configure AppLocker rules for virtual applications. - -[Support for Client Reporting over HTTP](support-for-client-reporting-over-http.md) -Provides an overview of the Client Reporting process for HTTP publishing. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client-wmi-provider.md b/mdop/appv-v4/application-virtualization-client-wmi-provider.md deleted file mode 100644 index dd3b3f8eae..0000000000 --- a/mdop/appv-v4/application-virtualization-client-wmi-provider.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Client WMI Provider -description: Application Virtualization Client WMI Provider -author: dansimp -ms.assetid: 384e33e0-6689-4e28-af84-53acee8a5c24 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client WMI Provider - - -This section contains detailed information about the Application Virtualization (App-V) Client Windows Management Instrumentation (WMI) Provider. All the classes that are described are in the WMI root\\microsoft\\appvirt\\client namespace. - -You can use a query tool such as wbemtest.exe or a scripting language such as Windows PowerShell or VBScript to retrieve key information about packages and applications from the clients for reporting purposes. The information available includes details on package status, cache size, and usage data. - -## In This Section - - -[App-V Application WMI Class](app-v-application-wmi-class.md) -Represents an individual application object in a package. - -[App-V Package WMI Class](app-v-package-wmi-class.md) -Represents an individual virtual package that can contain multiple applications. - -## Related topics - - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-client.md b/mdop/appv-v4/application-virtualization-client.md deleted file mode 100644 index 819dd8bed1..0000000000 --- a/mdop/appv-v4/application-virtualization-client.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Application Virtualization Client -description: Application Virtualization Client -author: dansimp -ms.assetid: d9e1939b-eb9c-49a0-855d-f4c323b84c2f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Client - - -You can use the procedures in this section to configure and manage the Microsoft Application Virtualization (App-V) Client. Procedures are provided for manual interaction with the App-V Client by using the App-V Client Management Console and also by using the command line. - -## In This Section - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) -Includes information about using the features and commands that are available from the Windows desktop notification area. - -[How to Manage Virtual Applications Manually](how-to-manage-virtual-applications-manually.md) -Provides information about how to manage the virtual applications by using the App-V Client Management Console. - -[How to Configure the Application Virtualization Client Settings Manually](how-to-configure-the-application-virtualization-client-settings-manually.md) -Provides a set of procedures that you can use to configure App-V Client settings by using the App-V Client Management Console. - -[How to Manage Virtual Applications by Using the Command Line](how-to-manage-virtual-applications-by-using-the-command-line.md) -Provides important procedures you can use to manage virtual applications and packages by using the SFTMIME command-line language. - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) -Provides a set of procedures you can use to change the configuration of the App-V Client. - -[Troubleshooting Information for the Application Virtualization Client](troubleshooting-information-for-the-application-virtualization-client.md) -Provides information about troubleshooting the App-V Client. - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) -Contains detailed technical reference material related to installing and managing system components. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[Application Virtualization Server](application-virtualization-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md deleted file mode 100644 index 4bd4d4fe49..0000000000 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Application Virtualization Deployment and Upgrade Checklists -description: Application Virtualization Deployment and Upgrade Checklists -author: dansimp -ms.assetid: 462e5119-cb83-4548-98f2-df668aa0958b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Deployment and Upgrade Checklists - - -The topics in this section provide checklists that you can use when installing the Microsoft Application Virtualization (App-V) system. - -## In This Section - - -[App-V Pre-Installation Checklist](app-v-pre-installation-checklist.md) -Describes the tasks that must be completed before starting the installation of the App-V system. - -[App-V Installation Checklist](app-v-installation-checklist.md) -Describes the tasks that must be completed while installing the App-V system. - -[App-V Postinstallation Checklist](app-v-postinstallation-checklist.md) -Describes the tasks that must be completed after the installation of the App-V system. - -[App-V Upgrade Checklist](app-v-upgrade-checklist.md) -Describes the tasks to be completed when upgrading the App-V system and the correct sequence for those tasks. - -## Related topics - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md deleted file mode 100644 index d71379b47f..0000000000 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Application Virtualization Deployment and Upgrade Considerations -description: Application Virtualization Deployment and Upgrade Considerations -author: dansimp -ms.assetid: c3c38930-0da3-43e6-b240-945edfd00a01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Deployment and Upgrade Considerations - - -Before you begin the deployment of Microsoft Application Virtualization (App-V), you might have to review your environment requirements that includes the hardware and software requirements for installing the various Application Virtualization components. Also, if you are upgrading from an earlier version, the topics in this section provide information about how to upgrade your current Sequencer, Server, and Client versions. - -## In This Section - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) -Provides general information about system requirements and upgrade considerations for your Application Virtualization deployment. - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) -Provides detailed lists of installation and upgrade tasks with links to the specific procedures. - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) -Describes how to install the Application Virtualization (App-V) platform components required for your server-based deployment. - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -Describes how to install the Application Virtualization Client software. - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) -Describes how to install the Application Virtualization Sequencer. - -[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) -Describes how to upgrade the Application Virtualization Desktop Client or the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services). - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) -Describes how to upgrade the software components installed on all Application Virtualization Management System computers. - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) -Describes how to upgrade the Sequencer on computers that are running Windows Vista or Windows XP. - -## Related topics - - -[Application Virtualization Reference](application-virtualization-reference.md) - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md deleted file mode 100644 index c09ced741d..0000000000 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Application Virtualization Deployment and Upgrade Considerations -description: Application Virtualization Deployment and Upgrade Considerations -author: dansimp -ms.assetid: adc562ee-7276-4b14-b10a-da17f05e1682 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Deployment and Upgrade Considerations - - -Before you begin the deployment of Microsoft Application Virtualization, you might need to review your environment requirements, including the hardware and software requirements for installing the various Application Virtualization components. Also, if you are upgrading from a previous version, the topics in this section provide information about upgrading your current Sequencer, server, and client versions. - -## In This Section - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) -Provides general information about system requirements and upgrade considerations for your Application Virtualization deployment. - -[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) -Provides step-by-step procedures for upgrading the Application Virtualization Desktop Client or the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services). - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) -Provides a step-by-step procedure you can use to upgrade the software components installed on all Application Virtualization System computers. - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) -Provides step-by-step procedures for upgrading the Sequencer on computers running Windows Vista or Windows XP. - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) -Provides a step-by-step procedure for installing the Sequencer. - -## Related topics - - -[Application Virtualization Reference](application-virtualization-reference.md) - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-deployment-requirements.md b/mdop/appv-v4/application-virtualization-deployment-requirements.md deleted file mode 100644 index 9baee67d59..0000000000 --- a/mdop/appv-v4/application-virtualization-deployment-requirements.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Application Virtualization Deployment Requirements -description: Application Virtualization Deployment Requirements -author: dansimp -ms.assetid: 9564e974-a853-45ae-b605-0a2e3e5cf212 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Deployment Requirements - - -Before you deploy Microsoft Application Virtualization (App-V) in your environment, you should verify that you can meet the hardware and software requirements for the components you plan to deploy, according to your chosen deployment scenario. - -## In This Section - - -[Application Virtualization System Requirements](application-virtualization-system-requirements.md) -Describes the recommended hardware and software requirements for each of the Application Virtualization System components. - -[Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) -Describes the minimum recommended hardware and software configuration for your Microsoft Application Virtualization Sequencer workstation. - -[Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) -Describes the recommended minimum hardware and software configuration for your installation of the Application Virtualization Desktop Client and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services). - -[Configuring Prerequisite Groups in Active Directory for App-V](configuring-prerequisite-groups-in-active-directory-for-app-v.md) -Describes the objects that you must install in Active Directory groups before you install the App-V system. - -[How to Configure Windows Server 2008 for App-V Management Servers](how-to-configure-windows-server-2008-for-app-v-management-servers.md) -Describes how to configure the server running Windows Server 2008 by installing Internet Information Services (IIS) as a role so that you can install the App-V Management Web Service. - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) -Provides checklists of tasks to guide you through the correct sequence when installing or upgrading the App-V system. - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-glossary.md b/mdop/appv-v4/application-virtualization-glossary.md deleted file mode 100644 index 3669509527..0000000000 --- a/mdop/appv-v4/application-virtualization-glossary.md +++ /dev/null @@ -1,208 +0,0 @@ ---- -title: Application Virtualization Glossary -description: Application Virtualization Glossary -author: dansimp -ms.assetid: 9eb71774-e288-4f94-8f94-5b98e0d012a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Glossary - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TermDefinition

    active upgrade

    An upgrade that enables a new version of an application to be added to an App-V Management Server or Streaming Server without affecting users currently running the application.

    Application Source Root

    Reference to a registry key that allows an override of the OSD CODEBASE for the HREF element (for example, the source location). This registry value enables an administrator or ESD system to ensure application loading is performed according to a planned topology management scheme.

    Application Virtualization drive

    The default virtual application client drive (Q:) from which sequenced applications are run.

    Application Virtualization reporting

    Virtual application information gathered for data analysis. Data is collected for assembly of custom views and interpretation.

    AutoLoad configuration parameter

    A client runtime policy configuration parameter that enables the secondary feature block of a virtualized application to be streamed to the client automatically in the background.

    branch a package

    To upgrade an existing sequenced application package and run it side-by-side with the original sequenced application package.

    Dynamic Suite Composition

    An Application Virtualization feature that enables a virtual application package to allow dependent plug-ins or middleware packages to use the virtual environment. This feature enables plug-ins and middleware packages to use the primary package's registry settings, and the packages behave and interact with one another in the same way as if they were installed locally on a comuter.

    ICO file

    The file for the icon on the client's desktop used to launch a sequenced application.

    Icon Source Root

    Reference to a registry key that allows specification of a source location for icon retrieval for a sequenced application package during publication. Icon Source Roots support UNC formats only (not URLs).

    Installation directory

    The directory where the installer for the application virtualization sequencer places its files.

    Microsoft Application Virtualization Desktop Client

    An application that resides on a Windows-based computer desktop and which communicates and authenticates with the Microsoft System Center Virtual Application Server to receive the application code and allow a sequenced application to be run locally.

    Microsoft Application Virtualization for Terminal Services

    The Application Virtualization feature, including both client and server components, running in a Terminal Services environment.

    Microsoft Application Virtualization Management Console

    Centralized snap-in to the Microsoft Management Console, which you use to administer the Application Virtualization Management System.

    Microsoft Application Virtualization Management System

    A specific deployment of the Application Virtualization platform that includes all of the components that are managed by a single data store.

    Microsoft Application Virtualization Management Web Service

    A service that acts as an intermediary between the Application Virtualization Management Console and the data store. First it authenticates its users, and then it allows authorized administrators to manipulate data in the data store.

    Microsoft Application Virtualization platform

    Name for the Microsoft products that are used to create, store, distribute, and run virtualized applications.

    Microsoft Application Virtualization Sequencer

    Application that monitors and records the installation and setup process for applications so that an application can be sequenced and run in the virtual environment.

    Microsoft Application Virtualization Terminal Services Client

    An application that resides on a Terminal Server and which communicates and authenticates with the Microsoft Virtual Application Server to receive the application code and allow a sequenced application to be run locally.

    Microsoft System Center Application Virtualization Management Server

    One of two Application Virtualization server types from which a sequenced application package can be streamed. In addition to streaming virtual application packages, the Application Virtualization Management Server offers other services such as publishing, management, reporting, and so on.

    Microsoft System Center Application Virtualization Streaming Server

    One of two Application Virtualization server types from which a sequenced application package can be streamed. The Streaming Server streams applications to the client computers only and does not offer other services such as publishing, management, reporting, and so on.

    Open Software Descriptor (OSD) file

    An XML-based file that instructs the client on how to retrieve the sequenced application from the Application Virtualization Management/Streaming Server and how to run the sequenced application in its virtual environment.

    OSD Source Root

    Reference to a registry key that allows specification of a source location for OSD file retrieval for an application package during publication. OSD Source Roots support UNC formats only (not URLs).

    package root directory

    The directory on the sequencing computer on which files for the sequenced application package are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed.

    primary feature block

    The minimum content in an application package that is necessary for an application to run. The content in the primary feature block is identified during the application phase of sequencing and typically consists of the content for the most used application features.

    secondary feature block

    The remainder of the application package that is not contained in the primary feature block. This content is streamed to the client on demand as application features are used.

    sequenced application

    An application that has been monitored by the Sequencer, broken up into primary and secondary feature blocks, streamed to a computer running the Microsoft Application Virtualization Terminal Services Client or the Microsoft Application Virtualization Desktop Client, and can run inside of its own virtual environment.

    sequenced application package

    The files that comprise a virtual application and allow a virtual application to run. These files are created after sequencing and specifically include .osd, .sft, .sprj, and .ico files.

    sequencing

    The process of creating an application package by using the Application Virtualization Sequencer. In this process, an application is monitored, its shortcuts are configured, and a sequenced application package is created containing the .osd, .sft, .sprj, and .ico files.

    sequencing computer

    The computer used to perform sequencing and create a sequenced application package.

    Sequencing Wizard

    Step-by-step wizard that walks the user through sequencing an application, including package configuration, installing the application or applications to be sequenced, and sequencing the application package for streaming.

    SFT

    A file that contains one or more sequenced applications that the Sequencer has packaged into streaming blocks, as well as the associated delivery information. The SFT file is stored on each server that must stream the packaged applications to a client.

    SFTMIME

    A command-line interface for setting up and managing applications, file type associations, and desktop configuration servers managed by Application Virtualization Desktop and Terminal Services Clients.

    SPRJ file

    An XML-based Sequencer Project file, in which the Sequencer stores its Exclusion Items and Parse Items information. The SPRJ file is used heavily in the creation of application records as well as during an upgrade to a package.

    virtual application

    An application packaged by the Sequencer to run in a self-contained, virtual environment. The virtual environment contains the information necessary to run the application on the client without installing the application locally.

    Virtual COM

    The subsystem that manages COM objects created by application processes running in a virtual environment and prevents conflict with the same objects created outside the virtual environment.

    virtual directory

    An opaque directory where only files and subdirectories defined in the application package or created through interaction with an application in a virtual environment are visible. Any files in an identically named local directory are not visible to the application.

    virtual environment

    A runtime container that defines the resources available to application processes launched from a sequenced application package.

    virtual file

    A file name within the virtual environment that is mapped to an alternate target location. A virtual file appears alongside other files in the containing directory, regardless of whether that directory is virtual or local.

    virtual file system

    The subsystem that intercepts and redirects file system requests from application processes running in a virtual environment. These requests are processed based on the virtual files and directories defined in the application package and created or modified through interaction with a virtual application.

    virtual registry

    The subsystem that intercepts and redirects registry requests for keys and values from application processes running in a virtual environment. The redirection is based on the registry information defined in the application package and created or modified through interaction with a virtual application.

    virtual services

    The subsystem that acts as the Service Control Manager (SCM) for services running in a virtual environment.

    - -  - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md b/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md deleted file mode 100644 index 9b480ae5f3..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Properties Connectivity Tab -description: Application Virtualization Properties Connectivity Tab -author: dansimp -ms.assetid: e07c1352-a2be-4d99-9968-daba515bcde2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: Connectivity Tab - - -Use the **Connectivity** tab of the **Application Virtualization Properties** dialog box to specify the connectivity settings. - -This tab contains the following elements. - -**Allow disconnected operation** -Use this check box to enable or disable disconnected operation. - -**Limit disconnected operation to \_\_\_\_ days** -Use this check box and field to set an expiration time-out for disconnected operation. The expiration length in days can be any number from 1–999999. - -**Work offline** -Use this check box to enable and disable offline operation. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-file-system-tab.md b/mdop/appv-v4/application-virtualization-properties-file-system-tab.md deleted file mode 100644 index fe4acb134a..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-file-system-tab.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Application Virtualization Properties File System Tab -description: Application Virtualization Properties File System Tab -author: dansimp -ms.assetid: c7d56d36-8c50-4dfc-afee-83dea06376d4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: File System Tab - - -Use the **File System** tab of the **Application Virtualization Properties** dialog box to view and monitor file system settings. - -This tab contains the following elements. - -**Client Cache Configuration Settings** -This section enables you to configure the client cache settings. Click one of the following radio buttons to choose how to manage the cache space: - -- **Use maximum cache size** - - Enter a numeric value from 100 to 1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size in MB of the cache. The value shown in **Reserved Cache Size** indicates the amount of cache in use. - -- **Use free disk space threshold** - - Enter a numeric value to specify the amount of free disk space, in MB, that the cache must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is unused. - -**Drive Letter** -This field displays the current drive being used. To change the drive, select any drive letter from the drop-down list of available drives. This setting becomes effective when the computer is rebooted. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-general-tab.md b/mdop/appv-v4/application-virtualization-properties-general-tab.md deleted file mode 100644 index 375209e344..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-general-tab.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Application Virtualization Properties General Tab -description: Application Virtualization Properties General Tab -author: dansimp -ms.assetid: be7449d9-171a-4a11-9382-83b7008ccbdd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: General Tab - - -Use the **General** tab of the **Application Virtualization Properties** dialog box to modify log settings and data locations. - -This tab contains the following elements. - -**Log Level** -Select the level from the drop-down list. The default level is **Information**. - -**Reset Log** -Click this button to back up the current log file and immediately start a new log file. - -**Location** -Enter or browse to the location where you want to save the log file sftlog.txt. The default locations are as follows: - -- For Windows XP, Windows Server 2003—*C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Application Virtualization Client* - -- For Windows Vista, Windows 7, Windows Server 2008—*C:\\ProgramData\\Microsoft\\Application Virtualization Client* - -**System Log Level** -Select the level from the drop-down list. The default level is **Warning**. - -**Note**   -The **System Log Level** setting controls the level of messages sent to the system event log. The logged messages are identical to the messages that get logged to the client event log, but they are stored in a different location that does not have the space limitations of the client event log. Because the system event log does not have space limitations, it is ideally suited for situations where verbose logging is necessary. - - - -**Global Data Directory** -Enter or browse to the location of the directory of the log file. The default locations are as follows: - -- For Windows XP, Windows Server 2003—*C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Application Virtualization Client* - -- For Windows Vista, Windows 7, Windows Server 2008—*C:\\ProgramData\\Microsoft\\Application Virtualization Client* - -**User Data Directory** -Enter or browse to the location of the directory where user-specific data is stored. The default is %APPDATA%. This path must be a valid environment variable on the client computer. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md b/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md deleted file mode 100644 index ada91ffa6f..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Properties Import Search Path Tab -description: Application Virtualization Properties Import Search Path Tab -author: dansimp -ms.assetid: 7f94d472-1d0a-49d8-b307-330936071e13 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: Import Search Path Tab - - -Use the **Import Search Path** tab of the **Application Virtualization Properties** dialog to view and manage the search paths for importing SFT files. - -This tab contains the following elements. - -**Path Window** -This window displays the SFT paths. - -**Add** and **Remove** -Use these buttons to add or remove SFT search paths. - -**Move up** and **Move Down** -Use these buttons to organize the SFT search paths. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-interface-tab.md b/mdop/appv-v4/application-virtualization-properties-interface-tab.md deleted file mode 100644 index fedbe93af5..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-interface-tab.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Properties Interface Tab -description: Application Virtualization Properties Interface Tab -author: dansimp -ms.assetid: bb9cb54e-315a-48bf-a396-b33e2cbd030a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: Interface Tab - - -Use the **Interface** tab of the **Application Virtualization Properties** dialog box to control default settings for user-interface components. - -This tab contains the following elements. - -**Run Settings** radio buttons -Select **Always**, **Only**, or **Do not show** to determine when the Application Virtualization Client is visible in the Windows desktop notification area. - -**Error message display time** -Enter a duration (in seconds) to determine how long error messages are visible in the desktop notification area. The minimum allowable value is 10. - -**Information message display time** -Enter a duration (in seconds) to determine how long information messages are visible in the desktop notification area. If you set this value to zero, all messages except error messages are suppressed. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-properties-permissions-tab.md b/mdop/appv-v4/application-virtualization-properties-permissions-tab.md deleted file mode 100644 index b830275c12..0000000000 --- a/mdop/appv-v4/application-virtualization-properties-permissions-tab.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Application Virtualization Properties Permissions Tab -description: Application Virtualization Properties Permissions Tab -author: dansimp -ms.assetid: 5219bc7c-7c7a-4e2f-8fba-7039933d1124 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Properties: Permissions Tab - - -Use the **Permissions** tab of the **Application Virtualization Properties** dialog box to specify which activities are available for non-administrators on the local computer. Select the check boxes that correspond to the items you want to make available to all users. Users who do not have administrative rights can view this page and see which items are selected, but they cannot modify the list. - -## Related topics - - -[Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md) - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-reference.md b/mdop/appv-v4/application-virtualization-reference.md deleted file mode 100644 index 11b374d4e3..0000000000 --- a/mdop/appv-v4/application-virtualization-reference.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Application Virtualization Reference -description: Application Virtualization Reference -author: dansimp -ms.assetid: 5f994be7-41fa-416b-8a4c-6ed52fcd9b72 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Reference - - -This section provides reference information related to installing and managing the Microsoft Application Virtualization Client and the virtual application packages created by the Application Virtualization Sequencer. - -## In This Section - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) -Provides details of all the command-line parameters that are available for use when installing the client. - -[SFTMIME Command Reference](sftmime--command-reference.md) -Provides a detailed list of all SFTMIME parameters. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-report-types.md b/mdop/appv-v4/application-virtualization-report-types.md deleted file mode 100644 index 3e81bdd8f6..0000000000 --- a/mdop/appv-v4/application-virtualization-report-types.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Application Virtualization Report Types -description: Application Virtualization Report Types -author: dansimp -ms.assetid: 232ef25e-11a0-49fb-b4b3-54ac83577383 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Report Types - - -From the Application Virtualization Server Management Console, you can generate a variety of reports that provide information about the system. This information includes usage information for applications and system error tracking. - -## In This Section - - -[System Utilization Report](system-utilization-reportserver.md) -Graphs the total daily usage, to help you determine the load on your Application Virtualization System. - -[Software Audit Report](software-audit-reportserver.md) -Lists the usage information during the reporting period for all applications defined in the database, to help you determine which applications are the most heavily used. - -[Application Utilization Report](application-utilization-reportserver.md) -Tracks usage information for a specified application, to help you determine how heavily a specific application is used. - -[System Error Report](system-error-reportserver.md) -Tracks the number of errors and warnings logged over time during the specified reporting period for the specified server or for the specified server group. - -## Related topics - - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-command-line.md b/mdop/appv-v4/application-virtualization-sequencer-command-line.md deleted file mode 100644 index abbc660844..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-command-line.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Application Virtualization Sequencer Command Line -description: Application Virtualization Sequencer Command Line -author: dansimp -ms.assetid: a6d5ec9f-cc66-4869-9250-5c65d7e1e58e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Command Line - - -You can use the Microsoft Application Virtualization (App-V) Sequencer to create virtual application packages using the command line. This method of sequencing is faster than sequencing using the **Sequencing** Wizard and is ideal if you are sequencing a large number of applications. - -## In This Section - - -[Command-Line Parameters](command-line-parameters.md) -Provides information about the Sequencer command line parameters. - -[Command-Line Errors](command-line-errors.md) -Provides information about common command line errors. - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-console-overview.md b/mdop/appv-v4/application-virtualization-sequencer-console-overview.md deleted file mode 100644 index 1669e0fe12..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-console-overview.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Application Virtualization Sequencer Console Overview -description: Application Virtualization Sequencer Console Overview -author: dansimp -ms.assetid: 681bb40d-2937-4645-82aa-4a44775232d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Console Overview - - -The Application Virtualization (App-V) Sequencer creates applications so that they can be run in a virtual environment, as virtual applications. After an application has been sequenced, it can run from an App-V Server to target computers that are running the App-V Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services) by using a process called streaming. The App-V Sequencer monitors the installation and setup process for applications, and it records all the information necessary for the application to run in the virtual environment. This process also determines which files and configurations are applicable to all users and which configurations users can customize. Virtual applications run on target computers and have no effect on the operating system running on the target computer or on any applications that are installed on the target computer. - -## Application Virtualization Sequencer Security Considerations - - -The App-V Sequencer runs all services detected at sequencing time using the Local System account and does not enforce security descriptors on service control requests. If the service was installed using a different user account or if the security descriptors are intended to grant different user groups specific service permissions, consider carefully whether the service should be virtualized. In some cases, you should install the service locally to ensure that the intended service security is preserved. - -## Application Virtualization Sequencer Console Menu Options - - -The following menu items are available in the App-V Sequencer Console: - -- **File**—Contains various commands to help create, open, modify, and save sequenced applications. - -- **Edit**—Contains various commands for editing existing virtual applications. - -- **View**—Contains various commands for viewing properties of a virtual application. - -- **Tools**—Contains various tools and diagnostics for configuring virtual applications. - -## Application Virtualization Sequencer Console Toolbar Options - - -The following toolbar buttons are available in the App-V Sequencer Console: - -- **New Package**—Click to create a new sequenced application. - -- **Open**—Click to open a sequenced application package in the App-V Sequencer Console. - -- **Open for Upgrade**—Click to open a sequenced application to upgrade or apply an update. - -- **Save**—Click to save a sequenced virtual application. - -- **Sequencing Wizard**—Click to open the Sequencing Wizard. You should use this button to start the Sequencing Wizard if you make any changes on the **General** tab under **Tools** / **Options**. - -## Virtual Application Tabs - - -The following tabs are displayed when you view a virtual application in the App-V Sequencer Console: - -- **Properties**—Displays information about the selected virtual application. You can update the **Package Name** and **Comments** associated with the virtual application. - -- **Deployment**—Displays information about how the virtual application will be accessed by target computers. You can configure the virtual application delivery method, and you can configure which operating systems must be running on the target computer. You can also configure the associated output options. If you plan to have clients access a virtual application from a file, use the following format when specifying the path: **File://server/share/path/.sft**. Select **Enforce Security Descriptors** to preserve security associated with the package during an upgrade, or the permissions will be reset during the upgrade. - -- **Change History**—Displays information about updates that have been made to the virtual application. - -- **Files**—Displays the files associated with the selected virtual application. You can make minor revisions to the associated file properties by using the appropriate fields. - -- **Virtual Registry**—Displays the virtual registry associated with the selected virtual application. You can add or delete registry keys by right-clicking the appropriate entry. - -- **Virtual File System**—Displays the virtual file systems associated with the selected virtual application. You can add, delete, or edit file system entries on this tab by right-clicking the appropriate entry and selecting the option. - -- **Virtual Services**—Displays the services associated with the selected virtual application. - -- **OSD**—Displays information about the Open Software Descriptor (OSD) associated with the virtual application. You can update the files associated with the OSD file by right-clicking the appropriate entry and selecting the action that you want. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md deleted file mode 100644 index cc7fa3c205..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md +++ /dev/null @@ -1,282 +0,0 @@ ---- -title: Application Virtualization Sequencer Hardware and Software Requirements -description: Application Virtualization Sequencer Hardware and Software Requirements -author: dansimp -ms.assetid: c88a1b5b-23e1-4460-afa9-a5f37e32eb05 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Hardware and Software Requirements - - -This topic describes the minimum recommended hardware and software requirements for the computer running the Microsoft Application Virtualization (App-V) Sequencer. - -**Important**   -You must run the App-V sequencer (**SFTSequencer.exe**) using an account that has administrator privileges because of the changes the sequencer makes to the local system. These changes can include writing files to the **C:\\Program Files** directory, making registry changes, starting and stopping services, updating security descriptors for files, and changing permissions. - - - -Before you install the Sequencer and after you sequence each application, you must restore a clean operating system image to the sequencing computer. You can use one of the following methods to restore the computer running the Sequencer: - -- Reformat the hard drive and reinstall the operating system. - -- Restore the hard drive on the computer running the Sequencer image by using another disk-imaging software. - -- Revert a virtual operating system image such as a Microsoft Virtual PC image. Using a virtual machine allows for clean sequencing environments to be easily reused with minimal administration. - -The following list outlines the recommended hardware requirements for running the App-V Sequencer. - -The requirements are listed first for Microsoft Application Virtualization (App-V) 4.6 SP2, followed by the requirements for versions that preceded App-V 4.6 SP2. - -### Hardware Requirements - -- Processor—Intel Pentium III, 1 GHz (32-bit or 64-bit). The sequencing process is a single-threaded process and does not take advantage of dual processors. - -- Memory—1 GB or above, 2 GB recommended. - -- Hard disk—40 gigabyte (GB) hard disk space with a minimum of 15 GB available hard disk space. We recommend that you have at least three times the hard disk space that the application you are sequencing requires. - - **Note**   - Sequencing requires heavy disk usage. A fast disk speed can decrease the sequencing time. - - - -### Software Requirements for App-V 4.6 SP2 - -The following list outlines the supported operating systems for running the App-V 4.6 SP2 Sequencer. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows XP

    Professional

    SP3

    x86

    Windows Vista

    Business, Enterprise, or Ultimate

    SP2

    x86

    Windows 7

    Professional, Enterprise, or Ultimate

    No service pack or SP1

    x86 and x64

    Windows 8

    Pro or Enterprise Edition

    x86 and x64

    - - - -**Note**   -The Application Virtualization (App-V) 4.6 SP2 Sequencer supports 32-bit and 64-bit versions of these operating systems. - - - -You should configure computers running the Sequencer with the same applications that are installed on targeted computers. - -### Software Requirements for Versions that Precede App-V 4.6 SP2 - -The following list outlines the supported operating systems for running the Sequencer for versions that precede App-V 4.6 SP2. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows XP

    Professional

    SP2 or SP3

    x86

    Windows Vista

    Business, Enterprise, or Ultimate

    No service pack, SP1, or SP2

    x86

    Windows 7¹

    Professional, Enterprise, or Ultimate

    x86

    - - - -¹Supported for App-V 4.5 with SP1 or SP2, and App-V 4.6 only - -**Note**   -The Application Virtualization (App-V) 4.6 Sequencer supports 32-bit and 64-bit versions of these operating systems. - - - -You should configure computers running the Sequencer with the same applications that are installed on targeted computers. - -### Software Requirements for Remote Desktop Services for App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2003 R2

    Standard Edition, Enterprise Edition, or Datacenter Edition

    SP2

    x86

    Windows Server 2008

    Standard, Enterprise, or Datacenter Edition

    SP2

    x86

    Windows Server 2008 R2

    Standard, Enterprise, or Datacenter Edition

    No service pack or SP1

    x64

    Windows Server 2012

    Standard, Enterprise, or Datacenter Edition

    x86 or x64

    - - - -**Note**   -Application Virtualization (App-V) 4.6 SP2 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems. - - - -### Software Requirements for Remote Desktop Services for Versions that Precede App-V 4.6 SP2 - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2003

    Standard Edition, Enterprise Edition, or Datacenter Edition

    SP1 or SP2

    x86

    Windows Server 2003 R2

    Standard Edition, Enterprise Edition, or Datacenter Edition

    No service pack or SP2

    x86

    Windows Server 2008

    Standard, Enterprise, or Datacenter Edition

    SP1 or SP2

    x86

    Windows Server 2008 R2

    Standard, Enterprise, or Datacenter Edition

    No service pack or SP1

    x64

    - - - -**Note**   -Application Virtualization (App-V) 4.6 SP2 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems. - - - -## Related topics - - -[Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) - -[Application Virtualization System Requirements](application-virtualization-system-requirements.md) - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-online-help.md b/mdop/appv-v4/application-virtualization-sequencer-online-help.md deleted file mode 100644 index 3164dedaf1..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-online-help.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Application Virtualization Sequencer Online Help -description: Application Virtualization Sequencer Online Help -author: dansimp -ms.assetid: 0ddeae59-314f-4c61-b85f-6b137b959fa6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Online Help - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records the installation and setup processes for software applications. Use the Sequencer to create a sequenced application that runs inside a virtual environment. The Sequencer packages the sequenced application and creates a virtual application that can be distributed to target computers and that runs in a self-contained, virtual environment. The virtual environment contains the information necessary to run the virtual application on the target computer without interacting with the operating system installed on the target computer. - -For more information about the App-V Sequencer, see the following topics: - -- [Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) - -- [Sequencer Hardware and Software Requirements](sequencer-hardware-and-software-requirements.md) - -- [Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) - -- [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - -- [Troubleshooting the Application Virtualization Sequencer](troubleshooting-the-application-virtualization-sequencer.md) - -- [Application Virtualization Sequencer Technical Reference](application-virtualization-sequencer-technical-reference-keep.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md deleted file mode 100644 index 894504a132..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Sequencer Options Dialog Box -description: Application Virtualization Sequencer Options Dialog Box -author: dansimp -ms.assetid: f71eda8d-8270-439f-a093-867b3a43ebff -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Options Dialog Box - - -Use the **Options** dialog box to configure and view the Microsoft Application Virtualization (App-V) settings. - -## In This Section - - -- [General Tab](general-tab-keep.md) - -- [Parse Items Tab](parse-items-tab-keep.md) - -- [Exclusion Items Tab](exclusion-items-tab-keep.md) - -- [Exclusion Item Dialog Box](exclusion-item-dialog-box.md) - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-overview.md b/mdop/appv-v4/application-virtualization-sequencer-overview.md deleted file mode 100644 index efe77f6f0e..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-overview.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Application Virtualization Sequencer Overview -description: Application Virtualization Sequencer Overview -author: dansimp -ms.assetid: e6422a28-633e-4dff-8abb-7cf6a5468112 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Overview - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records all installation and setup processes for an application and creates the following files: **ICO**, **OSD**, **SFT**, and **SPRJ**. These files contain all the necessary information about an application so the application can run in a virtual environment. - -Click the associated link for more information about the App-V Sequencer: - -## In This Section - - -[About the Application Virtualization Sequencer](about-the-application-virtualization-sequencer.md) -Provides general information about the sequencer. - -[About the Sequencer Console](about-the-sequencer-console.md) -Provides information about the App-V sequencer console. - -[About Using the Sequencer Command Line](about-using-the-sequencer-command-line.md) -Provides information about using the command line to sequence applications. - -[Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -Provides important security-related planning information about setting up the Application Virtualization Sequencer to sequence application packages. - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-reference.md b/mdop/appv-v4/application-virtualization-sequencer-reference.md deleted file mode 100644 index 69240cc62a..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-reference.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Application Virtualization Sequencer Reference -description: Application Virtualization Sequencer Reference -author: dansimp -ms.assetid: a2aef256-98c0-4f81-83a2-af4b64208088 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Reference - - -This section provides reference information related to managing the Application Virtualization (App-V) Sequencer. - -## In This Section - - -[Log Files for the Application Virtualization Sequencer](log-files-for-the-application-virtualization-sequencer.md) -Provides detailed information about the App-V Sequencer log files. - -[Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) -Provides information about parameters you can use to sequence an application and to upgrade an existing virtual application. - -[Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) -Provides a list of errors that are related to sequencing applications. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md b/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md deleted file mode 100644 index 36c372bd1c..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Application Virtualization Sequencer Technical Reference -description: Application Virtualization Sequencer Technical Reference -author: dansimp -ms.assetid: 4aa515ce-64f0-4998-8100-f87dc77aed70 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer Technical Reference - - -The Microsoft Application Virtualization (App-V) Sequencer Reference section contains technical information that you might find helpful as you work with the App-V Sequencer. - -## In This Section - - -- [Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -- [Sequencing Wizard](sequencing-wizard.md) - -- [Sequencer Console](sequencer-console.md) - -- [Application Virtualization Sequencer Command Line](application-virtualization-sequencer-command-line.md) - -## Related topics - - -[Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencer.md b/mdop/appv-v4/application-virtualization-sequencer.md deleted file mode 100644 index 3f31f87b42..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencer.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Application Virtualization Sequencer -description: Application Virtualization Sequencer -author: dansimp -ms.assetid: f078f3c9-7b5c-4ff1-b319-4c076b88bc39 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencer - - -Sequencing is the process by which you create an application package using the Microsoft Application Virtualization (App-V) Sequencer. The App-V Sequencer monitors and records all installation and setup processes for an application and creates the following files: ICO, OSD, SFT, and SPRJ. These files contain all the necessary information about an application, and they allow that application to run in a virtual environment. - -## In This Section - - -[Application Virtualization Sequencer Console Overview](application-virtualization-sequencer-console-overview.md) -Provides information about the menu, toolbar, and tabs on the Application Virtualization Sequencer Console. - -[About Sequencing Phases](about-sequencing-phases.md) -Provides information about sequencing an application. - -[How to Configure the App-V Sequencer](how-to-configure-the-app-v-sequencer.md) -Provides a set of procedures you can use to configure the Application Virtualization Sequencer. - -[Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md) -Provides a set of procedures you can use to configure the Application Virtualization Sequencer. - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) -Provides step-by-step procedures for sequencing or upgrading virtual application, using either the user interface or the command line. - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) -Provides step-by-step procedures for sequencing or upgrading virtual application. - -[Troubleshooting Application Virtualization Sequencer Issues](troubleshooting-application-virtualization-sequencer-issues.md) -Provides troubleshooting tips for a variety of issues that you might encounter when working with the App-V Sequencer. - -[Application Virtualization Sequencer Reference](application-virtualization-sequencer-reference.md) -Provides detailed technical reference material related to working with the Application Virtualization Sequencer. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -[Application Virtualization Server](application-virtualization-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md deleted file mode 100644 index e3b9b48948..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard-Add Application Dialog Box -description: Application Virtualization Sequencing Wizard-Add Application Dialog Box -author: dansimp -ms.assetid: 247eac0e-830d-4d72-be48-af7d1525eefd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard-Add Application Dialog Box - - -Use the **Add Application** dialog box to add an application to a sequenced application package for sequencing. This dialog box contains the following elements. - -**Application Path** -Specifies the path of the application. - -**Name** -Specifies the name of the application as listed in the OSD file. - -**Version** -Specifies the version of the application as listed in the OSD file. - -**OSD File Name** -Specifies the name of the OSD file that causes the application shortcut to open the application. - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md deleted file mode 100644 index 7d58727b72..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box -description: Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box -author: dansimp -ms.assetid: f7656053-3d92-448e-8759-b6b09cef6025 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box - - -Use the **Add File Type Association** dialog box to add a file type association for the application. To access this dialog box, click **File Type** associations on the **Configure Application** page and click **Add**. This dialog box contains the following elements. - -**Extension** -Use to specify the file name extension for the file type associated with the application. - -**File Type Description** -Use to specify a brief description of the file type. - -**Content Type** -Use to specify a brief description of the MIME type. - -**Perceived Type** -Use to select a file type. - -**Confirm open after download** -Select to confirm that the file is opened after a download. - -**Always show extension** -Select to display the extension with the file name. - -**Add to New menu** -Select to add the file type to the **New** menu. - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md deleted file mode 100644 index 1a7aceec55..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Add Files to Virtual File System Page -description: Application Virtualization Sequencing Wizard Add Files to Virtual File System Page -author: dansimp -ms.assetid: 6b01333b-08bd-4b96-a123-a07a7aafddd1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Add Files to Virtual File System Page - - -Use the **Add Files to Virtual File System** page of the Application Virtualization Sequencing Wizard to select files to add to the virtual file system. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Add the following files to the VFS

    Select to add the listed files to the virtual file system.

    Remove

    Click to remove a selected file from the list so that it will not be added to the virtual file system.

    Add

    Click to add a file so that you can add a file to the virtual file system.

    Reset

    Click to restore the default list of files under Add the following files to the VFS.

    Back

    Accesses the Sequencing Wizard's previous page.

    Next

    Accesses the Sequencing Wizard's next page.

    Cancel

    Terminates operation of the Sequencing Wizard.

    - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md deleted file mode 100644 index c195624f90..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md +++ /dev/null @@ -1,130 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Advanced Options Page -description: Application Virtualization Sequencing Wizard Advanced Options Page -author: dansimp -ms.assetid: 2c4c5d95-d55e-463d-a851-8486f6a724f2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Advanced Options Page - - -Use the **Advanced Options** page of the Application Virtualization (App-V) Sequencing Wizard to specify advanced options for the application to be installed. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Block Size

    Use to specify the size of blocks that the SFT file will be divided into when streamed across a network. All blocks equal the specified size; however, the last block might be smaller than specified. Select one of the following values:

    -
      -
    • 4 KB

    • -
    • 16 KB

    • -
    • 32 KB

    • -
    • 64 KB

    • -
    -
    -Note

    When you select a block size, consider the size of the SFT file and your network bandwidth. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes might stream faster, but they use more network bandwidth. Through experimentation, you can discover the optimum block size for streaming applications on your network.

    -
    -
    - -

    Enable Microsoft Update During Monitoring

    Enables installation of Microsoft Updates during the Sequencing Wizard's monitoring phase.

    Rebase DLLs

    Enables remapping of supported dynamic-link libraries to a contiguous space in RAM, saving memory and improving performance.

    Back

    Accesses the Sequencing Wizard's previous page.

    Next

    Accesses the Sequencing Wizard's next page.

    Cancel

    Terminates operation of the Sequencing Wizard.

    - - - -\[Template Token Value\] - -Use the **Advanced Options** page of the App-V Sequencing Wizard to specify advanced options for the application you are sequencing. This page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Allow Microsoft Update to run during monitoring

    Specifies whether software updates will be applied to the application during the monitoring phase of application sequencing. This option is helpful if updates are required to successfully complete the application installation. This option is not selected by default.

    Rebase Dlls

    Enables remapping of supported dynamic-link libraries to a contiguous space in RAM. Selecting this option can help manage memory and improve application performance. This option is not selected by default.

    Back

    Goes to the previous page of the wizard.

    Next

    Goes to the next page of the wizard.

    Cancel

    Discards the settings and exits the wizard.

    - - - -\[Template Token Value\] - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md deleted file mode 100644 index 0fa1b9ca03..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Configure Application Page -description: Application Virtualization Sequencing Wizard Configure Application Page -author: dansimp -ms.assetid: 2927debd-de4b-41d2-9e1c-e8927231f4cc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Configure Application Page - - -Use the **Configure Applications** page of the App-V Sequencing Wizard to add applications to a sequenced application package and to add or delete shortcuts and file type associations. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Application

    Displays a list of applications, which can be expanded to add or edit file type associations.

    Name

    Displays the name of the application you are sequencing.

    Version

    Displays the version number for the application you are sequencing.

    Command Line

    Displays any command-line directive of the application you are sequencing.

    Add

    Adds a selected application to a package.

    Remove

    Deletes a selected application from a package.

    Edit

    Enables editing of the application path and OSD file properties of the selected application.

    Back

    Goes to the previous page of the wizard.

    Next

    Goes to the next page of the wizard

    Cancel

    Discards the settings and closes the wizard.

    - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md deleted file mode 100644 index 995ae0facc..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Launch Applications Page -description: Application Virtualization Sequencing Wizard Launch Applications Page -author: dansimp -ms.assetid: 69b1d6e1-00ff-49e3-a245-a4aca225d681 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Launch Applications Page - - -Use the **Launch Applications** page of the App-V sequencing wizard to run applications so that the Sequencer can optimize the package for streaming and you can configure how the application should be initially started on target computers. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Name

    Displays the name of application you are sequencing.

    Command Line

    Displays any command-line directive for the application you are sequencing.

    Launch All

    Starts each application displayed, exercises each application sufficiently to cover the actions that users typically take immediately after they open the application, and then exits each application.

    Launch

    Starts a selected application and exercises the application sufficiently to cover the actions that users typically take immediately after they open the application.

    Back

    Goes to the previous page of the wizard.

    Next

    Goes to the next page of the wizard.

    Cancel

    Discards the settings and closes the wizard.

    - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md deleted file mode 100644 index 8f834f6d26..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Monitor Installation Page -description: Application Virtualization Sequencing Wizard Monitor Installation Page -author: dansimp -ms.assetid: b54b8145-a57e-4d0d-b776-b5319aadb78e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Monitor Installation Page - - -Use the **Monitor Installation** page of the Application Virtualization Sequencing Wizard to start the sequencing process so that the Sequencer can monitor the application installation activities. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Begin Monitoring

    Starts the monitoring of the sequencing process.

    -
    -Note

    The Sequencer will minimize so that you can run your application's installer, except on Vista.

    -
    -
    - -

    Stop Monitoring

    Stops the monitoring of the sequencing process.

    -
    -Note

    The Stop Monitoring button is displayed only after the monitoring process starts.

    -
    -
    - -

    Back

    Accesses the Sequencing Wizard's previous page.

    Next

    Accesses the Sequencing Wizard's next page.

    Cancel

    Terminates operation of the Sequencing Wizard.

    - - - -\[Template Token Value\] - -Use the **Monitor Installation** page of the App-V sequencing wizard to monitor the installation of an application. The page contains the elements described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Begin Monitoring

    Starts the monitoring of the application installation by the sequencer. This option enables the sequencer to record the installation process. After you click Start Monitoring, you must wait while sequencer prepares the computer for sequencing. All new and changed application components will be added to the virtual application package.

    Stop Monitoring

    Stops the sequencer from recording the installation process. This button is not available until you click Begin Monitoring.

    Back

    Goes to the previous page of the wizard.

    Next

    Goes to the next page of the wizard.

    Cancel

    Discards the settings and closes the wizard.

    - - - -\[Template Token Value\] - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md deleted file mode 100644 index 996fff81b1..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Package Information Page -description: Application Virtualization Sequencing Wizard Package Information Page -author: dansimp -ms.assetid: e52efd08-1b05-4bd6-a6e7-5f6bdbde7df7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Package Information Page - - -Use the **Package Information** page of the Application Virtualization (App-V) wizard to specify information that will be associated with the application you sequence. This page contains the following elements. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Package Name

    Specifies the name that will be associated with the virtual application package. This is a required field.

    Comments

    Specifies identifying information that will be associated with the package. The information will be added to OSD file ABSTRACT element. This field is optional.

    Show Advanced Monitoring Options

    Displays the Advanced Options page of the Sequencing Wizard.

    Next

    Goes to the next page of the wizard.

    Cancel

    Discards the settings and exits the wizard.

    - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md deleted file mode 100644 index 6a9437812a..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard Sequence Package Page -description: Application Virtualization Sequencing Wizard Sequence Package Page -author: dansimp -ms.assetid: 4c603d6a-9139-4867-a085-c6d6b517917e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard Sequence Package Page - - -Use the **Sequence Package** page of the Application Virtualization Sequencing Wizard to create the sequenced package. After you click **Finish**, save the application by clicking **File / Save** in the Sequencer console. This page contains the elements described in the following table. - - ---- - - - - - - - - - - - - -
    NameDescription

    Finish

    Closes the Sequencing Wizard and displays the virtual application package in the Sequence console.

    - -  - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md deleted file mode 100644 index 87689f417f..0000000000 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box -description: Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box -author: dansimp -ms.assetid: d79d7085-228e-4be2-abe6-2760b9b983d5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box - - -Use the **Shortcut Locations** dialog box to specify where to publish application shortcuts on the Application Virtualization Desktop Client. This dialog box is found on the **Configure Applications** page of the Sequencing Wizard and contains the following elements. - -**Desktop** -Select to publish the application shortcut to the Application Virtualization Desktop Client. - -**Send To Menu** -Select to publish the application shortcut to the **Send To** menu. - -**Quick Launch Toolbar** -Select to publish the application shortcut to the Quick Launch toolbar. - -**Start Menu** -Select to publish the application shortcuts to a designated subfolder of the **Start** menu. - -**Advanced** -Click to publish application shortcuts to additional locations. - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md b/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md deleted file mode 100644 index 8a53cc64f2..0000000000 --- a/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md +++ /dev/null @@ -1,178 +0,0 @@ ---- -title: Application Virtualization Server-Based Scenario Overview -description: Application Virtualization Server-Based Scenario Overview -author: dansimp -ms.assetid: 2d91392b-5085-4a5d-94f2-15eed1ed2928 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server-Based Scenario Overview - - -If you plan to use a server-based deployment scenario for your Microsoft Application Virtualization environment, it is important to understand the differences between the *Application Virtualization Management Server* and the *Application Virtualization Streaming Server*. This topic describes those differences and also provides information about package delivery methods, transmission protocols, and external components that you will need to consider as you proceed with your deployment. - -## Application Virtualization Management Server - - -The Application Virtualization Management Server performs both the publishing function and the streaming function. The server publishes application icons, shortcuts, and file type associations to the App-V clients for authorized users. When user requests for applications are received the server streams that data on-demand to authorized users using RTSP or RTSPS protocols. In most configurations using this server, one or more Management Servers share a common data store for configuration and package information. - -The Application Virtualization Management Servers use Active Directory groups to manage user authorization. In addition to Active Directory Domain Services, these servers have SQL Server installed to manage the database and data store. The Management Server is controlled through the Application Virtualization Management Console, a snap-in to the Microsoft Management Console. - -Because the Application Virtualization Management Servers stream applications to end-users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. - -## Application Virtualization Streaming Server - - -The Application Virtualization Streaming Server delivers the same streaming and package upgrade capabilities provided by the Management Server, but without its Active Directory or SQL Server requirements. However, the Streaming Server does not have a publishing service, nor does it have licensing or metering capabilities. The publishing service of a separate App-V Management Server is used in conjunction with the App-V Streaming Server. The App-V Streaming Server addresses the needs of businesses that want to use Application Virtualization in multiple locations with the streaming capabilities of the classic server configuration but might not have the infrastructure to support App-V Management Servers in every location. - -The Application Virtualization Streaming Server can also be used in environments with an existing electronic software distribution system (ESD). You use the ESD to manage streaming applications. Unlike the Application Virtualization Management Server, the Streaming Server does not use SQL or a management console. These servers use access control lists (ACLs) to grant user authorization. - -## Package Delivery Methods - - -If you plan to use an Application Virtualization Server as the publishing delivery method, you need to determine which of the following package delivery methods your scenario employs: - -- *Dynamic package delivery* - -- *Load from file package delivery* - -### Dynamic Package Delivery - -During dynamic package delivery, the server (Application Virtualization Management Server, Application Virtualization Streaming Server, or IIS server) delivers the virtualized applications to the end users through on-demand deployment. The server delivers the virtualized applications and packages to a client computer only when a user first attempts to launch an application (on demand). The server streams only the blocks needed to start the application (primary feature block). After the primary feature block is delivered to the client, the application runs; the client does not receive the complete application (incremental deployment) unless the client needs access to a part of the application that is not included in the primary feature block. When this occurs, the client performs an out-of-sequence request and the secondary feature block is streamed to the client. Dynamic package delivery allows for rapid application launch. - -### Load from File Package Delivery - -For load from file package delivery, the server delivers the entire virtualized application package to a client computer before the user launches the application. In this scenario, virtualized applications are delivered as a full package, rather than through the dynamic, incremental method used by the dynamic delivery model. - -**Note**   -For each delivery method, the initial virtual application delivery process and the virtual application update process are the same; the updated virtual application package replaces the original application package. - - - -The following table compares the advantages and disadvantages of each package delivery method. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    MethodAdvantagesDisadvantagesComments

    Dynamic package delivery

    Applications are delivered and updated on demand.

    -

    Applications are delivered and updated incrementally to optimize launch time.

    -

    Updates are delivered automatically to the client desktop.

    Larger footprint in enterprise topology because of server requirements.

    -

    Application streaming should be over a LAN; deployment scenarios over a WAN or that use an unreliable or intermittent connection between the server and client might be unusable.

    Requires a streaming infrastructure.

    -

    Windows Installer used to deploy Application Virtualization Desktop Client software to end-user computers.

    -

    Large enterprises should use Application Virtualization Streaming Servers as distribution points.

    Load from file package delivery

    Consistent with typical enterprise management practices.

    -

    Supports stand-alone configuration scenario.

    -

    Provides solution to micro–branch office problem.

    Application delivery and update is not possible on-demand.

    -

    Application delivery and update is not incremental; it increases resource consumption relative to dynamic delivery.

    The IT organization is often responsible for managing application licenses, user authorization, and authentication.

    - - - -## Server-Related Protocols and External Components - - -The following table lists the server types that can be used in an Application Virtualization Server-based scenarios, along with their corresponding transmission protocols and the external components needed to support the specific server configuration. The table also includes the reporting mechanism and the active upgrade mechanism for each server type. Because these scenarios all use the Application Virtualization Management Server, you can use the internal reporting functionality that is built into the system. If you use an Application Virtualization Management or an Application Virtualization Streaming Server to deliver packages to the client, packages on the server are automatically upgraded when a user logs into the client; if you use IIS servers or a file to deliver the packages to the client, the packages on the client must be upgraded manually. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server TypeProtocolsExternal Components NeededReportingActive Upgrade

    Application Virtualization Management Server

    RTSP

    -

    RTSPS

    When using HTTPS, use an IIS server to download ICO and OSD files and a firewall to protect the server from exposure to the Internet.

    Internal

    Supported

    Application Virtualization Streaming Server

    RTSP

    -

    RTSPS

    Use a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTPS, use an IIS server to download ICO and OSD files and use a firewall to protect the server from exposure to the Internet.

    Internal

    Supported

    IIS server

    HTTP

    -

    HTTPS

    Use a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server to download ICO and OSD files and a firewall to protect the server from exposure to the Internet.

    Internal

    Not Supported

    File

    SMB

    You need a way to synchronize the content between the Management Server and the Streaming Server. You need a client computer with file sharing or streaming capability.

    Internal

    Not Supported

    - - - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-server-based-scenario.md b/mdop/appv-v4/application-virtualization-server-based-scenario.md deleted file mode 100644 index 84336dad16..0000000000 --- a/mdop/appv-v4/application-virtualization-server-based-scenario.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Application Virtualization Server-Based Scenario -description: Application Virtualization Server-Based Scenario -author: dansimp -ms.assetid: 10ed0b18-087d-470f-951b-5083f4cb076f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server-Based Scenario - - -If you plan to use a server-based deployment scenario for your Microsoft Application Virtualization (App-V) environment, you should understand the differences between the Application Virtualization Management Server and the Application Virtualization Streaming Server. The topics in this section describe those differences and also provide information about package delivery methods, transmission protocols, and external components that you have to consider as you continue with your deployment. This section also provides step-by-step procedures for installing and configuring the App-V Management Server and the Application Virtualization Streaming Servers. - -## In This Section - - -[Application Virtualization Server-Based Scenario Overview](application-virtualization-server-based-scenario-overview.md) -Provides important deployment information about the Application Virtualization Management Server, the Application Virtualization Streaming Server, and the package delivery methods, protocols, and external components relevant to your server-based deployment plan. - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) -Describes how to install the Microsoft Application Virtualization platform components required for your server-based deployment. - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) -Describes how to configure the Application Virtualization Management Server, the Application Virtualization Streaming Server, the Internet Information Integration (IIS) server, and the file server. - -[How to Configure a Read-only Cache on the App-V Client (VDI)](how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md) -Describes how to configure the App-V client to use read-only cache. - -[How to Configure a Read-only Cache on the App-V Client (RDS)](how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md) -Describes how to configure the App-V client to use read-only cache. - -[How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) -Describes how to configure database mirroring by using Microsoft SQL Server for your App-V system. - -## Reference - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -## Related Sections - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-server-management-console-reference.md b/mdop/appv-v4/application-virtualization-server-management-console-reference.md deleted file mode 100644 index c36cd7f3fd..0000000000 --- a/mdop/appv-v4/application-virtualization-server-management-console-reference.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Application Virtualization Server Management Console Reference -description: Application Virtualization Server Management Console Reference -author: dansimp -ms.assetid: 7c9890f4-7230-44dd-bbe8-95a4b65dc796 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server Management Console Reference - - -This section of the Application Virtualization Server Management Console Help provides detailed information about each of the functional areas of the interface. - -## In This Section - - -[Server Management Console: About Dialog Boxes](server-management-console-about-dialog-boxes.md) -Describes the available **About** dialog boxes and how to view them. - -[Server Management Console: Application Virtualization System Node](server-management-console-application-virtualization-system-node.md) -Describes the screens in the Application Virtualization System node. - -[Server Management Console: Applications Node](server-management-console-applications-node.md) -Describes the screens in the **Applications** node. - -[Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) -Describes the screens in the **File Type Association** node. - -[Server Management Console: Packages Node](server-management-console-packages-node.md) -Describes the screens in the **Packages** node. - -[Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) -Describes the screens in the **Application Licenses** node. - -[Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) -Describes the screens in the **Server Groups** node. - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) -Describes the screens in the **Provider Policies** node. - -[Server Management Console: Administrators Node](server-management-console-administrators-node.md) -Describes the screens in the **Administrators** node. - -[Server Management Console: Reports Node](server-management-console-reports-node.md) -Describes the screens in the **Reports** node. - -## Related topics - - -[About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-server-management-help.md b/mdop/appv-v4/application-virtualization-server-management-help.md deleted file mode 100644 index 7ae7b3aab4..0000000000 --- a/mdop/appv-v4/application-virtualization-server-management-help.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Application Virtualization Server Management Help -description: Application Virtualization Server Management Help -author: dansimp -ms.assetid: 4f67265c-58f5-4d77-bfff-95474d8f1bb6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server Management Help - - -This help file supports the Application Virtualization Management Server. - -## In This Section - - -[About the Application Virtualization Server Management Console](about-the-application-virtualization-server-management-console.md) -Includes overview information about the Application Virtualization Management Server. - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) -Includes an overview as well as step-by-step procedures for using the features and commands that are available in the Application Virtualization Server. - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) -Includes reference information about the windows and dialogs that are available in the Application Virtualization Server Management Console. - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-server.md b/mdop/appv-v4/application-virtualization-server.md deleted file mode 100644 index db3ac34238..0000000000 --- a/mdop/appv-v4/application-virtualization-server.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Application Virtualization Server -description: Application Virtualization Server -author: dansimp -ms.assetid: feea99b2-5e3d-42b1-ad41-157429e5fceb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Server - - -This section provides important information and procedures that you can use to configure and manage the Microsoft Application Virtualization (App-V) Servers. - -## In This Section - - -[Monitoring Application Virtualization Servers](monitoring-application-virtualization-servers.md) -Provides information about monitoring the App-V Servers. - -[How to Load Files and Packages](how-to-load-files-and-packages.md) -Provides information about loading files and packages. - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) -Provides detailed procedures for managing the App-V Servers by using the Server Management Console. - -[How to Configure the App-V System for Package Upgrade](how-to-configure-the-app-v-system-for-package-upgrade.md) -Provides detailed information about upgrading packages in different scenarios. - -[Troubleshooting Information for the Application Virtualization Server](troubleshooting-information-for-the-application-virtualization-server.md) -Provides information that you can use to troubleshoot various issues on the Application Virtualization (App-V) Server. - -[How to Migrate the App-V SQL Database to a Different SQL Server](how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md) -Provides detailed procedures for migrating the App-V SQL Database to a different SQL Server. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/application-virtualization-system-requirements.md b/mdop/appv-v4/application-virtualization-system-requirements.md deleted file mode 100644 index d912bfff73..0000000000 --- a/mdop/appv-v4/application-virtualization-system-requirements.md +++ /dev/null @@ -1,363 +0,0 @@ ---- -title: Application Virtualization System Requirements -description: Application Virtualization System Requirements -author: dansimp -ms.assetid: a2798dd9-168e-45eb-8103-e12e128fae7c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization System Requirements - - -This topic describes the minimum hardware and software requirements for the Microsoft Application Virtualization (App-V) Management Server and Streaming Server. - -## Application Virtualization Management and Streaming Servers - - -The following list includes the minimum recommended hardware and software requirements for the App-V Management Server and App-V Streaming Server. - -### Hardware Requirements - -- Processor—Intel Pentium III, 1 GHz - -- RAM—512 MB - -- Disk space—200 MB available hard disk space, not including the Content directory - -### Software Requirements - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2003

    Standard Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2003

    Enterprise Edition or Datacenter Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2003 R2

    Standard Edition

    No service pack or SP2

    x86 or x64

    Windows Server 2003 R2

    Enterprise Edition or Datacenter Edition

    No service pack or SP2

    x86 or x64

    Windows Server 2008

    Standard, Enterprise, or Datacenter Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2008 R2¹

    Standard, Enterprise, or Datacenter Edition

    x64

    - - - -¹Applies to App-V 4.5 SP1 and SP2 only. - -## Data Store - - -The following list includes the minimum recommended hardware and software requirements for the computer that is used when you install the data store on a separate server. The data store is required only for the Application Virtualization Management Server. - -### Hardware Requirements - -- Processor—Intel Pentium III, 850 MHz - -- RAM—512 MB - -- Disk space—200 MB available hard disk space - -### Software Requirements - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2003

    Standard Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2003

    Enterprise Edition or Datacenter Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2003 R2

    Standard Edition

    No service pack or SP2

    x86 or x64

    Windows Server 2003 R2

    Enterprise Edition or Datacenter Edition

    No service pack or SP2

    x86 or x64

    Windows Server 2008

    Standard, Enterprise, or Datacenter Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2008 R2¹

    Standard, Enterprise, or Datacenter Edition

    x64

    - - - -¹Applies to App-V 4.5 SP1 and SP2 only. - -- Database—Microsoft SQL Server 2000 SP3a or SP4, SQL Server 2005 SP1, SP2, or SP3, or SQL Server 2008, no service pack or SP1 or SQL Server 2008 R2 (32-bit or 64-bit) - -- Microsoft Data Access Components—MDAC 2.7 - -- Domain controller—Active Directory Domain Services or Windows NT 4.0-based primary domain controller (PDC) as the central authentication authority - -## Management Web Service - - -The following list includes the minimum recommended hardware and software requirements for the Application Virtualization Management Web Service when it is installed on a separate computer. - -### Hardware Requirements - -- Processor—Intel Pentium III, 800 MHz - -- RAM—256 MB - -- Disk space—50 MB available hard disk space - -### Software Requirements - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2003

    Standard Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2003

    Enterprise Edition or Datacenter Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2003 R2

    Standard Edition

    No service pack or SP2

    x86 or x64

    Windows Server 2003 R2

    Enterprise Edition or Datacenter Edition

    No service pack or SP2

    x86 or x64

    Windows Server 2008

    Standard, Enterprise, or Datacenter Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2008 R2¹

    Standard, Enterprise, or Datacenter Edition

    x64

    - - - -¹Applies to App-V 4.5 SP1 and SP2 only. - -- Internet Information Services—Internet Information Services (IIS) 6.0 configured with Microsoft ASP.NET, IIS 7 - -- Microsoft .NET Framework 2.0 - -## Management Console - - -The following list includes the minimum recommended hardware and software requirements for the Application Virtualization Management Console when it is installed on a separate computer. - -### Hardware Requirements - -- Processor—Intel Pentium III, 450 MHz - -- RAM—256 MB - -- Disk space—200 MB available hard disk space - -### Software Requirements - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows XP

    Professional Edition

    SP2 or SP3

    x86 or x64

    Windows Vista

    Business, Enterprise, or Ultimate Edition

    No service pack, SP1, or SP2

    x86 or x64

    Windows 7

    Professional, Enterprise, or Ultimate Edition

    x86 or x64

    Windows Server 2003

    Standard Edition, Enterprise Edition, or Datacenter Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2003 R2

    Standard Edition, Enterprise Edition, or Datacenter Edition

    No service pack or SP2

    x86 or x64

    Windows Server 2008

    Standard, Enterprise, or Datacenter Edition

    SP1 or SP2

    x86 or x64

    Windows Server 2008 R2¹

    Standard, Enterprise, or Datacenter Edition

    x64

    - - - -¹Applies to App-V 4.5 SP1 and SP2 only. - -- Microsoft Management Console—MMC 3.0 or later - -- Microsoft .NET Framework 2.0 SP2 (minimum) - - **Important**   - The minimum requirement is .NET Framework 2.0 SP2 if you must install App-V hotfix KB980850 or subsequent App-V hotfixes on the computer that is running the App-V Management Console. - - - -## Related topics - - -[Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) - -[Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md b/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md deleted file mode 100644 index 3420240770..0000000000 --- a/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Application Virtualization Technical Publications -description: Application Virtualization Technical Publications -author: dansimp -ms.assetid: 86606647-3b9b-4459-9638-64626051ac94 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization Technical Publications - - -In this section, you can find additional technical support information for Microsoft Application Virtualization. - -## Technical Publications - - -The following technical publications support Microsoft Application Virtualization. - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-licenses-node.md b/mdop/appv-v4/applications-licenses-node.md deleted file mode 100644 index 3bc727a6b1..0000000000 --- a/mdop/appv-v4/applications-licenses-node.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: Applications Licenses Node -description: Applications Licenses Node -author: dansimp -ms.assetid: 2b8752ff-aa56-483e-b844-966941af2d94 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Licenses Node - - -The **Applications Licenses** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of licenses and license groups. The following license types are available: - -- **Unlimited License**—Provides access for any number of simultaneous users. This method of licensing is appropriate when you want to associate an enterprise-wide license with an application. - -- **Concurrent License**—Enables you to define the maximum number of concurrent users who are allowed to use the application. - -- **Named License**—Enables you to assign a license to an individual user. A named license can be used to ensure that a particular user will always be able to run the application. - -**Note**   -You can combine concurrent and named licenses for the same application. - - - -Right-click the **Applications Licenses** node to display a pop-up menu that contains the following elements. - -**New Unlimited License** -Displays the New Unlimited License Wizard. This wizard consists of the following pages: - -1. Enter the name of the license group in the **Applications License Group Name** field, and enter a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0 through 100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and select the **Enabled** check box to enable the license. - - Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the check box to use the displayed expiration date, or you can use the calendar utility to browse to the desired expiration date. - -3. Click **Finish** to add the new license. - -**New Concurrent License** -Displays the New Concurrent License Wizard. This wizard consists of the following three pages and is almost identical to the New Unlimited License Wizard: - -1. Enter the name of the license group in the **Applications License Group Name** field, and enter a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0 through 100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and enter a value in the **Concurrent License Quantity** field. - - You can also use the up and down arrows to specify the number of concurrent licenses. Select the **Enabled** check box to enable the license. - - Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the check box to use the displayed expiration date, or you can use the calendar utility to browse to the desired expiration date. - -3. Click **Finish** to add the new licenses. - -**New Named License** -Displays the New Named License Wizard. This wizard consists of the following four pages: - -1. Enter the name of the license group in the **Applications License Group Name** field, and enter a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0 through 100). You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and select the **Enabled** check box to enable the license. - - Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the check box to use the displayed expiration date, or you can use the calendar utility to browse to the desired expiration date. - -3. Click **Add**, **Edit**, or **Remove** named users. - -4. Click **Finish** to add the new license. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -If you click a license group or license that appears under the **Application Licenses** node in the **Scope** pane, the following elements are available. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a package from the **Results** pane. - -**Rename** -Changes the name of a package in the **Results** pane. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Properties** -Displays the **Properties** dialog box for the selected license group. The **General** tab of the **Properties** dialog box displays information about the license group and lets you change the time value in the **License Expiration Warning** field. The **Applications** tab displays the list of applications associated with the license group. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) - - - - - - - - - diff --git a/mdop/appv-v4/applications-licenses-results-pane-columns.md b/mdop/appv-v4/applications-licenses-results-pane-columns.md deleted file mode 100644 index 9fe5dbaaf8..0000000000 --- a/mdop/appv-v4/applications-licenses-results-pane-columns.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Applications Licenses Results Pane Columns -description: Applications Licenses Results Pane Columns -author: dansimp -ms.assetid: bd56b36a-655e-4fc4-9f83-d2ed68882402 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Licenses Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays a variety of columns. These columns are visible when licenses are visible and when the **Results** pane displays licenses. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, expand the **Application Licenses** node, right-click a license and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ColumnContents

    Description

    Describes the license.

    Type

    Lists the type of license. The available types are Unlimited (any number or users), Concurrent (a specified number of concurrent users), and Named (licenses reserved for specific users).

    Expiration Date

    Displays the date the license is set to expire.

    Enabled

    Displays the enabled status of the license as true or false.

    - -  - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-licenses-results-pane.md b/mdop/appv-v4/applications-licenses-results-pane.md deleted file mode 100644 index 3339644301..0000000000 --- a/mdop/appv-v4/applications-licenses-results-pane.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Applications Licenses Results Pane -description: Applications Licenses Results Pane -author: dansimp -ms.assetid: 8b519715-b2fe-451e-ad9b-e9b73f454961 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Licenses Results Pane - - -The **Applications Licenses Results** pane in the Application Virtualization Server Management Console displays a list of the available application license groups and application licenses. - -Right-click any application license group to display a pop-up menu that contains the following elements. - -**New Unlimited License** -Displays the New Unlimited License Wizard. This option is available only when the license group has no licenses. This wizard consists of three pages: - -1. Enter a group name in the **Applications License Group Name** field and a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0–100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and select the **Enabled** check box. Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the default check box or use the calendar utility to browse to the desired expiration date. - -3. Click **Finish** to add the new license. - -**New Concurrent License** -Displays the New Concurrent License Wizard. This option is available only when the license group has no unlimited licenses. This wizard consists of the following pages and is almost identical to the New Unlimited License Wizard: - -1. Enter a group name in the **Applications License Group Name** field and a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0–100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description** field, and enter a value in the **Concurrent License Quantity** field. You can also use the up and down arrows to specify the number of concurrent licenses. Select the **Enabled** check box to enable the license. Optionally, you can use the **Expiration Date** field to select an expiration date for the license. You can select the check box to use the displayed expiration date, or you can use the calendar utility to browse to the desired expiration date. - -3. Click **Finish** to add the new licenses. - -**New Named License** -Displays the New Named License Wizard. This option is available only when the license group has no unlimited licenses. This wizard consists of the following pages: - -1. Enter a group name in the **Applications License Group Name** field and a value (in minutes) in the **License Expiration Warning** field. (You can enter any value from 0–100.) You can also use the up and down arrows to select the number of minutes. - -2. Enter brief descriptive text in the **License Description**, and select the **Enabled** check box. Optionally, you can use the **Expiration Date** field to specify an expiration date for the license. You can select the check box to use the displayed expiration date, or use the calendar utility to browse to the desired expiration date. - -3. Click **Add**, **Edit**, or **Remove** named users. - -4. Click **Finish** to add the new license. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes the license group from the list. - -**Rename** -Changes the name of the applications license group. - -**Properties** -Displays the **Properties** dialog box for the selected application license groups. This dialog box has the following tabs: - -- **General** tab—Displays general information about the license group. From this tab, you can change the time value (in minutes) in the **License Expiration Warning** field. You can enter any value from 0–100. - -- **Applications** tab—Displays the list of applications associated with the license group. - -**Help** -Displays the Application Virtualization Server Management Console help system. - -When the **Results** pane displays application license groups, right-click anywhere in the **Results** pane, except on a license group, to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -When the **Results** pane displays licenses, right-click any application license to display a pop-up menu that contains the following elements. - -**Delete** -Deletes the license from the list. - -**Rename** -Changes the name of the license. - -**Properties** -Displays the **Properties** dialog box for the selected application license. - -The **General** tab of the **Properties** dialog box displays information about the license and lets you change the enabled status, license expiration date, and license key information. - -**Help** -Displays the server management console help system. - -When the **Results** pane displays licenses, right-click anywhere in the **Results** pane, except on a license, to display a pop-up menu that contains the following elements. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Properties** -Displays the **Properties** dialog box for the selected license. - -The **General** tab of the **Properties** dialog box displays information about the license and lets you change the enabled status, license expiration date, and license key information. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-node-in-server-management-console.md b/mdop/appv-v4/applications-node-in-server-management-console.md deleted file mode 100644 index 0dd4066e35..0000000000 --- a/mdop/appv-v4/applications-node-in-server-management-console.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Applications Node in Server Management Console -description: Applications Node in Server Management Console -author: dansimp -ms.assetid: 27edbd83-0fc2-4a40-9834-d5db5be06681 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Node in Server Management Console - - -The **Applications** node is one level below the Application Virtualization System node in the **Scope** pane. When you select this node, the **Results** pane displays a list of applications. Right-click the **Applications** node to display a pop-up menu that contains the following elements: - -**New Application Group** -Displays the New Application Group Wizard. - -**New Application** -Displays the New Application Wizard. - -**Import Applications** -Imports Open Software Descriptor (OSD) files or Sequencer Project (SPRJ) files. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Help** -Displays the help system for the Application Virtualization Management Console. - -When you right-click any application group that appears under the **Applications** node in the **Scope** pane, the following additional elements are available. - -**View** -Changes the appearance and content of the **Results** pane. - -**Move** -Moves the application to another application group. - -**Copy** -Copies an application to a new Application Virtualization System. - -**Delete** -Deletes an application. - -**Rename** -Renames an application. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -## Related topics - - -[How to Manually Add an Application](how-to-manually-add-an-application.md) - -[Server Management Console: Applications Node](server-management-console-applications-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-node.md b/mdop/appv-v4/applications-node.md deleted file mode 100644 index 760ebc733a..0000000000 --- a/mdop/appv-v4/applications-node.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Applications Node -description: Applications Node -author: dansimp -ms.assetid: ded79569-8a3f-47ab-b135-0836bbb039f3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Node - - -The **Applications** node is one level below the **Application Virtualization** node in the **Scope** pane of the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of applications. Right-click the **Applications** node to display a pop-up menu that contains the following elements. - -**New Application** -This menu item displays the New Application Wizard. This wizard consists of one page where you can select an icon for the application and browse to or enter a URL or a path to the Open Software Descriptor (OSD) file. - -- **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - -- **OSD File Path or URL**—Enter a local absolute path, a full Universal Naming Convention (UNC) path, or an HTTP URL. - -- **... (OSD browse button)**—Displays the standard Windows **Open File** dialog box. Browse to find the desired file. - -**New Window from Here** -Select this menu item to open a new management console with the selected node as the root node. - -**Export List** -You can use this menu item to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu items enables you to change the appearance and content of the **Results** pane. - -**Refresh** -Select this item to refresh the management console. - -**Help** -This item displays the help system for the management console. - -## Related topics - - -[Applications Results Pane](applications-results-pane.md) - -[Applications Results Pane Columns](applications-results-pane-columns.md) - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md b/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md deleted file mode 100644 index 55a7172da2..0000000000 --- a/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Applications Results Pane Columns in Server Management Console -description: Applications Results Pane Columns in Server Management Console -author: dansimp -ms.assetid: 8757e3bc-450b-4550-81d2-624906523147 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Results Pane Columns in Server Management Console - - -The **Applications Results** pane in the Application Virtualization Management Console displays a variety of columns. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ColumnContents

    Name

    Displays the application name.

    Version

    Displays the application version.

    Package

    Displays the name of the package.

    OSD Path

    Displays the full original path or URL to the Open Software Descriptor (OSD) file.

    Icon File

    Displays the complete path to the icon file.

    Enabled

    Displays the enabled status of the file; the status is either true or false.

    Application License

    Displays the name of the application license.

    Type

    Displays the application or application group type.

    Description

    Displays a brief description of the application.

    - -  - -## Related topics - - -[Server Management Console: Applications Node](server-management-console-applications-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-results-pane-columns.md b/mdop/appv-v4/applications-results-pane-columns.md deleted file mode 100644 index c7c7c41ec3..0000000000 --- a/mdop/appv-v4/applications-results-pane-columns.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: Applications Results Pane Columns -description: Applications Results Pane Columns -author: dansimp -ms.assetid: abae5ce2-40df-4f47-8062-f5eb6295c88c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Results Pane Columns - - -The **Results** pane of the **Applications** node in the Application Virtualization Client Management Console can display a variety of columns. **Application**, **Running**, **Locked**, and **Package Status** are shown by default. - -**Note**   -You can add or remove columns by right-clicking in the **Results** pane, selecting **View**, and then selecting **Add/Remove Columns**. - - - -The list can be sorted by any column. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text, dates and times are considered to come before any other text. - -The following columns are available. - -**Application** -The application name and version, separated by a space. - -**Application In Use** -Displays **Yes** or **No** depending on whether any user is using the application (that is, running it or loading it). - -**App Virt Server** -The Application Virtualization server from which the package was streamed. - -**Cached Icon File** -The name of the icon files in cache (a GUID in the current implementation). - -**Cached Icon Path** -The full path to the icon files in cache. - -**Cached Launch Percent** -The percentage of the application’s launch data currently in cache. - -**Cached Launch Size (MB)** -The amount of the application’s launch data currently in cache. - -**Cached OSD File** -The name of the OSD file in the cache (which is a GUID in the current implementation). - -**Cached OSD Path** -The full path to the OSD file in the cache. - -**Cached Package Percent** -The percentage of the package currently in cache. - -**Cached Package Size (MB)** -The size of the portion of the package currently in cache. - -**Icon File** -The original name of the icon file. - -**Icon Path** -The original path or URL for the icon file. - -**Last System Launch** -The last time the application was launched by the system. - -**Last User Launch** -The last time the application was launched by the user. - -**Launch Size (MB)** -The uncompressed size of the package data needed to launch the application. - -**Locked** -Displays **Yes** or **No** depending on whether the application’s package is locked in the cache. - -**Name** -The application name. - -**OSD File** -The original name of the Open Software Descriptor (OSD) file. - -**OSD Path** -The full original path or URL to the OSD file. - -**Package Name** -The name of the package. - -**Package GUID** -The GUID for the package. - -**Package Size (MB)** -The total size of the uncompressed data in the package. - -**Package Status** -The current operational status of the package. - -**Package URL** -The URL for the package. - -**Package Version** -The version for the package. - -**Package Version GUID** -The GUID for the package version. - -**Running** -Displays **Yes** or **No** depending on whether the current user is running the application. - -**Source** -Where the application came from—either the name of an application publishing server or "Local" for applications added from OSD files directly. - -**Version** -The application version. - -## Related topics - - -[Applications Node](applications-node.md) - -[Applications Results Pane](applications-results-pane.md) - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/applications-results-pane-in-server-management-console.md b/mdop/appv-v4/applications-results-pane-in-server-management-console.md deleted file mode 100644 index ea36979d73..0000000000 --- a/mdop/appv-v4/applications-results-pane-in-server-management-console.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: Applications Results Pane in Server Management Console -description: Applications Results Pane in Server Management Console -author: dansimp -ms.assetid: 686218bc-6156-40e2-92aa-90981c3d112a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Results Pane in Server Management Console - - -The **Applications Results** pane displays a list of the available applications. - -Right-click anywhere in the **Results** pane, except on an application or application group, to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the list of applications. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. For more information about the **Export List** feature, refer to the documentation for the Microsoft Management Console. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line up Icons** -Organizes the icons in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Management Console. - -Right-click any application in the **Results** pane to display a pop-up menu that contains the following elements. - -**Move** -Moves the applications into and out of application groups. - -**Copy** -Copies the application to another Application Virtualization System. - -**Duplicate** -Duplicates the application in the **Results** pane. - -**Delete** -Removes the application from the Application Virtualization System. - -**Rename** -Enables you to change the name of the application. - -**Properties** -Displays the **Properties** dialog box for the selected application. This dialog box has the following tabs: - -- **General** tab—Displays the application icon, application name, and package name. This tab also displays the following specific information about the application that you can change: - - - **Version**—Enables you to enter the appropriate version number. Select the **Enable** check box to enable version numbering. - - - **Description**—Enables you to enter a brief description of the application. - - - **OSD Path**—Enables you to enter or browse to the location of the appropriated Open Software Descriptor (OSD) file. - - - **Icon Path**—Enables you to enter or browse to the location of the icon file that you want to associate with the application. - - - **Application License Group**—Enables you to select the license group from the drop-down list of license groups. - - - **Server Group**—Enables you to select the server group from the drop-down list of server groups. - -- **Shortcuts** tab—Displays the check boxes that correspond to the locations where the shortcuts are published. You can select or clear check boxes from this tab. - -- **File Type Associations** tab—Displays a list of the file types associated with the selected application. From this tab, you can add, edit, or delete the file type association. - -- **Access Permissions** tab—Displays the list of groups that have access permission to the selected application. From this tab, you can add, edit, or delete groups. - -**Help** -Displays the help system for the Application Virtualization Management Console. - -Right-click any application group to display a pop-up menu that contains the following elements. - -**New Application Group** -Displays the New Application Group Wizard. Add the name of the new application group in the appropriate field, and then click **Finish**. - -**New Application** -Displays the New Application Wizard. Navigate through the wizard to add applications. - -**Import Applications** -Displays a browse dialog box that you can use to import existing applications into the Application Virtualization Management Console. You can import an OSD file or a Sequencer Project (SPRJ) file. - -**Move** -Moves the application group into and out of application groups. - -**Copy** -Copies the application group to a new server. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Removes the application group from the server. - -**Rename** -Changes the name of the application group. - -**Refresh** -Refreshes the application group. If the **Results** pane is displaying the entire application node, the pane will switch to display the contents of the application group. - -**Properties** -Displays the **Properties** dialog box for the selected application group. This dialog box has the following tabs: - -- **General** tab—Displays the application group icon and application group name. This tab also displays the following, limited information about the application group that you can change. - - - **Version**—Enables you to enter a version number for the application group. - - - **Description**—Enables you to enter a brief description of the application group. - - - **OSD Path**—Enables you to enter or browse to the location where the OSD file is located. - - - **Icon Path**—Enables you to enter or browse to the location where the icon file is located. - - - **Application License Group**—Enables you to select the license group from the drop-down list of license groups. - - - **Server Group**—Enables you to select the server group from the drop-down list of server groups. - -- **Shortcuts** tab—Displays the check boxes that correspond to the locations where the shortcuts are published. You can select or clear check boxes from this tab. - -- **File Associations** tab—Displays the list of file type associations. You can add, edit, or delete file type associations from this tab. - -- **Access Permissions** tab—Displays the list of groups that have access permission to the selected application group. From this tab, you can add, edit, or delete groups. - -**Help** -Displays the help system for the Application Virtualization Management Console. - -## Related topics - - -[Server Management Console: Applications Node](server-management-console-applications-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/applications-results-pane.md b/mdop/appv-v4/applications-results-pane.md deleted file mode 100644 index ad52fe65d1..0000000000 --- a/mdop/appv-v4/applications-results-pane.md +++ /dev/null @@ -1,142 +0,0 @@ ---- -title: Applications Results Pane -description: Applications Results Pane -author: dansimp -ms.assetid: 977a4d35-5344-41fa-af66-14957b38ed47 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Applications Results Pane - - -The **Applications Results** pane in the Application Virtualization Client Management Console displays a list of the available applications. Users can see a list of applications for which they have been granted access privileges. - -For more information about the procedures you can perform from this pane, see [How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md). - -Right-click any application to display a pop-up menu that contains the following elements. - -**New Shortcut** -This menu item displays the New Shortcut Wizard. This wizard consists of three pages: - -1. Select an icon, and specify a name for the shortcut: - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **Shortcut Title**—Enter the name you want to give the shortcut. This field defaults to the existing name and version of the application. - -2. Determine the location of the published shortcut. - - 1. **Location of shortcut**—Select a location by selecting one of the check boxes. The available locations are **Desktop**, **Quick Launch Toolbar**, **Send to Menu**, **Start Menu**, and **Another location**. - - 2. **Programs in the Start Menu**—When you select the **Start Menu** check box, this field becomes active. Leave this field blank to publish the shortcut directly to the root of the Programs folder, or enter a folder name or hierarchy—for example, "My\_Computer\\Office Applications." Shortcuts created this way are available only for the current user. - - 3. **Another location** and browse button—When you select the **Another location** check box, this field becomes active. Enter any valid location on the computer or any available Universal Naming Convention (UNC) path(shared file or directory on a network). The browse button displays a standard Windows **File Open** dialog box. - -3. Enter the desired command-line parameters, and then click **Finish** to exit the wizard. - -**New Association** -This menu item displays the New Association Wizard. This wizard consists of two pages: - -1. Enter a file name extension, and associate the extension with a file type. - - 1. **Extension**—Enter a file name extension. This field is blank by default. - - 2. **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - 3. **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is not selected. - - 4. **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Choose a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -2. Select the application that will open files with the specified extension: - - 1. **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - 2. **Open file with the association described in this OSD file**—Select this radio button to specify an Open Software Descriptor (OSD) file that determines the application used to open the file. Use the browse button to select an existing location, or enter a path or HTTP-formatted URL in this field. - -**Repair** -Resets the application default settings and eliminates all user-defined settings for the selected application. - -**Load** or **Unload** -Loads or unloads the selected application into the cache. This command is not available if 100 percent of the application is in the cache. - -**Clear** -Removes the user's settings, shortcuts, and file type associations for the selected application. This item is not available if a user is running any application from a suite of applications. Displays a confirmation prompt. - -**Lock** or **Unlock** -Locks or unlocks an application in the cache. When an application is locked, it cannot be deleted or overwritten. - -**Import** -Imports an application into the cache directly from this command in the **Applications** node. - -**Delete** -Deletes an application from the **Results** pane and from the computer, and clears the application from cache. - -**Refresh** -Refreshes the contents of the **Results** pane. - -**Properties** -Displays the **Properties** dialog box for the selected application. This dialog box has two tabs: - -1. The **General** tab displays the application icon and name, the location from where the application was streamed, and the path to the local OSD file. From this tab, you can change the icon for the application or you can clear the settings (which removes the shortcuts and the file type associations). - -2. The **Package** tab displays information about the application package, and you can **Lock**, **Unlock**, **Load**, **Unload**, and **Import** applications. - -**Help** -Displays the Client Management Console help system. - -## Displaying General Options for the Results pane - - -Right-click anywhere in the **Results** pane to display a pop-up menu that contains the following elements. - -**New Application** -This menu item displays the New Application Wizard. This wizard consists of one page where you can select an icon for the application and browse to or enter a URL or a path to the OSD file: - -1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - -2. **OSD File Path or URL**—Enter a local absolute path, a full UNC path, or an HTTP URL. - -3. **... (OSD browse button)**—Displays the standard Windows **Open File** dialog box. Browse to find the desired file. - -**Refresh** -Refreshes the **Results** pane. - -**Export List** -You can use this menu item to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu items lets you change the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -These menu items can be used to change how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the management console. - -## Related topics - - -[Applications Node](applications-node.md) - -[Applications Results Pane Columns](applications-results-pane-columns.md) - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -[How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md b/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md deleted file mode 100644 index 8ac9a89ec9..0000000000 --- a/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Best Practices for the Application Virtualization Sequencer -description: Best Practices for the Application Virtualization Sequencer -author: dansimp -ms.assetid: 95e5e216-864f-41a1-90d4-b8d7e1eb42a0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Best Practices for the Application Virtualization Sequencer - - -This topic provides best practices for running the Microsoft Application Virtualization (App-V) Sequencer. Review and consider the following recommendations when planning and using the Sequencer in your environment. - -## Sequencing Computer Configuration Best Practices - - -The following best practices should be considered when configuring the computer running the App-V Sequencer: - -- **Sequence on a computer that has a similar configuration and that is running an earlier version of the operating system than the target computers.** - - Ensure that the computer that is running the Sequencer is running an earlier version of the operating system than the target computers. This includes the service pack and update versions. For example, if the target computers are running Windows Vista and Windows XP, you should sequence applications on a computer that is running Windows XP. The ability to sequence on one operating system and run the virtualized application on a different operating system is not guaranteed, and depends on the particular application and operating system. If you encounter issues, you may be required to sequence on the same operating system environment as the one on which the App-V client is running. - -- **Configure the computer running the Sequencer with multiple partitions.** - - You should configure the computer running the Sequencer with at least two primary partitions. The first partition (**C:**) should contain the operating system, and it should be formatted using the NTFS file system. The second partition (**Q:**) is used as the destination path for the virtual application installation and should also be formatted using the NTFS file system. - -- **Configure the temp directory with enough free disk space.** - - The Sequencer uses the **%TMP%** or **%TEMP%** directory and the **Scratch** directory to store temporary files during sequencing. You should configure these directories on the computer running the Sequencer with free disk space equivalent to the estimated application installation requirements. You can verify the location of the **Scratch** directory by opening the Sequencer console and selecting **Tools**, **Options**, and then selecting the **Paths** tab. Configuring the temp directories and the **Scratch** directory on different hard drive partitions can improve performance during sequencing. - -- **Sequence applications by using Microsoft Virtual PC.** - - You will sequence most applications more than once. To help facilitate this, you should consider sequencing on a computer running in a virtual environment. This will allow you to sequence an application and revert to a clean state, with minimal reconfiguration, on the computer that is running the Sequencer. - - If you are running Microsoft Hyper-V in your environment the App-V sequencer will run when the Hyper-V virtual computer it is running on is: - - - paused and resumed. - - - has its state saved and restored. - - - saved as a snapshot and is restored. - - - migrated to different hardware as part of a live migration. - -- **Before you sequence a new application, shut down other running programs.** - - Processes and scheduled tasks that normally run on the sequencing computer can slow down the sequencing process and cause irrelevant data to be gathered during sequencing. All unnecessary applications and programs should be shut down before you begin sequencing. - -- **Sequence on a computer that is running Terminal Services** - - You should not configure the install mode on a computer that is running Terminal Services before you install the sequencer. - -## Sequencing Best Practices - - -The following best practices should be considered when sequencing a new application: - -- - - **Note**   - If you are running App-V 4.6 SP1 you do not need to sequence to a directory that follows the 8.3 naming convention. - - - -- **Sequence to a unique directory that follows the 8.3 naming convention.** - - You should sequence all applications to a directory that follows the 8.3 naming convention. The specified directory name cannot contain more than eight characters, followed by a three-character file name extension—for example, **Q:\\MYAPP.ABC**. - -- **Sequence to a destination folder on the root of the drive, not to a subdirectory.** - - If the application suite has multiple parts, install each application to a subdirectory of the main directory. For example, if a package contains an application along with a client, use **Q:\\AppSuite** as the main directory and sequence the main application to **Q:\\AppSuite\\Main**, and sequence the client to **Q:\\AppSuite\\Client**. - -- **Configure and test the application during the installation phase.** - - Completing the installation of an application often requires performing several manual steps that are not part of the application installation process. These steps can involve configuring a connection to a database or copying updated files. You should perform these configurations during the installation phase and then run the application to make sure it works. - -- **Run the application, multiple times if necessary, until the program is stable.** - - You should run the application multiple times during the installation to ensure all associated registration and dialog box configurations have been completed. Opening the application multiple times during installation will ensure that only the relevant application features are loaded into the **primary feature block**. - -- **Disable all automatic update features associated with the application.** - - Some applications have the ability to check for the latest updates automatically during installation. To assist with versioning of virtual application packages, you should disable this feature during sequencing. If there are required updates, you should sequence a new virtual application package with the associated updates installed. - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/change-history-tab-keep.md b/mdop/appv-v4/change-history-tab-keep.md deleted file mode 100644 index 7de068d479..0000000000 --- a/mdop/appv-v4/change-history-tab-keep.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: Change History Tab -description: Change History Tab -author: dansimp -ms.assetid: 652ef2f0-3a3e-4844-a472-9fa99ec5ee32 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Change History Tab - - -After you sequence an application and before you save it, you can use the **Change History** tab to view the historical information about a sequenced application package. This tab is read only and cannot be modified. It contains the following elements. - -## Modification Date - - -**Modification Date** -The date a sequenced application package was modified. - -## Package Information - - -**Package Version GUID** -The GUID for the version of the sequenced application package that is loaded, which can be used during deployment to specify a particular version of the package. - -## Sequencer Information - - -This section of the **Change History** tab displays specific information about the Application Virtualization Sequencer (the Sequencer) that was used to create the sequenced application package. It contains the following elements. - -**Sequencer Version** -The version of the Sequencer used to create the package. - -**Sequenced By** -The name of the sequencing engineer. - -**Sequencing Station** -The sequencing computer used to create the sequenced application package. - -**Package Upgrade** -Indicates whether the sequenced application package was upgraded and saved. - -**Save Mode** -Indicates the method used to save the application package. - -## Windows Information - - -**Windows Version** -The version of Windows used to create a sequenced application package. - -**System Folder** -The path on the Sequencing computer of its System folder. - -**Windows Folder** -The location on the sequencing computer of its Windows folder. - -**User Folder** -The location on the sequencing computer of its User folder. - -**System Type** -The type of operating system on the sequencing computer. - -## System Information - - -**Processor** -The processor of the sequencing computer system. - -**Last Boot Normal** -Indicates whether or not the sequencing computer's most recent boot-up was normal. - -**Terminal Services** -Indicates whether Terminal Services are operant on the sequencing computer system. - -**Remote Desktop** -Indicates whether Remote Desktop is operant on the sequencing computer. - -**.NET Framework Version** -Indicates the availability of any version of the .NET Framework on the sequencing computer. - -**Internet Explorer Version** -Indicates the availability of any version of Internet Explorer on the sequencing computer. - -**Windows Media Player Version** -Indicates the availability of any version of Windows Media Player on the sequencing computer. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/clear-app.md b/mdop/appv-v4/clear-app.md deleted file mode 100644 index ce8c9d4c5f..0000000000 --- a/mdop/appv-v4/clear-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: CLEAR APP -description: CLEAR APP -author: dansimp -ms.assetid: c2e63031-5941-45e4-9863-127231cfa25b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CLEAR APP - - -Clears the current user's settings and publishing configurations for an application. - -`SFTMIME CLEAR APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/clear-obj.md b/mdop/appv-v4/clear-obj.md deleted file mode 100644 index 33dfd04705..0000000000 --- a/mdop/appv-v4/clear-obj.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: CLEAR OBJ -description: CLEAR OBJ -author: dansimp -ms.assetid: 1e50b33f-6324-4eae-8573-75c153f786cd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CLEAR OBJ - - -Clears the settings and publishing configurations for all of your applications. - -`SFTMIME CLEAR OBJ:APP [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-about-dialog-boxes.md b/mdop/appv-v4/client-management-console-about-dialog-boxes.md deleted file mode 100644 index 67b7ff9eaa..0000000000 --- a/mdop/appv-v4/client-management-console-about-dialog-boxes.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Client Management Console About Dialog Boxes -description: Client Management Console About Dialog Boxes -author: dansimp -ms.assetid: eaf4a05e-513d-4eac-a549-76e63a70893d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: About Dialog Boxes - - -The **About** dialog boxes display information about the specific version of the Microsoft Management Console or the specific version of the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) Management Console. - -To display these dialog boxes, click **Help** and select **About Microsoft Management Console** or **About Application Virtualization Client Management Console**. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-application-virtualization-node.md b/mdop/appv-v4/client-management-console-application-virtualization-node.md deleted file mode 100644 index 9ea64120a9..0000000000 --- a/mdop/appv-v4/client-management-console-application-virtualization-node.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Client Management Console Application Virtualization Node -description: Client Management Console Application Virtualization Node -author: dansimp -ms.assetid: cf74e112-ddff-4e30-a3cc-7f4c643366c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: Application Virtualization Node - - -The **Application Virtualization** node is the top-level node in the **Scope** pane of the Application Virtualization Client Management Console. This node displays the name of the computer the console is currently controlling, or it displays "Local" if the console is connected to the local computer. - -By right-clicking the **Application Virtualization** node, you can display the **Properties** dialog box to configure the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services). - -The **Properties** dialog box contains the following elements: - -[Application Virtualization Properties: General Tab](application-virtualization-properties-general-tab.md) - -[Application Virtualization Properties: Interface Tab](application-virtualization-properties-interface-tab.md) - -[Application Virtualization Properties: File System Tab](application-virtualization-properties-file-system-tab.md) - -[Application Virtualization Properties: Permissions Tab](application-virtualization-properties-permissions-tab.md) - -[Application Virtualization Properties: Connectivity Tab](application-virtualization-properties-connectivity-tab.md) - -[Application Virtualization Properties: Import Search Path Tab](application-virtualization-properties-import-search-path-tab.md) - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-application-virtualization-properties.md b/mdop/appv-v4/client-management-console-application-virtualization-properties.md deleted file mode 100644 index 85513a0959..0000000000 --- a/mdop/appv-v4/client-management-console-application-virtualization-properties.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Client Management Console Application Virtualization Properties -description: Client Management Console Application Virtualization Properties -author: dansimp -ms.assetid: 70319e4c-5032-4cb3-bbb8-4292809dcea2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: Application Virtualization Properties - - -You can display the **Properties** dialog simply by right-clicking the **Application Virtualization** node in the Application Virtualization Client Management Console and selecting **Properties** from the pop-up menu. - -## In This Section - - -[Application Virtualization Properties: General Tab](application-virtualization-properties-general-tab.md) -Use the **General** tab of the **Properties** dialog box to modify log settings and data locations. - -[Application Virtualization Properties: Interface Tab](application-virtualization-properties-interface-tab.md) -Use the **Interface** tab of the **Properties** dialog box to control default settings for user-interface components. - -[Application Virtualization Properties: File System Tab](application-virtualization-properties-file-system-tab.md) -Use the **File System** tab of the **Properties** dialog box to view and monitor file system settings. - -[Application Virtualization Properties: Import Search Path Tab](application-virtualization-properties-import-search-path-tab.md) -Use the **Import Search Path** tab of the **Properties** dialog box to add, view, or change import search paths. - -[Application Virtualization Properties: Connectivity Tab](application-virtualization-properties-connectivity-tab.md) -Use the **Connectivity** tab of the **Properties** dialog box to specify the connectivity settings. - -[Application Virtualization Properties: Permissions Tab](application-virtualization-properties-permissions-tab.md) -Use the **Permissions** tab of the **Properties** dialog box to specify which activities are available for non-administrators on the local computer. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-applications-node.md b/mdop/appv-v4/client-management-console-applications-node.md deleted file mode 100644 index 6661141ad2..0000000000 --- a/mdop/appv-v4/client-management-console-applications-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Client Management Console Applications Node -description: Client Management Console Applications Node -author: dansimp -ms.assetid: 20cf533c-e0b0-4b81-af4b-b5b519594d1e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: Applications Node - - -The topics in this section provide information about the screen reference for the **Applications** node in the Application Virtualization Client Management Console. - -## In This Section - - -[Applications Node](applications-node.md) -Describes the features and commands available from the **Applications** node. - -[Applications Results Pane](applications-results-pane.md) -Describes the features and commands available from the **Applications** node **Results** pane. - -[Applications Results Pane Columns](applications-results-pane-columns.md) -Describes the columns available in the **Applications** node **Results** pane. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-file-type-associations-node.md b/mdop/appv-v4/client-management-console-file-type-associations-node.md deleted file mode 100644 index f0c5570f3c..0000000000 --- a/mdop/appv-v4/client-management-console-file-type-associations-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Client Management Console File Type Associations Node -description: Client Management Console File Type Associations Node -author: dansimp -ms.assetid: f0bc05ce-2cb2-4b06-961b-6c42d0274d28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: File Type Associations Node - - -The topics in this section provide information about the screen reference for the **File Associations** node in the Application Virtualization Client Management Console. - -## In This Section - - -[File Type Associations Node](file-type-associations-node-client.md) -Describes the features and commands available from the **File Associations** node. - -[File Type Association Results Pane](file-type-association-results-pane.md) -Describes the features and commands available from the **File Associations** node **Results** pane. - -[File Type Association Results Pane Columns](file-type-association-results-pane-columns.md) -Describes the columns available in the **File Associations** node **Results** pane. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/client-management-console-publishing-servers-node.md b/mdop/appv-v4/client-management-console-publishing-servers-node.md deleted file mode 100644 index f863e5d717..0000000000 --- a/mdop/appv-v4/client-management-console-publishing-servers-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Client Management Console Publishing Servers Node -description: Client Management Console Publishing Servers Node -author: dansimp -ms.assetid: 03f2038f-b5f7-4e5b-a8f0-98f5e9d5f644 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Management Console: Publishing Servers Node - - -The topics in this section provide information about the screen reference for the **Publishing Servers** node in the Application Virtualization Client Management Console. - -## In This Section - - -[Publishing Servers Node](publishing-servers-node.md) -Describes the features and commands available from the **Publishing Servers** node. - -[Publishing Servers Results Pane](publishing-servers-results-pane.md) -Describes the features and commands available from the **Publishing Servers** node **Results** pane. - -[Publishing Servers Results Pane Columns](publishing-servers-results-pane-columns.md) -Describes the columns available in the **Publishing Servers** node **Results** pane. - -## Related topics - - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/command-line-errors.md b/mdop/appv-v4/command-line-errors.md deleted file mode 100644 index 3da8e0d9f9..0000000000 --- a/mdop/appv-v4/command-line-errors.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Command-Line Errors -description: Command-Line Errors -author: dansimp -ms.assetid: eea62568-4e90-4877-9cc7-e27ef5c05068 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Command-Line Errors - - -Use the following list of errors to identify the reasons why command-line sequencing is not working properly. You can also see these errors by viewing the sequencer log file. - -**Note**   -More than one error might be displayed when sequencing. Furthermore, the error code displayed might be the sum of two error codes. For example, if the */InstallPath* and */OutputFile* parameters are missing, the Microsoft System Center Application Virtualization Sequencer will return 96—the sum of the two error codes. - - - -01 -There is an unspecified error. - -02 -The specified installation directory (/INSTALLPACKAGE) specified is not valid. - -04 -The specified package root directory (/INSTALLPATH) is not valid. - -08 -The */OutputFile* parameter that was specified is not valid. - -16 -The installation directory (/INSTALLPACKAGE) was not specified. - -32 -The package root directory (/INSTALLPATH) was not specified. - -64 -The */OutputFile* parameter was not specified. - -128 -The specified application virtualization drive is not valid. - -256 -The installer failed. - -512 -Sequencing the application failed. - -1024 -Evaluating installed shortcuts failed. - -2048 -The sequenced application package cannot be saved. - -4096 -The specified package name (/PACKAGENAME) is not valid. - -8192 -The specified block size (/BLOCKSIZE) is not valid. - -16384 -The specified compression type (/COMPRESSION) is not valid. - -32768 -The specified project path is not valid. - -65536 -The specified upgrade parameter is not valid. - -131072 -The specified upgrade project parameter is not valid. - -262144 -The specified decode path parameter is not valid. - -525288 -The package name was not specified. - -## Related topics - - -[About Using the Sequencer Command Line](about-using-the-sequencer-command-line.md) - -[Command-Line Parameters](command-line-parameters.md) - - - - - - - - - diff --git a/mdop/appv-v4/command-line-parameters.md b/mdop/appv-v4/command-line-parameters.md deleted file mode 100644 index 2c67aced2f..0000000000 --- a/mdop/appv-v4/command-line-parameters.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Command-Line Parameters -description: Command-Line Parameters -author: dansimp -ms.assetid: d90a0591-f1ce-4cb8-b244-85cc70461922 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Command-Line Parameters - - -Use the following Application Virtualization Sequencer parameters to sequence an application and to upgrade a sequenced application package at the command prompt. In the Microsoft Application Virtualization Sequencer directory, you would enter **SFTSequencer**, followed by the appropriate parameter. - -*/HELP* or */?* -Use to display the list of parameters available for command-line sequencing. - -*/INSTALLPACKAGE* or */I* -Use to specify the installer or a batch file for the application to be sequenced. - -*/INSTALLPATH* or */P* -Use to specify the package root directory. - -*/OUTPUTFILE* or */O* -Use to specify the path and file name of the SPRJ file that will be generated. - -**Important**   -The */OUTPUTFILE* parameter is not available when opening a package that you do not intend to upgrade. - - - -*/FULLLOAD* or */F* -Use to specify whether to put everything in the primary feature block. - -*/PACKAGENAME* or */K* -Use to specify the package name of the sequenced application. - -*/BLOCKSIZE* -Specifies the SFT file block size that will be used to stream the package to client computers. You can select one of the following values: - -- 4 KB - -- 16 KB - -- 32 KB - -- 64 KB - -You should consider the size of the SFT file when you specify the block size. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes use more network bandwidth. - -*/COMPRESSION* -Use to specify the method for compressing the SFT file as it is streamed to the client. - -*/MSI* or */M* -Use to specify generating a Microsoft Windows Installer package for the sequenced application. - -*/DEFAULT* -Specifies the default SPRJ file that will be used when creating a virtual application package. This file is used as the .sprj template when the application is sequenced for the first time. - -*/UPGRADE* -Specifies the path and file name of the SPRJ file that will be upgraded. - -*/DECODEPATH* -Specifies the directory on the sequencing computer where the files associated with the sequenced application package are installed. Use one of the following formats when specifying the directory: - -- /decodepath:Q: - -- /decodepath:Q:. - -- /decodepath:”Q:.” - -- /decodepath:”Q:” - -## Related topics - - -[About Using the Sequencer Command Line](about-using-the-sequencer-command-line.md) - -[How to Open a Sequenced Application Using the Command Line](how-to-open-a-sequenced-application-using-the-command-line.md) - -[How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md) - - - - - - - - - diff --git a/mdop/appv-v4/completion-page-package-accelerator.md b/mdop/appv-v4/completion-page-package-accelerator.md deleted file mode 100644 index 7542c71906..0000000000 --- a/mdop/appv-v4/completion-page-package-accelerator.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Completion Page -description: Completion Page -author: dansimp -ms.assetid: b2c7776c-2c35-4d25-92b4-6cd8c2bdff42 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Completion Page - - -Use the **Completion** page to review the package completion report. Any issues experienced during sequencing are displayed in the **Successful Virtual Application Package Report** pane. This information is also available in the directory where the package is saved in a file named Report.xml. - -This page contains the following elements: - -**Close** -Closes the **Create New Package Wizard**. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/completion-page.md b/mdop/appv-v4/completion-page.md deleted file mode 100644 index c733a56d5d..0000000000 --- a/mdop/appv-v4/completion-page.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Completion Page -description: Completion Page -author: dansimp -ms.assetid: b284d362-b9e1-4d04-88cd-fe9980652188 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Completion Page - - -Always save App-V Package Accelerators and any associated installation media in a secure location on the network to protect App-V Package Accelerators and the installation files from being tampered with or becoming corrupted. Transforms can also contain password and user-specific information so that you must save App-V Package Accelerators in a secure location. You must also digitally sign the Package Accelerator after you create it so the publisher can be verified when the Package Accelerator is applied. A digital signature is an electronic security mark that can help indicate the publisher of the software and whether the package has been tampered with, after the transform was originally signed. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-app.md b/mdop/appv-v4/configure-app.md deleted file mode 100644 index 407824e6a0..0000000000 --- a/mdop/appv-v4/configure-app.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: CONFIGURE APP -description: CONFIGURE APP -author: dansimp -ms.assetid: fcfb4f86-8b7c-4208-bca3-955fd067079f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CONFIGURE APP - - -Enables the user to change the icon associated with an application but does not update the icon on existing shortcuts or file type associations. - -`SFTMIME CONFIGURE APP:application /ICON icon-pathname [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application.

    /ICON <icon-pathname>

    The path or URL for the icon file.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-package.md b/mdop/appv-v4/configure-package.md deleted file mode 100644 index 2bccdbf61d..0000000000 --- a/mdop/appv-v4/configure-package.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: CONFIGURE PACKAGE -description: CONFIGURE PACKAGE -author: dansimp -ms.assetid: acc7eaa8-6ada-47b9-a655-2ca2537605b9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CONFIGURE PACKAGE - - -Enables the user to change a package manifest file, package source, load trigger types, or load target for a package. - -`SFTMIME CONFIGURE PACKAGE:package-name [/MANIFEST manifest-path] [/OVERRIDEURL url] [/AUTOLOADNEVER] [/AUTOLOADONREFRESH] [/AUTOLOADONLOGIN] [/AUTOLOADONLAUNCH] [/AUTOLOADTARGET {NONE|ALL|PREVUSED}] [/LOG log-pathname | /CONSOLE | /GUI] [/NO-UPDATE-FTA-SHORTCUT {TRUE|FALSE} {/GLOBAL}]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    PACKAGE:<package-name>

    User-visible and user-friendly name for the package.

    /MANIFEST <manifest-path>

    The path or URL of the manifest file that lists the applications included in the package and all of their publishing information.

    /OVERRIDEURL <URL>

    The location of the package's SFT file.

    /AUTOLOADNEVER

    Background loading is turned off for the package.

    /AUTOLOADONREFRESH

    Background loading is performed after a publishing refresh.

    /AUTOLOADONLOGIN

    Background loading is performed when a user logs in.

    /AUTOLOADONLAUNCH

    Background loading is performed after a user starts an application from the package.

    /AUTOLOADTARGET <target>

    Indicates which applications from the package will be autoloaded.

    NONE

    No autoloading will be performed despite the presence of any /AUTOLOADONxxx flags.

    ALL

    If an autoload trigger is enabled, all applications in the package will be loaded into cache regardless of whether they have ever been launched.

    PREVUSED

    If an autoload trigger is enabled, the package will load if any applications in this package have previously been started by a user.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -For version 4.6 SP2, the following option has been added. - - ---- - - - - - - - - - - -

    [/NO-UPDATE-FTA-SHORTCUT {TRUE|FALSE} {/GLOBAL}]

    If set to TRUE, a registry value is created for the package, either per user, or globally if the /GLOBAL flag is specified.

    -

    If set to FALSE, the registry value is removed and the file type associations (FTA) for the package are reinstalled.

    -

    If not specified, normal FTA and shortcut publishing behavior occurs. If you perform any subsequent publishing refresh operations on the App-V 4.6 SP2 client, the shortcuts and FTAs for packages that have this registry value set will not be changed, and the shortcuts and FTAs will not be registered at system startup or user login unless you reset the flag.

    /GLOBAL

    Works in conjunction with the /NO-UPDATE-FTA-SHORTCUT flag. If the /GLOBAL flag is present, it indicates that a registry value will be created for that package for all users. By default, the registry value is created only for this user.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-server.md b/mdop/appv-v4/configure-server.md deleted file mode 100644 index ed7f5ca4d8..0000000000 --- a/mdop/appv-v4/configure-server.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: CONFIGURE SERVER -description: CONFIGURE SERVER -author: dansimp -ms.assetid: c916eddd-74f2-46e4-953d-120b23284e37 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CONFIGURE SERVER - - -Enables a user to change the setup of a server; any settings not specified will not be modified. - -`SFTMIME CONFIGURE SERVER:server-name [/NAME display-name] [/HOST hostname] [/PORT port] [/PATH path] [/TYPE {HTTP|RTSP}] [/REFRESH {ON|OFF}] [/SECURE] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    SERVER:<server-name>

    The display name for the publishing server.

    /NAME <display-name>

    New display name for the server.

    /HOST <hostname>

    The host name or IP address for the publishing server.

    /PORT <port>

    The port on which the publishing server listens. Defaults to 80 for normal HTTP servers, 443 for HTTP servers using enhanced security, 554 for normal Application Virtualization Servers, and 322 for servers using enhanced security.

    /PATH <path>

    The path portion of the URL used in a publishing request. If the TYPE parameter is set to RTSP, the path is optional and defaults to "/".

    /TYPE

    Indicates whether the publishing server is a Web server ("HTTP") or an Application Virtualization Server ("RTSP").

    /REFRESH

    If set to ON, publishing information will be refreshed when the user logs in. Defaults to ON.

    /SECURE

    If present, indicates that a connection with enhanced security should be established to the publishing server.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-software-page--learn-more-.md b/mdop/appv-v4/configure-software-page--learn-more-.md deleted file mode 100644 index 87abcb67dd..0000000000 --- a/mdop/appv-v4/configure-software-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configure Software Page (Learn More) -description: Configure Software Page (Learn More) -author: dansimp -ms.assetid: 9a0cd4a5-88da-4897-a13a-5d21fc04afda -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Software Page (Learn More) - - -Use the **Configure Software** page to run each program to complete any configuration tasks after the installation. For example, this step helps configure any associated application license agreements. - -This page contains the following elements: - -**Run Selected** -Opens only the selected programs associated with the application. - -**Run All** -Opens all programs associated with the application. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-software-page-app-v-46-sp1.md b/mdop/appv-v4/configure-software-page-app-v-46-sp1.md deleted file mode 100644 index 7d201afb8d..0000000000 --- a/mdop/appv-v4/configure-software-page-app-v-46-sp1.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configure Software Page -description: Configure Software Page -author: dansimp -ms.assetid: 50596eba-ce20-4d36-8e57-bd4b6c6cf92e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configure Software Page - - -Use the **Configure Software** page to manage the application first-use tasks. - -This page contains the following elements: - -**Configure Software** -Click **Configure Software** to manually configure application first-use tasks. Selecting this option can increase the overall sequencing time depending on the size of the package you are creating. - -**Skip this step** -Click **Skip this step** to skip configuring the application. If you choose to skip this step, end users have to perform any required first-use tasks such as accepting any license agreements and first-use questions. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configure-type.md b/mdop/appv-v4/configure-type.md deleted file mode 100644 index 42307e58cb..0000000000 --- a/mdop/appv-v4/configure-type.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: CONFIGURE TYPE -description: CONFIGURE TYPE -author: dansimp -ms.assetid: 2caf9433-5449-486f-ab94-83ee8e44d7f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# CONFIGURE TYPE - - -Enables the user to change settings for a file type association. - -`SFTMIME CONFIGURE TYPE:file-extension [/GLOBAL] [/APP application] [/ICON icon-pathname] [/DESCRIPTION type-desc] [/CONTENT-TYPE content-type] [/PERCEIVED-TYPE perceived-type] [/PROGID progid] [/CONFIRMOPEN {YES|NO}] [/SHOWEXT {YES|NO}] [/NEWMENU {YES|NO}] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    TYPE:<file-extension>

    The file name extension to be configured.

    /APP <application>

    The name and version (optional) of the application to associate this file type with. Cannot be specified with PROGID.

    /ICON <icon-pathname>

    The path or URL for the icon file.

    /DESCRIPTION <type-desc>

    The user-friendly name for the file type.

    /CONTENT-TYPE <content-type>

    The content type of the file.

    /GLOBAL

    If present, indicates that the association that applies to all users should be edited, not the user-specific one.

    /PERCEIVED-TYPE <perceived-type>

    The perceived type of the file.

    /PROGID <progid>

    Indicates that the extension should be associated with a different file type. The previous file type is not deleted. Cannot be specified with APP, ICON, DESCRIPTION, CONFIRMOPEN, or SHOWEXT.

    /CONFIRMOPEN

    Indicates whether users downloading a file of this type should be asked whether to open or save the file.

    /SHOWEXT

    Indicates whether the file's extension should always be shown, even if the user has requested that all extensions be hidden.

    /NEWMENU

    Indicates whether an entry should be added to the shell's New menu.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md b/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md deleted file mode 100644 index 1fe3f100c5..0000000000 --- a/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Configuring App-V Administration for a Distributed Environment -description: Configuring App-V Administration for a Distributed Environment -author: dansimp -ms.assetid: 53971fa9-8319-435c-be74-c37feb9af1da -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring App-V Administration for a Distributed Environment - - -When designing the infrastructure for your specific organization, you can install the App-V Management Web Service on a computer other than the computer where you install the App-V Management Server. Common reasons for separating these App-V components include the following: - -- Performance - -- Reliability - -- Availability - -- Scalability - -Separating the Management Server and Management Web Service requires additional configuration for the infrastructure to operate correctly. When you separate these two features but do not complete the procedures described in this topic, the Management Console will connect to the Management Web Service but will not be able to properly authenticate with the data store. The Management Console will not load properly, and the administrator will not be able to complete any administrative tasks. - -This behavior occurs because the Management Web Service cannot use the credentials, passed to it from the Management Console, to access the data store. The solution is to configure the Management Web Service server to be “Trusted for delegation.” - -## Configuring Active Directory Domain Services - - -It is also necessary to configure Active Directory Domain Services properly to work in a distributed environment. This section includes the information you need configure Active Directory Domain Services. - -### When SQL Service Uses Local System account - -To set up the environment where the SQL Service uses the local system account, change the properties of the machine account of the Management Web Service to be trusted for delegation. For detailed procedures about how to do this, see [How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md) - -### When SQL Service Uses Domain-Based Account - -To set up the environment where SQL Servers use domain-based service accounts, you need to consider whether or not a variety of factors apply, including the following: - -- Clustering of SQL Server - -- Replication - -- Automated tasks - -- Linked servers - -For information about configuring Active Directory Domain Services when the SQL service uses a domain-based account, see . - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-app-v-for-secure-administration.md b/mdop/appv-v4/configuring-app-v-for-secure-administration.md deleted file mode 100644 index a71fffa3c7..0000000000 --- a/mdop/appv-v4/configuring-app-v-for-secure-administration.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configuring App-V for Secure Administration -description: Configuring App-V for Secure Administration -author: dansimp -ms.assetid: 4543fa81-c8cc-4b10-83b7-060778eb1349 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring App-V for Secure Administration - - -In an environment where securing administrative operations is important, App-V allows for secure communication between the App-V Web Management Service and the App-V Management Console. Because the Management Service is a Web-based application, it requires securing the App-V Management Server application on the Web server that hosts the Management Service. As shown in the following illustration, this process includes using HTTPS for communication and configuring the IIS server to allow only Windows Integrated Authentication. - -![app-v web service network configuration](images/appvmgmtwebservice.gif) - -The App-V Web Management Service is installed as a Web-based application on IIS. For the Web Management Service to support secure (SSL) connections between the App-V Management Console and the Web Management Service, you will need to configure the IIS server where the Web Management Service is installed and configure the App-V Management Console. - -## In This Section - - -[Configuring Certificates to Support the App-V Web Management Service](configuring-certificates-to-support-the-app-v-web-management-service.md) -Provides helpful information about configuring certificates to support SSL-based connections, to help secure communication for the App-V Web Management Service. - -[How to Install and Configure the App-V Management Console for a More Secure Environment](how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md) -Provides a step-by-step procedure for connecting to an App-V Web Management Service by using a secure connection. - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md b/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md deleted file mode 100644 index fe8ec7d8bc..0000000000 --- a/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Configuring Certificates to Support App-V Management Server or Streaming Server -description: Configuring Certificates to Support App-V Management Server or Streaming Server -author: dansimp -ms.assetid: 2f24e550-585e-4b7e-b486-22a3f181f543 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring Certificates to Support App-V Management Server or Streaming Server - - -After you complete the certificate provisioning process and change the private key permissions to support the App-V installation, you can launch the setup of the Management Server or the Streaming Server. During setup, if a certificate is provisioned before running the setup program, the wizard displays the certificate in the **Connection Security Mode** screen and, by default, the **Use enhanced security** check box is selected. - -**Note**   -Select the certificate that was configured for App-V if there is more than one certificate provisioned for this server. - - - -**Important**   -When upgrading from version  4.2 to version  4.5, the setup has an option for **Use enhanced security**; however, selecting this option will not disable streaming over RTSP. You must use the Management Console to disable RTSP after installation. - - - -Select the TCP port that the service will use for client communications. The default port is TCP 322; however, you can change the port to a custom port for your environment. - -The remaining steps of the wizard are the same as if you were deploying an App-V Management or Streaming Server without using the **Enhanced security** feature. - -## Configuring Certificates for NLB Environments - - -To support large enterprises, often the Management Server is placed into a Network Load Balancing (NLB) cluster to support the large number of connections. This requires at least two Management Servers that appear to be a single Management Server. When your environment uses an NLB cluster with several Management Servers, you need an advanced configuration of the certificate used for the NLB cluster. - -The App-V certificate is submitted to a certification authority (CA) that is configured on a computer running Windows Server 2003. The SAN lets you connect to a specific Management Server NLB cluster host name by using a Domain Name System (DNS) name that might differ from the actual computer names, because there can be up to 32 servers that comprise the NLB cluster. - -This configuration is necessary only when using an NLB cluster. When the client connects to the server, it will connect using the fully qualified domain name (FQDN) of the NLB cluster and not the FQDN of an individual server. If you do not add the SAN property with the FQDN of the server nodes in the cluster, all client connections are refused because the common name of the certificate won’t match the server name. - -For more detailed information about configuring certificates with the SAN attribute, see . - -## Related topics - - -[Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md) - -[How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md b/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md deleted file mode 100644 index 86f2485e5c..0000000000 --- a/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Configuring Certificates to Support Secure Streaming -description: Configuring Certificates to Support Secure Streaming -author: dansimp -ms.assetid: 88dc76d8-7745-4729-92a1-af089c921244 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring Certificates to Support Secure Streaming - - -By default, the App-V service runs under the Network Service account. However, you can create a service account in Active Directory Domain Services and replace the Network Service account with the Active Directory Domain account. - -The security context under which the service runs is important for configuring enhanced secure communications. This security context must have read permissions for the certificate private key. When a PKCS\#10 *Certificate Signing Request* (CSR) is generated for the App-V server, the Windows *Cryptographic Service Provider* is called and a private key is generated. The private key is secured with permissions given to the System and Administrator accounts only. - -You must modify the access control lists (ACLs) on the private key to let the App-V Management or Streaming Server access the private key required for successful TLS secured communication. - -## Obtaining and Installing a Certificate - - -The scenarios for obtaining and installing a certificate for App-V are as follows: - -- Internal public key infrastructure (PKI). - -- Third-party certificate issuing certification authority (CA). - - **Note**   - If you need to obtain a certificate from a third-party CA, follow the documentation available on that CA’s Web site. - - - -If a PKI infrastructure has been deployed, consult with the PKI administrators to acquire a certificate that complies with the requirements described in this topic. If a PKI infrastructure is not available, use a third-party CA to obtain a valid certificate. - -For step-by-step guidance for obtaining and installing a certificate, see . - -## Related topics - - -Configuring Certificates to Support Secure Streaming -[How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md b/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md deleted file mode 100644 index 7999d55e32..0000000000 --- a/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configuring Certificates to Support the App-V Web Management Service -description: Configuring Certificates to Support the App-V Web Management Service -author: dansimp -ms.assetid: b7960161-2c19-4cbf-a98a-d4b06f547dce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring Certificates to Support the App-V Web Management Service - - -The App-V Web Management Service must be configured to support SSL-based connections to help secure the communication. This process requires that the Web server or computer on which the Management Service is installed has a certificate issued to the service or computer. - -The following scenarios illustrate how to obtain a certificate for this purpose: - -1. The company infrastructure already has a public key infrastructure (PKI) in place that automatically issues certificates to computers. - -2. The company infrastructure already has a PKI in place, although it does not automatically issue certificates to computers. - -3. The company infrastructure has no PKI in place. - -In each of the preceding scenarios, the method for obtaining a certificate is different, but the end result is the same. The administrator must assign a certificate to the IIS Default Web Site and configure the App-V Web Management Service to require secure communications. - -**Important**   -The name of the certificate must match the name of the server. It is a best practice to use fully qualified domain names (FQDNs) for the common name of the certificate. - - - -App-V can use IIS servers to support different infrastructure configurations. For more information about configuring IIS servers to support HTTPS, see . - -## Related topics - - -[How to Install and Configure the App-V Management Console for a More Secure Environment](how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md) - - - - - - - - - diff --git a/mdop/appv-v4/configuring-iis-for-secure-streaming.md b/mdop/appv-v4/configuring-iis-for-secure-streaming.md deleted file mode 100644 index 1e5c0be5b8..0000000000 --- a/mdop/appv-v4/configuring-iis-for-secure-streaming.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Configuring IIS for Secure Streaming -description: Configuring IIS for Secure Streaming -author: dansimp -ms.assetid: 9a80a703-4642-4bec-b7af-dc7cb6b76925 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring IIS for Secure Streaming - - -With the release of Microsoft Application Virtualization (App-V) version 4.5, you can use HTTP and HTTPS as protocols for streaming application packages to the App-V clients. This option enables organizations to leverage the additional scalability that IIS typically offers. When you use IIS as a streaming server, you can help secure the communications between the client and server by using HTTPS instead of HTTP. - -**Note**   -If you want to stream applications from a file server, you should enhance the security of the communications to the application packages. This can be achieved using IPsec. For more information see the following topics in the TechNet Library: - -- For Windows Server 2003, - -- For Windows Server 2008, - - - -## MIME Types - - -When you use IIS to stream virtual applications with HTTP or HTTPS, to support App-V, the following MIME types must be added to the IIS server: - -- .OSD=TXT - -- .SFT=Binary - -Use the following KB articles as guidance for adding MIME types: - -IIS 6.0: - -IIS 7.0: - -## Kerberos Authentication - - -When you use HTTP or HTTPS and Kerberos authentication to stream ICO, OSD, or SFT files, you are enhancing the security of your environment. However, for IIS to support Kerberos authentication, you must configure a proper Service Principal Name (SPN). The `setspn.exe` tool is available for Windows Server 2003 from the Support Tools on the installation CD and is built-in to Windows Server 2008. - -To create an SPN, run `setspn.exe` from a command prompt while logged in as a member of Domain Administrators—for example, `setspn.exe –A HTTP/FQDN of Server ServerName`. - -## Related topics - - -[Configuring Management or Streaming Server for Secure Communications Post-Installation](configuring-management-or-streaming-server-for-secure-communications-post-installation.md) - - - - - - - - - diff --git a/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md b/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md deleted file mode 100644 index 022b096208..0000000000 --- a/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Configuring Management or Streaming Server for Secure Communications Post-Installation -description: Configuring Management or Streaming Server for Secure Communications Post-Installation -author: dansimp -ms.assetid: 1062a213-470b-4ae2-b12f-b3e28a6ab745 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Management or Streaming Server for Secure Communications Post-Installation - - -If the proper certificate was not provisioned before the installation of the App-V Management Server or the App-V Streaming Server, App-V can be configured for enhanced security after the initial installation. You can configure the App-V Management Server through the App-V Management Console. However, the App-V Streaming Server is managed through the registry. In either case, the certificate must include the proper *extended key usage* (EKU) for Server authentication and the Network Service must have read access to the private key. - -## In This Section - - -[How to Configure Management Server Security Post-Installation](how-to-configure-management-server-security-post-installation.md) -Provides a procedure that can be performed post-installation, using the App-V Management Console, to add the certificate and configure the App-V Management Server for enhanced security. - -[How to Configure Streaming Server Security Post-Installation](how-to-configure-streaming-server-security-post-installation.md) -Provides a procedure that can be performed post-installation, to add the certificate and configure the App-V Streaming Server for enhanced security. - -[Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md) -Provides troubleshooting guidance for when the private key has not been configured with the proper ACL for the Network Service. - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md b/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md deleted file mode 100644 index 92700f1f2a..0000000000 --- a/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Configuring Prerequisite Groups in Active Directory for App-V -description: Configuring Prerequisite Groups in Active Directory for App-V -author: dansimp -ms.assetid: 0010d534-46c0-44a3-b5c1-621b4d5e2c31 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Prerequisite Groups in Active Directory for App-V - - -Before you install the Microsoft Application Virtualization (App-V) Management Server, you must create the following objects in Active Directory. App-V uses Active Directory groups to control access to applications and administrative functions. You will use these groups during the server installation process and when publishing applications. - -## Configuring Prerequisite Groups in Active Directory for Application Virtualization - - -This table lists the Active Directory groups that are required for installing App-V. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ObjectDescription

    Organizational Unit (OU)

    Create an OU in Active Directory for the specific groups required for App-V.

    App-V Administrative Group

    During installation of the App-V Management Server, you must select an Active Directory group to use as the App-V Administrators group to control administrative access to the Management Console. Create a security group for App-V administrators, and add to this group every user who needs to use the Management Console. You cannot create this group directly from the App-V Management Server installer.

    App-V Users Group

    App-V requires that every User account that accesses App-V functions be a member of a provider policy associated with a single group for general platform access. Use an existing group; for example, Domain Users, if all users are to have access to App-V, or create a new group.

    Application Groups

    App-V associates the right to use an individual application with an Active Directory group. Create an Active Directory group for each application, and assign users to these groups as needed to control user access to the applications.

    - -  - -## Related topics - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) - -[How to Configure Windows Server 2008 for App-V Management Servers](how-to-configure-windows-server-2008-for-app-v-management-servers.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md b/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md deleted file mode 100644 index f8ec256bdd..0000000000 --- a/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Configuring the Application Virtualization Sequencer (App-V 4.6 SP1) -description: Configuring the Application Virtualization Sequencer (App-V 4.6 SP1) -author: dansimp -ms.assetid: af775165-5b99-4c74-807f-f504377c7be4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring the Application Virtualization Sequencer (App-V 4.6 SP1) - - -Use any of the following links for more information about configuring the App-V Sequencer. - -## In This Section - - -[How to Install the Sequencer (App-V 4.6 SP1)](how-to-install-the-sequencer---app-v-46-sp1-.md) -Describes how to install the App-V Sequencer. - -[How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md) -Describes how to create a project template. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md b/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md deleted file mode 100644 index 571b263abc..0000000000 --- a/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configuring the Application Virtualization Sequencer -description: Configuring the Application Virtualization Sequencer -author: dansimp -ms.assetid: cae1c368-9fcd-454e-8fc9-0893345d55bf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring the Application Virtualization Sequencer - - -To configure your environment for the Microsoft Application Virtualization (App-V) Sequencer, you need to perform certain tasks. - -Click any link in the following section for information about configuring your environment for running the Sequencer. - -## In This Section - - -[How to Install the Sequencer](how-to-install-the-sequencer.md) -Contains the steps for installing the App-V Sequencer. - -[How to Create the Package Root Directory](how-to-create-the-package-root-directory.md) -Contains the steps necessary to configure the directory where sequenced applications will be installed. - -[How to Modify the Location of the Log Directory](how-to-modify-the-location-of-the-log-directory.md) -Contains the steps necessary to configure where the Sequencer logs will be saved. - -[How to Modify the Location of the Scratch Directory](how-to-modify-the-location-of-the-scratch-directory.md) -Contains the steps necessary to configure the location where the Sequencer temporarily stores files during sequencing. - -## Related topics - - -[Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md b/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md deleted file mode 100644 index 688c137ae2..0000000000 --- a/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Configuring the Firewall for the App-V Servers -description: Configuring the Firewall for the App-V Servers -author: dansimp -ms.assetid: f779c450-6c6f-46a8-ac66-5e82e0689d55 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring the Firewall for the App-V Servers - - -After you install the Microsoft Application Virtualization (App-V) Management Server or Streaming Server and configure it to use the RTSP or RTSPS protocol, you must create firewall exceptions for the App-V programs. - -## Configuring Firewall Exceptions for Application Virtualization Management Server - - -Create a firewall exception for **sghwdsptr.exe** and **sghwsvr.exe**. These programs are found in the folder C:\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Server\\bin on a 32-bit operating system. If you are using a 64-bit operating system version, the folder is located under C:\\Program Files (x86)\\Microsoft System Center App Virt Management Server\\App Virt Management Server\\bin. - -## Configuring Firewall Exceptions for Application Virtualization Streaming Server - - -Create a firewall exception for **sglwdsptr.exe** and **sglwsvr.exe**. These programs are found in the folder C:\\Program Files\\Microsoft System Center App Virt Streaming Server\\App Virt Streaming Server\\bin on a 32-bit operating system. If you are using a 64-bit operating system version, the folder is located under C:\\Program Files (x86)\\Microsoft System Center App Virt Streaming Server\\App Virt Streaming Server\\bin. - -## Related topics - - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - -[How to Install and Configure the Default Application](how-to-install-and-configure-the-default-application.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/configuring-windows-firewall-for-app-v.md b/mdop/appv-v4/configuring-windows-firewall-for-app-v.md deleted file mode 100644 index f97d412295..0000000000 --- a/mdop/appv-v4/configuring-windows-firewall-for-app-v.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Configuring Windows Firewall for App-V -description: Configuring Windows Firewall for App-V -author: dansimp -ms.assetid: 6b5e253c-473f-4afc-a48b-631eda11d9ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Windows Firewall for App-V - - -Securing the communication between components in an App-V infrastructure is only one element in securing the environment. Using a firewall program on the server can help reduce the attack surface area. The topics in this section provide procedures for configuring Windows built-in firewall capabilities that support App-V. These procedures assume that you installed a Management Server and that it has been configured for RTSPS communication. Notes are included in the procedures for Streaming Servers and environments where RTSP is being used for communication. - -## In This Section - - -[How to Configure Windows Server 2003 Firewall for App-V](how-to-configure-windows-server-2003-firewall-for-app-v.md) -Provides a procedure you can use to configure the Windows Server 2003 firewall for App-V. - -[How to Configure Windows Server 2008 Firewall for App-V](how-to-configure-windows-server-2008-firewall-for-app-v.md) -Provides a procedure you can use to configure the Windows Server 2008 firewall for App-V. - -  - -  - - - - - diff --git a/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md b/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md deleted file mode 100644 index 11cb5f957c..0000000000 --- a/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Create New Package Wizard (AppV 4.6 SP1) -description: Create New Package Wizard (AppV 4.6 SP1) -author: dansimp -ms.assetid: 1f73d044-b364-4c95-8ae1-daedd316d87e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create New Package Wizard (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V Create New Package wizard. - -## In This Section - - -[Packaging Method Page (Learn More)](packaging-method-page--learn-more-.md) - -[Prepare Computer Page (Learn More)](prepare-computer-page--learn-more-.md) - -[Type of Application Page (Learn More)](type-of-application-page--learn-more-.md) - -[Select Installer Page (Learn More)](select-installer-page--learn-more-.md) - -[Package Name Page (Learn More)](package-name-page---learn-more-.md) - -[Installation Page (Learn More)](installation-page--learn-more-.md) - -[Configure Software Page (Learn More)](configure-software-page--learn-more-.md) - -[Installation Files Page](installation-files-page.md) - -[Installation Report Page (Learn More)](installation-report-page--learn-more-.md) - -[Customize Page (Learn More)](customize-page--learn-more-.md) - -[Select Primary Page (Learn More)](select-primary-page--learn-more-.md) - -## Related topics - - -[Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/create-package-accelerator--review-errors--page.md b/mdop/appv-v4/create-package-accelerator--review-errors--page.md deleted file mode 100644 index 63cdf9f7e1..0000000000 --- a/mdop/appv-v4/create-package-accelerator--review-errors--page.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Create Package Accelerator (Review Errors) Page -description: Create Package Accelerator (Review Errors) Page -author: dansimp -ms.assetid: ea3f531d-1887-4b42-a30f-b875d0ccb916 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create Package Accelerator (Review Errors) Page - - -Use the **Completion** page to review the Package Accelerator completion report. Any issues experienced during sequencing are displayed. - -This page contains the following elements: - -**Close** -Closes the **Create Package Accelerator** wizard. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/create-package-accelerator-page.md b/mdop/appv-v4/create-package-accelerator-page.md deleted file mode 100644 index 2d86172bf5..0000000000 --- a/mdop/appv-v4/create-package-accelerator-page.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Create Package Accelerator Page -description: Create Package Accelerator Page -author: dansimp -ms.assetid: 51cdc262-beda-4a4f-bb3e-66458062a7bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create Package Accelerator Page - - -Use the **Create Package Accelerator** page to specify the location where to save the Package Accelerator. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the location where to save the Package Accelerator. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md b/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md deleted file mode 100644 index 65aba0176a..0000000000 --- a/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Create Package Accelerator Wizard (AppV 4.6 SP1) -description: Create Package Accelerator Wizard (AppV 4.6 SP1) -author: dansimp -ms.assetid: 976d84e1-86d7-4a9b-a747-2b6eef790c1f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create Package Accelerator Wizard (AppV 4.6 SP1) - - -Use any of the following links for more information about the use of page elements in the App-V Create Package Accelerator wizard. - -## In This Section - - -[About Sharing Package Accelerators Page](about-sharing-package-accelerators-page.md) - -[Select Package (Learn More) Page](select-package--learn-more--page.md) - -[Installation Files Page](installation-files-page.md) - -[Gathering Information Page (Learn More)](gathering-information-page--learn-more-.md) - -[Select Files Page](select-files-page.md) - -[Verify Applications Page (Package Accelerators)](verify-applications-page--package-accelerators-.md) - -[Select Guidance Page (Package Accelerators)](select-guidance-page--package-accelerators-.md) - -[Create Package Accelerator Page](create-package-accelerator-page.md) - -[Completion Page](completion-page.md) - -[Create Package Accelerator (Review Errors) Page](create-package-accelerator--review-errors--page.md) - -## Related topics - - -[Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/create-package-page--app-v-46-sp1.md b/mdop/appv-v4/create-package-page--app-v-46-sp1.md deleted file mode 100644 index cfd5f7b2fc..0000000000 --- a/mdop/appv-v4/create-package-page--app-v-46-sp1.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Create Package Page -description: Create Package Page -author: dansimp -ms.assetid: dd7a8709-74cc-459a-88ac-b63d8dcf2ddf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create Package Page - - -Use the **Create Package** page to add optional comments and to specify where the package will be saved. You can also specify whether the package should be compressed. After you have configured the options on this page, click **Create** to create the new virtual application package. - -This page contains the following elements: - -**Comments** -Add optional comments that will be associated with the new virtual application package. The comments that you add help identify the purpose or version of the virtual application package. - -**Save Location** -Click **Browse** and specify to which location you want to save the package (.**sprj** file). - -**Compress Package** -Select the **Compress Package** check box to compress the package, which can help enhance package streaming to target computers. We recommend that you select this option for packages that are larger than 4 GB. The current uncompressed package size is also displayed. - -**Note**   -If the original package size is more than 4 GB and compressed, by default, the checkbox is checked and cannot be changed. If the original package is compressed and less than 4 GB, the check box is checked, but can be cleared. - - - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/customize-page--learn-more-.md b/mdop/appv-v4/customize-page--learn-more-.md deleted file mode 100644 index 0bed35f090..0000000000 --- a/mdop/appv-v4/customize-page--learn-more-.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Customize Page (Learn More) -description: Customize Page (Learn More) -author: dansimp -ms.assetid: 893df614-7058-4fcf-ba34-d0f16c856374 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Customize Page (Learn More) - - -Use the **Customize** page to finish creating the virtual application package or to configure the virtual application package further. - -This page contains the following elements: - -**Stop Now** -Creates a basic virtual application package. If you select this option, the package creation will finish, and the package will be available in the Sequencer console. - -**Customize** -Enables you to configure the virtual application package further. You can perform the following configuration items: - -- **Edit Shortcuts**. Add, remove, or change the shortcuts, and configure the file type associations associated with the virtual application package that will be created on target computers. - -- **Prepare virtual application package for streaming to improve the initial end user experience**. Optimize the virtual application package for streaming across the network. - -- **Restrict operating systems that can run this package**. Specify the operating systems that can run the virtual application package. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index a4d6ce5126..0000000000 --- a/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Defender Running Dialog Box (App-V 4.6 SP1) -description: Defender Running Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 716ec7f9-ddad-45dd-a3c7-4a9d81cfcfd0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Defender Running Dialog Box (App-V 4.6 SP1) - - -Microsoft Windows Defender is running. You should stop Windows Defender before continuing with the installation. Windows Defender can interfere with creation of a package by accessing files that must be added to the virtual application package or by adding extraneous data to the virtual application package. - -Use the following procedure to stop Microsoft Windows Defender from running during sequencing. - -1. On the computer running the App-V Sequencer, click **Start**, right-click **Computer**, and then click **Manage**. - -2. In the **Computer Management** console, double click **Services and Applications**, and then double-click **Services** to expand **Services**. - -3. Locate it in the list. Right-click Windows Defender, click **Stop** to stop Microsoft Windows Defender, and then click **Ok**. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 0fc1fd41be..0000000000 --- a/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Defrag Running Dialog Box (App-V 4.6 SP1) -description: Defrag Running Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 0ceb0897-377e-4754-a7ab-3bc2b5af1452 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Defrag Running Dialog Box (App-V 4.6 SP1) - - -The Disk Defragmenter service is running. The Disk Defragmenter service uses system resources and can cause degradation in performance or increase the time it takes to create virtual application package. - -Use the following procedure to stop the Disk Defragmenter service from running during sequencing. - -1. On the computer running the App-V Sequencer, click **Start**, right-click **Computer**, and then click **Manage**. - -2. In the **Computer Management** console, double-click **Services and Applications**, and then double-click **Services** to expand **Services**,. - -3. Locate it in the list. Right-click **Disk Defragmenter**, click **More Actions**, click **Stop** to stop Disk Defragmenter, and then click **OK**. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/delete-app.md b/mdop/appv-v4/delete-app.md deleted file mode 100644 index a5a5189fe4..0000000000 --- a/mdop/appv-v4/delete-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: DELETE APP -description: DELETE APP -author: dansimp -ms.assetid: 2f89c0c0-373b-4389-a26d-67b3f9712957 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE APP - - -Removes an application record from the file system cache to make it no longer visible. Users’ shortcuts and file type associations are hidden but not deleted. No user settings are removed. - -`SFTMIME DELETE APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application to be removed.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/delete-obj.md b/mdop/appv-v4/delete-obj.md deleted file mode 100644 index e0e1085ae9..0000000000 --- a/mdop/appv-v4/delete-obj.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: DELETE OBJ -description: DELETE OBJ -author: dansimp -ms.assetid: fb17a261-f378-4ce6-a538-ab2f0ada0f2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE OBJ - - -Removes all of your application records. - -`SFTMIME DELETE OBJ:APP [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    /GLOBAL

    If specified, all applications are removed. By default, only applications the current user has access to are removed.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/delete-package.md b/mdop/appv-v4/delete-package.md deleted file mode 100644 index f89b69d461..0000000000 --- a/mdop/appv-v4/delete-package.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: DELETE PACKAGE -description: DELETE PACKAGE -author: dansimp -ms.assetid: 8f7a4598-610d-490e-a224-426acce01a9f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE PACKAGE - - -Removes a package record and the applications associated with it. - -`SFTMIME DELETE PACKAGE:package-name [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    PACKAGE:<package-name>

    The name of the package to be removed.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - - - -**Important**   -The DELETE PACKAGE command always performs a global delete of the package and deletes only global file types and shortcuts. - -If the package is global, this command must be run as local Administrator; otherwise, only **DeleteApp** permission is needed. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/delete-server.md b/mdop/appv-v4/delete-server.md deleted file mode 100644 index 7425b0751b..0000000000 --- a/mdop/appv-v4/delete-server.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: DELETE SERVER -description: DELETE SERVER -author: dansimp -ms.assetid: 4c929639-1c1d-47c3-9225-cc4d7a8736f0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE SERVER - - -Removes a publishing server. - -**Note**   -This command does not remove any applications or packages published to the client by the server. For each application, use the SFTMIME **CLEAR APP** command followed by the **DELETE PACKAGE** command to completely remove those applications and packages from the client. - - - -`SFTMIME DELETE SERVER:server-name [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    SERVER:<server-name>

    The display name of the publishing server.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/delete-type.md b/mdop/appv-v4/delete-type.md deleted file mode 100644 index 62cbd9b1c7..0000000000 --- a/mdop/appv-v4/delete-type.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: DELETE TYPE -description: DELETE TYPE -author: dansimp -ms.assetid: f2852723-c894-49f3-a3c5-56f9648bb9ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DELETE TYPE - - -Removes the specified file type association. - -`SFTMIME DELETE TYPE:file-extension [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    TYPE:<file-extension>

    The file name extension to be removed.

    /GLOBAL

    If specified, indicates that the global association for the file name extension should be removed.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/deployment-tab.md b/mdop/appv-v4/deployment-tab.md deleted file mode 100644 index 0b872aa0ce..0000000000 --- a/mdop/appv-v4/deployment-tab.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Deployment Tab -description: Deployment Tab -author: dansimp -ms.assetid: 4510188b-eade-445d-a90f-b9127dd479a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deployment Tab - - -The **Deployment** tab in the Application Virtualization Sequencer Console enables you to specify parameters for the deployment of a sequenced application package. - -## In This Section - - -[About the Deployment Tab](about-the-deployment-tab.md) -Provides general information about the **Deployment** tab. - -[How to Change Deployment Properties](how-to-change-deployment-properties.md) -Provides procedures for changing package properties by using the **Deployment** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/determine-your-publishing-method.md b/mdop/appv-v4/determine-your-publishing-method.md deleted file mode 100644 index 683549aa16..0000000000 --- a/mdop/appv-v4/determine-your-publishing-method.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Determine Your Publishing Method -description: Determine Your Publishing Method -author: dansimp -ms.assetid: 1f2d0d39-5d65-457a-b826-4f45b00c8c85 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Determine Your Publishing Method - - -After you sequence an application by using the Application Virtualization Sequencer, you need to *publish* that application to your users. Publishing the application consists of delivering the icons, package definition information, and content source location to each computer where the Application Virtualization Client has been installed. The following table describes publishing methods that are supported when you deploy Application Virtualization by using an electronic software distribution (ESD) system. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    MethodAdvantagesDisadvantages

    Generate a Windows Installer file during sequencing, as a stand-alone solution.

      -
    • Very simple to use.

    • -
    • Package loaded into cache locally on each computer.

    • -
    • Icons displayed to user.

    • -
    • Similar to traditional software deployment.

    • -
    • No need for streaming servers.

    • -
      -
    • No flexibility in location of package contents on computers—same location on all computers.

    • -
    • Must use only Add/Remove Programs or msiexec to remove applications.

    • -
    • Removal and replacement with new version required for package updating.

    • -

    Generate a Windows Installer file during sequencing, used with MODE, LOAD, and OVERRIDEURL command-line properties and the package manifest.

      -
    • Simple to use but with added flexibility.

    • -
    • Icons displayed to user.

    • -
    • SFT file containing the applications can be placed on a streaming source location, with clients configured to use that location.

    • -
      -
    • Limited flexibility—only the location of the package content can be controlled at run time.

    • -
    • Must use only Add/Remove Programs or msiexec to remove the application.

    • -
    • Removal and replacement with new version required for package updating, unless using streaming server.

    • -

    Run SFTMIME commands.

      -
    • Complete flexibility—full control of all package management functions.

    • -
      -
    • Commands must be scripted for use with the ESD system.

    • -
    • Commands must be run on each computer in correct sequence.

    • -
    • Detailed understanding of command language and careful planning required.

    • -
    - -  - -For more information about using these publishing methods, see [How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md). - -## Related topics - - -[Determine Your Streaming Method](determine-your-streaming-method.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Electronic Software Distribution-Based Scenario Overview](electronic-software-distribution-based-scenario-overview.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/determine-your-streaming-method.md b/mdop/appv-v4/determine-your-streaming-method.md deleted file mode 100644 index 0033aa3003..0000000000 --- a/mdop/appv-v4/determine-your-streaming-method.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -title: Determine Your Streaming Method -description: Determine Your Streaming Method -author: dansimp -ms.assetid: 50d5e0ec-7f48-4cea-8711-5882bd89153b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Determine Your Streaming Method - - -The first time that a user double-clicks the icon that has been placed on a computer through the publishing process, the Application Virtualization client will obtain the virtual application package content from a streaming source location. - -**Note**   -*Streaming* is the term used to describe the process of obtaining content from a sequenced application package, starting with the primary feature block and then obtaining additional blocks as needed. - - - -The streaming source location is usually a server that is accessible by the user’s computer; however, some electronic distribution systems, such as Microsoft Endpoint Configuration Manager, can distribute the SFT file to the user’s computer and then stream the virtual application package locally from that computer’s cache. - -**Note**   -A streaming source location for virtual packages can be set up on a computer that is not a server. This is especially useful in a small branch office that has no server. - - - -The streaming sources that can be used to store sequenced applications are described in the following table. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server TypeProtocolAdvantagesDisadvantagesLinks

    File server

    File

      -
    • Simple low-cost solution to configure existing file server with \CONTENT share

    • -
      -
    • No active upgrade

    • -

    How to Configure the File Server

    IIS server

    HTTP/ HTTPS

      -
    • Supports enhanced security using HTTPS protocol.

    • -
    • Supports streaming to remote computers across the Internet

    • -
    • Only one port in firewall to open

    • -
    • Highly scalable

    • -
    • Familiar protocol

    • -
      -
    • Need to manage IIS

    • -
    • No active upgrade

    • -

    How to Configure the Server for IIS

    Application Virtualization Streaming Server

    RTSP/ RTSPS

      -
    • Active upgrade

    • -
    • Supports enhanced security using RTSPS protocol

    • -
    • Only one port in firewall to open (RTSPS only)

    • -
      -
    • Dual infrastructure

    • -
    • Server administration requirement

    • -

    How to Configure the Application Virtualization Management Servers

    - - - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Electronic Software Distribution-Based Scenario Overview](electronic-software-distribution-based-scenario-overview.md) - -[Determine Your Publishing Method](determine-your-publishing-method.md) - - - - - - - - - diff --git a/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md b/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md deleted file mode 100644 index a61b7c716f..0000000000 --- a/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Dialog Boxes (AppV 4.6 SP1) -description: Dialog Boxes (AppV 4.6 SP1) -author: dansimp -ms.assetid: f76b95df-cba4-4a69-8cd8-a888edf437be -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Dialog Boxes (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V Sequencer dialog boxes. - -## In This Section - - -[Incompatible Installer Dialog Box (App-V 4.6 SP1)](incompatible-installer-dialog-box--app-v-46-sp1-.md) - -[Failed Launch Dialog Box (App-V 4.6 SP1)](failed-launch-dialog-box--app-v-46-sp1-.md) - -[Oversized Package Dialog Box (App-V 4.6 SP1)](oversized-package-dialog-box--app-v-46-sp1-.md) - -[Restart Task Failure Dialog Box (App-V 4.6 SP1)](restart-task-failure-dialog-box--app-v-46-sp1-.md) - -[Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1)](side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md) - -[SXS Conflict Detected Dialog Box (App-V 4.6 SP1)](sxs-conflict-detected-dialog-box--app-v-46-sp1-.md) - -[Files Excluded Page Dialog Box (App-V 4.6 SP1)](files-excluded-page-dialog-box--app-v-46-sp1-.md) - -[Defender Running Dialog Box (App-V 4.6 SP1)](defender-running-dialog-box--app-v-46-sp1-.md) - -[Defrag Running Dialog Box (App-V 4.6 SP1)](defrag-running-dialog-box--app-v-46-sp1-.md) - -[Antivirus Running Dialog Box (App-V 4.6 SP1)](antivirus-running-dialog-box--app-v-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/disconnected-operation-mode.md b/mdop/appv-v4/disconnected-operation-mode.md deleted file mode 100644 index b123b249f9..0000000000 --- a/mdop/appv-v4/disconnected-operation-mode.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Disconnected Operation Mode -description: Disconnected Operation Mode -author: dansimp -ms.assetid: 3f9849ea-ba53-4c68-85d3-87a4218f59c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Disconnected Operation Mode - - -The disconnected operation mode settings—accessible by right-clicking the **Application Virtualization** node, selecting **Properties**, and clicking the **Connectivity** tab—enables the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) to run applications that are stored in the file system cache of the client when the client is unable to connect to the Application Virtualization Management Server. - -Reasons for failure to connect to the server include server failure, network outage, or disconnection from the network. If any failure occurs, the client will automatically switch to disconnected operation. After it is disconnected, if the client needs additional data from the server to continue to run an application or if the disconnected operation time-out expires, the client will attempt to reconnect to the server. If this connection attempt fails, the application will be shut down. - -By default, disconnected operation is enabled and the time-out is set to 90 days. The time-out value is specified as the number of days you want to limit disconnected operation mode, and you can enter a value from 1–999. - -## Related topics - - -[How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md b/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md deleted file mode 100644 index 7abf4bd3a7..0000000000 --- a/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Domain-Joined and Non-Domain-Joined Clients -description: Domain-Joined and Non-Domain-Joined Clients -author: dansimp -ms.assetid: a935dc98-de60-45f3-ab74-2444ce082e88 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Domain-Joined and Non-Domain-Joined Clients - - -The App-V Desktop Client can be configured to allow connection to a network regardless of whether the client is domain joined or non-domain joined. - -## Domain-Joined Clients - - -Clients that are domain joined, but outside the internal network, can communicate with the App-V infrastructure by using a VPN connection. When you want to provide users the ability to leave the internal network but still communicate in an App-V infrastructure, your environment requires very little setup. Because the users are already part of the domain, you simply need to ensure that Cached Credentials are supported on the client. This is the default configuration, and any changes to this setting can be accomplished from Group Policies. - -As mentioned in the App-V Security Best Practices Guide, the user will attempt to send their user ticket to the App-V infrastructure for authentication. If the ticket is expired, it will revert to using NTLM and the cached credentials on the computer. To allow roaming, administrators must ensure that the publishing server being accessed internally is available at the same name externally for the names to resolve properly. - -## Non-Domain-Joined Clients - - -Clients that are non-domain joined but need to communicate in the App-V infrastructure must be configured to ensure that authentication to the App-V infrastructure is successful. The App-V Desktop Client does not permit prompting for the publishing refresh process, so the client must be configured to present the proper credentials to the App-V Management Server. - -The publishing server, which is configured for publishing refresh from the non-domain joined client, requires that the external name that clients access is configured as the common name or a subject alternate name (SAN) on the publishing server’s certificate. - -## Related topics - - -[How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md) - -[How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/edit-shortcuts-learn-more.md b/mdop/appv-v4/edit-shortcuts-learn-more.md deleted file mode 100644 index 830abacbd3..0000000000 --- a/mdop/appv-v4/edit-shortcuts-learn-more.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Edit Shortcuts -description: Edit Shortcuts -author: dansimp -ms.assetid: a0ca75aa-1059-4d0c-894c-2e3474e9f519 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit Shortcuts - - -Use the **Edit Shortcuts** page to configure the shortcuts and file type associations (FTA) that are installed when you deploy the virtual application package to target computers. - -This page contains the following elements: - -**Add** -Adds an icon or specifies an FTA for the package. Click **Browse** to specify the file or program to add. - -**Remove** -Removes an icon or FTA from the package. - -**Edit** -Enables you to configure the properties associated with an icon or FTA in the package. You can update the associated **Application Path**, **Name**, **Version**, and **OSD File Name**. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md b/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md deleted file mode 100644 index ebdfacc6c9..0000000000 --- a/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: Electronic Software Distribution-Based Scenario Overview -description: Electronic Software Distribution-Based Scenario Overview -author: dansimp -ms.assetid: e9e94b8a-6cba-4de8-9b57-73897796b6a0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Electronic Software Distribution-Based Scenario Overview - - -If you plan to use an electronic software distribution (ESD) solution to deploy virtual applications, it is important to understand the factors that go into and are affected by that decision. This topic describes the benefits of using an ESD-based scenario and provides information about the publishing and package streaming methods that you will need to consider as you proceed with your deployment. - -**Important**   -Whichever ESD solution you use, you must be familiar with the requirements of your particular solution. If you are using Microsoft Endpoint Configuration Manager, see the Configuration Manager documentation at . - - - -Using an existing ESD system provides you with the following benefits: - -- Eliminates dual management infrastructures - -- Reduces the cost of additional hardware - -- Reduces the cost of additional operating system and database licenses - -## Publishing Methods - - -When using an ESD-based scenario, you have the following choices for publishing the application to the clients: - -- **Stand-alone Windows Installer.** The Windows Installer file contains the manifest and the OSD and ICO files the clients use to configure a package. The Windows Installer file also copies the SFT file to the client because this scenario does not use a server. - -- **Windows Installer with the package manifest.** The Windows Installer file contains the manifest and the OSD and ICO files the clients use to configure a package. The SFT file is stored on a server. A command-line parameter directs the client to the location of the SFT file. - -- **SFTMIME commands.** SFTMIME commands are used with the manifest, OSD, ICO, and SFT files to add packages to the client. The manifest file must be on the client computer, or it must be accessible through a UNC path. Depending on the client configuration and the command-line options, the OSD, ICO, and SFT files can be on the client computer or on a server. - -For more detailed information about the preceding publishing methods, see [Determine Your Publishing Method](determine-your-publishing-method.md). - -## Package Streaming Methods - - -You will need to determine the method your Application Virtualization System will use to stream the virtual application packages, or SFT files, from the server to the clients. The following streaming options are available: - -- **Application Virtualization Streaming Server.** If you use an Application Virtualization Streaming Server in your configuration, the SFT files are streamed to the clients from that server using RTSP or RTSPS protocols. You must install the server software on a computer and you must configure it through the registry, but this configuration does not depend on services such as SQL or Active Directory Domain Services. The SFT files are stored on the server at a location accessible by the clients. Publishing information can be distributed to the clients through any distribution mechanism. However, when configured, the client receives package upgrades automatically and active upgrade is supported. - -- **Application Virtualization Management Server.** If you use an Application Virtualization Management Server in your configuration, the SFT files are streamed to the clients from that server using RTSP or RTSPS protocols. You manage this server through the Application Virtualization Management Console. This configuration uses a SQL database and Active Directory services. The server can distribute publishing information to the clients, so additional publishing mechanisms are not needed. - -- **File server.** If you use a file server in your configuration, the SFT files are streamed to the other client computers by using SMB protocols. File servers used in this configuration are managed by creating access control lists (ACLs) on the file shares and SFT files. Care must be taken to direct the clients to the correct files on the file server. - -- **IIS server.** If you use an IIS server in your configuration, the SFT files are streamed to the clients from that server using HTTP or HTTPS protocols. The IIS server is easy to configure and manage. Care must be taken to direct the clients to the correct files on the IIS server. - -For more detailed information about the preceding streaming methods, see [Determine Your Streaming Method](determine-your-streaming-method.md). - -## Related topics - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Determine Your Publishing Method](determine-your-publishing-method.md) - -[Determine Your Streaming Method](determine-your-streaming-method.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/electronic-software-distribution-based-scenario.md b/mdop/appv-v4/electronic-software-distribution-based-scenario.md deleted file mode 100644 index d99c4ce90f..0000000000 --- a/mdop/appv-v4/electronic-software-distribution-based-scenario.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Electronic Software Distribution-Based Scenario -description: Electronic Software Distribution-Based Scenario -author: dansimp -ms.assetid: 18be0f8d-60ee-449b-aa83-93c86d1a908e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Electronic Software Distribution-Based Scenario - - -If you plan to use an electronic software distribution (ESD) deployment scenario for your Microsoft Application Virtualization environment, it is important to understand the factors that go into and are affected by that decision. The topics in this section describe the ESD scenario and provide information about package delivery methods, transmission protocols, and external components that you will need to consider in your deployment strategy. You can also use the procedures in this section to complete your deployment, from the server configuration phase through the deployment verification phase. - -## In This Section - - -[Electronic Software Distribution-Based Scenario Overview](electronic-software-distribution-based-scenario-overview.md) -Provides important information about the publishing and streaming methods you can use for an ESD-based deployment. - -[How to Configure Servers for ESD-Based Deployment](how-to-configure-servers-for-esd-based-deployment.md) -This section provides procedures you can use to configure the Application Virtualization Streaming Servers, the IIS server, and the file server for your electronic software distribution–based deployment strategy. - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) -Provides command-line procedures for installing the Application Virtualization Client, using either the setup.exe or the setup.msi file. - -[How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md) -Provides a step-by-step procedure you can use to confirm that the Application Virtualization Client has been installed and is functioning correctly. - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) -Provides command-line procedures for publishing an application package, using either Windows Installer or SFTMIME. - -## Reference - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -## Related Sections - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/exclusion-item-dialog-box.md b/mdop/appv-v4/exclusion-item-dialog-box.md deleted file mode 100644 index 250a430862..0000000000 --- a/mdop/appv-v4/exclusion-item-dialog-box.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Exclusion Item Dialog Box -description: Exclusion Item Dialog Box -author: dansimp -ms.assetid: 5523c6d4-95f2-47af-8c06-3ab18004a207 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Exclusion Item Dialog Box - - -Use the **Exclusion Item** dialog box to assign or change a mapping rule and to assign or change an expression for exclusion. This dialog box contains the following elements. - -**Important**   -Adding files from an excluded directory to the virtual files system is not supported. - - - -**Exclude Path** -Use to specify variable name that the Application Virtualization Sequencer will exclude if encountered while parsing virtual file system items or virtual registry items. - -**Mapping Type** -Use to select the mapping rules the Application Virtualization Sequencer will apply to parse items in the virtual file system or virtual registry. One of the following values can occur: - -- VRG—Specifies that this mapping rule applies when parsing an item in the virtual registry. - -- VFS—Specifies that this mapping rule applies when parsing an item in the virtual file system. - -- VRG & VFS—Specifies that this mapping rule applies when parsing an item in either the virtual file system or the virtual registry. - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - - - - - - - - - diff --git a/mdop/appv-v4/exclusion-items-tab-keep.md b/mdop/appv-v4/exclusion-items-tab-keep.md deleted file mode 100644 index e4dcff97c2..0000000000 --- a/mdop/appv-v4/exclusion-items-tab-keep.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Exclusion Items Tab -description: Exclusion Items Tab -author: dansimp -ms.assetid: 864e46dd-3d6e-4a1b-acf4-9dc00548117e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Exclusion Items Tab - - -The **Exclusion Items** tab displays the expressions that the Application Virtualization Sequencer excludes from the virtual file system or virtual registry. These expressions are excluded to ensure that the sequenced application package can run on Application Virtualization Desktop Clients. You can also exclude non-standard installation directories that might be unwanted in the sequencing. - -This tab contains the following elements. - -**Exclude Path** -Displays variable names that the Sequencer excludes if encountered while parsing virtual file system items or virtual registry items. - -**Resolves To** -Displays the actual paths that correspond to the Sequencer variables. - -**Map Type** -Displays mapping rules that the Sequencer applies to parse items in the virtual file system or virtual registry. One of the following values can occur: - -**New** -Click to enter a new exclusion item. - -**Edit** -Click to edit a selected exclusion. - -**Delete** -Click to remove a selected exclusion. - -**Save As Default** -Click to save the current exclusion items as your default. - -**Restore Defaults** -Click to restore default-assigned exclusion items and remove any items you added. - -**OK** -Click to accept the displayed exceptions. - -**Cancel** -Click to cancel any changes you have made. - -## Related topics - - -[Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) - -[Exclusion Item Dialog Box](exclusion-item-dialog-box.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index a08aea1e5d..0000000000 --- a/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Failed Launch Dialog Box (App-V 4.6 SP1) -description: Failed Launch Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 55669552-51b4-48aa-8bd0-6d78c2c930d9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Failed Launch Dialog Box (App-V 4.6 SP1) - - -The application did not start successfully. - -Use the following list to help identify why the application did not run successfully. - -1. Verify that all required prerequisites have been installed on the computer running the App-V Sequencer. - -2. Verify that any resources required by the application are available and not in use by another process. - -3. Verify that the application you are installing is supported by the operating system running on the computer that is running the App-V Sequencer. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-association-results-pane-columns.md b/mdop/appv-v4/file-type-association-results-pane-columns.md deleted file mode 100644 index 1cdc78f1cc..0000000000 --- a/mdop/appv-v4/file-type-association-results-pane-columns.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: File Type Association Results Pane Columns -description: File Type Association Results Pane Columns -author: dansimp -ms.assetid: eab48e20-9c92-459d-a06b-8e20202d73f6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Association Results Pane Columns - - -In the Application Virtualization Client Management Console, the **Results** pane of the **File Associations** node can display a variety of columns. **Extension**, **Description**, and **Application** are shown by default. - -**Note**   -You can add or remove a column simply by right-clicking in the **Results** pane, selecting **View**, then selecting **Add/Remove Columns**. - - - -The list can be sorted by any of the columns. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text, dates and times are considered to come before any other text. - -The available column names contain the following elements. - -**Extension** -The extension, such as DOC or HTML. This is the field by which the list is organized, so each extension is displayed once on the list. - -**Description** -The description or user-friendly name. - -**Application** -The name and version of the application associated with the default action of this file type. - -**Parameters** -The parameters for the default action. - -**Default Action** -The name of the default action. - -**DDE** -Displays **Enabled** or **Disabled** depending on whether Dynamic Data Exchange (DDE) is enabled for the default action. - -**Linked Extensions** -A comma-separated list of other extensions that are associated with the same type. - -**Confirm Open** -Displays **Yes** or **No** depending on whether **Confirm open after download** is selected. - -**Always Show** -Displays **Yes** or **No** depending on whether **Always show extension** is selected. - -**Shell New** -Displays **Yes** or **No** depending on whether the extension is added to the shell’s **New** menu. - -**Applies To** -Displays **User** or **Computer** depending on whether this is a user-specific or computer-wide association. - -**Icon File** -The original name of the icon file. - -**Icon Path** -The original path or URL for the icon file. - -**Cached Icon File** -The name of the icon files in cache (which is a GUID in the current implementation). - -**Cached Icon Path** -The full path to the icon files in cache. - -**Content Type** -The content type. - -**Perceived Type** -The perceived type or blank. - -## Related topics - - -[File Type Associations Node](file-type-associations-node-client.md) - -[File Type Association Results Pane](file-type-association-results-pane.md) - - - - - - - - - diff --git a/mdop/appv-v4/file-type-association-results-pane.md b/mdop/appv-v4/file-type-association-results-pane.md deleted file mode 100644 index 3b6a32eb71..0000000000 --- a/mdop/appv-v4/file-type-association-results-pane.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: File Type Association Results Pane -description: File Type Association Results Pane -author: dansimp -ms.assetid: bc5ceb48-1b9f-45d9-a770-1bac90629c76 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Association Results Pane - - -The **File Association** **Results** pane is one level below the **System** pane in the Application Virtualization Client Management Console, and it displays a list of the available file type associations. Users can see a list of file type extensions and the applications to which they correspond. - -To display specific options for file types, right-click any application extension to display a pop-up menu that contains the following elements. - -**Delete** -Deletes the file name extension from the list and removes the association to the file type. - -**Properties** -Displays the **Properties** dialog box for the selected application extension. This dialog box has two tabs: - -- The **General** tab displays general information about the file type association, including the application icon and name: - - - **Icon**—Displays the selected icon for the associated file type. - - - **Association Name**—Displays the name of the file type. - - - **Change Icon**—Click this button to change the icon for the file type association. - - - **Extension**—Displays the extension or extensions associated with a particular file type. - - - **Unlink**—This button is enabled when more than one extension is associated with an application. Click **Unlink** to manage the file type extension separately from the extension it is currently linked with. - - - **Specified application**—Select this radio button, and choose an application from the drop-down list of available applications. You are changing the application that is used by the default action. You can also browse to find an application if it isn't available on the drop-down list. - - - **OSD file**—Select this radio button, and specify a path to an Open Software Descriptor (OSD) file. You can also browse to an OSD file. - -- The **Advanced** tab displays detailed information about the file type association: - - - **Action**—Displays a list of the available actions for the associated file type. - - - **Content Type**—Displays a description of the contents of the file type. If this field is left blank, the client will fill it. - - - **Perceived Type**—Displays the file type. You can select one of the options from the drop-down list or add your own. - - - **Confirm open after download**—Select this check box to display a confirmation message after a file is loaded. If this box is selected, when you attempt to open a file of this type by downloading it into a Web browser, the browser prompts you to see whether you want to save the file rather than open it directly into the browser without confirmation. - - - **Always show extension**—Select this check box to specify that extensions should be shown even when the user requests that the system should hide extensions for known file types. - - - **Add to new menu**—Select this check box to specify that the extension or extensions should be listed in the shell's **New** context menu. - - - **Apply to all users**—Select this check box to specify that extensions should be available to all users. - -**Help** -Displays the Client Management Console help system. - -To display general options for the **Results** pane, right-click anywhere in the **Results** pane to display a pop-up menu that contains the following elements. - -**New Association** -This menu item displays the New Association Wizard. This wizard consists of two pages: - -1. Enter a new or existing file name extension, and associate the extension with a file type: - - - **Extension**—Enter a new file name extension. This field is blank by default. - - - **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - - **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is not selected. - - - **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Pick a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -2. Select the application that will open files with the specified extension: - - - **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - - **Open file with the association described in this OSD file**—Select this radio button to specify an OSD file that determines the application used to open the file. Use the browse button to select an existing location, or enter a path or HTTP-formatted URL in this field. - -**Refresh** -This item refreshes the **Results** pane. - -**Export List** -With this menu item, you can create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu item lets you change the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -These menu items can be used to change how the icons are displayed in the **Results** pane. - -**Help** -This item displays the help system for the management console. - -## Related topics - - -[How to Change an Application Icon](how-to-change-an-application-icon.md) - -[File Type Associations Node](file-type-associations-node-client.md) - -[File Type Association Results Pane Columns](file-type-association-results-pane-columns.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-associations-node-client.md b/mdop/appv-v4/file-type-associations-node-client.md deleted file mode 100644 index 4182a0dbbf..0000000000 --- a/mdop/appv-v4/file-type-associations-node-client.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: File Type Associations Node -description: File Type Associations Node -author: dansimp -ms.assetid: 48e4d9eb-00bd-4231-a68a-f8597ab683ff -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Associations Node - - -The **File Type Associations** node is one level below the **Application Virtualization** node in the **Scope** pane of the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of file type associations. - -Right-click the **File Type Associations** node to display a pop-up menu that contains the following elements. - -**New Association** -This menu item displays the New Association Wizard. This wizard consists of two pages: - -1. Enter a new or existing file name extension, and associate the extension with a file type: - - - **Extension**—Enter a new or existing file name extension. This field is blank by default. - - - **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - - **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is not selected. - - - **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Choose a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -2. Select the application that will open files with the specified extension: - - - **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - - **Open files with the application described in this OSD file**—Select this radio button to specify an Open Software Descriptor (OSD) file that determines the application used to open the file. Browse to select an existing location, or enter a path or HTTP-formatted URL in this field. - -**New Window from Here** -Select this menu item to open a new management console with the selected node as the root node. - -**Export List** -You can use this menu item to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu items enables you to change the appearance and content of the **Results** pane. - -**Refresh** -Select this item to refresh the management console. - -**Help** -With this menu item, you can display the help system for the management console. - -## Related topics - - -[File Type Association Results Pane](file-type-association-results-pane.md) - -[File Type Association Results Pane Columns](file-type-association-results-pane-columns.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-associations-node.md b/mdop/appv-v4/file-type-associations-node.md deleted file mode 100644 index f739cf0208..0000000000 --- a/mdop/appv-v4/file-type-associations-node.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: File Type Associations Node -description: File Type Associations Node -author: dansimp -ms.assetid: a3f35562-32d0-4a43-8604-3a54189ade92 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Associations Node - - -The **File Type Associations** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of file type associations. Right-click the **File Type Association** node to display a pop-up menu that contains the following elements. - -**New File Type Association** -Displays the New File Type Association Wizard. This wizard consists of the following two pages: - -1. Enter a new or existing file name extension, and associate the extension with a file type. - - 1. **Extension**—Enables you to enter a new or existing file name extension. This field is blank by default. - - 2. **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - 3. **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Pick a file type from the drop-down list. - -2. Select the application that will open files with the specified extension. - - 1. **Open files with the selected application**—Enables you to choose an application from the drop-down list of available applications. - - 2. **Icon Path**—Enables you to enter the complete path to the ICO file or to browse for the ICO file. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system. - -## Related topics - - -[Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-associations-results-pane-columns.md b/mdop/appv-v4/file-type-associations-results-pane-columns.md deleted file mode 100644 index 1458316d50..0000000000 --- a/mdop/appv-v4/file-type-associations-results-pane-columns.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: File Type Associations Results Pane Columns -description: File Type Associations Results Pane Columns -author: dansimp -ms.assetid: 8cbb63e4-f93b-4066-ba06-30103e6d0c3e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Associations Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays two columns. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - -
    ColumnDescription

    Extension

    Displays the extension, such as DOC or HTML. This is the field by which the list is organized, so each extension is displayed once on the list.

    File Type

    Displays the file type.

    - -  - -## Related topics - - -[Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/file-type-associations-results-pane.md b/mdop/appv-v4/file-type-associations-results-pane.md deleted file mode 100644 index b1f2badd96..0000000000 --- a/mdop/appv-v4/file-type-associations-results-pane.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: File Type Associations Results Pane -description: File Type Associations Results Pane -author: dansimp -ms.assetid: 881d7fa7-ecde-4a05-b6ee-132fe2c09900 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# File Type Associations Results Pane - - -The **File Type Associations Results** pane in the Application Virtualization Server Management Console displays a list of the available file type associations. Users can see a list of file type extensions and the applications to which they correspond. - -Right-click any application extension to display a pop-up menu that contains the following elements. - -**Delete** -Deletes the file name extension from the list. - -**Properties** -Displays the **Properties** dialog box for the selected application extension. This dialog box has the following tabs: - -- **General** tab—Displays general information about the file type association, including the application icon and name. - - - **Icon**—Displays the selected icon for the associated file type. - - - **Extension**—Displays the extension for the file type. - - - **File Type Description**—Displays a brief description of the file type. You can edit this field. - - - **Open files with this application**—Enables you to choose an application from the drop-down list of available applications. - - - **Icon Path**—Enables you to enter the complete path to the icon file (ICO) or to browse for the ICO file. - -- **Advanced** tab—Displays detailed information about the file type. - - - **Action**—Displays a list of the available actions for the associated file type. You can add new actions, edit existing actions, set an action as a default, or delete actions. - - - **Content Type**—Displays a description of the contents of the file type. If this field is left blank, the client will fill it. - - - **Perceived Type**—Displays the kind of file type. You can select one of the options from the drop-down list or add your own. - - - **Confirm open after download**—Select this check box to display a confirmation message after an application is loaded. - - - **Always show extension**—Select this check box to specify that extensions should be shown even when the user requests that the system hide the extensions for known file types. - - - **Add to new menu**—Select this check box to specify that the extension or extensions should be listed in the shell's **New Extensions** list. - -**Help** -Displays the Application Virtualization Server Management Console help system. - -Right-click anywhere in the **Results** pane that is not on an extension to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the **Results** pane. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line up Icons** -Organizes the icons in the **Results** pane. - -**Help** -Displays the help system. - -## Related topics - - -[Server Management Console: File Type Associations Node](server-management-console-file-type-associations-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index c994c8d5e0..0000000000 --- a/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Files Excluded Page Dialog Box (App-V 4.6 SP1) -description: Files Excluded Page Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 9718c7bf-7ed2-44d8-bdac-df013cd0d6c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Files Excluded Page Dialog Box (App-V 4.6 SP1) - - -All required files were not added to the package because they are located in excluded paths. Use the following steps to remove the files from the exclusion list. - -1. Open the package in the App-V Sequencer console. - -2. Click **Tools** / **Options**, and then click the **Exclusion Items** tab. - -3. Select the **Exclude Path** entry, and then click **Delete**. - -4. Click **Ok**. - -You must then add the file to the package. You can use the following steps to add files: - -1. In the App-V Sequencer console, click the **Virtual File System** tab. - -2. To add a new virtual file system mapping, right-click, and then click **Add**. - -3. In the **New Virtual File System Mapping** dialog box, to specify the file, click **Browse** and select the file. Click **OK**. To save the package, click **File** / **Save**. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/files-tab-keep.md b/mdop/appv-v4/files-tab-keep.md deleted file mode 100644 index aaeebd7805..0000000000 --- a/mdop/appv-v4/files-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Files Tab -description: Files Tab -author: dansimp -ms.assetid: 14191e51-11a2-40ab-8855-3408a4bc5a9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Files Tab - - -Use the **Files** tab to specify whether a file in a sequenced application package will be available to a specific user or to all users in the community. - -## In This Section - - -[About the Files Tab](about-the-files-tab.md) -Provides general information about the **Files** tab. - -[How to Modify the Files Included in a Package](how-to-modify-the-files-included-in-a-package.md) -Provides the procedure to modify the files included in a package. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/g b/mdop/appv-v4/g deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/mdop/appv-v4/gathering-information-page--learn-more-.md b/mdop/appv-v4/gathering-information-page--learn-more-.md deleted file mode 100644 index 2fb6c6cc6f..0000000000 --- a/mdop/appv-v4/gathering-information-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Gathering Information Page (Learn More) -description: Gathering Information Page (Learn More) -author: dansimp -ms.assetid: f8d5ec6b-a3d3-4e80-b1c2-3f8441b04aaa -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Gathering Information Page (Learn More) - - -Use the **Gathering Information** page to review the installation files that could not be located in the directory specified on the **Installation Files** page of this wizard. You must either locate the missing files and then click **Previous** to recreate the Package Accelerator, or select the **Remove these files** check box before you advance to the next page of this wizard. - -This page contains the following elements: - -**Review Missing Files** -Displays a list of the installation files that were not found in the specified directory. - -**Remove these files** -Specifies whether the missing installation files should be removed from the package. Only select this option if the files displayed in the **Review Missing Files** pane are not required to successfully run the application. All files that are removed will not be part of the Package Accelerator and also will not be part of any virtual application packages created by using the Package Accelerator. Ensure that removing these files will not cause the package to fail when running on target computers. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/general-tab-keep.md b/mdop/appv-v4/general-tab-keep.md deleted file mode 100644 index 58ae9340d1..0000000000 --- a/mdop/appv-v4/general-tab-keep.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: General Tab -description: General Tab -author: dansimp -ms.assetid: aeefae39-60cd-4ad4-9575-c07d7e2b1e59 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# General Tab - - -Use the **General** tab to configure options for Microsoft Application Virtualization (App-V) Sequencer. - -**Scratch Directory** -Specifies the path to the location where the Sequencer will temporarily save files generated during sequencing. The default path is C:\\Program Files\\Microsoft Application Virtualization Sequencer\\Scratch. To specify a new path, click **Browse**. - -**Log Directory** -Specifies the path to the directory where the Sequencer will save log files. The default path is C:\\Program Files\\Microsoft Application Virtualization Sequencer\\Logs. To specify a new path, click **Browse** - -**Allow Use of MSI Installer** -Select this option to allow interaction between the Sequencer and the application installer. This option is selected by default. - -**Allow Virtualization of Events** -Select this option to allow low-level operating system activities of the application to be virtualized when a sequenced application package is run on App-V Desktop Clients. This option is selected by default. - -**Allow Virtualization of Services** -Select this option to allow services required by the application to be virtualized when the application is run on App-V Desktop Clients. This option is selected by default. - -**Append Package Version to Filename** -Select this option to automatically append the sequenced application package version number to the file name. This option is selected by default. - -**OK** -Saves changes and closes the dialog box. - -**Cancel** -Exits the dialog box without saving any changes. - -**Apply** -Saves the changes and remains in the dialog box. - -## Related topics - - -[Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/guidance-page-app-v-46-sp1.md b/mdop/appv-v4/guidance-page-app-v-46-sp1.md deleted file mode 100644 index 6af524a1e1..0000000000 --- a/mdop/appv-v4/guidance-page-app-v-46-sp1.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Guidance Page -description: Guidance Page -author: dansimp -ms.assetid: 2d461f7e-bde0-4f20-bfc1-46d52feb701e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Guidance Page - - -Use the **Guidance** page to review the publishing guidance associated with the Package Accelerator. This information was created with the Package Accelerator and includes information about creating and publishing a new virtual application package based on the specified Package Accelerator. - -This page contains the following elements: - -**Export** -Click **Export** to export the guidance information to a Rich Text Format (.rtf) or text (.txt) file. Exporting the information is helpful if you have to review the guidance information later in the sequencing process. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/help.md b/mdop/appv-v4/help.md deleted file mode 100644 index 1b14a81bf2..0000000000 --- a/mdop/appv-v4/help.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: HELP -description: HELP -author: dansimp -ms.assetid: 0ddb5f18-0c0a-45ea-b7c7-2d4749e3d35d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# HELP - - -Displays information about the various SFTMIME commands that can be used in Application Virtualization (App-V). - -## HELP - - -`SFTMIME [/? | /HELP [VERB:]]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    /?, /HELP

    Displays usage information.

    verb

    The command to run, such as ADD, REFRESH, HELP or REMOVE.

    object

    What the command applies to, such as APP:"Default Application."

    parameters

    Optional parameters for the specified verb and object.

    /LOG

    Log output to the specified path name.

    /CONSOLE

    Displays output in the active console window (default).

    /GUI

    Displays errors in a dialog box (not valid for queries).

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -The verbs described in the following table are supported. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    ADD

    Adds a new application, package, file type association, or publishing server to the App-V Client.

    CONFIGURE

    Changes the configuration of an application, a package, a file type association, or a publishing server.

    DELETE

    Removes applications, packages, file type associations, or servers.

    LOAD

    Loads a package into the file system cache.

    REPAIR

    Resets your personal settings for an application.

    REFRESH

    Triggers a publishing server refresh.

    PUBLISH

    Publishes an application shortcut to the user's Start menu, desktop, or other specified location, or can be used to publish the contents of an entire package.

    UNPUBLISH

    Removes the shortcuts and file types for an entire package.

    QUERY

    Gets a current list of applications, packages, file type associations, or publishing servers.

    CLEAR

    Removes your personal settings and desktop configurations for one or more applications.

    UNLOAD

    Unloads a package from the file system cache.

    LOCK

    Locks the application specified in the file system cache.

    UNLOCK

    Unlocks the application specified in the file system cache.

    - -  - -For more information about the preceding actions, use the following command: - -`SFTMIME /HELP VERB:verb` - -For example, the following command will display information for the ADD verb: - -`SFTMIME /HELP VERB:ADD` - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-add-a-file-type-association.md b/mdop/appv-v4/how-to-add-a-file-type-association.md deleted file mode 100644 index bd5e1a7cb5..0000000000 --- a/mdop/appv-v4/how-to-add-a-file-type-association.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Add a File Type Association -description: How to Add a File Type Association -author: dansimp -ms.assetid: cccfbd00-51ba-4a60-a598-ee97f5ea1215 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a File Type Association - - -You can use the following procedure to add a file type association, using the **File Type Associations** node in the Application Virtualization Client Management Console. - -**To add a file type association** - -1. Right-click the **File Type Associations** node, and select **New Association** from the pop-up menu. - -2. Complete the first step of the dialog box by completing the following information, and then click **Next**: - - 1. **Extension**—Enter a new file name extension. This field is blank by default. - - 2. **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - 3. **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is cleared. - - 4. **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Pick a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -3. Complete the second step of the dialog box by completing the following information, and then click **Finish** to return to the Client Management Console: - - 1. **Change Icon**—Click this button to change the application icon. Select one of the available icons, or browse to a new location and select an icon. - - 2. **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - 3. **Open file with the association described in this OSD file**—Select this radio button to specify an Open Software Descriptor (OSD) file that determines the application used to open the file. Use the browse button to select an existing location, or enter a path or HTTP-formatted URL in this field. - -## Related topics - - -[How to Add an Application](how-to-add-an-application.md) - -[How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) - -[How to Delete a File Type Association](how-to-delete-a-file-type-association.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md b/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md deleted file mode 100644 index 6b9c002b72..0000000000 --- a/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Add a Package by Using the Command Line -description: How to Add a Package by Using the Command Line -author: dansimp -ms.assetid: e75af49e-811a-407a-a7f0-6de8562b9188 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a Package by Using the Command Line - - -The following procedures list the steps that are necessary to add a virtual application package to the Application Virtualization (App-V) Client on a specific computer. - -**To add a virtual application package for a specific user** - -- Run the following command under the user account of the person who is to get the package. The command adds and publishes the package for that user. - - `SFTMIME ADD PACKAGE:”name” /MANIFEST ` - -**To add a virtual application package for all users** - -- Run the following command under an account that has administrator rights. The package is added and published for all users on the computer. - - `SFTMIME ADD PACKAGE:”name” /MANIFEST /GLOBAL` - -**To add a package using an electronic software distribution system** - -1. If you are using an electronic software distribution system that runs the commands under the computer’s **SYSTEM** account, the package is published for that account only, unless you use the /GLOBAL switch. Run the following command to add and publish the package for all users on the computer: - - `SFTMIME ADD PACKAGE:”name” /MANIFEST /GLOBAL` - -2. - - If you want to add the package for specific users only, run the **ADD PACKAGE** command, and then explicitly publish the package for each user by running the following **PUBLISH PACKAGE** command under each person’s user account: - - `SFTMIME ADD PACKAGE:”name” /MANIFEST ` - - `SFTMIME PUBLISH PACKAGE:”name” /MANIFEST ` - - Publishing the package without the GLOBAL parameter grants the user access to the applications in the package and publishes the file types and shortcuts that are listed in the manifest to the user’s profile. Permissions required are “Manage file type associations” (**ManageTypes**) and “Publish shortcuts” (**PublishShortcut**). - -## Related topics - - -[How to Delete All Virtual Applications by Using the Command Line](how-to-delete-all-virtual-applications-by-using-the-command-line.md) - -[How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-add-a-package-version.md b/mdop/appv-v4/how-to-add-a-package-version.md deleted file mode 100644 index 6a4b7c4372..0000000000 --- a/mdop/appv-v4/how-to-add-a-package-version.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Add a Package Version -description: How to Add a Package Version -author: dansimp -ms.assetid: dbb829c1-e5cb-4a2f-bc17-9a9bb50c671c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a Package Version - - -In the Application Virtualization Server Management Console, when you resequence a package, you can use the following procedure to add the new version to your servers for streaming. - -**Note**   -When you upgrade a package with a new version, you can leave the existing version in place or delete it and leave only the newest one. You might want to leave the old version in place for compatibility with legacy documents or so that you can test the new version before making it available to all users. - - - -**To add a package version** - -1. Copy the new SFT file to the application server's content folder. If resequencing did not add changes to the Open Software Descriptor (OSD), icon (ICO), or Sequencer Project (SPRJ) files, you do not need to copy those. You can include those files if you want all the files to display the same date. - -2. In left pane of the Application Virtualization Server Management Console, expand the **Packages** node. - -3. Right-click the package you want to upgrade, and choose **Add Version**. - -4. In the **Add Package Version** dialog box, browse for or type the path name for the new application file in the **Full path for package file** field. This must be an SFT file. - -5. Click **Next**. - -6. The **Summary** dialog box shows the file location and prompts you to copy the file there if you have not already done so. Click **Finish** after you have verified the information. - - The new version is now complete and ready to stream. - -## Related topics - - -[How to Delete a Package](how-to-delete-a-packageserver.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-add-a-package.md b/mdop/appv-v4/how-to-add-a-package.md deleted file mode 100644 index b9f409c2cb..0000000000 --- a/mdop/appv-v4/how-to-add-a-package.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Add a Package -description: How to Add a Package -author: dansimp -ms.assetid: 5407fdbe-e658-44f6-a9b8-a566b81dedce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a Package - - -You can add a package from the Application Virtualization Server Management Console in the following ways: - -- Import an application, which creates the package automatically in the process. - -- Add a package manually. - -It is recommended that you import applications instead of adding them manually. For more information about importing applications, see [How to Import an Application](how-to-import-an-applicationserver.md). - -**To add a package manually** - -1. In the Application Virtualization Server Management Console, right-click the **Packages** node in the left pane and choose **New Package**. - -2. In the **New Package** dialog box, type a name in the **Package Name** field. - -3. Browse for or type a path name in the **Full path for package file** field. This must be an SFT file. - - **Note**   - If you browse to the SFT file, replace the local path (such as C:\\Program Files\\User\_Apps\\Virtual\_App\_Server\\content) with the server's static host name or IP address. Using the variable *%SFT\_SOFTGRIDSERVER%* requires per-client computer configuration. - - In dialog boxes that refer to Virtual Application Servers, you must use a network location, such as the server's static host name or IP address, that your users can access. The application's Open Software Descriptor (OSD) file can replace the placeholder variable *%SFT\_SOFTGRIDSERER%* with the server's static host name or IP address. If you leave the placeholder variable, you must set this variable on each client computer that will access that server. Set a User or System variable on each computer for SFT\_SOFTGRIDSERVER. The variable value must be the server's static host name or IP address. If you set a variable, exit the Client session, log out of and back into Microsoft Windows, and then restart the session on each computer that had a session running and had the variable set. - - - -4. Click **Next**. - -5. The **Summary** dialog box shows the file location and prompts you to copy the file to the location if you have not already done so. Click **Finish** after you have verified the information. - - **Note**   - If you are managing applications on a remote server, in the next dialog box, type only the path of the file relative to the server's content root. - - - -## Related topics - - -[How to Import an Application](how-to-import-an-applicationserver.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-add-a-server.md b/mdop/appv-v4/how-to-add-a-server.md deleted file mode 100644 index 0fb467e68f..0000000000 --- a/mdop/appv-v4/how-to-add-a-server.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Add a Server -description: How to Add a Server -author: dansimp -ms.assetid: 1f31678a-8edf-4d35-a812-e4a2abfd979b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add a Server - - -To help you manage your Application Virtualization Management Servers more efficiently, organize them into server groups. After you create a server group in the Application Virtualization Server Management Console, you can use the following procedure to add a server to the group. - -**Note**   -All servers in a server group must be connected to the same data store. - - - -**To add a server to a group** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. Right-click the desired server group, and select **New Application Virtualization Management Server**. - -3. In the **New Server Group Wizard**, enter the **Display Name** and the **DNS Host Name**. - -4. Leave the default values in the **Maximum Memory Allocation** field for the server cache and the **Warn Memory Allocation** field to specify the threshold warning level. - -5. Click **Next**. - -6. In the **Connection Security Mode** dialog, check the **Use enhanced security** box to select enhanced security mode, if desired. If necessary, complete the **Certificate Wizard** or view existing certificates. - -7. Click **Next**. - -8. In the **App Virt Port Setting** dialog, select the **Use Default Port** or the **User Custom Port** radio button and enter the custom port number. - -9. Click **Finish**. - -## Related topics - - -[How to Create a Server Group](how-to-create-a-server-group.md) - -[How to Remove a Server](how-to-remove-a-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-add-an-administrator-group.md b/mdop/appv-v4/how-to-add-an-administrator-group.md deleted file mode 100644 index 27067fbc52..0000000000 --- a/mdop/appv-v4/how-to-add-an-administrator-group.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Add an Administrator Group -description: How to Add an Administrator Group -author: dansimp -ms.assetid: 2611f33e-6082-4269-b0ba-394174701492 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add an Administrator Group - - -From the **Administrators** node of the Application Virtualization Server Management Console, you can use the following procedure to add an administrator group. - -**To add an administrator group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Administrators** node and select **Add Administrator Group**. - -2. Complete the **Select Groups** dialog box to add groups. - - **Important**   - When completing the **Select Groups** dialog box, you might see the **Multiple Names Found** dialog box, which can display multiple group names. To add more than one group at a time, press **Ctrl** and click the name of each group you want to add. Click **OK** to exit the **Multiple Names Found** dialog box. - - - -3. Click **OK**. - - **Note**   - To add administrator groups to the Application Virtualization Management Server, you must have system administrator or security administrator privileges on the associated data store. If you attempt to create a group without sufficient privileges, the system generates an error message. - - - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -[How to Delete an Administrator Group](how-to-delete-an-administrator-group.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-add-an-application.md b/mdop/appv-v4/how-to-add-an-application.md deleted file mode 100644 index 760c7f8540..0000000000 --- a/mdop/appv-v4/how-to-add-an-application.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Add an Application -description: How to Add an Application -author: dansimp -ms.assetid: 0147233d-f369-4796-8e34-fb1d894af732 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add an Application - - -You can use the following procedure to add an application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To add an application** - -1. In the **Results** pane, right-click and select **New Application** from the pop-up menu. - -2. On the wizard page, you can perform the following tasks: - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **OSD File Path or URL**—Enter a local absolute path, a full UNC path (shared file or directory on a network), or an HTTP URL. - - 3. **(OSD browse button)**—Displays the standard Windows **Open File** dialog box. Browse to find the desired file. - -3. Click **Finish** to add the application to the **Results** pane. - -## Related topics - - -[How to Add a File Type Association](how-to-add-a-file-type-association.md) - -[How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) - -[How to Delete a File Type Association](how-to-delete-a-file-type-association.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md b/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md deleted file mode 100644 index 2616fee08d..0000000000 --- a/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1) -description: How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1) -author: dansimp -ms.assetid: ca0bd514-2bbf-4130-8c77-98d991cbe016 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1) - - -You can use App-V Package Accelerators to automatically generate a new virtual application package. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - -**Important** -Disclaimer: The Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer. - - - -**Note** -Before starting this procedure, copy the required Package Accelerator locally to the computer running the App-V Sequencer. You should also copy all required installation files for the package to a local directory on the computer running the Sequencer. This is the directory that you have to specify in step 5 of this procedure. - - - -Use the following procedure to create a virtual application package by using a Package Accelerator. - -**To create a virtual application package by using an App-V Package Accelerator** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. - -3. On the **Select Package Accelerator** page, to specify the Package Accelerator that will be used to create the new virtual application package, click **Browse** to locate the Package Accelerator that you want to use. Click **Next**. - - **Important** - If the publisher of the Package Accelerator cannot be verified and does not contain a valid digital signature, in the **Security Warning** dialog box, you must confirm that you trust the source of the Package Accelerator before you click **Run**. - - - -4. On the **Guidance** page, review the publishing guidance information displayed in the information pane. The information displayed was added when the Package Accelerator was created and contains information about creating and publishing the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. - -5. On the **Select Installation Files** page, to create a local folder that contains all required installation files for the package, click **Make New Folder** and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer running the Sequencer, click **Browse** to select the folder. - - Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**. - - **Note** - You can specify the following types of supported installation files: - - - Windows Installer files(**.msi** - - - .cab files - - - Compressed files with a .zip file name extension - - - The actual application files - - The following file types are not supported: **.msp** and.exe files. If you specify an **.exe** file you must extract the installation files manually. - - - -~~~ -If the Package Accelerator requires an application be installed prior to applying the Package Accelerator and you have installed the application, on the **Local Installation** page, select the check box **I have installed all applications**, and then click **Next**. -~~~ - -6. On the **Package Name** page, specify a name that will be associated with the package. The name specified identifies the package in the App-V Management Console. Click **Next**. - -7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package you are creating. To confirm the location where the package is created, review the information displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. - - To create the package, click **Create**. After the package has been created, click **Next**. - -8. On the **Configure Software** page, to enable the Sequencer to configure the applications contained in the package, select **Configure Software**. This step is useful for configuring any associated tasks that must be completed to run the application on target computers, such as configuring any associated license agreements. - - If you select **Configure Software**, the following items are configured by the Sequencer as part of this step: - - - **Load Package**. The Sequencer loads the files associated with the package. It can take several seconds to up to an hour to decode the package. - - - **Run Each Program**. Optionally run the programs contained in the package. This step is helpful for completing any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**. - - - **Save Package**. The Sequencer saves the package. - - - **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block. - - If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**. - -9. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md). - -## Related topics - - -[Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md b/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md deleted file mode 100644 index ca8c706037..0000000000 --- a/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Apply an App-V Project Template (App-V 4.6 SP1) -description: How to Apply an App-V Project Template (App-V 4.6 SP1) -author: dansimp -ms.assetid: 8ef120ab-8cfb-438c-8136-671167b7bd9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply an App-V Project Template (App-V 4.6 SP1) - - -You can use an App-V project template to apply common settings associated with an existing virtual application package to a new virtual application package. Using App-V project templates can help streamline the process of creating virtual application packages by configuring common settings before you begin sequencing an application. - -**Note**   -You can only apply an App-V project template when you are creating a new virtual application package. Applying project templates to existing virtual application packages is not supported. Additionally, you cannot use a project template in conjunction with a Package Accelerator. - - - -For more information about creating App-V project templates, see [How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md). - -**To apply an App-V project template** - -1. To start the Microsoft Application Virtualization Sequencer, on the computer on which App-V Sequencer is installed, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To create a new virtual application package by using an App-V project template, click **File** / **New From Template**. - -3. To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**. - -4. Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating. For more information about creating a new virtual application package, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md), and select the appropriate procedure. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md deleted file mode 100644 index f24d17b75f..0000000000 --- a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Assign the Proper Credentials for Windows Vista -description: How to Assign the Proper Credentials for Windows Vista -author: dansimp -ms.assetid: cc11d2af-a350-4d16-ba7b-f9c1d89e14b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Assign the Proper Credentials for Windows Vista - - -Use the following procedure to configure the App-V Desktop Client for proper Windows Vista credentials. - -**Note**   -This procedure must be completed on each non-domain joined computer. Depending on the number of non-domain joined computers in your environment, this could be a very tedious operation. You can use scripts and the command-line interface for Credential Manager to help administrators automate this process. - - - -**To assign the proper credentials for App-V clients running Windows Vista** - -1. With administrator privileges on the App-V Desktop Client running Windows Vista, open the **User Accounts** control panel (Classic Control Panel). - -2. Select **Manage your network passwords** from **User Accounts** in the left tasks pane. - -3. Select **Add** on the **Stored User Names and Passwords** screen. - -4. On the **Stored Credential Properties** screen, provide the information for the App-V infrastructure: - - 1. **Log on to:** External name of the publishing server. - - 2. **User name:** User name for the external user in the form Domain\\Username. - - 3. **Password:** Password for the user account entered in the **User name** field. - - 4. Leave **Credential Type** selected, and click **OK**. - -5. Click **Close**. The credentials are stored in the credential store for proper authentication to the App-V infrastructure. - -## Related topics - - -[Domain-Joined and Non-Domain-Joined Clients](domain-joined-and-non-domain-joined-clients.md) - -[How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md deleted file mode 100644 index 9e1d52e3fc..0000000000 --- a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Assign the Proper Credentials for Windows XP -description: How to Assign the Proper Credentials for Windows XP -author: dansimp -ms.assetid: cddbd556-d8f9-4981-a947-6e8e3f552b70 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Assign the Proper Credentials for Windows XP - - -Use the following procedure to configure the App-V Desktop Client for proper Windows XP credentials. - -**Note**   -After finishing this procedure, the non-domain joined client can perform a publishing refresh without being joined to a domain. - - - -**To assign the proper credentials for App-V clients running Windows XP** - -1. With administrator privileges on the App-V Client running Windows XP, open the **User Accounts** control panel (Classic Control Panel). - -2. Click the **Advanced Tab**, and select **Manage Passwords**. - -3. On the **Stored User Names and Passwords** screen, click **Add**. - -4. On the **Logon Information Properties** screen, fill out the following fields with information from the App-V infrastructure: - - 1. **Server:** Name of publishing server external name. - - 2. **User name:** User name for external user in the form Domain\\username. - - 3. **Password:** Password for the user account entered in the **User name** field. - -5. Click **OK**. The credentials will be stored on the client. - -## Related topics - - -[Domain-Joined and Non-Domain-Joined Clients](domain-joined-and-non-domain-joined-clients.md) - -[How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md b/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md deleted file mode 100644 index 84d62ca579..0000000000 --- a/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Associate an Application with a License Group -description: How to Associate an Application with a License Group -author: dansimp -ms.assetid: 85639db3-5751-497e-a9e7-ce4770c0b55f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Associate an Application with a License Group - - -You can enforce licensing restrictions on an application by associating the application with a license group in the Application Virtualization Server Management Console. Depending on the type of license group, you control who has access to the application and how many users can access an application at a time. You can also access license compliance reports for the application. - -**Important**   -One or more application license groups must exist for you to associate an application with a license group. - - - -**To associate an application with a license group** - -1. In the left pane of the management console, expand the **Applications** node. - -2. Right-click the application you want to add to a license group, and choose **Properties**. - -3. On the **General** tab, use the **Application License Group** pull-down menu to choose the group. - -4. Click **OK**. - - **Note**   - You can alter the **Properties** tab of one application at a time. - - - -## Related topics - - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-branch-a-package.md b/mdop/appv-v4/how-to-branch-a-package.md deleted file mode 100644 index 9b2ab8c069..0000000000 --- a/mdop/appv-v4/how-to-branch-a-package.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Branch a Package -description: How to Branch a Package -author: dansimp -ms.assetid: bfe46a8a-f0ee-4a71-9e9c-64ac08aac9c1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Branch a Package - - -Use this procedure to modify an existing sequenced application package so you can run it side-by-side with the original sequenced application package. This process is called branching. When you branch a virtual application package you are able to run two versions of the same package. For example, you can apply a service pack to an existing package, and run it side-by-side with the original sequenced virtual application package. - -Use the following procedure to branch a sequenced virtual application package. - -**To branch a sequenced virtual application package** - -1. Open the Microsoft Application Virtualization (App-V) Sequencer. To specify the destination directory that contains the package (.sprj) you want to branch select **File**, **Open**. - -2. Navigate to the directory that contains the sequenced application you plan to branch and click **Open**. - -3. To save a copy of the package, in the App-V Sequencer, select **File**, **Save As**. Specify a new, unique name, and specify a new unique package root directory for the copy of the package. Click **Save**. - - **Important** - You must specify a new package name or you will overwrite the existing version of the package. - - - -~~~ -The sequencer will automatically generate new GUID files for the new package. The version number associated with the package will also be automatically appended to the OSD file name. -~~~ - -4. After you save the new version you can apply the required configuration changes and save the associated ICO, OSD, SFT, and SPRJ files to correct location on the Application Virtualization (App-V) server. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md deleted file mode 100644 index 32dfc28858..0000000000 --- a/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Cancel Loading of Virtual Applications from the Desktop Notification Area -description: How to Cancel Loading of Virtual Applications from the Desktop Notification Area -author: dansimp -ms.assetid: 4420a091-a344-48e9-a354-93bc0e2470eb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Cancel Loading of Virtual Applications from the Desktop Notification Area - - -From the desktop notification area, you can cancel the loading of applications into the cache. Applications are loaded one application at a time; the progress bar shows you the application name, the percentage of application loaded, and the number of applications already processed compared to the total number of the applications queued. You can cancel any application load in progress before it is 100% loaded. You can skip the loading of all remaining applications as well. - -**To cancel loading applications** - -1. Right-click the Application Virtualization System icon in the notification area. - -2. Select **Cancel** and **Load All** from the pop-up menu. - -3. Click one of the following buttons in the **Microsoft App Virt - Confirm Cancel** dialog to achieve the desired results: - - 1. **Skip**—To skip the currently loading application. - - 2. **Skip All**—To skip all remaining applications. - - 3. **Continue**—To cancel the dialog box and continue loading applications. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-an-application-icon.md b/mdop/appv-v4/how-to-change-an-application-icon.md deleted file mode 100644 index 9e9dbf95b0..0000000000 --- a/mdop/appv-v4/how-to-change-an-application-icon.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: How to Change an Application Icon -description: How to Change an Application Icon -author: dansimp -ms.assetid: bd6cfb22-086b-43fd-b6f9-1907b5f16e83 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change an Application Icon - - -You can use the following procedure to change an icon associated with the selected application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To change an application icon** - -1. Move the cursor to the **Results** pane, and right-click the desired application. - -2. Select **Properties**. - -3. On the **General** tab, click **Change Icon**. - -4. Select the desired icon, or browse to another location to select the icon. After you've selected the icon, click **OK**. The new icon appears in the **Results** pane. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-an-application-iconserver.md b/mdop/appv-v4/how-to-change-an-application-iconserver.md deleted file mode 100644 index 19445774d2..0000000000 --- a/mdop/appv-v4/how-to-change-an-application-iconserver.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Change an Application Icon -description: How to Change an Application Icon -author: dansimp -ms.assetid: 52c870eb-4a54-410b-8abf-79395a53f846 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change an Application Icon - - -You can use the following procedure to change an icon associated with the selected application directly from the **Results** pane of the **Application** node in the Application Virtualization Server Management Console. - -**To change an application icon** - -1. Right-click the application, and select **Properties** from the pop-up menu. - -2. On the **General** tab, click the **Browse** button next to **Icon Path**. - -3. Select the desired icon, or browse to another location to select the icon. After you've selected the icon, click **Open**. Click **OK** to apply. - - The new icon appears in the **Results** pane. The new icon is also displayed in the menus and in the client desktop notification area. - -## Related topics - - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-deployment-properties.md b/mdop/appv-v4/how-to-change-deployment-properties.md deleted file mode 100644 index f9eb0b5d3f..0000000000 --- a/mdop/appv-v4/how-to-change-deployment-properties.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Change Deployment Properties -description: How to Change Deployment Properties -author: dansimp -ms.assetid: 0a214a7a-cc83-4d04-89f9-5727153be918 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change Deployment Properties - - -You can use the following procedures to change the **Deployment** tab information for an application you are sequencing, including the Application Virtualization server URL, the operating systems required by the virtualized applications, and the output options for the virtual application to be installed. - -**To change the server URL** - -1. Select the streaming protocol from the drop-down list box. - -2. Enter the host name of the virtual application server or the server group's load balancer. You can use the actual host name or IP address. - -3. Specify the port number on which the virtual application server or load balancer will listen for an Application Virtualization Desktop Client request for the streamed application. - -4. Specify the relative path on the virtual application server where the software package is stored. - -**To change the application operating systems requirements** - -1. To add the required operating system(s), select it in the **Available** list and click the arrow button pointing to the **Selected** operating systems list control. - -2. To remove an operating system, select it in the **Selected** list control, and click the arrow button pointing to the **Available** operating systems list control. - -**To change the application output options** - -1. From the **Compression Algorithm** drop-down list, select the compression method to use when streaming the application. - -2. Select the **Enforce Security Descriptors** check box to ensure security descriptors of the packaged applications are enforced when deployed. - -3. Select **Generate Difference File** to generate a difference file for the application from the previous sequenced version. - -4. Select **Generate Microsoft Windows Installer (MSI) Package** to create an installer package. - -## Related topics - - -[About the Deployment Tab](about-the-deployment-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-import-search-paths.md b/mdop/appv-v4/how-to-change-import-search-paths.md deleted file mode 100644 index fef1c273d9..0000000000 --- a/mdop/appv-v4/how-to-change-import-search-paths.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Change Import Search Paths -description: How to Change Import Search Paths -author: dansimp -ms.assetid: 0125f2bf-4958-4854-a5a4-a63afe5bb986 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change Import Search Paths - - -You can use the following procedure to change the import search path directly from the **Application Virtualization** node in the Application Virtualization Client Management Console. The import search path is used by the client to find the SFT file when you use the console to import an SFT file. If it can find the file in this search path, it will not need to prompt you for a path. - -**To change the import search path** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **Import Search Path** tab in the **Properties** dialog box, click **Add** to display a standard **Browse** dialog box and browse to the desired location. - -3. Highlight a path, and click **Remove** to delete this path. - -4. Use the **Move Up** and **Move Down** buttons to control the order in which the paths will be searched. - -5. Click **OK** or **Apply** to change the setting. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -[How to Import an Application](how-to-import-an-application.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-package-properties.md b/mdop/appv-v4/how-to-change-package-properties.md deleted file mode 100644 index 565e4c27e9..0000000000 --- a/mdop/appv-v4/how-to-change-package-properties.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Change Package Properties -description: How to Change Package Properties -author: dansimp -ms.assetid: 6050916a-d4fe-4dac-8f2a-47308dbbf481 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change Package Properties - - -You can use the following procedures to modify an Application Virtualization package name and its associated comments. - -If this is the first time the package has been created, you can also change the sequencing parameter block size, which determines how a sequenced application package is streamed from an Application Virtualization Server to an Application Virtualization Desktop Client. - -**Note**   -When selecting a block size, consider the size of the SFT file and your network bandwidth. A file with a smaller block size takes longer to stream over the network, but it is less bandwidth intensive. Files with larger block sizes might stream faster, but they use more network bandwidth. Through experimentation, you can discover the optimum block size for streaming applications on your network. - - - -The remainder of the package properties on the **Properties** tab is automatically generated and cannot be modified on this tab. - -**To change the package name or comments** - -1. Click the **Properties** tab. - -2. In the **Package Name** text box, enter or edit the single name used for the package, which can contain multiple applications. - -3. In the **Comments** text box, optionally enter or edit any comments. The suggested best practice is to provide detail information about the package and sequencing. - -4. From the **File** menu, select **Save**. - -**To change the block size** - -1. Click the **Properties** tab. - -2. On the **Block Size** drop-down list, select **4 KB**, **16 KB**, **32 KB**, or **64 KB**. - -3. From the **File** menu, select **Save**. - -## Related topics - - -[About the Properties Tab](about-the-properties-tab.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md b/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md deleted file mode 100644 index 0aed8a88e3..0000000000 --- a/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Change the Cache Size and the Drive Letter Designation -description: How to Change the Cache Size and the Drive Letter Designation -author: dansimp -ms.assetid: e7d7b635-079e-41aa-a5e6-655f33b4e317 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Cache Size and the Drive Letter Designation - - -You can change the cache size and drive letter designation directly from the **Application Virtualization** node in the Application Virtualization Client Management Console. - -**Note** -After the cache size has been set, it cannot be made smaller. - - - -**To change the cache size** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. Select the **File System** tab on the **Properties** dialog box. In the **Client Cache Configuration Settings** section, click one of the following radio buttons to choose how to manage the cache space: - - **Important** - If you select the **Use free disk space threshold** setting, the value you enter will set the cache size to the total disk size minus the free disk space threshold number you entered. If you then want revert to using the **Use maximum cache size** setting, you must specify a larger number than the existing cache size. Otherwise, the error “New size must be larger than the existing cache size” will appear. - - - -~~~ -- **Use maximum cache size** - - Enter a numeric value from 100 to 1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache. The value shown in **Reserved Cache Size** indicates the amount of cache in use. - -- **Use free disk space threshold** - - Enter a numeric value to specify the amount of free disk space, in MB, that the cache must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is unused. -~~~ - -3. Click **OK** or **Apply** to change the setting. - -**To change the drive letter designation** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **File System** tab in the **Properties** dialog box, in the **Drive to use** field, select the desired drive letter from the drop-down list of available drive letters. This setting becomes effective when the computer is rebooted. - -3. Click **OK** or **Apply** to change the setting. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md b/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md deleted file mode 100644 index 4c3247ee57..0000000000 --- a/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Change the Log Reporting Levels and Reset the Log Files -description: How to Change the Log Reporting Levels and Reset the Log Files -author: dansimp -ms.assetid: 9561d6fb-b35c-491b-a355-000064583194 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Log Reporting Levels and Reset the Log Files - - -You can use the following procedure to change the log reporting level from the **Application Virtualization** node in the Application Virtualization Management Console. When the log file reaches the maximum size (default is 256 MB), a reset is forced when the next write to the log occurs. A reset causes a new log file to be created, and the old file is renamed as a backup. - -**To change the log reporting level** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **General** tab in the **Properties** dialog box, from the **Log Level** drop-down list, select the desired log level. - - **Note**   - If you choose **Verbose** as the logging level, the log files will grow large very quickly. This might inhibit client performance, so best practice is to use this log level only for diagnosing specific problems. - - - -3. On the **General** tab in the **Properties** dialog box, from the **System Log Level** drop-down list, select the desired log level. - - **Note**   - The **System Log Level** setting controls the level of messages sent to the system event log. The logged messages are identical to the messages that get logged to the client event log, but they are stored in a different location. - - - -4. Click **OK** or **Apply** to change the setting. - -**To reset the log file** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **General** tab in the **Properties** dialog box, click **Reset Log** to back up the current log file and immediately start a new log file. The backup log files are stored in the same folder. - -3. Click **OK** or **Apply** to change the setting. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-server-cache-size.md b/mdop/appv-v4/how-to-change-the-server-cache-size.md deleted file mode 100644 index 5b61e12a03..0000000000 --- a/mdop/appv-v4/how-to-change-the-server-cache-size.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Change the Server Cache Size -description: How to Change the Server Cache Size -author: dansimp -ms.assetid: 24e63744-21c3-458e-b137-9592f4fe785c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Server Cache Size - - -You can use the following procedure to change the cache size for any server directly from the Application Virtualization Server Management Console. - -**Note**   -Although you can change the cache size, unless your configuration specifically requires you to change the size, it is recommended that you leave the cache size set to the default values. - - - -**To change the server cache size** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. In the **Results** pane, double-click the desired server group to display the list of servers in the group. - -3. In the **Results** pane, right-click the desired server and select **Properties**. - -4. Select the **Advanced** tab. - -5. Enter a value in the **Maximum Memory Allocation** field for the server cache, and enter a value for the threshold warning level in the **Warn Memory Allocation** field. - -6. Enter a value in the **Maximum Block Size** field. This number must be greater than or equal to the maximum block size of the largest package that will be streamed from the server. - -7. Click **OK**. - -## Related topics - - -[How to Change the Server Port](how-to-change-the-server-port.md) - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md b/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md deleted file mode 100644 index baeeef43e1..0000000000 --- a/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md +++ /dev/null @@ -1,142 +0,0 @@ ---- -title: How to Change the Server Logging Level and the Database Parameters -description: How to Change the Server Logging Level and the Database Parameters -author: dansimp -ms.assetid: e3ebaee5-6c4c-4aa8-9766-c5aeb00f477a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Server Logging Level and the Database Parameters - - -You can use the following procedures to change the logging level and the database log parameters from the Application Virtualization Server Management Console. - -The following logging levels are available: - -- Transaction Only - -- Fatal Errors - -- Errors - -- Warnings/Errors - -- Info/Warnings/Errors - -- Verbose - -**Note**   -Because of the size of the log file produced when you use **Verbose** mode, the recommendation is that you do not run production servers with this level of logging set. - - - -The database logging parameters determine the database driver type, access credentials, and location of the logging database. - -**To change the logging level for Management Servers** - -1. Click the **Server Groups** node to display the server groups. - -2. Right-click the server group, and select **Properties**. - -3. In the **Properties** dialog box, select the **Logging** tab. - -4. In the **Server Group Properties** dialog box, select the server and then click **Edit**. - -5. In the **Add/Edit Log Module** dialog box, select the logging level from the **Event Type** drop-down list. - -6. Click **OK**. - -7. In the **Server Group Properties** dialog box, click **OK** or **Apply**. - -**To change the logging level for Streaming Servers** - -1. Edit the following registry key value to change the logging level: - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\DistributionServer\\LogLevel - -2. Select one of the following values to set the logging level. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ValueLogging Level

    0

    Transactions Only

    1

    Fatal Errors

    2

    Errors

    3

    Warnings/Errors

    4

    Information/ Warnings/Errors

    5

    Verbose

    - - - -**To change database log parameters** - -1. Click the **Server Groups** node to display the server groups. - -2. Right-click the server group, and select **Properties**. - -3. In the **Properties** dialog box, select the **Logging** tab. - -4. In the **Server Group Properties** dialog box, select the server and then click **Edit**. - -5. In the **Add/Edit Log Module** dialog box, select a database driver from the **Database Driver** drop-down list. - -6. Enter a **DNS Host Name**. - -7. Click the **Dynamically Determine Port** check box, or enter a port number in the **Port** field. - -8. Enter a **Service Name** in the corresponding field. - -9. Click **OK**. - -10. On the **Server Group Properties** dialog box, click **OK** or **Apply**. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-server-port.md b/mdop/appv-v4/how-to-change-the-server-port.md deleted file mode 100644 index 14d1933fb9..0000000000 --- a/mdop/appv-v4/how-to-change-the-server-port.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Change the Server Port -description: How to Change the Server Port -author: dansimp -ms.assetid: 0b4a262c-4816-48d0-b7c6-e496bb0d7370 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Server Port - - -From the Application Virtualization Server Management Console, you can use the following procedure to change the server communication port for any server. - -**To change the server port** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. In the **Results** pane, double-click the desired server group to display the list of servers in the group. - -3. In the **Results** pane, right-click the desired server and select **Properties.** - -4. Select the **Ports** tab. - -5. Enter the **Port** number. - - **Note**   - The port number can be any value between 1 and 65,535. The default values are 554 for RTSP and 322 for RTSPS. - - - -6. Click **OK** to change the port number. - -7. Click **OK** to exit the dialog box. - -8. Click **OK** at the prompt. - -## Related topics - - -[How to Change the Server Cache Size](how-to-change-the-server-cache-size.md) - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md b/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md deleted file mode 100644 index db72c07843..0000000000 --- a/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Change the Size of the FileSystem Cache -description: How to Change the Size of the FileSystem Cache -author: dansimp -ms.assetid: 6ed17ba3-293b-4482-b3fa-31e5f606dad6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change the Size of the FileSystem Cache - - -You can change the size of the FileSystem cache by using the command line. This action requires a complete reset of the cache, and it requires administrative rights. - -**To change the size of the FileSystem cache** - -1. Set the following registry value to 0 (zero): - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\State - -2. Set the following registry value to the maximum cache size, in MB, that is necessary to hold the packages—for example, 8192 MB: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\FileSize - -3. Restart the computer. - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-change-user-access-permissions.md b/mdop/appv-v4/how-to-change-user-access-permissions.md deleted file mode 100644 index e935af3cad..0000000000 --- a/mdop/appv-v4/how-to-change-user-access-permissions.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Change User Access Permissions -description: How to Change User Access Permissions -author: dansimp -ms.assetid: 21b60cc7-5395-401e-a374-6ef0d58872b7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change User Access Permissions - - -Use the following procedure to change user access permissions in the Application Virtualization Client Management Console. - -**Note**   -Before changing users access permissions, ensure that any permissions changes are consistent with the organization's guidelines for granting user access. - - - -**To change user access permissions** - -1. Right-click the **Application Virtualization** node, and select **Properties** from the pop-up menu. - -2. On the **Permissions** tab on the **Properties** dialog box, scroll through the list of permissions and select the check boxes that correspond to the permissions you want to grant to users of this computer. Administrators have access to all the permissions regardless of the settings on this tab. - -3. Click **OK** or **Apply** to change the setting. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-clear-an-application.md b/mdop/appv-v4/how-to-clear-an-application.md deleted file mode 100644 index 2fba3e47a3..0000000000 --- a/mdop/appv-v4/how-to-clear-an-application.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: How to Clear an Application -description: How to Clear an Application -author: dansimp -ms.assetid: 247b8f40-531c-413e-a2e5-fc990ed0a51a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Clear an Application - - -You can clear an application from the console directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you clear an application, the system removes the settings, shortcuts, and file type associations that correspond to the application and also removes the application from the user’s list of applications. - -**Note**   -When you clear an application from the console, you can no longer use that application. However, the application remains in cache and is still available to other users on the same system. After a publishing refresh, the cleared applications will again become available to you. If there are multiple applications in a package, the user's settings are not removed until all of the applications are cleared. - - - -**To clear an application from the console** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Clear** from the pop-up menu. - -2. At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation. - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md deleted file mode 100644 index 0a694a6795..0000000000 --- a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -title: How to Configure a Read-only Cache on the App-V Client (RDS) -description: How to Configure a Read-only Cache on the App-V Client (RDS) -author: dansimp -ms.assetid: b6607fe2-6f92-4567-99f1-d8e3c8a591e0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure a Read-only Cache on the App-V Client (RDS) - - -**Important**   -You must be running App-V 4.6, SP1 to use this procedure. - - - -You can deploy the App-V client by using a shared cache that is populated with all the applications required for all users. Then you configure the App-V Remote Desktop Services (RDS) Clients to use the same cache file. Users are granted access to specific applications by using the App-V publishing process. Because the cache is already preloaded with all applications, no streaming occurs when a user starts an application. However, the packages used to prepopulate the cache must be put on an App-V server that supports Real Time Streaming Protocol (RTSP) streaming and that grants access permissions to the App-V Clients. If you publish the applications by using an App-V Management Server, you can use it to provide this streaming function. - -**Note**   -The details outlined in these procedures are intended as examples only. You might use different methods to complete the overall process. - - - -## Deploying the App-V Client in an RDS Scenario - - -The deployment process consists of four primary tasks: - -- Creating and populating the master shared cache file - -- Copying the shared cache file to the server storage - -- Configuring the App-V client software - -- Managing the update deployment cycle for the shared cache file after the initial deployment - -These tasks require careful planning. We recommend that you prepare and document a methodical, reproducible process for your organization to follow. This is especially important for the preparation and deployment of the master shared cache file, and for the ongoing management of application updates, each of which require an update to the master shared cache. Use the following procedures to complete these primary tasks. - -**Note**   -Although you can publish the applications by using several different methods, the following procedures are based on your using an App-V Management Server for publishing. - - - -**To configure the read-only cache for initial deployment** - -1. Set up and configure an App-V Management Server to provide user authentication and publishing support. - -2. Populate the Content folder of this Management Server with all the application packages required for all users. - -3. Set up a staging computer that has the App-V Client installed. Log on to the staging computer by using an account that has access to all applications so that the complete set of applications are published to the computer, and then stream the applications to cache so that they are fully loaded. - - **Important** - The staging computer must use the same operating system type and system architecture as those used by the VMs on which the App-V Client will run. - - - -4. Restart the staging computer in safe mode to make sure that the drivers are not started, because this would lock the cache file. - - **Note** - Or, you can stop and disable the Application Virtualization service, and then restart the computer. After the file is copied, remember to enable and start the service again. - - - -5. Copy the Sftfs.fsd cache file to a SAN where all the RDS servers can access it, such as in a shared folder. Set the folder access permissions to Read-only for the group Everyone and to Full Control for administrators who will manage the cache file updates. The location of the cache file can be obtained from the registry AppFS\\FileName. - - **Important** - You must put the FSD file in a location that has the responsiveness and reliability equal to locally attached storage performance, for example, a SAN. - - - -6. Install the App-V RDS Client on each RDS server, and then configure it to use the read-only cache by adding the following registry key values to the AppFS key on the client. The AppFS key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\]Microsoft\\SoftGrid\\4.5\\Client\\AppFS for 32-bit computers and at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS for 64-bit computers. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    KeyTypeValuePurpose

    FileName

    String

    path of FSD

    Specifies the path of the shared cache file, for example, \RDSServername\Sharefolder\SFTFS.FSD (Required).

    ReadOnlyFSD

    DWORD

    1

    Configures the client to operate in Read-Only mode. This ensures that the client will not try to stream updates to the package cache. (Required)

    ErrorLogLocation

    String

    path of error log (.etl) file

    Entry used to specify the path of the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl).

    - - - -7. Configure each RDS server in the farm to use the publishing server and to use publishing update when users log on. As users log on to the RDS servers, a publishing update cycle occurs and publishes all the applications for which their account is authorized. These applications are run from the shared cache. - -**To configure the RDS client for package upgrade** - -1. Complete the upgrade and testing of the application package. - -2. Upgrade the package on the App-V server. Then, publish and stream the new version of the applications to the client on the staging computer so that they are fully loaded into cache. - -3. Restart the staging computer in safe mode to ensure the drivers are not started. - - **Note**   - Or, you can first stop and then disable the Application Virtualization service in the Services.msc, and restart the computer. After the file has been copied, remember to enable and start the service again. - - - -4. Copy the Sftfs.fsd cache file to a SAN where all the RDS servers can access it, such as in a shared folder. You can use a different file name, for example, SFTFS\_V2.FSD, to distinguish the new version. - -5. To configure the App-V RDS Client on each RDS server in the farm to use the updated shared cache file, change the AppFS registry key FILENAME value to point to the location of the updated file, for example, \\\\RDSServername\\Sharefolder\\SFTFS\_V2.FSD. This guarantees that each RDS server receives the updated copy of the cache when the App-Vclient drivers restart. - - **Important**   - You must restart the RDS servers in order to use the updated shared cache file. - - - -## How to Use Symbolic Links when Upgrading the Cache - - -Instead of changing the AppFS key FILENAME value every time that a new cache file is deployed that contains new or upgraded packages, you can use a symbolic link in the following operating systems: Windows Vista, Windows 7, and Windows Server 2008. For more information about symbolic links, see [Symbolic Links](https://go.microsoft.com/fwlink/?LinkId=157626) (https://go.microsoft.com/fwlink/?LinkId=157626). In contrast, Windows XP does not support the use of symbolic links, and you must use junction points instead. For more information about junctions, see [article 205524](https://go.microsoft.com/fwlink/?LinkId=182553) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=182553), and also the tool [Junction v1.05](https://go.microsoft.com/fwlink/?LinkId=182554) (https://go.microsoft.com/fwlink/?LinkId=182554). - -**To configure a symbolic link to reference the cache** - -1. During the initial deployment stage, open a Command Prompt window as a local administrator on the RDS server host operating system. - -2. Create a symbolic link by using the MKLINK command, and then configure it to point to the Sftfs.fsd file. - - **     mklink symlinkname \\\\rdshostserver\\sharefolder\\sftfs.fsd** - -3. On the VDI Master VM Image, open a Command Prompt window by using the **Run as administrator** option and grant remote link permissions so that the VM can access the symbolic link on the VDI Host operating system. By default, remote link permissions are disabled. - - **fsutil behavior set SymlinkEvaluation R2R:1** - - **Note**   - On the storage server, appropriate link permissions must be enabled. Depending on the location of link and the Sftfs.fsd file, the permissions are **L2L:1** or **L2R:1** or **R2L:1** or **R2R:1**. - - - -4. When you configure the App-V RDS Client, set the AppFS key FILENAME value equal to the UNC path of the FSD file that is using the symbolic link. For example, set the file name to \\\\VDIHostserver\\Symlinkname. When the App-V client first accesses the cache, the symbolic link passes to the client a handle to the cache file. The client continues to use that handle as long as the client is running. The value of the symbolic link can safely be updated even if existing clients have the old shared cache open. - -5. When you must upgrade a package or to add a new package to the cache, follow steps 1 through 4 of the upgrade procedure. Then, delete the symbolic link and re-create it to point to the new version of the shared cache file. This guarantees that each RDS server receives the updated copy of the cache when the App-V client drivers restart. When the RDS server is restarted, the App-V client receives a handle to the updated copy of the cache because the client uses the path that contains the updated symbolic link. Then, the users have access to the new and updated applications. - -## Related topics - - -[How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md deleted file mode 100644 index 8fd997eafd..0000000000 --- a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md +++ /dev/null @@ -1,197 +0,0 @@ ---- -title: How to Configure a Read-only Cache on the App-V Client (VDI) -description: How to Configure a Read-only Cache on the App-V Client (VDI) -author: dansimp -ms.assetid: 7a41e017-9e23-4a6a-a659-04d23f008b83 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure a Read-only Cache on the App-V Client (VDI) - - -In Microsoft Application Virtualization (App-V) 4.6 the Client supports using a shared read-only cache. The shared read-only cache enables the Client to use disk space efficiently in a Virtual Desktop Infrastructure (VDI) system, where users run applications on Virtual Machines (VM) that are hosted in a data center server environment and share network storage on a Storage Area Network (SAN). The following procedures provide an overview of the process that is required to implement the App-V Client in either of the primary VDI architectures, known as “Pooled VM” or “Static VM”. It is assumed that you are familiar with the planning, deployment, and operation of the App-V system and its components, and also the operation and management of the VDI server. For more information about App-V, see [Application Virtualization](https://go.microsoft.com/fwlink/?LinkId=122939) (https://go.microsoft.com/fwlink/?LinkId=122939) - -**Note**   -The details outlined in these procedures are intended as examples only. You might use different methods to complete the overall process. - - - -## Deploying the App-V Client in a VDI Scenario - - -You can deploy the App-V Client in a VDI scenario by using a shared read-only cache that has been populated with all the applications required for all users. You then configure the VDI Master VM Image so that all the App-V Clients use the same cache file. Users are granted access to specific applications by using the App-V publishing process. Since the cache is already preloaded with all applications, no streaming occurs when a user starts an application. However, the packages used to prepopulate the cache must be put on an App-V server that supports Real Time Streaming Protocol (RTSP) streaming and that grants access permissions to the App-V Clients. If you publish the applications by using an App-V Management Server, you can use it to provide this streaming function. - -The deployment process consists of four primary tasks: - -- Creating and populating the master shared cache file - -- Copying the shared cache file to the VDI server storage - -- Configuring the App-V client software on the VDI Master Image - -- Managing the update deployment cycle for the shared cache file after the initial deployment - -These tasks require careful planning. We recommend that you prepare and document a methodical, reproducible process for your organization to follow. This is especially important for the initial preparation and deployment of the master shared cache file, and for the on-going management of application updates, each of which require an update to the master shared cache. Use the following procedures to complete these primary tasks. - -**Note**   -Although you can publish the applications by using several different methods, the following procedures are based on the use of an App-V Management Server for publishing. - - - -**To configure the read-only cache for initial deployment in a Pooled VM VDI or Static VM VDI scenario** - -1. Set up and configure an App-V Management Server in a VM on the VDI server to provide user authentication and publishing support. - -2. Populate the Content folder of this Management Server with all the application packages required for all users. - -3. Set up a staging computer that has the App-V Client installed. Log on to the staging computer with an account that has access to all applications so that the complete set of applications are published to the computer, and then stream the applications to cache so that they are fully loaded. - - **Important** - The staging computer must use the same operating system type and system architecture as those used by the VMs on which the App-V Client will run. - - - -4. Restart the staging computer in Safe Mode to ensure the drivers are not started, which would lock the cache file. - - **Note** - Alternatively, you can stop and disable the Application Virtualization service, and then restart the computer. After the file has been copied, remember to enable and start the service again. - - - -5. Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. Set the folder access permissions to Read-only for the group Everyone and to Full Control for administrators who will manage the cache file updates. The location of the cache file can be obtained from the registry AppFS\\FileName. - - **Important** - You must put the FSD file in a location that has the responsiveness and reliability equivalent to locally attached storage performance, for example, a SAN. - - - -6. Install the App-V Desktop Client on the VDI Master VM Image, and then configure it to use the read-only cache by adding the following registry key values to the AppFS key on the client. The AppFS key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\[Wow6432Node\\\]Microsoft\\SoftGrid\\4.5\\Client\\AppFS. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    KeyTypeValuePurpose

    FileName

    String

    path to FSD

    Specifies the path to the shared cache file, for example, \VDIServername\Sharefolder\SFTFS.FSD (Required).

    ReadOnlyFSD

    DWORD

    1

    Configures the client to operate in Read-Only mode. This ensures that the client will not attempt to stream updates to the package cache. (Required)

    ErrorLogLocation

    String

    path to error log (.etl) file

    Entry used to specify the path to the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl).

    - - - -7. Configure the Master VM Image client to use the publishing server and to use publishing refresh at logon. As users log on to the VDI system and their VM is built from the Master VM Image, a publishing refresh cycle occurs and publishes all the applications for which their account is authorized. These applications are run from the shared cache. - -**To configure the client for package upgrade in a Pooled VM scenario** - -1. Complete the upgrade and testing of the application package. - -2. Upgrade the package on the App-V server. Then, publish and stream the new version of the applications to the client on the staging computer so that they are fully loaded into cache. - -3. Restart the staging computer in Safe Mode to ensure the drivers are not started. - - **Note**   - Alternatively, you can stop and disable the Application Virtualization service in the Services.msc, and then restart the computer. After the file has been copied, remember to enable and start the service again. - - - -4. Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. You can use a different filename, for example, SFTFS\_V2.FSD, to distinguish the new version. - -5. To configure the App-V Desktop Client on the VDI Master VM Image to use the updated shared cache file, change the AppFS registry key FILENAME value to point to the location of the updated file, for example, \\\\VDIServername\\Sharefolder\\SFTFS\_V2.FSD. When users log off and then log on again, a new VM is created for them by using the updated Master Image. All their user settings will be retained and applied to the new VM. Then they have access to the updated applications. - -**To configure the client for package upgrade in a Static VM scenario** - -1. Complete the upgrade and testing of the application package. - -2. Upgrade the package on the App-V server. Then, publish and stream the new version of the applications to the client on the staging computer so that the applications are fully loaded into cache. - -3. Restart the staging computer in Safe Mode to ensure that the drivers are not started. - - **Note**   - Alternatively, you can stop and disable the Application Virtualization service in the Services.msc, and then restart the computer. After the file has been copied, remember to enable and start the service again. - - - -4. Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. You can use a different filename, for example, SFTFS\_V2.FSD, to distinguish the new version. - -5. To configure the App-V Desktop Client on the VDI Master VM Image to use the updated shared cache file, change the AppFS registry key FILENAME value to point to the location of the updated file, for example, \\\\VDIServername\\Sharefolder\\SFTFS\_V2.FSD. This ensures that new users get the new version. - -6. Create a script that edits the AppFS key FILENAME value to set it to the location of the updated cache, for example, \\\\VDIServername\\Sharefolder\\SFTFS\_V2.FSD. Configure this script to run when the user logs off or logs on so that it runs before the App-V client drivers start, for example, by using Group Policy settings. When users log off and log on again, their existing VM is updated, and they will use the updated copy of the cache. Then, they have access to the updated applications. - -## How to Use Symbolic Links when Upgrading the Cache - - -Instead of modifying the AppFS key FILENAME value every time that a new cache file is deployed that contains new or upgraded packages, you can use a symbolic link in the following operating systems: Windows Vista, Windows 7, and Windows Server 2008. For more information about symbolic links, see [Symbolic Links](https://go.microsoft.com/fwlink/?LinkId=157626) (https://go.microsoft.com/fwlink/?LinkId=157626). In contrast, Windows XP does not support the use of symbolic links, and you must use junction points instead. For more information about junctions, see [article 205524](https://go.microsoft.com/fwlink/?LinkId=182553) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=182553), and also the tool [Junction v1.05](https://go.microsoft.com/fwlink/?LinkId=182554) (https://go.microsoft.com/fwlink/?LinkId=182554). - -**To configure a symbolic link to reference the cache** - -1. During the initial deployment stage, open a Command Prompt window as a local administrator on the VDI server host operating system. - -2. Create a symbolic link by using the MKLINK command, and then configure it to point to the Sftfs.fsd file. - - **     mklink symlinkname \\\\vdihostserver\\sharefolder\\sftfs.fsd** - -3. On the VDI Master VM Image, open a Command Prompt window by using the **Run as administrator** option and grant remote link permissions so that the VM can access the symbolic link on the VDI Host operating system. By default, remote link permissions are disabled. - - **fsutil behavior set SymlinkEvaluation R2R:1** - - **Note**   - On the storage server, appropriate link permissions must be enabled. Depending on the location of link and the Sftfs.fsd file, the permissions are **L2L:1** or **L2R:1** or **R2L:1** or **R2R:1**. - - - -4. When you configure the App-V Desktop Client on the VDI Master VM Image, set the AppFS key FILENAME value equal to the UNC path of the FSD file that is using the symbolic link; for example, set it to \\\\VDIHostserver\\Symlinkname. When the App-V client first accesses the cache, the symbolic link passes to the client a handle to the cache file. The client continues to use that handle as long as the client is running. The value of the symbolic link can safely be updated even if existing clients have the old shared cache open. - -5. When you must upgrade a package or to add a new package to the cache, follow steps 1 through 5 of the upgrade procedure for either the Static VM or Pooled VM scenario. Then, delete the symbolic link and re-create it to point to the new version of the shared cache file. When the VM is restarted, the client receives a handle to the updated copy of the cache because the VM uses the path that contains the updated symbolic link. Then, the users have access to the new and updated applications. - -## Related topics - - -[How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md b/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md deleted file mode 100644 index c14a8c48a6..0000000000 --- a/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Configure Management Server Security Post-Installation -description: How to Configure Management Server Security Post-Installation -author: dansimp -ms.assetid: 71979fa6-3d0b-4a8b-994e-cb728d013090 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Management Server Security Post-Installation - - -Use the App-V Management Console to add the certificate and configure the App-V Management Server for enhanced security. You can use the following procedure to configure security post-installation. - -**To configure Management Server security post-installation** - -1. Open the App-V Management Console, and connect to the **Management Service** with App-V administrator privileges. - -2. Expand the server, expand **Server Groups**, and then select the appropriate server group with which the Management Server was registered. - -3. Right-click the Management Server object, and select **Properties**. - -4. On the **Ports** tab, click **Server Certificate** and complete the wizard to select the properly provisioned certificate. - - **Note**   - If no certificates are displayed in the wizard, a certificate has not been provisioned or the certificate does meet the requirements of App-V. - - - -5. Click **Next** to continue on to the **Welcome To Certificate Wizard** page. - -6. Select the correct certificate in the **Available Certificates** screen. - -7. Click **Finish**. - -8. After completing the wizard, clear **RTSP** as an available listening port. This prevents connections from being made over a non-secure communication channel. - -9. Click **Apply**, and restart the **Microsoft Virtual Application Server** service. Use the service’s MMC snap-in to accomplish this task. - -## Related topics - - -[How to Configure Streaming Server Security Post-Installation](how-to-configure-streaming-server-security-post-installation.md) - -[Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md b/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md deleted file mode 100644 index 2b4a53819a..0000000000 --- a/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: How to Configure Microsoft SQL Server Mirroring Support for App-V -description: How to Configure Microsoft SQL Server Mirroring Support for App-V -author: dansimp -ms.assetid: 6d069eb5-109f-460a-836a-de49473b7035 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure Microsoft SQL Server Mirroring Support for App-V - - -You can use the following procedure to configure your Microsoft Application Virtualization (App-V) environment to use Microsoft SQL Server database mirroring. Configuring database mirroring can help with disaster recovery and failover scenarios. App-V 4.5 SP2 supports all modes of database mirroring currently available for Microsoft SQL Server 2005 and SQL Server 2008. - -**Note** -This procedure is written for administrators who are familiar with setting up and configuring SQL Server databases and database mirroring with Microsoft SQL Server, and therefore covers only the specific configuration settings that are unique to App-V. - - - -**To configure your App-V environment to use Microsoft SQL Server database mirroring** - -1. Set up SQL Server database mirroring of the App-V database following your standard business practices for database mirroring. Use the following links for general information about implementing Microsoft SQL Server database mirroring: - - - **Microsoft SQL 2005**—[Setting Up Database Mirroring](https://go.microsoft.com/fwlink/?LinkId=187478) (https://go.microsoft.com/fwlink/?LinkId=187478) - - - **Microsoft SQL 2008**—[Setting Up Database Mirroring](https://go.microsoft.com/fwlink/?LinkId=187477) (https://go.microsoft.com/fwlink/?LinkId=187477) - - In addition, you can find Best Practices information in [Database Mirroring Best Practices and Performance Considerations](https://go.microsoft.com/fwlink/?LinkId=190270) (https://go.microsoft.com/fwlink/?LinkId=190270). - -2. After mirroring has been set up, verify that the App-V database shows a status of **(Principal, Synchronized)**, and the mirrored database shows a status of **(Mirror, Synchronized / Restoring)**. Resolve any mirroring issues before proceeding to the next step. For additional information about monitoring the status, see [Monitoring Mirroring Status](https://go.microsoft.com/fwlink/?LinkId=190279) (https://go.microsoft.com/fwlink/?LinkId=190279). - -3. On the SQL Server computer that hosts the mirror of the App-V database, create the SQL Server Login for the network service account of the App-V Management Server by using the account name **<domain>\\<ManagementServerHostName>$**. - -4. Install the Microsoft SQL Server Native Client on the App-V Management Server, and on the computer running the App-V Management Web Service if installed on a different computer. If you plan to have additional App-V Management Servers connect to the mirrored SQL database for load balancing, you must install the Microsoft SQL Server Native Client on those computers as well. You can download the Microsoft SQL Server Native Client from the [Microsoft SQL Server 2008 Feature Pack](https://go.microsoft.com/fwlink/?LinkId=187479) page in the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=187479). - -5. Check the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLServerName** and make sure that it contains only the host name of the SQL Server. If it includes an instance name, for example *serverhostname\\instancename*, the instance name must be removed. - - **Important** - The App-V Management Server uses the TCP/IP networking library to communicate with the SQL Server when database mirroring is enabled, and therefore instance names cannot be used. The port numbers must be specified in the registry keys instead. - - - -6. Check the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLServerPort** and make sure that it contains the port number that is used for SQL on the SQL Server computer. If you are using a named instance this key value must be set to the port that is used for the named instance. - -7. Create the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLFailoverServerName** as REG\_SZ and then set the value to the host name of the SQL Server that hosts the mirror. - -8. Create the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLFailoverServerPort** as DWORD and then set the value to the port number that is used for SQL on the computer that is running SQL Server to host the mirror. If you are using a named instance for the mirror this key value must be set to the port number that is used for the named instance. - -9. On the computer that is running the App-V Management Web Service, configure the Universal Data Link (UDL) text file. In the directory where App-V is installed, double-click **SftMgmt.udl** and specify the following values: - - - On the **Provider** tab, select the OLE DB provider **SQL Server Native Client 10.0**. - - - Click **Next** to select the **Connection** tab. In the **Server Name** box, enter the server name of the SQL Server. Next, select **Use Windows NT Integrated Security**. Finally, click the list **Select the database**, and then select the App-V database name. - - - Click the **All** tab, and then select the entry **Failover Partner**. Click **Edit Value**, and then enter the server name of the failover SQL Server. Click **OK**. - - **Important** - The App-V system uses Kerberos authentication. Therefore, when you configure SQL mirroring where Kerberos Authentication is enabled on the SQL Server and the SQL Server service runs under a domain user account, you must manually configure an SPN. For more information, see “When SQL Service Uses Domain-Based Account” in the article [Configuring App-V Administration for a Distributed Environment](https://go.microsoft.com/fwlink/?LinkId=203186) (https://go.microsoft.com/fwlink/?LinkId=203186). - - - -10. To verify that database mirroring is running correctly, test the failover and confirm that the App-V Management Server continues to function correctly. - - **Important** - Proceed with care, and follow your standard business practices to ensure that system operations are not disrupted in the event of a failure. - - - -~~~ -After the failover has occurred successfully, as verified by using the SQL Server status monitoring information, right-click the **Applications** node in the App-V Management Console, and then select **Refresh**. The list of applications should display normally if the system is working correctly. -~~~ - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md b/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md deleted file mode 100644 index 1c79254fd6..0000000000 --- a/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Configure Servers for ESD-Based Deployment -description: How to Configure Servers for ESD-Based Deployment -author: dansimp -ms.assetid: 96208522-3a0c-4606-a10b-fc0ec0a12021 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Servers for ESD-Based Deployment - - -This section provides procedures you can use to configure the Application Virtualization Streaming Servers, the IIS server, and the file server for your electronic software distribution–based deployment strategy. - -## In This Section - - -[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) -Provides a step-by-step procedure for configuring the Application Virtualization Streaming Servers. - -[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) -Provides a step-by-step procedure for configuring the IIS server for your electronic software distribution deployment. - -[How to Configure the File Server](how-to-configure-the-file-server.md) -Provides a step-by-step procedure for configuring a local computer that is used as a file share and that streams applications to the Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services), for a deployment strategy where your site does not have server-class hardware installed. - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md b/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md deleted file mode 100644 index 5a4d8e1932..0000000000 --- a/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Configure Servers for Server-Based Deployment -description: How to Configure Servers for Server-Based Deployment -author: dansimp -ms.assetid: 6371c37a-46eb-44e8-ad6b-4430c866c8b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Servers for Server-Based Deployment - - -This section provides procedures you can use to configure the Microsoft System Center Application Virtualization (App-V) Management Servers and Microsoft System Center Application Virtualization Streaming Servers, and the Internet Information Services (IIS) and file servers, as appropriate for your Application Virtualization Server-based deployment strategy. - -## In This Section - - -[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) -Provides a step-by-step procedure for configuring the Application Virtualization Management Servers. - -[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) -Provides a step-by-step procedure for configuring the Application Virtualization Streaming Servers. - -[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) -Provides a step-by-step procedure for configuring the IIS server for your server-based deployment. - -[How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md) -Provides detailed instructions about how to configure the server to be trusted for delegation. - -[Configuring the Firewall for the App-V Servers](configuring-the-firewall-for-the-app-v-servers.md) -Describes the firewall settings required for the App-V servers. - -[How to Install and Configure the Default Application](how-to-install-and-configure-the-default-application.md) -Describes how to install and configure the default application for testing the App-V system. - -## Related topics - - -[Application Virtualization Server-Based Scenario Overview](application-virtualization-server-based-scenario-overview.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md b/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md deleted file mode 100644 index c668b902eb..0000000000 --- a/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: How to Configure Shortcut and File Type Association Behavior -description: How to Configure Shortcut and File Type Association Behavior -author: dansimp -ms.assetid: d6fd1728-4de6-4066-b36b-d4837d593d40 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Shortcut and File Type Association Behavior - - -Shortcut and File Type Association (FTA) publishing policy is defined and controlled by the publishing XML file, which is sent to clients by a publishing server during a publishing refresh operation. When the client receives this information, it adds any newly published data about applications such as the icons and FTAs. Then, it removes any outdated publishing data. - -In App-V version 4.6, two registry key values have been defined to enable administrators to control this behavior. By default, shortcuts that are created locally by using the client console are now retained. - -## How to Change Shortcut and FTA Behavior - - -Two new DWORD registry values have been defined for the client Configuration registry key, “FileTypePolicy” and “ShortcutPolicy”. These DWORD registry values are not present by default, but they can be added manually. The Configuration registry key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\[Wow6432Node\\\]Microsoft\\SoftGrid\\4.5\\Client\\Configuration. - -There are four policy values defined in the following table and these apply to both registry key values. The following list shows the numeric values for the registry settings, and the behavior applied to file types or shortcuts on a publishing refresh operation. - - ------ - - - - - - - - - - - - - - - - - - - - -

    Name

    Type

    Data (Examples)

    Description

    FileTypePolicy

    DWORD

    Default=0x2 (App-V 4.6)

    (0x0) – “ClientOnly”- remove any existing items from the same publishing information source, and keep only items that are added locally

    -

    (0x1) – “ServerOnly” - remove any outdated items from the same publishing information source and any items that are added locally, and add the new items

    -

    (0x2) – “ClientAndServer”- remove any outdated items from the same publishing information source, keep items added locally, and add the new items (default if not present for App-V 4.6)

    -

    (0x3) – “NoChange” - make no changes to file types or shortcuts

    ShortcutPolicy

    DWORD

    Default=0x2

    (0x0) – “ClientOnly”- remove any existing items from the same publishing information source, and keep only items added locally

    -

    (0x1) – “ServerOnly” - remove any outdated items from the same publishing information source and any items added locally, and add the new items

    -

    (0x2) – “ClientAndServer”- remove any outdated items from the same publishing information source, keep items added locally, and add the new items (default if not present)

    -

    (0x3) – “NoChange” - make no changes to file types or shortcuts

    - - - -**Note**   -The text values refer to the values for the XML attributes in the publishing XML file.  You can set these values manually if you have implemented a custom HTTP publishing solution. - - - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md b/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md deleted file mode 100644 index afe7d0a2da..0000000000 --- a/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Configure Streaming Server Security Post-Installation -description: How to Configure Streaming Server Security Post-Installation -author: dansimp -ms.assetid: 9bde3677-d1aa-4dcc-904e-bb49a268d748 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Streaming Server Security Post-Installation - - -Configure the App-V Streaming Server for enhanced security through the registry. As with the App-V Management Server, a certificate must be correctly provisioned with the correct EKU identifier for Server Authentication before you complete the following post-installation procedure. - -**To configure Streaming Server security post-installation** - -1. Create an MMC, add the **Certificates** snap-in, and select **Local Machine certificate store**. - -2. Open the **Personal** certificates for the computer, and open the certificate provisioned for App-V. - -3. On the **Details** tab, scroll down to the thumbprint and copy the hash in the details pane. - -4. Open the registry editor, and navigate to `HKLM\Software\Microsoft\SoftGrid\4.5\Distribution server`. - -5. Edit the `X509CertHash` value, paste the thumbprint hash in the value field, and remove all spaces. Click **OK** to accept the edit. - -6. In the registry editor, navigate to `HKLM\Software\Microsoft\SoftGrid\4.5\Distribution server\RtspsPorts`. - -7. Create a new **DWORD** value named "322," and then enter the decimal value as 322 or the hexadecimal value as 142. - -8. Restart the streaming service. - -## Related topics - - -[How to Configure Management Server Security Post-Installation](how-to-configure-management-server-security-post-installation.md) - -[Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md b/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md deleted file mode 100644 index 03e3ac7409..0000000000 --- a/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Configure the App-V Client Registry Settings by Using the Command Line -description: How to Configure the App-V Client Registry Settings by Using the Command Line -author: dansimp -ms.assetid: 3e3d873f-13d2-402f-97b4-f62d0c399171 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure the App-V Client Registry Settings by Using the Command Line - - -After the Application Virtualization (App-V) Client has been deployed and configured during the installation by using the command line, it might be necessary to change one or more client configuration settings. This is accomplished by editing the appropriate registry keys, using one of the following methods: - -- Using the Registry Editor directly - -- Using a .reg file - -- Using a scripting language such as VBScript or Windows PowerShell - -There is also an ADM template that you can use. For more information about the ADM template, see . - -**Caution**   -Use care when you edit the registry because errors can leave the computer in an unusable state. Be sure to follow your standard business practices that relate to registry edits. Thoroughly test all proposed changes in a test environment before you deploy them to production computers. - - - -## In This Section - - -**Important**   -On a 64-bit computer, the keys and values described in the following sections will be under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client. - - - -[How to Reset the FileSystem Cache](how-to-reset-the-filesystem-cache.md) -Provides the information that is required to reset the FileSystem cache. - -[How to Change the Size of the FileSystem Cache](how-to-change-the-size-of-the-filesystem-cache.md) -Explains how you can change the size of the cache. - -[How to Use the Cache Space Management Feature](how-to-use-the-cache-space-management-feature.md) -Describes how you can configure the cache space management feature. - -[How to Configure the Client Log File](how-to-configure-the-client-log-file.md) -Describes the various registry key values that control the client log file and how you can change them. - -[How to Configure User Permissions](how-to-configure-user-permissions.md) -Identifies the registry key that controls the user permissions and gives examples of how you can change some permissions. - -[How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md) -Explains how to configure the client to retrieve package content, icons, and file type associations from different sources, and provides several examples of the correct path format. - -[How to Configure the Client for Disconnected Operation Mode](how-to-configure-the-client-for-disconnected-operation-mode.md) -Provides information about how to configure the various settings associated with disconnected operations mode. - -[How to Configure Shortcut and File Type Association Behavior](how-to-configure-shortcut-and-file-type-association-behavior-46-only.md) -Describes the registry key values that control shortcuts and file type associations in the App-V client, and provides details on how to configure them. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md b/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md deleted file mode 100644 index 615d3a60b6..0000000000 --- a/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Configure the App-V Sequencer -description: How to Configure the App-V Sequencer -author: dansimp -ms.assetid: 0f43f618-80b0-4715-af17-90f5c673d838 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the App-V Sequencer - - -The topics in this section provide detailed information about the associated Application Virtualization (App-V) Sequencer configuration tasks. - -## In This Section - - -[How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md) -Provides a step-by-step procedure you can use to modify the location of the log directory. - -[How to Create the Sequencer Package Root Directory](how-to-create-the-sequencer-package-root-directory.md) -Provides a step-by-step procedure you can use to create the package root directory. - -[How to Modify the Scratch Directory Location](how-to-modify-the-scratch-directory-location.md) -Provides a step-by-step procedure you can use to modify the location of scratch directory. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md b/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md deleted file mode 100644 index 85ccb5fd59..0000000000 --- a/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: How to Configure the App-V System for Package Upgrade -description: How to Configure the App-V System for Package Upgrade -author: dansimp -ms.assetid: de133898-f887-46c1-9bc9-fbb03feac66a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the App-V System for Package Upgrade - - -When you deploy a new version of an existing application package that has been upgraded in the App-V Sequencer, you can deploy it so that the App-V clients automatically stream the new version to the local cache. Depending on the streaming solution you use, there are different procedures for configuring the package upgrade. The following sections describe the most typical scenarios for publishing and streaming, and include the procedures necessary for configuring the package upgrade for each scenario. - -## Using a Management Server for both publishing and streaming - - -In this scenario, a single App-V Management Server is used for both publishing and streaming of packages and applications, and the RTSP(S) protocol is required. When the original package is imported to the App-V Management Server, the administrator copies the package folder that contains the files created by the sequencer to the CONTENT folder, for example, to \\\\server\\CONTENT\\packagename. The administrator also edits the HREF entry in the OSD file to point to the SFT file in the package folder, and then imports the package to the server. - -When a user is authenticated by the Management Server, the server publishes the user’s applications by sending the applist.xml file to the client. The client then retrieves the OSD files and icons for the applications from the Management Server. When the user double-clicks an application icon, the application content is streamed to the client cache from the path that is specified in the OSD file, and the application is started. - -### To upgrade the package - -To add a new version of an application that has been upgraded in the App-V Sequencer, the administrator must copy the new SFT file and any other modified files to the same folder as the original version of the application. The administrator will then use **Add Version** in the server management console to add the new version of the package. - -When the user next starts the application, the server streams the new version to the client automatically. This specific method of upgrading a package was formerly known as an active upgrade. - -## Using a Management Server for publishing and a Streaming Server for streaming - - -In this scenario, the App-V Management Server is used for publishing the packages, and the Streaming Server is used for streaming packages and applications. The RTSP(S) protocol is required. When the original package is imported to the Management Server, the administrator copies the package folder that contains the files created by the sequencer to the CONTENT folder, for example, to \\\\server\\CONTENT\\packagename. The administrator edits the HREF entry in the OSD file to point to the SFT file on the Streaming Server, and then imports the package to the Management Server. - -To set up the Streaming Server, the administrator copies the package folder from the Management Server to the CONTENT folder on the Streaming Server. This folder must have the same name and relative path under the Streaming Server’s CONTENT folder as on the Management Server, for example, \\\\streamingserver\\CONTENT\\packagename. - -If the client’s Application Source Root (ASR) setting is configured to point to the Streaming Server, the client uses this setting instead of the server name in the HREF entry in the OSD file. The ISR and OSR fields on the client can optionally be configured to point to either the Management Server or the Streaming Server, depending on the specific system architecture that is used. - -When a user is authenticated by the Management Server, the server publishes the user’s applications by sending the applist.xml file to the client. The client retrieves the OSD files and icons for the applications from either the Streaming Server or the Management Server, depending on the settings in the OSR and ISR fields. - -When the user double-clicks an application icon, the client uses the path to the package content file (SFT) that is contained in the OSD file HREF element. If the ASR is used the client replaces the server name (and port and protocol, if used) in the HREF element with the path to the Streaming Server that is specified in the ASR. The application is then streamed from the Streaming Server to the client cache and is started. - -### To upgrade the package - -To add a new version of an application that has been upgraded in the App-V Sequencer, the administrator must copy the new version of the SFT file and any other modified files to the same folder as the original version of the application on the Streaming Server. - -For consistency, we recommend that you copy new files to the folder on the Management Server as well. In particular, if you use the client’s OSR or ISR fields, copy the updated OSD file and icons to the server that is specified in the OSR and ISR fields. - -After the Streaming Server detects the new version, the next time the user starts the application, the server streams the new version to the client automatically. - -## Using a Management Server for publishing and an IIS Server for streaming - - -In this scenario, the App-V Management Server is used for publishing the packages, and the IIS server is used for streaming packages and applications. When the original package is imported to the Management Server, the administrator copies the package folder that contains the files created by the sequencer to the CONTENT folder, for example, to \\\\server\\CONTENT\\packagename. The administrator edits the HREF entry in the OSD file so it points to the SFT file on the IIS server, and then imports the package to the Management Server. - -To set up the IIS server for streaming, the administrator copies the package folder from the Management Server to the CONTENT folder on the IIS Server. This folder must have the same name and relative path under the IIS server’s Web Content folder as on the Management Server; for example, the URL on the IIS Server can be accessed by using http://IISserver/CONTENT/packagename or https://IISserver/CONTENT/packagename. - -If the client’s Application Source Root (ASR) setting is configured to point to the IIS Server, the client uses the ASR instead of the server name in the HREF entry in the OSD file. You can optionally configure the ISR and OSR fields on the client to point to either the Management Server or the IIS Server, depending on the specific system architecture that you use. - -When the Management Server authenticates the user, the server publishes the user’s applications by sending the applist.xml file to the client. The client retrieves the OSD files and icons for the applications from either the IIS Server or the Management Server, depending on the settings in the ISR and OSR fields. - -When the user double-clicks an application icon, the client uses the path to the package content file (SFT) that is contained in the OSD file HREF element. If the ASR is used the client replaces the server name (and port and protocol, if used) in the HREF element with the path to the IIS Server that is specified in the ASR. The application is then streamed from the IIS server to the client cache by using the HTTP(S) protocol and is started. - -### To upgrade the package - -The procedure to upgrade the package is as follows: - -- Copy the new version of the OSD file to the original version’s folder under the Management Server’s CONTENT folder, for example \\\\server\\CONTENT\\packagename, and replace the existing OSD file. For consistency, copy any other modified files, too. If the client’s OSR or ISR fields are used, then also copy the updated OSD file and icons to the server that is specified in the OSR and ISR fields. - -- Copy the new version of the SFT file to the package folder under the Web Content folder on the IIS server; for example, the URL on the IIS Server can be accessed by using http://IISserver/CONTENT/packagename or https://IISserver/CONTENT/packagename. - -At the next publishing refresh, the client is updated with the new version of the OSD file. This file now points to the new version of the SFT file; therefore, when the user next double-clicks an application icon, the new version is started. - -## Using a Management Server for publishing and a File Share for Streaming - - -In this scenario, the App-V Management Server is used for publishing the packages, and the file server is used for streaming packages and applications. When the original package is imported to the Management Server, the administrator copies the package folder that contains the files created by the sequencer to the CONTENT folder, for example, to \\\\server\\CONTENT\\packagename. The administrator edits the HREF entry in the OSD file so that it points to the SFT file on the file server, and imports the package to the Management Server. - -To set up the file server for streaming, the administrator copies the package folder from the Management Server to the CONTENT folder on the file server. This folder must have the same name and relative path under the file server’s CONTENT folder as on the Management Server, for example \\\\fileserver\\CONTENT\\packagename. - -If the client’s Application Source Root (ASR) setting is configured to point to the file server by using a UNC path, for example \\\\fileserver\\content, the client uses this setting instead of the server name in the HREF entry in the OSD file. The administrator can optionally configure the ISR and OSR fields on the client to point to either the Management Server or the file server, depending on the specific system architecture being used. - -When the Management Server authenticates the user, the server publishes the user’s applications by sending the applist.xml file to the client. The client retrieves the OSD files and icons for the applications from either the file server or the Management Server, depending on the settings in the ISR and OSR fields. - -When the user double-clicks an application icon, the client uses the path to the package content file (SFT) that is contained in the OSD file HREF element. If the ASR is used, the client replaces the server name (and port and protocol, if used) in the HREF element with the path to the file server that is specified in the ASR. The application is then streamed from the file server to the client cache and is started. - -### To upgrade the package - -The procedure to upgrade the package is as follows: - -- Copy the new version of the OSD file to the original version’s folder under the Management Server’s CONTENT folder, for example \\\\server\\CONTENT\\packagename, replacing the existing OSD file. Any other modified files should be copied as well for consistency. If the client’s OSR or ISR fields are used, then also copy the updated OSD file and icons to the server that is specified in the OSR and ISR fields. - -- Copy the new version of the SFT file to the package folder under the CONTENT folder on the file server, for example \\\\fileserver\\CONTENT\\packagename. Copy the V2 SFT file to the folder under the CONTENT share on the file server, for example \\\\fileserver\\CONTENT\\packagename\\V1. - -At the next publishing refresh the client is updated with the new version of the OSD file. This file now points to new version of the SFT file, so when the user next double-clicks an application icon, the new version is started. - -## Upgrading the package by using MSI Streaming mode - - -When you generate a Windows Installer (MSI) file during sequencing a package, the sequencer creates a .MSI file that contains all the necessary publishing information. The administrator must copy the .MSI file to the client and the .SFT file containing the package content to a network share accessible by the client computer. - -To publish the application to the client, run the following command on the client computer: - -   **Msiexec.exe /i \\\\PathToMsi\\packagename.msi MODE=STREAMING OVERRIDEURL=\\\\\\\\server\\share\\package.sft** - -The .MSI file publishes the applications to the client and then streams the .SFT file to the client cache. - -### To upgrade the package - -To add a new version, an administrator must deploy a new .MSI file to the client and a new .SFT file to the network share. The administrator must then run the same command used to deploy the package, but use the new .MSI file and the new .SFT file, for example: - -   **Msiexec.exe /i \\\\PathToMsi\\packagename\_2.msi MODE=STREAMING OVERRIDEURL=\\\\\\\\server\\share\\package\_2.sft** - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md deleted file mode 100644 index 5dab5d7b35..0000000000 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: How to Configure the Application Virtualization Client Settings Manually -description: How to Configure the Application Virtualization Client Settings Manually -author: dansimp -ms.assetid: 53bd21d8-49eb-4c77-9692-c093ffe4c17c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Application Virtualization Client Settings Manually - - -This section contains procedures that administrators can use to configure the Application Virtualization (App-V) Desktop Client and the Application Virtualization (App-V) Client for Remote Desktop Services (formerly Terminal Services) and to manage applications by using the App-V Client Management Console. - -## In This Section - - -[How to Perform General Administrative Tasks in the App-V Client Management Console](how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md) -Provides procedures that you can use to set up the Publishing Server and to refresh applications. - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) -Provides procedures that you can use to configure App-V Desktop Client and the App-V Client for Remote Desktop Services. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md deleted file mode 100644 index 8225fe37da..0000000000 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Configure the Application Virtualization Management Servers -description: How to Configure the Application Virtualization Management Servers -author: dansimp -ms.assetid: a9f96148-bf2d-486f-98c2-23409bfb0935 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Application Virtualization Management Servers - - -Before virtualized applications can be streamed to the Application Virtualization Desktop Client or the Client for Remote Desktop Services (formerly Terminal Services), the Application Virtualization Management Server must be configured. When you configure the server, you are setting up the *content directory* where the SFT files are loaded and stored. The SFT files contain the virtualized application (or applications). - -**Important**   -Application Virtualization Servers stream SFT files to the Desktop Client and the Client for Remote Desktop Services using only RTSP or RTSPS protocols. The ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different file or HTTP server. - - - -**To configure the Application Virtualization Management Server** - -1. Complete the following procedure: - - [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) - - **Note**   - During the installation procedure, you specify the location of the \\Content directory on the **Content Path** screen. - - - -2. Navigate to the location that you specified for the \\Content directory, and if necessary, create the directory. - -3. When the content directory is created, configure this directory as a standard file share. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Application Virtualization System Requirements](application-virtualization-system-requirements.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md deleted file mode 100644 index 8671c8e401..0000000000 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Configure the Application Virtualization Streaming Servers -description: How to Configure the Application Virtualization Streaming Servers -author: dansimp -ms.assetid: 3e2dde35-9d72-40ba-9fdf-d0338bd4d561 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Application Virtualization Streaming Servers - - -Before virtual applications can be streamed to the Application Virtualization Desktop Client or the Client for Remote Desktop Services (formerly Terminal Services), the Application Virtualization Streaming Servers must be configured. When you configure the servers, you are setting up the *content directory* where the SFT files are loaded and stored. The SFT files contain the virtual application (or applications). - -**Important**   -Application Virtualization Servers stream SFT files to the Desktop Client and the Client for Remote Desktop Services using only RTSP or RTSPS protocols. The ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different file or HTTP server. - - - -**To configure the Application Virtualization Streaming Servers** - -1. Complete the installation procedure for the Application Virtualization Streaming Server. During the installation procedure, you specify the location of the \\Content directory on the **Content Path** screen. - -2. Navigate to the location that you specified for the \\Content directory, and if you have to, create the directory. - -3. When the Content directory is created, configure this directory as a standard file share. - -4. Configure the NTFS file system permissions to the Content directory and the package folders under the Content directory. You should use Security Groups in Active Directory Domain Services that define which users can access each application. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) - -[How to Configure the File Server](how-to-configure-the-file-server.md) - -[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md b/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md deleted file mode 100644 index 04f4c05542..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md +++ /dev/null @@ -1,169 +0,0 @@ ---- -title: How to Configure the Client for Application Package Retrieval -description: How to Configure the Client for Application Package Retrieval -author: dansimp -ms.assetid: 891f2739-da7a-46da-b452-b8c0af075525 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client for Application Package Retrieval - - -When the client is configured with an Application Virtualization (App-V) Management Server as its publishing server, by default at the next publishing refresh cycle, the client retrieves from the server the Open Software Descriptor (OSD) and package manifest files for each package that the user is authorized to use. The client uses the package source information that is defined in these files to determine where to find the package content, icons, and file type associations. - -If you want the client to obtain the package content (SFT file) from a local App-V Streaming Server or other alternate source such as a Web server or file server, instead of from the App-V Management Server, you can configure the ApplicationSourceRoot registry key value on the computer to point to the local content share on the other server. The OSD file still defines the original source path for the package content. However the client uses the value of the ApplicationSourceRoot setting in place of the server and share that are specified in the content path in the OSD file. This redirects the client to retrieve the content from the other server. - -You can also configure the OSDSourceRoot and IconSourceRoot registry key values if you want to override those settings in the package manifest file or in the paths sent by a publishing server. The OSDSourceRoot specifies a source location for OSD file retrieval for an application package during publication. The IconSourceRoot specifies a source location for icon retrieval for an application package during publication. - -**Note** -- The IconSourceRoot and OSDSourceRoot settings override the values in the package manifest file, so if you try to deploy a package by using the Windows Installer (.msi) file method, it will also override the values in the package manifest file that is contained within that .msi file. - -- During both the publishing and HTTP(S) streaming operations,App-V 4.5 SP1 clients use the proxy server settings that are configured in Internet Explorer on the user’s computer. - - - -**To configure the ApplicationSourceRoot registry key value** - -- Configure the ApplicationSourceRoot in the following registry key value with either a UNC path or a URL: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\ApplicationSourceRoot - - The correct format for the Universal Naming Convention (UNC) path is **\\\\computername\\sharefolder\\\[folder\]\[\\\]**, where **folder** is optional. The **computername** can be a Fully Qualified Domain Name (FQDN) or an IP address, and **sharefolder** can be a drive letter. Only the **\\\\computername\\sharedfolder** or drive letter portion of the OSD path is replaced. - - The correct format for the URL path is **protocol://servername:\[port\]\[/path\]\[/\]**, where **port** and **path** are optional. If **port** is not specified, the default port for the protocol is used. Only the **protocol://server:port** portion of the OSD URL is replaced. - - **Important** - Environment variables are not supported in the ApplicationSourceRoot definition. - - - -~~~ -The following table lists examples of acceptable URL and UNC path formats. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ApplicationSourceRootOSD File HREF PathResultComments

    rtsps://mainserver:322

    rtsp://appserver/productivity/office2k3.sft?customer=seq

    rtsps://mainserver:322/productivity/office2k3.sft?customer=seq

    rtsps://mainserver:322/prodapps

    rtsp://appserver/productivity/office2k3.sft?customer=seq

    rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq

    https://mainserver:443/prodapps

    rtsp://appserver/productivity/office2k3.sft?customer=seq

    https://mainserver:443/prodapps/productivity/office2k3.sft?customer=seq

    rtsps://mainserver:322/prodapps

    rtsp://%SFT_APPVSERVER%:554/productivity/office2k3.sft?customer=seq

    rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq

    rtsps://mainserver:322

    \\uncserver\share\productivity\office2k3.sft

    rtsps://mainserver:322/productivity/office2k3.sft

    ‘\’ converted to ‘/’

    rtsps://mainserver:322

    file://\\uncserver\share\productivity\office2k3.sft

    rtsps://mainserver:322/productivity/office2k3.sft

    ‘\’ converted to ‘/’

    \\uncserver\share

    rtsp://appserver/productivity/office2k3.sft?customer=seq

    \\uncserver\share\productivity\office2k3.sft

    ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path

    \\uncserver\share\prodapps

    rtsp://appserver/productivity/office2k3.sft?customer=seq

    \\uncserver\share\prodapps\productivity\office2k3.sft

    ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path

    M:

    \\uncserver\share\productivity\office2k3.sft

    M:\productivity\office2k3.sft

    M:\prodapps

    \\uncserver\share\productivity\office2k3.sft

    M:\prodapps\productivity\office2k3.sft

    -~~~ - - - -**To configure the OSDSourceRoot value** - -- Configure the OSDSourceRoot in the following registry key value with either a UNC path or a URL: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\OSDSourceRoot - - Acceptable formats for the OSDSourceRoot include UNC paths and URLs, as in the following example: - - **\\\\computername\\sharefolder\\resource** or **\\\\computername\\content** or **<drive>:\\foldername** - - **http://computername/productivity/** or **https://computername/productivity/** - -**To configure the IconSourceRoot value** - -- Configure the IconSourceRoot in the following registry key value with either a UNC path or a URL: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\IconSourceRoot - - Acceptable formats for the IconSourceRoot include UNC paths and URLs, as in the following example: - - **\\\\computername\\sharefolder\\resource** or **\\\\computername\\content** or **<drive>:\\foldername** - - **http://computername/productivity/** or **https://computername/productivity/** - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md b/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md deleted file mode 100644 index fe5c5331d3..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to Configure the Client for Disconnected Operation Mode -description: How to Configure the Client for Disconnected Operation Mode -author: dansimp -ms.assetid: 3b48464a-b8b4-494b-93e3-9a6d9bd74652 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client for Disconnected Operation Mode - - -The disconnected operation mode enables the Application Virtualization (App-V) Desktop Client or the Application Virtualization (App-V) Client for Remote Desktop Services (formerly Terminal Services) to run applications that are stored in the file system cache of the client when the client cannot connect to the App-V Management Server. - -**Important**   -In a large organization where multiple Remote Desktop Session Host (RD°Session Host) servers (formerly Terminal Servers) are linked in a farm to support many users, using a single App-V Management Server to support the farm represents a single point of failure. To provide high availability to support the RD Session Host farm, consider linking two or more App-V Management Servers to use the same database. - - - -**To enable disconnected operation mode** - -- Set the following registry key value equal to 1 to enable disconnected operation mode: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\AllowDisconnectedOperation - -**To set a time limit on disconnected operation mode use** - -1. Set the following registry key value to 1: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\LimitDisconnectedOperation - -2. Set the following registry key value to the number of minutes you want to limit disconnected operation mode. The valid range of values is 1–999999. The default value is 90 days or 129,600 minutes. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\DOTimeoutMinutes - -**To configure the Client for Remote Desktop Services for disconnected operation mode** - -1. Set the following registry key value to 1 to enable disconnected operation mode: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\AllowDisconnectedOperation - -2. Set the following registry key value to 0 (zero) to allow unlimited use of disconnected operation mode: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\LimitDisconnectedOperation - -3. Ensure that all packages are preloaded into the cache to improve performance. - -## Related topics - - -[Disconnected Operation Mode](disconnected-operation-mode.md) - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md b/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md deleted file mode 100644 index ee1c92f759..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: How to Configure the Client for MIT Kerberos Realm Support -description: How to Configure the Client for MIT Kerberos Realm Support -author: dansimp -ms.assetid: 46102f4c-270c-4115-8eb4-7ff5ae3be32d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client for MIT Kerberos Realm Support - - -In Application Virtualization (App-V) 4.5 SP1, support was added for MIT Kerberos realms. This topic provides detailed information on how to enable that support. - -**To enable support for MIT Kerberos Realms** - -- Create a new registry key named **UseMitKerberos** of type DWORD, as follows, and then set it to a value of 1. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\UseMitKerberos - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md b/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md deleted file mode 100644 index 951cbbb2d7..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Configure the Client in the Application Virtualization Client Management Console -description: How to Configure the Client in the Application Virtualization Client Management Console -author: dansimp -ms.assetid: d0868c9f-8fe9-442f-a9ad-ef30efb0f6b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client in the Application Virtualization Client Management Console - - -You can use the Application Virtualization Client Management Console to configure the Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services). - -## In This Section - - -[How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) -Provides procedures you can use to change the cache size and the drive designation letter that represents the virtual drive. - -[How to Change the Log Reporting Levels and Reset the Log Files](how-to-change-the-log-reporting-levels-and-reset-the-log-files.md) -Provides procedures you can use to change the log reporting levels and to reset the log files. - -[How to Change User Access Permissions](how-to-change-user-access-permissions.md) -Provides a procedure you can use to change the user access permissions. - -[How to Change Import Search Paths](how-to-change-import-search-paths.md) -Provides a procedure you can use to set up client import search paths. - -[How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) -Provides a procedure you can use to establish a schedule for Application Virtualization Server refresh. - -[How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) -Provides a procedure you can use to force Application Virtualization Server refresh on system login. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-client-log-file.md b/mdop/appv-v4/how-to-configure-the-client-log-file.md deleted file mode 100644 index e4a46cd129..0000000000 --- a/mdop/appv-v4/how-to-configure-the-client-log-file.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: How to Configure the Client Log File -description: How to Configure the Client Log File -author: dansimp -ms.assetid: dd79f8ce-61e2-4dc8-af03-2a353554a1b2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client Log File - - -You can use the following procedures to configure the Application Virtualization (App-V) Client log file. - -**To change the log file location** - -- Edit the following registry key value to specify the new path for the log file. You must restart the **sftlist** service after changing this value. This location can also be changed interactively after installation. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\LogFileName - -**To change the log reporting level** - -- By default, the type of messages that are written to the log include all events of severity level 4 (Informational) or higher. The severity level is stored in the following key value. Set this key value to 5 to enable verbose logging. Use verbose logging only for short periods during troubleshooting because it will generate a very large volume of messages and cause the log to fill up quickly. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\LogMinSeverity - -**To change the log size** - -- In Application Virtualization (App-V) 4.5, the log size is controlled by the following registry key value. This value defaults to 256 MB and defines the maximum size, in MB, that the log can grow to before being reset. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\LogMaxSize - - **Caution**   - This registry key value must be set to a value greater than zero to ensure the log file does get reset. - - - -**To change the number of backup copies** - -- When the log file reaches the maximum size, a reset is forced when the next write to the log occurs. A reset causes a new log file to be created, and the old file is renamed as a backup. The following registry setting controls the number of backup copies of the log file that are kept when the file is reset. The default value is 4. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\\LogRolloverCount - - The format of the backup log file names is: **sftlog\_YYYYMMDD\_hhmmss-uuu.txt** and is based on the reset time, in Universal Coordinated Time (UTC). The following table lists the symbols used in creating the file names and their descriptions. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SymbolDescription

    YYYY

    4-digit year

    MM

    2-digit month (01–12)

    DD

    2-digit day of the month (01–31)

    hh

    hour (00–23)

    mm

    minutes (00–59)

    ss

    seconds (00–59)

    uuu

    milliseconds (000–999)

    - - - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-file-server.md b/mdop/appv-v4/how-to-configure-the-file-server.md deleted file mode 100644 index c9d01b4dba..0000000000 --- a/mdop/appv-v4/how-to-configure-the-file-server.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to Configure the File Server -description: How to Configure the File Server -author: dansimp -ms.assetid: 0977554c-1741-411b-85e7-7e1cd017542f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the File Server - - -You can use the following procedure to configure a local computer that is used as a file share and streams applications to the Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services). This scenario is used when you do not want to add an additional server infrastructure to your existing hardware environment. - -If you are using an Application Virtualization Management Server as a distribution point to the file share installed in local offices, you must configure this server before virtual applications can be streamed to the computers that are used as file shares. When you configure the servers and the file shares, you are setting up the content directory where the SFT files are loaded and stored. The SFT files contain the virtual application (or applications). - -**Important**   -For applications to stream properly to the Application Virtualization Desktop Client and the Client for Remote Desktop Services, the SFT file streams from the content directory on the server where you store the virtual application; the ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different server. - - - -**To configure the Application Virtualization file server** - -1. Complete the following installation procedure to configure the server that is used as the distribution point: - - [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) - - **Note**   - During the installation procedure, you specify the location of the \\Content directory on the **Content Path** screen. - - - -2. Create a \\Content directory, which corresponds to the directory you specified when you installed the server, on each computer that you are using as a file share. - - **Important**   - Configure the Application Virtualization Desktop Clients to stream applications from the computer you are using as a file share rather than from an Application Virtualization Server or IIS server. - - - -3. When the \\Content directory is created, configure this directory as a standard file share. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) - -[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) - -[How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-server-for-iis.md b/mdop/appv-v4/how-to-configure-the-server-for-iis.md deleted file mode 100644 index 4290cc9bf5..0000000000 --- a/mdop/appv-v4/how-to-configure-the-server-for-iis.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Configure the Server for IIS -description: How to Configure the Server for IIS -author: dansimp -ms.assetid: 1fcfc583-322f-4a38-90d0-e64bfa9ee3d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Server for IIS - - -Before virtual applications can be streamed to the Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services), the IIS servers must be configured. When you configure the servers, you are setting up the content directory where the SFT files are loaded and stored. The SFT files contain the virtual application (or applications). - -**To configure the content directory on the IIS server** - -1. On the server that is running IIS, locate the directory that you want to use as the content directory, or create the directory if it does not exist. Configure this directory as a standard file share. - -2. On the server that is running IIS, open **IIS Manager**, and under the default website, create a virtual directory that corresponds to the content directory that you created on the server. Make sure that **Read** is checked. - -3. Give the newly created virtual directory the alias **Content**. - -4. Accept all other default settings for this virtual directory. - -5. Configure the NTFS file system permissions to the content directory and the package folders under the content directory by using the Security Groups in Active Directory Domain Services that you defined earlier. - -**Note**   -If you are using IIS to publish the ICO and OSD files, you must configure a MIME type for OSD=TXT; otherwise, IIS will not serve the ICO and OSD files to clients. If you are using IIS to publish packages (SFT files), you must configure a MIME type for SFT=Binary; otherwise, IIS will not serve the SFT files to clients. - - - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md) - -[How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md) - -[How to Configure the File Server](how-to-configure-the-file-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md b/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md deleted file mode 100644 index fec2c858fe..0000000000 --- a/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: How to Configure the Server to be Trusted for Delegation -description: How to Configure the Server to be Trusted for Delegation -author: dansimp -ms.assetid: d8d11588-17c0-4bcb-a7e6-86b5e4ba7e1c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Server to be Trusted for Delegation - - -When you install the Microsoft Application Virtualization (App-V) Management Server software, you can choose to install it by using a distributed system architecture. If you install the console, the Management Web Service, and the database on different computers, you must configure the Internet Information Services (IIS) server to be trusted for delegation. This is necessary because the Management Web Service will attempt to connect to the App-V data store by using the credentials of the App-V administrator who is using the console. The database server on which the data store is installed will not accept the administrator’s credentials from the IIS server unless the IIS server is configured to be trusted for delegation, and so the Management Web Service will not be able to connect to the App-V data store. - -**Note**   -If you install the App-V Management Server software on a single server and place the data store on a separate server, there is one situation in which you must still configure the server to be trusted for delegation even though the Management Web Service and Management Console are on the same server. This situation occurs if you need to connect to the Management Web Service in the console by using the **Use Alternate Credentials** option. - - - -The type of delegation that you can use depends on the Domain Functional Level that you have configured in your Active Directory Domain Services (AD DS) infrastructure. The following table lists the types of delegation that can be configured for each Domain Functional Level for App-V. Detailed instructions follow the table. - - ---- - - - - - - - - - - - - - - - - -
    Domain Functional LevelDelegation Levels Available

    Windows 2000 native

      -
    • No delegation (default)

    • -
    • Unconstrained delegation

    • -

    Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2

      -
    • No delegation (default)

    • -
    • Unconstrained delegation¹

    • -
    • Constrained delegation (Use Kerberos Only Protocols)

    • -
    • Constrained delegation (Use any authentication protocol) ¹

    • -
    - - - -¹ Not recommended. - -## To configure unconstrained delegation when the Domain Functional Level is Windows 2000 native - - -On the domain controller for your Web server’s domain, complete the following steps. - -**** - -1. Click **Start**, **Administrative Tools**, and then click **Active Directory Users and Computers**. - -2. Expand domain, and then expand the Computers folder. - -3. In the right pane, right-click the computer name for the Web server, and then click **Properties**. - -4. On the **General** tab, ensure that the **Trust computer for delegation** check box is selected. - -5. Click **OK**. - -## To configure unconstrained delegation when the Domain Functional Level is Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 - - -On the domain controller for your Web server’s domain, complete the following steps. - -**** - -1. Click **Start**, click **Administrative Tools**, and then click **Active Directory Users and Computers**. - -2. Expand domain, and expand the Computers folder. - -3. In the right pane, right-click the computer name for the Web server, select **Properties**, and then click the **Delegation** tab. - -4. Click to select **Trust this computer for delegation to any service (Kerberos only)**. - -5. Click **OK**. - -## To configure constrained delegation when the Domain Functional Level is Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 - - -On the domain controller for your Web server’s domain, complete the following steps. - -**** - -1. Click **Start**, click **Administrative Tools**, and then click **Active Directory Users and Computers**. - -2. Expand domain, and then expand the Computers folder. - -3. In the right pane, right-click the computer name for the Web server, select **Properties**, and then click the **Delegation** tab. - -4. Click to select **Trust this computer for delegation to specified services only**. - -5. Ensure that **Use Kerberos only** is selected, and then click **OK**. - -6. Click the **Add** button. In the **Add Services** dialog box, click **Users or Computers**, and then browse to or type the name of the Microsoft SQL server that has the App-V data store and is to receive the users credentials from IIS. Click **OK**. - -7. In the **Available Services** list, select the MSSQLSvc service that lists port number on which the Microsoft SQL Server is accepting connections for the App-V database (the default port is 1433). Click **OK**. - -### Additional steps to configure IIS 7 for constrained delegation - -If you are running the Management Web Service on an IIS 7 server, you must complete the following steps to set the IIS 7 *useAppPoolCredentials* variable to True. - -1. Open an elevated Command Prompt window. To open an elevated Command Prompt window, click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as administrator**. - -2. Navigate to %windir%\\system32\\inetsrv. - -3. Type **appcmd.exe set config -section:system.webServer/security/authentication/windowsAuthentication -useAppPoolCredentials:true**, and then press ENTER. - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-user-permissions.md b/mdop/appv-v4/how-to-configure-user-permissions.md deleted file mode 100644 index 88e1049577..0000000000 --- a/mdop/appv-v4/how-to-configure-user-permissions.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Configure User Permissions -description: How to Configure User Permissions -author: dansimp -ms.assetid: 54e69f46-b028-4ad1-9b80-f06ef5c8f559 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure User Permissions - - -You can enable and disable some actions for users who do not have administrative rights by editing the key values under the **Permissions** registry key (HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions). This key is primarily designed to help prevent users from making mistakes rather than to provide any special security, because users with administrative rights can edit any of these key values. The following procedures are examples of how to change the key values. For more information about the Application Virtualization (App-V) Client registry keys and values, see . - -**To change user permissions** - -1. To enable the users to choose to run the client in offline mode, set the following key value to 1: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions\\ToggleOfflineMode - -2. To enable the users to view all applications through the user interface, set the following key value to 1. Setting the value to 0 (zero) allows the users to see only the applications that are available to them. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions\\ViewAllApplications - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md b/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md deleted file mode 100644 index 3ec2889648..0000000000 --- a/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Configure Windows Server 2003 Firewall for App-V -description: How to Configure Windows Server 2003 Firewall for App-V -author: dansimp -ms.assetid: 2c0e80f8-41e9-4164-ac83-b23b132b489a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Windows Server 2003 Firewall for App-V - - -Use the following procedure to configure the Windows Server 2003 firewall for App-V. - -**To configure Windows Server 2003 firewall for App-V** - -1. In **Control Panel**, open the **Windows Firewall**. - - **Note**   - If the server has not been configured to run the firewall service before this step, you will be prompted to start the firewall service. - - - -2. If ICO and OSD files are published through SMB, ensure that **File and Printer Sharing** is enabled on the **Exceptions** tab. - - **Note**   - If ICO and OSD files are published through HTTP/HTTPS on the Management Server, you might need to add an exception for HTTP or HTTPS. If the IIS server hosting the ICO and OSD files is hosted on a computer separate from the Management Server, you need to add the exception to that computer. To maximize performance, it is recommended that you host the ICO and OSD files on a separate server from the Management Server. - - - -3. Add a program exception for `sghwdsptr.exe`, which is the Management Server service executable. The default path to this executable is `%ProgramFiles%\Microsoft System Center App Virt Management Server\App Virt Management Server\bin`. - - **Note**   - If the Management Server uses RTSP for communication, you must also add a program exception for `sghwsvr.exe`. - - The App-V Streaming Server requires a program exception `sglwdsptr.exe` for RTSPS communication. The App-V Streaming Server that uses RTSP for communication also requires a program exception for `sglwsvr.exe`. - - - -4. Ensure that the proper scope is configured for each exception. To reduce risk, remove any computer and strictly limit the IP addresses to which the server will respond. - -## Related topics - - -[How to Configure Windows Server 2008 Firewall for App-V](how-to-configure-windows-server-2008-firewall-for-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md b/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md deleted file mode 100644 index 7e516a89fd..0000000000 --- a/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Configure Windows Server 2008 Firewall for App-V -description: How to Configure Windows Server 2008 Firewall for App-V -author: dansimp -ms.assetid: 57f4ed17-0651-4a3c-be1e-29d9520c6aeb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure Windows Server 2008 Firewall for App-V - - -With the introduction of Windows Server 2008, the firewall and IPsec components were merged into one service, and the capabilities of this service were enhanced. The new firewall service supports incoming and outgoing stateful inspection. Also, you can configure specific firewall rules and IPsec policies through group policies. For additional information about the Windows firewall in Windows Server 2008, see . - -The following procedure does not include adding an exception for ICO and OSD publishing through SMB or HTTP/HTTPS. Those exceptions are automatically added based on the network profile and roles installed on the Windows Server 2008 firewall. - -**Note**   -If the Management Server is configured to use RTSP, repeat this procedure to add the `sghwsvr.exe` program as an exception. - -The App-V Streaming Server requires the program exception `sglwdsptr.exe` for RTSPS communication. An App-V Streaming Server that uses RTSP for communication also requires a program exception for `sglwsvr.exe`. - - - -**To configure Windows Server 2008 firewall for App-V** - -1. Open the **Windows Firewall with Advanced Security** management console through the Control Panel or by typing `wf.msc` on the Run line. - -2. Create a new inbound rule, and select **Program**. - -3. Select the program path, and browse to `sghwdsptr.exe`, which is located by default at `%ProgramFiles%\Microsoft System Center App Virt Management Server\App Virt Management Server\bin`. - -4. Click **Next**. - -5. On the **Action** page, select **Allow the connection**, and then click **Next**. - -6. Select the appropriate **Profiles** to apply to the inbound rule. - -7. Provide a name and description for the rule, and click **Finish**. - -## Related topics - - -[How to Configure Windows Server 2003 Firewall for App-V](how-to-configure-windows-server-2003-firewall-for-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md b/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md deleted file mode 100644 index 8368dd56f8..0000000000 --- a/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Configure Windows Server 2008 for App-V Management Servers -description: How to Configure Windows Server 2008 for App-V Management Servers -author: dansimp -ms.assetid: 38b4016f-de82-4209-9159-387d20ddee25 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Windows Server 2008 for App-V Management Servers - - -The Windows Server 2008 server on which you install the Microsoft Application Virtualization (App-V) Management Web Service requires Internet Information Services (IIS) to be installed as a role on the server. Use the following procedure to configure Windows Server 2008 to support App-V server installation. - -**To install IIS on a Windows Server 2008 computer** - -1. On the Windows Server 2008 computer, click **Start**, click **All Programs**, click **Administrative Tools**, and then click **Server Manager** to start Server Manager. In Server Manager, right-click the **Roles** node, and click **Add Roles** to start the **Add Roles Wizard**. - -2. In the **Add Roles Wizard**, on the **Select Server Roles** page, select **Web Server (IIS)**. When prompted, click **Add Required Features** to add the dependent features. - -3. On the **Select Server Roles** page, Click **Next**, and then click **Next** again. - -4. In the **Add Roles Wizard**, on the **Select Role Services** page: - - 1. Under **Application Development**, select **ASP.NET** and, when prompted, click **Add Required Role Services** to add the dependent roles services and features. - - 2. Under **Security**, select **Windows Authentication**. - - 3. In the **Management Tools** node, select **IIS Management Scripts and Tools**. Under **IIS 6 Management Compatibility**, ensure that both **IIS 6 Metabase Compatibility** and **IIS 6 WMI Compatibility** are selected, and then click **Next**. - -5. On the **Confirm Installation Selections** page, click **Install**, and then complete the rest of the wizard. - -6. Click **Close** to exit the **Add Roles Wizard**, and then close Server Manager. - -## Related topics - - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) - -[Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md b/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md deleted file mode 100644 index 169761167e..0000000000 --- a/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How to Connect to an Application Virtualization System -description: How to Connect to an Application Virtualization System -author: dansimp -ms.assetid: ac38216c-5464-4c0b-a4d3-3949ba6358ac -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Connect to an Application Virtualization System - - -You must connect the Application Virtualization Server Management Console to an Application Virtualization System before you can use the management console to manage applications, file type associations, packages, application licenses, server groups, provider policies and administrators. The following procedure outlines the steps you must follow to connect the console to an Application Virtualization System. - -**To connect to an Application Virtualization System** - -1. Right-click the Application Virtualization System node in the **Scope** pane, and select **Connect to Application Virtualization System** from the pop-up menu. - - **Note** - There are three components to Application Virtualization server management: the Application Virtualization Management Console, the Management Web Service, and the SQL Datastore. If these components are distributed across different physical machines, you must configure security properly for the components to communicate across the system. For more information, see the following manuals and articles: - - [How to Configure the Server to be Trusted for Delegation](https://go.microsoft.com/fwlink/?LinkID=166682) (https://go.microsoft.com/fwlink/?LinkID=166682) - - [Planning and Deployment Guide for the Application Virtualization System](https://go.microsoft.com/fwlink/?LinkID=122063) (https://go.microsoft.com/fwlink/?LinkID=122063) - - [Operations Guide for the Application Virtualization System](https://go.microsoft.com/fwlink/?LinkID=133129) (https://go.microsoft.com/fwlink/?LinkID=133129) - - [Article 930472](https://go.microsoft.com/fwlink/?LinkId=114647) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=114647) - - [Article 930565](https://go.microsoft.com/fwlink/?LinkId=114648) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=114648) - - - -2. Complete the fields in the **Connect to Application Virtualization System** dialog box: - - 1. **Web Service Host Name**—Enter the name of the Application Virtualization System to which you want to connect, or enter **localhost** to connect to the local server. - - 2. **Use Secure Connection**—Select this check box if you want to connect to the server with a secure connection. - - 3. **Port**—Enter the port number you want to use for the connection. **80** is the default regular port number, and **443** is the secure-port number. - - 4. **Use Current Windows Account**—Select this radio button to use the current Windows account credentials. - - 5. **Specify Windows Account**—Select this radio button when you want to connect to the server as a different user. - - 6. **Name**—Enter the name of the new user by using either the *DOMAIN\\username* or the username@domain format. - - 7. **Password**—Enter the password that corresponds to the new user. - -3. Click **OK**. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-a-reportserver.md b/mdop/appv-v4/how-to-create-a-reportserver.md deleted file mode 100644 index abdfd7298e..0000000000 --- a/mdop/appv-v4/how-to-create-a-reportserver.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Create a Report -description: How to Create a Report -author: dansimp -ms.assetid: 70938167-d3b9-45ce-b459-a953c93769b0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Report - - -The process for creating a report from the Application Virtualization Server Management Console is the same regardless of the report type. When you select a report type, the window displays a brief description of the selected report. - -**Note**   - When you create a report, you specify the parameters that are used for collecting the data when the report is run. Until you run a report, no data is collected. - - - -**To create a report** - -1. Run the New Report Wizard by right-clicking the **Reports** node and selecting **New Report** from the pop-up menu. - -2. On the first page of the New Report Wizard, enter a name in the **Report Name** field and select the **Report Type** from the drop-down list of reports. Depending on which report you select, the remaining pages in the wizard change according the requirements of that report type. Scan the following list of pages to find the pages that refer to your report: - - 1. **Report Period**—Select a radio button to specify the frequency for running the report. - - 2. **Server**—Select the **Server**, **Server Group**, or **Enterprise** radio button, and then select the server group and server from the corresponding drop-down list and field as enabled. - - 3. **Application**—Select an application from the drop-down list of available applications. - -3. Click **Finish**. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-a-server-group.md b/mdop/appv-v4/how-to-create-a-server-group.md deleted file mode 100644 index bc12c0bd0a..0000000000 --- a/mdop/appv-v4/how-to-create-a-server-group.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Create a Server Group -description: How to Create a Server Group -author: dansimp -ms.assetid: 29ada98b-1024-483d-a3ee-67d4bb263df7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Server Group - - -To help you manage your Application Virtualization Management Servers more efficiently, you can use the Application Virtualization Server Management Console to organize them into server groups. - -**To create a server group** - -1. Click the **Server Groups** node in the left pane, and choose **New Server Group**. - -2. In the **New Server Group Wizard**, enter a name in the **Server Group Name** field, and select the default provider policy from the drop-down list of provider policies. - -3. Be sure the **Enabled** check box is selected to enable the server group. - -4. Click **Finish**. - -## Related topics - - -[How to Add a Server](how-to-add-a-server.md) - -[How to Remove a Server Group](how-to-remove-a-server-group.md) - -[How to Remove a Server](how-to-remove-a-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md b/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md deleted file mode 100644 index 23e2b3570b..0000000000 --- a/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Create a Virtual Environment for a Web-Based Application -description: How to Create a Virtual Environment for a Web-Based Application -author: dansimp -ms.assetid: d2b16e9d-369c-4bd6-b2a0-16dd24c0e32c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Virtual Environment for a Web-Based Application - - -You can create separate virtual environments for web applications you want to isolate. Creating separate web environments is useful if the web-based applications require plug-ins of have configurations that conflict with each other. - -**To create a virtual environment for a Web-based application** - -1. Open the sequencing wizard. For more information about sequencing an application see [How to Sequence a New Application](how-to-sequence-a-new-application.md). - -2. On the **Monitor Installation** page, to start monitoring the installation of the application, click **Begin Monitoring**. Open a web browser and navigate to the installer file associated with the application. Install the application, and perform any required post installation configuration tasks. - -3. To ensure the applications starts, open the application three times. - -4. Install and configure any additional applications that need to reside in the same virtual environment. - -5. Complete the remainder of the Sequencing Wizard. - -6. To save the application, select **File**, and click **Save**. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md b/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md deleted file mode 100644 index 26aae4b1ea..0000000000 --- a/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Create an App-V Project Template (App-V 4.6 SP1) -description: How to Create an App-V Project Template (App-V 4.6 SP1) -author: dansimp -ms.assetid: 7e87fba2-b72a-4bc9-92b8-220e25aae99a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create an App-V Project Template (App-V 4.6 SP1) - - -You can use an App-V project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment which can help streamline the process of creating virtual application packages. - -**Note**   -You can only apply an App-V project template when you are creating a new virtual application package. Applying project templates to existing virtual application packages is not supported. - - - -For more information about applying an App-V project template, see [How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md). - -App-V project templates differ from App-V Application Accelerators because App-V Application Accelerators are application-specific, and App-V project templates can be applied to multiple applications. Additionally, you cannot use a project template when you use a Package Accelerator to create a virtual application package. - -The following general settings are saved with an App-V project template: - -- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring, Rebase **.dll’s**. - -- **Package Deployment Settings**. Contains **Protocol**, **Host Name**, **Port**, **Path**, **Operating Systems**, **Enforce Security Descriptors**, **Create MSI**, **Compress Package**. - -- **General Options**. Allows you to **Generate Microsoft Windows Installer (MSI)** package, **Allow Virtualization of Events**, **Allow Virtualization of Services**, **Append Package Version to Filename**. - -- **Exclusion Items**. Contains the Exclusion pattern list. - -**To create a project template** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. If the virtual application package is currently open in the App-V Sequencer, skip to step 3 of this procedure. To open the existing virtual application package that contains the settings you want to save with the App-V project template, click **File** / **Open** and click **Edit** **Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. - -3. In the App-V Sequencer console, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V project template. Click **Save**. - - The new App-V project template is saved in the directory specified in step 3 of this procedure. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-an-application-group.md b/mdop/appv-v4/how-to-create-an-application-group.md deleted file mode 100644 index ac2fba82be..0000000000 --- a/mdop/appv-v4/how-to-create-an-application-group.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Create an Application Group -description: How to Create an Application Group -author: dansimp -ms.assetid: 32751511-3d1e-40e5-b21f-d88ea39c76a3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create an Application Group - - -In the Application Virtualization Server Management Console, you can use the following procedure to create application groups to organize your applications. - -**To create an application group** - -1. In the Application Virtualization Server Management Console, click the **Applications** node in the left pane or expand it and highlight an existing application group. - -2. Right-click the **Applications** node or the existing application group where you want to put the new group, and choose **New Application Group**. - -3. In the **New Application Group Wizard**, type the name for the group and click **OK**. - - Now you can populate the new group by importing applications. You can also move applications between groups. For more information about moving applications, see [How to Move an Application](how-to-move-an-application.md). - -## Related topics - - -[How to Grant Access to an Application](how-to-grant-access-to-an-application.md) - -[How to Import an Application](how-to-import-an-applicationserver.md) - -[How to Manually Add an Application](how-to-manually-add-an-application.md) - -[How to Move an Application](how-to-move-an-application.md) - -[How to Move an Application Group](how-to-move-an-application-group.md) - -[How to Remove an Application Group](how-to-remove-an-application-group.md) - -[How to Rename an Application Group](how-to-rename-an-application-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-an-application-license-group.md b/mdop/appv-v4/how-to-create-an-application-license-group.md deleted file mode 100644 index 76da2668b9..0000000000 --- a/mdop/appv-v4/how-to-create-an-application-license-group.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Create an Application License Group -description: How to Create an Application License Group -author: dansimp -ms.assetid: b385324a-8a11-41ee-86e8-8f809235454c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create an Application License Group - - -The Application Virtualization Server Management Console enables you to organize and manage application licenses. Depending on the type of license group, you can control who has access to the application and how many users can access an application at a time. You can use the following procedure to create an application license group. - -**To create an application license group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Application Licenses** node. - -2. Select one of the following menu items that corresponds to the type of license group you want to create, and complete the pages in the associated **New License Wizard**: - - 1. **New Unlimited License** - - 2. **New Concurrent License** - - 3. **New Named License** - -3. Click **Finish**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Remove an Application License Group](how-to-remove-an-application-license-group.md) - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md deleted file mode 100644 index bf6769fb47..0000000000 --- a/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: How to Create App-V Package Accelerators (App-V 4.6 SP1) -description: How to Create App-V Package Accelerators (App-V 4.6 SP1) -author: dansimp -ms.assetid: 585e692e-cebb-48ac-93ab-b2e7eb7ae7ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create App-V Package Accelerators (App-V 4.6 SP1) - - -You can use App-V Package Accelerators to automatically generate a new virtual application package. After you have successfully created a Package Accelerator, you can reuse and share the Package Accelerator. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). Creating App-V Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V Package Accelerator is applied. - -In some situations, to create the Package Accelerator, you might have to install the application locally on the computer running the Sequencer. First try to create the Package Accelerator by using the installation media, and if there are a number of missing files that are required, install the application locally to the computer running the Sequencer, and then create the Package Accelerator. - -**Important** -Before you begin the following procedure, you should do the following: - -- Copy the virtual application package that you must use to create the Package Accelerator locally to the computer running the Sequencer. - -- Copy all required installation files associated with the virtual application package to the computer running the Sequencer. - - - -**Important** -Disclaimer: The Microsoft Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer. - - - -**To create an App-V Package Accelerator** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the App-V **Create Package Accelerator** wizard, in the App-V Sequencer, click **Tools** / **Create Package Accelerator**. - -3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.sprj file). - - **Tip** - Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. - - - -~~~ -Click **Next**. -~~~ - -4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files. - - **Tip** - Copy the folder that contains the required installation files to the computer running the Sequencer. - - - -~~~ -If the application is already installed on the computer running the Sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location. -~~~ - -5. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page. - - **Note** - You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard. - - - -6. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the Package Accelerator. Select only files that are required for the application to run successfully, and then click **Next**. - -7. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package. - - If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**. - -8. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**. - -9. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory. - -10. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**. - - **Important** - To help ensure that the Package Accelerator is as secure as possible, and so that the publisher can be verified when the Package Accelerator is applied, you should always digitally sign the Package Accelerator. - - - -## Related topics - - -Configuring the Application Virtualization Sequencer (App-V 4.6 SP1) -[How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md b/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md deleted file mode 100644 index c4db220dcf..0000000000 --- a/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Create or Upgrade Virtual Applications Using the App-V Sequencer -description: How to Create or Upgrade Virtual Applications Using the App-V Sequencer -author: dansimp -ms.assetid: 661d4f8c-2527-4654-9d92-15ecc652c0db -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create or Upgrade Virtual Applications Using the App-V Sequencer - - -The following topics provide detailed information about the associated Application Virtualization (App-V) Sequencer task. - -## In This Section - - -[How to Sequence an Application](how-to-sequence-an-application.md) -Provides a step-by-step procedure you can use to sequence an application. - -[How to Sequence a New Application (App-V 4.6)](how-to-sequence-a-new-application--app-v-46-.md) -Provides a step-by-step procedure you can use to sequence an application. - -[How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md) -Provides a step-by-step procedure you can use to upgrade an existing virtual application to a new version. - -[How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md) -Provides a step-by-step procedure you can use to upgrade an existing virtual application to a new version. - -[How to Modify a Virtual Application Package (App-V 4.6)](how-to-modify-a-virtual-application-package--app-v-46-.md) -Provides a step-by-step procedure you can use to modify an existing virtual application package. - -[How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md) -Provides a step-by-step procedure you can use to sequence a new application by using a command line. - -[How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md) -Provides a step-by-step procedure you can use to upgrade a virtual application by using a command line. - -[How To Use Dynamic Suite Composition](how-to-use-dynamic-suite-composition.md) -Provides information about how to define an application as being dependent on another application such as middleware or a plug-in. - -[How to Use the Differential SFT File](how-to-use-the-differential-sft-file.md) -Provides a step-by-step procedure you can use to create and deploy the Differential SFT file. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-create-the-package-root-directory.md b/mdop/appv-v4/how-to-create-the-package-root-directory.md deleted file mode 100644 index 8e00793ee2..0000000000 --- a/mdop/appv-v4/how-to-create-the-package-root-directory.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Create the Package Root Directory -description: How to Create the Package Root Directory -author: dansimp -ms.assetid: bcfe3bd4-6c60-409a-8ffa-cc22f27194b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create the Package Root Directory - - -The package root directory is the directory on the computer running the App-V Sequencer where files for the sequenced application are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed. You should create the package root directory before you monitor the installation of a new application. - -After you have created the package root directory, you can begin sequencing applications. For more information about sequencing a new application, see [How to Install the Sequencer](how-to-install-the-sequencer.md). - -**To create the package root directory** - -1. To create the package root directory, on the computer running the App-V Sequencer, map the Q:\\ drive to the specified network location. The location you specify should have sufficient space to save the application you are sequencing. - -2. To create a directory that you can use for a new virtual application, create a folder on the Q:\\ drive and assign it a name. - - **Important**   - The name you assign to virtual application files that will be saved in the package root directory should use the 8.3 naming format. The file names should be no longer than 8 characters with a three-character file name extension. - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md b/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md deleted file mode 100644 index b745ddf86a..0000000000 --- a/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Create the Sequencer Package Root Directory -description: How to Create the Sequencer Package Root Directory -author: dansimp -ms.assetid: 23fe28f1-c284-43ee-b8b7-1dfbed94eea5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create the Sequencer Package Root Directory - - -The package root directory is the directory on the computer running the App-V Sequencer where files for the sequenced application are installed. This directory also exists virtually on the computer to which a sequenced application will be streamed. You should create the package root directory before you monitor the installation of a new application. - -After you have created the package root directory, you can begin sequencing applications. For more information about sequencing a new application, see [How to Sequence an Application](how-to-sequence-an-application.md). - -**To create the package root directory** - -1. To create the package root directory, on the computer running the App-V Sequencer, map the Q:\\ drive to the specified network location. The location you specify should have sufficient space to save the application you are sequencing. - -2. To create a directory that you can use for a new virtual application, create a folder on the Q:\\ drive and assign it a name. - - **Important**   - The name you assign to virtual application files that will be saved in the package root directory should use the 8.3 naming format. The file names should be no longer than 8 characters with a three-character file name extension. - - - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md) - -[How to Modify the Scratch Directory Location](how-to-modify-the-scratch-directory-location.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md b/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md deleted file mode 100644 index f1e04f6d1e..0000000000 --- a/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Customize an Application Virtualization System in the Server Management Console -description: How to Customize an Application Virtualization System in the Server Management Console -author: dansimp -ms.assetid: e3a51d1d-451d-46a5-8ae5-f5792d49495b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Customize an Application Virtualization System in the Server Management Console - - -You can choose a variety of options to customize an Application Virtualization System. These options are available through the user interface of the Application Virtualization Server Management Console. - -## In This Section - - -[How to Set Up and Enable or Disable Authentication](how-to-set-up-and-enable-or-disable-authentication.md) -Provides procedures you can use to establish the levels of authentication for defining who has access to the system. - -[How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md) -Provides procedures for setting up or disabling usage reporting. - -[How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md) -Provides procedures for setting up the database size limits and determining when the server will clean up the database. - -[How to Set Up or Disable Application Licensing](how-to-set-up-or-disable-application-licensing.md) -Provides procedures for setting up or disabling application licensing. - -[How to Add an Administrator Group](how-to-add-an-administrator-group.md) -Provides a procedure for adding an administrator group. - -[How to Delete an Administrator Group](how-to-delete-an-administrator-group.md) -Provides a procedure for deleting an administrator group. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-delete-a-file-type-association.md b/mdop/appv-v4/how-to-delete-a-file-type-association.md deleted file mode 100644 index 16c96b8513..0000000000 --- a/mdop/appv-v4/how-to-delete-a-file-type-association.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Delete a File Type Association -description: How to Delete a File Type Association -author: dansimp -ms.assetid: bb2dd1cf-9a5d-45a9-aca1-3c53144b73ec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a File Type Association - - -You can use the following procedure to delete a file type association. The **File Type Associations** node is one level below the **Application Virtualization** node in the **Scope** pane. When you select this node, the **Results** pane displays a list of file type associations. - -**To remove a file type association** - -1. In the **Results** pane, right-click the extension of the file type association you want to delete. - -2. Select **Delete** from the pop-up menu. - -3. Click **Yes** to delete the association, or click **No** to return to the **Results** pane. - -## Related topics - - -[How to Add a File Type Association](how-to-add-a-file-type-association.md) - -[How to Add an Application](how-to-add-an-application.md) - -[How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-delete-a-package-version.md b/mdop/appv-v4/how-to-delete-a-package-version.md deleted file mode 100644 index c1d92e1264..0000000000 --- a/mdop/appv-v4/how-to-delete-a-package-version.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Delete a Package Version -description: How to Delete a Package Version -author: dansimp -ms.assetid: a55adb9d-ffa6-4df3-a2d1-5e0c73c35e1b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Package Version - - -From the Application Virtualization Server Management Console, for a package that has multiple versions, you can use the following procedure to delete one or more versions and still stream the remaining versions of the package. You might do this to more effectively manage files on the server or to remove an obsolete version. - -**Note**   -When you choose to delete a version, a confirmation box reminds you that client computers might still be using it. You should advise users to exit and unload any applications before you remove a version that is in use. - - - -**To delete a package version** - -1. In the left panel of the Application Virtualization Server Management Console, expand **Packages**. - -2. Click the package that contains the version you want to delete. - -3. In the center pane, right-click the version of the package you want to delete and choose **Delete**. - -4. Read the confirmation window, and click **Yes** to complete the action. - - **Note**   - If you have users in disconnected operation, their applications will be replaced with the new versions the next time they connect to the servers. After you are sure all users have updated applications, you can delete old versions. - - - -## Related topics - - -[How to Delete a Package](how-to-delete-a-packageserver.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-delete-a-packageserver.md b/mdop/appv-v4/how-to-delete-a-packageserver.md deleted file mode 100644 index 7f2bd13bae..0000000000 --- a/mdop/appv-v4/how-to-delete-a-packageserver.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Delete a Package -description: How to Delete a Package -author: dansimp -ms.assetid: 23f9c0e9-8910-47df-9fc0-7bbb5bbf2dc9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Package - - -You can use the following procedure to delete a package, including all versions of the package, from the Application Virtualization Server Management Console. You might do this for easier management of files on the server or to remove a package and replace it with a more stable one. - -**Important**   -When you choose to delete a package, a confirmation box reminds you that this action deletes all its versions. The server will no longer be able to stream the application. - - - -**To delete a package** - -1. In the left pane of the Application Virtualization Server Management Console, expand **Packages**. - -2. In the menu tree pane, right-click the package you want to delete and choose **Delete**. - -3. Read the confirmation window, and click **Yes** to complete the action. - -## Related topics - - -[How to Delete a Package Version](how-to-delete-a-package-version.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-delete-a-reportserver.md b/mdop/appv-v4/how-to-delete-a-reportserver.md deleted file mode 100644 index 14ac327bbf..0000000000 --- a/mdop/appv-v4/how-to-delete-a-reportserver.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Delete a Report -description: How to Delete a Report -author: dansimp -ms.assetid: 53350b71-1fb5-4f7e-a684-9ea1116c5c3f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Report - - -From the Application Virtualization Server Management Console, the process for deleting a report is the same regardless of the report type. - -**To delete a report** - -1. Click the **Reports** node to expand the list of reports. - -2. Right-click the desired report (either in the **Reports** node or the **Results** pane), and select **Delete**. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md b/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md deleted file mode 100644 index 1fdb2c31c6..0000000000 --- a/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Delete All Virtual Applications by Using the Command Line -description: How to Delete All Virtual Applications by Using the Command Line -author: dansimp -ms.assetid: bfe13b5c-825a-4eb1-a979-6c4b8d8b2a9c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete All Virtual Applications by Using the Command Line - - -You can use the following procedure to delete all virtual applications from a specific computer. - -**Note**   -When all applications are deleted from a package, the Application Virtualization (App-V) Client also deletes the package. - - - -**To delete all applications** - -- Run the following command to delete all applications for the user account under which the command is run. If you run the command with the optional /GLOBAL switch, using an account with administrative rights, all applications are deleted for all users. - - `SFTMIME DELETE OBJ:APP [/GLOBAL]` - - **Note**   - When all applications are deleted from a package, the Application Virtualization (App-V) Client also deletes the package. - - - -## Related topics - - -[How to Add a Package by Using the Command Line](how-to-add-a-package-by-using-the-command-line.md) - -[How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-delete-an-administrator-group.md b/mdop/appv-v4/how-to-delete-an-administrator-group.md deleted file mode 100644 index d538220e01..0000000000 --- a/mdop/appv-v4/how-to-delete-an-administrator-group.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Delete an Administrator Group -description: How to Delete an Administrator Group -author: dansimp -ms.assetid: 398a8028-e128-4020-bbe2-59ba63b5cd48 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete an Administrator Group - - -From the **Administrators** node of the Application Virtualization Server Management Console, you can use the following procedure to delete an administrator group. - -**To delete an administrator group** - -1. Click the **Administrators** node to display the list of administrator groups in the **Results** pane. - -2. In the **Actions** pane (far right pane), click **Delete**. - -3. Click **Yes**. - -## Related topics - - -[How to Add an Administrator Group](how-to-add-an-administrator-group.md) - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-delete-an-application-server.md b/mdop/appv-v4/how-to-delete-an-application-server.md deleted file mode 100644 index 55f77b412f..0000000000 --- a/mdop/appv-v4/how-to-delete-an-application-server.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Delete an Application -description: How to Delete an Application -author: dansimp -ms.assetid: 421e7df0-fea3-4cb2-a884-3d04f2223da7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete an Application - - -You can delete an application through the Application Virtualization Server Management Console. This does not delete its Open Software Descriptor (.osd) file for other files from the Application Virtualization Server. After it is deleted, however, the application no longer streams to end users. - -**Note**   -If this is the only application in a package, deleting it also removes related package data and file associations. - - - -**To delete an application** - -1. In the left pane of the management console, click the **Applications** node. - -2. In the right pane, highlight one or more applications you want to delete. You can use CTRL or Shift key combinations to highlight multiple applications. - -3. Right-click the application or applications, and choose **Delete**. - -4. In the **Remove Application** confirmation prompt, click **Yes** to complete the action. - -## Related topics - - -[How to Import an Application](how-to-import-an-applicationserver.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-delete-an-application.md b/mdop/appv-v4/how-to-delete-an-application.md deleted file mode 100644 index c1e441347c..0000000000 --- a/mdop/appv-v4/how-to-delete-an-application.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Delete an Application -description: How to Delete an Application -author: dansimp -ms.assetid: 03b0912d-b14a-4522-916d-71f8b77a8a82 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete an Application - - -When you select the **Application** node in the Application Virtualization Client Management Console, the **Results** pane displays a list of applications. You can use the following procedure to delete an application from the **Results** pane, which also removes the application from the cache. - -**Note**   -When you delete an application, the selected application will no longer be available to any users on that client. Shortcuts and file type associations are hidden, and the application is deleted from cache. However, if another application refers to data in the file system cache data for the selected application, these items will not be deleted. - -After a publishing refresh, the deleted applications will again become available to you. - - - -**To delete an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Delete** from the pop-up menu. - -2. At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation. - - - - - - - - - diff --git a/mdop/appv-v4/how-to-deny-access-to-an-application.md b/mdop/appv-v4/how-to-deny-access-to-an-application.md deleted file mode 100644 index 1dd6b7fdf5..0000000000 --- a/mdop/appv-v4/how-to-deny-access-to-an-application.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Deny Access to an Application -description: How to Deny Access to an Application -author: dansimp -ms.assetid: 14f5e201-7265-462c-b738-57938dc3fc30 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deny Access to an Application - - -Users must be in an application's **Access Permissions** list to load and use the application. Although the Application Virtualization Server Management Console does not support explicitly denying a user group access to an application, you can remove the user groups from an application’s properties to achieve this. - -**To deny access to an application** - -1. For an existing application, click the **Applications** node in the left pane. - -2. Right-click an application in the right pane, and choose **Properties**. Then select the **Access Permissions** tab. - -3. To remove access for a user group, highlight the user group and click **Remove**. - -4. Click **OK**. - - **Note**   - To control access to applications, you can also limit the application licenses. Setting up the proper user groups in Active Directory Domain Services provides the easiest way to grant and deny access to specific sets of users. - - - -## Related topics - - -[How to Grant Access to an Application](how-to-grant-access-to-an-application.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md b/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md deleted file mode 100644 index 6fda63581a..0000000000 --- a/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: How to Determine Whether to Edit or Upgrade a Virtual Application Package -description: How to Determine Whether to Edit or Upgrade a Virtual Application Package -author: dansimp -ms.assetid: 33dd5332-6802-46e0-9748-43fcc8f80aa3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Determine Whether to Edit or Upgrade a Virtual Application Package - - -Use the following table to help determine whether a virtual application package can be opened for edit, whether you need to create a new version of the package, or whether either option is available, using the App-V Sequencer. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ActionOpen for editOpen for upgrade

    View package properties.

    Yes

    Yes

    View package change history.

    Yes

    Yes

    View associated package files.

    Yes

    Yes

    Edit registry settings.

    Yes

    Yes

    Review additional package settings (except operating system file properties).

    Yes

    Yes

    Create associated Windows Installer (MSI).

    Yes

    Yes

    Modify OSD file.

    Yes

    Yes

    Compress and uncompress package.

    Yes

    Yes

    Add file type associations.

    Yes

    Yes

    Rename shortcuts.

    Yes

    Yes

    Set virtualized registry key state (override / merge).

    Yes

    Yes

    Set virtualized folder state.

    Yes

    Yes

    Edit virtual file system mappings.

    Yes

    Yes

    Review all associated operating system file properties for a package.

    No

    Yes

    Add additional services.

    No

    Yes

    Add additional files.

    No

    Yes

    Collect and configure associated security descriptors.

    No

    Yes

    Apply security updates or upgrade to a new version.

    No

    Yes

    Add an additional application.

    No

    Yes

    Apply updates that require the application to open.

    No

    Yes

    Apply updates that require the computer to restart.

    No

    Yes

    - -  - -## Related topics - - -[How to Edit an Existing Virtual Application](how-to-edit-an-existing-virtual-application.md) - -[How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md b/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md deleted file mode 100644 index 5394ec7bb3..0000000000 --- a/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: How to Determine Which Type of Application to Sequence (App-V 4.6 SP1) -description: How to Determine Which Type of Application to Sequence (App-V 4.6 SP1) -author: dansimp -ms.assetid: 936abee2-98f1-45fb-9f0d-786e1d7464b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Determine Which Type of Application to Sequence (App-V 4.6 SP1) - - -You can sequence three basic types of applications by using Microsoft Application Virtualization (App-V) Sequencer. - -## To determine which type of application to sequence - - -Use the following table to determine which type of application you should sequence and to obtain more information about how to sequence the application. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Application TypeDescriptionMore Information

    Standard

    Select this option to create a package that contains an application or a suite of applications. You should select this option for most applications that you plan to sequence.

    How to Sequence a New Standard Application (App-V 4.6 SP1)

    Add-on or Plug-in

    Select this option to create a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or another package that is linked by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see How To Use Dynamic Suite Composition (https://go.microsoft.com/fwlink/?LinkId=203804).

    How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)

    Middleware

    Select this option to create a package that is required by a standard application, for example, the Microsoft .NET Framework. Middleware packages are used for linking to other packages by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see How To Use Dynamic Suite Composition (https://go.microsoft.com/fwlink/?LinkId=203804).

    How to Sequence a New Middleware Application (App-V 4.6 SP1)

    - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md b/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md deleted file mode 100644 index fc1d34c067..0000000000 --- a/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Disable or Modify Disconnected Operation Mode Settings -description: How to Disable or Modify Disconnected Operation Mode Settings -author: dansimp -ms.assetid: 39f166d7-2d25-4899-8405-b45f051facb8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Disable or Modify Disconnected Operation Mode Settings - - -Use the following procedures in Application Virtualization Client to disable or modify disconnected operation mode settings. - -**To disable disconnected operation** - -1. Right-click the **Application Virtualization** node in the console, and select **Properties** from the pop-up menu. - -2. Click the **Connectivity** tab, and then clear **Allow disconnected operation** check box. - -3. Click **OK** to accept the change. - -**To change the time-out** - -1. Right-click the **Application Virtualization** node in the console, and select **Properties** from the pop-up menu. - -2. Click the **Connectivity** tab, and then select the **Limit disconnected operation to** check box. - -3. In the field, enter a value from 1–999999 (representing days). The default value is 90 days. - -4. Click **OK** to accept the change. - -**To work offline** - -1. Right-click the **Application Virtualization** node in the console, and select **Properties** from the pop-up menu. - -2. Click the **Connectivity** tab, and then select the **Work offline** check box. - -3. Click **OK** to accept the change. - -## Related topics - - -[Disconnected Operation Mode](disconnected-operation-mode.md) - -[How to Work Offline or Online with Application Virtualization](how-to-work-offline-or-online-with-application-virtualization.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md b/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md deleted file mode 100644 index 822fe72dd9..0000000000 --- a/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Edit an Existing Virtual Application -description: How to Edit an Existing Virtual Application -author: dansimp -ms.assetid: 358b9a69-5695-4c6f-92e1-7ed2b69a2def -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit an Existing Virtual Application - - -You can use the following procedure to edit the properties associated with an existing virtual application package by using the Application Virtualization (App-V) Sequencer. You must open the existing virtual application, make the necessary updates, and then save the updated virtual application package. - -**To modify an existing virtual application** - -1. To start the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start**/**Programs**/**Microsoft Application Virtualization**/**Microsoft Application Virtualization Sequencer**. - -2. To open the existing virtual application, in the App-V Console, select **File**/**Open**. Use the **Open** dialog box to locate the associated SPRJ file you want to modify. - -3. Modify the virtual application package. For more information about what properties can be modified, see [How to Determine Whether to Edit or Upgrade a Virtual Application Package](how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md). - -4. To save the modifications, select **File** / **Save**. - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - -[How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md b/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md deleted file mode 100644 index 41b7631eb1..0000000000 --- a/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Edit an OSD File Using a Text Editor -description: How to Edit an OSD File Using a Text Editor -author: dansimp -ms.assetid: f4263a1b-824f-49b9-8060-b8229c9d9960 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit an OSD File Using a Text Editor - - -Use the following procedure to edit an Open Software Descriptor (OSD) file by using a text editor. - -**To edit an OSD file by using a text editor** - -1. Open the OSD file using any XML or ASCII text editor—for example, Microsoft Notepad. - - **Note**   - Before modifying the OSD file, read the schema prescribed by the XSD file in the install directory. Failing to follow this schema might introduce errors that prevent a sequenced application from starting successfully. - - - -2. Edit the OSD file using your XML or ASCII text editor of choice, adhering to the prescribed schema and the following guidelines: - - 1. Ensure that named elements are nested within the <SOFTPKG> root element. - - 2. Ensure that element names are in all uppercase letters. - - 3. Be aware that attribute values are case sensitive. - - 4. Type carefully, and observe the XML specifications. - -## Related topics - - -[About the OSD Tab](about-the-osd-tab.md) - -[How to Edit an OSD File](how-to-edit-an-osd-file.md) - -[OSD File Elements](osd-file-elements.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-edit-an-osd-file.md b/mdop/appv-v4/how-to-edit-an-osd-file.md deleted file mode 100644 index 6f19e9a7b7..0000000000 --- a/mdop/appv-v4/how-to-edit-an-osd-file.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: How to Edit an OSD File -description: How to Edit an OSD File -author: dansimp -ms.assetid: 0d126ba7-72fb-42ce-982e-90ed01a852c8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit an OSD File - - -Use the following procedures to modify a sequenced application package's Open Software Descriptor (OSD) file by adding or deleting an element or an attribute. - -**Note**   - Some elements do not have an attribute, so it is not possible to add an attribute to every element. - - - -**Important**   -If you use the OSD editor to change the .sft file name, the HREF attribute of the CODEBASE element in the OSD file, you must use the **Save As** command to save the change to the project files. - - - -**To add an element** - -1. Click the **OSD File** tab. - -2. In the navigation pane, select the sequenced application package's OSD file you want to modify. - -3. In the navigation pane, right-click the element that you want to modify. On the menu, select **Element** and select **Add**. - -4. From the menu, select the element you want to add—for example, **Codebase**. - -5. From the **File** menu, select **Save**. - -**To delete an element** - -1. Click the **OSD File** tab. - -2. In the navigation pane, select the sequenced application package's OSD file you want to modify. - -3. In the navigation pane, right-click the element that you want to delete. On the menu, select **Element** and select **Delete**. - -4. From the **File** menu, select **Save**. - -**To add an attribute** - -1. Click the **OSD File** tab. - -2. In the navigation pane, select the sequenced application package's OSD file you want to modify. - -3. In the left pane, right-click the element to which you want to add an attribute. On the menu, select **Attribute** and select **Add**, choosing from the listed available attributes. - -4. From the **File** menu, select **Save**. - -**To delete an attribute** - -1. Click the **OSD File** tab. - -2. In the navigation pane, select the sequenced application package's OSD file you want to modify. - -3. In the navigation pane, right-click the element from which you want to delete an attribute. On the menu, select **Attribute** and then select **Delete**, choosing the attribute you wish to delete. - -4. From the **File** menu, select **Save**. - -## Related topics - - -[About the OSD Tab](about-the-osd-tab.md) - -[How to Edit an OSD File Using a Text Editor](how-to-edit-an-osd-file-using-a-text-editor.md) - -[OSD File Elements](osd-file-elements.md) - -[Sequencer Console](sequencer-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md b/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md deleted file mode 100644 index 480c2d8d34..0000000000 --- a/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: How to Exit the App-V Client from the Notification Area -description: How to Exit the App-V Client from the Notification Area -author: dansimp -ms.assetid: 71ebf88b-ef51-41a5-ae34-4e197d9d6ee6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Exit the App-V Client from the Notification Area - - -You can use the following procedure to exit the Application Virtualization Desktop Client or Client for Remote Desktop Services. - -**To exit the client** - -- Right-click the Application Virtualization System icon in the notification area, and select **Exit** from the pop-up menu. - - If you choose to exit from the client while virtual applications are open, the system displays a prompt telling you that you will lose unsaved data. Select **OK** or **Cancel** to acknowledge and close the prompt. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-export-a-reportserver.md b/mdop/appv-v4/how-to-export-a-reportserver.md deleted file mode 100644 index f7eb70e1aa..0000000000 --- a/mdop/appv-v4/how-to-export-a-reportserver.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Export a Report -description: How to Export a Report -author: dansimp -ms.assetid: 2f917130-db02-4c72-a45a-7928e51e689e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Export a Report - - -The process for exporting a report, using the Application Virtualization Console, is the same regardless of the report type. - -**To export a report** - -1. Right-click the report displayed in the **Results** pane, and select **Export** from the drop down menu. - -2. Select the report type from the list of types. - -3. In the **Save As** dialog box, navigate to the location where you want to save the output. - -4. Enter a name for the report in the **File Name** field, or select a file from the drop-down list of files. - -5. Select an output type from the **Save as Type** drop-down list of types. - -6. Click the **Save** button to save the file. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-grant-access-to-an-application.md b/mdop/appv-v4/how-to-grant-access-to-an-application.md deleted file mode 100644 index 89a6cf8277..0000000000 --- a/mdop/appv-v4/how-to-grant-access-to-an-application.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Grant Access to an Application -description: How to Grant Access to an Application -author: dansimp -ms.assetid: e54d9e84-21f5-488f-b040-25f374d9289f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Grant Access to an Application - - -As the administrator, you can use the Application Virtualization Server Management Console to determine which users can access which applications. You can do this when you import the Sequencer Project (SPRJ) or Open Software Descriptor (OSD) file or at anytime using the application's **Properties** dialog box. With both methods, use the **Access Permissions** options to add users. - -**To grant access to an application** - -1. For an existing application, click the **Applications** node in the left pane. Right-click an application in the right pane, and choose **Properties**. - -2. Select the **Access Permissions** tab. - -3. To add user groups, click **Add**. - -4. In the **Add/Edit User Group** dialog box, navigate to the user group. You can also enter the domain and group by typing the information in the respective fields. - -5. Click **OK**. You can add other groups with the same pages. - -6. When the wizard reappears, click **OK**. - - **Note**   - You must set up your groups in Active Directory Domain Services before you attempt to grant access to applications. - - - -## Related topics - - -[How to Deny Access to an Application](how-to-deny-access-to-an-application.md) - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -[How to Manually Add an Application](how-to-manually-add-an-application.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-import-an-application.md b/mdop/appv-v4/how-to-import-an-application.md deleted file mode 100644 index 2fc950a033..0000000000 --- a/mdop/appv-v4/how-to-import-an-application.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: How to Import an Application -description: How to Import an Application -author: dansimp -ms.assetid: 85aaf5d8-489c-4929-996f-f15d2dab1ad8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Import an Application - - -You can use the following procedure to import an application into the cache directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To import an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Import** from the pop-up menu. - -2. From the **Browse** window, navigate to the location of the package file for the desired application, and then click **OK**. - - **Note**   - If you have already configured an import search path or if the SFT file is in the same path as the last successful import, step 2 is not required. - - - - - - - - - - - diff --git a/mdop/appv-v4/how-to-import-an-applicationserver.md b/mdop/appv-v4/how-to-import-an-applicationserver.md deleted file mode 100644 index 66852c68c1..0000000000 --- a/mdop/appv-v4/how-to-import-an-applicationserver.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: How to Import an Application -description: How to Import an Application -author: dansimp -ms.assetid: ab40acad-1025-478d-8e13-0e1ff1bd37e4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Import an Application - - -Typically, you import applications to make them available to stream from an Application Virtualization Management Server. You can also add an application manually, but you must provide precise, detailed information about the application to do so. For more information, see [How to Manually Add an Application](how-to-manually-add-an-application.md). - -**Note**   -To import an application, you must have its sequenced Open Software Descriptor (OSD) file or its Sequencer Project (SPRJ) file available on the server. - - - -When importing an application, you should make sure the server is configured with a value in the **Default Content Path** field on the **General** tab of the **System Options** dialog (accessible by right-clicking the **Application Virtualization System** node in the App-V Server Console). The default content path value defines where the applications will be imported, and during the import process, this value is used to modify the paths defined in the OSD file for the SFT file and for the icon shortcuts. In the OSD file, the path for the SFT file is specified in the CODEBASE HREF entry and the path for the icons is specified in the SHORTCUTS entry. - -During the import process, the protocol, server, and, if present, port specified in these two paths in the OSD file will be replaced with the value from the default content path. The following table provides an example of how the import path will be affected. - - ----- - - - - - - - - - - - - - - -
    Default Content PathOSD File CODEBASE HREFResulting Value

    \server\content</p>

    http://WebServer/myFolder/package.sft

    \server\content\myFolder\package.sft

    - - - -**To import an application** - -1. Right-click the **Applications** node in the left pane, and choose **Import Applications**. - -2. In the **Open** dialog box, navigate to the application's SPRJ or OSD file. Highlight the file and click **Open**. - -3. In the **New Application Wizard**, be sure the **Enabled** box is selected for applications you want to stream. There you can also enter a description and verify the server and file paths. Also, if you have set up license and server groups, you can select those. - -4. Click **Next**. - -5. On the **Published Shortcuts** screen, select the boxes for the locations where you would like the application shortcuts to appear on the client computers. - -6. Click **Next**. - -7. In the **File Associations** screen, you can add new file associations to this application. To do so, click **Add**, enter the extension (without a preceding dot), enter a description, and click **OK**. - - **Note**   - Applications sequenced with Sequencer 4.0 populate the **File Associations** dialog box when you import or create them through the management console. Applications with previous Sequencer version packages do not. - - - -8. Click **Next**. - -9. In the **Access Permissions** screen, click **Add**. - -10. Complete the **Select Groups** dialog box. When you finish, click **OK**. - -11. Click **Next**. - -12. On the **Summary** screen, you can review the import settings. Click **Finish**, or click **Back** to change the import or click **Cancel** to cancel the import. - -## Related topics - - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -[How to Manually Add an Application](how-to-manually-add-an-application.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-a-database.md b/mdop/appv-v4/how-to-install-a-database.md deleted file mode 100644 index da440a18ff..0000000000 --- a/mdop/appv-v4/how-to-install-a-database.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Install a Database -description: How to Install a Database -author: dansimp -ms.assetid: 52e3a19d-b7cf-4f2c-8268-0f8361cc9766 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install a Database - - -You can use the following procedure to install a database for your server-based deployment of Application Virtualization if a database is not already available. Typically, in a production environment, you will connect to an existing database. - -**Important**   -To install the database, you must use a network account with the appropriate permissions. If your organization requires that only database administrators are allowed to create and conduct database upgrades, scripts are available that allow this task to be performed. - - - -**To install a database** - -1. Navigate to the location of the Application Virtualization System setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click **Setup.exe**. - -2. On the **Welcome Page**, click **Next**. - -3. On the **License Agreement** page, to accept the license agreement, select **I accept the license terms and conditions**, and click **Next**. - -4. On the **Registering Information** page, specify the **User Name** and **Organization** information, and then click **Next**. - -5. On the **Setup Type** page, select **Custom** and then click **Next**. - -6. On the **Custom Setup** page, deselect all Application Virtualization System components except **Application Virtualization Server**, and then click **Next**. - - **Note**   - If a component is already installed on the computer, by deselecting it on the **Custom Setup** screen it will automatically be uninstalled. - - - -7. On the **Database Server** page, type the passwords, assign an installation path, save the information, and click **Next**. - -8. Select a name for the database, and then click **Next**. - - **Note**   - If error 25109 is displayed when you try to complete this step, you have incorrectly set up the permissions necessary to install the database. For details on setting up the necessary SQL permissions, please see . - - - -9. On the **Directory Server** screen, enter a domain name and credentials that Application Virtualization Servers and the Management Web Service will use to access your domain controller, save this information, and then click **Next**. - - **Note**   - The installation will default to the domain of the current computer. - - - -10. On the **Administrator Group** page, enter the name of a group that will have Administrator privileges, save this information, and then click **Next**. - - **Note**   - You can also enter the first few characters of the name of a group that will have Administration privileges, click **Next**, and on the **Select Administrator Group** screen, select the group from the resulting list. Then save this information and click **Next**. - - - -11. On the **Default Provider Group** page, enter the complete name of a group that will control access to applications, save this information, and then click **Next**. - - **Note**   - You can also enter the first few characters of the name of a group that will control access to applications, click **Next**, and on the **Select Default Provider Group** screen, select the group in the list. Then save this information and click **Next**. - - - -12. On the **Installation Wizard Completed** page, to close the wizard, click **Finish**. - - **Important**   - The installation can take a few minutes to finish. A status message will flash above the Windows desktop notification area, indicating whether the installation succeeded. - - - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md b/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md deleted file mode 100644 index ba2ed5bf33..0000000000 --- a/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Install and Configure the App-V Management Console for a More Secure Environment -description: How to Install and Configure the App-V Management Console for a More Secure Environment -author: dansimp -ms.assetid: 9d89ef09-cdbf-48fc-99da-b24fc987ef8f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure the App-V Management Console for a More Secure Environment - - -The default installation of the App-V Management Console includes support for secure communications. Each Management Console is configured on a per-connection basis when the console is started for the first time or when connecting to an additional App-V Web Management Service. The default configuration uses SSL over TCP port 443. You can change the port number if the port number was modified on the server. You can use the following procedure to connect to an App-V Web Management Service by using a secure connection. - -**How to Connect to an App-V Management Service by Using an SSL Connection** - -1. Start the Application Virtualization Management Console. - -2. Click **Configure Connection** in the actions pane of the console. - -3. Type the **Web Service Host Name**, and ensure that **Use Secure Connection** is selected. - - **Important**   - The name provided in the Web Service Host Name must match the common name on the certificate, or the connection will fail. - - - -4. Select the appropriate login credentials, and click **OK**. - -## Related topics - - -[Configuring Certificates to Support the App-V Web Management Service](configuring-certificates-to-support-the-app-v-web-management-service.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-and-configure-the-default-application.md b/mdop/appv-v4/how-to-install-and-configure-the-default-application.md deleted file mode 100644 index 529a24aadc..0000000000 --- a/mdop/appv-v4/how-to-install-and-configure-the-default-application.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: How to Install and Configure the Default Application -description: How to Install and Configure the Default Application -author: dansimp -ms.assetid: 5c5d5ad1-af40-4f83-8234-39e972f2c29a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure the Default Application - - -The default application is provided as part of the installation and is automatically copied to the Microsoft Application Virtualization (App-V) Management Server during installation. It is used to verify that the Management Server was installed and configured correctly, but it has to be published to the Microsoft Application Virtualization (App-V) Client so that the user can access it. - -Use the following procedures to publish the default application and to stream it. - -**To publish the default application** - -1. Log on to the App-V Management Server by using an account that is a member of the App-V Administrators group specified during installation. - -2. On the App-V Management Server, click **Start**, click **Administrative Tools**, and then click **Application Virtualization Management Console**. - -3. In the App-V Management Console, click **Actions**, and then click **Connect to Application Virtualization System**. - -4. On the **Configure Connection** page, clear the **Use Secure Connection** check box. - -5. In the **Web Service Host Name** box, type the fully qualified domain name (FQDN) of the App-V Management Server, and then click **OK**. - - **Note**   - You can also use **localhost** for the Web Service Host name if it is installed on the Management Server. - - - -6. In the App-V Management Console, right-click the **Server** node, and click **System Options**. - -7. On the **General** tab, in the **Default Content Path** box, enter the Universal Naming Convention (UNC) path to the Content folder you created on the server during installation; for example, \\\\<Server Name>\\Content, and then click **OK**. - - **Important**   - Use the FQDN for the server name so that the client can resolve the name correctly. - - - -8. In the App-V Management Console, in the navigation pane, expand the **Server** node, and then click **Applications**. - -9. In the topic pane, click **Default Application**, and then, in the **Actions** pane, click **Properties**. - -10. In the **Properties** dialog box, next to the **OSD Path** box, click **Browse**. - -11. In the **Open** dialog box, enter the UNC path to the Content folder you created on the server during installation; for example, \\\\<Server Name>\\Content, and press ENTER. You must use the actual server name and cannot use the **localhost** here. - - **Important**   - Ensure that the values in both the **OSD Path** and **Icon Path** boxes are in UNC format (for example, \\\\<Server Name>\\Content\\DefaultApp.ico), and point to the Content folder you created when installing the server. Do not use **localhost** or a file path containing a drive letter such as C:\\Program Files\\..\\..\\Content. - - - -12. Select the DefaultApp.osd file, and click **Open**. - -13. Repeat the previous steps to configure the icon path. - -14. Click the **Access Permissions** tab, and confirm that the App-V Users group has access permissions to the application. - -15. Click the **Shortcuts** tab, and then click **Publish to User’s Desktop**. Click **OK**. - -16. Open Windows Explorer, and locate the Content directory. - -17. Double-click the DefaultApp.osd file, and open it with Notepad. - -18. Locate the line that contains the **HREF** tag, and change it to the following code: - - `CODEBASEHREF=”RTSP://:554/DefaultApp.sft”` - - Or, if you are using RTSPS: - - `CODEBASEHREF=”RTSPS://:322/DefaultApp.sft”` - -19. Close the DefaultApp.osd file, and save the changes. - -**To stream the default application** - -1. On the computer that has the App-V Client installed, log on as a user who is a member of the Application Virtualization Users group specified during server installation. - -2. On the desktop, the **Default Application Virtualization Application** shortcut appears. Double-click the shortcut to start the application. - -3. A status bar, displayed above the Windows notification area, reports that the application is starting. If the application startup is successful, the title screen for the default application is displayed. Click **OK** to close the dialog box. You have now confirmed that the App-V system is running correctly. - -## Related topics - - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-application-virtualization-management-server.md b/mdop/appv-v4/how-to-install-application-virtualization-management-server.md deleted file mode 100644 index 9fff92bc25..0000000000 --- a/mdop/appv-v4/how-to-install-application-virtualization-management-server.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: How to Install Application Virtualization Management Server -description: How to Install Application Virtualization Management Server -author: dansimp -ms.assetid: 8184be79-8c27-4328-a3c1-183791b5556c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install Application Virtualization Management Server - - -The Application Virtualization Management Server publishes its applications to clients. In a load-balanced environment, which is typical of large deployments, all servers in a server group should stream the same applications. If Application Virtualization Management Servers are to publish different applications, assign the servers to different server groups. In this case, you also might need to increase a server group's capacity. - -If you have designated a target computer on the network, with a login account having local Administrator privileges, you can use the following procedure to install the Application Virtualization Management Server and assign it to the appropriate server group. - -**Note** -The Installation Wizard can create a server group record, if one does not exist, as well as a record of the Application Virtualization Management Server's membership in this group. - - - -After you complete the installation process, reboot the server. - -**To install an Application Virtualization Management Server** - -1. Verify and, if necessary, uninstall previous versions of the Application Virtualization Management Server that are installed on the target computer. - -2. To open the **Microsoft Application Virtualization Management Server installation** wizard, navigate to the location of the Application Virtualization System **setup.exe** program on the network, either run this program from the network or copy its directory to the target computer, and then double-click the **Setup.exe** file. - -3. On the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, read the license agreement and, to accept the license agreement, select **I accept the license terms and conditions**. Click **Next**. - -5. On the **Registering Information** page, you must enter the user name and the **Organization**. Click **Next**. - -6. On the **Setup Type** page, select **Custom**. Click **Next**. On the **Custom Setup** page, deselect all Application Virtualization System components except **Application Virtualization Server**, and then click **Next**. - - **Caution** - If a component is already installed on the computer, when you deselect it in the **Custom Setup** window, the component is automatically uninstalled. - - - -7. On the **Configuration Database** page, select a database server from the list of available servers or add a server by selecting **Use the following host name** and specifying the **Server Name** and **Port Number** data. Click **Next**. - - **Note** - The Application Virtualization Management Server does not support case sensitive SQL. - - - -~~~ -If a database is available, click the radio button, select the database from the list, and then click **Next**. Setup will upgrade it to this newer version. If the name does not appear in the list, enter the name in the space provided. - -**Note** -When naming a server, do not use the backslash character (/) in the server name. - -If you need to install a database, see [How to Install a Database](how-to-install-a-database.md). If you would like to create a new database for this version, select **Create a new database** and specify the name that will be assigned to the new database. You can also specify a new location for the database by selecting the check box and entering the path. -~~~ - - - -8. On the **Connection Security Mode** page, select the desired certificate from the drop-down list. Click **Next**. - - **Note** - The **Secure Connection Mode** setting requires the server to have a server certificate provisioned to it from a public key infrastructure. If a server certificate is not installed on the server, this option is unavailable and cannot be selected. You must grant the Network Service account read access to the certificate being used. - - - -9. On the **TCP Port Configuration** page, to use the default port (554), select **Use default port (554)**. To specify a custom port, select **Use custom port** and specify the port number that will be used. Click **Next**. - - **Note** - When you install the server in a nonsecure environment, you can use the default port (554) or you can define a custom port. - - - -10. On the **Administrator Group** page, specify the name of the security group authorized to manage this server in **Group Name**. Click **Next**. Confirm the group specified and click **Next**. - -11. On the **Default Provider Group** page, specify the name of the default provider group, and then click **Next**. - -12. On the **Content Path** page, specify the location on the target computer where SFT files will be saved, and then click **Next**. - - **Note** - If the HTTP or RTSP port for the Management Server is already allocated, you will be prompted to choose a new port. Select the desired port, and then click **Next**. - - - -13. On the **Ready to Install the Program** page, to install the Application Virtualization Management Server, click **Install**. - - **Note** - If error 25120 is displayed when you try to complete this step, you need to enable IIS **Management Scripts and Tools**. To enable this Windows feature, open the **Programs and Features** control panel, select **Turn Windows features on or off**, and navigate to **Internet Information Services.** - - Under **Web Management Tools**, enable **IIS Management Scripts and Tools**. - - - -14. On the **Installation Wizard Completed** screen, to close the wizard, click **Finish**. - - **Important** - The installation can take a few minutes to finish. A status message will flash above the Windows desktop notification area, indicating that the installation succeeded. - - It is not necessary to reboot the computer when prompted. However, to optimize system performance, a reboot is recommended. - - - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md deleted file mode 100644 index 37596836cd..0000000000 --- a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Install the App-V Client by Using Setup.exe -description: How to Install the App-V Client by Using Setup.exe -author: dansimp -ms.assetid: 106a5d97-b5f6-4a16-bf52-a84f4d558c74 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the App-V Client by Using Setup.exe - - -This topic describes how to install the App-V client by using the setup.exe program. When you install the App-V client using the setup.exe program, the installer determines which prerequisite software is needed and installs it automatically before it installs the client. - -**To install the Application Virtualization Client by Using Setup.exe** - -1. Make sure you are logged on with an account that has administrator rights on the computer. - -2. Open a Command Prompt window, and then change the directory to the folder that contains the setup files. When installing version 4.6 or a later version of the App-V client, you must use the correct installer for the computer’s operating system, 32-bit or 64-bit. The installation will fail and an error message will be displayed if you use the wrong installer. - -3. Enter the install command string at the command prompt. Alternatively, you can create a command file and run it from the command prompt. You can also use a scripting language such as VBScript or Windows PowerShell to run the command. - -4. The following command-line example shows how setup.exe can be used with a number of optional parameters. For more information about these parameters, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md). - - **"setup.exe" /s /v"/qn SWICACHESIZE=\\"10240\\" SWIPUBSVRDISPLAY=\\"Production System\\" SWIPUBSVRTYPE=\\"HTTP /secure\\" SWIPUBSVRHOST=\\"PRODSYS\\" SWIPUBSVRPORT=\\"443\\" SWIPUBSVRPATH=\\"/AppVirt/appsntype.xml\\" SWIPUBSVRREFRESH=\\"on\\" SWIGLOBALDATA=\\"D:\\AppVirt\\Global\\" SWIUSERDATA=\\"^% LOCALAPPDATA ^%\\Windows\\Application Virtualization Client\\" SWIFSDRIVE=\\"Q\\""** - - **Important**   - - The quotation marks that appear in the "**/v**" section must be treated as special characters and entered with a preceding "**\\**". The quotation marks are required only when the value contains a space; however, for consistency, all the instances in the preceding example are shown as having quotation marks. - - - The "**%**" characters in "**%HomeDrive%**" must be preceded by the "**^**" escape character. Otherwise, the Windows command shell sets the value to that of the user who is performing the installation. - - - The **InstallShield** switches **/s** and **/qn** are needed to make this a silent install. The **/qn** switch must follow the **/v** switch, separated by only a quote character with no intervening spaces. - - - The folder specified in the **SWIGLOBALDATA** value must already exist. - -   - -5. When the installation is complete, we recommend that you run a Microsoft Update scan to ensure the latest updates are installed. - -## Related topics - - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md deleted file mode 100644 index 5485cfe6f6..0000000000 --- a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -title: How to Install the App-V Client by Using Setup.msi -description: How to Install the App-V Client by Using Setup.msi -author: dansimp -ms.assetid: 7221f384-36d6-409a-94a2-86f54fd75322 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install the App-V Client by Using Setup.msi - - -This topic describes how to install the App-V client by using the setup.msi program. Before you install the App-V client using the setup.msi program, you must first determine if any prerequisite software must be installed, and then you must install it. To install the prerequisite software, see the [Installing Prerequisite Software](#prereq-sw) section of this topic. To install the client software, see the [Installing the App-V Client Using the Setup.msi Program](#msi-setup) section of this topic. - -## Installing Prerequisite Software - - -You can use the following procedures to install the prerequisite software. You can create a command file and run the commands from the command prompt, or you can use a scripting language such as VBScript or Windows PowerShell to run the commands. - -**Note**   -The x86 versions of the following software are required for both x86 and x64 versions of the App-V client. - - - -**To install Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)** - -1. Download the [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) software package from the Microsoft Download Center (). \[Template Token Value\] For version 4.5 SP2 and later of the App-V client, download vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).\[Template Token Value\] - -2. To install silently, use the command-line option “/Q” with vcredist\_x86.exe—for example, **vcredist\_x86.exe /Q**. - -3. To install the software by using the vcredist\_x86.msi file, use the command-line option “/C /T:<fullpathtofolder>” to extract the files vcredist.msi and vcredis1.cab from vcredist\_x86.exe to a temporary folder. To install silently, use the command-line option /quiet—for example, **msiexec /i vcredist.msi** /quiet. - -### To install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) - -**Important**   -For version 4.6 and later of the App-V client, you must also install the Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update. - - - -**** - -1. Download the [Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=150700) software package from the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=150700). - -2. To install silently, use the command-line option “/Q” with vcredist\_x86.exe—for example, **vcredist\_x86.exe /Q**. - -### To install Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) - -**** - -1. Download the [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) software package from the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=63266). - -2. To install silently, use the command-line option /quiet—for example, **msiexec /i msxml6\_x86.msi /quiet**. - -### To install Microsoft Application Error Reporting - -When installing Microsoft Application Error Reporting, you must use the *APPGUID* parameter to specify the App-V product code. The product code is unique for each App-V client type and version. Select the correct product code from the following table. - -**Important**   -For App-V 4.6 SP2 and later, you no longer need to install Microsoft Application Error Reporting (dw20shared.msi). App-V now uses Microsoft Error Reporting. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    VersionProduct Code for Desktop ClientProduct Code for Client for Remote Desktop Services

    App-V 4.5 CU1

    FE495DBC-6D42-4698-B61F-86E655E0796D

    8A97C241-D92A-47DC-B360-E716C1AAA929

    App-V 4.5 SP1

    93468B43-C19D-44F9-8BCC-114076DB0443

    0042AD3C-99A4-4E58-B5F0-744D5AD96E1C

    App-V 4.5 SP2

    C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D

    ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5

    App-V 4.6 x86

    9E9D30B2-2065-4FDE-B756-8F1A6EABAFC3

    439FAC21-B423-41D4-8126-54F9FCB70039

    App-V 4.6 x64

    E569E45F-7BA6-4C7F-B6BA-3FFCBE92FC22

    D2977C18-D88A-47CB-AFD8-652DD36F4D0D

    App-V 4.6 x86 ¹

    40C3258B-F9D1-46DF-AE97-72C1F86F2427

    9915D911-CC73-4122-AF4F-564F89454655

    App-V 4.6 x64 ¹

    1650E31F-23B8-40B5-A60A-C5934F557E3B

    7580D918-C621-49E7-9877-3CC59F9BD1DA

    App-V 4.6 x86 SP1

    DB9F70CD-29BC-480B-8BA2-C9C2232C4553

    1354855A-2298-4C73-9022-EF0686C65991

    App-V 4.6 x64 SP1

    342C9BB8-65A0-46DE-AB7A-8031E151AF69

    B2C6C8D5-FE76-4056-A326-EE5D633EA175

    - - - -¹ App-V “Languages” release. - -**Note**   -If you need to find the product code, you can use the Orca.exe database editor or a similar tool to examine Windows Installer files to find the value of the *ProductCode* property. For more information about using Orca.exe, see [Windows Installer Development Tools](https://go.microsoft.com/fwlink/?LinkId=150008) (https://go.microsoft.com/fwlink/?LinkId=150008). - - - -**** - -1. Locate the Microsoft Application Error Reporting install program, dw20shared.msi, which can be found in the **Support\\Watson** folder on the release media. - -2. To install the software, run the following command: - - **msiexec /i dw20shared.msi APPGUID={valuefromtable} REBOOT=Suppress REINSTALL=ALL REINSTALLMODE=vomus** - -## Installing the App-V Client by Using the Setup.msi Program - - -Use the following procedure to install the App-V client. Ensure that any necessary prerequisite software has been installed. \[Template Token Value\] For version 4.6 and later of the App-V client, the setup.msi program checks the system and if prerequisite software is not installed, it generates an error message indicating that installation cannot continue. \[Template Token Value\] - -**To install the Application Virtualization Client by Using Setup.msi** - -1. Make sure you are logged on with an account that has administrator rights on the computer. - -2. Open a Command Prompt window by using elevated rights, and then change the directory to the folder that contains the setup files. When installing version 4.6 or a later version of the App-V client, you must use the correct installer for the computer’s operating system, 32-bit or 64-bit. The installation will fail and an error message will be displayed if you use the wrong installer. - -3. Enter the install command string at the command prompt. Alternatively, you can create a command file and run it from the command prompt. You can also use a scripting language such as VBScript or Windows PowerShell to run the command. - -4. The following command-line example shows how setup.msi can be used with a number of optional parameters. For more information about these parameters, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md). - - **msiexec.exe /i "setup.msi" SWICACHESIZE="10240" SWIPUBSVRDISPLAY="Production System" SWIPUBSVRTYPE="HTTP /secure" SWIPUBSVRHOST="PRODSYS" SWIPUBSVRPORT="443" SWIPUBSVRPATH="/AppVirt/appsntype.xml" SWIPUBSVRREFRESH="on" SWIGLOBALDATA="D:\\AppVirt\\Global" SWIUSERDATA="^% LOCALAPPDATA^%\\Windows\\Application Virtualization Client" SWIFSDRIVE="S" /q** - - **Important**   - - The Windows Installer switch "**/q**" is used to make this a silent installation. - - - The "**%**" characters in "**%HomeDrive%**" must be preceded by the "**^**" escape character. Otherwise, the Windows command shell sets the value to that of the user who is performing the installation. - - - To turn on installation logging, use the msiexec switch **/l\*v filename.log**. - - - -## Related topics - - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md b/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md deleted file mode 100644 index 5cf9e908d7..0000000000 --- a/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Install the Application Virtualization Sequencer -description: How to Install the Application Virtualization Sequencer -author: dansimp -ms.assetid: 89cdf60d-18b0-4204-aa9f-b402610f8f0e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Application Virtualization Sequencer - - -The Microsoft Application Virtualization Sequencer monitors and records the installation and setup process for applications so that the application can be run as a virtual application. You should install the Sequencer on a computer that has only the operating system installed. Alternatively, you can install the Sequencer on a computer running a virtual environment—for example, Microsoft Virtual PC. This method is useful because it is easier to maintain a clean sequencing environment that can be reused with minimal additional configuration. - -You must have administrative rights on the computer you are using to sequence the application and the computer must not be running any version of the Application Virtualization (App-V) client. Creating a virtual application by using the Sequencer is very resource intensive, so it is important that you install the Sequencer on a computer that meets or exceeds the recommended requirements. Running the App-V sequencer in Safe Mode is not supported. For more information about the system requirements, see [Application Virtualization System Requirements](application-virtualization-system-requirements.md). - -**Important**   -After you have sequenced an application, before you can properly sequence a new application you must reinstall the operating system and the Sequencer on the computer you are using to sequence applications. - - - -**To install the Microsoft Application Virtualization Sequencer** - -1. Copy the Microsoft Application Virtualization Sequencer installation files to the computer that you want to install it on. - -2. To start the Microsoft Application Virtualization Sequencer installation wizard, select **setup.exe**. If the **Microsoft Visual C++ SP1 Redistributable Package (x86)** is not detected prior to installation, **setup.exe** will install it. - -3. On the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the terms of the license agreement, select **I accept the terms in the license agreement**. Click **Next**. - -5. On the **Destination Folder** page, to accept the default installation folder, click **Next**. To specify a different destination folder, click **Change** and specify the installation folder that will be used for the installation. Click **Next**. - -6. On the **Ready to Install the Program** page, to start the installation, click **Install**. - -7. On the **InstallShield Wizard Completed** page, to close the installation wizard and open the Sequencer, click **Finish**. To close the installation wizard without opening the Sequencer, deselect **Launch the program** and click **Finish**. - -## Related topics - - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) - -[Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md b/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md deleted file mode 100644 index b6facad249..0000000000 --- a/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: How to Install the Application Virtualization Streaming Server -description: How to Install the Application Virtualization Streaming Server -author: dansimp -ms.assetid: a3065257-fb5a-4d92-98f8-7ef996c61db9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Application Virtualization Streaming Server - - -The Application Virtualization Streaming Server publishes its applications to clients. In a load-balanced environment, which is typical of large deployments, all servers in a server group should stream the same applications. If Application Virtualization Streaming Servers are to stream different applications, assign the servers to different server groups. In this case, you might also have to increase a server group's capacity. - -If you have designated a target computer on the network, with a logon account having local administrative privileges, you can use the following procedure to install the Application Virtualization Streaming Server and assign it to the appropriate server group. - -**Note**   -The Installation Wizard can create a server group record, if one does not exist, and a record of the Application Virtualization Streaming Server membership in this group. - - - -After you complete the installation process, restart the server. - -**To install an Application Virtualization Streaming Server** - -1. Verify that no earlier versions of the Application Virtualization Streaming Server are installed on your target computer. - - **Important**   - Make sure that the App-V Management Server is not installed on this computer. The two products cannot be installed on the same computer. - - - -2. Navigate to the location of the Application Virtualization System Setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click the **Setup.exe** file. - -3. On the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the license terms, select **I accept the licensing terms and conditions**, and then click **Next**. - -5. On the **Customer Information** page, specify the **User name** and the organization, and then click **Next**. - -6. On the **Installation Path** page, click **Browse**, specify the location where you want to install the Streaming Server, and then click **Next**. - -7. On the **Connection Security Mode** page, select the desired certificate from the drop-down list, and then click **Next**. - - **Note**   - The **Secure Connection Mode** setting requires the server to have a server certificate provisioned to it from a public key infrastructure. If a server certificate is not installed on the server, this option is unavailable and cannot be selected. You must grant the Network Service account read access to the certificate being used. - - - -8. On the **TCP Port Configuration** page, to use the standard port (554), select **Use default port (554)**. To specify a custom port, select **Use custom port**, specify the port number in the field provided, and then click **Next**. - - **Note**   - When you install the server in a nonsecure scenario, you can use the default port (554), or you can define a custom port. - - - -9. On the **Content Root** page, specify the location on the target computer where SFT files will be saved, and then click **Next**. - - **Note**   - If the HTTP or RTSP port for the Virtual Application Streaming Server is already allocated, you will be prompted to select a new port. Specify the desired port, and then click **Next**. - - - -10. On the **Advanced Setting** screen, enter the following information: - - 1. **Max client connections** - - 2. **Connection timeout (sec)** - - 3. **RTSP thread pool size** - - 4. **RTSP timeout (sec)** - - 5. **Number of core processes** - - 6. **Core timeout (sec)** - - 7. **Enable User authentication** - - 8. **Enable User authorization** - - 9. **Cache block size (KB)** - - 10. **Maximum cache size (MB)** - - **Note**   - The App-V Streaming Server uses NTFS file system permissions to control access to the applications under the Content share. Use **Enable User authentication** and **Enable User authorization** to control whether the server checks and enforces those access control lists (ACLs) or not. - - - -11. On the **Ready to Install the Program** page, to start the installation, click **Install**. - -12. On the **Installation Wizard Completed** screen, to close the wizard, click **Finish**. - - **Important**   - The installation can take several minutes to finish. A status message will flash above the Windows desktop notification area, indicating that the installation succeeded. - - It is not required to restart the computer when you are prompted. However, to optimize system performance, we recommend a restart. - - - -13. Repeat Steps 1–12 for each Virtual Application Server that you have to install. - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md b/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md deleted file mode 100644 index 69e3331059..0000000000 --- a/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Install the Client by Using the Command Line -description: How to Install the Client by Using the Command Line -author: dansimp -ms.assetid: ed372403-64ff-48ff-a3cd-a46cad04a4d5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install the Client by Using the Command Line - - -The topics in this section include procedures to install either the Application Virtualization (App-V) Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services) by using either setup.exe or setup.msi. Administrative rights are required to run either setup program. - -You can use optional command-line parameters to apply specific configuration settings to the App-V client during the installation. For more information about using parameters, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md). If you have applied registry settings to a computer before deploying a client—for example, by using Group Policy—these settings are retained and any additional command line parameters are applied. Command line parameter values will replace any existing value for the same setting. - -**Note**   -When you install the App-V client to use with a read-only cache, for example with a VDI server implementation, you must set the *AUTOLOADTARGET* parameter to NONE to prevent the client from trying to update applications when the cache is read-only. - - - -For more information about setting these parameter values after installation, see [How to Configure the App-V Client Registry Settings by Using the Command Line](https://go.microsoft.com/fwlink/?LinkId=169355) (https://go.microsoft.com/fwlink/?LinkId=169355) in the Application Virtualization (App-V) Operations Guide. - -**Note**   -If a configuration setting on the user’s computer depends on the client installation path, note that the Application Virtualization (App-V) 4.5 client copies its installation files to a different folder than previous versions did. By default, a new installation of the App-V 4.5 client will copy its installation files to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, running the App-V 4.5 client installer will perform an upgrade of the existing client using the existing installation folder. - - - -\[Template Token Value\] - -**Note**   -For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL is copied to the Windows\\system32 directory. If the App-V client is installed on a 64-bit system, SFTLDR\_WOW64.DLL is copied to the Windows\\SysWOW64 directory. - - - -\[Template Token Value\] - -## In This Section - - -The following topics describe how to install either the Application Virtualization (App-V) Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services) by using either setup.exe or setup.msi. - -[How to Install the App-V Client by Using Setup.exe](how-to-install-the-app-v-client-by-using-setupexe-new.md) -Provides a step-by-step procedure for installing the App-V client by using the setup.exe program. - -[How to Install the App-V Client by Using Setup.msi](how-to-install-the-app-v-client-by-using-setupmsi-new.md) -Provides step-by-step procedures for installing any prerequisite software and also the App-V client by using the setup.msi program. - -## Related topics - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -[How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-management-console.md b/mdop/appv-v4/how-to-install-the-management-console.md deleted file mode 100644 index df74e0f969..0000000000 --- a/mdop/appv-v4/how-to-install-the-management-console.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Install the Management Console -description: How to Install the Management Console -author: dansimp -ms.assetid: 586d99c8-bca6-42e2-a39c-a696053142f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Management Console - - -You can use the following procedure to install the Application Virtualization Management Console on a target computer on the network. You must use a network account that has administrator privileges on the target computer. You can use the console to configure and manage the Application Virtualization System Platform. - -Before you can complete this procedure, you must install the Application Virtualization Management Web Service on this or a different computer. The Management Web Service allows you to access the data store and the domain controller. For more information about installing the Web service, see [How to Install the Management Web Service](how-to-install-the-management-web-service.md). - -**To install the Management Console** - -1. Verify that no previous versions of the Management Console are installed on the target computer. - -2. Navigate to the location of the Application Virtualization System setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click **Setup.exe**. - -3. On the **Welcome Page**, click **Next**. - -4. On the **License Agreement** page, to accept the license agreement, select **I accept the license terms and conditions**, and then click **Next**. - -5. On the **Registration Information** page, specify the **User Name** and **Organization** information, and then click **Next**. - -6. On the **Setup Type** page, click **Custom** and then click **Next**. - -7. On the **Custom Setup** page, deselect all Application Virtualization System components except **Management Console**, and then click **Next**. - - **Note**   - If a component is already installed on the computer, by deselecting it on the Custom Setup screen, it will automatically be uninstalled. - - - -8. On the **Ready to Modify the Program** screen, click **Install**. - - **Note**   - If this is the first component you install, the **Ready to Install the Program** page is displayed. To start the installation, click **Install**. - - - -9. On the **Installation Wizard Completed** screen, click **Finish**. Click **Okay** to restart the computer and complete the installation. - -10. In the Windows Control Panel, double-click **Administrative Tools** and then click **Application Virtualization Management Console** to display the Management Console. - -11. Click the **Connect** icon, or right-click the **Application Virtualization Systems** container, and then click **Connect to Application Virtualization System**. - -12. On the **Connect to Application Virtualization System** screen, enter the host name and port of the Management Web Service computer, change the security information and login credentials if necessary, and then click **OK**. - -13. After connecting to the Management Web Service computer, click **File** on the **Console** menu, and then click **Exit**. Click **Yes** to save console settings. - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-management-web-service.md b/mdop/appv-v4/how-to-install-the-management-web-service.md deleted file mode 100644 index 72f0d59456..0000000000 --- a/mdop/appv-v4/how-to-install-the-management-web-service.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: How to Install the Management Web Service -description: How to Install the Management Web Service -author: dansimp -ms.assetid: cac296f5-8ca0-4ce7-afdb-859ae207d2f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Management Web Service - - -Use the following procedure to install the Application Virtualization Management Web Service on a target computer on the network, with a logon account having local administrative privileges. Although it is not required, we recommended that you install this component on your Web server. - -**To install the Management Web Service** - -1. Verify that no previous versions of the Application Virtualization Web Service are installed on your target computer. - -2. Navigate to the location of the Application Virtualization System setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click **Setup.exe**. - -3. After the Installation Wizard opens, on the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the license agreement, select **I accept the license terms and conditions**, and then click **Next**. - -5. On the **Registration Information** page, specify the **User Name** and organization information, and then click **Next**. - -6. On the **Setup Type** page, click **Custom**, and then click **Next**. - - **Note**   - If this is not the first component you installed on this computer, the **Program Maintenance** page is displayed. On the **Program Maintenance** page, click **Modify**. - - - -7. On the **Custom Setup** page, clear all Application Virtualization System components except **App Virt Management Service**, and then click **Next**. - - **Note**   - If a component is already installed on the computer, by clearing it on the **Custom Setup** page, you will automatically uninstall it. - - - -8. On the **Database Server** page, click **Connect to available database**, and then click **Next**. - - **Note**   - In a production environment, Microsoft assumes that you will connect to an existing database. If you want to install a database, see [How to Install a Database](how-to-install-a-database.md). After installing the database, continue with step 13. - - - -9. On the **Database Server Type** page, select a database type from the list, and then click **Next**. - -10. On the **Database Server Location** page, select a database server from the list of available servers or add a server by selecting the **Use the following host name** check box and entering information in the **Server Name** and **Port Number** boxes, and then click **Next**. - -11. On the **Select Database** page, select the database you want, and then click **Next**. - -12. On the **Database User Configuration** page, enter the credentials that the Management Web Service will use to access the data store, and then click **Next**. - -13. On the **Ready to Modify the Program** page, click **Install**. - - **Note**   - If this is the first component you install, the **Ready to Install the Program** page is displayed. On the page, click **Install**. - - - -14. On the **Installation Wizard Completed** page, click **Finish**. - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md b/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md deleted file mode 100644 index ea900036a2..0000000000 --- a/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: How to Install the Sequencer (App-V 4.6 SP1) -description: How to Install the Sequencer (App-V 4.6 SP1) -author: dansimp -ms.assetid: fe8eb876-28fb-46ae-b592-da055107e639 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Sequencer (App-V 4.6 SP1) - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records the installation and setup process for applications so that the application can be run as a virtual application. You should install the App-V Sequencer on a computer that has only the operating system installed. Alternatively, you can install the Sequencer on a computer running in a virtual environment, for example, a virtual computer. This method is useful because it is easier to maintain a clean sequencing environment that you can reuse with minimal additional configuration. - -You must have administrative credentials on the computer you are using to sequence the application, and the computer must not be running any version of App-V client. Creating a virtual application by using the App-V Sequencer requires multiple operations, so it is important that you install the Sequencer on a computer that meets or exceeds the [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md). - -**Note** -Running the App-V sequencer in Safe Mode is not supported. - - - -**To install the Microsoft Application Virtualization Sequencer** - -1. Copy the Microsoft Application Virtualization Sequencer installation files to the computer on which you want to install it. - -2. To start the Microsoft Application Virtualization Sequencer installation wizard, double-click **Setup.exe**. If the **Microsoft Visual C++ SP1 Redistributable Package (x86)** is not detected prior to installation, click **Install** to install the required prerequisite. - -3. To continue the installation, on the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the terms of the license agreement, click **I accept the terms in the license agreement**, and then click **Next**. - -5. On the **Destination Folder** page, to accept the default installation folder, click **Next**. To specify a different destination folder, click **Change** and specify the installation folder that will be used for the installation. Click **Next**. - -6. On the **Virtual Drive** page, to configure the Application Virtualization default drive **Q:\\** (default) as the drive that all sequenced applications will run from, click **Next**. If you want to specify a different drive letter, use the list and select the drive letter that you want to use by selecting the appropriate drive letter, and then click **Next**. - - **Important** - The Application Virtualization drive letter specified with this step is the drive letter that virtual applications will be run from on target computers. The drive letter specified must be available, and not currently in use on the computers running the App-V client. If the specified drive is already in use, the virtual application fails on the target computer. - - - -7. On the **Ready to Install the Program** page, to start the installation, click **Install**. - -8. On the **InstallShield Wizard Completed** page, to close the installation wizard and open the App-V Sequencer, click **Finish**. To close the installation wizard without opening the Sequencer, clear **Launch the program**, and then click **Finish**. - - **Note** - If you installed the App-V Sequencer on a computer running a virtual environment, for example a virtual machine, you must now take a snapshot. After you sequence an application, you can revert to this image, so you can sequence the next application. - - - -~~~ -When you uninstall the Sequencer, the following registry keys are not removed from the computer that the Sequencer was installed on. Additionally, you must restart the computer after you have uninstalled the Sequencer so that all associated drivers can be stopped and the operation can be completed. - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid** - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5** - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard** - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\SecKey** -~~~ - -## Related topics - - -[Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-install-the-sequencer.md b/mdop/appv-v4/how-to-install-the-sequencer.md deleted file mode 100644 index decce9699a..0000000000 --- a/mdop/appv-v4/how-to-install-the-sequencer.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Install the Sequencer -description: How to Install the Sequencer -author: dansimp -ms.assetid: 2cd16427-a0ba-4870-82d1-3e3c79e1959b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Sequencer - - -The Microsoft Application Virtualization (App-V) Sequencer monitors and records the installation and setup process for applications so that the application can be run as a virtual application. You should install the Sequencer on a computer that has only the operating system installed. Alternatively, you can install the Sequencer on a computer running a virtual environment—for example, Microsoft Virtual PC. This method is useful because it is easier to maintain a clean sequencing environment that can be reused with minimal additional configuration. - -You must have administrative rights on the computer you are using to sequence the application and the computer must be connected to the network. The computer must not be running any version of the Application Virtualization (App-V) client. Creating a virtual application using the Sequencer is very resource intensive, so it is important that you install the Sequencer on a computer that meets or exceeds the recommended requirements. For more information about the system requirements, see [Sequencer Hardware and Software Requirements](sequencer-hardware-and-software-requirements.md).. - -**To install the Microsoft Application Virtualization Sequencer** - -1. Copy the Microsoft Application Virtualization Sequencer installation files to the computer that you want to install it on. - -2. To start the Microsoft Application Virtualization Sequencer installation wizard, select **setup.exe**. If the **Microsoft Visual C++ SP1 Redistributable Package (x86)** is not detected prior to installation, **setup.exe** will install it. - -3. On the **Welcome** page, click **Next**. - -4. On the **License Agreement** page, to accept the terms of the license agreement, select **I accept the terms in the license agreement**. Click **Next**. - -5. On the **Destination Folder** page, to accept the default installation folder, click **Next**. To specify a different destination folder, click **Change** and specify the installation folder that will be used for the installation. Click **Next**. - -6. On the **Ready to Install the Program** page, to start the installation, click **Install**. - -7. On the **InstallShield Wizard Completed** page, to close the installation wizard and open the Sequencer, click **Finish**. To close the installation wizard without opening the Sequencer, deselect **Launch the program** and click **Finish**. - -## Related topics - - -[Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-install-the-servers-and-system-components.md b/mdop/appv-v4/how-to-install-the-servers-and-system-components.md deleted file mode 100644 index d8d537d0e8..0000000000 --- a/mdop/appv-v4/how-to-install-the-servers-and-system-components.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Install the Servers and System Components -description: How to Install the Servers and System Components -author: dansimp -ms.assetid: c6f5fef0-522a-4ef1-8585-05b292d0289b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Servers and System Components - - -Before you can deliver applications to users, you must install the Microsoft Application Virtualization Platform components. The topics in this section provide the information required to install the Application Virtualization Servers and the other Application Virtualization System components. - -**Note**   -The procedures in this section take you through a customized installation, where you pick and choose components to install on separate computers, as recommended in a production environment. However, your operating procedures might dictate a different approach, and during the installation process you might want to group components together. Regardless of where you install the components, you can install them in any order. - - - -## In This Section - - -[How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md) -Provides a step-by-step procedure for installing the Application Virtualization Management Server and assigning it to the appropriate server group. - -[How to Install the Application Virtualization Streaming Server](how-to-install-the-application-virtualization-streaming-server.md) -Provides a step-by-step procedure for installing the Application Virtualization Streaming Server and assigning it to the appropriate server group. - -[How to Install the Management Web Service](how-to-install-the-management-web-service.md) -Provides a step-by-step procedure for installing the Application Virtualization Management Web Service on a target computer on your network. - -[How to Install the Management Console](how-to-install-the-management-console.md) -Provides a step-by-step procedure for installing the Application Virtualization Management Console on a target computer on your network. - -[How to Install a Database](how-to-install-a-database.md) -Provides a step-by-step procedure for installing a database for your server-based deployment of Application Virtualization, if a database is not already available. - -[How to Remove the Application Virtualization System Components](how-to-remove-the-application-virtualization-system-components.md) -Provides step-by-step procedures to remove all or selected Application Virtualization software components from a target computer. - -## Related topics - - -[Application Virtualization Server-Based Scenario Overview](application-virtualization-server-based-scenario-overview.md) - -[How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md) - -[How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-load-files-and-packages.md b/mdop/appv-v4/how-to-load-files-and-packages.md deleted file mode 100644 index f70cbf6dc3..0000000000 --- a/mdop/appv-v4/how-to-load-files-and-packages.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Load Files and Packages -description: How to Load Files and Packages -author: dansimp -ms.assetid: f86f5bf1-99a4-44d7-ae2f-e6049c482f68 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Load Files and Packages - - -You can use the following procedure to load files and packages on Application Virtualization Servers. - -**Note**   -During the installation process, you specified the location of the \\Content directory on the **Content Path** page. This directory should be created and configured as a standard file share before you point to its location. - - - -**To load files and packages** - -1. On the computer from which you will stream applications, navigate to the location that you specified for the \\Content directory. If necessary, create the directory and configure it as a standard file share. - -2. Move the SFT files for the virtual applications and packages to the \\Content directory. To keep the SFT files organized and to avoid confusion, put applications and packages in dedicated subfolders. - -3. Load the applications and packages according to the requirements of your scenario and configuration, considering the following conditions: - - - If your applications and packages are stored on an Application Virtualization (App-V) Management Server, load them through the Management Console. For more information, see [How to Load or Unload an Application](how-to-load-or-unload-an-application.md) or [How to Load Virtual Applications from the Desktop Notification Area](how-to-load-virtual-applications-from-the-desktop-notification-area.md). - - - If your applications are stored on an App-V Streaming Server, a Web server, or a computer configured as a file server, the applications can be automatically loaded. - - **Note**   - The App-V Streaming Server automatically polls the \\Content directory for applications and packages and puts this information in RAM to service application requests. - - The App-V Clients must be properly configured to retrieve applications and packages from Web servers and file servers. For more information, see [How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md). - - - -## Related topics - - -[Application Virtualization Server](application-virtualization-server.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-load-or-unload-an-application.md b/mdop/appv-v4/how-to-load-or-unload-an-application.md deleted file mode 100644 index 5dd97091a1..0000000000 --- a/mdop/appv-v4/how-to-load-or-unload-an-application.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Load or Unload an Application -description: How to Load or Unload an Application -author: dansimp -ms.assetid: 8c149761-c591-433f-972b-91793a69c654 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Load or Unload an Application - - -You can use the following procedures to load or unload an application from the cache, directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of applications. - -**Note**   -When you load or unload a package, all the applications in the package are loaded into or removed from cache. When loading a package, if you do not have adequate space in cache to load the applications, increase your cache size. For more information about cache size, see [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md). - - - -**To load an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Load** from the pop-up menu. - -2. The application is automatically loaded. The progress is tracked in the column labeled **Package Status**. You must refresh the view to see that the load is complete or to see the progress. - -**To unload an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Unload** from the pop-up menu. - -2. The application is automatically unloaded, and the **Package Status** column is updated to reflect the change. - -## Related topics - - -[How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md deleted file mode 100644 index c089ce97ab..0000000000 --- a/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Load Virtual Applications from the Desktop Notification Area -description: How to Load Virtual Applications from the Desktop Notification Area -author: dansimp -ms.assetid: f52758eb-8b81-4b3c-9bc3-adcf7c00c238 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Load Virtual Applications from the Desktop Notification Area - - -If you are a mobile user, you might want to fully load your applications in the cache to use them during disconnected operation or offline mode. To stream applications from the Application Virtualization (App-V) Server or the Application Virtualization (App-V) Streaming Server, you must be connected to a server to load applications. If you are not connected to the server when you attempt to load applications, your system will generate an appropriate error message. You can also stream applications to the client from a file or disk. - -The applications are loaded one application at a time. The progress bar shows you the application name, the percentage of application loaded, and the number of applications already processed compared to the total number of the applications queued. You can skip any application in progress before it is 100% loaded. You can skip the loading of all remaining applications as well. - -**Note**   -If your system encounters an error while loading an application, it reports the error to you. You must dismiss the error dialog before it will load the next application. - - - -**To load all applications** - -1. Right-click the Application Virtualization System icon in the notification area. - -2. Select **Load Applications** from the pop-up menu. - -**To skip applications** - -1. Click the progress bar to display the dialog box. - -2. Select one of the following buttons to achieve the desired results: - - 1. **Skip**—To skip the currently loading application. - - 2. **Skip All**—To skip all remaining applications. - - 3. **Continue**—To cancel the dialog box and continue loading applications. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-lock-or-unlock-an-application.md b/mdop/appv-v4/how-to-lock-or-unlock-an-application.md deleted file mode 100644 index 1b2b033d69..0000000000 --- a/mdop/appv-v4/how-to-lock-or-unlock-an-application.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Lock or Unlock an Application -description: How to Lock or Unlock an Application -author: dansimp -ms.assetid: 8c65d4fd-f336-447f-8c0a-6d65aec9fd00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Lock or Unlock an Application - - -You can use the following procedures to lock or unlock any application in the Application Virtualization Desktop Client cache or the Client for Remote Desktop Services (formerly Terminal Services) cache. A locked application cannot be removed from the cache to make room for new applications. To remove a locked application from the Application Virtualization Desktop Client cache or the Client for Remote Desktop Services cache, you must first unlock it. - -**To lock an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Lock** from the pop-up menu. The selected application is locked in the cache. - -**To unlock an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Unlock** from the pop-up menu. The selected application is unlocked in the cache and can be removed. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md deleted file mode 100644 index a48df6078f..0000000000 --- a/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Manage Application Groups in the Server Management Console -description: How to Manage Application Groups in the Server Management Console -author: dansimp -ms.assetid: 46997971-bdc8-4565-aefd-f47e90d6d7a6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Application Groups in the Server Management Console - - -You can display and manage one or more applications in application groups in the Application Virtualization Server Management Console. This can be useful when you want to do the following: - -- Organize many applications into more manageable subgroups. - -- Create groups of applications specific to a department or other company division. - -- Group similar types of applications, such as financial software. - -- Simplify access permissions or license management by group. - -- Change the properties of applications and application groups within a group simultaneously. - -You can create a group, place it where you would like in the console's **Applications** tree, and import applications to the group. Then you can configure and manage the group's properties to affect all of its applications. You can also move applications among groups. - -**Note**   -Moving applications into groups does not affect the locations of their files (SFT, OSD, or SPRJ) on the server's file system. - - - -## In This Section - - -[How to Create an Application Group](how-to-create-an-application-group.md) -Provides step-by-step instructions for creating an application group. - -[How to Move an Application Group](how-to-move-an-application-group.md) -Provides step-by-step instructions for moving an application group. - -[How to Rename an Application Group](how-to-rename-an-application-group.md) -Provides step-by-step instructions for renaming an application group. - -[How to Remove an Application Group](how-to-remove-an-application-group.md) -Provides step-by-step instructions for removing or deleting an application group. - -## Related topics - - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md deleted file mode 100644 index 89c0f06825..0000000000 --- a/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Manage Application Licenses in the Server Management Console -description: How to Manage Application Licenses in the Server Management Console -author: dansimp -ms.assetid: 48503b04-0de7-48de-98ee-4623a712a341 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Application Licenses in the Server Management Console - - -The Application Virtualization Server Management Console is the interface you use to manage the Application Virtualization platform. From it, you can add, remove, configure, and control application license groups. - -**Important**   -If the App-V client Application Source Root (ASR) setting is configured to use any type of streaming source other than the Management Server, for example a Streaming Server, an IIS server, or a File server, then the Management Server is unable to enforce its licensing policy. - - - -## In This Section - - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) -Provides a procedure for creating a new application in a license group. - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) -Provides a procedure for adding an application to a license group. - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) -Provides a procedure for removing an application from a license group. - -[How to Remove an Application License Group](how-to-remove-an-application-license-group.md) -This section includes the steps necessary to delete an application license group. - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) -Provides a procedure for creating a new unlimited license group, allowing an unlimited number of users to access the applications in the group. - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) -Provides a procedure for creating a new concurrent license group, allowing a specific number of concurrent users to access the applications in the group. - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) -Provides a procedure for creating a new unlimited license group, allowing specific users to access the applications in the group. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md b/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md deleted file mode 100644 index caa426f56a..0000000000 --- a/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Manage Applications in the Client Management Console -description: How to Manage Applications in the Client Management Console -author: dansimp -ms.assetid: 15cb5133-539b-499d-adca-ed02da20194a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Applications in the Client Management Console - - -You can use the Application Virtualization Client Management Console to manage virtual applications in the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) cache. In the context of application virtualization, the cache is the area on the client computer reserved to store virtual applications. - -## In This Section - - -[How to Load or Unload an Application](how-to-load-or-unload-an-application.md) -Provides procedures for loading or unloading an application into or from the client cache. - -[How to Clear an Application](how-to-clear-an-application.md) -Provides a procedure you can use to clear the settings, file type associations, and shortcuts from the Application Virtualization Desktop Client or Client for Remote Desktop Services. - -[How to Repair an Application](how-to-repair-an-application.md) -Provides a procedure for repairing an application from the Application Virtualization Desktop Client or Client for Remote Desktop Services. - -[How to Import an Application](how-to-import-an-application.md) -Provides a procedure you can use to add a new application to the Application Virtualization Desktop Client or Client for Remote Desktop Services. - -[How to Lock or Unlock an Application](how-to-lock-or-unlock-an-application.md) -Provides procedures for locking or unlocking an application in the cache. - -[How to Delete an Application](how-to-delete-an-application.md) -Provides a procedure you can use to remove an application from the file system cache. - -[How to Change an Application Icon](how-to-change-an-application-icon.md) -Provides a procedure you can use to change the icon associated with the selected application. - -## Related topics - - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md deleted file mode 100644 index bfae14c37b..0000000000 --- a/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Manage Applications in the Server Management Console -description: How to Manage Applications in the Server Management Console -author: dansimp -ms.assetid: 21139a77-9f0f-4787-8173-a7766966ff7f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Applications in the Server Management Console - - -From the Application Virtualization Server Management Console, you can add, remove, configure, and control all applications, for one or multiple Application Virtualization Servers. - -## In This Section - - -[How to Import an Application](how-to-import-an-applicationserver.md) -Provides step-by-step instructions for importing an application by importing the Open Software Descriptor (OSD) or Sequencer Project (SPRJ) file. - -[How to Rename an Application](how-to-rename-an-application.md) -Provides step-by-step instructions for renaming an existing application. - -[How to Delete an Application](how-to-delete-an-application-server.md) -Provides step-by-step instructions for removing or deleting an application. - -[How to Manually Add an Application](how-to-manually-add-an-application.md) -Provides step-by-step instructions for manually adding an application to the servers. - -[How to Move an Application](how-to-move-an-application.md) -Provides step-by-step instructions for moving an application from one application group to another application group. - -[How to Grant Access to an Application](how-to-grant-access-to-an-application.md) -Provides step-by-step instructions for giving users access permission to applications. - -[How to Deny Access to an Application](how-to-deny-access-to-an-application.md) -Provides step-by-step instructions for denying users access permission to applications. - -[How to Change an Application Icon](how-to-change-an-application-iconserver.md) -Provides step-by-step instructions for changing the application icon. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md deleted file mode 100644 index 920445161f..0000000000 --- a/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Manage Packages in the Server Management Console -description: How to Manage Packages in the Server Management Console -author: dansimp -ms.assetid: d13d3896-8575-4d2a-8bb4-1fe15d79c390 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Packages in the Server Management Console - - -Application Virtualization packages, accessible via the **Packages** node in the Application Virtualization Server Management Console, enable you to control virtual application versions on your Application Virtualization Management Servers. - -## In This Section - - -[How to Add a Package](how-to-add-a-package.md) -Provides a step-by-step procedure for adding a package to the Application Virtualization Server Management Console. - -[How to Add a Package Version](how-to-add-a-package-version.md) -Provides a step-by-step procedure for adding a new version of the package to the Application Virtualization Server Management Console. - -[How to Delete a Package](how-to-delete-a-packageserver.md) -Provides a step-by-step procedure for deleting a package from the Application Virtualization Server Management Console. - -[How to Delete a Package Version](how-to-delete-a-package-version.md) -Provides a step-by-step procedure for deleting a specific version of a package from the Application Virtualization Server Management Console. - -[How to Upgrade a Package](how-to-upgrade-a-package.md) -Provides a step-by-step procedure for upgrading a package version on the Application Virtualization Server Management Console. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md deleted file mode 100644 index cfd2debb42..0000000000 --- a/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Manage Reports in the Server Management Console -description: How to Manage Reports in the Server Management Console -author: dansimp -ms.assetid: 28d99620-6339-43f6-9288-4aa958607c59 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Manage Reports in the Server Management Console - - -To effectively manage the Application Virtualization System, you can use the Application Virtualization Server Management Console to generate a variety of reports that provide information about the system. This information includes daily usage information for a specific application or all applications, and system error tracking. - -**Note**   -- During installation, the installation script installs only the English language version of report viewer. For the report viewer to display the correct information in other languages, it is necessary to install a language pack from the following location: . - -- When you add or edit an application in the Server Management Console, you must make sure that the application names and versions exactly match those in the OSD files. The reporting feature uses the application names and versions data fields when it identifies application usage data on which to report. If the data fields do not match, the usage records will be skipped. - -  - -## In This Section - - -[Application Virtualization Report Types](application-virtualization-report-types.md) -Contains information about the available report types. - -[How to Create a Report](how-to-create-a-reportserver.md) -Provides a step-by-step process for creating a report. - -[How to Run a Report](how-to-run-a-reportserver.md) -Provides a step-by-step process for running a report. - -[How to Print a Report](how-to-print-a-reportserver.md) -Provides a step-by-step process for printing a report. - -[How to Export a Report](how-to-export-a-reportserver.md) -Provides a step-by-step process for exporting a report. - -[How to Delete a Report](how-to-delete-a-reportserver.md) -Provides a step-by-step process for deleting a report. - -## Related topics - - -[Application Utilization Report](application-utilization-reportserver.md) - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -[Software Audit Report](software-audit-reportserver.md) - -[System Error Report](system-error-reportserver.md) - -[System Utilization Report](system-utilization-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md deleted file mode 100644 index 9287af4caa..0000000000 --- a/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Manage Servers in the Server Management Console -description: How to Manage Servers in the Server Management Console -author: dansimp -ms.assetid: 6e851c74-ea86-4fef-bb0c-e690e8e7e7eb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Servers in the Server Management Console - - -The Application Virtualization Server Management Console is your interface to manage the servers in the Application Virtualization Platform. From it, you can add, configure, and control all the Application Virtualization Management Servers. - -## In This Section - - -[How to Create a Server Group](how-to-create-a-server-group.md) -Provides a procedure for creating server groups, to help you more effectively manage your servers. - -[How to Remove a Server Group](how-to-remove-a-server-group.md) -Provides a procedure for removing server groups from the Application Virtualization System. - -[How to Add a Server](how-to-add-a-server.md) -Provides a procedure for adding servers to a server group. - -[How to Remove a Server](how-to-remove-a-server.md) -Provides a procedure for removing servers from a server group. - -[How to Change the Server Cache Size](how-to-change-the-server-cache-size.md) -Provides a procedure for changing the cache size of a server. - -[How to Change the Server Port](how-to-change-the-server-port.md) -Provides a procedure for changing the server ports. - -## Related topics - - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md b/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md deleted file mode 100644 index b3050789b3..0000000000 --- a/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Manage the App-V Client Cache Using Performance Counters -description: How to Manage the App-V Client Cache Using Performance Counters -author: dansimp -ms.assetid: 49d6c3f2-68b8-4c69-befa-7598a8737d05 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage the App-V Client Cache Using Performance Counters - - -You can use the following procedure to determine how much free space is available in the Application Virtualization (App-V) client cache by using Performance Monitor to display the information graphically. This information is captured on the client computer by a performance counter called “App Virt Client Cache,” and it includes the following counters: “Cache size (MB),” “Cache free space (MB),” and “% free space.” - -**To determine client cache space usage** - -1. Open a command prompt as administrator, or click **Start**, **Run**, type **perfmon.exe**, and click **OK**. - -2. Depending on the Windows operating system being used, click the Performance Monitor or System Monitor tool after the MMC window opens. - -3. To add counters, right-click the graph area and select **Add Counters**. - -4. Click the drop-down to display the list of available counters, scroll to find **App Virt Client Cache**, and then add the three counters. - - **Important**   - The App-V performance counters are implemented in a 32-bit DLL, so to see them, you must use the following command to start the 32-bit version of Performance Monitor: **mmc /32 perfmon.msc**. This command must be run directly on the computer being monitored and cannot be used to monitor a remote computer running a 64-bit operating system. - - - -## Related topics - - -[How to Manage Virtual Applications by Using the Command Line](how-to-manage-virtual-applications-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md b/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md deleted file mode 100644 index c88c2c0a2e..0000000000 --- a/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Manage Virtual Applications by Using the Command Line -description: How to Manage Virtual Applications by Using the Command Line -author: dansimp -ms.assetid: 88c61c20-5243-4862-83eb-5b30825f8bbf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Virtual Applications by Using the Command Line - - -This section provides information about using the SFTMIME command-line language to manage applications and packages on computers. - -## In This Section - - -[How to Add a Package by Using the Command Line](how-to-add-a-package-by-using-the-command-line.md) -Describes how to add a package to a specific computer by using SFTMIME. - -[How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md) -Describes how to remove a package from a specific computer by using SFTMIME. - -[How to Delete All Virtual Applications by Using the Command Line](how-to-delete-all-virtual-applications-by-using-the-command-line.md) -Describes how to remove all applications from a specific computer by using SFTMIME. - -[How to Manage the App-V Client Cache Using Performance Counters](how-to-manage-the-app-v-client-cache-using-performance-counters.md) -Describes how to determine free space in the client cache using the performance counters. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-manually.md b/mdop/appv-v4/how-to-manage-virtual-applications-manually.md deleted file mode 100644 index 1e5aa136e6..0000000000 --- a/mdop/appv-v4/how-to-manage-virtual-applications-manually.md +++ /dev/null @@ -1,241 +0,0 @@ ---- -title: How to Manage Virtual Applications Manually -description: How to Manage Virtual Applications Manually -author: dansimp -ms.assetid: 583c5255-d3f4-4197-85cd-2a59868d85de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Virtual Applications Manually - - -You can use the Application Virtualization (App-V) Client Management Console to manage virtual applications in the App-V Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services). App-V administrators can use perform the following tasks: - -## How to Load or Unload an App-V Application - - -You can use the following procedures to load or unload an application from the cache, directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of applications. - -**Note**   -When you load or unload a package, all the applications in the package are loaded into or removed from cache. When loading a package, if you do not have adequate space in cache to load the applications, increase your cache size. For more information about cache size, see [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md). - - - -**To load an App-V application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Load** from the pop-up menu. - -2. The application is automatically loaded. The progress is tracked in the column labeled **Package Status**. You must refresh the view to see that the load is complete or to see the progress. - -**To unload an App-V application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Unload** from the pop-up menu. - -2. The application is automatically unloaded, and the **Package Status** column is updated to reflect the change. - -## How to clear an App-V application - - -You can clear an application from the console directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you clear an application, the system removes the settings, shortcuts, and file type associations that correspond to the application and also removes the application from the user’s list of applications. - -**Note**   -When you clear an application from the console, you can no longer use that application. However, the application remains in cache and is still available to other users on the same system. After a publishing refresh, the cleared applications will again become available to you. If there are multiple applications in a package, the user's settings are not removed until all of the applications are cleared. - - - -**To clear an application from the console** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Clear** from the pop-up menu. - -2. At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation. - -## How to Repair an App-V application - - -To repair a selected application, you can perform the following procedure directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you repair an application, you remove any custom user settings and restore the default settings. This action does not change or delete shortcuts or file type associations, and it does not remove the application from cache. - -**To repair an App-V application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Repair** from the pop-up menu. - -3. At the confirmation prompt, click **Yes** to repair the application or **No** to cancel. - -## How to import an App-V application - - -You can use the following procedure to import an application into the cache directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To import an App-V application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Import** from the pop-up menu. - -2. From the **Browse** window, navigate to the location of the package file for the desired application, and then click **OK**. - - **Note**   - If you have already configured an import search path or if the SFT file is in the same path as the last successful import, step 2 is not required. - - - -## How to lock or unlock an App-V application - - -You can use the following procedures to lock or unlock any application in the Application Virtualization Desktop Client cache or the Client for Remote Desktop Services (formerly Terminal Services) cache. A locked application cannot be removed from the cache to make room for new applications. To remove a locked application from the Application Virtualization Desktop Client cache or the Client for Remote Desktop Services cache, you must first unlock it. - -**To lock an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Lock** from the pop-up menu. The selected application is locked in the cache. - -**To unlock an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Unlock** from the pop-up menu. The selected application is unlocked in the cache and can be removed. - -## How to delete an App-V application - - -When you select the **Application** node in the Application Virtualization Client Management Console, the **Results** pane displays a list of applications. You can use the following procedure to delete an application from the **Results** pane, which also removes the application from the cache. - -**Note**   -When you delete an application, the selected application will no longer be available to any users on that client. Shortcuts and file type associations are hidden, and the application is deleted from cache. However, if another application refers to data in the file system cache data for the selected application, these items will not be deleted. - -After a publishing refresh, the deleted applications will again become available to you. - - - -**To delete an application** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **Delete** from the pop-up menu. - -2. At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation. - -## How to change an App-V application icon - - -You can use the following procedure to change an icon associated with the selected application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To change an application icon** - -1. Move the cursor to the **Results** pane, and right-click the desired application. - -2. Select **Properties**. - -3. On the **General** tab, click **Change Icon**. - -4. Select the desired icon, or browse to another location to select the icon. After you've selected the icon, click **OK**. The new icon appears in the **Results** pane. - -## How to add an App-V application - - -You can use the following procedure to add an application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To add an application** - -1. In the **Results** pane, right-click and select **New Application** from the pop-up menu. - -2. On the wizard page, you can perform the following tasks: - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **OSD File Path or URL**—Enter a local absolute path, a full UNC path (shared file or directory on a network), or an HTTP URL. - - 3. **(OSD browse button)**—Displays the standard Windows **Open File** dialog box. Browse to find the desired file. - -3. Click **Finish** to add the application to the **Results** pane. - -## How to publish an App-V application shortcut - - -You can use the following procedure to publish shortcuts to an application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To publish application shortcuts** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **New Shortcut** from the pop-up menu to display the New Shortcut Wizard. - -2. On the first page of the New Shortcut Wizard, select an icon and specify a name for the shortcut. - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **Shortcut Title**—Enter the name you want to give the shortcut. This field defaults to the existing name and version of the application. - -3. On the second page of the wizard, determine the location of the published shortcut. - - 1. **The Desktop**—Select this check box to publish the shortcut to the desktop. - - 2. **The Quick Launch Toolbar**—Select this check box to publish the shortcut to the Quick Launch toolbar. - - 3. **The Send To Menu**—Select this check box to publish the shortcut to the **Send To** menu. - - 4. **Programs in the Start Menu**—When you select the **Start Menu** check box, this field becomes active. Leave this field blank to publish the shortcut directly to the root of the Programs folder, or enter a folder name or hierarchy—for example, "My\_Computer\\Office Applications." Shortcuts created this way are available only for the current user. - - 5. **Another location** and **Browse** button—When you select the **Another location** check box, this field becomes active. Enter any valid location on the computer or any available UNC path (shared file or directory on a network). The **Browse** button displays a standard Windows **File Open** dialog box. - -4. On the third page of the wizard, enter desired command-line parameters. - -5. Click **Finish** to publish the shortcuts and exit to the **Results** pane. - -## How to add a file type association for an App-V application - - -You can use the following procedure to add a file type association, using the **File Type Associations** node in the Application Virtualization Client Management Console. - -**To add a file type association** - -1. Right-click the **File Type Associations** node, and select **New Association** from the pop-up menu. - -2. Complete the first step of the dialog box by completing the following information, and then click **Next**: - - 1. **Extension**—Enter a new file name extension. This field is blank by default. - - 2. **Create a new file type with this description**—Select this radio button to enter a new file type description in the active field. This button is selected by default, and the active field is blank. - - 3. **Apply this file type to all users**—Select this check box when you want this association to be global for all users. By default, this box is cleared. - - 4. **Link this extension with an existing file type**—Select this radio button to associate the extension with an existing file type. Pick a file type from the drop-down list. When you choose this option, **Next** is changed to **Finish**. - -3. Complete the second step of the dialog box by completing the following information, and then click **Finish** to return to the Client Management Console: - - 1. **Change Icon**—Click this button to change the application icon. Select one of the available icons, or browse to a new location and select an icon. - - 2. **Open files with the selected application**—Select this radio button to open the file with an existing application. Choose an application from the drop-down list of available applications. - - 3. **Open file with the association described in this OSD file**—Select this radio button to specify an Open Software Descriptor (OSD) file that determines the application used to open the file. Use the browse button to select an existing location, or enter a path or HTTP-formatted URL in this field. - -## How to delete a file type association for an App-V application - - -You can use the following procedure to delete a file type association. The **File Type Associations** node is one level below the **Application Virtualization** node in the **Scope** pane. When you select this node, the **Results** pane displays a list of file type associations. - -**To remove a file type association** - -1. In the **Results** pane, right-click the extension of the file type association you want to delete. - -2. Select **Delete** from the pop-up menu. - -3. Click **Yes** to delete the association, or click **No** to return to the **Results** pane. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md b/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md deleted file mode 100644 index 49b1512034..0000000000 --- a/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Manage Virtual Applications Using the Command Line -description: How to Manage Virtual Applications Using the Command Line -author: dansimp -ms.assetid: 9394f34d-2b1e-4ea7-bf6f-1f56101ab4de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Virtual Applications Using the Command Line - - -Click any of the following links for more information about managing virtual applications using the command line. - -## In This Section - - -[How to Open a Sequenced Application Using the Command Line](how-to-open-a-sequenced-application-using-the-command-line.md) -Specifies how to open a virtual application using the command line. - -[How to Upgrade a Sequenced Application Package Using the Command Line](how-to-upgrade-a-sequenced-application-package-using-the-command-line.md) -Specifies how to sequence a virtual application using the command line. - -[How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md) -Specifies how to upgrade a virtual application package using the command line. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manually-add-an-application.md b/mdop/appv-v4/how-to-manually-add-an-application.md deleted file mode 100644 index b503780e0d..0000000000 --- a/mdop/appv-v4/how-to-manually-add-an-application.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Manually Add an Application -description: How to Manually Add an Application -author: dansimp -ms.assetid: c635b07a-5c7f-4ab2-ba18-366457146cb9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manually Add an Application - - -When adding an application to the Application Virtualization Management Server, it is recommended that you import it. You can add an application manually, but you must provide the precise, detailed information about the application called for in this section. - -**To manually add a new application** - -1. In the left pane, right-click the **Applications** node and choose **New Application**. - -2. In the **New Application Wizard**, complete the **General Information** dialog box: - - 1. **Application Name**—Type the name you want the users to see. - - 2. **Version**—Type the application version. - - 3. **Enabled**—This box must be selected to stream the application after you create it. - - 4. **Description**—Type an optional description for administrative use. - - 5. **OSD Path**—Browse the network to the application's Open Software Descriptor (OSD) file. This file must be in a shared network folder. - - 6. **Icon Path**—Browse to the application's ICO file. - - 7. **Application License Group**—If you have set up license groups, you can assign the application to one by selecting it in the pull-down list. - - 8. **Server Group**—If you have multiple Application Virtualization Servers, you can assign the application to one by selecting it in the pull-down list. - -3. Click **Next**. - -4. In the **Select Package** dialog box, select the related package and click **Next**. - -5. On the **Published Shortcuts** screen, select the boxes for the locations where you would like the application shortcuts to appear on the client computers and click **Next**. - -6. In the **File Associations** screen, you can add new type file associations to this application. To do so, click **Add**, enter the extension (without a preceding dot), enter a description, and click **OK**. - -7. Click **Next**. - -8. In the **Access Permissions** dialog box, click **Add**. - -9. In the **Add/Edit User Group** dialog box, navigate to the user group. You can also enter the domain and group by typing the information in the respective fields. When you finish, click **OK**. You can add other groups with the same pages. - -10. Click **Next**. - -11. On the **Summary** screen, you can review the import settings. Click **Finish** to add the application, click **Back** to change the information, or click **Cancel**. - -## Related topics - - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md b/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md deleted file mode 100644 index 3df7f2a0ee..0000000000 --- a/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: How to Manually Install the Application Virtualization Client -description: How to Manually Install the Application Virtualization Client -author: dansimp -ms.assetid: bb67f70b-d525-4317-b254-e4f084c717ab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - -# How to Manually Install the Application Virtualization Client - -There are two types of Application Virtualization Client components: the Application Virtualization Desktop Client, which is designed for installation on desktop computers, and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services), which you can install on Remote Desktop Session Host (RD Session Host) servers . Although the two client installer programs are different, you can use the following procedure to manually install either the Application Virtualization Desktop Client on a single desktop computer or the Application Virtualization Client for Remote Desktop Services on a single RD Session Host server. In a production environment, you most likely will install the Application Virtualization Desktop Client on multiple desktop computers with an automated scripted installation process. For information about how to install multiple clients by using a scripted installation process, see [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md). - -**Note** -1. If you are installing the Application Virtualization Client for Remote Desktop Services software on a RD Session Host server, advise users who have an open RDP or ICA client session with the RD Session Host server that they must save their work and close their sessions. In a Remote Desktop session, you can install the client the client manually. For more information about upgrading the client, see [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md). - -2. If you have any configuration on the user’s computer that depends on the client install path, note that the Application Virtualization (App-V) 4.5 client uses a different install folder than previous versions. By default, a new install of the Application Virtualization (App-V) 4.5 client will install to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, installing the App-V client will perform an upgrade into the existing installation folder. - -**Note** -For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL is installed in the Windows\\system32 directory. If the App-V client is installed on a 64-bit system, SFTLDR\_WOW64.DLL is installed in the Windows\\SysWOW64 directory. - -**To manually install Application Virtualization Desktop Client** - -1. After you have obtained the correct installer archive file and saved it to your computer, make sure you are logged on with an account having administrator rights on the computer and double-click the file to expand the archive. - -2. Choose the folder in which to save the files, and then open the folder after the files have been copied to it. - -3. Review the Release Notes if appropriate. - -4. Browse to find the setup.exe file, and double-click setup.exe to start the installation. - -5. The wizard checks the system to ensure that all prerequisite software is installed, and if any of the following are missing, the wizard will automatically prompt you to install them: - - - Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) - - - Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) - - - Microsoft Application Error Reporting - - **Note** - For App-V version 4.6 and later, the wizard will also install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86). - - For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [https://go.microsoft.com/fwlink/?LinkId=150700](https://go.microsoft.com/fwlink/?LinkId=150700). - - If prompted, click **Install**. Installation progress is displayed, and the status changes from **Pending** to **Installing**. Installation status changes to **Succeeded** as each step is completed successfully. - -6. When the **Microsoft Application Virtualization Desktop Client – InstallShield Wizard** is displayed, click **Next**. - -7. The **License Agreement** screen is displayed. Read the license agreement, and if you agree, click **I accept the terms in the license agreement** and then click **Next**. - - Optionally, you can click the button to read the Privacy Statement. You must be connected to the Internet to access the Privacy Statement. - -8. On the **Setup Type** screen, select the setup type. Click **Typical** to use the default program values, or click **Custom** if you want to configure the program settings during installation. - -9. If you choose **Typical**, the next screen displays **Ready to Install the Program**. Click **Install** to begin the installation. - -10. If you choose **Custom**, the **Destination Folder** screen appears. - -11. On the **Destination Folder** screen, click **Next** to accept the default folder or click **Change** to display the **Change Current Destination Folder** screen. Browse to or, in the **Folder Name** field, enter the destination folder, click **OK**, and then click **Next**. - -12. On the **Application Virtualization Data Location** screen, click **Next** to accept the default data locations or complete the following actions to change where the data is stored: - - 1. Click **Change**, and then browse to or, in the **Global Data Location** field, enter the destination folder for the global data location, and click **OK**. The Global Data Directory is where the Application Virtualization Desktop Client caches data shared by all users on the computer, like OSD files and SFT file data. - - 2. If you want to change the drive letter to be used, select the preferred drive letter from the drop-down list. - - 3. Enter a new path to store the user-specific data in the **User-specific Data Location** field if you want to change the data location. The User Data Directory is where the Application Virtualization Desktop Client stores user-specific information, like personal settings for virtualized applications. - - **Note** - This path must be different for every user, so it should include a user-specific environment variable or a mapped drive or something else that will resolve to a unique path for each user. - - 4. When you have finished making the changes, click **Next**. - -13. On the **Cache Size Settings** screen, you can accept or change the default cache size. Click one of the following radio buttons to choose how to manage the cache space: - - 1. **Use maximum cache size**. Enter a numeric value from 100–1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache. - - 2. **Use free disk space threshold**. Enter a numeric value to specify the amount of free disk space, in MB, that the Application Virtualization Client must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is currently unused. - - **Important** - To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. For more information about the cache space management feature, in the Microsoft Application Virtualization (App-V) Operations Guide, see **How to Use the Cache Space Management Feature**. - - Click **Next** to continue. - -14. In the following sections of the **Runtime Package Policy Configuration** screen, you can change the parameters that affect how the Application Virtualization client behaves during runtime: - - 1. **Application Source Root**. Specifies the location of SFT files. If used, overrides the protocol, server, and port portions of the CODEBASE HREF URL in the OSD file. - - 2. **Application Authorization**. When **Require User authorization even when cached** is checked, users are required to connect to a server and validate their credentials at least once before they are allowed to start each virtual application. - - 3. **Allow streaming from file**. Indicates whether streaming from file will be enabled, regardless of how the **Application Source Root** field is used. If not checked, streaming from files is disabled. This must be checked if **Application Source Root** contains a UNC path in the form \\\\server\\share. - - 4. **Automatically Load Application**. Controls when and how automatic background loading of applications occurs. - - **Note** - When you install the App-V client to use with a read-only cache, for example, with a VDI server implementation, set **What applications to Auto Load** to **Do not automatically load applications** to prevent the client from trying to update applications in the read-only cache. - - Click **Next** to continue. - -15. On the **Publishing Server** screen, select the **Set up a Publishing Server now** check box if you want to define a publishing server, or click **Next** if you want to complete this later. To define a publishing server, specify the following information: - - 1. **Display Name**—Enter the name you want to display for the server. - - 2. **Type**—Select the server type from the drop-down list of server types. - - 3. **Host Name** and **Port**—Enter the host name and the port in the corresponding fields. When you select a server type in the drop-down list, the port field will automatically fill with the standard port numbers. To change a port number, click the server type in the list and change the port number according to your needs. - - 4. **Path**—If you have selected either **Standard HTTP Server** or **Enhanced Security HTTP Server**, you must enter the complete path to the XML file containing publishing data in this field. If you select either **Application Virtualization Server** or **Enhanced Security Application Virtualization Server**, this field is not active. - - 5. **Automatically contact this server to update settings when a user logs in**—Select this check box if you want this server to be queried automatically when users log in to their account on the Application Virtualization Client. - - 6. When finished with the configuration steps, click **Next**. - -16. On the **Ready to Install the Program** screen, click **Install**. A screen is displayed that shows the progress of the installation. - -17. On the **Install Wizard Completed** screen, click **Finish**. - - **Note** - If the installation fails for any reason, you might need to restart the computer before trying the install again. - -## Related topics - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - -[Stand-Alone Delivery Scenario Overview](stand-alone-delivery-scenario-overview.md) diff --git a/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md b/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md deleted file mode 100644 index 4302487ce2..0000000000 --- a/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Manually Manage Applications in the Client Management Console -description: How to Manually Manage Applications in the Client Management Console -author: dansimp -ms.assetid: e29caa22-325d-457b-a177-a11f8a8ad57c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manually Manage Applications in the Client Management Console - - -This section provides procedures for using the Application Virtualization Client Management Console to manually manage your virtual applications. - -## In This Section - - -[How to Add an Application](how-to-add-an-application.md) -Provides a procedure you can use to add an application to the cache directly from the Application Virtualization Client Management Console. - -[How to Publish Application Shortcuts](how-to-publish-application-shortcuts.md) -Provides a procedure you can use to publish application shortcuts to the desktop, menus, and tool bar directly from the Application Virtualization Client Management Console. - -[How to Add a File Type Association](how-to-add-a-file-type-association.md) -Provides a procedure you can use to add a file type association to an application. - -[How to Delete a File Type Association](how-to-delete-a-file-type-association.md) -Provides a procedure you can use to delete a file type association. - -## Related topics - - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md b/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md deleted file mode 100644 index f4e1e2a14e..0000000000 --- a/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: How to Migrate the App-V SQL Database to a Different SQL Server -description: How to Migrate the App-V SQL Database to a Different SQL Server -author: dansimp -ms.assetid: 353892a1-9327-4489-a19c-4ec7bd1b736f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Migrate the App-V SQL Database to a Different SQL Server - - -The following procedures describe in detail how to migrate the SQL database of the Microsoft Application Virtualization (App-V) Management Server to a different SQL Server. - -**Important**   -This procedure requires that the App-V server service is stopped and this will prevent end-users from using their applications. - - - -**To back up the App-V SQL database** - -1. Open the Services.msc program and stop the App-V Management Server service on all Management Servers that use the database to be migrated. - -2. On the computer where the App-V database is located, open SQL Server Management Studio. - -3. Expand the **Databases** node and locate the App-V database (default name is APPVIRT). - -4. Right-click the database and select **Tasks** and then select **Back Up**. - -5. Verify that **Recovery model** is set to **SIMPLE** and the **Backup type** is set to **Full**. Change the **Backup set** and **Destination** settings if it is necessary. - -6. Click **OK** to back up the database. After the backup has completed successfully, click **OK**. - -7. Open Windows Explorer and browse to the folder that contains the database backup file, for example APPVIRT.BAK. Copy the database backup file to the destination computer that is running SQL Server. - -**To restore the App-V SQL database to the destination computer** - -1. On the destination computer, open SQL Server Management Studio, right-click the **Databases** node and select **Restore Database**. - -2. Under **Source for Restore**, choose **From device** and then click the “**…**” button. - -3. In the **Specify Backup** dialog box, make sure that the **Backup Media** is set to **File** and then click **Add**. - -4. Select the backup file that you copied from the original computer that is running SQL Server, and then click **OK**. - -5. Click **OK** and then click to select the backup set to restore. - -6. Under **Destination for restore**, click the drop-down for **To database** and select the App-V database name, for example APPVIRT. - -7. Click **OK** to start the restore. After the restore has completed successfully, click **OK**. - -8. Expand the **Security** node, right-click **Logins** and select **New Login**. - -9. In the **Login Name** field, enter the Network Service account details for the App-V Management Server in the format of DOMAIN\\SERVERNAME$. - -10. On the **General** page under **Default database** select the App-V database name, for example, APPVIRT, and then click **OK**. - -11. Under **Select a page**, click to select the **User Mapping** page. Under **Users mapped to this login**, click the check box in the **Map** column to select the App-V database. - -12. Under **Database role membership for: <appvdatabasename>**, click to select **SFTEveryone** and then click **OK**. - -13. Make sure that the Windows Firewall on the new computer that is running SQL Server is configured to allow the App-V Management Server to access the system. Under **Administrative Tools**, use the **Windows Firewall with Advanced Security** program to create an **Inbound Rule** for the port that is used by SQL Server (default is port 1433). - -**To migrate the App-V SQL Server Agent jobs** - -1. On the original computer that is running SQL Server, in SQL Server Management Studio, expand the **SQL Server Agent** node, and then expand the **Jobs** node. - -2. Right-click the following four App-V jobs and select **Script Job as | CREATE to | File**, and save each script to a folder and give each script a descriptive name. - - - **Softgrid Database (appvdbname) Check Usage History** - - - **Softgrid Database (appvdbname) Close Orphaned Sessions** - - - **Softgrid Database (appvdbname) Enforce Size Limit** - - - **Softgrid Database (appvdbname) Monitor Alert/Job Status** - -3. Copy the four script files (.sql) to the destination computer that is running SQL Server and open SQL Server Management Studio. - -4. In Windows Explorer, right-click each .sql file and then click **Run**. Each script will open in a query window in SQL Server Management Studio. Click **Execute** for each script and verify that each is completed successfully. - -5. Refresh the **Jobs** node under the **SQL Server Agent** node and confirm that the four jobs are created successfully. - -**To update the configuration of the App-V Management Server** - -1. On the App-V Management Server, modify the following registry keys: - - - **SQLServerName** = <newservername> - - - **SQLServerPort** = <newserverport> - - Then restart the App-V server service. - -2. Browse to find the file SftMgmt.udl under the App-V Management Server installation directory (default is C:\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Service). Right-click the file and select **Open**. - -3. On the **Connection** tab, enter the name of the destination computer that is running SQL Server, and then click **Test Connection**. When the test is successful, click **OK** and then click **OK** again. - -4. For App-V Management Server versions before 4.5 SP2, you must update the SQL Logging settings. Under **Server Groups**, right-click the server group the server is a member of and select **Properties**. - -5. On the **Logging** tab click to select the **SQL Database** entry and then click **Edit**. - -6. Change the **DNS Host Name** to the host name of the new computer that is running SQL Server and then click **OK**. Click **OK** two times more, and then restart the App-V server service. - -7. Open the App-V Management Console, right-click the **Applications** node and select **Refresh**. The list of applications should be displayed as before. - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md b/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md deleted file mode 100644 index 98641cae37..0000000000 --- a/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Modify a Virtual Application Package (App-V 4.6) -description: How to Modify a Virtual Application Package (App-V 4.6) -author: dansimp -ms.assetid: 346ec470-3822-48a7-95e7-61f46eb38dc2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify a Virtual Application Package (App-V 4.6) - - -The following procedure uses the Application Virtualization (App-V) Sequencer to edit the properties associated with an existing virtual application package. - -**To modify a virtual application package** - -1. To start the App-V Sequencer Console, on the computer running the Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. In the Sequencer console select **Edit a Package**. In the **Open** dialog box, locate and select the package you want to modify. - -3. Modify the application package. For more information about what properties can be modified, see [How to Determine Whether to Edit or Upgrade a Virtual Application Package](how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md). - -4. To save the modifications to the package, select **File** / **Save**. - -## Related topics - - -[How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md b/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md deleted file mode 100644 index 9ef7b06355..0000000000 --- a/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: How to Modify an Existing Virtual Application Package (App-V 4.6 SP1) -description: How to Modify an Existing Virtual Application Package (App-V 4.6 SP1) -author: dansimp -ms.assetid: f43a9927-4325-4b2d-829f-3068e4e84349 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify an Existing Virtual Application Package (App-V 4.6 SP1) - - -Use the following procedures to modify an existing virtual application package. You can use these procedures to: - -- Update an application that is part of an existing virtual application package. To perform this task, use the procedure **"To update an application in an existing application package"** in this document. - -- Modify the properties associated with an existing virtual application package. To perform this task, use the procedure **"To modify the properties associated with an existing virtual application package"** in this document. - -- Add a new application to an existing virtual application package. To perform this task, use the procedure **"To add a new application to an existing virtual application package"** in this document. - -You must have the App-V Sequencer installed to modify a virtual application package. For more information about installing the App-V Sequencer, see [How to Install the Sequencer (App-V 4.6 SP1)](how-to-install-the-sequencer---app-v-46-sp1-.md). - -**To update an application in an existing virtual application package** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package**, and then click **Next**. - -3. On the **Select Task** page, click **Update Application in Existing Package**, and then click **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application that you want to update, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the application update to fail, or for the application update to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information that is displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important**   - If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files are added to the package. - - - -6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. - - **Note**   - The sequencer monitors all changes and installations to the computer running the sequencer, including the changes and installations that are performed outside of the sequencing wizard. - - - -8. On the **Installation Report** page, you can review information about the virtual application you just updated. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop**, and then click one of the following options, **Stop all applications** or **Stop this application only**, depending on what you want. - - - -10. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. When you select this option, the package in the Sequencer console opens so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**, and then click **Create**. - -11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. - -**To modify the properties associated with an existing virtual application package** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package**, and then click **Next**. - -3. On the **Select Task** page, click **Edit Package**, and then click **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties that you want to modify, and then click **Edit**. - -5. In the Sequencer console, you can perform any of the following tasks: - - - View package properties. - - - View package change history. - - - View associated package files. - - - Edit registry settings. - - - Review additional package settings (except operating system file properties). - - - Create an associated Windows Installer (MSI). - - - Modify OSD file. - - - Compress and uncompress package. - - - Add file type associations. - - - Set virtualized registry key state (override or merge). - - - Set virtualized folder state. - - - Edit virtual file system mappings. - -6. When you have finished modifying the package properties, click **File** / **Save** to save the package,. - -**To add a new application to an existing virtual application package** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package**, and then click **Next**. - -3. On the **Select Task** page, click **Add New Application**, and then click **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that you want to add the application to, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail, or for the update to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information that is displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important**   - If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files can be added to the package. - - - -6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. This should be a new location so that you do not overwrite the existing version of the virtual application package. - - **Note**   - All changes and installations to the computer running the sequencer are monitored by the sequencer, including the changes and installations that are performed outside of the sequencing wizard. - - - -8. On the **Configure Software** page, optionally run the programs contained in the package. This step helps complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -9. On the **Installation Report** page, you can review information about the virtual application you just updated. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. If you want to customize any of the items in the following list, click **Customize**. - - - Edit the file type associations associated with an application. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - Click **Next**. - -11. On the **Edit Shortcuts** page, you can optionally configure the file type associations (FTA) that will be associated with the various applications in the package. To create a new FTA, select and expand the application that you want to customize in the left pane, and then click **Add**. In the **Add File Type Association** dialog box, provide the necessary information for the new FTA. To review the shortcut information associated with an application, under the application, select the **Shortcuts** check box, and in the **Location** pane, you can review the icon file information. To edit an existing FTA, click **Edit**. To remove an FTA, select the FTA, and then click **Remove**. Click **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop** and select either the **Stop all applications** or the **Stop this application only** check box, depending on what you want. - - - -13. On the **Create Package** page, select the **Continue to modify package without saving using the package editor** check box, to modify the package without saving it. When you select this option, the package in the sequencer console opens so that you can modify the package before it is saved. Click **Next**. - - Select the default **Save the package now**, to save the package immediately. Add optional **Comments** that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**. - -14. On the **Completion** page, click **Close**. The package is now available in the sequencer. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md b/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md deleted file mode 100644 index 98cb2e695d..0000000000 --- a/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Modify Attributes of Embedded Services -description: How to Modify Attributes of Embedded Services -author: dansimp -ms.assetid: b4057d3f-2e8f-4b1f-9ed5-b65f3da8631a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify Attributes of Embedded Services - - -After you sequence an application but before you save it, you can use the following procedure to manually modify the sequenced application package. - -**To remove an embedded service** - -1. Click the **Virtual Services** tab. - -2. Right-click the service you want to remove, and select **Remove**. - -3. In the **Sequencer** dialog box, click **Yes**. - -**To modify the properties of an embedded service** - -1. Click the **Virtual Services** tab. - -2. Right-click the service whose properties you want to modify, and select **Properties**. - -3. In the **Office Source Engine Properties** dialog box, complete the following tasks: - - 1. In the **Display Name** text box, type the name of the service. - - 2. In the **Description** text box, type a description of the service. - - 3. In the **Path to Executable** text box, enter the path to the executable file. - - 4. From the **Startup Type** drop down list, select how the service is to start up—manually, automatically, or not. - - 5. Click **OK**. - -## Related topics - - -[About the Virtual Services Tab](about-the-virtual-services-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-file-mapping-information.md b/mdop/appv-v4/how-to-modify-file-mapping-information.md deleted file mode 100644 index 8fdeaaf6cd..0000000000 --- a/mdop/appv-v4/how-to-modify-file-mapping-information.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to Modify File-Mapping Information -description: How to Modify File-Mapping Information -author: dansimp -ms.assetid: d3a9d10a-6cc8-4399-9479-b20f729c4dd9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify File-Mapping Information - - -After you sequence an application but before you save it, you can manually modify the virtual file system. Use the following procedures to add, delete, or edit a file in the virtual file system. - -**To add a file in the file system** - -1. Click the **Virtual File System** tab. - -2. Right-click a file under the virtual file system root in the left pane. On the menu, select **Add**. - -3. Complete the following tasks in the **New Virtual File System Mapping** dialog box: - - 1. To specify the new file association type the full network path to the new file. - - 2. Click **OK**. - -4. To override the local directory, right-click the file you just added and, on the menu, select **Override Local Directory**; or to merge with the local directory, select **Merge with Local Directory**. - -5. On the **File** menu, select **Save** to save this change. - -**To delete a file in the file system** - -1. Click the **Virtual File System** tab. - -2. Right-click a file in the virtual file system, and select **Delete**. - -3. Accept the confirmation message by clicking **OK**. - -4. On the **File** menu, select **Save** to save this change. - -**To edit a file in the file system** - -1. Click the **Virtual File System** tab. - -2. Right-click a file in the virtual file system. On the menu, select **Edit**. - -3. Complete the following tasks in the **Edit Virtual File System Mapping** dialog box: - - 1. To edit the file association, specify the full network path to the new file. - - 2. Click **OK**. - -4. To override the local directory, right-click the file you just edited and, on the menu, select **Override Local Directory**. - -5. On the **File** menu, select **Save** to save this change. - -## Related topics - - -[About the Virtual File System Tab](about-the-virtual-file-system-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md b/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md deleted file mode 100644 index f4c26c1e0a..0000000000 --- a/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Modify Private Key Permissions to Support Management Server or Streaming Server -description: How to Modify Private Key Permissions to Support Management Server or Streaming Server -author: dansimp -ms.assetid: 1ebe86fa-0fbc-4512-aebc-0a5da991cd43 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Modify Private Key Permissions to Support Management Server or Streaming Server - - -To support a more secure App-V installation, you can use the following procedures to modify private keys in either Windows Server 2003 or Windows Server 2008. To modify the permissions of the private key, you can use the Windows Server 2003 Resource Kit tool `WinHttpCertCfg.exe`. - -For Windows Server 2003, the procedure requires that a certificate that meets the prerequisites listed in this document is installed on the computer or computers on which you will install the App-V Management or Streaming Server. Additional information about using the `WinHttpCertCfg.exe` tool is available at . - -In Windows Server 2008, the process of changing the ACLs on the private key is much simpler. The certificate’s user interface can be used to manage private key permissions. - -**Note**   -The default security context is Network Service; however, a domain account can be used instead. - - - -**To manage private keys in Windows Server 2003** - -1. On the computer that will become the App-V Management or Streaming Server, type the following command in a command prompt to list the current permissions assigned to a specific certificate: - - `winhttpcertcfg -l -c LOCAL_MACHINE\My -s Name_of_cert` - -2. If necessary, modify the permissions of the certificate to provide read access to the security context that will be used for Management or Streaming Service: - - `winhttpcertcfg -g -c LOCAL_MACHINE\My -s Name_of_cert -a NetworkService` - -3. Verify that the security context was properly added by listing the permissions on the certificate: - - `winhttpcertcfg –l –c LOCAL_MACHINE\My –s Name_of_cert` - -**To manage private keys in Windows Server 2008** - -1. Create a Microsoft Management Console (MMC) with the *Certificates* snap-in that targets the *Local Machine* certificate store. - -2. Expand the MMC and select **Manage Private Keys**. - -3. On the **Security** tab, add the **Network Service** account with **Read** access. - -## Related topics - - -[Configuring Certificates to Support App-V Management Server or Streaming Server](configuring-certificates-to-support-app-v-management-server-or-streaming-server.md) - -[Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md b/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md deleted file mode 100644 index 2b1f6f9355..0000000000 --- a/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Modify the Files Included in a Package -description: How to Modify the Files Included in a Package -author: dansimp -ms.assetid: e331ac85-1c9c-49be-9d96-5444de38fd56 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Files Included in a Package - - -After you sequence an application but before you save it, you can manually modify a sequenced application package to specify how it will retain its settings. Use the Sequencer attributes section to specify whether a file in a sequenced application package will be available to a specific user or to all users in the community. - -**To modify Sequencer attributes** - -1. Click the **Files** tab. - -2. Select **User Data** or **Application Data**, depending on how you want an application to retain its settings, and select **Override** to enable the client to overwrite the cached application. - -3. Click **Apply**. - -## Related topics - - -[About the Files Tab](about-the-files-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md b/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md deleted file mode 100644 index 884b299f77..0000000000 --- a/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Modify the Location of the Log Directory -description: How to Modify the Location of the Log Directory -author: dansimp -ms.assetid: 8e222d29-6f58-43bb-9ea7-da9a2ebfa48c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Location of the Log Directory - - -The log directory location is where the Application Virtualization (App-V) Sequencer writes information about the sequencing of an application. - -Use the following procedure to change the location of the directory where the App-V Sequencer will save associated logs. - -**To modify the log directory location** - -1. To open the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To access the App-V Sequencer **Options** dialog box, select **Tools** / **Options**. On the **General** tab, specify the new directory location where you want the App-V Sequencer log file information to be saved. Alternatively, you can click **Browse** and use the **Browse For Folder** dialog box to specify a new location. - -3. To save the new location and close the **Options** dialog box, click **OK**. - -## Related topics - - -[Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md b/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md deleted file mode 100644 index db5ae76ad1..0000000000 --- a/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Modify the Location of the Scratch Directory -description: How to Modify the Location of the Scratch Directory -author: dansimp -ms.assetid: 25ebc2fa-d532-4800-9825-9d08306fc2e0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Location of the Scratch Directory - - -The scratch directory is used by the App-V Sequencer to save temporary files during the sequencing of an application. - -**To modify the scratch directory location** - -1. To open the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To access the App-V Sequencer **Options** dialog box, select **Tools** / **Options**. On the **General** tab, specify the new scratch directory location where you want the App-V Sequencer temporary files to be saved. Alternatively, you can click **Browse** and use the **Browse For Folder** dialog box to specify a new location. - -3. To save the new location and close the **Options** dialog box, click **OK**. - -## Related topics - - -[Configuring the Application Virtualization Sequencer](configuring-the-application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-log-directory-location.md b/mdop/appv-v4/how-to-modify-the-log-directory-location.md deleted file mode 100644 index 59765268ac..0000000000 --- a/mdop/appv-v4/how-to-modify-the-log-directory-location.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Modify the Log Directory Location -description: How to Modify the Log Directory Location -author: dansimp -ms.assetid: 203c674f-8d46-4d42-9af0-245a2681fc0f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Log Directory Location - - -The log directory location is where the Application Virtualization (App-V) Sequencer writes information about the sequencing of an application. - -**Important**   -The log location directory must be located on the computer running the App-V Sequencer. - - - -Use the following procedure to change the location of the directory where the App-V Sequencer will save associated logs. - -**To modify the log directory location** - -1. To open the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To access the App-V Sequencer **Options** dialog box, select **Tools** / **Options**. On the **General** tab, specify the new directory location where you want the App-V Sequencer log file information to be saved. Alternatively, you can click **Browse** and use the **Browse For Folder** dialog box to specify a new location. - -3. To save the new location and close the **Options** dialog box, click **OK**. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Configure the App-V Sequencer](how-to-configure-the-app-v-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md b/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md deleted file mode 100644 index 910e66507f..0000000000 --- a/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Modify the Operating Systems Associated With an Existing Windows Installer File -description: How to Modify the Operating Systems Associated With an Existing Windows Installer File -author: dansimp -ms.assetid: 0633f7e2-aebf-4e00-be02-35bc59dec420 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Operating Systems Associated With an Existing Windows Installer File - - -Use the following procedure to modify the operating system versions associated with an existing Windows Installer (**MSI**) file that was created by using the App-V Sequencer. - -**To modify the operating systems of an existing Windows Installer file** - -1. Install the App-V Sequencer on a computer in your environment that has only the operating system installed. Alternatively, you can install the Sequencer on a computer running a virtual environment—for example, Microsoft Virtual PC. This method is useful because it is easier to maintain a clean sequencing environment that you can reuse with minimal additional configuration. For more information about installing the App-V Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer.md). - -2. Copy the entire virtual application package that contains the Windows Installer file you want to modify to the computer running the Sequencer. - -3. To modify the Windows Installer file, open the Sequencer console, select **Package** / **Open**, and then browse to the location where the virtual application package associated with the Windows Installer file is saved. - -4. To add or remove operating systems, select the **Deployment** tab in the Sequencer console. To specify additional operating systems that will be associated with the Windows Installer file, select the desired operating system, and then click the arrow that points to the **Selected** operating system list control. - - To remove an operating system association, select the operating system you want to remove, and then click the arrow that points to the **Available** operating system list control. - -5. To create a new Windows Installer that will be associated with the virtual application package, select **Generate Microsoft Windows Installer (MSI) Package**. Alternatively, you can select **Tools** / **Create MSI**. - - **Note**   - If you select **Tools** / **Create MSI** to create a new Windows Installer file, you can skip **Step 6** of this procedure. - - - -6. To save the virtual application package, select **Package** / **Save**. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md b/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md deleted file mode 100644 index 55a1689ba0..0000000000 --- a/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Modify the Scratch Directory Location -description: How to Modify the Scratch Directory Location -author: dansimp -ms.assetid: 61ecb379-85be-4316-8023-a2c1811504e5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify the Scratch Directory Location - - -The scratch directory is used by the App-V Sequencer to save temporary files during the sequencing of an application. - -**Important**   -The specified scratch directory location should be located on the computer running the App-V Sequencer. - - - -Use the following procedure to modify the scratch directory location. - -**To modify the scratch directory location** - -1. To open the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To access the App-V Sequencer **Options** dialog box, select **Tools** / **Options**. On the **General** tab, specify the new scratch directory location where you want the App-V Sequencer temporary files to be saved. Alternatively, you can click **Browse** and use the **Browse For Folder** dialog box to specify a new location. - -3. To save the new location and close the **Options** dialog box, click **OK**. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Create the Sequencer Package Root Directory](how-to-create-the-sequencer-package-root-directory.md) - -[How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md b/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md deleted file mode 100644 index 717a3d0b0b..0000000000 --- a/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Modify Virtual Registry Key Information -description: How to Modify Virtual Registry Key Information -author: dansimp -ms.assetid: cf2559f2-a8cc-4fc7-916e-8368843c7ebc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify Virtual Registry Key Information - - -After you sequence an application but before you save it, you can modify its registry settings. Use the following procedures to modify a sequenced application package's registry values and registry keys. - -**To modify a registry key** - -1. Click the **Virtual Registry Key** tab. - -2. Double-click the **Registry** folder to expand its contents. - -3. In the left pane, right-click the folder you want to modify and select **Key**. - -4. To create a new registry key, on the menu, select **New**. A new registry key will appear in the folder you selected. - -5. To rename a registry key, on the menu, select **Rename**. Type a new value name in the text box. - -6. To delete a registry key, on the menu, select **Delete**. - -7. To override the local key, on the menu, select **Override Local Key**, or to merge with the local key, select **Merge with Local Key**. - -**To modify a registry value** - -1. Click the **Virtual Registry Value** tab. - -2. Double-click the **Registry** folder to expand its contents. - -3. In the left pane, right-click the folder you want to modify and select **Value**. - -4. To add a string, on the menu, select **Add String**. - -5. To add a binary, on the menu, select **Add Binary**. - -6. To add a DWORD, on the menu, select **Add DWORD**. - -7. To delete a registry value, right-click a value and select **Delete**. - -8. To rename a registry value, right-click a registry value and select **Rename**. - -## Related topics - - -[About the Virtual Registry Tab](about-the-virtual-registry-tab.md) - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-move-an-application-group.md b/mdop/appv-v4/how-to-move-an-application-group.md deleted file mode 100644 index 8ea5ba9d04..0000000000 --- a/mdop/appv-v4/how-to-move-an-application-group.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Move an Application Group -description: How to Move an Application Group -author: dansimp -ms.assetid: 7f9f9f2e-f394-4ad3-8615-4237a7dcfb95 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move an Application Group - - -In the Application Virtualization Server Management Console, you can use the following procedure to move an application group, which enables you to arrange your applications to suit your operations. You also can group them so that you can change the properties of nested groups simultaneously. - -**To move an application group** - -1. In the left pane of the Application Virtualization Server Management Console, expand **Applications** so that you can see the **Application** group you want to move. - -2. Right-click the group and choose **Move**. - -3. In the **Select Target** window, navigate to the application group under which you want to place this group. - -4. Click **OK**. - - The group, all its subgroups, and its existing applications now appear under the target group. This move does not change the properties of the group or its applications. - - **Note**   - You can select and move multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group. - - - -## Related topics - - -[How to Create an Application Group](how-to-create-an-application-group.md) - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-move-an-application.md b/mdop/appv-v4/how-to-move-an-application.md deleted file mode 100644 index 09e30ae09f..0000000000 --- a/mdop/appv-v4/how-to-move-an-application.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Move an Application -description: How to Move an Application -author: dansimp -ms.assetid: 3ebbf30c-b435-4a69-a0ba-2313aaf0017c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move an Application - - -If you have application groups under the **Applications** node in the Application Virtualization Server Management Console, you can move an application between groups or from the main node to a group. You can move the applications to suit your operations. You also can group them so that you can change the properties of nested groups simultaneously. - -**Important**   -You must have one or more application groups under the **Applications** node to move applications. - - - -**To move an application** - -1. In the left pane of the Application Virtualization Server Management Console, expand **Applications**. - -2. Highlight the application you want to move. - -3. Right-click the application and choose **Move**. - -4. In the **Select Target** window, navigate to the group in which you want to place this group. - -5. Click **OK**. - - The applications now appear under the target group. This move does not change the properties of the group or its applications, and it does not move any of the application's files on the server. - - **Note**   - You can select and move multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group. - - - -## Related topics - - -[How to Create an Application Group](how-to-create-an-application-group.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md b/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md deleted file mode 100644 index 21dbdb2640..0000000000 --- a/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Open a Sequenced Application Using the Command Line -description: How to Open a Sequenced Application Using the Command Line -author: dansimp -ms.assetid: dc23ee65-8aea-470e-bb3f-a2f2b06cb241 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Open a Sequenced Application Using the Command Line - - -You can open virtual application packages using the command line. You must run the **cmd** prompt as an administrator. - -Use the following procedure to open sequenced application packages using the command line - -**To open a sequenced application using the command line** - -1. To open the command prompt, click **Start**, and select **Run**, type **cmd**, and click **OK**. - -2. At a command prompt, type **cd\\** and specify the path to the directory where the Sequencer is installed and then press **Enter.** - -3. At the command prompt, type the following command, replacing the italicized text with your values: - - SFTSequencer /OPEN:*”specifies the .sprj file to open"* - - Press **Enter**. - -4. You can also specify the following optional parameters. At the command prompt, type the following commands, replacing the italicized text with your values: - - /PACKAGENAME:"*specifies the package name"* - - /MSI - specifies generating an associated Microsoft Windows Installer. - - /COMPRESS – specifies if the package will be compressed. By default, packages are not compressed. - - Press **Enter**. - - **Note**   - If the installer or Windows Installer package has a graphical user interface, it will be displayed after you specify the command-line parameters. - - - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md b/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md deleted file mode 100644 index 9c58f5b780..0000000000 --- a/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Perform Administrative Tasks in the Application Virtualization Server Management Console -description: How to Perform Administrative Tasks in the Application Virtualization Server Management Console -author: dansimp -ms.assetid: b80e39eb-4b2a-4f66-8c85-dd5712efed33 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform Administrative Tasks in the Application Virtualization Server Management Console - - -You have a wide range of configuration and control operations for one or more Application Virtualization Management Servers. The Application Virtualization Server Management Console provides local or remote access to your servers. - -## In This Section - - -[How to Connect to an Application Virtualization System](how-to-connect-to-an-application-virtualization-system.md) -Provides steps for connecting to an Application Virtualization System in the Application Virtualization Management Server Management Console. - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) -Provides procedures for managing applications in the Application Virtualization Server Management Console. - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) -Provides procedures for managing application groups in the Application Virtualization Server Management Console. - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) -Provides procedures for managing packages in the Application Virtualization Server Management Console. - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) -Provides procedures for managing reports in the Application Virtualization Server Management Console. - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) -Provides procedures for managing Application Virtualization Management Servers in the Application Virtualization Server Management Console. - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) -Provides procedures for managing licenses in the Application Virtualization Server Management Console. - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) -Provides procedures for customizing an Application Virtualization System in the Application Virtualization Server Management Console. - -[How to Change the Server Logging Level and the Database Parameters](how-to-change-the-server-logging-level-and-the-database-parameters.md) -Provides procedures for changing the logging level and the database log parameters in the Application Virtualization Server Management Console. - -[How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md) -Describes how to configure database mirroring by using Microsoft SQL Server for your App-V system. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md deleted file mode 100644 index 343308dd05..0000000000 --- a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Perform General Administrative Tasks in the App-V Client Management Console -description: How to Perform General Administrative Tasks in the App-V Client Management Console -author: dansimp -ms.assetid: 22abdb1e-ab35-440d-bf74-d358dd1a6558 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform General Administrative Tasks in the App-V Client Management Console - - -The App-V Client Management Console enables users who are local administrators to manage their applications. - -## In This Section - - -[How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) -Provides procedures for setting up App-V Servers and for adding more App-V Servers to both the App-V Desktop Client and the App-V Client for Remote Desktop Services (formerly Terminal Services). - -[How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) -Provides a procedure for refreshing the App-V Servers from the App-V Client Management Console. - -[How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) -Provides procedures for disabling or modifying disconnected operation mode settings. - -[User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md) -Provides the list of user access permissions. - -[Disconnected Operation Mode](disconnected-operation-mode.md) -Describes the disconnected operation mode and circumstances that affect it. - -## Related topics - - -[Application Virtualization Client](application-virtualization-client.md) - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md deleted file mode 100644 index 6680c9eb75..0000000000 --- a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Perform General Administrative Tasks in the Client Management Console -description: How to Perform General Administrative Tasks in the Client Management Console -author: dansimp -ms.assetid: 90bb7101-1075-4654-8a5e-ad08374e381f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform General Administrative Tasks in the Client Management Console - - -The Application Virtualization Client Management Console enables users who are local administrators to manage their applications. - -## In This Section - - -[How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md) -Provides procedures for adding more Application Virtualization Servers to the Application Virtualization Desktop Client or Client for Remote Desktop Services (formerly Terminal Services) and for setting up those servers. - -[How to Refresh the Publishing Servers](how-to-refresh-the-publishing-servers.md) -Provides a procedure for refreshing the Application Virtualization Servers from the Client Management Console. - -[How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) -Provides procedures you can use to disable or modify disconnected operation mode settings. - -## Related topics - - -[Application Virtualization Client Management Console Overview](application-virtualization-client-management-console-overview.md) - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -[How to Manage Applications in the Client Management Console](how-to-manage-applications-in-the-client-management-console.md) - -[How to Manually Manage Applications in the Client Management Console](how-to-manually-manage-applications-in-the-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-print-a-reportserver.md b/mdop/appv-v4/how-to-print-a-reportserver.md deleted file mode 100644 index b5032610a5..0000000000 --- a/mdop/appv-v4/how-to-print-a-reportserver.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Print a Report -description: How to Print a Report -author: dansimp -ms.assetid: 9cb3a2f1-69bf-47b2-b2cf-8afdcd77138f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Print a Report - - -The process for printing a report for the Application Virtualization Server Management Console is the same regardless of the report type. - -**To print a report** - -1. After the report output is displayed in the **Results** pane, click the **Printer** button (at the top of the **Results** pane) or right-click the desired report under the **Reports** node and select **Print** from the pop-up menu. - -2. Follow the printing prompts, and click **OK**. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md b/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md deleted file mode 100644 index 50cea0dd3a..0000000000 --- a/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How to Publish a Virtual Application on the Client -description: How to Publish a Virtual Application on the Client -author: dansimp -ms.assetid: 90af843e-b5b3-4a71-a3a1-fa5f4c087f28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Virtual Application on the Client - - -When you deploy Application Virtualization by using an electronic software distribution system, you can use one of the following procedures to publish an application package to your users. - -**To publish a package using a stand-alone Windows Installer file** - -1. The client should be installed with the *REQUIREAUTHORIZATIONIFCACHED* parameter set to 0 (zero). For more information about setting this parameter, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md) - -2. Copy the Windows Installer file and the SFT file to same folder on the target computer. - -3. Run the following command on the computer: - - `Msiexec.exe /I "packagename.msi" /q` - -**To publish a package using Windows Installer and the package manifest** - -1. Copy the Windows Installer file to the target computer and the SFT file to the CONTENT share on the streaming server. - -2. Run the following command on each user’s computer: - - `Msiexec.exe /I "\\pathtomsi\packagename.msi" MODE=STREAMING OVERRIDEURL="\\\\server\\share\\package.sft" LOAD=TRUE /q` - - **Important**   - For OVERRIDEURL all backslash characters must be escaped using a preceding backslash, or the OVERRIDEURL path will not be parsed correctly. Also, properties and values must be entered as uppercase except where the value is a path to a file. - - - -**To publish a package using SFTMIME** - -- For an example of how to publish an application for all users on a computer, run the following command on the user’s computer: - - `SFTMIME ADD PACKAGE:package-name /MANIFEST manifest-path [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - For additional details about these and other SFTMIME commands, see [SFTMIME Command Reference](sftmime--command-reference.md). - -## Related topics - - -[Determine Your Publishing Method](determine-your-publishing-method.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-publish-application-shortcuts.md b/mdop/appv-v4/how-to-publish-application-shortcuts.md deleted file mode 100644 index 6d4a244cfe..0000000000 --- a/mdop/appv-v4/how-to-publish-application-shortcuts.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Publish Application Shortcuts -description: How to Publish Application Shortcuts -author: dansimp -ms.assetid: fc5efe86-1bbe-438b-b7d8-4f9b815cc58e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish Application Shortcuts - - -You can use the following procedure to publish shortcuts to an application directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. - -**To publish application shortcuts** - -1. Move the cursor to the **Results** pane, right-click the desired application, and select **New Shortcut** from the pop-up menu to display the New Shortcut Wizard. - -2. On the first page of the New Shortcut Wizard, select an icon and specify a name for the shortcut. - - 1. **Change Icon**—Displays a standard Windows icon browser. Browse to and select the desired icon. - - 2. **Shortcut Title**—Enter the name you want to give the shortcut. This field defaults to the existing name and version of the application. - -3. On the second page of the wizard, determine the location of the published shortcut. - - 1. **The Desktop**—Select this check box to publish the shortcut to the desktop. - - 2. **The Quick Launch Toolbar**—Select this check box to publish the shortcut to the Quick Launch toolbar. - - 3. **The Send To Menu**—Select this check box to publish the shortcut to the **Send To** menu. - - 4. **Programs in the Start Menu**—When you select the **Start Menu** check box, this field becomes active. Leave this field blank to publish the shortcut directly to the root of the Programs folder, or enter a folder name or hierarchy—for example, "My\_Computer\\Office Applications." Shortcuts created this way are available only for the current user. - - 5. **Another location** and **Browse** button—When you select the **Another location** check box, this field becomes active. Enter any valid location on the computer or any available UNC path (shared file or directory on a network). The **Browse** button displays a standard Windows **File Open** dialog box. - -4. On the third page of the wizard, enter desired command-line parameters. - -5. Click **Finish** to publish the shortcuts and exit to the **Results** pane. - -## Related topics - - -[How to Add a File Type Association](how-to-add-a-file-type-association.md) - -[How to Add an Application](how-to-add-an-application.md) - -[How to Delete a File Type Association](how-to-delete-a-file-type-association.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-refresh-the-publishing-servers.md b/mdop/appv-v4/how-to-refresh-the-publishing-servers.md deleted file mode 100644 index a0e9a2926b..0000000000 --- a/mdop/appv-v4/how-to-refresh-the-publishing-servers.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Refresh the Publishing Servers -description: How to Refresh the Publishing Servers -author: dansimp -ms.assetid: 92e1d7b0-10ee-4531-9049-1056b44934e2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Refresh the Publishing Servers - - -After you request access to additional applications and permission is granted by the system administrator, you must refresh the publishing information from the Application Virtualization Servers before the applications appear on your desktop. You can accomplish this directly from the Windows desktop notification area. - -**Note**   -By default, publishing information is refreshed on user log in. - - - -**To refresh the publishing information** - -1. Right-click the Application Virtualization System icon in the notification area. - -2. Select **Refresh Applications** from the pop-up-menu. The new shortcuts appear where designated by the system administrator—for example, on your desktop, **Start** menu, or **Quick Launch** menu, depending on the configuration of the Application Virtualization Server and your desktop. - - **Note**   - Following are additional ways you can refresh the publishing information from the servers: - - - Right-click the server in the **Results** pane, and select **Refresh Server** from the pop-up menu. - - - Right-click the server in the **Results** pane, and then select **Properties** from the pop-up menu. Select the **Refresh** tab, and then click the **Refresh** button. - - - -## Related topics - - -[How to Set Up Periodic Publishing Refresh](how-to-set-up-periodic-publishing-refresh.md) - -[How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md deleted file mode 100644 index 7933691955..0000000000 --- a/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Refresh Virtual Applications from the Desktop Notification Area -description: How to Refresh Virtual Applications from the Desktop Notification Area -author: dansimp -ms.assetid: 801610d9-e89c-48bb-972c-20e37b945a02 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Refresh Virtual Applications from the Desktop Notification Area - - -To refresh the list of available applications and the associated shortcuts and file type associations, you must refresh the publishing information from the Application Virtualization (App-V) Management Server or the Application Virtualization (App-V) Streaming Server before the applications appear on your desktop. You can accomplish this directly from the notification area on your desktop. - -**To refresh the virtual applications from the client desktop** - -1. Right-click the Application Virtualization System icon in the notification area. - -2. Select **Refresh Applications** from the pop-up-menu. - - Your desktop is updated, and the client reflects any changes in applications, shortcuts, and file type associations. This applies only when a publishing server has been defined. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md b/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md deleted file mode 100644 index d0f45a1774..0000000000 --- a/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Remove a Package by Using the Command Line -description: How to Remove a Package by Using the Command Line -author: dansimp -ms.assetid: 47697ec7-20e5-4258-8865-a0a710d41d5a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove a Package by Using the Command Line - - -You can use the following command-line procedures to delete a virtual application package from the Application Virtualization (App-V) Client on a specific computer. - -**To delete a virtual application package for all users** - -- If the package was previously added for all users by using the /GLOBAL switch, use the following command to delete the package and the global file types and shortcuts. Administrator rights are required. The /GLOBAL switch is not needed in this case because the command always performs a global deletion of the package. - - `SFTMIME DELETE PACKAGE:”name”` - -**To delete a package previously added for individual users** - -1. If the package was previously added for individual users, you have several options. - - Run the following command once under the user account of each person the package was published to. This denies the user access to the applications if they roam to another computer. It deletes the specific user’s settings, shortcuts, and file types from the profile, and it stops background loads under the user’s context. - - `SFTMIME UNPUBLISH PACKAGE:”name”` - -2. Alternatively, run the following command under the user account of each person the package was published to. - - `SFTMIME UNPUBLISH PACKAGE:”name”` - - Then run this command for the package. - - `SFTMIME DELETE PACKAGE:”name”` - - This completely removes the package, and it deletes all user settings, shortcuts, and file types from their profiles. If the package is subsequently re-added, the users will have to specify their settings again. Only “Delete applications” (**DeleteApp**) permission is needed to run this command. - -3. As a third alternative, you can simply run the **DELETE PACKAGE** command without using the **UNPUBLISH PACKAGE** command. In this case, file types and shortcuts for each user are hidden rather than deleted, and the user settings are retained. This means that if the package is subsequently re-added for the user, the file types and shortcuts are restored, and the user settings are reapplied. - -## Related topics - - -[How to Add a Package by Using the Command Line](how-to-add-a-package-by-using-the-command-line.md) - -[How to Delete All Virtual Applications by Using the Command Line](how-to-delete-all-virtual-applications-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-remove-a-server-group.md b/mdop/appv-v4/how-to-remove-a-server-group.md deleted file mode 100644 index e7575feff4..0000000000 --- a/mdop/appv-v4/how-to-remove-a-server-group.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Remove a Server Group -description: How to Remove a Server Group -author: dansimp -ms.assetid: 3017f4f4-614b-4db4-834c-b6fd9b45f10c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove a Server Group - - -You can use the following procedure in the Application Virtualization Server Management Console to remove server groups, including all the servers in the group, from your Application Virtualization System. - -**To remove a server group** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. Right-click the desired server group, and select **Delete**. - -3. At the prompt, click **Yes**. - -## Related topics - - -[How to Add a Server](how-to-add-a-server.md) - -[How to Create a Server Group](how-to-create-a-server-group.md) - -[How to Remove a Server](how-to-remove-a-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-remove-a-server.md b/mdop/appv-v4/how-to-remove-a-server.md deleted file mode 100644 index bccd5fb64d..0000000000 --- a/mdop/appv-v4/how-to-remove-a-server.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Remove a Server -description: How to Remove a Server -author: dansimp -ms.assetid: afb2a889-733c-4058-9a50-caa2ca10bd58 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove a Server - - -To help you manage your servers more efficiently, organize them into server groups. After you create a server group in the Application Virtualization Server Management Console, you can remove servers from the group. - -**To remove a server from a group** - -1. Click the **Server Groups** node in the left pane to expand the list of server groups. - -2. In the right pane, right-click the desired server and select **Delete**. - -3. At the prompt, click **Yes**. - -## Related topics - - -[How to Add a Server](how-to-add-a-server.md) - -[How to Create a Server Group](how-to-create-a-server-group.md) - -[How to Remove a Server Group](how-to-remove-a-server-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md b/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md deleted file mode 100644 index 8d0d072de5..0000000000 --- a/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Remove an Application from a License Group -description: How to Remove an Application from a License Group -author: dansimp -ms.assetid: 973dfb11-b4d1-4b79-8f6a-aaea3e52b04f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove an Application from a License Group - - -You can use the following procedure to remove an application from its assigned license group in the Application Virtualization Server Management Console. After you do this, you cannot apply license controls or use reports to track the license usage for this application. - -**To remove an application from a license group** - -1. In the left pane of the management console, click and expand the **Applications** node. - -2. Right-click the desired application, and choose **Properties**. - -3. On the **General** tab, use the **Application License Group** pull-down menu to choose **<none>**. - -4. Click **OK**. - - **Note**   - You can alter the **Properties** tab of one application at a time. - - - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-remove-an-application-group.md b/mdop/appv-v4/how-to-remove-an-application-group.md deleted file mode 100644 index 04c1069006..0000000000 --- a/mdop/appv-v4/how-to-remove-an-application-group.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Remove an Application Group -description: How to Remove an Application Group -author: dansimp -ms.assetid: 3016b373-f5a0-4c82-96e8-e5e7960f0cc4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove an Application Group - - -You can use the following procedures to remove an application group in the Application Virtualization Server Management Console in one of two ways: - -**Caution**   -Deleting a group with its applications deletes those applications from the Application Virtualization Management Server. When you try to do this, you must confirm the deletion in a pop-up window. - - - -**To empty and then delete an application group** - -1. In the Application Virtualization Server Management Console, expand **Applications** in the left pane and select the **Application** group you want to remove. - -2. In the right pane, select the applications and application groups you want to keep. You can use the **CTRL** and **Shift** keys to select multiple applications and application groups. - -3. Right-click the selected applications, and choose **Move**. - -4. In the **Select Target** window, navigate to the new location and click **OK**. Repeat this step if you want to move different applications to more than one group. - -5. When you finish moving the applications you want to keep, right-click the application group and choose **Delete**. - -6. Click **Yes** to confirm. - -**To delete the group, with all its child groups and its applications** - -1. In the Application Virtualization Server Management Console, expand **Applications** in the left pane. - -2. Right-click the application group you want to remove, and choose **Delete**. - -3. Click **Yes** to confirm. - - **Note**   - You can select and remove multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group. - - - -## Related topics - - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-remove-an-application-license-group.md b/mdop/appv-v4/how-to-remove-an-application-license-group.md deleted file mode 100644 index 6e686e7f7b..0000000000 --- a/mdop/appv-v4/how-to-remove-an-application-license-group.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Remove an Application License Group -description: How to Remove an Application License Group -author: dansimp -ms.assetid: 35830916-7015-44cd-829b-23599a5029a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove an Application License Group - - -In the Application Virtualization Server Management Console, you can use the following procedure to remove an application license group. After you do this, you will be unable to apply license controls or use reports to track the licenses. - -**Important**   -Before you can remove a license group, you must remove any licenses associated with the group. - - - -**To remove a license group** - -1. In the left pane of the Application Virtualization Server Management Console, click and expand the **Applications Licenses** node. - -2. Click the desired **License Group**. - -3. In the right pane, right-click the license and select **Delete**. - -4. Click **Yes** at the prompt. - -5. In the left pane, right-click the desired license group and select **Delete**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md b/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md deleted file mode 100644 index 40b1a72de1..0000000000 --- a/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Remove the Application Virtualization System Components -description: How to Remove the Application Virtualization System Components -author: dansimp -ms.assetid: 45bb1e43-8708-48b7-9169-e3659f32686f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Remove the Application Virtualization System Components - - -You can use the following procedures to remove all or selected Application Virtualization software components from a target computer. - -**To remove all components from a single computer** - -1. From the Windows desktop, click **Start > Settings > Control Panel**. - -2. In the Control Panel window, double-click **Add or Remove Programs**. - -3. On the **Add or Remove Programs** page, select **Microsoft System Center Application Virtual Management Server** or **Microsoft System Center Application Streaming Server**, click **Remove**, and then click **Yes** at the prompt to remove all Application Virtualization software components from the computer. - -**To remove one or more components from a computer** - -1. Navigate to the location of the Application Virtualization System setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click **Setup.exe**. - -2. On the **Welcome** page, click **Next**. - -3. On the **Program Maintenance** page, select **Modify** and then click **Next**. - -4. On the **Custom Setup** page, deselect the Application Virtualization component or components you want to remove, and then click **Next**. - -5. On the **Ready to Modify the Program** page, to remove the selected components, click **Install**. - -6. On the **Installation Wizard Completed** page, to close the wizard click **Finish**. Click **Yes** to restart the computer. - -## Related topics - - -[How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-rename-an-application-group.md b/mdop/appv-v4/how-to-rename-an-application-group.md deleted file mode 100644 index a1ee2619d3..0000000000 --- a/mdop/appv-v4/how-to-rename-an-application-group.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Rename an Application Group -description: How to Rename an Application Group -author: dansimp -ms.assetid: 4dfd3336-ea9a-4a56-91e1-7e9d742c7b9a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Rename an Application Group - - -From the Application Virtualization Server Management Console, you can use the following procedure to rename an application group without affecting any of its properties or those of the applications in it. - -**To rename an application group** - -1. In the management console, expand **Applications** in the left pane. - -2. Right-click the **Applications** group, and choose **Rename**. - -3. Type the new name for the group, and press **Enter**. - - Alternately, you can highlight the group and press **F2**. Then type the new name, and press **Enter** - -## Related topics - - -[How to Manage Application Groups in the Server Management Console](how-to-manage-application-groups-in-the-server-management-console.md) - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-rename-an-application.md b/mdop/appv-v4/how-to-rename-an-application.md deleted file mode 100644 index d039ae22e5..0000000000 --- a/mdop/appv-v4/how-to-rename-an-application.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Rename an Application -description: How to Rename an Application -author: dansimp -ms.assetid: 983136b7-66bf-49f6-8dea-8933b622072d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Rename an Application - - -You can rename an application through the Application Virtualization Server Management Console. - -**To rename an application** - -1. In the left pane of the management console, click **Applications**. - -2. Right-click the application and choose **Rename**. - -3. Enter the new name and press **Enter**, or click outside of the box to cancel. - - **Note**   - You can also highlight the application in the right pane and press **F2**. - - - -## Related topics - - -[How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-repair-an-application.md b/mdop/appv-v4/how-to-repair-an-application.md deleted file mode 100644 index a6a164f1df..0000000000 --- a/mdop/appv-v4/how-to-repair-an-application.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: How to Repair an Application -description: How to Repair an Application -author: dansimp -ms.assetid: 80b08416-ad86-4ed6-966a-b943e3efb951 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Repair an Application - - -To repair a selected application, you can perform the following procedure directly from the **Results** pane of the **Application** node in the Application Virtualization Client Management Console. When you repair an application, you remove any custom user settings and restore the default settings. This action does not change or delete shortcuts or file type associations, and it does not remove the application from cache. - -**To repair an application** - -1. Move the cursor to the **Results** pane. - -2. Right-click the desired application, and select **Repair** from the pop-up menu. - -3. At the confirmation prompt, click **Yes** to repair the application or **No** to cancel. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-reset-the-filesystem-cache.md b/mdop/appv-v4/how-to-reset-the-filesystem-cache.md deleted file mode 100644 index f419abda81..0000000000 --- a/mdop/appv-v4/how-to-reset-the-filesystem-cache.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Reset the FileSystem Cache -description: How to Reset the FileSystem Cache -author: dansimp -ms.assetid: 7777259d-8c21-4c06-9384-9599b69f9828 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Reset the FileSystem Cache - - -Resetting the FileSystem cache is not something that should usually be necessary. However if you need to completely reset the FileSystem cache, perhaps for troubleshooting purposes, you can use the following procedure. Administrative rights are required to perform this action. - -**To reset the FileSystem cache** - -1. Set the following registry value to 0 (zero): - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\State - -2. Restart the computer. - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-run-a-reportserver.md b/mdop/appv-v4/how-to-run-a-reportserver.md deleted file mode 100644 index 989628b502..0000000000 --- a/mdop/appv-v4/how-to-run-a-reportserver.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Run a Report -description: How to Run a Report -author: dansimp -ms.assetid: 72a5419b-aa65-4e60-b23e-3751186b7aed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run a Report - - -The process for running a report is the same regardless of the report type. When you select a report type in the Application Virtualization Server Management Console, the window displays a brief description of the selected report. - -**Note**   -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run a report is determined by the amount of data collected in the data store. - - - -**To run a report** - -1. Click the **Reports** node in the navigation pane. - -2. Right-click the desired report, and select **Run Report** from the pop-up menu. - -3. The pages you must complete to run a report vary depending on the type of report. To run a report, complete the appropriate pages from the following list: - - 1. Select a **Report Period** radio button to specify the frequency for running the report. - - 2. Specify the start date and end date in the respective fields to determine the range of dates included in the report. You can enter these dates manually or use the calendar function and select the dates. - - 3. Select the **Server**, **Server Group**, or **Enterprise** radio button, and then select the server group and server from the corresponding drop-down list and field as enabled. - - 4. Select the desired application from the drop-down list of applications. - -4. Click **Finish**. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md deleted file mode 100644 index 71f9b1e3fe..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1) -description: How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1) -author: dansimp -ms.assetid: 2c018215-66e5-4301-8481-159891a6b35b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1) - - -Use the following procedure to create a new add-on or plug-in virtual application package by using the Application Virtualization (App-V) Sequencer. An add-on or plug-in application is an application that extends the functionality of an application, for example, a plug-in for Microsoft Excel. For more information about the types of applications you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -**Important** -Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. - - - -You can also use an existing virtual application package as the parent application. To use an existing virtual application package, use the following procedure before sequencing the new add-on or plug-in. - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To expand an existing package to the computer running the sequencer, click **Tools** / **Expand Package to Local System**. - -3. Browse to and select the package (**.sprj** file) that you want to expand, and then click **Open**. Continue with the following procedure. - -**To sequence a new add-on or plug-in application** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select **Create Package (default)**, and click then **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**. - - For more information about the types of applications that you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Select Primary** page, click **Browse** and specify the parent application. - - **Important** - If the parent application that the add-on or plug-in you are installing is going to support has not been installed locally, stop here and install the application on the computer running the sequencer. For example, the **Excel.exe** program file must be installed locally for a Microsoft Excel plug-in. - - - -~~~ -Click **Next**. -~~~ - -7. On the **Package Name** page, specify a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will also be displayed in the App-V management console. The **Installation Location** displays the Application Virtualization path where the application will be installed. To edit this location, select **Edit (Advanced)**. - - **Important** - Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path. - - - -~~~ -Click **Next**. -~~~ - -8. On the **Installation** page, when the sequencer and application installer are ready, install the plug-in or add-in application so the sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**. - -9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. If you want to customize any of the items in the following list, select **Customize**. - - - Edit the file type associations associated with an application. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - - Specify the operating systems that can run this package. - - Click **Next**. - -11. On the **Edit Shortcuts** page, you can optionally configure the file type associations (FTA) that will be associated with the various applications in the package. To create a new FTA, in the left pane, select and expand the application that you want to customize, and then click **Add**. In the **Add File Type Association** dialog box, provide the necessary information for the new FTA. Under the application, select **Shortcuts** to review the shortcut information associated with an application. In the **Location** pane, you can review the icon file information. To edit an existing FTA, click **Edit**. To remove an FTA, select the FTA, and then click **Remove**. Click **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note** - If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop** and select one of the check boxes, **Stop all applications** or **Stop this application only**. - - - -13. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**. - -14. On the **Create Package** page, to modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Optionally, select **Comments** to add comments that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**. - -15. On the **Completion** page, after you have reviewed the information that is displayed in the **Successful Virtual Application Package Report** pane, click **Close**. The information displayed in the **Successful Virtual Application Package Report** pane is also available in the directory specified in step 14 of this procedure, in a file named **Reports.xml**. - - The package is now available in the sequencer. Click **Edit \[Package Name\]** to edit the package properties. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md). - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md b/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md deleted file mode 100644 index d519abb772..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to Sequence a New Application (App-V 4.6) -description: How to Sequence a New Application (App-V 4.6) -author: dansimp -ms.assetid: f2c398c6-9200-4be3-b502-e00386fcd150 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application (App-V 4.6) - - -Use the following procedure to create a new virtual application by using the Application Virtualization (App-V) Sequencer. You can also use the App-V Sequencer to configure which files and configurations are applicable to all users and which files and configurations users can customize. After you successfully sequence the application, it is available in the App-V Sequencer. - -**Important** -During sequencing, if the computer running the sequencer is running Windows Vista or Windows 7, and a restart is initiated outside of the virtual environment, for example, by clicking **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows from shutting down. If you click **Force shut down**, the package creation will fail, and the computer will restart. When you click **Cancel**, the sequencer successfully records the restart while the application is being sequenced. - - - -**To sequence a new application** - -1. To create the App-V drive, configure drive Q as the location that can be used to save files while you are sequencing an application. You must then create individual directories for each application that you plan to sequence on drive Q. You can create the virtual application targeted folders before you sequence an application, or you can create them in step 5 of this procedure. - - **Note** - The App-V drive you specify must be accessible on targeted computers. If drive Q is not accessible, you can choose a different drive letter. - - - -2. To start the App-V Sequencer Console, on the computer that is running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. To start the Sequencing Wizard, click **Create a Package**. - -3. On the **Package Information** page, specify the **Package Name** that will be assigned to the virtual application. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application. To display the **Advanced Options** page, select **Show Advanced Monitoring Options**, and then click **Next**; otherwise, proceed to step 5. - -4. On the **Advanced Options** page, to allow Microsoft Update to update the application as it is being sequenced, select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates can be installed during the monitoring phase, and you have to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Terminal Server scenarios. Click **Next**. - -5. On the **Monitor Installation** page, when you are ready to install the application, click **Begin Monitoring**, and in the **Browse for Folder** dialog box, specify the directory on drive Q where the application will be installed. If you did not configure drive Q and used a different drive letter for the application virtualization drive, select the drive letter you specified in step 1 of this procedure. To install the application to a folder that has not been created on the application virtualization drive, click **Make New Folder**. After you specify the folder, wait while the Sequencer configures the computer for sequencing. - - **Important** - You must install each application that you sequence into a separate directory on the virtual application drive, and the associated folder name must not be longer than eight characters. - - - -~~~ -After the computer has been configured for sequencing, install the application so that the App-V Sequencer can monitor the installation; when you are finished, click **Stop Monitoring**, and then click **Next**. -~~~ - -6. On the **Configure Applications** page, if necessary, configure the shortcuts and file type associations that will be associated with the virtual application. To add a new file type association or shortcut, click **Add**, and in the **Add Application** dialog box, specify the new element. To remove an existing shortcut or file type association, click **Remove**. To edit an existing element, select the element you want to modify, and then click **Edit**. Specify the configurations in the **Edit Application** dialog box. Click **Save**, and then click **Next**. - -7. On the **Launch Applications** page, to start the application to ensure that the package has been installed correctly and is optimized for streaming, select the package, and then click **Launch**. This step is useful for configuring how the application initially runs on targeted computers and for accepting any associated license agreements before the package becomes available to App-V clients. If multiple applications are associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**. - -8. After you have successfully created the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the virtual drive location where the package will be saved. - - You can optionally create an associated Windows Installer file (**.msi**) to install the virtual application package on targeted computers. To create a Windows Installer file, open the package in the Sequencer and select **Tools** / **Create MSI**. The Windows Installer file will be created and saved in the directory where the virtual application package is saved. - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer running the sequencer. - - - -## Related topics - - -[How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md b/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md deleted file mode 100644 index 493a114518..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Sequence a New Application by Using the Command Line -description: How to Sequence a New Application by Using the Command Line -author: dansimp -ms.assetid: c3b5c842-6a91-4d0a-9a22-c7b8d1aeb09a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application by Using the Command Line - - -You can use a command line to sequence a new application. Using a command line is useful when you have to create a large number of virtual applications or when you need to create sequenced applications on a recurring basis. - -**Important** -Command-line sequencing allows for default sequencing only. If you need to change default installation settings for the application you are sequencing, you must either manually modify the virtual application or update the virtual application by using the Application Virtualization (App-V) Sequencer. For more information about updating a virtual application by using the App-V Sequencer, see [How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md). - - - -Use the following procedure to create a virtual application by using the command line. - -**To sequence an application by using the command line** - -1. On the computer that is running the App-V Sequencer, open the command prompt by selecting **Start**, **Run**, and then type **cmd**. Click **OK**. - -2. Use the command prompt to specify the location of where the App-V Sequencer is installed. For example, at the command prompt, you could type the following: **cd C:\\Program Files\\Microsoft Application Virtualization Sequencer**. - -3. At the command prompt, type the following command, replacing the text in quotation marks with your values: - - `SFTSequencer /INSTALLPACKAGE:"pathtoMSI" /INSTALLPATH:"pathtopackageroot" /OUTPUTFILE:"pathtodestinationSPRJ"` - - **Note** - You can specify additional parameters by using the command line, depending on the complexity of the application you are sequencing. For a complete list of parameters that are available for use with the App-V Sequencer, see [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md). - - - -~~~ -Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. - - ---- - - - - - - - - - - - - - - - - - - - - -
    ValueDescription

    pathtoMSI

    Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced.

    pathtopackageroot

    Specify the package root directory.

    pathtodestinationSPRJ

    Specifies the path and file name of the SPRJ file that will be created.

    -~~~ - - - -4. Press **Enter**. - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - -[Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) - -[Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md b/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md deleted file mode 100644 index 3271202faa..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Sequence a New Application Package Using the Command Line -description: How to Sequence a New Application Package Using the Command Line -author: dansimp -ms.assetid: de72912b-d9e7-45b5-a601-12528f1a4cac -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application Package Using the Command Line - - -You can use a command line to sequence a new application. Using a command line is useful when you have to create a large number of virtual applications or when you need to create sequenced applications on a recurring basis. - -**Important** -Command-line sequencing allows for default sequencing only. If you need to change default installation settings for the application you are sequencing, you must either manually modify the virtual application or update the virtual application by using the Application Virtualization (App-V) Sequencer. For more information about updating a virtual application by using the App-V Sequencer, see [How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md). - - - -Use the following procedure to create a virtual application by using the command line. - -**To sequence an application by using the command line** - -1. On the computer that is running the App-V Sequencer, open the command prompt by selecting **Start**, **Run**, and then type **cmd**. Click **OK**. - -2. Use the command prompt to specify the location of where the App-V Sequencer is installed. For example, at the command prompt, you could type the following: **cd C:\\Program Files\\Microsoft Application Virtualization Sequencer**. - -3. At the command prompt, type the following command, replacing the text in quotation marks with your values: - - `SFTSequencer /INSTALLPACKAGE:"pathtoMSI" /INSTALLPATH:"pathtopackageroot" /OUTPUTFILE:"pathtodestinationSPRJ"` - - **Note** - You can specify additional parameters by using the command line, depending on the complexity of the application you are sequencing. For a complete list of parameters that are available for use with the App-V Sequencer, see [Application Virtualization Sequencer Command Line](application-virtualization-sequencer-command-line.md). - - - -~~~ -Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. - - ---- - - - - - - - - - - - - - - - - - - - - -
    ValueDescription

    pathtoMSI

    Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced.

    pathtopackageroot

    Specifies the package root directory.

    pathtodestinationSPRJ

    Specifies the path and file name of the SPRJ file that will be created.

    -~~~ - - - -4. Press **Enter**. - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-application.md b/mdop/appv-v4/how-to-sequence-a-new-application.md deleted file mode 100644 index 8897653dba..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-application.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Sequence a New Application -description: How to Sequence a New Application -author: dansimp -ms.assetid: e01e98cd-2378-478f-9739-f72c465bf79a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application - - -The Application Virtualization (App-V) Sequencer creates applications that can be run in a virtual environment. The App-V Sequencer monitors the installation and setup process for an application, and it records the information necessary for the application to run in a virtual environment. You can also use the App-V Sequencer to configure which files and configurations are applicable to all users and which files and configurations users can customize. When you sequence an application, you should save the package to a drive that is local to the computer you are sequencing on. - -A sequenced application does not interact with the operating system because each application runs in a virtual environment and is isolated from other applications that might be installed or running on the target computer. This isolation dramatically reduces application conflicts and decreases the required amount of application pre-deployment testing. - -After you successfully sequence the application, it is available in the App-V Sequencer Console. Running the App-V sequencer in Safe Mode is not supported. - -**To sequence a new application** - -1. You must create the Application Virtualization drive to sequence a new virtual application. To create the Application Virtualization drive, map the Q:\\ drive to a location that can be used to save files while you are sequencing an application. You must then create individual directories for each application you plan to sequence on the Q:\\ drive. You can create the virtual application target folders before you sequence an application, or you can create it in step 5 of this procedure. - -2. To start the App-V Sequencer Console, on the computer that is running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. To start the **Sequencing Wizard**, select **File** / **New Package**. - -3. On the **Package Information** page, specify the **Package Name** that will be assigned to the virtual application. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application. To display the **Advanced Options** page, select **Show Advanced Monitoring Options**. Click **Next**. - - **Note** - To display the **Advanced Options** page, you must select **Show Advanced Monitoring Options**. If you do not require the **Advanced Options** page, skip to step 4. - - - -4. On the **Advanced Options** page, to specify the **Block Size** for the virtual application, select the size you want. The block size determines how the **.sft** file will be divided for streaming the package across the network to target computers. To allow Microsoft Update to update the application as it is being sequenced; select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Terminal Server scenarios. Click **Next**. - -5. On the **Monitor Installation** page, to monitor the installation of an application, click **Begin Monitoring**. After you click **Begin Monitoring**, specify the directory on the Q:\\ drive where the application will be installed. To install the application to a folder that has not been created, click **Make New Folder**. You must install each application that you sequence into a separate directory. - - **Important** - The folder name you specify must not be longer than 8 characters. - - - -~~~ -Wait for the virtual environment to load, and then install the application so that the App-V Sequencer can monitor the process. When you have completed the installation, click **Stop Monitoring** and then click **Next**. -~~~ - -6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add, and click **Open**. To clear existing files that have been added, click **Reset** and then click **Next**. - -7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the virtual application. Select the element you want to update, and then click **Edit Locations**. Specify the configurations in the **Shortcut Locations** dialog box. Click **OK** and then click **Next**. - -8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**. - -9. On the **Sequence Package** page, to close the wizard, click **Finish**. - -10. After you have successfully created the package, to save the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the location where the package will be saved. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md deleted file mode 100644 index 70ccc6f38a..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: How to Sequence a New Middleware Application (App-V 4.6 SP1) -description: How to Sequence a New Middleware Application (App-V 4.6 SP1) -author: dansimp -ms.assetid: 304045c2-5e5e-4c91-b59e-a91fdf2500fb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Sequence a New Middleware Application (App-V 4.6 SP1) - - -Use the following procedure to create a new middleware virtual application package using the Application Virtualization (App-V) Sequencer. A middleware application is software that connects software modules or applications. For more information about the types of applications that you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -Use this type of package by using Dynamic Suite Composition in App-V. Dynamic Suite Composition enables you to define a virtual application package as being dependent on another virtual application package. The dependency enables the application to interact with the middleware or plug-in in the virtual environment, where typically this interaction is prevented. This is useful because a secondary application package can be used with several other primary applications, which enables each primary application to reference the same secondary package. For more information about how to use Dynamic Suite Composition, see [How To Use Dynamic Suite Composition](https://go.microsoft.com/fwlink/?LinkID=203804&clcid=0x409) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkID=203804&clcid=0x409). - -**Important** -During sequencing, if the computer running the App-V Sequencer is running Windows Vista or Windows 7 and a restart is initiated outside of the virtual environment, for example, **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows from shutting down. If you click **Force shut down**, the package creation fails. When you click **Cancel**, App-V Sequencer successfully records the restart while the application is being sequenced. - - - -**To sequence a new middleware application** - -1. To start App-V Sequencer, on the computer that is running App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, you must scan the computer running the App-VSequencer to ensure that no unwanted or malicious files can be added to the package. - - - -4. On the **Type of Application** page, select **Middleware**, and then click **Next**. - - For more information about the types of applications that you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Package Name** page, specify a name that will be associated with the package. The name helps identify the purpose and version of the application that will be added to the package. The package name is also displayed in the App-V Management Console. The **Installation Location** displays the application virtualization path where the application will be installed. To edit this location, select **Edit (Advanced)**. - - **Important** - Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path. - - - -~~~ -Click **Next**. -~~~ - -7. On the **Installation** page, when the Sequencer and middleware application installer are ready, install the application so that the Sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**. - -8. On the **Installation** page, wait while the Sequencer configures the virtual application package. - -9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**. - -11. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default, the **Save the package now** check box. Add optional comments in the **Comments** box that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse**, and then specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**. - -12. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**. The information displayed in the **Virtual Application Package Report** pane is also available in the directory specified in step 11 of this procedure, in a file named **Report.xml**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md) - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the Sequencer. - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md deleted file mode 100644 index 91c5c8dae1..0000000000 --- a/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: How to Sequence a New Standard Application (App-V 4.6 SP1) -description: How to Sequence a New Standard Application (App-V 4.6 SP1) -author: dansimp -ms.assetid: c4a2eb33-def8-4535-b93a-3d2de21ce29f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Standard Application (App-V 4.6 SP1) - - -Use the following procedure to create a new standard virtual application package by using the Application Virtualization (App-V) Sequencer. This procedure applies to most applications that you sequence. For more information about the types of applications you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). You must run the sequencer (**SFTSequencer.exe**) using an account that has administrator privileges because of the changes the sequencer makes to the local system. These changes can include writing files to the **C:\\Program Files** directory, making registry changes, starting and stopping services, updating security descriptors for files, and changing permissions. - -**Important** -During sequencing, if the computer running the Sequencer is running Windows Vista or Windows 7 and a restart is initiated outside of the virtual environment, for example, **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows Vista or Windows from shutting down. If you click **Force shut down**, the package creation fails. When you click **Cancel**, the Sequencer successfully records the restart while the application is being sequenced. - - - -**Note** -Running the App-V sequencer in Safe Mode is not supported. - - - -**To sequence a new standard application** - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information that is displayed, click **Refresh**. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, scan the computer running the Sequencer to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, click **Standard Application (default)** check box, and then click **Next**. - - For more information about the types of applications that you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**. - -6. On the **Package Name** page, specify a name that will be associated with the package. The name helps identify the purpose and version of the application that are added to the package. The package name is also displayed in the App-V management console. The **Primary Virtual Application Directory** displays the Application Virtualization path where the application will be installed on target computers. To edit this location, select **Edit (Advanced)**. - - **Important** - Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, the default path is recommended. - - - -~~~ -Click **Next**. -~~~ - -7. On the **Installation** page, when the Sequencer and application installer are ready, install the application so that the Sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. - -8. On the **Installation** page, wait while the Sequencer configures the virtual application package. - -9. On the **Configure Software** page, optionally run the programs contained in the package. This step helps complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -10. On the **Installation Report** page, you can review information about the virtual application package you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -11. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 15 of this procedure. If you want to customize any of the items in the following list, select **Customize**. - - - Edit the file type associations and the icons associated with an application. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - - Specify the operating systems that can run this package. - - Click **Next**. - -12. On the **Edit Shortcuts** page, you can optionally configure the file type associations (FTA) and shortcut locations that will be associated with the various applications in the package. To create a new FTA, in the left pane, select and expand the application you want to customize, and then click **Add**. In the **Add File Type Association** dialog box, provide the necessary information for the new FTA. To review the shortcut information associated with an application, under the application, select **Shortcuts**, and in the **Location** pane, you can edit the icon file information. To edit an existing FTA, click **Edit**. To remove an FTA, select the FTA, and then click **Remove**. Click **Next**. - -13. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note** - If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop**, and select one of the check boxes, **Stop all applications** or **Stop this application only**, depending on what you want. - - - -14. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and specify the operating systems that can run this package. Click **Next**. - - **Important** - The operating systems specified during this step reflect the operating systems on target computers that are enabled to run the package. You must ensure that the operating systems specified are supported by the application you are sequencing. - - - -15. On the **Create Package** page, to modify the package without saving it, select **Continue to modify package without saving using the package editor**. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**. - -16. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**. The information displayed in the **Virtual Application Package Report** pane is also available in the directory specified in step 15 of this procedure, in a file named **Report.xml**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md) - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the Sequencer. - - - -## Related topics - - -[Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md) - -[How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-sequence-an-application.md b/mdop/appv-v4/how-to-sequence-an-application.md deleted file mode 100644 index c920cb5280..0000000000 --- a/mdop/appv-v4/how-to-sequence-an-application.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: How to Sequence an Application -description: How to Sequence an Application -author: dansimp -ms.assetid: bd643dd6-dbf6-4469-bc70-c43ad9c69da9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence an Application - - -The Application Virtualization (App-V) Sequencer creates applications that can be run in a virtual environment. The App-V Sequencer monitors the installation and setup process for an application, and it records the information necessary for the application to run in a virtual environment. You can also use the App-V Sequencer to configure which files and configurations are applicable to all users and which files and configurations users can customize. When you sequence an application, you should save the package to a drive that is local to the computer you are sequencing on. - -A sequenced application does not interact with the operating system because each application runs in a virtual environment and is isolated from other applications that might be installed or running on the target computer. This isolation dramatically reduces application conflicts and decreases the required amount of application pre-deployment testing. - -After you successfully sequence the application, it is available in the App-V Sequencer Console. - -**To sequence a new application** - -1. You must create the Application Virtualization drive to sequence a new virtual application. To create the Application Virtualization drive, map the Q:\\ drive to a location that can be used to save files while you are sequencing an application. You must then create individual directories for each application you plan to sequence on the Q:\\ drive. You can create the virtual application target folders before you sequence an application, or you can create it in step 5 of this procedure. - -2. To start the App-V Sequencer Console, on the computer that is running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. To start the **Sequencing Wizard**, select **File** / **New Package**. - -3. On the **Package Information** page, specify the **Package Name** that will be assigned to the virtual application. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application. To display the **Advanced Options** page, select **Show Advanced Monitoring Options**. Click **Next**. - - **Note** - To display the **Advanced Options** page, you must select **Show Advanced Monitoring Options**. If you do not require the **Advanced Options** page, skip to step 4. - - - -4. On the **Advanced Options** page, to specify the **Block Size** for the virtual application, select the size you want. The block size determines how the **.sft** file will be divided for streaming the package across the network to target computers. To allow Microsoft Update to update the application as it is being sequenced; select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Remote Desktop Session Host (RD Session Host) Server scenarios. Click **Next**. - -5. On the **Monitor Installation** page, to monitor the installation of an application, click **Begin Monitoring**. After you click **Begin Monitoring**, specify the directory on the Q:\\ drive where the application will be installed. To install the application to a folder that has not been created, click **Make New Folder**. You must install each application that you sequence into a separate directory. - - **Important** - The folder name you specify must not be longer than 8 characters. - - - -~~~ -Wait for the virtual environment to load, and then install the application so that the App-V Sequencer can monitor the process. When you have completed the installation, click **Stop Monitoring**, and then click **Next**. -~~~ - -6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add and click **Open**. To clear existing files that have been added, click **Reset**, and then click **Next**. - -7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the virtual application. Select the element that you want to update, and then click **Edit Locations**. Specify the configurations in the Shortcut Locations dialog box. Click **OK**, and then click **Next**. - -8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**. - -9. On the **Sequence Package** page, to close the wizard, click **Finish**. - -10. After you have successfully created the package, to save the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the location where the package will be saved. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md b/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md deleted file mode 100644 index 6a4304627f..0000000000 --- a/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Set Up a Concurrent License Group -description: How to Set Up a Concurrent License Group -author: dansimp -ms.assetid: 031abcf6-d8ed-49be-bddb-91b2c695d411 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up a Concurrent License Group - - -You can use the following procedure in the Application Virtualization Server Management Console to set up a concurrent license group. When you set up a concurrent license group, you can limit access to applications to a specific number of concurrent users. - -**To set up a concurrent license group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Application Licenses** node. - -2. Select **New Concurrent License**. - -3. Enter a name in the **Application License Group Name** field. - -4. Enter a value (in minutes) in the **License Expiration Warning** field. - -5. Click **Next**. - -6. Enter descriptive text in the **License Description** field. - -7. Enter a value in the **Concurrent License Quantity** field. - -8. Select the **Enabled** check box to enable the license. - -9. Select the **Expiration Date** check box (if you want to set an expiration date), and enter the expiration date or use the calendar utility to select a date. - -10. If you need to associate a key with the license, enter the license key information in the **License Key** field. - -11. Click **Finish**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-a-named-license-group.md b/mdop/appv-v4/how-to-set-up-a-named-license-group.md deleted file mode 100644 index 4077c745cd..0000000000 --- a/mdop/appv-v4/how-to-set-up-a-named-license-group.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Set Up a Named License Group -description: How to Set Up a Named License Group -author: dansimp -ms.assetid: 8ef6716c-0cb7-4706-ad3b-ac6f27b2e7ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up a Named License Group - - -You can use the following procedure in the Application Virtualization Server Management Console to set up a named license group. When you set up a named license group, you are giving specific users access to the selected application. - -**To set up a Named License Group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Application Licenses** node. - -2. Select **New Named License**. - -3. Enter a name in the **Application License Group Name** field. - -4. Enter a value (in minutes) in the **License Expiration Warning** field. - -5. Click **Next**. - -6. Enter descriptive text in the **License Description** field. - -7. Select the **Enabled** check box to enable the license. - -8. Select the **Expiration Date** check box (if you want to set an expiration date), and enter the expiration date or use the calendar utility to select a date. - -9. Click **Next**. - -10. Use the **Named License User Wizard** to add, edit, or remove specific users from the license group. - -11. Click **Finish**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Remove an Application License Group](how-to-remove-an-application-license-group.md) - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) - -[How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md b/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md deleted file mode 100644 index 4da9b85aa9..0000000000 --- a/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Set Up an Unlimited License Group -description: How to Set Up an Unlimited License Group -author: dansimp -ms.assetid: 0c37c7b7-aba9-4c03-9e0e-94c966f874cf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up an Unlimited License Group - - -You can use the following procedure in the Application Virtualization Server Management Console to set up an unlimited license group. When you set up an unlimited license group, you let an unlimited number of users access an application simultaneously. - -**To set up an unlimited license group** - -1. In the left pane of the Application Virtualization Server Management Console, right-click the **Application Licenses** node. - -2. Select **New Unlimited License**. - -3. Enter the name of the new group in the **Application License Group Name** field. - -4. Enter a value (in minutes) in the **License Expiration Warning** field. - -5. Click **Next**. - -6. Enter descriptive text in the **License Description** field. - -7. Select the **Enabled** check box to enable the license. - -8. Select the **Expiration Date** check box (if you want to set an expiration date), and enter the expiration date or use the calendar utility to select a date. - -9. If you need to associate a key with the license, enter the license key information in the **License Key** field. - -10. Click **Finish**. - -## Related topics - - -[How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md) - -[How to Create an Application License Group](how-to-create-an-application-license-group.md) - -[How to Remove an Application from a License Group](how-to-remove-an-application-from-a-license-group.md) - -[How to Set Up a Concurrent License Group](how-to-set-up-a-concurrent-license-group.md) - -[How to Set Up a Named License Group](how-to-set-up-a-named-license-group.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md b/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md deleted file mode 100644 index 66c1796f86..0000000000 --- a/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Set Up and Enable or Disable Authentication -description: How to Set Up and Enable or Disable Authentication -author: dansimp -ms.assetid: 1e43d0c5-a467-4a8b-b656-93f75d7deb82 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up and Enable or Disable Authentication - - -The Application Virtualization Server Management Console lets you enable or disable Windows authentication, which lets you to define who has access to the system. You can use the following procedures to set up and disable authentication from the **Provider Policies Results** pane of the console. - -**Note**   - Normally, you set up authentication when you add a provider policy through the New Provider Policy Wizard. - - - -**To set up authentication** - -1. Click the **Provider Policies** node to display the list of provider policies in the **Results** pane. - -2. Right-click the provider policy, and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Make sure the **Authentication** check box is selected. - -5. Select the authentication level from the drop-down list. - -6. Click **Apply** or **OK**. - -**To enable or disable authentication** - -1. Click the **Provider Policies** node to display the list of provider policies in the **Results** pane. - -2. Right-click the provider policy, and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Select the **Authentication** check box to enable authentication. Clear the box to disable it. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md b/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md deleted file mode 100644 index 9e7b1e615b..0000000000 --- a/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Set Up or Disable Application Licensing -description: How to Set Up or Disable Application Licensing -author: dansimp -ms.assetid: 7c00b531-ec41-4970-b0fc-d84225ce3bb2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up or Disable Application Licensing - - -You can use the following procedures to set up or disable application licensing in the Application Virtualization Server Management Console. - -**To set up application licensing** - -1. Click the **Provider Policies** node to display the provider policies in the **Results** pane. - -2. Right-click the provider policy, and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Select the **Licensing** check box, and select a licensing option from the drop-down menu. - -5. Click **Apply** or **OK**. - -**To disable application licensing** - -1. Click the **Provider Policies** node to display the provider policies in the **Results** pane. - -2. Right-click the provider policy, and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Clear the **Licensing** check box. - -5. Click **Apply** or **OK**. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-or-disable-database-size.md b/mdop/appv-v4/how-to-set-up-or-disable-database-size.md deleted file mode 100644 index f6db631033..0000000000 --- a/mdop/appv-v4/how-to-set-up-or-disable-database-size.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Set Up or Disable Database Size -description: How to Set Up or Disable Database Size -author: dansimp -ms.assetid: 4abaf349-132d-4186-8873-a0e515593b93 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up or Disable Database Size - - -You can use the following procedures in the Application Virtualization Server Management Console to specify the size (in MB) of Application Virtualization System usage that you want to store in the database. - -When the size of the stored data reaches 95% (the high watermark) of the specified limit, the system will delete 10% of the usage data, leaving 85% of the data. Package and application usage data will be deleted. When the database grows large enough and approaches the high watermark, a warning message is sent to the SQL Server log to inform you that this limit has been reached. This warning is necessary because the cleanup action can affect the output of the reports. It will also help you decide whether you need to increase the maximum database size, reduce the number of months of usage data to be kept, or turn down the logging level. - -**Note**   -The **No Size Limit** and **Keep All Usage** options are provided so that you can disable usage reporting and database cleanup. Selecting these items will clean up the database transaction log as well. (All committed Microsoft SQL Server transactions will be removed from the database log.) - - - -**To set up database size** - -1. Right-click the Application Virtualization System node in the left pane, and select **System Options**. - -2. Select the **Database** tab. - -3. Select the **Maximum Database Size (MB)** or **No Size Limit** radio button. - -4. If you choose to specify a database size, best practices recommend that you enter a number between 512 and 4096 MB. The default size is 1024 MB and if you need to increase the database size, the maximum value you can enter is 2,147,483,647. If you select **No Size Limit**, the database will grow until it reaches the disk size limit. - -5. Click **Apply** or **OK**. - -**To disable database size limits** - -1. Right-click the Application Virtualization System node in the **Scope** pane, and select **System Options**. - -2. Select the **Database** tab. - -3. Select the **No Size Limit** and **Keep All Usage** radio buttons. - -4. Click **Apply** or **OK**. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -[How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md b/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md deleted file mode 100644 index 1dc1ac12a1..0000000000 --- a/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Set Up or Disable Usage Reporting -description: How to Set Up or Disable Usage Reporting -author: dansimp -ms.assetid: 8587003a-128d-4b5d-ac70-5b9eddddd3dc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up or Disable Usage Reporting - - -You can use the following procedures in the Application Virtualization Server Management Console to specify the duration (in months) of Application Virtualization System usage information you want to store in the database. - -**Note**   - To store usage information, you must select the **Log Usage Information** check box on the **Provider Pipeline** tab. To display this tab, right-click the provider policy in the **Provider Policies Results** pane and select **Properties**. - - - -**To set up usage reporting** - -1. Right-click the Application Virtualization System node in the left pane, and select **System Options**. - -2. Select the **Database** tab. - -3. Select the **Keep Usage For (Months)** or **Keep All Usage** radio button. - -4. If you choose to specify usage duration in months, enter a number from 1 to 120 (default value is 6 months). If you select **Keep All Usage**, the database will grow until it reaches the specified size limit. - -5. Click **Apply** or **OK**. - -**To disable usage reporting** - -1. Click the **Provider Policies** node. - -2. Right-click **Provider Policy** and select **Properties**. - -3. Select the **Provider Pipeline** tab. - -4. Clear the **Log Usage Information** check box. - -5. Click **Apply** or **OK**. - -## Related topics - - -[How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md) - -[How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md b/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md deleted file mode 100644 index 4aaf75708f..0000000000 --- a/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Set Up Periodic Publishing Refresh -description: How to Set Up Periodic Publishing Refresh -author: dansimp -ms.assetid: c358c765-cb88-4881-b4e7-0a2e87304870 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up Periodic Publishing Refresh - - -You can use the following procedure to configure the client to periodically refresh the publishing information from the App-V servers. After the client is configured, the refresh operation is automatic. These settings configure the default settings for the client so that all users on this computer will see the same settings. - -**Note**   -After you have performed this procedure, the publishing information will be refreshed according to the new settings after the first refresh at login. When this first refresh occurs, the server might override the computer settings with different settings, depending on how it is configured. The **Refresh** tab in the **Properties** dialog box shows the locally configured client computer settings and any settings that might have been configured for the user by the publishing server. - - - -**To periodically refresh the publishing information from the Application Virtualization Servers** - -1. Click **Publishing Servers** in the **Scope** pane. - -2. In the **Results** pane, right-click the desired server and select **Properties** from the pop-up-menu. - -3. In the **Properties** dialog box, on the **Refresh** tab, select the **Refresh configuration every** check box and enter a number that represents the frequency in the field. Then select **Minutes**, **Hours**, **Days** from the drop-down menu. - - **Note**   - This setting will cause the client to refresh publishing information every time the configured period elapses. If the user is not logged in when it's time to do a refresh, the refresh will take place when the user next logs in. The timer is then started again for the next period. - - - -4. Click **Apply** to change the configuration. - -5. When you finish configuring the server, click **OK** to exit the dialog box and return to the Application Virtualization Client Management Console. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md b/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md deleted file mode 100644 index 0c4fc3c8e1..0000000000 --- a/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Set Up Publishing Refresh on Login -description: How to Set Up Publishing Refresh on Login -author: dansimp -ms.assetid: 196448db-7645-4fd5-a854-ef6405b15db4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up Publishing Refresh on Login - - -You can use the following procedure to configure the Application Virtualization (App-V) Client to refresh the publishing information from the server each time you log in to the computer. After the client is configured, the refresh operation is automatic. - -**To refresh the publishing information on login** - -1. Click **Publishing Servers** in the **Scope** pane. - -2. In the **Results** pane, right-click the desired server and select **Properties** from the pop-up-menu. - -3. In the **Properties** dialog box, on the **Refresh** tab, select the **Refresh configuration server on user login** check box. - -4. Click **Apply** to change the configuration. - -5. When you finish configuring the settings, click **OK** to exit the dialog box and return to the Application Virtualization Management Console. - - The publishing information will now be refreshed each time you log in to the system. - -## Related topics - - -[How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-set-up-publishing-servers.md b/mdop/appv-v4/how-to-set-up-publishing-servers.md deleted file mode 100644 index 08ed01a0ed..0000000000 --- a/mdop/appv-v4/how-to-set-up-publishing-servers.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Set Up Publishing Servers -description: How to Set Up Publishing Servers -author: dansimp -ms.assetid: 2111f079-c202-4c49-b2a6-f4237068b2dc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up Publishing Servers - - -You can use the following procedures to add and configure Application Virtualization Servers directly from the Client Management Console. - -**To add an application publishing server** - -1. In the **Results** pane, right-click and select **New Server** from the pop-up-menu to start the New Application Virtualization Server Wizard, or alternatively, right-click the **Publishing Server** node and select **New Server** from the pop-up-menu. - -2. On page one of the wizard, enter the name of the server in the **Display Name** field and select the server type from the **Type** drop-down list. You can choose **Application Virtualization Server**, **Enhanced Security Application Virtualization Server**, **Standard HTTP Server**, or **Enhanced Security HTTP Server** from the drop-down list of server types. - -3. Click **Next**. - -4. On page two of the wizard, type the appropriate information into the **Host Name** and **Port** fields. The **Path** field is not editable for Application Virtualization Servers. You must enter a path for Standard HTTP Server or Enhanced Security HTTP Server. - -5. Click **Finish** to add the server. - -**To set up an application publishing server** - -1. In the **Results** pane, right-click the desired server and select **Properties** from the pop-up menu. - -2. Click the **General** tab, where you can change the server name, select a type from the drop-down list of server types, and specify the host name and port. When the server type is Standard HTTP Server or Enhanced Security HTTP Server, the **Path** field is also editable. - -3. Click the **Refresh** tab, where the **Refresh publishing on user login** check box is selected by default. To change the refresh rate, select the **Refresh publishing every** check box and enter a number that represents the frequency in the field. Then select **Minutes**, **Hours**, **Days** from the drop-down menu. (The minimum amount of time you can enter is 30 minutes.) - -4. Click **Apply** to change the configuration. - -5. When you are finished publishing, click **OK** to exit the dialog box and return to the Client Management Console. - -## Related topics - - -[How to Disable or Modify Disconnected Operation Mode Settings](how-to-disable-or-modify-disconnected-operation-mode-settings.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-uninstall-the-app-v-client.md b/mdop/appv-v4/how-to-uninstall-the-app-v-client.md deleted file mode 100644 index 6a88f59a7d..0000000000 --- a/mdop/appv-v4/how-to-uninstall-the-app-v-client.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How to Uninstall the App-V Client -description: How to Uninstall the App-V Client -author: dansimp -ms.assetid: 07591270-9651-4bb5-a5b3-e0fc009bd9e2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall the App-V Client - - -Use the following procedure to uninstall the Application Virtualization Client from the computer. - -**To uninstall the Application Virtualization Desktop Client** - -1. In Control Panel, double-click **Add or Remove Programs** (or in Windows Vista, **Programs and Features**), and then double-click **Microsoft Application Virtualization Desktop Client**. - -2. In the dialog box that appears, click **Yes** to continue with the uninstall process. - - **Important**   - The uninstall process cannot be canceled or interrupted. - - - -3. When a message stating that the Microsoft Application Virtualization Client Tray application must be closed before continuing appears, right-click the App-V icon in the notification area and select **Exit** to close the application. Then click **Retry** to continue with the uninstall process. - - **Important**   - You might see a message stating that one or more virtual applications are in use. Close any open applications and save your data before you continue. Then click **OK** to continue with the uninstall process. - - - -4. A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process. - - **Note**   - The following registry keys remain after the uninstall process is complete: - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5 - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard "Client"=dword:00000000 - - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\SecKey - - - -## Related topics - - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md b/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md deleted file mode 100644 index a5bf655e68..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Upgrade a Package Using the Open Package Command -description: How to Upgrade a Package Using the Open Package Command -author: dansimp -ms.assetid: 67c10440-de8a-4547-a34b-f83206d0cc3b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Package Using the Open Package Command - - -Use the Open Package command to upgrade or apply an update to a sequenced application package. When you upgrade an existing virtual application package using the command line, the original version of the .sft file is deleted. You should backup the associated .sft file before upgrading the package using the command line. - -**To upgrade a package using the Open Package command** - -1. To open the package that will be upgraded, in the Application Virtualization (App-V) console select **File**, **Open Package for Upgrade**. In the **Open** dialog box, select the package that will be upgraded. - -2. To start the **Sequencing** wizard, select **Tools**, **Sequencing Wizard**. Complete the wizard applying the configuration changes, to save the new sequenced application, select **File**, **Save**. - -3. To append the version number to the package name, in the Sequencer console, select **Tools**, **Options**. Select **Append Package Version to Filename**. Click **OK**. - - **Important**   - Updating the file name with the package version is essential to successfully completing the upgrade. - - - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-package.md b/mdop/appv-v4/how-to-upgrade-a-package.md deleted file mode 100644 index 5c88a1bf32..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-package.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Upgrade a Package -description: How to Upgrade a Package -author: dansimp -ms.assetid: 831c7556-6f6c-4b3a-aefb-26889094dc1a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Package - - -The process for an automatic upgrade is the same as for adding a package version in the Application Virtualization Server Management Console. An automatic upgrade is performed when you resequence the application in an existing package. Then you can add this new version to your servers for streaming. - -When you upgrade a package with a new version, you can leave the existing version in place or delete it and leave only the newest one. You might want to leave the old version in place for compatibility with legacy documents or so that you can test the new version before making it available to all users. - -**To upgrade a package automatically** - -1. Copy the new SFT file to the Application Virtualization Server's content folder. - - **Note**   - If resequencing did not add features that changed the Open Software Descriptor (OSD), icon (ICO), or Sequencer Project (SPRJ) files, you do not need to copy those. You can include these files if you want all these files to display the same date. - - - -2. In left pane of the Application Virtualization Server Management Console, expand **Packages**. - -3. Right-click the package you want to upgrade, and select **Add Version**. - -4. In the **Add Package Version** dialog box, browse for or type the full path name for the new application version in the **Full Path for the file** field. This must be an SFT file. - -5. Click **Next**. - -6. The **Summary** dialog box shows the file location and prompts you to copy the file there if you have not already done so. Click **Finish** after you have verified the information. - - The new version is now complete and ready to stream. - -## Related topics - - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md b/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md deleted file mode 100644 index 0ac6b50d84..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: How to Upgrade a Sequenced Application Package Using the Command Line -description: How to Upgrade a Sequenced Application Package Using the Command Line -author: dansimp -ms.assetid: 682fac46-c71d-4731-831b-81bfd5032764 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Sequenced Application Package Using the Command Line - - -Use the following procedure to upgrade a virtual application by using a command line. When you upgrade an existing virtual application package by using the command line, the original version of the .sft file is deleted. You should back up the associated .sft file before upgrading the package by using the command line. - -**To upgrade a virtual application** - -1. On the computer that is running the Application Virtualization (App-V) Sequencer, to open the command prompt, select **Start**, **Run**, and type **cmd**. Click **OK**. - -2. At the command prompt, specify the location where the App-V Sequencer is installed. For example, at the command prompt, you could type the following: **cd C:\\Program Files\\Microsoft Application Virtualization Sequencer**. - -3. At the command prompt, type the following command, replacing the text in quotation marks with your values: - - `SFTSequencer /UPGRADE:"pathtosourceSPRJ" /INSTALLPACKAGE:"pathtoUpgradeInstaller" /DECODEPATH:"pathtodecodefolder" /OUTPUTFILE:"pathtodestinationSPRJ"` - - **Note** - You can specify additional parameters by using the command line, depending on the complexity of the application you are upgrading. For a complete list of parameters that are available for use with the App-V Sequencer, see [Command-Line Parameters](command-line-parameters.md). - - - -~~~ -Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ValueDescription

    pathtosourceSPRJ

    Specifies the directory location of the virtual application to be upgraded.

    pathtoUpgradeInstaller

    Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application.

    pathtodecodefolder

    Specify the directory in which to unpack the SFT file.

    pathtodestinationSPRJ

    Specifies the path and file name of the SPRJ file that will be created.

    -~~~ - - - -4. Press **Enter**. - -## Related topics - - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md b/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md deleted file mode 100644 index 131400d266..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Upgrade a Sequenced Virtual Application Package -description: How to Upgrade a Sequenced Virtual Application Package -author: dansimp -ms.assetid: ffa989f3-6621-4c59-9599-e3c3b3332f67 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Sequenced Virtual Application Package - - -You can upgrade an existing virtual application to a new version by using the Application Virtualization (App-V) Sequencer. The upgrade process is similar to creating a new virtual application. You must open the existing virtual application for an upgrade, make the necessary updates, and then save the updated virtual application to a new location in the package root directory. You can also use the App-V Sequencer Console to make changes to an existing virtual application without performing an upgrade. However, you cannot make modifications to the virtual application’s file system by using this method because the App-V Sequencer does not actually decode the associated .sft file. For example; you can open an existing virtual application in the App-V Sequencer Console by selecting **Open** on the **File** menu. You can update the **Package Name** and the associated **Comments**, and you can make changes to the virtual file system and virtual registry. You can also create a Windows Installer file. - -**Caution**   -You should not reference a previous version of the Windows Installer (.msi) file when you upgrade an existing virtual application package because the previous version of the .sft file will be modified during the upgrade. - - - -Use the following procedure to upgrade an existing virtual application. - -**To upgrade an existing virtual application** - -1. To start the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start**/**Programs**/**Microsoft Application Virtualization**/**Microsoft Application Virtualization Sequencer**. - -2. To open the existing virtual application, in the App-V Console, select **File**/**Open for Package Upgrade**. Use the **Open For Package Upgrade** dialog box to locate the associated SPRJ file you want to open for upgrade. - -3. To specify the location of where the updated package will be decoded, browse to the location by using the **Browse For Folder** dialog box. This is the location where the package root directory will be created as specified in the associated SFT file. The directory that you specify must be a different location from where the original version of the virtual application is saved. You can click **Make New Folder** if the new target folder has not been created yet. You should select the root of the Application Virtualization drive to create the folder. When you create the updated version of the package, it will be denoted with a sequential addition to the directory name—for example, “**.1**” will be added to the directory name located on the Q:\\ drive. - - **Important**   - The directory that you specify must be located in the package root directory on the Q:\\ drive. You can create a new folder, or you can create a subfolder under the directory where the original virtual application is saved. The name assigned to the new folder must not be longer than 8 eight characters. - - - -4. To open the Sequencing Wizard, select **Tools**/**Sequencing Wizard**. On the **Package Information** page, optionally specify the new **Package Name** and add optional comments that will be associated with the updated virtual application. Click **Next**. - -5. On the **Monitor Installation** page, to begin monitoring the new installation, click **Begin Monitoring**. After the virtual environment has finished loading, install the updated version of the application, or apply updates to the existing application. After you have finished updating the virtual application, click **Stop Monitoring**, and then click **Next**. - -6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add, and click **Open**. To clear existing files that have been added, click **Reset**, and then click **Next**. - -7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the updated virtual application. Select the element you want to update, and then click **Edit Locations**. Specify the configurations in the **Shortcut Locations** dialog box, and then click **Next**. - -8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the new version of the virtual application, click **Next**. - -9. To finish and to close the Sequencing Wizard, on the **Sequence Package** page, click **Finish**. - -10. After you have successfully updated the virtual application, to save the package, in the App-V Sequencer Console, on the **File** menu, select **Save**. The virtual application can be accessed in the directory specified in step 3. - -## Related topics - - -[Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md b/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md deleted file mode 100644 index 8557a608b7..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: How to Upgrade a Virtual Application by Using the Command Line -description: How to Upgrade a Virtual Application by Using the Command Line -author: dansimp -ms.assetid: 83c97767-6ea1-42aa-b411-ccc9fa61cf81 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Virtual Application by Using the Command Line - - -Use the following procedure to upgrade a virtual application by using a command line. - -**To upgrade a virtual application** - -1. On the computer that is running the Application Virtualization (App-V) Sequencer, to open the command prompt, select **Start**, **Run**, and type **cmd**. Click **OK**. - -2. At the command prompt, specify the location where the App-V Sequencer is installed. For example, at the command prompt, you could type the following: **cd C:\\Program Files\\Microsoft Application Virtualization Sequencer**. - -3. At the command prompt, type the following command, replacing the text in quotation marks with your values: - - `SFTSequencer /UPGRADE:"pathtosourceSPRJ" /INSTALLPACKAGE:"pathtoUpgradeInstaller" /DECODEPATH:"pathtodecodefolder" /OUTPUTFILE:"pathtodestinationSPRJ"` - - **Note** - You can specify additional parameters by using the command line, depending on the complexity of the application you are upgrading. For a complete list of parameters that are available for use with the App-V Sequencer, see [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md). - - - -~~~ -Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ValueDescription

    pathtosourceSPRJ

    Specifies the directory location of the virtual application to be upgraded.

    pathtoUpgradeInstaller

    Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application.

    pathtodecodefolder

    Specify the directory in which to unpack the SFT file.

    pathtodestinationSPRJ

    Specifies the path and file name of the SPRJ file that will be created.

    -~~~ - - - -4. Press **Enter**. - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - -[Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) - -[Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md b/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md deleted file mode 100644 index 043776bf7d..0000000000 --- a/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Upgrade a Virtual Application Package (App-V 4.6) -description: How to Upgrade a Virtual Application Package (App-V 4.6) -author: dansimp -ms.assetid: 3566227e-f3dc-4c32-af1f-e0211588118c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade a Virtual Application Package (App-V 4.6) - - -Use the following procedure to upgrade an existing virtual application by using the Application Virtualization (App-V) Sequencer. You can also use the App-V Sequencer Console to make changes to an existing virtual application without performing an upgrade, but you cannot make modifications to the virtual application’s file system by using this method because the App-V Sequencer does not actually decode the associated .sft file. For more information about editing an existing package, see [How to Modify a Virtual Application Package (App-V 4.6)](how-to-modify-a-virtual-application-package--app-v-46-.md). - -**To upgrade an existing virtual application** - -1. To start the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To open the existing virtual application package and start the **Sequencing Wizard**, select **Upgrade a Package**. Locate the package you want to upgrade, and click **Open**. In the **Browse For Folder** dialog box, specify the location where the upgraded version of the package will be placed. This location specified must be located on the drive specified as the application virtualization drive, which is typically the Q:\\ drive. To create a new folder, select **Make New Folder**. - - **Warning**   - You must specify the root folder of the existing virtual application. Do not manually create a subfolder or the upgrade will fail. - - - -3. On the **Package Information** page, specify the **Package Name** that will be assigned to the updated package. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application—for example, a version number. To display the **Advanced Options** page, select **Show Advanced Monitoring Options** and click **Next**; otherwise, proceed to step 5. - -4. On the **Advanced Options** page, to allow Microsoft Update to update the application as it is being sequenced, select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic-link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Click **Next**. - -5. On the **Monitor Installation** page, when you are ready to update the application, click **Begin Monitoring**. - - When the updates to the application have been applied, click **Stop Monitoring**. Click **Next**. - -6. On the **Configure Applications** page, if necessary, configure the shortcuts and file type associations that will be associated with the virtual application. To add a new file type association or shortcut, click **Add**, and in the **Add Application** dialog box, specify the new element. To remove an existing shortcut or file type association, click **Remove**. To edit an existing element, select the element you want to modify, and then click **Edit**. Specify the configurations in the **Edit Application** dialog box. Click **Save**. Click **Next**. - -7. On the **Launch Applications** page, to start the application to ensure that the package has been installed correctly and is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to App-V clients. If multiple applications are associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**. - -8. To close the Sequencing Wizard, click **Finish**. To save the updated package, in the Sequencer Console, select **File** / **Save**. - - If you plan to deploy the updated package by using a Windows Installer file (.msi), you must create new one as follows: in the Sequencer Console, select **Tools** / **Create MSI**. The new Windows Installer file will be created and saved in the directory where the updated virtual application package is saved. - -## Related topics - - -[How to Sequence a New Application (App-V 4.6)](how-to-sequence-a-new-application--app-v-46-.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md b/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md deleted file mode 100644 index f56ab1c22a..0000000000 --- a/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Upgrade an Existing Virtual Application -description: How to Upgrade an Existing Virtual Application -author: dansimp -ms.assetid: ec531576-2423-4c2c-9b9f-da74174a6858 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade an Existing Virtual Application - - -You can upgrade an existing virtual application to a new version by using the Application Virtualization (App-V) Sequencer. The upgrade process is similar to creating a new virtual application. You must open the existing virtual application for an upgrade, make the necessary updates, and then save the updated virtual application to a new location in the package root directory. - -You can also use the App-V Sequencer Console to make changes to an existing virtual application without performing an upgrade. However, you cannot make modifications to the virtual application’s file system by using this method because the App-V Sequencer does not actually decode the associated .sft file. For example; you can open an existing virtual application in the App-V Sequencer Console by selecting **Open** on the **File** menu. You can update the **Package Name** and the associated **Comments**, and you can make changes to the virtual file system and virtual registry. You can also create a Windows Installer file. - -Use the following procedure to upgrade an existing virtual application. - -**To upgrade an existing virtual application** - -1. To start the App-V Sequencer Console, on the computer running the App-V Sequencer, select **Start**/**Programs**/**Microsoft Application Virtualization**/**Microsoft Application Virtualization Sequencer**. - -2. To open the existing virtual application, in the App-V Console, select **File**/**Open for Package Upgrade**. Use the **Open For Package Upgrade** dialog box to locate the associated SPRJ file you want to open for upgrade. - -3. To specify the location of where the package will be decoded, click **Browse For Folder** and specify the Q:\\. This is the location where the package root directory will be created as specified in the associated SFT file. When you create the updated version of the package, it will be denoted with a sequential addition to the directory name—for example, “**.1**” will be added to the directory name located on the Q:\\ drive. - -4. To open the Sequencing Wizard, select **Tools**/**Sequencing Wizard**. On the **Package Information** page, optionally specify the new **Package Name** and add optional comments that will be associated with the updated virtual application. Click **Next**. - -5. On the **Monitor Installation** page, to begin monitoring the new installation, click **Begin Monitoring**. After the virtual environment has finished loading, install the updated version of the application, or apply updates to the existing application. After you have finished updating the virtual application, click **Stop Monitoring**, and then click **Next**. - -6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add, and click **Open**. To clear existing files that have been added, click **Reset**, and then click **Next**. - -7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the updated virtual application. Select the element you want to update, and then click **Edit Locations**. Specify the configurations in the **Shortcut Locations** dialog box, and then click **Next**. - -8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the new version of the virtual application, click **Next**. - -9. To finish and to close the Sequencing Wizard, on the **Sequence Package** page, click **Finish**. - -10. After you have successfully updated the virtual application, to save the package, in the App-V Sequencer Console, on the **File** menu, select **Save**. The virtual application can be accessed in the directory specified in step 3. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md deleted file mode 100644 index 2441e92fe0..0000000000 --- a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: How to Upgrade the Application Virtualization Client -description: How to Upgrade the Application Virtualization Client -author: dansimp -ms.assetid: 2a75d8b5-da88-456c-85bb-f5bd3d470f7f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade the Application Virtualization Client - - -You can use the following procedures to upgrade the Application Virtualization (App-V) Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services). You upgrade the client by installing a new version over the previously installed older version. When you upgrade the clients, the installer software automatically preserves and migrates the user’s settings for virtual applications. Administrative rights are required to run the setup program. - -**Note**   -During the upgrade to Application Virtualization (App-V) 4.5 or later versions, the permissions to the HKCU registry key are changed. Because of this, users will lose user configurations that were set previously, such as user-configured Disconnected Mode settings. If the user is not actively restricted from configuring client user interface behavior through a permission lockdown, the user can reset these preferences after a publishing refresh. - - - -**Important**   -When upgrading to version 4.6 or a later version of the App-V Client, you must use the correct installer for the computer’s operating system, 32-bit or 64-bit. The installation will fail and an error message will be displayed if you use the wrong installer. - - - -**To upgrade the Application Virtualization Desktop Client** - -1. Shut down all virtual applications, right-click the App-V Desktop Client icon displayed in the Windows desktop notification area, and select **Exit** to shut down the existing client. - -2. After you have obtained the correct installer archive file and saved it to your computer, double-click it to expand the archive. - -3. Browse to find the setup.exe file, and double-click setup.exe to start the installation. - -4. The wizard checks the system to ensure that all prerequisite software is installed and will prompt you to install any of the following, if missing: - - - Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) - - - Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) - - - Microsoft Application Error Reporting - - **Note**   - For version 4.6 and higher, the wizard will also install the following software prerequisite: - - - Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) - - - -5. Click **Install**. Installation progress is displayed, and the status changes from **Pending** to **Installing**. Installation status changes to **Succeeded** as each step is completed successfully. - -6. When the **Application Virtualization Desktop Client** dialog appears and displays a message stating that an older version of the client has been found on the computer, click **Next** to upgrade to the new version. - -7. When the **License Agreement** screen is displayed, read the license agreement, and if you agree, click **I accept the terms in the license agreement**, and then click **Next**. - -8. When the InstallShield Wizard displays the **Ready to Upgrade the Program** dialog screen, click **Upgrade** to begin the upgrade. The next screen indicates that the client is being installed. - - **Warning**   - If you did not shut down the client program in step 1, you might see a **Files In Use** warning displayed. If this happens, right-click the App-V Client icon displayed in the desktop notification area and select **Exit** to shut down the existing client. Then click **Retry** to continue. - - - -9. When the installation completes successfully, you will be prompted to restart the computer. You need to restart the computer to complete the installation. - - **Caution**   - If the upgrade fails for any reason, you will need to restart the computer before attempting the upgrade again. - - - -**To upgrade the Application Virtualization Client by Using the Command Line** - -1. If upgrading the App-V client using the setup.msi program, ensure that any necessary prerequisite software has been installed. - - **Important**   - - For version 4.6 and later of the App-V client, the setup.msi program checks the system and will fail with an error message indicating that installation cannot continue if prerequisite software is not installed. - - - For App-V version 4.6, command-line parameters cannot be used during an upgrade and will be ignored. - - - -2. The following command-line example uses the setup.msi file to upgrade the App-V Client. You will need to use the correct client installer program depending on whether you are upgrading the App-V Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services). - - **msiexec.exe /i "setup.msi"** - - **Important**   - The quotation marks are required only when the value contains a space. For consistency, all instances in the preceding example are shown as having quotation marks. - - - -**To upgrade the Application Virtualization Client for Remote Desktop Services** - -1. Follow your organization’s standard policies for installing or upgrading applications on the Remote Desktop Session Host (RD Session Host) server. If the system is part of a farm, remove the RD Session Host from the server farm. - -2. To upgrade the App-V Client for Remote Desktop Services (formerly Terminal Services), you must use the command line because you cannot upgrade the client manually on the RD Session Host. - - **Note**   - In App-V version 4.6 and later, in addition to using the command line to upgrade the client, you can also use a Remote Desktop session. No special parameters are required to start the Remote Desktop session. - - - -3. After the Client for Remote Desktop Services upgrade is complete, restart and log in to the RD Session Host. - -4. After the system is restarted, add the server to the server farm. - - **Caution**   - If the upgrade fails for any reason, you will need to restart the computer before attempting the upgrade again. - - - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md deleted file mode 100644 index 2842d352f7..0000000000 --- a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Upgrade the Application Virtualization Sequencer -description: How to Upgrade the Application Virtualization Sequencer -author: dansimp -ms.assetid: 7f85f140-5034-4227-85ef-81f205e722ef -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade the Application Virtualization Sequencer - - -Upgrading from previous versions of the Sequencer is not supported. You must uninstall any previous versions of the Sequencer and then install Microsoft Application Virtualization Sequencer 4.5. However, Virtual applications created using an earlier version of the Sequencer can be opened and edited using Sequencer 4.5. - -**To upgrade the Sequencer on computers running Windows Vista** - -1. To uninstall previous installations of the Sequencer, open Control Panel and select **Programs and Features**. Select the older version from the list, and then click **Uninstall**. To confirm the uninstall, click **Yes** in the **Programs and Features** dialog box. - -2. After you have completed uninstalling the previous Sequencer version, install Application Virtualization Sequencer 4.5. For more information about installing Sequencer 4.5, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). - -**To upgrade the Sequencer on computers running Windows XP** - -1. To uninstall previous installations of the Sequencer, open Control Panel and select **Add or Remove Programs**. Select the older version from the list, and then click **Remove**. To confirm the uninstall, click **Yes** in the **Add or Remove Programs** dialog box. - -2. After you have completed uninstalling the previous Sequencer version, install Application Virtualization Sequencer 4.5. For more information about installing Sequencer 4.5, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md b/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md deleted file mode 100644 index 924c233ee0..0000000000 --- a/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: How to Upgrade the Servers and System Components -description: How to Upgrade the Servers and System Components -author: dansimp -ms.assetid: 7d8374fe-5897-452e-923e-556a854b2024 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upgrade the Servers and System Components - - -Use the following procedure to upgrade software components installed on all Application Virtualization System computers. Application Virtualization System services will be restarted automatically on each computer after it has been upgraded. - -**Note**   -- The upgrade process stops all Application Virtualization System services, thereby taking the system out of service. User sessions should be shut down before you begin the upgrade process, and you should stop all Application Virtualization Server services in your environment. - -- If you have more than one server that is sharing access to the Application Virtualization database, all those servers must be taken offline while the database is being upgraded. You should follow your normal business practices for the database upgrade, but it is highly advisable that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the other servers. - -- You can upgrade to Microsoft Application Virtualization (App-V) 4.5 only from Microsoft Application Virtualization (App-V) 4.1 or 4.1 SP1. App-V 4.0 and earlier must be uninstalled or upgraded to 4.1 or 4.1 SP1 before upgrading to App-V 4.5. - - - -**To upgrade software components on Application Virtualization System computers** - -1. Navigate to the location of the Setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click the Setup.exe file. - -2. On the **Welcome** page of the Installation Wizard, click **Next**. - -3. On the **License Agreement** page, read the license agreement, check **I accept the terms in the license agreement**, and click **Next**. - -4. When the **Installed Software** page opens and displays a list of the installed Application Virtualization System components and the version of each component, click **Next**. - -5. On the **Session Loss Warning** page, read the displayed message and click **Next**. - -6. On the **Connect to Configuration Database** page, review the content on the page and click **Next**. - -7. If the **Database Upgrade Required** page is displayed, a database upgrade is required. Enter the database administrative credentials, and then click **Next**. If this page is not displayed, skip to Step 9. - -8. On the **Backup Configuration Database** page, check the appropriate boxes to perform the backup and export it to an existing location, and then click **Next**. - - **Important**   - If you want to be able to roll back to the previous version in the event of an upgrade failure, make sure you check the **Perform a backup of the configuration database** box, or you will lose the configuration data. - - When you want to restore a database with VSS, you must first stop the App-V Server Service on the Management Server. This should be done on every Management server if there is more than one server connected to the same database. - - - -9. On the first **Package Validation** page, read the content and then click **Next**. - -10. On the second **Package Validation** page, you have the option of displaying the details of the package validation in a Notepad window. To see the details, click **Details**; otherwise, click **Next**. - -11. On the **Ready to Upgrade the Program** page, click **Next**. - -12. On the **Installation Wizard Completed** page, click **Finish**. - -13. Repeat steps 1–12 on all other computers where you installed the Application Virtualization Management Console or the Application Virtualization Server software component. - - After upgrading the data store, you can resume normal operation. (The data store is upgraded when you upgrade any server or the App-V Management Web Service.) - -## Related topics - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-use-dynamic-suite-composition.md b/mdop/appv-v4/how-to-use-dynamic-suite-composition.md deleted file mode 100644 index e6841ce254..0000000000 --- a/mdop/appv-v4/how-to-use-dynamic-suite-composition.md +++ /dev/null @@ -1,144 +0,0 @@ ---- -title: How To Use Dynamic Suite Composition -description: How To Use Dynamic Suite Composition -author: dansimp -ms.assetid: 24147feb-a0a8-4791-a8e5-cbe5fe13c762 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How To Use Dynamic Suite Composition - - -Dynamic Suite Composition in Application Virtualization enables you to define an application as being dependent on another application, such as middleware or a plug-in. This enables the application to interact with the middleware or plug-in in the virtual environment, where typically this is prevented. This is useful because a secondary application package can be used with several other applications, referred to as the *primary applications*, which enables each primary application to reference the same secondary package. - -You can use Dynamic Suite Composition when you sequence applications that depend on plug-ins such as ActiveX controls or for applications that depend on middleware such as OLE DB or the Java Runtime Environment (JRE). If each application that used these dependent components required sequencing, including the components, updates to those components would require re-sequencing all the primary applications. If you sequence the primary applications without the components and then sequence the middleware or plug-in as a secondary package, then only the secondary package must be updated. - -One advantage of this approach is that it reduces the size of the primary packages. Another advantage is that it provides you with better control of access permissions on the secondary applications. Note that the secondary application can be streamed in the regular way and does not have to be fully cached to run. - -A primary package can have more than one secondary package. However, only one level of dependency is supported, so you cannot define a secondary package as dependent on another secondary package. Also the secondary application can only be middleware or a plug-in and cannot be another full software product. - -If you plan to make several primary applications dependent on a single middleware product, make sure that you test this configuration to determine the potential effect on system performance before you deploy it. - -**Important**   -Package dependencies can be specified as mandatory for a primary application. If a secondary package is flagged as mandatory and it cannot be accessed for some reason during loading, the load of the secondary package will fail. Also, the primary application will fail when the user tries to start it. - - - -You can use the following procedures to create a secondary package, for either a plug-in or a middleware component, and then you can use the final procedure to define the dependency in the OSD file of the secondary package. - -**To create a secondary package for a plug-in by using Dynamic Suite Composition** - -1. On a sequencing computer that is set up with a clean image, install Application Virtualization Sequencer and save the computer state. - -2. Sequence the primary application, and save the package to the Content folder on the server. - -3. Restore the sequencing computer to its saved state from step 1. - -4. Install and configure the primary application locally on the sequencing computer. - - **Important**   - You must specify a new package root for the secondary package. - - - -5. Start the sequencer monitoring phase. - -6. Install the plug-in on the sequencing computer and configure it as needed. - -7. Open the primary application, and confirm that the plug-in is working correctly. - -8. In the sequencer console, create a dummy application to represent the secondary package that will contain the plug-in and select an icon. - -9. Save the package to the Content folder on the server. - - **Note**   - To assist with management of secondary packages, it is recommended that the package name include the term “Secondary package” to emphasize that this is a package that will not function as a stand-alone application—for example, **\[Plug In Name\] Secondary package**. - - - -**To create a secondary package for middleware by using Dynamic Suite Composition** - -1. On a sequencing computer that is set up with a clean image, install Application Virtualization Sequencer and save the computer state. - -2. Install the middleware locally on the sequencing computer, and configure it. - -3. Sequence the primary application, and save the package to the Content folder on the server. - -4. Restore the sequencing computer to its saved state from step 1. - -5. Start the sequencer to create a new package. - -6. Start the sequencer monitoring phase. - -7. Install the middleware application on the sequencing computer, and configure it as in a typical installation. - -8. Complete the sequencing process. - -9. Save the package to the Content folder on the server. - - **Note**   - To assist with management of secondary packages, it is recommended that the package name include the term “Secondary package” to emphasize that this is a package that will not function as a stand-alone application—for example, **\[Middleware Name\] Secondary package**. - - - -**To define the dependency in the primary package** - -1. On the server, open the OSD file of the secondary package for editing. (It is a good idea to use an XML editor to make changes to the OSD file; however, you can use Notepad as an alternative.) - -2. Copy the **CODEBASE HREF** line from that file. - -3. Open the OSD file of the primary package for editing. - -4. Insert the <DEPENDENCIES>tag after the close of **</ENVLIST>** tag at the end of the **<VIRTUALENV>** section just before the **</VIRTUALENV>** tag. - -5. Paste the **CODEBASE HREF** line from the secondary package after the **<DEPENDENCIES>** tag you just created. - -6. If the secondary package is a mandatory package, which means that it must be started before the primary package is started, add the **MANDATORY=”TRUE”** property inside the **CODEBASE** tag. If it is not mandatory, the property can be omitted. - -7. Close the **<DEPENDENCIES>** tag by inserting the following: - - **</DEPENDENCIES>** - -8. Review the changes that you made to the OSD file, and then save and close the file. The following example shows how the added section should appear. The tag values shown here are for example only. - - **<VIRTUALENV>** - - **<ENVLIST>** - - **…** - - **</ENVLIST>** - - **<DEPENDENCIES>** - - **<CODEBASE HREF="rtsp://virt\_apps/package.1/package.1.sft" GUID="D54C80FA-9DFF-459D-AA33-DD852C9FBFBA" SYSGUARDFILE="package.1\\osguard.cp"/>** - - **<CODEBASE HREF="rtsp://sample\_apps/package.2/sample.sft" GUID="D54C80FA-9DFF-459D-AA33-DD852C9FBFBA" SYSGUARDFILE="package.2\\osguard.cp" MANDATORY="TRUE" />** - - **</DEPENDENCIES>** - - **</VIRTUALENV>** - -9. If the secondary package has any entries in the **<ENVLIST>** section of the OSD file, you must copy those entries to the same section in the primary package. - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md b/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md deleted file mode 100644 index a457af6266..0000000000 --- a/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Use the Cache Space Management Feature -description: How to Use the Cache Space Management Feature -author: dansimp -ms.assetid: 60965660-c015-46a8-88ac-54cbc050fe33 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Cache Space Management Feature - - -The FileSystem cache space management feature uses a Least Recently Used (LRU) algorithm and is enabled by default. If the space that is required for a new package would exceed the available free space in the cache, the Application Virtualization (App-V) Client uses this feature to determine which, if any, existing packages it can delete from the cache to make room for the new package. The client deletes the package with the oldest last-accessed date if it is older than the value specified in the MinPkgAge registry value. Use of the FileSystem cache space management feature can also help to avoid low cache space problems. - -More than one package is deleted if necessary. Packages that are locked are not deleted. - -**Note**   -To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. - - - -The cache space management feature is controlled by the UnloadLeastRecentlyUsed registry value. A value of 1 enables the feature, and a value of 0 (zero) disables it. - -**To enable or disable the cache space management feature** - -- Set the following registry value to 1 to enable the LRU algorithm. Set it to 0 (zero) to disable the feature. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\UnloadLeastRecentlyUsed - -**To control which packages can be discarded** - -- To determine when the package can be selected for discard, set the following registry value to equal the minimum number of days you want to elapse since the package was last accessed. Packages that have been used more recently are not discarded. - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS\\MinPkgAge - - **Caution**   - The maximum value for this registry key is 0x00011111. Larger values will prevent the correct operation of the cache space management feature. - - - -## Related topics - - -[How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md b/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md deleted file mode 100644 index a8943af3a2..0000000000 --- a/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Use the Desktop Notification Area for Application Virtualization Client Management -description: How to Use the Desktop Notification Area for Application Virtualization Client Management -author: dansimp -ms.assetid: 75b2e636-7669-4e1e-8368-8b9fca567a84 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Desktop Notification Area for Application Virtualization Client Management - - -The notification area is a standard Windows feature that, by default, appears in the lower-right corner of the desktop. You can exercise some Application Virtualization Client functionality from the notification area without starting the Application Virtualization Client Management Console. - -## In This Section - - -[How to Refresh Virtual Applications from the Desktop Notification Area](how-to-refresh-virtual-applications-from-the-desktop-notification-area.md) -Provides a simple procedure you can use to refresh the list of virtualized applications authorized for the client. - -[How to Load Virtual Applications from the Desktop Notification Area](how-to-load-virtual-applications-from-the-desktop-notification-area.md) -Provides procedures for loading virtualized applications into the cache. - -[How to Cancel Loading of Virtual Applications from the Desktop Notification Area](how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md) -Provides procedures for cancelling the loading of virtual applications. - -[How to Work Offline or Online with Application Virtualization](how-to-work-offline-or-online-with-application-virtualization.md) -Provides procedures you can use to toggle between offline and online operation. - -[How to Exit the App-V Client from the Notification Area](how-to-exit-the-app-v-client-from-the-notification-area.md) -Provides a simple procedure you can use to exit the application from the desktop notification area. - -  - -  - - - - - diff --git a/mdop/appv-v4/how-to-use-the-differential-sft-file.md b/mdop/appv-v4/how-to-use-the-differential-sft-file.md deleted file mode 100644 index 963df8c7b7..0000000000 --- a/mdop/appv-v4/how-to-use-the-differential-sft-file.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Use the Differential SFT File -description: How to Use the Differential SFT File -author: dansimp -ms.assetid: 607e30fd-2f0e-4e2f-b669-0b3f010aebb0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Use the Differential SFT File - - -When sequencing an application, the Microsoft Application Virtualization (App-V) Sequencer creates SFT files (.sft) to store all of the virtual application’s files content and configuration information. In version 4.5 of App-V, the Differential SFT (.dsft) file has been introduced. After using the Sequencer to create an upgrade for an existing package, you can choose to generate this file to store only the differences between the original sequenced application package and the new version. It is therefore much smaller than the full SFT file would be for the new version of the application and reduces the impact of sending package updates over low-bandwidth network connections. However, its use is supported only in certain restricted situations. This feature was intended to be used specifically where you are using an electronic software distribution (ESD) system to manage a group of users with a local file server over a low-bandwidth connection and you are not using App-V streaming servers. - -You do not need to use the Differential SFT file if you are using Configuration Manager 2007 to manage the users, because Configuration Manager has support for low-bandwidth deployments already built in. It is also not required if you are using Application Virtualization (App-V) Management or Streaming Servers with Active Upgrade because the client will retrieve only the differences between the old and new package versions. - -The following procedure shows how to use the mkdiffpkg.exe that is included in the Sequencer installation to create the Differential SFT file, after completing the upgrade of the virtual application package, and to deploy the Differential SFT file. Completing this procedure helps ensure that if the package is somehow unloaded from the client computer, the next time the user tries to run the application, the client will fall back to the override URL, which is set to stream the full package V2.sft from the local file share. This will avoid any failure for the user when starting the application. If the entire client becomes corrupted or is uninstalled, it is recommended that the ESD system be configured to deploy the full version of the upgraded package, V2.sft, to the client. - -For more information about upgrading a package, see “How to Upgrade an Existing Virtual Application” in the App-V 4.5 Operations Guide at - -**Note**   -As a prerequisite, all user computers being targeted by the ESD must have the V1.sft file fully loaded into their local cache, and file streaming must be enabled on all computers. - - - -**To use the Differential SFT file** - -1. Log on to the Sequencer computer by using an account with administrator rights. Open the original package (V1) for upgrade in the Sequencer, and then upgrade the package to the new version (V2) and save it as a new V2.sft. - -2. Open a command window in the App-V 4.5 Sequencer installation folder, and run the following command: - - `“mkdiffpkg.exe V2.sft V2.dsft”` - -3. Using the ESD system or other file copy process, copy the full V2 package content file, V2.sft, to a local file share that is accessible to the user computers on a well-connected network connection. - -4. Using the ESD system, place a copy of the Differential SFT file, V2.dsft, on each user computer. - -5. To import the V2.dsft file, run the following SFTMIME command on each user computer: - - `“SFTMIME load package: /SFTPATH ”` - -6. Run the following SFTMIME command on each user computer to set the override URL to point to the V2.sft file: - - `“SFTMIME configure package: /OverrideURL FILE://”` - -**Note**   -- Differential SFT files must be applied to clients in the correct order. For example, V2.dsft must be applied to a V1 application before V3.dsft is applied. - -- The **Generate Microsoft Windows Installer (MSI) Package** capability in the Sequencer cannot be used with the Differential SFT file. - - - -## Related topics - - -[How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md b/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md deleted file mode 100644 index 06576c4ec4..0000000000 --- a/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Work Offline or Online with Application Virtualization -description: How to Work Offline or Online with Application Virtualization -author: dansimp -ms.assetid: aa532b37-8a00-4db4-9b51-e1e8354b2495 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Work Offline or Online with Application Virtualization - - -If you plan to be disconnected from the network for an extended period of time, you can work in offline mode to eliminate possible delays when the Application Virtualization client attempts to communicate with the server. In offline mode, the Application Virtualization client will not attempt to communicate with the publishing server, so applications must be fully cached before enabling offline mode. Applications will not be retrieved from the content share even if they are on the local disk on the computer. You can use the following Application Virtualization Client procedure to toggle between working offline and online. - -**Note**   -By default, **Work Offline** is disabled for the Client for Remote Desktop Services (formerly Terminal Services). Your system administrator must change your user permissions to allow you to use this setting on a Client for Remote Desktop Services. - - - -**To work offline** - -- Right-click the Application Virtualization System icon in the notification area, and select **Work Offline** from the pop-up menu. - -**To work online** - -- Right-click the Application Virtualization System icon in the notification area, and select **Work Online** from the pop-up menu. - -## Related topics - - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) - - - - - - - - - diff --git a/mdop/appv-v4/i b/mdop/appv-v4/i deleted file mode 100644 index e69de29bb2..0000000000 diff --git a/mdop/appv-v4/images/appvbranchoffices.gif b/mdop/appv-v4/images/appvbranchoffices.gif deleted file mode 100644 index 57ece467d2..0000000000 Binary files a/mdop/appv-v4/images/appvbranchoffices.gif and /dev/null differ diff --git a/mdop/appv-v4/images/appvfirewalls.gif b/mdop/appv-v4/images/appvfirewalls.gif deleted file mode 100644 index e72ffc5c0f..0000000000 Binary files a/mdop/appv-v4/images/appvfirewalls.gif and /dev/null differ diff --git a/mdop/appv-v4/images/appvmgmtwebservice.gif b/mdop/appv-v4/images/appvmgmtwebservice.gif deleted file mode 100644 index 303643d098..0000000000 Binary files a/mdop/appv-v4/images/appvmgmtwebservice.gif and /dev/null differ diff --git a/mdop/appv-v4/images/appvperimeternetworkfirewall.gif b/mdop/appv-v4/images/appvperimeternetworkfirewall.gif deleted file mode 100644 index b4f5a8d453..0000000000 Binary files a/mdop/appv-v4/images/appvperimeternetworkfirewall.gif and /dev/null differ diff --git a/mdop/appv-v4/improving-security-during-app-v-sequencing.md b/mdop/appv-v4/improving-security-during-app-v-sequencing.md deleted file mode 100644 index 2336ea5569..0000000000 --- a/mdop/appv-v4/improving-security-during-app-v-sequencing.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Improving Security During App-V Sequencing -description: Improving Security During App-V Sequencing -author: dansimp -ms.assetid: f30206dd-5749-4a27-bbaf-61fc21b9c663 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Improving Security During App-V Sequencing - - -Packaging applications for sequencing is the largest ongoing task in an App-V infrastructure. Because this task is ongoing, you should carefully consider creating policies and procedures to follow when sequencing applications. In App-V 4.5, during sequencing, you can capture Access Control Lists (ACLs) on the file assets of the virtualized application. - -## Virus Scanning on the Sequencer - - -It is a best practice to install the scanning software on the sequencing computer and then scan the computer for viruses and malware. After the sequencing computer is scanned and free of any viruses or malware, disable the scanning software, including all antivirus and malware detection software, on the sequencing computer before sequencing any applications. This speeds the sequencing process and prevents the scanning software components from being detected during sequencing and included in the virtual application package. - -## Capturing ACLs on Files (NTFS) - - -The Sequencer captures NTFS permissions (the ACLs) for the files that are monitored during the sequencing installation phase. (Before the release of App-V 4.5, ACLs were not captured as part of the sequencing process.) This new feature enables certain applications to run for users with a low level of permission that would normally require Administrative privileges. - -This feature also enables the sequencing engineer to capture the security settings identified by the vendor. Failing to apply the settings recommended by the vendor could leave the application open to attack or misuse by users. For information about whether or not you should deploy an application with open ACLs, refer to your application support group or the software vendor. - -**Important**   -Although the sequencer captures the NTFS ACLs while monitoring the installation phase of sequencing, it does not capture the ACLs for the registry. Users have full access to all registry keys for virtual applications except for services. However, if a user modifies the registry of a virtual application, that change is stored in a specific location (`uservol_sftfs_v1.pkg`) and won’t affect other users. - - - -During the installation phase, a sequencing engineer can modify the default permissions of the files if necessary. After the sequencing process is complete, but before saving the package, the sequencing engineer can then choose to enforce security descriptors that were captured during the installation phase. It is a best practice to enforce security descriptors if no other solution allows the application to run properly once virtualized. - - - - - - - - - diff --git a/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index fd19796eb2..0000000000 --- a/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Incompatible Installer Dialog Box (App-V 4.6 SP1) -description: Incompatible Installer Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 45d465b1-ee49-4274-8234-71dd031a07b6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Incompatible Installer Dialog Box (App-V 4.6 SP1) - - -The application did not install correctly. - -Use the following procedure to verify that the application you are trying to sequence is compatible with the computer running the sequencer. - -1. Close the App-V Sequencer. - -2. Install the application on the computer running the Sequencer without monitoring the installation. - -3. Verify that the application is compatible and can be installed successfully. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/index.md b/mdop/appv-v4/index.md deleted file mode 100644 index 02747f94e3..0000000000 --- a/mdop/appv-v4/index.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Application Virtualization 4 -description: Application Virtualization 4 -author: dansimp -ms.assetid: 9da557bc-f433-47d3-8af7-68ec4ff9bd3f -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Virtualization 4 - - -Microsoft Application Virtualization provides the administrative capability to make applications available to end user computers without having to install the applications directly on those computers. - -## Technical Documentation - - -The technical documentation for Application Virtualization in the TechNet Library contains the following sections: - -- [Microsoft Application Virtualization Getting Started Guide](microsoft-application-virtualization-getting-started-guide.md) - -- [Planning and Deployment Guide for the Application Virtualization System](planning-and-deployment-guide-for-the-application-virtualization-system.md) - -- [Operations Guide for the Application Virtualization System](operations-guide-for-the-application-virtualization-system.md) - -- [Online Help for Application Virtualization](online-help-for-application-virtualization.md) - -- [Application Virtualization Glossary](application-virtualization-glossary.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/installation-files-page.md b/mdop/appv-v4/installation-files-page.md deleted file mode 100644 index 0825e6eddc..0000000000 --- a/mdop/appv-v4/installation-files-page.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Installation Files Page -description: Installation Files Page -author: dansimp -ms.assetid: b0aad26f-b143-4f09-87a1-9f016a23cb62 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installation Files Page - - -Use the **Installation Files** page to specify the installation files that were used to create the virtual application package specified on the **Select Package** page of this wizard. If you created a virtual application package that contains multiple applications, you should copy all required installation files to a single folder on the computer running the Microsoft Application Virtualization Sequencer. - -This page contains the following elements: - -**Original Installation Files** -Click **Browse** to specify the installation files that were originally used to create the virtual application package. The parent directory you specify should be saved locally to the computer running the Sequencer and must contain all required installation files or subfolders that contain the installation files. The installation files can be contained in the parent folder or in any of the subfolders of the specified parent folder. - -**Files installed on local system** -Click **Browse** to specify the installation files that have been installed locally on the computer running the Sequencer. You can only select this option if the application installation files have been installed to the application’s default location. - -**Note**   -The default installation location you provide depends on the following conditions: - - - -- The package root specified when the package was originally created. - -- The installation location specified in the Windows Installer when the package was originally created. - -- The default application installation path. - -For example, if the package root specified is **Q:\\Office12** and during installation, the default installation location is changed from **C:\\Program Files\\Office12** to **Q:\\Office12**, then the path specified during dehydration must be **C:\\Program Files\\Office 12**. - -If the package root specified is **Q:\\Microsoft** and during installation, the default installation location is changed from **C:\\Program Files\\Office12** to **Q:\\Microsoft\\Office12**, then the path specified during dehydration must be **C:\\Program Files**. - -When you create a package using a package accelerator, each file in the package, for example **Q:\\Office12\\file.txt** is found on the local computer by replacing the package root **Q:\\Office12** with the default location specified when the Package Accelerator was created, for example, **C:\\Program Files\\Office12**. In the previous example, the file should be located in **C:\\Program Files\\Office12\\file.txt**. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/installation-page--learn-more-.md b/mdop/appv-v4/installation-page--learn-more-.md deleted file mode 100644 index 2979a1cb34..0000000000 --- a/mdop/appv-v4/installation-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Installation Page (Learn More) -description: Installation Page (Learn More) -author: dansimp -ms.assetid: a53b8330-dfc3-4540-b147-7c10529f403a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installation Page (Learn More) - - -Use the **Installation** page to run additional installation files that are required to complete the application installation. - -This page contains the following elements: - -**Run** -Opens the **Select installation file** dialog box. Specify the location of the additional installation files, Windows Installer and executable program files, and then click **Open**. - -**I am finished installing** -Enables the **Next** button. Select this option if no additional installation files are associated with this application. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/installation-report-page--learn-more-.md b/mdop/appv-v4/installation-report-page--learn-more-.md deleted file mode 100644 index b35a3f1345..0000000000 --- a/mdop/appv-v4/installation-report-page--learn-more-.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Installation Report Page (Learn More) -description: Installation Report Page (Learn More) -author: dansimp -ms.assetid: 499cf4db-a39c-4dcf-b1cf-85fd7da11701 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installation Report Page (Learn More) - - -Use the **Installation Report** page to review the results of the sequencing process. These reports can help diagnose common problems that can occur during sequencing. - -This page contains the following elements: - -**Information Pane** -Displays problems and additional information about the overall sequencing process. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md b/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md deleted file mode 100644 index c7ef697fc2..0000000000 --- a/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Installing App-V Management Server or Streaming Server Securely -description: Installing App-V Management Server or Streaming Server Securely -author: dansimp -ms.assetid: d2a51a81-a80f-427c-a727-611e1eb74f02 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Installing App-V Management Server or Streaming Server Securely - - -The topics in this section provide information for installing an enhanced security version of the App-V Management Server or the App-V Streaming Server. - -**Note**   -Installing or configuring an App-V Management or Streaming Server to use enhanced security (for example, Transport Layer Security, or TLS) requires that an X.509 V3 certificate has been provisioned to the App-V server. - - - -When you prepare to install or configure a secure Management or Streaming Server, consider the following technical requirements: - -- The certificate must be valid. If the certificate is not valid, the client ends the connection. - -- The certificate must contain the correct *Enhanced Key Usage* (EKU)—Server Authentication (OID 1.3.6.1.5.5.7.3.1). If the certificate does not contain this EKU, the client ends the connection. - -- The certificate fully qualified domain name (FQDN) must match the server on which it is installed. For example, if the client is calling `RTSPS://Myserver.mycompany.com/content/MyApp.sft` and the certificate **Issued To** field is set to `Server1.mycompany.com`, the client will not connect to the server and the session ends. The failure is reported to the user. - - **Note**   - If you are using App-V in a Network Load Balancing cluster, you must configure the certificate with Subject Alternate Names (SANs) to support RTSPS. For information about configuring the certification authority (CA) and creating certificates with SANs, see . - - - -- The client and the server need to trust the root CA—The CA issuing the certificate to the App-V server must by trusted by the client connecting to the server. If not, the client ends the connection. - -- The certificate’s private key must have permissions changed to allow the App-V Service account to access the certificate. By default, App-V uses the Network Service account, and by default, the Network Service account does not have permission to access the private key, which will prevent secure connections. - -## In This Section - - -[Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md) -Provides information about obtaining, configuring, and installing certificates to support secure streaming. - -[How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md) -Provides procedures you can use to modify keys in Windows Server 2003 and Windows Server 2008. - -[Configuring Certificates to Support App-V Management Server or Streaming Server](configuring-certificates-to-support-app-v-management-server-or-streaming-server.md) -Provides information about configuring certificates for the App-V Management or Streaming Servers, including information about configuring certificates for Network Load Balancing environments. - - - - - - - - - diff --git a/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md b/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md deleted file mode 100644 index 9821a7ba66..0000000000 --- a/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Internet-Facing Considerations for App-V Clients -description: Internet-Facing Considerations for App-V Clients -author: dansimp -ms.assetid: 261acde3-7112-492e-8b11-934ae45adc5f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Internet-Facing Considerations for App-V Clients - - -The topics in this section includes information about Internet-facing configurations for domain-joined and non-domain joined clients, as well as procedures you can use to assign the proper credentials to your App-V Desktop Clients. - -## In This Section - - -[Domain-Joined and Non-Domain-Joined Clients](domain-joined-and-non-domain-joined-clients.md) -Provides general information about configuring domain-joined or non-domain-joined clients for successful network access. - -[How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md) -Provides a step-by-step procedure for assigning credentials on an App-V Desktop Client running Windows XP. - -[How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md) -Provides a step-by-step procedure for assigning credentials on an App-V Desktop Client running Windows Vista. - -  - -  - - - - - diff --git a/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md b/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md deleted file mode 100644 index 5d2b394c68..0000000000 --- a/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Internet-Facing Server Scenarios for Perimeter Networks -description: Internet-Facing Server Scenarios for Perimeter Networks -author: dansimp -ms.assetid: 8a4da6e6-82c7-49e5-b9b1-1666cba02f65 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Internet-Facing Server Scenarios for Perimeter Networks - - -App-V 4.5 supports Internet-facing server scenarios, in which users who are not connected to the corporate network or who disconnect from the network can still use App-V. As shown in the following illustration, only the use of secure protocols on the Internet (RTSPS and HTTPS) is supported. - -![app-v firewall positioning diagram](images/appvfirewalls.gif) - -You can set up an Internet-facing solution, using an ISA Server, where the App-V infrastructure is on the internal network in the following ways: - -- Create a Web Publishing rule for the IIS server that is hosting the ICO and OSD files—and optionally, the packages for streaming—located on the internal network. Detailed steps are provided at . - -- Create a Server Publishing rule for the App-V Web Management Server (RTSPS). Detailed steps are provided at [https://go.microsoft.com/fwlink/?LinkId=151983&](https://go.microsoft.com/fwlink/?LinkId=151983). - -As shown in the following illustration, if the infrastructure has implemented other firewalls between the client and the ISA Server or between the ISA Server and the internal network, both RTSPS (TCP 322) and HTTPS (TCP 443) firewall rules must be created to support the flow of traffic. Also, if firewalls have been implemented between the ISA Server and the internal network, the default traffic required for domain members must be permitted to tunnel through the firewall (DNS, LDAP, Kerberos, SMB/CIFS). - -![app-v perimeter network firewall diagram](images/appvperimeternetworkfirewall.gif) - -Because the firewall solutions vary from environment to environment, the guidance provided in this topic describes the traffic that would be required to configure an Internet-facing App-V environment in the perimeter network. This information also includes the recommended internal network servers. - -Place the following servers in the perimeter network: - -- App-V Management Server - -- IIS server for publishing and streaming - -**Note**   -It is a best practice to place the Management Server and IIS server on separate computers. - - - -Place the following servers in the internal network: - -- Content server - -- Data store (SQL Server) - -- Active Directory Domain Controller - -## Traffic Requirements - - -The following tables list the traffic requirements for communication from the Internet and the perimeter network and from the perimeter network to the internal network. - - ---- - - - - - - - - - - - - - - - - -
    Traffic Requirements from Internet to Perimeter NetworkDetails

    RTSPS (publishing refresh and streaming packages)

    TCP 322 by default; this can be changed in App-V Management Server.

    HTTPS (publishing ICO and OSD files and streaming packages)

    TCP 443 by default; this can be changed in the IIS configuration.

    - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Traffic Requirements from Perimeter Network to Internal NetworkDetails

    SQL Server

    TCP 1433 is the default but can be configured in SQL Server.

    SMB/CIFS

    If the content directory is located remotely from the Management Server(s) or IIS server (recommended).

    Kerberos

    TCP and UDP 88

    LDAP

    TCP and UDP 389

    DNS

    For name resolution of internal resources (can be eliminated with the use of host’s file on perimeter network servers)

    - - - - - - - - - - - diff --git a/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md b/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md deleted file mode 100644 index b621871cef..0000000000 --- a/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md +++ /dev/null @@ -1,85 +0,0 @@ ---- -title: Introduction to the Application Virtualization Security Guide -description: Introduction to the Application Virtualization Security Guide -author: dansimp -ms.assetid: 50e1d220-7a95-45b8-933b-3dadddebe26f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Introduction to the Application Virtualization Security Guide - - -This Microsoft Application Virtualization (App-V) security guide provides instructions for administrators who are responsible for configuring the security features that were selected for the App-V deployment. - -**Note**   -This documentation does not provide guidance for choosing the specific security options. That information is provided in the App-V Security Best Practices white paper available at . - - - -As an App-V administrator using this guide, you should be familiar with the following security-related technologies: - -- Active Directory Domain Services - -- Public key infrastructure (PKI) - -- Internet Protocol Security (IPsec) - -- Group Policies - -- Internet Information Services (IIS) - -## APP-V Infrastructure Components - - -When planning an enhanced security App-V environment, you can consider several different infrastructure models. - -**Note**   -For more information about App-V infrastructure models, see the following documentation: - -- [App-V Planning and Deployment Guide](https://go.microsoft.com/fwlink/?LinkId=122063) - -- [Infrastructure Planning and Design Guide Series](https://go.microsoft.com/fwlink/?LinkId=151986) - - - -These models utilize some but possibly not all of the App-V components depicted in the following illustration. - -![app-v branch office diagram](images/appvbranchoffices.gif) - -Application Virtualization (App-V) Management Server -The App-V Management Server streams the package content and publishes the shortcuts and file-type associations to the App-V Client. The App-V Management Server also supports active upgrade, license management, and a database that can be used for reporting. - -Application Virtualization (App-V) Streaming Server -The App-V Streaming Server hosts the packages for streaming to App-V Clients in environments such as branch offices, where the bandwidth of the connection to the App-V Management Server is insufficient for streaming package content to clients. The Streaming Server contains only streaming functionality and does not provide you with the App-V Management Console or the App-V Management Web Service. - -Application Virtualization (App-V) Data Store -The App-V data store, in the SQL database, retains information related to the App-V infrastructure. The information in the App-V data store includes all application records, application assignments, and which groups manage the Application Virtualization environment. - -Application Virtualization (App-V) Management Service -The App-V Management Service communicates read/write requests to the Application Virtualization data store. This component can be installed on the same computer as the App-V Management Server or on a separate computer with IIS installed. - -Application Virtualization (App-V) Management Console -The App-V Management Console is a snap-in management utility for App-V Server administration. This component can be installed on the same computer as the App-V Server or on a separate workstation that has MMC 3.0 and .NET 2.0 installed. - -Application Virtualization (App-V) Sequencer -The App-V Sequencer monitors and captures the installation of applications and creates virtual application packages. The output of the Sequencer consists of the application icon, the OSD file containing application definition information, a package manifest file, and an SFT file containing the application’s content files. Optionally, a Windows Installer file can be created for installing the package without using the App-V infrastructure. - -Application Virtualization (App-V) Client -The App-V Client is installed on the App-V Desktop Client computer or on the App-V Terminal Services Client computer. It provides the virtual environment for the virtual application packages. The App-V Client manages the package streaming to the cache, virtual application publishing refresh, and interaction with the Application Virtualization Servers. - - - - - - - - - diff --git a/mdop/appv-v4/load-app.md b/mdop/appv-v4/load-app.md deleted file mode 100644 index 8b07665623..0000000000 --- a/mdop/appv-v4/load-app.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: LOAD APP -description: LOAD APP -author: dansimp -ms.assetid: 7b727d0c-5423-419d-92ef-7ebbc6343e79 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# LOAD APP - - -Loads the specified application and all other applications in the package into the file system cache. - -**Note**   -The **LOAD APP** command starts the load process and a progress bar is displayed in the Desktop Notification Area. The command exits immediately after starting this process, so any load errors are displayed in the same location. Use the **LOAD PACKAGE** command if you want to start the load process from the command line without using the Desktop Notification Area. - - - -`SFTMIME LOAD APP:application [/LOG log-pathname | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application to load.

    /LOG

    If specified, output is logged to the specified path name.

    /GUI

    If specified, output is presented in a Windows dialog box.

    - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/load-package.md b/mdop/appv-v4/load-package.md deleted file mode 100644 index 025e980fda..0000000000 --- a/mdop/appv-v4/load-package.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: LOAD PACKAGE -description: LOAD PACKAGE -author: dansimp -ms.assetid: eb19116d-e5d0-445c-b2f0-3116a09384d7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# LOAD PACKAGE - - -Loads the specified package into the file system cache. - -`SFTMIME LOAD PACKAGE:package-name [/SFTPATH sft-pathname] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    PACKAGE:<package-name>

    The name of the package to load.

    /SFTPATH <sft-pathname>

    If specified, the path to an SFT file to load from.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - - - -**Note**   -If no SFTPATH is specified, the client will load the package by using the path it has been configured to use, based on the OSD file, the ApplicationSourceRoot registry key value, or the OverrideURL setting. - -The **LOAD PACKAGE** command performs a synchronous load and will not be complete until the package is fully loaded or until it encounters an error condition. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/lock-app.md b/mdop/appv-v4/lock-app.md deleted file mode 100644 index 1032c581d6..0000000000 --- a/mdop/appv-v4/lock-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: LOCK APP -description: LOCK APP -author: dansimp -ms.assetid: 30673433-4364-499f-8116-cb135fe2716f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# LOCK APP - - -Locks the application specified in the file system cache. - -`SFTMIME LOCK APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application to lock.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/log-file-for-the-application-virtualization-client.md b/mdop/appv-v4/log-file-for-the-application-virtualization-client.md deleted file mode 100644 index 1dec527a68..0000000000 --- a/mdop/appv-v4/log-file-for-the-application-virtualization-client.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Log File for the Application Virtualization Client -description: Log File for the Application Virtualization Client -author: dansimp -ms.assetid: ac4b3e4a-a220-4c06-bd60-af7dc318b3a9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Log File for the Application Virtualization Client - - -The log file for the Application Virtualization (App-V) Client captures detailed information about operations and error conditions. You can use it when you are verifying functionality and when you are troubleshooting issues. - -When the App-V Client is first installed, the log file is created by default in the location shown in the following table. The location of the log file is new for Application Virtualization (App-V) 4.5, although the location will not be changed if the client is upgraded from an earlier version. - - ---- - - - - - - - - - - - - -
    Log File NameDescription

    sftlog.txt

    Provides general information about App-V Client operations and errors. Use this log as a starting point for troubleshooting App-V Client errors.

    -

    Log file location for either the Desktop Client or the Client for Remote Desktop Services (formerly Terminal Services):

    -
      -
    • C:\Documents and Settings\All Users\Application Data\Microsoft\Application Virtualization Client: Windows XP, Windows Server 2003

    • -
    • C:\ProgramData\Microsoft\Application Virtualization Client: Windows Vista, Windows Server 2008

    • -
    - -  - -## Related topics - - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md b/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md deleted file mode 100644 index fd8062d829..0000000000 --- a/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Log Files for the Application Virtualization Sequencer -description: Log Files for the Application Virtualization Sequencer -author: dansimp -ms.assetid: 1a296544-eab4-46f9-82ce-3136f8b578af -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Log Files for the Application Virtualization Sequencer - - -The log files for the Application Virtualization (App-V) Sequencer provide detailed information about sequencing applications, and they can be helpful when you are verifying functionality or when you are troubleshooting issues. - -The following table provides information about the log files and their default locations, which are created when using the Sequencer. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Log File NameDescription

    sft-seq-log.txt

    Provides general information about sequencing an application. Use this log as a starting point for troubleshooting Sequencer errors.

    -

    Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs

    -

    [Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value]

    sftbt.txt

    Provides information about computer restart tasks that occur during the Sequencer’s simulated restart.

    -

    Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs

    -

    [Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value]

    SftCallBack.txt

    Provides general information about processes used during sequencing.

    -

    Log file location: %windir%\Microsoft Application Virtualization Sequencer\Logs

    -

    [Template Token Value] App-V 4.6 log file location: %windir%\Program Files\Microsoft Application Virtualization Sequencer\Logs[Template Token Value]

    - -  - -## Related topics - - -[Application Virtualization Sequencer Reference](application-virtualization-sequencer-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md deleted file mode 100644 index fe711b15c3..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md +++ /dev/null @@ -1,146 +0,0 @@ ---- -title: Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement -description: Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement -author: dansimp -ms.assetid: e82c57ea-885d-4761-96db-4d80b1c3e1ae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft Application Virtualization, 4.6 Service Pack 1 (“App-V”).  Specifically, the privacy statement describes the features in Service Pack 1 that send information to others, including Microsoft. It does not apply to other online or offline Microsoft sites, products, or services. - -App-V transforms applications into virtualized, network-available services resulting in dynamic delivery of software that is never installed, does not conflict, and minimizes costly application compatibility testing. Users and their application environments are no longer machine-specific, and the machines themselves are no longer user-specific, enabling IT to be flexible and responsive to business needs, and significantly reducing the cost of PC management, including application and operating system (OS) migrations. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized.  It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements.  Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft App-V may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well.  - -The privacy details for each App-V feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of your information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to this privacy statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us at: - -Microsoft Privacy - -Microsoft Corporation - -One Microsoft Way - -Redmond, Washington 98052 USA - -## Specific features - - -The remainder of this document will address the following specific features: - -## Customer Experience Improvement Program - - -### What This Feature Does: - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services.  We will not collect your name, address, or other contact information. - -### Information Collected, Processed, or Transmitted: - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -### Use of Information: - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -### Choice/Control: - -You are offered the opportunity to participate in CEIP during setup. If you choose to participate and later change your mind, you can turn off CEIP at any time by: - -1. Select “Help” on the main toolbar. - -2. Select “Customer Feedback Options”. - -## Microsoft Error Reporting - - -### What This Feature Does: - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with App-V to Microsoft and to receive information that may help you avoid or solve such problems. - -### Information Collected, Processed, or Transmitted: - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at . - -### Use of Information: - -We use the error reporting data to solve customer problems and improve our software and services. - -### Important Information: - -App-V does not change your Microsoft Error Reporting settings. If you previously turned on error reporting, it will send the information described above. Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at [https://go.microsoft.com/fwlink/?LinkId=35776](https://go.microsoft.com/fwlink/?LinkID=35776). - -## Application Package Accelerators - - -### What This Feature Does: - -Customers can use Application Package Accelerators to automatically package complex applications without installing the application. The App-V sequencer allows you to create package accelerators for each virtual package. You can then use these package accelerators to automatically re-create the same virtual package in the future. You may also use package accelerators released by Microsoft or other third parties to simplify and automate packaging of complex applications. - -### Information Collected, Processed, or Transmitted: - -Application Package Accelerators may contain information such as computer names, user account information, and information about applications included in the Package Accelerator file. - -If you plan to share Application Package Accelerators with anyone outside your organization you should review all the settings and ensure the Package Accelerators do not contain any personal or company information. You can view the contents by opening the Package Accelerator files using any XML viewer. The following are ways you can view and remove any computer or user information from the Package Accelerator files before sharing with anyone outside your company: - -- **Username** - When you log on to the computer running the App-V sequencer you should use a generic user account, such as **administrator**. You should not use an account that is based on an existing username. - -- **Computer Name**– Specify a general, non-identifying name for the computer that is running the App-V Sequencer. - -- **Server URL**– Use the default settings for the server URL configuration information on the **Deployment** tab in the App-V Sequencer console. - -- **Applications** – If you do not want to share the list of applications that were installed on the computer running the sequencer when you created the Package Accelerator you must delete the **appv\_manifest.xml** file. This file is located in the package root directory of the virtual application package. - -No information is sent to Microsoft through customers’ use of the Application Package Accelerator feature. - -  - -  - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md deleted file mode 100644 index 55db6ca874..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md +++ /dev/null @@ -1,227 +0,0 @@ ---- -title: Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement -description: Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement -author: dansimp -ms.assetid: 4ee569b2-7711-475a-9f17-70247f00b1b7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft Application Virtualization (App-V). Specifically, the privacy statement describes the features that send information to others, including Microsoft. It does not apply to other online or offline Microsoft sites, products, or services. - -App-V transforms applications into virtualized, network-available services resulting in dynamic delivery of software that is never installed, does not conflict, and minimizes costly application compatibility testing. Users and their application environments are no longer machine-specific, and the machines themselves are no longer user-specific, enabling IT to be flexible and responsive to business needs, and significantly reducing the cost of PC management, including application and operating system (OS) migrations. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by App-V may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -Because this is a pre-release version of the software, some of these Internet-enabled features are turned on by default so that we can collect enough information about how the software is working in order to improve the commercially released software. The default settings in this pre-release software do not necessarily reflect how these features will be configured in the commercially released software. - -The privacy details for each App-V feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of your information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to this privacy statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us at . - -## Specific features - - -The remainder of this document will address the following specific features: - -**Note**   -This section is divided into two parts: (1) features in all versions of App-V and (2) features in App-V 4.6 SP1 and later. - - - -### Microsoft Error Reporting - -**What This Feature Does:** - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with App-V to Microsoft and to receive information that may help you avoid or solve such problems. - -**Information Collected, Processed, or Transmitted:** - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at . - -**Use of Information:** - -We use the error reporting data to solve customer problems and improve our software and services. - -**Choice/Control:** - -App-V does not change your Microsoft Error Reporting settings. If you previously turned on error reporting, it will send Microsoft the information about the errors you encountered. When Microsoft needs additional data to analyze the problem, you will be prompted to review the data and choose whether or not to send it.  App-V will always respect your Microsoft Error Reporting settings. - -**Important Information:** - -Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at . - -### Microsoft Update - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software, including App-V.  For details about what information is collected, how it is used and how to change your settings, see the Update Services Privacy Statement at . - -**Choice/Control:** - -If Microsoft Update is not enabled, you can opt-in during setup and subsequent checks for updates will follow the machine-wide schedule. You can update this option from the Microsoft Update Control Panel item. - -### Collection/Transmission of Configuration Data - -**What This Feature Does:** - -The product will collect various configuration items, including UserID, MachineID and SecurityGroup details, to be able to enforce settings on managed nodes. The data is stored in the App-V SQL database and transmitted across the App-V server and client components to enforce the configuration on the managed node. - -**Information Collected, Processed, or Transmitted:** - -User and machine information and configuration content - -**Use of Information:** - -The information is used to enforce the application access configuration on the managed nodes within the enterprise. The information does not leave the enterprise. - -**Choice/Control:** - -By default, the product does not have any data. All data is entered and enabled by the admin and can be viewed in the Management console. The feature cannot be disabled as this is the product functionality. To disable this, App-V will need to be uninstalled. - -**Important Information:** - -None of this information is sent out of the enterprise. - -### Package History Information - -**What This Feature Does:** - -It captures package history and asset information as part of the package. - -**Information Collected, Processed, or Transmitted:** - -Information about the package and the sequencing environment is collected and stored in the package manifest during sequencing. - -**Use of Information:** - -The information will be used by the admin to track the updates done to a package during its lifecycle. It will also be used by software deployment systems to track the package deployments within the organization. - -**Choice/Control:** - -This feature is always enabled and cannot be turned off. - -**Important Information:** - -This administrator information will be stored in the package and can be viewed by the end users if they access the XML associated with the application. - -### Collection and Transmission of Reporting Data - -**What This Feature Does:** - -The product will collect a variety of reporting data points, including the username, to allow reporting on the usage of the product. - -**Information Collected, Processed, or Transmitted:** - -Information about the machine, package and application usage are collected from every machine that reporting is enabled on. - -**Use of Information:** - -The information is used to report on application usage within the enterprise. The information does not leave the enterprise. - -**Choice/Control:** - -By default, the product does not have any data. Data is only collected once the reporting feature is enabled on the App-V Client. To disable the collection of reporting data, the reporting feature must be disabled on all clients. - -**Important Information:** - -None of this information is sent out of the enterprise. - -### Features in App-V 4.6 SP1 and later - -This section addresses specific features available in App-V 4.6 SP1 and later. - -### Customer Experience Improvement Program - -**What This Feature Does:** - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We will not collect your name, address, or other contact information. - -**Information Collected, Processed, or Transmitted:** - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -**Use of Information:** - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -**Choice/Control:** - -CEIP is optional and the opt-in status can be updated during install or post install from the GUI.   - -### Application Package Accelerators - -**What This Feature Does:** - -Customers can use Application Package Accelerators to automatically package complex applications without installing the application. The App-V sequencer allows you to create package accelerators for each virtual package. You can then use these package accelerators to automatically re-create the same virtual package in the future. You may also use package accelerators released by Microsoft or other third parties to simplify and automate packaging of complex applications. - -**Information Collected, Processed, or Transmitted:** - -Application Package Accelerators may contain information such as computer names, user account information, and information about applications included in the Package Accelerator file. - -If you plan to share Application Package Accelerators with anyone outside your organization you should review all the settings and ensure the Package Accelerators do not contain any personal or company information. You can view the contents by opening the Package Accelerator files using any XML viewer. The following are ways you can view and remove any computer or user information from the Package Accelerator files before sharing with anyone outside your company: - -- **Username** - When you log on to the computer running the App-V sequencer you should use a generic user account, such as **administrator**. You should not use an account that is based on an existing username. - -- **Computer Name**– Specify a general, non-identifying name for the computer that is running the App-V Sequencer. - -- **Server URL**– Use the default settings for the server URL configuration information on the **Deployment** tab in the App-V Sequencer console. - -- **Applications** – If you do not want to share the list of applications that were installed on the computer running the sequencer when you created the Package Accelerator you must delete the **appv\_manifest.xml** file. This file is located in the package root directory of the virtual application package. - -No information is sent to Microsoft through customers’ use of the Application Package Accelerator feature. - -## Related topics - - -[About Microsoft Application Virtualization 4.6 SP2](about-microsoft-application-virtualization-46-sp2.md) - - - - - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md b/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md deleted file mode 100644 index c0c55aa648..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Microsoft Application Virtualization Client Management Help -description: Microsoft Application Virtualization Client Management Help -author: dansimp -ms.assetid: 449eebda-70eb-48b7-855a-db965a680923 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization Client Management Help - - -The Microsoft Application Virtualization Desktop Client and the Client for Remote Desktop Services (formerly Terminal Services) provide the interface you can use to manage virtual applications on your computer. Through the user interface, you can manage applications and file type associations, and you can refresh applications from the Application Virtualization Management Servers (also referred to as application publishing servers). - -This help documentation supports the Application Virtualization Desktop Client and Client for Remote Desktop Services. It includes conceptual information, step-by-step procedures, and a user interface reference. - -For the latest updates to this help documentation, please visit the Microsoft TechNet Library at . - -## In This Section - - -[Application Virtualization Client Management Console Roadmap](application-virtualization-client-management-console-roadmap.md) -Includes overview information about the Client Management Console. - -[About Virtual Environments](about-virtual-environments.md) -Describes virtual environments and the way virtual applications affect the environment. - -[How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md) -Includes information about using the features and commands that are available from the Windows desktop notification area. - -[Application Virtualization Client Management Console](application-virtualization-client-management-console.md) -Includes an overview as well as step-by-step procedures for using the features and commands that are available in the Application Virtualization Client. - -[Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md) -Includes reference information about the screen elements and dialog boxes that are available in the Application Virtualization Desktop Client and the Client for Remote Desktop Services. - -  - -  - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md b/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md deleted file mode 100644 index 6f19e8f359..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Microsoft Application Virtualization Getting Started Guide -description: Microsoft Application Virtualization Getting Started Guide -author: dansimp -ms.assetid: 6cd9a212-e270-4d7c-bd0a-bd6af9a5c3ba -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Microsoft Application Virtualization Getting Started Guide - - -This Getting Started Guide provides essential information that will help you design your Microsoft Application Virtualization (App-V) system and assist in your deployment and upgrade planning. - -## In This Section - - -[Overview of Application Virtualization](overview-of-application-virtualization.md) -Provides a summary of the App-V system features. - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) -Provides the guidance necessary to plan the implementation and deployment of your Application Virtualization system, and to migrate from previous versions. - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations-copy.md) -Provides information about hardware and software requirements for installing the various Application Virtualization components and upgrade information. - -[About Microsoft Application Virtualization 4.5](about-microsoft-application-virtualization-45.md) -Describes the features introduced in App-V 4.5 and also includes the App-V 4.5 release notes documentation. - -[About Microsoft Application Virtualization 4.5 SP1](about-microsoft-application-virtualization-45-sp1.md) -Describes the changes introduced in App-V 4.5 with SP1 and also includes the App-V 4.5 SP1 release notes documentation. - -[About Microsoft Application Virtualization 4.5 SP2](about-microsoft-application-virtualization-45-sp2.md) -Describes what’s new in App-V 4.5 with SP2 and also includes the App-V 4.5 SP2 release notes documentation. - -[About Microsoft Application Virtualization 4.6](about-microsoft-application-virtualization-46.md) -Describes what’s new in App-V 4.6 and also includes the App-V 4.6 release notes documentation. - -[About Microsoft Application Virtualization 4.6 SP1](about-microsoft-application-virtualization-46-sp1.md) -Describes what’s new in App-V 4.6 SP1 and also includes the App-V 4.6 release notes documentation. - -[About Microsoft Application Virtualization 4.6 SP3](about-microsoft-application-virtualization-46-sp3.md) -Describes what’s new in App-V 4.6 SP3 and also includes the App-V 4.6 release notes documentation. - -  - -  - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md deleted file mode 100644 index 2add0e46ac..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md +++ /dev/null @@ -1,221 +0,0 @@ ---- -title: Microsoft Application Virtualization Management System Release Notes 4.5 SP1 -description: Microsoft Application Virtualization Management System Release Notes 4.5 SP1 -author: dansimp -ms.assetid: 5d6b11ea-7b87-4084-9a7c-0d831f247aa3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization Management System Release Notes 4.5 SP1 - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. These Release Notes contain information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative. - - - -For updated information about known issues, please visit the Microsoft TechNet Library at . - -## About Microsoft Application Virtualization 4.5 Service Pack 1 - - -These Release Notes have been updated to reflect the changes introduced with Microsoft Application Virtualization (App-V) 4.5 Service Pack 1 (SP1). This service pack contains the following changes: - -- Support for Windows 7 and Windows Server 2008 R2: App-V 4.5 SP1 provides support for Windows 7 and Windows Server 2008 R2, including support for Windows 7 features such as the taskbar, AppLocker, BranchCache, and BitLocker To Go.  Windows Server 2008 R2 support is for the Application Virtualization Server only. For more information on AppLocker support in Windows 7, see . - -- Support for 3rd Party Kerberos Realms: App-V 4.5 SP1 provides support for environments that have a trust relationship and mapped user accounts between a Windows domain and an MIT Kerberos realm, which is a scenario that is common at many universities. For information on how to enable this support, please visit the Microsoft TechNet Library at . - -- Improved support for application publishing and streaming via HTTP/HTTPS: App-V 4.5 SP1 provides support for application publishing and streaming via the HTTP/HTTPS protocols for Windows XP Home Edition, Windows Vista Home Basic, and Windows 7 Home Basic. - -- Customer Feedback and Hotfix Rollup: App-V 4.5 SP1 also includes a rollup up of fixes to address issues found since the Microsoft Application Virtualization (App-V) 4.5 CU1 release. The updates are a result of a combination of known issues and customer feedback from our internal teams, partners, and customers who are using App-V 4.5. For a full list of the updates, see the KB article at . - -## About the Product Documentation - - -Comprehensive documentation for Application Virtualization (App-V) is available on Microsoft TechNet in the Application Virtualization (App-V) TechCenter at . The TechNet documentation includes the online Help for the Application Virtualization Sequencer, the Application Virtualization Client, and the Application Virtualization Server. It also includes the Application Virtualization Planning and Deployment Guide and the Application Virtualization Operations Guide. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, we recommend that you install the latest available security updates for any new software being installed. For more information, see the Microsoft Security Web site at . - -## Providing Feedback - - -You can provide feedback, make a suggestion, or report an issue with the Microsoft Application Virtualization (App-V) Management System via a community forum on the Microsoft Application Virtualization TechCenter (). - -You can also provide your feedback on the documentation directly to the App-V documentation team. Send your documentation feedback to appvdocs@microsoft.com. - -## Known Issues with Application Virtualization 4.5 SP1 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.5 SP1. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases of the software. - -### Guidance for installing Server Management Console - -If you need to install management software onto systems other than the primary Application Virtualization publishing and streaming server, the server install supports installing the Management Console and Management Web service on separate servers from the primary App-V Management Server. To distribute the management components across multiple servers, Kerberos delegation must be enabled on the server where the Web service is installed. For information on how to enable this support, please visit the Microsoft TechNet Library at - -### Guidance for installing or upgrading clients to App-V 4.5 SP1 using setup.msi - -When installing or upgrading your App-V clients to App-V 4.5 SP1 by using setup.msi, the prerequisites are not installed automatically. - -WORKAROUND   You must manually install the prerequisites before installing or upgrading the App-V client to App-V 4.5 SP1. For detailed procedures for installing the prerequisites and the App-V client, see . - -When this has been completed, install the App-V 4.5 SP1 client by using setup.msi with elevated privileges. This file is available on the App-V 4.5 SP1 release media in the Installers\\Client folder. - -When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 SP1 Desktop client: - - msiexec /i dw20shared.msi APPGUID={93468B43-C19D-44F9-8BCC-114076DB0443}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus - -Alternatively, if you are installing or upgrading to the App-V 4.5 SP1 Client for Remote Desktop Services (formerly Terminal Services), use the following command: - - msiexec /i dw20shared.msi APPGUID={0042AD3C-99A4-4E58-B5F0-744D5AD96E1C} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus - -**Note**   -The APPGUID parameter references the product code of the App-V client that you install or upgrade. The product code is unique for each setup.msi. You can use the Orca database editor or a similar tool to examine Windows Installer files and determine the product code. This step is required for all installations or upgrades to App-V 4.5 SP1. - - - -### Improving performance when sequencing the .NET Framework - -When sequencing the .NET Framework, you might experience reduced system performance because the Microsoft .NET Framework NGEN service attempts to precompile assemblies as a background task. - -WORKAROUND   When sequencing the .NET Framework, disable the Microsoft .NET Framework NGEN service (mscorsvw.exe) after completing the monitoring phase. You must use the **Virtual Services** tab in the Sequencer and change the startup type to disabled. - -### When you uninstall the Microsoft Application Virtualization Client, user settings associated with the user performing the uninstall will be deleted - -When you uninstall the App-V Client, the Windows Installer will remove Application Virtualization settings from the current user's profile. If your computer uses roaming profiles, do not use your personal network account to uninstall the client because it will remove settings for your virtual applications on all of your computers. - -WORKAROUND   You should perform the App-V Client uninstall with an administrative account that is not used for running virtual applications. - -### Edits made on the virtual file system and virtual registry tabs must be saved while running the Sequencing wizard - -If you open a package to perform an upgrade, or if you have already run the Sequencing wizard with a new package and make changes to the package in the virtual file system or virtual registry tabs, those changes are not automatically saved. - -WORKAROUND   Save the changes before re-running the wizard, to ensure that they are reflected inside the wizard’s virtual environment. - -### Command-line Sequencer must be run from an elevated command prompt - -When you use the command-line Sequencer, it does not prompt for elevation. - -WORKAROUND   Run the command-line Sequencer using an elevated command prompt. - -### Short path variable names in OSD files can cause errors - -If you receive error 450478-1F702339-0000010B “The directory name is invalid” when starting a virtual application on the client, it is possible that the variable in the OSD is set incorrectly. This can happen if the application’s installer sets a short path name during sequencing. - -WORKAROUND   Remove the trailing tilde from any CSIDL variable that exists in the OSD file. - -### Correct syntax for DECODEPATH parameter for command-line Sequencer - -In the command-line Sequencer, when opening a package for upgrade and decoding it to the root of the Q drive, the syntax for the *DECODEPATH* parameter should not include a trailing slash. - -WORKAROUND   You can use **Q:** rather than **Q:\\** (omitting the trailing “\\” character). - -### When upgrading 4.2 packages, you encounter problems caused by Windows Installer files in the Virtual File System - -When upgrading a package from 4.2, you might experience issues relating to a mismatch of Windows Installer system files that were included by default in 4.2 and the Windows Installer libraries locally installed on your Sequencing workstation. The following files are located in CSIDL\_SYSTEM\\: - -cabinet.dll - -msi.dll - -msiexec.exe - -msihnd.dll - -msimsg.dlll - -WORKAROUND   Delete all of the preceding files from the package. Delete the mappings on the **VFS** tab as well as the actual files in the CSIDL\_SYSTEM folder in your decode path. - -### On Windows XP, client install logging is not enabled by default - -When installing the client, to ensure that any install errors are captured for troubleshooting purposes, you should enable logging by using the command line. - -WORKAROUND   Add the parameter */l\*vx! log.txt* to the command line, as shown in the following example: - -setup.exe /s /v”/qn /l\*vx! log.txt” - -msiexec.exe /i setup.msi /qn /l\*vx! log.txt - -Alternatively, you can set the registry key to the following value: - -\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\] "Logging"="voicewarmupx!" - -### For Kerberos authentication to work, Service Principal Names (SPNs) must be registered for IIS - -When using IIS 6.0 or 7.0 for icon or OSD file retrieval and streaming of packages, for Kerberos authentication to be enabled, the SPNs must be registered as follows: - -- On the IIS server, run the following commands by using the SETSPN.EXE Resource Kit tool. The server fully qualified domain name (FQDN) must be used. - - Setspn -r SOFTGRID/<Server FQDN> - - Setspn -r HTTP/<Server FQDN> - -For more information, see . - -### .NET compatibility changes - -Microsoft Application Virtualization (App-V) Cumulative Update 1 or later supports sequencing the .NET Framework on Windows XP (SP2 or later). Sequencing routines for .NET applications that were written for SoftGrid 4.2 might need to be updated when used with the App-V 4.5 Sequencer. For details and workarounds, please refer to the Knowledge Base article at . - -### After client upgrade from App-V 4.2, some applications are not shown - -Check for the following error in the log: ”The Application Virtualization Client could not parse the OSD file”. The App-V 4.5 client filters out applications that have an OSD file containing an empty OS tag (<OS></OS>). - -WORKAROUND   Delete the empty OS tag from the OSD file. - -### The App-V server requires exemptions in its firewall for certain processes - -For the server to stream applications correctly, the server's core processes, including the dispatcher, need access through the firewall. - -WORKAROUND   Set exemptions in the server's firewall for the following processes: sghwsvr.exe and sghwdsptr.exe. This applies to the App-V Management Server and App-V Streaming Server. - -### When the server installer is run in silent mode, it does not correctly check for MSXML6 - -The App-V Management Server depends on MSXML6. However, if you run the installer in silent mode—for example, by using the command “msiexec -i setup.msi /qn” on a system where MSXML6 is not already installed—the installer does not detect the missing dependency and installs anyway. Therefore, when clients attempt to refresh publishing information from the App-V Management Server, they will see failures. - -WORKAROUND   Verify that MSXML6 is installed on the system before attempting a silent install of the App-V Management Server. - -### Error code 000C800 when attempting to connect to the Application Virtualization Management Console - -An Application Virtualization administrator who is not a local administrator on the App-V Management Web Service server will receive an error (Error code: 000C800) when attempting to connect to the App-V Management Console, and the sftmmc.log entry will indicate that access to SftMgmt.udl is denied. To successfully connect to the App-V Management Console, an administrator who does not have local administrator rights on the App-V Management Web Service server must have at least read and execute permissions to the SftMgmt.udl file. - -The Application Virtualization administrators must be given read and execute permissions to the SftMgmt.UDL file under %systemdrive%\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Service. - -### Client installer command-line parameters are ignored when used in conjunction with KEEPCURRENTSETTINGS=1 - -When used in conjunction with KEEPCURRENTSETTINGS=1, the following client installer command-line parameters are ignored: SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, SWIUSERDATA, and REQUIRESECURECONNECTION. - -WORKAROUND   If you have settings you want to retain, use KEEPCURRENTSETTINGS=1 and then set the other parameters after deployment. The App-V ADM Template can be used to set the following client settings: APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, AUTOLOADTARGET, AUTOLOADTRIGGERS, DOTIMEOUTMINUTES, and ALLOWINDEPENDENTFILESTREAMING. The ADM Template can be found at . - -## Release Notes Copyright Information - - -Information in this document, including URL and other Internet Web site references, is subject to change without notice and is provided for informational purposes only. The entire risk of the use or results from the use of this document remains with the user, and Microsoft Corporation makes no warranties, either express or implied. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. - -Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. - - - -Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md deleted file mode 100644 index c97f47acca..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md +++ /dev/null @@ -1,287 +0,0 @@ ---- -title: Microsoft Application Virtualization Management System Release Notes -description: Microsoft Application Virtualization Management System Release Notes -author: dansimp -ms.assetid: e1a4d5ee-53c7-4b48-814c-a34ce0e698dc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Application Virtualization Management System Release Notes - - -To search these Release Notes, press CTRL+F. - -**Important**   -Read these Release Notes thoroughly before you install the Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative. These Release Notes supersede the content included with this product. - - - -For updated information about known issues, please visit the Microsoft TechNet Library at . - -## About Microsoft Application Virtualization 4.5 Cumulative Update 1 - - -These Release Notes have been updated to reflect the changes introduced with Microsoft Application Virtualization 4.5 Cumulative Update 1 (App-V 4.5 CU1), which provides the latest updates to Application Virtualization (App-V) 4.5. This cumulative update contains the following changes: - -- Support for Windows 7 Beta and Windows Server 2008 R2 Beta: App-V 4.5 CU1 addresses compatibility issues with Windows 7 Beta and Windows Server 2008 R2 Beta. Support will be provided for blocking issues that prevent App-V 4.5 CU1 running in a test environment on pre-RTM versions of Windows 7. This will help ensure that your virtual applications can run successfully in a test environment where compatibility between App-V 4.5 Client and Windows 7 Beta is required. - - **Important**   - Running App-V 4.5 CU1 on any version of Windows 7 or Windows Server 2008 R2 in a live operating environment is not supported. - - - -- Improved support for sequencing the .NET Framework: App-V 4.5 CU1 addresses previous issues with sequencing the .NET Framework 3.5 and earlier on Windows XP (SP2 or later). For more information about the new capabilities, see the TechNet article at . - -- Customer Feedback and Hotfix Rollup: App-V 4.5 CU1 also includes a rollup up of fixes to address issues found since the App-V 4.5 RTM release. This includes a combination of known issues and customer feedback from our internal teams, partners, and customers who are using App-V 4.5. For a full list of the included updates, see the KB article at . - -## About the Product Documentation - - -Comprehensive documentation for Application Virtualization (App-V) is available on Microsoft TechNet in the Application Virtualization (App-V) TechCenter at . The TechNet documentation includes the online Help for the Application Virtualization Sequencer, the Application Virtualization Client, and the Application Virtualization Server. It also includes the Application Virtualization Planning and Deployment Guide and the Application Virtualization Operations Guide. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, it is important to install the latest available security updates for any new software being installed. For more information, see the Microsoft Security Web site at . - -## Providing Feedback - - -You can provide feedback, make a suggestion, or report an issue with the Microsoft Application Virtualization (App-V) Management System via a community forum on the Microsoft Application Virtualization TechCenter (). - -You can also provide your feedback on the documentation directly to the App-V documentation team. Send your documentation feedback to appvdocs@microsoft.com. - -## Known Issues with Application Virtualization 4.5 CU1 - - -This section provides the most up-to-date information about issues with Microsoft Application Virtualization (App-V) 4.5 CU1. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases. - -### Guidance for installing or upgrading clients to App-V 4.5 CU1 using setup.msi - -When installing or upgrading your App-V clients to App-V 4.5 CU1 by using setup.msi, the prerequisites are not installed automatically. - -WORKAROUND   You must manually install the prerequisites before installing or upgrading the App-V client to 4.5 CU1. For detailed procedures for installing the prerequisites and the App-V client, see . - -When this has been completed, install the App-V 4.5 CU1 client by using setup.msi with elevated privileges. This file is available on the App-V 4.5 CU1 release media in the Installers\\Client folder. - -When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 CU1 Desktop client: - - msiexec /i dw20shared.msi APPGUID={FE495DBC-6D42-4698-B61F-86E655E0796D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus - -Alternatively, if you are installing or upgrading to the App-V 4.5 CU1 Terminal Services client, use the following command: - - msiexec /i dw20shared.msi APPGUID={8A97C241-D92A-47DC-B360-E716C1AAA929} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus - -**Note**   -The APPGUID parameter references the product code of the App-V client that you install or upgrade to. The product code is unique for each setup.msi. You can use the Orca database editor or similar tool to examine Windows Installer files and determine the product code. This step is required for all installs or upgrades to App-V 4.5 CU1. - - - -### Some applications might fail to install during the monitoring phase when sequencing on Windows 7 Beta - -When sequencing on Windows 7 Beta or on a computer with Windows Installer 5.0, some applications might fail to install during the monitoring phase. - -WORKAROUND   You must manually grant the Everyone group Full Control permissions to the following registry key: - - HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\SystemGuard - -**Important**   -You must use the **Advanced** button to set the “Include inheritable permissions from this object’s parent” option. - - - -### Unable to save packages when sequencing on Windows 7 Beta - -When sequencing on Windows 7 Beta, you might be unable to save your sequenced package because of a sharing violation. - -WORKAROUND   As specified in the best practices section of the Microsoft Application Virtualization 4.5 Sequencing Guide (see ), you must shutdown and disable the following software programs before you begin sequencing: - -- Windows Defender - -- Antivirus software - -- Disk defragmentation software - -- Windows Search - -- Any open Windows Explorer session - -In addition, if you have Microsoft Update running on the sequencing station to capture updates during the package update process, you will need to add “C:\\Windows\\SoftwareDistribution” as a VFS exclusion before you start sequencing. - -### Improving performance when sequencing the .NET Framework - -When sequencing the .NET Framework, you might experience reduced system performance because the Microsoft .NET Framework NGEN service attempts to precompile assemblies as a background task. - -WORKAROUND   When sequencing the .NET Framework, disable the Microsoft .NET Framework NGEN service (mscorsvw.exe) after completing the monitoring phase. You must use the **Virtual Services** tab in the Sequencer and change the startup type to disabled. - -### Interoperability issues with the Windows 7 Taskbar - -When you run the Application Virtualization Client on Windows 7, the Windows 7 taskbar does not collapse multiple instances of a virtual application into a single taskbar button. In addition, jump Lists do not appear when you right-click a taskbar button of a virtual application, unless the application has been pinned to the Windows 7 taskbar. - -### When you uninstall the Microsoft Application Virtualization Client, user settings associated with the user performing the uninstall will be deleted - -When you uninstall the Microsoft Application Virtualization Client, the Windows Installer will remove Application Virtualization settings from the current user's profile. If your computer uses roaming profiles, do not use your personal network account to uninstall the client because it will remove settings for your virtual applications on all of your computers. - -WORKAROUND   You should perform the App-V Client uninstall with an administrative account that is not used for running virtual applications. - -### Edits made on the virtual file system and virtual registry tabs must be saved while running the Sequencing wizard - -If you open a package to perform an upgrade or have already run the Sequencing wizard with a new package and you make changes to the package in the virtual file system or virtual registry tabs, those changes are not automatically saved. - -WORKAROUND   Save the changes before re-running the wizard, to ensure that they are reflected inside the wizard’s virtual environment. - -### Command-line Sequencer must be run from an elevated command prompt - -When you use the command-line Sequencer, it does not prompt for elevation. - -WORKAROUND   Run the command-line Sequencer using an elevated command prompt. - -### Server Management Console configuration in distributed environments - -If you need to install management components onto systems other than the primary Application Virtualization publishing and streaming server, the server install supports installing our management console and Web service on separate servers from the primary Application Virtualization Server when properly configured. - -To distribute the management components across multiple servers, Kerberos delegation must be enabled on the server where the Web service is installed. - -### Short path variable names in OSD files can cause errors - -If you receive error 450478-1F702339-0000010B “The directory name is invalid” when starting a virtual application on the client, it is possible that the variable in the OSD is set incorrectly. This can happen if the application’s installer sets a short path name during sequencing. - -WORKAROUND   Remove the trailing tilde from any CSIDL variable that exists in the OSD file. - -### Correct syntax for DECODEPATH parameter for command-line Sequencer - -In the command-line Sequencer, when opening a package for upgrade and decoding it to the root of the Q drive, the syntax for the *DECODEPATH* parameter should not include a trailing slash. - -WORKAROUND   You can use **Q:** rather than **Q:\\** (omitting the trailing “\\” character). - -### When upgrading 4.2 packages, you encounter problems caused by Windows Installer files in the Virtual File System - -When upgrading a package from 4.2, you might experience issues relating to a mismatch of Windows Installer system files that were included by default in 4.2 and the Windows Installer libraries locally installed on your Sequencing workstation. The following files are located in CSIDL\_SYSTEM\\: - -cabinet.dll - -msi.dll - -msiexec.exe - -msihnd.dll - -msimsg.dlll - -WORKAROUND   Delete all of the preceding files from the package. Delete the mappings on the **VFS** tab as well as the actual files in the CSIDL\_SYSTEM folder in your decode path. - -### On Windows XP, client install logging is not enabled by default - -When installing the client, to ensure that any install errors are captured for troubleshooting purposes, you should enable logging by using the command line. - -WORKAROUND   Add the parameter */l\*vx! log.txt* to the command line, as shown in the following example: - -setup.exe /s /v”/qn /l\*vx! log.txt” - -msiexec.exe /i setup.msi /qn /l\*vx! log.txt - -Alternatively, you can set the registry key to the following value: - -\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\] "Logging"="voicewarmupx!" - -### For Kerberos authentication to work, Service Principal Names (SPNs) must be registered for IIS - -When using IIS 6.0 or 7.0 for icon or OSD file retrieval and streaming of packages, for Kerberos authentication to be enabled, the SPNs must be registered as follows: - -- On the IIS server, run the following commands by using the SETSPN.EXE Resource Kit tool. The server fully qualified domain name (FQDN) must be used. - - Setspn -r SOFTGRID/<Server FQDN> - - Setspn -r HTTP/<Server FQDN> - -For more information, see . - -### On upgrade from RC, the default permissions on client logs do not allow for non-admin users to access the logs for troubleshooting and support - -The default permissions on client logs for the Application Virtualization RC client did not allow for non-admin access to log files, and manual changes to these log permissions were reverted when clients were restarted. This has been corrected in the RTM release for new client installs, but on upgrade from RC, the custom permissions on existing log files are not reset. However, when any new logs are created or after a log reset, the files will have the new default permissions. - -WORKAROUND   After the upgrade, reset existing client logs or manually change their permissions. - -### .NET compatibility changes - -Microsoft Application Virtualization Cumulative Update 1 supports sequencing the .NET Framework on Windows XP (SP2 or later). Sequencing routines for .NET applications that were written for SoftGrid 4.2 might need to be updated when used with the App-V 4.5 Sequencer. For details and workarounds, please refer to the Knowledge Base article at . - -### After client upgrade from App-V 4.2, some applications are not shown - -Check for the following error in the log: ”The Application Virtualization Client could not parse the OSD file”. The Microsoft Application Virtualization 4.5 client filters out applications that have an OSD file containing an empty OS tag (<OS></OS>). - -WORKAROUND   Delete the empty OS tag from the OSD file. - -### The App-V server requires exemptions in its firewall for certain processes - -For the server to stream applications correctly, the server's core processes, including the dispatcher, need access through the firewall. - -WORKAROUND   Set exemptions in the server's firewall for the following processes: sghwsvr.exe and sghwdsptr.exe. This applies to the App-V Management Server and App-V Streaming Server. - -### Sequencing packages that require new Visual Basic runtimes might fail - -If you sequence a package that uses a newer version of a Visual Basic (VB) runtime on a system where an older version of the VB runtime is installed, you might see a crash or other unexpected behavior when you try to use your package. For example, if you try to sequence Microsoft Money 2007, which uses version 6.00.9782 of the VB runtime, on a Windows XP system with version 6.00.9690 of the VB runtime, you might see a crash in the Invoice Designer when you try to run it on another Windows XP system with that older VB runtime. - -WORKAROUND   After installing the application on the sequencing computer, while still monitoring, copy the correct (newer) VB runtime to the directory in the package from where the executable is started. This allows the sequenced application to find the expected version of the VB runtime when it is started. - -**Important**   -This issue has been fixed in Microsoft Application Virtualization 4.5 Cumulative Update 1. - - - -### When the server installer is run in silent mode, it does not correctly check for MSXML6 - -The App-V Management Server depends on MSXML6. However, if you run the installer in silent mode—for example, by using the command “msiexec -i setup.msi /qn” on a system where MSXML6 is not already installed—the installer does not notice the missing dependency and installs anyway. The most common result is that when clients attempt to refresh publishing information from the App-V Management Server, they will see failures. - -WORKAROUND   Verify that MSXML6 is installed on the system before attempting a silent install of the App-V Management Server. - -### Error code 000C800 when attempting to connect to the Application Virtualization Management Console - -An Application Virtualization administrator who is not a local admin on the Application Virtualization Management Service server will receive an error (Error code: 000C800) when attempting to connect to the Application Virtualization Management Console, and the sftmmc.log entry will indicate that access to SftMgmt.udl is denied. To successfully connect to the Application Virtualization Management Console, an Application Virtualization administrator who is not a local admin on the Application Virtualization Management Service server must have at least read and execute access to the SftMgmt.udl file. - -The Application Virtualization administrators must be given read and execute permissions to the SftMgmt.UDL file under %systemdrive%\\Program Files\\Microsoft System Center App Virt Management Server\\App Virt Management Service. - -### Client installer command-line parameters are ignored when used in conjunction with KEEPCURRENTSETTINGS=1 - -When used in conjunction with KEEPCURRENTSETTINGS=1, the following client installer command-line parameters are ignored: SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, SWIUSERDATA, and REQUIRESECURECONNECTION. - -WORKAROUND   If you have settings you want to retain, use KEEPCURRENTSETTINGS=1 and then set the other parameters after deployment. The App-V ADM Template can be used to set the following client settings: APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, AUTOLOADTARGET, AUTOLOADTRIGGERS, DOTIMEOUTMINUTES, and ALLOWINDEPENDENTFILESTREAMING. The ADM Template can be found at . - -### Error initializing virtual applications with Symantec Endpoint Protection - -When using Symantec Endpoint Protection with the Application and Device Control feature enabled, virtual applications might fail to start, with the error “The application failed to initialize properly (0xc000007b)”. For details and workarounds, please refer to the Knowledge Base article at . - -**Important**   -This issue has been fixed in Microsoft Application Virtualization 4.5 Cumulative Update 1. - - - -## Release Notes Copyright Information - - -Information in this document, including URL and other Internet Web site references, is subject to change without notice, and is provided for informational purposes only. The entire risk of the use or results of the use of this document remains with the user, and Microsoft Corporation makes no warranties, either express or implied. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. - -Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. - - - -Microsoft, MS-DOS, Windows, Windows Server, Windows Vista, Active Directory, and ActiveSync are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. - -The names of actual companies and products mentioned herein may be the trademarks of their respective owners. - - - - - - - - - diff --git a/mdop/appv-v4/microsoft-application-virtualization-security-guide.md b/mdop/appv-v4/microsoft-application-virtualization-security-guide.md deleted file mode 100644 index 8b8cf618b5..0000000000 --- a/mdop/appv-v4/microsoft-application-virtualization-security-guide.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: Microsoft Application Virtualization Security Guide -description: Microsoft Application Virtualization Security Guide -author: dansimp -ms.assetid: 5e794316-cc4f-459e-90ef-79fc9841ba4e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Microsoft Application Virtualization Security Guide - - -This documentation introduces you to important information about deployment decisions that can affect the security of your system. It also provides you with the necessary steps to configure the Microsoft Application Virtualization (App-V) security settings to enhance the security of your environment based on the recommendations presented in the Security Best Practices Whitepaper. If the security settings are specific to Windows but not to App-V, the documentation includes the appropriate links to that information. - -  - -  - - - - - diff --git a/mdop/appv-v4/monitoring-application-virtualization-servers.md b/mdop/appv-v4/monitoring-application-virtualization-servers.md deleted file mode 100644 index c778742dcd..0000000000 --- a/mdop/appv-v4/monitoring-application-virtualization-servers.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Monitoring Application Virtualization Servers -description: Monitoring Application Virtualization Servers -author: dansimp -ms.assetid: d84355ae-4fe4-41d9-ac3a-3eaa32d9a61f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring Application Virtualization Servers - - -To simplify Application Virtualization (App-V) Server management, you can use the System Center Operations Manager 2007 Management Pack. This Management Pack supports only Application Virtualization (App-V) 4.5 servers; it does not support previous server versions. The Management Pack maximizes App-V Server availability for handling App-V Client requests. - -## Status Indicators - - -The App-V Server health status indicators are color-coded. The colors represent the following status values: - -- No color indicates that the server is running without non-recoverable errors. - -- Yellow indicates that one of the components is not functioning correctly. The overall functionality of the server is degraded, but the server is still available. - -- Red indicates that the server is not available and that it cannot provide key services or communicate with external service dependencies. - -## Monitoring Criteria - - -The Management Pack monitors the following aspects of server health: - -- Server Status—monitors server events to validate that the server is providing its expected services. - -- Data Store Access—tracks the ability of one or more of the App-V Management Servers to access and communicate with the App-V data store. - -- Content Data Access—monitors access to the \\Content directory, which might be a local directory or a network share, and the ability to read the requested files. - -- Security—reports errors with the App-V Server’s certificate and secure communications. - -- Client Request Handling—monitors the ability of one or more of the App-V Servers to handle and correctly respond to client requests. These requests include publishing such items as configuration requests, package load requests, and out of sequence requests. - -- Server Configuration—checks the configuration settings of the App-V Server. These configuration settings include the settings in the registry and in the App-V data store. - -## Server Differences - - -The main differences between the App-V Management Server and the App-V Streaming Server are as follows: - -- App-V Management Servers can provide publishing, streaming, management, and reporting services. Therefore, the Management Pack can manage more aspects of the App-V Management Server than it can manage on the App-V Streaming Server, which provides only package streaming. - -- The App-V Streaming Server does not have an App-V data store, so data store access is not monitored. The configuration information for the App-V Streaming Server is managed in the registry. - -- The App-V Streaming Server does not use the App-V Server Management Console interface; use other tools to manage the configuration. - -## Related topics - - -[Application Virtualization Server](application-virtualization-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/online-help-for-application-virtualization.md b/mdop/appv-v4/online-help-for-application-virtualization.md deleted file mode 100644 index 91d7d2784f..0000000000 --- a/mdop/appv-v4/online-help-for-application-virtualization.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Online Help for Application Virtualization -description: Online Help for Application Virtualization -author: dansimp -ms.assetid: 261ede48-976f-473c-84bc-452577efdcdf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Online Help for Application Virtualization - - -The Microsoft Application Virtualization (App-V) system provides the capability to make applications available to end user computers without having to install the applications directly on those computers. The following online help documentation provides step-by-step procedures for interacting with and using the key system components. - -## In This Section - - -[Microsoft Application Virtualization Client Management Help](microsoft-application-virtualization-client-management-help.md) -Includes conceptual information, step-by-step procedures, and a user interface reference for the Application Virtualization (App-V) Desktop Client and Terminal Services Client. - -[Application Virtualization Server Management Help](application-virtualization-server-management-help.md) -Provides overview information about the Application Virtualization (App-V) Servers, as well as step-by-step procedures for using the available features and commands. A reference section includes information about the windows and dialogs that are available in the Server Management Console. - -[Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) -Includes information about the user interface and the Sequencing Wizard and provides detailed step-by-step procedures for sequencing applications. - -  - -  - - - - - diff --git a/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md b/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md deleted file mode 100644 index 0bf23f9812..0000000000 --- a/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Open Package Wizard (AppV 4.6 SP1) -description: Open Package Wizard (AppV 4.6 SP1) -author: dansimp -ms.assetid: 26bdef59-2ea3-4e30-9095-0ee0d0085b2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Open Package Wizard (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V Open Package wizard. - -## In This Section - - -[Select Task Page (Learn More)](select-task-page--learn-more-.md) -Describes the options on the **Select Task** page to modify an existing virtual application package. - -[Packaging Method (Learn More)](packaging-method--learn-more-.md) - -## Related topics - - -[Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md b/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md deleted file mode 100644 index fa836b09a6..0000000000 --- a/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Operations Guide for the Application Virtualization System -description: Operations Guide for the Application Virtualization System -author: dansimp -ms.assetid: 686f2b75-7fba-4410-89b2-a539984b6ef2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Operations Guide for the Application Virtualization System - - -The Microsoft Application Virtualization Operations Guide provides information and step-by-step procedures to help you administer the Microsoft Application Virtualization (App-V) system and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. - -## In This Section - - -[Application Virtualization Client](application-virtualization-client.md) -Provides information about operational tasks for administering the Application Virtualization (App-V) Client. - -[Application Virtualization Server](application-virtualization-server.md) -Provides information about operational tasks for administering the Application Virtualization (App-V) Servers. - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) -Provides information about operational tasks for using the Application Virtualization (App-V) Sequencer. - -## Reference - - -For more information about general App-V sequencing best practices, see the following Microsoft Web sites: - -MCS Sequencing Guidelines at - -Best Practices for Sequencing at - -  - -  - - - - - diff --git a/mdop/appv-v4/osd-file-elements.md b/mdop/appv-v4/osd-file-elements.md deleted file mode 100644 index 96422a7568..0000000000 --- a/mdop/appv-v4/osd-file-elements.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: OSD File Elements -description: OSD File Elements -author: dansimp -ms.assetid: 8211b562-7549-4331-8321-144f52574e99 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# OSD File Elements - - -The Sequencer installation directory contains an XML schema file, **Softricity.xsd**, which defines the valid structure of an Open Software Descriptor (OSD) file. Following are some of the more frequently used OSD elements. - -SOFTPKG -The root element of the OSD file containing all elements defining the software package. - -CODEBASE -Information about the .sft file for this package, including the HREF, FILENAME, and GUID attributes. You can edit the HREF attribute if you change the distribution point of this particular package. - -OS -Defines on what operating systems this application can run based on values that are initially set in the Sequencing Wizard. This value can contain only the values defined in **Softricity.xsd**. - -LOCAL\_INTERACTION\_ALLOWED -Set to TRUE, this enables creation of named objects (events, mutexes, semaphores, file mappings, and mailslots) and COM objects in the global namespace rather than isolated inside a particular virtual environment, which allows virtual applications to interact with the host operating system's applications. - -Example:<SOFTPKG><IMPLEMENTATION> - -<VIRTUALENV><POLICIES> - -<LOCAL\_INTERACTION\_ALLOWED>TRUE - -</LOCAL\_INTERACTION\_ALLOWED> - -</POLICIES></VIRTUALENV> - -</IMPLEMENTATION></SOFTPKG> - -DEPENDENCIES -Defines Dynamic Suite Composition (dependencies on other packages) by using a CODEBASE tag from another package. - -Example:<DEPENDENCIES><CODEBASE HREF="rtsps://server/package.sft" GUID="7579F4DF-2461-4219-BD43-494E1FDC69E3" SYSGUARDFILE="pkg.1\\osguard.cp" SIZE="6572748" MANDATORY="FALSE"/></DEPENDENCIES> - -PACKAGE NAME -A common name for the package entered into the Sequencing Wizard **Package Information** page, which enables you to specify a single name used for a sequenced application containing multiple applications. - -TITLE -Optional descriptive name of the application you are sequencing. - -ABSTRACT -Short description of the software package entered in the **Comments** field in the Sequencing Wizard **Package Information** page. A best practice is to specify information such as the operating system and service-pack level of the Sequencer workstation, Sequencer version, and the sequencing engineer’s name. - -SCRIPT -Defines specific scripted events to occur during startup, shutdown, or streaming. - -MGMT\_SHORTCUTLIST -List of all shortcuts defined in the wizard. - -MGMT\_FILEASSOCIATIONS -List of the file types specified in the wizard. - -## Related topics - - -[About the OSD Tab](about-the-osd-tab.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/osd-tab-keep.md b/mdop/appv-v4/osd-tab-keep.md deleted file mode 100644 index dd06e42a12..0000000000 --- a/mdop/appv-v4/osd-tab-keep.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: OSD Tab -description: OSD Tab -author: dansimp -ms.assetid: e66f1384-1753-4216-b9ee-77e99af93c74 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# OSD Tab - - -Use the **OSD** tab to edit and customize the Open Software Descriptor (OSD) file. - -## In This Section - - -[About the OSD Tab](about-the-osd-tab.md) -Provides general information about the **OSD** tab. - -[How to Edit an OSD File](how-to-edit-an-osd-file.md) -Provides the procedure to edit the OSD file by using the **Virtual Services** tab. - -[How to Edit an OSD File Using a Text Editor](how-to-edit-an-osd-file-using-a-text-editor.md) -Provides the procedure to customize an OSD file by using a text editor. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 6a802d1959..0000000000 --- a/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Oversized Package Dialog Box (App-V 4.6 SP1) -description: Oversized Package Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 8973a493-6509-4d52-afb6-a9f47d1c5c26 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Oversized Package Dialog Box (App-V 4.6 SP1) - - -The uncompressed package size exceeds the recommended 4 GB package size limit. To reduce the size of the package, package compression has been enabled. - -In the **Oversized Package** dialog box, use the following procedure to configure package compression. - -1. In the App-V Sequencer console, click the **Deployment** tab. - -2. To enable package compression, select the **Compress Package** check box. To disable package compression, clear the **Compress Package** check box. - -3. To save the package, click **File** / **Save**. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/overview-of-application-virtualization.md b/mdop/appv-v4/overview-of-application-virtualization.md deleted file mode 100644 index 356e53e996..0000000000 --- a/mdop/appv-v4/overview-of-application-virtualization.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Overview of Application Virtualization -description: Overview of Application Virtualization -author: dansimp -ms.assetid: 80545ef4-cf4c-420c-88d6-48e9f226051f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of Application Virtualization - - -Microsoft Application Virtualization (App-V) can make applications available to end user computers without having to install the applications directly on those computers. This is made possible through a process known as *sequencing the application*, which enables each application to run in its own self-contained virtual environment on the client computer. The sequenced applications are isolated from each other. This eliminates application conflicts, but the applications can still interact with the client computer. - -The App-V client is the feature that lets the end user interact with the applications after they have been published to the computer. The client manages the virtual environment in which the virtualized applications run on each computer. After the client has been installed on a computer, the applications must be made available to the computer through a process known as *publishing*, which enables the end user to run the virtual applications. The publishing process copies the virtual application icons and shortcuts to the computer—typically on the Windows desktop or on the **Start** menu—and also copies the package definition and file type association information to the computer. Publishing also makes the application package content available to the end user’s computer. - -The virtual application package content can be copied onto one or more Application Virtualization servers so that it can be streamed down to the clients on demand and cached locally. File servers and Web servers can also be used as streaming servers, or the content can be copied directly to the end user’s computer—for example, if you are using an electronic software distribution system, such as Microsoft Endpoint Configuration Manager. In a multi-server implementation, maintaining the package content and keeping it up to date on all the streaming servers requires a comprehensive package management solution. Depending on the size of your organization, you might need to have many virtual applications available to end users located all over the world. Managing the packages to ensure that the appropriate applications are available to all users where and when they need access to them is therefore an important requirement. - -## Microsoft Application Virtualization System Features - - -The following table describes the primary features of the Microsoft Application Virtualization Management System. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FeatureFunctionAdditional Information

    Microsoft Application Virtualization Management Server

    Responsible for streaming the package content and publishing the shortcuts and file type associations to the Application Virtualization client.

    The Application Virtualization Management Server supports active upgrade, License Management, and a database that can be used for reporting.

    Content folder

    Indicates the location of the Application Virtualization packages for streaming.

    This folder can be located on a share on or off the Application Virtualization Management Server.

    Microsoft Application Virtualization Management Console

    This console is an MMC 3.0 snap-in management tool used for Microsoft Application Virtualization Server administration.

    This tool can be installed on the Microsoft Application Virtualization server or located on a separate workstation that has Microsoft Management Console (MMC) 3.0 and Microsoft .NET Framework 2.0 installed.

    Microsoft Application Virtualization Management Web Service

    Responsible for communicating any read and write requests to the Application Virtualization data store.

    The Management Web Service can be installed on the Microsoft Application Virtualization Management server or on a separate computer that has Microsoft Internet Information Services (IIS) installed.

    Microsoft Application Virtualization Data Store

    The App-V SQL Server database responsible for storing all information related to the Application Virtualization infrastructure.

    This information includes all application records, application assignments, and which groups have responsibility for managing the Application Virtualization environment.

    Microsoft Application Virtualization Streaming Server

    Responsible for hosting the Application Virtualization packages for streaming to clients in a branch office, where the link back to the Application Virtualization Management Server is considered a wide area networks (WAN) connection.

    This server contains streaming functionality only and provides neither the Application Virtualization Management Console nor the Application Virtualization Management Web Service.

    Microsoft Application Virtualization Sequencer

    The sequencer is used to monitor and capture the installation of applications to create virtual application packages.

    The output consists of the application’s icons, an .osd file that contains package definition information, a package manifest file, and the .sft file that contains the application program’s content files.

    Microsoft Application Virtualization Client

    The Application Virtualization Desktop Client and the Application Virtualization Client for Remote Desktop Services provide and manage the virtual environment for the virtualized applications.

    The Microsoft Application Virtualization client manages the package streaming into cache, publishing refresh, transport, and all interaction with the Application Virtualization servers.

    - -  - -  - -  - - - - - diff --git a/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md b/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md deleted file mode 100644 index d0436a2494..0000000000 --- a/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Overview of the Application Virtualization System Components -description: Overview of the Application Virtualization System Components -author: dansimp -ms.assetid: 75d88ef7-44d8-4fa7-b7f5-9153f37e570d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of the Application Virtualization System Components - - -The following table describes the primary components of the Microsoft Application Virtualization Management System. For more information about deploying these system components, see [Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ComponentFunctionAdditional Information

    Microsoft Application Virtualization Management Server

    The component responsible for streaming the package content and publishing the shortcuts and file type associations to the Application Virtualization Client.

    The Application Virtualization Management Server supports active upgrade, License Management, and a database that can be used for reporting.

    Content folder

    The location of the Application Virtualization packages for streaming.

    This folder can be located on a share on or off the Application Virtualization Management Server. The folder can also be located on a Storage Area Network (SAN).

    Microsoft Application Virtualization Management Console

    An MMC 3.0 snap-in management utility for Microsoft Application Virtualization Server administration.

    This component can be installed on the Microsoft Application Virtualization server or located on a separate workstation that has MMC 3.0 and .NET 2.0 installed.

    Microsoft Application Virtualization Management Web Service

    The component responsible for communicating any read/write requests to the Application Virtualization data store.

    This component can installed on the Microsoft Application Virtualization Server or on a separate computer with IIS installed.

    Microsoft Application Virtualization Data Store

    The component stored in the SQL database and responsible for storing all information related to the Application Virtualization infrastructure.

    This information includes all application records, application assignments, and which groups have responsibility for managing the Application Virtualization environment.

    Microsoft Application Virtualization Streaming Server

    The component responsible for hosting the Application Virtualization packages for streaming to clients in a branch office, where the link back to the Application Virtualization Management Server is considered a WAN.

    This server contains streaming functionality only and provides neither the Application Virtualization Management Console nor the Application Virtualization Management Web Service.

    Microsoft Application Virtualization Sequencer

    The component used to monitor and capture the installation of applications to create virtual application packages.

    Output consists of the application’s icons, an OSD file containing package definition information, a package manifest file, and the SFT file containing the application program’s content files.

    Microsoft Application Virtualization Client

    The component installed on the Application Virtualization Desktop Client or on the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services) and that provides the virtual environment for the virtualized applications.

    The Microsoft Application Virtualization Client manages the package streaming into cache, publishing refresh, transport, and all interaction with the Application Virtualization Servers.

    - -  - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) - -[Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/package-name-page---learn-more-.md b/mdop/appv-v4/package-name-page---learn-more-.md deleted file mode 100644 index 5a371c35ca..0000000000 --- a/mdop/appv-v4/package-name-page---learn-more-.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Package Name Page (Learn More) -description: Package Name Page (Learn More) -author: dansimp -ms.assetid: ee75b8f0-bd9d-4460-a256-016ff97c2386 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Package Name Page (Learn More) - - -Use the **Package Name** page to specify a name for the virtual application package. You can also configure where the package will reside on the target computers. - -**Note**   -Editing the primary virtual application directory is an advanced task. - - - -This page contains the following elements: - -**Virtual Application Package Name** -Specifies the name that will be associated with virtual application package. The name specified should help identify the purpose and version of the application. The package name is also displayed in the App-V management console. - -**Edit (Advanced)** -Select this option to change the location of where the virtual application will be installed on target computers. Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path. Only select this option, if you prefer to generate your own file name. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/package-name-page--app-v-46-sp1.md b/mdop/appv-v4/package-name-page--app-v-46-sp1.md deleted file mode 100644 index 18593c1fbe..0000000000 --- a/mdop/appv-v4/package-name-page--app-v-46-sp1.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Package Name Page -description: Package Name Page -author: dansimp -ms.assetid: 1cea36b7-737d-4c5e-9294-5feba02a3e7d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Package Name Page - - -Use the **Package Name** page to specify a name to associate with the new virtual application package. - -This page contains the following elements: - -**Virtual Application Package Name** -Specify a name that describes the new virtual application package. The name also identifies the virtual application package in the App-V Management Console. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/package-results-pane-columns.md b/mdop/appv-v4/package-results-pane-columns.md deleted file mode 100644 index 65f4510c3f..0000000000 --- a/mdop/appv-v4/package-results-pane-columns.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Package Results Pane Columns -description: Package Results Pane Columns -author: dansimp -ms.assetid: 4ed3a06a-656d-497a-b62d-21684396e2b0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Package Results Pane Columns - - -The **Packages Results** pane in the Application Virtualization Server Management Console displays a variety of columns. - -You can use the standard Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click a package in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ColumnContents

    Number

    Displays the package icon and the version number.

    Package File

    Displays the name of the application file (SFT).

    Date Added

    Displays the date and time the package was added to the server.

    Version GUID

    Displays the version GUID.

    - -  - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -[Server Management Console: Packages Node](server-management-console-packages-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/package-results-pane.md b/mdop/appv-v4/package-results-pane.md deleted file mode 100644 index ed92ee0b14..0000000000 --- a/mdop/appv-v4/package-results-pane.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Package Results Pane -description: Package Results Pane -author: dansimp -ms.assetid: 07b7f737-f26f-4feb-88aa-3d8009c5622d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Package Results Pane - - -The **Packages Results** pane in the Application Virtualization Server Management Console displays a list of the available packages. - -Right-click any package in the **Results** pane to display a pop-up menu that contains the following elements. - -**Add Version** -Starts the Add Package Version wizard. On the **Add Package Version** page, in **Full path for package file**, you can enter or browse to the correct path. On the **Enter Relative path for package file** page, you can enter the relative path in the **Relative path for package file** field. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a package from the **Results** pane. - -**Rename** -Changes the name of a package in the **Results** pane. - -**Refresh** -Refreshes the view of the server. - -**Properties** -Displays the **Properties** dialog box for the selected package. The **Properties** dialog box displays the GUID information, the package name, and a list of applications (including version number and enabled status) associated with the package. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -Right-click anywhere in the **Results** pane to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the **Results** pane. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange Icons** -Changes how the icons are displayed in the **Results** pane. - -**Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -[Server Management Console: Packages Node](server-management-console-packages-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/packages-node.md b/mdop/appv-v4/packages-node.md deleted file mode 100644 index b293c3d8b7..0000000000 --- a/mdop/appv-v4/packages-node.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Packages Node -description: Packages Node -author: dansimp -ms.assetid: 3465168c-012f-4e9f-905d-611418d2975a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Packages Node - - -The **Packages** node is one level below the Application Virtualization System node in the **Scope** pane of the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of packages. Right-click the **Packages** node to display a pop-up menu that contains the following elements. - -**New Package** -Displays the New Package Wizard. This wizard consists of the following three pages: - -1. Enter the package name and path to the corresponding package file (SFT). - -2. Enter the relative path to the SFT file. This path must be relative to the Server Content root. - -3. View the summary screen, and click **Finish** to add the new package. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -If you right-click any package that appears under the **Packages** node in the **Scope** pane, the following elements are available. - -**Add Version** -Displays the Add Package Version Wizard. Use this wizard to enter the full path to a new SFT file, or browse to the location of a new SFT file. This wizard also has a summary screen. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a package from the **Results** pane. - -**Rename** -Changes the name of a package in the **Results** pane. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Properties** -Displays the **Properties** dialog box for the selected package. The **Properties** dialog box displays the GUID information, the package name, and a list of applications (including version number and enabled status) associated with the package. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -[Server Management Console: Packages Node](server-management-console-packages-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/packaging-method--learn-more-.md b/mdop/appv-v4/packaging-method--learn-more-.md deleted file mode 100644 index 8fd5449b82..0000000000 --- a/mdop/appv-v4/packaging-method--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Packaging Method (Learn More) -description: Packaging Method (Learn More) -author: dansimp -ms.assetid: 3975a640-1ffd-4b4c-95fd-608469f4c205 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Packaging Method (Learn More) - - -Use the **Packaging Method** page to specify the method you want to use to create a new virtual application package. - -This page contains the following elements: - -**Create Package (default)** -Select this option to create a virtual application package by installing an application to the computer running the App-V Sequencer while the App-V Sequencer monitors the installation. You should also copy all the required installation files to a local directory on the computer running the Sequencer. - -**Create Package using a Package Accelerator** -Select this option to create a package by using a Package Accelerator. The App-V Sequencer uses a Package Accelerator to create a virtual application package without having to manually install the application. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - -## Related topics - - -[Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/packaging-method-page--learn-more-.md b/mdop/appv-v4/packaging-method-page--learn-more-.md deleted file mode 100644 index 41103433f7..0000000000 --- a/mdop/appv-v4/packaging-method-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Packaging Method Page (Learn More) -description: Packaging Method Page (Learn More) -author: dansimp -ms.assetid: f405a293-bcd4-48a1-b4d9-b5e4cf73c5f4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Packaging Method Page (Learn More) - - -Use the **Packaging Method** page to specify the method you want to use to create a new virtual application package. - -This page contains the following elements. - -**Create Package (default)** -Select this option to create a virtual application package by installing an application on the computer running the App-V Sequencer while the App-V Sequencer monitors the installation. You should also copy all the required installation files to a local directory on the computer running the Sequencer. - -**Create Package using a Package Accelerator** -Select this option to create a package by using a Package Accelerator. The App-V Sequencer uses a Package Accelerator to create a virtual application package. A Package Accelerator enables you to create a virtual application package without performing all of the required manual steps during installation. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - -## Related topics - - -[Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/parse-items-tab-keep.md b/mdop/appv-v4/parse-items-tab-keep.md deleted file mode 100644 index e4f0a9b72f..0000000000 --- a/mdop/appv-v4/parse-items-tab-keep.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Parse Items Tab -description: Parse Items Tab -author: dansimp -ms.assetid: bdf3fe0d-404a-4745-af52-f415fa321564 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Parse Items Tab - - -The **Parse Items** tab displays the mapping rules that the Sequencer uses to accommodate differences that exist between configurations on the sequencing computer and the App-V Desktop Client. This tab contains the following elements. - -## UI Elements List - - -**Parse From** -Displays read-only variable names evaluated by the Application Virtualization Sequencer to determine important operating system locations on the sequencing computer. - -**Parse To** -Displays read-only variable names that the Application Virtualization Sequencer substitutes when encountering variable names in the associated **Parse From** column, while parsing items in the virtual file system or virtual registry. - -**Map Type** -Displays read-only mapping rules that the Application Virtualization Sequencer applies to parse items in the virtual file system or virtual registry. One of the following values can occur: - -**OK** -Saves the changes and exits the dialog box. - -**Cancel** -Exits the dialog box without saving any changes. - -**Apply** -Saves the changes and remains in the dialog box. - -## Related topics - - -[Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md b/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md deleted file mode 100644 index a3718091a0..0000000000 --- a/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Planning and Deployment Guide for the Application Virtualization System -description: Planning and Deployment Guide for the Application Virtualization System -author: dansimp -ms.assetid: 6c012e33-9ac6-4cd8-84ff-54f40973833f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning and Deployment Guide for the Application Virtualization System - - -Microsoft Application Virtualization Management provides the capability to make applications available to end user computers without having to install the applications directly on those computers. This is made possible through a process known as *sequencing the application*, which enables each application to run in its own self-contained virtual environment on the client computer. The sequenced applications are isolated from one another, eliminating application conflicts, yet can still interact with the client computer. - -The Application Virtualization Client is the Application Virtualization system component that enables the end user to interact with the applications after they have been published to the computer. The client manages the virtual environment in which the virtualized applications run on each computer. After the client has been installed on a computer, the applications must be made available to the computer through a process known as *publishing*, which enables the end user to run the virtual applications. The publishing process places the virtual application icons and shortcuts on the computer—typically on the Windows desktop or on the **Start** menu—and also places the package definition and file type association information on the computer. Publishing also makes the application package content available to the end user’s computer. - -The virtual application package content can be placed on one or more Application Virtualization servers so that it can be streamed down to the clients on demand and cached locally. File servers and Web servers can also be used as streaming servers, or the content can be placed directly on the end user’s computer—for example, if you are using an electronic software distribution system, such as Microsoft Endpoint Configuration Manager. In a multi-server implementation, maintaining the package content and keeping it up to date on all the streaming servers requires a comprehensive package management solution. Depending on the size of your organization, you might need to have many virtual applications accessible to end users located all over the world. Managing the packages to ensure that the right applications are available to all users where and when they need access to them is therefore an essential requirement. - -The Application Virtualization Planning and Deployment Guide provides information to help you better understand and deploy the Microsoft Application Virtualization application and its components. It also provides step-by-step procedures for implementing the key deployment scenarios. - -## In This Section - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) -Provides the guidance necessary to plan the implementation and deployment of your Application Virtualization system. - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) -Provides information about hardware and software requirements for installing the various Application Virtualization components, as well as upgrade information. - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) -Provides information about deploying Application Virtualization using an electronic software distribution (ESD) system. - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) -Provides information about deploying Application Virtualization using the Application Virtualization Management Server. - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) -Describes how to deploy Application Virtualization in a stand-alone mode, without the use of ESD or server-based resources. - -[Application Virtualization Reference](application-virtualization-reference.md) -Contains detailed technical reference material related to installing and managing system components. - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md b/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md deleted file mode 100644 index 4b56a86f3a..0000000000 --- a/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Planning for Application Virtualization Client Deployment -description: Planning for Application Virtualization Client Deployment -author: dansimp -ms.assetid: a352f80f-f0f9-4fbf-ac10-24c510b2d6be -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Application Virtualization Client Deployment - - -After you have decided how you will publish and deploy virtual application packages to your end user computers, you should plan the deployment of the Application Virtualization Client software. - -The Application Virtualization Client is the component that actually runs the virtual applications. The Application Virtualization Client enables users to interact with icons and to double-click file types to start a virtual application. It also handles streaming of the application content from a streaming server and caches it before starting the application. The application content is structured such that all the content needed to start the application and handle initial user interaction is streamed to the end user computer first. There are two different types of Application Virtualization Client software: the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services), which is used on Remote Desktop Session Host (RD Session Host) server systems, and the Application Virtualization Desktop Client, which is used for all other computers. - -The Application Virtualization Client should be configured at installation time, either in the Application Virtualization Management Console or via the installer command line, with a number of important settings, including the following: - -- Locations of the icons for all the applications. - -- The location of the OSD file that contains the package definition information. - -- The application content source. - -- The communications protocol to be used when retrieving the preceding items. - -- The cache size and cache size management method to be used. - -To expedite the deployment of the Application Virtualization Client software when using an electronic software distribution (ESD) solution, the preceding settings must be defined carefully in advance. This is especially important when you have computers in different offices, where their clients would need to be configured to use different source locations. - -**Note**   -- The icon location and OSD file values are an important factor to consider when choosing your publishing method, whether using Windows Installer or SFTMIME. The setting for the application content source is defined by your choice of streaming method. - -- To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. For more information about the cache space management feature, see **How to Use the Cache Space Management Feature** in the Microsoft Application Virtualization (App-V) Operations Guide. - -- During both the publishing and HTTP(S) streaming operations,App-V 4.5 SP1 clients use the proxy server settings that are configured in Internet Explorer on the user’s computer. - -For more information about configuring the client installation parameters, see [Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md). - -  - -Finally, you need to determine how to deploy the Application Virtualization Desktop Client software for the desktop clients. Although it is possible to deploy the Application Virtualization Desktop Client manually on each computer, most organizations would need to do this through some automated process. A medium or large organization might have an ESD system in operation, and that would be an ideal way to deploy the client. If no ESD system exists, you can use your standard method of installing software in your organization. Choices include Group Policy or various scripting techniques. Depending on the number and size of the offices you have, this deployment process can be complex, and it is essential that you take a structured approach to ensure all computers get a client installed with the correct configuration. - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -[How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -[How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md) - -[How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md b/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md deleted file mode 100644 index 7ac4ec4db2..0000000000 --- a/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Planning for Application Virtualization System Deployment -description: Planning for Application Virtualization System Deployment -author: dansimp -ms.assetid: 8215269f-c083-468a-bf0b-886b0d2dd69e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Application Virtualization System Deployment - - -This section provides important information to help you plan your deployment of Microsoft Application Virtualization. - -## In This Section - - -[Best Practices for the Application Virtualization Sequencer](best-practices-for-the-application-virtualization-sequencer-sp1.md) -Provides important security-related planning information about setting up the Application Virtualization Sequencer to sequence application packages. - -[Planning the Application Virtualization Sequencer Implementation](planning-the-application-virtualization-sequencer-implementation.md) -Provides planning guidance for implementing the App-V sequencer. - -[Using Electronic Software Distribution as a Package Management Solution](using-electronic-software-distribution-as-a-package-management-solution.md) -Provides planning guidance for using an electronic software distribution system to manage application package content, including setting up publishing and streaming. - -[Using Application Virtualization Servers as a Package Management Solution](using-application-virtualization-servers-as-a-package-management-solution.md) -Provides the planning information necessary for managing application package content in an Application Virtualization Server-based deployment. - -[Planning for Application Virtualization Client Deployment](planning-for-application-virtualization-client-deployment.md) -Provides important planning considerations for deploying the Application Virtualization Client. - -[Planning for Migration from Previous Versions](planning-for-migration-from-previous-versions.md) -Identifies the steps for upgrading from a previous version and lists several important factors to consider. - -[Planning for Security and Protection](planning-for-security-and-protection.md) -Provides information about enhanced security features in Application Virtualization 4.5. - -## Reference - - -[Application Virtualization Reference](application-virtualization-reference.md) - -## Related Sections - - -[Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md) - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-for-client-security.md b/mdop/appv-v4/planning-for-client-security.md deleted file mode 100644 index e47a871c34..0000000000 --- a/mdop/appv-v4/planning-for-client-security.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: Planning for Client Security -description: Planning for Client Security -author: dansimp -ms.assetid: 4840a60f-4c91-489c-ad0b-6671882abf9b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for Client Security - - -The App-V Client provides several security enhancements that were not present in previous versions of the product. These changes provide improved security after installation and through later configuration of the client settings. This topic describes some of those enhancements and identifies several important security-related configuration settings that you should consider during your planning process. It is important to remember that virtual applications are still executables, so you must ensure that these assets cannot be tampered with by unauthorized people. For this reason, the Open Software Descriptor (OSD) file cache is protected as described later in this topic, and we strongly recommend that you use RTSPS, HTTPS, and IPsec to protect publishing and streaming. - -## App-V Client Security - - -By default, at installation the App-V client is configured with the minimum permissions required to allow a user to perform a publishing refresh and to start applications. Other security enhancements provided in the App-V client include the following: - -- By default, the OSD file cache can be updated only by administrators and by using the publishing refresh process. - -- The log file (sftlog.txt) is accessible only by accounts with local administrative access to the client. - -- The log file now has a maximum size. - -### File Type Associations - -By default, the installation of the client registers file type associations (FTAs) for OSD files, which enables users to start applications directly from OSD files instead of the published shortcuts. If a user with local administrator rights receives an OSD file containing malicious code, either in e-mail or downloaded from a Web site, the user can open the OSD file and start the application even if the client has been set to restrict the **Add Application** permission. You can unregister the FTAs for the OSD to reduce this risk. Also, consider blocking this extension in the e-mail system and at the firewall. For more information about configuring Outlook to block extensions, see . - -**Security Note:** - -Starting with App-V version 4.6, the file type association is no longer created for OSD files during a new installation of the client, although the existing settings will be maintained during an upgrade from version 4.2 or 4.5 of the App-V client. If for any reason it is essential to create the file type association, you can create the following registry keys and set their values as shown: - - Create HKEY\_CLASSES\_ROOT\\.osd with a default value of SoftGrid.osd.File - - Under HKEY\_LOCAL\_MACHINE\\software\\classes\\Softgrid.osd.file, create a string value named AppUserModelID with a data value of Microsoft.AppV.Client.Tray - -### Authorization - -During installation, you can use the **RequireAuthorizationIfCached** parameter to configure the client to require authorization from the server when the user tries to start an application. You should consider carefully how to set this parameter. If the App-V server is unavailable for any reason, the application will use the most recent stored state of this parameter to control user access to the application. If the user has not launched the application successfully before the App-V server becomes unavailable, they will not be able to launch the application until they can communicate with the server and receive authorization. However, if you set the parameter so that the client does not require authorization and if the server is unavailable, all previously cached applications can be started whether authorized or not. Also, if the user has permission to change the client to Work Offline mode through permissions or if the user is a local administrator, the user would be able to open all cached packages as if the App-V infrastructure was unavailable. - -### Antivirus Scanning - -Antivirus software running on an App-V Client computer can detect and report an infected file in the virtual environment. However, it cannot disinfect the file. If a virus is detected in the virtual environment, the antivirus software would perform the configured quarantine or repair operation in the cache, not in the actual package. Configure the antivirus software with an exception for the sftfs.fsd file. This file is the cache file that stores packages on the App-V Client. - -**Security Note:** - -If a virus is detected in an application or package deployed in the production environment, replace the application or package with a virus-free version. - -## Communication Between Client and Server - - -Publishing refreshes and package streaming are also areas where security considerations relating to client-server communication are important. - -### Publishing Refresh - -When the client communicates with the server to perform a publishing refresh, it uses the credentials of the logged on user to request information about the application packages. You should secure the communication that occurs between the App-V client and App-V Management Server to ensure that none of the publishing information can be tampered with in transit. This is done by using the Enhanced Security option, which will use RTSPS/HTTPS. Communication between the Client and the location where the ICO and OSD files are stored should use IPsec for SMB/CIFS shares and HTTPS for an IIS server. - -**Note**   -If you are using IIS to publish the ICO and OSD files, configure a MIME type for OSD=TXT; otherwise, IIS will refuse to serve the ICO and OSD files to clients. - - - -### Package Streaming - -When a user launches an application for the first time, or if auto-loading parameters have been set on the client, the application package is streamed from a server to the client cache. This process supports the RTSP/RTSPS, HTTP/HTTPS, and SMB/CIFS protocols. The OSD files control which protocols are used, unless the **ApplicationSourceRoot** or **OverrideURL** setting has been configured on the clients. You should configure communication to occur over RTSPS, HTTPS, or IPsec for SMB/CIFS to achieve higher levels of security. For more information about choosing which communication method to use, see the App-V Planning and Deployment Guide at . - -**Note**   -If you are using IIS to publish packages (SFT files), configure a MIME type for SFT=Binary; otherwise, IIS will refuse to serve the SFT files to clients. - - - -### Roaming Profiles and Folder Redirection - -The App-V system stores user-specific changes to packages in the usrvol\_sftfs\_v1.pkg file. This file is located in the Application Data folder of a user’s profile. Because the profile or a redirected Application Data folder is transferred between the client and the server, use IPsec to secure the communication. - -## Considerations for Internet-Facing Clients - - -For Internet-facing clients, it is important to consider whether the client is domain joined or non-domain joined. - -### Domain Joined Client - -By default, App-V Clients use Kerberos tickets that were issued by Active Directory Domain Services for authentication and authorization on the intranet. These Kerberos tickets are valid for 10 hours by default. The client will use this ticket to access the App-V server for as long as the ticket is valid, even if the computer is unable to connect to the domain controller to refresh the ticket. If the Kerberos ticket expires, the App-V client will revert to NTLM authentication and use the user’s cached credentials. - -### Non-Domain Joined Client - -If a user is home-based and the computer is not joined to the company domain, App-V can still support delivering applications. To authenticate and authorize a user to perform a publishing refresh and to start applications, configure the user account on the client computer to store the user name and password that has access to the App-V environment and to provide appropriate permissions to the applications. - -## Related topics - - -[Planning for Security and Protection](planning-for-security-and-protection.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-for-migration-from-previous-versions.md b/mdop/appv-v4/planning-for-migration-from-previous-versions.md deleted file mode 100644 index 2e96c0f008..0000000000 --- a/mdop/appv-v4/planning-for-migration-from-previous-versions.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Planning for Migration from Previous Versions -description: Planning for Migration from Previous Versions -author: dansimp -ms.assetid: 62967bf1-542f-41b0-838f-c62f3430ac73 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for Migration from Previous Versions - - -Before attempting to upgrade to Microsoft Application Virtualization 4.5 or later versions, any version prior to 4.1 must be upgraded to version 4.1. You should plan to upgrade your clients first, and then upgrade the server components. Clients that have been upgraded to 4.5 will continue to work with Application Virtualization servers that have not yet been upgraded. Earlier versions of the client are not supported on servers that have been upgraded to 4.5. For more information about upgrading the system components, see [Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md). - -To help ensure a successful migration, the Application Virtualization system components should be upgraded in the following order: - -1. **Microsoft Application Virtualization Clients.** For step-by-step upgrade instructions, see [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md). - -2. **Microsoft Application Virtualization Servers and Database.** For step-by-step upgrade instructions, see [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md). - - **Note**   - If you have more than one server sharing access to the Application Virtualization database, all those servers must be taken offline while the database is being upgraded. You should follow your normal business practices for the database upgrade, but it is highly advisable that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the other servers. - - - -3. **Microsoft Application Virtualization Management Web Service.** This step applies only if the Management Web Service is on a separate server, which would require that you run the server installer program on that separate server to upgrade the Web service. Otherwise, the previous server upgrade step will automatically upgrade the Management Web Service. - -4. **Microsoft Application Virtualization Management Console.** This step applies only if the Management Console is on a separate computer, which would require that you run the server installer program on that separate computer to upgrade the console. Otherwise, the previous server upgrade step will upgrade the Management Console. - -5. **Microsoft Application Virtualization Sequencer.** For step-by-step instructions, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). Any virtual application packages sequenced in version 4.2 will not have to be re-sequenced for use with version 4.5. However, you should consider upgrading the virtual packages to the Microsoft Application Virtualization 4.5 format if you would like to apply default access control lists (ACLs) or generate a Windows Installer file. This is a simple process and requires only that the existing virtual application package be opened and saved with the 4.5 Sequencer. This can be automated by using the Application Virtualization Sequencer command-line interface. - -## App-V 4.6 Client Package Support - - -You can deploy packages created in previous versions of App-V to App-V 4.6 Clients. However, you must modify the associated **.osd** file so that it includes the appropriate operating system and chip architecture information. Use the following values. - - --- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    OS Value

    <OS VALUE=”Win2003TS”/>

    <OS VALUE=”Win2003TS64”/>

    <OS VALUE=”Win2008TS”/>

    <OS VALUE=”Win2008TS64”/>

    <OS VALUE=”Win2008R2TS64”/>

    <OS VALUE=”Win7”/>

    <OS VALUE=”Win764”/>

    <OS VALUE=”WinVista”/>

    <OS VALUE=”WinVista64”/>

    <OS VALUE=”WinXP”/>

    <OS VALUE=”WinXP64”/>

    - - - -To run a newly created 32-bit package, you must sequence the application on a computer running a 32-bit operating system with the App-V 4.6 Sequencer installed. After you have sequenced the application, in the Sequencer console, select the **Deployment** tab and then specify the appropriate operating system and chip architecture as required. - -**Important**   -Applications sequenced on a computer running a 64-bit operating system must be deployed to computers running a 64-bit operating system. New 32-bit packages created by using the App-V 4.6 Sequencer will not run on computers running the App-V 4.5 Client. - - - -To run new 64-bit packages on the App-V 4.6 Client, you must sequence the application on a computer running the App-V 4.6 Sequencer and that is running a 64-bit operating system. After you have sequenced the application, in the Sequencer console, select the **Deployment** tab and then specify the appropriate operating system and chip architecture as required. - -The following table lists which client versions will run packages created by using the various versions of the Sequencer. - - --------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Sequenced by using the App-V 4.2 SequencerSequenced by using the App-V 4.5 SequencerSequenced by using the 32-bit App-V 4.6 SequencerSequenced by using the 64-bit App-V 4.6 SequencerSequenced by using the 32-bit App-V 4.6 SP1 SequencerSequenced by using the 64-bit App-V 4.6 SP1 Sequencer

    4.2 Client

    Yes

    No

    No

    No

    No

    No

    4.5 Client ¹

    Yes

    Yes

    No

    No

    No

    No

    4.6 Client (32-bit)

    Yes

    Yes

    Yes

    No

    Yes

    No

    4.6 Client (64-bit)

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    4.6 SP1 Client

    Yes

    Yes

    Yes

    No

    Yes

    No

    4.6 SP1 Client (64-bit)

    Yes

    Yes

    Yes

    Yes

    Yes

    Yes

    - - - -¹Applies to all versions of the App-V 4.5 Client, including App-V 4.5, App-V 4.5 CU1 and App-V 4.5 SP1. - -## Additional Migration Considerations - - -One of the features of the App-V 4.5 Sequencer is the ability to create Windows Installer files (.msi) as control points for virtual application package interoperability with electronic software distribution (ESD) systems such as Microsoft Endpoint Configuration Manager. Previous Windows Installer files created with the .msi tool for Application Virtualization that were installed on a App-V 4.1 or 4.2 Client that is subsequently upgraded to 4.5 continue to work, although they cannot be installed on the 4.5 Client. However, they cannot be removed or upgraded unless they are upgraded in the 4.5 Sequencer. The original pre-4.5 virtual application package would need to be opened in the 4.5 Sequencer and then saved as a Windows Installer File. - -**Note**   -If the App-V 4.2 Client has already been upgraded to 4.5, it is possible to use script as a workaround to preserve the 4.2 packages on 4.5 clients and allow them to be managed. This script must copy two files, msvcp71.dll and msvcr71.dll, to the App-V installation folder and set the following registry key values under the registry key \[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\]: - -"ClientVersion"="4.2.1.20" - -"GlobalDataDirectory"="C:\\\\Documents and Settings\\\\All Users\\\\Documents\\\\" (a globally writeable location) - - - -Windows Installer files generated by the App-V 4.5 Sequencer display the error message "This package requires Microsoft Application Virtualization Client 4.5 or later" when you try to run them on an App-V 4.6 Client. Open the old package with either the App-V 4.5 SP1 Sequencer or the App-V 4.6 Sequencer and generate a new .msi for the package. - -Any 4.2 reports that were created and saved will be overwritten when the server is upgraded to 4.5. If you need to keep these reports, you must save a backup copy of the SftMMC.msc file located in the SoftGrid Management Console folder on the server and use that copy to replace the new SftMMC.msc that is installed during the upgrade. - -For additional information about upgrading from previous versions, see [Upgrading to Microsoft Application Virtualization 4.5 FAQ](https://go.microsoft.com/fwlink/?LinkId=120358) (https://go.microsoft.com/fwlink/?LinkId=120358). - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-for-security-and-protection.md b/mdop/appv-v4/planning-for-security-and-protection.md deleted file mode 100644 index dd42746a18..0000000000 --- a/mdop/appv-v4/planning-for-security-and-protection.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Planning for Security and Protection -description: Planning for Security and Protection -author: dansimp -ms.assetid: d0e2ef81-c197-4020-ad85-8d66fe5c178f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Security and Protection - - -As an infrastructure administrator, you must provide a secure, productive, and supportable, environment. Security for the Microsoft Application Virtualization (App-V) system relies on proper setup of the software and the environment in which it operates. This section of the Planning and Deployment Guide provides guidance for configuring the various App-V components to enhance the security of your environment. You should carefully consider the exposure and attack surface of your App-V environment before deciding to deploy a system without applying the security recommendations outlined in this section. - -## In This Section - - -[Security and Protection Overview](security-and-protection-overview.md) -Provides overview information about the security and protection of your App-V system. - -[Planning for Server Security](planning-for-server-security.md) -Provides information you can use to configure the Application Virtualization Management Server and Application Virtualization Streaming Server. - -[Planning for Client Security](planning-for-client-security.md) -Provides information you can use to configure the Application Virtualization Management Desktop Client. - -[Planning for Sequencer Security](planning-for-sequencer-security.md) -Provides information you can use to configure the Application Virtualization Sequencer. - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/planning-for-sequencer-security.md b/mdop/appv-v4/planning-for-sequencer-security.md deleted file mode 100644 index 63b4815f06..0000000000 --- a/mdop/appv-v4/planning-for-sequencer-security.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Planning for Sequencer Security -description: Planning for Sequencer Security -author: dansimp -ms.assetid: 8043cb02-476d-4c28-a850-903a8ac5b2d3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Sequencer Security - - -Incorporate recommended implementation practices as early as possible when configuring Application Virtualization (App-V) so that your Sequencer implementation is functional and more secure. If you have already configured the Sequencer, use the following best-practice guidelines to revisit your design decisions and analyze them from a security perspective. - -**Important** -The App-V Sequencer collects and deploys all application information recorded on the computer running the sequencer. You should ensure that all users accessing the computer running the Sequencer have administrative credentials. Users with user account credentials should not have access to control package contents and package files. If you are sequencing on a computer running Remote Desktop Services (formerly Terminal Services), make sure it is a computer that is dedicated to sequencing and that users with user account credentials are not connected to it during sequencing. - - - -## Sequencer Security Best Practices - - -Consider the following scenarios and the associated best practices when implementing and using the Application Virtualization (App-V) Sequencer: - -- **Virus scanning on the computer running the Sequencer**—It is recommended that you scan the computer running the Sequencer for viruses and then disable all antivirus and malware detection software on the computer running the Sequencer during the sequencing process. This will speed the sequencing process and prevent the antivirus and anti-malware software components from interfering with the sequencing process. Next install the sequenced package on a computer not running the Sequencer, and after successful installation, scan that computer for viruses. If viruses are found, the manufacturer of the software should be contacted to inform them of the infected source files and request an updated installation source without viruses. Optionally, the Sequencer could be scanned after the installation phase and if a virus is found, the software manufacturer should be contacted as mentioned above. - - **Note** - If a virus is detected in an application, the application should not be deployed to target computers. - - - -- **Capturing access control lists (ACLs) on NTFS files**—The App-V Sequencer captures NTFS file system permissions for the files that are monitored during the installation of the product. This capability allows you to more accurately replicate the intended behavior of the application, as if it were installed locally and not virtualized. In some scenarios, an application might store information that users were not intended to access within the application files. For example, an application could store credentials information in a file inside of the application. If ACLs are not enforced on the package, a user could potentially view and then use this information outside of the application. - - **Note** - You should not sequence applications that store unencrypted security-specific information, such as passwords, and so on. - - - -~~~ -During the installation phase, you can modify the default permissions of the files if necessary. After completion of the sequencing process, but before saving the package, you can choose whether to enforce security descriptors that were captured during the installation of the application. By default, App-V will enforce the security descriptors specified during the installation of the application. If you turn off security descriptor enforcement, you should test the application to ensure the removal of associated Access Control Lists (ACL) will not cause the application to perform unexpectedly. -~~~ - -- **Sequencer doesn’t capture registry ACLs**—Although the Sequencer captures the NTFS file system ACLs during the installation phase of sequencing, it does not capture the ACLs for the registry. Users will have full access to all registry keys for virtual applications except for services. However, if a user modifies the registry of a virtual application, the change will be stored in a specific store (**uservol\_sftfs\_v1.pkg**) and will not affect other users. - -- **Application services**—App-V provides support for application services that are part of a virtualized application. However, in the virtual environment, the security context that they will run as is limited. The only security contexts supported in a virtual environment are Local System, Local Service, and Network Service. During sequencing, if a security context is specified for an application service other than the three supported, the Local System security context will be applied in the virtual environment. If the application service is configured to use either Local Service or Network Service, it will be honored in the virtual environment. Configuring the service account can be done during the sequencing process using these three security contexts. - -- **Persisted security information**—When sequencing applications, you can install the application as a user would or you can develop an automated method for installing the application while being monitored. Everything that is not being excluded from the package will be captured as part of that package so that the application will have the necessary assets to run in a virtualized environment. Some applications store sensitive security information (such as passwords) during the installation; if persisted unprotected, this security information could be accessed by other users with access to the package. During installation, if an application installation asks for a password or other security-sensitive information, check with the documentation to ensure that it is either not persisted (removed after installation) or, if persisted, that it is protected (encrypted). - -- **Securing virtual application packages**—Always save virtual application packages in a secure location on the network to protect the package from being tampered with or corrupted. - -## Related topics - - -[Planning for Security and Protection](planning-for-security-and-protection.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-for-server-security.md b/mdop/appv-v4/planning-for-server-security.md deleted file mode 100644 index 289d44d508..0000000000 --- a/mdop/appv-v4/planning-for-server-security.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Planning for Server Security -description: Planning for Server Security -author: dansimp -ms.assetid: c7cd8227-b359-41e7-a8ae-d0d5718a76a2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for Server Security - - -To enhance the security of an environment, you must look at the exposure to any potential threats in the environment. Providing security for an App-V infrastructure requires you to use the specific App-V security features as well as the security practices and features for the underlying infrastructure. Securing the underlying infrastructure for services such as Internet Information Services (IIS), Active Directory Domain Services, and SQL Server will improve the overall security for your App-V system. - -The default settings for the server installation provide the highest levels of security. However, some of the components rely on underlying infrastructure that is not configured as part of the installation. Following up with post-installation steps will enhance the security of the App-V infrastructure. - -The content directory contains all of the packages that are to be streamed to clients. These resources need to be as secure as possible to eliminate many possible security threats. The following list offers some additional guidance: - -- UNC-based publishing and/or streaming—The permissions for this item should be the most restrictive in the environment. Use NTFS permissions to implement the most restrictive access control lists (ACLs) for the content directory (Users=Read, Administrators=Read and Write). - -- IIS used for publishing and/or streaming—Configure IIS to support only Windows Integrated authentication. Remove anonymous access to the IIS server, and restrict access to the directory with NTFS permissions. - -- RTSP/RTSPS to stream application packages—Configure the App-V Provider Policy to require authentication, enforce access permissions, and enable only required groups to have access to the provider policy. Configure applications with the appropriate permissions in the database. - -Keep the number of users with administrative privileges to a minimum to reduce possible threats to the data in the data store and to avoid publishing malicious applications into the infrastructure. - -## Application Virtualization Security - - -App-V uses several methods of communication between the various components of the infrastructure. When you plan your App-V infrastructure, securing the communications between servers can reduce the security risks that might already be present on the existing network. - -### Data Store - -The Application Virtualization Management Server and Application Virtualization Management Service communicate with the data store by using an SQL connection over TCP port 1433. The Management Server uses the data store to retrieve application and configuration data, and it writes usage information to the database. The Management Service communicates with the data store on behalf of an administrator who is configuring the App-V infrastructure. Because the data store contains critical information, it is important to minimize threats to this data. - -It is recommended that communications between App-V Management Server, Management Service and the data store be secured with Internet Protocol Security (IPsec). Specifically, create policies that secure the communication channel between the data store (SQL) and the Management Server and the data store and the Management Service. You can also deploy server and domain isolation with IPsec, ensuring all App-V infrastructure components communicate only with secure channels. For information about implementing IPsec, refer to the following documentation: - -- For Windows Server 2003, see (https://go.microsoft.com/fwlink/?LinkId=133226). - -- For Windows Server 2008, see (https://go.microsoft.com/fwlink/?LinkId=133227). - -### Content Directory - -The App-V Management Server installation configures a location for the content directory. This directory is the storage location for virtualized application packages. This location can be local to the server, or it can be placed on a remote network share. Therefore, implement IPsec to help secure the communication with a remote location for the content directory. - -You can also use a virtual directory on an IIS server to stream packages to the clients. If the virtual directory that is created for content is located on a remote source, use IPsec to help secure the communication between the IIS server and the remote storage location. - -The content directory contains all of the packages that are streamed to clients. These resources need to be as secure as possible to eliminate many possible security threats. - -### Security Protocols - -You can use RTSPS or HTTPS for enhanced secure communications. RTSPS is the protocol used by App-V servers, and HTTPS is the protocol used by IIS servers. These protocols are used when publishing applications from the server to the Application Virtualization Desktop Client. After you determine the desired protocol, add a publishing server that uses that protocol. - -### Configuring App-V Servers for RTSPS - -Installing or configuring an App-V Management Server or Streaming Server to use Enhanced Security (for example, TLS) requires that an X.509 V3 certificate be provisioned to the App-V server. When you prepare to install or configure security for a server, you must fulfill some specific requirements. Technical requirements for deploying and configuring certificates for a more secure App-V Management Server or Streaming Server include the following: - -- Certificate must be valid. Otherwise, the client terminates the connection. - -- Certificate must contain the correct Enhanced Key Usage (EKU) - Server Authentication (OID 1.3.6.1.5.5.7.3.1). Otherwise, the client terminates the connection. - -- Certificate fully qualified domain name (FQDN) must match the server on which it is installed. For example, if the client is calling `RTSPS://Myserver.mycompany.com/content/MyApp.sft`, but the certificate **Issued To** field contains `Myserver1.mycompany.com`, the client will not connect to the server and the session is terminated, even if `Myserver.mycompany.com` and `Myserver1.mycompany.com` resolve to the same IP address. - - **Note**   - If you use App-V in a network load balanced cluster, the certificate must be configured with *Subject Alternate Names* (SANs) to support RTSPS. For information about configuring the certification authority (CA) and creating certificates with SANs, see (https://go.microsoft.com/fwlink/?LinkId=133228). - - - -- The CA issuing the certificate to the App-V server must be trusted by the client connecting to the server. Otherwise, the client terminates the connection. - -- You must change the permissions for the *Certificate Private Key* to enable access by the Server App-V Service. By default, the App-V Management Server and Streaming Server services run under the Network Service account. When a PKCS\#10 is generated on the server, a private key is created. Only the Local System and Administrators groups have access to this key. These default ACLs prevent the App-V server from accepting secure connections. - - **Note**   - For information about configuring a public key infrastructure (PKI), see (https://go.microsoft.com/fwlink/?LinkId=133229). - - - -### Configuring IIS Servers with HTTPS - -App-V might use IIS servers in certain infrastructure configurations. For more information about configuring IIS servers, see (https://go.microsoft.com/fwlink/?LinkId=133230). - -**Note**   -If you are using IIS to publish the ICO and OSD files, configure a MIME type for OSD=TXT; otherwise, IIS will refuse to serve the ICO and OSD files to clients. - - - -### Application-Level Security - -You can configure the servers to stream specific applications to a user’s desktop. However, access permission actually is granted at the package level, not at the application level. Although a specific application might not be published to the user’s desktop, if the user has permission to add applications or is an administrator on the client computer, the user can create and use a shortcut on the client to run all the applications in a package. - -## Configuring App-V Administration for a Distributed Environment - - -When designing the infrastructure for your specific organization, you can install the App-V Management Web Service on a computer other than the computer where you install the App-V Management Server. Common reasons for separating these App-V components include the following: - -- Performance - -- Reliability - -- Availability - -- Scalability - -For the infrastructure to operate correctly, separating the App-V Management Console, Management Server and Management Web Service requires additional configuration. For detailed information about how to configure the server, see [How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md). - -## Related topics - - -[Planning for Security and Protection](planning-for-security-and-protection.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md b/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md deleted file mode 100644 index f330eaca98..0000000000 --- a/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Planning the Application Virtualization Sequencer Implementation -description: Planning the Application Virtualization Sequencer Implementation -author: dansimp -ms.assetid: 052f32fe-ad13-4921-a8ce-4a657eb2b2bf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning the Application Virtualization Sequencer Implementation - - -Sequencing, the process used by Application Virtualization to create virtual applications and application packages, requires the use of a computer with the Application Virtualization Sequencer software installed. - -During the sequencing process, the Sequencer is placed in monitor mode, and the application to be sequenced is installed on the sequencing computer. Next, the sequenced application is started, and its most important and commonly used functions are exercised so that the monitoring process can configure the primary feature block, which contains the minimum content in an application package that is necessary for an application to run. When these steps are complete, monitoring mode is stopped and the sequenced application is saved and tested to verify correct operation. - -When deciding which applications to choose for sequencing, remember that certain applications cannot be sequenced. These include certain parts of the Windows operating system, such as Internet Explorer, device drivers, and applications that start services at boot time. - -For step-by-step information about installing the Sequencer, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). - -**Important**   -The entire sequencing process plan should be reviewed and approved by your corporate security team. Sequencer operations would usually be kept separate from the production environment in a lab. This can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers will need connectivity to the corporate network to copy finished packages over to the production servers. However, because they are typically operated without antivirus protection, they must not be on the corporate network unprotected—for example, you might be able to operate behind a firewall or on an isolated network segment. Using Virtual Machines configured to share an isolated virtual network might also be an acceptable approach. Follow your corporate security policies to safely address this situation. - - - -Key steps for planning the sequencing process include the following: - -- Consider the number of applications you expect to process each month, the size of those applications, and add an allowance for sequencing future updates. Packages can be up to 4 GB in size, compressed or uncompressed. - -- Prepare and document a methodical, repeatable process for your organization to follow when sequencing each application. This should include the use of a checklist for each run, as well as a version control process. The use of a tracking log for each sequenced application is also very helpful when investigating possible technical issues with a package. - -- For sequencing applications, use high-performing computers that are optimized for processing throughput, with at least 4 GB of RAM and a fast CPU (3 GHz or faster). Fast hard disks and the use of separate disk volumes can also improve performance. Virtual Machines are ideal for sequencing because they can easily be reset, or you can use a physical computer with a clean image on a local partition to enable rapid re-imaging after each package sequencing operation has been completed. - - **Important**   - Running the App-V sequencer in Safe Mode is not supported. - - - -- Verify that you understand the sequenced application’s operating environment, including integration elements such as Microsoft Office or the Java Runtime Environment, because this will often determine whether anything has to be installed on the sequencing computer prior to sequencing the application. - -- Ensure that each new sequencing operation always starts with a clean base image. Make sure that the sequencing computer has been reset, either by restoring the saved image to a physical computer or by restarting a virtual machine after discarding all changes. The base image should have the latest updates applied from Windows Update before saving. - -- Turn off anything on the sequencing computer that can interfere with the install monitoring process, such antivirus scanners and Windows Update, because having a stable platform during the sequencing process is essential. Because this step incurs significant security risks, ensure that the correct precautions are taken to protect the computer and network as well as the sequenced application package. We recommend that you do an antivirus scan of application packages before sequencing them. - -- Include a detailed process for testing each application after sequencing. Testing the sequenced application will determine whether it functions correctly and is an essential part of the process prior to deploying the virtualized application to end users. As the final step in testing prior to wide-scale deployment to end users, you should also plan for a pilot deployment to a test group. - -- When testing sequenced applications, choose computer equipment of the same type and running the same operating systems that are in use in the company production environment. As long as they are configured properly, either virtual machines or physical machines can be used. - -## Related topics - - -[Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md) - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) - -[How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md) - -[Security and Protection Overview](security-and-protection-overview.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md b/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md deleted file mode 100644 index 6a03d508c0..0000000000 --- a/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation -description: Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation -author: dansimp -ms.assetid: 3a57306e-5c54-4fde-8593-fe3b788f18d3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation - - -If you want to use Application Virtualization Streaming Servers in conjunction with your Application Virtualization Management Server-based implementation, you can choose from several alternatives, taking advantage of whatever infrastructure is already in place. For example, if you already have servers in your field branch offices, you can place the Application Virtualization \\CONTENT share on those servers and then configure the clients to use that content share as their application content source. If you choose to use only Application Virtualization Management Servers—for example, because you have only a single office—the clients can stream content from that server. - -The supported options include using a file server, an IIS server, or an Application Virtualization Streaming Server. You could also install the Application Virtualization Streaming Server on an existing file server or IIS server. The characteristics of these different options are summarized in the following table. - -**Note**   -The active upgrade feature enables a new version of an application to be added to an App-V Management Server or Streaming Server without affecting users currently running the application. The App-V clients will automatically receive the latest version of the application from the App-V Management Server or Streaming Server the next time the user starts the application. Use of the RTSP(S) protocol is required for this feature. - - - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server TypeProtocolAdvantagesDisadvantagesLinks

    File server

    SMB

      -
    • Simple low-cost solution to configure existing file server with \CONTENT share

    • -
      -
    • No active upgrade

    • -

    How to Configure the File Server

    IIS server

    HTTP/ HTTPS

      -
    • Supports enhanced security using HTTPS protocol

    • -
    • Supports streaming to remote computers across the Internet

    • -
    • Only one port in firewall to open

    • -
    • Scalable

    • -
    • Familiar protocol

    • -
      -
    • Need to manage IIS

    • -
    • No active upgrade

    • -

    How to Configure the Server for IIS

    Application Virtualization Streaming Server

    RTSP/ RTSPS

      -
    • Active upgrade

    • -
    • Supports enhanced security using RTSPS protocol

    • -
    • Only one port in firewall to open

    • -
      -
    • Dual infrastructure

    • -
    • Server administration requirement

    • -

    How to Configure the Application Virtualization Streaming Servers

    Application Virtualization Management Server

    RTSP/ RTSPS

      -
    • Active upgrade

    • -
    • Supports enhanced security using RTSPS protocol

    • -
    • Only one port in firewall to open

    • -
      -
    • Dual infrastructure

    • -
    • Server administration requirement

    • -

    How to Configure the Application Virtualization Management Servers

    - - - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) - -[Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) - - - - - - - - - diff --git a/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md b/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md deleted file mode 100644 index f0e61dd69e..0000000000 --- a/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Planning Your Streaming Solution in an Electronic Software Distribution Implementation -description: Planning Your Streaming Solution in an Electronic Software Distribution Implementation -author: dansimp -ms.assetid: bc18772a-f169-486f-adb1-7af1a31845aa -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning Your Streaming Solution in an Electronic Software Distribution Implementation - - -If you decide to use streaming servers in conjunction with your ESD system to make application content available to your end user computers, you can choose from several alternatives, taking advantage of whatever infrastructure is already in place. For example, if your ESD system has software distribution shares on servers in your field branch offices, you can place the Application Virtualization \\CONTENT share on those servers and then configure the clients to use that content share as their application content source. The supported options include using a file server or an IIS server. You could also install the Application Virtualization Streaming Server on an existing file server or IIS server. - -The Application Virtualization Streaming Server provides support for the active upgrade feature in Application Virtualization. The active upgrade feature enables a new version of an application to be added to an App-V Management Server or Streaming Server without affecting users currently running the application. The App-V clients will automatically receive the latest version of the application from the App-V Management Server or Streaming Server the next time the user starts the application. Use of the RTSP(S) protocol is required for this feature. If you choose not to use the Application Virtualization Streaming Server, you will need to explicitly manage application package upgrades by using the ESD system. - -**Note**   -Access to the applications is controlled by means of Security Groups in Active Directory Domain Services, so you will need to plan a process for setting up a security group for each virtual application and for managing which users are added to each group. The Application Virtualization system administrator configures each streaming server to use these Active Directory groups by applying ACLs to the application directories under the CONTENT share, which controls access to the packages based on Active Directory group membership. - - - -The characteristics of the available streaming options are summarized in the following table. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server TypeProtocolAdvantagesDisadvantagesLinks

    File server

    SMB

      -
    • Simple low-cost solution to configure existing file server with \CONTENT share

    • -
      -
    • No active upgrade

    • -

    How to Configure the File Server

    IIS server

    HTTP/ HTTPS

      -
    • Supports enhanced security using HTTPS protocol

    • -
    • Supports streaming to remote computers across the Internet

    • -
    • Only one port in firewall to open

    • -
    • Scalable

    • -
    • Familiar protocol

    • -
      -
    • Need to manage IIS

    • -
    • No active upgrade

    • -

    How to Configure the Server for IIS

    Application Virtualization Streaming Server

    RTSP/ RTSPS

      -
    • Active upgrade

    • -
    • Supports enhanced security using RTSPS protocol

    • -
    • Only one port in firewall to open

    • -
      -
    • Dual infrastructure

    • -
    • Server administration requirement

    • -

    How to Configure the Application Virtualization Management Servers

    - - - -## Related topics - - -[How to Configure Servers for ESD-Based Deployment](how-to-configure-servers-for-esd-based-deployment.md) - -[Security and Protection Overview](security-and-protection-overview.md) - -[Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md) - - - - - - - - - diff --git a/mdop/appv-v4/prepare-computer-page--learn-more-.md b/mdop/appv-v4/prepare-computer-page--learn-more-.md deleted file mode 100644 index ae4493a4e7..0000000000 --- a/mdop/appv-v4/prepare-computer-page--learn-more-.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Prepare Computer Page (Learn More) -description: Prepare Computer Page (Learn More) -author: dansimp -ms.assetid: a401ce3d-b8f7-4b3f-9be9-ecf6d8b544fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Prepare Computer Page (Learn More) - - -Use the **Prepare Computer** to review the issues that might cause the virtual application package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information displayed, click **Refresh**. After you have resolved all potential issues, you can proceed to the next step. - -This page contains the following elements. - -**Description** -Displays the potential conflicting applications or programs that are currently running on the computer running the App-V Sequencer. - -**Resolution** -Displays the recommended action to ensure that the computer running the Sequencer has been optimized to create the virtual application package. - -**Refresh** -Refreshes the information displayed in the **Description** pane. After you performed the suggested steps, click **Refresh**. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/properties-tab-keep.md b/mdop/appv-v4/properties-tab-keep.md deleted file mode 100644 index 3631579f1f..0000000000 --- a/mdop/appv-v4/properties-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Properties Tab -description: Properties Tab -author: dansimp -ms.assetid: 6ff20678-6766-4f0d-8bbb-f19b224682a1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Properties Tab - - -The **Properties** tab provides basic statistical information about a sequenced application package. - -## In This Section - - -[About the Properties Tab](about-the-properties-tab.md) -Provides general information about the **Properties** tab. - -[How to Change Package Properties](how-to-change-package-properties.md) -Provides the procedure to change package properties using the **Properties** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/provider-policies-node.md b/mdop/appv-v4/provider-policies-node.md deleted file mode 100644 index bbe803ac9f..0000000000 --- a/mdop/appv-v4/provider-policies-node.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Provider Policies Node -description: Provider Policies Node -author: dansimp -ms.assetid: 89b47076-7732-4128-93cc-8e6d5b671c8e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Provider Policies Node - - -The **Provider Policies** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of provider policies. Right-click the **Provider Policies** node to display a pop-up menu that contains the following elements. - -**New Provider Policy** -Displays the New Provider Policy Wizard. This wizard consists of the following pages: - -1. Enter a name in the **Provider Policy Name** field. Select the **Manage client desktop using the Management Console** check box if you want that capability. Select one or both of the following check boxes if you want the associated functionality: - - - **Refresh publishing configuration when a user logs in** - - - **Refresh configuration every**. After selecting this option, enter a number and select the unit from the drop-down menu. Valid entries range from a minimum of **30 minutes** to a maximum of **999 days**. - -2. Click **Add** or **Remove** to add or remove a group assignment. Use the standard **Windows Browse** dialog box to find a user group. - -3. Select one of the following check boxes on the **Provider Pipeline Configuration** dialog box to enable the associated feature: - - - **Authentication**—Select the type of authentication from the drop-down list. - - - **Enforce Access Permission Settings** - - - **Log Usage Information** - - - **Licensing**—Select an enforcement scheme from the drop-down list. - -4. Click **Finish** to add the new provider policy. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/provider-policies-results-pane-columns.md b/mdop/appv-v4/provider-policies-results-pane-columns.md deleted file mode 100644 index 984d407ee3..0000000000 --- a/mdop/appv-v4/provider-policies-results-pane-columns.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Provider Policies Results Pane Columns -description: Provider Policies Results Pane Columns -author: dansimp -ms.assetid: f9456f17-3106-4e5a-9a8c-df3af66986e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Provider Policies Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays one column for the provider policies. If there are additional columns available, you can add and remove them. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - -
    ColumnContents

    Name

    This column displays the name of the provider policy.

    - -  - -## Related topics - - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/provider-policies-results-pane.md b/mdop/appv-v4/provider-policies-results-pane.md deleted file mode 100644 index efb2984428..0000000000 --- a/mdop/appv-v4/provider-policies-results-pane.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Provider Policies Results Pane -description: Provider Policies Results Pane -author: dansimp -ms.assetid: 17ea0836-bfb5-4966-8778-155444d81e64 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Provider Policies Results Pane - - -The **Provider Policies Results** pane in the Application Virtualization Server Management Console displays a list of the available provider policies. - -Right-click any provider policy to display the following elements. - -**Delete** -This menu item enables you to delete a provider policy from the **Results** pane. - -**Rename** -This menu item enables you to change the name of a provider policy in the **Results** pane. - -**Properties** -This menu item displays the **Properties** dialog box for the selected provider policy. The **Properties** dialog box has the following tabs: - -- **General**—Enables you to select the **Manage client desktop using the** **Management Console** check box if you want to centrally manage shortcuts on the client desktops from the Application Virtualization Server Management Console. If you choose to manage shortcuts from the console, you can select check boxes to refresh the desktop every time a user logs in and at intervals you specify. - -- **Group Assignment**—Enables you to add and remove user groups assigned to the provider policy. - -- **Provider Pipeline**—Enables you to specify the authentication required. - - - Select the desired check boxes for **Enforce Access Permission Settings**, **Log Usage Information**, and **Licensing**. If you select the **Licensing** check box, select **Audit License Usage Only** or **Enforce License Policies** from the drop-down list. The first option monitors license usage, while the second option strictly enforces your licensing policy. Click **Finish**, and then read the prompt and click **OK** to continue. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -Right-click anywhere in the **Results** pane, except on a provider policy, to display a pop-up menu that contains the following elements. - -**Refresh** -Select this menu item to refresh the view of the provider policies. - -**Export List** -With this menu item, you can create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This menu item lets you change the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -These menu items can be used to change how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system of the Application Virtualization Server Management Console. - -## Related topics - - -[Server Management Console: Provider Policies Node](server-management-console-provider-policies-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/publish-app.md b/mdop/appv-v4/publish-app.md deleted file mode 100644 index 3248daad68..0000000000 --- a/mdop/appv-v4/publish-app.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: PUBLISH APP -description: PUBLISH APP -author: dansimp -ms.assetid: f25f06a8-ca23-435b-a0c2-16a5f39b6b97 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# PUBLISH APP - - -Publishes an application shortcut to the user's Start menu, desktop, or other specified location. - -`SFTMIME PUBLISH APP:application {/DESKTOP | /START | /TARGET target-path} [/ICON icon-pathname] [/DISPLAY display-name] [/ARGS command-args...] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APPLICATION:<application>

    The name and version (optional) of the application.

    /DESKTOP

    Publishes a shortcut to the user's desktop.

    /START

    Publishes a shortcut to the Application Virtualization Applications folder in the Programs folder of the Start menu.

    /TARGET <target-path>

    The absolute path where the shortcut should be published.

    /ICON <icon-pathname>

    The path or URL for the icon file.

    /DISPLAY <display-name>

    The display name for the shortcut.

    /ARGS <command-args>

    Parameters to be passed to the application.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/publish-package.md b/mdop/appv-v4/publish-package.md deleted file mode 100644 index facdb61e5c..0000000000 --- a/mdop/appv-v4/publish-package.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: PUBLISH PACKAGE -description: PUBLISH PACKAGE -author: dansimp -ms.assetid: a33e72dd-194f-4283-8e99-4584ab13de53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# PUBLISH PACKAGE - - -Publishes the contents of an entire package. - -`SFTMIME PUBLISH PACKAGE:package-name /MANIFEST manifest-path [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    PACKAGE:<package-name>

    User-visible and user-friendly name for the package.

    /MANIFEST <manifest-path>

    The path or URL of the manifest file that lists the applications included in the package and all of their publishing information.

    /GLOBAL

    If present, the package will be available for all users on this computer.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - - - -**Important**   -The package must already have been added to the Application Virtualization Client, and the manifest file is required. - -To use the **GLOBAL** parameter, the PUBLISH PACKAGE command must be run as local Administrator; otherwise, only **ManageTypes** and **PublishShortcut** permissions are needed. - -Publishing without the **GLOBAL** parameter grants the user access to the applications in the package and publishes the file types and shortcuts listed in the manifest to the user’s profile. - -Publishing with the **GLOBAL** parameter adds the file types and shortcuts listed in the manifest to the “All Users” profile. - -If the package is not global before the call and the **GLOBAL** parameter is used, the package is made global and available to all users. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/publishing-servers-node.md b/mdop/appv-v4/publishing-servers-node.md deleted file mode 100644 index 980c07416d..0000000000 --- a/mdop/appv-v4/publishing-servers-node.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Publishing Servers Node -description: Publishing Servers Node -author: dansimp -ms.assetid: b5823c6c-15bc-4e8d-aeeb-acc366ffedd1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Servers Node - - -The **Publishing Servers** node is one level below the **Application Virtualization** node in the **Scope** pane of the Application Virtualization Client Management Console. When you select this node, the **Results** pane displays a list of publishing servers. - -Right-click the **Publishing Servers** node to display a pop-up menu that contains the following elements. - -**New Server** -This menu item displays the New Server Wizard. This wizard consists of two pages: - -1. Enter a server display name and server type: - - - **Display Name**—Enter a name that you want displayed for the server. This field is blank by default. - - - **Type**—Choose the server type from the drop-down list of server types. - -2. Specify the connection settings for the server: - - - **Host Name**—Enter the name or IP address for the server. - - - **Port**—Enter a numeric value that corresponds to the port number. The default value is 554 if the server type is "Application Virtualization Server" and 80 if the server type is "Standard HTTP Server." - - - **Path**—This field defaults to "/" and is read-only when the server type is "Application Virtualization Server" or “Enhanced Security Application Virtualization Server”. When the server type is “Standard HTTP Server” or “Enhanced Security HTTP Server”, the **Path** field is also editable. - -**New Window from Here** -Select this menu item to open a new management console with the selected node as the root node. - -**Export List** -You can use this menu item to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -This pop-up list of menu items enables you to change the appearance and content of the **Results** pane. - -**Refresh** -Select this item to refresh the management console. - -**Help** -This item displays the help system for the management console. - -## Related topics - - -[Publishing Servers Results Pane](publishing-servers-results-pane.md) - -[Publishing Servers Results Pane Columns](publishing-servers-results-pane-columns.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/publishing-servers-results-pane-columns.md b/mdop/appv-v4/publishing-servers-results-pane-columns.md deleted file mode 100644 index 42862c4a61..0000000000 --- a/mdop/appv-v4/publishing-servers-results-pane-columns.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Publishing Servers Results Pane Columns -description: Publishing Servers Results Pane Columns -author: dansimp -ms.assetid: ad875715-50b3-4881-a6b3-586238d12527 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Servers Results Pane Columns - - -The **Publishing Servers Results** pane can display a variety of columns. **Name**, **URL**, and **Next Refresh** are shown by default. - -**Note**   -You can add or remove a column simply by right-clicking in the **Results** pane, selecting **View**, then selecting **Add/Remove Columns**. - - - -The list can be sorted by any of the columns. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text (for example, **Next Refresh**), dates and times are considered to come before any other text. - -The available column names contain the following elements. - -**Name** -The display name for the server. - -**URL** -The protocol, server name, server port, and path combined into a URL. - -**Next User Refresh** -The next time a refresh is scheduled for the current user. Displays the time if periodic refreshes are set up. Displays **On Login** if the server is set to refresh only on login. Displays **Manual** if automatic refresh is not enabled. - -**Default Refresh Policy** -Displays **Manual**, **On Login**, or **Periodic** to describe how the server is configured. - -**Host** -The name or IP address for the server. - -**Type** -Displays **HTTP** or **Virtual Application** to indicate the server type. - -**Port** -The port on the server to be used. - -**Path** -The path on the server (generally just "/" for Application Virtualization Servers). - -**Last User Refresh** -The time the last refresh occurred for the current user. - -**Last System Refresh** -The last time a refresh happened from this server for any user. - -## Related topics - - -[Publishing Servers Node](publishing-servers-node.md) - -[Publishing Servers Results Pane](publishing-servers-results-pane.md) - - - - - - - - - diff --git a/mdop/appv-v4/publishing-servers-results-pane.md b/mdop/appv-v4/publishing-servers-results-pane.md deleted file mode 100644 index 27745a94ba..0000000000 --- a/mdop/appv-v4/publishing-servers-results-pane.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Publishing Servers Results Pane -description: Publishing Servers Results Pane -author: dansimp -ms.assetid: ee0662e8-9623-4a7c-b6dc-657fa3f56161 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Servers Results Pane - - -The **Publishing Servers** **Results** pane is one level below the **System** pane in the Application Virtualization Client Management Console, and it displays a list of the available application publishing servers. - -To display specific options for the application publishing servers, right-click any server to display a pop-up menu that contains the following elements. - -**Refresh Server** -Refreshes the application and file type associations from the selected application publishing server. - -**Delete** -Deletes the server from the list. - -**Refresh** -Refreshes the contents of the **Results** pane. - -**Properties** -- Click the **General** tab, where you can change the server name, select a type from the drop-down list of server types, and specify the host name and port. When the server type is Standard HTTP Server or Enhanced Security HTTP Server, the **Path** field is also editable. - -- Click the **Refresh** tab, where the **Refresh publishing on user login** check box is selected by default. To change the refresh rate, select the **Refresh publishing every** check box and enter a number that represents the frequency in the field. Then select **Minutes**, **Hours**, **Days** from the drop-down menu. (The minimum amount of time you can enter is 30 minutes.) - -**Help** -Displays the help system for the management console. - -To display general options for the **Result** pane, right-click anywhere in the **Result** pane to display a pop-up menu that contains the following elements. - -**New Server** -- On page one of the wizard, enter the name of the server in the **Display Name** field and select the server type from the **Type** drop-down list. You can choose **Application Virtualization Server**, **Enhanced Security Application Virtualization Server**, **Standard HTTP Server**, or **Enhanced Security HTTP Server** from the drop-down list of server types. - -- On page two of the wizard, type the appropriate information into the **Host Name** and **Port** fields. The **Path** field is not editable for Application Virtualization Servers. You must enter a path for Standard HTTP Server or Enhanced Security HTTP Server. - -**Refresh** -Refreshes the contents of the **Results** pane. - -**Export List** -Can be used to create a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Enables you to change the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Can be used to change how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the management console. - -## Related topics - - -[Publishing Servers Node](publishing-servers-node.md) - -[Publishing Servers Results Pane Columns](publishing-servers-results-pane-columns.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md b/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md deleted file mode 100644 index 53570b3732..0000000000 --- a/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Publishing Virtual Applications Using Application Virtualization Management Servers -description: Publishing Virtual Applications Using Application Virtualization Management Servers -author: dansimp -ms.assetid: f3d79284-3f82-4ca3-b741-1a80b61490da -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Virtual Applications Using Application Virtualization Management Servers - - -In an Application Virtualization Server-based deployment, virtual application packages that have been sequenced, tested, and found deployable are copied to the main CONTENT share to be used by the Application Virtualization Management Server. After the packages are imported on the Application Virtualization Management Server, they can be published to the end users. - -**Note**   -The CONTENT share should be located on the server’s attached disk storage. Using a network storage device such as a SAN or a DFS share should be considered carefully because of the network impact. - - - -Applications are provisioned to Active Directory groups. Typically, the Application Virtualization administrator will create Active Directory groups for each virtual application to be published and then add the appropriate users to those groups. When the users log on to their workstations, the Application Virtualization Client, by default, performs a publishing refresh using the credentials of the logged on user. The user can then start applications from wherever the shortcuts have been placed. The Application Virtualization administrator determines where and how many shortcuts are located on the client system during the sequencing of the application. - -**Note**   -A *publishing refresh* is a call to the Application Virtualization Server that is defined on the Application Virtualization Client, to determine which virtual application shortcuts are sent to the client for use by the end user. - - - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -[Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) - -[Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) - - - - - - - - - diff --git a/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md b/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md deleted file mode 100644 index 5a56209bc5..0000000000 --- a/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Publishing Virtual Applications Using Electronic Software Distribution -description: Publishing Virtual Applications Using Electronic Software Distribution -author: dansimp -ms.assetid: 295fbc1d-ed1c-43b4-aeee-0df384d4e630 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Publishing Virtual Applications Using Electronic Software Distribution - - -An electronic software distribution (ESD) system is designed to efficiently move software to many different computers over slow or fast network connections. With Application Virtualization, using an ESD system, you can use one of the following methods to distribute your virtual application packages: - -- Configure your ESD system to distribute the packages directly to each client computer by using the Windows Installer version of the package generated by the Application Virtualization Sequencer. The Windows Installer file contains the icons, package definition information, and the content, and when you use Windows Installer, it publishes the icons to the Windows desktop and Start menu and loads the package content into the Application Virtualization Client cache. The user can immediately start using the applications without any further setup requirements. Upgrading a package to a newer version is accomplished by using Windows Installer to uninstall the package.msi file and then to install the new version. - -- Place the package content on a software distribution point or Application Virtualization Streaming Server that is readily accessible to the client computers over a network connection with good bandwidth, such as a LAN. For example, you might use the existing ESD system distribution point computers in each branch office. Using command-line parameters to define the streaming source from which clients will stream the virtual application package, the ESD system would deploy the Windows Installer version of the package to each client. The ESD system could also be used to copy the SFT file that contains the package content to the file share on all streaming servers. Upgrading a package to a newer version is accomplished by using Windows Installer to uninstall the package.msi file and then install the new version. - -- As an alternative to using the self-contained Windows Installer file in either of the preceding modes to deploy the packages, you can control the deployment in a much more detailed way by using the Application Virtualization command-line language SFTMIME. This provides many commands to control all aspects of managing the packages. While SFTMIME is powerful, it is also complex, so administrators should plan to create all commands as scripts and thoroughly test them in a test environment prior to production use. For more information about available SFTMIME commands, see [SFTMIME Command Reference](sftmime--command-reference.md). - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -[Planning Your Streaming Solution in an Electronic Software Distribution Implementation](planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md) - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/query-obj.md b/mdop/appv-v4/query-obj.md deleted file mode 100644 index a137e1cbda..0000000000 --- a/mdop/appv-v4/query-obj.md +++ /dev/null @@ -1,142 +0,0 @@ ---- -title: QUERY OBJ -description: QUERY OBJ -author: dansimp -ms.assetid: 55abf0d1-c779-4172-8357-552ab010933b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# QUERY OBJ - - -Returns a tab-delimited list of current applications, packages, file type associations, or publishing servers. - -`SFTMIME QUERY OBJ:{APP|PACKAGE|TYPE|SERVER} [/SHORT] [/GLOBAL] [/LOG log-pathname | /CONSOLE ]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP

    Returns a list of applications.

    PACKAGE

    Returns a list of packages.

    TYPE

    Returns a list of file type associations.

    SERVER

    Returns a list of publishing servers.

    /SHORT

    Without displaying the full properties of each, returns a list of application names, packages, associations, or server names.

    /GLOBAL

    For applications, returns all known applications instead of only the ones the current user has access to. For packages, returns all known packages instead of only the ones the current user has access to. For associations, returns only associations that apply to all users, not user-specific ones. Not valid for servers.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - - - -**Note**   -In version 4.6, a new column has been added to the output of SFTMIME QUERY OBJ:APP \[/GLOBAL\]. The last column of the output is a numeric value that indicates whether an application is published or not. - -PUBLISHED=1 means the application was published by a Publishing Server refresh, by installing the application by using a Windows Installer file (.MSI), or by running an SFTMIME ADD PACKAGE, CONFIGURE PACKAGE or PUBLISH PACKAGE command by using a package manifest. - -PUBLISHED=0 means the application has not been published or it is no longer published as a result of performing a Clear operation or running an SFTMIME UNPUBLISH command. - -If you use the /GLOBAL parameter, the PUBLISHED state will be 1 for applications that were published globally and 0 for those applications that were published under user contexts. Without the /GLOBAL parameter, a PUBLISHED state of 1 is returned for applications published in the context of the user running the command, and a state of 0 is returned for those applications that are published globally. - - - -The SFTMIME QUERY OBJ command can be used to query for information on all of the objects shown above—applications, packages, file type associations, and servers. To show how you might use the SFTMIME QUERY OBJ command in your normal operations tasks, the following example demonstrates the process you would follow if you wanted to set the OVERRIDEURL parameter value for a specific package to specify a new path to the package content.  - -1. To find the package that you want to configure, run the following command: - - `SFTMIME QUERY OBJ:PACKAGE` - - This command returns each discovered package name as a GUID in the first column of output—for example, {AF78ABE1-57D4-4297-89DE-C308684AEDD6}. - -2. To set the OVERRIDEURL parameter value, you use the SFTMIME [CONFIGURE PACKAGE](configure-package.md) command. For example, to set the OVERRIDEURL value for this package to a value of *\\\\server\\share\\mypackage.sft*, use the SFTMIME CONFIGURE PACKAGE command and give it the selected package GUID from the output of the SFTMIME QUERY OBJ command in step 1, followed by the OVERRIDEURL parameter and its new value, as follows: - - `SFTMIME CONFIGURE PACKAGE:"{AF78ABE1-57D4-4297-89DE-C308684AEDD6}" /OVERRIDEURL "\\\\server\\share\\mypackage.sft "` - -For version 4.6 SP2, the following option has been added. - - ---- - - - - - - -

    /NO-UPDATE-FTA-SHORTCUT

    Indicates the current state of the /NO-UPDATE-FTA-SHORTCUT flag.

    - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/refresh-server.md b/mdop/appv-v4/refresh-server.md deleted file mode 100644 index 8cbd8928df..0000000000 --- a/mdop/appv-v4/refresh-server.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: REFRESH SERVER -description: REFRESH SERVER -author: dansimp -ms.assetid: 232df842-a160-46cd-b60b-f464cd9a0086 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# REFRESH SERVER - - -This command updates publishing information from a server. - -`SFTMIME REFRESH SERVER:server-name [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    SERVER:<server-name>

    The display name of the server.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/repair-app.md b/mdop/appv-v4/repair-app.md deleted file mode 100644 index 2b9e6f53f2..0000000000 --- a/mdop/appv-v4/repair-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: REPAIR APP -description: REPAIR APP -author: dansimp -ms.assetid: 892b556b-612d-4531-890e-4cfc2ac88d9f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# REPAIR APP - - -This command resets your personal settings for an application. - -`SFTMIME REPAIR APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/reports-node.md b/mdop/appv-v4/reports-node.md deleted file mode 100644 index d691eb3d1c..0000000000 --- a/mdop/appv-v4/reports-node.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Reports Node -description: Reports Node -author: dansimp -ms.assetid: b7fdc52d-f112-4a65-af25-134398810e9b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Reports Node - - -The **Reports** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of reports. Right-click the node to display a pop-up menu that contains the following elements. - -**New Report** -Displays the New Report Wizard. The wizard has several pages. Depending on which report you select, the remaining pages in the wizard change for the requirements of that report type. Scan the following list of pages to find the pages that refer to your report: - -- **Report Name**—Enables you to select a report type from the **Report Type** drop-down list. For more information, see [Application Virtualization Report Types](application-virtualization-report-types.md). - -- **Report Period**—Enables you to select a radio button to specify the frequency for running the report. - -- **Server**—Enables you to select the **Server**, **Server Group**, or **Enterprise** radio button, and to select the server from the **Server** field and the server group from the **Server Group** drop-down list. - -- **Application**—Enables you to select an application from the drop-down list of available applications. - -- When prompted, click **Finish** to add the report. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -Right-click any report displayed under the **Reports** node to display a pop-up menu that contains the following elements. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes the report from the **Reports** node. - -**Rename** -Highlights the report name so that it becomes editable text. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -[Server Management Console: Reports Node](server-management-console-reports-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/reports-results-pane-columns.md b/mdop/appv-v4/reports-results-pane-columns.md deleted file mode 100644 index a7abb0ae55..0000000000 --- a/mdop/appv-v4/reports-results-pane-columns.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Reports Results Pane Columns -description: Reports Results Pane Columns -author: dansimp -ms.assetid: 907360ca-6a55-4e42-88d2-db1a24cd2a28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Reports Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays three columns for reports. If there are additional columns available, you can add and remove them. - -You can use the standard Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -The following table displays the column name and its contents. - - ---- - - - - - - - - - - - - - - - - - - - - -
    ColumnContents

    Report Name

    This column displays the report name.

    Report Type

    This column displays the report type.

    Period Type

    This column displays the frequency with which Application Virtualization generates the report.

    - -  - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -[Server Management Console: Reports Node](server-management-console-reports-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/reports-results-pane.md b/mdop/appv-v4/reports-results-pane.md deleted file mode 100644 index 77e23a88cc..0000000000 --- a/mdop/appv-v4/reports-results-pane.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Reports Results Pane -description: Reports Results Pane -author: dansimp -ms.assetid: 66beac62-fa55-4ab9-ac19-b9e1772e2d20 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Reports Results Pane - - -The **Reports Results** pane in the Application Virtualization Server Management Console displays a list of the available reports. - -To display specific options for reports, right-click any report to view the following elements. - -**Run Report** -Runs the selected report regardless of the specified value in the **Report Period** field. - -**New Window From Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes the selected report from the **Results** pane. - -**Rename** -Changes the name of the selected report. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -Right-click anywhere in the **Results** pane to display a pop-up menu that contains the following elements. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -These menu items can be used to change how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[Application Virtualization Report Types](application-virtualization-report-types.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -[Server Management Console: Reports Node](server-management-console-reports-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 2a2fbe0e8d..0000000000 --- a/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Restart Task Failure Dialog Box (App-V 4.6 SP1) -description: Restart Task Failure Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 1933fe71-8aa0-4e43-b6f7-060050001edd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restart Task Failure Dialog Box (App-V 4.6 SP1) - - -A restart task associated with the application that you are trying sequence failed. - -Complete the installation and then manually restart the computer running Microsoft Application Virtualization (App-V) Sequencer. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md b/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md deleted file mode 100644 index 2a93fe0947..0000000000 --- a/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Run Each Program Page -description: Run Each Program Page -author: dansimp -ms.assetid: 4f09a64e-9545-47aa-bc43-fda0089f7adb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Run Each Program Page - - -Use the **Run Each Program** page to run each program to complete any configuration tasks after installation. For example, this step helps configure any associated application license agreements. Select the application in the **Application Pane** and select one of the following options. - -This page contains the following elements: - -**Run Selected** -Runs only the selected applications. - -**Run All** -Runs all applications contained in the package. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/security-and-protection-overview.md b/mdop/appv-v4/security-and-protection-overview.md deleted file mode 100644 index 99c0632836..0000000000 --- a/mdop/appv-v4/security-and-protection-overview.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Security and Protection Overview -description: Security and Protection Overview -author: dansimp -ms.assetid: a43e1c53-7936-4d48-a110-0be26c8e9d97 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Protection Overview - - -Microsoft Application Virtualization 4.5 provides the following enhanced security features to help you plan and implement a more secure deployment strategy: - -- Application Virtualization now supports Transport Layer Security (TLS) using X.509 V3 certificates. Provided that a server certificate has been provisioned to the planned Application Virtualization Management or Streaming Server, the installation will default to secure, using the RTSPS protocol over port 322. Using RTSPS ensures that communication between the Application Virtualization Servers and the Application Virtualization Clients is signed and encrypted. If no certificate is assigned to the server during the Application Virtualization Server installation, the communication will be set to RTSP over port 554. - - **Security Note:** - - To help provide a secure setup of the server, you must make sure that RTSP ports are disabled even if you have all packages configured to use RTSPS. - - If you add security certificates to the server after installing the server, the server might not detect the certificates. To help ensure security certificate detection, restart the server after adding the certificates. - -- The client must be configured to use the same protocol and port as the server, or it will not be able to communicate with the server. The client must also trust the issuer of the certificate and ships with several of the primary providers in its Trusted Root Store. You can use self-signed certificates, but you will need to update the clients. - -- When configuring IIS servers to use the HTTPS protocol for streaming, you will need to set up Secure Sockets Layer (SSL) on the IIS server and provision the certificate for the server. The clients will also need to be configured to trust the root certification authority that issued the server certificate. - -- Kerberos authentication has been added to Microsoft Application Virtualization as the default authentication mechanism. Earlier versions relied upon NTLM V2 for authentication. Using Kerberos Authentication strengthens the security of the communication between the client and the Application Virtualization server. When a connection has been initiated from the client, the Application Virtualization Server verifies the session ticket with the Key Distribution Center (KDC). - -- Because of the support for using server certificates and using the RTSPS or HTTPS protocols, you can now support clients outside of the corporate network. This can help eliminate the need for mobile users to set up a secure connection to the corporate network (VPN, RAS, and so on) prior to launching Application Virtualization provisioned applications. - -Other important security considerations to consider include the following: - -- Always keep servers fully updated and protected. - -- To add a certificate to enable more secure communications to the Application Virtualization Management Server, the following criteria must be met: - - - The user who will be adding the certificate must be an administrator on the server where the certificate store is located. - - - The server service must be started. - - - Port 139 on the Management Server must be open to the Web Service server’s IP. - -- Use access control lists (ACLs) to ensure that the application packages and all package files are protected and cannot be tampered. ACLs restrict access to the location or folder where you store the packages, allowing access only to certain accounts. - -- Make sure that the channel between the Application Virtualization Management Server and the database is secured—for example, by using IPsec. - -- If packages are stored on a SAN or NAS, ensure the connection between the central storage device and the Application Virtualization Servers is protected. - -- All communication channels to the client should be protected—including connections to the publishing server, the Application Virtualization Server, and the path to the OSD and ICO files—by using a protocol such as HTTPS or IPsec.  - -- Client permissions should be configured to help ensure that packages cannot be tampered with by users. It is especially important that you do not grant users permission to add or update packages on systems, such as Remote Desktop Session Host (RD Session Host) servers, that are shared with multiple users. - -- Kerberos authentication must be permitted across domain or forest environments for the Server Management Console to work correctly. - -- This release of the software does not support hosting a Kerberos-based RTSP server and a Microsoft NTLM-only-based IIS server on the same computer. To host an RTSP server and an IIS server on the same computer, remove the SPN from the IIS server and use NTLM authentication. - -## Related topics - - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-files-page.md b/mdop/appv-v4/select-files-page.md deleted file mode 100644 index f68466b525..0000000000 --- a/mdop/appv-v4/select-files-page.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Select Files Page -description: Select Files Page -author: dansimp -ms.assetid: 6d1524ca-6306-4a28-b65f-3ded9d487e75 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Files Page - - -Use the **Select Files** page to review the files that will be saved with the Package Accelerator. Some of these files are displayed because they were not located on the specified media or on the local computer. In some scenarios the displayed files should be saved with the Package Accelerator so that the virtual application package can be fully recreated when the Package Accelerator is applied. - -This page contains the following elements: - -**Select Files Pane** -Displays a list of the files that were discovered in the Package Accelerator. Carefully review the files, and clear any file that should be removed from the Package Accelerator. Select only files that are required by the application to run successfully. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-guidance-page--package-accelerators-.md b/mdop/appv-v4/select-guidance-page--package-accelerators-.md deleted file mode 100644 index 387de4bfaf..0000000000 --- a/mdop/appv-v4/select-guidance-page--package-accelerators-.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Select Guidance Page (Package Accelerators) -description: Select Guidance Page (Package Accelerators) -author: dansimp -ms.assetid: 608b8823-6eac-40c0-a6dc-2f0bfc0d42a1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Guidance Page (Package Accelerators) - - -Use the **Select Guidance** page to specify a file that contains prescriptive guidance about how to use the Package Accelerator to create a new virtual application package. The file you select must be in rich text (.rtf) (recommended) or text (.txt) format. You should provide detailed information about all the necessary instructions for the Package Accelerator to create a virtual application package. For example, if you are performing a media installation, you can include information about how to extract files from any self-extracting executable programs. You should also provide information about all the dependent packages or any applications that must be installed for the package to run on target computers. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the file that contains information about how to apply the Package Accelerator. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md b/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md deleted file mode 100644 index 08bd4bf267..0000000000 --- a/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Select Installation Files Page -description: Select Installation Files Page -author: dansimp -ms.assetid: 4c8cd49e-ba39-4918-9863-5b3c315d14a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Installation Files Page - - -Use the **Select Installation Files** page to select installation files that the selected Package Accelerator requires. The installation files you specify should be located on the computer running the App-V Sequencer. The required installation files are also displayed on this page. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the directory that contains required installation files for the selected Package Accelerator to create the virtual application package. The directory should be located on the computer running the Sequencer. You can specify installation files of the following types of media and format: - -- Compressed files - -- Windows Installer files - -- .cab files - -- Local files and directories - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-installer-page--learn-more-.md b/mdop/appv-v4/select-installer-page--learn-more-.md deleted file mode 100644 index 6a57a0227a..0000000000 --- a/mdop/appv-v4/select-installer-page--learn-more-.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Select Installer Page (Learn More) -description: Select Installer Page (Learn More) -author: dansimp -ms.assetid: da05e756-d23e-4557-8ff6-313d695a78a1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Installer Page (Learn More) - - -Use the **Select Installer** page to specify the installation (**.msi**, **.exe**) files or programs for the application that you are sequencing. The files specified on this page must be the actual files that will be used to install the application you are sequencing. - -This page contains the following elements: - -**Select the installer for the application.** -Specifies the installation file or files that the sequencer runs and records while creating the virtual application package. You must specify a valid Windows Installer or an executable (**.exe**) program. - -**Select this option to perform a custom installation.** -If the application you are installing does not have an associated Windows Installer or executable program, select this option to manually install the application by using a custom set of installation files. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-package--learn-more--page.md b/mdop/appv-v4/select-package--learn-more--page.md deleted file mode 100644 index 24f631fd1d..0000000000 --- a/mdop/appv-v4/select-package--learn-more--page.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Select Package (Learn More) Page -description: Select Package (Learn More) Page -author: dansimp -ms.assetid: 0b3d4ca4-ff65-4aa5-87a9-61cbe2ffc8be -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Package (Learn More) Page - - -Use the **Select Package** page to select the source virtual application package you want to use to create the Package Accelerator. Copy the package you specify on this page to the computer running the sequencer. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the existing virtual application package that you will use to create the Package Accelerator. Save the package you specify locally on the computer running the sequencer. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-package-accelerator--learn-more--page.md b/mdop/appv-v4/select-package-accelerator--learn-more--page.md deleted file mode 100644 index 18ce0df5a2..0000000000 --- a/mdop/appv-v4/select-package-accelerator--learn-more--page.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Select Package Accelerator (Learn More) Page -description: Select Package Accelerator (Learn More) Page -author: dansimp -ms.assetid: 2db51514-8695-4b5e-b3e5-1e96e3ee4cc7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Package Accelerator (Learn More) Page - - -Only run Package Accelerators from publishers that you trust. Package Accelerators usually include a digital signature. A digital signature is an electronic security mark that can help indicate the publisher of the software, and that the package has not been tampered with after the transform was originally signed. If you use a transform that has been digitally signed by a publisher and the publisher has verified its identity with a certification authority, you can be more confident that the transform comes from that specific publisher and has not been altered. - -The sequencer notifies you if any of the following conditions are true: - -- The selected transform has not been digitally signed. - -- The selected transform is signed by a publisher that has not verified its identity with a certification authority. - -- The selected transform has been altered after it was digitally signed and released. - -If any of these messages are displayed when using a Package Accelerator, visit the Package Accelerators publisher’s website to get a digitally signed version of the transform. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-package-accelerator-page.md b/mdop/appv-v4/select-package-accelerator-page.md deleted file mode 100644 index b1b04254d7..0000000000 --- a/mdop/appv-v4/select-package-accelerator-page.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Select Package Accelerator Page -description: Select Package Accelerator Page -author: dansimp -ms.assetid: 865c2702-4dfd-41ae-8cfc-3514d5f41f76 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Package Accelerator Page - - -Use the **Select Package Accelerator** page to select the Package Accelerator that will be used to create the new virtual application package. You must copy the Package Accelerator to a folder on the computer running the App-V Sequencer. For more information, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md). - -Only run Package Accelerators from publishers that you trust. Package Accelerators usually include a digital signature. A digital signature is an electronic security mark that can help indicate the publisher of the software, and whether the package has been tampered with after the transform was originally signed. If you use a transform that has been digitally signed by a publisher and the publisher has verified its identity with a certification authority, you can be more confident that the transform comes from that specific publisher and has not been altered. - -The App-V Sequencer notifies you if any of the following conditions are true: - -- The selected transform has not been digitally signed. - -- The selected transform is signed by a publisher that has not verified its identity with a certification authority. - -- The selected transform has been altered after it was digitally signed and released. - -If any of these messages are displayed when using a Package Accelerators, visit the Package Accelerators publisher’s website to get a digitally signed version of the transform. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the Package Accelerator that you will use to create the virtual application package. Save the Package Accelerator you specified locally on the computer that is running the Sequencer. - -## Related topics - - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-primary-page--learn-more-.md b/mdop/appv-v4/select-primary-page--learn-more-.md deleted file mode 100644 index cf6a9e41a9..0000000000 --- a/mdop/appv-v4/select-primary-page--learn-more-.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Select Primary Page (Learn More) -description: Select Primary Page (Learn More) -author: dansimp -ms.assetid: 17c779da-f683-4967-b136-94fe65373c1b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Primary Page (Learn More) - - -Use the **Select Primary** page to specify the installation file of the program that the add-on or plug-in will be associated with. If the parent application is not already installed on the computer running the App-V Sequencer, you must stop this procedure and install it now. - -For example, if you are installing a plug-in that is designed to operate with Microsoft Excel, you must specify **Excel.exe**. - -You can also use an existing virtual application package as the parent application. To use an existing virtual application package, use the following procedure before sequencing the new add-on or plug-in. - -1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To expand an existing package to the computer running the Sequencer, click **Tools** / **Expand Package to Local System**. - -3. Browse to, and select the package (**.sprj** file) that you want to expand, and then click **Open**. - -This page contains the following elements: - -**Browse** -Click **Browse** to specify the program that the add-in or plug-in you are sequencing will be associated with. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/select-task-page--learn-more-.md b/mdop/appv-v4/select-task-page--learn-more-.md deleted file mode 100644 index 60b28a83fa..0000000000 --- a/mdop/appv-v4/select-task-page--learn-more-.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Select Task Page (Learn More) -description: Select Task Page (Learn More) -author: dansimp -ms.assetid: 09534c40-bf6c-4b3f-be9a-8624965c9c18 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Select Task Page (Learn More) - - -Use the **Select Task** page to modify an existing virtual application package. For more information about modifying an existing virtual application package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md). - -This page contains the following elements: - -**Update Application in Existing Package** -Select this option to apply an update to an application or program that is part of an existing virtual application package. If you select this option, you should have the associated installation files saved locally to the computer running the App-V Sequencer. You must also have access to the location where the package that contains the application or program that you want to modify is saved. - -**Edit Package** -Select this option to modify the properties associated with an existing virtual application package. To edit a package, you must have access to the location where the virtual application package is saved. The following list displays the package properties that can be updated if you select **Edit Package**: - -- View package properties. - -- View package change history. - -- View associated package files. - -- Edit registry settings. - -- Review additional package settings (except operating system file properties). - -- Create associated Windows Installer. - -- Modify OSD file. - -- Compress and uncompress package. - -- Add file type associations. - -- Rename shortcuts. - -- Set virtualized registry key state (override / merge). - -- Set virtualized folder state. - -- Edit virtual file system mappings. - -**Add New Application** -Select this option to add a new application or program to an existing virtual application package. For example, you can add Microsoft Excel to an existing Microsoft Office virtual application package. To add a new application, you must have access to the location where the virtual application package is saved. You can also edit file type associations associated with an existing package. - -## Related topics - - -[Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencer-command-line-error-codes.md b/mdop/appv-v4/sequencer-command-line-error-codes.md deleted file mode 100644 index 73d55eebce..0000000000 --- a/mdop/appv-v4/sequencer-command-line-error-codes.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Sequencer Command-Line Error Codes -description: Sequencer Command-Line Error Codes -author: dansimp -ms.assetid: 3d491314-4923-45fd-9839-c541c5e620bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Command-Line Error Codes - - -Use the following list to help identify errors that are related to sequencing applications by using the command line. You can also see this information by viewing the associated App-V Sequencer log file. - -**Note**   -Multiple errors can occur during sequencing, and if this happens, the error code that is displayed might be the sum of two error codes. For example, if the */InstallPath* and */OutputFile* parameters are missing, the App-V Sequencer will return **96**—the sum of the two error codes. - - - -01 -There is an unspecified error. - -02 -The specified installation directory (/INSTALLPACKAGE) is not valid. - -04 -The specified package root directory (/INSTALLPATH) is not valid. - -08 -The specified */OutputFile* parameter is not valid. - -16 -The installation directory (/INSTALLPACKAGE) is not specified. - -32 -The package root directory (/INSTALLPATH) is not specified. - -64 -The */OutputFile* parameter is not specified. - -128 -The specified application virtualization drive is not valid. - -256 -The installer failed. - -512 -Sequencing the application failed. - -1024 -Evaluating installed shortcuts failed. - -2048 -The sequenced application package cannot be saved. - -4096 -The specified package name (/PACKAGENAME) is not valid. - -8192 -The specified block size (/BLOCKSIZE) is not valid. - -16384 -The specified compression type (/COMPRESSION) is not valid. - -32768 -The specified project path is not valid. - -65536 -The specified upgrade parameter is not valid. - -131072 -The specified upgrade project parameter is not valid. - -262144 -The specified decode path parameter is not valid. - -525288 -The package name is not specified. - -## Related topics - - -[Application Virtualization Sequencer Reference](application-virtualization-sequencer-reference.md) - -[Sequencer Command-Line Parameters](sequencer-command-line-parameters.md) - - - - - - - - - diff --git a/mdop/appv-v4/sequencer-command-line-parameters.md b/mdop/appv-v4/sequencer-command-line-parameters.md deleted file mode 100644 index 11ecdb06c4..0000000000 --- a/mdop/appv-v4/sequencer-command-line-parameters.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Sequencer Command-Line Parameters -description: Sequencer Command-Line Parameters -author: dansimp -ms.assetid: 28fb875a-c302-4d95-b2e0-8dc0c5dbb0f8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Command-Line Parameters - - -You can use the following Application Virtualization (App-V) Sequencer parameters to sequence an application and to upgrade an existing virtual application by using a command line. For more information about sequencing an application by using a command line, see [How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md). - -## Sequencer Command-Line Parameters - - -**/HELP or /?** -Displays information about parameters that are available for using a command line to sequence applications. - -**/INSTALLPACKAGE or /I** -Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced. - -**/INSTALLPATH or /P** -Specifies the package root directory for an application. - -**/OUTPUTFILE or /O** -Specifies the path and file name of the SPRJ file that will be generated. - -**/FULLLOAD or /F** -Specifies whether all files will be contained in the primary feature block. If the **/FULLLOAD** parameter is specified on the command line, all of the associated application data is added to primary feature block. If the **/FULLLOAD** parameter is not specified on the command line, then none of the associated application data is added to the primary feature block. - -**/PACKAGENAME or /K** -Specifies the package name that will be assigned to the sequenced application. - -**/BLOCKSIZE** -Specifies the SFT file block size that will be used to stream the package to client computers. You can select one of the following values: - -- 4 KB - -- 16 KB - -- 32 KB - -- 64 KB - -You should consider the size of the SFT file when you specify the block size. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes use more network bandwidth. - -**/COMPRESSION** -Specifies the method for compressing the SFT file that will be streamed to the client. - -**/MSI or /M** -Specifies whether a Windows Installer for the sequenced application should be created. - -**/DEFAULT** -Specifies the default SPRJ file that will be used when creating a virtual application package. This file is used as the .sprj template when the application is sequenced for the first time. - -**/UPGRADE** -Specifies the path and file name of the SPRJ file that will be upgraded. - -**/DECODEPATH** -Specifies the directory on the sequencing computer where the files associated with the sequenced application package are installed. Use one of the following formats when specifying the directory: - -- /decodepath:Q: - -- /decodepath:Q:. - -- /decodepath:”Q:.” - -- /decodepath:”Q:” - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -[Sequencer Command-Line Error Codes](sequencer-command-line-error-codes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencer-console.md b/mdop/appv-v4/sequencer-console.md deleted file mode 100644 index 661a880497..0000000000 --- a/mdop/appv-v4/sequencer-console.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Sequencer Console -description: Sequencer Console -author: dansimp -ms.assetid: 69e0202d-be2c-41cc-99cb-2a08a034e804 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Console - - -The Application Virtualization Sequencer Console enables you to perform a variety of tasks, including sequencing an application, modifying a sequenced application package, configuring the Application Virtualization Sequencer, and more. - -## In This Section - - -[Properties Tab](properties-tab-keep.md) -Provides general information about the **Properties** tab, along with related procedures you can perform. - -[Deployment Tab](deployment-tab.md) -Provides general information about the **Deployment** tab, along with related procedures you can perform. - -[Change History Tab](change-history-tab-keep.md) -Provides general information about the **Change History** tab. - -[Files Tab](files-tab-keep.md) -Provides general information about the **Files** tab, along with related procedures you can perform. - -[Virtual Registry Tab](virtual-registry-tab-keep.md) -Provides general information about the **Virtual Registry** tab, along with related procedures you can perform. - -[Virtual File System Tab](virtual-file-system-tab-keep.md) -Provides general information about the **Virtual File System** tab, along with related procedures you can perform. - -[Virtual Services Tab](virtual-services-tab-keep.md) -Provides general information about the **Virtual Services** tab, along with related procedures you can perform. - -[OSD Tab](osd-tab-keep.md) -Provides general information about the **OSD** tab, along with related procedures you can perform. - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencer-dialog-boxes.md b/mdop/appv-v4/sequencer-dialog-boxes.md deleted file mode 100644 index deba694e0e..0000000000 --- a/mdop/appv-v4/sequencer-dialog-boxes.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Sequencer Dialog Boxes -description: Sequencer Dialog Boxes -author: dansimp -ms.assetid: f660d56b-0244-4167-b077-96ad482e6b36 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Dialog Boxes - - -## In This Section - - -- [Application Virtualization Sequencer Options Dialog Box](application-virtualization-sequencer-options-dialog-box.md) - -- [Application Virtualization Sequencing Wizard-Add Application Dialog Box](application-virtualization-sequencing-wizard-add-application-dialog-box.md) - -- [Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box](application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md) - -- [Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box](application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md) - -## Related topics - - -[Sequencing Wizard](sequencing-wizard.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/sequencer-hardware-and-software-requirements.md deleted file mode 100644 index 40fe62a7a2..0000000000 --- a/mdop/appv-v4/sequencer-hardware-and-software-requirements.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Sequencer Hardware and Software Requirements -description: Sequencer Hardware and Software Requirements -author: dansimp -ms.assetid: 36084e12-831d-452f-a4a4-45f07f9ce471 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Hardware and Software Requirements - - -This topic describes the minimum recommended hardware and software requirements for the computer running the Microsoft Application Virtualization (App-V) Sequencer. - -Before you install the Sequencer and after you sequence each application, you must restore a clean operating system image to the sequencing computer. You can use one of the following methods to restore the computer running the Sequencer: - -- Reformat the hard drive and reinstall the operating system. - -- Restore the hard drive on the computer running the Sequencer image by using another disk-imaging software. - -The following list outlines the recommended hardware requirements for running the App-V Sequencer. - -### Hardware Requirements - -- Processor—Intel Pentium III, 1 GHz (32-bit or 64-bit). The sequencing process is a single-threaded process and does not take advantage of dual processors. - -- Memory—1 GB or above, 2 GB recommended. - -- Hard Disk—40 gigabyte (GB) hard disk space with a minimum of 15 GB available hard disk space. We recommend that you have at least three times the hard disk space that the application you are sequencing requires. - - **Note**   - Sequencing requires heavy disk usage. A fast disk speed can decrease the sequencing time. - - - -### Software Requirements - -The following list outlines the supported operating systems for running the Sequencer. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows XP

    Professional

    SP2 or SP3

    x86

    Windows Vista

    Business, Enterprise, or Ultimate

    No service pack, SP1, or SP2

    x86

    Windows 7¹

    Professional, Enterprise, or Ultimate

    x86

    - - - -¹Supported for App-V 4.5 with SP1 or SP2, and App-V 4.6 only - -**Note**   -The Application Virtualization (App-V) 4.6 Sequencer supports 32-bit and 64-bit versions of these operating systems. - - - -You should configure computers running the Sequencer with the same applications that are installed on target computers. - -### Software Requirements for Remote Desktop Services - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2003

    Standard Edition, Enterprise Edition, or Datacenter Edition

    SP1 or SP2

    x86

    Windows Server 2003 R2

    Standard Edition, Enterprise Edition, or Datacenter Edition

    x86

    Windows Server 2008

    Standard, Enterprise, or Datacenter

    SP1 or SP2

    x86

    - - - -**Note**   -Application Virtualization (App-V) 4.6 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems. - - - -## Related topics - - -[Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md) - - - - - - - - - diff --git a/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md b/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md deleted file mode 100644 index 6da8f78d45..0000000000 --- a/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Sequencer Wizard - Package Accelerator (AppV 4.6 SP1) -description: Sequencer Wizard - Package Accelerator (AppV 4.6 SP1) -author: dansimp -ms.assetid: 1f75f5ba-0707-48fb-b0b8-ba94a5159e36 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencer Wizard - Package Accelerator (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V Package Accelerator wizard. - -## In This Section - - -[Select Package Accelerator Page](select-package-accelerator-page.md) - -[Select Package Accelerator (Learn More) Page](select-package-accelerator--learn-more--page.md) - -[Guidance Page](guidance-page-app-v-46-sp1.md) - -[Select Installation Files Page](select-installation-files-page-app-v-46-sp1.md) - -[Package Name Page](package-name-page--app-v-46-sp1.md) - -[Create Package Page](create-package-page--app-v-46-sp1.md) - -[Configure Software Page](configure-software-page-app-v-46-sp1.md) - -[Run Each Program Page](run-each-program-page-app-v-46-sp1.md) - -[Completion Page](completion-page-package-accelerator.md) - -## Related topics - - -[Wizard Pages (AppV 4.6 SP1)](wizard-pages--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sequencing-wizard.md b/mdop/appv-v4/sequencing-wizard.md deleted file mode 100644 index 4db54af6bc..0000000000 --- a/mdop/appv-v4/sequencing-wizard.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Sequencing Wizard -description: Sequencing Wizard -author: dansimp -ms.assetid: 81e2f4fa-b06e-4cbe-aeb8-6ceb8f0543a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sequencing Wizard - - -Use the Sequencing Wizard to create applications that can run in a virtual environment. The topics in this section provide detailed information about each wizard page in the Sequencing Wizard. - -## In This Section - - -- [Application Virtualization Sequencing Wizard Package Information Page](application-virtualization-sequencing-wizard-package-information-page-keep.md) - -- [Application Virtualization Sequencing Wizard Advanced Options Page](application-virtualization-sequencing-wizard-advanced-options-page.md) - -- [Application Virtualization Sequencing Wizard Monitor Installation Page](application-virtualization-sequencing-wizard-monitor-installation-page.md) - -- [Application Virtualization Sequencing Wizard Add Files to Virtual File System Page](application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md) - -- [Application Virtualization Sequencing Wizard Configure Application Page](application-virtualization-sequencing-wizard-configure-application-page-keep.md) - -- [Application Virtualization Sequencing Wizard Launch Applications Page](application-virtualization-sequencing-wizard-launch-applications-page.md) - -- [Application Virtualization Sequencing Wizard Sequence Package Page](application-virtualization-sequencing-wizard-sequence-package-page.md) - -## Related topics - - -[Sequencer Dialog Boxes](sequencer-dialog-boxes.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-groups-node.md b/mdop/appv-v4/server-groups-node.md deleted file mode 100644 index 95137d7733..0000000000 --- a/mdop/appv-v4/server-groups-node.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Server Groups Node -description: Server Groups Node -author: dansimp -ms.assetid: 6b2ed086-9100-47d0-be7f-0c5fb4fa55c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Groups Node - - -The **Server Groups** node is one level below the Application Virtualization System node in the **Scope** pane in the Application Virtualization Server Management Console. When you select this node, the **Results** pane displays a list of server groups. Right-click the node to display a pop-up menu that contains the following elements. - -**New Server Group** -Displays the New Server Group Wizard. This wizard consists of a single page, where you can specify a name for the server group in the **Server Group Name** field and then select the default provider policy from the drop-down menu of available provider policies. Select the **Enable** check box to enable the server group. Click **Finish** to add the new server group. - -**View** -Changes the appearance and content of the **Results** pane. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -If you click any server group that appears under the **Server Groups** node in the **Scope** pane, the following elements are available. - -**New Virtual Application Server** -Displays the New Virtual Application Server Wizard. Use this wizard to add a new Application Virtualization Management Server. This wizard has one page, in which you specify the server name in the **Display Name** field and enter a name in the **DNS Host Name** field. From this wizard, you can also specify a value for the server cache in the **Maximum Memory Allocation (MB)** field and a value for the threshold warning level in the **Warn Memory Allocation (MB)** field. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a package from the **Results** pane. - -**Rename** -Changes the name of a package in the **Results** pane. - -**Refresh** -Refreshes the view of the server. - -**Properties** -Displays the **Properties** dialog box for the selected server group. The **Properties** dialog box has the following tabs: - -- **General**—Enables you to select the provider policy from the drop-down list of Provider Policies. You can also enable or disable the server by selecting or clearing the **Enable** check box. - -- **Logging**—Enables you to add, edit, and remove logging modules. When you add or edit a logging module, you can also set or change the logging level. - -- **Applications**—Lists the applications that are associated with the selected server group. The displayed information includes the application name, version number, and enable status. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - -[Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-groups-results-pane-columns.md b/mdop/appv-v4/server-groups-results-pane-columns.md deleted file mode 100644 index 9a40ac8e31..0000000000 --- a/mdop/appv-v4/server-groups-results-pane-columns.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Server Groups Results Pane Columns -description: Server Groups Results Pane Columns -author: dansimp -ms.assetid: e91b1b9b-e58c-4274-ad18-8b157936b9be -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Groups Results Pane Columns - - -The **Results** pane in the Application Virtualization Server Management Console displays a variety of columns. If there are additional columns available, you can add and remove them. - -You can use the standard Microsoft Windows **Add/Remove Columns** dialog box to select which columns are displayed in the **Results** pane. - -To see the **Add/Remove Columns** dialog box, right-click in the **Results** pane and select **View > Add/Remove Columns** from the pop-up menu. - -When the **Results** pane displays server groups, the column name and contents that appear are described in the following table. - - ---- - - - - - - - - - - - - -
    ColumnContents

    Name

    Displays the name of the server group.

    - -  - -When the **Results** pane displays virtual application servers, the column name and contents that appear are described in the following table. - - ---- - - - - - - - - - - - - - - - - -
    ColumnContents

    Name

    Displays the name of the virtual application server.

    Host Name

    Displays the DNS host name for the virtual application server.

    - -  - -## Related topics - - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - -[Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-groups-results-pane.md b/mdop/appv-v4/server-groups-results-pane.md deleted file mode 100644 index e8558e68c8..0000000000 --- a/mdop/appv-v4/server-groups-results-pane.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Server Groups Results Pane -description: Server Groups Results Pane -author: dansimp -ms.assetid: ac7b0525-5946-4728-9cf1-c65007852ebe -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Groups Results Pane - - -The **Server Groups Results** pane in the Application Virtualization Server Management Console displays a list of the available server groups and Application Virtualization Management Servers. - -When you right-click any server group, the following elements are displayed. - -**New Application Virtualization Management Server** -Displays the New Server Wizard. Use this wizard to add a new Application Virtualization Management Server. This wizard has one page, in which you specify a name for the server in the **Display Name** field, and enter a name in the **DNS Host Name** field. From this wizard, you can also specify a maximum memory allocation for the server cache and a memory threshold warning level. - -**New Window from Here** -Opens a new management console with the selected node as the root node. - -**Delete** -Deletes a server group. - -**Rename** -Changes the name of a server group. - -**Refresh** -Refreshes the **Results** pane. - -**Properties** -Displays the **Properties** dialog box for the selected server group. The **Properties** dialog box has the following tabs: - -- **General Tab**—Enables you to select the provider policy from the drop-down list of provider policies and to enable or disable the server by selecting or clearing the **Enable** check box. - -- **Logging Tab**—Displays the list of logging modules. You can add, edit, and remove logging modules from this tab. When you add or edit a logging module, you can also set or change the logging level. - -- **Applications Tab**—Lists the applications that are associated with the selected server group. The displayed information includes the application name, version number, and enable status. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -When the **Results** pane displays **Server Groups**, right-click anywhere in the **Results** pane, except on a server group, to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the view of the server. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -When the **Results** pane displays **Application Virtualization Management** **Servers**, right-click a server to display a pop-up menu that contains the following elements. - -**Duplicate** -Duplicates an Application Virtualization Management Server. - -**Delete** -Deletes an Application Virtualization Management Server. - -**Rename** -Changes the name of an Application Virtualization Management Server. - -**Properties** -Displays the **Properties** dialog box for the selected server. The **Properties** dialog box has the following tabs: - -- **General**—Enables you to select the provider policy from the **Provider Policies** drop-down list and to enable or disable the server by selecting or clearing the **Enable** check box. - -- **Logging**—Displays the **Logging Modules** list. You can add, edit, and remove logging modules from this tab. When you add or edit a logging module, you can also set or change the logging level. - -- **Applications**—Lists the applications that are associated with the selected server group. The displayed information includes the application name, version number, and enable status. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -When the **Results** pane displays **Application Virtualization Management** **Servers**, right-click anywhere, except on a server, to display a pop-up menu that contains the following elements. - -**Refresh** -Refreshes the **Results** pane. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**View** -Changes the appearance and content of the **Results** pane. - -**Arrange/Line Up Icons** -Changes how the icons are displayed in the **Results** pane. - -**Properties** -Displays the **Properties** dialog box for the most recently selected server. The **Properties** dialog box has the following tabs: - -- **General**—Enables you to select the provider policy from the **Provider Policies** drop-down list and to enable or disable the server by selecting or clearing the **Enable** check box. - -- **Logging**—Displays the **Logging Modules** list. You can add, edit, and remove logging modules from this tab. When you add or edit a logging module, you can also set or change the logging level. - -- **Applications**—Lists the applications that are associated with the selected server group. The displayed information includes the application name, version number, and enable status. - -**Help** -Displays the help system for the Application Virtualization Server Management Console. - -## Related topics - - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - -[Server Management Console: Server Groups Node](server-management-console-server-groups-node.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-about-dialog-boxes.md b/mdop/appv-v4/server-management-console-about-dialog-boxes.md deleted file mode 100644 index c40139a8da..0000000000 --- a/mdop/appv-v4/server-management-console-about-dialog-boxes.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Server Management Console About Dialog Boxes -description: Server Management Console About Dialog Boxes -author: dansimp -ms.assetid: b5fdee0b-4269-4a48-98a0-ed3f06cff041 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: About Dialog Boxes - - -The **About** dialog boxes display information about the specific version of the Microsoft Management Console or the specific version of the Application Virtualization Server Management Console. - -To display these dialog boxes, click **Help** and select **About Microsoft Management Console** or **About Application Virtualization Server Management Console**. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-administrators-node.md b/mdop/appv-v4/server-management-console-administrators-node.md deleted file mode 100644 index 0ed24e294f..0000000000 --- a/mdop/appv-v4/server-management-console-administrators-node.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Server Management Console Administrators Node -description: Server Management Console Administrators Node -author: dansimp -ms.assetid: ab421454-69d1-4c10-8f58-2a35ae89c8b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Administrators Node - - -The topics in this section provide information about the screen reference for the **Administrators** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Administrators Node](administrators-node.md) -Describes the features and commands available from the **Administrators** node. - -[Administrators Results Pane](administrators-results-pane.md) -Describes the features and commands available in the **Administrators** node **Results** pane. - -[Administrators Results Pane Columns](administrators-results-pane-columns.md) -Describes the columns available in the **Administrators** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-application-licenses-node.md b/mdop/appv-v4/server-management-console-application-licenses-node.md deleted file mode 100644 index 9d37dd63fa..0000000000 --- a/mdop/appv-v4/server-management-console-application-licenses-node.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Server Management Console Application Licenses Node -description: Server Management Console Application Licenses Node -author: dansimp -ms.assetid: ad3fa486-2b3c-4efd-91f5-507e9c5057d5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Application Licenses Node - - -The topics in this section provide information about the screen reference for the **Application Licenses** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Applications Licenses Node](applications-licenses-node.md) -Describes the features and commands available from the **Application Licenses** node. - -[Applications Licenses Results Pane](applications-licenses-results-pane.md) -Describes the features and commands available in the **Application Licenses** node **Results** pane. - -[Applications Licenses Results Pane Columns](applications-licenses-results-pane-columns.md) -Describes the columns available in the **Application Licenses** node **Results** pane. - -## Related topics - - -[About Application Licensing](about-application-licensing.md) - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[How to Manage Application Licenses in the Server Management Console](how-to-manage-application-licenses-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-application-virtualization-system-node.md b/mdop/appv-v4/server-management-console-application-virtualization-system-node.md deleted file mode 100644 index b52204a63d..0000000000 --- a/mdop/appv-v4/server-management-console-application-virtualization-system-node.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Server Management Console Application Virtualization System Node -description: Server Management Console Application Virtualization System Node -author: dansimp -ms.assetid: 9450832e-335c-41e7-af24-fddb8ffc327c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Application Virtualization System Node - - -The Application Virtualization System node is the top-level node in the **Scope** pane. This node displays the name of the server the console is currently controlling, or it displays the name of the local computer (if you are connected by the name) or "local" when the console is connected to the local computer. From the Application Virtualization System node, you can connect to another computer or you can connect to the current computer with a different set of credentials. - -You can right-click the Application Virtualization System node to display the following elements. - -**Configure Connection** -In this dialog box, you can modify the following settings: - -- **Web Service Host Name**—Enables you to enter the name of the Application Virtualization System to which you want to connect, or you can enter **localhost** to connect to the local computer. - -- **Use Secure Connection**—Select if you want to connect to the server with a secure connection. - -- **Port**—Enables you to enter the port number you want to use for the connection. 80 is the default regular port number, and 443 is default secure port number. - -- **Use Current Windows Account**—Select to use the current Windows account credentials. - -- **Specify Windows Account**—Select when you want to connect to the server as a different user. - -- **Name**—Enables you to enter the name of the new user by using either the *DOMAIN\\username* or the username@domain format. - -- **Password**—Enables you to enter the password that corresponds to the new user. - -**System Options** -On the following tabs on this dialog box, you can modify the associated settings: - -- **General Tab**—Enables you to specify the **Default Content Path** where the OSD and icon files are stored. - -- **Database Tab**—Enables you to specify the maximum **Database Size** and the **Usage History**. - -**View** -Changes the appearance of the Application Virtualization Server Management Console. For more information about changing the appearance of the console, refer to the help files for the Microsoft Management Console. - -**New Window from Here** -Opens a new management console window. - -**Export List** -Creates a tab-delimited text file that contains the contents of the **Results** pane. This item displays a standard **File Save** dialog box where you specify the location for the text file you are creating. - -**Help** -Starts the management console help file. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/server-management-console-applications-node.md b/mdop/appv-v4/server-management-console-applications-node.md deleted file mode 100644 index 4b72b9cea2..0000000000 --- a/mdop/appv-v4/server-management-console-applications-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Server Management Console Applications Node -description: Server Management Console Applications Node -author: dansimp -ms.assetid: e465f816-032d-4824-9924-f2dcf30f2a2c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Applications Node - - -The topics in this section provide information about the screen reference for the **Applications** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Applications Node in Server Management Console](applications-node-in-server-management-console.md) -Describes the features and commands available from the **Applications** node. - -[Applications Results Pane in Server Management Console](applications-results-pane-in-server-management-console.md) -Describes the features and commands available in the **Applications** node **Results** pane. - -[Applications Results Pane Columns in Server Management Console](applications-results-pane-columns-in-server-management-console.md) -Describes the columns available in the **Applications** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-file-type-associations-node.md b/mdop/appv-v4/server-management-console-file-type-associations-node.md deleted file mode 100644 index 30911041dd..0000000000 --- a/mdop/appv-v4/server-management-console-file-type-associations-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Server Management Console File Type Associations Node -description: Server Management Console File Type Associations Node -author: dansimp -ms.assetid: c22168be-6601-4154-b36b-9ca0fa87e5e0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: File Type Associations Node - - -The topics in this section provide information about the screen reference for the **File Type Associations** node in the Application Virtualization Server Management Console. - -## In This Section - - -[File Type Associations Node](file-type-associations-node.md) -Describes the features and commands available from the **File Type Associations** node. - -[File Type Associations Results Pane](file-type-associations-results-pane.md) -Describes the features and commands available in the **File Type Associations** node **Results** pane. - -[File Type Associations Results Pane Columns](file-type-associations-results-pane-columns.md) -Describes the columns available in the **File Type Associations** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-packages-node.md b/mdop/appv-v4/server-management-console-packages-node.md deleted file mode 100644 index dc6de0a83f..0000000000 --- a/mdop/appv-v4/server-management-console-packages-node.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Server Management Console Packages Node -description: Server Management Console Packages Node -author: dansimp -ms.assetid: 458424f6-d586-4fa8-bf61-44c5028a4490 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Packages Node - - -The topics in this section provide information about the screen reference for the **Packages** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Packages Node](packages-node.md) -Describes the features and commands available from the **Packages** node. - -[Package Results Pane](package-results-pane.md) -Describes the features and commands available in the **Packages** node **Results** pane. - -[Package Results Pane Columns](package-results-pane-columns.md) -Describes the columns available in the **Packages** node **Results** pane. - -## Related topics - - -[About Application Virtualization Packages](about-application-virtualization-packages.md) - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-provider-policies-node.md b/mdop/appv-v4/server-management-console-provider-policies-node.md deleted file mode 100644 index e48e539846..0000000000 --- a/mdop/appv-v4/server-management-console-provider-policies-node.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Server Management Console Provider Policies Node -description: Server Management Console Provider Policies Node -author: dansimp -ms.assetid: a5b99158-9af8-45bb-b3b8-61e220529e14 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Provider Policies Node - - -The topics in this section provide information about the screen reference for the **Provider Policies** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Provider Policies Node](provider-policies-node.md) -Describes the features and commands available from the **Provider Policies** node. - -[Provider Policies Results Pane](provider-policies-results-pane.md) -Describes the features and commands available in the **Provider Policies** node **Results** pane. - -[Provider Policies Results Pane Columns](provider-policies-results-pane-columns.md) -Describes the columns available in the **Provider Policies** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-reports-node.md b/mdop/appv-v4/server-management-console-reports-node.md deleted file mode 100644 index 5cda771115..0000000000 --- a/mdop/appv-v4/server-management-console-reports-node.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Server Management Console Reports Node -description: Server Management Console Reports Node -author: dansimp -ms.assetid: 9dde6332-5882-40dd-8a8f-857216df80ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Reports Node - - -The topics in this section provide information about the screen reference for the **Reports** node in the Application Virtualization Server Management Console. - -## In This Section - - -Reports Node -Describes the features and commands available from the **Reports** node. - -[Reports Results Pane](reports-results-pane.md) -Describes the features and commands available in the **Reports** node **Results** pane. - -[Reports Results Pane Columns](reports-results-pane-columns.md) -Describes the columns available in the **Reports** node **Results** pane. - -## Related topics - - -[Application Utilization Report](application-utilization-reportserver.md) - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[Software Audit Report](software-audit-reportserver.md) - -[System Error Report](system-error-reportserver.md) - -[System Utilization Report](system-utilization-reportserver.md) - -[How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/server-management-console-server-groups-node.md b/mdop/appv-v4/server-management-console-server-groups-node.md deleted file mode 100644 index 4b657466b4..0000000000 --- a/mdop/appv-v4/server-management-console-server-groups-node.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Server Management Console Server Groups Node -description: Server Management Console Server Groups Node -author: dansimp -ms.assetid: 83b86fc5-3f77-4470-985a-cf0bb8686067 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Management Console: Server Groups Node - - -The topics in this section provide information about the screen reference for the **Server Groups** node in the Application Virtualization Server Management Console. - -## In This Section - - -[Server Groups Node](server-groups-node.md) -Describes the features and commands available from the **Server Groups** node. - -[Server Groups Results Pane](server-groups-results-pane.md) -Describes the features and commands available in the **Server Groups** node **Results** pane. - -[Server Groups Results Pane Columns](server-groups-results-pane-columns.md) -Describes the columns available in the **Server Groups** node **Results** pane. - -## Related topics - - -[Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md) - -[How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sftmime--command-reference.md b/mdop/appv-v4/sftmime--command-reference.md deleted file mode 100644 index 732b47bafc..0000000000 --- a/mdop/appv-v4/sftmime--command-reference.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: SFTMIME Command Reference -description: SFTMIME Command Reference -author: dansimp -ms.assetid: a4a69228-9dd3-4623-b773-899d03c0cf10 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# SFTMIME Command Reference - - -SFTMIME is a command-line interface used by Application Virtualization (App-V) that enables you to manage many client configuration details. This section contains all the commands and their parameters, with a brief description of each. - -**Important**   -- All backslash characters must be escaped using a preceding backslash, or the path will not be parsed correctly. - -- If you are using a calling program to invoke SFTMIME with **CreateProcess**, you must ensure that the first parameter is the path to sftmime.exe. - -- The output of the SFTMIME **QUERY OBJ** command cannot be piped to the **findstr** command to search for a string. - -- Use of the **GLOBAL** switch requires local administrator rights. - -- Use of short paths and relative paths can lead to unexpected results and should be avoided. Always use full paths. - -  - -## In This Section - - -[ADD APP](add-app.md) - -[ADD PACKAGE](add-package.md) - -[ADD SERVER](add-server.md) - -[ADD TYPE](add-type.md) - -[CLEAR APP](clear-app.md) - -[CLEAR OBJ](clear-obj.md) - -[CONFIGURE APP](configure-app.md) - -[CONFIGURE PACKAGE](configure-package.md) - -[CONFIGURE SERVER](configure-server.md) - -[CONFIGURE TYPE](configure-type.md) - -[DELETE APP](delete-app.md) - -[DELETE OBJ](delete-obj.md) - -[DELETE PACKAGE](delete-package.md) - -[DELETE SERVER](delete-server.md) - -[DELETE TYPE](delete-type.md) - -[HELP](help.md) - -[LOAD APP](load-app.md) - -[LOAD PACKAGE](load-package.md) - -[LOCK APP](lock-app.md) - -[PUBLISH APP](publish-app.md) - -[PUBLISH PACKAGE](publish-package.md) - -[QUERY OBJ](query-obj.md) - -[REFRESH SERVER](refresh-server.md) - -[REPAIR APP](repair-app.md) - -[UNLOAD APP](unload-app.md) - -[UNLOAD PACKAGE](unload-package.md) - -[UNLOCK APP](unlock-app.md) - -[UNPUBLISH PACKAGE](unpublish-package.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/sfttray-command-reference.md b/mdop/appv-v4/sfttray-command-reference.md deleted file mode 100644 index 9e7dc93e91..0000000000 --- a/mdop/appv-v4/sfttray-command-reference.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: SFTTRAY Command Reference -description: SFTTRAY Command Reference -author: dansimp -ms.assetid: 6fa3a939-b047-4d6c-bd1d-dfb93e065eb2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# SFTTRAY Command Reference - - -The Microsoft Application Virtualization (App-V) Client Tray application, sfttray.exe, is the main user interface element of the App-V Client that users will interact with during normal use. This program controls the streaming and starting of all virtual applications and is accessed by right-clicking the icon displayed in the notification area to display the menu of client functions. The menu enables the user to load applications, start a publishing refresh, cancel a request, or change the client to offline mode. The user can also close the Application Virtualization Client Tray application and all active applications by clicking **Exit**. - -By default, the icon is displayed whenever a virtual application is started, although you can control this behavior by using SFTTRAY commands. The Application Virtualization Client Tray application also displays a progress bar for each application that is started, as well as status messages about active applications. Clicking the progress bar displays a message that allows you to cancel the loading or starting of an application. - -## SFTTRAY Commands - - -The list of commands and command-line switches can be displayed by running the following command from a command window. - -**Note** -There is only one Application Virtualization Client Tray instance for each user context, so if you start a new SFTTRAY command, it will be passed to the program that is already running. - - - -`Sfttray.exe /?` - -### Command Usage - -`Sfttray.exe [/HIDE | /SHOW]` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] [/EXE alternate-exe] /LAUNCH app [args]` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOAD app [/SFTFILE sft]` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOADALL` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /REFRESHALL` - -`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LAUNCHRESULT /LAUNCH app [args]` - -`Sfttray.exe /EXIT` - -### Command-Line Switches - -The SFTTRAY command-line switches are described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SwitchDescription

    /HIDE

    Hides the SFTTRAY icon in the Windows notification area.

    /SHOW

    Displays the SFTTRAY icon in the Windows notification area.

    /QUIET

    Supports unattended usage by preventing errors from displaying message boxes that require user acknowledgement.

    /EXE <alternate-exe>

    Used with /LAUNCH to specify that an executable program is to be started in the virtual environment when a virtual application is started in place of the target file specified in the OSD.

    -
    -Note

    For example, use “SFTTRAY.EXE /EXE REGEDIT.EXE /LAUNCH <app>” to enable you to examine the registry of the virtual environment in which the application is running.

    -
    -
    - -

    /LAUNCH <app> [<args>]

    Starts a virtual application. Specify the name and version of an application or the path to an OSD file. Optionally, command-line arguments can be passed to the virtual application.

    -
    -Note

    Use the command “SFTMIME.EXE /QUERY OBJ:APP /SHORT” to obtain a list of the names and versions of available virtual applications.

    -
    -
    - -

    /LOAD

    Loads or imports a virtual application.

    /LOADALL

    Loads all applications into cache.

    /REFRESHALL

    Starts a publishing refresh for all applications.

    /LAUNCHRESULT <UNIQUE ID>

    Returns the launch result code to the process that launches sfttray.exe by using a global event and a memory mapped file that are based on the specified root name for the UNIQUE ID.¹

    /SFTFILE <sft>

    Optional switch used with /LOAD to specify the path to the application’s SFT file. If specified, the application is imported rather than loaded.

    /EXIT

    Closes the SFTTRAY program and all active virtual applications and removes the icon from the Windows notification area.

    - - - -**Note** -¹ The */LAUNCHRESULT* command line parameter provides a means for the process that launches sfttray.exe to specify the root name for a global event and a memory mapped file that are used to return the launch result code to the process. The unique identifier name should start with “SFT-” to prevent the event name from getting virtualized when the launching process is invoked within a virtual environment. The memory mapped region will be 64 bits in size. - -To use this parameter, the launching process creates an event with the name “<UNIQUE ID>-result\_event”, a memory mapped file with the name “<UNIQUE ID>-result\_value”, and optionally an event with the name “<UNIQUE ID>-shutdown\_event”, and then the launching process launches sfttray.exe and waits on the event to be signaled. After the event “<UNIQUE ID>-result\_event” is signaled, the launching process retrieves the 64-bit return code from the memory mapped region. - -If the optional event “<UNIQUE ID>-shutdown\_event” exists when the virtual application exits, sfttray.exe opens and signals the event. The launching process waits on this shutdown event if it needs to determine when the virtual application exits. - - - - - - - - - - - diff --git a/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index ced6882390..0000000000 --- a/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1) -description: Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: bcdb9b82-b53d-4a36-9f5d-71c021d4be28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1) - - -The Side-by-side assembly privatization failed. You can find more information about the side-by-side assemblies in the Sequencer log file which is located in the following directory: - -<App-V Sequencer installation drive> \\**Program Files** \\ **Microsoft Application Virtualization Sequencer** \\ **Logs** - -Install public versions of the required assemblies on the computer running the App-V Sequencer before you sequence the application. The same assemblies must also be installed on all computers running the App-V client before you deploy the package. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/software-audit-reportserver.md b/mdop/appv-v4/software-audit-reportserver.md deleted file mode 100644 index 9efbb49955..0000000000 --- a/mdop/appv-v4/software-audit-reportserver.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Software Audit Report -description: Software Audit Report -author: dansimp -ms.assetid: 55a49ed2-f331-40d3-add6-8e5fcd6816fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Software Audit Report - - -Use the Software Audit Report to list the usage information during the reporting period for all applications defined in the database. You can use this report to determine which applications are the most heavily used. - -For each application, the Software Audit Report lists the following information: - -- Number of sessions—Number of times an application was used - -The Software Audit Report also includes a summary of the total usage per application. - -When you create a report, you specify the parameters that are used for collecting the data when the report is run. - -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run this report is determined by the amount of data collected in the data store. - -After you run a report and the output is displayed in the Application Virtualization Server Management Console, you can export the report into the following formats: - -- Adobe Acrobat (PDF) - -- Microsoft Office Excel - -## Related topics - - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md b/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md deleted file mode 100644 index 224b3b7a04..0000000000 --- a/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Stand-Alone Delivery Scenario for Application Virtualization Clients -description: Stand-Alone Delivery Scenario for Application Virtualization Clients -author: dansimp -ms.assetid: 7545b468-f58a-4504-a6d5-3c2d303731c4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Stand-Alone Delivery Scenario for Application Virtualization Clients - - -The Stand-Alone Delivery Scenario enables you to realize the benefits of Microsoft Application Virtualization in situations where no servers are available to support other methods of deploying your virtual applications. - -**Note**   -It is assumed that you have already installed the Application Virtualization Sequencer in preparation for the stand-alone scenario. For more information, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md). - - - -## In This Section - - -[Stand-Alone Delivery Scenario Overview](stand-alone-delivery-scenario-overview.md) -Provides a general overview of the benefits of a stand-alone Application Virtualization deployment scenario. - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) -Provides a step-by-step procedure for installing the Application Virtualization Client software. - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) -Provides command-line procedures for publishing an application package, using either Windows Installer or SFTMIME. - -## Reference - - -[Application Virtualization Client Installer Command-Line Parameters](application-virtualization-client-installer-command-line-parameters.md)[SFTMIME Command Reference](sftmime--command-reference.md) - -## Related topics - - -[Application Virtualization Client Hardware and Software Requirements](application-virtualization-client-hardware-and-software-requirements.md) - -[How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md) - - - - - - - - - diff --git a/mdop/appv-v4/stand-alone-delivery-scenario-overview.md b/mdop/appv-v4/stand-alone-delivery-scenario-overview.md deleted file mode 100644 index d01a132c43..0000000000 --- a/mdop/appv-v4/stand-alone-delivery-scenario-overview.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Stand-Alone Delivery Scenario Overview -description: Stand-Alone Delivery Scenario Overview -author: dansimp -ms.assetid: b109f309-f3c1-43af-996f-2a9b138dd171 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Stand-Alone Delivery Scenario Overview - - -The stand-alone delivery scenario is an ideal application virtualization solution for environments where either low bandwidth connectivity or no connectivity limits the ability of the Application Virtualization Desktop Client to stream applications from centralized servers. In these environments, users often work remotely and device owners install applications by using Windows Installer files. - -You can use the Application Virtualization Sequencer to create sequenced applications that include Windows Installer files. These packages include the virtualized applications, publication information, and the necessary installer routines for installing the packages on the client systems. The installer adds the virtual application package to the Microsoft Application Virtualization Desktop Client. The publication information is configured to load applications from a local location rather than stream them across a WAN. Users can temporarily connect to a network to retrieve the Windows Installer files or can run them from a DVD. - -The stand-alone delivery scenario provides users the following benefits: - -- Simple deployment operation. - -- Network and servers not needed at runtime. - -- Applications pre-cached and available to all users. - -The stand-alone delivery scenario has the following limitations: - -- Built-in, automated reporting is unavailable; reports must be generated with external reporting tools. - -- Applications must be delivered to the client manually like the original Windows Installer files. - -## Related topics - - -[How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md) - -[How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/streaming-page-learn-more.md b/mdop/appv-v4/streaming-page-learn-more.md deleted file mode 100644 index f46ecd595d..0000000000 --- a/mdop/appv-v4/streaming-page-learn-more.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Streaming Page -description: Streaming Page -author: dansimp -ms.assetid: a69a57a0-1bbe-4604-840d-bfa87ec463e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Streaming Page - - -Use the **Streaming** page to optimize the virtual application package. During this step, the App-V Sequencer evaluates and configures the virtual application package so that it runs more efficiently when the package is deployed to target computers. - -**Note**   -You only have to perform the following tasks if you plan to stream the package across the network. - - - -This page contains the following elements: - -**Run Selected** -Runs and optimizes only the specified programs saved in the virtual application package. - -**Run All** -Runs all the programs saved in the virtual application package. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/support-for-client-reporting-over-http.md b/mdop/appv-v4/support-for-client-reporting-over-http.md deleted file mode 100644 index 23aa56eca5..0000000000 --- a/mdop/appv-v4/support-for-client-reporting-over-http.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: Support for Client Reporting over HTTP -description: Support for Client Reporting over HTTP -author: dansimp -ms.assetid: 4a26ac80-1fb5-4c05-83de-4d06793f7bf2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Support for Client Reporting over HTTP - - -Version 4.6 of the App-V client now supports the use of HTTP communication when sending client reporting data to the publishing server. This feature supports scenarios where a customer has implemented a custom HTTP(S) publishing server that is configured to collect and process client data. - -For more information on HTTP publishing servers, see - -## Client Reporting over HTTP - - -The client starts collecting data when it receives a “REPORTING=”TRUE””attribute in the publishing refresh response XML from the publishing server. When this attribute is received, the client sends any accumulated data to the publishing server that sent the publishing refresh. The details of this process are as follows: - -- The client sends an HTTP GET request to the publishing server for a publishing refresh. The header of this message contains an “AppV-Op:Refresh” custom header that the custom HTTP(S) publishing server uses to identify the message type. - -- The publishing server then sends the publishing refresh response XML that contains a “REPORTING=”TRUE”” value. - -- The client then sends an HTTP POST request to the publishing server along with the reporting data that has been gathered since the previous refresh. The header of this message contains an “AppV-Op:Report” custom header that the custom HTTP(S) publishing server uses to identify the message type. - -The following schema gives specific details of the package and the application data that is sent to the server. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -  - -  - - - - - diff --git a/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md deleted file mode 100644 index 8e3965c0c2..0000000000 --- a/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: SXS Conflict Detected Dialog Box (App-V 4.6 SP1) -description: SXS Conflict Detected Dialog Box (App-V 4.6 SP1) -author: dansimp -ms.assetid: 7cbb67ba-cc11-4f10-b903-4a6af233eacb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# SXS Conflict Detected Dialog Box (App-V 4.6 SP1) - - -The application you are installing requires 64-bit assemblies. You can find more information about the side-by-side assemblies in the Sequencer log file which is located in the following directory: - -<App-V Sequencer installation drive> \\**Program Files** \\ **Microsoft Application Virtualization Sequencer** \\ **Logs** - -Install public versions of the required 64-bit assemblies on the computer running the App-V Sequencer before sequencing this application. You must also install the assemblies on the computer running the App-V client before you deploy this package. - -## Related topics - - -[Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/system-error-reportserver.md b/mdop/appv-v4/system-error-reportserver.md deleted file mode 100644 index b94b419d2f..0000000000 --- a/mdop/appv-v4/system-error-reportserver.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: System Error Report -description: System Error Report -author: dansimp -ms.assetid: 4081db2f-92a6-4928-a26b-757048159094 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# System Error Report - - -Generate the System Error Report to track the number of errors and warnings logged over time during the specified reporting period for the specified server, for the specified server group. - -This report generates a bar graph that displays the fatal errors, errors, and log warnings in ascending order based on the time the messages were logged. - -When you create a report, you specify the parameters that are used for collecting the data when the report is run. - -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run this report is determined by the amount of data collected in the data store. - -After you run a report and the output is displayed in the Application Virtualization Server Management Console, you can export the report into the following formats: - -- Adobe Acrobat (PDF) - -- Microsoft Office Excel - -## Related topics - - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/system-utilization-reportserver.md b/mdop/appv-v4/system-utilization-reportserver.md deleted file mode 100644 index 5bccc4c9ab..0000000000 --- a/mdop/appv-v4/system-utilization-reportserver.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: System Utilization Report -description: System Utilization Report -author: dansimp -ms.assetid: 4d490d15-2d1f-4f2c-99bb-0685447c0672 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# System Utilization Report - - -Use the System Utilization Report to graph the total daily system usage. You can use this report to determine the load on your Application Virtualization System. - -This report tracks the usage over time during the reporting period for the specified server or for the server group. - -The System Utilization Report also graphs the following system usage: - -- Usage by day of the week - -- Usage by hour of the day - -The System Utilization Report also includes a summary of the total system usage for specific users and total session counts. - -When you create a report, you specify the parameters that are used for collecting the data when the report is run. - -Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run this report is determined by the amount of data collected in the data store. - -After you run a report and the output is displayed in the Application Virtualization Server Management Console, you can export the report into the following formats: - -- Adobe Acrobat (PDF) - -- Microsoft Office Excel - -**Note**   -The App-V server name reported from the clients must be part of the Default Server Group in order for the System Utilization report to show data. For example, if you are using multiple servers with a Network Load Balancer (NLB), you must add the NLB cluster name to the Default Server Group. - - - -## Related topics - - -[How to Create a Report](how-to-create-a-reportserver.md) - -[How to Delete a Report](how-to-delete-a-reportserver.md) - -[How to Export a Report](how-to-export-a-reportserver.md) - -[How to Print a Report](how-to-print-a-reportserver.md) - -[How to Run a Report](how-to-run-a-reportserver.md) - - - - - - - - - diff --git a/mdop/appv-v4/target-os-page-learn-more.md b/mdop/appv-v4/target-os-page-learn-more.md deleted file mode 100644 index 34db517496..0000000000 --- a/mdop/appv-v4/target-os-page-learn-more.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Target OS Page -description: Target OS Page -author: dansimp -ms.assetid: 003fd992-0a7e-494e-9e75-4dd5e0927e15 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Target OS Page - - -Use the **Target OS** page to specify which operating systems in your environment can run this virtual application package. - -**Note**   -The operating systems specified on this page can only run this virtual application package if the application you are sequencing supports the operating systems specified. Review the supported operating systems for the application you are sequencing to ensure compatibility. - - - -This page contains the following elements: - -**Allow this package to run on any operating system** -Enables the virtual application package to be installed and run on all supported operating systems. - -**Allow this package to only run on the following operating systems** -Enables the virtual application package to be installed and run only on the selected supported operating systems. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - - - - - - - - - diff --git a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md deleted file mode 100644 index f3df4eb7f8..0000000000 --- a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1) -description: Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1) -author: dansimp -ms.assetid: 58597af9-6a62-4588-ab41-dbf6b7026267 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1) - - -Use any of the following links for more information about using the App-V Sequencer. - -## In This Section - - -[How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md) -Describes how to determine the type of application you want to sequence. - -[How to Sequence a New Standard Application (App-V 4.6 SP1)](how-to-sequence-a-new-standard-application--app-v-46-sp1-.md) -Describes how to sequence a new standard application. - -[How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)](how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md) -Describes how to sequence a new add-on or plug-in application. - -[How to Sequence a New Middleware Application (App-V 4.6 SP1)](how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md) -Describes how to sequence a new middleware application. - -[How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md) -Describes how to modify an existing virtual application package. - -[How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md) -Describes how to use a Package Accelerator to create a new virtual application package. - -[How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md) -Describes how to use a project template to apply standard package settings to a new virtual application package. - -[How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md) -Describes how create a new Package Accelerator. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md deleted file mode 100644 index 88d5d425f0..0000000000 --- a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Tasks for the Application Virtualization Sequencer -description: Tasks for the Application Virtualization Sequencer -author: dansimp -ms.assetid: 398018f4-297a-440d-b614-23f0ab03e7bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Tasks for the Application Virtualization Sequencer - - -The links in this section provide the necessary information to complete each associated Microsoft Application Virtualization (App-V) task. - -## In This Section - - -[How to Sequence a New Application](how-to-sequence-a-new-application.md) -Specifies the tasks associated with sequencing a new application. - -[How to Create a Virtual Environment for a Web-Based Application](how-to-create-a-virtual-environment-for-a-web-based-application.md) -Specifies how to create separate web environments for virtual applications. - -[How to Upgrade a Sequenced Virtual Application Package](how-to-upgrade-a-sequenced-virtual-application-package.md) -Specifies how to upgrade an existing virtual application package. - -[How to Branch a Package](how-to-branch-a-package.md) -Specifies how to branch an existing virtual application package so you can run multiple versions of the same package. - -[How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md) -Specifies how to upgrade an existing virtual application package using the command line. - -[How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md) -Specifies how to manage virtual applications using the command line. - -## Related topics - - -[Application Virtualization Sequencer Online Help](application-virtualization-sequencer-online-help.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md b/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md deleted file mode 100644 index c7285083d5..0000000000 --- a/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Troubleshooting Application Virtualization Sequencer Issues -description: Troubleshooting Application Virtualization Sequencer Issues -author: dansimp -ms.assetid: 2712094b-a0bc-4643-aced-5415535f3fec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Application Virtualization Sequencer Issues - - -This topic includes information that you can use to help troubleshoot general issues on the Application Virtualization (App-V) Sequencer. - -## Creating an SFTD File by Using the App-V Sequencer Increases the Version Number Unexpectedly - - -Use the command line to generate a new .sft file. To create the .sft file by using the command line, enter the following at a command prompt: - -**mkdiffpkg.exe <base SFT file name> <diff SFT file name>** - -## File Name in OSD File Is Not Correct After Package Upgrade - - -When you open a package for upgrade, you should specify the root Q:\\ drive as the output location for the package. Do not specify an associated file name with the output location. - -## Microsoft Word 2003 Default Install Results in an Error When Streamed to a Client - - -When you stream Microsoft Word 2003 to a client, an error is returned, but Microsoft Word continues to run. - -**Solution** - -Resequence the virtual application package and select **Full Install**. - -## Active Upgrade Does Not Work When You Create a Dependent Package - - -When you create a dependent package by using active upgrade and add new registry entries, it appears to function correctly, but the updated registry entries are not available. - -**Solution** - -Registry settings are always stored with the original version of the package, so updates to the package will not appear to be available unless you repair the original package. - -## Detailed information is not visible for Microsoft Office 2007 documents by using the properties page - - -When you try to view detailed information associated with a Microsoft Office 2007 document by using the properties page, the detailed information is not visible. - -**Solution** - -App-V does not support the required shell extensions for these property pages. - -## Some registry keys are not captured when you sequence 16-bit applications - - -In App-V 4.5, registry hooking has been moved from kernel mode to user mode. If you want to sequence a 16-bit application or an application that uses a 16-bit installer, you must first configure the sequencer computer so that the process runs in its own copy of the Windows NT Virtual DOS Machine (NTVDM). - -**Solution** - -Before you sequence the application, set the following global REGSZ registry key value to "yes" on the sequencing computer: - -HKLM\\SYSTEM\\CurrentControlSet\\Control\\WOW\\DefaultSeparateVDM - -You must restart the computer before this takes effect. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-certificate-permission-issues.md b/mdop/appv-v4/troubleshooting-certificate-permission-issues.md deleted file mode 100644 index 9b05d6624b..0000000000 --- a/mdop/appv-v4/troubleshooting-certificate-permission-issues.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Troubleshooting Certificate Permission Issues -description: Troubleshooting Certificate Permission Issues -author: dansimp -ms.assetid: 06b8cbbc-93fd-44aa-af39-2d780792d3c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Certificate Permission Issues - - -After the installation of App-V 4.5, if the private key has not been configured with the proper ACL for the Network Service, an event is logged in the NT Event Log and an entry is placed in the `Sft-server.log` file. - -## Error Messages - - -### Windows Server 2003 - -Event ID 36870—A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x80090016. - -### Windows Server 2008 - -Event ID 36870—A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. - -## Sft-server.log - - -The following error is placed in the `sft-server.log` file located in the `%ProgramFiles%\Microsoft System Center App Virt Management Server\App Virt Management Server\logs` directory: - -Certificate could not be loaded. Error code \[-2146893043\]. Make sure that the Network Service account has proper access to the certificate and its corresponding private key file. - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md deleted file mode 100644 index a8b8781132..0000000000 --- a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Troubleshooting Information for the Application Virtualization Client -description: Troubleshooting Information for the Application Virtualization Client -author: dansimp -ms.assetid: 260a8dad-847f-4ec0-b7dd-6e6bc52017ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Information for the Application Virtualization Client - - -This topic includes information that you can use to troubleshoot various issues on the Application Virtualization (App-V) Client. - -## Publishing Refresh Is Very Slow - - -If publishing refresh on a specific computer takes much longer than expected and if the client is configured to use the **IconSourceRoot** setting, determine whether **IconSourceRoot** contains a nonvalid URL. A nonvalid URL will cause very long delays during publishing refresh. - -## Users Cannot Connect to the Server and Go into Disconnected Operations Mode - - -When you are using an App-V Management Server configured with the RTSPS protocol, if the users are unable to connect and they go into disconnected operations mode, determine whether the certificate that is being used on the server is valid. A nonvalid certificate will prevent users from connecting and will cause them to go into disconnected operations mode. - -## Users Experience Slow Performance When Applications Are Not Fully Cached - - -When applications are not fully cached, users might occasionally experience temporary slow or intermittent performance when they start or use the application. There are several possible reasons this can occur—for example, when the App-V Client is in the process of auto-loading an application or when an Out Of Sequence request is being processed. When the applications are fully cached, these problems will no longer occur. - -## Error Displayed After an Update Is Removed - - -You must use the correct Windows Installer 3.1 command format to remove an update from the App-V Client, as follows: - -`Msiexec /I {F82584A0-D706-4D2D-9BC1-7E6D8BE3BB0F} MSIPATCHREMOVE={BE3DD018-9A1F-40FD-9538-C0A995CBD254} /qb /l*v "Uninstall.log"` - -Using the older command format `msiexec /package /uninstall ` will cause error 6003 "Application Virtualization client could not be started". - -## Error Code 0A-0000E01E Occurs When You Try to Start an Application - - -Error code 0A-0000E01E indicates that the sequenced application package might be corrupt. The solution is to resequence the package. - -## Users Cannot Access Files They Have Created on the Q: Drive - - -If users save files to the **Q:** drive, they cannot retrieve them because they do not have read rights to the drive. Users should not save files to the **Q:** drive. - -## User Is Prompted with a 1D1 Error - - -When the file streaming URL is incorrectly set in the Open Software Descriptor (OSD) file, the App-V Client returns a 1d1 error instead of a “file not found” error. This error indicates that the application start failed and the user has been forced into disconnected operations mode. Correct the file streaming URL. - -## Incorrect Icons Associated with Some Applications - - -When an icon is to be used in a publishing operation, the App-V Client first determines whether it already has a cached copy of the icon, by looking in the icon cache for an item whose original source path matches the path of the icon given to the publishing operation. If the App-V Client finds a match, it will use the already-cached icon; otherwise, it will download the new icon into the cache. If the path to the icon is a scratch directory or if it gets reused for new icons or packages, the lookup in the cache might pick the wrong icon from a previous operation. - -## Users Are Prompted for Credentials When Starting an Application - - -If a user attempts to start a virtual application to which the system administrator has restricted access, the user might be prompted to enter credentials. The user should type the user name and password for an account that has permission to launch the application and then press ENTER. - -## Publishing Refresh Fails After Upgrading the App-V Client to Version 4.5 - - -If the user data directory was previously placed in a non-standard location (%*AllUsersProfile*%\\Documents\\SoftGrid Client\\Users\\%*username*%), users who do not have administrator privileges on the computer will find that publishing refresh fails after the App-V Client is upgraded. During the upgrade, the App-V Client global data directory and all its subdirectories are configured with restricted access rights for administrators only. You can avoid this problem by changing the user data directory before upgrading so that it is not a subdirectory of the global data directory. - -## Reboot Required After Install Failure - - -If the client install fails for any reason and if subsequent attempts to install the client also fail, check the Windows Installer log to see whether it shows an error “sftplay failed, error=1072”. If so, restart the computer before trying to install the client again. - -## Repairing a Corrupted Virtual Application - - -If for any reason a virtual application package installed using a Windows Installer Package (MSI) file becomes corrupted, reinstall the package. The Repair function available in the Windows Installer will not update the user volumes. - -## Related topics - - -[Application Virtualization Client Reference](application-virtualization-client-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md deleted file mode 100644 index df335aaec7..0000000000 --- a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Troubleshooting Information for the Application Virtualization Server -description: Troubleshooting Information for the Application Virtualization Server -author: dansimp -ms.assetid: e9d43d9b-84f2-4d1b-bb90-a13740151e0c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting Information for the Application Virtualization Server - - -This topic includes information that you can use to troubleshoot various issues on the Application Virtualization (App-V) Servers. - -## Warning Message 25017 in Setup Log After Installing the Server - - -You might find the following message in the server setup log after installation. - -*Warning 25017. The installation Program could not create the Active Directory marker object for the server. The account used to install did not have the sufficient rights to write to Active Directory or Active Directory was unavailable.* - -The App-V Management or Streaming Server installer creates a Service Connection Point entry under the Computer object in Active Directory Domain Services (AD DS) that corresponds to the computer on which the server is installed if the account used to run the installer has the appropriate rights. Failure to create this entry will not cause the install to fail and this should not otherwise affect the functioning of the product. The likely cause of any failure is that the user account used to run the install did not have sufficient rights to write to AD DS. Although registering the App-V server in AD DS is optional, one benefit of doing so enables centralized management tools to locate the App-V server for inventory and management purposes. - -## Related topics - - -[Application Virtualization Server](application-virtualization-server.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md b/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md deleted file mode 100644 index c832ebe830..0000000000 --- a/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Troubleshooting the Application Virtualization Sequencer -description: Troubleshooting the Application Virtualization Sequencer -author: dansimp -ms.assetid: 12ea8367-0b84-44e1-a885-e0539486556b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting the Application Virtualization Sequencer - - -This topic includes information that you can use to help troubleshoot general issues on the Application Virtualization (App-V) Sequencer. - -## Creating an SFTD File by Using the App-V Sequencer Increases the Version Number Unexpectedly - - -The version number associated with an SFTD file increases unexpectedly. - -**Solution** - -Use the command line to generate a new .sft file. To create the .sft file by using the command line, enter the following at a command prompt: - -**mkdiffpkg.exe <base SFT file name> <diff SFT file name>** - -## File Name in OSD File Is Not Correct After Package Upgrade - - -After you upgrade an existing package, the file name is not correct. - -**Solution** - -When you open a package for upgrade, you should specify the root Q:\\ drive as the output location for the package. Do not specify an associated file name with the output location. - -## Microsoft Word 2003 Default Install Results in an Error When Streamed to a Client - - -When you stream Microsoft Word 2003 to a client, an error is returned but Microsoft Word continues to run. - -**Solution** - -Resequence the virtual application package, and select **Full Install**. - -## Package Upgrade Does Not Work When You Create a Dependent Package - - -When you create a dependent package by using package upgrade and add new registry entries, it appears to function correctly but the updated registry entries are not available. - -**Solution** - -Registry settings are always stored with the original version of the package, so updates to the package will not appear to be available unless you repair the original package. - -## Error When Trying to Sequence .NET 2.0 - - -When you sequence a package that requires .NET 2.0, you get an error. - -**Solution** - -Sequencing packages that require .NET 2.0 is not supported. - -## Related topics - - -[Application Virtualization Sequencer](application-virtualization-sequencer.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/type-of-application-page--learn-more-.md b/mdop/appv-v4/type-of-application-page--learn-more-.md deleted file mode 100644 index 529c2aac7d..0000000000 --- a/mdop/appv-v4/type-of-application-page--learn-more-.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Type of Application Page (Learn More) -description: Type of Application Page (Learn More) -author: dansimp -ms.assetid: d1262d16-7b14-441e-8500-7974bf68d196 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Type of Application Page (Learn More) - - -Use the **Type of Application** page to specify the type of application you are sequencing. It is important to understand and select the correct type of application you are sequencing so you can ensure you take the correct steps toward successful package creation. - -This page contains the following elements: - -**Standard Application (default)** -Select this option to create a package that contains an application or a suite of applications. You should select this option for most applications you plan to sequence. - -**Add-on or Plug-in** -Select this option to create a package that extends the functionality of a standard application; for example, a plug-in for Microsoft Excel. - -**Middleware** -Select this option to create a package that is required by a standard application, for example, the Microsoft .NET Framework. - -## Related topics - - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/unload-app.md b/mdop/appv-v4/unload-app.md deleted file mode 100644 index e9b1a2c013..0000000000 --- a/mdop/appv-v4/unload-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: UNLOAD APP -description: UNLOAD APP -author: dansimp -ms.assetid: f0d729ae-8772-498b-be11-1a4b35499c53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UNLOAD APP - - -Unloads the application and all other applications in the package from the file system cache. - -`SFTMIME UNLOAD APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application to unload.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/unload-package.md b/mdop/appv-v4/unload-package.md deleted file mode 100644 index 8c8678569e..0000000000 --- a/mdop/appv-v4/unload-package.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: UNLOAD PACKAGE -description: UNLOAD PACKAGE -author: dansimp -ms.assetid: a076eb5a-ce3d-49e4-ac7a-4d4df10e3477 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UNLOAD PACKAGE - - -Unloads the package from the file system cache. - -`SFTMIME UNLOAD PACKAGE:package-name [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    PACKAGE:<package-name>

    The name of the package to unload.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/unlock-app.md b/mdop/appv-v4/unlock-app.md deleted file mode 100644 index 91940cb378..0000000000 --- a/mdop/appv-v4/unlock-app.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: UNLOCK APP -description: UNLOCK APP -author: dansimp -ms.assetid: 91fc8ceb-b4f5-4a06-8193-05189f830943 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UNLOCK APP - - -Unlocks the application specified in the file system cache. - -`SFTMIME UNLOCK APP:application [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    APP:<application>

    The name and version (optional) of the application to unlock.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - -  - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - -  - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/unpublish-package.md b/mdop/appv-v4/unpublish-package.md deleted file mode 100644 index 34f5a16083..0000000000 --- a/mdop/appv-v4/unpublish-package.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: UNPUBLISH PACKAGE -description: UNPUBLISH PACKAGE -author: dansimp -ms.assetid: 1651427c-72a5-4701-bb57-71e14a7a3803 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UNPUBLISH PACKAGE - - -Enables you to remove the shortcuts and file types for an entire package. - -`SFTMIME UNPUBLISH PACKAGE:package-name [/CLEAR] [/GLOBAL] [/LOG log-pathname | /CONSOLE | /GUI]` - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    PACKAGE:<package-name>

    The name of the package.

    /CLEAR

    If present, user settings will also be removed. (For more information, see the Important note later in this topic.)

    /GLOBAL

    If present, the package will be unpublished for all users on this computer.

    /LOG

    If specified, output is logged to the specified path name.

    /CONSOLE

    If specified, output is presented in the active console window (default).

    /GUI

    If specified, output is presented in a Windows dialog box.

    - - - -For version 4.6, the following option has been added. - - ---- - - - - - - -

    /LOGU

    If specified, output is logged to the specified path name in UNICODE format.

    - - - -**Important**   -Before you can run the **UNPUBLISH PACKAGE** command, the package must already have been added to the Application Virtualization Client. - -To use **GLOBAL**, **UNPUBLISH PACKAGE** must be run as local Administrator; otherwise, only **ClearApp** permission is needed. - -Using **UNPUBLISH PACKAGE** with **GLOBAL** removes any global file types and shortcuts for the package. **CLEAR** is not applicable. - -Using **UNPUBLISH PACKAGE** without **GLOBAL** removes the user shortcuts and file types for the package and, if **CLEAR** is set, also removes user settings and stops background loads under the user’s context. - -**UNPUBLISH PACKAGE** works on applications from the same package name or GUID that was used as the source ID for **ADD**, **EDIT**, and **PUBLISH PACKAGE**. - -**UNPUBLISH PACKAGE** always clears all the user settings, shortcuts, and file types regardless of the use of the /CLEAR switch. - - - -## Related topics - - -[SFTMIME Command Reference](sftmime--command-reference.md) - - - - - - - - - diff --git a/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md b/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md deleted file mode 100644 index b5823c5aa0..0000000000 --- a/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md +++ /dev/null @@ -1,134 +0,0 @@ ---- -title: User Access Permissions in Application Virtualization Client -description: User Access Permissions in Application Virtualization Client -author: dansimp -ms.assetid: 7459374c-810c-45e3-b205-fdd1f8514f80 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# User Access Permissions in Application Virtualization Client - - -On the **Permissions** tab on the **Properties** dialog box, accessible by right-clicking the **Application Virtualization** node in the Application Virtualization Client Management Console, administrators can grant users permissions to use the various client functions. - -**Note**   -Before changing users permissions, ensure that any permissions changes are consistent with the organization's guidelines for granting user permissions. - - - -The following table lists and describes the permissions that can be granted to users. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Permission NameDescription

    Add applications

    Register new applications by passing a new OSD file to the client by using sfttray.exe, sftmime.exe or the MMC.

    Change file system cache size

    Increase the size of the file system cache.

    Change file system drive

    Select a different preferred drive letter for the file system.

    Change log settings

    Change the log level or the log path for the client log file.

    Change OSD files

    Modify OSD files for registered applications and pass them into the client. This does not affect publishing refresh.

    Clear application settings

    Delete file types, shortcuts and any configurations for the current user.

    Delete applications

    Remove all references to an application from the file system and OSD cache for all users on the computer.

    Import applications into the cache

    Load application data directly from a specified SFT file into the file system cache. This affects all users.

    Load applications into the cache

    Start a load of the SFT file for an application from the configured source, such as an App-V Streaming Server. This loads the application for all users on the computer.

    Lock and unlock applications in the cache

    Prevent or allow applications from being unloaded from the file system cache. This affects all users on the computer.

    Manage file type associations

    Add, modify, or delete file type associations for the current user only.

    Manage publishing refresh settings

    Change settings that control the timing of publishing refreshes for all users on the computer.

    Manage publishing servers

    Add, modify, or delete publishing servers for all users on the computer. This permission implicitly includes permission to manage publishing refresh settings.

    Publish shortcuts

    Create new shortcuts to registered applications. The user must also have permission to create files in the local file system.

    Repair applications

    Remove application specific configurations for the current user without removing shortcuts or file type associations.

    Start a publishing refresh

    Start an unscheduled publishing refresh for the current user.

    Toggle offline mode

    Change the entire client from online to offline mode for all users.

    Unload applications from the cache

    Clear application data from the file system cache for all users without removing user-specific settings, shortcuts, or file type associations.

    View all applications

    Allow the user to see the virtual applications for all users registered on the computer.

    - - - -## Related topics - - -[How to Change User Access Permissions](how-to-change-user-access-permissions.md) - - - - - - - - - diff --git a/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md b/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md deleted file mode 100644 index e41d0cb21b..0000000000 --- a/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Using Application Virtualization Servers as a Package Management Solution -description: Using Application Virtualization Servers as a Package Management Solution -author: dansimp -ms.assetid: 41597355-e7bb-45e2-b300-7b1724419975 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using Application Virtualization Servers as a Package Management Solution - - -If you do not have an existing ESD system to deploy your Application Virtualization solution or do not wish to use one, you will need to install one or more Application Virtualization Management Servers as the core of your system architecture. The Application Virtualization Management Server requires a dedicated server computer and needs a Microsoft SQL Server database. The database can be on the same server, or it can be configured on a corporate database server that is accessible to the Application Virtualization Management Server over a high-speed LAN connection. In addition, you will need to install the Microsoft Application Virtualization Management Console, on either the Application Virtualization Management Server or on a designated management workstation, and you will need to install the Microsoft Application Virtualization Management Web Service, which can also be installed on the Application Virtualization Management Server or on a separate IIS server. The Application Virtualization Management Console is used to connect to the Application Virtualization Management Web Service, enabling the system administrator to interact with the Application Virtualization Management Server. - -**Note**   -Access to the applications is controlled by means of Security Groups in Active Directory Domain Services, so you will need to plan a process to set up a security group for each virtualized application and for managing which users are added to each group. The Application Virtualization Management Server administrator configures the server to use these Active Directory groups, and the server then automatically controls access to the packages based on Active Directory group membership. - - - -## In This Section - - -[Overview of the Application Virtualization System Components](overview-of-the-application-virtualization-system-components.md) -Lists and describes the primary components of the Microsoft Application Virtualization Management System. - -[Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md) -Provides a brief overview of how virtual applications are published in an Application Virtualization Server-based deployment scenario. - -[Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md) -Describes available options for using Application Virtualization Streaming Servers in conjunction with your Application Virtualization Management Server-based implementation. - -## Related topics - - -[Application Virtualization Server-Based Scenario](application-virtualization-server-based-scenario.md) - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - - - - - - - - - diff --git a/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md b/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md deleted file mode 100644 index 7106bf01e0..0000000000 --- a/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Using Electronic Software Distribution as a Package Management Solution -description: Using Electronic Software Distribution as a Package Management Solution -author: dansimp -ms.assetid: 7d96ea70-3e7e-49fa-89cc-586804a10657 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using Electronic Software Distribution as a Package Management Solution - - -In Application Virtualization, after you have sequenced and tested a package, you need to deploy the virtual application package to the target computers. To accomplish this, you will need to determine where to put the package content and how to deliver it to the end user computers. An efficient, effective electronic software distribution–based deployment plan will help you avoid the situation where large numbers of end users computers need to retrieve the package content over slow network connections. - -If you currently have an electronic software distribution (ESD) system in daily operation, you can use it to handle all necessary management tasks in Application Virtualization. This means that you can effectively use your existing infrastructure to the best advantage, without the need to add new servers and application software or incur the additional administrative overhead that these would require. Ideally, if you have Microsoft Endpoint Configuration Manager deployed and operational, you will find that Configuration Manager has built-in capability for performing the Application Virtualization management tasks. - -For in-depth information about performing an ESD-based deployment, [Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md). - -## In This Section - - -[Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md) -Describes the available ESD-based methods for distributing your sequenced applications to clients. - -[Planning Your Streaming Solution in an Electronic Software Distribution Implementation](planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md) -Describes available options for using a streaming server to deploy your sequenced applications to clients. - -## Related topics - - -[Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md) - -[Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/verify-applications-page--package-accelerators-.md b/mdop/appv-v4/verify-applications-page--package-accelerators-.md deleted file mode 100644 index fa38068d5e..0000000000 --- a/mdop/appv-v4/verify-applications-page--package-accelerators-.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Verify Applications Page (Package Accelerators) -description: Verify Applications Page (Package Accelerators) -author: dansimp -ms.assetid: e58a37db-d042-453f-aa0d-2f324600a35b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Verify Applications Page (Package Accelerators) - - -Use the **Verify Applications** page to review the installer file dependencies that are saved with the package. These files are required when the Package Accelerator is used to create a new virtual application package. - -You can add or edit the following types of information. Only the application **Name** is required; however, you should provide as much information as possible to help ensure that a new virtual application package is created successfully when you use a package accelerator: - -- **Name**. You must specify a name. - -- **Publisher**. Optionally specify information about the application publisher. - -- **Version**. Optionally specify application version information. - -- **Language**. Optionally specify language information. - -This page contains the following elements: - -**Add** -Adds a new installation file dependency that will be required when the Package Accelerator is applied. - -**Delete** -Deletes a selected dependency file that is currently part of the Package Accelerator. - -**Edit** -Enables you to edit the properties associated with the selected installer file’s dependency. - -## Related topics - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/virtual-application-package-additional-components.md b/mdop/appv-v4/virtual-application-package-additional-components.md deleted file mode 100644 index 8fe48620bc..0000000000 --- a/mdop/appv-v4/virtual-application-package-additional-components.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Virtual Application Package Additional Components -description: Virtual Application Package Additional Components -author: dansimp -ms.assetid: 476b0f40-ebd6-4296-92fa-61fa9495c03c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Virtual Application Package Additional Components - - -The App-V Sequencer has detected a directory that contains 64-bit and 32-bit executables and/or dynamic-link library (.dll) files that depend on the same side-by-side assembly. Typically, the Sequencer creates private side-by-side assemblies for all public assemblies that are used by the package; however, it is not possible to create 32-bit and 64-bit versions of the private assemblies in the same directory. - -If the Sequencer detects a single conflict, it will perform the following actions: - -- Remove all of the existing 64-bit private assemblies in the entire package, whether or not the directory has a conflict. - -- Create only 32-bit versions of the private side-by-side assemblies. - -You should natively install public versions of all the required 64-bit assemblies on the computer running the Sequencer and on all App-V client computers. - -To locate the required existing public assemblies, open the directory where the package is saved and look in the **VFS** folder. For example, if the package root is **Q:\\MyApp**, when you sequence the application, look in **Q:\\MyApp\\VFS\\CSIDL\_Windows\\WinSxS\\Manifests** and locate all of the existing public assemblies. The 64-bit versions of these files will always start with the following text at the beginning of the manifest name: **amd64…**. The exact name and version of the assembly can be found in the associated manifest file. - -Use any of the following links to download and install the correct version of the required prerequisites: - -- [Microsoft Visual C++ 2005 Redistributable Package (x64)](https://go.microsoft.com/fwlink/?LinkId=152697) - -- [Microsoft Visual C++ 2005 SP1 Redistributable Package (x64)](https://go.microsoft.com/fwlink/?LinkId=152698) - -- [Microsoft Visual C++ 2008 Redistributable Package (x64)](https://go.microsoft.com/fwlink/?LinkId=152699) - -- [Microsoft Visual C++ 2008 SP1 Redistributable Package (x64)](https://go.microsoft.com/fwlink/?LinkId=152700) - -  - -  - - - - - diff --git a/mdop/appv-v4/virtual-file-system-tab-keep.md b/mdop/appv-v4/virtual-file-system-tab-keep.md deleted file mode 100644 index 290e0a1d2a..0000000000 --- a/mdop/appv-v4/virtual-file-system-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Virtual File System Tab -description: Virtual File System Tab -author: dansimp -ms.assetid: 9d084e2a-720d-4a25-9cd5-d0d70868b413 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtual File System Tab - - -The **Virtual File System** tab allows you to view and modify the file-mapping information. - -## In This Section - - -[About the Virtual File System Tab](about-the-virtual-file-system-tab.md) -Provides general information about the **Virtual File System** tab. - -[How to Modify File-Mapping Information](how-to-modify-file-mapping-information.md) -Provides the procedure to modify the file-mapping information by using the **Virtual File System** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/virtual-registry-tab-keep.md b/mdop/appv-v4/virtual-registry-tab-keep.md deleted file mode 100644 index cd9e9a01da..0000000000 --- a/mdop/appv-v4/virtual-registry-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Virtual Registry Tab -description: Virtual Registry Tab -author: dansimp -ms.assetid: 25833383-24c4-40a1-b34c-73b2bd3f11e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtual Registry Tab - - -Use the **Virtual Registry** tab to view and modify the virtual registry key information. - -## In This Section - - -[About the Virtual Registry Tab](about-the-virtual-registry-tab.md) -Provides general information about the **Virtual Registry** tab. - -[How to Modify Virtual Registry Key Information](how-to-modify-virtual-registry-key-information.md) -Provides the procedure to modify the virtual registry key information by using the **Virtual Registry** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/virtual-services-tab-keep.md b/mdop/appv-v4/virtual-services-tab-keep.md deleted file mode 100644 index 360df6d0a5..0000000000 --- a/mdop/appv-v4/virtual-services-tab-keep.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Virtual Services Tab -description: Virtual Services Tab -author: dansimp -ms.assetid: 9fc4679d-ccb5-4df7-99de-dd7d3a367ecc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtual Services Tab - - -Use the **Virtual Services** tab to view and edit the attributes of embedded services. - -## In This Section - - -[About the Virtual Services Tab](about-the-virtual-services-tab.md) -Provides general information about the **Virtual Services** tab. - -[How to Modify Attributes of Embedded Services](how-to-modify-attributes-of-embedded-services.md) -Provides the procedure to modify the attributes of embedded services by using the **Virtual Services** tab. - -## Related topics - - -[Sequencer Console](sequencer-console.md) - -  - -  - - - - - diff --git a/mdop/appv-v4/wizard-pages--appv-46-sp1-.md b/mdop/appv-v4/wizard-pages--appv-46-sp1-.md deleted file mode 100644 index a0a4219295..0000000000 --- a/mdop/appv-v4/wizard-pages--appv-46-sp1-.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Wizard Pages (AppV 4.6 SP1) -description: Wizard Pages (AppV 4.6 SP1) -author: dansimp -ms.assetid: dadab8cf-fe6d-4cff-8f6c-e9676f244872 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Wizard Pages (AppV 4.6 SP1) - - -Use any of the following links for more information about the App-V wizards. - -## In This Section - - -[Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md) - -[Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md) - -[Open Package Wizard (AppV 4.6 SP1)](open-package-wizard---appv-46-sp1-.md) - -[Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/TOC.md b/mdop/appv-v5/TOC.md deleted file mode 100644 index 6f2058280a..0000000000 --- a/mdop/appv-v5/TOC.md +++ /dev/null @@ -1,223 +0,0 @@ -# [Application Virtualization 5](index.md) -## [Application Virtualization 5.1](microsoft-application-virtualization-51-administrators-guide.md) -### [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) -#### [About App-V 5.1](about-app-v-51.md) -##### [Release Notes for App-V 5.1](release-notes-for-app-v-51.md) -#### [Evaluating App-V 5.1](evaluating-app-v-51.md) -#### [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md) -#### [Accessibility for App-V 5.1](accessibility-for-app-v-51.md) -### [Planning for App-V 5.1](planning-for-app-v-51.md) -#### [Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md) -##### [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) -##### [App-V 5.1 Security Considerations](app-v-51-security-considerations.md) -#### [Planning to Deploy App-V 5.1](planning-to-deploy-app-v51.md) -##### [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) -##### [App-V 5.1 Capacity Planning](app-v-51-capacity-planning.md) -##### [Planning for High Availability with App-V 5.1](planning-for-high-availability-with-app-v-51.md) -##### [Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md) -##### [Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md) -##### [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md) -##### [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md) -##### [Planning for Using App-V with Office 5.1](planning-for-using-app-v-with-office51.md) -##### [Planning to Use Folder Redirection with App-V 5.1](planning-to-use-folder-redirection-with-app-v51.md) -#### [App-V 5.1 Planning Checklist](app-v-51-planning-checklist.md) -### [Deploying App-V 5.1](deploying-app-v-51.md) -#### [Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) -##### [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) -##### [About Client Configuration Settings 5.1](about-client-configuration-settings51.md) -##### [How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md) -##### [How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md) -##### [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md) -##### [How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md) -##### [How to Uninstall the App-V 5.1 Client](how-to-uninstall-the-app-v-51-client.md) -#### [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) -##### [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md) -##### [How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md) -##### [How to Deploy the App-V Databases by Using SQL Scripts 5.1](how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md) -##### [How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer51.md) -##### [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services 5.1](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md) -##### [How to install the Management Server on a Standalone Computer and Connect it to the Database 5.1](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) -##### [About App-V 5.1 Reporting](about-app-v-51-reporting.md) -##### [How to install the Reporting Server on a Standalone Computer and Connect it to the Database 5.1](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) -#### [App-V 5.1 Deployment Checklist](app-v-51-deployment-checklist.md) -#### [Deploying Microsoft Office 2016 by Using App-V 5.1](deploying-microsoft-office-2016-by-using-app-v51.md) -#### [Deploying Microsoft Office 2013 by Using App-V 5.1](deploying-microsoft-office-2013-by-using-app-v51.md) -#### [Deploying Microsoft Office 2010 by Using App-V 5.1](deploying-microsoft-office-2010-by-using-app-v51.md) -### [Operations for App-V 5.1](operations-for-app-v-51.md) -#### [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md) -##### [How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md) -##### [How to Modify an Existing Virtual Application Package 5.1](how-to-modify-an-existing-virtual-application-package-51.md) -##### [How to Create and Use a Project Template 5.1](how-to-create-and-use-a-project-template51.md) -##### [How to Create a Package Accelerator 5.1](how-to-create-a-package-accelerator51.md) -##### [How to Create a Virtual Application Package Using an App-V Package Accelerator 5.1](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md) -#### [Administering App-V 5.1 Virtual Applications by Using the Management Console](administering-app-v-51-virtual-applications-by-using-the-management-console.md) -##### [About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) -##### [How to Connect to the Management Console 5.1](how-to-connect-to-the-management-console-51.md) -##### [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) -##### [How to Configure Access to Packages by Using the Management Console 5.1](how-to-configure-access-to-packages-by-using-the-management-console-51.md) -##### [How to Publish a Package by Using the Management Console 5.1](how-to-publish-a-package-by-using-the-management-console-51.md) -##### [How to Delete a Package in the Management Console 5.1](how-to-delete-a-package-in-the-management-console-51.md) -##### [How to Add or Remove an Administrator by Using the Management Console 5.1](how-to-add-or-remove-an-administrator-by-using-the-management-console51.md) -##### [How to Register and Unregister a Publishing Server by Using the Management Console 5.1](how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md) -##### [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md) -##### [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console 5.1](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md) -##### [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console 5.1](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md) -##### [Configure Applications and Default Virtual Application Extensions in Management Console](configure-applications-and-default-virtual-application-extensions-in-management-console.md) -#### [Managing Connection Groups 5.1](managing-connection-groups51.md) -##### [About the Connection Group Virtual Environment 5.1](about-the-connection-group-virtual-environment51.md) -##### [About the Connection Group File 5.1](about-the-connection-group-file51.md) -##### [How to Create a Connection Group 5.1](how-to-create-a-connection-group51.md) -##### [How to Create a Connection Group with User-Published and Globally Published Packages 5.1](how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md) -##### [How to Delete a Connection Group 5.1](how-to-delete-a-connection-group51.md) -##### [How to Publish a Connection Group 5.1](how-to-publish-a-connection-group51.md) -##### [How to Use Optional Packages in Connection Groups 5.1](how-to-use-optional-packages-in-connection-groups51.md) -##### [How to Make a Connection Group Ignore the Package Version 5.1](how-to-make-a-connection-group-ignore-the-package-version51.md) -##### [How to Allow Only Administrators to Enable Connection Groups 5.1](how-to-allow-only-administrators-to-enable-connection-groups51.md) -#### [Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md) -##### [How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md) -##### [How to Enable Only Administrators to Publish Packages by Using an ESD 5.1](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md) -#### [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md) -##### [How to Access the Client Management Console 5.1](how-to-access-the-client-management-console51.md) -##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server 5.1](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md) -#### [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) -##### [Check Registry Keys before installing App-V 5.x Server](check-reg-key-svr.md) -##### [How to Convert a Package Created in a Previous Version of App-V 5.1](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md) -##### [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) -##### [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md) -##### [How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) -##### [How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md) -#### [Maintaining App-V 5.1](maintaining-app-v-51.md) -##### [How to Move the App-V Server to Another Computer 5.1](how-to-move-the-app-v-server-to-another-computer51.md) -#### [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) -##### [How to Load the PowerShell Cmdlets and Get Cmdlet Help 5.1](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md) -##### [How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md) -##### [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell 5.1](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md) -##### [How to Modify Client Configuration by Using PowerShell 5.1](how-to-modify-client-configuration-by-using-powershell51.md) -##### [How to Apply the User Configuration File by Using PowerShell 5.1](how-to-apply-the-user-configuration-file-by-using-powershell51.md) -##### [How to Apply the Deployment Configuration File by Using PowerShell 5.1](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md) -##### [How to Sequence a Package by Using PowerShell 5.1](how-to-sequence-a-package--by-using-powershell-51.md) -##### [How to Create a Package Accelerator by Using PowerShell 5.1](how-to-create-a-package-accelerator-by-using-powershell51.md) -##### [How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md) -##### [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell 5.1](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md) -### [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) -### [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) -#### [Performance Guidance for Application Virtualization 5.1](performance-guidance-for-application-virtualization-51.md) -#### [Application Publishing and Client Interaction 5.1](application-publishing-and-client-interaction51.md) -#### [Viewing App-V Server Publishing Metadata 5.1](viewing-app-v-server-publishing-metadata51.md) -#### [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications 5.1](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md) -## [Application Virtualization 5.0](microsoft-application-virtualization-50-administrators-guide.md) -### [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) -#### [About App-V 5.0](about-app-v-50.md) -##### [What's New in App-V 5.0](whats-new-in-app-v-50.md) -##### [Release Notes for App-V 5.0](release-notes-for-app-v-50.md) -#### [About App-V 5.0 SP1](about-app-v-50-sp1.md) -##### [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) -##### [Release Notes for App-V 5.0 SP1](release-notes-for-app-v-50-sp1.md) -#### [About App-V 5.0 SP2](about-app-v-50-sp2.md) -##### [Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md) -#### [About App-V 5.0 SP3](about-app-v-50-sp3.md) -##### [Release Notes for App-V 5.0 SP3](release-notes-for-app-v-50-sp3.md) -#### [Evaluating App-V 5.0](evaluating-app-v-50.md) -#### [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md) -#### [Accessibility for App-V 5.0](accessibility-for-app-v-50.md) -### [Planning for App-V 5.0](planning-for-app-v-50-rc.md) -#### [Preparing Your Environment for App-V 5.0](preparing-your-environment-for-app-v-50.md) -##### [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) -##### [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) -##### [App-V 5.0 Security Considerations](app-v-50-security-considerations.md) -#### [Planning to Deploy App-V](planning-to-deploy-app-v.md) -##### [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) -##### [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md) -##### [App-V 5.0 Capacity Planning](app-v-50-capacity-planning.md) -##### [Planning for High Availability with App-V 5.0](planning-for-high-availability-with-app-v-50.md) -##### [Planning to Deploy App-V 5.0 with an Electronic Software Distribution System](planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md) -##### [Planning for the App-V 5.0 Server Deployment](planning-for-the-app-v-50-server-deployment.md) -##### [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) -##### [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md) -##### [Planning for Using App-V with Office](planning-for-using-app-v-with-office.md) -##### [Planning to Use Folder Redirection with App-V](planning-to-use-folder-redirection-with-app-v.md) -#### [App-V 5.0 Planning Checklist](app-v-50-planning-checklist.md) -### [Deploying App-V 5.0](deploying-app-v-50.md) -#### [Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) -##### [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) -##### [About Client Configuration Settings](about-client-configuration-settings.md) -##### [How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md) -##### [How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md) -##### [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md) -##### [How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md) -##### [How to Uninstall the App-V 5.0 Client](how-to-uninstall-the-app-v-50-client.md) -#### [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) -##### [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) -##### [How to Deploy the App-V 5.0 Server Using a Script](how-to-deploy-the-app-v-50-server-using-a-script.md) -##### [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md) -##### [How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer.md) -##### [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md) -##### [How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md) -##### [About App-V 5.0 Reporting](about-app-v-50-reporting.md) -##### [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md) -#### [App-V 5.0 Deployment Checklist](app-v-50-deployment-checklist.md) -#### [Deploying Microsoft Office 2016 by Using App-V](deploying-microsoft-office-2016-by-using-app-v.md) -#### [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) -#### [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) -### [Operations for App-V 5.0](operations-for-app-v-50.md) -#### [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md) -##### [How to Sequence a New Application with App-V 5.0](how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md) -##### [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md) -##### [How to Create and Use a Project Template](how-to-create-and-use-a-project-template.md) -##### [How to Create a Package Accelerator](how-to-create-a-package-accelerator.md) -##### [How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md) -#### [Administering App-V 5.0 Virtual Applications by Using the Management Console](administering-app-v-50-virtual-applications-by-using-the-management-console.md) -##### [About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md) -##### [How to Connect to the Management Console](how-to-connect-to-the-management-console-beta.md) -##### [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md) -##### [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md) -##### [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md) -##### [How to Delete a Package in the Management Console](how-to-delete-a-package-in-the-management-console-beta.md) -##### [How to Add or Remove an Administrator by Using the Management Console](how-to-add-or-remove-an-administrator-by-using-the-management-console.md) -##### [How to Register and Unregister a Publishing Server by Using the Management Console](how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md) -##### [How to Create a Custom Configuration File by Using the App-V 5.0 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md) -##### [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md) -##### [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md) -##### [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md) -#### [Managing Connection Groups](managing-connection-groups.md) -##### [About the Connection Group Virtual Environment](about-the-connection-group-virtual-environment.md) -##### [About the Connection Group File](about-the-connection-group-file.md) -##### [How to Create a Connection Group](how-to-create-a-connection-group.md) -##### [How to Create a Connection Group with User-Published and Globally Published Packages](how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md) -##### [How to Delete a Connection Group](how-to-delete-a-connection-group.md) -##### [How to Publish a Connection Group](how-to-publish-a-connection-group.md) -##### [How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md) -##### [How to Make a Connection Group Ignore the Package Version](how-to-make-a-connection-group-ignore-the-package-version.md) -##### [How to Allow Only Administrators to Enable Connection Groups](how-to-allow-only-administrators-to-enable-connection-groups.md) -#### [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md) -##### [How to deploy App-V 5.0 Packages Using Electronic Software Distribution](how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md) -##### [How to Enable Only Administrators to Publish Packages by Using an ESD](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md) -#### [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md) -##### [How to Access the Client Management Console](how-to-access-the-client-management-console.md) -##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md) -#### [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) -##### [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md) -##### [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md) -##### [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md) -##### [How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) -##### [How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md) -#### [Maintaining App-V 5.0](maintaining-app-v-50.md) -##### [How to Move the App-V Server to Another Computer](how-to-move-the-app-v-server-to-another-computer.md) -#### [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) -##### [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md) -##### [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md) -##### [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md) -##### [How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell.md) -##### [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell.md) -##### [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell.md) -##### [How to Sequence a Package by Using PowerShell](how-to-sequence-a-package--by-using-powershell-50.md) -##### [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell.md) -##### [How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) -##### [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md) -### [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) -### [Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md) -#### [Performance Guidance for Application Virtualization 5.0](performance-guidance-for-application-virtualization-50.md) -#### [Application Publishing and Client Interaction](application-publishing-and-client-interaction.md) -#### [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata.md) -#### [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md) - diff --git a/mdop/appv-v5/about-app-v-50-dynamic-configuration.md b/mdop/appv-v5/about-app-v-50-dynamic-configuration.md deleted file mode 100644 index 03301519d2..0000000000 --- a/mdop/appv-v5/about-app-v-50-dynamic-configuration.md +++ /dev/null @@ -1,889 +0,0 @@ ---- -title: About App-V 5.0 Dynamic Configuration -description: About App-V 5.0 Dynamic Configuration -author: dansimp -ms.assetid: 88afaca1-68c5-45c4-a074-9371c56b5804 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About App-V 5.0 Dynamic Configuration - - -You can use the dynamic configuration to customize an App-V 5.0 package for a user. Use the following information to create or edit an existing dynamic configuration file. - -When you edit the dynamic configuration file it customizes how an App-V 5.0 package will run for a user or group. This helps to provide a more convenient method for package customization by removing the need to re-sequence packages using the desired settings, and provides a way to keep package content and custom settings independent. - -## Advanced: Dynamic Configuration - - -Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no additional customization). If you want to adjust these defaults for a particular user or group, you can create and edit the following files: - -- User Configuration file - -- Deployment configuration file - -The previous .xml files specify package settings and allow for packages to be customized without directly affecting the packages. When a package is created, the sequencer automatically generates default deployment and user configuration .xml files using the package manifest data. Therefore, these automatically generated configuration files simply reflect the default settings that the package innately as from how things were configured during sequencing. If you apply these configuration files to a package in the form generated by the sequencer, the packages will have the same default settings that came from their manifest. This provides you with a package-specific template to get started if any of the defaults must be changed. - -**Note**   -The following information can only be used to modify sequencer generated configuration files to customize packages to meet specific user or group requirements. - - - -### Dynamic Configuration file contents - -All of the additions, deletions, and updates in the configuration files need to be made in relation to the default values specified by the package's manifest information. Review the following table: - - --- - - - - - - - - - - - -

    User Configuration .xml file

    Deployment Configuration .xml file

    Package Manifest

    - - - -The previous table represents how the files will be read. The first entry represents what will be read last, therefore, its content takes precedence. Therefore, all packages inherently contain and provide default settings from the package manifest. If a deployment configuration .xml file with customized settings is applied, it will override the package manifest defaults. If a user configuration .xml file with customized settings is applied prior to that, it will override both the deployment configuration and the package manifest defaults. - -The following list displays more information about the two file types: - -- **User Configuration File (UserConfig)** – Allows you to specify or modify custom settings for a package. These settings will be applied for a specific user when the package is deployed to a computer running the App-V 5.0 client. - -- **Deployment Configuration File (DeploymentConfig)** – Allows you to specify or modify the default settings for a package. These settings will be applied for all users when a package is deployed to a computer running the App-V 5.0 client. - -To customize the settings for a package for a specific set of users on a computer or to make changes that will be applied to local user locations such as HKCU, the UserConfig file should be used. To modify the default settings of a package for all users on a machine or to make changes that will be applied to global locations such as HKEY\_LOCAL\_MACHINE and the all users folder, the DeploymentConfig file should be used. - -The UserConfig file provides configuration settings that can be applied to a single user without affecting any other users on a client: - -- Extensions that will be integrated into the native system per user:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM - -- Virtual Subsystems:- Application Objects, Environment variables, Registry modifications, Services and Fonts - -- Scripts (User context only) - -- Managing Authority (for controlling co-existence of package with App-V 4.6) - -The DeploymentConfig file provides configuration settings in two sections, one relative to the machine context and one relative to the user context providing the same capabilities listed in the UserConfig list above: - -- All UserConfig settings above - -- Extensions that can only be applied globally for all users - -- Virtual Subsystems that can be configured for global machine locations e.g. registry - -- Product Source URL - -- Scripts (Machine context only) - -- Controls to Terminate Child Processes - -### File structure - -The structure of the App-V 5.0 Dynamic Configuration file is explained in the following section. - -### Dynamic User Configuration file - -**Header** - the header of a dynamic user configuration file is as follows: - -<?xml version="1.0" encoding="utf-8"?><UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - -The **PackageId** is the same value as exists in the Manifest file. - -**Body** - the body of the Dynamic User Configuration file can include all the app extension points that are defined in the Manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body: - -1. **Applications** - All app-extensions that are contained in the Manifest file within a package are assigned with an Application ID, which is also defined in the manifest file. This allows you to enable or disable all the extensions for a given application within a package. The **Application ID** must exist in the Manifest file or it will be ignored. - - <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - - <Applications> - - <!-- No new application can be defined in policy. AppV Client will ignore any application ID that is not also in the Manifest file --> - - <Application Id="{a56fa627-c35f-4a01-9e79-7d36aed8225a}" Enabled="false"> - - </Application> - - </Applications> - - … - - </UserConfiguration> - -2. **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under the <Subsystems>: - - <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - - <Subsystems> - - .. - - </Subsystems> - - .. - - </UserConfiguration> - - Each subsystem can be enabled/disabled using the “**Enabled**” attribute. Below are the various subsystems and usage samples. - - **Extensions:** - - Some subsystems (Extension Subsystems) control Extensions. Those subsystems are:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM - - Extension Subsystems can be enabled and disabled independently of the content. Thus if Shortcuts are enabled, The client will use the shortcuts contained within the manifest by default. Each Extension Subsystem can contain an <Extensions> node. If this child element is present, the client will ignore the content in the Manifest file for that subsystem and only use the content in the configuration file. - - Example using the shortcuts subsystem: - - 1. If the user defined this in either the dynamic or deployment config file: - - **<Shortcuts Enabled="true">** - - **<Extensions>** - - ... - - **</Extensions>** - - **</Shortcuts>** - - Content in the manifest will be ignored. - - 2. If the user defined only the following: - - **<Shortcuts Enabled="true"/>** - - Then the content in the Manifest will be integrated during publishing. - - 3. If the user defines the following - - **<Shortcuts Enabled="true">** - - **<Extensions/>** - - **</Shortcuts>** - - Then all the shortcuts within the manifest will still be ignored. There will be no shortcuts integrated. - - The supported Extension Subsystems are: - - **Shortcuts:** This controls shortcuts that will be integrated into the local system. Below is a sample with 2 shortcuts: - - <Subsystems> - - <Shortcuts Enabled="true"> - - <Extensions> - - <Extension Category="AppV.Shortcut"> - - <Shortcut> - - <File>\[{Common Programs}\]\\Microsoft Contoso\\Microsoft ContosoApp Filler 2010.lnk</File> - - <Target>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</Target> - - <Icon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\inficon.exe</Icon> - - <Arguments /> - - <WorkingDirectory /> - - <AppUserModelId>ContosoApp.Filler.3</AppUserModelId> - - <Description>Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp.</Description> - - <Hotkey>0</Hotkey> - - <ShowCommand>1</ShowCommand> - - <ApplicationId>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</ApplicationId> - - </Shortcut> - - </Extension> - - <Extension Category="AppV.Shortcut"> - - <Shortcut> - - <File>\[{AppData}\]\\Microsoft\\Contoso\\Recent\\Templates.LNK</File> - - <Target>\[{AppData}\]\\Microsoft\\Templates</Target> - - <Icon /> - - <Arguments /> - - <WorkingDirectory /> - - <AppUserModelId /> - - <Description /> - - <Hotkey>0</Hotkey> - - <ShowCommand>1</ShowCommand> - - <!-- Note the ApplicationId is optional --> - - </Shortcut> - - </Extension> - - </Extensions> - - </Shortcuts> - - **File-Type Associations:** Associates File-types with programs to open by default as well as setup the context menu. (MIME types can also be setup using this susbsystem). Sample File-type Association is below: - - <FileTypeAssociations Enabled="true"> - - <Extensions> - - <Extension Category="AppV.FileTypeAssociation"> - - <FileTypeAssociation> - - <FileExtension MimeAssociation="true"> - - <Name>.docm</Name> - - <ProgId>contosowordpad.DocumentMacroEnabled.12</ProgId> - - <PerceivedType>document</PerceivedType> - - <ContentType>application/vnd.ms-contosowordpad.document.macroEnabled.12</ContentType> - - <OpenWithList> - - <ApplicationName>wincontosowordpad.exe</ApplicationName> - - </OpenWithList> - - <OpenWithProgIds> - - <ProgId>contosowordpad.8</ProgId> - - </OpenWithProgIds> - - <ShellNew> - - <Command /> - - <DataBinary /> - - <DataText /> - - <FileName /> - - <NullFile>true</NullFile> - - <ItemName /> - - <IconPath /> - - <MenuText /> - - <Handler /> - - </ShellNew> - - </FileExtension> - - <ProgId> - - <Name>contosowordpad.DocumentMacroEnabled.12</Name> - - <DefaultIcon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\contosowordpadicon.exe,15</DefaultIcon> - - <Description>Blah Blah Blah</Description> - - <FriendlyTypeName>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,9182</FriendlyTypeName> - - <InfoTip>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,1424</InfoTip> - - <EditFlags>0</EditFlags> - - <ShellCommands> - - <DefaultCommand>Open</DefaultCommand> - - <ShellCommand> - - <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId> - - <Name>Edit</Name> - - <FriendlyName>&Edit</FriendlyName> - - <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /vu "%1"</CommandLine> - - </ShellCommand> - - </ShellCommand> - - <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId> - - <Name>Open</Name> - - <FriendlyName>&Open</FriendlyName> - - <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /n "%1"</CommandLine> - - <DropTargetClassId /> - - <DdeExec> - - <Application>mscontosowordpad</Application> - - <Topic>ShellSystem</Topic> - - <IfExec>\[SHELLNOOP\]</IfExec> - - <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand> - - </DdeExec> - - </ShellCommand> - - </ShellCommands> - - </ProgId> - - </FileTypeAssociation> - - </Extension> - - </Extensions> - - </FileTypeAssociations> - - **URL Protocols**: This controls the URL Protocols that are integrated into the local registry of the client machine e.g. “mailto:”. - - <URLProtocols Enabled="true"> - - <Extensions> - - <Extension Category="AppV.URLProtocol"> - - <URLProtocol> - - <Name>mailto</Name> - - <ApplicationURLProtocol> - - <DefaultIcon>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE,-9403</DefaultIcon> - - <EditFlags>2</EditFlags> - - <Description /> - - <AppUserModelId /> - - <FriendlyTypeName /> - - <InfoTip /> - - <SourceFilter /> - - <ShellFolder /> - - <WebNavigableCLSID /> - - <ExplorerFlags>2</ExplorerFlags> - - <CLSID /> - - <ShellCommands> - - <DefaultCommand>open</DefaultCommand> - - <ShellCommand> - - <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId> - - <Name>open</Name> - - <CommandLine>\[{ProgramFilesX86}\\Microsoft Contoso\\Contoso\\contosomail.EXE" -c OEP.Note /m "%1"</CommandLine> - - <DropTargetClassId /> - - <FriendlyName /> - - <Extended>0</Extended> - - <LegacyDisable>0</LegacyDisable> - - <SuppressionPolicy>2</SuppressionPolicy> - - <DdeExec> - - <NoActivateHandler /> - - <Application>contosomail</Application> - - <Topic>ShellSystem</Topic> - - <IfExec>\[SHELLNOOP\]</IfExec> - - <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand> - - </DdeExec> - - </ShellCommand> - - </ShellCommands> - - </ApplicationURLProtocol> - - </URLProtocol> - - </Extension> - - </Extension> - - </URLProtocols> - - **Software Clients**: Allows the app to register as an Email client, news reader, media player and makes the app visible in the Set Program Access and Computer Defaults UI. In most cases you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client. - - <SoftwareClients Enabled="true"> - - <ClientConfiguration EmailEnabled="false" /> - - </SoftwareClients> - - AppPaths:- If an application for example contoso.exe is registered with an apppath name of “myapp”, it allows you type “myapp” under the run menu and it will open contoso.exe. - - <AppPaths Enabled="true"> - - <Extensions> - - <Extension Category="AppV.AppPath"> - - <AppPath> - - <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId> - - <Name>contosomail.exe</Name> - - <ApplicationPath>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationPath> - - <PATHEnvironmentVariablePrefix /> - - <CanAcceptUrl>false</CanAcceptUrl> - - <SaveUrl /> - - </AppPath> - - </Extension> - - </Extensions> - - </AppPaths> - - **COM**: Allows an Application register Local COM servers. Mode can be Integration, Isolated or Off. When Isol. - - <COM Mode="Isolated"/> - - **Other Settings**: - - In addition to Extensions, other subsystems can be enabled/disabled and edited: - - **Virtual Kernel Objects**: - - <Objects Enabled="false" /> - - **Virtual Registry**: Used if you want to set a registry in the Virtual Registry within HKCU - - <Registry Enabled="true"> - - <Include> - - <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\ABC"> - - <Value Type="REG\_SZ" Name="Bar" Data="NewValue" /> - - </Key> - - <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\EmptyKey" /> - - </Include> - - <Delete> - - </Registry> - - **Virtual File System** - - <FileSystem Enabled="true" /> - - **Virtual Fonts** - - <Fonts Enabled="false" /> - - **Virtual Environment Variables** - - <EnvironmentVariables Enabled="true"> - - <Include> - - <Variable Name="UserPath" Value="%path%;%UserProfile%" /> - - <Variable Name="UserLib" Value="%UserProfile%\\ABC" /> - - </Include> - - <Delete> - - <Variable Name="lib" /> - - </Delete> - - </EnvironmentVariables> - - **Virtual services** - - <Services Enabled="false" /> - -3. **UserScripts** – Scripts can be used to setup or alter the virtual environment as well as execute scripts at time of deployment or removal, before an application executes, or they can be used to “clean up” the environment after the application terminates. Please reference a sample User configuration file that is output by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used. - -4. **ManagingAuthority** – Can be used when 2 versions of your package are co-existing on the same machine, one deployed to App-V 4.6 and the other deployed on App-V 5.0. To Allow App-V vNext to take over App-V 4.6 extension points for the named package enter the following in the UserConfig file (where PackageName is the Package GUID in App-V 4.6: - - <ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName="032630c0-b8e2-417c-acef-76fc5297fe81" /> - -### Dynamic Deployment Configuration file - -**Header** - The header of a Deployment Configuration file is as follows: - -<?xml version="1.0" encoding="utf-8"?><DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - -The **PackageId** is the same value as exists in the manifest file. - -**Body** - The body of the deployment configuration file includes two sections: - -- User Configuration section –allows the same content as the User Configuration file described in the previous section. When the package is published to a user, any appextensions configuration settings in this section will override corresponding settings in the Manifest within the package unless a user configuration file is also provided. If a UserConfig file is also provided, it will be used instead of the User settings in the deployment configuration file. If the package is published globally, then only the contents of the deployment configuration file will be used in combination with the manifest. - -- Machine Configuration section–contains information that can be configured only for an entire machine, not for a specific user on the machine. For example, HKEY\_LOCAL\_MACHINE registry keys in the VFS. - -<DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="; - -<UserConfiguration> - - .. - -</UserConfiguration> - -<MachineConfiguration> - -.. - -</MachineConfiguration> - -.. - -</MachineConfiguration> - -</DeploymentConfiguration> - -**User Configuration** - use the previous **Dynamic User Configuration file** section for information on settings that are provided in the user configuration section of the Deployment Configuration file. - -Machine Configuration - the Machine configuration section of the Deployment Configuration File is used to configure information that can be set only for an entire machine, not for a specific user on the computer. For example, HKEY\_LOCAL\_MACHINE registry keys in the Virtual Registry. There are four subsections allowed in under this element - -1. **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under <Subsystems>: - - <MachineConfiguration> - - <Subsystems> - - .. - - </Subsystems> - - .. - - </MachineConfiguration> - - The following section displays the various subsystems and usage samples. - - **Extensions**: - - Some subsystems (Extension Subsystems) control Extensions which can only apply to all users. The subsystem is application capabilities. Because this can only apply to all users, the package must be published globally in order for this type of extension to be integrated into the local system. The same rules for controls and settings that apply to the Extensions in the User Configuration also apply to those in the MachineConfiguration section. - - **Application Capabilities**: Used by default programs in windows operating system Interface. Allows an application to register itself as capable of opening certain file extensions, as a contender for the start menu internet browser slot, as capable of opening certain windows MIME types.  This extension also makes the virtual application visible in the Set Default Programs UI.: - - <ApplicationCapabilities Enabled="true"> - - <Extensions> - - <Extension Category="AppV.ApplicationCapabilities"> - - <ApplicationCapabilities> - - <ApplicationId>\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe</ApplicationId> - - <Reference> - - <Name>LitView Browser</Name> - - <Path>SOFTWARE\\LitView\\Browser\\Capabilities</Path> - - </Reference> - - <CapabilityGroup> - - <Capabilities> - - <Name>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12345</Name> - - <Description>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12346</Description> - - <Hidden>0</Hidden> - - <EMailSoftwareClient>Lit View E-Mail Client</EMailSoftwareClient> - - <FileAssociationList> - - <FileAssociation Extension=".htm" ProgID="LitViewHTML" /> - - <FileAssociation Extension=".html" ProgID="LitViewHTML" /> - - <FileAssociation Extension=".shtml" ProgID="LitViewHTML" /> - - </FileAssociationList> - - <MIMEAssociationList> - - <MIMEAssociation Type="audio/mp3" ProgID="LitViewHTML" /> - - <MIMEAssociation Type="audio/mpeg" ProgID="LitViewHTML" /> - - </MIMEAssociationList> - - <URLAssociationList> - - <URLAssociation Scheme="http" ProgID="LitViewHTML.URL.http" /> - - </URLAssociationList> - - </Capabilities> - - </CapabilityGroup> - - </ApplicationCapabilities> - - </Extension> - - </Extensions> - - </ApplicationCapabilities> - - **Other Settings**: - - In addition to Extensions, other subsystems can be edited: - - **Machine Wide Virtual Registry**: Used when you want to set a registry key in the virtual registry within HKEY\_Local\_Machine - - <Registry> - - <Include> - - <Key Path="\\REGISTRY\\Machine\\Software\\ABC"> - - <Value Type="REG\_SZ" Name="Bar" Data="Baz" /> - - </Key> - - <Key Path="\\REGISTRY\\Machine\\Software\\EmptyKey" /> - - </Include> - - <Delete> - - </Registry> - - **Machine Wide Virtual Kernel Objects** - - <Objects> - - <NotIsolate> - - <Object Name="testObject" /> - - </NotIsolate> - - </Objects> - -2. **ProductSourceURLOptOut**: Indicates whether the URL for the package can be modified globally through PackageSourceRoot (to support branch office scenarios). Default is false and the setting change takes effect on the next launch.   - - <MachineConfiguration> - - ..  - - <ProductSourceURLOptOut Enabled="true" /> - - .. - - </MachineConfiguration> - -3. **MachineScripts** – Package can be configured to execute scripts at time of deployment, publishing or removal. Please reference a sample deployment configuration file that is generated by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used - -4. **TerminateChildProcess**:- An application executable can be specified, whose child processes will be terminated when the application exe process is terminated. - - <MachineConfiguration> - - ..    - - <TerminateChildProcesses> - - <Application Path="\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE" /> - - <Application Path="\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe" /> - - <Application Path="\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE" /> - - </TerminateChildProcesses> - - .. - - </MachineConfiguration> - -### Scripts - -The following table describes the various script events and the context under which they can be run. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Script Execution TimeCan be specified in Deployment ConfigurationCan be specified in User ConfigurationCan run in the Virtual Environment of the packageCan be run in the context of a specific applicationRuns in system/user context: (Deployment Configuration, User Configuration)

    AddPackage

    X

    (SYSTEM, N/A)

    PublishPackage

    X

    X

    (SYSTEM, User)

    UnpublishPackage

    X

    X

    (SYSTEM, User)

    RemovePackage

    X

    (SYSTEM, N/A)

    StartProcess

    X

    X

    X

    X

    (User, User)

    ExitProcess

    X

    X

    X

    (User, User)

    StartVirtualEnvironment

    X

    X

    X

    (User, User)

    TerminateVirtualEnvironment

    X

    X

    (User, User)

    - - - -### Create a Dynamic Configuration file using an App-V 5.0 Manifest file - -You can create the Dynamic Configuration file using one of three methods: either manually, using the App-V 5.0 Management Console or sequencing a package, which will be generated with 2 sample files. - -For more information about how to create the file using the App-V 5.0 Management Console see, [How to Create a Custom Configuration File by Using the App-V 5.0 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md). - -To create the file manually, the information above in previous sections can be combined into a single file. We recommend you use files generated by the sequencer. - - - - - - -## Related topics - - -[How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell.md) - -[How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell.md) - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50-reporting.md b/mdop/appv-v5/about-app-v-50-reporting.md deleted file mode 100644 index f5bce3e29a..0000000000 --- a/mdop/appv-v5/about-app-v-50-reporting.md +++ /dev/null @@ -1,327 +0,0 @@ ---- -title: About App-V 5.0 Reporting -description: About App-V 5.0 Reporting -author: dansimp -ms.assetid: 27c33dda-f017-41e3-8a78-1b681543ec4f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.0 Reporting - - -Microsoft Application Virtualization (App-V) 5.0 includes a built-in reporting feature that helps you collect information about computers running the App-V 5.0 client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. - -## App-V 5.0 Reporting Overview - - -The following list displays the end–to-end high-level workflow for reporting in App-V 5.0. - -1. The Microsoft Application Virtualization (App-V) 5.0 Reporting server has the following prerequisites: - - - Internet Information Service (IIS) web server role - - - Windows Authentication role (under **IIS / Security**) - - - SQL Server installed and running with SQL Server Reporting Services (SSRS) - - To confirm SQL Server Reporting Services is running, view `http://localhost/Reports` in a web browser as administrator on the server that will host App-V 5.0 Reporting. The SQL Server Reporting Services Home page should display. - -2. Install the App-V 5.0 reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md). Configure the time when the computer running the App-V 5.0 client should send data to the reporting server. - -3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at . - - **Note**   - If you are using the Configuration Manager integration with App-V 5.0, most reports are generated from Configuration Manager rather than from App-V 5.0. - - - -4. After importing the App-V 5.0 PowerShell module using `Import-Module AppvClient` as administrator, enable the App-V 5.0 client. This sample PowerShell cmdlet enables App-V 5.0 reporting: - - ``` syntax - Set-AppvClientConfiguration –reportingserverurl : -reportingenabled 1 – ReportingStartTime <0-23> - ReportingRandomDelay <#min> - ``` - - To immediately send App-V 5.0 report data, run `Send-AppvClientReport` on the App-V 5.0 client. - - For more information about installing the App-V 5.0 client with reporting enabled see [About Client Configuration Settings](about-client-configuration-settings.md). To administer App-V 5.0 Reporting with Windows PowerShell, see [How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md). - -5. After the reporting server receives the data from the App-V 5.0 client it sends the data to the reporting database. When the database receives and processes the client data, a successful reply is sent to the reporting server and then a notification is sent to the App-V 5.0 client. - -6. When the App-V 5.0 client receives the success notification, it empties the data cache to conserve space. - - **Note**   - By default the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache. - - - -~~~ -If the App-V 5.0 client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache. -~~~ - -### App-V 5.0 reporting server frequently asked questions - -The following table displays answers to common questions about App-V 5.0 reporting - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    QuestionMore Information

    What is the frequency that reporting information is sent to the reporting database?

    The frequency depends on how the reporting task is configured on the computer running the App-V 5.0 client. You must configure the frequency / interval for sending the reporting data. App-V 5.0 Reporting is not enabled by default.

    What information is stored in the reporting server database?

    The following list displays what is stored in the reporting database:

    -
      -
    • The operating system running on the computer running the App-V 5.0 client: host name, version, service pack, type - client/server, processor architecture.

    • -
    • App-V 5.0 Client information: version.

    • -
    • Published package list: GUID, version GUID, name.

    • -
    • Application usage information: name, version, streaming server, user (domain\alias), package version GUID, launch status and time, shutdown time.

    • -

    What is the average volume of information that is sent to the reporting server?

    It depends. The following list displays the three sets of the data sent to the reporting server:

    -
      -
    1. Operating system, and App-V 5.0 client information. ~150 Bytes, every time this data is sent.

    2. -
    3. Published package list. ~7 KB for 30 packages. This is sent only when the package list is updated with a publishing refresh, which is done infrequently; if there is no change, this information is not sent.

    4. -
    5. Virtual application usage information – about 0.25KB per event. Opening and closing count as one event if both occur before sending the information. When sending using a scheduled task, only the data since the last successful upload is sent to the server. If sending manually through the PowerShell cmdlet, there is an optional argument that controls if the data needs to be re-sent next time around – that argument is DeleteOnSuccess.

      -

      -

      So for example, if twenty applications are opened and closed and reporting information is scheduled to be sent daily, the typical daily traffic should be about 0.15KB + 20 x 0.25KB, or about 5KB/user

    6. -

    Can reporting be scheduled?

    Yes. Besides manually sending reporting using PowerShell Cmdlets (Send-AppvClientReport), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting:

    -
      -
    1. Using PowerShell cmdlets - Set-AppvClientConfiguration. For example:

      -

      Set-AppvClientConfiguration -ReportingEnabled 1 - ReportingServerURL http://any.com/appv-reporting

      -

      -

      For a complete list of client configuration settings see About Client Configuration Settings and look for the following entries: ReportingEnabled, ReportingServerURL, ReportingDataCacheLimit, ReportingDataBlockSize, ReportingStartTime, ReportingRandomDelay, ReportingInterval.

      -

    2. -
    3. By using Group Policy. If distributed using the domain controller, the settings are the same as previously listed.

      -
      -Note

      Group Policy settings override local settings configured using PowerShell.

      -
      -
      - -
    4. -
    - - - -## App-V 5.0 Client Reporting - - -To use App-V 5.0 reporting you must install and configure the App-V 5.0 client. After the client has been installed, use the **Set-AppVClientConfiguration** PowerShell cmdlet or the **ADMX Template** to configure reporting. The reporting feature cmdlets are available by using the following link and are prefaced by **Reporting**. For a complete list of client configuration settings see [About Client Configuration Settings](about-client-configuration-settings.md). The following section provides examples of App-V 5.0 client reporting configuration using PowerShell. - -### Configuring App-V Client reporting using PowerShell - -The following examples show how PowerShell parameters can configure the reporting features of the App-V 5.0 client. - -**Note** -The following configuration task can also be configured using Group Policy settings in the App-V 5.0 ADMX template. For more information about using the ADMX template, see [How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md). - - - -**To enable reporting and to initiate data collection on the computer running the App-V 5.0 client**: - -`Set-AppVClientConfiguration –ReportingEnabled 1` - -**To configure the client to automatically send data to a specific reporting server**: - -``` syntax -Set-AppVClientConfiguration –ReportingServerURL http://MyReportingServer:MyPort/ -ReportingStartTime 20 -ReportingInterval 1 -ReportingRandomDelay 30 -``` - -`-ReportingInterval 1 -ReportingRandomDelay 30` - -This example configures the client to automatically send the reporting data to the reporting server URL http://MyReportingServer:MyPort/. Additionally, the reporting data will be sent daily between 8:00 and 8:30 PM, depending on the random delay generated for the session. - -**To limit the size of the data cache on the client**: - -`Set-AppvClientConfiguration –ReportingDataCacheLimit 100` - -Configures the maximum size of the reporting cache on the computer running the App-V 5.0 client to 100 MB. If the cache limit is reached before the data is sent to the server, then the log rolls over and data will be overwritten as necessary. - -**To configure the data block size transmitted across the network between the client and the server**: - -`Set-AppvClientConfiguration –ReportingDataBlockSize 10240` - -Specifies the maximum data block that the client sends to 10240 MB. - -### Types of data collected - -The following table displays the types of information you can collect by using App-V 5.0 reporting. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Client InformationPackage InformationApplication Usage

    Host Name

    Package Name

    Start and End Times

    App-V 5.0 Client Version

    Package Version

    Run Status

    Processor Architecture

    Package Source

    Shutdown State

    Operating System Version

    Percent Cached

    Application Name

    Service Pack Level

    Application Version

    Operating System Type

    Username

    Connection Group

    - - - -The client collects and saves this data in an **.xml** format. The data cache is hidden by default and requires administrator rights to open the XML file. - -### Sending data to the server - -You can configure the computer that is running the App-V 5.0 client to automatically send data to the specified reporting server. To specify the server use the **Set-AppvClientConfiguration** cmdlet with the following settings: - -- ReportingEnabled - -- ReportingServerURL - -- ReportingStartTime - -- ReportingInterval - -- ReportingRandomDelay - -After you configure the previous settings, you must create a scheduled task. The scheduled task will contact the server specified by the **ReportingServerURL** setting and will initiate the transfer. If you want to manually send data outside of the scheduled times, use the following PowerShell cmdlet: - -`Send-AppVClientReport –URL http://MyReportingServer:MyPort/ -DeleteOnSuccess` - -If the reporting server has been previously configured, then the **–URL** parameter can be omitted. Alternatively, if the data should be sent to an alternate location, specify a different URL to override the configured **ReportingServerURL** for this data collection. - -The **-DeleteOnSuccess** parameter indicates that if the transfer is successful, then the data cache is cleared. If this is not specified, then the cache will not be cleared. - -### Manual Data Collection - -You can also use the **Send-AppVClientReport** cmdlet to manually collect data. This solution is helpful with or without an existing reporting server. The following list displays information about collecting data with or without a reporting server. - - ---- - - - - - - - - - - - - -
    With a Reporting ServerWithout a Reporting Server

    If you have an existing App-V 5.0 reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency.

    If you do not have an existing App-V 5.0 reporting Server, use the –URL parameter to send the data to a specified share. For example:

    -

    Send-AppVClientReport –URL \Myshare\MyData\ -DeleteOnSuccess

    -

    The previous example will send the reporting data to \MyShare\MyData</strong> location indicated by the -URL parameter. After the data has been sent, the cache is cleared.

    -
    -Note

    If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing.

    -
    -
    - -
    - - - -### Creating Reports - -To retrieve report information and create reports using App-V 5.0 you must use one of the following methods: - -- **Microsoft SQL Server Reporting Services (SSRS)** - Microsoft SQL Server Reporting Services is available with Microsoft SQL Server. SSRS is not installed when you install the App-V 5.0 reporting server. It must be deployed separately to generate the associated reports. - - Use the following link for more information about using [Microsoft SQL Server Reporting Services](https://go.microsoft.com/fwlink/?LinkId=285596). - -- **Scripting** – You can generate reports by scripting directly against the App-V 5.0 reporting database. For example: - - **Stored Procedure:** - - **spProcessClientReport** is scheduled to run at midnight or 12:00 AM. - - To run the Microsoft SQL Server Scheduled Stored procedure, the Microsoft SQL Server Agent must be running. You should ensure that the Microsoft SQL Server Agent is set to **AutoStart**. For more information see [Autostart SQL Server Agent (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=287045). - - The stored procedure is also created when using the App-V 5.0 database scripts. - -You should also ensure that the reporting server web service’s **Maximum Concurrent Connections** is set to a value that the server will be able to manage without impacting availability. The recommended number of **Maximum Concurrent Connections** for the **Reporting Web Service** is **10,000**. - - - - - - -## Related topics - - -[Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - -[How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50-sp1.md b/mdop/appv-v5/about-app-v-50-sp1.md deleted file mode 100644 index 2222333447..0000000000 --- a/mdop/appv-v5/about-app-v-50-sp1.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: About App-V 5.0 SP1 -description: About App-V 5.0 SP1 -author: dansimp -ms.assetid: 2848a51b-452e-4c70-b465-f6717cfa667f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.0 SP1 - - -This service pack contains the following changes: - -- The App-V 5.0 sequencer and App-V 5.0 client now support twenty-four languages. You can download the additional language packs using the **Volume Licensing Service Center**. - -- The App-V 5.0 server now supports eleven languages. You can download the additional language packs using the **Volume Licensing Service Center**. - -- Support has been added for the App-V 5.0 Volume Shadow Copy Service (VSS) Writer feature. - - **Important**   - To use VSS and App-V 5.0 you must modify the values for the following server registry keys with the updated database names: - - - Management - **HKEY\_LOCAL\_MACHINE** \\ **SOFTWARE** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ManagementService** \\ **MANAGEMENT\_DB\_NAME** - - - Reporting - **HKEY\_LOCAL\_MACHINE** \\ **SOFTWARE** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ReportingService** \\ **REPORTING\_DB\_NAME** - - - -## How to Get MDOP Technologies - - -App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) - -[Release Notes for App-V 5.0 SP1](release-notes-for-app-v-50-sp1.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50-sp2.md b/mdop/appv-v5/about-app-v-50-sp2.md deleted file mode 100644 index f3f167d10a..0000000000 --- a/mdop/appv-v5/about-app-v-50-sp2.md +++ /dev/null @@ -1,183 +0,0 @@ ---- -title: About App-V 5.0 SP2 -description: About App-V 5.0 SP2 -author: dansimp -ms.assetid: 16ca8452-cef2-464e-b4b5-c10d4630fa6a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.0 SP2 - - -App-V 5.0 SP2 provides an improved integrated platform, more flexible virtualization, and powerful management for virtualized applications. For more information see, [App-V 5.0 Overview](https://go.microsoft.com/fwlink/p/?LinkId=325265) (https://go.microsoft.com/fwlink/?LinkId=325265). - -## Changes in Standard App-V 5.0 SP2 Functionality - - -The following sections contain information about the changes in standard functionality for App-V 5.0 SP2. - -### Support for Windows Server 2012 R2 and Windows 8.1 - -App-V 5.0 includes support for Windows Server 2012 R2 and Windows 8.1 - -### App-V 5.0 SP2 now supports folder redirection for the user’s roaming AppData directory - -App-V 5.0 SP2 supports roaming AppData (%AppData%) folder redirection. For more information, see the [Planning to Use Folder Redirection with App-V](planning-to-use-folder-redirection-with-app-v.md). - -### Package upgrade improvements and pending tasks - -In App-V 5.0 SP2, you are no longer prompted to close a running virtual application when a newer version of the package or connection group is published. If a package or connection group is in use when you try to perform a related task, a message displays to indicate that the object is in use, and that the operation will be attempted at a later time. - -Tasks that have been placed in a pending state will be performed according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
    Task typeApplicable rule

    User-based task, e.g., publishing a package to a user

    The pending task will be performed after the user logs off and then logs back on.

    Globally based task, e.g., enabling a connection group globally

    The pending task will be performed when the computer is shut down and then restarted.

    - - - -When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: - - ---- - - - - - - - - - - - - - - - - -
    User-based or globally based taskWhere the registry key is generated

    User-based tasks

    KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks

    Globally based tasks

    HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks

    - - - -### Virtualizing Microsoft Office 2013 and Microsoft Office 2010 using App-V 5.0 - -Use the following link for more information about App-V 5.0 supported Microsoft Office scenarios. - -[Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](../solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md) - -**Note**   -This document focuses on creating a Microsoft Office 2013 App-V 5.0 Package. However, it also provides information about scenarios for Microsoft Office 2010 with App-V 5.0. - - - -### App-V 5.0 Client Management User Interface Application - -In previous versions of App-V 5.0 the Client Management User Interface (UI) was provided with the App-V 5.0 Client installation. With App-V 5.0 SP2 this is no longer the case. Administrators now have the option to deploy the App-V 5.0 Client UI as a Virtual Application (using all supported App-V deployment configurations) or as an installed application. - -For more information see [Microsoft Application Virtualization 5.0 Client UI Application](https://go.microsoft.com/fwlink/p/?LinkId=386345) (https://go.microsoft.com/fwlink/?LinkId=386345). - -### Side-by-Side (SxS) Assembly Automatic Packaging and Deployment - -App-V 5.0 SP2 now automatically detects side-by-side (SxS) assemblies, and deployment on the computer running the App-V 5.0 SP2 client. A SxS assembly primarily consists of VC++ run-time dependencies or MSXML. In previous versions of App-V, virtual applications that had dependencies on VC run-times required these dependencies to be locally on the computer running the App-V 5.0 SP2 client. - -The following functionality is now supported: - -- The App-V 5.0 sequencer automatically captures the SxS assembly in the package regardless of whether the VC run-time has already been installed on the computer running the sequencer. - -- The App-V 5.0 client automatically installs the required SxS assembly to the computer running the client as required at publishing time. - -- The App-V 5.0 sequencer reports the VC run-time dependency using the sequencer reporting mechanism. - -- The App-V 5.0 sequencer now allows you to exclude the VC run-time dependency in the event that the dependency is already available on the computer running the sequencer. - -### Publishing Refresh Improvements - -App-V 5.0 supports several features were added to improve the overall experience of refreshing a set of applications for a specific user. - -The following list displays the publishing refresh enhancements: - -The following list contains more information about how to enable the new publishing refresh improvements. - -- **EnablePublishingRefreshUI** - Enables the publishing refresh progress bar for the computer running the App-V 5.0 Client. - -- **HideUI** - Hides the publishing refresh progress bar during a manual sync. - -### New Client Configuration Setting - -The following new client configuration setting is available with App-V 5.0 SP2: - -**EnableDynamicVirtualization** - Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. - -For more information, see [About Client Configuration Settings](about-client-configuration-settings.md). - -### App-V 5.0 Shell extensions - -App-V 5.0 SP2 now supports shell extensions. - -For more information see the **App-V 5.0 SP2 shell extension support** section of [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md). - -## App-V 5.0 documentation updates - - -App-V 5.0 SP2 provides updated documentation for the following scenarios: - -- [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) - -- [About App-V 5.0](about-app-v-50.md) - -- [About App-V 5.0 Reporting](about-app-v-50-reporting.md) (frequently asked questions section) - -## How to Get MDOP Technologies - - -App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50-sp3.md b/mdop/appv-v5/about-app-v-50-sp3.md deleted file mode 100644 index a784b0b574..0000000000 --- a/mdop/appv-v5/about-app-v-50-sp3.md +++ /dev/null @@ -1,839 +0,0 @@ ---- -title: About App-V 5.0 SP3 -description: About App-V 5.0 SP3 -author: dansimp -ms.assetid: 67b5268b-edc1-4027-98b0-b3937dd70a6b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# About App-V 5.0 SP3 - - -Use the following sections to review information about significant changes that apply to Microsoft Application Virtualization (App-V) 5.0 SP3: - -- [App-V 5.0 SP3 software prerequisites and supported configurations](#bkmk-sp3-prereq-configs) - -- [Migrating to App-V 5.0 SP3](#bkmk-migrate-to-50sp3) - -- [Manually created connection group xml file requires update to schema](#bkmk-update-schema-cg) - -- [Improvements to connection groups](#bkmk-cg-improvements) - -- [Administrators can publish and unpublish packages for a specific user](#bkmk-usersid-pub-pkgs-specf-user) - -- [Enable only administrators to publish and unpublish packages](#bkmk-admins-only-pub-unpub-pkgs) - -- [RunVirtual registry key supports packages that are published to the user](#bkmk-runvirtual-reg-key) - -- [New PowerShell cmdlets and updateable cmdlet help](#bkmk-posh-cmdlets-help) - -- [Primary virtual application directory (PVAD) is hidden but can be turned on](#bkmk-pvad-hidden) - -- [ClientVersion is required to view App-V publishing metadata](#bkmk-pub-metadata-clientversion) - -- [App-V event logs have been consolidated](#bkmk-event-logs-moved) - -## App-V 5.0 SP3 software prerequisites and supported configurations - - -See the following links for the App-V 5.0 SP3 software prerequisites and supported configurations. - - ---- - - - - - - - - - - - - - - - - -
    Links to prerequisites and supported configurationsDescription

    App-V 5.0 SP3 Prerequisites

    Prerequisite software that you must install before starting the App-V 5.0 SP3 installation

    App-V 5.0 SP3 Supported Configurations

    Supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client components

    - - - -## Migrating to App-V 5.0 SP3 - - -Use the following information to upgrade to App-V 5.0 SP3 from earlier versions. - -### Before you start the upgrade - -Review the following information before you start the upgrade: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Items to review before upgradingDescription

    Components to upgrade

      -
    1. App-V Server

    2. -
    3. Sequencer

    4. -
    5. App-V client or App-V Remote Desktop Services (RDS) client

    6. -
    7. Connection groups

    8. -
    -
    -Note

    To use the App-V client user interface, download the existing version from Microsoft Application Virtualization 5.0 Client UI Application.

    -
    -
    - -

    Upgrading from App-V 4.x

    You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.0 SP3.

    -

    For more information, see:

    - -

    Upgrading from App-V 5.0 or later

    You can upgrade to App-V 5.0 SP3 directly from any of the following versions:

    -
      -
    • App-V 5.0

    • -
    • App-V 5.0 SP1

    • -
    • App-V 5.0 SP2

    • -
    -

    To upgrade to App-V 5.0 SP3, follow the steps in the remaining sections of this article.

    Required changes to packages and connection groups after upgrade

    None. Packages and connection groups will continue to work as they currently do.

    - - - -### Steps to upgrade the App-V infrastructure - -Complete the following steps to upgrade each component of the App-V infrastructure to App-V 5.0 SP3. - - ---- - - - - - - - - - - - - - - - - - - - - -
    StepFor more information

    Step 1: Upgrade the App-V Server.

    -

    If you are not using the App-V Server, skip this step and go to the next step.

    -
    -Note

    The App-V 5.0 SP3 client is compatible with the App-V 5.0 SP1 Server.

    -
    -
    - -

    Follow these steps:

    -
      -
    1. Review the Release Notes for App-V 5.0 SP3 for issues that may affect the App-V Server installation.

    2. -
    3. Do one of the following, depending on the method you are using to upgrade the Management database and/or Reporting database:

      - ---- - - - - - - - - - - - - - - - - -
      Database upgrade methodStep

      Windows Installer

      Skip this step and go to step 3, “If you are upgrading the App-V Server...”

      SQL scripts

      ---- - - - - - - - - - - -

      Management database

      To install or upgrade, see SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail.

      Reporting database

      Follow the steps in How to Deploy the App-V Databases by Using SQL Scripts.

      -

      -

    4. -
    5. If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section Check registry keys after installing the App-V 5.0 SP3 Server.

    6. -
    7. Follow the steps in How to Deploy the App-V 5.0 Server.

    8. -

    Step 2: Upgrade the App-V Sequencer.

    See How to Install the Sequencer.

    Step 3: Upgrade the App-V client or App-V RDS client.

    See How to Deploy the App-V Client.

    - - - -### Check registry keys before installing the App-V 5.0 SP3 Server - -This is step 3 from the previous table. - - ---- - - - - - - - - - - - - - - - - - - -

    When this step is required

    You are upgrading from App-V SP1 with any subsequent Hotfix Packages that you installed by using an .msp file.

    Which components require that you do this step

    Only the App-V Server components that you are upgrading.

    When you need to do this step

    Before you upgrade the App-V Server to App-V 5.0 SP3

    What you need to do

    Using the information in the following tables, update each registry key value under HKLM\Software\Microsoft\AppV\Server with the value that you provided in your original server installation. Completing this step restores registry values that may have been removed when App-V SP1 Hotfix Packages were installed.

    - - - -**ManagementDatabase key** - -If you are installing the Management database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementDatabase`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Key nameDescription

    IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED

    Describes whether a public access account is required to access non-local management databases. Value is set to “1” if it is required.

    MANAGEMENT_DB_NAME

    Name of the Management database.

    MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT

    Account used for read (public) access to the Management database.

    -

    Used when IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

    MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_SID

    Secure identifier (SID) of the account used for read (public) access to the Management database.

    -

    Used when IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

    MANAGEMENT_DB_SQL_INSTANCE

    SQL Server instance for the Management database.

    -

    If the value is blank, the default database instance is used.

    MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT

    Account used for write (administrator) access to the Management database.

    MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT_SID

    Secure identifier (SID) of the account used for write (administrator) access to the Management database.

    MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    Management server remote computer account (domain\account).

    MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    Installation administrator login for the Management server (domain\account).

    MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    Valid values are:

    -
      -
    • 1 – the Management service is on the local computer, that is, MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT is blank.

    • -
    • 0 - the Management service is on a different computer from the local computer.

    • -
    - - - -**ManagementService key** - -If you are installing the Management server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementService`. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Key nameDescription

    MANAGEMENT_ADMINACCOUNT

    Active Directory Domain Services (AD DS) group or account that is authorized to manage App-V (domain\account).

    MANAGEMENT_DB_SQL_INSTANCE

    SQL server instance that contains the Management database.

    -

    If the value is blank, the default database instance is used.

    MANAGEMENT_DB_SQL_SERVER_NAME

    Name of the remote SQL server with the Management database.

    -

    If the value is blank, the local computer is used.

    - - - -**ReportingDatabase key** - -If you are installing the Reporting database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingDatabase`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Key nameDescription

    IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED

    Describes whether a public access account is required to access non-local reporting databases. Value is set to “1” if it is required.

    REPORTING_DB_NAME

    Name of the Reporting database.

    REPORTING_DB_PUBLIC_ACCESS_ACCOUNT

    Account used for read (public) access to the Reporting database.

    -

    Used when IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

    REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_SID

    Secure identifier (SID) of the account used for read (public) access to the Reporting database.

    -

    Used when IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

    REPORTING_DB_SQL_INSTANCE

    SQL Server instance for the Reporting database.

    -

    If the value is blank, the default database instance is used.

    REPORTING_DB_WRITE_ACCESS_ACCOUNT

    REPORTING_DB_WRITE_ACCESS_ACCOUNT_SID

    REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    Reporting server remote computer account (domain\account).

    REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    Installation administrator login for the Reporting server (domain\account).

    REPORTING_SERVER_MACHINE_USE_LOCAL

    Valid values are:

    -
      -
    • 1 – the Reporting service is on the local computer, that is, REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT is blank.

    • -
    • 0 - the Reporting service is on a different computer from the local computer.

    • -
    - - - -**ReportingService key** - -If you are installing the Reporting server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingService`. - - ---- - - - - - - - - - - - - - - - - -
    Key nameDescription

    REPORTING_DB_SQL_INSTANCE

    SQL Server instance for the Reporting database.

    -

    If the value is blank, the default database instance is used.

    REPORTING_DB_SQL_SERVER_NAME

    Name of the remote SQL server with the Reporting database.

    -

    If the value is blank, the local computer is used.

    - - - -## Manually created connection group xml file requires update to schema - - -If you are manually creating the connection group XML file, and want to use the new “optional packages” and “use any version” features that are described in [Improvements to connection groups](#bkmk-cg-improvements), you must specify the following schema in the XML file: - -`xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"` - -For examples and more information, see [About the Connection Group File](about-the-connection-group-file.md). - -## Improvements to connection groups - - -You can manage connection groups more easily by using optional packages and other improvements that have been added in App-V 5.0 SP3. The following table summarizes the tasks that you can perform by using the new connection group features, and links to more detailed information about each task. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Task/featureDescriptionLinks to more information

    Enable a connection group to include optional packages

    Including optional packages in a connection group enables you to dynamically determine which applications will be included in the connection group’s virtual environment, based on the applications that users are entitled to.

    -

    You don’t need to manage as many connection groups because you can mix optional and non-optional packages in the same connection group. Mixing packages allows different groups of users to use the same connection group, even though users might have only one package in common.

    -

    Example: You can enable a package with Microsoft Office for all users, but enable different optional packages, which contain different Office plug-ins, to different subsets of users.

    How to Use Optional Packages in Connection Groups

    Unpublish or delete an optional package without changing the connection group

    Unpublish or delete, or unpublish and republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V client.

    How to Use Optional Packages in Connection Groups

    Publish connection groups that contain user-published and globally published packages

    Create a user-published connection group that contains user-published and globally published packages.

    How to Create a Connection Group with User-Published and Globally Published Packages

    Make a connection group ignore the package version

    Configure a connection group to accept any version of a package, which enables you to upgrade a package without having to disable the connection group. In addition, if there is an optional package with an incorrect version in the connection group, the package is ignored and won’t block the connection group’s virtual environment from being created.

    How to Make a Connection Group Ignore the Package Version

    Limit end users’ publishing capabilities

    Enable only administrators (not end users) to publish packages and to enable connection groups.

    For information about connection groups, see How to Allow Only Administrators to Enable Connection Groups

    -

    For information about packages, see the following articles:

    - ---- - - - - - - - - - - - - - - - - - - - - -
    MethodLink to more information

    Management console

    How to Publish a Package by Using the Management Console

    PowerShell

    How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell

    Third-party electronic software delivery system

    How to Enable Only Administrators to Publish Packages by Using an ESD

    -

    Enable or disable a connection group for a specific user

    Administrators can enable or disable a connection group for a specific user by using the optional –UserSID parameter with the following cmdlets:

    -
      -
    • Enable-AppVClientConnectionGroup

    • -
    • Disable-AppVClientConnectionGroup

    • -

    How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell

    Merging identical package paths into one virtual directory in connection groups

    If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment.

    -

    This merging of paths allows an application in one package to access files that are in a different package.

    About the Connection Group Virtual Environment

    - - - -## Administrators can publish and unpublish packages for a specific user - - -Administrators can use the following cmdlets to publish or unpublish packages for a specific user. To use the cmdlets, enter the **–UserSID** parameter, followed by the user’s security identifier (SID). For more information, see: - -- [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-pub-pkg-a-user-standalone-posh) - -- [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-unpub-pkg-specfc-use) - - ---- - - - - - - - - - - - - - - - - -
    CmdletExamples

    Publish-AppvClientPackage

    Publish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    Unpublish-AppvClientPackage

    Unpublish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    - - - -## Enable only administrators to publish and unpublish packages - - -You can enable only administrators (not end users) to publish and unpublish packages by using one of the following methods: - - ---- - - - - - - - - - - - - - - - - -
    MethodMore information

    Group Policy setting

    Navigate to the following Group Policy Object node:

    -

    Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing.

    -

    Enable the Require publish as administrator Group Policy setting.

    PowerShell

    How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell

    - - - -## RunVirtual registry key supports packages that are published to the user - - -App-V 5.0 SP3 adds support for using the **RunVirtual** registry key with virtualized applications that are in user-published packages. The **RunVirtual** registry key lets you run a locally installed application in a virtual environment, along with applications that have been virtualized by using App-V. - -Previously, the virtualized applications in App-V packages had to be published globally. For more about **RunVirtual** and about other methods of running locally installed applications in a virtual environment with virtualized applications, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md). - -## New PowerShell cmdlets and updateable cmdlet help - - -New PowerShell cmdlets and updateable cmdlet help are included in App-V 5.0 SP3. To download the cmdlet modules, see [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md#bkmk-load-cmdlets). - -### New App-V 5.0 SP3 Server PowerShell cmdlets - -New Windows PowerShell cmdlets for the App-V Server have been added to help you manage connection groups. - - ---- - - - - - - - - - - - - - - - - - - - - -
    CmdletDescription

    Add-AppvServerConnectionGroupPackage

    Appends a package to the end of a connection group's package list and enables you to configure the package as optional and/or with no version within the connection group.

    Set-AppvServerConnectionGroupPackage

    Enables you to edit details about the connection group package, such as whether it is optional.

    Remove-AppvServerConnectionGroupPackage

    Removes a package from a connection group.

    - - - -### Getting help for the PowerShell cmdlets - -Cmdlet help is available in the following formats: - - ---- - - - - - - - - - - - - - - - - -
    FormatDescription

    As a downloadable module

    To get the latest help after downloading the cmdlet module:

    -
      -
    1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).

    2. -
    3. Type one of the following commands to load the cmdlets for the module you want:

    4. -
    - ---- - - - - - - - - - - - - - - - - - - - - -
    App-V componentCommand to type

    App-V Server

    Update-Help-Module AppvServer

    App-V Sequencer

    Update-Help-Module AppvSequencer

    App-V client

    Update-Help-Module AppvClient

    -

    On TechNet as web pages

    See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.

    - - - -For more information, see [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md). - -## Primary virtual application directory (PVAD) is hidden but can be turned on - - -The primary virtual application directory (PVAD) is hidden in App-V 5.0 SP3, but you can turn it back on and make it visible by using one of the following methods: - - ---- - - - - - - - - - - - - - - - - -
    MethodSteps

    Use a command line parameter

    Pass the –EnablePVADControl parameter to the Sequencer.exe.

    Create a registry subkey

      -
    1. In the Registry Editor, navigate to: HKLM\SOFTWARE\Microsoft\AppV\Sequencer\Compatibility

      -
      -Note

      If the Compatibility subkey doesn’t exist, you must create it.

      -
      -
      - -
    2. -
    3. Create a DWORD Value named EnablePVADControl, and set the value to 1.

      -

      A value of 0 means that PVAD is hidden.

    4. -
    - - - -**More about PVAD:** When you use the Sequencer to create a package, you can enter any installation path for the package. In past versions of App-V, you were required to specify the primary virtual application directory (PVAD) of the application as the path. PVAD is the directory to which you would typically install an application on your local computer if you weren’t using App-V. For example, if you were installing Office on a computer, the PVAD typically would be C:\\Program Files\\Microsoft Office\\. - -## ClientVersion is required to view App-V publishing metadata - - -In App-V 5.0 SP3, you must provide the following values in the address when you query the App-V Publishing server for metadata: - - ---- - - - - - - - - - - - - - - - - -
    ValueAdditional details

    ClientVersion

    If you omit the ClientVersion parameter from the query, the metadata excludes the new App-V 5.0 SP3 features.

    ClientOS

    You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query.

    -

    If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata.

    - - - -For syntax and examples of this query, see [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata.md). - -## App-V event logs have been consolidated - - -The following event logs, previously located at **Applications and Services Logs/Microsoft/AppV/<App-V component>**, have been moved to **Applications and Services Logs/Microsoft/AppV/ServiceLog**. - -To view the logs, select **View** > **Show Analytic and Debug Logs** in the Event Viewer application. - -Client-Catalog Client-Integration Client-Orchestration Client-PackageConfig Client-Scripting Client-Service Client-Vemgr Client-VFSC FilesystemMetadataLibrary ManifestLibrary PolicyLibrary Subsystems-ActiveX Subsystems-AppPath Subsystems-Com Subsystems-fta - -## How to Get MDOP Technologies - - -App-V is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[Release Notes for App-V 5.0 SP3](release-notes-for-app-v-50-sp3.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-50.md b/mdop/appv-v5/about-app-v-50.md deleted file mode 100644 index a81421348c..0000000000 --- a/mdop/appv-v5/about-app-v-50.md +++ /dev/null @@ -1,113 +0,0 @@ ---- -title: About App-V 5.0 -description: About App-V 5.0 -author: dansimp -ms.assetid: 5799141b-44bc-4033-afcc-212235e15f00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.0 - - -App-V 5.0 provides an improved integrated platform, more flexible virtualization, and powerful management for virtualized applications. For more information see the [App-V 5.0 Overview](https://go.microsoft.com/fwlink/?LinkId=325265) (https://go.microsoft.com/fwlink/?LinkId=325265). - -## What’s new? - - -The following list displays what is new with App-V 5.0: - -- **IT Diagnostics and Monitoring** - App-V 5.0 enhances the ability to generate reporting information about computers running the App-V 5.0 client and virtualized packages. - -- **End-to-End Programmability** - Leveraging PowerShell 3.0, App-V 5.0 offers a complete programmability solution for packaging, client and server operations. - -- **Simple and Effective Client Console** - App-V 5.0 offers a modern client console designed to simplify the top end user and Tier 1 support engineer scenarios. - -- **Virtual Application Extensions** - App-V 5.0 virtual application extensions enable virtual packages to run as if they are installed locally. - -- **Local Drive Creation** - App-V 5.0 no longer requires a dedicated local drive letter for virtual application deployment. - -- **Shared Content Store** – The App-V 5.0 shared content store offers similar functionality to the streaming server available in previous versions of App-V. It also requires less disk space and updates to virtual applications are available as soon as the new version is ready. - -- **Connection Groups** - App-V 5.0 connection groups allow you to connect and run virtual applications interactively. - -## Differences between App-V 4.6 and App-V 5.0 - - -The following table displays some of the differences between App-V 4.6 and App-V 5.0: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    App-V 4.6App-V 5.0

    Must Use a dedicated drive letter (Q:</strong>).

    No dedicated drive letter required.

    4 GB package size limit requirement.

    No 4 GB package size limit requirement.

    Virtual applications are isolated from locally installed applications.

    Virtual applications can be extended to support local application interaction.

    Dynamic Suite Composition enabled interaction with middleware applications.

    Peer applications are shared using connection groups. For more information about connection groups see, Managing Connection Groups.

    VDI/RDS environments required a read-only shared cache.

    You can update the shared content store using the standard workflow.

    Limited command-line scripting.

    Supports robust PowerShell scripting for the sequencer, client, and server components.

    Provides web-based management capabilities.

    - - - -## How to Get MDOP Technologies - - -App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md b/mdop/appv-v5/about-app-v-51-dynamic-configuration.md deleted file mode 100644 index 663c596d68..0000000000 --- a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md +++ /dev/null @@ -1,953 +0,0 @@ ---- -title: About App-V 5.1 dynamic configuration -description: You can use the dynamic configuration to customize an App-V 5.1 package for a user. Use the following information to create or edit an existing dynamic configuration file. -author: dansimp -ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74 -ms.reviewer: -manager: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/28/2018 -ms.author: dansimp ---- - -# About App-V 5.1 dynamic configuration -With dynamic configuration, you can edit the dynamic configuration file to customize how an App-V 5.1 package runs for a user or group. Package customization removes the need to resequence packages using the desired settings. It also provides a way to keep package content and custom settings independent. - -Virtual application packages contain a manifest that provides all the core information for the package. This information includes the defaults for the package settings and determines settings in the most basic form (with no additional customization). - -When a package gets created, the sequencer generates default deployment and user configuration .xml files automatically using the package manifest data. Therefore, these generated files reflect the default settings configured during sequencing. If you apply these files to a package in the form generated by the sequencer, the packages have the same default settings that came from their manifest. - -Use these generated files to make changes, if necessary, which doesn’t directly affect the package. If you want to add, delete or update the configuration files, make your changes about the default values in the manifest information. - ->[!TIP] ->The order in which the files read are:
    • UserConfig.xml
    • DeploymentConfig.xml
    • Manifest

    The first entry represents what gets read last. Therefore, its content takes precedence, and all packages inherently contain and provide default settings from the package manifest.

    1. If customizing the DeploymentConfig.xml file and apply the customized settings, the default settings in the package manifest get overridden.
    2. If customizing the UserConfig.xml and apply the customized settings, the default settings for both the deployment configuration and the package manifest get overridden.
    - -## User configuration file contents (UserConfig.xml) -The UserConfig file provides configuration settings that get applied for a specific user when deploying the package to a computer running the App-V 5.1 client. These settings don’t affect any other users on the client. - -Use the UserConfig file to specify or modify custom settings for a package: - -- Extensions integrated into the native system per user: shortcuts, file-type associations, URL protocols, AppPaths, software clients and COM -- Virtual subsystems: application objects, environment variables, registry modifications, services and fonts -- Scripts (user context only) -- Managing authority (for controlling co-existence of package with App-V 4.6) - -### Header - -The header of a dynamic user configuration file looks like: - -```xml - -``` - -The **PackageId** is the same value as exists in the manifest file. - - -### Body - -The body of the dynamic user configuration file can include all the app extension points defined in the manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body: - -1. **[Applications](#applications)** -2. **[Subsystems](#subsystems)** -3. **[UserScripts](#userscripts)** -4. **[ManagingAuthority](#managingauthority)** - -#### Applications - -All app-extensions contained in the manifest file within a package have an Application ID assigned, which you find in the manifest file. The Application ID lets you enable or disable all extensions for a given application within a package. The Application ID must exist in the manifest file, or it gets ignored. - -```XML - - - - - - - - - - - - -.. - - -``` - -#### Subsystems - -AppExtensions and other subsystems arranged as subnodes. - -```XML - - - - -.. - - - -.. - - -``` - -You can enable or disable each subsystem using the **Enabled** attribute. - -**Extensions** - -Some subsystems (extension subsystems) control extensions. Those subsystems are Shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients, and COM. - -Extension subsystems can be enabled and disabled independently of the content. For example, if you enable Shortcuts, the client uses the Shortcuts contained within the manifest by default. Each extension subsystem can contain an \ node. If this child element is present, the client ignores the content in the manifest file for that subsystem and only use the content in the configuration file. - -_**Examples:**_ - -- If you define this in either the user or deployment config file, the content in the manifest gets ignored. - - ```XML - - - - - - ... - - - - - ``` -- If you define only the following, the content in the manifest gets integrated during publishing. - - ```XML - - - ``` - -- If you define the following, all Shortcuts within the manifest still get ignored. In other words, no Shortcuts get integrated. - - ```XML - - - - - - - ``` - -_**Supported extension subsystems:**_ - -**Shortcuts** extension subsystem controls what shortcuts get integrated into the local system. - -```XML - - - - - - - - - - - - [{Common Programs}]\Microsoft Contoso\Microsoft ContosoApp Filler 2010.lnk - - [{PackageRoot}]\Contoso\ContosoApp.EXE - - - [{Windows}]\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe - - - - - - ContosoApp.Filler.3 - - Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp. - - 0 - - 1 - - [{PackageRoot}]\Contoso\ContosoApp.EXE - - - - - - - - - - [{AppData}]\Microsoft\Contoso\Recent\Templates.LNK - - [{AppData}]\Microsoft\Templates - - - - - - - - - - - - 0 - - 1 - - - - - - - - - - -``` - -**File-Type Associates** extension subsystem associates file types with programs to open by default as well as set up the context menu. - ->[!TIP] ->You can set up the subsystem with MIME types. - -```XML - - - - - - - - - - - - .docm - - contosowordpad.DocumentMacroEnabled.12 - - document - - application/vnd.ms-contosowordpad.document.macroEnabled.12 - - - - wincontosowordpad.exe - - - - - - contosowordpad.8 - - - - - - - - - - - - - - true - - - - - - - - - - - - - - - - contosowordpad.DocumentMacroEnabled.12 - - [{Windows}]\Installer\{90140000-0011-0000-0000-000000FF1CE}\contosowordpadicon.exe,15 - - Blah Blah Blah - - [{FOLDERID_ProgramFilesX86}]\Microsoft Contoso 14\res.dll,9182 - - [{FOLDERID_ProgramFilesX86}]\Microsoft Contoso 14\res.dll,1424 - - 0 - - - - Open - - - - {e56fa627-c35f-4a01-9e79-7d36aed8225a} - - Edit - - &Edit - - "[{PackageRoot}]\Contoso\WINcontosowordpad.EXE" /vu "%1" - - - - - - {e56fa627-c35f-4a01-9e79-7d36aed8225a} - - Open - - &Open - - "[{PackageRoot}]\Contoso\WINcontosowordpad.EXE" /n "%1" - - - - - - mscontosowordpad - - ShellSystem - - [SHELLNOOP] - - [SetForeground][ShellNewDatabase"%1"] - - - - - - - - - - - - - - - - -``` - -**URL Protocols** extension subsystem controls the URL protocols integrated into the local registry of the client machine, for example, _mailto:_. - -```XML - - - - - - - - - - mailto - - - - [{ProgramFilesX86}]\MicrosoftContoso\Contoso\contosomail.EXE,-9403 - - 2 - - - - - - - - - - - - - - - - 2 - - - - - - open - - - - [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE - - open - - [{ProgramFilesX86}\Microsoft Contoso\Contoso\contosomail.EXE" -c OEP.Note /m "%1" - - - - - - 0 - - 0 - - 2 - - - - - - contosomail - - ShellSystem - - [SHELLNOOP] - - [SetForeground][ShellNewDatabase "%1"] - - - - - - - - - - - - - - - - -``` - -**Software Clients** extension subsystem allows the app to register as an email client, news reader, media player and makes the app visible in the Set program access and Computer defaults UI. In most cases, you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client. - -```XML - - - - - - -``` - -**AppPaths** extension subsystem opens apps registered with an application path. For example, if contoso.exe has an apppath name of _myapp_, users can type _myapp_ from the run menu, opening contoso.exe. - -```XML - - - - - - - - - - [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE - - contosomail.exe - - [{ProgramFilesX86}]\Microsoft Contoso\Contoso\contosomail.EXE - - - - false - - - - - - - - - - -``` - -**COM** extensions subsystem allows an application registered to local COM servers. The mode can be: - -- Integration -- Isolated -- Off - -```XML - - -``` - -**Virtual Kernel Objects** - -```XML - - -``` - -**Virtual Registry** sets a registry in the virtual registry within HKCU. - -```XML - - - - - - - - - - - - - - - - - - -``` - -**Virtual File System** - -```XML - - -``` - -**Virtual Fonts** - -```XML - - -``` - -**Virtual Environment Variables** - -```XML - - - - - - - - - - - - - - - - - - -``` - -**Virtual services** - -```XML - - -``` - -#### UserScripts - -Use UserScripts to set up or alter the virtual environment. You can also execute scripts at the time of deployment or to clean up the environment after the application terminates. To see a sample script, refer to the user configuration file generated by the sequencer. -The Scripts section below provides more information on the various triggers that can be used. - -#### ManagingAuthority - -Use ManagingAuthority when two versions of your package co-exist on the same machine, one deployed to App-V 4.6 and another deployed on App-V 5.0. To allow App-V vNext to take over App-V 4.6 extension points for the named package enter the following in the UserConfig file (where PackageName is the Package GUID in App-V 4.6: - -```XML - - -``` - -## Deployment configuration file (DeploymentConfig.xml) - -The DeploymentConfig file provides configuration settings for machine context and user context, providing the same capabilities listed in the UserConfig file. The setting get applied when deploying the package to a computer running the App-V 5.1 client. - -Use the DeploymentConfig file to specify or modify custom settings for a package: - -- All UserConfig settings -- Extensions that can only be applied globally for all users -- Virtual subsystems for global machine locations, for example, registry -- Product source URL -- Scripts (machine context only) -- Controls to terminate child processes - -### Header - -The header of a dynamic deployment configuration file looks like: - -```XML - -``` - -The **PackageId** is the same value as exists in the manifest file. - -### Body - -The body of the dynamic deployment configuration file includes two sections: - -- **UserConfiguration:** allows the same content as the user configuration file described in the previous section. When publishing the package to a user, any appextensions configuration settings in this section override corresponding settings in the manifest within the package, unless you provide a user configuration file. If also providing a UserConfig file, it gets used instead of the User settings in the deployment configuration file. If publishing the package globally, then only the contents of the deployment configuration file get used in combination with the manifest. For more details, see [User configuration file contents (UserConfig.xml)](#user-configuration-file-contents-userconfigxml). - -- **MachineConfiguration:** contains information that can be configured only for an entire machine, not for a specific user on the machine. For example, HKEY_LOCAL_MACHINE registry keys in the VFS. - -```XML - - - - - -... - - - - - -... - - - -... - - - - -``` - -### UserConfiguration - -Refer to [User configuration file contents (UserConfig.xml)](#user-configuration-file-contents-userconfigxml) for information on the settings provided for this section. - -### MachineConfiguration - -Use the MachineConfiguration section to configure information for an entire machine; not for a specific user on the computer. For example, HKEY_LOCAL_MACHINE registry keys in the virtual registry. There are four subsections allowed in under this element: - -1. **[Subsystems](#subsystems-1)** -2. **[ProductSourceURLOptOut](#productsourceurloptout)** -3. **[MachineScripts](#machinescripts)** -4. **[TerminateChildProcess](#terminatechildprocess)** - -#### Subsystems - -AppExtensions and other subsystems arranged as subnodes. - -```XML - - - - - - … - - - -… - - -``` - -You can enable or disable each subsystem using the **Enabled** attribute. - -**Extensions** - -Some subsystems (extension subsystems) control extensions. The subsystem is Application Capabilities that default programs use. For this type of extension, the package must be published globally for integration into the local system. The same rules for controls and settings that apply to the Extensions in the User Configuration also, apply to those in the MachineConfiguration section. - -**Application Capabilities**: Used by default programs that allow an application to register itself as: - -- Capable of opening specific file extensions -- A contender for the start menu internet browser slot -- Capable of opening specific windows MIME types - -This extension also makes the virtual application visible in the Set default programs UI. - -```XML - - - - - - - - - - - [{PackageRoot}]\LitView\LitViewBrowser.exe - - - - LitView Browser - - SOFTWARE\LitView\Browser\Capabilities - - - - - - - - - @[{ProgramFilesX86}]\LitView\LitViewBrowser.exe,-12345 - - - @[{ProgramFilesX86}]\LitView\LitViewBrowser.exe,-12346 - - 0 - - Lit View E-Mail Client - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -_**Supported extension subsystems:**_ - -**Machine Wide Virtual Registry** extension subsystem sets a registry key in the virtual registry within HKEY_Local_Machine. - -```XML - - - - - - - - - - - - - - - - - - -``` - -**Machine Wide Virtual Kernel Objects** - -```XML - - - - - - - - - - -``` - -#### ProductSourceURLOptOut - -Use ProductSourceURLOptOut to indicate that the URL for the package can be modified globally through _PackageSourceRoot_ (to support branch office scenarios). Changes take effect on the next launch. - -```XML - - - - ... - - - - ... - - -``` - -#### MachineScripts - -The package can be configured to execute scripts at time of deployment, publishing or removal. To see a sample script, refer to the deployment configuration file generated by the sequencer. - -The Scripts section below provides more information on the various triggers that can be used. - -#### TerminateChildProcess - -An application executable can be specified, whose child processes get terminated when the application exe process terminates. - -```XML - - - - ... - - - - - - - - - - - - ... - - -``` - - - -## Scripts - -The following table describes the various script events and the context under which they can be run. - -| Script Execution Time | Can be specified in Deployment Configuration | Can be specified in User Configuration | Can run in the Virtual Environment of the package | Can be run in the context of a specific application | Runs in system/user context: (Deployment Configuration, User Configuration) | -|-----------------------------|----------------------------------------------|----------------------------------------|---------------------------------------------------|-----------------------------------------------------|-----------------------------------------------------------------------------| -| AddPackage | X | | | | (SYSTEM, N/A) | -| PublishPackage | X | X | | | (SYSTEM, User) | -| UnpublishPackage | X | X | | | (SYSTEM, User) | -| RemovePackage | X | | | | (SYSTEM, N/A) | -| StartProcess | X | X | X | X | (User, User) | -| ExitProcess | X | X | | X | (User, User) | -| StartVirtualEnvironment | X | X | X | | (User, User) | -| TerminateVirtualEnvironment | X | X | | | (User, User) | - -### Using multiple scripts on a single event trigger - -App-V 5.1 supports the use of multiple scripts on a single event trigger for -App-V packages, including packages that you convert from App-V 4.6 to App-V 5.0 -or later. To enable the use of multiple scripts, App-V 5.1 uses a script -launcher application, named ScriptRunner.exe, which is installed as part of the -App-V client installation. - -### How to use multiple scripts on a single event trigger - -For each script that you want to run, pass that script as an argument to the -ScriptRunner.exe application. The application then runs each script separately, -along with the arguments that you specify for each script. Use only one script -(ScriptRunner.exe) per trigger. - -> [!NOTE] -> -> We recommended that you run the multi-script line from a command prompt -> first to make sure that all arguments are built correctly before adding them to -> the deployment configuration file. - -### Example script and parameter descriptions - -Using the following example file and table, modify the deployment or user -configuration file to add the scripts that you want to run. - -```XML - - - ScriptRunner.exe - - -appvscript script1.exe arg1 arg2 –appvscriptrunnerparameters –wait –timeout=10 - -appvscript script2.vbs arg1 arg2 - -appvscript script3.bat arg1 arg2 –appvscriptrunnerparameters –wait –timeout=30 –rollbackonerror - - - - -``` - - -**Parameters in the example file include:** - -#### \ - -Name of the event trigger for which you are running a script, such as adding a package or publishing a package. - -#### \ScriptRunner.exe\ - -The script launcher application that is installed as part of the App-V client installation. - -> [!NOTE] -> -> Although ScriptRunner.exe is installed as part of the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:FilesApplication Virtualizationfolder. - -#### \ - -`-appvscript` - Token that represents the actual script that you want to run. - -`script1.exe` – Name of the script that you want to run. - -`arg1 arg2` – Arguments for the script that you want to run. - -`-appvscriptrunnerparameters` – Token that represents the execution options for script1.exe. - -`-wait` – Token that informs ScriptRunner to wait for execution of script1.exe to complete before proceeding to the next script. - -`-timeout=x` – Token that informs ScriptRunner to stop running the current script after x number of seconds. All other specified scripts still runs. - -`-rollbackonerror` – Token that informs ScriptRunner to stop running all scripts that haven't yet run and to roll back an error to the App-V client. - -#### \ - -Waits for overall completion of ScriptRunner.exe. - -Set the timeout value for the overall runner to be greater than or equal to the sum of the timeout values on the individual scripts. - -If any individual script reported an error and rollbackonerror was set to true, then ScriptRunner would report the error to App-V client. - -ScriptRunner runs any script whose file type is associated with an application installed on the computer. If the associated application is missing, or the script’s file type is not associated with any application on the computer, the script does not run. - -### Create a dynamic configuration file using an App-V 5.1 manifest file - -You can create the dynamic configuration file using one of three methods: either manually, using the App-V 5.1 Management Console or sequencing a package, which generates two sample files. For more information about how to create the file using the App-V 5.1 Management Console see, [How to create a custom configuration File by using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md). - -To create the file manually, the information above in previous sections can be combined into a single file. We recommend you use files generated by the sequencer. - - - -- Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). -- For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - -- [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md) - -- [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - ---- diff --git a/mdop/appv-v5/about-app-v-51-reporting.md b/mdop/appv-v5/about-app-v-51-reporting.md deleted file mode 100644 index 381a1231a7..0000000000 --- a/mdop/appv-v5/about-app-v-51-reporting.md +++ /dev/null @@ -1,253 +0,0 @@ ---- -title: About App-V 5.1 Reporting -description: About App-V 5.1 Reporting -author: dansimp -ms.assetid: 385dca00-7178-4e35-8d86-c58867ebd65c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.1 Reporting - -Microsoft Application Virtualization (App-V) 5.1 includes a built-in reporting feature that helps you collect information about computers running the App-V 5.1 client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. - -## App-V 5.1 Reporting Overview - -The following list displays the end–to-end high-level workflow for reporting in App-V 5.1. - -1. The App-V 5.1 Reporting server has the following prerequisites: - - - Internet Information Service (IIS) web server role - - - Windows Authentication role (under **IIS / Security**) - - - SQL Server installed and running with SQL Server Reporting Services (SSRS) - - To confirm SQL Server Reporting Services is running, view `http://localhost/Reports` in a web browser as administrator on the server that will host App-V 5.1 Reporting. The SQL Server Reporting Services Home page should display. - -2. Install the App-V 5.1 reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md). Configure the time when the computer running the App-V 5.1 client should send data to the reporting server. - -3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined SSRS Reports from the [Download Center](https://go.microsoft.com/fwlink/?LinkId=397255). - - > [!NOTE] - > If you are using the Configuration Manager integration with App-V 5.1, most reports are generated from Configuration Manager rather than from App-V 5.1. - -4. After importing the App-V 5.1 PowerShell module using `Import-Module AppvClient` as administrator, enable the App-V 5.1 client. This sample PowerShell cmdlet enables App-V 5.1 reporting: - - ```powershell - Set-AppvClientConfiguration –reportingserverurl : -reportingenabled 1 – ReportingStartTime <0-23> - ReportingRandomDelay <#min> - ``` - - To immediately send App-V 5.1 report data, run `Send-AppvClientReport` on the App-V 5.1 client. - - For more information about installing the App-V 5.1 client with reporting enabled see [About Client Configuration Settings](about-client-configuration-settings51.md). To administer App-V 5.1 Reporting with Windows PowerShell, see [How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md). - -5. After the reporting server receives the data from the App-V 5.1 client it sends the data to the reporting database. When the database receives and processes the client data, a successful reply is sent to the reporting server and then a notification is sent to the App-V 5.1 client. - -6. When the App-V 5.1 client receives the success notification, it empties the data cache to conserve space. - - > [!NOTE] - > By default the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache. - -If the App-V 5.1 client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache. - -### App-V 5.1 reporting server frequently asked questions - -The following table displays answers to common questions about App-V 5.1 reporting - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    QuestionMore Information

    What is the frequency that reporting information is sent to the reporting database?

    The frequency depends on how the reporting task is configured on the computer running the App-V 5.1 client. You must configure the frequency / interval for sending the reporting data. App-V 5.1 Reporting is not enabled by default.

    What information is stored in the reporting server database?

    The following list displays what is stored in the reporting database:

    -
      -
    • The operating system running on the computer running the App-V 5.1 client: host name, version, service pack, type - client/server, processor architecture.

    • -
    • App-V 5.1 Client information: version.

    • -
    • Published package list: GUID, version GUID, name.

    • -
    • Application usage information: name, version, streaming server, user (domain\alias), package version GUID, launch status and time, shutdown time.

    • -

    What is the average volume of information that is sent to the reporting server?

    It depends. The following list displays the three sets of the data sent to the reporting server:

    -
      -
    1. Operating system, and App-V 5.1 client information. ~150 Bytes, every time this data is sent.

    2. -
    3. Published package list. ~7 KB for 30 packages. This is sent only when the package list is updated with a publishing refresh, which is done infrequently; if there is no change, this information is not sent.

    4. -
    5. Virtual application usage information – about 0.25KB per event. Opening and closing count as one event if both occur before sending the information. When sending using a scheduled task, only the data since the last successful upload is sent to the server. If sending manually through the PowerShell cmdlet, there is an optional argument that controls if the data needs to be re-sent next time around – that argument is DeleteOnSuccess.

      -

      -

      So for example, if twenty applications are opened and closed and reporting information is scheduled to be sent daily, the typical daily traffic should be about 0.15KB + 20 x 0.25KB, or about 5KB/user

    6. -

    Can reporting be scheduled?

    Yes. Besides manually sending reporting using PowerShell Cmdlets (Send-AppvClientReport), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting:

    -
      -
    1. Using PowerShell cmdlets - Set-AppvClientConfiguration. For example:

      -

      Set-AppvClientConfiguration -ReportingEnabled 1 - ReportingServerURL http://any.com/appv-reporting

      -

      -

      For a complete list of client configuration settings see About Client Configuration Settings and look for the following entries: ReportingEnabled, ReportingServerURL, ReportingDataCacheLimit, ReportingDataBlockSize, ReportingStartTime, ReportingRandomDelay, ReportingInterval.

      -

    2. -
    3. By using Group Policy. If distributed using the domain controller, the settings are the same as previously listed.

      -
      -Note

      Group Policy settings override local settings configured using PowerShell.

      -
      -
      -
    4. -
    - -## App-V 5.1 Client Reporting - -To use App-V 5.1 reporting you must install and configure the App-V 5.1 client. After the client has been installed, use the **Set-AppVClientConfiguration** PowerShell cmdlet or the **ADMX Template** to configure reporting. The reporting feature cmdlets are available by using the following link and are prefaced by **Reporting**. For a complete list of client configuration settings see [About Client Configuration Settings](about-client-configuration-settings51.md). The following section provides examples of App-V 5.1 client reporting configuration using PowerShell. - -### Configuring App-V Client reporting using PowerShell - -The following examples show how PowerShell parameters can configure the reporting features of the App-V 5.1 client. - -> [!NOTE] -> The following configuration task can also be configured using Group Policy settings in the App-V 5.1 ADMX template. For more information about using the ADMX template, see [How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md). - -**To enable reporting and to initiate data collection on the computer running the App-V 5.1 client**: - -```powershell -Set-AppVClientConfiguration –ReportingEnabled 1 -``` - -**To configure the client to automatically send data to a specific reporting server**: - -```powershell -Set-AppVClientConfiguration –ReportingServerURL http://MyReportingServer:MyPort/ -ReportingStartTime 20 -ReportingInterval 1 -ReportingRandomDelay 30 -ReportingInterval 1 -ReportingRandomDelay 30 -``` - -This example configures the client to automatically send the reporting data to the reporting server URL **http://MyReportingServer:MyPort/**. Additionally, the reporting data will be sent daily between 8:00 and 8:30 PM, depending on the random delay generated for the session. - -**To limit the size of the data cache on the client**: - -```powershell -Set-AppvClientConfiguration –ReportingDataCacheLimit 100 -``` - -Configures the maximum size of the reporting cache on the computer running the App-V 5.1 client to 100 MB. If the cache limit is reached before the data is sent to the server, then the log rolls over and data will be overwritten as necessary. - -**To configure the data block size transmitted across the network between the client and the server**: - -```powershell -Set-AppvClientConfiguration –ReportingDataBlockSize 10240 -``` - -Specifies the maximum data block that the client sends to 10240 MB. - -### Types of data collected - -The following table displays the types of information you can collect by using App-V 5.1 reporting. - -|Client Information |Package Information |Application Usage | -|---------|---------|---------| -|Host Name |Package Name|Start and End Times| -|App-V 5.1 Client Version |Package Version|Run Status| -|Processor Architecture |Package Source|Shutdown State| -|Operating System Version|Percent Cached|Application Name| -|Service Pack Level| |Application Version| -|Operating System Type| |Username| -| | |Connection Group| - -The client collects and saves this data in an **.xml** format. The data cache is hidden by default and requires administrator rights to open the XML file. - -### Sending data to the server - -You can configure the computer that is running the App-V 5.1 client to automatically send data to the specified reporting server. To specify the server use the **Set-AppvClientConfiguration** cmdlet with the following settings: - -- ReportingEnabled -- ReportingServerURL -- ReportingStartTime -- ReportingInterval -- ReportingRandomDelay - -After you configure the previous settings, you must create a scheduled task. The scheduled task will contact the server specified by the **ReportingServerURL** setting and will initiate the transfer. If you want to manually send data outside of the scheduled times, use the following PowerShell cmdlet: - -```powershell -Send-AppVClientReport –URL http://MyReportingServer:MyPort/ -DeleteOnSuccess -``` - -If the reporting server has been previously configured, then the **–URL** parameter can be omitted. Alternatively, if the data should be sent to an alternate location, specify a different URL to override the configured **ReportingServerURL** for this data collection. - -The **-DeleteOnSuccess** parameter indicates that if the transfer is successful, then the data cache is cleared. If this is not specified, then the cache will not be cleared. - -### Manual Data Collection - -You can also use the **Send-AppVClientReport** cmdlet to manually collect data. This solution is helpful with or without an existing reporting server. The following list displays information about collecting data with or without a reporting server. - - ---- - - - - - - - - - - - - -
    With a Reporting ServerWithout a Reporting Server

    If you have an existing App-V 5.1 reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency.

    If you do not have an existing App-V 5.1 reporting Server, use the –URL parameter to send the data to a specified share. For example:

    -

    Send-AppVClientReport –URL \Myshare\MyData\ -DeleteOnSuccess

    -

    The previous example will send the reporting data to \MyShare\MyData</strong> location indicated by the -URL parameter. After the data has been sent, the cache is cleared.

    -
    -Note

    If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing.

    -
    -
    -
    - -### Creating Reports - -To retrieve report information and create reports using App-V 5.1 you must use one of the following methods: - -- **Microsoft SQL Server Reporting Services (SSRS)** - Microsoft SQL Server Reporting Services is available with Microsoft SQL Server. SSRS is not installed when you install the App-V 5.1 reporting server. It must be deployed separately to generate the associated reports. - - Use the following link for more information about using [Microsoft SQL Server Reporting Services](https://go.microsoft.com/fwlink/?LinkId=285596). - -- **Scripting** – You can generate reports by scripting directly against the App-V 5.1 reporting database. For example: - - **Stored Procedure:** - - **spProcessClientReport** is scheduled to run at midnight or 12:00 AM. - - To run the Microsoft SQL Server Scheduled Stored procedure, the Microsoft SQL Server Agent must be running. You should ensure that the Microsoft SQL Server Agent is set to **AutoStart**. For more information see [Autostart SQL Server Agent (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=287045). - - The stored procedure is also created when using the App-V 5.1 database scripts. - -You should also ensure that the reporting server web service's **Maximum Concurrent Connections** is set to a value that the server will be able to manage without impacting availability. The recommended number of **Maximum Concurrent Connections** for the **Reporting Web Service** is **10,000**. - -## Related topics - -[Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - -[How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) diff --git a/mdop/appv-v5/about-app-v-51.md b/mdop/appv-v5/about-app-v-51.md deleted file mode 100644 index f52bcf1b64..0000000000 --- a/mdop/appv-v5/about-app-v-51.md +++ /dev/null @@ -1,527 +0,0 @@ ---- -title: About App-V 5.1 -description: About App-V 5.1 -author: dansimp -ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About App-V 5.1 - - -Use the following sections to review information about significant changes that apply to Application Virtualization (App-V) 5.1: - -[App-V 5.1 software prerequisites and supported configurations](#bkmk-51-prereq-configs) - -[Migrating to App-V 5.1](#bkmk-migrate-to-51) - -[What’s New in App-V 5.1](#bkmk-whatsnew) - -[App-V support for Windows 10](#bkmk-win10support) - -[App-V Management Console Changes](#bkmk-mgmtconsole) - -[Sequencer Improvements](#bkmk-seqimprove) - -[Improvements to Package Converter](#bkmk-pkgconvimprove) - -[Support for multiple scripts on a single event trigger](#bkmk-supmultscripts) - -[Hardcoded path to installation folder is redirected to virtual file system root](#bkmk-hardcodepath) - -## App-V 5.1 software prerequisites and supported configurations - - -See the following links for the App-V 5.1 software prerequisites and supported configurations. - - ---- - - - - - - - - - - - - - - - - -
    Links to prerequisites and supported configurationsDescription

    App-V 5.1 Prerequisites

    Prerequisite software that you must install before starting the App-V 5.1 installation

    App-V 5.1 Supported Configurations

    Supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client components

    - - - -**Support for using Configuration Manager with App-V:** App-V 5.1 supports System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager and Configuration Manager. - -## Migrating to App-V 5.1 - - -Use the following information to upgrade to App-V 5.1 from earlier versions. See [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) for more information. - -### Before you start the upgrade - -Review the following information before you start the upgrade: - - ---- - - - - - - - - - - - - - - - - - - - - -
    Items to review before upgradingDescription

    Components to upgrade, in any order

      -
    1. App-V Server

    2. -
    3. Sequencer

    4. -
    5. App-V Client or App-V Remote Desktop Services (RDS) Client

    6. -
    -
    -Note

    Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from Application Virtualization 5.0 Client UI Application.

    -
    -
    - -

    Upgrading from App-V 4.x

    You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.1. For more information, see:

    - -

    Upgrading from App-V 5.0 or later

    You can upgrade to App-V 5.1 directly from any of the following versions:

    -
      -
    • App-V 5.0

    • -
    • App-V 5.0 SP1

    • -
    • App-V 5.0 SP2

    • -
    • App-V 5.0 SP3

    • -
    -

    To upgrade to App-V 5.1, follow the steps in the remaining sections of this topic.

    -

    Packages and connection groups will continue to work with App-V 5.1 as they currently do.

    - - - -### Steps to upgrade the App-V infrastructure - -Complete the following steps to upgrade each component of the App-V infrastructure to App-V 5.1. The following order is only a suggestion; you may upgrade components in any order. - - ---- - - - - - - - - - - - - - - - - - - - - -
    StepFor more information

    Step 1: Upgrade the App-V Server.

    -
    -Note

    If you are not using the App-V Server, skip this step and go to the next step.

    -
    -
    - -

    Follow these steps:

    -
      -
    1. Do one of the following, depending on the method you are using to upgrade the Management database and/or Reporting database:

      - ---- - - - - - - - - - - - - - - - - -
      Database upgrade methodStep

      Windows Installer

      Skip this step and go to step 2, “If you are upgrading the App-V Server...”

      SQL scripts

      Follow the steps in How to Deploy the App-V Databases by Using SQL Scripts.

      -
    2. If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section Check registry keys after installing the App-V 5.0 SP3 Server.

    3. -
    4. Follow the steps in How to Deploy the App-V 5.1 Server

    5. -

      -

    Step 2: Upgrade the App-V Sequencer.

    See How to Install the Sequencer.

    Step 3: Upgrade the App-V Client or App-V RDS Client.

    See How to Deploy the App-V Client.

    - - - -### Converting packages created using a prior version of App-V - -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. - -**Note** -App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and so there is no need to convert App-V 5.0 packages to App-V 5.1 packages. - - - -## What’s New in App-V 5.1 - - -These sections are for users who are already familiar with App-V and want to know what has changed in App-V 5.1. If you are not already familiar with App-V, you should start by reading [Planning for App-V 5.1](planning-for-app-v-51.md). - -### App-V support for Windows 10 - -The following table lists the Windows 10 support for App-V. Windows 10 is not supported in versions of App-V prior to App-V 5.1. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    ComponentApp-V 5.1App-V 5.0

    App-V Client

    Yes

    No

    App-V RDS Client

    Yes

    No

    App-V Sequencer

    Yes

    No

    - - - -### App-V Management Console Changes - -This section compares the App-V Management Console’s current and previous functionality. - -### Silverlight is no longer required - -The Management Console UI no longer requires Silverlight. The 5.1 Management Console is built on HTML5 and Javascript. - -### Notifications and messages are displayed individually in a dialog box - - ---- - - - - - - - - - - - - - - - - - - - - -
    New in App-V 5.1Prior to App-V 5.1

    Number of messages indicator:

    -

    On the title bar of the App-V Management Console, a number is now displayed next to a flag icon to indicate the number of messages that are waiting to be read.

    You could see only one message or error at a time, and you were unable to determine how many messages there were.

    Message appearance:

    -
      -
    • Messages that require user input appear in a separate dialog box that displays on top of the current page that you were viewing, and require a response before you can dismiss them.

    • -
    • Messages and errors appear in a list, with one beneath the other.

    • -

    You could see only one message or error at a time.

    Dismissing messages:

    -

    Use the Dismiss All link to dismiss all messages and errors at one time, or dismiss them one at a time.

    You could dismiss messages and errors only one at a time.

    - - - -### Console pages are now separate URLs - - ---- - - - - - - - - - - - - -
    New in App-V 5.1Prior to App-V 5.1

    Each page in the console has a different URL, which enables you to bookmark specific pages for quick access in the future.

    -

    The number that appears in some URLs indicates the specific package. These numbers are unique.

    All console pages are accessed through the same URL.

    - - - -### New, separate CONNECTION GROUPS page and menu option - - ---- - - - - - - - - - - - - -
    New in App-V 5.1Prior to App-V 5.1

    The CONNECTION GROUPS page is now part of the main menu, at the same level as the PACKAGES page.

    To open the CONNECTION GROUPS page, you navigate through the PACKAGES page.

    - - - -### Menu options for packages have changed - - ---- - - - - - - - - - - - - - - - - -
    New in App-V 5.1Prior to App-V 5.1

    The following options are now buttons that appear at the bottom of the PACKAGES page:

    -
      -
    • Add or Upgrade

    • -
    • Publish

    • -
    • Unpublish

    • -
    • Delete

    • -
    -

    The following options will still appear when you right-click a package to open the drop-down context menu:

    -
      -
    • Publish

    • -
    • Unpublish

    • -
    • Edit AD Access

    • -
    • Edit Deployment Config

    • -
    • Transfer deployment configuration from…

    • -
    • Transfer access and configuration from…

    • -
    • Delete

    • -
    -

    When you click Delete to remove a package, a dialog box opens and asks you to confirm that you want to delete the package.

    The Add or Upgrade option was a button at the top right of the PACKAGES page.

    -

    The Publish, Unpublish, and Delete options were available only if you right-clicked a package name in the packages list.

    The following package operations are now buttons on the package details page for each package:

    -
      -
    • Transfer (drop-down menu with the following options):

      -
        -
      • Transfer deployment configuration from…

      • -
      • Transfer access and configuration from…

      • -
    • -
    • Edit (connection groups and AD Access)

    • -
    • Unpublish

    • -
    • Delete

    • -
    • Edit Default Configuration

    • -

    These package options were available only if you right-clicked a package name in the packages list.

    - - - -### Icons in left pane have new colors and text - -The colors of the icons in the left pane have been changed, and text added, to make the icons consistent with other Microsoft products. - -### Overview page has been removed - -In the left pane of the Management Console, the OVERVIEW menu option and its associated OVERVIEW page have been removed. - -### Sequencer Improvements - -The following improvements have been made to the package editor in the App-V 5.1 Sequencer. - -### Import and export the manifest file - -You can import and export the AppxManifest.xml file. To export the manifest file, select the **Advanced** tab and in the Manifest File box, click **Export...**. You can make changes to the manifest file, such as removing shell extensions or editing file type associations. - -After you make your changes, click **Import...** and select the file you edited. After you successfully import it back in, the manifest file is immediately updated within the package editor. - -**Caution** -When you import the file, your changes are validated against the XML schema. If the file is not valid, you will receive an error. Be aware that it is possible to import a file that is validated against the XML schema, but that might still fail to run for other reasons. - - - -### Addition of Windows 10 to operating systems list - -In the Deployment tab, Windows 10 32-bit and Windows 10-64 bit have been added to the list of operating systems for which you can sequence a package. If you select **Any Operating System**, Windows 10 is automatically included among the operating systems that the sequenced package will support. - -### Current path displays at bottom of virtual registry editor - -In the Virtual Registry tab, the path now displays at the bottom of the virtual registry editor, which enables you to determine the currently selected key. Previously, you had to scroll through the registry tree to find the currently selected key. - -### Combined “find and replace” dialog box and shortcut keys added in virtual registry editor - -In the virtual registry editor, shortcut keys have been added for the Find option (Ctrl+F), and a dialog box that combines the “find” and “replace” tasks has been added to enable you to find and replace values and data. To access this combined dialog box, select a key and do one of the following: - -- Press **Ctrl+H** - -- Right-click a key and select **Replace**. - -- Select **View** > **Virtual Registry** > **Replace**. - -Previously, the “Replace” dialog box did not exist, and you had to make changes manually. - -### Rename registry keys and package files successfully - -You can rename virtual registry keys and files without experiencing Sequencer issues. Previously, the Sequencer stopped working if you tried to rename a key. - -### Import and export virtual registry keys - -You can import and export virtual registry keys. To import a key, right-click the node under which to import the key, navigate to the key you want to import, and then click **Import**. To export a key, right-click the key and select **Export**. - -### Import a directory into the virtual file system - -You can import a directory into the VFS. To import a directory, click the **Package Files** tab, and then click **View** > **Virtual File System** > **Import Directory**. If you try to import a directory that contains files that are already in the VFS, the import fails, and an explanatory message is displayed. Prior to App-V 5.1, you could not import directories. - -### Import or export a VFS file without having to delete and then add it back to the package - -You can import files to or export files from the VFS without having to delete the file and then add it back to the package. For example, you might use this feature to export a change log to a local drive, edit the file using an external editor, and then re-import the file into the VFS. - -To export a file, select the **Package Files** tab, right-click the file in the VFS, click **Export**, and choose an export location from which you can make your edits. - -To import a file, select the **Package Files** tab and right-click the file that you had exported. Browse to the file that you edited, and then click **Import**. The imported file will overwrite the existing file. - -After you import a file, you must save the package by clicking **File** > **Save**. - -### Menu for adding a package file has moved - -The menu option for adding a package file has been moved. To find the Add option, select the **Package Files** tab, then click **View** > **Virtual File System** > **Add File**. Previously, you right-clicked a folder under the VFS node, and chose **Add File**. - -### Virtual registry node expands MACHINE and USER hives by default - -When you open the virtual registry, the MACHINE and USER hives are shown below the top-level REGISTRY node. Previously, you had to expand the REGISTRY node to show the hives beneath. - -### Enable or disable Browser Helper Objects - -You can enable or disable Browser Helper Objects by selecting a new check box, Enable Browser Helper Objects, on the Advanced tab of the Sequencer user interface. If Browser Helper Objects: - -- Exist in the package and are enabled, the check box is selected by default. - -- Exist in the package and are disabled, the check box is clear by default. - -- Exist in the package, with one or more enabled and one or more disabled, the check box is set to indeterminate by default. - -- Do not exist in the package, the check box is disabled. - -### Improvements to Package Converter - -You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. - -For more information including examples, see [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md). - -### Support for multiple scripts on a single event trigger - -App-V 5.1 supports the use of multiple scripts on a single event trigger for App-V packages, including packages that you are converting from App-V 4.6 to App-V 5.0 or later. To enable the use of multiple scripts, App-V 5.1 uses a script launcher application, named ScriptRunner.exe, which is installed as part of the App-V client installation. - -For more information, including a list of event triggers and the context under which scripts can be run, see the Scripts section in [About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md). - -### Hardcoded path to installation folder is redirected to virtual file system root - -When you convert packages from App-V 4.6 to 5.1, the App-V 5.1 package can access the hardcoded drive that you were required to use when you created 4.6 packages. The drive letter will be the drive you selected as the installation drive on the 4.6 sequencing machine. (The default drive letter is Q:\\.) - -Previously, the 4.6 root folder was not recognized and could not be accessed by App-V 5.0 packages. App-V 5.1 packages can access hardcoded files by their full path or can programmatically enumerate files under the App-V 4.6 installation root. - -**Technical Details:** The App-V 5.1 package converter will save the App-V 4.6 installation root folder and short folder names in the FilesystemMetadata.xml file in the Filesystem element. When the App-V 5.1 client creates the virtual process, it will map requests from the App-V 4.6 installation root to the virtual file system root. - -## How to Get MDOP Technologies - - -App-V is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - - - - - - -## Related topics - - -[Release Notes for App-V 5.1](release-notes-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-client-configuration-settings.md b/mdop/appv-v5/about-client-configuration-settings.md deleted file mode 100644 index 9ba08f850a..0000000000 --- a/mdop/appv-v5/about-client-configuration-settings.md +++ /dev/null @@ -1,473 +0,0 @@ ---- -title: About Client Configuration Settings -description: About Client Configuration Settings -author: dansimp -ms.assetid: cc7ae28c-b2ac-4f68-b992-5ccdbd5316a4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Client Configuration Settings - - -The Microsoft Application Virtualization (App-V) 5.0 client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists the App-V 5.0 Client configuration settings and explains their uses. You can use PowerShell to modify the client configuration settings. For more information about using PowerShell and App-V 5.0 see [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md). - -## App-V 5.0 Client Configuration Settings - - -The following table displays information about the App-V 5.0 client configuration settings: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Setting NameSetup FlagDescriptionSetting OptionsRegistry Key ValueDisabled Policy State Keys and Values

    PackageInstallationRoot

    PACKAGEINSTALLATIONROOT

    Specifies directory where all new applications and updates will be installed.

    String

    Streaming\PackageInstallationRoot

    Policy value not written (same as Not Configured)

    PackageSourceRoot

    PACKAGESOURCEROOT

    Overrides source location for downloading package content.

    String

    Streaming\PackageSourceRoot

    Policy value not written (same as Not Configured)

    AllowHighCostLaunch

    Not available.

    This setting controls whether virtualized applications are launched on Windows 8 machines connected via a metered network connection (For example, 4G).

    True (enabled); False (Disabled state)

    Streaming\AllowHighCostLaunch

    0

    ReestablishmentRetries

    Not available.

    Specifies the number of times to retry a dropped session.

    Integer (0-99)

    Streaming\ReestablishmentRetries

    Policy value not written (same as Not Configured)

    ReestablishmentInterval

    Not available.

    Specifies the number of seconds between attempts to reestablish a dropped session.

    Integer (0-3600)

    Streaming\ReestablishmentInterval

    Policy value not written (same as Not Configured)

    AutoLoad

    AUTOLOAD

    Specifies how new packages should be loaded automatically by App-V on a specific computer.

    (0x0) None; (0x1) Previously used; (0x2) All

    Streaming\AutoLoad

    Policy value not written (same as Not Configured)

    LocationProvider

    Not available.

    Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface.

    String

    Streaming\LocationProvider

    Policy value not written (same as Not Configured)

    CertFilterForClientSsl

    Not available.

    Specifies the path to a valid certificate in the certificate store.

    String

    Streaming\CertFilterForClientSsl

    Policy value not written (same as Not Configured)

    VerifyCertificateRevocationList

    Not available.

    Verifies Server certificate revocation status before steaming using HTTPS.

    True(enabled); False(Disabled state)

    Streaming\VerifyCertificateRevocationList

    0

    SharedContentStoreMode

    SHAREDCONTENTSTOREMODE

    Specifies that streamed package contents will be not be saved to the local hard disk.

    True(enabled); False(Disabled state)

    Streaming\SharedContentStoreMode

    0

    Name

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    PUBLISHINGSERVERNAME

    Displays the name of publishing server.

    String

    Publishing\Servers{serverId}\FriendlyName

    Policy value not written (same as Not Configured)

    URL

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    PUBLISHINGSERVERURL

    Displays the URL of publishing server.

    String

    Publishing\Servers{serverId}\URL

    Policy value not written (same as Not Configured)

    GlobalRefreshEnabled

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    GLOBALREFRESHENABLED

    Enables global publishing refresh (Boolean)

    True(enabled); False(Disabled state)

    Publishing\Servers{serverId}\GlobalEnabled

    False

    GlobalRefreshOnLogon

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    GLOBALREFRESHONLOGON

    Triggers a global publishing refresh on logon. ( Boolean)

    True(enabled); False(Disabled state)

    Publishing\Servers{serverId}\GlobalLogonRefresh

    False

    GlobalRefreshInterval

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    GLOBALREFRESHINTERVAL

    Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0.

    Integer (0-744

    Publishing\Servers{serverId}\GlobalPeriodicRefreshInterval

    0

    GlobalRefreshIntervalUnit

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    GLOBALREFRESHINTERVALUNI

    Specifies the interval unit (Hour 0-23, Day 0-31).

    0 for hour, 1 for day

    Publishing\Servers{serverId}\GlobalPeriodicRefreshIntervalUnit

    1

    UserRefreshEnabled

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    USERREFRESHENABLED

    Enables user publishing refresh (Boolean)

    True(enabled); False(Disabled state)

    Publishing\Servers{serverId}\UserEnabled

    False

    UserRefreshOnLogon

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    USERREFRESHONLOGON

    Triggers a user publishing refresh onlogon. ( Boolean)

    -

    Word count (with spaces): 60

    True(enabled); False(Disabled state)

    Publishing\Servers{serverId}\UserLogonRefresh

    False

    UserRefreshInterval

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    USERREFRESHINTERVAL

    Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.

    -

    Word count (with spaces): 85

    Integer (0-744 Hours)

    Publishing\Servers{serverId}\UserPeriodicRefreshInterval

    0

    UserRefreshIntervalUnit

    -
    -Note

    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.

    -
    -
    - -

    USERREFRESHINTERVALUNIT

    Specifies the interval unit (Hour 0-23, Day 0-31).

    0 for hour, 1 for day

    Publishing\Servers{serverId}\UserPeriodicRefreshIntervalUnit

    1

    MigrationMode

    MIGRATIONMODE

    Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V.

    True(enabled state); False (disabled state)

    Coexistence\MigrationMode

    CEIPOPTIN

    CEIPOPTIN

    Allows the computer running the App-V 5.0 Client to collect and return certain usage information to help allow us to further improve the application.

    0 for disabled; 1 for enabled

    SOFTWARE/Microsoft/AppV/CEIP/CEIPEnable

    0

    EnablePackageScripts

    ENABLEPACKAGESCRIPTS

    Enables scripts defined in the package manifest of configuration files that should run.

    True(enabled); False(Disabled state)

    \Scripting\EnablePackageScripts

    RoamingFileExclusions

    ROAMINGFILEEXCLUSIONS

    Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS='desktop;my pictures'

    RoamingRegistryExclusions

    ROAMINGREGISTRYEXCLUSIONS

    Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients

    String

    Integration\RoamingRegistryExclusions

    Policy value not written (same as Not Configured)

    IntegrationRootUser

    Not available.

    Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\Microsoft\AppV\Client\Integration.

    String

    Integration\IntegrationRootUser

    Policy value not written (same as Not Configured)

    IntegrationRootGlobal

    Not available.

    Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\Microsoft\AppV\Client\Integration

    String

    Integration\IntegrationRootGlobal

    Policy value not written (same as Not Configured)

    VirtualizableExtensions

    Not available.

    A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment.

    -

    When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the RunVirtual command line parameter will be added, and the application will run virtually.

    -

    For more information about the RunVirtual parameter, see Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications.

    String

    Integration\VirtualizableExtensions

    Policy value not written

    ReportingEnabled

    Not available.

    Enables the client to return information to a reporting server.

    True (enabled); False (Disabled state)

    Reporting\EnableReporting

    False

    ReportingServerURL

    Not available.

    Specifies the location on the reporting server where client information is saved.

    String

    Reporting\ReportingServer

    Policy value not written (same as Not Configured)

    ReportingDataCacheLimit

    Not available.

    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024.

    Integer [0-1024]

    Reporting\DataCacheLimit

    Policy value not written (same as Not Configured)

    ReportingDataBlockSize

    Not available.

    Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited.

    Integer [1024 - Unlimited]

    Reporting\DataBlockSize

    Policy value not written (same as Not Configured)

    ReportingStartTime

    Not available.

    Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the ReportingStartTime will start on the current day at 10 P.M.or 22.

    -
    -Note

    You should configure this setting to a time when computers running the App-V 5.0 client are least likely to be offline.

    -
    -
    - -

    Integer (0 – 23)

    Reporting\ StartTime

    Policy value not written (same as Not Configured)

    ReportingInterval

    Not available.

    Specifies the retry interval that the client will use to resend data to the reporting server.

    Integer

    Reporting\RetryInterval

    Policy value not written (same as Not Configured)

    ReportingRandomDelay

    Not available.

    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data. This can help to prevent collisions on the server.

    Integer [0 - ReportingRandomDelay]

    Reporting\RandomDelay

    Policy value not written (same as Not Configured)

    EnableDynamicVirtualization

    -
    -Important

    This setting is available only with App-V 5.0 SP2 or later.

    -
    -
    - -

    Not available.

    Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications.

    1 (Enabled), 0 (Disabled)

    HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Virtualization

    EnablePublishingRefreshUI

    -
    -Important

    This setting is available only with App-V 5.0 SP2.

    -
    -
    - -

    Not available.

    Enables the publishing refresh progress bar for the computer running the App-V 5.0 Client.

    1 (Enabled), 0 (Disabled)

    HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing

    HideUI

    -
    -Important

    This setting is available only with App-V 5.0 SP2.

    -
    -
    - -

    Not available.

    Hides the publishing refresh progress bar.

    1 (Enabled), 0 (Disabled)

    ProcessesUsingVirtualComponents

    Not available.

    Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization.

    String

    Virtualization\ProcessesUsingVirtualComponents

    Empty string.

    - - - - - - - - -## Related topics - - -[Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - -[How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md) - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-client-configuration-settings51.md b/mdop/appv-v5/about-client-configuration-settings51.md deleted file mode 100644 index 0ea5586f2b..0000000000 --- a/mdop/appv-v5/about-client-configuration-settings51.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: About Client Configuration Settings -description: About Client Configuration Settings -author: dansimp -ms.assetid: 18bb307a-7eda-4dd6-a83e-6afaefd99470 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About Client Configuration Settings - - -The Microsoft Application Virtualization (App-V) 5.1 client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists the App-V 5.1 Client configuration settings and explains their uses. You can use PowerShell to modify the client configuration settings. For more information about using PowerShell and App-V 5.1 see [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md). - -## App-V 5.1 Client Configuration Settings - - -The following table displays information about the App-V 5.1 client configuration settings: - -|Setting name | Setup Flag | Description | Setting Options | Registry Key Value | Disabled Policy State Keys and Values | -|-------------|------------|-------------|-----------------|--------------------|--------------------------------------| -| PackageInstallationRoot | PACKAGEINSTALLATIONROOT | Specifies directory where all new applications and updates will be installed. | String | Streaming\PackageInstallationRoot | Policy value not written (same as Not Configured) | -| PackageSourceRoot | PACKAGESOURCEROOT | Overrides source location for downloading package content. | String | Streaming\PackageSourceRoot | Policy value not written (same as Not Configured) | -| AllowHighCostLaunch | Not available. |This setting controls whether virtualized applications are launched on Windows 10 machines connected via a metered network connection (For example, 4G). | True (enabled); False (Disabled state) | Streaming\AllowHighCostLaunch | 0 | -| ReestablishmentRetries | Not available. | Specifies the number of times to retry a dropped session. | Integer (0-99) | Streaming\ReestablishmentRetries | Policy value not written (same as Not Configured) | -| ReestablishmentInterval | Not available. | Specifies the number of seconds between attempts to reestablish a dropped session. | Integer (0-3600) | Streaming\ReestablishmentInterval | Policy value not written (same as Not Configured) | -| LocationProvider | Not available. | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface. | String | Streaming\LocationProvider | Policy value not written (same as Not Configured) | -| CertFilterForClientSsl | Not available. | Specifies the path to a valid certificate in the certificate store. | String | Streaming\CertFilterForClientSsl | Policy value not written (same as Not Configured) | -| VerifyCertificateRevocationList | Not available. | Verifies Server certificate revocation status before steaming using HTTPS. | True(enabled); False(Disabled state) | Streaming\VerifyCertificateRevocationList | 0 | -| SharedContentStoreMode | SHAREDCONTENTSTOREMODE | Specifies that streamed package contents will be not be saved to the local hard disk. | True(enabled); False(Disabled state) | Streaming\SharedContentStoreMode | 0 | -| Name
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | PUBLISHINGSERVERNAME | Displays the name of publishing server. | String | Publishing\Servers\{serverId}\FriendlyName | Policy value not written (same as Not Configured) | -| URL
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | PUBLISHINGSERVERURL | Displays the URL of publishing server. | String | Publishing\Servers\{serverId}\URL | Policy value not written (same as Not Configured) | -| GlobalRefreshEnabled
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | GLOBALREFRESHENABLED | Enables global publishing refresh (Boolean) | True(enabled); False(Disabled state) | Publishing\Servers\{serverId}\GlobalEnabled | False | -| GlobalRefreshOnLogon
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | GLOBALREFRESHONLOGON | Triggers a global publishing refresh on logon. ( Boolean) | True(enabled); False(Disabled state) | Publishing\Servers\{serverId}\GlobalLogonRefresh | False | -| GlobalRefreshInterval
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | GLOBALREFRESHINTERVAL | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0. | Integer (0-744) | Publishing\Servers\{serverId}\GlobalPeriodicRefreshInterval | 0 | -| GlobalRefreshIntervalUnit
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | GLOBALREFRESHINTERVALUNI | Specifies the interval unit (Hour 0-23, Day 0-31). | 0 for hour, 1 for day | Publishing\Servers\{serverId}\GlobalPeriodicRefreshIntervalUnit | 1 | -| UserRefreshEnabled
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | USERREFRESHENABLED | Enables user publishing refresh (Boolean) | True(enabled); False(Disabled state) | Publishing\Servers\{serverId}\UserEnabled | False | -| UserRefreshOnLogon
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | USERREFRESHONLOGON | Triggers a user publishing refresh onlogon. ( Boolean)
    Word count (with spaces): 60 | True(enabled); False(Disabled state) | Publishing\Servers\{serverId}\UserLogonRefresh | False | -| UserRefreshInterval
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | USERREFRESHINTERVAL | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0. | Word count (with spaces): 85
    Integer (0-744 Hours) | Publishing\Servers\{serverId}\UserPeriodicRefreshInterval | 0 | -| UserRefreshIntervalUnit
    **Note** This setting cannot be modified using the **set-AppvclientConfiguration** cmdLet. You must use the **Set-AppvPublishingServer** cmdlet. | USERREFRESHINTERVALUNIT | Specifies the interval unit (Hour 0-23, Day 0-31). | 0 for hour, 1 for day | Publishing\Servers\{serverId}\UserPeriodicRefreshIntervalUnit | 1 | -| MigrationMode | MIGRATIONMODE | Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created using a previous version of App-V. | True(enabled state); False (disabled state) | Coexistence\MigrationMode | | -| CEIPOPTIN | CEIPOPTIN | Allows the computer running the App-V 5.1 Client to collect and return certain usage information to help allow us to further improve the application. | 0 for disabled; 1 for enabled | SOFTWARE/Microsoft/AppV/CEIP/CEIPEnable | 0 | -| EnablePackageScripts | ENABLEPACKAGESCRIPTS | Enables scripts defined in the package manifest of configuration files that should run. | True(enabled); False(Disabled state) | \Scripting\EnablePackageScripts | | -| RoamingFileExclusions | ROAMINGFILEEXCLUSIONS | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage:  /ROAMINGFILEEXCLUSIONS='desktop;my pictures' | | | | -| RoamingRegistryExclusions | ROAMINGREGISTRYEXCLUSIONS | Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients | String | Integration\RoamingRegistryExclusions | Policy value not written (same as Not Configured) | -| IntegrationRootUser | Not available. | Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\Microsoft\AppV\Client\Integration.| String | Integration\IntegrationRootUser | Policy value not written (same as Not Configured) | -|IntegrationRootGlobal | Not available.| Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\Microsoft\AppV\Client\Integration | String | Integration\IntegrationRootGlobal | Policy value not written (same as Not Configured) | -| VirtualizableExtensions | Not available. | A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment.
    When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command line parameter will be added, and the application will run virtually.
    For more information about the **RunVirtual** parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md). | String | Integration\VirtualizableExtensions | Policy value not written | -| ReportingEnabled | Not available. | Enables the client to return information to a reporting server. | True (enabled); False (Disabled state) | Reporting\EnableReporting | False | -| ReportingServerURL | Not available. | Specifies the location on the reporting server where client information is saved. | String | Reporting\ReportingServer | Policy value not written (same as Not Configured) | -| ReportingDataCacheLimit | Not available. | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024. | Integer [0-1024] | Reporting\DataCacheLimit | Policy value not written (same as Not Configured) | -| ReportingDataBlockSize| Not available. | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited. | Integer [1024 - Unlimited] | Reporting\DataBlockSize | Policy value not written (same as Not Configured) | -| ReportingStartTime | Not available. | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
    **Note** You should configure this setting to a time when computers running the App-V 5.1 client are least likely to be offline. | Integer (0 – 23) | Reporting\ StartTime | Policy value not written (same as Not Configured) | -| ReportingInterval | Not available. | Specifies the retry interval that the client will use to resend data to the reporting server. | Integer | Reporting\RetryInterval | Policy value not written (same as Not Configured) | -| ReportingRandomDelay | Not available. | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This can help to prevent collisions on the server. | Integer [0 - ReportingRandomDelay] | Reporting\RandomDelay | Policy value not written (same as Not Configured) | -| EnableDynamicVirtualization
    **Important** This setting is available only with App-V 5.0 SP2 or later. | Not available. | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications. | 1 (Enabled), 0 (Disabled) | HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Virtualization | | -| EnablePublishingRefreshUI
    **Important** This setting is available only with App-V 5.0 SP2. | Not available. | Enables the publishing refresh progress bar for the computer running the App-V 5.1 Client. | 1 (Enabled), 0 (Disabled) | HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing | | -| HideUI
    **Important**  This setting is available only with App-V 5.0 SP2.| Not available. | Hides the publishing refresh progress bar. | 1 (Enabled), 0 (Disabled) | | | -| ProcessesUsingVirtualComponents | Not available. | Specifies a list of process paths (that may contain wildcards), which are candidates for using dynamic virtualization (supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization. | String | Virtualization\ProcessesUsingVirtualComponents | Empty string. | - - - - - - -## Related topics - - -[Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - -[How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md) - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/about-the-connection-group-file.md b/mdop/appv-v5/about-the-connection-group-file.md deleted file mode 100644 index 49785fcb96..0000000000 --- a/mdop/appv-v5/about-the-connection-group-file.md +++ /dev/null @@ -1,338 +0,0 @@ ---- -title: About the Connection Group File -description: About the Connection Group File -author: dansimp -ms.assetid: bfeb6013-a7ca-4e36-9fe3-229702e83f0d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Connection Group File - - -**In this topic:** - -- [Connection group file purpose and location](#bkmk-cg-purpose-loc) - -- [Structure of the connection group XML file](#bkmk-define-cg-5-0sp3) - -- [Configuring the priority of packages in a connection group](#bkmk-config-pkg-priority-incg) - -- [Supported virtual application connection configurations](#bkmk-va-conn-configs) - -## Connection group file purpose and location - - - ---- - - - - - - - - - - - - - - -

    Connection group purpose

    A connection group is an App-V feature that enables you to group packages together to create a virtual environment in which the applications in those packages can interact with each other.

    -

    Example: You want to use plug-ins with Microsoft Office. You can create a package that contains the plug-ins, and create another package that contains Office, and then add both packages to a connection group to enable Office to use those plug-ins.

    How the connection group file works

    When you apply an Application Virtualization 5.0 connection group file, the packages that are enumerated in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) 5.0 connection group file to configure existing Application Virtualization 5.0 connection groups.

    Example file path

    %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups{6CCC7575-162E-4152-9407-ED411DA138F4}{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.

    - - - -## Structure of the connection group XML file - - -**In this section:** - -- [Parameters that define the connection group](#bkmk-params-define-cg) - -- [Parameters that define the packages in the connection group](#bkmk-params-define-pkgs-incg) - -- [App-V 5.0 SP3 example connection group XML file](#bkmk-50sp3-exp-cg-xml) - -- [App-V 5.0 through App-V 5.0 SP2 example connection group XML file](#bkmk-50thru50sp2-exp-cg-xm) - -### Parameters that define the connection group - -The following table describes the parameters in the XML file that define the connection group itself, not the packages. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    Schema name

    Name of the schema.

    -

    Applicable starting in App-V 5.0 SP3: If you want to use the new “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file:

    -

    xmlns="https://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";

    AppConnectionGroupId

    Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group.

    -

    You can create a new GUID by typing: [Guid]::NewGuid().

    VersionId

    Version GUID identifier for this version of the connection group.

    -

    When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version.

    DisplayName

    Display name of the connection group.

    Priority

    Optional priority field for the connection group.

    -

    “0” - indicates the highest priority.

    -

    If a priority is required, but has not been configured, the package will fail because the correct connection group to use cannot be determined.

    - - - -### Parameters that define the packages in the connection group - -In the <Packages> section of the connection group XML file, you list the member packages in the connection group by specifying each package’s unique package identifier and version identifier, as described in the following table. The first package in the list has the highest precedence. - - ---- - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    PackageId

    Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published.

    VersionId

    Unique GUID identifier for the version of the package.

    -

    Applicable starting in App-V 5.0 SP3: If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted.

    IsOptional

    Applicable starting in App-V 5.0 SP3: Parameter that enables you to make a package optional within the connection group. Valid entries are:

    -
      -
    • “true” – package is optional in the connection group

    • -
    • “false” – package is required in the connection group

    • -
    -

    See How to Use Optional Packages in Connection Groups.

    - - - -### App-V 5.0 SP3 example connection group XML file - -The following example connection group XML file shows examples of the fields in the previous tables and highlights the items that are new for App-V 5.0 SP3. - -```XML - - - - - - - -``` - -### App-V 5.0 through App-V 5.0 SP2 example connection group XML file - -The following example connection group XML file applies to App-V 5.0 through App-V 5.0 SP2. It shows examples of the fields in the previous table, but it excludes the changes described above for App-V 5.0 SP3. - -```XML - - - - - - -Configuring the priority of packages in a connection group - - -Package precedence is configured using the package list order. The first package in the document has the highest precedence. Subsequent packages in the list have descending priority. - -Package precedence is the resolution for otherwise inevitable resource collisions during virtual environment initialization. For example, if two packages that are opening in the same virtual environment define the same registry DWORD value, the package with the highest precedence determines the value that is set. - -You can use the connection group file to configure each connection group by using the following methods: - -- Specify runtime priorities for connection groups. - - **Note**   - Priority is required only if the package is associated with more than one connection group. - - - -- Specify package precedence within the connection group. - -The priority field is required when a running virtual application initiates from a native application request, for example, Microsoft Windows Explorer. The App-V client uses the priority to determine which connection group virtual environment the application should run in. This situation occurs if a virtual application is part of multiple connection groups. - -If a virtual application is opened using another virtual application the virtual environment of the original virtual application will be used. The priority field is not used in this case. - -**Example:** - -The virtual application Microsoft Outlook is running in virtual environment **XYZ**. When you open an attached Microsoft Word document, a virtualized version Microsoft Word opens in the virtual environment **XYZ**, regardless of the virtualized Microsoft Word’s associated connection groups or runtime priorities. - -## Supported virtual application connection configurations - - - ---- - - - - - - - - - - - - - - - - - - - - -
    ConfigurationExample scenario

    An. exe file and plug-in (.dll)

      -
    • You want to distribute Microsoft Office to all users, but distribute a Microsoft Excel plug-in to only a subset of users.

    • -
    • Enable the connection group for the appropriate users.

    • -
    • Update each package individually as required.

    • -

    An. exe file and a middleware application

      -
    • You have an application requires a middleware application, or several applications that all depend on the same middleware runtime version.

    • -
    • All computers that require one or more of the applications receive the connection groups with the application and middleware application runtime.

    • -
    • You can optionally combine multiple middleware applications into a single connection group.

      - ---- - - - - - - - - - - - - - - - - -
      ExampleExample description

      Virtual application connection group for the financial division

        -
      • Middleware application 1

      • -
      • Middleware application 2

      • -
      • Middleware application 3

      • -
      • Middleware application runtime

      • -

      Virtual application connection group for HR division

        -
      • Middleware application 5

      • -
      • Middleware application 6

      • -
      • Middleware application runtime

      • -
      -

       

    • -

    An. exe file and an .exe file

    You have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines.

    -

    Example:

    -

    If you are deploying Microsoft Lync 2010, you can use three packages:

    -
      -
    • Microsoft Office 2010

    • -
    • Microsoft Communicator 2007

    • -
    • Microsoft Lync 2010

    • -
    -

    You can manage the deployment using the following connection groups:

    -
      -
    • Microsoft Office 2010 and Microsoft Communicator 2007

    • -
    • Microsoft Office 2010 and Microsoft Lync 2010

    • -
    -

    When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group.

    - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-the-connection-group-file51.md b/mdop/appv-v5/about-the-connection-group-file51.md deleted file mode 100644 index c135acab7f..0000000000 --- a/mdop/appv-v5/about-the-connection-group-file51.md +++ /dev/null @@ -1,338 +0,0 @@ ---- -title: About the Connection Group File -description: About the Connection Group File -author: dansimp -ms.assetid: 1f4df515-f5f6-4b58-91a8-c71598cb3ea4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Connection Group File - - -**In this topic:** - -- [Connection group file purpose and location](#bkmk-cg-purpose-loc) - -- [Structure of the connection group XML file](#bkmk-define-cg-5-0sp3) - -- [Configuring the priority of packages in a connection group](#bkmk-config-pkg-priority-incg) - -- [Supported virtual application connection configurations](#bkmk-va-conn-configs) - -## Connection group file purpose and location - - - ---- - - - - - - - - - - - - - - -

    Connection group purpose

    A connection group is an App-V feature that enables you to group packages together to create a virtual environment in which the applications in those packages can interact with each other.

    -

    Example: You want to use plug-ins with Microsoft Office. You can create a package that contains the plug-ins, and create another package that contains Office, and then add both packages to a connection group to enable Office to use those plug-ins.

    How the connection group file works

    When you apply an App-V 5.1 connection group file, the packages that are enumerated in the file will be combined at runtime into a single virtual environment. Use the Microsoft Application Virtualization (App-V) 5.1 connection group file to configure existing App-V 5.1 connection groups.

    Example file path

    %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups{6CCC7575-162E-4152-9407-ED411DA138F4}{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.

    - - - -## Structure of the connection group XML file - - -**In this section:** - -- [Parameters that define the connection group](#bkmk-params-define-cg) - -- [Parameters that define the packages in the connection group](#bkmk-params-define-pkgs-incg) - -- [App-V example connection group XML file](#bkmk-50sp3-exp-cg-xml) - -- [App-V 5.0 through App-V 5.0 SP2 example connection group XML file](#bkmk-50thru50sp2-exp-cg-xm) - -### Parameters that define the connection group - -The following table describes the parameters in the XML file that define the connection group itself, not the packages. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    Schema name

    Name of the schema.

    -

    Applicable starting in App-V 5.0 SP3: If you want to use the new “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file:

    -

    xmlns="https://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";

    AppConnectionGroupId

    Unique GUID identifier for this connection group. The connection group state is associated with this identifier. Specify this identifier only when you create the connection group.

    -

    You can create a new GUID by typing: [Guid]::NewGuid().

    VersionId

    Version GUID identifier for this version of the connection group.

    -

    When you update a connection group (for example, by adding or updating a new package), you must update the version GUID to reflect the new version.

    DisplayName

    Display name of the connection group.

    Priority

    Optional priority field for the connection group.

    -

    “0” - indicates the highest priority.

    -

    If a priority is required, but has not been configured, the package will fail because the correct connection group to use cannot be determined.

    - - - -### Parameters that define the packages in the connection group - -In the <Packages> section of the connection group XML file, you list the member packages in the connection group by specifying each package’s unique package identifier and version identifier, as described in the following table. The first package in the list has the highest precedence. - - ---- - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    PackageId

    Unique GUID identifier for this package. This GUID doesn’t change when newer versions of the package are published.

    VersionId

    Unique GUID identifier for the version of the package.

    -

    Applicable starting in App-V 5.0 SP3: If you specify “*” for the package version, the GUID of the latest available package version is dynamically inserted.

    IsOptional

    Applicable starting in App-V 5.0 SP3: Parameter that enables you to make a package optional within the connection group. Valid entries are:

    -
      -
    • “true” – package is optional in the connection group

    • -
    • “false” – package is required in the connection group

    • -
    -

    See How to Use Optional Packages in Connection Groups.

    - - - -### App-V example connection group XML file - -The following example connection group XML file shows examples of the fields in the previous tables and highlights the items that are new starting in App-V 5.0 SP3. - -```XML - - - - - - - -``` - -### App-V 5.0 through App-V 5.0 SP2 example connection group XML file - -The following example connection group XML file applies to App-V 5.0 through App-V 5.0 SP2. It shows examples of the fields in the previous table, but it excludes the changes described above for App-V 5.0 SP3. - -```XML - - - - - - - -``` - -## Configuring the priority of packages in a connection group - - -Package precedence is configured using the package list order. The first package in the document has the highest precedence. Subsequent packages in the list have descending priority. - -Package precedence is the resolution for otherwise inevitable resource collisions during virtual environment initialization. For example, if two packages that are opening in the same virtual environment define the same registry DWORD value, the package with the highest precedence determines the value that is set. - -You can use the connection group file to configure each connection group by using the following methods: - -- Specify runtime priorities for connection groups. To edit priority by using the App-V Management Console, click the connection group and then click **Edit**. - - **Note**   - Priority is required only if the package is associated with more than one connection group. - - - -- Specify package precedence within the connection group. - -The priority field is required when a running virtual application initiates from a native application request, for example, Microsoft Windows Explorer. The App-V client uses the priority to determine which connection group virtual environment the application should run in. This situation occurs if a virtual application is part of multiple connection groups. - -If a virtual application is opened using another virtual application the virtual environment of the original virtual application will be used. The priority field is not used in this case. - -**Example:** - -The virtual application Microsoft Outlook is running in virtual environment **XYZ**. When you open an attached Microsoft Word document, a virtualized version Microsoft Word opens in the virtual environment **XYZ**, regardless of the virtualized Microsoft Word’s associated connection groups or runtime priorities. - -## Supported virtual application connection configurations - - - ---- - - - - - - - - - - - - - - - - - - - - -
    ConfigurationExample scenario

    An. exe file and plug-in (.dll)

      -
    • You want to distribute Microsoft Office to all users, but distribute a Microsoft Excel plug-in to only a subset of users.

    • -
    • Enable the connection group for the appropriate users.

    • -
    • Update each package individually as required.

    • -

    An. exe file and a middleware application

      -
    • You have an application requires a middleware application, or several applications that all depend on the same middleware runtime version.

    • -
    • All computers that require one or more of the applications receive the connection groups with the application and middleware application runtime.

    • -
    • You can optionally combine multiple middleware applications into a single connection group.

      - ---- - - - - - - - - - - - - - - - - -
      ExampleExample description

      Virtual application connection group for the financial division

        -
      • Middleware application 1

      • -
      • Middleware application 2

      • -
      • Middleware application 3

      • -
      • Middleware application runtime

      • -

      Virtual application connection group for HR division

        -
      • Middleware application 5

      • -
      • Middleware application 6

      • -
      • Middleware application runtime

      • -
      -

       

    • -

    An. exe file and an .exe file

    You have an application that relies on another application, and you want to keep the packages separate for operational efficiencies, licensing restrictions, or rollout timelines.

    -

    Example:

    -

    If you are deploying Microsoft Lync 2010, you can use three packages:

    -
      -
    • Microsoft Office 2010

    • -
    • Microsoft Communicator 2007

    • -
    • Microsoft Lync 2010

    • -
    -

    You can manage the deployment using the following connection groups:

    -
      -
    • Microsoft Office 2010 and Microsoft Communicator 2007

    • -
    • Microsoft Office 2010 and Microsoft Lync 2010

    • -
    -

    When the deployment has completed, you can either create a single new Microsoft Office 2010 + Microsoft Lync 2010 package, or keep and maintain them as separate packages and deploy them by using a connection group.

    - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/about-the-connection-group-virtual-environment.md b/mdop/appv-v5/about-the-connection-group-virtual-environment.md deleted file mode 100644 index 5b7e566fae..0000000000 --- a/mdop/appv-v5/about-the-connection-group-virtual-environment.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: About the Connection Group Virtual Environment -description: About the Connection Group Virtual Environment -author: dansimp -ms.assetid: 535fa640-cbd9-425e-8437-94650a70c264 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Connection Group Virtual Environment - - -**In this topic:** - -- [How package priority is determined](#bkmk-pkg-priority-deter) - -- [Merging identical package paths into one virtual directory in connection groups](#bkmk-merged-root-ve-exp) - -## How package priority is determined - - -The virtual environment and its current state are associated with the connection group, not with the individual packages. If an App-V package is removed from the connection group, the state that existed as part of the connection group will not migrate with the package. - -If the same package is a part of two different connection groups, you have to indicate which connection group App-V should use. For example, you might have two packages in a connection group that each define the same registry DWORD value. - -The connection group that is used is based on the order in which a package appears inside the **AppConnectionGroup** XML document: - -- The first package has the highest precedence. - -- The second package has the second highest precedence. - -Consider the following example section: - -```xml - -``` - -Assume that same DWORD value ABC (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region) is defined in the first and third package, such as: - -- Package 1 (A8731008-4523-4713-83A4-CD1363907160): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5 - -- Package 3 (04220DCA-EE77-42BE-A9F5-96FD8E8593F2): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=10 - -Since Package 1 appears first, the AppConnectionGroup's virtual environment will have the single DWORD value of 5 (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5). This means that the virtual applications in Package 1, Package 2, and Package 3 will all see the value 5 when they query for HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region. - -Other virtual environment resources are resolved similarly, but the usual case is that the collisions occur in the registry. - -## Merging identical package paths into one virtual directory in connection groups - - -If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment. This merging of paths allows an application in one package to access files that are in a different package. - -When you remove a package from a connection group, the applications in that removed package are no longer able to access files in the remaining packages in the connection group. - -The order in which App-V looks up a file’s name in the connection group is specified by the order in which the App-V packages are listed in the connection group manifest file. - -The following example shows the order and relationship of a file name lookup in a connection group for **Package A** and **Package B**. - - ---- - - - - - - - - - - - - - - - - -
    Package APackage B

    C:\Windows\System32

    C:\Windows\System32

    C:\AppTest

    C:\AppTest

    - -  - -In the example above, when a virtualized application tries to find a specific file, Package A is searched first for a matching file path. If a matching path is not found, Package B is searched, using the following mapping rules: - -- If a file named **test.txt** exists in the same virtual folder hierarchy in both application packages, the first matching file is used. - -- If a file named **bar.txt** exists in the virtual folder hierarchy of one application package, but not in the other, the first matching file is used. - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/about-the-connection-group-virtual-environment51.md b/mdop/appv-v5/about-the-connection-group-virtual-environment51.md deleted file mode 100644 index 3acd54097c..0000000000 --- a/mdop/appv-v5/about-the-connection-group-virtual-environment51.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: About the Connection Group Virtual Environment -description: About the Connection Group Virtual Environment -author: dansimp -ms.assetid: b7bb0e3d-8cd5-45a9-b84e-c9ab4196a18c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Connection Group Virtual Environment - - -**In this topic:** - -- [How package priority is determined](#bkmk-pkg-priority-deter) - -- [Merging identical package paths into one virtual directory in connection groups](#bkmk-merged-root-ve-exp) - -## How package priority is determined - - -The virtual environment and its current state are associated with the connection group, not with the individual packages. If an App-V package is removed from the connection group, the state that existed as part of the connection group will not migrate with the package. - -If the same package is a part of two different connection groups, you have to indicate which connection group App-V should use. For example, you might have two packages in a connection group that each define the same registry DWORD value. - -The connection group that is used is based on the order in which a package appears inside the **AppConnectionGroup** XML document: - -- The first package has the highest precedence. - -- The second package has the second highest precedence. - -Consider the following example section: - -```xml - -``` - -Assume that same DWORD value ABC (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region) is defined in the first and third package, such as: - -- Package 1 (A8731008-4523-4713-83A4-CD1363907160): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5 - -- Package 3 (04220DCA-EE77-42BE-A9F5-96FD8E8593F2): HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=10 - -Since Package 1 appears first, the AppConnectionGroup's virtual environment will have the single DWORD value of 5 (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region=5). This means that the virtual applications in Package 1, Package 2, and Package 3 will all see the value 5 when they query for HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region. - -Other virtual environment resources are resolved similarly, but the usual case is that the collisions occur in the registry. - -## Merging identical package paths into one virtual directory in connection groups - - -If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment. This merging of paths allows an application in one package to access files that are in a different package. - -When you remove a package from a connection group, the applications in that removed package are no longer able to access files in the remaining packages in the connection group. - -The order in which App-V looks up a file’s name in the connection group is specified by the order in which the App-V packages are listed in the connection group manifest file. - -The following example shows the order and relationship of a file name lookup in a connection group for **Package A** and **Package B**. - - ---- - - - - - - - - - - - - - - - - -
    Package APackage B

    C:\Windows\System32

    C:\Windows\System32

    C:\AppTest

    C:\AppTest

    - -  - -In the example above, when a virtualized application tries to find a specific file, Package A is searched first for a matching file path. If a matching path is not found, Package B is searched, using the following mapping rules: - -- If a file named **test.txt** exists in the same virtual folder hierarchy in both application packages, the first matching file is used. - -- If a file named **bar.txt** exists in the virtual folder hierarchy of one application package, but not in the other, the first matching file is used. - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/accessibility-for-app-v-50.md b/mdop/appv-v5/accessibility-for-app-v-50.md deleted file mode 100644 index 4cc6cd8431..0000000000 --- a/mdop/appv-v5/accessibility-for-app-v-50.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Accessibility for App-V 5.0 -description: Accessibility for App-V 5.0 -author: dansimp -ms.assetid: 56696523-6332-4bbe-8ddf-32b1dfe38131 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for App-V 5.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access Any Command with a Few Keystrokes - - -**Important**   -The information in this section only applies to the App-V 5.0 sequencer. For specific information about the App-V 5.0 server, see the Keyboard Shortcuts for the App-V 5.0 Management Server section of this document. - - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Keyboard Shortcuts for the App-V 5.0 Management Server - - -Keyboard Shortcuts for the App-V 5.0 Management Server: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    To do thisPress

    Rename App-V 5.0 connection groups or the App-V 5.0 publishing server description.

    F2

    Transfer access and configuration information from an existing App-V 5.0 package.

    CTRL + Shift + A

    Transfer default configurations from an existing App-V 5.0 package.

    CTRL + Shift + C

    Refresh the current page of the App-V 5.0 client console.

    F5

    On the Connections Groups page of the client management console, copies as a new version.

    CTRL + Shift + C

    - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - - - - - - - - - diff --git a/mdop/appv-v5/accessibility-for-app-v-51.md b/mdop/appv-v5/accessibility-for-app-v-51.md deleted file mode 100644 index 30d29b8cd1..0000000000 --- a/mdop/appv-v5/accessibility-for-app-v-51.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Accessibility for App-V 5.1 -description: Accessibility for App-V 5.1 -author: dansimp -ms.assetid: ef3f7742-f2e9-4748-ad60-74e0961b1bd9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for App-V 5.1 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Keyboard Shortcuts for the App-V 5.1 Management Server - - -Following are the keyboard Shortcuts for the App-V 5.1 Management Server: - - ---- - - - - - - - - - - - - - - - - - - - - -
    To do thisPress

    Close a dialog box.

    Esc

    Perform the default action of a dialog box.

    Enter

    Refresh the current page of the App-V 5.1 client console.

    F5

    - - - -## Keyboard Shortcuts for the App-V 5.1 Sequencer - - -Following are the keyboard shortcuts for the Virtual Registry tab in the package editor in the App-V 5.1 Sequencer: - - ---- - - - - - - - - - - - - - - - - -
    To do thisPress

    Open the Find dialog box.

    CTRL + F

    Open the Replace dialog box.

    CTRL + H

    - - - -### Access Any Command with a Few Keystrokes - -**Important**   -The information in this section only applies to the App-V 5.1 sequencer. For specific information about the App-V 5.1 server, see the Keyboard Shortcuts for the App-V 5.1 Management Server section of this document. - - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - An underline appears beneath the keyboard shortcut for each feature that is available in the current view. - -2. Press the letter underlined in the keyboard shortcut for the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md deleted file mode 100644 index 50214f1054..0000000000 --- a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: Administering App-V 5.0 Virtual Applications by Using the Management Console -description: Administering App-V 5.0 Virtual Applications by Using the Management Console -author: dansimp -ms.assetid: e9280dbd-782b-493a-b495-daab25247795 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 10/03/2016 ---- - - -# Administering App-V 5.0 Virtual Applications by Using the Management Console - - -Use the Microsoft Application Virtualization (App-V) 5.0 management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers that run the App-V 5.0 client. One or more management servers typically share a common data store for configuration and package information. - -The management server uses Active Directory Domain Services (AD DS) groups to manage user authorization and has SQL Server installed to manage the database and data store. - -Because the management servers stream applications to end users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. The management server consists of the following components: - -- Management Server – Use the management server to manage packages and connection groups. - -- Publishing Server – Use the publishing server to deploy packages to computers that run the App-V 5.0 client. - -- Management Database - Use the management database to manage the package access and to publish the server’s synchronization with the management server. - -## Management Console tasks - - -The most common tasks that you can perform with the App-V 5.0 Management console are: - -- [How to Connect to the Management Console](how-to-connect-to-the-management-console-beta.md) - -- [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md) - -- [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md) - -- [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md) - -- [How to Delete a Package in the Management Console](how-to-delete-a-package-in-the-management-console-beta.md) - -- [How to Add or Remove an Administrator by Using the Management Console](how-to-add-or-remove-an-administrator-by-using-the-management-console.md) - -- [How to Register and Unregister a Publishing Server by Using the Management Console](how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md) - -- [How to Create a Custom Configuration File by Using the App-V 5.0 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md) - -- [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md) - -- [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md) - -- [Configure Applications and Default Virtual Application Extensions in Management Console](configure-applications-and-default-virtual-application-extensions-in-management-console.md) - -The main elements of the App-V 5.0 Management Console are: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Management Console tabDescription

    Overview

    -
      -
    • App-V Sequencer - Select this option to review general information about using the App-V 5.0 sequencer.

    • -
    • Application Packages Library – Select this option to open the PACKAGES page of the Management Console. Use this page to review packages that have been added to the server. You can also manage the connection groups, as well as add or upgrade packages.

    • -
    • SERVERS – Select this option to open the SERVERS page of the Management Console. Use this page to review the list of servers that have been registered with your App-V 5.0 infrastructure.

    • -
    • CLIENTS – Select this option to review general information about App-V 5.0 clients.

    • -

    Packages tab

    Use the PACKAGES tab to add or upgrade packages. You can also manage connection groups by clicking CONNECTION GROUPS.

    Servers tab

    Use the SERVERS tab to register a new server.

    Administrators tab

    Use the ADMINISTRATORS tab to register, add, or remove administrators in your App-V 5.0 environment.

    - -  - - - - - - -## Other resources for this App-V 5.0 deployment - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/administering-app-v-51-by-using-powershell.md b/mdop/appv-v5/administering-app-v-51-by-using-powershell.md deleted file mode 100644 index be798c4983..0000000000 --- a/mdop/appv-v5/administering-app-v-51-by-using-powershell.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: Administering App-V 5.1 by Using PowerShell -description: Administering App-V 5.1 by Using PowerShell -author: dansimp -ms.assetid: 9e10ff07-2cd9-4dc1-9e99-582f90c36081 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering App-V 5.1 by Using PowerShell - - -Microsoft Application Virtualization (App-V) 5.1 provides Windows PowerShell cmdlets, which can help administrators perform various App-V 5.1 tasks. The following sections provide more information about using PowerShell with App-V 5.1. - -## How to administer App-V 5.1 by using PowerShell - - -Use the following PowerShell procedures to perform various App-V 5.1 tasks. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    How to Load the PowerShell Cmdlets and Get Cmdlet Help

    Describes how to install the PowerShell cmdlets and find cmdlet help and examples.

    How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell

    Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell.

    How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell

    Describes how to manage connection groups using PowerShell.

    How to Modify Client Configuration by Using PowerShell

    Describes how to modify the client using PowerShell.

    How to Apply the User Configuration File by Using PowerShell

    Describes how to apply a user configuration file using PowerShell.

    How to Apply the Deployment Configuration File by Using PowerShell

    Describes how to apply a deployment configuration file using PowerShell.

    How to Sequence a Package by Using PowerShell

    Describes how to create a new package using PowerShell.

    How to Create a Package Accelerator by Using PowerShell

    Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications.

    How to Enable Reporting on the App-V 5.1 Client by Using PowerShell

    Describes how to enable the computer running the App-V 5.1 to send reporting information.

    How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell

    Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.

    - - - -**Important**   -Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for PowerShell. - - - -## PowerShell Error Handling - - -Use the following table for information about App-V 5.1 PowerShell error handling. - - ---- - - - - - - - - - - - - - - - - -
    EventAction

    Using the RollbackOnError attribute with embedded scripts

    When you use the RollbackOnError attribute with embedded scripts, the attribute is ignored for the following events:

    -
      -
    • Removing a package

    • -
    • Unpublishing a package

    • -
    • Terminating a virtual environment

    • -
    • Terminating a process

    • -

    Package name contains $

    If a package name contains the character ( $ ), you must use a single-quote ( ), for example,

    -

    Add-AppvClientPackage ‘Contoso$App.appv’

    - - - - - - - - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md deleted file mode 100644 index 26ff07008e..0000000000 --- a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Administering App-V 5.1 Virtual Applications by Using the Management Console -description: Administering App-V 5.1 Virtual Applications by Using the Management Console -author: dansimp -ms.assetid: a4d078aa-ec54-4fa4-9463-bfb3b971d724 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering App-V 5.1 Virtual Applications by Using the Management Console - - -Use the Microsoft Application Virtualization (App-V) 5.1 management server to manage packages, connection groups, and package access in your environment. The server publishes application icons, shortcuts, and file type associations to authorized computers that run the App-V 5.1 client. One or more management servers typically share a common data store for configuration and package information. - -The management server uses Active Directory Domain Services (AD DS) groups to manage user authorization and has SQL Server installed to manage the database and data store. - -Because the management servers stream applications to end users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. The management server consists of the following components: - -- Management Server – Use the management server to manage packages and connection groups. - -- Publishing Server – Use the publishing server to deploy packages to computers that run the App-V 5.1 client. - -- Management Database - Use the management database to manage the package access and to publish the server’s synchronization with the management server. - -## Management Console tasks - - -The most common tasks that you can perform with the App-V 5.1 Management console are: - -- [How to Connect to the Management Console](how-to-connect-to-the-management-console-51.md) - -- [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) - -- [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-51.md) - -- [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md) - -- [How to Delete a Package in the Management Console](how-to-delete-a-package-in-the-management-console-51.md) - -- [How to Add or Remove an Administrator by Using the Management Console](how-to-add-or-remove-an-administrator-by-using-the-management-console51.md) - -- [How to Register and Unregister a Publishing Server by Using the Management Console](how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md) - -- [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md) - -- [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md) - -- [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md) - -- [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md) - -The main elements of the App-V 5.1 Management Console are: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Management Console tabDescription

    Packages tab

    Use the PACKAGES tab to add or upgrade packages.

    Connection Groups tab

    Use the CONNECTION GROUPS tab to manage connection groups.

    Servers tab

    Use the SERVERS tab to register a new server.

    Administrators tab

    Use the ADMINISTRATORS tab to register, add, or remove administrators in your App-V 5.1 environment.

    - - - -**Important**   -JavaScript must be enabled on the browser that opens the Web Management Console. - - - - - - - - -## Other resources for this App-V 5.1 deployment - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/administering-app-v-by-using-powershell.md b/mdop/appv-v5/administering-app-v-by-using-powershell.md deleted file mode 100644 index 8d6b8071a3..0000000000 --- a/mdop/appv-v5/administering-app-v-by-using-powershell.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Administering App-V by Using PowerShell -description: Administering App-V by Using PowerShell -author: dansimp -ms.assetid: 1ff4686a-1e19-4eff-b648-ada091281094 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering App-V by Using PowerShell - - -Microsoft Application Virtualization (App-V) 5.0 provides Windows PowerShell cmdlets, which can help administrators perform various App-V 5.0 tasks. The following sections provide more information about using PowerShell with App-V 5.0. - -## How to administer App-V 5.0 by using PowerShell - - -Use the following PowerShell procedures to perform various App-V 5.0 tasks. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    How to Load the PowerShell Cmdlets and Get Cmdlet Help

    Describes how to install the PowerShell cmdlets and find cmdlet help and examples.

    How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell

    Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell.

    How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell

    Describes how to manage connection groups using PowerShell.

    How to Modify Client Configuration by Using PowerShell

    Describes how to modify the client using PowerShell.

    How to Apply the User Configuration File by Using PowerShell

    Describes how to apply a user configuration file using PowerShell.

    How to Apply the Deployment Configuration File by Using PowerShell

    Describes how to apply a deployment configuration file using PowerShell.

    How to Sequence a Package by Using PowerShell

    Describes how to create a new package using PowerShell.

    How to Create a Package Accelerator by Using PowerShell

    Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications.

    How to Enable Reporting on the App-V 5.0 Client by Using PowerShell

    Describes how to enable the computer running the App-V 5.0 to send reporting information.

    How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell

    Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.

    - - - -## PowerShell Error Handling - - -Use the following table for information about App-V 5.0 PowerShell error handling. - - ---- - - - - - - - - - - - - - - - - -
    EventAction

    Using the RollbackOnError attribute with embedded scripts

    When you use the RollbackOnError attribute with embedded scripts, the attribute is ignored for the following events:

    -
      -
    • Removing a package

    • -
    • Unpublishing a package

    • -
    • Terminating a virtual environment

    • -
    • Terminating a process

    • -

    Package name contains $

    If a package name contains the character ( $ ), you must use a single-quote ( ), for example,

    -

    Add-AppvClientPackage ‘Contoso$App.appv’

    - - - - - - - - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-capacity-planning.md b/mdop/appv-v5/app-v-50-capacity-planning.md deleted file mode 100644 index 3fe507eacf..0000000000 --- a/mdop/appv-v5/app-v-50-capacity-planning.md +++ /dev/null @@ -1,963 +0,0 @@ ---- -title: App-V 5.0 Capacity Planning -description: App-V 5.0 Capacity Planning -author: dansimp -ms.assetid: 56f48b00-cd91-4280-9481-5372a0e2e792 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.0 Capacity Planning - - -The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V 5.0 infrastructure. - -**Important**   -Use the information in this section only as a general guide for planning your App-V 5.0 deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary. - - - -## Determine the Project Scope - - -Before you design the App-V 5.0 infrastructure, you must determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V 5.0 infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization. - - ---- - - - - - - - - - - - - - - - - -
    TaskMore Information

    Determine Application Scope

    Depending on the applications to be virtualized, the App-V 5.0 infrastructure can be set up in different ways. The first task is to define what applications you want to virtualize.

    Determine Location Scope

    Location scope refers to the physical locations (for example, enterprise-wide or a specific geographic location) where you plan to run the virtualized applications. It can also refer to the user population (for example, a single department) who will run the virtual applications. You should obtain a network map that includes the connection paths as well as available bandwidth to each location and the number of users using virtualized applications and the WAN link speed.

    - - - -## Determine Which App-V 5.0 Infrastructure is Required - - -**Important**   -Both of the following models require the App-V 5.0 client to be installed on the computer where you plan to run virtual applications. - -You can also manage your App-V 5.0 environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md). - - - -- **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V 5.0 in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios: - - - With disconnected remote users who cannot connect to the App-V 5.0 infrastructure. - - - When you are running a software management system, such as Configuration Manager 2012. - - - When network bandwidth limitations inhibit electronic software distribution. - -- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V 5.0 Full Infrastructure Model consists of one or more App-V 5.0 management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for the App-V 5.0 Server Deployment](planning-for-the-app-v-50-server-deployment.md). The full infrastructure model is recommended for the following scenarios: - - **Important**   - The App-V 5.0 full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - - - - When you want to use the Management Server to publish the application to target computers. - - - For rapid provisioning of applications to target computers. - - - When you want to use App-V 5.0 reporting. - -## End-to-end Server Sizing Guidance - - -The following section provides information about end-to-end App-V 5.0 sizing and planning. For more specific information, refer to the subsequent sections. - -**Note**   -Round trip response time on the client is the time taken by the computer running the App-V 5.0 client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server. - - - -- 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time. (<3 seconds) - -- A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time. (<5 seconds) - -## App-V 5.0 Management Server Capacity Planning Recommendations - - -The App-V 5.0 publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V 5.0 management server supported configurations see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -**Note**   -The default refresh time on the App-V 5.0 publishing server is ten minutes. - - - -When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors influence the round trip response time on the publishing server: - -1. Number of publishing servers making simultaneous requests. - -2. Number of connection groups configured on the management server. - -3. Number of access groups configured on the management server. - -The following table displays more information about each factor that impacts round trip time. - -**Note**   -Round trip response time is the time taken by the computer running the App-V 5.0 publishing server to receive a successful package metadata update from the management server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
    Factors impacting round trip response timeMore Information

    The number of publishing servers simultaneously requesting package metadata refreshes.

    -
      -
    • A single management server can respond to up to 320 publishing servers requesting publishing metadata simultaneously.

    • -
    • Round trip response time for 320 pub servers is ~40 seconds.

    • -
    • For <50 publishing servers requesting metadata simultaneously, the round trip response time is <5 seconds.

    • -
    • From 50 to 320 publishing servers, the response time increases linearly (approximately 2x).

    • -

    The number of connection groups configured on the management server.

    -

    -
      -
    • For up to 100 connection groups, there is no significant change in the round trip response time on the publishing server.

    • -
    • For 100 - 400 connection groups, there is a minor linear increase in the round trip response time.

    • -

    The number of access groups configured on the management server.

    -

    -
      -
    • For up to 40 access groups, there is a linear (approximately 3x) increase in the round trip response time on the publishing server.

    • -
    - - - -The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V 5.0management server. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

    Publishing servers simultaneously contacting management server for publishing metadata.

    Number of publishing servers

    -
      -
    • 0

    • -
    • 0

    • -
    • 0

    • -
    • 0

    • -
    • 0

    • -
    • 0

    • -

    -
      -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -

    -
      -
    • 50

    • -
    • 100

    • -
    • 200

    • -
    • 300

    • -
    • 315

    • -
    • 320

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 5

    • -
    • 10

    • -
    • 19

    • -
    • 32

    • -
    • 30

    • -
    • 37

    • -

    -
      -
    • 17

    • -
    • 17

    • -
    • 17

    • -
    • 15

    • -
    • 17

    • -
    • 15

    • -

    Publishing metadata contains connection groups

    Number of connection groups

    -
      -
    • 10

    • -
    • 50

    • -
    • 100

    • -
    • 150

    • -
    • 300

    • -
    • 400

    • -

    -
      -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -

    -
      -
    • 100

    • -
    • 100

    • -
    • 100

    • -
    • 100

    • -
    • 100

    • -
    • 100

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 10

    • -
    • 11

    • -
    • 11

    • -
    • 16

    • -
    • 22

    • -
    • 25

    • -

    -
      -
    • 17

    • -
    • 19

    • -
    • 22

    • -
    • 19

    • -
    • 20

    • -
    • 20

    • -

    Publishing metadata contains access groups

    Number of access groups

    -
      -
    • 0

    • -
    • 0

    • -
    • 0

    • -
    • 0

    • -

    -
      -
    • 1

    • -
    • 10

    • -
    • 20

    • -
    • 40

    • -

    -
      -
    • 100

    • -
    • 100

    • -
    • 100

    • -
    • 100

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 10

    • -
    • 43

    • -
    • 153

    • -
    • 535

    • -

    -
      -
    • 17

    • -
    • 26

    • -
    • 24

    • -
    • 24

    • -
    - - - -The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example: Transactions/sec is ~30, batch requests ~200, and user connects ~6. - -Using a geographically distributed deployment, where the management server & publishing servers utilize a slow link network between them, the round trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

    Network connection between the publishing server and management server

    1.5 Mbps Slow link Network

    -
      -
    • 0

    • -
    • 0

    • -

    -
      -
    • 1

    • -
    • 1

    • -

    -
      -
    • 50

    • -
    • 100

    • -

    -
      -
    • 1.5Mbps Cable DSL

    • -
    • 1.5Mbps Cable DSL

    • -

    -
      -
    • 4

    • -
    • 5

    • -

    -
      -
    • 1

    • -
    • 2

    • -

    Network connection between the publishing server and management server

    LAN / WIFI Network

    -
      -
    • 0

    • -
    • 0

    • -

    -
      -
    • 1

    • -
    • 1

    • -

    -
      -
    • 100

    • -
    • 200

    • -

    -
      -
    • Wifi

    • -
    • Wifi

    • -

    -
      -
    • 11

    • -
    • 20

    • -

    -
      -
    • 15

    • -
    • 17

    • -
    - - - -Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes. - -## App-V 5.0 Reporting Server Capacity Planning Recommendations - - -App-V 5.0 clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V 5.0 client. For more information about App-V 5.0 Reporting Server supported configurations see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -**Note**   -Round trip response time is the time taken by the computer running the App-V 5.0 client to send the reporting information to the reporting server and receive a successful notification from the reporting server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
    ScenarioSummary

    Multiple App-V 5.0 clients send reporting information to the reporting server simultaneously.

    -
      -
    • Round trip response time from the reporting server is 2.6 seconds for 500 clients.

    • -
    • Round trip response time from the reporting server is 5.65 seconds for 1000 clients.

    • -
    • Round trip response time increases linearly depending on number of clients.

    • -

    Requests per second processed by the reporting server.

    -

    -
      -
    • A single reporting server and a single database, can process a maximum of 139 requests per second. The average is 121 requests/second.

    • -
    • Using two reporting servers reporting to the same Microsoft SQL Server database, the average requests/second is similar to a single reporting server = ~127, with a max of 278 requests/second.

    • -
    • A single reporting server can process 500 concurrent/active connections.

    • -
    • A single reporting server can process a maximum 1500 concurrent connections.

    • -

    Reporting Database.

    -

    -
      -
    • Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second.

    • -
    • Throughput and response time are independent of database size.

    • -
    - - - -**Calculating random delay**: - -The random delay specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between **0** and **ReportingRandomDelay** and will wait the specified duration before sending data. - -Random delay = 4 \* number of clients / average requests per second. - -Example: For 500 clients, with 120 requests per second, the Random delay is, 4 \* 500 / 120 = ~17 minutes. - -## App-V 5.0 Publishing Server Capacity Planning Recommendations - - -Computers running the App-V 5.0 client connect to the App-V 5.0 publishing server to send a publishing refresh request and to receive a response. Round trip response time is measured on the computer running the App-V 5.0 client. Processor time is measured on the publishing server. For more information about App-V 5.0 Publishing Server supported configurations see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -**Important**   -The following list displays the main factors to consider when setting up the App-V 5.0 publishing server: - -- The number of clients connecting simultaneously to a single publishing server. - -- The number of packages in each refresh. - -- The available network bandwidth in your environment between the client and the App-V 5.0 publishing server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
    ScenarioSummary

    Multiple App-V 5.0 clients connect to a single publishing server simultaneously.

    -
      -
    • A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously.

    • -
    • For 5000-10000 clients, the publishing server requires a minimum quad core.

    • -
    • For 10000-20000 clients, the publishing server should have dual quad cores for more efficient response times.

    • -
    • A publishing server with a quad core can refresh up to 10000 packages within 3 seconds. (Supporting 10000 simultaneous clients)

    • -

    Number of packages in each refresh.

    -

    -
      -
    • Increasing number of packages will increase response time by ~40% (up to 1000 packages).

    • -

    Network between the App-V 5.0 client and the publishing server.

    -

    -
      -
    • Across a slow network (1.5 Mbps bandwidth), there is a 97% increase in response time compared to LAN (up to 1000 users).

    • -
    - - - -**Note**   -The publishing server CPU usage is always high during the time interval when it has to process simultaneous requests (>90% in most cases). The publishing server can handle ~1500 client requests in 1 second. - - - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScenarioVariationNumber of App-V 5.0 clientsNumber of packagesProcessor configuration on the publishing serverNetwork connection type publishing server / App-V 5.0 clientRound trip time on the App-V 5.0 client (in seconds)CPU utilization on publishing server (in %)

    App-V 5.0 client sends publishing refresh request & receives response, each request containing 120 packages

    Number of clients

    -
      -
    • 100

    • -
    • 1000

    • -
    • 5000

    • -
    • 10000

    • -

    -
      -
    • 120

    • -
    • 120

    • -
    • 120

    • -
    • 120

    • -

    -
      -
    • Dual Core

    • -
    • Dual Core

    • -
    • Quad Core

    • -
    • Quad Core

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 1

    • -
    • 2

    • -
    • 2

    • -
    • 3

    • -

    -
      -
    • 100

    • -
    • 99

    • -
    • 89

    • -
    • 77

    • -

    Multiple packages in each refresh

    Number of packages

    -
      -
    • 1000

    • -
    • 1000

    • -

    -
      -
    • 500

    • -
    • 1000

    • -

    -
      -
    • Quad Core

    • -
    • Quad Core

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 2

    • -
    • 3

    • -

    -
      -
    • 92

    • -
    • 91

    • -

    Network between client and publishing server

    1.5 Mbps Slow link network

    -
      -
    • 100

    • -
    • 500

    • -
    • 1000

    • -

    -
      -
    • 120

    • -
    • 120

    • -
    • 120

    • -

    -
      -
    • Quad Core

    • -
    • Quad Core

    • -
    • Quad Core

    • -

    -
      -
    • 1.5 Mbps Intra-Continental Network

    • -

    -
      -
    • 3

    • -
    • 10 (with 0.2% failure rate)

    • -
    • 17 (with 1% failure rate)

    • -

    - - - -## App-V 5.0 Streaming Capacity Planning Recommendations - - -Computers running the App-V 5.0 client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V 5.0 client, and is the time taken to stream the entire package. - -**Important**   -The following list identifies the main factors to consider when setting up the App-V 5.0 streaming server: - -- The number of clients streaming application packages simultaneously from a single streaming server. - -- The size of the package being streamed. - -- The available network bandwidth in your environment between the client and the streaming server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
    ScenarioSummary

    Multiple App-V 5.0 clients stream applications from a single streaming server simultaneously.

    -
      -
    • If the number of clients simultaneously streaming from the same server increases, there is a linear relationship with the package download/streaming time.

    • -

    Size of the package being streamed.

    -

    -
      -
    • The package size has a significant impact on the streaming/download time only for larger packages with a size ~ 1GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients.

    • -

    Network between the App-V 5.0 client and the streaming server.

    -

    -
      -
    • Across a slow network (1.5 Mbps bandwidth), there is a 70-80% increase in response time compared to LAN (up to 100 users).

    • -
    - - - -The following table displays sample values for each of the factors in the previous list: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScenarioVariationNumber of App-V 5.0 clientsSize of each packageNetwork connection type streaming server / App-V 5.0 clientRound trip time on the App-V 5.0 client (in seconds)

    Multiple App-V 5.0 clients streaming virtual application packages from a streaming server.

    Number of clients.

    -
      -
    • 100

    • -
    • 200

    • -
    • 1000

    • -
    • -
    • 100

    • -
    • 200

    • -
    • 1000

    • -

    -
      -
    • 3.5 MB

    • -
    • 3.5 MB

    • -
    • 3.5 MB

    • -
    • -
    • 5 MB

    • -
    • 5 MB

    • -
    • 5 MB

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 29

    • -
    • 39

    • -
    • 391

    • -
    • -
    • 35

    • -
    • 68

    • -
    • 461

    • -

    Size of each package being streamed.

    Size of each package.

    -
      -
    • 100

    • -
    • 200

    • -
    • -
    • 100

    • -
    • 200

    • -

    -
      -
    • 21 MB

    • -
    • 21 MB

    • -
    • -
    • 109

    • -
    • 109

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • -
    • LAN

    • -
    • LAN

    • -

    -

    33

    -

    83

    -

    -

    100

    -

    160

    Network connection between client and App-V 5.0 streaming server.

    1.5 Mbps Slow link network.

    -
      -
    • 100

    • -
    • -
    • 100

    • -

    -
      -
    • 3.5 MB

    • -
    • -
    • 5 MB

    • -

    -
      -
    • 1.5 Mbps Intra-Continental Network

    • -

    -

    102

    -

    -

    121

    - - - -Each App-V 5.0 streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications. - -**Note**   -The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions. - - - -For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real world environments streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment in order to properly size the number of required streaming servers. - -The number of clients a streaming server can support can be significantly increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. - -## Combining App-V 5.0 Server Roles - - -Discounting scaling and fault-tolerance requirements, the minimum number of servers needed for a location with connectivity to Active Directory is one. This server will host the management server, management server service, and Microsoft SQL Server roles. Server roles, therefore, can be arranged in any desired combination since they do not conflict with one another. - -Ignoring scaling requirements, the minimum number of servers necessary to provide a fault-tolerant implementation is four. The management server, and Microsoft SQL Server roles support being placed in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure. - -Although there are a number of fault-tolerance strategies and technologies available, not all are applicable to a given service. Additionally, if App-V 5.0 roles are combined, certain fault-tolerance options may no longer apply due to incompatibilities. - - - - - - -## Related topics - - -[App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) - -[Planning for High Availability with App-V 5.0](planning-for-high-availability-with-app-v-50.md) - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-deployment-checklist.md b/mdop/appv-v5/app-v-50-deployment-checklist.md deleted file mode 100644 index 2b84226c10..0000000000 --- a/mdop/appv-v5/app-v-50-deployment-checklist.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: App-V 5.0 Deployment Checklist -description: App-V 5.0 Deployment Checklist -author: dansimp -ms.assetid: d6d93152-82b4-4b02-8b11-ed21d3331f00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.0 Deployment Checklist - - -This checklist can be used to help you during Microsoft Application Virtualization (App-V) 5.0 deployment. - -**Note** -This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V 5.0 features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Complete the planning phase to prepare the computing environment for App-V 5.0 deployment.

    App-V 5.0 Planning Checklist

    Checklist box

    Review the App-V 5.0 supported configurations information to make sure selected client and server computers are supported for App-V 5.0 feature installation.

    App-V 5.0 Supported Configurations

    Checklist box

    Run App-V 5.0 Setup to deploy the required App-V 5.0 features for your environment.

    -
    -Note

    Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process.

    -
    -
    - -

    -

    - - - - - - - - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-planning-checklist.md b/mdop/appv-v5/app-v-50-planning-checklist.md deleted file mode 100644 index 3eeb21f0b8..0000000000 --- a/mdop/appv-v5/app-v-50-planning-checklist.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: App-V 5.0 Planning Checklist -description: App-V 5.0 Planning Checklist -author: dansimp -ms.assetid: 81d3fa62-3c9e-4de7-a9da-cd13112b0862 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.0 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Application Virtualization (App-V) 5.0 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for an App-V 5.0 deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Review the getting started information about App-V 5.0 to gain a basic understanding of the product before beginning deployment planning.

    Getting Started with App-V 5.0

    Checklist box

    Plan for App-V 5.0 1.0 Deployment Prerequisites and prepare your computing environment.

    App-V 5.0 Prerequisites

    Checklist box

    If you plan to use the App-V 5.0 management server, plan for the required roles.

    Planning for the App-V 5.0 Server Deployment

    Checklist box

    Plan for the App-V 5.0 sequencer and client so you to create and run virtualized applications.

    Planning for the App-V 5.0 Sequencer and Client Deployment

    Checklist box

    If applicable, review the options and steps for migrating from a previous version of App-V.

    Planning for Migrating from a Previous Version of App-V

    Checklist box

    Plan for running App-V 5.0 clients using in shared content store mode.

    How to Install the App-V 5.0 Client for Shared Content Store Mode

    - - - - - - - - -## Related topics - - -[Planning for App-V 5.0](planning-for-app-v-50-rc.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-prerequisites.md b/mdop/appv-v5/app-v-50-prerequisites.md deleted file mode 100644 index e90a62583c..0000000000 --- a/mdop/appv-v5/app-v-50-prerequisites.md +++ /dev/null @@ -1,436 +0,0 @@ ---- -title: App-V 5.0 Prerequisites -description: App-V 5.0 Prerequisites -author: dansimp -ms.assetid: 9756b571-c785-4ce6-a95c-d4e134e89429 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.0 Prerequisites - - -Before you begin the Microsoft Application Virtualization (App-V) 5.0 Setup, you should make sure that you have met the prerequisites to install the product. This topic contains information to help you successfully plan for preparing your computing environment before you deploy the App-V 5.0 features. - -**Important** -**The prerequisites in this article apply only to App-V 5.0**. For additional prerequisites that apply to App-V 5.0 Service Packs, see the following web pages: - -- [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) - -- [About App-V 5.0 SP2](about-app-v-50-sp2.md) - -- [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) - - - -The following table lists prerequisite information that pertains to specific operating systems. - - ---- - - - - - - - - - - - - - - - - -
    Operating systemsPrerequisite description

    Computers that are running:

    -
      -
    • Windows 8

    • -
    • Windows Server 2012

    • -

    The following prerequisites are already installed:

    -
      -
    • Microsoft .NET Framework 4.5 – you do not need Microsoft .NET Framework 4

    • -
    • Windows PowerShell 3.0

    • -

    Computers that are running:

    -
      -
    • Windows 7

    • -
    • Windows Server 2008

    • -

    You may want to download the following KB:

    -

    Microsoft Security Advisory: Insecure library loading could allow remote code execution

    -

    Be sure to check for subsequent KBs that have superseded this one, and note that some KBs may require that you uninstall previous updates.

    - - - -## Installation prerequisites for App-V 5.0 - - -**Note** -The following prerequisites are already installed for computers that run Windows 8. - - - -Each of the App-V 5.0 features have specific prerequisites that must be met before the App-V 5.0 features can be successfully installed. - -### Prerequisites for the App-V 5.0 client - -The following table lists the installation prerequisites for the App-V 5.0 client: - - ---- - - - - - - - - - - - - -
    PrerequisiteDetails

    Software requirements

    - - - -### Prerequisites for the App-V 5.0 Remote Desktop Services client - -**Note** -The following prerequisites are already installed for computers that run Windows Server 2012. - - - -The following table lists the installation prerequisites for the App-V 5.0 Remote Desktop Services client: - - ---- - - - - - - - - - - - - -
    PrerequisiteDetails

    Software requirements

    - - - -### Prerequisites for the App-V 5.0 Sequencer - -**Note** -The following prerequisites are already installed for computers that run Windows 8 and Windows Server 2012. - - - -The following table lists the installation prerequisites for the App-V 5.0 Sequencer. If possible, the computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. - -**Note** -If the system requirements of a locally installed application exceed the requirements of the Sequencer, you must meet the requirements of that application. Additionally, because the sequencing process is system resource-intensive, we recommend that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - - - ---- - - - - - - - - - - - - -
    PrerequisiteDetails

    Software requirements

    - - - -### Prerequisites for the App-V 5.0 server - -**Note** -The following prerequisites are already installed for computers that run Windows Server 2012: - -- Microsoft .NET Framework 4.5. This eliminates the Microsoft .NET Framework 4 requirement. - -- Windows PowerShell 3.0 - -- Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (https://support.microsoft.com/kb/2533623) - - **Important** - You can still download install the previous KB. However, it may have been replaced with a more recent version. - - - - - -The following table lists the installation prerequisites for the App-V 5.0 server. The account that you use to install the server components must have administrative rights on the computer that you are installing on. This account must also have the ability to query Active Directory Directory Services. Before you install and configure the App-V 5.0 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to the specified ports. - -**Note** -Web Distributed Authoring and Versioning (WebDAV) is automatically disabled for the Management Service. - - - -The App-V 5.0 server is supported for a standalone deployment, where all the components are deployed on the same server, and a distributed deployment. Depending on the topology that you use to deploy the App-V 5.0 server, the data that you will need for each component will slightly change. - -**Important** -The installation of the App-V 5.0 server on a computer that runs any previous version or component of App-V is not supported. Additionally, the installation of the server components on a computer that runs Server Core or a Domain Controller is also not supported. - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Management Server

    -

    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management server.

    -
      -
    • Installation location - by default this component will be installed to: %PROGRAMFILES%\Microsoft Application Virtualization Server.

    • -
    • Location of the App-V 5.0 management database - SQL Server Name, SQL Instance Name, Database Name.

    • -
    • Access rights for the App-V 5.0 management console - This is the user or the group that should be granted access to the management console at the end of the deployment. After the deployment, only these users will have access to the management console until additional administrators are added through the management console.

      -
      -Note

      Security groups and single users are not supported. You must specify an AD DS group.

      -
      -
      - -
    • -
    • App-V 5.0 management service website name – specify a name for the website or use the default name.

    • -
    • App-V 5.0 management service port binding - this should be a unique port number that is not used by another website on the computer.

    • -
    • Support for Microsoft Silverlight– Microsoft Silverlight must be installed before the management console is available. While this is not a requirement for the deployment, the server must be able to support Microsoft Silverlight.

    • -

    Management Database

    -
    -Note

    The database is required only when using the App-V 5.0 management server.

    -
    -
    - -
    - -

    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database.

    -
      -
    • Installation location - by default this component will be installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.

    • -
    • Custom SQL Server instance name (if applicable) – the format should be INSTANCENAME, because the installation assumes that it is on the local machine. If you specify the name with the following format, SVR\INSTANCE will fail.

    • -
    • Custom App-V 5.0 database name (if applicable) – you must specify a unique database name. The default value for the management database is AppVManagement.

    • -
    • App-V 5.0 management server location – specifies the machine account on which the management server is deployed. This should be specified in the following format Domain\MachineAccount.

    • -
    • App-V 5.0 management server installation administrator - specifies the account that will be used to install the App-V 5.0 management server. You should use the following format: Domain\AdministratorLoginName.

    • -
    • Microsoft SQL Server Service Agent - configure the computer running the App-V 5.0 Management Database so that Microsoft SQL Server Agent service is restarted automatically. For more information see Configure SQL Server Agent to Restart Services Automatically (https://go.microsoft.com/fwlink/?LinkId=273725).

    • -

    Reporting Server

      -
    • Microsoft .NET Framework 4 (Full Package) (https://www.microsoft.com/download/details.aspx?id=17718)

    • -
    • Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)(https://go.microsoft.com/fwlink/?LinkId=267110)

    • -
    • -Note

      To help reduce the risk of unwanted or malicious data being sent to the reporting server, you should restrict access to the Reporting Web Service per your corporate security policy.

      -
      -
      - -
      -

      Windows Web Server with the IIS role with the following features: Common HTTP Features (static content and default document), Application Development (ASP.NET, .NET Extensibility, ISAPI Extensions and ISAPI Filters), Security (Windows Authentication, Request Filtering), Security (Windows Authentication, Request Filtering), Management Tools (IIS Management Console)

    • -
    • 64-bit ASP.NET registration

    • -
    • Installation location - by default this component is installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.

    • -
    • App-V 5.0 reporting service website name – specifies the name of the website or the default name that will be used.

    • -
    • App-V 5.0 reporting service port binding - This should be a unique port number that is not already used by another website that runs on the computer.

    • -

    Reporting Database

    -
    -Note

    The database is required only when using the App-V 5.0 reporting server.

    -
    -
    - -
    - -

    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 reporting database.

    -
      -
    • Installation location - by default this component will be installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.

    • -
    • Custom SQL Server instance name (if applicable) – the format should be INSTANCENAME, because the installation assumes that it is on the local machine. If you specify the name with the following format, SVR\INSTANCE will fail.

    • -
    • Custom App-V 5.0 database name (if applicable) – you must specify a unique database name. The default value for the reporting database is AppVReporting.

    • -
    • App-V 5.0 reporting server location – specifies the machine account on which the reporting server is deployed. This should be specified in the following format Domain\MachineAccount.

    • -
    • App-V 5.0 reporting server installation administrator - specifies the account that will be used to install the App-V 5.0 reporting server. You should use the following format: Domain\AdministratorLoginName.

    • -
    • Microsoft SQL Server Service and the Microsoft SQL Server Agent Service – these services must be associated with user accounts that have access to query AD.

    • -

    Publishing Server

    -

    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 publishing server.

    -
      -
    • Installation location - by default this component is installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.

    • -
    • App-V 5.0 management service URL – specifies the URL of the App-V 5.0 management service. This is the port that the publishing server communicates with, and it should be specified using the following format: http://localhost:12345.

    • -
    • App-V 5.0 publishing service website name – specifies the name of the website or the default name that will be used.

    • -
    • App-V 5.0 publishing service port binding - This should be a unique port number that is not already used by another website that runs on the computer.

    • -
    - - - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - -[App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-security-considerations.md b/mdop/appv-v5/app-v-50-security-considerations.md deleted file mode 100644 index 3425e93637..0000000000 --- a/mdop/appv-v5/app-v-50-security-considerations.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: App-V 5.0 Security Considerations -description: App-V 5.0 Security Considerations -author: dansimp -ms.assetid: 1e7292a0-7972-4b4f-85a9-eaf33f6c563a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.0 Security Considerations - - -This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for App-V 5.0. - -**Important** -App-V 5.0 is not a security product and does not provide any guarantees for a secure environment. - - - -## PackageStoreAccessControl (PSAC) feature has been deprecated - - -Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that was introduced in Microsoft Application Virtualization (App-V) 5.0 Service Pack 2 (SP2) has been deprecated in both single-user and multi-user environments. - -## General security considerations - - -**Understand the security risks.** The most serious risk to App-V 5.0 is that its functionality could be hijacked by an unauthorized user who could then reconfigure key data on App-V 5.0 clients. The loss of App-V 5.0 functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. - -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V 5.0 server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V 5.0 servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V 5.0, subscribe to the Security Notification service (). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V 5.0 and App-V 5.0 administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). - -## Accounts and groups in App-V 5.0 - - -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V 5.0 local groups on the App-V 5.0 servers. - -**Note** -App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. - - - -### App-V 5.0 server security - -No groups are created automatically during App-V 5.0 Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.0 server operations. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Group nameDetails

    App-V Management Admin group

    Used to manage the App-V 5.0 management server. This group is created during the App-V 5.0 Management Server installation.

    -
    -Important

    There is no method to create the group using the management console after you have completed the installation.

    -
    -
    - -

    Database read/write for Management Service account

    Provides read/write access to the management database. This account should be created during the App-V 5.0 management database installation.

    App-V Management Service install admin account

    -
    -Note

    This is only required if management database is being installed separately from the service.

    -
    -
    - -

    Provides public access to schema-version table in management database. This account should be created during the App-V 5.0 management database installation.

    App-V Reporting Service install admin account

    -
    -Note

    This is only required if reporting database is being installed separately from the service.

    -
    -
    - -

    Public access to schema-version table in reporting database. This account should be created during the App-V 5.0 reporting database installation.

    - - - -Consider the following additional information: - -- Access to the package shares - If a share exists on the same computer as the management Server, the **Network** service requires read access to the share. In addition, each App-V client computer must have read access to the package share. - - **Note** - In previous versions of App-V, package share was referred to as content share. - - - -- Registering publishing servers with Management Server - A publishing server must be registered with the Management server. For example, it must be added to the database, so that the Publishing server machine accounts are able to call into the Management service API. - -### App-V 5.0 package security - -The following will help you plan how to ensure that virtualized packages are secure. - -- If an application installer applies an access control list (ACL) to a file or directory, then that ACL is not persisted in the package. When the package is deployed, if the file or directory is modified by a user it will either inherit the ACL in the **%userprofile%** or inherit the ACL of the target computer’s directory. The former case occurs if the file or directory does not exist in a virtual file system location; the latter case occurs if the file or directory exists in a virtual file system location, for example **%windir%**. - -## App-V 5.0 log files - - -During App-V 5.0 Setup, setup log files are created in the **%temp%** folder of the installing user. diff --git a/mdop/appv-v5/app-v-50-sp3-prerequisites.md b/mdop/appv-v5/app-v-50-sp3-prerequisites.md deleted file mode 100644 index 4b92ce66e0..0000000000 --- a/mdop/appv-v5/app-v-50-sp3-prerequisites.md +++ /dev/null @@ -1,659 +0,0 @@ ---- -title: App-V 5.0 SP3 Prerequisites -description: App-V 5.0 SP3 Prerequisites -author: dansimp -ms.assetid: fa8d5578-3a53-4e8a-95c7-e7a5f6e4a31c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.0 SP3 Prerequisites - - -Before installing Microsoft Application Virtualization (App-V) 5.0 SP3, ensure that you have installed all of the following required prerequisite software. - -For a list of supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client, see [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md). - -## Summary of software preinstalled on each operating system - - -The following table indicates the software that is already installed for different operating systems. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Operating systemPrerequisite description

    Windows 8.1

    All of the prerequisite software is already installed.

    Windows 8

    -

    Windows Server 2012

    The following prerequisite software is already installed:

    -
      -
    • Microsoft .NET Framework 4.5

    • -
    • Windows PowerShell 3.0

      -
      -Note

      Installing PowerShell 3.0 requires a restart.

      -
      -
      - -
    • -

    Windows 7

    The prerequisite software is not already installed. You must install it before you can install App-V.

    - - - -## App-V Server prerequisite software - - -Install the required prerequisite software for the App-V 5.0 SP3 Server components. - -### What to know before you start - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Account for installing the App-V Server

    The account that you use to install the App-V Server components must have:

    -
      -
    • Administrative rights on the computer on which you are installing the components.

    • -
    • The ability to query Active Directory Domain Services.

    • -

    Port and firewall

      -
    • Specify a port where each component will be hosted.

    • -
    • Add the associated firewall rules to allow incoming requests to the specified ports.

    • -
    -

    Web Distributed Authoring and Versioning (WebDAV)

    WebDAV is automatically disabled for the Management Service.

    Supported deployment scenarios

      -
    • A stand-alone deployment, where all components are deployed on the same server.

    • -
    • A distributed deployment.

    • -

    Unsupported deployment scenarios

      -
    • Installing the App-V Server on a computer that runs any previous version or component of App-V.

    • -
    • Installing the App-V server components on a computer that runs server core or domain controller.

    • -
    - - - -### Management server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Supported version of SQL Server

    For supported versions, see App-V 5.0 SP3 Supported Configurations.

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Windows PowerShell 3.0

    Installing PowerShell 3.0 requires a restart.

    Download and install KB2533623

    Applies to Windows 7 only.

    Visual C++ Redistributable Packages for Visual Studio 2013

    64-bit ASP.NET registration

    Windows Server Web Server Role

    This role must be added to a server operating system that is supported for the Management server.

    Web Server (IIS) Management Tools

    Click IIS Management Scripts and Tools.

    Web Server Role Services

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -
    -

    Management Tools:

    -
      -
    • IIS Management Console

    • -

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Location of the Management database

    SQL Server database name, SQL Server database instance name, and database name.

    Management console and Management database permissions

    A user or group that can access the Management console and database after the deployment is complete. Only these users or groups will have access to the Management console and database unless additional administrators are added by using the Management console.

    Management service website name

    Name for the Management console website.

    Management service port binding

    Unique port number for the Management service. This port cannot be used by another process on the computer.

    Microsoft Silverlight 5

    The Management console is available only if Silverlight is installed.

    - - - -### Management server database prerequisite software - -The Management database is required only if you are using the App-V 5.0 SP3 Management server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Visual C++ Redistributable Packages for Visual Studio 2013

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Custom SQL Server instance name (if applicable)

    Format to use: INSTANCENAME

    -

    This format is based on the assumption that the installation is on the local computer.

    -

    If you specify the name with the format SVR\INSTANCE, the installation will fail.

    Custom database name (if applicable)

    Unique database name.

    -

    Default: AppVManagement

    Management server location

    Machine account on which the Management server is deployed.

    -

    Format to use: Domain\MachineAccount

    Management server installation administrator

    Account used to install the Management server.

    -

    Format to use: Domain\AdministratorLoginName

    Microsoft SQL Server Service Agent

    Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see Configure SQL Server Agent to Restart Services Automatically.

    - - - -### Publishing server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Visual C++ Redistributable Packages for Visual Studio 2013

    64-bit ASP.NET registration

    Windows Server Web Server Role

    This role must be added to a server operating system that is supported for the Management server.

    Web Server (IIS) Management Tools

    Click IIS Management Scripts and Tools.

    Web Server Role Services

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -
    -

    Management Tools:

    -
      -
    • IIS Management Console

    • -

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Management service URL

    URL of the App-V Management service. This is the port with which the Publishing server communicates.

    - ---- - - - - - - - - - - - - - - - - -
    Installation architectureFormat to use for the URL

    Management server and Publishing server are installed on the same server

    http://localhost:12345

    Management server and Publishing server are installed on different servers

    http://MyAppvServer.MyDomain.com

    -

    -

    Publishing service website name

    Name for the Publishing website.

    Publishing service port binding

    Unique port number for the Publishing service. This port cannot be used by another process on the computer.

    - - - -### Reporting server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Supported version of SQL Server

    For supported versions, see App-V 5.0 SP3 Supported Configurations.

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Visual C++ Redistributable Packages for Visual Studio 2013

    64-bit ASP.NET registration

    Windows Server Web Server Role

    This role must be added to a server operating system that is supported for the Management server.

    Web Server (IIS) Management Tools

    Click IIS Management Scripts and Tools.

    Web Server Role Services

    To reduce the risk of unwanted or malicious data being sent to the Reporting server, you should restrict access to the Reporting Web Service per your corporate security policy.

    -

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -
    -

    Management Tools:

    -
      -
    • IIS Management Console

    • -

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Reporting service website name

    Name for the Reporting website.

    Reporting service port binding

    Unique port number for the Reporting service. This port cannot be used by another process on the computer.

    - - - -### Reporting database prerequisite software - -The Reporting database is required only if you are using the App-V 5.0 SP3 Reporting server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Visual C++ Redistributable Packages for Visual Studio 2013

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Custom SQL Server instance name (if applicable)

    Format to use: INSTANCENAME

    -

    This format is based on the assumption that the installation is on the local computer.

    -

    If you specify the name with the format SVR\INSTANCE, the installation will fail.

    Custom database name (if applicable)

    Unique database name.

    -

    Default: AppVReporting

    Reporting server location

    Machine account on which the Reporting server is deployed.

    -

    Format to use: Domain\MachineAccount

    Reporting server installation administrator

    Account used to install the Reporting server.

    -

    Format to use: Domain\AdministratorLoginName

    Microsoft SQL Server Service and Microsoft SQL Server Service Agent

    Configure these services to be associated with user accounts that have access to query AD DS.

    - - - -## App-V client prerequisite software - - -Install the following prerequisite software for the App-V client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Windows PowerShell 3.0

    -

    Installing PowerShell 3.0 requires a restart.

    KB2533623

    Applies to Windows 7 only: Download and install the KB.

    Visual C++ Redistributable Packages for Visual Studio 2013

    - - - -## Remote Desktop Services client prerequisite software - - -Install the following prerequisite software for the App-V Remote Desktop Services client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Windows PowerShell 3.0

    -

    Installing PowerShell 3.0 requires a restart.

    KB2533623

    Applies to Windows 7 only: Download and install the KB.

    Visual C++ Redistributable Packages for Visual Studio 2013

    - - - -## Sequencer prerequisite software - - -**What to know before installing the prerequisites:** - -- Best practice: The computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. - -- The sequencing process is resource intensive, so make sure that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. The system requirements of locally installed applications cannot exceed those of the Sequencer. For more information, see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Windows PowerShell 3.0

    -

    Installing PowerShell 3.0 requires a restart.

    KB2533623

    Applies to Windows 7 only: Download and install the KB.

    Visual C++ Redistributable Packages for Visual Studio 2013

    - - - - - - - - -## Related topics - - -[Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -[App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md b/mdop/appv-v5/app-v-50-sp3-supported-configurations.md deleted file mode 100644 index 8341bc668d..0000000000 --- a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md +++ /dev/null @@ -1,467 +0,0 @@ ---- -title: App-V 5.0 SP3 Supported Configurations -description: App-V 5.0 SP3 Supported Configurations -author: dansimp -ms.assetid: 08ced79a-0ed3-43c3-82e7-de01c1f33e81 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.0 SP3 Supported Configurations - - -This topic specifies the requirements to install and run Microsoft Application Virtualization (App-V) 5.0 SP3 in your environment. - -## App-V Server system requirements - - -This section lists the operating system and hardware requirements for all of the App-V Server components. - -### Unsupported App-V 5.0 SP3 Server scenarios - -The App-V 5.0 SP3 Server does not support the following scenarios: - -- Deployment to a computer that runs Microsoft Windows Server Core. - -- Deployment to a computer that runs a previous version of App-V 5.0 SP3 Server components. You can install App-V 5.0 SP3 side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. - -- Deployment to a computer that runs Microsoft SQL Server Express edition. - -- Remote deployment of the management server database or the reporting database. You must run the installer directly on the computer that is running Microsoft SQL Server. - -- Deployment to a domain controller. - -- Short paths. If you plan to use a short path, you must create a new volume. - -### Management server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 Management server installation. - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). See [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976) for more information. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - - - -**Important**   -Deployment of the Management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported. - - - -### Management server hardware requirements - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—1 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory - -### Management server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.0 SP3 Management database installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    SQL Server versionService packSystem architecture

    Microsoft SQL Server 2014

    32-bit or 64-bit

    Microsoft SQL Server 2012

    SP2

    32-bit or 64-bit

    Microsoft SQL Server 2008 R2

    SP3

    32-bit or 64-bit

    - - - -### Publishing server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 Publishing server installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - - - -### Publishing server hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory - -### Reporting server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 Reporting server installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - - - -### Reporting server hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -### Reporting server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.0 SP3 Reporting database installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    SQL Server versionService packSystem architecture

    Microsoft SQL Server 2014

    32-bit or 64-bit

    Microsoft SQL Server 2012

    SP2

    32-bit or 64-bit

    Microsoft SQL Server 2008 R2

    SP3

    32-bit or 64-bit

    - - - -## App-V client system requirements - - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 client installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService packSystem architecture

    Microsoft Windows 8.1

    32-bit or 64-bit

    Microsoft Windows 8

    32-bit or 64-bit

    Windows 7

    SP1

    32-bit or 64-bit

    - - - -The following App-V client installation scenarios are not supported, except as noted: - -- Computers that run Windows Server - -- Computers that run App-V 4.6 SP1 or earlier versions - -- The App-V 5.0 SP3 Remote Desktop services client is supported only for RDS-enabled servers - -### App-V client hardware requirements - -The following list displays the supported hardware configuration for the App-V 5.0 SP3 client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## Remote Desktop Services client system requirements - - -The following table lists the operating systems that are supported for App-V 5.0 SP3 Remote Desktop Services (RDS) client installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - - - -### Remote Desktop Services client hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -## Sequencer system requirements - - -The following table lists the operating systems that are supported for the App-V 5.0 SP3 Sequencer installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService packSystem architecture

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    Microsoft Windows 8.1

    32-bit and 64-bit

    Microsoft Windows 8

    32-bit and 64-bit

    Microsoft Windows 7

    SP1

    32-bit and 64-bit

    - - - -### Sequencer hardware requirements - -See the Windows or Windows Server documentation for the hardware requirements. App-V adds no additional hardware requirements. - -## Supported versions of System Center Configuration Manager - - -The App-V client supports the following versions of System Center Configuration Manager: - -- Microsoft System Center 2012 Configuration Manager - -- System Center 2012 R2 Configuration Manager - -- System Center 2012 R2 Configuration Manager SP1 - -For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx). - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - -[App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-50-supported-configurations.md b/mdop/appv-v5/app-v-50-supported-configurations.md deleted file mode 100644 index 4b23a3738a..0000000000 --- a/mdop/appv-v5/app-v-50-supported-configurations.md +++ /dev/null @@ -1,532 +0,0 @@ ---- -title: App-V 5.0 Supported Configurations -description: App-V 5.0 Supported Configurations -author: dansimp -ms.assetid: 3787ff63-7ce7-45a8-8f01-81b4b6dced34 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.0 Supported Configurations - - -This topic specifies the requirements that are necessary to install and run Microsoft Application Virtualization (App-V) 5.0 in your environment. - -**Important** -**The supported configurations in this article apply only to App-V 5.0**. For supported configurations that apply to App-V 5.0 Service Packs, see the following web pages: - -- [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md) - -- [About App-V 5.0 SP2](about-app-v-50-sp2.md) - -- [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md) - - - -## App-V 5.0 server system requirements - - -**Important** -The App-V 5.0 server does not support the following scenarios: - - - -- Deployment to a computer that runs Microsoft Windows Server Core. - -- Deployment to a computer that runs a previous version of App-V 5.0 server components. - - **Note** - You can install App-V 5.0 side-by-side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V 5.0 side-by-side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. - - - -- Deployment to a computer that runs Microsoft SQL Server Express edition. - -- Remote deployment of the management server database or the reporting database. The installer must be run directly on the computer running Microsoft SQL for the database installation to succeed. - -- Deployment to a domain controller. - -- Short paths are not supported. If you plan to use a short path you must create a new volume. - -### Management Server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 management server installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)

    R2

    SP1 and higher

    64-bit

    Microsoft Windows Server 2012 (Standard, Datacenter)

    64-bit

    Microsoft Windows Server 2012 (Standard, Datacenter)

    R2

    64-bit

    - - - -**Important** -Deployment of the management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported. - - - -### Management Server hardware requirements - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM— 1 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory. - -### Publishing Server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 publishing server installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)

    R2

    64-bit

    Microsoft Windows Server 2012 (Standard, Datacenter)

    64-bit

    Microsoft Windows Server 2012 (Standard, Datacenter)

    R2

    64-bit

    - - - -### Publishing Server hardware requirements - -- Processor—1.4 GHz or faster. 64-bit (x64) processor - -- RAM— 2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space. not including content directory - -### Reporting Server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.0 reporting server installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService PackSystem architecture

    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)

    R2

    64-bit

    Microsoft Windows Server 2012 (Standard, Datacenter)

    64-bit

    Microsoft Windows Server 2012 (Standard, Datacenter)

    R2

    64-bit

    - - - -### Reporting Server hardware requirements - -- Processor—1.4 GHz or faster. 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -### SQL Server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.0 database and server installation. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    App-V 5.0 server typeSQL Server versionEditionService packSystem architecture

    Management / Reporting

    Microsoft SQL Server 2008

    -

    (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)

    32-bit or 64-bit

    Management / Reporting

    Microsoft SQL Server 2008

    -

    (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)

    R2

    SP2

    32-bit or 64-bit

    Management / Reporting

    Microsoft SQL Server 2012

    -

    (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)

    32-bit or 64-bit

    - - - -## App-V 5.0 client system requirements - - -The following table lists the operating systems that are supported for the App-V 5.0 client installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService packSystem architecture

    Microsoft Windows 7

    SP1

    32-bit or 64-bit

    Microsoft Windows 8

    32-bit or 64-bit

    -Important

    Windows 8.1 is only supported by App-V 5.0 SP2

    -
    -
    - -
    -

    Windows 8.1

    32-bit or 64-bit

    - - - -The following App-V client installation scenarios are not supported, except as noted: - -- Computers that run Windows Server - -- Computers that run App-V 4.6 SP1 or earlier versions - -- The App-V 5.0 Remote Desktop services client is supported only for RDS-enabled servers - -### Client hardware requirements - -The following list displays the supported hardware configuration for the App-V 5.0 client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## App-V 5.0 Remote Desktop client system requirements - - -The following table lists the operating systems that are supported for App-V 5.0 Remote Desktop client installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - -Operating system -Edition -Service pack -Microsoft Windows Server 2008 - -R2 - -SP1 - -Microsoft Windows Server 2012 - -**Important** -Windows Server 2012 R2 is only supported by App-V 5.0 SP2 - - - -Microsoft Windows Server 2012 (Standard, Datacenter) - -R2 - -64-bit - - - -### Remote Desktop client hardware requirements - -The following list displays the supported hardware configuration for the App-V 5.0 client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## App-V 5.0 Sequencer system requirements - - -The following table lists the operating systems that are supported for App-V 5.0 Sequencer installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Microsoft Windows 7

    SP1

    32-bit and 64-bit

    Microsoft Windows 8

    32-bit and 64-bit

    -Important

    Windows 8.1 is only supported by App-V 5.0 SP2

    -
    -
    - -
    -

    Windows 8.1

    32-bit or 64-bit

    Microsoft Windows Server 2008

    R2

    SP1

    32-bit and 64-bit

    Microsoft Windows Server 2012

    32-bit and 64-bit

    -Important

    Windows Server 2012 R2 is only supported by App-V 5.0 SP2

    -
    -
    - -
    -

    Microsoft Windows Server 2012

    R2

    64-bit

    - - - -## Supported versions of System Center Configuration Manager - - -You can use Microsoft System Center 2012 Configuration Manager or System Center 2012 R2 Configuration Manager to manage App-V virtual applications, reporting, and other functions. The following table lists the supported versions of Configuration Manager for each applicable version of App-V. - - ---- - - - - - - - - - - - - - - - - -
    Supported Configuration Manager versionApp-V version

    Microsoft System Center 2012 Configuration Manager

      -
    • App-V 5.0

    • -
    • App-V 5.0 SP1

    • -
    • App-V 5.0 SP2

    • -

    System Center 2012 R2 Configuration Manager

      -
    • App-V 5.0

    • -
    • App-V 5.0 SP1

    • -
    • App-V 5.0 SP2

    • -
    - - - -For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx). - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - -[App-V 5.0 Prerequisites](app-v-50-prerequisites.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-capacity-planning.md b/mdop/appv-v5/app-v-51-capacity-planning.md deleted file mode 100644 index 0473ec9858..0000000000 --- a/mdop/appv-v5/app-v-51-capacity-planning.md +++ /dev/null @@ -1,963 +0,0 @@ ---- -title: App-V 5.1 Capacity Planning -description: App-V 5.1 Capacity Planning -author: dansimp -ms.assetid: 7a98062f-5a60-49d6-ab40-dc6057e1dd5a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.1 Capacity Planning - - -The following recommendations can be used as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V 5.1 infrastructure. - -**Important**   -Use the information in this section only as a general guide for planning your App-V 5.1 deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary. - - - -## Determine the Project Scope - - -Before you design the App-V 5.1 infrastructure, you must determine the project’s scope. The scope consists of determining which applications will be available virtually and to also identify the target users, and their locations. This information will help determine what type of App-V 5.1 infrastructure should be implemented. Decisions about the scope of the project must be based on the specific needs of your organization. - - ---- - - - - - - - - - - - - - - - - -
    TaskMore Information

    Determine Application Scope

    Depending on the applications to be virtualized, the App-V 5.1 infrastructure can be set up in different ways. The first task is to define what applications you want to virtualize.

    Determine Location Scope

    Location scope refers to the physical locations (for example, enterprise-wide or a specific geographic location) where you plan to run the virtualized applications. It can also refer to the user population (for example, a single department) who will run the virtual applications. You should obtain a network map that includes the connection paths as well as available bandwidth to each location and the number of users using virtualized applications and the WAN link speed.

    - - - -## Determine Which App-V 5.1 Infrastructure is Required - - -**Important**   -Both of the following models require the App-V 5.1 client to be installed on the computer where you plan to run virtual applications. - -You can also manage your App-V 5.1 environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md). - - - -- **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V 5.1 in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios: - - - With disconnected remote users who cannot connect to the App-V 5.1 infrastructure. - - - When you are running a software management system, such as Configuration Manager 2012. - - - When network bandwidth limitations inhibit electronic software distribution. - -- **Full Infrastructure Model** - The full infrastructure model provides for software distribution, management, and reporting capabilities; it also includes the streaming of applications across the network. The App-V 5.1 Full Infrastructure Model consists of one or more App-V 5.1 management servers. The Management Server can be used to publish applications to all clients. The publishing process places the virtual application icons and shortcuts on the target computer. It can also stream applications to local users. For more information about installing the management server see, [Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md). The full infrastructure model is recommended for the following scenarios: - - **Important**   - The App-V 5.1 full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - - - - - When you want to use the Management Server to publish the application to target computers. - - - For rapid provisioning of applications to target computers. - - - When you want to use App-V 5.1 reporting. - -## End-to-end Server Sizing Guidance - - -The following section provides information about end-to-end App-V 5.1 sizing and planning. For more specific information, refer to the subsequent sections. - -**Note**   -Round trip response time on the client is the time taken by the computer running the App-V 5.1 client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server. - - - -- 20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time. (<3 seconds) - -- A single management server can support up to 50 publishing servers for package metadata refreshes in an acceptable round trip time. (<5 seconds) - -## App-V 5.1 Management Server Capacity Planning Recommendations - - -The App-V 5.1 publishing servers require the management server for package refresh requests and package refresh responses. The management server then sends the information to the management database to retrieve information. For more information about App-V 5.1 management server supported configurations see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -**Note**   -The default refresh time on the App-V 5.1 publishing server is ten minutes. - - - -When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors influence the round trip response time on the publishing server: - -1. Number of publishing servers making simultaneous requests. - -2. Number of connection groups configured on the management server. - -3. Number of access groups configured on the management server. - -The following table displays more information about each factor that impacts round trip time. - -**Note**   -Round trip response time is the time taken by the computer running the App-V 5.1 publishing server to receive a successful package metadata update from the management server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
    Factors impacting round trip response timeMore Information

    The number of publishing servers simultaneously requesting package metadata refreshes.

    -
      -
    • A single management server can respond to up to 320 publishing servers requesting publishing metadata simultaneously.

    • -
    • Round trip response time for 320 pub servers is ~40 seconds.

    • -
    • For <50 publishing servers requesting metadata simultaneously, the round trip response time is <5 seconds.

    • -
    • From 50 to 320 publishing servers, the response time increases linearly (approximately 2x).

    • -

    The number of connection groups configured on the management server.

    -

    -
      -
    • For up to 100 connection groups, there is no significant change in the round trip response time on the publishing server.

    • -
    • For 100 - 400 connection groups, there is a minor linear increase in the round trip response time.

    • -

    The number of access groups configured on the management server.

    -

    -
      -
    • For up to 40 access groups, there is a linear (approximately 3x) increase in the round trip response time on the publishing server.

    • -
    - - - -The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V 5.1management server. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

    Publishing servers simultaneously contacting management server for publishing metadata.

    Number of publishing servers

    -
      -
    • 0

    • -
    • 0

    • -
    • 0

    • -
    • 0

    • -
    • 0

    • -
    • 0

    • -

    -
      -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -

    -
      -
    • 50

    • -
    • 100

    • -
    • 200

    • -
    • 300

    • -
    • 315

    • -
    • 320

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 5

    • -
    • 10

    • -
    • 19

    • -
    • 32

    • -
    • 30

    • -
    • 37

    • -

    -
      -
    • 17

    • -
    • 17

    • -
    • 17

    • -
    • 15

    • -
    • 17

    • -
    • 15

    • -

    Publishing metadata contains connection groups

    Number of connection groups

    -
      -
    • 10

    • -
    • 50

    • -
    • 100

    • -
    • 150

    • -
    • 300

    • -
    • 400

    • -

    -
      -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -
    • 1

    • -

    -
      -
    • 100

    • -
    • 100

    • -
    • 100

    • -
    • 100

    • -
    • 100

    • -
    • 100

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 10

    • -
    • 11

    • -
    • 11

    • -
    • 16

    • -
    • 22

    • -
    • 25

    • -

    -
      -
    • 17

    • -
    • 19

    • -
    • 22

    • -
    • 19

    • -
    • 20

    • -
    • 20

    • -

    Publishing metadata contains access groups

    Number of access groups

    -
      -
    • 0

    • -
    • 0

    • -
    • 0

    • -
    • 0

    • -

    -
      -
    • 1

    • -
    • 10

    • -
    • 20

    • -
    • 40

    • -

    -
      -
    • 100

    • -
    • 100

    • -
    • 100

    • -
    • 100

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 10

    • -
    • 43

    • -
    • 153

    • -
    • 535

    • -

    -
      -
    • 17

    • -
    • 26

    • -
    • 24

    • -
    • 24

    • -
    - - - -The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example: Transactions/sec is ~30, batch requests ~200, and user connects ~6. - -Using a geographically distributed deployment, where the management server & publishing servers utilize a slow link network between them, the round trip response time on the publishing servers is within acceptable time limits (<5 seconds), even for 100 simultaneous requests on a single management server. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScenarioVariationNumber of connection groupsNumber of access groupsNumber of publishing serversNetwork connection type publishing server / management serverRound trip response time on the publishing server (in seconds)CPU utilization on management server

    Network connection between the publishing server and management server

    1.5 Mbps Slow link Network

    -
      -
    • 0

    • -
    • 0

    • -

    -
      -
    • 1

    • -
    • 1

    • -

    -
      -
    • 50

    • -
    • 100

    • -

    -
      -
    • 1.5Mbps Cable DSL

    • -
    • 1.5Mbps Cable DSL

    • -

    -
      -
    • 4

    • -
    • 5

    • -

    -
      -
    • 1

    • -
    • 2

    • -

    Network connection between the publishing server and management server

    LAN / WIFI Network

    -
      -
    • 0

    • -
    • 0

    • -

    -
      -
    • 1

    • -
    • 1

    • -

    -
      -
    • 100

    • -
    • 200

    • -

    -
      -
    • Wifi

    • -
    • Wifi

    • -

    -
      -
    • 11

    • -
    • 20

    • -

    -
      -
    • 15

    • -
    • 17

    • -
    - - - -Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes. - -## App-V 5.1 Reporting Server Capacity Planning Recommendations - - -App-V 5.1 clients send reporting data to the reporting server. The reporting server then records the information in the Microsoft SQL Server database and returns a successful notification back to the computer running App-V 5.1 client. For more information about App-V 5.1 Reporting Server supported configurations see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -**Note**   -Round trip response time is the time taken by the computer running the App-V 5.1 client to send the reporting information to the reporting server and receive a successful notification from the reporting server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
    ScenarioSummary

    Multiple App-V 5.1 clients send reporting information to the reporting server simultaneously.

    -
      -
    • Round trip response time from the reporting server is 2.6 seconds for 500 clients.

    • -
    • Round trip response time from the reporting server is 5.65 seconds for 1000 clients.

    • -
    • Round trip response time increases linearly depending on number of clients.

    • -

    Requests per second processed by the reporting server.

    -

    -
      -
    • A single reporting server and a single database, can process a maximum of 139 requests per second. The average is 121 requests/second.

    • -
    • Using two reporting servers reporting to the same Microsoft SQL Server database, the average requests/second is similar to a single reporting server = ~127, with a max of 278 requests/second.

    • -
    • A single reporting server can process 500 concurrent/active connections.

    • -
    • A single reporting server can process a maximum 1500 concurrent connections.

    • -

    Reporting Database.

    -

    -
      -
    • Lock contention on the computer running Microsoft SQL Server is the limiting factor for requests/second.

    • -
    • Throughput and response time are independent of database size.

    • -
    - - - -**Calculating random delay**: - -The random delay specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between **0** and **ReportingRandomDelay** and will wait the specified duration before sending data. - -Random delay = 4 \* number of clients / average requests per second. - -Example: For 500 clients, with 120 requests per second, the Random delay is, 4 \* 500 / 120 = ~17 minutes. - -## App-V 5.1 Publishing Server Capacity Planning Recommendations - - -Computers running the App-V 5.1 client connect to the App-V 5.1 publishing server to send a publishing refresh request and to receive a response. Round trip response time is measured on the computer running the App-V 5.1 client. Processor time is measured on the publishing server. For more information about App-V 5.1 Publishing Server supported configurations see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -**Important**   -The following list displays the main factors to consider when setting up the App-V 5.1 publishing server: - -- The number of clients connecting simultaneously to a single publishing server. - -- The number of packages in each refresh. - -- The available network bandwidth in your environment between the client and the App-V 5.1 publishing server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
    ScenarioSummary

    Multiple App-V 5.1 clients connect to a single publishing server simultaneously.

    -
      -
    • A publishing server running dual core processors can respond to at most 5000 clients requesting a refresh simultaneously.

    • -
    • For 5000-10000 clients, the publishing server requires a minimum quad core.

    • -
    • For 10000-20000 clients, the publishing server should have dual quad cores for more efficient response times.

    • -
    • A publishing server with a quad core can refresh up to 10000 packages within 3 seconds. (Supporting 10000 simultaneous clients)

    • -

    Number of packages in each refresh.

    -

    -
      -
    • Increasing number of packages will increase response time by ~40% (up to 1000 packages).

    • -

    Network between the App-V 5.1 client and the publishing server.

    -

    -
      -
    • Across a slow network (1.5 Mbps bandwidth), there is a 97% increase in response time compared to LAN (up to 1000 users).

    • -
    - - - -**Note**   -The publishing server CPU usage is always high during the time interval when it has to process simultaneous requests (>90% in most cases). The publishing server can handle ~1500 client requests in 1 second. - - - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScenarioVariationNumber of App-V 5.1 clientsNumber of packagesProcessor configuration on the publishing serverNetwork connection type publishing server / App-V 5.1 clientRound trip time on the App-V 5.1 client (in seconds)CPU utilization on publishing server (in %)

    App-V 5.1 client sends publishing refresh request & receives response, each request containing 120 packages

    Number of clients

    -
      -
    • 100

    • -
    • 1000

    • -
    • 5000

    • -
    • 10000

    • -

    -
      -
    • 120

    • -
    • 120

    • -
    • 120

    • -
    • 120

    • -

    -
      -
    • Dual Core

    • -
    • Dual Core

    • -
    • Quad Core

    • -
    • Quad Core

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 1

    • -
    • 2

    • -
    • 2

    • -
    • 3

    • -

    -
      -
    • 100

    • -
    • 99

    • -
    • 89

    • -
    • 77

    • -

    Multiple packages in each refresh

    Number of packages

    -
      -
    • 1000

    • -
    • 1000

    • -

    -
      -
    • 500

    • -
    • 1000

    • -

    -
      -
    • Quad Core

    • -
    • Quad Core

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 2

    • -
    • 3

    • -

    -
      -
    • 92

    • -
    • 91

    • -

    Network between client and publishing server

    1.5 Mbps Slow link network

    -
      -
    • 100

    • -
    • 500

    • -
    • 1000

    • -

    -
      -
    • 120

    • -
    • 120

    • -
    • 120

    • -

    -
      -
    • Quad Core

    • -
    • Quad Core

    • -
    • Quad Core

    • -

    -
      -
    • 1.5 Mbps Intra-Continental Network

    • -

    -
      -
    • 3

    • -
    • 10 (with 0.2% failure rate)

    • -
    • 17 (with 1% failure rate)

    • -

    - - - -## App-V 5.1 Streaming Capacity Planning Recommendations - - -Computers running the App-V 5.1 client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V 5.1 client, and is the time taken to stream the entire package. - -**Important**   -The following list identifies the main factors to consider when setting up the App-V 5.1 streaming server: - -- The number of clients streaming application packages simultaneously from a single streaming server. - -- The size of the package being streamed. - -- The available network bandwidth in your environment between the client and the streaming server. - - - - ---- - - - - - - - - - - - - - - - - - - - - -
    ScenarioSummary

    Multiple App-V 5.1 clients stream applications from a single streaming server simultaneously.

    -
      -
    • If the number of clients simultaneously streaming from the same server increases, there is a linear relationship with the package download/streaming time.

    • -

    Size of the package being streamed.

    -

    -
      -
    • The package size has a significant impact on the streaming/download time only for larger packages with a size ~ 1GB. For package sizes ranging from 3 MB to 100 MB, the streaming time ranges from 20 seconds to 100 seconds, with 100 simultaneous clients.

    • -

    Network between the App-V 5.1 client and the streaming server.

    -

    -
      -
    • Across a slow network (1.5 Mbps bandwidth), there is a 70-80% increase in response time compared to LAN (up to 100 users).

    • -
    - - - -The following table displays sample values for each of the factors in the previous list: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ScenarioVariationNumber of App-V 5.1 clientsSize of each packageNetwork connection type streaming server / App-V 5.1 clientRound trip time on the App-V 5.1 client (in seconds)

    Multiple App-V 5.1 clients streaming virtual application packages from a streaming server.

    Number of clients.

    -
      -
    • 100

    • -
    • 200

    • -
    • 1000

    • -
    • -
    • 100

    • -
    • 200

    • -
    • 1000

    • -

    -
      -
    • 3.5 MB

    • -
    • 3.5 MB

    • -
    • 3.5 MB

    • -
    • -
    • 5 MB

    • -
    • 5 MB

    • -
    • 5 MB

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -
    • -
    • LAN

    • -
    • LAN

    • -
    • LAN

    • -

    -
      -
    • 29

    • -
    • 39

    • -
    • 391

    • -
    • -
    • 35

    • -
    • 68

    • -
    • 461

    • -

    Size of each package being streamed.

    Size of each package.

    -
      -
    • 100

    • -
    • 200

    • -
    • -
    • 100

    • -
    • 200

    • -

    -
      -
    • 21 MB

    • -
    • 21 MB

    • -
    • -
    • 109

    • -
    • 109

    • -

    -
      -
    • LAN

    • -
    • LAN

    • -
    • -
    • LAN

    • -
    • LAN

    • -

    -

    33

    -

    83

    -

    -

    100

    -

    160

    Network connection between client and App-V 5.1 streaming server.

    1.5 Mbps Slow link network.

    -
      -
    • 100

    • -
    • -
    • 100

    • -

    -
      -
    • 3.5 MB

    • -
    • -
    • 5 MB

    • -

    -
      -
    • 1.5 Mbps Intra-Continental Network

    • -

    -

    102

    -

    -

    121

    - - - -Each App-V 5.1 streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications. - -**Note**   -The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions. - - - -For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real world environments streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment in order to properly size the number of required streaming servers. - -The number of clients a streaming server can support can be significantly increased and the peak streaming requirements reduced if you pre-cache your applications. You can also increase the number of clients a streaming server can support by using on-demand streaming delivery and stream optimized packages. - -## Combining App-V 5.1 Server Roles - - -Discounting scaling and fault-tolerance requirements, the minimum number of servers needed for a location with connectivity to Active Directory is one. This server will host the management server, management server service, and Microsoft SQL Server roles. Server roles, therefore, can be arranged in any desired combination since they do not conflict with one another. - -Ignoring scaling requirements, the minimum number of servers necessary to provide a fault-tolerant implementation is four. The management server, and Microsoft SQL Server roles support being placed in fault-tolerant configurations. The management server service can be combined with any of the roles, but remains a single point of failure. - -Although there are a number of fault-tolerance strategies and technologies available, not all are applicable to a given service. Additionally, if App-V 5.1 roles are combined, certain fault-tolerance options may no longer apply due to incompatibilities. - - - - - - -## Related topics - - -[App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) - -[Planning for High Availability with App-V 5.1](planning-for-high-availability-with-app-v-51.md) - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-deployment-checklist.md b/mdop/appv-v5/app-v-51-deployment-checklist.md deleted file mode 100644 index 955988dde1..0000000000 --- a/mdop/appv-v5/app-v-51-deployment-checklist.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: App-V 5.1 Deployment Checklist -description: App-V 5.1 Deployment Checklist -author: dansimp -ms.assetid: 44bed85a-e4f5-49d7-a308-a2b681f76372 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.1 Deployment Checklist - - -This checklist can be used to help you during Microsoft Application Virtualization (App-V) 5.1 deployment. - -**Note** -This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V 5.1 features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Complete the planning phase to prepare the computing environment for App-V 5.1 deployment.

    App-V 5.1 Planning Checklist

    Checklist box

    Review the App-V 5.1 supported configurations information to make sure selected client and server computers are supported for App-V 5.1 feature installation.

    App-V 5.1 Supported Configurations

    Checklist box

    Run App-V 5.1 Setup to deploy the required App-V 5.1 features for your environment.

    -
    -Note

    Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process.

    -
    -
    - -

    -

    - - - - - - - - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-planning-checklist.md b/mdop/appv-v5/app-v-51-planning-checklist.md deleted file mode 100644 index e1f8ef66b6..0000000000 --- a/mdop/appv-v5/app-v-51-planning-checklist.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: App-V 5.1 Planning Checklist -description: App-V 5.1 Planning Checklist -author: dansimp -ms.assetid: 1e26a861-0612-43a6-972f-375a40a8dcbc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.1 Planning Checklist - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Application Virtualization (App-V) 5.1 deployment. - -> [!NOTE] -> This checklist outlines the recommended steps and a high-level list of items to consider when planning for an App-V 5.1 deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - -| |Task |References | -|-|-|-| -|![Checklist box](images/checklistbox.gif) |Review the getting started information about App-V 5.1 to gain a basic understanding of the product before beginning deployment planning.|[Getting Started with App-V 5.1](getting-started-with-app-v-51.md)| -|![Checklist box](images/checklistbox.gif) |Plan for App-V 5.1 1.0 Deployment Prerequisites and prepare your computing environment.|[App-V 5.1 Prerequisites](app-v-51-prerequisites.md)| -|![Checklist box](images/checklistbox.gif) |If you plan to use the App-V 5.1 management server, plan for the required roles.|[Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md)| -|![Checklist box](images/checklistbox.gif) |Plan for the App-V 5.1 sequencer and client so you to create and run virtualized applications.|[Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md)| -|![Checklist box](images/checklistbox.gif) |If applicable, review the options and steps for migrating from a previous version of App-V.|[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md)| -|![Checklist box](images/checklistbox.gif) |Plan for running App-V 5.1 clients using in shared content store mode.|[How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md)| -|![Checklist box](images/checklistbox.gif) | | | - -## Related topics - -[Planning for App-V 5.1](planning-for-app-v-51.md) diff --git a/mdop/appv-v5/app-v-51-prerequisites.md b/mdop/appv-v5/app-v-51-prerequisites.md deleted file mode 100644 index f9709263ec..0000000000 --- a/mdop/appv-v5/app-v-51-prerequisites.md +++ /dev/null @@ -1,665 +0,0 @@ ---- -title: App-V 5.1 Prerequisites -description: App-V 5.1 Prerequisites -author: dansimp -ms.assetid: 1bfa03c1-a4ae-45ec-8a2b-b10c2b94bfb0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# App-V 5.1 Prerequisites - - -Before installing Microsoft Application Virtualization (App-V) 5.1, ensure that you have installed all of the following required prerequisite software. - -For a list of supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -## Summary of software preinstalled on each operating system - - -The following table indicates the software that is already installed for different operating systems. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemPrerequisite description

    Windows 10

    All of the prerequisite software is already installed.

    Windows 8.1

    All of the prerequisite software is already installed.

    -
    -Note

    If you are running Windows 8, upgrade to Windows 8.1 before using App-V 5.1.

    -
    -
    - -

    Windows Server 2012

    The following prerequisite software is already installed:

    -
      -
    • Microsoft .NET Framework 4.5

    • -
    • Windows PowerShell 3.0

      -
      -Note

      Installing PowerShell 3.0 requires a restart.

      -
      -
      - -
    • -

    Windows 7

    The prerequisite software is not already installed. You must install it before you can install App-V.

    - - - -## App-V Server prerequisite software - - -Install the required prerequisite software for the App-V 5.1 Server components. - -### What to know before you start - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Account for installing the App-V Server

    The account that you use to install the App-V Server components must have:

    -
      -
    • Administrative rights on the computer on which you are installing the components.

    • -
    • The ability to query Active Directory Domain Services.

    • -

    Port and firewall

      -
    • Specify a port where each component will be hosted.

    • -
    • Add the associated firewall rules to allow incoming requests to the specified ports.

    • -
    -

    Web Distributed Authoring and Versioning (WebDAV)

    WebDAV is automatically disabled for the Management Service.

    Supported deployment scenarios

      -
    • A stand-alone deployment, where all components are deployed on the same server.

    • -
    • A distributed deployment.

    • -

    Unsupported deployment scenarios

      -
    • Installing side-by-side instances of multiple App-V Server versions on the same server.

    • -
    • Installing the App-V server components on a computer that runs server core or domain controller.

    • -
    - - - -### Management server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Supported version of SQL Server

    For supported versions, see App-V 5.1 Supported Configurations.

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Windows PowerShell 3.0

    Installing PowerShell 3.0 requires a restart.

    Download and install KB2533623

    Applies to Windows 7 only.

    Visual C++ Redistributable Packages for Visual Studio 2013

    64-bit ASP.NET registration

    Windows Server Web Server Role

    This role must be added to a server operating system that is supported for the Management server.

    Web Server (IIS) Management Tools

    Click IIS Management Scripts and Tools.

    Web Server Role Services

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -
    -

    Management Tools:

    -
      -
    • IIS Management Console

    • -

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Location of the Management database

    SQL Server database name, SQL Server database instance name, and database name.

    Management console and Management database permissions

    A user or group that can access the Management console and database after the deployment is complete. Only these users or groups will have access to the Management console and database unless additional administrators are added by using the Management console.

    Management service website name

    Name for the Management console website.

    Management service port binding

    Unique port number for the Management service. This port cannot be used by another process on the computer.

    - - - -**Important** -JavaScript must be enabled on the browser that opens the Web Management Console. - - - -### Management server database prerequisite software - -The Management database is required only if you are using the App-V 5.1 Management server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Visual C++ Redistributable Packages for Visual Studio 2013

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Custom SQL Server instance name (if applicable)

    Format to use: INSTANCENAME

    -

    This format is based on the assumption that the installation is on the local computer.

    -

    If you specify the name with the format SVR\INSTANCE, the installation will fail.

    Custom database name (if applicable)

    Unique database name.

    -

    Default: AppVManagement

    Management server location

    Machine account on which the Management server is deployed.

    -

    Format to use: Domain\MachineAccount

    Management server installation administrator

    Account used to install the Management server.

    -

    Format to use: Domain\AdministratorLoginName

    Microsoft SQL Server Service Agent

    Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see Configure SQL Server Agent to Restart Services Automatically.

    - - - -### Publishing server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Visual C++ Redistributable Packages for Visual Studio 2013

    64-bit ASP.NET registration

    Windows Server Web Server Role

    This role must be added to a server operating system that is supported for the Management server.

    Web Server (IIS) Management Tools

    Click IIS Management Scripts and Tools.

    Web Server Role Services

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -
    -

    Management Tools:

    -
      -
    • IIS Management Console

    • -

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Management service URL

    URL of the App-V Management service. This is the port with which the Publishing server communicates.

    - ---- - - - - - - - - - - - - - - - - -
    Installation architectureFormat to use for the URL

    Management server and Publishing server are installed on the same server

    http://localhost:12345

    Management server and Publishing server are installed on different servers

    http://MyAppvServer.MyDomain.com

    -

    -

    Publishing service website name

    Name for the Publishing website.

    Publishing service port binding

    Unique port number for the Publishing service. This port cannot be used by another process on the computer.

    - - - -### Reporting server prerequisite software - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Supported version of SQL Server

    For supported versions, see App-V 5.1 Supported Configurations.

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Visual C++ Redistributable Packages for Visual Studio 2013

    64-bit ASP.NET registration

    Windows Server Web Server Role

    This role must be added to a server operating system that is supported for the Management server.

    Web Server (IIS) Management Tools

    Click IIS Management Scripts and Tools.

    Web Server Role Services

    To reduce the risk of unwanted or malicious data being sent to the Reporting server, you should restrict access to the Reporting Web Service per your corporate security policy.

    -

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -
    -

    Management Tools:

    -
      -
    • IIS Management Console

    • -

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Reporting service website name

    Name for the Reporting website.

    Reporting service port binding

    Unique port number for the Reporting service. This port cannot be used by another process on the computer.

    - - - -### Reporting database prerequisite software - -The Reporting database is required only if you are using the App-V 5.1 Reporting server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Prerequisites and required settingsDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Visual C++ Redistributable Packages for Visual Studio 2013

    Default installation location

    %PROGRAMFILES%\Microsoft Application Virtualization Server

    Custom SQL Server instance name (if applicable)

    Format to use: INSTANCENAME

    -

    This format is based on the assumption that the installation is on the local computer.

    -

    If you specify the name with the format SVR\INSTANCE, the installation will fail.

    Custom database name (if applicable)

    Unique database name.

    -

    Default: AppVReporting

    Reporting server location

    Machine account on which the Reporting server is deployed.

    -

    Format to use: Domain\MachineAccount

    Reporting server installation administrator

    Account used to install the Reporting server.

    -

    Format to use: Domain\AdministratorLoginName

    Microsoft SQL Server Service and Microsoft SQL Server Service Agent

    Configure these services to be associated with user accounts that have access to query AD DS.

    - - - -## App-V client prerequisite software - - -Install the following prerequisite software for the App-V client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Windows PowerShell 3.0

    -

    Installing PowerShell 3.0 requires a restart.

    KB2533623

    Applies to Windows 7 only: Download and install the KB.

    Visual C++ Redistributable Packages for Visual Studio 2013

    - - - -## Remote Desktop Services client prerequisite software - - -Install the following prerequisite software for the App-V Remote Desktop Services client. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Windows PowerShell 3.0

    -

    Installing PowerShell 3.0 requires a restart.

    KB2533623

    Applies to Windows 7 only: Download and install the KB.

    Visual C++ Redistributable Packages for Visual Studio 2013

    - - - -## Sequencer prerequisite software - - -**What to know before installing the prerequisites:** - -- Best practice: The computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications. - -- The sequencing process is resource intensive, so make sure that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. The system requirements of locally installed applications cannot exceed those of the Sequencer. For more information, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - - ---- - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Microsoft .NET Framework 4.5.1 (Web Installer)

    Windows PowerShell 3.0

    -

    Installing PowerShell 3.0 requires a restart.

    KB2533623

    Applies to Windows 7 only: Download and install the KB.

    - - - - - - - - -## Related topics - - -[Planning for App-V 5.1](planning-for-app-v-51.md) - -[App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-security-considerations.md b/mdop/appv-v5/app-v-51-security-considerations.md deleted file mode 100644 index cf442e5690..0000000000 --- a/mdop/appv-v5/app-v-51-security-considerations.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: App-V 5.1 Security Considerations -description: App-V 5.1 Security Considerations -author: dansimp -ms.assetid: 6bc6c1fc-f813-47d4-b763-06fd4faf6a72 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# App-V 5.1 Security Considerations - - -This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for Microsoft Application Virtualization (App-V) 5.1. - -**Important** -App-V 5.1 is not a security product and does not provide any guarantees for a secure environment. - - - -## PackageStoreAccessControl (PSAC) feature has been deprecated - - -Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that was introduced in Microsoft Application Virtualization (App-V) 5.0 Service Pack 2 (SP2) has been deprecated in both single-user and multi-user environments. - -## General security considerations - - -**Understand the security risks.** The most serious risk to App-V 5.1 is that its functionality could be hijacked by an unauthorized user who could then reconfigure key data on App-V 5.1 clients. The loss of App-V 5.1 functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. - -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an App-V 5.1 server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. App-V 5.1 servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. To stay informed about the latest updates for operating systems, Microsoft SQL Server, and App-V 5.1, subscribe to the Security Notification service (). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all App-V 5.1 and App-V 5.1 administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). - -## Accounts and groups in App-V 5.1 - - -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V 5.1 local groups on the App-V 5.1 servers. - -**Note** -App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group. - - - -### App-V 5.1 server security - -No groups are created automatically during App-V 5.1 Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.1 server operations. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Group nameDetails

    App-V Management Admin group

    Used to manage the App-V 5.1 management server. This group is created during the App-V 5.1 Management Server installation.

    -
    -Important

    There is no method to create the group using the management console after you have completed the installation.

    -
    -
    - -

    Database read/write for Management Service account

    Provides read/write access to the management database. This account should be created during the App-V 5.1 management database installation.

    App-V Management Service install admin account

    -
    -Note

    This is only required if management database is being installed separately from the service.

    -
    -
    - -

    Provides public access to schema-version table in management database. This account should be created during the App-V 5.1 management database installation.

    App-V Reporting Service install admin account

    -
    -Note

    This is only required if reporting database is being installed separately from the service.

    -
    -
    - -

    Public access to schema-version table in reporting database. This account should be created during the App-V 5.1 reporting database installation.

    - - - -Consider the following additional information: - -- Access to the package shares - If a share exists on the same computer as the management Server, the **Network** service requires read access to the share. In addition, each App-V client computer must have read access to the package share. - - **Note** - In previous versions of App-V, package share was referred to as content share. - - - -- Registering publishing servers with Management Server - A publishing server must be registered with the Management server. For example, it must be added to the database, so that the Publishing server machine accounts are able to call into the Management service API. - -### App-V 5.1 package security - -The following will help you plan how to ensure that virtualized packages are secure. - -- If an application installer applies an access control list (ACL) to a file or directory, then that ACL is not persisted in the package. When the package is deployed, if the file or directory is modified by a user it will either inherit the ACL in the **%userprofile%** or inherit the ACL of the target computer’s directory. The former case occurs if the file or directory does not exist in a virtual file system location; the latter case occurs if the file or directory exists in a virtual file system location, for example **%windir%**. - -## App-V 5.1 log files - - -During App-V 5.1 Setup, setup log files are created in the **%temp%** folder of the installing user. - - - - - - -## Related topics - - -[Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/app-v-51-supported-configurations.md b/mdop/appv-v5/app-v-51-supported-configurations.md deleted file mode 100644 index 7785be89ee..0000000000 --- a/mdop/appv-v5/app-v-51-supported-configurations.md +++ /dev/null @@ -1,551 +0,0 @@ ---- -title: App-V 5.1 Supported Configurations -description: App-V 5.1 Supported Configurations -author: dansimp -ms.assetid: 8b8db63b-f71c-4ae9-80e7-a6752334e1f6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/02/2020 ---- - - -# App-V 5.1 Supported Configurations - -This topic specifies the requirements to install and run Microsoft Application Virtualization (App-V) 5.1 in your environment. - -## App-V Server system requirements - -This section lists the operating system and hardware requirements for all of the App-V Server components. - -### Unsupported App-V 5.1 Server scenarios - -The App-V 5.1 Server does not support the following scenarios: - -- Deployment to a computer that runs Microsoft Windows Server Core. - -- Deployment to a computer that runs a previous version of App-V 5.1 Server components. You can install App-V 5.1 side by side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V side by side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported. - -- Deployment to a computer that runs Microsoft SQL Server Express edition. - -- Deployment to a domain controller. - -- Short paths. If you plan to use a short path, you must create a new volume. - -### Management server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.1 Management server installation. - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). See [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976) for more information. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2016

    64-bit

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - - - -**Important**   -Deployment of the Management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported. - - - -### Management server hardware requirements - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—1 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory - -### Management server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.1 Management database installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SQL Server versionService packSystem architecture

    Microsoft SQL Server 2019

    32-bit or 64-bit

    Microsoft SQL Server 2017

    32-bit or 64-bit

    Microsoft SQL Server 2016

    SP2

    32-bit or 64-bit

    Microsoft SQL Server 2014

    SP2

    32-bit or 64-bit

    Microsoft SQL Server 2012

    SP2

    32-bit or 64-bit

    Microsoft SQL Server 2008 R2

    SP3

    32-bit or 64-bit

    - -For more information on user configuration files with SQL server 2016 or later, see the [support article](https://support.microsoft.com/help/4548751/app-v-server-publishing-might-fail-when-you-apply-user-configuration-f). - -### Publishing server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.1 Publishing server installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2016

    64-bit

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - - - -### Publishing server hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space, not including the content directory - -### Reporting server operating system requirements - -The following table lists the operating systems that are supported for the App-V 5.1 Reporting server installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2016

    64-bit

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - - - -### Reporting server hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -### Reporting server database requirements - -The following table lists the SQL Server versions that are supported for the App-V 5.1 Reporting database installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SQL Server versionService packSystem architecture

    Microsoft SQL Server 2017

    32-bit or 64-bit

    Microsoft SQL Server 2016

    SP2

    32-bit or 64-bit

    Microsoft SQL Server 2014

    SP2

    32-bit or 64-bit

    Microsoft SQL Server 2012

    SP2

    32-bit or 64-bit

    Microsoft SQL Server 2008 R2

    SP3

    32-bit or 64-bit

    - - - -## App-V client system requirements - -The following table lists the operating systems that are supported for the App-V 5.1 client installation. - -**Note:** With the Windows 10 Anniversary release (aka 1607 version), the App-V client is in-box and will block installation of any previous version of the App-V client - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService packSystem architecture

    Microsoft Windows 10 (pre-1607 version)

    32-bit or 64-bit

    Microsoft Windows 8.1

    32-bit or 64-bit

    Windows 7

    SP1

    32-bit or 64-bit

    - - - -The following App-V client installation scenarios are not supported, except as noted: - -- Computers that run Windows Server - -- Computers that run App-V 4.6 SP1 or earlier versions - -- The App-V 5.1 Remote Desktop services client is supported only for RDS-enabled servers - -### App-V client hardware requirements - -The following list displays the supported hardware configuration for the App-V 5.1 client installation. - -- Processor— 1.4 GHz or faster 32-bit (x86) or 64-bit (x64) processor - -- RAM— 1 GB (32-bit) or 2 GB (64-bit) - -- Disk— 100 MB for installation, not including the disk space that is used by virtualized applications. - -## Remote Desktop Services client system requirements - - -The following table lists the operating systems that are supported for App-V 5.1 Remote Desktop Services (RDS) client installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService PackSystem architecture

    Microsoft Windows Server 2016

    64-bit

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    - - - -### Remote Desktop Services client hardware requirements - -App-V adds no additional requirements beyond those of Windows Server. - -- Processor—1.4 GHz or faster, 64-bit (x64) processor - -- RAM—2 GB RAM (64-bit) - -- Disk space—200 MB available hard disk space - -## Sequencer system requirements - -The following table lists the operating systems that are supported for the App-V 5.1 Sequencer installation. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemService packSystem architecture

    Microsoft Windows Server 2016

    64-bit

    Microsoft Windows Server 2012 R2

    64-bit

    Microsoft Windows Server 2012

    64-bit

    Microsoft Windows Server 2008 R2

    SP1

    64-bit

    Microsoft Windows 10

    32-bit and 64-bit

    Microsoft Windows 8.1

    32-bit and 64-bit

    Microsoft Windows 7

    SP1

    32-bit and 64-bit

    - - - -### Sequencer hardware requirements - -See the Windows or Windows Server documentation for the hardware requirements. App-V adds no additional hardware requirements. - -## Supported versions of System Center Configuration Manager - -The App-V client supports the following versions of System Center Configuration Manager: - -- Microsoft System Center 2012 Configuration Manager - -- System Center 2012 R2 Configuration Manager - -- System Center 2012 R2 Configuration Manager SP1 - -The following App-V and System Center Configuration Manager version matrix shows all officially supported combinations of App-V and Configuration Manager. - -**Note:** Both App-V 4.5 and 4.6 have exited Mainstream support. - - ---------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    App-V VersionSystem Center Configuration Manager 2007System Center 2012 Configuration ManagerSystem Center 2012 Configuration Manager SP1System Center 2012 R2 Configuration ManagerSystem Center 2012 R2 Configuration Manager SP1System Center 2012 Configuration Manager SP2System Center Configuration Manager Version 1511

    App-V 5.0 SP3

    MSI-Wrapper Only

    No

    2012 SP1 CU4

    2012 R2 CU1

    Yes

    Yes

    Yes

    App-V 5.1

    MSI-Wrapper Only

    No

    2012 SP1 CU4

    2012 R2 CU1

    Yes

    Yes

    Yes

    - - - -For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx). - -## Related topics - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - -[App-V 5.1 Prerequisites](app-v-51-prerequisites.md) diff --git a/mdop/appv-v5/application-publishing-and-client-interaction.md b/mdop/appv-v5/application-publishing-and-client-interaction.md deleted file mode 100644 index 6c060982f7..0000000000 --- a/mdop/appv-v5/application-publishing-and-client-interaction.md +++ /dev/null @@ -1,1635 +0,0 @@ ---- -title: Application Publishing and Client Interaction -description: Application Publishing and Client Interaction -author: dansimp -ms.assetid: c69a724a-85d1-4e2d-94a2-7ffe0b47d971 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Application Publishing and Client Interaction - - -This article provides technical information about common App-V client operations and their integration with the local operating system. - -- [App-V package files created by the Sequencer](#bkmk-appv-pkg-files-list) - -- [What’s in the appv file?](#bkmk-appv-file-contents) - -- [App-V client data storage locations](#bkmk-files-data-storage) - -- [Package registry](#bkmk-pkg-registry) - -- [App-V package store behavior](#bkmk-pkg-store-behavior) - -- [Roaming registry and data](#bkmk-roaming-reg-data) - -- [App-V client application lifecycle management](#bkmk-clt-app-lifecycle) - -- [Integration of App-V packages](#bkmk-integr-appv-pkgs) - -- [Dynamic configuration processing](#bkmk-dynamic-config) - -- [Side-by-side assemblies](#bkmk-sidebyside-assemblies) - -- [Client logging](#bkmk-client-logging) - -For additional reference information, see [Microsoft Application Virtualization (App-V) Documentation Resources Download Page](https://www.microsoft.com/download/details.aspx?id=27760). - -## App-V package files created by the Sequencer - - -The Sequencer creates App-V packages and produces a virtualized application. The sequencing process creates the following files: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FileDescription

    .appv

      -
    • The primary package file, which contains the captured assets and state information from the sequencing process.

    • -
    • Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.

    • -

    .MSI

    Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.

    _DeploymentConfig.XML

    File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client.

    _UserConfig.XML

    File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client.

    Report.xml

    Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.

    .CAB

    Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.

    .appvt

    Optional: Sequencer template file used to retain commonly reused Sequencer settings.

    - - - -For information about sequencing, see [Application Virtualization 5.0 Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760). - -## What’s in the appv file? - - -The appv file is a container that stores XML and non-XML files together in a single entity. This file is built from the AppX format, which is based on the Open Packaging Conventions (OPC) standard. - -To view the appv file contents, make a copy of the package, and then rename the copied file to a ZIP extension. - -The appv file contains the following folder and files, which are used when creating and publishing a virtual application: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescription

    Root

    File folder

    Directory that contains the file system for the virtualized application that is captured during sequencing.

    [Content_Types].xml

    XML File

    List of the core content types in the appv file (e.g. DLL, EXE, BIN).

    AppxBlockMap.xml

    XML File

    Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package.

    AppxManifest.xml

    XML File

    Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package.

    FilesystemMetadata.xml

    XML File

    List of the files captured during sequencing, including attributes (e.g., directories, files, opaque directories, empty directories,and long and short names).

    PackageHistory.xml

    XML File

    Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version).

    Registry.dat

    DAT File

    Registry keys and values captured during the sequencing process for the package.

    StreamMap.xml

    XML File

    List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.

    - - - -## App-V client data storage locations - - -The App-V client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameLocationDescription

    Package Store

    %ProgramData%\App-V

    Default location for read only package files

    Machine Catalog

    %ProgramData%\Microsoft\AppV\Client\Catalog

    Contains per-machine configuration documents

    User Catalog

    %AppData%\Microsoft\AppV\Client\Catalog

    Contains per-user configuration documents

    Shortcut Backups

    %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups

    Stores previous integration points that enable restore on package unpublish

    Copy on Write (COW) Roaming

    %AppData%\Microsoft\AppV\Client\VFS

    Writeable roaming location for package modification

    Copy on Write (COW) Local

    %LocalAppData%\Microsoft\AppV\Client\VFS

    Writeable non-roaming location for package modification

    Machine Registry

    HKLM\Software\Microsoft\AppV

    Contains package state information, including VReg for machine or globally published packages (Machine hive)

    User Registry

    HKCU\Software\Microsoft\AppV

    Contains user package state information including VReg

    User Registry Classes

    HKCU\Software\Classes\AppV

    Contains additional user package state information

    - - - -Additional details for the table are provided in the section below and throughout the document. - -### Package store - -The App-V Client manages the applications assets mounted in the package store. This default storage location is `%ProgramData%\App-V`, but you can configure it during or after setup by using the `Set-AppVClientConfiguration` PowerShell command, which modifies the local registry (`PackageInstallationRoot` value under the `HKLM\Software\Microsoft\AppV\Client\Streaming` key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named for the Package GUID and Version GUID. - -Example of a path to a specific application: - -``` syntax -C:\ProgramData\App-V\PackGUID\VersionGUID -``` - -To change the default location of the package store during setup, see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md). - -### Shared Content Store - -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information on shared content store mode, see . - -**Note**   -The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. - - - -### Package catalogs - -The App-V Client manages the following two file-based locations: - -- **Catalogs (user and machine).** - -- **Registry locations** - depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine Catalog stores global information applicable to all users or any user, and the User Catalog stores information applicable to a specific user. The Catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version.  - -### Machine catalog - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Description

    Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

    -

    If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (e.g., the package directory is in a shared disk location).

    -

    If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.

    Default storage location

    %programdata%\Microsoft\AppV\Client\Catalog</code>

    -

    This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.

    Files in the machine catalog

      -
    • Manifest.xml

    • -
    • DeploymentConfiguration.xml

    • -
    • UserManifest.xml (Globally Published Package)

    • -
    • UserDeploymentConfiguration.xml (Globally Published Package)

    • -

    Additional machine catalog location, used when the package is part of a connection group

    The following location is in addition to the specific package location mentioned above:

    -

    %programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID

    Additional files in the machine catalog when the package is part of a connection group

      -
    • PackageGroupDescriptor.xml

    • -
    • UserPackageGroupDescriptor.xml (globally published Connection Group)

    • -
    - - - -### User catalog - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Description

    Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information.

    -

    When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

    -

    For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.

    Default storage location

    appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID

    Files in the user catalog

      -
    • UserManifest.xml

    • -
    • DynamicConfiguration.xml or UserDeploymentConfiguration.xml

    • -

    Additional user catalog location, used when the package is part of a connection group

    The following location is in addition to the specific package location mentioned above:

    -

    appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID

    Additional file in the machine catalog when the package is part of a connection group

    UserPackageGroupDescriptor.xml

    - - - -### Shortcut backups - -During the publishing process, the App-V Client backs up any shortcuts and integration points to `%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups.` This backup enables the restoration of these integration points to the previous versions when the package is unpublished. - -### Copy on Write files - -The Package Store contains a pristine copy of the package files that have been streamed from the publishing server. During normal operation of an App-V application, the user or service may require changes to the files. These changes are not made in the package store in order to preserve your ability to repair the application, which removes these changes. These locations, called Copy on Write (COW), support both roaming and non-roaming locations. The location where the modifications are stored depends where the application has been programmed to write changes to in a native experience. - -### COW roaming - -The COW Roaming location described above stores changes to files and directories that are targeted to the typical %AppData% location or \\Users\\{username}\\AppData\\Roaming location. These directories and files are then roamed based on the operating system settings. - -### COW local - -The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (e.g. Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. - -## Package registry - - -Before an application can access the package registry data, the App-V Client must make the package registry data available to the applications. The App-V Client uses the real registry as a backing store for all registry data. - -When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at `%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat`. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. - - ----- - - - - - - - -

    Registry.dat from Package Store

     > 

    %ProgramData%\Microsoft\AppV\Client\Vreg{VersionGuid}.dat

    - - - -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. - -### Package registry staging vs. connection group registry staging - -When connection groups are present, the previous process of staging the registry holds true, but instead of having one hive file to process, there are more than one. The files are processed in the order in which they appear in the connection group XML, with the first writer winning any conflicts. - -The staged registry persists the same way as in the single package case. Staged user registry data remains for the connection group until it is disabled; staged machine registry data is removed on connection group removal. - -### Virtual registry - -The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality – that is any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the registry COW -> package -> native. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. - -### Registry locations - -There are two package registry locations and two connection group locations where the App-V Client stores registry information, depending on whether the Package is published individually or as part of a connection group. There are three COW locations for packages and three for connection groups, which are created and managed by the VREG. Settings for packages and connection groups are not shared: - -**Single Package VReg:** - - ---- - - - - - - - - - - - - - - - - - - -

    Location

    Description

    COW

      -
    • Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)

    • -
    • User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes

    • -
    • User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non elevated process)

    • -

    Package

      -
    • Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine

    • -
    • User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry

    • -

    Native

      -
    • Native application registry location

    • -
    - - - - - -**Connection Group VReg:** - - ---- - - - - - - - - - - - - - - - - - - -

    Location

    Description

    COW

      -
    • Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)

    • -
    • User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes

    • -
    • User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY

    • -

    Package

      -
    • Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

    • -
    • User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

    • -

    Native

      -
    • Native application registry location

    • -
    - - - - - -There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. - -### Pass-through keys - -Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key `HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry`. Any key that appears under this multi-string value (and their children) will be treated as pass-through. - -The following locations are configured as pass-through locations by default: - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Policies - -The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI based applications. It is recommend that administers do not modify any of the default pass-through keys, but in some instances, based on application behavior may require adding additional pass-through keys. - -## App-V package store behavior - - -App-V 5 manages the Package Store, which is the location where the expanded asset files from the appv file are stored. By default, this location is stored at %ProgramData%\\App-V, and is limited in terms of storage capabilities only by free disk space. The package store is organized by the GUIDs for the package and version as mentioned in the previous section. - -### Add packages - -App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. During publishing or a manual Add-AppVClientPackage, the data structure is built in the package store (c:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the StreamMap.xml are added to the system and the top level folders and child files staged to ensure proper application assets exist at launch. - -### Mounting packages - -Packages can be explicitly loaded using the PowerShell `Mount-AppVClientPackage` or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. - -### Streaming packages - -The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: `HKEY_LOCAL_MAcHINE\Software\Microsoft\AppV\Client\Streaming`. Policies are set using the PowerShell cmdlet `Set-AppvClientConfiguration`. The following policies apply to Streaming: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PolicyDescription

    AllowHighCostLaunch

    On Windows 8 it allows streaming over 3G and cellular networks

    AutoLoad

    Specifies the Background Load setting:

    -

    0 - Disabled

    -

    1 – Previously Used Packages only

    -

    2 – All Packages

    PackageInstallationRoot

    The root folder for the package store in the local machine

    PackageSourceRoot

    The root override where packages should be streamed from

    SharedContentStoreMode

    Enables the use of Shared Content Store for VDI scenarios

    - - - - - -These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained: - -- Background Streaming - -- Optimized Streaming - -- Stream Faults - -### Background streaming - -The PowerShell cmdlet `Get-AppvClientConfiguration` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. - -### Optimized streaming - -App-V packages can be configured with a primary feature block during sequencing. This setting allows the sequencing engineer to monitor launch files for a specific application, or applications, and mark the blocks of data in the App-V package for streaming at first launch of any application in the package. - -### Stream faults - -After the initial stream of any publishing data and the primary feature block, requests for additional files perform stream faults. These blocks of data are downloaded to the package store on an as-needed basis. This allows a user to download only a small part of the package, typically enough to launch the package and run normal tasks. All other blocks are downloaded when a user initiates an operation that requires data not currently in the package store. - -For more information on App-V Package streaming visit: . - -Sequencing for streaming optimization is available at: . - -### Package upgrades - -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: `%ProgramData%\App-V\{PkgGUID}\{newVerGUID}`. The upgrade operation is optimized by creating hard links to identical- and streamed-files from other versions of the same package. - -### Package removal - -The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the PowerShell cmdlet `Remove-AppVClientPackge` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. - -## Roaming registry and data - - -App-V 5 is able to provide a near-native experience when roaming, depending on how the application being used is written. By default, App-V roams AppData that is stored in the roaming location, based on the roaming configuration of the operating system. Other locations for storage of file-based data do not roam from computer to computer, since they are in locations that are not roamed. - -### Roaming requirements and user catalog data storage - -App-V stores data, which represents the state of the user’s catalog, in the form of: - -- Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog - -- Registry settings under `HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages` - -Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V does not support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. - -**Note**   -The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%. - - - -### Registry-based data - -App-V registry roaming falls into two scenarios, as shown in the following table. - - ---- - - - - - - - - - - - - - - - - -
    ScenarioDescription

    Applications that are run as standard users

    When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

    -
      -
    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages{PkgGUID}\REGISTRY\MACHINE\SOFTWARE

    • -
    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\REGISTRY\USER{UserSID}\SOFTWARE

    • -
    -

    The locations are enabled for roaming based on the operating system settings.

    Applications that are run with elevation

    When an application is launched with elevation:

    -
      -
    • HKLM data is stored in the HKLM hive on the local computer

    • -
    • HKCU data is stored in the User Registry location

    • -
    -

    In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:

    -
      -
    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}{UserSID}\REGISTRY\MACHINE\SOFTWARE

    • -
    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\Registry\User{UserSID}\SOFTWARE

    • -
    - - - -### App-V and folder redirection - -App-V 5.0 SP2 supports folder redirection of the roaming AppData folder (%AppData%). When the virtual environment is started, the roaming AppData state from the user’s roaming AppData directory is copied to the local cache. Conversely, when the virtual environment is shut down, the local cache that is associated with a specific user’s roaming AppData is transferred to the actual location of that user’s roaming AppData directory. - -A typical package has several locations mapped in the user’s backing store for settings in both AppData\\Local and AppData\\Roaming. These locations are the Copy on Write locations that are stored per user in the user’s profile, and that are used to store changes made to the package VFS directories and to protect the default package VFS. - -The following table shows local and roaming locations, when folder redirection has not been implemented. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    VFS directory in packageMapped location of backing store

    ProgramFilesX86

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86

    SystemX86

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86

    Windows

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows

    appv_ROOT

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT

    AppData

    C:\users\jsmith\AppData<strong>Roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData

    - - - - - -The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    VFS directory in packageMapped location of backing store

    ProgramFilesX86

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86

    SystemX86

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86

    Windows

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows

    appv_ROOT

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT

    AppData

    \Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData

    - - - - - -The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: - -1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. - -2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. - -3. If the roaming AppData path is not local, the VFS AppData directory is mapped to the local AppData directory. - -This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: - -1. App-V application is shut down, which shuts down the virtual environment. - -2. The local cache of the roaming AppData location is compressed and stored in a ZIP file. - -3. A timestamp at the end of the ZIP packaging process is used to name the file. - -4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. - -5. The folder redirection process is called to evaluate and initiate the ZIP file uploaded to the roaming AppData directory. - -The timestamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: - -1. The user starts the virtual environment by starting an application. - -2. The application’s virtual environment checks for the most recent time stamped ZIP file, if present. - -3. The registry is checked for the last known uploaded timestamp, if present. - -4. The most recent ZIP file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the ZIP file. - -5. If the local last known upload timestamp is earlier than that of the most recent ZIP file in the roaming AppData location, the ZIP file is extracted to the local temp directory in the user’s profile. - -6. After the ZIP file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. - -7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. - -This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: - -1. During repair, detect if the path to the user’s roaming AppData directory is not local. - -2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. - -3. Delete the timestamp stored in the registry, if present. - -This process will re-create both the local and network locations for AppData and remove the registry record of the timestamp. - -## App-V client application lifecycle management - - -In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of PowerShell commands initiated on the computer running the App-V Client. - -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012 visit: . - -The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured during setup of the client or post-setup with PowerShell commands. See the How to Deploy the Client section on TechNet at: [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) or utilize the PowerShell: - -```powershell -get-command *appv* -``` - -### Publishing refresh - -The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following PowerShell cmdlets: - -- **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. - -- **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. - -- **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. - -- **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. - -The focus of the following sections is to detail the operations that occur during different phases of an App-V Publishing Refresh. The topics include: - -- Adding an App-V Package - -- Publishing an App-V Package - -### Adding an App-V package - -Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. - -**How to add an App-V package** - -1. Manual initiation via PowerShell or Task Sequence initiation of the Publishing Refresh process. - - 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. - - 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per package basis. - -2. The Publishing Agent on the App-V Client performs all actions below serialized. - - Evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group cannot be processed. - -3. Configure the packages by identifying an Add or Update operations. - - 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. - - 2. The package file is opened and the AppXManifest.xml and StreamMap.xml are downloaded to the Package Store. - - 3. Completely stream publishing block data defined in the StreamMap.xml. Stores the publishing block data in the Package Store\\PkgGUID\\VerGUID\\Root. - - - Icons: Targets of extension points. - - - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, directly accessed or via file types. - - - Scripts: Download scripts directory for use throughout the publishing process. - - 4. Populate the Package store: - - 1. Create sparse files on disk that represent the extracted package for any directories listed. - - 2. Stage top level files and directories under root. - - 3. All other files are created when the directory is listed as sparse on disk and streamed on demand. - - 5. Create the machine catalog entries. Create the Manifest.xml and DeploymentConfiguration.xml from the package files (if no DeploymentConfiguration.xml file in the package a placeholder is created). - - 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog - - 7. Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat - - 8. Register the package with the App-V Kernel Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV - - 9. Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing. - -4. Configure Connection Groups by adding and enabling or disabling. - -5. Remove objects that are not published to the target (user or machine). - - **Note**   - This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published). - - - -6. Invoke background load mounting based on client configuration. - -7. Packages that already have publishing information for the machine or user are immediately restored. - - **Note**   - This condition occurs as a product of removal without unpublishing with background addition of the package. - - - -This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user). - -![package add file and registry data](images/packageaddfileandregistrydata.png) - -### Publishing an App-V package - -During the Publishing Refresh operation, the specific publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. The following are the detailed steps. - -**How to publish and App-V package** - -1. Package entries are added to the user catalog - - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the User Catalog - - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the Machine Catalog - -2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV - -3. Perform integration tasks. - - 1. Create extension points. - - 2. Store backup information in the user’s registry and roaming profile (Shortcut Backups). - - **Note**   - This enables restore extension points if the package is unpublished. - - - - 3. Run scripts targeted for publishing timing. - -Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information above for details. - -![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) - -### Application launch - -After the Publishing Refresh process, the user launches and subsequently re-launches an App-V application. The process is very simple and optimized to launch quickly with a minimum of network traffic. The App-V Client checks the path to the user catalog for files created during publishing. After rights to launch the package are established, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. With the virtual environment created and configured for the specific package and application, the application starts. - -**How to launch App-V applications** - -1. User launches the application by clicking on a shortcut or file type invocation. - -2. The App-V Client verifies existence in the User Catalog for the following files - - - UserDeploymentConfiguration.xml - - - UserManifest.xml - -3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There is no network traffic at this point. - -4. Next, the App-V Client checks that the path for the package registered for the App-V Client service is found in the registry. - -5. Upon finding the path to the package store, the virtual environment is created. If this is the first launch, the Primary Feature Block downloads if present. - -6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. - -7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. - - ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) - -### Upgrading an App-V package - -The App-V 5 package upgrade process differs from the older versions of App-V. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only the new files are added to the new version store location and hard links are created for unchanged files. This reduces the overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. The specific details of upgrading an App-V Package are as follows: - -**How to upgrade an App-V package** - -1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. - -2. Package entries are added to the appropriate catalog for the new version - - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - -3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV - -4. Perform integration tasks. - - - Integrate extensions points (EP) from the Manifest and Dynamic Configuration files. - - 1. File based EP data is stored in the AppData folder utilizing Junction Points from the package store. - - 2. Version 1 EPs already exist when a new version becomes available. - - 3. The extension points are switched to the Version 2 location in machine or user catalogs for any newer or updated extension points. - -5. Run scripts targeted for publishing timing. - -6. Install Side by Side assemblies as required. - -### Upgrading an in-use App-V package - -**Starting in App-V 5 SP2**: If you try to upgrade a package that is in use by an end user, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
    Task typeApplicable rule

    User-based task, e.g., publishing a package to a user

    The pending task will be performed after the user logs off and then logs back on.

    Globally based task, e.g., enabling a connection group globally

    The pending task will be performed when the computer is shut down and then restarted.

    - - - -When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: - - ---- - - - - - - - - - - - - - - - - -
    User-based or globally based taskWhere the registry key is generated

    User-based tasks

    KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks

    Globally based tasks

    HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks

    - - - -The following operations must be completed before users can use the newer version of the package: - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    Add the package to the computer

    This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above.

    Publish the package

    See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task.

    - - - -Use the following example scenarios as a guide for updating packages. - - ---- - - - - - - - - - - - - - - - - -
    ScenarioRequirements

    App-V package is not in use when you try to upgrade

    None of the following components of the package can be in use: virtual application, COM server, or shell extensions.

    -

    The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and run. Nothing has changed in this scenario in App-V 5 SP2 from previous releases of App-V 5.

    App-V package is in use when the administrator publishes a newer version of the package

    The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use.

    -

    If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

    -

    If the package has shell extensions (Office 2013), which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade.

    - - - -### Global vs user publishing - -App-V Packages can be published in one of two ways; User which entitles an App-V package to a specific user or group of users and Global which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: - -- **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. - -- **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via PowerShell commands). - -### Removing an App-V package - -Removing App-V applications in a Full Infrastructure is an unpublish operation, and does not perform a package removal. The process is the same as the publish process above, but instead of adding the removal process reverses the changes that have been made for App-V Packages. - -### Repairing an App-V package - -The repair operation is very simple but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are de-integrated and then re-integrated. Please review the COW data placement locations by reviewing where they are registered in the registry. This operation is done automatically and there is no administrative control other than initiating a Repair operation from the App-V Client Console or via PowerShell (Repair-AppVClientPackage). - -## Integration of App-V packages - - -The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: - -- AppXManifest.xml: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. - -- DeploymentConfig.xml: Provides configuration information of computer and user based integration extension points. - -- UserConfig.xml: A subset of the Deploymentconfig.xml that only provides user- based configurations and only targets user-based extension points. - -### Rules of integration - -When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the list below: - -- Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. - -- User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. - -- Backup and Restore: Existing native application data and registry (such as FTA registrations) are backed up during publishing. - - 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. - - 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This will not initiate a restore of the data or registry. - - 3. Restore the backed up data when the last package is unpublished or removed on a per extension point basis. - -### Extension points - -The App-V publishing files (manifest and dynamic configuration) provide several extension points that enable the application to integrate with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: - -- Shortcuts - -- File Type Associations - -- Shell Extensions - -- COM - -- Software Clients - -- Application capabilities - -- URL Protocol Handler - -- AppPath - -- Virtual Application - -### Shortcuts - -The short cut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. - -From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following: - -```xml - - - [{Common Desktop}]\Adobe Reader 9.lnk - [{AppVPackageRoot}]\Reader\AcroRd32.exe - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\SC_Reader.ico - - - 1 - [{AppVPackageRoot}]\Reader\AcroRd32.exe - - -``` - -As mentioned previously, the App-V shortcuts are placed by default in the user’s profile based on the refresh operation. Global refresh places shortcuts in the All Users profile and user refresh stores them in the specific user’s profile. The actual executable is stored in the Package Store. The location of the ICO file is a tokenized location in the App-V package. - -### File type associations - -The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below: - -```xml - - - - .xdp - AcroExch.XDPDoc - application/vnd.adobe.xdp+xml - - - AcroExch.XDPDoc - Adobe Acrobat XML Data Package File - 65536 - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\XDPFile_8.ico - - Read - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Open - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Printto - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" /t "%1" "%2" "%3" "%4" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Read - Open with Adobe Reader 9 - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - - - -``` - -**Note**   -In this example: - -- `.xdp` is the extension - -- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) - -- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable - - - -### Shell extensions - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published globally, the shell extension gives users the same functionality as if the application were locally installed. The application requires no additional setup or configuration on the client to enable the shell extension functionality. - -**Requirements for using shell extensions:** - -- Packages that contain embedded shell extensions must be published globally. - -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. - -The following table displays the supported shell extensions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    HandlerDescription

    Context menu handler

    Adds menu items to the context menu. It is called before the context menu is displayed.

    Drag-and-drop handler

    Controls the action upon right-click drag-and-drop and modifies the context menu that appears.

    Drop target handler

    Controls the action after a data object is dragged-and-dropped over a drop target such as a file.

    Data object handler

    Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target.

    Property sheet handler

    Replaces or adds pages to the property sheet dialog box of an object.

    Infotip handler

    Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse- hover.

    Column handler

    Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

    Preview handler

    Enables a preview of a file to be displayed in the Windows Explorer Preview Pane.

    - - - -### COM - -The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires additional detail. - -App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and in-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes off, Isolated, and Integrated. The integrated mode is configured for either the out-of-process or in-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). - -Details on App-V integration are available at: . - -### Software clients and application capabilities - -App-V supports specific software clients and application capabilities extension points that enable virtualized applications to be registered with the software client of the operating system. This enables users to select default programs for operations like email, instant messaging, and media player. This operation is performed in the control panel with the Set Program Access and Computer Defaults, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. - -Example of software client registration of an App-V based mail client. - -```xml - - - - - - - Mozilla Thunderbird - Mozilla Thunderbird - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /SetAsDefaultAppGlobal - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /HideShortcuts - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /ShowShortcuts - - 1 - - - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -mail - - [{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll - - Thunderbird URL - 2 - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -osint -compose "%1" - - - - - - - -``` - -**Note**   -In this example: - -- `` is the overall Software Clients setting to integrate Email clients - -- `` is the flag to set a particular Email client as the default Email client - -- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration - - - -### URL Protocol handler - -Applications do not always specifically called virtualized applications utilizing file type invocation. For, example, in an application that supports embedding a mailto: link inside a document or web page, the user clicks on a mailto: link and expects to get their registered mail client. App-V supports URL Protocol handlers that can be registered on a per-package basis with the local operating system. During sequencing, the URL protocol handlers are automatically added to the package. - -For situations where there is more than one application that could register the specific URL Protocol handler, the dynamic configuration files can be utilized to modify the behavior and suppress or disable this feature for an application that should not be the primary application launched. - -### AppPath - -The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. - -The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: . - -### Virtual application - -This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a particular application can be disabled using dynamic configuration files. For example, if a package contains two applications, it is possible to disable all extension points belonging to one application, in order to allow only integration of extension points of other application. - -### Extension point rules - -The extension points described above are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example a shortcut that is created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). - -Extension points are not all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they are delivered. Below is a table that describes these two key rules. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Virtual ExtensionRequires target OS SequencingRequires Global Publishing

    Shortcut

    File Type Association

    URL Protocols

    X

    AppPaths

    X

    COM Mode

    Software Client

    X

    Application Capabilities

    X

    X

    Context Menu Handler

    X

    X

    Drag-and-drop Handler

    X

    Data Object Handler

    X

    Property Sheet Handler

    X

    Infotip Handler

    X

    Column Handler

    X

    Shell Extensions

    X

    Browser Helper Object

    X

    X

    Active X Object

    X

    X

    - - - -## Dynamic configuration processing - - -Deploying App-V packages to one machine or user is very simple. However, as organizations deploy AppV applications across business lines and geographic and political boundaries, the ability to sequence an application one time with one set of settings becomes impossible. App-V was designed for this scenario, as it captures specific settings and configurations during sequencing in the Manifest file, but also supports modification with Dynamic Configuration files. - -App-V dynamic configuration allows for specifying a policy for a package either at the machine level or at the user level. The Dynamic Configuration files enable sequencing engineers to modify the configuration of a package, post-sequencing, to address the needs of individual groups of users or machines. In some instances it may be necessary to make modifications to the application to provide proper functionality within the App-V environment. For example, it may be necessary to make modifications to the \_\*config.xml files to allow certain actions to be performed at a specified time during the execution of the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. - -App-V Packages contain the Manifest file inside of the appv package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow the publishing of an application to different desktops or users with different extension points. The two Dynamic Configuration Files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. - -### Example for dynamic configuration files - -The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information review the App-V 5 Sequencing Guide at: - -**Manifest** - -```xml - - - [{Common Programs}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - -``` - -**Deployment Configuration** - -```xml - - - - - - - - - - -``` - -**User Configuration** - -```xml - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - - - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM.exe.O.ico - - - [{Common Programs}]\7-Zip\7-Zip File Manager.Ink - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot)]\7zFM.exe.O.ico - - - - - - - - - - - - -``` - -## Side-by-side assemblies - - -App-V supports the automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V 5 SP2 supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. And for assemblies consisting of Visual C++ (Version 8 and newer) and/or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they were not installed during monitoring. The Side by Side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in deployed App-V applications to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. - -Side by Side Assembly support in App-V has the following features. - -- Automatic captures of SxS assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. - -- The App-V Client automatically installs required SxS assemblies to the client computer at publishing time when they are not present. - -- The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. - -- The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. - -### Automatic publishing of SxS assemblies - -During publishing of an App-V package with SxS assemblies the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the Side by Side assembly installations that are part of the base packages, as the connection group does not contain any information about assembly installation. - -**Note**   -UnPublishing or removing a package with an assembly does not remove the assemblies for that package. - - - -## Client logging - - -The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer, under Applications and Services Logs\\Microsoft\\AppV\\Client. - -**Note**   -In App-V 5.0 SP3, some logs have been consolidated and moved to the following location: - -`Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog` - -For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - - - -There are three specific categories of events recorded described below. - -**Admin**: Logs events for configurations being applied to the App-V Client, and contains the primary warnings and errors. - -**Operational**: Logs the general App-V execution and usage of individual components creating an audit log of the App-V operations that have been completed on the App-V Client. - -**Virtual Application**: Logs virtual application launches and use of virtualization subsystems. - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/application-publishing-and-client-interaction51.md b/mdop/appv-v5/application-publishing-and-client-interaction51.md deleted file mode 100644 index ba6d7e8fe7..0000000000 --- a/mdop/appv-v5/application-publishing-and-client-interaction51.md +++ /dev/null @@ -1,1635 +0,0 @@ ---- -title: Application Publishing and Client Interaction -description: Application Publishing and Client Interaction -author: dansimp -ms.assetid: 36a4bf6f-a917-41a6-9856-6248686df352 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Application Publishing and Client Interaction - - -This article provides technical information about common App-V client operations and their integration with the local operating system. - -- [App-V package files created by the Sequencer](#bkmk-appv-pkg-files-list) - -- [What’s in the appv file?](#bkmk-appv-file-contents) - -- [App-V client data storage locations](#bkmk-files-data-storage) - -- [Package registry](#bkmk-pkg-registry) - -- [App-V package store behavior](#bkmk-pkg-store-behavior) - -- [Roaming registry and data](#bkmk-roaming-reg-data) - -- [App-V client application lifecycle management](#bkmk-clt-app-lifecycle) - -- [Integration of App-V packages](#bkmk-integr-appv-pkgs) - -- [Dynamic configuration processing](#bkmk-dynamic-config) - -- [Side-by-side assemblies](#bkmk-sidebyside-assemblies) - -- [Client logging](#bkmk-client-logging) - -For additional reference information, see [Microsoft Application Virtualization (App-V) Documentation Resources Download Page](https://www.microsoft.com/download/details.aspx?id=27760). - -## App-V package files created by the Sequencer - - -The Sequencer creates App-V packages and produces a virtualized application. The sequencing process creates the following files: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FileDescription

    .appv

      -
    • The primary package file, which contains the captured assets and state information from the sequencing process.

    • -
    • Architecture of the package file, publishing information, and registry in a tokenized form that can be reapplied to a machine and to a specific user upon delivery.

    • -

    .MSI

    Executable deployment wrapper that you can use to deploy .appv files manually or by using a third-party deployment platform.

    _DeploymentConfig.XML

    File used to customize the default publishing parameters for all applications in a package that is deployed globally to all users on a computer that is running the App-V client.

    _UserConfig.XML

    File used to customize the publishing parameters for all applications in a package that is a deployed to a specific user on a computer that is running the App-V client.

    Report.xml

    Summary of messages resulting from the sequencing process, including omitted drivers, files, and registry locations.

    .CAB

    Optional: Package accelerator file used to automatically rebuild a previously sequenced virtual application package.

    .appvt

    Optional: Sequencer template file used to retain commonly reused Sequencer settings.

    - - - -For information about sequencing, see [Application Virtualization Sequencing Guide](https://go.microsoft.com/fwlink/?LinkID=269810). - -## What’s in the appv file? - - -The appv file is a container that stores XML and non-XML files together in a single entity. This file is built from the AppX format, which is based on the Open Packaging Conventions (OPC) standard. - -To view the appv file contents, make a copy of the package, and then rename the copied file to a ZIP extension. - -The appv file contains the following folder and files, which are used when creating and publishing a virtual application: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeDescription

    Root

    File folder

    Directory that contains the file system for the virtualized application that is captured during sequencing.

    [Content_Types].xml

    XML File

    List of the core content types in the appv file (e.g. DLL, EXE, BIN).

    AppxBlockMap.xml

    XML File

    Layout of the appv file, which uses File, Block, and BlockMap elements that enable location and validation of files in the App-V package.

    AppxManifest.xml

    XML File

    Metadata for the package that contains the required information for adding, publishing, and launching the package. Includes extension points (file type associations and shortcuts) and the names and GUIDs associated with the package.

    FilesystemMetadata.xml

    XML File

    List of the files captured during sequencing, including attributes (e.g., directories, files, opaque directories, empty directories,and long and short names).

    PackageHistory.xml

    XML File

    Information about the sequencing computer (operating system version, Internet Explorer version, .Net Framework version) and process (upgrade, package version).

    Registry.dat

    DAT File

    Registry keys and values captured during the sequencing process for the package.

    StreamMap.xml

    XML File

    List of files for the primary and publishing feature block. The publishing feature block contains the ICO files and required portions of files (EXE and DLL) for publishing the package. When present, the primary feature block includes files that have been optimized for streaming during the sequencing process.

    - - - -## App-V client data storage locations - - -The App-V client performs tasks to ensure that virtual applications run properly and work like locally installed applications. The process of opening and running virtual applications requires mapping from the virtual file system and registry to ensure the application has the required components of a traditional application expected by users. This section describes the assets that are required to run virtual applications and lists the location where App-V stores the assets. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameLocationDescription

    Package Store

    %ProgramData%\App-V

    Default location for read only package files

    Machine Catalog

    %ProgramData%\Microsoft\AppV\Client\Catalog

    Contains per-machine configuration documents

    User Catalog

    %AppData%\Microsoft\AppV\Client\Catalog

    Contains per-user configuration documents

    Shortcut Backups

    %AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups

    Stores previous integration points that enable restore on package unpublish

    Copy on Write (COW) Roaming

    %AppData%\Microsoft\AppV\Client\VFS

    Writeable roaming location for package modification

    Copy on Write (COW) Local

    %LocalAppData%\Microsoft\AppV\Client\VFS

    Writeable non-roaming location for package modification

    Machine Registry

    HKLM\Software\Microsoft\AppV

    Contains package state information, including VReg for machine or globally published packages (Machine hive)

    User Registry

    HKCU\Software\Microsoft\AppV

    Contains user package state information including VReg

    User Registry Classes

    HKCU\Software\Classes\AppV

    Contains additional user package state information

    - - - -Additional details for the table are provided in the section below and throughout the document. - -### Package store - -The App-V Client manages the applications assets mounted in the package store. This default storage location is `%ProgramData%\App-V`, but you can configure it during or after setup by using the `Set-AppVClientConfiguration` PowerShell command, which modifies the local registry (`PackageInstallationRoot` value under the `HKLM\Software\Microsoft\AppV\Client\Streaming` key). The package store must be located at a local path on the client operating system. The individual packages are stored in the package store in subdirectories named for the Package GUID and Version GUID. - -Example of a path to a specific application: - -``` syntax -C:\ProgramData\App-V\PackGUID\VersionGUID -``` - -To change the default location of the package store during setup, see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md). - -### Shared Content Store - -If the App-V Client is configured in Shared Content Store mode, no data is written to disk when a stream fault occurs, which means that the packages require minimal local disk space (publishing data). The use of less disk space is highly desirable in VDI environments, where local storage can be limited, and streaming the applications from a high performance network location (such as a SAN) is preferable. For more information on shared content store mode, see . - -**Note**   -The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client. - - - -### Package catalogs - -The App-V Client manages the following two file-based locations: - -- **Catalogs (user and machine).** - -- **Registry locations** - depends on how the package is targeted for publishing. There is a Catalog (data store) for the computer, and a catalog for each individual user. The Machine Catalog stores global information applicable to all users or any user, and the User Catalog stores information applicable to a specific user. The Catalog is a collection of Dynamic Configurations and manifest files; there is discrete data for both file and registry per package version.  - -### Machine catalog - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Description

    Stores package documents that are available to users on the machine, when packages are added and published. However, if a package is “global” at publishing time, the integrations are available to all users.

    -

    If a package is non-global, the integrations are published only for specific users, but there are still global resources that are modified and visible to anyone on the client computer (e.g., the package directory is in a shared disk location).

    -

    If a package is available to a user on the computer (global or non-global), the manifest is stored in the Machine Catalog. When a package is published globally, there is a Dynamic Configuration file, stored in the Machine Catalog; therefore, the determination of whether a package is global is defined according to whether there is a policy file (UserDeploymentConfiguration file) in the Machine Catalog.

    Default storage location

    %programdata%\Microsoft\AppV\Client\Catalog</code>

    -

    This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.

    Files in the machine catalog

      -
    • Manifest.xml

    • -
    • DeploymentConfiguration.xml

    • -
    • UserManifest.xml (Globally Published Package)

    • -
    • UserDeploymentConfiguration.xml (Globally Published Package)

    • -

    Additional machine catalog location, used when the package is part of a connection group

    The following location is in addition to the specific package location mentioned above:

    -

    %programdata%\Microsoft\AppV\Client\Catalog\PackageGroups\ConGroupGUID\ConGroupVerGUID

    Additional files in the machine catalog when the package is part of a connection group

      -
    • PackageGroupDescriptor.xml

    • -
    • UserPackageGroupDescriptor.xml (globally published Connection Group)

    • -
    - - - -### User catalog - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Description

    Created during the publishing process. Contains information used for publishing the package, and also used at launch to ensure that a package is provisioned to a specific user. Created in a roaming location and includes user-specific publishing information.

    -

    When a package is published for a user, the policy file is stored in the User Catalog. At the same time, a copy of the manifest is also stored in the User Catalog. When a package entitlement is removed for a user, the relevant package files are removed from the User Catalog. Looking at the user catalog, an administrator can view the presence of a Dynamic Configuration file, which indicates that the package is entitled for that user.

    -

    For roaming users, the User Catalog needs to be in a roaming or shared location to preserve the legacy App-V behavior of targeting users by default. Entitlement and policy are tied to a user, not a computer, so they should roam with the user once they are provisioned.

    Default storage location

    appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID

    Files in the user catalog

      -
    • UserManifest.xml

    • -
    • DynamicConfiguration.xml or UserDeploymentConfiguration.xml

    • -

    Additional user catalog location, used when the package is part of a connection group

    The following location is in addition to the specific package location mentioned above:

    -

    appdata\roaming\Microsoft\AppV\Client\Catalog\PackageGroups\PkgGroupGUID\PkgGroupVerGUID

    Additional file in the machine catalog when the package is part of a connection group

    UserPackageGroupDescriptor.xml

    - - - -### Shortcut backups - -During the publishing process, the App-V Client backs up any shortcuts and integration points to `%AppData%\Microsoft\AppV\Client\Integration\ShortCutBackups.` This backup enables the restoration of these integration points to the previous versions when the package is unpublished. - -### Copy on Write files - -The Package Store contains a pristine copy of the package files that have been streamed from the publishing server. During normal operation of an App-V application, the user or service may require changes to the files. These changes are not made in the package store in order to preserve your ability to repair the application, which removes these changes. These locations, called Copy on Write (COW), support both roaming and non-roaming locations. The location where the modifications are stored depends where the application has been programmed to write changes to in a native experience. - -### COW roaming - -The COW Roaming location described above stores changes to files and directories that are targeted to the typical %AppData% location or \\Users\\{username}\\AppData\\Roaming location. These directories and files are then roamed based on the operating system settings. - -### COW local - -The COW Local location is similar to the roaming location, but the directories and files are not roamed to other computers, even if roaming support has been configured. The COW Local location described above stores changes applicable to typical windows and not the %AppData% location. The directories listed will vary but there will be two locations for any typical Windows locations (e.g. Common AppData and Common AppDataS). The **S** signifies the restricted location when the virtual service requests the change as a different elevated user from the logged on users. The non-**S** location stores user based changes. - -## Package registry - - -Before an application can access the package registry data, the App-V Client must make the package registry data available to the applications. The App-V Client uses the real registry as a backing store for all registry data. - -When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file from the package is created at `%ProgramData%\Microsoft\AppV\Client\VREG\{Version GUID}.dat`. The name of the file is the version GUID with the .DAT extension. The reason this copy is made is to ensure that the actual hive file in the package is never in use, which would prevent the removal of the package at a later time. - - ----- - - - - - - - -

    Registry.dat from Package Store

     > 

    %ProgramData%\Microsoft\AppV\Client\Vreg{VersionGuid}.dat

    - - - -When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation. - -### Package registry staging vs. connection group registry staging - -When connection groups are present, the previous process of staging the registry holds true, but instead of having one hive file to process, there are more than one. The files are processed in the order in which they appear in the connection group XML, with the first writer winning any conflicts. - -The staged registry persists the same way as in the single package case. Staged user registry data remains for the connection group until it is disabled; staged machine registry data is removed on connection group removal. - -### Virtual registry - -The purpose of the virtual registry (VREG) is to provide a single merged view of the package registry and the native registry to applications. It also provides copy-on-write (COW) functionality – that is any changes made to the registry from the context of a virtual process are made to a separate COW location. This means that the VREG must combine up to three separate registry locations into a single view based on the populated locations in the registry COW -> package -> native. When a request is made for a registry data it will locate in order until it finds the data it was requesting. Meaning if there is a value stored in a COW location it will not proceed to other locations, however, if there is no data in the COW location it will proceed to the Package and then Native location until it finds the appropriate data. - -### Registry locations - -There are two package registry locations and two connection group locations where the App-V Client stores registry information, depending on whether the Package is published individually or as part of a connection group. There are three COW locations for packages and three for connection groups, which are created and managed by the VREG. Settings for packages and connection groups are not shared: - -**Single Package VReg:** - - ---- - - - - - - - - - - - - - - - - - - -

    Location

    Description

    COW

      -
    • Machine Registry\Client\Packages\PkgGUID\REGISTRY (Only elevate process can write)

    • -
    • User Registry\Client\Packages\PkgGUID\REGISTRY (User Roaming anything written under HKCU except Software\Classes

    • -
    • User Registry Classes\Client\Packages\PkgGUID\REGISTRY (HKCU\Software\Classes writes and HKLM for non elevated process)

    • -

    Package

      -
    • Machine Registry\Client\Packages\PkgGUID\Versions\VerGuid\Registry\Machine

    • -
    • User Registry Classes\Client\Packages\PkgGUID\Versions\VerGUID\Registry

    • -

    Native

      -
    • Native application registry location

    • -
    - - - - - -**Connection Group VReg:** - - ---- - - - - - - - - - - - - - - - - - - -

    Location

    Description

    COW

      -
    • Machine Registry\Client\PackageGroups\GrpGUID\REGISTRY (only elevate process can write)

    • -
    • User Registry\Client\PackageGroups\GrpGUID\REGISTRY (Anything written to HKCU except Software\Classes

    • -
    • User Registry Classes\Client\PackageGroups\GrpGUID\REGISTRY

    • -

    Package

      -
    • Machine Registry\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

    • -
    • User Registry Classes\Client\PackageGroups\GrpGUID\Versions\VerGUID\REGISTRY

    • -

    Native

      -
    • Native application registry location

    • -
    - - - - - -There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first. - -### Pass-through keys - -Pass-through keys enable an administrator to configure certain keys so they can only be read from the native registry, bypassing the Package and COW locations. Pass-through locations are global to the machine (not package specific) and can be configured by adding the path to the key, which should be treated as pass-through to the **REG\_MULTI\_SZ** value called **PassThroughPaths** of the key `HKLM\Software\Microsoft\AppV\Subsystem\VirtualRegistry`. Any key that appears under this multi-string value (and their children) will be treated as pass-through. - -The following locations are configured as pass-through locations by default: - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\services\\eventlog\\Application - -- HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib - -- HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies - -- HKEY\_CURRENT\_USER\\SOFTWARE\\Policies - -The purpose of Pass-through keys is to ensure that a virtual application does not write registry data in the VReg that is required for non-virtual applications for successful operation or integration. The Policies key ensures that Group Policy based settings set by the administrator are utilized and not per package settings. The AppModel key is required for integration with Windows Modern UI based applications. It is recommend that administers do not modify any of the default pass-through keys, but in some instances, based on application behavior may require adding additional pass-through keys. - -## App-V package store behavior - - -App-V 5 manages the Package Store, which is the location where the expanded asset files from the appv file are stored. By default, this location is stored at %ProgramData%\\App-V, and is limited in terms of storage capabilities only by free disk space. The package store is organized by the GUIDs for the package and version as mentioned in the previous section. - -### Add packages - -App-V Packages are staged upon addition to the computer with the App-V Client. The App-V Client provides on-demand staging. During publishing or a manual Add-AppVClientPackage, the data structure is built in the package store (c:\\programdata\\App-V\\{PkgGUID}\\{VerGUID}). The package files identified in the publishing block defined in the StreamMap.xml are added to the system and the top level folders and child files staged to ensure proper application assets exist at launch. - -### Mounting packages - -Packages can be explicitly loaded using the PowerShell `Mount-AppVClientPackage` or by using the **App-V Client UI** to download a package. This operation completely loads the entire package into the package store. - -### Streaming packages - -The App-V Client can be configured to change the default behavior of streaming. All streaming policies are stored under the following registry key: `HKEY_LOCAL_MAcHINE\Software\Microsoft\AppV\Client\Streaming`. Policies are set using the PowerShell cmdlet `Set-AppvClientConfiguration`. The following policies apply to Streaming: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PolicyDescription

    AllowHighCostLaunch

    On Windows 8 and later, it allows streaming over 3G and cellular networks

    AutoLoad

    Specifies the Background Load setting:

    -

    0 - Disabled

    -

    1 – Previously Used Packages only

    -

    2 – All Packages

    PackageInstallationRoot

    The root folder for the package store in the local machine

    PackageSourceRoot

    The root override where packages should be streamed from

    SharedContentStoreMode

    Enables the use of Shared Content Store for VDI scenarios

    - - - - - -These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained: - -- Background Streaming - -- Optimized Streaming - -- Stream Faults - -### Background streaming - -The PowerShell cmdlet `Get-AppvClientConfiguration` can be used to determine the current mode for background streaming with the AutoLoad setting and modified with the cmdlet Set-AppvClientConfiguration or from the registry (HKLM\\SOFTWARE\\Microsoft\\AppV\\ClientStreaming key). Background streaming is a default setting where the Autoload setting is set to download previously used packages. The behavior based on default setting (value=1) downloads App-V data blocks in the background after the application has been launched. This setting can be disabled all together (value=0) or enabled for all packages (value=2), whether they have been launched. - -### Optimized streaming - -App-V packages can be configured with a primary feature block during sequencing. This setting allows the sequencing engineer to monitor launch files for a specific application, or applications, and mark the blocks of data in the App-V package for streaming at first launch of any application in the package. - -### Stream faults - -After the initial stream of any publishing data and the primary feature block, requests for additional files perform stream faults. These blocks of data are downloaded to the package store on an as-needed basis. This allows a user to download only a small part of the package, typically enough to launch the package and run normal tasks. All other blocks are downloaded when a user initiates an operation that requires data not currently in the package store. - -For more information on App-V Package streaming visit: . - -Sequencing for streaming optimization is available at: . - -### Package upgrades - -App-V Packages require updating throughout the lifecycle of the application. App-V Package upgrades are similar to the package publish operation, as each version will be created in its own PackageRoot location: `%ProgramData%\App-V\{PkgGUID}\{newVerGUID}`. The upgrade operation is optimized by creating hard links to identical- and streamed-files from other versions of the same package. - -### Package removal - -The behavior of the App-V Client when packages are removed depends on the method used for removal. Using an App-V full infrastructure to unpublish the application, the user catalog files (machine catalog for globally published applications) are removed, but retains the package store location and COW locations. When the PowerShell cmdlet `Remove-AppVClientPackge` is used to remove an App-V Package, the package store location is cleaned. Remember that unpublishing an App-V Package from the Management Server does not perform a Remove operation. Neither operation will remove the Package Store package files. - -## Roaming registry and data - - -App-V 5 is able to provide a near-native experience when roaming, depending on how the application being used is written. By default, App-V roams AppData that is stored in the roaming location, based on the roaming configuration of the operating system. Other locations for storage of file-based data do not roam from computer to computer, since they are in locations that are not roamed. - -### Roaming requirements and user catalog data storage - -App-V stores data, which represents the state of the user’s catalog, in the form of: - -- Files under %appdata%\\Microsoft\\AppV\\Client\\Catalog - -- Registry settings under `HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages` - -Together, these files and registry settings represent the user’s catalog, so either both must be roamed, or neither must be roamed for a given user. App-V does not support roaming %AppData%, but not roaming the user’s profile (registry), or vice versa. - -**Note**   -The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%. - - - -### Registry-based data - -App-V registry roaming falls into two scenarios, as shown in the following table. - - ---- - - - - - - - - - - - - - - - - -
    ScenarioDescription

    Applications that are run as standard users

    When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:

    -
      -
    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages{PkgGUID}\REGISTRY\MACHINE\SOFTWARE

    • -
    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\REGISTRY\USER{UserSID}\SOFTWARE

    • -
    -

    The locations are enabled for roaming based on the operating system settings.

    Applications that are run with elevation

    When an application is launched with elevation:

    -
      -
    • HKLM data is stored in the HKLM hive on the local computer

    • -
    • HKCU data is stored in the User Registry location

    • -
    -

    In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:

    -
      -
    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}{UserSID}\REGISTRY\MACHINE\SOFTWARE

    • -
    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\Registry\User{UserSID}\SOFTWARE

    • -
    - - - -### App-V and folder redirection - -App-V 5.1 supports folder redirection of the roaming AppData folder (%AppData%). When the virtual environment is started, the roaming AppData state from the user’s roaming AppData directory is copied to the local cache. Conversely, when the virtual environment is shut down, the local cache that is associated with a specific user’s roaming AppData is transferred to the actual location of that user’s roaming AppData directory. - -A typical package has several locations mapped in the user’s backing store for settings in both AppData\\Local and AppData\\Roaming. These locations are the Copy on Write locations that are stored per user in the user’s profile, and that are used to store changes made to the package VFS directories and to protect the default package VFS. - -The following table shows local and roaming locations, when folder redirection has not been implemented. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    VFS directory in packageMapped location of backing store

    ProgramFilesX86

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86

    SystemX86

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86

    Windows

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows

    appv_ROOT

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT

    AppData

    C:\users\jsmith\AppData<strong>Roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData

    - - - - - -The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    VFS directory in packageMapped location of backing store

    ProgramFilesX86

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86

    SystemX86

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86

    Windows

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows

    appv_ROOT

    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT

    AppData

    \Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData

    - - - - - -The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are: - -1. During publishing or virtual environment startup, the App-V Client detects the location of the AppData directory. - -2. If the roaming AppData path is local or ino AppData\\Roaming location is mapped, nothing happens. - -3. If the roaming AppData path is not local, the VFS AppData directory is mapped to the local AppData directory. - -This process solves the problem of a non-local %AppData% that is not supported by the App-V Client VFS driver. However, the data stored in this new location is not roamed with folder redirection. All changes during the running of the application happen to the local AppData location and must be copied to the redirected location. The detailed steps of this process are: - -1. App-V application is shut down, which shuts down the virtual environment. - -2. The local cache of the roaming AppData location is compressed and stored in a ZIP file. - -3. A timestamp at the end of the ZIP packaging process is used to name the file. - -4. The timestamp is recorded in the registry: HKEY\_CURRENT\_USER\\Software\\Microsoft\\AppV\\Client\\Packages\\<GUID>\\AppDataTime as the last known AppData timestamp. - -5. The folder redirection process is called to evaluate and initiate the ZIP file uploaded to the roaming AppData directory. - -The timestamp is used to determine a “last writer wins” scenario if there is a conflict and is used to optimize the download of the data when the App-V application is published or the virtual environment is started. Folder redirection will make the data available from any other clients covered by the supporting policy and will initiate the process of storing the AppData\\Roaming data to the local AppData location on the client. The detailed processes are: - -1. The user starts the virtual environment by starting an application. - -2. The application’s virtual environment checks for the most recent time stamped ZIP file, if present. - -3. The registry is checked for the last known uploaded timestamp, if present. - -4. The most recent ZIP file is downloaded unless the local last known upload timestamp is greater than or equal to the timestamp from the ZIP file. - -5. If the local last known upload timestamp is earlier than that of the most recent ZIP file in the roaming AppData location, the ZIP file is extracted to the local temp directory in the user’s profile. - -6. After the ZIP file is successfully extracted, the local cache of the roaming AppData directory is renamed and the new data is moved into place. - -7. The renamed directory is deleted and the application opens with the most recently saved roaming AppData data. - -This completes the successful roaming of application settings that are present in AppData\\Roaming locations. The only other condition that must be addressed is a package repair operation. The details of the process are: - -1. During repair, detect if the path to the user’s roaming AppData directory is not local. - -2. Map the non-local roaming AppData path targets are recreated the expected roaming and local AppData locations. - -3. Delete the timestamp stored in the registry, if present. - -This process will re-create both the local and network locations for AppData and remove the registry record of the timestamp. - -## App-V client application lifecycle management - - -In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers via the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are performed as a series of PowerShell commands initiated on the computer running the App-V Client. - -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012 visit: . - -The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured during setup of the client or post-setup with PowerShell commands. See the How to Deploy the Client section on TechNet at: [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) or utilize the PowerShell: - -```powershell -get-command *appv* -``` - -### Publishing refresh - -The publishing refresh process is comprised of several smaller operations that are performed on the App-V Client. Since App-V is an application virtualization technology and not a task scheduling technology, the Windows Task Scheduler is utilized to enable the process at user logon, machine startup, and at scheduled intervals. The configuration of the client during setup listed above is the preferred method when distributing the client to a large group of computers with the correct settings. These client settings can be configured with the following PowerShell cmdlets: - -- **Add-AppVPublishingServer:** Configures the client with an App-V Publishing Server that provides App-V packages. - -- **Set-AppVPublishingServer:** Modifies the current settings for the App-V Publishing Server. - -- **Set-AppVClientConfiguration:** Modifies the currents settings for the App-V Client. - -- **Sync-AppVPublishingServer:** Initiates an App-V Publishing Refresh process manually. This is also utilized in the scheduled tasks created during configuration of the publishing server. - -The focus of the following sections is to detail the operations that occur during different phases of an App-V Publishing Refresh. The topics include: - -- Adding an App-V Package - -- Publishing an App-V Package - -### Adding an App-V package - -Adding an App-V package to the client is the first step of the publishing refresh process. The end result is the same as the `Add-AppVClientPackage` cmdlet in PowerShell, except during the publishing refresh add process, the configured publishing server is contacted and passes a high-level list of applications back to the client to pull more detailed information and not a single package add operation. The process continues by configuring the client for package or connection group additions or updates, then accesses the appv file. Next, the contents of the appv file are expanded and placed on the local operating system in the appropriate locations. The following is a detailed workflow of the process, assuming the package is configured for Fault Streaming. - -**How to add an App-V package** - -1. Manual initiation via PowerShell or Task Sequence initiation of the Publishing Refresh process. - - 1. The App-V Client makes an HTTP connection and requests a list of applications based on the target. The Publishing refresh process supports targeting machines or users. - - 2. The App-V Publishing Server uses the identity of the initiating target, user or machine, and queries the database for a list of entitled applications. The list of applications is provided as an XML response, which the client uses to send additional requests to the server for more information on a per package basis. - -2. The Publishing Agent on the App-V Client performs all actions below serialized. - - Evaluate any connection groups that are unpublished or disabled, since package version updates that are part of the connection group cannot be processed. - -3. Configure the packages by identifying an Add or Update operations. - - 1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server. - - 2. The package file is opened and the AppXManifest.xml and StreamMap.xml are downloaded to the Package Store. - - 3. Completely stream publishing block data defined in the StreamMap.xml. Stores the publishing block data in the Package Store\\PkgGUID\\VerGUID\\Root. - - - Icons: Targets of extension points. - - - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, directly accessed or via file types. - - - Scripts: Download scripts directory for use throughout the publishing process. - - 4. Populate the Package store: - - 1. Create sparse files on disk that represent the extracted package for any directories listed. - - 2. Stage top level files and directories under root. - - 3. All other files are created when the directory is listed as sparse on disk and streamed on demand. - - 5. Create the machine catalog entries. Create the Manifest.xml and DeploymentConfiguration.xml from the package files (if no DeploymentConfiguration.xml file in the package a placeholder is created). - - 6. Create location of the package store in the registry HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog - - 7. Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat - - 8. Register the package with the App-V Kernel Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV - - 9. Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing. - -4. Configure Connection Groups by adding and enabling or disabling. - -5. Remove objects that are not published to the target (user or machine). - - **Note**   - This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published). - - - -6. Invoke background load mounting based on client configuration. - -7. Packages that already have publishing information for the machine or user are immediately restored. - - **Note**   - This condition occurs as a product of removal without unpublishing with background addition of the package. - - - -This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user). - -![package add file and registry data](images/packageaddfileandregistrydata.png) - -### Publishing an App-V package - -During the Publishing Refresh operation, the specific publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps. The following are the detailed steps. - -**How to publish and App-V package** - -1. Package entries are added to the user catalog - - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the User Catalog - - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the Machine Catalog - -2. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV - -3. Perform integration tasks. - - 1. Create extension points. - - 2. Store backup information in the user’s registry and roaming profile (Shortcut Backups). - - **Note**   - This enables restore extension points if the package is unpublished. - - - - 3. Run scripts targeted for publishing timing. - -Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the machine and users catalog information above for details. - -![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) - -### Application launch - -After the Publishing Refresh process, the user launches and subsequently re-launches an App-V application. The process is very simple and optimized to launch quickly with a minimum of network traffic. The App-V Client checks the path to the user catalog for files created during publishing. After rights to launch the package are established, the App-V Client creates a virtual environment, begins streaming any necessary data, and applies the appropriate manifest and deployment configuration files during virtual environment creation. With the virtual environment created and configured for the specific package and application, the application starts. - -**How to launch App-V applications** - -1. User launches the application by clicking on a shortcut or file type invocation. - -2. The App-V Client verifies existence in the User Catalog for the following files - - - UserDeploymentConfiguration.xml - - - UserManifest.xml - -3. If the files are present, the application is entitled for that specific user and the application will start the process for launch. There is no network traffic at this point. - -4. Next, the App-V Client checks that the path for the package registered for the App-V Client service is found in the registry. - -5. Upon finding the path to the package store, the virtual environment is created. If this is the first launch, the Primary Feature Block downloads if present. - -6. After downloading, the App-V Client service consumes the manifest and deployment configuration files to configure the virtual environment and all App-V subsystems are loaded. - -7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as needed basis. - - ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) - -### Upgrading an App-V package - -The App-V 5 package upgrade process differs from the older versions of App-V. App-V supports multiple versions of the same package on a machine entitled to different users. Package versions can be added at any time as the package store and catalogs are updated with the new resources. The only process specific to the addition of new version resources is storage optimization. During an upgrade, only the new files are added to the new version store location and hard links are created for unchanged files. This reduces the overall storage by only presenting the file on one disk location and then projecting it into all folders with a file location entry on the disk. The specific details of upgrading an App-V Package are as follows: - -**How to upgrade an App-V package** - -1. The App-V Client performs a Publishing Refresh and discovers a newer version of an App-V Package. - -2. Package entries are added to the appropriate catalog for the new version - - 1. User targeted packages: the UserDeploymentConfiguration.xml and UserManifest.xml are placed on the machine in the user catalog at appdata\\roaming\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - - 2. Machine targeted (global) packages: the UserDeploymentConfiguration.xml is placed in the machine catalog at %programdata%\\Microsoft\\AppV\\Client\\Catalog\\Packages\\PkgGUID\\VerGUID - -3. Register the package with the kernel mode driver for the user at HKLM\\Software\\Microsoft\\AppV\\MAV - -4. Perform integration tasks. - - - Integrate extensions points (EP) from the Manifest and Dynamic Configuration files. - - 1. File based EP data is stored in the AppData folder utilizing Junction Points from the package store. - - 2. Version 1 EPs already exist when a new version becomes available. - - 3. The extension points are switched to the Version 2 location in machine or user catalogs for any newer or updated extension points. - -5. Run scripts targeted for publishing timing. - -6. Install Side by Side assemblies as required. - -### Upgrading an in-use App-V package - -**Starting in App-V 5 SP2**: If you try to upgrade a package that is in use by an end user, the upgrade task is placed in a pending state. The upgrade will run later, according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
    Task typeApplicable rule

    User-based task, e.g., publishing a package to a user

    The pending task will be performed after the user logs off and then logs back on.

    Globally based task, e.g., enabling a connection group globally

    The pending task will be performed when the computer is shut down and then restarted.

    - - - -When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows: - - ---- - - - - - - - - - - - - - - - - -
    User-based or globally based taskWhere the registry key is generated

    User-based tasks

    KEY_CURRENT_USER\Software\Microsoft\AppV\Client\PendingTasks

    Globally based tasks

    HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\PendingTasks

    - - - -The following operations must be completed before users can use the newer version of the package: - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    Add the package to the computer

    This task is computer specific and you can perform it at any time by completing the steps in the Package Add section above.

    Publish the package

    See the Package Publishing section above for steps. This process requires that you update extension points on the system. End users cannot be using the application when you complete this task.

    - - - -Use the following example scenarios as a guide for updating packages. - - ---- - - - - - - - - - - - - - - - - -
    ScenarioRequirements

    App-V package is not in use when you try to upgrade

    None of the following components of the package can be in use: virtual application, COM server, or shell extensions.

    -

    The administrator publishes a newer version of the package and the upgrade works the next time a component or application inside the package is launched. The new version of the package is streamed and run. Nothing has changed in this scenario in App-V 5 SP2 from previous releases of App-V 5.

    App-V package is in use when the administrator publishes a newer version of the package

    The upgrade operation is set to pending by the App-V Client, which means that it is queued and carried out later when the package is not in use.

    -

    If the package application is in use, the user shuts down the virtual application, after which the upgrade can occur.

    -

    If the package has shell extensions (Office 2013), which are permanently loaded by Windows Explorer, the user cannot be logged in. Users must log off and the log back in to initiate the App-V package upgrade.

    - - - -### Global vs user publishing - -App-V Packages can be published in one of two ways; User which entitles an App-V package to a specific user or group of users and Global which entitles the App-V package to the entire machine for all users of the machine. Once a package upgrade has been pended and the App-V package is not in use, consider the two types of publishing: - -- **Globally published**: the application is published to a machine; all users on that machine can use it. The upgrade will happen when the App-V Client Service starts, which effectively means a machine restart. - -- **User published**: the application is published to a user. If there are multiple users on the machine, the application can be published to a subset of the users. The upgrade will happen when the user logs in or when it is published again (periodically, ConfigMgr Policy refresh and evaluation, or an App-V periodic publishing/refresh, or explicitly via PowerShell commands). - -### Removing an App-V package - -Removing App-V applications in a Full Infrastructure is an unpublish operation, and does not perform a package removal. The process is the same as the publish process above, but instead of adding the removal process reverses the changes that have been made for App-V Packages. - -### Repairing an App-V package - -The repair operation is very simple but may affect many locations on the machine. The previously mentioned Copy on Write (COW) locations are removed, and extension points are de-integrated and then re-integrated. Please review the COW data placement locations by reviewing where they are registered in the registry. This operation is done automatically and there is no administrative control other than initiating a Repair operation from the App-V Client Console or via PowerShell (Repair-AppVClientPackage). - -## Integration of App-V packages - - -The App-V Client and package architecture provides specific integration with the local operating system during the addition and publishing of packages. Three files define the integration or extension points for an App-V Package: - -- AppXManifest.xml: Stored inside of the package with fallback copies stored in the package store and the user profile. Contains the options created during the sequencing process. - -- DeploymentConfig.xml: Provides configuration information of computer and user based integration extension points. - -- UserConfig.xml: A subset of the Deploymentconfig.xml that only provides user- based configurations and only targets user-based extension points. - -### Rules of integration - -When App-V applications are published to a computer with the App-V Client, some specific actions take place as described in the list below: - -- Global Publishing: Shortcuts are stored in the All Users profile location and other extension points are stored in the registry in the HKLM hive. - -- User Publishing: Shortcuts are stored in the current user account profile and other extension points are stored in the registry in the HKCU hive. - -- Backup and Restore: Existing native application data and registry (such as FTA registrations) are backed up during publishing. - - 1. App-V packages are given ownership based on the last integrated package where the ownership is passed to the newest published App-V application. - - 2. Ownership transfers from one App-V package to another when the owning App-V package is unpublished. This will not initiate a restore of the data or registry. - - 3. Restore the backed up data when the last package is unpublished or removed on a per extension point basis. - -### Extension points - -The App-V publishing files (manifest and dynamic configuration) provide several extension points that enable the application to integrate with the local operating system. These extension points perform typical application installation tasks, such as placing shortcuts, creating file type associations, and registering components. As these are virtualized applications that are not installed in the same manner a traditional application, there are some differences. The following is a list of extension points covered in this section: - -- Shortcuts - -- File Type Associations - -- Shell Extensions - -- COM - -- Software Clients - -- Application capabilities - -- URL Protocol Handler - -- AppPath - -- Virtual Application - -### Shortcuts - -The short cut is one of the basic elements of integration with the OS and is the interface for direct user launch of an App-V application. During the publishing and unpublishing of App-V applications. - -From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following: - -```xml - - - [{Common Desktop}]\Adobe Reader 9.lnk - [{AppVPackageRoot}]\Reader\AcroRd32.exe - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\SC_Reader.ico - - - 1 - [{AppVPackageRoot}]\Reader\AcroRd32.exe - - -``` - -As mentioned previously, the App-V shortcuts are placed by default in the user’s profile based on the refresh operation. Global refresh places shortcuts in the All Users profile and user refresh stores them in the specific user’s profile. The actual executable is stored in the Package Store. The location of the ICO file is a tokenized location in the App-V package. - -### File type associations - -The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below: - -```xml - - - - .xdp - AcroExch.XDPDoc - application/vnd.adobe.xdp+xml - - - AcroExch.XDPDoc - Adobe Acrobat XML Data Package File - 65536 - [{Windows}]\Installer\{AC76BA86-7AD7-1033-7B44-A94000000001}\XDPFile_8.ico - - Read - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Open - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Printto - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" /t "%1" "%2" "%3" "%4" - - - [{AppVPackageRoot}]\Reader\AcroRd32.exe - Read - Open with Adobe Reader 9 - "[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1" - - - - - -``` - -**Note**   -In this example: - -- `.xdp` is the extension - -- `AcroExch.XDPDoc` is the ProgId value (which points to the adjoining ProgId) - -- `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable - - - -### Shell extensions - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published globally, the shell extension gives users the same functionality as if the application were locally installed. The application requires no additional setup or configuration on the client to enable the shell extension functionality. - -**Requirements for using shell extensions:** - -- Packages that contain embedded shell extensions must be published globally. - -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. - -The following table displays the supported shell extensions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    HandlerDescription

    Context menu handler

    Adds menu items to the context menu. It is called before the context menu is displayed.

    Drag-and-drop handler

    Controls the action upon right-click drag-and-drop and modifies the context menu that appears.

    Drop target handler

    Controls the action after a data object is dragged-and-dropped over a drop target such as a file.

    Data object handler

    Controls the action after a file is copied to the clipboard or dragged-and-dropped over a drop target. It can provide additional clipboard formats to the drop target.

    Property sheet handler

    Replaces or adds pages to the property sheet dialog box of an object.

    Infotip handler

    Allows retrieving flags and infotip information for an item and displaying it inside a popup tooltip upon mouse- hover.

    Column handler

    Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

    Preview handler

    Enables a preview of a file to be displayed in the Windows Explorer Preview Pane.

    - - - -### COM - -The App-V Client supports publishing applications with support for COM integration and virtualization. COM integration allows the App-V Client to register COM objects on the local operating system and virtualization of the objects. For the purposes of this document, the integration of COM objects requires additional detail. - -App-V supports registering COM objects from the package to the local operating system with two process types: Out-of-process and in-process. Registering COM objects is accomplished with one or a combination of multiple modes of operation for a specific App-V package that includes off, Isolated, and Integrated. The integrated mode is configured for either the out-of-process or in-process type. Configuration of COM modes and types is accomplished with dynamic configuration files (deploymentconfig.xml or userconfig.xml). - -Details on App-V integration are available at: . - -### Software clients and application capabilities - -App-V supports specific software clients and application capabilities extension points that enable virtualized applications to be registered with the software client of the operating system. This enables users to select default programs for operations like email, instant messaging, and media player. This operation is performed in the control panel with the Set Program Access and Computer Defaults, and configured during sequencing in the manifest or dynamic configuration files. Application capabilities are only supported when the App-V applications are published globally. - -Example of software client registration of an App-V based mail client. - -```xml - - - - - - - Mozilla Thunderbird - Mozilla Thunderbird - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /SetAsDefaultAppGlobal - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /HideShortcuts - "[{ProgramFilesX86}]\Mozilla Thunderbird\uninstall\helper.exe" /ShowShortcuts - - 1 - - - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -mail - - [{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll - - Thunderbird URL - 2 - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe,0 - - [{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe - "[{ProgramFilesX86}]\Mozilla Thunderbird\thunderbird.exe" -osint -compose "%1" - - - - - - - -``` - -**Note**   -In this example: - -- `` is the overall Software Clients setting to integrate Email clients - -- `` is the flag to set a particular Email client as the default Email client - -- `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration - - - -### URL Protocol handler - -Applications do not always specifically called virtualized applications utilizing file type invocation. For, example, in an application that supports embedding a mailto: link inside a document or web page, the user clicks on a mailto: link and expects to get their registered mail client. App-V supports URL Protocol handlers that can be registered on a per-package basis with the local operating system. During sequencing, the URL protocol handlers are automatically added to the package. - -For situations where there is more than one application that could register the specific URL Protocol handler, the dynamic configuration files can be utilized to modify the behavior and suppress or disable this feature for an application that should not be the primary application launched. - -### AppPath - -The AppPath extension point supports calling App-V applications directly from the operating system. This is typically accomplished from the Run or Start Screen, depending on the operating system, which enables administrators to provide access to App-V applications from operating system commands or scripts without calling the specific path to the executable. It therefore avoids modifying the system path environment variable on all systems, as it is accomplished during publishing. - -The AppPath extension point is configured either in the manifest or in the dynamic configuration files and is stored in the registry on the local machine during publishing for the user. For additional information on AppPath review: . - -### Virtual application - -This subsystem provides a list of applications captured during sequencing which is usually consumed by other App-V components. Integration of extension points belonging to a particular application can be disabled using dynamic configuration files. For example, if a package contains two applications, it is possible to disable all extension points belonging to one application, in order to allow only integration of extension points of other application. - -### Extension point rules - -The extension points described above are integrated into the operating system based on how the packages has been published. Global publishing places extension points in public machine locations, where user publishing places extension points in user locations. For example a shortcut that is created on the desktop and published globally will result in the file data for the shortcut (%Public%\\Desktop) and the registry data (HKLM\\Software\\Classes). The same shortcut would have file data (%UserProfile%\\Desktop) and registry data (HKCU\\Software\\Classes). - -Extension points are not all published the same way, where some extension points will require global publishing and others require sequencing on the specific operating system and architecture where they are delivered. Below is a table that describes these two key rules. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Virtual ExtensionRequires target OS SequencingRequires Global Publishing

    Shortcut

    File Type Association

    URL Protocols

    X

    AppPaths

    X

    COM Mode

    Software Client

    X

    Application Capabilities

    X

    X

    Context Menu Handler

    X

    X

    Drag-and-drop Handler

    X

    Data Object Handler

    X

    Property Sheet Handler

    X

    Infotip Handler

    X

    Column Handler

    X

    Shell Extensions

    X

    Browser Helper Object

    X

    X

    Active X Object

    X

    X

    - - - -## Dynamic configuration processing - - -Deploying App-V packages to one machine or user is very simple. However, as organizations deploy AppV applications across business lines and geographic and political boundaries, the ability to sequence an application one time with one set of settings becomes impossible. App-V was designed for this scenario, as it captures specific settings and configurations during sequencing in the Manifest file, but also supports modification with Dynamic Configuration files. - -App-V dynamic configuration allows for specifying a policy for a package either at the machine level or at the user level. The Dynamic Configuration files enable sequencing engineers to modify the configuration of a package, post-sequencing, to address the needs of individual groups of users or machines. In some instances it may be necessary to make modifications to the application to provide proper functionality within the App-V environment. For example, it may be necessary to make modifications to the \_\*config.xml files to allow certain actions to be performed at a specified time during the execution of the application, like disabling a mailto extension to prevent a virtualized application from overwriting that extension from another application. - -App-V Packages contain the Manifest file inside of the appv package file, which is representative of sequencing operations and is the policy of choice unless Dynamic Configuration files are assigned to a specific package. Post-sequencing, the Dynamic Configuration files can be modified to allow the publishing of an application to different desktops or users with different extension points. The two Dynamic Configuration Files are the Dynamic Deployment Configuration (DDC) and Dynamic User Configuration (DUC) files. This section focuses on the combination of the manifest and dynamic configuration files. - -### Example for dynamic configuration files - -The example below shows the combination of the Manifest, Deployment Configuration and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only and not to be a complete description of the specific categories available in each of the files. For more information review the App-V 5 Sequencing Guide at: - -**Manifest** - -```xml - - - [{Common Programs}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - -``` - -**Deployment Configuration** - -```xml - - - - - - - - - - -``` - -**User Configuration** - -```xml - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM exe.O.ico - - - - - - - - [{Desktop}]\7-Zip\7-Zip File Manager.lnk - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot}]\7zFM.exe.O.ico - - - [{Common Programs}]\7-Zip\7-Zip File Manager.Ink - [{AppVPackageRoot}]\7zFM.exe - [{AppVPackageRoot)]\7zFM.exe.O.ico - - - - - - - - - - - - -``` - -## Side-by-side assemblies - - -App-V supports the automatic packaging of side-by-side (SxS) assemblies during sequencing and deployment on the client during virtual application publishing. App-V 5 SP2 supports capturing SxS assemblies during sequencing for assemblies not present on the sequencing machine. And for assemblies consisting of Visual C++ (Version 8 and newer) and/or MSXML run-time, the Sequencer will automatically detect and capture these dependencies even if they were not installed during monitoring. The Side by Side assemblies feature removes the limitations of previous versions of App-V, where the App-V Sequencer did not capture assemblies already present on the sequencing workstation, and privatizing the assemblies which limited to one bit version per package. This behavior resulted in deployed App-V applications to clients missing the required SxS assemblies, causing application launch failures. This forced the packaging process to document and then ensure that all assemblies required for packages were locally installed on the user’s client operating system to ensure support for the virtual applications. Based on the number of assemblies and the lack of application documentation for the required dependencies, this task was both a management and implementation challenge. - -Side by Side Assembly support in App-V has the following features. - -- Automatic captures of SxS assembly during Sequencing, regardless of whether the assembly was already installed on the sequencing workstation. - -- The App-V Client automatically installs required SxS assemblies to the client computer at publishing time when they are not present. - -- The Sequencer reports the VC run-time dependency in Sequencer reporting mechanism. - -- The Sequencer allows opting to not package the assemblies that are already installed on the Sequencer, supporting scenarios where the assemblies have previously been installed on the target computers. - -### Automatic publishing of SxS assemblies - -During publishing of an App-V package with SxS assemblies the App-V Client will check for the presence of the assembly on the machine. If the assembly does not exist, the client will deploy the assembly to the machine. Packages that are part of connection groups will rely on the Side by Side assembly installations that are part of the base packages, as the connection group does not contain any information about assembly installation. - -**Note**   -UnPublishing or removing a package with an assembly does not remove the assemblies for that package. - - - -## Client logging - - -The App-V client logs information to the Windows Event log in standard ETW format. The specific App-V events can be found in the event viewer, under Applications and Services Logs\\Microsoft\\AppV\\Client. - -**Note**   -In App-V 5.0 SP3, some logs were consolidated and moved to the following location: - -`Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog` - -For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - - - -There are three specific categories of events recorded described below. - -**Admin**: Logs events for configurations being applied to the App-V Client, and contains the primary warnings and errors. - -**Operational**: Logs the general App-V execution and usage of individual components creating an audit log of the App-V operations that have been completed on the App-V Client. - -**Virtual Application**: Logs virtual application launches and use of virtualization subsystems. - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/check-reg-key-svr.md b/mdop/appv-v5/check-reg-key-svr.md deleted file mode 100644 index 44498c1829..0000000000 --- a/mdop/appv-v5/check-reg-key-svr.md +++ /dev/null @@ -1,246 +0,0 @@ ---- -title: Check Registry Keys before installing App-V 5.x Server -description: Check Registry Keys before installing App-V 5.x Server -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - - -# Check Registry Keys before installing App-V 5.x Server - -If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in this section before installing the App-V 5.x Server - - ---- - - - - - - - - - - - - - - - - - - -

    When this step is required

    You are upgrading from App-V 5.0 SP1 with any subsequent Hotfix Packages that you installed by using an .msp file.

    Which components require that you do this step

    Only the App-V Server components that you are upgrading.

    When you need to do this step

    Before you upgrade the App-V Server to App-V 5.x

    What you need to do

    Using the information in the following tables, update each registry key value under HKLM\Software\Microsoft\AppV\Server with the value that you provided in your original server installation. Completing this step restores registry values that may have been removed when App-V 5.0 SP1 Hotfix Packages were installed.

    - -  - -**ManagementDatabase key** - -If you are installing the Management database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementDatabase`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Key nameDescription

    IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED

    Describes whether a public access account is required to access non-local management databases. Value is set to “1” if it is required.

    MANAGEMENT_DB_NAME

    Name of the Management database.

    MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT

    Account used for read (public) access to the Management database.

    -

    Used when IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

    MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_SID

    Secure identifier (SID) of the account used for read (public) access to the Management database.

    -

    Used when IS_MANAGEMENT_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

    MANAGEMENT_DB_SQL_INSTANCE

    SQL Server instance for the Management database.

    -

    If the value is blank, the default database instance is used.

    MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT

    Account used for write (administrator) access to the Management database.

    MANAGEMENT_DB_WRITE_ACCESS_ACCOUNT_SID

    Secure identifier (SID) of the account used for write (administrator) access to the Management database.

    MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    Management server remote computer account (domain\account).

    MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    Installation administrator login for the Management server (domain\account).

    MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    Valid values are:

    -
      -
    • 1 – the Management service is on the local computer, that is, MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT is blank.

    • -
    • 0 - the Management service is on a different computer from the local computer.

    • -
    - -  - -**ManagementService key** - -If you are installing the Management server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ManagementService`. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Key nameDescription

    MANAGEMENT_ADMINACCOUNT

    Active Directory Domain Services (AD DS) group or account that is authorized to manage App-V (domain\account).

    MANAGEMENT_DB_SQL_INSTANCE

    SQL server instance that contains the Management database.

    -

    If the value is blank, the default database instance is used.

    MANAGEMENT_DB_SQL_SERVER_NAME

    Name of the remote SQL server with the Management database.

    -

    If the value is blank, the local computer is used.

    - -  - -**ReportingDatabase key** - -If you are installing the Reporting database, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingDatabase`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Key nameDescription

    IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED

    Describes whether a public access account is required to access non-local reporting databases. Value is set to “1” if it is required.

    REPORTING_DB_NAME

    Name of the Reporting database.

    REPORTING_DB_PUBLIC_ACCESS_ACCOUNT

    Account used for read (public) access to the Reporting database.

    -

    Used when IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

    REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_SID

    Secure identifier (SID) of the account used for read (public) access to the Reporting database.

    -

    Used when IS_REPORTING_DB_PUBLIC_ACCESS_ACCOUNT_REQUIRED is set to 1.

    REPORTING_DB_SQL_INSTANCE

    SQL Server instance for the Reporting database.

    -

    If the value is blank, the default database instance is used.

    REPORTING_DB_WRITE_ACCESS_ACCOUNT

    REPORTING_DB_WRITE_ACCESS_ACCOUNT_SID

    REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    Reporting server remote computer account (domain\account).

    REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    Installation administrator login for the Reporting server (domain\account).

    REPORTING_SERVER_MACHINE_USE_LOCAL

    Valid values are:

    -
      -
    • 1 – the Reporting service is on the local computer, that is, REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT is blank.

    • -
    • 0 - the Reporting service is on a different computer from the local computer.

    • -
    - -  - -**ReportingService key** - -If you are installing the Reporting server, set these registry keys under `HKLM\Software\Microsoft\AppV\Server\ReportingService`. - - ---- - - - - - - - - - - - - - - - - -
    Key nameDescription

    REPORTING_DB_SQL_INSTANCE

    SQL Server instance for the Reporting database.

    -

    If the value is blank, the default database instance is used.

    REPORTING_DB_SQL_SERVER_NAME

    Name of the remote SQL server with the Reporting database.

    -

    If the value is blank, the local computer is used.

    - diff --git a/mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md b/mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md deleted file mode 100644 index c96dff8cbe..0000000000 --- a/mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Configure Applications and Default Virtual Application Extensions in Management Console -description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: dansimp -ms.assetid: 1e1941d3-fb22-4077-8ec6-7a0cb80335d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 09/26/2019 ---- - -# Configure Applications and Default Virtual Application Extensions in Management Console - -Use the following procedure to *view* and *configure* default package extensions. - -**To view and configure default virtual application extensions** - -1. To view the package that you want to configure, open the App-V 5.1 Management Console. Select the package that you want to configure, right-click the package name and select **edit default configuration**. - -2. To view the applications contained in the specified package, in the **Default Configuration** pane, click **Applications**. To view the shortcuts for that package, click **Shortcuts**. To view the file type associations for that package, click **File Types**. - -3. To enable the application extensions, select **ENABLE**. - - To enable shortcuts, select **ENABLE SHORTCUTS**. To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced** and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions associated with the package using the configuration file. - -5. To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process. - ->**Note** If the upload fails and the size of your configuration file is above 4MB, you will need to increase the maximum file size allowed by the server. This can be done by adding the maxRequestLength attribute with a value greater than the size of your configuration file (in KB) to the httpRuntime element on line 26 of `C:\Program Files\Microsoft Application Virtualization Server\ManagementService\Web.config`. -For example, changing `` to `` will increase the maximum size to 8MB - - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md deleted file mode 100644 index 56bd58a27e..0000000000 --- a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md +++ /dev/null @@ -1,344 +0,0 @@ ---- -title: Creating and Managing App-V 5.0 Virtualized Applications -description: Creating and Managing App-V 5.0 Virtualized Applications -author: dansimp -ms.assetid: 66bab403-d7e0-4e7b-bc8f-a29a98a7160a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating and Managing App-V 5.0 Virtualized Applications - - -After you have properly deployed the Microsoft Application Virtualization (App-V) 5.0 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. - -**Note**   -For more information about configuring the Microsoft Application Virtualization (App-V) 5.0 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx) (https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx). - - - -## Sequencing an application - - -You can use the App-V 5.0 Sequencer to perform the following tasks: - -- Create virtual packages that can be deployed to computers running the App-V 5.0 client. - -- Upgrade existing packages. You can expand an existing package onto the computer running the sequencer and then upgrade the application to create a newer version. - -- Edit configuration information associated with an existing package. For example, you can add a shortcut or modify a file type association. - - **Note**   - You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V 5.0 client. - - - -- Convert existing virtual packages. - -The sequencer uses the **%TMP% \\ Scratch** or **%TEMP% \\ Scratch** directory and the **Temp** directory to store temporary files during sequencing. On the computer that runs the sequencer, you should configure these directories with free disk space equivalent to the estimated application installation requirements. Configuring the temp directories and the Temp directory on different hard drive partitions can help improve performance during sequencing. - -When you use the sequencer to create a new virtual application, the following listed files are created. These files comprise the App-V 5.0 package. - -- .msi file. This Windows Installer (.msi) file is created by the sequencer and is used to install the virtual package on target computers. - -- Report.xml file. In this file, the sequencer saves all issues, warnings, and errors that were discovered during sequencing. It displays the information after the package has been created. You can us this report for diagnosing and troubleshooting. - -- .appv file. This is the virtual application file. - -- Deployment configuration file. The deployment configuration file determines how the virtual application will be deployed to target computers. - -- User configuration file. The user configuration file determines how the virtual application will run on target computers. - -**Important**   -You must configure the %TMP% and %TEMP% folders that the package converter uses to be a secure location and directory. A secure location is only accessible by an administrator. Additionally, when you sequence the package you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion and monitoring process. - - - -The **Options** dialog box in the sequencer console contains the following tabs: - -- **General**. Use this tab to enable Microsoft Updates to run during sequencing. Select **Append Package Version to Filename** to configure the sequence to add a version number to the virtualized package that is being sequenced. Select **Always trust the source of Package Accelerators** to create virtualized packages using a package accelerator without being prompted for authorization. - - **Important**   - Package Accelerators created using App-V 4.6 are not supported by App-V 5.0. - - - -- **Parse Items**. This tab displays the associated file path locations that will be parsed or tokenized into in the virtual environment. Tokens are useful for adding files using the **Package Files** tab in **Advanced Editing**. - -- **Exclusion Items**. Use this tab to specify which folders and directories should not be monitored during sequencing. To add local application data that is saved in the Local App Data folder in the package, click **New** and specify the location and the associated **Mapping Type**. This option is required for some packages. - -App-V 5.0 supports applications that include Microsoft Windows Services. If an application includes a Windows service, the Service will be included in the sequenced virtual package as long as it is installed while being monitored by the sequencer. If a virtual application creates a Windows service when it initially runs, then later, after installation, the application must be run while the sequencer is monitoring so that the Windows Service will be added to the package. Only Services that run under the Local System account are supported. Services that are configured for AutoStart or Delayed AutoStart are started before the first virtual application in a package runs inside the package’s Virtual Environment. Windows Services that are configured to be started on demand by an application are started when the virtual application inside the package starts the Service via API call. - -[How to Sequence a New Application with App-V 5.0](how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md) - -## App-V 5.0 SP2 shell extension support - - -App-V 5.0 SP2 supports shell extensions. Shell extensions will be detected and embedded in the package during sequencing. - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published, the shell extension gives users the same functionality as if the application were locally installed. - -**Requirements for using shell extensions:** - -- Packages that contain embedded shell extensions must be published globally. The application requires no additional setup or configuration on the client to enable the shell extension functionality. - -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. - -The following table lists the supported shell extensions: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    HandlerDescription

    Context menu handler

    Adds menu items to the context menu. It is called before the context menu is displayed.

    Drag-and-drop handler

    Controls the action where right-click, drag and drop and modifies the context menu that appears.

    Drop target handler

    Controls the action after a data object is dragged and dropped over a drop target such as a file.

    Data object handler

    Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target.

    Property sheet handler

    Replaces or adds pages to the property sheet dialog box of an object.

    Infotip handler

    Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover.

    Column handler

    Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

    Preview handler

    Enables a preview of a file to be displayed in the Windows Explorer Preview pane.

    - - - -## Copy on Write (CoW) file extension support - - -Copy on write (CoW) file extensions allow App-V 5.0 to dynamically write to specific locations contained in the virtual package while it is being used. - -The following table displays the file types that can exist in a virtual package under the VFS directory, but cannot be updated on the computer running the App-V 5.0 client. All other files and directories can be modified. - -.acm - -.asa - -.asp - -.aspx - -.ax - -.bat - -.cer - -.chm - -.clb - -.cmd - -.cnt - -.cnv - -.com - -.cpl - -.cpx - -.crt - -.dll - -.drv - -.exe - -.fon - -.grp - -.hlp - -.hta - -.ime - -.inf - -.ins - -.isp - -.its - -.js - -.jse - -.lnk - -.msc - -.msi - -.msp - -.mst - -.mui - -.nls - -.ocx - -.pal - -.pcd - -.pif - -.reg - -.scf - -.scr - -.sct - -.shb - -.shs - -.sys - -.tlb - -.tsp - -.url - -.vb - -.vbe - -.vbs - -.vsmacros - -.ws - -.esc - -.wsf - -.wsh - - - -## Modifying an existing virtual application package - - -You can use the sequencer to modify an existing package. The computer on which you do this should match the chip architecture of the computer you used to create the application. For example, if you initially sequenced a package using a computer running a 64-bit operating system, you should modify the package using a computer running a 64-bit operating system. - -[How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md) - -## Creating a project template - - -A .appvt file is a project template that can be used to save commonly applied, customized settings. You can then more easily use these settings for future sequencings. - -App-V 5.0 project templates differ from App-V 5.0 Application Accelerators because App-V 5.0 Application Accelerators are application-specific, and App-V 5.0 project templates can be applied to multiple applications. Additionally, you cannot use a project template when you use a Package Accelerator to create a virtual application package. The following general settings are saved with an App-V 5.0 project template: - -A template can specify and store multiple settings as follows: - -- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring. Saves allow local interaction option settings - -- **General Options**. Enables the use of **Windows Installer**, **Append Package Version to Filename**. - -- **Exclusion Items.** Contains the Exclusion pattern list. - -[How to Create and Use a Project Template](how-to-create-and-use-a-project-template.md) - -## Creating a package accelerator - - -**Note**   -Package accelerators created using a previous version of App-V must be recreated using App-V 5.0. - - - -You can use App-V 5.0 package accelerators to automatically generate a new virtual application packages. After you have successfully created a package accelerator, you can reuse and share the package accelerator. - -In some situations, to create the package accelerator, you might have to install the application locally on the computer that runs the sequencer. In such cases, you should first try to create the package accelerator with the installation media. If multiple missing files are required, you should install the application locally to the computer that runs the sequencer, and then create the package accelerator. - -After you have successfully created a Package Accelerator, you can reuse and share the Package Accelerator. Creating App-V 5.0 Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.0 Package Accelerator is applied. - -[How to Create a Package Accelerator](how-to-create-a-package-accelerator.md) - -[How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md) - -## Sequencer error reporting - - -The App-V 5.0 Sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue. - -You can also find additional information about sequencing errors using the Windows Event Viewer. - - - - - - -## Other resources for the App-V 5.0 sequencer - - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md deleted file mode 100644 index c781eb4fea..0000000000 --- a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md +++ /dev/null @@ -1,216 +0,0 @@ ---- -title: Creating and Managing App-V 5.1 Virtualized Applications -description: Creating and Managing App-V 5.1 Virtualized Applications -author: dansimp -ms.assetid: 26be4331-88eb-4cfb-9d82-e63d7ee54576 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating and Managing App-V 5.1 Virtualized Applications - - -After you have properly deployed the Microsoft Application Virtualization (App-V) 5.1 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. - -**Note**   -For more information about configuring the App-V 5.1 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx). - -**Note** -The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. - -## Sequencing an application - - -You can use the App-V 5.1 Sequencer to perform the following tasks: - -- Create virtual packages that can be deployed to computers running the App-V 5.1 client. - -- Upgrade existing packages. You can expand an existing package onto the computer running the sequencer and then upgrade the application to create a newer version. - -- Edit configuration information associated with an existing package. For example, you can add a shortcut or modify a file type association. - - **Note**   - You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V 5.1 client. - -- Convert existing virtual packages. - -The sequencer uses the **%TMP% \\ Scratch** or **%TEMP% \\ Scratch** directory and the **Temp** directory to store temporary files during sequencing. On the computer that runs the sequencer, you should configure these directories with free disk space equivalent to the estimated application installation requirements. Configuring the temp directories and the Temp directory on different hard drive partitions can help improve performance during sequencing. - -When you use the sequencer to create a new virtual application, the following listed files are created. These files comprise the App-V 5.1 package. - -- .msi file. This Windows Installer (.msi) file is created by the sequencer and is used to install the virtual package on target computers. - -- Report.xml file. In this file, the sequencer saves all issues, warnings, and errors that were discovered during sequencing. It displays the information after the package has been created. You can us this report for diagnosing and troubleshooting. - -- .appv file. This is the virtual application file. - -- Deployment configuration file. The deployment configuration file determines how the virtual application will be deployed to target computers. - -- User configuration file. The user configuration file determines how the virtual application will run on target computers. - -**Important**   -You must configure the %TMP% and %TEMP% folders that the package converter uses to be a secure location and directory. A secure location is only accessible by an administrator. Additionally, when you sequence the package you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion and monitoring process.  - -The **Options** dialog box in the sequencer console contains the following tabs: - -- **General**. Use this tab to enable Microsoft Updates to run during sequencing. Select **Append Package Version to Filename** to configure the sequence to add a version number to the virtualized package that is being sequenced. Select **Always trust the source of Package Accelerators** to create virtualized packages using a package accelerator without being prompted for authorization. - - **Important**   - Package Accelerators created using App-V 4.6 are not supported by App-V 5.1.   - -- **Parse Items**. This tab displays the associated file path locations that will be parsed or tokenized into in the virtual environment. Tokens are useful for adding files using the **Package Files** tab in **Advanced Editing**. - -- **Exclusion Items**. Use this tab to specify which folders and directories should not be monitored during sequencing. To add local application data that is saved in the Local App Data folder in the package, click **New** and specify the location and the associated **Mapping Type**. This option is required for some packages. - -App-V 5.1 supports applications that include Microsoft Windows Services. If an application includes a Windows service, the Service will be included in the sequenced virtual package as long as it is installed while being monitored by the sequencer. If a virtual application creates a Windows service when it initially runs, then later, after installation, the application must be run while the sequencer is monitoring so that the Windows Service will be added to the package. Only Services that run under the Local System account are supported. Services that are configured for AutoStart or Delayed AutoStart are started before the first virtual application in a package runs inside the package’s Virtual Environment. Windows Services that are configured to be started on demand by an application are started when the virtual application inside the package starts the Service via API call. - -[How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md) - -## App-V 5.1 shell extension support - - -App-V 5.1 supports shell extensions. Shell extensions will be detected and embedded in the package during sequencing. - -Shell extensions are embedded in the package automatically during the sequencing process. When the package is published, the shell extension gives users the same functionality as if the application were locally installed. - -**Requirements for using shell extensions:** - -- Packages that contain embedded shell extensions must be published globally. The application requires no additional setup or configuration on the client to enable the shell extension functionality. - -- The “bitness” of the application, Sequencer, and App-V client must match, or the shell extensions won’t work. For example: - - - The version of the application is 64-bit. - - - The Sequencer is running on a 64-bit computer. - - - The package is being delivered to a 64-bit App-V client computer. - -The following table lists the supported shell extensions: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    HandlerDescription

    Context menu handler

    Adds menu items to the context menu. It is called before the context menu is displayed.

    Drag-and-drop handler

    Controls the action where right-click, drag and drop and modifies the context menu that appears.

    Drop target handler

    Controls the action after a data object is dragged and dropped over a drop target such as a file.

    Data object handler

    Controls the action after a file is copied to the clipboard or dragged and dropped over a drop target. It can provide additional clipboard formats to the drop target.

    Property sheet handler

    Replaces or adds pages to the property sheet dialog box of an object.

    Infotip handler

    Allows retrieving flags and infotip information for an item and displaying it inside a pop-up tooltip upon mouse hover.

    Column handler

    Allows creating and displaying custom columns in Windows Explorer Details view. It can be used to extend sorting and grouping.

    Preview handler

    Enables a preview of a file to be displayed in the Windows Explorer Preview pane.

    - -## Copy on Write (CoW) file extension support - -Copy on write (CoW) file extensions allow App-V 5.1 to dynamically write to specific locations contained in the virtual package while it is being used. - -The following table displays the file types that can exist in a virtual package under the VFS directory, but cannot be updated on the computer running the App-V 5.1 client. All other files and directories can be modified. - -| File Type | | | | | | -|------------ |------------- |------------- |------------ |------------ |------------ | -| .acm | .asa | .asp | .aspx | .ax | .bat | -| .cer | .chm | .clb | .cmd | .cnt | .cnv | -| .com | .cpl | .cpx | .crt | .dll | .drv | -| .esc | .exe | .fon | .grp | .hlp | .hta | -| .ime | .inf | .ins | .isp | .its | .js | -| .jse | .lnk | .msc | .msi | .msp | .mst | -| .mui | .nls | .ocx | .pal | .pcd | .pif | -| .reg | .scf | .scr | .sct | .shb | .shs | -| .sys | .tlb | .tsp | .url | .vb | .vbe | -| .vbs | .vsmacros | .ws | .wsf | .wsh | | - - -## Modifying an existing virtual application package - - -You can use the sequencer to modify an existing package. The computer on which you do this should match the chip architecture of the computer you used to create the application. For example, if you initially sequenced a package using a computer running a 64-bit operating system, you should modify the package using a computer running a 64-bit operating system. - -[How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-51.md) - -## Creating a project template - - -A .appvt file is a project template that can be used to save commonly applied, customized settings. You can then more easily use these settings for future sequencings. - -App-V 5.1 project templates differ from App-V 5.1 Application Accelerators because App-V 5.1 Application Accelerators are application-specific, and App-V 5.1 project templates can be applied to multiple applications. Additionally, you cannot use a project template when you use a Package Accelerator to create a virtual application package. The following general settings are saved with an App-V 5.1 project template: - -A template can specify and store multiple settings as follows: - -- **Advanced Monitoring Options**. Enables Microsoft Update to run during monitoring. Saves allow local interaction option settings - -- **General Options**. Enables the use of **Windows Installer**, **Append Package Version to Filename**. - -- **Exclusion Items.** Contains the Exclusion pattern list. - -[How to Create and Use a Project Template](how-to-create-and-use-a-project-template51.md) - -## Creating a package accelerator - - -**Note**   -Package accelerators created using a previous version of App-V must be recreated using App-V 5.1. - -You can use App-V 5.1 package accelerators to automatically generate a new virtual application packages. After you have successfully created a package accelerator, you can reuse and share the package accelerator. - -In some situations, to create the package accelerator, you might have to install the application locally on the computer that runs the sequencer. In such cases, you should first try to create the package accelerator with the installation media. If multiple missing files are required, you should install the application locally to the computer that runs the sequencer, and then create the package accelerator. - -After you have successfully created a Package Accelerator, you can reuse and share the Package Accelerator. Creating App-V 5.1 Package Accelerators is an advanced task. Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.1 Package Accelerator is applied. - -[How to Create a Package Accelerator](how-to-create-a-package-accelerator51.md) - -[How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md) - -## Sequencer error reporting - - -The App-V 5.1 Sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue. - -You can also find additional information about sequencing errors using the Windows Event Viewer. - - -## Other resources for the App-V 5.1 sequencer - - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - diff --git a/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md b/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md deleted file mode 100644 index 4490ab666a..0000000000 --- a/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD) -description: Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD) -author: dansimp -ms.assetid: d1d74af4-229f-4578-8c95-554a3d7cd2f3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD) - - -You can deploy App-V 5.0 packages using an Electronic Software Distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to Deploy App-V 5.0 with an Electronic Software Distribution System](planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md). - -To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) - -## How to deploy virtualized packages using an ESD - - -Describes the methods you can use to deploy App-V packages by using an ESD - -[How to deploy App-V 5.0 Packages Using Electronic Software Distribution](how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md) - -## How to Enable Only Administrators to Publish Packages by Using an ESD - - -Explains how to configure the App-V client to enable only administrators to publish and unpublish packages when you’re using an ESD. - -[How to Enable Only Administrators to Publish Packages by Using an ESD](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md) - - - - - - -## Other resources for using an ESD and App-V 5.0 - - -Use the following link for more information about [App-V and Citrix Integration](https://go.microsoft.com/fwlink/?LinkId=330294 ) (https://go.microsoft.com/fwlink/?LinkId=330294). - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/deploying-app-v-50.md b/mdop/appv-v5/deploying-app-v-50.md deleted file mode 100644 index 5f13c3d291..0000000000 --- a/mdop/appv-v5/deploying-app-v-50.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Deploying App-V 5.0 -description: Deploying App-V 5.0 -author: dansimp -ms.assetid: 77cb19d7-00e6-4b39-b35a-e8a8ca0b807b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying App-V 5.0 - - -Microsoft Application Virtualization (App-V) 5.0 (App-V 5.0) supports a number of different deployment options. This section of the App-V 5.0 Administrator’s Guide includes information you should consider about the deployment of App-V 5.0 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## App-V 5.0 Deployment Information - - -- [Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - - This section describes how to install the App-V 5.0 sequencer which is used to virtualize applications, and the App-V 5.0 client which runs on target computers to facilitate virtualized packages. - -- [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - - This section provides information about installing the App-V 5.0 management, publishing, database and reporting severs. - -- [App-V 5.0 Deployment Checklist](app-v-50-deployment-checklist.md) - - This section provides a deployment checklist that can be used to assist with installing App-V 5.0. - -## Other Resources for Deploying App-V 5.0 - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md b/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md deleted file mode 100644 index de4772c416..0000000000 --- a/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD) -description: Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD) -author: dansimp -ms.assetid: c2e4d176-460d-44ca-9a1d-69d2a733aa42 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD) - - -You can deploy App-V 5.1 packages using an Electronic Software Distribution (ESD) solution. For information about planning to deploy App-V packages with an ESD, see [Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md). - -To deploy App-V packages with Microsoft System Center 2012 Configuration Manager, see [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) - -## How to deploy virtualized packages using an ESD - - -Describes the methods you can use to deploy App-V packages by using an ESD - -[How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md) - -## How to Enable Only Administrators to Publish Packages by Using an ESD - - -Explains how to configure the App-V client to enable only administrators to publish and unpublish packages when you’re using an ESD. - -[How to Enable Only Administrators to Publish Packages by Using an ESD](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md) - - - - - - -## Other resources for using an ESD and App-V 5.1 - - -Use the following link for more information about [App-V and Citrix Integration](https://go.microsoft.com/fwlink/?LinkId=330294 ) (https://go.microsoft.com/fwlink/?LinkId=330294). - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/deploying-app-v-51.md b/mdop/appv-v5/deploying-app-v-51.md deleted file mode 100644 index 719dc32571..0000000000 --- a/mdop/appv-v5/deploying-app-v-51.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Deploying App-V 5.1 -description: Deploying App-V 5.1 -author: dansimp -ms.assetid: af8742bf-e24b-402a-bcf4-0f2297f26bc4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying App-V 5.1 - - -Microsoft Application Virtualization (App-V) 5.1 supports a number of different deployment options. This section of the App-V 5.1 Administrator’s Guide includes information you should consider about the deployment of App-V 5.1 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## App-V 5.1 Deployment Information - - -- [Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - - This section describes how to install the App-V 5.1 sequencer which is used to virtualize applications, and the App-V 5.1 client which runs on target computers to facilitate virtualized packages. - -- [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - - This section provides information about installing the App-V 5.1 management, publishing, database and reporting severs. - -- [App-V 5.1 Deployment Checklist](app-v-51-deployment-checklist.md) - - This section provides a deployment checklist that can be used to assist with installing App-V 5.1. - -## Other Resources for Deploying App-V 5.1 - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) - -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md deleted file mode 100644 index 88c3436957..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md +++ /dev/null @@ -1,315 +0,0 @@ ---- -title: Deploying Microsoft Office 2010 by Using App-V -description: Deploying Microsoft Office 2010 by Using App-V -author: dansimp -ms.assetid: 0a9e496e-82a1-4dc0-a496-7b21eaa00f53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying Microsoft Office 2010 by Using App-V - - -You can create Office 2010 packages for Application Virtualization 5.0 using one of the following methods: - -- Application Virtualization (App-V) Sequencer - -- Application Virtualization (App-V) Package Accelerator - -## App-V support for Office 2010 - - -The following table shows the App-V versions, methods of Office package creation, supported licensing, and supported deployments for Office 2010. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported itemLevel of support

    Supported App-V versions

      -
    • 4.6

    • -
    • 5.0

    • -

    Package creation

      -
    • Sequencing

    • -
    • Package Accelerator

    • -
    • Office Deployment Kit

    • -

    Supported licensing

    Volume Licensing

    Supported deployments

      -
    • Desktop

    • -
    • Personal VDI

    • -
    • RDS

    • -
    - - - -## Creating Office 2010 App-V 5.0 using the sequencer - - -Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V 5.0. Microsoft has provided a detailed recipe through a Knowledge Base article. To create an Office 2010 package on App-V 5.0, refer to the following link for detailed instructions: - -[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -## Creating Office 2010 App-V 5.0 packages using package accelerators - - -Office 2010 App-V 5.0 packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 8 and Windows 7. To create Office 2010 packages on App-V using Package accelerators, refer to the following pages to access the appropriate package accelerator: - -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://go.microsoft.com/fwlink/p/?LinkId=330677) - -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=330678) - -For detailed instructions on how to create virtual application packages using App-V package accelerators, see [How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md). - -## Deploying the Microsoft Office package for App-V 5.0 - - -You can deploy Office 2010 packages by using any of the following App-V deployment methods: - -- System Center Configuration Manager - -- App-V server - -- Stand-alone through PowerShell commands - -## Office App-V package management and customization - - -Office 2010 packages can be managed like any other App-V 5.0 packages through known package management mechanisms. No special instructions are needed, for example, to add, publish, unpublish, or remove Office packages. - -## Microsoft Office integration with Windows - - -The following table provides a full list of supported integration points for Office 2010. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Extension PointDescriptionOffice 2010

    Lync meeting Join Plug-in for Firefox and Chrome

    User can join Lync meetings from Firefox and Chrome

    Sent to OneNote Print Driver

    User can print to OneNote

    Yes

    OneNote Linked Notes

    OneNote Linked Notes

    Send to OneNote Internet Explorer Add-In

    User can send to OneNote from IE

    Firewall Exception for Lync and Outlook

    Firewall Exception for Lync and Outlook

    MAPI Client

    Native apps and add-ins can interact with virtual Outlook through MAPI

    SharePoint Plugin for Firefox

    User can use SharePoint features in Firefox

    Mail Control Panel Applet

    User gets the mail control panel applet in Outlook

    Yes

    Primary Interop Assemblies

    Support managed add-ins

    Office Document Cache Handler

    Allows Document Cache for Office applications

    Outlook Protocol Search handler

    User can search in outlook

    Yes

    Active X Controls:

    For more information on ActiveX controls, refer to ActiveX Control API Reference.

       Groove.SiteClient

    Active X Control

       PortalConnect.PersonalSite

    Active X Control

       SharePoint.openDocuments

    Active X Control

       SharePoint.ExportDatabase

    Active X Control

       SharePoint.SpreadSheetLauncher

    Active X Control

       SharePoint.StssyncHander

    Active X Control

       SharePoint.DragUploadCtl

    Active X Control

       SharePoint.DragDownloadCtl

    Active X Control

       Sharpoint.OpenXMLDocuments

    Active X Control

       Sharepoint.ClipboardCtl

    Active X control

       WinProj.Activator

    Active X Control

       Name.NameCtrl

    Active X Control

       STSUPld.CopyCtl

    Active X Control

       CommunicatorMeetingJoinAx.JoinManager

    Active X Control

       LISTNET.Listnet

    Active X Control

       OneDrive Pro Browser Helper

    Active X Control]

    OneDrive Pro Icon Overlays

    Windows explorer shell icon overlays when users look at folders OneDrive Pro folders

    - - - -## Additional resources - - -**Office 2013 App-V 5.0 Packages 5.0 Additional Resources** - -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) - -**Office 2010 App-V 5.0 Packages** - -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330681) - -[Known issues when you create or use an App-V 5.0 Office 2010 package](https://go.microsoft.com/fwlink/p/?LinkId=330682) - -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups.md) - -**Dynamic Configuration** - -[About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md deleted file mode 100644 index 8e68496eec..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md +++ /dev/null @@ -1,316 +0,0 @@ ---- -title: Deploying Microsoft Office 2010 by Using App-V -description: Deploying Microsoft Office 2010 by Using App-V -author: dansimp -ms.assetid: ae0b0459-c0d6-4946-b62d-ff153f52d1fb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying Microsoft Office 2010 by Using App-V - - -You can create Office 2010 packages for Microsoft Application Virtualization (App-V) 5.1 using one of the following methods: - -- Application Virtualization (App-V) Sequencer - -- Application Virtualization (App-V) Package Accelerator - -## App-V support for Office 2010 - - -The following table shows the App-V versions, methods of Office package creation, supported licensing, and supported deployments for Office 2010. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported itemLevel of support

    Supported App-V versions

      -
    • 4.6

    • -
    • 5.0

    • -
    • 5.1

    • -

    Package creation

      -
    • Sequencing

    • -
    • Package Accelerator

    • -
    • Office Deployment Kit

    • -

    Supported licensing

    Volume Licensing

    Supported deployments

      -
    • Desktop

    • -
    • Personal VDI

    • -
    • RDS

    • -
    - - - -## Creating Office 2010 App-V 5.1 using the sequencer - - -Sequencing Office 2010 is one of the main methods for creating an Office 2010 package on App-V 5.1. Microsoft has provided a detailed recipe through a Knowledge Base article. To create an Office 2010 package on App-V 5.1, refer to the following link for detailed instructions: - -[How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -## Creating Office 2010 App-V 5.1 packages using package accelerators - - -Office 2010 App-V 5.1 packages can be created through package accelerators. Microsoft has provided package accelerators for creating Office 2010 on Windows 10, Windows 8 and Windows 7. To create Office 2010 packages on App-V using Package accelerators, refer to the following pages to access the appropriate package accelerator: - -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 8](https://go.microsoft.com/fwlink/p/?LinkId=330677) - -- [App-V 5.0 Package Accelerator for Office Professional Plus 2010 – Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=330678) - -For detailed instructions on how to create virtual application packages using App-V package accelerators, see [How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md). - -## Deploying the Microsoft Office package for App-V 5.1 - - -You can deploy Office 2010 packages by using any of the following App-V deployment methods: - -- System Center Configuration Manager - -- App-V server - -- Stand-alone through PowerShell commands - -## Office App-V package management and customization - - -Office 2010 packages can be managed like any other App-V 5.1 packages through known package management mechanisms. No special instructions are needed, for example, to add, publish, unpublish, or remove Office packages. - -## Microsoft Office integration with Windows - - -The following table provides a full list of supported integration points for Office 2010. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Extension PointDescriptionOffice 2010

    Lync meeting Join Plug-in for Firefox and Chrome

    User can join Lync meetings from Firefox and Chrome

    Sent to OneNote Print Driver

    User can print to OneNote

    Yes

    OneNote Linked Notes

    OneNote Linked Notes

    Send to OneNote Internet Explorer Add-In

    User can send to OneNote from IE

    Firewall Exception for Lync and Outlook

    Firewall Exception for Lync and Outlook

    MAPI Client

    Native apps and add-ins can interact with virtual Outlook through MAPI

    SharePoint Plugin for Firefox

    User can use SharePoint features in Firefox

    Mail Control Panel Applet

    User gets the mail control panel applet in Outlook

    Yes

    Primary Interop Assemblies

    Support managed add-ins

    Office Document Cache Handler

    Allows Document Cache for Office applications

    Outlook Protocol Search handler

    User can search in outlook

    Yes

    Active X Controls:

    For more information on ActiveX controls, refer to ActiveX Control API Reference.

       Groove.SiteClient

    Active X Control

       PortalConnect.PersonalSite

    Active X Control

       SharePoint.openDocuments

    Active X Control

       SharePoint.ExportDatabase

    Active X Control

       SharePoint.SpreadSheetLauncher

    Active X Control

       SharePoint.StssyncHander

    Active X Control

       SharePoint.DragUploadCtl

    Active X Control

       SharePoint.DragDownloadCtl

    Active X Control

       Sharpoint.OpenXMLDocuments

    Active X Control

       Sharepoint.ClipboardCtl

    Active X control

       WinProj.Activator

    Active X Control

       Name.NameCtrl

    Active X Control

       STSUPld.CopyCtl

    Active X Control

       CommunicatorMeetingJoinAx.JoinManager

    Active X Control

       LISTNET.Listnet

    Active X Control

       OneDrive Pro Browser Helper

    Active X Control]

    OneDrive Pro Icon Overlays

    Windows explorer shell icon overlays when users look at folders OneDrive Pro folders

    - - - -## Additional resources - - -**Office 2013 App-V Packages Additional Resources** - -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) - -**Office 2010 App-V Packages** - -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330681) - -[Known issues when you create or use an App-V 5.0 Office 2010 package](https://go.microsoft.com/fwlink/p/?LinkId=330682) - -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups51.md) - -**Dynamic Configuration** - -[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md deleted file mode 100644 index ec3642bc65..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md +++ /dev/null @@ -1,894 +0,0 @@ ---- -title: Deploying Microsoft Office 2013 by Using App-V -description: Deploying Microsoft Office 2013 by Using App-V -author: dansimp -ms.assetid: 02df5dc8-79e2-4c5c-8398-dbfb23344ab3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Deploying Microsoft Office 2013 by Using App-V - - -Use the information in this article to use Microsoft Application Virtualization 5.0, or later versions, to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and pp-V. - -This topic contains the following sections: - -- [What to know before you start](#bkmk-before-you-start) - -- [Creating an Office 2013 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) - -- [Publishing the Office package for App-V 5.0](#bkmk-pub-pkg-office) - -- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) - -## What to know before you start - - -Before you deploy Office 2013 by using App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and about running coexisting versions of Office. - - ---- - - - - - - - - - - - - - - - - -
    Information to reviewDescription

    Planning for Using App-V with Office

      -
    • Supported versions of Office

    • -
    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

    • -
    • Office licensing options

    • -

    Planning for Using App-V with Office

    Considerations for installing different versions of Office on the same computer

    - - - -### Packaging, publishing, and deployment requirements - -Before you deploy Office by using App-V, review the following requirements. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskRequirement

    Packaging

      -
    • All of the Office applications that you want to deploy to users must be in a single package.

    • -
    • In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

    • -
    • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2013 and Project 2013 with Office.

    • -

    Publishing

      -
    • You can publish only one Office package to each client computer.

    • -
    • You must publish the Office package globally. You cannot publish to the user.

    • -

    Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

    -
      -
    • Microsoft 365 Apps for enterprise

    • -
    • Visio Pro for Office 365

    • -
    • Project Pro for Office 365

    • -

    You must enable shared computer activation.

    -

    You don’t use shared computer activation if you’re deploying a volume licensed product, such as:

    -
      -
    • Office Professional Plus 2013

    • -
    • Visio Professional 2013

    • -
    • Project Professional 2013

    • -
    - - - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

      -
    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

    • -
    • For more information, see ExcludeApp element.

    • -

    Modify the DeploymentConfig.xml file

      -
    • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

    • -
    • For more information, see Disabling Office 2013 applications.

    • -
    - - - -## Creating an Office 2013 package for App-V with the Office Deployment Tool - - -Complete the following steps to create an Office 2013 package for App-V 5.0 or later. - -**Important** -In App-V 5.0 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you are installing the Office Deployment Tool must have: - - ---- - - - - - - - - - - - - - - - - -
    PrerequisiteDescription

    Prerequisite software

    .Net Framework 4

    Supported operating systems

      -
    • 64-bit version of Windows 8

    • -
    • 64-bit version of Windows 7

    • -
    - - -**Note** -In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing. - - -### Create Office 2013 App-V Packages Using Office Deployment Tool - -You create Office 2013 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing. - -Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V package will run on 32-bit and 64-bit Windows 7 and Windows 8 computers. - -### Download the Office Deployment Tool - -Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: - -1. Download the [Office Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778). - -2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2013 - -3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. - -### Download Office 2013 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. After getting the Office applications, you create the Office 2013 App-V package. - -The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file: - - ```xml - - - - - - - - - - - ``` - - **Note** - The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. - - The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    InputDescriptionExample

    Add element

    Specifies the products and languages to include in the package.

    N/A

    OfficeClientEdition (attribute of Add element)

    Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

    OfficeClientEdition="32"

    -

    OfficeClientEdition="64"

    Product element

    Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.

    Product ID ="O365ProPlusRetail "

    -

    Product ID ="VisioProRetail"

    -

    Product ID ="ProjectProRetail"

    -

    Product ID ="ProPlusVolume"

    -

    Product ID ="VisioProVolume"

    -

    Product ID = "ProjectProVolume"

    Language element

    Specifies the language supported in the applications

    Language ID="en-us"

    Version (attribute of Add element)

    Optional. Specifies a build to use for the package

    -

    Defaults to latest advertised build (as defined in v32.CAB at the Office source).

    15.1.2.3

    SourcePath (attribute of Add element)

    Specifies the location in which the applications will be saved to.

    Sourcepath = "\Server\Office2013”

    - - After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. - -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details: - - ``` syntax - \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - -

    \server\Office2013

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    Setup.exe

    is the Office Deployment Tool.

    /download

    downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.

    \server\Office2013\Customconfig.xml

    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2013.

    - - - -### Convert the Office applications into an App-V package - -After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. Complete the steps that correspond to your licensing model. - -**Summary of what you’ll need to do:** - -- Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7 and Windows 8 computers. - -- Create an Office App-V package for either Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. - - The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Product IDVolume LicensingSubscription Licensing

    Office 2013

    ProPlusVolume

    O365ProPlusRetail

    Office 2013 with Visio 2013

    ProPlusVolume

    -

    VisioProVolume

    O365ProPlusRetail

    -

    VisioProRetail

    Office 2013 with Visio 2013 and Project 2013

    ProPlusVolume

    -

    VisioProVolume

    -

    ProjectProVolume

    O365ProPlusRetail

    -

    VisioProRetail

    -

    ProjectProRetail

    - - - -**How to convert the Office applications into an App-V package** - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterWhat to change the value to

    SourcePath

    Point to the Office applications downloaded earlier.

    ProductID

    Specify the type of licensing, as shown in the following examples:

    -
      -
    • Subscription Licensing

      -
      <Configuration>
      -      <Add SourcePath= "\server\Office 2013" OfficeClientEdition="32" >
      -       <Product ID="O365ProPlusRetail">
      -         <Language ID="en-us" />
      -       </Product>
      -       <Product ID="VisioProRetail">
      -         <Language ID="en-us" />
      -       </Product>
      -     </Add>
      -   </Configuration> 
      -

      In this example, the following changes were made to create a package with Subscription licensing:

      - - - - - - - - - - - - - - - - - - - -

      SourcePath

      is the path, which was changed to point to the Office applications that were downloaded earlier.

      Product ID

      for Office was changed to O365ProPlusRetail.

      Product ID

      for Visio was changed to VisioProRetail.

      -

      -

    • -
    • Volume Licensing

      -
      <Configuration>
      -      <Add SourcePath= "\Server\Office2013" OfficeClientEdition="32" >
      -       <Product ID="ProPlusVolume">
      -         <Language ID="en-us" />
      -       </Product>
      -       <Product ID="VisioProVolume">
      -         <Language ID="en-us" />
      -       </Product>
      -     </Add>
      -   </Configuration>
      -

      In this example, the following changes were made to create a package with Volume licensing:

      - - - - - - - - - - - - - - - - - - - -

      SourcePath

      is the path, which was changed to point to the Office applications that were downloaded earlier.

      Product ID

      for Office was changed to ProPlusVolume.

      Product ID

      for Visio was changed to VisioProVolume.

      -

      -

    • -

    ExcludeApp (optional)

    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

    PACKAGEGUID (optional)

    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

    -

    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.

    -
    - Note

    Even if you use unique package IDs, you can still deploy only one App-V package to a single device.

    -
    -
    - -
    - - - -2. Use the /packager command to convert the Office applications to an Office 2013 App-V package. - - For example: - - ``` syntax - \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml \\server\share\Office2013AppV - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    \server\Office2013

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    Setup.exe

    is the Office Deployment Tool.

    /packager

    creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.

    \server\Office2013\Customconfig.xml

    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

    \server\share\Office 2013AppV

    specifies the location of the newly created Office App-V package.

    - - - -~~~ -After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - -- **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files. - -- **WorkingDir** - -**Note** -To troubleshoot any issues, see the log files in the %temp% directory (default). -~~~ - - - -3. Verify that the Office 2013 App-V package works correctly: - - 1. Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear. - - 2. Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V 5.0 - - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2013 by using the same methods you use for any other package: - -- System Center Configuration Manager - -- App-V Server - -- Stand-alone through PowerShell commands - -### Publishing prerequisites and requirements - - ---- - - - - - - - - - - - - - - - - -
    Prerequisite or requirementDetails

    Enable PowerShell scripting on the App-V clients

    To publish Office 2013 packages, you must run a script.

    -

    Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

    -
    Set-AppvClientConfiguration –EnablePackageScripts 1

    Publish the Office 2013 package globally

    Extension points in the Office App-V package require installation at the computer level.

    -

    When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

    - - - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -- `Add-AppvClientPackage | Publish-AppvClientPackage –global` - -- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) - -- [Disabling Office 2013 applications](#bkmk-disable-office-apps) - -- [Disabling Office 2013 shortcuts](#bkmk-disable-shortcuts) - -- [Managing Office 2013 package upgrades](#bkmk-manage-office-pkg-upgrd) - -- [Managing Office 2013 licensing upgrades](#bkmk-manage-office-lic-upgrd) - -- [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -**To enable plug-ins for Office App-V packages** - -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. - -2. Sequence your plug-ins using the App-V 5.0 Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Microsoft 365 Apps for enterprise(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. - -3. Create an App-V 5.0 package that includes the desired plug-ins. - -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. - -5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - **Important** - The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package. - - - -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package. - -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2013 App-V package has. - - Since the Office 2013 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2013 App-V package you published. - -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. - -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. - -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2013 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. - -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2013 application and verify that the plug-in you published and added to the connection group works as expected. - -### Disabling Office 2013 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -**Note** -To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](https://technet.microsoft.com/library/jj219426.aspx). - - - -**To disable an Office 2013 application** - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." - -2. Search for the Office application you want to disable, for example, Access 2013. - -3. Change the value of "Enabled" from "true" to "false." - -4. Save the Deployment Configuration File. - -5. Add the Office 2013 App-V Package with the new Deployment Configuration File. - - ```xml - - - InfoPath Filler 2013 - - - - - - - Lync 2013 - - - - - - - Access 2013 - - - - - ``` - -6. Re-add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -### Disabling Office 2013 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -**To disable shortcuts for Office 2013 applications** - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. - -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ``` syntax - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2013\Access 2013.lnk - [{AppvPackageRoot}])office15\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office15\MSACCESS.EXE - - ``` - -3. Save the Deployment Configuration File. - -4. Republish Office 2013 App-V Package with new Deployment Configuration File. - -Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2013 package upgrades - -To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2013 package, perform the following steps. - -**How to upgrade a previously deployed Office 2013 package** - -1. Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - **Note** - Office App-V packages have two Version IDs: - - - An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. - - - A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package. - - - -2. Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. - -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - -### Managing Office 2013 licensing upgrades - -If a new Office 2013 App-V Package has a different license than the Office 2013 App-V Package currently deployed. For instance, the Office 2013 package deployed is a subscription based Office 2013 and the new Office 2013 package is Volume Licensing based, the following instructions must be followed to ensure smooth licensing upgrade: - -**How to upgrade an Office 2013 License** - -1. Unpublish the already deployed Office 2013 Subscription Licensing App-V package. - -2. Remove the unpublished Office 2013 Subscription Licensing App-V package. - -3. Restart the computer. - -4. Add the new Office 2013 App-V Package Volume Licensing. - -5. Publish the added Office 2013 App-V Package with Volume Licensing. - -An Office 2013 App-V Package with your chosen licensing will be successfully deployed. - -### Deploying Visio 2013 and Project 2013 with Office - -The following table describes the requirements and options for deploying Visio 2013 and Project 2013 with Office. - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    How do I package and publish Visio 2013 and Project 2013 with Office?

    You must include Visio 2013 and Project 2013 in the same package with Office.

    -

    If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow Deploying Microsoft Office 2010 by Using App-V.

    How can I deploy Visio 2013 and Project 2013 to specific users?

    Use one of the following methods:

    - ---- - - - - - - - - - - - - - - - - -
    If you want to......then use this method

    Create two different packages and deploy each one to a different group of users

    Create and deploy the following packages:

    -
      -
    • A package that contains only Office - deploy to computers whose users need only Office.

    • -
    • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

    • -

    If you want only one package for the whole organization, or if you have users who share computers:

    Follows these steps:

    -
      -
    1. Create a package that contains Office, Visio, and Project.

    2. -
    3. Deploy the package to all users.

    4. -
    5. Use Microsoft AppLocker to prevent specific users from using Visio and Project.

    6. -
    -

    - - - -## Additional resources - - -**Office 2013 App-V 5.0 Packages 5.0 Additional Resources** - -[Office Deployment Tool for Click-to-Run](https://go.microsoft.com/fwlink/p/?LinkID=330672) - -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) - -**Office 2010 App-V 5.0 Packages** - -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330681) - -[Known issues when you create or use an App-V 5.0 Office 2010 package](https://go.microsoft.com/fwlink/p/?LinkId=330682) - -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups.md) - -**Dynamic Configuration** - -[About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md deleted file mode 100644 index 3c08f56eaf..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md +++ /dev/null @@ -1,902 +0,0 @@ ---- -title: Deploying Microsoft Office 2013 by Using App-V -description: Deploying Microsoft Office 2013 by Using App-V -author: dansimp -ms.assetid: 9a7be05e-2a7a-4874-af25-09c0f5037876 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Deploying Microsoft Office 2013 by Using App-V - - -Use the information in this article to use Microsoft Application Virtualization (App-V) 5.1, or later versions, to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v51.md). To successfully deploy Office 2013 with App-V, you need to be familiar with Office 2013 and App-V. - -This topic contains the following sections: - -- [What to know before you start](#bkmk-before-you-start) - -- [Creating an Office 2013 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) - -- [Publishing the Office package for App-V 5.1](#bkmk-pub-pkg-office) - -- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) - -## What to know before you start - - -Before you deploy Office 2013 by using App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and about running coexisting versions of Office. - - ---- - - - - - - - - - - - - - - - - -
    Information to reviewDescription

    Planning for Using App-V with Office

      -
    • Supported versions of Office

    • -
    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

    • -
    • Office licensing options

    • -

    Planning for Using App-V with Office

    Considerations for installing different versions of Office on the same computer

    - - -### Packaging, publishing, and deployment requirements - -Before you deploy Office by using App-V, review the following requirements. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskRequirement

    Packaging

      -
    • All of the Office applications that you want to deploy to users must be in a single package.

    • -
    • In App-V 5.1 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

    • -
    • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2013 and Project 2013 with Office.

    • -

    Publishing

      -
    • You can publish only one Office package to each client computer.

    • -
    • You must publish the Office package globally. You cannot publish to the user.

    • -

    Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

    -
      -
    • Microsoft 365 Apps for enterprise

    • -
    • Visio Pro for Office 365

    • -
    • Project Pro for Office 365

    • -

    You must enable shared computer activation.

    -

    You don’t use shared computer activation if you’re deploying a volume licensed product, such as:

    -
      -
    • Office Professional Plus 2013

    • -
    • Visio Professional 2013

    • -
    • Project Professional 2013

    • -
    - - - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

      -
    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

    • -
    • For more information, see ExcludeApp element.

    • -

    Modify the DeploymentConfig.xml file

      -
    • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

    • -
    • For more information, see Disabling Office 2013 applications.

    • -
    - - - -## Creating an Office 2013 package for App-V with the Office Deployment Tool - - -Complete the following steps to create an Office 2013 package for App-V 5.1 or later. - -**Important** -In App-V 5.1 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - - - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you are installing the Office Deployment Tool must have: - - ---- - - - - - - - - - - - - - - - - -
    PrerequisiteDescription

    Prerequisite software

    .Net Framework 4

    Supported operating systems

      -
    • 64-bit version of Windows 8 or later

    • -
    • 64-bit version of Windows 7

    • -
    - - - -**Note** -In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing. - - - -### Create Office 2013 App-V Packages Using Office Deployment Tool - -You create Office 2013 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2013 App-V package with Volume Licensing or Subscription Licensing. - -Create Office 2013 App-V packages on 64-bit Windows computers. Once created, the Office 2013 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. - -### Download the Office Deployment Tool - -Office 2013 App-V Packages are created using the Office Deployment Tool, which generates an Office 2013 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: - -1. Download the [Office Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=36778). - -2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2013 - -3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. - -### Download Office 2013 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2013 applications. After getting the Office applications, you create the Office 2013 App-V package. - -The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file: - - ```xml - - - - - - - - - - - ``` - - **Note** - The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. - - - -~~~ - The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    InputDescriptionExample

    Add element

    Specifies the products and languages to include in the package.

    N/A

    OfficeClientEdition (attribute of Add element)

    Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

    OfficeClientEdition="32"

    -

    OfficeClientEdition="64"

    Product element

    Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.

    Product ID ="O365ProPlusRetail "

    -

    Product ID ="VisioProRetail"

    -

    Product ID ="ProjectProRetail"

    -

    Product ID ="ProPlusVolume"

    -

    Product ID ="VisioProVolume"

    -

    Product ID = "ProjectProVolume"

    Language element

    Specifies the language supported in the applications

    Language ID="en-us"

    Version (attribute of Add element)

    Optional. Specifies a build to use for the package

    -

    Defaults to latest advertised build (as defined in v32.CAB at the Office source).

    15.1.2.3

    SourcePath (attribute of Add element)

    Specifies the location in which the applications will be saved to.

    Sourcepath = "\\Server\Office2013”

    - - - - After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. -~~~ - -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details: - - ``` syntax - \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - -

    \server\Office2013

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    Setup.exe

    is the Office Deployment Tool.

    /download

    downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.

    \server\Office2013\Customconfig.xml

    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2013.

    - - - -### Convert the Office applications into an App-V package - -After you download the Office 2013 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2013 App-V package. Complete the steps that correspond to your licensing model. - -**Summary of what you’ll need to do:** - -- Create the Office 2013 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8, and Windows 10 computers. - -- Create an Office App-V package for either Subscription Licensing package or Volume Licensing by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. - - The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Product IDVolume LicensingSubscription Licensing

    Office 2013

    ProPlusVolume

    O365ProPlusRetail

    Office 2013 with Visio 2013

    ProPlusVolume

    -

    VisioProVolume

    O365ProPlusRetail

    -

    VisioProRetail

    Office 2013 with Visio 2013 and Project 2013

    ProPlusVolume

    -

    VisioProVolume

    -

    ProjectProVolume

    O365ProPlusRetail

    -

    VisioProRetail

    -

    ProjectProRetail

    - - - -**How to convert the Office applications into an App-V package** - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterWhat to change the value to

    SourcePath

    Point to the Office applications downloaded earlier.

    ProductID

    Specify the type of licensing, as shown in the following examples:

    -
      -
    • Subscription Licensing

      -
      <Configuration>
      -      <Add SourcePath= "\server\Office 2013" OfficeClientEdition="32" >
      -       <Product ID="O365ProPlusRetail">
      -         <Language ID="en-us" />
      -       </Product>
      -       <Product ID="VisioProRetail">
      -         <Language ID="en-us" />
      -       </Product>
      -     </Add>
      -   </Configuration> 
      -

      In this example, the following changes were made to create a package with Subscription licensing:

      - - - - - - - - - - - - - - - - - - - -

      SourcePath

      is the path, which was changed to point to the Office applications that were downloaded earlier.

      Product ID

      for Office was changed to O365ProPlusRetail.

      Product ID

      for Visio was changed to VisioProRetail.

      -

      -

    • -
    • Volume Licensing

      -
      <Configuration>
      -      <Add SourcePath= "\Server\Office2013" OfficeClientEdition="32" >
      -       <Product ID="ProPlusVolume">
      -         <Language ID="en-us" />
      -       </Product>
      -       <Product ID="VisioProVolume">
      -         <Language ID="en-us" />
      -       </Product>
      -     </Add>
      -   </Configuration>
      -

      In this example, the following changes were made to create a package with Volume licensing:

      - - - - - - - - - - - - - - - - - - - -

      SourcePath

      is the path, which was changed to point to the Office applications that were downloaded earlier.

      Product ID

      for Office was changed to ProPlusVolume.

      Product ID

      for Visio was changed to VisioProVolume.

      -

      -

    • -

    ExcludeApp (optional)

    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

    PACKAGEGUID (optional)

    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

    -

    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.

    -
    - Note

    Even if you use unique package IDs, you can still deploy only one App-V package to a single device.

    -
    -
    - -
    - - - -2. Use the /packager command to convert the Office applications to an Office 2013 App-V package. - - For example: - - ``` syntax - \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml \\server\share\Office2013AppV - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    \server\Office2013

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    Setup.exe

    is the Office Deployment Tool.

    /packager

    creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.

    \server\Office2013\Customconfig.xml

    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

    \server\share\Office 2013AppV

    specifies the location of the newly created Office App-V package.

    - - - -~~~ -After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - -- **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files. - -- **WorkingDir** - -**Note** -To troubleshoot any issues, see the log files in the %temp% directory (default). -~~~ - - - -3. Verify that the Office 2013 App-V package works correctly: - - 1. Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear. - - 2. Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V 5.1 - - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2013 by using the same methods you use for any other package: - -- System Center Configuration Manager - -- App-V Server - -- Stand-alone through PowerShell commands - -### Publishing prerequisites and requirements - - ---- - - - - - - - - - - - - - - - - -
    Prerequisite or requirementDetails

    Enable PowerShell scripting on the App-V clients

    To publish Office 2013 packages, you must run a script.

    -

    Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

    -
    Set-AppvClientConfiguration –EnablePackageScripts 1

    Publish the Office 2013 package globally

    Extension points in the Office App-V package require installation at the computer level.

    -

    When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2013 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

    - - - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -- `Add-AppvClientPackage | Publish-AppvClientPackage –global` - -- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) - -- [Disabling Office 2013 applications](#bkmk-disable-office-apps) - -- [Disabling Office 2013 shortcuts](#bkmk-disable-shortcuts) - -- [Managing Office 2013 package upgrades](#bkmk-manage-office-pkg-upgrd) - -- [Managing Office 2013 licensing upgrades](#bkmk-manage-office-lic-upgrd) - -- [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -**To enable plug-ins for Office App-V packages** - -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. - -2. Sequence your plug-ins using the App-V 5.1 Sequencer. Ensure that Office 2013 is installed on the computer being used to sequence the plug-in. It is recommended you use Microsoft 365 Apps for enterprise(non-virtual) on the sequencing computer when you sequence Office 2013 plug-ins. - -3. Create an App-V 5.1 package that includes the desired plug-ins. - -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. - -5. Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - **Important** - The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package. - - - -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package. - -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2013 App-V package has. - - Since the Office 2013 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2013 App-V package you published. - -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. - -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. - -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2013 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. - -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2013 application and verify that the plug-in you published and added to the connection group works as expected. - -### Disabling Office 2013 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -**Note** -To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](https://technet.microsoft.com/library/jj219426.aspx). - - - -**To disable an Office 2013 application** - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." - -2. Search for the Office application you want to disable, for example, Access 2013. - -3. Change the value of "Enabled" from "true" to "false." - -4. Save the Deployment Configuration File. - -5. Add the Office 2013 App-V Package with the new Deployment Configuration File. - - ```xml - - - InfoPath Filler 2013 - - - - - - - Lync 2013 - - - - - - - Access 2013 - - - - - ``` - -6. Re-add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications. - -### Disabling Office 2013 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -**To disable shortcuts for Office 2013 applications** - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. - -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ``` syntax - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2013\Access 2013.lnk - [{AppvPackageRoot}])office15\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office15\MSACCESS.EXE - - ``` - -3. Save the Deployment Configuration File. - -4. Republish Office 2013 App-V Package with new Deployment Configuration File. - -Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2013 package upgrades - -To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2013 package, perform the following steps. - -**How to upgrade a previously deployed Office 2013 package** - -1. Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - **Note** - Office App-V packages have two Version IDs: - - - An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool. - - - A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package. - - - -2. Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. - -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - -### Managing Office 2013 licensing upgrades - -If a new Office 2013 App-V Package has a different license than the Office 2013 App-V Package currently deployed. For instance, the Office 2013 package deployed is a subscription based Office 2013 and the new Office 2013 package is Volume Licensing based, the following instructions must be followed to ensure smooth licensing upgrade: - -**How to upgrade an Office 2013 License** - -1. Unpublish the already deployed Office 2013 Subscription Licensing App-V package. - -2. Remove the unpublished Office 2013 Subscription Licensing App-V package. - -3. Restart the computer. - -4. Add the new Office 2013 App-V Package Volume Licensing. - -5. Publish the added Office 2013 App-V Package with Volume Licensing. - -An Office 2013 App-V Package with your chosen licensing will be successfully deployed. - -### Deploying Visio 2013 and Project 2013 with Office - -The following table describes the requirements and options for deploying Visio 2013 and Project 2013 with Office. - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    How do I package and publish Visio 2013 and Project 2013 with Office?

    You must include Visio 2013 and Project 2013 in the same package with Office.

    -

    If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow Deploying Microsoft Office 2010 by Using App-V.

    How can I deploy Visio 2013 and Project 2013 to specific users?

    Use one of the following methods:

    - ---- - - - - - - - - - - - - - - - - -
    If you want to......then use this method

    Create two different packages and deploy each one to a different group of users

    Create and deploy the following packages:

    -
      -
    • A package that contains only Office - deploy to computers whose users need only Office.

    • -
    • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

    • -

    If you want only one package for the whole organization, or if you have users who share computers:

    Follows these steps:

    -
      -
    1. Create a package that contains Office, Visio, and Project.

    2. -
    3. Deploy the package to all users.

    4. -
    5. Use Microsoft AppLocker to prevent specific users from using Visio and Project.

    6. -
    -

    - - - -## Additional resources - - -**Office 2013 App-V Packages Additional Resources** - -[Office Deployment Tool for Click-to-Run](https://go.microsoft.com/fwlink/p/?LinkID=330672) - -[Supported scenarios for deploying Microsoft Office as a sequenced App-V Package](https://go.microsoft.com/fwlink/p/?LinkId=330680) - -**Office 2010 App-V Packages** - -[Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330681) - -[Known issues when you create or use an App-V 5.0 Office 2010 package](https://go.microsoft.com/fwlink/p/?LinkId=330682) - -[How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://go.microsoft.com/fwlink/p/?LinkId=330676) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups51.md) - -**Dynamic Configuration** - -[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md deleted file mode 100644 index 2856f34f5d..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md +++ /dev/null @@ -1,796 +0,0 @@ ---- -title: Deploying Microsoft Office 2016 by Using App-V -description: Deploying Microsoft Office 2016 by Using App-V -author: dansimp -ms.assetid: cc675cde-cb8d-4b7c-a700-6104b78f1d89 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 07/25/2017 ---- - - -# Deploying Microsoft Office 2016 by Using App-V - - -Use the information in this article to use Microsoft Application Virtualization 5.0, or later versions, to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md). - -This topic contains the following sections: - -- [What to know before you start](#bkmk-before-you-start) - -- [Creating an Office 2016 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) - -- [Publishing the Office package for App-V 5.0](#bkmk-pub-pkg-office) - -- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) - -## What to know before you start - - -Before you deploy Office 2016 by using App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and about running coexisting versions of Office. - - ---- - - - - - - - - - - - - - - - - -
    Information to reviewDescription

    Supported versions of Microsoft Office

      -
    • Supported versions of Office

    • -
    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

    • -
    • Office licensing options

    • -

    Planning for Using App-V with coexisting versions of Office

    Considerations for installing different versions of Office on the same computer

    - - - -### Packaging, publishing, and deployment requirements - -Before you deploy Office by using App-V, review the following requirements. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskRequirement

    Packaging

    -
      -
    • All of the Office applications that you want to deploy to users must be in a single package.

    • -
    • In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

    • -
    • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2016 and Project 2016 with Office.

    • -

    Publishing

      -
    • You can publish only one Office package to each client computer.

    • -
    • You must publish the Office package globally. You cannot publish to the user.

    • -

    Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

    -
      -
    • Microsoft 365 Apps for enterprise

    • -
    • Visio Pro for Office 365

    • -
    • Project Pro for Office 365

    • -

    You must enable shared computer activation.

    -
    - - - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

      -
    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

    • -
    • For more information, see ExcludeApp element.

    • -

    Modify the DeploymentConfig.xml file

      -
    • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

    • -
    • For more information, see Disabling Office 2016 applications.

    • -
    - - - -## Creating an Office 2016 package for App-V with the Office Deployment Tool - - -Complete the following steps to create an Office 2016 package for App-V 5.0 or later. - ->**Important**  In App-V 5.0 and later, you must use the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you are installing the Office Deployment Tool must have: - - ---- - - - - - - - - - - - - - - - - -
    PrerequisiteDescription

    Prerequisite software

    .Net Framework 4

    Supported operating systems

      -
    • 64-bit version of Windows 10

    • -
    • 64-bit version of Windows 8 or 8.1

    • -
    • 64-bit version of Windows 7

    • -
    - - ->**Note** In this topic, the term “Office 2016 App-V package” refers to subscription licensing. - - -### Create Office 2016 App-V Packages Using Office Deployment Tool - -You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with Subscription Licensing. - -Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. - -### Download the Office Deployment Tool - -Office 2016 App-V Packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: - -1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117). - -> **Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages. -> 2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2016 - -3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. - -### Download Office 2016 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package. - -The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file: - - ```xml - - - - - - - - - - - ``` - - >**Note** The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line. - - The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    InputDescriptionExample

    Add element

    Specifies the products and languages to include in the package.

    N/A

    OfficeClientEdition (attribute of Add element)

    Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

    OfficeClientEdition="32"

    -

    OfficeClientEdition="64"

    Product element

    Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications. - - For more information about the product IDs, see Product IDs that are supported by the Office Deployment Tool for Click-to-Run -

    Product ID ="O365ProPlusRetail "

    -

    Product ID ="VisioProRetail"

    -

    Product ID ="ProjectProRetail"

    -

    Language element

    Specifies the language supported in the applications

    Language ID="en-us"

    Version (attribute of Add element)

    Optional. Specifies a build to use for the package

    -

    Defaults to latest advertised build (as defined in v32.CAB at the Office source).

    16.1.2.3

    SourcePath (attribute of Add element)

    Specifies the location in which the applications will be saved to.

    Sourcepath = "\Server\Office2016”

    Channel (attribute of Add element)

    Optional. Specifies the update channel for the product that you want to download or install.

    For more information about update channels, see Overview of update channels for Microsoft 365 Apps for enterprise.

    Channel="Deferred"

    - - After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. - -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with a description of details: - - ``` syntax - \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - -

    \server\Office2016

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    Setup.exe

    is the Office Deployment Tool.

    /download

    downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.

    \server\Office2016\Customconfig.xml

    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2016.

    - - - -### Convert the Office applications into an App-V package - -After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model. - -**Summary of what you’ll need to do:** - -- Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10 computers. - -- Create an Office App-V package for Subscription Licensing package by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. - - The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - ->**Note**  You can use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Product IDSubscription Licensing

    Office 2016

    O365ProPlusRetail

    Office 2016 with Visio 2016

    O365ProPlusRetail

    -

    VisioProRetail

    Office 2016 with Visio 2016 and Project 2016

    O365ProPlusRetail

    -

    VisioProRetail

    -

    ProjectProRetail

    - - - -**How to convert the Office applications into an App-V package** - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterWhat to change the value to

    SourcePath

    Point to the Office applications downloaded earlier.

    ProductID

    Specify Subscription licensing, as shown in the following example:

    -
    <Configuration>
    -      <Add SourcePath= "\server\Office 2016" OfficeClientEdition="32" >
    -       <Product ID="O365ProPlusRetail">
    -         <Language ID="en-us" />
    -       </Product>
    -       <Product ID="VisioProRetail">
    -         <Language ID="en-us" />
    -       </Product>
    -     </Add>
    -   </Configuration> 
    -

    In this example, the following changes were made to create a package with Subscription licensing:

    - - - - - - - - - - - - - - - - - - - -

    SourcePath

    is the path, which was changed to point to the Office applications that were downloaded earlier.

    Product ID

    for Office was changed to O365ProPlusRetail.

    Product ID

    for Visio was changed to VisioProRetail.

    -

    -

    ExcludeApp (optional)

    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

    PACKAGEGUID (optional)

    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

    -

    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.

    - >Note Even if you use unique package IDs, you can still deploy only one App-V package to a single device. -
    - - - -2. Use the /packager command to convert the Office applications to an Office 2016 App-V package. - - For example: - - ``` syntax - \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml \\server\share\Office2016AppV - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    \server\Office2016

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    Setup.exe

    is the Office Deployment Tool.

    /packager

    creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.

    \server\Office2016\Customconfig.xml

    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

    \server\share\Office 2016AppV

    specifies the location of the newly created Office App-V package.

    - - - -~~~ -After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - -- **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files. - -- **WorkingDir** - -**Note** To troubleshoot any issues, see the log files in the %temp% directory (default). -~~~ - - - -3. Verify that the Office 2016 App-V package works correctly: - - 1. Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear. - - 2. Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V - - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2016 by using the same methods you use for any other package: - -- System Center Configuration Manager - -- App-V Server - -- Stand-alone through PowerShell commands - -### Publishing prerequisites and requirements - - ---- - - - - - - - - - - - - - - - - -
    Prerequisite or requirementDetails

    Enable PowerShell scripting on the App-V clients

    To publish Office 2016 packages, you must run a script.

    -

    Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

    -
    Set-AppvClientConfiguration –EnablePackageScripts 1

    Publish the Office 2016 package globally

    Extension points in the Office App-V package require installation at the computer level.

    -

    When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

    - - - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -- `Add-AppvClientPackage | Publish-AppvClientPackage –global` - -- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) - -- [Disabling Office 2016 applications](#bkmk-disable-office-apps) - -- [Disabling Office 2016 shortcuts](#bkmk-disable-shortcuts) - -- [Managing Office 2016 package upgrades](#bkmk-manage-office-pkg-upgrd) - -- [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -**To enable plug-ins for Office App-V packages** - -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. - -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Microsoft 365 Apps for enterprise(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. - -3. Create an App-V package that includes the desired plug-ins. - -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. - -5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - >**Important** The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package. - - - -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2016 App-V package. - -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2016 App-V package has. - - Since the Office 2016 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2016 App-V package you published. - -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. - -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. - -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2016 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. - -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2016 application and verify that the plug-in you published and added to the connection group works as expected. - -### Disabling Office 2016 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, you will save the changes, add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - ->**Note** To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. - - -**To disable an Office 2016 application** - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." - -2. Search for the Office application you want to disable, for example, Access 2016. - -3. Change the value of "Enabled" from "true" to "false." - -4. Save the Deployment Configuration File. - -5. Add the Office 2016 App-V Package with the new Deployment Configuration File. - - ```xml - - - Lync 2016 - - - - - - - Access 2016 - - - - - ``` - -6. Re-add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - -### Disabling Office 2016 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -**To disable shortcuts for Office 2016 applications** - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. - -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ``` syntax - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2016\Access 2016.lnk - [{AppvPackageRoot}])office16\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office16\MSACCESS.EXE - - ``` - -3. Save the Deployment Configuration File. - -4. Republish Office 2016 App-V Package with new Deployment Configuration File. - -Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2016 package upgrades - -To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2016 package, perform the following steps. - -**How to upgrade a previously deployed Office 2016 package** - -1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - > **Note** Office App-V packages have two Version IDs: - >
      - >
    • An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
    • - >
    • A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
    • - >
    - - -2. Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. - -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - - -### Deploying Visio 2016 and Project 2016 with Office - -The following table describes the requirements and options for deploying Visio 2016 and Project 2016 with Office. - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    How do I package and publish Visio 2016 and Project 2016 with Office?

    You must include Visio 2016 and Project 2016 in the same package with Office.

    -

    If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic.

    How can I deploy Visio 2016 and Project 2016 to specific users?

    Use one of the following methods:

    - ---- - - - - - - - - - - - - - - - - -
    If you want to......then use this method

    Create two different packages and deploy each one to a different group of users

    Create and deploy the following packages:

    -
      -
    • A package that contains only Office - deploy to computers whose users need only Office.

    • -
    • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

    • -

    If you want only one package for the whole organization, or if you have users who share computers:

    Follows these steps:

    -
      -
    1. Create a package that contains Office, Visio, and Project.

    2. -
    3. Deploy the package to all users.

    4. -
    5. Use Microsoft AppLocker to prevent specific users from using Visio and Project.

    6. -
    -

    - - - -## Additional resources - - -[Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) - -[Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) - -[Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups.md) - -**Dynamic Configuration** - -[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) - - - - - diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md deleted file mode 100644 index 6d6021c95e..0000000000 --- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md +++ /dev/null @@ -1,795 +0,0 @@ ---- -title: Deploying Microsoft Office 2016 by Using App-V -description: Deploying Microsoft Office 2016 by Using App-V -author: dansimp -ms.assetid: e0f4876-da99-4b89-977e-2fb6e89ea3d3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Deploying Microsoft Office 2016 by Using App-V - - -Use the information in this article to use Microsoft Application Virtualization (App-V) 5.1, or later versions, to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. For information about using App-V to deliver Office 2013, see [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v51.md). For information about using App-V to deliver Office 2010, see [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v51.md). - -This topic contains the following sections: - -- [What to know before you start](#bkmk-before-you-start) - -- [Creating an Office 2016 package for App-V with the Office Deployment Tool](#bkmk-create-office-pkg) - -- [Publishing the Office package for App-V 5.1](#bkmk-pub-pkg-office) - -- [Customizing and managing Office App-V packages](#bkmk-custmz-manage-office-pkgs) - -## What to know before you start - - -Before you deploy Office 2016 by using App-V, review the following planning information. - -### Supported Office versions and Office coexistence - -Use the following table to get information about supported versions of Office and about running coexisting versions of Office. - - ---- - - - - - - - - - - - - - - - - -
    Information to reviewDescription

    Supported versions of Microsoft Office

      -
    • Supported versions of Office

    • -
    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)

    • -
    • Office licensing options

    • -

    Planning for Using App-V with coexisting versions of Office

    Considerations for installing different versions of Office on the same computer

    - - - -### Packaging, publishing, and deployment requirements - -Before you deploy Office by using App-V, review the following requirements. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskRequirement

    Packaging

    -
      -
    • All of the Office applications that you want to deploy to users must be in a single package.

    • -
    • In App-V 5.1 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.

    • -
    • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2016 and Project 2016 with Office.

    • -

    Publishing

      -
    • You can publish only one Office package to each client computer.

    • -
    • You must publish the Office package globally. You cannot publish to the user.

    • -

    Deploying any of the following products to a shared computer, for example, by using Remote Desktop Services:

    -
      -
    • Microsoft 365 Apps for enterprise

    • -
    • Visio Pro for Office 365

    • -
    • Project Pro for Office 365

    • -

    You must enable shared computer activation.

    -
    - - - -### Excluding Office applications from a package - -The following table describes the recommended methods for excluding specific Office applications from a package. - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.

      -
    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.

    • -
    • For more information, see ExcludeApp element.

    • -

    Modify the DeploymentConfig.xml file

      -
    • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.

    • -
    • For more information, see Disabling Office 2016 applications.

    • -
    - - - -## Creating an Office 2016 package for App-V with the Office Deployment Tool - - -Complete the following steps to create an Office 2016 package for App-V 5.1 or later. - ->**Important**  In App-V 5.1 and later, you must use the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages. - -### Review prerequisites for using the Office Deployment Tool - -The computer on which you are installing the Office Deployment Tool must have: - - ---- - - - - - - - - - - - - - - - - -
    PrerequisiteDescription

    Prerequisite software

    .Net Framework 4

    Supported operating systems

      -
    • 64-bit version of Windows 10

    • -
    • 64-bit version of Windows 8 or 8.1

    • -
    • 64-bit version of Windows 7

    • -
    - - ->**Note** In this topic, the term “Office 2016 App-V package” refers to subscription licensing. - - -### Create Office 2016 App-V Packages Using Office Deployment Tool - -You create Office 2016 App-V packages by using the Office Deployment Tool. The following instructions explain how to create an Office 2016 App-V package with Subscription Licensing. - -Create Office 2016 App-V packages on 64-bit Windows computers. Once created, the Office 2016 App-V package will run on 32-bit and 64-bit Windows 7, Windows 8.1, and Windows 10 computers. - -### Download the Office Deployment Tool - -Office 2016 App-V Packages are created using the Office Deployment Tool, which generates an Office 2016 App-V Package. The package cannot be created or modified through the App-V sequencer. To begin package creation: - -1. Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117). - -> **Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages. -> 2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved. - - Example: \\\\Server\\Office2016 - -3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified. - -### Download Office 2016 applications - -After you download the Office Deployment Tool, you can use it to get the latest Office 2016 applications. After getting the Office applications, you create the Office 2016 App-V package. - -The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included. - -1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications: - - 1. Open the sample XML file in Notepad or your favorite text editor. - - 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file: - - ```xml - - - - - - - - - - - ``` - - >**Note** The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line. - - The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    InputDescriptionExample

    Add element

    Specifies the products and languages to include in the package.

    N/A

    OfficeClientEdition (attribute of Add element)

    Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.

    OfficeClientEdition="32"

    -

    OfficeClientEdition="64"

    Product element

    Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications. - - For more information about the product IDs, see Product IDs that are supported by the Office Deployment Tool for Click-to-Run -

    Product ID ="O365ProPlusRetail "

    -

    Product ID ="VisioProRetail"

    -

    Product ID ="ProjectProRetail"

    -

    Language element

    Specifies the language supported in the applications

    Language ID="en-us"

    Version (attribute of Add element)

    Optional. Specifies a build to use for the package

    -

    Defaults to latest advertised build (as defined in v32.CAB at the Office source).

    16.1.2.3

    SourcePath (attribute of Add element)

    Specifies the location in which the applications will be saved to.

    Sourcepath = "\Server\Office2016”

    Branch (attribute of Add element)

    Optional. Specifies the update branch for the product that you want to download or install.

    For more information about update branches, see Overview of update branches for Microsoft 365 Apps for enterprise.

    Branch = "Business"

    - - After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml. - -2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with a description of details: - - ``` syntax - \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - -

    \server\Office2016

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    Setup.exe

    is the Office Deployment Tool.

    /download

    downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.

    \server\Office2016\Customconfig.xml

    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2016.

    - - - -### Convert the Office applications into an App-V package - -After you download the Office 2016 applications through the Office Deployment Tool, use the Office Deployment Tool to convert them into an Office 2016 App-V package. Complete the steps that correspond to your licensing model. - -**Summary of what you’ll need to do:** - -- Create the Office 2016 App-V packages on 64-bit Windows computers. However, the package will run on 32-bit and 64-bit Windows 7, Windows 8 or 8.1, and Windows 10 computers. - -- Create an Office App-V package for Subscription Licensing package by using the Office Deployment Tool, and then modify the CustomConfig.xml configuration file. - - The following table summarizes the values you need to enter in the CustomConfig.xml file for the licensing model you’re using. The steps in the sections that follow the table will specify the exact entries you need to make. - ->**Note**  You can use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Product IDSubscription Licensing

    Office 2016

    O365ProPlusRetail

    Office 2016 with Visio 2016

    O365ProPlusRetail

    -

    VisioProRetail

    Office 2016 with Visio 2016 and Project 2016

    O365ProPlusRetail

    -

    VisioProRetail

    -

    ProjectProRetail

    - - - -**How to convert the Office applications into an App-V package** - -1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterWhat to change the value to

    SourcePath

    Point to the Office applications downloaded earlier.

    ProductID

    Specify Subscription licensing, as shown in the following example:

    -
    <Configuration>
    -      <Add SourcePath= "\server\Office 2016" OfficeClientEdition="32" >
    -       <Product ID="O365ProPlusRetail">
    -         <Language ID="en-us" />
    -       </Product>
    -       <Product ID="VisioProRetail">
    -         <Language ID="en-us" />
    -       </Product>
    -     </Add>
    -   </Configuration> 
    -

    In this example, the following changes were made to create a package with Subscription licensing:

    - - - - - - - - - - - - - - - - - - - -

    SourcePath

    is the path, which was changed to point to the Office applications that were downloaded earlier.

    Product ID

    for Office was changed to O365ProPlusRetail.

    Product ID

    for Visio was changed to VisioProRetail.

    -

    -

    ExcludeApp (optional)

    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.

    PACKAGEGUID (optional)

    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.

    -

    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.

    - - >Note Even if you use unique package IDs, you can still deploy only one App-V package to a single device. -
    - - -2. Use the /packager command to convert the Office applications to an Office 2016 App-V package. - - For example: - - ``` syntax - \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml \\server\share\Office2016AppV - ``` - - In the example: - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    \server\Office2016

    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.

    Setup.exe

    is the Office Deployment Tool.

    /packager

    creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.

    \server\Office2016\Customconfig.xml

    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.

    \server\share\Office 2016AppV

    specifies the location of the newly created Office App-V package.

    - - - -~~~ -After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved: - -- **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files. - -- **WorkingDir** - -**Note** To troubleshoot any issues, see the log files in the %temp% directory (default). -~~~ - - - -3. Verify that the Office 2016 App-V package works correctly: - - 1. Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear. - - 2. Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected. - -## Publishing the Office package for App-V - - -Use the following information to publish an Office package. - -### Methods for publishing Office App-V packages - -Deploy the App-V package for Office 2016 by using the same methods you use for any other package: - -- System Center Configuration Manager - -- App-V Server - -- Stand-alone through PowerShell commands - -### Publishing prerequisites and requirements - - ---- - - - - - - - - - - - - - - - - -
    Prerequisite or requirementDetails

    Enable PowerShell scripting on the App-V clients

    To publish Office 2016 packages, you must run a script.

    -

    Package scripts are disabled by default on App-V clients. To enable scripting, run the following PowerShell command:

    -
    Set-AppvClientConfiguration –EnablePackageScripts 1

    Publish the Office 2016 package globally

    Extension points in the Office App-V package require installation at the computer level.

    -

    When you publish at the computer level, no prerequisite actions or redistributables are needed, and the Office 2016 package globally enables its applications to work like natively installed Office, eliminating the need for administrators to customize packages.

    - - - -### How to publish an Office package - -Run the following command to publish an Office package globally: - -- `Add-AppvClientPackage | Publish-AppvClientPackage –global` - -- From the Web Management Console on the App-V Server, you can add permissions to a group of computers instead of to a user group to enable packages to be published globally to the computers in the corresponding group. - -## Customizing and managing Office App-V packages - - -To manage your Office App-V packages, use the same operations as you would for any other package, but there are a few exceptions, as outlined in the following sections. - -- [Enabling Office plug-ins by using connection groups](#bkmk-enable-office-plugins) - -- [Disabling Office 2016 applications](#bkmk-disable-office-apps) - -- [Disabling Office 2016 shortcuts](#bkmk-disable-shortcuts) - -- [Managing Office 2016 package upgrades](#bkmk-manage-office-pkg-upgrd) - -- [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project) - -### Enabling Office plug-ins by using connection groups - -Use the steps in this section to enable Office plug-ins with your Office package. To use Office plug-ins, you must use the App-V Sequencer to create a separate package that contains just the plug-ins. You cannot use the Office Deployment Tool to create the plug-ins package. You then create a connection group that contains the Office package and the plug-ins package, as described in the following steps. - -**To enable plug-ins for Office App-V packages** - -1. Add a Connection Group through App-V Server, System Center Configuration Manager, or a PowerShell cmdlet. - -2. Sequence your plug-ins using the App-V Sequencer. Ensure that Office 2016 is installed on the computer being used to sequence the plug-in. It is recommended you use Microsoft 365 Apps for enterprise(non-virtual) on the sequencing computer when you sequence Office 2016 plug-ins. - -3. Create an App-V package that includes the desired plug-ins. - -4. Add a Connection Group through App-V server, System Center Configuration Manager, or a PowerShell cmdlet. - -5. Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created. - - >**Important** The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package. - - - -6. Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2016 App-V package. - -7. Verify that the Deployment Configuration File of the plug-in package has the same settings that the Office 2016 App-V package has. - - Since the Office 2016 App-V package is integrated with the operating system, the plug-in package settings should match. You can search the Deployment Configuration File for “COM Mode” and ensure that your plug-ins package has that value set as “Integrated” and that both "InProcessEnabled" and "OutOfProcessEnabled" match the settings of the Office 2016 App-V package you published. - -8. Open the Deployment Configuration File and set the value for **Objects Enabled** to **false**. - -9. If you made any changes to the Deployment Configuration file after sequencing, ensure that the plug-in package is published with the file. - -10. Ensure that the Connection Group you created is enabled onto your desired computer. The Connection Group created will likely “pend” if the Office 2016 App-V package is in use when the Connection Group is enabled. If that happens, you have to reboot to successfully enable the Connection Group. - -11. After you successfully publish both packages and enable the Connection Group, start the target Office 2016 application and verify that the plug-in you published and added to the connection group works as expected. - -### Disabling Office 2016 applications - -You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, you will save the changes, add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - ->**Note** To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. - - -**To disable an Office 2016 application** - -1. Open a Deployment Configuration File with a text editor such as **Notepad** and search for “Applications." - -2. Search for the Office application you want to disable, for example, Access 2016. - -3. Change the value of "Enabled" from "true" to "false." - -4. Save the Deployment Configuration File. - -5. Add the Office 2016 App-V Package with the new Deployment Configuration File. - - ```xml - - - Lync 2016 - - - - - - - Access 2016 - - - - - ``` - -6. Re-add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications. - -### Disabling Office 2016 shortcuts - -You may want to disable shortcuts for certain Office applications instead of unpublishing or removing the package. The following example shows how to disable shortcuts for Microsoft Access. - -**To disable shortcuts for Office 2016 applications** - -1. Open a Deployment Configuration File in Notepad and search for “Shortcuts”. - -2. To disable certain shortcuts, delete or comment out the specific shortcuts you don’t want. You must keep the subsystem present and enabled. For example, in the example below, delete the Microsoft Access shortcuts, while keeping the subsystems <shortcut> </shortcut> intact to disable the Microsoft Access shortcut. - - ``` syntax - Shortcuts - - --> - - - - - [{Common Programs}]\Microsoft Office 2016\Access 2016.lnk - [{AppvPackageRoot}])office16\MSACCESS.EXE - [{Windows}]\Installer\{90150000-000F-0000-0000-000000FF1CE)\accicons.exe.Ø.ico - - - Microsoft.Office.MSACCESS.EXE.15 - true - Build a professional app quickly to manage data. - l - [{AppVPackageRoot}]\office16\MSACCESS.EXE - - ``` - -3. Save the Deployment Configuration File. - -4. Republish Office 2016 App-V Package with new Deployment Configuration File. - -Many additional settings can be changed through modifying the Deployment Configuration for App-V packages, for example, file type associations, Virtual File System, and more. For additional information on how to use Deployment Configuration Files to change App-V package settings, refer to the additional resources section at the end of this document. - -### Managing Office 2016 package upgrades - -To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a previously deployed Office 2016 package, perform the following steps. - -**How to upgrade a previously deployed Office 2016 package** - -1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage. - - > **Note** Office App-V packages have two Version IDs: - >
      - >
    • An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
    • - >
    • A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
    • - >
    - - -2. Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast. - -3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted. - - -### Deploying Visio 2016 and Project 2016 with Office - -The following table describes the requirements and options for deploying Visio 2016 and Project 2016 with Office. - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    How do I package and publish Visio 2016 and Project 2016 with Office?

    You must include Visio 2016 and Project 2016 in the same package with Office.

    -

    If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow the packaging, publishing, and deployment requirements described in this topic.

    How can I deploy Visio 2016 and Project 2016 to specific users?

    Use one of the following methods:

    - ---- - - - - - - - - - - - - - - - - -
    If you want to......then use this method

    Create two different packages and deploy each one to a different group of users

    Create and deploy the following packages:

    -
      -
    • A package that contains only Office - deploy to computers whose users need only Office.

    • -
    • A package that contains Office, Visio, and Project - deploy to computers whose users need all three applications.

    • -

    If you want only one package for the whole organization, or if you have users who share computers:

    Follows these steps:

    -
      -
    1. Create a package that contains Office, Visio, and Project.

    2. -
    3. Deploy the package to all users.

    4. -
    5. Use Microsoft AppLocker to prevent specific users from using Visio and Project.

    6. -
    -

    - - -## Additional resources - - -[Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) - -[Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) - -[Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117) - -**Connection Groups** - -[Deploying Connection Groups in Microsoft App-V v5](https://go.microsoft.com/fwlink/p/?LinkId=330683) - -[Managing Connection Groups](managing-connection-groups.md) - -**Dynamic Configuration** - -[About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) - - - - - diff --git a/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md b/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md deleted file mode 100644 index 1ad01a6915..0000000000 --- a/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Deploying the App-V 5.0 Sequencer and Client -description: Deploying the App-V 5.0 Sequencer and Client -author: dansimp -ms.assetid: 84cc84bd-5bc0-41aa-9519-0ded2932c078 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Deploying the App-V 5.0 Sequencer and Client - - -The App-V 5.0 Sequencer and client enable administrators to virtualize and run virtualized applications. - -## Deploy the client - - -The App-V 5.0 client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and to double-click file types, so that they can start a virtualized application. The client can also obtain the virtual application content from the management server. - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) - -[How to Uninstall the App-V 5.0 Client](how-to-uninstall-the-app-v-50-client.md) - -[How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md) - -## Client Configuration Settings - - -The App-V 5.0 client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. - -[About Client Configuration Settings](about-client-configuration-settings.md) - -## Configure the client by using the ADMX template and Group Policy - - -You can use the Microsoft ADMX template to configure the client settings for the App-V 5.0 client and the Remote Desktop Services client. The ADMX template manages common client configurations by using an existing Group Policy infrastructure and it includes settings for the App-V 5.0 client configuration. - -**Important**   -You can obtain the App-V 5.0 ADMX template from the Microsoft Download Center. - - - -After you download and install the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller. - -1. Save the **.admx** file to the following directory: **Windows \\ PolicyDefinitions** - -2. Save the **.adml** file to the following directory: **Windows \\ PolicyDefinitions \\ <Language Directory>** - -After you have completed the preceding steps, you can manage the App-V 5.0 client configuration settings with the **Group Policy Management** console. - -The App-V 5.0 client also stores its configuration in the registry. You can gather some useful information about the client if you understand the format of the data in the registry. You can also configure many client actions by changing registry entries. - -[How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md) - -## Deploy the client by using the Shared Content Store mode - - -The App-V 5.0 Shared Content Store (SCS) mode enables the SCS App-V 5.0 clients to run virtualized applications without saving any of the associated package data locally. All required virtualized package data is transmitted across the network; therefore, you should only use the SCS mode in environments with a fast connection. Both the Remote Desktop Services (RDS) and the standard version of the App-V 5.0 client are supported with SCS mode. - -**Important**   -If the App-V 5.0 client is configured to run in the SCS mode, the location where the App-V 5.0 packages are streamed from must be available, otherwise, the virtualized package will fail. Additionally, we do not recommend deployment of virtualized applications to computers that run the App-V 5.0 client in the SCS mode across the internet. - - - -Additionally, the SCS is not a physical location that contains virtualized packages. It is a mode that allows the App-V 5.0 client to stream the required virtualized package data across the network. - -The SCS mode is helpful in the following scenarios: - -- Virtual desktop infrastructure (VDI) deployments - -- Remote desktop services (RDS) deployments - -To use SCS in your environment, you must enable the App-V 5.0 client to run in SCS mode. This setting should be specified during installation. By default, the client is not configured to use SCS mode. You should install the client by using the suggested procedure if you plan to use SCS. However, you can configure an existing App-V 5.0 client to run in SCS mode by entering the following PowerShell command on the computer that runs the App-V 5.0 client: - -**set-AppvClientConfiguration -SharedContentStoreMode 1** - -There might be cases when the administrator pre-loads some virtual applications on the computer that runs the App-V 5.0 client in SCS mode. This can be accomplished with PowerShell commands to add, publish, and mount the package. For example, if a package is pre-loaded on all computers, the administrator could add, publish, and mount the package by using PowerShell commands. The package would not stream across the network because it would be locally stored. - -[How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md) - -## Deploy the Sequencer - - -The Sequencer is a tool that is used to convert standard applications into virtual packages for deployment to computers that run the App-V 5.0 client. The Sequencer helps provide a simple and predictable conversion process with minimal changes to prior sequencing workflows. In addition, the Sequencer allows users to more easily configure applications to enable connections of virtualized applications. - -For a list of changes in the App-V 5.0 Sequencer, see [What's New in App-V 5.0](whats-new-in-app-v-50.md). - -[How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md) - -## App-V 5.0 Client and Sequencer logs - - -You can use the App-V 5.0 Sequencer log information to help troubleshoot the Sequencer installation and operational events while using App-V 5.0. The Sequencer-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Sequencer-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V**. Sequencer-related events are prepended with **AppV\_Sequencer**. Client-related events are prepended with **AppV\_Client**. - -In App-V 5.0 SP3, some logs have been consolidated. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - -## Other resources for deploying the Sequencer and client - - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[Planning for App-V 5.0](planning-for-app-v-50-rc.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-the-app-v-50-server.md b/mdop/appv-v5/deploying-the-app-v-50-server.md deleted file mode 100644 index a9c5cecc6e..0000000000 --- a/mdop/appv-v5/deploying-the-app-v-50-server.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Deploying the App-V 5.0 Server -description: Deploying the App-V 5.0 Server -author: dansimp -ms.assetid: a47f0dc8-2971-4e4d-8d57-6b69bbed4b63 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the App-V 5.0 Server - - -You can install the App-V 5.0 server features by using different deployment configurations, which described in this topic. Before you install the server features, review the server section of [App-V 5.0 Security Considerations](app-v-50-security-considerations.md). - -For information about deploying the App-V 5.0 SP3 Server, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-migrate-to-50sp3). - -**Important**   -Before you install and configure the App-V 5.0 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. - - - -## App-V 5.0 Server overview - - -The App-V 5.0 Server is made up of five components. Each component serves a different purpose within the App-V 5.0 environment. Each of the five components is briefly described here: - -- Management Server – provides overall management functionality for the App-V 5.0 infrastructure. - -- Management Database – facilitates database predeployments for App-V 5.0 management. - -- Publishing Server – provides hosting and streaming functionality for virtual applications. - -- Reporting Server – provides App-V 5.0 reporting services. - -- Reporting Database – facilitates database predeployments for App-V 5.0 reporting. - -## App-V 5.0 stand-alone deployment - - -The App-V 5.0 standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are deployed to a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V 5.0 components. Therefore, you should not use this topology for larger deployments. - -[How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) - -[How to Deploy the App-V 5.0 Server Using a Script](how-to-deploy-the-app-v-50-server-using-a-script.md) - -## App-V 5.0 Server distributed deployment - - -The distributed deployment topology can support a large App-V 5.0 client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V 5.0 Server components are deployed across multiple computers, based on the structure and requirements of the organization. - -[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md) - -[How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md) - -[How to Deploy the App-V 5.0 Server Using a Script](how-to-deploy-the-app-v-50-server-using-a-script.md) - -[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer.md) - -[How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md) - -## Using an Enterprise Software Distribution (ESD) solution and App-V 5.0 - - -You can also deploy the App-V 5.0 clients and packages by using an ESD without having to deploy App-V 5.0. The full capabilities for integration will vary depending on the ESD that you use. - -**Note**   -The App-V 5.0 reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V 5.0 clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality. - - - -[Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md) - -## App-V 5.0 Server logs - - -You can use App-V 5.0 server log information to help troubleshoot the server installation and operational events while using App-V 5.0. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V** - -Associated setup logs are saved in the following directory: - -**%temp%** - -In App-V 5.0 SP3, some logs have been consolidated and moved. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - -## App-V 5.0 reporting - - -App-V 5.0 reporting allows App-V 5.0 clients to collect data and then send it back to be stored in a central repository. You can use this information to get a better view of the virtual application usage within your organization. The following list displays some of the types of information the App-V 5.0 client collects: - -- Information about the computer that runs the App-V 5.0 client. - -- Information about virtualized packages on a specific computer that runs the App-V 5.0 client. - -- Information about package open and shutdown for a specific user. - -The reporting information will be maintained until it is successfully sent to the reporting server database. After the data is in the database, you can use Microsoft SQL Server Reporting Services to generate any necessary reports. - -If you want to retrieve report information, you must use Microsoft SQL Server Reporting Services (SSRS) which is available with Microsoft SQL. SSRS is not installed when you install the App-V 5.0 reporting server and it must be deployed separately to generate the associated reports. - -Use the following link for more information [About App-V 5.0 Reporting](about-app-v-50-reporting.md). - -[How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) - -## Other resources for the App-V server - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md b/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md deleted file mode 100644 index 0811cc8ca8..0000000000 --- a/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Deploying the App-V 5.1 Sequencer and Client -description: Deploying the App-V 5.1 Sequencer and Client -author: dansimp -ms.assetid: 74f32794-4c76-436f-a542-f9e95d89063d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Deploying the App-V 5.1 Sequencer and Client - - -The Microsoft Application Virtualization (App-V) 5.1 Sequencer and client enable administrators to virtualize and run virtualized applications. - -## Deploy the client - - -The App-V 5.1 client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and to double-click file types, so that they can start a virtualized application. The client can also obtain the virtual application content from the management server. - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) - -[How to Uninstall the App-V 5.1 Client](how-to-uninstall-the-app-v-51-client.md) - -[How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md) - -## Client Configuration Settings - - -The App-V 5.1 client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. - -[About Client Configuration Settings](about-client-configuration-settings51.md) - -## Configure the client by using the ADMX template and Group Policy - - -You can use the Microsoft ADMX template to configure the client settings for the App-V 5.1 client and the Remote Desktop Services client. The ADMX template manages common client configurations by using an existing Group Policy infrastructure and it includes settings for the App-V 5.1 client configuration. - -**Important**   -You can obtain the App-V 5.1 ADMX template from the Microsoft Download Center. - - - -After you download and install the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller. - -1. Save the **.admx** file to the following directory: **Windows \\ PolicyDefinitions** - -2. Save the **.adml** file to the following directory: **Windows \\ PolicyDefinitions \\ <Language Directory>** - -After you have completed the preceding steps, you can manage the App-V 5.1 client configuration settings with the **Group Policy Management** console. - -The App-V 5.1 client also stores its configuration in the registry. You can gather some useful information about the client if you understand the format of the data in the registry. You can also configure many client actions by changing registry entries. - -[How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md) - -## Deploy the client by using the Shared Content Store mode - - -The App-V 5.1 Shared Content Store (SCS) mode enables the SCS App-V 5.1 clients to run virtualized applications without saving any of the associated package data locally. All required virtualized package data is transmitted across the network; therefore, you should only use the SCS mode in environments with a fast connection. Both the Remote Desktop Services (RDS) and the standard version of the App-V 5.1 client are supported with SCS mode. - -**Important**   -If the App-V 5.1 client is configured to run in the SCS mode, the location where the App-V 5.1 packages are streamed from must be available, otherwise, the virtualized package will fail. Additionally, we do not recommend deployment of virtualized applications to computers that run the App-V 5.1 client in the SCS mode across the internet. - - - -Additionally, the SCS is not a physical location that contains virtualized packages. It is a mode that allows the App-V 5.1 client to stream the required virtualized package data across the network. - -The SCS mode is helpful in the following scenarios: - -- Virtual desktop infrastructure (VDI) deployments - -- Remote desktop services (RDS) deployments - -To use SCS in your environment, you must enable the App-V 5.1 client to run in SCS mode. This setting should be specified during installation. By default, the client is not configured to use SCS mode. You should install the client by using the suggested procedure if you plan to use SCS. However, you can configure an existing App-V 5.1 client to run in SCS mode by entering the following PowerShell command on the computer that runs the App-V 5.1 client: - -**set-AppvClientConfiguration -SharedContentStoreMode 1** - -There might be cases when the administrator pre-loads some virtual applications on the computer that runs the App-V 5.1 client in SCS mode. This can be accomplished with PowerShell commands to add, publish, and mount the package. For example, if a package is pre-loaded on all computers, the administrator could add, publish, and mount the package by using PowerShell commands. The package would not stream across the network because it would be locally stored. - -[How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md) - -## Deploy the Sequencer - - -The Sequencer is a tool that is used to convert standard applications into virtual packages for deployment to computers that run the App-V 5.1 client. The Sequencer helps provide a simple and predictable conversion process with minimal changes to prior sequencing workflows. In addition, the Sequencer allows users to more easily configure applications to enable connections of virtualized applications. - -For a list of changes in the App-V 5.1 Sequencer, see [About App-V 5.1](about-app-v-51.md). - -[How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md) - -## App-V 5.1 Client and Sequencer logs - - -You can use the App-V 5.1 Sequencer log information to help troubleshoot the Sequencer installation and operational events while using App-V 5.1. The Sequencer-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Sequencer-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V**. Sequencer-related events are prepended with **AppV\_Sequencer**. Client-related events are prepended with **AppV\_Client**. - -## Other resources for deploying the Sequencer and client - - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[Planning for App-V 5.1](planning-for-app-v-51.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/deploying-the-app-v-51-server.md b/mdop/appv-v5/deploying-the-app-v-51-server.md deleted file mode 100644 index 10380a684e..0000000000 --- a/mdop/appv-v5/deploying-the-app-v-51-server.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Deploying the App-V 5.1 Server -description: Deploying the App-V 5.1 Server -author: dansimp -ms.assetid: 987b61dc-00d6-49ba-8f1b-92d7b948e702 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the App-V 5.1 Server - - -You can install the Microsoft Application Virtualization (App-V) 5.1 server features by using different deployment configurations, which described in this topic. Before you install the server features, review the server section of [App-V 5.1 Security Considerations](app-v-51-security-considerations.md). - -For information about deploying the App-V Server, see [About App-V 5.1](about-app-v-51.md#bkmk-migrate-to-51). - -**Important**   -Before you install and configure the App-V 5.1 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings. - - - -## App-V 5.1 Server overview - - -The App-V 5.1 Server is made up of five components. Each component serves a different purpose within the App-V 5.1 environment. Each of the five components is briefly described here: - -- Management Server – provides overall management functionality for the App-V 5.1 infrastructure. - -- Management Database – facilitates database predeployments for App-V 5.1 management. - -- Publishing Server – provides hosting and streaming functionality for virtual applications. - -- Reporting Server – provides App-V 5.1 reporting services. - -- Reporting Database – facilitates database predeployments for App-V 5.1 reporting. - -## App-V 5.1 stand-alone deployment - - -The App-V 5.1 standalone deployment provides a good topology for a small deployment or a test environment. When you use this type of implementation, all server components are deployed to a single computer. The services and associated databases will compete for the resources on the computer that runs the App-V 5.1 components. Therefore, you should not use this topology for larger deployments. - -[How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md) - -[How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md) - -## App-V 5.1 Server distributed deployment - - -The distributed deployment topology can support a large App-V 5.1 client base and it allows you to more easily manage and scale your environment. When you use this type of deployment, the App-V 5.1 Server components are deployed across multiple computers, based on the structure and requirements of the organization. - -[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md) - -[How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) - -[How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md) - -[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer51.md) - -[How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md) - -## Using an Enterprise Software Distribution (ESD) solution and App-V 5.1 - - -You can also deploy the App-V 5.1 clients and packages by using an ESD without having to deploy App-V 5.1. The full capabilities for integration will vary depending on the ESD that you use. - -**Note**   -The App-V 5.1 reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V 5.1 clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality. - - - -[Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md) - -## App-V 5.1 Server logs - - -You can use App-V 5.1 server log information to help troubleshoot the server installation and operational events while using App-V 5.1. The server-related log information can be reviewed with the **Event Viewer**. The following line displays the specific path for Server-related events: - -**Event Viewer \\ Applications and Services Logs \\ Microsoft \\ App V** - -Associated setup logs are saved in the following directory: - -**%temp%** - -In App-V 5.0 SP3, some logs were consolidated and moved. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved). - -## App-V 5.1 reporting - - -App-V 5.1 reporting allows App-V 5.1 clients to collect data and then send it back to be stored in a central repository. You can use this information to get a better view of the virtual application usage within your organization. The following list displays some of the types of information the App-V 5.1 client collects: - -- Information about the computer that runs the App-V 5.1 client. - -- Information about virtualized packages on a specific computer that runs the App-V 5.1 client. - -- Information about package open and shutdown for a specific user. - -The reporting information will be maintained until it is successfully sent to the reporting server database. After the data is in the database, you can use Microsoft SQL Server Reporting Services to generate any necessary reports. - -If you want to retrieve report information, you must use Microsoft SQL Server Reporting Services (SSRS) which is available with Microsoft SQL. SSRS is not installed when you install the App-V 5.1 reporting server and it must be deployed separately to generate the associated reports. - -Use the following link for more information [About App-V 5.1 Reporting](about-app-v-51-reporting.md). - -[How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md) - -## Other resources for the App-V server - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/evaluating-app-v-50.md b/mdop/appv-v5/evaluating-app-v-50.md deleted file mode 100644 index 1b2cc2ac24..0000000000 --- a/mdop/appv-v5/evaluating-app-v-50.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Evaluating App-V 5.0 -description: Evaluating App-V 5.0 -author: dansimp -ms.assetid: 0b4a6b12-559d-429f-9659-dc8f4883feab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Evaluating App-V 5.0 - - -Before you deploy Microsoft Application Virtualization (App-V) 5.0 into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V 5.0 in a lab environment for evaluation purposes only. - -## Configure lab computers for App-V 5.0 Evaluation - - -Use the following link for information about setting up the App-V 5.0 sequencer on a computer in your lab environment. - -### Installing the App-V 5.0 Sequencer and Creating Packages - -Use the following links for information about setting up the App-V 5.0 sequencer and creating packages in your lab environment. - -- [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md) - -- [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md) - -### Configuring the App-V 5.0 Server - -Use the following links for information about setting up the App-V 5.0 server in your lab environment. - -- [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) - -- [Administering App-V 5.0 Virtual Applications by Using the Management Console](administering-app-v-50-virtual-applications-by-using-the-management-console.md) - -### Installing the App-V 5.0 Client - -Use the following link for more information about creating and managing virtualized packages in your lab environment. - -- [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md) - - - - - - -## Related topics - - -[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/evaluating-app-v-51.md b/mdop/appv-v5/evaluating-app-v-51.md deleted file mode 100644 index 84facb34f4..0000000000 --- a/mdop/appv-v5/evaluating-app-v-51.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Evaluating App-V 5.1 -description: Evaluating App-V 5.1 -author: dansimp -ms.assetid: 92d80b23-3eca-4be3-a771-e700ad1470db -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Evaluating App-V 5.1 - - -Before you deploy Microsoft Application Virtualization (App-V) 5.1 into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V 5.1 in a lab environment for evaluation purposes only. - -## Configure lab computers for App-V 5.1 Evaluation - - -Use the following link for information about setting up the App-V 5.1 sequencer on a computer in your lab environment. - -### Installing the App-V 5.1 Sequencer and Creating Packages - -Use the following links for information about setting up the App-V 5.1 sequencer and creating packages in your lab environment. - -- [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md) - -- [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md) - -### Configuring the App-V 5.1 Server - -Use the following links for information about setting up the App-V 5.1 server in your lab environment. - -- [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md) - -- [Administering App-V 5.1 Virtual Applications by Using the Management Console](administering-app-v-51-virtual-applications-by-using-the-management-console.md) - -### Installing the App-V 5.1 Client - -Use the following link for more information about creating and managing virtualized packages in your lab environment. - -- [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) - -- [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md) - - - - - - -## Related topics - - -[Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/getting-started-with-app-v-50--rtm.md b/mdop/appv-v5/getting-started-with-app-v-50--rtm.md deleted file mode 100644 index 861662bca5..0000000000 --- a/mdop/appv-v5/getting-started-with-app-v-50--rtm.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Getting Started with App-V 5.0 -description: Getting Started with App-V 5.0 -author: dansimp -ms.assetid: 3e16eafb-ce95-4d06-b214-fe0f4b1b495f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with App-V 5.0 - - -App-V 5.0 enables administrators to deploy, update, and support applications as services in real time, on an as-needed basis. Individual applications are transformed from locally installed products into centrally managed services and are available wherever you need, without the need to preconfigure computers or to change operating system settings. - -App-V consists of the following elements: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ElementDescription

    App-V Management Server

      -
    • Provides a central location for managing the App-V infrastructure, which delivers virtual applications to both the App-V Desktop Client and the Remote Desktop Services (formerly Terminal Services) Client.

    • -
    • Uses Microsoft SQL Server® for its data store, where one or more App-V Management servers can share a single SQL Server data store.

    • -
    • Authenticates requests and provides security, metering, monitoring, and data gathering. The server uses Active Directory and supporting tools to manage users and applications.

    • -
    • Has a Silverlight®-based management site, which enables you to configure the App-V infrastructure from any computer. You can add and remove applications, manipulate shortcuts, assign access permissions to users and groups, and create connection groups.

    • -
    • Enables communication between the App-V Web Management Console and the SQL Server data store. These components can all be installed on a single server computer, or on one or more separate computers, depending on the required system architecture.

    • -

    App-V Publishing Server

      -
    • Provides App-V Clients with entitled applications for the specific user

    • -
    • Hosts the virtual application package for streaming.

    • -

    App-V Desktop Client

      -
    • Retrieves virtual applications

    • -
    • Publishes the applications on the clients

    • -
    • Automatically sets up and manages virtual environments at runtime on Windows endpoints.

    • -
    • Stores user-specific virtual application settings, such as registry and file changes, in each user's profile.

    • -

    App-V Remote Desktop Services (RDS) Client

    Enables Remote Desktop Session Host servers to use the capabilities of the App-V Desktop Client for shared desktop sessions.

    App-V Sequencer

      -
    • Is a wizard-based tool that you use to transform traditional applications into virtual applications.

    • -
    • Produces the application “package,” which consists of:

      -
        -
      1. a sequenced application (APPV) file

      2. -
      3. a Windows Installer file (MSI) that can be deployed to clients configured for stand-alone operation

      4. -
      5. Several XML files including Report.XML, PackageName_DeploymentConfig.XML, and PackageName_UserConfig.XML. The UserConfig and DeploymentConfig XML files are used to configure custom changes to the default behavior of the package.

      6. -
    • -
    - - - -For more information about these elements, see [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md). - -If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -**Note**   -A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at (https://go.microsoft.com/fwlink/?LinkId=272491). - - - -This section of the App-V 5.0 Administrator’s Guide includes high-level information about App-V 5.0 to provide you with a basic understanding of the product before you begin the deployment planning. - -## Getting started with App-V 5.0 - - -- [About App-V 5.0](about-app-v-50.md) - - Provides a high-level overview of App-V 5.0 and how it can be used in your organization. - -- [About App-V 5.0 SP1](about-app-v-50-sp1.md) - - Provides a high-level overview of App-V 5.0 SP1 and how it can be used in your organization. - -- [About App-V 5.0 SP2](about-app-v-50-sp2.md) - - Provides a high-level overview of App-V 5.0 SP2 and how it can be used in your organization. - -- [About App-V 5.0 SP3](about-app-v-50-sp3.md) - - Provides a high-level overview of App-V 5.0 SP2 and how it can be used in your organization. - -- [Evaluating App-V 5.0](evaluating-app-v-50.md) - - Provides information about how you can best evaluate App-V 5.0 for use in your organization. - -- [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md) - - Provides a description of the App-V 5.0 features and how they work together. - -- [Accessibility for App-V 5.0](accessibility-for-app-v-50.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Other resources for this product - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -- [Deploying App-V 5.0](deploying-app-v-50.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/getting-started-with-app-v-51.md b/mdop/appv-v5/getting-started-with-app-v-51.md deleted file mode 100644 index f508e2c3a6..0000000000 --- a/mdop/appv-v5/getting-started-with-app-v-51.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Getting Started with App-V 5.1 -description: Getting Started with App-V 5.1 -author: dansimp -ms.assetid: 49a20e1f-0566-4e53-a417-1521393fc974 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with App-V 5.1 - - -Microsoft Application Virtualization (App-V) 5.1 enables administrators to deploy, update, and support applications as services in real time, on an as-needed basis. Individual applications are transformed from locally installed products into centrally managed services and are available wherever you need, without the need to preconfigure computers or to change operating system settings. - -App-V consists of the following elements: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ElementDescription

    App-V Management Server

      -
    • Provides a central location for managing the App-V infrastructure, which delivers virtual applications to both the App-V Desktop Client and the Remote Desktop Services (formerly Terminal Services) Client.

    • -
    • Uses Microsoft SQL Server® for its data store, where one or more App-V Management servers can share a single SQL Server data store.

    • -
    • Authenticates requests and provides security, metering, monitoring, and data gathering. The server uses Active Directory and supporting tools to manage users and applications.

    • -
    • Has a management site that lets you configure the App-V infrastructure from any computer. You can add and remove applications, manipulate shortcuts, assign access permissions to users and groups, and create connection groups.

    • -
    • Enables communication between the App-V Web Management Console and the SQL Server data store. These components can all be installed on a single server computer, or on one or more separate computers, depending on the required system architecture.

    • -

    App-V Publishing Server

      -
    • Provides App-V Clients with entitled applications for the specific user

    • -
    • Hosts the virtual application package for streaming.

    • -

    App-V Desktop Client

      -
    • Retrieves virtual applications

    • -
    • Publishes the applications on the clients

    • -
    • Automatically sets up and manages virtual environments at runtime on Windows endpoints.

    • -
    • Stores user-specific virtual application settings, such as registry and file changes, in each user's profile.

    • -

    App-V Remote Desktop Services (RDS) Client

    Enables Remote Desktop Session Host servers to use the capabilities of the App-V Desktop Client for shared desktop sessions.

    App-V Sequencer

      -
    • Is a wizard-based tool that you use to transform traditional applications into virtual applications.

    • -
    • Produces the application “package,” which consists of:

      -
        -
      1. a sequenced application (APPV) file

      2. -
      3. a Windows Installer file (MSI) that can be deployed to clients configured for stand-alone operation

      4. -
      5. Several XML files including Report.XML, PackageName_DeploymentConfig.XML, and PackageName_UserConfig.XML. The UserConfig and DeploymentConfig XML files are used to configure custom changes to the default behavior of the package.

      6. -
    • -
    - - - -For more information about these elements, see [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md). - -If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -**Note**   -A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at (https://go.microsoft.com/fwlink/?LinkId=272491). - - - -This section of the App-V 5.1 Administrator’s Guide includes high-level information about App-V 5.1 to provide you with a basic understanding of the product before you begin the deployment planning. - -## Getting started with App-V 5.1 - - -- [About App-V 5.1](about-app-v-51.md) - - Provides a high-level overview of App-V 5.1 and how it can be used in your organization. - -- [Evaluating App-V 5.1](evaluating-app-v-51.md) - - Provides information about how you can best evaluate App-V 5.1 for use in your organization. - -- [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md) - - Provides a description of the App-V 5.1 features and how they work together. - -- [Accessibility for App-V 5.1](accessibility-for-app-v-51.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Other resources for this product - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Deploying App-V 5.1](deploying-app-v-51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) - -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/high-level-architecture-for-app-v-50.md b/mdop/appv-v5/high-level-architecture-for-app-v-50.md deleted file mode 100644 index e23df5f0a1..0000000000 --- a/mdop/appv-v5/high-level-architecture-for-app-v-50.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: High Level Architecture for App-V 5.0 -description: High Level Architecture for App-V 5.0 -author: dansimp -ms.assetid: fdf8b841-918f-4672-b352-0f2b9519581b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High Level Architecture for App-V 5.0 - - -Use the following information to help you simplify you Microsoft Application Virtualization (App-V) 5.0 deployment. - -## Architecture Overview - - -A typical App-V 5.0 implementation consists of the following elements. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ElementMore information

    App-V 5.0 Management Server

    The App-V 5.0 Management server provides overall management functionality for the App-V 5.0 infrastructure. Additionally, you can install more than one instance of the management server in your environment which provides the following benefits:

    -
      -
    • Fault Tolerance and High Availability – Installing and configuring the App-V 5.0 Management server on two separate computers can help in situations when one of the servers is unavailable or offline.

      -

      You can also help increase App-V 5.0 availability by installing the Management server on multiple computers. In this scenario, a network load balancer should also be considered so that server requests are balanced.

    • -
    • Scalability – You can add additional management servers as necessary to support a high load, for example you can install multiple servers behind a load balancer.

    • -

    App-V 5.0 Publishing Server

    The App-V 5.0 publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports the following protocols:

    -
      -
    • HTTP, and HTTPS

    • -
    -

    You can also help increase App-V 5.0 availability by installing the Publishing server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

    App-V 5.0 Reporting Server

    The App-V 5.0 Reporting server enables authorized users to run and view existing App-V 5.0 reports and ad hoc reports that can help them manage the App-V 5.0 infrastructure. The Reporting server requires a connection to the App-V 5.0 reporting database. You can also help increase App-V 5.0 availability by installing the Reporting server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

    App-V 5.0 Client

    The App-V 5.0 client enables packages created using App-V 5.0 to run on target computers.

    - - - -**Note**   -If you are using App-V 5.0 with Electronic Software Distribution (ESD) you are not required to use the App-V 5.0 Management server, however you can still utilize the reporting and streaming functionality of App-V 5.0. - - - - - - - - -## Related topics - - -[Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - - - - - - - - - diff --git a/mdop/appv-v5/high-level-architecture-for-app-v-51.md b/mdop/appv-v5/high-level-architecture-for-app-v-51.md deleted file mode 100644 index af616233b3..0000000000 --- a/mdop/appv-v5/high-level-architecture-for-app-v-51.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: High Level Architecture for App-V 5.1 -description: High Level Architecture for App-V 5.1 -author: dansimp -ms.assetid: 90406361-55b8-40b7-85c0-449436789d4c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High Level Architecture for App-V 5.1 - - -Use the following information to help you simplify you Microsoft Application Virtualization (App-V) 5.1 deployment. - -## Architecture Overview - - -A typical App-V 5.1 implementation consists of the following elements. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ElementMore information

    App-V 5.1 Management Server

    The App-V 5.1 Management server provides overall management functionality for the App-V 5.1 infrastructure. Additionally, you can install more than one instance of the management server in your environment which provides the following benefits:

    -
      -
    • Fault Tolerance and High Availability – Installing and configuring the App-V 5.1 Management server on two separate computers can help in situations when one of the servers is unavailable or offline.

      -

      You can also help increase App-V 5.1 availability by installing the Management server on multiple computers. In this scenario, a network load balancer should also be considered so that server requests are balanced.

    • -
    • Scalability – You can add additional management servers as necessary to support a high load, for example you can install multiple servers behind a load balancer.

    • -

    App-V 5.1 Publishing Server

    The App-V 5.1 publishing server provides functionality for virtual application hosting and streaming. The publishing server does not require a database connection and supports the following protocols:

    -
      -
    • HTTP, and HTTPS

    • -
    -

    You can also help increase App-V 5.1 availability by installing the Publishing server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

    App-V 5.1 Reporting Server

    The App-V 5.1 Reporting server enables authorized users to run and view existing App-V 5.1 reports and ad hoc reports that can help them manage the App-V 5.1 infrastructure. The Reporting server requires a connection to the App-V 5.1 reporting database. You can also help increase App-V 5.1 availability by installing the Reporting server on multiple computers. A network load balancer should also be considered so that server requests are balanced.

    App-V 5.1 Client

    The App-V 5.1 client enables packages created using App-V 5.1 to run on target computers.

    - - - -**Note**   -If you are using App-V 5.1 with Electronic Software Distribution (ESD) you are not required to use the App-V 5.1 Management server, however you can still utilize the reporting and streaming functionality of App-V 5.1. - - - - - - - - -## Related topics - - -[Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-access-the-client-management-console.md b/mdop/appv-v5/how-to-access-the-client-management-console.md deleted file mode 100644 index 90164220e0..0000000000 --- a/mdop/appv-v5/how-to-access-the-client-management-console.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Access the Client Management Console -description: How to Access the Client Management Console -author: dansimp -ms.assetid: 3f6303c7-f953-4623-8211-c20d1faa846b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Access the Client Management Console - - -Use the App-V 5.0 client management console to manage packages on the computer running the App-V 5.0 client. - -**Note**   -To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V 5.0 client. - - - -Use the following procedure to access the client management console. - -**To access the client management console** - -1. On the computer running the App-V 5.0 client, click **Start** and select **Microsoft Application Virtualization Client**. - - **Note**   - For computers running the App-V 5.0 Remote Desktop Services client version, to access client management console follow step 1 of this procedure on the server running the client. - - - -2. When the App-V 5.0 client management console is displayed, click the tab you want to review and perform any required tasks. For more information about the client management console tasks see, [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-access-the-client-management-console51.md b/mdop/appv-v5/how-to-access-the-client-management-console51.md deleted file mode 100644 index e98a45a0a3..0000000000 --- a/mdop/appv-v5/how-to-access-the-client-management-console51.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Access the Client Management Console -description: How to Access the Client Management Console -author: dansimp -ms.assetid: 22131251-acd5-44e7-a30b-7d389c518b6f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Access the Client Management Console - - -Use the App-V 5.1 client management console to manage packages on the computer running the App-V 5.1 client. - -**Note**   -To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V 5.1 client. - - - -Use the following procedure to access the client management console. - -**To access the client management console** - -1. On the computer running the App-V 5.1 client, click **Start** and select **Microsoft Application Virtualization Client**. - - **Note**   - For computers running the App-V 5.1 Remote Desktop Services client version, to access client management console follow step 1 of this procedure on the server running the client. - - - -2. When the App-V 5.1 client management console is displayed, click the tab you want to review and perform any required tasks. For more information about the client management console tasks see, [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md b/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md deleted file mode 100644 index 7f2daaca8d..0000000000 --- a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Add or Remove an Administrator by Using the Management Console -description: How to Add or Remove an Administrator by Using the Management Console -author: dansimp -ms.assetid: 0e8ab443-1931-4b1a-95df-6ccbecc9efc5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add or Remove an Administrator by Using the Management Console - - -Use the following procedures to add or remove an administrator on the App-V 5.0 server. - -**To add an administrator using the Management Console** - -1. Open the App-V 5.0 Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of Access Directory (AD) users and groups that currently have administrative access to the App-V 5.0 server. - -2. To add a new administrator, click **Add Administrator** Type the name of the administrator that you want to add in the **Active Directory Name** field. Ensure you provide the associated user account domain name. For example, **Domain** \\ **UserName**. - -3. Select the account that you want to add and click **Add**. The new account is displayed in the list of server administrators. - -**To remove an administrator using the Management Console** - -1. Open the App-V 5.0 Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the App-V 5.0 server. - -2. Right-click the account to be removed from the list of administrators and select **Remove**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md b/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md deleted file mode 100644 index e4d9c802e9..0000000000 --- a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Add or Remove an Administrator by Using the Management Console -description: How to Add or Remove an Administrator by Using the Management Console -author: dansimp -ms.assetid: 7ff8c436-9d2e-446a-9ea2-bbab7e25bf21 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add or Remove an Administrator by Using the Management Console - - -Use the following procedures to add or remove an administrator on the Microsoft Application Virtualization (App-V) 5.1 server. - -**To add an administrator using the Management Console** - -1. Open the Microsoft Application Virtualization (App-V) 5.1 Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of Access Directory (AD) users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) 5.1 server. - -2. To add a new administrator, click **Add Administrator** Type the name of the administrator that you want to add in the **Active Directory Name** field. Ensure you provide the associated user account domain name. For example, **Domain** \\ **UserName**. - -3. Select the account that you want to add and click **Add**. The new account is displayed in the list of server administrators. - -**To remove an administrator using the Management Console** - -1. Open the Microsoft Application Virtualization (App-V) 5.1 Management Console and click **Administrators** in the navigation pane. The navigation pane displays a list of AD users and groups that currently have administrative access to the Microsoft Application Virtualization (App-V) 5.1 server. - -2. Right-click the account to be removed from the list of administrators and select **Remove**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md b/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md deleted file mode 100644 index 0d643c8054..0000000000 --- a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Add or Upgrade Packages by Using the Management Console -description: How to Add or Upgrade Packages by Using the Management Console -author: dansimp -ms.assetid: 62417b63-06b2-437c-8584-523e1dea97c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add or Upgrade Packages by Using the Management Console - - -You can the following procedure to add or upgrade a package to the App-V 5.1 Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. - -**To add a package to the Management Console** - -1. Click the **Packages** tab in the navigation pane of the Management Console display. - - The console displays the list of packages that have been added to the server along with status information about each package. When a package is selected, detailed information about the package is displayed in the **PACKAGES** pane. - - Click the **Ungrouped** drop-down list box and specify how the packages are to be displayed in the console. You can also click the associated column header to sort the packages. - -2. To specify the package you want to add, click **Add or Upgrade Packages**. - -3. Type the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then click **Add**. - - **Important**   - You must select a package with the **.appv** file name extension. - - - -4. The page displays the status message **Adding <Packagename>**. Click **IMPORT STATUS** to check the status of a package that you have imported. - - Click **OK** to add the package and close the **Add Package** page. If there was an error during the import, click **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. - -5. Click **Close** to close the **Add or Upgrade Packages** page. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md b/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md deleted file mode 100644 index ac3caca510..0000000000 --- a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Add or Upgrade Packages by Using the Management Console -description: How to Add or Upgrade Packages by Using the Management Console -author: dansimp -ms.assetid: 4e389d7e-f402-44a7-bc4c-42c2a8440573 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Add or Upgrade Packages by Using the Management Console - - -You can the following procedure to add or upgrade a package to the App-V 5.0 Management Console. To upgrade a package that already exists in the Management Console, use the following steps and import the upgraded package using the same package **Name**. - -**To add a package to the Management Console** - -1. Click the **Packages** tab in the navigation pane of the Management Console display. - - The console displays the list of packages that have been added to the server along with status information about each package. When a package is selected, detailed information about the package is displayed in the **PACKAGES** pane. - - Click the **Ungrouped** drop-down list box and specify how the packages are to be displayed in the console. You can also click the associated column header to sort the packages. - -2. To specify the package you want to add, click **Add or Upgrade Packages**. - -3. Type the full path to the package that you want to add. Use the UNC or HTTP path format, for example **\\\\servername\\sharename\\foldername\\packagename.appv** or **http://server.1234/file.appv**, and then click **Add**. - - **Important**   - You must select a package with the **.appv** file name extension. - - - -4. The page displays the status message **Adding <Packagename>**. Click **IMPORT STATUS** to check the status of a package that you have imported. - - Click **OK** to add the package and close the **Add Package** page. If there was an error during the import, click **Detail** on the **Package Import** page for more information. The newly added package is now available in the **PACKAGES** pane. - -5. Click **Close** to close the **Add or Upgrade Packages** page. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md b/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md deleted file mode 100644 index ac99282ee1..0000000000 --- a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Allow Only Administrators to Enable Connection Groups -description: How to Allow Only Administrators to Enable Connection Groups -author: dansimp -ms.assetid: 60e62426-624f-4f26-851e-41cd78520883 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Allow Only Administrators to Enable Connection Groups - - -You can configure the App-V client so that only administrators (not end users) can enable or disable connection groups. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - - - -Use one of the following methods to allow only administrators to enable or disable connection groups. - - ---- - - - - - - - - - - - - - - - - -
    MethodSteps

    Group Policy setting

    Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

    -

    Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing

    PowerShell cmdlet

    Run the Set-AppvClientConfiguration cmdlet with the –RequirePublishAsAdmin parameter.

    -

    Parameter values:

    -
      -
    • 0 - False

    • -
    • 1 - True

    • -
    -

    Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

    - - - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md b/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md deleted file mode 100644 index 1a6a35f007..0000000000 --- a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Allow Only Administrators to Enable Connection Groups -description: How to Allow Only Administrators to Enable Connection Groups -author: dansimp -ms.assetid: 42ca3157-5d85-467b-a148-09404f8f737a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Allow Only Administrators to Enable Connection Groups - - -You can configure the App-V client so that only administrators (not end users) can enable or disable connection groups. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - - - -Use one of the following methods to allow only administrators to enable or disable connection groups. - - ---- - - - - - - - - - - - - - - - - -
    MethodSteps

    Group Policy setting

    Enable the “Require publish as administrator” Group Policy setting, which is located in the following Group Policy Object node:

    -

    Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing

    PowerShell cmdlet

    Run the Set-AppvClientConfiguration cmdlet with the –RequirePublishAsAdmin parameter.

    -

    Parameter values:

    -
      -
    • 0 - False

    • -
    • 1 - True

    • -
    -

    Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

    - - - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md b/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md deleted file mode 100644 index 3f0b9b7a68..0000000000 --- a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Apply the Deployment Configuration File by Using PowerShell -description: How to Apply the Deployment Configuration File by Using PowerShell -author: dansimp -ms.assetid: 5df5d5bc-6c72-4087-8b93-d6d4b502a1f4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply the Deployment Configuration File by Using PowerShell - - -The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V 5.0 client before the package has been published. The file configures the default settings for package for all users on the computer running the App-V 5.0 client. This section describes the steps used to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: - -**c:\\Packages\\Contoso\\MyApp.appv** - -**c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - -**To Apply the Deployment Configuration File Using PowerShell** - -- To specify a new default set of configurations for all users who will run the package on a specific computer, using a PowerShell console type the following: - - **Add-AppVClientPackage –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - - **Note** - This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - - **Set-AppVClientPackage –Name Myapp –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md b/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md deleted file mode 100644 index dac9fedce1..0000000000 --- a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Apply the Deployment Configuration File by Using PowerShell -description: How to Apply the Deployment Configuration File by Using PowerShell -author: dansimp -ms.assetid: 78fe0f15-4a36-41e3-96d6-7d5aa77c1e06 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply the Deployment Configuration File by Using PowerShell - - -The dynamic deployment configuration file is applied when a package is added or set to a computer running the App-V 5.1 client before the package has been published. The file configures the default settings for package for all users on the computer running the App-V 5.1 client. This section describes the steps used to use a deployment configuration file. The procedure is based on the following example and assumes the following package and configuration files exist on a computer: - -**c:\\Packages\\Contoso\\MyApp.appv** - -**c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - -**To Apply the Deployment Configuration File Using PowerShell** - -- To specify a new default set of configurations for all users who will run the package on a specific computer, using a PowerShell console type the following: - - **Add-AppVClientPackage –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - - **Note** - This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document: - - **Set-AppVClientPackage –Name Myapp –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml** - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md b/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md deleted file mode 100644 index bf8e5bc775..0000000000 --- a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Apply the User Configuration File by Using PowerShell -description: How to Apply the User Configuration File by Using PowerShell -author: dansimp -ms.assetid: f7d7c595-4fdd-4096-b53d-9eead111c339 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply the User Configuration File by Using PowerShell - - -The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. - -Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: - -**c:\\Packages\\Contoso\\MyApp.appv** - -**To apply a user Configuration file** - -1. To add the package to the computer using the PowerShell console type the following command: - - **Add-AppVClientPackage c:\\Packages\\Contoso\\MyApp.appv**. - -2. Use the following command to publish the package to the user and specify the updated the dynamic user configuration file: - - **Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath c:\\Packages\\Contoso\\config.xml** - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md b/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md deleted file mode 100644 index 9ef045bf7b..0000000000 --- a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Apply the User Configuration File by Using PowerShell -description: How to Apply the User Configuration File by Using PowerShell -author: dansimp -ms.assetid: 986e638c-4a0c-4a7e-be73-f4615e8b8000 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply the User Configuration File by Using PowerShell - - -The dynamic user configuration file is applied when a package is published to a specific user and determines how the package will run. - -Use the following procedure to specify a user-specific configuration file. The following procedure is based on the example: - -**c:\\Packages\\Contoso\\MyApp.appv** - -**To apply a user Configuration file** - -1. To add the package to the computer using the PowerShell console type the following command: - - **Add-AppVClientPackage c:\\Packages\\Contoso\\MyApp.appv**. - -2. Use the following command to publish the package to the user and specify the updated the dynamic user configuration file: - - **Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath c:\\Packages\\Contoso\\config.xml** - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md b/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md deleted file mode 100644 index b09260f550..0000000000 --- a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Configure Access to Packages by Using the Management Console -description: How to Configure Access to Packages by Using the Management Console -author: dansimp -ms.assetid: 8f4c91e4-f4e6-48cf-aa94-6085a054e8f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Access to Packages by Using the Management Console - - -Before you deploy an App-V 5.0 virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. - -Use the following procedure to configure access to virtualized packages. - -**To grant access to an App-V 5.0 package** - -1. Find the package you want to configure: - - 1. Open the App-V 5.0 Management console. - - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Provision a security group for the package: - - 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. - - 2. Using the format **mydomain** \\ **groupname**, type the name or part of the name of an Active Directory group object, and click **Check**. - - **Note**   - Ensure that you provide an associated domain name for the group that you are searching for. - - - -3. To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. - -4. - - To accept the default configuration settings and close the **AD ACCESS** page, click **Close**. - - To customize configurations for a specific group, click the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To configure the custom configurations, click **EDIT**. After you grant access, click **Close**. - -**To remove access to an App-V 5.0 package** - -1. Find the package you want to configure: - - 1. Open the App-V 5.0 Management console. - - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Select the group you want to remove, and click **DELETE**. - -3. To close the **AD ACCESS** page, click **Close**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md deleted file mode 100644 index b7683c7b78..0000000000 --- a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Configure Access to Packages by Using the Management Console -description: How to Configure Access to Packages by Using the Management Console -author: dansimp -ms.assetid: 4fd39bc2-d814-46de-a108-1c21fa404e8a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Access to Packages by Using the Management Console - - -Before you deploy an App-V 5.1 virtualized package, you must configure the Active Directory Domain Services (AD DS) security groups that will be allowed to access and run the applications. The security groups may contain computers or users. Entitling a package to a computer group publishes the package globally to all computers in the group. - -Use the following procedure to configure access to virtualized packages. - -**To grant access to an App-V 5.1 package** - -1. Find the package you want to configure: - - 1. Open the App-V 5.1 Management console. - - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Provision a security group for the package: - - 1. Go to the **FIND VALID ACTIVE DIRECTORY NAMES AND GRANT ACCESS** page. - - 2. Using the format **mydomain** \\ **groupname**, type the name or part of the name of an Active Directory group object, and click **Check**. - - **Note**   - Ensure that you provide an associated domain name for the group that you are searching for. - - - -3. To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane. - -4. - - To accept the default configuration settings and close the **AD ACCESS** page, click **Close**. - - To customize configurations for a specific group, click the **ASSIGNED CONFIGURATIONS** drop-down and select **Custom**. To configure the custom configurations, click **EDIT**. After you grant access, click **Close**. - -**To remove access to an App-V 5.1 package** - -1. Find the package you want to configure: - - 1. Open the App-V 5.1 Management console. - - 2. To display the **AD ACCESS** page, right-click the package to be configured, and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. Select the group you want to remove, and click **DELETE**. - -3. To close the **AD ACCESS** page, click **Close**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md b/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md deleted file mode 100644 index 8e6b0c9389..0000000000 --- a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server -description: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server -author: dansimp -ms.assetid: 23b2d03a-20ce-4973-99ee-748f3b682207 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server - - -Deploying packages and connection groups using the App-V 5.1 publishing server is helpful because it offers single-point management and high scalability. - -Use the following steps to configure the App-V 5.1 client to receive updates from the publishing server. - -**Note**   -For the following procedures the management server was installed on a computer named **MyMgmtSrv**, and the publishing server was installed on a computer named **MyPubSrv**. - - - -**To configure the App-V 5.1 client to receive updates from the publishing server** - -1. Deploy the App-V 5.1 management and publishing servers, and add the required packages and connection groups. For more information about adding packages and connection groups, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) and [How to Create a Connection Group](how-to-create-a-connection-group51.md). - -2. To open the management console click the following link, open a browser and type the following: http://MyMgmtSrv/AppvManagement/Console.html in a web browser, and import, publish, and entitle all the packages and connection groups which will be necessary for a particular set of users. - -3. On the computer running the App-V 5.1 client, open an elevated PowerShell command prompt, run the following command: - - **Add-AppvPublishingServer  -Name  ABC  -URL  http:// MyPubSrv/AppvPublishing** - - This command will configure the specified publishing server. You should see output similar to the following: - - Id                        : 1 - - SetByGroupPolicy          : False - - Name                      : ABC - - URL                       : http:// MyPubSrv/AppvPublishing - - GlobalRefreshEnabled      : False - - GlobalRefreshOnLogon      : False - - GlobalRefreshInterval     : 0 - - GlobalRefreshIntervalUnit : Day - - UserRefreshEnabled        : True - - UserRefreshOnLogon        : True - - UserRefreshInterval       : 0 - - UserRefreshIntervalUnit   : Day - - The returned Id – in this case 1 - -4. On the computer running the App-V 5.1 client, open a PowerShell command prompt, and type the following command: - - **Sync-AppvPublishingServer  -ServerId  1** - - The command will query the publishing server for the packages and connection groups that need to be added or removed for this particular client based on the entitlements for the packages and connection groups as configured on the management server. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md b/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md deleted file mode 100644 index fd12886881..0000000000 --- a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server -description: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server -author: dansimp -ms.assetid: f5dfd96d-4b63-468c-8d93-9dfdf47c28fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server - - -Deploying packages and connection groups using the App-V 5.0 publishing server is helpful because it offers single-point management and high scalability. - -Use the following steps to configure the App-V 5.0 client to receive updates from the publishing server. - -**Note**   -For the following procedures the management server was installed on a computer named **MyMgmtSrv**, and the publishing server was installed on a computer named **MyPubSrv**. - - - -**To configure the App-V 5.0 client to receive updates from the publishing server** - -1. Deploy the App-V 5.0 management and publishing servers, and add the required packages and connection groups. For more information about adding packages and connection groups, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md) and [How to Create a Connection Group](how-to-create-a-connection-group.md). - -2. To open the management console click the following link, open a browser and type the following: http://MyMgmtSrv/AppvManagement/Console.html in a web browser, and import, publish, and entitle all the packages and connection groups which will be necessary for a particular set of users. - -3. On the computer running the App-V 5.0 client, open an elevated PowerShell command prompt, run the following command: - - **Add-AppvPublishingServer  -Name  ABC  -URL  http:// MyPubSrv/AppvPublishing** - - This command will configure the specified publishing server. You should see output similar to the following: - - Id                        : 1 - - SetByGroupPolicy          : False - - Name                      : ABC - - URL                       : http:// MyPubSrv/AppvPublishing - - GlobalRefreshEnabled      : False - - GlobalRefreshOnLogon      : False - - GlobalRefreshInterval     : 0 - - GlobalRefreshIntervalUnit : Day - - UserRefreshEnabled        : True - - UserRefreshOnLogon        : True - - UserRefreshInterval       : 0 - - UserRefreshIntervalUnit   : Day - - The returned Id – in this case 1 - -4. On the computer running the App-V 5.0 client, open a PowerShell command prompt, and type the following command: - - **Sync-AppvPublishingServer  -ServerId  1** - - The command will query the publishing server for the packages and connection groups that need to be added or removed for this particular client based on the entitlements for the packages and connection groups as configured on the management server. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-connect-to-the-management-console-51.md b/mdop/appv-v5/how-to-connect-to-the-management-console-51.md deleted file mode 100644 index b6144f08ac..0000000000 --- a/mdop/appv-v5/how-to-connect-to-the-management-console-51.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Connect to the Management Console -description: How to Connect to the Management Console -author: dansimp -ms.assetid: 5a15ed86-7db7-4df3-80ca-bde26f3285e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Connect to the Management Console - - -Use the following procedure to connect to the App-V 5.1 Management Console. - -**To connect to the App-V 5.1 Management Console** - -1. Open Internet Explorer browser and type the address for the App-V 5.1. For example, **http://<Management server name>:<Management service port number>/Console.html**. - -2. To view different sections of the console, click the desired section in the navigation pane. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md b/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md deleted file mode 100644 index a460c12f62..0000000000 --- a/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Connect to the Management Console -description: How to Connect to the Management Console -author: dansimp -ms.assetid: 67dfdfa1-e7dd-4c5e-aa50-f016bd1dc643 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Connect to the Management Console - - -Use the following procedure to connect to the App-V 5.0 Management Console. - -**To connect to the App-V 5.0 Management Console** - -1. Open Internet Explorer browser and type the address for the App-V 5.0. For example, **http://<Management server name>:<Management service port number>/Console.html**. - -2. To view different sections of the console, click the desired section in the navigation pane. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md deleted file mode 100644 index e1e6432a8a..0000000000 --- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: How to Convert a Package Created in a Previous Version of App-V -description: How to Convert a Package Created in a Previous Version of App-V -author: dansimp -ms.assetid: b092a5f8-cc5f-4df8-a5a2-0a68fd7bd5b2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Convert a Package Created in a Previous Version of App-V - - -You can use the package converter utility to upgrade virtual application packages that have been created with previous versions of App-V. - -**Note** -If you are running a computer with a 64-bit architecture, you must use the x86 version of PowerShell. - - - -The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or a subsequent version. Packages that were created using a version prior to App-V 4.5 must be upgraded to the App-V 4.5 or App-V 4.6 format before conversion. - -The following information provides direction for converting existing virtual application packages. - -**Important** -You must configure the package converter to always save the package ingredients file to a secure location and directory. A secure location is accessible only by an administrator. Additionally, when you deploy the package, you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion process. - - - -**Getting started** - -1. Install the App-V Sequencer on a computer in your environment. For information about how to install the Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -2. Import the required Powershell Module - -```powershell -Import-Module AppVPkgConverter -``` - -3. The following cmdlets are available: - - - Test-AppvLegacyPackage – This cmdlet is designed to check packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in depth validation. For information about options and basic functionality for this cmdlet, using the PowerShell cmdline, type `Test-AppvLegacyPackage -?`. - - - ConvertFrom-AppvLegacyPackage – To convert an existing package, type `ConvertFrom-AppvLegacyPackage c:\contentStore c:\convertedPackages`. In this command, `c:\contentStore` represents the location of the existing package and `c:\convertedPackages` is the output directory to which the resulting App-V 5.0 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used for the App-V 5.0 filename. - - Additionally, the package converter optimizes performance of packages in App-V 5.0 by setting the package to stream fault the App-V package. This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default. - - **Note** - Before you specify the output directory, you must create the output directory. - - - -~~~ -**Advanced Conversion Tips** - -- Piping - PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V 5.0 client. - -- Batching - The PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`. - -- Other functionality - PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in PowerShell and can help you create advanced scenarios for the Package Converter. - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md deleted file mode 100644 index b146f4dd7f..0000000000 --- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Convert a Package Created in a Previous Version of App-V -description: How to Convert a Package Created in a Previous Version of App-V -author: dansimp -ms.assetid: 3366d399-2891-491d-8de1-f8cfdf39bbab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Convert a Package Created in a Previous Version of App-V - - -You can use the package converter utility to upgrade virtual application packages that have been created with previous versions of App-V. - -**Note** -If you are running a computer with a 64-bit architecture, you must use the x86 version of PowerShell. - - - -The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or a subsequent version. Packages that were created using a version prior to App-V 4.5 must be upgraded to the App-V 4.5 or App-V 4.6 format before conversion. - -The following information provides direction for converting existing virtual application packages. - -**Important** -You must configure the package converter to always save the package ingredients file to a secure location and directory. A secure location is accessible only by an administrator. Additionally, when you deploy the package, you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion process. - - - -**App-V 4.6 installation folder is redirected to virtual file system root** - -When you convert packages from App-V 4.6 to 5.1, the App-V 5.1 package can access the hardcoded drive that you were required to use when you created 4.6 packages. The drive letter will be the drive you selected as the installation drive on the 4.6 sequencing machine. (The default drive letter is Q:\\.) - -Prior to App-V 5.1, the 4.6 root folder was not recognized and could not be accessed by App-V 5.0 packages. Now, App-V 5.1 packages can access hardcoded files by their full path or can programmatically enumerate files under the App-V 4.6 installation root. - -**Technical Details:** The App-V 5.1 package converter will save the App-V 4.6 installation root folder and short folder names in the FilesystemMetadata.xml file in the Filesystem element. When the App-V 5.1 client creates the virtual process, it will map requests from the App-V 4.6 installation root to the virtual file system root. - -**Getting started** - -1. Install the App-V Sequencer on a computer in your environment. For information about how to install the Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -2. - - The following cmdlets are available: - - - Test-AppvLegacyPackage – This cmdlet is designed to check packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in depth validation. For information about options and basic functionality for this cmdlet, using the PowerShell cmdline, type `Test-AppvLegacyPackage -?`. - - - ConvertFrom-AppvLegacyPackage – To convert an existing package, type `ConvertFrom-AppvLegacyPackage c:\contentStore c:\convertedPackages`. In this command, `c:\contentStore` represents the location of the existing package and `c:\convertedPackages` is the output directory to which the resulting App-V 5.1 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used for the App-V 5.1 filename. - - Additionally, the package converter optimizes performance of packages in App-V 5.1 by setting the package to stream fault the App-V package. This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default. - - **Note** - Before you specify the output directory, you must create the output directory. - - - -~~~ -**Advanced Conversion Tips** - -- Piping - PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V 5.1 client. - -- Batching - The PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`. - -- Other functionality - PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in PowerShell and can help you create advanced scenarios for the Package Converter. - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md deleted file mode 100644 index f9ce72926a..0000000000 --- a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Create a Connection Group with User-Published and Globally Published Packages -description: How to Create a Connection Group with User-Published and Globally Published Packages -author: dansimp -ms.assetid: 82f7ea7f-7b14-4506-8940-fdcd6c3e117f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Create a Connection Group with User-Published and Globally Published Packages -You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods: - -- [How to use PowerShell cmdlets to create the user-entitled connection groups](#bkmk-posh-userentitled-cg) - -- [How to use the App-V Server to create the user-entitled connection groups](#bkmk-appvserver-userentitled-cg) - -**What to know before you start:** - - ---- - - - - - - - - - - - - - - - - -
    Unsupported scenarios and potential issuesResult

    You cannot include user-published packages in globally entitled connection groups.

    The connection group will fail.

    If you publish a package globally and then create a user-published connection group in which you’ve made that package non-optional, you can still run Unpublish-AppvClientPackage <package> -global to unpublish the package, even when that package is being used in another connection group.

    If any other connection groups are using that package, the package will fail in those connection groups.

    -

    To avoid inadvertently unpublishing a non-optional package that is being used in another connection group, we recommend that you track the connection groups in which you’ve used a non-optional package.

    - -  -**How to use PowerShell cmdlets to create user-entitled connection groups** - -1. Add and publish packages by using the following commands: - - **Add-AppvClientPackage Package1\_AppV\_file\_Path** - - **Add-AppvClientPackage Package2\_AppV\_file\_Path** - - **Publish-AppvClientPackage -PackageId Package1\_ID -VersionId Package1\_Version ID -Global** - - **Publish-AppvClientPackage -PackageId Package2\_ID -VersionId Package2\_ID** - -2. Create the connection group XML file. For more information, see [About the Connection Group File](about-the-connection-group-file.md). - -3. Add and publish the connection group by using the following commands: - - **Add-AppvClientConnectionGroup Connection\_Group\_XML\_file\_Path** - - **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID** - -**How to use the App-V Server to create user-entitled connection groups** - -1. Open the App-V 5.0 Management Console. - -2. Follow the instructions in [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md) to publish packages globally and to the user. - -3. Follow the instructions in [How to Create a Connection Group](how-to-create-a-connection-group.md) to create the connection group, and add the user-published and globally published packages. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - -[How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md deleted file mode 100644 index fe42b5278b..0000000000 --- a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Create a Connection Group with User-Published and Globally Published Packages -description: How to Create a Connection Group with User-Published and Globally Published Packages -author: dansimp -ms.assetid: 851b8742-0283-4aa6-b3a3-f7f6289824c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Create a Connection Group with User-Published and Globally Published Packages - - -You can create user-entitled connection groups that contain both user-published and globally published packages, using either of the following methods: - -- [How to use PowerShell cmdlets to create the user-entitled connection groups](#bkmk-posh-userentitled-cg) - -- [How to use the App-V Server to create the user-entitled connection groups](#bkmk-appvserver-userentitled-cg) - -**What to know before you start:** - - ---- - - - - - - - - - - - - - - - - -
    Unsupported scenarios and potential issuesResult

    You cannot include user-published packages in globally entitled connection groups.

    The connection group will fail.

    If you publish a package globally and then create a user-published connection group in which you’ve made that package non-optional, you can still run Unpublish-AppvClientPackage <package> -global to unpublish the package, even when that package is being used in another connection group.

    If any other connection groups are using that package, the package will fail in those connection groups.

    -

    To avoid inadvertently unpublishing a non-optional package that is being used in another connection group, we recommend that you track the connection groups in which you’ve used a non-optional package.

    - -**How to use PowerShell cmdlets to create user-entitled connection groups** - -1. Add and publish packages by using the following commands: - - **Add-AppvClientPackage Package1\_AppV\_file\_Path** - - **Add-AppvClientPackage Package2\_AppV\_file\_Path** - - **Publish-AppvClientPackage -PackageId Package1\_ID -VersionId Package1\_Version ID -Global** - - **Publish-AppvClientPackage -PackageId Package2\_ID -VersionId Package2\_ID** - -2. Create the connection group XML file. For more information, see [About the Connection Group File](about-the-connection-group-file51.md). - -3. Add and publish the connection group by using the following commands: - - **Add-AppvClientConnectionGroup Connection\_Group\_XML\_file\_Path** - - **Enable-AppvClientConnectionGroup  -GroupId CG\_Group\_ID -VersionId CG\_Version\_ID** - -**How to use the App-V Server to create user-entitled connection groups** - -1. Open the App-V 5.1 Management Console. - -2. Follow the instructions in [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md) to publish packages globally and to the user. - -3. Follow the instructions in [How to Create a Connection Group](how-to-create-a-connection-group51.md) to create the connection group, and add the user-published and globally published packages. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - -[How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-connection-group.md b/mdop/appv-v5/how-to-create-a-connection-group.md deleted file mode 100644 index 70a482f2c4..0000000000 --- a/mdop/appv-v5/how-to-create-a-connection-group.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: How to Create a Connection Group -description: How to Create a Connection Group -author: dansimp -ms.assetid: 9d272052-2d28-4e41-989c-89610482a0ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Connection Group - - -Use these steps to create a connection group by using the App-V Management Console. To use PowerShell to create connection groups, see [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md). - -When you place packages in a connection group, their package root paths are merged. If you remove packages, only the remaining packages maintain the merged root. - -**To create a connection group** - -1. In the App-V 5.0 Management Console, select **Packages**. - -2. Select **CONNECTION GROUPS** to display the Connection Groups library. - -3. Select **ADD CONNECTION GROUP** to create a new connection group. - -4. In the **New Connection Group** pane, type a description for the group. - -5. Click **EDIT** in the **CONNECTED PACKAGES** pane to add a new application to the connection group. - -6. In the **PACKAGES Entire Library** pane, select the application to be added, and click the arrow to add the application. - - To remove an application, select the application to be removed in the **PACKAGES IN** pane and click the arrow. - - To reprioritize the applications in your connection group, use the arrows in the **PACKAGES IN** pane. - - **Important**   - By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane. - - - -7. After adding all the applications and configuring Active Directory access, click **Apply**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-connection-group51.md b/mdop/appv-v5/how-to-create-a-connection-group51.md deleted file mode 100644 index f5605affe1..0000000000 --- a/mdop/appv-v5/how-to-create-a-connection-group51.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Create a Connection Group -description: How to Create a Connection Group -author: dansimp -ms.assetid: 221e2eed-7ebb-42e3-b3d6-11c37c0578e6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Connection Group - - -Use these steps to create a connection group by using the App-V Management Console. To use PowerShell to create connection groups, see [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md). - -When you place packages in a connection group, their package root paths are merged. If you remove packages, only the remaining packages maintain the merged root. - -**To create a connection group** - -1. In the App-V 5.1 Management Console, select **CONNECTION GROUPS** to display the Connection Groups library. - -2. Select **ADD CONNECTION GROUP** to create a new connection group. - -3. In the **New Connection Group** pane, type a description for the group. - -4. Click **EDIT** in the **CONNECTED PACKAGES** pane to add a new application to the connection group. - -5. In the **PACKAGES Entire Library** pane, select the application to be added, and click the arrow to add the application. - - To remove an application, select the application to be removed in the **PACKAGES IN** pane and click the arrow. - - To reprioritize the applications in your connection group, use the arrows in the **PACKAGES IN** pane. - - **Important**   - By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane. - - - -6. After adding all the applications and configuring Active Directory access, click **Apply**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md b/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md deleted file mode 100644 index 4837568ff0..0000000000 --- a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Create a Custom Configuration File by Using the App-V 5.0 Management Console -description: How to Create a Custom Configuration File by Using the App-V 5.0 Management Console -author: dansimp -ms.assetid: 0d1f6768-be30-4682-8eeb-aa95918b24c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Custom Configuration File by Using the App-V 5.0 Management Console - - -You can use a dynamic configuration to customize an App-V 5.0 package for a specific user. However, you must first create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use the files. Creation of the file is an advanced manual operation. For general information about dynamic user configuration files, see, [About App-V 5.0 Dynamic Configuration](about-app-v-50-dynamic-configuration.md). - -Use the following procedure to create a Dynamic User Configuration file by using the App-V 5.0 Management console. - -**To create a Dynamic User Configuration file** - -1. Right-click the name of the package that you want to view and select **Edit active directory access** to view the configuration that is assigned to a given user group. Alternatively, select the package, and click **Edit**. - -2. Using the list of **AD Entities with Access**, select the AD group that you want to customize. Select **Custom** from the drop-down list, if it is not already selected. A link named **Edit** will be displayed. - -3. Click **Edit**. The Dynamic User Configuration that is assigned to the AD Group will be displayed. - -4. Click **Advanced**, and then click **Export Configuration**. Type in a filename and click **Save**. Now you can edit the file to configure a package for a user. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md b/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md deleted file mode 100644 index eb1da74435..0000000000 --- a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Create a Custom Configuration File by Using the App-V 5.1 Management Console -description: How to Create a Custom Configuration File by Using the App-V 5.1 Management Console -author: dansimp -ms.assetid: f5ab426a-f49a-47b3-93f3-b9d60aada8f4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Custom Configuration File by Using the App-V 5.1 Management Console - - -You can use a dynamic configuration to customize an App-V 5.1 package for a specific user. However, you must first create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use the files. Creation of the file is an advanced manual operation. For general information about dynamic user configuration files, see, [About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md). - -Use the following procedure to create a Dynamic User Configuration file by using the App-V 5.1 Management console. - -**To create a Dynamic User Configuration file** - -1. Right-click the name of the package that you want to view and select **Edit active directory access** to view the configuration that is assigned to a given user group. Alternatively, select the package, and click **Edit**. - -2. Using the list of **AD Entities with Access**, select the AD group that you want to customize. Select **Custom** from the drop-down list, if it is not already selected. A link named **Edit** will be displayed. - -3. Click **Edit**. The Dynamic User Configuration that is assigned to the AD Group will be displayed. - -4. Click **Advanced**, and then click **Export Configuration**. Type in a filename and click **Save**. Now you can edit the file to configure a package for a user. - - **Note** - To export a configuration while running on Windows Server, you must disable "IE Enhanced Security Configuration". If this is enabled and set to block downloads, you cannot download anything from the App-V Server. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md b/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md deleted file mode 100644 index 0f7df5d66c..0000000000 --- a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Create a Package Accelerator by Using PowerShell -description: How to Create a Package Accelerator by Using PowerShell -author: dansimp -ms.assetid: 8e527363-d961-4153-826a-446a4ad8d980 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Package Accelerator by Using PowerShell - - -App-V 5.0 package accelerators automatically sequence large, complex applications. Additionally, when you apply an App-V 5.0 package accelerator, you are not always required to manually install an application to create the virtualized package. - -**To create a package accelerator** - -1. Install the App-V 5.0 sequencer. For more information about installing the sequencer see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. Use the **New-AppvPackageAccelerator** cmdlet. - -3. To create a package accelerator, make sure that you have the .appv package to create an accelerator from, the installation media or installation files, and optionally a read me file for consumers of the accelerator to use. The following parameters are required to use the package accelerator cmdlet: - - - **InstalledFilesPath** - specifies the application installation path. - - - **Installer** – specifies the path to the application installer media - - - **InputPackagePath** – specifies the path to the .appv package - - - **Path** – specifies the output directory for the package. - - The following example displays how you can create a package accelerator with an .appv package and the installation media: - - **New-AppvPackageAccelerator -InputPackagePath <path to the .appv file> -Installer <path to the installer executable> -Path <directory of the output path>** - - Additional optional parameters that can be used with the **New-AppvPackageAccelerator** cmdlet are displayed in the following list: - - - **AcceleratorDescriptionFile** - specifies the path to user created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be packaged with the package created using the package accelerator. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md b/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md deleted file mode 100644 index ef6e767d58..0000000000 --- a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Create a Package Accelerator by Using PowerShell -description: How to Create a Package Accelerator by Using PowerShell -author: dansimp -ms.assetid: 0cb98394-4477-4193-8c5f-1c1773c7263a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Package Accelerator by Using PowerShell - - -App-V 5.1 package accelerators automatically sequence large, complex applications. Additionally, when you apply an App-V 5.1 package accelerator, you are not always required to manually install an application to create the virtualized package. - -**To create a package accelerator** - -1. Install the App-V 5.1 sequencer. For more information about installing the sequencer see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. Use the **New-AppvPackageAccelerator** cmdlet. - -3. To create a package accelerator, make sure that you have the .appv package to create an accelerator from, the installation media or installation files, and optionally a read me file for consumers of the accelerator to use. The following parameters are required to use the package accelerator cmdlet: - - - **InstalledFilesPath** - specifies the application installation path. - - - **Installer** – specifies the path to the application installer media - - - **InputPackagePath** – specifies the path to the .appv package - - - **Path** – specifies the output directory for the package. - - The following example displays how you can create a package accelerator with an .appv package and the installation media: - - **New-AppvPackageAccelerator -InputPackagePath <path to the .appv file> -Installer <path to the installer executable> -Path <directory of the output path>** - - Additional optional parameters that can be used with the **New-AppvPackageAccelerator** cmdlet are displayed in the following list: - - - **AcceleratorDescriptionFile** - specifies the path to user created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be packaged with the package created using the package accelerator. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator.md b/mdop/appv-v5/how-to-create-a-package-accelerator.md deleted file mode 100644 index b823c813a0..0000000000 --- a/mdop/appv-v5/how-to-create-a-package-accelerator.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: How to Create a Package Accelerator -description: How to Create a Package Accelerator -author: dansimp -ms.assetid: dfe305e5-7cf8-498f-9581-4805ffc722bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Package Accelerator - - -App-V 5.0 package accelerators automatically generate new virtual application packages. - -**Note** -You can use PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell.md). - - - -Use the following procedure to create a package accelerator. - -**Important** -Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.0 Package Accelerator is applied. - - - -**Important** -Before you begin the following procedure, you should perform the following: - -- Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer. - -- Copy all required installation files associated with the virtual application package to the computer running the sequencer. - - - -**To create a package accelerator** - -1. **Important** - The App-V 5.0 Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V 5.0 Sequencer. - - - -~~~ -To start the App-V 5.0 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. -~~~ - -2. To start the App-V 5.0 **Create Package Accelerator** wizard, in the App-V 5.0 sequencer console, click **Tools** / **Create Accelerator**. - -3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file). - - **Tip** - Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. - - - -~~~ -Click **Next**. -~~~ - -4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files. - - **Tip** - Copy the folder that contains the required installation files to the computer running the Sequencer. - - - -5. If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location. - -6. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page. - - **Note** - You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard. - - - -7. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**. - -8. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package. - - If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**. - -9. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**. - -10. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory. - -11. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**. - - **Important** - To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator51.md b/mdop/appv-v5/how-to-create-a-package-accelerator51.md deleted file mode 100644 index 45092fa865..0000000000 --- a/mdop/appv-v5/how-to-create-a-package-accelerator51.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: How to Create a Package Accelerator -description: How to Create a Package Accelerator -author: dansimp -ms.assetid: b61f3581-7933-443e-b872-a96bed9ff8d7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Package Accelerator - - -App-V 5.1 package accelerators automatically generate new virtual application packages. - -**Note** -You can use PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell51.md). - - - -Use the following procedure to create a package accelerator. - -**Important** -Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.1 Package Accelerator is applied. - - - -**Important** -Before you begin the following procedure, you should perform the following: - -- Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer. - -- Copy all required installation files associated with the virtual application package to the computer running the sequencer. - - - -**To create a package accelerator** - -1. **Important** - The App-V 5.1 Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V 5.1 Sequencer. - - - -~~~ -To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. -~~~ - -2. To start the App-V 5.1 **Create Package Accelerator** wizard, in the App-V 5.1 sequencer console, click **Tools** / **Create Accelerator**. - -3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file). - - **Tip** - Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer. - - - -~~~ -Click **Next**. -~~~ - -4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files. - - **Tip** - Copy the folder that contains the required installation files to the computer running the Sequencer. - - - -5. If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location. - -6. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page. - - **Note** - You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard. - - - -7. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**. - -8. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package. - - If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**. - -9. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**. - -10. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory. - -11. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**. - - **Important** - To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md b/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md deleted file mode 100644 index d6752dc7b3..0000000000 --- a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: How to Create a Virtual Application Package Using an App-V Package Accelerator -description: How to Create a Virtual Application Package Using an App-V Package Accelerator -author: dansimp -ms.assetid: 715e7526-e100-419c-8fc1-75cbfe433835 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Virtual Application Package Using an App-V Package Accelerator - - -**Important** -The App-V 5.0 Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V 5.0 Sequencer. - - - -Use the following procedure to create a virtual application package with the App-V 5.0 Package Accelerator. - -**Note** -Before you start this procedure, copy the required Package Accelerator locally to the computer that runs the App-V 5.0 Sequencer. You should also copy all required installation files for the package to a local directory on the computer that runs the Sequencer. This is the directory that you have to specify in step 5 of this procedure. - - - -**To create a virtual application package with an App-V 5.0 Package Accelerator** - -1. To start the App-V Sequencer, on the computer that runs the App-V 5.0 Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. - -3. To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**. - - **Important** - If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box. - - - -4. On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. - -5. On the **Select Installation Files** page, click **Make New Folder** to create a local folder that contains all required installation files for the package, and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer that runs the Sequencer, click **Browse** to select the folder. - - Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**. - - **Note** - You can specify the following types of supported installation files: - - - Windows Installer files (**.msi**) - - - Cabinet files (.cab) - - - Compressed files with a .zip file name extension - - - The actual application files - - The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually. - - - -~~~ -If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page. -~~~ - -6. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**. - -7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. - - To create the package, click **Create**. After the package is created, click **Next**. - -8. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements. - - If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step: - - - **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package. - - - **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**. - - - **Save Package**. The Sequencer saves the package. - - - **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block. - - If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**. - -9. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md b/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md deleted file mode 100644 index 2552432acc..0000000000 --- a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: How to Create a Virtual Application Package Using an App-V Package Accelerator -description: How to Create a Virtual Application Package Using an App-V Package Accelerator -author: dansimp -ms.assetid: eae1e4f8-f14f-4bc8-9867-052561c37297 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Virtual Application Package Using an App-V Package Accelerator - - -**Important** -The App-V 5.1 Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V 5.1 Sequencer. - - - -Use the following procedure to create a virtual application package with the App-V 5.1 Package Accelerator. - -**Note** -Before you start this procedure, copy the required Package Accelerator locally to the computer that runs the App-V 5.1 Sequencer. You should also copy all required installation files for the package to a local directory on the computer that runs the Sequencer. This is the directory that you have to specify in step 5 of this procedure. - - - -**To create a virtual application package with an App-V 5.1 Package Accelerator** - -1. To start the App-V Sequencer, on the computer that runs the App-V 5.1 Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**. - -3. To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**. - - **Important** - If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box. - - - -4. On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**. - -5. On the **Select Installation Files** page, click **Make New Folder** to create a local folder that contains all required installation files for the package, and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer that runs the Sequencer, click **Browse** to select the folder. - - Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**. - - **Note** - You can specify the following types of supported installation files: - - - Windows Installer files (**.msi**) - - - Cabinet files (.cab) - - - Compressed files with a .zip file name extension - - - The actual application files - - The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually. - - - -~~~ -If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page. -~~~ - -6. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**. - -7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB. - - To create the package, click **Create**. After the package is created, click **Next**. - -8. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements. - - If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step: - - - **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package. - - - **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**. - - - **Save Package**. The Sequencer saves the package. - - - **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block. - - If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**. - -9. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**. - - The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-and-use-a-project-template.md b/mdop/appv-v5/how-to-create-and-use-a-project-template.md deleted file mode 100644 index 514740a212..0000000000 --- a/mdop/appv-v5/how-to-create-and-use-a-project-template.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Create and Use a Project Template -description: How to Create and Use a Project Template -author: dansimp -ms.assetid: 2063f0b3-47a1-4090-bf99-0f26b107331c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create and Use a Project Template - - -You can use an App-V 5.0 project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment. Using a project template can streamline the process of creating virtual application packages. - -**Note**   -You can, and often should apply an App-V 5.0 project template during a package upgrade. For example, if you sequenced an application with a custom exclusion list, it is recommended that an associated template is created and saved for later use while upgrading the sequenced application. - -App-V 5.0 project templates differ from App-V 5.0 Application Accelerators because App-V 5.0 Application Accelerators are application-specific, and App-V 5.0 project templates can be applied to multiple applications. - -Use the following procedures to create and apply a new template. - -**To create a project template** - -1. To start the App-V 5.0 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -**Note**   - If the virtual application package is currently open in the App-V 5.0 Sequencer console, skip to step 3 of this procedure. - -2. To open the existing virtual application package that contains the settings you want to save with the App-V 5.0 project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. - -3. In the App-V 5.0 Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V 5.0 project template. Click Save. - The new App-V 5.0 project template is saved in the directory specified in step 3 of this procedure. - -**To apply a project template** - -**Important**   - Creating a virtual application package using a project template in conjunction with a Package Accelerator is not supported. - -1. To start the App-V 5.0 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. To create or upgrade a new virtual application package by using an App-V 5.0 project template, click **File** / **New From Template**. - -3. To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**. - - Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-create-and-use-a-project-template51.md b/mdop/appv-v5/how-to-create-and-use-a-project-template51.md deleted file mode 100644 index cc1d47dba3..0000000000 --- a/mdop/appv-v5/how-to-create-and-use-a-project-template51.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Create and Use a Project Template -description: How to Create and Use a Project Template -author: dansimp -ms.assetid: e5ac1dc8-a88f-4b16-8e3c-df07ef5e4c3b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create and Use a Project Template - - -You can use an App-V 5.1 project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment. Using a project template can streamline the process of creating virtual application packages. - -**Note** -You can, and often should apply an App-V 5.1 project template during a package upgrade. For example, if you sequenced an application with a custom exclusion list, it is recommended that an associated template is created and saved for later use while upgrading the sequenced application. - - - -App-V 5.1 project templates differ from App-V 5.1 Application Accelerators because App-V 5.1 Application Accelerators are application-specific, and App-V 5.1 project templates can be applied to multiple applications. - -Use the following procedures to create and apply a new template. - -**To create a project template** - -1. To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. - -2. **Note** - If the virtual application package is currently open in the App-V 5.1 Sequencer console, skip to step 3 of this procedure. - - - -~~~ -To open the existing virtual application package that contains the settings you want to save with the App-V 5.1 project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**. -~~~ - -3. In the App-V 5.1 Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V 5.1 project template. Click Save. - - The new App-V 5.1 project template is saved in the directory specified in step 3 of this procedure. - -**To apply a project template** - -1. **Important** - Creating a virtual application package using a project template in conjunction with a Package Accelerator is not supported. - - - -~~~ -To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. -~~~ - -2. To create or upgrade a new virtual application package by using an App-V 5.1 project template, click **File** / **New From Template**. - -3. To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**. - - Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md b/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md deleted file mode 100644 index 110fce61e0..0000000000 --- a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console -description: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console -author: dansimp -ms.assetid: 4f249ee3-cc2d-4b1e-afe5-d1cbf9cabd88 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console - - -Use the following procedure to customize the virtual application extensions for an Active Directory (AD) group. - -**To customize virtual applications extensions for an AD group** - -1. To view the package that you want to configure, open the App-V 5.0 Management Console. To view the configuration that is assigned to a given user group, select the package, and right-click the package name and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. To customize an AD group, you can find the group from the list of **AD Entities with Access**. Then, using the drop-down box in the **Assigned Configuration** pane, select **Custom**, and then click **EDIT**. - -3. To disable all extensions for a given application, clear **ENABLE**. - - To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane, and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane, and select **Remove Shortcut**. To edit an existing shortcut, right-click the application, and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced**, and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions that are associated with the package using the configuration file. - -5. To edit additional application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog, click **Overwrite** to complete the process. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md b/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md deleted file mode 100644 index 4d7754f265..0000000000 --- a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console -description: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console -author: dansimp -ms.assetid: dd71df05-512f-4eb4-a55f-e5b93601323d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console - - -Use the following procedure to customize the virtual application extensions for an Active Directory (AD) group. - -**To customize virtual applications extensions for an AD group** - -1. To view the package that you want to configure, open the App-V 5.1 Management Console. To view the configuration that is assigned to a given user group, select the package, and right-click the package name and select **Edit active directory access**. Alternatively, select the package and click **EDIT** in the **AD ACCESS** pane. - -2. To customize an AD group, you can find the group from the list of **AD Entities with Access**. Then, using the drop-down box in the **Assigned Configuration** pane, select **Custom**, and then click **EDIT**. - -3. To disable all extensions for a given application, clear **ENABLE**. - - To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane, and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane, and select **Remove Shortcut**. To edit an existing shortcut, right-click the application, and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced**, and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions that are associated with the package using the configuration file. - -5. To edit additional application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog, click **Overwrite** to complete the process. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-delete-a-connection-group.md b/mdop/appv-v5/how-to-delete-a-connection-group.md deleted file mode 100644 index 8d3a29dee3..0000000000 --- a/mdop/appv-v5/how-to-delete-a-connection-group.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Delete a Connection Group -description: How to Delete a Connection Group -author: dansimp -ms.assetid: 92654019-a5ad-4ed7-8c39-45f658f60196 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Connection Group - - -Use the following procedure to delete an existing App-V connection group. - -**To delete a connection group** - -1. Open the App-V Management Console and select **Packages** > **CONNECTION GROUPS**. - -2. Right-click the connection group to be removed, and select **delete**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Managing Connection Groups](managing-connection-groups.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-delete-a-connection-group51.md b/mdop/appv-v5/how-to-delete-a-connection-group51.md deleted file mode 100644 index 90aec39b89..0000000000 --- a/mdop/appv-v5/how-to-delete-a-connection-group51.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Delete a Connection Group -description: How to Delete a Connection Group -author: dansimp -ms.assetid: dfdfb507-8891-4f17-9125-5759c9b74483 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Connection Group - - -Use the following procedure to delete an existing App-V connection group. - -**To delete a connection group** - -1. Open the App-V Management Console and select **CONNECTION GROUPS**. - -2. Right-click the connection group to be removed, and select **delete**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Managing Connection Groups](managing-connection-groups51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md b/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md deleted file mode 100644 index 51e1ae3be1..0000000000 --- a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Delete a Package in the Management Console -description: How to Delete a Package in the Management Console -author: dansimp -ms.assetid: 4a2be40b-bbb8-4fab-992d-7466df432858 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Package in the Management Console - - -Use the following procedure to delete an App-V 5.1 package. - -**To delete a package in the Management Console** - -1. To view the package you want to delete, open the App-V 5.1 Management Console and select **Packages**. Select the package to be removed. - -2. Click or right-click the package. Select **Delete** to remove the package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md b/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md deleted file mode 100644 index a9a1d7847a..0000000000 --- a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: How to Delete a Package in the Management Console -description: How to Delete a Package in the Management Console -author: dansimp -ms.assetid: d780aafb-4097-4417-8ecc-30efac73c33a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a Package in the Management Console - - -Use the following procedure to delete an App-V 5.0 package. - -**To delete a package in the Management Console** - -1. To view the package you want to delete, open the App-V 5.0 Management Console and select **Packages**. Select the package to be removed. - -2. Right-click the package, and select **delete** to remove the package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md b/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md deleted file mode 100644 index c84a1d788d..0000000000 --- a/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to deploy App-V 5.0 Packages Using Electronic Software Distribution -description: How to deploy App-V 5.0 Packages Using Electronic Software Distribution -author: dansimp -ms.assetid: 08e5e05b-dbb8-4be7-b2d8-721ef627da81 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to deploy App-V 5.0 Packages Using Electronic Software Distribution - - -You can use an electronic software distribution (ESD) system to deploy App-V 5.0 virtual applications to App-V clients. For details, see the documentation available with the ESD you are using. - -For component requirements and options for using an ESD to deploy App-V packages, see [Planning to Deploy App-V 5.0 with an Electronic Software Distribution System](planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md). - -Use one of the following methods to publish packages to App-V client computers with an ESD: - - ---- - - - - - - - - - - - - - - - - - - - - -
    MethodDescription

    Functionality provided by a third-party ESD

    Use the functionality in a third-party ESD.

    Stand-alone Windows Installer

    Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V 5.0 package file information used to configure a package and copies the required package files to the client.

    PowerShell

    Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.0, see Administering App-V by Using PowerShell.

    - - - -**To deploy App-V 5.0 packages by using an ESD** - -1. Install the App-V 5.0 Sequencer on a computer in your environment. For more information about installing the sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -2. Use the App-V 5.0 Sequencer to create virtual application. For information about creating a virtual application, see [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md). - -3. After you create the virtual application, deploy the package by using your ESD solution. - - If you are using System Center Configuration Manager, start by reviewing [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) for information about using App-V 5.0 and System Center 2012 Configuration Manager. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md b/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md deleted file mode 100644 index 6171caac63..0000000000 --- a/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to deploy App-V 5.1 Packages Using Electronic Software Distribution -description: How to deploy App-V 5.1 Packages Using Electronic Software Distribution -author: dansimp -ms.assetid: e1957a5a-1f18-42da-b2c1-a5ae5a4cca7a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to deploy App-V 5.1 Packages Using Electronic Software Distribution - - -You can use an electronic software distribution (ESD) system to deploy App-V 5.1 virtual applications to App-V clients. For details, see the documentation available with the ESD you are using. - -For component requirements and options for using an ESD to deploy App-V packages, see [Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md). - -Use one of the following methods to publish packages to App-V client computers with an ESD: - - ---- - - - - - - - - - - - - - - - - - - - - -
    MethodDescription

    Functionality provided by a third-party ESD

    Use the functionality in a third-party ESD.

    Stand-alone Windows Installer

    Install the application on the target client computer by using the associated Windows Installer (.msi) file that is created when you initially sequence an application. The Windows Installer file contains the associated App-V 5.1 package file information used to configure a package and copies the required package files to the client.

    PowerShell

    Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.1, see Administering App-V 5.1 by Using PowerShell.

    - - - -**To deploy App-V 5.1 packages by using an ESD** - -1. Install the App-V 5.1 Sequencer on a computer in your environment. For more information about installing the sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -2. Use the App-V 5.1 Sequencer to create virtual application. For information about creating a virtual application, see [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md). - -3. After you create the virtual application, deploy the package by using your ESD solution. - - If you are using System Center Configuration Manager, start by reviewing [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) for information about using App-V 5.1 and System Center 2012 Configuration Manager. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md deleted file mode 100644 index b201ab4069..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer -description: How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer -ms.assetid: 5b7e27e4-4360-464c-b832-f1c7939e5485 -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.date: 06/21/2016 ---- - -# How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer - -**Note:** App-V 4.6 has exited Mainstream support. The following assumes that the App-V 4.6 SP3 client is already installed. - -Use the following information to install the App-V 5.0 client (preferably, with the latest Service Packs and hotfixes) and the App-V 4.6 SP3 client on the same computer. For supported versions, requirements, and other planning information, see [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md). - -**To deploy the App-V 5.0 client and App-V 4.6 client on the same computer** - -1. Install the App-V 5.0 SP3 client on the computer that is running the App-V 4.6 version of the client. For best results, we recommend that you install all available updates to the App-V 5.0 SP3 client. - -2. Convert or re-sequence the packages gradually. - - - To convert the packages, use the App-V 5.0 package converter and convert the required packages to the App-V 5.0 (**.appv**) file format. - - - To re-sequence the packages, consider using the latest version of the Sequencer for best results. - - For more information about publishing packages, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md). - -3. Deploy packages to the client computers. - -4. Convert extension points, as needed. For more information, see the following resources: - - - [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md) - - - [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md) - - - [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md) - -5. Test that your App-V 5.0 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](https://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md) - -[Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md deleted file mode 100644 index 90cb9db9a7..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer -description: How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer -ms.assetid: 498d50c7-f13d-4fbb-8ea1-b959ade26fdf -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer - -**Note:** App-V 4.6 has exited Mainstream support. - -Use the following information to install the Microsoft Application Virtualization (App-V) 5.1 client (preferably, with the latest Service Packs and hotfixes) and the App-V 4.6 SP2 client or the App-V 4.6 S3 client on the same computer. For supported versions, requirements, and other planning information, see [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md). - -**To deploy the App-V 5.1 client and App-V 4.6 client on the same computer** - -1. Install the following version of the App-V client on the computer that is running App-V 4.6. - - - [Microsoft Application Virtualization 4.6 Service Pack 3](https://www.microsoft.com/download/details.aspx?id=41187) - -2. Install the App-V 5.1 client on the computer that is running the App-V 4.6 SP3 version of the client. For best results, we recommend that you install all available updates to the App-V 5.1 client. - -3. Convert or re-sequence the packages gradually. - - - To convert the packages, use the App-V 5.1 package converter and convert the required packages to the App-V 5.1 (**.appv**) file format. - - - To re-sequence the packages, consider using the latest version of the Sequencer for best results. - - For more information about publishing packages, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md). - -4. Deploy packages to the client computers. - -5. Convert extension points, as needed. For more information, see the following resources: - - - [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) - - - [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md) - - - [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md) - -6. Test that your App-V 5.1 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](https://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md) - -[Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md b/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md deleted file mode 100644 index b58dcbe9cc..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md +++ /dev/null @@ -1,280 +0,0 @@ ---- -title: How to Deploy the App-V 5.0 Server -description: How to Deploy the App-V 5.0 Server -author: dansimp -ms.assetid: 4f8f16af-7d74-42b4-84b8-b04ce668225d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V 5.0 Server - - -Use the following procedure to install the App-V 5.0 server. For information about deploying the App-V 5.0 SP3 Server, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-migrate-to-50sp3). - -**Before you start:** - -- Ensure that you’ve installed prerequisite software. See [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -- Review the server section of [App-V 5.0 Security Considerations](app-v-50-security-considerations.md). - -- Specify a port where each component will be hosted. - -- Add firewall rules to allow incoming requests to access the specified ports. - -- If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md). - -**To install the App-V 5.0 server** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it. - -2. Start the App-V 5.0 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. - -3. Review and accept the license terms, and choose whether to enable Microsoft updates. - -4. On the **Feature Selection** page, select all of the following components. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ComponentDescription

    Management server

    Provides overall management functionality for the App-V infrastructure.

    Management database

    Facilitates database predeployments for App-V management.

    Publishing server

    Provides hosting and streaming functionality for virtual applications.

    Reporting server

    Provides App-V 5.0 reporting services.

    Reporting database

    Facilitates database predeployments for App-V reporting.

    - - - -5. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. - -6. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. - - - - - - - - - - - - - - - - - - - - - - -
    MethodWhat you need to do

    You are using a custom Microsoft SQL Server instance.

    Select Use the custom instance, and type the name of the instance.

    -

    Use the format INSTANCENAME. The assumed installation location is the local computer.

    -

    Not supported: A server name using the format ServerName<strong>INSTANCE.

    You are using a custom database name.

    Select Custom configuration and type the database name.

    -

    The database name must be unique, or the installation will fail.

    - - - -7. On the **Configure** page, accept the default value **Use this local computer**. - - **Note** - If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. - - - -8. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. - - - - - - - - - - - - - - - - - - - - - - -
    MethodWhat you need to do

    You are using a custom Microsoft SQL Server instance.

    Select Use the custom instance, and type the name of the instance.

    -

    Use the format INSTANCENAME. The assumed installation location is the local computer.

    -

    Not supported: A server name using the format ServerName<strong>INSTANCE.

    You are using a custom database name.

    Select Custom configuration and type the database name.

    -

    The database name must be unique, or the installation will fail.

    - - - -9. On the **Configure** page, accept the default value: **Use this local computer**. - - **Note** - If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. - - - -10. On the **Configure** (Management Server Configuration) page, specify the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Item to configureDescription and examples

    Type the AD group with sufficient permissions to manage the App-V environment.

    Example: MyDomain\MyUser

    -

    After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action.

    Website name: Specify the custom name that will be used to run the publishing service.

    If you do not have a custom name, do not make any changes.

    Port binding: Specify a unique port number that will be used by App-V.

    Example: 12345

    -

    Ensure that the port specified is not being used by another website.

    - - - -11. On the **Configure** **Publishing Server Configuration** page, specify the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Item to configureDescription and examples

    Specify the URL for the management service.

    Example: http://localhost:12345

    Website name: Specify the custom name that will be used to run the publishing service.

    If you do not have a custom name, do not make any changes.

    Port binding: Specify a unique port number that will be used by App-V.

    Example: 54321

    -

    Ensure that the port specified is not being used by another website.

    - - - -12. On the **Reporting Server** page, specify the following: - - - - - - - - - - - - - - - - - - - - - - -
    Item to configureDescription and examples

    Website name: Specify the custom name that will be used to run the Reporting Service.

    If you do not have a custom name, do not make any changes.

    Port binding: Specify a unique port number that will be used by App-V.

    Example: 55555

    -

    Ensure that the port specified is not being used by another website.

    - - - -13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. - -14. To verify that the setup completed successfully, open a web browser, and type the following URL: - - **http://<Management server machine name>:<Management service port number>/Console.html**. - - Example: **http://localhost:12345/console.html**. If the installation succeeded, the App-V Management console is displayed with no errors. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md) - -[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer.md) - -[How to Deploy the App-V 5.0 Server Using a Script](how-to-deploy-the-app-v-50-server-using-a-script.md) - -[How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md b/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md deleted file mode 100644 index 03f183eae8..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md +++ /dev/null @@ -1,757 +0,0 @@ ---- -title: How to Deploy the App-V 5.0 Server Using a Script -description: How to Deploy the App-V 5.0 Server Using a Script -author: dansimp -ms.assetid: b91a35c8-df9e-4065-9187-abafbe565b84 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/15/2018 ---- - - -# How to Deploy the App-V 5.0 Server Using a Script - - -In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. - -Use the following tables for more information about installing the App-V 5.0 server using the command line. - ->[!NOTE] -> The information in the following tables can also be accessed using the command line by typing the following command: ->``` -> appv\_server\_setup.exe /? ->``` - -## Common parameters and Examples - - - - - - - - - - - - -

    To Install the Management server and Management database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /MANAGEMENT_SERVER

    • -
    • /MANAGEMENT_ADMINACCOUNT

    • -
    • /MANAGEMENT_WEBSITE_NAME

    • -
    • /MANAGEMENT_WEBSITE_PORT

    • -
    • /DB_PREDEPLOY_MANAGEMENT

    • -
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /MANAGEMENT_DB_NAME

    • -
    -

    To use a custom instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /MANAGEMENT_SERVER

    • -
    • /MANAGEMENT_ADMINACCOUNT

    • -
    • /MANAGEMENT_WEBSITE_NAME

    • -
    • /MANAGEMENT_WEBSITE_PORT

    • -
    • /DB_PREDEPLOY_MANAGEMENT

    • -
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -
    • /MANAGEMENT_DB_NAME

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    - - - - - - - - - - - - -

    To Install the Management server using an existing Management database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /MANAGEMENT_SERVER

    • -
    • /MANAGEMENT_ADMINACCOUNT

    • -
    • /MANAGEMENT_WEBSITE_NAME

    • -
    • /MANAGEMENT_WEBSITE_PORT

    • -
    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    • -
    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /EXISTING_MANAGEMENT_DB_NAME

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /MANAGEMENT_SERVER

    • -
    • /MANAGEMENT_ADMINACCOUNT

    • -
    • /MANAGEMENT_WEBSITE_NAME

    • -
    • /MANAGEMENT_WEBSITE_PORT

    • -
    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    • -
    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -
    • /EXISTING_MANAGEMENT_DB_NAME

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    -

    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

    -

    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

      - - - - - - - - - - - - -

    To install the Management server using an existing Management database on a remote machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /MANAGEMENT_SERVER

    • -
    • /MANAGEMENT_ADMINACCOUNT

    • -
    • /MANAGEMENT_WEBSITE_NAME

    • -
    • /MANAGEMENT_WEBSITE_PORT

    • -
    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

    • -
    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /EXISTING_MANAGEMENT_DB_NAME

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /MANAGEMENT_SERVER

    • -
    • /MANAGEMENT_ADMINACCOUNT

    • -
    • /MANAGEMENT_WEBSITE_NAME

    • -
    • /MANAGEMENT_WEBSITE_PORT

    • -
    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

    • -
    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -
    • /EXISTING_MANAGEMENT_DB_NAME

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /MANAGEMENT_SERVER

    -

    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”

    -

    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”

    -

    /MANAGEMENT_WEBSITE_PORT=”8080”

    -

    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”

    -

    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”

    -

    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”

    - - - - - - - - - - - - -

    To Install the Management database and the Management Server on the same computer.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /DB_PREDEPLOY_MANAGEMENT

    • -
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /MANAGEMENT_DB_NAME

    • -
    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    • -
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /DB_PREDEPLOY_MANAGEMENT

    • -
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -
    • /MANAGEMENT_DB_NAME

    • -
    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    • -
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    -

    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    -

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    - - - - - - - - - - - - -

    To install the Management database on a different computer than the Management server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /DB_PREDEPLOY_MANAGEMENT

    • -
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /MANAGEMENT_DB_NAME

    • -
    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    • -
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /DB_PREDEPLOY_MANAGEMENT

    • -
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE

    • -
    • /MANAGEMENT_DB_NAME

    • -
    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    • -
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_MANAGEMENT

    -

    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /MANAGEMENT_DB_NAME=”AppVManagement”

    -

    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

    -

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    - - - - - - - - - - - - -

    To Install the publishing server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /PUBLISHING_SERVER

    • -
    • /PUBLISHING_MGT_SERVER

    • -
    • /PUBLISHING_WEBSITE_NAME

    • -
    • /PUBLISHING_WEBSITE_PORT

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /PUBLISHING_SERVER

    -

    /PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”

    -

    /PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”

    -

    /PUBLISHING_WEBSITE_PORT=”8081”

    - - - - - - - - - - - - -

    To Install the Reporting server and Reporting database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /REPORTING _SERVER

    • -
    • /REPORTING _WEBSITE_NAME

    • -
    • /REPORTING _WEBSITE_PORT

    • -
    • /DB_PREDEPLOY_REPORTING

    • -
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /REPORTING _DB_NAME

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /REPORTING _SERVER

    • -
    • /REPORTING _ADMINACCOUNT

    • -
    • /REPORTING _WEBSITE_NAME

    • -
    • /REPORTING _WEBSITE_PORT

    • -
    • /DB_PREDEPLOY_REPORTING

    • -
    • /REPORTING _DB_CUSTOM_SQLINSTANCE

    • -
    • /REPORTING _DB_NAME

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -
      -
    • /appv_server_setup.exe /QUIET

    • -
    • /REPORTING_SERVER

    • -
    • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    • -
    • /REPORTING_WEBSITE_PORT=”8082”

    • -
    • /DB_PREDEPLOY_REPORTING

    • -
    • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    • -
    • /REPORTING_DB_NAME=”AppVReporting”

    • -
    - - - - - - - - - - - - -

    To Install the Reporting server and using an existing Reporting database on a local machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /REPORTING _SERVER

    • -
    • /REPORTING _WEBSITE_NAME

    • -
    • /REPORTING _WEBSITE_PORT

    • -
    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    • -
    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /EXISTING_REPORTING _DB_NAME

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /REPORTING _SERVER

    • -
    • /REPORTING _ADMINACCOUNT

    • -
    • /REPORTING _WEBSITE_NAME

    • -
    • /REPORTING _WEBSITE_PORT

    • -
    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    • -
    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

    • -
    • /EXISTING_REPORTING _DB_NAME

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /REPORTING_SERVER

    -

    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    -

    /REPORTING_WEBSITE_PORT=”8082”

    -

    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    -

    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /EXITING_REPORTING_DB_NAME=”AppVReporting”

    - - - - - - - - - - - - -

    To Install the Reporting server using an existing Reporting database on a remote machine.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /REPORTING _SERVER

    • -
    • /REPORTING _WEBSITE_NAME

    • -
    • /REPORTING _WEBSITE_PORT

    • -
    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

    • -
    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /EXISTING_REPORTING _DB_NAME

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /REPORTING _SERVER

    • -
    • /REPORTING _ADMINACCOUNT

    • -
    • /REPORTING _WEBSITE_NAME

    • -
    • /REPORTING _WEBSITE_PORT

    • -
    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

    • -
    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE

    • -
    • /EXISTING_REPORTING _DB_NAME

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /REPORTING_SERVER

    -

    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”

    -

    /REPORTING_WEBSITE_PORT=”8082”

    -

    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”

    -

    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /EXITING_REPORTING_DB_NAME=”AppVReporting”

    - - - - - - - - - - - - -

    To install the Reporting database on the same computer as the Reporting server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /DB_PREDEPLOY_REPORTING

    • -
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /REPORTING _DB_NAME

    • -
    • /REPORTING_SERVER_MACHINE_USE_LOCAL

    • -
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /DB_PREDEPLOY_REPORTING

    • -
    • /REPORTING _DB_CUSTOM_SQLINSTANCE

    • -
    • /REPORTING _DB_NAME

    • -
    • /REPORTING_SERVER_MACHINE_USE_LOCAL

    • -
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_REPORTING

    -

    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /REPORTING_DB_NAME=”AppVReporting”

    -

    /REPORTING_SERVER_MACHINE_USE_LOCAL

    -

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    - - - - - - - - - - - - -

    To install the Reporting database on a different computer than the Reporting server.

    To use the default instance of Microsoft SQL Server, use the following parameters:

    -
      -
    • /DB_PREDEPLOY_REPORTING

    • -
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT

    • -
    • /REPORTING _DB_NAME

    • -
    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    • -
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
    -

    To use a custom instance of Microsoft SQL Server, use these parameters:

    -
      -
    • /DB_PREDEPLOY_REPORTING

    • -
    • /REPORTING _DB_CUSTOM_SQLINSTANCE

    • -
    • /REPORTING _DB_NAME

    • -
    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    • -
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    • -
    -

    Using a custom instance of Microsoft SQL Server example:

    -

    /appv_server_setup.exe /QUIET

    -

    /DB_PREDEPLOY_REPORTING

    -

    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”

    -

    /REPORTING_DB_NAME=”AppVReporting”

    -

    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”

    -

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”

    - -## Parameter Definitions - -### General Parameters - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /QUIET

    Specifies silent install.

    /UNINSTALL

    Specifies an uninstall.

    /LAYOUT

    Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.

    /LAYOUTDIR

    Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”

    /INSTALLDIR

    Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”

    /MUOPTIN

    Enables Microsoft Update. No value is expected

    /ACCEPTEULA

    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

    - -### Management Server Installation Parameters - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /MANAGEMENT_SERVER

    Specifies that the management server will be installed. No value is expected

    /MANAGEMENT_ADMINACCOUNT

    Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".

    /MANAGEMENT_WEBSITE_NAME

    Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”

    MANAGEMENT_WEBSITE_PORT

    Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.

    - -### Parameters for the Management Server Database - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /DB_PREDEPLOY_MANAGEMENT

    Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected

    /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance should be used. No value is expected.

    /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

    /MANAGEMENT_DB_NAME

    Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.

    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL

    Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT

    Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”

    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT

    Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”

    - -### Parameters for Installing Publishing Server - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /PUBLISHING_SERVER

    Specifies that the Publishing Server will be installed. No value is expected

    /PUBLISHING_MGT_SERVER

    Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored

    /PUBLISHING_WEBSITE_NAME

    Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”

    /PUBLISHING_WEBSITE_PORT

    Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83

    - -### Parameters for Reporting Server - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /REPORTING_SERVER

    Specifies that the Reporting Server will be installed. No value is expected

    /REPORTING_WEBSITE_NAME

    Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"

    /REPORTING_WEBSITE_PORT

    Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82

    - - - -### Parameters for using an Existing Reporting Server Database - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL

    Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.

    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME

    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

    /EXISTING_ REPORTING DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.

    /EXISTING REPORTING_DB_CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

    /EXISTING_ REPORTING _DB_NAME

    Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_NAME="AppVReporting"

    - -### Parameters for installing Reporting Server Database - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /DB_PREDEPLOY_REPORTING

    Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected

    /REPORTING_DB_SQLINSTANCE_USE_DEFAULT

    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"

    /REPORTING_DB_NAME

    Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"

    /REPORTING_SERVER_MACHINE_USE_LOCAL

    Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.

    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT

    Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"

    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT

    Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"

    - -### Parameters for using an existing Management Server Database - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterInformation

    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL

    Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME

    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"

    /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT

    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE

    Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    /EXISTING_MANAGEMENT_DB_NAME

    Specifies the name of the existing management database that should be used. Example usage: /EXISTING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.

    -

    -

    Got a suggestion for App-V? Add or vote on suggestions here. Got an App-V issue? Use the App-V TechNet Forum.

    - - -## Related topics - -[Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md b/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md deleted file mode 100644 index 5a39bf03ab..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md +++ /dev/null @@ -1,380 +0,0 @@ ---- -title: How to Deploy the App-V 5.1 Server Using a Script -description: How to Deploy the App-V 5.1 Server Using a Script -author: dansimp -ms.assetid: 15c33d7b-9b61-4dbc-8674-399bb33e5f7e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 03/20/2020 ---- - -# How to Deploy the App-V 5.1 Server Using a Script - -In order to complete the **appv\_server\_setup.exe** Server setup successfully using the command line, you must specify and combine multiple parameters. - -## Install the App-V 5.1 server using a script - -- Use the following information about installing the App-V 5.1 server using the command line. - - > [!NOTE] - > The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**. - -### Install the Management server and Management database on a local machine - -The following parameters are valid with both the default and custom instance of Microsoft SQL Server: - -- /MANAGEMENT_SERVER -- /MANAGEMENT_ADMINACCOUNT -- /MANAGEMENT_WEBSITE_NAME -- /MANAGEMENT_WEBSITE_PORT -- /DB_PREDEPLOY_MANAGEMENT -- /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT -- /MANAGEMENT_DB_NAME - -**Example: Using a custom instance of Microsoft SQL Server** - -```dos -appv_server_setup.exe /QUIET /MANAGEMENT_SERVER /MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" /MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" /MANAGEMENT_WEBSITE_PORT="8080" /DB_PREDEPLOY_MANAGEMENT /MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /MANAGEMENT_DB_NAME="AppVManagement" -``` - -### Install the Management server using an existing Management database on a local machine - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /MANAGEMENT_SERVER -- /MANAGEMENT_ADMINACCOUNT -- /MANAGEMENT_WEBSITE_NAME -- /MANAGEMENT_WEBSITE_PORT -- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL -- */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -- /EXISTING_MANAGEMENT_DB_NAME - -To use a custom instance of Microsoft SQL Server, use the following parameters (difference from default instance in *italic*): - -- /MANAGEMENT_SERVER -- /MANAGEMENT_ADMINACCOUNT -- /MANAGEMENT_WEBSITE_NAME -- /MANAGEMENT_WEBSITE_PORT -- /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL -- */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -- /EXISTING_MANAGEMENT_DB_NAME - -**Example: Using a custom instance of Microsoft SQL Server** - -```dos -appv_server_setup.exe /QUIET /MANAGEMENT_SERVER /MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" /MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" /MANAGEMENT_WEBSITE_PORT="8080" /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName" /EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" -``` - -### Install the Management server using an existing Management database on a remote machine - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /MANAGEMENT_SERVER -- /MANAGEMENT_ADMINACCOUNT -- /MANAGEMENT_WEBSITE_NAME -- /MANAGEMENT_WEBSITE_PORT -- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME -- */EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -- /EXISTING_MANAGEMENT_DB_NAME - -To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): - -- /MANAGEMENT_SERVER -- /MANAGEMENT_ADMINACCOUNT -- /MANAGEMENT_WEBSITE_NAME -- /MANAGEMENT_WEBSITE_PORT -- /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME -- */EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -- /EXISTING_MANAGEMENT_DB_NAME - -**Example: Using a custom instance of Microsoft SQL Server:** - -```dos -appv_server_setup.exe /QUIET /MANAGEMENT_SERVER /MANAGEMENT_ADMINACCOUNT="Domain\AdminGroup" /MANAGEMENT_WEBSITE_NAME="Microsoft AppV Management Service" /MANAGEMENT_WEBSITE_PORT="8080" /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME="SqlServermachine.domainName" /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE ="SqlInstanceName" /EXISTING_MANAGEMENT_DB_NAME ="AppVManagement" -``` - -### Install the Management database and the Management Server on the same computer - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /DB_PREDEPLOY_MANAGEMENT -- */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -- /MANAGEMENT_DB_NAME -- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL -- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT - -To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): - -- /DB_PREDEPLOY_MANAGEMENT -- */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -- /MANAGEMENT_DB_NAME -- /MANAGEMENT_SERVER_MACHINE_USE_LOCAL -- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT - -**Example: Using a custom instance of Microsoft SQL Server** - -```dos -appv_server_setup.exe /QUIET /DB_PREDEPLOY_MANAGEMENT /MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /MANAGEMENT_DB_NAME="AppVManagement" /MANAGEMENT_SERVER_MACHINE_USE_LOCAL /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -``` - -### Install the Management database on a different computer than the Management server - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /DB_PREDEPLOY_MANAGEMENT -- */MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT* -- /MANAGEMENT_DB_NAME -- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT -- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT - -To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): - -- /DB_PREDEPLOY_MANAGEMENT -- */MANAGEMENT_DB_CUSTOM_SQLINSTANCE* -- /MANAGEMENT_DB_NAME -- /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT -- /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT - -**Example: Using a custom instance of Microsoft SQL Server** - -```dos -appv_server_setup.exe /QUIET /DB_PREDEPLOY_MANAGEMENT /MANAGEMENT_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /MANAGEMENT_DB_NAME="AppVManagement" /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount" /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -``` - -### Install the publishing server - -To use the default instance of Microsoft SQL Server, use the following parameters: - -- /PUBLISHING_SERVER -- /PUBLISHING_MGT_SERVER -- /PUBLISHING_WEBSITE_NAME -- /PUBLISHING_WEBSITE_PORT - -**Example: Using a custom instance of Microsoft SQL Server:** - -```dos -appv_server_setup.exe /QUIET /PUBLISHING_SERVER /PUBLISHING_MGT_SERVER="http://ManagementServerName:ManagementPort" /PUBLISHING_WEBSITE_NAME="Microsoft AppV Publishing Service" /PUBLISHING_WEBSITE_PORT="8081" -``` - -### Install the Reporting server and Reporting database on a local machine - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /REPORTING _SERVER -- /REPORTING _WEBSITE_NAME -- /REPORTING _WEBSITE_PORT -- /DB_PREDEPLOY_REPORTING -- */REPORTING _DB_SQLINSTANCE_USE_DEFAULT* -- /REPORTING _DB_NAME - -To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): - -- /REPORTING _SERVER -- */REPORTING _ADMINACCOUNT* -- /REPORTING _WEBSITE_NAME -- /REPORTING _WEBSITE_PORT -- /DB_PREDEPLOY_REPORTING -- */REPORTING _DB_CUSTOM_SQLINSTANCE* -- /REPORTING _DB_NAME - -**Example: Using a custom instance of Microsoft SQL Server:** - -```dos -appv_server_setup.exe /QUIET /REPORTING_SERVER /REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" /REPORTING_WEBSITE_PORT="8082" /DB_PREDEPLOY_REPORTING /REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /REPORTING_DB_NAME="AppVReporting" -``` - -### Install the Reporting server and using an existing Reporting database on a local machine - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /REPORTING _SERVER -- /REPORTING _WEBSITE_NAME -- /REPORTING _WEBSITE_PORT -- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL -- */EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT* -- /EXISTING_REPORTING _DB_NAME - -To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): - -- /REPORTING _SERVER -- */REPORTING _ADMINACCOUNT* -- /REPORTING _WEBSITE_NAME -- /REPORTING _WEBSITE_PORT -- /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL -- */EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE* -- /EXISTING_REPORTING _DB_NAME - -**Example: Using a custom instance of Microsoft SQL Server:** - -```dos -appv_server_setup.exe /QUIET /REPORTING_SERVER /REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" /REPORTING_WEBSITE_PORT="8082" /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /EXITING_REPORTING_DB_NAME="AppVReporting" -``` - -### Install the Reporting server using an existing Reporting database on a remote machine - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /REPORTING _SERVER -- /REPORTING _WEBSITE_NAME -- /REPORTING _WEBSITE_PORT -- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME -- */EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT* -- /EXISTING_REPORTING _DB_NAME - -To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): - -- /REPORTING _SERVER -- */REPORTING _ADMINACCOUNT* -- /REPORTING _WEBSITE_NAME -- /REPORTING _WEBSITE_PORT -- /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME -- */EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE* -- /EXISTING_REPORTING _DB_NAME - -**Example: Using a custom instance of Microsoft SQL Server:** - -```dos -appv_server_setup.exe /QUIET /REPORTING_SERVER /REPORTING_WEBSITE_NAME="Microsoft AppV Reporting Service" /REPORTING_WEBSITE_PORT="8082" /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME="SqlServerMachine.DomainName" /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /EXITING_REPORTING_DB_NAME="AppVReporting" -``` - -### Install the Reporting database on the same computer as the Reporting server - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /DB_PREDEPLOY_REPORTING -- */REPORTING _DB_SQLINSTANCE_USE_DEFAULT* -- /REPORTING _DB_NAME -- /REPORTING_SERVER_MACHINE_USE_LOCAL -- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT - -To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): - -- /DB_PREDEPLOY_REPORTING -- */REPORTING _DB_CUSTOM_SQLINSTANCE* -- /REPORTING _DB_NAME -- /REPORTING_SERVER_MACHINE_USE_LOCAL -- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT - -**Example: Using a custom instance of Microsoft SQL Server:** - -```dos -appv_server_setup.exe /QUIET /DB_PREDEPLOY_REPORTING /REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /REPORTING_DB_NAME="AppVReporting" /REPORTING_SERVER_MACHINE_USE_LOCAL /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -``` - -### Install the Reporting database on a different computer than the Reporting server - -To use the default instance of Microsoft SQL Server, use the following parameters (difference from custom instance in *italic*): - -- /DB_PREDEPLOY_REPORTING -- /REPORTING _DB_SQLINSTANCE_USE_DEFAULT -- /REPORTING _DB_NAME -- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT -- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT - -To use a custom instance of Microsoft SQL Server, use these parameters (difference from default instance in *italic*): - -- /DB_PREDEPLOY_REPORTING -- /REPORTING _DB_CUSTOM_SQLINSTANCE -- /REPORTING _DB_NAME -- /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT -- /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT - -**Example: Using a custom instance of Microsoft SQL Server:** - -```dos - appv_server_setup.exe /QUIET /DB_PREDEPLOY_REPORTING /REPORTING_DB_CUSTOM_SQLINSTANCE="SqlInstanceName" /REPORTING_DB_NAME="AppVReporting" /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT="Domain\MachineAccount" /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="Domain\InstallAdminAccount" -``` - -### Parameter Definitions - -#### General Parameters - -| Parameter | Information | -|--|--| -| /QUIET | Specifies silent install. | -| /UNINSTALL | Specifies an uninstall. | -| /LAYOUT | Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected. | -| /LAYOUTDIR | Specifies the layout directory. Takes a string. Example usage: **/LAYOUTDIR="C:\\Application Virtualization Server"** | -| /INSTALLDIR | Specifies the installation directory. Takes a string. Example usage: **/INSTALLDIR="C:\\Program Files\\Application Virtualization\\Server"** | -| /MUOPTIN | Enables Microsoft Update. No value is expected. | -| /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage: **/ACCEPTEULA** or **/ACCEPTEULA=1** | - -#### Management Server Installation Parameters - -|Parameter |Information | -|--|--| -| /MANAGEMENT_SERVER | Specifies that the management server will be installed. No value is expected | -| /MANAGEMENT_ADMINACCOUNT | Specifies the account that will be allowed Administrator access to the management server. This can be a user account or a group. Example usage: **/MANAGEMENT_ADMINACCOUNT="mydomain\\admin"**. If **/MANAGEMENT_SERVER** is not specified, this will be ignored. | -| /MANAGEMENT_WEBSITE_NAME | Specifies name of the website that will be created for the management service. Example usage: **/MANAGEMENT_WEBSITE_NAME="Microsoft App-V Management Service"** | -| MANAGEMENT_WEBSITE_PORT | Specifies the port number that will be used by the management service will use. Example usage: **/MANAGEMENT_WEBSITE_PORT=82** | - -#### Parameters for the Management Server Database - -| Parameter | Information | -|--|--| -| /DB_PREDEPLOY_MANAGEMENT | Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected. | -| /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance should be used. No value is expected. | -| /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: **/MANAGEMENT_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"**. If **/DB_PREDEPLOY_MANAGEMENT** is not specified, this will be ignored. | -| /MANAGEMENT_DB_NAME | Specifies the name of the new management database that should be created. Example usage: **/MANAGEMENT_DB_NAME="AppVMgmtDB"**. If **/DB_PREDEPLOY_MANAGEMENT** is not specified, this will be ignored. | -| /MANAGEMENT_SERVER_MACHINE_USE_LOCAL | Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. | -| /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the management server will be installed on. Example usage: **/MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT="domain\\computername"** | -| /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the management server. Example usage: **/MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT ="domain\\alias"** | - -#### Parameters for Installing Publishing Server - -| Parameter | Information | -|--|--| -| /PUBLISHING_SERVER | Specifies that the Publishing Server will be installed. No value is expected. | -| /PUBLISHING_MGT_SERVER | Specifies the URL to Management Service the Publishing server will connect to. Example usage: **http://<management server name>:<Management server port number>**. If **/PUBLISHING_SERVER** is not used, this parameter will be ignored. | -| /PUBLISHING_WEBSITE_NAME | Specifies name of the website that will be created for the publishing service. Example usage: **/PUBLISHING_WEBSITE_NAME="Microsoft App-V Publishing Service"** | -| /PUBLISHING_WEBSITE_PORT | Specifies the port number used by the publishing service. Example usage: **/PUBLISHING_WEBSITE_PORT=83** | - -#### Parameters for Reporting Server - -| Parameter | Information | -|--|--| -| /REPORTING_SERVER | Specifies that the Reporting Server will be installed. No value is expected. | -| /REPORTING_WEBSITE_NAME | Specifies name of the website that will be created for the Reporting Service. Example usage: **/REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"** | -| /REPORTING_WEBSITE_PORT | Specifies the port number that the Reporting Service will use. Example usage: **/REPORTING_WEBSITE_PORT=82** | - -#### Parameters for using an Existing Reporting Server Database - -| Parameter | Information | -|--|--| -| /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL | Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected. | -| /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. Example usage: **/EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"** | -| /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. | -| /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that should be used. Takes a string. Example usage: **/EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"** | -| /EXISTING_ REPORTING _DB_NAME | Specifies the name of the existing Reporting database that should be used. Takes a string. Example usage: **/EXISTING_REPORTING_DB_NAME="AppVReporting"** | - -#### Parameters for installing Reporting Server Database - -| Parameter | Information | -|--|--| -| /DB_PREDEPLOY_REPORTING | Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected. | -| /REPORTING_DB_SQLINSTANCE_USE_DEFAULT | Specifies the name of the custom SQL instance that should be used. Takes a string. Example usage: **/REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"** | -| /REPORTING_DB_NAME | Specifies the name of the new Reporting database that should be created. Takes a string. Example usage: **/REPORTING_DB_NAME="AppVMgmtDB"** | -| /REPORTING_SERVER_MACHINE_USE_LOCAL | Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected. | -| /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT | Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. Example usage: **/REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT="domain\computername"** | -| /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT | Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. Example usage: **/REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT="domain\\alias"** | - -#### Parameters for using an existing Management Server Database - -| Parameter | Information | -|--|--| -| /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL | Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If **/DB_PREDEPLOY_MANAGEMENT** is specified, this will be ignored. | -| /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME | Specifies the name of the remote computer that SQL Server is installed on. Takes a string. Example usage: **/EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"** | -| /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT | Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If **/DB_PREDEPLOY_MANAGEMENT** is specified, this will be ignored. | -| /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE | Specifies the name of the custom SQL instance that will be used. Example usage **/EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE="AppVManagement"**. If **/DB_PREDEPLOY_MANAGEMENT** is specified, this will be ignored. | -| /EXISTING_MANAGEMENT_DB_NAME | Specifies the name of the existing management database that should be used. Example usage: **/EXISTING_MANAGEMENT_DB_NAME="AppVMgmtDB"**. If **/DB_PREDEPLOY_MANAGEMENT** is specified, this will be ignored. | - -Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - -[Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md b/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md deleted file mode 100644 index 97b1877022..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md +++ /dev/null @@ -1,278 +0,0 @@ ---- -title: How to Deploy the App-V 5.1 Server -description: How to Deploy the App-V 5.1 Server -author: dansimp -ms.assetid: 4729beda-b98f-481b-ae74-ad71c59b1d69 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V 5.1 Server - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 server. For information about deploying the App-V 5.1 Server, see [About App-V 5.1](about-app-v-51.md#bkmk-migrate-to-51). - -**Before you start:** - -- Ensure that you’ve installed prerequisite software. See [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -- Review the server section of [App-V 5.1 Security Considerations](app-v-51-security-considerations.md). - -- Specify a port where each component will be hosted. - -- Add firewall rules to allow incoming requests to access the specified ports. - -- If you use SQL scripts, instead of the Windows Installer, to set up the Management database or Reporting database, you must run the SQL scripts before installing the Management Server or Reporting Server. See [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md). - -**To install the App-V 5.1 server** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it. - -2. Start the App-V 5.1 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. - -3. Review and accept the license terms, and choose whether to enable Microsoft updates. - -4. On the **Feature Selection** page, select all of the following components. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ComponentDescription

    Management server

    Provides overall management functionality for the App-V infrastructure.

    Management database

    Facilitates database predeployments for App-V management.

    Publishing server

    Provides hosting and streaming functionality for virtual applications.

    Reporting server

    Provides App-V 5.1 reporting services.

    Reporting database

    Facilitates database predeployments for App-V reporting.

    - - - -5. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line. - -6. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below. - - - - - - - - - - - - - - - - - - - - - - -
    MethodWhat you need to do

    You are using a custom Microsoft SQL Server instance.

    Select Use the custom instance, and type the name of the instance.

    -

    Use the format INSTANCENAME. The assumed installation location is the local computer.

    -

    Not supported: A server name using the format ServerName<strong>INSTANCE.

    You are using a custom database name.

    Select Custom configuration and type the database name.

    -

    The database name must be unique, or the installation will fail.

    - - - -7. On the **Configure** page, accept the default value **Use this local computer**. - - **Note** - If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. - - - -8. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below. - - - - - - - - - - - - - - - - - - - - - - -
    MethodWhat you need to do

    You are using a custom Microsoft SQL Server instance.

    Select Use the custom instance, and type the name of the instance.

    -

    Use the format INSTANCENAME. The assumed installation location is the local computer.

    -

    Not supported: A server name using the format ServerName<strong>INSTANCE.

    You are using a custom database name.

    Select Custom configuration and type the database name.

    -

    The database name must be unique, or the installation will fail.

    - - - -9. On the **Configure** page, accept the default value: **Use this local computer**. - - **Note** - If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed. - - - -10. On the **Configure** (Management Server Configuration) page, specify the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Item to configureDescription and examples

    Type the AD group with sufficient permissions to manage the App-V environment.

    Example: MyDomain\MyUser

    -

    After installation, you can add additional users or groups by using the Management console. However, global security groups and Active Directory Domain Services (AD DS) distribution groups are not supported. You must use Domain local or Universal groups are required to perform this action.

    Website name: Specify the custom name that will be used to run the publishing service.

    If you do not have a custom name, do not make any changes.

    Port binding: Specify a unique port number that will be used by App-V.

    Example: 12345

    -

    Ensure that the port specified is not being used by another website.

    - - - -11. On the **Configure** **Publishing Server Configuration** page, specify the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Item to configureDescription and examples

    Specify the URL for the management service.

    Example: http://localhost:12345

    Website name: Specify the custom name that will be used to run the publishing service.

    If you do not have a custom name, do not make any changes.

    Port binding: Specify a unique port number that will be used by App-V.

    Example: 54321

    -

    Ensure that the port specified is not being used by another website.

    - - - -12. On the **Reporting Server** page, specify the following: - - - - - - - - - - - - - - - - - - - - - - -
    Item to configureDescription and examples

    Website name: Specify the custom name that will be used to run the Reporting Service.

    If you do not have a custom name, do not make any changes.

    Port binding: Specify a unique port number that will be used by App-V.

    Example: 55555

    -

    Ensure that the port specified is not being used by another website.

    - - - -13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page. - -14. To verify that the setup completed successfully, open a web browser, and type the following URL: - - **http://<Management server machine name>:<Management service port number>/Console.html**. - - Example: **http://localhost:12345/console.html**. If the installation succeeded, the App-V Management console is displayed with no errors. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md) - -[How to Install the Publishing Server on a Remote Computer](how-to-install-the-publishing-server-on-a-remote-computer51.md) - -[How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md b/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md deleted file mode 100644 index f89ee280f9..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md +++ /dev/null @@ -1,374 +0,0 @@ ---- -title: How to Deploy the App-V Client -description: How to Deploy the App-V Client -author: dansimp -ms.assetid: 981f57c9-56c3-45da-8261-0972bfad3e5b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Deploy the App-V Client - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 client and Remote Desktop Services client. You must install the version of the client that matches the operating system of the target computer. - -**What to do before you start** - -1. Review and install the software prerequisites: - - Install the prerequisite software that corresponds to the version of App-V that you are installing: - - - [About App-V 5.1](about-app-v-51.md) - - - [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) - -2. Review the client coexistence and unsupported scenarios, as applicable to your installation: - - - - - - - - - - - - - - - - -

    Deploying coexisting App-V clients

    Planning for the App-V 5.1 Sequencer and Client Deployment

    Unsupported or limited installation scenarios

    See the client section in App-V 5.1 Supported Configurations

    - - - -3. Review the locations for client registry, log, and troubleshooting information: - - ---- - - - - - - - - - - - - - - -

    Client registry information

      -
    • By default, after you install the App-V 5.1 client, the client information is stored in the registry in the following registry key:

      -

      HKEY_LOCAL_MACHINE \ SOFTWARE \ MICROSOFT \ APPV \ CLIENT

    • -
    • When you deploy a virtualized package to a computer that is running the App-V client, the associated package data is stored in the following location:

      -

      C: \ ProgramData \ App-V

      -

      However, you can reconfigure this location with the following registry key:

      -

      HKEY_LOCAL_MACHINE \ SOFTWARE \ MICROSOFT \ SOFTWARE \ MICROSOFT \ APPV \ CLIENT \ STREAMING \ PACKAGEINSTALLATIONROOT

    • -

    Client log files

      -
    • For log file information that is associated with the App-V 5.1 Client, search in the following log:

      -

      Event logs / Applications and Services Logs / Microsoft / AppV

    • -
    • In App-V 5.0 SP3, some logs were consolidated and moved to the following location:

      -

      Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog

      -

      For a list of the moved logs, see About App-V 5.0 SP3.

    • -
    • Packages that are currently stored on computers that run the App-V 5.1 Client are saved to the following location:

      -

      C:\ProgramData\App-V&lt;package id>&lt;version id>

    • -

    Client installation troubleshooting information

    See the error log in the %temp% folder. To review the log files, click Start, type %temp%, and then look for the appv_ log.

    - - - -**To install the App-V 5.1 Client** - -1. Copy the App-V 5.1 client installation file to the computer on which it will be installed. Choose from the following client types: - - - - - - - - - - - - - - - - - - - - - - -
    Client typeFile to use

    Standard version of the client

    appv_client_setup.exe

    Remote Desktop Services version of the client

    appv_client_setup_rds.exe

    - - - -2. Double-click the installation file, and click **Install**. Before the installation begins, the installer checks the computer for any missing [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -3. Review and accept the Software License Terms, choose whether to use Microsoft Update and whether to participate in the Microsoft Customer Experience Improvement Program, and click **Install**. - -4. On the **Setup completed successfully** page, click **Close**. - - The installation creates the following entries for the App-V client in **Programs**: - - - **.exe** - - - **.msi** - - - **language pack** - - **Note** - After the installation, only the .exe file can be uninstalled. - - - -**To install the App-V 5.1 client using a script** - -1. Install all of the required prerequisite software on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If you install the client by using an .msi file, the installation will fail if any prerequisites are missing. - -2. To use a script to install the App-V 5.1 client, use the following parameters with **appv\_client\_setup.exe**. - - **Note** - The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    /INSTALLDIR

    Specifies the installation directory. Example usage: /INSTALLDIR=C:\Program Files\AppV Client

    /CEIPOPTIN

    Enables participation in the Customer Experience Improvement Program. Example usage: /CEIPOPTIN=[0|1]

    /MUOPTIN

    Enables Microsoft Update. Example usage: /MUOPTIN=[0|1]

    /PACKAGEINSTALLATIONROOT

    Specifies the directory in which to install all new applications and updates. Example usage: /PACKAGEINSTALLATIONROOT='C:\App-V Packages'

    /PACKAGESOURCEROOT

    Overrides the source location for downloading package content. Example usage: /PACKAGESOURCEROOT='http://packageStore'

    /AUTOLOAD

    Specifies how new packages will be loaded by App-V 5.1 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0].Example usage: /AUTOLOAD=[0|1|2]

    /SHAREDCONTENTSTOREMODE

    Specifies that streamed package contents will be not be saved to the local hard disk. Example usage: /SHAREDCONTENTSTOREMODE=[0|1]

    /MIGRATIONMODE

    Allows the App-V 5.1 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage: /MIGRATIONMODE=[0|1]

    /ENABLEPACKAGESCRIPTS

    Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage: /ENABLEPACKAGESCRIPTS=[0|1]

    /ROAMINGREGISTRYEXCLUSIONS

    Specifies the registry paths that will not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients

    /ROAMINGFILEEXCLUSIONS

    Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS 'desktop;my pictures'

    /S[1-5]PUBLISHINGSERVERNAME

    Displays the name of the publishing server. Example usage: /S2PUBLISHINGSERVERNAME=MyPublishingServer

    /S[1-5]PUBLISHINGSERVERURL

    Displays the URL of the publishing server. Example usage: /S2PUBLISHINGSERVERURL=\pubserver

    /S[1-5]GLOBALREFRESHENABLED -

    Enables a global publishing refresh. Example usage: /S2GLOBALREFRESHENABLED=[0|1]

    /S[1-5]GLOBALREFRESHONLOGON

    Initiates a global publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1]

    /S[1-5]GLOBALREFRESHINTERVAL -

    Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744]

    /S[1-5]GLOBALREFRESHINTERVALUNIT

    Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2GLOBALREFRESHINTERVALUNIT=[0|1]

    /S[1-5]USERREFRESHENABLED

    Enables user publishing refresh. Example usage: /S2USERREFRESHENABLED=[0|1]

    /S[1-5]USERREFRESHONLOGON

    Initiates a user publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1]

    /S[1-5]USERREFRESHINTERVAL -

    Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744]

    /S[1-5]USERREFRESHINTERVALUNIT

    Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2USERREFRESHINTERVALUNIT=[0|1]

    /Log

    Specifies a location where the log information is saved. The default location is %Temp%. Example usage: /log C:\logs\log.log

    /q

    Specifies an unattended installation.

    /REPAIR

    Repairs a previous client installation.

    /NORESTART

    Prevents the computer from rebooting after the client installation.

    -

    The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.1 and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V.

    /UNINSTALL

    Uninstalls the client.

    /ACCEPTEULA

    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

    /LAYOUT

    Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.1. No value is expected.

    /LAYOUTDIR

    Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”.

    /?, /h, /help

    Requests help about the previous installation parameters.

    - - - -**To install the App-V 5.1 client by using the Windows Installer (.msi) file** - -1. Install the required prerequisites on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If any prerequisites are not met, the installation will fail. - -2. Ensure that the target computers do not have any pending restarts before you install the client using the App-V 5.1 Windows Installer (.msi) files. The Windows Installer files do not flag a pending restart. - -3. Deploy one of the following Windows Installer files to the target computer. The file that you specify must match the configuration of the target computer. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type of deploymentDeploy this file

    Computer is running a 32-bit Microsoft Windows operating system

    appv_client_MSI_x86.msi

    Computer is running a 64-bit Microsoft Windows operating system

    appv_client_MSI_x64.msi

    You are deploying the App-V 5.1 Remote Desktop Services client

    appv_client_rds_MSI_x64.msi

    - - - -4. Using the information in the following table, select the appropriate language pack **.msi** to install, based on the desired language for the target computer. The **xxxx** in the table refers to the target locale of the language pack. - - **What to know before you start:** - - - The language packs are common to both the standard App-V 5.1 client and the Remote Desktop Services version of the App-V 5.1 client. - - - If you install the App-V 5.1 client using the **.exe**, the installer will deploy only the language pack that matches the operating system running on the target computer. - - - To deploy additional language packs on a target computer, use the procedure **To install the App-V 5.1 client by using Windows Installer (.msi) file**. - - - - - - - - - - - - - - - - - - - - - - -
    Type of deploymentDeploy this file

    Computer is running a 32-bit Microsoft Windows operating system

    appv_client_LP_xxxx_ x86.msi

    Computer is running a 64-bit Microsoft Windows operating system

    appv_client_LP_xxxx_ x64.msi

    - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[About Client Configuration Settings](about-client-configuration-settings51.md) - -[How to Uninstall the App-V 5.1 Client](how-to-uninstall-the-app-v-51-client.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md b/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md deleted file mode 100644 index 3197e02c38..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: How to Deploy the App-V Client -description: How to Deploy the App-V Client -ms.author: dansimp -author: dansimp -ms.assetid: 9c4e67ae-ddaf-4e23-8c16-72d029a74a27 -ms.reviewer: -manager: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/05/2018 ---- - - -# How to Deploy the App-V Client - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.0 client and Remote Desktop Services client. You must install the version of the client that matches the operating system of the target computer. - -**What to do before you start** - -1. Review and install the software prerequisites: - - Install the prerequisite software that corresponds to the version of App-V that you are installing: - - - [About App-V 5.0 SP3](about-app-v-50-sp3.md) - - - App-V 5.0 SP1 and App-V 5.0 SP2 – no new prerequisites in these versions - - - [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) - -2. Review the client coexistence and unsupported scenarios, as applicable to your installation: - - - | | | - |-----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------| - | Deploying coexisting App-V clients | [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) | - | Unsupported or limited installation scenarios | [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) | - - --- - -3. Review the locations for client registry, log, and troubleshooting information: - -#### Client registry information -
    • By default, after you install the App-V 5.0 client, the client information is stored in the registry in the following registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\APPV\CLIENT

    • When you deploy a virtualized package to a computer that is running the App-V client, the associated package data is stored in the following location:

      C:\ProgramData\App-V

      However, you can reconfigure this location with the following registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SOFTWARE\MICROSOFT\APPV\CLIENT\STREAMING\PACKAGEINSTALLATIONROOT

    - -#### Client log files -
    • For log file information that is associated with the App-V 5.0 Client, search in the following log:

      Event logs/Applications and Services Logs/Microsoft/AppV

    • In App-V 5.0 SP3, some logs have been consolidated and moved to the following location:

      Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog

      For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved).

    • Packages that are currently stored on computers that run the App-V 5.0 Client are saved to the following location:

      C:\ProgramData\App-V\<package id>\<version id>

    - -#### Client installation troubleshooting information -- See the error log in the **%temp%** folder. -- To review the log files, click **Start**, type **%temp%**, and then look for the **appv_ log**. - -## To install the App-V 5.0 Client - -1. Copy the App-V 5.0 client installation file to the computer on which it will be installed.

    Choose from the following client types: - - - | Client type | File to use | - |-----------------------------------------------|-------------------------------| - | Standard version of the client | **appv_client_setup.exe** | - | Remote Desktop Services version of the client | **appv_client_setup_rds.exe** | - - --- - -2. Double-click the installation file, and click **Install**. Before the installation begins, the installer checks the computer for any missing [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -3. Review and accept the Software License Terms, choose whether to use Microsoft Update and whether to participate in the Microsoft Customer Experience Improvement Program, and click **Install**. - -4. On the **Setup completed successfully** page, click **Close**. - - The installation creates the following entries for the App-V client in **Programs**: - - - **.exe** - - - **.msi** - - - **language pack** - - >[!NOTE] - >After the installation, only the .exe file can be uninstalled. - - -## To install the App-V 5.0 client using a script - -1. Install all of the required prerequisite software on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If you install the client by using an .msi file, the installation will fail if any prerequisites are missing. - -2. To use a script to install the App-V 5.0 client, use the following parameters with **appv\_client\_setup.exe**. - - >[!NOTE] - >The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter. - - | | | - |----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| - | /INSTALLDIR | Specifies the installation directory. Example usage:

    **/INSTALLDIR=C:\Program Files\AppV Client** | - | /CEIPOPTIN | Enables participation in the Customer Experience Improvement Program. Example usage:

    **/CEIPOPTIN=[0\|1\]** | - | /MUOPTIN | Enables Microsoft Update. Example usage:

    **/MUOPTIN=[0\|1\]** | - | /PACKAGEINSTALLATIONROOT | Specifies the directory in which to install all new applications and updates. Example usage:

    **/PACKAGEINSTALLATIONROOT='C:\App-V Packages'** | - | /PACKAGESOURCEROOT | Overrides the source location for downloading package content. Example usage:

    **/PACKAGESOURCEROOT=''** | - | /AUTOLOAD | Specifies how new packages will be loaded by App-V 5.0 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0]. Example usage:

    **/AUTOLOAD=[0\|1\|2\]** | - | /SHAREDCONTENTSTOREMODE | Specifies that streamed package contents will be not be saved to the local hard disk. Example usage:

    **/SHAREDCONTENTSTOREMODE=[0\|1\]** | - | /MIGRATIONMODE | Allows the App-V 5.0 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage:

    **/MIGRATIONMODE=[0\|1\]** | - | /ENABLEPACKAGESCRIPTS | Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage:

    **/ENABLEPACKAGESCRIPTS=[0\|1\]** | - | /ROAMINGREGISTRYEXCLUSIONS | Specifies the registry paths that will not roam with a user profile. Example usage:

    **/ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients** | - | /ROAMINGFILEEXCLUSIONS | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage:

    **/ROAMINGFILEEXCLUSIONS 'desktop;my pictures'** | - | /S[1-5]PUBLISHINGSERVERNAME | Displays the name of the publishing server. Example usage:

    **/S2PUBLISHINGSERVERNAME=MyPublishingServer** | - | /S[1-5]PUBLISHINGSERVERURL | Displays the URL of the publishing server. Example usage:

    **/S2PUBLISHINGSERVERURL=\\pubserver** | - | /S[1-5]GLOBALREFRESHENABLED | Enables a global publishing refresh. Example usage:

    **/S2GLOBALREFRESHENABLED=[0\|1\]** | - | /S[1-5]GLOBALREFRESHONLOGON | Initiates a global publishing refresh when a user logs on. Example usage:

    **/S2LOGONREFRESH=[0\|1\]** | - | /S[1-5]GLOBALREFRESHINTERVAL | Specifies the publishing refresh interval, where **0** indicates do not periodically refresh. Example usage: **/S2PERIODICREFRESHINTERVAL=[0-744]** | - | /S[1-5]GLOBALREFRESHINTERVALUNIT | Specifies the interval unit (Hours[0], Days[1]). Example usage:

    **/S2GLOBALREFRESHINTERVALUNIT=[0\|1\]** | - | /S[1-5]USERREFRESHENABLED | Enables user publishing refresh. Example usage: **/S2USERREFRESHENABLED=[0\|1\]** | - | /S[1-5]USERREFRESHONLOGON | Initiates a user publishing refresh when a user logs on. Example usage:

    **/S2LOGONREFRESH=[0\|1\]** | - | /S[1-5]USERREFRESHINTERVAL | Specifies the publishing refresh interval, where **0** indicates do not periodically refresh. Example usage: **/S2PERIODICREFRESHINTERVAL=[0-744]** | - | /S[1-5]USERREFRESHINTERVALUNIT | Specifies the interval unit (Hours[0], Days[1]). Example usage:

    **/S2USERREFRESHINTERVALUNIT=[0\|1\]** | - | /Log | Specifies a location where the log information is saved. The default location is %Temp%. Example usage:

    **/log C:\logs\log.log** | - | /q | Specifies an unattended installation. | - | /REPAIR | Repairs a previous client installation. | - | /NORESTART | Prevents the computer from rebooting after the client installation.

    The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.0 SPX and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V. | - | /UNINSTALL | Uninstalls the client. | - | /ACCEPTEULA | Accepts the license agreement. This is required for an unattended installation. Example usage:

    **/ACCEPTEULA** or **/ACCEPTEULA=1** | - | /LAYOUT | Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.0. No value is expected. | - | /LAYOUTDIR | Specifies the layout directory. Requires a string value. Example usage:

    **/LAYOUTDIR=”C:\Application Virtualization Client”** | - | /?, /h, /help | Requests help about the previous installation parameters. | - - --- - -## To install the App-V 5.0 client by using the Windows Installer (.msi) file - -1. Install the required prerequisites on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If any prerequisites are not met, the installation will fail. - -2. Ensure that the target computers do not have any pending restarts before you install the client using the App-V 5.0 Windows Installer (.msi) files. The Windows Installer files do not flag a pending restart. - -3. Deploy one of the following Windows Installer files to the target computer. The file that you specify must match the configuration of the target computer. - - - | Type of deployment | Deploy this file | - |-----------------------------------------------------------------|-----------------------------| - | Computer is running a 32-bit Microsoft Windows operating system | appv_client_MSI_x86.msi | - | Computer is running a 64-bit Microsoft Windows operating system | appv_client_MSI_x64.msi | - | You are deploying the App-V 5.0 Remote Desktop Services client | appv_client_rds_MSI_x64.msi | - - --- - -4. Using the information in the following table, select the appropriate language pack **.msi** to install, based on the desired language for the target computer. The **xxxx** in the table refers to the target locale of the language pack. - - **What to know before you start:** - - - The language packs are common to both the standard App-V 5.0 client and the Remote Desktop Services version of the App-V 5.0 client. - - - If you install the App-V 5.0 client using the **.exe**, the installer will deploy only the language pack that matches the operating system running on the target computer. - - - To deploy additional language packs on a target computer, use the procedure **To install the App-V 5.0 client by using Windows Installer (.msi) file**. - - | Type of deployment | Deploy this file | - |-----------------------------------------------------------------|------------------------------| - | Computer is running a 32-bit Microsoft Windows operating system | appv_client_LP_xxxx_ x86.msi | - | Computer is running a 64-bit Microsoft Windows operating system | appv_client_LP_xxxx_ x64.msi | - - --- - - **Got a suggestion for App-V**? Add or vote on [suggestions](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization).

    **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[About Client Configuration Settings](about-client-configuration-settings.md) - -[How to Uninstall the App-V 5.0 Client](how-to-uninstall-the-app-v-50-client.md) diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md deleted file mode 100644 index 0427b800e1..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Deploy the App-V Databases by Using SQL Scripts -description: How to Deploy the App-V Databases by Using SQL Scripts -author: dansimp -ms.assetid: 23637936-475f-4ca5-adde-76bb27d2372b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V Databases by Using SQL Scripts - - -Use the following instructions to use SQL scripts, rather than the Windows Installer, to: - -- Install the App-V 5.0 databases - -- Upgrade the 5.0 databases to a later version - -**How to install the App-V databases by using SQL scripts** - -1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software. - -2. Copy the **appv\_server\_setup.exe** from the App-V release media to a temporary location. - -3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts. - - Example: appv\_server\_setup.exe /layout c:\\<temporary location path> - -4. Browse to the temporary location that you created, open the extracted **DatabaseScripts** folder, and review the appropriate Readme.txt file for instructions: - - - - - - - - - - - - - - - - - - - - - - -
    DatabaseLocation of Readme.txt file to use

    Management database

    ManagementDatabase subfolder

    -
    - Important

    If you are upgrading to or installing the App-V 5.0 SP3 Management database, see SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail.

    -
    -
    - -

    Reporting database

    ReportingDatabase subfolder

    - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - -[How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md deleted file mode 100644 index c8faae6bae..0000000000 --- a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md +++ /dev/null @@ -1,241 +0,0 @@ ---- -title: How to Deploy the App-V Databases by Using SQL Scripts -description: How to Deploy the App-V Databases by Using SQL Scripts -author: dansimp -ms.assetid: 1183b1bc-d4d7-4914-a049-06e82bf2d96d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the App-V Databases by Using SQL Scripts - - -Use the following instructions to use SQL scripts, rather than the Windows Installer, to: - -- Install the App-V 5.1 databases - -- Upgrade the App-V databases to a later version - -**Note** -If you have already deployed the App-V 5.0 SP3 database, the SQL scripts are not required to upgrade to App-V 5.1. - - - -**How to install the App-V databases by using SQL scripts** - -1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software. - -2. Copy the **appv\_server\_setup.exe** from the App-V release media to a temporary location. - -3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts. - - Example: appv\_server\_setup.exe /layout c:\\<temporary location path> - -4. Browse to the temporary location that you created, open the extracted **DatabaseScripts** folder, and review the appropriate Readme.txt file for instructions: - - - - - - - - - - - - - - - - - - - - - - -
    DatabaseLocation of Readme.txt file to use

    Management database

    ManagementDatabase subfolder

    Reporting database

    ReportingDatabase subfolder

    - - - -~~~ -**Caution** -The readme.txt file in the ManagementDatabase subfolder is out of date. The information in the updated readme files below is the most current and should supersede the readme information provided in the **DatabaseScripts** folders. - - - -**Important** -The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. - -The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). **Step 1** is not required for versions of App-V later than App-V 5.0 SP3. -~~~ - - - -**Updated management database README file content** - -``` syntax -****************************************************************** -Before you install and use the Application Virtualization Database Scripts you must: -1.Review the Microsoft Application Virtualization Server 5.0 license terms. -2.Print and retain a copy of the license terms for your records. -By running the Microsoft Application Virtualization Database Scripts you agree to such license terms. If you do not accept them, do not use the software. -****************************************************************** - - -Steps to install "AppVManagement" schema in SQL SERVER. - - -## PREREQUISITES: - - 1. Review the installation package. The following files MUST exist: - - SQL files - --------- - Database.sql - CreateTables.sql - CreateStoredProcs.sql - UpdateTables.sql - Permissions.sql - - 2. Ensure the target SQL Server instance and SQL Server Agent service are running. - - 3. If you are not running the scripts directly on the server, ensure the - necessary SQL Server client software is installed and available from - the specified location. Specifically, the "osql" command must -## be supported for these scripts to run. - - - -## PREPARATION: - - 1. Review the database.sql file and modify as necessary. Although the - defaults are likely sufficient, it is suggested that the following - settings be reviewed: - - DATABASE - ensure name is satisfactory - default is "AppVManagement". - - 2. Review the Permissions.sql file and provide all the necessary account information - for setting up read and write access on the database. Note: Default settings -## in the file will not work. - - - -## INSTALLATION: - - 1. Run the database.sql against the "master" database. Your user - credential must have the ability to create databases. - This script will create the database. - - 2. Run the following scripts against the "AppVManagement" database using the - same account as above in order. - - CreateTables.sql - CreateStoredProcs.sql - UpdateTables.sql -## Permissions.sql - -``` - -**Updated reporting database README file content** - -``` syntax -****************************************************************** -Before you install and use the Application Virtualization Database Scripts you must: -1.Review the Microsoft Application Virtualization Server 5.0 license terms. -2.Print and retain a copy of the license terms for your records. -By running the Microsoft Application Virtualization Database Scripts you agree to such license terms. If you do not accept them, do not use the software. -****************************************************************** - -Steps to install "AppVReporting" schema in SQL SERVER. - - -## PREREQUISITES: - - 1. Review the installation package. The following files MUST exist: - - SQL files - --------- - Database.sql - UpgradeDatabase.sql - CreateTables.sql - CreateReportingStoredProcs.sql - CreateStoredProcs.sql - CreateViews.sql - InsertVersionInfo.sql - Permissions.sql - ScheduleReportingJob.sql - - 2. Ensure the target SQL Server instance and SQL Server Agent service are running. - - 3. If you are not running the scripts directly on the server, ensure the - necessary SQL Server client software is installed and executable from - the location you have chosen. Specifically, the "osql" command must -## be supported for these scripts to run. - - - -## PREPARATION: - - 1. Review the database.sql file and modify as necessary. Although the - defaults are likely sufficient, it is suggested that the following - settings be reviewed: - - DATABASE - ensure name is satisfactory - default is "AppVReporting". - - 2. Review the Permissions.sql file and provide all the necessary account information - for setting up read and write access on the database. Note: Default settings - in the file will not work. - - 3. Review the ScheduleReportingJob.sql file and make sure that the stored proc schedule - time is acceptable. The default stored proc schedule time is at 12.01 AM (line 84). - If this time is not suitable, you can change this to a more suitable time. The time is -## in the format HHMMSS. - - - -## INSTALLATION: - - 1. Run the database.sql against the "master" database. Your user - credential must have the ability to create databases. - This script will create the database. - - 2. If upgrading the database, run UpgradeDatabase.sql This will upgrade database schema. - - 2. Run the following scripts against the "AppVReporting" database using the - same account as above in order. - - CreateTables.sql - CreateReportingStoredProcs.sql - CreateStoredProcs.sql - CreateViews.sql - InsertVersionInfo.sql - Permissions.sql -## ScheduleReportingJob.sql - -``` - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - -[How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md b/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md deleted file mode 100644 index 094eff2814..0000000000 --- a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Enable Only Administrators to Publish Packages by Using an ESD -description: How to Enable Only Administrators to Publish Packages by Using an ESD -author: dansimp -ms.assetid: 03367b26-83d5-4299-ad52-b9177b9cf9a8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Enable Only Administrators to Publish Packages by Using an ESD - - -Starting in App-V 5.0 SP3, you can configure the App-V client so that only administrators (not end users) can publish or unpublish packages. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**To enable only administrators to publish or unpublish packages** - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To alternatively use PowerShell to set this item, see [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md b/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md deleted file mode 100644 index 475dc5d892..0000000000 --- a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Enable Only Administrators to Publish Packages by Using an ESD -description: How to Enable Only Administrators to Publish Packages by Using an ESD -author: dansimp -ms.assetid: bbc9fda2-fc09-4d72-8d9a-e83d2fcfe234 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Enable Only Administrators to Publish Packages by Using an ESD - - -Starting in App-V 5.0 SP3, you can configure the App-V client so that only administrators (not end users) can publish or unpublish packages. In earlier versions of App-V, you could not prevent end users from performing these tasks. - -**To enable only administrators to publish or unpublish packages** - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To alternatively use PowerShell to set this item, see [How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md b/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md deleted file mode 100644 index 128470febf..0000000000 --- a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: How to Enable Reporting on the App-V 5.0 Client by Using PowerShell -description: How to Enable Reporting on the App-V 5.0 Client by Using PowerShell -author: dansimp -ms.assetid: a7aaf553-0f83-4cd0-8df8-93a5f1ebe497 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Enable Reporting on the App-V 5.0 Client by Using PowerShell - - -Use the following procedure to configure the App-V 5.0 for reporting. - -**To configure the computer running the App-V 5.0 client for reporting** - -1. Install the App-V 5.0 client. For more information about installing the client see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md). - -2. After you have installed the App-V 5.0 client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription

    ReportingEnabled

    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.

    ReportingServerURL

    Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.

    -
    - Note

    This is the port number that was assigned during the Reporting Server setup

    -
    -
    - -

    Reporting Start Time

    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.

    ReportingRandomDelay

    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.

    ReportingInterval

    Specifies the retry interval that the client will use to resend data to the reporting server.

    ReportingDataCacheLimit

    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

    ReportingDataBlockSize

    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

    - - - -3. After the appropriate settings have been configured, the computer running the App-V 5.0 client will automatically collect data and will send the data back to the reporting server. - - Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md b/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md deleted file mode 100644 index 0bbe4ac487..0000000000 --- a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: How to Enable Reporting on the App-V 5.1 Client by Using PowerShell -description: How to Enable Reporting on the App-V 5.1 Client by Using PowerShell -author: dansimp -ms.assetid: c4c58be6-cc50-44f6-bf4f-8346fc5d0c0e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Enable Reporting on the App-V 5.1 Client by Using PowerShell - - -Use the following procedure to configure the App-V 5.1 for reporting. - -**To configure the computer running the App-V 5.1 client for reporting** - -1. Install the App-V 5.1 client. For more information about installing the client see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md). - -2. After you have installed the App-V 5.1 client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    SettingDescription

    ReportingEnabled

    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.

    ReportingServerURL

    Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.

    -
    - Note

    This is the port number that was assigned during the Reporting Server setup

    -
    -
    - -

    Reporting Start Time

    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.

    ReportingRandomDelay

    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.

    ReportingInterval

    Specifies the retry interval that the client will use to resend data to the reporting server.

    ReportingDataCacheLimit

    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

    ReportingDataBlockSize

    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.

    - - - -3. After the appropriate settings have been configured, the computer running the App-V 5.1 client will automatically collect data and will send the data back to the reporting server. - - Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md b/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md deleted file mode 100644 index b9405a9529..0000000000 --- a/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Install the App-V 5.0 Client for Shared Content Store Mode -description: How to Install the App-V 5.0 Client for Shared Content Store Mode -author: dansimp -ms.assetid: 88f09e6f-19e7-48ea-965a-907052d1a02f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install the App-V 5.0 Client for Shared Content Store Mode - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.0 client so that it uses the App-V 5.0 Shared Content Store (SCS) mode. You should ensure that all required prerequisites are installed on the computer you plan to install to. Use the following link for a [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -**Note**   -Before performing this procedure if necessary uninstall any existing version of the App-V 5.0 client. - - - -For more information about SCS mode, see [Shared Content Store in Microsoft App-V 5.0 – Behind the Scenes](https://go.microsoft.com/fwlink/?LinkId=316879) (https://go.microsoft.com/fwlink/?LinkId=316879). - -**Install and configure the App-V 5.0 client for SCS mode** - -1. Copy the App-V 5.0 client installation files to the computer on which it will be installed. Open a command line and from the directory where the installation files are saved type one of the following options depending on the version of the client you are installing: - - - To install the RDS version of the App-V 5.0 client type: **appv\_client\_setup\_rds.exe /SHAREDCONTENTSTOREMODE=1 /q** - - - To install the standard version of the App-V 5.0 client type: **appv\_client\_setup.exe /SHAREDCONTENTSTOREMODE=1 /q** - - **Important**   - You must perform a silent installation or the installation will fail. - - - -2. After you have completed the installation you can deploy packages to the computer running the client and all package contents will be streamed across the network. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md b/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md deleted file mode 100644 index 25741ffb48..0000000000 --- a/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: How to Install the App-V 5.1 Client for Shared Content Store Mode -description: How to Install the App-V 5.1 Client for Shared Content Store Mode -author: dansimp -ms.assetid: 6f3ecb1b-b5b5-4ae0-8de9-b4ffdfd2c216 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install the App-V 5.1 Client for Shared Content Store Mode - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 client so that it uses the App-V 5.1 Shared Content Store (SCS) mode. You should ensure that all required prerequisites are installed on the computer you plan to install to. Use the following link to see [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -**Note**   -Before performing this procedure if necessary uninstall any existing version of the App-V 5.1 client. - - - -For more information about SCS mode, see [Shared Content Store in Microsoft App-V 5.0 – Behind the Scenes](https://go.microsoft.com/fwlink/?LinkId=316879) (https://go.microsoft.com/fwlink/?LinkId=316879). - -**Install and configure the App-V 5.1 client for SCS mode** - -1. Copy the App-V 5.1 client installation files to the computer on which it will be installed. Open a command line and from the directory where the installation files are saved type one of the following options depending on the version of the client you are installing: - - - To install the RDS version of the App-V 5.1 client type: **appv\_client\_setup\_rds.exe /SHAREDCONTENTSTOREMODE=1 /q** - - - To install the standard version of the App-V 5.1 client type: **appv\_client\_setup.exe /SHAREDCONTENTSTOREMODE=1 /q** - - **Important**   - You must perform a silent installation or the installation will fail. - - - -2. After you have completed the installation you can deploy packages to the computer running the client and all package contents will be streamed across the network. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md deleted file mode 100644 index 22ca05448e..0000000000 --- a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell -description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell -author: dansimp -ms.assetid: 9399342b-1ea7-41df-b988-33e302f9debe -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell - - -Use the following PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. - -Before attempting this procedure, you should read and understand the information and examples displayed in the following list: - -- **.INPUTS** – The account or accounts used to convert to SID format. This can be a single account name or an array of account names. - -- **.OUTPUTS** - A list of account names with the corresponding SID in standard and hexadecimal formats. - -- **Examples** - - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List**. - - **$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200** - - \#> - -**To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)** - -1. Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**. - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - - ```powershell - <# - .SYNOPSIS - This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. - - .DESCRIPTION - This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. - - .INPUTS - The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below. - - .OUTPUTS - A list of account names with the corresponding SID in standard and hexadecimal formats - - .EXAMPLE - .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List - - .EXAMPLE - $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2") - - .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 - #> - - function ConvertSIDToHexFormat - { - param([System.Security.Principal.SecurityIdentifier]$sidToConvert) - - $sb = New-Object System.Text.StringBuilder - - [int] $binLength = $sidToConvert.BinaryLength - - [Byte[]] $byteArray = New-Object Byte[] $binLength - - $sidToConvert.GetBinaryForm($byteArray, 0) - - foreach($byte in $byteArray) - { - $sb.Append($byte.ToString("X2")) |Out-Null - } - return $sb.ToString() - } - - [string[]]$myArgs = $args - - - - if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0)) - { - [string]::Format("{0}====== Description ======{0}{0}" + - " Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" + - " Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" + - " The output is written to the console in the format 'Account name SID as string SID as hexadecimal'{0}" + - " And can be written out to a file using standard PowerShell redirection{0}" + - " Please specify user accounts in the format 'DOMAIN\username'{0}" + - " Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" + - " For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + - "{0}====== Arguments ======{0}" + - - - - "{0} /? Show this help message", [Environment]::NewLine) - } - else - { - #If an array was passed in, try to split it - if($myArgs.Length -eq 1) - { - $myArgs = $myArgs.Split(' ') - } - - #Parse the arguments for account names - foreach($accountName in $myArgs) - { - [string[]] $splitString = $accountName.Split('\') # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject - - if($splitString.Length -ne 2) - { - $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName) - - Write-Error -Message $message - continue - } - - #Convert any account names to SIDs - try - { - [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1]) - - [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier])) - } - catch [System.Security.Principal.IdentityNotMappedException] - { - $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString()) - - Write-Error -Message $message - - continue - } - - #Convert regular SID to binary format used by SQL - - $hexSIDString = ConvertSIDToHexFormat $SID - - $SIDs = New-Object PSObject - - $SIDs | Add-Member NoteProperty Account $accountName - - $SIDs | Add-Member NoteProperty SID $SID.ToString() - - $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString - - Write-Output $SIDs - } - } - ``` - -3. Run the script you saved in step one of this procedure passing the accounts to convert as arguments. - - For example, - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”** - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) diff --git a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md deleted file mode 100644 index ed4ef04eb0..0000000000 --- a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell -description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell -author: dansimp -ms.assetid: 2be6fb72-f3a6-4550-bba1-6defa78ca08a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell - - -Use the following PowerShell procedure to convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by Microsoft SQL Server when running SQL scripts. - -Before attempting this procedure, you should read and understand the information and examples displayed in the following list: - -- **.INPUTS** – The account or accounts used to convert to SID format. This can be a single account name or an array of account names. - -- **.OUTPUTS** - A list of account names with the corresponding SID in standard and hexadecimal formats. - -- **Examples** - - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List**. - - **$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200** - - \#> - -**To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)** - -1. Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**. - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - - ```powershell - <# - .SYNOPSIS - This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats. - .DESCRIPTION - This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts. - .INPUTS - The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below. - .OUTPUTS - A list of account names with the corresponding SID in standard and hexadecimal formats - .EXAMPLE - .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List - .EXAMPLE - $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2") - .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200 - #> - - function ConvertSIDToHexFormat - { - - param(\[System.Security.Principal.SecurityIdentifier\]$sidToConvert) - - $sb = New-Object System.Text.StringBuilder - [int] $binLength = $sidToConvert.BinaryLength - [Byte[]] $byteArray = New-Object Byte[] $binLength - $sidToConvert.GetBinaryForm($byteArray, 0) - foreach($byte in $byteArray) - { - $sb.Append($byte.ToString("X2")) |Out-Null - } - return $sb.ToString() - } - [string[]]$myArgs = $args - if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0)) - { - - [string]::Format("{0}====== Description ======{0}{0}" + - " Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" + - " Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" + - " The output is written to the console in the format 'Account name SID as string SID as hexadecimal'{0}" + - " And can be written out to a file using standard PowerShell redirection{0}" + - " Please specify user accounts in the format 'DOMAIN\username'{0}" + - " Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" + - " For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + - "{0}====== Arguments ======{0}" + - "{0} /? Show this help message", [Environment]::NewLine) - } - else - { - #If an array was passed in, try to split it - if($myArgs.Length -eq 1) - { - $myArgs = $myArgs.Split(' ') - } - - #Parse the arguments for account names - foreach($accountName in $myArgs) - { - [string[]] $splitString = $accountName.Split('\') # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject - if($splitString.Length -ne 2) - { - $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName) - Write-Error -Message $message - continue - } - - #Convert any account names to SIDs - try - { - [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1]) - [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier])) - } - catch [System.Security.Principal.IdentityNotMappedException] - { - $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString()) - Write-Error -Message $message - continue - } - - #Convert regular SID to binary format used by SQL - $hexSIDString = ConvertSIDToHexFormat $SID - - $SIDs = New-Object PSObject - $SIDs | Add-Member NoteProperty Account $accountName - $SIDs | Add-Member NoteProperty SID $SID.ToString() - $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString - - Write-Output $SIDs - } - } -3. Run the script you saved in step one of this procedure passing the accounts to convert as arguments. - - For example, - - **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")** - - **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”** - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) diff --git a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md b/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md deleted file mode 100644 index 924e89d919..0000000000 --- a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services -description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services -author: dansimp -ms.assetid: 02afd6d6-4c33-4c0b-bd88-ae167b786fdf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services - - -Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. - -**Note** -After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases. - - - -**To install the management database and the management server on separate computers** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Management Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Management Server Database page**, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - - **Note** - If you plan to deploy the management server on the same computer you must select **Use this local computer**. - - - -~~~ -Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. -~~~ - -8. To start the installation, click **Install**. - -**To install the reporting database and the reporting server on separate computers** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Reporting Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Reporting Server Database** page, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - - **Note** - If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. - - - -~~~ -Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. -~~~ - -8. To start the installation, click **Install**. - -**To install the management and reporting databases using App-V 5.0 database scripts** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. - -2. To extract the App-V 5.0 database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - - **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”**. - -3. After the extraction has been completed, to access the App-V 5.0 database scripts and instructions readme file: - - - The App-V 5.0 Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. - - - The App-V 5.0 Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. - -4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. - - **Note** - For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md). - - - -5. Run the scripts on the computer running Microsoft SQL Server. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md b/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md deleted file mode 100644 index 77c7a3fd6a..0000000000 --- a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services -description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services -author: dansimp -ms.assetid: 2a67402e-3119-40ea-a247-24d166af1ced -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services - - -Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. - -**Note** -After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases. - - - -**To install the management database and the management server on separate computers** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Management Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Management Server Database page**, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - - **Note** - If you plan to deploy the management server on the same computer you must select **Use this local computer**. - - - -~~~ -Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. -~~~ - -8. To start the installation, click **Install**. - -**To install the reporting database and the reporting server on separate computers** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the components you want to install by selecting the **Reporting Server Database** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the initial **Create New Reporting Server Database** page, accept the default selections if appropriate, and click **Next**. - - If you are using a custom SQL Server instance, then select **Use a custom instance** and type the name of the instance. - - If you are using a custom database name, then select **Custom configuration** and type the database name. - -7. On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - - **Note** - If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. - - - -~~~ -Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**. -~~~ - -8. To start the installation, click **Install**. - -**To install the management and reporting databases using App-V 5.1 database scripts** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. - -2. To extract the App-V 5.1 database scripts, open a command prompt and specify the location where the installation files are saved and run the following command: - - **appv\_server\_setup.exe** **/LAYOUT** **/LAYOUTDIR=”InstallationExtractionLocation”**. - -3. After the extraction has been completed, to access the App-V 5.1 database scripts and instructions readme file: - - - The App-V 5.1 Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**. - - - The App-V 5.1 Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**. - -4. For each database, copy the scripts to a share and modify them following the instructions in the readme file. - - **Note** - For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md). - - - -5. Run the scripts on the computer running Microsoft SQL Server. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md b/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md deleted file mode 100644 index c27949ba3d..0000000000 --- a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to install the Management Server on a Standalone Computer and Connect it to the Database -description: How to install the Management Server on a Standalone Computer and Connect it to the Database -author: dansimp -ms.assetid: 95281287-cb56-4117-befd-854268ea147c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to install the Management Server on a Standalone Computer and Connect it to the Database - - -Use the following procedure to install the management server on a standalone computer and connect it to the database. - -**To install the management server on a standalone computer and connect it to the database** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Management Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. - - **Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - - - -~~~ -For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - -Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. -~~~ - -7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation - - Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**. - -8. Click **Install**. - -9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console.html if the installation was successful you should see the **Silverlight Management Console** appear without any error messages or warnings being displayed. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md b/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md deleted file mode 100644 index 988a91b3ff..0000000000 --- a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to install the Management Server on a Standalone Computer and Connect it to the Database -description: How to install the Management Server on a Standalone Computer and Connect it to the Database -author: dansimp -ms.assetid: 3f83c335-d976-4abd-b8f8-d7f5e50b4318 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to install the Management Server on a Standalone Computer and Connect it to the Database - - -Use the following procedure to install the management server on a standalone computer and connect it to the database. - -**To install the management server on a standalone computer and connect it to the database** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Management Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. - - **Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - - - -~~~ -For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - -Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**. -~~~ - -7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation - - Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**. - -8. Click **Install**. - -9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md deleted file mode 100644 index ee45693fca..0000000000 --- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Install the Publishing Server on a Remote Computer -description: How to Install the Publishing Server on a Remote Computer -author: dansimp -ms.assetid: 37970706-54ff-4799-9485-b9b49fd50f37 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Publishing Server on a Remote Computer - - -Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. - -**To install the publishing server on a separate computer** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Publishing Server Configuration** page, specify the following items: - - - The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. - - - Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name. - - - For the **Port Binding**, specify a unique port number that will be used by App-V 5.0, for example **54321**. - -7. On the **Ready to Install** page, click **Install**. - -8. After the installation is complete, the publishing server must be registered with the management server. In the App-V 5.0 management console, use the following steps to register the server: - - 1. Open the App-V 5.0 management server console. - - 2. In the left pane, select **Servers**, and then select **Register New Server**. - - 3. Type the name of this server and a description (if required) and click **Add**. - -9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed: - - ```xml - - - - - - - - - ``` - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md deleted file mode 100644 index c9ed253251..0000000000 --- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Install the Publishing Server on a Remote Computer -description: How to Install the Publishing Server on a Remote Computer -author: dansimp -ms.assetid: 1c903f78-0558-458d-a149-d5f6fb55aefb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Publishing Server on a Remote Computer - - -Use the following procedure to install the publishing server on a separate computer. Before you perform the following procedure, ensure the database and management server are available. - -**To install the publishing server on a separate computer** - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Publishing Server Configuration** page, specify the following items: - - - The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**. - - - Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name. - - - For the **Port Binding**, specify a unique port number that will be used by App-V 5.1, for example **54321**. - -7. On the **Ready to Install** page, click **Install**. - -8. After the installation is complete, the publishing server must be registered with the management server. In the App-V 5.1 management console, use the following steps to register the server: - - 1. Open the App-V 5.1 management server console. - - 2. In the left pane, select **Servers**, and then select **Register New Server**. - - 3. Type the name of this server and a description (if required) and click **Add**. - -9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed: - - ```xml - - - - - - - - - ``` - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md b/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md deleted file mode 100644 index 4285fdefd0..0000000000 --- a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database -description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database -author: dansimp -ms.assetid: d186bdb7-e522-4124-bc6d-7d5a41ba8266 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to install the Reporting Server on a Standalone Computer and Connect it to the Database - - -Use the following procedure to install the reporting server on a standalone computer and connect it to the database. - -**Important** -Before performing the following procedure you should read and understand [About App-V 5.0 Reporting](about-app-v-50-reporting.md). - - - -**To install the reporting server on a standalone computer and connect it to the database** - -1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Reporting Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**. - - **Note** - If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - - - -~~~ -For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - -Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. -~~~ - -7. On the **Configure Reporting Server Configuration** page. - - - Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name. - - - For the **Port binding**, specify a unique port number that will be used by App-V 5.0, for example **55555**. You should also ensure that the port specified is not being used by another website. - -8. Click **Install**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[About App-V 5.0 Reporting](about-app-v-50-reporting.md) - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md b/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md deleted file mode 100644 index b74f0be3c2..0000000000 --- a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database -description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database -author: dansimp -ms.assetid: 11f07750-4045-4c8d-a583-7d70c9e9aa7b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to install the Reporting Server on a Standalone Computer and Connect it to the Database - -Use the following procedure to install the reporting server on a standalone computer and connect it to the database. - -**Important** -Before performing the following procedure you should read and understand [About App-V 5.1 Reporting](about-app-v-51-reporting.md). - -## To install the reporting server on a standalone computer and connect it to the database - -1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**. - -2. On the **Getting Started** page, review and accept the license terms, and click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don't want to use Microsoft Update**. Click **Next**. - -4. On the **Feature Selection** page, select the **Reporting Server** checkbox and click **Next**. - -5. On the **Installation Location** page, accept the default location and click **Next**. - -6. On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**. - - > [!NOTE] - > If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. - - For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance. - - Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**. - -7. On the **Configure Reporting Server Configuration** page. - - - Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name. - - - For the **Port binding**, specify a unique port number that will be used by App-V 5.1, for example **55555**. You should also ensure that the port specified is not being used by another website. - -8. Click **Install**. - -**Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - -[About App-V 5.1 Reporting](about-app-v-51-reporting.md) - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md) diff --git a/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md b/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md deleted file mode 100644 index dac6a4e3dc..0000000000 --- a/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: How to Install the Sequencer -description: How to Install the Sequencer -author: dansimp -ms.assetid: 5e8f1696-9bc0-4f44-8cb7-b809b2daae10 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Sequencer - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.1 sequencer. The computer that will run the sequencer must not be running any version of the App-V 5.1 client. - -Upgrading a previous installation of the App-V sequencer is not supported. - -**Important**   -For a full list of the sequencer requirements see sequencer sections of [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) and [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - - - -You can also use the command line to install the App-V 5.1 sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandDescription

    /INSTALLDIR

    Specifies the installation directory.

    /CEIPOPTIN

    Enables participation in the Microsoft Customer Experience Improvement Program.

    /Log

    Specifies where the installation log will be saved, the default location is %Temp%. For example, C:\ Logs \ log.log.

    /q

    Specifies a quiet or silent installation.

    /Uninstall

    Specifies the removal of the sequencer.

    /ACCEPTEULA

    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

    /LAYOUT

    Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.1. No value is expected.

    /LAYOUTDIR

    Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”.

    /? Or /h or /help

    Displays associated help.

    - - - -**To install the App-V 5.1 sequencer** - -1. Copy the App-V 5.1 sequencer installation files to the computer on which it will be installed. Double-click **appv\_sequencer\_setup.exe** and then click **Install**. - -2. On the **Software License Terms** page, you should review the license terms. To accept the license terms select **I accept the license terms.** Click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates from running select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Customer Experience Improvement Program** page, to participate in the program select **Join the Customer Experience Improvement Program**. This will allow information to be collected about how you are using App-V 5.1. If you don’t want to participate in the program select **I don’t want to join the program at this time**. Click **Install**. - -5. To open the sequencer, click **Start** and then click **Microsoft Application Virtualization Sequencer**. - -**To troubleshoot the App-V 5.1 sequencer installation** - -- For more information regarding the sequencer installation, you can view the error log in the **%temp%** folder. To review the log files, click **Start**, type **%temp%**, and then look for the **appv\_ log**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md b/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md deleted file mode 100644 index c02d94ec51..0000000000 --- a/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: How to Install the Sequencer -description: How to Install the Sequencer -author: dansimp -ms.assetid: a122caf0-f408-458c-b119-dc84123c1d58 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the Sequencer - - -Use the following procedure to install the Microsoft Application Virtualization (App-V) 5.0 sequencer. The computer that will run the sequencer must not be running any version of the App-V 5.0 client. - -Upgrading a previous installation of the App-V sequencer is not supported. - -**Important**   -For a full list of the sequencer requirements see sequencer sections of [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) and [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - - - -You can also use the command line to install the App-V 5.0 sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandDescription

    /INSTALLDIR

    Specifies the installation directory.

    /CEIPOPTIN

    Enables participation in the Microsoft Customer Experience Improvement Program.

    /Log

    Specifies where the installation log will be saved, the default location is %Temp%. For example, C:\ Logs \ log.log.

    /q

    Specifies a quiet or silent installation.

    /Uninstall

    Specifies the removal of the sequencer.

    /ACCEPTEULA

    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.

    /LAYOUT

    Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.0. No value is expected.

    /LAYOUTDIR

    Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”.

    /? Or /h or /help

    Displays associated help.

    - - - -**To install the App-V 5.0 sequencer** - -1. Copy the App-V 5.0 sequencer installation files to the computer on which it will be installed. Double-click **appv\_sequencer\_setup.exe** and then click **Install**. - -2. On the **Software License Terms** page, you should review the license terms. To accept the license terms select **I accept the license terms.** Click **Next**. - -3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates from running select **I don’t want to use Microsoft Update**. Click **Next**. - -4. On the **Customer Experience Improvement Program** page, to participate in the program select **Join the Customer Experience Improvement Program**. This will allow information to be collected about how you are using App-V 5.0. If you don’t want to participate in the program select **I don’t want to join the program at this time**. Click **Install**. - -5. To open the sequencer, click **Start** and then click **Microsoft Application Virtualization Sequencer**. - -**To troubleshoot the App-V 5.0 sequencer installation** - -- For more information regarding the sequencer installation, you can view the error log in the **%temp%** folder. To review the log files, click **Start**, type **%temp%**, and then look for the **appv\_ log**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md deleted file mode 100644 index e24a590f0a..0000000000 --- a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md +++ /dev/null @@ -1,222 +0,0 @@ ---- -title: How to Load the PowerShell Cmdlets and Get Cmdlet Help -description: How to Load the PowerShell Cmdlets and Get Cmdlet Help -author: dansimp -ms.assetid: 0624495b-943e-485b-9e54-b50e4ee6591c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# How to Load the PowerShell Cmdlets and Get Cmdlet Help - - -What this topic covers: - -- [Requirements for using PowerShell cmdlets](#bkmk-reqs-using-posh) - -- [Loading the PowerShell cmdlets](#bkmk-load-cmdlets) - -- [Getting help for the PowerShell cmdlets](#bkmk-get-cmdlet-help) - -- [Displaying the help for a PowerShell cmdlet](#bkmk-display-help-cmdlet) - -## Requirements for using PowerShell cmdlets - - -Review the following requirements for using the App-V PowerShell cmdlets: - - ---- - - - - - - - - - - - - - - - - - - - - -
    RequirementDetails

    Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:

    Cmdlets that require an elevated command prompt

      -
    • Add-AppvClientPackage

    • -
    • Remove-AppvClientPackage

    • -
    • Set-AppvClientConfiguration

    • -
    • Add-AppvClientConnectionGroup

    • -
    • Remove-AppvClientConnectionGroup

    • -
    • Add-AppvPublishingServer

    • -
    • Remove-AppvPublishingServer

    • -
    • Send-AppvClientReport

    • -
    • Set-AppvClientMode

    • -
    • Set-AppvClientPackage

    • -
    • Set-AppvPublishingServer

    • -

    Cmdlets that end users can run, unless you configure them to require an elevated command prompt

      -
    • Publish-AppvClientPackage

    • -
    • Unpublish-AppvClientPackage

    • -
    -

    To configure these cmdlets to require an elevated command prompt, use one of the following methods:

    - ---- - - - - - - - - - - - - - - - - -
    MethodMore resources

    Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

    Enable the “Require publish as administrator” Group Policy setting for App-V Clients.

    How to Publish a Package by Using the Management Console

    -

     

    - - - -## Loading the PowerShell cmdlets -To load the PowerShell cmdlet modules: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type one of the following commands to load the cmdlets for the module you want: - - ---- - - - - - - - - - - - - - - - - - - - - -
    App-V componentCommand to type

    App-V Server

    Import-Module AppvServer

    App-V Sequencer

    Import-Module AppvSequencer

    App-V Client

    Import-Module AppvClient

    - - - -## Getting help for the PowerShell cmdlets -Starting in App-V 5.0 SP3, cmdlet help is available in two formats: - - ---- - - - - - - - - - - - - - - - - -
    FormatDescription

    As a downloadable module

    To download the latest help after downloading the cmdlet module:

    -
      -
    1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).

    2. -
    3. Type one of the following commands to load the cmdlets for the module you want:

    4. -
    - ---- - - - - - - - - - - - - - - - - - - - - -
    App-V componentCommand to type

    App-V Server

    Update-Help -Module AppvServer

    App-V Sequencer

    Update-Help -Module AppvSequencer

    App-V Client

    Update-Help -Module AppvClient

    -

     

    On TechNet as web pages

    See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.

    - - - -## Displaying the help for a PowerShell cmdlet -To display help for a specific PowerShell cmdlet: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type **Get-Help** <*cmdlet*>, for example, **Get-Help Publish-AppvClientPackage**. - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue**? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - - - - - - - - - diff --git a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md deleted file mode 100644 index c8f34160ab..0000000000 --- a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md +++ /dev/null @@ -1,219 +0,0 @@ ---- -title: How to Load the PowerShell Cmdlets and Get Cmdlet Help -description: How to Load the PowerShell Cmdlets and Get Cmdlet Help -author: dansimp -ms.assetid: b6ae5460-2c3a-4030-b132-394d9d5a541e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# How to Load the PowerShell Cmdlets and Get Cmdlet Help - - -What this topic covers: - -- [Requirements for using PowerShell cmdlets](#bkmk-reqs-using-posh) - -- [Loading the PowerShell cmdlets](#bkmk-load-cmdlets) - -- [Getting help for the PowerShell cmdlets](#bkmk-get-cmdlet-help) - -- [Displaying the help for a PowerShell cmdlet](#bkmk-display-help-cmdlet) - -## Requirements for using PowerShell cmdlets - - -Review the following requirements for using the App-V PowerShell cmdlets: - - ---- - - - - - - - - - - - - - - - - - - - - -
    RequirementDetails

    Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:

    Cmdlets that require an elevated command prompt

      -
    • Add-AppvClientPackage

    • -
    • Remove-AppvClientPackage

    • -
    • Set-AppvClientConfiguration

    • -
    • Add-AppvClientConnectionGroup

    • -
    • Remove-AppvClientConnectionGroup

    • -
    • Add-AppvPublishingServer

    • -
    • Remove-AppvPublishingServer

    • -
    • Send-AppvClientReport

    • -
    • Set-AppvClientMode

    • -
    • Set-AppvClientPackage

    • -
    • Set-AppvPublishingServer

    • -

    Cmdlets that end users can run, unless you configure them to require an elevated command prompt

      -
    • Publish-AppvClientPackage

    • -
    • Unpublish-AppvClientPackage

    • -
    -

    To configure these cmdlets to require an elevated command prompt, use one of the following methods:

    - ---- - - - - - - - - - - - - - - - - -
    MethodMore resources

    Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.

    Enable the “Require publish as administrator” Group Policy setting for App-V Clients.

    How to Publish a Package by Using the Management Console

    -

     

    - - - -## Loading the PowerShell cmdlets - -To load the PowerShell cmdlet modules: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type one of the following commands to load the cmdlets for the module you want: - - ---- - - - - - - - - - - - - - - - - - - - - -
    App-V componentCommand to type

    App-V Server

    Import-Module AppvServer

    App-V Sequencer

    Import-Module AppvSequencer

    App-V Client

    Import-Module AppvClient

    - -## Getting help for the PowerShell cmdlets -Starting in App-V 5.0 SP3, cmdlet help is available in two formats: - - ---- - - - - - - - - - - - - - - - - -
    FormatDescription

    As a downloadable module

    To download the latest help after downloading the cmdlet module:

    -
      -
    1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE).

    2. -
    3. Type one of the following commands to load the cmdlets for the module you want:

    4. -
    - ---- - - - - - - - - - - - - - - - - - - - - -
    App-V componentCommand to type

    App-V Server

    Update-Help -Module AppvServer

    App-V Sequencer

    Update-Help -Module AppvSequencer

    App-V Client

    Update-Help -Module AppvClient

    -

     

    On TechNet as web pages

    See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.

    - -## Displaying the help for a PowerShell cmdlet -To display help for a specific PowerShell cmdlet: - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type **Get-Help** <*cmdlet*>, for example, **Get-Help Publish-AppvClientPackage**. - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - - - - - - - - - diff --git a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md b/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md deleted file mode 100644 index 5cfa258188..0000000000 --- a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: How to Make a Connection Group Ignore the Package Version -description: How to Make a Connection Group Ignore the Package Version -author: dansimp -ms.assetid: 6ebc1bff-d190-4f4c-a6da-e09a4cca7874 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Make a Connection Group Ignore the Package Version - - -Microsoft Application Virtualization (App-V) 5.0 SP3 enables you to configure a connection group to use any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create. - -To upgrade a package in earlier versions of App-V, you had to perform several steps, including disabling the connection group and modifying the connection group’s XML definition file. - - ---- - - - - - - - - - - - - -
    Task description with App-V 5.0 SP3How to perform the task with App-V 5.0 SP3

    You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group.

    -

    How the feature works:

    -
      -
    • If the connection group has access to multiple versions of a package, the latest version is used.

    • -
    • If the connection group contains an optional package that has an incorrect version, the package is ignored and won’t block the connection group’s virtual environment from being created.

    • -
    • If the connection group contains a non-optional package that has an incorrect version, the connection group’s virtual environment cannot be created.

    • -
    ---- - - - - - - - - - - - - - - - - -
    MethodSteps

    App-V Server – Management Console

      -
    1. In the Management Console, select PACKAGES > CONNECTION GROUPS.

    2. -
    3. Select the correct connection group from the Connection Groups library.

    4. -
    5. Click EDIT in the CONNECTED PACKAGES pane.

    6. -
    7. Select Use Any Version check box next to the package name, and click Apply.

    8. -
    -

    For more about adding or upgrading packages, see How to Add or Upgrade Packages by Using the Management Console.

    App-V Client on a Stand-alone computer

      -
    1. Create the connection group XML document.

    2. -
    3. For the package to be upgraded, set the Package tag attribute VersionID to an asterisk (*).

    4. -
    5. Use the following cmdlet to add the connection group, and include the path to the connection group XML document:

      -

      Add-AppvClientConnectionGroup

    6. -
    7. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package:

      -
        -
      • RemoveAppvClientPackage

      • -
      • Add-AppvClientPackage

      • -
      • Publish-AppvClientPackage

      • -
    8. -
    -

    For more information, see:

    -
    -

     

    - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md b/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md deleted file mode 100644 index dd0494ceee..0000000000 --- a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: How to Make a Connection Group Ignore the Package Version -description: How to Make a Connection Group Ignore the Package Version -author: dansimp -ms.assetid: db16b095-dbe2-42c7-863d-b0d5d91b2f4c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Make a Connection Group Ignore the Package Version - - -Microsoft Application Virtualization (App-V) 5.1 lets you configure a connection group to use any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create. - -To upgrade a package in some earlier versions of App-V, you had to perform several steps, including disabling the connection group and modifying the connection group’s XML definition file. - - ---- - - - - - - - - - - - - -
    Task description with App-V 5.1How to perform the task with App-V 5.1

    You can configure a connection group to accept any version of a package, which enables you to upgrade the package without having to disable the connection group.

    -

    How the feature works:

    -
      -
    • If the connection group has access to multiple versions of a package, the latest version is used.

    • -
    • If the connection group contains an optional package that has an incorrect version, the package is ignored and won’t block the connection group’s virtual environment from being created.

    • -
    • If the connection group contains a non-optional package that has an incorrect version, the connection group’s virtual environment cannot be created.

    • -
    ---- - - - - - - - - - - - - - - - - -
    MethodSteps

    App-V Server – Management Console

      -
    1. In the Management Console, select CONNECTION GROUPS.

    2. -
    3. Select the correct connection group from the Connection Groups library.

    4. -
    5. Click EDIT in the CONNECTED PACKAGES pane.

    6. -
    7. Select Use Any Version check box next to the package name, and click Apply.

    8. -
    -

    For more about adding or upgrading packages, see How to Add or Upgrade Packages by Using the Management Console.

    App-V Client on a Stand-alone computer

      -
    1. Create the connection group XML document.

    2. -
    3. For the package to be upgraded, set the Package tag attribute VersionID to an asterisk (*).

    4. -
    5. Use the following cmdlet to add the connection group, and include the path to the connection group XML document:

      -

      Add-AppvClientConnectionGroup

    6. -
    7. When you upgrade a package, use the following cmdlets to remove the old package, add the upgraded package, and publish the upgraded package:

      -
        -
      • RemoveAppvClientPackage

      • -
      • Add-AppvClientPackage

      • -
      • Publish-AppvClientPackage

      • -
    8. -
    -

    For more information, see:

    -
    -

     

    - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md deleted file mode 100644 index ef45d7b6df..0000000000 --- a/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell -description: How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell -author: dansimp -ms.assetid: 1d6c2d25-81ec-4ff8-9262-6b4cf484a376 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell - - -The following sections explain how to perform various management tasks on a stand-alone client computer by using PowerShell: - -- [To return a list of packages](#bkmk-return-pkgs-standalone-posh) - -- [To add a package](#bkmk-add-pkgs-standalone-posh) - -- [To publish a package](#bkmk-pub-pkg-standalone-posh) - -- [To publish a package to a specific user](#bkmk-pub-pkg-a-user-standalone-posh) - -- [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh) - -- [To unpublish an existing package](#bkmk-unpub-pkg-standalone-posh) - -- [To unpublish a package for a specific user](#bkmk-unpub-pkg-specfc-use) - -- [To remove an existing package](#bkmk-remove-pkg-standalone-posh) - -- [To enable only administrators to publish or unpublish packages](#bkmk-admins-pub-pkgs) - -- [Understanding pending packages (UserPending and GlobalPending)](#bkmk-understd-pend-pkgs) - -## To return a list of packages - - -Use the following information to return a list of packages that are entitled to a specific user: - -**Cmdlet**: Get-AppvClientPackage - -**Parameters**: -Name -Version -PackageID -VersionID - -**Example**: Get-AppvClientPackage –Name “ContosoApplication” -Version 2 - -## To add a package - - -Use the following information to add a package to a computer. - -**Important**   -This example only adds a package. It does not publish the package to the user or the computer. - - - -**Cmdlet**: Add-AppvClientPackage - -**Example**: $Contoso = Add-AppvClientPackage \\\\path\\to\\appv\\package.appv - -## To publish a package - - -Use the following information to publish a package that has been added to a specific user or globally to any user on the computer. - - ---- - - - - - - - - - - - - - - - - -
    Publishing methodCmdlet and example

    Publishing to the user

    Cmdlet: Publish-AppvClientPackage

    -

    Example: Publish-AppvClientPackage “ContosoApplication”

    Publishing globally

    Cmdlet: Publish-AppvClientPackage

    -

    Example: Publish-AppvClientPackage “ContosoApplication” -Global

    - - - -## To publish a package to a specific user - - -**Note**   -You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - -An administrator can publish a package to a specific user by specifying the optional **–UserSID** parameter with the **Publish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. - -- You must be logged in with administrative credentials to use the parameter. - -- The end user must be logged in. - -- You must provide the end user’s security identifier (SID). - -**Cmdlet**: Publish-AppvClientPackage - -**Example**: Publish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 - -## To add and publish a package - - -Use the following information to add a package to a computer and publish it to the user. - -**Cmdlet**: Add-AppvClientPackage - -**Example**: Add-AppvClientPackage \\\\path\\to\\appv\\package.appv | Publish-AppvClientPackage - -## To unpublish an existing package - - -Use the following information to unpublish a package which has been entitled to a user but not remove the package from the computer. - -**Cmdlet**: Unpublish-AppvClientPackage - -**Example**: Unpublish-AppvClientPackage “ContosoApplication” - -## To unpublish a package for a specific user - - -**Note**   -You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - -An administrator can unpublish a package for a specific user by using the optional **–UserSID** parameter with the **Unpublish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. - -- You must be logged in with administrative credentials to use the parameter. - -- The end user must be logged in. - -- You must provide the end user’s security identifier (SID). - -**Cmdlet**: Unpublish-AppvClientPackage - -**Example**: Unpublish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 - -## To remove an existing package - - -Use the following information to remove a package from the computer. - -**Cmdlet**: Remove-AppvClientPackage - -**Example**: Remove-AppvClientPackage “ContosoApplication” - -**Note**   -App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://go.microsoft.com/fwlink/?LinkId=324466). - - - -## To enable only administrators to publish or unpublish packages - - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - - - -Use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages: - - ---- - - - - - - - - - - -

    Cmdlet

    Set-AppvClientConfiguration

    Parameter

    -RequirePublishAsAdmin

    -

    Parameter values:

    -
      -
    • 0 - False

    • -
    • 1 - True

    • -
    -

    Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

    - - - -To use the App-V Management console to set this configuration, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md). - -## Understanding pending packages (UserPending and GlobalPending) - - -**Starting in App-V 5.0 SP2**: If you run a PowerShell cmdlet that affects a package that is currently in use, the task that you are trying to perform is placed in a pending state. For example, if you try to publish a package when an application in that package is being used, and then run **Get-AppvClientPackage**, the pending status appears in the cmdlet output as follows: - - ---- - - - - - - - - - - - - - - - - -
    Cmdlet output itemDescription

    UserPending

    Indicates whether the listed package has a pending task that is being applied to the user:

    -
      -
    • True

    • -
    • False

    • -

    GlobalPending

    Indicates whether the listed package has a pending task that is being applied globally to the computer:

    -
      -
    • True

    • -
    • False

    • -
    - - - -The pending task will run later, according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
    Task typeApplicable rule

    User-based task, e.g., publishing a package to a user

    The pending task will be performed after the user logs off and then logs back on.

    Globally based task, e.g., enabling a connection group globally

    The pending task will be performed when the computer is shut down and then restarted.

    - - - -For more information about pending tasks, see [About App-V 5.0 SP2](about-app-v-50-sp2.md#bkmk-pkg-upgr-pendg-tasks). - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md deleted file mode 100644 index fe66e53ac9..0000000000 --- a/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell -description: How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell -author: dansimp -ms.assetid: c3fd06f6-102f-43d1-a577-d5ced6ac537d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell - - -The following sections explain how to perform various management tasks on a stand-alone client computer by using PowerShell: - -- [To return a list of packages](#bkmk-return-pkgs-standalone-posh) - -- [To add a package](#bkmk-add-pkgs-standalone-posh) - -- [To publish a package](#bkmk-pub-pkg-standalone-posh) - -- [To publish a package to a specific user](#bkmk-pub-pkg-a-user-standalone-posh) - -- [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh) - -- [To unpublish an existing package](#bkmk-unpub-pkg-standalone-posh) - -- [To unpublish a package for a specific user](#bkmk-unpub-pkg-specfc-use) - -- [To remove an existing package](#bkmk-remove-pkg-standalone-posh) - -- [To enable only administrators to publish or unpublish packages](#bkmk-admins-pub-pkgs) - -- [Understanding pending packages (UserPending and GlobalPending)](#bkmk-understd-pend-pkgs) - -## To return a list of packages - - -Use the following information to return a list of packages that are entitled to a specific user: - -**Cmdlet**: Get-AppvClientPackage - -**Parameters**: -Name -Version -PackageID -VersionID - -**Example**: Get-AppvClientPackage –Name “ContosoApplication” -Version 2 - -## To add a package - - -Use the following information to add a package to a computer. - -**Important**   -This example only adds a package. It does not publish the package to the user or the computer. - - - -**Cmdlet**: Add-AppvClientPackage - -**Example**: $Contoso = Add-AppvClientPackage \\\\path\\to\\appv\\package.appv - -## To publish a package - - -Use the following information to publish a package that has been added to a specific user or globally to any user on the computer. - - ---- - - - - - - - - - - - - - - - - -
    Publishing methodCmdlet and example

    Publishing to the user

    Cmdlet: Publish-AppvClientPackage

    -

    Example: Publish-AppvClientPackage “ContosoApplication”

    Publishing globally

    Cmdlet: Publish-AppvClientPackage

    -

    Example: Publish-AppvClientPackage “ContosoApplication” -Global

    - - - -## To publish a package to a specific user - - -**Note**   -You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - -An administrator can publish a package to a specific user by specifying the optional **–UserSID** parameter with the **Publish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. - -- You must be logged in with administrative credentials to use the parameter. - -- The end user must be logged in. - -- You must provide the end user’s security identifier (SID). - -**Cmdlet**: Publish-AppvClientPackage - -**Example**: Publish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 - -## To add and publish a package - - -Use the following information to add a package to a computer and publish it to the user. - -**Cmdlet**: Add-AppvClientPackage - -**Example**: Add-AppvClientPackage \\\\path\\to\\appv\\package.appv | Publish-AppvClientPackage - -## To unpublish an existing package - - -Use the following information to unpublish a package which has been entitled to a user but not remove the package from the computer. - -**Cmdlet**: Unpublish-AppvClientPackage - -**Example**: Unpublish-AppvClientPackage “ContosoApplication” - -## To unpublish a package for a specific user - - -**Note**   -You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - -An administrator can unpublish a package for a specific user by using the optional **–UserSID** parameter with the **Unpublish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID). - -To use this parameter: - -- You can run this cmdlet from the user or administrator session. - -- You must be logged in with administrative credentials to use the parameter. - -- The end user must be logged in. - -- You must provide the end user’s security identifier (SID). - -**Cmdlet**: Unpublish-AppvClientPackage - -**Example**: Unpublish-AppvClientPackage “ContosoApplication” -UserSID S-1-2-34-56789012-3456789012-345678901-2345 - -## To remove an existing package - - -Use the following information to remove a package from the computer. - -**Cmdlet**: Remove-AppvClientPackage - -**Example**: Remove-AppvClientPackage “ContosoApplication” - -**Note**   -App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://go.microsoft.com/fwlink/?LinkId=324466). - - - -## To enable only administrators to publish or unpublish packages - - -**Note**   -**This feature is supported starting in App-V 5.0 SP3.** - - - -Use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages: - - ---- - - - - - - - - - - -

    Cmdlet

    Set-AppvClientConfiguration

    Parameter

    -RequirePublishAsAdmin

    -

    Parameter values:

    -
      -
    • 0 - False

    • -
    • 1 - True

    • -
    -

    Example:: Set-AppvClientConfiguration –RequirePublishAsAdmin1

    - - - -To use the App-V Management console to set this configuration, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md). - -## Understanding pending packages (UserPending and GlobalPending) - - -**Starting in App-V 5.0 SP2**: If you run a PowerShell cmdlet that affects a package that is currently in use, the task that you are trying to perform is placed in a pending state. For example, if you try to publish a package when an application in that package is being used, and then run **Get-AppvClientPackage**, the pending status appears in the cmdlet output as follows: - - ---- - - - - - - - - - - - - - - - - -
    Cmdlet output itemDescription

    UserPending

    Indicates whether the listed package has a pending task that is being applied to the user:

    -
      -
    • True

    • -
    • False

    • -

    GlobalPending

    Indicates whether the listed package has a pending task that is being applied globally to the computer:

    -
      -
    • True

    • -
    • False

    • -
    - - - -The pending task will run later, according to the following rules: - - ---- - - - - - - - - - - - - - - - - -
    Task typeApplicable rule

    User-based task, e.g., publishing a package to a user

    The pending task will be performed after the user logs off and then logs back on.

    Globally based task, e.g., enabling a connection group globally

    The pending task will be performed when the computer is shut down and then restarted.

    - - - -For more information about pending tasks, see [About App-V 5.0 SP2](about-app-v-50-sp2.md#bkmk-pkg-upgr-pendg-tasks). - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md deleted file mode 100644 index 742f6905de..0000000000 --- a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md +++ /dev/null @@ -1,147 +0,0 @@ ---- -title: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell -description: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell -author: dansimp -ms.assetid: b73ae74d-8a6f-4bb3-b1f2-0067c7bd5212 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell - - -An App-V connection group allows you to run all the virtual applications as a defined set of packages in a single virtual environment. For example, you can virtualize an application and its plug-ins by using separate packages, but run them together in a single connection group. - -A connection group XML file defines the connection group that runs on the computer where you’ve installed the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](about-the-connection-group-file.md). - -This topic explains the following procedures: - -- [To add and publish the App-V packages in the connection group](#bkmk-add-pub-pkgs-in-cg) - -- [To add and enable the connection group on the App-V client](#bkmk-add-enable-cg-on-clt) - -- [To enable or disable a connection group for a specific user](#bkmk-enable-cg-for-user-poshtopic) - -- [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg) - -**To add and publish the App-V packages in the connection group** - -1. To add and publish the App-V 5.0 packages to the computer running the App-V client, type the following command: - - Add-AppvClientPackage –path c:\\tmpstore\\quartfin.appv | Publish-AppvClientPackage - -2. Repeat **step 1** of this procedure for each package in the connection group. - -**To add and enable the connection group on the App-V client** - -1. Add the connection group by typing the following command: - - Add-AppvClientConnectionGroup –path c:\\tmpstore\\financ.xml - -2. Enable the connection group by typing the following command: - - Enable-AppvClientConnectionGroup –name “Financial Applications” - - When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. - -**To enable or disable a connection group for a specific user** - -1. Review the parameter description and requirements: - - - The parameter enables an administrator to enable or disable a connection group for a specific user. - - - You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - You can run this cmdlet from the user or administrator session. - - - You must be logged in with administrative credentials to use the parameter. - - - The end user must be logged in. - - - You must provide the end user’s security identifier (SID). - -2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID): - - - - - - - - - - - - - - - - - - - - - - -
    CmdletExamples

    Enable-AppVClientConnectionGroup

    Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    Disable -AppVClientConnectionGroup

    Disable -AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    - -**To allow only administrators to enable connection groups** - -1. Review the description and requirement for using this cmdlet: - - - Use this cmdlet and parameter to configure the App-V client to allow only administrators (not end users) to enable or disable connection groups. - - - You must be using at least App-V 5.0 SP3 to use this cmdlet. - -2. Run the following cmdlet and parameter: - - - - - - - - - - - - - - - - - - - - - -
    CmdletParameter and valuesExample

    Set-AppvClientConfiguration

    –RequirePublishAsAdmin

    -
      -
    • 0 - False

    • -
    • 1 - True

    • -

    Set-AppvClientConfiguration –RequirePublishAsAdmin1

    - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md deleted file mode 100644 index fb63bd845f..0000000000 --- a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md +++ /dev/null @@ -1,151 +0,0 @@ ---- -title: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell -description: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell -author: dansimp -ms.assetid: e1589eff-d306-40fb-a0ae-727190dafe26 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell - - -An App-V connection group allows you to run all the virtual applications as a defined set of packages in a single virtual environment. For example, you can virtualize an application and its plug-ins by using separate packages, but run them together in a single connection group. - -A connection group XML file defines the connection group that runs on the computer where you’ve installed the App-V client. For information about the connection group XML file and how to configure it, see [About the Connection Group File](about-the-connection-group-file51.md). - -This topic explains the following procedures: - -- [To add and publish the App-V packages in the connection group](#bkmk-add-pub-pkgs-in-cg) - -- [To add and enable the connection group on the App-V client](#bkmk-add-enable-cg-on-clt) - -- [To enable or disable a connection group for a specific user](#bkmk-enable-cg-for-user-poshtopic) - -- [To allow only administrators to enable connection groups](#bkmk-admin-only-posh-topic-cg) - -*To add and publish the App-V packages in the connection group** - -1. To add and publish the App-V 5.1 packages to the computer running the App-V client, type the following command: - - Add-AppvClientPackage –path c:\\tmpstore\\quartfin.appv | Publish-AppvClientPackage - -2. Repeat **step 1** of this procedure for each package in the connection group. - -**To add and enable the connection group on the App-V client** - -1. Add the connection group by typing the following command: - - Add-AppvClientConnectionGroup –path c:\\tmpstore\\financ.xml - -2. Enable the connection group by typing the following command: - - Enable-AppvClientConnectionGroup –name “Financial Applications” - - When any virtual applications that are in the member packages are run on the target computer, they will run inside the connection group’s virtual environment and will be available to all the virtual applications in the other packages in the connection group. - -**To enable or disable a connection group for a specific user** - -1. Review the parameter description and requirements: - - - The parameter enables an administrator to enable or disable a connection group for a specific user. - - - You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter. - - - You can run this cmdlet from the user or administrator session. - - - You must be logged in with administrative credentials to use the parameter. - - - The end user must be logged in. - - - You must provide the end user’s security identifier (SID). - -2. Use the following cmdlets, and add the optional **–UserSID** parameter, where **-UserSID** represents the end user’s security identifier (SID): - - - - - - - - - - - - - - - - - - - - - - -
    CmdletExamples

    Enable-AppVClientConnectionGroup

    Enable-AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    Disable -AppVClientConnectionGroup

    Disable -AppVClientConnectionGroup “ConnectionGroupA” -UserSID S-1-2-34-56789012-3456789012-345678901-2345

    - -**To allow only administrators to enable connection groups** - -1. Review the description and requirement for using this cmdlet: - - - Use this cmdlet and parameter to configure the App-V client to allow only administrators (not end users) to enable or disable connection groups. - - - You must be using at least App-V 5.0 SP3 to use this cmdlet. - -2. Run the following cmdlet and parameter: - - - - - - - - - - - - - - - - - - - - - -
    CmdletParameter and valuesExample

    Set-AppvClientConfiguration

    –RequirePublishAsAdmin

    -
      -
    • 0 - False

    • -
    • 1 - True

    • -

    Set-AppvClientConfiguration –RequirePublishAsAdmin1

    - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md deleted file mode 100644 index 08be8a6ee4..0000000000 --- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer -description: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer -ms.assetid: 3ae9996f-71d9-4ca1-9aab-25b599158e55 -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer - -**Note:** App-V 4.6 has exited Mainstream support. - -Use the following procedure to migrate extension points from an App-V 4.6 package to a App-V 5.0 package using the deployment configuration file. - -**Note**   -The following procedure does not require an App-V 5.0 management server. - - - -**To migrate extension points from a package from an App-V 4.6 package to a converted App-V 5.0 package using the deployment configuration file** - -1. Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section: - - **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>** - - The following is an example of content from a deployment configuration file: - - <?xml version="1.0" ?> - - <DeploymentConfiguration - - xmlns="" PackageId=<Package ID> DisplayName=<Display Name> - - <MachineConfiguration/> - - <UserConfiguration> - - <ManagingAuthority TakeoverExtensionPointsFrom46="true" - - PackageName=<Package ID> - - </UserConfiguration> - - </DeploymentConfiguration> - -2. To add the App-V 5.0 package, in an elevated PowerShell command prompt type: - - PS>**$pkg= Add-AppvClientPackage** **–Path** <Path to package location> -**DynamicDeploymentConfiguration** <Path to the deployment configuration file> - - PS>**Publish-AppVClientPackage $pkg** - -3. To test the migration, open the virtual application using associated FTAs or shortcuts. The application opens with App-V 5.0. Both, the App-V 4.6 package and the converted App-V 5.0 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.0 package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md deleted file mode 100644 index 3a18c1b154..0000000000 --- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer -description: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer -author: dansimp -ms.assetid: 4ef823a5-3106-44c5-aecc-29edf69c2fbb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer - - -Use the following procedure to migrate extension points from an App-V 4.6 package to a App-V 5.1 package using the deployment configuration file. - -**Note**   -This procedure assumes that you are running the latest version of App-V 4.6. -The following procedure does not require an App-V 5.1 management server. - - - -**To migrate extension points from a package from an App-V 4.6 package to a converted App-V 5.1 package using the deployment configuration file** - -1. Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section: - - **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>** - - The following is an example of content from a deployment configuration file: - - <?xml version="1.0" ?> - - <DeploymentConfiguration - - xmlns="" PackageId=<Package ID> DisplayName=<Display Name> - - <MachineConfiguration/> - - <UserConfiguration> - - <ManagingAuthority TakeoverExtensionPointsFrom46="true" - - PackageName=<Package ID> - - </UserConfiguration> - - </DeploymentConfiguration> - -2. To add the App-V 5.1 package, in an elevated PowerShell command prompt type: - - PS>**$pkg= Add-AppvClientPackage** **–Path** <Path to package location> -**DynamicDeploymentConfiguration** <Path to the deployment configuration file> - - PS>**Publish-AppVClientPackage $pkg** - -3. To test the migration, open the virtual application using associated FTAs or shortcuts. The application opens with App-V 5.1. Both, the App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md deleted file mode 100644 index 6e636ec80a..0000000000 --- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User -description: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User -ms.assetid: dad25992-3c75-4b7d-b4c6-c2edf43baaea -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User - -*Note:** App-V 4.6 has exited Mainstream support. - -Use the following procedure to migrate packages created with App-V using the user configuration file. - -**To convert a package** - -1. Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**. - - The following is an example of a user configuration file: - - <?xml version="1.0" ?> - - <UserConfiguration PackageId=<Package ID> DisplayName=<Name of the Package> - - xmlns="; <ManagingAuthority TakeoverExtensionPointsFrom46="true" - - PackageName=<Package ID> - - </UserConfiguration> - -2. To add the App-V 5.0 package type the following in an elevated PowerShell command prompt: - - PS>**$pkg= Add-AppvClientPackage –Path** <Path to package location> - - PS>**Publish-AppVClientPackage $pkg -DynamicUserConfiguration** <Path to the user configuration file> - -3. Open the application using FTAs or shortcuts now. The application should open using App-V 5.0. - - The App-V SP2 package and the converted App-V 5.0 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.0 package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md deleted file mode 100644 index cbec1bdbe6..0000000000 --- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User -description: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User -author: dansimp -ms.assetid: 19da3776-5ebe-41e1-9890-12b84ef3c1c7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User - - -Use the following procedure to migrate packages created with App-V using the user configuration file. - -**Note**   -This procedure assumes that you are running the latest version of App-V 4.6. - -**To convert a package** - -1. Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**. - - The following is an example of a user configuration file: - - <?xml version="1.0" ?> - - <UserConfiguration PackageId=<Package ID> DisplayName=<Name of the Package> - - xmlns="; <ManagingAuthority TakeoverExtensionPointsFrom46="true" - - PackageName=<Package ID> - - </UserConfiguration> - -2. To add the App-V 5.1 package, type the following in an elevated PowerShell command prompt window: - - PS>**$pkg= Add-AppvClientPackage –Path** <Path to package location> - - PS>**Publish-AppVClientPackage $pkg -DynamicUserConfiguration** <Path to the user configuration file> - -3. Open the application using FTAs or shortcuts now. The application should open using App-V 5.1. - - The App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md deleted file mode 100644 index 8a537ea939..0000000000 --- a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md +++ /dev/null @@ -1,168 +0,0 @@ ---- -title: How to Modify an Existing Virtual Application Package -description: How to Modify an Existing Virtual Application Package -author: dansimp -ms.assetid: 6cdeec00-e4fe-4210-b4c7-6ca1ac643ddd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Modify an Existing Virtual Application Package - - -This topic explains how to: - -- [Update an application in an existing virtual application package](#bkmk-update-app-in-pkg) - -- [Modify the properties associated with an existing virtual application package](#bkmk-chg-props-in-pkg) - -- [Add a new application to an existing virtual application package](#bkmk-add-app-to-pkg) - -**Before you update a package:** - -- Ensure that you’ve installed the Microsoft Application Virtualization (App-V) Sequencer, which is required for modifying a virtual application package. To install the App-V Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -- Save the .appv file in a secure location and always trust the source before trying to open the package for editing. - -- The Managing Authority section is erroneously removed from the deployment configuration file when you update a package. Before starting the update, copy the Managing Authority section from the existing deployment configuration file, and then paste the copied section into the new configuration file after the conversion is complete. - -- If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. - -**Update an application in an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Update Application in Existing Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application to update, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the application update to fail or cause the updated application to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. - - **Note**   - The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. - -9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**.   - -10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**. - -11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. - -**Modify the properties associated with an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Edit Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties to modify, and then click **Edit**. - -5. In the App-V Sequencer console, perform any of the following tasks as needed: - - - Import and export the manifest file. - - - Enable or disable Browser Helper Objects. - - - Import or export a VFS file. - - - Import a directory into the virtual file system. - - - Import and export virtual registry keys. - - - View package properties. - - - View associated package files. - - - Edit registry settings. - - - Review additional package settings (except operating system file properties). - - - Set virtualized registry key state (override or merge). - - - Set virtualized folder state. - - - Add or edit shortcuts and file type associations. - - **Note**   - To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. - -6. When you finish changing the package properties, click **File** > **Save** to save the package. - -**Add a new application to an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Add New Application** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package to which you will add the application, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or cause the revised package to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package. - - **Note**   - The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. - -10. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 13 of this procedure. If you want to perform the following described customization, click **Customize**. - - If you are customizing, prepare the virtual package for streaming, and then click **Next**. Streaming improves the experience when the virtual application package is run on target computers. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. - -12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. - -13. On the **Completion** page, click **Close**. The package is now available in the sequencer. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md deleted file mode 100644 index cb4d6428ca..0000000000 --- a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md +++ /dev/null @@ -1,158 +0,0 @@ ---- -title: How to Modify an Existing Virtual Application Package -description: How to Modify an Existing Virtual Application Package -author: dansimp -ms.assetid: 86b0fe21-52b0-4a9c-9a66-c78935fe74f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Modify an Existing Virtual Application Package - - -This topic explains how to: - -- [Update an application in an existing virtual application package](#bkmk-update-app-in-pkg) - -- [Modify the properties associated with an existing virtual application package](#bkmk-chg-props-in-pkg) - -- [Add a new application to an existing virtual application package](#bkmk-add-app-to-pkg) - -**Before you update a package:** - -- Ensure that you’ve installed the Microsoft Application Virtualization (App-V) Sequencer, which is required for modifying a virtual application package. To install the App-V Sequencer, see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -- Save the .appv file in a secure location and always trust the source before trying to open the package for editing. - -- The Managing Authority section is erroneously removed from the deployment configuration file when you update a package. Before starting the update, copy the Managing Authority section from the existing deployment configuration file, and then paste the copied section into the new configuration file after the conversion is complete. - -- If you click **Modify an Existing Virtual Application Package** in the Sequencer in order to edit a package, but then make no changes and close the package, the streaming behavior of the package is changed. The primary feature block is removed from the StreamMap.xml file, and any files that were listed in the publishing feature block are removed. Users who receive the edited package experience that package as if it were stream-faulted, regardless of how the original package was configured. - -**Update an application in an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Update Application in Existing Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application to update, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the application update to fail or cause the updated application to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files are added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file, and if you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application update so the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and then locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. - - **Note**   - The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information. To proceed, click **Next**. - -9. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all of the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop**, and then select either **Stop all applications** or **Stop this application only**. - -10. On the **Create Package** page, to modify the package without saving it, select the check box for **Continue to modify package without saving using the package editor**. When you select this option, the package opens in the App-V Sequencer console, where you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful to identify the application version and provide other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. Click **Create**. - -11. On the **Completion** page, click **Close** to close the wizard. The package is now available in the sequencer. - -**Modify the properties associated with an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Edit Package** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package that contains the application properties to modify, and then click **Edit**. - -5. In the App-V Sequencer console, perform any of the following tasks as needed: - - - View package properties. - - - View associated package files. - - - Edit registry settings. - - - Review additional package settings (except operating system file properties). - - - Set virtualized registry key state (override or merge). - - - Set virtualized folder state. - - - Add or edit shortcuts and file type associations. - - **Note**   - To edit shortcuts or file type associations, you must first open the package for upgrade to add a new application, and then proceed to the final editing page. - -6. When you finish changing the package properties, click **File** > **Save** to save the package. - -**Add a new application to an existing virtual application package** - -1. On the computer that runs the sequencer, click **All Programs**, point to **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the App-V Sequencer, click **Modify an Existing Virtual Application Package** > **Next**. - -3. On the **Select Task** page, click **Add New Application** > **Next**. - -4. On the **Select Package** page, click **Browse** to locate the virtual application package to which you will add the application, and then click **Next**. - -5. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or cause the revised package to contain unnecessary data. Resolve all potential issues before you continue. After making any corrections and resolving all potential issues, click **Refresh** > **Next**. - - **Important**   - If you are required to disable virus scanning software, first scan the computer that runs the sequencer to ensure that no unwanted or malicious files can be added to the package. - -6. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready, install the application so that the sequencer can monitor the installation process. If additional installation files must be run as part of the installation, click **Run**, and locate and run the additional installation files. When you finish the installation, select **I am finished installing** > **Next**. In the **Browse for Folder** dialog box, specify the primary directory where the application will be installed. Ensure that this is a new location so that you don’t overwrite the existing version of the virtual application package. - - **Note**   - The sequencer monitors all changes and installations that occur on the computer that runs the sequencer. This includes any changes and installations that are performed outside of the sequencing wizard. - -8. On the **Configure Software** page, optionally run the programs contained in the package. This step completes any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**. - -9. On the **Installation Report** page, you can review information about the updated virtual application. In **Additional Information**, double-click the event to obtain more detailed information, and then click **Next** to open the **Customize** page. - -10. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 13 of this procedure. If you want to perform the following described customization, click **Customize**. - - If you are customizing, prepare the virtual package for streaming, and then click **Next**. Streaming improves the experience when the virtual application package is run on target computers. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note**   - You can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and then select either **Stop all applications** or **Stop this application only**. - -12. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the App-V Sequencer console, where you can modify the package before saving it. Click **Next**. - - To save the package immediately, select the default **Save the package now**. Add optional **Comments** to associate with the package. Comments are useful for providing application versions and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. Click **Create**. - -13. On the **Completion** page, click **Close**. The package is now available in the sequencer. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md b/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md deleted file mode 100644 index 8ad3680354..0000000000 --- a/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy -description: How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy -author: dansimp -ms.assetid: 79d03a2b-2586-4ca7-bbaa-bdeb0a694279 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy - - -Use the App-V 5.0 ADMX template to configure App-V 5.0 client settings using the ADMX Template and Group Policy. - -**To modify App-V 5.0 client configuration using Group Policy** - -1. To modify the App-V 5.0 client configuration, locate the **ADMXTemplate** files that are available with App-V 5.0. - - **Note**   - Use the following link to download the App-V 5.0 **ADMX Templates**: . - - - -2. On the computer where you manage group Policy, typically the domain controller, copy the template **.admx** file to the following directory: **<Installation Drive> \\ Windows \\ PolicyDefinitions**. - - Next, on the same computer, copy the **.adml** file to the following directory: **<InstallationDrive> \\ Windows \\ PolicyDefinitions \\ en-US**. - -3. After you have copied the files open the Group Policy Management Console, to modify the policies associated with your App-V 5.0 clients browse to **Computer Configuration** / **Policies** / **Administrative Templates** / **System** / **App-V**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - -[About Client Configuration Settings](about-client-configuration-settings.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md b/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md deleted file mode 100644 index b316fe6660..0000000000 --- a/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy -description: How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy -author: dansimp -ms.assetid: 0d9cf13a-b29c-4c87-a776-15fea34027dd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy - - -Use the Microsoft Application Virtualization (App-V) 5.1 ADMX template to configure App-V 5.1 client settings using the ADMX Template and Group Policy. - -**To modify App-V 5.1 client configuration using Group Policy** - -1. To modify the App-V 5.1 client configuration, locate the **ADMXTemplate** files that are available with App-V 5.1. - - **Note**   - Use the following link to download the App-V 5.1 **ADMX Templates**: . - - - -2. On the computer where you manage group Policy, typically the domain controller, copy the template **.admx** file to the following directory: **<Installation Drive> \\ Windows \\ PolicyDefinitions**. - - Next, on the same computer, copy the **.adml** file to the following directory: **<InstallationDrive> \\ Windows \\ PolicyDefinitions \\ en-US**. - -3. After you have copied the files open the Group Policy Management Console, to modify the policies associated with your App-V 5.1 clients browse to **Computer Configuration** / **Policies** / **Administrative Templates** / **System** / **App-V**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - -[About Client Configuration Settings](about-client-configuration-settings51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md b/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md deleted file mode 100644 index b51429c229..0000000000 --- a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Modify Client Configuration by Using PowerShell -description: How to Modify Client Configuration by Using PowerShell -author: dansimp -ms.assetid: 53ccb2cf-ef81-4310-a853-efcb395f006e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify Client Configuration by Using PowerShell - - -Use the following procedure to configure the App-V 5.0 client configuration. - -**To modify App-V 5.0 client configuration using PowerShell** - -1. To configure the client settings using PowerShell, use the **Set-AppvClientConfiguration** cmdlet. - -2. To modify the client configuration, open a PowerShell Command prompt and run the following cmdlet **Set-AppvClientConfiguration** with any required parameters. For example: - - `$config = Get-AppvClientConfiguration` - - `Set-AppvClientConfiguration $config` - - `Set-AppvClientConfiguration –AutoLoad 2` - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md b/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md deleted file mode 100644 index ba031caf40..0000000000 --- a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Modify Client Configuration by Using PowerShell -description: How to Modify Client Configuration by Using PowerShell -author: dansimp -ms.assetid: c3a59592-bb0d-43b6-8f4e-44f3a2d5b7ea -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Modify Client Configuration by Using PowerShell - - -Use the following procedure to configure the App-V 5.1 client configuration. - -**To modify App-V 5.1 client configuration using PowerShell** - -1. To configure the client settings using PowerShell, use the **Set-AppvClientConfiguration** cmdlet. For more information about installing PowerShell, and a list of cmdlets see, [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md). - -2. To modify the client configuration, open a PowerShell Command prompt and run the following cmdlet **Set-AppvClientConfiguration** with any required parameters. For example: - - `$config = Get-AppvClientConfiguration` - - `Set-AppvClientConfiguration $config` - - `Set-AppvClientConfiguration –AutoLoad 2` - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md b/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md deleted file mode 100644 index 75439a513b..0000000000 --- a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: How to Move the App-V Server to Another Computer -description: How to Move the App-V Server to Another Computer -author: dansimp -ms.assetid: 4fda21be-4d6b-499c-a38a-5afd57b34a47 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move the App-V Server to Another Computer - - -Use the following information to create a new management server console in your environment. - -## To create a new management server console - - -The following list displays the steps necessary to create a new management server console: - -1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md). - -2. After you have completed the installation, use the following link to connect it to the App-V 5.0 database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md). - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md b/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md deleted file mode 100644 index 65179dff17..0000000000 --- a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: How to Move the App-V Server to Another Computer -description: How to Move the App-V Server to Another Computer -author: dansimp -ms.assetid: 853af9eb-db5b-421d-a0fe-79ded8752cef -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move the App-V Server to Another Computer - - -Use the following information to create a new management server console in your environment. - -## To create a new management server console - - -The following list displays the steps necessary to create a new management server console: - -1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md). - -2. After you have completed the installation, use the following link to connect it to the App-V 5.1 database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md). - -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-publish-a-connection-group.md b/mdop/appv-v5/how-to-publish-a-connection-group.md deleted file mode 100644 index d3e96c272e..0000000000 --- a/mdop/appv-v5/how-to-publish-a-connection-group.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Publish a Connection Group -description: How to Publish a Connection Group -author: dansimp -ms.assetid: c61db00a-8393-485c-949e-af2098b9e258 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Connection Group - - -After you create a connection group, you must publish it to computers that run the App-V client. - -**To publish a connection group** - -1. Open the App-V Management Console, and select **Packages** > **CONNECTION GROUPS**. - -2. Right-click the connection group to be published, and select **publish**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[Managing Connection Groups](managing-connection-groups.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-publish-a-connection-group51.md b/mdop/appv-v5/how-to-publish-a-connection-group51.md deleted file mode 100644 index 523eb51739..0000000000 --- a/mdop/appv-v5/how-to-publish-a-connection-group51.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Publish a Connection Group -description: How to Publish a Connection Group -author: dansimp -ms.assetid: fe89601c-23c6-4b7c-a61b-4ca50908f1b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Connection Group - - -After you create a connection group, you must publish it to computers that run the App-V client. - -**To publish a connection group** - -1. Open the App-V Management Console, and select **CONNECTION GROUPS**. - -2. Right-click the connection group to be published, and select **publish**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[Managing Connection Groups](managing-connection-groups51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md b/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md deleted file mode 100644 index 99df93599f..0000000000 --- a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Publish a Package by Using the Management Console -description: How to Publish a Package by Using the Management Console -author: dansimp -ms.assetid: 7c6930fc-5c89-4519-a901-512dae155fd2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Package by Using the Management Console - - -Use the following procedure to publish an App-V 5.0 package. Once you publish a package, computers that are running the App-V 5.0 client can access and run the applications in that package. - -**Note**   -The ability to enable only administrators to publish or unpublish packages (described below) is supported starting in App-V 5.0 SP3. - - - -**To publish an App-V 5.0 package** - -1. In the App-V 5.0 Management console. right-click the name of the package to be published, and select **Publish**. - -2. Review the **Status** column to verify that the package has been published and is now available. If the package is available, the status **published** is displayed. - - If the package is not published successfully, the status **unpublished** is displayed, along with error text that explains why the package is not available. - -**To enable only administrators to publish or unpublish packages** - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To alternatively use PowerShell to set this item, see [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md deleted file mode 100644 index 9a64b6ff65..0000000000 --- a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Publish a Package by Using the Management Console -description: How to Publish a Package by Using the Management Console -author: dansimp -ms.assetid: e34d2bcf-15ac-4a75-9dc8-79380b36a25f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish a Package by Using the Management Console - - -Use the following procedure to publish an App-V 5.1 package. Once you publish a package, computers that are running the App-V 5.1 client can access and run the applications in that package. - -**Note**   -The ability to enable only administrators to publish or unpublish packages (described below) is supported starting in App-V 5.0 SP3. - - - -**To publish an App-V 5.1 package** - -1. In the App-V 5.1 Management console. Click or right-click the name of the package to be published. Select **Publish**. - -2. Review the **Status** column to verify that the package has been published and is now available. If the package is available, the status **published** is displayed. - - If the package is not published successfully, the status **unpublished** is displayed, along with error text that explains why the package is not available. - -**To enable only administrators to publish or unpublish packages** - -1. Navigate to the following Group Policy Object node: - - **Computer Configuration > Policies > Administrative Templates > System > App-V > Publishing**. - -2. Enable the **Require publish as administrator** Group Policy setting. - - To alternatively use PowerShell to set this item, see [How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs). - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md b/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md deleted file mode 100644 index abd93c7e0a..0000000000 --- a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Register and Unregister a Publishing Server by Using the Management Console -description: How to Register and Unregister a Publishing Server by Using the Management Console -author: dansimp -ms.assetid: c24f3b43-4888-41a9-9a39-973657f2b917 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Register and Unregister a Publishing Server by Using the Management Console - - -You can register and unregister publishing servers that will synchronize with the App-V 5.0 management server. You can also see the last attempt that the publishing server made to synchronize the information with the management server. - -Use the following procedure to register or unregister a publishing server. - -**To register a publishing server using the Management Console** - -1. Connect to the Management Console and select **Servers**. For more information about how to connect to the Management Console, see [How to Connect to the Management Console](how-to-connect-to-the-management-console-beta.md). - -2. A list of publishing servers that already synchronize with the management server is displayed. Click Register New Server to register a new server. - -3. Type a computer name of a domain joined computer on the **Server Name** line, to specify a name for the server. You should also include a domain name, for example, **MyDomain\\TestServer**. Click **Check**. - -4. Select the computer and click **Add** to add the computer to the list of servers. The new server will be displayed in the list. - -**To unregister a publishing server using the Management Console** - -1. Connect to the Management Console and select **Servers**. For more information about how to connect to the Management Console, see [How to Connect to the Management Console](how-to-connect-to-the-management-console-beta.md). - -2. A list of publishing servers that synchronize with the management server is displayed. - -3. To unregister the server, right-click the computer name and select the computer name and select **unregister server**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md b/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md deleted file mode 100644 index 7e06b09dbc..0000000000 --- a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Register and Unregister a Publishing Server by Using the Management Console -description: How to Register and Unregister a Publishing Server by Using the Management Console -author: dansimp -ms.assetid: 69cef0a8-8102-4697-b1ba-f16e0f25216b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Register and Unregister a Publishing Server by Using the Management Console - - -You can register and unregister publishing servers that will synchronize with the App-V 5.1 management server. You can also see the last attempt that the publishing server made to synchronize the information with the management server. - -Use the following procedure to register or unregister a publishing server. - -**To register a publishing server using the Management Console** - -1. Connect to the Management Console and select **Servers**. For more information about how to connect to the Management Console, see [How to Connect to the Management Console](how-to-connect-to-the-management-console-51.md). - -2. A list of publishing servers that already synchronize with the management server is displayed. Click Register New Server to register a new server. - -3. Type a computer name of a domain joined computer on the **Server Name** line, to specify a name for the server. You should also include a domain name, for example, **MyDomain\\TestServer**. Click **Check**. - -4. Select the computer and click **Add** to add the computer to the list of servers. The new server will be displayed in the list. - -**To unregister a publishing server using the Management Console** - -1. Connect to the Management Console and select **Servers**. For more information about how to connect to the Management Console, see [How to Connect to the Management Console](how-to-connect-to-the-management-console-51.md). - -2. A list of publishing servers that synchronize with the management server is displayed. - -3. To unregister the server, right-click the computer name and select the computer name and select **unregister server**. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md deleted file mode 100644 index 76656d39e1..0000000000 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -ms.reviewer: -title: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User -description: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User -ms.assetid: f1d2ab1f-0831-4976-b49f-169511d3382a -author: dansimp -ms.assetid: f1d2ab1f-0831-4976-b49f-169511d3382a -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User - -*Note:** App-V 4.6 has exited Mainstream support. - -Use the following procedure to revert an App-V 5.0 package to the App-V file format using the user configuration file. - -**To revert a package** - -1. Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.0 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md). - - In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>** - -2. From an elevated command prompt, type: - - PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath** <path to user configuration file> - -3. Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6 SP2. - - **Note** - If you do not need the App-V 5.0 package anymore, you can unpublish the App-V 5.0 package and the extension points will automatically revert to App-V 4.6. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - - - - diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md deleted file mode 100644 index d8bed1b729..0000000000 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: "How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer" -description: How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer -ms.assetid: 2a43ca1b-6847-4dd1-ade2-336ac4ac6af0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer - -*Note:** App-V 4.6 has exited Mainstream support. The following assumes that the App-V 4.6 SP3 client is already installed. - -Use the following procedure to revert extension points from an App-V 5.0 package to the App-V 4.6 file format using the deployment configuration file. - -**To revert a package** - -1. Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.0 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md). - - In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>** - -2. From an elevated command prompt, type: - - PS>**Set-AppvClientPackage $pkg –DynamicDeploymentConfiguration** <path to deployment configuration file> - - PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationType useDeploymentConfiguration** - -3. Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 SP2 package. - - Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6. - - **Note** - If you do not need the App-V 5.0 package anymore, you can unpublish the App-V 5.0 package and the extension points will automatically revert to App-V 4.6. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md deleted file mode 100644 index b62aea5290..0000000000 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User -description: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User -author: dansimp -ms.assetid: bd53c5d6-7fd2-4816-b03b-d59da0a35819 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User - - -Use the following procedure to revert an App-V 5.1 package to the App-V file format using the user configuration file. - -**To revert a package** - -1. Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md). - - In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>** - -2. From an elevated command prompt, type: - - PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath** <path to user configuration file> - -3. Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6. - - **Note** - If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md deleted file mode 100644 index 7c6b1455cf..0000000000 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer -description: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer -author: dansimp -ms.assetid: 64640b8e-de6b-4006-a33e-353d285af15e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer - - -Use the following procedure to revert extension points from an App-V 5.1 package to the App-V 4.6 file format using the deployment configuration file. - -**To revert a package** - -1. Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md). - - In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>** - -2. From an elevated command prompt, type: - - PS>**Set-AppvClientPackage $pkg –DynamicDeploymentConfiguration** <path to deployment configuration file> - - PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationType useDeploymentConfiguration** - -3. Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 package. - - Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6. - - **Note** - If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md deleted file mode 100644 index 8652ce06d6..0000000000 --- a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md +++ /dev/null @@ -1,332 +0,0 @@ ---- -title: How to Sequence a New Application with App-V 5.0 -description: How to Sequence a New Application with App-V 5.0 -author: dansimp -ms.assetid: a263fa84-cd6d-4219-a5c2-eb6a553b826c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application with App-V 5.0 - - -**To review or do before you start sequencing** - -1. Determine the type of virtualized application package you want to create: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Application typeDescription

    Standard

    Creates a package that contains an application or a suite of applications. This is the preferred option for most application types.

    Add-on or plug-in

    Creates a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or for another package that is linked by using connection groups.

    Middleware

    Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages by using connection groups.

    - - - -2. Copy all required installation files to the computer that is running the sequencer. - -3. Make a backup image of your virtual environment before sequencing an application, and then revert to that image each time after you finish sequencing an application. - -4. Review the following items: - - - If an application installer changes the security access to a new or existing file or directory, those changes are not captured in the package. - - - If short paths have been disabled for the virtualized package’s target volume, you must also sequence the package to a volume that was created and still has short-paths disabled. It cannot be the system volume. - - - Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden). - -**To sequence a new standard application** - -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, click the **Standard Application (default)** check box, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. - - **Note** - If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package. - - - -~~~ -If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**. -~~~ - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. - - The **Primary Virtual Application Directory** displays the path where the application will be installed on target computers. To specify this location, select **Browse**. - - **Note** - Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden). - - - -~~~ -**Important** -The primary application virtual directory should match the installation location for the application that is being sequenced. For example, if you install Notepad to **C:\\Program Files\\Notepad**; you should configure **C:\\Program Files\\Notepad** as your primary virtual directory. Alternatively, you can choose to set **C:\\Notepad** as the primary virtual application directory, as long as during installation time, you configure the installer to install to **C:\\Notepad**. Editing the Application Virtualization path is an advanced configuration task. For most applications, the default path is recommended for the following reasons: - -- Application Compatibility. Some virtualized applications will not function correctly, or will fail to open if the directories are not configured with identical virtual directory paths. - -- Performance. Since no file system redirection is required, the runtime performance can improve. - - - -**Tip** -It is recommended that prior to Sequencing an application, you open the associated installer to determine the default installation directory, and then configure that location as the **Primary Virtual Application Directory**. - - - -Click **Next**. -~~~ - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. - - **Important** - You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring. - - - -~~~ -Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. -~~~ - -8. On the **Installation** page, wait while the sequencer configures the virtualized application package. - -9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run. - - **Note** - To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step. - - - -~~~ -Click **Next**. -~~~ - -10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. - -11. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - - Specify the operating systems that can run this package. - - Click **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - **Note** - If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application. - - - -13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. Click **Next**. - - **Important** - Make sure that the operating systems you specify here are supported by the application you are sequencing. - - - -14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package. - - **Important** - The system does not support non-printable characters in **Comments** and **Descriptions**. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory where the package was created. - - The package is now available in the sequencer. - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -**To sequence an add-on or plug-in application** - -1. - - **Note** - Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer. - - For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. - - - -~~~ -On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. -~~~ - -2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**. - - Click **Next**. - -7. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console. The **Primary Virtual Application Directory** displays the path where the application will be installed. To specify this location, type the path, or click **Browse**. - - **Note** - Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden). - - - -~~~ -Click **Next**. -~~~ - -8. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**. - -9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**. - - - Optimize how the package will run across a slow or unreliable network. - - - Specify the operating systems that can run this package. - - Click **Next**. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all the applications to run. After all applications have run, close each of the applications. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Click **Next**. - - **Note** - If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**. - - - -12. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**. - -13. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** that will be associated with the package. Descriptions are useful for identifying the version and other information about the package. - - **Important** - The system does not support non-printable characters in Comments and Descriptions. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -**To sequence a middleware application** - -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - **Important** - If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package. - - - -4. On the **Type of Application** page, select **Middleware**, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. The **Primary Virtual Application Directory** displays the path where the application will be installed. To specify this location, type the path or click **Browse**. - - Click **Next**. - -7. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**. - -8. On the **Installation** page, wait while the sequencer configures the virtual application package. - -9. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. - -10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**. - -11. On the **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** to be associated with the package. Descriptions are useful for identifying the program version and other information about the package. - - **Important** - The system does not support non-printable characters in Comments and Descriptions. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -12. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure. - - The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**. - - **Important** - After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md deleted file mode 100644 index ba6d5a807d..0000000000 --- a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md +++ /dev/null @@ -1,308 +0,0 @@ ---- -title: How to Sequence a New Application with App-V 5.1 -description: How to Sequence a New Application with App-V 5.1 -author: dansimp -ms.assetid: 7d7699b1-0cb8-450d-94e7-5af937e16c21 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a New Application with App-V 5.1 - - -**To review or do before you start sequencing** - -1. Determine the type of virtualized application package you want to create: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Application typeDescription

    Standard

    Creates a package that contains an application or a suite of applications. This is the preferred option for most application types.

    Add-on or plug-in

    Creates a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or for another package that is linked by using connection groups.

    Middleware

    Creates a package that is required by a standard application, for example, Java. Middleware packages are used for linking to other packages by using connection groups.

    - - - -2. Copy all required installation files to the computer that is running the sequencer. - -3. Make a backup image of your virtual environment before sequencing an application, and then revert to that image each time after you finish sequencing an application. - -4. Review the following items: - - - If an application installer changes the security access to a new or existing file or directory, those changes are not captured in the package. - - - If short paths have been disabled for the virtualized package’s target volume, you must also sequence the package to a volume that was created and still has short-paths disabled. It cannot be the system volume. - -> [!NOTE] -> The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. - -**To sequence a new standard application** - -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - > [!IMPORTANT] - > If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - - - -~~~ -> [!NOTE] -> There is currently no way to disable Windows Defender in Windows 10. If you receive a warning, you can safely ignore it. It is unlikely that Windows Defender will affect sequencing at all. -~~~ - - - -4. On the **Type of Application** page, click the **Standard Application (default)** check box, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. - - > [!NOTE] - > If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package. - - - -~~~ -If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**. -~~~ - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. - - Click **Next**. - -7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. - - > [!IMPORTANT] - > You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring. - - - -~~~ -Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**. -~~~ - -8. On the **Installation** page, wait while the sequencer configures the virtualized application package. - -9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run. - - > [!NOTE] - > To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step. - - - -~~~ -Click **Next**. -~~~ - -10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. - -11. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. - - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - - Specify the operating systems that can run this package. - - Click **Next**. - -12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. - - > [!NOTE] - > If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application. - - - -13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. Click **Next**. - - > [!IMPORTANT] - > Make sure that the operating systems you specify here are supported by the application you are sequencing. - - - -14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package. - - > [!IMPORTANT] - > The system does not support non-printable characters in **Comments** and **Descriptions**. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory where the package was created. - - The package is now available in the sequencer. - - > [!IMPORTANT] - > After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -**To sequence an add-on or plug-in application** - -1. > [!NOTE] - > Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer. - > - > For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package. - - - -~~~ -On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. -~~~ - -2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - > [!IMPORTANT] - > If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package. - - - -4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**. - - Click **Next**. - -7. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console. - - Click **Next**. - -8. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**. - -9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**. - -10. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**. - - - Optimize how the package will run across a slow or unreliable network. - - - Specify the operating systems that can run this package. - - Click **Next**. - -11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all the applications to run. After all applications have run, close each of the applications. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Click **Next**. - - > [!NOTE] - > If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**. - - - -12. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**. - -13. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** that will be associated with the package. Descriptions are useful for identifying the version and other information about the package. - - > [!IMPORTANT] - > The system does not support non-printable characters in Comments and Descriptions. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -**To sequence a middleware application** - -1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**. - -2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**. - -3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**. - - > [!IMPORTANT] - > If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package. - - - -4. On the **Type of Application** page, select **Middleware**, and then click **Next**. - -5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**. - -6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. - - Click **Next**. - -7. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**. - -8. On the **Installation** page, wait while the sequencer configures the virtual application package. - -9. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**. - -10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**. - -11. On the **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**. - - To save the package immediately, select **Save the package now**. Optionally, add a **Description** to be associated with the package. Descriptions are useful for identifying the program version and other information about the package. - - > [!IMPORTANT] - > The system does not support non-printable characters in Comments and Descriptions. - - - -~~~ -The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**. -~~~ - -12. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure. - - The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**. - - > [!IMPORTANT] - > After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md b/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md deleted file mode 100644 index d9728ec6c1..0000000000 --- a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Sequence a Package by Using PowerShell -description: How to Sequence a Package by Using PowerShell -author: dansimp -ms.assetid: b41feed9-d1c5-48a3-940c-9a21d594f4f8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a Package by Using PowerShell - - -Use the following procedure to create a new App-V 5.0 package using PowerShell. - -**Note**   -Before you use this procedure you must copy the associated installer files to the computer running the sequencer and you have read and understand the sequencer section of [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md). - - - -**To create a new virtual application using PowerShell** - -1. Install the App-V 5.0 sequencer. For more information about installing the sequencer see [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md). - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - -3. Using the PowerShell console, type the following: **import-module appvsequencer**. - -4. To create a package, use the **New-AppvSequencerPackage** cmdlet. The following parameters are required to create a package: - - - **Name** - specifies the name of the package. - - - **PrimaryVirtualApplicationDirectory** - specifies the path to the directory that will be used to install the application. This path must exist. - - - **Installer** - specifies the path to the associated application installer. - - - **Path** - specifies the output directory for the package. - - For example: - - **New-AppvSequencerPackage –Name <name of Package> -PrimaryVirtualApplicationDirectory <path to the package root> -Installer <path to the installer executable> -OutputPath <directory of the output path>** - - Wait for the sequencer to create the package. Creating a package using PowerShell can take time. If the package was not created successfully an error will be returned. - - The following list displays additional optional parameters that can be used with **New-AppvSequencerPackage** cmdlet: - - - AcceleratorFilePath – specifies the path to the accelerator .cab file to generate a package. - - - InstalledFilesPath - specifies the path to where the local installed files of the application are saved. - - - InstallMediaPath - specifies the path to where the installation media is - - - TemplateFilePath - specifies the path to a template file if you want to customize the sequencing process. - - - FullLoad - specifies that the package must be fully downloaded to the computer running the App-V 5.0 before it can be opened. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md b/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md deleted file mode 100644 index 8a8c74258e..0000000000 --- a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Sequence a Package by Using PowerShell -description: How to Sequence a Package by Using PowerShell -author: dansimp -ms.assetid: 6134c6be-937d-4609-a516-92d49154b290 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Sequence a Package by Using PowerShell - - -Use the following procedure to create a new App-V 5.1 package using PowerShell. - -**Note**   -Before you use this procedure you must copy the associated installer files to the computer running the sequencer and you have read and understand the sequencer section of [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md). - - - -**To create a new virtual application using PowerShell** - -1. Install the App-V 5.1 sequencer. For more information about installing the sequencer see [How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md). - -2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**. - -3. Using the PowerShell console, type the following: **import-module appvsequencer**. - -4. To create a package, use the **New-AppvSequencerPackage** cmdlet. The following parameters are required to create a package: - - - **Name** - specifies the name of the package. - - - **PrimaryVirtualApplicationDirectory** - specifies the path to the directory that will be used to install the application. This path must exist. - - - **Installer** - specifies the path to the associated application installer. - - - **Path** - specifies the output directory for the package. - - For example: - - **New-AppvSequencerPackage –Name <name of Package> -PrimaryVirtualApplicationDirectory <path to the package root> -Installer <path to the installer executable> -OutputPath <directory of the output path>** - - Wait for the sequencer to create the package. Creating a package using PowerShell can take time. If the package was not created successfully an error will be returned. - - The following list displays additional optional parameters that can be used with **New-AppvSequencerPackage** cmdlet: - - - AcceleratorFilePath – specifies the path to the accelerator .cab file to generate a package. - - - InstalledFilesPath - specifies the path to where the local installed files of the application are saved. - - - InstallMediaPath - specifies the path to where the installation media is - - - TemplateFilePath - specifies the path to a template file if you want to customize the sequencing process. - - - FullLoad - specifies that the package must be fully downloaded to the computer running the App-V 5.1 before it can be opened. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md b/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md deleted file mode 100644 index 1979f1b044..0000000000 --- a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -author: dansimp -ms.assetid: d41d64a0-0333-4951-ab27-db595bf0f634 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console - - -Use the following procedure to transfer the access and default package configurations to another version of a package by using the management console. - -**To transfer access and configurations to another version of a package** - -1. To view the package that you want to configure, open the App-V 5.0 Management Console. Select the package to which you will transfer the new configuration, right-click the package and select **transfer default configuration from** or **transfer access and configurations from**, depending on the configuration that you want to transfer. - -2. To transfer the configuration, in the **Select Previous Version** dialog box, select the package that contains the settings that you want to transfer, and then click **OK**. - - If you select **transfer default configuration from**, then only the underlying dynamic deployment configuration will be transferred. - - If you select **transfer access and configurations from**, then all access permissions, as well as the configuration settings, will be copied. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md b/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md deleted file mode 100644 index 17e0975836..0000000000 --- a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -author: dansimp -ms.assetid: bf53f064-76ae-4eac-9266-d087c480cda7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console - - -Use the following procedure to transfer the access and default package configurations to another version of a package by using the management console. - -**To transfer access and configurations to another version of a package** - -1. To view the package that you want to configure, open the App-V 5.1 Management Console. Select the package to which you will transfer the new configuration, right-click the package and select **transfer default configuration from** or **transfer access and configurations from**, depending on the configuration that you want to transfer. - -2. To transfer the configuration, in the **Select Previous Version** dialog box, select the package that contains the settings that you want to transfer, and then click **OK**. - - If you select **transfer default configuration from**, then only the underlying dynamic deployment configuration will be transferred. - - If you select **transfer access and configurations from**, then all access permissions, as well as the configuration settings, will be copied. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md b/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md deleted file mode 100644 index b30443d81b..0000000000 --- a/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Uninstall the App-V 5.0 Client -description: How to Uninstall the App-V 5.0 Client -author: dansimp -ms.assetid: 7566fb19-8d52-439a-be42-e004d95fed6f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall the App-V 5.0 Client - - -Use the following procedure to uninstall the App-V 5.0 client from a computer. When you uninstall the App-V 5.0 client all packages published to the computer running the client are also removed. If the uninstall operation does not complete the packages will need to be re-published to the computer running the App-V 5.0 client. - -**Important** -You should ensure that the App-V 5.0 client service is running prior to performing the uninstall procedure. - - - -**To uninstall the App-V 5.0 Client** - -1. In Control Panel, double-click **Programs** / **Uninstall a Program**, and then double-click **Microsoft Application Virtualization Client**. - -2. In the dialog box that appears, click **Yes** to continue with the uninstall process. - - **Important** - The uninstall process cannot be canceled or interrupted. - - - -3. A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process. - - **Note** - You can also use the command line to uninstall the App-V 5.0 client with the following switch: **/UNINSTALL**. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Deploying App-V 5.0](deploying-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md b/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md deleted file mode 100644 index 119e3fda37..0000000000 --- a/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Uninstall the App-V 5.1 Client -description: How to Uninstall the App-V 5.1 Client -author: dansimp -ms.assetid: 21f2d946-fc9f-4cd3-899b-ac52b3fbc306 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall the App-V 5.1 Client - - -Use the following procedure to uninstall the Microsoft Application Virtualization (App-V) 5.1 client from a computer. When you uninstall the App-V 5.1 client all packages published to the computer running the client are also removed. If the uninstall operation does not complete the packages will need to be re-published to the computer running the App-V 5.1 client. - -**Important** -You should ensure that the App-V 5.1 client service is running prior to performing the uninstall procedure. - - - -**To uninstall the App-V 5.1 Client** - -1. In Control Panel, double-click **Programs** / **Uninstall a Program**, and then double-click **Microsoft Application Virtualization Client**. - -2. In the dialog box that appears, click **Yes** to continue with the uninstall process. - - **Important** - The uninstall process cannot be canceled or interrupted. - - - -3. A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process. - - **Note** - You can also use the command line to uninstall the App-V 5.1 client with the following switch: **/UNINSTALL**. - - - -~~~ -**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). -~~~ - -## Related topics - - -[Deploying App-V 5.1](deploying-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md deleted file mode 100644 index 0345a45113..0000000000 --- a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -ms.reviewer: -title: How to Use an App-V 4.6 Application From an App-V 5.0 Application -description: How to Use an App-V 4.6 Application From an App-V 5.0 Application -ms.assetid: 4e78cb32-9c8b-478e-ae8b-c474a7e42487 -author: msfttracyp -ms.assetid: 4e78cb32-9c8b-478e-ae8b-c474a7e42487 -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - -# How to Use an App-V 4.6 Application From an App-V 5.0 Application - -*Note:** App-V 4.6 has exited Mainstream support. The following applies to an App-V 4.6 SP3 package. - -Use the following procedure to run an App-V 4.6 application with App-V 5.0 applications on a standalone client. - -**To run applications on a standalone client** - -1. Select two applications in your environment that can be opened from one another. For example, Microsoft Outlook and Adobe Acrobat Reader. You can access an email attachment created using Adobe Acrobat. - -2. Convert the packages, or create a new package for either of the applications using the App-V 5.0 format. For more information about converting packages see, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md) or [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md). - -3. Add and provision the package using the App-V 5.0 management console. For more information adding and provisioning packages see, [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md) and [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md). - -4. The converted application now runs using App-V 5.0 and you can open one application from the other. For example, if you converted a Microsoft Office package to an App-V 5.0 package and Adobe Acrobat is still running as an App-V 4.6 package, you can open an Adobe Acrobat Reader attachment using Microsoft Outlook. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - - - - diff --git a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md deleted file mode 100644 index ea81880476..0000000000 --- a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Use an App-V 4.6 Application From an App-V 5.1 Application -description: How to Use an App-V 4.6 Application From an App-V 5.1 Application -author: dansimp -ms.assetid: 909b4391-762b-4988-b0cf-32b67f1fcf0e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# How to Use an App-V 4.6 Application From an App-V 5.1 Application - -*Note:** App-V 4.6 has exited Mainstream support. The following applies to an App-V 4.6 SP3 package. - -Use the following procedure to run an App-V 4.6 application with App-V 5.1 applications on a standalone client. - -**Note**   -This procedure assumes that you are running the latest version of App-V 4.6. - -**To run applications on a standalone client** - -1. Select two applications in your environment that can be opened from one another. For example, Microsoft Outlook and Adobe Acrobat Reader. You can access an email attachment created using Adobe Acrobat. - -2. Convert the packages, or create a new package for either of the applications using the App-V 5.1 format. For more information about converting packages see, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) or [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md). - -3. Add and provision the package using the App-V 5.1 management console. For more information adding and provisioning packages see, [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md) and [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-51.md). - -4. The converted application now runs using App-V 5.1 and you can open one application from the other. For example, if you converted a Microsoft Office package to an App-V 5.1 package and Adobe Acrobat is still running as an App-V 4.6 package, you can open an Adobe Acrobat Reader attachment using Microsoft Outlook. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md deleted file mode 100644 index 8c95c046c5..0000000000 --- a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md +++ /dev/null @@ -1,301 +0,0 @@ ---- -title: How to Use Optional Packages in Connection Groups -description: How to Use Optional Packages in Connection Groups -author: dansimp -ms.assetid: 4d08a81b-55e5-471a-91dc-9a684fb3c9a1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use Optional Packages in Connection Groups - - -Starting in Microsoft Application Virtualization (App-V) 5.0 SP3, you can add optional packages to your connection groups to simplify connection group management. The following table summarizes the tasks that you can complete more easily by using optional packages, and provides links to instructions for each task. - -**Note**   -**Optional packages are supported only in App-V 5.0 SP3.** - - - -Before using optional packages, see [Requirements for using optional packages in connection groups](#bkmk-reqs-using-cg). - - ---- - - - - - - - - - - - - - - - - -
    Link to instructionsTask

    Use one connection group, with optional packages, for multiple users who have different packages entitled to them

    Use a single connection group to make different groups of applications and plug-ins available to different end users.

    -

    For example, you want to distribute Microsoft Office to all end users, but distribute different plug-ins to different subsets of users.

    Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group

    Unpublish, delete, or republish an optional package without having to disable, remove, edit, add, and re-enable the connection group on the App-V Client.

    -

    You can also unpublish the optional package and republish it later without having to disable or republish the connection group.

    - - - -## Use one connection group, with optional packages, for multiple users with different packages entitled to them - - - ---- - - - - - - - - - - - - - - - - -
    Task descriptionHow to perform the task

    With App-V 5.0 SP3

    -

    You can add optional packages to connection groups, which enables you to provide different combinations of applications and plug-ins to different end users.

    -

    Example: You want to distribute Microsoft Office to your end users, but enable a certain plug-in for only a subset of users.

    -

    To do this, create a connection group that contains a package with Office, and another package with Office plug-ins, and then make the plug-ins package optional.

    -

    End users who are not entitled to the plug-in package will still be able to run Office.

    ---- - - - - - - - - - - - - - - - - - - - - -
    MethodSteps

    App-V Server – Management Console

      -
    1. In the Management Console, select PACKAGES to open the PACKAGES page.

    2. -
    3. Select CONNECTION GROUPS to display the Connection Groups library.

    4. -
    5. Select the correct connection group from the Connection Groups library.

    6. -
    7. Click EDIT in the CONNECTED PACKAGES pane.

    8. -
    9. Select Optional next to the package name.

    10. -
    11. Select the ADD PACKAGE ACCESS TO GROUP ACCESS check box. This required step adds to the connection group the package entitlements that you configured earlier when you assigned packages to Active Directory groups.

    12. -

    App-V Server - PowerShell cmdlet

    Use the following cmdlet, and specify the -Optional parameter:

    -

    Add-AppvServerConnectionGroupPackage

    -

    Syntax:

    -

    Add-AppvServerConnectionGroupPackage [-AppvServerConnectionGroup] <SerializableConnectionGroup> [[-AppvServerPackage] <PackageVersion>] [-Optional] [-Order <int>] [-UseAnyPackageVersion]

    -

    Example:

    -

    Add-AppvServerConnectionGroupPackage -Name "Connection Group 1" -PackageName "Package 1" -Optional

    App-V Client on a Stand-alone computer

      -
    1. Create the connection group XML document, and set the Package tag attribute IsOptional to “true”.

    2. -
    3. Use the following cmdlets to add and enable the connection group:

      -
        -
      • Add-AppvClientConnectionGroup

      • -
      • Enable-AppvClientConnectionGroup

      • -
    4. -
    -

    Example connection group XML document with optional packages:

    -
    <?xml version="1.0" ?>
    -<AppConnectionGroup
    -   xmlns="https://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";
    -   AppConnectionGroupId="8105CCD5-244B-4BA1-8888-E321E688D2CB"
    -   VersionId="84CE3797-F1CB-4475-A223-757918929EB4"
    -   DisplayName="Contoso Software Connection Group" >
    -<Packages>
    -<Package
    -   PackageId="7735d1a8-5ef9-4df9-a1cf-3aa92ef54fe7"
    -   VersionId="ec560d6f-e62e-48eb-a9e5-7c52a8c2e149"
    -   DisplayName="Contoso Business Manager"
    -/>
    -
    -<Package
    -   PackageId="fc6fe0f7-be3d-4643-b37d-fc3f62d4dd5c"
    -   VersionId="c67a71cd-3542-4a48-93e8-20c643c50970"
    -   DisplayName="Contoso Forms"
    -   IsOptional="false"
    -/>
    -
    -<Package
    -   PackageId="8f6301a5-4348-4039-9560-b27a5bb72711"
    -   VersionId="6c694b45-3e19-46c6-a327-d159aa39e1d2"
    -   DisplayName="Contoso Tax"
    -   IsOptional="true"
    -/>
    -
    -<Package
    -   PackageId="89d701bc-d507-4299-b6b6-000000003472"
    -   VersionId="*"
    -   DisplayName="Contoso Accounts"
    -   IsOptional="true"
    -/>
    -
    -</Packages>
    -</AppConnectionGroup>
    -

     

    With versions earlier than App-V 5.0 SP3

    You had to create many connection groups to make specific application and plug-in combinations available to specific users.

    - - - -## Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group - - - ---- - - - - - - - - - - - - - - - - -
    Task descriptionHow to perform the task

    With App-V 5.0 SP3

    -

    You can unpublish, delete, or republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V Client.

    -

    You can also unpublish an optional package and republish it later without having to disable or republish the connection group.

    -

    Example: If you publish an optional package that contains a Microsoft Office plug-in, and you want to remove the plug-in, you can unpublish the package without having to disable the connection group.

    ---- - - - - - - - - - - - - - - - - -
    MethodSteps

    App-V Server – Management Console

      -
    • To unpublish the package: In the Management Console, select elect the PACKAGES page, right-click the package that you want to unpublish, and click unpublish.

    • -
    • To remove an optional package from a connection group: On the CONNECTION GROUPS page, select the package that you want to remove, and click the right arrow to remove the package from the connection group pane on the bottom left.

    • -

    App-V Client on a Stand-alone computer

    Use the following existing cmdlets:

    -
      -
    • Unpublish-AppvClientPackage

    • -
    • Remove-AppvClientPackage

    • -
    -

    For more information, see How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell.

    -

     

    With versions earlier than App-V 5.0 SP3

    You had to:

    -
      -
    1. Remove the connection group from each App-V Client computer where it was enabled.

    2. -
    3. Unpublish the package.

    4. -
    5. Remove the package from the connection group’s definition.

    6. -
    7. Republish the connection group.

    8. -
    - - - -## Requirements for using optional packages in connection groups - - -Review the following requirements before using optional packages in connection groups: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    RequirementDetails

    Connection groups must contain at least one non-optional package.

      -
    • Check carefully that you meet this requirement, as the App-V Server and the PowerShell cmdlet don’t validate that the requirement has been met.

    • -
    • If you accidentally create a connection group that does not contain at least one non-optional package, and the end user tries to open a packaged application in that connection group, the connection group will fail.

    • -
    -

      -
    • User-published connection groups can contain packages that are published globally or to the user.

    • -
    • Globally published connection groups must contain only globally published packages.

    • -

    Globally published connection groups must contain packages that are published globally to ensure that the packages will be available when starting the connection group’s virtual environment.

    -

    If you try to add or enable globally published connection groups that contain user-published packages, the connection group will fail.

    You must publish all non-optional packages before publishing the connection group that contains those packages.

    A connection group’s virtual environment cannot start if any non-optional packages are missing.

    -

    The App-V Client fails to add or enable a connection group if any non-optional packages have not been published.

    Before you unpublish a globally published package, ensure that the connection groups that are entitled to all the users on that computer no longer require the package.

    The system does not check whether the package is part of another user’s connection group. Unpublishing a global package will make it unavailable to every user on that computer, so make sure that each user’s connection groups no longer contain the package, or alternatively make the package optional.

    - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md deleted file mode 100644 index b29a4ff7a9..0000000000 --- a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md +++ /dev/null @@ -1,300 +0,0 @@ ---- -title: How to Use Optional Packages in Connection Groups -description: How to Use Optional Packages in Connection Groups -author: dansimp -ms.assetid: 67666f18-b704-4852-a1e4-d13633bd2baf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use Optional Packages in Connection Groups - - -Starting in Microsoft Application Virtualization (App-V) 5.0 SP3, you can add optional packages to your connection groups to simplify connection group management. The following table summarizes the tasks that you can complete more easily by using optional packages, and provides links to instructions for each task. - -**Note**   -**Optional packages are not supported in releases prior to App-V 5.0 SP3.** - - - -Before using optional packages, see [Requirements for using optional packages in connection groups](#bkmk-reqs-using-cg). - - ---- - - - - - - - - - - - - - - - - -
    Link to instructionsTask

    Use one connection group, with optional packages, for multiple users who have different packages entitled to them

    Use a single connection group to make different groups of applications and plug-ins available to different end users.

    -

    For example, you want to distribute Microsoft Office to all end users, but distribute different plug-ins to different subsets of users.

    Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group

    Unpublish, delete, or republish an optional package without having to disable, remove, edit, add, and re-enable the connection group on the App-V Client.

    -

    You can also unpublish the optional package and republish it later without having to disable or republish the connection group.

    - - - -## Use one connection group, with optional packages, for multiple users with different packages entitled to them - - - ---- - - - - - - - - - - - - - - - - -
    Task descriptionHow to perform the task

    With App-V 5.0 SP3 and App-V 5.1

    -

    You can add optional packages to connection groups, which enables you to provide different combinations of applications and plug-ins to different end users.

    -

    Example: You want to distribute Microsoft Office to your end users, but enable a certain plug-in for only a subset of users.

    -

    To do this, create a connection group that contains a package with Office, and another package with Office plug-ins, and then make the plug-ins package optional.

    -

    End users who are not entitled to the plug-in package will still be able to run Office.

    ---- - - - - - - - - - - - - - - - - - - - - -
    MethodSteps

    App-V Server – Management Console

      -
    1. In the Management Console, select CONNECTION GROUPS to display the Connection Groups library.

    2. -
    3. Select the correct connection group from the Connection Groups library.

    4. -
    5. Click EDIT in the CONNECTED PACKAGES pane.

    6. -
    7. Select Optional next to the package name.

    8. -
    9. Select the ADD PACKAGE ACCESS TO GROUP ACCESS check box. This required step adds to the connection group the package entitlements that you configured earlier when you assigned packages to Active Directory groups.

    10. -

    App-V Server - PowerShell cmdlet

    Use the following cmdlet, and specify the -Optional parameter:

    -

    Add-AppvServerConnectionGroupPackage

    -

    Syntax:

    -

    Add-AppvServerConnectionGroupPackage [-AppvServerConnectionGroup] <SerializableConnectionGroup> [[-AppvServerPackage] <PackageVersion>] [-Optional] [-Order <int>] [-UseAnyPackageVersion]

    -

    Example:

    -

    Add-AppvServerConnectionGroupPackage -Name "Connection Group 1" -PackageName "Package 1" -Optional

    App-V Client on a Stand-alone computer

      -
    1. Create the connection group XML document, and set the Package tag attribute IsOptional to “true”.

    2. -
    3. Use the following cmdlets to add and enable the connection group:

      -
        -
      • Add-AppvClientConnectionGroup

      • -
      • Enable-AppvClientConnectionGroup

      • -
    4. -
    -

    Example connection group XML document with optional packages:

    -
    <?xml version="1.0" ?>
    -<AppConnectionGroup
    -   xmlns="https://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";
    -   AppConnectionGroupId="8105CCD5-244B-4BA1-8888-E321E688D2CB"
    -   VersionId="84CE3797-F1CB-4475-A223-757918929EB4"
    -   DisplayName="Contoso Software Connection Group" >
    -<Packages>
    -<Package
    -   PackageId="7735d1a8-5ef9-4df9-a1cf-3aa92ef54fe7"
    -   VersionId="ec560d6f-e62e-48eb-a9e5-7c52a8c2e149"
    -   DisplayName="Contoso Business Manager"
    -/>
    -
    -<Package
    -   PackageId="fc6fe0f7-be3d-4643-b37d-fc3f62d4dd5c"
    -   VersionId="c67a71cd-3542-4a48-93e8-20c643c50970"
    -   DisplayName="Contoso Forms"
    -   IsOptional="false"
    -/>
    -
    -<Package
    -   PackageId="8f6301a5-4348-4039-9560-b27a5bb72711"
    -   VersionId="6c694b45-3e19-46c6-a327-d159aa39e1d2"
    -   DisplayName="Contoso Tax"
    -   IsOptional="true"
    -/>
    -
    -<Package
    -   PackageId="89d701bc-d507-4299-b6b6-000000003472"
    -   VersionId="*"
    -   DisplayName="Contoso Accounts"
    -   IsOptional="true"
    -/>
    -
    -</Packages>
    -</AppConnectionGroup>
    -

     

    With versions earlier than App-V 5.0 SP3

    You had to create many connection groups to make specific application and plug-in combinations available to specific users.

    - - - -## Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group - - - ---- - - - - - - - - - - - - - - - - -
    Task descriptionHow to perform the task

    With App-V 5.0 SP3 and App-V 5.1

    -

    You can unpublish, delete, or republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V Client.

    -

    You can also unpublish an optional package and republish it later without having to disable or republish the connection group.

    -

    Example: If you publish an optional package that contains a Microsoft Office plug-in, and you want to remove the plug-in, you can unpublish the package without having to disable the connection group.

    ---- - - - - - - - - - - - - - - - - -
    MethodSteps

    App-V Server – Management Console

      -
    • To unpublish the package: In the Management Console, select elect the PACKAGES page, click or right-click the package that you want to unpublish, and click Unpublish.

    • -
    • To remove an optional package from a connection group: On the CONNECTION GROUPS page, select the package that you want to remove, and click the right arrow to remove the package from the connection group pane on the bottom left.

    • -

    App-V Client on a Stand-alone computer

    Use the following existing cmdlets:

    -
      -
    • Unpublish-AppvClientPackage

    • -
    • Remove-AppvClientPackage

    • -
    -

    For more information, see How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell.

    -

     

    With versions earlier than App-V 5.0 SP3

    You had to:

    -
      -
    1. Remove the connection group from each App-V Client computer where it was enabled.

    2. -
    3. Unpublish the package.

    4. -
    5. Remove the package from the connection group’s definition.

    6. -
    7. Republish the connection group.

    8. -
    - - - -## Requirements for using optional packages in connection groups - - -Review the following requirements before using optional packages in connection groups: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    RequirementDetails

    Connection groups must contain at least one non-optional package.

      -
    • Check carefully that you meet this requirement, as the App-V Server and the PowerShell cmdlet don’t validate that the requirement has been met.

    • -
    • If you accidentally create a connection group that does not contain at least one non-optional package, and the end user tries to open a packaged application in that connection group, the connection group will fail.

    • -
    -

      -
    • User-published connection groups can contain packages that are published globally or to the user.

    • -
    • Globally published connection groups must contain only globally published packages.

    • -

    Globally published connection groups must contain packages that are published globally to ensure that the packages will be available when starting the connection group’s virtual environment.

    -

    If you try to add or enable globally published connection groups that contain user-published packages, the connection group will fail.

    You must publish all non-optional packages before publishing the connection group that contains those packages.

    A connection group’s virtual environment cannot start if any non-optional packages are missing.

    -

    The App-V Client fails to add or enable a connection group if any non-optional packages have not been published.

    Before you unpublish a globally published package, ensure that the connection groups that are entitled to all the users on that computer no longer require the package.

    The system does not check whether the package is part of another user’s connection group. Unpublishing a global package will make it unavailable to every user on that computer, so make sure that each user’s connection groups no longer contain the package, or alternatively make the package optional.

    - - - - - - - - -## Related topics - - -[Managing Connection Groups](managing-connection-groups51.md) - - - - - - - - - diff --git a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md deleted file mode 100644 index 96723eea3e..0000000000 --- a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: dansimp -ms.assetid: c77e6662-7a18-4da1-8da8-b58068b65fa1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console - - -Use the following procedure to view and configure default package extensions. - -**To view and configure default virtual application extensions** - -1. To view the package that you want to configure, open the App-V 5.0 Management Console. Select the package that you want to configure, right-click the package name and select **edit default configuration**. - -2. To view the applications contained in the specified package, in the **Default Configuration** pane, click **Applications**. To view the shortcuts for that package, click **Shortcuts**. To view the file type associations for that package, click **File Types**. - -3. To enable the application extensions, select **ENABLE**. - - To enable shortcuts, select **ENABLE SHORTCUTS**. To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**. - -4. To view any other application extensions, click **Advanced** and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions associated with the package using the configuration file. - -5. To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process. - - **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/images/checklistbox.gif b/mdop/appv-v5/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/appv-v5/images/checklistbox.gif and /dev/null differ diff --git a/mdop/appv-v5/images/packageaddfileandregistrydata-global.png b/mdop/appv-v5/images/packageaddfileandregistrydata-global.png deleted file mode 100644 index 775e290a36..0000000000 Binary files a/mdop/appv-v5/images/packageaddfileandregistrydata-global.png and /dev/null differ diff --git a/mdop/appv-v5/images/packageaddfileandregistrydata-stream.png b/mdop/appv-v5/images/packageaddfileandregistrydata-stream.png deleted file mode 100644 index 0e1205c62b..0000000000 Binary files a/mdop/appv-v5/images/packageaddfileandregistrydata-stream.png and /dev/null differ diff --git a/mdop/appv-v5/images/packageaddfileandregistrydata.png b/mdop/appv-v5/images/packageaddfileandregistrydata.png deleted file mode 100644 index 603420e627..0000000000 Binary files a/mdop/appv-v5/images/packageaddfileandregistrydata.png and /dev/null differ diff --git a/mdop/appv-v5/index.md b/mdop/appv-v5/index.md deleted file mode 100644 index 8f3c652084..0000000000 --- a/mdop/appv-v5/index.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Application Virtualization 5 -description: Application Virtualization 5 -author: dansimp -ms.assetid: e82eb44b-9ccd-41aa-923b-71400230ad23 -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Application Virtualization 5 - - -Microsoft Application Virtualization (App-V) 5 lets administrators make applications available to end users without having to install the applications directly on end user computers. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. - -## App-V 5 Versions - - -[Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -> [!NOTE] -> Application Virtualization 5.1 for Remote Desktop Services will be end of life on January 10, 2023. Please upgrade to a supported version, such as App-V 5.0 with Service Pack 3 prior to this date. - -[Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -> [!NOTE] -> Application Virtualization 5.0 for Windows Desktops will be end of life on January 10, 2023. Please upgrade to a supported version, such as App-V 5.0 with Service Pack 3 prior to this date. - -## More Information - - -[Release Notes for App-V 5.1](release-notes-for-app-v-51.md) -View updated product information and known issues for App-V 5.1. - -[Release Notes for App-V 5.0 SP3](release-notes-for-app-v-50-sp3.md) -View updated product information and known issues for App-V 5.0 SP3. - -[Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md) -View updated product information and known issues for App-V 5.0 SP2. - -[Release Notes for App-V 5.0](release-notes-for-app-v-50.md) -View updated product information and known issues for App-V 5.0. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/maintaining-app-v-50.md b/mdop/appv-v5/maintaining-app-v-50.md deleted file mode 100644 index a8cfb7715b..0000000000 --- a/mdop/appv-v5/maintaining-app-v-50.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Maintaining App-V 5.0 -description: Maintaining App-V 5.0 -author: dansimp -ms.assetid: 66851ec3-c674-493b-ad6d-db8fcbf1956c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Maintaining App-V 5.0 - - -After you have completed all the necessary planning, and then deployment of App-V 5.0, you can use the following information to maintain the App-V 5.0 infrastructure. - -## Move the App-V 5.0 Server - - -The App-V 5.0 server connects to the App-V 5.0 database. Therefore you can install the management component to any computer on the network and then connect it to the App-V 5.0 database. - -[How to Move the App-V Server to Another Computer](how-to-move-the-app-v-server-to-another-computer.md) - -## Determine if an App-V 5.0 Application is Running Virtualized - - -Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V 5.0 or above, should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. - -Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V 5.0 and above, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. - - - - - - -## Other resources for maintaining App-V 5.0 - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/maintaining-app-v-51.md b/mdop/appv-v5/maintaining-app-v-51.md deleted file mode 100644 index 005a024a2b..0000000000 --- a/mdop/appv-v5/maintaining-app-v-51.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Maintaining App-V 5.1 -description: Maintaining App-V 5.1 -author: dansimp -ms.assetid: 5abd17d3-e8af-4261-b914-741ae116b0e7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Maintaining App-V 5.1 - - -After you have completed all the necessary planning, and then deployment of App-V 5.1, you can use the following information to maintain the App-V 5.1 infrastructure. - -## Move the App-V 5.1 Server - - -The App-V 5.1 server connects to the App-V 5.1 database. Therefore you can install the management component to any computer on the network and then connect it to the App-V 5.1 database. - -[How to Move the App-V Server to Another Computer](how-to-move-the-app-v-server-to-another-computer51.md) - -## Determine if an App-V 5.1 Application is Running Virtualized - - -Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V 5.1 or above, should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. - -Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V 5.1 and above, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. - - - - - - -## Other resources for maintaining App-V 5.1 - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/managing-connection-groups.md b/mdop/appv-v5/managing-connection-groups.md deleted file mode 100644 index 1c3c341ef5..0000000000 --- a/mdop/appv-v5/managing-connection-groups.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Managing Connection Groups -description: Managing Connection Groups -author: dansimp -ms.assetid: 1a9c8f26-f421-4b70-b7e2-da8118e8198c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing Connection Groups - - -Connection groups enable the applications within a package to interact with each other in the virtual environment, while remaining isolated from the rest of the system. By using connection groups, administrators can manage packages independently and can avoid having to add the same application multiple times to a client computer. - -**Note**   -In previous versions of App-V 5.0, connection groups were referred to as Dynamic Suite Composition. - - - -**In this topic:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -

    About the Connection Group Virtual Environment

    Describes the connection group virtual environment.

    About the Connection Group File

    Describes the connection group file.

    How to Create a Connection Group

    Explains how to create a new connection group.

    How to Create a Connection Group with User-Published and Globally Published Packages

    Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.

    How to Delete a Connection Group

    Explains how to delete a connection group.

    How to Publish a Connection Group

    Explains how to publish a connection group.

    - - - - - - - - -## Other resources for App-V 5.0 connection groups - - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/managing-connection-groups51.md b/mdop/appv-v5/managing-connection-groups51.md deleted file mode 100644 index 43554b1ff9..0000000000 --- a/mdop/appv-v5/managing-connection-groups51.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Managing Connection Groups -description: Managing Connection Groups -author: dansimp -ms.assetid: 22c9d3cb-7246-4173-9742-4ba1c24b0a6a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing Connection Groups - - -Connection groups enable the applications within a package to interact with each other in the virtual environment, while remaining isolated from the rest of the system. By using connection groups, administrators can manage packages independently and can avoid having to add the same application multiple times to a client computer. - -**Note**   -In some previous versions of App-V, connection groups were referred to as Dynamic Suite Composition. - - - -**In this topic:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -

    About the Connection Group Virtual Environment

    Describes the connection group virtual environment.

    About the Connection Group File

    Describes the connection group file.

    How to Create a Connection Group

    Explains how to create a new connection group.

    How to Create a Connection Group with User-Published and Globally Published Packages

    Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.

    How to Delete a Connection Group

    Explains how to delete a connection group.

    How to Publish a Connection Group

    Explains how to publish a connection group.

    - - - - - - - - -## Other resources for App-V 5.1 connection groups - - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md b/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md deleted file mode 100644 index 3645704cf9..0000000000 --- a/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Microsoft Application Virtualization 5.0 Administrator's Guide -description: Microsoft Application Virtualization 5.0 Administrator's Guide -author: dansimp -ms.assetid: c46e94b5-32cd-4377-8dc3-8163539be897 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - -# Microsoft Application Virtualization 5.0 Administrator's Guide - -The Microsoft Application Virtualization (App-V) 5.0 Administrator’s Guide provides information and step-by-step procedures to help you administer the App-V 5.0 system and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - - [About App-V 5.0](about-app-v-50.md) - - [About App-V 5.0 SP1](about-app-v-50-sp1.md) - - [About App-V 5.0 SP2](about-app-v-50-sp2.md) - - [About App-V 5.0 SP3](about-app-v-50-sp3.md) - - [Evaluating App-V 5.0](evaluating-app-v-50.md) - - [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md) - - [Accessibility for App-V 5.0](accessibility-for-app-v-50.md) -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - - [Preparing Your Environment for App-V 5.0](preparing-your-environment-for-app-v-50.md) - - [Planning to Deploy App-V](planning-to-deploy-app-v.md) - - [App-V 5.0 Planning Checklist](app-v-50-planning-checklist.md) -- [Deploying App-V 5.0](deploying-app-v-50.md) - - [Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md) - - [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - - [App-V 5.0 Deployment Checklist](app-v-50-deployment-checklist.md) - - [Deploying Microsoft Office 2016 by Using App-V](deploying-microsoft-office-2016-by-using-app-v.md) - - [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v.md) - - [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v.md) -- [Operations for App-V 5.0](operations-for-app-v-50.md) - - [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md) - - [Administering App-V 5.0 Virtual Applications by Using the Management Console](administering-app-v-50-virtual-applications-by-using-the-management-console.md) - - [Managing Connection Groups](managing-connection-groups.md) - - [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md) - - [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md) - - [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) - - [Maintaining App-V 5.0](maintaining-app-v-50.md) - - [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) -- [Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md) - - [Performance Guidance for Application Virtualization 5.0](performance-guidance-for-application-virtualization-50.md) - - [Application Publishing and Client Interaction](application-publishing-and-client-interaction.md) - - [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata.md) - - [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md) - -## Also see - -- Add or vote on suggestions on the ["Microsoft Application Virtualization" forum on UserVoice.com](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). -- For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md b/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md deleted file mode 100644 index 07efe04eca..0000000000 --- a/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Microsoft Application Virtualization 5.1 Administrator's Guide -description: Microsoft Application Virtualization 5.1 Administrator's Guide -author: dansimp -ms.assetid: 3049996a-7253-4599-a29a-1b58f9ab14a4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - -# Microsoft Application Virtualization 5.1 Administrator's Guide - -The Microsoft Application Virtualization (App-V) 5.1 Administrator’s Guide provides information and step-by-step procedures to help you administer the App-V 5.1 system and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - - [About App-V 5.1](about-app-v-51.md) - - [Evaluating App-V 5.1](evaluating-app-v-51.md) - - [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md) - - [Accessibility for App-V 5.1](accessibility-for-app-v-51.md) -- [Planning for App-V 5.1](planning-for-app-v-51.md) - - [Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md) - - [Planning to Deploy App-V](planning-to-deploy-app-v51.md) -- [Deploying App-V 5.1](deploying-app-v-51.md) - - [Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md) - - [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - - [App-V 5.1 Deployment Checklist](app-v-51-deployment-checklist.md) - - [Deploying Microsoft Office 2016 by Using App-V](deploying-microsoft-office-2016-by-using-app-v51.md) - - [Deploying Microsoft Office 2013 by Using App-V](deploying-microsoft-office-2013-by-using-app-v51.md) - - [Deploying Microsoft Office 2010 by Using App-V](deploying-microsoft-office-2010-by-using-app-v51.md) -- [Operations for App-V 5.1](operations-for-app-v-51.md) - - [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md) - - [Administering App-V 5.1 Virtual Applications by Using the Management Console](administering-app-v-51-virtual-applications-by-using-the-management-console.md) - - [Managing Connection Groups](managing-connection-groups51.md) - - [Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md) - - [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md) - - [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) - - [Maintaining App-V 5.1](maintaining-app-v-51.md) - - [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - [Performance Guidance for Application Virtualization 5.1](performance-guidance-for-application-virtualization-51.md) - - [Application Publishing and Client Interaction](application-publishing-and-client-interaction51.md) - - [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata51.md) - - [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md) - -## Also see - -- Add or vote on suggestions on the ["Microsoft Application Virtualization" forum on UserVoice.com](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). -- For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv). diff --git a/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md b/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md deleted file mode 100644 index c3d4ae514c..0000000000 --- a/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md +++ /dev/null @@ -1,199 +0,0 @@ ---- -title: Migrating from a Previous Version -description: Migrating from a Previous Version -author: dansimp -ms.assetid: a13cd353-b22a-48f7-af1e-5d54ede2a7e5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Migrating from a Previous Version - - -With App-V 5.0 you can migrate your existing App-V 4.6 infrastructure to the more flexible, integrated, and easier to manage App-V 5.0 infrastructure. - -Consider the following sections when you plan your migration strategy: - -**Note**   -For more information about the differences between App-V 4.6 and App-V 5.0, see the **Differences between App-V 4.6 and App-V 5.0 section** of [About App-V 5.0](about-app-v-50.md). - - - -## Converting packages created using a prior version of App-V - - -Use the package converter utility to upgrade virtual application packages created using previous versions of App-V. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. - -**Important**   -After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. - - - -**What to know before you convert existing packages** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    IssueWorkaround

    Package scripts are not converted.

    Test the converted package. If necessary convert the script.

    Package registry setting overrides are not converted.

    Test the converted package. If necessary, re-add registry overrides.

    Virtual packages using DSC are not linked after conversion.

    Link the packages using connection groups. See Managing Connection Groups.

    Environment variable conflicts are detected during conversion.

    Resolve any conflicts in the associated .osd file.

    Hard-coded paths are detected during conversion.

    Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package.

    - - - -When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be hard-coded path. Convert the path. - -**Note**   -It is recommended that you use the App-V 5.0 sequencer for converting critical applications or applications that need to take advantage of features. See, [How to Sequence a New Application with App-V 5.0](how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md). - -If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V 5.0 sequencer. - - - -[How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md) - -## Migrating Clients - - -The following table displays the recommended method for upgrading clients. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskMore Information

    Upgrade your environment to App-V 4.6 SP2

    Application Virtualization Deployment and Upgrade Considerations.

    Install the App-V 5.0 client with co-existence enabled.

    How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer.

    Sequence and roll out App-V 5.0 packages. As needed, unpublish App-V 4.6 packages.

    How to Sequence a New Application with App-V 5.0.

    - - - -**Important**   -You must be running App-V 4.6 SP3 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section. - - - -## Migrating the App-V 5.0 Server Full Infrastructure - - -There is no direct method to upgrade to a full App-V 5.0 infrastructure. Use the information in the following section for information about upgrading the App-V server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskMore Information

    Upgrade your environment to App-V 4.6 SP3.

    Application Virtualization Deployment and Upgrade Considerations.

    Deploy App-V 5.0 version of the client.

    How to Deploy the App-V Client.

    Install App-V 5.0 server.

    How to Deploy the App-V 5.0 Server.

    Migrate existing packages.

    See the Converting packages created using a prior version of App-V section of this article.

    - - - -## Additional Migration tasks - - -You can also perform additional migration tasks such as reconfiguring end points as well as opening a package created using a prior version on a computer running the App-V 5.0 client. The following links provide more information about performing these tasks. - -[How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md) - -[How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md) - -[How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) - -[How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md) - - - - - - - -## Other resources for performing App-V migration tasks - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -[A simplified Microsoft App-V 5.1 Management Server upgrade procedure](https://go.microsoft.com/fwlink/p/?LinkId=786330) - - - - - - - - - diff --git a/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md b/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md deleted file mode 100644 index 3692e67c10..0000000000 --- a/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md +++ /dev/null @@ -1,335 +0,0 @@ ---- -title: Migrating to App-V 5.1 from a Previous Version -description: Migrating to App-V 5.1 from a Previous Version -author: dansimp -ms.assetid: e7ee0edc-7544-4c0a-aaca-d922a33bc1bb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Migrating to App-V 5.1 from a Previous Version - - -With Microsoft Application Virtualization (App-V) 5.1, you can migrate your existing App-V 4.6 or App-V 5.0 infrastructure to the more flexible, integrated, and easier to manage App-V 5.1 infrastructure. -However, you cannot migrate directly from App-V 4.x to App-V 5.1, you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) - -**Note**   -App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V 5.1 packages. - -For more information about the differences between App-V 4.6 and App-V 5.1, see the **Differences between App-V 4.6 and App-V 5.0 section** of [About App-V 5.0](about-app-v-50.md). - - - -## Improvements to the App-V 5.1 Package Converter - - -You can now use the package converter to convert App-V 4.6 packages that contain scripts, and registry information and scripts from source .osd files are now included in package converter output. - -You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom-AppvLegacyPackage` cmdlet to specify which .osd files’ information is converted and placed within the new package. - - ---- - - - - - - - - - - - - -
    New in App-V 5.1Prior to App-V 5.1

    New .xml files are created corresponding to the .osd files associated with a package; these files include the following information:

    -
      -
    • environment variables

    • -
    • shortcuts

    • -
    • file type associations

    • -
    • registry information

    • -
    • scripts

    • -
    -

    You can now choose to add information from a subset of the .osd files in the source directory to the package using the -OSDsToIncludeInPackage parameter.

    Registry information and scripts included in .osd files associated with a package were not included in package converter output.

    -

    The package converter would populate the new package with information from all of the .osd files in the source directory.

    - - - -### Example conversion statement - -To understand the new process, review the following example `ConvertFrom-AppvLegacyPackage` package converter statement. - -**If the source directory (\\\\OldPkgStore\\ContosoApp) includes the following:** - -- ContosoApp.sft - -- ContosoApp.msi - -- ContosoApp.sprj - -- ContosoApp\_manifest.xml - -- X.osd - -- Y.osd - -- Z.osd - -**And you run this command:** - -``` syntax -ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\ --DestinationPath \\NewPkgStore\ContosoApp\ --OSDsToIncludeInPackage X.osd,Y.osd -``` - -**The following is created in the destination directory (\\\\NewPkgStore\\ContosoApp):** - -- ContosoApp.appv - -- ContosoApp.msi - -- ContosoApp\_DeploymentConfig.xml - -- ContosoApp\_UserConfig.xml - -- X\_Config.xml - -- Y\_Config.xml - -- Z\_Config.xml - -**In the above example:** - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    These Source directory files……are converted to these Destination directory files……and will contain these itemsDescription
      -
    • X.osd

    • -
    • Y.osd

    • -
    • Z.osd

    • -
      -
    • X_Config.xml

    • -
    • Y_Config.xml

    • -
    • Z_Config.xml

    • -
      -
    • Environment variables

    • -
    • Shortcuts

    • -
    • File type associations

    • -
    • Registry information

    • -
    • Scripts

    • -

    Each .osd file is converted to a separate, corresponding .xml file that contains the items listed here in App-V 5.1 deployment configuration format. These items can then be copied from these .xml files and placed in the deployment configuration or user configuration files as desired.

    -

    In this example, there are three .xml files, corresponding with the three .osd files in the source directory. Each .xml file contains the environment variables, shortcuts, file type associations, registry information, and scripts in its corresponding .osd file.

      -
    • X.osd

    • -
    • Y.osd

    • -
      -
    • ContosoApp.appv

    • -
    • ContosoApp_DeploymentConfig.xml

    • -
    • ContosoApp_UserConfig.xml

    • -
      -
    • Environment variables

    • -
    • Shortcuts

    • -
    • File type associations

    • -

    The information from the .osd files specified in the -OSDsToIncludeInPackage parameter are converted and placed inside the package. The converter then populates the deployment configuration file and the user configuration file with the contents of the package, just as App-V Sequencer does when sequencing a new package.

    -

    In this example, environment variables, shortcuts, and file type associations included in X.osd and Y.osd were converted and placed in the App-V package, and some of this information was also included in the deployment configuration and user configuration files. X.osd and Y.osd were used because they were included as arguments to the -OSDsToIncludeInPackage parameter. No information from Z.osd was included in the package, because it was not included as one of these arguments.

    - - - -## Converting packages created using a prior version of App-V - - -Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion. - -**Important**   -After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful. - - - -**What to know before you convert existing packages** - - ---- - - - - - - - - - - - - - - - - - - - - -
    IssueWorkaround

    Virtual packages using DSC are not linked after conversion.

    Link the packages using connection groups. See Managing Connection Groups.

    Environment variable conflicts are detected during conversion.

    Resolve any conflicts in the associated .osd file.

    Hard-coded paths are detected during conversion.

    Hard-coded paths are difficult to convert correctly. The package converter will detect and return packages with files that contain hard-coded paths. View the file with the hard-coded path, and determine whether the package requires the file. If so, it is recommended to re-sequence the package.

    - - - -When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path. - -**Note**   -It is recommended that you use the App-V 5.1 sequencer for converting critical applications or applications that need to take advantage of features. See, [How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md). - -If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V 5.1 sequencer. - - - -[How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md) - -## Migrating Clients - - -The following table displays the recommended method for upgrading clients. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskMore Information

    Upgrade your environment to the latest version of App-V 4.6

    Application Virtualization Deployment and Upgrade Considerations.

    Install the App-V 5.1 client with co-existence enabled.

    How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer.

    Sequence and roll out App-V 5.1 packages. As needed, unpublish App-V 4.6 packages.

    How to Sequence a New Application with App-V 5.1.

    - - - -**Important**   -You must be running the latest version of App-V 4.6 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section. - - - -## Migrating the App-V 5.1 Server Full Infrastructure - - -There is no direct method to upgrade to a full App-V 5.1 infrastructure. Use the information in the following section for information about upgrading the App-V server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskMore Information

    Upgrade your environment to the latest version of App-V 4.6.

    Application Virtualization Deployment and Upgrade Considerations.

    Deploy App-V 5.1 version of the client.

    How to Deploy the App-V Client.

    Install App-V 5.1 server.

    How to Deploy the App-V 5.1 Server.

    Migrate existing packages.

    See the Converting packages created using a prior version of App-V section of this article.

    - - - -## Additional Migration tasks - - -You can also perform additional migration tasks such as reconfiguring end points as well as opening a package created using a prior version on a computer running the App-V 5.1 client. The following links provide more information about performing these tasks. - -[How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md) - -[How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md) - -[How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md) - -[How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md) - - - - - - - -## Other resources for performing App-V migration tasks - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -[A simplified Microsoft App-V 5.1 Management Server upgrade procedure](https://go.microsoft.com/fwlink/p/?LinkId=786330) - - - - - - - - - diff --git a/mdop/appv-v5/operations-for-app-v-50.md b/mdop/appv-v5/operations-for-app-v-50.md deleted file mode 100644 index 3df456161b..0000000000 --- a/mdop/appv-v5/operations-for-app-v-50.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Operations for App-V 5.0 -description: Operations for App-V 5.0 -author: dansimp -ms.assetid: 4d0d41a6-f7da-4a2f-8ac9-2d67cc18ea93 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for App-V 5.0 - - -This section of the App-V 5.0 Administrator’s Guide includes information about the various types of App-V 5.0 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations Information - - -- [Creating and Managing App-V 5.0 Virtualized Applications](creating-and-managing-app-v-50-virtualized-applications.md) - - Describes how to create, modify, and convert virtualized packages. - -- [Administering App-V 5.0 Virtual Applications by Using the Management Console](administering-app-v-50-virtual-applications-by-using-the-management-console.md) - - Describes how to use the App-V Management console to perform tasks such as sequencing an application, changing a package, using a project template, and using a package accelerator. - -- [Managing Connection Groups](managing-connection-groups.md) - - Describes how connection groups enable virtualized applications to communicate with each other in the virtual environment; explains how to create, publish, and delete them; and describes how connection groups can help you better manage your virtualized applications. - -- [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md) - - Describes how to deploy App-V packages by using an ESD. - -- [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md) - - Describes how perform client configuration tasks using the client management console. - -- [Migrating from a Previous Version](migrating-from-a-previous-version-app-v-50.md) - - Provides instructions for migrating to App-V 5.0 from a previous version. - -- [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md) - - Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V 5.0 server tasks. - - - - - - -## Other Resources for App-V Operations - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -- [Deploying App-V 5.0](deploying-app-v-50.md) - -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/operations-for-app-v-51.md b/mdop/appv-v5/operations-for-app-v-51.md deleted file mode 100644 index 8a97413907..0000000000 --- a/mdop/appv-v5/operations-for-app-v-51.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Operations for App-V 5.1 -description: Operations for App-V 5.1 -author: dansimp -ms.assetid: dd13b5c9-2d1e-442f-91e4-43dec7f17ea2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for App-V 5.1 - - -This section of the Microsoft Application Virtualization (App-V) 5.1 Administrator’s Guide includes information about the various types of App-V 5.1 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations Information - - -- [Creating and Managing App-V 5.1 Virtualized Applications](creating-and-managing-app-v-51-virtualized-applications.md) - - Describes how to create, modify, and convert virtualized packages. - -- [Administering App-V 5.1 Virtual Applications by Using the Management Console](administering-app-v-51-virtual-applications-by-using-the-management-console.md) - - Describes how to use the App-V Management console to perform tasks such as sequencing an application, changing a package, using a project template, and using a package accelerator. - -- [Managing Connection Groups](managing-connection-groups51.md) - - Describes how connection groups enable virtualized applications to communicate with each other in the virtual environment; explains how to create, publish, and delete them; and describes how connection groups can help you better manage your virtualized applications. - -- [Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md) - - Describes how to deploy App-V packages by using an ESD. - -- [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md) - - Describes how perform client configuration tasks using the client management console. - -- [Migrating to App-V 5.1 from a Previous Version](migrating-to-app-v-51-from-a-previous-version.md) - - Provides instructions for migrating to App-V 5.1 from a previous version. - -- [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md) - - Describes the set of Windows PowerShell cmdlets available for administrators performing various App-V 5.1 server tasks. - - - - - - -## Other Resources for App-V Operations - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Deploying App-V 5.1](deploying-app-v-51.md) - -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) - -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md deleted file mode 100644 index d18673c97f..0000000000 --- a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md +++ /dev/null @@ -1,761 +0,0 @@ ---- -title: Performance Guidance for Application Virtualization 5.0 -description: Performance Guidance for Application Virtualization 5.0 -author: dansimp -ms.assetid: 6b3a3255-b957-4b9b-8bfc-a93fe8438a81 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Performance Guidance for Application Virtualization 5.0 - - -Learn how to configure App-V 5.0 for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. - -Implementing multiple methods can help you improve the end-user experience. However, your environment may not support all methods. - -You should read and understand the following information before reading this document. - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [App-V 5 SP2 Application Publishing and Client Interaction](https://go.microsoft.com/fwlink/?LinkId=395206) - -- [Microsoft Application Virtualization 5.0 Sequencing Guide](https://go.microsoft.com/fwlink/?LinkId=269953) - -**Note** -Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. - - - -Finally, this document will provide you with the information to configure the computer running App-V 5.0 client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V 5.0 in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI). - -To help determine what information is relevant to your environment you should review each section’s brief overview and applicability checklist. - -## App-V 5.0 in stateful\* non-persistent deployments - - -This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This is achieved by uniquely addressing the often long-running App-V 5.0 publishing refresh. As you will discover the basis of the approach, the fastest publishing refresh, is one that doesn’t have to actually do anything. A number of conditions must be met and steps followed to provide the optimal user experience. - -Use the information in the following section for more information: - -[Usage Scenarios](#bkmk-us) - As you review the two scenarios, keep in mind that these are the approach extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users and/or virtual applications packages. - -- Optimized for Performance – To provide the optimal experience, you can expect the base image to include some of the App-V virtual application package. This and other requirements are discussed. - -- Optimized for Storage – If you are concerned with the storage impact, following this scenario will help address those concerns. - -[Preparing your Environment](#bkmk-pe) - -- Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach. - -- Use UE-V 2.0 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. - -[User Experience Walk-through](#bkmk-uewt) - -- Walk-through – This is a step-by-step walk-through of the App-V and UE-V operations and the expectations users should have. - -- Outcome – This describes the expected results. - -[Impact to Package Lifecycle](#bkmk-plc) - -[Enhancing the VDI Experience through Performance Optimization/Tuning](#bkmk-evdi) - -### Applicability Checklist - -Deployment Environment - - ---- - - - - - - - - - - -
    Checklist box

    Non-Persistent VDI or RDSH.

    Checklist box

    User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).

    - - - -Expected Configuration - - ---- - - - - - - - - - - -
    Checklist box

    User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.

    Checklist box

    App-V Shared Content Store (SCS) is configured or can be configured.

    - - - -IT Administration - - ---- - - - - - - -
    Checklist box

    Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.

    - - - -### Usage Scenario - -As you review the two scenarios, keep in mind that these approach the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both. - - ---- - - - - - - - - - - - - -
    Optimized for PerformanceOptimized for Storage

    To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead.

    -

    The following describes many performance improvements in stateful non-persistent deployments. For more information, see the Sequencing Steps to Optimize Packages for Publishing Performance and reference to App-V 5.0 Sequencing Guide in the See Also section of this document.

    The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.

    -

    The impact of this alteration is detailed in the User Experience Walkthrough section of this document.

    - - - -### Preparing your Environment - -The following table displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach. - -**Prepare the Base Image** - - ---- - - - - - - - - - - - - -
    Optimized for PerformanceOptimized for Storage

    -
      -
    • Install the Hotfix Package 4 for Application Virtualization 5.0 SP2 client version of the client.

    • -
    • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

    • -
    • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.0 Client for Shared Content Store Mode.

    • -
    • Configure Preserve User Integrations on Login Registry DWORD.

    • -
    • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.

    • -
    • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.

    • -
    • Pre-publish all global-targeted packages.

      -

      -

      Alternatively,

      -
        -
      • Perform a global publishing/refresh.

      • -
      • Perform a user publishing/refresh.

      • -
      • Un-publish all user-targeted packages.

      • -
      • Delete the following user-Virtual File System (VFS) entries.

      • -
      -

      AppData\Local\Microsoft\AppV\Client\VFS

      -

      AppData\Roaming\Microsoft\AppV\Client\VFS

    • -

    -
      -
    • Install the Hotfix Package 4 for Application Virtualization 5.0 SP2 client version of the client.

    • -
    • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

    • -
    • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.0 Client for Shared Content Store Mode.

    • -
    • Configure Preserve User Integrations on Login Registry DWORD.

    • -
    • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.

    • -
    • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.

    • -
    • Pre-publish all global-targeted packages.

      -

    • -
    - - - -**Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Configuration SettingWhat does this do?How should I use it?

    Shared Content Store (SCS) Mode

    -
      -
    • Configurable in PowerShell using Set- AppvClientConfigurationSharedContentStoreMode, or

    • -
    • During installation of the App-V 5.0 client.

    • -

    When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM).

    -

    This helps to conserve local storage and minimize disk I/O per second (IOPS).

    This is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN.

    PreserveUserIntegrationsOnLogin

    -
      -
    • Configure in the Registry under HKEY_LOCAL_MACHINE \ Software \ Microsoft \ AppV \ Client \ Integration.

    • -
    • Create the DWORD value PreserveUserIntegrationsOnLogin with a value of 1.

    • -
    • Restart the App-V client service or restart the computer running the App-V Client.

    • -

    If you have not pre-configured (Add-AppvClientPackage) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then re-integrate*.

    -

    For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh.

    If you don’t plan to pre-configure every available user package in the base image, use this setting.

    MaxConcurrentPublishingRefresh

    -
      -
    • Configure in the Registry under HKEY_LOCAL_MACHINE <strong>Software \ Microsoft \ AppV <strong>Client \ Publishing.

    • -
    • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.

    • -
    • The App-V client service and computer do not need to be restarted.

    • -

    This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit.

    Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync.

    -

    If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time.

    - - - -### Configure UE-V solution for App-V Approach - -We recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. - -For more information see [Getting Started With User Experience Virtualization 2.0](https://technet.microsoft.com/library/dn458936.aspx) - -In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458936.aspx). - -**Note** -Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. - -UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following 2 scenarios, because the net result will be that the shortcut will be valid on one but not all devices. - -- If a user has an application installed on one device with .lnk files enabled and the same native application installed on another device to a different installation root with .lnk files enabled. - -- If a user has an application installed on one device but not another with .lnk files enabled. - - - -**Important** -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types. - -**Configure other User Profile Management (UPM) solution for App-V Approach** - -The expectation in a stateful environment is that a UPM solution is implemented and can support persistence of user data across sessions and between logins. - -The requirements for the UPM solution are as follows. - -To enable an optimized login experience, for example the App-V 5.0 approach for the user, the solution must be capable of: - -- Persisting the below user integrations as part of the user profile/persona. - -- Triggering a user profile sync on login (or application start), which can guarantee that all user integrations are applied before publishing/refresh begin, or, - -- Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations. - -- Capturing changes to the locations, which constitute the user integrations, prior to session logoff. - -With App-V 5.0 when you add a publishing server (**Add-AppvPublishingServer**) you can configure synchronization, for example refresh during log on and/or after a specified refresh interval. In both cases a scheduled task is created. - -In previous versions of App-V 5.0, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. With Hotfix Package 4 for Application Virtualization 5.0 SP2 the user refresh on log on is initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process will delay the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. - -**User Integrations** - -Registry – HKEY\_CURRENT\_USER - -- Path - Software\\Classes - - Exclude: Local Settings, ActivatableClasses, AppX\* - -- Path - Software\\Microsoft\\AppV - -- Path- Software\\Microsoft\\Windows\\CurrentVersion\\App Paths - -**File Locations** - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Catalog - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Integration - -- Root – “Environment Variable” APPDATA - - Path - Microsoft\\Windows\\Start Menu\\Programs - -- (To persist all desktop shortcuts, virtual and non-virtual) - - Root - “KnownFolder” {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}FileMask - \*.lnk - -**Microsoft User Experience Virtualization (UE-V)** - -Additionally, we recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -For more information see [Getting Started With User Experience Virtualization 1.0](https://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](https://technet.microsoft.com/library/jj679972.aspx). - -### User Experience Walk-through - -This following is a step-by-step walk-through of the App-V and UPM operations and the expectations users should expect. - - ---- - - - - - - - - - - - - -
    Optimized for PerformanceOptimized for Storage

    After implementing this approach in the VDI/RDSH environment, on first login,

    -
      -
    • (Operation) A user-publishing/refresh is initiated. (Expectation) If this is the first time a user has published virtual applications (e.g. non-persistent), this will take the usual duration of a publishing/refresh.

    • -
    • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state.

    • -
    -

    On subsequent logins:

    -
      -
    • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

      -

      (Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (i.e., package entitlements change), some may go away.

    • -
    • (Operation) Publishing/refresh will process un-publish and publish operations for changes in user package entitlements. (Expectation) If there are no entitlement changes, publishing1 will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity* of virtual applications

    • -
    • (Operation) UPM solution will capture user integrations again at logoff. (Expectation) Same as previous.

    • -
    -

    ¹ The publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps.

    After implementing this approach in the VDI/RDSH environment, on first login,

    -
      -
    • (Operation) A user-publishing/refresh is initiated. (Expectation)

      -
        -
      • If this is the first time a user has published virtual applications (e.g., non-persistent), this will take the usual duration of a publishing/refresh.

      • -
      • First and subsequent logins will be impacted by pre-configuring of packages (add/refresh).

        -

      • -
    • -
    • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state

    • -
    -

    On subsequent logins:

    -
      -
    • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

    • -
    • (Operation) Add/refresh must pre-configure all user targeted applications. (Expectation)

      -
        -
      • This may increase the time to application availability significantly (on the order of 10’s of seconds).

      • -
      • This will increase the publishing refresh time relative to the number and complexity* of virtual applications.

        -

      • -
    • -
    • (Operation) Publishing/refresh will process un-publish and publish operations for changes to user package entitlements.

    • -
    - - - - ---- - - - - - - - - - - - - -
    OutcomeOutcome

    -
      -
    • Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of login.

    • -
    • The publishing/refresh will process changes to the users entitled virtual applications which impacts the experience.

    • -

    Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended.

    - - - -### Impact to Package Life Cycle - -Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (un-published) virtual application packages, it is recommended you update the base image to reflect these changes. To understand why review the following section: - -App-V 5.0 SP2 introduced the concept of pending states. In the past, - -- If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the un-publish or publish operation, respectively, would fail. - -- Now, if a package is in-use the operation will be pended. The un-publish and publish-pend operations will be processed on service restart or if another publish or un-publish command is issued. In the latter case, if the virtual application is in-use otherwise, the virtual application will remain in a pending state. For globally published packages, a restart (or service restart) often needed. - -In a non-persistent environment, it is unlikely these pended operations will be processed. The pended operations, for example tasks are captured under **HKEY\_CURRENT\_USER** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **PendingTasks**. Although this location is persisted by the UPM solution, if it is not applied to the environment prior to log on, it will not be processed. - -### Enhancing the VDI Experience through Performance Optimization Tuning - -The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. - -**.NET NGEN Blog and Script (Highly Recommended)** - -About NGEN technology - -- [How to speed up NGEN optimization](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) - -- [Script](https://aka.ms/DrainNGenQueue) - -**Windows Server and Server Roles** - -Server Performance Tuning Guidelines for - -- [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx) - -- [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx) - -- [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx) - -**Server Roles** - -- [Remote Desktop Virtualization Host](https://msdn.microsoft.com/library/windows/hardware/dn567643.aspx) - -- [Remote Desktop Session Host](https://msdn.microsoft.com/library/windows/hardware/dn567648.aspx) - -- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](https://msdn.microsoft.com/library/windows/hardware/dn567678.aspx) - -- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](https://technet.microsoft.com/library/jj134210.aspx) - -**Windows Client (Guest OS) Performance Tuning Guidance** - -- [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx) - -- [Optimization Script: (Provided by Microsoft Support)](https://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx) - -- [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf) - -- [Optimization Script: (Provided by Microsoft Support)](https://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx) - -## Sequencing Steps to Optimize Packages for Publishing Performance - - -App-V 5.0 and App-V 5.0 SP2 provide significant value in their respective releases. Several features facilitate new scenarios or enabled new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations. - - ------ - - - - - - - - - - - - - - - - -
    StepConsiderationBenefitsTradeoffs

    No Feature Block 1 (FB1, also known as Primary FB)

    No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch.If there are network limitations, FB1 will:

    -
      -
    • Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.

    • -
    • Delay launch until the entire FB1 has been streamed.

    • -

    Stream faulting decreases the launch time.

    Virtual application packages with FB1 configured will need to be re-sequenced.

    - - - -### Removing FB1 - -Removing FB1 does not require the original application installer. After completing the following steps, it is suggested that you revert the computer running the sequencer to a clean snapshot. - -**Sequencer UI** - Create a New Virtual Application Package. - -1. Complete the sequencing steps up to Customize -> Streaming. - -2. At the Streaming step, do not select **Optimize the package for deployment over slow or unreliable network**. - -3. If desired, move on to **Target OS**. - -**Modify an Existing Virtual Application Package** - -1. Complete the sequencing steps up to Streaming. - -2. Do not select **Optimize the package for deployment over a slow or unreliable network**. - -3. Move to **Create Package**. - -**PowerShell** - Update an Existing Virtual Application Package. - -1. Open an elevated PowerShell session. - -2. Import-module **appvsequencer**. - -3. **Update-AppvSequencerPackage** - **AppvPackageFilePath** - - "C:\\Packages\\MyPackage.appv" -Installer - - "C:\\PackageInstall\\PackageUpgrade.exe empty.exe" -OutputPath - - "C:\\UpgradedPackages" - - **Note** - This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file. - - - - ------ - - - - - - - - - - - - - - - - -
    StepConsiderationsBenefitsTradeoffs

    No SXS Install at Publish (Pre-Install SxS assemblies)

    Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package.

    The SxS Assembly dependencies will not install at publishing time.

    SxS Assembly dependencies must be pre-installed.

    - - - -### Creating a new virtual application package on the sequencer - -If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is installed as part of an application’s installation, SxS Assembly will be automatically detected and included in the package. The administrator will be notified and will have the option to exclude the SxS Assembly. - -**Client Side**: - -When publishing a virtual application package, the App-V 5.0 SP2 Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Installer (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur. - - ------ - - - - - - - - - - - - - - - - -
    StepConsiderationsBenefitsTradeoffs

    Selectively Employ Dynamic Configuration files

    The App-V 5.0 client must parse and process these Dynamic Configuration files.

    -

    Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.

    -

    Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.

    Publishing times will improve if these files are used selectively or not at all.

    Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.

    - - - -### Disabling a Dynamic Configuration using Powershell - -- For already published packages, you can use `Set-AppVClientPackage –Name Myapp –Path c:\Packages\Apps\MyApp.appv` without - - **-DynamicDeploymentConfiguration** parameter - -- Similarly, when adding new packages using `Add-AppVClientPackage –Path c:\Packages\Apps\MyApp.appv`, do not use the - - **-DynamicDeploymentConfiguration** parameter. - -For documentation on How to Apply a Dynamic Configuration, see: - -- [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell.md) - -- [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell.md) - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    StepConsiderationsBenefitsTradeoffs

    Account for Synchronous Script Execution during Package Lifecycle.

    If script collateral is embedded in the package, Add (Powershell) may be significantly slower.

    -

    Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.

    Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.

    This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.

    Remove Extraneous Virtual Fonts from Package.

    The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20.

    Virtual Fonts impact publishing refresh performance.

    Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.

    - - - -### Determining what virtual fonts exist in the package - -- Make a copy of the package. - -- Rename Package\_copy.appv to Package\_copy.zip - -- Open AppxManifest.xml and locate the following: - - <appv:Extension Category="AppV.Fonts"> - - <appv:Fonts> - - <appv:Font Path="\[{Fonts}\]\\private\\CalibriL.ttf" DelayLoad="true"></appv:Font> - - **Note** - If there are fonts marked as **DelayLoad**, those will not impact first launch. - - - -~~~ -</appv:Fonts> -~~~ - -### Excluding virtual fonts from the package - -Use the dynamic configuration file that best suits the user scope – deployment configuration for all users on computer, user configuration for specific user or users. - -- Disable fonts with the deployment or user configuration. - -Fonts - ---> - -<Fonts Enabled="false" /> - -<!-- - -## App-V 5.0 Performance Guidance Terminology - - -The following terms are used when describing concepts and actions related to App-V 5.0 performance optimization. - -- **Complexity** – Refers to the one or more package characteristics that may impact performance during pre-configure (**Add-AppvClientPackage**) or integration (**Publish-AppvClientPackage**). Some example characteristics are: manifest size, number of virtual fonts, number of files. - -- **De-Integrate** – Removes the user integrations - -- **Re-Integrate** – Applies the user integrations. - -- **Non-Persistent, Pooled** – Creates a computer running a virtual environment each time they log in. - -- **Persistent, Personal** – A computer running a virtual environment that remains the same for every login. - -- **Stateful** - For this document, implies that user integrations are persisted between sessions and a user environment management technology is used in conjunction with non-persistent RDSH or VDI. - -- **Stateless** – Represents a scenario when no user state is persisted between sessions. - -- **Trigger** – (or Native Action Triggers). UPM uses these types of triggers to initiate monitoring or synchronization operations. - -- **User Experience** - In the context of App-V 5.0, the user experience, quantitatively, is the sum of the following parts: - - - From the point that users initiate a log-in to when they are able to manipulate the desktop. - - - From the point where the desktop can be interacted with to the point a publishing refresh begins (in PowerShell terms, sync) when using the App-V 5.0 full server infrastructure. In standalone instances, it is when the **Add-AppVClientPackage** and **Publish-AppVClientPackage Powershell** commands are initiated. - - - From start to completion of the publishing refresh. In standalone instances, this is the first to last virtual application published. - - - From the point where the virtual application is available to launch from a shortcut. Alternatively, it is from the point at which the file type association is registered and will launch a specified virtual application. - -- **User Profile Management** – The controlled and structured approach to managing user components associated with the environment. For example, user profiles, preference and policy management, application control and application deployment. You can use scripting or third-party solutions configure the environment as needed. - - - - - - -## Related topics - - -[Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - - - - - - - - - diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md deleted file mode 100644 index c6309edacb..0000000000 --- a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md +++ /dev/null @@ -1,768 +0,0 @@ ---- -title: Performance Guidance for Application Virtualization 5.1 -description: Performance Guidance for Application Virtualization 5.1 -author: dansimp -ms.assetid: 5f2643c7-5cf7-4a29-adb7-45bf9f5b0364 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Performance Guidance for Application Virtualization 5.1 - - -Learn how to configure App-V 5.1 for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. - -Implementing multiple methods can help you improve the end-user experience. However, your environment may not support all methods. - -You should read and understand the following information before reading this document. - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [App-V 5 SP2 Application Publishing and Client Interaction](https://go.microsoft.com/fwlink/?LinkId=395206) - -- [Microsoft Application Virtualization Sequencing Guide](https://go.microsoft.com/fwlink/?LinkId=269953) - -**Note** -Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. - - - -Finally, this document will provide you with the information to configure the computer running App-V 5.1 client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V 5.1 in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI). - -To help determine what information is relevant to your environment you should review each section’s brief overview and applicability checklist. - -## App-V 5.1 in stateful\* non-persistent deployments - - -This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This is achieved by uniquely addressing the often long-running App-V 5.1 publishing refresh. As you will discover the basis of the approach, the fastest publishing refresh, is one that doesn’t have to actually do anything. A number of conditions must be met and steps followed to provide the optimal user experience. - -Use the information in the following section for more information: - -[Usage Scenarios](#bkmk-us) - As you review the two scenarios, keep in mind that these are the approach extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users and/or virtual applications packages. - -- Optimized for Performance – To provide the optimal experience, you can expect the base image to include some of the App-V virtual application package. This and other requirements are discussed. - -- Optimized for Storage – If you are concerned with the storage impact, following this scenario will help address those concerns. - -[Preparing your Environment](#bkmk-pe) - -- Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach. - -- Use UE-V 2.1 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution. - -[User Experience Walk-through](#bkmk-uewt) - -- Walk-through – This is a step-by-step walk-through of the App-V and UE-V operations and the expectations users should have. - -- Outcome – This describes the expected results. - -[Impact to Package Lifecycle](#bkmk-plc) - -[Enhancing the VDI Experience through Performance Optimization/Tuning](#bkmk-evdi) - -### Applicability Checklist - -Deployment Environment - - ---- - - - - - - - - - - -
    Checklist box

    Non-Persistent VDI or RDSH.

    Checklist box

    User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).

    - - - -Expected Configuration - - ---- - - - - - - - - - - -
    Checklist box

    User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.

    Checklist box

    App-V Shared Content Store (SCS) is configured or can be configured.

    - - - -IT Administration - - ---- - - - - - - -
    Checklist box

    Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.

    - - - -### Usage Scenario - -As you review the two scenarios, keep in mind that these approach the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both. - - ---- - - - - - - - - - - - - -
    Optimized for PerformanceOptimized for Storage

    To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead.

    -

    The following describes many performance improvements in stateful non-persistent deployments. For more information, see the Sequencing Steps to Optimize Packages for Publishing Performance and reference to App-V Sequencing Guide in the See Also section of this document.

    The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.

    -

    The impact of this alteration is detailed in the User Experience Walkthrough section of this document.

    - - - -### Preparing your Environment - -The following table displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach. - -**Prepare the Base Image** - - ---- - - - - - - - - - - - - -
    Optimized for PerformanceOptimized for Storage

    -
      -
    • Install the App-V 5.1 client version of the client.

    • -
    • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

    • -
    • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.1 Client for Shared Content Store Mode.

    • -
    • Configure Preserve User Integrations on Login Registry DWORD.

    • -
    • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.

    • -
    • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.

    • -
    • Pre-publish all global-targeted packages.

      -

      -

      Alternatively,

      -
        -
      • Perform a global publishing/refresh.

      • -
      • Perform a user publishing/refresh.

      • -
      • Un-publish all user-targeted packages.

      • -
      • Delete the following user-Virtual File System (VFS) entries.

      • -
      -

      AppData\Local\Microsoft\AppV\Client\VFS

      -

      AppData\Roaming\Microsoft\AppV\Client\VFS

    • -

    -
      -
    • Install the App-V 5.1 client version of the client.

    • -
    • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.

    • -
    • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.1 Client for Shared Content Store Mode.

    • -
    • Configure Preserve User Integrations on Login Registry DWORD.

    • -
    • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.

    • -
    • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.

    • -
    • Pre-publish all global-targeted packages.

      -

    • -
    - - - -**Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Configuration SettingWhat does this do?How should I use it?

    Shared Content Store (SCS) Mode

    -
      -
    • Configurable in PowerShell using Set- AppvClientConfigurationSharedContentStoreMode, or

    • -
    • During installation of the App-V client.

    • -

    When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM).

    -

    This helps to conserve local storage and minimize disk I/O per second (IOPS).

    This is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN.

    PreserveUserIntegrationsOnLogin

    -
      -
    • Configure in the Registry under HKEY_LOCAL_MACHINE \ Software \ Microsoft \ AppV \ Client \ Integration.

    • -
    • Create the DWORD value PreserveUserIntegrationsOnLogin with a value of 1.

    • -
    • Restart the App-V client service or restart the computer running the App-V Client.

    • -

    If you have not pre-configured (Add-AppvClientPackage) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then re-integrate*.

    -

    For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh.

    If you don’t plan to pre-configure every available user package in the base image, use this setting.

    MaxConcurrentPublishingRefresh

    -
      -
    • Configure in the Registry under HKEY_LOCAL_MACHINE <strong>Software \ Microsoft \ AppV <strong>Client \ Publishing.

    • -
    • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.

    • -
    • The App-V client service and computer do not need to be restarted.

    • -

    This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit.

    Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync.

    -

    If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time.

    - - - -### Configure UE-V solution for App-V Approach - -We recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. UE-V is optimized for RDS and VDI scenarios. - -For more information see [Getting Started With User Experience Virtualization 2.0](https://technet.microsoft.com/library/dn458926.aspx) - -In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458926.aspx). - -**Note** -Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default. - -UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following 2 scenarios, because the net result will be that the shortcut will be valid on one but not all devices. - -- If a user has an application installed on one device with .lnk files enabled and the same native application installed on another device to a different installation root with .lnk files enabled. - -- If a user has an application installed on one device but not another with .lnk files enabled. - - - -**Important** -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types. - -**Configure other User Profile Management (UPM) solution for App-V Approach** - -The expectation in a stateful environment is that a UPM solution is implemented and can support persistence of user data across sessions and between logins. - -The requirements for the UPM solution are as follows. - -To enable an optimized login experience, for example the App-V 5.1 approach for the user, the solution must be capable of: - -- Persisting the below user integrations as part of the user profile/persona. - -- Triggering a user profile sync on login (or application start), which can guarantee that all user integrations are applied before publishing/refresh begin, or, - -- Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations. - - **Note** - App-V is supported when using UPD only when the entire profile is stored on the user profile disk. - - App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver does not handle UPD selected folders. - - - -- Capturing changes to the locations, which constitute the user integrations, prior to session logoff. - -With App-V 5.1 when you add a publishing server (**Add-AppvPublishingServer**) you can configure synchronization, for example refresh during log on and/or after a specified refresh interval. In both cases a scheduled task is created. - -In previous versions of App-V 5.1, both scheduled tasks were configured using a VBScript that would initiate the user and global refresh. With Hotfix Package 4 for Application Virtualization 5.0 SP2 the user refresh on log on was initiated by **SyncAppvPublishingServer.exe**. This change was introduced to provide UPM solutions a trigger process. This process delays the publish /refresh to allow the UPM solution to apply the user integrations. It will exit once the publishing/refresh is complete. - -**User Integrations** - -Registry – HKEY\_CURRENT\_USER - -- Path - Software\\Classes - - Exclude: Local Settings, ActivatableClasses, AppX\* - -- Path - Software\\Microsoft\\AppV - -- Path- Software\\Microsoft\\Windows\\CurrentVersion\\App Paths - -**File Locations** - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Catalog - -- Root – “Environment Variable” APPDATA - - Path – Microsoft\\AppV\\Client\\Integration - -- Root – “Environment Variable” APPDATA - - Path - Microsoft\\Windows\\Start Menu\\Programs - -- (To persist all desktop shortcuts, virtual and non-virtual) - - Root - “KnownFolder” {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}FileMask - \*.lnk - -**Microsoft User Experience Virtualization (UE-V)** - -Additionally, we recommend using Microsoft User Experience Virtualization (UE-V) to capture and centralize application settings and Windows operating system settings for a specific user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -For more information see [Getting Started With User Experience Virtualization 1.0](https://technet.microsoft.com/library/jj680015.aspx) and [Sharing Settings Location Templates with the UE-V Template Gallery](https://technet.microsoft.com/library/jj679972.aspx). - -### User Experience Walk-through - -This following is a step-by-step walk-through of the App-V and UPM operations and the expectations users should expect. - - ---- - - - - - - - - - - - - -
    Optimized for PerformanceOptimized for Storage

    After implementing this approach in the VDI/RDSH environment, on first login,

    -
      -
    • (Operation) A user-publishing/refresh is initiated. (Expectation) If this is the first time a user has published virtual applications (e.g. non-persistent), this will take the usual duration of a publishing/refresh.

    • -
    • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state.

    • -
    -

    On subsequent logins:

    -
      -
    • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

      -

      (Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (i.e., package entitlements change), some may go away.

    • -
    • (Operation) Publishing/refresh will process un-publish and publish operations for changes in user package entitlements. (Expectation) If there are no entitlement changes, publishing1 will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity* of virtual applications

    • -
    • (Operation) UPM solution will capture user integrations again at logoff. (Expectation) Same as previous.

    • -
    -

    ¹ The publishing operation (Publish-AppVClientPackage) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps.

    After implementing this approach in the VDI/RDSH environment, on first login,

    -
      -
    • (Operation) A user-publishing/refresh is initiated. (Expectation)

      -
        -
      • If this is the first time a user has published virtual applications (e.g., non-persistent), this will take the usual duration of a publishing/refresh.

      • -
      • First and subsequent logins will be impacted by pre-configuring of packages (add/refresh).

        -

      • -
    • -
    • (Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state

    • -
    -

    On subsequent logins:

    -
      -
    • (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.

    • -
    • (Operation) Add/refresh must pre-configure all user targeted applications. (Expectation)

      -
        -
      • This may increase the time to application availability significantly (on the order of 10’s of seconds).

      • -
      • This will increase the publishing refresh time relative to the number and complexity* of virtual applications.

        -

      • -
    • -
    • (Operation) Publishing/refresh will process un-publish and publish operations for changes to user package entitlements.

    • -
    - - - - ---- - - - - - - - - - - - - -
    OutcomeOutcome

    -
      -
    • Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of login.

    • -
    • The publishing/refresh will process changes to the users entitled virtual applications which impacts the experience.

    • -

    Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended.

    - - - -### Impact to Package Life Cycle - -Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (un-published) virtual application packages, it is recommended you update the base image to reflect these changes. To understand why review the following section: - -App-V 5.0 SP2 introduced the concept of pending states. In the past, - -- If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the un-publish or publish operation, respectively, would fail. - -- Now, if a package is in-use the operation will be pended. The un-publish and publish-pend operations will be processed on service restart or if another publish or un-publish command is issued. In the latter case, if the virtual application is in-use otherwise, the virtual application will remain in a pending state. For globally published packages, a restart (or service restart) often needed. - -In a non-persistent environment, it is unlikely these pended operations will be processed. The pended operations, for example tasks are captured under **HKEY\_CURRENT\_USER** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **PendingTasks**. Although this location is persisted by the UPM solution, if it is not applied to the environment prior to log on, it will not be processed. - -### Enhancing the VDI Experience through Performance Optimization Tuning - -The following section contains lists with information about Microsoft documentation and downloads that may be useful when optimizing your environment for performance. - -**.NET NGEN Blog and Script (Highly Recommended)** - -About NGEN technology - -- [How to speed up NGEN optimization](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx) - -- [Script](https://aka.ms/DrainNGenQueue) - -**Windows Server and Server Roles** - -Server Performance Tuning Guidelines for - -- [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx) - -- [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx) - -- [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx) - -**Server Roles** - -- [Remote Desktop Virtualization Host](https://msdn.microsoft.com/library/windows/hardware/dn567643.aspx) - -- [Remote Desktop Session Host](https://msdn.microsoft.com/library/windows/hardware/dn567648.aspx) - -- [IIS Relevance: App-V Management, Publishing, Reporting Web Services](https://msdn.microsoft.com/library/windows/hardware/dn567678.aspx) - -- [File Server (SMB) Relevance: If used for App-V Content Storage and Delivery in SCS Mode](https://technet.microsoft.com/library/jj134210.aspx) - -**Windows Client (Guest OS) Performance Tuning Guidance** - -- [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx) - -- [Optimization Script: (Provided by Microsoft Support)](https://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx) - -- [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf) - -- [Optimization Script: (Provided by Microsoft Support)](https://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx) - -## Sequencing Steps to Optimize Packages for Publishing Performance - - -Several App-V features facilitate new scenarios or enable new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations. - - ------ - - - - - - - - - - - - - - - - -
    StepConsiderationBenefitsTradeoffs

    No Feature Block 1 (FB1, also known as Primary FB)

    No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch.If there are network limitations, FB1 will:

    -
      -
    • Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.

    • -
    • Delay launch until the entire FB1 has been streamed.

    • -

    Stream faulting decreases the launch time.

    Virtual application packages with FB1 configured will need to be re-sequenced.

    - - - -### Removing FB1 - -Removing FB1 does not require the original application installer. After completing the following steps, it is suggested that you revert the computer running the sequencer to a clean snapshot. - -**Sequencer UI** - Create a New Virtual Application Package. - -1. Complete the sequencing steps up to Customize -> Streaming. - -2. At the Streaming step, do not select **Optimize the package for deployment over slow or unreliable network**. - -3. If desired, move on to **Target OS**. - -**Modify an Existing Virtual Application Package** - -1. Complete the sequencing steps up to Streaming. - -2. Do not select **Optimize the package for deployment over a slow or unreliable network**. - -3. Move to **Create Package**. - -**PowerShell** - Update an Existing Virtual Application Package. - -1. Open an elevated PowerShell session. - -2. Import-module **appvsequencer**. - -3. **Update-AppvSequencerPackage** - **AppvPackageFilePath** - - "C:\\Packages\\MyPackage.appv" -Installer - - "C:\\PackageInstall\\PackageUpgrade.exe empty.exe" -OutputPath - - "C:\\UpgradedPackages" - - **Note** - This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file. - - - - ------ - - - - - - - - - - - - - - - - -
    StepConsiderationsBenefitsTradeoffs

    No SXS Install at Publish (Pre-Install SxS assemblies)

    Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package.

    The SxS Assembly dependencies will not install at publishing time.

    SxS Assembly dependencies must be pre-installed.

    - - - -### Creating a new virtual application package on the sequencer - -If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is installed as part of an application’s installation, SxS Assembly will be automatically detected and included in the package. The administrator will be notified and will have the option to exclude the SxS Assembly. - -**Client Side**: - -When publishing a virtual application package, the App-V Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Installer (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur. - - ------ - - - - - - - - - - - - - - - - -
    StepConsiderationsBenefitsTradeoffs

    Selectively Employ Dynamic Configuration files

    The App-V 5.1 client must parse and process these Dynamic Configuration files.

    -

    Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.

    -

    Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.

    Publishing times will improve if these files are used selectively or not at all.

    Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.

    - - - -### Disabling a Dynamic Configuration using Powershell - -- For already published packages, you can use `Set-AppVClientPackage –Name Myapp –Path c:\Packages\Apps\MyApp.appv` without - - **-DynamicDeploymentConfiguration** parameter - -- Similarly, when adding new packages using `Add-AppVClientPackage –Path c:\Packages\Apps\MyApp.appv`, do not use the - - **-DynamicDeploymentConfiguration** parameter. - -For documentation on How to Apply a Dynamic Configuration, see: - -- [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell51.md) - -- [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md) - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    StepConsiderationsBenefitsTradeoffs

    Account for Synchronous Script Execution during Package Lifecycle.

    If script collateral is embedded in the package, Add (Powershell) may be significantly slower.

    -

    Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.

    Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.

    This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.

    Remove Extraneous Virtual Fonts from Package.

    The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20.

    Virtual Fonts impact publishing refresh performance.

    Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.

    - - - -### Determining what virtual fonts exist in the package - -- Make a copy of the package. - -- Rename Package\_copy.appv to Package\_copy.zip - -- Open AppxManifest.xml and locate the following: - - <appv:Extension Category="AppV.Fonts"> - - <appv:Fonts> - - <appv:Font Path="\[{Fonts}\]\\private\\CalibriL.ttf" DelayLoad="true"></appv:Font> - - **Note** - If there are fonts marked as **DelayLoad**, those will not impact first launch. - - - -~~~ -</appv:Fonts> -~~~ - -### Excluding virtual fonts from the package - -Use the dynamic configuration file that best suits the user scope – deployment configuration for all users on computer, user configuration for specific user or users. - -- Disable fonts with the deployment or user configuration. - -Fonts - ---> - -<Fonts Enabled="false" /> - -<!-- - -## App-V 5.1 Performance Guidance Terminology - - -The following terms are used when describing concepts and actions related to App-V 5.1 performance optimization. - -- **Complexity** – Refers to the one or more package characteristics that may impact performance during pre-configure (**Add-AppvClientPackage**) or integration (**Publish-AppvClientPackage**). Some example characteristics are: manifest size, number of virtual fonts, number of files. - -- **De-Integrate** – Removes the user integrations - -- **Re-Integrate** – Applies the user integrations. - -- **Non-Persistent, Pooled** – Creates a computer running a virtual environment each time they log in. - -- **Persistent, Personal** – A computer running a virtual environment that remains the same for every login. - -- **Stateful** - For this document, implies that user integrations are persisted between sessions and a user environment management technology is used in conjunction with non-persistent RDSH or VDI. - -- **Stateless** – Represents a scenario when no user state is persisted between sessions. - -- **Trigger** – (or Native Action Triggers). UPM uses these types of triggers to initiate monitoring or synchronization operations. - -- **User Experience** - In the context of App-V 5.1, the user experience, quantitatively, is the sum of the following parts: - - - From the point that users initiate a log-in to when they are able to manipulate the desktop. - - - From the point where the desktop can be interacted with to the point a publishing refresh begins (in PowerShell terms, sync) when using the App-V 5.1 full server infrastructure. In standalone instances, it is when the **Add-AppVClientPackage** and **Publish-AppVClientPackage Powershell** commands are initiated. - - - From start to completion of the publishing refresh. In standalone instances, this is the first to last virtual application published. - - - From the point where the virtual application is available to launch from a shortcut. Alternatively, it is from the point at which the file type association is registered and will launch a specified virtual application. - -- **User Profile Management** – The controlled and structured approach to managing user components associated with the environment. For example, user profiles, preference and policy management, application control and application deployment. You can use scripting or third-party solutions configure the environment as needed. - - - - - - -## Related topics - - -[Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-app-v-50-rc.md b/mdop/appv-v5/planning-for-app-v-50-rc.md deleted file mode 100644 index 1d4bd7a75c..0000000000 --- a/mdop/appv-v5/planning-for-app-v-50-rc.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Planning for App-V 5.0 -description: Planning for App-V 5.0 -author: dansimp -ms.assetid: 69df85b3-06c7-4123-af05-29d537a687ec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for App-V 5.0 - - -Use this information to plan how to deploy Microsoft Application Virtualization (App-V) 5.0 so that it does not disrupt your users or the network. - -## Planning information - - -- [Preparing Your Environment for App-V 5.0](preparing-your-environment-for-app-v-50.md) - - This section describes the computing environment requirements and installation prerequisites that should be planned for before beginning App-V 5.0 setup. - -- [Planning to Deploy App-V](planning-to-deploy-app-v.md) - - This section describes the minimum hardware and software requirements necessary for App-V 5.0 client, sequencer and server feature installations. Additionally, associated feature planning information is also displayed. - -- [App-V 5.0 Planning Checklist](app-v-50-planning-checklist.md) - - Planning checklist that can be used to assist in App-V 5.0 deployment planning. - - - - - - -## Other resources for App-V 5.0 Planning - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -- [Deploying App-V 5.0](deploying-app-v-50.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - -- [Troubleshooting App-V 5.0](troubleshooting-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-for-app-v-51.md b/mdop/appv-v5/planning-for-app-v-51.md deleted file mode 100644 index 302d550ef0..0000000000 --- a/mdop/appv-v5/planning-for-app-v-51.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Planning for App-V 5.1 -description: Planning for App-V 5.1 -author: dansimp -ms.assetid: 8d84e679-0bd3-4864-976b-a3cbe6eafba6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for App-V 5.1 - - -Use this information to plan how to deploy Microsoft Application Virtualization (App-V) 5.1 so that it does not disrupt your users or the network. - -## Planning information - - -- [Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md) - - This section describes the computing environment requirements and installation prerequisites that should be planned for before beginning App-V 5.1 setup. - -- [Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - This section describes the minimum hardware and software requirements necessary for App-V 5.1 client, sequencer and server feature installations. Additionally, associated feature planning information is also displayed. - -- [App-V 5.1 Planning Checklist](app-v-51-planning-checklist.md) - - Planning checklist that can be used to assist in App-V 5.1 deployment planning. - - - - - - -## Other resources for App-V 5.1 Planning - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -- [Deploying App-V 5.1](deploying-app-v-51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - -- [Troubleshooting App-V 5.1](troubleshooting-app-v-51.md) - -- [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md b/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md deleted file mode 100644 index d23fc021f8..0000000000 --- a/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md +++ /dev/null @@ -1,156 +0,0 @@ ---- -title: Planning for High Availability with App-V 5.0 -description: Planning for High Availability with App-V 5.0 -author: dansimp -ms.assetid: 6d9a6492-23f8-465c-82e5-49c863594156 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for High Availability with App-V 5.0 - - -Microsoft Application Virtualization 5.0 (App-V 5.0) system configurations can take advantage of options that maintain a high level of available service. - -Use the information in the following sections to help you understand the options to deploy App-V 5.0 in a highly available configuration. - -- [Support for Microsoft SQL Server clustering](#bkmk-sqlcluster) - -- [Support for IIS Network Load Balancing](#bkmk-iisloadbal) - -- [Support for clustered file servers when running (SCS) mode](#bkmk-clusterscsmode) - -- [Support for Microsoft SQL Server Mirroring](#bkmk-sqlmirroring) - -- [Support for Microsoft SQL Server Always On](#bkmk-sqlalwayson) - -## Support for Microsoft SQL Server clustering - - -You can run the App-V Management database and Reporting database on computers that are running Microsoft SQL Server clusters. However, you must install the databases using scripts. - -For instructions, see [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md). - -## Support for IIS Network Load Balancing - - -You can use Internet Information Services (IIS) Network Load Balancing to configure a highly available environment for computers running the App-V 5.x Management, Publishing, and Reporting services which are deployed through IIS. - -Review the following for more information about configuring IIS and Network Load Balancing for computers running Windows Server operating systems: - -- Provides information about configuring Internet Information Services (IIS) 7.0. - - [Achieving High Availability and Scalability - ARR and NLB](https://go.microsoft.com/fwlink/?LinkId=316369) (https://go.microsoft.com/fwlink/?LinkId=316369) - -- Configuring Microsoft Windows Server - - [Network Load Balancing](https://go.microsoft.com/fwlink/?LinkId=316370) (https://go.microsoft.com/fwlink/?LinkId=316370). - - This information also applies to IIS Network Load Balancing (NLB) clusters in Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012. - - **Note**   - The IIS Network Load Balancing functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are changed in Windows Server 2012. For information on new ways to do tasks, see [Common Management Tasks and Navigation in Windows Server 2012 R2 Preview and Windows Server 2012](https://go.microsoft.com/fwlink/?LinkId=316371) (https://go.microsoft.com/fwlink/?LinkId=316371). - - - -## Support for clustered file servers when running (SCS) mode - - -Running App-V 5.0 in Share Content Store (SCS) mode with clustered file servers is supported. - -The following steps can be used to enable this configuration: - -- Configure App-V 5.0 to run in client SCS mode. For more information about configuring App-V 5.0 SCS mode, see [How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md). - -- Configure the file server cluster configured in both the Microsoft Server 2012 scale out mode and pre **2012** mode with a virtual SAN. - -The following steps can be used to validate the configuration: - -1. Add a package on the publishing server. For more information about adding a package, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md). - -2. Perform a publishing refresh on the computer running the App-V 5.0 client and open an application. - -3. Switch cluster nodes mid-publishing refresh and mid-streaming to ensure fail-over works correctly. - -Review the following for more information about configuring Windows Server Failover clusters: - -- [Checklist: Create a Clustered File Server](https://go.microsoft.com/fwlink/?LinkId=316372) (https://go.microsoft.com/fwlink/?LinkId=316372). - -- [Use Cluster Shared Volumes in a Windows Server 2012 Failover Cluster](https://go.microsoft.com/fwlink/?LinkId=316373) (https://go.microsoft.com/fwlink/?LinkId=316373). - -## Support for Microsoft SQL Server Mirroring - - -Using Microsoft SQL Server mirroring, where the App-V 5.0 management server database is mirrored utilizing two SQL Server instances, for App-V 5.0 management server databases is supported. - -Review the following for more information about configuring Microsoft SQL Server Mirroring: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=316375) (https://go.microsoft.com/fwlink/?LinkId=316375) - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=316377) (https://go.microsoft.com/fwlink/?LinkId=316377) - -The following steps can be used to validate the configuration: - -1. Initiate a Microsoft SQL Server Mirroring session. - -2. Select **Failover** to designate a new master Microsoft SQL Server instance. - -3. Verify that the App-V 5.0 management server continues to function as expected after the failover. - -The connection string on the management server can be modified to include **failover partner = <server2>**. This will only help when the primary on the mirror has failed over to the secondary and the computer running the App-V 5.0 client is doing a fresh connection (say after reboot). - -Use the following steps to modify the connection string to include **failover partner = <server2>**: - -**Important**   -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -1. Login to the management server and open **regedit**. - -2. Navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ManagementService**. - -3. Modify the **MANAGEMENT\_SQL\_CONNECTION\_STRING** value with the **failover partner = <server2>**. - -4. Restart management service using the IIS console. - - **Note**   - Database Mirroring is on the list of Deprecated Database Engine Features for Microsoft SQL Server 2012 due to the **AlwaysOn** feature available with Microsoft SQL Server 2012. - - - -Click any of the following links for more information: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=394235) (https://go.microsoft.com/fwlink/?LinkId=394235). - -- [How to: Configure a Database Mirroring Session (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=394236) (https://go.microsoft.com/fwlink/?LinkId=394236). - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=394237) (https://go.microsoft.com/fwlink/?LinkId=394237). - -- [Deprecated Database Engine Features in SQL Server 2012](https://go.microsoft.com/fwlink/?LinkId=394238) (https://go.microsoft.com/fwlink/?LinkId=394238). - -## Support for Microsoft SQL Server Always On configuration - - -The App-V 5.0 management server database supports deployments to computers running Microsoft SQL Server with the **Always On** configuration. - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md b/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md deleted file mode 100644 index a0cfecee7c..0000000000 --- a/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md +++ /dev/null @@ -1,161 +0,0 @@ ---- -title: Planning for High Availability with App-V 5.1 -description: Planning for High Availability with App-V 5.1 -author: dansimp -ms.assetid: 1f190a0e-10ee-4fbe-a602-7e807e943033 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for High Availability with App-V 5.1 - - -Microsoft Application Virtualization (App-V) 5.1 system configurations can take advantage of options that maintain a high level of available service. - -Use the information in the following sections to help you understand the options to deploy App-V 5.1 in a highly available configuration. - -- [Support for Microsoft SQL Server clustering](#bkmk-sqlcluster) - -- [Support for IIS Network Load Balancing](#bkmk-iisloadbal) - -- [Support for clustered file servers when running (SCS) mode](#bkmk-clusterscsmode) - -- [Support for Microsoft SQL Server Mirroring](#bkmk-sqlmirroring) - -- [Support for Microsoft SQL Server Always On](#bkmk-sqlalwayson) - -## Support for Microsoft SQL Server clustering - - -You can run the App-V Management database and Reporting database on computers that are running Microsoft SQL Server clusters. However, you must install the databases using scripts. - -For instructions, see [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md). - -## Support for IIS Network Load Balancing - - -You can use Internet Information Services (IIS) Network Load Balancing to configure a highly available environment for computers running the App-V 5.x Management, Publishing, and Reporting services which are deployed through IIS. - -Review the following for more information about configuring IIS and Network Load Balancing for computers running Windows Server operating systems: - -- Provides information about configuring Internet Information Services (IIS) 7.0. - - [Achieving High Availability and Scalability - ARR and NLB](https://go.microsoft.com/fwlink/?LinkId=316369) (https://go.microsoft.com/fwlink/?LinkId=316369) - -- Configuring Microsoft Windows Server - - [Network Load Balancing](https://go.microsoft.com/fwlink/?LinkId=316370) (https://go.microsoft.com/fwlink/?LinkId=316370). - - This information also applies to IIS Network Load Balancing (NLB) clusters in Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012. - - **Note**   - The IIS Network Load Balancing functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are changed in Windows Server 2012. For information on new ways to do tasks, see [Common Management Tasks and Navigation in Windows Server 2012 R2 Preview and Windows Server 2012](https://go.microsoft.com/fwlink/?LinkId=316371) (https://go.microsoft.com/fwlink/?LinkId=316371). - - - -## Support for clustered file servers when running (SCS) mode - - -Running App-V 5.1 in Share Content Store (SCS) mode with clustered file servers is supported. - -The following steps can be used to enable this configuration: - -- Configure App-V 5.1 to run in client SCS mode. For more information about configuring App-V 5.1 SCS mode, see [How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md). - -- Configure the file server cluster configured in both the Microsoft Server 2012 scale out mode and pre **2012** mode with a virtual SAN. - -The following steps can be used to validate the configuration: - -1. Add a package on the publishing server. For more information about adding a package, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md). - -2. Perform a publishing refresh on the computer running the App-V 5.1 client and open an application. - -3. Switch cluster nodes mid-publishing refresh and mid-streaming to ensure fail-over works correctly. - -Review the following for more information about configuring Windows Server Failover clusters: - -- [Checklist: Create a Clustered File Server](https://go.microsoft.com/fwlink/?LinkId=316372) (https://go.microsoft.com/fwlink/?LinkId=316372). - -- [Use Cluster Shared Volumes in a Windows Server 2012 Failover Cluster](https://go.microsoft.com/fwlink/?LinkId=316373) (https://go.microsoft.com/fwlink/?LinkId=316373). - -## Support for Microsoft SQL Server Mirroring - - -Using Microsoft SQL Server mirroring, where the App-V 5.1 management server database is mirrored utilizing two SQL Server instances, for App-V 5.1 management server databases is supported. - -Review the following for more information about configuring Microsoft SQL Server Mirroring: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=316375) (https://go.microsoft.com/fwlink/?LinkId=316375) - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=316377) (https://go.microsoft.com/fwlink/?LinkId=316377) - -The following steps can be used to validate the configuration: - -1. Initiate a Microsoft SQL Server Mirroring session. - -2. Select **Failover** to designate a new master Microsoft SQL Server instance. - -3. Verify that the App-V 5.1 management server continues to function as expected after the failover. - -The connection string on the management server can be modified to include **failover partner = <server2>**. This will only help when the primary on the mirror has failed over to the secondary and the computer running the App-V 5.1 client is doing a fresh connection (say after reboot). - -Use the following steps to modify the connection string to include **failover partner = <server2>**: - -**Important**   -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -1. Login to the management server and open **regedit**. - -2. Navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ManagementService**. - -3. Modify the **MANAGEMENT\_SQL\_CONNECTION\_STRING** value with the **failover partner = <server2>**. - -4. Restart management service using the IIS console. - - **Note**   - Database Mirroring is on the list of Deprecated Database Engine Features for Microsoft SQL Server 2012 due to the **AlwaysOn** feature available with Microsoft SQL Server 2012. - - - -Click any of the following links for more information: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=394235) (https://go.microsoft.com/fwlink/?LinkId=394235). - -- [How to: Configure a Database Mirroring Session (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=394236) (https://go.microsoft.com/fwlink/?LinkId=394236). - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=394237) (https://go.microsoft.com/fwlink/?LinkId=394237). - -- [Deprecated Database Engine Features in SQL Server 2012](https://go.microsoft.com/fwlink/?LinkId=394238) (https://go.microsoft.com/fwlink/?LinkId=394238). - -## Support for Microsoft SQL Server Always On configuration - - -The App-V 5.1 management server database supports deployments to computers running Microsoft SQL Server with the **Always On** configuration. - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md deleted file mode 100644 index b802e65076..0000000000 --- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Planning for Migrating from a Previous Version of App-V -description: Planning for Migrating from a Previous Version of App-V -author: dansimp -ms.assetid: d4ca8f09-86fd-456f-8ec2-242ff94ae9a0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Planning for Migrating from a Previous Version of App-V - - -Use the following information to plan how to migrate to App-V 5.0 from previous versions of App-V. - -## Migration requirements - - -Before you start any upgrades, review the following requirements: - -- If you are upgrading from a version earlier than App-V 4.6 SP2, upgrade to version App-V 4.6 SP3 first before upgrading to App-V 5.0 or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components. -**Note:** App-V 4.6 has exited Mainstream support. - -- App-V 5.0 supports only packages that are created using App-V 5.0, or packages that have been converted to the App-V 5.0 (**.appv**) format. - -- App-V 5.0 SP3 only: If you are upgrading the App-V Server from App-V 5.0 SP1, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-migrate-to-50sp3) for instructions. - -## Running the App-V 5.0 client concurrently with App-V 4.6 - - -You can run the App-V 5.0 client concurrently on the same computer with the App-V 4.6 SP3 client. - -When you run coexisting App-V clients, you can: - -- Convert an App-V 4.6 SP3 package to the App-V 5.0 format and publish both packages, when you have both clients running. - -- Define the migration policy for the converted package, which allows the converted App-V 5.0 package to assume the file type associations and shortcuts from the App-V 4.6 package. - -### Supported coexistence scenarios - -The following table shows the supported App-V coexistence scenarios. We recommend that you install the latest available updates of a given release when you are running coexisting clients. - - ---- - - - - - - - - - - - - - - - - -
    App-V 4.6 client typeApp-V 5.0 client type

    App-V 4.6 SP3

    App-V 5.0

    App-V 4.6 SP3 RDS

    App-V 5.0 RDS

    - - - -### Requirements for running coexisting clients - -To run coexisting clients, you must: - -- Install the App-V 4.6 client before you install the App-V 5.0 client. - -- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To get the deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx). - -### Client downloads and documentation - -The following table provides link to the TechNet documentation about the releases. The TechNet documentation about the App-V client applies to both clients, unless stated otherwise. - - ---- - - - - - - - - - - - - - - - - -
    App-V versionLink to TechNet documentation

    App-V 4.6 SP3

    About Microsoft Application Virtualization 4.6 SP3

    App-V 5.0 SP3

    About Microsoft Application Virtualization 5.0 SP3

    - - - -For more information about how to configure App-V 5.0 client coexistence, see: - -- [How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md) - -- [App-V 5.0 Coexistence and Migration](https://technet.microsoft.com/windows/jj835811.aspx) - -## Converting “previous-version” packages using the package converter - - -Before migrating a package, created using App-V 4.6 SP3 or earlier, to App-V 5.0, review the following requirements: - -- You must convert the package to the **.appv** file format. - -- The Package Converter supports only the direct conversion of packages that were created by using App-V 4.5 and later. To use the package converter on a package that was created using a previous version, you must use an App-V 4.5 or later version of the sequencer to upgrade the package, and then you can perform the package conversion. - -For more information about using the package converter to convert a package, see [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md). After you convert the file, you can deploy it to target computers that run the App-V 5.0 client. - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md deleted file mode 100644 index 583f61a259..0000000000 --- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Planning for Migrating from a Previous Version of App-V -description: Planning for Migrating from a Previous Version of App-V -author: dansimp -ms.assetid: 4a058047-9674-41bc-8050-c58c97a80a9b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Planning for Migrating from a Previous Version of App-V - - -Use the following information to plan how to migrate to Microsoft Application Virtualization (App-V) 5.1 from previous versions of App-V. - -## Migration requirements - - -Before you start any upgrades, review the following requirements: - -- If you are upgrading from a version earlier than App-V 4.6 SP2, upgrade to version App-V 4.6 SP3 first before upgrading to App-V 5.1 or later. In this scenario, upgrade the App-V clients first, and then upgrade the server components. -**Note:** App-V 4.6 has exited Mainstream support. - -- App-V 5.1 supports only packages that are created using App-V 5.0 or App-V 5.1, or packages that have been converted to the **.appv** format. - -- If you are upgrading the App-V Server from App-V 5.0 SP1, see [About App-V 5.1](about-app-v-51.md#bkmk-migrate-to-51) for instructions. - -## Running the App-V 5.1 client concurrently with App-V 4.6 - - -You can run the App-V 5.1 client concurrently on the same computer with the App-V 4.6 SP3 client. - -When you run coexisting App-V clients, you can: - -- Convert an App-V 4.6 SP3 package to the App-V 5.1 format and publish both packages, when you have both clients running. - -- Define the migration policy for the converted package, which allows the converted App-V 5.1 package to assume the file type associations and shortcuts from the App-V 4.6 package. - -### Supported coexistence scenarios - -The following table shows the supported App-V coexistence scenarios. We recommend that you install the latest available updates of a given release when you are running coexisting clients. - - ---- - - - - - - - - - - - - - - - - -
    App-V 4.6 client typeApp-V 5.1 client type

    App-V 4.6 SP3

    App-V 5.1

    App-V 4.6 SP3 RDS

    App-V 5.1 RDS

    - - - -### Requirements for running coexisting clients - -To run coexisting clients, you must: - -- Install the App-V 4.6 client before you install the App-V 5.1 client. - -- Enable the **Enable Migration Mode** Group Policy setting, which is in the **App-V** > **Client Coexistence** node. To deploy the .admx template, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx). - -**Note**   -App-V 5.1 packages can run side by side with App-V 4.6 packages if you have coexisting installations of App-V 5.1 and 4.6. However, App-V 5.1 packages cannot interact with App-V 4.6 packages in the same virtual environment. - - - -### Client downloads and documentation - -The following table provides links to the App-V 4.6 client downloads and to the TechNet documentation about the releases. The downloads include the App-V “regular” and RDS clients. The TechNet documentation about the App-V client applies to both clients, unless stated otherwise. - - ---- - - - - - - - - - - - - - - - - -
    App-V versionLink to TechNet documentation

    App-V 4.6 SP3

    About Microsoft Application Virtualization 4.6 SP3

    App-V 4.6 SP3

    About Microsoft Application Virtualization 5.1

    - - - -For more information about how to configure App-V 5.1 client coexistence, see: - -- [How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md) - -- [App-V 5.0 Coexistence and Migration](https://technet.microsoft.com/windows/jj835811.aspx) - -## Converting “previous-version” packages using the package converter - - -Before migrating a package, created using App- 4.6 SP2 or earlier, to App-V 5.1, review the following requirements: - -- You must convert the package to the **.appv** file format. - -- The Package Converter supports only the direct conversion of packages that were created by using App-V 4.5 and later. To use the package converter on a package that was created using a previous version, you must use an App-V 4.5 or later version of the sequencer to upgrade the package, and then you can perform the package conversion. - -For more information about using the package converter to convert a package, see [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md). After you convert the file, you can deploy it to target computers that run the App-V 5.1 client. - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md b/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md deleted file mode 100644 index dda2baef42..0000000000 --- a/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Planning for the App-V 5.0 Sequencer and Client Deployment -description: Planning for the App-V 5.0 Sequencer and Client Deployment -author: dansimp -ms.assetid: 57a604ad-90e1-4d32-86bb-eafff59aa43a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Planning for the App-V 5.0 Sequencer and Client Deployment - - -Before you can start to use Microsoft Application Virtualization (App-V) 5.0, you must install the App-V 5.0 sequencer, the App-V 5.0 client, and optionally the App-V 5.0 shared content store. The following sections address planning for these installations. - -## Planning for App-V 5.0 sequencer deployment - - -App-V 5.0 uses a process called sequencing to create virtualized applications and application packages. Sequencing requires the use of a computer that runs the App-V 5.0 sequencer. - -**Note**   -For information about the new functionality of App-V 5.0 sequencer, see the **Changes to the sequencer** section of [What's New in App-V 5.0](whats-new-in-app-v-50.md). - - - -The computer that runs the App-V 5.0 sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -Ideally, you should install the sequencer on a computer running as a virtual machine. This enables you to more easily revert the computer running the sequencer to a “clean” state before sequencing another application. When you install the sequencer using a virtual machine, you should perform the following steps: - -1. Install all associated sequencer prerequisites. - -2. Install the sequencer. - -3. Take a “snapshot” of the environment. - -**Important**   -You should have your corporate security team review and approve the sequencing process plan. For security reasons, you should keep the sequencer operations in a lab that is separate from the production environment. The separation arrangement can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers must be able to connect to the corporate network to copy finished packages to the production servers. However, because the sequencing computers are typically operated without antivirus protection, they must not be on the corporate network unprotected. For example, you might be able to operate behind a firewall or on an isolated network segment. You might also be able to use virtual machines that are configured to share an isolated virtual network. Follow your corporate security policies to safely address these concerns. - - - -[How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md) - -## Planning for App-V 5.0 client deployment - - -To run virtualized packages on target computers, you must install the App-V 5.0 client on the target computers. The App-V 5.0 client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and specific file types to start virtualized applications. The client also helps obtain application content from the management server and caches the content before the client starts the application. There are two different client types: the client for Remote Desktop Services, which is used on Remote Desktop Session Host (RD Session Host) server systems and the App-V 5.0 client, which is used for all other computers. - -The App-V 5.0 client should be configured by using either the installer command line or by using a PowerShell script after the installation has been completed. - -The settings must be defined carefully in advance in order to expedite the deployment of the App-V 5.0 client software. This is especially important when you have computers in different offices where the clients must be configured to use different source locations. - -You must also determine how you will deploy the client software. Although it is possible to deploy the client manually on each computer, most organizations prefer to deploy the client through an automated process. A larger organization might have an operational Electronic Software Distribution (ESD) system, which is an ideal client deployment system. If no ESD system exists, you can use your organization’s standard method of installing software. Possible methods include Group Policy or various scripting techniques. Depending on the quantity and disparate locations of your client computers, this deployment process can be complex. You must use a structured approach to ensure that all computers get the client installed with the correct configuration. - -For a list of the client minimum requirements see [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) - -## Planning for App-V client coexistence - - -You can deploy the App-V 5.0 client side by side with the App-V 4.6 client. Client coexistence requires that you add or publish virtualized applications by using either a deployment configuration file or a user configuration file, because there are certain settings in these configuration files that must be configured in order for App-V 5.0 to function with App-V 4.6 clients. When a package is upgraded by using either the client or the server, the package must resubmit the configuration file. This is true for any package that has a corresponding configuration file, so it is not specific to client coexistence. However, if you do not submit the configuration file during the package upgrade, then the package state will not function as expected in coexistence scenarios. - -App-V 5.0 dynamic configuration files customize a package for a specific user. You must create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use them. To create the file it requires an advanced manual operation. - -When a dynamic user configuration file is used, none of the App-V 5.0 information for the extension in the manifest file is used. This means that the dynamic user configuration file must include everything for the extension that is specific to App-V 5.0 in the manifest file, as well as the changes that you want to make, such as, deletions and updates. For more information about how to create a custom configuration file, see [How to Create a Custom Configuration File by Using the App-V 5.0 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md). - -[How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md) - -## Planning for the App-V 5.0 Shared Content Store (SCS) - - -The App-V 5.0 shared content store mode allows the computer running the App-V 5.0 client to run virtualized applications and none of the package contents is saved on the computer running the App-V 5.0 client. Virtual applications are streamed to target computers only when requested by the client. - -The following list displays some of the benefits of using the App-V 5.0 shared content store: - -- Reduced app-to-app and multi-user application conflicts and hence a reduced need for regression testing - -- Accelerated application deployment by reduction of deployment risk - -- Simplified profile management - -[How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md) - - - - - - -## Other resources for the App-V 5.0 deployment - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md b/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md deleted file mode 100644 index cfbadbc58c..0000000000 --- a/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: Planning for the App-V 5.0 Server Deployment -description: Planning for the App-V 5.0 Server Deployment -author: dansimp -ms.assetid: fd89b324-3961-471a-ad90-c8f9ae7a8155 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for the App-V 5.0 Server Deployment - - -The Microsoft Application Virtualization (App-V) 5.0 server infrastructure consists of a set of specialized features that can be installed on one or more server computers, based on the requirements of the enterprise. - -## Planning for App-V 5.0 Server Deployment - - -The App-V 5.0 server consists of the following features: - -- Management Server – provides overall management functionality for the App-V 5.0 infrastructure. - -- Management Database – facilitates database predeployments for App-V 5.0 management. - -- Publishing Server – provides hosting and streaming functionality for virtual applications. - -- Reporting Server – provides App-V 5.0 reporting services. - -- Reporting Database – facilitates database predeployments for App-V 5.0 reporting. - -The following list displays the recommended methods for installing the App-V 5.0 server infrastructure: - -- Install the App-V 5.0 server. For more information, see [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md). - -- Install the database, reporting, and management features on separate computers. For more information, see [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md). - -- Use Electronic Software Distribution (ESD). For more information, see [How to deploy App-V 5.0 Packages Using Electronic Software Distribution](how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md). - -- Install all server features on a single computer. - -## App-V 5.0 Server Interaction - - -This section contains information about how the various App-V 5.0 server roles interact with each other. - -The App-V 5.0 Management Server contains the repository of packages and their assigned configurations. For Publishing Servers that are registered with the Management Server, the associated metadata is provided to the Publishing servers for use when publishing refresh requests are received from computers running the App-V 5.0 Client. App-V 5.0 publishing servers managed by a single management server can be serving different clients and can have different website names and port bindings. Additionally, all Publishing Servers managed by the same Management Server are replicas of each other. - -**Note**   -The Management Server does not perform any load balancing. The associated metadata is simply passed to the publishing server for use when processing client requests. - - - -## Server-Related Protocols and External Features - - -The following displays information about server-related protocols used by the App-V 5.0 servers. The table also includes the reporting mechanism for each server type. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server TypeProtocolsExternal Features NeededReporting

    IIS server

    HTTP

    -

    HTTPS

    This server-protocol combination requires a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server and a firewall to protect the server from exposure to the Internet.

    Internal

    File

    SMB

    This server-protocol combination requires support to synchronize the content between the Management Server and the Streaming Server. Use a client computer with file sharing or streaming capability.

    Internal

    - - - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v.md) - -[Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md b/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md deleted file mode 100644 index 2dc56979b0..0000000000 --- a/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Planning for the App-V 5.1 Sequencer and Client Deployment -description: Planning for the App-V 5.1 Sequencer and Client Deployment -author: dansimp -ms.assetid: d92f8773-fa7d-4926-978a-433978f91202 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/21/2016 ---- - - -# Planning for the App-V 5.1 Sequencer and Client Deployment - - -Before you can start to use Microsoft Application Virtualization (App-V) 5.1, you must install the App-V 5.1 sequencer, the App-V 5.1 client, and optionally the App-V 5.1 shared content store. The following sections address planning for these installations. - -## Planning for App-V 5.1 sequencer deployment - - -App-V 5.1 uses a process called sequencing to create virtualized applications and application packages. Sequencing requires the use of a computer that runs the App-V 5.1 sequencer. - -**Note**   -For information about the new functionality of App-V 5.1 sequencer, see the **Sequencer Improvements** section of [About App-V 5.1](about-app-v-51.md). - - - -The computer that runs the App-V 5.1 sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md). - -Ideally, you should install the sequencer on a computer running as a virtual machine. This enables you to more easily revert the computer running the sequencer to a “clean” state before sequencing another application. When you install the sequencer using a virtual machine, you should perform the following steps: - -1. Install all associated sequencer prerequisites. - -2. Install the sequencer. - -3. Take a “snapshot” of the environment. - -**Important**   -You should have your corporate security team review and approve the sequencing process plan. For security reasons, you should keep the sequencer operations in a lab that is separate from the production environment. The separation arrangement can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers must be able to connect to the corporate network to copy finished packages to the production servers. However, because the sequencing computers are typically operated without antivirus protection, they must not be on the corporate network unprotected. For example, you might be able to operate behind a firewall or on an isolated network segment. You might also be able to use virtual machines that are configured to share an isolated virtual network. Follow your corporate security policies to safely address these concerns. - - - -## Planning for App-V 5.1 client deployment - - -To run virtualized packages on target computers, you must install the App-V 5.1 client on the target computers. The App-V 5.1 client is the component that runs a virtualized application on a target computer. The client enables users to interact with icons and specific file types to start virtualized applications. The client also helps obtain application content from the management server and caches the content before the client starts the application. There are two different client types: the client for Remote Desktop Services, which is used on Remote Desktop Session Host (RD Session Host) server systems and the App-V 5.1 client, which is used for all other computers. - -The App-V 5.1 client should be configured by using either the installer command line or by using a PowerShell script after the installation has been completed. - -The settings must be defined carefully in advance in order to expedite the deployment of the App-V 5.1 client software. This is especially important when you have computers in different offices where the clients must be configured to use different source locations. - -You must also determine how you will deploy the client software. Although it is possible to deploy the client manually on each computer, most organizations prefer to deploy the client through an automated process. A larger organization might have an operational Electronic Software Distribution (ESD) system, which is an ideal client deployment system. If no ESD system exists, you can use your organization’s standard method of installing software. Possible methods include Group Policy or various scripting techniques. Depending on the quantity and disparate locations of your client computers, this deployment process can be complex. You must use a structured approach to ensure that all computers get the client installed with the correct configuration. - -For a list of the client minimum requirements see [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -## Planning for App-V client coexistence - - -You can deploy the App-V 5.1 client side by side with the App-V 4.6 client. Client coexistence requires that you add or publish virtualized applications by using either a deployment configuration file or a user configuration file, because there are certain settings in these configuration files that must be configured in order for App-V 5.1 to function with App-V 4.6 clients. When a package is upgraded by using either the client or the server, the package must resubmit the configuration file. This is true for any package that has a corresponding configuration file, so it is not specific to client coexistence. However, if you do not submit the configuration file during the package upgrade, then the package state will not function as expected in coexistence scenarios. - -App-V 5.1 dynamic configuration files customize a package for a specific user. You must create the dynamic user configuration (.xml) file or the dynamic deployment configuration file before you can use them. To create the file it requires an advanced manual operation. - -When a dynamic user configuration file is used, none of the App-V 5.1 information for the extension in the manifest file is used. This means that the dynamic user configuration file must include everything for the extension that is specific to App-V 5.1 in the manifest file, as well as the changes that you want to make, such as, deletions and updates. For more information about how to create a custom configuration file, see [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md). - -## Planning for the App-V 5.1 Shared Content Store (SCS) - - -The App-V 5.1 shared content store mode allows the computer running the App-V 5.1 client to run virtualized applications and none of the package contents is saved on the computer running the App-V 5.1 client. Virtual applications are streamed to target computers only when requested by the client. - -The following list displays some of the benefits of using the App-V 5.1 shared content store: - -- Reduced app-to-app and multi-user application conflicts and hence a reduced need for regression testing - -- Accelerated application deployment by reduction of deployment risk - -- Simplified profile management - - - - - - -## Other resources for the App-V 5.1 deployment - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - -## Related topics - - -[How to Install the Sequencer](how-to-install-the-sequencer-51beta-gb18030.md) - -[How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) - -[How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md) - -[How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md b/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md deleted file mode 100644 index cbba13e491..0000000000 --- a/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: Planning for the App-V 5.1 Server Deployment -description: Planning for the App-V 5.1 Server Deployment -author: dansimp -ms.assetid: eedd97c9-bee0-4749-9d1e-ab9528fba398 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for the App-V 5.1 Server Deployment - - -The Microsoft Application Virtualization (App-V) 5.1 server infrastructure consists of a set of specialized features that can be installed on one or more server computers, based on the requirements of the enterprise. - -## Planning for App-V 5.1 Server Deployment - - -The App-V 5.1 server consists of the following features: - -- Management Server – provides overall management functionality for the App-V 5.1 infrastructure. - -- Management Database – facilitates database predeployments for App-V 5.1 management. - -- Publishing Server – provides hosting and streaming functionality for virtual applications. - -- Reporting Server – provides App-V 5.1 reporting services. - -- Reporting Database – facilitates database predeployments for App-V 5.1 reporting. - -The following list displays the recommended methods for installing the App-V 5.1 server infrastructure: - -- Install the App-V 5.1 server. For more information, see [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md). - -- Install the database, reporting, and management features on separate computers. For more information, see [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md). - -- Use Electronic Software Distribution (ESD). For more information, see [How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md). - -- Install all server features on a single computer. - -## App-V 5.1 Server Interaction - - -This section contains information about how the various App-V 5.1 server roles interact with each other. - -The App-V 5.1 Management Server contains the repository of packages and their assigned configurations. For Publishing Servers that are registered with the Management Server, the associated metadata is provided to the Publishing servers for use when publishing refresh requests are received from computers running the App-V 5.1 Client. App-V 5.1 publishing servers managed by a single management server can be serving different clients and can have different website names and port bindings. Additionally, all Publishing Servers managed by the same Management Server are replicas of each other. - -**Note**   -The Management Server does not perform any load balancing. The associated metadata is simply passed to the publishing server for use when processing client requests. - - - -## Server-Related Protocols and External Features - - -The following displays information about server-related protocols used by the App-V 5.1 servers. The table also includes the reporting mechanism for each server type. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
    Server TypeProtocolsExternal Features NeededReporting

    IIS server

    HTTP

    -

    HTTPS

    This server-protocol combination requires a mechanism to synchronize the content between the Management Server and the Streaming Server. When using HTTP or HTTPS, use an IIS server and a firewall to protect the server from exposure to the Internet.

    Internal

    File

    SMB

    This server-protocol combination requires support to synchronize the content between the Management Server and the Streaming Server. Use a client computer with file sharing or streaming capability.

    Internal

    - - - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - -[Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md) - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office.md b/mdop/appv-v5/planning-for-using-app-v-with-office.md deleted file mode 100644 index bb0f791a10..0000000000 --- a/mdop/appv-v5/planning-for-using-app-v-with-office.md +++ /dev/null @@ -1,398 +0,0 @@ ---- -title: Planning for Using App-V with Office -description: Planning for Using App-V with Office -author: dansimp -ms.assetid: c4371869-4bfc-4d13-9198-ef19f99fc192 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for Using App-V with Office - - -Use the following information to plan how to deploy Office by using App-V. This article includes: - -- [App-V support for Language Packs](#bkmk-lang-pack) - -- [Supported versions of Microsoft Office](#bkmk-office-vers-supp-appv) - -- [Planning for using App-V with coexisting versions of Office](#bkmk-plan-coexisting) - -- [How Office integrates with Windows when you deploy use App-V to deploy Office](#bkmk-office-integration-win) - -## App-V support for Language Packs - - -You can use the App-V 5.0 Sequencer to create plug-in packages for Language Packs, Language Interface Packs, Proofing Tools and ScreenTip Languages. You can then include the plug-in packages in a Connection Group, along with the Office 2013 package that you create by using the Office Deployment Toolkit. The Office applications and the plug-in Language Packs interact seamlessly in the same connection group, just like any other packages that are grouped together in a connection group. - -**Note**   -Microsoft Visio and Microsoft Project do not provide support for the Thai Language Pack. - - - -## Supported versions of Microsoft Office - - -The following table lists the versions of Microsoft Office that App-V supports, methods of Office package creation, supported licensing, and supported deployments. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported Office VersionSupported App-V VersionsPackage CreationSupported LicensingSupported Deployments

    Microsoft 365 Apps for enterprise

    -

    Also supported:

    -
      -
    • Visio Pro for Office 365

    • -
    • Project Pro for Office 365

    • -
      -
    • App-V 5.0

    • -
    • App-V 5.0 SP1

    • -
    • App-V 5.0 SP2

    • -

    Office Deployment Tool

    Subscription

      -
    • Desktop

    • -
    • Personal VDI

    • -
    • Pooled VDI

    • -
    • RDS

    • -

    Office Professional Plus 2013

    -

    Also supported:

    -
      -
    • Visio Professional 2013

    • -
    • Project Professional 2013

    • -
      -
    • App-V 5.0

    • -
    • App-V 5.0 SP1

    • -
    • App-V 5.0 SP2

    • -

    Office Deployment Tool

    Volume Licensing

      -
    • Desktop

    • -
    • Personal VDI

    • -
    • Pooled VDI

    • -
    • RDS

    • -
    - - - -## Planning for using App-V with coexisting versions of Office - - -You can install more than one version of Microsoft Office side by side on the same computer by using “Microsoft Office coexistence.” You can implement Office coexistence with combinations of all major versions of Office and with installation methods, as applicable, by using the Windows Installer-based (MSi) version of Office, Click-to-Run, and App-V 5.0 SP2. However, using Office coexistence is not recommended by Microsoft. - -Microsoft’s recommended best practice is to avoid Office coexistence completely to prevent compatibility issues. However, when you are migrating to a newer version of Office, issues occasionally arise that can’t be resolved immediately, so you can temporarily implement coexistence to help facilitate a faster migration to the latest product version. Using Office coexistence on a long-term basis is never recommended, and your organization should have a plan to fully transition in the immediate future. - -### Before you implement Office coexistence - -Before implementing Office coexistence, review the following Office documentation. Choose the article that corresponds to the newest version of Office for which you plan to implement coexistence. - - ---- - - - - - - - - - - - - - - - - -
    Office versionLink to guidance

    Office 2013

    Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office

    Office 2010

    Information about how to use Office 2010 suites and programs on a computer that is running another version of Office

    - - - -The Office documentation provides extensive guidance on coexistence for Windows Installer-based (MSi) and Click-to-Run installations of Office. This App-V topic on coexistence supplements the Office guidance with information that is more specific to App-V deployments. - -### Supported Office coexistence scenarios - -The following tables summarize the supported coexistence scenarios. They are organized according to the version and deployment method you’re starting with and the version and deployment method you are migrating to. Be sure to fully test all coexistence solutions before deploying them to a production audience. - -**Note**   -Microsoft does not support the use of multiple versions of Office in Windows Server environments that have the Remote Desktop Session Host role service enabled. To run Office coexistence scenarios, you must disable this role service. - - - -### Windows integrations & Office coexistence - -The Windows Installer-based and Click-to-Run Office installation methods integrate with certain points of the underlying Windows operating system. When you use coexistence, common operating system integrations between two Office versions can conflict, causing compatibility and user experience issues. With App-V, you can sequence certain versions of Office to exclude integrations, thereby “isolating” them from the operating system. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Mode in which App-V can sequence this version of Office

    Office 2007

    Always non-integrated. App-V does not offer any operating system integrations with a virtualized version of Office 2007.

    Office 2010

    Integrated and non-integrated mode.

    Office 2013

    Always integrated. Windows operating system integrations cannot be disabled.

    - - - -Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069). - -### Known limitations of Office coexistence scenarios - -The following sections describe some issues that you might encounter when using App-V to implement coexistence with Office. - -### Limitations common to Windows Installer-based/Click-to-Run and App-V Office coexistence scenarios - -The following limitations can occur when you install the following versions of Office on the same computer: - -- Office 2010 by using the Windows Installer-based version - -- Office 2013 by using App-V - -After you publish Office 2013 by using App-V side by side with an earlier version of the Windows Installer-based Office 2010 might also cause the Windows Installer to start. This is because the Windows Installer-based or Click-to-Run version of Office 2010 is trying to automatically register itself to the computer. - -To bypass the auto-registration operation for native Word 2010, follow these steps: - -1. Exit Word 2010. - -2. Start the Registry Editor by doing the following: - - - In Windows 7: Click **Start**, type **regedit** in the Start Search box, and then press Enter. - - - In Windows 8, type **regedit** press Enter on the Start page and then press Enter. - - If you are prompted for an administrator password or for a confirmation, type the password, or click **Continue**. - -3. Locate and then select the following registry subkey: - - ``` syntax - HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options - ``` - -4. On the **Edit** menu, click **New**, and then click **DWORD Value**. - -5. Type **NoReReg**, and then press Enter. - -6. Right-click **NoReReg** and then click **Modify**. - -7. In the **Valuedata** box, type **1**, and then click **OK**. - -8. On the File menu, click **Exit** to close Registry Editor. - -## How Office integrates with Windows when you use App-V to deploy Office - - -When you deploy Office 2013 by using App-V, Office is fully integrated with the operating system, which provides end users with the same features and functionality as Office has when it is deployed without App-V. - -The Office 2013 App-V package supports the following integration points with the Windows operating system: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Extension PointDescription

    Lync meeting Join Plug-in for Firefox and Chrome

    User can join Lync meetings from Firefox and Chrome

    Sent to OneNote Print Driver

    User can print to OneNote

    OneNote Linked Notes

    OneNote Linked Notes

    Send to OneNote Internet Explorer Add-In

    User can send to OneNote from IE

    Firewall Exception for Lync and Outlook

    Firewall Exception for Lync and Outlook

    MAPI Client

    Native apps and add-ins can interact with virtual Outlook through MAPI

    SharePoint Plug-in for Firefox

    User can use SharePoint features in Firefox

    Mail Control Panel Applet

    User gets the mail control panel applet in Outlook

    Primary Interop Assemblies

    Support managed add-ins

    Office Document Cache Handler

    Allows Document Cache for Office applications

    Outlook Protocol Search handler

    User can search in outlook

    Active X Controls:

    For more information on ActiveX controls, refer to ActiveX Control API Reference.

       Groove.SiteClient

    Active X Control

       PortalConnect.PersonalSite

    Active X Control

       SharePoint.openDocuments

    Active X Control

       SharePoint.ExportDatabase

    Active X Control

       SharePoint.SpreadSheetLauncher

    Active X Control

       SharePoint.StssyncHander

    Active X Control

       SharePoint.DragUploadCtl

    Active X Control

       SharePoint.DragDownloadCtl

    Active X Control

       Sharepoint.OpenXMLDocuments

    Active X Control

       Sharepoint.ClipboardCtl

    Active X control

       WinProj.Activator

    Active X Control

       Name.NameCtrl

    Active X Control

       STSUPld.CopyCtl

    Active X Control

       CommunicatorMeetingJoinAx.JoinManager

    Active X Control

       LISTNET.Listnet

    Active X Control

       OneDrive Pro Browser Helper

    Active X Control]

    OneDrive Pro Icon Overlays

    Windows Explorer shell icon overlays when users look at folders OneDrive Pro folders

    Shell extensions

    Shortcuts

    Windows Search

    - - - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office51.md b/mdop/appv-v5/planning-for-using-app-v-with-office51.md deleted file mode 100644 index 76e791e8a6..0000000000 --- a/mdop/appv-v5/planning-for-using-app-v-with-office51.md +++ /dev/null @@ -1,335 +0,0 @@ ---- -title: Planning for Using App-V with Office -description: Planning for Using App-V with Office -author: dansimp -ms.assetid: e7a19b43-1746-469f-bad6-8e75cf4b3f67 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 03/16/2017 ---- - - -# Planning for Using App-V with Office - - -Use the following information to plan how to deploy Office by using Microsoft Application Virtualization (App-V) 5.1. This article includes: - -- [App-V support for Language Packs](#bkmk-lang-pack) - -- [Supported versions of Microsoft Office](#bkmk-office-vers-supp-appv) - -- [Planning for using App-V with coexisting versions of Office](#bkmk-plan-coexisting) - -- [How Office integrates with Windows when you deploy use App-V to deploy Office](#bkmk-office-integration-win) - -## App-V support for Language Packs - - -You can use the App-V 5.1 Sequencer to create plug-in packages for Language Packs, Language Interface Packs, Proofing Tools and ScreenTip Languages. You can then include the plug-in packages in a Connection Group, along with the Office 2013 package that you create by using the Office Deployment Toolkit. The Office applications and the plug-in Language Packs interact seamlessly in the same connection group, just like any other packages that are grouped together in a connection group. - ->**Note**   -Microsoft Visio and Microsoft Project do not provide support for the Thai Language Pack. - - - -## Supported versions of Microsoft Office - -See [Microsoft Office Product IDs that App-V supports](https://support.microsoft.com/help/2842297/product-ids-that-are-supported-by-the-office-deployment-tool-for-click) for a list of supported Office products. ->**Note**  You must use the Office Deployment Tool to create App-V packages for Microsoft 365 Apps for enterprise. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. You cannot use the App-V Sequencer. - - - -## Planning for using App-V with coexisting versions of Office - - -You can install more than one version of Microsoft Office side by side on the same computer by using “Microsoft Office coexistence.” You can implement Office coexistence with combinations of all major versions of Office and with installation methods, as applicable, by using the Windows Installer-based (MSi) version of Office, Click-to-Run, and App-V 5.1. However, using Office coexistence is not recommended by Microsoft. - -Microsoft’s recommended best practice is to avoid Office coexistence completely to prevent compatibility issues. However, when you are migrating to a newer version of Office, issues occasionally arise that can’t be resolved immediately, so you can temporarily implement coexistence to help facilitate a faster migration to the latest product version. Using Office coexistence on a long-term basis is never recommended, and your organization should have a plan to fully transition in the immediate future. - -### Before you implement Office coexistence - -Before implementing Office coexistence, review the following Office documentation. Choose the article that corresponds to the newest version of Office for which you plan to implement coexistence. - - ---- - - - - - - - - - - - - - - - - -
    Office versionLink to guidance

    Office 2013

    Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office

    Office 2010

    Information about how to use Office 2010 suites and programs on a computer that is running another version of Office

    - - - -The Office documentation provides extensive guidance on coexistence for Windows Installer-based (MSi) and Click-to-Run installations of Office. This App-V topic on coexistence supplements the Office guidance with information that is more specific to App-V deployments. - -### Supported Office coexistence scenarios - -The following tables summarize the supported coexistence scenarios. They are organized according to the version and deployment method you’re starting with and the version and deployment method you are migrating to. Be sure to fully test all coexistence solutions before deploying them to a production audience. - ->**Note**   -Microsoft does not support the use of multiple versions of Office in Windows Server environments that have the Remote Desktop Session Host role service enabled. To run Office coexistence scenarios, you must disable this role service. - - - -### Windows integrations & Office coexistence - -The Windows Installer-based and Click-to-Run Office installation methods integrate with certain points of the underlying Windows operating system. When you use coexistence, common operating system integrations between two Office versions can conflict, causing compatibility and user experience issues. With App-V, you can sequence certain versions of Office to exclude integrations, thereby “isolating” them from the operating system. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Mode in which App-V can sequence this version of Office

    Office 2007

    Always non-integrated. App-V does not offer any operating system integrations with a virtualized version of Office 2007.

    Office 2010

    Integrated and non-integrated mode.

    Office 2013

    Always integrated. Windows operating system integrations cannot be disabled.

    - - - -Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069). - -### Known limitations of Office coexistence scenarios - -The following sections describe some issues that you might encounter when using App-V to implement coexistence with Office. - -### Limitations common to Windows Installer-based/Click-to-Run and App-V Office coexistence scenarios - -The following limitations can occur when you install the following versions of Office on the same computer: - -- Office 2010 by using the Windows Installer-based version - -- Office 2013 by using App-V - -After you publish Office 2013 by using App-V side by side with an earlier version of the Windows Installer-based Office 2010 might also cause the Windows Installer to start. This is because the Windows Installer-based or Click-to-Run version of Office 2010 is trying to automatically register itself to the computer. - -To bypass the auto-registration operation for native Word 2010, follow these steps: - -1. Exit Word 2010. - -2. Start the Registry Editor by doing the following: - - - In Windows 7: Click **Start**, type **regedit** in the Start Search box, and then press Enter. - - - In Windows 8.1 or Windows 10, type **regedit** press Enter on the Start page and then press Enter. - - If you are prompted for an administrator password or for a confirmation, type the password, or click **Continue**. - -3. Locate and then select the following registry subkey: - - ``` syntax - HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options - ``` - -4. On the **Edit** menu, click **New**, and then click **DWORD Value**. - -5. Type **NoReReg**, and then press Enter. - -6. Right-click **NoReReg** and then click **Modify**. - -7. In the **Valuedata** box, type **1**, and then click **OK**. - -8. On the File menu, click **Exit** to close Registry Editor. - -## How Office integrates with Windows when you use App-V to deploy Office - - -When you deploy Office 2013 by using App-V, Office is fully integrated with the operating system, which provides end users with the same features and functionality as Office has when it is deployed without App-V. - -The Office 2013 App-V package supports the following integration points with the Windows operating system: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Extension PointDescription

    Lync meeting Join Plug-in for Firefox and Chrome

    User can join Lync meetings from Firefox and Chrome

    Sent to OneNote Print Driver

    User can print to OneNote

    OneNote Linked Notes

    OneNote Linked Notes

    Send to OneNote Internet Explorer Add-In

    User can send to OneNote from IE

    Firewall Exception for Lync and Outlook

    Firewall Exception for Lync and Outlook

    MAPI Client

    Native apps and add-ins can interact with virtual Outlook through MAPI

    SharePoint Plug-in for Firefox

    User can use SharePoint features in Firefox

    Mail Control Panel Applet

    User gets the mail control panel applet in Outlook

    Primary Interop Assemblies

    Support managed add-ins

    Office Document Cache Handler

    Allows Document Cache for Office applications

    Outlook Protocol Search handler

    User can search in outlook

    Active X Controls:

    For more information on ActiveX controls, refer to ActiveX Control API Reference.

       Groove.SiteClient

    Active X Control

       PortalConnect.PersonalSite

    Active X Control

       SharePoint.openDocuments

    Active X Control

       SharePoint.ExportDatabase

    Active X Control

       SharePoint.SpreadSheetLauncher

    Active X Control

       SharePoint.StssyncHander

    Active X Control

       SharePoint.DragUploadCtl

    Active X Control

       SharePoint.DragDownloadCtl

    Active X Control

       Sharepoint.OpenXMLDocuments

    Active X Control

       Sharepoint.ClipboardCtl

    Active X control

       WinProj.Activator

    Active X Control

       Name.NameCtrl

    Active X Control

       STSUPld.CopyCtl

    Active X Control

       CommunicatorMeetingJoinAx.JoinManager

    Active X Control

       LISTNET.Listnet

    Active X Control

       OneDrive Pro Browser Helper

    Active X Control]

    OneDrive Pro Icon Overlays

    Windows Explorer shell icon overlays when users look at folders OneDrive Pro folders

    Shell extensions

    Shortcuts

    Windows Search

    - - - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md b/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md deleted file mode 100644 index 0cc8198165..0000000000 --- a/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Planning to Deploy App-V 5.0 with an Electronic Software Distribution System -description: Planning to Deploy App-V 5.0 with an Electronic Software Distribution System -author: dansimp -ms.assetid: 8cd3f1fb-b84e-4260-9e72-a14d01e7cadf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Deploy App-V 5.0 with an Electronic Software Distribution System - - -If you are using an electronic software distribution system to deploy App-V packages, review the following planning considerations. For information about using System Center Configuration Manager to deploy App-V, see [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816). - -Review the following component and architecture requirements options that apply when you use an ESD to deploy App-V packages: - - ---- - - - - - - - - - - - - - - - - -
    Deployment requirement or optionDescription

    The App-V Management server, Management database, and Publishing server are not required.

    These functions are handled by the implemented ESD solution.

    You can deploy the App-V Reporting server and Reporting database side by side with the ESD.

    The side-by-side deployment lets you to collect data and generate reports.

    -

    If you enable the App-V client to send report information, and you are not using the App-V Reporting server, the reporting data is stored in associated .xml files.

    - -  - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md b/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md deleted file mode 100644 index 6033a54f5b..0000000000 --- a/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Planning to Deploy App-V 5.1 with an Electronic Software Distribution System -description: Planning to Deploy App-V 5.1 with an Electronic Software Distribution System -author: dansimp -ms.assetid: c26602c2-5e8d-44e6-90df-adacc593607e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Deploy App-V 5.1 with an Electronic Software Distribution System - - -If you are using an electronic software distribution system to deploy App-V packages, review the following planning considerations. For information about using System Center Configuration Manager to deploy App-V, see [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816). - -Review the following component and architecture requirements options that apply when you use an ESD to deploy App-V packages: - - ---- - - - - - - - - - - - - - - - - -
    Deployment requirement or optionDescription

    The App-V Management server, Management database, and Publishing server are not required.

    These functions are handled by the implemented ESD solution.

    You can deploy the App-V Reporting server and Reporting database side by side with the ESD.

    The side-by-side deployment lets you to collect data and generate reports.

    -

    If you enable the App-V client to send report information, and you are not using the App-V Reporting server, the reporting data is stored in associated .xml files.

    - -  - - - - - - -## Related topics - - -[Planning to Deploy App-V](planning-to-deploy-app-v51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-to-deploy-app-v.md b/mdop/appv-v5/planning-to-deploy-app-v.md deleted file mode 100644 index c12ddb523d..0000000000 --- a/mdop/appv-v5/planning-to-deploy-app-v.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Planning to Deploy App-V -description: Planning to Deploy App-V -author: dansimp -ms.assetid: 28d3035c-3805-4339-90fc-6c3fd3b1123e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy App-V - - -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for Microsoft Application Virtualization (App-V) 5.0. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## App-V 5.0 supported configurations - - -Describes the minimum hardware and operating system requirements for each App-V components. For information about software prerequisites that you must install before you install App-V, see [App-V 5.0 Prerequisites](app-v-50-prerequisites.md). - -[App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) - -## App-V 5.0 capacity planning - - -Describes the available options for scaling your App-V 5.0 deployment. - -[App-V 5.0 Capacity Planning](app-v-50-capacity-planning.md) - -## Planning for high availability with App-V 5.0 - - -Describes the available options for ensuring high availability of App-V 5.0 databases and services. - -[Planning for High Availability with App-V 5.0](planning-for-high-availability-with-app-v-50.md) - -## Planning to Deploy App-V 5.0 with an Electronic Software Distribution System - - -Describes the options and requirements for deploying App-V with an electronic software distribution system. - -[Planning to Deploy App-V 5.0 with an Electronic Software Distribution System](planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md) - -## Planning for the App-V 5.0 Server deployment - - -Describes the planning considerations for the App-V Server components and their functions. - -[Planning for the App-V 5.0 Server Deployment](planning-for-the-app-v-50-server-deployment.md) - -## Planning for the App-V 5.0 Sequencer and Client deployment - - -Describes the planning considerations for the App-V Client and for the Sequencer software, which you use to create virtual applications and application packages. - -[Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) - -## Planning for migrating from a previous version of App-V - - -Describes the recommended path for migrating from previous versions of App-V, while ensuring that existing server configurations, packages and clients continue to work in your new App-V environment. - -[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md) - -## Planning for using App-V with Office - - -Describes the requirements for using App-V with Office and explains the supported scenarios, including information about coexisting versions of Office. - -[Planning for Using App-V with Office](planning-for-using-app-v-with-office.md) - -## Planning to use folder redirection with App-V - - -Explains how folder redirection works with App-V. - -[Planning to Use Folder Redirection with App-V](planning-to-use-folder-redirection-with-app-v.md) - -## Other Resources for App-V 5.0 Planning - - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md)[Performance Guidance for Application Virtualization 5.0](performance-guidance-for-application-virtualization-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-to-deploy-app-v51.md b/mdop/appv-v5/planning-to-deploy-app-v51.md deleted file mode 100644 index dc0bca0071..0000000000 --- a/mdop/appv-v5/planning-to-deploy-app-v51.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Planning to Deploy App-V -description: Planning to Deploy App-V -author: dansimp -ms.assetid: 39cbf981-d9c6-457f-b047-f9046e1a6442 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy App-V - - -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for Microsoft Application Virtualization (App-V) 5.1. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## App-V 5.1 supported configurations - - -Describes the minimum hardware and operating system requirements for each App-V components. For information about software prerequisites that you must install before you install App-V, see [App-V 5.1 Prerequisites](app-v-51-prerequisites.md). - -[App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md) - -## App-V 5.1 capacity planning - - -Describes the available options for scaling your App-V 5.1 deployment. - -[App-V 5.1 Capacity Planning](app-v-51-capacity-planning.md) - -## Planning for high availability with App-V 5.1 - - -Describes the available options for ensuring high availability of App-V 5.1 databases and services. - -[Planning for High Availability with App-V 5.1](planning-for-high-availability-with-app-v-51.md) - -## Planning to Deploy App-V 5.1 with an Electronic Software Distribution System - - -Describes the options and requirements for deploying App-V with an electronic software distribution system. - -[Planning to Deploy App-V 5.1 with an Electronic Software Distribution System](planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md) - -## Planning for the App-V 5.1 Server deployment - - -Describes the planning considerations for the App-V Server components and their functions. - -[Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md) - -## Planning for the App-V 5.1 Sequencer and Client deployment - - -Describes the planning considerations for the App-V Client and for the Sequencer software, which you use to create virtual applications and application packages. - -[Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md) - -## Planning for migrating from a previous version of App-V - - -Describes the recommended path for migrating from previous versions of App-V, while ensuring that existing server configurations, packages and clients continue to work in your new App-V environment. - -[Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md) - -## Planning for using App-V with Office - - -Describes the requirements for using App-V with Office and explains the supported scenarios, including information about coexisting versions of Office. - -[Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md) - -## Planning to use folder redirection with App-V - - -Explains how folder redirection works with App-V. - -[Planning to Use Folder Redirection with App-V](planning-to-use-folder-redirection-with-app-v51.md) - -## Other Resources for App-V 5.1 Planning - - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Performance Guidance for Application Virtualization 5.1](performance-guidance-for-application-virtualization-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md deleted file mode 100644 index 5d2759961a..0000000000 --- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md +++ /dev/null @@ -1,193 +0,0 @@ ---- -title: Planning to Use Folder Redirection with App-V -description: Planning to Use Folder Redirection with App-V -author: dansimp -ms.assetid: 2a4deeed-fdc0-465c-b88a-3a2fbbf27436 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Use Folder Redirection with App-V - - -App-V 5.0 SP2 supports the use of folder redirection, a feature that enables users and administrators to redirect the path of a folder to a new location. - -This topic contains the following sections: - -- [Requirements for using folder redirection](#bkmk-folder-redir-reqs) - -- [How to configure folder redirection for use with App-V](#bkmk-folder-redir-cfg) - -- [How folder redirection works with App-V](#bkmk-folder-redir-works) - -- [Overview of folder redirection](#bkmk-folder-redir-overview) - -## Requirements and unsupported scenarios for using folder redirection - - - ---- - - - - - - - - - - -

    Requirements

    To use %AppData% folder redirection, you must:

    -
      -
    • Have an App-V package that has an AppData virtual file system (VFS) folder.

    • -
    • Enable folder redirection and redirect users’ folders to a shared folder, typically a network folder.

    • -
    • Roam both or neither of the following:

      -
    • -
    • Ensure that the following folders are available to each user who logs into the computer that is running the App-V 5.0 SP2 or later client:

      -
        -
      • %AppData% is configured to the desired network location (with or without Offline Files support).

      • -
      • %LocalAppData% is configured to the desired local folder.

      • -
    • -

    Unsupported scenarios

      -
    • Configuring %LocalAppData% as a network drive.

    • -
    • Redirecting the Start menu to a single folder for multiple users.

    • -
    • If roaming AppData (%AppData%) is redirected to a network share that is not available, App-V applications will fail to launch as follows:

      - ---- - - - - - - - - - - - - - - - - -
      App-V versionScenario description

      In App-V 5.0 through App-V 5.0 SP2 plus hotfixes

      This failure will occur regardless of whether Offline Files is enabled.

      In App-V 5.0 SP3

      If the unavailable network share has been enabled for Offline Files, the App-V application will start successfully.

      -

    • -
    - - - -## How to configure folder redirection for use with App-V - - -Folder redirection can be applied to different folders, such as Desktop, My Documents, My Pictures, etc. However, the only folder that impacts the use of App-V applications is the user’s roaming AppData folder (%AppData%). You can apply folder redirection to any other supported folders without impacting App-V. - -## How folder redirection works with App-V - - -The following table describes how folder redirection works when %AppData% is redirected to a network and when you have met the requirements listed earlier in this article. - - ---- - - - - - - - - - - - - - - - - -
    Virtual environment stateAction that occurs

    When the virtual environment starts

    The virtual file system (VFS) AppData folder is mapped to the local AppData folder (%LocalAppData%) instead of to the user’s roaming AppData folder (%AppData%).

    -
      -
    • LocalAppData contains a local cache of the user’s roaming AppData folder for the package in use. The local cache is located under:

      -

      %LocalAppData%\Microsoft\AppV\Client\VFS\PackageGUID\AppData

    • -
    • The latest data from the user’s roaming AppData folder is copied to and replaces the data currently in the local cache.

    • -
    • While the virtual environment is running, data continues to be saved to the local cache. Data is served only out of %LocalAppData% and is not moved or synchronized with %AppData% until the end user shuts down the computer.

    • -
    • Entries to the AppData folder are made using the user context, not the system context.

    • -
    -
    -Note

    The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See Release Notes for App-V 5.0 SP2.

    -
    -
    - -

    When the virtual environment shuts down

    The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under:

    -

    HKCU\Software\Microsoft\AppV\Client\Packages&lt;PACKAGE_GUID>\AppDataTime

    -

    To provide redundancy, App-V 5.0 keeps the three most recent copies of the compressed data under %AppData%.

    - - - -## Overview of folder redirection - - - ---- - - - - - - - - - - - - - - - - - - -

    Purpose

    Enables end users to work with files, which have been redirected to another folder, as if the files still existed on the local drive.

    Description

    Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network.

    -
      -
    • Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network.

    • -
    • The new location can be a folder on the local computer or a folder on a shared network.

    • -
    • Folder redirection updates the files immediately, whereas roaming data is typically synchronized when the user logs in or logs off.

    • -

    Usage example

    You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network.

    More resources

    Folder redirection overview

    - - - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md deleted file mode 100644 index adf150f3e1..0000000000 --- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md +++ /dev/null @@ -1,193 +0,0 @@ ---- -title: Planning to Use Folder Redirection with App-V -description: Planning to Use Folder Redirection with App-V -author: dansimp -ms.assetid: 6bea9a8f-a915-4d7d-be67-ef1cca1398ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Use Folder Redirection with App-V - - -Microsoft Application Virtualization (App-V) 5.1 supports the use of folder redirection, a feature that enables users and administrators to redirect the path of a folder to a new location. - -This topic contains the following sections: - -- [Requirements for using folder redirection](#bkmk-folder-redir-reqs) - -- [How to configure folder redirection for use with App-V](#bkmk-folder-redir-cfg) - -- [How folder redirection works with App-V](#bkmk-folder-redir-works) - -- [Overview of folder redirection](#bkmk-folder-redir-overview) - -## Requirements and unsupported scenarios for using folder redirection - - - ---- - - - - - - - - - - -

    Requirements

    To use %AppData% folder redirection, you must:

    -
      -
    • Have an App-V package that has an AppData virtual file system (VFS) folder.

    • -
    • Enable folder redirection and redirect users’ folders to a shared folder, typically a network folder.

    • -
    • Roam both or neither of the following:

      -
    • -
    • Ensure that the following folders are available to each user who logs into the computer that is running the App-V 5.0 SP2 or later client:

      -
        -
      • %AppData% is configured to the desired network location (with or without Offline Files support).

      • -
      • %LocalAppData% is configured to the desired local folder.

      • -
    • -

    Unsupported scenarios

      -
    • Configuring %LocalAppData% as a network drive.

    • -
    • Redirecting the Start menu to a single folder for multiple users.

    • -
    • If roaming AppData (%AppData%) is redirected to a network share that is not available, App-V applications will fail to launch as follows:

      - ---- - - - - - - - - - - - - - - - - -
      App-V versionScenario description

      In App-V 5.0 through App-V 5.0 SP2 plus hotfixes

      This failure will occur regardless of whether Offline Files is enabled.

      In App-V 5.0 SP3 and later

      If the unavailable network share has been enabled for Offline Files, the App-V application will start successfully.

      -

    • -
    - - - -## How to configure folder redirection for use with App-V - - -Folder redirection can be applied to different folders, such as Desktop, My Documents, My Pictures, etc. However, the only folder that impacts the use of App-V applications is the user’s roaming AppData folder (%AppData%). You can apply folder redirection to any other supported folders without impacting App-V. - -## How folder redirection works with App-V - - -The following table describes how folder redirection works when %AppData% is redirected to a network and when you have met the requirements listed earlier in this article. - - ---- - - - - - - - - - - - - - - - - -
    Virtual environment stateAction that occurs

    When the virtual environment starts

    The virtual file system (VFS) AppData folder is mapped to the local AppData folder (%LocalAppData%) instead of to the user’s roaming AppData folder (%AppData%).

    -
      -
    • LocalAppData contains a local cache of the user’s roaming AppData folder for the package in use. The local cache is located under:

      -

      %LocalAppData%\Microsoft\AppV\Client\VFS\PackageGUID\AppData

    • -
    • The latest data from the user’s roaming AppData folder is copied to and replaces the data currently in the local cache.

    • -
    • While the virtual environment is running, data continues to be saved to the local cache. Data is served only out of %LocalAppData% and is not moved or synchronized with %AppData% until the end user shuts down the computer.

    • -
    • Entries to the AppData folder are made using the user context, not the system context.

    • -
    -
    -Note

    The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See Release Notes for App-V 5.0 SP2.

    -
    -
    - -

    When the virtual environment shuts down

    The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under:

    -

    HKCU\Software\Microsoft\AppV\Client\Packages&lt;PACKAGE_GUID>\AppDataTime

    -

    To provide redundancy, App-V keeps the three most recent copies of the compressed data under %AppData%.

    - - - -## Overview of folder redirection - - - ---- - - - - - - - - - - - - - - - - - - -

    Purpose

    Enables end users to work with files, which have been redirected to another folder, as if the files still existed on the local drive.

    Description

    Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network.

    -
      -
    • Folder redirection allows users and administrators to redirect the path of a folder to a network location. The documents in the folder are available to the user from any computer on the network.

    • -
    • The new location can be a folder on the local computer or a folder on a shared network.

    • -
    • Folder redirection updates the files immediately, whereas roaming data is typically synchronized when the user logs in or logs off.

    • -

    Usage example

    You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network.

    More resources

    Folder redirection overview

    - - - - - - - - - - - - - - - - diff --git a/mdop/appv-v5/preparing-your-environment-for-app-v-50.md b/mdop/appv-v5/preparing-your-environment-for-app-v-50.md deleted file mode 100644 index aa0bb21af5..0000000000 --- a/mdop/appv-v5/preparing-your-environment-for-app-v-50.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Preparing Your Environment for App-V 5.0 -description: Preparing Your Environment for App-V 5.0 -author: dansimp -ms.assetid: 119d990e-a6c6-47b7-a7b0-52f88205e5ec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing Your Environment for App-V 5.0 - - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements.” - -## App-V 5.0 prerequisites - - -- [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) - - Lists the prerequisite software that you must install before installing App-V 5.0. - -## App-V 5.0 SP3 prerequisites - - -- [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md) - - Lists the prerequisite software that you must install before installing App-V 5.0 SP3. - -## App-V 5.0 security considerations - - -- [App-V 5.0 Security Considerations](app-v-50-security-considerations.md) - - Describes accounts, groups, log files, and other considerations for securing your App-V environment. - - - - - - -## Other resources for App-V 5.0 Planning - - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/preparing-your-environment-for-app-v-51.md b/mdop/appv-v5/preparing-your-environment-for-app-v-51.md deleted file mode 100644 index 05f376d410..0000000000 --- a/mdop/appv-v5/preparing-your-environment-for-app-v-51.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Preparing Your Environment for App-V 5.1 -description: Preparing Your Environment for App-V 5.1 -author: dansimp -ms.assetid: 64b2e1ac-1561-4c99-9815-b4688a0ff48a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing Your Environment for App-V 5.1 - - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan for Microsoft Application Virtualization (App-V) 5.1. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## App-V 5.1 prerequisites - - -- [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) - - Lists the prerequisite software that you must install before installing App-V 5.1. - -## App-V 5.1 security considerations - - -- [App-V 5.1 Security Considerations](app-v-51-security-considerations.md) - - Describes accounts, groups, log files, and other considerations for securing your App-V environment. - - - - - - -## Other resources for App-V 5.1 Planning - - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp1.md b/mdop/appv-v5/release-notes-for-app-v-50-sp1.md deleted file mode 100644 index a24b405c96..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp1.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Release Notes for App-V 5.0 SP1 -description: Release Notes for App-V 5.0 SP1 -author: dansimp -ms.assetid: 21a859cd-41b4-4cc4-9c9c-7ba236084bb0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for App-V 5.0 SP1 - - -**To search for a specific issue in these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install App-V 5.0 SP1. - -These release notes contain information that is required to successfully install App-V 5.0 SP1. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other App-V 5.0 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For information about App-V 5.0 documentation, see the App-V 5.0 home page on Microsoft TechNet. - -## Provide Feedback - - -We are interested in your feedback on App-V 5.0. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with App-V 5.0 SP1 - - -There are no App-V 5.0 SP1 release notes at this time.  This topic will be updated if issues are reported in future. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - - - - - - -## Related topics - - -[About App-V 5.0](about-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp2.md b/mdop/appv-v5/release-notes-for-app-v-50-sp2.md deleted file mode 100644 index 8a8faa9757..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp2.md +++ /dev/null @@ -1,170 +0,0 @@ ---- -title: Release Notes for App-V 5.0 SP2 -description: Release Notes for App-V 5.0 SP2 -author: dansimp -ms.assetid: fe73139d-240c-4ed5-8e59-6ae76ee8e80c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for App-V 5.0 SP2 - - -**To search for a specific issue in these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install App-V 5.0 SP2. - -These release notes contain information that is required to successfully install App-V 5.0 SP2. The release notes also contain information that is not available in the product documentation. If there are differences between these release notes and other App-V 5.0 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For information about App-V 5.0 documentation, see the App-V 5.0 home page on Microsoft TechNet. - -## Provide Feedback - - -We are interested in your feedback on App-V 5.0. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with Hotfix Package 4 for Application Virtualization 5.0 SP2 - - -### Packages stop working after you uninstall Hotfix Package 4 for Application Virtualization 5.0 SP2 - -Packages published when Hotfix Package 4 for Application Virtualization 5.0 SP2 is applied stop working when Hotfix Package 4 for Application Virtualization 5.0 SP2 is removed. - -WORKAROUND: - -If the following folder exists, then you must delete it: - -**%localappdata%** \\ **Microsoft** \\ **AppV** \\ **Client** \\ **VFS** \\ **<package ID>** for each package that was published. - -**Note**   -You must have elevated privileges to delete this folder. - - - -To use a script, for each user account on the computer and for each package id that was published after installing Hotfix Package 4 for Application Virtualization 5.0 SP2: - -`Rd /s /q “%systemdrive%\users\[UserName]\AppData\Local\Microsoft\AppV\Client\VFS\[Package ID]` - -- The shortcuts will remain with the user sessions even after deleting the folder from the directory in the previous section, so you can click on the shortcut to run the application again. There is no need to re-publish the application. - -- This issue happens for both user published packaged and globally published packages for example, Microsoft Office 2013. The folder must be deleted for both types of packages. - -- You do not need to delete the VFS folder in the Roaming app data (**%appdata%**). Only the **%localappdata%** must be deleted. - -### Microsoft Office integration points to wrong file system location - -Microsoft Office integration points to wrong file system location (Groove.exe error message). - -WORKAROUND: - -Use one of the following methods: - -1. Delete the shortcut in the start-up folder after upgrade. - -2. Change the shortcut in the start-up folder using a script. - -3. Use the deployment configuration file to specify the shortcut target to the integration root. - -### Hotfix Package 4 for Application Virtualization 5.0 SP2 installer can take a long time - -The Hotfix Package 4 for Application Virtualization 5.0 SP2 installer can potentially take a long time depending on how many files are stored in the existing package cache. - -Updating associated package security descriptors during the Hotfix Package 4 for Application Virtualization 5.0 SP2 installation has a significant impact on how long it takes the installation will take. Previously, the installation install was standard in duration. However, it now depends on how many files you have staged in the package cache. - -WORKAROUND: None - -### Uninstalling Hotfix Package 4 for Application Virtualization 5.0 SP2 fails if JIT-V package is in use - -If you install Hotfix Package 4 for Application Virtualization 5.0 SP2 and then try to uninstall the hotfix when just-in-time virtualization (JIT-V) is being used, the operation will fail if all of the following conditions are true: - -- You installed by using a Windows Installer file (.msi), and then you apply updates by using a Microsoft Installer Patch File (.msp). - -- You try to uninstall an update by using the Add or Remove Programs item in Control Panel. - -- A JIT-V-enabled package is running on the computer. - -WORKAROUND: Complete the following steps: - -1. Open Windows PowerShell and run the following commands: - - - **Import-module appvclient** - - - **Get-AppvClientPackage | Stop-AppvClientPackage** - -2. Uninstall the update using Add or Remove Programs. - -## Known Issues with App-V 5.0 SP2 - - -### App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData% - -When %AppData% is a shared network folder that you have configured for folder redirection, the changes that end users make to AppData (Roaming) can be lost when they switch computers or when their local AppData is cleared when they log off and then log back on. This error occurs because the registry key (AppDataTime), which indicates the last known upload, gets out of synchronization with the local cached AppData. - -WORKAROUND: Manually delete the following registry key for each relevant package when an end user logs on or off: - -``` syntax -HKCU\Software\Microsoft\AppV\Client\Packages\\AppDataTime -``` - -The first time that end users start an application in the package after they log in, App-V forces a download of the zipped %AppData%, even if %LocalAppData% is already up to date. - -### App-V 5.0 Service Pack 2 (App-V 5.0 SP2) does not include a new version of the App-V Server - -App-V 5.0 SP2 does not include a new version of the App-V Server. If you deploy App-V 5.0 SP2 clients running Windows 8.1 in your environment and plan to manage the clients using the App-V infrastructure, you must install [Hotfix Package 2 for Microsoft Application Virtualization 5.0 Service Pack 1](https://go.microsoft.com/fwlink/?LinkId=386634). (https://go.microsoft.com/fwlink/?LinkId=386634) - -If you are running and managing App-V 5.0 SP2 clients using any of the following methods no client update is required: - -- Standalone mode. - -- Configuration Manager. - -- Third party ESD. - -The App-V 5.0 SP2 client is fully compatible with Windows 8.1 - -WORKAROUND: None. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - - - - - - -## Related topics - - -[About App-V 5.0 SP2](about-app-v-50-sp2.md) - - - - - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md b/mdop/appv-v5/release-notes-for-app-v-50-sp3.md deleted file mode 100644 index 9eb47a741d..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Release Notes for App-V 5.0 SP3 -description: Release Notes for App-V 5.0 SP3 -author: dansimp -ms.assetid: bc4806e0-2aba-4c7b-9ecc-1b2cc54af1d0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Release Notes for App-V 5.0 SP3 - - -The following are known issues in Microsoft Application Virtualization (App-V) 5.0 SP3. - -## Server files fail to get deleted after a new App-V 5.0 SP3 Server installation - - -If you uninstall the App-V 5.0 SP1 Server and then install the App-V 5.0 SP3 Server, the installation fails and the wrong version of the Management server is installed. The following errors are displayed: - -`[0A5C:06F8][2014-09-12T19:08:00]i102: Detected related bundle: {bee44f0f-05be-48e4-81dd-d34a83600b95}, type: Upgrade, scope: PerMachine, version: 5.0.1218.0, operation: MajorUpgrade``[0A5C:06F8][2014-09-12T19:08:00]i000: AppvUX: A previous version of this product is installed; requesting upgrade.``[0A5C:06F8][2014-09-12T19:08:00]i102: Detected related bundle: {e1ca9d65-0ebf-4fd5-98e5-00d6453967a4}, type: Upgrade, scope: PerMachine, version: 5.0.1224.0, operation: MajorUpgrade``[0A5C:06F8][2014-09-12T19:08:00]i000: AppvUX: A previous version of this product is installed; requesting upgrade.` - -The issue occurs because the Server files are not being deleted when you uninstall App-V 5.0 SP1, so the App-V 5.0 SP3 installation process erroneously does an upgrade instead of a new installation. - -**Workaround**: Delete the following registry key before you start installing App-V 5.0 SP3: - -`HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall` - -## Querying AD DS can cause some applications to work incorrectly - - -When you receive updated packages by querying Active Directory Domain Services for updated group memberships, it can cause some applications to work incorrectly if the applications depend on the user’s access token. In addition, frequent group membership queries can cause the domain controller to overload. For more information about user access tokens, see [Access Tokens](https://msdn.microsoft.com/library/windows/desktop/aa374909.aspx). - -**Workaround**: Wait until the user logs off and then logs back on before you query for updated group memberships. Do not use the registry key, described in [Hotfix Package 2 for Microsoft Application Virtualization 5.0 Service Pack 1](https://support.microsoft.com/kb/2897087), to query for updated group memberships. - - - - - - -## Related topics - - -[About App-V 5.0 SP3](about-app-v-50-sp3.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-50.md b/mdop/appv-v5/release-notes-for-app-v-50.md deleted file mode 100644 index 417148f521..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-50.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Release Notes for App-V 5.0 -description: Release Notes for App-V 5.0 -author: dansimp -ms.assetid: 68a6a5a1-4b3c-4c09-b00c-9ca4237695d5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for App-V 5.0 - - -**To search for a specific issue in these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install App-V 5.0. - -These release notes contain information that is required to successfully install App-V 5.0. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other App-V 5.0 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For information about App-V 5.0 documentation, see the App-V 5.0 home page on Microsoft TechNet. - -## Provide Feedback - - -We are interested in your feedback on App-V 5.0. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with App-V 5.0 - - -This section contains release notes about the known issues with App-V 5.0. - -### Unable to terminate adding packages when using server PowerShell cmdlets - -When you add a package using PowerShell, there is no method to exit adding new packages. - -WORKAROUND: To stop adding packages, press **enter** after you have added the final package. - -### App-V 5.0 client rejects packages from servers whose SSL certificate has been revoked - -When using the HTTPS protocol, the App-V 5.0 client will by default reject packages from servers whose SSL certificate has been revoked. This behavior can be turned off through configuration by modifying the **VerifyCertificateRevocationList** setting. Applying new configuration for this setting will not take effect until the App-V 5.0 service is restarted. - -WORKAROUND: Restart the App-V 5.0 service. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - - - - - - -## Related topics - - -[About App-V 5.0](about-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/release-notes-for-app-v-51.md b/mdop/appv-v5/release-notes-for-app-v-51.md deleted file mode 100644 index f96c8ae1d2..0000000000 --- a/mdop/appv-v5/release-notes-for-app-v-51.md +++ /dev/null @@ -1,205 +0,0 @@ ---- -title: Release Notes for App-V 5.1 -description: Release Notes for App-V 5.1 -author: dansimp -ms.assetid: 62c5be3b-0a46-4512-93ed-97c23184f343 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 09/26/2016 ---- - - -# Release Notes for App-V 5.1 - - -The following are known issues in Microsoft Application Virtualization (App-V) 5.1. - -## Error occurs during publishing refresh between App-V 5.0 SP3 Management Server and App-V 5.1 Client on Windows 10 - - -An error is generated during publishing refresh when synchronizing packages from the App-V 5.0 SP3 management server to an App-V 5.1 client on Windows 10 . This error occurs because the App-V 5.0 SP3 server does not understand the Windows 10 operating system that is specified in the publishing URL. The issue is fixed for App-V 5.1 publishing server, but is not backported to versions of App-V 5.0 SP3 or earlier. - -**Workaround**: Upgrade the App-V 5.0 Management server to the App-V 5.1 Management server for Windows 10 Clients. - -## Custom configurations do not get applied for packages that will be published globally if they are set using the App-V 5.1 Server - - -If you assign a package to an AD group that contains machine accounts and apply a custom configuration to that group using the App-V Server, the custom configuration will not be applied to those machines. The App-V 5.1 Client will publish packages assigned to a machine account globally. However, it stores custom configuration files per user in each user’s profile. Globally published packages will not have access to this custom configuration. - -**Workaround**: Do one of the following: - -- Assign the package to groups containing only user accounts. This will ensure that the package’s custom configuration will be stored in each user’s profile and will be applied correctly. - -- Create a custom deployment configuration file and apply it to the package on the client using the Add-AppvClientPackage cmdlet with the –DynamicDeploymentConfiguration parameter. See [About App-V 5.1 Dynamic Configuration](about-app-v-51-dynamic-configuration.md) for more information. - -- Create a new package with the custom configuration using the App-V 5.1 Sequencer. - -## Server files not deleted after new App-V 5.1 Server installation - - -If you uninstall the App-V 5.0 SP1 Server and then install the App-V 5.1 Server, the installation fails, the wrong version of the Management server is installed, and an error message is returned. The issue occurs because the Server files are not being deleted when you uninstall App-V 5.0 SP1, so the installation process does an upgrade instead of a new installation. - -**Workaround**: Delete this registry key before you start installing App-V 5.1: - -Under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall, locate and delete the installation GUID key that contains the DWORD value "DisplayName" with value data "Microsoft Application Virtualization (App-V) Server". This is the only key that should be deleted. - -## File type associations added manually are not saved correctly - - -File type associations added to an application package manually using the Shortcuts and FTAs tab at the end of the application upgrade wizard are not saved correctly. They will not be available to the App-V Client or to the Sequencer when updating the saved package again. - -**Workaround**: To add a file type association, open the package for modification and run the update wizard. During the Installation step, add the new file type association through the operating system. The sequencer will detect the new association in the system registry and add it to the package’s virtual registry, where it will be available to the client. - -## When streaming packages in Shared Content Store (SCS) mode to a client that is also managed with AppLocker, additional data is written to the local disk. - - -To decrease the amount of data written to a client’s local disk, you can enable SCS mode on the App-V 5.1 Client to stream the contents of a package on demand. However, if AppLocker manages an application within the package, some data might be written to the client’s local disk that would not otherwise be written. - -**Workaround**: None - -## In the Management Console Add Package dialog box, the Browse button is not available when using Chrome or Firefox - - -On the Packages page of the Management Console, if you click **Add or Upgrade** in the lower-right corner, the **Add Package** dialog box appears. If you are accessing the Management Console using Chrome or Firefox as your browser, you will not be able to browse to the location of the package. - -**Workaround**: Type or copy and paste the path to the package into the **Add Package** input field. If the Management Console has access to this path, you will be able to add the package. If the package is on a network share, you can browse to the location using File Explorer by doing these steps: - -1. While pressing **Shift**, right-click on the package file - -2. Select **Copy as path** - -3. Paste the path into the **Add Package** dialog box input field - -## Upgrading App-V Management Server to 5.1 sometimes fails with the message “A database error occurred” - - -If you install the App-V 5.0 SP1 Management Server, and then try to upgrade to App-V 5.1 Server when multiple connection groups are configured and enabled, the following error is displayed: “A database error occurred. Reason: 'Invalid column name 'PackageOptional'. Invalid column name 'VersionOptional'.” - -**Workaround**: Run this command on your SQL database: - -`ALTER TABLE AppVManagement.dbo.PackageGroupMembers ADD PackageOptional bit NOT NULL DEFAULT 0, VersionOptional bit NOT NULL DEFAULT 0` - -where “AppVManagement” is the name of the database. - -## Users cannot open a package in a user-published connection group if you add or remove an optional package - - -In environments that are running the RDS Client or that have multiple concurrent users per computer, logged-in users cannot open applications in packages that are in a user-published connection group if an optional package is added to or removed from the connection group. - -**Workaround**: Have users log out and then log back in. - -## Error message is erroneously displayed when the connection group is published only to the user - - -When you run Repair-AppvClientConnectionGroup, the following error is displayed, even when the connection group is published only to the user: “Internal App-V Integration error: Package not integrated for the user. Please ensure that the package is added to the machine and published to the user.” - -**Workaround**: Do one of the following: - -- Publish all packages in a connection group. - - The problem arises when the connection group being repaired has packages that are missing or not available to the user (that is, not published globally or to the user). However, the repair will work if all of the connection group’s packages are available, so ensure that all packages are published. - -- Repair packages individually using the Repair-AppvClientPackage command rather than the Repair-AppvClientConnectionGroup command. - - Determine which packages are available to users and then run the Repair-AppvClientPackage command once for each package. Use PowerShell cmdlets to do the following: - - 1. Get all the packages in a connection group. - - 2. Check to see if each package is currently published. - - 3. If the package is currently published, run Repair-AppvClientPackage on that package. - -## Icons not displayed properly in Sequencer - - -Icons in the Shortcuts and File Type Associations tab are not displayed correctly when modifying a package in the App-V Sequencer. This problem occurs when the size of the icons are not 16x16 or 32x32. - -**Workaround**: Only use icons that are 16x16 or 32x32. - -## InsertVersionInfo.sql script no longer required for the Management Database - - -The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3. - -The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). - -**Important**   -**Step 1** is not required for versions of App-V later than App-V 5.0 SP3. - - - -## Microsoft Visual Studio 2012 not supported - - -App-V 5.1 does not support Visual Studio 2012. - -**Workaround**: None - -## Application filename restrictions for App-V 5.x Sequencer - - -The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. - -**Workaround**: Use a different filename - -## Intermittent "File Not Found" error when Mounting a Package - - -Occasionally when mounting a package, a "File Not Found" (0x80070002) error is generated. Typically, this occurs when a folder in an App-V package contains many files ( i.e. 20K or more). This can cause streaming to take longer than expected and to time out which generates the "File Not Found" error. - -**Workaround**: Starting with HF06, a new registry key has been introduced to enable extending this time-out period. - - ---- - - - - - - - - - - - - - - - - - - - - - - -
    PathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Streaming
    SettingStreamResponseWaitTimeout
    DataTypeDWORD
    UnitsSeconds
    Default5
    -Note: this value is the default if the registry key is not defined or a value <=5 is specified. -
    - - - - - - -## Related topics - - -[About App-V 5.1](about-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md deleted file mode 100644 index 6a49308d73..0000000000 --- a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md +++ /dev/null @@ -1,195 +0,0 @@ ---- -title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: dansimp -ms.assetid: a8affa46-f1f7-416c-8125-9595cfbfdbc7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications - - -You can run a locally installed application in a virtual environment, alongside applications that have been virtualized by using Microsoft Application Virtualization (App-V). You might want to do this if you: - -- Want to install and run an application locally on client computers, but want to virtualize and run specific plug-ins that work with that local application. - -- Are troubleshooting an App-V client package and want to open a local application within the App-V virtual environment. - -Use any of the following methods to open a local application inside the App-V virtual environment: - -- [RunVirtual registry key](#bkmk-runvirtual-regkey) - -- [Get-AppvClientPackage PowerShell cmdlet](#bkmk-get-appvclientpackage-posh) - -- [Command line switch /appvpid:<PID>](#bkmk-cl-switch-appvpid) - -- [Command line hook switch /appvve:<GUID>](#bkmk-cl-hook-switch-appvve) - -Each method accomplishes essentially the same task, but some methods may be better suited for some applications than others, depending on whether the virtualized application is already running. - -## RunVirtual registry key - - -To add a locally installed application to a package or to a connection group’s virtual environment, you add a subkey to the `RunVirtual` registry key in the Registry Editor, as described in the following sections. - -There is no Group Policy setting available to manage this registry key, so you have to use System Center Configuration Manager or another electronic software distribution (ESD) system, or manually edit the registry. - -### Supported methods of publishing packages when using RunVirtual - - ---- - - - - - - - - - - - - - - - - -
    App-V versionSupported publishing methods

    App-V 5.0 SP3

    Published globally or to the user

    App-V 5.0 through App-V 5.0 SP2

    Published globally only

    - - - -### Steps to create the subkey - -1. Using the information in the following table, create a new registry key using the name of the executable file, for example, **MyApp.exe**. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Package publishing methodWhere to create the registry key

    Published globally

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual

    -

    Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe

    Published to the user

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual

    -

    Example: HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe

    Connection group can contain:

    -
      -
    • Packages that are published just globally or just to the user

    • -
    • Packages that are published globally and to the user

    • -

    Either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER key, but all of the following must be true:

    -
      -
    • If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group.

    • -
    • Create only one subkey for one of the packages in the connection group. If, for example, you have one package that is published globally, and another package that is published to the user, you create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment.

    • -
    • The key under which you create the subkey must match the publishing method you used for the package.

      -

      For example, if you published the package to the user, you must create the subkey under HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual.

    • -
    - - - -2. Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore. - - **Syntax**: <PackageId>\_<VersionId> - - **Example**: 4c909996-afc9-4352-b606-0b74542a09c1\_be463724-Oct1-48f1-8604-c4bd7ca92fa - - The application in the previous example would produce a registry export file (.reg file) like the following: - - ``` syntax - Windows Registry Editor Version 5.00 - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual] - @="" - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe] - @="aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-555555555 - ``` - -## Get-AppvClientPackage PowerShell cmdlet - - -You can use the **Start-AppVVirtualProcess** cmdlet to retrieve the package name and then start a process within the specified package's virtual environment. This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - -Use the following example syntax, and substitute the name of your package for **<Package>**: - -`$AppVName = Get-AppvClientPackage ` - -`Start-AppvVirtualProcess -AppvClientObject $AppVName cmd.exe` - -If you don’t know the exact name of your package, you can use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*. - -## Command line switch /appvpid:<PID> - - -You can apply the **/appvpid:<PID>** switch to any command, which enables that command to run within a virtual process that you select by specifying its process ID (PID). Using this method launches the new executable in the same App-V environment as an executable that is already running. - -Example: `cmd.exe /appvpid:8108` - -To find the process ID (PID) of your App-V process, run the command **tasklist.exe** from an elevated command prompt. - -## Command line hook switch /appvve:<GUID> - - -This switch lets you run a local command within the virtual environment of an App-V package. Unlike the **/appvid** switch, where the virtual environment must already be running, this switch enables you to start the virtual environment. - -Syntax: `cmd.exe /appvve:` - -Example: `cmd.exe /appvve:aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-55555555` - -To get the package GUID and version GUID of your application, run the **Get-AppvClientPackage** cmdlet. Concatenate the **/appvve** switch with the following: - -- A colon - -- Package GUID of the desired package - -- An underscore - -- Version ID of the desired package - -If you don’t know the exact name of your package, use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*. - -This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - - - - - - -## Related topics - - -[Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md deleted file mode 100644 index 26f9693b4b..0000000000 --- a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md +++ /dev/null @@ -1,195 +0,0 @@ ---- -title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: dansimp -ms.assetid: 71baf193-a9e8-4ffa-aa7f-e0bffed2e4b2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications - - -You can run a locally installed application in a virtual environment, alongside applications that have been virtualized by using Microsoft Application Virtualization (App-V). You might want to do this if you: - -- Want to install and run an application locally on client computers, but want to virtualize and run specific plug-ins that work with that local application. - -- Are troubleshooting an App-V client package and want to open a local application within the App-V virtual environment. - -Use any of the following methods to open a local application inside the App-V virtual environment: - -- [RunVirtual registry key](#bkmk-runvirtual-regkey) - -- [Get-AppvClientPackage PowerShell cmdlet](#bkmk-get-appvclientpackage-posh) - -- [Command line switch /appvpid:<PID>](#bkmk-cl-switch-appvpid) - -- [Command line hook switch /appvve:<GUID>](#bkmk-cl-hook-switch-appvve) - -Each method accomplishes essentially the same task, but some methods may be better suited for some applications than others, depending on whether the virtualized application is already running. - -## RunVirtual registry key - - -To add a locally installed application to a package or to a connection group’s virtual environment, you add a subkey to the `RunVirtual` registry key in the Registry Editor, as described in the following sections. - -There is no Group Policy setting available to manage this registry key, so you have to use System Center Configuration Manager or another electronic software distribution (ESD) system, or manually edit the registry. - -### Supported methods of publishing packages when using RunVirtual - - ---- - - - - - - - - - - - - - - - - -
    App-V versionSupported publishing methods

    App-V 5.0 SP3 and App-V 5.1

    Published globally or to the user

    App-V 5.0 through App-V 5.0 SP2

    Published globally only

    - - - -### Steps to create the subkey - -1. Using the information in the following table, create a new registry key using the name of the executable file, for example, **MyApp.exe**. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Package publishing methodWhere to create the registry key

    Published globally

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual

    -

    Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe

    Published to the user

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual

    -

    Example: HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe

    Connection group can contain:

    -
      -
    • Packages that are published just globally or just to the user

    • -
    • Packages that are published globally and to the user

    • -

    Either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER key, but all of the following must be true:

    -
      -
    • If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group.

    • -
    • Create only one subkey for one of the packages in the connection group. If, for example, you have one package that is published globally, and another package that is published to the user, you create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment.

    • -
    • The key under which you create the subkey must match the publishing method you used for the package.

      -

      For example, if you published the package to the user, you must create the subkey under HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual.

    • -
    - - - -2. Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore. - - **Syntax**: <PackageId>\_<VersionId> - - **Example**: 4c909996-afc9-4352-b606-0b74542a09c1\_be463724-Oct1-48f1-8604-c4bd7ca92fa - - The application in the previous example would produce a registry export file (.reg file) like the following: - - ``` syntax - Windows Registry Editor Version 5.00 - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual] - @="" - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe] - @="aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-555555555 - ``` - -## Get-AppvClientPackage PowerShell cmdlet - - -You can use the **Start-AppVVirtualProcess** cmdlet to retrieve the package name and then start a process within the specified package's virtual environment. This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - -Use the following example syntax, and substitute the name of your package for **<Package>**: - -`$AppVName = Get-AppvClientPackage ` - -`Start-AppvVirtualProcess -AppvClientObject $AppVName cmd.exe` - -If you don’t know the exact name of your package, you can use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*. - -## Command line switch /appvpid:<PID> - - -You can apply the **/appvpid:<PID>** switch to any command, which enables that command to run within a virtual process that you select by specifying its process ID (PID). Using this method launches the new executable in the same App-V environment as an executable that is already running. - -Example: `cmd.exe /appvpid:8108` - -To find the process ID (PID) of your App-V process, run the command **tasklist.exe** from an elevated command prompt. - -## Command line hook switch /appvve:<GUID> - - -This switch lets you run a local command within the virtual environment of an App-V package. Unlike the **/appvid** switch, where the virtual environment must already be running, this switch enables you to start the virtual environment. - -Syntax: `cmd.exe /appvve:` - -Example: `cmd.exe /appvve:aaaaaaaa-bbbb-cccc-dddd-eeeeeeee_11111111-2222-3333-4444-55555555` - -To get the package GUID and version GUID of your application, run the **Get-AppvClientPackage** cmdlet. Concatenate the **/appvve** switch with the following: - -- A colon - -- Package GUID of the desired package - -- An underscore - -- Version ID of the desired package - -If you don’t know the exact name of your package, use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*. - -This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running. - - - - - - -## Related topics - - -[Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/technical-reference-for-app-v-50.md b/mdop/appv-v5/technical-reference-for-app-v-50.md deleted file mode 100644 index 4edd02b6e7..0000000000 --- a/mdop/appv-v5/technical-reference-for-app-v-50.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Technical Reference for App-V 5.0 -description: Technical Reference for App-V 5.0 -author: dansimp -ms.assetid: aa899158-41e8-47d3-882c-8c5b96018308 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for App-V 5.0 - - -This section provides reference information related to managing App-V 5.0. - -## In This Section - - -- [Performance Guidance for Application Virtualization 5.0](performance-guidance-for-application-virtualization-50.md) - - Provides strategy and context for a number of performance optimization practices. Not all practices will be applicable although they are supported and have been tested. Using all suggested practices that are applicable to your organization will provide the optimal end-user experience. - -- [Application Publishing and Client Interaction](application-publishing-and-client-interaction.md) - - Describes how the following App-V client operations affect the local operating system: App-V files and data storage locations, package registry, package store behavior, roaming registry and data, client application lifecycle management, integration of App-V packages, dynamic configuration, side-by-side assemblies, and client logging. - - - - - - -## Related topics - - -[Creating App-V 4.5 Databases Using SQL Scripting](../solutions/creating-app-v-45-databases-using-sql-scripting.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/technical-reference-for-app-v-51.md b/mdop/appv-v5/technical-reference-for-app-v-51.md deleted file mode 100644 index 4a5b670357..0000000000 --- a/mdop/appv-v5/technical-reference-for-app-v-51.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Technical Reference for App-V 5.1 -description: Technical Reference for App-V 5.1 -author: dansimp -ms.assetid: 2b9e8b2b-4cd1-46f3-ba08-e3bc8d5c6127 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for App-V 5.1 - - -This section provides reference information related to managing App-V 5.1. - -## In This Section - - -- [Performance Guidance for Application Virtualization 5.1](performance-guidance-for-application-virtualization-51.md) - - Provides strategy and context for a number of performance optimization practices. Not all practices will be applicable although they are supported and have been tested. Using all suggested practices that are applicable to your organization will provide the optimal end-user experience. - -- [Application Publishing and Client Interaction](application-publishing-and-client-interaction51.md) - - Describes how the following App-V client operations affect the local operating system: App-V files and data storage locations, package registry, package store behavior, roaming registry and data, client application lifecycle management, integration of App-V packages, dynamic configuration, side-by-side assemblies, and client logging. - - - - - - -## Related topics - - -[Creating App-V 4.5 Databases Using SQL Scripting](../solutions/creating-app-v-45-databases-using-sql-scripting.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/troubleshooting-app-v-50.md b/mdop/appv-v5/troubleshooting-app-v-50.md deleted file mode 100644 index 7fde4fd864..0000000000 --- a/mdop/appv-v5/troubleshooting-app-v-50.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Troubleshooting App-V 5.0 -description: Troubleshooting App-V 5.0 -author: dansimp -ms.assetid: a713b345-25b7-4cdf-ba55-66df672a1f3a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting App-V 5.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting App-V 5.0 - - -- [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md) - -- [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md) - -- [Planning for App-V 5.0](planning-for-app-v-50-rc.md) - -- [Deploying App-V 5.0](deploying-app-v-50.md) - -- [Operations for App-V 5.0](operations-for-app-v-50.md) - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/troubleshooting-app-v-51.md b/mdop/appv-v5/troubleshooting-app-v-51.md deleted file mode 100644 index 27ce45c67f..0000000000 --- a/mdop/appv-v5/troubleshooting-app-v-51.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Troubleshooting App-V 5.1 -description: Troubleshooting App-V 5.1 -author: dansimp -ms.assetid: 435d0e56-0aa2-4168-b5a7-2f03a1f273d4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting App-V 5.1 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting App-V 5.1 - - -- [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md) - -- [Getting Started with App-V 5.1](getting-started-with-app-v-51.md) - -- [Planning for App-V 5.1](planning-for-app-v-51.md) - -- [Deploying App-V 5.1](deploying-app-v-51.md) - -- [Operations for App-V 5.1](operations-for-app-v-51.md) - - - - - - -  - -  - - - - - diff --git a/mdop/appv-v5/using-the-app-v-50-client-management-console.md b/mdop/appv-v5/using-the-app-v-50-client-management-console.md deleted file mode 100644 index 2ab6dea613..0000000000 --- a/mdop/appv-v5/using-the-app-v-50-client-management-console.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Using the App-V 5.0 Client Management Console -description: Using the App-V 5.0 Client Management Console -author: dansimp -ms.assetid: 36398307-57dd-40f3-9d4f-b09f44fd37c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using the App-V 5.0 Client Management Console - - -This topic provides information about how you can configure and manage the App-V 5.0 client. - -## Modify App-V 5.0 client configuration - - -The App-V 5.0 client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client or by using PowerShell or Group Policy. For more information about how to modify the client using PowerShell or Group Policy configuration see, [How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell.md). - -## The App-V 5.0 client management console - - -You can obtain information about the App-V 5.0 client or perform specific tasks by using the App-V 5.0 client management console. Many of the tasks that you can perform in the client management console you can also perform by using PowerShell. The associated PowerShell cmdlets for each action are also displayed in the following table. For more information about how to use PowerShell, see [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md). - -The client management console contains the following described main tabs. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TabDescription

    Overview

    The Overview tab contains the following elements:

    -
      -
    • Update – Use the Update tile to refresh a virtualized application or to receive a new virtualized package.

      -

      The Last Refresh displays the current version of the virtualized package.

    • -
    • Download all virtual applications – Use the Download tile to download all of the packages provisioned to the current user.

      -

      (Associated PowerShell cmdlet: Mount-AppvClientPackage)

      -

    • -
    • Work Offline – Use this tile to disallow all automatic and manual virtual application updates.

      -

      (Associated PowerShell cmdlet: Set-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled)

    • -

    Virtual Apps

    The VIRTUAL APPS tab displays all of the packages that have been published to the user. You can also click a specific package and see all of the applications that are part of that package. This displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads. Additionally, you can repair the user state. A repair will delete all user data that is associated with a package.

    -

    App Connection Groups

    The APP CONNECTION GROUPS tab displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group.

    -

    (Associated PowerShell cmdlets: Download - Mount-AppvClientConnectionGroup. Repair -AppvClientConnectionGroup.)

    -

    - -  - -[How to Access the Client Management Console](how-to-access-the-client-management-console.md) - -[How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md) - - - - - - -## Related topics - - -[Operations for App-V 5.0](operations-for-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/using-the-app-v-51-client-management-console.md b/mdop/appv-v5/using-the-app-v-51-client-management-console.md deleted file mode 100644 index 427f3aa60c..0000000000 --- a/mdop/appv-v5/using-the-app-v-51-client-management-console.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Using the App-V 5.1 Client Management Console -description: Using the App-V 5.1 Client Management Console -author: dansimp -ms.assetid: be6d4e35-5701-4f9a-ba8a-bede12662cf1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using the App-V 5.1 Client Management Console - - -This topic provides information about how you can configure and manage the Microsoft Application Virtualization (App-V) 5.1 client. - -## Modify App-V 5.1 client configuration - - -The App-V 5.1 client has associated settings that can be configured to determine how the client will run in your environment. You can manage these settings on the computer that runs the client or by using PowerShell or Group Policy. For more information about how to modify the client using PowerShell or Group Policy configuration see, [How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell51.md). - -## The App-V 5.1 client management console - - -You can obtain information about the App-V 5.1 client or perform specific tasks by using the App-V 5.1 client management console. Many of the tasks that you can perform in the client management console you can also perform by using PowerShell. The associated PowerShell cmdlets for each action are also displayed in the following table. For more information about how to use PowerShell, see [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md). - -The client management console contains the following described main tabs. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TabDescription

    Overview

    The Overview tab contains the following elements:

    -
      -
    • Update – Use the Update tile to refresh a virtualized application or to receive a new virtualized package.

      -

      The Last Refresh displays the current version of the virtualized package.

    • -
    • Download all virtual applications – Use the Download tile to download all of the packages provisioned to the current user.

      -

      (Associated PowerShell cmdlet: Mount-AppvClientPackage)

      -

    • -
    • Work Offline – Use this tile to disallow all automatic and manual virtual application updates.

      -

      (Associated PowerShell cmdlet: Set-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled)

    • -

    Virtual Apps

    The VIRTUAL APPS tab displays all of the packages that have been published to the user. You can also click a specific package and see all of the applications that are part of that package. This displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads. Additionally, you can repair the user state. A repair will delete all user data that is associated with a package.

    -

    App Connection Groups

    The APP CONNECTION GROUPS tab displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group.

    -

    (Associated PowerShell cmdlets: Download - Mount-AppvClientConnectionGroup. Repair -AppvClientConnectionGroup.)

    -

    - -  - -[How to Access the Client Management Console](how-to-access-the-client-management-console51.md) - -[How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md) - - - - - - -## Related topics - - -[Operations for App-V 5.1](operations-for-app-v-51.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md b/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md deleted file mode 100644 index 218bac0f4f..0000000000 --- a/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md +++ /dev/null @@ -1,258 +0,0 @@ ---- -title: Viewing App-V Server Publishing Metadata -description: Viewing App-V Server Publishing Metadata -author: dansimp -ms.assetid: 048dd42a-24d4-4cc4-81f6-7a919aadd9b2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing App-V Server Publishing Metadata - - -Use this procedure to view publishing metadata, which can help you resolve publishing-related issues. You must be using the App-V Management server to use this procedure. - -This article contains the following information: - -- [App-V 5.0 SP3 requirements for viewing publishing metadata](#bkmk-50sp3-reqs-pub-meta) - -- [Syntax to use for viewing publishing metadata](#bkmk-syntax-view-pub-meta) - -- [Query values for client operating system and version](#bkmk-values-query-pub-meta) - -- [Definition of publishing metadata](#bkmk-whatis-pub-metadata) - -## App-V 5.0 SP3 requirements for viewing publishing metadata - - -In App-V 5.0 SP3, you must provide the following values in the address when you query the App-V Publishing server for metadata: - - ---- - - - - - - - - - - - - - - - - -
    ValueAdditional details

    ClientVersion

    If you omit the ClientVersion parameter from the query, the metadata excludes the new App-V 5.0 SP3 features.

    ClientOS

    You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query.

    -

    If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata.

    - - - -## Query syntax for viewing publishing metadata - - -The following table provides the syntax and query examples. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Version of App-VQuery syntaxParameter descriptionsExample

    App-V 5.0 SP3

    http://<PubServer>:<Publishing Port#>/?ClientVersion=<AppvClientVersion>&ClientOS=<OSStringValue>

    ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    <PubServer>

    Name of the App-V Publishing server.

    <Publishing Port#>

    Port to the App-V Publishing server, which you defined when you configured the Publishing server.

    ClientVersion=<AppvClientVersion>

    Version of the App-V client. Refer to the following table for the correct value to use.

    ClientOS=<OSStringValue>

    Operating system of the computer that is running the App-V client. Refer to the following table for the correct value to use.

    -

    -

    To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet.

    http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64

    -

    In the example:

    -
      -
    • A Windows Server 2012 R2 named “pubsvr01” hosts the Publishing service.

    • -
    • The Windows client is Windows 8.1 64-bit.

    • -

    App-V 5.0 through App-V 5.0 SP2

    http://<PubServer>:<Publishing Port#>/

    -
    -Note

    ClientVersion and ClientOS are supported only in App-V 5.0 SP3.

    -
    -
    - -

    See the information for App-V 5.0 SP3.

    http://pubsvr01:2718

    -

    In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services.

    - - - -## Query values for client operating system and version - - -In your publishing metadata query, enter the string values that correspond to the client operating system and version that you’re using. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemArchitectureOperating string string value

    Windows 8.1

    64-bit

    WindowsClient_6.2_x64

    Windows 8.1

    32-bit

    WindowsClient_6.2_x86

    Windows 8

    64-bit

    WindowsClient_6.2_x64

    Windows 8

    32-bit

    WindowsClient_6.2_x86

    Windows Server 2012 R2

    64-bit

    WindowsServer_6.2_x64

    Windows Server 2012 R2

    32-bit

    WindowsServer_6.2_x86

    Windows Server 2012

    64-bit

    WindowsServer_6.2_x64

    Windows Server 2012

    32-bit

    WindowsServer_6.2_x86

    Windows 7

    64-bit

    WindowsClient_6.1_x64

    Windows 7

    32-bit

    WindowsClient_6.1_x86

    Windows Server 2008 R2

    64-bit

    WindowsServer_6.1_x64

    Windows Server 2008 R2

    32-bit

    WindowsServer_6.1_x86

    - - - -## Definition of publishing metadata - - -When packages are published to a computer that is running the App-V client, metadata is sent to that computer indicating which packages and connection groups are being published. The App-V Client makes two separate requests for the following: - -- Packages and connection groups that are entitled to the client computer. - -- Packages and connection groups that are entitled to the current user. - -The Publishing server communicates with the Management server to determine which packages and connection groups are available to the requester. The Publishing server must be registered with the Management server in order for the metadata to be generated. - -You can view the metadata for each request in an Internet browser by using a query that is in the context of the specific user or computer. - - - - - - -## Related topics - - -[Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md) - - - - - - - - - diff --git a/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md b/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md deleted file mode 100644 index 5971f5c937..0000000000 --- a/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md +++ /dev/null @@ -1,268 +0,0 @@ ---- -title: Viewing App-V Server Publishing Metadata -description: Viewing App-V Server Publishing Metadata -author: dansimp -ms.assetid: d5fa9eb5-647c-478d-8a4d-0ecda018bce6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing App-V Server Publishing Metadata - - -Use this procedure to view publishing metadata, which can help you resolve publishing-related issues. You must be using the App-V Management server to use this procedure. - -This article contains the following information: - -- [App-V 5.1 requirements for viewing publishing metadata](#bkmk-51-reqs-pub-meta) - -- [Syntax to use for viewing publishing metadata](#bkmk-syntax-view-pub-meta) - -- [Query values for client operating system and version](#bkmk-values-query-pub-meta) - -- [Definition of publishing metadata](#bkmk-whatis-pub-metadata) - -## App-V 5.1 requirements for viewing publishing metadata - - -In App-V 5.1, you must provide the following values in the address when you query the App-V Publishing server for metadata: - - ---- - - - - - - - - - - - - - - - - -
    ValueAdditional details

    ClientVersion

    If you omit the ClientVersion parameter from the query, the metadata excludes the features that were new in App-V 5.0 SP3.

    ClientOS

    You have to provide this value only if you select specific client operating systems when you sequence the package. If you select the default (all operating systems), do not specify this value in the query.

    -

    If you omit the ClientOS parameter from the query, only the packages that were sequenced to support any operating system appear in the metadata.

    - - - -## Query syntax for viewing publishing metadata - - -The following table provides the syntax and query examples. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Version of App-VQuery syntaxParameter descriptionsExample

    App-V 5.0 SP3 and App-V 5.1

    http://<PubServer>:<Publishing Port#>/?ClientVersion=<AppvClientVersion>&ClientOS=<OSStringValue>

    ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    <PubServer>

    Name of the App-V Publishing server.

    <Publishing Port#>

    Port to the App-V Publishing server, which you defined when you configured the Publishing server.

    ClientVersion=<AppvClientVersion>

    Version of the App-V client. Refer to the following table for the correct value to use.

    ClientOS=<OSStringValue>

    Operating system of the computer that is running the App-V client. Refer to the following table for the correct value to use.

    -

    -

    To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet.

    http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64

    -

    In the example:

    -
      -
    • A Windows Server 2012 R2 named “pubsvr01” hosts the Publishing service.

    • -
    • The Windows client is Windows 8.1 64-bit.

    • -

    App-V 5.0 through App-V 5.0 SP2

    http://<PubServer>:<Publishing Port#>/

    -
    -Note

    ClientVersion and ClientOS are supported only in App-V 5.0 SP3 and App-V 5.1.

    -
    -
    - -

    See the information for App-V 5.0 SP3 and App-V 5.1.

    http://pubsvr01:2718

    -

    In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services.

    - - - -## Query values for client operating system and version - - -In your publishing metadata query, enter the string values that correspond to the client operating system and version that you’re using. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemArchitectureOperating string string value

    Windows 10

    64-bit

    WindowsClient_10.0_x64

    Windows 10

    32-bit

    WindowsClient_10.0_x86

    Windows 8.1

    64-bit

    WindowsClient_6.2_x64

    Windows 8.1

    32-bit

    WindowsClient_6.2_x86

    Windows 8

    64-bit

    WindowsClient_6.2_x64

    Windows 8

    32-bit

    WindowsClient_6.2_x86

    Windows Server 2012 R2

    64-bit

    WindowsServer_6.2_x64

    Windows Server 2012 R2

    32-bit

    WindowsServer_6.2_x86

    Windows Server 2012

    64-bit

    WindowsServer_6.2_x64

    Windows Server 2012

    32-bit

    WindowsServer_6.2_x86

    Windows 7

    64-bit

    WindowsClient_6.1_x64

    Windows 7

    32-bit

    WindowsClient_6.1_x86

    Windows Server 2008 R2

    64-bit

    WindowsServer_6.1_x64

    Windows Server 2008 R2

    32-bit

    WindowsServer_6.1_x86

    - - - -## Definition of publishing metadata - - -When packages are published to a computer that is running the App-V client, metadata is sent to that computer indicating which packages and connection groups are being published. The App-V Client makes two separate requests for the following: - -- Packages and connection groups that are entitled to the client computer. - -- Packages and connection groups that are entitled to the current user. - -The Publishing server communicates with the Management server to determine which packages and connection groups are available to the requester. The Publishing server must be registered with the Management server in order for the metadata to be generated. - -You can view the metadata for each request in an Internet browser by using a query that is in the context of the specific user or computer. - - - - - - -## Related topics - - -[Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md) - - - - - - - - - diff --git a/mdop/appv-v5/whats-new-in-app-v-50-sp1.md b/mdop/appv-v5/whats-new-in-app-v-50-sp1.md deleted file mode 100644 index 6968160074..0000000000 --- a/mdop/appv-v5/whats-new-in-app-v-50-sp1.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: What's new in App-V 5.0 SP1 -description: What's new in App-V 5.0 SP1 -author: dansimp -ms.assetid: e97c2dbb-7b40-46a0-8137-9ee4fc2bd071 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's new in App-V 5.0 SP1 - - -This section is for users who are already familiar with App-V and want to know what has changed in App-V 5.0 SP1. If you are not already familiar with App-V, you should start by reading [Planning for App-V 5.0](planning-for-app-v-50-rc.md). - -## Changes in Standard Functionality - - -The following sections contain information about the changes in standard functionality for App-V 5.0 SP1. - -### Changes to Supported Languages - -For more information, see [About App-V 5.0 SP1](about-app-v-50-sp1.md). - -The following list contains more information about the new Language Packs: - -- The App-V 5.0 SP1 language packs are bundled into the **appv\_xxx\_setup.exe** installer for all the App-V 5.0 Components. - -- When you run the installer it will automatically install the most appropriate language pack based on the locale of the associated operating system running on the target computer. - -- If additional language packs are required, you must extract these language packs from the installer by running the following command: `appv_xxx_setup.exe /Layout /LayoutDir=””`. After this has been run, the contents of the installer are extracted to the specified location. - -- You must install the desired language pack by applying the appropriate Language pack Windows Installation file. For example, **appv\_hib\_LP\_jmmb\_x86.msi** or **appv\_hib\_LP\_jmmb\_x64.msi**, where **hib** refers to the component and **jmmb** refers to the locale. - -## Enhanced Support for Microsoft Office 2010 - - -**Microsoft Office 2010 Sequencing Kit for Application Virtualization 5.0** – helps provide users with a consistent experience using a virtualized version of Microsoft Office 2010. The **Microsoft Office 2010 Sequencing Kit for Application Virtualization 5.0** is used in conjunction with the **Microsoft Office 2010 Deployment Kit for App-V** and also provides the required Microsoft Office 2010 licensing service. - - - - - - -## Related topics - - -[About App-V 5.0](about-app-v-50.md) - -  - -  - - - - - diff --git a/mdop/appv-v5/whats-new-in-app-v-50.md b/mdop/appv-v5/whats-new-in-app-v-50.md deleted file mode 100644 index 7d5f3286a2..0000000000 --- a/mdop/appv-v5/whats-new-in-app-v-50.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: What's New in App-V 5.0 -description: What's New in App-V 5.0 -author: dansimp -ms.assetid: 79ff6e02-e926-4803-87d8-248a6b28099d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, appcompat, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in App-V 5.0 - - -This section is for users who are already familiar with App-V and want to know what has changed in App-V 5.0 If you are not already familiar with App-V, you should start by reading [Planning for App-V 5.0](planning-for-app-v-50-rc.md). - -## Changes in Standard Functionality - - -The following sections contain information about the changes in standard functionality for App-V 5.0. - -### Changes to Supported Operating Systems - -For more information, see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md). - -## Changes to the sequencer - - -The following sections contain information about the changes in the App-V 5.0 sequencer. - -### Specific change to the sequencer - -The following table displays information about what has changed with the App-V 5.0 sequencer - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Sequencer FeatureApp-V 5.0 Sequencer Functionality

    Reboot processing

    When an application prompts for a restart, you should allow the application to restart the computer running the sequencer. The computer running the sequencer will restart and the sequencer will resume in monitoring mode.

    Specifying the virtual application directory

    Virtual Application Directory is a mandatory parameter. For best results, it should match the installation directory of the application installer. This results in more optimal performance and application compatibility.

    Editing shortcuts/FTAs

    The Shortcuts/FTA page is on the Advanced editing page after the sequencing wizard has completed.

    Change History Tab

    The Change History tab has been removed for App-V 5.0.

    OSD Tab

    The OSD tab has been removed for App-V 5.0.

    Virtual Services Tab

    The virtual services tab has been removed for App-V 5.0.

    Files/Virtual File System Tab

    These tabs are combined and allow you to modify package files.

    Deployment Tab

    There are no longer options to configure the server URL in the packages. You should configure this now using deployment configuration, or the management server.

    Package Converter Tool

    You can now use PowerShell to convert packages created in previous versions.

    Add-on/Middleware

    You can expand parent packages when you are sequencing an Add-On or Middleware application. Add-ons and Middleware packages must be connected using connection groups in App-V 5.0.

    Files output

    The following files are created with App-V 5.0, Windows Installer (.msi), .appv, deployment configuration, user configuration, and the Report.XML.

    Compression/Security descriptors/MSI packages

    Compression and the creation of a Windows Installer (.msi) file are automatic for all packages and you can no longer override security descriptors.

    Tools / Options

    The Diagnostics window has been removed as well as several other settings.

    Installation Drive

    An installation drive is no longer required when you install an application.

    OOS Streaming

    If no stream optimization is performed, packages are stream faulted when they are requested by computers running the App-V 5.0 client until they can launch.

    Q:</p>

    App-V 5.0 uses the native file system and no longer requires a Q:.

    - - - -## Sequencing error detection - - -The App-V 5.0 sequencer can detect common sequencing issues during sequencing. The **Installation Report** page at the end of the sequencing wizard displays diagnostic messages categorized into **Errors**, **Warnings**, and **Info** depending on the severity of the issue. - -To display more detailed information about an event, double-click the item you want to review in the report. The sequencing issues, as well as suggestions about how to resolve the issues are displayed. Information from the system preparation report and the installation report are summarized when you have finished creating a package. The following list displays the types of issues available in the report: - -- Excluded files. - -- Driver information. - -- COM+ system differences. - -- Side-by-side (SxS) conflicts. - -- Shell Extensions. - -- Information about unsupported services. - -- DCOM. - -## Connection Groups - - -The App-V feature formerly known as **Dynamic Suite Composition** is now referred to as **Connection Groups** in App-V 5.0. For more information about using Connection Groups see [Managing Connection Groups](managing-connection-groups.md). - -## Licensing and Metering Functionality - - -The application and licensing functionality has been removed in App-V 5.0. The actual license positions in your environment depend on the specific software title license and usage rights granted by the associated license terms. - -## File and Application Cache - - -There is no file or application cache available with App-V 5.0. - - - - - - -## Related topics - - -[About App-V 5.0](about-app-v-50.md) - - - - - - - - - diff --git a/mdop/breadcrumb/toc.yml b/mdop/breadcrumb/toc.yml deleted file mode 100644 index 904b8033a1..0000000000 --- a/mdop/breadcrumb/toc.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Microsoft Desktop Optimization Pack - tocHref: /microsoft-desktop-optimization-pack - topicHref: /microsoft-desktop-optimization-pack/index \ No newline at end of file diff --git a/mdop/dart-v10/TOC.md b/mdop/dart-v10/TOC.md deleted file mode 100644 index 5f3730e1c6..0000000000 --- a/mdop/dart-v10/TOC.md +++ /dev/null @@ -1,39 +0,0 @@ -# [Diagnostics and Recovery Toolset 10](index.md) -## [Getting Started with DaRT 10](getting-started-with-dart-10.md) -### [About DaRT 10](about-dart-10.md) -#### [Release Notes for DaRT 10](release-notes-for-dart-10.md) -### [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md) -### [Accessibility for DaRT 10](accessibility-for-dart-10.md) -## [Planning for DaRT 10](planning-for-dart-10.md) -### [Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) -#### [DaRT 10 Supported Configurations](dart-10-supported-configurations.md) -#### [Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md) -#### [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md) -### [DaRT 10 Planning Checklist](dart-10-planning-checklist.md) -## [Deploying DaRT 10](deploying-dart-10.md) -### [Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) -#### [How to Deploy DaRT 10](how-to-deploy-dart-10.md) -#### [How to Change, Repair, or Remove DaRT 10](how-to-change-repair-or-remove-dart-10.md) -### [Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) -### [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) -#### [How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md) -#### [How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md) -### [DaRT 10 Deployment Checklist](dart-10-deployment-checklist.md) -## [Operations for DaRT 10](operations-for-dart-10.md) -### [Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md) -#### [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md) -#### [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md) -### [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) -#### [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md) -#### [How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md) -#### [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md) -### [Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md) -#### [Security Considerations for DaRT 10](security-considerations-for-dart-10.md) -#### [DaRT 10 Privacy Statement](dart-10-privacy-statement.md) -### [Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) -#### [How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md) -#### [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md) -## [Troubleshooting DaRT 10](troubleshooting-dart-10.md) -# [DaRT 10](dart-10--c--page.md) -# [DaRT 10](dart-10-cover-page.md) - diff --git a/mdop/dart-v10/about-dart-10.md b/mdop/dart-v10/about-dart-10.md deleted file mode 100644 index bc738c6bd9..0000000000 --- a/mdop/dart-v10/about-dart-10.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: About DaRT 10 -description: About DaRT 10 -author: dansimp -ms.assetid: 02378035-58d1-4095-82fe-d60734a746fb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About DaRT 10 - - -DaRT 10 includes the following enhancements and changes as described in this topic. - -## What’s new - - -- **Support for Windows 10** - - You can create DaRT images by using Windows 10. - - **Note**   - For earlier versions of the Windows operating systems, continue to use the earlier versions of DaRT. - - - -- **Windows Defender** - - Windows Defender is now part of the Windows 10 Preinstallation Environment (PE) image. As a result, Windows Defender has been removed from the DaRT 10 toolset. - -## Requirements - - -- **Windows Assessment and Development Kit 10.0** - - Windows Assessment and Development Kit (ADK) 10.0 is a required prerequisite for the DaRT Recovery Image Wizard. Windows ADK 10.0 contains deployment tools that are used to customize, deploy, and service Windows images. It also contains the Windows Preinstallation Environment (Windows PE). - - **Note**   - Windows ADK 10.0 is not required if you are installing only Remote Connection Viewer or Crash Analyzer. - - - -- **Windows 10 Debugging Tools** - - To use the Crash Analyzer tool in DaRT 10, you need the required debugging tools, which are available in the Software Development Kit for Windows 10. - -## Language availability - - -DaRT 10 is available in the following languages: - -- English (United States) en-US - -- French (France) fr-FR - -- Italian (Italy) it-IT - -- German (Germany) de-DE - -- Spanish, International Sort (Spain) es-ES - -- Korean (Korea) ko-KR - -- Japanese (Japan) ja-JP - -- Portuguese (Brazil) pt-BR - -- Russian (Russia) ru-RU - -- Chinese Traditional zh-TW - -- Chinese Simplified zh-CN - -## How to Get MDOP Technologies - - -DaRT 10 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Release Notes for DaRT 10](release-notes-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/accessibility-for-dart-10.md b/mdop/dart-v10/accessibility-for-dart-10.md deleted file mode 100644 index d6f65c76e7..0000000000 --- a/mdop/dart-v10/accessibility-for-dart-10.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for DaRT 10 -description: Accessibility for DaRT 10 -author: dansimp -ms.assetid: 61d7a30c-3551-440d-bdcd-36333052c7b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for DaRT 10 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in alternative formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - - - -## Customer service for people with hearing impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For more information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/administering-dart-10-using-powershell.md b/mdop/dart-v10/administering-dart-10-using-powershell.md deleted file mode 100644 index 566da0b7e9..0000000000 --- a/mdop/dart-v10/administering-dart-10-using-powershell.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Administering DaRT 10 Using PowerShell -description: Administering DaRT 10 Using PowerShell -author: dansimp -ms.assetid: eefe992f-077b-4e4b-8a5d-45b451614d7b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering DaRT 10 Using PowerShell - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 lets you use PowerShell commands to complete various DaRT 10 administrative tasks or to create the DaRT recovery image. - -## Perform DaRT tasks by using PowerShell commands - - -DaRT 10 provides four PowerShell commands that let you do the following: - -- Burn an ISO to a CD, DVD, or USB drive. - -- Allow the source WIM file, which contains a DaRT image, to be converted into an ISO file. - -- Create a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image. - -- Apply a DartConfiguration object to a mounted Windows Image. - -[How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md) - -## Use a PowerShell script to create the recovery image - - -Rather than use the DaRT Recovery Image wizard to create the recovery image, you can use a PowerShell script and specify the parameters you want. - -[How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md) - -## Other resources for administering DaRT 10 using PowerShell - - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/creating-the-dart-10-recovery-image.md b/mdop/dart-v10/creating-the-dart-10-recovery-image.md deleted file mode 100644 index 01bc58f01f..0000000000 --- a/mdop/dart-v10/creating-the-dart-10-recovery-image.md +++ /dev/null @@ -1,266 +0,0 @@ ---- -title: Creating the DaRT 10 Recovery Image -description: Creating the DaRT 10 Recovery Image -author: dansimp -ms.assetid: 173556de-2f20-4ea6-9e29-fc5ccc71ebd7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Creating the DaRT 10 Recovery Image - - -After installing Microsoft Diagnostics and Recovery Toolset (DaRT) 10, you create a DaRT 10 recovery image. The recovery image starts Windows RE, from which you can then start the DaRT tools. You can generate International Organization for Standardization (ISO) files and Windows Imaging Format (WIM) images. In addition, you can use PowerShell to generate scripts that use the settings you select in the DaRT Recovery Image wizard. You can use the script later to rebuild recovery images by using the same settings. The recovery image provides a variety of recovery tools. For a description of the tools, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md). - -After you boot the computer into DaRT, you can run the different DaRT tools to try to diagnose and repair the computer. This section walks you through the process of creating the DaRT recovery image and lets you select the tools and features that you want to include as part of the image. - -You can create the DaRT recovery image by using either of two methods: - -- Use the DaRT Recovery Image wizard, which runs in a Windows environment. - -- Modify an example PowerShell script with the values you want. For more information, see [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md). - -You can write the ISO to a recordable CD or DVD, save it to a USB flash drive, or save it in a format that you can use to boot into DaRT from a remote partition or from a recovery partition. - -Once you have created the ISO image, you can burn it onto a blank CD or DVD (if your computer has a CD or DVD drive). If your computer does not have a drive for this purpose, you can use most generic programs that are used to burn CDs or DVDs. - -## Select the image architecture and specify the path - - -On the Windows 10 Media page, you select whether to create a 32-bit or 64-bit DaRT recovery image. Use the 32-bit Windows to build 32-bit DaRT recovery images, and 64-bit Windows to build 64-bit DaRT recovery images. You can use a single computer to create recovery images for both architecture types, but you cannot create one image that works on both 32-bit and 64-bit architectures. You also indicate the path of the Windows 10 installation media. Choose the architecture that matches the one of the recovery image that you are creating. - -**To select the image architecture and specify the path** - -1. On the **Windows 10 Media** page, select one of the following: - - - If you are creating a recovery image for 64-bit computers, select **Create x64 (64-bit) DaRT image**. - - - If you are creating a recovery image for 32-bit computers, select **Create x86 (32-bit) DaRT image**. - -2. In the **Specify the root path of the Windows 10 <64-bit or 32-bit> install media** box, type the path of the Windows 10 installation files. Use a path that matches the architecture of the recovery image that you are creating. - -3. Click **Next**. - -## Select the tools to include on the recovery image - - -On the Tools page, you can select numerous tools to include on the recovery image. These tools will be available to end users when they boot into the DaRT image. However, if you enable remote connectivity when creating the DaRT image, all of the tools will be available when a help desk worker connects to the end user’s computer, regardless of which tools you chose to include on the image. - -To restrict end-user access to these tools, but still retain full access to the tools through the Remote Connection Viewer, do not select those tools on the Tools page. End users will be able to use only Remote Connection and will be able to see, but not access, any tools that you exclude from the recovery image. - -**To select the tools to include on the recovery image** - -1. On the **Tools** page, select the check box beside each tool that you want to include on the image. - -2. Click **Next**. - -## Choose whether to allow remote connectivity by a help desk - - -On the Remote Connection page, you can choose to enable a help desk worker to remotely connect to and run the DaRT tools on an end user’s computer. The remote connectivity option is then shown as an available option in the Diagnostics and Recovery Toolset window. After help desk workers establish a remote connection, they can run the DaRT tools on the end-user computer from a remote location. - -**To choose whether to allow remote connectivity by help desk workers** - -1. On the **Remote Connection** page, select the **Allow remote connections** check box to allow remote connections, or clear the check box to prevent remote connections. - -2. If you cleared the **Allow remote connections** check box, click **Next**. Otherwise, go to the next step to continue configuring remote connectivity. - -3. Select one of the following: - - - Let Windows choose an open port number. - - - Specify the port number. If you select this option, enter a port number between 1 and 65535 in the field beneath the option. This port number will be used when establishing a remote connection. We recommend that the port number be 1024 or higher to minimize the possibility of a conflict. - -4. (Optional) in the **Remote connection welcome** message box, create a customized message that end users receive when they establish a remote connection. The message can be a maximum of 2048 characters. - -5. Click **Next**. - - For more information about running the DaRT tools remotely, see [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md). - -## Add drivers to the recovery image - - -On the Drivers tab of the Advanced Options page, you can add additional device drivers that you may need when repairing a computer. These may typically include storage or network controllers that Windows 10 does not provide. Drivers are installed when the image is created. - -**Important**   -When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT. - - - -**To add drivers to the recovery image** - -1. On the **Advanced Options** page, click the **Drivers** tab. - -2. Click **Add**. - -3. Browse to the file to be added for the driver, and then click **Open**. - - **Note**   - The driver file is provided by the manufacturer of the storage or network controller. - - - -4. Repeat Steps 2 and 3 for every driver that you want to include. - -5. Click **Next**. - -## Add WinPE optional packages to the recovery image - - -On the WinPE tab of the Advanced Options page, you can add WinPE optional packages to the DaRT image. These packages are part of the Windows ADK, which is an installation prerequisite for the DaRT Recovery Image wizard. The tools that you can select are all optional. Any required packages are added automatically, based on the tools you selected on the Tools page. - -You can also specify the size of the scratch space. Scratch space is the amount of RAM disk space that is set aside for DaRT to run. The scratch space is useful in case the end user’s hard disk is not available. If you are running additional tools and drivers, you may want to increase the scratch space. - -**To add WinPE optional packages to the recovery image** - -1. On the **Advanced Options** page, click the **WinPE** tab. - -2. Select the check box beside each package that you want to include on the image, or click the **Name** check box to select all of the packages. - -3. In the **Scratch Space** field, select the amount of RAM disk space to allocate for running DaRT in case the end user’s hard disk is not available. - -4. Click **Next**. - -## Add the debugging tools for Crash Analyzer - - -If you include the Crash Analyzer tool in the ISO image, you must also include the Debugging Tools for Windows. On the Crash Analyzer tab of the Advanced Options page, you enter the path of the Windows 10 Debugging Tools, which Crash Analyzer uses to analyze memory dump files. You can use the tools that are on the computer where you are running the DaRT Recovery Image wizard, or you can use the tools that are on the end-user computer. If you decide to use the tools on the end-user computer, remember that every computer that you diagnose must have the Debugging Tools installed. - -If you installed the Microsoft Windows Software Development Kit (SDK) or the Microsoft Windows Development Kit (WDK), the Windows 10 Debugging Tools are added to the recovery image by default, and the path to the Debugging Tools is automatically filled in. You can change the path of the Windows 10 Debugging Tools if the files are located somewhere other than the location indicated by the default file path. A link in the wizard lets you download and install debugging tools for Windows if they are not already installed. - -To download the Windows Debugging Tools, see [Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=266248). Install the Debugging Tools to the default location. - -**Note**   -The DaRT wizard checks for the tools in the `HKLM\Software\Microsoft\Windows Kits\Installed Roots\WindowsDebuggersRoot` registry key. If the registry value is not there, the wizard looks in one of the following locations, depending on your system architecture: - -`%ProgramFilesX86%\Windows Kits\10.0\Debuggers\x64` - -`%ProgramFilesX86%\Windows Kits\10.0\Debuggers\x86` - - - -**To add the debugging tools for Crash Analyzer** - -1. On the **Advanced Options** page, click the **Crash Analyzer** tab. - -2. (Optional) Click **Download the Debugging Tools** to download the Debugging Tools for Windows. - -3. Select one of the following options: - - - **Include the Windows 10 <64-bit or 32-bit> Debugging Tools**. If you select this option, browse to and select the location of the tools if the path is not already displaying. - - - **Use the Debugging Tools from the system that is being debugged**. If you select this option, the Crash Analyzer will not work if the Debugging Tools for Windows are not found on the problem computer. - -4. Click **Next**. - -## Select the types of recovery image files to create - - -On the Create Image page, you choose an output folder for the recovery image, enter an image name, and select the types of DaRT recovery image files to create. During the recovery image creation process, Windows source files are unpacked, DaRT files are copied to it, and the image is then “re-packed” into the file formats that you select on this page. - -The available image file types are: - -- **Windows Imaging File (WIM)** - used to deploy DaRT to a preboot execution environment (PXE) or local partition). - -- **International Standards Organization (ISO)** – used to deploy to CD or DVD, or for use in virtual machines (VM)s). The wizard requires that the ISO image have an .iso file name extension because most programs that burn a CD or DVD require that extension. If you do not specify a different location, the ISO image is created on your desktop with the name DaRT10.ISO. - -- **PowerShell script** – creates a DaRT recovery image with commands that provide essentially the same options that you can select by using the DaRT Recovery Image wizard. The script also enables you to add or changes files in the DaRT recovery image. - -If you select the Edit Image check box on this page, you can customize the recovery image during the image creation process. For example, you can change the “winpeshl.ini” file to create a custom startup order or to add third-party tools. - -**To select the types of recovery image files to create** - -1. On the **Create Image** page, click **Browse** to choose the output folder for the image file. - - **Note**   - The size of the image will vary, depending on the tools that you select and the files that you add in the wizard. - - - -2. In the **Image name** box, enter a name for the DaRT recovery image, or accept the default name, which is DaRT10. - - The wizard creates a subfolder in the output path by this name. - -3. Select the types of image files that you want to create. - -4. Choose one of the following: - - - To change the files in the recovery image before you create the image files, select the **Edit Image** check box, and then click **Prepare**. - - - To create the recovery image without changing the files, click **Create**. - -5. - - Click **Next**. - -## Edit the recovery image files - - -You can edit the recovery image only if you selected the Edit Image check box on the Create Image page. After the recovery image has been prepared for editing, you can add and modify the recovery image files before creating the bootable media. For example, you can create a custom order for startup, add various third-party tools, and so on. - -**To edit the recovery image files** - -1. On the **Edit Image** page, click **Open** in Windows Explorer. - -2. Create a subfolder in the folder that is listed in the dialog box. - -3. Copy the files that you want to the new subfolder, or remove files that you don’t want. - -4. Click **Create** to start creating the recovery image. - -## Generate the recovery image files - - -On the Generate Files page, the DaRT recovery image is generated for the file types that you selected on the Create Image page. - -**To generate the recovery image files** - -- On the **Generate Files** page, click **Next** to generate the recovery image files. - -## Copy the recovery image to a CD, DVD, or USB - - -On the Create Bootable Media page, you can optionally copy the image file to a CD, DVD, or USB flash drive (UFD). You can also create additional bootable media from this page by restarting the wizard. - -**Note**   -The Preboot execution environment (PXE) and local image deployment are not supported natively by this tool since they require additional enterprise tools, such as System Center Configuration Manager server and Microsoft Development Toolkit. - - - -**To copy the recovery image to a CD, DVD, or USB** - -1. On the **Create Bootable Media** page, select the iso file that you want to copy. - -2. Insert a CD, DVD, or USB, and then select the drive. - - **Note**   - If a drive is not recognized and you install a new drive, you can click **Refresh** to force the wizard to update the list of available drives. - - - -3. Click the **Create Bootable Media** button. - -4. To create another recovery image, click Restart, or click **Close** if you have finished creating all of the media that you want. - -## Related topics - - -[Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/dart-10--c--page.md b/mdop/dart-v10/dart-10--c--page.md deleted file mode 100644 index edbc333edd..0000000000 --- a/mdop/dart-v10/dart-10--c--page.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: DaRT 10 -description: DaRT 10 -author: dansimp -ms.assetid: 4f62abe6-d971-44b4-b1e7-9dcaf199ca31 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 10 - - -## Copyright - - -This document is provided "as-is". Information and views expressed in this document, including URL and other Internet website references, may change without notice. - -Some examples depicted herein are provided for illustration only and are fictitious.  No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. - -This document is confidential and proprietary to Microsoft. It is disclosed and can be used only pursuant to a non-disclosure agreement. - - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - -## Revision History - - - ---- - - - - - - - - - - - - -
    Release DateChanges

    Month dd, yyyy

    Original release of this guide.

    - -  - -  - -  - - - - - diff --git a/mdop/dart-v10/dart-10-cover-page.md b/mdop/dart-v10/dart-10-cover-page.md deleted file mode 100644 index 93162131d7..0000000000 --- a/mdop/dart-v10/dart-10-cover-page.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: DaRT 10 -description: DaRT 10 -author: dansimp -ms.assetid: 875f6dc4-13f4-4625-8c6a-38215c2daf01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 10 - - -![mbam logo](images/mbam-logo-sm.gif) - -## Administrator’s Guide for <Product Name> - - -Published: *<date published>* - -*Include an executive summary overview of the product, here.* - -This guide describes how to install and use *<Product Name>*. This guide is intended for administrators and IT personnel. - -For the most current documentation for *<Product Name>*, see the *insert link here* home page. - -For the release notes for *<Product Name>*, see *insert link here*. - -### Feedback - -Send suggestions and comments about this document to . - -  - -  - - - - - diff --git a/mdop/dart-v10/dart-10-deployment-checklist.md b/mdop/dart-v10/dart-10-deployment-checklist.md deleted file mode 100644 index 51c0fb097f..0000000000 --- a/mdop/dart-v10/dart-10-deployment-checklist.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 10 Deployment Checklist -description: DaRT 10 Deployment Checklist -author: dansimp -ms.assetid: a6b7ba27-a969-4da9-bef0-d019739413cc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 10 Deployment Checklist - - -This checklist can be used to help you during Microsoft Diagnostics and Recovery Toolset (DaRT) 10 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferences
    Checklist box

    Decide on the best DaRT 10 deployment option for your requirements and deploy it.

    Deploying DaRT 10 to Administrator Computers

    Checklist box

    Use the DaRT Recovery Image wizard to create the DaRT recovery image ISO.

    Creating the DaRT 10 Recovery Image

    Checklist box

    Decide on the best DaRT 10 recovery image deployment option for your requirements and deploy it.

    Deploying the DaRT Recovery Image

    - - - -## Related topics - - -[Deploying DaRT 10](deploying-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/dart-10-planning-checklist.md b/mdop/dart-v10/dart-10-planning-checklist.md deleted file mode 100644 index 5db8a262f5..0000000000 --- a/mdop/dart-v10/dart-10-planning-checklist.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 10 Planning Checklist -description: DaRT 10 Planning Checklist -author: dansimp -ms.assetid: d6482534-cdf3-4997-bec0-33d0edf6924a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 10 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Diagnostics and Recovery Toolset (DaRT) 10 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferences
    Checklist box

    Review the DaRT 10 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.

    DaRT 10 Supported Configurations

    Checklist box

    Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.

    Planning to Create the DaRT 10 Recovery Image

    Checklist box

    Determine which method, or methods, you will use to deploy the DaRT recovery image.

    Planning How to Save and Deploy the DaRT 10 Recovery Image

    - - - -## Related topics - - -[Planning for DaRT 10](planning-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/dart-10-privacy-statement.md b/mdop/dart-v10/dart-10-privacy-statement.md deleted file mode 100644 index ee32260042..0000000000 --- a/mdop/dart-v10/dart-10-privacy-statement.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: DaRT 10 Privacy Statement -description: DaRT 10 Privacy Statement -author: dansimp -ms.assetid: 27ad36fe-6816-4fe8-8838-500c05b5b184 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# DaRT 10 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft Diagnostics and Recovery Toolset (“DaRT”). This disclosure focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft Diagnostics and Recovery Toolset (“DaRT”) enables administrators to easily recover PCs that have become unusable, rapidly diagnose probable causes of issues, and quickly repair unbootable or locked-out systems, all faster than the average time it takes to reimage the machine. When necessary, you can also quickly restore critical lost files. This release provides support for Windows 10 as well as improvements on image creation and new hardware and software coverage. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by DaRT may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -The privacy details for each DaRT feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of your information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to this privacy statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please [contact us](https://go.microsoft.com/fwlink/?LinkID=245853). - -Microsoft PrivacyMicrosoft CorporationOne Microsoft WayRedmond, Washington 98052 USA - -## Specific Features - - -## Microsoft Update - - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Use of Information:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Choice/Control:** - -For details about controlling this feature, see the Update Services Privacy Statement at [https://go.microsoft.com/fwlink/?LinkId=244000](https://go.microsoft.com/fwlink/?LinkId=244400). - -## Related topics - - -[Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/dart-10-supported-configurations.md b/mdop/dart-v10/dart-10-supported-configurations.md deleted file mode 100644 index 0a20396771..0000000000 --- a/mdop/dart-v10/dart-10-supported-configurations.md +++ /dev/null @@ -1,307 +0,0 @@ ---- -title: DaRT 10 Supported Configurations -description: DaRT 10 Supported Configurations -author: dansimp -ms.assetid: a07d6562-1fa9-499f-829c-9cc487ede0b7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# DaRT 10 Supported Configurations - - -This topic specifies the prerequisite software and supported configurations requirements that are necessary to install and run Microsoft Diagnostics and Recovery Toolset (DaRT) 10 in your environment. Both the operating system requirements and the system requirements that are required to run DaRT 10 are specified. For information about prerequisites that you need to consider to create the DaRT recovery image, see [Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md). - -For supported configurations that apply to later releases, see the documentation for the applicable release. - -You can install DaRT in one of two ways. You can install all functionality on an IT administrator computer, where you will perform all the tasks associated with running DaRT. Alternatively, you can install, on the administrator computer, only the DaRT functionality that creates the recovery image, and then install the functionality used to run DaRT (that is, the DaRT Remote Connection Viewer) on a help desk computer. - -## DaRT 10 prerequisite software - - -Make sure that the following prerequisites are met before you install DaRT. - -### Administrator computer prerequisites - -The following table lists the installation prerequisites for the administrator computer when you are installing DaRT 10 and all of the DaRT tools. - - ---- - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Windows Assessment and Development Kit (ADK)

    Required for the DaRT Recovery Image wizard. Contains the Deployment Tools, which are used to customize, deploy, and service Windows images, and contains the Windows Preinstallation Environment (Windows PE). The ADK is not required if you are installing only the Remote Connection Viewer and/or Crash Analyzer.

    Windows Development Kit OR Software Development Kit (optional)

    Crash Analyzer requires the Windows 10 Debugging Tools from the Windows Driver Kit to analyze memory dump files.

    Windows 10 64-bit or 32-bit ISO image

    DaRT requires the Windows Recovery Environment (Windows RE) image from the Windows 10 media. Download the 32-bit or 64-bit version of Windows 10, depending on the type of DaRT recovery image you want to create. If you support both system types in your environment, download both versions of Windows 10.

    - - - -### Help desk computer prerequisites - -The following table lists the installation prerequisites for the help desk computer when you are running the DaRT 10 Remote Connection Viewer. - - ---- - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    DaRT 10 Remote Connection Viewer

    Must be installed on a Windows 10 operating system.

    Debugging Tools for Windows

    Required only if you are installing the Crash Analyzer tool

    - - - -### End-user computer prerequisites - -There is no prerequisite software that must be installed on end-user computers, other than the Windows 10 operating system. - -## DaRT 10 operating system requirements - - -### Administrator computer system requirements - -The following table lists the operating systems that are supported for the DaRT 10 administrator computer installation. - -**Note**   -Make sure that you allocate enough space for any additional tools that you want to install on the administrator computer. - - - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirement for Running DaRT

    Windows 10

    All editions

    N/A

    64-bit

    2 GB

    2.5 GB

    Windows 10

    All editions

    N/A

    32-bit

    1 GB

    1.5 GB

    - - - -### DaRT help desk computer system requirements - -If you allow a help desk to remotely troubleshoot computers, you must have the Remote Connection Viewer installed on the help desk computer. You can optionally install the Crash Analyzer tool on the help desk computer. - -DaRT 10 enables a help desk worker to connect to a DaRT 10 computer by using either the DaRT 7.0, DaRT 8.0, DaRt 8.1, or DaRT 10 Remote Connection Viewer. The DaRT 7.0, DaRT 8.0 and DaRt 8.1, Remote Connection Viewers require Windows 7, Windows 8, or Windows 8.1 operating systems respectively, while the DaRT 10 Remote Connection Viewer requires Windows 10. The DaRT 10 Remote Connection Viewer and all other DaRT 10 tools can be installed only on a computer running Windows 10. - -The following table lists the operating systems that are supported for the DaRT help desk computer installation. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirements for Running DaRT

    Windows 10

    All editions

    N/A

    64-bit

    2 GB

    2.5 GB

    Windows 10 (with Remote Connection Viewer 10.0 only)

    All editions

    N/A

    32-bit

    1 GB

    1.5 GB

    Windows 8

    All editions

    N/A

    64-bit

    2 GB

    2.5 GB

    Windows 8 (with Remote Connection Viewer 8.0 only)

    All editions

    N/A

    32-bit

    1 GB

    1.5 GB

    Windows 7 (with Remote Connection Viewer 7.0 only)

    All editions

    SP1, SP2

    64-bit or 32-bit

    1 GB

    N/A

    Windows Server 2012

    Standard, Enterprise, Data Center

    N/A

    64-bit

    2 GB

    1.0 GB

    Windows Server 2012 R2

    Standard, Enterprise, Data Center

    N/A

    64-bit

    2 GB

    1.0 GB

    - - - -DaRT also has the following minimum hardware requirements for the end-user computer: - -A CD or DVD drive or a USB port - required only if you are deploying DaRT in your enterprise by using a CD, DVD, or USB. - -BIOS support for starting the computer from a CD or DVD, a USB flash drive, or from a remote or recovery partition. - -### DaRT 10 end-user computer system requirements - -The Diagnostics and Recovery Toolset window in DaRT 10 requires that the end-user computer use one of the following operating systems together with the specified amount of system memory available for DaRT: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirements

    Windows 10

    All editions

    N/A

    64-bit

    2 GB

    2.5 GB

    Windows 10

    All editions

    N/A

    32-bit

    1 GB

    1.5 GB

    - - - -## Related topics - - -[Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md b/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md deleted file mode 100644 index 84b8e13959..0000000000 --- a/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying DaRT 10 to Administrator Computers -description: Deploying DaRT 10 to Administrator Computers -author: dansimp -ms.assetid: c1981cbe-10f8-41f6-8989-bcc9d57a2aa8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying DaRT 10 to Administrator Computers - - -Before you begin the deployment of Microsoft Diagnostics and Recovery Toolset (DaRT) 10, review the requirements for your environment. This includes the hardware requirements for installing DaRT 10. For more information about DaRT hardware and software requirements, see [DaRT 10 Supported Configurations](dart-10-supported-configurations.md). - -The topics in this section can be used to help you deploy DaRT in your enterprise based on your environment and deployment strategy. - -## Deploy DaRT 10 - - -You can use the Windows Installer file for DaRT to install DaRT on a computer that you will use to first create the DaRT recovery image and then troubleshoot and fix end-user computers. Frequently, across an organization, you might install on the administrator computer only the DaRT functionality that you need to create a DaRT recovery image. Then, on a help desk administrator’s computer, you might install only the DaRT functionality that you must have to troubleshoot a problem computer, such as the DaRT Remote Connection Viewer and the Crash Analyzer. - -In addition to manually running the Windows Installer file to install DaRT, you can also install DaRT at the command prompt to support enterprise software deployment systems such as System Center Configuration Manager 2012. - -[How to Deploy DaRT 10](how-to-deploy-dart-10.md) - -## Change, repair, or remove DaRT 10 - - -You can change, repair, or remove the DaRT installation by double-clicking the DaRT installation file and then clicking the button that corresponds to the action that you want to perform or through the Windows Control Panel. - -[How to Change, Repair, or Remove DaRT 10](how-to-change-repair-or-remove-dart-10.md) - -## How to get DaRT 10 - - -To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for deploying DaRT 10 to administrator computers - - -[Deploying DaRT 10](deploying-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/deploying-dart-10.md b/mdop/dart-v10/deploying-dart-10.md deleted file mode 100644 index ba270e3a87..0000000000 --- a/mdop/dart-v10/deploying-dart-10.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Deploying DaRT 10 -description: Deploying DaRT 10 -author: dansimp -ms.assetid: 92cf70fd-006f-4fdc-9fb3-78d9d223148d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying DaRT 10 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 supports a number of different deployment configurations. This section includes information you should consider about the deployment of DaRT 10 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment Information - - -- [Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) - - This section describes the different DaRT deployment options for your requirements and explains how to deploy them. - -- [Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) - - This section describes the methods you can use to create the DaRT recovery image and provides instructions to create the recovery image by using the DaRT Recovery Image wizard. - -- [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) - - This section provides information to help you decide on the best DaRT recovery image deployment option for your requirements and provides instructions on how to deploy the recovery image. - -- [DaRT 10 Deployment Checklist](dart-10-deployment-checklist.md) - - This section contains a deployment checklist that can help you to deploy DaRT. - -### How to get DaRT - -This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/p/?LinkId=322049) (https://go.microsoft.com/fwlink/p/?LinkId=322049). - -## Other Resources for deploying DaRT - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md deleted file mode 100644 index 8bdf2391c1..0000000000 --- a/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Deploying the DaRT Recovery Image -description: Deploying the DaRT Recovery Image -author: dansimp -ms.assetid: 2b859da6-e31a-4240-8868-93a754328cf2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the DaRT Recovery Image - - -After you have created the International Organization for Standardization (ISO) file that contains the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image, you can deploy the DaRT 10 recovery image throughout your enterprise so that it is available to end users and help desk workers. There are four supported methods that you can use to deploy the DaRT recovery image. To review the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md). - -Burn the ISO image file to a CD or DVD by using the DaRT Recovery Image wizard - -Save the contents of the ISO image file to a USB Flash Drive (UFD) by using the DaRT Recovery Image wizard - -Extract the boot.wim file from the ISO image and deploy as a remote partition that is available to end-user computers - -Extract the boot.wim file from the ISO image and deploy in the recovery partition of a new Windows 10 installation - -**Important**   -The **DaRT Recovery Image Wizard** provides the option to burn the image to a CD, DVD or UFD, but the other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section. - - - -## Deploy the DaRT recovery image as part of a recovery partition - - -After you have finished running the DaRT Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 10 image. - -[How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md) - -## Deploy the DaRT recovery image as a remote partition - - -You can host the recovery image on a central network boot server, such as Windows Deployment Services, and allow users or support staff to stream the image to computers on demand. - -[How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md) - -## Other resources for deploying the DaRT recovery image - - -[Deploying DaRT 10](deploying-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md b/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md deleted file mode 100644 index a13df573f8..0000000000 --- a/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Diagnosing System Failures with Crash Analyzer -description: Diagnosing System Failures with Crash Analyzer -author: dansimp -ms.assetid: 7ebef49e-a294-4173-adb1-7e6994aa01ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Diagnosing System Failures with Crash Analyzer - - -The **Crash Analyzer** in Microsoft Diagnostics and Recovery Toolset (DaRT) 10 lets you debug a memory dump file on a Windows-based computer and then diagnose any related computer errors. The **Crash Analyzer** uses the Microsoft Debugging Tools for Windows to examine a memory dump file for the driver that caused the computer to fail. You can run the Crash Analyzer on an end-user computer or in stand-alone mode on a computer other than an end-user computer. - -## Run the Crash Analyzer on an end-user-computer - - -Typically, you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window on an end-user computer that is experiencing the problem. The **Crash Analyzer** tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location, or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -If you included the Microsoft Debugging Tools for Windows and the symbol files when you created the DaRT 10 recovery image, the Tools and symbol files should be available when you run the **Crash Analyzer** on the problem computer. If you did not include them in the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining them, you can alternatively run the Crash Analyzer in stand-alone mode on a computer other than the end user’s computer, as described in the following section. - -[How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md) - -## Run the Crash Analyzer in stand-alone mode on a computer other than an end user’s computer - - -Although you typically run **Crash Analyzer** on the end-user computer that is experiencing the problem, you can also run the Crash Analyzer in stand-alone mode, on a computer other than an end-user computer. You might choose this option if you did not include the Windows Debugging Tools in the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining the Debugging Tools. In this case, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of **Crash Analyzer** installed, such as on a help desk agent’s computer. - -[How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md) - -## How to ensure that Crash Analyzer can access symbol files - - -To debug applications that have stopped responding, you need access to the symbol file, which is separate from the program. Although symbol files are automatically downloaded when you run Crash Analyzer, there might be times when the problem computer does not have access to the Internet. There are several ways to ensure that you have guaranteed access to symbol files. - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md) - -## Other resources for diagnosing system failures with Crash Analyzer - - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/getting-started-with-dart-10.md b/mdop/dart-v10/getting-started-with-dart-10.md deleted file mode 100644 index f81b153367..0000000000 --- a/mdop/dart-v10/getting-started-with-dart-10.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Getting Started with DaRT 10 -description: Getting Started with DaRT 10 -author: dansimp -ms.assetid: 593dd317-4fba-4d51-8a80-951590acede6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with DaRT 10 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 requires thorough planning before you deploy it or use its features. If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. - ->[!NOTE] -> A downloadable version of this administrator’s guide is not available. However, you can click **Download PDF** at the bottom of the Table of Contents pane to get a PDF version of this guide. -> ->Additional information about this product can also be found on the [Diagnostics and Recovery Toolset documentation download page.](https://www.microsoft.com/download/details.aspx?id=27754) - - -## Getting started with DaRT 10 - - -- [About DaRT 10](about-dart-10.md) - - Provides information specifically related to DaRT, including what is new in DaRT 10. - -- [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md) - - Describes the tools in DaRT 10. - -- [Accessibility for DaRT 10](accessibility-for-dart-10.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## How to Get DaRT 10 - - -DaRT 10 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for this product - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md b/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md deleted file mode 100644 index 8bc407173f..0000000000 --- a/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: How to Change, Repair, or Remove DaRT 10 -description: How to Change, Repair, or Remove DaRT 10 -author: dansimp -ms.assetid: e7718c6f-06a1-48bb-b04b-1a0f659a0337 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change, Repair, or Remove DaRT 10 - - -You can change, repair, or remove the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 installation by double-clicking the DaRT 10 installation file and then clicking the button that corresponds to the action that you want to perform. - -You can also change, repair, or remove the DaRT installation using the Windows Control Panel by completing the following steps. - -## To change, repair, or remove DaRT - - -1. Click **Start**, and then click **Control Panel**. - -2. On **Control Panel**, navigate to the feature that lets you uninstall programs. - -3. Click **Microsoft Diagnostics and Recovery Toolset 10**, and then click the button that corresponds to the action that you want to perform. - -## Related topics - - -[Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-deploy-dart-10.md b/mdop/dart-v10/how-to-deploy-dart-10.md deleted file mode 100644 index f911f88b74..0000000000 --- a/mdop/dart-v10/how-to-deploy-dart-10.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Deploy DaRT 10 -description: How to Deploy DaRT 10 -author: dansimp -ms.assetid: 13e8ba20-21c3-4870-94ed-6d3106d69f21 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy DaRT 10 - - -The following instructions explain how to deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 10 in your environment. To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). It is assumed that you are installing all functionality on one administrator computer. If you need to deploy or uninstall DaRT 10 on multiple computers, using an electronic software distribution system, for example, it might be easier to use command line installation options. Descriptions and examples of the available command line options are provided in this section. - -**Important**   -Before you install DaRT, see [DaRT 10 Supported Configurations](dart-10-supported-configurations.md) to ensure that you have installed all of the prerequisite software and that the computer meets the minimum system requirements. The computer onto which you install DaRT must be running Windows 10. - - - -You can install DaRT using one of two different configurations: - -- Install DaRT and all of the DaRT tools on the administrator computer. - -- Install on the administrator computer only the tools that you need to create the DaRT recovery image, and then install the **Remote Connection Viewer** and, optionally, **Crash Analyzer** on a help desk computer. - -The DaRT installation file is available in both 32-bit and 64-bit versions. Install the version that matches the architecture of the computer on which you are running the DaRT Recovery Image wizard, not the computer architecture of the recovery image that you are creating. - -You can use either version of the DaRT installation file to create a recovery image for either 32-bit or 64-bit computers, but you cannot create one recovery image for both 32-bit and 64-bit computers. - -**To install DaRT and all DaRT tools on an administrator computer** - -1. Download the 32-bit or 64-bit version of the DaRT 10 installer file. Choose the architecture that matches the computer on which you are installing DaRT and running the DaRT Recovery Image wizard. - -2. From the folder into which you downloaded DaRT 10, run the **MSDaRT.msi** installation file that corresponds to your system requirements. - -3. On the **Welcome to the Microsoft DaRT 10 Setup Wizard** page, click **Next**. - -4. Accept the Microsoft Software License Terms, and then click **Next**. - -5. On the **Microsoft Update** page, select **Use Microsoft Update when I check for updates**, and then click **Next**. - -6. On the **Select Installation Folder** page, select a folder, or click **Next** to install DaRT in the default installation location. - -7. On the **Setup Options** page, select the DaRT features that you want to install, or click **Next** to install DaRT with all of the features. - -8. To start the installation, click **Install**. - -9. After the installation has completed successfully, click **Finish** to exit the wizard. - -## To install DaRT and all DaRT tools on an administrator computer by using a command prompt - - -When you install or uninstall DaRT, you have the option of running the installation files at the command prompt. This section describes some examples of different options that you can specify when you install or uninstall DaRT at the command prompt. - -The following example shows how to install all DaRT functionality. - -``` syntax -msiexec /i MSDaRT.msi ADDLOCAL=CommonFiles, DaRTRecoveryImage,CrashAnalyzer,RemoteViewer -``` - -The following example shows how to install only the DaRT Recovery Image wizard. - -``` syntax -msiexec /i MSDaRT.msi ADDLOCAL=CommonFiles, ,DaRTRecoveryImage -``` - -The following example shows how to install only the Crash Analyzer and the DaRT Remote Connection Viewer. - -``` syntax -msiexec /i MSDaRT.msi ADDLOCAL=CommonFiles,CrashAnalyzer,RemoteViewer -``` - -The following example creates a setup log for the Windows Installer. This is valuable for debugging. - -``` syntax -msiexec.exe /i MSDaRT.msi /l*v log.txt -``` - -**Note**   -You can add /qn or /qb to perform a silent installation. - - - -**To validate the DaRT installation** - -1. Click **Start**, and select **Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. - -2. Check that all of the DaRT tools that you selected for installation were successfully installed. - -## Related topics - - -[Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md deleted file mode 100644 index 8d2a4a4426..0000000000 --- a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as a Remote Partition -description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: dansimp -ms.assetid: 06a5e250-b992-4f6a-ad74-e7715f9e96e7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as a Remote Partition - - -After you have finished running the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a remote partition on the network. - -**To deploy DaRT 10 as a remote partition** - -1. Extract the boot.wim file from the DaRT ISO image file. - - 1. Mount the ISO image file that you created in the **Create Startup Image** dialog box by using your company’s preferred method of mounting an image. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image. - - - -2. Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise. - -3. Configure the WDS server to use the boot.wim file for DaRT by following your standard WDS deployment procedures. - -For more information about how to deploy DaRT as a remote partition, see [Walkthrough: Deploy an Image by Using PXE](https://go.microsoft.com/fwlink/?LinkId=212108) and [Windows Deployment Services Getting Started Guide](https://go.microsoft.com/fwlink/?LinkId=212106). - -## Related topics - - -[Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) - -[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md deleted file mode 100644 index a147d07a7b..0000000000 --- a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: dansimp -ms.assetid: 0d2192c1-4058-49fb-b0b6-baf4699ac7f5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as Part of a Recovery Partition - - -After you have finished running the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 10 image. A partition is recommended, because any corruption issues that prevent the Windows operating system from starting would also prevent the recovery image from starting. A separate partition also eliminates the need to provide the BitLocker recovery key twice. Consider hiding the partition to prevent users from storing files on it. - -**To deploy DaRT in the recovery partition of a Windows 10 image** - -1. Create a target partition in your Windows 10 image that is equal to or greater than the size of the ISO image file that you created by using the **DaRT 10 Recovery Image wizard**. - - The minimum size required for a DaRT partition is 500MB to accommodate the remote connection functionality in DaRT. - -2. Extract the boot.wim file from the DaRT ISO image file. - - 1. Using your company’s preferred method, mount the ISO image file that you created on the **Create Startup Image** page. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD, DVD, or USB of the recovery image, you can open the files on the removable media and copy the boot.wim file from the \\sources folder. If you copy boot.wim file, you don’t need to mount the image. - - - -3. Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image. - - For more information about how to create or customize a recovery partition, see [Customizing the Windows RE Experience](https://go.microsoft.com/fwlink/?LinkId=214222). - -4. Replace the target partition in your Windows 10 image with the recovery partition. - - For more information about how to deploy a recovery solution to reinstall the factory image in the event of a system failure, see [Deploy a System Recovery Image](https://go.microsoft.com/fwlink/?LinkId=214221). - -## Related topics - - -[Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md) - -[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md b/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md deleted file mode 100644 index 4d6c8d968c..0000000000 --- a/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Ensure that Crash Analyzer Can Access Symbol Files -description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: dansimp -ms.assetid: 39e307bd-5d21-4e44-bed6-bf532f580775 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Ensure that Crash Analyzer Can Access Symbol Files - - -Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding. - -Symbol files are automatically downloaded when you run **Crash Analyzer**. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -**To ensure that Crash Analyzer can access symbol files** - -1. **Copy the dump file to another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, copy the memory dump file to a computer that does have an Internet connection and run the stand-alone **Crash Analyzer Wizard** on that computer. - -2. **Access the symbol files from another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, you can download the symbols from a computer that does have an Internet connection and then copy them to the computer that does not have an Internet connection, or you can map a network drive to a location where the symbols are available on the local network. If you run the **Crash Analyzer** in a Windows Recovery Environment (Windows RE), you can include the symbol files on the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image. - -3. **Access symbol files through an HTTP proxy server.** If the symbols cannot be downloaded because an HTTP proxy server must be accessed, use the following steps to access an HTTP proxy server. In DaRT 10, the **Crash Analyzer Wizard** has a setting available on the **Specify Symbol Files Location** dialog page, marked with the label **Proxy server (optional, using the format "server:port")**. You can use this text box to specify a proxy server. Enter the proxy address in the form **<hostname>:<port>**, where the <**hostname**> is a DNS name or IP address, and the <**port**> is a TCP port number. There are two modes in which the **Crash Analyzer** can be run. Following is how you use the proxy setting in each of these modes: - - - **Online mode:** In this mode, if the proxy server field is left blank, the wizard uses the proxy settings from Internet Options in Control Panel. If you enter a proxy address in the text box which is provided, that address will be used, and it will override the setting in the Internet Options. - - - Windows Recovery Environment (Windows RE): When you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window, there is no default proxy address. If the computer is directly connected to the Internet, a proxy address is not required. Therefore, you can leave this field blank in the wizard setting. If the computer is not directly connected to the Internet, and it is in a network environment that has a proxy server, you must set the proxy field in the wizard to access the symbol store. The proxy address can be obtained from the network administrator. Setting the proxy server is important only when the public symbol store is connected to the Internet. If the symbols are already on the DaRT recovery image, or if they are available locally, setting the proxy server is not required. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md b/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md deleted file mode 100644 index f53350ad55..0000000000 --- a/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Perform DaRT Tasks by Using PowerShell Commands -description: How to Perform DaRT Tasks by Using PowerShell Commands -author: dansimp -ms.assetid: f5a5c5f9-d667-4c85-9e82-7baf0b2aec6e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform DaRT Tasks by Using PowerShell Commands - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 provides the following listed set of Windows PowerShell cmdlets. Administrators can use these PowerShell cmdlets to perform various DaRT 10 server tasks from the command prompt rather than from the DaRT Recovery Image wizard. - -## To administer DaRT by using PowerShell commands - - -Use the PowerShell cmdlets described here to administer DaRT. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Copy-DartImage

    Burns an ISO to a CD, DVD, or USB drive.

    Export-DartImage

    Allows the source WIM file, which contains a DaRT image, to be converted into an ISO file.

    New-DartConfiguration

    Creates a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image.

    Set-DartImage

    Applies a DartConfiguration object to a mounted Windows Image. This includes adding all files, configuration, and package dependencies.

    - -  - -## Related topics - - -[Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md deleted file mode 100644 index 443db6f54f..0000000000 --- a/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: How to Recover Local Computers by Using the DaRT Recovery Image -description: How to Recover Local Computers by Using the DaRT Recovery Image -author: dansimp -ms.assetid: a6adc717-827c-45e8-b9c3-06d0e919e0bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover Local Computers by Using the DaRT Recovery Image - - -Use these instructions to recover a computer when you are physically present at the end-user computer that is experiencing problems. - -**How to recover a local computer by using the DaRT recovery image** - -1. Boot the end-user computer by using the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image. - - As the computer is booting into the DaRT 10 recovery image, the **NetStart** dialog box appears. - -2. When you are asked whether you want to initialize network services, select one of the following: - - **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - **No** - skip the network initialization process. - -3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. On the **System Recovery Options** dialog box, select a keyboard layout. - -5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver. - -6. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 10 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created. - -You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides. - -For general information about any of the DaRT tools, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md). - -**How to run DaRT at the command prompt** - -- To run DaRT at the command prompt, specify the **netstart.exe** command then use any of the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - -

    Parameter

    Description

    -network

    Initializes the network services.

    -remount

    Remaps the drive letters.

    -prompt

    Displays messages that ask the end user to specify whether to initialize the network and remap the drives.

    -
    - Warning

    The end user’s response to the prompt overrides the –network and –remount switches.

    -
    -
    - -
    - - - -## Related topics - - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md deleted file mode 100644 index 90f2db33d1..0000000000 --- a/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md +++ /dev/null @@ -1,207 +0,0 @@ ---- -title: How to Recover Remote Computers by Using the DaRT Recovery Image -description: How to Recover Remote Computers by Using the DaRT Recovery Image -author: dansimp -ms.assetid: c0062208-39cd-4e01-adf8-36a11386e2ea -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Recover Remote Computers by Using the DaRT Recovery Image - - -Use the Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 10 to run the DaRT tools remotely on an end-user computer. After the end user provides the administrator or help desk worker with certain information, the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely. - -If you disabled the DaRT tools when you created the recovery image, you still have access to all of the tools. All of the tools, except Remote Connection, are unavailable to end users. - -**To recover a remote computer by using the DaRT recovery image** - -1. Boot an end-user computer by using the DaRT recovery image. - - You will typically use one of the following methods to boot into DaRT to recover a remote computer, depending on how you deploy the DaRT recovery image. For more information about deploying the DaRT recovery image, see [Deploying DaRT 10](deploying-dart-10.md). - - - Boot into DaRT from a recovery partition on the problem computer. - - - Boot into DaRT from a remote partition on the network. - - For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md). - - Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - - **Note** - Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -~~~ -As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. -~~~ - -2. When you are asked whether you want to initialize network services, select one of the following: - - **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - **No** - skip the network initialization process. - -3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. On the **System Recovery Options** dialog box, select a keyboard layout. - -5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver. - -6. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 10 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 10](troubleshooting-dart-10.md). - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**. - -8. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**. - - The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information. - -9. On the help desk computer, open the **DaRT Remote Connection Viewer**. - -10. Click **Start**, click **All Programs**, click **Microsoft DaRT 10**, and then click **DaRT Remote Connection Viewer**. - -11. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information. - - **Note** - This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer. - - - -12. Click **Connect**. - -The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely. - -**Note** -A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32. - - - -**To customize the Remote Connection process** - -1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413). - - Specify the following commands and parameters to customize how a remote connection is established with an end-user computer: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandParameterDescription

    RemoteRecovery.exe

    -nomessage

    Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.

    WaitForConnection.exe

    none

    Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.

    -
    - Important

    This command serves no function if it is specified independently. It must be specified in a script to function correctly.

    -
    -
    - -
    - - - -2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT: - - ```ini - [LaunchApps] - "%windir%\system32\netstart.exe -network -remount" - "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage" - "%windir%\system32\WaitForConnection.exe" - "%SYSTEMDRIVE%\sources\recovery\recenv.exe" - ``` - -When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the RAM disk. This file contains connection information: IP address, port, and ticket number. You can copy this file to a network share to trigger a Help desk workflow. For example, a custom program can check the network share for connection files, and then create a support ticket or send email notifications. - -**To run the Remote Connection Viewer at the command prompt** - -1. To run the **DaRT Remote Connection Viewer** at the command prompt, specify the **DartRemoteViewer.exe** command and use the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    -ticket=<ticketnumber>

    Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection.

    -ipaddress=<ipaddress>

    Where <ipaddress> is the IP address that is generated by Remote Connection.

    -port=<port>

    Where <port> is the port that corresponds to the specified IP address.

    - - - -~~~ -**Note** -The variables for these parameters are created on the end-user computer and must be provided by the end user. -~~~ - - - -2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified. - -## Related topics - - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md b/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md deleted file mode 100644 index 1d01911abd..0000000000 --- a/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: dansimp -ms.assetid: 27c1e1c6-123a-4f8a-b7d2-5bddc9ca3249 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer - - -If you cannot access the Microsoft Debugging Tools for Windows or the symbol files on the end-user computer, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of Crash Analyzer installed, such as a help desk computer that contains Microsoft Diagnostics and Recovery Toolset (DaRT) 10. - -To run Crash Analyzer in stand-alone mode, you copy the memory dump file from the problem computer and analyze it on another computer, such as a help desk computer, that has the **Crash Analyzer** installed. - -**To run the Crash Analyzer in stand-alone mode** - -1. On a computer that has DaRT 10 installed, click **Start**, type **Crash Analyzer**, and then click **Crash Analyzer**. - -2. Follow the steps in the wizard, as described in [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md). - -## Related topics - - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md b/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md deleted file mode 100644 index 7f67229645..0000000000 --- a/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Run the Crash Analyzer on an End-user Computer -description: How to Run the Crash Analyzer on an End-user Computer -author: dansimp -ms.assetid: 10334800-ff8e-43ac-a9c2-d28807473ec2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Run the Crash Analyzer on an End-user Computer - - -To run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window on an end-user computer that is experiencing problems, you must have the Microsoft Debugging Tools for Windows and the symbol files installed. To download the Windows Debugging Tools, see [Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=266248). - -**To run the Crash Analyzer on an end-user computer** - -1. On the **Diagnostics and Recovery Toolset** window on an end-user computer, click **Crash Analyzer**. - -2. Provide the required information for the Microsoft Debugging Tools for Windows. - -3. Provide the required information for the symbol files. For more information about symbol files, see [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md). - -4. Provide the required information for a memory dump file. To determine the location of the memory dump file: - - 1. Open the **System Properties** window. - - 2. Click **Start**, type **sysdm.cpl**, and then press **Enter**. - - 3. Click the **Advanced** tab. - - 4. In the **Startup and Recovery** area, click **Settings**. - - If you do not have access to the **System Properties** window, you can search for dump files on the end-user computer by using the **Search** tool in Microsoft Diagnostics and Recovery Toolset (DaRT) 10. - - The **Crash Analyzer** scans the memory dump file and reports a probable cause of the problem. You can view more information about the failure, such as the specific memory dump message and description, the drivers loaded at the time of the failure, and the full output of the analysis. - -5. Identify the appropriate strategy to resolve the problem. The strategy may require disabling or updating the device driver that caused the failure by using the **Services and Drivers** node of the **Computer Management** tool in DaRT 10. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md b/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md deleted file mode 100644 index 0b1feb848a..0000000000 --- a/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Use a PowerShell Script to Create the Recovery Image -description: How to Use a PowerShell Script to Create the Recovery Image -author: dansimp -ms.assetid: cf5b0814-71a8-4f0b-b1f1-1ac6d8b51c4f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use a PowerShell Script to Create the Recovery Image - - -## To create the DaRT recovery image by using a PowerShell script - - -You can create the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image by using a PowerShell script instead of using the DaRT 10 Recovery Image wizard. See the following example script. - -`` - -`This script was auto generated by the Microsoft DaRT Recovery Image Wizard.``###``This script uses the DISM and DaRT PowerShell commands to create a bootable DaRT image.``###Both a WIM and ISO file are produced.``###``### Examples of how to burn/copy the DaRT ISO to DVD/USB are available at the end of this script.``###` - -`$ErrorActionPreference = "Stop";``### This variable tells PowerShell to stop if an error occurs.` - -`###``### Import the modules necessary for DaRT Image creation.``###` - -`Import-Module "Dism"`I`mport-Module "Microsoft.Dart"` - -`###``### Specifies where the Windows 10 media is located and where the ISO and WIM files will be saved.``### These can be changed as necessary.``###` - -`$Win10MediaPath = "D:\";``### This is the path of the Windows 10 media.``$DestinationWimPath = "C:\Users\Administrator\Desktop\DaRT10\x64\boot.wim";``### Specify where the WIM file will be saved.``$DestinationIsoPath = "C:\Users\Administrator\Desktop\DaRT10\x64\DaRT10.iso";``### Specify where the ISO will be saved.` - -`###``### These variables are used to specify temporary and output directories based on the paths above.``###` - -`$WimParentPath = (Split-Path -Path "$destinationWimPath" -Parent);``### Specify the directory where the DaRT WIM file will be saved.``$IsoParentPath = (Split-Path -Path "$destinationIsoPath" -Parent);``### This is the directory where the DaRT ISO file will be saved.``$TempMountPath = "$env:temp\DaRT10Mount_$(Get-Random)";``### Specify the temporary directory used to mount the Windows image.` - -`###``### Prepare the windows image.``###` - -`### Guarantee the output directories exists.``New-Item -Path $WimParentPath -Type Directory -Force``New-Item -Path $IsoParentPath -Type Directory -Force``New-Item -Path $TempMountPath -Type Directory -Force` - -`### Create a copy of the WIM and remove the read-only attribute.``### The WIM file will be the resulting dart image.``Copy-Item "$Win10MediaPath\sources\boot.wim" $DestinationWimPath -Force``Set-ItemProperty $DestinationWimPath -Name IsReadOnly -Value $false` - -`### Mount the bootable image within the WIM file (normally index 2).``Mount-WindowsImage -ImagePath $DestinationWimPath -Path $TempMountPath -Index 2` - -`###``### Add additional drivers to the image.``###` - -`###``### Installs the specified driver(s) into the image.``###` - -`Add-WindowsDriver -Path $TempMountPath -Driver "C:\Windows\System32\DriverStore\FileRepository``\xusb22.inf_amd64_89c20c625f14f923\xusb22.inf" -ForceUnsigned` - -`###``### Add additional drivers to the image.``###` - -`###``### Installs the specified WinPE package(s) into the image.``###` - -`Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-FMAPI.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-HTA.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\10.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-HTA_en-us.cab"` - -`###``### Add the DaRT tools to the image.``### The New-DartConfiguration cmdlet is used to specify how the DaRT image is configured.``### Modify this statement to configure how the DaRT tools will be applied to the image.``###` - -`$config = New-DartConfiguration -AddComputerManagement -AddCrashAnalyzer -AddDiskCommander -AddExplorer -AddFileRestore -AddFileSearch -AddHotfixUninstall -AddRegistryEditor -AddRemoteConnection -AddSfcScan -AddSolutionWizard -AddTcpConfig -RemoteMessage "Test welcome message" -RemotePort 3388 -ScratchSpace 512``$config | Set-DartImage -Path $TempMountPath` - -`###``### Perform any manual user-specific customizations here.``###` - -`# Read-Host -Prompt "Script is paused for any manual customization. Press ENTER to continue"` - -`### Save the changes to the WIM file by dismounting the image.``Dismount-WindowsImage -Path $TempMountPath -Save` - -`### Create a bootable DaRT ISO.``Export-DartImage -IsoPath $DestinationIsoPath -WimPath $DestinationWimPath` - -`### The following is an example of how to burn the ISO to a writeable CD/DVD.``### Specify the correct drive letter and uncomment the statement to burn an ISO.``# Copy-DartImage -IsoPath $DestinationIsoPath -Drive "G:" -Type DVD` - -`### Removes all temporary files.``Remove-Item $TempMountPath -Force -Recurse` - -## Related topics - - -[Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/images/checklistbox.gif b/mdop/dart-v10/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/dart-v10/images/checklistbox.gif and /dev/null differ diff --git a/mdop/dart-v10/images/mbam-logo-sm.gif b/mdop/dart-v10/images/mbam-logo-sm.gif deleted file mode 100644 index 2102b4540c..0000000000 Binary files a/mdop/dart-v10/images/mbam-logo-sm.gif and /dev/null differ diff --git a/mdop/dart-v10/index.md b/mdop/dart-v10/index.md deleted file mode 100644 index 5d88fce5c0..0000000000 --- a/mdop/dart-v10/index.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Diagnostics and Recovery Toolset 10 -description: Diagnostics and Recovery Toolset 10 -author: dansimp -ms.assetid: 64403eca-ff05-4327-ac33-bdcc96e706c8 -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Diagnostics and Recovery Toolset 10 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 10 lets you diagnose and repair a computer that cannot be started or that has problems starting as expected. By using DaRT 10, you can recover end-user computers that have become unusable, diagnose probable causes of issues, and quickly repair unbootable or locked-out computers. When it is necessary, you can also quickly restore important lost files and detect and remove malware, even when the computer is not online. - -DaRT 10 lets you create a DaRT recovery image in International Organization for Standardization (ISO) and Windows Imaging (WIM) file formats and burn the image to a CD, DVD, or USB. You can then use the recovery image files and deploy them locally or to a remote partition or a recovery partition. - -DaRT 10 is an important part of the Microsoft Desktop Optimization Pack (MDOP), a dynamic solution available to Software Assurance customers that helps reduce software installation costs, enables delivery of applications as services, and helps manage and control enterprise desktop environments. - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[About DaRT 10](about-dart-10.md)**|**[Release Notes for DaRT 10](release-notes-for-dart-10.md)**|**[Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md)**|**[Accessibility for DaRT 10](accessibility-for-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md)**|**[DaRT 10 Supported Configurations](dart-10-supported-configurations.md)**|**[Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md)**|**[Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md)**|**[DaRT 10 Planning Checklist](dart-10-planning-checklist.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md)**|**[Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md)**|**[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md)**|**[DaRT 10 Deployment Checklist](dart-10-deployment-checklist.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md)**|**[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md)**|**[Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md)**|**[Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - -### More Information - -[How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) -Get information about how to download DaRT. - -[Release Notes for DaRT 10](release-notes-for-dart-10.md) -View updated product information and known issues for DaRT 10. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - - diff --git a/mdop/dart-v10/operations-for-dart-10.md b/mdop/dart-v10/operations-for-dart-10.md deleted file mode 100644 index 6e12927ca8..0000000000 --- a/mdop/dart-v10/operations-for-dart-10.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations for DaRT 10 -description: Operations for DaRT 10 -author: dansimp -ms.assetid: 1776d5ed-96c6-4841-a097-721d8cf5c7f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for DaRT 10 - - -This section includes information about the various types of Microsoft Diagnostics and Recovery Toolset (DaRT) 10 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations information - - -- [Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md) - - This section provides instructions on how to use DaRT 10 to recover local or remote computers by using the DaRT recovery image. - -- [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md) - - This section explains how to open and run the Crash Analyzer on either an end-user or non-end-user computer to debug a memory dump file and then diagnose computer errors. - -- [Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md) - - This section describes measures for maintaining security while using DaRT. - -- [Administering DaRT 10 Using PowerShell](administering-dart-10-using-powershell.md) - - This section lists the Windows PowerShell commands that administrators can use to perform various DaRT tasks. - -## Other resources for DaRT 10 operations - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/overview-of-the-tools-in-dart-10.md b/mdop/dart-v10/overview-of-the-tools-in-dart-10.md deleted file mode 100644 index d5908052a6..0000000000 --- a/mdop/dart-v10/overview-of-the-tools-in-dart-10.md +++ /dev/null @@ -1,148 +0,0 @@ ---- -title: Overview of the Tools in DaRT 10 -description: Overview of the Tools in DaRT 10 -author: dansimp -ms.assetid: 752467dd-b646-4335-82ce-9090d4651f65 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of the Tools in DaRT 10 - - -From the **Diagnostics and Recovery Toolset** window in Microsoft Diagnostics and Recovery Toolset (DaRT) 10, you can start any of the individual tools that you include when you create the DaRT 10 recovery image. For information about how to access the **Diagnostics and Recovery Toolset** window, see [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md). - -If it is available, you can use the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to select the tool that best addresses your particular issue, based on a brief interview that the wizard provides. - -## Exploring the DaRT tools - - -A description of the DaRT 10 tools follows. - -### Computer Management - -**Computer Management** is a collection of Windows administrative tools that help you troubleshoot a problem computer. You can use the **Computer Management** tools in DaRT to view system information and event logs, manage disks, list autoruns, and manage services and drivers. The **Computer Management** console is customized to help you diagnose and repair problems that might be preventing the Windows operating system from starting. - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### Crash Analyzer - -Use the **Crash Analyzer Wizard** to quickly determine the cause of a computer failure by analyzing the memory dump file on the Windows operating system that you are repairing. **Crash Analyzer** examines the memory dump file for the driver that caused a computer to fail. You can then disable the problem device driver by using the **Services and Drivers** node in the **Computer Management** tool. - -The **Crash Analyzer Wizard** requires the Debugging Tools for Windows and symbol files for the operating system that you are repairing. You can include both requirements when you create the DaRT recovery image. If they are not included on the recovery image and you do not have access to them on the computer that you are repairing, you can copy the memory dump file to another computer and use the stand-alone version of **Crash Analyzer** to diagnose the problem. - -Running **Crash Analyzer** is a good idea even if you plan to reimage the computer. The image could have a defective driver that is causing problems in your environment. By running **Crash Analyzer**, you can identify problem drivers and improve the image stability. - -For more information about **Crash Analyzer**, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md). - -### Disk Commander - -**Disk Commander** lets you recover and repair disk partitions or volumes by using one of the following recovery processes: - -- Restore the master boot record (MBR) - -- Recover one or more lost volumes - -- Restore partition tables from **Disk Commander** backup - -- Save partition tables to **Disk Commander** backup - -**Warning**   -We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table. - - - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### Disk Wipe - -You can use **Disk Wipe** to delete all data from a disk or volume, even the data that is left behind after you reformat a hard disk drive. **Disk Wipe** lets you select from either a single-pass overwrite or a four-pass overwrite, which meets current U.S. Department of Defense standards. - -**Warning**   -After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it. - - - -### Explorer - -The **Explorer** tool lets you browse the computer’s file system and network shares so that you can remove important data that the user stored on the local drive before you try to repair or reimage the computer. And because you can map drive letters to network shares, you can easily copy and move files from the computer to the network for safekeeping or from the network to the computer to restore them. - -### File Restore - -**File Restore** lets you try to restore files that were accidentally deleted or that were too big to fit in the Recycle Bin. **File Restore** is not limited to regular disk volumes, but can find and restore files on lost volumes or on volumes that are encrypted by BitLocker. - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### File Search - -Before reimaging a computer, recovering files from the local hard disk is important, especially when the user might not have backed up or stored the files elsewhere. - -The **Search** tool opens a **File Search** window that you can use to find documents when you do not know the file path or to search for general kinds of files across all local hard disks. You can search for specific file-name patterns in specific paths. You can also limit results to a date range or size range. - -### Hotfix Uninstall - -The **Hotfix Uninstall Wizard** lets you remove hotfixes or service packs from the Windows operating system on the computer that you are repairing. Use this tool when a hotfix or service pack is suspected in preventing the operating system from starting. - -We recommend that you uninstall only one hotfix at a time, even though the tool lets you uninstall more than one. - -**Important**   -Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix. - - - -### Locksmith - -The **Locksmith Wizard** lets you set or change the password for any local account on the Windows operating system that you are analyzing or repairing. You do not have to know the current password. However, the password that you set must comply with any requirements that are defined by a local Group Policy Object. This includes password length and complexity. - -You can use **Locksmith** when the password for a local account, such as the local Administrator account, is unknown. You cannot use **Locksmith** to set passwords for domain accounts. - -### Registry Editor - -You can use **Registry Editor** to access and change the registry of the Windows operating system that you are analyzing or repairing. This includes adding, removing, and editing keys and values, and importing registry (.reg) files. - -**Warning**   -Serious problems can occur if you change the registry incorrectly by using **Registry Editor**. These problems might require you to reinstall the operating system. Before you make changes to the registry, you should back up any valued data on the computer. Change the registry at your own risk. - - - -### SFC Scan - -The **SFC Scan** tool starts the **System File Repair Wizard** and lets you repair system files that are preventing the installed Windows operating system from starting. The **System File Repair Wizard** can automatically repair system files that are corrupted or missing, or it can prompt you before it performs any repairs. - -### Solution Wizard - -The **Solution Wizard** presents a series of questions and then recommends the best tool for the situation, based on your answers. This wizard helps you determine which tool to use when you are not familiar with the tools in DaRT. - -### TCP/IP Config - -When you boot a problem computer into DaRT, it is set to automatically obtain its TCP/IP configuration (IP address and DNS server) from Dynamic Host Configuration Protocol (DHCP). If DHCP is unavailable, you can manually configure TCP/IP by using the **TCP/IP Config** tool. You first select a network adapter, and then configure the IP address and DNS server for that adapter. - -## Related topics - - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/planning-for-dart-10.md b/mdop/dart-v10/planning-for-dart-10.md deleted file mode 100644 index d907bb9ecc..0000000000 --- a/mdop/dart-v10/planning-for-dart-10.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning for DaRT 10 -description: Planning for DaRT 10 -author: dansimp -ms.assetid: 2ca0249a-6a9f-4b4e-91f1-f1b34be7b16c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for DaRT 10 - - -The goal of deployment planning is to successfully and efficiently deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 10 so that it does not disrupt your users or the network. - -Before you deploy DaRT 10, you should consider the different deployment configurations and prerequisites. This section includes information that can help you gather the information to formulate a deployment plan that best meets your business requirements. - -## Planning information - - -- [Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) - - There are several deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -- [DaRT 10 Planning Checklist](dart-10-planning-checklist.md) - - This checklist can assist you in preparing your computing environment for the DaRT deployment. - -## Other resources for DaRT planning - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -[Troubleshooting DaRT 10](troubleshooting-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md b/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md deleted file mode 100644 index f76a87d4d5..0000000000 --- a/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Planning How to Save and Deploy the DaRT 10 Recovery Image -description: Planning How to Save and Deploy the DaRT 10 Recovery Image -author: dansimp -ms.assetid: 9a3e5413-2621-49ce-8bd2-992616691703 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning How to Save and Deploy the DaRT 10 Recovery Image - - -You can save and deploy the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image by using the following methods. When you are determining the method that you will use, consider the advantages and disadvantages of each. You should also consider your infrastructure and support staff. If you have a small infrastructure, you might want to deploy DaRT 10 by using removable media, since the recovery image will always be available if you install it to the local hard drive. - -If your organization uses Active Directory Domain Services (AD DS), you may want to deploy recovery images as a network service by using Windows DS. Recovery images are always available to any connected computer. You can deploy multiple images from Windows DS and maintain them all in one place. - -**Note**   -You may want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network. - - - -The following table shows some advantages and disadvantages of each method of using DaRT in your organization. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Method to Boot into DaRTAdvantagesDisadvantages

    Removable Media

    -

    The recovery image is written to a CD, DVD, or USB drive to enable support staff to take the recovery tools with them to the unstable computer.

    Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk and supports cases in which there is no network connection.

    -

    Enables you to create multiple recovery images with different tools to provide different levels of support.

    -

    Provides a built-in tool for burning recovery images to removable media.

    Requires that support staff are physically at the end-user computer to boot into DaRT.

    -

    Requires time and maintenance to create multiple media with different configurations for 32-bit and 64-bit computers.

    From a remote (network) partition

    -

    The recovery image is hosted on a network boot server like Windows Deployment Services (Windows DS), which allows users or support staff to stream it to computers on demand.

    Available to all computers that have access to the network boot server.

    -

    Recovery images are hosted on a central server, which enables centralized updates.

    -

    Centralized help desk staff can provide repairs by using remote connectivity.

    -

    No local storage requirement on the clients.

    -

    Ability to create multiple recovery images with different tools for specific support levels.

    The need to secure Windows DS infrastructure to ensure that regular users can start only the DaRT recovery image and not the full operating system imaging process.

    -

    -

    -

    Requires that the end-user computer is connected to the network at runtime.

    -

    Requires that the recovery image is brought across the network.

    From a recovery partition on the local hard drive

    -

    The recovery image is installed on a local hard drive either manually or by using electronic software distribution systems like System Center Configuration Manager.

    The recovery image is always available because it is pre-staged on the computer.

    -

    Centralized help desk staff can provide support by using Remote Connection.

    -

    The recovery image is centrally managed and deployed.

    -

    Additional recovery key requests on computers that are protected by Windows BitLocker drive encryption are eliminated.

    Local storage is required.

    -

    A dedicated, unencrypted partition for recovery image placement is recommended to reduce the risk of a failed boot partition.

    -

    When updating DaRT, you must update all computers in your enterprise instead of just one partition (on the network) or removable device.

    -

    Additional consideration is required if you deploy the recovery image after BitLocker has been enabled.

    - - - -## Related topics - - -[Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md b/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md deleted file mode 100644 index 7089ba0bff..0000000000 --- a/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Planning to Create the DaRT 10 Recovery Image -description: Planning to Create the DaRT 10 Recovery Image -author: dansimp -ms.assetid: a0087d93-b88f-454b-81b2-3c7ce3718023 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Create the DaRT 10 Recovery Image - - -Use the information in this section when you are planning to create the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image. - -## Planning to create the DaRT 10 recovery image - - -When you create the DaRT recovery image, you have to decide which tools to include on the image. To make the decision, consider that end users may have access to those tools. If support engineers will take the recovery image media to end users’ computers to diagnose issues, you may want to install all of the tools on the recovery image. If you plan to diagnose end user’s computers remotely, you may want to disable some of the tools, such as Disk Wipe and Registry Editor, and then enable other tools, including Remote Connection. - -When you create the DaRT recovery image, you will also specify whether you want to include additional drivers or files. Determine the locations of any additional drivers or files that you want to include on the DaRT recovery image. - -For more information about the DaRT tools, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md). For more information about how to help create a secure recovery image, see [Security Considerations for DaRT 10](security-considerations-for-dart-10.md). - -## Prerequisites for the recovery image - - -The following items are required or recommended for creating the DaRT recovery image: - - ---- - - - - - - - - - - - - - - - - - - -

    Prerequisite

    Details

    Windows 10 source files

    Required to create the DaRT recovery image. Provide the path of a Windows 10 DVD or of Windows 10 source files.

    Windows Debugging Tools for your platform

    Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: Download and Install Debugging Tools for Windows.

    Optional: Windows symbols files for use with Crash Analyzer

    Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see Diagnosing System Failures with Crash Analyzer.

    - - - -## Related topics - -[Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md) - - - - - - - - diff --git a/mdop/dart-v10/planning-to-deploy-dart-10.md b/mdop/dart-v10/planning-to-deploy-dart-10.md deleted file mode 100644 index a3f8fabb1c..0000000000 --- a/mdop/dart-v10/planning-to-deploy-dart-10.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning to Deploy DaRT 10 -description: Planning to Deploy DaRT 10 -author: dansimp -ms.assetid: 32a39e97-a889-4aae-982c-b85cdc3d9134 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy DaRT 10 - - -You should consider all of the different deployment configurations and prerequisites before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## Review the DaRT 10 software prerequisites and supported configurations - - -After preparing your computing environment for DaRT 10 installation, make sure that you review the prerequisite software to install and the supported configurations to confirm that the selected computers for the installation meet the minimum hardware and operating system requirements. For information about prerequisites that you need to consider to create the DaRT recovery image, see [Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md). - -[DaRT 10 Supported Configurations](dart-10-supported-configurations.md) - -## Plan for creating the DaRT 10 recovery image - - -Before you start to create the DaRT recovery image, you need to consider possible security issues, the tools that you want to include on the recovery image, and the prerequisite software that you need to install. - -[Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md) - -## Plan how to save and deploy the DaRT recovery image - - -There are several methods that you can use to save and deploy the DaRT recovery image. Before you start to create the recovery image, review the advantages and disadvantages of each method and consider how you want to use DaRT in your enterprise. - -[Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md) - -## Other resources for planning to deploy DaRT 10 - - -[Planning for DaRT 10](planning-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/recovering-computers-using-dart-10.md b/mdop/dart-v10/recovering-computers-using-dart-10.md deleted file mode 100644 index a8d8499941..0000000000 --- a/mdop/dart-v10/recovering-computers-using-dart-10.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Recovering Computers Using DaRT 10 -description: Recovering Computers Using DaRT 10 -author: dansimp -ms.assetid: 2ad7fab0-c22d-4171-8b5a-b2b7d7c0ad2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recovering Computers Using DaRT 10 - - -After deploying the Microsoft Diagnostics and Recovery Toolset (DaRT) 10 recovery image, you can use DaRT 10 to recover computers. The information in this section describes the recovery tasks that you can perform. - -You have several different methods to choose from to boot into DaRT, depending on how you deploy the DaRT recovery image. - -- Insert a DaRT recovery image CD, DVD, or USB flash drive into the problem computer and use it to boot into the computer. - -- Boot into DaRT from a recovery partition on the problem computer. - -- Boot into DaRT from a remote partition on the network. - -For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md). - -Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - -**Note**   -Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -## Recover a local computer by using the DaRT recovery image - - -To recover a local computer by using DaRT, you must be physically present at the end-user computer that is experiencing problems that require DaRT. - -[How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md) - -## Recover a remote computer by using the DaRT recovery image - - -The Remote Connection feature in DaRT lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a help desk professional working on the end-user computer), the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important**   -The two computers establishing a remote connection must be part of the same network. - - - -The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**. - -The Remote Connection feature on the end-user computer creates the following connection information: a ticket number, a port, and a list of all available IP addresses. The ticket number and port are generated randomly. - -The IT administrator or help desk worker enters this information into the **DaRT Remote Connection Viewer** to establish the terminal services connection to the end-user computer. The terminal services connection that is established lets an IT administrator remotely interact with the DaRT tools on the end-user computer. The end-user computer then processes the connection information, shares its screen, and responds to instructions from the IT administrator computer. - -[How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md) - -## Other resources for recovering computers using DaRT 10 - - -[Operations for DaRT 10](operations-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/release-notes-for-dart-10.md b/mdop/dart-v10/release-notes-for-dart-10.md deleted file mode 100644 index 422e6479b3..0000000000 --- a/mdop/dart-v10/release-notes-for-dart-10.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Release Notes for DaRT 10 -description: Release Notes for DaRT 10 -author: dansimp -ms.assetid: eb996980-f9c4-42cb-bde9-6b3d4b82b58c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Release Notes for DaRT 10 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 10. - -These release notes contain information that is required to successfully install Diagnostics and Recovery Toolset 10. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Known issues with DaRT 10 - - -### Disk Commander is unable to repair a corrupt master boot record in a physical partition in Windows 10 - -In Windows 10, the “Restore the Master Boot Record (MBR) or the header of the GUID Partition Table (GPT)” option in Disk Commander is unable to repair a corrupt master boot record in a physical partition, and therefore is unable to boot the client computer. - -**Workaround:** Start **Startup Repair**, click **Troubleshoot**, click **Advanced options**, and then click **Start repair**. - -### Multiple instances of Disk Wipe that target the same drive cause all instances except the last one to report a failure - -If you start multiple instances of Disk Wipe, and then try to wipe the same drive by using two separate Disk Wipe instances, all instances except the last one report a failure to wipe the drive. - -**Workaround:** None. - -### Disk Wipe may not clear all data on solid-state drives that have flash memory - -If you use Disk Wipe to clear data on a solid-state drive (SSD) that has flash memory, all of the data may not be erased. This issue occurs because the SSD firmware controls the physical location of writes while Disk Wipe is running. - -**Workaround:** None. - -### System restore fails when you run Locksmith Wizard or Registry Editor - -If you run Locksmith Wizard, Registry Editor, and possibly other tools, System Restore fails. - -**Workaround:** Close and restart DaRT, and then start System Restore. - -### System File Checker (SFC) Scan fails to run after you start and close Locksmith Wizard or Computer Management - -If you start and then close Locksmith Wizard or tools in Computer Management, System File Checker fails to run. - -**Workaround:** Close and restart DaRT, and then start System File Checker. - -### DaRT installer does not fail when the Windows Assessment and Deployment Kit is not installed - -If you install DaRT 10 by using the command line to run the Windows Installer (.msi), and the Windows Assessment and Deployment Kit (Windows ADK) has not been installed, the DaRT installation should fail. Currently, the DaRT 10 installer installs all components except the DaRT recovery image. - -**Workaround:** None. - -## Related topics - - -[About DaRT 10](about-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/security-and-privacy-for-dart-10.md b/mdop/dart-v10/security-and-privacy-for-dart-10.md deleted file mode 100644 index 8a01341fe5..0000000000 --- a/mdop/dart-v10/security-and-privacy-for-dart-10.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Security and Privacy for DaRT 10 -description: Security and Privacy for DaRT 10 -author: dansimp -ms.assetid: 9ce5d555-c4e9-4482-a147-27b26579c935 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for DaRT 10 - - -Use the following information to help you plan for security and privacy considerations in Microsoft Diagnostics and Recovery Toolset (DaRT) 10. - -## Security considerations for DaRT 10 - - -There are several security-related considerations that you should plan for when deploying and using DaRT in your environment. The information in this section provides a brief overview about the security-related considerations for DaRT. - -[Security Considerations for DaRT 10](security-considerations-for-dart-10.md) - -## Privacy considerations for DaRT 10 - - -The information in this section explains many of the data collection and use practices of DaRT. - -[DaRT 10 Privacy Statement](dart-10-privacy-statement.md) - -## Other resources for DaRT 10 security and privacy - - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v10/security-considerations-for-dart-10.md b/mdop/dart-v10/security-considerations-for-dart-10.md deleted file mode 100644 index 41712c5ad9..0000000000 --- a/mdop/dart-v10/security-considerations-for-dart-10.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Security Considerations for DaRT 10 -description: Security Considerations for DaRT 10 -author: dansimp -ms.assetid: c653daf1-f12a-4667-98cc-f0c89fa38e3f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Security Considerations for DaRT 10 - - -This topic contains a brief overview about the accounts and groups, log files, and other security-related considerations for Microsoft Diagnostics and Recovery Toolset (DaRT) 10. For more information, follow the links within this article. - -## General security considerations - - -**Understand the security risks**. DaRT 10 includes functionality that lets an administrator or a help desk worker run the DaRT tools remotely to resolve problems on an end-user computer. In addition, you can save the International Organization for Standardization (ISO) image to a USB flash drive or put the ISO image on a network to include its contents as a recovery partition on a computer’s hard disk. These capabilities provide flexibility, but also create potential security risks that you should consider when configuring DaRT. - -**Physically secure your computers**. When administrators and help desk workers are not physically at their computers, they should lock their computers and use a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for operating systems by subscribing to the Security Notification service (). - -## Limit end-user access to DaRT tools - - -When you are creating the DaRT recovery image, you can select the tools that you want to include. For security reasons, you might want to restrict end-user access to the more powerful DaRT tools, such as Disk Wipe and Locksmith. In DaRT 10, you can disable certain tools during configuration and still make them available to help desk workers when the end user starts the Remote Connection feature. - -You can even configure the DaRT image so that the option to start a remote connection session is the only tool available to an end user. - -**Important**   -After the remote connection is established, all the tools that you included in the recovery image, including those unavailable to the end user, will become available to any help desk worker who is working on the end–user computer. - - - -For more information about including tools in the DaRT recovery image, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md). - -## Secure the DaRT recovery image - - -If you deploy the DaRT recovery image by saving it to a USB flash drive or by creating a remote partition or a recovery partition, you might want to include your company’s preferred method of drive encryption on the ISO. Encrypting the ISO helps to ensure that end users cannot use DaRT functionality if they were to gain access to the recovery image, and it ensures that unauthorized users cannot boot into DaRT on computers that belong to someone else. If you use an encryption method, be sure to deploy and enable it in all computers. - -**Note**   -DaRT 10 supports BitLocker natively. - - - -To include drive encryption, add the encryption solution files when you create the recovery image. Your encryption solution must be able to run on WinPE. End users who boot from the ISO are then able to access that encryption solution and unblock the drive. - -## Maintain security between two computers when you use Remote Connection - - -By default, the communication between two computers that have established a **Remote Connection** session may not be encrypted. Therefore, to help maintain security between the two computers, we recommend that both computers are a part of the same network. - -## Related topics - - -[Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md) - - - - - - - - - diff --git a/mdop/dart-v10/troubleshooting-dart-10.md b/mdop/dart-v10/troubleshooting-dart-10.md deleted file mode 100644 index 2ba6f1ddfb..0000000000 --- a/mdop/dart-v10/troubleshooting-dart-10.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting DaRT 10 -description: Troubleshooting DaRT 10 -author: dansimp -ms.assetid: 76d42a00-3f6b-4730-8857-39fe49535d37 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting DaRT 10 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to find troubleshooting content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting DaRT 10 - - -[Diagnostics and Recovery Toolset 10](index.md) - -[Getting Started with DaRT 10](getting-started-with-dart-10.md) - -[Planning for DaRT 10](planning-for-dart-10.md) - -[Deploying DaRT 10](deploying-dart-10.md) - -[Operations for DaRT 10](operations-for-dart-10.md) - -  - -  - - - - - diff --git a/mdop/dart-v65.md b/mdop/dart-v65.md deleted file mode 100644 index ef08a90758..0000000000 --- a/mdop/dart-v65.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: Diagnostics and Recovery Toolset 6.5 -description: Diagnostics and Recovery Toolset 6.5 -author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# Diagnostics and Recovery Toolset 6.5 - -Selecting the link for [Diagnostics and Recovery Toolset 6.5 documentation](https://technet.microsoft.com/library/jj713388.aspx) will take you to another website. Use your browser's **Back** button to return to this page. diff --git a/mdop/dart-v7/TOC.md b/mdop/dart-v7/TOC.md deleted file mode 100644 index 5688dce81f..0000000000 --- a/mdop/dart-v7/TOC.md +++ /dev/null @@ -1,36 +0,0 @@ -# [Diagnostics and Recovery Toolset 7](index.md) -## [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) -### [About DaRT 7.0](about-dart-70-new-ia.md) -#### [Release Notes for DaRT 7.0](release-notes-for-dart-70-new-ia.md) -### [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md) -### [Accessibility for DaRT 7.0](accessibility-for-dart-70.md) -## [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) -### [Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) -#### [DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md) -#### [Planning to Create the DaRT 7.0 Recovery Image](planning-to-create-the-dart-70-recovery-image.md) -#### [Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md) -### [DaRT 7.0 Planning Checklist](dart-70-planning-checklist-dart-7.md) -## [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) -### [Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) -#### [How to Deploy DaRT 7.0](how-to-deploy-dart-70.md) -#### [How to Change, Repair, or Remove DaRT 7.0](how-to-change-repair-or-remove-dart-70.md) -### [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) -#### [How to Use the DaRT Recovery Image Wizard to Create the Recovery Image](how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md) -#### [How to Create a Time Limited Recovery Image](how-to-create-a-time-limited-recovery-image-dart-7.md) -### [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) -#### [How to Deploy the DaRT Recovery Image Using a USB Flash Drive](how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md) -#### [How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md) -#### [How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md) -### [DaRT 7.0 Deployment Checklist](dart-70-deployment-checklist-dart-7.md) -## [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) -### [Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md) -#### [How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md) -#### [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md) -### [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) -#### [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md) -#### [How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md) -#### [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md) -### [Security Considerations for DaRT 7.0](security-considerations-for-dart-70-dart-7.md) -## [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) -## [Technical Reference for DaRT 7.0](technical-reference-for-dart-70-new-ia.md) - diff --git a/mdop/dart-v7/about-dart-70-new-ia.md b/mdop/dart-v7/about-dart-70-new-ia.md deleted file mode 100644 index bad11f06bb..0000000000 --- a/mdop/dart-v7/about-dart-70-new-ia.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: About DaRT 7.0 -description: About DaRT 7.0 -author: dansimp -ms.assetid: 217ffafc-6d73-4b80-88d9-71870460d4ab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About DaRT 7.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 helps you troubleshoot and repair Windows-based desktops. This includes those desktops that cannot be started. DaRT is a powerful set of tools that extend the Windows Recovery Environment (WinRE). By using DaRT, you can analyze an issue to determine its cause, for example, by inspecting the computer’s event log or system registry. - -DaRT also provides tools to help you fix a problem as soon as you determine the cause. For example, you can use the tools in DaRT to disable a faulty device driver, remove hotfixes, restore deleted files, and scan the computer for malware even when you cannot or should not start the installed Windows operating system. - -DaRT can help you quickly recover computers that are running either 32-bit or 64-bit versions of Windows 7, typically in less time than it would take to reimage the computer. - -## About the DaRT 7 Recovery Image - - -Functionality in DaRT lets you create a recovery image that is based on WinRE combined with a set of tools that DaRT provides. The DaRT recovery image takes advantage of WinRE, from which you can access the **Diagnostics and Recovery Toolset** window. - -Use the **DaRT Recovery Image Wizard** to create the DaRT recovery image. By default, the wizard creates an International Organization for Standardization (ISO) image file on your desktop that is named DaRT70.iso, although you can specify a different location and file name. The wizard also lets you burn the image to a CD or DVD. After you have finished the wizard, you can save the recovery image to a USB flash drive or save it in a format that you can use to create a remote partition or a recovery partition. - -When you have to use DaRT to startup an end-user computer that will not start, you can follow the instructions at [How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md). - -For detailed information about the tools in DaRT, see [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md). - -## What’s New in DaRT 7 - - -DaRT 7 continues to support all the scenarios included in previous versions and it adds a new Remote Connection feature in addition to three new deployment options. - -### DaRT 7 Image Creation - -The wizard that you use to create DaRT ISO images is now called **DaRT Recovery Image** and it now supports an option to enable or disable the new Remote Connection feature. Remote Connection lets a helpdesk agent run the DaRT tools from a remote location. In previous releases, the helpdesk agent had to be physically present at the end-user computer to run the DaRT tools. - -The wizard also lets you customize the Welcome message for the Remote Connection feature (the message is shown when end users run the Remote Connection tool). IT Admins can also configure which Port Number should be used by Remote Connection. - -For more information about the **DaRT Recovery Image Wizard** or Remote Connection, see [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md). - -### DaRT 7 ISO Deployment - -In addition to burning to a CD or DVD, DaRT 7 adds three new options when you deploy the ISO that contains the DaRT recovery image: - -- USB flash drive deployment - -- Remote partition deployment - -- Recovery partition deployment - -The USB flash drive deployment option lets a company use DaRT on computers that do not have CD or DVD drives available. The recovery and remote partition options let end users have easy access to the DaRT image and to enable the Remote Connection functionality. - -For more information about how to deploy DaRT recovery images, see [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md). - -## Related topics - - -[Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -[Release Notes for DaRT 7.0](release-notes-for-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/accessibility-for-dart-70.md b/mdop/dart-v7/accessibility-for-dart-70.md deleted file mode 100644 index 728b5a9f48..0000000000 --- a/mdop/dart-v7/accessibility-for-dart-70.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for DaRT 7.0 -description: Accessibility for DaRT 7.0 -author: dansimp -ms.assetid: 41f7bb72-4f1d-44fb-bc3f-8b66557fec2f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for DaRT 7.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access Any Command with a Few Keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md b/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md deleted file mode 100644 index 7158d4abbf..0000000000 --- a/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Creating the DaRT 7.0 Recovery Image -description: Creating the DaRT 7.0 Recovery Image -author: dansimp -ms.assetid: ebb2ec58-0349-469d-a23f-3f944fe4c1fa -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating the DaRT 7.0 Recovery Image - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 includes the **DaRT Recovery Image Wizard** that is used in Windows to create a bootable International Organization for Standardization (ISO) image. An ISO image is a file that represents the raw contents of a CD. - -## Use the DaRT Recovery Image Wizard to Create the Recovery Image - - -The ISO created by the DaRT Recovery Image Wizard contains the DaRT recovery image that lets you boot into a problem computer, even if it might otherwise not start. After you boot the computer into DaRT, you can run the different DaRT tools to try to diagnose and repair the computer. - -You can write the ISO to a recordable CD or DVD, save it to a USB flash drive, or save it in a format that you can use to boot into DaRT from a remote partition or from a recovery partition. For more information, see [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md). - -**Note**   -If your computer includes a CD-RW drive, the wizard offers to burn the ISO image to a blank CD or DVD. If your computer does not include a drive that is supported by the wizard, you can burn the ISO image onto a CD or DVD by using most programs that can burn a CD or DVD. - - - -To create a bootable CD or DVD from the ISO image, you must have: - -- A CD-RW drive. - -- A recordable CD or DVD (in a format supported by the recordable drive). - -- Software that supports the recordable drive and supports burning an ISO image directly to CD or DVD. - - **Important**   - Test the CD or DVD that you create on all the different kinds of computers that you intend to support because some computers cannot start from all kinds of recordable media. - - - -To save the ISO image to a USB flash drive (UFD), you must have: - -- A correctly formatted UFD. - -- A program that you can use to mount the ISO image. - -[How to Use the DaRT Recovery Image Wizard to Create the Recovery Image](how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md) - -## Create a Time Limited Recovery Image - - -You can create a DaRT recovery image that can only be used for a certain number of days after it is generated. To do this, you must run the **DaRT Recovery Image Wizard** at a command prompt and specify the number of days. - -[How to Create a Time Limited Recovery Image](how-to-create-a-time-limited-recovery-image-dart-7.md) - -## Other resources for creating the DaRT 7 recovery image - - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md b/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md deleted file mode 100644 index ab0a13cab2..0000000000 --- a/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 7.0 Deployment Checklist -description: DaRT 7.0 Deployment Checklist -author: dansimp -ms.assetid: 2c68ec15-0624-4a75-8237-05c68b61ad07 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 7.0 Deployment Checklist - - -This checklist can be used to help you during Microsoft Diagnostics and Recovery Toolset (DaRT) 7 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferences
    Checklist box

    Decide on the best DaRT 7 deployment option for your requirements and deploy it.

    Deploying DaRT 7.0 to Administrator Computers

    Checklist box

    Use the DaRT Recovery Image Wizard to create the DaRT recovery image ISO.

    Creating the DaRT 7.0 Recovery Image

    Checklist box

    Decide on the best DaRT 7 recovery image deployment option for your requirements and deploy it.

    Deploying the DaRT 7.0 Recovery Image

    - - - -## Related topics - - -[Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/dart-70-planning-checklist-dart-7.md b/mdop/dart-v7/dart-70-planning-checklist-dart-7.md deleted file mode 100644 index 8c9dbcaa92..0000000000 --- a/mdop/dart-v7/dart-70-planning-checklist-dart-7.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 7.0 Planning Checklist -description: DaRT 7.0 Planning Checklist -author: dansimp -ms.assetid: f97a2318-6597-4774-a854-bb546279a8fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 7.0 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Diagnostics and Recovery Toolset (DaRT) 7 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferences
    Checklist box

    Review the DaRT 7 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.

    DaRT 7.0 Supported Configurations

    Checklist box

    Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.

    Planning to Create the DaRT 7.0 Recovery Image

    Checklist box

    Determine which method, or methods, you will use to deploy the DaRT recovery image.

    Planning How to Save and Deploy the DaRT 7.0 Recovery Image

    - - - -## Related topics - - -[Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/dart-70-supported-configurations-dart-7.md b/mdop/dart-v7/dart-70-supported-configurations-dart-7.md deleted file mode 100644 index 790c2e9077..0000000000 --- a/mdop/dart-v7/dart-70-supported-configurations-dart-7.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: DaRT 7.0 Supported Configurations -description: DaRT 7.0 Supported Configurations -author: dansimp -ms.assetid: e9ee87b0-3254-4625-b178-17b2f5b8f8c8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 7.0 Supported Configurations - - -Your environment may already meet the configuration requirements provided here so that you can install and run Microsoft Diagnostics and Recovery Toolset (DaRT) 7. These include the following recovery image and disk space requirements. - -## DaRT 7 Recovery Image Requirements - - -No cross-platform recovery image creation is supported. The following table specifies the kind of recovery image that you should create and deploy in your enterprise: - - ---- - - - - - - - - - - - - - - - - -
    Platform and DaRT VersionRecovery Image Requirements

    64-Bit DaRT 7.0

    Create and use a 64-Bit DaRT recovery image.

    32-Bit DaRT 7.0

    Create and use a 32-Bit DaRT recovery image.

    - -  - -## DaRT 7 End-user Computer Requirements - - -The **Diagnostics and Recovery Toolset** window in DaRT requires that the destination computer use one of the following operating systems together with the specified amount of system memory available for DaRT: - - ---- - - - - - - - - - - - - - - - - - - - - -
    Operating SystemSystem Requirements for DaRT

    Windows 7 64-Bit (2GB)

    2.5GB of system memory

    Windows 7 32-Bit (1GB)

    1.5GB of system memory

    Windows Server 2008 R2 (512MB)

    1GB of system memory

    - -  - -DaRT also has the following minimal hardware requirements: - -- A CD or DVD drive or a USB port - - This is required if you are deploying DaRT in your enterprise by using a CD, DVD, or USB. - -- BIOS support for starting the computer from a CD or DVD, a USB flash drive, or from a remote or recovery partition - -## Related topics - - -[Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/deploying-dart-70-new-ia.md b/mdop/dart-v7/deploying-dart-70-new-ia.md deleted file mode 100644 index 4b535951b5..0000000000 --- a/mdop/dart-v7/deploying-dart-70-new-ia.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Deploying DaRT 7.0 -description: Deploying DaRT 7.0 -author: dansimp -ms.assetid: 7bc99bce-b94f-4074-ba88-986ed76f8a6c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying DaRT 7.0 - - -There are a number of different deployment configurations that Microsoft Diagnostics and Recovery Toolset (DaRT) 7 supports. This section includes information you should consider about the deployment of DaRT 7 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment information - - -- [Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) - - This section provides information to help you decide on the best DaRT 7 deployment option for your requirements and then how to deploy it. - -- [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) - - This section provides information to help you use the DaRT Recovery Image Wizard to create the DaRT recovery image ISO. - -- [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) - - This section provides information to help you decide on the best DaRT 7 recovery image deployment option for your requirements and then how to deploy it. - -- [DaRT 7.0 Deployment Checklist](dart-70-deployment-checklist-dart-7.md) - - This section provides a deployment checklist that can help you in deploying and using DaRT 7. - -## Other resources for deploying DaRT 7 - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md b/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md deleted file mode 100644 index 107a1f0256..0000000000 --- a/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Deploying DaRT 7.0 to Administrator Computers -description: Deploying DaRT 7.0 to Administrator Computers -author: dansimp -ms.assetid: 8baf26aa-b168-463c-810f-a165918b9d9f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying DaRT 7.0 to Administrator Computers - - -Before you begin the deployment of Microsoft Diagnostics and Recovery Toolset (DaRT) 7, review the requirements for your environment. This includes the hardware requirements for installing DaRT. For more information about DaRT hardware and software requirements, see [DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md). - -The topics in this section can be used to help you deploy DaRT in your enterprise based on your environment and deployment strategy. - -## Deploy DaRT 7.0 to administrator computers - - -You can use the Windows Installer file for DaRT to install DaRT on a computer that you will use to first create the DaRT recovery image and then troubleshoot and fix end-user computers. Frequently, across an organization, you might install on the administrator computer only the DaRT functionality that you need to create a DaRT recovery image. Then, on a helpdesk administrator’s computer, you might install only the DaRT functionality that you must have to troubleshoot a problem computer, such as the DaRT Remote Connection Viewer and the Crash Analyzer. - -In addition to manually running the Windows Installer file to install DaRT, you can also install DaRT at the command prompt to support enterprise software deployment systems such as System Center Configuration Manager 2012. - -[How to Deploy DaRT 7.0](how-to-deploy-dart-70.md) - -## Change, repair, or remove DaRT 7.0 - - -You can change, repair, or remove the DaRT installation by double-clicking the DaRT installation file and then clicking the button that corresponds to the action that you want to perform or through the Windows Control Panel. - -[How to Change, Repair, or Remove DaRT 7.0](how-to-change-repair-or-remove-dart-70.md) - -## Other resources for Deploying the DaRT 7.0 to Administrator Computers - - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md b/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md deleted file mode 100644 index d5be1d6f03..0000000000 --- a/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Deploying the DaRT 7.0 Recovery Image -description: Deploying the DaRT 7.0 Recovery Image -author: dansimp -ms.assetid: 6bba7bff-800f-44e4-bcfc-e143115607ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying the DaRT 7.0 Recovery Image - - -After you have created the International Organization for Standardization (ISO) file that contains the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 recovery image, you can deploy the DaRT recovery image throughout your enterprise so that it is available to end users and helpdesk agents. There are four supported methods that you can use to deploy the DaRT recovery image. - -- Burn the ISO image file to a CD or DVD - -- Save the contents of the ISO image file to a USB Flash Drive (UFD) - -- Extract the boot.wim file from the ISO image and deploy as a remote partition that is available to end-user computers - -- Extract the boot.wim file from the ISO image and deploy in the recovery partition of a new Windows 7 installation - -**Important**   -The **DaRT Recovery Image Wizard** only provides the option to burn a CD or DVD. All other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section. - - - -## Deploy the DaRT Recovery Image Using a USB Flash Drive - - -After you have finished running the DaRT Recovery Image Wizard, you can use the tool at to copy the ISO image file to a USB flash drive (UFD). - -[How to Deploy the DaRT Recovery Image Using a USB Flash Drive](how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md) - -## Deploy the DaRT Recovery Image as Part of a Recovery Partition - - -After you have finished running the DaRT Recovery Image Wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 7 image. - -[How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md) - -## Deploy the DaRT Recovery Image as a Remote Partition - - -After you have finished running the DaRT Recovery Image Wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a remote partition on the network. - -[How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md) - -## Other resources for maintaining Deploying the DaRT Recovery Image - - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md b/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md deleted file mode 100644 index 793f1a332e..0000000000 --- a/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Diagnosing System Failures with Crash Analyzer -description: Diagnosing System Failures with Crash Analyzer -author: dansimp -ms.assetid: 170d40ef-4edb-4a32-a349-c285c0ea5e56 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Diagnosing System Failures with Crash Analyzer - - -The Crash Analyzer in Microsoft Diagnostics and Recovery Toolset (DaRT) 7 lets you debug a crash dump file on a Windows-based computer and then diagnose any related computer errors. The Crash Analyzer uses the Microsoft Debugging Tools for Windows to examine a crash dump file for the driver that caused the computer to fail. - -## Run the Crash Analyzer on an End-user Computer - - -Typically, you run Crash Analyzer from the Diagnostics and Recovery Toolset window on an end-user computer that has problems. The Crash Analyzer tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -If you included the Microsoft Debugging Tools for Windows and the symbol files when you created the DaRT recovery image, they should be available when you run the Crash Analyzer on the problem computer. - -[How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md) - -## Run the Crash Analyzer in stand-alone mode on a computer other than an end-user computer - - -The Crash Analyzer tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -If you did not include the Microsoft Debugging Tools for Windows and the symbol files when you created the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining them, then you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of Crash Analyzer installed, such as a helpdesk administrator’s computer. - -[How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md) - -## Ensure that Crash Analyzer can access symbol files - - -Typically, debugging information is stored in a symbol file that is separate from the executable. You must have access to the symbol information when you debug an application that has stopped responding, for example if it crashed. - -Symbol files are automatically downloaded when you run Crash Analyzer. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md) - -## Other resources for diagnosing system failures with Crash Analyzer - - -[Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/getting-started-with-dart-70-new-ia.md b/mdop/dart-v7/getting-started-with-dart-70-new-ia.md deleted file mode 100644 index 4a0b5db556..0000000000 --- a/mdop/dart-v7/getting-started-with-dart-70-new-ia.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Getting Started with DaRT 7.0 -description: Getting Started with DaRT 7.0 -author: dansimp -ms.assetid: 796f52ce-0935-4d3d-9437-289b4c7b16c3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with DaRT 7.0 - - -DaRT requires thorough planning before you deploy it or use its features. If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at [https://go.microsoft.com/fwlink/p/?LinkId=80347](https://go.microsoft.com/fwlink/?LinkId=80347). - -This section provides general information for administrators who are evaluating and using Microsoft Diagnostics and Recovery Toolset (DaRT) 7. - -**Note**   -A downloadable version of this document and the DaRT 7 Evaluation Guide can be downloaded from . - - - -## Getting Started With DaRT 7 - - -- [About DaRT 7.0](about-dart-70-new-ia.md) - - Provides information specifically related to DaRT including what is new in DaRT 7. - -- [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md) - - Provides general information about the tools in Microsoft Diagnostics and Recovery Toolset (DaRT) 7. - -- [Accessibility for DaRT 7.0](accessibility-for-dart-70.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Other resources for this product - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md b/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md deleted file mode 100644 index 07c0c01702..0000000000 --- a/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Change, Repair, or Remove DaRT 7.0 -description: How to Change, Repair, or Remove DaRT 7.0 -author: dansimp -ms.assetid: a65ff4f3-2b6d-4105-a7a0-67c87e8e7300 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change, Repair, or Remove DaRT 7.0 - - -You can change, repair, or remove the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 installation by double-clicking the DaRT installation file and then clicking the button that corresponds to the action that you want to perform. - -You can also change, repair, or remove the DaRT installation using the Windows Control Panel by following the steps described in the procedure in this topic. - -**To change, repair, or remove DaRT** - -1. Click **Start** and then click **Control Panel**. - -2. Click **Programs and Features**. - -3. Click **Microsoft Diagnostics and Recovery Toolset 7.0** and then click the button that corresponds to the action that you want to perform. - -## Related topics - - -[Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md b/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md deleted file mode 100644 index 91c0b79888..0000000000 --- a/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Create a Time Limited Recovery Image -description: How to Create a Time Limited Recovery Image -author: dansimp -ms.assetid: d2e29cac-c24c-4239-997f-0320b8a830ae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Time Limited Recovery Image - - -You can create a DaRT recovery image that can only be used for a certain number of days after it is generated. To do this, you must run the **DaRT Recovery Image Wizard** at a command prompt and specify the number of days. - -**To create a recovery image that has a time limit** - -1. Open a Command Prompt with administrator credentials. - -2. Change the directory to the location of the ERDC.exe program. - -3. Using the following syntax, run the **DaRT Recovery Image Wizard**. *NumberOfDays* is a positive integer that represents the number of days that the DaRT recovery image will be usable. - - ``` syntax - ERDC /e NumberOfDays - ``` - -## Related topics - - -[Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/how-to-deploy-dart-70.md b/mdop/dart-v7/how-to-deploy-dart-70.md deleted file mode 100644 index 23d20d5d80..0000000000 --- a/mdop/dart-v7/how-to-deploy-dart-70.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: How to Deploy DaRT 7.0 -description: How to Deploy DaRT 7.0 -author: dansimp -ms.assetid: 30522441-40cb-4eca-99b4-dff758f5c647 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy DaRT 7.0 - - -This topic provides instructions to deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 7 in your environment. The first procedure in this topic assumes that you are installing all functionality on one administrator computer. When you need to deploy or uninstall DaRT on multiple computers, using an electronic software distribution system for example, it might be easier to use command line installation options. Those options are defined in the second procedure in this topic which provides example usage for the available command line options. - -**Important**   -Before you install DaRT, ensure that the computer meets the minimum system requirements listed in [DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md). - - - -**To install DaRT on an administrator computer** - -1. Locate the DaRT installation files that you received as part of your software download. - -2. Double-click the DaRT installation file that corresponds to your system requirements, either 32-bit or 64-bit. The DaRT installation file is named **MSDaRT70.msi**. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Select the destination folder for installing DaRT, select whether DaRT should be installed for all users or just the current user, and then click **Next**. - -5. Select whether the installation should be **Typical**, **Custom**, or **Complete**, and then click **Next**. - - - **Typical** installs the tools that are most frequently used. This method is recommended for most users. - - - **Custom** lets you select the tools that are installed and where they will be installed. This is recommended for advanced users, especially if you are installing different DaRT tools on different helpdesk computers. - - - **Complete** installs all DaRT tools and requires the most disk space. - - After you have selected your method of installation, click **Next**. - -6. To start the installation, click **Install**. - -7. After the installation is completed successfully, click **Finish** to exit the wizard. - -**To install DaRT at the command prompt** - -1. The following example shows how to install all DaRT functionality. - - ``` syntax - msiexec /i MSDaRT70.msi ADDLOCAL=CommonFiles,MSDaRTHelp,DaRTRecoveryImage,CrashAnalyzer,RemoteViewer - ``` - -2. The following example shows how to install only the **DaRT Recovery Image Wizard**. - - ``` syntax - msiexec /i MSDaRT70.msi ADDLOCAL=CommonFiles,MSDaRTHelp,DaRTRecoveryImage - ``` - -3. The following example shows how to install only the Crash Analyzer and the DaRT Remote Connection Viewer. - - ``` syntax - msiexec /i MSDaRT70.msi ADDLOCAL=CommonFiles,MSDaRTHelp,CrashAnalyzer,RemoteViewer - ``` - -4. The following example creates a setup log for the Windows Installer. This is valuable for debugging. - - ``` syntax - msiexec.exe /i MSDaRT70.msi /l*v log.txt - ``` - -**Note**   -You can add /qn or /qb to any of the DaRT installation command prompt options to perform a silent installation. - - - -## Related topics - - -[Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md deleted file mode 100644 index 39343027eb..0000000000 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as a Remote Partition -description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: dansimp -ms.assetid: 757c9340-8eac-42e8-85de-4302e436713a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as a Remote Partition - - -After you have finished running the DaRT Recovery Image Wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a remote partition on the network. - -**To deploy DaRT as a remote partition** - -1. Extract the boot.wim file from the DaRT ISO image file. - - 1. Mount the ISO image file that you created in the **Create Startup Image** dialog box by using your company’s preferred method of mounting an image. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image. - - - -2. Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise. - -3. Configure the WDS server to use the boot.wim file for DaRT by following your standard WDS deployment procedures. - -For more information about how to deploy DaRT as a remote partition, see the following: - -- [Walkthrough: Deploy an Image by Using PXE](https://go.microsoft.com/fwlink/?LinkId=212108) - -- [Windows Deployment Services Getting Started Guide](https://go.microsoft.com/fwlink/?LinkId=212106) - -## Related topics - - -[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md deleted file mode 100644 index 3ec6953ff3..0000000000 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: dansimp -ms.assetid: 462f2d08-f03b-4a07-b2d3-c69205dc6f70 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as Part of a Recovery Partition - - -After you have finished running the DaRT Recovery Image Wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 7 image. - -**To deploy DaRT in the recovery partition of a Windows 7 image** - -1. Create a target partition in your Windows 7 image that is equal to or greater than the size of the ISO image file that you created by using the **DaRT Recovery Image Wizard**. - - The minimum size required for a DaRT partition is approximately 300MB. However, we recommend 450MB to accommodate for the remote connection functionality in DaRT. - -2. Extract the boot.wim file from the DaRT ISO image file. - - 1. Mount the ISO image file that you created in the **Create Startup Image** dialog box by using your company’s preferred method of mounting an image. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image. - - - -3. Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image. - - For more information about how to create or customize a recovery partition, see [Customizing the Windows RE Experience](https://go.microsoft.com/fwlink/?LinkId=214222). - -4. Replace the target partition in your Windows 7 image with the recovery partition. - -After your Windows 7 image is ready, distribute the image to computers in your enterprise by using your company’s standard image deployment process. For more information about how to create a Windows 7 image, see [Building a Standard Image of Windows 7: Step-by-Step Guide](https://go.microsoft.com/fwlink/?LinkId=212103). - -For more information about how to deploy a recovery solution to reinstall the factory image in the event of a system failure, see [Deploy a System Recovery Image](https://go.microsoft.com/fwlink/?LinkId=214221). - -## Related topics - - -[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md deleted file mode 100644 index aebbdbfef1..0000000000 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image Using a USB Flash Drive -description: How to Deploy the DaRT Recovery Image Using a USB Flash Drive -author: dansimp -ms.assetid: 5b7aa843-731e-47e7-b5f9-48d08da732d6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image Using a USB Flash Drive - - -After you have finished running the **DaRT Recovery Image Wizard**, you can use the tool at to copy the ISO image file to a USB flash drive (UFD). - -You can also manually copy the ISO image file to a UFD by following the steps provided in this section. - -**To save the DaRT recovery image to a USB flash drive** - -1. Format the USB flash drive. - - 1. From a running valid operating system or Windows PE session, insert your UFD. - - 2. At the command prompt with administrator permissions, type **DISKPART** and then type **LIST DISK**. - - The Command Prompt window displays the disk number of your UFD, for example **DISK 1**. - - 3. Enter the following commands one at a time at the command prompt. - - ``` syntax - SELECT DISK 1 - CLEAN - CREATE PARTITION PRIMARY - SELECT PARTITION 1 - ACTIVE - FORMAT FS=NTFS - ASSIGN - EXIT - ``` - - **Note**   - The previous code example assumes Disk 1 is the UFD. If it is necessary, replace DISK 1 with your disk number. - - - -2. By using your company’s preferred method of mounting an image, mount the ISO image file that you created in the **Create Startup Image** dialog box of the **DaRT Recovery Image Wizard**. This requires that you have a method available to mount an image file. - -3. Open the mounted ISO image file and copy all its contents to the formatted USB flash drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the contents to the UFD. This lets you skip the need to mount the image. - - - -## Related topics - - -[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md b/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md deleted file mode 100644 index a241116de7..0000000000 --- a/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Ensure that Crash Analyzer Can Access Symbol Files -description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: dansimp -ms.assetid: 150a2f88-68a5-40eb-8471-e5008488ab6e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Ensure that Crash Analyzer Can Access Symbol Files - - -Typically, debugging information is stored in a symbol file that is separate from the executable. You must have access to the symbol information when you debug an application that has stopped responding, for example if it crashed. - -Symbol files are automatically downloaded when you run the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 Crash Analyzer. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -## Ensure access to symbol files - - -Typically, debugging information is stored in a symbol file that is separate from the executable. You must have access to the symbol information when you debug an application that has stopped responding, for example if it crashed. - -Symbol files are automatically downloaded when you run **Crash Analyzer**. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -The following is a list of options that are available for guaranteeing access to symbol files: - -- **Copy the dump file to another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, copy the crash dump file to a computer that does have an Internet connection and run the stand-alone **Crash Analyzer Wizard** on that computer. - -- **Access the symbol files from another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, you can download the symbols from a computer that does have an Internet connection and then copy them to the computer that does not have an Internet connection, or you can map a network drive to a location where the symbols are available on the local network. If you run the **Crash Analyzer** in a Windows Recovery Environment (Windows RE), you can include the symbol files on the DaRT recovery image. For more information about how to create a recovery image, see [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md). - -- **Access symbol files through an HTTP proxy server.** If the symbols cannot be downloaded because an HTTP proxy server must be accessed, use the following steps to access an HTTP proxy server. In DaRT 7, the **Crash Analyzer Wizard** has a setting available on the **Specify Symbol Files Location** dialog page, marked with the label **Proxy server (optional, using the format "server:port")**. You can use this text box to specify a proxy server. Enter the proxy address in the form **<hostname>:<port>**, where the <**hostname**> is a DNS name or IP address, and the <**port**> is a TCP port number, usually 80. There are two modes in which the **Crash Analyzer** can be run. Following is how you use the proxy setting in each of these modes: - - - **Online mode:** In this mode, if the proxy server field is left blank, the wizard uses the proxy settings from Internet Options in Control Panel. If you enter a proxy address in the text box which is provided, that address will be used, and it will override the setting in the Internet Options. - - - **Windows Recovery Environment (Windows RE):** When you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window, there is no default proxy address. If the computer is directly connected to the Internet, a proxy address is not required. Therefore, you can leave this field blank in the wizard setting. If the computer is not directly connected to the Internet, and it is in a network environment that has a proxy server, you must set the proxy field in the wizard to access the symbol store. The proxy address can be obtained from the network administrator. Setting the proxy server is important only when the public symbol store is connected to the Internet. If the symbols are already on the DaRT recovery image, or if they are available locally, setting the proxy server is not required. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md b/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md deleted file mode 100644 index f7bab54d96..0000000000 --- a/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: How to Recover Local Computers Using the DaRT Recovery Image -description: How to Recover Local Computers Using the DaRT Recovery Image -author: dansimp -ms.assetid: be29b5a8-be08-4cf2-822e-77a51d3f3b65 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover Local Computers Using the DaRT Recovery Image - - -To recover a local computer by using Microsoft Diagnostics and Recovery Toolset (DaRT) 7, you must be physically present at the end-user computer that is experiencing problems that require DaRT. You can also run DaRT remotely by following the instructions at [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md). - -**To recover a local computer by using DaRT** - -1. As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. You are asked whether you want to initialize network services. If you click **Yes**, it is assumed that a DHCP server is present on the network and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - To skip the network initialization process, click **No**. - -2. Following the network initialization dialog box, you are asked whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -3. Following the remapping dialog box, a **System Recovery Options** dialog box appears and asks you to select a keyboard layout. Then it displays the system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers. This prompts you to insert the installation media for the device and to select the driver. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 7 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor, and several other DaRT utilities, will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -4. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created. - -You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides. - -For general information about any of the DaRT tools, see [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md). - -**To run DaRT at the command prompt** - -1. You can run DaRT at the command prompt by specifying the **netstart.exe** command and by using any of the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    -network

    Initializes the network services.

    -remount

    Remaps the drive letters.

    -prompt

    Displays messages asking the end user to specify whether to initialize the network and remap the drives.

    -
    - Important

    The end user’s response to the prompts overrides the -network and -remount switches.

    -
    -
    - -
    - - - -2. You can customize DaRT so that a computer that boots into DaRT automatically opens the **Remote Connection** tool that is used to establish a remote connection with the help desk. - -## Related topics - - -[Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md b/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md deleted file mode 100644 index 4ed0e0e5ec..0000000000 --- a/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md +++ /dev/null @@ -1,196 +0,0 @@ ---- -title: How to Recover Remote Computers Using the DaRT Recovery Image -description: How to Recover Remote Computers Using the DaRT Recovery Image -author: dansimp -ms.assetid: 66bc45fb-dc40-4d47-b583-5bb1ff5c97a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Recover Remote Computers Using the DaRT Recovery Image - - -The Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 7 lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a helpdesk professional working on the end-user computer), the IT administrator or helpdesk agent can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important** -The two computers establishing a remote connection must be part of the same network. - - - -**To recover a remote computer by using DaRT** - -1. Boot an end-user computer by using the DaRT recovery image. - - You will typically use one of the following methods to boot into DaRT to recover a remote computer, depending on how you deploy the DaRT recovery image. For more information about deploying the DaRT recovery image, see [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md). - - - Boot into DaRT from a recovery partition on the problem computer. - - - Boot into DaRT from a remote partition on the network. - - For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md). - - Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - - **Note** - Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -2. As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. You are asked whether you want to initialize network services. If you click **Yes**, it is assumed that a DHCP server is present on the network and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - To skip the network initialization process, click **No**. - -3. Following the network initialization dialog box, you are asked whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. Following the remapping dialog box, a **System Recovery Options** dialog box appears and asks you to select a keyboard layout. Then it displays the system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers. This prompts you to insert the installation media for the device and to select the driver. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 7 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about this situation including how to resolve it, see [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md). - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor, and several other DaRT utilities, will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -5. On the **System Recovery Options** window, select **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset** window. - -6. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**. - - The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information. - -7. On the helpdesk agent computer, open the **DaRT Remote Connection Viewer**. - - Click **Start**, click **All Programs**, click **Microsoft DaRT 7**, and then click **DaRT Remote Connection Viewer**. - -8. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information. - - **Note** - This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer. - - - -9. Click **Connect**. - -The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely. - -**Note** -A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32. - - - -**To customize the Remote Connection process** - -1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413). - - Specify the following commands and parameters to customize how a remote connection is established with an end-user computer: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandParameterDescription

    RemoteRecovery.exe

    -nomessage

    Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.

    WaitForConnection.exe

    none

    Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.

    -
    - Important

    This command serves no function if it is specified independently. It must be specified in a script to function correctly.

    -
    -
    - -
    - - - -2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT: - - ```ini - [LaunchApps] - "%windir%\system32\netstart.exe -network -remount" - "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage" - "%windir%\system32\WaitForConnection.exe" - "%SYSTEMDRIVE%\sources\recovery\recenv.exe" - ``` - -**To run the Remote Connection Viewer at the command prompt** - -1. You can run the **DaRT Remote Connection Viewer** at the command prompt by specifying the **DartRemoteViewer.exe** command and by using the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    -ticket=<ticketnumber>

    Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection.

    -ipaddress=<ipaddress>

    Where <ipaddress> is the IP address that is generated by Remote Connection.

    -port=<port>

    Where <port> is the port that corresponds to the specified IP address.

    - - - -~~~ -**Note** -The variables for these parameters are created on the end-user computer and must be provided by the end user. -~~~ - - - -2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified. - -## Related topics - - -[Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md b/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md deleted file mode 100644 index 943522849f..0000000000 --- a/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: dansimp -ms.assetid: 881d573f-2f18-4c5f-838e-2f5320179f94 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer - - -If you cannot access the Microsoft Debugging Tools for Windows or the symbol files on the end-user computer, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of Crash Analyzer installed, such as a helpdesk administrator’s computer. - -**To run the Crash Analyzer in stand-alone mode** - -1. On a computer with DaRT 7 installed, click **Start** / **All Programs** / **Microsoft DaRT 7**. - -2. Provide the required information for the following: - - - Microsoft Debugging Tools for Windows - - - Symbol files - - For more information about symbol files, see, [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md). - - - A crash dump file - - **Note**   - Use the Search tool in DaRT 7 to locate the copied crash dump file. - - - -3. The **Crash Analyzer** scans the crash dump file and reports a probable cause of the crash. You can view more information about the crash, such as the specific crash message and description, the drivers loaded at the time of the crash, and the full output of the analysis. - -4. Decide upon an appropriate strategy to resolve the problem. This may require disabling or updating the device driver that caused the crash by using the **Services and Drivers** node of the **Computer Management** tool in DaRT. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md b/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md deleted file mode 100644 index 857157396c..0000000000 --- a/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Run the Crash Analyzer on an End-user Computer -description: How to Run the Crash Analyzer on an End-user Computer -author: dansimp -ms.assetid: 40af4ead-6588-4a81-8eaa-3dc00c397e1d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run the Crash Analyzer on an End-user Computer - - -Typically, you run Microsoft Diagnostics and Recovery Toolset (DaRT) 7 Crash Analyzer from the Diagnostics and Recovery Toolset window on an end-user computer that has problems. The Crash Analyzer tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -**To open and run the Crash Analyzer on an end-user computer** - -1. On the **Diagnostics and Recovery Toolset** window on an end-user computer, click **Crash Analyzer**. - -2. Provide the required information for the following: - - - Microsoft Debugging Tools for Windows - - - Symbol files - - For more information about symbol files, see, [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md). - - - A crash dump file - - Follow these steps to determine the location of the crash dump file: - - 1. Open the **System Properties** window. - - Click **Start**, type sysdm.cpl, and then press Enter. - - 2. Click the **Advanced** tab. - - 3. In the **Startup and Recovery** area, click **Settings**. - - **Note**   - If you do not have access to the **System Properties** window, you can search for dump files on the end-user computer by using the **Search** tool in DaRT. - - - -3. The **Crash Analyzer** scans the crash dump file and reports a probable cause of the crash. You can view more information about the crash, such as the specific crash message and description, the drivers loaded at the time of the crash, and the full output of the analysis. - -4. Decide upon an appropriate strategy to resolve the problem. This may require disabling or updating the device driver that caused the crash by using the **Services and Drivers** node of the **Computer Management** tool in DaRT. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md b/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md deleted file mode 100644 index 28abed205c..0000000000 --- a/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: How to Use the DaRT Recovery Image Wizard to Create the Recovery Image -description: How to Use the DaRT Recovery Image Wizard to Create the Recovery Image -author: dansimp -ms.assetid: 1b8ef983-fff9-4d75-a2f6-53120c5c00c9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Use the DaRT Recovery Image Wizard to Create the Recovery Image - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 includes the **DaRT Recovery Image Wizard** that is used in Windows to create a bootable International Organization for Standardization (ISO) image. An ISO image is a file that represents the raw contents of a CD. - -The **DaRT Recovery Image Wizard** requires the following information: - -- **Boot Image**˚˚You must provide the path of a Windows 7 DVD or Windows 7 source files that are required to create the DaRT recovery image. - -- **Tool Selection**˚˚You can select the tools to include on the DaRT recovery image. - -- **Remote Connections**˚˚You can select whether you want the DaRT recovery image to include the ability to establish a remote connection between the helpdesk and the end-user computer. - -- **Debugging Tools for Windows**˚˚You are asked to provide the location of the Debugging Tools for Windows. - -- **Definitions for Standalone System Sweeper**˚˚You can decide whether to download the latest definitions at the time that you create the recovery image or download the definitions later. - -- **Drivers**˚˚You are asked whether you want to add drivers to the ISO image. - -- **Additional Files**˚˚You can add files to the ISO image that might help diagnose problems. - -- **ISO Image Location**˚˚You are asked to specify where the ISO image should be located. - -- **CD/DVD Drive**˚˚You are asked to specify whether the CD or DVD drive should be used to burn the CD or DVD. - -**Note**   -The ISO image size can vary, depending on the tools that were selected in the **DaRT Recovery Image Wizard**. - - - -## To create the recovery image using the DaRT Recovery Image Wizard - - -Follow these instructions to use the **DaRT Recovery Image Wizard** to create the DaRT recovery image. - -### To select the tools to include on the DaRT recovery image - -The **DaRT Recovery Image Wizard** presents a **Tool Selection** dialog box. You can select or remove tools from the list of tools to be included on the DaRT recovery image by highlighting a tool and then clicking the **Enable** or **Disable** buttons. - -After you have selected all the tools that you want to include on the recovery image, click **Next**. - -### To add the option to allow remote connectivity - -You can select the **Allow remote connections** check box to provide the option in the **Diagnostics and Recovery Toolset** window to establish a remote connection between the helpdesk agent and an end-user computer. After a helpdesk agent establishes a remote connection, they can run the DaRT tools on the end-user computer from a remote location. - -You can select the **Specify the port number** check box to enter a specific port number that will be used when establishing a remote connection. You can specify a port number between 1 and 65535. We recommend that the port number be 1024 or higher to minimize the possibility of a conflict. - -You can also create a customized message that an end user will receive when they establish a remote connection. The message can be a maximum of 2048 characters. - -For more information about remotely running the DaRT tools, see [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md). - -### To add the Debugging Tools for Windows to the DaRT recovery image - -In the **Crash Analyzer** dialog box of the **DaRT Recovery Image Wizard**, you are asked to specify the location of the Debugging Tools for Windows. If you do not have a copy of the tools, you can download them from Microsoft. The following link to the download page is provided in the wizard: [Download and Install Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=99934). - -You can either specify the location of the debugging tools on the computer where you are running the **DaRT Recovery Image Wizard**, or you can decide to use the tools that are located on the destination computer. If you decide to use a copy on another computer, you must make sure that the tools are installed on each computer on which you are diagnosing a crash. - -**Note**   -If you include the **Crash Analyzer** in the ISO image, we recommend that you also include the Debugging Tools for Windows. - - - -Follow these steps to add the Debugging Tools for Windows: - -1. (Optional) Click the hyperlink to download the Debugging Tools for Windows. - -2. Select one of the following options: - - - **Use the Debugging Tools for Windows in the following location**. If you select this option, you can browse to the location of the tools. - - - **Locate the Debugging Tools for Windows on the system that you are repairing**. If you select this option, the **Crash Analyzer** will not work if the Debugging Tools for Windows are not found on the problem computer. - -3. After you have finished, click **Next**. - -### To add definitions for Standalone System Sweeper to the DaRT recovery image - -Definitions are a repository of known malware and other potentially unwanted software. Because malware is being continually developed, **Standalone System Sweeper** relies on current definitions to determine whether software that is trying to install, run, or change settings on a computer is potentially unwanted or malicious software. - -To include the latest definitions in the DaRT recovery image (recommended), click **Yes, download the latest definitions.** The definition update starts automatically. You must be connected to the Internet to complete this process. - -To skip the definition update, click **No, manually download definitions later**. Definitions will not be included in the DaRT recovery image. - -If you decide not to include the latest definitions on the recovery image, or if the definitions included on the recovery image are no longer current by the time that you are ready to use **Standalone System Sweeper**, obtain the latest definitions before you begin a scan by following the instructions that are provided in the **Standalone System Sweeper**. - -**Important**   -You cannot scan if there are no definitions. - - - -After you have finished, click **Next**. - -### To add drivers to the DaRT recovery image - -**Caution**   -By default, when you add a driver to the DaRT recovery image, all additional files and subfolders that are located in that folder are added into the recovery image. For more information, see [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md). - - - -You should include additional drivers on the recovery image for DaRT 7 that you may need when repairing a computer. These may typically include storage or network controllers that are not included on the Windows DVD. - -**Important**   -When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT. - - - -**To add a storage or network controller driver to the recovery image** - -1. In the **Additional Drivers** dialog box of the **DaRT Recovery Image Wizard**, click **Add Device**. - -2. Browse to the file to be added for the driver, and then click **Open**. - - **Note**   - The **driver** file is provided by the manufacturer of the storage or network controller. - - - -3. Repeat Steps 1 and 2 for every driver that you want to include. - -4. After you have finished, click **Next**. - -### To add files to the DaRT recovery image - -Follow these steps to add files to the recovery image so that you can use them to diagnose computer problems. - -1. In the **Additional Files** dialog box of the **DaRT Recovery Image Wizard**, click **Show Files**. This opens an Explorer window that displays the folder that holds the shared files. - -2. Create a subfolder in the folder that is listed in the dialog box. - -3. Copy the files that you want to the new subfolder. - -4. After you have finished, click **Next.** - -### To select a location for the ISO that contains the DaRT recovery image - -Follow these steps to specify the location where the ISO image is created: - -1. In the **Create Startup Image** dialog box of the **DaRT Recovery Image Wizard**, click **Browse**. - -2. Browse to the preferred location in the **Save As** window, and then click **Save**. - -3. After you have finished, click **Next**. - -The size of the ISO image will vary, depending on the tools that you select and the files that you add in the wizard. - -The wizard requires the ISO image to have an **.iso** file name extension because most programs that burn a CD or DVD require that extension. If you do not specify a different location, the ISO image is created on your desktop with the name **DaRT70.ISO**. - -### To burn the recovery image to a CD or DVD - -If the **DaRT Recovery Image Wizard** detects a compatible CD-RW drive on your computer, it offers to burn the ISO image to a disc for you. If you want to burn a CD or DVD and the wizard does not recognize your drive, you must use another program, such as the program that was included with your drive. You can use a duplicator, a duplicating service, or CD or DVD-burning software to make any additional copies. - -1. In the **Burn to a recordable CD/DVD** dialog box of the **DaRT Recovery Image Wizard**, select **Burn the image to the following recordable CD/DVD drive**. - -2. Select the CD or DVD drive. - - **Note**   - If a drive is not recognized and you install a new drive, you can click **Refresh Drive List** to force the wizard to update the list of available drives. - - - -3. Click **Next**. - -## Related topics - - -[Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md) - - - - - - - - - diff --git a/mdop/dart-v7/images/checklistbox.gif b/mdop/dart-v7/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/dart-v7/images/checklistbox.gif and /dev/null differ diff --git a/mdop/dart-v7/index.md b/mdop/dart-v7/index.md deleted file mode 100644 index ba12a07c9d..0000000000 --- a/mdop/dart-v7/index.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Diagnostics and Recovery Toolset 7 Administrator's Guide -description: Diagnostics and Recovery Toolset 7 Administrator's Guide -author: dansimp -ms.assetid: bf89eccd-fc03-48ff-9019-a8640e11dd99 -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Diagnostics and Recovery Toolset 7 Administrator's Guide - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 lets you diagnose and repair a computer that cannot be started or that has problems starting as expected. By using DaRT, you can recover end-user computers that have become unusable, diagnose probable causes of issues, and quickly repair unbootable or locked-out computers. When it is necessary, you can also quickly restore important lost files and detect and remove malware, even when the computer is not online. - -DaRT is an important part of the Microsoft Desktop Optimization Pack (MDOP), a dynamic solution available to Software Assurance customers that helps reduce software installation costs, enables delivery of applications as services, and helps manage and control enterprise desktop environments. - -[Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -[About DaRT 7.0](about-dart-70-new-ia.md)**|**[Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md)**|**[Accessibility for DaRT 7.0](accessibility-for-dart-70.md) - -[Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -[Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md)**|**[DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md)**|**[Planning to Create the DaRT 7.0 Recovery Image](planning-to-create-the-dart-70-recovery-image.md)**|**[Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md)**|**[DaRT 7.0 Planning Checklist](dart-70-planning-checklist-dart-7.md) - -[Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -[Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md)**|**[Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md)**|**[Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md)**|**[DaRT 7.0 Deployment Checklist](dart-70-deployment-checklist-dart-7.md) - -[Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -[Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md)**|**[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md)**|**[Security Considerations for DaRT 7.0](security-considerations-for-dart-70-dart-7.md) - -[Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -[Technical Reference for DaRT 7.0](technical-reference-for-dart-70-new-ia.md) - -### More Information - -[Release Notes for DaRT 7.0](release-notes-for-dart-70-new-ia.md) -View updated product information and known issues for DaRT 7. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - - diff --git a/mdop/dart-v7/operations-for-dart-70-new-ia.md b/mdop/dart-v7/operations-for-dart-70-new-ia.md deleted file mode 100644 index 1a7b02146b..0000000000 --- a/mdop/dart-v7/operations-for-dart-70-new-ia.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Operations for DaRT 7.0 -description: Operations for DaRT 7.0 -author: dansimp -ms.assetid: 5566d817-fc14-4408-ba01-1d87fbc132d9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for DaRT 7.0 - - -This section of the Administrator’s Guide includes information about the various types of Microsoft Diagnostics and Recovery Toolset (DaRT) 7 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations information - - -- [Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md) - - This section provides information to help you recover computers using the DaRT 7 recovery image. - -- [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md) - - This section provides information to help you use the DaRT 7 Crash Analyzer to diagnose system failures. - -- [Security Considerations for DaRT 7.0](security-considerations-for-dart-70-dart-7.md) - - This section provides information to help you follow security best practices while using DaRT 7. - -## Other resources for DaRT operations - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md b/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md deleted file mode 100644 index 30c1b4a4a7..0000000000 --- a/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: Overview of the Tools in DaRT 7.0 -description: Overview of the Tools in DaRT 7.0 -author: dansimp -ms.assetid: 67c5991e-cbe6-4ce9-9fe5-f1761369d1fe -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of the Tools in DaRT 7.0 - - -From the **Diagnostics and Recovery Toolset** window in Microsoft Diagnostics and Recovery Toolset (DaRT) 7, you can start any of the individual tools that were included when the DaRT recovery image was created. For information about how to access the **Diagnostics and Recovery Toolset** window, see [How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md). - -If it is available, you can use the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to select the tool that best addresses your particular issue, based on a brief interview. - -## Exploring the DaRT Tools - - -This section describes the various tools that are part of DaRT. - -### Registry Editor - -You can use **Registry Editor** to access and change the registry of the Windows operating system that you are analyzing or repairing. This includes adding, removing, and editing keys and values, and importing registry (.reg) files. - -**Caution**   -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -### Locksmith - -The **Locksmith Wizard** lets you set or change the password for any local account on the Windows operating system that you are analyzing or repairing. You do not have to know the current password. However, the password that you set must comply with any requirements that are defined by a local Group Policy object. This includes password length and complexity. - -You can use **Locksmith** when the password for a local account, such as the local Administrator account, is unknown. You cannot use **Locksmith** to set passwords for domain accounts. - -### Crash Analyzer - -Use the **Crash Analyzer Wizard** to quickly determine the cause of a computer crash by analyzing the memory dump file on the Windows operating system that you are repairing. **Crash Analyzer** examines the crash dump file for the driver that caused a computer to fail. Then, you can disable the problem device driver by using the **Services and Drivers** node in the **Computer Management** tool. - -The **Crash Analyzer Wizard** requires the Debugging Tools for Windows and symbol files for the operating system that you are repairing. You can include both requirements when you create the DaRT recovery image. If they are not included on the recovery image and you do not have access to them on the computer that you are repairing, you can copy the memory dump file to another computer and use the stand-alone version of **Crash Analyzer** to diagnose the problem. - -Running **Crash Analyzer** is a good idea even if you plan to reimage the computer. The image could have a defective driver that is causing problems in your environment. By running **Crash Analyzer**, you can identify problem drivers and improve the image stability. - -For more information about **Crash Analyzer**, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md). - -### File Restore - -**File Restore** lets you try to restore files that were accidentally deleted or that were too big to fit in the Recycle Bin. **File Restore** is not limited to regular disk volumes, but can find and restore files on lost volumes or on volumes that are encrypted by BitLocker. - -### Disk Commander - -**Disk Commander** lets you recover and repair disk partitions or volumes by using one of the following recovery processes: - -- Restore the master boot record (MBR) - -- Recover one or more lost volumes - -- Restore partition tables from **Disk Commander** backup - -- Save partition tables to **Disk Commander** backup - -**Warning**   -We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table. - - - -### Disk Wipe - -You can use **Disk Wipe** to delete all data from a disk or volume, even the data that is left behind after you reformat a hard disk drive. **Disk Wipe** lets you select from either a single-pass overwrite or a four-pass overwrite, which meets current U.S. Department of Defense standards. - -**Warning**   -After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it. - - - -### Computer Management - -**Computer Management** is a collection of Windows administrative tools that help you troubleshoot a problem computer. You can use the **Computer Management** tools in DaRT to view system information and event logs, manage disks, list autoruns, and manage services and drivers. The **Computer Management** console is customized to help you diagnose and repair problems that might be preventing the Windows operating system from starting. - -### Explorer - -The **Explorer** tool lets you browse the computer’s file system and network shares so that you can remove important data that the user stored on the local drive before you try to repair or reimage the computer. And because you can map drive letters to network shares, you can easily copy and move files from the computer to the network for safekeeping or from the network to the computer to restore them. - -### Solution Wizard - -The **Solution Wizard** presents a series of questions and then recommends the best tool for the situation, based on your answers. This wizard helps you determine which tool to use when you are not familiar with the tools in DaRT. - -### TCP/IP Config - -When you boot a problem computer into DaRT, it is set to automatically obtain its TCP/IP configuration (IP address and DNS server) from Dynamic Host Configuration Protocol (DHCP). If DHCP is unavailable, you can manually configure TCP/IP by using the **TCP/IP Config** tool. You first select a network adapter, and then configure the IP address and DNS server for that adapter. - -### Hotfix Uninstall - -The **Hotfix Uninstall Wizard** lets you remove hotfixes or service packs from the Windows operating system on the computer that you are repairing. Use this tool when a hotfix or service pack is suspected in preventing the operating system from starting. - -We recommend that you uninstall only one hotfix at a time, even though the tool lets you uninstall more than one. - -**Important**   -Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix. - - - -### SFC Scan - -The **SFC Scan** tool starts the **System File Repair Wizard** and lets you repair system files that are preventing the installed Windows operating system from starting. The **System File Repair Wizard** can automatically repair system files that are corrupted or missing, or it can prompt you before it performs any repairs. - -### Search - -Before reimaging a computer, recovering files from the local hard disk is important, especially when the user might not have backed up or stored the files elsewhere. - -The **Search** tool opens a **File Search** window that you can use to find documents when you do not know the file path or to search for general kinds of files across all local hard disks. You can search for specific file-name patterns in specific paths. You can also limit results to a date range or size range. - -### Standalone System Sweeper - -**Important**   -Environments with the Standalone System Sweeper deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Standalone System Sweeper tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. - - - -The **Standalone System Sweeper** can help detect malware and unwanted software and warn you of security risks. You can use this tool to scan a computer for and remove malware even when the installed Windows operating system is not running. When the **Standalone System Sweeper** detects malicious or unwanted software, it prompts you to remove, quarantine, or allow for each item. - -Malware that uses rootkits can mask itself from the running operating system. If a rootkit-enabled virus or spyware is in a computer, most real-time scanning and removal tools can no longer see it or remove it. Because you boot the problem computer into DaRT and the installed operating system is offline, you can detect the rootkit without it being able to mask itself. - -### Remote Connection - -The **Remote Connection** tool in DaRT lets you remotely run the DaRT tools on an end-user computer. After certain specific information is provided by the end user (or by a helpdesk professional working on the end-user computer), the IT administrator can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important**   -The two computers establishing a remote connection must be part of the same network. - - - -## Related topics - - -[Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/planning-for-dart-70-new-ia.md b/mdop/dart-v7/planning-for-dart-70-new-ia.md deleted file mode 100644 index 0e8009edfe..0000000000 --- a/mdop/dart-v7/planning-for-dart-70-new-ia.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning for DaRT 7.0 -description: Planning for DaRT 7.0 -author: dansimp -ms.assetid: 9a60cb08-5efb-40fe-b1e3-9ece831f3b43 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for DaRT 7.0 - - -The goal of deployment planning is to successfully and efficiently deploy a product so that it does not disrupt your users or the network. - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## Planning information - - -- [Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) - - There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -- [DaRT 7.0 Planning Checklist](dart-70-planning-checklist-dart-7.md) - - This checklist can be used to help you plan for preparing your computing environment for DaRT 7 deployment. - -## Other resources for DaRT 7 Planning - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md b/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md deleted file mode 100644 index 041f8915f6..0000000000 --- a/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Planning How to Save and Deploy the DaRT 7.0 Recovery Image -description: Planning How to Save and Deploy the DaRT 7.0 Recovery Image -author: dansimp -ms.assetid: d96e9363-6186-4fc3-9b83-ba15ed9694a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning How to Save and Deploy the DaRT 7.0 Recovery Image - - -Use the information in this section when you plan for saving and deploying the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 recovery image. - -## Planning How to Save and Deploy the DaRT Recovery Image - - -You can save and deploy the DaRT recovery image by using the following methods. When you are determining the method that you will use, consider the advantages and disadvantages of each. Also, consider how you want to use DaRT in your enterprise. - -**Note**   -You might want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network. - - - -The following table shows some advantages and disadvantages of each method of using DaRT in your organization. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Method to Boot into DaRTAdvantagesDisadvantages

    From a CD or DVD

    Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk. Also supports cases in which there is no network connection.

    -

    This is most familiar to users of earlier versions of DaRT, and a CD or DVD can be burned directly from the DaRT Recovery Image Wizard.

    Requires that someone with access to the CD or DVD is physically at the end-user computer to boot into DaRT.

    From a USB flash drive (UFD)

    Provides same advantages as booting from a CD or DVD and also provides support to computers that have no CD or DVD drive.

    Requires you to format the UFD before you can use it to boot into DaRT. Also requires that someone with access to the UFD is physically at the end-user computer to boot into DaRT.

    From a remote (network) partition

    Lets you boot into DaRT without needing a CD, DVD, or UFD. Also allows for easy upgrades of DaRT because there is only one file location to update.

    Does not work if the end-user computer is not connected to the network.

    -

    Widely available to end users and might require additional security considerations when you are creating the recovery image.

    From a recovery partition

    Lets you boot into DaRT without needing a CD, DVD, or UFD that includes instances in which there is no network connectivity.

    -

    Also, can be implemented and managed as part of your standard Windows image process by using automated distribution tools, such as Microsoft Endpoint Configuration Manager.

    When updating DaRT, requires you to update all computers in your enterprise instead of just one partition (on the network) or device (CD, DVD, or UFD).

    - - - -## Related topics - - -[Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) - - - - - - - - - diff --git a/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md b/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md deleted file mode 100644 index fb3aeeb596..0000000000 --- a/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Planning to Create the DaRT 7.0 Recovery Image -description: Planning to Create the DaRT 7.0 Recovery Image -author: dansimp -ms.assetid: e5d49bee-ae4e-467b-9976-c1203f6355f9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Create the DaRT 7.0 Recovery Image - - -Use the information in this section when you plan for creating the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 recovery image. - -## Planning to Create the DaRT 7 Recovery Image - - -When you create the DaRT recovery image, you have to decide which tools to include on the image. When you make that decision, remember that end users might have access occasionally to the various DaRT tools. For more information about the DaRT tools, see [Overview of the Tools in DaRT 7.0](overview-of-the-tools-in-dart-70-new-ia.md). For more information about how to help create a secure recovery image, see [Security Considerations for DaRT 7.0](security-considerations-for-dart-70-dart-7.md). - -When you create the DaRT recovery image, you will also specify whether you want to include additional drivers or files. Determine the locations of any additional drivers or files that you want to include on the DaRT recovery image. - -## Prerequisites - - -The following items are required or recommended for creating the DaRT recovery image: - -- Windows 7 source files - - You must provide the path of a Windows 7 DVD or of Windows 7 source files. Windows 7 source files are required to create the DaRT recovery image. - -- Windows Debugging Tools for your platform - - Windows Debugging Tools are required when you run **Crash Analyzer** to determine the cause of a computer crash. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. If it is necessary, you can download the Windows Debugging Tools here: [Download and Install Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=99934). - -- Optional: **Standalone System Sweeper** definitions - - The latest definitions for the **Standalone System Sweeper** are required when you run this tool. Although you can download the definitions when you run **Standalone System Sweeper**, we recommend that you download the latest definitions at the time you create the DaRT recovery image. In this manner, you can still run the tool with the latest definitions even if the problem computer does not have network connectivity. - -- Optional: Windows symbols files for use with **Crash Analyzer** - - Typically, debugging information is stored in a symbol file that is separate from the executable. You must have access to the symbol information when you debug an application that has stopped responding, for example if it crashed. For more information, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md). - -## Related topics - - -[Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/planning-to-deploy-dart-70.md b/mdop/dart-v7/planning-to-deploy-dart-70.md deleted file mode 100644 index 27eb83e0aa..0000000000 --- a/mdop/dart-v7/planning-to-deploy-dart-70.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Planning to Deploy DaRT 7.0 -description: Planning to Deploy DaRT 7.0 -author: dansimp -ms.assetid: 05e97cdb-a8c2-46e4-9c75-a7d12fe26fe8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy DaRT 7.0 - - -There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -Consider the following when you plan your Microsoft Diagnostics and Recovery Toolset (DaRT) 7 installation: - -- When you install DaRT, you can either install all functionality on an IT administrator computer where you will perform all the tasks associated with running DaRT. Or you can install only the DaRT functionality that creates the recovery image on the IT administrator computer. Then, install the functionality used to run DaRT, such as the **DaRT Remote Connection Viewer** and **Crash Analyzer**, on a helpdesk agent computer. - -- To be able to run DaRT remotely, make sure that the helpdesk agent computer and all computers that you might be troubleshooting remotely are on the same network. - -- Before you roll out DaRT into production, you can first build a lab environment for testing. A test lab should include a minimum of two computers, one to act as the IT administrator/helpdesk agent computer and one to act as an end-user computer. Or, you can use three computers in your lab if you want to separate the IT administrator responsibilities from those of the helpdesk agent. - -## Review the supported configurations - - -You should review the Microsoft Diagnostics and Recovery Toolset (DaRT) 7 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements. - -[DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md) - -## Plan for creating the DaRT recovery image - - -When you create the DaRT recovery image, you have to decide which tools to include on the image. When you make that decision, remember that end users might have access occasionally to the various DaRT tools. When you create the recovery image, you will also specify whether you want to include additional drivers or files. Determine the locations of any additional drivers or files that you want to include on the DaRT recovery image. - -You should be aware of the prerequisites and other additional planning recommendations for creating the DaRT recovery image. - -[Planning to Create the DaRT 7.0 Recovery Image](planning-to-create-the-dart-70-recovery-image.md) - -## Plan for saving and deploying the DaRT recovery image - - -Several methods can be used to save and deploy the DaRT recovery image. When you are determining the method that you will use, consider the advantages and disadvantages of each. Also, consider how you want to use DaRT in your enterprise. - -**Note**   -You might want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network. - - - -[Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md) - -## Other resources for Planning to Deploy DaRT - - -[Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md b/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md deleted file mode 100644 index fb6d52dd23..0000000000 --- a/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Recovering Computers Using DaRT 7.0 -description: Recovering Computers Using DaRT 7.0 -author: dansimp -ms.assetid: bcded7ca-237b-4971-ac34-4394b05cbc50 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recovering Computers Using DaRT 7.0 - - -There are two methods available to recover computers using Microsoft Diagnostics and Recovery Toolset (DaRT) 7. You can either run the DaRT 7 recovery image locally or use The Remote Connection feature available in DaRT 7 to recover a remote computer. Both methods are described in more detail in this section. - -## Recover Local Computers by Using the DaRT Recovery Image - - -To recover a local computer by using DaRT 7, you must be physically present at the end-user computer that is experiencing problems that require DaRT. - -You have several different methods to choose from to boot into DaRT, depending on how you deploy the DaRT recovery image. - -- Insert a DaRT recovery image CD, DVD, or USB flash drive into the problem computer and use it to boot into the computer. - -- Boot into DaRT from a recovery partition on the problem computer. - -- Boot into DaRT from a remote partition on the network. - -For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md). - -Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - -**Note**   -Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -[How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md) - -## Recover Remote Computers by Using the DaRT Recovery Image - - -The Remote Connection feature in DaRT lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a helpdesk professional working on the end-user computer), the IT administrator or helpdesk agent can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important**   -The two computers establishing a remote connection must be part of the same network. - - - -The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**. - -The Remote Connection feature on the end-user computer creates the following connection information: a ticket number, a port, and a list of all available IP addresses. The ticket number and port are generated randomly. - -The IT administrator or helpdesk agent enters this information into the **DaRT Remote Connection Viewer** to establish the terminal services connection to the end-user computer. The terminal services connection that is established lets an IT administrator remotely interact with the DaRT tools on the end-user computer. The end-user computer then processes the connection information, shares its screen, and responds to instructions from the IT administrator computer. - -[How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md) - -## Other resources for recovering computers using DaRT 7 - - -[Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/release-notes-for-dart-70-new-ia.md b/mdop/dart-v7/release-notes-for-dart-70-new-ia.md deleted file mode 100644 index 19faaa9de5..0000000000 --- a/mdop/dart-v7/release-notes-for-dart-70-new-ia.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Release Notes for DaRT 7.0 -description: Release Notes for DaRT 7.0 -author: dansimp -ms.assetid: fad227d0-5c22-4efd-9187-0e5922f7250b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for DaRT 7.0 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 7. - -## About Microsoft Diagnostics and Recovery Toolset 7.0 - - -These release notes contain information that is required to successfully install DaRT 7 and contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT platform documentation, the latest change should be considered authoritative. These release notes supersede the content included with this product. - -## About the Product Documentation - - -Documentation for Microsoft Diagnostics and Recovery Toolset (DaRT) 7 is distributed with the product and on the Connect site. - -For detailed help about how to use the tools in DaRT 7, see the Help file available on the **Diagnostics and Recovery Toolset** menu. - -## Providing feedback - - -We are interested in your feedback on DaRT 7. You can send your feedback to dart7feedback@microsoft.com. This email address is not a support channel, but your feedback will help us to plan future changes for these tools to make them more useful to you in the future. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, we recommend that you install the latest available security updates for any new software being installed. For more information, see [Microsoft Security](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with DaRT 7.0 - - -### SFC Scan cannot start if Standalone System Sweeper is open - -If the Standalone System Sweeper is running, SFC Scan cannot start or run because of a resource conflict between the two tools. - -**Workaround:** Close the Standalone System Sweeper before you try to open or run the SFC Scan tool. - -### Unicode characters may not be displayed in file names - -If you delete a file that has Unicode characters in its file name and try to restore the file by using the File Restore tool, the file is not found. This only occurs when you use characters from a language other than the language of the Windows DVD that was used to create the recovery image. - -**Workaround:** Make sure that the language that is used by DaRT matches the language that is used by the operating system from which it is trying to restore files. - -### DaRT command-line installation may fail silently - -DaRT command-line installation fails silently if run with the quiet mode option unless it is run by using elevated administrator permissions. - -**Workaround:** Run the command-line installation by using elevated administrator permissions. DaRT installation supports the typical Windows Installer options for command-line installation. Please see [Command-Line Options](https://go.microsoft.com/fwlink/?LinkId=160689) for Windows Installer for more information about the several available switches. - -### File Search cannot move a folder to a different volume - -Moving folders between volumes is not supported by the File Search application. If you try to move a folder to a different volume in File Search, the following error is returned: "An error occurred while writing the file *<filename>*. Make sure that the drive has sufficient space and the destination path is accessible." - -**Workaround:** Use the Explorer to move a folder to a different volume. - -### Some data may not be available on computers where the drive letters are remapped - -This problem can occur on BitLocker-enabled computers and multiboot computers. This occurs because some information in the offline registry has hard-coded drive letters, and DaRT uses different letters for the same volumes. The typical effects include not having access to certain local user accounts in Registry Editor. Additionally, some tools may be unable to obtain properties that rely on resolving file paths. - -**Workaround:** Use the option to remap the drive letters as DaRT starts. This usually aligns the typical drive letters to what is expected. - -### Hotfix Uninstall might not uninstall certain updates - -Some updates and service packs cannot be uninstalled because they are marked as un-installable or because they need to be uninstalled from within Windows 7. In these instances, the Hotfix Uninstall tool may indicate that these updates have been uninstalled even though they have not been. - -**Workaround:** Uninstall these problematic updates from Windows 7. - -### Disk Wipe: Disks with spanned volumes, striped volumes, or mirrored volumes cannot be deleted - -Disk Wipe does not support deleting disks that are spanned, mirrored, or striped across one or more volumes. - -**Workaround:** Select and delete each disk in the volume separately. - -## Release Notes Copyright Information - - -This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet website references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. This document is confidential and proprietary to Microsoft. It is disclosed and can be used only pursuant to a nondisclosure agreement. - - - -Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - -## Related topics - - -[About DaRT 7.0](about-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md b/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md deleted file mode 100644 index bba2b7aa94..0000000000 --- a/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Security Considerations for DaRT 7.0 -description: Security Considerations for DaRT 7.0 -author: dansimp -ms.assetid: 52ad7e6c-c169-4ba4-aa76-56335a585eb8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security Considerations for DaRT 7.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 7 includes functionality that lets an administrator run the DaRT tools remotely to resolve problems on an end-user computer. In earlier releases of DaRT, a help desk technician or administrator had to physically be at an end-user computer and boot into DaRT by using the CD or DVD that included the DaRT recovery image. Now, the help desk technician or administrator can perform the same procedures remotely. - -Also in DaRT 7, in addition to burning a CD or DVD, you are now able to save the International Organization for Standardization (ISO) image to a USB flash drive. You can also put the ISO image on a network or include its contents as a recovery partition on a computer hard disk. - -The **Remote Connection** feature in DaRT 7 lets end users access DaRT by using one of these new deployment methods. Therefore, they can more easily start DaRT and access the DaRT tools. - -The new functionalities in DaRT 7 provide much more flexibility in how you use DaRT in your enterprise. However, they also create their own set of security issues that must be addressed. We recommend that you consider the following security tips when you configure DaRT. - -## To help maintain security when you create the DaRT recovery image - - -When you are creating the DaRT recovery image, you can select the tools that you want to include. For security reasons, you might want to restrict end-user access to the more powerful DaRT tools, such as Disk Wipe and Locksmith. In DaRT 7, you can disable certain tools during configuration and still make them available to helpdesk agents when the end user starts the Remote Connection feature. - -You can even configure the DaRT image so that the option to start a remote connection session is the only tool available to an end user. - -**Important**   -After the remote connection is established, all the tools that you included in the recovery image, including those unavailable to the end user, will become available to the helpdesk agent working on the end–user computer. - - - -For more information about including tools in the DaRT recovery image, see [How to Use the DaRT Recovery Image Wizard to Create the Recovery Image](how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md). - -## To help maintain security by encrypting the DaRT recovery image - - -If you use one of the deployment options new in DaRT 7, for example, saving to a USB flash drive or creating a remote partition or a recovery partition, you can include your company’s preferred method of drive encryption on the ISO. This will help make sure that an end user cannot use the functionality of DaRT should they gain access to the recovery image. And it will also make sure that unauthorized users cannot boot into DaRT on computers that belong to someone else. - -Your encryption method should be deployed and enabled in all computers. - -**Note**   -DaRT 7 supports BitLocker natively. - - - -## To help maintain security between two computers during Remote Connection - - -By default, the communication between two computers that have established a **Remote Connection** session may not be encrypted. Therefore, to help maintain security between the two computers, we recommend that both computers are a part of the same network. - -## Related topics - - -[Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - - - - - - - - - diff --git a/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md b/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md deleted file mode 100644 index 71ac50f9ae..0000000000 --- a/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Technical Reference for DaRT 7.0 -description: Technical Reference for DaRT 7.0 -author: dansimp -ms.assetid: f55c7e5e-713a-42d1-84c9-88370155f934 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for DaRT 7.0 - - -This section includes technical reference information about Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 that provide additional information an administrator. - -## Other resources for DaRT operations - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -- [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v7/troubleshooting-dart-70-new-ia.md b/mdop/dart-v7/troubleshooting-dart-70-new-ia.md deleted file mode 100644 index 6c38d06409..0000000000 --- a/mdop/dart-v7/troubleshooting-dart-70-new-ia.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting DaRT 7.0 -description: Troubleshooting DaRT 7.0 -author: dansimp -ms.assetid: 24c50efa-e9ac-45c4-aca2-b1dcfe834fdd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting DaRT 7.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting DaRT 7 - - -- [Diagnostics and Recovery Toolset 7 Administrator's Guide](index.md) - -- [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md) - -- [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md) - -- [Deploying DaRT 7.0](deploying-dart-70-new-ia.md) - -- [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/TOC.md b/mdop/dart-v8/TOC.md deleted file mode 100644 index b2c907364b..0000000000 --- a/mdop/dart-v8/TOC.md +++ /dev/null @@ -1,43 +0,0 @@ -# [Diagnostics and Recovery Toolset 8](index.md) -## [Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) -### [About DaRT 8.0](about-dart-80-dart-8.md) -#### [Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md) -### [About DaRT 8.0 SP1](about-dart-80-sp1.md) -#### [Release Notes for DaRT 8.0 SP1](release-notes-for-dart-80-sp1.md) -### [About DaRT 8.1](about-dart-81.md) -#### [Release Notes for DaRT 8.1](release-notes-for-dart-81.md) -### [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md) -### [Accessibility for DaRT 8.0](accessibility-for-dart-80-dart-8.md) -## [Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) -### [Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) -#### [DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md) -#### [Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md) -#### [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md) -### [DaRT 8.0 Planning Checklist](dart-80-planning-checklist-dart-8.md) -## [Deploying DaRT 8.0](deploying-dart-80-dart-8.md) -### [Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) -#### [How to Deploy DaRT 8.0](how-to-deploy-dart-80-dart-8.md) -#### [How to Change, Repair, or Remove DaRT 8.0](how-to-change-repair-or-remove-dart-80-dart-8.md) -### [Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) -### [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) -#### [How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md) -#### [How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md) -### [DaRT 8.0 Deployment Checklist](dart-80-deployment-checklist-dart-8.md) -## [Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) -### [Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md) -#### [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md) -#### [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md) -### [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) -#### [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md) -#### [How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md) -#### [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md) -### [Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md) -#### [Security Considerations for DaRT 8.0](security-considerations-for-dart-80--dart-8.md) -#### [DaRT 8.0 Privacy Statement](dart-80-privacy-statement-dart-8.md) -### [Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) -#### [How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md) -#### [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md) -## [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) -## [Technical Reference for DaRT 8.0](technical-reference-for-dart-80-new-ia.md) -### [Use Windows Defender Offline (WDO) for malware protection, not DaRT ](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md) - diff --git a/mdop/dart-v8/about-dart-80-dart-8.md b/mdop/dart-v8/about-dart-80-dart-8.md deleted file mode 100644 index 9820c5e742..0000000000 --- a/mdop/dart-v8/about-dart-80-dart-8.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: About DaRT 8.0 -description: About DaRT 8.0 -author: dansimp -ms.assetid: ce91efd6-7d78-44cb-bb8f-1f43f768ebaa -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About DaRT 8.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 helps you troubleshoot and repair Windows-based computers. This includes those computers that cannot be started. DaRT 8.0 is a powerful set of tools that extend the Windows Recovery Environment (WinRE). By using DaRT, you can analyze an issue to determine its cause, for example, by inspecting the computer’s event log or system registry. DaRT supports the recovery of basic hard disks that contain partitions, for example, primary partitions and logical drives, and supports the recovery of volumes. - -**Note**   -DaRT does not support the recovery of dynamic disks. - - - -DaRT also provides tools to help you fix a problem as soon as you determine the cause. For example, you can use the tools in DaRT to disable a faulty device driver, remove hotfixes, restore deleted files, and scan the computer for malware even when you cannot or should not start the installed Windows operating system. - -DaRT can help you quickly recover computers that are running either 32-bit or 64-bit versions of Windows 8, typically in less time than it would take to reimage the computer. - -Functionality in DaRT lets you create a recovery image. The recovery image starts Windows Recovery Environment (Windows RE), from which you can start the **Diagnostics and Recovery Toolset** window and access the DaRT tools. - -Use the **DaRT Recovery Image Wizard** to create the DaRT recovery image. By default, the wizard creates an International Organization for Standardization (ISO) image file and a Windows Imaging Format (WIM) file and let you burn the image to a CD, DVD, or USB. You can deploy the image locally at end user’s computers, or you can deploy it from a remote network partition or a recovery partition on the local hard drive. - -## What’s new in DaRT 8.0 - - -DaRT 8.0 can help you quickly recover computers that are running either 32-bit or 64-bit versions of Windows 8, typically in less time than it would take to reimage the computer. DaRT 8.0 has the following new features. - -### Create DaRT images by using Windows 8 or Windows Server 2012 - -DaRT 8.0 enables you to create DaRT images using either Windows® 8 or Windows Server® 2012. For versions of Windows earlier than Windows 8 and Windows Server 2012, customers should continue to use earlier versions of DaRT. - -### Generate both 32- and 64-bit images from one computer - -DaRT 8.0 enables you to generate both 32-bit and 64-bit images from a single computer that is running DaRT, regardless of whether the computer is a 32-bit or 64-bit computer. In DaRT 7, the image that was created had to be the same, bit-wise, as the computer that was running DaRT. - -### Create one image that supports computers that have either a BIOS or UEFI interface - -DaRT 8.0’s support for both the Unified Extensible Firmware Interface (UEFI) and BIOS interfaces enables you to create just one image that works with computers that have either interface. - -### Use a GUID partition table (GPT) for partitioning - -DaRT 8.0 tools now support Windows 8 GPT disks, which provide a more flexible mechanism for partitioning disks than the older master boot record (MBR) partitioning scheme. DaRT 8.0 tools continue to support MBR partitioning. - -### Install Windows 8 and Windows Server 2012 on the local hard disk - -DaRT 8.0 tools can be used only when Windows 8 and Windows Server 2012 are installed on the local hard disk. Currently, there is no support for Windows To Go. - -### DaRT 8.0 release notes - -For more information, and for late-breaking news that did not make it into the documentation, see the [Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md). - -## How to Get DaRT 8.0 - - -This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/about-dart-80-sp1.md b/mdop/dart-v8/about-dart-80-sp1.md deleted file mode 100644 index e44c7a09be..0000000000 --- a/mdop/dart-v8/about-dart-80-sp1.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: About DaRT 8.0 SP1 -description: About DaRT 8.0 SP1 -author: dansimp -ms.assetid: 2e166444-4097-4b23-9f50-d8819f1f4960 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About DaRT 8.0 SP1 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 Service Pack 1 (SP1) provides the following enhancements, which are described in this topic. - -**Translation of Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 into Ten Languages plus English** - -DaRT 8.0 is now available in the following languages, in addition to English: - -- French (FR) - -- Italian (IT) - -- German (DE) - -- Spanish (ES) - -- Korean (KO) - -- Japanese (JA) - -- Brazilian Portuguese (PT-BR) - -- Russian (RU) - -- Chinese Traditional (ZH-TW) - -- Chinese Simplified (ZH-CN) - -**Updates to the DaRT Defender tool** - -Defender has been updated to include improved protection capabilities. The changes do not impact how you use Defender. - -**Customer feedback rollup** - -DaRT 8.0 SP1 includes a rollup of fixes to address issues found since the DaRT 8.0 release. - -## How to Get DaRT 8.0 SP1 - - -DaRT 8.0 SP1 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Release Notes for DaRT 8.0 SP1](release-notes-for-dart-80-sp1.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/about-dart-81.md b/mdop/dart-v8/about-dart-81.md deleted file mode 100644 index b6da659173..0000000000 --- a/mdop/dart-v8/about-dart-81.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: About DaRT 8.1 -description: About DaRT 8.1 -author: dansimp -ms.assetid: dcaddc57-0111-4a9d-8be9-f5ada0eefa7d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About DaRT 8.1 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.1 provides the following enhancements, which are described in this topic. - -## What’s new - - -- **Support for WIMBoot** - - Diagnostics and Recovery Toolset 8.1 supports the Windows image file boot (WIMBoot) environment if these conditions are met: - - - WIMBoot is based on Windows 8.1 Update 1 or later. - - - The DaRT 8.1 image is built on Windows 8.1 Update 1 or later. - - For more information about WIMBoot, see [Windows Image File Boot (WIMBoot) Overview](https://go.microsoft.com/fwlink/?LinkId=517536). - -- **Support for Windows Server 2012 R2 and Windows 8.1** - - You can create DaRT images by using Windows Server 2012 R2 or Windows 8.1. - - **Note** - For earlier versions of the Windows Server and Windows operating systems, continue to use the earlier versions of DaRT. - - - -- **Customer feedback** - - DaRT 8.1 includes updates that address issues found since the DaRT 8.0 SP1 release. - -- **Windows Defender** - - Windows Defender in Windows 8.1 includes improved protection. The changes do not impact how you use DaRT with Windows Defender. - -## Requirements - - -- **Windows Assessment and Development Kit 8.1** - - Windows Assessment and Development Kit (ADK) 8.1 is a required prerequisite for the DaRT Recovery Image Wizard. Windows ADK 8.1 contains deployment tools that are used to customize, deploy, and service Windows images. It also contains the Windows Preinstallation Environment (Windows PE). - - **Note** - Windows ADK 8.1 is not required if you are installing only Remote Connection Viewer or Crash Analyzer. - - - -~~~ -To download Windows ADK 8.1, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1](https://www.microsoft.com/download/details.aspx?id=39982) in the Microsoft Download Center. -~~~ - -- **Microsoft .NET Framework 4.5.1** - - DaRT 8.1 requires that .NET Framework 4.5.1 is installed. To download, see [Microsoft.NET Framework 4.5.1](https://go.microsoft.com/fwlink/?LinkId=329038) in the Microsoft Download Center. - -- **Windows 8.1 Debugging Tools** - - To use the Crash Analyzer tool in DaRT 8.1, you need the required debugging tools, which are available in the Software Development Kit for Windows 8.1. - - To download, see [Windows Software Development Kit (SDK) for Windows 8.1](https://msdn.microsoft.com/library/windows/desktop/bg162891.aspx) in the Microsoft Download Center. - -## Language availability - - -DaRT 8.1 is available in the following languages: - -- English (United States) en-US - -- French (France) fr-FR - -- Italian (Italy) it-IT - -- German (Germany) de-DE - -- Spanish, International Sort (Spain) es-ES - -- Korean (Korea) ko-KR - -- Japanese (Japan) ja-JP - -- Portuguese (Brazil) pt-BR - -- Russian (Russia) ru-RU - -- Chinese Traditional zh-TW - -- Chinese Simplified zh-CN - -## How to Get MDOP Technologies - - -DaRT 8.1 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - - -[Release Notes for DaRT 8.1](release-notes-for-dart-81.md) - - - - - - - - - diff --git a/mdop/dart-v8/accessibility-for-dart-80-dart-8.md b/mdop/dart-v8/accessibility-for-dart-80-dart-8.md deleted file mode 100644 index 6980d28973..0000000000 --- a/mdop/dart-v8/accessibility-for-dart-80-dart-8.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for DaRT 8.0 -description: Accessibility for DaRT 8.0 -author: dansimp -ms.assetid: 95f426de-222c-4ec0-9b9b-af817c7fff9b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for DaRT 8.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in alternative formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - - - -## Customer service for people with hearing impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For more information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md b/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md deleted file mode 100644 index 49ed66516c..0000000000 --- a/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Administering DaRT 8.0 Using PowerShell -description: Administering DaRT 8.0 Using PowerShell -author: dansimp -ms.assetid: 776430e0-d5c9-4919-877a-fab503451b37 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering DaRT 8.0 Using PowerShell - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 lets you use PowerShell commands to complete various DaRT 8.0 administrative tasks or to create the DaRT recovery image. - -## Perform DaRT tasks by using PowerShell commands - - -DaRT 8.0 provides four PowerShell commands that let you do the following: - -- Burn an ISO to a CD, DVD, or USB drive. - -- Allow the source WIM file, which contains a DaRT image, to be converted into an ISO file. - -- Create a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image. - -- Apply a DartConfiguration object to a mounted Windows Image. - -[How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md) - -## Use a PowerShell script to create the recovery image - - -Rather than use the DaRT Recovery Image wizard to create the recovery image, you can use a PowerShell script and specify the parameters you want. - -[How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md) - -## Other resources for administering DaRT 8.0 using PowerShell - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md deleted file mode 100644 index 9284d0c20e..0000000000 --- a/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md +++ /dev/null @@ -1,290 +0,0 @@ ---- -title: Creating the DaRT 8.0 Recovery Image -description: Creating the DaRT 8.0 Recovery Image -author: dansimp -ms.assetid: 39001b8e-86c0-45ef-8f34-2d6199f9922d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/21/2017 ---- - - -# Creating the DaRT 8.0 Recovery Image - - -After installing Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0, you create a DaRT 8.0 recovery image. The recovery image starts Windows RE, from which you can then start the DaRT tools. You can generate International Organization for Standardization (ISO) files and Windows Imaging Format (WIM) images. In addition, you can use PowerShell to generate scripts that use the settings you select in the DaRT Recovery Image wizard. You can use the script later to rebuild recovery images by using the same settings. The recovery image provides a variety of recovery tools. For a description of the tools, see [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md). - -After you boot the computer into DaRT, you can run the different DaRT tools to try to diagnose and repair the computer. This section walks you through the process of creating the DaRT recovery image and lets you select the tools and features that you want to include as part of the image. - -You can create the DaRT recovery image by using either of two methods: - -- Use the DaRT Recovery Image wizard, which runs in a Windows environment. - -- Modify an example PowerShell script with the values you want. For more information, see [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md). - -You can write the ISO to a recordable CD or DVD, save it to a USB flash drive, or save it in a format that you can use to boot into DaRT from a remote partition or from a recovery partition. - -Once you have created the ISO image, you can burn it onto a blank CD or DVD (if your computer has a CD or DVD drive). If your computer does not have a drive for this purpose, you can use most generic programs that are used to burn CDs or DVDs. - -## Select the image architecture and specify the path - - -On the Windows 8 Media page, you select whether to create a 32-bit or 64-bit DaRT recovery image. Use the 32-bit Windows to build 32-bit DaRT recovery images, and 64-bit Windows to build 64-bit DaRT recovery images. You can use a single computer to create recovery images for both architecture types, but you cannot create one image that works on both 32-bit and 64-bit architectures. You also indicate the path of the Windows 8 installation media. Choose the architecture that matches the one of the recovery image that you are creating. - -**To select the image architecture and specify the path** - -1. On the **Windows 8 Media** page, select one of the following: - - - If you are creating a recovery image for 64-bit computers, select **Create x64 (64-bit) DaRT image**. - - - If you are creating a recovery image for 32-bit computers, select **Create x86 (32-bit) DaRT image**. - -2. In the **Specify the root path of the Windows 8 <64-bit or 32-bit> install media** box, type the path of the Windows 8 installation files. Use a path that matches the architecture of the recovery image that you are creating. - -3. Click **Next**. - -## Select the tools to include on the recovery image - - -On the Tools page, you can select numerous tools to include on the recovery image. These tools will be available to end users when they boot into the DaRT image. However, if you enable remote connectivity when creating the DaRT image, all of the tools will be available when a help desk worker connects to the end user’s computer, regardless of which tools you chose to include on the image. - -To restrict end-user access to these tools, but still retain full access to the tools through the Remote Connection Viewer, do not select those tools on the Tools page. End users will be able to use only Remote Connection and will be able to see, but not access, any tools that you exclude from the recovery image. - -**To select the tools to include on the recovery image** - -1. On the **Tools** page, select the check box beside each tool that you want to include on the image. - -2. Click **Next**. - -## Choose whether to allow remote connectivity by a help desk - - -On the Remote Connection page, you can choose to enable a help desk worker to remotely connect to and run the DaRT tools on an end user’s computer. The remote connectivity option is then shown as an available option in the Diagnostics and Recovery Toolset window. After help desk workers establish a remote connection, they can run the DaRT tools on the end-user computer from a remote location. - -**To choose whether to allow remote connectivity by help desk workers** - -1. On the **Remote Connection** page, select the **Allow remote connections** check box to allow remote connections, or clear the check box to prevent remote connections. - -2. If you cleared the **Allow remote connections** check box, click **Next**. Otherwise, go to the next step to continue configuring remote connectivity. - -3. Select one of the following: - - - Let Windows choose an open port number. - - - Specify the port number. If you select this option, enter a port number between 1 and 65535 in the field beneath the option. This port number will be used when establishing a remote connection. We recommend that the port number be 1024 or higher to minimize the possibility of a conflict. - -4. (Optional) in the **Remote connection welcome** message box, create a customized message that end users receive when they establish a remote connection. The message can be a maximum of 2048 characters. - -5. Click **Next**. - - For more information about running the DaRT tools remotely, see [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md). - -## Add drivers to the recovery image - - -On the Drivers tab of the Advanced Options page, you can add additional device drivers that you may need when repairing a computer. These may typically include storage or network controllers that Windows 8 does not provide. Drivers are installed when the image is created. - -**Important**   -When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT. - - - -**To add drivers to the recovery image** - -1. On the **Advanced Options** page, click the **Drivers** tab. - -2. Click **Add**. - -3. Browse to the file to be added for the driver, and then click **Open**. - - **Note**   - The driver file is provided by the manufacturer of the storage or network controller. - - - -4. Repeat Steps 2 and 3 for every driver that you want to include. - -5. Click **Next**. - -## Add WinPE optional packages to the recovery image - - -On the WinPE tab of the Advanced Options page, you can add WinPE optional packages to the DaRT image. These packages are part of the Windows ADK, which is an installation prerequisite for the DaRT Recovery Image wizard. The tools that you can select are all optional. Any required packages are added automatically, based on the tools you selected on the Tools page. - -You can also specify the size of the scratch space. Scratch space is the amount of RAM disk space that is set aside for DaRT to run. The scratch space is useful in case the end user’s hard disk is not available. If you are running additional tools and drivers, you may want to increase the scratch space. - -**To add WinPE optional packages to the recovery image** - -1. On the **Advanced Options** page, click the **WinPE** tab. - -2. Select the check box beside each package that you want to include on the image, or click the **Name** check box to select all of the packages. - -3. In the **Scratch Space** field, select the amount of RAM disk space to allocate for running DaRT in case the end user’s hard disk is not available. - -4. Click **Next**. - -## Add the debugging tools for Crash Analyzer - - -If you include the Crash Analyzer tool in the ISO image, you must also include the Debugging Tools for Windows. On the Crash Analyzer tab of the Advanced Options page, you enter the path of the Windows 8 Debugging Tools, which Crash Analyzer uses to analyze memory dump files. You can use the tools that are on the computer where you are running the DaRT Recovery Image wizard, or you can use the tools that are on the end-user computer. If you decide to use the tools on the end-user computer, remember that every computer that you diagnose must have the Debugging Tools installed. - -If you installed the Microsoft Windows Software Development Kit (SDK) or the Microsoft Windows Development Kit (WDK), the Windows 8 Debugging Tools are added to the recovery image by default, and the path to the Debugging Tools is automatically filled in. You can change the path of the Windows 8 Debugging Tools if the files are located somewhere other than the location indicated by the default file path. A link in the wizard lets you download and install debugging tools for Windows if they are not already installed. - -To download the Windows Debugging Tools, see [Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=266248). Install the Debugging Tools to the default location. - -**Note**   -The DaRT wizard checks for the tools in the `HKLM\Software\Microsoft\Windows Kits\Installed Roots\WindowsDebuggersRoot` registry key. If the registry value is not there, the wizard looks in one of the following locations, depending on your system architecture: - -`%ProgramFilesX86%\Windows Kits\8.0\Debuggers\x64` - -`%ProgramFilesX86%\Windows Kits\8.0\Debuggers\x86` - - - -**To add the debugging tools for Crash Analyzer** - -1. On the **Advanced Options** page, click the **Crash Analyzer** tab. - -2. (Optional) Click **Download the Debugging Tools** to download the Debugging Tools for Windows. - -3. Select one of the following options: - - - **Include the Windows 8 <64-bit or 32-bit> Debugging Tools**. If you select this option, browse to and select the location of the tools if the path is not already displaying. - - - **Use the Debugging Tools from the system that is being debugged**. If you select this option, the Crash Analyzer will not work if the Debugging Tools for Windows are not found on the problem computer. - -4. Click **Next**. - -## Add definitions for the Defender tool - - -On the Defender tab of the Advanced Options page, you add definitions, which are used by the Defender tool to determine whether software that is trying to install, run, or change settings on a computer is unwanted or malicious software. - -**To add definitions for the Defender tool** - -1. On the **Advanced Options** page, click the **Defender** tab. - -2. Select one of the following options: - - - **Download the latest definitions (Recommended)** – The definition update starts automatically, and the definitions are added to the DaRT recovery image. This option is recommended to help you avoid cases where the definitions might not be available. You must be connected to the Internet to download the definitions. - - - **Download the definitions later** – Definitions will not be included in the DaRT recovery image, and you will need to download the definitions from the computer that is running DaRT. - - If you decide not to include the latest definitions on the recovery image, or if the definitions included on the recovery image are no longer current by the time that you are ready to use Defender, obtain the latest definitions before you begin a scan by following the instructions that are provided in Defender. - - **Important**   - You cannot scan if there are no definitions. - - - -3. Click **Next**. - -## Select the types of recovery image files to create - - -On the Create Image page, you choose an output folder for the recovery image, enter an image name, and select the types of DaRT recovery image files to create. During the recovery image creation process, Windows source files are unpacked, DaRT files are copied to it, and the image is then “re-packed” into the file formats that you select on this page. - -The available image file types are: - -- **Windows Imaging File (WIM)** - used to deploy DaRT to a preboot execution environment (PXE) or local partition). - -- **ISO image file** – used to deploy to CD or DVD, or for use in virtual machines (VM)s). The wizard requires that the ISO image have an .iso file name extension because most programs that burn a CD or DVD require that extension. If you do not specify a different location, the ISO image is created on your desktop with the name DaRT8.ISO. - -- **PowerShell script** – creates a DaRT recovery image with commands that provide essentially the same options that you can select by using the DaRT Recovery Image wizard. The script also enables you to add or changes files in the DaRT recovery image. - -If you select the Edit Image check box on this page, you can customize the recovery image during the image creation process. For example, you can change the “winpeshl.ini” file to create a custom startup order or to add third-party tools. - -**To select the types of recovery image files to create** - -1. On the **Create Image** page, click **Browse** to choose the output folder for the image file. - - **Note**   - The size of the image will vary, depending on the tools that you select and the files that you add in the wizard. - - - -2. In the **Image name** box, enter a name for the DaRT recovery image, or accept the default name, which is DaRT8. - - The wizard creates a subfolder in the output path by this name. - -3. Select the types of image files that you want to create. - -4. Choose one of the following: - - - To change the files in the recovery image before you create the image files, select the **Edit Image** check box, and then click **Prepare**. - - - To create the recovery image without changing the files, click **Create**. - -5. - - Click **Next**. - -## Edit the recovery image files - - -You can edit the recovery image only if you selected the Edit Image check box on the Create Image page. After the recovery image has been prepared for editing, you can add and modify the recovery image files before creating the bootable media. For example, you can create a custom order for startup, add various third-party tools, and so on. - -**To edit the recovery image files** - -1. On the **Edit Image** page, click **Open** in Windows Explorer. - -2. Create a subfolder in the folder that is listed in the dialog box. - -3. Copy the files that you want to the new subfolder, or remove files that you don’t want. - -4. Click **Create** to start creating the recovery image. - -## Generate the recovery image files - - -On the Generate Files page, the DaRT recovery image is generated for the file types that you selected on the Create Image page. - -**To generate the recovery image files** - -- On the **Generate Files** page, click **Next** to generate the recovery image files. - -## Copy the recovery image to a CD, DVD, or USB - - -On the Create Bootable Media page, you can optionally copy the image file to a CD, DVD, or USB flash drive (UFD). You can also create additional bootable media from this page by restarting the wizard. - -**Note**   -The Preboot execution environment (PXE) and local image deployment are not supported natively by this tool since they require additional enterprise tools, such as System Center Configuration Manager server and Microsoft Development Toolkit. - - - -**To copy the recovery image to a CD, DVD, or USB** - -1. On the **Create Bootable Media** page, select the iso file that you want to copy. - -2. Insert a CD, DVD, or USB, and then select the drive. - - **Note**   - If a drive is not recognized and you install a new drive, you can click **Refresh** to force the wizard to update the list of available drives. - - - -3. Click the **Create Bootable Media** button. - -4. To create another recovery image, click Restart, or click **Close** if you have finished creating all of the media that you want. - -## Related topics - - -[Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md b/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md deleted file mode 100644 index b0585c84fc..0000000000 --- a/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 8.0 Deployment Checklist -description: DaRT 8.0 Deployment Checklist -author: dansimp -ms.assetid: 74e071fb-697c-463f-adce-d09b8d86495f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 8.0 Deployment Checklist - - -This checklist can be used to help you during Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferences
    Checklist box

    Decide on the best DaRT 8.0 deployment option for your requirements and deploy it.

    Deploying DaRT 8.0 to Administrator Computers

    Checklist box

    Use the DaRT Recovery Image wizard to create the DaRT recovery image ISO.

    Creating the DaRT 8.0 Recovery Image

    Checklist box

    Decide on the best DaRT 8.0 recovery image deployment option for your requirements and deploy it.

    Deploying the DaRT Recovery Image

    - - - -## Related topics - - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/dart-80-planning-checklist-dart-8.md b/mdop/dart-v8/dart-80-planning-checklist-dart-8.md deleted file mode 100644 index ceb155c30e..0000000000 --- a/mdop/dart-v8/dart-80-planning-checklist-dart-8.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: DaRT 8.0 Planning Checklist -description: DaRT 8.0 Planning Checklist -author: dansimp -ms.assetid: 0a0f5a71-b1d6-424c-8174-fc5aad506928 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# DaRT 8.0 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferences
    Checklist box

    Review the DaRT 8.0 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.

    DaRT 8.0 Supported Configurations

    Checklist box

    Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.

    Planning to Create the DaRT 8.0 Recovery Image

    Checklist box

    Determine which method, or methods, you will use to deploy the DaRT recovery image.

    Planning How to Save and Deploy the DaRT 8.0 Recovery Image

    - - - -## Related topics - - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/dart-80-privacy-statement-dart-8.md b/mdop/dart-v8/dart-80-privacy-statement-dart-8.md deleted file mode 100644 index 73939a6af0..0000000000 --- a/mdop/dart-v8/dart-80-privacy-statement-dart-8.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -title: DaRT 8.0 Privacy Statement -description: DaRT 8.0 Privacy Statement -author: dansimp -ms.assetid: db474241-e44e-4bca-9be4-3557a3614c2a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# DaRT 8.0 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft Diagnostics and Recovery Toolset (“DaRT”). This disclosure focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft Diagnostics and Recovery Toolset (“DaRT”) enables administrators to easily recover PCs that have become unusable, rapidly diagnose probable causes of issues, and quickly repair unbootable or locked-out systems, all faster than the average time it takes to reimage the machine. When necessary, you can also quickly restore critical lost files. This release provides support for Windows 8 Beta as well as improvements on image creation and new hardware and software coverage. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by DaRT may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -The privacy details for each DaRT feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of your information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to this privacy statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please [contact us](https://go.microsoft.com/fwlink/?LinkID=245853). - -Microsoft PrivacyMicrosoft CorporationOne Microsoft WayRedmond, Washington 98052 USA - -## Specific Features - - -## Microsoft Update - - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Use of Information:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Choice/Control:** - -For details about controlling this feature, see the Update Services Privacy Statement at [https://go.microsoft.com/fwlink/?LinkId=244000](https://go.microsoft.com/fwlink/?LinkId=244400). - -## Windows Defender Offline - - -**What This Feature Does:** - -Windows Defender Offline (WDO) is included in the DaRT download. WDO helps protect your PC from malicious software (malware) such as viruses, spyware, and other potentially harmful software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the WDO Privacy Statement at [https://go.microsoft.com/fwlink/?LinkId=246081](https://go.microsoft.com/fwlink/?LinkID=211807). - -**Use of Information:** - -For details about what information is collected and how it is used, see the WDO Privacy Statement at . - -**Choice/Control:** - -For details about controlling this feature, see the Windows Defender Offline Privacy Statement at . - -## Related topics - - -[Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/dart-80-supported-configurations-dart-8.md b/mdop/dart-v8/dart-80-supported-configurations-dart-8.md deleted file mode 100644 index ba3ca72434..0000000000 --- a/mdop/dart-v8/dart-80-supported-configurations-dart-8.md +++ /dev/null @@ -1,307 +0,0 @@ ---- -title: DaRT 8.0 Supported Configurations -description: DaRT 8.0 Supported Configurations -author: dansimp -ms.assetid: 95d68e5c-d202-4f4a-adef-d2098328172e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# DaRT 8.0 Supported Configurations - - -This topic specifies the prerequisite software and supported configurations requirements that are necessary to install and run Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 in your environment. Both the operating system requirements and the system requirements that are required to run DaRT 8.0 are specified. For information about prerequisites that you need to consider to create the DaRT recovery image, see [Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md). - -For supported configurations that apply to later releases, see the documentation for the applicable release. - -You can install DaRT in one of two ways. You can install all functionality on an IT administrator computer, where you will perform all the tasks associated with running DaRT. Alternatively, you can install, on the administrator computer, only the DaRT functionality that creates the recovery image, and then install the functionality used to run DaRT (that is, the DaRT Remote Connection Viewer) on a help desk computer. - -## DaRT 8.0 prerequisite software - - -Make sure that the following prerequisites are met before you install DaRT. - -### Administrator computer prerequisites - -The following table lists the installation prerequisites for the administrator computer when you are installing DaRT 8.0 and all of the DaRT tools. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Windows Assessment and Development Kit (ADK)

    Required for the DaRT Recovery Image wizard. Contains the Deployment Tools, which are used to customize, deploy, and service Windows images, and contains the Windows Preinstallation Environment (Windows PE). The ADK is not required if you are installing only the Remote Connection Viewer and/or Crash Analyzer.

    .NET Framework 4.5

    Required by the DaRT Recovery Image wizard.

    Windows Development Kit OR Software Development Kit (optional)

    Crash Analyzer requires the Windows 8 Debugging Tools from the Windows Driver Kit to analyze memory dump files.

    Windows 8 64-bit ISO image

    DaRT requires the Windows Recovery Environment (Windows RE) image from the Windows 8 media. Download the 32-bit or 64-bit version of Windows 8, depending on the type of DaRT recovery image you want to create. If you support both system types in your environment, download both versions of Windows 8.

    - - - -### Help desk computer prerequisites - -The following table lists the installation prerequisites for the help desk computer when you are running the DaRT 8.0 Remote Connection Viewer. - - ---- - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    DaRT 8.0 Remote Connection Viewer

    Must be installed on a Windows 8 operating system.

    NET Framework 4.5

    Required by the DaRT Recovery Image wizard

    Debugging Tools for Windows

    Required only if you are installing the Crash Analyzer tool

    - - - -### End-user computer prerequisites - -There is no prerequisite software that must be installed on end-user computers, other than the Windows 8 operating system. - -## DaRT operating system requirements - - -### Administrator computer system requirements - -The following table lists the operating systems that are supported for the DaRT administrator computer installation. - -**Note**   -Make sure that you allocate enough space for any additional tools that you want to install on the administrator computer. - - - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirement for Running DaRT

    Windows 8

    All editions

    N/A

    64-bit

    2 GB

    2.5 GB

    Windows 8

    All editions

    N/A

    32-bit

    1 GB

    1.5 GB

    Windows Server 2012

    Standard, Enterprise, Data Center

    N/A

    64-bit

    512 MB

    1 .0 GB

    - - - -### DaRT help desk computer system requirements - -If you allow a help desk to remotely troubleshoot computers, you must have the Remote Connection Viewer installed on the help desk computer. You can optionally install the Crash Analyzer tool on the help desk computer. - -DaRT 8.0 enables a help desk worker to connect to a DaRT 8.0 computer by using either the DaRT 7.0 or DaRT 8.0 Remote Connection Viewer. The DaRT 7.0 Remote Connection Viewer requires a Windows 7 operating system, while the DaRT 8.0 Remote Connection Viewer requires Windows 8. The DaRT 8.0 Remote Connection Viewer and all other DaRT 8.0 tools can be installed only on a computer running Windows 8. - -The following table lists the operating systems that are supported for the DaRT help desk computer installation. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirements for Running DaRT

    Windows 8

    All editions

    N/A

    64-bit

    2 GB

    2.5 GB

    Windows 8 (with Remote Connection Viewer 8.0 only)

    All editions

    N/A

    32-bit

    1 GB

    1.5 GB

    Windows 7 (with Remote Connection Viewer 7.0 only)

    All editions

    SP1, SP2

    64-bit or 32-bit

    1 GB

    N/A

    Windows Server 2012

    Standard, Enterprise, Data Center

    N/A

    64-bit

    51

    1.0 GB

    - - - -DaRT also has the following minimum hardware requirements for the end-user computer: - -A CD or DVD drive or a USB port - required only if you are deploying DaRT in your enterprise by using a CD, DVD, or USB. - -BIOS support for starting the computer from a CD or DVD, a USB flash drive, or from a remote or recovery partition. - -### DaRT end-user computer system requirements - -The Diagnostics and Recovery Toolset window in DaRT requires that the end-user computer use one of the following operating systems together with the specified amount of system memory available for DaRT: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem ArchitectureOperating System RequirementsRAM Requirements

    Windows 8

    All editions

    N/A

    64-bit

    2 GB

    2.5 GB

    Windows 8

    All editions

    N/A

    32-bit

    1 GB

    1.5 GB

    Windows Server 2012

    Standard, Enterprise, Data Center

    N/A

    64-bit

    512 MB

    1.0 GB

    - - - -## Related topics - - -[Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/deploying-dart-80-dart-8.md b/mdop/dart-v8/deploying-dart-80-dart-8.md deleted file mode 100644 index 0bfff42e41..0000000000 --- a/mdop/dart-v8/deploying-dart-80-dart-8.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Deploying DaRT 8.0 -description: Deploying DaRT 8.0 -author: dansimp -ms.assetid: 5a976d4e-3372-4ef6-9095-1b48e99af21b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying DaRT 8.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 supports a number of different deployment configurations. This section includes information you should consider about the deployment of DaRT 8.0 and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment Information - - -- [Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) - - This section describes the different DaRT deployment options for your requirements and explains how to deploy them. - -- [Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) - - This section describes the methods you can use to create the DaRT recovery image and provides instructions to create the recovery image by using the DaRT Recovery Image wizard. - -- [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) - - This section provides information to help you decide on the best DaRT recovery image deployment option for your requirements and provides instructions on how to deploy the recovery image. - -- [DaRT 8.0 Deployment Checklist](dart-80-deployment-checklist-dart-8.md) - - This section contains a deployment checklist that can help you to deploy DaRT. - -### How to get DaRT - -This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/p/?LinkId=322049) (https://go.microsoft.com/fwlink/p/?LinkId=322049). - -## Other Resources for deploying DaRT - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md b/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md deleted file mode 100644 index 9a76b0e3ae..0000000000 --- a/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying DaRT 8.0 to Administrator Computers -description: Deploying DaRT 8.0 to Administrator Computers -author: dansimp -ms.assetid: f918ead8-742e-464a-8bf6-1fcedde66cae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying DaRT 8.0 to Administrator Computers - - -Before you begin the deployment of Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0, review the requirements for your environment. This includes the hardware requirements for installing DaRT 8.0. For more information about DaRT hardware and software requirements, see [DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md). - -The topics in this section can be used to help you deploy DaRT in your enterprise based on your environment and deployment strategy. - -## Deploy DaRT 8.0 - - -You can use the Windows Installer file for DaRT to install DaRT on a computer that you will use to first create the DaRT recovery image and then troubleshoot and fix end-user computers. Frequently, across an organization, you might install on the administrator computer only the DaRT functionality that you need to create a DaRT recovery image. Then, on a help desk administrator’s computer, you might install only the DaRT functionality that you must have to troubleshoot a problem computer, such as the DaRT Remote Connection Viewer and the Crash Analyzer. - -In addition to manually running the Windows Installer file to install DaRT, you can also install DaRT at the command prompt to support enterprise software deployment systems such as System Center Configuration Manager 2012. - -[How to Deploy DaRT 8.0](how-to-deploy-dart-80-dart-8.md) - -## Change, repair, or remove DaRT 8.0 - - -You can change, repair, or remove the DaRT installation by double-clicking the DaRT installation file and then clicking the button that corresponds to the action that you want to perform or through the Windows Control Panel. - -[How to Change, Repair, or Remove DaRT 8.0](how-to-change-repair-or-remove-dart-80-dart-8.md) - -## How to get DaRT 8.0 - - -To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for deploying the DaRT 8.0 to administrator computers - - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md deleted file mode 100644 index 38d53ac43d..0000000000 --- a/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Deploying the DaRT Recovery Image -description: Deploying the DaRT Recovery Image -author: dansimp -ms.assetid: df5cb54a-be8c-4ed2-89ea-d3c67c2ef4d4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the DaRT Recovery Image - - -After you have created the International Organization for Standardization (ISO) file that contains the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image, you can deploy the DaRT 8.0 recovery image throughout your enterprise so that it is available to end users and help desk workers. There are four supported methods that you can use to deploy the DaRT recovery image. To review the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md). - -Burn the ISO image file to a CD or DVD by using the DaRT Recovery Image wizard - -Save the contents of the ISO image file to a USB Flash Drive (UFD) by using the DaRT Recovery Image wizard - -Extract the boot.wim file from the ISO image and deploy as a remote partition that is available to end-user computers - -Extract the boot.wim file from the ISO image and deploy in the recovery partition of a new Windows 8 installation - -**Important**   -The **DaRT Recovery Image Wizard** provides the option to burn the image to a CD, DVD or UFD, but the other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section. - - - -## Deploy the DaRT recovery image as part of a recovery partition - - -After you have finished running the DaRT Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 8 image. - -[How to Deploy the DaRT Recovery Image as Part of a Recovery Partition](how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md) - -## Deploy the DaRT recovery image as a remote partition - - -You can host the recovery image on a central network boot server, such as Windows Deployment Services, and allow users or support staff to stream the image to computers on demand. - -[How to Deploy the DaRT Recovery Image as a Remote Partition](how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md) - -## Other resources for deploying the DaRT recovery image - - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md b/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md deleted file mode 100644 index 4553af5ce2..0000000000 --- a/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Diagnosing System Failures with Crash Analyzer -description: Diagnosing System Failures with Crash Analyzer -author: dansimp -ms.assetid: ce3d3186-54fb-45b2-b5ce-9bb7841db28f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Diagnosing System Failures with Crash Analyzer - - -The **Crash Analyzer** in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 lets you debug a memory dump file on a Windows-based computer and then diagnose any related computer errors. The **Crash Analyzer** uses the Microsoft Debugging Tools for Windows to examine a memory dump file for the driver that caused the computer to fail. You can run the Crash Analyzer on an end-user computer or in stand-alone mode on a computer other than an end-user computer. - -## Run the Crash Analyzer on an end-user-computer - - -Typically, you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window on an end-user computer that is experiencing the problem. The **Crash Analyzer** tries to locate the Debugging Tools for Windows on the problem computer. If the directory path dialog box is empty, you must enter the location, or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files are located. - -If you included the Microsoft Debugging Tools for Windows and the symbol files when you created the DaRT 8.0 recovery image, the Tools and symbol files should be available when you run the **Crash Analyzer** on the problem computer. If you did not include them in the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining them, you can alternatively run the Crash Analyzer in stand-alone mode on a computer other than the end user’s computer, as described in the following section. - -[How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md) - -## Run the Crash Analyzer in stand-alone mode on a computer other than an end user’s computer - - -Although you typically run **Crash Analyzer** on the end-user computer that is experiencing the problem, you can also run the Crash Analyzer in stand-alone mode, on a computer other than an end-user computer. You might choose this option if you did not include the Windows Debugging Tools in the DaRT recovery image, or if disk size or network connectivity problems are preventing you from obtaining the Debugging Tools. In this case, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of **Crash Analyzer** installed, such as on a help desk agent’s computer. - -[How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md) - -## How to ensure that Crash Analyzer can access symbol files - - -To debug applications that have stopped responding, you need access to the symbol file, which is separate from the program. Although symbol files are automatically downloaded when you run Crash Analyzer, there might be times when the problem computer does not have access to the Internet. There are several ways to ensure that you have guaranteed access to symbol files. - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md) - -## Other resources for diagnosing system failures with Crash Analyzer - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/getting-started-with-dart-80-dart-8.md b/mdop/dart-v8/getting-started-with-dart-80-dart-8.md deleted file mode 100644 index 66f6c6ad7d..0000000000 --- a/mdop/dart-v8/getting-started-with-dart-80-dart-8.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Getting Started with DaRT 8.0 -description: Getting Started with DaRT 8.0 -author: dansimp -ms.assetid: 579d18c5-7434-4a0e-9725-fb81ca5e3c6d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with DaRT 8.0 - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 requires thorough planning before you deploy it or use its features. If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at [https://go.microsoft.com/fwlink/p/?LinkId=80347](https://go.microsoft.com/fwlink/?LinkId=80347). - -**Note**   -A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at (https://go.microsoft.com/fwlink/?LinkId=272493). - -Additional downloadable information about this product can also be found at . - - - -## Getting started with DaRT 8.0 - - -- [About DaRT 8.0](about-dart-80-dart-8.md) - - Provides information specifically related to DaRT, including what is new in DaRT 8.0. - -- [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md) - - Describes the tools in DaRT 8.0. - -- [Accessibility for DaRT 8.0](accessibility-for-dart-80-dart-8.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## How to Get DaRT 8.0 - - -DaRT 8.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for this product - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md b/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md deleted file mode 100644 index 07b0c8b5bf..0000000000 --- a/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: How to Change, Repair, or Remove DaRT 8.0 -description: How to Change, Repair, or Remove DaRT 8.0 -author: dansimp -ms.assetid: a9737635-aaf5-45bd-861f-f9dff4f02336 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Change, Repair, or Remove DaRT 8.0 - - -You can change, repair, or remove the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 installation by double-clicking the DaRT 8.0 installation file and then clicking the button that corresponds to the action that you want to perform. - -You can also change, repair, or remove the DaRT installation using the Windows Control Panel by completing the following steps. - -## To change, repair, or remove DaRT - - -1. Click **Start**, and then click **Control Panel**. - -2. On **Control Panel**, navigate to the feature that lets you uninstall programs. - -3. Click **Microsoft Diagnostics and Recovery Toolset 8.0**, and then click the button that corresponds to the action that you want to perform. - -## Related topics - - -[Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md b/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md deleted file mode 100644 index 64defad414..0000000000 --- a/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Deploy DaRT 8.0 -description: How to Deploy DaRT 8.0 -author: dansimp -ms.assetid: ab772e7a-c02f-4847-acdf-8bd362769a77 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy DaRT 8.0 - - -The following instructions explain how to deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 in your environment. To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). It is assumed that you are installing all functionality on one administrator computer. If you need to deploy or uninstall DaRT 8.0 on multiple computers, using an electronic software distribution system, for example, it might be easier to use command line installation options. Descriptions and examples of the available command line options are provided in this section. - -**Important**   -Before you install DaRT, see [DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md) to ensure that you have installed all of the prerequisite software and that the computer meets the minimum system requirements. The computer onto which you install DaRT must be running Windows 8 or Windows Server 2012. - - - -You can install DaRT using one of two different configurations: - -- Install DaRT and all of the DaRT tools on the administrator computer. - -- Install on the administrator computer only the tools that you need to create the DaRT recovery image, and then install the **Remote Connection Viewer** and, optionally, **Crash Analyzer** on a help desk computer. - -The DaRT installation file is available in both 32-bit and 64-bit versions. Install the version that matches the architecture of the computer on which you are running the DaRT Recovery Image wizard, not the computer architecture of the recovery image that you are creating. - -You can use either version of the DaRT installation file to create a recovery image for either 32-bit or 64-bit computers, but you cannot create one recovery image for both 32-bit and 64-bit computers. - -**To install DaRT and all DaRT tools on an administrator computer** - -1. Download the 32-bit or 64-bit version of the DaRT 8.0 installer file. Choose the architecture that matches the computer on which you are installing DaRT and running the DaRT Recovery Image wizard. - -2. From the folder into which you downloaded DaRT 8.0, run the **MSDaRT80.msi** installation file that corresponds to your system requirements. - -3. On the **Welcome to the Microsoft DaRT 8.0 Setup Wizard** page, click **Next**. - -4. Accept the Microsoft Software License Terms, and then click **Next**. - -5. On the **Microsoft Update** page, select **Use Microsoft Update when I check for updates**, and then click **Next**. - -6. On the **Select Installation Folder** page, select a folder, or click **Next** to install DaRT in the default installation location. - -7. On the **Setup Options** page, select the DaRT features that you want to install, or click **Next** to install DaRT with all of the features. - -8. To start the installation, click **Install**. - -9. After the installation has completed successfully, click **Finish** to exit the wizard. - -## To install DaRT and all DaRT tools on an administrator computer by using a command prompt - - -When you install or uninstall DaRT, you have the option of running the installation files at the command prompt. This section describes some examples of different options that you can specify when you install or uninstall DaRT at the command prompt. - -The following example shows how to install all DaRT functionality. - -``` syntax -msiexec /i MSDaRT80.msi ADDLOCAL=CommonFiles, DaRTRecoveryImage,CrashAnalyzer,RemoteViewer -``` - -The following example shows how to install only the DaRT Recovery Image wizard. - -``` syntax -msiexec /i MSDaRT80.msi ADDLOCAL=CommonFiles, ,DaRTRecoveryImage -``` - -The following example shows how to install only the Crash Analyzer and the DaRT Remote Connection Viewer. - -``` syntax -msiexec /i MSDaRT80.msi ADDLOCAL=CommonFiles,CrashAnalyzer,RemoteViewer -``` - -The following example creates a setup log for the Windows Installer. This is valuable for debugging. - -``` syntax -msiexec.exe /i MSDaRT80.msi /l*v log.txt -``` - -**Note**   -You can add /qn or /qb to perform a silent installation. - - - -**To validate the DaRT installation** - -1. Click **Start**, and select **Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. - -2. Check that all of the DaRT tools that you selected for installation were successfully installed. - -## Related topics - - -[Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md deleted file mode 100644 index db1b6db9c4..0000000000 --- a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as a Remote Partition -description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: dansimp -ms.assetid: 58f4a6c6-6193-42bd-a095-0de868711af9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as a Remote Partition - - -After you have finished running the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a remote partition on the network. - -**To deploy DaRT 8.0 as a remote partition** - -1. Extract the boot.wim file from the DaRT ISO image file. - - 1. Mount the ISO image file that you created in the **Create Startup Image** dialog box by using your company’s preferred method of mounting an image. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image. - - - -2. Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise. - -3. Configure the WDS server to use the boot.wim file for DaRT by following your standard WDS deployment procedures. - -For more information about how to deploy DaRT as a remote partition, see [Walkthrough: Deploy an Image by Using PXE](https://go.microsoft.com/fwlink/?LinkId=212108) and [Windows Deployment Services Getting Started Guide](https://go.microsoft.com/fwlink/?LinkId=212106). - -## Related topics - - -[Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) - -[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md deleted file mode 100644 index 2f572440c7..0000000000 --- a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: dansimp -ms.assetid: 07c5d539-51d9-4759-adc7-72b40d5d7bb3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy the DaRT Recovery Image as Part of a Recovery Partition - - -After you have finished running the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 Recovery Image wizard and created the recovery image, you can extract the boot.wim file from the ISO image file and deploy it as a recovery partition in a Windows 8 image. A partition is recommended, because any corruption issues that prevent the Windows operating system from starting would also prevent the recovery image from starting. A separate partition also eliminates the need to provide the BitLocker recovery key twice. Consider hiding the partition to prevent users from storing files on it. - -**To deploy DaRT in the recovery partition of a Windows 8 image** - -1. Create a target partition in your Windows 8 image that is equal to or greater than the size of the ISO image file that you created by using the **DaRT 8.0 Recovery Image wizard**. - - The minimum size required for a DaRT partition is 500MB to accommodate the remote connection functionality in DaRT. - -2. Extract the boot.wim file from the DaRT ISO image file. - - 1. Using your company’s preferred method, mount the ISO image file that you created on the **Create Startup Image** page. - - 2. Open the ISO image file and copy the boot.wim file from the \\sources folder in the mounted image to a location on your computer or on an external drive. - - **Note**   - If you burned a CD, DVD, or USB of the recovery image, you can open the files on the removable media and copy the boot.wim file from the \\sources folder. If you copy boot.wim file, you don’t need to mount the image. - - - -3. Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image. - - For more information about how to create or customize a recovery partition, see [Customizing the Windows RE Experience](https://go.microsoft.com/fwlink/?LinkId=214222). - -4. Replace the target partition in your Windows 8 image with the recovery partition. - - For more information about how to deploy a recovery solution to reinstall the factory image in the event of a system failure, see [Deploy a System Recovery Image](https://go.microsoft.com/fwlink/?LinkId=214221). - -## Related topics - - -[Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md) - -[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md b/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md deleted file mode 100644 index e6b4f6ad25..0000000000 --- a/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Ensure that Crash Analyzer Can Access Symbol Files -description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: dansimp -ms.assetid: 99839013-1cd8-44d1-8484-0e15261c5a4b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Ensure that Crash Analyzer Can Access Symbol Files - - -Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding. - -Symbol files are automatically downloaded when you run **Crash Analyzer**. If the computer does not have an Internet connection or the network requires the computer to access an HTTP proxy server, the symbol files cannot be downloaded. - -**To ensure that Crash Analyzer can access symbol files** - -1. **Copy the dump file to another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, copy the memory dump file to a computer that does have an Internet connection and run the stand-alone **Crash Analyzer Wizard** on that computer. - -2. **Access the symbol files from another computer.** If the symbols cannot be downloaded because of a lack of an Internet connection, you can download the symbols from a computer that does have an Internet connection and then copy them to the computer that does not have an Internet connection, or you can map a network drive to a location where the symbols are available on the local network. If you run the **Crash Analyzer** in a Windows Recovery Environment (Windows RE), you can include the symbol files on the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image. - -3. **Access symbol files through an HTTP proxy server.** If the symbols cannot be downloaded because an HTTP proxy server must be accessed, use the following steps to access an HTTP proxy server. In DaRT 8.0, the **Crash Analyzer Wizard** has a setting available on the **Specify Symbol Files Location** dialog page, marked with the label **Proxy server (optional, using the format "server:port")**. You can use this text box to specify a proxy server. Enter the proxy address in the form **<hostname>:<port>**, where the <**hostname**> is a DNS name or IP address, and the <**port**> is a TCP port number, usually 80. There are two modes in which the **Crash Analyzer** can be run. Following is how you use the proxy setting in each of these modes: - - - **Online mode:** In this mode, if the proxy server field is left blank, the wizard uses the proxy settings from Internet Options in Control Panel. If you enter a proxy address in the text box which is provided, that address will be used, and it will override the setting in the Internet Options. - - - Windows Recovery Environment (Windows RE): When you run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window, there is no default proxy address. If the computer is directly connected to the Internet, a proxy address is not required. Therefore, you can leave this field blank in the wizard setting. If the computer is not directly connected to the Internet, and it is in a network environment that has a proxy server, you must set the proxy field in the wizard to access the symbol store. The proxy address can be obtained from the network administrator. Setting the proxy server is important only when the public symbol store is connected to the Internet. If the symbols are already on the DaRT recovery image, or if they are available locally, setting the proxy server is not required. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md b/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md deleted file mode 100644 index 8e49329140..0000000000 --- a/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Perform DaRT Tasks by Using PowerShell Commands -description: How to Perform DaRT Tasks by Using PowerShell Commands -author: dansimp -ms.assetid: bc788b00-38c7-4f57-a832-916b68264d89 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Perform DaRT Tasks by Using PowerShell Commands - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 provides the following listed set of Windows PowerShell cmdlets. Administrators can use these PowerShell cmdlets to perform various DaRT 8.0 server tasks from the command prompt rather than from the DaRT Recovery Image wizard. - -## To administer DaRT by using PowerShell commands - - -Use the PowerShell cmdlets described here to administer DaRT. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Copy-DartImage

    Burns an ISO to a CD, DVD, or USB drive.

    Export-DartImage

    Allows the source WIM file, which contains a DaRT image, to be converted into an ISO file.

    New-DartConfiguration

    Creates a DaRT configuration object that is needed to apply a DaRT toolset to a Windows Image.

    Set-DartImage

    Applies a DartConfiguration object to a mounted Windows Image. This includes adding all files, configuration, and package dependencies.

    - -  - -## Related topics - - -[Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md deleted file mode 100644 index fc95efeecd..0000000000 --- a/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: How to Recover Local Computers by Using the DaRT Recovery Image -description: How to Recover Local Computers by Using the DaRT Recovery Image -author: dansimp -ms.assetid: f679d522-49ab-429c-93d0-294c3f3e5639 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover Local Computers by Using the DaRT Recovery Image - - -Use these instructions to recover a computer when you are physically present at the end-user computer that is experiencing problems. - -**How to recover a local computer by using the DaRT recovery image** - -1. Boot the end-user computer by using the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image. - - As the computer is booting into the DaRT 8.0 recovery image, the **NetStart** dialog box appears. - -2. When you are asked whether you want to initialize network services, select one of the following: - - **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - **No** - skip the network initialization process. - -3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. On the **System Recovery Options** dialog box, select a keyboard layout. - -5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver. - -6. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 8 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**. - - The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created. - -You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides. - -For general information about any of the DaRT tools, see [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md). - -**How to run DaRT at the command prompt** - -- To run DaRT at the command prompt, specify the **netstart.exe** command then use any of the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - -

    Parameter

    Description

    -network

    Initializes the network services.

    -remount

    Remaps the drive letters.

    -prompt

    Displays messages that ask the end user to specify whether to initialize the network and remap the drives.

    -
    - Warning

    The end user’s response to the prompt overrides the –network and –remount switches.

    -
    -
    - -
    - - - -## Related topics - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md deleted file mode 100644 index e8ceaf560b..0000000000 --- a/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md +++ /dev/null @@ -1,207 +0,0 @@ ---- -title: How to Recover Remote Computers by Using the DaRT Recovery Image -description: How to Recover Remote Computers by Using the DaRT Recovery Image -author: dansimp -ms.assetid: 363ccd48-6820-4b5b-a43a-323c0b208a9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Recover Remote Computers by Using the DaRT Recovery Image - - -Use the Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 to run the DaRT tools remotely on an end-user computer. After the end user provides the administrator or help desk worker with certain information, the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely. - -If you disabled the DaRT tools when you created the recovery image, you still have access to all of the tools. All of the tools, except Remote Connection, are unavailable to end users. - -**To recover a remote computer by using the DaRT recovery image** - -1. Boot an end-user computer by using the DaRT recovery image. - - You will typically use one of the following methods to boot into DaRT to recover a remote computer, depending on how you deploy the DaRT recovery image. For more information about deploying the DaRT recovery image, see [Deploying DaRT 8.0](deploying-dart-80-dart-8.md). - - - Boot into DaRT from a recovery partition on the problem computer. - - - Boot into DaRT from a remote partition on the network. - - For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md). - - Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - - **Note** - Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -~~~ -As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. -~~~ - -2. When you are asked whether you want to initialize network services, select one of the following: - - **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address. - - **No** - skip the network initialization process. - -3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process. - -4. On the **System Recovery Options** dialog box, select a keyboard layout. - -5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver. - -6. Select the installation that you want to repair or diagnose, and then click **Next**. - - **Note** - If the Windows Recovery Environment (WinRE) detects or suspects that Windows 8 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md). - - - -~~~ -If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available. - -The **System Recovery Options** window appears and lists various recovery tools. -~~~ - -7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**. - -8. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**. - - The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information. - -9. On the help desk computer, open the **DaRT Remote Connection Viewer**. - -10. Click **Start**, click **All Programs**, click **Microsoft DaRT 8.0**, and then click **DaRT Remote Connection Viewer**. - -11. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information. - - **Note** - This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer. - - - -12. Click **Connect**. - -The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely. - -**Note** -A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32. - - - -**To customize the Remote Connection process** - -1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413). - - Specify the following commands and parameters to customize how a remote connection is established with an end-user computer: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    CommandParameterDescription

    RemoteRecovery.exe

    -nomessage

    Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.

    WaitForConnection.exe

    none

    Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.

    -
    - Important

    This command serves no function if it is specified independently. It must be specified in a script to function correctly.

    -
    -
    - -
    - - - -2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT: - - ```ini - [LaunchApps] - "%windir%\system32\netstart.exe -network -remount" - "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage" - "%windir%\system32\WaitForConnection.exe" - "%SYSTEMDRIVE%\sources\recovery\recenv.exe" - ``` - -When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the RAM disk. This file contains connection information: IP address, port, and ticket number. You can copy this file to a network share to trigger a Help desk workflow. For example, a custom program can check the network share for connection files, and then create a support ticket or send email notifications. - -**To run the Remote Connection Viewer at the command prompt** - -1. To run the **DaRT Remote Connection Viewer** at the command prompt, specify the **DartRemoteViewer.exe** command and use the following parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    -ticket=<ticketnumber>

    Where <ticketnumber> is the ticket number, including the dashes, that is generated by Remote Connection.

    -ipaddress=<ipaddress>

    Where <ipaddress> is the IP address that is generated by Remote Connection.

    -port=<port>

    Where <port> is the port that corresponds to the specified IP address.

    - - - -~~~ -**Note** -The variables for these parameters are created on the end-user computer and must be provided by the end user. -~~~ - - - -2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified. - -## Related topics - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md b/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md deleted file mode 100644 index 8f3cdb66ed..0000000000 --- a/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: dansimp -ms.assetid: b2f87144-6379-478a-802b-9cfef5242f34 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer - - -If you cannot access the Microsoft Debugging Tools for Windows or the symbol files on the end-user computer, you can copy the dump file from the problem computer and analyze it on a computer that has the stand-alone version of Crash Analyzer installed, such as a help desk computer that contains Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. - -To run Crash Analyzer in stand-alone mode, you copy the memory dump file from the problem computer and analyze it on another computer, such as a help desk computer, that has the **Crash Analyzer** installed. - -**To run the Crash Analyzer in stand-alone mode** - -1. On a computer that has DaRT 8.0 installed, click **Start**, type **Crash Analyzer**, and then click **Crash Analyzer**. - -2. Follow the steps in the wizard, as described in [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md). - -## Related topics - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) - -[How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md b/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md deleted file mode 100644 index 82ae23319c..0000000000 --- a/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Run the Crash Analyzer on an End-user Computer -description: How to Run the Crash Analyzer on an End-user Computer -author: dansimp -ms.assetid: d36213e5-7719-44d7-be65-971c3ef7df2c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Run the Crash Analyzer on an End-user Computer - - -To run **Crash Analyzer** from the **Diagnostics and Recovery Toolset** window on an end-user computer that is experiencing problems, you must have the Microsoft Debugging Tools for Windows and the symbol files installed. To download the Windows Debugging Tools, see [Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=266248). - -**To run the Crash Analyzer on an end-user computer** - -1. On the **Diagnostics and Recovery Toolset** window on an end-user computer, click **Crash Analyzer**. - -2. Provide the required information for the Microsoft Debugging Tools for Windows. - -3. Provide the required information for the symbol files. For more information about symbol files, see [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md). - -4. Provide the required information for a memory dump file. To determine the location of the memory dump file: - - 1. Open the **System Properties** window. - - 2. Click **Start**, type **sysdm.cpl**, and then press **Enter**. - - 3. Click the **Advanced** tab. - - 4. In the **Startup and Recovery** area, click **Settings**. - - If you do not have access to the **System Properties** window, you can search for dump files on the end-user computer by using the **Search** tool in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. - - The **Crash Analyzer** scans the memory dump file and reports a probable cause of the problem. You can view more information about the failure, such as the specific memory dump message and description, the drivers loaded at the time of the failure, and the full output of the analysis. - -5. Identify the appropriate strategy to resolve the problem. The strategy may require disabling or updating the device driver that caused the failure by using the **Services and Drivers** node of the **Computer Management** tool in DaRT 8.0. - -## Related topics - - -[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md b/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md deleted file mode 100644 index 33e32407c5..0000000000 --- a/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Use a PowerShell Script to Create the Recovery Image -description: How to Use a PowerShell Script to Create the Recovery Image -author: dansimp -ms.assetid: d0c71092-535e-43b1-9b1d-6ac819508348 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use a PowerShell Script to Create the Recovery Image - - -## To create the DaRT recovery image by using a PowerShell script - - -You can create the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image by using a PowerShell script instead of using the DaRT 8.0 Recovery Image wizard. See the following example script. - -`` - -`This script was auto generated by the Microsoft DaRT Recovery Image Wizard.``###``This script uses the DISM and DaRT PowerShell commands to create a bootable DaRT image.``###Both a WIM and ISO file are produced.``###``### Examples of how to burn/copy the DaRT ISO to DVD/USB are available at the end of this script.``###` - -`$ErrorActionPreference = "Stop";``### This variable tells PowerShell to stop if an error occurs.` - -`###``### Import the modules necessary for DaRT Image creation.``###` - -`Import-Module "Dism"`I`mport-Module "Microsoft.Dart"` - -`###``### Specifies where the Windows 8 media is located and where the ISO and WIM files will be saved.``### These can be changed as necessary.``###` - -`$Win8MediaPath = "D:\";``### This is the path of the Windows 8 media.``$DestinationWimPath = "C:\Users\Administrator\Desktop\DaRT8\x64\boot.wim";``### Specify where the WIM file will be saved.``$DestinationIsoPath = "C:\Users\Administrator\Desktop\DaRT8\x64\DaRT8.iso";``### Specify where the ISO will be saved.` - -`###``### These variables are used to specify temporary and output directories based on the paths above.``###` - -`$WimParentPath = (Split-Path -Path "$destinationWimPath" -Parent);``### Specify the directory where the DaRT WIM file will be saved.``$IsoParentPath = (Split-Path -Path "$destinationIsoPath" -Parent);``### This is the directory where the DaRT ISO file will be saved.``$TempMountPath = "$env:temp\DaRT8Mount_$(Get-Random)";``### Specify the temporary directory used to mount the Windows image.` - -`###``### Prepare the windows image.``###` - -`### Guarantee the output directories exists.``New-Item -Path $WimParentPath -Type Directory -Force``New-Item -Path $IsoParentPath -Type Directory -Force``New-Item -Path $TempMountPath -Type Directory -Force` - -`### Create a copy of the WIM and remove the read-only attribute.``### The WIM file will be the resulting dart image.``Copy-Item "$Win8MediaPath\sources\boot.wim" $DestinationWimPath -Force``Set-ItemProperty $DestinationWimPath -Name IsReadOnly -Value $false` - -`### Mount the bootable image within the WIM file (normally index 2).``Mount-WindowsImage -ImagePath $DestinationWimPath -Path $TempMountPath -Index 2` - -`###``### Add additional drivers to the image.``###` - -`###``### Installs the specified driver(s) into the image.``###` - -`Add-WindowsDriver -Path $TempMountPath -Driver "C:\Windows\System32\DriverStore\FileRepository``\xusb22.inf_amd64_89c20c625f14f923\xusb22.inf" -ForceUnsigned` - -`###``### Add additional drivers to the image.``###` - -`###``### Installs the specified WinPE package(s) into the image.``###` - -`Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-Scripting.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-FMAPI.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-Scripting_en-us.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\WinPE-HTA.cab"``Add-WindowsPackage -Path $TempMountPath -PackagePath "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64\WinPE_OCs\en-us\WinPE-HTA_en-us.cab"` - -`###``### Add the DaRT tools to the image.``### The New-DartConfiguration cmdlet is used to specify how the DaRT image is configured.``### Modify this statement to configure how the DaRT tools will be applied to the image.``###` - -`$config = New-DartConfiguration -AddComputerManagement -AddCrashAnalyzer -AddDefender -AddDiskCommander -AddExplorer -AddFileRestore -AddFileSearch -AddHotfixUninstall -AddRegistryEditor -AddRemoteConnection -AddSfcScan -AddSolutionWizard -AddTcpConfig -RemoteMessage "Test welcome message" -RemotePort 3388 -ScratchSpace 512 -UpdateDefender``$config | Set-DartImage -Path $TempMountPath` - -`###``### Perform any manual user-specific customizations here.``###` - -`# Read-Host -Prompt "Script is paused for any manual customization. Press ENTER to continue"` - -`### Save the changes to the WIM file by dismounting the image.``Dismount-WindowsImage -Path $TempMountPath -Save` - -`### Create a bootable DaRT ISO.``Export-DartImage -IsoPath $DestinationIsoPath -WimPath $DestinationWimPath` - -`### The following is an example of how to burn the ISO to a writeable CD/DVD.``### Specify the correct drive letter and uncomment the statement to burn an ISO.``# Copy-DartImage -IsoPath $DestinationIsoPath -Drive "G:" -Type DVD` - -`### Removes all temporary files.``Remove-Item $TempMountPath -Force -Recurse` - -## Related topics - - -[Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/images/checklistbox.gif b/mdop/dart-v8/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/dart-v8/images/checklistbox.gif and /dev/null differ diff --git a/mdop/dart-v8/index.md b/mdop/dart-v8/index.md deleted file mode 100644 index d51694005d..0000000000 --- a/mdop/dart-v8/index.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Diagnostics and Recovery Toolset 8 Administrator's Guide -description: Diagnostics and Recovery Toolset 8 Administrator's Guide -author: dansimp -ms.assetid: 33685dd7-844f-4864-b504-3ef384ef01de -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 10/03/2017 ---- - - -# Diagnostics and Recovery Toolset 8 Administrator's Guide - - -Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 lets you diagnose and repair a computer that cannot be started or that has problems starting as expected. By using DaRT 8.0, you can recover end-user computers that have become unusable, diagnose probable causes of issues, and quickly repair unbootable or locked-out computers. When it is necessary, you can also quickly restore important lost files and detect and remove malware, even when the computer is not online. - -DaRT 8.0 lets you create a DaRT recovery image in International Organization for Standardization (ISO) and Windows Imaging (WIM) file formats and burn the image to a CD, DVD, or USB. You can then use the recovery image files and deploy them locally or to a remote partition or a recovery partition. - -DaRT 8.0 is an important part of the Microsoft Desktop Optimization Pack (MDOP), a dynamic solution available to Software Assurance customers that helps reduce software installation costs, enables delivery of applications as services, and helps manage and control enterprise desktop environments. - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[About DaRT 8.0](about-dart-80-dart-8.md)**|**[Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md)**|**[About DaRT 8.0 SP1](about-dart-80-sp1.md)**|**[Release Notes for DaRT 8.0 SP1](release-notes-for-dart-80-sp1.md)**|**[About DaRT 8.1](about-dart-81.md)**|**[Release Notes for DaRT 8.1](release-notes-for-dart-81.md)**|**[Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md)**|**[Accessibility for DaRT 8.0](accessibility-for-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md)**|**[DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md)**|**[Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md)**|**[Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md)**|**[DaRT 8.0 Planning Checklist](dart-80-planning-checklist-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md)**|**[Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md)**|**[Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md)**|**[DaRT 8.0 Deployment Checklist](dart-80-deployment-checklist-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md)**|**[Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md)**|**[Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md)**|**[Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) - -[Technical Reference for DaRT 8.0](technical-reference-for-dart-80-new-ia.md) - -[Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection-->](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -### More Information - -[How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) -Get information about how to download DaRT. - -[Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md) -View updated product information and known issues for DaRT 8.0. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com), or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - - diff --git a/mdop/dart-v8/operations-for-dart-80-dart-8.md b/mdop/dart-v8/operations-for-dart-80-dart-8.md deleted file mode 100644 index a629db0966..0000000000 --- a/mdop/dart-v8/operations-for-dart-80-dart-8.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations for DaRT 8.0 -description: Operations for DaRT 8.0 -author: dansimp -ms.assetid: a31615de-eb6e-41af-909c-d0b6f3eb3f2f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for DaRT 8.0 - - -This section includes information about the various types of Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations information - - -- [Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md) - - This section provides instructions on how to use DaRT 8.0 to recover local or remote computers by using the DaRT recovery image. - -- [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md) - - This section explains how to open and run the Crash Analyzer on either an end-user or non-end-user computer to debug a memory dump file and then diagnose computer errors. - -- [Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md) - - This section describes measures for maintaining security while using DaRT. - -- [Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md) - - This section lists the Windows PowerShell commands that administrators can use to perform various DaRT tasks. - -## Other resources for DaRT 8.0 operations - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md b/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md deleted file mode 100644 index ec7b892511..0000000000 --- a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Overview of the Tools in DaRT 8.0 -description: Overview of the Tools in DaRT 8.0 -author: dansimp -ms.assetid: 1766c82e-c099-47d4-b186-4689b026a7e0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 10/03/2016 ---- - - -# Overview of the Tools in DaRT 8.0 - - -From the **Diagnostics and Recovery Toolset** window in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0, you can start any of the individual tools that you include when you create the DaRT 8.0 recovery image. For information about how to access the **Diagnostics and Recovery Toolset** window, see [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md). - -If it is available, you can use the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to select the tool that best addresses your particular issue, based on a brief interview that the wizard provides. - -## Exploring the DaRT tools - - -A description of the DaRT 8.0 tools follows. - -### Computer Management - -**Computer Management** is a collection of Windows administrative tools that help you troubleshoot a problem computer. You can use the **Computer Management** tools in DaRT to view system information and event logs, manage disks, list autoruns, and manage services and drivers. The **Computer Management** console is customized to help you diagnose and repair problems that might be preventing the Windows operating system from starting. - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### Crash Analyzer - -Use the **Crash Analyzer Wizard** to quickly determine the cause of a computer failure by analyzing the memory dump file on the Windows operating system that you are repairing. **Crash Analyzer** examines the memory dump file for the driver that caused a computer to fail. You can then disable the problem device driver by using the **Services and Drivers** node in the **Computer Management** tool. - -The **Crash Analyzer Wizard** requires the Debugging Tools for Windows and symbol files for the operating system that you are repairing. You can include both requirements when you create the DaRT recovery image. If they are not included on the recovery image and you do not have access to them on the computer that you are repairing, you can copy the memory dump file to another computer and use the stand-alone version of **Crash Analyzer** to diagnose the problem. - -Running **Crash Analyzer** is a good idea even if you plan to reimage the computer. The image could have a defective driver that is causing problems in your environment. By running **Crash Analyzer**, you can identify problem drivers and improve the image stability. - -For more information about **Crash Analyzer**, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md). - -### Defender - -**Important**   -Environments with the DaRT Defender deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. For more information, see [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection-->](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md). - - - -**Defender** can help detect malware and unwanted software and warn you of security risks. You can use this tool to scan a computer for and remove malware even when the installed Windows operating system is not running. When **Defender** detects malicious or unwanted software, it prompts you to remove, quarantine, or allow for each item. - -Malware that uses rootkits can mask itself from the running operating system. If a rootkit-enabled virus or spyware is in a computer, most real-time scanning and removal tools can no longer see it or remove it. Because you boot the problem computer into DaRT and the installed operating system is offline, you can detect the rootkit without it being able to mask itself. - -### Disk Commander - -**Disk Commander** lets you recover and repair disk partitions or volumes by using one of the following recovery processes: - -- Restore the master boot record (MBR) - -- Recover one or more lost volumes - -- Restore partition tables from **Disk Commander** backup - -- Save partition tables to **Disk Commander** backup - -**Warning**   -We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table. - - - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### Disk Wipe - -You can use **Disk Wipe** to delete all data from a disk or volume, even the data that is left behind after you reformat a hard disk drive. **Disk Wipe** lets you select from either a single-pass overwrite or a four-pass overwrite, which meets current U.S. Department of Defense standards. - -**Warning**   -After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it. - - - -### Explorer - -The **Explorer** tool lets you browse the computer’s file system and network shares so that you can remove important data that the user stored on the local drive before you try to repair or reimage the computer. And because you can map drive letters to network shares, you can easily copy and move files from the computer to the network for safekeeping or from the network to the computer to restore them. - -### File Restore - -**File Restore** lets you try to restore files that were accidentally deleted or that were too big to fit in the Recycle Bin. **File Restore** is not limited to regular disk volumes, but can find and restore files on lost volumes or on volumes that are encrypted by BitLocker. - -**Note**   -The recovery of dynamic disks with DaRT is not supported. - - - -### File Search - -Before reimaging a computer, recovering files from the local hard disk is important, especially when the user might not have backed up or stored the files elsewhere. - -The **Search** tool opens a **File Search** window that you can use to find documents when you do not know the file path or to search for general kinds of files across all local hard disks. You can search for specific file-name patterns in specific paths. You can also limit results to a date range or size range. - -### Hotfix Uninstall - -The **Hotfix Uninstall Wizard** lets you remove hotfixes or service packs from the Windows operating system on the computer that you are repairing. Use this tool when a hotfix or service pack is suspected in preventing the operating system from starting. - -We recommend that you uninstall only one hotfix at a time, even though the tool lets you uninstall more than one. - -**Important**   -Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix. - - - -### Locksmith - -The **Locksmith Wizard** lets you set or change the password for any local account on the Windows operating system that you are analyzing or repairing. You do not have to know the current password. However, the password that you set must comply with any requirements that are defined by a local Group Policy Object. This includes password length and complexity. - -You can use **Locksmith** when the password for a local account, such as the local Administrator account, is unknown. You cannot use **Locksmith** to set passwords for domain accounts. - -### Registry Editor - -You can use **Registry Editor** to access and change the registry of the Windows operating system that you are analyzing or repairing. This includes adding, removing, and editing keys and values, and importing registry (.reg) files. - -**Warning**   -Serious problems can occur if you change the registry incorrectly by using **Registry Editor**. These problems might require you to reinstall the operating system. Before you make changes to the registry, you should back up any valued data on the computer. Change the registry at your own risk. - - - -### SFC Scan - -The **SFC Scan** tool starts the **System File Repair Wizard** and lets you repair system files that are preventing the installed Windows operating system from starting. The **System File Repair Wizard** can automatically repair system files that are corrupted or missing, or it can prompt you before it performs any repairs. - -### Solution Wizard - -The **Solution Wizard** presents a series of questions and then recommends the best tool for the situation, based on your answers. This wizard helps you determine which tool to use when you are not familiar with the tools in DaRT. - -### TCP/IP Config - -When you boot a problem computer into DaRT, it is set to automatically obtain its TCP/IP configuration (IP address and DNS server) from Dynamic Host Configuration Protocol (DHCP). If DHCP is unavailable, you can manually configure TCP/IP by using the **TCP/IP Config** tool. You first select a network adapter, and then configure the IP address and DNS server for that adapter. - -## Related topics - - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/planning-for-dart-80-dart-8.md b/mdop/dart-v8/planning-for-dart-80-dart-8.md deleted file mode 100644 index 79fd2ee510..0000000000 --- a/mdop/dart-v8/planning-for-dart-80-dart-8.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning for DaRT 8.0 -description: Planning for DaRT 8.0 -author: dansimp -ms.assetid: c8be3ab3-dc54-43b9-b9ff-fbd5e1ef29a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for DaRT 8.0 - - -The goal of deployment planning is to successfully and efficiently deploy Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 so that it does not disrupt your users or the network. - -Before you deploy DaRT 8.0, you should consider the different deployment configurations and prerequisites. This section includes information that can help you gather the information to formulate a deployment plan that best meets your business requirements. - -## Planning information - - -- [Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) - - There are several deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -- [DaRT 8.0 Planning Checklist](dart-80-planning-checklist-dart-8.md) - - This checklist can assist you in preparing your computing environment for the DaRT deployment. - -## Other resources for DaRT planning - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md deleted file mode 100644 index cebf48b625..0000000000 --- a/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: Planning How to Save and Deploy the DaRT 8.0 Recovery Image -description: Planning How to Save and Deploy the DaRT 8.0 Recovery Image -author: dansimp -ms.assetid: 939fbe17-0e30-4c85-8782-5b84d69442a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning How to Save and Deploy the DaRT 8.0 Recovery Image - - -You can save and deploy the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image by using the following methods. When you are determining the method that you will use, consider the advantages and disadvantages of each. You should also consider your infrastructure and support staff. If you have a small infrastructure, you might want to deploy DaRT 8.0 by using removable media, since the recovery image will always be available if you install it to the local hard drive. - -If your organization uses Active Directory Domain Services (AD DS), you may want to deploy recovery images as a network service by using Windows DS. Recovery images are always available to any connected computer. You can deploy multiple images from Windows DS and maintain them all in one place. - -**Note**   -You may want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network. - - - -The following table shows some advantages and disadvantages of each method of using DaRT in your organization. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Method to Boot into DaRTAdvantagesDisadvantages

    Removable Media

    -

    The recovery image is written to a CD, DVD, or USB drive to enable support staff to take the recovery tools with them to the unstable computer.

    Supports scenarios in which the master boot record (MBR) is corrupted and you cannot access the hard disk and supports cases in which there is no network connection.

    -

    Enables you to create multiple recovery images with different tools to provide different levels of support.

    -

    Provides a built-in tool for burning recovery images to removable media.

    Requires that support staff are physically at the end-user computer to boot into DaRT.

    -

    Requires time and maintenance to create multiple media with different configurations for 32-bit and 64-bit computers.

    From a remote (network) partition

    -

    The recovery image is hosted on a network boot server like Windows Deployment Services (Windows DS), which allows users or support staff to stream it to computers on demand.

    Available to all computers that have access to the network boot server.

    -

    Recovery images are hosted on a central server, which enables centralized updates.

    -

    Centralized help desk staff can provide repairs by using remote connectivity.

    -

    No local storage requirement on the clients.

    -

    Ability to create multiple recovery images with different tools for specific support levels.

    The need to secure Windows DS infrastructure to ensure that regular users can start only the DaRT recovery image and not the full operating system imaging process.

    -

    -

    -

    Requires that the end-user computer is connected to the network at runtime.

    -

    Requires that the recovery image is brought across the network.

    From a recovery partition on the local hard drive

    -

    The recovery image is installed on a local hard drive either manually or by using electronic software distribution systems like System Center Configuration Manager.

    The recovery image is always available because it is pre-staged on the computer.

    -

    Centralized help desk staff can provide support by using Remote Connection.

    -

    The recovery image is centrally managed and deployed.

    -

    Additional recovery key requests on computers that are protected by Windows BitLocker drive encryption are eliminated.

    Local storage is required.

    -

    A dedicated, unencrypted partition for recovery image placement is recommended to reduce the risk of a failed boot partition.

    -

    When updating DaRT, you must update all computers in your enterprise instead of just one partition (on the network) or removable device.

    -

    Additional consideration is required if you deploy the recovery image after BitLocker has been enabled.

    - - - -## Related topics - - -[Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md deleted file mode 100644 index c75e4671f5..0000000000 --- a/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Planning to Create the DaRT 8.0 Recovery Image -description: Planning to Create the DaRT 8.0 Recovery Image -author: dansimp -ms.assetid: cfd0e1e2-c379-4460-b545-3f7be9f33583 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Create the DaRT 8.0 Recovery Image - - -Use the information in this section when you are planning to create the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image. - -## Planning to create the DaRT 8.0 recovery image - - -When you create the DaRT recovery image, you have to decide which tools to include on the image. To make the decision, consider that end users may have access to those tools. If support engineers will take the recovery image media to end users’ computers to diagnose issues, you may want to install all of the tools on the recovery image. If you plan to diagnose end user’s computers remotely, you may want to disable some of the tools, such as Disk Wipe and Registry Editor, and then enable other tools, including Remote Connection. - -When you create the DaRT recovery image, you will also specify whether you want to include additional drivers or files. Determine the locations of any additional drivers or files that you want to include on the DaRT recovery image. - -For more information about the DaRT tools, see [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md). For more information about how to help create a secure recovery image, see [Security Considerations for DaRT 8.0](security-considerations-for-dart-80--dart-8.md). - -## Prerequisites for the recovery image - - -The following items are required or recommended for creating the DaRT recovery image: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Prerequisite

    Details

    Windows 8 source files

    Required to create the DaRT recovery image. Provide the path of a Windows 8 DVD or of Windows 8 source files.

    Windows Debugging Tools for your platform

    Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: Download and Install Debugging Tools for Windows.

    Optional: Defender definitions

    The latest definitions for Defender are required when you run Defender. Although you can download the definitions when you run Defender, we recommend that you download the latest definitions at the time you create the DaRT recovery image so that you can still run the tool with the latest definitions even if the problem computer does not have network connectivity.

    Optional: Windows symbols files for use with Crash Analyzer

    Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see Diagnosing System Failures with Crash Analyzer.

    - - - -## Related topics - - -[Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md b/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md deleted file mode 100644 index dd46acd8ee..0000000000 --- a/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Planning to Deploy DaRT 8.0 -description: Planning to Deploy DaRT 8.0 -author: dansimp -ms.assetid: 36f2babb-9ac5-4ea2-932c-12c6211f5be2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy DaRT 8.0 - - -You should consider all of the different deployment configurations and prerequisites before you create your deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## Review the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 software prerequisites and supported configurations - - -After preparing your computing environment for DaRT 8.0 installation, make sure that you review the prerequisite software to install and the supported configurations to confirm that the selected computers for the installation meet the minimum hardware and operating system requirements. For information about prerequisites that you need to consider to create the DaRT recovery image, see [Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md). - -[DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md) - -## Plan for creating the DaRT 8.0 recovery image - - -Before you start to create the DaRT recovery image, you need to consider possible security issues, the tools that you want to include on the recovery image, and the prerequisite software that you need to install. - -[Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md) - -## Plan how to save and deploy the DaRT recovery image - - -There are several methods that you can use to save and deploy the DaRT recovery image. Before you start to create the recovery image, review the advantages and disadvantages of each method and consider how you want to use DaRT in your enterprise. - -[Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md) - -## Other resources for planning to deploy DaRT 8.0 - - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md b/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md deleted file mode 100644 index 0cec24ac75..0000000000 --- a/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Recovering Computers Using DaRT 8.0 -description: Recovering Computers Using DaRT 8.0 -author: dansimp -ms.assetid: 0caeb7d9-c1e6-4f32-bc27-157b91630989 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Recovering Computers Using DaRT 8.0 - - -After deploying the Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 recovery image, you can use DaRT 8.0 to recover computers. The information in this section describes the recovery tasks that you can perform. - -You have several different methods to choose from to boot into DaRT, depending on how you deploy the DaRT recovery image. - -- Insert a DaRT recovery image CD, DVD, or USB flash drive into the problem computer and use it to boot into the computer. - -- Boot into DaRT from a recovery partition on the problem computer. - -- Boot into DaRT from a remote partition on the network. - -For information about the advantages and disadvantages of each method, see [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md). - -Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user. - -**Note**   -Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization. - - - -## Recover a local computer by using the DaRT recovery image - - -To recover a local computer by using DaRT, you must be physically present at the end-user computer that is experiencing problems that require DaRT. - -[How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md) - -## Recover a remote computer by using the DaRT recovery image - - -The Remote Connection feature in DaRT lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a help desk professional working on the end-user computer), the IT administrator or help desk worker can take control of the end user's computer and run the necessary DaRT tools remotely. - -**Important**   -The two computers establishing a remote connection must be part of the same network. - - - -The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**. - -The Remote Connection feature on the end-user computer creates the following connection information: a ticket number, a port, and a list of all available IP addresses. The ticket number and port are generated randomly. - -The IT administrator or help desk worker enters this information into the **DaRT Remote Connection Viewer** to establish the terminal services connection to the end-user computer. The terminal services connection that is established lets an IT administrator remotely interact with the DaRT tools on the end-user computer. The end-user computer then processes the connection information, shares its screen, and responds to instructions from the IT administrator computer. - -[How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md) - -## Other resources for recovering computers using DaRT 8.0 - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/release-notes-for-dart-80--dart-8.md b/mdop/dart-v8/release-notes-for-dart-80--dart-8.md deleted file mode 100644 index 501dfef1e7..0000000000 --- a/mdop/dart-v8/release-notes-for-dart-80--dart-8.md +++ /dev/null @@ -1,101 +0,0 @@ ---- -title: Release Notes for DaRT 8.0 -description: Release Notes for DaRT 8.0 -author: dansimp -ms.assetid: e8b373c8-7aa5-4930-a8f9-743d26145dad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for DaRT 8.0 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. - -These release notes contain information that is required to successfully install DaRT 8.0. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -To get the DaRT software, see [How to Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049). - -## About the product documentation - - -For information about documentation for DaRT, see the [DaRT home page](https://go.microsoft.com/fwlink/?LinkID=252096) on Microsoft TechNet. - -To obtain a downloadable copy of DaRT documentation, see on the Microsoft Download Center. - -## Providing feedback - - -We are interested in your feedback on DaRT 8.0. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan future changes for our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known issues with DaRT 8.0 - - -### System restore fails when you run Locksmith or Registry Editor - -If you run Locksmith, Registry Editor, and possibly other tools, System Restore fails. - -**Workaround:** Close and restart DaRT and then start System Restore. - -### SFC scan fails to run after you launch and close Locksmith or Computer Management - -If you start and then close the Locksmith or Computer Management tools, System File Checker fails to run. - -**Workaround:** Close and restart DaRT and then start SFC. - -### DaRT installer does not fail when ADK has not been installed - -If you install DaRT 8.0 by using the command line to execute the MSI, and the ADK has not been installed, the DaRT installation should fail. Currently, the DaRT 8.0 installer installs all components except the DaRT 8.0 recovery image. - -**Workaround:** None. - -### Defender cannot be launched after Locksmith, RegEdit, Crash Analyzer, and Computer Management are launched - -Defender does not launch if you have already launched Locksmith, RegEdit, Crash Analyzer, and Computer Management. - -**Workaround:** Close and restart DaRT and then launch Defender. - -### Defender may be slow to launch - -Defender sometimes takes a few minutes to launch. The progress bar indicates the current loading status. - -**Workaround:** None. - -## Release notes copyright information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - -## Related topics - - -[About DaRT 8.0](about-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/release-notes-for-dart-80-sp1.md b/mdop/dart-v8/release-notes-for-dart-80-sp1.md deleted file mode 100644 index 063f9be979..0000000000 --- a/mdop/dart-v8/release-notes-for-dart-80-sp1.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Release Notes for DaRT 8.0 SP1 -description: Release Notes for DaRT 8.0 SP1 -author: dansimp -ms.assetid: fa7512d8-fb00-4c27-8f65-c15f3a8ff1cc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for DaRT 8.0 SP1 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 Service Pack 1 (SP1). - -These release notes contain information that is required to successfully install Diagnostics and Recovery Toolset 8.0 SP1. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the product documentation - - -For information about documentation for DaRT, see the [DaRT home page](https://go.microsoft.com/fwlink/?LinkID=252096) on Microsoft TechNet. - -## Known issues with DaRT 8.0 SP1 - - -### System restore fails when you run Locksmith or Registry Editor - -If you run Locksmith, Registry Editor, and possibly other tools, System Restore fails. - -**Workaround:** Close and restart DaRT and then start System Restore. - -### SFC scan fails to run after you launch and close Locksmith or Computer Management - -If you start and then close the Locksmith or Computer Management tools, System File Checker fails to run. - -**Workaround:** Close and restart DaRT and then start SFC. - -### DaRT installer does not fail when ADK has not been installed - -If you install DaRT 8.0 SP1 by using the command line to run the MSI, and the ADK has not been installed, the DaRT installation should fail. Currently, the DaRT 8.0 SP1 installer installs all components except the DaRT recovery image. - -**Workaround:** None. - -### Defender cannot be launched after Locksmith, RegEdit, Crash Analyzer, and Computer Management are launched - -Defender does not launch if you have already launched Locksmith, RegEdit, Crash Analyzer, and Computer Management. - -**Workaround:** Close and restart DaRT and then launch Defender. - -### Defender may be slow to launch - -Defender sometimes takes a few minutes to launch. The progress bar indicates the current loading status. - -**Workaround:** None. - -## Release notes copyright information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - -## Related topics - - -[About DaRT 8.0 SP1](about-dart-80-sp1.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/release-notes-for-dart-81.md b/mdop/dart-v8/release-notes-for-dart-81.md deleted file mode 100644 index 9b8d9d6639..0000000000 --- a/mdop/dart-v8/release-notes-for-dart-81.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Release Notes for DaRT 8.1 -description: Release Notes for DaRT 8.1 -author: dansimp -ms.assetid: 44303107-60f4-485c-848a-7e0529f142d4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Release Notes for DaRT 8.1 - - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft Diagnostics and Recovery Toolset (DaRT) 8.1. - -These release notes contain information that is required to successfully install Diagnostics and Recovery Toolset 8.1. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other DaRT documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Known issues with DaRT 8.1 - - -### Disk Commander is unable to repair a corrupt master boot record in a physical partition in Windows 8.1 - -In Windows 8.1, the “Restore the Master Boot Record (MBR) or the header of the GUID Partition Table (GPT)” option in Disk Commander is unable to repair a corrupt master boot record in a physical partition, and therefore is unable to boot the client computer. - -**Workaround:** Start **Startup Repair**, click **Troubleshoot**, click **Advanced options**, and then click **Start repair**. - -### Multiple instances of Disk Wipe that target the same drive cause all instances except the last one to report a failure - -If you start multiple instances of Disk Wipe, and then try to wipe the same drive by using two separate Disk Wipe instances, all instances except the last one report a failure to wipe the drive. - -**Workaround:** None. - -### Disk Wipe may not clear all data on solid-state drives that have flash memory - -If you use Disk Wipe to clear data on a solid-state drive (SSD) that has flash memory, all of the data may not be erased. This issue occurs because the SSD firmware controls the physical location of writes while Disk Wipe is running. - -**Workaround:** None. - -### System restore fails when you run Locksmith Wizard or Registry Editor - -If you run Locksmith Wizard, Registry Editor, and possibly other tools, System Restore fails. - -**Workaround:** Close and restart DaRT, and then start System Restore. - -### System File Checker (SFC) Scan fails to run after you start and close Locksmith Wizard or Computer Management - -If you start and then close Locksmith Wizard or tools in Computer Management, System File Checker fails to run. - -**Workaround:** Close and restart DaRT, and then start System File Checker. - -### DaRT installer does not fail when the Windows Assessment and Deployment Kit is not installed - -If you install DaRT 8.1 by using the command line to run the Windows Installer (.msi), and the Windows Assessment and Deployment Kit (Windows ADK) has not been installed, the DaRT installation should fail. Currently, the DaRT 8.1 installer installs all components except the DaRT recovery image. - -**Workaround:** None. - -### Windows Defender cannot start after Locksmith Wizard, Registry Editor, Crash Analyzer, and Computer Management are started - -Windows Defender does not start if you have already started Locksmith Wizard, Registry Editor, Crash Analyzer, and Computer Management. - -**Workaround:** Close and restart DaRT, and then start Windows Defender. - -### Windows Defender may be slow to start - -Windows Defender sometimes takes a few minutes to start. The progress bar indicates the current loading status. - -**Workaround:** None. - -## Related topics - - -[About DaRT 8.1](about-dart-81.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md b/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md deleted file mode 100644 index bb8ae3ba3b..0000000000 --- a/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Security and Privacy for DaRT 8.0 -description: Security and Privacy for DaRT 8.0 -author: dansimp -ms.assetid: 668188fc-d9e9-4607-b90a-9e50bf53bc88 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for DaRT 8.0 - - -Use the following information to help you plan for security and privacy considerations in Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. - -## Security considerations for DaRT 8.0 - - -There are several security-related considerations that you should plan for when deploying and using DaRT in your environment. The information in this section provides a brief overview about the security-related considerations for DaRT. - -[Security Considerations for DaRT 8.0](security-considerations-for-dart-80--dart-8.md) - -## Privacy considerations for DaRT 8.0 - - -The information in this section explains many of the data collection and use practices of DaRT. - -[DaRT 8.0 Privacy Statement](dart-80-privacy-statement-dart-8.md) - -## Other resources for DaRT 8.0 security and privacy - - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md b/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md deleted file mode 100644 index 918f14acaf..0000000000 --- a/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Security Considerations for DaRT 8.0 -description: Security Considerations for DaRT 8.0 -author: dansimp -ms.assetid: 45ef8164-fee7-41a1-9a36-de4e3264e7a8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Security Considerations for DaRT 8.0 - - -This topic contains a brief overview about the accounts and groups, log files, and other security-related considerations for Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0. For more information, follow the links within this article. - -## General security considerations - - -**Understand the security risks**. DaRT 8.0 includes functionality that lets an administrator or a help desk worker run the DaRT tools remotely to resolve problems on an end-user computer. In addition, you can save the International Organization for Standardization (ISO) image to a USB flash drive or put the ISO image on a network to include its contents as a recovery partition on a computer’s hard disk. These capabilities provide flexibility, but also create potential security risks that you should consider when configuring DaRT. - -**Physically secure your computers**. When administrators and help desk workers are not physically at their computers, they should lock their computers and use a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for operating systems by subscribing to the Security Notification service (). - -## Limit end-user access to DaRT tools - - -When you are creating the DaRT recovery image, you can select the tools that you want to include. For security reasons, you might want to restrict end-user access to the more powerful DaRT tools, such as Disk Wipe and Locksmith. In DaRT 8.0, you can disable certain tools during configuration and still make them available to help desk workers when the end user starts the Remote Connection feature. - -You can even configure the DaRT image so that the option to start a remote connection session is the only tool available to an end user. - -**Important**   -After the remote connection is established, all the tools that you included in the recovery image, including those unavailable to the end user, will become available to any help desk worker who is working on the end–user computer. - - - -For more information about including tools in the DaRT recovery image, see [Overview of the Tools in DaRT 8.0](overview-of-the-tools-in-dart-80-dart-8.md). - -## Secure the DaRT recovery image - - -If you deploy the DaRT recovery image by saving it to a USB flash drive or by creating a remote partition or a recovery partition, you might want to include your company’s preferred method of drive encryption on the ISO. Encrypting the ISO helps to ensure that end users cannot use DaRT functionality if they were to gain access to the recovery image, and it ensures that unauthorized users cannot boot into DaRT on computers that belong to someone else. If you use an encryption method, be sure to deploy and enable it in all computers. - -**Note**   -DaRT 8.0 supports BitLocker natively. - - - -To include drive encryption, add the encryption solution files when you create the recovery image. Your encryption solution must be able to run on WinPE. End users who boot from the ISO are then able to access that encryption solution and unblock the drive. - -## Maintain security between two computers when you use Remote Connection - - -By default, the communication between two computers that have established a **Remote Connection** session may not be encrypted. Therefore, to help maintain security between the two computers, we recommend that both computers are a part of the same network. - -## Related topics - - -[Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md) - - - - - - - - - diff --git a/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md b/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md deleted file mode 100644 index 6fefab5848..0000000000 --- a/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Technical Reference for DaRT 8.0 -description: Technical Reference for DaRT 8.0 -author: dansimp -ms.assetid: 1d0bf98b-b56b-4ce6-ad19-eb85e1ff1287 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 10/03/2016 ---- - - -# Technical Reference for DaRT 8.0 - - -This section includes technical reference information about Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 that provide additional information an administrator. - -## Technical reference - - -[Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection-->](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md) - - Environments with the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. - -## Other resources for DaRT 8.0 operations - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -[Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/troubleshooting-dart-80-dart-8.md b/mdop/dart-v8/troubleshooting-dart-80-dart-8.md deleted file mode 100644 index 1ad577b12a..0000000000 --- a/mdop/dart-v8/troubleshooting-dart-80-dart-8.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting DaRT 8.0 -description: Troubleshooting DaRT 8.0 -author: dansimp -ms.assetid: 0444a390-3251-47f4-b6c8-828d4a2e8af4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting DaRT 8.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to find troubleshooting content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting DaRT 8.0 - - -[Diagnostics and Recovery Toolset 8 Administrator's Guide](index.md) - -[Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md) - -[Planning for DaRT 8.0](planning-for-dart-80-dart-8.md) - -[Deploying DaRT 8.0](deploying-dart-80-dart-8.md) - -[Operations for DaRT 8.0](operations-for-dart-80-dart-8.md) - -  - -  - - - - - diff --git a/mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md b/mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md deleted file mode 100644 index 6265073d6b..0000000000 --- a/mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Use Windows Defender Offline (WDO) for malware protection not DaRT -description: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection -author: dansimp -ms.assetid: 59678283-4b44-4d02-ba8f-0e7315efd5d1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: support -ms.sitesec: library -ms.prod: w10 -ms.date: 09/25/2019 ---- - - -# Use Windows Defender Offline (WDO) for malware protection, not DaRT. - -Environments that have the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. This applies to all currently supported versions of DaRT. These versions include DaRT 7, DaRT 8, and DaRT 8.1, together with their service packs. - -## About Windows Defender - - -The Windows Defender tool distributes anti-malware updates more frequently than the DaRT Defender tool. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. Without these updates, the DaRT Defender tool quickly becomes outdated. To make sure of up-to-date protection at scan time, you should download Windows Defender Offline to create a bootable image for scanning. - -Currently deployed DaRT images do not have to be removed or updated. We recommend that you deploy the bootable image that is provided by Windows Defender Offline for all future malware scans. Using an outdated version of the DaRT Defender tool could result in undetected malware. - -For more information about Windows Defender Offline downloads and FAQs, go to the following website: [What is Windows Defender Offline?](https://go.microsoft.com/fwlink/p/?LinkId=394127). - -  - -  - - - - - diff --git a/mdop/docfx.json b/mdop/docfx.json index e6f79ff24a..abcead924c 100644 --- a/mdop/docfx.json +++ b/mdop/docfx.json @@ -34,7 +34,7 @@ "ms.topic": "article", "ms.date": "04/05/2017", "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_github_repo": "https://github.com/MicrosoftDocs/mdop-docs", "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { diff --git a/mdop/index.md b/mdop/index.md deleted file mode 100644 index 93ce634a80..0000000000 --- a/mdop/index.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: MDOP Information Experience -description: MDOP Information Experience -ms.assetid: 12b8ab56-3267-450d-bb22-1c7e44cb8e52 -author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 07/24/2018 ---- - -# MDOP Information Experience - - -The Microsoft Desktop Optimization Pack (MDOP) is a portfolio of technologies available as a subscription for Software Assurance customers. MDOP helps to improve compatibility and management, reduce support costs, improve asset management, and improve policy control. - -The MDOP Information Experience provides product documentation, videos, blogs, and other resources to help users implement and optimize their experience with the MDOP technologies. You can learn about updates and events by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## MDOP Documentation Links - - -The following table provides links to the product documentation for the MDOP products by version. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of the Group Policy Management Console (GPMC) to provide change control and improved management.

    -

    AGPM 4.0 SP3 – Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2008, Windows Server 2008 R2

    -

    AGPM 4.0 SP2 - Windows 8.1, Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2008, Windows Server 2008 R2

    -

    AGPM 4.0 SP1 - Windows 8, Windows 7, Windows Vista SP1, Windows Server 2012, Windows Server 2008, Windows Server 2008 R2

    -

    AGPM 4.0 - Windows Vista SP1, Windows 7, Windows Server 2008, Windows Server 2008 R2

    -

    AGPM 3.0- Windows Vista SP1, Windows Server 2008

    -

    AGPM 2.5 - Windows Vista, Windows Server 2003

    Overview of Microsoft Advanced Group Policy Management

    -

    AGPM 4.0 SP3

    -

    AGPM 4.0 SP2

    -

    AGPM 4.0 SP1 (https://go.microsoft.com/fwlink/p/?LinkId=286715)

    -

    AGPM 4.0

    -

    AGPM 3.0

    -

    AGPM 2.5

    -

    AGPM Whitepapers on the Microsoft Download Center

    Microsoft Application Virtualization (App-V) lets you make applications available to end user computers without installing the applications directly on those computers.

    Microsoft Application Virtualization 5.1 Administrator's Guide

    -

    About App-V 5.0 SP3

    -

    About App-V 5.0 SP2

    -

    About App-V 5.0 SP1

    -

    Microsoft Application Virtualization 5.0 Administrator's Guide

    -

    About Microsoft Application Virtualization 4.6 SP3

    -

    About Microsoft Application Virtualization 4.6 SP2

    -

    About Microsoft Application Virtualization 4.6 SP1

    -

    About Microsoft Application Virtualization 4.6

    -

    About Microsoft Application Virtualization 4.5

    -

    App-V Whitepapers on the Microsoft Download Center

    -

    App-V 5.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309570)

    Microsoft BitLocker Administration and Monitoring (MBAM) provides an administrative interface to enterprise-wide BitLocker drive encryption.

    Microsoft BitLocker Administration and Monitoring 2.5

    -

    MBAM 2.5 Video Demonstration: Deploying MBAM 2.5

    -

    About MBAM 2.5 SP1

    -

    About MBAM 2.0 SP1

    -

    Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide

    -

    Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide

    -

    MBAM Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=231905)

    -

    MBAM 1.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309571)

    Microsoft Diagnostics and Recovery Toolset (DaRT) helps troubleshoot and repair Windows-based computers.

    -

    DaRT 10 - Windows 10

    -

    DaRT 8.1 - Windows 8.1, Windows Server 2012 R2

    -

    DaRT 8.0 SP1 - Windows 8, Windows Server 2012

    -

    DaRT 8.0 - Windows 8, Windows Server 2012

    -

    DaRT 7.0 - Windows 7, Windows Server 2008 R2

    -

    DaRT 6.5 - Windows 7, Windows Server 2008 R2

    -

    DaRT 6.0 - Windows Vista, Windows Server 2008

    -

    DaRT 5.0 - Windows 2000, Windows XP, Windows Server 2003

    Diagnostics and Recovery Toolset 10

    -

    About DaRT 8.1

    -

    About DaRT 8.0 SP1

    -

    Diagnostics and Recovery Toolset 8 Administrator's Guide

    -

    Diagnostics and Recovery Toolset 7 Administrator's Guide

    -

    DaRT 6.5 (https://go.microsoft.com/fwlink/p/?LinkId=232983)

    -

    DaRT Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=232274)

    -

    DaRT 8.0 eBook (https://go.microsoft.com/fwlink/p/?LinkId=309573)

    -

    DaRT 7.0 eBook (https://go.microsoft.com/fwlink/p/?LinkId=309572)

    Microsoft Desktop Enterprise Monitoring (DEM) monitors and reports enterprise-wide desktop application and system failures.

    DEM 3.5 (https://go.microsoft.com/fwlink/p/?LinkId=232985)

    -

    DEM Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=232276)

    Microsoft Enterprise Desktop Virtualization (MED-V) uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization.

    -

    MED-V 2.0 - Windows 7

    -

    MED-V 1.0 SP1 - Windows 7, Windows Vista, Windows XP

    -

    MED-V 1.0 - Windows Vista, Windows XP

    Microsoft Enterprise Desktop Virtualization 2.0

    -

    About MED-V 1.0 SP1

    -

    Microsoft Enterprise Desktop Virtualization 1.0

    -

    Microsoft User Experience Virtualization (UE-V) captures settings to apply to computers accessed by the user including desktop computers, laptop computers, and VDI sessions.

    Microsoft User Experience Virtualization (UE-V) 2.x

    -

    What's New in UE-V 2.1 SP1

    -

    What's New in UE-V 2.1

    -

    What's New in UE-V 2.0

    -

    About User Experience Virtualization 1.0 SP1

    -

    Microsoft User Experience Virtualization (UE-V) 1.0

    -

    UE-V 1.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309574)

    MDOP Solutions and Scenarios

    Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0

    -

    Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0

    -

    Creating App-V 4.5 Databases Using SQL Scripting

    -

    Application Publishing and Client Interaction for App-V 5

    -

    How to Download and Deploy MDOP Group Policy (.admx) Templates

    - - - -## Supplemental MDOP Product Guidance - - -In addition to the product documentation available online, supplemental product guidance such as informational videos and virtual labs are available for most MDOP products. - - ---- - - - - - - - - - - - - - - -

    MDOP Virtual Labs

    For a list of available MDOP virtual labs, go to Microsoft Desktop Optimization Pack (MDOP) Virtual Labs (https://go.microsoft.com/fwlink/p/?LinkId=234276).

    MDOP TechCenter

    For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to MDOP TechCenter (https://go.microsoft.com/fwlink/p/?LinkId=225286)

    -

    MDOP Forums

    Join in the MDOP community where you can ask and answer questions at the MDOP TechNet Forum (https://go.microsoft.com/fwlink/p/?LinkId=286973).

    - - - -## How to Get MDOP - - -MDOP is a suite of products that can help streamline desktop deployment, management, and support across the enterprise. MDOP is available as an additional subscription for Software Assurance customers. - -**Download MDOP** -MDOP subscribers can download the software at the [Microsoft Volume Licensing website (MVLS)](https://go.microsoft.com/fwlink/p/?LinkId=166331). - -**Purchase MDOP** -Visit the enterprise [Purchase Windows Enterprise Licensing](https://www.microsoft.com/licensing/how-to-buy/how-to-buy) website to find out how to purchase MDOP for your business. - - - - - - - - - diff --git a/mdop/mbam-v1/TOC.md b/mdop/mbam-v1/TOC.md deleted file mode 100644 index 8d49baf940..0000000000 --- a/mdop/mbam-v1/TOC.md +++ /dev/null @@ -1,59 +0,0 @@ -# [Microsoft BitLocker Administration and Monitoring 1](index.md) -## [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) -### [About MBAM 1.0](about-mbam-10.md) -#### [Release Notes for MBAM 1.0](release-notes-for-mbam-10.md) -### [Evaluating MBAM 1.0](evaluating-mbam-10.md) -### [High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md) -### [Accessibility for MBAM 1.0](accessibility-for-mbam-10.md) -## [Planning for MBAM 1.0](planning-for-mbam-10.md) -### [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) -#### [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) -#### [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) -#### [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) -### [Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) -#### [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) -#### [Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md) -#### [Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md) -### [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) -## [Deploying MBAM 1.0](deploying-mbam-10.md) -### [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) -#### [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md) -#### [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md) -#### [How to Configure Network Load Balancing for MBAM](how-to-configure-network-load-balancing-for-mbam.md) -### [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) -#### [How to Install the MBAM 1.0 Group Policy Template](how-to-install-the-mbam-10-group-policy-template.md) -#### [How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md) -#### [How to Hide Default BitLocker Encryption in The Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md) -### [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) -#### [How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md) -#### [How to Deploy the MBAM Client as Part of a Windows Deployment](how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md) -### [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) -#### [How to Install the MBAM Language Update on a Single Server](how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md) -#### [How to Install the MBAM Language Update on Distributed Servers](how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md) -#### [Known Issues in the MBAM International Release](known-issues-in-the-mbam-international-release-mbam-1.md) -### [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md) -## [Operations for MBAM 1.0](operations-for-mbam-10.md) -### [Administering MBAM 1.0 Features](administering-mbam-10-features.md) -#### [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md) -#### [How to Manage Hardware Compatibility](how-to-manage-hardware-compatibility-mbam-1.md) -#### [How to Manage Computer BitLocker Encryption Exemptions](how-to-manage-computer-bitlocker-encryption-exemptions.md) -#### [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md) -#### [How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md) -### [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) -#### [Understanding MBAM Reports](understanding-mbam-reports-mbam-1.md) -#### [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-1.md) -### [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) -#### [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-1.md) -#### [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-1.md) -#### [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-1.md) -#### [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-1.md) -#### [How to Determine the BitLocker Encryption State of a Lost Computers](how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md) -### [Maintaining MBAM 1.0](maintaining-mbam-10.md) -#### [High Availability for MBAM 1.0](high-availability-for-mbam-10.md) -#### [How to Move MBAM 1.0 Features to Another Computer](how-to-move-mbam-10-features-to-another-computer.md) -### [Security and Privacy for MBAM 1.0](security-and-privacy-for-mbam-10.md) -#### [Security Considerations for MBAM 1.0](security-considerations-for-mbam-10.md) -#### [Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md) -### [Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md) -## [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - diff --git a/mdop/mbam-v1/about-mbam-10.md b/mdop/mbam-v1/about-mbam-10.md deleted file mode 100644 index 3d6a3f705f..0000000000 --- a/mdop/mbam-v1/about-mbam-10.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: About MBAM 1.0 -description: About MBAM 1.0 -author: dansimp -ms.assetid: 99254aaa-2b30-4b2e-8365-0d4b67a89a0c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About MBAM 1.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) provides a simplified administrative interface to BitLocker drive encryption and offers enhanced protection against data theft or data exposure for computers that are lost or stolen. BitLocker encrypts all data that is stored on the Windows operating system volume and configured data volumes, which includes the Windows operating system, hibernation and paging files, applications, and the data that is used by applications. - -With Microsoft BitLocker Administration and Monitoring, you can select the BitLocker encryption policy options that are appropriate for your enterprise so that you can monitor the client compliance with those policies and then report the encryption status of both the enterprise and individual computers. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. - -**Note**   -BitLocker is not covered in detail in this guide. For an overview of BitLocker, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013). - - - -The following groups might be interested in using MBAM to manage BitLocker: - -- Administrators, IT security professionals, and compliance officers who are tasked with ensuring that confidential data is not disclosed without authorization - -- Administrators who are responsible for securing computers in remote or branch offices - -- Administrators who are responsible for servers or Windows client computers that are mobile - -- Administrators who are responsible for decommissioning servers that contain confidential data - -## MBAM 1.0 Release Notes - - -For more information and for latest updates, see [Release Notes for MBAM 1.0](release-notes-for-mbam-10.md). - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/accessibility-for-mbam-10.md b/mdop/mbam-v1/accessibility-for-mbam-10.md deleted file mode 100644 index bfe5549622..0000000000 --- a/mdop/mbam-v1/accessibility-for-mbam-10.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for MBAM 1.0 -description: Accessibility for MBAM 1.0 -author: dansimp -ms.assetid: 5c1bf1a3-76cf-458c-ac4a-cd343aace4de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for MBAM 1.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access Any Command with a Few Keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md b/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md deleted file mode 100644 index 1609db7fb7..0000000000 --- a/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Administering MBAM 1.0 by Using PowerShell -description: Administering MBAM 1.0 by Using PowerShell -author: dansimp -ms.assetid: 3bf2eca5-4ab7-4e84-9e80-c0c7d709647b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 1.0 by Using PowerShell - - -Microsoft BitLocker Administration and Monitoring (MBAM) provides the following listed set of Windows PowerShell cmdlets. Administrators can use these PowerShell cmdlets to perform various MBAM server tasks from the command prompt rather than from the MBAM administration website. - -## How to administer MBAM by using PowerShell - - -Use the PowerShell cmdlets described here to administer MBAM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Add-MbamHardwareType

    Adds a new hardware model to the MBAM hardware inventory. This cmdlet can also specify whether the hardware is supported or unsupported for BitLocker drive encryption.

    Get-MbamBitLockerRecoveryKey

    Requests an MBAM recovery key that will enable a user to unlock a computer or encrypted drive.

    Get-MbamHardwareType

    Gets a master hardware inventory that contains data that indicates whether hardware models are compatible or incompatible with BitLocker drive encryption.

    Get-MbamTPMOwnerPassword

    Provides a TPM owner password for a user to manage their TPM (Trusted Platform Module) access. Helps users when TPM has locked them out and will no longer accept their PIN.

    Install-Mbam

    Installs MBAM features that provide advanced group policy, encryption, key recovery, and compliance reporting tools.

    Remove-MbamHardwareType

    Removes the hardware models from the hardware inventory.

    Set-MbamHardwareType

    Allows management of a master hardware inventory to designate whether or not hardware models are capable or incapable to perform BitLocker encryption.

    Uninstall-Mbam

    Removes previously installed MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting tools.

    - -  - -## Related topics - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/administering-mbam-10-features.md b/mdop/mbam-v1/administering-mbam-10-features.md deleted file mode 100644 index 5f4fbb0244..0000000000 --- a/mdop/mbam-v1/administering-mbam-10-features.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Administering MBAM 1.0 Features -description: Administering MBAM 1.0 Features -author: dansimp -ms.assetid: dd9a9eff-f1ad-4af3-85d9-c19131a4ad22 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 1.0 Features - - -After you complete all necessary Microsoft BitLocker Administration and Monitoring (MBAM) planning and deployment, you can configure and use MBAM to manage enterprise BitLocker encryption. The information in this section describes post-installation day-to-day MBAM feature operations tasks. - -## Manage MBAM Administrator Roles - - -After MBAM Setup is complete for all server features, administrative users must be granted access to these server features. As a best practice, administrators who will manage or use MBAM server features, should be assigned to Active Directory security groups and then those groups should be added to the appropriate MBAM administrative local group. - -[How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md) - -## Manage Hardware Compatibility - - -The MBAM Hardware Compatibility feature can help you to ensure that only the computer hardware that you specify as supporting BitLocker will be encrypted. When this feature is turned on, bit\_admmontla will encrypt only computers that are marked as Compatible. - -**Important**   -When this feature is turned off, all computers where the MBAM policy is deployed will be encrypted. - - - -MBAM can collect information on both the make and model of client computers if you deploy the “Allow Hardware Compatibility Checking” Group Policy. If you configure this policy, the MBAM agent reports the computer make and model information to the MBAM Server when the MBAM Client is deployed on a client computer. - -[How to Manage Hardware Compatibility](how-to-manage-hardware-compatibility-mbam-1.md) - -[How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md) - -## Manage BitLocker encryption exemptions - - -MBAM can grant two forms of exemption from BitLocker encryption: computer exemption and user exemption. Computer exemption is typically used when a company has computers that do not have to be encrypted, such as computers that are used in development or testing, or older computers that do not support BitLocker. In some cases, local law may also require that certain computers are not encrypted. You may also choose to exempt users who do not need or want their drives encrypted. - -[How to Manage Computer BitLocker Encryption Exemptions](how-to-manage-computer-bitlocker-encryption-exemptions.md) - -## Manage MBAM Client BitLocker Encryption Options by using the Control Panel - - -If enabled through a Group Policy Objects (GPO), a custom MBAM control panel that is named BitLocker Encryption Options will be available under **System and Security**. This customized control panel replaces the default Windows BitLocker control panel. The MBAM control panel enables you to unlock encrypted drives (fixed and removable), and also helps you manage your PIN or password. - -[How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md) - -## Other resources for Administering MBAM features - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md b/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md deleted file mode 100644 index 37436151d6..0000000000 --- a/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Deploying MBAM 1.0 Group Policy Objects -description: Deploying MBAM 1.0 Group Policy Objects -author: dansimp -ms.assetid: 2129291e-d2b2-41ed-b643-1e311c49fee7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 1.0 Group Policy Objects - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you must first determine the Group Policies that you will use in your implementation of MBAM. For more information about the various available policies, see [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md). When you have determined the policies that you are going to use, you must use the MBAM 1.0 Group Policy template to create and deploy one or more Group Policy objects (GPO) that include the MBAM policy settings. - -## Install the MBAM 1.0 Group Policy template - - -In addition to providing server-related features of MBAM, the server setup application includes an MBAM Group Policy template. You can install this template on any computer that is able to run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -[How to Install the MBAM 1.0 Group Policy Template](how-to-install-the-mbam-10-group-policy-template.md) - -## Deploy MBAM 1.0 Group Policy settings - - -After you create the necessary GPOs, you must deploy the MBAM Group Policy settings to your organization’s client computers. - -[How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md) - -## Display the MBAM Control Panel in Windows - - -Because MBAM offers a customized MBAM control panel that can replace the default Windows BitLocker control panel, you can also choose to hide the default BitLocker Control Panel from end users by using Group Policy. - -[How to Hide Default BitLocker Encryption in The Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md) - -## Other resources for deploying MBAM 1.0 Group Policy Objects - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/deploying-mbam-10.md b/mdop/mbam-v1/deploying-mbam-10.md deleted file mode 100644 index ab3420e5c6..0000000000 --- a/mdop/mbam-v1/deploying-mbam-10.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Deploying MBAM 1.0 -description: Deploying MBAM 1.0 -author: dansimp -ms.assetid: ff952ed6-08b2-4ed0-97b8-bf89f22cccbc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 1.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) supports a number of different deployment configurations. This section of the Administrator’s Guide for Microsoft BitLocker Administration and Monitoring includes information that you should consider about the deployment of MBAM and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment information - - -- [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - This section describes the different topology options for MBAM deployment and how to use MBAM Setup to deploy MBAM Server features. - -- [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - - This section describes how to create and deploy the MBAM Group Policy Objects that are required to manage MBAM Clients and BitLocker encryption policies throughout the enterprise. - -- [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - This section describes how to use the MBAM Client Windows Installer files to deploy the MBAM Client software. - -- [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - - This section describes how to deploy the MBAM language release update to provide support for additional non-English language user interfaces. - -- [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md) - - This section provides a deployment checklist that can help you deploy MBAM Server and MBAM Client. - -## Other Resources for deploying MBAM - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/deploying-the-mbam-10-client.md b/mdop/mbam-v1/deploying-the-mbam-10-client.md deleted file mode 100644 index cba12f248f..0000000000 --- a/mdop/mbam-v1/deploying-the-mbam-10-client.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Deploying the MBAM 1.0 Client -description: Deploying the MBAM 1.0 Client -author: dansimp -ms.assetid: f7ca233f-5035-4ff9-ab3a-f2453b4929d1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 1.0 Client - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through tools like Active Directory Domain Services or by directly encrypting the client computers as part of the initial imaging process. - -Depending on when you deploy the MBAM Client, you can enable BitLocker encryption on a computer in your organization either before or after the end user receives the computer. To control this timing, you configure Group Policy and deploy the MBAM Client software by using an enterprise software deployment system. - -You can use either or both of these methods in your organization. If you use both methods, you can improve compliance, reporting, and key recovery support. - -## Deploy the MBAM Client to desktop or laptop computers - - -After you have configured Group Policy, you can deploy the MBAM Client installation Windows Installer files to target computers. You can do this by use of an enterprise software deployment system product like Microsoft System Center 2012 Configuration Manager or Active Directory Domain Services. The two available MBAM Client installation Windows Installer files are MBAMClient-64bit.msi and MBAMClient-32bit.msi. These files are provided with the MBAM software. For more information about how to deploy MBAM Group Policy Objects, see [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md). - -[How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md) - -## Deploy the MBAM Client as part of a Windows deployment - - -In some organizations, new computers are received and configured centrally. This situation enables administrators to install the MBAM Client to manage BitLocker encryption on each computer before any user data is written to the computer. This approach helps to ensure that computers are properly encrypted because the administrator performs the action without reliance on end-user action. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. - -[How to Deploy the MBAM Client as Part of a Windows Deployment](how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md) - -## Other resources for deploying the MBAM Client - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - -[Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md b/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md deleted file mode 100644 index 22cac957e6..0000000000 --- a/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Deploying the MBAM 1.0 Language Release Update -description: Deploying the MBAM 1.0 Language Release Update -author: dansimp -ms.assetid: 9dbd85c3-e470-4752-a90f-25754dd46dab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 1.0 Language Release Update - - -Microsoft BitLocker Administration and Monitoring (MBAM) 1.0 Language Release is an update to MBAM and includes the support of new languages. The new languages are: - -- English (en-us) - -- French (fr) - -- Italian (it) - -- German (de) - -- Spanish (es) - -- Korean (ko) - -- Japanese (ja) - -- Brazilian Portuguese (pt-br) - -- Russian (ru) - -- Chinese Traditional (zh-tw) - -- Chinese Simplified (zh-cn) - -The MBAM 1.0 language update will change the version number from MBAM 1.0.1237.1 to MBAM 1.0.2001. - -You do not need to reinstall all of the MBAM features in order to add these additional languages. This topic defines the steps required to add the newly supported languages. - -## Deploy the MBAM international release to MBAM Server features - - -To begin, you must update the following MBAM server features: - -- Compliance and Audit Report - -- Administration and Monitoring Server - -- Policy Templates - -Then, you must run **MbamSetup.exe** to upgrade the MBAM features that run on the same server at the same time. - -[How to Install the MBAM Language Update on a Single Server](how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md) - -[How to Install the MBAM Language Update on Distributed Servers](how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md) - -## Install the MBAM language update for Group Policies - - -The MBAM Group Policy templates can be installed on each management workstation or they can be copied to the Group Policy central store, in order to make the templates available to all Group Policy administrators. The policy templates cannot be directly installed on a domain controller. If you do not use a Group Policy central store, then you must copy the policies manually to each domain controller that manages MBAM Group Policy. - -To add the MBAM language policies templates, copy the Group Policy language files from %SystemRoot%\\PolicyDefinitions on the computer where the “Policy Templates” role was installed to the same location on the workstation computer. Here are some examples of Group Policy files: - -- BitLockerManagement.admx - -- BitLockerUserManagement.admx - -- en-us\\BitLockerManagement.adml - -- en-us\\BitLockerUserManagement.adml - -- fr-fr\\ BitLockerManagement.adml - -- fr-fr\\ BitLockerUserManagement.adml - -- (and similarly for each supported language) - -## Known issues in the MBAM international release - - -This topic contains known issues for Microsoft BitLocker Administration and Monitoring International Release. - -[Known Issues in the MBAM International Release](known-issues-in-the-mbam-international-release-mbam-1.md) - -## Other resources for deploying the MBAM 1.0 Language Update - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md b/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md deleted file mode 100644 index 22d1fabb5c..0000000000 --- a/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Deploying the MBAM 1.0 Server Infrastructure -description: Deploying the MBAM 1.0 Server Infrastructure -author: dansimp -ms.assetid: 90529379-b70e-4c92-b188-3d7aaf1844af -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying the MBAM 1.0 Server Infrastructure - - -You can install Microsoft BitLocker Administration and Monitoring (MBAM) Server features in different configurations by using one to five servers. Generally, you should use a configuration of three to five servers for production environments, depending on your scalability needs. For more information about performance scalability of MBAM and recommended deployment topologies, see the [MBAM Scalability and High-Availability Guide White Paper](https://go.microsoft.com/fwlink/p/?LinkId=258314). - -## Deploy all MBAM 1.0 on a single server - - -In this configuration, all MBAM features are installed on a single server. This deployment topology for MBAM server infrastructure will support up to 21,000 MBAM client computers. - -**Important**   -This configuration is supported, but we recommend it for testing only. - - - -The procedures in this section describe the full installation of the MBAM features on a single server. - -[How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md) - -## Deploy MBAM 1.0 on distributed servers - - -MBAM features can be installed in different configurations, depending on your scalability needs. For more information about how to plan for MBAM server feature deployment, see [Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md). - -The procedures in this section describe the full installation of the MBAM features on distributed servers. - -### Three-computer configuration - -The following diagram displays the three-computer deployment topology for MBAM. We recommend this topology for production environments that support up to 55,000 MBAM Clients. - -![mbam three computer deployment topology](images/mbam-3-server.jpg) - -In this configuration, MBAM features are installed in the following configuration: - -1. Recovery and Hardware Database, Compliance and Audit Database, and Compliance and Audit Reports are installed on a server. - -2. Administration and Monitoring Server feature is installed on a server. - -3. MBAM Group Policy template is installed on a computer that is capable of modifying Group Policy Objects (GPO). - -### Four-computer configuration - -The following diagram displays the four-computer deployment topology for MBAM. We recommended this topology for production environments that support up to 110,000 MBAM Clients. - -![mbam four computer deployment topology.](images/mbam-4-computer.jpg) - -In this configuration, MBAM features are installed in the following configuration: - -1. Recovery and Hardware Database, Compliance and Audit Database, and Compliance and Audit Reports are installed on a server. - -2. Administration and Monitoring Server feature is installed on a server that is configured in a Network Load Balancing (NLB) Server Cluster. - -3. MBAM Group Policy template is installed on a computer that is capable of modifying the Group Policy Objects. - -### Five-computer configuration - -The following diagram displays the five-computer deployment topology for MBAM. We recommend this topology for production environments that support up to 135,000 MBAM Clients. - -![mbam five computer deployment topology.](images/mbam-5-computer.jpg) - -In this configuration, MBAM features are installed in the following configuration: - -1. Recovery and Hardware Database is installed on a server. - -2. The Compliance and Audit Database and Compliance and Audit Reports are installed on a server. - -3. Administration and Monitoring Server feature is installed on a server that is configured in a Network Load Balancing (NLB) Server Cluster. - -4. MBAM Group Policy template is installed on a computer that is capable of modifying Group Policy Objects. - -[How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md) - -[How to Configure Network Load Balancing for MBAM](how-to-configure-network-load-balancing-for-mbam.md) - -## Other resources for MBAM 1.0 Server features deployment - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/evaluating-mbam-10.md b/mdop/mbam-v1/evaluating-mbam-10.md deleted file mode 100644 index c7a6729376..0000000000 --- a/mdop/mbam-v1/evaluating-mbam-10.md +++ /dev/null @@ -1,184 +0,0 @@ ---- -title: Evaluating MBAM 1.0 -description: Evaluating MBAM 1.0 -author: dansimp -ms.assetid: a1e2b674-eda9-4e1c-9b4c-e748470c71f2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Evaluating MBAM 1.0 - - -Before you deploy Microsoft BitLocker Administration and Monitoring (MBAM) into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up MBAM in a single server lab environment for evaluation purposes only. - -While the actual deployment steps are very similar to the scenario that is described in [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md), this topic contains additional information to enable you to set up an MBAM evaluation environment in the least amount of time. - -## Set up the Lab Environment - - -Even when you set up a non-production instance of MBAM to evaluate in a lab environment, you should still verify that you have met the deployment prerequisites and the hardware and software requirements. For more information, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). You should also review [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) before you begin the MBAM evaluation deployment. - -### Plan for an MBAM Evaluation Deployment - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Review the Getting Started information about MBAM to gain a basic understanding of the product before you begin your deployment planning.

    Getting Started with MBAM 1.0

    Checklist box

    -

    Prepare your computing environment for the MBAM installation. To do so, you must enable the Transparent Data Encryption (TDE) on the SQL Server instances that will host MBAM databases. To enable TDE in your lab environment, you can create a .sql file to run against the master database that is hosted on the instance of the SQL Server that MBAM will use.

    -
    -Note

    You can use the following example to create a .sql file for your lab environment to quickly enable TDE on the SQL Server instance that will host the MBAM databases. These SQL Server commands will enable TDE by using a locally signed SQL Server certificate. Make sure to back up the TDE certificate and its associated encryption key to the example local backup path of C:\Backup</em>. The TDE certificate and key are required when recover the database or move the certificate and key to another server that has TDE encryption in place.

    -
    -
    - -
    -
    USE master;
    -GO
    -CREATE MASTER KEY ENCRYPTION BY PASSWORD = &amp;#39;P@55w0rd';
    -GO
    -CREATE CERTIFICATE tdeCert WITH SUBJECT = 'TDE Certificate';
    -GO
    -BACKUP CERTIFICATE tdeCert TO FILE = 'C:\Backup\TDECertificate.cer'
    -   WITH PRIVATE KEY (
    -         FILE = 'C:\Backup\TDECertificateKey.pvk',
    -         ENCRYPTION BY PASSWORD = &amp;#39;P@55w0rd');
    -GO

    MBAM 1.0 Deployment Prerequisites

    -

    Database Encryption in SQL Server 2008 Enterprise Edition

    Checklist box

    Plan for and configure MBAM Group Policy requirements.

    Planning for MBAM 1.0 Group Policy Requirements

    Checklist box

    Plan for and create the necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.

    Planning for MBAM 1.0 Administrator Roles

    Checklist box

    Plan for MBAM Server feature deployment.

    Planning for MBAM 1.0 Server Deployment

    Checklist box

    Plan for MBAM Client deployment.

    Planning for MBAM 1.0 Client Deployment

    - - - -### Perform an MBAM Evaluation Deployment - -After you complete the necessary planning and software prerequisite installations to prepare your computing environment for an MBAM installation, you can begin the MBAM evaluation deployment. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Checklist box

    Review the MBAM supported configurations information to make sure that the selected client and server computers are supported for the MBAM feature installation.

    MBAM 1.0 Supported Configurations

    Checklist box

    Run MBAM Setup to deploy MBAM Server features on a single server for evaluation purposes.

    How to Install and Configure MBAM on a Single Server

    Checklist box

    Add the Active Directory Domain Services security groups that you created during the planning phase to the appropriate local MBAM Server feature local groups on the new MBAM server.

    Planning for MBAM 1.0 Administrator Roles and How to Manage MBAM Administrator Roles

    Checklist box

    Create and deploy the required MBAM Group Policy Objects.

    Deploying MBAM 1.0 Group Policy Objects

    Checklist box

    Deploy the MBAM Client software.

    Deploying the MBAM 1.0 Client

    - - - -## Configure Lab Computers for MBAM Evaluation - - -You can change the frequency settings on the MBAM Client status reporting by using Registry Editor. However, these modifications should be used for testing purposes only. - -**Warning** -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -### Modify the Frequency Settings on MBAM Client Status Reporting - -The MBAM Client wakeup and status reporting frequencies have a minimum value of 90 minutes when they are set to use Group Policy. You can change these frequencies on MBAM client computers by editing the Windows registry to lower values, which will help speed up the testing. To modify the frequency settings on MBAM Client status reporting, use a registry editor to navigate to **HKLM\\Software\\Policies\\FVE\\MDOPBitLockerManagement**, change the values for **ClientWakeupFrequency** and **StatusReportingFrequency** to **1** as the minimum client supported value, and then restart BitLocker Management Client Service. When you make this change, the MBAM Client will report every minute. You can set values this low only when you do so manually in the registry. - -### Modify the Startup Delay on MBAM Client Service - -In addition to the MBAM Client wakeup and status reporting frequencies, there is a random delay of up to 90 minutes when the MBAM Client agent service starts on client computers. If you do not want the random delay, create a **DWORD** value of **NoStartupDelay** under **HKLM\\Software\\Microsoft\\MBAM**, set its value to **1**, and then restart BitLocker Management Client Service. - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/getting-started-with-mbam-10.md b/mdop/mbam-v1/getting-started-with-mbam-10.md deleted file mode 100644 index 7d1f4c4060..0000000000 --- a/mdop/mbam-v1/getting-started-with-mbam-10.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Getting Started with MBAM 1.0 -description: Getting Started with MBAM 1.0 -author: dansimp -ms.assetid: 4fab4e4a-d25e-4661-b235-2b45bf5ac3e4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - -# Getting Started with MBAM 1.0 - -> **IMPORTANT** -> MBAM 1.0 will reach end of support on September 14, 2021. -> See our [lifecycle page](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%201.0) for more information. We recommend [migrating to MBAM 2.5](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions) or another supported version of MBAM, or migrating your BitLocker management to [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager). - - -Microsoft BitLocker Administration and Monitoring (MBAM) requires thorough planning before you deploy it or use its features. Because this product can affect every computer in your organization, you might disrupt your entire network if you do not plan your deployment carefully. However, if you plan your deployment carefully and manage it so that it meets your business needs, MBAM can help reduce your administrative overhead and total cost of ownership. - -If you are new to this product, we recommend that you read the documentation thoroughly. Before you deploy it to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -**Note**   -You can find a downloadable version of this documentation and the MBAM Evaluation Guide at . - - - -This section of the MBAM Administrator’s Guide includes high-level information about MBAM to provide you with a basic understanding of the product before you begin the deployment planning. Additional MBAM documentation can be found on the MBAM Documentation Resources Download page at . - -## Getting started with MBAM 1.0 - - -- [About MBAM 1.0](about-mbam-10.md) - - Provides a high-level overview of MBAM and how it can be used in your organization. - -- [Evaluating MBAM 1.0](evaluating-mbam-10.md) - - Provides information about how you can best evaluate MBAM for use in your organization. - -- [High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md) - - Provides a description of the MBAM features and how they work together. - -- [Accessibility for MBAM 1.0](accessibility-for-mbam-10.md) - - Provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Other resources for this product - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -- [Deploying MBAM 1.0](deploying-mbam-10.md) - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/high-availability-for-mbam-10.md b/mdop/mbam-v1/high-availability-for-mbam-10.md deleted file mode 100644 index 90c23329c3..0000000000 --- a/mdop/mbam-v1/high-availability-for-mbam-10.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: High Availability for MBAM 1.0 -description: High Availability for MBAM 1.0 -author: dansimp -ms.assetid: 5869ecf8-1056-4c32-aecb-838a37e05d39 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# High Availability for MBAM 1.0 - - -This topic describes how to configure a highly available installation of Microsoft BitLocker Administration and Monitoring (MBAM). - -## High Availability Scenarios for MBAM - - -Microsoft BitLocker Administration and Monitoring (MBAM) is designed to be fault-tolerant. If a server becomes unavailable, the users should not be negatively affected. For example, if the MBAM agent cannot connect to the MBAM web server, users should not be prompted for action. - -When you plan your MBAM installation, consider the following concerns that can affect the availability of the MBAM service: - -- Drive encryption and recovery password – If a recovery password cannot be escrowed, the encryption will not start on the client computer. - -- Compliance status data upload – If the server that hosts the compliance status report service is not available, the compliance data will not remain current. - -- Help Desk recovery key access - If the Help Desk cannot access MBAM database information, they will be unable to provide recovery keys to users. - -- Availability of reports – Reports will not be available if the server that hosts the Compliance and Audit Reports is not available. - -The main concern for MBAM high availability is BitLocker key recovery availability. If the help desk cannot provide recovery keys, users who are locked out cannot unlock their computers. To avoid this problem, consider implementing redundant web servers and databases to ensure high availability. - -For more information about MBAM scalability and high availability, see the [MBAM Scalability White Paper](https://go.microsoft.com/fwlink/p/?LinkId=229025) (https://go.microsoft.com/fwlink/p/?LinkId=229025). - -For general guidance on high availability for Microsoft SQL Server, see [High Availability](https://go.microsoft.com/fwlink/p/?LinkId=221504) (https://go.microsoft.com/fwlink/p/?LinkId=221504). - -For general guidance on availability and scalability for web servers, see [Availability and Scalability](https://go.microsoft.com/fwlink/p/?LinkId=221503) (https://go.microsoft.com/fwlink/p/?LinkId=221503). - -## Related topics - - -[Maintaining MBAM 1.0](maintaining-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/high-level-architecture-for-mbam-10.md b/mdop/mbam-v1/high-level-architecture-for-mbam-10.md deleted file mode 100644 index 4b98af6d48..0000000000 --- a/mdop/mbam-v1/high-level-architecture-for-mbam-10.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: High Level Architecture for MBAM 1.0 -description: High Level Architecture for MBAM 1.0 -author: dansimp -ms.assetid: b1349196-88ed-4d6c-8a1d-998f18127b6b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# High Level Architecture for MBAM 1.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) is a client/server data encryption solution that can help you simplify BitLocker provisioning and deployment, improve BitLocker compliance and reporting, and reduce support costs. MBAM includes the features that are described in this topic. - -Additionally, there is a video that provides an overview of the MBAM architecture and MBAM Setup. For more information, see [MBAM Deployment and Architecture Overview](https://go.microsoft.com/fwlink/p/?LinkId=258392). - -## Architecture Overview - - -The following diagram displays the MBAM architecture. The single-server MBAM deployment topology is shown to introduce the MBAM features. However, this MBAM deployment topology is recommended only for lab environments. - -**Note**   -At least a three-computer MBAM deployment topology is recommended for a production deployment. For more information about MBAM deployment topologies, see [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md). - - - -![mbam single server deployment topology](images/mbam-1-server.jpg) - -1. **Administration and Monitoring Server**. The MBAM Administration and Monitoring Server is installed on a Windows server and hosts the MBAM Administration and Management website and the monitoring web services. The MBAM Administration and Management website is used to determine enterprise compliance status, to audit activity, to manage hardware capability, and to access recovery data, such as the BitLocker recovery keys. The Administration and Monitoring Server connects to the following databases and services: - - - Recovery and Hardware Database. The Recovery and Hardware database is installed on a Windows-based server and supported SQL Server instance. This database stores recovery data and hardware information that is collected from MBAM client computers. - - - Compliance and Audit Database. The Compliance and Audit Database is installed on a Windows server and supported SQL Server instance. This database stores compliance data for MBAM client computers. This data is used primarily for reports that are hosted by SQL Server Reporting Services (SSRS). - - - Compliance and Audit Reports. The Compliance and Audit Reports are installed on a Windows-based server and supported SQL Server instance that has the SSRS feature installed. These reports provide Microsoft BitLocker Administration and Monitoring reports. These reports can be accessed from the MBAM Administration and Management website or directly from the SSRS Server. - -2. **MBAM Client**. The Microsoft BitLocker Administration and Monitoring Client performs the following tasks: - - - Uses Group Policy to enforce the BitLocker encryption of client computers in the enterprise. - - - Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives. - - - Collects recovery information and hardware information about the client computers. - - - Collects compliance data for the computer and passes the data to the reporting system. - -3. **Policy Template**. The MBAM Group Policy template is installed on a supported Windows-based server or client computer. This template is used to specify the MBAM implementation settings for BitLocker drive encryption. - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md b/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md deleted file mode 100644 index aa02943b12..0000000000 --- a/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: How to Configure Network Load Balancing for MBAM -description: How to Configure Network Load Balancing for MBAM -author: dansimp -ms.assetid: df2208c3-352b-4a48-9722-237b0c8cd6a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure Network Load Balancing for MBAM - - -To verify that you have met the prerequisites and hardware and software requirements to install the Administration and Monitoring Server feature, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - -**Note**   -To obtain the setup log files, you must install Microsoft BitLocker Administration and Monitoring (MBAM) by using the **msiexec** package and the **/l** <location> option. The Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder of the user who installs MBAM. - - - -The Network Load Balancing (NLB) clusters for the Administration and Monitoring Server feature provides scalability in MBAM and it should support more than 55,000 MBAM client computers. - -**Note**   -Windows Server Network Load Balancing distributes client requests across a set of servers that are configured into a single server cluster. When Network Load Balancing is installed on each of the servers (hosts) in a cluster, the cluster presents a virtual IP address or fully qualified domain name (FQDN) to client requests. The initial client requests go to all the hosts in the cluster, but only one host accepts and handles the request. - -All computers that will be part of a NLB cluster have the following requirements: - -- All computers in the NLB cluster must be in the same domain. - -- Each computer in the NLB cluster must use a static IP address. - -- Each computer in the NLB cluster must have Network Load Balancing enabled. - -- The NLB cluster requires a static IP address, and a host record must be manually created in the domain name system (DNS). - - - -## Configuring Network Load Balancing for MBAM Administration and Monitoring Servers - - -The following steps describe how to configure an NLB cluster virtual name and IP address for two MBAM Administration and Monitoring servers, and how to configure MBAM Clients to use the NLB Cluster. - -Before you begin the procedures described in this topic, you must have the MBAM Administration and Monitoring Server feature successfully installed by using the same IIS port binding on two separate server computers that meet the prerequisites for both MBAM Server feature installation and NLB Cluster configuration. - -**Note**   -This topic describes the basic process of using Network Load Balancing Manager to create an NLB Cluster. The exact steps to configure a Windows Server as part of an NLB cluster depend on the Windows Server version in use.. For more information about how to create NLBs on Windows Server 2008, see [Creating Network Load Balancing Clusters](https://go.microsoft.com/fwlink/?LinkId=197176) in the Windows Server 2008 TechNet library. - - - -**To configure an NLB Cluster Virtual Name and IP address for two MBAM Administration and Monitoring Servers** - -1. Click **Start**, click **All Programs**, click **Administrative Tools**, and then click **Network Load Balancing Manager**. - - **Note**   - If the NLB Manager is not present, you can install it as a Windows Server feature. You must install this feature on both MBAM Administration and Monitoring servers if you want to configure it into the NLB cluster. - - - -2. On the menu bar, click **Cluster**, and then click **New** to open the **Cluster Parameters** dialog box. - -3. In the **Cluster Parameters** dialog box, enter the information for the NLB cluster IP configuration: - - - **IP address:** NLB cluster IP address registered in DNS - - - **Subnet mask:** NLB cluster IP address subnet mask registered in DNS - - - **Full Internet name:** FQDN of NLB cluster name registered in DNS - -4. Ensure that **Unicast** is selected in **Cluster operation mode**, and then click **Next**. - -5. On the **Cluster IP Addresses** page, click **Next**. - -6. On the **Port Rules** page, click **Edit** to define the ports that the NLB cluster will respond to and configure the ports that are used for client-to-site system communication as they are defined for the site, or click **Next** to enable the NLB cluster IP address to respond to all TCP/IP ports. - - **Note**   - Ensure that **Affinity** is set to **Single**. - - - -7. On the **Connect** page, enter an MBAM Administration and Monitoring server instance host name that will be part of the NLB cluster in **Host**, and then click **Connect**. - -8. In **Interfaces available for configuring a new cluster**, select the networking interface that will be configured to respond to NLB cluster communication, and then click **Next**. - -9. On the **Host Parameters** page, review the information displayed to ensure that the **Dedicated IP configuration** settings display the dedicated host IP configuration for the correct NLB cluster host, check that the Initial host state **Default state:** is **Started**, and then click **Finish**. - - **Note**   - The **Host Parameters** page also displays the NLB cluster host priority, which is 1 through 32. As new hosts are added to the NLB cluster, the host priority must differ from the previously added hosts. The priority is automatically incremented when you use the Network Load Balancing Manager. - - - -10. Click **<NLB cluster name>** and ensure that the NLB host interface **Status** displays **Converged** before you continue. This step might require that you refresh the NLB cluster display as the host TCP/IP configuration that is being modified by the NLB Manager. - -11. To add additional hosts to the NLB cluster, right-click **<NLB cluster name>**, click **Add Host to Cluster,** and then repeat steps 7 through 10 for each site system that will be part of the NLB cluster. - -12. On a computer that has MBAM Group Policy template installed, modify the MBAM Group Policy settings to configure the MBAM services endpoints to use the NLB Cluster name and the appropriate IIS port binding to access the MBAM Administration and Monitoring Server features that are installed on the NLB Cluster computers. For more information about how to edit MBAM GPO settings, see [How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md). If the MBAM Administration and Monitoring servers are new to your environment, ensure that the required local security group memberships have been properly configured. For more information about security group requirements, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md). - -13. When the NLB Cluster configuration is complete, we recommend that you validate that the MBAM Administration and Monitoring NLB Cluster is functional. To do this, open a web browser on a computer other than the servers that are configured in the NLB, and ensure that you can access the MBAM Administration and Monitoring web site by using the NLB FQDN. - -## Related topics - - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md b/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md deleted file mode 100644 index 0653f76736..0000000000 --- a/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: How to Deploy the MBAM Client as Part of a Windows Deployment -description: How to Deploy the MBAM Client as Part of a Windows Deployment -author: dansimp -ms.assetid: 8704bf33-535d-41da-b9b2-45b60754367e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client as Part of a Windows Deployment - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker Client can be integrated into an organization by enabling BitLocker management and encryption on client computers during the computer imaging and Windows deployment process. - -**Note** -To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -Encryption of client computers with BitLocker during the initial imaging stage of a Windows deployment can lower the administrative overhead for MBAM implementation. This approach also ensures that every computer that is deployed already has BitLocker running and is configured correctly. - -**Warning** -This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk. - - - -**To encrypt a computer as part of Windows deployment** - -1. If your organization plans to use the Trusted Platform Module (TPM) protector or the TPM + PIN protector options in BitLocker, you must activate the TPM chip before the initial deployment of MBAM. When you activate the TPM chip, you avoid a reboot later in the process, and you ensure that the TPM chips are correctly configured according to the requirements of your organization. You must activate the TPM chip manually in the computer's BIOS. Refer to the manufacturer documentation for more details about how to configure the TPM chip. - -2. Install the MBAM client agent. - -3. We recommend that you join the computer to a domain... - - - If the computer is not joined to a domain, the recovery password is not stored in the MBAM Key Recovery service. By default, MBAM does not allow encryption to occur unless the recovery key can be stored. - - - If a computer starts in recovery mode before the recovery key is stored on the MBAM server, the computer has to be reimaged. No recovery method is available. - -4. Open a command prompt as an administrator, stop the MBAM service, and then set the service to **manual** or **on demand**. Then, run the following commands: - - **net stop mbamagent** - - **sc config mbamagent start= demand** - -5. Set the registry settings for the MBAM agent to ignore Group Policy and run the TPM for **operating system only encryption** To do this, run **regedit**, and then import the registry key template from C:\\Program Files\\Microsoft\\MDOP MBAM\\MBAMDeploymentKeyTemplate.reg. - -6. In regedit, go to HKLM\\SOFTWARE\\Microsoft\\MBAM and configure the settings that are listed in the following table. - - Registry entry - - Configuration settings - - DeploymentTime - - 0 = OFF - - 1 = Use deployment time policy settings (default) - - UseKeyRecoveryService - - 0 = Do not use key escrow (The next two registry entries are not required in this case.) - - 1 = Use key escrow in Key Recovery system (default) - - Recommended: The computer must be able to communicate with the Key Recovery service. Verify that the computer can communicate with the service before you proceed. - - KeyRecoveryOptions - - 0 = Upload Recovery Key Only - - 1 = Upload Recovery Key and Key Recovery Package (default) - - KeyRecoveryServiceEndPoint - - Set this value to the URL for the Key Recovery web server. - - Example: http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc. - - - -~~~ -**Note** -MBAM policy or registry values can be set here to override the previously set values. -~~~ - - - -7. The MBAM agent restarts the system during MBAM client deployment. When you are ready for this reboot, run the following command at a command prompt as an administrator: - - **net start mbamagent** - -8. When the computers restarts and the BIOS prompts you to accept a TPM change, accept the change. - -9. During the Windows client operating system imaging process, when you are ready to start encryption, restart the MBAM agent service. Then, to set start to **automatic**, open a command prompt as an administrator and run the following commands: - - **sc config mbamagent start= auto** - - **net start mbamagent** - -10. Remove the bypass registry values. To do this, run regedit, browse to the HKLM\\SOFTWARE\\Microsoft registry entry, right-click the **MBAM** node, and then click **Delete**. - -## Related topics - - -[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md b/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md deleted file mode 100644 index be6480250c..0000000000 --- a/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: How to Deploy the MBAM Client to Desktop or Laptop Computers -description: How to Deploy the MBAM Client to Desktop or Laptop Computers -author: dansimp -ms.assetid: f32927a2-4c05-4da8-acca-1108d1dfdb7e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client to Desktop or Laptop Computers - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The MBAM Client can be integrated into an organization by deploying the client through tools, such as Active Directory Domain Services or an enterprise software deployment tool such as Microsoft System Center 2012 Configuration Manager. - -**Note**   -To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -**To deploy the MBAM Client to desktop or laptop computers** - -1. Locate the MBAM Client installation files that are provided with the MBAM software. - -2. Deploy the Windows Installer package to target computers by using Active Directory Domain Services or an enterprise software deployment tool, such as Microsoft System Center 2012 Configuration Manager. - - **Note**   - You should not use Group Policy to deploy the Windows Installer package. - - - -3. Configure the distribution settings or Group Policy to run the MBAM Client installation file. After successful installation, the MBAM Client applies the Group Policy settings that are received from a domain controller to begin BitLocker encryption and management functions. For more information about MBAM Group Policy settings, see [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md). - - **Important**   - The MBAM Client will not start BitLocker encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed before BitLocker encryption will begin. - - - -## Related topics - - -[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md b/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md deleted file mode 100644 index 218739fbbf..0000000000 --- a/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Determine the BitLocker Encryption State of a Lost Computers -description: How to Determine the BitLocker Encryption State of a Lost Computers -author: dansimp -ms.assetid: 9440890a-9c63-463b-9113-f46071446388 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Determine the BitLocker Encryption State of a Lost Computers - - -Microsoft BitLocker Administration and Monitoring (MBAM) enables you to determine the last known BitLocker encryption status of computers that are lost or stolen. Use the following procedure to determine whether the volumes have been encrypted on computers that are no longer in your possession. - -**Determine a Computer's Last Known BitLocker Encryption state** - -1. Open the MBAM website. - - **Note**   - The default address for the MBAM website is http://*<computername>*. Use the fully qualified server name for faster browsing results. - - - -2. Select the **Report** node from the navigation pane, and then select the **Computer Compliance Report**. - -3. Use the filter fields in the right-side pane to narrow the search results, and then click **Search**. Results will be shown below your search query. - -4. Take the appropriate action as determined by your policy for lost devices. - - **Note**   - Device compliance is determined by the deployed BitLocker policies. You should verify these deployed policies when you are trying to determine the BitLocker encryption state of a device. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md b/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md deleted file mode 100644 index 96e8628560..0000000000 --- a/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Edit MBAM 1.0 GPO Settings -description: How to Edit MBAM 1.0 GPO Settings -author: dansimp -ms.assetid: 03d12fbc-4302-43fc-9b38-440607d778a1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit MBAM 1.0 GPO Settings - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you must first determine the Group Policies that you will use in your implementation of Microsoft BitLocker Administration and Monitoring. For more information about the various available policies, see [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md). After you have determined the policies that you are going to use, you then must modify one or more Group Policy Objects (GPO) that include the MBAM policy settings. - -The following steps describe how to configure the basic, recommended Group Policy object (GPO) settings to enable MBAM to manage BitLocker encryption for your organization’s client computers. - -**To edit the MBAM Client GPO settings** - -1. On a computer that has MBAM Group Policy template installed, make sure that MBAM services are enabled. - -2. Use the Group Policy Management Console (GPMC.msc) or the Advanced Group Policy Management (AGPM) MDOP product for these actions: Select **Computer configuration**, choose **Policies**, click **Administrative Templates**, select **Windows Components**, and then click **MDOP MBAM (BitLocker Management)**. - -3. Edit the Group Policy Object settings that are required to enable MBAM Client services on client computers. For each policy in the table that follows, select **Policy Group**, click the **Policy**, and then configure the **Setting**. - - Policy Group - - Policy - - Setting - - Client Management - - Configure MBAM Services - - Enabled. Set **MBAM Recovery and Hardware service endpoint** and **Select BitLocker recovery information to store**. - - Set **MBAM compliance service endpoint** and **Enter status report frequency in (minutes)**. - - Allow hardware compatibility checking - - Disabled. This policy is enabled by default, but is not needed for a basic MBAM implementation. - - Operating System Drive - - Operating system drive encryption settings - - Enabled. Set **Select protector for operating system drive**. This is required to save operating system drive data to the MBAM Key Recovery server. - - Removable Drive - - Control Use of BitLocker on removable drives - - Enabled. This is required if MBAM will save removable drive data to the MBAM Key Recovery server. - - Fixed Drive - - Control Use of BitLocker on fixed drives - - Enabled. This is required if MBAM will save fixed drive data to the MBAM Key Recovery server. - - Set **Choose how BitLocker-protected drives can be recovered** and **Allow data recovery agent**. - - - -~~~ -**Important** -Depending on the policies that your organization decides to deploy, you may have to configure additional policies. See [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) for Group Policy configuration details for all of the available MBAM GPO policy options. -~~~ - - - -## Related topics - - -[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md b/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md deleted file mode 100644 index 19ff56c01c..0000000000 --- a/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: How to Generate MBAM Reports -description: How to Generate MBAM Reports -author: dansimp -ms.assetid: cdf4ae76-040c-447c-8736-c9e57068d221 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Generate MBAM Reports - - -Microsoft BitLocker Administration and Monitoring (MBAM) generates various reports to monitor BitLocker encryption usage and compliance. This topic describes how to open the MBAM administration website and how to generate MBAM reports on enterprise compliance, individual computers, hardware compatibility, and key recovery activity. For more information about MBAM reports, see [Understanding MBAM Reports](understanding-mbam-reports-mbam-1.md). - -**Note**   -To run the reports, you must be a member of the **Report Users** role on the computers where you have installed the Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports. - - - -**To open the MBAM Administration website** - -1. Open a web browser and navigate to the MBAM website. The default URL for the website is *http://<computername>* of the Microsoft BitLocker Administration and Monitoring server. - - **Note**   - If the MBAM administration website was installed on a port other than port 80, you must specify that port number in the URL. For example, *http://<computername>:<port>*. If you specified a Host Name for the MBAM administration website during the installation, the URL would be *http://<hostname>*. - - - -2. In the navigation pane, click **Reports**. In the main pane, click the tab for your report type: **Enterprise Compliance Report**, **Computer Compliance Report**, **Hardware Audit Report**, or **Recovery Audit Report**. - - **Note**   - Historical MBAM Client data is retained in the compliance database. This retained data may be needed in case a computer is lost or stolen. When running enterprise reports, you should use appropriate start and end dates to scope the time frames for the reports from one to two weeks to increase the reporting data accuracy. - - - -**To generate an enterprise Compliance Report** - -1. On the MBAM administration website, click **Reports** in the navigation pane, then click the **Enterprise Compliance Report** tab and select the appropriate filters for your report. For the Enterprise Compliance Report, you can set the following filters. - - - **Compliance Status**. Use this filter to specify the compliance status types (for example, Compliant or Noncompliant) to include in the report. - - - **Error State**. Use this filter to specify the Error State types, such as No Error or Error, to include in the report. - -2. Click **View Report** to display the specified report. - - The report results can be saved in any of several available file formats such as HTML, Microsoft Word, and Microsoft Excel. - - **Note**   - The Enterprise Compliance report is generated by a SQL job that runs every six hours. Therefore, the first time you try to view the report you may find that some data is missing. - - - -3. To view information about a computer in the Computer Compliance Report, select the computer name. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - -**To generate the Computer Compliance Report** - -1. In the MBAM administration website, select the **Report** node in the navigation pane, and then select the **Computer Compliance Report**. Use the Computer Compliance report to search for **user name** or **computer name**. - -2. Click **View Report** to view the computer report. - - Results can be saved in any of several available file formats such as HTML, Microsoft Word, and Microsoft Excel. - -3. To display more information about a computer in the Computer Compliance Report, select the computer name. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - - **Note**   - An MBAM Client computer is considered compliant if the computer matches the requirements of the MBAM policy settings or the computer’s hardware model is set to incompatible. Therefore, when you are viewing detailed information about the disk volumes associated with the computer, computers that are exempt from BitLocker encryption due to hardware compatibility can be displayed as compliant even though their drive volume encryption status is displayed as noncompliant. - - - -**To generate the Hardware Compatibility Audit Report** - -1. From the MBAM administration website, select the **Report** node from the navigation pane, and then select the **Hardware Audit Report**. Select the appropriate filters for your Hardware Audit report. The Hardware Audit report offers the following available filters: - - - **User (Domain\\User)**. Specifies the name of the user who made a change. - - - **Change Type**. Specifies the type of changes you are looking for. - - - **Start Date**. Specifies the Start Date part of the date range that you want to report on. - - - **End Date**. Specifies the End Date part of the date range that you want to report on. - -2. Click **View Report** to view the report. - - Results can be saved in several available file formats such as HTML, Microsoft Word, and Microsoft Excel. - -**To generate the Recovery Key Audit Report** - -1. From the MBAM administration website, select the **Report** node in the navigation pane, and then select the **Recovery Audit Report**. Select the filters for your Recovery Key Audit report. The available filters for Recovery Key audits are as follows: - - - **Requestor**. Specifies the user name of the requestor. The requestor is the person in the help desk who accessed the key on behalf of a user. - - - **Requestee**. Specifies the user name of the requestee. The requestee is the person who called the help desk to obtain a recovery key. - - - **Request Result** Specifies the request result types, such as: Success or Failed. For example, you may want to view failed key access attempts. - - - **Key Type**. Specifies the Key Type, such as: Recovery Key Password or TPM Password Hash. - - - **Start Date**. Specifies the Start Date part of the date range. - - - **End Date**. Specifies the End Date part of the date range. - -2. Click **View Report** to display the report. - - Results can be saved in several available file formats such as HTML, Microsoft Word, and Microsoft Excel. - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md b/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md deleted file mode 100644 index 4eab4444f5..0000000000 --- a/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Hide Default BitLocker Encryption in The Windows Control Panel -description: How to Hide Default BitLocker Encryption in The Windows Control Panel -author: dansimp -ms.assetid: c8503743-220c-497c-9785-e2feeca484d6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Hide Default BitLocker Encryption in The Windows Control Panel - - -Microsoft BitLocker Administration and Monitoring (MBAM) offers a customized control panel for MBAM client computers that is named called BitLocker Encryption Options. This customized control panel can replace the default Windows BitLocker control panel that is named BitLocker Drive Encryption. The BitLocker Encryption Options control panel, located under System and Security in the Windows control panel, enables users to manage their PIN and passwords, unlock drives, and hides the interface that allows administrators to decrypt a drive or to suspend or resume BitLocker encryption. - -**To hide default BitLocker Encryption in the Windows Control Panel** - -1. Browse to **User configuration** by using the Group Policy Management Console (GPMC), the Advanced Group Policy Management (AGPM), or the Local Group Policy Editor on the BitLocker Group Policies computer. - -2. Click **Policies**, select **Administrative Templates**, and then click **Control Panel**. - -3. In the **Details** pane, double-click **Hide specified Control Panel items**, and then select **Enabled**. - -4. Click **Show**, **click Add…**, and then type Microsoft.BitLockerDriveEncryption. This policy hides the default Windows BitLocker Management tool from the Windows Control Panel and allows the user to open the updated MBAM BitLocker Encryption Options tool from the Windows Control Panel. - -## Related topics - - -[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md deleted file mode 100644 index b4654bbd91..0000000000 --- a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md +++ /dev/null @@ -1,184 +0,0 @@ ---- -title: How to Install and Configure MBAM on a Single Server -description: How to Install and Configure MBAM on a Single Server -author: dansimp -ms.assetid: 55841c63-bad9-44e7-b7fd-ea7037febbd7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure MBAM on a Single Server - - -The procedures in this topic describe the full installation of the Microsoft BitLocker Administration and Monitoring (MBAM) features on a single server. - -Each server feature has certain prerequisites. To verify that you have met the prerequisites and the hardware and software requirements, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). In addition, some features also have information that must be provided during the installation process to successfully deploy the feature. You should also review [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) before you begin the MBAM deployment. - -**Note**   -To obtain the setup log files, you must install MBAM by using the **msiexec** package and the **/l** <location> option. Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder of the user who is installing MBAM. - - - -## To install MBAM Server features on a single server - - -The following steps describe how to install general MBAM features. - -**Note**   -Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers. - - - -**To start MBAM Server features installation** - -1. Start the MBAM installation wizard. Click **Install** at the Welcome page. - -2. Read and accept the Microsoft Software License Terms, and then click **Next** to continue the installation. - -3. By default, all MBAM features are selected for installation. Features that will be installed on the same computer must be installed together at the same time. Clear the features that you want to install elsewhere. You must install the MBAM features in the following order: - - - Recovery and Hardware Database - - - Compliance and Audit Database - - - Compliance Audit and Reports - - - Administration and Monitoring Server - - - MBAM Group Policy Template - - **Note**   - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you must resolve the missing prerequisites, and then click **Check prerequisites again**. After all prerequisites are met, the installation resumes. - - - -4. You are prompted to configure the network communication security. MBAM can encrypt the communication between the Recovery and Hardware Database, the Administration and Monitoring Server, and the clients. If you decide to encrypt the communication, you are asked to select the authority-provisioned certificate that will be used for encryption. - -5. Click **Next** to continue. - -6. The MBAM Setup wizard will display the installation pages for the selected features. - -**To deploy MBAM Server features** - -1. In the **Configure the Recovery and Hardware database** window, specify the instance of SQL Server and the name of the database that will store the recovery and hardware data. You must also specify both the database files location and the log information location. - -2. Click **Next** to continue. - -3. In the **Configure the Compliance and Audit database** window, specify the instance of the SQL Server and the name of the database that will store the compliance and audit data. Then, specify the database files location and the log information location. - -4. Click **Next** to continue. - -5. In the **Compliance and Audit Reports** window, specify the report service instance that will be used and provide a domain user account for accessing the database. This should be a user account that is provisioned specifically for this use. The user account should be able to access all data available to the MBAM Reports Users group. - -6. Click **Next** to continue. - -7. In the **Configure the Administration and Monitoring Server** window, enter the **Port Binding**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring server. - - **Warning**   - The port number that you specify must be an unused port number on the Administration and Monitoring server, unless a unique host header name is specified. - - - -8. Click **Next** to continue. - -9. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. The Microsoft Updates option does not turn on the Automatic Updates in Windows. - -10. When the Setup wizard has collected the necessary feature information, the MBAM installation is ready to start. Click **Back** to move back through the wizard if you want to review or change your installation settings. Click **Install** to begin the installation. Click **Cancel** to exit Setup. Setup installs the MBAM features and notifies you that the installation is completed. - -11. Click **Finish** to exit the wizard. - -12. After you install MBAM server features, you must add users to the MBAM roles. For more information, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md). - -**To perform post installation configuration** - -1. After Setup is finished, you must add user roles so that you can give users access to features in the MBAM administration website. On the Administration and Monitoring Server, add users to the following local groups: - - - **MBAM Hardware Users**: Members of this local group can access the Hardware feature in the MBAM administration website. - - - **MBAM Helpdesk Users**: Members of this local group can access the Drive Recovery and Manage TPM features in the MBAM administration website. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User. - - - **MBAM Advanced Helpdesk Users**: Members of this local group have advanced access to the Drive Recovery and Manage TPM features in the MBAM administration website. For Advanced Helpdesk Users, only the Key ID field is required in Drive Recovery. For Manage TPM users, only the Computer Domain field and Computer Name field are required. - -2. On the Administration and Monitoring Server, Compliance and Audit Database, and on the computer that hosts the Compliance and Audit Reports, add users to the following local group to enable them to access the Reports feature in the MBAM administration website: - - - **MBAM Report Users**: Members of this local group can access the Reports features in the MBAM administration website. - - **Note**   - Identical user membership or group membership of the **MBAM Report Users** local group must be maintained on all computers where the Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports are installed. - - To maintain identical memberships on all computers, you should create a domain security group and add that domain group to each local MBAM Report Users group. When you do this, you can manage the group memberships by using the domain group. - - - -## Validating the MBAM Server feature installation - - -When the MBAM installation is complete, validate that the installation has successfully set up all the necessary MBAM features that are required for BitLocker management. Use the following procedure to confirm that the MBAM service is functional: - -**To validate MBAM Server feature installation** - -1. On each server where an MBAM feature is deployed, open **Control Panel**. Click **Programs**, and then click **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To validate the installation, you must use a Domain Account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery and Hardware Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed. - -3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance and Audit Database** is installed. - -4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance is at http://<NameofMBAMReportsServer>/Reports. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances specified during setup. - - Confirm that a folder named **Malta Compliance Reports** is listed and that it contains five reports and one data source. - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>* - - - -5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**, select **Web Server (IIS)**, and click **Internet Information Services (IIS) Manager** - -6. In **Connections**, browse to *<computername>*, select **Sites**, and select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed. - -7. On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges, and then browse to the following locations in the MBAM website to verify that they load successfully: - - - *http://<computername>/default.aspx* and confirm each of the links for navigation and reports - - - *http://<computername>/MBAMAdministrationService/AdministrationService.svc* - - - *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc* - - - *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc* - - **Note** - Typically, the services are installed on the default port 80 without network encryption. If the services are installed on a different port, change the URLs to include the appropriate port. For example, http://*<computername>:<port>*/default.aspx or http://<hostheadername>/default.aspx. - - If the services are installed with network encryption, change http:// to https://. - - - -## Related topics - - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md deleted file mode 100644 index 5801740a1e..0000000000 --- a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md +++ /dev/null @@ -1,246 +0,0 @@ ---- -title: How to Install and Configure MBAM on Distributed Servers -description: How to Install and Configure MBAM on Distributed Servers -author: dansimp -ms.assetid: 9ee766aa-6339-422a-8d00-4f58e4646a5e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure MBAM on Distributed Servers - - -The procedures in this topic describe the full installation of the Microsoft BitLocker Administration and Monitoring (MBAM) features on distributed servers. - -Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). In addition, some features require that you provide certain information during the installation process to successfully deploy the feature. - -**Note** -To obtain the setup log files, you have to install MBAM by using the **msiexec** package and the **/l <location>** option. Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder of the user that runs the MBAM installation. - - - -## Deploy the MBAM Server features - - -The following steps describe how to install the general MBAM features. - -**Note** -Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers. - - - -**To Deploy MBAM Server features** - -1. Start the MBAM installation wizard, and click **Install** at the Welcome page. - -2. Read and accept the Microsoft Software License Terms, and then click **Next** to continue the installation. - -3. By default, all MBAM features are selected for installation. Clear the features that you want to install elsewhere. Features that you want to install on the same computer must be installed all at the same time. MBAM features must be installed in the following order: - - - Recovery and Hardware Database - - - Compliance and Audit Database - - - Compliance Audit and Reports - - - Administration and Monitoring Server - - - MBAM Group Policy Template - - **Note** - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation will resume. - - - -4. The MBAM Setup wizard will display the installation pages for the selected features. The following sections describe the installation procedures for each feature. - - **Note** - Typically, each feature is installed on a separate server. If you want to install multiple features on a single server, you may change or eliminate some of the following steps. - - - -~~~ -**To install the Recovery and Hardware Database** - -1. Choose an option for MBAM communication encryption. MBAM can encrypt the communication between the Recovery and Hardware Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that is used for encryption. - -2. Click **Next** to continue. - -3. Specify the names of the computers that will be running the Administration and Monitoring Server feature, to configure access to the Recovery and Hardware Database.. Once the Administration and Monitoring Server feature is deployed, it connects to the database by using its domain account. - -4. Click **Next** to continue. - -5. Specify the **Database Configuration** for the SQL Server instance that stores the recovery and hardware data. You must also specify where the database will be located and where the log information will be located. - -6. Click **Next** to continue with the MBAM Setup wizard. - -**To install the Compliance and Audit Database** - -1. Choose an option for the MBAM communication encryption. MBAM can encrypt the communication between the Compliance and Audit Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that will be used for encryption. - -2. Click **Next** to continue. - -3. Specify the user account that will be used to access the database for reports. - -4. Click **Next** to continue. - -5. Specify the computer names of the computers that you want to run the Administration and Monitoring Server and the Compliance and Audit Reports, to configure the access to the Compliance and Audit Database.. After the Administration and Monitoring and the Compliance and Audit Reports Server are deployed, they will connect to the databases by using their domain accounts. - -6. Specify the **Database Configuration** for the SQL Server instance that will store the compliance and audit data. You must also specify where the database will be located and where the log information will be located. - -7. Click **Next** to continue with the MBAM Setup wizard. - -**To install the Compliance and Audit Reports** - -1. Specify the remote SQL Server instance. For example, *<ServerName>*,where the Compliance and Audit Database are installed. - -2. Specify the name of the Compliance and Audit Database. By default, the database name is “MBAM Compliance Status”, but you can change the name when you install the Compliance and Audit Database. - -3. Click **Next** to continue. - -4. Select the SQL Server Reporting Services instance where the Compliance and Audit Reports will be installed. Provide the username and password used to access the compliance database. - -5. Click **Next** to continue with the MBAM Setup wizard. - -**To install the Administration and Monitoring Server feature** - -1. Choose an option for the MBAM communication encryption. MBAM can encrypt the communication between the Recovery and Hardware Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that is used for encryption. - -2. Click **Next** to continue. - -3. Specify the remote SQL Server instance, For example, *<ServerName>*, where the Compliance and Audit Database are installed. - -4. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, but, you can change the name when you install the Compliance and Audit Database. - -5. Click **Next** to continue. - -6. Specify the remote SQL Server instance. For example, *<ServerName>*,where the Recovery and Hardware Database are installed. - -7. Specify the name of the Recovery and Hardware Database. By default, the database name is **MBAM Recovery and Hardware**, but you can change the name when you install the Recovery and Hardware Database feature. - -8. Click **Next** to continue. - -9. Specify the URL for the “Home” of the SQL Server Reporting Services (SRS) site. The default Home location of a SQL Server Reporting Services site instance is at: - - http://*<NameofMBAMReportsServer>/*ReportServer - - **Note** - If you configured the SQL Server Reporting Services as a named instance, the URL resembles the following:http://*<NameofMBAMReportsServer>*/ReportServer\_*<SRSInstanceName>* - - - -10. Click **Next** to continue. - -11. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring server - - **Warning** - The port number that you specify must be an unused port number on the Administration and Monitoring server, unless you specify a unique host header name. - - - -12. Click **Next** to continue with the MBAM Setup wizard. -~~~ - -5. - - Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. - -6. When the selected MBAM feature information is complete, you are ready to start the MBAM installation by using the Setup wizard. Click **Back** to move through the wizard if you have to review or change your installation settings. Click **Install** to begin the installation. Click **Cancel** to exit the Wizard. Setup installs the MBAM features that you selected and notifies you that the installation is finished. - -7. Click **Finish** to exit the wizard. - -8. Add users to appropriate MBAM roles, after the MBAM server features are installed.. For more information, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md). - -**Post-installation configuration** - -1. After MBAM Setup is finished, you must add user Roles before users can access to features in the MBAM administration website. On the Administration and Monitoring Server, add users to the following local groups. - - - **MBAM Hardware Users**: Members of this local group can access the Hardware feature in the MBAM administration website. - - - **MBAM Helpdesk Users**: Members of this local group can access the Drive Recovery and Manage Trusted Platform Modules (TPM) features in the MBAM administration website. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User. - - - **MBAM Advanced Helpdesk Users**: Members of this local group have advanced access to the Drive Recovery and Manage TPM features in the MBAM administration website. For Advanced Helpdesk Users, only the Key ID field is required in Drive Recovery. In Manage TPM, only the Computer Domain field and Computer Name field are required. - -2. On the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports, add users to the following local group to give them access to the Reports feature in the MBAM administration website. - - - **MBAM Report Users**: Members of this local group can access the Reports in the MBAM administration website. - - **Note** - Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and the Compliance and Audit Reports are installed. - - - -## Validate the MBAM Server feature installation - - -When the MBAM Server feature installation is complete, you should validate that the installation has successfully set up all the necessary features for MBAM. Use the following procedure to confirm that the MBAM service is functional. - -**To validate an MBAM installation** - -1. On each server, where an MBAM feature is deployed, open **Control Panel**, click **Programs**, and then click **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To validate the MBAM installation, you must use a Domain Account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery and Hardware Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed. - -3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance Status** database is installed. - -4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance can be found at http://<NameofMBAMReportsServer>/Reports.aspx. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances specified during setup. - - Confirm that a folder named **Malta Compliance Reports** is listed and that it contains five reports and one data source. - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>* - - - -5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**, select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager**. In **Connections** browse to *<computername>*, click **Sites**, and click **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed. - -6. On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges and browse to the following locations in the MBAM web site, to verify that they load successfully: - - - *http://<computername>/default.aspx* and confirm each of the links for navigation and reports - - - *http://<computername>/MBAMAdministrationService/AdministrationService.svc* - - - *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc* - - - *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc* - - **Note** - Typically, services are installed on the default port 80 without network encryption. If the services are installed on a different port, change the URLs to include the appropriate port. For example, http://*<computername>:<port>*/default.aspx or http://<hostheadername>/default.aspx - - If the services were installed with network encryption, change http:// to https://. - - - -~~~ -Verify that each web page loads successfully. -~~~ - -## Related topics - - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md b/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md deleted file mode 100644 index 47f9d4d6f4..0000000000 --- a/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Install the MBAM 1.0 Group Policy Template -description: How to Install the MBAM 1.0 Group Policy Template -author: dansimp -ms.assetid: 451a50b0-939c-47ad-9248-a138deade550 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MBAM 1.0 Group Policy Template - - -In addition to the server-related features of Microsoft BitLocker Administration and Monitoring (MBAM), the server setup application includes an MBAM Group Policy template. You can install this template on any computer that is capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -The following steps describe how to install the MBAM Group Policy template. - -**Note**   -Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers. - - - -**To install the MBAM Group Policy template** - -1. Start the MBAM installation wizard; then, click **Install** on the Welcome page. - -2. Read and accept the Microsoft Software License Terms, and then click **Next** to continue the installation. - -3. By default, all MBAM features are selected for installation. Clear all feature options except for **Policy Template**, and then click **Next** to continue the installation. - - **Note**   - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you must resolve the missing prerequisite and then click **Check prerequisites again**. Once all prerequisites are met, the installation will resume. - - - -4. After the MBAM Setup wizard displays installation pages for the selected features, click **Finish** to close MBAM Setup. - -## Related topics - - -[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md deleted file mode 100644 index ae463cffe6..0000000000 --- a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Install the MBAM Language Update on a Single Server -description: How to Install the MBAM Language Update on a Single Server -author: dansimp -ms.assetid: e6fe59a3-a3e1-455c-a059-1f23ee083cf6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MBAM Language Update on a Single Server - - -Microsoft BitLocker Administration and Monitoring (MBAM) includes four server roles that can be run on one or more computers. However, only two MBAM Server features require the update to support installation of the MBAM 1.0 language release and the MBAM Policy Template. To update all three of the required MBAM features to be installed on one computer, perform the steps described in this topic. - -**To install the MBAM language update on a single server** - -1. Open the Internet Information Services (IIS) Management Console, go to **Sites**, and then shut down the Microsoft BitLocker Administration and Monitoring website. - -2. Edit the bindings for the MBAM website, and then temporarily modify the bindings of the site. For example, change the port from 443 to 9443. - -3. Locate and run the MBAM setup wizard (MBAMsetup.exe) and select the following three features: - - 1. Compliance and Audit Reports - - 2. Administration and Monitoring Server - - 3. Group Policy Templates - - **Important**   - The MBAM server features must be updated in the following order: Compliance and Audit Reports first, then Administration and Monitoring Server. The Group Policy templates can be updated at any time without concern for sequence. - - - -4. After you upgrade the server database, open the IIS Management Console and review the bindings of the Microsoft BitLocker Administration and Monitoring website. - -5. Delete one of the bindings and ensure that the remaining binding has the correct host name, certificate, and port number for the MBAM enterprise configuration. - -6. Restart the MBAM website. - -7. Test the MBAM website functionality: - - - Open the MBAM web interface and ensure you can fetch a recovery key for a client. - - - Enforce encryption of a new or manually decrypted client computer. - - **Note**   - The MBAM client opens only if it can communicate with the Recovery and Hardware database. - - - -## Related topics - - -[Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md deleted file mode 100644 index 8a88aa7e8a..0000000000 --- a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: How to Install the MBAM Language Update on Distributed Servers -description: How to Install the MBAM Language Update on Distributed Servers -author: dansimp -ms.assetid: 5ddc64c6-0417-4a04-843e-b5e18d9f1a52 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MBAM Language Update on Distributed Servers - - -Microsoft BitLocker Administration and Monitoring (MBAM) includes four server roles that can be run on one or more computers. However, only two MBAM Server features require the update to support the installation of the MBAM 1.0 language release and the MBAM Policy Template. In configurations with the MBAM Server features installed on multiple computers, only the following server features need to be updated: - -- The MBAM Compliance and Audit Reports - -- The MBAM Administration and Monitoring Server - -**Important**   -The MBAM server features must be updated in this order: Compliance and Audit Reports first, and then the Administration and Monitoring Server. The MBAM Group Policy templates can be updated at any time without concern for sequence. - - - -**To install the MBAM Language Update on the MBAM Compliance and Audit Report Server feature** - -1. On the computer running the MBAM Compliance and Audit Report feature, locate and run the MBAM Language Update setup wizard (MBAMsetup.exe). - -2. Complete the wizard for the Compliance and Audit Reports and then close the wizard. - -**To install the MBAM Language Update on the MBAM Administration and Monitoring Server feature** - -1. On the computer that is running the MBAM Administration and Monitoring feature, open the Internet Information Services (IIS) management console, go to **Sites**, and then shut down the Microsoft BitLocker Administration and Monitoring website. - -2. Choose to edit the bindings for the MBAM website, and then modify the bindings of the site. For example, change the port from 443 to 9443. - -3. Locate and run the MBAM Language Update setup wizard (MBAMsetup.exe). Complete the wizard for the Administration and Monitoring Server feature and then close the wizard. - -4. After you upgrade the server database, open IIS Management Console and review the bindings of the Microsoft BitLocker Administration and Monitoring website. - -5. Delete the old binding and ensure that the remaining binding has the correct host name, certificate, and port number for the MBAM enterprise configuration. - -6. Restart the MBAM web site. - -7. Test the MBAM web site functionality: - - - Open the MBAM web interface and ensure that you can obtain a recovery key for a client. - - - Enforce encryption of a new or manually decrypted client computer. - - **Note**   - The MBAM client opens only if it can communicate with the Recovery and Hardware database. - - - -## Related topics - - -[Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md b/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md deleted file mode 100644 index 15689e60c3..0000000000 --- a/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Manage Computer BitLocker Encryption Exemptions -description: How to Manage Computer BitLocker Encryption Exemptions -author: dansimp -ms.assetid: d4400a0d-b36b-4cf5-a294-1f53ec47f9ee -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Computer BitLocker Encryption Exemptions - - -Microsoft BitLocker Administration and Monitoring (MBAM) can be used to exempt certain computers from BitLocker protection. For example, an organization may decide to control BitLocker exemption on a computer-by-computer basis. - -To exempt a computer from BitLocker encryption, you must add the computer to a security group in Active Directory Domain Services in order to bypass any computer-based BitLocker protection rules. - -**Note**   -If the computer is already BitLocker-protected, the computer exemption policy has no effect. - - - -**To exempt a computer from BitLocker encryption** - -1. Add the computer account that you want to be exempted to a security group in Active Directory Domain Services. This allows you to bypass any computer-based BitLocker protection rules. - -2. Create a Group Policy Object by using the MBAM Group Policy template, then associate the Group Policy Object with the Active Directory group that you created in the previous step. For more information about creating the necessary Group Policy Objects, see [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md). - -3. When an exempted computer starts, the MBAM client checks the Computer Exemption Policy setting and suspends protection based on whether the computer is part of the BitLocker exemption security group. - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md b/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md deleted file mode 100644 index 0072ad71f7..0000000000 --- a/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: How to Manage Hardware Compatibility -description: How to Manage Hardware Compatibility -author: dansimp -ms.assetid: c74b96b9-8161-49bc-b5bb-4838734e7df5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage Hardware Compatibility - - -Microsoft BitLocker Administration and Monitoring (MBAM) can collect information about the manufacturer and model of client computers after you deploy the Allow Hardware Compatibility Checking Group Policy. If you configure this policy, the MBAM agent reports the computer make and model information to the MBAM Server when the MBAM Client is deployed on a client computer. - -The Hardware Compatibility feature is helpful when your organization has older computer hardware or computers that do not support Trusted Platform Module (TPM) chips. In these cases, you can use the Hardware Compatibility feature to ensure that BitLocker encryption is applied only to computer models that support it. If all computers in your organization will support BitLocker, you do not have to use the Hardware Compatibility feature. - -**Note**   -By default, MBAM Hardware Compatibility feature is not enabled. To enable it, select the **Hardware Compatibility** feature under the **Administration and Monitoring Server** feature during setup. For more information about how to set up and configure Hardware Compatibility, see [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md). - - - -The Hardware Compatibility feature works in the following way. - -**** - -1. The MBAM client agent discovers basic computer information such as manufacturer, model, BIOS maker, BIOS version, TPM maker, and TPM version, and then passes this information to the MBAM server. - -2. The MBAM server generates a list of client computer makes and models to enable you to differentiate between those that can or cannot support BitLocker - -3. The MBAM client agents that are deployed in the enterprise automatically update this list with all new computer makes and models that are discovered with a state of **Unknown**. An administrator can then use the MBAM administration website to change list entries to specify a particular computer make and model as **Compatible** or **Incompatible**. - -4. Before the MBAM client agent begins encrypting a drive, the agent first verifies the BitLocker encryption compatibility of the hardware it is running on. - - - If the hardware is marked as compatible, the BitLocker encryption process starts. MBAM will also recheck the hardware compatibility status of the computer one time per day. - - - If the hardware is marked as incompatible, the agent logs an event and passes a “hardware exempted” state as part of compliance reporting. The agent checks every seven days to see whether the state has changed to “compatible.” - - - If the hardware is marked as unknown, the BitLocker encryption process will not begin. The MBAM client agent will recheck the hardware compatibility status of the computer one time per day. - -**Warning**   -If the MBAM client agent tries to encrypt a computer that does not support BitLocker drive encryption, there is a possibility that the computer will become corrupted. Ensure that the hardware compatibility feature is correctly configured when your organization has older hardware that does not support BitLocker. - - - -**To manage hardware compatibility** - -1. Open a web browser and navigate to the Microsoft BitLocker Administration and Monitoring website. Select **Hardware** in the left menu bar. - -2. On the right pane, click **Advanced Search**, and then filter to display a list of all computer models that have a **Capability** status of **Unknown**. A list of computer models matching the search criteria is displayed. Administrators can add, edit, or remove new computer types from this page. - -3. Review each unknown hardware configuration to determine whether the configuration should be set to **Compatible** or **Incompatible**. - -4. Select one or more rows, and then click either **Set Compatible** or **Set Incompatible** to set the BitLocker compatibility, as appropriate, for the selected computer models. If set to **Compatible**, BitLocker tries to enforce drive encryption policy on computers that match the supported model. If set to **Incompatible**, BitLocker will not enforce drive encryption policy on those computers. - - **Note**   - After you set a computer model as compatible, it can take more than twenty-four hours for the MBAM Client to begin BitLocker encryption on the computers matching that hardware model. - - - -5. Administrators should regularly monitor the hardware compatibility list to review new models that are discovered by the MBAM agent, and then update their compatibility setting to **Compatible** or **Incompatible** as appropriate. - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md b/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md deleted file mode 100644 index 748fa21f52..0000000000 --- a/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Manage MBAM Administrator Roles -description: How to Manage MBAM Administrator Roles -author: dansimp -ms.assetid: c0f25a42-dbff-418d-a776-4fe23ee07d16 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage MBAM Administrator Roles - - -After Microsoft BitLocker Administration and Monitoring (MBAM) Setup is complete for all server features, administrative users must be granted access to these server features. As a best practice, administrators who will manage or use MBAM server features, should be assigned to Active Directory security groups and then those groups should be added to the appropriate MBAM administrative local group. - -**To manage MBAM Administrator Role memberships** - -1. Assign administrative users to security groups in Active Directory Domain Services. - -2. Add Active Directory Domain Services security groups to the roles for MBAM administrative local groups on the Microsoft BitLocker Administration and Monitoring server for the respective features. The user roles are as follows: - - - **MBAM System Administrators** have access to all Microsoft BitLocker Administration and Monitoring features in the MBAM administration website. - - - **MBAM Hardware Users** have access to the Hardware Compatibility features in the MBAM administration website. - - - **MBAM Helpdesk Users** have access to the Manage TPM and Drive Recovery options in the MBAM administration website, but must fill in all fields when they use either option. - - - **MBAM Report Users** have access to the Compliance and Audit reports in the MBAM administration website. - - - **MBAM Advanced Helpdesk Uses** have access to the Manage TPM and Drive Recovery options in the MBAM administration website. These users are not required to fill in all fields when they use either option. - - For more information about roles for Microsoft BitLocker Administration and Monitoring, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md). - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md b/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md deleted file mode 100644 index 0812e74168..0000000000 --- a/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -description: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -author: dansimp -ms.assetid: c08077e1-5529-468f-9370-c3b33fc258f3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel - - -A Microsoft BitLocker Administration and Monitoring (MBAM) control panel application, called BitLocker Encryption Options, will be available under **System and Security** when the MBAM Client is installed. This customized MBAM control panel replaces the default Windows BitLocker control panel. The MBAM control panel enables you to unlock encrypted drives (fixed and removable), and also helps you manage your PIN or password. For more information about enabling the MBAM control panel, see [How to Hide Default BitLocker Encryption in The Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md). - -**Note**   -For the BitLocker client, the Admin and Operational log files are located in Event Viewer, under **Application and Services Logs** / **Microsoft** / **Windows** / **BitLockerManagement**. - - - -**To use the MBAM Client Control Panel** - -1. To open BitLocker Encryption Options, click **Start**, and then select **Control Panel**. When **Control Panel** opens, select **System and Security**. - -2. Double-click **BitLocker Encryption Options** to open the customized MBAM control panel. You will see a list of all the hard disk drives on the computer and their encryption status. You will also see an option to manage your PIN or passwords. - -3. Use the list of hard disk drives on the computer to verify the encryption status, unlock a drive, or request an exemption for BitLocker protection if the User and Computer Exemption policies have been deployed. - -4. Non-administrators can use the BitLocker Encryption Options control panel to manage PINs or passwords. A user can select **Manage PIN,** and then enter both a current PIN and a new PIN. Users can also confirm their new PIN. The **Update PIN** function will reset the PIN to the new one that the user selects. - -5. To manage your password, select **Unlock drive** and enter your current password. As soon as the drive is unlocked, select **Reset Password** to change your current password. - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md b/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md deleted file mode 100644 index 9dee32aef0..0000000000 --- a/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Manage User BitLocker Encryption Exemptions -description: How to Manage User BitLocker Encryption Exemptions -author: dansimp -ms.assetid: 48d69721-504f-4524-8a04-b9ce213ac9b4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage User BitLocker Encryption Exemptions - - -Microsoft BitLocker Administration and Monitoring (MBAM) can be used to manage BitLocker protection by exempting users who do not need or want their drives encrypted. - -To exempt users from BitLocker protection, an organization must first create an infrastructure to support such exemptions. The supporting infrastructure might include a contact telephone number, webpage, or mailing address to request exemption. Also, any exempt user will have to be added to a security group for Group Policy created specifically for exempted users. When members of this security group log on to a computer, the user Group Policy shows that the user is exempted from BitLocker protection. The user policy overwrites the computer policy, and the computer will remain exempt from BitLocker encryption. - -**Note**   -If the computer is already BitLocker-protected, the user exemption policy has no effect. - - - -The following table shows how BitLocker protection is applied based on how exemptions are set. - - ----- - - - - - - - - - - - - - - - - - - - -
    User StatusComputer Not ExemptComputer Exempt

    User not exempt

    BitLocker protection is enforced on the computer.

    BitLocker protection is not enforced on the computer.

    User exempt

    BitLocker protection is not enforced on the computer.

    BitLocker protection is not enforced on the computer.

    - - - -**To exempt a user from BitLocker Encryption** - -1. Create an Active Directory Domain Services security group that will be used to manage user exemptions from BitLocker encryption. - -2. Create a Group Policy Object setting by using the MBAM Group Policy template. Associate the Group Policy Object with the Active Directory group that you created in the previous step. For more information about the necessary policy settings to enable users to request exemption from BitLocker encryption, see the Configure User Exemption Policy section in [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md). - -3. After creating a security group for BitLocker-exempted users, add to this group the names of the users who are requesting exemption. When a user logs on to a computer controlled by BitLocker, the MBAM client will check the User Exemption Policy setting and will suspend protection based on whether the user is part of the BitLocker exemption security group. - - **Note**   - Shared computer scenarios require special consideration regarding user exemption. If a non-exempt user logs on to a computer shared with an exempt user, the computer may be encrypted. - - - -**To enable users to request exemption from BitLocker Encryption** - -1. After you have configured user-exemption policies by usingwith the MBAM Policy template, a user can request exemption from BitLocker protection through the MBAM client. - -2. When a user logs on to a computer that is marked as **Compatible** in the MBAM Hardware Compatibility list, the system presents the user with a notification that the computer is going to be encrypted. The user can select **Request Exemption** and postpone the encryption by selecting **Later**, or select **Start** to accept the BitLocker encryption. - - **Note**   - Selecting **Request Exemption** will postpone the BitLocker protection until the maximum time set in the User Exemption Policy. - - - -3. When a user selects **Request Exemption**, the user is notified to contact the organization's BitLocker administration group. Depending on how the Configure User Exemption Policy is configured, users are provided with one or more of the following contact methods: - - - Phone Number - - - Webpage URL - - - Mailing Address - - After submittal of the request, the MBAM Administrator can decide if it is appropriate to add the user to the BitLocker Exemption Active Directory group. - - **Note**   - Once the postpone time limit from the User Exemption Policy has expired, users will not see the option to request exemption to the encryption policy. At this point, users must contact the MBAM administrator directly in order to receive exemption from BitLocker Protection. - - - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md deleted file mode 100644 index c691779c7b..0000000000 --- a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md +++ /dev/null @@ -1,698 +0,0 @@ ---- -title: How to Move MBAM 1.0 Features to Another Computer -description: How to Move MBAM 1.0 Features to Another Computer -author: dansimp -ms.assetid: e1907d92-6b42-4ba3-b0e4-60a9cc8285cc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move MBAM 1.0 Features to Another Computer - - -This topic describes the steps that you should take to move one or more Microsoft BitLocker Administration and Monitoring (MBAM) features to a different computer. When you move more than one MBAM feature to another computer, you should move them in the following order: - -1. Recovery and Hardware Database - -2. Compliance and Audit Database - -3. Compliance and Audit Reports - -4. Administration and Monitoring - -## To move the Recovery and Hardware Database - - -You can use the following procedure to move the MBAM Recovery and Hardware Database from one computer to another (you can move this MBAM Server feature from Server A to Server B): - -**** - -1. Stop all instances of the MBAM Administration and Monitoring web site. - -2. Run the MBAM Setup on Server B. - -3. Back up the MBAM Recovery and Hardware database on Server A. - -4. MBAM Recovery and Hardware database from Server A to B - -5. Restore the MBAM Recovery and Hardware database on Server B - -6. Configure the access to the MBAM Recovery and Hardware database on Server B - -7. Update the database connection data on MBAM Administration and Monitoring servers - -8. Resume all instances of the MBAM Administration and Monitoring web site - -**To stop all instances of the MBAM Administration and Monitoring website** - -1. Use the Internet Information Services (IIS) Manager console to stop the MBAM website on each of the servers that run the MBAM Administration and Monitoring feature. The MBAM website is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command at the command prompt that is similar to the following, by using Windows PowerShell: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To run this PowerShell command prompt, you must add the IIS Module for PowerShell to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable the execution of scripts. - - - -**To run MBAM setup on Server B** - -1. Run the MBAM setup on Server B and select the Recovery and Hardware Database for installation. - -2. To automate this procedure, you can use a command at the command prompt that is similar to the following, by using Windows PowerShell: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=KeyDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery and Hardware database will be moved. - - - $DOMAIN$\\$SERVERNAME$ - Enter the domain and server names of each MBAM Application and Monitoring Server that will contact the Recovery and Hardware database. If there are multiple domain and server names, use a semicolon to separate each one of them in the list. For example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$. Additionally, each server name must be followed by a **$**. For example, MyDomain\\MyServerName1$, MyDomain\\MyServerName2$. - - - -**To back up the Database on Server A** - -1. To back up the Recovery and Hardware database on Server A, use SQL Server Management Studio and the Task named **Back Up…**. By default, the database name is **MBAM Recovery and Hardware Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - Modify the MBAM Recovery and Hardware Database to use the full recovery mode. - - ```sql - USE master; - - GO - - ALTER DATABASE "MBAM Recovery and Hardware" - - SET RECOVERY FULL; - - GO - ``` - - Create MBAM Recovery and Hardware Database Data and MBAM Recovery logical backup devices. - - ```sql - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - - 'Z:\MBAM Recovery and Hardware Database Data.bak'; - - GO - ``` - - Back up the full MBAM Recovery and Hardware database. - - ```sql - BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - - GO - - BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - - TO FILE = 'Z:\SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - ENCRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - ``` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $PASSWORD$ - Enter a password that you will use to encrypt the Private Key file. - - - -3. Execute the SQL file by using SQL Server PowerShell and a command that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\BackupMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the value in the previous example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and the instance from which you back up the Recovery and Hardware database. - - - -**To move the Database and Certificate from Server A to B** - -1. Move the MBAM Recovery and Hardware database data.bak from Server A to Server B by using Windows Explorer. - -2. To move the certificate for the encrypted database, you will need to use the following automation steps. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - - `PS C:\> Copy-Item “Z:\MBAM Recovery and Hardware Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$` - - `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFile” \\$SERVERNAME$\$DESTINATIONSHARE$` - - `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFilePrivateKey” \\$SERVERNAME$\$DESTINATIONSHARE$` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$ - Enter the name of the server to which the files will be copied. - - - $DESTINATIONSHARE$ - Enter the name of the share and path to which the files will be copied. - - - -**To restore the Database on Server B** - -1. Restore the Recovery and Hardware database on Server B by using the SQL Server Management Studio and the Task named **Restore Database**. - -2. Once the task has been executed, choose the database backup file by selecting the **From Device** option, and then use the **Add** command to choose the MBAM Recovery and Hardware database **Data.bak** file. - -3. Select **OK** to complete the restoration process. - -4. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - ```sql - -- Restore MBAM Recovery and Hardware Database. - - USE master - - GO - ``` - - Drop the certificate created by MBAM Setup. - - ```sql - DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - - GO - ``` - - Add certificate - - ```sql - CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - - FROM FILE = 'Z: \SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - DECRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - ``` - - Restore the MBAM Recovery and Hardware database data and the log files. - - ```sql - RESTORE DATABASE [MBAM Recovery and Hardware] - - FROM DISK = 'Z:\MBAM Recovery and Hardware Database Data.bak' - - WITH REPLACE - ``` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $PASSWORD$ - Enter the password that you used to encrypt the Private Key file. - - - -5. Use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\RestoreMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the value from the receding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and the instance to which the Recovery and Hardware Database will be restored. - - - -**Configure the access to the Database on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager, to add the computer accounts from each server that runs the MBAM Administration and Monitoring feature to the Local Group named **MBAM Recovery and Hardware DB Access**. - -2. To automate this procedure, you can use Windows PowerShell on Server B to enter a command that is similar to the following: - - `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - **Note** - Replace the values from the preceding example with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain name and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**, for example, MyDomain\\MyServerName1$. - - - -~~~ -You must run the command for each Administration and Monitoring Server that will be accessing the database in your environment. -~~~ - -**To update the Database Connection data on MBAM Administration and Monitoring Servers** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following applications, which are hosted in the Microsoft BitLocker Administration and Monitoring website: - - - MBAM Administration Service - - - MBAM Recovery And Hardware Service - -2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**. - -3. Select the **configurationStrings** option from the Section list control. - -4. Choose the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, choose the row named **KeyRecoveryConnectionString** when you updated the configuration for the ‘MBAMAdministrationService’ application, or choose the row named Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString, when updating the configuration for the ‘MBAMRecoveryAndHardwareService’. - -6. Update the **Data Source=** value for the **configurationStrings** property to list the server name and the instance where the Recovery and Hardware Database was moved to. For example, $SERVERNAME$\\$SQLINSTANCENAME$. - -7. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell on each Administration and Monitoring Server: - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value “Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;”` - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;"` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery and Hardware database is. - - - -**To resume all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to Start the MBAM website, which is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - -## To move the Compliance Status Database feature - - -If you choose to move the MBAM Compliance Status Database feature from one computer to another, such as from Server A to Server B, you should use the following procedure: - -1. Stop all instances of the MBAM Administration and Monitoring website - -2. Run MBAM setup on Server B - -3. Backup the Database on Server A - -4. Move the Database from Server A to B - -5. Restore the Database on Server B - -6. Configure Access to the Database on Server B - -7. Update database connection data on MBAM Administration and Monitoring servers - -8. Resume all instances of the MBAM Administration and Monitoring website - -**To stop all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to Stop the MBAM website, which is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command that is similar to the following one,by using Windows PowerShell: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To execute this command, you must add the IIS Module for PowerShell to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable the execution of scripts. - - - -**To run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select the Compliance Status Database feature for installation. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal= ReportsDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$ COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNT=$DOMAIN$\$USERNAME$` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database will be moved to. - - - $DOMAIN$\\$SERVERNAME$ - Enter the domain names and server names of each MBAM Application and Monitoring Server that will contact the Compliance Status Database. If there are multiple domain names and server names, use a semicolon to separate each one of them in the list. For example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$. Each server name must be followed by a **$** as shown in the example. For example, MyDomain\\MyServerName1$, MyDomain\\MyServerName2$. - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit reports feature to connect to the Compliance Status Database. - - - -**To back up the Compliance Database on Server A** - -1. To back up the Compliance Database on Server A, use SQL Server Management Studio and the Task named **Back Up…**. By default, the database name is **MBAM Compliance Status Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Modify the MBAM Compliance Status Database to use the full recovery model. - - USE master; - - GO - - ALTER DATABASE "MBAM Compliance Status" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Compliance Status Data logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - - 'Z: \MBAM Compliance Status Database Data.bak'; - - GO - - -- Back up the full MBAM Recovery and Hardware database. - - BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - - GO - ``` - -3. Run the SQL file with a command that is similar to the following one, by using the SQL Server PowerShell: - - `PS C:\> Invoke-Sqlcmd -InputFile "Z:\BackupMBAMComplianceStatusDatabaseScript.sql" –ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and the instance from where the Compliance Status database will be backed up. - - - -**To move the Database from Server A to B** - -1. Move the following files from Server A to Server B, by using Windows Explorer: - - - MBAM Compliance Status Database Data.bak - -2. To automate this procedure, you can use a command that is similar to the following using Windows PowerShell: - - `PS C:\> Copy-Item “Z:\MBAM Compliance Status Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$ - Enter the server name where the files will be copied to. - - - $DESTINATIONSHARE$ - Enter the name of share and path where the files will be copied to. - - - -**To restore the Database on Server B** - -1. Restore the Compliance Status database on Server B by using SQL Server Management Studio and the Task named **Restore Database…**. - -2. Once the task is executed, select the database backup file, by selecting the From Device option, and then use the Add command to choose the MBAM Compliance Status Database Data.bak file. Click OK to complete the restoration process. - -3. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Create MBAM Compliance Status Database Data logical backup devices. - - Use master - - GO - - -- Restore the MBAM Compliance Status database data files. - - RESTORE DATABASE [MBAM Compliance Status Database] - - FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - - WITH REPLACE - ``` - -4. Run the SQL File with a command that is similar to the following one, by using the SQL Server PowerShell: - - `PS C:\> Invoke-Sqlcmd -InputFile "Z:\RestoreMBAMComplianceStatusDatabaseScript.sql" -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database will be restored to. - - - -**To configure the Access to the Database on Server B** - -1. On Server B use the Local user and Groups snap-in from Server Manager to add the machine accounts from each server that runs the MBAM Administration and Monitoring feature to the Local Group named **MBAM Compliance Status DB Access**. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell on Server B: - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$REPORTSUSERNAME$ /add` - - **Note** - Replace the value from the preceding example with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**.For example, MyDomain\\MyServerName1$. - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports - - - -~~~ -For each Administration and Monitoring Server that will access the database of your environment, you must run the command that will add the servers to the MBAM Compliance Auditing DB Access local group. -~~~ - -**To update the database connection data on MBAM Administration and Monitoring servers** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following Applications, which are hosted in the Microsoft BitLocker Administration and Monitoring website: - - - MBAMAdministrationService - - - MBAMComplianceStatusService - -2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**. - -3. Select the **configurationStrings** option from the Section list control. - -4. Select the row named **(Collection)**, and open the Collection Editor by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named **ComplianceStatusConnectionString**, when you update the configuration for the MBAMAdministrationService application, or the row named **Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString**, when you update the configuration for the MBAMComplianceStatusService. - -6. Update the **Data Source=** value for the **configurationStrings** property to list the server name and the instance name. For example, $SERVERNAME$\\$SQLINSTANCENAME, to which the Recovery and Hardware Database was moved. - -7. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following one on each Administration and Monitoring Server: - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="ComplianceStatusConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"` - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMComplianceStatusService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance name where the Recovery and Hardware Database is located. - - - -**To resume all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to start the MBAM web site named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - - **PS C:\\> Start-Website “Microsoft BitLocker Administration and Monitoring”** - -## To moving the Compliance and Audit Reports - - -If you choose to move the MBAM Compliance and Audit Reports from one computer to another (specifically, if you move feature from Server A to Server B), you should use the following procedure and steps: - -1. Run MBAM setup on Server B - -2. Configure Access to the Compliance and Audit Reports on Server B - -3. Stop all instances of the MBAM Administration and Monitoring website - -4. Update the reports connection data on MBAM Administration and Monitoring servers - -5. Resume all instances of the MBAM Administration and Monitoring website - -**To run MBAM setup on Server B** - -1. Run MBAM setup on Server B and only select the Compliance and Audit feature for installation. - -2. To automate this procedure, you can use a command that is similar to the following, by using Windows PowerShell: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=Reports COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNTPW=$PASSWORD$` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database is located. - - - $DOMAIN$\\$USERNAME$ - Enter the domain name and user name that will be used by the Compliance and Audit reports feature to connect to the Compliance Status Database. - - - $PASSWORD$ - Enter the password of the user account that will be used to connect to the Compliance Status Database. - - - -**To configure the access to the Compliance and Audit Reports on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager to add the user accounts that will have access to the Compliance and Audit Reports. Add the user accounts to the local group named “MBAM Report Users”. - -2. To automate this procedure, you can use a command that is similar to the following, by using Windows PowerShell on Server B. - - `PS C:\> net localgroup "MBAM Report Users" $DOMAIN$\$REPORTSUSERNAME$ /add` - - **Note** - Replace the following value from the preceding example with the applicable values for your environment: - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports - - - -~~~ -The command to add the users to the MBAM Report Users local group must be run for each user that will be accessing the reports in your environment. -~~~ - -**To stop all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers that run the MBAM Administration and Monitoring Feature use the Internet Information Services (IIS) Manager console to Stop the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - -**To update the Database Connection Data on MBAM Administration and Monitoring Servers** - -1. On each of the servers that run the MBAM Administration and Monitoring Feature, use the Internet Information Services (IIS) Manager console to update the Compliance Reports URL. - -2. Select the **Microsoft BitLocker Administration and Monitoring** website and use the **Configuration Editor** feature which can be found under the **Management** section of the **Feature View**. - -3. Select the **appSettings** option from the Section list control. - -4. From here, select the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named “Microsoft.Mbam.Reports.Url”. - -6. Update the value for Microsoft.Mbam.Reports.Url to reflect the server name for Server B. If the Compliance and Audit reports feature was installed on a named SQL Reporting Services instance, make sure that you add or update the name of the instance to the URL. For example, http://$SERVERNAME$/ReportServer\_$SQLSRSINSTANCENAME$/Pages.... - -7. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following one on each Administration and Monitoring Server: - - `PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring" -Name "Value" -Value “http://$SERVERNAME$/ReportServer_$SRSINSTANCENAME$/Pages/ReportViewer.aspx?/Malta+Compliance+Reports/”` - - **Note** - Replace the value from the preceding example with those that match your environment: - - - $SERVERNAME$ - Enter the name of the server to which the Compliance and Audit Reports were installed. - - - $SRSINSTANCENAME$ - Enter the name of the SQL Reporting Services instance to which the Compliance and Audit Reports were installed. - - - -**To resume all instances of the MBAM Administration and Monitoring website** - -1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to Start the MBAM web site named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To execute this command, the IIS Module for PowerShell must be added to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable execution of scripts. - - - -## To move the Administration and Monitoring feature - - -If you choose to move the MBAM Administration and Monitoring Reports feature from one computer to another, (if you move feature from Server A to Server B), you should use the following procedure. The process includes the following steps: - -1. Run MBAM setup on Server B - -2. Configure Access to the Database on Server B - -**To run MBAM setup on Server B** - -1. Run MBAM setup on Server B and only select the Administration feature for installation. - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=AdministrationMonitoringServer,HardwareCompatibility COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ SRS_REPORTSITEURL=$REPORTSSERVERURL$` - - **Note** - Replace the values from the preceding example with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - For the COMPLIDB\_SQLINSTANCE parameter, input the server name and instance where the Compliance Status Database is located. For the RECOVERYANDHWDB\_SQLINSTANCE parameter, input the server name and instance where the Recovery and Hardware Database is located. - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit reports feature to connect to the Compliance Status Database. - - - $ REPORTSSERVERURL$ - Enter the URL for the Home location of the SQL Reporting Service website. If the reports were installed to a default SRS instance the URL format will formatted “http:// $SERVERNAME$/ReportServer”. If the reports were installed to a default SRS instance, the URL format will be formatted to “http://$SERVERNAME$/ReportServer\_$SQLINSTANCENAME$”. - - - -**To configure the Access to the Databases** - -1. On server or servers where the Recovery and Hardware, and Compliance and Audit databases are deployed, use the Local user and Groups snap-in from Server Manager to add the machine accounts from each server that run the MBAM Administration and Monitoring feature to the Local Groups named “MBAM Recovery and Hardware DB Access” (Recovery and Hardware DB Server) and “MBAM Compliance Status DB Access” (Compliance and Audit DB Server). - -2. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell on the server where the Compliance and Audit databases were deployed. - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$REPORTSUSERNAME$ /add` - -3. On the server where the Recovery and Hardware databases were deployed, run a command that is similar to the following one, by using Windows PowerShell. - - `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - **Note** - Replace the value from the preceding example with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**. For example, MyDomain\\MyServerName1$) - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports. - - - -~~~ -The commands listed for adding the server computer accounts to the MBAM local groups must be run for each Administration and Monitoring Server that will be accessing the databases in your environment. -~~~ - -## Related topics - - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md deleted file mode 100644 index b0dee3080f..0000000000 --- a/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: How to Recover a Corrupted Drive -description: How to Recover a Corrupted Drive -author: dansimp -ms.assetid: 715491ae-69c0-4fae-ad3f-3bd19a0db2f2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Corrupted Drive - - -To recover a corrupted drive that has been protected by BitLocker, a Microsoft BitLocker Administration and Monitoring (MBAM) help desk user must create a recovery key package file. This package file can be copied to the computer that contains the corrupted drive and then used to recover the drive. To accomplish this, use the following procedure. - -**To Recover a Corrupted Drive** - -1. Open the MBAM administration website. - -2. Select **Drive Recovery** from the navigation pane. Enter the user’s domain name and user name, the reason for unlocking the drive, and the user’s recovery password ID. - - **Note**   - If you are a member of the Help Desk Administrators role, you do not have to enter the user’s domain name or user name. - - - -3. Click **Submit**. The recovery key will be displayed. - -4. Click **Save**, and then select **Recovery Key Package**. The recovery key package will be created on your computer. - -5. Copy the recovery key package to the computer that has the corrupted drive. - -6. Open an elevated command prompt. To do this, click **Start** and type `cmd` in the **Search programs and files** box. In the search results list, right-click **cmd.exe** and select **Run as Administrator**. - -7. At the command prompt, type the following: - - `repair-bde -kp -rp ` - - **Note**   - For the <fixed drive> in the command, specify an available storage device that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified fixed drive. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md deleted file mode 100644 index fe926539db..0000000000 --- a/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: How to Recover a Drive in Recovery Mode -description: How to Recover a Drive in Recovery Mode -author: dansimp -ms.assetid: 09d27e4b-57fa-47c7-a004-8b876a49f27e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Drive in Recovery Mode - - -Microsoft BitLocker Administration and Monitoring (MBAM) includes Encrypted Drive Recovery features. These features ensure the capture and storage of data and availability of tools that are required to access a BitLocker-protected volume when BitLocker puts that volume into recovery mode. A BitLocker-protected volume goes into recovery mode when a PIN or password is lost or forgotten, or when the Trusted Module Platform (TPM) chip detects a change to the computer's BIOS or startup files. - -Use this procedure to access the centralized Key Recovery data system that can provide a recovery password when a recovery password ID and associated user identifier are supplied. - -**Important**   -MBAM generates single-use recovery keys. Under this limitation, a recovery key can be used only once and then it is no longer valid. The single use of a recovery password is automatically applied to operating system drives and fixed drives. On removable drives, the single use is applied when the drive is removed and then re-inserted and unlocked on a computer that has the group policy settings activated to manage removable drives. - - - -**To recover a drive in Recovery Mode** - -1. Open the MBAM website. - -2. In the navigation pane, click **Drive Recovery**. The **Recover access to an encrypted drive** webpage opens. - -3. Enter the user's Windows Logon domain and user name and the first eight digits of the recovery key ID, to receive a list of possible matching recovery keys. Alternatively, enter the entire recovery key ID to receive the exact recovery key. Select one of the predefined options in the **Reason for Drive Unlock** drop-down list, and then click **Submit**. - - **Note**   - If you are an MBAM Advanced Helpdesk User, the user domain and user ID entries are not required. - - - -4. MBAM returns the following: - - 1. An error message if no matching recovery password is found - - 2. Multiple possible matches if the user has multiple matching recovery passwords - - 3. The recovery password and recovery package for the submitted user - - **Note**   - If you are recovering a damaged drive, the recovery package option provides BitLocker with the critical information necessary to attempt the recovery. - - - -5. After the recovery password and recovery package are retrieved, the recovery password is displayed. To copy the password, click **Copy Key**, and then paste the recovery password into an email or other text file for temporary storage. Or, to save the recovery password to a file, click **Save**. - -6. When the user types the recovery password into the system or uses the recovery package, the drive is unlocked. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md deleted file mode 100644 index 77052fa258..0000000000 --- a/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Recover a Moved Drive -description: How to Recover a Moved Drive -author: dansimp -ms.assetid: 0c7199d8-9463-4f44-9af3-b70eceeaff1d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Moved Drive - - -When you move an operating system drive that has been previously encrypted by using Microsoft BitLocker Administration and Monitoring (MBAM), you must resolve certain issues. After a PIN is attached to the new computer, the drive will not accept the start-up PIN that was used in previous computer. The system considers the PIN to be invalid because of the change to the Trusted Platform Module (TPM) chip. You must obtain a recovery key ID to retrieve the recovery password in order to use the moved drive. To do this, use the following procedure. - -**To recover a moved drive** - -1. On the computer that contains the moved drive, start in Windows Recovery Environment (WinRE) mode, or start the computer by using the Microsoft Diagnostics and Recovery Toolset (DaRT). - -2. Once the computer has been started with WinRE or DaRT, MBAM will treat the moved operating system drive as a data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password. - - **Note**   - In some cases, you might be able to click **I forget the PIN** during the startup process to enter the recovery mode. This also displays the recovery key ID. - - - -3. On the MBAM administration website, use the recovery key ID to retrieve the recovery password and unlock the drive. - -4. If the moved drive was configured to use a TPM chip on the original computer, you must take additional steps after you unlock the drive and complete the start process. In WinRE mode, open a command prompt and use the **manage-bde** tool to decrypt the drive. The use of this tool is the only way to remove the TPM-plus-PIN protection without the original TPM chip. - -5. After the removal is complete, start the system normally. The MBAM agent will proceed to enforce the policy to encrypt the drive with the new computer’s TPM plus PIN. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md b/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md deleted file mode 100644 index 0dd2c800ef..0000000000 --- a/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Reset a TPM Lockout -description: How to Reset a TPM Lockout -author: dansimp -ms.assetid: 91ec6666-1ae2-4e76-9459-ad65c405f639 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Reset a TPM Lockout - - -The Encrypted Drive Recovery feature of Microsoft BitLocker Administration and Monitoring (MBAM) encompasses both the capture and storage of data and the availability for tools that are required to manage the Trusted Platform Module (TPM). This topic covers how to access the centralized Key Recovery data system in the bit\_admmon\_tlanextref administration website. The Key Recovery data system can provide a TPM owner password file when the computer identity and the associated user identifier are supplied. - -A TPM lockout can occur if a user enters an incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM lockout is based on the computer manufacturer's specification. - -**To reset a TPM lockout** - -1. Open the MBAM administration website. - -2. In the navigation pane, select **Manage TPM**. This opens the **Manage TPM** page. - -3. Enter the fully qualified domain name (FQDN) for the computer and the computer name. Enter the user’s Windows Logon domain and the user’s user name. Select one of the predefined options in the **Reason for requesting TPM owner password file** drop-down menu. Click **Submit**. - -4. MBAM will return one of the following: - - - An error message if no matching TPM owner password file is found - - - The TPM owner password file for the submitted computer - - **Note**   - If you are an Advanced Helpdesk User, the user domain and user ID fields are not required. - - - -5. Upon retrieval, the owner password is displayed. To save this password to a .tpm file, click the **Save** button. - -6. The user will run the TPM management console and select the **Reset TPM lockout** option and provide the TPM owner password file to reset the TPM lockout. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - - - - - - - - diff --git a/mdop/mbam-v1/images/checklistbox.gif b/mdop/mbam-v1/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/mbam-v1/images/checklistbox.gif and /dev/null differ diff --git a/mdop/mbam-v1/images/mbam-1-server.jpg b/mdop/mbam-v1/images/mbam-1-server.jpg deleted file mode 100644 index f49d4978c9..0000000000 Binary files a/mdop/mbam-v1/images/mbam-1-server.jpg and /dev/null differ diff --git a/mdop/mbam-v1/images/mbam-3-server.jpg b/mdop/mbam-v1/images/mbam-3-server.jpg deleted file mode 100644 index ffd6420bda..0000000000 Binary files a/mdop/mbam-v1/images/mbam-3-server.jpg and /dev/null differ diff --git a/mdop/mbam-v1/images/mbam-4-computer.jpg b/mdop/mbam-v1/images/mbam-4-computer.jpg deleted file mode 100644 index 9b1aa2ab35..0000000000 Binary files a/mdop/mbam-v1/images/mbam-4-computer.jpg and /dev/null differ diff --git a/mdop/mbam-v1/images/mbam-5-computer.jpg b/mdop/mbam-v1/images/mbam-5-computer.jpg deleted file mode 100644 index cd7b2668ae..0000000000 Binary files a/mdop/mbam-v1/images/mbam-5-computer.jpg and /dev/null differ diff --git a/mdop/mbam-v1/index.md b/mdop/mbam-v1/index.md deleted file mode 100644 index b25186a196..0000000000 --- a/mdop/mbam-v1/index.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide -description: Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide -author: dansimp -ms.assetid: 4086e721-db24-4439-bdcd-ac5ef901811f -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - -# Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide - -Microsoft BitLocker Administration and Monitoring (MBAM) provides a simplified administrative interface that you can use to manage BitLocker drive encryption. With MBAM, you can select BitLocker encryption policy options that are appropriate to your enterprise and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the entire enterprise. In addition, you can access recovery key information when users forget their PIN or password, or when their BIOS or boot record changes. - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - - [About MBAM 1.0](about-mbam-10.md) - - [Release Notes for MBAM 1.0](release-notes-for-mbam-10.md) - - [Evaluating MBAM 1.0](evaluating-mbam-10.md) - - [High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md) - - [Accessibility for MBAM 1.0](accessibility-for-mbam-10.md) - - [Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md) -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - - [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) - - [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) - - [Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - - [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) - - [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) -- [Deploying MBAM 1.0](deploying-mbam-10.md) - - [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) - - [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - - [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md) -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - - [Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) - - [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - [Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md) -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -## More Information -- [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) - Find documentation, videos, and other resources for MDOP technologies. diff --git a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md b/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md deleted file mode 100644 index d365a7ce2c..0000000000 --- a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Known Issues in the MBAM International Release -description: Known Issues in the MBAM International Release -author: dansimp -ms.assetid: bbf888dc-93c1-4323-b43c-0ded098e9b93 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Known Issues in the MBAM International Release - - -This section contains known issues for Microsoft BitLocker Administration and Monitoring (MBAM) International Release. - -## Known Issues in the MBAM International Release - - -### The Installation Process Does Not Specify Update - -Upon updating the Microsoft BitLocker Administration and Monitoring server or servers, the Setup program does not state that an update is being installed. - -**Workaround**: None. - -### Certificates Used for the Administration and Monitoring Server Role - -If you are using a certificate for authentication between MBAM servers, after updating the MBAM Administration and Monitoring server you must ensure that the certificate is valid and not revoked or expired. - -**Workaround**: None. - -### MBAM Svclog File Filling Disk Space - -If you have followed Knowledge Base article 2668170, [https://support.microsoft.com/kb/2668170](https://go.microsoft.com/fwlink/?LinkID=247277), you might have to repeat the KB steps after you install this update. - -**Workaround**: None. - -## Related topics - - -[Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/maintaining-mbam-10.md b/mdop/mbam-v1/maintaining-mbam-10.md deleted file mode 100644 index ed8099b713..0000000000 --- a/mdop/mbam-v1/maintaining-mbam-10.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Maintaining MBAM 1.0 -description: Maintaining MBAM 1.0 -author: dansimp -ms.assetid: 02ffb093-c364-4837-bbe8-23d4c09fbd3d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Maintaining MBAM 1.0 - - -After you complete all the necessary planning and then deploy Microsoft BitLocker Administration and Monitoring (MBAM), you can configure MBAM to run in a highly available fashion while using it to manage enterprise BitLocker encryption operations. The information in this section describes high availability options for MBAM, as well as how to move MBAM Server features if necessary. - -## MBAM Management Pack - - -The Microsoft System Center Operations Manager Management Pack for MBAM is available for download from the Microsoft Download Center. - -This management pack monitors the critical interactions in the server-side infrastructure, such as the connections between the web services and databases and the operational calls between websites and their supportive web service. It also uploads the requests between desktop clients and their respective receiving web service endpoints. - -[Microsoft BitLocker Administration And Monitoring Management Pack](https://go.microsoft.com/fwlink/p/?LinkId=258390) - -## Ensure high availability for MBAM 1.0 - - -MBAM is designed to be fault-tolerant. If a server becomes unavailable, the users should not be negatively affected. The information in this section can be used to configure a highly available MBAM installation. - -[High Availability for MBAM 1.0](high-availability-for-mbam-10.md) - -## Move MBAM 1.0 features to another server - - -When you need to move an MBAM Server feature from one server computer to another, there is a specific order and required steps that you should follow to avoid loss of productivity or data. This section describes the steps that you should take to move one or more MBAM Server features to a different computer. - -[How to Move MBAM 1.0 Features to Another Computer](how-to-move-mbam-10-features-to-another-computer.md) - -## Other resources for maintaining MBAM - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/mbam-10-deployment-checklist.md b/mdop/mbam-v1/mbam-10-deployment-checklist.md deleted file mode 100644 index 8b7b659b06..0000000000 --- a/mdop/mbam-v1/mbam-10-deployment-checklist.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: MBAM 1.0 Deployment Checklist -description: MBAM 1.0 Deployment Checklist -author: dansimp -ms.assetid: 7e00be23-36a0-4b0f-8663-3c4f2c71546d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 1.0 Deployment Checklist - - -This checklist is designed to facilitate your deployment of Microsoft BitLocker Administration and Monitoring (MBAM). - -**Note** -This checklist outlines the recommended steps and provides a high-level list of items to consider when you deploy the MBAM features. We recommend that you copy this checklist into a spreadsheet program and customize it for your specific needs. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Complete the planning phase to prepare the computing environment for MBAM deployment.

    MBAM 1.0 Planning Checklist

    Checklist box

    Review the information on MBAM supported configurations to make sure that your selected client and server computers are supported for MBAM feature installation.

    MBAM 1.0 Supported Configurations

    Checklist box

    Run MBAM Setup to deploy MBAM Server features in the following order:

    -
      -
    1. Recovery and Hardware Database

    2. -
    3. Compliance Status Database

    4. -
    5. Compliance Audit and Reports

    6. -
    7. Administration and Monitoring Server

    8. -
    9. MBAM Group Policy Template

    10. -
    -
    -Note

    Keep track of the names of the servers each feature is installed on. You will use this information throughout the installation process.

    -
    -
    - -

    Deploying the MBAM 1.0 Server Infrastructure

    Checklist box

    Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on the appropriate servers.

    Planning for MBAM 1.0 Administrator Roles and How to Manage MBAM Administrator Roles

    Checklist box

    Create and deploy the required MBAM Group Policy Objects.

    Deploying MBAM 1.0 Group Policy Objects

    Checklist box

    Deploy the MBAM Client software.

    Deploying the MBAM 1.0 Client

    - - - -## Related topics - - -[Deploying MBAM 1.0](deploying-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/mbam-10-deployment-prerequisites.md b/mdop/mbam-v1/mbam-10-deployment-prerequisites.md deleted file mode 100644 index 0b59eb0f40..0000000000 --- a/mdop/mbam-v1/mbam-10-deployment-prerequisites.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -title: MBAM 1.0 Deployment Prerequisites -description: MBAM 1.0 Deployment Prerequisites -author: dansimp -ms.assetid: bd9e1010-7d25-43e7-8dc6-b521226a659d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 1.0 Deployment Prerequisites - - -Before you begin the Microsoft BitLocker Administration and Monitoring (MBAM) Setup, make sure that you meet the necessary prerequisites to install the product. This section contains information to help you successfully prepare your computing environment before you deploy the MBAM Clients and Server features. - -## Installation prerequisites for MBAM Server features - - -Each of the MBAM server features has specific prerequisites that must be met before they can be successfully installed. MBAM Setup verifies if all prerequisites are met before the installation starts. - -### Installation prerequisites for Administration and Monitoring Server - -The following table contains the installation prerequisites for the MBAM Administration and Monitoring Server: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Windows ServerWeb Server Role

    This role must be added to a server operating system supported for the mbam Administration and Monitoring Server feature.

    Web Server (IIS) Management Tools

    IIS Management Scripts and Tools

    Web Server Role Services

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -

    Windows Server Features

    Microsoft .NET Framework 3.5.1 features:

    -
      -
    • .NET Framework 3.5.1

    • -
    • WCF Activation

      -
        -
      • HTTP Activation

      • -
      • Non-HTTP Activation

      • -
    • -
    -

    Windows Process Activation Service

    -
      -
    • Process Model

    • -
    • .NET Environment

    • -
    • Configuration APIs

    • -
    - - - -**Note**   -For a list of supported operating systems, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -### Installation prerequisites for the Compliance and Audit Reports - -The Compliance and Audit Reports must be installed on a supported version of SQL Server. Installation prerequisites for this feature include SQL Server Reporting Services (SSRS). - -SSRS must be installed and running during MBAM server installation. SSRS should also be configured in “native” mode, not in the “unconfigured” or “SharePoint” mode. - -**Note**   -For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -### Installation prerequisites for the Recovery and Hardware Database - -The Recovery and Hardware Database must be installed on a supported version of SQL Server. - -SQL Server must have Database Engine Services installed and running during the MBAM server installation. The Transparent Data Encryption (TDE) feature must be enabled. - -**Note**   -For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -The TDE SQL Server feature performs real-time input/output (I/O) encryption and decryption of the data and log files. TDE protects data that is "at rest,” which include the data and the log files. It provides the ability to comply with many laws, regulations, and guidelines that are established in various industries. - -**Note**   -Because TDE performs real-time decryption of database information, the recovery key information will be visible if the account under which you are logged in has permissions to the database when you view the recovery key information SQL tables. - - - -### Installation prerequisites for the Compliance and Audit Database - -The Compliance and Audit Database must be installed on a supported version of SQL Server. - -SQL Server must have Database Engine Services installed and running during MBAM server installation. - -**Note**   -For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -## Installation prerequisites for MBAM Clients - - -The necessary prerequisites that you must meet before you begin the MBAM Client installation are the following: - -- Trusted Platform Module (TPM) v1.2 capability - -- The TPM chip must be turned on in the BIOS and it must be resettable from the operating system. For more information, see the BIOS documentation. - -**Warning**   -Ensure that the keyboard, mouse, and video are directly connected to the computer, instead of to a keyboard, video, mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware. - - - -## Related topics - - -[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - -[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) - - - - - - - - - diff --git a/mdop/mbam-v1/mbam-10-planning-checklist.md b/mdop/mbam-v1/mbam-10-planning-checklist.md deleted file mode 100644 index 0324216e06..0000000000 --- a/mdop/mbam-v1/mbam-10-planning-checklist.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: MBAM 1.0 Planning Checklist -description: MBAM 1.0 Planning Checklist -author: dansimp -ms.assetid: e9439f16-d68b-48ed-99ce-5949356b180b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 1.0 Planning Checklist - - -You can use this checklist to plan and prepare your computing environment for Microsoft BitLocker Administration and Monitoring (MBAM) deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when you plan for an MBAM deployment. We recommend that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Review the “getting started” information about MBAM to gain a basic understanding of the product before you begin the deployment planning.

    Getting Started with MBAM 1.0

    Checklist box

    Plan for MBAM 1.0 Deployment Prerequisites and prepare your computing environment.

    MBAM 1.0 Deployment Prerequisites

    Checklist box

    Plan for and configure MBAM Group Policy requirements.

    Planning for MBAM 1.0 Group Policy Requirements

    Checklist box

    Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.

    Planning for MBAM 1.0 Administrator Roles

    Checklist box

    Review the MBAM 1.0 Supported Configurations documentation to ensure hardware that meets MBAM installation system requirements is available.

    MBAM 1.0 Supported Configurations

    Checklist box

    Plan for MBAM Server feature deployment.

    Planning for MBAM 1.0 Server Deployment

    Checklist box

    Plan for MBAM Client deployment.

    Planning for MBAM 1.0 Client Deployment

    Checklist box

    Validate your deployment plan in a lab environment.

    Evaluating MBAM 1.0

    - - - -## Related topics - - -[Planning for MBAM 1.0](planning-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/mbam-10-supported-configurations.md b/mdop/mbam-v1/mbam-10-supported-configurations.md deleted file mode 100644 index 80ed363018..0000000000 --- a/mdop/mbam-v1/mbam-10-supported-configurations.md +++ /dev/null @@ -1,193 +0,0 @@ ---- -title: MBAM 1.0 Supported Configurations -description: MBAM 1.0 Supported Configurations -author: dansimp -ms.assetid: 1f5ac58e-6a3f-47df-8a9b-4b57631ab9ee -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 1.0 Supported Configurations - - -This topic specifies the necessary requirements to install and run Microsoft BitLocker Administration and Monitoring (MBAM) in your environment. - -## MBAM server system Requirements - - -### Server operating system requirements - -The following table lists the operating systems that are supported for the Microsoft BitLocker Administration and Monitoring Server installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2008

    Standard, Enterprise, Datacenter, or Web Server

    SP2 only

    32-bit or 64-bit

    Windows Server 2008 R2

    Standard, Enterprise, Datacenter, or Web Server

    64-bit

    - - - -**Warning** -There is no support for installing MBAM services, reports, or databases on a domain controller computer. - - - -### Server random access memory (RAM) requirements - -There are no RAM requirements that are specific to MBAM Server installation. - -### SQL Server Database requirements - -The following table lists the SQL Server versions that are supported for the MBAM Server feature installation. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    MBAM Server FeatureSQL Server VersionEditionService PackSystem Architecture

    Compliance and Audit Reports

    Microsoft SQL Server 2008

    R2, Standard, Enterprise, Datacenter, or Developer Edition

    SP2

    32-bit or 64-bit

    Recovery and Hardware Database

    Microsoft SQL Server 2008

    R2, Enterprise, Datacenter, or Developer Edition

    -
    -Important

    SQL Server Standard Editions are not supported for MBAM Recovery and Hardware Database Server feature installation.

    -
    -
    - -

    SP2

    32-bit or 64-bit

    Compliance and Audit Database

    Microsoft SQL Server 2008

    R2, Standard, Enterprise, Datacenter, or Developer Edition

    SP2

    32-bit or 64-bit

    - - - -## MBAM Client system requirements - - -### Client operating system requirements - -The following table lists the operating systems that are supported for MBAM Client installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows 7

    Enterprise Edition

    None, SP1

    32-bit or 64-bit

    Windows 7

    Ultimate Edition

    None, SP1

    32-bit or 64-bit

    - - - -### Client RAM requirements - -There are no RAM requirements that are specific to the MBAM Client installation. - -## Related topics - - -[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - -[MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) - - - - - - - - - diff --git a/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md b/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md deleted file mode 100644 index beb0deea35..0000000000 --- a/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Monitoring and Reporting BitLocker Compliance with MBAM 1.0 -description: Monitoring and Reporting BitLocker Compliance with MBAM 1.0 -author: dansimp -ms.assetid: fb497d3f-ff33-4747-8e34-366440ee25c2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring and Reporting BitLocker Compliance with MBAM 1.0 - - -If you use Microsoft BitLocker Administration and Monitoring (MBAM), you can generate various reports to monitor BitLocker usage and compliance activities. - -## Understand MBAM reports - - -MBAM reports have many fields that you should be familiar with before you generate MBAM reports. - -[Understanding MBAM Reports](understanding-mbam-reports-mbam-1.md) - -## Generate MBAM Reports - - -If you use MBAM reporting, you can generate reports on enterprise compliance, individual computers, hardware compatibility, and key recovery activity. - -[How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-1.md) - -## Other resources for Monitoring and Reporting BitLocker Compliance with MBAM - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/operations-for-mbam-10.md b/mdop/mbam-v1/operations-for-mbam-10.md deleted file mode 100644 index 560b76d3ff..0000000000 --- a/mdop/mbam-v1/operations-for-mbam-10.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Operations for MBAM 1.0 -description: Operations for MBAM 1.0 -author: dansimp -ms.assetid: 2c358fa1-4795-45ab-9316-02db4aaa6d5f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for MBAM 1.0 - - -This section of the Administrator’s Guide for Microsoft BitLocker Administration and Monitoring (MBAM) includes information about the various types of Microsoft BitLocker Administration and Monitoring administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations information - - -- [Administering MBAM 1.0 Features](administering-mbam-10-features.md) - - After you complete all necessary MBAM planning and deploying, you can configure and use MBAM features to manage enterprise BitLocker encryption. The information in this section describes post-installation day-to-day MBAM feature operations and maintenance tasks. - -- [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) - - This section describes how to generate and understand the various MBAM reports to help you monitor the BitLocker usage and compliance activities throughout your enterprise environment. - -- [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) - - This section describes post-installation day-to-day BitLocker encryption management tasks that are accomplished by using MBAM. - -- [Maintaining MBAM 1.0](maintaining-mbam-10.md) - - This section describes how to configure MBAM to run in a highly available manner. It also describes how to use MBAM to manage enterprise BitLocker encryption operations. The information in this section describes high availability options for MBAM, as well as how to move MBAM Server features if necessary. - -- [Security and Privacy for MBAM 1.0](security-and-privacy-for-mbam-10.md) - - This section provides an overview of MBAM security considerations and explains many of the data collection and use practices of MBAM. - -- [Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md) - - This section describes the set of Windows PowerShell cmdlets that are available for administrators to perform various MBAM server tasks from the command prompt rather than from the MBAM administration website. - -## Other resources for MBAM operations - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -- [Deploying MBAM 1.0](deploying-mbam-10.md) - -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md b/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md deleted file mode 100644 index b37c05e208..0000000000 --- a/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Performing BitLocker Management with MBAM -description: Performing BitLocker Management with MBAM -author: dansimp -ms.assetid: 2d24390a-87bf-48b3-96a9-3882d6f2a15c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing BitLocker Management with MBAM - - -After you deploy Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use MBAM to manage enterprise BitLocker encryption. This section describes post-installation, day-to-day BitLocker encryption management tasks that can be accomplished by using MBAM. - -## Reset a TPM Lockout with MBAM - - -A Trusted Platform Module (TPM) microchip provides basic security-related functions. These functions are accomplished primarily by the use of encryption keys. The TPM is typically installed on the motherboard of a computer or laptop and communicates with the rest of the system by using a hardware bus. Computers that incorporate a TPM can create cryptographic keys that can be decrypted only by the TPM. A TPM lockout can occur if a user enters an incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies from manufacturer to manufacturer. The Key Recovery data system on the MBAM administration website enables you to obtain a reset TPM owner password file. - -[How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-1.md) - -## Recover drives with MBAM - - -Make sure that you know how to attempt data recovery from encrypted drives in the event of hardware failure, changes in personnel, or other situations in which encryption keys are lost. The Encrypted Drive Recovery features of MBAM provide the capture and storage of data and availability of tools required to access a BitLocker-protected volume when the volume goes into recovery mode, is moved, or becomes corrupted. - -[How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-1.md) - -[How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-1.md) - -[How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-1.md) - -## Determine BitLocker Encryption State of lost computers by Using MBAM - - -When you use MBAM, you can determine the last known BitLocker encryption status of computers that were lost or stolen. - -[How to Determine the BitLocker Encryption State of a Lost Computers](how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md) - -## Other resources for performing BitLocker Management with MBAM - - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md b/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md deleted file mode 100644 index 6ed9a49fe7..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Planning for MBAM 1.0 Administrator Roles -description: Planning for MBAM 1.0 Administrator Roles -author: dansimp -ms.assetid: 95be0eb4-25e9-43ca-a8e7-27373d35544d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 1.0 Administrator Roles - - -This topic includes and describes the administrator roles that are available in Microsoft BitLocker Administration and Monitoring (MBAM), as well as the server locations where the local groups are created. - -## MBAM Administrator roles - - - **MBAM System Administrators** -Administrators in this role have access to all MBAM features. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Hardware Users** -Administrators in this role have access to the Hardware Capability features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Helpdesk Users** -Administrators in this role have access to the Helpdesk features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Report Users** -Administrators in this role have access to the Compliance and Audit Reports feature from MBAM. The local group for this role is installed on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports. - - **MBAM Advanced Helpdesk Users** -Administrators in this role have increased access to the Helpdesk features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. If a user is a member of both MBAM Helpdesk Users and MBAM Advanced Helpdesk Users, the MBAM Advanced Helpdesk Users permissions will overwrite the MBAM Helpdesk User permissions. - -**Important**   -To view the reports, an administrative user must be a member of the **MBAM Report Users** security group on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Reports feature. As a best practice, create a security group in Active Directory with rights on the local **MBAM Report Users** security group on both the Administration and Monitoring Server and on the server that hosts the Compliance and Reports. - - - -## Related topics - - -[Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md b/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md deleted file mode 100644 index 352f0f8fba..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Planning for MBAM 1.0 Client Deployment -description: Planning for MBAM 1.0 Client Deployment -author: dansimp -ms.assetid: 3af2e7f3-134b-4ab9-9847-b07474ca6ac3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 1.0 Client Deployment - - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring (MBAM) Client, you can enable BitLocker encryption on a computer in your organization either before the end user receives the computer or afterwards. To enable BitLocker encryption after the end user receives the computer, configure Group Policy. To enable BitLocker encryption before the end user receives the computer, deploy the MBAM Client software by using an enterprise software deployment system. - -You can use one or both methods in your organization. If you use both methods, you can improve compliance, reporting, and key recovery support. - -**Note**   -To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - - - -## Deploying the MBAM Client to enable BitLocker encryption after computer distribution to end users - - -After you configure the Group Policy, you can use an enterprise software deployment system product, such as Microsoft System Center Configuration Manager 2012 or Active Directory Domain Services, to deploy the MBAM Client installation Windows Installer files to the target computers. The two MBAM Client installation Windows Installer files are MBAMClient-64bit.msi and MBAMClient-32bit.msi, which are provided with the MBAM software. For more information about how to deploy MBAM Group Policy Objects, see [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md). - -When you deploy the MBAM Client, after you distribute the computers to end users, the end users are prompted to encrypt their computers. This lets MBAM collect the data, to include the PIN and password, and then begin the encryption process. - -**Note**   -In this approach, users are prompted to activate and initialize the Trusted Platform Module (TPM) chip, if it has not been previously activated. - - - -## Using the MBAM Client to enable BitLocker encryption before computer distribution to end users - - -In organizations where computers are received and configured centrally, you can install the MBAM Client to manage BitLocker encryption on each computer before any user data is written on it. The benefit of this process is that every computer will then be compliant with the BitLocker encryption. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. - -If your organization wants to use (TPM) to encrypt computers, the administrator must encrypt the operating system volume of the computer with TPM protector. If your organization wants to use the TPM chip and a PIN protector, the administrator must encrypt the system volume with the TPM protector, and then the users select a PIN the first time they log on. If your organization decides to use only the PIN protector, the administrator does not have to encrypt the volume first. When users log on their computers, MBAM prompts them to provide a PIN or a PIN and a password that they will use when they restart their computer later. - -**Note**   -The TPM protector option requires for the administrator to accept the BIOS prompt to activate and initialize the TPM before delivering the computer to the user. - - - -## Related topics - - -[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - -[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) - - - - - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md b/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md deleted file mode 100644 index 4b825a4bea..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md +++ /dev/null @@ -1,328 +0,0 @@ ---- -title: Planning for MBAM 1.0 Group Policy Requirements -description: Planning for MBAM 1.0 Group Policy Requirements -author: dansimp -ms.assetid: 0fc9c509-7850-4a8e-bb82-b949025bcb02 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 1.0 Group Policy Requirements - - -Microsoft BitLocker Administration and Monitoring (MBAM) Client management requires custom Group Policy settings to be applied. This topic describes the available policy options for Group Policy Object (GPO) when you use MBAM to manage BitLocker Drive Encryption in the enterprise. - -**Important** -MBAM does not use the default GPO settings for Windows BitLocker drive encryption. If the default settings are enabled, they can cause conflicting behavior. To enable MBAM to manage BitLocker, you must define the GPO policy settings after you install the MBAM Group Policy Template. - - - -After you install the MBAM Group Policy template, you can view and modify the available custom MBAM GPO policy settings that enable MBAM to manage the enterprise BitLocker encryption. The MBAM Group Policy template must be installed on a computer that is capable of running the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) MDOP technology. Next, to edit the applicable GPO, open the GPMC or AGPM, and then navigate to the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**. - -The MDOP MBAM (BitLocker Management) GPO node contains four global policy settings and four child GPO setting nodes, respectively. The four GPO global policy settings are: Client Management, Fixed Drive, Operating System Drive, and Removable Drive. The following sections provide policy definitions and suggested policy settings to help you plan for the MBAM GPO policy setting requirements. - -**Note** -For more information about configuring the minimum suggested GPO settings to enable MBAM to manage BitLocker encryption, see [How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md). - - - -## Global policy definitions - - -This section describes the MBAM Global policy definitions, which can be found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Setting

    Choose drive encryption method and cipher strength

    Suggested Configuration: Not Configured

    -

    Configure this policy to use a specific encryption method and cipher strength.

    -

    When this policy is not configured, BitLocker uses the default encryption method of AES 128-bit with Diffuser or the encryption method specified by the setup script.

    Prevent memory overwrite on restart

    Suggested Configuration: Not Configured

    -

    Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart.

    -

    When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts.

    Validate smart card certificate usage rule

    Suggested Configuration: Not Configured

    -

    Configure this policy to use smartcard certificate-based BitLocker protection.

    -

    When this policy is not configured, a default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate.

    Provide the unique identifiers for your organization

    Suggested Configuration: Not Configured

    -

    Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader.

    -

    When this policy is not configured, the Identification field is not used.

    -

    If your company requires higher security measurements, you may want to configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting.

    - - - -## Client Management policy definitions - - -This section describes the Client Management policy definitions for MBAM, found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Client Management**. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Settings

    Configure MBAM Services

    Suggested Configuration: Enabled

    -
      -
    • MBAM Recovery and Hardware service endpoint. This is the first policy setting that you must configure to enable the MBAM Client BitLocker encryption management. For this setting, enter the endpoint location similar to the following example: http://<MBAM Administration and Monitoring Server Name>:<port the web service is bound to>/MBAMRecoveryAndHardwareService/CoreService.svc.

    • -
    • Select BitLocker recovery information to store. This policy setting lets you configure the key recovery service to back up the BitLocker recovery information. It also lets you configure the status reporting service for collecting compliance and audit reports. The policy provides an administrative method of recovering data encrypted by BitLocker to help prevent data loss due to the lack of key information. Status report and key recovery activity will automatically and silently be sent to the configured report server location.

      -

      If you do not configure or if you disable this policy setting, the key recovery information will not be saved, and status report and key recovery activity will not be reported to server. When this setting is set to Recovery Password and key package, the recovery password and key package will be automatically and silently backed up to the configured key recovery server location.

    • -
    • Enter the client checking status frequency in minutes. This policy setting manages how frequently the client checks the BitLocker protection policies and the status on the client computer. This policy also manages how frequently the client compliance status is saved to the server. The client checks the BitLocker protection policies and status on the client computer, and it also backs up the client recovery key at the configured frequency.

      -

      Set this frequency based on the requirement established by your company on how frequently to check the compliance status of the computer, and how frequently to back up the client recovery key.

    • -
    • MBAM Status reporting service endpoint. This is the second policy setting that you must configure to enable MBAM Client BitLocker encryption management. For this setting, enter the endpoint location by using the following example: http://<MBAM Administration and Monitoring Server Name>:<port the web service is bound to>/MBAMComplianceStatusService/StatusReportingService. svc.

    • -

    Allow hardware compatibility checking

    Suggested Configuration: Enabled

    -

    This policy setting lets you manage the verification of hardware compatibility before you enable BitLocker protection on drives of MBAM client computers.

    -

    You should enable this policy option if your enterprise has older computer hardware or computers that do not support Trusted Platform Module (TPM). If either of these criteria is true, enable the hardware compatibility verification to make sure that MBAM is applied only to computer models that support BitLocker. If all computers in your organization support BitLocker, you do not have to deploy the Hardware Compatibility, and you can set this policy to Not Configured.

    -

    If you enable this policy setting, the model of the computer is validated against the hardware compatibility list once every 24 hours, before the policy enables BitLocker protection on a computer drive.

    -
    -Note

    Before enabling this policy setting, make sure that you have configured the MBAM Recovery and Hardware service endpoint setting in the Configure MBAM Services policy options.

    -
    -
    - -
    -

    If you either disable or do not configure this policy setting, the computer model is not validated against the hardware compatibility list.

    Configure user exemption policy

    Suggested Configuration: Not Configured

    -

    This policy setting lets you configure a web site address, email address, or phone number that will instruct a user to request an exemption from BitLocker encryption.

    -

    If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog with instructions on how to apply for an exemption from BitLocker protection. For more information about how to enable BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.

    -

    If you either disable or do not configure this policy setting, the instructions about how to apply for an exemption request will not be presented to users.

    -
    -Note

    User exemption is managed per user, not per computer. If multiple users log on to the same computer and one user is not exempt, the computer will be encrypted.

    -
    -
    - -
    - - - -## Fixed Drive policy definitions - - -This section describes the Fixed Drive policy definitions for MBAM, which can be found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Fixed Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Setting

    Fixed data drive encryption settings

    Suggested Configuration: Enabled, and select the Enable auto-unlock fixed data drive check box if the operating system volume is required to be encrypted.

    -

    This policy setting lets you manage whether or not to encrypt the fixed drives.

    -

    When you enable this policy, do not disable the Configure use of password for fixed data drives policy.

    -

    If the Enable auto-unlock fixed data drive check box is selected, the operating system volume must be encrypted.

    -

    If you enable this policy setting, users are required to put all fixed drives under BitLocker protection, which will encrypt the drives.

    -

    If you do not configure this policy or if you disable this policy, users are not required to put fixed drives under BitLocker protection.

    -

    If you disable this policy, the MBAM agent decrypts any encrypted fixed drives.

    -

    If encrypting the operating system volume is not required, clear the Enable auto-unlock fixed data drive check box.

    Deny “write” permission to fixed drives that are not protected by BitLocker

    Suggested Configuration: Not Configured

    -

    This policy setting determines if BitLocker protection is required for fixed drives on a computer so that they are writable. This policy setting is applied when you turn on BitLocker.

    -

    When the policy is not configured, all fixed drives on the computer are mounted with read/write permissions.

    Allow access to BitLocker-protected fixed drives from earlier versions of Windows

    Suggested configuration: Not Configured

    -

    Enable this policy to unlock and view the fixed drives that are formatted with the file allocation table (FAT) file system on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    -

    These operating systems have read-only permissions to BitLocker-protected drives.

    -

    When the policy is disabled, fixed drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    Configure use of password for fixed drives

    Suggested configuration: Not Configured

    -

    Enable this policy to configure password protection on fixed drives.

    -

    When the policy is not configured, passwords will be supported with the default settings, which do not include password complexity requirements and require only eight characters.

    -

    For higher security, enable this policy and select Require password for fixed data drive, select Require password complexity, and set the desired minimum password length.

    Choose how BitLocker-protected fixed drives can be recovered

    Suggested Configuration: Not Configured

    -

    Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When this policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require the recovery information to be backed up to AD DS.

    - - - -## Operating System Drive policy definitions - - -This section describes the Operating System Drive policy definitions for MBAM, found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Operating System Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Setting

    Operating system drive encryption settings

    Suggested configuration: Enabled

    -

    This policy setting determines if the operating system drive will be encrypted.

    -

    Configure this policy to do the following:

    -
      -
    • Enforce BitLocker protection for the operating system drive.

    • -
    • Configure PIN usage to use a Trusted Platform Module (TPM) PIN for operating system protection.

    • -
    • Configure enhanced startup PINs to permit characters such as uppercase and lowercase letters, and numbers. MBAM does not support the use of symbols and spaces for enhanced PINs, even though BitLocker supports symbols and spaces.

    • -
    -

    If you enable this policy setting, users are required to secure the operating system drive by using BitLocker.

    -

    If you do not configure or if you disable the setting, users are not required to secure the operating system drive by using BitLocker.

    -

    If you disable this policy, the MBAM agent decrypts the operating system volume if it is encrypted.

    -

    When it is enabled, this policy setting requires users to secure the operating system by using BitLocker protection, and the drive is encrypted. Based on your encryption requirements, you may select the method of protection for the operating system drive.

    -

    For higher security requirements, use TPM + PIN, allow enhanced PINs, and set the minimum PIN length to eight characters.

    -

    When this policy is enabled with the TPM + PIN protector, you can consider disabling the following policies under System / Power Management / Sleep Settings:

    -
      -
    • Allow Standby States (S1-S3) When Sleeping (Plugged In)

    • -
    • Allow Standby States (S1-S3) When Sleeping (On Battery)

    • -

    Configure TPM platform validation profile

    Suggested Configuration: Not Configured

    -

    This policy setting lets you configure how the TPM security hardware on a computer secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker already has TPM protection enabled.

    -

    When this policy is not configured, the TPM uses the default platform validation profile or the platform validation profile specified by the setup script.

    Choose how to recover BitLocker-protected operating system drives

    Suggested Configuration: Not Configured

    -

    Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When this policy is not configured, the data recovery agent is allowed, and the recovery information is not backed up to AD DS.

    -

    MBAM operation does not require the recovery information to be backed up to AD DS.

    - - - -## Removable Drive policy definitions - - -This section describes the Removable Drive Policy definitions for MBAM, found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Removable Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Setting

    Control the use of BitLocker on removable drives

    Suggested configuration: Enabled

    -

    This policy controls the use of BitLocker on removable data drives.

    -

    Enable the Allow users to apply BitLocker protection on removable data drives option, to allow users to run the BitLocker setup wizard on a removable data drive.

    -

    Enable the Allow users to suspend and decrypt BitLocker on removable data drives option to allow users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed.

    -

    When this policy is enabled and the Allow users to apply BitLocker protection on removable data drives option is selected, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server, and it allows users to recover the drive if the password is lost.

    Deny the “write” permissions to removable drives that are not protected by BitLocker

    Suggested Configuration: Not Configured

    -

    Enable this policy to allow write-only permissions to BitLocker protected drives.

    -

    When this policy is enabled, all removable data drives on the computer require encryption before write permissions are allowed.

    Allow access to BitLocker-protected removable drives from earlier versions of Windows

    Suggested Configuration: Not Configured

    -

    Enable this policy to unlock and view the fixed drives that are formatted with the (FAT) file system on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    -

    These operating systems have read-only permissions to BitLocker-protected drives.

    -

    When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    Configure the use of password for removable data drives

    Suggested configuration: Not Configured

    -

    Enable this policy to configure password protection on removable data drives.

    -

    When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and require only eight characters.

    -

    For increased security, you can enable this policy and select Require password for removable data drive, select Require password complexity, and then set the preferred minimum password length.

    Choose how BitLocker-protected removable drives can be recovered

    Suggested Configuration: Not Configured

    -

    You can configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When the policy is set to Not Configured, the data recovery agent is allowed and recovery information is not backed up to AD DS.

    -

    MBAM operation does not require the recovery information to be backed up to AD DS.

    - - - -## Related topics - - -[Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md b/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md deleted file mode 100644 index fe9b06d826..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Planning for MBAM 1.0 Server Deployment -description: Planning for MBAM 1.0 Server Deployment -author: dansimp -ms.assetid: 3cbef284-3092-4c42-9234-2826b18ddef1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for MBAM 1.0 Server Deployment - - -The Microsoft BitLocker Administration and Monitoring (MBAM) server infrastructure depends on a set of server features that can be installed on one or more server computers, based on the requirements of your enterprise. - -## Planning for MBAM Server deployment - - -The following MBAM features represent the server infrastructure for an MBAM server deployment: - -- Recovery and Hardware Database - -- Compliance and Audit Database - -- Compliance and Audit Reports - -- Administration and Monitoring Server - -MBAM server databases and features can be installed in different configurations, depending on your scalability needs. All MBAM Server features can be installed on a single server or distributed across multiple servers. Generally, we recommend that you use a three-server or five-server configuration for production environments, although configurations of two or four servers can also be used, depending on your computing needs. - -**Note**   -For more information about performance scalability of MBAM and recommended deployment topologies, see the MBAM Scalability and High-Availability Guide white paper at . - - - -Each MBAM feature has specific prerequisites. For a full list of server feature prerequisites and hardware and software requirements, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). - -In addition to the server-related MBAM features, the server Setup application includes an MBAM Group Policy template. This template can be installed on any computer that is able to run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -## Order of deployment of MBAM Server Features - - -When you deploy the MBAM Server features, install the features in the following order: - -1. Recovery and Hardware Database - -2. Compliance and Audit Database - -3. Compliance Audit and Reports - -4. Administration and Monitoring Server - -5. Policy Template - -**Note**   -Keep track of the names of the computers on which you install each feature. You will use this information throughout the installation process. You can print and use a deployment checklist to assist you in the installation process. For more information about the MBAM deployment checklist, see [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md). - - - -## Related topics - - -[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/mbam-v1/planning-for-mbam-10.md b/mdop/mbam-v1/planning-for-mbam-10.md deleted file mode 100644 index 53583513c7..0000000000 --- a/mdop/mbam-v1/planning-for-mbam-10.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Planning for MBAM 1.0 -description: Planning for MBAM 1.0 -author: dansimp -ms.assetid: d4e8a42f-2836-48c8-83c1-40bd58270e19 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 1.0 - - -The goal of deployment planning is to successfully and efficiently deploy Microsoft BitLocker Administration and Monitoring (MBAM) so that it does not disrupt your users or the network. - -There are a number of different deployment configurations and prerequisites that you should consider before you try to deploy the MBAM. This section includes information that can help you gather the information that you need to formulate a deployment plan that best meets your business requirements. It can assist you in preparing your network and computing environment, and it provides the information necessary for you to properly plan to deploy MBAM features. - -## Planning information - - -- [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) - - This section describes the computing environment requirements and installation prerequisites that you should plan for before you begin the MBAM Setup. - -- [Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) - - This section describes the minimum hardware and software requirements necessary for the MBAM Client and Server feature installation. It also provides information about the MBAM deployment topology that you can use, and other MBAM Server and Client planning considerations. - -- [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) - - This section provides a planning checklist that you can use throughout the MBAM deployment. - -## Other resources for MBAM planning - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -- [Deploying MBAM 1.0](deploying-mbam-10.md) - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/planning-to-deploy-mbam-10.md b/mdop/mbam-v1/planning-to-deploy-mbam-10.md deleted file mode 100644 index c35e32933a..0000000000 --- a/mdop/mbam-v1/planning-to-deploy-mbam-10.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Planning to Deploy MBAM 1.0 -description: Planning to Deploy MBAM 1.0 -author: dansimp -ms.assetid: 30ad4304-45c6-427d-8e33-ebe8053c7871 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy MBAM 1.0 - - -You should consider a number of different deployment configurations and prerequisites before you create your Microsoft BitLocker Administration and Monitoring (MBAM) 1.0 deployment plan. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. - -## Review the MBAM 1.0 supported configurations - - -After you prepare your computing environment for the MBAM Client and Server feature installation, make sure that you review the Supported Configurations information for MBAM to confirm that the computers on which you install MBAM meet the minimum hardware and operating system requirements. For more information about MBAM deployment prerequisites, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md). - -[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) - -## Plan for MBAM 1.0 Server and Client deployment - - -The MBAM server infrastructure depends on a set of server features that can be installed on one or more server computers, based on the requirements of the enterprise. These features can be installed on a single server or distributed across multiple servers. - -The MBAM Client enables administrators to enforce and monitor the BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through tools like Active Directory Domain Services or by directly encrypting the client computers as part of the initial imaging process. - -With MBAM, you can encrypt a computer in your organization either before the end user receives the computer or afterwards, by using Group Policy. You can use one or both methods in your organization. If you choose to use both methods, you can improve compliance, reporting, and key recovery support. - -[Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md) - -[Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md) - -## Other resources for MBAM planning - - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md b/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md deleted file mode 100644 index 931b7c9924..0000000000 --- a/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Preparing your Environment for MBAM 1.0 -description: Preparing your Environment for MBAM 1.0 -author: dansimp -ms.assetid: 915f7c3c-70ad-4a90-a434-73e7fba97ecb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing your Environment for MBAM 1.0 - - -Before you begin the Microsoft BitLocker Administration and Monitoring (MBAM) Setup, make sure that you have met the necessary prerequisites to install the product. If you know the prerequisites in advance, you can efficiently deploy the product and enable its features, which can support the business objectives of your organization more effectively. - -## Review MBAM 1.0 deployment prerequisites - - -The MBAM Client and each of the MBAM Server features have specific prerequisites that must be met before they can be successfully installed. - -To ensure successful installation of MBAM Clients and MBAM Server features, you should plan to ensure that computers specified for MBAM Client or MBAM Server feature installation are properly prepared for MBAM Setup. - -**Note**   -MBAM Setup verifies if all prerequisites are met before installation starts. If they are not met, Setup will fail. - - - -[MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) - -## Plan for MBAM 1.0 Group Policy requirements - - -Before MBAM can manage clients in the enterprise, you must define the Group Policy for the encryption requirements of your environment. - -**Important**   -MBAM will not work with policies for stand-alone BitLocker drive encryption. Group Policy must be defined for MBAM; otherwise, the BitLocker encryption and enforcement will fail. - - - -[Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) - -## Plan for MBAM 1.0 administrator roles - - -MBAM administrator roles are managed by local groups that are created by MBAM Setup when you install the following: BitLocker Administration and Monitoring Server, the Compliance and Audit Reports feature, and the Compliance and Audit Status Database. - -The membership of MBAM roles can be managed more effectively if you create security groups in Active Directory Domain Services, add the appropriate administrator accounts to those groups, and then add those security groups to the MBAM local groups. For more information, see [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md). - -[Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) - -## Other resources for MBAM planning - - -[Planning for MBAM 1.0](planning-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/privacy-statement-for-mbam-10.md b/mdop/mbam-v1/privacy-statement-for-mbam-10.md deleted file mode 100644 index f54a72fb5e..0000000000 --- a/mdop/mbam-v1/privacy-statement-for-mbam-10.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Privacy Statement for MBAM 1.0 -description: Privacy Statement for MBAM 1.0 -author: dansimp -ms.assetid: db18cc93-a1c1-44da-a450-a5399a4427b9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Privacy Statement for MBAM 1.0 - - -## Privacy Statement - - -At Microsoft, we're working hard to protect your privacy while delivering products that bring you the performance, power, and convenience that you want in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft BitLocker Administration and Monitoring (MBAM). This privacy statement focuses on features that communicate with the Internet and is not intended to be an exhaustive list. This privacy statement does not apply to other online or offline Microsoft sites, products or services. - -Collection and Use of Your Personal Information: - -When we need information that personally identifies you or allows us to contact you, we will explicitly ask you for it. The personal information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to provide the service(s) or carry out the transaction(s) you have requested or authorized, and may also be used to request additional information on feedback that you provide about the product or service that you are using; to provide critical updates and notifications regarding the software; to improve the product or service, for example bug and survey form inquiries, or to provide you with advance notice of events or to tell you about new product releases. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Information that is collected by or sent to Microsoft may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries or agents maintain facilities, and by using a Microsoft site or service, you consent to any such transfer of information outside of your country. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union. Microsoft may disclose personal information about you if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on Microsoft or the site; (b) protect and defend the rights or property of Microsoft (including enforcing our agreements); or (c) act in urgent circumstances to protect the personal safety of Microsoft employees, users of Microsoft products or services, or members of the public. - -Collection and Use of Information about Your Computer: - -Microsoft BitLocker Administration and Monitoring contains Internet-enabled features that can collect certain standard information from your computer ("standard computer information") along with information needed for a specific feature and send it to Microsoft. Standard computer information includes information such as your IP address, operating system version, a code that identifies the manufacturer of your computer, and your regional and language settings. This computer information is generally not personally identifiable. - -Security of Your Information: - -Microsoft is committed to protecting the security of your personal information. We use a variety of security technologies and procedures to help protect your personal information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer servers with limited access that are located in controlled facilities. - -Changes to the Privacy Statement: - -We may occasionally update this privacy statement. When we do, we will revise the "last updated" date at the top of the privacy statement. We encourage you to periodically review this privacy statement to be informed of how Microsoft is protecting your information. - -For More Information: - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement, please contact us at: - -Microsoft Privacy - -Microsoft Corporation - -One Microsoft Way - -Redmond, Washington 98052 USA - -## Related topics - - -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/release-notes-for-mbam-10.md b/mdop/mbam-v1/release-notes-for-mbam-10.md deleted file mode 100644 index 61041c666a..0000000000 --- a/mdop/mbam-v1/release-notes-for-mbam-10.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -title: Release Notes for MBAM 1.0 -description: Release Notes for MBAM 1.0 -author: dansimp -ms.assetid: d82fddde-c360-48ef-86a0-d9b5fe066861 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for MBAM 1.0 - - -**To search for a specific issue in these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM). - -These release notes contain information that is required to successfully install MBAM. The release notes also contain information that is not available in the product documentation. If there is a difference between these release notes and other MBAM documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## About the Product Documentation - - -For information about MBAM documentation, see the MBAM home page on Microsoft TechNet. - -To obtain a downloadable copy of the MBAM documentation, see on the Microsoft Download Center. - -## Provide Feedback - - -We are interested in your feedback on MBAM. You can send your feedback to . - -**Note**   -This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases. - - - -For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page. - -For more information about new updates or to provide feedback, follow us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -## Known Issues with MBAM 1.0 - - -This section contains release notes about the known issues with MBAM setup and installation. - -### If you select the “Use a certificate to encrypt the network communication” option during Setup, existing database connections and dependent applications can stop functioning - -You can configure MBAM for **Encrypted network communication** after you install either the Recovery and Hardware Database or the Compliance Status Database features. If you choose to configure MBAM for Encrypted network communication, MBAM Setup configures the instance of the SQL Server Database Engine to use Secure Sockets Layer (SSL) for communication between the applicable database and both the Administration and Monitoring Server and the Compliance and Audit Report Server features. - -- If the instance of the SQL Server Database Engine is not already configured to use SSL, MBAM Setup configures it to do so. This can prevent applications that try to use non-MBAM databases on the instance of the SQL Server Database Engine from communicating with their databases. - -- If the instance of the SQL Server Database Engine is already configured to use SSL, it is configured to use the certificate that the user selected during setup. If this certificate differs from the one that was already in use, it can prevent applications that use SQL Server databases on the instance of the SQL Server Database Engine from running. - -**WORKAROUND:** None - -### MBAM Setup fails during installation when you use a local Administrator account - -MBAM Setup fails when you use a local Administrator account. The log file contains the following information: - -``` syntax -Locating group 'MBAM Report Users' -Adding ' to group 'MBAM Report Users' -Locating group 'MBAM Recovery and Hardware DB Access' -Adding 'S-1-5-20' to group 'MBAM Recovery and Hardware DB Access' -Exception: A new member could not be added to a local group because the member has the wrong account type. - - StackTrace:    at System.DirectoryServices.AccountManagement.SAMStoreCtx.UpdateGroupMembership(Principal group, DirectoryEntry de, NetCred credentials, AuthenticationTypes authTypes) - at System.DirectoryServices.AccountManagement.SDSUtils.ApplyChangesToDirectory(Principal p, StoreCtx storeCtx, GroupMembershipUpdater updateGroupMembership, NetCred credentials, AuthenticationTypes authTypes) - at System.DirectoryServices.AccountManagement.SAMStoreCtx.Update(Principal p) - at Microsoft.Windows.Mdop.BitlockerManagement.Setup.Groups.CreateGroupsDeferred(Session session) - InnerException:Exception: A new member could not be added to a local group because the member has the wrong account type. - - InnerException:StackTrace:    at System.DirectoryServices.AccountManagement.UnsafeNativeMethods.IADsGroup.Add(String bstrNewItem) - at System.DirectoryServices.AccountManagement.SAMStoreCtx.UpdateGroupMembership(Principal group, DirectoryEntry de, NetCred credentials, AuthenticationTypes authTypes) -CustomAction MbamCreateGroupsDeferred returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) -Action ended 11:41:29: InstallExecute. Return value 3. -``` - -**WORKAROUND:** Use a domain account with administrative credentials on the server computer when you install MBAM. - -### MBAM Setup reconfigures the instance of the SQL Server Database Engine to not use SSL if you select “Do not encrypt network communication” - -When you install either the Recovery and Hardware Database or the Compliance Status Database, you can use Setup to configure MBAM by selecting **Encrypted network communication**. If you decide not to encrypt the network communication, MBAM Setup reconfigures the instance of the SQL Server Database Engine so that it does not use SSL. - -- If the instance of the SQL Server Database Engine is already configured to use SSL, MBAM Setup disables SSL on the instance of the SQL Server Database Engine. This changes the communication security between the applications that use databases that are not related to MBAM databases on the instance of the SQL Server Database Engine. - -**WORKAROUND:** None - -### Missing prerequisite for the Internet Information Services (IIS) Management Scripts and Tools web server feature - -MBAM Setup is dependent on the IIS Management Scripts and Tools web server feature, but it is not an enforced prerequisite. Server setup lets you install MBAM when this feature is missing. However, this will cause the backup service MBAM VSS Writer to start and then stop, because it cannot locate the Windows Management Instrumentation (WMI) and the Internet Information Services (IIS) provider. There is no error message for this condition, except that which occurs in the event log. Installation of MBAM without IIS Management Scripts and Tools causes the backup operations not to run for MBAM. - -**WORKAROUND:** Ensure that the IIS Management Scripts and Tools web server feature is installed before you start the MBAM Setup. - -### MBAM Setup stops responding during the “Installing selected features” phase when setup is configured to use a certificate - -MBAM Setup stops responding during the **Installing selected features** phase of setup. This occurs during the installation of the Recovery and Hardware Database or the Compliance Status Database, after you select the **Use a certificate to encrypt the network communication** option. Furthermore, the MBAM Setup stops responding if the instance of the SQL Server Database Engine cannot access the certificate that was specified during setup. - -**WORKAROUND:** Update the permissions on the certificate, so that the Windows service for the applicable instance of the SQL Server Database Engine can access the certificate. You can also change the account under which the instance of the SQL Server Database Engine runs, for the database engine to use the certificate. To determine the permissions for the certificate, type the following command at the command prompt: **certutil -v -store MY** - -### MBAM Setup pauses when you install SQL Server Reporting Services - -During MBAM installation, when you select an instance of SQL Server Reporting Services (SSRS) and SSRS instance is not available or it is configured incorrectly, the MBAM Setup might pause for up to one minute while it attempts to communicate with the SSRS instance. - -**WORKAROUND:** Wait for at least one minute for MBAM Setup to resume while the Setup program attempts to contact the instance of SSRS. - -### Administration and Monitoring Server does not run after setup - -After MBAM Setup successfully installs the Administration and Monitoring Server feature, MBAM displays error messages when you try to access the MBAM administrator website. This issue occurs for one of the following reasons: - -- One or more prerequisites on the Administration and Monitoring Server were removed after the MBAM installation. - -- One or more prerequisites were installed on the server and later they were removed before running the MBAM Setup. - -**WORKAROUND:** Review the MBAM documentation and confirm that all MBAM prerequisites are installed. - -### Clicking documentation links during Setup results in an application error after Setup is finished - -When you click a documentation link during setup and then close the Setup program by clicking **Cancel** or **Finish** after Setup has successfully finished, an application error message appears.. The problem is caused by an access violation error in the Windows Task Scheduler. - -**WORKAROUND:** None. You can ignore this error. - -### Failed MBAM Setup does not remove new databases - -If the MBAM Setup fails, Setup might not remove the newly created databases. This can cause failures during subsequent installations. - -**WORKAROUND:** Choose a different name for the database instance during the subsequent installation. - -### MBAM Setup does not recognize valid network load-balancing cluster certificates - -During the MBAM Administration and Monitoring Server installation, with the network encryption option selected, the cluster certificate is not recognized as a valid certificate. It is recognized as valid when the certificate for communication with the database is installed, but it is rejected for communication by the load-balancing cluster. - -**WORKAROUND:** Confirm that the certificate revocation list (CRL) associated with the certificate is accessible, or use a certificate that does not require validation by using the CRL. - -## Release Notes Copyright Information - - -Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Windows, Microsoft Intune, and Windows PowerShell are trademarks of the Microsoft group of companies. All other trademarks are property of their respective owners. - - - -## Related topics - - -[About MBAM 1.0](about-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/security-and-privacy-for-mbam-10.md b/mdop/mbam-v1/security-and-privacy-for-mbam-10.md deleted file mode 100644 index 8ef48ada78..0000000000 --- a/mdop/mbam-v1/security-and-privacy-for-mbam-10.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Security and Privacy for MBAM 1.0 -description: Security and Privacy for MBAM 1.0 -author: dansimp -ms.assetid: ba4497f1-b9e3-41be-8953-3637d1f83f01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for MBAM 1.0 - - -The topics in this guide will help you plan for security and privacy considerations for Microsoft BitLocker Administration and Monitoring (MBAM). - -## Security considerations for MBAM 1.0 - - -Before you deploy and use MBAM in your computing environment, you should consider potential security-related issues. The information in the Security Considerations topic provides a brief overview of Active Directory Domain Services user accounts and groups, log files, and other security-related considerations for MBAM. - -[Security Considerations for MBAM 1.0](security-considerations-for-mbam-10.md) - -## Privacy for MBAM 1.0 - - -This topic covers many of the data collection and use practices of MBAM. - -[Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md) - -## Other resources MBAM Security and Privacy - - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/security-considerations-for-mbam-10.md b/mdop/mbam-v1/security-considerations-for-mbam-10.md deleted file mode 100644 index 340bd2e376..0000000000 --- a/mdop/mbam-v1/security-considerations-for-mbam-10.md +++ /dev/null @@ -1,207 +0,0 @@ ---- -title: Security Considerations for MBAM 1.0 -description: Security Considerations for MBAM 1.0 -author: dansimp -ms.assetid: 5e1c8b8c-235b-4a92-8b0b-da50dca17353 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Security Considerations for MBAM 1.0 - - -This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for Microsoft BitLocker Administration and Monitoring (MBAM). For more information, follow the links in this article. - -## General security considerations - - -**Understand the security risks.** The most serious risk to MBAM is that its functionality could be hijacked by an unauthorized user who could then reconfigure BitLocker encryption and gain BitLocker encryption key data on MBAM Clients. However, the loss of MBAM functionality for a short period of time due to a denial-of-service attack would not generally have a catastrophic impact. - -**Physically secure your computers**. Security is incomplete without physical security. Anyone with physical access to an MBAM Server could potentially attack the entire client base. Any potential physical attacks must be considered high risk and mitigated appropriately. MBAM servers should be stored in a physically secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for operating systems, Microsoft SQL Server, and MBAM by subscribing to the Security Notification service (). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all MBAM and MBAM administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). - -## Accounts and Groups in MBAM - - -A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary MBAM local groups on the MBAM Servers. - -### Active Directory Domain Services Groups - -No groups are created automatically during MBAM Setup. However, you should create the following Active Directory Domain Services global groups to manage MBAM operations. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Group NameDetails

    MBAM Advanced Helpdesk Users

    Create this group to manage members of the MBAM Advanced Helpdesk Users local group that was created during MBAM Setup.

    MBAM Compliance Auditing DB Access

    Create this group to manage members of the MBAM Compliance Auditing DB Access local group that was created during MBAM Setup.

    MBAM Hardware Users

    Create this group to manage members of the MBAM Hardware Users local group that was created during MBAM Setup.

    MBAM Helpdesk Users

    Create this group to manage members of the MBAM Helpdesk Users local group that was created during MBAM Setup.

    MBAM Recovery and Hardware DB Access

    Create this group to manage members of the MBAM Recovery and Hardware DB Access local group that was created during MBAM Setup.

    MBAM Report Users

    Create this group to manage members of the MBAM Report Users local group that was created during MBAM Setup.

    MBAM System Administrators

    Create this group to manage members of the MBAM System Administrators local group that was created during MBAM Setup.

    BitLocker Encryption Exemptions

    Create this group to manage user accounts that should be exempted from BitLocker encryption starting on computers that they log on to.

    - - - -### MBAM Server Local Groups - -MBAM Setup creates local groups to support MBAM operations. You should add the Active Directory Domain Services Global Groups to the appropriate MBAM local groups to configure MBAM security and data access permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Group NameDetails

    MBAM Advanced Helpdesk Users

    Members of this group have expanded access to the Helpdesk features of Microsoft BitLocker Administration and Monitoring.

    MBAM Compliance Auditing DB Access

    This group contains the machines that have access to the MBAM Compliance Auditing Database.

    MBAM Hardware Users

    Members of this group have access to some of the Hardware Capability features from Microsoft BitLocker Administration and Monitoring.

    MBAM Helpdesk Users

    Members of this group have access to some of the Helpdesk features from Microsoft BitLocker Administration and Monitoring.

    MBAM Recovery and Hardware DB Access

    This group contains the computers that have access to the MBAM Recovery and Hardware Database.

    MBAM Report Users

    Members of this group have access to the Compliance and Audit reports from Microsoft BitLocker Administration and Monitoring.

    MBAM System Administrators

    Members of this group have access to all the features of Microsoft BitLocker Administration and Monitoring.

    - - - -### SSRS Reports Access Account - -The SQL Server Reporting Services (SSRS) Reports Service Account provides the security context to run the MBAM reports available through SSRS. This account is configured during MBAM Setup. - -## MBAM Log Files - - -During MBAM Setup, the following MBAM Setup log files are created in the %temp% folder of the user who installs the - -**MBAM Server Setup log files** - -MSI<five random characters>.log -Logs the actions taken during MBAM Setup and MBAM Server Feature installation. - -InstallComplianceDatabase.log -Logs the actions taken to create the MBAM Compliance Status database setup. - -InstallKeyComplianceDatabase.log -Logs the actions taken to create the MBAM Recovery and Hardware database. - -AddHelpDeskDbAuditUsers.log -Logs the actions taken to create the SQL Server logins on the MBAM Compliance Status database and authorize helpdesk web service to the database for reports. - -AddHelpDeskDbUsers.log -Logs the actions taken to authorize web services to database for key recovery and create logins to the MBAM Recovery and Hardware database. - -AddKeyComplianceDbUsers.log -Logs the actions taken to authorize web services to MBAM Compliance Status database for compliance reporting. - -AddRecoveryAndHardwareDbUsers.log -Logs the actions taken to authorize web services to MBAM Recovery and Hardware database for key recovery. - -**Note**   -In order to obtain additional MBAM Setup log files, you must install Microsoft BitLocker Administration and Monitoring by using the **msiexec** package and the **/l** <location> option. Log files are created in the location specified. - - - -**MBAM Client Setup log files** - -MSI<five random characters>.log -Logs the actions taken during MBAM Client installation. - -## MBAM Database TDE considerations - - -The Transparent Data Encryption (TDE) feature available in SQL Server 2008 is a required installation prerequisite for the database instances that will host MBAM database features. - -With TDE, you can perform real-time, full database-level encryption. TDE is a well-suited choice for bulk encryption to meet regulatory compliance or corporate data security standards. TDE works at the file level, which is similar to two Windows features: the Encrypting File System (EFS) and BitLocker Drive Encryption, both of which also encrypt data on the hard drive. TDE does not replace cell-level encryption, EFS, or BitLocker. - -When TDE is enabled on a database, all backups are encrypted. Thus, special care must be taken to ensure that the certificate that was used to protect the Database Encryption Key (DEK) is backed up and maintained with the database backup. Without a certificate, the data will be unreadable. Back up the certificate along with the database. Each certificate backup should have two files; both of these files should be archived .It is best to archive them separately from the database backup file for security. - -For an example of how to enable TDE for MBAM database instances, see [Evaluating MBAM 1.0](evaluating-mbam-10.md). - -For more information about TDE in SQL Server 2008, see [Database Encryption in SQL Server 2008 Enterprise Edition](https://go.microsoft.com/fwlink/?LinkId=269703). - -## Related topics - - -[Security and Privacy for MBAM 1.0](security-and-privacy-for-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v1/troubleshooting-mbam-10.md b/mdop/mbam-v1/troubleshooting-mbam-10.md deleted file mode 100644 index bcf03fa8b3..0000000000 --- a/mdop/mbam-v1/troubleshooting-mbam-10.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting MBAM 1.0 -description: Troubleshooting MBAM 1.0 -author: dansimp -ms.assetid: 7d47fbfe-51c0-4619-bed3-163dfd18cdec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting MBAM 1.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting MBAM 1.0 - - -- [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](index.md) - -- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -- [Planning for MBAM 1.0](planning-for-mbam-10.md) - -- [Deploying MBAM 1.0](deploying-mbam-10.md) - -- [Operations for MBAM 1.0](operations-for-mbam-10.md) - -  - -  - - - - - diff --git a/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md b/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md deleted file mode 100644 index eb7557d3a6..0000000000 --- a/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md +++ /dev/null @@ -1,389 +0,0 @@ ---- -title: Understanding MBAM Reports -description: Understanding MBAM Reports -author: dansimp -ms.assetid: 34e4aaeb-7f89-41a1-b816-c6fe8397b060 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding MBAM Reports - - -Microsoft BitLocker Administration and Monitoring (MBAM) generates various reports to monitor BitLocker usage and compliance. This topic describes the MBAM reports for enterprise compliance, individual computers, hardware compatibility, and key recovery activity. - -## Understanding Reports - - -To access the Reports feature of MBAM, open the MBAM administration website. Select **Reports** in the navigation pane. Then, in the main content pane, click the tab for your report type: **Enterprise Compliance Report**, **Computer Compliance Report**, **Hardware Audit Report**, or **Recovery Audit Report**. - -### Enterprise Compliance Report - -An Enterprise Compliance Report provides information on overall BitLocker compliance in your organization. The available filters for this report allow you to narrow your search results according to Compliance state and Error status. This report runs every six hours. - -**Enterprise Compliance Report fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    The user-specified DNS name that is being managed by MBAM.

    Domain Name

    The fully qualified domain name where the client computer resides and is managed by MBAM.

    Compliance Status

    The state of compliance for the computer, according to the policy specified for the computer. The possible states are Noncompliant and Compliant. For more information, see Enterprise Compliance Report Compliance States in this topic.

    Exemption

    The state of the computer hardware for determining the identification of the hardware type and whether the computer is exempt from policy. There are three possible states: Hardware Unknown (the hardware type has not been identified by MBAM), Hardware Exempt (the hardware type was identified and was marked as exempt from MBAM policy), and Not Exempt (the hardware was identified and is not exempt from policy).

    Device Users

    Known users on the computer that is being managed by MBAM.

    Compliance Status Details

    Error and status messages about the compliance state of the computer in accordance to the specified policy.

    Last Contact

    Date and time when the computer last contacted the server to report compliance status. This time is configurable. See MBAM policy settings.

    - - - -**Enterprise Compliance Report Compliance states** - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Compliance StatusExemptionDescriptionUser Action

    Noncompliant

    Not Exempt

    The computer is noncompliant according to the specified policy, and the hardware type has not been indicated as exempt from policy.

    Click Computer Name to expand the Computer Compliance Report and determine whether the state of each drive complies with the specified policy. If the encryption state indicates that the computer is not encrypted, encryption might still be in process, or there might be an error on the computer. If there is no error, the likely cause is that the computer is still in the process of connecting or establishing the encryption status. Check back later to determine if the state changes.

    Compliant

    Not Exempt

    The computer is compliant in accordance with the specified policy.

    No Action needed. Optionally, you can view the Computer Compliance Report to confirm the state of the computer.

    Compliant

    Hardware Exempt

    If the Hardware type is exempt. Regardless of how the policy is set or the individual status of each hard-drive, the overall state is considered to be compliant.

    No action needed.

    Compliant

    Hardware Unknown

    MBAM recognizes the hardware type, but MBAM does not know whether it is exempt or not exempt. This occurs if the administrator has not set the Compatible status for the hardware. Therefore, MBAM reverts to Compliant status by default.

    This is the initial state of a newly deployed MBAM client. It is typically only a transient state. Even if the administrator has marked the Hardware as Compatible, there can be a significant delay or configurable wait time before the client computer reports back in. Make note of the time of Last Contact, and check in again after the specified interval to see if the state has changed. If the state has not changed, there may be an error for this computer or hardware type.

    - - - -### Computer Compliance Report - -The Computer Compliance Report displays information that is specific to a computer or user. - -The Computer Compliance Report provides detailed encryption information and applicable policies for each drive on a computer, including operating system drives and fixed data drives. To view this report type, click the computer name in the Enterprise Compliance Report or type the computer name in the Computer Compliance Report. To view the details of each drive, expand the Computer Name entry. - -**Note**   -This report does not provide encryption status for Removable Data Volumes. - - - -**Computer Compliance Report fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    The user-specified DNS computer name that is being managed by MBAM.

    Domain Name

    The fully qualified domain name where the client computer resides and is managed by MBAM.

    Computer Type

    The portability type of computer. Valid types are non-Portable and Portable.

    Operating System

    Operating System type installed on the MBAM managed client computer.

    Compliance Status

    The overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. While it is possible to have Compliant and Noncompliant drives in the same computer, this field indicates the overall computer compliance per specified policy.

    Policy Cypher Strength

    The Cipher Strength selected by the Administrator during MBAM policy specification. For example, 128-bit with Diffuser

    Policy Operating System Drive

    Indicates whether encryption is required for the O/S and the protector type as applicable.

    Policy Fixed Data Drive

    Indicates whether encryption is required for the Fixed Drive.

    Policy Removable Data Drive

    Indicates whether encryption is required for the Removable Drive.

    Device Users

    Provides the identity of known users on the computer.

    Exemption

    Indicates whether the computer hardware type is recognized by MBAM and, if known, whether the computer has been indicated as exempt from policy. There are three states: Hardware Unknown (the hardware type has not been identified by MBAM); Hardware Exempt (the hardware type was identified and was marked as exempt from MBAM policy); and Not Exempt (the hardware was identified and is not exempt from policy).

    Manufacturer

    The computer manufacturer name as it appears in the computer BIOS.

    Model

    The computer manufacturer model name as it appears in the computer BIOS.

    Compliance Status Details

    Error and status messages of the compliance state of the computer in accordance with the specified policy.

    Last Contact

    Date and time that the computer last contacted the server to report compliance status. T

    - - - -**Computer Compliance Report Drive fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Drive Letter

    Computer drive letter that was assigned to this particular drive by the user.

    Drive Type

    Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

    Cypher Strength

    Cipher Strength selected by the Administrator during MBAM policy specification.

    Protector Type

    Type of protector selected via policy used to encrypt an operating system or Fixed volume. The valid protector types on an operating system drive are TPM or TPM+PIN. The only valid protector type for a Fixed Data Volume is Password.

    Protector State

    This field indicates whether the computer has enabled the protector type specified in the policy. The valid states are ON or OFF.

    Encryption State

    This is the current encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

    Compliance Status

    Indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant.

    Compliance Status Details

    Contains error and status messages regarding the compliance state of the computer.

    - - - -### Hardware Audit Report - -This report can help you audit changes to the Hardware Compatibility status of specific computer makes and models. To help you narrow your search results, this report includes filtering on criteria such as type of change and time of occurrence. Each state change is tracked by user and date and time. The Hardware Type is automatically populated by the MBAM agent that runs on the client computer. This report tracks user changes to the information collected directly from the MBAM managed computer. A typical administrative change is changing from Compatible to incompatible. However, the administrator can also revise any field. - -**Hardware Audit Report fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Date and Time

    Date and time that a change was made to the Hardware Type. Note that every unique hardware type is assigned to at least one entry.

    User

    Administrative user that has made the change for the particular entry.

    Change Type

    Type of change that was made to the hardware type information. Valid values are Addition (new entry), Update (change existing entry), or Deletion (remove existing entry).

    Original Value

    Value of the hardware type specification before the change was made.

    Current Value

    Value of the hardware type specification after the change was made.

    - - - -### Recovery Audit Report - -The Recovery Audit Report can help you audit users who have requested access to recovery keys. The filter criteria for this report includes type of user making the request, type of key requested, time of occurrence, success or fail, time of occurrence, and type of user requesting (help desk, end user). This report enables administrators to produce contextual reports based on need. - -**Recovery Audit Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Request Date and Time

    The date and time that a key retrieval request was made by an end user or help desk user.

    Request Status

    Status of the request. Valid statuses are either Successful (the key was retrieved) or Failed (the key was not retrieved).

    Helpdesk User

    The help desk user who initiated the request for key retrieval. If the help desk user retrieves the key on behalf of an end user, the End User field will be blank.

    User

    The end user who initiated the request for key retrieval.

    Key Type

    The type of key that was requested. MBAM collects three key types: Recovery Key Password (to recovery a computer in recovery mode); Recovery Key ID (to recover a computer in recovery mode on behalf of another user); and Trusted Platform Module (TPM) Password Hash (to recover a computer with a locked TPM).

    Reason Description

    The reason that the specified Key Type was requested. The reasons are specified in the Drive Recovery and Manage TPM features of the Administrative web site. Valid entries include user-entered text or one of the following reason codes:

    -
      -
    • Operating System Boot Order changed

    • -
    • BIOS changed

    • -
    • Operating System files changed

    • -
    • Lost Startup key

    • -
    • Lost PIN

    • -
    • TPM Reset

    • -
    • Lost Passphrase

    • -
    • Lost Smartcard

    • -
    • Reset PIN lockout

    • -
    • Turn on TPM

    • -
    • Turn off TPM

    • -
    • Change TPM password

    • -
    • Clear TPM

    • -
    -

    - - - -**Note**   -To save report results to a file, click the **Export** button on the reports menu bar. - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) - - - - - - - - - diff --git a/mdop/mbam-v2/TOC.md b/mdop/mbam-v2/TOC.md deleted file mode 100644 index 4bb822bfb4..0000000000 --- a/mdop/mbam-v2/TOC.md +++ /dev/null @@ -1,73 +0,0 @@ -# [Microsoft BitLocker Administration and Monitoring 2](index.md) -## [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) -### [About MBAM 2.0](about-mbam-20-mbam-2.md) -#### [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md) -### [About MBAM 2.0 SP1](about-mbam-20-sp1.md) -#### [Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md) -### [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md) -### [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md) -### [Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md) -## [Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) -### [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) -#### [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) -#### [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) -#### [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) -### [Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) -#### [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) -#### [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) -#### [Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) -### [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) -## [Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) -### [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) -#### [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md) -#### [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md) -#### [How to Use a Command Line to Install the MBAM Server](how-to-use-a-command-line-to-install-the-mbam-server.md) -#### [How to Brand the Self-Service Portal](how-to-brand-the-self-service-portal.md) -### [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) -#### [How to Install the MBAM 2.0 Group Policy Template](how-to-install-the-mbam-20-group-policy-template-mbam-2.md) -#### [How to Edit MBAM 2.0 GPO Settings](how-to-edit-mbam-20-gpo-settings-mbam-2.md) -#### [How to Hide Default BitLocker Encryption in the Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md) -### [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) -#### [How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md) -#### [How to Deploy the MBAM Client as Part of a Windows Deployment](how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md) -#### [How to Use a Command Line to Install the MBAM Client](how-to-use-a-command-line-to-install-the-mbam-client.md) -### [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md) -### [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md) -## [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) -### [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) -#### [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md) -#### [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md) -#### [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) -##### [How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md) -###### [Edit the Configuration.mof File](edit-the-configurationmof-file.md) -###### [Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file.md) -##### [How to Install MBAM with Configuration Manager](how-to-install-mbam-with-configuration-manager.md) -##### [How to Validate the MBAM Installation with Configuration Manager](how-to-validate-the-mbam-installation-with-configuration-manager.md) -#### [Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md) -### [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) -#### [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md) -#### [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md) -#### [How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md) -### [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) -#### [Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md) -#### [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md) -### [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) -#### [How to Use the Help Desk Portal](how-to-use-the-help-desk-portal.md) -#### [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-2.md) -#### [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-2.md) -#### [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-2.md) -#### [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-2.md) -#### [How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md) -#### [How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md) -#### [Helping End Users Manage BitLocker](helping-end-users-manage-bitlocker.md) -##### [Using Your PIN or Password](using-your-pin-or-password.md) -##### [About the Computer TPM Chip](about-the-computer-tpm-chip.md) -### [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) -#### [High Availability for MBAM 2.0](high-availability-for-mbam-20-mbam-2.md) -#### [How to Move MBAM 2.0 Features to Another Computer](how-to-move-mbam-20-features-to-another-computer-mbam-2.md) -### [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) -#### [MBAM 2.0 Security Considerations](mbam-20-security-considerations-mbam-2.md) -#### [MBAM 2.0 Privacy Statement](mbam-20-privacy-statement-mbam-2.md) -### [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md) -## [Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - diff --git a/mdop/mbam-v2/about-mbam-20-mbam-2.md b/mdop/mbam-v2/about-mbam-20-mbam-2.md deleted file mode 100644 index 9fb055be15..0000000000 --- a/mdop/mbam-v2/about-mbam-20-mbam-2.md +++ /dev/null @@ -1,115 +0,0 @@ ---- -title: About MBAM 2.0 -description: About MBAM 2.0 -author: dansimp -ms.assetid: b43a0ba9-1c83-4854-a2c5-14eea0070e36 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About MBAM 2.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 provides a simplified administrative interface to BitLocker drive encryption. BitLocker offers enhanced protection against data theft or data exposure for computers that are lost or stolen. BitLocker encrypts all data that is stored on the Windows operating system volume and configured data volumes. - -## About MBAM 2.0 - - -BitLocker Administration and Monitoring 2.0 enforces the BitLocker encryption policy options that you set for your enterprise, monitors the compliance of client computers with those policies, and reports on the encryption status of both the enterprise and the individual computers. In addition, MBAM lets you access the recovery key information when users forget their PIN or password, or when their BIOS or boot record changes. - -**Note**   -BitLocker is not covered in detail in this guide. For an overview of BitLocker, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013). - - - -The following groups might be interested in using MBAM to manage BitLocker: - -- Administrators, IT security professionals, and compliance officers who are responsible for ensuring that confidential data is not disclosed without authorization - -- Administrators who are responsible for computer security in remote or branch offices - -- Administrators who are responsible for client computers that are running Windows - -## What’s New in MBAM 2.0 - - -MBAM 2.0 provides the following new features and functionality. - -### Integration of System Center Configuration Manager with MBAM - -MBAM now supports integration with System Center Configuration Manager. This integration moves the MBAM compliance infrastructure into the native environment of Configuration Manager. IT administrators who use Configuration Manager in their enterprise can now view the compliance status of their enterprise in the Microsoft Management Console and drill into reports to view individual computers. - -### Hardware Compatibility is Available Only in the Configuration Manager Integration Topology - -Integrating Configuration Manager with MBAM enables Configuration Manager capabilities that allow or prohibit the use of certain hardware types with MBAM and provides more flexibility than the hardware compatibility that was available in MBAM 1.0. IT administrators can create their own collections to limit hardware and can deploy the MBAM configuration baseline to those collections. The MBAM hardware compatibility that was present in MBAM 1.0 is now available only in the MBAM Configuration Manager topology and is administered from Configuration Manager. - -### Protectors Flexible Policy - -Computers that are already encrypted with a protector (for example, TPM + PIN or Auto-Unlock and password) and that receive an MBAM policy that requires a subset of that encryption (for example, TPM or Auto-Unlock) are considered compliant. In the example above, PIN and password would not be removed automatically unless the IT administrator specifically defines these features as no longer allowed. - -Computers that are not encrypted and that receive an MBAM policy (for example, TPM or Auto-Unlock) are encrypted accordingly. Users who are local administrators are allowed to use the BitLocker tools (Control Panel item BitLocker Drive Encryption or Manage-bde) to add or modify the existing protectors (for example, TPM + PIN or Auto-Unlock and password). They remain compliant unless MBAM policies specifically define them. - -### Ability to Upgrade the MBAM Client - -The MBAM 2.0 Client Windows Installer detects the version of the existing client and performs the required steps to upgrade to the MBAM 2.0 Client from previous versions. - -### Ability to Upgrade the MBAM Server from Previous Versions - -You can upgrade the MBAM 2.0 Server infrastructure from previous versions of MBAM as follows: - -**Manual in-place server replacement** – You must manually uninstall the existing MBAM server infrastructure, and then install the MBAM 2.0 Server infrastructure. You do not have to remove the databases to do the upgrade. Instead, you select the existing databases, which the previous version of the MBAM Client created. The MBAM 2.0 upgrade installation then migrates the existing databases to MBAM 2.0. - -**Distributed client upgrade** – If you are using the Stand-alone MBAM topology, you can upgrade the MBAM Clients gradually after you install the MBAM 2.0 Server infrastructure. The MBAM 2.0 Server detects the version of the existing Client and performs the required steps to upgrade to the 2.0 Client. - -After you upgrade the MBAM 2.0 Server infrastructure, MBAM 1.0 Clients continue to report to the MBAM 2.0 Server successfully, escrowing recovery data, but compliance will be based on the policies in MBAM 1.0. You must upgrade clients to MBAM 2.0 to have client computers accurately report compliance against the MBAM 2.0 policies. You can upgrade the clients to the MBAM 2.0 Client without uninstalling the previous client, and the client will start to apply and report MBAM 2.0 policies. - -If you are using MBAM with Configuration Manager, you must upgrade the MBAM 1.0 clients to MBAM 2.0. - -### MBAM Support for BitLocker’s Enterprise Scenarios on the Windows 8 Platform - -MBAM supports the Windows 8 operating system as a target platform for the MBAM Client installation. This support enables IT administrators to install the MBAM agent, to encrypt Windows 8 operating system drives, and to report on the compliance of the computers. MBAM leverages the TPM and TPM+PIN protectors to manage the Windows 8 operating system just as it does the Windows 7 operating system. MBAM 2.0 also adds support for encrypting Windows To Go clients. - -### Addition of the Self-Service Portal - -End users can now use the Self-Service Portal to recover their recovery keys. The Self-Service Portal can be deployed on a single server with the other MBAM features, or on a separate server that gives IT administrators the flexibility to expose the Self-Server Portal to users, as required. After the Self-Service Portal authenticates users, users have to enter only the first eight digits of the recovery key ID to receive their recovery key. - -MBAM also secures the key by allowing users to recover keys only for those computers on which they are users, which reduces the risk that other users gain unauthorized access. - -### Ability to Automatically Resume BitLocker Protection from a Suspended State - -MBAM no longer allows IT administrators to keep BitLocker suspended and unprotected for prolonged periods of time. If an IT administrator suspends BitLocker, MBAM re-enables it automatically when the computer is rebooted, which reduces the risk that the computer can be attacked. - -### Fixed Data Drives Can Be Configured to Automatically Unlock Without a Password - -A Fixed Data Drive (FDD) policy can now be configured to allow automatic unlocking of the drive without a password. Users are not prompted for a password before the FDD is encrypted, and the FDD will be secured and auto-unlocked with the operating system drive. - -## MBAM 2.0 Release Notes - - -For more information, and for late-breaking news that is not included in the documentation, see the [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md). - -## How to Get MBAM 2.0 - - -This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP?](https://go.microsoft.com/fwlink/p/?LinkId=322049) - -## Related topics - - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/about-mbam-20-sp1.md b/mdop/mbam-v2/about-mbam-20-sp1.md deleted file mode 100644 index cb1d4df6a7..0000000000 --- a/mdop/mbam-v2/about-mbam-20-sp1.md +++ /dev/null @@ -1,477 +0,0 @@ ---- -title: About MBAM 2.0 SP1 -description: About MBAM 2.0 SP1 -author: dansimp -ms.assetid: 5ba89ed8-bb6e-407b-82c2-e2e36dd1078e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About MBAM 2.0 SP1 - -This topic describes the changes in Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1). For a general description of MBAM, see [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md). - -## What’s new in MBAM 2.0 SP1 - -This version of MBAM provides the following new features and functionality. - -### Support for Windows 8.1, Windows Server 2012 R2, and System Center 2012 R2 Configuration Manager - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1) adds support for Windows 8.1, Windows Server 2012 R2, and System Center 2012 R2 Configuration Manager. - -### Support for Microsoft SQL Server 2008 R2 SP2 - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1) adds support for Microsoft SQL Server 2008 R2 SP2. You must use Microsoft SQL Server 2008 R2 or higher if you are running Microsoft System Center Configuration Manager 2007 R2. - -### Customer feedback rollup - -MBAM 2.0 SP1 includes a rollup of fixes to address issues that were found since the Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 release. As part of these changes, the Computer Name field now appears in the BitLocker Computer Compliance and BitLocker Enterprise Compliance Details reports when you run MBAM with Microsoft System Center Configuration Manager 2007. - -### Firewall exception must be set on ports for the Self-Service Portal and the Administration and Monitoring website - -When you configure the Self-Service Portal and the Administration and Monitoring website, you must set a firewall exception to enable communication through the specified ports. Previously, the MBAM server installation opened the ports automatically in Windows Firewall. - -### Location of MBAM reports has changed in Configuration Manager - -MBAM reports for the Configuration Manager integrated topology are now available under subfolders within the MBAM node. The subfolder names represent the language of the reports within the subfolder. - -### Ability to install MBAM on a primary site server when you install MBAM with Configuration Manager - -You can install MBAM on a primary site server or a central administration site server when you install MBAM with the Configuration Manager integrated topology. Previously, you were required to install MBAM on a central administration site server. - -**Important** -The server on which you install MBAM must be the top-tier server in your hierarchy. - - - -The MBAM installation works differently for Microsoft System Center Configuration Manager 2007 and Microsoft System Center 2012 Configuration Manager as follows: - -- **Configuration Manager 2007** : If you install MBAM on a primary site server that is part of a larger Configuration Manager hierarchy and has a central site parent server, MBAM resolves the central site parent server and performs all of the installation actions on that parent server. The installation actions include checking prerequisites and installing the Configuration Manager objects and reports. For example, if you install MBAM on a primary site server that is a child of a central site parent server, MBAM installs all of the Configuration Manager objects and reports on the parent server. If you install MBAM on the parent server, MBAM performs all of the installation actions on that parent server. - -- **System Center 2012 Configuration Manager** : If you install MBAM on a primary site server or on a central administration server, MBAM performs all of the installation actions on that site server. - -### Configuration Manager Console must be installed on the computer on which you install the MBAM Server - -When you install MBAM with the Configuration Manager integrated topology, you must install the Configuration Manager Console on the same computer on which MBAM will be installed. If you use the recommended architecture, which is described in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md), you would install MBAM on the Configuration Manager Primary Site Server. - -### New setup command-line parameters for the Configuration Manager integrated topology - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Command-Line ParameterDescriptionExample

    CM_SSRS_REMOTE_SERVER_NAME

    Enables you to install the Configuration Manager reports on a remote SQL Server Reporting Services (SSRS) server that is part of the same Configuration Manager site to which MBAM is installed. You can set the value to the fully qualified domain name of the remote SSRS point role server.

    MbamSetup.exe CM_SSRS_REMOTE_SERVER_NAME=ssrsServer.Contoso.com

    CM_REPORTS_ONLY

    Enables you to install only the Configuration Manager reports, without other Configuration Manager objects, such as the baseline, collection, and configuration items.

    -
    -Note

    You must combine this parameter with the CM_REPORTS_COLLECTION_ID parameter.

    -
    -
    - -
    -

    Valid parameter values:

    -
      -
    • True

    • -
    • False

    • -
    -

    You can combine this parameter with the CM_SSRS_REMOTE_SERVER_NAME parameter if you want to install the reports only to a remote SSRS point role server.

    -

    If you do not set the parameter or if you set it to False, MBAM Setup installs all of the Configuration Manager objects, including the reports.

    MbamSetup.exe CM_REPORTS_ONLY=True

    -

    CM_REPORTS_COLLECTION_ID=SMS00001

    CM_REPORTS_COLLECTION_ID

    An existing collection ID that identifies the collection for which reporting compliance data will be displayed. You can specify any collection ID. You are not required to use the “MBAM Supported Computers” collection ID.

    MbamSetup.exe CM_REPORTS_ONLY=True

    -

    CM_REPORTS_COLLECTION_ID=SMS00001

    - - - -### Ability to turn Self-Service Portal notice text on or off - -MBAM 2.0 SP1 enables you to turn off the notice text on the Self-Service Portal. Previously, the notice text displayed by default, and you could not turn it off. - -**To turn off the notice text** - -1. On the server where you installed the Self-Service Portal, open Internet Information Services (IIS) and browse to **Sites > Microsoft BitLocker Administration and Monitoring > SelfService > Application Settings**. - -2. From the **Name** column, select **DisplayNotice**, and set the value to **false**. - -### Ability to localize the HelpdeskText statement that points users to more Self-Service Portal information - -You can configure a localized version of the Self-Service Portal “HelpdeskText” statement, which tells end users how to get additional help when they are using the Self-Service Portal. If you configure localized text for the statement, as described in the following instructions, MBAM will display the localized version. If MBAM does not find the localized version, it displays the value that is in the **HelpdeskText** parameter. - -**To display a localized version of the HelpdeskText statement** - -1. On the server where you installed the Self-Service Portal, open IIS and browse to **Sites > Microsoft BitLocker Administration and Monitoring > SelfService > Application Settings**. - -2. In the **Actions** pane, click **Add** to open the **Add Application Setting** dialog box. - -3. In the **Name** field, type **HelpdeskText**\_<*language*>, where <*language*> is the appropriate language code for the text. For example, to create a localized HelpdeskText statement in Spanish, you would name the parameter HelpdeskText\_es-es. For a list of the valid language codes that you can use, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947). - -4. In the **Value** field, type the localized text that you want to display to end users. - -### Ability to localize the Self-Service Portal HelpdeskURL - -You can configure a localized version of the Self-Service Portal HelpdeskURL to display to end users by default. If you create a localized version, as described in the following instructions, MBAM finds and displays the localized version. If MBAM does not find a localized version, it displays the URL that is configured for the HelpDeskURL parameter. - -**To display a localized HelpdeskURL** - -1. On the server where you installed the Self-Service Portal, open IIS and browse to **Sites > Microsoft BitLocker Administration and Monitoring > SelfService > Application Settings**. - -2. In the **Actions** pane, click **Add** to open the **Add Application Setting** dialog box. - -3. In the **Name** field, type **HelpdeskURL**\_<*language*>, where <*language*> is the appropriate language code for the URL. For example, to create a localized HelpdeskURL in Spanish, you would name the parameter HelpdeskURL\_es-es. For a list of the valid language codes you can use, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947). - -4. In the **Value** field, type the localized HelpdeskURL that you want to display to end users. - -### Ability to localize the Self-Service Portal notice text - -You can configure localized notice text to display to end users by default in the Self-Service Portal. The notice.txt file, which displays the notice text, is located in the following root directory: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - -To display localized notice text, you create a localized notice.txt file and save it under a specific language folder in the following directory: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - -MBAM displays the notice text, based on the following rules: - -- If you create a localized notice.txt file in the appropriate language folder, MBAM displays the localized notice text. - -- If MBAM does not find a localized version of the notice.txt file, it displays the text in the default notice.txt file. - -- If MBAM does not find a default notice.txt file, it displays the default text in the Self-Service Portal. - -**Note** -If an end user’s browser is set to a language that does not have a corresponding language subfolder or notice.txt, the text that is in the notice.txt file in the following root directory is displayed: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - - - -**To create a localized notice.txt file** - -1. On the server where you installed the Self-Service Portal, create a <*language*> folder in the following directory, where <*language*> represents the name of the localized language: - - <*MBAM Self-Service Install Directory*>\\Self Service Website\\ - - **Note** - Some language folders already exist, so you may not have to create one. If you do need to create a language folder, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947) for a list of the valid names that you can use for the <*language*> folder. - - - -2. Create a notice.txt file that contains the localized notice text. - -3. Save the notice.txt file in the <*language*> folder. For example, to create a localized notice.txt file in Spanish, you would save the localized notice.txt file in the following folder: - - <*MBAM Self-Service Install Directory*>\\Self Service Website\\es-es - -## Upgrading to MBAM 2.0 SP1 - - -You can upgrade to MBAM 2.0 SP1 from any previous version of MBAM. - -### Upgrading the MBAM infrastructure - -You can upgrade the MBAM Server infrastructure to MBAM 2.0 SP1 as follows: - -**Manual in-place server replacement**: You must manually uninstall the existing MBAM Server infrastructure, and then install the MBAM 2.0 SP1 Server infrastructure. You do not have to remove the databases to do the upgrade. Instead, you select the existing databases, which the previous version of MBAM created. The MBAM 2.0 SP1 upgrade installation then migrates the existing databases to MBAM 2.0 SP1. - -**Distributed client upgrade**: If you are using the Stand-alone MBAM topology, you can upgrade the MBAM Clients gradually after you install the MBAM 2.0 SP1 Server infrastructure. - -After you upgrade the MBAM Server infrastructure, MBAM 1.0 or 2.0 Clients will report to the MBAM 2.0 SP1 Server successfully and will store the recovery data, but compliance will be based on the policies available for the MBAM Client version that is currently installed. To enable reporting against MBAM 2.0 SP1 policies, you must upgrade client computers to MBAM 2.0 SP1. You can upgrade the client computers to the MBAM 2.0 SP1 Client without uninstalling the previous Client, and the Client will start to apply and report, based on the MBAM 2.0 SP1 policies. - -For more information about upgrading the MBAM servers, see [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md). - -### Upgrading the MBAM Client to MBAM 2.0 SP1 - -To upgrade end-user computers to the MBAM 2.0 SP1 Client, run **MbamClientSetup.exe** on each client computer. The installer automatically updates the Client to the MBAM 2.0 SP1 Client. After the installation, client computers do not have to be rebooted, and the MBAM 2.0 SP1 Client starts to apply and report against MBAM 2.0 SP1 policies. - -If you are using MBAM with Configuration Manager, you must upgrade the MBAM client computers to MBAM 2.0 SP1. - -For more information about upgrading the MBAM client computers, see [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md). - -## Installing or upgrading to MBAM 2.0 SP1 with Configuration Manager - - -This section describes the requirements when you are installing MBAM 2.0 SP1 as a new installation or as an upgrade to a previous MBAM 2.0 SP1 installation. - -### Required files for installing MBAM 2.0 SP1 if you are using MBAM with Configuration Manager - -If you are installing MBAM for the first time and you are using MBAM 2.0 SP1 with System Center Configuration Manager, you must create or edit mof files to enable MBAM to work correctly with Configuration Manager. - -- **configuration.mof file** - - - If you are using Configuration Manager 2007, you must edit the configuration.mof file by completing step 3 from the item **Update the configuration.mof file if you upgrade to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007**, which follows this item. - - - If you are using System Center 2012 Configuration Manager, edit the configuration.mof file by following the instructions in [Edit the Configuration.mof File](edit-the-configurationmof-file.md). - -- **sms\_def.mof file** – follow the instructions in [Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file.md). - -### Update the configuration.mof file if you upgrade to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007 - -If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007, you must update the configuration.mof file to ensure that MBAM 2.0 SP1 works correctly. - -**To update the configuration.mof file:** - -1. On the Configuration Manager Server, browse to the location of the Configuration.mof file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files (x86)\\Microsoft Configuration Manager. - -2. Review the block of code that you appended to the configuration.mof file, and delete it. The block of code will be similar to the one shown in the following step. - -3. Copy the following block of code, and then append it to the configuration.mof file to add the following required MBAM classes to the file: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - # pragma namespace ("\\\\.\\root\\cimv2") - # pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - }; - - # pragma namespace ("\\\\.\\root\\cimv2") - # pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - # pragma namespace ("\\\\.\\root\\cimv2") - # pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy_64 - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy_64 - { - KeyName="BitLocker policy 64"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - # pragma namespace ("\\\\.\\root\\cimv2") - # pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - # pragma namespace ("\\\\.\\root\\cimv2") - # pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - - ``` - -### Translation of MBAM 2.0 SP1 - -MBAM 2.0 SP1 is now available in the following languages: - -- English (United States) en-US -- French (France) fr-FR -- Italian (Italy) it-IT -- German (Germany) de-DE -- Spanish, International Sort (Spain) es-ES -- Korean (Korea) ko-KR -- Japanese (Japan) ja-JP -- Portuguese (Brazil) pt-BR -- Russian (Russia) ru-RU -- Chinese Traditional zh-TW -- Chinese Simplified zh-CN - -## How to Get MDOP Technologies - -MBAM 2.0 SP1 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Related topics - -[Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md) - - - - - - - - - diff --git a/mdop/mbam-v2/about-the-computer-tpm-chip.md b/mdop/mbam-v2/about-the-computer-tpm-chip.md deleted file mode 100644 index 8c951c73f2..0000000000 --- a/mdop/mbam-v2/about-the-computer-tpm-chip.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: About the Computer TPM Chip -description: About the Computer TPM Chip -author: dansimp -ms.assetid: 6f1cf18c-277a-4932-886d-14202ca8d175 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About the Computer TPM Chip - - -BitLocker provides additional protection when it is used with a Trusted Platform Module (TPM) chip. The TPM chip is a hardware component that is installed in many newer computers by the computer manufacturers. Microsoft BitLocker Administration and Monitoring (MBAM) uses BitLocker, in addition to the TPM chip, to help provide additional protection of your data and to make sure that your computer has not been tampered with. - -## How to Set Up Your TPM - - -When you start the BitLocker Drive Encryption wizard on your computer, BitLocker checks for a TPM chip if your organization has configured BitLocker to use a TPM chip. If BitLocker finds a compatible TPM chip, you may be prompted to restart your computer to enable the TPM chip for use. As soon as your computer has restarted, follow the instructions to configure the TPM chip in the BIOS (the BIOS is a pre-Windows layer of your computer software). - -After BitLocker is configured, you can access additional information about the TPM chip by opening the BitLocker Encryption Options tool in the Windows Control Panel, and then selecting **TPM Administration**. - -**Note**   -You must have administrative credentials on your computer to access this tool. - - - -In a TPM failure, a change in the BIOS, or certain Windows Updates, BitLocker will lock your computer and require you to contact your Help Desk to unlock it. You have to provide the name of your computer as well as your computer’s domain. Help Desk can give you a password file that can be used to unlock your computer. - -## Troubleshooting TPM Issues - - -If a TPM failure, change in the BIOS, or certain Windows Updates occur, BitLocker will lock your computer and require you to contact your Help Desk to unlock it. You have to provide the name of your computer as well as your computer’s domain. The Help Desk can give you a password file that you can use to unlock your computer. - -## Related topics - - -[Helping End Users Manage BitLocker](helping-end-users-manage-bitlocker.md) - -[Using Your PIN or Password](using-your-pin-or-password.md) - - - - - - - - - diff --git a/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md b/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md deleted file mode 100644 index 0103e4791e..0000000000 --- a/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Accessibility for MBAM 2.0 -description: Accessibility for MBAM 2.0 -author: dansimp -ms.assetid: 9cd628f1-f594-43ab-8095-4663272940a9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for MBAM 2.0 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access Any Command with a Few Keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in Alternative Formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - - - -## Customer Service for People with Hearing Impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For More Information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Related topics - - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md b/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md deleted file mode 100644 index fc6335b69f..0000000000 --- a/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Administering MBAM 2.0 Features -description: Administering MBAM 2.0 Features -author: dansimp -ms.assetid: 065e0704-069e-4372-9b86-0b57dd7638dd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 2.0 Features - - -After completing all necessary planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use it to manage BitLocker encryption across the enterprise The information in this section describes post-installation day-to-day Microsoft BitLocker Administration and Monitoring feature operations tasks. - -## Manage MBAM Administrator Roles - - -After MBAM Setup is complete for all server features, administrative users have to be granted access to them. As a best practice, administrators who will manage or use MBAM server features should be assigned to Active Directory Domain Services security groups, and then those groups should be added to the appropriate MBAM administrative local group. - -[How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md) - -## Manage BitLocker Encryption Exemptions - - -MBAM lets you grant encryption exemptions to specific users who do not need or want their drives encrypted. Computer exemption is typically used when a company has computers that do not have to be encrypted, such as computers that are used in development or testing, or older computers that do not support BitLocker. In some cases, local law may also require that certain computers are not encrypted. - -[How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md) - -## Manage MBAM Client BitLocker Encryption Options by Using the Control Panel - - -MBAM provides a custom control panel, called BitLocker Encryption Options, that will appear under **System and Security**. The MBAM control panel can be used to unlock encrypted fixed and removable drives, and also manage your PIN or password. - -**Note**   -This customized control panel does not replace the default Windows BitLocker control panel. - - - -[How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md) - -## Other Resources for Administering MBAM Features - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md b/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md deleted file mode 100644 index 87d58f9e89..0000000000 --- a/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Administering MBAM 2.0 Using PowerShell -description: Administering MBAM 2.0 Using PowerShell -author: dansimp -ms.assetid: d785a8df-0a8c-4d70-abd2-93a762b4f3de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 2.0 Using PowerShell - - -Microsoft BitLocker Administration and Monitoring (MBAM) provides the following listed set of Windows PowerShell cmdlets. Administrators can use these PowerShell cmdlets to perform various Microsoft BitLocker Administration and Monitoring server tasks from the command line rather than from the MBAM administration website. - -## How to Administer MBAM Using PowerShell - - -Use the PowerShell cmdlets described here to administer MBAM. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDescription

    Install-Mbam

    Installs the MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting.

    Uninstall-Mbam

    Removes the MBAM features that provide advanced policy, encryption, key recovery, and compliance reporting tools.

    Get-MbamBitLockerRecoveryKey

    Requests an MBAM recovery key that will enable users to unlock a computer or encrypted drive.

    Get-MbamTPMOwnerPassword

    Provides users with a TPM owner password that they can use to unlock a Trusted Platform Module (TPM) when the TPM has locked them out and will no longer accept their PIN.

    - -  - -## Related topics - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md b/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md deleted file mode 100644 index 9d05e02689..0000000000 --- a/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md +++ /dev/null @@ -1,381 +0,0 @@ ---- -title: Create or Edit the Sms\_def.mof File -description: Create or Edit the Sms\_def.mof File -author: dansimp -ms.assetid: d1747e43-484e-4031-a63b-6342fe588aa2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/04/2017 ---- - - -# Create or Edit the Sms\_def.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to create or edit the Sms\_def.mof file. - -If you are using System Center 2012 Configuration Manager, you must create the file. - -In Configuration Manager 2007, the file already exists, so you only have to edit it. **Do not overwrite the existing file**. - -In the following sections, complete the instructions that correspond to the version of Configuration Manager that you are using. - -**To create the Sms\_def.mof file for System Center 2012 Configuration Manager** - -1. On the Configuration Manager Server, browse to the location where you have to create the Sms\_def.mof file, for example, the Desktop. - -2. Create a text file called **Sms\_def.mof** and copy the following code to populate the file with the following Sms\_def.mof MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("BitLocker Encryption Details"), - SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")] - class Win32_BitLockerEncryptionDetails : SMS_Class_Template - { - [ SMS_Report (TRUE), key ] - String DeviceId; - [ SMS_Report (TRUE) ] - String BitlockerPersistentVolumeId; - [ SMS_Report (TRUE) ] - String MbamPersistentVolumeId; - [ SMS_Report (TRUE) ] - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - SInt32 MbamVolumeType; - [ SMS_Report (TRUE) ] - String DriveLetter; - [ SMS_Report (TRUE) ] - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - SInt32 Compliant; - [ SMS_Report (TRUE) ] - SInt32 ReasonsForNonCompliance[]; - [ SMS_Report (TRUE) ] - SInt32 KeyProtectorTypes[]; - [ SMS_Report (TRUE) ] - SInt32 EncryptionMethod; - [ SMS_Report (TRUE) ] - SInt32 ConversionStatus; - [ SMS_Report (TRUE) ] - SInt32 ProtectionStatus; - [ SMS_Report (TRUE) ] - Boolean IsAutoUnlockEnabled; - }; - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0")] - - Class Win32Reg_MBAMPolicy: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - //Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Operating System Ex"), - SMS_Class_ID ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ] - class CCM_OperatingSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint32 SKU; - }; - - //Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Computer System Ex"), - SMS_Class_ID ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ] - class CCM_ComputerSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint16 PCSystemType; - }; - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -3. Import the **Sms\_def.mof** file by doing the following: - - 1. Open the **System Center 2012 Configuration Manager console** and select the **Administration** tab. - - 2. On the **Administration** tab, select **Client Settings**. - - 3. Right-click **Default Client Settings**, and then select **Properties**. - - 4. In the **Default Settings** window, select **Hardware Inventory**. - - 5. Click **Set Classes**, and then click **Import**. - - 6. In the browser that opens, select your **.mof** file, and then click **Open**. The **Import Summary** window opens. - - 7. In the **Import Summary** window, ensure that the option to import both hardware inventory classes and class settings is selected, and then click **Import**. - - 8. In both the **Hardware Inventory Classes** window and the **Default Settings** window, click **OK**. - -4. Enable the **Win32\_Tpm** class as follows: - - 1. Open the **System Center 2012 Configuration Manager console** and select the **Administration** tab. - - 2. On the **Administration** tab, select **Client Settings**. - - 3. Right-click **Default Client Settings**, and then select **Properties**. - - 4. In the **Default Settings** window, select **Hardware Inventory**. - - 5. Click **Set Classes**. - - 6. In the main window, scroll down, and then select the **TPM (Win32\_Tpm)** class. - - 7. Under **TPM**, ensure that the **SpecVersion** property is selected. - - 8. In both the **Hardware Inventory Classes** window and the **Default Settings** window, click **OK**. - -**To edit the sms\_def.mof file for Configuration Manager 2007** - -1. On the Configuration Manager Server, browse to the location of the **sms\_def.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive% \\Program Files (x86)\\Microsoft Configuration Manager. - -2. Copy the following code, and then append it to **Sms\_def.mof** file to add the following required MBAM classes to the file: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("BitLocker Encryption Details"), - SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")] - class Win32_BitLockerEncryptionDetails : SMS_Class_Template - { - [ SMS_Report (TRUE), key ] - String DeviceId; - [ SMS_Report (TRUE) ] - String BitlockerPersistentVolumeId; - [ SMS_Report (TRUE) ] - String MbamPersistentVolumeId; - [ SMS_Report (TRUE) ] - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - SInt32 MbamVolumeType; - [ SMS_Report (TRUE) ] - String DriveLetter; - [ SMS_Report (TRUE) ] - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - SInt32 Compliant; - [ SMS_Report (TRUE) ] - SInt32 ReasonsForNonCompliance[]; - [ SMS_Report (TRUE) ] - SInt32 KeyProtectorTypes[]; - [ SMS_Report (TRUE) ] - SInt32 EncryptionMethod; - [ SMS_Report (TRUE) ] - SInt32 ConversionStatus; - [ SMS_Report (TRUE) ] - SInt32 ProtectionStatus; - [ SMS_Report (TRUE) ] - Boolean IsAutoUnlockEnabled; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"), - SMS_Context_1("__ProviderArchitecture=32|uint32"), - SMS_Context_2("__RequiredArchitecture=true|boolean")] - Class Win32Reg_MBAMPolicy: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - // Encoded Computer Name - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"), - SMS_Context_1("__ProviderArchitecture=64|uint32"), - SMS_Context_2("__RequiredArchitecture=true|boolean")] - Class Win32Reg_MBAMPolicy_64: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - // Encoded Computer Name - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - //Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Operating System Ex"), - SMS_Class_ID ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ] - class CCM_OperatingSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint32 SKU; - }; - - //Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Computer System Ex"), - SMS_Class_ID ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ] - class CCM_ComputerSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -3. Modify the **Win32\_Tpm** class as follows: - - - Set **SMS\_REPORT** to **TRUE** in the class attributes. - - - Set **SMS\_REPORT** to **TRUE** in the **SpecVersion** property attribute. - -## Related topics - - -[How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md) - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md b/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md deleted file mode 100644 index da944127c7..0000000000 --- a/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Deploying MBAM 2.0 Group Policy Objects -description: Deploying MBAM 2.0 Group Policy Objects -author: dansimp -ms.assetid: f17f3897-73ab-431b-a6ec-5a6cff9f279a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 2.0 Group Policy Objects - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you first have to determine the Group Policies that you will use in your implementation of Microsoft BitLocker Administration and Monitoring. See [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) for more information on the different policies that are available. When you have determined the policies that you are going to use, you then must create and deploy one or more Group Policy Objects (GPO) that include the policy settings for MBAM by using the MBAM 2.0 Group Policy template. - -## Install the MBAM 2.0 Group Policy Template - - -In addition to the server-related Microsoft BitLocker Administration and Monitoring features, the server setup application includes a MBAM Group Policy template. This template can be installed on any computer able to run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -[How to Install the MBAM 2.0 Group Policy Template](how-to-install-the-mbam-20-group-policy-template-mbam-2.md) - -## Deploy MBAM 2.0 Group Policy Settings - - -After you create the necessary GPOs, you must deploy the MBAM Group Policy settings to your organization’s client computers. - -[How to Edit MBAM 2.0 GPO Settings](how-to-edit-mbam-20-gpo-settings-mbam-2.md) - -## Display the MBAM Control Panel in Windows - - -Because MBAM offers a customized MBAM control panel that can replace the default Windows BitLocker control panel, you can also choose to hide the default BitLocker Control Panel from end users by using Group Policy. - -[How to Hide Default BitLocker Encryption in the Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md) - -## Other Resources for Deploying MBAM 2.0 Group Policy Objects - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-mbam-20-mbam-2.md b/mdop/mbam-v2/deploying-mbam-20-mbam-2.md deleted file mode 100644 index 6f40b9722f..0000000000 --- a/mdop/mbam-v2/deploying-mbam-20-mbam-2.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Deploying MBAM 2.0 -description: Deploying MBAM 2.0 -author: dansimp -ms.assetid: 4b0eaf10-81b4-427e-9d43-eb833de935a3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 2.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) supports a number of different deployment configurations. This section includes information that you should consider about the deployment of MBAM and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -You can deploy MBAM either in a Stand-alone topology, or with a topology that integrates MBAM with Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager. For information about installing MBAM with the Configuration Manager integrated topology, see [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md). - -## Deployment Information - - -- [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - This section describes the different MBAM deployment topology options and how to use MBAM Setup to deploy MBAM Server features. - -- [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - - This section describes how to create and deploy MBAM Group Policy Objects that are required for managing MBAM Clients and BitLocker encryption policies throughout the enterprise. - -- [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - This section describes how to use the MBAM Client Installer files to deploy the MBAM Client software. - -- [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md) - - This section provides a deployment checklist that can be used to assist in MBAM Server feature and MBAM Client deployment. - -- [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md) - - This section provides instructions for upgrading MBAM from previous versions. - -## Other Resources for Deploying MBAM - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md b/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md deleted file mode 100644 index ae87ad3b57..0000000000 --- a/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Deploying MBAM with Configuration Manager -description: Deploying MBAM with Configuration Manager -author: dansimp -ms.assetid: 89d03e29-457a-471d-b893-e0b74a83ec50 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Deploying MBAM with Configuration Manager - - -The following procedures describe how to deploy Microsoft BitLocker Administration and Monitoring (MBAM) with Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager by usingthe recommended configuration, which is described in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md). The recommended configuration is to install the Administration and Monitoring features on one or more Microsoft BitLocker Administration and Monitoring servers, and install Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager on a separate server. - -Before you start the installation, ensure that you have met the prerequisites and hardware and software requirements for installing MBAM with Configuration Manager by reviewing [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -If you ever have to reinstall MBAM with the Configuration Manager topology, you will need to remove certain Configuration Manager objects first. Read the [Knowledge Base article](https://go.microsoft.com/fwlink/?LinkId=286306) for more information. - -The steps to install MBAM with Configuration Manager are grouped into the following categories. Complete the steps for each category to complete the installation. - -## How to Create or Edit the mof Files - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the **Configuration.mof** file, and either edit or create the Sms\_def.mof file, depending on which version of Configuration Manager you are using. - -[How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md) - -## How to Install MBAM with Configuration Manager - - -This section provides steps about how to install the following: MBAM on the Configuration Manager Server; the Recovery and Audit Databases on the Database Server; and the Administration and Monitoring Server features on the Administration and Monitoring Server. - -[How to Install MBAM with Configuration Manager](how-to-install-mbam-with-configuration-manager.md) - -## How to Validate the MBAM Server Feature Installation on the Configuration Manager Server - - -When the Microsoft BitLocker Administration and Monitoring installation is complete, validate that the installation has successfully set up all the necessary MBAM features required for the Configuration Manager Server. - -[How to Validate the MBAM Installation with Configuration Manager](how-to-validate-the-mbam-installation-with-configuration-manager.md) - -## Related topics - - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md b/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md deleted file mode 100644 index 66a8831e05..0000000000 --- a/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Deploying the MBAM 2.0 Client -description: Deploying the MBAM 2.0 Client -author: dansimp -ms.assetid: 3dd584fe-2a54-40f0-9bab-13ea74040b01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 2.0 Client - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an electronic software distribution system, such as Active Directory Domain Services, or by directly encrypting the client computers as part of the initial imaging process. - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring Client, you can enable BitLocker encryption on a computer in your organization either before the end user receives the computer or afterwards by configuring Group Policy and deploying the MBAM Client software by using an enterprise software deployment system. - -## Deploy the MBAM Client to Desktop or Laptop Computers - - -After configuring Group Policy, you can use an enterprise software deployment system product like Microsoft System Center Configuration Manager 2012 or Active Directory Domain Services to deploy the MBAM Client installation Windows Installer files to target computers. You can deploy the client by using either the 32-bit or 64-bit MbamClientSetup.exe files, or the 32-bit or 64-bit MBAMClient.msi files, which are provided with the MBAM software. For more information about deploying MBAM Group Policy Objects, see [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md). - -[How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md) - -## Deploy the MBAM Client as Part of a Windows Deployment - - -In organizations where computers are received and configured centrally, you can install the MBAM Client to manage BitLocker encryption on each computer before any user data is written to it. The benefit of this process is that every computer is then BitLocker encryption compliant. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. If the Group Policy has been configured to require a PIN, users are prompted to set a PIN after they receive the Group Policy. - -[How to Deploy the MBAM Client as Part of a Windows Deployment](how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md) - -## How to Use a Command Line to Install the MBAM Client - - -This section explains how to install the MBAM Client by using a command line. - -[How to Use a Command Line to Install the MBAM Client](how-to-use-a-command-line-to-install-the-mbam-client.md) - -## Other Resources for Deploying the MBAM Client - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md)[Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md b/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md deleted file mode 100644 index ba8831debe..0000000000 --- a/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Deploying the MBAM 2.0 Server Infrastructure -description: Deploying the MBAM 2.0 Server Infrastructure -author: dansimp -ms.assetid: 52e68d94-e2b4-4b06-ae55-f900ea6cc59f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 2.0 Server Infrastructure - - -Microsoft BitLocker Administration and Monitoring (MBAM) Server features for the Stand-alone topology can be installed in different configurations on two or more servers in a production environment. The recommended configuration is two servers for a production environment, depending on your scalability requirements. Use a single server for an MBAM installation only in test environments. For more information about planning for the MBAM Server feature deployment, see [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md). - -The following diagram shows an example of how you can configure the recommended two-server MBAM deployment. This configuration supports up to 200,000 MBAM clients in a production environment. The server features and databases in the architecture image are described in the following section and are listed under the computer or server where we recommend that you install them. - -![mbam 2 two-server deployment topology](images/mbam2-3-servers.gif) - -## Administration and Monitoring Server - - -The following features are installed on this server: - -- **Administration and Monitoring Server**. The Administration and Monitoring Server feature is installed on a Windows server and consists of the Help Desk website and the monitoring web services. - -- **Self-Service Portal**. The Self-Service Portal is installed on a Windows server. The Self-Service Portal enables end users on client computers to independently log on to a website, where they can obtain a recovery key to recover a locked BitLocker volume. - -## Database Server - - -The following features are installed on this server: - -- **Recovery Database**. The Recovery Database is installed on a Windows server and a supported instance of Microsoft SQL Server. This database stores recovery data that is collected from MBAM client computers. - -- **Compliance and Audit Database**. The Compliance and Audit Database is installed on a Windows server and a supported instance of SQL Server. This database stores compliance data for MBAM client computers. This data is used primarily for reports that SQL Server Reporting Services (SSRS) hosts. - -- **Compliance and Audit Reports**. The Compliance and Audit Reports are installed on a Windows server and a supported instance of SQL Server that has the SQL Server Reporting Services (SSRS) feature installed. These reports provide MBAM reports that you can access from the Help Desk website or directly from the SSRS server. - -## Management Workstation - - -The following feature is installed on the Management Workstation, which can be a Windows server or a client computer. - -- **Policy Template**. The Policy Template consists of Group Policies that define MBAM implementation settings for BitLocker drive encryption. You can install the Policy template on any server or workstation, but it is commonly installed on a management workstation, which is a supported Windows server or client computer. The workstation does not have to be a dedicated computer. - -## MBAM Client - - -The MBAM Client is installed on a Windows computer and has the following characteristics: - -- Uses Group Policy to enforce the BitLocker drive encryption of client computers in the enterprise. - -- Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives. - -- Collects compliance data for the computer and passes the data to the reporting system. - -## Other Resources for Deploying MBAM 2.0 Server Features - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/edit-the-configurationmof-file.md b/mdop/mbam-v2/edit-the-configurationmof-file.md deleted file mode 100644 index d1b6c423a7..0000000000 --- a/mdop/mbam-v2/edit-the-configurationmof-file.md +++ /dev/null @@ -1,389 +0,0 @@ ---- -title: Edit the Configuration.mof File -description: Edit the Configuration.mof File -author: dansimp -ms.assetid: 23e50ec9-4083-4b12-ad96-626cf30960bb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/03/2017 ---- - - -# Edit the Configuration.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the **Configuration.mof** file, whether you are using Configuration Manager 2007 or System Center 2012 Configuration Manager. Complete the following instructions for the version of Configuration Manager that you are using. - -**Important**   -If you are installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1), either by doing a new installation or by upgrading from a previous version, see the appropriate item in [About MBAM 2.0 SP1](about-mbam-20-sp1.md) as described in the following bullets: - -- For a new MBAM 2.0 SP1 installation, see **Required files for installing MBAM 2.0 SP1 if you are using MBAM with Configuration Manager**. - -- For an upgrade to MBAM 2.0 SP1, see **Update the configuration.mof file if you upgrade to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007**. - - - -**To create the configuration.mof file if you are using MBAM 2.0 SP1 with Configuration Manager** - -- See the “Important” note about MBAM 2.0 SP1 earlier in this topic for the appropriate instructions to follow in [About MBAM 2.0 SP1](about-mbam-20-sp1.md). - -**To edit the Configuration.mof file for System Center 2012 Configuration Manager** - -1. On the Configuration Manager Server, browse to the location of the **Configuration.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files \\Microsoft Configuration Manager. - -2. Edit the **Configuration.mof** file to append the following MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -**To edit the Configuration.mof file for Configuration Manager 2007** - -1. On the Configuration Manager Server, browse to the location of the **Configuration.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files (x86)\\Microsoft Configuration Manager. - -2. Edit the **Configuration.mof** file to append the following MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy_64 - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - UInt32 MBAMMachineError; - - // Encoded computer name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy_64 - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - - ``` - -## Related topics - - -[How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md) - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md b/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md deleted file mode 100644 index 9381657ebb..0000000000 --- a/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md +++ /dev/null @@ -1,178 +0,0 @@ ---- -title: Evaluating MBAM 2.0 -description: Evaluating MBAM 2.0 -author: dansimp -ms.assetid: bfc77eec-0fd7-4fec-9c78-6870afa87152 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Evaluating MBAM 2.0 - - -Before deploying Microsoft BitLocker Administration and Monitoring (MBAM) into a production environment, you should evaluate it in a test environment. The information in this topic can be used to set up Microsoft BitLocker Administration and Monitoring with a Stand-alone topology in a single-server test environment for evaluation purposes only. A single-server topology is not recommended for production environments. - -For instructions on deploying MBAM in a test environment, see [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md). - -## Setting up the Test Environment - - -Even though you are setting up a non-production instance of MBAM to evaluate in a test environment, you should still verify that you have met the prerequisites and hardware and software requirements. Before you start the installation, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md), [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md), and [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md). - -### Plan for an MBAM Evaluation Deployment - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Review the Getting Started information about MBAM to gain a basic understanding of the product before beginning deployment planning.

    Getting Started with MBAM 2.0

    Checklist box

    Plan for MBAM 2.0 Deployment Prerequisites and prepare your computing environment.

    MBAM 2.0 Deployment Prerequisites

    Checklist box

    Plan for and configure MBAM Group Policy requirements.

    Planning for MBAM 2.0 Group Policy Requirements

    Checklist box

    Plan for and create necessary Active Directory Domain Services security groups, and plan for MBAM local security group membership requirements.

    Planning for MBAM 2.0 Administrator Roles

    Checklist box

    Plan for deploying MBAM Server feature deployment.

    Planning for MBAM 2.0 Server Deployment

    Checklist box

    Plan for deploying MBAM Client deployment.

    Planning for MBAM 2.0 Client Deployment

    - - - -### Perform an MBAM Evaluation Deployment - -After completing the necessary planning and software prerequisite installations to prepare your computing environment for the MBAM installation, you can begin the MBAM evaluation deployment. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Checklist box

    Review the MBAM supported configurations information to make sure that selected client and server computers are supported for MBAM feature installation.

    MBAM 2.0 Supported Configurations

    Checklist box

    Run MBAM Setup to deploy MBAM Server features on a single server for evaluation purposes.

    How to Install and Configure MBAM on a Single Server

    Checklist box

    Add Active Directory Domain Services security groups, that you created during the planning phase, to the appropriate local MBAM Server feature local groups on the new MBAM Server.

    Planning for MBAM 2.0 Administrator Roles and How to Manage MBAM Administrator Roles

    Checklist box

    Create and deploy required MBAM Group Policy Objects.

    Deploying MBAM 2.0 Group Policy Objects

    Checklist box

    Deploy the MBAM Client software.

    Deploying the MBAM 2.0 Client

    - - - -## Configure Lab Computers for MBAM Evaluation - - -This section contains information that can be used to speed up the MBAM Client status reporting. However, these modifications should be used for testing purposes only. - -**Note**   -The information in following section describes how to modify the Windows registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. - - - -### Modify MBAM Client Status Reporting Frequency Settings - -The MBAM Client wakeup and status reporting frequencies have a minimum value of 90 minutes when they are set using Group Policy. You can use the Windows registry to change these frequencies to a lower value on MBAM client computers to help speed up testing. - -To modify the MBAM Client status reporting frequency settings: - -1. Use a registry editor to navigate to **HKLM\\Software\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement**. - -2. Change the values for **ClientWakeupFrequency** and **StatusReportingFrequency** to **1** as the minimum client-supported value. This change causes the MBAM Client to report every minute. - -3. Restart **BitLocker Management Client Service**. - -**Note**   -To set values that are this low, you must set them in the registry manually. - - - -### Modify MBAM Client Service Startup Delay - -In addition to the MBAM Client wakeup and status reporting frequencies, there is a random delay of up to 90 minutes when the MBAM Client agent service starts on client computers. If you do not want the random delay, create a **DWORD** value of **NoStartupDelay** under **HKLM\\Software\\Microsoft\\MBAM**, set its value to **1**, and then restart **BitLocker Management Client Service**. - -## Related topics - - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md b/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md deleted file mode 100644 index a2a80d1262..0000000000 --- a/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Getting Started - Using MBAM with Configuration Manager -description: Getting Started - Using MBAM with Configuration Manager -author: dansimp -ms.assetid: b0a1d3cc-0b01-4b69-a2cd-fd09fb3beda4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Getting Started - Using MBAM with Configuration Manager - - -When you install Microsoft BitLocker Administration and Monitoring (MBAM), you can choose a topology that integrates MBAM with Configuration Manager 2007 or System Center 2012 Configuration Manager. For a list of the supported versions of Configuration Manager that MBAM supports, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). In the integrated topology, the hardware compliance and reporting features are removed from MBAM and are accessed from Configuration Manager. - -**Important**   -Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007. - - - -## Using MBAM with Configuration Manager - - -The integration of MBAM is based on a new Configuration Pack that installs the following three items into Configuration Manager 2007 or System Center 2012 Configuration Manager, which are described in detail in the following sections: - -Configuration data that consists of configuration items and a configuration baseline - -Collection - -Reports - -### Configuration Data - -The configuration data installs a configuration baseline, called “BitLocker Protection,” which contains two configuration items: “BitLocker Operating System Drive Protection” and “BitLocker Fixed Data Drives Protection.” The configuration baseline is deployed to the collection, which is also created when MBAM is installed. The two configuration items provide the basis for evaluating the compliance status of the client computers. This information is captured, stored, and evaluated in Configuration Manager. The configuration items are based on the compliance requirements for operating system drives (OSDs) and Fixed Data Drives (FDDs). The required details for the deployed computers are collected so that the compliance for those drive types can be evaluated. By default, the configuration baseline evaluates the compliance status every 12 hours and sends the compliance data to Configuration Manager. - -### Collection - -MBAM creates a collection that is called MBAM Supported Computers. The configuration baseline is targeted to client computers that are in this collection. This is a dynamic collection that, by default, runs every 12 hours and evaluates membership. Membership is based on three criteria: - -- It is a supported version of the Windows operating system. Currently, MBAM supports only Windows 7 Enterprise and Windows 7 Ultimate, Windows 8 Enterprise, and Windows To Go, when Windows To Go is running on Windows 8 Enterprise. - -- It is a physical computer. Virtual machines are not supported. - -- Trusted Platform Module (TPM) is available. A compatible version of TPM 1.2 or later is required for Windows 7. Windows 8 and Windows To Go do not require a TPM. - -The collection is evaluated against all computers and creates the subset of compatible computers that provides the basis for compliance evaluation and reporting for the MBAM integration. - -### Reports - -There are four reports that you can use to view compliance. They are: - -- **BitLocker Enterprise Compliance Dashboard** – gives IT administrators three different views of information on a single report: Compliance Status Distribution, Non Compliant – Errors Distribution, and Compliance Status Distribution By Drive Type. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select. - -- **BitLocker Enterprise Compliance Details** – lets IT administrators view information about the BitLocker encryption compliance status of the enterprise and includes the compliance status for each computer. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select. - -- **BitLocker Computer Compliance** – lets IT administrators view an individual computer and determine why it was reported with a given status of compliant or not compliant. The report also displays the encryption state of the operating system drives (OSD) and fixed data drives (FDDs). - -- **BitLocker Enterprise Compliance Summary** – lets IT administrators view the status of the compliance of the enterprise with MBAM policy. Each computer’s state is evaluated, and the report shows a summary of the compliance of all computers in the enterprise against the policy. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select. - -## High-Level Architecture of MBAM with Configuration Manager - - -The following image shows the MBAM architecture with the Configuration Manager topology. This configuration supports up to 200,000 MBAM clients in a production environment. - -![mbam architecture with configuration manager](images/mbam2-cmserver.gif) - -A description of the servers, databases, and features of this architecture follows. The server features and databases in the architecture image are listed under the computer or server where we recommend that you install them. - -- **Database Server** – The **Recovery Database**, **Audit Database**, and **Audit Reports** are installed on a Windows server and supported SQL Server instance. The Recovery database stores recovery data that is collected from MBAM client computers. The Audit Database stores audit activity data that is collected from client computers that have accessed recovery data. The Audit Reports provide data about the compliance status of client computers in your enterprise. - -- **Configuration Manager Primary Site Server** – The Configuration Manager Server contains of the MBAM server installation with the System Center Configuration Manager Integration topology, which must be installed on a Configuration Manager primary site server. The Configuration Manager Server collects the hardware inventory information from client computers and is used to report BitLocker compliance of client computers. When you run the MBAM Setup server installation, a collection and the configuration data are installed on the Configuration Manager Primary Site Server. - -- **Administration and Monitoring Server** - The **Administration and Monitoring Server** is installed on a Windows server and consists of the Administration and Monitoring website and the monitoring web services. The Administration and Monitoring website is used to audit activity and to access recovery data (for example, BitLocker recovery keys). The **Self-Service Portal** is also installed on the Administration and Monitoring Server. The Portal enables end users on client computers to independently log onto a website to get a recovery key if they lose or forget their BitLocker password. The Audit reports are also installed on the Administration and Monitoring Server. - -- **Management Workstation** - The **Policy Template** consists of Group Policy Objects that define MBAM implementation settings for BitLocker drive encryption. You can install the Policy template on any server or workstation, but it is commonly installed on a management workstation that is a supported Windows server or client computer. The workstation does not have to be a dedicated computer. - -- **MBAM Client** and **Configuration Manager Client** computer - - - The **MBAM Client** performs the following tasks: - - - Uses Group Policy Objects to enforce the BitLocker encryption of client computers in the enterprise. - - - Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives. - - - Collects recovery information and computer information about the client computers. - - - **Configuration Manager Client** – The Configuration Manager client enables Configuration Manager to collect hardware compatibility data about the client computers, and enables Configuration Manager to report compliance information. - -## Related topics - - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - - - - - - - - diff --git a/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md b/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md deleted file mode 100644 index 0183c9e902..0000000000 --- a/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Getting Started with MBAM 2.0 -description: Getting Started with MBAM 2.0 -author: dansimp -ms.assetid: 29f5c9af-5bbf-4d37-aa0f-0716046904af -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with MBAM 2.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 requires thorough planning before you deploy it or use its features. Because this product can affect every computer in your organization, you might disrupt your entire network if you do not plan your deployment carefully. However, if you plan your deployment carefully and manage it so that it meets your business requirements, BitLocker Administration and Monitoring 2.0 can help reduce your administrative overhead and total cost of ownership. - -If you are new to this product, we recommend that you read the documentation carefully. To get the MBAM software, see [How Do I Get MDOP?](https://go.microsoft.com/fwlink/p/?LinkId=322049). Before you deploy MBAM to a production environment, we also recommend that you validate your deployment plan in a test environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -This section of the MBAM 2.0 Administrator’s Guide includes high-level information about MBAM 2.0 to provide a basic understanding of the product before you begin to plan deployment. For specific information about deploying MBAM with the Configuration Manager integrated topology, see [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md). You can find additional MBAM documentation on the Microsoft BitLocker Administration and Monitoring (MBAM) Documentation Resources Download Page at . - -## Getting Started with MBAM 2.0 - - -- [About MBAM 2.0](about-mbam-20-mbam-2.md) - - Provides a high-level overview of MBAM 2.0 and describes how it can be used in your organization. - -- [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md) - - Provides information about how you can best evaluate MBAM 2.0 for use in your organization. - -- [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md) - - Describes the MBAM 2.0 features and the recommended architecture for a production environment. - -- [Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md) - - Describes the keyboard shortcuts that are available for MBAM 2.0. - -## Other Resources for this Product - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/helping-end-users-manage-bitlocker.md b/mdop/mbam-v2/helping-end-users-manage-bitlocker.md deleted file mode 100644 index b3c0e338c5..0000000000 --- a/mdop/mbam-v2/helping-end-users-manage-bitlocker.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Helping End Users Manage BitLocker -description: Helping End Users Manage BitLocker -author: dansimp -ms.assetid: 47776fb3-2d94-4970-b687-c35ec3dd6c64 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Helping End Users Manage BitLocker - - -Content on a lost or stolen computer is vulnerable to unauthorized access, which can present a security risk to both people and companies. Microsoft BitLocker Administration and Monitoring (MBAM) uses BitLocker to help prevent unauthorized access by locking your computer to help protect sensitive data from malicious users. - -## What is BitLocker? - - -BitLocker Drive Encryption can provide protection for operating system drives, data drives, and removable drives (such as a USB thumb drive) by encrypting the drives. Depending on how BitLocker is configured, users may have to provide a key (a password or PIN) to unlock the information that is stored on the encrypted drives. - -When you add new files to a drive that is encrypted with BitLocker, BitLocker encrypts them automatically. Files remain encrypted only while they are stored in the encrypted drive. Files that are copied to another drive or computer are decrypted. If you share files with other users, such as through a network, these files are encrypted while stored on the encrypted drive, but they can be accessed normally by authorized users. - -If you encrypt the operating system drive, BitLocker checks the computer during startup for any conditions that could represent a security risk (for example, a change to the BIOS or changes to any startup files). If a potential security risk is detected, BitLocker will lock the operating system drive and require a special BitLocker recovery key to unlock it. Make sure that you create this recovery key when you turn on BitLocker for the first time. Otherwise, you could permanently lose access to your files. - -If you encrypt data drives (fixed or removable), you can unlock an encrypted drive with a password or a smart card, or set the drive to automatically unlock when you log on to the computer. - -In addition to passwords and PINs, BitLocker can use the Trusted Platform Module (TPM) chip that is provided in many newer computers. The TPM chip is used to ensure that your computer has not been tampered with before BitLocker will unlock the operating system drive. During the encryption process, you may have to enable the TPM chip. When you start your computer, BitLocker asks the TPM for the keys to the drive and unlocks it. To enable the TPM chip, you will have to restart your computer and then change a setting in the BIOS, a pre-Windows layer of your computer software. For more information about the TPM, see [About the Computer TPM Chip](about-the-computer-tpm-chip.md). - -Once your computer is protected by BitLocker, you may have to enter a PIN or password every time that the computer wakes from hibernation or starts. The Help Desk for your company or organization can help if you ever forget your PIN or password. - -You can turn off BitLocker, either temporarily, by suspending it, or permanently, by decrypting the drive. - -**Note**   -Because BitLocker encrypts the whole drive and not just the individual files themselves, be careful when you move sensitive data between drives. If you move a file from a BitLocker-protected drive to a nonencrypted drive, the file will no longer be encrypted. - - - -## About the BitLocker Encryption Options Application - - -To unlock hard disk drives on your computer and to manage your PIN and passwords, use the BitLocker Encryption Options application in the Windows Control Panel by following the procedure outlined here. You can enter passwords to unlock protected drives and can check the BitLocker status of attached drives by using this application. - -**To open the BitLocker Encryption Options application** - -1. Click **Start**, and select **Control Panel**. The Control Panel opens in a new window. - -2. In **Control Panel**, select **System and Security**. - -3. Select **BitLocker Encryption Options** to open the BitLocker Encryption Options application. - - For a description of the available options, see the following section. - -## Options on the BitLocker Encryption Options Application - - -The BitLocker Encryption Options application on Control Panel lets you manage your PIN and passwords, which BitLocker uses to protect your computer. - -**BitLocker Drive Encryption – Fixed Disk Drives:** - -In this section, you can view information about hard disk drives connected to your computer and their current BitLocker Encryption status. - -- **Manage your PIN** - changes the PIN used by BitLocker to unlock your operating system drive. - -- **Manage your password** - changes the password that is used by BitLocker to unlock your other internal drives. - -**BitLocker Drive Encryption - External Drives:** - -In this section, you can view information about external drives (such as a USB thumb drive) connected to your computer, and their current BitLocker encryption status. - -- **Manage your password** - changes the password that is used by BitLocker to unlock your other internal drives. - -**Advanced:** - -- **TPM Administration** - opens the TPM Administration tool in a separate window. From here you can configure common TPM tasks and obtain information about the TPM chipset. You must have administrative permissions on your computer to access this tool. - -- **Disk Management** -open the Disk Management tool. From here you can view the information for all hard drives connected to the computer and configure partitions and drive options. You must have administrative rights on your computer to access this tool. - - - - - - - - - diff --git a/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md b/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md deleted file mode 100644 index 810ca0e569..0000000000 --- a/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: High Availability for MBAM 2.0 -description: High Availability for MBAM 2.0 -author: dansimp -ms.assetid: 244ee013-9e2a-48d2-b842-4e10594fd74f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High Availability for MBAM 2.0 - - -This topic provides basic information about a highly available installation of Microsoft BitLocker Administration and Monitoring (MBAM). High-availability scenarios are not fully supported in this version of MBAM, so they are not described here. It is recommended that you search related blogs and forums, where users describe how they have successfully configured high availability for MBAM in their environments. - -## High Availability Scenarios for MBAM - - -Microsoft BitLocker Administration and Monitoring is designed to be fault-tolerant. If a server becomes unavailable, users should not be negatively affected. For example, if the MBAM agent cannot connect to the MBAM web server, users should not be prompted for action. - -When you plan your MBAM installation, consider the following items, which can affect the availability of the MBAM service: - -- Drive encryption and recovery password – If a recovery password cannot be escrowed, the encryption does not start on the client computer. - -- Compliance status data upload – If the server that hosts the compliance status report service is not available, the compliance data does not remain current. - -- Help Desk recovery key access - If the Help Desk cannot access MBAM database information, the Help Desk cannot provide recovery keys to users. - -- Availability of reports –If the server that hosts the Compliance and Audit Reports is not available, reports will not be available. - -## How the MBAM Backup Uses the Volume Shadow Copy Service (VSS) - - -MBAM 2.0 provides a Volume Shadow Copy Service (VSS) writer, called the Microsoft BitLocker Administration and Management Writer, which facilitates the backup of the Compliance and Audit Database and the Recovery Database. - -The MBAM Server Windows Installer registers the MBAM VSS Writer. Any failure during the VSS writer registration causes the MBAM Server installation to roll back. In a topology where the Compliance and Audit Database and the Recovery Database are installed on different servers, a separate instance of MBAM VSS Writer is registered on each server. The MBAM VSS Writer is dependent on the SQL Server VSS Writer. The SQL Server VSS Writer is registered as part of the Microsoft SQL Server installation. Any backup technology that uses VSS writers to perform backup can discover the MBAM VSS Writer. - -## Related topics - - -[Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md b/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md deleted file mode 100644 index 99d1616b22..0000000000 --- a/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: High-Level Architecture for MBAM 2.0 -description: High-Level Architecture for MBAM 2.0 -author: dansimp -ms.assetid: 7f73dd3a-0b1f-4af6-a2f0-d0c5bc5d183a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture for MBAM 2.0 - - -Microsoft BitLocker Administration and Monitoring (MBAM) is a client/server solution that can help you simplify BitLocker provisioning and deployment, improve compliance and reporting on BitLocker, and reduce support costs. Microsoft BitLocker Administration and Monitoring includes the features that are described in this topic. - -Microsoft BitLocker Administration and Monitoring can be deployed in the Stand-alone topology, or in a topology that is integrated with Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager. This topic describes the architecture for the Stand-alone topology. For information about deploying in the integrated Configuration Manager topology, see [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md). - -The following diagram shows the MBAM recommended architecture for a production environment, which consists of two servers and a management workstation. This architecture supports up to 200,000 MBAM clients. The server features and databases in the architecture image are described in the following section and are listed under the computer or server where we recommend that you install them. - -**Note**   -A single-server architecture should be used only in test environments. - - - -![mbam 2 two-server deployment topology](images/mbam2-3-servers.gif) - -## Administration and Monitoring Server - - -The following features are installed on this server: - -- **Administration and Monitoring Server**. The Administration and Monitoring Server feature is installed on a Windows server and consists of the Administration and Monitoring website, which includes the reports and the Help Desk Portal, and the monitoring web services. - -- **Self-Service Portal**. The Self-Service Portal is installed on a Windows server. The Self-Service Portal enables end users on client computers to independently log on to a website, where they can obtain a recovery key to recover a locked BitLocker volume. - -## Database Server - - -The following features are installed on this server: - -- **Recovery Database**. The Recovery Database is installed on a Windows server and a supported instance of Microsoft SQL Server. This database stores recovery data that is collected from MBAM client computers. - -- **Compliance and Audit Database**. The Compliance and Audit Database is installed on a Windows server and a supported instance of SQL Server. This database stores compliance data for MBAM client computers. This data is used primarily for reports that SQL Server Reporting Services (SSRS) hosts. - -- **Compliance and Audit Reports**. The Compliance and Audit Reports are installed on a Windows server and a supported instance of SQL Server that has the SQL Server Reporting Services (SSRS) feature installed. These reports provide MBAM reports that you can access from the Administration and Monitoring website or directly from the SSRS server. - -## Management Workstation - - -The following feature is installed on the Management workstation, which can be a Windows server or a client computer. - -- **Policy Template**. The Policy Template consists of Group Policy settings that define MBAM implementation settings for BitLocker drive encryption. You can install the Policy template on any server or workstation, but it is commonly installed on a management workstation, which is a supported Windows server or client computer. The workstation does not have to be a dedicated computer. - -## MBAM Client - - -The MBAM Client is installed on a Windows computer and has the following characteristics: - -- Uses Group Policy to enforce the BitLocker drive encryption of client computers in the enterprise. - -- Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives. - -- Collects compliance data for the computer and passes the data to the reporting system. - -## Related topics - - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-brand-the-self-service-portal.md b/mdop/mbam-v2/how-to-brand-the-self-service-portal.md deleted file mode 100644 index e7b09a94a5..0000000000 --- a/mdop/mbam-v2/how-to-brand-the-self-service-portal.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: How to Brand the Self-Service Portal -description: How to Brand the Self-Service Portal -author: dansimp -ms.assetid: 3ef9e951-7c42-4f7f-b131-3765d39b3207 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Brand the Self-Service Portal - - -After you install the Microsoft BitLocker Administration and Monitoring (MBAM) Self-Service Portal, you can brand the Self-Service Portal with your company name, Help Desk URL, and “notice” text. You can also change the Session Timeout setting to make the end user’s session expire after a specified period of inactivity. - -**To set the session time-out and branding for the Self-Service Portal** - -1. To set the time-out period for the end user’s session, start the **Internet Information Services Manager**, or run **inetmgr.exe**. - -2. Browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **ASP.NET** > **Session State**, and change the **Time-out** value under **Cookie Settings** to the number of minutes after which the end user’s Self-Service Portal session will expire. The default is 5. To disable the setting so that there is no time-out, set the value to **0**. - -3. To set the branding items for the Self-Service Portal, start the **Internet Information Services Manager**, or run **inetmgr.exe**. - -4. Browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -5. From the **Name** column, select the item that you want to change, and change the default value to reflect the name that you want to use. The following table lists the values that you can set. - - **Caution** - Do not change the value in the Name column (CompanyName\*), as it will cause the Self-Service Portal to stop working. - - - -~~~ - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDefault Value

    CompanyName*

    Contoso IT

    HelpdeskText*

    Contact Help Desk or IT Department

    HelpdeskUrl*

    Http://www.microsoft.com

    jQueryPath

    //ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js

    MicrosoftAjaxPath

    //ajax.aspnetcdn.com/ajax/3.5/MicrosoftAjax.js

    MicrosoftMvcAjaxPath

    //ajax.aspnetcdn.com/ajax/mvc/2.0/MicrosoftMvcValidation.js

    NoticeTextPath

    Notice.txt

    -
    -Note -

    You can edit the Notice text either by using the IIS Manager or by opening and changing the Notice.txt file in the installation directory.

    -
    -
    - -
    -~~~ - - - -## Related topics - - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md b/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md deleted file mode 100644 index c74822c16c..0000000000 --- a/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: How to Create or Edit the mof Files -description: How to Create or Edit the mof Files -author: dansimp -ms.assetid: 4d19d707-b90f-4057-a6e9-e4221a607190 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create or Edit the mof Files - - -Before you install Microsoft BitLocker Administration and Monitoring (MBAM) with Configuration Manager, you need to edit the Configuration.mof file. You also need to either edit or create the Sms\_def.mof file, depending on which version of Configuration Manager you are using. - -## Edit the Configuration.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file for Microsoft System Center Configuration Manager 2007 and System Center 2012 Configuration Manager. - -[Edit the Configuration.mof File](edit-the-configurationmof-file.md) - -## Create or Edit the Sms\_def.mof File - - -To enable the client computers to report BitLocker compliance details in the MBAM Configuration Manager reports, you have to create or edit the Sms\_def.mof file. In Configuration Manager 2007, the file already exists, so you need to edit, but not overwrite, the existing file. If you are using System Center 2012 Configuration Manager, you must create the file. - -[Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file.md) - -## Related topics - - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md b/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md deleted file mode 100644 index 59996d8297..0000000000 --- a/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md +++ /dev/null @@ -1,124 +0,0 @@ ---- -title: How to Deploy the MBAM Client as Part of a Windows Deployment -description: How to Deploy the MBAM Client as Part of a Windows Deployment -author: dansimp -ms.assetid: 67387de7-8b02-4412-9850-3b8d8e5c18af -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client as Part of a Windows Deployment - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. If computers that have a Trusted Platform Module (TPM) chip, the BitLocker client can be integrated into an organization by enabling BitLocker management and encryption on client computers as part of the imaging and Windows deployment process. - -**Note** -To review the Microsoft BitLocker Administration and Monitoring Client system requirements, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). - - - -Encrypting client computers with BitLocker during the initial imaging stage of a Windows deployment can lower the administrative overhead necessary for implementing MBAM in an organization. It also ensures that every computer that is deployed already has BitLocker running and is configured correctly. - -**Note** -The procedure in this topic describes modifying the Windows registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. - - - -**To encrypt a computer as part of Windows deployment** - -1. If your organization is planning to use the Trusted Platform Module (TPM) protector or the TPM + PIN protector options in BitLocker, you must activate the TPM chip before the initial deployment of MBAM. When you activate the TPM chip, you avoid a reboot later in the process, and you ensure that the TPM chips are correctly configured according to the requirements of your organization. You must activate the TPM chip manually in the BIOS of the computer. - - **Note** - Some vendors provide tools to turn on and activate the TPM chip in the BIOS from within the operating system. Refer to the manufacturer documentation for more details about how to configure the TPM chip. - - - -2. Install the Microsoft BitLocker Administration and Monitoring client agent. - -3. Join the computer to a domain (recommended). - - - If the computer is not joined to the domain, the recovery password is not stored in the MBAM Key Recovery service. By default, MBAM does not allow encryption to occur unless the recovery key can be stored. - - - If a computer starts in recovery mode before the recovery key is stored on the MBAM Server, the computer has to be reimaged. No recovery method is available. - -4. Run the command prompt as an administrator, stop the MBAM service, and then set the service to **manual** or **on demand**, and then start by typing the following commands: - - **net stop mbamagent** - - **sc config mbamagent start= demand** - -5. Set the registry settings for the MBAM agent to ignore Group Policy and run the TPM for **operating system only encryption** by running **Regedit**, and then importing the registry key template from C:\\Program Files\\Microsoft\\MDOP MBAM\\MBAMDeploymentKeyTemplate.reg. - -6. In regedit, go to HKLM\\SOFTWARE\\Microsoft\\MBAM, and configure the settings that are listed in the following table. - - Registry entry - - Configuration settings - - DeploymentTime - - 0 = OFF - - 1 = Use deployment time policy settings (default) - - UseKeyRecoveryService - - 0 = Do not use key escrow ( the next two registry entries are not required in this case) - - 1 = Use key escrow in Key Recovery system (default) - - Recommended: The computer must be able to communicate with the Key Recovery service. Verify that the computer can communicate with the service before you proceed. - - KeyRecoveryOptions - - 0 = Uploads Recovery Key Only - - 1 = Uploads Recovery Key and Key Recovery Package (default) - - KeyRecoveryServiceEndPoint - - Set this value to the URL for the Key Recovery web server, for example, http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc. - - - -~~~ -**Note** -MBAM policy or registry values can be set here to override previously set values. -~~~ - - - -7. The MBAM agent restarts the system during MBAM client deployment. When you are ready for this reboot, run the following command at a command prompt as an administrator: - - **net start mbamagent** - -8. When the computers restarts, and the BIOS prompts you to accept a TPM change, accept the change. - -9. During the Windows client operating system imaging process, when you are ready to start encryption, restart the MBAM agent service, and set start to **automatic** by running a command prompt as an administrator and typing the following commands: - - **sc config mbamagent start= auto** - - **net start mbamagent** - -10. Remove the bypass registry values by running Regedit and going to the HKLM\\SOFTWARE\\Microsoft registry entry. To delete the **MBAM** node, right-click the node and click **Delete**. - -## Related topics - - -[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md b/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md deleted file mode 100644 index c7b5c03238..0000000000 --- a/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Deploy the MBAM Client to Desktop or Laptop Computers -description: How to Deploy the MBAM Client to Desktop or Laptop Computers -author: dansimp -ms.assetid: 56744922-bfdd-48f6-ae01-645ff53b64a8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client to Desktop or Laptop Computers - - -The Microsoft BitLocker Administration and Monitoring (MBAM) client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an electronic software distribution system, such as Active Directory Domain Services or Microsoft System Center Configuration Manager. - -**Note**   -To review the Microsoft BitLocker Administration and Monitoring Client system requirements, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). - - - -**To deploy the MBAM Client to desktop or laptop computers** - -1. Locate the MBAM client installation files that are provided with the MBAM software. - -2. Use Active Directory Domain Services or an enterprise software deployment tool like Microsoft System Center Configuration Manager to deploy the Windows Installer package to target computers. - -3. Configure the distribution settings or Group Policy to run the MBAM Client installation file. After successful installation, the MBAM Client applies the Group Policy settings that are received from a domain controller to begin BitLocker encryption and management functions. For more information about MBAM group policy settings, see [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md). - - **Important**   - The MBAM Client will not start BitLocker encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed before BitLocker encryption will begin. - - - -## Related topics - - -[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md b/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md deleted file mode 100644 index 46c10f9c67..0000000000 --- a/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: How to Determine BitLocker Encryption State of Lost Computers -description: How to Determine BitLocker Encryption State of Lost Computers -author: dansimp -ms.assetid: dbd23b64-dff3-4913-9acd-affe67b9462e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Determine BitLocker Encryption State of Lost Computers - - -You can use Microsoft BitLocker Administration and Monitoring (MBAM) to determine the last known BitLocker encryption status of computers that were lost or stolen. The following procedure explains how to determine whether the volumes on a computer are encrypted if there is a loss or theft. - -**To determine the last known BitLocker encryption state of lost computers** - -1. Open a web browser and navigate to the Administration and Monitoring website. - - **Note**   - Note: The default address for the Administration and Monitoring website is http://*<computername>*. Using the fully qualified server name will yield faster browsing results. - - - -2. Selects the **Report** node from the navigation pane, and select the **Computer Compliance Report**. - -3. Use the filter fields in the right pane to narrow the search results, and then click **Search**. Results are shown below your search query. - -4. Take the appropriate action, as determined by your policy for lost devices. - - **Note**   - Device compliance is determined by the BitLocker policies that your enterprise has deployed. You may want to verify your deployed policies before you try to determine the BitLocker encryption state of a device. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md b/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md deleted file mode 100644 index 457d479a15..0000000000 --- a/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Edit MBAM 2.0 GPO Settings -description: How to Edit MBAM 2.0 GPO Settings -author: dansimp -ms.assetid: f5ffa93d-b4d2-4317-8a1c-7d2be0264fe3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit MBAM 2.0 GPO Settings - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you first have to determine the Group Policies that you will use in your implementation of Microsoft BitLocker Administration and Monitoring. See [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) for more information on the different policies that are available. After you have determined the policies that you are going to use, you then must modify one or more Group Policy Objects (GPO) that include the policy settings for MBAM. - -You can use the following steps to configure the basic, recommended GPO settings to enable MBAM to manage BitLocker encryption for your organization’s client computers. - -**To Edit MBAM Client GPO Settings** - -1. On a computer that has MBAM Group Policy template installed, make sure that MBAM services are enabled. - -2. Using the Group Policy Management Console (GPMC.msc) or the Advanced Group Policy Management (AGPM) MDOP product on a computer with the MBAM Group Policy template installed, select **Computer configuration**, choose **Policies**, click **Administrative Templates**, select **Windows Components**, and then click **MDOP MBAM (BitLocker Management)**. - -3. Edit the Group Policy Object settings that are required to enable MBAM Client services on client computers. For each policy in the table that follows, select **Policy Group**, click the **Policy**, and then configure the **Setting**: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy GroupPolicySetting

    Client Management

    Configure MBAM Services

    Enabled. Set MBAM Recovery and Hardware service endpoint and Select BitLocker recovery information to store. Set MBAM compliance service endpoint and Enter status report frequency in (minutes).

    Operating System Drive

    Operating system drive encryption settings

    Enabled. Set Select protector for operating system drive. Required to save operating system drive data to the MBAMKey Recovery server.

    Removable Drive

    Control Use of BitLocker on removable drives

    Enabled. Required if MBAM will save removable drive data to the MBAM Key Recovery server.

    Fixed Drive

    Control Use of BitLocker on fixed drives

    Enabled. Required if MBAM will save fixed drive data to the MBAM Key Recovery server.

    -

    Set Choose how BitLocker-protected drives can be recovered and Allow data recovery agent.

    - - - -~~~ -**Important** -Depending on the policies that your organization decides to deploy, you may have to configure additional policies. See [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) for Group Policy configuration details for all of the available MBAM GPO policy options. -~~~ - - - -## Related topics - - -[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md b/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md deleted file mode 100644 index 601184d6e5..0000000000 --- a/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md +++ /dev/null @@ -1,115 +0,0 @@ ---- -title: How to Generate MBAM Reports -description: How to Generate MBAM Reports -author: dansimp -ms.assetid: 083550cb-8c3f-49b3-a30e-97d85374d2f4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Generate MBAM Reports - - -When you install Microsoft BitLocker Administration and Monitoring (MBAM) with the Stand-alone topology, you can generate different reports to monitor BitLocker encryption usage and compliance. The procedures in this topic describe how to open the Administration and Monitoring website and the steps that are needed to generate Microsoft BitLocker Administration and Monitoring reports on enterprise compliance, individual computers, and key recovery activity. For detailed information to help understand MBAM reports, see [Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md). - -**Note**   -To run the reports, you must be a member of the **Report Users Role** on the computers where the Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports are installed. - - - -**To open the Administration and Monitoring website** - -1. Open a web browser and navigate to the Administration and Monitoring website. The default URL for the Administration and Monitoring website is *http://<computername>*. - - **Note**   - If the Administration and Monitoring website was installed on a port other than 80, you have to specify the port in the URL (for example, *http://<computername>:<port>*. If you specified a host name for the Administration and Monitoring website during the installation, the URL is *http://<hostname>*. - - - -2. In the left pane, click **Reports** and then select the report you want to run from the top menu bar. - - Historical MBAM client data is retained in the compliance database for historical reference in case a computer is lost or stolen. When running enterprise reports, we recommend that you use appropriate start and end dates to scope the time frames for the reports from one to two weeks to increase reporting data accuracy. - - **Note**   - If SSRS was not configured to use Secure Socket Layer, the URL for the reports will be set to HTTP instead of to HTTPS when you install the MBAM Server. If you then go to the Help Desk portal and select a report, the following message displays: “Only Secure Content is Displayed.” To show the report, click **Show All Content**. - - - -**To generate an Enterprise Compliance Report** - -1. From the Administration and Monitoring website, select the **Reports** node from the left navigation pane, select **Enterprise Compliance Report**, and select the filters that you want to use. The available filters for the Enterprise Compliance Report are the following: - - - **Compliance Status**. Use this filter to specify the compliance status types (for example, Compliant, or Noncompliant) of the report. - - - **Error State**. Use this filter to specify the error state types (for example, No Error, or Error) of the report. - -2. Click **View Report** to display the selected report. - - Results can be saved in different formats, such as HTML, Microsoft Word, and Microsoft Excel. - - **Note**   - The Enterprise Compliance report is generated by a SQL job that runs every six hours. Therefore, the first time you view the report, you may find that some data is missing. You can generate updated report data manually by using SQL Management Studio. From the **Object Explorer** window, expand **SQL Server Agent**, expand **Jobs**, right-click the **CreateCache** job, and select **Start Job at Step….** - - - -3. Select a computer name to view information about the computer in the Computer Compliance Report. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - -**To generate the Computer Compliance Report** - -1. In the Administration and Monitoring website, select the **Report** node from the left navigation pane, and then select the **Computer Compliance Report**. Use the Computer Compliance report to search for **user name** or **computer name**. - -2. Click **View Report** to view the computer report. - - Results can be saved in different formats, such as HTML, Microsoft Word, and Microsoft Excel. - -3. Select a computer name to display more information about the computer in the Computer Compliance Report. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - - **Note**   - An MBAM client computer is considered compliant if the computer matches the requirements of the MBAM policy settings. - - - -**To generate the Recovery Key Audit Report** - -1. From the Administration and Monitoring website, select the **Report** node in the left navigation pane, and then select the **Recovery Audit Report**. Select the filters for your Recovery Key Audit report. The available filters for Recovery Key audits are as follows: - - - **Requestor**. This filter enables users to specify the user name of the requester. The requester is the person in the Help Desk who accessed the key on behalf of a user. - - - **Requestee**. This filter enables users to specify the user name of the requestee. The requestee is the person who called the Help Desk to obtain a recovery key. - - - **Request Result**. This filter enables users to specify the request result types (for example, Success or Failed) that they want to base the report on. For example, users may want to view failed key access attempts. - - - **Key Type**. This filter enables users to specify the Key Type (for example: Recovery Key Password or TPM Password Hash) that they want to base the report on. - - - **Start Date**. This filter is used to define the Start Date part of the date range that the user wants to report on. - - - **End Date**. This filter is used to define the End Date part of the date range that the users want to report on. - -2. Click **View Report** to view the report. - - Results can be saved in different formats, such as HTML, Microsoft Word, and Microsoft Excel. - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md b/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md deleted file mode 100644 index 73915791b9..0000000000 --- a/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: How to Hide Default BitLocker Encryption in the Windows Control Panel -description: How to Hide Default BitLocker Encryption in the Windows Control Panel -author: dansimp -ms.assetid: 6674aa51-2b5d-4e4a-8b43-2cc18d008285 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Hide Default BitLocker Encryption in the Windows Control Panel - - -Microsoft BitLocker Administration and Monitoring (MBAM) offers a customized control panel for Microsoft BitLocker Administration and Monitoring client computers, called BitLocker Encryption Options. This customized control panel can replace the default Windows BitLocker control panel, which is called BitLocker Drive Encryption. The customized control panel, which is in Control Panel under System and Security, enables users to manage their PIN and passwords and to unlock drives, and hides the interface that enables administrators to decrypt a drive or to suspend or resume BitLocker drive encryption. - -**To hide default BitLocker drive encryption in Windows Control Panel** - -1. In the Group Policy Management Console (GPMC), the Advanced Group Policy Management (AGPM), or the Local Group Policy Editor on the BitLocker Group Policies computer, browse to **User configuration**. - -2. Next, click **Policies**, select **Administrative Templates**, and then click **Control Panel**. - -3. Double-click **Hide specified Control Panel items** in the **Details** pane, and then select **Enabled**. - -4. Click **Show**, click **Add**, and then type **Microsoft.BitLockerDriveEncryption**. This policy hides the default Windows BitLocker Management tool from the Windows Control Panel and, in Control Panel, lets the user open the updated MBAM BitLocker Encryption Options tool under System and Security. - -## Related topics - - -[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md deleted file mode 100644 index 593e8d34e5..0000000000 --- a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md +++ /dev/null @@ -1,206 +0,0 @@ ---- -title: How to Install and Configure MBAM on a Single Server -description: How to Install and Configure MBAM on a Single Server -author: dansimp -ms.assetid: 45e6a012-6c8c-4d90-902c-d09de9a0cbea -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install and Configure MBAM on a Single Server - - -The procedures in this topic describe how to install Microsoft BitLocker Administration and Monitoring (MBAM) in the Stand-alone topology on a single server. Use the single-server configuration only in a test environment. For production environments, use two or more servers. If you are installing Microsoft BitLocker Administration and Monitoring by using the Configuration Manager topology, see [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md). - -The following diagram shows an example of a single-server architecture. For a description of the databases and features, see [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md). - -![mbam 2 single server deployment topology](images/mbam2-1-server.gif) - -Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) and [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). In addition, some features also have information that must be provided during the installation process to successfully deploy the feature. You should also review [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) before you start MBAM deployment. - -**Note** -To obtain the setup log files, you have use the Msiexec package and the **/L** <location> option to install MBAM. Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder on the server of the user who is installing MBAM. - - - -## To install MBAM Server features on a single server - - -The following steps describe how to install general MBAM features. - -**To start the MBAM Server features installation** - -1. On the server where you want to install MBAM, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **Stand-alone** topology, and then click **Next**. - -5. On the **Select features to install** page, select the features that you want to install. By default, all MBAM features are selected for installation. Features that are to be installed on the same computer must be installed together at the same time. Clear the check boxes for any features that you want to install elsewhere. You must install MBAM features in the following order: - - - Recovery Database - - - Compliance and Audit Database - - - Compliance and Audit Reports - - - Self-Service Server - - - Administration and Monitoring Server - - - MBAM Group Policy template - - **Note** - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes. - - - -6. On the **Configure network communication security** page, choose whether to encrypt the communication between the Web Services on the Administration and Monitoring Server and the clients. If you decide to encrypt the communication, select the certification authority-provisioned certificate to use for encryption. The certificate must be created prior to this step to enable you to select it on this page. - - **Note** - This page appears only if you selected the Self-Service Portal or the Administration and Monitoring Server feature on the **Select features to install** page. - - - -7. Click **Next**, and then continue to the next set of steps to configure the MBAM Server features. - -**To configure the MBAM Server features** - -1. On the **Configure the Recovery database** page, specify the SQL Server instance name and the name of the database that will store the recovery data. You must also specify both where the database files will be located and where the log information will be located. - -2. Click **Next** to continue. - -3. On the **Configure the Compliance and Audit database** page, specify the SQL Server instance name and the name of the database that will store the compliance and audit data. You must also specify where the database files will be located and where the log information will be located. - -4. Click **Next** to continue. - -5. On the **Configure the Compliance and Audit Reports** page, specify the SQL Server Reporting Services instance where the Compliance and Audit reports will be installed, and provide a domain user account and password for accessing the Compliance and Audit database. Configure the password for this account to never expire. The user account should be able to access all data available to the MBAM Reports Users group. - -6. Click **Next** to continue. - -7. On the **Configure the Self-Service Portal** page, enter the port number, host name, virtual directory name, and installation path for the Self-Service Portal. - - **Note** - The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically. - - - -8. Click **Next** to continue. - -9. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. This does not turn on Automatic Updates in Windows. - -10. On the **Configure the Administration and Monitoring Server** page, enter the port number, host name, virtual directory name, and installation path for the Help Desk website. - - **Note** - The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically. - - - -11. On the **Installation Summary** page, review the list of features that will be installed, and click **Install** to start installing the MBAM features. Click **Back** to move back through the wizard if you have to review or change your installation settings, or click **Cancel** to exit Setup. Setup installs the MBAM features and notifies you that the installation is complete. - -12. Click **Finish** to exit the wizard. After the Microsoft BitLocker Administration and Monitoring Server features have been installed, continue to the next section and complete the steps have to add users to the Microsoft BitLocker Administration and Monitoring roles. For more information about roles, see [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md). - -**To perform post-installation configuration** - -1. On the Administration and Monitoring Server, add users to the following local groups to give them access to the MBAM Help Desk website features: - - - **MBAM Helpdesk Users**: Members of this local group can access the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User. - - - **MBAM Advanced Helpdesk Users**: Members of this local group have advanced access to the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. For Advanced Helpdesk Users, only the **Key ID** field is required in Drive Recovery. In Manage TPM, only the **Computer Domain** field and **Computer Name** field are required. - -2. On the Administration and Monitoring Server, add users to the following local group to enable them to access the Reports feature on the MBAM Administration and Monitoring website: - - - **MBAM Report Users**: Members of this local group can access the Reports features on the MBAM Administration and Monitoring website. - - - Brand the Self-Service Portal with your company name, notice text, and other company-specific information. For instructions, see [How to Brand the Self-Service Portal](how-to-brand-the-self-service-portal.md). - - **Note** - Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports are installed. The recommended way to do this is to create a domain security group and add that domain group to each local MBAM Report Users group. When you use this process, manage the group memberships by way of the domain group. - - - -## Validating the MBAM Server feature installation - - -When the Microsoft BitLocker Administration and Monitoring installation is completed, validate that the installation has successfully set up all the necessary MBAM features that are required for BitLocker management. Use the following procedure to confirm that the MBAM service is functional. - -**To validate the MBAM Server feature installation** - -1. On each server where a MBAM feature is deployed, open **Control Panel**. Select **Programs**, and then select **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To validate the installation, you must use a domain account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery Database is installed, open SQL Server Management Studio, and verify that the **MBAM Recovery and Hardware** database is installed. - -3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio, and verify that the **MBAM Compliance Status Database** is installed. - -4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative credentials and browse to the “Home” of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance is at http://<NameofMBAMReportsServer>/Reports. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that are specified during setup. - - Confirm that a Reports folder named Microsoft BitLocker Administration and Monitoring contains a data source called **MaltaDataSource** and that an **en-us** folder contains four reports. - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following: http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>* - - - -~~~ -**Note** -If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring website and select a report, the following message appears: “Only Secure Content is Displayed.” To show the report, click **Show All Content**. -~~~ - - - -5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**. Select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager.** - -6. In **Connections,** browse to *<computername>*, select **Sites**, and then select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMUserSupportService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed. - -7. On the server where the Administration and Monitoring features and Self-Service Portal are installed, open a web browser with administrative credentials and browse to the following locations to verify that they load successfully: - - - *http://<hostname>/HelpDesk/default.aspx* and confirm each of the links for navigation and reports - - - *http://<hostname>/SelfService>/* - - - *http://<computername>/MBAMAdministrationService/AdministrationService.svc* - - - *http://<hostname>/MBAMUserSupportService/UserSupportService.svc* - - - *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc* - - - *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc* - - **Note** - It is assumed that the server features were installed on the default port without network encryption. If you installed the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example, *http://<hostname>:<port>/HelpDesk/default.asp*x or*http://<hostname>:<port>/<virtualdirectory>/default.aspx* - - If the server features were installed with network encryption, change http:// to https://. - - - -## Related topics - - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md deleted file mode 100644 index c4e74fd53a..0000000000 --- a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md +++ /dev/null @@ -1,345 +0,0 @@ ---- -title: How to Install and Configure MBAM on Distributed Servers -description: How to Install and Configure MBAM on Distributed Servers -author: dansimp -ms.assetid: 67b91e6b-ae2e-4e47-9ef2-6819aba95976 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install and Configure MBAM on Distributed Servers - - -The procedures in this topic describe how to install Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 in the Stand-alone topology on distributed servers. To see a diagram of the recommended architecture, along with a description of the databases and features, see [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md). To install Microsoft BitLocker Administration and Monitoring with the Configuration Manager topology, see [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md). - -Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) and [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). In addition, some features require that you provide certain information during the installation process to successfully deploy the feature. You should also review [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) before you start the MBAM deployment. - -**Note** -To obtain the setup log files, you have to use the Msiexec package and the **/L** <location> option to install MBAM. Log files are created in the location that you specify. - -Additional setup log files are created in the %temp% folder on the server of the user who is installing MBAM. - - - -## Deploying MBAM Server Features - - -The following steps describe how to install general MBAM features. - -**To start the MBAM Server installation wizard** - -1. On the server where you want to install Microsoft BitLocker Administration and Monitoring, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **Stand-alone** topology, and then click **Next**. - - **Note** - If you want to install MBAM with the Configuration Manager integrated topology, see [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md). - - - -5. Select the features that you want to install. By default, all MBAM features are selected for installation. Clear the features that you want to install elsewhere. Features that will be installed on the same computer must be installed together at the same time. You must install MBAM features in the following order: - - - Recovery Database - - - Compliance and Audit Database - - - Compliance and Audit Reports - - - Self-Service Portal - - - Administration and Monitoring Server - - - MBAM Group Policy template - - **Note** - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes. - - - -~~~ -The MBAM Setup wizard displays installation pages for the features that you select. The following sections describe the installation procedures for each feature. - -**Note** -For the following instructions, it is assumed that each feature is to be installed on a separate server. If you install multiple features on a single server, you can change or eliminate some steps. -~~~ - - - -**To install the Recovery Database** - -1. On the **Configure the Recovery database** page, specify the names of the computers that will be running the Administration and Monitoring Server feature. After the Administration and Monitoring Server feature is deployed, it uses its domain account to connect to the database. - -2. Click **Next** to continue. - -3. Specify the SQL Server instance name and the name of the database that will store the recovery data. You must also specify both where the database will be located and where the log information will be located. - -4. Click **Next** to continue with the MBAM Setup wizard. - -**To install the Compliance and Audit Database** - -1. On the **Configure the Compliance and Audit Database** page, specify the user account that will be used to access the database for reports. - -2. Specify the computer names of the computers that will be running the Administration and Monitoring Server and the Compliance and Audit Reports. After the Administration and Monitoring and the Compliance and Audit Reports Server are deployed, they use their domain accounts to connect to the databases. - - **Note** - If you are installing the Compliance and Audit Database without the Compliance and Audit Reports feature, you must add an exception on the Compliance and Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433. - - - -3. Specify the SQL Server instance name and the name of the database that will store the compliance and audit data. You must also specify where the database and log information will be located. - -4. Click **Next** to continue with the Microsoft BitLocker Administration and Monitoring Setup wizard. - -**To install the Compliance and Audit Reports** - -1. On the **Configure the Compliance and Audit Reports** page, specify the remote SQL Server instance name (for example, <ServerName>) where the Compliance and Audit Database was installed. - - **Note** - If you are installing the Compliance and Audit Reports without the Administration and Monitoring Server, you must add an exception on the Compliance and Audit Report computer to enable inbound traffic on the Reporting Server port (the default port is 80). - - - -2. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, although you can change the name when you install the Compliance and Audit Database. - -3. Click **Next** to continue. - -4. Select the instance of SQL Server Reporting Services where the Compliance and Audit Reports will be installed. Provide a domain user account and password to access the Compliance and Audit Database. Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group. - -5. Click **Next** to continue with the Microsoft BitLocker Administration and Monitoring Setup wizard. - -**To install the Self-Service Portal** - -1. On the **Configure the Self-Service Portal** page, you can optionally encrypt the communication between the Self-Service Portal and the Administration and Monitoring servers. If you choose the option to encrypt the communication, you are prompted to select the certification authority-provisioned certificate to use for encryption. - -2. Click **Next** to continue. - -3. Specify the remote instance of SQL Server (for example, *<ServerName>*) where the Compliance and Audit Database was installed. - -4. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status. However, you can change the name when you install the Compliance and Audit Database. - -5. Click **Next** to continue. - -6. Specify the remote instance of SQL Server (for example, *<ServerName>*) where the Recovery Database was installed. - -7. Specify the name of the Recovery Database. By default, the database name is **MBAM Recovery and Hardware**. However, you can change the name when you install the Recovery Database feature. - -8. Click **Next** to continue. - -9. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring Server. - - **Note** - The port number that you specify must be an unused port number on the Administration and Monitoring server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically. - - - -10. To optionally register a Service Principal Name (SPN) for the Self-Service Portal, select **Register this machine’s Service Principal Names (SPN) with Active Directory (Required for Windows Authentication)**. If you select this check box, MBAM Setup will not try to register the existing SPNs, and you can manually register the SPN before or after the MBAM installation. For instructions on registering the SPN manually, see [Manual SPN Registration](https://go.microsoft.com/fwlink/?LinkId=286758). - -11. Click **Next** to continue with the Microsoft BitLocker Administration and Monitoring Setup wizard. - -12. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. - -13. When the selected MBAM feature information is completed, you are ready to start the MBAM installation by using the Setup wizard. Click **Back** to move through the wizard if you have to review or change your installation settings. Click **Install** to start the installation. Click **Cancel** to exit the wizard. Setup installs the MBAM features that you selected and notifies you that the installation is finished. - -14. Click **Finish** to exit the wizard. - - **Note** - To configure the Self-Service Portal after you installed it, brand the Self-Service Portal with your company name and other company-specific information, see [How to Brand the Self-Service Portal](how-to-brand-the-self-service-portal.md) for instructions. - - - -15. If the client computers have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, you are finished with the Self-Service Portal installation. If the client computers does not have access to the Microsoft CDN, complete the steps in the next section to configure the Self-Service Portal to reference the JavaScript files from an accessible source. - -**To configure the Self-Service Portal when end users cannot access the Microsoft Content Delivery Network** - -1. If the client computers have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, the Self-Service Portal installation is completed. If the client computers do not have access to the Microsoft CDN, complete the remaining steps in this section to configure the Self-Service Portal to reference the JavaScript files from an accessible source. - -2. Download the four JavaScript files from the Microsoft CDN: - - - jQuery-1.7.2.min.js - [https://go.microsoft.com/p/fwlink/?LinkID=271736](https://go.microsoft.com/fwlink/p/?LinkID=271736) - - - MicrosoftAjax.js –[https://go.microsoft.com/p/fwlink/?LinkId=272283](https://go.microsoft.com/fwlink/p/?LinkId=272283) - - - MicrosoftMvcAjax.js - [https://go.microsoft.com/p/fwlink/?LinkId=272284](https://go.microsoft.com/fwlink/p/?LinkId=272284) - - - MicrosoftMvcValidation.js - - -3. Copy the JavaScript files to the **Scripts** directory of the Self-Service Portal. This directory is located in <MBAM Self-Service Install Directory>\\Self Service Website\\Scripts. - -4. Open **Internet Information Services (IIS) Manager**. - -5. Expand **Sites** > **Microsoft BitLocker Administration and Monitoring**, and highlight **SelfService**. - - **Note** - *SelfService* is the default virtual directory name. If you chose a different name for this directory during installation, remember to replace *SelfService* in the rest of these instructions with the name you chose. - - - -6. In the middle pane, double-click **Application Settings**. - -7. For each item in the following list, edit the application settings to reference the new location by replacing <virtual directory> with /SelfService/ (or the name you chose during installation). For example, the virtual directory path will be similar to /selfservice/scripts/jquery-1.7.2.min.js. - - - jQueryPath: /<virtual directory>/Scripts/ jQuery-1.7.2.min.js - - - MicrosoftAjaxPath: /<virtual directory>/Scripts/ MicrosoftAjax.js - - - MicrosoftMvcAjaxPath: /<virtual directory>/Scripts/ MicrosoftMvcAjax.js - - - MicrosoftMvcValidationPath: /<virtual directory>/Scripts/ MicrosoftMvcValidation.js - -**To install the Administration and Monitoring Server feature** - -1. MBAM can encrypt the communication between the Web Services and the Administration and Monitoring servers. If you choose the option to encrypt the communication, you are prompted to select the certification authority-provisioned certificate to use for encryption. - -2. Click **Next** to continue. - -3. Specify the remote instance of SQL Server (for example: *<ServerName>*) where the Compliance and Audit Database was installed. - -4. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status. However, you can change the name when you install the Compliance and Audit Database. - -5. Click **Next** to continue. - -6. Specify the remote instance of SQL Server (for example: *<ServerName>*) where the Recovery Database was installed. - -7. Specify the name of the Recovery Database. By default, the database name is **MBAM Recovery and Hardware**. However, you can change the name when you install the Recovery Database feature. - -8. Click **Next** to continue. - -9. Specify the URL for the “Home” of the SQL Server Reporting Services (SRS) site. The default Home location of a SQL Server Reporting Services site instance is at: - - http://<NameofMBAMReportsServer>/ReportServer - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL resembles the following: http://*<NameofMBAMReportsServer>*/ReportServer\_*<SRSInstanceName>*. - - - -10. Click **Next** to continue. - -11. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring Server. - - **Note** - The port number that you specify must be an unused port number on the Administration and Monitoring server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically. - - - -12. To optionally register a Service Principal Name (SPN) for the Self-Service Portal, select **Register this machine’s Service Principal Names (SPN) with Active Directory (Required for Windows Authentication)**. If you select this check box, MBAM Setup will not try to register the existing SPNs, and you can manually register the SPN before or after the MBAM installation. For instructions on registering the SPN manually, see [Manual SPN Registration](https://go.microsoft.com/fwlink/?LinkId=286758). - -13. Click **Next** to continue with the Microsoft BitLocker Administration and Monitoring Setup wizard. - -14. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. - -15. When the selected MBAM feature information is completed, you are ready to start the MBAM installation by using the Setup wizard. Click **Back** to move through the wizard if you have to review or change your installation settings. Click **Install** to being the installation. Click **Cancel** to exit the wizard. Setup installs the MBAM features that you selected and notifies you that the installation is finished. - -16. Click **Finish** to exit the wizard. - -**To perform post-installation configuration** - -1. On the Administration and Monitoring Server, add users to the following local groups to give them access to the features on the MBAM Administration and Monitoring website. - - - **MBAM Helpdesk Users**: Members of this local group can access the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User. - - - **MBAM Advanced Helpdesk Users**: Members of this local group have advanced access to the Drive Recovery and Manage TPM features on the MBAM Administration and Monitoring website. For Advanced Helpdesk Users, only the Key ID field is required in Drive Recovery. In **Manage TPM**, only the **Computer Domain** field and **Computer Name** field are required. - -2. On the server that hosts Administration and Monitoring Server and the Compliance and Audit Database and on the server that hosts the Compliance and Audit Reports, add users to the following local group to give them access to the Reports feature on the MBAM Administration and Monitoring website. - - - **MBAM Report Users**: Members of this local group can access the reports on the MBAM Administration and Monitoring website. - - **Note** - Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and the Compliance and Audit Reports are installed. - - - -## Validating the MBAM Server Feature Installation - - -When Microsoft BitLocker Administration and Monitoring Server feature installation is completed, we recommend that you validate that the installation has successfully set up all the necessary features for MBAM. Use the following procedure to confirm that the Microsoft BitLocker Administration and Monitoring service is functional. - -**To validate an MBAM Server installation** - -1. On each server where an MBAM feature is deployed, open **Control Panel**, select **Programs**, and then select **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To validate the MBAM installation, you must use a domain account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed. - -3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance Status Database** is installed. - -4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative credentials and browse to the “Home” of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance can be found is at http://<NameofMBAMReportsServer>/Reports.aspx. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that were specified during setup. - - Confirm that a reports folder named **Microsoft BitLocker Administration and Monitoring** contains a data source called **MaltaDataSource** and that an **en-us** folder contains four reports. - - **Note** - If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>* - - - -~~~ -**Note** -If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring website and select a report, the following message appears: “Only Secure Content is Displayed.” To show the report, click **Show All Content**. -~~~ - - - -5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**. Select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager**. - -6. In **Connections**, browse to *<computername>*, select **Sites**, and select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed. - -7. On the server where the Administration and Monitoring features and Self-Service Portal are installed, open a web browser with administrative credentials and browse to the following locations to verify that they load successfully. - - **Note** - The URLs ending in “.svc” do not display a website. Success is indicated by the message “Metadata publishing for this service is currently disabled” or by information resembling code. If you see some other error message or if the page cannot be found, the page has not loaded successfully. - - - -~~~ -- *http://<hostname>/HelpDesk/default.aspx* and confirm each of the links for navigation and reports - -- *http://<hostname>/SelfService>/* - -- *http://<computername>/MBAMAdministrationService/AdministrationService.svc* - -- *http://<hostname>/MBAMUserSupportService/UserSupportService.svc* - -- *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc* - -- *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc* - -**Note** -It is assumed that the server features were installed on the default port without network encryption. If you installed the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example, *http://<hostname>:<port>/HelpDesk/default.aspx* or*http://<hostname>:<port>/<virtualdirectory>/default.aspx* - -If the server features were installed with network encryption, change http:// to https://. -~~~ - - - -8. Verify that each webpage loads successfully. - -## Related topics - - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md b/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md deleted file mode 100644 index ef5c19da6f..0000000000 --- a/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md +++ /dev/null @@ -1,149 +0,0 @@ ---- -title: How to Install MBAM with Configuration Manager -description: How to Install MBAM with Configuration Manager -author: dansimp -ms.assetid: fd0832e4-3b79-4e56-9550-d2f396be6d09 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install MBAM with Configuration Manager - - -This section describes the steps to install MBAM with Configuration Manager by using the recommended configuration, which is illustrated in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md). The steps are divided into the following tasks: - -- Install and configure MBAM on the Configuration Manager Server - -- Install the Recovery and Audit Databases on the Database Server - -- Install the Administration and Monitoring Server features on the Administration and Monitoring Server - -Before you begin the installation, ensure that you have edited or created the necessary mof files. For instructions, see [How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md). - -**Important**   -If you are using a non-default SQL Server Reporting Services (SSRS) instance, you must start the MBAM Setup by using the following command line to specify the SSRS named instance: - -`MbamSetup.exe CM_SSRS_INSTANCE_NAME=` - - - -**To install MBAM on the Configuration Manager Server** - -1. On the Configuration Manager Server, run **MBAMSetup.exe** to start the MBAM installation wizard. - - **Note**   - To obtain the setup log files, you have to use the Msiexec package and the **/L** <location> option to install Configuration Manager. Log files are created in the location that you specify. - - Additional setup log files are created in the %temp% folder on the computer of the user who is installing Configuration Manager. - - - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select **System Center Configuration Manager Integration**, and then click **Next**. - -5. On the **Select features to install** page, select **System Center Configuration Manager Integration**. - - **Note**   - On the **Checking Prerequisites** page, click **Next** after the installation wizard checks the prerequisites for your installation and confirms that none are missing. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again.** - - - -6. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. Using Microsoft Updates does not turn on Automatic Updates in Windows. - -7. Click **Next** to continue. - -8. On the **Installation Summary** page, review the list of features that will be installed, and click **Install** to start installing the MBAM features. Click **Back** to move back through the wizard if you have to review or change your installation settings, or click **Cancel** to exit Setup. Setup installs the MBAM features and notifies you that the installation is completed. - -9. Click **Finish** to exit the wizard. - -**To install the Recovery and Audit Databases on the Database Server** - -1. On the Database Server, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **System Center Configuration Manager Integration** topology, and then click **Next**. - -5. From the list of features to install, select **Recovery Database** and **Audit Database**, and clear the remaining features. - - **Note**   - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes. - - - -6. On the **Configure the Recovery Database** page, specify the names of the computers that will be running the Administration and Monitoring Server feature. After the Administration and Monitoring Server feature is deployed, it uses its domain account to connect to the database. - -7. Click **Next** to continue. - -8. Specify the SQL Server instance name and the name of the database that will store the recovery data. You must also specify both where the database will be located and where the log information will be located. - -9. Click **Next** to continue with the MBAM Setup installation wizard. - -10. On the **Configure the Audit Database** page, specify the user account that will be used to access the database for reports. - -11. Specify the computer names of the computers that will be running the Administration and Monitoring Server and the Audit Reports. After the Administration and Monitoring and the Audit Reports features are deployed, their domain accounts will be used to connect to the databases. - - **Note**   - If you are installing the Audit Database without the Audit Reports feature, you must add an exception on the Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433. - - - -12. Specify the SQL Server instance name and the name of the database that will store the audit data. You must also specify where the database and log information will be located. - -13. Click **Install** to start the installation, and then click **Finish** to complete the installation. - -**To install the Administration and Monitoring Server features on the Administration and Monitoring Server** - -1. On the Administration and Monitoring Server, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **System Center Configuration Manager Integration** topology, and then click **Next**. - -5. From the list of features to install, select **Administration and Monitoring Server** and **Self-Service Portal**, and clear the remaining features. - - **Note**   - The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes. - - - -6. Install the Self-Service Portal by following the steps in the **To install the Self-Service Portal** section in [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md). - - **Note**   - If the client computers will not have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, complete the steps in the **To configure the Self-Service Portal when end users cannot access the Microsoft Content Delivery Network** section [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md) to configure the Self-Service Portal to reference the JavaScript files from an accessible source. - - - -7. Install the Administration and Monitoring Server features by following the steps in the **To install the Administration and Monitoring Server feature** section in [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md). - -8. Click **Finish** to complete the installation. - -## Related topics - - -[How to Validate the MBAM Installation with Configuration Manager](how-to-validate-the-mbam-installation-with-configuration-manager.md) - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md b/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md deleted file mode 100644 index 88d1e84dc4..0000000000 --- a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: How to Install the MBAM 2.0 Group Policy Template -description: How to Install the MBAM 2.0 Group Policy Template -author: dansimp -ms.assetid: bc193232-d060-4285-842e-d194a74dd3c9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MBAM 2.0 Group Policy Template - - -In addition to the server-related Microsoft BitLocker Administration and Monitoring (MBAM) features, the server setup application includes an Microsoft BitLocker Administration and Monitoring Group Policy template. This template can be installed on any computer capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -The following steps describe how to install the MBAM Group Policy template. - -**Note**   -Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers. - - - -**To install the MBAM Group Policy template** - -1. On the server where you want to install MBAM, run **MBAMSetup.exe** to start the MBAM installation wizard. - -2. On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Terms, and then click **Next** to continue the installation. - -4. By default, all Microsoft BitLocker Administration and Monitoring features are selected for installation. Clear all feature options except for **Policy Template**, and then click **Next** to continue the installation. - - **Note**   - The installation wizard checks the prerequisites for your installation and displays prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. Once all prerequisites are met, the installation will resume. - - - -5. For specific steps about how and where to install the templates, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx). - -6. After the Microsoft BitLocker Administration and Monitoring Setup wizard displays installation pages for the selected features, click **Finish** to close MBAM Setup. - -## Related topics - - -[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md b/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md deleted file mode 100644 index 4f2389ef54..0000000000 --- a/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: How to Manage MBAM Administrator Roles -description: How to Manage MBAM Administrator Roles -author: dansimp -ms.assetid: 813ac0c4-3cf9-47af-b4cb-9395fd915e5c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage MBAM Administrator Roles - - -After Microsoft BitLocker Administration and Monitoring (MBAM) Setup is complete for all server features, administrative users will have to be granted access to them. As a best practice, administrators who will manage or use Microsoft BitLocker Administration and Monitoring Server features should be assigned to Domain Services security groups, and then those groups should be added to the appropriate MBAM administrative local group. - -**To manage MBAM Administrator Role memberships** - -1. Assign administrative users to security groups in Active Directory Domain Services. - -2. Add Active Directory security groups to the roles for MBAM administrative local groups on the MBAM server for the respective features. - - - **MBAM System Administrators** have access to all MBAM features in the MBAM Administration and Monitoring website. - - - **MBAM Helpdesk Users** have access to the Manage TPM and Drive Recovery options in the MBAM Administration and Monitoring website, but must fill in all fields when they use either option. - - - **MBAM Report Users** have access to the Compliance and Audit reports in the MBAM Administration and Monitoring website. - - - **MBAM Advanced Helpdesk Users** have access to the Manage TPM and Drive Recovery options in the MBAM Administration and Monitoring website, but are not required to fill in all fields when they use either option. - - For more information about roles for Microsoft BitLocker Administration and Monitoring, see [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md). - -## Related topics - - -[Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md b/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md deleted file mode 100644 index fafcf4f205..0000000000 --- a/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -description: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -author: dansimp -ms.assetid: e2ff153e-5770-4a12-b79d-cda998b8a8ab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel - - -A Microsoft BitLocker Administration and Monitoring (MBAM) control panel application, called BitLocker Encryption Options, will be available under **System and Security** when the Microsoft BitLocker Administration and Monitoring Client is installed. This custom MBAM control panel is an additional control panel. It does not replace the default Windows BitLocker control panel. The MBAM control panel can be used to unlock encrypted fixed and removable drives, and also manage your PIN or password. For more information about enabling the MBAM control panel, see [How to Hide Default BitLocker Encryption in the Windows Control Panel](how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md). - -**To use the MBAM Client Control Panel** - -1. To open BitLocker Encryption Options, click **Start** and then select **Control Panel**. When **Control Panel** opens, select **System and Security**. - -2. Double-click **BitLocker Encryption Options** to open the customized MBAM control panel. You will see a list of all the hard disk drives on the computer and their encryption status, in addition to an option to manage your PIN or passwords. - - The list of hard disk drives on the computer can be used to verify encryption status, unlock a drive, or request an exemption for BitLocker protection if the User and Computer Exemption policies have been deployed. - - The BitLocker Encryption Options control panel also allows for non-administrator users to manage their PIN or passwords. By selecting **Manage PIN**, users are prompted to enter both a current PIN and a new PIN (in addition to confirming the new PIN). Selecting **Update PIN** will reset the PIN to the new one that the users selected. - - To manage your password, select **Unlock drive** and enter your current password. As soon as the drive is unlocked, select **Reset Password** to change your current password. - -## Related topics - - -[Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md b/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md deleted file mode 100644 index a19aea482c..0000000000 --- a/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Manage User BitLocker Encryption Exemptions -description: How to Manage User BitLocker Encryption Exemptions -author: dansimp -ms.assetid: 1bfd9d66-6a9a-4d0e-b54a-e5a6627f5ada -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage User BitLocker Encryption Exemptions - - -Microsoft BitLocker Administration and Monitoring (MBAM) can be used to manage BitLocker protection by exempting users if there are users who do not need or want their drives encrypted. - -To exempt users from BitLocker protection, an organization will have to create an infrastructure to support exempted users, such as giving the user a contact telephone number, webpage, or mailing address to use to request an exemption. Also, an exempt user will have to be added to a security group for a Group Policy Object that was created specifically for exempted users. When members of this security group log on to a computer, the user’s Group Policy setting shows that the user is exempted from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption. - -**Note**   -If the computer is already BitLocker-protected, the user exemption policy has no effect. - - - -The following table shows how BitLocker protection is applied based on how exemptions are set. - - ----- - - - - - - - - - - - - - - - - - - - -
    User StatusComputer Not ExemptComputer Exempt

    User not exempt

    BitLocker protection is enforced on computer

    BitLocker protection is not enforced on computer

    User exempt

    BitLocker protection is not enforced on computer

    BitLocker protection is not enforced on computer

    - - - -**To exempt a user from BitLocker encryption** - -1. Create an Active Directory Domain Services security group that will be used to manage user exemptions from BitLocker encryption requirements. - -2. Create a Group Policy Object setting by using the Microsoft BitLocker Administration and Monitoring Group Policy template and associate it with the Active Directory group that you created in the previous step. The policy settings to exempt users can be found under **UserConfiguration\\Administrative Templates\\Windows Components\\MDOP MBAM (BitLocker Management)**. - -3. After creating a security group for BitLocker-exempted users, add to this group the names of the users who are requesting an exemption. When users log on to a computer controlled by BitLocker, the MBAM client will check the User Exemption Policy setting and will suspend protection based on whether the user is part of the BitLocker exemption security group. - - **Important**   - Shared computer scenarios require special consideration when using user exemptions. If a non-exempt user logs on to a computer shared with an exempt user, the computer may be encrypted. - - - -**To enable users to request an exemption from BitLocker encryption** - -1. If you have configured user exemption policies by using the MBAM policy template, a user can request an exemption from BitLocker protection through the MBAM client. - -2. When users log on to a computer that is required to be encrypted, they receive a notification that their computer is going to be encrypted. They can select **Request Exemption** and postpone the encryption by selecting **Later**, or select **Start** to accept the BitLocker encryption. - - **Note**   - Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy. - - - -3. If users select **Request Exemption**, they receive a notification telling them to contact your organization’s BitLocker administration group. Depending on how the Configure User Exemption Policy is configured, users are provided with one or more of the following contact methods: - - - Phone Number - - - Webpage URL - - - Mailing Address - - After the exemption request is received, the MBAM Administrator can take decide if it is appropriate to add the user to the BitLocker Exemption Active Directory group. - - **Note**   - Once a user submits an exemption request, the MBAM agent reports the user as “temporarily exempt” and then waits a configurable number of days before it checks the computer’s compliance again. If the MBAM administrator rejects the exemption request, the exemption request option is deactivated, which prevents the user from being able to request the exemption again. - - - -## Related topics - - -[Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md deleted file mode 100644 index 353753ffd1..0000000000 --- a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md +++ /dev/null @@ -1,700 +0,0 @@ ---- -title: How to Move MBAM 2.0 Features to Another Computer -description: How to Move MBAM 2.0 Features to Another Computer -author: dansimp -ms.assetid: 49bc0792-60a4-473f-89cc-ada30191e04a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move MBAM 2.0 Features to Another Computer - - -This topic describes the steps that you should take to move one or more Microsoft BitLocker Administration and Monitoring (MBAM) features to a different computer. When moving more than one Microsoft BitLocker Administration and Monitoring feature, you should move them in the following order: - -1. Recovery Database - -2. Compliance and Audit Database - -3. Compliance and Audit Reports - -4. Administration and Monitoring - -## Moving the Recovery Database - - -To move the Recovery Database from one computer to another (for example, from Server A to Server B), use the following procedure. - -1. Stop all instances of the Administration and Monitoring web site. - -2. Run MBAM Setup on Server B. - -3. Back up the MBAM Recovery Database on Server A. - -4. Move the MBAM Recovery Database from Server A to B. - -5. Restore the MBAM Recovery Database on Server B. - -6. Configure access to the MBAM Recovery Database on Server B. - -7. Update the database connection data on MBAM Administration and Monitoring servers. - -8. Resume all instances of the MBAM Administration and Monitoring website. - -**Stop All Instances of the MBAM Administration and Monitoring Website** - -1. On each of the servers running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to stop the MBAM website, which is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter command line that is similar to the: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To run this PowerShell command line, the IIS Module for PowerShell must be added to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable execution of scripts. - - - -**Run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select only the **Recovery Database** for installation. - -2. To automate this procedure, you can use Windows PowerShell to enter command line that is similar to the following: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=KeyDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ TOPOLOGY=$X$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery Database will be moved. - - - $DOMAIN$\\$SERVERNAME$ - Enter the domain and server names of each MBAM Administration and Monitoring Server that will contact the Recovery Database. Use a semi-colon to separate each domain and server pairs in the list (for example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$). Each server name must be followed by a “$” symbol, as shown in the example (MyDomain\\MyServerName1$; MyDomain\\MyServerName2$). - - - $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology. - - - -**Back Up the Recovery Database on Server A** - -1. To back up the Recovery Database on Server A, use SQL Server Management Studio and the Task named Back Up. By default, the database name is **MBAM Recovery Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - Modify the MBAM Recovery Database to use the full recovery mode. - - ```sql - USE master; - - GO - - ALTER DATABASE "MBAM Recovery and Hardware" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Recovery Database Data and MBAM Recovery logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - - 'Z:\MBAM Recovery Database Data.bak'; - - GO - - -- Back up the full MBAM Recovery Database. - - BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - - GO - - BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - - TO FILE = 'Z:\SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - ENCRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - ``` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $PASSWORD$ - Enter a password that you will use to encrypt the Private Key file. - - - -3. Run the SQL File by using SQL Server PowerShell and a command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\BackupMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance from which the Recovery Database will be backed up. - - - -**Move the Recovery Database and Certificate from Server A to Server B** - -1. Move the following file from Server A to Server B by using Windows Explorer. - - - MBAM Recovery Database data.bak - -2. To move the certificate for the encrypted database, use the following automation steps. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Copy-Item “Z:\MBAM Recovery Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$` - - `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFile” \\$SERVERNAME$\$DESTINATIONSHARE$` - - `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFilePrivateKey” \\$SERVERNAME$\$DESTINATIONSHARE$` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$ - Enter the name of the server to which the files will be copied. - - - $DESTINATIONSHARE$ - Enter the name of the share and path to which the files will be copied. - - - -**Restore the Recovery Database on Server B** - -1. Restore the Recovery Database on Server B by using SQL Server Management Studio and the task named **Restore Database**. - -2. Once the task has been completed, select the database backup file by selecting the **From Device** option and then use the **Add** command to select the MBAM Recovery database **Data.bak** file. - -3. Select **OK** to complete the restoration process. - -4. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Restore MBAM Recovery Database. - - USE master - - GO - - -- Drop certificate created by MBAM Setup. - - DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - - GO - - --Add certificate - - CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - - FROM FILE = 'Z: \SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - DECRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - - -- Restore the MBAM Recovery Database data and log files. - - RESTORE DATABASE [MBAM Recovery and Hardware] - - FROM DISK = 'Z:\MBAM Recovery Database Data.bak' - - WITH REPLACE - ``` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $PASSWORD$ - Enter a password that you used to encrypt the Private Key file. - - - -5. You can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\RestoreMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery Database will be restored. - - - -**Configure Access to the Recovery Database on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager to add the computer accounts from each server that is running the MBAM Administration and Monitoring feature to the Local Group named **MBAM Recovery and Hardware DB Access**. - -2. Verify that the SQL login **MBAM Recovery and Hardware DB Access** on the restored database is mapped to the login name **$MachineName$\\MBAM Recovery and Hardware DB Access**. If it is not mapped as described, create another login with similar group memberships, and map it to the login name **$MachineName$\\MBAM Recovery and Hardware DB Access**. - -3. To automate this procedure, you can use Windows PowerShell on Server B to enter a command line that is similar to the following: - - `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - **Note** - Replace the following values in the example above with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a $, as shown in the example (for example, MyDomain\\MyServerName1$). - - - -~~~ -This command line must be run for each Administration and Monitoring Server that will be accessing the database in your environment. -~~~ - -**Update the Recovery Database Connection Data on the MBAM Administration and Monitoring Servers** - -1. On each of the servers running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following applications, which are hosted in the Administration and Monitoring website: - - - MBAMAdministrationService - - - MBAMRecoveryAndHardwareService - -2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**. - -3. Select the **configurationStrings** option from the **Section list** control. - -4. Select the row named **(Collection)** and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named **KeyRecoveryConnectionString** when updating the configuration for the MBAMAdministrationService application or the row named Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString when updating the configuration for the MBAMRecoveryAndHardwareService. - -6. Update the **Data Source=** value for the **configurationStrings** property to list the server name and instance (for example, $SERVERNAME$\\$SQLINSTANCENAME$) where the Recovery Database was moved to. - -7. To automate this procedure, you can use Windows to enter a command line, that is similar to the following, on each Administration and Monitoring Server: - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value “Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;”` - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;"` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery Database is. - - - -**Resume all Instances of the MBAM Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to start the MBAM website, which is named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - -## Moving the Compliance and Audit Database Feature - - -If you want to move the MBAM Compliance and Audit Database from one computer to another (that is, move the database from Server A to Server B), use the following procedure. The process includes the following high-level steps: - -1. Stop all instances of the Administration and Monitoring website. - -2. Run MBAM setup on Server B. - -3. Back up the Database on Server A. - -4. Move the Database from Server A to B. - -5. Restore the Database on Server B. - -6. Configure access to the Database on Server B. - -7. Update the database connection data on the MBAM Administration and Monitoring servers. - -8. Update the SSRS reports data source connection string with the new location of the Compliance and Audit Database. - -9. Resume all instances of the Administration and Monitoring website. - -**Stop All Instances of the Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to stop the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Stop-s “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To run this command line, you must add the IIS Module for PowerShell to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable scripts to be run. - - - -**Run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select only the **Compliance and Audit Database** for installation. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal= ReportsDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$ COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNT=$DOMAIN$\$USERNAME$ TOPOLOGY=$X$` - - **Note** - Note: Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database will be moved to. - - - $DOMAIN$\\$SERVERNAME$ - Enter the domain and server names of each MBAM Administration and Monitoring Server that will contact the Compliance and Audit Database. Use a semi-colon to separate each domain and server pair in the list (for example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$). Each server name must be followed by a “$” symbol, as shown in the example (MyDomain\\MyServerName1$; MyDomain\\MyServerName2$). - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit Reports feature to connect to the Compliance and Audit Database. - - - $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology. - - - -**Back Up the Compliance and Audit Database on Server A** - -1. To back up the Compliance and Audit Database on Server A, use SQL Server Management Studio and the task named **Back Up**. By default, the database name is **MBAM Compliance Status Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Modify the MBAM Compliance Status Database to use the full recovery model. - - USE master; - - GO - - ALTER DATABASE "MBAM Compliance Status" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Compliance Status Data logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - - 'Z: \MBAM Compliance Status Database Data.bak'; - - GO - - -- Back up the full MBAM Recovery database. - - BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - - GO - ``` - -3. Run the SQL file by using a Windows PowerShell command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile "Z:\BackupMBAMComplianceStatusDatabaseScript.sql" –ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit database will be backed up from. - - - -**Move the Compliance and Audit Database from Server A to B** - -1. Move the following files from Server A to Server B using Windows Explorer. - - - MBAM Compliance Status Database Data.bak - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Copy-Item “Z:\MBAM Compliance Status Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$ - Enter the server name where the files will be copied to. - - - $DESTINATIONSHARE$ - Enter the name of share and path where the files will be copied to. - - - -**Restore the Compliance and Audit Database on Server B** - -1. Restore the Compliance and Audit Database on Server B by using SQL Server Management Studio and the task named **Restore Database**. - -2. Once the task has been completed, select the database backup file by selecting the **From Device** option and then use the **Add** command to select the MBAM Compliance Status Database Data.bak file. Select **OK** to complete the restoration process. - -3. To automate this procedure, create a SQL file (.sql) that contains the following-SQL script: - - ```sql - -- Create MBAM Compliance Status Database Data logical backup devices. - - Use master - - GO - - -- Restore the MBAM Compliance Status database data files. - - RESTORE DATABASE [MBAM Compliance Status] - - FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - - WITH REPLACE - ``` - -4. Run the SQL File by using a Windows PowerShell command line that is similar to the following: - - `PS C:\> Invoke-Sqlcmd -InputFile "Z:\RestoreMBAMComplianceStatusDatabaseScript.sql" -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$` - - **Note** - Replace the following value in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database will be restored to. - - - -**Configure Access to the Compliance and Audit Database on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager to add the computer accounts from each server that is running the MBAM Administration and Monitoring feature to the local group named **MBAM Compliance Status DB Access**. - -2. Verify that the SQL login **MBAM Compliance Auditing DB Access** on the restored database is mapped to the login name **$MachineName$\\ MBAM Compliance Auditing DB Access**. If it is not mapped as described, create another login with similar group memberships, and map it to the login name **$MachineName$\\ MBAM Compliance Auditing DB Access**. - -3. To automate this procedure, you can use Windows PowerShell to enter a command line on Server B that is similar to the following: - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$REPORTSUSERNAME$ /add` - - **Note** - Replace the following values in the example above with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a “$” as shown in the example. (for example, MyDomain\\MyServerName1$) - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit Reports. - - - -~~~ -The command line for adding the servers to the MBAM Compliance and Audit Database access local group must be run for each Administration and Monitoring Server that will be accessing the database in your environment. -~~~ - -**Update the Database Connection Data on MBAM Administration and Monitoring Servers** - -1. On each server that is running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the connection string information for the following applications, which are hosted in the Administration and Monitoring website: - - - MBAMAdministrationService - - - MBAMComplianceStatusService - -2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**. - -3. Select the **configurationStrings** option from the **Section list** control. - -4. Select the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named **ComplianceStatusConnectionString** when updating the configuration for the MBAMAdministrationService application, or the row named **Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString** when updating the configuration for the MBAMComplianceStatusService. - -6. Update the **Data Source=** value for the **configurationStrings** property to list the name of the server and instance (for example, $SERVERNAME$\\$SQLINSTANCENAME) to which the Recovery Database was moved. - -7. To automate this procedure, you can use Windows to enter a command line on each Administration and Monitoring Server that is similar to the following: - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="ComplianceStatusConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"` - - `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMComplianceStatusService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery Database is located. - - - -**Resume All Instances of the MBAM Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to start the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - -## Moving the Compliance and Audit Reports - - -If you want to move the MBAM Compliance and Audit Reports from one computer to another (that is, move the reports from Server A to Server B), use the following procedure, which includes the following high-level steps: - -1. Run MBAM setup on Server B. - -2. Configure access to the Compliance and Audit Reports on Server B. - -3. Stop all instances of the MBAM Administration and Monitoring website. - -4. Update the reports connection data on MBAM Administration and Monitoring servers. - -5. Resume all instances of the MBAM Administration and Monitoring website. - -**Run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select only the **Compliance and Audit Reports** feature for installation. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=Reports COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNTPW=$PASSWORD$ TOPOLOGY=$X$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database is located. - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit Reports feature to connect to the Compliance and Audit Database. - - - $PASSWORD$ - Enter the password of the user account that will be used to connect to the Compliance and Audit Database. - - - $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology. - - - -**Configure Access to the Compliance and Audit Reports on Server B** - -1. On Server B, use the Local user and Groups snap-in from Server Manager to add the user accounts that will have access to the Compliance and Audit Reports. Add the user accounts to the local group named MBAM Report Users. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line on Server B that is similar to the following: - - `PS C:\> net localgroup "MBAM Report Users" $DOMAIN$\$REPORTSUSERNAME$ /add` - - **Note** - Replace the following values in the example above with the applicable values for your environment: - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports. - - - -~~~ -The command line for adding the users to the MBAM Report Users local group must be run for each user that will be accessing the reports in your environment. -~~~ - -**Stop All Instances of the MBAM Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring Server feature, use the Internet Information Services (IIS) Manager console to stop the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”` - -**Update the Database Connection Data on the MBAM Administration and Monitoring Servers** - -1. On each server that is running the MBAM Administration and Monitoring Server feature, use the Internet Information Services (IIS) Manager console to update the Compliance and Audit Reports URL. - -2. Select the **Microsoft BitLocker Administration and Monitoring** website, and use the **Configuration Editor** feature that is location under the **Management** section of the **Feature View**. - -3. Select the **appSettings** option from the **Section list** control. - -4. Select the row named **(Collection)** and open the **Collection Editor** by selecting the button on the right side of the row. - -5. In the **Collection Editor**, select the row named **Microsoft.Mbam.Reports.Url**. - -6. Update the value for **Microsoft.Mbam.Reports.Url** to reflect the server name for Server B. If the Compliance and Audit Reports feature was installed on a named SQL Reporting Services instance, be sure to add or update the name of the instance to the URL (for example, http://$SERVERNAME$/ReportServer\_$SQLSRSINSTANCENAME$/Pages....) - -7. To automate this procedure, you can use Windows PowerShell to enter a command line on each Administration and Monitoring Server that is similar to the following: - - `PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\ \sites\Microsoft Bitlocker Administration and Monitoring\HelpDesk" -Name "Value" -Value “http://$SERVERNAME$/ReportServer_$SRSINSTANCENAME$/Pages/ReportViewer.aspx?/ Microsoft+BitLocker+Administration+and+Monitoring/”` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$ - Enter the name of the server name to which the Compliance and Audit Reports were installed. - - - $SRSINSTANCENAME$ - Enter the name of the SQL Reporting Services instance to which the Compliance and Audit Reports were installed. - - - -**Resume All Instances of the MBAM Administration and Monitoring Website** - -1. On each server that is running the MBAM Administration and Monitoring Server feature, use the Internet Information Services (IIS) Manager console to Start the MBAM website named **Microsoft BitLocker Administration and Monitoring**. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”` - - **Note** - To run this command line, you must add the IIS Module for PowerShell to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable scripts to be run. - - - -## Moving the Administration and Monitoring Feature - - -If you want to move the MBAM Administration and Monitoring Reports feature from one computer to another (that is, move the feature from Server A to Server B), use the following procedure, which includes the following high-level steps: - -1. Run MBAM Setup on Server B. - -2. Configure access to the Database on Server B. - -**Run MBAM Setup on Server B** - -1. Run MBAM Setup on Server B and select only the **Administration and Monitoring Server** feature for installation. - -2. To automate this procedure, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=AdministrationMonitoringServer, COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ SRS_REPORTSITEURL=$REPORTSSERVERURL$ TOPOLOGY=$X$` - - **Note** - Replace the following values in the example above with those that match your environment: - - - $SERVERNAME$\\$SQLINSTANCENAME$ - For the COMPLIDB\_SQLINSTANCE parameter, enter the server name and instance where the Compliance and Audit Database is located. For the RECOVERYANDHWDB\_SQLINSTANCE parameter, enter the server name and instance where the Recovery Database is located. - - - $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit Reports feature to connect to the Compliance and Audit Database. - - - $ REPORTSSERVERURL$ - Enter the URL for the Home location of the SQL Reporting Service website. If the reports were installed to a default SRS instance, the URL format will have the format “http:// $SERVERNAME$/ReportServer”. If the reports were installed to a default SRS instance, the URL format will have the format “http://$SERVERNAME$/ReportServer\_$SQLINSTANCENAME$”. - - - $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology. - - - -**Configure Access to the Databases** - -1. On the server or servers where the Recovery Database and Compliance and Audit Database are deployed, use the Local user and Groups snap-in from Server Manager to add the computer accounts from each server that is running the MBAM Administration and Monitoring Server feature to the local groups named **MBAM Recovery and Hardware DB Access** (Recovery DB Server) and **MBAM Compliance Status DB Access** (Compliance and Audit Database Server). - -2. To automate this procedure, you can use Windows PowerShell to enter a command line, that is similar to the following, on the server where the Compliance and Audit Database was deployed. - - `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$SERVERNAME$$ /add` - -3. On the server where the Recovery database was deployed, you can use Windows PowerShell to enter a command line that is similar to the following: - - `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$ /add` - - **Note** - Replace the following value in the example above with the applicable values for your environment: - - - $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the Administration and Monitoring Server. The server name must be followed by a “$” symbol, as shown in the example (for example, MyDomain\\MyServerName1$). - - - $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit Reports. - - - -~~~ -The command lines that are listed for adding server computer accounts to the MBAM local groups must be run for each Administration and Monitoring Server that will be accessing the databases in your environment. -~~~ - -## Related topics - - -[Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md deleted file mode 100644 index 0bc49581fa..0000000000 --- a/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Recover a Corrupted Drive -description: How to Recover a Corrupted Drive -author: dansimp -ms.assetid: b0457a00-f72e-4ad8-ab3b-7701851ca87e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Corrupted Drive - - -To recover a corrupted drive protected by BitLocker, a Microsoft BitLocker Administration and Monitoring (MBAM) Help Desk user will need to create a recovery key package file. This package file can then be copied to the computer that contains the corrupted drive, and then used to recover the drive. Use the following procedure for the steps needed to do this. - -**Important**   -To avoid a potential loss of data, it is strongly recommended that you read the “repair-bde” help and clearly understand how to use the command before completing the following instructions. - - - -**To recover a corrupted drive** - -1. To create the recovery key package necessary to recover a corrupted drive, start a web browser and open the MBAM Administration and Monitoring website. - -2. Select **Drive Recovery** from the left navigation pane. Enter the user’s domain name, user name, reason for unlocking the drive, and the user’s recovery password ID. - - **Note**   - If you are a member of the Help Desk Administrators role, you do not have to enter the user’s domain name or user name. - - - -3. Click **Submit**. The recovery key will be displayed. - -4. Click **Save**, and then select **Recovery Key Package**. The recovery key package will be created on your computer. - -5. Copy the recovery key package to the computer that has the corrupted drive. - -6. Open an elevated command prompt. To do this, click **Start** and type `cmd` in the **Search programs and files box**. Right-click **cmd.exe** and select **Run as Administrator**. - -7. At the command prompt, type the following: - - `repair-bde -kp -rp ` - - **Note**   - Replace <fixed drive> with an available hard disk drive that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified hard disk drive. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md deleted file mode 100644 index a4e2df88a3..0000000000 --- a/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: How to Recover a Drive in Recovery Mode -description: How to Recover a Drive in Recovery Mode -author: dansimp -ms.assetid: 8b792bc8-b671-4345-9d37-0208db3e5b03 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Drive in Recovery Mode - - -The encrypted drive recovery features of Microsoft BitLocker Administration and Monitoring (MBAM) ensure the capture and storage of data and availability of tools required to access a BitLocker-protected volume when BitLocker goes into recovery mode. A BitLocker-protected volume goes into recovery mode when a PIN or password is lost or forgotten, or when the Trusted Module Platform (TPM) chip detects changes to the BIOS or startup files of a computer. - -Use this procedure to access the centralized key recovery data system, which can provide a recovery password if a recovery password ID and associated user identifier are supplied. - -**Important** -Microsoft BitLocker Administration and Monitoring uses single-use recovery keys that expire upon use. The single use of a recovery password is automatically applied to operating system drives and fixed drives. On removable drives, it is applied when the drive is removed and then re-inserted and unlocked on a computer that has Group Policy settings activated to manage removable drives. - - - -**To recover a drive in recovery mode** - -1. Open a web browser and navigate to the Administration and Monitoring website. - -2. In the navigation pane, click **Drive Recovery**. The “Recover access to an encrypted drive” webpage opens. - -3. Enter the Windows Logon domain and user name of the user to view recovery information and the first eight digits of the recovery key ID to receive a list of possible matching recovery keys or the entire recovery key ID to receive the exact recovery key. - -4. Select one of the predefined options from the **Reason for Drive Unlock** list, and then click **Submit**. - - **Note** - If you are an MBAM Advanced Helpdesk user, the user domain and user ID entries are not required. - - - -~~~ -MBAM returns the following: - -- An error message if no matching recovery password is found - -- Multiple possible matches if the user has multiple matching recovery passwords - -- The recovery password and recovery package for the submitted user - - **Note** - If you are recovering a damaged drive, the recovery package option provides BitLocker with critical information that it needs to recover the drive. - - - -After the recovery password and recovery package are retrieved, the recovery password is displayed. -~~~ - -5. To copy the password, click **Copy Key**, and then paste the recovery password into an email message. Alternatively, click **Save** to save the recovery password to a file. - - When the user types the recovery password into the system or uses the recovery package, the drive is unlocked. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md deleted file mode 100644 index 8c02d3e434..0000000000 --- a/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Recover a Moved Drive -description: How to Recover a Moved Drive -author: dansimp -ms.assetid: 697cd78d-962c-411e-901a-2e9220ba6552 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Moved Drive - - -When you move an operating system drive that is encrypted by using Microsoft BitLocker Administration and Monitoring (MBAM), the drive will not accept the PIN that was used in a previous computer because of the change to the Trusted Platform Module (TPM) chip. To use the moved drive, you will need a way to obtain the recovery key ID to retrieve the recovery password. Use the following procedure to recover a drive that has moved. - -**To recover a moved drive** - -1. On the computer that contains the moved drive, start the computer in Windows recovery environment (WinRE) mode, or start the computer by using the Microsoft Diagnostic and Recovery Toolset (DaRT). - -2. Once the computer has been started with WinRE or DaRT, Microsoft BitLocker Administration and Monitoring will treat the moved operating system drive as a data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password. - - **Note**   - In some cases, you may be able to click **I forgot the PIN** during the startup process, and then enter the recovery mode to display the recovery key ID. - - - -3. Use the recovery key ID to retrieve the recovery password and unlock the drive from the Administration and Monitoring website. - -4. If the moved drive was configured to use a TPM chip on the original computer, you must take additional steps after unlocking the drive and completing the start process. In WinRE mode, open a command prompt and use the **manage-bde** tool to decrypt the drive. Using this tool is the only way to remove the TPM plus PIN protector without the original TPM chip. - -5. Once the removal is completed, start the computer normally. The MBAM agent will now enforce the policy to encrypt the drive with the new computer’s TPM plus PIN. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md b/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md deleted file mode 100644 index b41efb0bd6..0000000000 --- a/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Reset a TPM Lockout -description: How to Reset a TPM Lockout -author: dansimp -ms.assetid: 20719ab2-18ae-4d3b-989a-539341909816 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Reset a TPM Lockout - - -The Encrypted Drive Recovery feature of Microsoft BitLocker Administration and Monitoring (MBAM) encompasses both the capture and storage of data and the availability for tools that are needed to manage the Trusted Platform Module (TPM). This topic covers how to access the centralized Key Recovery data system in the Administration and Monitoring website, which can provide a TPM owner password file when a computer ID and associated user identifier are supplied. - -A TPM lockout can occur if a user enters the incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies from manufacturer to manufacturer. - -You can reset a TPM lockout only if MBAM owns the TPM. - -**To reset a TPM lockout** - -1. Open a web browser and navigate to the Administration and Monitoring website. - -2. In the left navigation pane, select **Manage TPM** to open the **Manage TPM** page. - -3. Enter the fully qualified domain name for the computer and the computer name, and enter the user’s Windows logon domain and the user’s user name to retrieve the TPM owner password file. - -4. From the **Reason for requesting TPM owner password file** list, select a reason for the request, and click **Submit**. - - MBAM returns one of the following: - - - An error message, if no matching TPM owner password file is found - - - The TPM owner password file for the submitted computer - - **Note** - If you are an Advanced Helpdesk user, the user domain and user ID fields are not required. - - - -~~~ -After the TPM owner password is retrieved, the owner password is displayed. -~~~ - -5. To save the password to a .tpm file, click the **Save** button. - - The user will run the TPM management console, select the **Reset TPM lockout** option, and provide the TPM owner password file to reset the TPM lockout. - - **Important** - Help Desk administrators should not give the TPM hash value or TPM owner password file to end users. The TPM information does not change, so it could pose a security risk if the file is given to end users. - - - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md deleted file mode 100644 index b28772f06b..0000000000 --- a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: How to Use a Command Line to Install the MBAM Client -description: How to Use a Command Line to Install the MBAM Client -author: dansimp -ms.assetid: 4dc8f944-c2fd-4d89-aed6-e9dc77de3ae4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use a Command Line to Install the MBAM Client - - -You can use a command line to deploy the Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Client. - -## Command Line for Deploying the MBAM 2.0 Client - - -Use the following command line to deploy the MBAM Client: - -`MBAMClientSetup.exe /q` - -## Related topics - - -[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md deleted file mode 100644 index 856a5c7584..0000000000 --- a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md +++ /dev/null @@ -1,219 +0,0 @@ ---- -title: How to Use a Command Line to Install the MBAM Server -description: How to Use a Command Line to Install the MBAM Server -author: dansimp -ms.assetid: 6ffc6d41-a793-42c2-b997-95ba47550648 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use a Command Line to Install the MBAM Server - - -You can use a command line to install the MBAM Server with either the Stand-alone or Configuration Manager topology. The following command line example is for deploying MBAM on a single server, which is an architecture that should be used only in a test environment. You will need to change the command line accordingly when you deploy MBAM to a production environment, which should have multiple servers. - -## Command Line for Deploying the MBAM 2.0 Server with the Stand-alone Topology - - -You can use a command line that is similar to the following to install the MBAM Server with the Stand-alone topology. - -``` syntax -MbamSetup.exe /qb /l*v MaltaServerInstall.log TOPOLOGY=0 I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 ADDLOCAL=KeyDatabase,ReportsDatabase,Reports,AdministrationMonitoringServer,SelfServiceServer,PolicyTemplate,REPORTS_USERACCOUNT=[UserDomain]\[UserName1] REPORTS_USERACCOUNTPW=[UserPwd1] COMPLIDB_SQLINSTANCE=%computername% RECOVERYANDHWDB_SQLINSTANCE=%computername% SRS_INSTANCENAME=%computername% ADMINANDMON_WEBSITE_PORT=83 WEBSITE_PORT=83 -``` - -The following table describes the command line parameters for deploying the MBAM Server with the Stand-alone topology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterParameter ValueDescription

    TOPOLOGY

    0

    0 – Stand-alone topology

    I_ACCEPT_ENDUSER_LICENSE_AGREEMENT

    01

    0 – do not accept the license agreement1 – accept the license agreement

    ADDLOCAL

    Features to be installed on the Server

    KeyDatabase

    Recovery Database

    ReportsDatabase

    Compliance and Audit Reports Database

    Reports

    Compliance and Audit Reports

    AdministrationMonitoringServer

    Administration and Monitoring website

    SelfServiceServer

    Self-Service Portal

    PolicyTemplate

    MBAM Group Policy template

    REPORTS_USERACCOUNT

    [UserDomain][UserName1]

    Domain and user account of the Reporting Services service account that will access the Compliance and Audit database

    REPORTS_USERACCOUNTPW

    [UserPwd1]

    Password of the Reporting Services service account that will access the Compliance and Audit database

    COMPLIDB_SQLINSTANCE

    %computername%

    SQL Server instance name for the Compliance and Audit Database – replace %computername% with the computer name

    RECOVERYANDHWDB_SQLINSTANCE

    %computername%

    SQL Server instance name for the Recovery Database – replace %computername% with the computer name

    SRS_INSTANCENAME

    %computername%

    SQL Server Reporting Server instance where the Compliance and Audit reports will be installed – replace %computername% with the computer name

    ADMINANDMON_WEBSITE_PORT

    83

    Port for the Administration and Monitoring website; “83” is only an example

    WEBSITE_PORT

    83

    Port for the Self-Service Portal website; “83” is only an example

    - - - -## Command Line for Deploying the MBAM 2.0 Server with the Configuration Manager Topology - - -You can use a command line that is similar to the following to install the MBAM Server with the Configuration Manager topology. - -``` syntax -MbamSetup.exe /qn /l*v MaltaServerInstall.log I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 TOPOLOGY=1 COMPLIDB_SQLINSTANCE=%computername% RECOVERYANDHWDB_SQLINSTANCE=%computername% SRS_INSTANCENAME=%computername% REPORTS_USERACCOUNT=[UserDomain]\[UserName] REPORTS_USERACCOUNTPW=[UserPwd] ADMINANDMON_WEBSITE_PORT=83 WEBSITE_PORT=83 -``` - -The following table describes the command line parameters for installing the MBAM 2.0 Server with the Configuration Manager topology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterParameter ValueDescription

    TOPOLOGY

    1

    1 – Configuration Manager topology

    I_ACCEPT_ENDUSER_LICENSE_AGREEMENT

    01

    0 – do not accept the license agreement1 – accept the license agreement

    COMPLIDB_SQLINSTANCE

    %computername%

    SQL Server instance name for the Audit Database – replace %computername% with the computer name

    RECOVERYANDHWDB_SQLINSTANCE

    %computername%

    SQL Server instance name for the Recovery Database - replace %computername% with the computer name

    SRS_INSTANCENAME

    %computername%

    SQL Server Reporting Server instance where the Audit reports will be installed – replace %computername% with the computer name

    REPORTS_USERACCOUNT

    [UserDomain][UserName1]

    Domain and user account of the Reporting Services service account that will access the Compliance and Audit database

    REPORTS_USERACCOUNTPW

    [UserPwd1]

    Password of the Reporting Services service account that will access the Compliance and Audit database

    ADMINANDMON_WEBSITE_PORT

    83

    Port for the Administration and Monitoring website; “83” is only an example

    WEBSITE_PORT

    83

    Port for the Self-Service Portal website; “83” is only an example

    - - - -## Related topics - - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-use-the-help-desk-portal.md b/mdop/mbam-v2/how-to-use-the-help-desk-portal.md deleted file mode 100644 index 4b4a4b1d73..0000000000 --- a/mdop/mbam-v2/how-to-use-the-help-desk-portal.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: How to Use the Help Desk Portal -description: How to Use the Help Desk Portal -author: dansimp -ms.assetid: c27f7737-10c8-4164-9de8-57987292c89c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Help Desk Portal - - -The MBAM Administration and Monitoring website, also referred to as the Help Desk Portal, is an administrative interface to BitLocker drive encryption that is installed as part of the Microsoft BitLocker Administration and Monitoring (MBAM) server infrastructure. The following sections describe how you can use this website to review reports, recover end users’ drives, and manage end users’ TPMs. - -## Reports - - -MBAM collects information from Active Directory and client computers, which enables you to run different reports to monitor BitLocker usage and compliance. Using the **Reports** section of the Administration and Monitoring website, you can generate reports on enterprise compliance, individual computers, and key recovery activity. For a description of each report, see [Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md). - -**To access reports** - -1. Open a web browser and navigate to the MBAM Administration and Monitoring website. - -2. Select **Reports** in the left pane. - -3. From the top menu bar, select the report type you want to generate. To save reports, click the **Export** button on the Reports menu bar. - -For additional information about how to run MBAM reports, see [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md). - -## Drive Recovery - - -The **Drive Recovery** feature of the Administration and Monitoring website allows users with specific administrator roles (for example, Help Desk Users) to access recovery key data that has been collected by the MBAM Client. This data can be used to access a BitLocker-protected drive when BitLocker goes into recovery mode. For instructions on how to recover a drive that is in recovery mode, see [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-2.md). - -You can also recover drives that have been moved or that are corrupted: - -- [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-2.md) - -- [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-2.md) - -For additional information about how to recover a BitLocker-protected drive, see [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md). - -## Manage TPM - - -The Manage TPM feature of the Administration and Monitoring website gives users with certain administrator roles (for example, “MBAM Helpdesk Users”) access to TPM data that has been collected by the MBAM Client. In a TPM lockout, an administrator can use the Administration and Monitoring website to retrieve the necessary password file to unlock the TPM. For instructions on how to reset a TPM after a TPM lockout, see [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-2.md). - -## MBAM Help Desk Tasks - - -You can use the Administration and Monitoring website for many administrative tasks, such as managing BitLocker-protected hardware, recovering drives, and running reports. By default, the URL for the Administration and Monitoring website is http://<*MBAMAdministrationServername*>, although you can customize it during the installation process. - -**Note**   -To access the various features offered by the Administration and Monitoring website, you must have the appropriate roles associated with your user account. For more information about understanding user roles, see [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md). - - - -Use the following links to find information about the tasks that you can perform by using the Administration and Monitoring website: - -- [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-2.md) - -- [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-2.md) - -- [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-2.md) - -- [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-2.md) - -- [How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md b/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md deleted file mode 100644 index bb6cf70424..0000000000 --- a/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Use the Self-Service Portal to Regain Access to a Computer -description: How to Use the Self-Service Portal to Regain Access to a Computer -author: dansimp -ms.assetid: bcf095de-0237-4bb0-b450-da8fb6d6f3d0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Self-Service Portal to Regain Access to a Computer - - -If end users get locked out of Windows by BitLocker because they forgot their password or PIN, or because they changed operating system files or changed the BIOS or the Trusted Platform Module (TPM), they can use the Self-Service Portal to regain access to Windows without having to ask their Help Desk for assistance. - -**Note**   -If the IT administrator configured an IIS Session State time-out, a message is displayed 60 seconds prior to the time-out. - - - -**Note**   -These instructions are written for and from the perspective of end users. - - - -**To use the Self-Service Portal to regain access to a computer** - -1. In the **Recovery KeyId** field, enter a minimum of eight of the 32-digit BitLocker Key ID that is displayed on the BitLocker recovery screen of your computer. - - **Note**   - If the first eight digits match multiple keys, a message displays that requires you to enter all 32 digits of the recovery key ID. - - - -2. In the **Reason** field, select a reason for your request for the recovery key. - -3. Click **Get Key**. Your BitLocker recovery key is displayed in the “Your BitLocker Recovery Key” field. - -4. Enter the 48-digit code into the BitLocker recovery screen on your computer to regain access to the computer. - -## Related topics - - -[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md b/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md deleted file mode 100644 index ad2f0f4528..0000000000 --- a/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Validate the MBAM Installation with Configuration Manager -description: How to Validate the MBAM Installation with Configuration Manager -author: dansimp -ms.assetid: 8e268539-91c3-4e8a-baae-faf3605da818 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Validate the MBAM Installation with Configuration Manager - - -After installing Microsoft BitLocker Administration and Monitoring (MBAM) with Configuration Manager, validate that the installation has successfully set up all the necessary features for MBAM by completing the following steps. - -**To validate the MBAM Server feature installation with Configuration Manager** - -1. On the server where System Center Configuration Manager is deployed, open **Control Panel**. Select the program that is used to uninstall or change a program. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the list of programs and features. - - **Note**   - To validate the installation, you must use a domain account that has local computer administrative credentials on each server. - - - -2. Use the Configuration Manager console to confirm that a new collection, called “MBAM Supported Computers,” is displayed. - - To view the collection with Configuration Manager 2007: Click **Site Database** (<**SiteCode**> - <**ServerName**>, <**SiteName**>), **Computer Management**. - - To view the collection with System Center 2012 Configuration Manager: Click the **Assets and Compliance** workspace, **Device Collections**. - -3. Use the Configuration Manager console to verify that the following reports are listed in the **MBAM** folder: - - - BitLocker Computer Compliance - - - BitLocker Enterprise Compliance Dashboard - - - BitLocker Enterprise Compliance Details - - - BitLocker Enterprise Compliance Summary - - To view the reports with Configuration Manager 2007: Click **Reporting**, **Reporting Services**, \\\\<**ServerName**>, **Report Folders** - - To view the reports with System Center 2012 Configuration Manager: Click the **Monitoring** workspace, **Reporting**, **Reports**. - -4. Use the Configuration Manager console to confirm that the configuration baseline “BitLocker Protection” is listed. - - To view the configuration baselines with Configuration Manager 2007: Click **Desired Configuration Management**, **Configuration Baselines**. - - To view the configuration baselines with System Center 2012 Configuration Manager: Click the **Assets and Compliance** workspace, **Compliance Settings**, **Configuration Baselines**. - -5. Use the Configuration Manager console to confirm that the following new configuration items are displayed: - - - BitLocker Fixed Data Drives Protection - - - BitLocker Operating System Drive Protection - - To view the configuration items with Configuration Manager 2007: Click **Desired Configuration Management**, **Configuration Items**. - - To view the configuration items with System Center 2012 Configuration Manager: Click the **Assets and Compliance** workspace, **Compliance Settings**, **Configuration Items**. - -## Related topics - - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/images/checklistbox.gif b/mdop/mbam-v2/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/mbam-v2/images/checklistbox.gif and /dev/null differ diff --git a/mdop/mbam-v2/images/mbam2-1-server.gif b/mdop/mbam-v2/images/mbam2-1-server.gif deleted file mode 100644 index 20f3f5adcb..0000000000 Binary files a/mdop/mbam-v2/images/mbam2-1-server.gif and /dev/null differ diff --git a/mdop/mbam-v2/images/mbam2-3-servers.gif b/mdop/mbam-v2/images/mbam2-3-servers.gif deleted file mode 100644 index 62f5d02a39..0000000000 Binary files a/mdop/mbam-v2/images/mbam2-3-servers.gif and /dev/null differ diff --git a/mdop/mbam-v2/images/mbam2-cmserver.gif b/mdop/mbam-v2/images/mbam2-cmserver.gif deleted file mode 100644 index 80a0444483..0000000000 Binary files a/mdop/mbam-v2/images/mbam2-cmserver.gif and /dev/null differ diff --git a/mdop/mbam-v2/index.md b/mdop/mbam-v2/index.md deleted file mode 100644 index ba76b06b55..0000000000 --- a/mdop/mbam-v2/index.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide -description: Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide -author: dansimp -ms.assetid: fdb43f62-960a-4811-8802-50efdf04b4af -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - -# Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 provides a simplified administrative interface that you can use to manage BitLocker drive encryption. In BitLocker Administration and Monitoring 2.0, you can select BitLocker drive encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. - -## Outline - -- [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - - [About MBAM 2.0](about-mbam-20-mbam-2.md) - - [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md) - - [About MBAM 2.0 SP1](about-mbam-20-sp1.md) - - [Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md) - - [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md) - - [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md) - - [Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md) -- [Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - - [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) - - [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) - - [Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - - [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) - - [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) -- [Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - - [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) - - [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md) - - [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md) -- [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - - [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - - [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) - - [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) - - [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - - [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md) -- [Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -## More Information - -- [MDOP Information Experience](index.md) - - Find documentation, videos, and other resources for MDOP technologies. - -  - -  - - - - - diff --git a/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md b/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md deleted file mode 100644 index d83b165ded..0000000000 --- a/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Maintaining MBAM 2.0 -description: Maintaining MBAM 2.0 -author: dansimp -ms.assetid: 6479e093-840d-45d5-b759-1179aeeeefeb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Maintaining MBAM 2.0 - - -After completing all necessary planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure Microsoft BitLocker Administration and Monitoring to run in a highly available fashion while using it to manage enterprise BitLocker encryption operations. The information in this section describes high availability options for MBAM as well as how to move MBAM Server features. - -## Ensure High Availability for MBAM 2.0 - - -MBAM was designed to be fault-tolerant and not negatively affect the users if a server is not available. The information in this section can be used to configure a highly available MBAM installation. - -[High Availability for MBAM 2.0](high-availability-for-mbam-20-mbam-2.md) - -## Move MBAM 2.0 Features to Another Server - - -If you need to move an MBAM Server feature from one server computer to another, you must complete required steps in a specific order to avoid a loss of productivity or data. This section describes the steps that you must complete to move one or more MBAM Server features to a different computer. - -[How to Move MBAM 2.0 Features to Another Computer](how-to-move-mbam-20-features-to-another-computer-mbam-2.md) - -## Other resources for Maintaining MBAM - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md b/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md deleted file mode 100644 index 74f3cbeaca..0000000000 --- a/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: MBAM 2.0 Deployment Checklist -description: MBAM 2.0 Deployment Checklist -author: dansimp -ms.assetid: 7905d31d-f21c-4683-b9c4-95b815e08fab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.0 Deployment Checklist - - -This checklist can be used to help you during Microsoft BitLocker Administration and Monitoring (MBAM) deployment with a Stand-alone topology. - -**Note** -This checklist outlines the recommended steps and a high-level list of items to consider when deploying Microsoft BitLocker Administration and Monitoring features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Complete the planning phase to prepare the computing environment for MBAM deployment.

    MBAM 2.0 Planning Checklist

    Checklist box

    Review the MBAM supported configurations information to make sure selected client and server computers are supported for MBAM feature installation.

    MBAM 2.0 Supported Configurations

    Checklist box

    Run MBAM Setup to deploy MBAM Server features in the following order:

    -
      -
    1. Recovery Database

    2. -
    3. Compliance and Audit Database

    4. -
    5. Compliance Audit and Reports

    6. -
    7. Self-Service Server

    8. -
    9. Administration and Monitoring Server

    10. -
    11. MBAM Group Policy template

    12. -
    -
    -Note

    Keep track of the names of the servers each feature is installed on. This information will be used throughout the installation process.

    -
    -
    - -

    Deploying the MBAM 2.0 Server Infrastructure

    Checklist box

    Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on appropriate servers.

    Planning for MBAM 2.0 Administrator Roles and How to Manage MBAM Administrator Roles

    Checklist box

    Create and deploy required MBAM Group Policy Objects.

    Deploying MBAM 2.0 Group Policy Objects

    Checklist box

    Deploy the MBAM Client software.

    Deploying the MBAM 2.0 Client

    - - - -## Related topics - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md b/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md deleted file mode 100644 index 4901f54cfe..0000000000 --- a/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md +++ /dev/null @@ -1,347 +0,0 @@ ---- -title: MBAM 2.0 Deployment Prerequisites -description: MBAM 2.0 Deployment Prerequisites -author: dansimp -ms.assetid: 57d1c2bb-5ea3-457e-badd-dd9206ff0f20 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.0 Deployment Prerequisites - - -Before you start Microsoft BitLocker Administration and Monitoring (MBAM) Setup, you should ensure that you have met the prerequisites to install the product. This section contains information to help you successfully plan your computing environment before you deploy Microsoft BitLocker Administration and Monitoring Server features and Clients. If you are installing MBAM with Configuration Manager, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md) for additional prerequisites. - -## Installation Prerequisites for MBAM Server Features - - -Each of the MBAM Server features has specific prerequisites that must be met before the MBAM features can be successfully installed. MBAM Setup checks that all prerequisites are met before the installation starts. - -### Prerequisites for Administration and Monitoring Server - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Windows Server Web Server Role

    This role must be added to a server operating system that is supported for the Administration and Monitoring Server feature.

    Web Server (IIS) Management Tools

    Select IIS Management Scripts and Tools.

    SSL Certificate

    Optional. To secure communication between the clients and the web services, you have to obtain and install a certificate that a trusted security authority signed.

    Web Server Role Services

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -

    Windows Server Features

    .NET Framework 3.5.1 features:

    -
      -
    • .NET Framework 3.5.1

    • -
    • WCF Activation

      -
        -
      • HTTP Activation

      • -
      • Non-HTTP Activation

      • -
    • -
    -

    Windows Process Activation Service:

    -
      -
    • Process Model

    • -
    • .NET Environment

    • -
    • Configuration APIs

    • -
    - - - -**Note** -For a list of supported operating systems, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). - - - -### Prerequisites for the Compliance and Audit Reports - - ---- - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Supported version of SQL Server

    -

    See MBAM 2.0 Supported Configurations for supported versions.

    Install SQL Server with:

    -
      -
    • SQL_Latin1_General_CP1_CI_AS collation

    • -

    SQL Server Reporting Services (SSRS)

    SSRS instance rights – required for installing reports only if you are installing databases on a separate server from the reports.

    Required instance rights:

    -
      -
    • Create Folders

    • -
    • Publish Reports

    • -
    -

    SSRS must be installed and running during the MBAM Server installation. Configure SSRS in “native” mode and not in unconfigured or “SharePoint” mode.

    - - - -### Prerequisites for the Recovery Database - - ---- - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Supported version of SQL Server

    -

    See MBAM 2.0 Supported Configurations for supported versions.

    Install SQL Server with:

    -
      -
    • SQL_Latin1_General_CP1_CI_AS collation

    • -
    • SQL Server Management Tools

    • -

    Required SQL Server permissions

    Required permissions:

    -
      -
    • SQL instance Login Server roles:

      -
        -
      • dbcreator

      • -
      • processadmin

      • -
    • -
    • SQL Server Reporting Services instance rights:

      -
        -
      • Create Folders

      • -
      • Publish Reports

      • -
    • -

    Optional - Install Transparent Data Encryption (TDE) feature available in SQL Server

    The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries.

    -
    -Note

    TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible.

    -
    -
    - -
    -

    More about TDE: MBAM 2.0 Security Considerations.

    - - - -### Prerequisites for the Compliance and Audit Database - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Supported version of SQL Server

    -

    See MBAM 2.0 Supported Configurations for supported versions.

    Install SQL Server with:

    -
      -
    • SQL_Latin1_General_CP1_CI_AS collation

    • -
    • SQL Server Management Tools

    • -

    Required SQL Server permissions

    Required permissions:

    -
      -
    • SQL instance Login Server roles:

      -
        -
      • dbcreator

      • -
      • processadmin

      • -
    • -
    • SQL Server Reporting Services instance rights:

      -
        -
      • Create Folders

      • -
      • Publish Reports

      • -
    • -

    Optional - Install Transparent Data Encryption (TDE) feature in SQL Server.

    The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries.

    -
    -Note

    TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible.

    -
    -
    - -
    -

    More about TDE: MBAM 2.0 Security Considerations

    SQL Server must have Database Engine Services installed and running during MBAM Server installation.

    The SQL Server Agent service must be running and set to auto-start on the selected instances of SQL Server.

    - - - -### Prerequisites for the Self-Service Portal - - ---- - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Supported version of Windows Server

    -

    See MBAM 2.0 Supported Configurations for supported versions.

    ASP.NET MVC 2.0

    ASP.NET MVC 2 download

    Web Service IIS Management Tools

    - - - -## Prerequisites for MBAM Clients - - - ---- - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Windows 7 clients only - must have Trusted Platform Module (TPM) capability.

    TPM version must be 1.2 or later.

    The TPM chip must be turned on in the BIOS and be resettable from the operating system.

    For more information, see the BIOS documentation.

    Windows 8 clients only: To have MBAM store and manage the TPM recovery keys: TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM. To turn off TPM auto-provisioning, see Disable-TpmAutoProvisioning.

    -
      -
    • TPM auto-provisioning must be turned off.

    • -
    • MBAM must be set as the owner of the TPM before you deploy MBAM.

    • -

    To turn off TPM auto-provisioning, see Disable-TpmAutoProvisioning.

    -
    -Note

    Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.

    -
    -
    - -
    - - - -## Related topics - - -[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - -[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md b/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md deleted file mode 100644 index dd323a9429..0000000000 --- a/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: MBAM 2.0 Planning Checklist -description: MBAM 2.0 Planning Checklist -author: dansimp -ms.assetid: 16b27c27-5f5e-41e2-b526-89a036672fb8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.0 Planning Checklist - - -This checklist can be used to help you plan for preparing your computing environment for Microsoft BitLocker Administration and Monitoring (MBAM) deployment. - -**Note**   -This checklist outlines the recommended steps and a high-level list of items to consider when planning for an Microsoft BitLocker Administration and Monitoring deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Review the getting started information about MBAM to gain a basic understanding of the product before beginning deployment planning.

    Getting Started with MBAM 2.0

    Checklist box

    Plan for MBAM 2.0 Deployment Prerequisites and prepare your computing environment.

    MBAM 2.0 Deployment Prerequisites

    Checklist box

    Plan for and configure MBAM Group Policy requirements.

    Planning for MBAM 2.0 Group Policy Requirements

    Checklist box

    Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.

    Planning for MBAM 2.0 Administrator Roles

    Checklist box

    Review the MBAM 2.0 Supported Configurations documentation to ensure that hardware that meets MBAM installation system requirements is available.

    MBAM 2.0 Supported Configurations

    Checklist box

    Plan for deploying MBAM Server feature deployment.

    Planning for MBAM 2.0 Server Deployment

    Checklist box

    Plan for deploying MBAM Client deployment.

    Planning for MBAM 2.0 Client Deployment

    Checklist box

    Validate your deployment plan in a test environment.

    Evaluating MBAM 2.0

    - - - -## Related topics - - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md deleted file mode 100644 index 1d8f677dab..0000000000 --- a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: MBAM 2.0 Privacy Statement -description: MBAM 2.0 Privacy Statement -author: dansimp -ms.assetid: fce72ad4-a837-4d17-8d3b-4d93f1a399be -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.0 Privacy Statement - - -## Microsoft BitLocker Administration and Monitoring (MBAM) v2 Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft BitLocker Administration and Monitoring v2 (MBAM). This is a preliminary disclosure that focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft BitLocker Administration and Monitoring (MBAM) enhances BitLocker by simplifying deployment and key recovery, centralizing provisioning, monitoring and reporting of encryption status for fixed and removable drives, and minimizing support costs. This release provides support for Windows 8 as well as improvements on Configuration Manager Integration and key recovery functionality. - -### Collection and Use of Your Information - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public.  We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by MBAM may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -### Collection and Use of Information about Your Computer - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -Because this is a pre-release version of the software, some of these Internet-enabled features are turned on by default so that we can collect enough information about how the software is working in order to improve the commercially released software. The default settings in this pre-release software do not necessarily reflect how these features will be configured in the commercially released software. - -The privacy details for each MBAM feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -### Security of your information - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -### Changes to this privacy statement - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -### For More Information - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us. - -Microsoft Privacy Microsoft Corporation One Microsoft Way Redmond, Washington 98052 USA - -### Specific Features - -### Microsoft Error Reporting - -The remainder of this document will address the following specific features: - -**What This Feature Does:** - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with MBAM to Microsoft and to receive information that may help you avoid or solve such problems. - -**Information Collected, Processed, or Transmitted:** - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at [https://go.microsoft.com](https://go.microsoft.com/fwlink/?LinkID=244395). - -**Use of Information:** - -We use the error reporting data to solve customer problems and improve our software and services. - -**Choice and control:** - -Microsoft Error Reporting is not turned on or off by MBAM. MBAM will utilize whatever configuration is active in Windows. You can change your Microsoft Error Reporting settings at any time disabling the automatic reporting of errors that may contain the names of folders on your PC by creating a registry value named "DisableGenericReports" with any type or value under: - -"HKLM\\Software\\Microsoft\\Microsoft Standalone System Sweeper Tool" (for the 32-bit version) - -"HKLM\\Software\\Wow6432Node\\Microsoft\\Microsoft Standalone System Sweeper Tool" (for the 64-bit version) - -**Warning** - -Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the PC. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied. - -Important Information: Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their PCs. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available on [TechNet](https://technet.microsoft.com/library/cc709644.aspx). - -Additional information on how to modify enable and disable error reporting is available at this support article: [(https://support.microsoft.com/kb/188296)](https://support.microsoft.com/kb/188296). - -### Microsoft Update - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Use of Information:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -**Choice/Control:** - -For details about controlling this feature, see the Update Services Privacy Statement at . - -### Customer Experience Improvement Program - -**What This Feature Does:** - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We won't collect your name, address, or other contact information. - -**Information Collected, Processed, or Transmitted:** - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -**Use of Information:** - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -**Choice/Control:** - -CEIP is off by default. You're offered the opportunity to participate in CEIP during setup. If you choose to participate and later change your mind, you can turn off CEIP at any time by: Using the CEIP Opt-out run-time dialog. From the Help menu, open the link named “Customer Experience Improvement Program” and check the ‘Don’t Join’ radio button. - -## Related topics - - -[Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md b/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md deleted file mode 100644 index 74670be60b..0000000000 --- a/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md +++ /dev/null @@ -1,206 +0,0 @@ ---- -title: MBAM 2.0 Security Considerations -description: MBAM 2.0 Security Considerations -author: dansimp -ms.assetid: 0aa5c6e2-d92c-4e30-9f6a-b48abb667ae5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.0 Security Considerations - - -This topic contains a brief overview about the accounts and groups, log files, and other security-related considerations for Microsoft BitLocker Administration and Monitoring (MBAM). For more information, follow the links within this article. - -## General Security Considerations - - -**Understand the security risks.** The most serious risk from Microsoft BitLocker Administration and Monitoring is that its functionality could be hijacked by an unauthorized user who could then reconfigure BitLocker encryption and gain BitLocker encryption key data on MBAM Clients. However, the loss of MBAM functionality for a short period of time, due to a denial-of-service attack, does not generally have a catastrophic impact, unlike, for example, e-mail, network communications, light, and power. - -**Physically secure your computers**. There is no security without physical security. An attacker who gets physical access to an MBAM Server could potentially use it to attack the entire client base. All potential physical attacks must be considered high risk and mitigated appropriately. MBAM servers should be stored in a secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for operating systems, Microsoft SQL Server, and MBAM by subscribing to the Security Notification service (). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all MBAM and MBAM administrator accounts. Never use blank passwords. For more information about password concepts, see the “Account Passwords and Policies” white paper on TechNet (). - -## Accounts and Groups in MBAM - - -The best practice for managing user accounts is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary MBAM local groups on the MBAM Servers. - -### Active Directory Domain Services Groups - -No Active Directory groups are created automatically during the MBAM setup process. However, it is recommended that you create the following Active Directory Domain Services global groups to manage MBAM operations. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Group NameDetails

    MBAM Advanced Helpdesk Users

    Create this group to manage members of the MBAM Advanced Helpdesk Users local group created during MBAM Setup.

    MBAM Compliance Auditing DB Access

    Create this group to manage members of the MBAM Compliance Auditing DB Access local group created during MBAM Setup.

    MBAM Helpdesk Users

    Create this group to manage members of the MBAM Helpdesk Users local group created during MBAM Setup.

    MBAM Recovery and Hardware DB Access

    Create this group to manage members of the MBAM Recovery and Hardware DB Access local group created during MBAM Setup.

    MBAM Report Users

    Create this group to manage members of the MBAM Report Users local group created during MBAM Setup.

    MBAM System Administrators

    Create this group to manage members of the MBAM System Administrators local group created during MBAM Setup.

    BitLocker Encryption Exemptions

    Create this group to manage user accounts that should be exempted from BitLocker encryption starting on computers that they log on to.

    - - - -### MBAM Server Local Groups - -MBAM Setup creates local groups to support MBAM operations. You should add the Active Directory Domain Services global groups to the appropriate MBAM local groups to configure MBAM security and data access permissions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Group NameDetails

    MBAM Advanced Helpdesk Users

    Members of this group have increased access to the Help Desk features from MBAM.

    MBAM Compliance Auditing DB Access

    Contains the machines that have access to the MBAM Compliance and Auditing Database.

    MBAM Helpdesk Users

    Members of this group have access to some of the Help Desk features from MBAM.

    MBAM Recovery and Hardware DB Access

    Contains the machines that have access to the MBAM Recovery Database.

    MBAM Report Users

    Members of this group have access to the Compliance and Audit reports from MBAM.

    MBAM System Administrators

    Members of this group have access to all MBAM features.

    - - - -### SSRS Reports Service Account - -The SSRS Reports service account provides the security context to run the MBAM reports available through SSRS. It is configured during MBAM Setup. - -When you configure the SSRS Reports service account, specify a domain user account, and configure the password to never expire. - -**Note**   -If you change the name of the service account after you deploy MBAM, you must reconfigure the reporting data source to use the new service account credentials. Otherwise, you will not be able to access the Help Desk Portal. - - - -## MBAM Log Files - - -The following MBAM Setup log files are created in the installing user’s %temp% folder during MBAM Setup: - -**MBAM Server Setup log files** - -MSI<five random characters>.log -Logs the actions taken during MBAM Setup and MBAM Server Feature installation. - -InstallComplianceDatabase.log -Logs actions taken to create the MBAM Compliance and Audit Database setup. - -InstallKeyComplianceDatabase.log -Logs actions taken to create the MBAM Recovery Database. - -AddHelpDeskDbAuditUsers.log -Logs actions taken to create the SQL Server logins on the MBAM Compliance and Audit database and authorize the HelpDesk web service to the database for reports. - -AddHelpDeskDbUsers.log -Logs actions taken to authorize web services to database for key recovery and create logins to the MBAM Recovery Database. - -AddKeyComplianceDbUsers.log -Logs actions taken to authorize web services to MBAM Compliance and Audit Database for compliance reporting. - -AddRecoveryAndHardwareDbUsers.log -Logs actions taken to authorize web services to the MBAM Recovery database for key recovery. - -**Note**   -In order to obtain additional MBAM Setup log files, you have to install MBAM by using the msiexec package and the /L <location> option. Log files are created in the location specified. - - - -**MBAM Client Setup log files** - -MSI<five random characters>.log -Logs the actions taken during MBAM Client installation. - -## MBAM Database TDE Considerations - - -The transparent data encryption (TDE) feature that is available in SQL Server is an optional installation for the database instances that will host MBAM database features. - -With TDE, you can perform real-time, full database-level encryption. TDE is the optimal choice for bulk encryption to meet regulatory compliance or corporate data security standards. TDE works at the file level, which is similar to two Windows features: the Encrypting File System (EFS) and BitLocker Drive Encryption, both of which also encrypt data on the hard drive. TDE does not replace cell-level encryption, EFS, or BitLocker. - -When TDE is enabled on a database, all backups are encrypted. Thus, special care must be taken to ensure that the certificate that was used to protect the database encryption key is backed up and maintained with the database backup. If this certificate (or certificates) is lost, the data will be unreadable. Back up the certificate along with the database. Each certificate backup should have two files. Both of these files should be archived (ideally separately from the database backup file for security). You can alternatively consider using the extensible key management (EKM) feature (see Extensible Key Management) for storage and maintenance of keys used for TDE. - -For an example of how to enable TDE for MBAM database instances, see [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md). - -For more information about TDE in SQL Server 2008, see [SQL Server Encryption]( https://go.microsoft.com/fwlink/?LinkId=299883). - -## Related topics - - -[Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md b/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md deleted file mode 100644 index 43687475bb..0000000000 --- a/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md +++ /dev/null @@ -1,302 +0,0 @@ ---- -title: MBAM 2.0 Supported Configurations -description: MBAM 2.0 Supported Configurations -author: dansimp -ms.assetid: dca63391-39fe-4273-a570-76d0a2f8a0fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.0 Supported Configurations - - -This topic specifies the requirements to install and run Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 in your environment by using the Stand-alone topology. For supported configurations that apply to later releases, see the documentation for the applicable release. - -If you plan to install MBAM 2.0 by using the Configuration Manager topology and want to review a list of the system requirements, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -The recommended configuration for running MBAM in a production environment is with two servers, depending on your scalability requirements. This configuration supports up to 200,000 MBAM clients. For an image and descriptions of the Stand-alone MBAM server infrastructure, see [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md). - -**Note**   -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - -## MBAM Server System Requirements - - -### Server Operating System Requirements - -The following table lists the operating systems that are supported for the Microsoft BitLocker Administration and Monitoring Server installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Windows Server 2008 R2

    Standard, Enterprise, or Datacenter Edition

    SP1

    64-bit

    Windows Server 2012

    Standard or Datacenter Edition

    64-bit

    - - - -**Note**   -There is no support for installing MBAM services, reports, or databases on a domain controller computer. - - - -### Server Processor, RAM, and Disk Space Requirements - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Hardware componentMinimum requirementRecommended requirement

    Processor

    2.33 GHz

    2.33 GHz or greater

    RAM

    8 GB

    12 GB

    Free disk space

    1 GB

    2 GB

    - - - -### SQL Server Database Requirements - -The following table lists the SQL Server versions that are supported for the Administration and Monitoring Server feature installation, which includes the Recovery Database, Compliance and Audit Database, and Compliance and Audit Reports. The databases additionally require the installation of SQL Server Management Tools. - -**Note**   -MBAM does not natively support SQL clustering, mirroring, or Availability Groups. To install the databases, you must run the MBAM Server installation on a stand-alone SQL server. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    SQL Server versionEditionService packSystem architecture

    Microsoft SQL Server 2008 R2

    Standard, Enterprise, or Datacenter Edition

    SP1

    64-bit

    Microsoft SQL Server 2012

    Standard, Enterprise, or Datacenter Edition

    SP1

    64-bit

    - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Hardware componentMinimum requirementRecommended requirement

    Processor

    2.33 GHz

    2.33 GHz or greater

    RAM

    8 GB

    12 GB

    Free disk space

    5 GB

    5 GB or greater

    - - - -## MBAM Client System Requirements - - -### Client Operating System Requirements - -The following table lists the operating systems that are supported for Microsoft BitLocker Administration and Monitoring Client installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Windows 7

    Enterprise or Ultimate Edition

    SP1

    32-bit or 64-bit

    Windows 8

    Enterprise Edition

    32-bit or 64-bit

    Windows To Go

    Windows 8 Enterprise Edition

    32-bit or 64-bit

    - - - -### Client RAM Requirements - -There are no RAM requirements that are specific to the Microsoft BitLocker Administration and Monitoring Client installation. - -## MBAM Group Policy System Requirements - - -The following table lists the operating systems that are supported for Microsoft BitLocker Administration and Monitoring Group Policy template installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Windows 7

    Enterprise, or Ultimate Edition

    SP1

    32-bit or 64-bit

    Windows 8

    Enterprise Edition

    32-bit or 64-bit

    Windows Server 2008 R2

    Standard, Enterprise, or Datacenter Edition

    SP1

    64-bit

    Windows Server 2012

    Standard or Datacenter Edition

    64-bit

    - - - -## Related topics - - -[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - -[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md b/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md deleted file mode 100644 index be5f19b3a8..0000000000 --- a/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Monitoring and Reporting BitLocker Compliance with MBAM 2.0 -description: Monitoring and Reporting BitLocker Compliance with MBAM 2.0 -author: dansimp -ms.assetid: 0b9ba701-0aad-4e16-9b32-73d358047ccc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring and Reporting BitLocker Compliance with MBAM 2.0 - - -You can generate different reports to monitor BitLocker usage and compliance activities. - -If you chose the Configuration Manager topology when you installed Microsoft BitLocker Administration and Monitoring (MBAM), reports are generated from Configuration Manager rather than from MBAM. See [Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md) for more information. - -## Understand MBAM Reports - - -MBAM reports have many fields that you may want to be familiar with before generating MBAM reports. - -[Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md) - -## Generate MBAM Reports - - -You can generate reports on enterprise compliance, individual computer compliance, and key recovery activity. - -[How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md) - -## Other Resources for Monitoring and Reporting BitLocker Compliance with MBAM - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md b/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md deleted file mode 100644 index 5de22fee46..0000000000 --- a/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Operations for MBAM 2.0 -description: Operations for MBAM 2.0 -author: dansimp -ms.assetid: ece72016-4ffa-48df-8c12-1e442ee9e980 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for MBAM 2.0 - - -This section of the Microsoft BitLocker Administration and Monitoring (MBAM) Administrator’s Guide includes information about the various types of Microsoft BitLocker Administration and Monitoring administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform those tasks. - -## Operations Information - - -- [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - If you want to install MBAM to work with Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager, refer to this section for information about architecture, planning, deployment, and reporting. - -- [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) - - After completing all necessary planning and then deploying MBAM, you can configure and use it to manage enterprise BitLocker encryption. The information in this section describes post-installation day-to-day MBAM feature operations and maintenance tasks. - -- [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) - - This section describes how to generate and understand the different MBAM reports to monitor BitLocker usage and compliance activities throughout your enterprise environment. - -- [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) - - This section describes post-installation day-to-day BitLocker encryption management tasks that are accomplished by using MBAM. - -- [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) - - This section describes how to configure MBAM to run in a highly available fashion while using it to manage enterprise BitLocker encryption operations. The information in this section describes high availability options for MBAM as well as how to move MBAM Server features if necessary. - -- [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) - - This section describes an overview of MBAM security considerations and explains many of the data collection and use practices of MBAM. - -- [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md) - - This section describes the set of Windows PowerShell cmdlets available for administrators performing various MBAM Server tasks from the command line rather than from the Administration and Monitoring website. - -## Other Resources for MBAM Operations - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md b/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md deleted file mode 100644 index c132428d23..0000000000 --- a/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Performing BitLocker Management with MBAM -description: Performing BitLocker Management with MBAM -author: dansimp -ms.assetid: 9bfc6c67-f12c-4daa-8f08-5884fb47443c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing BitLocker Management with MBAM - - -After planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use it to manage enterprise BitLocker encryption. The information in this section describes post-installation day-to-day BitLocker encryption management tasks that are accomplished by using Microsoft BitLocker Administration and Monitoring. - -## Reset a TPM Lockout by Using MBAM - - -A Trusted Platform Module (TPM) is a microchip that is designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer or laptop, and communicates with the rest of the system by using a hardware bus. Computers that incorporate a TPM have the ability to create cryptographic keys and encrypt them so that they can be decrypted only by the TPM. - -A TPM lockout can occur if a user enters the incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies from manufacturer to manufacturer. You can use MBAM to access the centralized Key Recovery data system in the Administration and Monitoring website, where you can retrieve a TPM owner password file when you supply a computer ID and associated user identifier. - -[How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-2.md) - -## Recover Drives with MBAM - - -When you are dealing with the encryption of data, especially in an enterprise environment, consider how that data can be recovered in the event of a hardware failure, changes in personnel, or other situations in which encryption keys can be lost. - -The encrypted drive recovery features of MBAM ensure that data can be captured and stored and that the required tools are available to access a BitLocker-protected volume when BitLocker goes into recovery mode, is moved, or becomes corrupted. - -[How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-2.md) - -[How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-2.md) - -[How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-2.md) - -## Determine BitLocker Encryption State of Lost Computers by Using MBAM - - -Using MBAM, you can determine the last known BitLocker encryption status of computers that were lost or stolen. - -[How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md) - -## Use the Self-Service Portal to Regain Access to a Computer - - -If end users get locked out of Windows by BitLocker, they can use the instructions in this section to get a BitLocker recovery key to regain access to their computer. - -[How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md) - -## Other Resources for Performing BitLocker Management with MBAM - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md deleted file mode 100644 index dcc4dfb344..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Planning for MBAM 2.0 Administrator Roles -description: Planning for MBAM 2.0 Administrator Roles -author: dansimp -ms.assetid: 6f813297-6479-42d3-a21b-896d54466b5b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 Administrator Roles - - -This topic lists and describes the available administrator roles that are available in Microsoft BitLocker Administration and Monitoring (MBAM) as well as the server locations where the local groups are created. - -## MBAM Administrator Roles - - - **MBAM System Administrators** -Administrators in this role have access to all Microsoft BitLocker Administration and Monitoring features. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Helpdesk Users** -Administrators in this role have access to the Help Desk features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. - - **MBAM Report Users** -Administrators in this role have access to the Compliance and Audit Reports from MBAM. The local group for this role is installed on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports. - - **MBAM Advanced Helpdesk Users** -Administrators in this role have increased access to the Help Desk features from MBAM. The local group for this role is installed on the Administration and Monitoring Server. If a user is a member of both MBAM Helpdesk Users and MBAM Advanced Helpdesk Users, the MBAM Advanced Helpdesk Users permissions will override the MBAM Helpdesk User permissions. - -**Important**   -To view reports, an administrative user must be a member of the **MBAM Report Users** security group on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports feature. As a best practice, create a security group in Active Directory Domain Services with rights on the local **MBAM Report Users** security group on both the Administration and Monitoring Server and the server that hosts the Compliance and Audit Reports. - - - -## Related topics - - -[Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md deleted file mode 100644 index cc8dfa17dc..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Planning for MBAM 2.0 Client Deployment -description: Planning for MBAM 2.0 Client Deployment -author: dansimp -ms.assetid: 3a92cf29-092f-4cad-bdfa-d5f6aafe554b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 Client Deployment - - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring (MBAM) Client, you can enable BitLocker drive encryption on a computer in your organization either before the end user receives the computer or afterwards. For both the MBAM Stand-alone and the Configuration Manager topologies, you have to configure Group Policy settings for MBAM. - -If you are using the MBAM Stand-alone topology, it is recommended that you use an enterprise software deployment system to deploy the MBAM Client software to end-user computers. - -If you deploy MBAM with the Configuration Manager topology, you can use Configuration Manager to deploy the MBAM Client software to end-user computers. In Configuration Manager, the MBAM installation creates a collection of computers that MBAM can manage. This collection includes workstations and devices that do not have a Trusted Platform Module (TPM), but that are running Windows 8. - -**Note**   -Windows To Go is not supported for integrated Configuration Manager installations of MBAM if you are using Configuration Manager 2007. - - - -## Deploying the MBAM Client to Enable BitLocker Encryption After Computer Distribution to End Users - - -After you configure Group Policy, you can use an enterprise software deployment system product like Microsoft System Center Configuration Manager or Active Directory Domain Services (AD DS) to deploy the Windows Installer files of the MBAM Client installation to target computers. To deploy the MBAM Client, you can use either the 32-bit or 64-bit MbamClientSetup.exe files or MBAMClient.msi files, which are provided with the MBAM software. - -When you deploy the MBAM Client after you distribute computers to client computers, end users are prompted to encrypt their computer. This enables MBAM to collect the data, which includes the PIN and password, and then to begin the encryption process. - -**Note**   -In this approach, users who have computers with a TPM chip are prompted to activate and initialize the TPM chip if the chip has not been previously activated. - - - -## Using the MBAM Client to Enable BitLocker Encryption Before Computer Distribution to End Users - - -In organizations where computers are received and configured centrally, and where computers have a compliant TPM chip, you can install the MBAM Client to manage BitLocker encryption on each computer before any user data is written to it. The benefit of this process is that every computer will then be BitLocker encryption-compliant. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. - -If your organization wants to use the TPM chip to encrypt computers, the administrator adds the TPM protector to encrypt the operating system volume of the computer. If your organization wants to use the TPM chip and a PIN protector, the administrator encrypts the operating system volume with the TPM protector, and then users select a PIN when they log on for the first time. If your organization decides to use only the PIN protector, the administrator does not have to encrypt the volume first. When users log on, Microsoft BitLocker Administration and Monitoring prompts them to provide a PIN, or a PIN and password to be used on later computer restarts. - -**Note**   -The TPM protector option requires the administrator to accept the BIOS prompt to activate and initialize the TPM before the computer is delivered to the user. - - - -## Related topics - - -[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - -[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md deleted file mode 100644 index d5311487bf..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md +++ /dev/null @@ -1,328 +0,0 @@ ---- -title: Planning for MBAM 2.0 Group Policy Requirements -description: Planning for MBAM 2.0 Group Policy Requirements -author: dansimp -ms.assetid: f5e19dcb-eb15-4722-bb71-0734b3799eb8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 Group Policy Requirements - - -To manage Microsoft BitLocker Administration and Monitoring (MBAM) client computers, you need to consider the types of BitLocker protectors that you want to support in your organization, and then configure the corresponding Group Policy settings that you want to apply. This topic describes the Group Policy settings that are available for use when you are using Microsoft BitLocker Administration and Monitoring to manage BitLocker Drive Encryption in the enterprise. - -MBAM supports the following types of BitLocker protectors for operating system drives: Trusted Platform Module (TPM), TPM + PIN, TPM + USB key, and TPM + PIN + USB key, password, numerical password, and Data Recovery Agent. The password protector is supported only for Windows To Go devices and for Windows 8 devices that do not have a TPM. MBAM supports the TPM + USB key and the TPM + PIN + USB key protectors only when the operating system volume is encrypted before MBAM is installed. - -MBAM supports the following types of BitLocker protectors for fixed data drives: password, auto-unlock, numerical password, and Data Recovery Agent. - -The numeric password protector is applied automatically as part of volume encryption and does not need to be configured. - -**Important** -The default Windows BitLocker drive encryption Group Policy Object (GPO) settings are not used by MBAM and can cause conflicting behavior if they are enabled. To enable MBAM to manage BitLocker, you must define the MBAM Group Policy settings only after installing the MBAM Group Policy template. - - - -Enhanced startup PINs can contain characters, such as uppercase and lowercase letters, and numbers. Unlike BitLocker, MBAM does not support the use of symbols and spaces for enhanced PINs. - -Install the MBAM Group Policy template on a computer that is capable of running the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) MDOP technology. To edit the GPO settings that enable MBAM functionality, you must first install the MBAM Group Policy template, open the GPMC or AGPM to edit the applicable GPO, and then navigate to the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management).** - -The MDOP MBAM (BitLocker Management) GPO node contains four global policy settings and four child GPO settings nodes: Client Management, Fixed Drive, Operating System Drive, and Removable Drive. The following sections provide policy definitions and suggested policy settings to assist you in planning for MBAM GPO policy setting requirements. - -**Note** -For more information about configuring the minimum, recommended GPO settings to enable MBAM to manage BitLocker encryption, see [How to Edit MBAM 2.0 GPO Settings](how-to-edit-mbam-20-gpo-settings-mbam-2.md). - - - -## Global Policy Definitions - - -This section describes MBAM Global policy definitions found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Setting

    Choose drive encryption method and cipher strength

    Suggested Configuration: Not Configured

    -

    Configure this policy to use a specific encryption method and cipher strength.

    -

    When this policy is not configured, BitLocker uses the default encryption method of AES 128-bit with Diffuser or the encryption method specified by the setup script.

    Prevent memory overwrite on restart

    Suggested Configuration: Not Configured

    -

    Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart.

    -

    When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts.

    Validate smart card certificate usage rule

    Suggested Configuration: Not Configured

    -

    Configure this policy to use smartcard certificate-based BitLocker protection.

    -

    When this policy is not configured, a default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate.

    Provide the unique identifiers for your organization

    Suggested Configuration: Not Configured

    -

    Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader.

    -

    When this policy is not configured, the Identification field is not used.

    -

    If your company requires higher security measurements, you may want to configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting.

    - - - -## Client Management Policy Definitions - - -This section describes Client Management policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**\\**Client Management**. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Settings

    Configure MBAM Services

    Suggested Configuration: Enabled

    -
      -
    • MBAM Recovery and Hardware service endpoint. Use this setting to enable MBAM Client BitLocker encryption management. Enter an endpoint location that is similar to the following example: http://<MBAM Administration and Monitoring Server Name>:<port the web service is bound to>/MBAMRecoveryAndHardwareService/CoreService.svc.

    • -
    • Select BitLocker recovery information to store. This policy setting lets you configure the key recovery service to back up BitLocker recovery information. It also lets you configure status reporting service for collecting compliance and audit reports. The policy provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to the lack of key information. Status report and key recovery activity will automatically and silently be sent to the configured report server location.

      -

      If you do not configure or if you disable this policy setting, the Key recovery information will not be saved, and status report and key recovery activity will not be reported to server. When this setting is set to Recovery Password and key package, the recovery password and key package will be automatically and silently backed up to the configured key recovery server location.

    • -
    • Enter client checking status frequency in minutes. This policy setting manages how frequently the client checks the BitLocker protection policies and status on the client computer. This policy also manages how frequently the client compliance status is saved to the server. The client checks the BitLocker protection policies and status on the client computer and also backs up the client recovery key at the configured frequency.

      -

      Set this frequency based on the requirement set by your company on how frequently to check the compliance status of the computer, and how frequently to back up the client recovery key.

    • -
    • MBAM Status reporting service endpoint. You must configure this setting to enable MBAM Client BitLocker encryption management. Enter an endpoint location that is similar to the following example: http://<MBAM Administration and Monitoring Server Name>:<port the web service is bound to>/MBAMComplianceStatusService/StatusReportingService.svc.

    • -

    Configure user exemption policy

    Suggested Configuration: Not Configured

    -

    This policy setting lets you configure a web site address, email address, or phone number that will instruct a user to request an exemption from BitLocker encryption.

    -

    If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog that gives them instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.

    -

    If you either disable or do not configure this policy setting, the exemption request instructions will not be presented to users.

    -
    -Note

    User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer will be encrypted.

    -
    -
    - -

    Configure customer experience improvement program

    This policy setting lets you configure how MBAM users can join the Customer Experience Improvement Program. This program collects information about computer hardware and how users use MBAM without interrupting their work. The information helps Microsoft to identify which MBAM features to improve. Microsoft will not use this information to identify or contact MBAM users.

    -

    If you enable this policy setting, users will be able to join the Customer Experience Improvement Program.

    -

    If you disable this policy setting, users will not be able to join the Customer Experience Improvement Program.

    -

    If you do not configure this policy setting, users will have the option to join the Customer Experience Improvement Program.

    - - - -## Fixed Drive Policy Definitions - - -This section describes Fixed Drive policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**\\**Fixed Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Setting

    Fixed data drive encryption settings

    Suggested Configuration: Enabled

    -

    This policy setting let you manage whether fixed drives must be encrypted.

    -

    If the operating system volume is required to be encrypted, select the Enable auto-unlock fixed data drive option.

    -

    When enabling this policy, you must not disable the Configure use of password for fixed data drives policy unless the use of Auto-Unlock for fixed data drives is allowed or required.

    -

    If you require the use of Auto-Unlock for fixed data drives, you must configure operating system volumes to be encrypted.

    -

    If you enable this policy setting, users are required to put all fixed drives under BitLocker protection, and the drives will be encrypted.

    -

    If you do not configure this policy setting, users are not required to put fixed drives under BitLocker protection. If you apply this policy after fixed data drives are encrypted, the MBAM agent decrypts the encrypted fixed drives.

    -

    If you disable this policy setting, users will not be able to put their fixed data drives under BitLocker protection.

    Deny write access to fixed drives not protected by BitLocker

    Suggested Configuration: Not Configured

    -

    This policy setting determines whether BitLocker protection is required for fixed drives to be writable on a computer. This policy setting is applied when you turn on BitLocker.

    -

    When the policy is not configured, all fixed data drives on the computer are mounted with read and write access.

    Allow access to BitLocker-protected fixed drives from earlier versions of Windows

    Suggested configuration: Not Configured

    -

    Enable this policy to let fixed drives with the FAT file system be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    -

    When the policy is enabled or not configured, fixed drives formatted with the FAT file system can be unlocked and their content can be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. These operating systems have read-only access to BitLocker-protected drives.

    -

    When the policy is disabled, fixed drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    Configure use of password for fixed drives

    Suggested configuration: Not Configured

    -

    Use this policy to specify whether a password is required to unlock BitLocker-protected fixed data drives.

    -

    If you enable this policy setting, users can configure a password that meets the requirements you define. BitLocker will allow users to unlock a drive with any of the protectors that are available on the drive.

    -

    These settings are enforced when turning on BitLocker, not when unlocking a volume.

    -

    If you disable this policy setting, users are not allowed to use a password.

    -

    When the policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

    -

    For higher security, enable this policy and select Require password for fixed data drive, select Require password complexity, and set the desired minimum password length.

    -

    If you disable this policy setting, users are not allowed to use a password.

    -

    If you do not configure this policy setting, passwords will be supported with the default settings, which do not include password complexity requirements and which require only eight characters.

    Choose how BitLocker-protected fixed drives can be recovered

    Suggested Configuration: Not Configured

    -

    Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When the policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require recovery information to be backed up to AD DS.

    - - - -## Operating System Drive Policy Definitions - - -This section describes Operating System Drive policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**\\**Operating System Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Setting

    Operating system drive encryption settings

    Suggested configuration: Enabled

    -

    This policy setting lets you manage whether the operating system drive must be encrypted.

    -

    For higher security, consider disabling the following policy settings in System/Power Management/Sleep Settings when you enable them with TPM + PIN protector:

    -
      -
    • Allow Standby States (S1-S3) When Sleeping (Plugged In)

    • -
    • Allow Standby States (S1-S3) When Sleeping (On Battery)

    • -
    -

    If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive.

    -

    On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a personal identification number (PIN).

    -

    If you enable this policy setting, users have to put the operating system drive under BitLocker protection, and the drive will be encrypted.

    -

    If you disable this policy, users will not be able to put the operating system drive under BitLocker protection. If you apply this policy after the operating system drive is encrypted, the drive will be decrypted.

    -

    If you do not configure this policy, the operating system drive is not required to be placed under BitLocker protection.

    Configure TPM platform validation profile

    Suggested Configuration: Not Configured

    -

    This policy setting lets you configure how the TPM security hardware on a computer secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

    -

    When this policy setting is not configured, the TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.

    Choose how BitLocker-protected operating system drives can be recovered

    Suggested Configuration: Not Configured

    -

    Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When this policy is not configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS.

    -

    MBAM operation does not require recovery information to be backed up to AD DS.

    - - - -## Removable Drive Policy Definitions - - -This section describes Removable Drive Policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Removable Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy NameOverview and Suggested Policy Setting

    Control use of BitLocker on removable drives

    Suggested configuration: Enabled

    -

    This policy controls the use of BitLocker on removable data drives.

    -

    Enable the Allow users to apply BitLocker protection on removable data drives option to allow users to run the BitLocker setup wizard on a removable data drive.

    -

    Enable the Allow users to suspend and decrypt BitLocker on removable data drives option to allow users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed.

    -

    When this policy is enabled and the Allow users to apply BitLocker protection on removable data drives option is selected, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server and allows users to recover the drive if the password is lost.

    Deny write access to removable drives not protected by BitLocker

    Suggested Configuration: Not Configured

    -

    Enable this policy to allow only write access to BitLocker protected drives.

    -

    When this policy is enabled, all removable data drives on the computer require encryption before write access is allowed.

    Allow access to BitLocker-protected removable drives from earlier versions of Windows

    Suggested Configuration: Not Configured

    -

    Enable this policy to allow fixed drives with the FAT file system to be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    -

    When this policy is not configured, removable data drives formatted with the FAT file system can be unlocked on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only access to BitLocker-protected drives.

    -

    When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    Configure use of password for removable data drives

    Suggested configuration: Not Configured

    -

    Enable this policy to configure password protection on removable data drives.

    -

    When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

    -

    For increased security, you may enable this policy and check Require password for removable data drive, select Require password complexity, and set the preferred minimum password length.

    Choose how BitLocker-protected removable drives can be recovered

    Suggested Configuration: Not Configured

    -

    Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When set to Not Configured, the data recovery agent is allowed and recovery information is not backed up to AD DS.

    -

    MBAM operation does not require recovery information to be backed up to AD DS.

    - - - -## Related topics - - -[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md deleted file mode 100644 index 32ad03c576..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Planning for MBAM 2.0 -description: Planning for MBAM 2.0 -author: dansimp -ms.assetid: 1206bd18-05ea-4ca8-9362-07e512503c3f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 - - -The goal of deployment planning is to successfully and efficiently deploy Microsoft BitLocker Administration and Monitoring (MBAM) with the Stand-alone topology so that it does not disrupt your users or the network. If you want to install Microsoft BitLocker Administration and Monitoring with the Configuration Manager topology, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -You should consider a number of different deployment configurations and prerequisites before you deploy MBAM. This section describes the information that you need to formulate a deployment plan that best meets your business requirements, assists you in preparing your network and computing environment, and provides the information necessary for you to properly plan to deploy MBAM features. - -## Planning Information - - -- [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) - - This section describes the computing environment requirements and installation prerequisites that you should consider before beginning MBAM Setup. - -- [Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - - This section describes the minimum hardware and software requirements for MBAM Client and Server feature installation. It also provides information about choosing an MBAM deployment topology, and lists other MBAM Server and Client planning considerations. - -- [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) - - This section provides a planning checklist that can assist you in MBAM deployment planning. - -## Other Resources for Planning for MBAM - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md deleted file mode 100644 index c345da750c..0000000000 --- a/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Planning for MBAM 2.0 Server Deployment -description: Planning for MBAM 2.0 Server Deployment -author: dansimp -ms.assetid: b57f1a42-134f-4997-8697-7fbed08e2fc4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.0 Server Deployment - - -The Microsoft BitLocker Administration and Monitoring (MBAM) server infrastructure depends on a set of server features that can be installed on one or more server computers, based on the requirements of the enterprise. If you are installing Microsoft BitLocker Administration and Monitoring with the Configuration Manager topology, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -**Note**   -Installations of Microsoft BitLocker Administration and Monitoring on a single server are recommended only for test environments. - - - -## Planning for MBAM Server Deployment - - -The infrastructure for an MBAM Server deployment includes the following features: - -- Recovery Database - -- Compliance and Audit Database - -- Compliance and Audit Reports - -- Self-Service Portal - -- Administration and Monitoring Server - -- MBAM Group Policy Template - -MBAM Server databases and features can be installed in different configurations, depending on your scalability requirements. All MBAM Server features can be installed on a single server or distributed across multiple servers. We recommend that you use a two-server configuration for production environments, although configurations of two to four servers can also be used, depending on your computing requirements. - -Each MBAM feature has specific prerequisites. For a full list of server feature prerequisites and hardware and software requirements, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) and [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). - -In addition to the server-related MBAM features, the Server Setup application includes an MBAM Group Policy template. The template contains Group Policy Object (GPO) settings that you configure to manage BitLocker Drive Encryption in the enterprise. You can install this template on any computer that can run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -As you plan the MBAM Server deployment, consider that BitLocker recovery keys in MBAM are intended for single use only, after which recovery keys expire. In order for the keys to expire after use, they must be retrieved through the Help Desk Portal or the Self-Service Portal. - -## Order of Deployment of MBAM Server Features - - -To deploy MBAM features on multiple servers, you have to install the features in the following order: - -1. Recovery Database - -2. Compliance and Audit Database - -3. Compliance Audit and Reports - -4. Self-Service Portal - -5. Administration and Monitoring Server - -6. MBAM Group Policy Template - -**Note**   -Keep track of the names of the computers on which you install each feature. You have to use this information throughout the installation process. You can print and use a deployment checklist to assist in this effort. For more information about the MBAM Deployment Checklist, see [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md). - - - -## Related topics - - -[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md b/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md deleted file mode 100644 index 118968c502..0000000000 --- a/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Planning to Deploy MBAM 2.0 -description: Planning to Deploy MBAM 2.0 -author: dansimp -ms.assetid: 2dc05fcd-aed9-4315-aeaf-92aaa9e0e955 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy MBAM 2.0 - - -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for Microsoft BitLocker Administration and Monitoring (MBAM). This section includes information that can help you gather the necessary information to formulate a deployment plan that best meets your business requirements. If you are installing MBAM with the Configuration Manager topology, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md) for additional planning information. - -## Review the MBAM 2.0 Supported Configurations - - -After preparing your computing environment for the MBAM Server and Client feature installation, make sure that you review the Supported Configurations to confirm that the computers on which you are installing MBAM meet the minimum hardware and operating system requirements. For more information about MBAM deployment prerequisites, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md). - -[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) - -## Plan for MBAM 2.0 Server and Client Deployment - - -The MBAM Server infrastructure depends on a set of server features that can be installed on one or more server computers, based on the requirements of the enterprise. These features can be installed in a distributed configuration across multiple servers. - -**Note**   -An MBAM installation on a single server is recommended only for lab environments. - - - -The MBAM Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an enterprise software delivery system or by installing the client agent on client computers as part of the initial imaging process. - -With MBAM, you can encrypt a computer in your organization either before the end user receives the computer, or afterwards by using Group Policy. - -[Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) - -[Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md) - -## Other Resources for MBAM Planning - - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md b/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md deleted file mode 100644 index 59aa487003..0000000000 --- a/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md +++ /dev/null @@ -1,368 +0,0 @@ ---- -title: Planning to Deploy MBAM with Configuration Manager -description: Planning to Deploy MBAM with Configuration Manager -author: dansimp -ms.assetid: fb768306-48c2-40b4-ac4e-c279db987391 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning to Deploy MBAM with Configuration Manager - - -To deploy MBAM with the Configuration Manager topology, a three-server architecture, which supports 200,000 clients, is recommended. Use a separate server to run Configuration Manager, and install the basic Administration and Monitoring features on two servers, as shown in the architecture image in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md). - -**Important** -Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007. - - - -## Deployment Prerequisites for Installing MBAM with Configuration Manager - - -Ensure that you have met the following prerequisites before you install MBAM with Configuration Manager: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteAdditional Information

    Ensure that the Configuration Manager Server is a primary site in the Configuration Manager system.

    N/A

    Enable the Hardware Inventory Client Agent on the Configuration Manager Server.

    For Configuration Manager 2007, see How to Configure Hardware Inventory for a Site.

    -

    For System Center 2012 Configuration Manager, see How to Configure Hardware Inventory in Configuration Manager.

    Enable the Desired Configuration Management (DCM) agent or the compliance settings, depending on the version of Configuration Manager that you are using.

    For Configuration Manager 2007, enable the see Desired Configuration Management Client Agent Properties.

    -

    For System Center 2012 Configuration Manager, see Configuring Compliance Settings in Configuration Manager.

    Define a reporting services point in Configuration Manager. Required for SQL Reporting Services.

    For Configuration Manager 2007, see How to Create a Reporting Services Point for SQL Reporting Services.

    -

    For System Center 2012 Configuration Manager, see Prerequisites for Reporting in Configuration Manager.

    - - - -## Configuration Manager Supported Versions - - -MBAM supports the following versions of Configuration Manager: - - ----- - - - - - - - - - - - - - - - - - - - -
    Supported versionService packSystem architecture

    Microsoft System Center Configuration Manager 2007 R2

    SP1 or later

    64-bit

    -
    -Note

    Although Configuration Manager 2007 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software.

    -
    -
    - -

    Microsoft System Center 2012 Configuration Manager

    SP1

    64-bit

    - - - -For a list of supported configurations for the Configuration Manager Server, see the appropriate webpage for the version of Configuration Manager that you are using. MBAM has no additional system requirements for the Configuration Manager Server. - -## MBAM and SQL Server System Requirements - - -The supported configurations and system requirements for the MBAM servers and SQL Server for the Configuration Manager topology are the same as those for the Stand-alone topology. For the Stand-alone system requirements, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). For the MBAM Server and SQL Server processor, RAM, and disk space requirements for the Configuration Manager topology, see the following sections. - -## MBAM Server Processor, RAM, and Disk Space Requirements for MBAM - - -The following table lists the server processor, RAM, and disk space requirements for MBAM servers when you are using the Configuration Manager Integration topology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Hardware ComponentMinimum RequirementRecommended Requirement

    Processor

    2.33 GHz

    2.33 GHz or greater

    RAM

    4 GB

    8 GB

    Free disk space

    1 GB

    2 GB

    - - - -## SQL Server Processor, RAM, and Disk Space Requirements - - -The following table lists the server processor, RAM, and disk space requirements for the SQL Server computer when you are using the Configuration Manager Integration topology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Hardware ComponentMinimum RequirementRecommended Requirement

    Processor

    2.33 GHz

    2.33 GHz or greater

    RAM

    4 GB

    8 GB

    Free disk space

    5 GB

    5 GB or greater

    - - - -## Required permissions to install the MBAM Server - - -To install MBAM with Configuration Manager, you must have an administrative user in Configuration Manager who has a security role with the minimum permissions listed in the following table. The table also shows the rights that you must have, beyond basic computer administrator rights, to install the MBAM Server. - - ---- - - - - - - - - - - - - - - - - -
    PermissionsMBAM Server Feature

    SQL instance Login Server Roles: - dbcreator- processadmin

    - Recovery Database- Audit Database

    SQL Server Reporting Services instance rights: - Create Folders- Publish Reports

    - System Center Configuration Manager Integration

    - - - -**System Center 2012 Configuration Manager** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PermissionsConfiguration Manager Server Feature

    Configuration Manager site rights:- Read

    System Center Configuration Manager integration

    Configuration Manager collection rights: - Create- Delete- Read- Modify- Deploy Configuration Items

    System Center Configuration Manager integration

    Configuration Manager configuration item rights: - Create- Delete- Read

    System Center Configuration Manager integration

    - - - -**Configuration Manager 2007** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PermissionsConfiguration Manager Server Feature

    Configuration Manager site rights:- Read

    System Center Configuration Manager integration

    Configuration Manager collection rights: - Create- Delete- Read- ReadResource

    System Center Configuration Manager integration

    Configuration Manager configuration item rights: - Create- Delete- Read- Distribute

    System Center Configuration Manager integration

    - - - -## Order of Deployment of MBAM Features for the Configuration Manager Topology - - -When deploying MBAM on the Configuration Manager Server, you must complete the deployment tasks in the following order: - -1. Edit the configuration.mof file on the Configuration Manager Server. - -2. Create or edit the sms\_def.mof file Configuration Manager Server. - -3. Install MBAM on the Configuration Manager Server. - -4. Install the Recovery Database and the Audit Database on the Database server. - -5. Install the MBAM features on the Administration and Monitoring Server. - -## Planning Checklist for Installing MBAM with Configuration Manager - - -This checklist outlines the recommended steps and a high-level list of items to consider when planning for an Microsoft BitLocker Administration and Monitoring deployment with Configuration Manager. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Review the getting started information, which describes how Configuration Manager works with MBAM and shows the recommended high-level architecture.

    Getting Started - Using MBAM with Configuration Manager

    Checklist box

    Review the planning information, which describes the deployment prerequisites, supported configurations, required permissions, and deployment order for each feature.

    Planning to Deploy MBAM with Configuration Manager

    Checklist box

    Plan for and configure MBAM Group Policy requirements.

    Planning for MBAM 2.0 Group Policy Requirements

    Checklist box

    Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.

    Planning for MBAM 2.0 Administrator Roles

    Checklist box

    Plan for deploying MBAM Client deployment.

    Planning for MBAM 2.0 Client Deployment

    - - - -## Related topics - - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - - - - - - - - diff --git a/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md b/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md deleted file mode 100644 index c726106add..0000000000 --- a/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Preparing your Environment for MBAM 2.0 -description: Preparing your Environment for MBAM 2.0 -author: dansimp -ms.assetid: 5fb01da9-620e-4992-9e54-2ed3fb69e6af -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing your Environment for MBAM 2.0 - - -Before beginning Microsoft BitLocker Administration and Monitoring (MBAM) Setup, you should make sure that you have met the prerequisites to install the product. When you know what the prerequisites are ahead of time, you can efficiently deploy the product and enable its features so that it most effectively supports your organization’s business objectives. - -If you are deploying Microsoft BitLocker Administration and Monitoring with Microsoft System Center Configuration Manager 2007 or Microsoft System Center 2012 Configuration Manager, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -## Review MBAM 2.0 Deployment Prerequisites - - -The MBAM Client and each of the MBAM Server features have specific prerequisites that must be met before they can be successfully installed. - -To ensure successful installation of MBAM Clients and MBAM Server features, ensure that computers specified for MBAM Client or MBAM Server feature installation are properly prepared for MBAM Setup. - -**Note**   -MBAM Setup checks that all prerequisites are met before installation starts. If all prerequisites are not met, Setup will fail. - - - -[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) - -## Plan for MBAM 2.0 Group Policy Requirements - - -Before MBAM can manage clients in the enterprise, you must define Group Policy for the encryption requirements of your environment. - -**Important**   -MBAM will not work with policies for stand-alone BitLocker drive encryption. Group Policy settings must be defined for MBAM, or BitLocker encryption and enforcement will fail. - - - -[Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) - -## Plan for MBAM 2.0 Administrator Roles - - -MBAM administrator roles are managed by local groups that are created by MBAM Setup when you install the BitLocker Administration and Monitoring Server, the Compliance and Audit Reports feature, and the Compliance and Audit Status Database. - -The membership of Microsoft BitLocker Administration and Monitoring roles can best be managed by creating security groups in Active Directory Domain Services, adding the appropriate administrator accounts to those groups, and then adding those security groups to the BitLocker Administration and Monitoring local groups. For more information, see [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md). - -## Other Resources for MBAM Planning - - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md b/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md deleted file mode 100644 index 2bbbd782ed..0000000000 --- a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,296 +0,0 @@ ---- -title: Release Notes for MBAM 2.0 -description: Release Notes for MBAM 2.0 -author: dansimp -ms.assetid: c3f16cf3-94f2-47ac-b3a4-3dc505c6a8dd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Release Notes for MBAM 2.0 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM) 2.0. These release notes contain information that is required to successfully install BitLocker Administration and Monitoring 2.0 and contain information that is not available in the product documentation. If there is a difference between these release notes and other MBAM 2.0 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## MBAM 2.0 Known Issues - - -This section contains release notes for MBAM 2.0. - -### Computer Name field may not appear in the BitLocker Computer Compliance and BitLocker Enterprise Compliance Details reports when you run MBAM with Microsoft System Center Configuration Manager 2007 - -The Computer Name field may be blank in the BitLocker Computer Compliance and BitLocker Enterprise Compliance Details reports when you use MBAM with Configuration Manager 2007. - -WORKAROUND: None. - -### Enterprise Compliance Report fails to update after you upgrade the Stand-alone MBAM server infrastructure - -If you are using the MBAM Stand-alone topology, and you upgrade the server infrastructure from version 1.0 to 2.0, the Enterprise Compliance Report fails to update. - -WORKAROUND: After the upgrade, run the following script on the Compliance and Audit Database: - -```sql --- ============================================= --- Script Template --- ============================================= - -DECLARE @DatabaseName nvarchar(255); -SET @DatabaseName = DB_NAME() - -USE msdb; - -DECLARE @JobID BINARY(16) -SELECT @JobID = job_id -FROM msdb.dbo.sysjobs -WHERE (name = N'CreateCache') - -if (@JobID IS NOT NULL) -BEGIN - EXEC dbo.sp_delete_job - @job_name = N'CreateCache'; -END - -EXEC dbo.sp_add_job - @job_name = N'CreateCache', - @enabled = 1; - -EXEC dbo.sp_add_jobstep - @job_name = N'CreateCache', - @step_name = N'Copy Data', - @subsystem = N'TSQL', - @command = N'EXEC [ComplianceCore].UpdateCache', - @database_name = @DatabaseName, - @retry_attempts = 5, - @retry_interval = 5; - - -EXEC dbo.sp_add_jobschedule - @job_name = N'CreateCache', - @name = N'ReportCacheSchedule1am', - @freq_type = 4, - @freq_interval = 1, - @active_start_time = 010000, - @active_end_time = 020000; - -EXEC dbo.sp_attach_schedule - @job_name = N'CreateCache', - @schedule_name = N'ReportCacheSchedule1am'; - -EXEC dbo.sp_add_jobschedule - @job_name = N'CreateCache', - @name = N'ReportCacheSchedule7am', - @freq_type = 4, - @freq_interval = 1, - @active_start_time = 070000, - @active_end_time = 080000; - -EXEC dbo.sp_attach_schedule - @job_name = N'CreateCache', - @schedule_name = N'ReportCacheSchedule7am'; - -EXEC dbo.sp_add_jobschedule - @job_name = N'CreateCache', - @name = N'ReportCacheSchedule1pm', - @freq_type = 4, - @freq_interval = 1, - @active_start_time = 130000, - @active_end_time = 140000; - -EXEC dbo.sp_attach_schedule - @job_name = N'CreateCache', - @schedule_name = N'ReportCacheSchedule1pm'; - -EXEC dbo.sp_add_jobschedule - @job_name = N'CreateCache', - @name = N'ReportCacheSchedule7pm', - @freq_type = 4, - @freq_interval = 1, - @active_start_time = 190000, - @active_end_time = 200000; - -EXEC dbo.sp_attach_schedule - @job_name = N'CreateCache', - @schedule_name = N'ReportCacheSchedule7pm'; - -EXEC dbo.sp_add_jobserver - @job_name = N'CreateCache'; -``` - -### Reports in the Help Desk Portal display a warning if SSL is not configured in SSRS - -If SQL Server Reporting Services (SSRS) was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then browse to the Help Desk Portal and select a report, the following message displays: “Only Secure Content is Displayed.” - -WORKAROUND: To show the report, click **Show All Content**. To address this issue, go to the MBAM computer where SQL Server Reporting Services is installed, run **Reporting Services Configuration Manager**, and then click **Web Service URL**. Select the appropriate SSL certificate for the server, enter the appropriate SSL port (the default port is 443), and then click **Apply**. - -### Non-default instances of the Configuration Manager database are not supported - -MBAM looks only for the default instance of the Configuration Manager database in Configuration Manager 2007 and System Center 2012 Configuration Manager. If you use a non-default instance, you cannot install MBAM. - -WORKAROUND: None. - -### Clicking “Back” in the Compliance Summary report might throw an error - -If you drill down into a Compliance Summary report, and then click the **Back** link in the SSRS report, an error might be thrown. - -WORKAROUND: None. - -### Used Space Only Encryption does not work correctly - -If you encrypt a computer for the first time after you install the MBAM Client, and you have set a Group Policy Object to implement Used Space Only encryption, MBAM erroneously encrypts the entire disk instead of encrypting only the disk’s used space. If a computer is already encrypted when you install the MBAM Client, and you have set the same Group Policy Object, the encryption works correctly and encrypts only the used disk space on your computer. - -WORKAROUND: None. - -### Cipher strength displays incorrectly on the Computer Compliance report - -If you do not set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object, the Computer Compliance report in the Configuration Manager Integration topology always displays “unknown” for the cipher strength, even when the cipher strength uses the default of 128-bit encryption. The report displays the correct cipher strength if you set a specific cipher strength in the Group Policy Object. - -WORKAROUND: Always set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object. - -### Compliance Status Distribution By Drive Type displays old data after you update configuration items - -After you update MBAM configuration items in System Center 2012 Configuration Manager, the Compliance Status Distribution By Drive Type bar chart on the BitLocker Enterprise Compliance Dashboard shows data that is based on information from old versions of the configuration items. - -WORKAROUND: None. Modification of the MBAM configuration items is not supported, and the report might not appear as expected. - -### Enhanced Security Configuration may cause reports to display incorrectly - -If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an “Access Denied” message might appear when you try to view reports on the MBAM Server. By default, ESC is turned on to protect the server by decreasing the server’s exposure to potential attacks that can occur through web content and application scripts. - -WORKAROUND: If the “Access Denied” message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which ESC is not enabled. - -### MBAM Server installation fails when you upgrade from SQL Server 2008 to SQL Server 2012 - -If you upgrade from SQL Server 2008 to SQL Server 2012, and then try to install the Compliance and Audit Database or the Recovery Database, the installation fails and rolls back. The failure occurs because the required SQLCMD.exe file was removed during the SQL upgrade and cannot be found by the MBAM installer. The MSI log file lines may look similar to the following: - -RunDbInstallScript Recovery Db CA: BinDir - E:\\MSSQL\\100\\Tools\\Binn\\SqlCmd.exeRunDbInstallScript Recovery Db CA: dbInstance - xxxxxx\\I01RunDbInstallScript Recovery Db CA: sqlScript- C:\\Program Files\\Microsoft\\Microsoft BitLocker Administration and Monitoring\\Setup\\KeyRecovery.sqlRunDbInstallScript Recovery Db CA: dbName- MBAM\_Recovery\_and\_HardwareRunDbInstallScript Recovery Db CA: defaultFileName- MBAM\_Recovery\_and\_HardwareRunDbInstallScript Recovery Db CA: defaultDataPath- F:\\MSSQL\\MSSQL10.I01\\MSSQL\\DATA\\RunDbInstallScript Recovery Db CA: defaultLogPath- K:\\MSSQL\\MSSQL10.I01\\MSSQL\\Data\\RunDbInstallScript Recovery Db CA: scriptLogPath - C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\InstallKeyComplianceDatabase.log-e -E -S xxxxxxx\\I01 -i "C:\\Program Files\\Microsoft\\Microsoft BitLocker Administration and Monitoring\\Setup\\KeyRecovery.sql" -v DatabaseName="MBAM\_Recovery\_and\_Hardware" DefaultFileName="MBAM\_Recovery\_and\_Hardware" DefaultDataPath="F:\\MSSQL\\MSSQL10.I01\\MSSQL\\DATA\\" DefaultLogPath="K:\\MSSQL\\MSSQL10.I01\\MSSQL\\Data\\" -o "C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\InstallKeyComplianceDatabase.log"RunDbInstallScript Recovery Db CA:Starting to run the Recovery database install scriptRunDbInstallScript Recovery Db CA: Sqlcmd log file is located in C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\\\InstallKeyRecoveryDatabase.logRunDbInstallScript Recovery Db CA Exception: Install Recovery database Custom Action command line output Exception: The system cannot find the file specified - -The MBAM Server Windows Installer is hardcoded to find the SQLCMD.exe path by looking in the Path string value in the registry under HKLM\\Software\\Microsoft\\Microsoft SQL Server\\100\\Tools\\ClientSetup. The key is still present during the migration from SQL Server 2008 to SQL Server 2012, but the path that is referenced by the data value does not contain the SQLCMD.exe file, because the SQL upgrade process removed the file. - -WORKAROUND: Temporarily rename the HKLM\\Software\\Microsoft\\Microsoft SQL Server\\100\\Tools\\ClientSetup Path string value to **Path\_old**, and then re-run the MBAM Server Windows Installer. When the installation completes successfully and creates the databases in SQL Server 2012, rename the **Path\_old** value to **Path**. - -## Hotfixes and Knowledge Base articles for MBAM 2.0 - - -This section contains hotfixes and KB articles for MBAM 2.0. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    KB ArticleTitleLink

    2831166

    Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed"

    support.microsoft.com/kb/2831166/EN-US

    2870849

    Users cannot retrieve BitLocker Recovery key using MBAM 2.0 Self Service Portal

    support.microsoft.com/kb/2870849/EN-US

    2756402

    MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description

    support.microsoft.com/kb/2756402/EN-US

    2620287

    Error Message “Server Error in ‘/Reports’ Application” When You Click Reports Tab in MBAM

    support.microsoft.com/kb/2620287/EN-US

    2639518

    Error opening Enterprise or Computer Compliance Reports in MBAM

    support.microsoft.com/kb/2639518/EN-US

    2620269

    MBAM Enterprise Reporting Not Getting Updated

    support.microsoft.com/kb/2620269/EN-US

    2712461

    Installing MBAM on a Domain Controller is not supported

    support.microsoft.com/kb/2712461/EN-US

    2876732

    You receive error code 0x80071a90 during Standalone or Configuration Manager Integration setup of MBAM 2.0

    support.microsoft.com/kb/2876732/EN-US

    2754259

    MBAM and Secure Network Communication

    support.microsoft.com/kb/2754259/EN-US

    2870842

    MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008

    support.microsoft.com/kb/2870842/EN-US

    2668533

    MBAM Setup fails if SQL SSRS is not configured properly

    support.microsoft.com/kb/2668533/EN-US

    2870847

    MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role"

    support.microsoft.com/kb/2870847/EN-US

    2870839

    MBAM 2.0 Enterprise Reports are not refreshed in MBAM 2.0 Standalone topology due to SQL job CreateCache failure

    support.microsoft.com/kb/2870839/EN-US

    2620269

    MBAM Enterprise Reporting Not Getting Updated

    support.microsoft.com/kb/2620269/EN-US

    2935997

    MBAM Supported Computers compliance reporting incorrectly includes unsupported products

    support.microsoft.com/kb/2935997/EN-US

    2612822

    Computer Record is Rejected in MBAM

    support.microsoft.com/kb/2612822/EN-US

    - - - -## Related topics - - -[About MBAM 2.0](about-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md b/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md deleted file mode 100644 index 9fb4028a56..0000000000 --- a/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md +++ /dev/null @@ -1,244 +0,0 @@ ---- -title: Release Notes for MBAM 2.0 SP1 -description: Release Notes for MBAM 2.0 SP1 -author: dansimp -ms.assetid: b39002ba-33c6-45ec-9d1b-464327b60f5c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for MBAM 2.0 SP1 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1). These release notes contain information that is required to successfully install BitLocker Administration and Monitoring 2.0 SP1, and they contain information that is not available in the product documentation. If there is a difference between these release notes and other MBAM 2.0 SP1 documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## MBAM 2.0 SP1 known issues - - -This section contains known issues for MBAM 2.0 SP1. - -### Upgrade of MBAM with Configuration Manager Integrated topology to MBAM 2.0 SP1 requires manual removal of Configuration Manager objects - -If you are using MBAM with Configuration Manager, and you want to upgrade to MBAM 2.0 SP1, you must manually remove all of the Configuration Manager objects that were installed into Configuration Manager as a part of the MBAM installation. The objects that you must manually remove are the MBAM reports, MBAM Supported Computers collection, and the BitLocker Protection Configuration Baseline and its associated configuration items. - -**Workaround**: Upgrade the Configuration Manager objects by completing the following steps: - -1. Back up existing compliance data to an external file, as described in the following steps. - - **Note**   - All existing BitLocker compliance data will be deleted when you delete the existing baseline in Configuration Manager. The data will be regenerated over time, but it is recommended that you save a copy of the data in case you need the compliance data for a particular computer before the compliance data has been regenerated. - - - - 1. To save historical BitLocker compliance data, open the **BitLocker Enterprise Compliance Details** Report. - - 2. Click the **Save** icon in the report and select **Excel**. - - The saved report will contain data such as the computer name, domain name, compliance status, exemption, device users, compliance status details, and last contact date/time. Some information, such as detailed volume information and encryption strength, are not saved. - -2. Uninstall **MBAM** from the server by using the **MBAM** installer. - -3. Manually delete the following objects from Configuration Manager: - - - MBAM Supported Computers collection - - - BitLocker Protection baseline - - - BitLocker Operating System Drive Protection configuration item - - - BitLocker Fixed Data Drives Protection configuration item - -4. Manually delete the MBAM Reports folder in the Configuration Manager SQL Server Reporting Services site. To do this: - - 1. Use Internet Explorer to browse to the reporting services point, for example, http://<yourcmserver>/reports. - - 2. Click the appropriate Configuration Manager site code link. - - 3. Delete the MBAM folder. - -5. Use the MBAM Server installer to reinstall the Configuration Manager Integration objects. The client computers will begin to upload BitLocker compliance data again over time. - -### Submit button on Self-Service Portal does not work in Internet Explorer 10 - -When you use Internet Explorer 10 to access the Administration and Monitoring Website, the **Submit** button on the website does not work. - -**Workaround**: On the server where you installed the Administration and Monitoring Website, install [Hotfix for ASP.NET browser definition files](https://go.microsoft.com/fwlink/?LinkId=317798). - -### International domain names are not supported - -MBAM 2.0 SP1 does not support international domain names. - -**Workaround**: None. - -### Reports in the Administration and Monitoring website display a warning if SSL is not configured in SSRS - -If SQL Server Reporting Services (SSRS) was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then browse to the Administration and Monitoring website and select a report, the following message displays: “Only Secure Content is Displayed.” - -**Workaround**: To correct this issue, configure SSL in **Reporting Services Configuration Manager** on the MBAM server where SQL Server Reporting Services is installed. Uninstall and then reinstall the Administration and Monitoring Server website. - -### Clicking Back in the Compliance Summary report might create an error - -If you drill down into a Compliance Summary report, and then click the **Back** link in the SSRS report, an error might occur. - -**Workaround**: None. - -### Used Space Only Encryption does not work correctly - -If you encrypt a computer for the first time after you install the MBAM Client, and you have set a Group Policy Object to implement Used Space Only Encryption, MBAM erroneously encrypts the entire disk instead of encrypting only the disk’s used space. If a computer is already encrypted with Used Space Only Encryption before you install the MBAM Client, and you have set the same Used Space Only Encryption Group Policy Object, MBAM recognizes the setting and reports the encryption correctly in the compliance reports. - -**Workaround**: None. - -### Cipher strength displays incorrectly in the Computer Compliance report - -If you do not set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object, the Computer Compliance report in the Configuration Manager integrated topology always displays **Unknown** for the cipher strength, even when the cipher strength uses the default of 128-bit encryption. The report displays the correct cipher strength if you set a specific cipher strength in the Group Policy Object. - -**Workaround**: Always set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object. - -### Compliance Status Distribution By Drive Type displays old data after you update configuration items - -After you update MBAM configuration items in System Center 2012 Configuration Manager, the Compliance Status Distribution By Drive Type bar chart on the BitLocker Enterprise Compliance Dashboard shows data that is based on information from old versions of the configuration items. - -**Workaround**: None. Modification of the MBAM configuration items is not supported, and the report might not appear as expected. - -### Enhanced Security Configuration may cause reports to display incorrectly - -If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an **Access Denied** message might appear when you try to view reports on the MBAM Server. By default, Enhanced Security Configuration is turned on to protect the server by decreasing the server’s exposure to potential attacks that can occur through web content and application scripts. - -**Workaround**: If the **Access Denied** message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which Enhanced Security Configuration is not enabled. - -### MBAM Server installation fails when you upgrade from SQL Server 2008 to SQL Server 2012 - -If you upgrade from SQL Server 2008 to SQL Server 2012, and then try to install the Compliance and Audit Database or the Recovery Database, the installation fails and rolls back. The failure occurs because the required SQLCMD.exe file was removed during the SQL Server upgrade, and it cannot be found by the MBAM installer. The MSI log file lines may look similar to the following: - -RunDbInstallScript Recovery Db CA: BinDir - E:\\MSSQL\\100\\Tools\\Binn\\SqlCmd.exeRunDbInstallScript Recovery Db CA: dbInstance - xxxxxx\\I01RunDbInstallScript Recovery Db CA: sqlScript- C:\\Program Files\\Microsoft\\Microsoft BitLocker Administration and Monitoring\\Setup\\KeyRecovery.sqlRunDbInstallScript Recovery Db CA: dbName- MBAM\_Recovery\_and\_HardwareRunDbInstallScript Recovery Db CA: defaultFileName- MBAM\_Recovery\_and\_HardwareRunDbInstallScript Recovery Db CA: defaultDataPath- F:\\MSSQL\\MSSQL10.I01\\MSSQL\\DATA\\RunDbInstallScript Recovery Db CA: defaultLogPath- K:\\MSSQL\\MSSQL10.I01\\MSSQL\\Data\\RunDbInstallScript Recovery Db CA: scriptLogPath - C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\InstallKeyComplianceDatabase.log-e -E -S xxxxxxx\\I01 -i "C:\\Program Files\\Microsoft\\Microsoft BitLocker Administration and Monitoring\\Setup\\KeyRecovery.sql" -v DatabaseName="MBAM\_Recovery\_and\_Hardware" DefaultFileName="MBAM\_Recovery\_and\_Hardware" DefaultDataPath="F:\\MSSQL\\MSSQL10.I01\\MSSQL\\DATA\\" DefaultLogPath="K:\\MSSQL\\MSSQL10.I01\\MSSQL\\Data\\" -o "C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\InstallKeyComplianceDatabase.log"RunDbInstallScript Recovery Db CA:Starting to run the Recovery database install scriptRunDbInstallScript Recovery Db CA: Sqlcmd log file is located in C:\\Users\\xxxxxx\\AppData\\Local\\Temp\\\\InstallKeyRecoveryDatabase.logRunDbInstallScript Recovery Db CA Exception: Install Recovery database Custom Action command line output Exception: The system cannot find the file specified - -The MBAM Server Windows Installer is hardcoded to find the SQLCMD.exe path by looking in the Path string value in the registry under HKLM\\Software\\Microsoft\\Microsoft SQL Server\\100\\Tools\\ClientSetup. The key is still present during the migration from SQL Server 2008 to SQL Server 2012, but the path that is referenced by the data value does not contain the SQLCMD.exe file, because the SQL upgrade process removed the file. - -**Workaround**: Temporarily rename the HKLM\\Software\\Microsoft\\Microsoft SQL Server\\100\\Tools\\ClientSetup path string value to **Path\_old**, and then run Windows Installer on the MBAM Server again. When the installation completes successfully and creates the databases in SQL Server 2012, rename **Path\_old** to **Path**. - -## Hotfixes and Knowledge Base articles for MBAM 2.0 SP1 - - -This section contains hotfixes and KB articles for MBAM 2.0 SP1. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    KB ArticleTitleLink

    2831166

    Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed"

    support.microsoft.com/kb/2831166/EN-US

    2870849

    Users cannot retrieve BitLocker Recovery key using MBAM 2.0 Self Service Portal

    support.microsoft.com/kb/2870849/EN-US

    2756402

    MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description

    support.microsoft.com/kb/2756402/EN-US

    2620287

    Error Message “Server Error in ‘/Reports’ Application” When You Click Reports Tab in MBAM

    support.microsoft.com/kb/2620287/EN-US

    2639518

    Error opening Enterprise or Computer Compliance Reports in MBAM

    support.microsoft.com/kb/2639518/EN-US

    2620269

    MBAM Enterprise Reporting Not Getting Updated

    support.microsoft.com/kb/2620269/EN-US

    2712461

    Installing MBAM on a Domain Controller is not supported

    support.microsoft.com/kb/2712461/EN-US

    2876732

    You receive error code 0x80071a90 during Standalone or Configuration Manager Integration setup of MBAM 2.0

    support.microsoft.com/kb/2876732/EN-US

    2754259

    MBAM and Secure Network Communication

    support.microsoft.com/kb/2754259/EN-US

    2870842

    MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008

    support.microsoft.com/kb/2870842/EN-US

    2668533

    MBAM Setup fails if SQL SSRS is not configured properly

    support.microsoft.com/kb/2668533/EN-US

    2870847

    MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role"

    support.microsoft.com/kb/2870847/EN-US

    2870839

    MBAM 2.0 Enterprise Reports are not refreshed in MBAM 2.0 Standalone topology due to SQL job CreateCache failure

    support.microsoft.com/kb/2870839/EN-US

    2620269

    MBAM Enterprise Reporting Not Getting Updated

    support.microsoft.com/kb/2620269/EN-US

    2935997

    MBAM Supported Computers compliance reporting incorrectly includes unsupported products

    support.microsoft.com/kb/2935997/EN-US

    2612822

    Computer Record is Rejected in MBAM

    support.microsoft.com/kb/2612822/EN-US

    - - - -## Related topics - - -[About MBAM 2.0 SP1](about-mbam-20-sp1.md) - - - - - - - - - diff --git a/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md b/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md deleted file mode 100644 index 0a0a6f60c0..0000000000 --- a/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Security and Privacy for MBAM 2.0 -description: Security and Privacy for MBAM 2.0 -author: dansimp -ms.assetid: 1b2859f8-2381-4ad7-8744-2caed88570ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for MBAM 2.0 - - -Use the following information to help you plan for security and privacy considerations in Microsoft BitLocker Administration and Monitoring (MBAM). - -## Security Considerations for MBAM 2.0 - - -There are many security-related considerations that should be planned for when deploying and using MBAM in your environment. The information in this section provides a brief overview about the Active Directory Domain Services user accounts and groups, log files, and other security-related considerations for MBAM. - -[MBAM 2.0 Security Considerations](mbam-20-security-considerations-mbam-2.md) - -## Privacy for MBAM 2.0 - - -The information in this section explains many of the data collection and use practices of MBAM. - -[MBAM 2.0 Privacy Statement](mbam-20-privacy-statement-mbam-2.md) - -## Other resources MBAM Security and Privacy - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md b/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md deleted file mode 100644 index 7ea7004d1c..0000000000 --- a/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Troubleshooting MBAM 2.0 -description: Troubleshooting MBAM 2.0 -author: dansimp -ms.assetid: 43933ec7-b5b8-49c5-813f-4c06aa7314ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting MBAM 2.0 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to Find Troubleshooting Content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP Documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to Create a Troubleshooting Article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting MBAM - - -[Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](index.md) - -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) - -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -  - -  - - - - - diff --git a/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md b/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md deleted file mode 100644 index 4e367f90d7..0000000000 --- a/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md +++ /dev/null @@ -1,450 +0,0 @@ ---- -title: Understanding MBAM Reports in Configuration Manager -description: Understanding MBAM Reports in Configuration Manager -author: dansimp -ms.assetid: b2582190-c9de-4e64-bd5a-f31ac1916f53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding MBAM Reports in Configuration Manager - - -When Microsoft BitLocker Administration and Monitoring (MBAM) is installed with the Configuration Manager Integrated topology, the hardware compliance and reporting features are moved into the Configuration Manager infrastructure and out of MBAM. When you use the Configuration Manager topology, you run reports from Configuration Manager rather than from MBAM, except for the Recovery Audit Report, which you continue to access by using the Administration and Monitoring Website. - -The reports for the Configuration Manager Integrated topology show BitLocker compliance for the enterprise and for individual computers and devices that MBAM manages. The reports provide both tabular information and charts, and enable you to filter reports to view data from different perspectives. - -The information in this topic describes the MBAM reports that you run from Configuration Manager. For information about MBAM reports for the Stand-alone topology, see [Understanding MBAM Reports](understanding-mbam-reports-mbam-2.md). - -## Accessing Reports in Configuration Manager - - -To access the Reports feature in Configuration Manager, open the **Configuration Manager console**. To display the list of available reports: - -- In Configuration Manager 2007, expand the **Computer Management** node, and then expand the **Reporting** node. - -- In System Center 2012 Configuration Manager, in the Monitoring workspace under **Overview**, expand the **Reporting** node and then click **Reports**. - -### BitLocker Enterprise Compliance Dashboard - -The BitLocker Enterprise Compliance Dashboard provides the following graphs, which show BitLocker compliance status across the enterprise: - -- Compliance Status Distribution - -- Non Compliant Errors Distribution - -- Compliance Status Distribution by Drive Type - -**Compliance Status Distribution** - -This pie chart shows computer compliance statuses within the enterprise, and shows the percentage of computers, compared to the total number of computers in the selected collection, that have that compliance status. The actual number of computers with each status is also shown. The pie chart shows the following compliance statuses: - -- Compliant - -- Non Compliant - -- User Exempt - -- Temporary User Exempt - -- Policy Not Enforced - -- Unknown -computers whose status was reported as an error, or devices that are part of the collection but have never reported their compliance status, for example, if they are disconnected from the organization - -**Non Compliant Errors Distribution** - -This pie chart shows the categories of computers in the enterprise that are not compliant with the BitLocker drive encryption policy, and shows the number of computers in each category. Each category percentage is calculated from the total number of non-compliant computers in the collection. - -- User postponed encryption - -- Unable to find compatible TPM - -- System Partition not available or large enough - -- Policy conflict - -- Waiting for TPM auto provisioning - -- An unknown error has occurred - -- No information – computers that do not have the MBAM Client installed, or that have the MBAM Client installed but not activated, for example, the service is not working - -**Compliance Status Distribution by Drive Type** - -This bar chart shows the current BitLocker compliance status by drive type. The statuses are “Compliant” and “Non Compliant.” Bars are shown for fixed data drives and operating system drives. Computers that do not have a fixed data drive are included and show a value only in the Operating System Drive bar. The chart does not include users who have been granted an exemption from the BitLocker drive encryption policy or the “No Policy” category. - -### BitLocker Enterprise Compliance Details Report - -This report shows information about the overall BitLocker compliance across your enterprise for the collection of computers that is targeted for BitLocker use. - -**BitLocker Enterprise Compliance Details Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Managed Computers

    Number of computers that MBAM manages.

    % Compliant

    Percentage of compliant computers in the enterprise.

    % Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    % Unknown Compliance

    Percentage of computers whose compliance state is not known.

    % Exempt

    Percentage of computers exempt from the BitLocker encryption requirement.

    % Non-Exempt

    Percentage of computers exempt from the BitLocker encryption requirement.

    Compliant

    Percentage of compliant computers in the enterprise.

    Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    Unknown Compliance

    Percentage of computers whose compliance state is not known.

    Exempt

    Total computers that are exempt from the BitLocker encryption requirement.

    Non-Exempt

    Total computers that are not exempt from the BitLocker encryption requirement.

    - - - -**BitLocker Enterprise Compliance Details Report - Compliance States** - - ----- - - - - - - - - - - - - - - - - - - - -
    Compliance StatusExemptionDescription

    Noncompliant

    Not Exempt

    The computer is noncompliant, according to the specified policy.

    Compliant

    Not Exempt

    The computer is compliant in accordance with the specified policy.

    - - - -### BitLocker Enterprise Compliance Summary Report - -Use this report type to show information about the overall BitLocker compliance across your enterprise and to show the compliance for individual computers that are in the collection of computers that is targeted for BitLocker use. - -**BitLocker Enterprise Compliance Summary Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Managed Computers

    Number of computers that MBAM manages.

    % Compliant

    Percentage of compliant computers in the enterprise.

    % Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    % Unknown Compliance

    Percentage of computers whose compliance state is not known.

    % Exempt

    Percentage of computers exempt from the BitLocker encryption requirement.

    % Non-Exempt

    Percentage of computers exempt from the BitLocker encryption requirement.

    Compliant

    Percentage of compliant computers in the enterprise.

    Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    Unknown Compliance

    Percentage of computers whose compliance state is not known.

    Exempt

    Total computers that are exempt from the BitLocker encryption requirement.

    Non-Exempt

    Total computers that are not exempt from the BitLocker encryption requirement.

    - - - -**BitLocker Enterprise Compliance Summary Report - Computer Details** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    User-specified DNS computer name that is being managed by MBAM.

    Domain Name

    Fully qualified domain name, where the client computer resides and is managed by MBAM.

    Compliance Status

    Overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified.

    Exemption

    Status that indicates whether the user is exempt or non-exemption from the BitLocker policy.

    Device Users

    User of the device.

    Compliance Status Details

    Error and status messages of the compliance state of the computer in accordance to the policy specified.

    Last Contact

    Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings).

    - - - -### BitLocker Computer Compliance Report - -Use this report type to collect information that is specific to a computer. The Computer Compliance Report provides detailed encryption information about each drive (Operating System and Fixed data drives) on a computer, and also an indication of the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry. - -**Note**   -Removable Data Volume encryption status is not shown in the report. - - - -**BitLocker Computer Compliance Report – Computer Details Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    User-specified DNS computer name that is being managed by MBAM.

    Domain Name

    Fully qualified domain name, where the client computer resides and is managed by MBAM.

    Computer Type

    Type of computer. Valid types are non-Portable and Portable.

    Operating System

    Operating System type found on the MBAM managed client computer.

    Overall Compliance

    Overall Compliance Status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified.

    Operating System Compliance

    Compliance status of the operating system that is managed by MBAM. Valid states are Compliant and Noncompliant.

    Fixed Data Drive Compliance

    Compliance status of the Fixed Data Drive that is managed by MBAM. Valid states are Compliant and Noncompliant.

    Last Update Date

    Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings).

    Exemption

    Status that indicates whether the user is exempt or non-exemption from the BitLocker policy.

    Exempted User

    User who is exempt from the BitLocker policy.

    Exemption Date

    Date on which the exemption was granted.

    Compliance Status Details

    Error and status messages of the compliance state of the computer in accordance to the policy specified.

    Policy Cipher Strength

    Cipher Strength selected by the Administrator during MBAM policy specification. (for example, 128-bit with Diffuser).

    Policy: Operating System Drive

    Indicates if encryption is required for the O/S and the appropriate protector type.

    Policy:Fixed Data Drive

    Indicates if encryption is required for the Fixed Drive.

    Manufacturer

    Computer manufacturer name as it appears in the computer BIOS.

    Model

    Computer manufacturer model name as it appears in the computer BIOS.

    Device Users

    Known users on the computer that is being managed by MBAM.

    - - - -**BitLocker Computer Compliance Report – Computer Volume Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Drive Letter

    Computer drive letter that was assigned to the particular drive by the user.

    Drive Type

    Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

    Cipher Strength

    Cipher Strength selected by the Administrator during MBAM policy specification.

    Protector Types

    Type of protector selected via policy used to encrypt an operating system or Fixed volume. The valid protector types on an operating system are TPM or TPM+PIN and for a Fixed Data Volume is Password.

    Protector State

    Indicates that the computer being managed by MBAM has enabled the protector type specified in the policy. The valid states are ON or OFF.

    Encryption State

    Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

    - - - -## Related topics - - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) - - - - - - - - - diff --git a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md b/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md deleted file mode 100644 index 4e1f2addc4..0000000000 --- a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md +++ /dev/null @@ -1,326 +0,0 @@ ---- -title: Understanding MBAM Reports -description: Understanding MBAM Reports -author: dansimp -ms.assetid: 8778f333-760e-4f26-acb4-4e73b6fbb536 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding MBAM Reports - - -If you chose the Stand-alone topology when you installed Microsoft BitLocker Administration and Monitoring (MBAM), you can run different reports in MBAM to monitor BitLocker usage and compliance. MBAM reports compliance and other information about all of the computers and devices it manages. The information in this topic can be used to help you understand the Microsoft BitLocker Administration and Monitoring reports for enterprise and individual computer compliance and for key recovery activity. - -**Note**   -If you chose the Configuration Manager topology when you installed Microsoft BitLocker Administration and Monitoring (MBAM), reports are generated from Configuration Manager rather than from MBAM. For more information about reports that are run from Configuration Manager, see [Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md). - - - -## Understanding Reports - - -To access the Reports feature of Microsoft BitLocker Administration and Monitoring, open a web browser and open the Administration and Monitoring website. Select **Reports** in the left menu bar and then select from the top menu bar the kind of report that you want to generate. - -### Enterprise Compliance Report - -Use this report type to collect information on overall BitLocker compliance in your organization. You can use different filters to narrow your search results to Compliance state and Error status. The report information is updated every six hours. - -**Enterprise Compliance Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    User-specified DNS name that is being managed by MBAM.

    Domain Name

    Fully qualified domain name where the client computer resides and is managed by MBAM.

    Compliance Status

    State of compliance for the computer, according to the policy specified for the computer. The states are Noncompliant and Compliant. See the Enterprise Compliance Report Compliance States table for more information about how to interpret compliance states.

    Compliance Status Details

    Error and status messages of the compliance state of the computer in accordance to the policy specified.

    Last Contact

    Date and time when the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings).

    - - - -**Enterprise Compliance Report Compliance States** - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Compliance StatusExemptionDescriptionUser Action

    Noncompliant

    Not Exempt

    The computer is noncompliant, according to the specified policy.

    Expand the Computer Compliance Report details by clicking Computer Name, and determine whether the state of each drive complies with the specified policy. If the encryption state indicates that the computer is not encrypted, encryption may be in process, or there is an error on the computer. If there is no error, the likely cause is that the computer is still in the process of connecting or establishing the encryption status. Check back later to determine if the state changes.

    Compliant

    Not Exempt

    The computer is compliant, according to the specified policy.

    No action needed; the state of the computer can be confirmed by viewing the Computer Compliance Report.

    - - - -### Computer Compliance Report - -Use this report type to collect information that is specific to a computer or user. - -This report can be viewed by clicking the computer name in the Enterprise Compliance Report, or by typing the computer name in the Computer Compliance Report. The Computer Compliance Report provides detailed encryption information about each drive (operating system and fixed data drives) on a computer, and also an indication of the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry. - -**Note**   -Removable Data Volume encryption status will not be shown in the report. - - - -**Computer Compliance Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    User-specified DNS computer name that is being managed by MBAM.

    Domain Name

    Fully qualified domain name, where the client computer resides and is managed by MBAM.

    Computer Type

    Type of computer. Valid types are non-Portable and Portable.

    Operating System

    Operating system type found on the MBAM-managed client computer.

    Compliance Status

    Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the following table) may indicate different compliance states. However, this field represents that compliance state, according to the specified policy.

    Policy Cipher Strength

    Cipher strength selected by the administrator during MBAM policy specification (for example, 128-bit with Diffuser).

    Policy Operating System Drive

    Indicates if encryption is required for the operating system and shows the appropriate protector type.

    Policy-Fixed Data Drive

    Indicates if encryption is required for the fixed data drive.

    Policy Removable Data Drive

    Indicates if encryption is required for the removable drive.

    Device Users

    Known users on the computer that is being managed by MBAM.

    Manufacturer

    Computer manufacturer name, as it appears in the computer BIOS.

    Model

    Computer manufacturer model name, as it appears in the computer BIOS.

    Compliance Status Details

    Error and status messages of the compliance state of the computer, in accordance with the specified policy.

    Last Contact

    Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable (see MBAM policy settings).

    - - - -**Computer Compliance Report Drive Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Drive Letter

    Computer drive letter that was assigned to the particular drive by the user.

    Drive Type

    Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

    Cipher Strength

    Cipher strength selected by the administrator during MBAM policy specification.

    Protector Type

    Type of protector selected via the policy used to encrypt an operating system or fixed data volume.

    Protector State

    Indicates that the computer being managed by MBAM has enabled the protector type that is specified in the policy. The valid states are ON or OFF.

    Encryption State

    Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

    Compliance Status

    State that indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant.

    Compliance Status Details

    Error and status messages of the compliance state of the computer, according to the specified policy.

    - - - -### Recovery Audit Report - -Use this report type to audit users who have requested access to recovery keys. The report offers several filters based on the desired filtering criteria. Users can filter on a specific type of user, either a Help Desk user or an end user, whether the request failed or was successful, the specific type of key requested, and a date range during which the retrieval occurred. The administrator can produce contextual reports based on need. - -**Recovery Audit Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Request Date and Time

    Date and time that a key retrieval request was made by an end user or Help Desk user.

    Request Status

    Status of the request. Valid statuses are either Successful (the key was retrieved), or Failed (the key was not retrieved).

    Helpdesk User

    Help Desk user that initiated the request for key retrieval. Note: If the Help Desk user retrieves the key on behalf on an end-user, the End User field will be blank.

    User

    End user who initiated the request for key retrieval.

    Key Type

    Type of key that was requested by either the Help Desk user or the end user. The three types of keys that MBAM collects are: Recovery Key Password (used to recovery a computer in recovery mode), Recovery Key ID (used to recover a computer in recovery mode on behalf of another user), and TPM Password Hash (used to recover a computer with a locked TPM).

    Reason Description

    Reason the specified Key Type was requested by the Help Desk user or the end user. The reasons are specified in the Drive Recovery and Manage TPM features of the Administration and Monitoring website. The valid entries are either user-entered text, or one of the following reason codes:

    -
      -
    • Operating System Boot Order changed

    • -
    • BIOS Changed

    • -
    • Operating System files changed

    • -
    • Lost Startup key

    • -
    • Lost PIN

    • -
    • TPM Reset

    • -
    • Lost Passphrase

    • -
    • Lost Smartcard

    • -
    • Reset PIN lockout

    • -
    • Turn on TPM

    • -
    • Turn off TPM

    • -
    • Change TPM password

    • -
    • Clear TPM

    • -
    - - - -**Note**   -Report results can be saved to a file by clicking the **Export** button on the reports menu bar. For more information about how to run MBAM reports, see [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md). - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md b/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md deleted file mode 100644 index ab076703c4..0000000000 --- a/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: Upgrading from Previous Versions of MBAM -description: Upgrading from Previous Versions of MBAM -author: dansimp -ms.assetid: 73b425cf-9cd9-4ebc-a35e-1b3bf18596ce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Upgrading from Previous Versions of MBAM - - -You can upgrade Microsoft BitLocker Administration and Monitoring (MBAM) to MBAM 2.0, with the Stand-alone topology or Configuration Manager topology, by doing the following: - -- **Manual in-place server replacement** – To upgrade the MBAM Server, manually uninstall MBAM by using either the installer or Control Panel, and then install the MBAM 2.0 infrastructure. You do not have to remove the databases. Uninstalling the MBAM 1.0 Server leaves the MBAM databases intact. If you specify the same databases that MBAM 1.0 was using, the MBAM 2.0 installation retains MBAM 1.0 data in the databases and converts the databases to work with MBAM 2.0. - -- **Distributed Client Upgrade** - If you are using the Stand-alone MBAM topology, you can upgrade the MBAM Clients gradually after you install the MBAM 2.0 Server infrastructure. The MBAM 2.0 Server detects the version of the existing Client and performs the required steps to upgrade to the 2.0 Client. - - After you upgrade the MBAM 2.0 Server infrastructure, MBAM 1.0 Clients continue to report to the MBAM 2.0 Server successfully, escrowing recovery data, but compliance will be based on the policies in MBAM 1.0. You must upgrade clients to MBAM 2.0 to have client computers accurately report compliance against the MBAM 2.0 policies. You can upgrade the clients to the MBAM 2.0 Client without uninstalling the previous client, and the client will start to apply and report MBAM 2.0 policies. - - If you are using MBAM with Configuration Manager, you must upgrade the MBAM 1.0 clients to MBAM 2.0. - -## Upgrading MBAM from a Two-Server Architecture - - -Use the following instructions to upgrade from a previous version of MBAM when you are using a two-server architecture, where one server is hosting the Microsoft SQL Server components, and the other server is hosting the websites and services. - -**To upgrade MBAM from a two-server architecture** - -1. On the server with the SQL Server features, in Control Panel, select **Programs and Features**, and then uninstall **Microsoft BitLocker Administration and Monitoring**. The Recovery Database and Compliance and Audit database remain unchanged. - -2. Run **MBAMSetup.exe** for version MBAM 2.0, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **Stand-alone** or **System Center Configuration Manager Integration** topology, and then click **Next**. - -5. On the **Select features to install** page, clear the **Self-Service Server** and **Administration and Monitoring Server** features, and then click **Next**. - -6. Wait for the prerequisite checks to finish, and then click **Next**. If a missing prerequisite is detected, resolve the missing prerequisites, and then click **Check prerequisites again**. - -7. On the **Provide account used to access the MBAM databases** page, provide the computer name for the server that will host the sites and services, and then click **Next**. - -8. On the **Configure the Recovery database** page, specify the SQL Server instance name and the name of the database that will store the recovery data. You must also specify where the database files and log information will be located. - -9. Click **Next** to continue. - -10. On the **Configure the Compliance and Audit database** page, specify the SQL Server instance name and the name of the database that will store the compliance and audit data. - -11. Click **Next** to continue. - -12. On the **Configure the Compliance and Audit Reports** page, specify the SQL Server Reporting Services instance where the Compliance and Audit reports will be installed, and provide a domain user account and password to access the Compliance and Audit database. Configure the password for this account to never expire. The user account can access all data available to the MBAM Reports Users group. - -13. Click **Next** to continue. - -14. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. This does not turn on Automatic Updates in Windows. If you previously chose to use Microsoft Update for this product or another product, the Microsoft Update page does not appear. - -15. On the **Installation Summary** page, review the features that will be installed, and then click **Install** to start the installation. - -**To uninstall the Administration and Monitoring Server features and to complete the upgrade** - -1. On the computer that hosts the Administration and Monitoring Server features, in Control Panel, select **Programs and Features**, and then uninstall MBAM to remove the previously installed websites and services. - -2. Run the **MBAMSetup.exe** for version 2.0, optionally select the **Customer Experience Improvement Program**, and then click **Start**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. On the **Topology Selection** page, select the **Stand-alone** or **System Center Configuration Manager Integration** topology, and then click **Next**. - -5. On the **Select features to install** page, clear the **Recovery Database** and **Compliance and Audit Database** and **Compliance and Audit Reports** features, and then click **Next**. - -6. Wait for the prerequisite checks to finish, and then click **Next**. If a missing prerequisite is detected, resolve the missing prerequisites first, and then click **Check prerequisites again**. - -7. On the **Configure network communication security** page, choose whether to use Secure Socket Layer (SSL) encryption for the websites and services. If you decide to encrypt the communication, select the certification authority (CA) certificate to use for encryption. - - **Note**   - The certificate must be created before this step to enable you to select it on this page. - - - -8. On the **Configure the location of the Compliance Status database** page, specify the SQL Server instance name and the name of the database that stores the compliance and audit data. You must also specify where the database files and log information will be located. - -9. Click **Next** to continue. - -10. On the **Configure the location of the Recovery Database** page, specify the SQL Server instance name and the name of the database that stores the recovery data. - -11. Click **Next** to continue. - -12. On the **Configure the Compliance and Audit Reports** page, enter the URL for the reporting instance that you configured on the other server. Use the **Test** button to verify that you can reach the site. - -13. Click **Next** to continue. - -14. On the **Configure the Self-Service Portal** page, enter the port number, host name, virtual directory name, and installation path for the Self-Service Portal. - - **Note**   - The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name. - - - -15. On the **Configure the Administration and Monitoring Server** page, specify the desired virtual directory for the Help Desk website. - -16. Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. This step does not turn on Automatic Updates in Windows. If you previously chose to use Microsoft Update for this product or another product, the Microsoft Update page does not appear. - -17. On the **Installation Summary** page, review the features that will be installed, and then click **Install** to start the installation. - -18. To validate that the upgrade was successful, verify that you can reach each site from another computer in the domain. - -## Upgrading the MBAM Client on End-User Computers - - -To upgrade end-user computers to the MBAM 2.0 Client, run **MbamClientSetup.exe** on each client computer. The installer automatically updates the Client to the MBAM 2.0 Client. You can install the MBAM Client through an electronic software distribution system, tools such as Active Directory Domain Services or System Center Configuration Manager. - -To validate the Client upgrade, do the following: - -1. Wait until the configured reporting cycle is finished, and then start **SQL Server Management Studio** on the SQL Server computer. - -2. On the SQL Server computer, start **SQL Server Management Studio**. - -3. Verify that the **RecoveryAndHardwareCore.Machines** table contains a row that shows the end-user’s computer name. - -## Related topics - - -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/using-mbam-with-configuration-manager.md b/mdop/mbam-v2/using-mbam-with-configuration-manager.md deleted file mode 100644 index 10be5afa15..0000000000 --- a/mdop/mbam-v2/using-mbam-with-configuration-manager.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Using MBAM with Configuration Manager -description: Using MBAM with Configuration Manager -author: dansimp -ms.assetid: 03868717-4aa7-4897-8166-9a3df5e9519e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using MBAM with Configuration Manager - - -When you install Microsoft BitLocker Administration and Monitoring (MBAM), you can choose an installation that integrates Microsoft BitLocker Administration and Monitoring with System Center Configuration Manager. For a list of the supported versions of Configuration Manager, see [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md). - -This integration moves the Microsoft BitLocker Administration and Monitoring compliance and reporting infrastructure into the native environment of Microsoft System Center Configuration Manager. With the Configuration Manager topology, IT administrators can view reports and the compliance status of their enterprise from the Configuration Manager Management Console. - -**Important**   -Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007. - - - -## Getting Started – Using MBAM with Configuration Manager - - -This section describes how MBAM works with Configuration Manager and explains the recommended architecture for deploying MBAM with the Configuration Manager Integration topology. - -[Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md) - -## Planning to Deploy MBAM with Configuration Manager - - -This section describes the installation prerequisites, supported configurations, and hardware and software requirements that you need to consider before you install MBAM with the Configuration Manager topology. - -[Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md) - -## Deploying MBAM with Configuration Manager - - -This section describes how to deploy MBAM with Configuration Manager, and includes instructions for installing and configuring the MBAM on the Administration and Monitoring Server and Configuration Manager Server. - -[Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md) - -## Understanding MBAM Reports in Configuration Manager - - -This section describes the MBAM reports that you can run from Configuration Manager to show the compliance of your enterprise and compliance of individual computers in your enterprise. - -[Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md) - -## Related topics - - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - - - - - - - - - diff --git a/mdop/mbam-v2/using-your-pin-or-password.md b/mdop/mbam-v2/using-your-pin-or-password.md deleted file mode 100644 index b2e8471007..0000000000 --- a/mdop/mbam-v2/using-your-pin-or-password.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Using Your PIN or Password -description: Using Your PIN or Password -author: dansimp -ms.assetid: 7fe2aef4-d3e0-49c8-877d-7fee13dc5b7b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using Your PIN or Password - - -BitLocker helps secure your computer by requiring a personal identification number (PIN) or password to unlock the information that is stored on your computer. The PIN or password requirements are set by your organization and depend on the kind of drive being encrypted. Data on the encrypted drives cannot be viewed without entering the PIN or password. If your computer hardware includes an enabled Trusted Platform Module (TPM), the TPM chip prompts you for your PIN before Windows starts on your computer. - -## About Your BitLocker PIN and Passwords - - -Your company specifies the complexity required for your PIN or password. These requirements for your PIN or password are explained during the BitLocker setup process. - -The password is used to unlock drives on your computer that do not contain the operating system. BitLocker will ask for your password after the PIN is requested during startup. Each BitLocker protected hard disk on your computer has its own unique password. You cannot unlock a BitLocker protected drive until you provide your password. - -**Note**   -Your Help Desk may set drives to unlock automatically. This eliminates the need to provide a PIN or password to view the information on the drives. - - - -## Unlocking Your Computer if You Forget Your PIN or Password - - -If you forget your PIN or password, your Help Desk can help you unlock BitLocker protected drives. To unlock a drive protected with BitLocker, contact your Help Desk if you need help. - -**How to unlock your computer if you forget your PIN or password** - -1. When you contact your Help Desk, you will need to provide them with the following information: - - - Your user name - - - Your domain - - - The first eight digits of your recovery key ID. This is a 32-digit code that BitLocker will display if you forget your PIN or password. - - - If you forget your PIN, you will have to enter the first eight digits of the recovery key ID, which will appear in the BitLocker Recovery console. The BitLocker Recovery console is a pre-Windows screen that will be displayed if you do not enter the correct PIN. - - - If you forget your password, look for the recovery key ID in the BitLocker Encryption Options Control Panel application. Select **Unlock Drive** and then click **I cannot remember my password**. The BitLocker Encryption Options application will then display a recovery key ID that you provide to Help Desk. - -2. Once your Help Desk receives the necessary information, it will provide you with a recovery key over the phone or through e-mail. - - - If you forgot your PIN, enter the recovery key in the BitLocker Recovery console to unlock your computer. - - - If you forgot your password, enter the recovery key in the BitLocker Encryption Options Control Panel application, in the same location where you found the recovery key ID earlier. This will unlock the protected hard drive. - -## Changing your PIN or Password - - -Before you can change the password on a BitLocker protected drive, you must unlock the drive. If the drive is not unlocked, select **Unlock Drive**, and then enter your current password. As soon as the drive is unlocked, you can select **Manage your Password** to change your current password. - -**How to Change your PIN or password** - -1. Click **Start**, and then select **Control Panel**. Control Panel opens in a new window. - -2. Select **System and Security**, and then select **BitLocker Encryption Options**. - - - To change your PIN, select **Manage Your PIN**. Type your new PIN into both fields and select **Reset PIN**. - - - To change your password, select **Manage Your Password**. Enter your new password into both fields and select **Reset Password**. - - - - - - - - - diff --git a/mdop/mbam-v25/TOC.md b/mdop/mbam-v25/TOC.md deleted file mode 100644 index 8a6984ffb5..0000000000 --- a/mdop/mbam-v25/TOC.md +++ /dev/null @@ -1,94 +0,0 @@ -# [Microsoft BitLocker Administration and Monitoring 2.5](index.md) -## [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) -### [About MBAM 2.5](about-mbam-25.md) -#### [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md) -### [About MBAM 2.5 SP1](about-mbam-25-sp1.md) -#### [Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md) -### [Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md) -### [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) -#### [High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md) -#### [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md) -#### [Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md) -### [Accessibility for MBAM 2.5](accessibility-for-mbam-25.md) -## [Planning for MBAM 2.5](planning-for-mbam-25.md) -### [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) -#### [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) -##### [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) -##### [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) -###### [Prerequisites for the Configuration Manager Integration Feature](prerequisites-for-the-configuration-manager-integration-feature.md) -###### [Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) -###### [Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) -##### [Prerequisites for MBAM 2.5 Clients](prerequisites-for-mbam-25-clients.md) -#### [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) -#### [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) -#### [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md) -### [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) -#### [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) -#### [Planning for MBAM 2.5 Server Deployment](planning-for-mbam-25-server-deployment.md) -#### [Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) -#### [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md) -#### [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md) -### [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) -## [Deploying MBAM 2.5](deploying-mbam-25.md) -### [Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md) -#### [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md) -#### [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) -##### [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md) -##### [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) -##### [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) -###### [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md) -###### [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) -####### [How to Set the Self-Service Portal Branding and Session Time-out](how-to-set-the-self-service-portal-branding-and-session-time-out.md) -####### [How to Turn the Self-Service Portal Notice Text On or Off](how-to-turn-the-self-service-portal-notice-text-on-or-off.md) -####### [How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information](how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md) -####### [How to Localize the Self-Service Portal “HelpdeskURL”](how-to-localize-the-self-service-portal-helpdeskurl.md) -####### [How to Localize the Self-Service Portal Notice Text](how-to-localize-the-self-service-portal-notice-text.md) -##### [How to Configure the MBAM 2.5 System Center Configuration Manager Integration](how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md) -##### [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) -#### [Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) -### [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) -#### [Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) -#### [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) -#### [Hiding the Default BitLocker Drive Encryption Item in Control Panel](hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md) -### [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) -#### [How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md) -#### [How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md) -#### [How to Deploy the MBAM Client by Using a Command Line](how-to-deploy-the-mbam-client-by-using-a-command-line.md) -### [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md) -### [Upgrading to MBAM 2.5 SP1 from MBAM 2.5](upgrading-to-mbam-25-sp1-from-mbam-25.md) -### [Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md) -### [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md) -## [Operations for MBAM 2.5](operations-for-mbam-25.md) -### [Administering MBAM 2.5 Features](administering-mbam-25-features.md) -#### [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md) -#### [Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) -### [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) -#### [Viewing MBAM 2.5 Reports for the Stand-alone Topology](viewing-mbam-25-reports-for-the-stand-alone-topology.md) -##### [Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md) -##### [Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md) -#### [Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md) -### [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) -#### [How to Use the Administration and Monitoring Website](how-to-use-the-administration-and-monitoring-website.md) -##### [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-25.md) -##### [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-25.md) -##### [How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-25.md) -##### [How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-25.md) -##### [How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md) -#### [How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md) -### [Maintaining MBAM 2.5](maintaining-mbam-25.md) -#### [Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md) -##### [How to Move the MBAM 2.5 Databases](how-to-move-the-mbam-25-databases.md) -##### [How to Move the MBAM 2.5 Reports](how-to-move-the-mbam-25-reports.md) -##### [How to Move the MBAM 2.5 Websites](how-to-move-the-mbam-25-websites.md) -#### [Monitoring Web Service Request Performance Counters](monitoring-web-service-request-performance-counters.md) -### [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) -## [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) -### [Upgrade from MBAM 2.5 to MBAM 2.5 SP1](upgrade-mbam2.5-sp1.md) -### [Troubleshooting MBAM 2.5 installation problems](troubleshooting-mbam-installation.md) -### [Deploying MBAM 2.5 in a stand-alone configuration](deploy-mbam.md) -## [Applying hotfixes on MBAM 2.5 SP1](apply-hotfix-for-mbam-25-sp1.md) -## [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) -### [Client Event Logs](client-event-logs.md) -### [Server Event Logs](server-event-logs.md) -### [Determining why a Device Receives a Noncompliance Message](determining-why-a-device-receives-a-noncompliance-message.md) - diff --git a/mdop/mbam-v25/about-mbam-25-sp1.md b/mdop/mbam-v25/about-mbam-25-sp1.md deleted file mode 100644 index e9fefc297b..0000000000 --- a/mdop/mbam-v25/about-mbam-25-sp1.md +++ /dev/null @@ -1,253 +0,0 @@ ---- -title: About MBAM 2.5 SP1 -description: About MBAM 2.5 SP1 -author: dansimp -ms.assetid: 6f12e605-44e6-4646-9c20-aee89c8ff0b7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 09/27/2016 ---- - - -# About MBAM 2.5 SP1 - - -MBAM 2.5 SP1 provides a simplified administrative interface for BitLocker Drive Encryption. BitLocker offers enhanced protection against data theft or data exposure for computers that are lost or stolen. BitLocker encrypts all data that is stored on the Windows operating system and drives and configured data drives. - -## Overview of MBAM - - -MBAM 2.5 SP1 has the following features: - -- Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. - -- Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. - -- Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. - -- Reduces the workload on the Help Desk to assist end users with BitLocker PIN and recovery key requests. - -- Enables end users to recover encrypted devices independently by using the Self-Service Portal. - -- Enables security officers to easily audit access to recover key information. - -- Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. - -MBAM enforces the BitLocker encryption policy options that you set for your enterprise, monitors the compliance of client computers with those policies, and reports on the encryption status of the enterprise’s and individual’s computers. In addition, MBAM lets you access the recovery key information when users forget their PIN or password, or when their BIOS or boot records change. - -The following groups might be interested in using MBAM to manage BitLocker: - -- Administrators, IT security professionals, and compliance officers who are responsible for ensuring that confidential data is not disclosed without authorization - -- Administrators who are responsible for computer security in remote or branch offices - -- Administrators who are responsible for client computers that are running Windows - -**Note**   -BitLocker is not explained in detail in this MBAM documentation. For more information, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013). - - - -## What’s new in MBAM 2.5 SP1 - - -This section describes the new features in MBAM 2.5 SP1. - -### Newly Supported Languages for the MBAM 2.5 SP1 Client - -The following additional languages are now supported in MBAM 2.5 SP1 for the MBAM Client only, including the Self-Service Portal: - -Czech (Czech Republic) cs-CZ - -Danish (Denmark) da-DK - -Dutch (Netherlands) nl-NL - -Finnish (Finland) fi-FI - -Greek (Greece) el-GR - -Hungarian (Hungary) hu-HU - -Norwegian, Bokmål (Norway) nb-NO - -Polish (Poland) pl-PL - -Portuguese (Portugal) pt-PT - -Slovak (Slovakia) sk-SK - -Slovenian (Slovenia) sl-SI - -Swedish (Sweden) sv-SE - -Turkish (Turkey) tr-TR - -For a list of all languages supported for client and server in MBAM 2.5 and MBAM 2.5 SP1, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -### Support for Windows 10 - -MBAM 2.5 SP1 adds support for Windows 10 and Windows Server 2016, in addition to the same software that is supported in earlier versions of MBAM. - -Windows 10 is supported in both MBAM 2.5 and MBAM 2.5 SP1. - -### Support for Microsoft SQL Server 2014 SP1 - -MBAM 2.5 SP1 adds support for Microsoft SQL Server 2014 SP1, in addition to the same software that is supported in earlier versions of MBAM. - -### MBAM no longer ships with separate MSI - -Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product. - -### MBAM can escrow OwnerAuth passwords without owning the TPM - -Previously, if MBAM did not own the TPM, the TPM OwnerAuth could not be escrowed to the MBAM database. To configure MBAM to own the TPM and to store the passwords, you had to disable TPM auto-provisioning and clear the TPM on the client computer. - -In Windows 8 and higher, MBAM 2.5 SP1 can now escrow the OwnerAuth passwords without owning the TPM. During service startup, MBAM queries to see if the TPM is already owned and if so, it requests the passwords from the operating system. The passwords are then escrowed to the MBAM database. In addition, Group Policy must be set to prevent the OwnerAuth from being deleted locally. - -In Windows 7, MBAM must own the TPM to automatically escrow TPM OwnerAuth information in the MBAM database. If MBAM does not own the TPM and Active Directory (AD) backup of the TPM is configured through Group Policy, you must use the **MBAM Active Directory (AD) Data Import cmdlets** to copy TPM OwnerAuth from AD into the MBAM database. These are five new PowerShell cmdlets that pre-populate MBAM databases with the Volume recovery and TPM owner information stored in Active Directory. - -For more information, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-tpm). - -### MBAM can automatically unlock the TPM after a lockout - -On computers running TPM 1.2, you can now configure MBAM to automatically unlock the TPM in case of a lockout. If the TPM lockout auto reset feature is enabled, MBAM can detect that a user is locked out and then get the OwnerAuth password from the MBAM database to automatically unlock the TPM for the user. - -This feature must be enabled on both the server side and in Group Policy on the client side. For more information, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-autounlock). - -### Support for FIPS-compliant BitLocker numerical password protectors - -In MBAM 2.5, support was added for Federal Information Processing Standard (FIPS)-compliant BitLocker recovery keys on devices running the Windows 8.1 operating system. However, Windows did not implement FIPS-compliant recovery keys in Windows 7. Therefore, Windows 7 and Windows 8 devices still required a Data Recovery Agent (DRA) protector for recovery. - -The Windows team has backported FIPS-compliant recovery keys with a hotfix, and MBAM 2.5 SP1 has added support for them as well. - -**Note**   -Client computers that are running the Windows 8 operating system still require a DRA protector since the hotfix was not backported to that OS. See [Hotfix Package 2 for BitLocker Administration and Monitoring 2.5](https://support.microsoft.com/kb/3015477) to download and install the BitLocker hotfix for Windows 7 and Windows 8 computers. For information about DRA, see [Using Data Recovery Agents with BitLocker](https://go.microsoft.com/fwlink/?LinkId=393557). - - - -To enable FIPS compliance in your organization, you must configure the Federal Information Processing Standard (FIPS) Group Policy settings. For configuration instructions, see [BitLocker Group Policy Settings](https://go.microsoft.com/fwlink/?LinkId=393560). - -### Customize pre-boot recovery message and URL with new Group Policy setting - -A new Group Policy setting, **Configure pre-boot recovery message and URL**, lets you configure a custom recovery message or specify a URL that is then displayed on the pre-boot BitLocker recovery screen when the OS drive is locked. This setting is only available on client computers running Windows 10. - -If you enable this policy setting, you can you can select one of these options for the pre-boot recovery message: - -- **Use custom recovery message**: Select this option to include a custom message in the pre-boot BitLocker recovery screen. - -- **Use custom recovery URL**: Select this option to replace the default URL that is displayed in the pre-boot BitLocker recovery screen. - -- **Use default recovery message and URL**: Select this option to display the default BitLocker recovery message and URL in the pre-boot BitLocker recovery screen. If you previously configured a custom recovery message or URL and want to revert to the default message, you must enable this policy and select this option. - -The new Group Policy setting is located in the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Operating System Drive**. For more information, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md). - -### MBAM added support for Used Space Encryption - -In MBAM 2.5 SP1, if you enable Used Space Encryption via BitLocker Group Policy, the MBAM Client honors it. - -This Group Policy setting is called **Enforce drive encryption type on operating system drives** and is located in the following GPO node: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives**. If you enable this policy and select the encryption type as **Used Space Only encryption**, MBAM will honor the policy and BitLocker will only encrypt disk space that is used on the volume. - -For more information, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md). - -### MBAM Client support for Encrypted Hard Drives - -MBAM supports BitLocker on Encrypted Hard Drives that meet TCG specification requirements for Opal as well as IEEE 1667 standards. When BitLocker is enabled on these devices, it will generate keys and perform management functions on the encrypted drive. See [Encrypted Hard Drive](https://technet.microsoft.com/library/hh831627.aspx) for more information. - -### Delegation configuration no longer required when registering SPNs - -The requirement to configure constrained delegation for SPNs that you register for the application pool account is no longer necessary in MBAM 2.5 SP1. However, it is still a requirement for MBAM 2.5. - -### Enable BitLocker using MBAM as Part of a Windows Deployment - -In MBAM 2.5 SP1, you can use a PowerShell script to configure BitLocker drive encryption and escrow recovery keys to the MBAM Server. - -For more information, see [How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md) - -### Self-Service Portal can be customized by using either PowerShell or the SSP customization wizard - -As of MBAM 2.5 SP1, the Self-Service Portal can be configured by using the customization wizard as well as by using PowerShell. See [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md). - -### Web browser no longer unintentionally runs as administrator - -An issue in MBAM 2.5 caused help links in the Server Configuration tool to cause browser windows to open with administrator rights. This issue is fixed in MBAM 2.5 SP1. - -### No longer need to download the JavaScript files to configure the Self-Service Portal when the CDN is inaccessible - -In MBAM 2.5 and earlier, the jQuery files used for configuration of the Self-Service Portal had to be downloaded from the CDN in advance if clients accessing the Self-Service Portal did not have internet access. In MBAM 2.5 SP1, all JavaScript files are included in the product, so downloading them is unnecessary. - -### Reports can be opened in Report Builder 3.0 - -In MBAM 2.5 SP1, the reports have been updated to the latest report definition language schema, allowing users to open and customize the reports in Report Builder 3.0 and save them immediately without corrupting the report file. - -### New PowerShell cmdlets - -New PowerShell cmdlets for MBAM 2.5 SP1 enable you to configure and manage different MBAM features, including databases, reports, and web applications. Each feature has a corresponding PowerShell cmdlet that you can use to enable or disable features, or to get information about the feature. - -The following cmdlets have been implemented for MBAM 2.5 SP1: - -- Write-MbamTpmInformation - -- Write-MbamRecoveryInformation - -- Read-ADTpmInformation - -- Read-ADRecoveryInformation - -- Write-MbamComputerUser - -The following parameters have been implemented in the Enable-MbamWebApplication and Test-MbamWebApplication cmdlets for MBAM 2.5 SP1: - -- DataMigrationAccessGroup - -- TpmAutoUnlock - -For information about the cmdlets, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md) and [Microsoft Bitlocker Administration and Monitoring Cmdlet Help](https://technet.microsoft.com/library/dn720418.aspx). - -### MBAM agent detects presentation mode - -The MBAM agent can detect when the computer is in presentation mode and avoid invoking the MBAM UI at that time. - -### MBAM agent service now configured to use delayed start - -After installation, the service will now set the MBAM agent service to use delayed start, decreasing the amount of time it takes to start Windows. - -### Locked Fixed Data volumes now report as Compliant - -The compliance calculation logic for "Locked Fixed Data" volumes has been changed to report the volumes as "Compliant," but with a Protector State and Encryption State of "Unknown" and with a Compliance Status Detail of "Volume is locked". Previously, locked volumes were reported as “Non-Compliant”, a Protector State of "Encrypted", an Encryption State of "Unknown", and a Compliance Status Detail of "An unknown error". - - -## How to Get MDOP Technologies - - -MBAM is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of the Microsoft Software Assurance program. For more information about the Microsoft Software Assurance program and how to acquire the MDOP, see [How Do I Get MDOP?](https://go.microsoft.com/fwlink/?LinkId=322049). - -## MBAM 2.5 SP1 Release Notes - - -For more information and late-breaking news that is not included in this documentation, see [Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md). - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -## Related topics - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - - - - - - - - diff --git a/mdop/mbam-v25/about-mbam-25.md b/mdop/mbam-v25/about-mbam-25.md deleted file mode 100644 index 7afb0c3d9f..0000000000 --- a/mdop/mbam-v25/about-mbam-25.md +++ /dev/null @@ -1,378 +0,0 @@ ---- -title: About MBAM 2.5 -description: About MBAM 2.5 -author: dansimp -ms.assetid: 1ce218ec-4d2e-4a75-8d1a-68d737a8f3c9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# About MBAM 2.5 - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides a simplified administrative interface for BitLocker Drive Encryption. BitLocker offers enhanced protection against data theft or data exposure for computers that are lost or stolen. BitLocker encrypts all data that is stored on the Windows operating system volumes and drives and configured data drives. - -## Overview of MBAM - - -MBAM 2.5 has the following features: - -- Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. - -- Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. - -- Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. - -- Reduces the workload on the Help Desk to assist end users with BitLocker PIN and recovery key requests. - -- Enables end users to recover encrypted devices independently by using the Self-Service Portal. - -- Enables security officers to easily audit access to recover key information. - -- Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. - -MBAM enforces the BitLocker encryption policy options that you set for your enterprise, monitors the compliance of client computers with those policies, and reports on the encryption status of the enterprise’s and individual’s computers. In addition, MBAM lets you access the recovery key information when users forget their PIN or password, or when their BIOS or boot records change. - -The following groups might be interested in using MBAM to manage BitLocker: - -- Administrators, IT security professionals, and compliance officers who are responsible for ensuring that confidential data is not disclosed without authorization - -- Administrators who are responsible for computer security in remote or branch offices - -- Administrators who are responsible for client computers that are running Windows - -**Note**   -BitLocker is not explained in detail in this MBAM documentation. For more information, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013). - - - -## What’s new in MBAM 2.5 - - -This section describes the new features in MBAM 2.5. - -### Support for Microsoft SQL Server 2014 - -MBAM adds support for Microsoft SQL Server 2014, in addition to the same software that is supported in earlier versions of MBAM. - -### MBAM Group Policy Templates downloaded separately - -The MBAM Group Policy Templates must be downloaded separately from the MBAM installation. In previous versions of MBAM, the MBAM installer included an MBAM Policy Template, which contained the required MBAM-specific Group Policy Objects (GPOs) that define MBAM implementation settings for BitLocker Drive Encryption. These GPOs have been removed from the MBAM installer. You now download the GPOs from [How to Get MDOP Group Policy (.admx) Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941) and copy them to a server or workstation before you begin the MBAM Client installation. You can copy the Group Policy Templates to any server or workstation that is running a supported version of the Windows Server or Windows operating system. - -**Important**   -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the BitLocker Drive Encryption settings for you. - - - -The template files that you need to copy to a server or workstation are: - -- BitLockerManagement.adml - -- BitLockerManagement.admx - -- BitLockerUserManagement.adml - -- BitLockerUserManagement.admx - -Copy the template files to the location that best meets your needs. For the language-specific files, which must be copied to a language-specific folder, the Group Policy Management Console is required to view the files. - -- To install the template files locally on a server or workstation, copy the files to one of the following locations. - - - - - - - - - - - - - - - - - - - - - - -
    File typeFile location

    language neutral (.admx)

    %systemroot%\policyDefinitions

    language specific (.adml)

    %systemroot%\policyDefinitions[MUIculture] (for example, the U.S. English language specific file will be stored in %systemroot%</em>policyDefinitions\en-us)

    - - - -- To make the templates available to all Group Policy administrators in a domain, copy the files to one of the following locations on a domain controller. - - - - - - - - - - - - - - - - - - - - - - -
    File typeDomain controller file location

    Language neutral (.admx)

    %systemroot%sysvol\domain\policies\PolicyDefinitions

    Language specific (.adml)

    %systemroot%\sysvol\domain\policies\PolicyDefinitions[MUIculture] (for example, the U.S. English language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us)

    - - - -For more information about template files, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/?LinkId=392818). - -### Ability to enforce encryption policies on operating system and fixed data drives - -MBAM 2.5 enables you to enforce encryption policies on operating system and fixed data drives for computers in your organization and limit the number of days that end users can request a postponement of the requirement to comply with MBAM encryption policies. - -To enable you to configure encryption policy enforcement, a new Group Policy setting, called Encryption Policy Enforcement Settings, has been added for operating system drives and fixed data drives. This policy is described in the following table. - - ----- - - - - - - - - - - - - - - - - - - - -
    Group Policy settingDescriptionGroup Policy node used to configure this setting

    Encryption Policy Enforcement Settings (Operating System Drive)

    For this setting, use the option Configure the number of noncompliance grace period days for operating system drives to configure a grace period.

    -

    The grace period specifies the number of days that end users can postpone compliance with MBAM policies for their operating system drive after the drive is first detected as noncompliant.

    -

    After the configured grace period expires, users cannot postpone the required action or request an exemption from it.

    -

    If user interaction is required (for example, if you are using the Trusted Platform Module (TPM) + PIN or using a password protector), a dialog box appears, and users cannot close it until they provide the required information. If the protector is TPM only, encryption begins immediately in the background without user input.

    -

    Users cannot request exemptions through the BitLocker encryption wizard. Instead, they must contact their Help Desk or use whatever process their organization uses for exemption requests.

    Computer Configuration > Policies > Administrative Templates > Windows Components > MDOP MBAM (BitLocker Management) > Operating System Drive

    Encryption Policy Enforcement Settings (Fixed Data Drives)

    For this setting, use the option Configure the number of noncompliance grace period days for fixed drives to configure a grace period.

    -

    The grace period specifies the number of days that end users can postpone compliance with MBAM policies for their fixed drive after the drive is first detected as noncompliant.

    -

    The grace period begins when the fixed drive is determined to be noncompliant. If you are using auto-unlock, the policy will not be enforced until the operating system drive is compliant. However, if you are not using auto-unlock, encryption of the fixed data drive can begin before the operating system drive is fully encrypted.

    -

    After the configured grace period expires, users cannot postpone the required action or request an exemption from it. If user interaction is required, a dialog box appears and users cannot close it until they provide the required information.

    Computer Configuration > Policies > Administrative Templates > Windows Components > MDOP MBAM (BitLocker Management) > Fixed Drive

    - - - -### Ability to provide a URL in the BitLocker Drive Encryption wizard to point to your security policy - -A new Group Policy setting, **Provide the URL for the Security Policy link**, enables you to configure a URL that will be presented to end users as a link called **Company Security Policy**. This link will appear when MBAM prompts users to encrypt a volume. - -If you enable this policy setting, you can configure the URL for the **Company Security Policy** link. If you disable or do not configure this policy setting, the **Company Security Policy** link is not displayed to users. - -The new Group Policy setting is located in the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management) > Client Management**. - -### Support for FIPS-compliant recovery keys - -MBAM 2.5 supports Federal Information Processing Standard (FIPS)-compliant BitLocker recovery keys on devices that are running the Windows 8.1 operating system. The recovery key was not FIPS compliant in earlier versions of Windows. This enhancement improves the drive recovery process in organizations that require FIPS compliance because it enables end users to use the Self-Service Portal or Administration and Monitoring Website (Help Desk) to recover their drives if they forget their PIN or password or get locked out of their computers. The new FIPS compliance feature does not extend to password protectors. - -To enable FIPS compliance in your organization, you must configure the Federal Information Processing Standard (FIPS) Group Policy settings. For configuration instructions, see [BitLocker Group Policy Settings](https://go.microsoft.com/fwlink/?LinkId=393560). - -For client computers that are running the Windows 8 or Windows 7 operating systems without the [installed BitLocker hotfix](https://support.microsoft.com/kb/3015477), IT administrators will continue to use the Data Recovery Agents (DRA) protector in FIPS-compliant environments. For information about DRA, see [Using Data Recovery Agents with BitLocker](https://go.microsoft.com/fwlink/?LinkId=393557). - -See [Hotfix Package 2 for BitLocker Administration and Monitoring 2.5](https://support.microsoft.com/kb/3015477) to download and install the BitLocker hotfix for Windows 7 and Windows 8 computers. - -### Support for high availability deployments - -MBAM supports the following high-availability scenarios in addition to the standard two-server and Configuration Manager Integration topologies: - -- SQL Server AlwaysOn availability groups - -- SQL Server clustering - -- Network load balancing (NLB) - -- SQL Server mirroring - -- Volume Shadow Copy Service (VSS) Backup - -For more information about these features, see [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md). - -### Management of roles for Administration and Monitoring Website changed - -In MBAM 2.5, you must create security groups in Active Directory Domain Services (AD DS) to manage the roles that provide access rights to the Administration and Monitoring Website. Roles enable users who are in specific security groups to perform different tasks in the website such as viewing reports or helping end users recover encrypted drives. In previous versions of MBAM, roles were managed by using local groups. - -In MBAM 2.5, the term “roles” replaces the term “administrator roles,” which was used in earlier versions of MBAM. In addition, in MBAM 2.5 the “MBAM System Administrators” role has been removed. - -The following table lists the security groups that you must create in AD DS. You can use any name for the security groups. - - ---- - - - - - - - - - - - - - - - - - - - - -
    RoleAccess rights for this role on the Administration and Monitoring Website

    MBAM Helpdesk Users

    Provides access to the Manage TPM and Drive Recovery areas of the MBAM Administration and Monitoring Website. Users who have access to these areas must fill in all fields when they use either area.

    MBAM Report Users

    Provides access to the Reports in the Administration and Monitoring Website.

    MBAM Advanced Helpdesk Users

    Provides access to all areas in the Administration and Monitoring Website. Users in this group have to enter only the recovery key, not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users group permissions.

    - - - -After you create the security groups in AD DS, assign users and/or groups to the appropriate security group to enable the corresponding level of access to the Administration and Monitoring Website. To enable individuals with each role to access the Administration and Monitoring Website, you must also specify each security group when you are configuring the Administration and Monitoring Website. - -### Windows PowerShell cmdlets for configuring MBAM Server features - -Windows PowerShell cmdlets for MBAM 2.5 enable you to configure and manage the MBAM Server features. Each feature has a corresponding Windows PowerShell cmdlet that you can use to enable or disable features, or to get information about the feature. - -For prerequisites and prerequisites for using Windows PowerShell, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md). - -**To load the MBAM 2.5 Help for Windows PowerShell cmdlets after installing the MBAM Server software** - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type **Update-Help –Module Microsoft.MBAM**. - -Windows PowerShell Help for MBAM is available in the following formats: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows PowerShell Help formatMore information

    At a Windows PowerShell command prompt, type Get-Help <cmdlet>

    To upload the latest Windows PowerShell cmdlets, follow the instructions in the previous section on how to load Windows PowerShell Help for MBAM.

    On TechNet as webpages

    https://go.microsoft.com/fwlink/?LinkId=393498

    On the Download Center as a Word .docx file

    https://go.microsoft.com/fwlink/?LinkId=393497

    On the Download Center as a .pdf file

    https://go.microsoft.com/fwlink/?LinkId=393499

    - - - -### Support for ASCII-only and enhanced PINs and ability to prevent sequential and repeating characters - -**Allow enhanced PINs for startup Group Policy setting** - -The Group Policy setting, **Allow enhanced PINs for startup**, enables you to configure whether enhanced startup PINs are used with BitLocker. Enhanced startup PINs permit users to enter any keys on a full keyboard, including uppercase and lowercase letters, symbols, numbers, and spaces. If you enable this policy setting, all new BitLocker startup PINs that are set will be enhanced PINs. If you disable or do not configure this policy setting, enhanced PINs cannot be used. - -Not all computers support the entry of enhanced PINs in the Pre-Boot Execution Environment (PXE). Before you enable this Group Policy setting for your organization, run a system check during the BitLocker setup process to ensure that the computer’s BIOS supports the use of the full keyboard in PXE. For more information, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md). - -**Require ASCII-only PINs check box** - -The **Allow enhanced PINs for startup** Group Policy setting also contains a **Require ASCII-only PINs** check box. If the computers in your organization do not support the use of the full keyboard in PXE, you can enable the **Allow enhanced PINs for startup** Group Policy setting, and then select the **Require ASCII-only PINs** check box to require that enhanced PINs use only printable ASCII characters. - -**Enforced use of nonsequential and nonrepeating characters** - -MBAM 2.5 prevents end users from creating PINs that consist of repeating numbers (such as 1111) or sequential numbers (such as 1234). If end users try to enter a password that contains three or more repeating or sequential numbers, the Bitlocker Drive Encryption wizard displays an error message and prevents users from entering a PIN with the prohibited characters. - -### Addition of DRA Certificate to BitLocker Computer Compliance report - -A new protector type, the Data Recovery Agent (DRA) Certificate, has been added to the BitLocker Computer Compliance Report in Configuration Manager. This protector type applies to operating system drives, and it appears in the **Computer Volume(s)** section in the **Protector Types** column. - -### Support for multi-forest support deployments - -MBAM 2.5 supports the following types of multi-forest deployments: - -- Single forest with single domain - -- Single forest with a single tree and multiple domains - -- Single forest with multiple trees and disjoint namespaces - -- Multiple forests in a central forest topology - -- Multiple forests in a resource forest topology - -There is no support for forest migration (going from single to multiple, multiple to single, resource to across the forest, etc.), or upgrade or downgrade. - -The prerequisites for deploying MBAM in multi-forest deployments are: - -- Forest must be running on supported versions of Windows Server. - -- A two-way or one-way trust is required. One-way trusts require that the server’s domain trusts the client’s domain. In other words, the server’s domain is pointed at the client’s domain. - -### MBAM Client support for Encrypted Hard Drives - -MBAM supports BitLocker on Encrypted Hard Drives that meet TCG specification requirements for Opal as well as IEEE 1667 standards. When BitLocker is enabled on these devices, it will generate keys and perform management functions on the encrypted drive. See [Encrypted Hard Drive](https://technet.microsoft.com/library/hh831627.aspx) for more information. - -## How to Get MDOP Technologies - - -MBAM is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of the Microsoft Software Assurance program. For more information about the Microsoft Software Assurance program and how to acquire the MDOP, see [How Do I Get MDOP?](https://go.microsoft.com/fwlink/?LinkId=322049). - -## MBAM 2.5 Release Notes - - -For more information and late-breaking news that is not included in this documentation, see [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md). - -## Got a suggestion for MBAM? -- Send your feedback [here](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -## Related topics - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - - - - - - - - diff --git a/mdop/mbam-v25/accessibility-for-mbam-25.md b/mdop/mbam-v25/accessibility-for-mbam-25.md deleted file mode 100644 index 5618291576..0000000000 --- a/mdop/mbam-v25/accessibility-for-mbam-25.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Accessibility for MBAM 2.5 -description: Accessibility for MBAM 2.5 -author: dansimp -ms.assetid: 03b343a6-9e8e-4868-a52b-cedf0b696d56 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for MBAM 2.5 - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -## Documentation in alternative formats - - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.). Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.

    - - - -## Customer service for people with hearing impairments - - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time the service is used. - -## For more information - - -For more information about how accessible technology for computers helps to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/?linkid=8431). - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -## Related topics - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - - - - - - - - diff --git a/mdop/mbam-v25/administering-mbam-25-features.md b/mdop/mbam-v25/administering-mbam-25-features.md deleted file mode 100644 index ba93616f8c..0000000000 --- a/mdop/mbam-v25/administering-mbam-25-features.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Administering MBAM 2.5 Features -description: Administering MBAM 2.5 Features -author: dansimp -ms.assetid: ca15f818-cf07-4437-8ffa-425af603a3c8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering MBAM 2.5 Features - - -After completing all necessary planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use it to manage BitLocker encryption across the enterprise The information in this section describes post-installation day-to-day Microsoft BitLocker Administration and Monitoring feature operations tasks. - -## Manage BitLocker Encryption Exemptions - - -MBAM lets you grant encryption exemptions to specific users who do not need or want their drives encrypted. Computer exemption is typically used when a company has computers that do not have to be encrypted, such as computers that are used in development or testing, or older computers that do not support BitLocker. In some cases, local law may also require that certain computers are not encrypted. - -[How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md) - -## Understand the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel - - -MBAM provides a custom control panel, called BitLocker Encryption Options, that appears under **System and Security**. The MBAM control panel can be used to unlock encrypted fixed and removable drives, and also manage your PIN or password. - -**Note**   -This customized control panel does not replace the default Windows BitLocker control panel. - - - -[Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) - -## Other Resources for Administering MBAM Features - - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md deleted file mode 100644 index cd77d39b06..0000000000 --- a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -title: Applying hotfixes on MBAM 2.5 SP1 -description: Applying hotfixes on MBAM 2.5 SP1 -ms.author: ppriya-msft -author: dansimp -ms.assetid: -ms.reviewer: -manager: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 8/30/2018 -ms.author: pashort -author: shortpatti ---- - -# Applying hotfixes on MBAM 2.5 SP1 -This topic describes the process for applying the hotfixes for Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1 - -### Before you begin, download the latest hotfix of Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1 -[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=57157) - -> [!NOTE] -> For more information about the hotfix releases, see the [MBAM version chart](https://docs.microsoft.com/archive/blogs/dubaisec/mbam-version-chart). - -#### Steps to update the MBAM Server for existing MBAM environment -1. Remove MBAM server feature (do this by opening the MBAM Server Configuration Tool, then selecting Remove Features). -2. Remove MDOP MBAM from Control Panel | Programs and Features. -3. Install MBAM 2.5 SP1 RTM server components. -4. Install lastest MBAM 2.5 SP1 hotfix rollup. -5. Configure MBAM features using MBAM Server Configurator. - -#### Steps to install the new MBAM 2.5 SP1 server hotfix -Refer to the document for [new server installation](deploying-the-mbam-25-server-infrastructure.md). diff --git a/mdop/mbam-v25/client-event-logs.md b/mdop/mbam-v25/client-event-logs.md deleted file mode 100644 index 747ad55211..0000000000 --- a/mdop/mbam-v25/client-event-logs.md +++ /dev/null @@ -1,275 +0,0 @@ ---- -title: Client Event Logs -description: Client Event Logs -author: dansimp -ms.assetid: d5c2f270-db6a-45f1-8557-8c6fb28fd568 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Event Logs - -MBAM Client event logs are located in Event Viewer – Applications and Services Logs – Microsoft – Windows – MBAM - Operational path. -The following table contains event IDs that can occur on the MBAM Client. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Event IDChannelEvent symbolMessage

    1

    Operational

    VolumeEnactmentSuccessful

    The MBAM policies were applied successfully.

    2

    Admin

    VolumeEnactmentFailed

    An error occurred while applying MBAM policies.

    3

    Operational

    TransferStatusDataSuccessful

    The encryption status data was sent successfully.

    4

    Admin

    TransferStatusDataFailed

    An error occurred while sending encryption status data.

    8

    Admin

    SystemVolumeNotFound

    The system volume is missing. SystemVolume is needed to encrypt the operating system drive.

    9

    Admin

    TPMNotFound

    The TPM hardware is missing. TPM is needed to encrypt the operating system drive with any TPM protector.

    10

    Admin

    MachineHWExempted

    The computer is exempted from Encryption. Machine’s hardware status: Exempted

    11

    Admin

    MachineHWUnknown

    The computer is exempted from encryption. Machine’s hardware status: Unknown

    12

    Admin

    HWCheckFailed

    Hardware exemption check failed.

    13

    Admin

    UserIsExempted

    The user is exempt from encryption.

    14

    Admin

    UserIsWaiting

    The user requested an exemption.

    15

    Admin

    UserExemptionCheckFailed

    User exemption check failed.

    16

    Admin

    UserPostponed

    The user postponed the encryption process.

    17

    Admin

    TPMInitializationFailed

    TPM initialization failed. The user rejected the BIOS changes.

    18

    Admin

    CoreServiceDown

    Unable to connect to the MBAM Recovery and Hardware service.

    19

    Operational

    CoreServiceUp

    Successfully connected to the MBAM Recovery and Hardware service.

    20

    Admin

    PolicyMismatch

    The MBAM policy is in conflict or corrupt.

    21

    Admin

    ConflictingOSVolumePolicies

    Detected OS volume encryption policies conflict. Check BitLocker and MBAM policies related to OS drive protectors.

    22

    Admin

    ConflictingFDDVolumePolicies

    Detected Fixed Data Drive volume encryption policies conflict. Check BitLocker and MBAM policies related to FDD drive protectors.

    27

    Admin

    EncryptionFailedNoDra

    An error occurred while encrypting. A Data Recovery Agent (DRA) protector is required in FIPS mode for pre-Windows 8.1 machines.

    28

    Operational

    TpmOwnerAuthEscrowed

    The TPM OwnerAuth has been escrowed.

    29

    Operational

    RecoveryKeyEscrowed

    The BitLocker recovery key for the volume has been escrowed.

    30

    Operational

    RecoveryKeyReset

    The BitLocker recovery key for the volume has been updated.

    31

    Operational

    EnforcePolicyDateSet

    The enforce policy date, <date>, has been set for the volume

    32

    Operational

    EnforcePolicyDateCleared

    The enforce policy date, <date>, has been cleared for the volume.

    33

    Operational

    TpmLockOutResetSucceeded

    Successfully reset TPM lockout.

    34

    Admin

    TpmLockOutResetFailed

    Failed to reset TPM lockout.

    35

    Operational

    TpmOwnerAuthRetrievalSucceeded

    Successfully retrieved TPM OwnerAuth from MBAM services.

    36

    Admin

    TpmOwnerAuthRetrievalFailed

    Failed to retrieve TPM OwnerAuth from MBAM services.

    37

    Admin

    WmiProviderDllSearchPathUpdateFailed

    Failed to update the DLL search path for WMI provider.

    38

    Admin

    TimedOutWaitingForWmiProvider

    Agent Stopping - Timed-out waiting for MBAM WMI Provider Instance.

    39

    Operational

    RemovableDriveMounted

    Removable drive was mounted.

    40

    Operational

    RemovableDriveDismounted

    Removable drive was unmounted.

    41

    Operational

    FailedToEnactEndpointUnreachable

    Failure to connect to the MBAM Recovery and Hardware service prevented MBAM policies from being applied successfully to the volume.

    42

    Operational

    FailedToEnactLockedVolume

    Locked volume state prevented MBAM policies from being applied successfully to the volume.

    43

    Operational

    TransferStatusDataFailedEndpointUnreachable

    Failure to connect to the MBAM Compliance and Status service prevented the transfer of encryption status data.

    - -  - - -## Related topics -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Server Event Logs](server-event-logs.md) - -  - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md b/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md deleted file mode 100644 index 3e68d38e01..0000000000 --- a/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md +++ /dev/null @@ -1,376 +0,0 @@ ---- -title: Configuring MBAM 2.5 Server Features by Using Windows PowerShell -description: Configuring MBAM 2.5 Server Features by Using Windows PowerShell -author: dansimp -ms.assetid: 826429fd-29bb-44be-b47e-5f5c7d20dd1d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring MBAM 2.5 Server Features by Using Windows PowerShell - - -After you install the MBAM 2.5 Server software, you can use configure MBAM 2.5 Server features by using Windows PowerShell cmdlets or the MBAM Server Configuration wizard. This topic describes how to configure MBAM 2.5 by using the Windows PowerShell cmdlets. To use the wizard instead, see [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md). - -## In this topic - - -This topic includes the following information about using Windows PowerShell to configure MBAM: - -- [How to load Windows PowerShell Help for MBAM 2.5](#bkmk-load-posh-help) - -- [How to get Help about an MBAM Windows PowerShell cmdlet](#bkmk-help-specific-cmdlet) - -- [Configurations that you can do only with Windows PowerShell but not with the MBAM Server Configuration wizard](#bkmk-config-only-posh) - -- [Prerequisites and requirements for using Windows PowerShell to configure MBAM Server features](#bkmk-prereqs-posh-mbamsvr) - -- [Using Windows PowerShell to configure MBAM on a remote computer](#bkmk-remote-config) - -- [Required accounts and corresponding Windows PowerShell cmdlet parameters](#bkmk-reqd-posh-accts) - -For information about the **Get-MbamBitLockerRecoveryKey** and **Get-MbamTPMOwnerPassword** Windows PowerShell cmdlets, which are used to administer MBAM, see [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md). - -## How to load Windows PowerShell Help for MBAM 2.5 - - -For a list of the Windows PowerShell cmdlets on TechNet, see [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://go.microsoft.com/fwlink/?LinkId=392816). - -**To load the MBAM 2.5 Help for Windows PowerShell cmdlets after installing the MBAM Server software** - -1. Open Windows PowerShell or Windows PowerShell Integrated Scripting Environment (ISE). - -2. Type **Update-Help –Module Microsoft.MBAM**. - -## How to get Help about an MBAM Windows PowerShell cmdlet - - -Windows PowerShell Help for MBAM is available in the following formats: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows PowerShell Help formatMore information

    At a Windows PowerShell command prompt, type Get-Help <cmdlet>

    To upload the latest Windows PowerShell cmdlets, follow the instructions in the previous section on how to load Windows PowerShell Help for MBAM.

    On TechNet as webpages

    https://go.microsoft.com/fwlink/?LinkId=393498

    On the Download Center as a Word .docx file

    https://go.microsoft.com/fwlink/?LinkId=393497

    On the Download Center as a .pdf file

    https://go.microsoft.com/fwlink/?LinkId=393499

    - - - -## Configurations that you can do only with Windows PowerShell but not with the MBAM Server Configuration wizard - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Configurations that you can do only by using Windows PowerShellDetails

    Install the web services on a separate computer from the web applications.

    Using the wizard, you must install the web services and web applications on the same computer.

    Enable reports on a separate reporting services point without installing all of the Configuration Manager objects.

    Delete all of the objects from Configuration Manager.

    Deleting the objects in turn deletes all of the compliance data from Configuration Manager.

    Enter a custom connection string for the databases.

    Example: To configure the web applications to work with mirroring, you must use the Enable-MbamWebApplication cmdlet to specify the appropriate failover partner syntax in the connection string.

    Skip validation and configure a feature even though the prerequisite check failed.

    - - - -**Note**   -You cannot disable the MBAM databases with a Windows PowerShell cmdlet or the MBAM Server Configuration wizard. To prevent the accidental removal of your compliance and audit data, database administrators must remove databases manually. - - - -## Prerequisites and requirements for using Windows PowerShell to configure MBAM Server features - - -Before starting the configuration, complete the following prerequisites. - -**Account-related prerequisites** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails or additional information

    Create the required accounts.

    See section Required accounts and corresponding Windows PowerShell cmdlet parameters later in this topic.

    User accounts and groups that you pass as parameters to the Windows PowerShell cmdlets must be valid accounts in the domain.

    You cannot use local accounts.

    Specify accounts in the down-level format.

    Examples:

    -

    domainNetBiosName\userdomainNetBiosName\group

    - - - -**Permission-related prerequisites** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails or additional information

    You must be an administrator on the local computer where you are configuring the MBAM feature.

    Use an elevated Windows PowerShell command prompt to run all Windows PowerShell cmdlets.

    For the Enable-MbamDatabase cmdlet only:

    -

    You must have "create any database" permissions on the instance of the target Microsoft SQL Server database.

    -

    This user account must be a part of the local administrators group or the Backup Operators group to register the MBAM Volume Shadow Copy Service (VSS) Writer.

    By default, the database administrator or system administrator has the required "create any database" permissions.

    -

    -

    For more information about VSS Writer, see Volume Shadow Copy Service.

    For the System Center Configuration Manager Integration feature only:

    -

    The user who enables this feature must have these rights in Configuration Manager:

    ---- - - - - - - - - - - - - - - - - - - - - -
    Type of rights in Configuration ManagerRequired rights

    Configuration Manager Site rights:

    - Read

    Configuration Manager Collection rights:

    - Create- Delete- Read- Modify- Deploy Configuration Items

    Configuration Manager Configuration item rights:

    - Create- Delete- Read

    -

     

    -

    - - - -## Using Windows PowerShell to configure MBAM on a remote computer - - - ---- - - - - - - - - - - - - - - - - - - -

    When to use this capability

    When you want to configure the MBAM 2.5 Server features on a remote computer. The Windows PowerShell cmdlets are running on one computer, and you are configuring the features on a different, remote computer.

    What you have to do

    To use Windows PowerShell to configure MBAM 2.5 Server features on a remote computer, you must:

    -
      -
    • Ensure that the MBAM 2.5 Server software has been installed on the remote computer.

    • -
    • Use the Credential Security Support Provider (CredSSP) Protocol to open the Windows PowerShell session.

    • -
    • Enable Windows Remote Management (WinRM). If you fail to enable WinRM and to configure it correctly, the New-PSSession cmdlet that is described in this table displays an error and describes how to fix the issue. For more information about WinRM, see Using Windows Remote Management.

    • -

    Why you have to do it

    This protocol enables the Windows PowerShell cmdlets to connect to Active Directory Domain Services by using the user’s administrative credentials. You might get a validation error if you start the Windows PowerShell session without this protocol.

    How to start a Windows PowerShell session with the CredSSP protocol

    Type the following code at the Windows PowerShell prompt:

    -

    $s = New-PSSession -ComputerName xxx -Authentication Credssp -Credential xxx

    -

    The following code shows an example.

    -

    $session = New-PSSession -ComputerName <MBAM_server_name> -Authentication Credssp -Credential (Get-Credential)

    -

    Enter-PSSession $session

    - - - -## Required accounts and corresponding Windows PowerShell cmdlet parameters - - -The following table describes the accounts that are required to configure MBAM 2.5 Server features. It also lists the corresponding Windows PowerShell cmdlet and parameter for which you have to specify the account during configuration. - -Cmdlet -Parameter -Type (User or Group) -Description -Enable-MBAMDatabase - -AccessAccount - -User or Group - -Specify a domain user or group that has read/write permission to this database to give the web applications access to data and reports in this database. If the value is a domain user, then the **WebServiceApplicationPoolCredential** parameter that is used when running the **Enable-MbamWebApplication** cmdlet must use the same user account. If the value is a domain Users group, then the domain account that is used by the **WebServiceApplicationPoolCredential** parameter must be a member of this group. - -ReportAccount - -User or Group - -Specify a domain user or Users group that has read-only permission to this database to provide the MBAM reports access to the compliance and audit data. If the value is a domain user, then the **ComplianceAndAuditDBCredential** parameter of the **Enable-MbamReport** cmdlet must use the same user account. If the value is a domain Users group, then the domain account that is used by the **ComplianceAndAuditDBCredential** parameter must be a member of this group. - -Enable-MbamReport - -ComplianceAndAuditDBCredential - -User - -Specifies the administrative credential that the local SSRS instance uses to connect to the MBAM Compliance and Audit Database. The domain user in the administrative credential must be the same as the user account that is used for the **ReportAccount** parameter, which is used while running the **Enable-MbamDatabase** cmdlet. If a domain Users group was used with the **ReportAccount** parameter, this account should be a member of that group. - -**Important**   -The account specified in the administrative credentials should have limited user rights for improved security. Also, the password of the account should be set to not expire. - - - -ReportsReadOnlyAccessGroup - -Group - -Specifies the domain user group that has read permissions to the reports. The specified group must be the same group that is used for the **ReportsReadOnlyAccessGroup** parameter in the **Enable-MbamWebApplication** cmdlet. - -Enable-MBAMWebApplication - -AdvancedHelpdeskAccessGroup - -Group - -Specifies the domain Users group that has access to all areas of the Administration and Monitoring Website except the Reports area. - -HelpdeskAccessGroup - -Group - -Specifies the domain Users group that has access to the **Manage TPM** and **Drive Recovery** areas of the Administration and Monitoring Website. - -ReportsReadOnlyAccessGroup - -Group - -Specifies the domain Users group that has read permission to the **Reports** area of the Administration and Monitoring Website. The specified group must be the same group that is used for the **ReportsReadOnlyAccessGroup** parameter in the **Enable-MbamReport** cmdlet. - -WebServiceApplicationPoolCredential - -User - -Specifies the domain user to be used by the application pool for the MBAM web applications. It must be the same domain user account that is specified in the **AccessAccount** parameter of the **Enable-MbamDatabase** cmdlet. If a domain Users group was used by the **AccessAccount** parameter when running the **Enable-MbamDatabase** cmdlet, the domain user that is specified here must be a member of that group. If you do not specify the administrative credentials, the administrative credentials that were specified by any previously enabled web application are used. All of the web applications use the same application pool identity. If it is specified multiple times, the most recently specified value is used. - -**Important**   -For improved security, set the account that is specified in the administrative credentials to limited user rights. Also, set the password of the account to never expire. Ensure that either the built-in IIS\_IUSRS account or the account that is used for the **WebServiceApplicationPoolCredential** parameter has been added to the **Impersonate a client after authentication** local security setting. - -To view the local security setting, open the **Local Security Policy editor**, expand the **Local Policies** node, select the **User Rights Assignment** node, and then double-click the **Impersonate a client after authentication** and **Log on as a batch job** Group Policy settings in the details pane. - - - - - - - - -## Related topics - - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - -[Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/configuring-the-mbam-25-server-features.md b/mdop/mbam-v25/configuring-the-mbam-25-server-features.md deleted file mode 100644 index d5431e95f6..0000000000 --- a/mdop/mbam-v25/configuring-the-mbam-25-server-features.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: Configuring the MBAM 2.5 Server Features -description: Configuring the MBAM 2.5 Server Features -author: dansimp -ms.assetid: 894d1080-5f13-48f7-8fde-82f8d440a4ed -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring the MBAM 2.5 Server Features - - -Use this information as a starting place for configuring Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server features after [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md). There are two methods you can use to configure MBAM: - -- MBAM Server Configuration wizard - -- Windows PowerShell cmdlets - -## Before you start configuring MBAM Server features - - -Review and complete the following steps before you start configuring the MBAM Server features: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepWhere to get instructions

    Review the recommended architecture for MBAM.

    High-Level Architecture for MBAM 2.5

    Review the supported configurations for MBAM.

    MBAM 2.5 Supported Configurations

    Complete the required prerequisites on each server.

    Install the MBAM Server software on each server where you will configure an MBAM Server feature.

    Installing the MBAM 2.5 Server Software

    Review the prerequisites for using Windows PowerShell to configure MBAM Server features (if you are using this method to configure MBAM Server features).

    Configuring MBAM 2.5 Server Features by Using Windows PowerShell

    - - - -## Steps for configuring MBAM Server features - - -Each row in the following table describes the features that you will configure on a separate server, according to the recommended [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Features to installWhere to get instructions

    Configure the databases.

    How to Configure the MBAM 2.5 Databases

    Configure the reports.

    How to Configure the MBAM 2.5 Reports

    Configure the web applications.

    How to Configure the MBAM 2.5 Web Applications

    Configure the System Center Configuration Manager Integration (if applicable).

    How to Configure the MBAM 2.5 System Center Configuration Manager Integration

    - - - -For a list of events about MBAM Server feature configuration, see [Server Event Logs](server-event-logs.md). - - - -## Related topics - - -Configuring the MBAM 2.5 Server Features - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md b/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md deleted file mode 100644 index 166bfb30c5..0000000000 --- a/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: Copying the MBAM 2.5 Group Policy Templates -description: Copying the MBAM 2.5 Group Policy Templates -author: dansimp -ms.assetid: e526ecec-07ff-435e-bc90-3084b617b84b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/28/2017 ---- - - -# Copying the MBAM 2.5 Group Policy Templates - - -Before deploying the MBAM Client installation, you must download the MBAM Group Policy Templates, which contain Group Policy settings that define MBAM implementation settings for BitLocker Drive Encryption. After downloading the templates, you then set the Group Policy settings to implement across your enterprise. - -## Downloading and deploying the MDOP Group Policy templates - - -MDOP Group Policy templates are available for download in a self-extracting, compressed file, grouped by technology and version. - -**How to download and deploy the MDOP Group Policy templates** - -1. Download the MDOP Group Policy templates from [Microsoft Desktop Optimization Pack Group Policy Administrative Templates](https://www.microsoft.com/download/details.aspx?id=55531). - -2. Run the downloaded file to extract the template folders. - - **Warning** - Do not extract the templates directly to the Group Policy deployment directory. Multiple technologies and versions are bundled in this file. - - - -3. In the extracted folder, locate the technology-version .admx file. Certain MDOP technologies have multiple sets of Group Policy Objects (GPOs). For example, MBAM includes MBAM Management settings and MBAM User settings. - -4. Locate the appropriate .adml file by language-culture (that is, *en* for English-United States). - -5. Copy the .admx and .adml files to a policy definition folder. Depending on where you store the templates, you can configure Group Policy settings from the local device or from any computer on the domain. - - **Local files.** To configure Group Policy settings from the local device, copy template files to the following locations: - - - - - - - - - - - - - - - - - - - - - - -
    File typeFile location

    Group Policy template (.admx)

    %systemroot%<strong>policyDefinitions

    Group Policy language file (.adml)

    %systemroot%<strong>policyDefinitions[MUIculture]

    - - - -~~~ -**Domain central store.** To enable Group Policy settings configuration by a Group Policy administrator from any computer on the domain, copy files to the following locations on the domain controller: - - ---- - - - - - - - - - - - - - - - - -
    File typeFile location

    Group Policy template (.admx)

    %systemroot%\sysvol\domain\policies\PolicyDefinitions

    Group Policy language file (.adml)

    %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture]\[MUIculture]

    -

    For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us.

    -~~~ - - - -6. Edit the Group Policy settings using Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) to configure Group Policy settings for the MDOP technology. See [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) for more information. - - For descriptions of the Group Policy settings, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md). - - -## Related topics - - -[Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md b/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md deleted file mode 100644 index efae4b682d..0000000000 --- a/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md +++ /dev/null @@ -1,395 +0,0 @@ ---- -title: Create or Edit the Sms\_def.mof File -description: Create or Edit the Sms\_def.mof File -author: dansimp -ms.assetid: 0bc5e7d8-9747-4da6-a1b3-38d8f27ba121 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create or Edit the Sms\_def.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to create or edit the Sms\_def.mof file. - -If you are using System Center 2012 Configuration Manager, you must create the file. Create the file on the top-tier site. The changes will be replicated to the other sites in your infrastructure. - -In Configuration Manager 2007, the file already exists, so you only have to edit it. **Do not overwrite the existing file.** - -In the following sections, complete the instructions that correspond to the version of Configuration Manager that you are using. - -**To create the Sms\_def.mof file for System Center 2012 Configuration Manager** - -1. On the Configuration Manager Server, browse to the location where you have to create the Sms\_def.mof file, for example, the Desktop. - -2. Create a text file called **Sms\_def.mof** and copy the following code to populate the file with the following Sms\_def.mof MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("BitLocker Encryption Details"), - SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")] - class Win32_BitLockerEncryptionDetails : SMS_Class_Template - { - [ SMS_Report (TRUE), key ] - String DeviceId; - [ SMS_Report (TRUE) ] - String BitlockerPersistentVolumeId; - [ SMS_Report (TRUE) ] - String MbamPersistentVolumeId; - [ SMS_Report (TRUE) ] - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - SInt32 MbamVolumeType; - [ SMS_Report (TRUE) ] - String DriveLetter; - [ SMS_Report (TRUE) ] - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - SInt32 Compliant; - [ SMS_Report (TRUE) ] - SInt32 ReasonsForNonCompliance[]; - [ SMS_Report (TRUE) ] - SInt32 KeyProtectorTypes[]; - [ SMS_Report (TRUE) ] - SInt32 EncryptionMethod; - [ SMS_Report (TRUE) ] - SInt32 ConversionStatus; - [ SMS_Report (TRUE) ] - SInt32 ProtectionStatus; - [ SMS_Report (TRUE) ] - Boolean IsAutoUnlockEnabled; - [ SMS_Report (TRUE) ] - String NoncomplianceDetectedDate; - [ SMS_Report (TRUE) ] - String EnforcePolicyDate; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0")] - Class Win32Reg_MBAMPolicy: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - //Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Operating System Ex"), - SMS_Class_ID ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ] - class CCM_OperatingSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint32 SKU; - }; - - //Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Computer System Ex"), - SMS_Class_ID ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ] - class CCM_ComputerSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -3. Import the **Sms\_def.mof** file by doing the following: - - 1. Open the **System Center 2012 Configuration Manager console** and select the **Administration** tab. - - 2. On the **Administration** tab, select **Client Settings**. - - 3. Right-click **Default Client Settings**, and then select **Properties**. - - 4. In the **Default Settings** window, select **Hardware Inventory**. - - 5. Click **Set Classes**, and then click **Import**. - - 6. In the browser that opens, select your **.mof** file, and then click **Open**. The **Import Summary** window opens. - - 7. In the **Import Summary** window, ensure that the option to import both hardware inventory classes and class settings is selected, and then click **Import**. - - 8. In both the **Hardware Inventory Classes** window and the **Default Settings** window, click **OK**. - -4. Enable the **Win32\_Tpm** class as follows: - - 1. Open the **System Center 2012 Configuration Manager console** and select the **Administration** tab. - - 2. On the **Administration** tab, select **Client Settings**. - - 3. Right-click **Default Client Settings**, and then select **Properties**. - - 4. In the **Default Settings** window, select **Hardware Inventory**. - - 5. Click **Set Classes**. - - 6. In the main window, scroll down, and then select the **TPM (Win32\_Tpm)** class. - - 7. Under **TPM**, ensure that the **SpecVersion** property is selected. - - 8. In both the **Hardware Inventory Classes** window and the **Default Settings** window, click **OK**. - -**To edit the sms\_def.mof file for Configuration Manager 2007** - -1. On the Configuration Manager Server, browse to the location of the **sms\_def.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive% \\Program Files (x86)\\Microsoft Configuration Manager. - -2. Copy the following code, and then append it to **Sms\_def.mof** file to add the following required MBAM classes to the file: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("BitLocker Encryption Details"), - SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")] - class Win32_BitLockerEncryptionDetails : SMS_Class_Template - { - [ SMS_Report (TRUE), key ] - String DeviceId; - [ SMS_Report (TRUE) ] - String BitlockerPersistentVolumeId; - [ SMS_Report (TRUE) ] - String MbamPersistentVolumeId; - [ SMS_Report (TRUE) ] - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - SInt32 MbamVolumeType; - [ SMS_Report (TRUE) ] - String DriveLetter; - [ SMS_Report (TRUE) ] - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - SInt32 Compliant; - [ SMS_Report (TRUE) ] - SInt32 ReasonsForNonCompliance[]; - [ SMS_Report (TRUE) ] - SInt32 KeyProtectorTypes[]; - [ SMS_Report (TRUE) ] - SInt32 EncryptionMethod; - [ SMS_Report (TRUE) ] - SInt32 ConversionStatus; - [ SMS_Report (TRUE) ] - SInt32 ProtectionStatus; - [ SMS_Report (TRUE) ] - Boolean IsAutoUnlockEnabled; - [ SMS_Report (TRUE) ] - String NoncomplianceDetectedDate; - [ SMS_Report (TRUE) ] - String EnforcePolicyDate; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"), - SMS_Context_1("__ProviderArchitecture=32|uint32"), - SMS_Context_2("__RequiredArchitecture=true|boolean")] - Class Win32Reg_MBAMPolicy: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - // Encoded Computer Name - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [ SMS_Report(TRUE), - SMS_Group_Name("BitLocker Policy"), - SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"), - SMS_Context_1("__ProviderArchitecture=64|uint32"), - SMS_Context_2("__RequiredArchitecture=true|boolean")] - Class Win32Reg_MBAMPolicy_64: SMS_Class_Template - { - [SMS_Report(TRUE),key] - string KeyName; - - //General encryption requirements - [SMS_Report(TRUE)] - UInt32 OsDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveEncryption; - [ SMS_Report (TRUE) ] - UInt32 EncryptionMethod; - - //Required protectors properties - [ SMS_Report (TRUE) ] - UInt32 OsDriveProtector; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDriveAutoUnlock; - [ SMS_Report (TRUE) ] - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3) - [SMS_Report(TRUE)] - Uint32 MBAMPolicyEnforced; - [SMS_Report(TRUE)] - string LastConsoleUser; - //Date of the exemption request of the last logged on user, - //or the first date the exemption was granted to him on this machine. - [SMS_Report(TRUE)] - datetime UserExemptionDate; - //Errors encountered by MBAM agent. - [ SMS_Report (TRUE) ] - UInt32 MBAMMachineError; - // Encoded Computer Name - [ SMS_Report (TRUE) ] - string EncodedComputerName; - }; - - //Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Operating System Ex"), - SMS_Class_ID ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ] - class CCM_OperatingSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint32 SKU; - }; - - //Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista. - #pragma namespace ("\\\\.\\root\\cimv2\\SMS") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [ SMS_Report (TRUE), - SMS_Group_Name ("Computer System Ex"), - SMS_Class_ID ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ] - class CCM_ComputerSystemExtended : SMS_Class_Template - { - [SMS_Report (TRUE), key ] - string Name; - [SMS_Report (TRUE) ] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -3. Modify the **Win32\_Tpm** class as follows: - - - Set **SMS\_REPORT** to **TRUE** in the class attributes. - - - Set **SMS\_REPORT** to **TRUE** in the **SpecVersion** property attribute. - - **Got a suggestion for MBAM**? Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). **Got a MBAM issue**? Use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -## Related topics - - -[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) - -[Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) - -[MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md b/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md deleted file mode 100644 index b5343853e6..0000000000 --- a/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: Customizing the Self-Service Portal for Your Organization -description: Customizing the Self-Service Portal for Your Organization -author: dansimp -ms.assetid: f007e02b-e2df-47a9-9762-5909e230aa3f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Customizing the Self-Service Portal for Your Organization - - -After configuring the Self-Service Portal, you will want to customize it for your organization by adding custom notice text, your company name, and other company-specific information. - -## Customizing the Self-Service Portal information - - -You can customize the Self-Service Portal in the following ways: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    What you can doInstructions

    You can brand the Self-Service Portal with your company name, Help Desk URL, and can change the Session Time-out setting to make the end user’s session expire after a specified period of inactivity.

    How to Set the Self-Service Portal Branding and Session Time-out

    You can turn the Self-Service Portal notice text on or off.

    How to Turn the Self-Service Portal Notice Text On or Off

    You can configure a localized version of the Self-Service Portal "HelpdeskText" statement, which tells end users how to get additional help when they are using the Self-Service Portal.

    How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information

    You can configure a localized version of the Self-Service Portal "HelpdeskURL" to display to end users by default.

    How to Localize the Self-Service Portal “HelpdeskURL”

    You can configure localized notice text to display to end users by default in the Self-Service Portal.

    How to Localize the Self-Service Portal Notice Text

    - - - - - -## Related topics - - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/deploy-mbam.md b/mdop/mbam-v25/deploy-mbam.md deleted file mode 100644 index a921105176..0000000000 --- a/mdop/mbam-v25/deploy-mbam.md +++ /dev/null @@ -1,595 +0,0 @@ ---- -title: Deploying MBAM 2.5 in a stand-alone configuration -description: Introducing how to deploy MBAM 2.5 in a stand-alone configuration. -author: Deland-Han -ms.reviewer: dcscontentpm -manager: dansimp -ms.author: delhan -ms.sitesec: library -ms.prod: w10 -ms.date: 09/16/2019 -manager: dcscontentpm ---- - -# Deploying MBAM 2.5 in a standalone configuration - -This article provides step-by-step instructions for installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 in a standalone configuration. In this guide we will use a two-server configuration. One of the two servers will be a database server running Microsoft SQL Server 2012. This server will host the MBAM databases and reports. The additional server will be a Windows Server 2012 web server hosting "Administration and Monitoring Server" and "Self-Service Portal." - -## Preparation steps before installing MBAM 2.5 server software - -### Step 1: Installation and configuration of servers - -Before we start configuring MBAM 2.5, we have to make sure that both servers are configured as per MBAM system requirements. See the [MBAM minimum system requirements](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/mbam-25-supported-configurations#-mbam-server-system-requirements), and select a configuration that meets these requirements. - -#### Step 1.1: Deploying prerequisites for database and reporting server - -1. Install and configure a server running Windows Server 2008 R2 (or later) operating system. - -2. Install Windows PowerShell 3.0. - -3. Install Microsoft SQL Server 2008 R2 or a later version that includes the latest service pack. If you are installing a new instance of SQL Server for MBAM, make sure the SQL Server you install includes the SQL_Latin1_General_CP1_CI_AS collation. You’ll have to install the following SQL Server features: - - * Database Engine - * Reporting Services - * Client Tools Connectivity - * Management Tools – Complete - - > [!Note] - > Optionally, you can also install the [Transparent Data Encryption (TDE) feature in SQL Server](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/mbam-25-security-considerations). - - SQL Server Reporting Services must be installed and configured in "native" mode and not in unconfigured or "SharePoint" mode. - - ![The required SQL Server features](images/deploying-MBAM-1.png) - -4. If you plan to use SSL for the Administration and Monitoring website, make sure that you configure SQL Server Reporting Services (SSRS) to use the Secure Sockets Layer (SSL) protocol before you configure the Administration and Monitoring website. Otherwise, the Reports feature will use unencrypted (HTTP) data transport instead of encrypted (HTTPS). - - You can follow [Configure SSL Connections](https://docs.microsoft.com/sql/reporting-services/security/configure-ssl-connections-on-a-native-mode-report-server?view=sql-server-2017) on a Native Mode Report Server to configure SSL on Report Server. - - > [!Note] - > You can follow the SQL Server Installation Guide for your respective version of SQL Server to install SQL Server. The links are as follows: - > * [SQL Server 2014](https://docs.microsoft.com/sql/sql-server/install/planning-a-sql-server-installation?view=sql-server-2014) - > * [SQL Server 2012](https://docs.microsoft.com/previous-versions/sql/sql-server-2012/bb500442(v=sql.110)) - > * [SQL Server 2008 R2](https://docs.microsoft.com/previous-versions/sql/sql-server-2012/bb500442(v=sql.110)) - -5. In the post-installation of SQL Server, make sure that you provision the user account in SQL Server, and assign the following permissions to the user who will configure the MBAM database and reporting roles on the database server. - - Roles for the instance of SQL Server: - - * dbcreator - * processadmin - - Rights for the instance of SQL Server Reporting Services: - - * Create Folders - * Publish Reports - -Your database server is ready for configuration of MBAM 2.5 roles. Let’s move to the next server. - -#### Step 1.2: Deploying prerequisites for administration and monitoring server - -Choose a server that meets the hardware configuration as explained in the [MBAM system requirements document](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/mbam-25-supported-configurations#-mbam-server-system-requirements). It must be running Windows Server 2008 R2 or a later operating system together with latest service pack and updates. After the server is ready, install the following roles and features: - -##### Roles - -* Web Server (IIS) Management Tools (Select IIS Management Scripts and Tools.) - -* Web Server Role Services - - * Common HTTP features
    - Static Content
    - Default Document - - * Application development
    - ASP.NET
    - .NET Extensibility
    - ISAPI Extensions
    - ISAPI Filters
    - Security
    - Windows Authentication
    - Request Filtering - - * Web Service IIS Management Tools - -##### Feature - -* .NET Framework 4.5 features - - * Microsoft .NET Framework 4.5 - - For Windows Server 2012 or Windows Server 2012 R2, .NET Framework 4.5 is already installed for these versions of Windows Server. However, you must enable it. - - For Windows Server 2008 R2, .NET Framework 4.5 is not included with Windows Server 2008 R2. So, you must download .NET Framework 4.5 and install it separately. - - * WCF Activation
    - HTTP Activation
    - Non-HTTP Activation - - * TCP Activation - - * Windows Process Activation Service:
    - Process Model
    - .NET Framework Environment
    - Configuration APIs - -For the self-service portal to work, you should also [download and install ASP.NET MVC 4.0](https://go.microsoft.com/fwlink/?linkid=392271). - -The next step is to create the required MBAM users and groups in Active Directory. - -### Step 2: Creating users and groups in Active Directory Domain Services - -As part of the prerequisites, you must define certain roles and accounts that are used in MBAM to provide security and access rights to specific servers and features, such as the databases that are running on the instance of SQL Server and the web applications that are running on the Administration and Monitoring Server. - -Create the following groups and users in Active Directory. (You can use any name for the groups and users.) Users do not have to have greater user rights. A domain user account is sufficient. You’ll have to specify the name of these groups during configuration of MBAM 2.5: - -* **MBAMAppPool** - - **Type**: Domain User - - **Description**: Domain user who has Read or Write permission to the Compliance and Audit Database and the Recovery Database to enable the web applications to access the data and reports in these databases. It will also be used by the application pool for the web applications. - - **Account Roles (During Configuration of MBAM)**: - - 1. Web service application pool domain account - - 2. Compliance and Audit Database and Recovery Database read/write user for reports - -* **MBAMROUser** - - **Type**: Domain User - - **Description**: Domain user who will have Read-Only access to the Compliance and Audit Database to enable the reports to access the compliance and audit data in this database. It will also be the domain user account that the local SQL Server Reporting Services instance uses to access the Compliance and Audit Database. - - **Account Roles (During Configuration of MBAM)**: - - 1. Compliance and Audit Database read-only user for reports - - 2. Compliance and Audit Database domain user account - -* **MBAMAdvHelpDsk** - - **Type**: Domain Group - - **Description**: MBAM Advanced Helpdesk Users access group: Domain user group whose members have access to all areas of the Administration and Monitoring Website. Users who have this role have to enter only the recovery key, not the user’s domain and user name, when they are helping users recover their drives. If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Group permissions. - - **Account Roles (During Configuration of MBAM)**: MBAM Advanced Helpdesk Users - -* **MBAMHelpDsk** - - **Type**: Domain Group - - **Description**: MBAM Helpdesk Users access group: Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the MBAM Administration and Monitoring Website. People who have this role must fill in all fields when they use either option. This includes the user’s domain and account name. - - **Account Roles (During Configuration of MBAM)**: MBAM Helpdesk Users - -* **MBAMRUGrp** - - **Type**: Domain Group - - **Description**: Domain user group whose members have read-only access to the reports in the Reports area of the Administration and Monitoring Website. - - **Account Roles (During Configuration of MBAM)**: - - 1. Reports read-only domain access group - - 2. MBAM Report Users access group - -### Step 3 (Optional): Configure and install SSL certificate on administration and monitoring server - -Although it’s optional, we highly recommend that you use a certificate to help secure the communication between the MBAM Client and the Administration and Monitoring Website and the Self-Service Portal websites. We do not recommend that you use self-signed certificates because of obvious security reasons. We suggest that you use a Web Server Type Certificate from a trusted Certification Authority. To do this, you can refer the "Using Certificate Approved by Certificate Authority" section from [KB 2754259](https://support.microsoft.com/help/2754259). - -After the certificate is issued, you should add the certificate to the personal store of the Administration and Monitoring Server. To add the certificate, open the Certificates store on the local computer. To do this, follow these steps: - -1. Right-select Start, and then select Run. - - ![Select ](images/deploying-MBAM-2.png) - -2. Type "MMC.EXE" (without the quotation marks), and then select **OK**. - - ![Run box](images/deploying-MBAM-3.png) - -3. Select **File** in the new MMC that you opened, and then select **Add/Remove Snap-in**. - - ![Select](images/deploying-MBAM-4.png) - -4. Highlight the **Certificates** snap-in, and then select **Add**. - - ![Add or Remove Snap-ins window](images/deploying-MBAM-5.png) - -5. Select the **Computer account** option, and then select **Next**. - - ![Certificates snap-in window](images/deploying-MBAM-6.png) - -6. Select **Local Computer** on the next screen, and then select **Finish**. - - ![Select Computer window](images/deploying-MBAM-7.png) - -7. You have now added the Certificates snap-in. This will enable you to work with any certificates in your computer's certificate store. - - ![Add or Remove Snap-ins window](images/deploying-MBAM-8.png) - -8. Import the web server certificate into your computer's certificate store. - - Now that you have access to the Certificates snap-in, you can import the web server certificate into your computer's certificate store. To do this, follow the next steps. - -9. Open the Certificates (Local Computer) snap-in, and browse to **Personal** and then **Certificates**. - - ![Certificates (Local Computer) snap-in window](images/deploying-MBAM-9.png) - - > [!Note] - > The Certificates snap-in may not be listed. If it is not, no certificates are installed. - -10. Right-select **Certificates**, select **All Tasks**, and then select **Import**. - - ![Certificates (Local Computer) snap-in window](images/deploying-MBAM-10.png) - -11. When the wizard starts, select **Next**. Browse to the file that you created that contains your server certificate and private key, and then select **Next**. - - ![Certificate Import Wizard window](images/deploying-MBAM-11.png) - -12. Enter the password if you specified one for the file when you created it. - - ![Enter password window](images/deploying-MBAM-12.png) - - > [!Note] - > Make sure that the **Mark the key as exportable** option is selected if you want to be able to export the key pair again from this computer. As an added security measure, you may want to leave this option cleared to make sure that no one can make a backup of your private key. - -13. Select **Next**, and then select the **Certificate Store** to which you want to save the certificate. - - ![Certificate Import Wizard window](images/deploying-MBAM-13.png) - - > [!Note] - > You should select **Personal**, because it is a web server certificate. If you included the certificate in the certification hierarchy, it will also be added to this store. - -14. Select **Next**, and then select **Finish**. - - ![Certificate Import Wizard window](images/deploying-MBAM-14.png) - -You will now see the server certificate for your web server in the Personal Certificates list. It will be denoted by the common name of the server. (You can find this in the subject section of the certificate.) - -For further reference: - -[MBAM 2.5 Security Considerations](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/mbam-25-security-considerations) - -[Planning How to Secure the MBAM Websites](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-how-to-secure-the-mbam-websites) - -The next step is to register a service principle name for the application pool account. - -### Step 4: Configuring SSL certificate for MBAM Web Server - -If you are using SSL communication between the client and server, you should make sure that the certificate has Enhanced Key Usage OIDs (1.3.6.1.5.5.7.3.1) and (1.3.6.1.5.5.7.3.2). That is, you should make sure that Server Authentication and Client Authentication are added. - -If you receive a certificate error when you try to browse service URLs, you are using a certificate that was issued to a different name, or you are browsing by using an incorrect URL. - -Although the browser may prompt you with a certificate error message but let you continue, the MBAM web service will not ignore certificate errors and will block the connection. You will notice certificate-related errors in the MBAM client’s MBAM Admin event log. If you are using an alias to connect to the Administration and Monitoring server, you should issue a certificate to the alias name. That is, the subject name of the certificate should be the alias name, and the local server’s DNS name should be added to the **Subject Alternative Name** field of the certificate. - -Example: - -If the virtual name is "bitlocker.contoso.com" and the MBAM Administration and Monitoring server name is "adminserver.contoso.com," the certificate should be issued to bitlocker.contoso.com (subject name), and adminserver.contoso.com should be added to **Subject Alternative Name** field of the certificate. - -Similarly, if you have multiple Administration and Monitoring servers installed to balance the load by using a load balancer, you should issue the SSL certificate to the virtual name. That is, the subject name field of the certificate should have the virtual name, and the names of all the local servers should be added in the **Subject Alternative Name** field of the certificate. - -Example: - -If the virtual name is "bitlocker.contoso.com" and the servers are "adminserver1.contoso.com" and "adminiserver2.contoso.com," the certificate should be issued to bitlocker.contoso.com (subject name) and adminserver1.contoso.com, and adminiserver2.contoso.com should be added to the **Subject Alternative Name** field of the certificate. - -The steps to configure SSL communication by using MBAM are described in the following Knowledge Base article: [KB 2754259](https://support.microsoft.com/help/2754259). - -### Step 5: Register SPNS for the application pool account and configure constrained delegation - -> [!Note] -> Constrained delegation is required only for 2.5 and is not required for 2.5 Service Pack 1 and later. - -To enable the MBAM servers to authenticate communication from the Administration and Monitoring Website and the Self-Service Portal, you must register a Service Principal Name (SPN) for the host name under the domain account that you are using for the web application pool. The following article contains step-by-step instructions to register SPNs: [Planning How to Secure the MBAM Websites](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-how-to-secure-the-mbam-websites) - -After you have the SPN configured, you should set up constrained delegation on the SPN. To do this, follow these steps: - -1. Go to Active Directory, and find the app pool credentials that you configured for MBAM websites in the previous steps. - -2. Right-click the credentials, and then select **properties**. - -3. Select the **delegation** tab. - -4. Select the option for Kerberos authentication. - -5. Select **browse**, and browse again for your app pool credentials. You should then see the all the SPNs that are set up on the app pool creds account. (The SPN should resemble "http/bitlocker.fqdn.com"). Highlight the SPN that is the same as the host name that you specified during the MBAM installation. - -6. Select **OK**. - -Now you are good with prerequisites. In the next steps, you will install the MBAM software on the servers and configure it. - -## Installing and configuring MBAM 2.5 server software - -### Step 6: Install MBAM 2.5 server software - -To install the MBAM Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard both on Database Server and on Administration and Monitoring Server, follow these steps. - -1. On the server on which you want to install MBAM, run MBAMserversetup.exe to start the Microsoft BitLocker Administration and Monitoring Setup wizard. - -2. On the Welcome page, select **Next**. - -3. Read and accept the Microsoft Software License Agreement, and then select **Next** to continue the installation. - -4. Decide whether to use Microsoft Update when you check for updates, and then select **Next**. - -5. Decide whether to participate in the Customer Experience Improvement Program, and then select **Next**. - -6. To start the installation, select **Install**. - -7. To configure the server features after the MBAM Server software finishes installing, select the **Run MBAM Server Configuration after the wizard closes** check box. Or, you can configure MBAM later by using the **MBAM Server Configuration** shortcut that the server installation creates on your **Start** menu. - -8. Select **Finish**. - -For more information, see [Installing the MBAM 2.5 Server Software](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/installing-the-mbam-25-server-software). - -### Step 7: Configure MBAM 2.5 database and reports role - -In this step, we will configure the MBAM 2.5 databases and reporting component by using the MBAM Wizard: - -1. Configure the Compliance and Audit Database and the Recovery Database by using the wizard: - - 1. On the server on which you want to configure the databases, start the **MBAM Server Configuration wizard**. You can select **MBAM Server Configuration** on the **Start** menu to open the wizard. - - 2. Select **Add New Features**, select **Compliance and Audit Database**, **Recovery Database and Reports**, and then select **Next**. The wizard checks that all prerequisites for the databases are met. - - 3. If the prerequisite check is successful, select **Next** to continue. Otherwise, resolve any missing prerequisites, and then select **Check prerequisites again**. - - 4. Using the following descriptions, enter the field values in the wizard: - -2. Compliance and audit database - - |Field |Description| - |-------|-------| - |SQL Server name |Name of the server on which you are configuring the Compliance and Audit Database.
    You must add an exception on the Compliance and Audit Database computer to enable incoming inbound traffic on the SQL Server port. The default port number is 1433.| - |SQL Server database instance |Name of the database instance where the compliance and audit data will be stored. If you are using the default instance, you must leave this field blank. You must also specify where the database information will be located.| - |Database name |Name of the database that will store the compliance data. You must note the name of the database that you are specifying here because you will have to provide this information in later steps.| - |Read/write permission domain user or group |Specify the name of the MBAMAppPool user as configured in step 2.| - |Read-only access domain user or group |Specify the name of the MBAMROUser user as configured in step 2.| - -3. Recovery database. - - |Field |Description| - |-----|-----| - |SQL Server name |Name of the server on which you are configuring the Recovery Database. You must add an exception on the Recovery Database computer to enable incoming inbound traffic on the SQL Server port. The default port number is 1433.| - |SQL Server database instance |Name of the database instance where the recovery data will be stored. If you are using the default instance, you must leave this field blank. You must also specify where the database information will be located.| - |Database name |Name of the database that will store the recovery data.| - |Read/write permission domain user or group |Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.
    If you enter a user in this field, it must be the same value as the value in the **Web service application pool domain account** field on the **Configure Web Applications** page.
    If you enter a group in this field, the value in the **Web service application pool domain account** field on the **Configure Web Applications** page must be a member of the group that you enter in this field.| - - When you finish your entries, select **Next**. The wizard checks that all prerequisites for the databases are met. - - If the prerequisite check is successful, select **Next** to continue. Otherwise, resolve any missing prerequisites, and then select **Next** again. - -4. Reports. - - |Field |Description| - |----|----| - |SQL Server Reporting Services instance |Instance of SQL Server Reporting Services where the reports will be configured. If you are using the default instance, you must leave this field blank.| - |Reporting role domain group |Specify the name of the MBAMRUGrp as mentioned in step 2.| - |SQL Server name |Name of the server on which the Compliance and Audit Database is configured.| - |SQL Server database instance |Name of the database instance where the compliance and audit data is configured. If you are using the default instance, you must leave this field blank.
    You must add an exception on the Reports computer to enable incoming traffic on the port of the Reporting Server. (The default port is 80.)| - |Database name| Name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status.| - |Compliance and Audit Database domain account |Specify the name of the MBAMROUser user as configured in step 2.| - - When you finish your entries, select **Next**. The wizard checks that all prerequisites for the Reports feature are met. Select Next to continue. On the **Summary** page, review the features that will be added. - - For more information, see the following article: [How to Configure the MBAM 2.5 Databases](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-mbam-25-databases). - -### Step 8: Configure the MBAM 2.5 Web applications role - -1. On the server on which you want to configure the web applications, start the MBAM Server Configuration wizard. You can select **MBAM Server Configuration** on the **Start** menu to open the wizard. - -2. Select **Add New Features**, select **Administration and Monitoring Website** and **Self-Service Portal**, and then select **Next**. The wizard checks that all prerequisites for the databases are met. - -3. If the prerequisite check is successful, select **Next** to continue. Otherwise, resolve any missing prerequisites, and then select **Check prerequisites again**. - -4. Use the following descriptions to enter the field values in the wizard. - - |Field |Description| - |-----|-----| - |Security certificate |Select a previously created certificate in step 3 to optionally encrypt the communication between the web services and the server on which you are configuring the Administration and Monitoring Website. If you select Do not use a certificate, your web communication may not be secure.| - |Host name |Name of the host computer on which you are configuring the Administration and Monitoring Website.
    It does not have to be the hostname of the machine, it could be anything. However, if the hostname is different than the netbios name of the computer, you have to create an A record and make sure the SPN uses the custom hostname, not the netbios name. This is common on load balancing scenarios.| - |Installation path |Path on which you are installing the Administration and Monitoring Website.| - |Port |Port number to use for website communication.
    You must set a firewall exception to enable communication through the specified port.| - |Web service application pool domain account and password |Specify the user account and password of the MBAMAppPool user as configured in step 2.
    For improved security, set the account that is specified in the credentials to have limited user rights. Also, set the password of the account to never expire.| - -5. Verify that the built-in IIS_IUSRS account or the application pool account was added to the **Impersonate a client after authentication** and the **Log on as a batch job** local security settings. - - To check whether the account was added to the local security settings, open the **Local Security Policy editor**, expand the **Local Policies** node, select the **User Rights Assignment** node, and double-select **Impersonate a client after authentication** and **Log on as a batch job** policies in the right-side pane. - -6. Use the following field descriptions to configure the connection information in the wizard for the Compliance and Audit Database. - |Field |Description| - |------|------| - |SQL Server name |Name of the server on which the Compliance and Audit Database is configured.| - |SQL Server database instance |Name of the instance of SQL Server (for example, \) and on which the Compliance and Audit Database is configured. Leave this blank if you are using the default instance.| - |Database name |Name of the Compliance and Audit Database. By default, it’s "MBAM Compliance Status".| - -7. Use the following field descriptions to configure the connection information in the wizard for the Recovery Database. - |Field |Description| - |----|----| - |SQL Server name |Name of the server on which the Recovery Database is configured.| - |SQL Server database instance |Name of the instance of SQL Server (for example, \) on which the Recovery Database is configured. Leave this blank if you are using the default instance.| - |Database name |Name of the Recovery Database. By default, it’s "MBAM Recovery and Hardware".| - -8. Use the following descriptions to enter the field values in the wizard to configure the Administration and Monitoring Website. - |Field |Description| - |----|----| - |Advanced Helpdesk role domain group |Specify the name of the MBAMAdvHelpDsk Group as configured in step 2.| - |Helpdesk role domain group |Specify the name of the MBAMHelpDsk Group as configured in step 2.| - |Use System Center Configuration Manager Integration |Select to clear this check box. | - |Reporting role domain group |Specify the name of the MBAMRUGrp Group as configured in step 2. | - |SQL Server Reporting Services URL |Specify the Web Service URL for the SSRS server on which the MBAM reports are configured. You can find this information by logging in to Reporting Services Configuration Manager on the Database Server.
    Example of a fully qualified domain name: https://MyReportServer.Contoso.com/ReportServer
    Example of a custom host name: https://MyReportServer/ReportServer| - |Virtual directory |Virtual directory of the Administration and Monitoring Website. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name. For example:
    http(s)://*\*:*\*/HelpDesk/
    If you do not specify a virtual directory, the value HelpDesk will be used. | - -9. Use the following description to enter the field values in the wizard to configure the Self-Service Portal. - - |Field |Description| - |----|----| - |Virtual directory |Virtual directory of the web application. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name. For example:
    http(s)://*\*:*\*/SelfService/
    If you do not specify a virtual directory, the value "SelfService" will be used.| - -10. When you finish your entries, select **Next**. The wizard checks that all prerequisites for the web applications are met. - -11. Select **Next** to continue. - -12. On the **Summary** page, review the features that will be added. - -13. Select **Add** to add the web applications to the server, and then select **Close**. - -## Customizing and validating steps after installing MBAM 2.5 server software - -### Step 9: Customizing the self-server portal for your organization - -To customize the Self-Service Portal by adding custom notice text, your company name, pointers to more information, and so on, see [Customizing the Self-Service Portal for Your Organization](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/customizing-the-self-service-portal-for-your-organization). - -### Step 10: Configure the self-server portal if client computers cannot access the CDN - -Determine whether your client computers have access to the Microsoft AJAX Content Delivery Network (CDN). The CDN gives the Self-Service Portal the access it requires to certain JavaScript files. If you don’t configure the Self-Service Portal when client computers cannot access the CDN, only the company name and the account under which the user signed in will be displayed. No error message will be shown. - -Do one of the following: - -* If your client computers have access to the CDN, do nothing. Your Self-Service Portal configuration is complete. - -* If your client computers do not have access to the CDN, follow the steps in [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network). - -### Step 11: Validate the MBAM 2.5 server feature configuration - -To validate your MBAM Server deployment to use the standalone topology, follow these steps. - -1. On each server on which an MBAM feature is deployed, select **Control Panel** > **Programs** > **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - > [!Note] - > To perform the validation, you must use a domain account that has local computer administrative credentials on each server. - -2. On the server on which the Recovery Database is configured, open SQL Server Management Studio, and verify that the **MBAM Recovery and Hardware** database is configured. - -3. On the server om which the Compliance and Audit Database is configured, open SQL Server Management Studio, and verify that the MBAM Compliance Status Database is configured. - -4. On the server onm which the Reports feature is configured, open a web browser by using administrative credentials, and browse to the homepage of the SQL Server Reporting Services site. - - The default homepage location of a SQL Server Reporting Services site instance is as follows: - http(s)://*\*:*\*/Reports.aspx - - To find the actual URL, use the Reporting Services Configuration Manager tool, and select the instances that you specified during setup. - -5. Verify that a reports folder that is named Microsoft BitLocker Administration and Monitoring contains a data source that is named MaltaDataSource. This data source contains folders that have names that represent language locales (for example, en-us). The reports are in the language folders. - - > [!Note] - > If SQL Server Reporting Services (SSRS) was configured as a named instance, the URL should resemble the following: - > http(s)://\:\/Reports_\ - > - > If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to "HTTP" instead of "HTTPS" when you install the MBAM server. If you then go to the Administration and Monitoring Website (also known as Helpdesk) and select a report, you receive the following message: "Only Secure Content is Displayed." To show the report, select **Show All Content**. - -6. On the server on which the Administration and Monitoring Website feature is configured, run Server Manager, browse to **Roles**, and then select **Web Server (IIS)** > **Internet Information Services (IIS)** Manager. - -7. In **Connections**, browse to \ and then select **Sites** > **Microsoft BitLocker Administration and Monitoring**. Verify that the following are listed: - - * MBAMAdministrationService - * MBAMComplianceStatusService - * MBAMRecoveryAndHardwareService - -8. On the server on which the Administration and Monitoring Website and Self-Service Portal are configured, open a web browser by using administrative credentials. - -9. Browse to the following websites to verify that they load successfully: - * https(s)://\:\/HelpDesk/ (confirm each link for navigation and reports) - * http(s)://\:\/SelfService/ - - > [!Note] - > It is assumed that you configured the server features on the default port without network encryption. If you configured the server features on a different port or virtual directory, change the URLs to include the appropriate port. For example: - > http(s)://\:\/HelpDesk/ - > http(s)://\:\/\/ - > If the server features were configured to use network encryption, change http:// to https://. - -10. Browse to the following web services to verify that they load successfully. A page opens to indicate that the service is running. However, the page displays no metadata. - - * http(s)://\:\/MBAMAdministrationService/AdministrationService.svc - * http(s)://\:\/MBAMUserSupportService/UserSupportService.svc - * http(s)://\:\/MBAMComplianceStatusService/StatusReportingService.svc - * http(s)://\:\/MBAMRecoveryAndHardwareService/CoreService.svc - -### Step 12: Configure the MBAM Group policy templates - -To deploy MBAM, you have to set Group Policy settings that define MBAM implementation settings for BitLocker Drive Encryption. To complete this task, you must copy the MBAM Group Policy templates to a server or workstation that can run Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM), and then edit the settings. - -> [!Important] -> Do not change the Group Policy settings in the **BitLocker Drive Encryption** node or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you. - -#### Copying the MBAM 2.5 Group Policy templates - -Before you install the MBAM Client, you must copy MBAM-specific Group Policy Objects (GPOs) to the management workstation. These GPOs define MBAM implementation settings for BitLocker. You can copy the Group Policy templates to any server or workstation that is a supported Windows-based server or client computer and that can run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -For more information, see [Copying the MBAM 2.5 Group Policy Templates](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/copying-the-mbam-25-group-policy-templates). - -#### Editing MBAM 2.5 GPO settings - -After you create the necessary GPOs, you must deploy the MBAM Group Policy settings to your organization’s client computers. To view and create GPOs, you must have Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) installed. - -For more information, see [Editing the MBAM 2.5 Group Policy Settings](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/editing-the-mbam-25-group-policy-settings) and [Planning for MBAM 2.5 Group Policy Requirements](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-group-policy-requirements). - -### Step 13: Deploying the MBAM 2.5 Client - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring Client software, you can enable BitLocker on a computer in your organization either before the user receives the computer or afterward by configuring Group Policy and deploying the MBAM Client software by using an enterprise software deployment system. - -#### Deploy the MBAM Client to desktop or portable computers - -After you configure Group Policy settings, you can use an enterprise software deployment system product such as Microsoft System Center 2012 Configuration Manager or Active Directory Domain Services (AD DS) to deploy the MBAM client installation Windows Installer files to target computers. You can use either the 32-bit or 64-bit MbamClientSetup.exe files or the 32-bit or 64-bit MBAMClient.msi files. These are provided together with the MBAM Client software. - -For more information, see [How to Deploy the MBAM Client to Desktop or Laptop Computers](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25). - -#### Deploy the MBAM Client as part of a Windows deployment - -In organizations in which computers are received and configured centrally, you can install the MBAM Client to manage BitLocker Drive Encryption on each computer before any user data is written to it. The benefit of this process is that every computer is then BitLocker-compliant. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization is to install a corporate Windows image before the computer is delivered to the user. If the Group Policy settings are configured to require a PIN, users are prompted to set a PIN after they receive the policy. - -For more information, see [How to Deploy the MBAM Client as Part of a Windows Deployment](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25). - -#### How to deploy the MBAM Client by using a command line - -For more information see [How to Deploy the MBAM Client by Using a Command Line](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line). - -#### Post-deployment of clients - -Now that you have finished the deployment activity, you should review the following logs and determine whether the clients are reporting successfully to the MBAM database. - -## FAQ - -### How to create a Load balanced IIS servers - -* SPN must be registered only to the friendly name (for example: bitlocker.corp.net), and must not be registered to individual IIS servers. - -* If a certificate is used, the certificate must have both FQDN and NetBIOS names entered into the **Subject Alternative Name** field for all IIS servers in the load balance group and also as the Friendly Name (for example: bitlocker.corp.net). Otherwise, the certificate will be reported as not trusted by the browser when you browse load-balanced addresses. - -For more information, see [IIS Network Load Balancing](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-high-availability#a-href-idbkmk-load-balanceaiis-network-load-balancing) and [Registering SPNs for the application pool account](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-how-to-secure-the-mbam-websites#registering-spns-for-the-application-pool-account). - -### How to configure a certificate - -* You’ll have to have two certificates. One certificate is used for SQL server, and the other is used for IIS. They must be installed before starting MBAM installation. - -* We recommend that you use the installer to add the certificate to the IIS configuration instead of manually editing the web.config file. - -* The certificate will not be accepted by the MBAM Configurator if the “Issued To” field on the certificate does not match the name of the server. In this case, temporarily create a self-signed certificate from the IIS Console, and use it in the Configurator. This will make nsure that the Web Apps are installed for SSL and HTTPS. After that, you can change the certificate to one from IIS bindings for the MBAM Website. - -### The SQL permissions requirement for installation - -Create an account for MBAM App Pool, and give it only SecurityAdmin, Public, and DBCreator permissions. - -See [MBAM Database configuration – minimum permissions](https://blogs.technet.microsoft.com/dubaisec/2016/02/02/mbam-database-configuration-minimum-permissions/) for more information. - -> [!Note] -> * In some situations, more permissions are required for the initial installation and upgrade operations. -> * Use an account that has temporary SA for the installation. -> * Do not start the Configurator in the context of a user account (Run As) that does not have enough permissions to make changes to SQL Server because this will cause installation errors. -> * You must be logged on by using an account that has permissions on SQL Server. Only SQL Server databases can be created or updated by running MBAM Configurator remotely. For SSRS server, you must install MBAM and run Configurator locally to install or update the MBAM SSRS reports. - -### The permission required for SPN Registration - -An account that's used for IIS portal installation must have Write ServicePrincipalName and Write Validated SPN permissions. Without these permissions, the installation will return a warning message that states that it cannot register the SPN. - -> [!Note] -> You will this receive this warning message twice. This does not mean that the SPN must have two objects registered to it. - -For more information, see [MBAM Setup fails with “Register SPN Deferred” error message](https://support.microsoft.com/help/2754138/). - -### Did I have to update the ADMX templates to the latest version? - -You'll see multiple OS options in the MBAM root node for GPO after you update the ADMX templates to their latest versions. For example, Windows 7, Windows 8.1, and Windows 10, version 1511 and later versions. - -For more information about how to update the ADMX templates, see the following articles: -* [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://docs.microsoft.com/microsoft-desktop-optimization-pack/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates) -* [Planning for MBAM 2.5 Group Policy Requirements](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-group-policy-requirements) -* [Microsoft Desktop Optimization Pack Group Policy Administrative Templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531) diff --git a/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md b/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md deleted file mode 100644 index ea0c9dff8f..0000000000 --- a/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Deploying MBAM 2.5 Group Policy Objects -description: Deploying MBAM 2.5 Group Policy Objects -author: dansimp -ms.assetid: 4b835054-6846-463d-af58-8ac4639a1188 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 2.5 Group Policy Objects - - -To deploy MBAM, you have to set Group Policy settings that define MBAM implementation settings for BitLocker drive encryption. To complete this task, you must copy the MBAM Group Policy Templates to a server or workstation that are capable of running Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM), and then edit the settings. - -**Important**   -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you. - - - -## Copying the MBAM 2.5 Group Policy Templates - - -Before you install the MBAM Client, you must copy MBAM-specific Group Policy Objects (GPOs) to the Management Workstation. These GPOs define MBAM implementation settings for BitLocker drive encryption. You can copy the Group Policy templates to any server or workstation that is a supported Windows server or client computer and that is able to run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM). - -[Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) - -## Editing MBAM 2.0 GPO settings - - -After you create the necessary GPOs, you must deploy the MBAM Group Policy settings to your organization’s client computers. To view and create GPOs, you must have Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) installed. - -[Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) - -## Showing or hiding the MBAM Control Panel in Windows Control Panel - - -Since MBAM offers a customized MBAM control panel that can replace the default Windows BitLocker control panel, you can also choose to show or hide the default BitLocker Control Panel from end users by using Group Policy settings. - -[Hiding the Default BitLocker Drive Encryption Item in Control Panel](hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md) - -## Other Resources for deploying MBAM 2.0 Group Policy Objects - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/deploying-mbam-25.md b/mdop/mbam-v25/deploying-mbam-25.md deleted file mode 100644 index 48ab4bb17d..0000000000 --- a/mdop/mbam-v25/deploying-mbam-25.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Deploying MBAM 2.5 -description: Deploying MBAM 2.5 -author: dansimp -ms.assetid: 45403607-1f4d-42fe-8413-0d4da01808a6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying MBAM 2.5 - - -Use this information to identify the procedures you can follow to deploy and configure Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server features to upgrade to MBAM 2.5 from previous versions, or to remove MBAM Server features. - -## Deployment information - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Topic descriptionLinks to topics
      -
    • Deployment topology options.

    • -
    • How to install the MBAM Server software.

    • -
    • How to configure the MBAM Server features.

    • -

    Deploying the MBAM 2.5 Server Infrastructure

    How to download and deploy the MBAM Group Policy Templates, which are required to manage MBAM Clients and BitLocker encryption policies in the enterprise.

    Deploying MBAM 2.5 Group Policy Objects

    How to use the MBAM Client Windows Installer files to deploy the MBAM Client software.

    Deploying the MBAM 2.5 Client

    Checklist that can assist you in deploying the MBAM Server features and MBAM Client.

    MBAM 2.5 Deployment Checklist

    How to upgrade MBAM from previous versions.

    Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions

    How to remove MBAM Server features or software.

    Removing MBAM Server Features or Software

    - - - -## Other resources for deploying MBAM - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Deploying MBAM 2.5 in a stand-alone configuration](https://support.microsoft.com/kb/3046555) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/deploying-the-mbam-25-client.md b/mdop/mbam-v25/deploying-the-mbam-25-client.md deleted file mode 100644 index 0a20208aa0..0000000000 --- a/mdop/mbam-v25/deploying-the-mbam-25-client.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Deploying the MBAM 2.5 Client -description: Deploying the MBAM 2.5 Client -author: dansimp -ms.assetid: 0a96a0ee-f280-49d9-a244-88f4147fe9fd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 2.5 Client - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Client software enables administrators to enforce and monitor BitLocker Drive Encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an electronic software distribution system, such as Active Directory Domain Services, or by directly encrypting the client computers as part of the initial imaging process. - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring Client software, you can enable BitLocker Drive Encryption on a computer in your organization either before the end user receives the computer or afterwards by configuring Group Policy and deploying the MBAM Client software by using an enterprise software deployment system. - -## Deploy the MBAM Client to desktop or laptop computers - - -After configuring Group Policy settings, you can use an enterprise software deployment system product like Microsoft System Center 2012 Configuration Manager or Active Directory Domain Services to deploy the MBAM Client installation Windows Installer files to target computers. You can use either the 32-bit or 64-bit MbamClientSetup.exe files or the 32-bit or 64-bit MBAMClient.msi files, which are provided with the MBAM Client software. For more information about deploying MBAM Group Policy settings, see [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md). - -**Note**   -Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product. - - - -[How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md) - -## Deploy the MBAM Client as part of a Windows deployment - - -In organizations where computers are received and configured centrally, you can install the MBAM Client to manage BitLocker Drive Encryption on each computer before any user data is written to it. The benefit of this process is that every computer is then BitLocker Drive Encryption-compliant. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the user. If the Group Policy settings has been configured to require a PIN, users are prompted to set a PIN after they receive the policy. - -[How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md) - -## How to deploy the MBAM Client by using a command line - - -This section explains how to install the MBAM Client by using a command line. - -[How to Deploy the MBAM Client by Using a Command Line](how-to-deploy-the-mbam-client-by-using-a-command-line.md) - -## Other resources for deploying the MBAM Client - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md b/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md deleted file mode 100644 index d60e1044e5..0000000000 --- a/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Deploying the MBAM 2.5 Server Infrastructure -description: Deploying the MBAM 2.5 Server Infrastructure -author: dansimp -ms.assetid: e85a60cf-4cc1-4906-8da3-442232c374af -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MBAM 2.5 Server Infrastructure - - -To deploy the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server infrastructure, you complete the following three high-level tasks: - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskWhere to get instructions

    Install the MBAM 2.5 Server software on each server where you want to configure an MBAM Server feature.

    Installing the MBAM 2.5 Server Software

    Configure the databases, reports, web applications, and the optional System Center Configuration Manager Integration topology.

    -

    You can use the MBAM Server Configuration wizard or Windows PowerShell cmdlets to do the configuration.

    Configuring the MBAM 2.5 Server Features

    Validate the MBAM Server configuration.

    Validating the MBAM 2.5 Server Feature Configuration

    - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md b/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md deleted file mode 100644 index 9ce836f5eb..0000000000 --- a/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Determining why a Device Receives a Noncompliance Message -description: Determining why a Device Receives a Noncompliance Message -author: dansimp -ms.assetid: 793df330-a0ee-4759-b53a-95618ac74428 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/22/2017 ---- - - -# Determining why a Device Receives a Noncompliance Message - - -The following noncompliance codes are provided by WMI and describe the reasons why a particular device is reported by MBAM as noncompliant. - -You can use your preferred method to view WMI. If you use PowerShell, run `gwmi -class mbam_volume -Namespace root\microsoft\mbam` from a PowerShell prompt and search for ReasonsForNoncompliance. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Non-Compliance CodeReason for Non-Compliance

    0

    Cipher strength not AES 256.

    1

    MBAM Policy requires this volume to be encrypted but it is not.

    2

    MBAM Policy requires this volume to NOT be encrypted, but it is.

    3

    MBAM Policy requires this volume use a TPM protector, but it does not.

    4

    MBAM Policy requires this volume use a TPM+PIN protector, but it does not.

    5

    MBAM Policy does not allow non TPM machines to report as compliant.

    6

    Volume has a TPM protector but the TPM is not visible (booted with recover key after disabling TPM in BIOS?).

    7

    MBAM Policy requires this volume use a password protector, but it does not have one.

    8

    MBAM Policy requires this volume NOT use a password protector, but it has one.

    9

    MBAM Policy requires this volume use an auto-unlock protector, but it does not have one.

    10

    MBAM Policy requires this volume NOT use an auto-unlock protector, but it has one.

    11

    Policy conflict detected preventing MBAM from reporting this volume as compliant.

    12

    A system volume is needed to encrypt the OS volume but it is not present.

    13

    Protection is suspended for the volume.

    14

    AutoUnlock unsafe unless the OS volume is encrypted.

    15

    Policy requires minimum cypher strength is XTS-AES-128 bit, actual cypher strength is weaker than that.

    16

    Policy requires minimum cypher strength is XTS-AES-256 bit, actual cypher strength is weaker than that.

    - -  - -## Related topics - - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). -  - - - - - diff --git a/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md b/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md deleted file mode 100644 index a3a45c975d..0000000000 --- a/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md +++ /dev/null @@ -1,389 +0,0 @@ ---- -title: Edit the Configuration.mof File -description: Edit the Configuration.mof File -author: dansimp -ms.assetid: 5d8cd76b-8ffc-4d46-b761-1b8350310c48 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit the Configuration.mof File - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the **Configuration.mof** file, whether you are using System Center 2012 Configuration Manager or Configuration Manager 2007. Complete the following instructions for the version of Configuration Manager that you are using. - -**To edit the Configuration.mof file for System Center 2012 Configuration Manager** - -1. On the Configuration Manager Server, browse to the location of the **Configuration.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files \\Microsoft Configuration Manager. - -2. Edit the **Configuration.mof** file to append the following MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled, NoncomplianceDetectedDate, EnforcePolicyDate from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - [PropertySources{"NoncomplianceDetectedDate"}] - String NoncomplianceDetectedDate; - [PropertySources{"EnforcePolicyDate"}] - String EnforcePolicyDate; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded Computer Name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - -**To edit the Configuration.mof file for Configuration Manager 2007** - -1. On the Configuration Manager Server, browse to the location of the **Configuration.mof** file: - - <CMInstallLocation>\\Inboxes\\clifiles.src\\hinv\\ - - On a default installation, the installation location is %systemdrive%\\Program Files (x86)\\Microsoft Configuration Manager. - -2. Edit the **Configuration.mof** file to append the following MBAM classes: - - ``` syntax - //=================================================== - // Microsoft BitLocker Administration and Monitoring - //=================================================== - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) - [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled, NoncomplianceDetectedDate, EnforcePolicyDate from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")] - class Win32_BitLockerEncryptionDetails - { - [PropertySources{"DeviceId"},key] - String DeviceId; - [PropertySources{"BitlockerPersistentVolumeId"}] - String BitlockerPersistentVolumeId; - [PropertySources{"BitLockerManagementPersistentVolumeId"}] - String MbamPersistentVolumeId; - //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3 - [PropertySources{"BitLockerManagementVolumeType"}] - SInt32 MbamVolumeType; - [PropertySources{"DriveLetter"}] - String DriveLetter; - //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2 - [PropertySources{"Compliant"}] - SInt32 Compliant; - [PropertySources{"ReasonsForNonCompliance"}] - SInt32 ReasonsForNonCompliance[]; - [PropertySources{"KeyProtectorTypes"}] - SInt32 KeyProtectorTypes[]; - [PropertySources{"EncryptionMethod"}] - SInt32 EncryptionMethod; - [PropertySources{"ConversionStatus"}] - SInt32 ConversionStatus; - [PropertySources{"ProtectionStatus"}] - SInt32 ProtectionStatus; - [PropertySources{"IsAutoUnlockEnabled"}] - Boolean IsAutoUnlockEnabled; - [PropertySources{"NoncomplianceDetectedDate"}] - String NoncomplianceDetectedDate; - [PropertySources{"EnforcePolicyDate"}] - String EnforcePolicyDate; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; - UInt32 MBAMMachineError; - - // Encoded Computer Name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL) - [DYNPROPS] - Class Win32Reg_MBAMPolicy_64 - { - [key] - string KeyName; - - //General encryption requirements - UInt32 OsDriveEncryption; - UInt32 FixedDataDriveEncryption; - UInt32 EncryptionMethod; - - //Required protectors properties - UInt32 OsDriveProtector; - UInt32 FixedDataDriveAutoUnlock; - UInt32 FixedDataDrivePassphrase; - - //MBAM Agent fields - Uint32 MBAMPolicyEnforced; - string LastConsoleUser; - datetime UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - UInt32 MBAMMachineError; - - // Encoded Computer Name - string EncodedComputerName; - }; - - [DYNPROPS] - Instance of Win32Reg_MBAMPolicy_64 - { - KeyName="BitLocker policy"; - - //General encryption requirements - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")] - OsDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveEncryption; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")] - EncryptionMethod; - - //Required protectors properties - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")] - OsDriveProtector; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")] - FixedDataDriveAutoUnlock; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")] - FixedDataDrivePassphrase; - - //MBAM agent fields - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")] - MBAMPolicyEnforced; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")] - LastConsoleUser; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")] - UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")] - MBAMMachineError; - [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")] - EncodedComputerName; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_OperatingSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"OperatingSystemSKU"}] - uint32 SKU; - }; - - #pragma namespace ("\\\\.\\root\\cimv2") - #pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL) - [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"}, - dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")] - class CCM_ComputerSystemExtended - { - [PropertySources{"Name"},key] - string Name; - [PropertySources{"PCSystemType"}] - uint16 PCSystemType; - }; - - //======================================================= - // Microsoft BitLocker Administration and Monitoring end - //======================================================= - ``` - - -## Related topics - - -[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) - -[Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) - -[MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md b/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md deleted file mode 100644 index 8e285009f6..0000000000 --- a/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md +++ /dev/null @@ -1,113 +0,0 @@ ---- -title: Editing the MBAM 2.5 Group Policy Settings -description: Editing the MBAM 2.5 Group Policy Settings -author: dansimp -ms.assetid: a50b6b0c-6818-4419-8447-d0520a533dba -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Editing the MBAM 2.5 Group Policy Settings - - -To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM), you have to: - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskMore information

    Copy the MBAM 2.5 Group Policy Templates.

    Copying the MBAM 2.5 Group Policy Templates

    Determine which Group Policy Objects (GPOs) you want to use in your MBAM implementation. Based on the needs of your organization, you might have to configure additional Group Policy settings.

    Planning for MBAM 2.5 Group Policy Requirements – contains descriptions of the GPOs

    Set the Group Policy settings for your organization.

    - - - -**Important**   -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you. - - - -**To edit MBAM Client Group Policy settings** - -1. On a computer that has the MBAM Group Policy Templates installed, make sure that MBAM Services are enabled. - -2. Using the Group Policy Management Console (GPMC.msc) or the Microsoft Advanced Group Policy Management MDOP product on a computer with the MBAM Group Policy Templates installed, select **Computer configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)**. - -3. Edit the Group Policy settings that are required to enable MBAM Client services on client computers. For each policy in the following table, select **Policy Group**, click the **Policy** you want, and then configure the settings. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy GroupPolicy

    Client Management

    Configure MBAM Services

    Operating System Drive

    Operating system drive encryption settings

    Removable Drive

    Control use of BitLocker on removable drives

    Fixed Drive

    Control use of BitLocker on fixed drives

    - - - -## Related topics - - -[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) - -[Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md b/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md deleted file mode 100644 index 67c54060da..0000000000 --- a/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md +++ /dev/null @@ -1,413 +0,0 @@ ---- -title: Evaluating MBAM 2.5 in a Test Environment -description: Evaluating MBAM 2.5 in a Test Environment -author: dansimp -ms.assetid: 72959b7a-e55f-4797-91b3-5be23c8c2844 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Evaluating MBAM 2.5 in a Test Environment - - -This topic describes how you can set up a test environment to evaluate Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 in the Stand-alone or System Center Configuration Manager Integration topology. - -## Evaluating MBAM 2.5 by using the Stand-alone topology - - -To evaluate MBAM by using the Stand-alone topology, use the information in the following tables to install the MBAM Server software, and then configure the MBAM Server features in your test environment. - -**To evaluate MBAM 2.5 by using the Stand-alone topology** - -1. Before installing MBAM, do the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskWhere to get instructions

    Ensure that you have installed all of the prerequisite software.

    MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies

    Check the required hardware, RAM, and other specifications.

    MBAM 2.5 Supported Configurations

    Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM.

    Configuring MBAM 2.5 Server Features by Using Windows PowerShell

    - - - -2. Install the MBAM Server software, and then configure the features you want. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskWhere to get instructions

    Install the MBAM Server software on each server where you want to configure an MBAM Server feature.

    Installing the MBAM 2.5 Server Software

    Configure the Compliance and Audit Database and the Recovery Database.

    How to Configure the MBAM 2.5 Databases

    Configure the Reports feature.

    How to Configure the MBAM 2.5 Reports

    Configure the web applications.

    How to Configure the MBAM 2.5 Web Applications

    - - - -3. On a client computer, do the following: - - 1. Install the MBAM Client on a client computer. - - 2. Apply the MBAM Group Policy Objects (GPOs) to the computer. - - 3. Set the following registry keys to force the MBAM Client to wake up faster and at regular intervals: - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement - "ClientWakeupFrequency"=dword:00000001 - "StatusReportingFrequency"=dword:00000001 - ``` - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM] - "NoStartupDelay"=dword:00000001 - ``` - - **Note** - Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in a test environment. - - - - 4. Restart the **BitLocker Management Client Service**. - -## Evaluating MBAM 2.5 by using the System Center 2012 Configuration Manager Integration topology - - -To evaluate MBAM by using the Configuration Manager Integration topology, use the information in the following tables to install the MBAM Server software, and then configure the MBAM Server features in your test environment. After installing the MBAM Client on a client computer, you will complete additional steps to force the MBAM Client to report the computer’s status to MBAM more quickly. - -**To evaluate MBAM 2.5 by using the System Center 2012 Configuration Manager Integration topology** - -1. Before installing MBAM, review the prerequisite software and supported configuration. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskWhere to get instructions

    Ensure that you have installed all of the prerequisite software.

    MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies

    -

    MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology

    Check the required hardware, RAM, and other specifications.

    MBAM 2.5 Supported Configurations

    Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM.

    Configuring MBAM 2.5 Server Features by Using Windows PowerShell

    Create or edit the .mof files.

    Edit the Configuration.mof File

    -

    Create or Edit the Sms_def.mof File

    - - - -2. Install the MBAM Server software, and then configure the features you want. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskWhere to get instructions

    Install the MBAM Server software on each server where you want to configure an MBAM Server feature.

    -
    - Note

    You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.

    -
    -
    - -

    Installing the MBAM 2.5 Server Software

    Configure the Compliance and Audit Database and the Recovery Database.

    How to Configure the MBAM 2.5 Databases

    Configure the Reports feature.

    How to Configure the MBAM 2.5 Reports

    Configure the web applications.

    How to Configure the MBAM 2.5 Web Applications

    Configure the System Center Configuration Manager to install the Configuration Manager objects.

    How to Configure the MBAM 2.5 System Center Configuration Manager Integration

    - - - -3. On a client computer, do the following: - - 1. Install the MBAM Client and the Configuration Manager Client on a client computer. - - 2. Apply the MBAM Group Policy Objects to the computer. - - 3. Set the following registry keys to force the MBAM Client to wake up faster and at regular intervals: - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement - "ClientWakeupFrequency"=dword:00000001 - "StatusReportingFrequency"=dword:00000001 - ``` - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM] - "NoStartupDelay"=dword:00000001 - ``` - - **Note** - Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in a test environment. - - - - 4. Restart the **BitLocker Management Client Service**. - - 5. In Control Panel, open **Configuration Manager**, and then click the **Actions** tab. - - 6. Select **Hardware Inventory Cycle**, and then click **Run Now**. This step runs the hardware inventory by using the new classes that you imported to your .mof files, and then sends the data to the Configuration Manager server. - - 7. Select **Machine Policy Retrieval & Evaluation Cycle**, and then click **Run Now** to apply the Group Policy Objects that are relevant to that client computer. - - - -4. In the Configuration Manager console, do the following: - - 1. In the navigation pane, right-click **MBAM Supported Computers**, click **Update Membership**, and then click **Yes** to force the client computer to report its membership immediately. - - 2. In the navigation pane, click **MBAM Supported Computers** to verify that the client computer appears in the collection. - -5. On the client computer, in Control Panel, reopen **Configuration Manager** again, and do the following: - - 1. Click the **Actions** tab, and then rerun **Machine Policy Retrieval & Evaluation Cycle**. - - 2. Click the **Configurations** tab, select the BitLocker baseline, and then click **Evaluate**. - -6. In the Configuration Manager console, verify that the client computer appears on the Enterprise Compliance Report: as follows: - - 1. In the navigation pane, select the **Monitoring** workspace. - - 2. In the console tree, expand **Overview** > **Reporting** > **Reports** > **MBAM**. - - 3. Select the folder that represents the language in which you want to view reports, and then select the report in the results pane. - -## Evaluating MBAM 2.5 by using the System Center Configuration Manager 2007 Integration topology - - -To evaluate MBAM by using the Configuration Manager Integration topology, follow the same steps to install and configure MBAM in your test environment as you use in a production environment. After installing the MBAM Client on a client computer, complete the additional steps in this topic to enable the MBAM Client to start reporting the computer’s status to MBAM more quickly. - -**To evaluate MBAM by using the Configuration Manager 2007 Integration topology** - -1. Before you install MBAM, do the following: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskWhere to get instructions

    Ensure that you have installed all of the prerequisite software.

    MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies

    -

    MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology

    Check the required hardware, RAM, and other specifications.

    MBAM 2.5 Supported Configurations

    Create or edit the .mof files.

    Edit the Configuration.mof File

    -

    Create or Edit the Sms_def.mof File

    - - - -2. Install the MBAM Server software, and then configure the features you want. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskWhere to get instructions

    Install the MBAM Server software on each server where you want to configure an MBAM Server feature.

    -
    - Note

    You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.

    -
    -
    - -

    Installing the MBAM 2.5 Server Software

    Configure the Compliance and Audit Database and the Recovery Database.

    How to Configure the MBAM 2.5 Databases

    Configure the Reports feature.

    How to Configure the MBAM 2.5 Reports

    Configure the web applications.

    How to Configure the MBAM 2.5 Web Applications

    Configure the System Center Configuration Manager to install the Configuration Manager objects.

    How to Configure the MBAM 2.5 System Center Configuration Manager Integration

    - - - -3. On a client computer, do the following: - - 1. Install the MBAM Client on a client computer. - - 2. Apply the MBAM Group Policy Objects to the computer. - - 3. Set the following registry keys to force the MBAM Client to wake up more quickly and at faster intervals: - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement - "ClientWakeupFrequency"=dword:00000001 - "StatusReportingFrequency"=dword:00000001 - ``` - - ``` syntax - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM] - "NoStartupDelay"=dword:00000001 - ``` - - **Note** - Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in an evaluation environment. - - - - 4. Restart the **BitLocker Management Client Service**. - - 5. In Control Panel, open **Configuration Manager**, and then click the **Actions** tab. - - 6. Select **Machine Policy Retrieval & Evaluation Cycle**, and then click **Run Now** to apply the Group Policy Objects that are relevant to that client computer. - - 7. Select **Hardware Inventory Cycle**, and then click **Run Now**. This step runs the hardware inventory by using the new classes that you imported to your .mof files and then sends the data to the Configuration Manager server. - -4. In the Configuration Manager console, do the following: - - 1. In the navigation pane, right-click **MBAM Supported Computers**, click **Update Membership**, and then click **Yes** to force the client computer to report its membership immediately. - - 2. In the navigation pane, click **MBAM Supported Computers** to verify that the client computer appears in the collection. - -5. On the client computer, in Control Panel, reopen **Configuration Manager** again, and do the following: - - 1. Click the **Actions** tab, and then rerun **Machine Policy Retrieval & Evaluation Cycle**. - - 2. Click the **Configurations** tab, select the BitLocker baseline, and click **Evaluate**. - -6. In the Configuration Manager console, verify that the client computer appears on the Enterprise Compliance Report, as follows - - 1. In the navigation pane, expand **Computer Management** > **Reporting** > **Reporting Services** > **<server name>MBAM**. - - 2. Within the **MBAM** node, select the folder that represents the language in which you want to view reports, and then select the report from the results pane. - - -## Related topics - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md b/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md deleted file mode 100644 index 9fe1680548..0000000000 --- a/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: Generating MBAM 2.5 Stand-alone Reports -description: Generating MBAM 2.5 Stand-alone Reports -author: dansimp -ms.assetid: 0ec623ff-5155-4906-aef2-20cdc0f84667 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# Generating MBAM 2.5 Stand-alone Reports - - -When you configure Microsoft BitLocker Administration and Monitoring (MBAM) with the Stand-alone topology, you can generate reports to monitor BitLocker drive encryption usage and compliance. This topic contains the following procedures: - -- [To open the Administration and Monitoring Website](#bkmk-openadmin) - -- [To generate an Enterprise Compliance Report](#bkmk-enterprise) - -- [To generate a Computer Compliance Report](#bkmk-computercomp) - -- [To generate a Recovery Key Audit Report](#bkmk-recoverykey) - -For descriptions of the Stand-alone reports, see [Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md). - -**Note**   -To run the reports, you must be a member of the **MBAM Report Users** group, which you configure in Active Directory Domain Services. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md). - - - -**To open the Administration and Monitoring Website** - -1. Open a web browser and navigate to the Administration and Monitoring Website. The default URL for the Administration and Monitoring Website is: - - *http(s)://<MBAMAdministrationServerName>:<port>/Helpdesk* - -2. In the left pane, click **Reports**. From the top menu bar, select the report you want to run. - - MBAM client data is retained in the Compliance and Audit Database for historical reference in case a computer is lost or stolen. When running enterprise reports, we recommend that you use appropriate start and end dates to scope the time frames for the reports from one to two weeks to increase reporting data accuracy. - - After you generate a report, you can save the results in different formats, such as HTML, Microsoft Word, and Microsoft Excel. - - **Note**   - Configure SQL Server Reporting Services (SSRS) to use Secure Sockets Layer (SSL) before configuring the Administration and Monitoring Website. If, for any reason, SSRS is not configured to use SSL, the URL for the Reports will be set to HTTP instead of to HTTPS when you configure the Administration and Monitoring Website. If you then go to the Administration and Monitoring Website and select a report, the following message displays: “Only Secure Content is Displayed.” To show the report, click **Show All Content**. - - - -**To generate an Enterprise Compliance Report** - -1. From the Administration and Monitoring Website, select the **Reports** node from the left navigation pane, select **Enterprise Compliance Report**, and select the filters that you want to use. The available filters for the Enterprise Compliance Report are: - - - **Compliance Status**. Use this filter to specify the compliance status types of the report (for example, Compliant or Noncompliant). - - - **Error State**. Use this filter to specify the error state types of the report (for example, No Error or Error). - -2. Click **View Report** to display the selected report. - -3. Select a computer name to view information about the computer in the Computer Compliance Report. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - -**To generate a Computer Compliance Report** - -1. From the Administration and Monitoring Website, select the **Report** node from the left navigation pane, and then select **Computer Compliance Report**. Use the Computer Compliance Report to search for **User name** or **Computer name**. - -2. Click **View Report** to view the Computer Compliance Report. - -3. Select a computer name to display more information about the computer in the Computer Compliance Report. - -4. Select the plus sign (+) next to the computer name to view information about the volumes on the computer. - - **Note**   - An MBAM client computer is considered compliant if the computer matches or exceeds the requirements of the MBAM Group Policy settings. - -**To generate a Recovery Key Audit Report** - -1. From the Administration and Monitoring Website, select the **Report** node in the left navigation pane, and then select **Recovery Audit Report**. Select the filters for your Recovery Key Audit Report. The available filters for recovery key audits are as follows: - - - **Helpdesk User**. This filter enables users to specify the user name of the requester. The requester is the person in the Help Desk who accessed the key on behalf of an end user. - - - **End User**. This filter enables users to specify the user name of the requestee. The requestee is the end user who called the Help Desk to obtain a recovery key. - - - **Request Result**. This filter enables users to specify the request result types (for example, Success or Failed) that they want to base the report on. For example, users may want to view failed key access attempts. - - - **Key Type**. This filter enables users to specify the key type (for example, Recovery Key Password or TPM Password Hash) that they want to base the report on. - - - **Start Date**. This filter is used to define the Start Date part of the date range that the user wants to report on. - - - **End Date**. This filter is used to define the End Date part of the date range that the users want to report on. - -2. Click **View Report** to view the report. - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - -[Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/getting-started-with-mbam-25.md b/mdop/mbam-v25/getting-started-with-mbam-25.md deleted file mode 100644 index 27038fd66a..0000000000 --- a/mdop/mbam-v25/getting-started-with-mbam-25.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Getting Started with MBAM 2.5 -description: Getting Started with MBAM 2.5 -author: dansimp -ms.assetid: 23d0cfbb-e2ef-4c34-bf29-1b7ab4c48f00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started with MBAM 2.5 - - -This topic provides a list of links to help you learn about Microsoft BitLocker Administration and Monitoring (MBAM) 2.5, its purpose, features, recommended architecture, and steps for evaluating MBAM in a test environment. - -See the following resources for additional MBAM documentation: - -- [Microsoft BitLocker Administration and Monitoring Deployment Guide](https://go.microsoft.com/fwlink/?LinkId=396653) - -Before you deploy MBAM to a production environment, we recommend that you validate your deployment plan in a test environment. - -## Getting started with MBAM 2.5 - - -Before you start planning your MBAM deployment, review the following topics. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Topic descriptionLinks to topics

    High-level overview of MBAM 2.5 that describes how you can use it in your organization.

    About MBAM 2.5

    Release notes, which lists known issues in the product.

    Release Notes for MBAM 2.5

    Information about how you can evaluate MBAM 2.5 in a test environment.

    Evaluating MBAM 2.5 in a Test Environment

    Description of the MBAM 2.5 features and the recommended architecture of the Stand-alone and Configuration Manager Integration topologies in a production environment.

    High-Level Architecture for MBAM 2.5

    Description and illustration of each MBAM Server feature, without the recommended architecture.

    Illustrated Features of an MBAM 2.5 Deployment

    Describes the keyboard shortcuts that are available for MBAM 2.5.

    Accessibility for MBAM 2.5

    - - - -## How to get MDOP technologies - - -MBAM 2.5 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and about acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). - -## Other resources for this product - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md b/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md deleted file mode 100644 index 5ef9f09421..0000000000 --- a/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Hiding the Default BitLocker Drive Encryption Item in Control Panel -description: Hiding the Default BitLocker Drive Encryption Item in Control Panel -author: dansimp -ms.assetid: 6e2a9a02-a809-43a1-80a3-1b03c7192c89 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Hiding the Default BitLocker Drive Encryption Item in Control Panel - - -This topic describes how to hide the **BitLocker Drive Encryption** Control Panel item, which appears by default on Control Panel as part of the Windows operating system. - -**Note**   -Microsoft BitLocker Administration and Monitoring (MBAM) creates an additional, custom Control Panel item, called **BitLocker Encryption Options**, which enables end users to manage their PIN and password, turn on BitLocker for a drive, and check encryption. - - - -See [Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) to read about: - -- Differences between the MBAM and the default Control Panel items - -- **Manage BitLocker** shortcut menu that appears when you right-click a drive in Windows Explorer - -**Important**   -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node. If you do, MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you. - - - -**To hide the default BitLocker Drive Encryption item in Control Panel** - -1. In the Group Policy Management Console (GPMC) or in Advanced Group Policy Management, browse to **User configuration** > **Policies** > **Administrative Templates** > **Control Panel**. - -2. In the **Details** pane, double-click **Hide specified Control Panel items**, and then click **Enabled**. - -3. Click **Show**, click **Add**, and then type **Microsoft.BitLockerDriveEncryption**. - - - -## Related topics - - -[Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) - -[Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/high-level-architecture-for-mbam-25.md b/mdop/mbam-v25/high-level-architecture-for-mbam-25.md deleted file mode 100644 index 10db3f3710..0000000000 --- a/mdop/mbam-v25/high-level-architecture-for-mbam-25.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: High-Level Architecture for MBAM 2.5 -description: High-Level Architecture for MBAM 2.5 -author: dansimp -ms.assetid: b42af25c-961b-4a6a-92d2-916a373eb68b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture for MBAM 2.5 - - -Microsoft BitLocker Administration and Monitoring can be deployed in a Stand-alone topology, where you run MBAM as a stand-alone product, or in a topology that is integrated with System Center 2012 R2 Configuration Manager, System Center 2012 Configuration Manager, or Microsoft System Center Configuration Manager 2007. The high-level architecture information describes and illustrates the recommended architecture and servers for each topology and the features that you configure on each server. - -## High-level architecture information - - -- [High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md) - - This section describes and illustrates the recommended MBAM architecture for the MBAM Stand-alone topology. It also lists the servers and the features that you configure on the servers. - -- [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md) - - This section describes and illustrates the recommended MBAM architecture for the System Center Configuration Manager Integration topology. It also lists the servers and the features that you configure on the servers. - -## Other resources - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md b/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md deleted file mode 100644 index 3f47fccbd0..0000000000 --- a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md +++ /dev/null @@ -1,297 +0,0 @@ ---- -title: High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology -description: High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology -author: dansimp -ms.assetid: 075bafa1-792b-4c24-9d8e-5d3153e2112c -ms.reviewer: -manager: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/23/2018 -ms.author: dansimp ---- - - -# High-level architecture of MBAM 2.5 with Configuration Manager Integration topology - -This topic describes the recommended architecture for deploying Microsoft BitLocker Administration and Monitoring (MBAM) with the Configuration Manager Integration topology. This topology integrates MBAM with System Center Configuration Manager. To deploy MBAM with the Stand-alone topology, see [High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md). - -For a list of the supported versions of the software mentioned in this topic, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -**Important**   -Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007. - - - -## Recommended number of servers and supported number of clients - - -The recommended number of servers and supported number of clients in a production environment is as follows: - - ---- - - - - - - - - - - - - - - - - -
    Recommended architectureDetails

    Number of servers and other computers

    Three servers

    -

    One workstation

    Number of client computers supported

    500,000

    - - - -## Differences between Configuration Manager Integration and stand-alone topologies - - -The main differences between the topologies are: - -- The compliance and reporting features are removed from MBAM and are accessed from Configuration Manager. - -- Reports are viewed from the Configuration Manager Management Console, with the exception of the Recovery Audit Report, which you continue to view from the MBAM Administration and Monitoring Website. - -## Recommended MBAM high-level architecture with the Configuration Manager Integration topology - - -The following diagram and table describe the recommended high-level architecture for MBAM with the Configuration Manager Integration topology. MBAM multi-forest deployments require a one-way or two-way trust. One-way trusts require that the server domain trusts the client domain. - -![mbam2\-5](images/mbam2-5-cmserver.png) - -### Database server - -#### Recovery database - -This feature is configured on a computer running Windows Server and supported SQL Server instance. - -The **Recovery Database** stores recovery data that is collected from MBAM Client computers. - -#### Audit database - -This feature is configured on a computer running Windows Server and supported SQL Server instance. - -The **Audit Database** stores audit activity data that is collected from client computers that have accessed recovery data. - -#### Reports - -This feature is configured on a computer running Windows Server and supported SQL Server instance. - -The **Reports** provide recovery audit data for the client computers in your enterprise. You can view reports from the Configuration Manager console or directly from SQL Server Reporting Services. - -### Configuration Manager primary site server - -System Center Configuration Manager Integration feature - -- This feature is configured on the Configuration Manager Primary Site Server, which is the top-tier server in your Configuration Manager infrastructure. - -- The **Configuration Manager Server** collects the hardware inventory information from client computers and is used to report BitLocker compliance of client computers. - -- When you run the Microsoft BitLocker Administration and Monitoring Setup wizard to install the server software, the MBAM Supported Computers collection, configuration baseline, and reports are configured on the Configuration Manager Primary Site Server. - -- The **Configuration Manager console** must be installed on the same computer on which you install the MBAM Server software. - -### Administration and monitoring server - -#### Administration and monitoring website - -This feature is configured on a computer running Windows Server. - -The **Administration and monitoring website** is used to: - -- Help end users regain access to their computers when they are locked out. (This area of the Website is commonly called the Help Desk.) - -- View the Recovery Audit Report, which shows recovery activity for client computers. Other reports are viewed from the Configuration Manager console. - -#### Self-service portal - -This feature is configured on a computer running Windows Server. - -The **Self-Service Portal** is a website that enables end users on client computers to independently log on to a website to get a recovery key if they lose or forget their BitLocker password. - -#### Monitoring web services for this website - -This feature is installed on a computer running Windows Server. - -The **monitoring web services** are used by the MBAM Client and the websites to communicate to the database. - -**Important**
    The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM websites communicate directly with the Recovery Database. - - - -### Management workstation - -#### MBAM group policy templates - -- The **MBAM Group Policy Templates** are Group Policy settings that define implementation settings for MBAM, which enable you to manage BitLocker drive encryption. - -- Before you run MBAM, you must download the Group Policy Templates from [How to Get MDOP Group Policy (.admx) Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941) and copy them to a server or workstation that is running a supported Windows Server or Windows operating system. - - **NOTE**
    The workstation does not have to be a dedicated computer. - - - -### MBAM Client and Configuration Manager Client computer - -#### MBAM Client software - -The **MBAM Client**: - -- Uses Group Policy Objects to enforce BitLocker drive encryption on client computers in the enterprise. - -- Collects the BitLocker recovery key for three data drive types: operating system drives, fixed data drives, and removable (USB) data drives. - -- Collects recovery information and computer information about the client computers. - -#### Configuration Manager Client - -The **Configuration Manager Client** enables Configuration Manager to collect hardware compatibility data about the client computers and report compliance information. - - - -## Differences in MBAM deployment for supported Configuration Manager versions - - -When you deploy MBAM with the Configuration Manager Integration topology, you can install MBAM on a primary site server. However, the MBAM installation works differently for System Center 2012 Configuration Manager and Configuration Manager 2007. - - ---- - - - - - - - - - - - - - - - - -
    Configuration Manager versionDescription

    System Center 2012 R2 Configuration Manager

    -

    System Center 2012 Configuration Manager

    If you install MBAM on a primary site server or on a central administration server, MBAM performs all of the installation actions on that site server.

    Configuration Manager 2007 R2

    -

    Configuration Manager 2007

    If you install MBAM on a primary site server that is part of a larger Configuration Manager hierarchy with a central site parent server, MBAM identifies the central site parent server and performs all of the installation actions on that parent server. The installation includes checking prerequisites and installing the Configuration Manager objects and reports.

    -

    For example, if you install MBAM on a primary site server that is a child of a central site parent server, MBAM installs all of the Configuration Manager objects and reports on the parent server. If you install MBAM on the parent server, MBAM performs all of the installation actions on that parent server.

    - - - -## How MBAM works with Configuration Manager - - -The integration of MBAM with Configuration Manager is based on a configuration pack that installs the items described in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Items installed into Configuration ManagerDescription

    Configuration data

    The configuration data installs a configuration baseline, called “BitLocker Protection,” which contains two configuration items:

    -
      -
    • BitLocker Operating System Drive Protection

    • -
    • BitLocker Fixed Data Drives Protection

    • -
    -

    The configuration baseline is deployed to the MBAM Supported Computers collection, which is also created when MBAM is installed.

    -

    The two configuration items provide the basis for evaluating the compliance status of the client computers. This information is captured, stored, and evaluated in Configuration Manager.

    -

    The configuration items are based on the compliance requirements for operating system drives and fixed data drives. The required details for the deployed computers are collected so that the compliance for those drive types can be evaluated.

    -

    By default, the configuration baseline evaluates the compliance status every 12 hours and sends the compliance data to Configuration Manager.

    MBAM Supported Computers collection

    MBAM creates a collection that is called MBAM Supported Computers. The configuration baseline is targeted to client computers that are in this collection.

    -

    This is a dynamic collection. By default, it runs every 12 hours and evaluates membership, based on three criteria:

    -
      -
    • The computer is a supported version of the Windows operating system.

    • -
    • The computer is a physical computer. Virtual machines are not supported.

    • -
    • The computer has a Trusted Platform Module (TPM) that is available. A compatible version of TPM 1.2 or later is required for Windows 7. Windows 10, Windows 8.1, Windows 8, and Windows To Go do not require a TPM.

    • -
    -

    The collection is evaluated against all computers and a subset of compatible computers is created, which provides the basis for compliance evaluation and reporting for the MBAM integration.

    Reports

    When you configure MBAM with the Configuration Manager Integration topology, you view all reports in Configuration Manager, except the Recovery Audit Report, the latter of which you continue to view in the MBAM Administration and Monitoring Website. The reports available in Configuration Manager are:

    - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ReportDescription

    BitLocker Enterprise Compliance Dashboard

    Gives IT administrators three views of information in a single report: Compliance Status Distribution, Non Compliant – Errors Distribution, and Compliance Status Distribution By Drive Type. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the selected state.

    BitLocker Enterprise Compliance Details

    Lets IT administrators view information about the BitLocker encryption compliance status of the enterprise and includes the compliance status for each computer. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the selected state.

    BitLocker Computer Compliance

    Lets IT administrators view an individual computer and determine why it was reported with a status of compliant or not compliant. The report also displays the encryption state of the operating system drives and fixed data drives.

    BitLocker Enterprise Compliance Summary

    Lets IT administrators view the status of MBAM policy compliance in the enterprise. Each computer’s state is evaluated, and the report shows a summary of the compliance of all computers in the enterprise against the policy. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the selected state.

    -

     

    - - - - -## Related topics - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md) - -[Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md b/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md deleted file mode 100644 index 48a70ddaaa..0000000000 --- a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md +++ /dev/null @@ -1,161 +0,0 @@ ---- -title: High-Level Architecture of MBAM 2.5 with Stand-alone Topology -description: High-Level Architecture of MBAM 2.5 with Stand-alone Topology -author: dansimp -ms.assetid: 35f8c5f6-8be3-443d-baf0-56d68b08f3bc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# High-Level Architecture of MBAM 2.5 with Stand-alone Topology - - -This topic describes the recommended architecture for deploying Microsoft BitLocker Administration and Monitoring (MBAM) with the Configuration Manager Stand-alone topology. In this topology, MBAM is deployed as a stand-alone product. You can alternatively deploy MBAM with the Configuration Manager Integration topology, which integrates MBAM with Configuration Manager. For more information, see [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md). - -For a list of the supported versions of the software mentioned in this topic, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -**Note**   -We recommend you use a single-server architecture in test environments only. - - - -## Recommended number of servers and supported number of clients - - -The recommended number of servers and supported number of clients in a production environment is as follows: - - ---- - - - - - - - - - - - - - - - - -
    Recommended architecture in a production environmentDetails

    Number of servers and other computers

    Two servers

    -

    One workstation

    Number of client computers supported

    500,000

    - - - -## Recommended MBAM high-level architecture with the Stand-alone topology - - -The following diagram and table describe the recommended high-level, two-server architecture for MBAM with the Stand-alone topology. MBAM multi-forest deployments require a one-way or two-way trust. One-way trusts require that the server domain trusts the client domain. - -![mbam2](images/mbam2-5-2servers.png) - -Server -Features to configure on this server -Description -Database server - -Compliance and Audit Database - -This feature is configured on a server running Windows Server and supported SQL Server instance. - -The **Compliance and Audit Database** stores compliance data, which is used primarily for reports that SQL Server Reporting Services hosts. - -Recovery Database - -This feature is configured on a server running Windows Server and supported SQL Server instance. - -The **Recovery Database** stores recovery data that is collected from MBAM client computers. - -Reports - -This feature is configured on a server running Windows Server and supported SQL Server instance. - -The **Reports** provide recovery audit and compliance status data about the client computers in your enterprise. You can access the reports from the Administration and Monitoring Website or directly from SQL Server Reporting Services. - -Administration and Monitoring Server - -Administration and Monitoring Website - -This feature is configured on a computer running Windows Server. - -The **Administration and Monitoring Website** is used to: - -- Help end users regain access to their computers when they are locked out. (This area of the Website is commonly called the Help Desk.) - -- View reports that show compliance status and recovery activity for client computers. - -Self-Service Portal - -This feature is configured on a computer running Windows Server. - -The **Self-Service Portal** is a website that enables end users on client computers to independently log on to a website to get a recovery key if they lose or forget their BitLocker password. - -Monitoring web services for this website - -This feature is configured on a computer running Windows Server. - -The **monitoring web services** are used by the MBAM Client and the websites to communicate to the database. - -**Important**   -The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM websites communicate directly with the Recovery Database. - - - -Management workstation - -MBAM Group Policy Templates - -- The MBAM Group Policy Templates are Group Policy settings that define implementation settings for MBAM, which enable you to manage BitLocker Drive Encryption. - -- Before you run MBAM, you must download the Group Policy Templates from [How to Get MDOP Group Policy (.admx) Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941) and copy them to a server or workstation that is running a supported Windows Server or Windows operating system. - -- The workstation does not have to be a dedicated computer. - -MBAM Client and Configuration Manager client computer - -MBAM Client software - -The MBAM Client: - -- Uses Group Policy Objects to enforce BitLocker Drive Encryption on client computers in the enterprise. - -- Collects the Bitlocker recovery key for three data drive types: operating system drives, fixed data drives, and removable (USB) data drives. - -- Collects recovery information and computer information about the client computers. - - - -## Related topics - - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md) - -[Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md deleted file mode 100644 index 1c818b89dc..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md +++ /dev/null @@ -1,237 +0,0 @@ ---- -title: How to Configure the MBAM 2.5 Databases -description: How to Configure the MBAM 2.5 Databases -author: dansimp -ms.assetid: 66e1c81b-f785-4398-9175-bb5f112c2a35 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the MBAM 2.5 Databases - - -This topic explains how to configure the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Compliance and Audit Database and the Recovery Database by using: - -- A Windows PowerShell cmdlet - -- The MBAM Server Configuration wizard - -The instructions are based on the recommended architecture in [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - -**Before you start the configuration:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepWhere to get instructions

    Review the recommended architecture for MBAM.

    High-Level Architecture for MBAM 2.5

    Review the supported configurations for MBAM.

    MBAM 2.5 Supported Configurations

    Complete the required prerequisites on each server.

    Install the MBAM Server software on each server where you plan to configure an MBAM Server feature.

    -
    -Note

    You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.

    -
    -
    - -

    Installing the MBAM 2.5 Server Software

    Review the prerequisites for using Windows PowerShell if you plan to use Windows PowerShell cmdlets to configure MBAM Server features.

    Configuring MBAM 2.5 Server Features by Using Windows PowerShell

    - - - -**To configure the databases by using Windows PowerShell** - -1. Before you start the configuration, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the **Enable-MbamDatabase** Windows PowerShell cmdlet to configure the databases. To get information about this Windows PowerShell cmdlet, type **Get-Help Enable-MbamDatabase**. - -**To configure the Compliance and Audit Database by using the wizard** - -1. On the server where you want to configure the databases, start the **MBAM Server Configuration** wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard. - -2. Click **Add New Features**, select **Compliance and Audit Database** and **Recovery Database**, and then click **Next**. The wizard checks that all prerequisites for the databases have been met. - -3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**. - -4. Using the following descriptions, enter the field values in the wizard: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    SQL Server name

    Name of the server where you are configuring the Compliance and Audit Database.

    -
    - Note

    You must add an exception on the Compliance and Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.

    -
    -
    - -

    SQL Server database instance

    Name of the database instance where the compliance and audit data will be stored. You must also specify where the database information will be located.

    Database name

    Name of the database that will store the compliance data.

    -
    - Note

    If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment.

    -
    -
    - -

    Read/write access domain user or group

    Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.

    -

    If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.

    -

    If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.

    Read-only access domain user or group

    Name of the user or group that will have read-only permission to this database to enable the reports to access the compliance data in this database.

    -

    If you enter a user in this field, it must be the same user as the one you specify in the Compliance and Audit Database domain account field on the Configure Reports page.

    -

    If you enter a group in this field, the value that you specify in the Compliance and Audit Database domain account field on the Configure Reports page must be a member of the group that you specify in this field.

    - - - -5. Continue to the next section to configure the Recovery Database. - -**To configure the Recovery Database by using the wizard** - -1. Using the following descriptions, enter the field values in the wizard: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    SQL Server name

    Name of the server where you are configuring the Recovery Database.

    -
    - Note

    You must add an exception on the Recovery Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.

    -
    -
    - -

    SQL Server database instance

    Name of the database instance where the recovery data will be stored. You must also specify where the database information will be located.

    Database name

    Name of the database that will store the recovery data.

    -
    - Note

    If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment.

    -
    -
    - -

    Read/write access domain user or group

    Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.

    -

    If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.

    -

    If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.

    - - - -2. When you finish your entries, click **Next**. - - The wizard checks that all prerequisites for the databases have been met. - -3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Next** again. - -4. On the **Summary** page, review the features that will be added. - - **Note** - To create a Windows PowerShell script of the entries that you just made, click **Export PowerShell Script**, and then save the script. - - - -5. Click **Add** to add the MBAM databases on the server, and then click **Close**. - - - -## Related topics - - -[Server Event Logs](server-event-logs.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md deleted file mode 100644 index b76b25843c..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: How to Configure the MBAM 2.5 Reports -description: How to Configure the MBAM 2.5 Reports -author: dansimp -ms.assetid: ec462879-0253-4d9c-83c7-a9bcad479725 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the MBAM 2.5 Reports - - -This topic explains how to configure the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Reports feature by using: - -- A Windows PowerShell cmdlet - -- The MBAM Server Configuration wizard - -The instructions are based on the recommended architecture in [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - -**Before you start the configuration:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepWhere to get instructions

    Review the recommended architecture for MBAM.

    High-Level Architecture for MBAM 2.5

    Review the supported configurations for MBAM.

    MBAM 2.5 Supported Configurations

    Complete the required prerequisites on each server.

    Install the MBAM Server software on each server where you plan to configure an MBAM Server feature.

    Installing the MBAM 2.5 Server Software

    Review the prerequisites for using Windows PowerShell if you plan to use Windows PowerShell cmdlets to configure MBAM Server features.

    Configuring MBAM 2.5 Server Features by Using Windows PowerShell

    - - - -**To configure the Reports by using Windows PowerShell** - -1. Before you start the configuration, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the **Enable-MbamReport** Windows PowerShell cmdlet to configure the Reports. To get information about this Windows PowerShell cmdlet, type **Get-Help Enable-MbamReport**. - -**To configure the Reports by using the wizard** - -1. On the server where you want to configure the Reports, start the **MBAM Server Configuration** wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard. - -2. Click **Add New Features**, select **Reports**, and then click **Next**. The wizard checks that all prerequisites for the Reports have been met. - -3. Click **Next** to continue. - -4. Using the following descriptions, enter the field values in the wizard: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    SQL Server Reporting Services instance

    Instance of SQL Server Reporting Services where the Reports will be configured.

    Reporting role domain group

    Name of the domain Users group whose members have rights to access the reports on the Administration and Monitoring Server.

    SQL Server name

    Name of the server where the Compliance and Audit Database is configured.

    SQL Server database instance

    Name of the instance of SQL Server (for example, MSSQLSERVER) where the Compliance and Audit Database is configured.

    -
    - Note

    You must add an exception on the Reports computer to enable inbound traffic on the port of the Reporting Server (the default port is 80).

    -
    -
    - -

    Database name

    Name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, although you can change the name when you configure the Compliance and Audit Database.

    -
    - Note

    If you are upgrading from a previous version of MBAM, you must use the same database name as the name used in your previous deployment.

    -
    -
    - -

    Compliance and Audit Database domain account

    Domain user account and password to access the Compliance and Audit Database.

    -

    If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a user, you must enter that same value in this field.

    -

    If the value that you enter in the Read-only access domain user or group field on the Configure Databases page is a group, the value that you enter in this field must be a member of that group.

    -

    Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group.

    - - - -5. When you finish your entries, click **Next**. - - The wizard checks that all prerequisites for the Reports feature have been met. - -6. Click **Next** to continue. - -7. On the **Summary** page, review the features that will be added. - - **Note** - To create a Windows PowerShell script of the entries that you just made, click **Export PowerShell Script**, and then save the script. - - - -8. Click **Add** to add the Reports on the server, and then click **Close**. - - - -## Related topics - - -[Server Event Logs](server-event-logs.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md deleted file mode 100644 index 38766dc323..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: How to Configure the MBAM 2.5 System Center Configuration Manager Integration -description: How to Configure the MBAM 2.5 System Center Configuration Manager Integration -author: dansimp -ms.assetid: 2b8a4c13-1dad-41e8-89ac-6889c5f7e051 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the MBAM 2.5 System Center Configuration Manager Integration - - -This topic explains how to configure Microsoft BitLocker Administration and Monitoring (MBAM) to use the System Center Configuration Manager Integration topology, which integrates MBAM with Configuration Manager. - -The instructions explain how to configure Configuration Manager Integration by using: - -- A Windows PowerShell cmdlet - -- The MBAM Server Configuration wizard - -The instructions are based on the recommended architecture in [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - -**Before you start the configuration:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepWhere to get instructions

    Review the recommended architecture for MBAM.

    High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology

    Review the supported configurations for MBAM.

    MBAM 2.5 Supported Configurations

    Complete the required prerequisites on each server.

    Install the MBAM Server software on each server where you will configure an MBAM Server feature.

    -
    -Note

    For this topology, you must install the Configuration Manager console on the computer where you are installing the MBAM Server software.

    -
    -
    - -

    Installing the MBAM 2.5 Server Software

    Review Windows PowerShell prerequisites (applicable only if you are going to use Windows PowerShell cmdlets to configure MBAM).

    Configuring MBAM 2.5 Server Features by Using Windows PowerShell

    - - - -**To configure Configuration Manager Integration by using Windows PowerShell** - -1. Before you start the configuration, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the **Enable-MbamCMIntegration** Windows PowerShell cmdlet to configure the Reports. To get information about this cmdlet, type **Get-Help Enable-MbamCMIntegration**. - -**To configure the System Center Configuration Manager Integration by using the wizard** - -1. On the server where you want to configure the System Center Configuration Manager Integration feature, start the MBAM Server Configuration wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard. - -2. Click **Add New Features**, select **System Center Configuration Manager Integration**, and then click **Next**. - - The wizard checks that all prerequisites for the Configuration Manager Integration have been met. - -3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**. - -4. Use the following descriptions to enter the field values in the wizard: - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    SQL Server Reporting Services server

    Fully qualified domain name (FQDN) of the server with the Reporting Service point role. This is the server to which the MBAM Configuration Manager Reports are deployed.

    -

    If you don’t specify a server, the Configuration Manager Reports will be deployed to the local server.

    SQL Server Reporting Services instance

    Name of the SQL Server Reporting Services (SSRS) instance where the Configuration Manager Reports are deployed.

    -

    If you don’t specify an instance, the Configuration Manager Reports will be deployed to the default SSRS instance name. The value you enter is ignored if the server has System Center 2012 Configuration Manager installed.

    - - - -5. On the **Summary** page, review the features that will be added. - - **Note** - To create a Windows PowerShell script of the entries you just made, click **Export PowerShell Script** and save the script. - - - -6. Click **Add** to add the Configuration Manager Integration feature to the server, and then click **Close**. - - - -## Related topics - - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md deleted file mode 100644 index dba8888b3b..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md +++ /dev/null @@ -1,430 +0,0 @@ ---- -title: How to Configure the MBAM 2.5 Web Applications -description: How to Configure the MBAM 2.5 Web Applications -author: dansimp -ms.assetid: 909bf2d3-028c-4ac1-9247-171532a1eeae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the MBAM 2.5 Web Applications - - -This topic explains how to configure the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 web applications for the recommended [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) by using one of the following methods: - -- A Windows PowerShell cmdlet - -- The MBAM Server Configuration wizard - -The web applications comprise the following websites and their corresponding web services: - - ---- - - - - - - - - - - - - - - - - -
    WebsiteDescription

    Administration and Monitoring Website

    Website where specified users can view reports and help end users recover their computers when they forget their PIN or password

    Self-Service Portal

    Website that end users can access to independently regain access to their computers if they forget their PIN or password

    - - - -**Before you start the configuration:** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepWhere to get instructions

    Review the recommended architecture for MBAM.

    High-Level Architecture for MBAM 2.5

    Review the supported configurations for MBAM.

    MBAM 2.5 Supported Configurations

    Complete the required prerequisites on each server.

    -
    -Note

    Ensure that you configure SQL ServerReporting Services (SSRS) to use the Secure Sockets Layer (SSL) before you configure the Administration and Monitoring Website. Otherwise, the Reports feature will use HTTP instead of HTTPS.

    -
    -
    - -

    Register service principal names (SPNs) for the application pool account for the websites. You need to do this step only if you do not have administrative domain rights in Active Directory Domain Services (AD DS). If you do have these rights in AD DS, MBAM will create the SPNs for you.

    Planning How to Secure the MBAM Websites

    Install the MBAM Server software on each server where you will configure an MBAM Server feature.

    -
    -Note

    If you plan to install the websites on one server and the web services on another, you will be able to configure them only by using the Enable-MbamWebApplication Windows PowerShell cmdlet. The MBAM Server Configuration wizard does not support configuring these items on separate servers.

    -
    -
    - -

    Installing the MBAM 2.5 Server Software

    Review the prerequisites for using Windows PowerShell if you plan to use cmdlets to configure MBAM Server features.

    Configuring MBAM 2.5 Server Features by Using Windows PowerShell

    - - - -**To configure the web applications by using Windows PowerShell** - -1. Before you start the configuration, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the **Enable-MbamWebApplication** cmdlet to configure the web applications using Windows PowerShell. To get information about this cmdlet, type **Get-Help Enable-MbamWebApplication**. - -**To configure the settings for all web applications using the wizard** - -1. On the server where you want to configure the web applications, start the MBAM Server Configuration wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard. - -2. Click **Add New Features**, select **Administration and Monitoring Website** and **Self-Service Portal**, and then click **Next**. The wizard checks that all prerequisites for the web applications have been met. - -3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**. - -4. Use the following descriptions to enter the field values in the wizard. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    Security certificate

    Select a previously created certificate to optionally encrypt the communication between the web services and the server on which you are configuring the websites. If you choose Do not use a certificate, your web communication may not be secure.

    Host name

    Name of the host computer where you are configuring the websites.

    Installation path

    Path where you are installing the websites.

    Port

    Port number to use for website and service communication.

    -
    - Note

    You must set a firewall exception to enable communication through the specified port.

    -
    -
    - -

    Web service application pool domain account and password

    Domain user account and password for the web service application pool.

    -

    If you enter a user name in the Read/write access domain user or group field on the Configure Databases page, you must enter that same value in this field.

    -

    If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group.

    -

    If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used.

    -
    - Important

    For improved security, set the account that is specified in the credentials to have limited user rights. Also, set the password of the account to never expire.

    -
    -
    - -
    - - - -5. Verify that the built-in IIS\_IUSRS account or the application pool account has been added to the **Impersonate a client after authentication** and the **Log on as a batch job** local security settings. - - To check whether it has been added to the local security settings, open the **Local Security Policy editor**, expand the **Local Policies** node, click the **User Rights Assignment** node, and double-click **Impersonate a client after authentication** and **Log on as a batch job** policies in the right pane. - -**To configure connection information for the databases by using the wizard** - -1. Use the following field descriptions to configure the connection information in the wizard for the Compliance and Audit Database. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    SQL Server name

    Name of the server where the Compliance and Audit Database is configured.

    SQL Server database instance

    SQL Server instance name where the Compliance and Audit Database is configured.

    Database name

    Name of the Compliance and Audit Database.

    - - - -2. Use the following field descriptions to configure the connection information in the wizard for the Recovery Database. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    SQL Server name

    Name of the server where the Recovery Database is configured.

    SQL Server database instance

    SQL Server instance name where the Recovery Database is configured.

    Database name

    Name of the Recovery Database.

    - - - -**To configure the web applications by using the wizard** - -1. Use the following descriptions to enter the field values in the wizard to configure the Administration and Monitoring Website. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    Advanced Helpdesk role domain group

    Domain user group whose members have access to all areas of the Administration and Monitoring Website except the Reports area.

    Helpdesk role domain group

    Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the Administration and Monitoring Website.

    Use System Center Configuration Manager Integration

    Select this check box if you are configuring MBAM with the Configuration Manager Integration topology. Selecting this check box makes all reports, except the Recovery Audit report, appear in Configuration Manager instead of in the Administration and Monitoring Website.

    Reporting role domain group

    Domain user group whose members have read-only access to the Reports area of the Administration and Monitoring Website.

    SQL Server Reporting Services URL

    URL for the SSRS server where the MBAM Reports are configured.

    -

    Examples of report URLs:

    - - - - - - - - - - - - - - - - - - - - - -
    Type of host nameExample

    Example with a fully qualified domain name

    https://MyReportServer.Contoso.com/ReportServer

    Example with a custom host name

    https://MyReportServer/ReportServer

    -

    Virtual directory

    Virtual directory of the Administration and Monitoring Website. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name, for example:

    -

    http(s)://<hostname>:<port>/HelpDesk/

    -

    If you do not specify a virtual directory, the value HelpDesk will be used.

    Data Migration role domain group (optional)

    Domain user group whose members have access to use the Write-Mbam*Information Cmdlets to write recovery information via this endpoint.

    - - - -2. Use the following description to enter the field values in the wizard to configure the Self-Service Portal. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription

    Virtual directory

    Virtual directory of the web application. This name corresponds to the website’s physical directory on the server, and is appended to the website’s host name, for example:

    -

    http(s)://<hostname>:<port>/SelfService/

    -

    If you do not specify a virtual directory, the value SelfService will be used.

    Company name

    Specify a company name for the Self-Service Portal, for example:

    -

    Contoso IT

    -

    This company name is viewed by all Self-Service Portal users.

    Helpdesk URL text

    Specify a text statement that directs users to your organization's Helpdesk website, for example:

    -

    Contact Helpdesk or IT department

    Helpdesk URL

    Specify the URL for your organization's Helpdesk website, for example:

    -

    http(s)://<companyHelpdeskURL>/

    Notice text file

    Select a file that contains the notice you want displayed to users on the Self-Service Portal landing page.

    Do not display notice text to users

    Select this check box to specify that the notice text is not displayed to users.

    - - - -3. When you finish your entries, click **Next**. - - The wizard checks that all prerequisites for the web applications have been met. - -4. Click **Next** to continue. - -5. On the **Summary** page, review the features that will be added. - - **Note** - To create a Windows PowerShell script for the entries you made, click **Export PowerShell Script** and save the script. - - - -6. Click **Add** to add the web applications to the server, and then click **Close**. - - To customize the Self-Service Portal by adding custom notice text, your company name, pointers to more information, and so on, see [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md). - -**To configure the Self-Service Portal if client computers cannot access the CDN** - -1. Determine whether you are running Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1. If so, do nothing. Your Self-Service Portal configuration is complete. - - **Note** - Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 installs the JavaScript files in setup, and so does not need to be connected to the Microsoft Ajax Content Delivery Network in order to configure the Self-Service Portal. The following steps are necessary only if you are using a version of Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 previous to SP1. - - - -2. Determine if your client computers have access to the Microsoft Ajax Content Delivery Network (CDN). - - The CDN gives the Self-Service Portal the access it requires to certain JavaScript files. If you don’t configure the Self-Service Portal when client computers cannot access the CDN, only the company name and the account under which the end user signed in will be displayed. No error message will be shown. - -3. Do one of the following: - - - If your client computers have access to the CDN, do nothing. Your Self-Service Portal configuration is complete. - - - If your client computers do not have access to the CDN, complete the steps in [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md). - - -## Related topics - - -[Server Event Logs](server-event-logs.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -[How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md) - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - -[Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md b/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md deleted file mode 100644 index c187bc1e3c..0000000000 --- a/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network -description: How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network -author: dansimp -ms.assetid: 90ee76db-9876-41b5-994a-118556d5ed3b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network - - -Follow these instructions if the client computers in your organization do not have access to the Microsoft Ajax Content Delivery Network (CDN). - -**Why you need to configure this:** - -Your client computers need access to the CDN, which gives the Self-Service Portal the required access to certain JavaScript files. If you don’t configure the Self-Service Portal when client computers cannot access CDN, only the company name and the account under which the end user logs in will be displayed. No error message will be shown. - -**Note**   -In MBAM 2.5 SP1, the JavaScript files are included in the product, and you do not need to follow the instructions in this section to configure the SSP to support clients that cannot access the internet. - - - -**How to configure the Self-Service Portal when client computers cannot access the CDN** - -1. Download the following JavaScript files from the CDN: - - - [jQuery-1.10.2.min.js](https://go.microsoft.com/fwlink/?LinkID=390515) - - - [jQuery.validate.min.js](https://go.microsoft.com/fwlink/?LinkID=390516) - - - [jQuery.validate.unobtrusive.min.js](https://go.microsoft.com/fwlink/?LinkID=390517) - -2. Copy the JavaScript files to the **Scripts** directory of the Self-Service Portal. This directory is located in <MBAM Self-Service Install Directory>\\Self Service Website\\Scripts. - -3. Open Internet Information Services (IIS) Manager. - -4. Expand **Sites** > **Microsoft BitLocker Administration and Monitoring**, and highlight **SelfService**. - - **Note** - *SelfService* is the default virtual directory name. If you chose a different name for this directory during the configuration, remember to replace *SelfService* in these instructions with the name you chose. - - - -5. In the middle pane, double-click **Application Settings**. - -6. For each item in the following list, edit the application settings to reference the new location by replacing /<*virtual directory*>/ with /SelfService/ (or whatever name you chose during configuration). For example, the virtual directory path will be similar to /selfservice/Scripts/ jQuery-1.10.2.min.js. - - - jQueryPath: /<*virtual directory*>/Scripts/jQuery-1.10.2.min.js - - - jQueryValidatePath: /<*virtual directory*>/Scripts/jQuery.validate.min.js - - - jQueryValidateUnobtrusivePath: /<*virtual directory*>/Scripts/jQuery.validate.unobtrusive.min.js - - - -## Related topics - - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md b/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md deleted file mode 100644 index 27bfffcf2d..0000000000 --- a/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: How to Deploy the MBAM Client by Using a Command Line -description: How to Deploy the MBAM Client by Using a Command Line -author: dansimp -ms.assetid: ac1d4ffe-c26d-41c9-9737-a4f2b37fde24 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client by Using a Command Line - - -You can use a command line to deploy the Microsoft BitLocker Administration and Monitoring (MBAM) Client software. - -## Command Line to deploy the MBAM Client software - - -Type the following command at the command prompt to automatically accept the end user license agreement when deploying the MBAM Client software. - -**MBAMClientSetup.exe /acceptEula=Yes** - -**Note**   -The **/ju** and **/jm** command-line options are not supported and cannot be used to install the MBAM Client software. - - - -Type the following command at the command prompt to extract and install the MSP: - -**MBAMClientSetup.exe /extract <path to extract MSI> /acceptEula=Yes** - -Then, install the MSI silently by running the following command: - -**msiexec /i <path to extracted MSI> /qb ALLUSERS=1 REBOOT=ReallySuppress** - -**Note**   -Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product, after accepting the EULA. - - - -## OPTIN\_FOR\_MICROSOFT\_UPDATES=1 command-line option - - -You can optionally specify the command-line option `OPTIN_FOR_MICROSOFT_UPDATES=1` during the Client software installation to automatically install Microsoft Updates on client computers. Specifying this option makes Microsoft Update automatically start and search for available updates to install after the Client software installation finishes. - -You can use this command-line option with either of the following installation methods. - - ---- - - - - - - - - - - - - - - - - -
    Install the MBAM Client software by usingExample

    MBAMClientSetup.exe

    MbamClientSetup.exe OPTIN_FOR_MICROSOFT_UPDATES=1

    msiexec /i MBAMClient.msi

    msiexec /i MBAMClient.msi OPTIN_FOR_MICROSOFT_UPDATES=1

    - - - - -## Related topics - - -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md b/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md deleted file mode 100644 index 04cb113b89..0000000000 --- a/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Deploy the MBAM Client to Desktop or Laptop Computers -description: How to Deploy the MBAM Client to Desktop or Laptop Computers -author: dansimp -ms.assetid: 3a7639e0-468e-4496-8be2-ed29b8e07c53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy the MBAM Client to Desktop or Laptop Computers - - -This topic explains how to deploy the MBAM Client to end users’ computers. You can deploy the MBAM Client through an electronic software distribution system, such as Active Directory Domain Services or Microsoft System Center Configuration Manager. - -To deploy the MBAM Client as part of a Windows deployment, see [How to Enable BitLocker by Using MBAM as Part of a Windows Deployment](how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md). - -Before you start the MBAM Client deployment, review the [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -**To deploy the MBAM Client to desktop or laptop computers** - -1. Locate the MBAM Client installation files that are provided with the MBAM software. - -2. Use Active Directory Domain Services or an enterprise software deployment tool like Microsoft System Center Configuration Manager to deploy the Windows Installer package to target computers. - -3. Configure the distribution settings or Group Policy settings to run the MBAM Client installation file. - - After successful installation, the MBAM Client applies the Group Policy settings that are received from a domain controller to begin BitLocker Drive Encryption and management functions. - - **Important**   - The MBAM Client does not start BitLocker Drive Encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed and a user must be logged on to a physical console session before BitLocker Drive Encryption begins. - - - - -## Related topics -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - -[Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md b/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md deleted file mode 100644 index 58fc45a61e..0000000000 --- a/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Determine BitLocker Encryption State of Lost Computers -description: How to Determine BitLocker Encryption State of Lost Computers -author: dansimp -ms.assetid: 4f4bec1b-df3e-40ee-b431-291440268d64 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Determine BitLocker Encryption State of Lost Computers - - -Use this procedure with the Administration and Monitoring Website to determine the following: - -- The last known BitLocker encryption status of lost or stolen computers - -- Whether the volumes on a lost or stolen computer were encrypted - -To complete this task, you need access to the **Reports** area of the Administration and Monitoring Website. To get access to this area, you must be assigned the MBAM Report Users role. You may have given these roles different names when you created them. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). - -**Note**   -Device compliance is determined by the BitLocker policies that your enterprise has deployed. You may want to verify your deployed policies before you try to determine the BitLocker encryption state of a device. - - - -**To determine the last known BitLocker encryption state of lost computers** - -1. Open a web browser and navigate to the **Administration and Monitoring Website**. - -2. In the left pane, select **Reports** to open the Reports page. - -3. Select the **Computer Compliance Report**. - -4. Use the filter fields in the right pane to narrow the search results, and then click **Search**. Results are shown under your search query. - -5. Take the appropriate action, as determined by your policy for lost devices. - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md deleted file mode 100644 index 1eacd30123..0000000000 --- a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md +++ /dev/null @@ -1,336 +0,0 @@ ---- -title: How to Enable BitLocker by Using MBAM as Part of a Windows Deployment -description: How to Enable BitLocker by Using MBAM as Part of a Windows Deployment -author: dansimp -ms.assetid: 7609ad7a-bb06-47be-b186-0a2db787c8a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/23/2017 ---- - - -# How to Enable BitLocker by Using MBAM as Part of a Windows Deployment - - -This topic explains how to enable BitLocker on an end user's computer by using MBAM as part of your Windows imaging and deployment process. If you see a black screen at restart (after Install phase concludes) indicating that the drive cannot be unlocked, see [Earlier Windows versions don't start after "Setup Windows and Configuration Manager" step if Pre-Provision BitLocker is used with Windows 10, version 1511](https://support.microsoft.com/en-us/help/4494799/earlier-windows-versions-don-t-start-after-you-use-pre-provision-bitlo). - -**Prerequisites:** - -- An existing Windows image deployment process – Microsoft Deployment Toolkit (MDT), Microsoft System Center Configuration Manager, or some other imaging tool or process – must be in place - -- TPM must be enabled in the BIOS and visible to the OS - -- MBAM server infrastructure must be in place and accessible - -- The system partition required by BitLocker must be created - -- The machine must be domain joined during imaging before MBAM fully enables BitLocker - -**To enable BitLocker using MBAM 2.5 SP1 as part of a Windows deployment** - -1. In MBAM 2.5 SP1, the recommended approach to enable BitLocker during a Windows Deployment is by using the `Invoke-MbamClientDeployment.ps1` PowerShell script. - - - The `Invoke-MbamClientDeployment.ps1` script enacts BitLocker during the imaging process. When required by BitLocker policy, the MBAM agent immediately prompts the domain user to create a PIN or password when the domain user first logs on after imaging. - - - Easy to use with MDT, System Center Configuration Manager, or standalone imaging processes - - - Compatible with PowerShell 2.0 or higher - - - Encrypt OS volume with TPM key protector - - - Fully support BitLocker pre-provisioning - - - Optionally encrypt FDDs - - - Escrow TPM OwnerAuth - For Windows 7, MBAM must own the TPM for escrow to occur. - For Windows 8.1, Windows 10 RTM and Windows 10 version 1511, escrow of TPM OwnerAuth is supported. - For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details. - - - Escrow recovery keys and recovery key packages - - - Report encryption status immediately - - - New WMI providers - - - Detailed logging - - - Robust error handling - - You can download the `Invoke-MbamClientDeployment.ps1` script from [Microsoft.com Download Center](https://www.microsoft.com/download/details.aspx?id=54439). This is the main script that your deployment system will call to configure BitLocker drive encryption and record recovery keys with the MBAM Server. - - **WMI deployment methods for MBAM:** The following WMI methods have been added in MBAM 2.5 SP1 to support enabling BitLocker by using the `Invoke-MbamClientDeployment.ps1` PowerShell script. - - **MBAM\_Machine WMI Class** - **PrepareTpmAndEscrowOwnerAuth:** Reads the TPM OwnerAuth and sends it to the MBAM recovery database by using the MBAM recovery service. If the TPM is not owned and auto-provisioning is not on, it generates a TPM OwnerAuth and takes ownership. If it fails, an error code is returned for troubleshooting. - - **Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details. - -| Parameter | Description | -| -------- | ----------- | -| RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. | - -Here are a list of common error messages: - -| Common return values | Error message | -| -------------------- | ------------- | -| **S_OK**
    0 (0x0) | The method was successful. | -| **MBAM_E_TPM_NOT_PRESENT**
    2147746304 (0x80040200) | TPM is not present in the computer or is disabled in the BIOS configuration. | -| **MBAM_E_TPM_INCORRECT_STATE**
    2147746305 (0x80040201) | TPM is not in the correct state (enabled, activated and owner installation allowed). | -| **MBAM_E_TPM_AUTO_PROVISIONING_PENDING**
    2147746306 (0x80040202) | MBAM cannot take ownership of TPM because auto-provisioning is pending. Try again after auto-provisioning is completed. | -| **MBAM_E_TPM_OWNERAUTH_READFAIL**
    2147746307 (0x80040203) | MBAM cannot read the TPM owner authorization value. The value might have been removed after a successful escrow. On Windows 7, MBAM cannot read the value if the TPM is owned by others. | -| **MBAM_E_REBOOT_REQUIRED**
    2147746308 (0x80040204) | The computer must be restarted to set TPM to the correct state. You might need to manually reboot the computer. | -| **MBAM_E_SHUTDOWN_REQUIRED**
    2147746309 (0x80040205) | The computer must be shut down and turned back on to set TPM to the correct state. You might need to manually reboot the computer. | -| **WS_E_ENDPOINT_ACCESS_DENIED**
    2151481349 (0x803D0005) | Access was denied by the remote endpoint. | -| **WS_E_ENDPOINT_NOT_FOUND**
    2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | -| **WS_E_ENDPOINT_FAILURE
    2151481357 (0x803D000F) | The remote endpoint could not process the request. | -| **WS_E_ENDPOINT_UNREACHABLE**
    2151481360 (0x803D0010) | The remote endpoint was not reachable. | -| **WS_E_ENDPOINT_FAULT_RECEIVED**
    2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | -| **WS_E_INVALID_ENDPOINT_URL** 2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. | - - **ReportStatus:** Reads the compliance status of the volume and sends it to the MBAM compliance status database by using the MBAM status reporting service. The status includes cipher strength, protector type, protector state and encryption state. If it fails, an error code is returned for troubleshooting. - - | Parameter | Description | - | --------- | ----------- | - | ReportingServiceEndPoint | A string specifying the MBAM status reporting service endpoint. | - - Here are a list of common error messages: - - | Common return values | Error message | - | -------------------- | ------------- | - | **S_OK**
    0 (0x0) | The method was successful | - | **WS_E_ENDPOINT_ACCESS_DENIED**
    2151481349 (0x803D0005) | Access was denied by the remote endpoint.| - | **WS_E_ENDPOINT_NOT_FOUND**
    2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | - | **WS_E_ENDPOINT_FAILURE**
    2151481357 (0x803D000F) | The remote endpoint could not process the request. | - | **WS_E_ENDPOINT_UNREACHABLE**
    2151481360 (0x803D0010) | The remote endpoint was not reachable. | - | **WS_E_ENDPOINT_FAULT_RECEIVED**
    2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | - | **WS_E_INVALID_ENDPOINT_URL**
    2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. | - - **MBAM\_Volume WMI Class** - **EscrowRecoveryKey:** Reads the recovery numerical password and key package of the volume and sends them to the MBAM recovery database by using the MBAM recovery service. If it fails, an error code is returned for troubleshooting. - - | Parameter | Description | - | --------- | ----------- | - | RecoveryServiceEndPoint | A string specifying the MBAM recovery service endpoint. | - - Here are a list of common error messages: - - | Common return values | Error message | - | -------------------- | ------------- | - | **S_OK**
    0 (0x0) | The method was successful | - | **FVE_E_LOCKED_VOLUME**
    2150694912 (0x80310000) | The volume is locked. | - | **FVE_E_PROTECTOR_NOT_FOUND**
    2150694963 (0x80310033) | A Numerical Password protector was not found for the volume. | - | **WS_E_ENDPOINT_ACCESS_DENIED**
    2151481349 (0x803D0005) | Access was denied by the remote endpoint. | - | **WS_E_ENDPOINT_NOT_FOUND**
    2151481357 (0x803D000D) | The remote endpoint does not exist or could not be located. | - | **WS_E_ENDPOINT_FAILURE**
    2151481357 (0x803D000F) | The remote endpoint could not process the request. | - | **WS_E_ENDPOINT_UNREACHABLE**
    2151481360 (0x803D0010) | The remote endpoint was not reachable. | - | **WS_E_ENDPOINT_FAULT_RECEIVED**
    2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. | - | **WS_E_INVALID_ENDPOINT_URL**
    2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. | - - -2. **Deploy MBAM by using Microsoft Deployment Toolkit (MDT) and PowerShell** - - 1. In MDT, create a new deployment share or open an existing deployment share. - - **Note** - The `Invoke-MbamClientDeployment.ps1` PowerShell script can be used with any imaging process or tool. This section shows how to integrate it by using MDT, but the steps are similar to integrating it with any other process or tool. - - **Caution** - If you are using BitLocker pre-provisioning (WinPE) and want to maintain the TPM owner authorization value, you must add the `SaveWinPETpmOwnerAuth.wsf` script in WinPE immediately before the installation reboots into the full operating system. **If you do not use this script, you will lose the TPM owner authorization value on reboot.** - - 2. Copy `Invoke-MbamClientDeployment.ps1` to **<DeploymentShare>\\Scripts**. If you are using pre-provisioning, copy the `SaveWinPETpmOwnerAuth.wsf` file into **<DeploymentShare>\\Scripts**. - - 3. Add the MBAM 2.5 SP1 client application to the Applications node in the deployment share. - - 1. Under the **Applications** node, click **New Application**. - - 2. Select **Application with Source Files**. Click **Next**. - - 3. In **Application Name**, type “MBAM 2.5 SP1 Client”. Click **Next**. - - 4. Browse to the directory containing `MBAMClientSetup-.msi`. Click **Next**. - - 5. Type “MBAM 2.5 SP1 Client” as the directory to create. Click **Next**. - - 6. Enter `msiexec /i MBAMClientSetup-.msi /quiet` at the command line. Click **Next**. - - 7. Accept the remaining defaults to complete the New Application wizard. - - 4. In MDT, right-click the name of the deployment share and click **Properties**. Click the **Rules** tab. Add the following lines: - - `SkipBitLocker=YES``BDEInstall=TPM``BDEInstallSuppress=NO``BDEWaitForEncryption=YES` - - Click OK to close the window. - - 5. Under the Task Sequences node, edit an existing task sequence used for Windows Deployment. If you want, you can create a new task sequence by right-clicking the **Task Sequences** node, selecting **New Task Sequence**, and completing the wizard. - - On the **Task Sequence** tab of the selected task sequence, perform these steps: - - 1. Under the **Preinstall** folder, enable the optional task **Enable BitLocker (Offline)** if you want BitLocker enabled in WinPE, which encrypts used space only. - - 2. To persist TPM OwnerAuth when using pre-provisioning, allowing MBAM to escrow it later, do the following: - - 1. Find the **Install Operating System** step - - 2. Add a new **Run Command Line** step after it - - 3. Name the step **Persist TPM OwnerAuth** - - 4. Set the command line to `cscript.exe "%SCRIPTROOT%/SaveWinPETpmOwnerAuth.wsf"` - **Note:** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details. - - 3. In the **State Restore** folder, delete the **Enable BitLocker** task. - - 4. In the **State Restore** folder under **Custom Tasks**, create a new **Install Application** task and name it **Install MBAM Agent**. Click the **Install Single Application** radio button and browse to the MBAM 2.5 SP1 client application created earlier. - - 5. In the **State Restore** folder under **Custom Tasks**, create a new **Run PowerShell Script** task (after the MBAM 2.5 SP1 Client application step) with the following settings (update the parameters as appropriate for your environment): - - - Name: Configure BitLocker for MBAM - - - PowerShell script: `Invoke-MbamClientDeployment.ps1` - - - Parameters: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    -RecoveryServiceEndpoint

    Required

    MBAM recovery service endpoint

    -StatusReportingServiceEndpoint

    Optional

    MBAM status reporting service endpoint

    -EncryptionMethod

    Optional

    Encryption method (default: AES 128)

    -EncryptAndEscrowDataVolume

    Switch

    Specify to encrypt data volume(s) and escrow data volume recovery key(s)

    -WaitForEncryptionToComplete

    Switch

    Specify to wait for the encryption to complete

    -DoNotResumeSuspendedEncryption

    Switch

    Specify that the deployment script will not resume suspended encryption

    -IgnoreEscrowOwnerAuthFailure

    Switch

    Specify to ignore TPM owner-auth escrow failure. It should be used in the scenarios where MBAM is not able to read the TPM owner-auth, e.g. if TPM auto provisioning is enabled

    -IgnoreEscrowRecoveryKeyFailure

    Switch

    Specify to ignore volume recovery key escrow failure

    -IgnoreReportStatusFailure

    Switch

    Specify to ignore status reporting failure

    - - - -**To enable BitLocker using MBAM 2.5 or earlier as part of a Windows deployment** - -1. Install the MBAM Client. For instructions, see [How to Deploy the MBAM Client by Using a Command Line](how-to-deploy-the-mbam-client-by-using-a-command-line.md). - -2. Join the computer to a domain (recommended). - - - If the computer is not joined to a domain, the recovery password is not stored in the MBAM Key Recovery service. By default, MBAM does not allow encryption to occur unless the recovery key can be stored. - - - If a computer starts in recovery mode before the recovery key is stored on the MBAM Server, no recovery method is available, and the computer has to be reimaged. - -3. Open a command prompt as an administrator, and stop the MBAM service. - -4. Set the service to **Manual** or **On demand** by typing the following commands: - - **net stop mbamagent** - - **sc config mbamagent start= demand** - -5. Set the registry values so that the MBAM Client ignores the Group Policy settings and instead sets encryption to start the time Windows is deployed to that client computer. - - **Caution**   - This step describes how to modify the Windows registry. Using Registry Editor incorrectly can cause serious issues that can require you to reinstall Windows. We cannot guarantee that issues resulting from the incorrect use of Registry Editor can be resolved. Use Registry Editor at your own risk. - - 1. Set the TPM for **Operating system only encryption**, run Regedit.exe, and then import the registry key template from C:\\Program Files\\Microsoft\\MDOP MBAM\\MBAMDeploymentKeyTemplate.reg. - - 2. In Regedit.exe, go to HKLM\\SOFTWARE\\Microsoft\\MBAM, and configure the settings that are listed in the following table. - - **Note**   - You can set Group Policy settings or registry values related to MBAM here. These settings will override previously set values. - - Registry entry - Configuration settings - - DeploymentTime - - 0 = Off - - 1 = Use deployment time policy settings (default) – use this setting to enable encryption at the time Windows is deployed to the client computer. - - UseKeyRecoveryService - - 0 = Do not use key escrow (the next two registry entries are not required in this case) - - 1 = Use key escrow in Key Recovery system (default) - - This is the recommended setting, which enables MBAM to store the recovery keys. The computer must be able to communicate with the MBAM Key Recovery service. Verify that the computer can communicate with the service before you proceed. - - KeyRecoveryOptions - - 0 = Uploads Recovery Key only - - 1 = Uploads Recovery Key and Key Recovery Package (default) - - KeyRecoveryServiceEndPoint - - Set this value to the URL for the server running the Key Recovery service, for example, http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc. - - -6. The MBAM Client will restart the system during the MBAM Client deployment. When you are ready for this restart, run the following command at a command prompt as an administrator: - - **net start mbamagent** - -7. When the computers restarts, and the BIOS prompts you, accept the TPM change. - -8. During the Windows client operating system imaging process, when you are ready to start encryption, open a command prompt as an administrator, and type the following commands to set the start to **Automatic** and to restart the MBAM Client agent: - - **sc config mbamagent start= auto** - - **net start mbamagent** - -9. To delete the bypass registry values, run Regedit.exe, and go to the HKLM\\SOFTWARE\\Microsoft registry entry. Right-click the **MBAM** node, and then click **Delete**. - -## Related topics - -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - -[Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). diff --git a/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md b/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md deleted file mode 100644 index ff06699bd3..0000000000 --- a/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information -description: How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information -author: dansimp -ms.assetid: 09ba2a07-3186-45d9-adef-4034c70ae7cf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information - - -You can configure a localized version of the Self-Service Portal "HelpdeskText" statement, which informs end users about how to get additional help when they are using the Self-Service Portal. If you configure localized text for the statement, as described in the following instructions, MBAM displays the localized version. If MBAM does not find the localized version, it displays the value that is in the **HelpdeskText** parameter. - -**Note**   -In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal. - - - -**To display a localized version of the HelpdeskText statement** - -1. On the server where you configured the Self-Service Portal, browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -2. In the **Actions** pane, click **Add** to open the **Add Application Setting** dialog box. - -3. In the **Name** field, type **HelpdeskText**\_<*Language*>, where <*Language*> is the appropriate language code for the text. - - For example, to create a localized HelpdeskText statement in Spanish, name the parameter **HelpdeskText\_es-es**. - - The name of the Language folder can also be the language neutral name **es** instead of **es-es**. If the end user’s browser is set to **es-es** and that folder does not exist, the parent locale (as defined in .NET) is recursively retrieved and checked, resolving to <MBAM Self-Service Install Directory>\\SelfServiceWebsite\\es\\Notice.txt before finally becoming the default Notice.txt file. This recursive fallback mimics the .NET resource loading rules. - - For a list of the valid language codes you can use, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947). - -4. In the **Value** field, type the localized text that you want to display to end users. - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md b/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md deleted file mode 100644 index 39f6b21718..0000000000 --- a/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: How to Localize the Self-Service Portal “HelpdeskURL” -description: How to Localize the Self-Service Portal “HelpdeskURL” -author: dansimp -ms.assetid: 86798460-077b-459b-8d54-4b605e07d2f1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Localize the Self-Service Portal “HelpdeskURL” - - -You can configure a localized version of the Self-Service Portal URL to display to end users by default. The Self-Service Portal URL is represented by the parameter **HelpdeskURL**. - -If you create a localized version, as described in the following instructions, Microsoft BitLocker Administration and Monitoring (MBAM) finds and displays the localized version. If MBAM does not find a localized version, it displays the URL that is configured for the parameter **HelpDeskURL**. - -**Note**   -In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal. - - - -**To localize the Self-Service Portal URL** - -1. On the server where you configured the Self-Service Portal, browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -2. In the **Actions** pane, click **Add** to open the **Add Application Setting** dialog box. - -3. In the **Name** field, type **HelpdeskURL**\_<*Language*>, where <*Language*> is the appropriate language code for the URL. - - For example, to create a localized version of the `HelpdeskURL` value in Spanish, name the parameter **HelpdeskURL\_es-es**. - - The name of the Language folder can also be the language neutral name **es** instead of **es-es**. If the end user’s browser is set to **es-es** and that folder does not exist, the parent locale (as defined in .NET) is recursively retrieved and checked, resolving to <MBAM Self-Service Install Directory>\\SelfServiceWebsite\\es\\Notice.txt before finally becoming the default Notice.txt file. This recursive fallback mimics the .NET resource loading rules. - - For a list of the valid language codes you can use, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947). - -4. In the **Value** field, type the localized version of the `HelpdeskURL` value that you want to display to end users. - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md b/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md deleted file mode 100644 index 65d97745b3..0000000000 --- a/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: How to Localize the Self-Service Portal Notice Text -description: How to Localize the Self-Service Portal Notice Text -author: dansimp -ms.assetid: a4c878b7-e5c8-45af-a537-761bb2991659 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Localize the Self-Service Portal Notice Text - - -You can configure localized notice text to display to end users by default in the Self-Service Portal. The Notice.txt file that displays the notice text is in the following root directory: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - -To display localized notice text, you create a localized Notice.txt file, and then save it under a specific language folder in the following example directory: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - -**Note**   -You can configure the path by using the **NoticeTextPath** item in **Application Settings**. - - - -MBAM displays the notice text, based on the following rules: - -- If you create a localized **Notice.txt** file in the appropriate language folder, MBAM displays the localized notice text if the default **Notice.txt** file exists. If the default **Notice.txt** file is missing, a message displays indicating that the default file is missing. - -- If MBAM does not find a localized version of the Notice.txt file, it displays the text in the default Notice.txt file. - -- If MBAM does not find a default Notice.txt file, it displays the default text in the Self-Service Portal. - -**Note**   -If an end user’s browser is set to a language that does not have a corresponding language subfolder or Notice.txt, the text in the Notice.txt file in the following root directory is displayed: - -<*MBAM Self-Service Install Directory*>\\Self Service Website\\ - - - -**To create a localized Notice.txt file** - -1. On the server where you configured the Self-Service Portal, create a <*Language*> folder in the following example directory, where <*Language*> represents the name of the localized language: - - <*MBAM Self-Service Install Directory*>\\Self Service Website\\ - - **Note**   - Some language folders already exist, so you might not have to create a folder. If you do have to create a language folder, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947) for a list of the valid names that you can use for the <*Language*> folder. - - - -2. Create a Notice.txt file that contains the localized notice text. - -3. Save the Notice.txt file in the <*Language*> folder. For example, to create a localized Notice.txt file in Spanish, save the localized Notice.txt file in the following example directory: - - <*MBAM Self-Service Install Directory*>\\Self Service Website\\Es-es - - The name of the Language folder can also be the language neutral name **es** instead of **es-es**. If the end user’s browser is set to **es-es** and that folder does not exist, the parent locale (as defined in .NET) is recursively retrieved and checked, resolving to <MBAM Self-Service Install Directory>\\SelfServiceWebsite\\es\\Notice.txt before finally becoming the default Notice.txt file. This recursive fallback mimics the .NET resource loading rules. - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md b/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md deleted file mode 100644 index 5cb63887d0..0000000000 --- a/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md +++ /dev/null @@ -1,166 +0,0 @@ ---- -title: How to Manage User BitLocker Encryption Exemptions -description: How to Manage User BitLocker Encryption Exemptions -author: dansimp -ms.assetid: f582ab82-5bb5-4cd3-ad7c-483240533cf9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manage User BitLocker Encryption Exemptions - - -Microsoft BitLocker Administration and Monitoring (MBAM) enables you to exempt users from BitLocker Drive Encryption requirements. - -To exempt users from BitLocker protection, you have to: - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    Create an infrastructure to support exempted users.

    Examples of this infrastructure include providing users with a contact telephone number, webpage, or mailing address that they can use to request an exemption.

    Add the exempted user to a security group for a Group Policy Object that is configured specifically for exempted users.

    When members of this security group sign in to a computer, the user’s Group Policy setting exempts the user from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption.

    -
    -Note

    MBAM does not enact the encryption policy if the computer is already BitLocker-protected and the user is exempted. However, if another user who is not exempt from the encryption policy signs in to the computer, encryption will take place.

    -
    -
    - -
    - - - -The following steps describe what occurs when end users request an exemption from the BitLocker Drive Encryption exemption process through the MBAM Client or through whatever process your organization uses. You must configure MBAM Group Policy settings to allow end users to request an exemption from BitLocker Drive Encryption. - -1. When end users sign in to a computer that is required to be encrypted, they receive a notification that their computer is going to be encrypted. They can select **Request Exemption** and postpone the encryption by selecting **Postpone**, or they can select **Start Encryption** to accept the BitLocker encryption. - - **Note** - Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy. - - - -2. If end users select **Request Exemption**, they receive a notification telling them to contact the organization’s BitLocker administration group. Depending on how the **Configure User Exemption Policy** is configured, users are provided with one or more of the following contact methods: - - - Phone number - - - Webpage URL - - - Mailing address - -3. After the exemption request is received, the MBAM administrator decides whether to add the user to the BitLocker Exemption Active Directory Domain Services (AD DS) group. - -4. After an end user submits an exemption request, the MBAM Client reports the user as “Temporarily exempt.” The Client then waits a specified number of days, which IT administrators configure, before it checks the computer’s compliance again. If the MBAM administrator rejects the exemption request, the exemption request option is deactivated, which prevents the user from requesting the exemption again. - -Microsoft BitLocker Administration and Monitoring (MBAM) enables you to exempt users from BitLocker Drive Encryption requirements. - -To exempt users from BitLocker protection, you have to: - - ---- - - - - - - - - - - - - - - - - -
    TaskDetails

    Create an infrastructure to support exempted users.

    Examples of this infrastructure include providing users with a contact telephone number, webpage, or mailing address that they can use to request an exemption.

    Add the exempted user to a security group for a Group Policy Object that is configured specifically for exempted users.

    When members of this security group sign in to a computer, the user’s Group Policy setting exempts the user from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption.

    -
    -Note

    If the computer is already BitLocker-protected, the User Exemption Policy has no effect. In addition, if another user signs in to a computer that is not exempt from the encryption policy, encryption will take place.

    -
    -
    - -
    - - - -The following steps describe what occurs when end users request an exemption from the BitLocker Drive Encryption exemption process through the MBAM Client or through whatever process your organization uses. You must configure MBAM Group Policy settings to allow end users to request an exemption from BitLocker Drive Encryption. - -1. When end users sign in to a computer that is required to be encrypted, they receive a notification that their computer is going to be encrypted. They can select **Request Exemption** and postpone the encryption by selecting **Postpone**, or they can select **Start Encryption** to accept the BitLocker encryption. - - **Note** - Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy. - - - -2. If end users select **Request Exemption**, they receive a notification telling them to contact the organization’s BitLocker administration group. Depending on how the **Configure User Exemption Policy** is configured, users are provided with one or more of the following contact methods: - - - Phone number - - - Webpage URL - - - Mailing address - -3. After the exemption request is received, the MBAM administrator decides whether to add the user to the BitLocker Exemption Active Directory Domain Services (AD DS) group. - -4. After an end user submits an exemption request, the MBAM Client reports the user as “Temporarily exempt.” The Client then waits a specified number of days, which IT administrators configure, before it checks the computer’s compliance again. If the MBAM administrator rejects the exemption request, the exemption request option is deactivated, which prevents the user from requesting the exemption again. - -**To exempt a user from BitLocker Drive Encryption** - -1. Create an AD DS security group that will be used to manage user exemptions from BitLocker encryption requirements. - -2. Create a Group Policy Object by using the Microsoft BitLocker Administration and Monitoring Group Policy Templates. - -3. Associate the Group Policy Object with the AD DS group that you created in the previous step. The policy settings to exempt users are located at: **UserConfiguration** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)**. - -4. To the security group you created for BitLocker exempted users, add the names of the users who are requesting an exemption. - - When a user signs in to a computer controlled by BitLocker, the MBAM Client checks the User Exemption Policy setting. If the computer is already encrypted, BitLocker protection is not suspended. If the computer is not encrypted, MBAM does not prompt the user to encrypt. - - **Important** - Shared computer scenarios require special consideration when you are using BitLocker user exemptions. If a non-exempt user signs in to a computer that is shared with an exempt user, the computer may be encrypted. - - - - -## Related topics - - -[Administering MBAM 2.5 Features](administering-mbam-25-features.md) - -[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md b/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md deleted file mode 100644 index 2500ec0e02..0000000000 --- a/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md +++ /dev/null @@ -1,497 +0,0 @@ ---- -title: How to Move the MBAM 2.5 Databases -description: How to Move the MBAM 2.5 Databases -author: dansimp -ms.assetid: 34b46f2d-0add-4377-8e4e-04b628fdfcf1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/15/2018 ---- - -# How to Move the MBAM 2.5 Databases - -Use these procedures to move the following databases from one computer to another; from Server A to Server B, for example: - -- Compliance and Audit Database - -- Recovery Database - ->[!NOTE] ->It is important that the databases be restored to Machine B PRIOR to running the MBAM Configuration Wizard to update/configure them. - -If the databases are NOT present, the Configuration Wizard creates NEW, empty, databases. When your existing databases are then restored, this process will break the MBAM configuration. - -Restore the databases FIRST, then run the MBAM Configuration Wizard, choose the database option, and the Configuration Wizard will “connect” to the databases you restored; upgrading them if needed as part of the process. - -**If you are moving multiple features, move them in the following order:** - -1. Recovery Database - -2. Compliance and Audit Database - -3. Reports - -4. Administration and Monitoring Website - -5. Self-Service Portal - ->[!Note] ->To run the example Windows PowerShell scripts provided in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](https://technet.microsoft.com/library/ee176949.aspx) for instructions. - -## Move the Recovery Database - -The high-level steps for moving the Recovery Database are: - -1. Stop all instances of the MBAM Administration and Monitoring Website - -2. Back up the Recovery Database on Server A - -3. Move the Recovery Database from Server A to Server B - -4. Restore the Recovery Database on Server B - -5. Configure access to the Database on Server B and update connection data - -6. Install MBAM Server software and run the MBAM Server Configuration wizard on Server B - -7. Resume the instance of the Administration and Monitoring Website - -### How to move the Recovery Database - -**Stop all instances of the MBAM Administration and Monitoring Website.** On each server that is running the MBAM Administration and Monitoring Server Website, use the Internet Information Services (IIS) Manager console to stop the Administration and Monitoring Website. - -To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - -```powershell -Stop-Website "Microsoft BitLocker Administration and Monitoring" -``` - ->[!NOTE] ->To run this command, you must add the Internet Information Services (IIS) module for Windows PowerShell to the current instance of Windows PowerShell. - -### Back up the Recovery Database on Server A - -1. Use the **Back Up** task in SQL Server Management Studio to back up the Recovery Database on Server A. By default, the database name is **MBAM Recovery Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following SQL script, and change the MBAM Recovery Database to use the full recovery mode: - - ``` - USE master; - - GO - - ALTER DATABASE "MBAM Recovery and Hardware" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Recovery Database Data and MBAM Recovery logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device', - - 'Z:\MBAM Recovery Database Data.bak'; - - GO - - -- Back up the full MBAM Recovery Database. - - BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device]; - - GO - - BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate] - - TO FILE = 'Z:\SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - ENCRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - ``` - -3. Use the following value to replace the values in the code example with values that match your environment: - - **$PASSWORD$** - password that you use to encrypt the Private Key file. - -4. In Windows PowerShell, run the script that is stored in the file and similar to the following: - - ```powershell - Invoke-Sqlcmd -InputFile - 'Z:\BackupMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$ - ``` -5. Use the following value to replace the values in the code example with values that match your environment: - - **$SERVERNAME$\$SQLINSTANCENAME$** - server name and instance from which the Recovery Database will be backed up. - -### Move the Recovery Database from Server A to Server B - -Use Windows Explorer to move the **MBAM Recovery Database Data.bak** file from Server A to Server B. - -To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - -```powershell -Copy-Item "Z:\MBAM Recovery Database Data.bak" -\\$SERVERNAME$\$DESTINATIONSHARE$ - -Copy-Item "Z:\SQLServerInstanceCertificateFile" -\\$SERVERNAME$\$DESTINATIONSHARE$ - -Copy-Item "Z:\SQLServerInstanceCertificateFilePrivateKey" -\\$SERVERNAME$\$DESTINATIONSHARE$ -``` -Use the information in the following table to replace the values in the code example with values that match your environment. - -| **Parameter** | **Description** | -|----------------------|------------------| -| $SERVERNAME$ | Name of the server to which the files will be copied. | -| $DESTINATIONSHARE$ | Name of the share and path to which the files will be copied. | - - -### Restore the Recovery Database on Server B - -1. Restore the Recovery Database on Server B by using the **Restore Database** task in SQL Server Management Studio. - -2. When the previous task finishes, select **From Device**, and then select the database backup file. - -3. Use the **Add** command to select the **MBAM Recovery Database Data.bak** file, and click **OK** to complete the restoration process. - -4. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - ``` - -- Restore MBAM Recovery Database. - - USE master - - GO - - -- Drop certificate created by MBAM Setup. - - DROP CERTIFICATE [MBAM Recovery Encryption Certificate] - - GO - - --Add certificate - - CREATE CERTIFICATE [MBAM Recovery Encryption Certificate] - - FROM FILE = 'Z:\SQLServerInstanceCertificateFile' - - WITH PRIVATE KEY - - ( - - FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey', - - DECRYPTION BY PASSWORD = '$PASSWORD$' - - ); - - GO - - -- Restore the MBAM Recovery Database data and log files. - - RESTORE DATABASE [MBAM Recovery and Hardware] - - FROM DISK = 'Z:\MBAM Recovery Database Data.bak' - - WITH REPLACE - ``` - -5. Use the following value to replace the values in the code example with values that match your environment. - - **$PASSWORD$** - password that you used to encrypt the Private Key file. - -6. In Windows PowerShell, run the script that is stored in the file and similar to the following: - - ```powershell - Invoke-Sqlcmd -InputFile 'Z:\RestoreMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$ - ``` -7. Use the following value to replace the values in the code example with values that match your environment. - - **$SERVERNAME$\$SQLINSTANCENAME$** - Server name and instance to which the Recovery Database will be restored. - -### Configure access to the Database on Server B and update connection data - -1. Verify that the Microsoft SQL Server user login that enables Recovery Database access on the restored database is mapped to the access account that you provided during the configuration process. - - >[!NOTE] - >If the login is not the same, create a login by using SQL Server Management Studio, and map it to the existing database user. - -2. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the MBAM websites. - -3. Edit the following registry key: - - **HKLM\\Software\\Microsoft\\MBAM Server\\Web\\RecoveryDBConnectionString** - -4. Update the **Data Source** value with the name of the server and instance (for example, \$SERVERNAME\$\\\$SQLINSTANCENAME) to which the Recovery Database was moved. - -5. Update the **Initial Catalog** value with the recovered database name. - -6. To automate this process, you can use the Windows PowerShell command prompt to enter a command line on the Administration and Monitoring Server that is similar to the following: - - ```powershell - reg add "HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\MBAM Server\\Web" /v - RecoveryDBConnectionString /t REG_SZ /d "Integrated Security=SSPI;Initial - Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f - - Set-WebConfigurationProperty - 'connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath - "IIS:\sites\Microsoft Bitlocker Administration and - Monitoring\MBAMAdministrationService" -Name "connectionString" -Value "Data - Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and - Hardware;Integrated Security=SSPI;" - - Set-WebConfigurationProperty - 'connectionStrings/add[\@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' - -PSPath "IIS:\sites\Microsoft Bitlocker Administration and - Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value - "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery - and Hardware;Integrated Security=SSPI;" - ``` - - >[!Note] - >This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server. - - -7. Use the following table to replace the values in the code example with values that match your environment. - - |Parameter|Description| - |---------|-----------| - |$SERVERNAME$/\$SQLINSTANCENAME$|Server name and instance of SQL Server where the Recovery Database is located.| - |$DATABASE$|Name of the Recovery database.| - - -### Install MBAM Server software and run the MBAM Server Configuration wizard on Server B - -1. Install the MBAM 2.5 Server software on Server B. For details, see [Installing the MBAM 2.5 Server Software](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/installing-the-mbam-25-server-software). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Recovery Database** feature. For details on how to configure the databases, see [How to Configure the MBAM 2.5 Databases](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-mbam-25-databases). - - >[!TIP] - >Alternatively, you can use the **Enable-MbamDatabase** Windows PowerShell cmdlet to configure the Recovery Database. - - -### Resume the instance of the Administration and Monitoring Website - -On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to start the Administration and Monitoring Website. - -To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - -```powershell -Start-Website "Microsoft BitLocker Administration and Monitoring" -``` - ->[!NOTE] ->To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell. - -## Move the Compliance and Audit Database - -The high-level steps for moving the Compliance and Audit Database are: - -1. Stop all instances of the MBAM Administration and Monitoring Website - -2. Back up the Compliance and Audit Database on Server A - -3. Move the Compliance and Audit Database from Server A to Server B - -4. Restore the Compliance and Audit Database on Server B - -5. Configure access to the Database on Server B and update connection data - -6. Install MBAM Server software and run the MBAM Server Configuration wizard on - Server B - -7. Resume the instance of the Administration and Monitoring Website - -### How to move the Compliance and Audit Database - -**Stop all instances of the MBAM Administration and Monitoring Website.** On each server that is running the MBAM Administration and Monitoring Server Website, use the Internet Information Services (IIS) Manager console to stop the Administration and Monitoring Website. - -To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - -```powershell -Stop-Website "Microsoft BitLocker Administration and Monitoring" -``` - ->[!NOTE] ->To run this command, you must add the Internet Information Services (IIS) module for Windows PowerShell to the current instance of Windows PowerShell. - -### Back up the Compliance and Audit Database on Server A - -1. Use the **Back Up** task in SQL Server Management Studio to back up the Compliance and Audit Database on Server A. By default, the database name is **MBAM Compliance Status Database**. - -2. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - ``` - USE master; - - GO - - ALTER DATABASE "MBAM Compliance Status" - - SET RECOVERY FULL; - - GO - - -- Create MBAM Compliance Status Data logical backup devices. - - USE master - - GO - - EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device', - - 'Z: \MBAM Compliance Status Database Data.bak'; - - GO - - -- Back up the full MBAM Compliance Recovery database. - - BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device]; - - GO - - ``` - -3. Run the script that is stored in the .sql file by using a Windows PowerShell command that is similar to the following: - - ```powershell - Invoke-Sqlcmd -InputFile "Z:\BackupMBAMComplianceStatusDatabaseScript.sql" –ServerInstance $SERVERNAME$\$SQLINSTANCENAME$ - - ``` - -4. Using the following value, replace the values in the code example with values that match your environment: - - **$SERVERNAME$\$SQLINSTANCENAME$** - server name and instance from which the Compliance and Audit Database will be backed up. - -### Move the Compliance and Audit Database from Server A to Server B** - -1. Use Windows Explorer to move the **MBAM Compliance Status Database Data.bak** file from Server A to Server B. - -2. To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - - ```powershell - Copy-Item "Z:\MBAM Compliance Status Database Data.bak" - \\$SERVERNAME$\$DESTINATIONSHARE$ - ``` - -3. Using the following table, replace the values in the code example with values that match your environment. - - | **Parameter** | **Description** | - |----------------------|---------------------------------------------------------------| - | $SERVERNAME$ | Name of the server to which the files will be copied. | - | $DESTINATIONSHARE$ | Name of the share and path to which the files will be copied. | - - -### Restore the Compliance and Audit Database on Server B - -1. Restore the Compliance and Audit Database on Server B by using the **Restore Database** task in SQL Server Management Studio. - -2. When the previous task finishes, select **From Device**, and then select the database backup file. - -3. Use the **Add** command to select the **MBAM Compliance Status Database Data.bak** file and click **OK** to complete the restoration process. - -4. To automate this procedure, create a SQL file (.sql) that contains the following SQL script: - - ``` - -- Create MBAM Compliance Status Database Data logical backup devices. - - Use master - - GO - - -- Restore the MBAM Compliance Status database data files. - - RESTORE DATABASE [MBAM Compliance Status] - - FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak' - - WITH REPLACE - - ``` - -5. In Windows PowerShell, run the script that is stored in the file and similar to the following: - - ```powershell - Invoke-Sqlcmd -InputFile "Z:\RestoreMBAMComplianceStatusDatabaseScript.sql" -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$ - - ``` - -6. Using the following value, replace the values in the code example with values that match your environment. - - **$SERVERNAME$\$SQLINSTANCENAME$** - Server name and instance to which the Compliance and Audit Database will be restored. - -### Configure access to the Database on Server B and update connection data - -1. Verify that the Microsoft SQL Server user login that enables Compliance and Audit Database access on the restored database is mapped to the access account that you provided during the configuration process. - - >[!NOTE] - >If the login is not the same, create a login by using SQL Server Management Studio, and map it to the existing database user. - -2. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the Website. - -3. Edit the following registry key: - - **HKLM\\Software\\Microsoft\\MBAM Server\\Web\\ComplianceDBConnectionString** - -4. Update the **Data Source** value with the name of the server and instance (for example, \$SERVERNAME\$\\\$SQLINSTANCENAME) to which the Recovery Database was moved. - -5. Update the **Initial Catalog** value with the recovered database name. - -6. To automate this process, you can use the Windows PowerShell command prompt to enter a command line on the Administration and Monitoring Server that is similar to the following: - - ```powershell - reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server\Web" /v - ComplianceDBConnectionString /t REG_SZ /d "Integrated Security=SSPI;Initial - Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f - ``` - >[!NOTE] - >This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server. - - -7. Using the following table, replace the values in the code example with values that match your environment. - - |Parameter | Description | - |---------|------------| - |$SERVERNAME$\$SQLINSTANCENAME$ | Server name and instance of SQL Server where the Recovery Database is located.| - |$DATABASE$|Name of the recovered database.| - -### Install MBAM Server software and run the MBAM Server Configuration wizard on Server B - -1. Install the MBAM 2.5 Server software on Server B. For details, see [Installing the MBAM 2.5 Server Software](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/installing-the-mbam-25-server-software). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Compliance and Audit Database** feature. For details on how to configure the databases, see [How to Configure the MBAM 2.5 Databases](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-mbam-25-databases). - - >[!TIP] - >Alternatively, you can use the **Enable-MbamDatabase** Windows PowerShell cmdlet to configure the Compliance and Audit Database. - - -### Resume the instance of the Administration and Monitoring Website - -On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to start the Administration and Monitoring Website. - -To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - -```powershell -Start-Website "Microsoft BitLocker Administration and Monitoring" -``` - ->[!NOTE] ->To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell. diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md b/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md deleted file mode 100644 index c77b29982c..0000000000 --- a/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: How to Move the MBAM 2.5 Reports -description: How to Move the MBAM 2.5 Reports -author: dansimp -ms.assetid: c8223656-ca9d-41c8-94a3-64d07a6b99e9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move the MBAM 2.5 Reports - - -Use these procedures to move the Reports feature from one computer to another, that is, to move the Reports feature from Server A to Server B. - -The high-level steps for moving the Reports feature are: - -1. Stop all instances of the MBAM Administration and Monitoring Website. - -2. Install the MBAM 2.5 Server software on Server B and configure the Reports feature on Server B. - -3. Update the reports connection data on the MBAM Administration and Monitoring servers. - -4. Resume the instance of the MBAM Administration and Monitoring Website. - -**Note**   -To run the example Windows PowerShell scripts in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](https://technet.microsoft.com/library/ee176949.aspx) for instructions. - - - -**Stop the MBAM Administration and Monitoring Website** - -- On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to stop the Administration and Monitoring Website. - - To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following: - - ``` syntax - PS C:\> Stop-Website "Microsoft BitLocker Administration and Monitoring" - ``` - -**Install MBAM Server software and run the MBAM Server Configuration wizard on Server B** - -1. Install the MBAM Server software on Server B. For instructions, see [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Reports** feature. - - Alternatively, you can use the **Enable-MbamReport** Windows PowerShell cmdlet to configure the Reports. - - For instructions on how to configure the Reports, see [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md). - -**Update the reports connection data on the Administration and Monitoring Server** - -1. On the server that is running the Reports feature, use the Internet Information Services (IIS) Manager console to update the Reports URL. - -2. Expand **Microsoft BitLocker Administration and Monitoring**, and then select the **HelpDesk** node. - -3. In the **Management** section of the **Features View**, select **Configuration Editor**. - -4. In the **Section** field, select **appSettings**. - -5. Select the **Collection** row, and then click the "ellipses" button **(…)** at the far right of the pane to open the **Collection Editor**. - -6. In the **Collection Editor**, select the row that contains **Microsoft.Mbam.Reports.Url**, and update the value for **Microsoft.Mbam.Reports.Url** to reflect the server name for Server B. - - If you previously configured the Reports feature on a named instance of SQL Server Reporting Services, add or update the name of the instance to the URL, for example: - - `http://$SERVERNAME$/ReportServer_$SQLSRSINSTANCENAME$/Pages....)` - -7. To automate this procedure, you can use Windows PowerShell to run a command on the Administration and Monitoring Server that is similar to the following code example. - - ``` syntax - PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\\sites\Microsoft Bitlocker Administration and Monitoring\HelpDesk" -Name "Value" -Value "http://$SERVERNAME$/ReportServer[_$SRSINSTANCENAME$]/Pages/ReportViewer.aspx?/Microsoft+BitLocker+Administration+and+Monitoring/" - ``` - - Using the descriptions in the following table, replace the values in the code example with values that match your environment. - - - - - - - - - - - - - - - - - - - - - - -
    ParameterDescription

    $SERVERNAME$

    Name of the server to which the Reports were moved.

    $SRSINSTANCENAME$

    Name of the instance of SQL Server Reporting Services to which the Reports were moved.

    - - - -**Resume the instance of the Administration and Monitoring Website** - -1. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to start the Administration and Monitoring Website. - -2. To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following: - - ``` syntax - PS C:\> Start-Website "Microsoft BitLocker Administration and Monitoring" - ``` - - **Note**   - To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell. - - - - - -## Related topics - - -[How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md) - -[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) - -[Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md b/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md deleted file mode 100644 index 6b57070737..0000000000 --- a/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Move the MBAM 2.5 Websites -description: How to Move the MBAM 2.5 Websites -author: dansimp -ms.assetid: 71af9a54-c27b-408f-9d75-37c0d02e730e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Move the MBAM 2.5 Websites - - -Use these procedures to move the following MBAM websites from one computer to another, that is, to move the following features from Server A to Server B: - -- Administration and Monitoring Website - -- Self-Service Portal - -**Important**   -During the configuration of both websites, you must provide the same connection string, Reports URL, group accounts, and web service application pool domain account as the ones that you are currently using. If you don’t use the same values, you cannot access some of the servers. To get the current values, use the **Get-MbamWebApplication** Windows PowerShell cmdlet. - - - -**To move the Administration and Monitoring Website to another server** - -1. On Server B, install the MBAM 2.5 Server software. For instructions, see [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Administration and Monitoring Website** feature. - - Alternatively, you can use the **Enable-MbamWebApplication** Windows PowerShell cmdlet to configure the Administration and Monitoring Website. - - For instructions on how to configure the Administration and Monitoring Website, see [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md). - -**To move the Self-Service Portal to another server** - -1. On Server B, install the MBAM 2.5 Server software. For instructions, see [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md). - -2. On Server B, start the MBAM Server Configuration wizard, click **Add New Features**, and then select only the **Self-Service Portal** feature. - - Alternatively, you can use the **Enable-MbamWebApplication** Windows PowerShell cmdlet to configure the Self-Service Portal. - - For instructions on how to configure the Administration and Monitoring Website, see [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md). - -3. If the client computers in your organization do not have access to the Microsoft Content Delivery Network, you also have to move the JavaScript files. See [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md) for more information. - -4. Customize the Self-Service Portal for your organization. Use the instructions in [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) to review your current customizations and to configure custom settings on the Self-Server Portal on Server B. - - - -## Related topics - - -[How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md) - -[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) - -[Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md deleted file mode 100644 index 5ee41f6f49..0000000000 --- a/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Recover a Corrupted Drive -description: How to Recover a Corrupted Drive -author: dansimp -ms.assetid: fa5b846b-dda6-4ae4-bf6c-39e4f1d8aa00 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Recover a Corrupted Drive - - -You can use this procedure with the Administration and Monitoring Website (also referred to as the Help Desk) Website to recover a corrupted drive that is protected by BitLocker. To do this, you will complete the tasks outlined in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - -
    TaskDetails and more information

    Create a recovery key package file by accessing the Drive Recovery area of the Administration and Monitoring Website.

    To access the Drive Recovery area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. You may have given these roles different names when you created them. For more information, see Planning for MBAM 2.5 Groups and Accounts.

    Copy the package file to the computer that contains the corrupted drive.

    Use the repair-bde command to complete the recovery process.

    To avoid a potential loss of data, it is strongly recommended that you review the Manage-bde command before using it.

    - - - -**To recover a corrupted drive** - -1. Open a web browser and navigate to the **Administration and Monitoring Website**. - -2. In the left pane, select **Drive Recovery** to open the **Recover access to an encrypted drive** page. - -3. Enter the end user’s Windows log-on domain and user name, the reason for unlocking the drive, and the end user’s recovery password ID. - - **Note**   - If you are a member of the Advanced Helpdesk Users access group, you do not have to enter the user’s domain name or user name. - - - -4. Click **Submit**. The recovery key will be displayed. - -5. Click **Save**, and then select **Recovery Key Package**. The recovery key package will be created on your computer. - -6. Copy the recovery key package to the computer that has the corrupted drive. - -7. Open an elevated command prompt. To do this, click **Start** and type `cmd` in the **Search programs and files** text box. Right-click **cmd.exe**, and select **Run as Administrator**. - -8. At the command prompt, type the following: - - `repair-bde -kp -rp ` - - **Note**   - Replace <*fixed drive*> with an available hard disk drive that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified hard disk drive. - - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md deleted file mode 100644 index 9dec2442fb..0000000000 --- a/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: How to Recover a Drive in Recovery Mode -description: How to Recover a Drive in Recovery Mode -author: dansimp -ms.assetid: e126eaf8-9ae7-40fe-a28e-dbd78d26859e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Recover a Drive in Recovery Mode - - -This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to get a recovery password to give to end users if their BitLocker-protected drive goes into recovery mode. Drives go into recovery mode if users lose or forget their PIN or password or if the Trusted Module Platform (TPM) chip detects changes to the BIOS or startup files of a computer. - -To get a recovery password, use the **Drive Recovery** area of the Administration and Monitoring Website. You must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role to access this area of the website. - -**Note** -You may have given these roles different names when you created them. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). - - - -**Important** -Recovery passwords expire after a single use. On operating system drives and fixed data drives, the single-use rule is applied automatically. On removable drives, it is applied when the drive is removed and then reinserted and unlocked on a computer that has Group Policy settings activated to manage removable drives. - - - -**To recover a drive in recovery mode** - -1. Open a web browser and navigate to the **Administration and Monitoring Website**. - -2. In the left pane, select **Drive Recovery** to open the **Recover access to an encrypted drive** page. - -3. Enter the end user’s Windows log-on domain and user name to view recovery information. - - **Note** - If you are in the MBAM Advanced Helpdesk Users group, the user domain and user ID fields are not required. - - - -4. Enter the first eight digits of the recovery key ID to see a list of possible matching recovery keys, or enter the entire recovery key ID to get the exact recovery key. - -5. From the **Reason for Drive Unlock** list, select one of the predefined options, and then click **Submit**. - - MBAM returns the following: - - - An error message if no matching recovery password is found - - - Multiple possible matches if the user has multiple matching recovery passwords - - - The recovery password and recovery package for the submitted user - - **Note** - If you are recovering a damaged drive, the recovery package option provides BitLocker with critical information that it needs to recover the drive. - - - -~~~ -After the recovery password and recovery package are retrieved, the recovery password is displayed. -~~~ - -6. To copy the password, click **Copy Key**, and then paste the recovery password into an email message. Alternatively, click **Save** to save the recovery password to a file. - - When the user types the recovery password into the system or uses the recovery package, the drive is unlocked. - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md deleted file mode 100644 index 59ee1c423d..0000000000 --- a/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: How to Recover a Moved Drive -description: How to Recover a Moved Drive -author: dansimp -ms.assetid: 0d38ce7e-bc64-473e-ae85-99b7099ca758 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Recover a Moved Drive -This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to recover an operating system drive that was moved after being encrypted by Microsoft BitLocker Administration and Monitoring (MBAM). When a drive is moved, it no longer accepts the PIN that was used in the previous computer because the Trusted Platform Module (TPM) chip has changed. To recover the moved drive, you must obtain the recovery key ID to retrieve the recovery password. - -To recover a moved drive, you must use the **Drive Recovery** area of the Administration and Monitoring Website. To access the **Drive Recovery** area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. For more information about these roles, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). - -**To recover a moved drive** -1. On the computer that contains the moved drive, start the computer in Windows Recovery Environment (WinRE) mode, or start the computer by using the Microsoft Diagnostic and Recovery Toolset (DaRT). - -2. After the computer has been started with WinRE or DaRT, MBAM will treat the moved operating system drive as a fixed data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password. - - **Note**   - In some cases, you may be able to click **I forgot the PIN** during the startup process, and then enter the recovery mode to display the recovery key ID. - - - -3. Use the recovery key ID to retrieve the recovery password and unlock the drive from the Administration and Monitoring Website. For instructions, see [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-25.md). - - If the moved drive was configured to use a TPM chip on the original computer, complete the following additional steps. Otherwise, the recovery process is complete. - -4. After unlocking the drive and completing the start process, open a command prompt in WinRE mode and use the `manage-bde` command to decrypt the drive. Using this tool is the only way to remove the TPM plus the PIN protector without the original TPM chip. For information about the `manage-bde` command, see [Manage-bde](https://go.microsoft.com/fwlink/?LinkId=393567). - -5. When the removal is completed, start the computer normally. The MBAM agent will now enforce the policy to encrypt the drive with the new computer’s TPM plus the PIN. - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md b/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md deleted file mode 100644 index fc80c4324c..0000000000 --- a/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md +++ /dev/null @@ -1,80 +0,0 @@ ---- -title: How to Reset a TPM Lockout -description: How to Reset a TPM Lockout -author: dansimp -ms.assetid: dd20a728-c52e-48e6-9f6c-1311c71dee74 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Reset a TPM Lockout - - -This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to reset a TPM lockout. TPM lockouts can occur if an end user enters the incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies from manufacturer to manufacturer. - -From the **Manage TPM** area of the Administration and Monitoring Website, you can access the centralized Key Recovery data system, which provides a TPM owner password file when you supply a computer ID and associated user identifier. - -To access the Manage TPM area of the Administration and Monitoring Website, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. These roles are groups that administrators create in Active Directory. You can use any name for these groups. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles). - -For information about MBAM and TPM ownership, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-tpm). - -**To reset a TPM lockout** - -1. Open a web browser and navigate to the **Administration and Monitoring Website**. - -2. In the left pane, click **Manage TPM** to open the **Manage TPM** page. - -3. Enter the fully qualified domain name for the computer and the computer name. - -4. Enter the end user’s Windows log-on domain and user name to retrieve the TPM owner password file. - - **Note**   - If you are in the MBAM Advanced Helpdesk Users group, the user domain and user ID fields are not required. - - - -5. From the **Reason for requesting TPM owner password file** list, select a reason for the request, and click **Submit**. - - MBAM returns one of the following: - - - An error message if no matching TPM owner password file is found - - - The TPM owner password file for the submitted computer - - After the TPM owner password is retrieved, the owner password is displayed. - -6. To save the password to a .tpm file, click the **Save** button. - -7. In the **Manage TPM** area of the **Administration and Monitoring Website**, select the **Reset TPM lockout** option and provide the TPM owner password file. - - The TPM lockout is reset and the end user’s access is restored. - - **Important**   - Do not give the TPM hash value or TPM owner password file to end users. Because the TPM information does not change, giving the file to end users creates a security risk. - - - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md b/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md deleted file mode 100644 index 67f433c862..0000000000 --- a/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: How to Set the Self-Service Portal Branding and Session Time-out -description: How to Set the Self-Service Portal Branding and Session Time-out -author: dansimp -ms.assetid: 031eedfc-fade-4d2f-8771-b329e1d38c0d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set the Self-Service Portal Branding and Session Time-out - - -After you configure the Self-Service Portal, you can brand it with your company name, Help Desk URL, and "notice" text. You can also change the Session Time-out setting to make the end user’s session expire after a specified period of inactivity. - -**Note** -You can also brand the Self-Service Portal by using the **Enable-MbamWebApplication** Windows PowerShell cmdlet or the MBAM Server Configuration wizard. For instructions on using the wizard, see [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md). - - - -**Note** -In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal. - - - -**To set the session time-out and branding for the Self-Service Portal** - -1. To set the time-out period for the end user’s session, start the **Internet Information Services Manager**, or run **inetmgr.exe**. - -2. Browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **ASP.NET** > **Session State**, and change the **Time-out** value under **Cookie Settings** to the number of minutes after which the end user’s Self-Service Portal session expires. The default value is **5**. To disable the setting so that there is no time-out, set the value to **0**. - -3. To set the branding items for the Self-Service Portal, start the **Internet Information Services Manager** or run **inetmgr.exe**. - -4. Browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -5. In the **Name** column, select the item that you want to change, and change the default value to reflect the name that you want to use. The following table lists the values that you can set. - - **Caution** - Do not change the value in the Name column (CompanyName\*), as it will cause Self-Service Portal to stop working. - - - -~~~ - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameDefault value

    ClientValidationEnabled

    true

    CompanyName

    Contoso IT

    DisplayNotice

    true

    HelpdeskText

    Contact Helpdesk or IT Department

    HelpdeskUrl

    #

    -
    -Note -

    In MBAM 2.5 SP1, the HelpdeskUrl default value is empty.

    -
    -
    - -

    jQueryPath

    [//go.microsoft.com/fwlink/?LinkID=390515](//go.microsoft.com/fwlink/?LinkID=390515)

    -
    -Note -

    In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery-1.10.2.min.js

    -
    -
    - -

    jQueryValidatePath

    [//go.microsoft.com/fwlink/?LinkID=390516](//go.microsoft.com/fwlink/?LinkID=390516)

    -
    -Note -

    In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.min.js

    -
    -
    - -

    jQueryValidateUnobtrusivePath

    [//go.microsoft.com/fwlink/?LinkID=390517](//go.microsoft.com/fwlink/?LinkID=390517)

    -
    -Note -

    In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.unobtrusive.min.js

    -
    -
    - -

    NoticeTextPath

    Notice.txt

    -
    -Note -

    You can edit the notice text either by using the Internet Information Services (IIS) Manager or by opening and changing the Notice.txt file in the installation directory.

    -
    -
    - -

    UnobtrusiveJavaScriptEnabled

    true

    -~~~ - - - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md b/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md deleted file mode 100644 index 015d00c47f..0000000000 --- a/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How to Turn the Self-Service Portal Notice Text On or Off -description: How to Turn the Self-Service Portal Notice Text On or Off -author: dansimp -ms.assetid: e786685b-ffdb-4557-ae71-e79528097264 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Turn the Self-Service Portal Notice Text On or Off - - -You can turn the Self-Service Portal notice text on or off. By default, the notice text is turned on. To set the notice text, see [How to Set the Self-Service Portal Branding and Session Time-out](how-to-set-the-self-service-portal-branding-and-session-time-out.md). - -**Note**   -In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal. - - - -**To turn off the notice text** - -1. On the server where you configured the Self-Service Portal, browse to **Sites** > **Microsoft BitLocker Administration and Monitoring** > **SelfService** > **Application Settings**. - -2. In the **Name** column, select **DisplayNotice**, and set the value to **false**. - - - -## Related topics - - -[Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md b/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md deleted file mode 100644 index 6999def5bb..0000000000 --- a/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: How to Use the Administration and Monitoring Website -description: How to Use the Administration and Monitoring Website -author: dansimp -ms.assetid: bb96a4e8-d4f4-4e6f-b7db-82d96998bfa6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Administration and Monitoring Website - - -The Administration and Monitoring Website, also referred to as the Help Desk, is an administrative interface for BitLocker Drive Encryption. Use the website to review reports, recover end users’ drives, and manage end users’ TPMs, as described in the following sections. - -**Note**   -If you are using MBAM in the Stand-alone topology, you view all reports from the Administration and Monitoring Website. If you are using the Configuration Manager Integration topology, you view all reports in Configuration Manager, except the Recovery Audit report, which you continue to view from the Administration and Monitoring Website. For more information about reports, see [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md). - - - -## Required roles for using the Administration and Monitoring Website - - -To access specific areas of the Administration and Monitoring Website, you must have one of the following roles, which are groups that you create in Active Directory. You can use any name for these groups. - - ---- - - - - - - - - - - - - - - - - - - - - -
    AccountDescription

    MBAM Advanced Helpdesk Users

    Provides access to all areas of the Administration and Monitoring Website. Users who have this role enter only the recovery key, and not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users Group permissions.

    -

    MBAM Helpdesk Users

    Provides access to the Manage TPM and Drive Recovery areas of the Administration and Monitoring Website. Individuals who have this role must fill in all fields, including the end-user’s domain and account name, when they use either area.

    -

    If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Users Group permissions.

    MBAM Report Users

    Provides access to the reports in the Reports area of the Administration and Monitoring Website.

    - - - -## Tasks you can perform on the Administration and Monitoring Website - - -The following table summarizes the tasks you can perform on the Administration and Monitoring Website and provides links to more information about each task. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskArea of the Website where you access the taskDescriptionFor more information

    View reports

    Reports

    Enables you to run reports to monitor BitLocker usage, compliance, and key recovery activity. Reports provide data about enterprise compliance, individual computers, and who requested recovery keys or the TPM OwnerAuth package for a specific computer.

    Viewing MBAM 2.5 Reports for the Stand-alone Topology

    Determine the BitLocker encryption status of lost or stolen computers

    Reports

    Determine if a volume was encrypted if the computer is lost or stolen.

    How to Determine BitLocker Encryption State of Lost Computers

    Recover lost drives

    Drive Recovery

    Recover drives that are:

    -
      -
    • In recovery mode

    • -
    • Have been moved

    • -
    • Are corrupted

    • -

    Reset a TPM lockout

    Manage TPM

    Provides access to TPM data that has been collected by the MBAM Client. In a TPM lockout, use the Administration and Monitoring Website to retrieve the necessary password file to unlock the TPM.

    How to Reset a TPM Lockout

    - - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md b/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md deleted file mode 100644 index 3be2d5cf4a..0000000000 --- a/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Use the Self-Service Portal to Regain Access to a Computer -description: How to Use the Self-Service Portal to Regain Access to a Computer -author: dansimp -ms.assetid: 3c24b13a-d1b1-4763-8ac0-0b2db46267e3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Use the Self-Service Portal to Regain Access to a Computer - - -The Self-Service Portal is a website that IT administrators configure as part of their Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 deployment. The website enables end users to independently regain access to their computers if they get locked out of Windows. The Self-Service Portal requires no assistance from Help Desk staff. - -The following instructions are written from the perspective of end users, but the information may be useful for IT administrators to understand. - -**Important**   -An end user must have physically logged on to the computer (not remotely) at least one time successfully to be able to recover their key using the Self-Service Portal. Otherwise, they must use the Helpdesk Portal for key recovery. - - - -End users may experience lockouts if they: - -- Forget their password or PIN - -- Change operating system files, the BIOS, or the Trusted Platform Module (TPM) - -**Note**   -If the IT administrator configured an IIS Session State time-out, a message is displayed in the Self-Service Portal 60 seconds prior to the time-out. - - - -**To use the Self-Service Portal to regain access to a computer** - -1. In the **Recovery KeyId** field, enter a minimum of eight of the 32-digit BitLocker Key ID that is displayed on the BitLocker recovery screen of your computer. If the first eight digits match multiple keys, a message displays that requires you to enter all 32 digits of the recovery key ID. - -2. In the **Reason** field, select a reason for your request for the recovery key. - -3. Click **Get Key**. Your BitLocker recovery key is displayed in the **Your BitLocker Recovery Key** field. - -4. Enter the 48-digit code into the BitLocker recovery screen on your computer to regain access to the computer. - - - -## Related topics - - -[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md b/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md deleted file mode 100644 index 7d2a8d5f0e..0000000000 --- a/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Illustrated Features of an MBAM 2.5 Deployment -description: Illustrated Features of an MBAM 2.5 Deployment -author: dansimp -ms.assetid: 7b5eff42-af8c-4bd0-a20a-18cc2e779f01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/15/2018 ---- - - -# Illustrated Features of an MBAM 2.5 Deployment - - -This topic describes the individual features that make up a Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 deployment for the following topologies: - -- MBAM Stand-alone - -- System Center Configuration Manager Integration - -**Important** -These features do not represent the recommended architecture for deploying MBAM. Use this information only as a guide to understand the individual features that make up an MBAM deployment. See [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) for the recommended architecture for MBAM. - - - -For a list of the supported versions of the software mentioned in this topic, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -## MBAM Stand-alone topology - - -The following image and table explain the features in an MBAM Stand-alone topology. - -![mbab2\-5](images/mbam2-5-standalonecomponents.png) - -|Feature type|Description|Database| -|-|-|-| -|Recovery Database|This database stores recovery data that is collected from MBAM client computers.|This feature is configured on a server running Windows Server and a supported SQL Server instance.| -|Compliance and Audit Database|This database stores compliance data, which is used primarily for the Reports that SQL Server Reporting Services hosts.|This feature is configured on a server running Windows Server and a supported SQL Server instance.| -|Compliance and Audit Reports||| -|Reporting Web Service|This web service enables communication between the Administration and Monitoring Website and the SQL Server instance where reporting data is stored.|This feature is installed on a server running Windows Server.| -|Reporting Website (Administration and Monitoring Website)|You view Reports from the Administration and Monitoring Website. The Reports provide recovery audit and compliance status data about the client computers in your enterprise.|This feature is configured on a server running Windows Server.| -|SQL Server Reporting Services (SSRS)|Reports are configured in an SSRS database instance. Reports can be viewed directly from SSRS or from the Administration and Monitoring Website.|This feature is configured on a server running Windows Server and a supported SQL Server instance that is running SSRS.| -|Self-Service Server||| -|Self-Service Web Service|This web service is used by the MBAM Client and the Administration and Monitoring Website and Self-Service Portal to communicate to the Recovery Database.|This feature is installed on a computer running Windows Server.| -|Self-Service Website (Self-Service Portal)|This website enables end users on client computers to independently sign in to a website to get a recovery key if they lose or forget their BitLocker password.|This feature is configured on a computer running Windows Server.| -|Administration and Monitoring Server||| -|Administration and Monitoring Web Service|The Monitoring Web Service is used by the MBAM Client and the websites to communicate to the databases.|This feature is installed on a computer running Windows Server.| - -**Important** -The Self-Service Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1, in which the MBAM Client, the Administration and Monitoring Website, and the Self-Service Portal communicate directly with the Recovery Database. - -**Important** -The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM Client and the websites communicate directly with the Recovery Database. - - -## System Center Configuration Manager Integration topology - -The following image and table explain the features in the System Center Configuration Manager Integration topology. - -![mbam2\-5](images/mbam2-5-cmcomponents.png) - -**Important** -The Self-Service Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1, in which the MBAM Client, the Administration and Monitoring Website, and the Self-Service Portal communicate directly with the Recovery Database. - -**Warning** -The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM Client and the websites communicate directly with the Recovery Database. - - -| Feature type | Description | -|------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Self-Service Server | | -| Self-Service Web Service | This web service is used by the MBAM Client and the Self-Service Portal to communicate to the Recovery Database. | -| Self-Service Website | This website enables end users on client computers to independently sign in to a website to get a recovery key if they lose or forget their BitLocker password. | -| Administration and Monitoring Server/Recovery Audit Report | | -| Administration and Monitoring Web Service | This web service enables communication between the Administration and Monitoring Website and the SQL Server databases where reporting data is stored. | -| Administration and Monitoring Website | The Recovery Audit report is viewed from the Administration and Monitoring Website. Use the Configuration Manager console to view all other reports, or view reports directly from SQL Server Reporting Services. | -| Databases | | -| Recovery Database | This database stores recovery data that is collected from MBAM client computers. | -| Audit Database | This database stores audit information about recovery attempts and activity. | -| Configuration Manager Features | | -| Configuration Manager Management console | This console is built into Configuration Manager and is used to view reports. | -| Configuration Manager Reports | Reports show compliance and recovery audit data for client computers in your enterprise. | -| SQL Server Reporting Services | SSRS enables the MBAM Reports. Reports can be viewed directly from SSRS or from the Configuration Manager console. | - -## Related topics - -[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/images/checklistbox.gif b/mdop/mbam-v25/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/mbam-v25/images/checklistbox.gif and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-1.png b/mdop/mbam-v25/images/deploying-MBAM-1.png deleted file mode 100644 index eeb70cba71..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-1.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-10.png b/mdop/mbam-v25/images/deploying-MBAM-10.png deleted file mode 100644 index 69c5ddf7c5..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-10.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-11.png b/mdop/mbam-v25/images/deploying-MBAM-11.png deleted file mode 100644 index 6a33a96097..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-11.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-12.png b/mdop/mbam-v25/images/deploying-MBAM-12.png deleted file mode 100644 index c21dda4c80..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-12.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-13.png b/mdop/mbam-v25/images/deploying-MBAM-13.png deleted file mode 100644 index 3fec7c2d3a..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-13.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-14.png b/mdop/mbam-v25/images/deploying-MBAM-14.png deleted file mode 100644 index 514a80cce5..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-14.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-2.png b/mdop/mbam-v25/images/deploying-MBAM-2.png deleted file mode 100644 index c7f7bc2b42..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-2.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-3.png b/mdop/mbam-v25/images/deploying-MBAM-3.png deleted file mode 100644 index a4c20e2096..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-3.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-4.png b/mdop/mbam-v25/images/deploying-MBAM-4.png deleted file mode 100644 index e1f8c45c3f..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-4.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-5.png b/mdop/mbam-v25/images/deploying-MBAM-5.png deleted file mode 100644 index 93886bc19e..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-5.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-6.png b/mdop/mbam-v25/images/deploying-MBAM-6.png deleted file mode 100644 index 4822eaf50b..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-6.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-7.png b/mdop/mbam-v25/images/deploying-MBAM-7.png deleted file mode 100644 index 11232fc2ed..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-7.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-8.png b/mdop/mbam-v25/images/deploying-MBAM-8.png deleted file mode 100644 index 707cf78794..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-8.png and /dev/null differ diff --git a/mdop/mbam-v25/images/deploying-MBAM-9.png b/mdop/mbam-v25/images/deploying-MBAM-9.png deleted file mode 100644 index cdd490f4d5..0000000000 Binary files a/mdop/mbam-v25/images/deploying-MBAM-9.png and /dev/null differ diff --git a/mdop/mbam-v25/images/mbam2-5-2servers.png b/mdop/mbam-v25/images/mbam2-5-2servers.png deleted file mode 100644 index 2db19008d6..0000000000 Binary files a/mdop/mbam-v25/images/mbam2-5-2servers.png and /dev/null differ diff --git a/mdop/mbam-v25/images/mbam2-5-cmcomponents.png b/mdop/mbam-v25/images/mbam2-5-cmcomponents.png deleted file mode 100644 index 8b5f59f115..0000000000 Binary files a/mdop/mbam-v25/images/mbam2-5-cmcomponents.png and /dev/null differ diff --git a/mdop/mbam-v25/images/mbam2-5-cmserver.png b/mdop/mbam-v25/images/mbam2-5-cmserver.png deleted file mode 100644 index 2fb56b9435..0000000000 Binary files a/mdop/mbam-v25/images/mbam2-5-cmserver.png and /dev/null differ diff --git a/mdop/mbam-v25/images/mbam2-5-standalonecomponents.png b/mdop/mbam-v25/images/mbam2-5-standalonecomponents.png deleted file mode 100644 index 8a96c611d0..0000000000 Binary files a/mdop/mbam-v25/images/mbam2-5-standalonecomponents.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-1.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-1.png deleted file mode 100644 index 3ae07ddf32..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-1.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-10.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-10.png deleted file mode 100644 index d4f0ccd596..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-10.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-11.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-11.png deleted file mode 100644 index c6835166f1..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-11.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-2.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-2.png deleted file mode 100644 index 488b60ea4c..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-2.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-3.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-3.png deleted file mode 100644 index 3ad922e3a5..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-3.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-4.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-4.png deleted file mode 100644 index 3bfaf4918a..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-4.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-5.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-5.png deleted file mode 100644 index 1cf43b2ba3..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-5.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-6.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-6.png deleted file mode 100644 index 8aab8a27a5..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-6.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-7.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-7.png deleted file mode 100644 index 35d487937f..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-7.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-8.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-8.png deleted file mode 100644 index 11a30cde0f..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-8.png and /dev/null differ diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-9.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-9.png deleted file mode 100644 index 0c7ab8f429..0000000000 Binary files a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-9.png and /dev/null differ diff --git a/mdop/mbam-v25/index.md b/mdop/mbam-v25/index.md deleted file mode 100644 index 3f71f9edd8..0000000000 --- a/mdop/mbam-v25/index.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Microsoft BitLocker Administration and Monitoring 2.5 -description: Microsoft BitLocker Administration and Monitoring 2.5 -author: dansimp -ms.assetid: fd81d7de-b166-47e8-b6c7-d984830762b6 -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - -# Microsoft BitLocker Administration and Monitoring 2.5 - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides a simplified administrative interface that you can use to manage BitLocker Drive Encryption. You configure MBAM Group Policy Templates that enable you to set BitLocker Drive Encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. For a more detailed description of MBAM, see [About MBAM 2.5](about-mbam-25.md). - -To obtain MBAM, see [How Do I Get MDOP](https://docs.microsoft.com/microsoft-desktop-optimization-pack/index#how-to-get-mdop). - -## Outline - -- [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - - [About MBAM 2.5](about-mbam-25.md) - - [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md) - - [About MBAM 2.5 SP1](about-mbam-25-sp1.md) - - [Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md) - - [Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md) - - [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) - - [Accessibility for MBAM 2.5](accessibility-for-mbam-25.md) -- [Planning for MBAM 2.5](planning-for-mbam-25.md) - - [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - - [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - - [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) - - [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) - - [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md) - - [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - - [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - - [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md) - - [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md) - - [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) -- [Deploying MBAM 2.5](deploying-mbam-25.md) - - [Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md) - - [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) - - [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - - [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md) - - [Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md) - - [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md) -- [Operations for MBAM 2.5](operations-for-mbam-25.md) - - [Administering MBAM 2.5 Features](administering-mbam-25-features.md) - - [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - - [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - [Maintaining MBAM 2.5](maintaining-mbam-25.md) - - [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) -- [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) -- [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - - [Client Event Logs](client-event-logs.md) - - [Server Event Logs](server-event-logs.md) - -## More Information - -- [MDOP Information Experience](index.md) - - Find documentation, videos, and other resources for MDOP technologies. - -- [MBAM Deployment Guide](https://www.microsoft.com/download/details.aspx?id=38398) - - Get help in choosing a deployment method for MBAM, including step-by-step instructions for each method. - -- [Apply Hotfixes on MBAM 2.5 SP1 Server](apply-hotfix-for-mbam-25-sp1.md) - - Guide of how to apply MBAM 2.5 SP1 Server hotfixes diff --git a/mdop/mbam-v25/installing-the-mbam-25-server-software.md b/mdop/mbam-v25/installing-the-mbam-25-server-software.md deleted file mode 100644 index d238b982fe..0000000000 --- a/mdop/mbam-v25/installing-the-mbam-25-server-software.md +++ /dev/null @@ -1,150 +0,0 @@ ---- -title: Installing the MBAM 2.5 Server Software -description: Installing the MBAM 2.5 Server Software -author: dansimp -ms.assetid: b9dbe697-5400-4bac-acfb-ee6dc6586c30 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installing the MBAM 2.5 Server Software - - -This topic describes how to install the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard or by using command-line parameters. Repeat the server installation process for each server on which you are configuring MBAM 2.5 Server features. After you finish the installation, see [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) for steps about configuring the Server features. - - ---- - - - - - - - - - - - - - - - - -
    Before you startDescription

    Review the MBAM 2.5 planning information

    Read how to get log files

    By default, log files are created in the local computer’s %temp% folder. To write the log files to a specific location rather than to the %temp% folder, use the /log <location> argument.

    -

    Additional events might be logged in Event Viewer in the MBAM-Setup or MBAM-Web nodes under Applications and Services Logs > Microsoft > Windows. For example, if you uninstall MBAM, the uninstaller will also uninstall the MBAM-Setup and MBAM-Web logs in EventViewer.

    - - - -## Installing the MBAM 2.5 Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard - - -Use these steps to install the MBAM Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard. - -**To install the MBAM 2.5 Server software by using the wizard** - -1. On the server where you want to install MBAM, run **MBAMserversetup.exe** to start the Microsoft BitLocker Administration and Monitoring Setup wizard. - -2. On the **Welcome** page, click **Next**. - -3. Read and accept the Microsoft Software License Agreement, and then click **Next** to continue the installation. - -4. Choose whether to use Microsoft Update when you check for updates, and then click **Next**. - -5. Choose whether to participate in the Customer Experience Improvement Program, and then click **Next**. - -6. To start the installation, click **Install**. - -7. To configure the server features after the MBAM Server software finishes installing, select the **Run MBAM Server Configuration after the wizard closes** check box. Alternatively, you can configure MBAM later by using the **MBAM Server Configuration** shortcut that the server installation creates on your **Start** menu. - -8. Click **Finish**. - -## Installing the MBAM 2.5 Server software by using a Command Prompt window - - -At a command prompt, type a command similar to the following command to install the MBAM Server software. - -``` syntax -MbamServerSetup.exe MBAMServerInstall.log -CEIPENABLED=True OPTIN_FOR_MICROFOST_UPDATES=True INSTALLDIR=c:\mbaminstall -``` - -The following table describes the command-line parameters for installing the MBAM 2.5 Server software. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterParameter valueDescription

    CEIPENABLED

    True False

    True - participate in the Customer Improvement Experience Program, which helps Microsoft identify which MBAM features to improve.

    -

    False – do not participate in the Customer Improvement Experience Program.

    OPTIN_FOR_MICROSOFT_UPDATES

    True False

    True - use Microsoft Update to keep your computer secure and up-to-date for Windows and other Microsoft products, including MBAM.

    -

    False – do not use Microsoft Update

    INSTALLDIR

    <Path>

    Location where you want to install MBAM.

    -

    Example:

    -

    INSTALLDIR=c:\mbaminstall

    FORCE_UNINSTALL

    True False

    True - continue the process of uninstalling MBAM, even if any features fail to be removed.

    -

    False (default) if the uninstallation custom action fails to remove an added MBAM Server feature, the uninstallation fails, and MBAM remains installed.

    -

    In both instances, any features that were successfully removed during the attempt to uninstall MBAM stay removed.

    - - - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/maintaining-mbam-25.md b/mdop/mbam-v25/maintaining-mbam-25.md deleted file mode 100644 index 56128367b9..0000000000 --- a/mdop/mbam-v25/maintaining-mbam-25.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Maintaining MBAM 2.5 -description: Maintaining MBAM 2.5 -author: dansimp -ms.assetid: 44d398a0-2ca0-4d47-943c-322345409b59 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Maintaining MBAM 2.5 - - -The topics in this section describe maintenance tasks that you can perform with Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. - -## Moving MBAM 2.5 features to another server - - -Use the steps in this topic to move an MBAM Server feature from one server computer to another. - -[Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md) - -## Monitoring web service request performance counters - - -Use the steps in this topic to monitor the performance counters that record the performance of requests that are sent to the web services for the Administration and Monitoring Website and the Self-Service Portal. - -[Monitoring Web Service Request Performance Counters](monitoring-web-service-request-performance-counters.md) - -## Other resources for maintaining MBAM - - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/mbam-25-deployment-checklist.md b/mdop/mbam-v25/mbam-25-deployment-checklist.md deleted file mode 100644 index 660b1ebf79..0000000000 --- a/mdop/mbam-v25/mbam-25-deployment-checklist.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: MBAM 2.5 Deployment Checklist -description: MBAM 2.5 Deployment Checklist -author: dansimp -ms.assetid: 2ba7de17-e3a4-4798-99e0-cd1dc28c5b76 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.5 Deployment Checklist - - -You can use this checklist to help you during Microsoft BitLocker Administration and Monitoring (MBAM) deployment with a Stand-alone topology. - -**Note** -This checklist outlines the recommended steps and a high-level list of items to consider when you deploy Microsoft BitLocker Administration and Monitoring features. We recommend that you copy this checklist into a spreadsheet program and customize it for your use. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Review and complete all planning steps to prepare your environment for MBAM deployment.

    MBAM 2.5 Planning Checklist

    Checklist box

    Review the supported configurations information to ensure that MBAM supports the selected client and server computers.

    MBAM 2.5 Supported Configurations

    Checklist box

    Install the MBAM Server software.

    Installing the MBAM 2.5 Server Software

    Checklist box

    Configure the MBAM Server features:

    -
      -
    • Compliance and Audit Database and Recovery Database

    • -
    • Reports

    • -
    • Web applications

    • -
    • Configuration Manager Integration topology (needed only if you are running MBAM with this topology)

    • -
    -
    -Note

    Note the names of the servers on which you configure each feature. You will use this information throughout the configuration process.

    -
    -
    - -

    Configuring the MBAM 2.5 Server Features

    Checklist box

    Validate the MBAM configuration.

    Validating the MBAM 2.5 Server Feature Configuration

    Checklist box

    Copy the MBAM Group Policy Template and edit the Group Policy settings.

    Copying the MBAM 2.5 Group Policy Templates and Editing the MBAM 2.5 Group Policy Settings

    Checklist box

    Deploy the MBAM Client software.

    Deploying the MBAM 2.5 Client

    - - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/mbam-25-deployment-prerequisites.md b/mdop/mbam-v25/mbam-25-deployment-prerequisites.md deleted file mode 100644 index aecfb3c56b..0000000000 --- a/mdop/mbam-v25/mbam-25-deployment-prerequisites.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: MBAM 2.5 Deployment Prerequisites -description: MBAM 2.5 Deployment Prerequisites -author: dansimp -ms.assetid: a7b02d01-d182-4031-b373-0271177af14e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.5 Deployment Prerequisites - - -This section contains the software that you must install before starting the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 installation. - -## MBAM 2.5 prerequisites topics - - -- [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) - - This topic lists the prerequisites that apply to the Stand-alone topology and System Center Configuration Manager Integration topology. - -- [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) - - This topic lists the prerequisites that apply only to the System Center Configuration Manager Integration topology. - - - [Prerequisites for the Configuration Manager Integration Feature](prerequisites-for-the-configuration-manager-integration-feature.md) - - This topic lists the software prerequisites for the System Center Configuration Manager Integration topology. - - - [Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) - - Instructions for editing the **Configuration.mof** file are described. - - - [Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) - - Instructions for editing or creating the **Sms\_def.mof** file are described. - -- [Prerequisites for MBAM 2.5 Clients](prerequisites-for-mbam-25-clients.md) - - This topic lists the MBAM 2.5 Client prerequisites. - -## Other resources for MBAM 2.5 prerequisites - - -- [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -- [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -- [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/mbam-25-planning-checklist.md b/mdop/mbam-v25/mbam-25-planning-checklist.md deleted file mode 100644 index 015403224b..0000000000 --- a/mdop/mbam-v25/mbam-25-planning-checklist.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: MBAM 2.5 Planning Checklist -description: MBAM 2.5 Planning Checklist -author: dansimp -ms.assetid: ffe11eb8-44db-4886-8300-6dffec8bcfa4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.5 Planning Checklist - - -You can use the following checklists to help you prepare your computing environment for the Microsoft BitLocker Administration and Monitoring (MBAM) deployment. The checklists provide a high-level list of items to consider when planning the deployment. There are separate checklists for the Stand-alone topology and the Configuration Manager Integration topology. You might want to copy the desired checklist into a spreadsheet and customize it for your use. - -**Planning checklist for an MBAM deployment** - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferencesNotes
    Checklist box

    Review the "Getting started" information to understand the product before you start deployment planning.

    Getting Started with MBAM 2.5

    Checklist box

    Review the recommended high-level architecture for an MBAM deployment. You might also want to review an illustration and description of the individual parts (databases, websites, Reports) of an MBAM deployment.

    High-Level Architecture for MBAM 2.5

    -

    Illustrated Features of an MBAM 2.5 Deployment

    Checklist box

    Review and complete the prerequisites for the MBAM Stand-alone and Configuration Manager Integration topologies.

    MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies

    Checklist box

    If you plan to use the Configuration Manager Integration topology, complete the additional prerequisites that apply only to this topology.

    MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology

    Checklist box

    Review and meet the MBAM 2.5 prerequisites for the MBAM Client.

    Prerequisites for MBAM 2.5 Clients

    Checklist box

    Plan for and configure MBAM Group Policy requirements.

    Planning for MBAM 2.5 Group Policy Requirements

    Checklist box

    Plan for and create the necessary Active Directory Domain Services security groups.

    Planning for MBAM 2.5 Groups and Accounts

    Checklist box

    Plan how you will secure the MBAM websites.

    Planning How to Secure the MBAM Websites

    Checklist box

    Review the MBAM Supported Configurations to ensure that your hardware meets the installation system requirements.

    MBAM 2.5 Supported Configurations

    Checklist box

    Review the considerations for deploying the MBAM Server features.

    Planning for MBAM 2.5 Server Deployment

    Checklist box

    Review the considerations for deploying the MBAM Client.

    Planning for MBAM 2.5 Client Deployment

    Checklist box

    Review the requirements and steps to deploy MBAM in a highly available configuration.

    Planning for MBAM 2.5 High Availability

    Checklist box

    Review the MBAM security considerations that pertain to the Trusted Platform Module, log files, and transparent data encryption.

    MBAM 2.5 Security Considerations

    Checklist box

    Optionally, review the steps to evaluate MBAM in a test environment.

    Evaluating MBAM 2.5 in a Test Environment

    - - - - -## Related topics - - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/mbam-25-security-considerations.md b/mdop/mbam-v25/mbam-25-security-considerations.md deleted file mode 100644 index 05695a6beb..0000000000 --- a/mdop/mbam-v25/mbam-25-security-considerations.md +++ /dev/null @@ -1,317 +0,0 @@ ---- -title: MBAM 2.5 Security Considerations -description: MBAM 2.5 Security Considerations -author: dansimp -ms.assetid: f6613c63-b32b-45fb-a6e8-673d6dae7d16 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/23/2017 ---- - - -# MBAM 2.5 Security Considerations - - -This topic contains the following information about how to secure Microsoft BitLocker Administration and Monitoring (MBAM): - -- [Configure MBAM to escrow the TPM and store OwnerAuth passwords](#bkmk-tpm) - -- [Configure MBAM to automatically unlock the TPM after a lockout](#bkmk-autounlock) - -- [Secure connections to SQL Server](#bkmk-secure-databases) - -- [Create accounts and groups](#bkmk-accts-groups) - -- [Use MBAM log files](#bkmk-logfiles) - -- [Review MBAM database TDE considerations](#bkmk-tde) - -- [Understand general security considerations](#bkmk-general-security) - -## Configure MBAM to escrow the TPM and store OwnerAuth passwords - -**Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addition, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/information-protection/tpm/change-the-tpm-owner-password) for further details. - -Depending on its configuration, the Trusted Platform Module (TPM) will lock itself in certain situations ─ such as when too many incorrect passwords are entered ─ and can remain locked for a period of time. During TPM lockout, BitLocker cannot access the encryption keys to perform unlock or decryption operations, requiring the user to enter their BitLocker recovery key to access the operating system drive. To reset TPM lockout, you must provide the TPM OwnerAuth password. - -MBAM can store the TPM OwnerAuth password in the MBAM database if it owns the TPM or if it escrows the password. OwnerAuth passwords are then easily accessible on the Administration and Monitoring Website when you must recover from a TPM lockout, eliminating the need to wait for the lockout to resolve on its own. - -### Escrowing TPM OwnerAuth in Windows 8 and higher - -**Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/information-protection/tpm/change-the-tpm-owner-password) for further details. - -In Windows 8 or higher, MBAM no longer must own the TPM to store the OwnerAuth password, as long as the OwnerAuth is available on the local machine. - -To enable MBAM to escrow and then store TPM OwnerAuth passwords, you must configure these Group Policy settings. - - ---- - - - - - - - - - - - - - - - - -
    Group Policy SettingConfiguration

    Turn on TPM backup to Active Directory Domain Services

    Disabled or Not Configured

    Configure the level of TPM owner authorization information available to the operating system

    Delegated/None or Not Configured

    - - - -The location of these Group Policy settings is **Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services**. - -**Note**   -Windows removes the OwnerAuth locally after MBAM successfully escrows it with these settings. - - - -### Escrowing TPM OwnerAuth in Windows 7 - -In Windows 7, MBAM must own the TPM to automatically escrow TPM OwnerAuth information in the MBAM database. If MBAM does not own the TPM, you must use the MBAM Active Directory (AD) Data Import cmdlets to copy TPM OwnerAuth from Active Directory into the MBAM database. - -### MBAM Active Directory Data Import cmdlets - -The MBAM Active Directory Data Import cmdlets let you retrieve recovery key packages and OwnerAuth passwords that are stored in Active Directory. - -The MBAM 2.5 SP1 server ships with four PowerShell cmdlets that pre-populate MBAM databases with the Volume recovery and TPM owner information stored in Active Directory. - -For Volume Recovery keys and packages: - -- Read-ADRecoveryInformation - -- Write-MbamRecoveryInformation - -For TPM Owner Information: - -- Read-ADTpmInformation - -- Write-MbamTpmInformation - -For Associating Users to Computers: - -- Write-MbamComputerUser - -The Read-AD\* cmdlets read information from Active Directory. The Write-Mbam\* cmdlets push the data into the MBAM databases. See [Cmdlet Reference for Microsoft Bitlocker Administration and Monitoring 2.5](https://technet.microsoft.com/library/dn459018.aspx) for detailed information about these cmdlets, including syntax, parameters, and examples. - -**Create user-to-computer associations:** The MBAM Active Directory Data Import cmdlets gather information from Active Directory and insert the data into MBAM database. However, they do not associate users to volumes. You can download the Add-ComputerUser.ps1 PowerShell script to create user-to-machine associations, which let users regain access to a computer through the Administration and Monitoring Website or by using the Self-Service Portal for recovery. The Add-ComputerUser.ps1 script gathers data from the **Managed By** attribute in Active Directory (AD), the object owner in AD, or from a custom CSV file. The script then adds the discovered users to the recovery information pipeline object, which must be passed to Write-MbamRecoveryInformation to insert the data into the recovery database. - -Download the Add-ComputerUser.ps1 PowerShell script from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=613122). - -You can specify **help Add-ComputerUser.ps1** to get help for the script, including examples of how to use the cmdlets and the script. - -To create user-to-computer associations after you have installed the MBAM server, use the Write-MbamComputerUser PowerShell cmdlet. Similar to the Add-ComputerUser.ps1 PowerShell script, this cmdlet lets you specify users that can use the Self-Service Portal to get TPM OwnerAuth information or volume recovery passwords for the specified computer. - -**Note**   -The MBAM agent will override user-to-computer associations when that computer begins reporting up to the server. - - - -**Prerequisites:** The Read-AD\* cmdlets can retrieve information from AD only if they are either run as a highly privileged user account, such as a Domain Administrator, or run as an account in a custom security group granted read access to the information (recommended). - -[BitLocker Drive Encryption Operations Guide: Recovering Encrypted Volumes with AD DS](https://technet.microsoft.com/library/cc771778(WS.10).aspx) provides details about creating a custom security group (or multiple groups) with read access to the AD information. - -**MBAM Recovery and Hardware Web Service Write Permissions:** The Write-Mbam\* cmdlets accept the URL of the MBAM Recovery and Hardware Service, used to publish the recovery or TPM information. Typically, only a domain computer service account can communicate with the MBAM Recovery and Hardware Service. In MBAM 2.5 SP1, you can configure the MBAM Recovery and Hardware Service with a security group called DataMigrationAccessGroup whose members are allowed to bypass the domain computer service account check. The Write-Mbam\* cmdlets must be run as a user belonging to this configured group. (Alternatively, the credentials of an individual user in the configured group can be specified by using the –Credential parameter in the Write-Mbam\* cmdlets.) - -You can configure the MBAM Recovery and Hardware Service with the name of this security group in one of these ways: - -- Provide the name of the security group (or individual) in the -DataMigrationAccessGroup parameter of the Enable-MbamWebApplication –AgentService Powershell cmdlet. - -- Configure the group after the MBAM Recovery and Hardware Service has been installed by editing the web.config file in the <inetpub>\\Microsoft Bitlocker Management Solution\\Recovery and Hardware Service\\ folder. - - ```xml - - ``` - - where <groupName> is replaced with the domain and the group name (or the individual user) that will be used to allow data migration from Active Directory. - -- Use the Configuration Editor in IIS Manager to edit this appSetting. - -In the following example, the command, when run as a member of both the ADRecoveryInformation group and the Data Migration Users group, will pull the volume recovery information from computers in the WORKSTATIONS organizational unit (OU) in the contoso.com domain and write them to MBAM by using the MBAM Recovery and Hardware Service running on the mbam.contoso.com server. - -``` syntax -PS C:\> Read-ADRecoveryInformation -Server contoso.com -SearchBase "OU=WORKSTATIONS,DC=CONTOSO,DC=COM" | Write-MbamRecoveryInformation -RecoveryServiceEndPoint "https://mbam.contoso.com/MBAMRecoveryAndHardwareService/CoreService.svc" -``` - -**Read-AD\* cmdlets** accept the name or IP address of an Active Directory hosting server machine to query for recovery or TPM information. We recommend providing the distinguished names of the AD containers in which the computer object resides as the value of the SearchBase parameter. If computers are stored across several OUs, the cmdlets can accept pipeline input to run once for each container. The distinguished name of an AD container will look similar to OU=Machines,DC=contoso,DC=com. Performing a search targeted to specific containers provides the following benefits: - -- Reduces the risk of timeout while querying a large AD dataset for computer objects. - -- Can omit OUs containing datacenter servers or other classes of computers for which the backup might not be desired or necessary. - -Another option is to provide the –Recurse flag with or without the optional SearchBase to search for computer objects across all containers under the specified SearchBase or the entire domain respectively. When you use the -Recurse flag, you can also use the -MaxPageSize parameter to control the amount of local and remote memory required to service the query. - -These cmdlets write to the pipeline objects of type PsObject. Each PsObject instance contains a single volume recovery key or TPM owner string with its associated computer name, timestamp, and other information required to publish it to the MBAM data store. - -**Write-Mbam\* cmdlets** accept recovery information parameter values from the pipeline by property name. This allows the Write-Mbam\* cmdlets to accept the pipeline output of the Read-AD\* cmdlets (for example, Read-ADRecoveryInformation –Server contoso.com –Recurse | Write-MbamRecoveryInformation –RecoveryServiceEndpoint mbam.contoso.com). - -The **Write-Mbam\* cmdlets** include optional parameters that provide options for fault tolerance, verbose logging, and preferences for WhatIf and Confirm. - -The **Write-Mbam\* cmdlets** also include an optional *Time* parameter whose value is a **DateTime** object. This object includes a *Kind* attribute that can be set to `Local`, `UTC`, or `Unspecified`. When the *Time* parameter is populated from data taken from the Active Directory, the time is converted to UTC and this *Kind* attribute is set automatically to `UTC`. However, when populating the *Time* parameter using another source, such as a text file, you must explicitly set the *Kind* attribute to its appropriate value. - -**Note**   -The Read-AD\* cmdlets do not have the ability to discover the user accounts that represent the computer users. User account associations are needed for the following: - -- Users to recover volume passwords/packages by using the Self-Service portal - -- Users who are not in the MBAM Advanced Helpdesk Users security group as defined during installation, recovering on behalf of other users - - - -## Configure MBAM to automatically unlock the TPM after a lockout - - -You can configure MBAM 2.5 SP1 to automatically unlock the TPM in case of a lockout. If TPM lockout auto reset is enabled, MBAM can detect that a user is locked out and then get the OwnerAuth password from the MBAM database to automatically unlock the TPM for the user. TPM lockout auto reset is only available if the OS recovery key for that computer was retrieved by using the Self Service Portal or the Administration and Monitoring Website. - -**Important**   -To enable TPM lockout auto reset, you must configure this feature on both the server side and in Group Policy on the client side. - - - -- To enable TPM lockout auto reset on the client side, configure the Group Policy setting "Configure TPM lockout auto reset" located at **Computer Configuration** > **Administrative Templates** > **Windows Components** > **MDOP MBAM** > **Client Management**. - -- To enable TPM lockout auto reset on the server side, you can check "Enable TPM lockout auto reset" in the MBAM Server Configuration wizard during setup. - - You can also enable TPM lockout auto reset in PowerShell by specifying the "-TPM lockout auto reset" switch while enabling the agent service web component. - -After a user enters the BitLocker recovery key they obtained from the Self Service Portal or the Administration and Monitoring Website, the MBAM agent will determine if the TPM is locked out. If it is locked out, it will attempt to retrieve the TPM OwnerAuth for the computer from the MBAM database. If the TPM OwnerAuth is successfully retrieved, it will be used to unlock the TPM. Unlocking the TPM makes the TPM fully functional and the user will not be forced to enter the recovery password during subsequent reboots from a TPM lockout. - -TPM lockout auto reset is disabled by default. - -**Note**   -TPM lockout auto reset is only supported on computers running TPM version 1.2. TPM 2.0 provides built-in lockout auto reset functionality. - - - -**The Recovery Audit Report** includes events related to TPM lockout auto reset. If a request is made from the MBAM client to retrieve a TPM OwnerAuth password, an event is logged to indicate recovery. Audit entries will include the following events: - - ---- - - - - - - - - - - - - - - - - - - - - -
    EntryValue

    Audit Request Source

    Agent TPM unlock

    Key Type

    TPM Password Hash

    Reason Description

    TPM Reset

    - - - -## Secure connections to SQL Server - - -In MBAM, SQL Server communicates with SQL Server Reporting Services and with the web services for the Administration and Monitoring Website and Self-Service Portal. We recommend that you secure the communication with SQL Server. For more information, see [Encrypting Connections to SQL Server](https://technet.microsoft.com/library/ms189067.aspx). - -For more information about securing the MBAM websites, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md). - -## Create accounts and groups - - -The best practice for managing user accounts is to create domain global groups and add user accounts to them. For a description of the recommended accounts and groups, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md). - -## Use MBAM log files - - -This section describes the MBAM Server and MBAM Client log files. - -**MBAM Server Setup log files** - -The **MBAMServerSetup.exe** file generates the following log files in the user’s **%temp%** folder during the MBAM installation: - -- **Microsoft\_BitLocker\_Administration\_and\_Monitoring\_<14 numbers>.log** - - Logs the actions taken during the MBAM setup and the MBAM Server feature configuration. - -- **Microsoft\_BitLocker\_Administration\_and\_Monitoring\_<14\_numbers>\_0\_MBAMServer.msi.log** - - Logs additional action taken during installation. - -**MBAM Server Configuration log files** - -- **Applications and Services Logs/Microsoft Windows/MBAM-Setup** - - Logs the errors that occur when you are using Windows Powershell cmdlets or the MBAM Server Configuration wizard to configure the MBAM Server features. - -**MBAM Client setup log files** - -- **MSI<five random characters>.log** - - Logs the actions taken during the MBAM Client installation. - -**MBAM-Web log files** - -- Shows activity from the web portals and services. - -## Review MBAM database TDE considerations - - -The transparent data encryption (TDE) feature that is available in SQL Server is an optional installation for the database instances that will host the MBAM database features. - -With TDE, you can perform real-time, full database-level encryption. TDE is the optimal choice for bulk encryption to meet regulatory compliance or corporate data security standards. TDE works at the file level, which is similar to two Windows features: the Encrypting File System (EFS) and BitLocker Drive Encryption. Both features also encrypt data on the hard drive. TDE does not replace cell-level encryption, EFS, or BitLocker. - -When TDE is enabled on a database, all backups are encrypted. Thus, special care must be taken to ensure that the certificate that was used to protect the database encryption key is backed up and maintained with the database backup. If this certificate (or certificates) is lost, the data will be unreadable. - -Back up the certificate with the database. Each certificate backup should have two files. Both of these files should be archived. Ideally for security, they should be backed up separately from the database backup file. You can alternatively consider using the extensible key management (EKM) feature (see Extensible Key Management) for storage and maintenance of keys that are used for TDE. - -For an example of how to enable TDE for MBAM database instances, see [Understanding Transparent Data Encryption (TDE)](https://technet.microsoft.com/library/bb934049.aspx). - -## Understand general security considerations - - -**Understand the security risks.** The most serious risk when you use Microsoft BitLocker Administration and Monitoring is that its functionality could be compromised by an unauthorized user who could then reconfigure BitLocker Drive Encryption and gain BitLocker encryption key data on MBAM Clients. However, the loss of MBAM functionality for a short period of time, due to a denial-of-service attack, does not generally have a catastrophic impact, unlike, for example, losing e-mail or network communications, or power. - -**Physically secure your computers**. There is no security without physical security. An attacker who gets physical access to an MBAM Server could potentially use it to attack the entire client base. All potential physical attacks must be considered high risk and mitigated appropriately. MBAM Servers should be stored in a secure server room with controlled access. Secure these computers when administrators are not physically present by having the operating system lock the computer, or by using a secured screen saver. - -**Apply the most recent security updates to all computers**. Stay informed about new updates for Windows operating systems, SQL Server, and MBAM by subscribing to the Security Notification service at the [Security TechCenter](https://go.microsoft.com/fwlink/?LinkId=28819). - -**Use strong passwords or pass phrases**. Always use strong passwords with 15 or more characters for all MBAM administrator accounts. Never use blank passwords. For more information about password concepts, see [Password Policy](https://technet.microsoft.com/library/hh994572.aspx). - - - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md b/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md deleted file mode 100644 index b95c5a854c..0000000000 --- a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md +++ /dev/null @@ -1,430 +0,0 @@ ---- -title: MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies -description: MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies -author: dansimp -ms.assetid: 76a6047a-5c6e-42ff-af09-a6f382a69537 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies - - -Before starting the Microsoft BitLocker Administration and Monitoring (MBAM) installation, you must complete the prerequisites listed in this topic. These prerequisites apply to the MBAM Stand-alone topology and System Center Configuration Manager Integration topology. - -If you are deploying MBAM with System Center Configuration Manager, you must complete additional prerequisites, which are listed in [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md). - -For a list of the supported hardware and operating systems for MBAM, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md). - -**Important** -If BitLocker was used without MBAM, you must decrypt the drive and then clear TPM using tpm.msc. MBAM cannot take ownership of TPM if the client PC is already encrypted and the TPM owner password created. - - - -## Required MBAM roles and accounts - - - ---- - - - - - - - - - - - - -
    PrerequisiteDetails

    Groups created in Active Directory Domain Services (AD DS)

    See Planning for MBAM 2.5 Groups and Accounts for a description of these groups and accounts.

    - - - -## Prerequisites for the Recovery Database - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Supported version of SQL Server

    Install Microsoft SQL Server with SQL_Latin1_General_CP1_CI_AS collation.

    -

    See MBAM 2.5 Supported Configurations for supported versions.

    Required SQL Server permissions

    Required permissions:

    -
      -
    • SQL Server instance login server roles:

      -
        -
      • dbcreator

      • -
      • processadmin

      • -
    • -
    • SQL Server Reporting Services instance rights:

      -
        -
      • Create Folders

      • -
      • Publish Reports

      • -
    • -

    Optional - Install the Transparent Data Encryption (TDE) feature available in SQL Server

    The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries.

    -
    -Note

    TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see MBAM 2.5 Security Considerations.

    -
    -
    - -

    SQL Server Database Engine Services

    SQL Server Database Engine Services must be installed and running during MBAM Server installation.

    Windows PowerShell 3.0 or later

    Windows PowerShell does not have to be installed on the Recovery Database server if you are using Windows PowerShell to configure the database from a remote computer.

    - - - -## Prerequisites for the Compliance and Audit Database - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Supported version of SQL Server

    Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation.

    -

    See MBAM 2.5 Supported Configurations for supported versions.

    Required SQL Server permissions

    Required permissions:

    -
      -
    • SQL Server instance login server roles:

      -
        -
      • dbcreator

      • -
      • processadmin

      • -
    • -
    • SQL Server Reporting Services instance rights:

      -
        -
      • Create Folders

      • -
      • Publish Reports

      • -
    • -

    Optional - Install the Transparent Data Encryption (TDE) feature in SQL Server

    The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries.

    -

    TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see MBAM 2.5 Security Considerations.

    SQL Server Database Engine Services

    SQL Server Database Engine Services must be installed and running during MBAM Server installation. However, SQL Server can be running remotely; it doesn’t have to be on the same server on which you are installing the MBAM Server software.

    Windows PowerShell 3.0 or later

    Windows PowerShell does not have to be installed on the Compliance and Audit Database server if you are using Windows PowerShell to configure the database from a remote computer.

    - - - -## Prerequisites for the Reports - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Supported version of SQL Server

    Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation.

    -

    See MBAM 2.5 Supported Configurations for supported versions.

    SQL Server Reporting Services (SSRS)

    SSRS must be installed and running during the MBAM Server installation.

    -

    Configure SSRS in "native" mode and not in unconfigured or "SharePoint" mode.

    SSRS instance rights – required for configuring Reports only if you are installing databases on a separate server from the server where Reports are configured.

    Required instance rights:

    -
      -
    • Create Folders

    • -
    • Publish Reports

    • -

    Windows PowerShell 3.0 or later

    Windows PowerShell does not have to be installed on this Database server if you are using Windows PowerShell to configure the database from a remote computer.

    - - - -## Prerequisites for the Administration and Monitoring Server - - -The following table lists the installation prerequisites for the MBAM Administration and Monitoring Server. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Windows Server Web Server Role

    This role must be added to a server operating system that is supported for the Administration and Monitoring Server feature.

    Web Server (IIS) Management Tools

    Click IIS Management Scripts and Tools.

    SSL Certificate

    Optional. To secure communication between the client computers and the web services, you must obtain and install a certificate that a trusted security authority signed.

    Web Server Role Services

    Common HTTP Features:

    -
      -
    • Static Content

    • -
    • Default Document

    • -
    -

    Application Development:

    -
      -
    • ASP.NET

    • -
    • .NET Extensibility

    • -
    • ISAPI Extensions

    • -
    • ISAPI Filters

    • -
    -

    Security:

    -
      -
    • Windows Authentication

    • -
    • Request Filtering

    • -

    Windows Server Features

    .NET Framework 4.5 features:

    -
      -
    • .NET Framework 4.5 or 4.6

      -
        -
      • Windows Server 2016 - .NET Framework 4.6 is already installed for these versions of Windows Server, but you must enable it.

      • -
      • Windows Server 2012 or Windows Server 2012 R2 - .NET Framework 4.5 is already installed for these versions of Windows Server, but you must enable it.

      • -
      • Windows Server 2008 R2 - .NET Framework 4.5 is not included with Windows Server 2008 R2, so you must download Microsoft .NET Framework 4.5 and install it separately.

        -
        -Note

        If you are upgrading from MBAM 2.0 or MBAM 2.0 SP1 and need to install .NET Framework 4.5, see Release Notes for MBAM 2.5 for an additional required step to make the websites work.

        -
        -
        - -
      • -
    • -
    • WCF Activation

      -
        -
      • HTTP Activation

      • -
      • Non-HTTP Activation (Only for Windows Server 2008, 2012, and 2012 R2)

        -

      • -
    • -
    • TCP Activation

    • -
    -

    Windows Process Activation Service:

    -
      -
    • Process Model

    • -
    • .NET Framework Environment

    • -
    • Configuration APIs

    • -

    ASP.NET MVC 4.0

    ASP.NET MVC 4 download

    Service Principal Name (SPN)

    The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.

    -

    If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See Setspn for information about the rights required to create SPNs.

    -

    If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization to create the SPN for you by using the following command.

    -
    Setspn -s http/mbamvirtual contoso\mbamapppooluser
    -Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
    -

    In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser.

    -
    -Note

    If you are setting up Load Balancing, use the same application pool account on all servers.

    -
    -
    - -
    -

    For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see Planning How to Secure the MBAM Websites.

    - - - -## Prerequisites for the Self-Service Portal - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    Supported version of Windows Server

    See MBAM 2.5 Supported Configurations for supported versions.

    ASP.NET MVC 4.0

    ASP.NET MVC 4 download

    Web Service IIS Management Tools

    Service Principal Name (SPN)

    The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.

    -

    If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See Setspn for information about the rights required to create SPNs.

    -

    If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization administrators in your organization to create the SPN for you by using the following command.

    -
    Setspn -s http/mbamvirtual contoso\mbamapppooluser
    -Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
    -

    In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser.

    -
    -Note

    If you are setting up Load Balancing, use the same application pool account on all servers.

    -
    -
    - -
    -

    For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see Planning How to Secure the MBAM Websites.

    - - - -## Prerequisites for the Management Workstation - - - ---- - - - - - - - - - - - - -
    PrerequisiteDetails

    Before installing the MBAM Client, download the MBAM Group Policy Templates from How to Get MDOP Group Policy (.admx) Templates and configure them with the settings that you want to implement in your enterprise for BitLocker Drive Encryption.

    Before installing the MBAM Client, do the following:

    - ---- - - - - - - - - - - - - - - - - -
    What to doWhere to get instructions

    Copy the MBAM Group Policy Templates

    Copying the MBAM 2.5 Group Policy Templates

    Edit the Group Policy settings

    Editing the MBAM 2.5 Group Policy Settings

    -

    - - - - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md b/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md deleted file mode 100644 index 58cc6cf2fe..0000000000 --- a/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology -description: MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology -author: dansimp -ms.assetid: 74180d8d-7b0f-460f-b301-53595cde8381 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology - - -If you are installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 by using the System Center Configuration Manager Integration feature, you must complete the prerequisites described in this topic, in addition to those in [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md). You must also create or modify .mof files that are needed for the Configuration Manager Integration topology. - -## Prerequisites for the Configuration Manager Integration Feature - - -If you are configuring MBAM with the System Center Configuration Manager Integration topology, you must complete additional prerequisites that are required for Configuration Manager. - -[Prerequisites for the Configuration Manager Integration Feature](prerequisites-for-the-configuration-manager-integration-feature.md) - -## Edit the Configuration.mof file - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager Reports, you have to edit the Configuration.mof file for System Center 2012 Configuration Manager and Microsoft System Center Configuration Manager 2007. - -[Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md) - -## Create or edit the Sms\_def.mof file - - -To enable the client computers to report BitLocker compliance details in the MBAM Configuration Manager Reports, you have to create or edit the Sms\_def.mof file. If you are using System Center 2012 Configuration Manager, you must create the file. In Configuration Manager 2007, the file already exists, so you need to edit, but not overwrite, the existing file. - -[Create or Edit the Sms\_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md) - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/mbam-25-supported-configurations.md b/mdop/mbam-v25/mbam-25-supported-configurations.md deleted file mode 100644 index 95405633b3..0000000000 --- a/mdop/mbam-v25/mbam-25-supported-configurations.md +++ /dev/null @@ -1,619 +0,0 @@ ---- -title: MBAM 2.5 Supported Configurations -description: MBAM 2.5 Supported Configurations -author: dansimp -ms.assetid: ce689aff-9a55-4ae7-a968-23c7bda9b4d6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 10/24/2018 ---- - - -# MBAM 2.5 Supported Configurations - - -You can run Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 in a Stand-alone topology or in a Configuration Manager Integration topology that integrates MBAM with System Center Configuration Manager. If you use the recommended configuration for either topology in a production environment, MBAM supports up to 500,000 MBAM clients. For information about the recommended architecture and features that are configured on each server for each topology, see [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md). - -For additional configurations that are specific to the Configuration Manager Integration topology, see [Versions of Configuration Manager that MBAM supports](#bkmk-cm-ramreqs). - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - -## MBAM Supported Languages - - -The following tables show the languages that are supported for the MBAM Client (including the Self-Service Portal) and the MBAM Server in MBAM 2.5 and MBAM 2.5 SP1. - -**Supported Languages in MBAM 2.5 SP1:** - - ---- - - - - - - - - - - - - -
    Client LanguagesServer Languages

    Czech (Czech Republic) cs-CZ

    -

    Danish (Denmark) da-DK

    -

    Dutch (Netherlands) nl-NL

    -

    English (United States) en-US

    -

    Finnish (Finland) fi-FI

    -

    French (France) fr-FR

    -

    German (Germany) de-DE

    -

    Greek (Greece) el-GR

    -

    Hungarian (Hungary) hu-HU

    -

    Italian (Italy) it-IT

    -

    Japanese (Japan) ja-JP

    -

    Korean (Korea) ko-KR

    -

    Norwegian, Bokmål (Norway) nb-NO

    -

    Polish (Poland) pl-PL

    -

    Portuguese (Brazil) pt-BR

    -

    Portuguese (Portugal) pt-PT

    -

    Russian (Russia) ru-RU

    -

    Slovak (Slovakia) sk-SK

    -

    Spanish (Spain) es-ES

    -

    Swedish (Sweden) sv-SE

    -

    Turkish (Turkey) tr-TR

    -

    Slovenian (Slovenia) sl-SI

    -

    Simplified Chinese (PRC) zh-CN

    -

    Traditional Chinese (Taiwan) zh-TW

      -
    • English (United States) en-US

    • -
    • French (France) fr-FR

    • -
    • German (Germany) de-DE

    • -
    • Italian (Italy) it-IT

    • -
    • Japanese (Japan) ja-JP

    • -
    • Korean (Korea) ko-KR

    • -
    • Portuguese (Brazil) pt-BR

    • -
    • Russian (Russia) ru-RU

    • -
    • Spanish (Spain) es-ES

    • -
    • Simplified Chinese (PRC) zh-CN

    • -
    • Traditional Chinese (Taiwan) zh-TW

    • -
    - - - -**Supported Languages in MBAM 2.5:** - - ---- - - - - - - - - - - - - -
    Client LanguagesServer Languages
      -
    • English (United States) en-US

    • -
    • French (France) fr-FR

    • -
    • German (Germany) de-DE

    • -
    • Italian (Italy) it-IT

    • -
    • Japanese (Japan) ja-JP

    • -
    • Korean (Korea) ko-KR

    • -
    • Portuguese (Brazil) pt-BR

    • -
    • Russian (Russia) ru-RU

    • -
    • Spanish (Spain) es-ES

    • -
    • Simplified Chinese (PRC) zh-CN

    • -
    • Traditional Chinese (Taiwan) zh-TW

    • -
      -
    • English (United States) en-US

    • -
    • French (France) fr-FR

    • -
    • German (Germany) de-DE

    • -
    • Italian (Italy) it-IT

    • -
    • Japanese (Japan) ja-JP

    • -
    • Korean (Korea) ko-KR

    • -
    • Portuguese (Brazil) pt-BR

    • -
    • Russian (Russia) ru-RU

    • -
    • Spanish (Spain) es-ES

    • -
    • Simplified Chinese (PRC) zh-CN

    • -
    • Traditional Chinese (Taiwan) zh-TW

    • -
    - - - -## MBAM Server system requirements - - -### MBAM Server operating system requirements - -We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. - -The following table lists the operating systems that are supported for the MBAM Server installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Windows Server 2016

    Standard or Datacenter

    64-bit

    Windows Server 2012 R2

    Standard or Datacenter

    64-bit

    Windows Server 2012

    Standard or Datacenter

    64-bit

    Windows Server 2008 R2

    Standard, Enterprise, or Datacenter

    SP1

    64-bit

    - - - -The enterprise domain must contain at least one Windows Server 2008 (or later) domain controller. - -### MBAM Server processor, RAM, and disk space requirements – Stand-alone topology - -These requirements are for the MBAM Stand-alone topology. For the requirements for the Configuration Manager Integration topology, see [MBAM Server Processor, RAM, and Disk Space Requirements - Configuration Manager Integration Topology](#bkmk-cm-ramreqs). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Hardware itemMinimum requirementRecommended requirement

    Processor

    2.33 GHz

    2.33 GHz or greater

    RAM

    8 GB

    12 GB

    Free disk space

    1 GB

    2 GB

    - - - -### MBAM Server processor, RAM, and disk space requirements - Configuration Manager Integration topology - -The following table lists the server processor, RAM, and disk space requirements for MBAM servers when you are using the Configuration Manager Integration topology. For the requirements for the Stand-alone topology, see [MBAM Server Processor, RAM, and Disk Space Requirements – Stand-alone Topology](#bkmk-stand-alone-ramreqs). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Hardware itemMinimum requirementRecommended requirement

    Processor

    2.33 GHz

    2.33 GHz or greater

    RAM

    4 GB

    8 GB

    Free disk space

    1 GB

    2 GB

    - - - -### Versions of Configuration Manager that MBAM supports - -MBAM supports the following versions of Configuration Manager. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Supported versionService packSystem architecture

    Microsoft System Center Configuration Manager (Current Branch), versions up to 1902

    64-bit

    Microsoft System Center Configuration Manager 1806

    64-bit

    Microsoft System Center Configuration Manager (LTSB - version 1606)

    64-bit

    Microsoft System Center 2012 Configuration Manager

    SP1

    64-bit

    Microsoft System Center Configuration Manager 2007 R2 or later

    64-bit

    - ->Note Although Configuration Manager 2007 R2 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software. -
    - - - -For a list of supported configurations for the Configuration Manager Server, see the appropriate TechNet documentation for the version of Configuration Manager that you are using. MBAM has no additional system requirements for the Configuration Manager Server. - -### SQL Server database requirements - -The following table lists the Microsoft SQL Server versions that are supported for the MBAM Server features, which include the Recovery Database, Compliance and Audit Database, and the Reports feature. The required versions apply to the Stand-alone or the Configuration Manager Integration topologies. - -You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** collation. - - ------ - - - - - - - - - - - - - -
    - - - -https://www.microsoft.com/download/details.aspx?id=54967 - - - - - - - - - - - - - - - - - -
    SQL Server versionEditionService packSystem architecture

    Microsoft SQL Server 2017

    Standard, Enterprise, or Datacenter

    64-bit

    Microsoft SQL Server 2016

    Standard, Enterprise, or Datacenter

    SP1

    64-bit

    Microsoft SQL Server 2014

    Standard, Enterprise, or Datacenter

    SP1, SP2

    64-bit

    Microsoft SQL Server 2012

    Standard, Enterprise, or Datacenter

    SP3

    64-bit

    Microsoft SQL Server 2008 R2

    Standard or Enterprise

    SP3

    64-bit

    - -**Note** -In order to support SQL 2016 you must install the March 2017 Servicing Release for MDOP https://www.microsoft.com/download/details.aspx?id=54967 and to support SQL 2017 you must install the July 2018 Servicing Release for MDOP https://www.microsoft.com/download/details.aspx?id=57157. In general stay current by always using the most recent servicing update as it also includes all bugfixes and new features. - - -### SQL Server processor, RAM, and disk space requirements – Stand-alone topology - -The following table lists the recommended server processor, RAM, and disk space requirements for the SQL Server computer when you are using the Stand-alone topology. Use these requirements as a guide. Your specific requirements will vary based on the number of client computers you are supporting in your enterprise. To view the requirements for the Configuration Manager Integration topology, see [SQL Server Processor, RAM, and Disk Space Requirements - Configuration Manager Integration Topology](#bkmk-cm-sql-ramreqs). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Hardware itemMinimum requirementRecommended requirement

    Processor

    2.33 GHz

    2.33 GHz or greater

    RAM

    8 GB

    12 GB

    Free disk space

    5 GB

    5 GB or greater

    - - - -### SQL Server processor, RAM, and disk space requirements - Configuration Manager Integration topology - -The following table lists the server processor, RAM, and disk space requirements for the Microsoft SQL Server computer when you are using the Configuration Manager Integration topology, see [SQL Server Processor, RAM, and Disk Space Requirements – Stand-alone Topology](#bkmk-sql-stand-alone-ramreqs). - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    Hardware itemMinimum requirementRecommended requirement

    Processor

    2.33 GHz

    2.33 GHz or greater

    RAM

    4 GB

    8 GB

    Free disk space

    5 GB

    5 GB

    - - - -## MBAM Client system requirements - - -### Client operating system requirements - -We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on. - -The following table lists the operating systems that are supported for MBAM Client installation. The same requirements apply to the Stand-alone and the Configuration Manager Integration topologies. - - ------ - - - - - - - - - - - - - - -
    - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Windows 10 IoT

    Enterprise

    32-bit or 64-bit

    Windows 10

    Enterprise

    32-bit or 64-bit

    Windows 8.1

    Enterprise

    32-bit or 64-bit

    Windows 7

    Enterprise or Ultimate

    SP1

    32-bit or 64-bit

    Windows To Go

    Windows 8.1 and Windows 10 Enterprise

    32-bit or 64-bit

    - - - -### Client RAM requirements - -There are no RAM requirements that are specific to the MBAM Client installation. - -## MBAM Group Policy system requirements - - -The following table lists the operating systems that are supported for MBAM Group Policy Templates installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architecture

    Windows 10 IoT

    Enterprise

    32-bit or 64-bit

    Windows 10

    Enterprise

    32-bit or 64-bit

    Windows 8.1

    Enterprise

    32-bit or 64-bit

    Windows 7

    Enterprise, or Ultimate

    SP1

    32-bit or 64-bit

    Windows Server 2012 R2

    Standard or Datacenter

    64-bit

    Windows Server 2012

    Standard or Datacenter

    64-bit

    Windows Server 2008 R2

    Standard, Enterprise, or Datacenter

    SP1

    64-bit

    - -## MBAM In Azure IaaS - -The MBAM server can be deployed in Azure Infrastructure as a Service (IaaS) on any of the supported OS versions listed above, connecting to an Active Directory hosted on premises or an Active Directory also hosted in Azure IaaS. Documentation for setting up and configuring Active Directory on Azure IaaS is [here](https://msdn.microsoft.com/library/azure/jj156090.aspx). - -The MBAM client is not supported on virtual machines and is also not supported on Azure IaaS. - - -## Service releases - -- [April 2016 hotfix](https://support.microsoft.com/help/3144445/april-2016-hotfix-rollup-for-microsoft-desktop-optimization-pack) -- [September 2016](https://support.microsoft.com/ms-my/help/3168628/september-2016-servicing-release-for-microsoft-desktop-optimization-pa) -- [December 2016](https://support.microsoft.com/help/3198158/december-2016-servicing-release-for-microsoft-desktop-optimization-pac) -- [March 2017](https://support.microsoft.com/en-ie/help/4014009/march-2017-servicing-release-for-microsoft-desktop-optimization-pack) -- [June 2017](https://support.microsoft.com/af-za/help/4018510/june-2017-servicing-release-for-microsoft-desktop-optimization-pack) -- [September 2017](https://support.microsoft.com/en-ie/help/4041137/september-2017-servicing-release-for-microsoft-desktop-optimization) -- [March 2018](https://support.microsoft.com/help/4074878/march-2018-servicing-release-for-microsoft-desktop-optimization-pack) -- [July 2018](https://support.microsoft.com/help/4340040/july-2018-servicing-release-for-microsoft-desktop-optimization-pack) -- [May 2019](https://support.microsoft.com/help/4505175/may-2019-servicing-release-for-microsoft-desktop-optimization-pack) - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md b/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md deleted file mode 100644 index 45f2ee0794..0000000000 --- a/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Monitoring and Reporting BitLocker Compliance with MBAM 2.5 -description: Monitoring and Reporting BitLocker Compliance with MBAM 2.5 -author: dansimp -ms.assetid: 24a3bccd-8b67-4baa-a181-e4572eaba5bf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring and Reporting BitLocker Compliance with MBAM 2.5 - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides several reports that you can use to monitor BitLocker usage and compliance activities in your enterprise. - -Reports for the MBAM Stand-alone topology and the MBAM Configuration Manager Integration topology differ in the following ways: - -- In the Stand-alone topology, you view reports in the Administration and Monitoring Website. In the Configuration Manager Integration topology, you view reports in the Configuration Manager console, with one exception: you continue to view the Recovery Audit report from the Administration and Monitoring Website. - -- The names of the reports differ slightly between the two topologies. Visit the following links for the names and descriptions of the reports for each topology. - -## Viewing MBAM 2.5 Reports – Stand-alone topology - - -The following topics describe the reports and explain how to generate and view them in the Administration and Monitoring Website. - -[Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md) - -[Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md) - -## Viewing MBAM 2.5 Reports – Configuration Manager Integration topology - - -The topic in this section describes the reports for the Configuration Manager Integration topology and explains how to view them in the Configuration Manager console. - -[Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md) - -## Other resources for monitoring and reporting BitLocker compliance with MBAM - - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md b/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md deleted file mode 100644 index 6a03158661..0000000000 --- a/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Monitoring Web Service Request Performance Counters -description: Monitoring Web Service Request Performance Counters -author: dansimp -ms.assetid: bdb812a1-465a-4098-b4c0-cb99890d1b0d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Monitoring Web Service Request Performance Counters - - -Microsoft BitLocker Administration and Monitoring (MBAM) provides performance counters that record the performance of requests that are sent to the following web services: - -- **StatusReportingService.svc** – service that receives requests for compliance status - -- **CoreService.svc** – service that receives requests for key recovery attempts - -## Performance counters that MBAM provides - - -MBAM provides the following performance counters for each of the public methods that is implemented by its StatusReportingService and CoreService web services: - - ---- - - - - - - - - - - - - - - - - - - - - -
    Type of performance counterDescription

    Total number of requests

    Provides an incrementing count that starts from zero when the server is started or restarted.

    -

    Provides an overall view of system activity. Can be monitored by automated tools to ensure the health of the server and to validate that the counter continually increments over a specified period of time.

    Requests per second

    Indicates the current throughput of the MBAM Server as it supports the MBAM client base.

    -

    Enables site administrators to:

    -
      -
    • Calculate the average number of requests per second, based on the number of MBAM Clients and their reporting frequency.

    • -
    • Validate that the number of requests per second broadly correlates with the calculated average number of requests per second. A significant variance can indicate that the MBAM Client isn't installed on a percentage of the client base or that an MBAM Group Policy Object hasn't been successfully deployed.

    • -

    Request duration

    Records the duration of requests in milliseconds.

    -

    Although this counter is updated with the duration of each request, Windows Performance Monitor samples it only periodically (typically every second), so you might see some variability in the value. For this reason, consider using the average value displayed by Performance Monitor.

    - -  - -## Performance counter results and recommendations - - -As you add new MBAM Clients to an MBAM Server with spare capacity, expect to see an increase in the number of requests per second. This increase will be proportional to the number of new client computers. The average request duration will remain relatively static. As the server nears its maximum capacity, the requests per second start to level out, and the average request duration starts to get longer. - -If you are concerned about whether your MBAM Servers can support your client base, consider deploying MBAM in phases across different collections of client computers. As you deploy MBAM to each collection of client computers, we recommend that you take snapshots of the performance counters to see the relative impact of deploying to each new client collection. If the number of requests per second starts to level off and the average request duration increases, consider enhancing your MBAM Server infrastructure by doing one of the following: - -- Moving the MBAM database onto a dedicated Microsoft SQL Server or SQL Server cluster - -- Load-balancing MBAM across multiple Internet Information Services (IIS) web servers - -- Deploying MBAM on more powerful server hardware - -## Viewing performance counters - - -The recommended tool for viewing MBAM performance counters is Windows Performance Monitor, which comes with Windows. If you are using Windows PowerShell, you don’t need to enable the counters before viewing them, as they are automatically registered by the Windows PowerShell **Enable-webapplication** cmdlet. - -For detailed instructions on how to view performance counters, see [How to View MBAM Performance Counters](https://go.microsoft.com/fwlink/?LinkId=393457). - - - -## Related topics - - -[Maintaining MBAM 2.5](maintaining-mbam-25.md) - -  - -  - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - diff --git a/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md b/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md deleted file mode 100644 index 75b47a4907..0000000000 --- a/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Moving MBAM 2.5 Features to Another Server -description: Moving MBAM 2.5 Features to Another Server -author: dansimp -ms.assetid: 9767a0e4-e8ab-49f0-98c5-5cd671975501 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Moving MBAM 2.5 Features to Another Server - - -Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 enables you to move the databases, Reports feature, and the websites to another server. - -## Moving MBAM Server features topics - - -- [How to Move the MBAM 2.5 Databases](how-to-move-the-mbam-25-databases.md) - - This topic explains how to move the Compliance and Audit Database (or Audit Database, if you are using the Configuration Manager Integration topology) and the Recovery Database. - -- [How to Move the MBAM 2.5 Reports](how-to-move-the-mbam-25-reports.md) - - This topic explains how to move the Reports to another server. - -- [How to Move the MBAM 2.5 Websites](how-to-move-the-mbam-25-websites.md) - - This topic explains how to move the Administration and Monitoring Website and Self-Service Portal to another server. - -## Other resources for moving MBAM features - - -- [Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -- [Maintaining MBAM 2.5](maintaining-mbam-25.md) - -- [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/operations-for-mbam-25.md b/mdop/mbam-v25/operations-for-mbam-25.md deleted file mode 100644 index e318d1bba3..0000000000 --- a/mdop/mbam-v25/operations-for-mbam-25.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Operations for MBAM 2.5 -description: Operations for MBAM 2.5 -author: dansimp -ms.assetid: da0e35be-2dc4-4a24-b69a-530436eb48fc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for MBAM 2.5 - - -This topic describes the types of administrative tasks that you can perform with Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. - -## Operations information - - -- [Administering MBAM 2.5 Features](administering-mbam-25-features.md) - - After deploying MBAM, you can use it to manage BitLocker encryption in your enterprise. The information in this section describes day-to-day MBAM feature operations and maintenance tasks. - -- [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - - This section describes the MBAM reports that you use to monitor BitLocker usage and compliance activities throughout your enterprise. - -- [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) - - This section describes the day-to-day BitLocker encryption management tasks that you can do with MBAM. - -- [Maintaining MBAM 2.5](maintaining-mbam-25.md) - - This section describes how to move MBAM Server features and how to monitor web service request performance counters. - -- [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) - - This section describes Windows PowerShell cmdlets that administrators can use to perform various MBAM Server tasks. - -## Other resources for MBAM operations - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md b/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md deleted file mode 100644 index d6ef03091b..0000000000 --- a/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Performing BitLocker Management with MBAM 2.5 -description: Performing BitLocker Management with MBAM 2.5 -author: dansimp -ms.assetid: 068f3ee0-300c-4083-ba18-7065eef997ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Performing BitLocker Management with MBAM 2.5 - - -After planning and then deploying Microsoft BitLocker Administration and Monitoring (MBAM), you can configure and use it to manage BitLocker Drive Encryption across your enterprise. The information in this section describes post-installation, day-to-day BitLocker encryption management tasks that are accomplished by using Microsoft BitLocker Administration and Monitoring. - -## Reset a TPM lockout - - -A Trusted Platform Module (TPM) is a microchip that is designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer, and it communicates with the rest of the system by using a host bus adapter. On computers that incorporate a TPM, you can create cryptographic keys and encrypt them so that they can be decrypted only by the TPM. - -A TPM lockout can occur if a user enters the incorrect PIN too many times. The number of times that a user can enter an incorrect PIN before the TPM locks varies by manufacturer. You can use MBAM to access the centralized key recovery data system on the Administration and Monitoring Website, where you can retrieve a TPM owner password file when you supply a computer ID and an associated user identifier. - -[How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-25.md) - -## Recover drives - - -When you are dealing with the encryption of data, especially in an enterprise environment, consider how that data can be recovered in the event of a hardware failure, changes in personnel, or other situations in which encryption keys can be lost. - -The encrypted drive recovery features in MBAM ensure that data can be captured and stored and that the required tools are available to access a BitLocker-protected volume when BitLocker goes into recovery mode, is moved, or becomes corrupted. - -[How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-25.md) - -[How to Recover a Moved Drive](how-to-recover-a-moved-drive-mbam-25.md) - -[How to Recover a Corrupted Drive](how-to-recover-a-corrupted-drive-mbam-25.md) - -## Determine BitLocker encryption state of lost computers - - -By using MBAM, you can determine the last known BitLocker encryption status of computers that were lost or stolen. - -[How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md) - -## Use the Self-Service Portal to regain access to a computer - - -If end users get locked out of Windows by BitLocker, they can use the instructions in this section to get a BitLocker recovery key to regain access to their computer. - -[How to Use the Self-Service Portal to Regain Access to a Computer](how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md) - - - -## Related topics - - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -  - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md b/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md deleted file mode 100644 index 6fce394daa..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Planning for MBAM 2.5 Client Deployment -description: Planning for MBAM 2.5 Client Deployment -author: dansimp -ms.assetid: 23c89976-af24-4753-9412-ce0ea42d1964 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.5 Client Deployment - - -Depending on when you deploy the Microsoft BitLocker Administration and Monitoring (MBAM) Client software, you can enable BitLocker Drive Encryption on a computer in your organization either before the end user receives the computer or afterwards. For both the MBAM Stand-alone and the System Center Configuration Manager Integration topologies, you have to configure Group Policy settings for MBAM. - -If you are using the MBAM Stand-alone topology, we recommend that you use an enterprise software deployment system to deploy the MBAM Client software to end-user computers. - -If you deploy MBAM with the Configuration Manager Integration topology, you can use Configuration Manager to deploy the MBAM Client software to end-user computers. In Configuration Manager, the MBAM installation creates a collection of computers that MBAM can manage. This collection includes workstations and devices that do not have a Trusted Platform Module (TPM), but that are running Windows 8, Windows 8.1, or Windows 10. - -**Note**   -Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007. - - - -## Deploying the MBAM Client to enable BitLocker Drive Encryption after computer distribution to end users - - -After you configure Group Policy, you can use an enterprise software deployment system product like Microsoft System Center Configuration Manager or Active Directory Domain Services (AD DS) to deploy the Windows Installer files of the MBAM Client installation to target computers. To deploy the MBAM Client, you can use either the 32-bit or 64-bit MbamClientSetup.exe files or MBAMClient.msi files, which are provided with the MBAM Client software. - -**Note**   -Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product. - - - -When you deploy the MBAM Client after you distribute computers to client computers, end users are prompted to encrypt their computer. This action enables MBAM to collect the data, which includes the PIN and password (if required by policy), and then to begin the encryption process. - -**Note**   -In this approach, end users who have computers with a TPM chip are prompted to activate and initialize the TPM chip if the chip has not been previously activated. - - - -## Using the MBAM Client to enable BitLocker Drive Encryption before computer distribution to end users - - -In organizations where computers are received and configured centrally, and where computers have a compliant TPM chip, you can use the MBAM Client to manage BitLocker Drive Encryption on each computer before any user data is written to it. The benefit of this process is that every computer is then compliant. This method does not rely on end-user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization installs a corporate Windows image before the computer is delivered to the end user. - -If your organization wants to use the TPM chip to encrypt computers, the administrator adds the TPM protector to encrypt the operating system volume of the computer. If your organization wants to use the TPM chip and a PIN protector, the administrator encrypts the operating system volume with the TPM protector, and then end users select a PIN when they log on for the first time. If your organization decides to use only the PIN protector, the administrator does not have to encrypt the volume first. When end users log on, Microsoft BitLocker Administration and Monitoring prompts them to provide a PIN, or a PIN and password to be used on later computer restarts. - -**Note**   -The TPM protector option requires the administrator to accept the BIOS prompt to activate and initialize the TPM before the computer is delivered to the end user. - - - -## MBAM Client support for Encrypted Hard Drives - - -MBAM supports BitLocker on Encrypted Hard Drives that meet TCG specification requirements for Opal as well as IEEE 1667 standards. When BitLocker is enabled on these devices, it will generate keys and perform management functions on the encrypted drive. See [Encrypted Hard Drive](https://technet.microsoft.com/library/hh831627.aspx) for more information. - - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md b/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md deleted file mode 100644 index 9003490cee..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md +++ /dev/null @@ -1,528 +0,0 @@ ---- -title: Planning for MBAM 2.5 Group Policy Requirements -description: Planning for MBAM 2.5 Group Policy Requirements -author: dansimp -ms.assetid: 82d545dc-3fbf-4b46-b62f-47fe178a7c44 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for MBAM 2.5 Group Policy Requirements - - -Use the following information to determine the types of BitLocker protectors that you can use to manage the Microsoft BitLocker Administration and Monitoring (MBAM) client computers in your enterprise. - -## Types of BitLocker protectors that MBAM supports - - -MBAM supports the following types of BitLocker protectors. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Type of drive or volumeSupported BitLocker protectors

    Operating system volumes

      -
    • Trusted Platform Module (TPM)

    • -
    • TPM + PIN

    • -
    • TPM + USB key – supported only when the operating system volume is encrypted before MBAM is installed

    • -
    • TPM + PIN + USB key - supported only when the operating system volume is encrypted before MBAM is installed

    • -
    • Password - supported only for Windows To Go devices, fixed data drives, and Windows 8, Windows 8.1, and Windows 10 devices that do not have a TPM

    • -
    • Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7

    • -
    • Data recovery agent (DRA)

    • -

    Fixed data drives

      -
    • Password

    • -
    • Auto-unlock

    • -
    • Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7

    • -
    • Data recovery agent (DRA)

    • -

    Removable drives

      -
    • Password

    • -
    • Auto-unlock

    • -
    • Numerical password - applied automatically as part of volume encryption and does not need to be configured

    • -
    • Data recovery agent (DRA)

    • -
    - - - -### Support for the Used Space Encryption BitLocker policy - -In MBAM 2.5 SP1, if you enable Used Space Encryption via BitLocker Group policy, the MBAM Client honors it. - -This Group Policy setting is called **Enforce drive encryption type on operating system drives** and is located in the following GPO node: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives**. If you enable this policy and select the encryption type as **Used Space Only encryption**, MBAM will honor the policy and BitLocker will only encrypt disk space that is used on the volume. - -## How to get the MBAM Group Policy Templates and edit the settings - - -When you are ready to configure the MBAM Group Policy settings you want, do the following: - - ---- - - - - - - - - - - - - - - - - -
    Steps to followWhere to get instructions

    Copy the MBAM Group Policy Templates from How to Get MDOP Group Policy (.admx) Templates and install them on a computer that is capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM).

    Copying the MBAM 2.5 Group Policy Templates

    Configure the Group Policy settings that you want to use in your enterprise.

    Editing the MBAM 2.5 Group Policy Settings

    - - - -## Descriptions of the MBAM Group Policy settings - - -The **MDOP MBAM (BitLocker Management)** GPO node contains four global policy settings and four child GPO nodes: **Client Management**, **Fixed Drive**, **Operating System Drive**, and **Removable Drive**. The following sections describe and suggest settings for the MBAM Group Policy settings. - -**Important** -Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. MBAM automatically configures the settings in this node for you when you configure the settings in the **MDOP MBAM (BitLocker Management)** node. - - - -### Global Group Policy definitions - -This section describes MBAM Global Group Policy definitions at the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy nameOverview and suggested Group Policy settings

    Choose drive encryption method and cipher strength

    Suggested configuration: Enabled

    -

    Configure this policy to use a specific encryption method and cipher strength.

    -

    When this policy is not configured, BitLocker uses the default encryption method: AES 128-bit with Diffuser.

    -
    -Note

    An issue with the BitLocker Computer Compliance report causes it to display "unknown" for the cipher strength, even if you are using the default value. To work around this issue, make sure you enable this setting and set a value for cipher strength.

    -
    -
    - -
    -
      -
    • AES 128-bit with Diffuser – for Windows 7 only

    • -
    • AES 128 for Windows 8, Windows 8.1, and Windows 10

    • -

    Prevent memory overwrite on restart

    Suggested configuration: Not Configured

    -

    Configure this policy to improve restart performance without overwriting BitLocker secrets in memory on restart.

    -

    When this policy is not configured, BitLocker secrets are removed from memory when the computer restarts.

    Validate smart card certificate usage rule

    Suggested configuration: Not Configured

    -

    Configure this policy to use smartcard certificate-based BitLocker protection.

    -

    When this policy is not configured, the default object identifier 1.3.6.1.4.1.311.67.1.1 is used to specify a certificate.

    Provide the unique identifiers for your organization

    Suggested configuration: Not Configured

    -

    Configure this policy to use a certificate-based data recovery agent or the BitLocker To Go reader.

    -

    When this policy is not configured, the Identification field is not used.

    -

    If your company requires higher security measurements, you can configure the Identification field to make sure that all USB devices have this field set and that they are aligned with this Group Policy setting.

    - - - -### Client Management Group Policy definitions - -This section describes Client Management policy definitions for MBAM at the following GPO node: **Computer Configuration** > **Policies** >**Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Client Management**. - -You can set the same Group Policy settings for the Stand-alone and System Center Configuration Manager Integration topologies, with one exception: Disable the **Configure MBAM Services > MBAM Status reporting service endpoint** setting if you are using the Configuration Manager Integration topology, as indicated in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy nameOverview and suggested Group Policy settings

    Configure MBAM Services

    Suggested configuration: Enabled

    -
      -
    • MBAM Recovery and Hardware service endpoint. Use this setting to enable MBAM Client BitLocker encryption management. Enter an endpoint location that is similar to the following example: http(s)://<MBAM Administration and Monitoring Server Name>:<the port the web service is bound to>/MBAMRecoveryAndHardwareService/CoreService.svc.

    • -
    • Select BitLocker recovery information to store. This policy setting lets you configure the key recovery service to back up BitLocker recovery information. It also lets you configure a status reporting service for collecting reports. The policy provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to the lack of key information. The status report and key recovery activity are automatically and silently sent to the configured report server location.

      -

      If you do not configure this policy setting or if you disable it, the key recovery information is not saved, and the status report and key recovery activity are not reported to the server. When this setting is set to Recovery Password and key package, the recovery password and key package are automatically and silently backed up to the configured key recovery server location.

    • -
    • Enter client checking status frequency in minutes. This policy setting manages how frequently the client checks the BitLocker protection policies and status on the client computer. This policy also manages how frequently the client compliance status is saved to the server. The client checks the BitLocker protection policies and status on the client computer and also backs up the client recovery key at the configured frequency.

      -

      Set this frequency based on the requirement set by your company on how frequently to check the compliance status of the computer and how frequently to back up the client recovery key.

    • -
    • MBAM Status reporting service endpoint:

      -

      For MBAM in a Stand-alone topology: You must configure this setting to enable MBAM Client BitLocker encryption management.

      -

      Enter an endpoint location that is similar to the following example:

      -

      http(s)://<MBAM Administration and Monitoring Server Name>:<the port the web service is bound to>/MBAMComplianceStatusService/StatusReportingService.svc

      -

      For MBAM in the Configuration Manager Integration topology: Disable this setting.

    • -

    Configure user exemption policy

    Suggested configuration: Not Configured

    -

    This policy setting lets you configure a website address, email address, or phone number that instructs a user to request an exemption from BitLocker encryption.

    -

    If you enable this policy setting and provide a website address, email address, or phone number, users see a dialog box with instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.

    -

    If you either disable or do not configure this policy setting, the exemption request instructions are not displayed to users.

    -
    -Note

    User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer is encrypted.

    -
    -
    - -

    Configure customer experience improvement program

    Suggested configuration: Enabled

    -

    This policy setting lets you configure how MBAM users can join the Customer Experience Improvement Program. This program collects information about computer hardware and how users use MBAM without interrupting their work. The information helps Microsoft to identify which MBAM features to improve. Microsoft does not use this information to identify or contact MBAM users.

    -

    If you enable this policy setting, users can join the Customer Experience Improvement Program.

    -

    If you disable this policy setting, users cannot join the Customer Experience Improvement Program.

    -

    If you do not configure this policy setting, users have the option to join the Customer Experience Improvement Program.

    Provide the URL for the Security Policy link

    Suggested configuration: Enabled

    -

    Use this policy setting to specify a URL that is displayed to end users as a link named "Company Security Policy." The link points to your company’s internal security policy and provides end users with information about encryption requirements. The link appears when users are prompted by MBAM to encrypt a drive.

    -

    If you enable this policy setting, you can configure the URL for the Security Policy link.

    -

    If you disable or do not configure this policy setting, the Security Policy link is not displayed to users.

    - - - -### Fixed Drive Group Policy definitions - -This section describes Fixed Drive policy definitions for Microsoft BitLocker Administration and Monitoring at the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Fixed Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy nameOverview and suggested Group Policy settings

    Fixed data drive encryption settings

    Suggested configuration: Enabled

    -

    This policy setting lets you manage whether fixed data drives must be encrypted.

    -

    If the operating system volume is required to be encrypted, click Enable auto-unlock fixed data drive.

    -

    When you enable this policy, you must not disable the Configure use of password for fixed data drives policy unless you are enabling or requiring the use of auto-unlock for fixed data drives.

    -

    If you have to use auto-unlock for fixed data drives, you must configure operating system volumes to be encrypted.

    -

    If you enable this policy setting, users are required to put all fixed data drives under BitLocker protection, and the data drives are then encrypted.

    -

    If you do not configure this policy setting, users are not required to put fixed data drives under BitLocker protection. If you apply this policy after fixed data drives are encrypted, the MBAM agent decrypts the encrypted fixed data drives.

    -

    If you disable this policy setting, users cannot put their fixed data drives under BitLocker protection.

    Deny write access to fixed drives not protected by BitLocker

    Suggested configuration: Not Configured

    -

    This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. This policy setting is applied when you turn on BitLocker.

    -

    When the policy is not configured, all fixed data drives on the computer are mounted with read/write permission.

    Allow access to BitLocker-protected fixed drives from earlier versions of Windows

    Suggested configuration: Not Configured

    -

    Enable this policy so that fixed drives with the FAT file system can be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    -

    When the policy is enabled or not configured, fixed drives that are formatted with the FAT file system can be unlocked and their content can be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. These operating systems have read-only permission to BitLocker-protected drives.

    -

    When the policy is disabled, fixed drives that are formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    Configure use of password for fixed drives

    Suggested configuration: Not Configured

    -

    Use this policy to specify whether a password is required to unlock BitLocker-protected fixed data drives.

    -

    If you enable this policy setting, users can configure a password that meets the requirements that you define. BitLocker enables users to unlock a drive with any of the protectors that are available on the drive.

    -

    These settings are enforced when you turn on BitLocker, not when you unlock a volume.

    -

    If you disable this policy setting, users are not allowed to use a password.

    -

    When the policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

    -

    For higher security, enable this policy, and then select Require password for fixed data drive, click Require password complexity, and set the minimum password length that you want.

    -

    If you disable this policy setting, users are not allowed to use a password.

    -

    If you do not configure this policy setting, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

    Choose how BitLocker-protected fixed drives can be recovered

    Suggested configuration: Not Configured

    -

    Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When the policy is not configured, the BitLocker data recovery agent is allowed, and recovery information is not backed up to AD DS. MBAM does not require recovery information to be backed up to AD DS.

    Encryption Policy Enforcement Settings

    Suggested configuration: Enabled

    -

    Use this policy setting to configure the number of days that fixed data drives can remain noncompliant until they are forced to comply with MBAM policies. Users cannot postpone the required action or request an exemption from it after the grace period. The grace period starts when the fixed data drive is determined to be noncompliant. However, the fixed data drive policy is not enforced until the operating system drive is compliant.

    -

    If the grace period expires and the fixed data drive is still not compliant, users do not have the option to postpone or to request an exemption. If the encryption process requires user input, a dialog box appears that users cannot close until they provide the required information.

    -

    Enter 0 in the Configure the number of noncompliance grace period days for fixed drives to force the encryption process to begin immediately after the grace period expires for the operating system drive.

    -

    If you disable or do not configure this setting, users are not forced to comply with MBAM policies.

    -

    If no user interaction is required to add a protector, encryption begins in the background after the grace period expires.

    - - - -### Operating System Drive Group Policy definitions - -This section describes Operating System Drive policy definitions for Microsoft BitLocker Administration and Monitoring at the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Operating System Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy nameOverview and suggested Group Policy settings

    Operating system drive encryption settings

    Suggested configuration: Enabled

    -

    This policy setting lets you manage whether the operating system drive must be encrypted.

    -

    For higher security, consider disabling the following policy settings in System > Power Management > Sleep Settings when you enable them with TPM + PIN protector:

    -
      -
    • Allow Standby States (S1-S3) When Sleeping (Plugged In)

    • -
    • Allow Standby States (S1-S3) When Sleeping (On Battery)

    • -
    -

    If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive.

    -

    On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a personal identification number (PIN).

    -

    If you enable this policy setting, users have to put the operating system drive under BitLocker protection, and the drive is then encrypted.

    -

    If you disable this policy, users cannot put the operating system drive under BitLocker protection. If you apply this policy after the operating system drive is encrypted, the drive is then decrypted.

    -

    If you do not configure this policy, the operating system drive is not required to be placed under BitLocker protection.

    Allow enhanced PINs for startup

    Suggested configuration: Not Configured

    -

    Use this policy setting to configure whether enhanced startup PINs are used with BitLocker. Enhanced startup PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. This policy setting is applied when you turn on BitLocker.

    -

    If you enable this policy setting, all new BitLocker startup PINs set will enable end user to create enhanced PINs. However, not all computers can support enhanced PINs in the pre-boot environment. We strongly recommend that administrators evaluate whether their systems are compatible with this feature before enabling its use.

    -

    Select the Require ASCII-only PINs check box to help make enhanced PINs more compatible with computers that limit the type or number of characters that can be entered in the pre-boot environment.

    -

    If you disable or do not configure this policy setting, enhanced PINs are not used.

    Choose how BitLocker-protected operating system drives can be recovered

    Suggested configuration: Not Configured

    -

    Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When this policy is not configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS.

    -

    MBAM operation does not require recovery information to be backed up to AD DS.

    Configure use of passwords for operating system drives

    Suggested configuration: Not Configured

    -

    Use this policy setting to set the constraints for passwords that are used to unlock BitLocker-protected operating system drives. If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, you must also enable the Group Policy setting "Password must meet complexity requirements" located in Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy.

    -
    -Note

    These settings are enforced when you turn on BitLocker, not when you unlock a volume. BitLocker lets you unlock a drive with any of the protectors that are available on the drive.

    -
    -
    - -
    -

    If you enable this policy setting, users can configure a password that meets the requirements that you define. To enforce complexity requirements on the password, click Require password complexity.

    Configure TPM platform validation profile for BIOS-based firmware configurations

    Suggested configuration: Not Configured

    -

    This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

    -
    -Important

    This Group Policy setting applies only to computers with BIOS configurations or to computers with UEFI firmware with a Compatibility Service Module (CSM) enabled. Computers that use a native UEFI firmware configuration store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for native UEFI firmware configurations" Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware.

    -
    -
    - -
    -

    If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before you unlock access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.

    -

    If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the Setup script.

    Configure TPM platform validation profile

    Suggested configuration: Not Configured

    -

    This policy setting enables you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

    -

    If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before you unlock access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.

    -

    If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.

    Configure TPM platform validation profile for native UEFI firmware configurations

    Suggested configuration: Not Configured

    -

    This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.

    -
    -Important

    This Group Policy setting applies only to computers with a native UEFI firmware configuration.

    -
    -
    - -
    -

    If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.

    -

    If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.

    Reset platform validation data after BitLocker recovery

    Suggested configuration: Not Configured

    -

    Use this policy setting to control whether platform validation data is refreshed when Windows is started after BitLocker recovery.

    -

    If you enable this policy setting, platform validation data are refreshed when Windows is started after BitLocker recovery. If you disable this policy setting, platform validation data are not refreshed when Windows is started after BitLocker recovery. If you do not configure this policy setting, platform validation data are refreshed when Windows is started after BitLocker recovery.

    Use enhanced Boot Configuration Data validation profile

    Suggested configuration: Not Configured

    -

    This policy setting allows you to choose specific Boot Configuration Data (BCD) settings to verify during platform validation.

    -

    If you enable this policy setting, you can add additional settings, remove the default settings, or both. If you disable this policy setting, the computer reverts to a BCD profile similar to the default BCD profile that is used by Windows 7. If you do not configure this policy setting, the computer verifies the default Windows BCD settings.

    -
    -Note

    When BitLocker uses Secure Boot for platform and Boot Configuration Data (BCD) integrity validation, as defined by the "Allow Secure Boot for integrity validation" policy, the "Use enhanced Boot Configuration Data validation profile" policy is ignored.

    -
    -
    - -
    -

    The setting that controls boot debugging (0x16000010) is always validated and has no effect if it is included in the provided fields.

    Encryption Policy Enforcement Settings

    Suggested configuration: Enabled

    -

    Use this policy setting to configure the number of days that users can postpone complying with MBAM policies for their operating system drive. The grace period begins when the operating system is first detected as noncompliant. After this grace period expires, users cannot postpone the required action or request an exemption from it.

    -

    If the encryption process requires user input, a dialog box appears that users cannot close until they provide the required information.

    -

    If you disable or do not configure this setting, users are not forced to comply with MBAM policies.

    -

    If no user interaction is required to add a protector, encryption begins in the background after the grace period expires.

    Configure pre-boot recovery message and URL

    Suggested configuration: Not Configured

    -

    Enable this policy setting to configure a custom recovery message or to specify a URL that is then displayed on the pre-boot BitLocker recovery screen when the OS drive is locked. This setting is only available on client computers running Windows 10.

    -

    When this policy is enabled, you can select one of these options for the pre-boot recovery message:

    -
      -
    • Use custom recovery message: Select this option to include a custom message in the pre-boot BitLocker recovery screen. In the Custom recovery message option box, type the message that you want displayed. If you also want to specify a recovery URL, include it as part of your custom recovery message.

    • -
    • Use custom recovery URL: Select this option to replace the default URL that is displayed in the pre-boot BitLocker recovery screen. In the Custom recovery URL option box, type the URL that you want displayed.

    • -
    • Use default recovery message and URL: Select this option to display the default BitLocker recovery message and URL in the pre-boot BitLocker recovery screen. If you previously configured a custom recovery message or URL and want to revert to the default message, you must enable this policy and select the Use default recovery message and URL option.

    • -
    -
    -Note

    Not all characters and languages are supported in pre-boot. We recommend that you test that the characters you use for the custom message or URL appear correctly on the pre-boot BitLocker recovery screen.

    -
    -
    - -
    - - - -### Removable Drive Group Policy definitions - -This section describes Removable Drive Group Policy definitions for Microsoft BitLocker Administration and Monitoring at the following GPO node: **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Removable Drive**. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Policy nameOverview and suggested Group Policy settings

    Control use of BitLocker on removable drives

    Suggested configuration: Enabled

    -

    This policy controls the use of BitLocker on removable data drives.

    -

    Click Allow users to apply BitLocker protection on removable data drives to allow users to run the BitLocker setup wizard on a removable data drive.

    -

    Click Allow users to suspend and decrypt BitLocker on removable data drives to enable users to remove BitLocker drive encryption from the drive or to suspend the encryption while maintenance is performed.

    -

    When this policy is enabled, and you click Allow users to apply BitLocker protection on removable data drives, the MBAM Client saves the recovery information about removable drives to the MBAM key recovery server and allows users to recover the drive if the password is lost.

    Deny write access to removable drives not protected by BitLocker

    Suggested configuration: Not Configured

    -

    Enable this policy to allow only write permission to BitLocker-protected drives.

    -

    When this policy is enabled, all removable data drives on the computer require encryption before write permission is allowed.

    Allow access to BitLocker-protected removable drives from earlier versions of Windows

    Suggested configuration: Not Configured

    -

    Enable this policy to allow fixed drives with the FAT file system to be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    -

    When this policy is not configured, removable drives that are formatted with the FAT file system can be unlocked on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only permission to BitLocker-protected drives.

    -

    When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.

    Configure use of password for removable data drives

    Suggested configuration: Not Configured

    -

    Enable this policy to configure password protection on removable data drives.

    -

    When this policy is not configured, passwords are supported with the default settings, which do not include password complexity requirements and which require only eight characters.

    -

    For increased security, you can enable this policy and select Require password for removable data drive, click Require password complexity, and set the preferred minimum password length.

    Choose how BitLocker-protected removable drives can be recovered

    Suggested configuration: Not Configured

    -

    Configure this policy to enable the BitLocker data recovery agent or to save BitLocker recovery information to Active Directory Domain Services (AD DS).

    -

    When set to Not Configured, the data recovery agent is allowed, and recovery information is not backed up to AD DS.

    -

    MBAM operation does not require recovery information to be backed up to AD DS.

    - - - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md b/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md deleted file mode 100644 index 7f91892a01..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md +++ /dev/null @@ -1,194 +0,0 @@ ---- -title: Planning for MBAM 2.5 Groups and Accounts -description: Planning for MBAM 2.5 Groups and Accounts -author: dansimp -ms.assetid: 73bb9fe5-5900-4b6f-b271-ade62991fca1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Planning for MBAM 2.5 Groups and Accounts - - -This topic lists the roles and accounts that you must create in Active Directory Domain Services (AD DS) to provide security and access rights for the Microsoft BitLocker Administration and Monitoring (MBAM) databases, reports, and web applications. For each role and account, the corresponding field in the MBAM Server Configuration wizard is provided. For a list of Windows PowerShell cmdlets and parameters that correspond to these accounts, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md#bkmk-reqd-posh-accts). - -**Note** -MBAM does not support the use of managed service accounts. - - - -## Database accounts - - -Create the following accounts for the Compliance and Audit Database and the Recovery Database. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Account name and purposeAccount typeMBAM Server Configuration wizard field that corresponds to this accountDescription of the MBAM Server Configuration wizard field that corresponds to this account

    Compliance and Audit Database and Recovery Database read/write user or group for reports

    User or Group

    Read/write access domain user or group

    Domain user or group that has read/write access to the Compliance and Audit Database and the Recovery Database to enable the web applications to access the data and reports in these databases.

    -

    If you enter a user name in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.

    -

    If you enter a group name in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.

    Compliance and Audit Database read-only user or group for reports

    User or Group

    Read-only access domain user or group

    Name of the user or group that will have read-only access to the Compliance and Audit Database to enable the reports to access the compliance and audit data in this database.

    -

    If you enter a user name in this field, it must be the same user as the one you specify in the Compliance and Audit Database domain account field on the Configure Reports page.

    -

    If you enter a group name in this field, the value that you specify in the Compliance and Audit Database domain account field on the Configure Reports page must be a member of the group that you specify in this field.

    - - - -## Reporting accounts - - -Create the following accounts for the Reports feature. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Account name/purposeAccount typeMBAM Server Configuration wizard field that corresponds to this accountDescription of the MBAM Server Configuration wizard field that corresponds to this account

    Reports read-only domain access group

    Group

    Reporting role domain group

    Specifies the domain user group that has read-only access to the reports in the Administration and Monitoring Website. The group you specify must be the same group you specified for the Reports Read Only Access Group parameter when the web apps are enabled.

    Compliance and Audit Database domain user account

    User

    Compliance and Audit Database domain account

    Domain user account and password that the local SQL Server Reporting Services instance uses to access the Compliance and Audit Database. This account requires Log On as Batch rights to the SQL Server Reporting Services server.

    -

    If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a user name, you must enter that same value in this field.

    -

    If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a group name, the value that you enter in this field must be a member of that group.

    -

    Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group.

    - - - -## Administration and Monitoring Website (Help Desk) accounts - - -Create the following accounts for the Administration and Monitoring Website. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Account name/purposeAccount typeMBAM Server Configuration wizard field that corresponds to this accountDescription of the MBAM Server Configuration wizard field that corresponds to this account

    Web service application pool domain account

    User

    Web service application pool domain account

    Domain user account to be used by the application pool for the web applications.

    -

    If you enter a user name in the Read/write access domain user or group field on the Configure Databases page, you must enter that same value in this field.

    -

    If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group.

    -

    If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used.

    -
    -Important

    For improved security, set the account that is specified in the credentials to have limited user rights.

    -
    -
    - -

    MBAM Advanced Helpdesk Users access group

    Group

    MBAM Advanced Helpdesk Users

    Domain user group whose members have access to all recovery areas of the Administration and Monitoring Website. Users who have this role have to enter only the recovery key, and not the end user’s domain and user name, when helping end users recover their drives. If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Group permissions.

    MBAM Helpdesk Users access group

    Group

    MBAM Helpdesk Users

    Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the MBAM Administration and Monitoring Website. Individuals who have this role must fill-in all fields, including the end-user’s domain and account name, when they use either option.

    -

    If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Group permissions.

    MBAM Report Users access group

    Group

    MBAM Report Users

    Domain user group whose members have read-only access to the reports in the Reports area of the Administration and Monitoring Website.

    MBAM Data Migration User Group

    Group

    MBAM Data Migration Users

    Optional domain user group whose members have permissions to write data to MBAM by using the MBAM Recovery and Hardware Service running on the MBAM server. This account is generally used with the Write-Mbam* cmdlets to write recovery and TPM data from Active Directory into the MBAM database.

    -

    For more information, see MBAM 2.5 Security Considerations.

    - - - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md b/mdop/mbam-v25/planning-for-mbam-25-high-availability.md deleted file mode 100644 index 0a95efbd31..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Planning for MBAM 2.5 High Availability -description: Planning for MBAM 2.5 High Availability -author: dansimp -ms.assetid: 1e29b30c-33f1-4a52-9442-8c1391f0049c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning for MBAM 2.5 High Availability - - -Microsoft BitLocker Administration and Monitoring (MBAM) can maintain high availability through use of one or more of the following technologies, which are described in the following sections: - -- [SQL Server AlwaysOn availability groups](#bkmk-alwayson) - -- [Microsoft SQL Server clustering](#bkmk-sql-clustering) - -- [IIS Network Load Balancing](#bkmk-load-balance) - -- [Database mirroring in SQL Server](#bkmk-db-mirroring) - -- [Backing up MBAM databases by using the Volume Shadow Copy Service (VSS)](#bkmk-vss) - -Use the information in the following sections to help you understand the options to deploy MBAM in a highly available configuration. - -## Support for SQL Server AlwaysOn availability groups - - -MBAM enables you to configure and manage availability groups for the databases in Microsoft SQL Server. An availability group for MBAM supports a failover environment where the Compliance and Audit Database and the Recovery Database fail over together rather than separately. - -An availability group supports a set of read/write primary databases and one to four sets of corresponding secondary databases. Optionally, secondary databases can be made available for read-only permission, some backup operations, or for both. - -For information about how to set up availability groups, see [AlwaysOn Availability Groups](https://go.microsoft.com/fwlink/?LinkId=393277). - -## Microsoft SQL Server clustering - - -You can run the MBAM 2.5 Compliance and Audit Database and the Recovery Database on computers that are running SQL Server clusters. - -## IIS Network Load Balancing - - -You can use Network Load Balancing to configure a highly available environment for computers that are running the Administration and Monitoring Website (also known as Help Desk), the Self-Service Portal, and the web services, which are deployed through Internet Information Services (IIS). - -### Prerequisites - -Before configuring load balancing, ensure that you have met the following prerequisites: - -- A load balancer must be available. You can use load balancers from Microsoft or another company. For more information about Microsoft load balancer technology, see [Build a Web Farm with IIS Servers](https://go.microsoft.com/fwlink/?LinkId=393326). - -- At least two servers are running IIS and have met all of the MBAM prerequisites to support its web features, including ASP.NET MVC 4. - -- MBAM databases and reports are running on a server. - -### MBAM-specific changes that are required to enable Load Balancing - -Complete the following tasks: - -1. Register a Service Principal Name (SPN) for the virtual host name under the domain account that you are using for the web application pools. For example, if the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\\mbamapppooluser, the following command registers the SPN appropriately. - - `Setspn -s http//mbamvirtual contoso\mbamapppooluser` - - `Setspn -s http//mbamvirtual.contoso.com contoso\mbamapppooluser` - -2. Configure the following MBAM web features: - - - On each server that will host the MBAM web features, use the same domain account for the application pool administrative credentials. - - - Specify a host name that matches the virtual host name (DNS name) of the Load Balancing cluster. For example, when you install MBAM on a server called "NLB1" with a virtual host name of **mbamvirtual.contoso.com**, ensure that the host name that you specify in the Windows PowerShell cmdlet is **mbamvirtual.contoso.com**. - -3. If you are configuring the websites in a web farm with a load balancer, you must configure the websites to use the same machine key. - - For more information, see the following sections in [machineKey Element (ASP.NET Settings Schema)](https://msdn.microsoft.com/library/vstudio/w8h3skw9.aspx): - - - Machine Key Explained - - - Web Farm Deployment Considerations - - For instructions about how to automatically generate a key, see [Generate a Machine Key (IIS 7)](https://technet.microsoft.com/library/cc772287.aspx). - -The information about Load Balancing also applies to IIS Network Load Balancing (NLB) clusters in Windows Server 2012 or Windows Server 2008 R2. The IIS Network Load Balancing functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are different in Windows Server 2012. For information about new ways to do tasks, see [Common Management Tasks and Navigation in Windows Server 2012 R2 Preview and Windows Server 2012](https://go.microsoft.com/fwlink/?LinkId=316371). - -## Database mirroring in SQL Server - - -MBAM supports the use of SQL Server mirroring, where the Compliance and Audit Database and the Recovery Database are mirrored by using two instances of SQL Server for each database. Before implementing mirroring, be aware that mirroring is slowly being phased out, in favor of availability groups, which are discussed earlier in this topic. - -To implement mirroring for MBAM, you must specify the appropriate connection strings for the mirrored database configuration by using the **Enable-MbamWebApplication** Windows PowerShell cmdlet. For more information about the MBAM 2.5 Windows PowerShell cmdlets, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md). - -### Examples of implementing SQL Server mirroring by using Windows PowerShell - -The following examples show how you might implement SQL Server mirroring by using Windows PowerShell cmdlets. - -**Example 1** - -``` syntax -Enable-MbamWebApplication -AdministrationPortal -ComplianceAndAuditDBConnectionString 'Integrated Security=SSPI;Data Source=MyDatabaseServer;Failover Partner=myMirrorServerAddress;Initial Catalog="MBAM Compliance Status";' -RecoveryDBConnectionString 'Integrated Security=SSPI;Data Source=MyDatabaseServer;Failover Partner=myMirrorServerAddress;Initial Catalog="MBAM Recovery and Hardware";' -AdvancedHelpdeskAccessGroup “MyDomain\AdvancedUserGroup” -HelpdeskAccessGroup “MyDomain\StandardUserGroup” -ReportsReadOnlyAccessGroup "MyDomain\ReportUserGroup" -ReportUrl "https://MyReportServer/ReportServer" -Port 443 -WebServiceApplicationPoolCredential (Get-Credential) -Certificate (dir cert:\LocalMachine\My\E2A7EA5533890D6567E40DFC46F53B3D31D6B689) -``` - -**Example 2** - -``` syntax -Enable-MbamWebApplication -SelfServicePortal -ComplianceAndAuditDBConnectionString 'Integrated Security=SSPI;Data Source=MyDatabaseServer; Failover Partner=myMirrorServerAddress;Initial Catalog="MBAM Compliance Status";' -RecoveryDBConnectionString 'Integrated Security=SSPI;Data Source=MyDatabaseServer;I Failover Partner=myMirrorServerAddress;Initial Catalog="MBAM Recovery and Hardware";' -Port 443 -WebServiceApplicationPoolCredential (Get-Credential) -Certificate (dir cert:\LocalMachine\My\E2A7EA5533890D6567E40DFC46F53B3D31D6B689) -``` - -### More information about SQL Server mirroring - -The following links provide more information about configuring SQL Server mirroring: - -- [How to: Prepare a Mirror Database for Mirroring (Transact-SQL)](https://go.microsoft.com/fwlink/?LinkId=316375) - -- [Establish a Database Mirroring Session Using Windows Authentication (SQL Server Management Studio)](https://go.microsoft.com/fwlink/?LinkId=316377) - -## Backing up MBAM databases by using the Volume Shadow Copy Service (VSS) - - -MBAM provides a Volume Shadow Copy Service (VSS) writer, called the Microsoft BitLocker Administration and Management Writer. This VSS writer facilitates the backup of the Compliance and Audit Database and the Recovery Database. - -The VSS writer is registered on every server where you enable an MBAM web application. The MBAM VSS writer depends on the SQL Server VSS Writer, which is registered as part of the Microsoft SQL Server installation. Any backup technology that uses VSS writers to perform backup can discover the MBAM VSS writer. - - - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md b/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md deleted file mode 100644 index 41ccde26df..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: Planning for MBAM 2.5 Server Deployment -description: Planning for MBAM 2.5 Server Deployment -author: dansimp -ms.assetid: 88774c89-31c8-4eb8-a845-a00bbec8c870 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.5 Server Deployment - - -This topic lists the features that you deploy for the MBAM Stand-alone and Configuration Manager topologies and lists the order in which you need to deploy them. There is a recommended configuration for each topology. However, you can configure MBAM server databases and features in different configurations and across multiple servers, depending on your scalability requirements. - -## Important planning considerations for both topologies - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    ConsiderationsDetails or purpose

    Review the following before you start the deployment:

    -

    Each MBAM feature has specific prerequisites that must be met before you start the MBAM installation.

    BitLocker recovery keys in MBAM expire after a single use.

    A single use means that the recovery key has been retrieved through the Administration and Monitoring Website (also known as Help Desk), Self-Service Portal, or by using the Get-MbamBitLockerRecoveryKey Windows PowerShell cmdlet.

    Keep track of the names of the computers on which you configure each feature. You will use this information throughout the configuration process.

    You may want to use the MBAM 2.5 Deployment Checklist for this purpose.

    Configure only the Group Policy settings in the MDOP MBAM (BitLocker Management) node. Do not change the Group Policy settings in the BitLocker Drive Encryption node.

    If you change the Group Policy settings in the BitLocker Drive Encryption node, MBAM will not work.

    - - - -## Planning for MBAM Server deployment – Stand-alone topology - - -For the Stand-alone topology, a two-server configuration is recommended for production environments, although configurations of three to four servers can be used. - -The Server infrastructure for the MBAM Stand-alone topology contains the following features, which must be configured in the order listed: - -1. Databases (Compliance and Audit Database and Recovery Database) - -2. Reports - -3. Web applications (and their corresponding web services) - - - Administration and Monitoring Website - - - Self-Service Portal - -For a description of these features, see [High-Level Architecture of MBAM 2.5 with Stand-alone Topology](high-level-architecture-of-mbam-25-with-stand-alone-topology.md). - -## Planning for MBAM Server deployment – Configuration Manager topology - - -For the Configuration Manager Integration topology, a three-server configuration is recommended for production environments, although configurations of additional servers can be used. - -The Server infrastructure for the MBAM Configuration Manager topology contains the following features, which must be configured or performed in the order listed: - -1. Databases (Compliance and Audit Database and Recovery Database) - -2. Reports - -3. Web applications (and their corresponding web services) - - - Administration and Monitoring Website - - - Self-Service Portal - -4. System Center Configuration Manager Integration - -For a description of these features, see [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md). - - - -## Related topics - - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - -[Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/planning-for-mbam-25.md b/mdop/mbam-v25/planning-for-mbam-25.md deleted file mode 100644 index 5be4741f7c..0000000000 --- a/mdop/mbam-v25/planning-for-mbam-25.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Planning for MBAM 2.5 -description: Planning for MBAM 2.5 -author: dansimp -ms.assetid: aebe82c0-e3b6-4bfb-beb0-b99f9c5c5267 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MBAM 2.5 - - -This topic lists the tasks, prerequisites, and requirements that you need to complete when you are planning to deploy Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. - -## Planning information - - -- [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - - This section describes the installation prerequisites, Group Policy settings, groups and accounts, and website security that are required before you deploy MBAM. - -- [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - - This section describes the minimum hardware and software requirements for installing the MBAM Client and configuring the MBAM Server features, and describes the MBAM Server features to be deployed and the order in which to deploy them. It also explains how to configure a highly available environment and lists some security considerations to be aware of. - -- [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) - - This section provides a planning checklist that can assist you in MBAM deployment planning. - -## Other resources for planning for MBAM - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - - - -  - -  -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - diff --git a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md b/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md deleted file mode 100644 index 56e258088e..0000000000 --- a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md +++ /dev/null @@ -1,336 +0,0 @@ ---- -title: Planning How to Secure the MBAM Websites -description: Planning How to Secure the MBAM Websites -author: dansimp -ms.assetid: aea1d137-62cf-4da4-9989-541e0b5ad8d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Planning How to Secure the MBAM Websites - - -This topic describes the following methods for securing the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Administration and Monitoring Website and Self-Service Portal: - - ---- - - - - - - - - - - - - - - - - -
    MethodRequired or optional?

    Using certificates to secure MBAM websites

    Optional, but highly recommended

    Registering Service Principal Names (SPN) for the application pool account

    Required

    - - - -For more information about how to secure your MBAM deployment, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md). - -## Using certificates to secure MBAM websites - - -We recommend that you use a certificate to secure the communication between the: - -- MBAM Client and the web services - -- Browser and the Administration and Monitoring Website and the Self-Service Portal websites - -For information about requesting and installing a certificate, see [Configuring Internet Server Certificates](https://technet.microsoft.com/library/cc731977.aspx). - -**Note** -You can configure the websites and web services on different servers only if you are using Windows PowerShell. If you use the MBAM Server Configuration wizard to configure the websites, you must configure the websites and the web services on the same server. - - - -To secure the communication between the web services and the databases, we also recommend that you force encryption in SQL Server. For information about securing all connections to SQL Server, including communication between the web services and SQL Server, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-secure-databases). - -## Registering SPNs for the application pool account - - -To enable the MBAM Servers to authenticate communication from the Administration and Monitoring Website and the Self-Service Portal, you must register a Service Principal Name (SPN) for the host name under the domain account that you are using for the web application pool. - -This topic contains instructions on how to register SPNs for the following types of host names: - -- Fully qualified domain name - -- NetBIOS name - -- Virtual name - -### Before you create SPNs for an initial MBAM installation - -Review the information in the following table before you start creating SPNs. - - ---- - - - - - - - - - - - - - - - - - - - - -
    Task or itemMore information

    Create a service account in Active Directory Domain Services (AD DS).

    The service account is a user account that you create in AD DS to provide security for the MBAM websites. The MBAM websites run under an application pool, whose identity is the name of the service account. The SPNs are then registered in the application pool account.

    -
    -Note

    You must use the same application pool account for all web servers.

    -
    -
    - -

    Verify that either the IIS-IUSRS group account or the application pool account has been granted the necessary rights.

    To check this, follow these steps:

    -
      -
    1. Open the Local Security Policy editor and expand the Local Policies node.

    2. -
    3. Select the User Rights Assignment node, and double-click the Impersonate a client after authentication and Log on as a batch job Group Policy settings in the right pane.

    4. -

    If you configure the MBAM websites by using a domain administrative account, MBAM will create the SPNs for you.

    If you configure the MBAM websites by using a domain administrative account, follow the steps in this topic to register SPNs manually for the type of host name that you are using.

    - - - -### Registering SPNs when you use a fully qualified domain host name - -If you use a fully qualified domain host name when you configure MBAM, you have to register only one SPN, as shown in the following example. - - ---- - - - - - - - - - - - - - - - - -
    What you need to doExamples and more information

    Register an SPN for the fully qualified domain name.

    Setspn -s http/mybitlockerrecovery.contoso.com contoso\mbamapppooluser

    -

    The fully qualified host name is mybitlockerrecovery.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser.

    Configure constrained delegation for the SPN that you are registering for the application pool account.

    Configuring Constrained Delegation

    -

    This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.

    - - - -### Registering SPNs when you use a NetBIOS host name - -If you use a NetBIOS host name when you configure MBAM, register one SPN for the NetBIOS name, and another SPN for the fully qualified domain name, as shown in the following examples. - - ---- - - - - - - - - - - - - - - - - - - - - -
    What you need to doExamples and more information

    Register an SPN for the NetBIOS host name.

    Setspn -s http/nbname01 contoso\mbamapppooluser

    -

    The NetBIOS host name is nbname01, and the domain account used for the web application pool is contoso\mbamapppooluser.

    Register an SPN for the fully qualified domain name.

    Setspn –s http/nbname01.corp.contoso.com contoso\mbamapppooluser

    -

    The fully qualified domain name is nbname01.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser.

    Configure constrained delegation for the SPNs that you are registering for the application pool account.

    Configuring Constrained Delegation

    -

    This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.

    - - - -### Registering SPNs when you use a virtual host name - -If you configure MBAM with a virtual host name that is a fully qualified domain name, register only one SPN for the virtual host name. If the virtual host name that you configure is not a fully qualified domain name, you must create a second SPN that specifies the fully qualified domain name, as described in the following examples. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    What you need to doExamples and more information

    If your virtual host name is a fully qualified domain name, as in this example, register only one SPN.

    Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser

    -

    In the example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser.

    Register this additional SPN if your virtual host name is not a fully qualified domain name.

    Setspn -s http/mbamvirtual contoso\mbamapppooluser

    -

    In the example, the virtual host name is mbamvirtual, and the domain account used for the web application pool is contoso\mbamapppooluser.

    Register this additional SPN if your virtual host name is not a fully qualified domain name.

    Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser

    -

    In the example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pool is contoso\mbamapppooluser.

    On the Domain Name Server (DNS) server, create an “A record” for the custom host name and point it to a web server or a load balancer.

    See the “To configure DNS Host A Records” section in Configure DNS Host Records.

    -

    We recommend that you use A records instead of CNAMES. If you use CNAMES to point to the domain address, you must also register SPNs for the web server name in the application pool account.

    Configure constrained delegation for the SPNs that you are registering for the application pool account.

    Configuring Constrained Delegation

    -

    This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.

    - - - -### Registering an SPN when you upgrade from previous versions of MBAM - -Complete the steps in this section only if you want to: - -- Upgrade from a previous version of MBAM. - -- Run the websites in MBAM 2.5 in a load-balanced or distributed configuration, and you are currently running in a configuration that is not load balanced. - -If you already registered SPNs on the machine account rather than in an application pool account, MBAM uses the existing SPNs, and you cannot configure the websites in a load-balanced or distributed configuration. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    What you need to doExamples and more information

    Create an application pool account in Active Directory Domain Services (AD DS).

    Remove the currently installed websites and web services.

    Removing MBAM Server Features or Software

    Remove SPNs from the machine account.

    Setspn –d http/mbamwebserver mbamwebserver

    -

    Setspn –d http/mbamwebserver.contoso.com mbamwebserver

    Register SPNs in the application pool account.

    Follow the steps for Registering SPNs when you use a virtual host name.

    Reconfigure the web applications and web services.

    How to Configure the MBAM 2.5 Web Applications

    Do one of the following, depending on the method you use for the configuration:

    - ---- - - - - - - - - - - - - - - - - -
    MethodDetails

    MBAM Server Configuration wizard

    Enter the application pool account in the Web service application pool domain account field.

    Enable-MbamWebApplication Windows PowerShell cmdlet

    Enter the account in the WebServiceApplicationPoolCredential parameter.

    -

    -Important

    The host name that you enter must be the same name as the virtual host name for which you are creating the SPNs. Also, in your web farm, the host names and the application pool credentials must be the same on every server that you are configuring.

    -
    -
    - -
    -

    When MBAM configures the web applications, it will try to register the SPNs for you, but it can do so only if you have Domain Admin rights on the server on which you are installing MBAM. If you do not have these rights, you can complete the configuration, but you will have to set the SPNs before or after you configure MBAM.

    - -## Required Request Filtering Settings - - 'Allow unlisted file name extensions' is required for the application to operate as expected. This can be found by navigating to the 'Microsoft BitLocker Administration and Monitoring' -> Request Filtering -> Edit Feature Settings. - - -## Related topics - - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) - -[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/mbam-v25/planning-to-deploy-mbam-25.md b/mdop/mbam-v25/planning-to-deploy-mbam-25.md deleted file mode 100644 index e0e73d9033..0000000000 --- a/mdop/mbam-v25/planning-to-deploy-mbam-25.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Planning to Deploy MBAM 2.5 -description: Planning to Deploy MBAM 2.5 -author: dansimp -ms.assetid: 1343b80c-d87a-42e7-b912-e84ba997d7e3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning to Deploy MBAM 2.5 - - -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for Microsoft BitLocker Administration and Monitoring (MBAM). This section includes information that can help you gather the necessary information to formulate a deployment plan that best meets your business requirements. - -## Review the MBAM 2.5 supported configurations - - -After preparing your computing environment for the MBAM Server and Client feature deployment, make sure that you review the Supported Configurations to confirm that the computers on which you are installing MBAM meet the minimum hardware and operating system requirements. For more information about MBAM deployment prerequisites, see [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md). - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -## Plan for MBAM 2.5 Server and Client deployment - - -The MBAM Server infrastructure depends on a set of server features that can be configured on one or more server computers, based on the requirements of the enterprise. These features can be configured in a distributed configuration across multiple servers. - -**Note**   -An MBAM installation on a single server is recommended only for lab environments. - - - -The MBAM Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an enterprise software delivery system or by installing the Client on client computers as part of the initial imaging process. - -With MBAM, you can encrypt a computer in your organization either before the end user receives the computer, or afterwards by using Group Policy. - -[Planning for MBAM 2.5 Server Deployment](planning-for-mbam-25-server-deployment.md) - -[Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md) - -## Other resources for MBAM planning - - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - - - - diff --git a/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md b/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md deleted file mode 100644 index bfc0fff5d3..0000000000 --- a/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Preparing your Environment for MBAM 2.5 -description: Preparing your Environment for MBAM 2.5 -author: dansimp -ms.assetid: 7552ba08-9dbf-40cd-8920-203d733fd242 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing your Environment for MBAM 2.5 - - -Before beginning Microsoft BitLocker Administration and Monitoring (MBAM) Setup, you should make sure that you have met the prerequisites to install the product. When you know what the prerequisites are ahead of time, you can efficiently deploy the product and enable its features so that it most effectively supports your organization’s business objectives. - -If you are deploying Microsoft BitLocker Administration and Monitoring with Configuration Manager, ensure that you meet the additional requirements for Configuration Manager, which are listed later in this topic. - -## Review MBAM 2.5 deployment prerequisites - - -To ensure that your MBAM deployment is successful, make sure that you review and complete the required software prerequisites before you install the MBAM Client and configure the MBAM Server features. - -[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) - -## Plan for MBAM 2.5 Group Policy requirements - - -Before MBAM can manage clients in the enterprise, you must download and configure Group Policy templates that are specific to MBAM, and then configure the Group Policy settings that you want for your environment. - -[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) - -## Plan for MBAM 2.5 roles and accounts - - -As part of the prerequisites, you must define certain roles and accounts, which are used in MBAM to provide security and access rights to specific servers and features, such as the databases running on SQL Server and the web applications running on the Administration and Monitoring Server. - -[Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) - -## Other resources for MBAM planning - - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md deleted file mode 100644 index 2329a20a37..0000000000 --- a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md +++ /dev/null @@ -1,106 +0,0 @@ ---- -title: Prerequisites for MBAM 2.5 Clients -description: Prerequisites for MBAM 2.5 Clients -author: dansimp -ms.assetid: fc230679-9c84-4b99-a77c-bae7e7bf8145 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/23/2017 ---- - - -# Prerequisites for MBAM 2.5 Clients - - -Before you install the MBAM Client software on end users' computers, ensure that your environment and the client computers meet the following prerequisites. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteDetails

    The enterprise domain must contain at least one Windows Server 2008 (or later) domain controller.

    The client computer must be logged on to the enterprise intranet.

    For Windows 7 client computers only: Each client must have Trusted Platform Module (TPM) capability (TPM 1.2 or later).

    For Windows 8.1, Windows 10 RTM or Windows 10 version 1511 client computers only: If you want MBAM to be able to store and manage the TPM recovery keys, TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM.

    -

    In MBAM 2.5 SP1 only, you no longer need to turn off TPM auto-provisioning, but you must make sure that the TPM Group Policy Objects are set to not escrow TPM OwnerAuth to Active Directory.

    MBAM 2.5 Security Considerations

    For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM.

    -

    In MBAM 2.5 SP1, you must turn on auto-provisioning.

    -

    See TPM owner password for further details. -

    The TPM chip must be turned on in the BIOS and be resettable from the operating system.

    See the BIOS documentation for more information.

    The computer’s hard disk must have at least two partitions and must be formatted with the NTFS file system.

    The computer’s hard disk must have a BIOS that is compatible with TPM and that supports USB devices during computer startup.

    -Note

    Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.

    -
    -
    - -

    If you use a proxy, it must be visible in the system context. MBAM runs under the system context, not the user context.

    - - - -**Important** -If BitLocker was used without MBAM, MBAM can be installed and utilize the existing TPM information. - - - - -## Related topics - - -[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) - -[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md b/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md deleted file mode 100644 index f7ff13527a..0000000000 --- a/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md +++ /dev/null @@ -1,199 +0,0 @@ ---- -title: Prerequisites for the Configuration Manager Integration Feature -description: Prerequisites for the Configuration Manager Integration Feature -author: dansimp -ms.assetid: b318cbd3-b009-44b8-991b-f7364c1cae88 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Prerequisites for the Configuration Manager Integration Feature - - -If you deploy MBAM with the System Center Configuration Manager Integration topology, we recommend a three-server architecture, as described in [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md). This architecture can support 500,000 client computers. - -**Important** -Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007. - - - -## General prerequisites for the Configuration Manager Integration feature - - -When you install MBAM with Configuration Manager, the following additional prerequisites are required in addition to the prerequisites for the Stand-alone topology. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PrerequisiteAdditional information

    The Configuration Manager Server is a primary site in the Configuration Manager system.

    N/A

    The Hardware Inventory Client Agent is on the Configuration Manager Server.

    For System Center 2012 Configuration Manager, see How to Configure Hardware Inventory in Configuration Manager.

    -

    For Configuration Manager 2007, see How to Configure Hardware Inventory for a Site.

    One of the following is enabled, depending on the version of Configuration Manager that you are using:

    -
      -
    • Compliance Settings - (System Center 2012 Configuration Manager)

    • -
    • Desired Configuration Management (DCM) Client Agent – (Configuration Manager 2007)

    • -

    For System Center 2012 Configuration Manager, see Configuring Compliance Settings in Configuration Manager.

    -

    For Configuration Manager 2007, see Desired Configuration Management Client Agent Properties.

    A reporting services point is defined in Configuration Manager. Required for SQL Server Reporting Services (SSRS).

    For System Center 2012 Configuration Manager, see Prerequisites for Reporting in Configuration Manager.

    -

    For Configuration Manager 2007, see How to Create a Reporting Services Point for SQL Reporting Services.

    Configuration Manager 2007 requires Microsoft .NET Framework 2.0

    The Desired Configuration Management (DCM) Client Agent in Configuration Manager 2007 requires .NET Framework 2.0 to report compliance.

    -
    -Note

    Installing .NET Framework 3.5 automatically installs .NET Framework 2.0.

    -
    -
    - -
    - - - -## Required permissions to install MBAM with Configuration Manager - - -To install MBAM with Configuration Manager, you must have an administrative user in Configuration Manager who has a security role with the minimum permissions listed in the following table. The table also shows the rights that you must have, beyond basic computer administrator rights, to install the MBAM Server. - -**The permissions in the following table apply to both versions of Configuration Manager.** - - ---- - - - - - - - - - - - - - - - - -
    PermissionsMBAM Server feature

    SQL Server instance login server roles: - dbcreator- processadmin

    - Recovery Database- Audit Database

    SSRS instance rights: - Create Folders- Publish Reports

    - System Center Configuration Manager Integration

    - - - -**System Center 2012 Configuration Manager** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PermissionsConfiguration Manager Server feature

    Configuration Manager site rights:- Read

    System Center Configuration Manager Integration

    Configuration Manager collection rights: - Create- Delete- Read- Modify- Deploy Configuration Items

    System Center Configuration Manager Integration

    Configuration Manager configuration item rights: - Create- Delete- Read

    System Center Configuration Manager Integration

    - - - -**Configuration Manager 2007** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PermissionsConfiguration Manager Server feature

    Configuration Manager site rights:- Read

    System Center Configuration Manager Integration

    Configuration Manager collection rights: - Create- Delete- Read- ReadResource

    System Center Configuration Manager Integration

    Configuration Manager configuration item rights: - Create- Delete- Read- Distribute

    System Center Configuration Manager Integration

    - - - -## Required changes for the .mof files - - -To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file and Sms\_def.mof file for System Center 2012 Configuration Manager and Microsoft System Center Configuration Manager 2007. For instructions, see [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md). - - - -## Related topics - - -[MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md) - -[MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md b/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md deleted file mode 100644 index 3e71f9ec51..0000000000 --- a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -title: Release Notes for MBAM 2.5 SP1 -description: Release Notes for MBAM 2.5 SP1 -author: dansimp -ms.assetid: 3ac424c8-c490-4d62-aba4-1b462c02e962 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 09/06/2017 ---- - - -# Release Notes for MBAM 2.5 SP1 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1. These release notes contain information that is required to successfully install MBAM and can contain information that is not available in the product documentation. If these release notes differ from other MBAM 2.5 SP1 documentation, consider the latest change to be authoritative. These release notes supersede the content that is included with this product. - -## MBAM 2.5 SP1 known issues - - -This section contains release notes for MBAM 2.5 SP1. - -### PowerShell Read-AD\* cmdlets do not provide feedback if user does not have sufficient rights - -If a user trying to use the PowerShell Read-AD\* cmdlets for the MBAM Server does not have user rights to read the Active Directory recovery information or to read the TPM information, the cmdlets will not provide the user with any error or warning. - -**Workaround:** Only use the PowerShell Read-AD\* cmdlets if you have the required user rights. - -### MBAM Active Directory (AD) Migration cmdlets do not retrieve volume recovery information - -MBAM Active Directory (AD) Migration cmdlets fail to retrieve volume recovery information for computers in organizational units (OUs) if the forward slash character (/) is part of the OU name. Repeated AD pulls will fail with a pipeline terminating error when this error is encountered. - -**Technical Details:** You will see this error when running the command: - -``` syntax -Read-ADRecoveryInformation : Unknown error (0x80005000) -At line:1 char:1 -+ Read-ADRecoveryInformation -Server "…" -SearchBase " ... -+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - + CategoryInfo : NotSpecified: (:) [Read-ADRecoveryInformation], COMException - + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Microsoft.Mbam.Server.Commands.ADPullCommands.ReadADRecoveryInformationCommand -``` - -In addition, the Exception stack trace `Error[0].Exception.StackTrace` will look like this: - -``` syntax - at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) - at System.DirectoryServices.DirectoryEntry.Bind() - at System.DirectoryServices.DirectoryEntry.get_AdsObject() - at System.DirectoryServices.PropertyValueCollection.PopulateList() - at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName) - at System.DirectoryServices.PropertyCollection.get_Item(String propertyName) - at Microsoft.Mbam.Server.Commands.ADPullCommands.ReadCore.VerifySettingsConnectivity() - at Microsoft.Mbam.Server.Commands.ADPullCommands.ReadCore.ExecuteRead() - at Microsoft.Mbam.Server.Commands.ADPullCommands.ReadADInformationBase.ProcessRecord() - at System.Management.Automation.CommandProcessor.ProcessRecord() -``` - -**Workaround:** Perform one of these tasks to resolve this situation: - -- Rename the OU to remove the forward slash character and then run the script. - -- To exclude any problematic OU from the backup process, find a list of OUs whose names do not contain the forward slash character. Run the script on these OUs, one OU at a time. - -### MBAM fails to encrypt a volume and reports an error if you set a TPM + PIN protector on a tablet device - -If end users try to set a TPM + PIN protector on a tablet device, MBAM fails to encrypt, and it reports an error. This issue occurs because tablet devices do not have a pre-boot environment keyboard. - -**Workaround:** Enable the **Enable use of BitLocker authentication requiring preboot keyboard input on tablets** Group Policy setting. This setting is a BitLocker Group Policy setting and is not available in the MBAM Group Policy Templates. - -### User principal name is required for all service accounts - -A user principal name (UPN) must be set for all service accounts in MBAM. If you fail to create a UPN for an account, an error message appears during the configuration process to indicate that the user or group could not be found in Active Directory. - -**Workaround:** Add the UPN to the service account. - -### Self-Service Portal and the Administration and Monitoring Website do not open after you upgrade IIS to .NET Framework 4.5 - -When you upgrade Internet Information Services (IIS) to the Microsoft .NET Framework 4.5, the Self-Service Portal and the Administration and Monitoring Website do not open. - -**Workaround:** See the article [Error message after you install the .NET Framework 4.0: "Could not load type 'System.ServiceModel.Activation.HttpModule'](https://go.microsoft.com/fwlink/?LinkId=393568). - -### Administration and Monitoring Website displays a "Report cannot be found" error message when Reports are not configured - -If you configure the Administration and Monitoring Website and then try to view a report without configuring the Reports feature first, an error message indicates that the report cannot be found. - -**Workaround:** Configure the Reports feature before you configure the web applications. - -### Reports in the Administration and Monitoring Website display a warning if SSL is not configured in SSRS - -If SQL Server Reporting Services (SSRS) was not configured to use Secure Socket Layer (SSL), the URL for the Reports feature will be set to HTTP instead of to HTTPS when you configure the MBAM Server. If you then open the Administration and Monitoring Website and select a report, the following error message appears: "Only Secure Content is Displayed." - -**Workaround:** To show the report, click **Show All Content**. To correct this issue, go to the MBAM computer where SQL Server Reporting Services is installed, run **Reporting Services Configuration Manager**, and then click **Web Service URL**. Select the appropriate SSL certificate for the server, enter the appropriate SSL port (the default port is 443), and then click **Apply**. - -### Clicking "Back" in the BitLocker Compliance Summary report might throw an error - -If you drill down into a BitLocker Compliance Summary report, and then click the **Back** link in the SSRS report, an error might be thrown. - -**Workaround:** None. - -### Cipher strength displays incorrectly on the BitLocker Computer Compliance report - -If you do not set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object, the BitLocker Computer Compliance report in the Configuration Manager Integration topology always displays "unknown" for the cipher strength, even when the cipher strength uses the default of 128-bit encryption. The report displays the correct cipher strength if you set a specific cipher strength in the Group Policy Object. - -**Workaround:** Always set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object. - -### Compliance Status Distribution By Drive Type displays old data after you update configuration items - -After you update MBAM configuration items in System Center 2012 Configuration Manager, the Compliance Status Distribution By Drive Type bar chart on the BitLocker Enterprise Compliance Dashboard shows data that is based on information from old versions of the configuration items. - -**Workaround:** None. Modification of the MBAM configuration items is not supported, and the report might not appear as expected. - -### Enhanced Security Configuration might cause reports to display an error message incorrectly - -If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an "Access Denied" error message might appear when you try to view reports on the MBAM Server. By default, ESC is turned on to protect the server by decreasing the server’s exposure to potential attacks that can occur through web content and application scripts. - -**Workaround:** If the "Access Denied" error message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which ESC is not enabled. - -### Support for Bitlocker XTS-AES encryption algorithm -Bitlocker added support for the XTS-AES encryption algorithm in Windows 10, version 1511. With HF02, MBAM added client support for this Bitlocker option and in HF04, the server-side support was added. However, there is one known limitation: - -* Customers must use the same encryption strength for OS and data volumes on the same machine. -If different encryption strengths are used, MBAM will report the machine as **non-compliant**. - -### Self-Service Portal automatically adds "-" on Key ID entry -As of HF02, the MBAM Self-Service Portal automatically adds the '-' on Key ID entry. -**Note:** The Server has to be reconfigured for the Javascript to take effect. - -### MBAM 2.5 Sp1 Reports does not work / render properly -Reports Page does not render properly when SSRS is hosted on SQL Server 2016 edition.  -For example – Browsing to Helpdesk – Clicking on Reports –  ( Highlighted portion have “x”  on it ) -Digging this further with Fiddler – it does look like once we click on Reports – it calls the SSRS page with HTML 4.0 rendering format. - -**Workaround:** Looking at the site.master code and noticed the X-UA mode was dictated as IE8. As IE8 is WAY past the end of life, and customer is using IE11. Update the setting to the below code. This allows the site to utilize IE11 rendering technologies - - - -Original setting is: - - - - -This is the reason why the issue was not seen with other browsers like Chrome, Firefox etc. - - - -## Related topics - - -[About MBAM 2.5](about-mbam-25.md) - -  - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/release-notes-for-mbam-25.md b/mdop/mbam-v25/release-notes-for-mbam-25.md deleted file mode 100644 index ca65e45a7a..0000000000 --- a/mdop/mbam-v25/release-notes-for-mbam-25.md +++ /dev/null @@ -1,186 +0,0 @@ ---- -title: Release Notes for MBAM 2.5 -description: Release Notes for MBAM 2.5 -author: dansimp -ms.assetid: fcaf03e6-5e39-4771-af3c-a3cd468f3961 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Release Notes for MBAM 2.5 - - -To search these release notes, press Ctrl+F. - -Read these release notes thoroughly before you install Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. These release notes contain information that is required to successfully install MBAM and can contain information that is not available in the product documentation. If these release notes differ from other MBAM 2.5 documentation, consider the latest change to be authoritative. These release notes supersede the content that is included with this product. - -## MBAM 2.5 known issues - - -This section contains release notes for MBAM 2.5. - -### Web browser unintentionally run as administrator - -Help links in the MBAM Server Configuration tool can cause browser windows to open with administrator rights. - -**Workaround:** Enable Internet Explorer Enhanced Security Configuration (IESC) or close your web browser before navigating to other sites. - -**Note**   -This is fixed in MBAM 2.5 SP1. - - - -### MBAM reports as noncompliant a client encrypted with AES 256-bit encryption keys and Diffuser - -If a computer has the MBAM 2.5 client installed and is encrypted by using the AES 256-bit with Diffuser cipher strength, the MBAM client is reported as noncompliant in the MBAM compliance reports. - -**Workaround:** Install the hotfix at [KB2975636](https://go.microsoft.com/fwlink/?LinkId=511972). - -### MBAM fails to encrypt a volume and reports an error if you set a TPM + PIN protector on a tablet device - -If end users try to set a TPM + PIN protector on a tablet device, MBAM fails to encrypt, and it reports an error. This issue occurs because tablet devices do not have a pre-boot environment keyboard. - -**Workaround:** Enable the **Enable use of BitLocker authentication requiring preboot keyboard input on tablets** Group Policy setting. This setting is a BitLocker Group Policy setting and is not available in the MBAM Group Policy Templates. - -### User principal name is required for all service accounts - -A user principal name (UPN) must be set for all service accounts in MBAM. If you fail to create a UPN for an account, an error message appears during the configuration process to indicate that the user or group could not be found in Active Directory. - -**Workaround:** Add the UPN to the service account. - -### Self-Service Portal requires additional configuration if client computers cannot access Microsoft Ajax Content Delivery Network - -If your client computers do not have access to the Microsoft Ajax Content Delivery Network (CDN), which gives the Self-Service Portal the access that it requires to certain JavaScript files, you must configure the Self-Service Portal to reference the JavaScript files from an accessible source. If you don’t configure the Self-Service Portal when client computers cannot access CDN, only the company name and the account under which you logged on is displayed. No error message appears. - -**Workaround:** Install MBAM 2.5 SP1. or configure the Self-Service Portal by following these instructions: [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md). - -### Self-Service Portal and the Administration and Monitoring Website do not open after you upgrade IIS to .NET Framework 4.5 - -When you upgrade Internet Information Services (IIS) to the Microsoft .NET Framework 4.5, the Self-Service Portal and the Administration and Monitoring Website do not open. - -**Workaround:** See the article [Error message after you install the .NET Framework 4.0: "Could not load type 'System.ServiceModel.Activation.HttpModule'](https://go.microsoft.com/fwlink/?LinkId=393568). - -### Administration and Monitoring Website displays a "Report cannot be found" error message when Reports are not configured - -If you configure the Administration and Monitoring Website and then try to view a report without configuring the Reports feature first, an error message indicates that the report cannot be found. - -**Workaround:** Configure the Reports feature before you configure the web applications. - -### Reports in the Administration and Monitoring Website display a warning if SSL is not configured in SSRS - -If SQL Server Reporting Services (SSRS) was not configured to use Secure Socket Layer (SSL), the URL for the Reports feature will be set to HTTP instead of to HTTPS when you configure the MBAM Server. If you then open the Administration and Monitoring Website and select a report, the following error message appears: "Only Secure Content is Displayed." - -**Workaround:** To show the report, click **Show All Content**. To correct this issue, go to the MBAM computer where SQL Server Reporting Services is installed, run **Reporting Services Configuration Manager**, and then click **Web Service URL**. Select the appropriate SSL certificate for the server, enter the appropriate SSL port (the default port is 443), and then click **Apply**. - -### Clicking "Back" in the BitLocker Compliance Summary report might throw an error - -If you drill down into a BitLocker Compliance Summary report, and then click the **Back** link in the SSRS report, an error might be thrown. - -**Workaround:** None. - -### Used Space Only Encryption does not work correctly - -If you encrypt a computer for the first time after you install the MBAM Client, and you have configured a Group Policy setting to implement Used Space Only encryption, MBAM erroneously encrypts the entire disk instead of encrypting only the disk’s used space. If a computer is already encrypted with Used Space Only when you install the MBAM Client, and you have configured the same Group Policy setting, MBAM reports that the drive is encrypted correctly, and does not try to re-encrypt the drive. - -**Workaround:** None. - -### Cipher strength displays incorrectly on the BitLocker Computer Compliance report - -If you do not set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object, the BitLocker Computer Compliance report in the Configuration Manager Integration topology always displays "unknown" for the cipher strength, even when the cipher strength uses the default of 128-bit encryption. The report displays the correct cipher strength if you set a specific cipher strength in the Group Policy Object. - -**Workaround:** Always set a specific cipher strength in the **Choose drive encryption method and cipher strength** Group Policy Object. - -### Compliance Status Distribution by Drive Type displays old data after you update configuration items - -After you update MBAM configuration items in System Center 2012 Configuration Manager, the Compliance Status Distribution By Drive Type bar chart on the BitLocker Enterprise Compliance Dashboard shows data that is based on information from old versions of the configuration items. - -**Workaround:** None. Modification of the MBAM configuration items is not supported, and the report might not appear as expected. - -### Enhanced Security Configuration might cause reports to display an error message incorrectly - -If Internet Explorer Enhanced Security Configuration (ESC) is turned on, an "Access Denied" error message might appear when you try to view reports on the MBAM Server. By default, ESC is turned on to protect the server by decreasing the server’s exposure to potential attacks that can occur through web content and application scripts. - -**Workaround:** If the "Access Denied" error message appears when you try to view reports on the MBAM Server, you can set a Group Policy Object or change the default manually in your image to disable Enhanced Security Configuration. You can also alternatively view the reports from another computer on which ESC is not enabled. - -## Hotfixes and Knowledge Base articles for MBAM 2.5 - - -This table lists the hotfixes and KB articles for MBAM 2.5. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    KB ArticleTitleLink

    2975636

    Hotfix Package 1 for Microsoft BitLocker Administration and Monitoring 2.5

    support.microsoft.com/kb/2975636/EN-US

    3015477

    Hotfix Package 2 for BitLocker Administration and Monitoring 2.5

    support.microsoft.com/kb/3015477

    3011022

    MBAM 2.5 installation or Configuration Manager reporting fails if the name of SSRS instance contains an underscore

    support.microsoft.com/kb/3011022/EN-US

    2756402

    MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description

    support.microsoft.com/kb/2756402/EN-US

    2639518

    Error opening Enterprise or Computer Compliance Reports in MBAM

    support.microsoft.com/kb/2639518/EN-US

    2870842

    MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008

    support.microsoft.com/kb/2870842/EN-US

    2975472

    SQL deadlocks when many MBAM clients connect to the MBAM recovery database

    support.microsoft.com/kb/2975472/EN-US

    - - - - -## Related topics - - -[About MBAM 2.5](about-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/removing-mbam-server-features-or-software.md b/mdop/mbam-v25/removing-mbam-server-features-or-software.md deleted file mode 100644 index 640588cc30..0000000000 --- a/mdop/mbam-v25/removing-mbam-server-features-or-software.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Removing MBAM Server Features or Software -description: Removing MBAM Server Features or Software -author: dansimp -ms.assetid: 5212ba3f-124d-43c5-824a-608e9a192e86 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Removing MBAM Server Features or Software - - -These instructions explain how to remove software and features from Microsoft BitLocker Administration and Monitoring (MBAM). If you remove MBAM Server features, only the configured features are removed from the server, not the MBAM Server software. If you remove the MBAM Server software, the software and any MBAM Server features that you configured on that server are removed. - -**Note**   -To prevent the accidental removal of data, MBAM provides no mechanism for removing the databases; you must do that manually. - - - -## Removing MBAM Server features - - -You can use either of the following methods to remove MBAM Server features that you have configured: - -- MBAM Server Configuration wizard - -- Windows PowerShell cmdlets - -### Using the MBAM Server Configuration wizard to remove features - -Follow these instructions to use the MBAM Server Configuration wizard to remove configured MBAM Server features from a server. - -**To remove MBAM features by using the wizard** - -1. On the server where you want to remove features, select **MBAM Server Configuration** to open the configuration wizard. - -2. Click **Remove Features**, select the features to remove, and then click **Next**. A **Summary** page displays the features you selected for removal. - -3. Click **Remove** to start removing the features, and then click **Close**. - -### Using Windows PowerShell to remove features - -Use the following steps as a general guide to remove MBAM Server features by using Windows PowerShell cmdlets. - -**To remove MBAM features by using Windows PowerShell** - -1. Before removing any features, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) to review the prerequisites for using Windows PowerShell. - -2. Use the following cmdlets to remove MBAM Server features: - - - Disable-MbamReport - - - Disable-MbamWebApplication - - - Disable-MbamCMIntegration - - To get help with Windows PowerShell cmdlets, type **Get-Help** <*cmdlet*> or see the [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://go.microsoft.com/fwlink/?LinkId=393498) page for the MBAM Windows PowerShell cmdlets. - -## Removing MBAM Server software - - -Use the following steps to remove the MBAM Server software and any MBAM Server features that you configured on that server. - -**To remove the MBAM Server software** - -1. On the server where you want to uninstall the MBAM Server software, run **MBAMserversetup.exe** to start the Microsoft BitLocker Administration and Monitoring Setup wizard. - -2. Select **Uninstall**, and follow the remaining prompts to complete the process of uninstalling the MBAM Server software. - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/mbam-v25/server-event-logs.md b/mdop/mbam-v25/server-event-logs.md deleted file mode 100644 index b02ad84d6d..0000000000 --- a/mdop/mbam-v25/server-event-logs.md +++ /dev/null @@ -1,683 +0,0 @@ ---- -title: Server Event Logs -description: Server Event Logs -author: dansimp -ms.assetid: 04e724d2-28cc-4fa8-86a1-0d4ab0234b11 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Server Event Logs - - -The tables in this section provide information about MBAM Server log event IDs. - -## Configuration - - -The following table contains messages and troubleshooting information for event IDs that can occur on the MBAM Server during configuration. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Event IDSourceEvent symbolMessageTroubleshooting

    103

    Microsoft-Windows-MBAM-Server/Operational

    VssRegistrationException

    An exception was thrown during VSS registration.

    104

    Microsoft-Windows-MBAM-Server/Operational

    VssDeregistrationException

    An exception was thrown during VSS deregistration.

    300

    Microsoft-Windows-MBAM-Server /Admin

    CmdletError

    Failed in removing folder.

    Indicates that a terminating error occurred while performing a task. Inspect other event messages in the log to further diagnose MBAM setup.

    301

    Microsoft-Windows-MBAM-Server /Admin

    cmdletUnexpectedError

    Unexpected Cmdlet error.

    302

    Microsoft-Windows-MBAM-Server /Admin

    CmdletWarning

    Cmdlet warning.

    303

    Microsoft-Windows-MBAM-Server/Operational

    CmdletInformation

    Cmdlet information.

    Informational only; no troubleshooting required. The event indicates that a task is taking place by the Cmdlets such as enabling\disabling a feature or cancelling an operation.

    400

    Microsoft-Windows-MBAM-Server /Admin

    ConfiguratorError

    Configurator error.

    Indicates that an error has occurred while launching the MBAM Configurator. Ensure that the user has adequate privileges to launch the MBAM Configurator.

    401

    Microsoft-Windows-MBAM-Server /Admin

    ConfiguratorUnexpectedError

    Unexpected Configurator error.

    Indicates that a terminating error has occurred while performing an MBAM Configurator task. The error message will contain more details about the error. Inspect other error messages in the event log to further diagnose MBAM setup. Known errors include:

    -
      -
    • Failure to retrieve or validate a Certificate that was selected by the user

    • -
    • Failure to parse the Reports URL

    • -
    • Failure to open Event Logs for the user

    • -

    402

    Microsoft-Windows-MBAM-Server /Admin

    ConfiguratorWarning

    Configurator warning.

    Indicates that an MBAM Configurator task is not complete as expected but did not fail completely. Known tasks include missing certificate in the LocalMachine\My store that was configured in the web application feature, or a timeout for a pending task.

    410

    Microsoft-Windows-MBAM-Server/Operational

    ConfiguratorInformation

    Configurator information.

    Informational only; no troubleshooting required. The event indicates that a task is being invoked by the MBAM Configurator. Known tasks include:

    -
      -
    • Launching the configurator

    • -
    • Checking software prerequisites for an MBAM feature

    • -
    • Validating parameters for an MBAM feature

    • -
    • Enabling\disabling\committing an MBAM feature

    • -
    • Generating a PowerShell script from the configurator

    • -

    500

    Microsoft_Windows_MBAM_Server_Admin

    WebProviderUnexpectedError

    Web application provider unexpected error.

    Indicates that an error has occurred while enabling and configuring an MBAM web site or web service in IIS. Known errors include:

    -
      -
    • Failure to find IIS WWW root folder

    • -
    • Failure to access IIS configuration in web.config due to malformed files or missing settings

    • -
    • Failure to create or remove a web application

    • -
    • IIS access violation

    • -
    -

    This error is also logged if MBAM cannot access Active Directory (AD) to validate user accounts. Verify that IIS is installed, correctly configured, and the IIS service is running. Verify that all the MBAM software prerequisite checks pass. Verify that the user has the correct permissions to create web applications on the IIS instance. Verify that the user has access to read user account objects in AD.

    501

    Microsoft-Windows-MBAM-Server /Admin

    WebProviderError

    Web application provider unexpected error.

    Indicates that an error has occurred while enabling, disabling, or configuring an MBAM web site or web service in IIS. Known errors include:

    -
      -
    • Failure to read basic or WSHttp binding information from IIS

    • -
    • Missing identity section or DNS entry in identity section in IIS config files

    • -
    • Failure to open registry key HKLM\SOFTWARE\Microsoft\InetStp

    • -
    • Failure to read value PathWWWRoot from registry key HKLM\SOFTWARE\Microsoft\InetStp

    • -
    • User is trying to specify a virtual directory name with a reserved name for MBAM

    • -
    -

    Verify that IIS is installed and correctly configured. Verify that the registry key HKLM\SOFTWARE\Microsoft\InetStp:PathWWWRoot exists and accessible. Verify that the binding information in IIS is not corrupt.

    502

    Microsoft-Windows-MBAM-Server /Admin

    WebProviderWarning

    Web application provider warning.

    Indicates that a non-terminating error has occurred while enabling an MBAM web site or web service. Known errors include:

    -
      -
    • Failure to access AD to validate the Service Principal Name (SPN) on the app pool account

    • -
    • Failure to validate SPN because it is assigned to multiple accounts in AD

    • -
    • Failure to register an SPN on the app pool account in AD

    • -
    • SPN is registered on an account other than the app pool in AD

    • -
    • Failure to remove SPN from the app pool account in AD during a rollback operation

    • -
    • Failure to check if the IIS_IUSRS group has been granted the logon as batch privilege on the IIS server

    • -
    -

    The event message will contain more information about the specific error. Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has read permissions on the app pool account in AD. If an SPN is already registered on the app pool account in AD then make sure that it is not registered on other accounts.

    503

    Microsoft-Windows-MBAM-Server/Operational

    WebProviderInformation

    Web application provider information. {Description}

    Informational only; no troubleshooting required. The event indicates that a task is being invoked by the MBAM Setup. Known tasks include getting IIS configuration such as binding information and root site, and configuring Service Principal Name (SPN).

    600

    Microsoft-Windows-MBAM-Server /Admin

    SetupUnexpectedError

    Unexpected setup error.

    Indicates that a terminating error has occurred while enabling\disabling or configuring an MBAM feature. Known errors include:

    -
      -
    • Failure to rollback a task after an error

    • -
    • Failure to read from the registry

    • -
    • Failure to create or delete a folder in the file system

    • -
    • Failure to read SQL version information

    • -
    • Failure to register VSS writer in SQL

    • -
    -

    The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Make sure the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has read permissions in AD.

    -

    For a successful VSS writer registration, verify that a supported version of SQL is installed and an instance is accessible to the user who is running the MBAM setup. If disabling an MBAM feature or uninstalling MBAM verify that all files such as log files and web.config files are closed so MBAM can remove its web sites and web services.

    601

    Microsoft-Windows-MBAM-Server /Admin

    SetupError

    Setup error.

    Indicates that a terminating error has occurred while enabling\disabling or configuring an MBAM feature. Known errors include:

    -
      -
    • Failure to read MBAM configuration in IIS

    • -
    • Corrupt appSettings section in IIS configuration or misconfigured settings

    • -
    • Failure to validate host name

    • -
    • Failure to read SQL version information

    • -
    • Failure to register VSS writer in SQL

    • -
    -

    The event message will contain more information about the specific error. Verify that IIS is installed and configured correctly. Verify that all MBAM software prerequisite checks pass. For a successful VSS writer registration, verify that a supported version of SQL is installed and an instance is accessible to the user who is running the MBAM setup.

    602

    Microsoft-Windows-MBAM-Server /Admin

    SetupWarning

    Setup warning.

    Indicates that a non-terminating error has occurred while enabling\disabling or configuring an MBAM feature such as Configuration Manager (CM) Integration or MBAM web application. Known errors include: failure to delete MBAM Reports from SRS Role point in the CM, and failure to resolve a host name from the domain controller. The event message will contain more information about the specific error.

    -

    Verify that AD is reachable from the server where MBAM setup is running. Verify that the user who is running the MBAM setup has remove permissions on the SSRS instance that is configured as an SRS Role point in CM.

    603

    Microsoft-Windows-MBAM-Server/Operational

    SetupInformation

    Setup information.

    Informational only; no troubleshooting required.

    605

    Microsoft-Windows-MBAM-Server /Admin

    WebProviderSoftwareCheckFailure

    Web application cannot be enabled because one or more software dependencies are not being met.

    During MBAM web site/web service installation, MBAM setup verifies if necessary prerequisites are in place. This message indicates that MBAM failed to install the requested web site/web service as the necessary prerequisite is missing. Refer to error messages preceding this message to get more information about missing prerequisites.

    606

    Microsoft-Windows-MBAM-Server /Admin

    SetupParameterValidationFailure

    The parameter that is needed to enable the server feature was either not specified or it did not pass the validation.

    Indicates that the parameter that is needed to configure an MBAM feature was either not specified or it did not pass the validation.

    607

    Microsoft-Windows-MBAM-Server /Admin

    SetupParameterValidationFailureWithError

    Error encountered while trying to validate specified parameter that is needed to enable the server feature.

    Indicates that an error was encountered while trying to validate specified parameter that is needed to enable the server feature.

    700

    Microsoft-Windows-MBAM-Server /Admin

    DbProviderUnexpectedError

    DB provider unexpected error.

    701

    Microsoft-Windows-MBAM-Server /Admin

    DbProviderError

    DB provider error.

    The message contained in the EventDetails section should provide more information about actual error. These are some of the areas to verify:

    -
      -
    • MBAM Setup failed to connect to Database using the provided connection information. Verify the connection string details provided to MBAM setup.

    • -
    • MBAM Setup could not connect to the given database using the supplied domain account credentials. Verify that domain account user name and password are valid.

    • -
    • MBAM Setup could not connect to the given database using the supplied domain account credentials. Verify that the provided domain account has necessary permissions in place to connect to MBAM database.

    • -
    • MBAM Dac pac will fail if a newer version of MBAM database is already installed. Verify that a new version of MBAM DBs does not exist on the given SQL server.

    • -

    702

    Microsoft-Windows-MBAM-Server /Admin

    DbProviderWarning

    DB provider warning.

    703

    Microsoft-Windows-MBAM-Server/Operational

    DbProviderInformation

    DB provider information.

    Informational only; no troubleshooting required.

    704

    Microsoft-Windows-MBAM-Server /Admin

    DbProviderDacError

    An error occurred while deploying the Data-Tier Application.

    MBAM packages its databases as data tier applications and tries to register them using Microsoft.SqlServer.Dac.DacServices. The error message in context is reported by DAC service. The event should contain detailed information about what caused it. Read the information in the error message to troubleshoot and fix the issue.

    705

    Microsoft-Windows-MBAM-Server /Admin

    DbProviderDacWarning

    A warning occurred while deploying the Data-Tier Application.

    MBAM packages its databases as data tier application and tries to register them using Microsoft.SqlServer.Dac.DacServices. The warning message in context is reported by DAC service. The event should contain detailed information about what caused it. Read the information in the warning message to troubleshoot and fix the issue.

    706

    Microsoft-Windows-MBAM-Server/Operational

    DbProviderDacInformation

    A message was raised while deploying the Data-Tier Application.

    Informational only; no troubleshooting required.

    800

    Microsoft-Windows-MBAM-Server /Admin

    ReportProviderUnexpectedError

    Report provider unexpected error.

    Report provider unexpected error. {Description} {exceptionDetails} These are some of the possible exception details:

    -

    An error occurred while getting the name of directory '{directoryName}'

    -

    An exception occurred while getting files for directory '{directoryName}'

    -

    An exception occurred while enumerating directories in directory '{directoryName}'

    -

    An exception occurred while reading all bytes for file '{fileName}'

    -

    During MBAM installation, MBAM setup unzips all the report files to the specified installation path. As a part of report installation, install module tries to access the unzipped report files at installation path and communicates with SQL Reporting services to publish the report files. The above errors occur when MBAM cannot access the files/folders at unzipped Installation path. These are some tips to troubleshoot this issue:

    -
      -
    • Verify that MBAM is installed.

    • -
    • Verify that regkey HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server\InstallationPath is present and accessible to the executing user.

    • -
    • Verify that Path to Report files under MBAM InstallationPath does not exceed 248 characters.

    • -
    • Verify that MBAM Setup folder or the files contained in MBAM Installation path has not been modified since installation.

    • -
    • Verify that user running the setup is authorized to read from/write to MBAM Installation folder.

    • -
    -

    Reporting Services connectivity failed.{exceptionDetails}

    -

    During MBAM reports installation, modules tries to communicate with SSRS web services to create folders and publish reports. The above message indicates that MBAM could not find or communicate with SSRS web services. These are some tips to troubleshoot this issue:

    -
      -
    • Verify that SSRS is installed on the specified machine.

    • -
    • Using SSRS console verify that SSRS is enabled and running.

    • -
    • Verify that user running the setup is authorized to access SSRS.

    • -
    -

    Failed to remove the MBAM Reports using Reporting Services instance URL '{SSRSInstanceUrl}'.Make sure the SSRS instance required for MBAM Reports is running and configured correctly.

    -

    When MBAM installation fails or When user disables MBAM Reporting features, setup module removes SSRS reports. The above message indicates that MBAM failed to remove SSRS reports. These are some tips to troubleshoot this issue:

    -
      -
    • Verify that SSRS is installed on the specified machine.

    • -
    • Using SSRS console verify that SSRS is enabled and running.

    • -
    • Verify that the user running the setup is authorized to access SSRS.

    • -
    -

    An error occurred while publishing reports.{exceptionDetails}.

    -

    During MBAM reports installation, modules tries to communicate with SSRS web services to create folders and publish reports. The above message indicates that SSRS web service reported and exception while publishing reports. These are some tips to troubleshoot this issue:

    -
      -
    • Using SSRS console verify that SSRS is enabled and running.

    • -
    • Verify that the user running the setup is authorized to access/publish reports to SSRS.

    • -
    -

    A policy for group user name '{userName}' already exists. In case this is not correct, manually revise the Reporting Service for duplicate or invalid policies.

    -

    After Publishing MBAM reports, MBAM setup tries to create a MBAM Report Users roles (if it does not exist already) and sets corresponding user policy. The above error indicates that SSRS web service threw an exception while setting up report user role policy. Follow the instructions in the event message and refer to "https://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=SQL+Server+Reporting+Services&ProdVer=8.00&EvtID=rsInvalidPolicyDefinition&EvtSrc=Microsoft.ReportingServices.Diagnostics.ErrorStrings.resources.Strings&LCID=1033"; for more help.

    -

    An error occurred while validating access to SSRS {exceptionDetails}.

    -

    As part of prerequisite check, MBAM setup verifies if the user has necessary permissions to access/create folder under SSRS. The error message indicates that an exception has occurred while verifying access to SSRS. Refer to the exception details for debugging tips.

    -

    A SOAP error occurred while checking the SSRS URL.{exceptionDetails}

    -

    A web error occurred while checking the SSRS URL.{exceptionDetails}

    -

    An http/https error occurred while checking the SSRS URL.{exceptionDetails}

    -

    An error occurred while checking the SSRS URL.{exceptionDetails}

    -

    As part of prerequisite check, MBAM setup retrieves URLs associated with the supplied SSRS instance and tries to communicate with SSRS web service. The above error message indicates that SSRS web service at the given URL threw an exception, Refer to exception details for more information. These are some tips to resolve SSRS communication issues.

    -
      -
    • Verify that SSRS is installed on the specified machine.

    • -
    • Using SSRS console verify that SSRS is enabled and running.

    • -
    • Verify that the user running the setup is authorized to access SSRS.

    • -
    -

    An error occurred while retrieving the SSRS version. {exceptionDetails}

    -

    As part of prerequisite check, MBAM setup queries WMI to retrieve the version number associated to the supplied SSRS instance. The above error message indicates that an exception occurred while querying WMI. Refer to exceptionDetails for more information. These are some checks you can perform:

    -
      -
    • Verify that SSRS with given instance name is installed on the specified machine.

    • -
    • Using SSRS console verify that SSRS is enabled and running.

    • -
    • Verify that the user executing the setup is authorized to query SSRS class under WMI namespace.

    • -
    -

    The current user is not authorized to access the WMI namespace '{ssrsWMINamespace}'.

    -

    An error occurred while enumerating the namespace '{ssrsWMINamespace}'. RPC server for SSRS WMI provider on the local host is not found.

    -

    An error occurred while enumerating the namespace '{ssrsNamespace}'. Unable to find an instance of SSRS on the local host.

    -

    An error occurred while accessing WMI. RPC server for instance '{ssrsInstance}' was not found.

    -

    An error occurred while accessing WMI. Instance name '{ssrsInstanceName}' is not correct.

    -

    An error occurred while accessing WMI. Unable to find instance '{ssrsInstanceName}' on the local host.

    -

    As part of prerequisite check, MBAM setup queries WMI to retrieve WMI namespace associated to given instance. The above error message indicates that and exception was occurred while querying WMI. Refer to exceptionDetails for more information. These are some checks you can perform:

    -
      -
    • Verify that SSRS with given instance name is installed on the specified machine.

    • -
    • Using SSRS console verify that SSRS is enabled and running.

    • -
    • Verify that the user running the setup is authorized to access/query SSRS class under WMI namespace.

    • -

    801

    Microsoft-Windows-MBAM-Server /Admin

    ReportProviderError

    Report provider unexpected error.

    Given the SQL server reporting services instance name, MBAM tries to find the WMI namespace corresponding to the reporting instance and connect to it. This error occurs if MBAM encounters an exception when MBAM searches for or tries to connect to SSRS WMI namespace. Read the information in the error messages logged in the MBAM setup channel before this message to get more details. Here are some things you can check:

    -
      -
    • Verify that SSRS with supplied instance name is up and running

    • -
    • Verify that the user account running MBAM installation has necessary permissions to query/connect to SSRS WMI namespace

    • -

    802

    Microsoft-Windows-MBAM-Server /Admin

    ReportProviderWarning

    Report provider warning.

    803

    Microsoft-Windows-MBAM-Server/Operational

    ReportProviderInformation

    Report provider information.

    Informational only; no troubleshooting required.

    900

    Microsoft-Windows-MBAM-Server /Admin

    CMProviderUnexpectedError

    CM provider unexpected error.

    Indicates that a terminating error has occurred while enabling\disabling or configuring the Configuration Manager (CM) Integration feature in MBAM. Known errors include:

    -
      -
    • Failure to connect to the CM site server via the SMS Provider

    • -
    • Failure to read from the registry

    • -
    • Failure to create or delete a folder in the file system

    • -
    • Failure to locate the Configuration Manager Console installation on the local machine

    • -
    • Failure to retrieve information for the SSRS instance that is configured as an SRS Role point in CM

    • -
    -

    The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Verify that the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that MBAM is being integrated with a supported version of Configuration Manager. Verify that the Configuration Manager Console is installed on the machine where the MBAM setup is being invoked and that the console can be used to connect to the target CM Site Server. Verify that a valid SSRS instance is configured as an SRS Role point in CM and that the user who is running the MBAM setup has read\write permissions on the SSRS instance.

    901

    Microsoft-Windows-MBAM-Server /Admin

    CMProviderError

    CM provider unexpected error.

    Indicates that a terminating error has occurred while enabling\disabling or configuring the Configuration Manager (CM) Integration feature in MBAM. Known errors include:

    -
      -
    • failure to connect to the CM Site Server via the SMS Provider

    • -
    • failure to read from the registry

    • -
    • failure to create or delete a folder in the file system

    • -
    • failure to locate the Configuration Manager Console installation on the local machine

    • -
    • missing ConfigMgr folder in SSRS as the root folder for the SRS Role point reports

    • -
    • missing ConfigMgr shared data source in SSRS

    • -
    • failure to deploy SSRS reports in the SSRS instance that is configured as an SRS Role point in CM

    • -
    • failure to create Configuration Items and baselines in CM

    • -
    -

    The event message will contain more information about the specific error. Verify that all MBAM software prerequisite checks pass. Verify that the MBAM registry path, if exists, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server and all the subkeys are readable. Verify that MBAM is being integrated with a supported version of Configuration Manager. Verify that the Configuration Manager Console is installed on the machine where the MBAM setup is being invoked and that the console can be used to connect to the target CM Site Server. Verify that the user has the required read\write permissions to create Configuration Items, Baselines, and Collections in CM. Verify that a valid SSRS instance is configured as an SRS Role point in CM and that the user who is running the MBAM setup has read\write permissions on the SSRS instance.

    902

    Microsoft_Windows_MBAM_Server_Admin

    CMProviderWarning

    CM provider warning.

    Indicates that a non-terminating error has occurred while enabling the Configuration Manager (CM) Integration feature. Known errors include: failure to commit collection rules in the MBAM Supported Computers collection in CM, and other SSRS and network related errors.

    -

    The event message will contain more information about the specific error. Some operations that caused this warning are retired after the warning. If after several retries the error persists, then MBAM might end with an actual error. Inspect other event messages in the log to further diagnose MBAM setup.

    903

    Microsoft-Windows-MBAM-Server/Operational

    CMProviderInformation

    CM provider information.

    Informational only; no troubleshooting required.

    - - - -## Operation - - -The following table contains messages and troubleshooting information for event IDs that can occur while MBAM is running. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Event IDSourceEvent SymbolMessageTroubleshooting

    1

    Microsoft-Windows-MBAM-Web/Admin

    WebAppSpnError

    Application: {SiteName}{VirtualDirectory} is missing the following Service Principal Names (SPNs):{ListOfSpns} Register the required SPNs on the account: {ExecutionAccount}.

    For Integrated Windows Authentication to succeed, necessary SPNs needs to be in place. This message indicates that the SPN required for MBAM application has not been correctly configured. Details contained in this event should provide more information.

    -

    See “Service Principal Name (SPN)” in MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies for more information.

    4

    Microsoft-Windows-MBAM-Web/Operational

    PerformanceCounterError

    An error occurred while retrieving a performance counter.

    -

    Message:{EventMessage}Category:{CategoryOfPerformanceCounter} Performance Counter:{NameOfPerformanceCounter} Instance:{Name of performance counter category instance} Exception:{ExceptionThrown}

    -

    Trace message will contain the actual exception message, some of which are explained here:

    -

    ArgumentNullException: This exception is thrown if the category, counter or instance of requested Performance counter is invalid.

    -

    System.InvalidOperationException: categoryName is an empty string ("").-or- counterName is an empty string("").

    -

    -or- The read/write permission setting requested is invalid for this counter.

    -

    -or- The category specified does not exist (if readOnly is true).

    -

    -or- The category specified is not a .NET Framework custom category (if readOnly is false).

    -

    -or-The category specified is marked as multi-instance and requires the performance counter to be created with an instance name.

    -

    -or-instanceName is longer than 127 characters.

    -

    -or-categoryName and counterName have been localized into different languages.

    -

    System.ComponentModel.Win32Exception: An error occurred when accessing a system API.

    -

    System.PlatformNotSupportedException: The platform is Windows 98 or Windows Millennium Edition (ME), which does not support performance counters.

    -

    System.UnauthorizedAccessException: Code that is executing without administrative privileges attempted to read a performance counter.

    The message contained in the event will provide more details around the exception that was thrown. If a System.UnauthorizedAccessException was thrown, verify that MBAM execution account (app pool) has access to performance counter APIs.

    100

    Microsoft-Windows-MBAM-Web/Admin

    AdminServiceRecoveryDbError

    GetMachineUsers: An error occurred while getting user information from the database. Message:{message} -or-

    -

    GetRecoveryKey: an error occurred while getting recovery key from the database. Message:{message} -or-

    -

    GetRecoveryKey: an error occurred while getting user information from the database. Message:{message} -or-

    -

    GetRecoveryKeyIds: an error occurred while getting recovery key Ids from the database. Message:{message} -or-

    -

    GetTpmHashForUser: An error occurred while getting TPM hash data from the recovery database. Message:{message} -or-

    -

    GetTpmHashForUser: An error occurred while getting TPM hash data from the recovery database. Message:{message}-or-

    -

    QueryDriveRecoveryData: An error occurred while getting drive recovery data from the database. Message:{message}-or-

    -

    QueryRecoveryKeyIdsForUser: An error occurred while getting recovery key Ids from the database. Message:{message} -or-

    -

    QueryVolumeUsers: An error occurred while getting user information from the database.

    This message is logged whenever there is an exception while communicating with the MBAM recovery database. Read through the information contained in the trace to get specific details about the exception.

    -

    For detailed troubleshooting steps, see the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine.

    101

    Microsoft-Windows-MBAM-Web/Admin

    AdminServiceComplianceDbError

    GetRecoveryKey: An error occurred while logging an audit event to the compliance database. Message:{message} -or-

    -

    GetRecoveryKeyIds: An error occurred while logging an audit event to the compliance database. Message:{message} -or-

    -

    GetTpmHashForUser: An error occurred while logging an audit event to the compliance database. Message:{message} -or-

    -

    QueryRecoveryKeyIdsForUser: An error occurred while logging an audit event to the compliance database. Message:{message} -or-

    -

    QueryDriveRecoveryData: An error occurred while logging an audit event to the compliance database. Message:{message}

    This message is logged whenever there is an exception while communicating the MBAM compliance database. Read through the information contained in the trace to get specific details about the exception.

    -

    For detailed troubleshooting steps, see the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine.

    102

    Microsoft-Windows-MBAM-Web/Admin

    AgentServiceRecoveryDbError

    This message indicates an exception when MBAM Agent service tries to communicate with the recovery database. Read through the message contained in the event to get specific information about the exception.

    -

    See the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether the MBAM app pool account has required permissions in place to connect or execute on MBAM recovery database.

    103

    Microsoft-Windows-MBAM-Web/Admin

    AgentServiceError

    Unable to detect client machine account or data migration user account. -or-

    -

    Account verification failed for caller identity.

    Whenever a call is made to the "PostKeyRecoveryInfo", "IsRecoveryKeyResetRequired", "CommitRecoveryKeyRest", or "GetTpmHash" web methods on MBAM Agent services, it retrieves the caller context to obtain caller credentials. If the caller context is null or empty, the MBAM Agent service logs "Unable to detect client machine account or data migration user account."

    -

    The message "Account verification failed for caller identity " is logged if the web method is expecting the caller to a be computer account and the caller is not a computer account, or if the web method is excepting the caller to be a user account and the caller is not a user account or member of data migration group account.

    104

    Microsoft-Windows-MBAM-Web/Admin

    StatusServiceComplianceDbConfigError

    "The Compliance database connection string in the registry is empty."

    This message is logged whenever the compliance db connection string is invalid.

    -

    Verify the value at the registry key HKLM\Software\Microsoft\MBAM Server\Web\ComplianceDBConnectionString

    105

    Microsoft-Windows-MBAM-Web/Admin

    StatusServiceComplianceDbError

    This error indicates that MBAM websites/web services were unable to connect to the MBAMCompliance database.

    -

    See the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify that the IIS app pool account could connect to the MBAM compliance database.

    106

    Microsoft-Windows-MBAM-Web/Admin

    HelpdeskError

    The request to URL {url} caused an internal error. -or-

    -

    An error occurred while obtaining execution context information. Unable to verify Service Principal Name (SPN) registration. -or-

    -

    An error occurred while verifying Service Principal Name (SPN) registration.

    Indicates that an unhandled exception has been raised in Helpdesk application. Review the log entries in the MBAM Admin operational channel to find the specific exception. –or-

    -

    During the initial Helpdesk website load operation, an SPN check is performed. To verify SPN, the Helpdesk requires execution account information, IIS Sitename, and ApplicationVirtualPath corresponding to Helpdesk website. This error message is logged when one or more of these is invalid or missing. –or-

    -

    This message indicates that a security exception is thrown while performing SPN verification. Refer to the exception contained in event details section.

    107

    Microsoft-Windows-MBAM-Web/Admin

    SelfServicePortalError

    An error occurred while getting recovery key for a user. EventDetails:{ExceptionMessage} -or-

    -

    An error occurred while obtaining execution context information. Unable to verify Service Principal Name (SPN) registration. EventDetails: User: {username Identity} Application:{SiteName\ApplicationVirtualPath} -or-

    -

    An error occurred while verifying Service Principal Name (SPN) registration. EventDetails:{ExceptionMessage}

    Indicates that an unexpected exception was thrown when a request was made to retrieve recovery key. Refer to the exception message contained in event details section. If tracing is enabled on MBAM Helpdesk, refer to trace data to obtain detailed exception messages. –or-

    -

    During an initial load operation, the Self-Service Portal (SSP) retrieves execution account information, IIS Sitename, and ApplicationVirtualPath corresponding to the Self-Service website to verify SPN. This error message is logged when one or more of these is invalid. –or-

    -

    This message indicates that a security exception was thrown while performing SPN verification. Refer to the exception contained in event details section.

    108

    Microsoft-Windows-MBAM-Web/Admin

    DomainControllerError

    An error occurred while resolving domain name {DomainName}, A memory allocation failure occurred. -or-

    -

    Could not invoke DsGetDcName method. EventDetails:{ExceptionMessage}

    To resolve Domain name, MBAM leverages "DsGetDcName" windows API. This message is logged when "DsGetDcName" returns "ERROR_NOT_ENOUGH_MEMORY" indicating a memory allocation failure. –or-

    -

    This message indicates that "DsGetDcName" API method is unavailable on the hosting system.

    109

    Microsoft-Windows-MBAM-Web/Admin

    WebAppRecoveryDbError

    An error occurred while reading the configuration of the Recovery database. The connection string to the Recovery database is not configured. Message:{message} -or-

    -

    DoesUserHaveMatchingRecoveryKey: an error occurred while getting recovery key Ids for a user. Message:{message} -or-

    -

    QueryDriveRecoveryData: an error occurred while getting drive recovery data. Message:{message} -or-

    -

    QueryRecoveryKeyIdsForUser: an error occurred while getting recovery key Ids for a user. Message:{message} -or-

    -

    An error occurred while getting TPM password hash from the Recovery database. EventDetails:{ExceptionMessage}

    This message indicates that recovery database connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\RecoveryDBConnectionString" is invalid. Verify the given registry key value. –or-

    -

    If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether a connection could be made to the MBAM Recovery database from IIS server using app pool credentials.

    110

    Microsoft-Windows-MBAM-Web/Admin

    WebAppComplianceDbError

    An error occurred while reading the configuration of the Compliance database. The connection string to the Compliance database is not configured. -or-

    -

    GetRecoveryKeyForCurrentUser: an error occurred while logging an audit event to the Compliance database. Message:{message} -or-

    -

    QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the Compliance database. Message:{message} -or-

    -

    QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the compliance database. Message:{message}

    This message indicates that compliance db connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\ComplianceDBConnectionString" is invalid. Verify the value corresponding to above registry key. –or-

    -

    If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether a connection could be made to the MBAM Compliance database from IIS server using app pool credentials.

    111

    Microsoft-Windows-MBAM-Web/Admin

    WebAppDbError

    These errors indicate one of the following two conditions

    -
      -
    • MBAM websites/webservices were unable to either connect to MBAMCompliance OR MBAMRecovery database

    • -
    • MBAM websites/webservices execution account(app pool account) could not run the GetVersion stored procedure on MBAMCompliance OR MBAMRecovery database

    • -
    -

    The message contained in the event will provide more details about the exception.

    -

    Refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify that the MBAM execution account (app pool account) could connect to MBAM compliance/recovery database and it has permissions in place to execute GetVersion stored procedure.

    112

    Microsoft-Windows-MBAM-Web/Admin

    WebAppError

    An error occurred while verifying Service Principal Name (SPN) registration. EventDetails:{ExceptionMessage}

    To perform SPN verification, MBAM queries Active Directory to retrieve a list of SPNs mapped execution account. MBAM also queries the "ApplicationHost.config" to obtain MBAM website bindings. This error message indicates that MBAM could not communicate with Active Directory or it could not load the applicationHost.config file.

    -

    Verify that the execution account (app pool account) has permissions to query AD or the ApplicationHost.config file. Also verify the site binding entries in ApplicationHost.config file.

    200

    Microsoft-Windows-MBAM-Web/Operational

    HelpDeskInformation

    The administration website application successfully found and connected to a supported version of the Recovery database. -or-

    -

    The administration website application successfully found and connected to a supported version of the Compliance database.

    Indicates successful connection to the Recovery/Compliance database from the MBAM Helpdesk website.

    201

    Microsoft-Windows-MBAM-Web/Operational

    SelfServicePortalInformation

    The Self-Service Portal application successfully found and connected to a supported version of the Recovery database. -or-

    -

    The Self-Service Portal application successfully found and connected to a supported version of the Compliance database.

    Indicates successful connection to the Recovery/Compliance database from the MBAM Self-Service Portal.

    202

    Microsoft-Windows-MBAM-Web/Operational

    WebAppInformation

    Application has its SPNs registered correctly.

    Indicates that the SPNs required for the MBAM Helpdesk website are correctly registered against the executing account.

    - - - - -## Related topics - - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Client Event Logs](client-event-logs.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/technical-reference-for-mbam-25.md b/mdop/mbam-v25/technical-reference-for-mbam-25.md deleted file mode 100644 index a8b62bb56d..0000000000 --- a/mdop/mbam-v25/technical-reference-for-mbam-25.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Technical Reference for MBAM 2.5 -description: Technical Reference for MBAM 2.5 -author: dansimp -ms.assetid: da77a5b6-d5cf-4bae-9475-13a75088ab23 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for MBAM 2.5 - - -This section includes technical information about features in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5. - -## Technical reference information - - -- [Client Event Logs](client-event-logs.md) - - This topic provides a list of Client events for MBAM. - -- [Server Event Logs](server-event-logs.md) - - This topic provides a list of Server events for MBAM. - -## Other resources for MBAM operations - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/troubleshooting-mbam-25.md b/mdop/mbam-v25/troubleshooting-mbam-25.md deleted file mode 100644 index e756c4cc34..0000000000 --- a/mdop/mbam-v25/troubleshooting-mbam-25.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: Troubleshooting MBAM 2.5 -description: Troubleshooting MBAM 2.5 -author: dansimp -ms.assetid: f35e7aef-2c3c-4d43-b170-6830d2756063 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting MBAM 2.5 - - -Troubleshooting content is not included in the Administrator’s Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## How to find troubleshooting content - - -You can use the following information to find troubleshooting or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. - -After you search the MDOP documentation, your next step would be to search the troubleshooting information for the product in the TechNet Wiki. - -**To search the MDOP product documentation** - -1. Use a web browser to navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/?LinkId=236032) TechNet home page. - -2. Enter applicable search terms in the **Search TechNet with Bing** search box at the top of the MDOP Information Experience home page. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Enter applicable search terms in the **Search TechNet Wiki** search box on the TechNet Wiki home page. - -3. Review the search results for assistance. - -## How to create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP OnlineHelp or TechNet Wiki, you can create your own TechNet Wiki articles. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Use a web browser to navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log in with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article >>** at the bottom of the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Be sure to give the article a descriptive title and then overwrite the template information as needed to create your troubleshooting or best practice article. - -7. After you review your article, be sure to include a tag that is named **Troubleshooting** and another for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for troubleshooting MBAM - - -[Microsoft BitLocker Administration and Monitoring 2.5](index.md) - -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) - -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Troubleshooting MBAM 2.5 installation problems](https://support.microsoft.com/kb/3049652) - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  - - - - - diff --git a/mdop/mbam-v25/troubleshooting-mbam-installation.md b/mdop/mbam-v25/troubleshooting-mbam-installation.md deleted file mode 100644 index f2d0494b7f..0000000000 --- a/mdop/mbam-v25/troubleshooting-mbam-installation.md +++ /dev/null @@ -1,645 +0,0 @@ ---- -title: Troubleshooting MBAM 2.5 installation problems -description: Introducing how to troubleshoot MBAM 2.5 installation problems. -author: Deland-Han -ms.reviewer: dcscontentpm -manager: dansimp -ms.author: delhan -ms.sitesec: library -ms.prod: w10 -ms.date: 09/16/2019 -manager: dcscontentpm ---- - -# Troubleshooting MBAM 2.5 installation problems - -This article introduces how to troubleshoot Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 installation issues in a standalone configuration. - -## Referring MBAM log files for troubleshooting - -MBAM includes logging for server installation, client installation, and events. This logging should be referred to for troubleshooting. - -### MBAM server installation log files - -MBAMServerSetup.exe generates the following log files in the user’s %temp% folder during MBAM installation:
    **Microsoft_BitLocker_Administration_and_Monitoring_<14 numbers>.log** - -MBAMServerSetup.exe logs the actions that were taken during MBAM setup and MBAM server feature installation:
    **Microsoft_BitLocker_Administration_and_Monitoring_<14_numbers>_0_MBAMServer.msi.log** - -MBAMServerSetup.exe logs additional actions that were taken during installation. - -### MBAM client installation log file - -The client installation is recorded in the following log file in the %temp% folder (or a custom location, depending on how the client was installed):
    **MSI\.log** - -This log contains the actions that are taken during MBAM client installation. - -### MBAM client event-logging channel - -MBAM has separate event-logging channels. The Admin, Analytical, and Operational log files are located in Event Viewer, under **Application and Services Logs** > **Microsoft** > **Windows** > **MBAM**. - -The following table provides a brief description of each event log. - -|Event log| Description| -|----------|-------| -|Microsoft-Windows-MBAM/Admin| Contains error messages| -|Microsoft-Windows-MBAM/Analytic| Contains advanced logging information| -|Microsoft-Windows-MBAM/Operational| Contains success messages| - -### MBAM server event-logging channel - -The log files are located in Event Viewer, under **Application and Services Logs** > **Microsoft** > **Windows** > **MBAM**. The following table includes server event logs that were introduced in MBAM 2.5: - -|Event log| Description| -|--------|-------------| -|Microsoft-Windows-MBAM/Admin| Contains error messages| -|Microsoft-Windows-MBAM/Analytic| Contains advanced logging information| -|Microsoft-Windows-MBAM/Operational| Contains success messages| - -### MBAM web service logs - -Each MBAM web service log writes logging information to an SVCLOG file. By default, each web service writes the trace file under a folder that uses its name in the C:\inetpub\Microsoft BitLocker Management Solution\Logs folder. - -You can use the service trace viewer tool (part of Microsoft Visual Studio) to review the svclog traces. - -## Troubleshooting encryption and reporting issues - -This section contains troubleshooting information for server functionality, client functionality, configuration settings, and known issues: - -### MBAM client installation, Group Policy settings - -Determine whether the MBAM agent is installed on the client computer. When MBAM is installed, it creates a service that is named BitLocker Management Client Service. This service is configured to start automatically. Determine whether the service is running. - -Make sure that MBAM Group Policy settings are applied on the client computer. The following registry subkey is created if the Group Policy settings were applied on the client computer: -**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement** - -Verify that this key exists and is populated by using values per Group Policy settings. - -### MBAM Agent in the initial delay period - -The MBAM client doesn't start the operation immediately after installation. There is an initial random delay of 1–18 minutes before the MBAM Agent starts its operation. In addition to the initial delay, there is a delay of at least 90 minutes. (The delay depends on the Group Policy settings that are configured for the frequency of checking the client status.) Therefore, the total delay before a client starts operation is *random startup delay* + *client checking frequency delay*. - -If the Operational and Admin event logs are blank, the client has not started the operation yet and is in the delay period that was mentioned earlier. If you want to bypass the delay, follow these steps: - -1. Stop the BitLocker Management Client Service service. - -2. Under the **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM** registry subkey, create the **NoStartupDelay** registry value, set its type to **REG_DWORD**, and then set its value to **1**. - -3. Under **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**, set the **ClientWakeupFrequency** and **StatusReportingFrequency** values to **1**. These values will revert to their original settings after Group Policy updates are on the computer. - -4. Start the BitLocker Management Client Service service. - -After the service starts, if you log in locally on the computer and there are no errors, you should receive a request to encrypt the computer within one minute. If you do not receive a request, you should review the MBAM Admin logs for any error entries. - -### Computer does not have a TPM device, or the TPM device is not enabled in the BIOS - -Review the MBAM Admin event log. You will see an event entry that resembles the following in the MBAM Admin event log: - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 8/3/2013 12:31:10 PM - Event ID: 9 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: Mbamclient.contoso.com - Description: - The TPM hardware is missing. - TPM is needed to encrypt the operating system drive with any TPM protector. - -Open TPM Management (tpm.msc), and check whether the computer has a TPM device. If tpm.msc does not show a device, open Device Manager (devmgmt.msc), and check for a Trusted Platform Module under Security Devices. If you do not see a Trusted Platform Module device, this might be true for one of the following reasons: - -* Your system doesn't have a Trusted Platform Module (TPM/Security) device. - -* The TPM device is disabled in the BIOS. - -* TPM Device is enabled in the BIOS, but management of the TPM device from the operating system setting is disabled in the BIOS. - -* You aren't using a Microsoft driver for the TPM device. Review the devices that are listed in device manager to identify the Microsoft TPM device driver. - -If the TPM device is not using the C:\Windows\System32\tpm.sys driver, you should update the driver by selecting the C:\Windows\Inf\tpm.inf file. - -### Computer does not have a valid SYSTEM partition - -Review the MBAM Admin event log. You will see an event entry that resembles the following in the MBAM Admin event log: - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 8/3/2013 4:13:37 AM - Event ID: 8 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: BITTESTVM.xtremelabs.com - Description: - The system volume is missing. - SystemVolume is needed to encrypt the operating system drive. - -BitLocker requires a SYSTEM partition to enable encryption ([BitLocker Drive Encryption in Windows 7: Frequently Asked Questions](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/ee449438(v=ws.10)?redirectedfrom=MSDN#bkmk_partitions)). - -MBAM doesn't create the system partition automatically. You can use the BitLocker drive preparation utility (bdehdcfg.exe) to create the system partition and move the required startup files. - -For example, you can use the command **%windir%\system32\bdeHdCfg.exe -target default -size 300 –quiet** to prepare the drive silently before you deploy MBAM to encrypt the drives. This requires a restart. You can also script the action if this is required. The following document describes the BitLocker Drive Preparation Tool: - -[Description of the BitLocker Drive Preparation Tool](https://support.microsoft.com/help/933246) - -### Drives are not formatted to have a compatible file system - -See the [TechNet article for file system requirements for BitLocker](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/ee449438(v=ws.10)?redirectedfrom=MSDN#bkmk_hsrequirements). - -### Group Policy conflict - -You will see an event entry that resembles the following in the MBAM Admin event log: - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 7/25/2013 9:27:58 PM - Event ID: 22 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: Mbamclient.contoso.com - Description: - Detected Fixed Data Drive volume encryption policies conflict. - Check BitLocker and MBAM policies related to FDD drive protectors. - -Verify your Group Policy settings to make sure that you do not have a conflicting setting among the MBAM Group Policy settings. - -You should configure Group Policy by using the MDOP MBAM template and not the BitLocker Drive Encryption template. - -For example: - -Under Operating system drive encryption settings, you selected TPM as the protector, and you also selected **Allow enhanced PINs for startup**. These are conflicting settings because TPM-only protection doesn't require a PIN. Therefore, you should disable the enhanced PINs setting. - -### User may have requested an exemption - -If you enabled the Computer Configuration\Administrative Templates\Windows Components\MDOP MBAM (BitLocker Management)\Client Management\Configure user exemption policy Group Policy setting, users will be offered the option to request an exemption. - -By default, if the user requests an exemption, the exemption will be valid for 7 days, and the user will not receive prompts to encrypt during this period. (The default value can be increased or decreased during policy configuration.) After the exemption period is over, the user is prompted to encrypt. - -You will see the following entry in the MBAM Admin event log when a computer is under user exemption: - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 8/3/2013 3:06:40 PM - Event ID: 13 - Task Category: None - Level: Warning - Keywords: - User: SYSTEM - Computer: MBAMCLIENT.contoso.com - Description: - The user is exempt from encryption. - -If you want to manually override user exemption for a computer, follow these steps: - -1. Set the AllowUserExemption value to **0** under the following registry subkey:
    -**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement** - -2. Delete all the registry values under the following registry subkey except for **AgentVersion**, **EncodedComputerName**, and **Installed**:
    -**HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM** - - **Note** You must restart the MBAM agent for the changes to take effect. - -Be aware that after you apply Group Policy to the computer, these values may revert to their original settings. - -### WMI issue - -MBAM uses methods of the win32_encryptablevolume class to manage BitLocker. If this module is unregistered or corrupted, the MBAM client will not operate correctly, and you will see the following event entry in the MBAM Admin event log: - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 7/27/2013 11:18:51 PM - Event ID: 4 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: BITTEST.xtremelabs.com - Description: - An error occurred while sending encryption status data. - Error code: - 0x80041016 - Details: - NULL - -Additionally, you may notice that the Recovery and Hardware policies do not apply with Error Code 0x8007007e. This translates to "The specified module could not be found." - -To resolve this issue, you should reregister the **win32_encryptablevolume** class by using the following command: - -```cmd -mofcomp c:\Windows\System32\wbem\win32_encryptablevolume.mof -``` - -## Troubleshooting MBAM Agent communication issues - -This section contains troubleshooting information for the following issues that are related to MBAM agent communication: - -### Incorrect MBAM service URL - -If the value of MBAM Compliance Status Service or Recovery and Hardware Service is incorrect, you'll see an event entry that resembles the following in the MBAM Admin event log on the client computer: - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 8/3/2013 4:13:36 PM - Event ID: 4 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: Mbamclient.contoso.com - Description: - An error occurred while sending encryption status data. - Error code: - 0x803d0010 - Details: - The remote endpoint was not reachable. - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 8/3/2013 4:13:33 PM - Event ID: 18 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: Mbamclient.contoso.com - Description: - Unable to connect to the MBAM Recovery and Hardware service. - Error code: - 0x803d0010 - Details: - The remote endpoint was not reachable. - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 8/3/2013 4:20:32 PM - Event ID: 4 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: Mbamclient.contoso.com - Description: - An error occurred while sending encryption status data. - Error code: - 0x803d0020 - Details: - The endpoint address URL is invalid. - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 8/3/2013 4:20:32 PM - Event ID: 18 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: Mbamclient.contoso.com - Description: - Unable to connect to the MBAM Recovery and Hardware service. - Error code: - 0x803d0020 - Details: - The endpoint address URL is invalid. - -Verify the values of **KeyRecoveryServiceEndPoint** and **StatusReportingServiceEndpoint** under the following registry subkey on the client computer:
    -**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement** - -By default, the URL for KeyRecoveryServiceEndPoint (MBAM Recovery and Hardware service endpoint) is in the following format:
    -**http://\:\/MBAMRecoveryAndHardwareService/CoreService.svc** - -By default, the URL for StatusReportingServiceEndpoint (MBAM Status reporting service endpoint) is in the following format:
    -**http://\:\/MBAMComplianceStatusService/StatusReportingService.svc** - -> [!Note] -> There should be no spaces in the URL. - -If the service URL is incorrect, you should correct the service URL in the following Group Policy setting: - -**Computer configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Client Management** > **Configure MBAM Services** - -### Connectivity issue that affects the MBAM administration server - -The MBAM agent will be unable to post any updates to the database if connectivity issues exist between the client agent and the MBAM administration server. In this case, you will notice connectivity failure entries in the MBAM Admin event log on the client computer: - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 29-04-2014 18:21:22 - Event ID: 2 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: TESTLABS.CONTOSO.COM - Description: - An error occurred while applying MBAM policies. - Volume ID:\\?\Volume{871c5858-2467-4d0b-8c83-d68af8ce10e5}\ - Error code: - 0x803D0010 - Details: - The remote endpoint was not reachable. - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 29-04-2014 23:06:48 - Event ID: 2 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: TESTLABS.CONTOSO.COM - Description: - An error occurred while applying MBAM policies. - Volume ID:\\?\Volume{871c5858-2467-4d0b-8c83-d68af8ce10e5}\ - Error code: - 0x803D0006 - Details: - The operation did not complete within the time allotted. - - Log Name: Microsoft-Windows-MBAM/Admin - Source: Microsoft-Windows-MBAM - Date: 02-09-2013 02:02:04 - Event ID: 18 - Task Category: None - Level: Error - Keywords: - User: SYSTEM - Computer: TESTLABS.CONTOSO.COM - Description: - Unable to connect to the MBAM Recovery and Hardware service. - Error code: - 0x803D0010 - Details: - The remote endpoint was not reachable. - -Basic checks: - -* Verify basic connectivity by pinging the MBAM administration server by name and IP. Check whether you can connect to the MBAM administration website or service port by using telnet or portqry. - -* Verify that the IIS service is running on the MBAM administration and monitoring server and that the MBAM web service is listening on the same port that is configured on the MBAM client computer (`netstat –ano | find "portnumber"`). - -* Verify that the port number that is configured for the MBAM website is using IIS Manager (inetmgr). Make sure that the port number is the same as the port number on which the client is listening. Make sure that the port number is not shared by another application. For example, another application on the server should not be using the same port. - -* If there is a firewall, make sure that the port is open in the firewall or proxy server. - -* If the communication between client and server is secure, make sure that you are using a valid SSL certificate. - -* Verify network connectivity between the web server and the database server to which the data is sent for insertion. You can check database connectivity from the web server to the database server by using ODBC Data Source Administrator. Detailed SQL Server connection troubleshooting information is available in [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx). - -#### Troubleshooting the connectivity issue - -Make sure that the service URL that is configured on the client is correct. Copy the value of the URL for KeyRecoveryServiceEndPoint (**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**) from the registry, and open it in Internet Explorer. - -Similarly, copy the value of the URL for StatusReportingServiceEndpoint (**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**), and open it in Internet Explorer. - -> [!Note] -> If you cannot browse to the URL from the client computer, you should test basic network connectivity from the client to the server that is running IIS. See points 1, 2, 3, and 4 in the previous section. - -Additionally, review the Application logs on the administration and monitoring server for any errors. - -You can make a concurrent network trace between the client and the server, and review the trace to determine the cause of connection failure between the client agent and the MBAM administration server. - -> [!Note] -> If you can browse to the service URLs from the client computer and there are connectivity error entries in the MBAM admin event logs, this might be because of a connectivity failure between the administration server and the database server. - -If you can successfully browse to both service URLs, and there is connectivity between the client and the server that is running, IIS is working. However, there may be a problem in communication between the server that is running IIS and the database server. - -The MBAM services may be unable to connect to the database server because of a network issue or an incorrect database connection string setting. Review the Application logs on the administration and monitoring server. You might see errors entries or warnings from source ASP.NET 2.0.50727.0 that resemble the following log entry: - - Log Name: Application - Source: ASP.NET 2.0.50727.0 - Date: 7/11/2013 6:16:34 PM - Event ID: 1310 - Task Category: Web Event - Level: Warning - Keywords: Classic - User: N/A - Computer: MBAM2-Admin.contoso.com - Description: - Event code: 100001 - Event message: SQL error occurred - Event time: 7/11/2013 6:16:34 PM - Event time (UTC): 7/11/2013 12:46:34 PM - Event ID: 6615fb8eb9d54e778b933d5bb7ca91ed - Event sequence: 2 - Event occurrence: 1 - Event detail code: 0 - Application information: - Application domain: /LM/W3SVC/2/ROOT/MBAMAdministrationService-1-130180202570338699 - Trust level: Full - Application Virtual Path: /MBAMAdministrationService - Application Path: C:\inetpub\Microsoft BitLocker Management Solution\Administration Service\ - Machine name: MBAM2-ADMIN - - Process information: - Process ID: 1940 - Process name: w3wp.exe - Account name: NT AUTHORITY\NETWORK SERVICE - - Exception information: - Exception type: SqlException - Exception message: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server) - - Request information: - Request URL: - Request path: - User host address: - User: - Is authenticated: False - Authentication Type: - Thread account name: NT AUTHORITY\NETWORK SERVICE - - Thread information: - Thread ID: 7 - Thread account name: NT AUTHORITY\NETWORK SERVICE - Is impersonating: False - Stack trace: at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) - at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) - at System.Data.SqlClient.TdsParser.Connect(ServerInfo serverInfo, SqlInternalConnectionTds connHandler, Boolean ignoreSniOpenTimeout, Int64 timerExpire, Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, SqlConnection owningObject) - at System.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, Boolean ignoreSniOpenTimeout, Int64 timerExpire, SqlConnection owningObject) - at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart) - at System.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance) - at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance) - at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection) - at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options) - at System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject) - at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject) - at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) - at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) - at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) - at System.Data.SqlClient.SqlConnection.Open() - at System.Data.Linq.SqlClient.SqlConnectionManager.UseConnection(IConnectionUser user) - at System.Data.Linq.SqlClient.SqlProvider.get_IsSqlCe() - at System.Data.Linq.SqlClient.SqlProvider.InitializeProviderMode() - at System.Data.Linq.SqlClient.SqlProvider.System.Data.Linq.Provider.IProvider.Execute(Expression query) - at System.Data.Linq.DataContext.ExecuteMethodCall(Object instance, MethodInfo methodInfo, Object[] parameters) - at Microsoft.Mbam.Server.ServiceCommon.KeyRecoveryModelDataContext.GetRecoveryKeyIds(String partialRecoveryKeyId, String reason) - at Microsoft.Mbam.ApplicationSupportService.AdministrationService.GetRecoveryKeyIds(String partialRecoveryKeyId, String reasonCode) - - Custom event details: - Application: MBAMAdministrationService - Sql Server: - Database: MBAM Recovery and Hardware - Database: MBAM Compliance Status - Sql ErrorCode: 5 - Error Message: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server) - -#### Possible causes - -##### Cause 1 - -The administrator may have specified an invalid database instance name/database name during installation of administration and monitoring server components. - -You can verify and correct the database connection strings by using the IIS Management console. To do this, open IIS Manager, and browse to Microsoft BitLocker Administration and Monitoring. For each service that is listed on the left side, follow these steps to change the database connection strings: - -1. In **Features View**, double-select **Connection Strings**. - -2. On the **Connection Strings** page, select the connection string that you want to change. - -3. In the **Actions** pane, select **Edit**. - -4. In the **Edit Connection String** dialog box, change the properties that you want to change, and then select **OK**. - -##### Cause 2 - -SQL Server port blocked in firewall. Verify the port number to which SQL Server is configured to listen, and make sure that the port is open in the firewall between the administration server and database server. - -##### Cause 3 - -Incorrect SQL server TCP/IP bindings. Verify SQL TCP/IP bindings in SQL Server Configuration Manager on the database server. MBAM requires that the TCP/IP and Named Pipes protocols are enabled to connect to the database. - -##### Cause 4 - -The NT Authority\Network Service account or the MBAM Administration Server’s computer account doesn't have the required permissions to connect to the SQL database. - -During the installation of database components on the database server, the installer creates two local groups: MBAM Compliance Auditing DB Access and MBAM Recovery and Hardware DB Access. - -The NT Authority\Network Service account, the MBAM administration server’s computer account, and the user who installs the database components are automatically added to these groups. - -These groups are granted the required permissions on the database during the installation. All users who are part of this group automatically receive the required permissions on the database. - -The web service may not connect to the database server because of a permissions issue if one or more of the following conditions are true: - -* The groups that were mentioned earlier are removed from the local groups on the database server. - -* The NT Authority\Network Service account and the MBAM administration server’s computer account are not members of these groups. - -* These groups do not have the required permissions on the database. - -You will notice permissions-related errors in the Application logs on the MBAM administration and monitoring server if any of the previous conditions are true. In that case, you should manually add the NT Authority\Network Service account and MBAM administration server’s computer account and grant them a server-wide public role on the SQL database server that is using SQL Server Management Studio (https://msdn.microsoft.com/library/aa337562.aspx). - -#### Review the web service logs - -If no events are logged in the Application logs on the MBAM administration server, it’s time to review the web service logs (.svclog) of the MBAM web service that is hosted on the MBAM administration and monitoring server. You will have to use the Service Trace Viewer Tool (SvcTraceViewer.exe) https://msdn.microsoft.com/library/ms732023.aspx to view the log file. - -You should primarily investigate the service trace logs of RecoveryandHardwareService and ComplianceStatusService. By default, web service logs are located in the C:\inetpub\Microsoft BitLocker Management Solution\Logs folder. There, each service writes its .svclog file under its own folder. - -Review the activity in the service trace log for any error or warning entries. By default, error entries are highlighted in red. Select the error description on the right pane of the trace viewer to view detailed information about the error entry. The following is a sample error entry from the trace log: - - - - 15183 - 3 - 0 - 2 - - - - - - XXXXXXXXXXX - - AddUpdateVolume: While executing sql transaction for add volume to store exception occurred Key Recovery Data Store processing error: Violation of UNIQUE KEY constraint 'UniqueRecoveryKeyId'. Cannot insert duplicate key in object 'RecoveryAndHardwareCore.Keys'. The duplicate key value is (8637036e-b379-4798-bd9e-5a0b36296de3). - - - -## Re-installation or reconfiguration of MBAM infrastructure - -To re-install or reconfigure MBAM infrastructure, you must know the following things: - -* Application Pool account - -* MBAM Groups (Helpdesk, Advanced, Report Users Group) - -* MBAM Reports URL - -* SQL Server name and database names - -* MBAM ReadWrite and ReadOnly Accounts - -### Application Pool account - -To find the Application Pool account, log on to the MBAM Web Server, open **Internet Information Services (IIS) Manager**, and then select **Application Pools**: - -![application pools](images/troubleshooting-MBAM-installation-1.png) - -The Service Principal Name (SPN) must be set in this account. This setting is very important to the functionality of MBAM. - -### MBAM Groups (Helpdesk, Advanced, Report Users Group and Reports URL) - -![MBAM Groups](images/troubleshooting-MBAM-installation-2.png) - -This provides information such as Helpdesk Group, Advanced Helpdesk Group, Report Users group, and MBAM Reports URL. The MBAM Reports URL must be provided in the MBAM setup and should read as: http(s)://servername/ReportServer. - -### SQL Server name and database (DB) names - -To find the SQL Server names and instances hosting the MBAM DBs, log on to the MBAM Web (IIS) server and browse to the folowing registry subkey: - -**HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server\Web** - -![Regedit](images/troubleshooting-MBAM-installation-3.png) - -The highlighted portions are connection strings. These should have the SQL Server name, database names, and instances (if named). - -### MBAM ReadWrite and ReadOnly accounts - -This information will be in the SQL Server database, for which we already found the name from the web server. - -#### ReadWrite account - -1. Log in to the SQL Management Studio. - -2. Right-click **MBAM Recovery and Hardware**, select **Properties**, and then select **Permissions**. - -For example, The the lab account name is **MBAMWrite**. The Application Pool and ReadWrite accounts are set to be the same. - -![SQL DB](images/troubleshooting-MBAM-installation-4.png) - -![DB properties](images/troubleshooting-MBAM-installation-5.png) - -Browse to **Security** and then **Logins** in SQL Management Studio. Browse to the account shown in the previous screenshot. - -![SQL Security](images/troubleshooting-MBAM-installation-6.png) - -Right-click the accounts, go to **Properties User Mapping**, and locate the MBAM Recovery and Hardware database: - -![User Mapping](images/troubleshooting-MBAM-installation-7.png) - -#### ReadOnly account - -Open SQL Server Reporting Services Configuration Manager on the SSRS Server. Select **Report Manager URL**, and then browse the **URLs**: - -![Report Manager](images/troubleshooting-MBAM-installation-8.png) - -Select **Microsoft Bitlocker Administration and Monitoring**: - -![Bitlocker Administration and Monitoring](images/troubleshooting-MBAM-installation-9.png) - -Select **MaltaDatasource**: - -![DBs](images/troubleshooting-MBAM-installation-10.png) - -![MaltaDatasource](images/troubleshooting-MBAM-installation-11.png) - -MaltaDataSource should have the ReadOnly Account name and should be used in MBAM setup. - -## Reference - -For more information, see the following articles: - -[Deploying MBAM 2.5 in a standalone configuration](https://support.microsoft.com/help/3046555) - -[Microsoft BitLocker Administration and Monitoring 2.5](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) diff --git a/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md b/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md deleted file mode 100644 index 5f546b0f97..0000000000 --- a/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md +++ /dev/null @@ -1,388 +0,0 @@ ---- -title: Understanding MBAM 2.5 Stand-alone Reports -description: Understanding MBAM 2.5 Stand-alone Reports -author: dansimp -ms.assetid: 78b5aaf4-8257-4722-8eb9-e0de48db6a11 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding MBAM 2.5 Stand-alone Reports - - -This topic describes the reports that are available when you are running Microsoft BitLocker Administration and Monitoring (MBAM) in the Stand-alone topology. - -**Note** -If you are running MBAM with the Configuration Manager Integration topology, you generate reports from Configuration Manager rather than from MBAM. See [Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md) for more information about these reports. - - - -## Understanding the MBAM Stand-alone topology reports - - -MBAM provides three report types that you can use to monitor your organization for BitLocker compliance: - -- [Enterprise Compliance Report](#bkmk-enterprisecompliance) - -- [Computer Compliance Report](#bkmk-compliance) - -- [Recovery Audit Report](#bkmk-recovery) - -To access MBAM reports when you are running MBAM in the Stand-alone topology, open a web browser, and then open the Administration and Monitoring Website. Select **Reports** in the left menu bar. From the top menu bar, select the kind of report that you want to generate. For more information about generating these reports, see [Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md). - -### Enterprise Compliance Report - -Use this report type to collect information about overall BitLocker compliance in your organization. You can use filters to narrow your search results to learn more about the compliance state and error status of computers in your organization. - -**Enterprise Compliance Overview** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Managed Computers

    Number of computers that MBAM manages.

    % Compliant

    Percentage of compliant computers in the enterprise.

    % Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    % Exempt

    Percentage of computers exempt from the BitLocker encryption requirement.

    % Non-Exempt

    Percentage of computers not exempt from the BitLocker encryption requirement.

    Compliant

    Percentage of compliant computers in the enterprise.

    Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    Exempt

    Total computers that are exempt from the BitLocker encryption requirement.

    Non-Exempt

    Total computers that are not exempt from the BitLocker encryption requirement.

    - - - -**Enterprise Compliance Computer Details** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    User-specified DNS name that is managed by MBAM.

    Domain Name

    Fully qualified domain name where the client computer resides and is managed by MBAM.

    Compliance Status

    State of compliance for the computer, according to the policy specified for the computer. The states are Noncompliant and Compliant. See the following Enterprise Compliance Report Compliance States table for more information about how to interpret compliance states.

    Exemption

    Status that indicates whether this computer is exempt from the BitLocker policy.

    Compliance Status Details

    Error and status messages about the compliance state of the computer in accordance to the policy specified.

    Last Contact

    Date and time when the computer last contacted the server to report compliance status. The contact frequency is configurable. For more information, see the MBAM Group Policy settings.

    - - - -### Computer Compliance Report - -Use this report type to collect information that is specific to a computer or user. - -View this report by clicking the computer name in the Enterprise Compliance Report, or by typing the computer name in the Computer Compliance Report. This report shows detailed encryption information about each drive (operating system and fixed data drives) on a computer. It also indicates the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry. - -**Note** -Removable Data Volume encryption status is not shown in this report. - - - -**Computer Compliance Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    User-specified DNS computer name that is managed by MBAM.

    Domain Name

    Fully qualified domain name where the client computer resides and is managed by MBAM.

    Computer Type

    Type of computer. Valid types are Non-Portable and Portable.

    Operating System

    Operating system type found on the client computer that is managed by MBAM.

    Compliance Status

    Overall compliance status of the computer that is managed by MBAM. Valid states are Compliant and Noncompliant.

    -

    Notice that the compliance status per drive (see the following table) may indicate different compliance states. However, this field represents that compliance state, according to the specified policy.

    Policy Cipher Strength

    Cipher strength selected by the administrator during MBAM policy specification (for example, 128-bit with diffuser).

    Policy Operating System Drive

    Indicates if encryption is required for the operating system and shows the appropriate protector type.

    Policy-Fixed Data Drive

    Indicates if encryption is required for the fixed data drive.

    Policy Removable Data Drive

    Indicates if encryption is required for the removable drive.

    Device Users

    Known users on the computer that is managed by MBAM.

    Exemption

    Status that indicates whether this computer is exempt from the BitLocker policy.

    Manufacturer

    Computer manufacturer name, as it appears in the computer BIOS.

    Model

    Computer manufacturer model name, as it appears in the computer BIOS.

    Compliance Status Details

    Error and status messages about the compliance state of the computer, in accordance with the specified policy.

    Last Contact

    Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable. For more information, see the MBAM Group Policy settings.

    - - - -**Computer Compliance Report Drive Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Drive Letter

    Computer drive letter that was assigned to the particular drive by the user.

    Drive Type

    Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

    Cipher Strength

    Cipher strength selected by the administrator during MBAM policy specification.

    Protector Type

    Type of protector selected through the Group Policy setting used to encrypt an operating system or fixed data volume.

    Protector State

    Indicates that the computer being managed by MBAM has enabled the protector type that is specified in the policy. The valid states are ON or OFF.

    Encryption State

    Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

    Compliance Status

    State that indicates whether the drive is in accordance with the policy. States are Noncompliant and Compliant.

    Compliance Status Details

    Error and status messages of the compliance state of the computer, according to the specified policy.

    - - - -### Recovery Audit Report - -Use this report type to audit users who have requested access to BitLocker recovery keys. The report offers several filters based on the desired filtering criteria. You can filter on a specific type of user (a Help Desk user or an end user), whether the request failed or was successful, the specific type of key requested, and a date range during which the retrieval occurred. - -**Recovery Audit Report Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Request Date and Time

    Date and time that a key retrieval request was made by an end user or Help Desk user.

    Audit Request Source

    The site from which the request was initiated. This entry will have one of two values: Self-Service Portal or Helpdesk.

    Request Status

    Status of the request. Valid statuses are Successful (the key was retrieved), or Failed (the key was not retrieved).

    Helpdesk User

    Help Desk user who initiated the request for key retrieval.

    -
    -Note

    If an Advanced Helpdesk User recovers the key without specifying the end user, the End User field will be blank. A standard Helpdesk User must specify the end user, and that user will appear in this field.

    -

    A recovery via the Self-Service Portal will list the requesting end user both in this field and in the End User field.

    -
    -
    - -

    End User

    End user who initiated the request for key retrieval.

    Computer

    Computer name of the computer that was recovered.

    Key Type

    Type of key that was requested by the Help Desk user or the end user. The three types of keys that MBAM collects are:

    -
      -
    • Recovery Key Password (used to recover a computer in recovery mode)

    • -
    • Recovery Key ID (used to recover a computer in recovery mode on behalf of another user)

    • -
    • TPM Password Hash (used to recover a computer with a locked TPM)

    • -

    Reason Description

    Reason the specified key type was requested by the Help Desk user or the end user. The reasons are specified in the Drive Recovery and Manage TPM features of the Administration and Monitoring Website. The valid entries are user-entered text or one of the following reason codes:

    -
      -
    • Operating System Boot Order changed

    • -
    • BIOS Changed

    • -
    • Operating System files changed

    • -
    • Lost Startup key

    • -
    • Lost PIN

    • -
    • TPM Reset

    • -
    • Lost Passphrase

    • -
    • Lost Smartcard

    • -
    • Reset PIN lockout

    • -
    • Turn on TPM

    • -
    • Turn off TPM

    • -
    • Change TPM password

    • -
    • Clear TPM

    • -
    - - - -**Note** -Report results can be saved to a file by clicking the **Export** button on the **Reports** menu bar. - - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - -[Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md b/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md deleted file mode 100644 index 39cd813d57..0000000000 --- a/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel -description: Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel -author: dansimp -ms.assetid: f8a01cc2-0c77-48b9-8351-8194e80b0cf8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel - - -This topic describes the **BitLocker Encryption Options** and **BitLocker Drive Encryption** Control Panel items and explains the following: - -- How these items are created - -- Tasks they enable you to perform - -- **Manage BitLocker** “right-click” shortcut menu, when it is visible versus hidden, and how to set it to be visible by default - -## BitLocker Encryption Options and BitLocker Drive Encryption Control Panel items - - -The following table lists the tasks you can perform from each Control Panel item and describes how these items are created. - - ----- - - - - - - - - - - - - - - - - - - - -
    BitLocker Encryption Options (MBAM)BitLocker Drive Encryption (Windows)

    Tasks you can do

      -
    • Change your PIN or password

    • -
    • Check encryption status for a drive

    • -
    • Open the TPM Management console

    • -
    • Turn on BitLocker

    • -
      -
    • Suspend protection for a drive

    • -
    • Back up your recovery key

    • -
    • Change your PIN

    • -
    • Turn off BitLocker for a drive

    • -
    • Turn on BitLocker for a drive

    • -
    • Open the TPM Management console

    • -
    • Decrypt a drive (appears only if the MBAM Client is NOT installed)

    • -

    How the Control Panel item is created

    Created in Control Panel when you install the MBAM Client. This item cannot be hidden.

    -
    -Note

    This item appears in addition to, but does not replace, the default BitLocker Drive Encryption Control Panel item.

    -
    -
    - -

    Appears by default in Control Panel as part of the Windows operating system, but you can hide it.

    -

    To hide it, see Hiding the Default BitLocker Drive Encryption Item in Control Panel.

    - - - -## “Manage BitLocker” shortcut menu - - -The following table describes how the **Manage BitLocker** shortcut menu differs depending on whether the MBAM Client is installed. The term “shortcut menu” refers to options that appear when you right-click a drive in Windows Explorer. - - ----- - - - - - - - - - - - - - - - - - - - -
    When MBAM Client is installedWhen MBAM Client is not installed

    Visibility of shortcut menu

    The Manage BitLocker option is hidden.

    -

    To make the Manage BitLocker option visible on the shortcut menu, which displays the option to decrypt a drive, delete the following registry key:

    -
    HKEY_CLASSES_ROOT\Drive\Shell\manage-bde \REG_SZ LegacyDisable

    The Manage BitLocker option appears on the shortcut menu.

    What users can do

    With the shortcut hidden, users can open the BitLocker Drive Encryption Control Panel item, but the option to decrypt a drive is not available.

    With the shortcut visible, selecting the Manage BitLocker option opens the BitLocker Drive Encryption Control Panel item, which displays the option to decrypt a drive.

    - - - - -## Related topics - - -[Administering MBAM 2.5 Features](administering-mbam-25-features.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - diff --git a/mdop/mbam-v25/upgrade-mbam2.5-sp1.md b/mdop/mbam-v25/upgrade-mbam2.5-sp1.md deleted file mode 100644 index 153757ee67..0000000000 --- a/mdop/mbam-v25/upgrade-mbam2.5-sp1.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Upgrading from MBAM 2.5 to MBAM 2.5 SP1 Servicing Release Update -author: dansimp -ms.author: ksharma -manager: -audience: ITPro -ms.topic: article -ms.prod: w10 -manager: miaposto -ms.localizationpriority: Normal ---- - -# Upgrade from MBAM 2.5 to MBAM 2.5 SP1 Servicing Release Update - -This article provides step-by-step instructions to upgrade Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 to MBAM 2.5 Service Pack 1 (SP1) together with the [Microsoft Desktop Optimization Pack (MDOP) May 2019 servicing update](https://support.microsoft.com/help/4505175/may-2019-servicing-release-for-microsoft-desktop-optimization-pack) in a standalone configuration. - -In this guide, we will use a two-server configuration. One server will be a database server that's running Microsoft SQL Server 2016. This server will host the MBAM databases and reports. The other server will be a Windows Server 2012 R2 web server. This server will host "Administration and Monitoring" and "Self-Service Portal." - -## Prepare to upgrade MBAM 2.5 SP1 - -### Know the MBAM servers in your environment - -1. SQL Server Database Engine: Server that hosts the MBAM databases. -2. SQL Server Reporting Services: Server that hosts the MBAM reports. -3. Internet Information Services (IIS) web servers: Server that hosts MBAM Web Applications and MBAM services. -4. (Optional) Microsoft System Center Configuration Manager primary site server: The MBAM configuration application is run on this server to integrate MBAM reports with Configuration Manager. These reports are then merged with existing Configuration Manager reports on the Configuration Manager SQL Server Reporting Services (SSRS) instance. - -### Identify service accounts, groups, server name, and reports URL - -1. Identify the MBAM application pool service account that's used by IIS web servers to read and write data to MBAM databases. -2. Identify the groups that are used during the MBAM web features configuration and the reports web service URL. -3. Identify the SQL Server name and instance name. Watch this video to learn more. - - > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ANP1] - -4. Identify the SQL Server Reporting Services Account that's used for reading compliance data from the Compliance and Audit database. Watch this video to learn more. - - > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALdZ] - -## Upgrade the MBAM infrastructure to the latest version available - -MBAM Server infrastructure installation or upgrade is always performed in the order listed below: - -- SQL Server Database Engine: Databases -- SQL Server Reporting Services: Reports -- Web Server: Web Applications -- SCCM Server: SCCM Integrated Reports if applicable -- Clients: MBAM Agent or Client Update -- Group Policy Templates: Update the existing Group Policy with new templates and enable new settings on existing MBAM Group Policy - -> [!NOTE] -> We recommend that you create a full database backup of the MBAM databases before you run the upgrades. - -### Upgrade the MBAM SQL Server - -Watch this video to learn how to upgrade the MBAM SQL Server: - - > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALew] - -### Upgrade the MBAM Web Server - -Watch this video to learn how to upgrade the MBAM Web Server: - - > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALex] - -## More information - -For more information about known issues in MBAM 2.5 SP1, see [Release Notes for MBAM 2.5 SP1](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/release-notes-for-mbam-25-sp1). diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md b/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md deleted file mode 100644 index eb867b9ba1..0000000000 --- a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions -description: Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions -author: dansimp -ms.assetid: a9edb4b8-5d5e-42ab-8db6-619db2878e50 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions - - -This topic describes the process for upgrading the Microsoft BitLocker Administration and Monitoring (MBAM) Server and the MBAM Client from earlier versions of MBAM. - -**Note**   -You can upgrade directly to MBAM 2.5 or MBAM 2.5 SP1 from any previous version of MBAM. - - - -## Before you start the upgrade - - -Review the following information before you start the upgrade. - - ---- - - - - - - - - - - - - - - - - - - - - -
    What to know before you startDetails

    If you are installing the MBAM websites on one server and the web services on another server, you have to use Windows PowerShell cmdlets to configure them.

    The MBAM Server Configuration wizard does not support configuring the websites on one server and the web services on a different server.

    If you are upgrading to MBAM 2.5 or 2.5 SP1 from MBAM 2.0 or 2.0 SP1 in Windows Server 2008 R2:

    -

    The Administration and Monitoring Website and the Self-Service Portal will not work if you install the required .NET Framework 4.5 software after Internet Information Services (IIS) is already installed.

    -

    This issue occurs because ASP.NET cannot be registered correctly with IIS if the .NET Framework is installed after IIS has already been installed.

    To resolve this issue:

    -

    Run aspnet_regiis –i from the following location:

    -

    C:\windows\microsoft.net\Framework\v4.0.30319

    -

    For more information, see: ASP.NET IIS Registration Tool.

    Register an SPN on the application pool account if all of the following are true:

    -
      -
    • You are upgrading from a previous version of MBAM.

    • -
    • Currently, you are not running the MBAM websites in a load-balanced or distributed configuration, but you would like to do so when you upgrade to MBAM 2.5 or 2.5 SP1.

    • -

    For instructions, see Planning How to Secure the MBAM Websites.

    - ---- - - - - - - - - - - - - - - -

    What we recommend

    Register a service principal name (SPN) for the application pool account, even though you may already have registered SPNs for the machine account.

    Why we recommend it

    Registering an SPN on the application pool account is required to configure the websites in a load-balanced or distributed configuration.

    What happens if SPNs are already configured on a machine account?

    MBAM will use the SPNs that you have already registered, and you don’t need to configure additional SPNs, but you are not able to configure the websites in a load-balanced or distributed configuration.

    -

     

    - - - -## Steps to upgrade the MBAM Server infrastructure - - -Use the steps in the following sections to upgrade MBAM for the Stand-alone topology or the System Center Configuration Manager Integration topology. - -**To upgrade the MBAM Server infrastructure for Stand-alone topology** - -1. Uninstall previous versions of MBAM from **Programs and Features** and from web servers to make sure that information is not being written from MBAM clients to the MBAM infrastructure. For instructions, see [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md#bkmk-removeserverfeatures). - -2. Back up your databases. - -3. Uninstall previous versions of MBAM from SQL Server by using **Programs and Features**, including SQL Servers hosting the MBAM reports via SQL Server Reporting Services. Remove any remaining MBAM server temporary files or folders from the database server and reporting services. - - **Note**   - The databases will not be removed, and all compliance and recovery data is maintained in the database. - - - -4. Install and configure the MBAM 2.5 or 2.5 SP1 databases, reports, and web applications, in that order. The databases are upgraded in place. - -5. Update the Group Policy Objects (GPOs) using the MBAM 2.5 Templates to leverage the new features in MBAM, such as enforced encryption. If you do not update the GPOs and the MBAM client to MBAM 2.5, earlier versions of MBAM clients will continue to report against your current GPOs with reduced functionality. See [How to Get MDOP Group Policy (.admx) Templates](https://www.microsoft.com/download/details.aspx?id=41183) to download the latest ADMX templates. - - After you upgrade the MBAM Server infrastructure, the existing client computers continue to successfully report to the MBAM 2.5 or 2.5 SP1 Server, and recovery data continues to be stored. - -6. Install the latest MBAM 2.5 or 2.5 SP1 Client. Client computers do not need to be rebooted after the deployment. - -**To upgrade the MBAM infrastructure for System Center Configuration Manager Integration topology** - -1. Uninstall previous versions of MBAM from **Programs and Features** and from web servers to make sure that information is not being written from MBAM clients to the MBAM infrastructure. For instructions, see [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md#bkmk-removeserverfeatures). - -2. Back up your databases. - -3. Uninstall previous versions of MBAM from SQL Server by using **Programs and Features**, including SQL Servers hosting the MBAM reports via SQL Server Reporting Services. Remove any remaining MBAM server temporary files or folders from the database server and reporting services. - -4. Uninstall MBAM from the Configuration Manager server. - - **Note**   - The databases and the Configuration Manager objects (baseline, MBAM supported computers collection, and Reports) will not be removed, and all compliance and recovery data is maintained in the database. - - - -5. Update the .mof files. - -6. Install and configure the MBAM 2.5 or 2.5 SP1 databases, reports, web applications, and Configuration Manager integration, in that order. The databases and Configuration Manager objects are upgraded in place. - -7. Optionally, update the Group Policy Objects (GPOs), and edit the settings if you want to implement new features in MBAM, such as enforced encryption. If you do not update the GPOs, MBAM will continue to report against your current GPOs. See [How to Get MDOP Group Policy (.admx) Templates](https://docs.microsoft.com/microsoft-desktop-optimization-pack/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates) to download the latest ADMX templates. - - After you upgrade the MBAM Server infrastructure, the existing client computers continue to successfully report to the MBAM 2.5 or 2.5 SP1 Server, and recovery data continues to be stored. - -8. Install the latest MBAM 2.5 or 2.5 SP1 Client. Client computers do not need to be rebooted after the deployment. - -## Upgrade support for the MBAM Client - - -MBAM supports upgrades to the MBAM 2.5 Client from any earlier version of the MBAM Client. - -**Ways to install the MBAM Client:** - -- Upgrade the computers running MBAM Client all at once or gradually after you install the MBAM 2.5 Server infrastructure. - -- Install the MBAM Client through an electronic software distribution system or through tools such as Active Directory Domain Services or System Center Configuration Manager. - - - -## Related topics - - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md deleted file mode 100644 index 436bbbe48d..0000000000 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Upgrading to MBAM 2.5 SP1 from MBAM 2.5 -description: Upgrading to MBAM 2.5 SP1 from MBAM 2.5 -author: dansimp -ms.assetid: -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 2/16/2018 ---- - -# Upgrading to MBAM 2.5 SP1 from MBAM 2.5 -This topic describes the process for upgrading the Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 and the MBAM Client from 2.5 to MBAM 2.5 SP1. - -### Before you begin -#### Download the May 2019 servicing release -[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=58345) - -#### Verify the installation documentaion -Verify you have a current documentation of your MBAM environment, including all server names, database names, service accounts and their passwords. - -### Upgrade steps -#### Steps to upgrade the MBAM Database (SQL Server) -1. Using the MBAM Configurator; remove the Reports role from the SQL server, or wherever the SSRS database is hosted. Depending on your environment, this can be the same server or a separate one. - > [!NOTE] - > You will not see an option to remove the Databases; this is expected. -2. Install 2.5 SP1 (Located with MDOP - Microsoft Desktop Optimization Pack 2015 from the Volume Licensing Service Center site: -3. Do not configure it at this time  -4. Using the MBAM Configurator; re-add the Reports role -5. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server -6. At the end, you will be warned that the DBs already exist and weren’t created, but this is expected -7. This process updates the existing databases to the current version being installed. - -#### Steps to upgrade the MBAM Server (Running MBAM and IIS) -1. Using the MBAM Configurator; remove the Admin and Self Service Portals from the IIS server -2. Install MBAM 2.5 SP1 -3. Do not configure it at this time   -4. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server  -5. Open an elevated command prompt, type **IISRESET**, and hit Enter. - -#### Steps to upgrade the MBAM Clients/Endpoints -1. Uninstall the 2.5 Agent from client endpoints -2. Install the 2.5 SP1 Agent on the client endpoints -3. Push out the May 2019 Rollup Client update to clients running the 2.5 SP1 Agent  -4. There is no need to uninstall the existing client prior to installing the May 2019 Rollup.   diff --git a/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md b/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md deleted file mode 100644 index 33509cf80e..0000000000 --- a/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Using Windows PowerShell to Administer MBAM 2.5 -description: Using Windows PowerShell to Administer MBAM 2.5 -author: dansimp -ms.assetid: 64668e76-2cba-433d-8d2d-50df0a4b2997 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Using Windows PowerShell to Administer MBAM 2.5 - - -This topic describes Windows PowerShell cmdlets for Microsoft BitLocker Administration and Monitoring (MBAM) that relate to recovering computers or drives when users get locked out. - -For cmdlets that you use to configure MBAM Server features, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md). - -## Cmdlets for recovering computers or drives that are managed by MBAM - - -Use the following Windows PowerShell cmdlets to recover computers or drives that are managed by MBAM. - - ---- - - - - - - - - - - - - - - - - -
    NameDescription

    Get-MbamBitLockerRecoveryKey

    Requests an MBAM recovery key that enables users to unlock a computer or encrypted drive.

    Get-MbamTPMOwnerPassword

    Provides users with a TPM owner password that they can use to unlock a Trusted Platform Module (TPM) when the TPM has locked them out and will no longer accept their PIN.

    - - - -## MBAM cmdlet Help - - -Windows PowerShell Help for MBAM cmdlets is available in the following formats: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows PowerShell Help formatMore information

    At a Windows PowerShell command prompt, type Get-Help <cmdlet>

    To upload the latest Windows PowerShell cmdlets, follow the instructions in Configuring MBAM 2.5 Server Features by Using Windows PowerShell

    On TechNet as webpages

    https://go.microsoft.com/fwlink/?LinkId=393498

    On the Download Center as a Word .docx file

    https://go.microsoft.com/fwlink/?LinkId=393497

    On the Download Center as a .pdf file

    https://go.microsoft.com/fwlink/?LinkId=393499

    - - - - - -## Related topics - - -[Administering MBAM 2.5 Features](administering-mbam-25-features.md) - -[Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md b/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md deleted file mode 100644 index 76b918713f..0000000000 --- a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md +++ /dev/null @@ -1,192 +0,0 @@ ---- -title: Validating the MBAM 2.5 Server Feature Configuration -description: Validating the MBAM 2.5 Server Feature Configuration -author: dansimp -ms.assetid: f4983a33-ce18-4186-a471-dd6415940504 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Validating the MBAM 2.5 Server Feature Configuration - - -When you finish the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Server feature deployment, we recommend that you validate the deployment to ensure that all features have been successfully configured. Use the procedure that matches the topology (Stand-alone or System Center Configuration Manager Integration) that you deployed. - -## Validating the MBAM Server deployment with the Stand-alone topology - - -Use the following steps to validate your MBAM Server deployment with the Stand-alone topology. - -**To validate a Stand-alone MBAM Server deployment** - -1. On each server where an MBAM feature is deployed, click **Control Panel** > **Programs** > **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list. - - **Note** - To do the validation, you must use a domain account that has local computer administrative credentials on each server. - - - -2. On the server where the Recovery Database is configured, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is configured. - -3. On the server where the Compliance and Audit Database is configured, open SQL Server Management Studio and verify that the **MBAM Compliance Status Database** is configured. - -4. On the server where the Reports feature is configured, open a web browser with administrative credentials and browse to the "Home" of the SQL Server Reporting Services site. - - The default Home location of a SQL Server Reporting Services site instance is at: - - http(s)://< *MBAMReportsServerName*>:<*port*>/Reports.aspx - - To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that you specified during setup. - -5. Confirm that a reports folder named **Microsoft BitLocker Administration and Monitoring** contains a data source called **MaltaDataSource** as well as the language folders. The data source contains folders with names that represent languages (for example, en-us). The reports are in the language folders. - - **Note** - If SQL Server Reporting Services (SSRS) was configured as a named instance, the URL should resemble the following: http(s)://< *MBAMReportsServerName*>:<*port*>/Reports\_<*SSRSInstanceName*> - - - -~~~ -**Note** -If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring Website (also known as Help Desk) and select a report, the following message appears: "Only Secure Content is Displayed." To show the report, click **Show All Content**. -~~~ - - - -6. On the server where the Administration and Monitoring Website feature is configured, run **Server Manager**, browse to **Roles**, and then select **Web Server (IIS)** > **Internet Information Services (IIS) Manager**. - -7. In **Connections**, browse to *<computer name>* and select **Sites** > **Microsoft BitLocker Administration and Monitoring**. Verify that the following are listed: - - - **MBAMAdministrationService** - - - **MBAMComplianceStatusService** - - - **MBAMRecoveryAndHardwareService** - -8. On the server where the Administration and Monitoring Website and Self-Service Portal are configured, open a web browser with administrative credentials. - -9. Browse to the following websites to verify that they load successfully: - - - https(s)://<*MBAMAdministrationServerName*>:<*port*>/HelpDesk/ - confirm each of the links for navigation and reports - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/SelfService/ - - **Note** - It is assumed that you configured the server features on the default port without network encryption. If you configured the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example: - - http(s)://< *host name*>:<*port*>/HelpDesk/ - - http(s)://< *host name*>:<*port*>/<*virtualdirectory*>/ - - If the server features were configured with network encryption, change http:// to https://. - - - -10. Browse to the following web services to verify that they load successfully. A page opens to indicate that the service is running, but the page does not display any metadata. - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMAdministrationService/AdministrationService.svc - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMUserSupportService/UserSupportService.svc - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMComplianceStatusService/StatusReportingService.svc - - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMRecoveryAndHardwareService/CoreService.svc - -## Validating the MBAM Server deployment with the Configuration Manager Integration topology - - -Use the following steps to validate your MBAM deployment with the Configuration Manager Integration topology. Complete the validation steps that match the version of Configuration Manager that you are using. - -### Validating the MBAM Server deployment with System Center 2012 Configuration Manager - -Use these steps to validate your MBAM Server deployment when you are using MBAM with System Center 2012 Configuration Manager. - -**To validate a Configuration Manager Integration MBAM Server deployment – System Center 2012 Configuration Manager** - -1. On the server where System Center 2012 Configuration Manager is deployed, open **Programs and Features** in **Control Panel**, and verify that **Microsoft BitLocker Administration and Monitoring** appears. - - **Note** - To validate the configuration, you must use a domain account that has local computer administrative credentials on each server. - - - -2. In the Configuration Manager console, click the **Assets and Compliance** workspace > **Device Collections**, and confirm that a new collection called **MBAM Supported Computers** is displayed. - -3. In the Configuration Manager console, click the **Monitoring** workspace > **Reporting** > **Reports** > **MBAM**. - -4. Verify that the **MBAM** folder contains subfolders, with names that represent different languages, and that the following reports are listed in each language subfolder: - - - BitLocker Computer Compliance - - - BitLocker Enterprise Compliance Dashboard - - - BitLocker Enterprise Compliance Details - - - BitLocker Enterprise Compliance Summary - -5. In the Configuration Manager console, click the **Assets and Compliance** workspace > **Compliance Settings** > **Configuration Baselines**, and confirm that the configuration baseline **BitLocker Protection** is listed. - -6. In the Configuration Manager console, click the **Assets and Compliance** workspace > **Compliance Settings** > **Configuration Items**, and confirm that the following new configuration items are displayed: - - - BitLocker Fixed Data Drives Protection - - - BitLocker Operating System Drive Protection - -### Validating the MBAM Server deployment with Configuration Manager 2007 - -Use these steps to validate your MBAM Server deployment when you are using MBAM with Configuration Manager 2007. - -**To validate a Configuration Manager Integration MBAM Server deployment – Configuration Manager 2007** - -1. On the server where Configuration Manager 2007 is deployed, open **Programs and Features** on **Control Panel** , and verify that **Microsoft BitLocker Administration and Monitoring** appears. - - **Note** - To validate the configuration, you must use a domain account that has local computer administrative credentials on each server. - - - -2. In the Configuration Manager console, click **Site Database <SiteCode> - <ServerName>, <SiteName>), Computer Management**, and confirm that a new collection called **MBAM Supported Computers** is displayed. - -3. In the Configuration Manager console, click **Reporting** > **Reporting Services** > **\\\\<ServerName>** > **Report Folders** > **MBAM**. - - Verify that the **MBAM** folder contains subfolders, with names that represent different languages, and that the following reports are listed in each language subfolder: - - - BitLocker Computer Compliance - - - BitLocker Enterprise Compliance Dashboard - - - BitLocker Enterprise Compliance Details - - - BitLocker Enterprise Compliance Summary - -4. In the Configuration Manager console, click **Desired Configuration Management** > **Configuration Baselines**, and confirm that the configuration baseline **BitLocker Protection** is listed. - -5. In the Configuration Manager console, click **Desired Configuration Management** > **Configuration Items**, and confirm that the following new configuration items are displayed: - - - BitLocker Fixed Data Drives Protection - - - BitLocker Operating System Drive Protection - - - -## Related topics - - -[Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md) - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - - - - diff --git a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md deleted file mode 100644 index 66de3b12f9..0000000000 --- a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md +++ /dev/null @@ -1,493 +0,0 @@ ---- -title: Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology -description: Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology -author: dansimp -ms.assetid: 60d11b2f-3a76-4023-8da4-f89e9f35b790 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology - - -This topic describes the reports that are available when you configure Microsoft BitLocker Administration and Monitoring (MBAM) with the Configuration Manager Integration topology. The reports show BitLocker compliance for the enterprise and for individual computers and devices that MBAM manages. The reports provide tabular information and charts, and they have filters that let you view data from different perspectives. - -In the Configuration Manager Integration topology, you view reports from Configuration Manager rather than from the Administration and Monitoring Website, with the exception of the **Recovery Audit Report**, which you continue to view from the Administration and Monitoring Website. - -For information about MBAM reports for the Stand-alone topology, see [Viewing MBAM 2.5 Reports for the Stand-alone Topology](viewing-mbam-25-reports-for-the-stand-alone-topology.md). - -## Accessing reports in Configuration Manager - - -To access the Reports feature in Configuration Manager: - - ---- - - - - - - - - - - - - - - - - -
    Version of Configuration ManagerHow to view the reports

    System Center 2012 Configuration Manager

      -
    1. In the left pane, select the Monitoring workspace.

    2. -
    3. In the tree, expand Overview > Reporting > Reports > MBAM.

    4. -
    5. Select the folder that represents the language in which you want to view reports, and then select the report from the right pane.

    6. -

    Configuration Manager 2007

      -
    1. In the left pane, expand Computer Management > Reporting > Reporting Services > <server name> > Report folders > MBAM.

    2. -
    3. Select the folder that represents the language in which you want to view reports, and then select the report from the right pane.

    4. -
    - - - -## Description of reports in Configuration Manager - - -There are a few minor differences in the reports for the Configuration Manager Integration topology and the Stand-alone topology. The following sections describe the data in the MBAM reports for the Configuration Manager Integration topology: - -- [BitLocker Enterprise Compliance Dashboard](#bkmk-dashboard) - -- [BitLocker Enterprise Compliance Details](#bkmk-compliancedetails) - -- [BitLocker Enterprise Compliance Summary](#bkmk-compliancesummary) - -- [BitLocker Computer Compliance Report](#bkmk-compliancereport) - -### BitLocker Enterprise Compliance Dashboard - -The BitLocker Enterprise Compliance Dashboard provides the following graphs, which show BitLocker compliance status across the enterprise: - -- Compliance Status Distribution - -- Non Compliant Errors Distribution - -- Compliance Status Distribution by Drive Type - -**Compliance Status Distribution** - -This pie chart shows compliance status for computers within the enterprise. It also shows the percentage of computers, compared to the total number of computers in the selected collection, that has that compliance status. The actual number of computers with each status is also shown. The pie chart shows the following compliance statuses: - -- Compliant - -- Non Compliant - -- User Exempt - -- Temporary User Exempt - -- Policy Not Enforced - -- Unknown. These computers reported a status error, or they are part of the collection, but have never reported their compliance status. The lack of a compliance status could occur if the computer is disconnected from the organization. - -**Non Compliant Errors Distribution** - -This pie chart shows the categories of computers in the enterprise that are not compliant with the BitLocker Drive Encryption policy, and shows the number of computers in each category. Each category percentage is calculated from the total number of non-compliant computers in the collection. - -- User postponed encryption - -- Unable to find compatible TPM - -- System partition not available or large enough - -- Policy conflict - -- Waiting for TPM auto provisioning - -- An unknown error has occurred - -- No information. These computers do not have the MBAM Client installed, or they have the MBAM Client installed but not activated (for example, the service is not working). - -**Compliance Status Distribution by Drive Type** - -This bar chart shows the current BitLocker compliance status by drive type. The statuses are **Compliant** and **Non Compliant**. Bars are shown for fixed data drives and operating system drives. Computers that do not have a fixed data drive are included and show a value only in the **Operating System Drive** bar. The chart does not include users who have been granted an exemption from the BitLocker Drive Encryption policy or the No Policy category. - -### BitLocker Enterprise Compliance Details - -This report shows information about the overall BitLocker compliance across your enterprise for the collection of computers that is targeted for BitLocker use. - -**BitLocker Enterprise Compliance Details Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Managed Computers

    Number of computers that MBAM manages.

    % Compliant

    Percentage of compliant computers in the enterprise.

    % Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    % Unknown Compliance

    Percentage of computers with a compliance state that is not known.

    % Exempt

    Percentage of computers exempt from the BitLocker encryption requirement.

    % Non-Exempt

    Percentage of computers not exempt from the BitLocker encryption requirement.

    Compliant

    Percentage of compliant computers in the enterprise.

    Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    Unknown Compliance

    Percentage of computers with a compliance state that is not known.

    Exempt

    Total computers that are exempt from the BitLocker encryption requirement.

    Non-Exempt

    Total computers that are not exempt from the BitLocker encryption requirement.

    - - - -**BitLocker Enterprise Compliance Details States** - - ----- - - - - - - - - - - - - - - - - - - - -
    Compliance StatusExemptionDescription

    Noncompliant

    Not exempt

    The computer is noncompliant, according to the specified policy.

    Compliant

    Not exempt

    The computer is compliant in accordance with the specified policy.

    - - - -### BitLocker Enterprise Compliance Summary - -Use this report type to show information about the overall BitLocker compliance across your enterprise and to show the compliance for individual computers that are in the collection of computers that is targeted for BitLocker use. - -**BitLocker Enterprise Compliance Summary Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Managed Computers

    Number of computers that MBAM manages.

    % Compliant

    Percentage of compliant computers in the enterprise.

    % Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    % Unknown Compliance

    Percentage of computers with a compliance state that is not known.

    % Exempt

    Percentage of computers exempt from the BitLocker encryption requirement.

    % Non-Exempt

    Percentage of computers not exempt from the BitLocker encryption requirement.

    Compliant

    Percentage of compliant computers in the enterprise.

    Non-Compliant

    Percentage of non-compliant computers in the enterprise.

    Unknown Compliance

    Percentage of computers with a compliance state that is not known.

    Exempt

    Total computers that are exempt from the BitLocker encryption requirement.

    Non-Exempt

    Total computers that are not exempt from the BitLocker encryption requirement.

    - - - -**BitLocker Enterprise Compliance Summary Computer Details** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    User-specified DNS computer name that is being managed by MBAM.

    Domain Name

    Fully qualified domain name, where the client computer resides and is managed by MBAM.

    Compliance Status

    Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the table that follows) may indicate different compliance states. However, this field represents that compliance state, in accordance with the policy specified.

    Exemption

    Status that indicates whether the user is exempt or non-exempt from the BitLocker policy.

    Device Users

    User of the device.

    Compliance Status Details

    Error and status messages about the compliance state of the computer in accordance with the policy specified.

    Last Contact

    Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable through the Group Policy settings.

    - - - -### BitLocker Computer Compliance Report - -Use this report type to collect information that is specific to a computer. The BitLocker Computer Compliance Report provides detailed encryption information about each drive on a computer (operating system and fixed data drives). It also provides an indication of the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry. - -**Note**   -The Removable Data Volume encryption status is not shown in this report. - - - -**BitLocker Computer Compliance Report: Computer Details Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Computer Name

    User-specified DNS computer name that is being managed by MBAM.

    Domain Name

    Fully qualified domain name, where the client computer resides and is managed by MBAM.

    Computer Type

    Type of computer. Valid types are Non-Portable and Portable.

    Operating System

    Operating System type found on the MBAM managed client computer.

    Overall Compliance

    Overall compliance status of the computer managed by MBAM. Valid states are Compliant and Noncompliant. Notice that the compliance status per drive (see the table that follows) may indicate different compliance states. However, this field represents that compliance state in accordance with the policy specified.

    Operating System Compliance

    Compliance status of the operating system that is managed by MBAM. Valid states are Compliant and Noncompliant.

    Fixed Data Drive Compliance

    Compliance status of the fixed data drive that is managed by MBAM. Valid states are Compliant and Noncompliant.

    Last Update Date

    Date and time that the computer last contacted the server to report compliance status. The contact frequency is configurable through the Group Policy settings.

    Exemption

    Status that indicates whether the user is exempt or non-exempt from the BitLocker policy.

    Exempted User

    User who is exempt from the BitLocker policy.

    Exemption Date

    Date on which the exemption was granted.

    Compliance Status Details

    Error and status messages about the compliance state of the computer in accordance with the policy specified.

    Policy Cipher Strength

    Cipher strength selected by the Administrator during the MBAM policy specification (for example, 128-bit with diffuser).

    Policy: Operating System Drive

    Indicates if encryption is required for the operating system and the appropriate protector type.

    Policy: Fixed Data Drive

    Indicates if encryption is required for the fixed data drive.

    Manufacturer

    Computer manufacturer name as it appears in the computer BIOS.

    Model

    Computer manufacturer model name as it appears in the computer BIOS.

    Device Users

    Known users on the computer that is being managed by MBAM.

    - - - -**BitLocker Computer Compliance Report: Computer Volume Fields** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Column NameDescription

    Drive Letter

    Computer drive letter that was assigned to the particular drive by the user.

    Drive Type

    Type of drive. Valid values are Operating System Drive and Fixed Data Drive. These are physical drives rather than logical volumes.

    Cipher Strength

    Cipher strength selected by the Administrator during MBAM policy specification.

    Protector Types

    Type of protector selected through the policy used to encrypt an operating system or fixed data drive. The valid protector types for an operating system are TPM or TPM+PIN. The valid protector type for a fixed data drive is a password.

    Protector State

    Indicates that the computer being managed by MBAM has enabled the protector type specified in the policy. The valid states are ON or OFF.

    Encryption State

    Encryption state of the drive. Valid states are Encrypted, Not Encrypted, and Encrypting.

    - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).  - - - - - diff --git a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md deleted file mode 100644 index 9de3997194..0000000000 --- a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Viewing MBAM 2.5 Reports for the Stand-alone Topology -description: Viewing MBAM 2.5 Reports for the Stand-alone Topology -author: dansimp -ms.assetid: 50e93c3a-baf1-4378-8fc0-74dd65d76306 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, security -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing MBAM 2.5 Reports for the Stand-alone Topology - - -The Microsoft BitLocker Administration and Monitoring (MBAM) Stand-alone topology provides reports that you use to monitor BitLocker usage and compliance. MBAM reports key recovery activity and the compliance status of the computers and devices that it manages across your enterprise. - -See the following topics for information about Stand-alone reports: - - ---- - - - - - - - - - - - - - - - - -
    Report informationLink to detailed information

    Report descriptions - MBAM Stand-alone topology

    Understanding MBAM 2.5 Stand-alone Reports

    Instructions for generating reports - MBAM Stand-alone topology

    Generating MBAM 2.5 Stand-alone Reports

    - - - -**Note**   -If you are using the Configuration Manager Integration topology, most reports are generated from Configuration Manager rather than from MBAM. See [Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md). - - - - -## Related topics - - -[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) - - - - - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - - - diff --git a/mdop/medv-v1/TOC.md b/mdop/medv-v1/TOC.md deleted file mode 100644 index c6dd794c5c..0000000000 --- a/mdop/medv-v1/TOC.md +++ /dev/null @@ -1,87 +0,0 @@ -# [Microsoft Enterprise Desktop Virtualization 1](index.md) -## [About This Guide](about-this-guidemedv.md) -## [Getting Started with MED-V](getting-started-with-med-v.md) -### [Overview of MED-V](overview-of-med-v.md) -### [High-Level Architecture](high-level-architecturemedv.md) -### [Key Scenarios for Using MED-V](key-scenarios-for-using-med-v.md) -### [About MED-V 1.0](about-med-v-10.md) -#### [MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md) -#### [MED-V 1.0 Installation Checklist](med-v-10-installation-checklist.md) -#### [MED-V 1.0 Release Notes](med-v-10-release-notesmedv-10.md) -### [About MED-V 1.0 SP1](about-med-v-10-sp1.md) -#### [MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) -#### [MED-V 1.0 SP1 Upgrade Checklist](med-v-10-sp1-upgrade-checklistmedv-10-sp1.md) -#### [MED-V 1.0 SP1 and SP2 Release Notes](med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md) -## [MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md) -### [Define the Project Scope](define-the-project-scope.md) -### [Identify the Number of MED-V Instances](identify-the-number-of-med-v-instances.md) -### [Design the MED-V Server Infrastructure](design-the-med-v-server-infrastructure.md) -### [Design the MED-V Image Repositories](design-the-med-v-image-repositories.md) -## [MED-V Deployment and Configuration](med-v-deployment-and-configuration.md) -### [MED-V Installation Prerequisites](med-v-installation-prerequisites.md) -### [Supported Configurations](supported-configurationsmedv-orientation.md) -#### [MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md) -#### [MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) -### [Installation and Upgrade Checklists](installation-and-upgrade-checklists.md) -#### [MED-V 1.0 Installation Checklist](med-v-10-installation-checklist.md) -#### [MED-V 1.0 SP1 Upgrade Checklist](med-v-10-sp1-upgrade-checklistmedv-10-sp1.md) -### [Installing and Configuring MED-V Components](installing-and-configuring-med-v-components.md) -#### [How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md) -#### [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) -#### [How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) -#### [How to Uninstall MED-V Components](how-to-uninstall-med-v-componentsmedvv2.md) -### [Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) -### [Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) -### [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md) -#### [How to Apply General Settings to a MED-V Workspace](how-to-apply-general-settings-to-a-med-v-workspace.md) -#### [How to Apply Virtual Machine Settings to a MED-V Workspace](how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md) -#### [How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md) -#### [How to Configure Published Applications](how-to-configure-published-applicationsmedvv2.md) -#### [How to Configure Web Settings for a MED-V Workspace](how-to-configure-web-settings-for-a-med-v-workspace.md) -#### [How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md) -##### [How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md) -##### [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md) -##### [Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md) -#### [How to Apply Network Settings to a MED-V Workspace](how-to-apply-network-settings-to-a-med-v-workspace.md) -#### [How to Apply Performance Settings to a MED-V Workspace](how-to-apply-performance-settings-to-a-med-v-workspace.md) -#### [How to Import and Export a Policy](how-to-import-and-export-a-policy.md) -### [Configuring MED-V for Remote Networks](configuring-med-v-for-remote-networks.md) -### [Configuring MED-V Server for Cluster Mode](configuring-med-v-server-for-cluster-mode.md) -## [MED-V Operations](med-v-operations.md) -### [Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) -### [Creating a MED-V Image](creating-a-med-v-image.md) -#### [How to Create and Test a MED-V Image](how-to-create-and-test-a-med-v-image.md) -#### [How to Pack a MED-V Image](how-to-pack-a-med-v-image.md) -#### [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) -#### [How to Localize a MED-V Image](how-to-localize-a-med-v-image.md) -#### [How to Update a MED-V Image](how-to-update-a-med-v-image.md) -#### [How to Delete a MED-V Image](how-to-delete-a-med-v-image.md) -### [Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md) -#### [How to Install MED-V Client](how-to-install-med-v-clientesds.md) -#### [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imageesds.md) -### [Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md) -#### [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md) -#### [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md) -#### [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imagedeployment-package.md) -### [Updating a MED-V Workspace Image](updating-a-med-v-workspace-image.md) -### [MED-V Client Operations](med-v-client-operations.md) -#### [How to Start and Exit the MED-V Client](how-to-start-and-exit-the-med-v-client.md) -#### [How to Start, Stop, and Restart a MED-V Workspace](how-to-start-stop-and-restart-a-med-v-workspace.md) -#### [How to View MED-V Settings and General Information](how-to-view-med-v-settings-and-general-information.md) -#### [How to Lock and Unlock a Workspace](how-to-lock-and-unlock-a-workspace.md) -#### [MED-V Client Tools](med-v-client-toolsv2.md) -## [Troubleshooting MED-V](troubleshooting-med-v.md) -## [Technical Reference](technical-referencemedv-10-sp1.md) -### [MED-V Reporting](med-v-reporting.md) -#### [How to Generate Reports](how-to-generate-reports-medvv2.md) -#### [How to Work with Reports](how-to-work-with-reports.md) -### [MED-V Trim Transfer Technology](med-v-trim-transfer-technology-medvv2.md) -### [How to Back Up and Restore a MED-V Server](how-to-back-up-and-restore-a-med-v-server.md) -### [How to Share Folders Between the Host and the MED-V Workspace](how-to-share-folders-between-the-host-and-the-med-v-workspace.md) -### [How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md) -### [How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md) -### [How to Edit a Published Application with Advanced Settings](how-to-edit-a-published-application-with-advanced-settings.md) -### [How to Set Up Script Actions](how-to-set-up-script-actions.md) -### [Client Installation Command Line Reference](client-installation-command-line-reference.md) -### [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md) - diff --git a/mdop/medv-v1/about-med-v-10-sp1.md b/mdop/medv-v1/about-med-v-10-sp1.md deleted file mode 100644 index f9d3fc4573..0000000000 --- a/mdop/medv-v1/about-med-v-10-sp1.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: About MED-V 1.0 SP1 -description: About MED-V 1.0 SP1 -author: dansimp -ms.assetid: 4c16e935-46c4-49c3-9e53-c60404d5da0c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About MED-V 1.0 SP1 - - -Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 Service Pack 1 (SP1) provides support for Windows 7 and Windows Server 2008 R2. - -The topics in this section provide information relating specifically to MED-V 1.0 SP1. - -## In This Section - - -[MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) -Delineates the supported configurations for MED-V 1.0 SP1. - -[MED-V 1.0 SP1 Upgrade Checklist](med-v-10-sp1-upgrade-checklistmedv-10-sp1.md) -Provides a step-by-step procedure for upgrading from MED-V 1.0 to MED-V 1.0 SP1. - -[MED-V 1.0 SP1 and SP2 Release Notes](med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md) -Provides known issues specific to MED-V 1.0 SP1. - -## Related topics - - -[MED-V 1.0 Release Notes](med-v-10-release-notesmedv-10.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/about-med-v-10.md b/mdop/medv-v1/about-med-v-10.md deleted file mode 100644 index 8a99314de9..0000000000 --- a/mdop/medv-v1/about-med-v-10.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: About MED-V 1.0 -description: About MED-V 1.0 -author: dansimp -ms.assetid: 89651022-a2ba-4d8a-a3ff-68539ea7a235 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About MED-V 1.0 - - -## In This Section - - -This section provides information related specifically to MED-V 1.0 and includes the following topics: - -[MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md) -Delineates the supported configurations for MED-V 1.0. - -[MED-V 1.0 Installation Checklist](med-v-10-installation-checklist.md) -Provides a list of all the steps required for installing MED-V 1.0. - -[MED-V 1.0 Release Notes](med-v-10-release-notesmedv-10.md) -Provides a list of known issues with MED-V. - -## Related topics - - -[MED-V 1.0 SP1 and SP2 Release Notes](med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/about-this-guidemedv.md b/mdop/medv-v1/about-this-guidemedv.md deleted file mode 100644 index cf20d13c06..0000000000 --- a/mdop/medv-v1/about-this-guidemedv.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: About This Guide -description: About This Guide -author: dansimp -ms.assetid: 17d8f150-226e-45f8-87e3-f425a77243e4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About This Guide - - -This Planning, Deployment, and Operations guide for Microsoft Enterprise Desktop Virtualization (MED-V) provides background information about MED-V, installing MED-V, and how it works and explains how to correctly use the product. The guide includes the following: - -- System requirements and supported platforms - -- Environmental prerequisites and considerations - -- Step-by-step instructions for installing MED-V server, management, and client - -- Step-by-step instructions for configuring MED-V image, workspace, and policy - -- Step-by-step instructions for deploying a MED-V workspace - -- MED-V client operations - -  - -  - - - - - diff --git a/mdop/medv-v1/client-installation-command-line-reference.md b/mdop/medv-v1/client-installation-command-line-reference.md deleted file mode 100644 index 44326e2a47..0000000000 --- a/mdop/medv-v1/client-installation-command-line-reference.md +++ /dev/null @@ -1,130 +0,0 @@ ---- -title: Client Installation Command Line Reference -description: Client Installation Command Line Reference -author: dansimp -ms.assetid: 122a593d-3314-4e9b-858a-08a25ed00c32 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Client Installation Command Line Reference - - -**To install MED-V from the command line** - -1. From the command line, run the MED-V .msi package followed by any of the optional parameters described in the following table. - -2. The MED-V .msi package is called *MED-V\_x.msi*, where *x* is the version number. - - For example, *MED-V\_1.0.65.msi*. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterValueDescription

    /quiet

    Silent installation

    /log <full path to log file>

    The full path to the log file.

    INSTALLDIR

    The full path to the installation directory.

    VMSFOLDER

    The full path to the virtual machine folder.

    INSTALL_ADMIN_TOOLS

    1,0

    -

    Default: 0

    Installs MED-V administration tools.

    START_AUTOMATICALLY

    1,0

    -

    Default: 0

    Automatically starts MED-V client every time the user logs on to Windows.

    SERVER_ADDRESS

    host name or IP

    SERVER_PORT

    port

    SERVER_SSL

    1,0

    -

    for https or http

    START_MEDV

    1,0

    -

    Default: 1

    Starts MED-V at the completion of the MED-V installation.

    -
    -Note

    It is recommended to set START_MEDV=0 in case MED-V is installed by the system.

    -
    -
    - -

    DESKTOP_SHORTCUT

    1,0

    -

    Default: 1

    Creates a shortcut on the desktop, which starts MED-V client.

    MINIMAL_RAM_REQUIRED

    RAM in MB

    When installing MED-V, checks whether the computer has the minimum amount of RAM specified. If not, installation is aborted.

    SKIP_OS_CHECK

    1,0

    Omits the operating system validation.

    - - - - - - - - - - - diff --git a/mdop/medv-v1/configuring-med-v-for-remote-networks.md b/mdop/medv-v1/configuring-med-v-for-remote-networks.md deleted file mode 100644 index cdb27ae2fd..0000000000 --- a/mdop/medv-v1/configuring-med-v-for-remote-networks.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Configuring MED-V for Remote Networks -description: Configuring MED-V for Remote Networks -author: dansimp -ms.assetid: 4d2f0081-622f-4a6f-8d73-f8c2108036e0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring MED-V for Remote Networks - - -You can configure MED-V to work from inside a network, remotely, or both from inside the network and remotely. - -## - - -**To configure MED-V to work from inside a network** - -- Configure a MED-V server and image distribution inside the network. - -**To configure MED-V to work remotely** - -1. Configure a MED-V server and an image distribution server that are accessible from the Internet. - -2. If needed, configure a perimeter network (also called a DMZ) reverse proxy. - -3. Set the authentication method, in the *ClientSettings.xml* file, which can be found in the **Servers\\Configuration Server\\** folder. - -**To configure MED-V to work both from inside a network and remotely** - -1. Configure a MED-V server and image distribution server inside the network. - -2. Ensure that the servers are accessible from the Internet. - -3. Configure the DNS resolution so that when the client attempts to connect to a server, it automatically connects to the correct server (within the network or over the Internet) based on the client location. - -4. If needed, configure a perimeter network reverse proxy. - -5. Set the authentication method, in the *ClientSettings.xml* file, which can be found in the **Servers\\Configuration Server\\** folder. - -**Note**   -When applying new settings, the service must be restarted. - - - -- You can change the IIS authentication scheme to one of the following: BASIC, DIGEST, NTLM, or NEGOTIATE. The default is NEGOTIATE and uses the following entry: - - ```xml - - - - - - - - - BG_AUTH_SCHEME_NEGOTIATE - - - ``` - -## Related topics - - -[MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md) - - - - - - - - - diff --git a/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md b/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md deleted file mode 100644 index 1b03f70a10..0000000000 --- a/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Configuring MED-V Server for Cluster Mode -description: Configuring MED-V Server for Cluster Mode -author: dansimp -ms.assetid: 41f0b2a3-4ce9-48e1-a6fb-4c13c4228515 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring MED-V Server for Cluster Mode - - -You can configure the MED-V server in cluster mode. In cluster mode, two servers are used and all files identified as mutual to both servers are placed on a file system. The server accesses the files from the file system rather than storing the files locally. - -## - - -**To configure the MED-V server in cluster mode** - -1. Install and configure MED-V on one of the servers. - -2. Create a shared network in a central location where all of the servers can access it. - -3. Copy the contents of the *<InstallDir>/Servers/ConfigurationServer* folder to the shared network. - -4. Install MED-V server on all designated servers. - -5. On the shared network, assign full access to all MED-V server system accounts. - -6. On each server, do the following: - - 1. In the *<InstallDir>/Servers/ServerConfiguration.xml* file, set the value of *<StorePath>* to the shared network path. - - 2. Copy the *<InstsallDir>/Servers/KeyPair.xml* file from the original server to all MED-V servers. - - 3. Restart the MED-V service. - -**Note**   -If all servers have the same local settings (such as listening ports, IIS server, management permissions, report database, and so on), the *<InstallDir>/Servers/ServerSettings.xml* can be shared by all servers as well. - - - -## Related topics - - -[MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md) - - - - - - - - - diff --git a/mdop/medv-v1/configuring-med-v-workspace-policies.md b/mdop/medv-v1/configuring-med-v-workspace-policies.md deleted file mode 100644 index 34784f4a18..0000000000 --- a/mdop/medv-v1/configuring-med-v-workspace-policies.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: Configuring MED-V Workspace Policies -description: Configuring MED-V Workspace Policies -author: dansimp -ms.assetid: 0eaed981-cbf3-4b16-a4b7-4705c5705dc7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring MED-V Workspace Policies - - -A MED-V workspace policy is a group of configurable settings that define how the virtualized environment and applications perform on the host machine. The topics in this section describe all the configurable settings in the MED-V workspace policy as well as how these settings influence the MED-V workspace. - -The following MED-V workspace types are available: - -- **Persistent**—In a persistent MED-V workspace, all changes and additions the user makes to the MED-V workspace are saved in the MED-V workspace between sessions. Additionally, a persistent MED-V workspace is generally used in a domain environment. - -- **Revertible**—In a revertible MED-V workspace, at the completion of each session (that is, when the MED-V workspace is stopped), the MED-V workspace reverts to its original state during deployment. No changes or additions that the user made are saved on the MED-V workspace between sessions. A revertible MED-V workspace cannot be used in a domain environment. - -It is important to decide on the type of MED-V workspace you are creating before deploying the MED-V workspace, because it is not recommended to reconfigure the type of MED-V workspace after a policy has been deployed to users. - -**Note**   -When configuring a policy, a warning symbol appears next to mandatory fields that are not filled in. If a mandatory field is not filled in, the symbol appears on the tab as well. - - - -## In This Section - - -[How to Apply General Settings to a MED-V Workspace](how-to-apply-general-settings-to-a-med-v-workspace.md) -Describes the general settings of a MED-V workspace, and how to apply them to a policy. - -[How to Apply Virtual Machine Settings to a MED-V Workspace](how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md) -Describes the virtual machine settings for a MED-V workspace, and how to apply them to a policy. - -[How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md) -Describes how to configure domain users and groups. - -[How to Configure Published Applications](how-to-configure-published-applicationsmedvv2.md) -Describes published applications and menus, and how to apply them to a policy. - -[How to Configure Web Settings for a MED-V Workspace](how-to-configure-web-settings-for-a-med-v-workspace.md) -Describes the Web settings available for a MED-V workspace, and how to apply them to a policy. - -[How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md) -Describes the virtual machine setup for a MED-V workspace, and how to apply it to a policy. - -[How to Apply Network Settings to a MED-V Workspace](how-to-apply-network-settings-to-a-med-v-workspace.md) -Describes the network settings of a MED-V workspace, and how to apply them to a policy. - -[How to Apply Performance Settings to a MED-V Workspace](how-to-apply-performance-settings-to-a-med-v-workspace.md) -Describes the performance settings of a MED-V workspace, and how to apply them to a policy. - -[How to Import and Export a Policy](how-to-import-and-export-a-policy.md) -Describes how to import and export a policy. - - - - - - - - - diff --git a/mdop/medv-v1/creating-a-med-v-image.md b/mdop/medv-v1/creating-a-med-v-image.md deleted file mode 100644 index 4b9d3222fb..0000000000 --- a/mdop/medv-v1/creating-a-med-v-image.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Creating a MED-V Image -description: Creating a MED-V Image -author: dansimp -ms.assetid: 7cbbcd22-83f5-4b60-825f-781b4c6a2d36 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a MED-V Image - - -## In This Section - - -This section describes how to configure a MED-V image on a computer on which the MED-V client and MED-V management application are installed, and explains the following: - -[How to Create and Test a MED-V Image](how-to-create-and-test-a-med-v-image.md) -Describes how to create a MED-V image, and then test the image locally. - -[How to Pack a MED-V Image](how-to-pack-a-med-v-image.md) -Describes how to pack a MED-V image so that it can be added to a deployment package or uploaded to the server. - -[How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) -Describes how to upload a MED-V image to the server. - -[How to Localize a MED-V Image](how-to-localize-a-med-v-image.md) -Describes how to localize a MED-V image either through extracting or downloading the image. - -[How to Update a MED-V Image](how-to-update-a-med-v-image.md) -Describes how to update a MED-V image to create a new version of the image. - -[How to Delete a MED-V Image](how-to-delete-a-med-v-image.md) -Describes how to delete a MED-V image. - -**Note**   -After the MED-V image is configured, the computer should not be part of a domain because the join domain procedure should be performed on the client after the deployment, as part of the MED-V workspace setup. - - - - - - - - - - - diff --git a/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md b/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md deleted file mode 100644 index 49db131ccf..0000000000 --- a/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Creating a MED-V Workspace -description: Creating a MED-V Workspace -author: dansimp -ms.assetid: 9578bb99-8a09-44c1-b88f-538901f16ad3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating a MED-V Workspace - - -A MED-V workspace is the desktop environment in which end users interact with the virtual machine provided by MED-V. The MED-V workspace is created and customized by the administrator. It consists of an image and the policy, which defines the rules and functionality of the MED-V workspace. Multiple MED-V workspaces can be created, each customized with its own configuration, settings, and rules. A user, group, or multiple users or groups can be associated with each MED-V workspace, thereby making the MED-V workspace available only for the associated user's or group's computers. - -## How to Add a MED-V Workspace - - -**To add a MED-V workspace** - -1. Click the **Policy** management button to open the **Policy** module. - - The **Policy** module consists of the **Workspaces** menu on the left and the **General**, **Virtual Machine**, **Deployment**, **Applications**, **Web**, **VM Setup**, **Network**, and **Performance** tabs. - -2. On the **Policy** menu, select **New Workspace**, or click **Add** to create a new MED-V workspace. - -3. On the **General** tab, in the **Name** field, enter the name of the MED-V workspace. - -4. In the **Description** field, enter a description for the MED-V workspace. - -5. In the **Support contact info** field, enter the contact information for technical support. - - For more information about configuring a MED-V workspace, see [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md). - -## How to Clone a MED-V Workspace - - -A MED-V workspace can be cloned so that you can create a MED-V workspace identical to an existing MED-V workspace. - -**To clone a MED-V workspace** - -1. Click the MED-V workspace to clone. - -2. On the **Policy** menu, select **Clone Workspace**. - - A new MED-V workspace is created with the name <Original MED-V workspace name> - 2. - -## How to Delete a MED-V Workspace - - -**To delete a MED-V workspace** - -- In the **Policy** module, while the workspace pane is in focus, click **Remove**. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md b/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md deleted file mode 100644 index c73b1b9457..0000000000 --- a/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md +++ /dev/null @@ -1,256 +0,0 @@ ---- -title: Creating a Virtual PC Image for MED-V -description: Creating a Virtual PC Image for MED-V -author: dansimp -ms.assetid: 5e02ea07-25b9-41a5-a803-d70c55eef586 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Creating a Virtual PC Image for MED-V - - -To create a Virtual PC (VPC) image for MED-V, you must perform the following: - -1. [Create a VPC image](#bkmk-creatingavirtualmachinebyusingmicrosoftvirtualpc). - -2. [Install the MED-V workspace .msi package onto the VPC image](#bkmk-howtoinstallthemedvworkspacemsipackage). - -3. [Run the MED-V virtual machine prerequisites tool on the VPC image](#bkmk-howtorunthevirtualmachineprerequisitestool). - -4. [Manually configure virtual machine prerequisites on the VPC image](#bkmk-howtoconfiguremedvvirtualmachinemanualinstallationprerequisites). - -5. [Configure Sysprep for MED-V images](#bkmk-howtoconfiguresysprepformedvimages) (optional). - -6. [Turn off Microsoft Virtual PC](#bkmk-turningoffmicrosoftvirtualpc). - -## Creating a Virtual PC Image by Using Microsoft Virtual PC - - -To create a Virtual PC image using Microsoft Virtual PC, refer to the Virtual PC documentation. - -For more information, see the following: - -- [Windows Virtual PC Help](https://go.microsoft.com/fwlink/?LinkId=182378) - -- [Create a virtual machine and install a guest operating system](https://go.microsoft.com/fwlink/?LinkId=182379) - -## How to Install the MED-V Workspace .msi Package - - -After the Virtual PC image is created, install the MED-V workspace .msi package onto the image. - -**To install the MED-V workspace image** - -1. Start the virtual machine, and copy the MED-V workspace .msi package inside. - - The MED-V workspace .msi package is called *MED-V\_workspace\_x.msi*, where *x* is the version number. - - For example, *MED-V\_workspace\_1.0.65.msi*. - -2. Double-click the MED-V workspace .msi package, and follow the installation wizard instructions. - - **Note** - When a new MED-V version is released, and an existing Virtual PC image is updated, uninstall the existing MED-V workspace .msi package, reboot the computer, and install the new MED-V workspace .msi package. - - - -~~~ -**Note** -After the MED-V workspace .msi package is installed, other products that replace GINA cannot be installed. -~~~ - - - -## How to Run the Virtual Machine Prerequisites Tool - - -The virtual machine (VM) prerequisites tool is a wizard that automates several of the prerequisites. - -**Note** -Although many parameters are configurable in the wizard, the properties required for the proper functioning of MED-V are not configurable. - - - -**To run the virtual machine prerequisites tool** - -1. After the MED-V workspace .msi package is installed, on the Windows **Start** menu, select **All Programs > MED-V > VM Prerequisites Tool**. - - **Note** - The user running the virtual machine prerequisites tool must have local administrator rights and must be the only user logged in. - - - -~~~ -The **MED-V VM Prerequisite Wizard Welcome** page appears. -~~~ - -2. Click **Next**. - -3. On the **Windows Settings** page, from the following configurable properties, select the ones to be configured: - - - **Clear users’ personal history information** - - - **Clear local profiles temp directory** - - - **Disable sounds on following Windows events: start, logon, logoff** - - **Note** - Do not enable Windows page saver in a group policy. - - - -4. Click **Next**. - -5. On the **Internet Explorer Settings** page, from the following configurable properties, select the ones to be configured: - - - **Don't use auto complete features** - - - **Disable reuse of windows for launching shortcuts** - - - **Clear browsing history** - - - **Enable tabbed browsing in Internet Explorer 7** - -6. Click **Next**. - -7. On the **Windows Services** page, from the following configurable properties, select the ones to be configured: - - - **Security center service** - - - **Task scheduler service** - - - **Automatic updates service** - - - **System restore service** - - - **Indexing service** - - - **Wireless Zero Configuration** - - - **Fast User Switching Compatibility** - -8. Click **Next**. - -9. On the **Windows Auto Logon** page, do the following: - - 1. Select the **Enable Windows Auto Logon** check box. - - 2. Assign a **User name** and **Password**. - -10. Click **Apply**, and in the confirmation box that appears, click **Yes**. - -11. On the **Summary** page, click **Finish** to quit the wizard - -**Note** -Verify that group policies do not overwrite the mandatory settings set in the prerequisites tool. - - - -## How to Configure MED-V Virtual Machine Manual Installation Prerequisites - - -Several of the configurations cannot be configured through the virtual machine prerequisites tool and must be performed manually. - -- Virtual Machine Settings - - It is recommended to configure the following virtual machine settings in the Microsoft Virtual PC console: - - - Disable floppy disk drives. - - - Disable undo-disks (**Settings > undo-disks**). - - - Ensure that the image has only one virtual CPU. - - - Eliminate interactions between the virtual machine and the user, where they are not related to published applications (such as, messages requiring user input). - -- Image Settings - - Configure the following manual settings inside the image: - - 1. In the **Power Options Properties** window, disable hibernation and sleep. - - 2. Apply the most recent Windows updates. - - 3. In the **Windows Startup and Recovery** dialog box, in the **System Failure** section, clear the **Automatically restart** check box. - - 4. Ensure that the image uses a VLK license key. - -- Installing VPC Additions - - On the **Action** menu, select **Install or Update Virtual Machine Additions**. - -- Configuring Printing - - You can configure printing from the MED-V workspace in either of the following ways: - - - Add a printer to the virtual machine. - - - Allow printing with printers that are configured on the host computer. - -## How to Configure Sysprep for MED-V Images - - -In a MED-V workspace, Sysprep can be configured in order to assign unique security ID (SID), particularly when multiple MED-V workspaces are run on a single computer. It is not recommended to use Sysprep to join a domain; instead, use the MED-V join domain script action as described in [How to Set Up Script Actions](how-to-set-up-script-actions.md). - -**Note** -Sysprep is Microsoft's system preparation utility for the Windows operating system. - - - -**To configure Sysprep in a MED-V workspace** - -1. Create a directory in the root of the system drive named *Sysprep*. - -2. From the Windows installation CD, extract *deploy.cab* to the root of the system drive, or download the latest Deployment Tools update from the Microsoft Web site. - - - For Windows 2000, see [Deployment Tools update for Windows 2000](https://go.microsoft.com/fwlink/?LinkId=143001). - - - For Windows XP, see [Deployment Tools update for Windows XP](https://go.microsoft.com/fwlink/?LinkId=143000). - -3. Run **Setup Manager** (setupmgr.exe). - -4. Follow the Setup Manager wizard. - -After Sysprep is configured and the MED-V workspace is created, Sysprep must be executed. - -**To run Sysprep** - -1. From the Sysprep folder located in the root of the system drive, run the System Preparation Tool (Sysprep.exe). - -2. In the warning message box that appears, click **OK**. - -3. In the **Sysprep Properties** dialog box, select the **Don't reset grace period for activation** and **Use Mini-Setup** check boxes. - -4. Click **Reseal**. - -5. If you are not satisfied with the information listed in the confirmation message box that appears, click **Cancel** and change the selections. - -6. Click **OK** to complete the system preparation process. - -## Turning Off Microsoft Virtual PC - - -After all the components are installed and configured, close Microsoft Virtual PC and select **Turn Off**. - -## Related topics - - -Creating a MED-V Image -[How to Set Up Script Actions](how-to-set-up-script-actions.md) - - - - - - - - - diff --git a/mdop/medv-v1/define-the-project-scope.md b/mdop/medv-v1/define-the-project-scope.md deleted file mode 100644 index 2d628bd096..0000000000 --- a/mdop/medv-v1/define-the-project-scope.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Define the Project Scope -description: Define the Project Scope -author: dansimp -ms.assetid: 84637d2a-2e30-417d-b150-dc81f414b3a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Define the Project Scope - - -When defining the project scope, determine the following: - -1. The MED-V end users—the location and number of end users are used in determining the location of MED-V client installations and the number of MED-V instances, as well as the number and placement of MED-V image repositories. - -2. The virtual machine (VM) images to be managed by MED-V—to determine the method of distributing images and placement of image repositories. - -3. The organization’s service level expectations—to determine the performance and fault-tolerance requirements for the MED-V server and database as well as the image repository. - -4. Validate with the business—ensure there is a complete understanding of how the planned infrastructure affects the business. - -## Define the MED-V End Users - - -First, determine where the end users are located, as well as the number of users in each location. Second, obtain a network infrastructure diagram that displays the user locations and the available bandwidth to those locations. Third, find out if users travel between locations. If users travel, additional capacity may be required in the design of the server infrastructure and image repositories. - -## Determine the MED-V Images to Be Managed by MED-V - - -After the MED-V end users have been defined, determine which VMs will be managed by MED-V for the users in each location. - -If any of the VMs are stored in a centralized library, determine the location of the library so that it may be evaluated for use as a MED-V repository. - -## Determine the Organization’s Service Level Expectations - - -For each MED-V workspace, note the acceptable time for a new image to load and the timeframe for critical updates to be deployed. - -If applicable, record the service level expectations for MED-V reporting, to be used in the design of the server infrastructure. - -## Validate with the Business - - -Ask business stakeholders and application owners the following questions: - -- Are there any existing images that can be combined? For example, if application A on Windows XP is one VPC image and application B on Windows XP is another VPC image, perhaps a single image can contain both applications, thereby reducing repository space and bandwidth required for image download. - -- Are the in-scope applications licensable and supportable if delivered in a VM by MED-V? Check with the application supplier to ensure that licensing and support terms will not be violated by delivering the application through MED-V. - -  - -  - - - - - diff --git a/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md b/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md deleted file mode 100644 index 52e0292edc..0000000000 --- a/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Deploying a MED-V Workspace Using a Deployment Package -description: Deploying a MED-V Workspace Using a Deployment Package -author: dansimp -ms.assetid: e07fa70a-1a9f-486f-9a86-b33593b234da -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying a MED-V Workspace Using a Deployment Package - - -The deployment package installation provides a method of installing MED-V client together with all its required prerequisites as well as any settings predefined by the administrator. - -When using a deployment package, the package is distributed via a shared network or removable media. The image can be included in the package or can be distributed separately. - -Before creating a deployment package, ensure that you have created a MED-V image ready for deployment. For more information on creating a MED-V image, see [Creating a MED-V Image](creating-a-med-v-image.md). - -After the MED-V image is prepared, consider the best method for distributing the image in your environment. The image can be distributed in one of the following ways: - -- Uploaded to the Web and distributed via Web download, optionally using Trim Transfer technology. - -- Distributed using image pre-staging. - -- Included in the deployment package and distributed together with all the other MED-V components. - -If the image will be included in the package, no other configurations are necessary for the image. If the image will not be included in the deployment package, do one of the following: - -- If you are deploying the image via the Web, upload the MED-V image to the image Web distribution server. For information on configuring an image Web distribution server, see [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md). For information on uploading an image to the server, see [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md). - -- If you are deploying the image via image pre-staging, configure the pre-stage folder, and push the MED-V image to the folder. For more information on configuring the image pre-staging, see [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md). - -**Note**   -If you are using image pre-staging, it is important to configure the image pre-stage folder prior to creating the deployment package. The folder path needs to be included in the deployment package. - - - -Finally, create the deployment package. For more information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). After the package is complete, distribute it for deployment. - -After the deployment package is distributed, MED-V client can be installed and the image deployed. For more information on installing MED-V client, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). For more information on deploying the image, see [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imagedeployment-package.md). - - - - - - - - - diff --git a/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md b/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md deleted file mode 100644 index 4167d9099f..0000000000 --- a/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Deploying a MED-V Workspace Using an Enterprise Software Distribution System -description: Deploying a MED-V Workspace Using an Enterprise Software Distribution System -author: dansimp -ms.assetid: 867faed6-74ce-4573-84be-8bf26e66c08c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying a MED-V Workspace Using an Enterprise Software Distribution System - - -MED-V client can be distributed using an enterprise software distribution system, such as Microsoft System Center Configuration Manager. - -**Note**   -If MED-V is installed by using Microsoft System Center Configuration Manager, when creating a package for MED-V, set the run mode to administrative rights. - - - -Before deploying MED-V using an enterprise software distribution system, ensure that you have created a MED-V image ready for deployment. For more information on creating a MED-V image, see [Creating a MED-V Image](creating-a-med-v-image.md). - -After the MED-V image is prepared, consider the best method for distributing the image in your environment. The image can be distributed in one of the following ways: - -- Uploaded to the Web and distributed via Web download, optionally utilizing Trim Transfer technology. - -- Distributed using image pre-staging. - -## Deploying the Image via the Web - - -If you are deploying the image via the Web, upload the MED-V image to an image Web distribution server. For information on configuring an image Web distribution server, see [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md). For information on uploading an image to the server, see [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md). - -## Deploying the Image via Pre-staging - - -If you are deploying the image via image pre-staging, configure the pre-stage folder, and push the MED-V image to the folder. For more information on configuring image pre-staging, see [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md). - -**Note**   -If you are using image pre-staging, it is important to configure the image pre-stage folder prior to pushing the client .msi package. The folder path needs to be included in the client .msi package. - - - -Finally, push the client .msi package using your enterprise software distribution center. MED-V can then be installed and the image deployed. For more information on installing MED-V client, see [How to Install MED-V Client](how-to-install-med-v-clientesds.md). For more information on deploying the image, see [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imageesds.md). - - - - - - - - - diff --git a/mdop/medv-v1/design-the-med-v-image-repositories.md b/mdop/medv-v1/design-the-med-v-image-repositories.md deleted file mode 100644 index 8302861536..0000000000 --- a/mdop/medv-v1/design-the-med-v-image-repositories.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Design the MED-V Image Repositories -description: Design the MED-V Image Repositories -author: dansimp -ms.assetid: e153154d-2751-4990-b94d-a2d76242c15f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Design the MED-V Image Repositories - - -After MED-V images are created and packed, they can be stored on a file server in any location. The files may be sent over HTTP or HTTPS by one or more IIS servers. The image repository can be shared by multiple MED-V instances. - -To design the image repositories, you must first decide how the images will be deployed to each client and then whether that client requires a local image repository. Each repository is then designed and placed, along with its accompanying IIS server. - -## Determine How Images Will Be Deployed - - -For each MED-V workspace, decide how you plan to deploy MED-V images to the client. This is important in determining how many repositories are necessary to store the packed images, where those repositories will be placed, and then to design those repositories. - -Packed images can be deployed in the following ways: - -- Downloaded over the network from an image distribution server, which comprises a file server and IIS server. - -- On removable media, such as a USB drive or DVD. - -- Pre-staged to an image store directory on the client computer using an enterprise software distribution center. - -Decide which method, or methods, will be used to deploy MED-V images to each of the clients and whether the location will require an image repository. - -## Determine the Number of Image Repositories - - -Now that you have determined the minimum number of repositories you need, add more if any of the following criteria apply: - -- Organizational or regulatory reasons to separate the MED-V images—some MED-V images may not be able to coexist in the same repository. For example, sensitive personal data may require storage on a server that is only available to a limited set of employees who need access to the data. - -- Clients in isolated networks—if images will be deployed over the network, determine whether any networks are isolated and require a separate repository. For example, organizations often isolate lab networks from production networks. - -- Clients in remote networks—if images will be deployed over the network, some client machines may be separated from the repository by network links that have insufficient bandwidth to provide an adequate experience when a client loads a MED-V workspace. If necessary, design additional MED-V instances to address this need. - -Add these repositories to the design. Decide on a name for each repository and the reason for designing it. Decide which MED-V images the repositories will hold and which MED-V clients will load MED-V workspaces with images from the repository. - -## Design and Place the Image Repositories - - -When a new image is available to clients, clients begin downloading the image, possibly simultaneously. This creates a high demand on the repository and must be taken into account when designing the image repository. - -For each repository, determine the amount of data it will store. Sum the sizes of images that will be stored in the repository. This is the value of the disk space required on the file server. - -Next, add up the number of clients that may download MED-V images from the repository. This is the maximum number of concurrent downloads that can occur when a new MED-V image is loaded into the repository. The file server must be designed with a disk subsystem that can meet the IO demands this will create. - -The image repository can reside on the same system as the MED-V server and the server running SQL Server, or on a remote file share. You can also run it in a Windows Server 2008 Hyper-V VM. Check the network location of the clients that the image repository will service, and place the repository in a network location where it will have sufficient bandwidth to meet the service level expectations of those clients. - -### Fault Tolerance - -If the image repository is unavailable, clients will not be able to download new or updated MED-V images. To design fault-tolerance options for the file server and fault-tolerant disks, see the [Infrastructure Planning and Design Microsoft SQL Server 2008](https://go.microsoft.com/fwlink/?LinkId=163302) guide. - -## Design and Place the IIS Servers - - -This section is only relevant if clients will download image files over the network using HTTP or HTTPS. - -The IIS server can coexist on the same system as the MED-V server and the server running SQL Server. It can also run in a Windows Server 2008 Hyper-V VM. The IIS server infrastructure must have sufficient throughput to deliver images to clients within the service level expectations of the organization. It must be designed with a disk subsystem that can meet the IO demands this creates. - -For each image repository, sum the number of clients that may download MED-V images using IIS. This is the maximum number of concurrent downloads that can occur when an image is loaded into the repository. Use the throughput sum and the service level expectations determined in [Define the Project Scope](define-the-project-scope.md) to plan the design of the IIS server infrastructure and to determine the appropriate amount of bandwidth to allocate for the repository. - -To design the IIS infrastructure, see the [Infrastructure Planning and Design Microsoft Internet Information Services](https://go.microsoft.com/fwlink/?LinkId=160826) guide. - -### Fault Tolerance - -If the IIS server infrastructure is unavailable, clients will not be able to download new or updated images. To configure fault tolerance, the Windows Server 2008-based IIS server can be placed in a failover cluster. To design the fault tolerance for the IIS server infrastructure, see the [Infrastructure Planning and Design Microsoft Internet Information Services](https://go.microsoft.com/fwlink/?LinkId=160826) guide. - -## Related topics - - -[Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md) - -[Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/design-the-med-v-server-infrastructure.md b/mdop/medv-v1/design-the-med-v-server-infrastructure.md deleted file mode 100644 index 40536204ff..0000000000 --- a/mdop/medv-v1/design-the-med-v-server-infrastructure.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: Design the MED-V Server Infrastructure -description: Design the MED-V Server Infrastructure -author: dansimp -ms.assetid: 2781040f-880e-4e16-945d-a38c0adb4151 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Design the MED-V Server Infrastructure - - -In this topic, you will design the server infrastructure for each MED-V instance. This includes determining whether the SQL Server instance will exist on the MED-V server or on a remote server, as well as the size of the SQL Server database. You will also determine the location of the management console. - -## Design and Place the Server for Each MED-V Instance - - -The MED-V server implements policies and stores state and history data about its clients. - -### Form Factor - -MED-V recommends using a 2.8-GHz dual core CPU server with 2 GB of RAM. This recommendation is based on the assumption that the MED-V server will run on a dedicated machine and that SQL Server and the MED-V management console will run on separate machines. - -Given this workload, the MED-V server should be relatively lightly loaded. In the absence of specific architectural guidance on the server form factor, design the server using the MED-V recommendation, with memory that matches the organization’s standard form factor. The MED-V server can be run on a virtual machine (VM) on Windows Server 2008 Hyper-V. If a VM will be used, ensure that it has access to CPU and memory resources equivalent to those specified for a physical machine. - -The disk capacity the MED-V server requires must be sufficient to store the MED-V workspace configuration files. A MED-V workspace can only use one VM, and one policy, for one or more users. Therefore, the number of MED-V workspaces that must be stored depends on the degree to which different policies are required for different users of the same VM, as well as the number of VMs that will be used. The MED-V workspace XML files are around 30 KB in size for a typical MED-V workspace. To determine the required disk capacity, multiply 30 KB by the number of MED-V workspaces that the MED-V server will store. - -The MED-V server’s most important network connections are the links to its clients, therefore place the server in a network location that provides the most available bandwidth and the most robust links to its clients. - -### Fault Tolerance - -There can only be one active MED-V server in a MED-V instance, and MED-V does not include standard capabilities to place the server in a Microsoft Cluster Server (MSCS) cluster to provide fault tolerance. A passive backup server can be manually configured. - -To decide whether a passive backup server should be manually configured for the MED-V instance, determine whether users will be permitted to use the MED-V images in offline mode. For information on offline mode, see [How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md). If users are not allowed to work offline, they will be unable to continue working in the event of a MED-V server failure, even if the MED-V workspace has already been started on the client. If offline work is permitted, for each MED-V workspace, determine how long the client is allowed to work offline before it must authenticate. This is the maximum amount of time that the server can be unavailable. - -## Design and Place the SQL Server Database - - -The MED-V server uses the SQL Server database to store client status and events. You can install the SQL Server database on the same machine as the MED-V server or you can place it on a separate server running SQL Server, which can optionally be remote. You can share the database with other MED-V instances, in which case events and alerts from those instances will be stored in the same database, and reports will include events from all instances. You can install the database in an existing SQL Server instance, and the databases of other MED-V servers can reside in that same instance. - -If you place the database server in a location that is remote from the MED-V server, across networks links that do not have sufficient bandwidth available, reports may be slow to load in the console and may not display the latest data from clients. Refer to the organization service level expectations that you determined in [Define the Project Scope](define-the-project-scope.md) and use that information to decide where to place the SQL Server database. - -### Form Factor - -If you will run SQL Server on the same server as MED-V, and if SQL Server will only be used to store data for that server, start with the MED-V recommendation and add resources for the SQL Server load. If SQL Server will store events and alerts from more than one MED-V instance, for information on how to scale up the server form factor, see the [Infrastructure Planning and Design Microsoft SQL Server 2008](https://go.microsoft.com/fwlink/?LinkId=163302) guide (http:// go.microsoft.com/fwlink/?LinkId=163302). - -The size of the database depends on the number of client events that the database will store. Events are created by normal operation of the client, such as when a MED-V workspace is started, or when there is an error in the MED-V workspace. The default interval at which the client sends events is 1 minute. - -To estimate the size of the database, determine the following: - -- Number of clients in the MED-V instance. The maximum is 5,000. - -- Typical event arrival rate. This rate depends on client usage behavior but is approximately 15 to 20 events per day per client. - -- Event size. The size is typically around 200 bytes. - -- Storage amount. The number of days for which events will be stored. - -Multiply these values together to calculate the size of the required data storage in bytes, and then add a safety factor to account for the following: - -- Errors, which could create a large number of events from a client in a short period of time. - -- Database table and organizational space. - -To approximate the infrastructure optimization per second (IOPs) requirement, use the above values, multiplying the typical event arrival rate by the number of clients in the instance. This yields the number of records that can be written per day. Divide that number by 86,400 to derive the number of records written per second. If a write operations can be equated with a single infrastructure optimization (IO) operation, this number is the write IOPs required. Add a buffer to that for reporting activity. This is difficult to determine but depends on the number of consoles in use with the instance and the frequency with which they are used to generate reports. - -### Fault Tolerance - -When MED-V client is running, if the server is unavailable, events will be backed up on the client and reports will be unavailable in the management console. Refer to the organization’s service level expectations determined in [Define the Project Scope](define-the-project-scope.md) to decide whether the design of a fault-tolerant SQL Server infrastructure is necessary. - -MED-V does not provide support for running SQL Server in an MSCS cluster. In order to provide warm standby and to avoid data loss in the event of a failure, you can place SQL Server in a log shipping configuration. For information on log shipping, see the [Infrastructure Planning and Design Microsoft SQL Server 2008](https://go.microsoft.com/fwlink/?LinkId=163302) guide (https://go.microsoft.com/fwlink/?LinkId=163302). - -## Design the Management Console - - -Part of the functionality of the MED-V management console is to test VMs before they are packed for distribution to MED-V clients. Therefore, the management console should be designed with a form factor that resembles, as closely as possible, the form factor of a typical MED-V client machine. - -The management console application is installed together with the MED-V client and uses Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918. A client operating system must be used; the MED-V management console cannot run on the same system as the MED-V server. - -You cannot share a management console with multiple MED-V server instances. The address of the MED-V server is specified during the installation of the management console’s MED-V client; this can be changed after installation, but at any time the management console can only work with a single MED-V server. - -You can use multiple management consoles with a single MED-V server. To avoid conflicts, a mechanism is available that notifies other console users when one console has made changes to a MED-V workspace. - -For each MED-V instance, determine how many management consoles will be needed and where they will be placed. Select a typical MED-V client form factor to be used for the management console. - -## Related topics - - -[MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) - -[Configuring MED-V Server for Cluster Mode](configuring-med-v-server-for-cluster-mode.md) - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md b/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md deleted file mode 100644 index 5165183f3c..0000000000 --- a/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Examples of Virtual Machine Configurations -description: Examples of Virtual Machine Configurations -author: dansimp -ms.assetid: 5937601e-41ab-4ca2-8fa1-3c9154710cd6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Examples of Virtual Machine Configurations - - -The following are examples of typical virtual machine configurations: one in a persistent MED-V workspace and one in a revertible MED-V workspace. - -**Note**   -These examples are not intended for use in all environments. Adjust the configuration according to your environment. - - - -**To configure a typical domain setup in a persistent MED-V workspace** - -1. Configure Sysprep on the base image to create a unique SID. For more information, see [Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md#bkmk-howtoconfiguresysprepformedvimages). - -2. On the **VM Setup** tab, select the **Run VM Setup** check box. - -3. In the **VM Computer Name Pattern** section, configure the pattern for the machine image name. For more information, see [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md). - -4. Click **Script Editor**, and in the **VM Setup Script Editor** dialog box, configure the following actions: - - 1. **Rename Computer** - - 2. **Restart Windows** - - 3. **Check Connectivity** - - 4. **Join Domain** - - 5. **Disable Auto-Logon** - - For more information, see [How to Set Up Script Actions](how-to-set-up-script-actions.md). - -5. On the **Policy** menu, click **Commit**. - -**To configure a typical setup in a revertible workspace** - -1. On the **VM Setup** tab, select the **Rename the VM based on the computer name pattern** check box. - -2. In the **VM Computer Name Pattern** section, configure the pattern for the machine image name. For more information, see [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md). - -3. On the **Policy** menu, click **Commit**. - -## Related topics - - -[How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md) - -[How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md) - -[How to Set Up Script Actions](how-to-set-up-script-actions.md) - - - - - - - - - diff --git a/mdop/medv-v1/getting-started-with-med-v.md b/mdop/medv-v1/getting-started-with-med-v.md deleted file mode 100644 index 969a8b0a46..0000000000 --- a/mdop/medv-v1/getting-started-with-med-v.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Getting Started with MED-V -description: Getting Started with MED-V -author: dansimp -ms.assetid: 5832cdb3-3892-4048-b29d-7644e75117f0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Getting Started with MED-V - - -This section provides general information for administrators using Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 and MED-V 1.0 SP1. - -## In This Section - - -[Overview of MED-V](overview-of-med-v.md) - -[High-Level Architecture](high-level-architecturemedv.md) - -[Key Scenarios for Using MED-V](key-scenarios-for-using-med-v.md) - -[About MED-V 1.0](about-med-v-10.md) - -[About MED-V 1.0 SP1](about-med-v-10-sp1.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/high-level-architecturemedv.md b/mdop/medv-v1/high-level-architecturemedv.md deleted file mode 100644 index 7badb94bbd..0000000000 --- a/mdop/medv-v1/high-level-architecturemedv.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: High-Level Architecture -description: High-Level Architecture -author: dansimp -ms.assetid: a78e12ad-5aa6-40e0-ae8b-51acaf005712 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture - - -The MED-V solution comprises the following elements: - -- **Administrator-defined virtual machine**—Encapsulates a full desktop environment, including an operating system, applications, and optional management and security tools. - -- **Image repository**—Stores all virtual images on a standard IIS server and enables virtual images version management, client-authenticated image retrieval, and efficient download (of a new image or updates) via Trim Transfer technology. - -- **Management server**—Associates virtual images from the image repository along with administrator usage policies to Active Directory® users or groups. The management server also aggregates clients' events and stores them in an external database (Microsoft SQL Server®) for monitoring and reporting purposes. - -- **Management console**—Enables administrators to control the management server and the image repository. - -- **End-user client** - - 1. Virtual image life-cycle—Authentication, image retrieval, enforcement of usage policies. - - 2. Virtual machine session management—Start, stop, lock the virtual machine. - - 3. Single desktop experience—Applications installed in the virtual machine seamlessly available through the standard desktop Start menu and integrated with other applications on the user desktop. - -All communication between the client and the servers (management server and image repository) is carried on top of a standard HTTP or HTTPS channel. - -![](images/506f54d0-38fa-446a-8070-17ae26da5355.gif) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md deleted file mode 100644 index 5d9bdb7412..0000000000 --- a/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md +++ /dev/null @@ -1,108 +0,0 @@ ---- -title: How to Apply General Settings to a MED-V Workspace -description: How to Apply General Settings to a MED-V Workspace -author: dansimp -ms.assetid: 6152dced-e301-4fa2-bfa0-aecf3c23f23a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply General Settings to a MED-V Workspace - - -The general settings enable you to configure the basic user experience when working with a MED-V workspace, by defining whether the MED-V workspace will appear in seamless integration or full desktop mode. Seamless integration includes legacy applications in the host desktop so that they appear as if they are installed directly on the host. Full desktop presents the desktop of the MED-V workspace operating system in a separate window on the host. - -All general settings are configured in the **Policy** module, on the **General** tab. - -**To apply general settings to a MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. Configure the general properties as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**General Workspace Properties** - -Property -Description -*Workspace Properties* - -Name - -The name of the MED-V workspace. - -**Warning**   -Do not rename an existing MED-V workspace while it is running on a client computer. - - - -Description - -Description of the MED-V workspace, which can include the content or status of the MED-V workspace and any other useful information. - -**Note**   -The description is for administrator use and has no impact on the policy. - - - -Support contact info - -The contact information for technical support. The information entered will be displayed in the support contact information screen that can be accessed from the MED-V client notification area. - -*Workspace UI* - -Seamless Integration - -Select this option for the MED-V workspace windows, taskbar, and notification area icons to integrate seamlessly into the host desktop. - -Draw a frame around each workspace window - -When using seamless integration, select this option to create a colored border around all applications running within the MED-V workspace and a colored background for all taskbar button icons. In the **Frame color** field, select the color. - -Full Desktop - -Select this option to display the MED-V workspace as the entire desktop, without integrating with the host. - -*Host Verification* - -Command line - -Type a command line to run on the host before starting the MED-V workspace. - -Do not start the Workspace if the verification fails (exit code is not '0') - -Select this check box if you are using a command line and want to start the MED-V workspace only if the script is completed successfully. - - - -A command line can be run on the host prior to starting the MED-V workspace. - -**To run a command line before starting a MED-V workspace** - -1. In the **Command line** field, enter a command line. - -2. To start the MED-V workspace only if the command line was successful, select the **Do not start the workspace if the verification fails** check box. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md deleted file mode 100644 index 4846278e8e..0000000000 --- a/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: How to Apply Network Settings to a MED-V Workspace -description: How to Apply Network Settings to a MED-V Workspace -author: dansimp -ms.assetid: 641f46b3-a56f-478a-823b-1d90aa1716b3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply Network Settings to a MED-V Workspace - - -Administrators can define the network settings for each MED-V workspace. - -All network settings are configured in the **Policy** module, on the **Network** tab. - -**To apply network settings to a MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. In the **Network** pane, configure the settings as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**MED-V Workspace Network Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    TCP/IP Properties

      -
    • Use host's IP address (NAT)—The workspace will use NAT to share the host's IP for outgoing traffic.

    • -
    • Use different IP address than host (Bridge)—The MED-V workspace will have its own network address, usually obtained via DHCP.

    • -
    -

    Select the Map multiple adapters into Workspace check box when the host computer has multiple adapters. It is recommended to use this configuration when the host moves between different networks using different adapters.

    DNS Server

      -
    • Don't change—DNS settings that are set within the MED-V workspace virtual machine will not be changed.

    • -
    • Use Host's DNS address—MED-V workspace DNS settings will be synchronized to match the host's settings. The DNS synchronization is dynamic. It is synchronized periodically with the host so that if it is changed on the host, it will change dynamically in the MED-V workspace.

    • -
    • Use specific DNS addresses—The MED-V workspace will use a specific DNS, as specified.

      -

      In the Primary and Secondary fields, enter the primary and secondary DNS addresses.

      -

      Select the Append Host's DNS addresses check box to append the host to the configured DNS addresses.

    • -

    Assign DNS Suffixes

      -
    • Assign the following suffixes—Select this check box to assign specific DNS suffixes; in the box, enter a suffix or multiple suffixes separated by commas.

    • -
    • Append host suffixes—Select this check box to append the host suffixes to the DNS address.

    • -
    - -  - -## Related topics - - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md deleted file mode 100644 index bb5b64f7e8..0000000000 --- a/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Apply Performance Settings to a MED-V Workspace -description: How to Apply Performance Settings to a MED-V Workspace -author: dansimp -ms.assetid: e0fed1e1-6e8f-4d65-ab83-b950a17661c0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply Performance Settings to a MED-V Workspace - - -The following performance setting can be defined for each MED-V workspace: - -VM memory allocation - -Performance settings are configured in the **Policy** module, on the **Performance** tab. - -**To apply performance settings to a MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. In the **Performance** pane, configure the settings as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**Performance Settings Properties** - - ---- - - - - - - - - - - - - -
    PropertyDescription

    Adjust VM memory, based on amount of the Host machine's physical memory

    Select this check box, and configure the following virtual machine properties in the table:

    -
      -
    • Host Memory—Define the common host RAM configuration in your organization based on any numbers of groups to configure.

    • -
    • VM Memory—Enter the amount of host memory to allocate to the virtual machine.

    • -
    - -  - -## Related topics - - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md deleted file mode 100644 index 197b944570..0000000000 --- a/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: How to Apply Virtual Machine Settings to a MED-V Workspace -description: How to Apply Virtual Machine Settings to a MED-V Workspace -author: dansimp -ms.assetid: b50d0dfb-8d61-4543-9607-a29bbb1ed45f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Apply Virtual Machine Settings to a MED-V Workspace - - -Every MED-V workspace must have a Microsoft Virtual PC image associated with it. The virtual machine settings enable you to assign a Virtual PC image as well as set other virtual machine properties. - -All virtual machine settings are configured in the **Policy** module, on the **Virtual Machine Settings** tab. - -**To apply virtual machine settings to a MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. Configure the virtual machine properties as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**Virtual Machine Properties** - -Property -Description -*Virtual Machine Settings* - -Assigned Image - -The actual Microsoft Virtual PC image assigned to the MED-V workspace. The menu provides a list of all available Virtual PC images. The following image types are in the **Active** image list: - -- **Local test images**—Images on the local computer that are not yet packed. These image names are followed by the word “test” in parentheses (test) and are for testing purposes only. - -- **Local packed images**—Packed images on the local computer. These images are followed by the word “local” in parentheses (local) and cannot be downloaded by clients until the administrator uploads them to the server. - - A local image can be selected if you are creating a package that will be distributed to the client via removable media (such as USB or DVD). - -- **Packed images on server**—Images that are on the server and are available for download by clients. Click Refresh to refresh the images list. - - **Note**   - Each MED-V workspace image can only be used by one Windows user. - - - -Workspace is persistent - -Select this check box to configure the MED-V workspace as persistent. In a persistent MED-V workspace, when the MED-V workspace is stopped, changes and additions to the MED-V workspace are saved in the MED-V workspace. - -For a Domain MED-V workspace, this option must be selected. - -**Note**   -This setting should not be changed after a MED-V workspace is deployed to users. - - - -Shut down the VM when stopping the Workspace - -Select this check box to shut down the virtual machine when stopping the MED-V workspace. If this check box is cleared, at the completion of each session, the virtual machine is not shut down but instead takes a snapshot of the virtual machine. Upon the initiation of a new session, Windows starts from the snapshot (that is, Windows does not restart and no login is required). - -**Note**   -This property is enabled only if **Workspace is persistent** is selected. - - - -Logon to Windows in VM using MED-V credentials (SSO) - -Select this check box to log in to Windows on the virtual machine by using the MED-V credentials entered when logging in to MED-V client. - -**Note**   -This property is enabled only when **Workspace is persistent** is selected. - - - -Workspace is revertible - -Select this check box to configure the MED-V workspace as revertible. In a revertible MED-V workspace, at the completion of each session (that is, when the user stops the MED-V workspace), the MED-V workspace reverts to the original state it was in during deployment. No changes or additions that the user made are saved on the MED-V workspace between sessions. - -**Note**   -This setting should not be changed after a MED-V workspace is deployed to users. - - - -Synchronize Workspace time zone with host - -Select this check box to synchronize the time zone in the MED-V workspace with the host. - -The synchronization works differently depending on whether the MED-V workspace is persistent or revertible, as follows: - -- In a persistent MED-V workspace, the time zone first tries to synchronize with the server. If that fails, it synchronizes with the host. - -- In a revertible MED-V workspace, the time zone synchronizes with the host. - -*Lock Settings* - -Lock the Workspace on host standby/hibernate event - -Select this check box to automatically lock the MED-V workspace when the host computer goes into standby or hibernate. - -Lock the Workspace after - -Select this check box to lock the MED-V workspace when the MED-V workspace is idle for a specified period of time. When selected, the number box is enabled. Enter the number of minutes of idle time before locking the MED-V workspace. - -**Note**   -The idle time refers to the MED-V workspace applications (not the host applications). - - - -*Image Update Settings* - -Keep only - -Select this check box to limit the number of old image versions to keep. - -When selected, the number box is enabled. Enter the number of old versions to keep. - -Suggest update when a new version is available - -Select this check box to suggest (but not force) an update when a new version of the image is available. - -Clients should use Trim Transfer when downloading images for this Workspace - -Select this check box to enable Trim Transfer (for more information, see [MED-V Trim Transfer Technology](med-v-trim-transfer-technology-medvv2.md)) when downloading images associated with this MED-V workspace. If this check box is cleared, the full image will be downloaded. - -**Note**   -Trim Transfer requires indexing the hard drive, which might take a considerable amount of time. It is recommended to use Trim Transfer when indexing the hard drive is more efficient than downloading the new image version, such as when downloading an image version that is similar to the existing version. - - - - - -## Related topics - - -[Creating a MED-V Image](creating-a-med-v-image.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md b/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md deleted file mode 100644 index 3a7c44c436..0000000000 --- a/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: How to Back Up and Restore a MED-V Server -description: How to Back Up and Restore a MED-V Server -author: dansimp -ms.assetid: 8d05e3a4-279b-4ce6-a319-8a09e7a30c60 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Back Up and Restore a MED-V Server - - -XML files located on the server can be backed up and then restored in case of loss of data on the server. - -**To back up a MED-V server** - -- Back up the following files, located in *<InstallDir>\\Servers\\ConfigurationServer*: - - **Note**   - If the configuration has been changed from the default, the files might be stored in a different location. - - - - - ClientPolicy.xml - - - ClientSettings.xml - - - ConfigurationFiles.xml - - - OrganizationPolicy.xml - - - WorkspaceKeys.xml - - **Note**   - The ServerSettings.xml file can be backed up as well. However, if a specific configuration has been changed (for example, on the original server, the MED-V VMS directory is located in "*C:\\Vms*" and such a directory does not exist on the new server), it can cause an error. - - - -**To restore a MED-V server** - -1. Install a new MED-V server. - -2. Copy the backup files to the following directory: - - *<InstallDir>\\Servers\\ConfigurationServer* - -3. Restart the MED-V service. - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-a-deployment-package.md b/mdop/medv-v1/how-to-configure-a-deployment-package.md deleted file mode 100644 index 6d2a5b4f31..0000000000 --- a/mdop/medv-v1/how-to-configure-a-deployment-package.md +++ /dev/null @@ -1,162 +0,0 @@ ---- -title: How to Configure a Deployment Package -description: How to Configure a Deployment Package -author: dansimp -ms.assetid: 748272a1-6af2-476e-a3f1-87435b8e94b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure a Deployment Package - - -The Packaging wizard walks you through the creation of a package by creating a folder on your local computer and transferring all the required installation files to the single folder. The contents of the folder can then be moved to multiple removable media drives for distribution. - -**Note** -A single package cannot contain installation files for both x86 and x64 systems. - - - -## How to Create a Deployment Package - - -**To create a deployment package** - -1. Verify in the **Images** module that you have created at least one local packed image. - -2. On the **Tools** menu, select **Packaging wizard**. - -3. On the **Packaging wizard** welcome page, click **Next**. - -4. On the **Workspace Image** page, select the **Include image in the package** check box to include an image in the package. - - The **Image** field is enabled. - - **Note** - An image is not required in a MED-V package; the package can be created without an image. In such a case, the image should be uploaded to the server so that it can later be downloaded over the network to the client, or pushed to an image pre-stage folder. - - - -5. Click the **Image** list to view all available images. Select the image to be copied to the package. Click **Refresh** to refresh the list of available images. - -6. Click **Next**. - -7. On the **MED-V Installation Settings** page, select the MED-V installation file by doing one of the following: - - - In the **MED-V installation file** field, type the full path to the directory where the installation file is located. - - - Click **...** to browse to the directory where the installation file is located. - - **Note** - This field is mandatory, and the wizard will not continue without a valid file name. - - - -8. In the **Server address** field, type the server name or IP address. - -9. In the **Server port** field, type the server port. - -10. Select the **Server is accessed using https** check box to require an https connection to connect to the server. - -11. Do one of the following: - - - Click **Default installation settings**, and then click **Next** to continue and leave the default settings. - - - Click **Custom installation settings**, and then click **Next** to customize the installation settings. - - 1. On the **MED-V Installation Custom Settings** page, in the **Installation folder** field, type the path of the folder where the MED-V files will be installed on the host computer. - - **Note** - It is recommended to use variables in the path rather than constants, which might vary from computer to computer. - - For example, use *%ProgramFiles%\\MED-V* instead of *c:\\MED-V*. - - - - ~~~ - 2. In the **Virtual machines images folder** field, type the path of the folder where the virtual images files will be installed on the host computer. - - **Note** - If you are using image pre-staging, this is the image pre-stage folder where the image is located. - - - - 3. In the **Minimal required RAM** field, enter the RAM required to install a MED-V package. If the user installing the MED-V package does not have the minimal required RAM, the installation will fail. - - 4. Select the **Install the MED-V management application** check box to include the MED-V management console application in the installation. - - 5. Select the **Create a shortcut to MED-V on the desktop** check box to create a shortcut to MED-V on the host's desktop. - - 6. Select the **Start automatically on computer startup** check box to start MED-V automatically on startup. - - 7. Click **Next**. - ~~~ - -12. On the **Additional Installations** page, select the **Include installation of virtualization software** check box to include the Virtual PC installation in the package. - - The **Installation file** field is enabled. Type the full path of the virtualization software installation file, or click **...** to browse to the directory. - -13. Select the **Include installation of Virtual PC QFE** check box to include Virtual PC update installation in the package. - - The **Installation file** field is enabled. Type the full path of the Virtual PC update installation file, or click **...** to browse to the directory. - -14. Select the **Include installation of Microsoft .NET Framework 2.0** check box to include the Microsoft .NET Framework 2.0 installation in the package. - - The **Installation file** field is enabled. Type the full path of the Microsoft .NET Framework 2.0 installation file, or click **...** to browse to the directory. - -15. Click **Next**. - -16. On the **Finalize** page, select the location where the package should be saved by doing one of the following: - - - In the **Package destination** field, type the full path to the directory where the package should be saved. - - - Click **...** to browse to the directory where the installation files should be saved. - - **Note** - Building the package might consume more space than the actual package size. It is therefore recommended to build the package on the hard drive. After the package is created, it can then be copied to the USB. - - - -17. In the **Package name** field, enter a name for the package. - -18. Click **Finish** to create the package. - - The package is created. This might take several minutes. - - After the package is created, a message appears notifying you that it has been completed successfully. - -**Note** -If you saved all the files locally, and not directly on the removable media, ensure that you copy only the contents of the folder and not the folder itself to the removable media. - - - -**Note** -The removable media must be large enough so that the package contents consume a maximum of only three-quarters of the removable media's memory. - - - -**Note** -When creating the package, up to double the size of the actual package size might be required when the build is complete. - - - -## Related topics - - -[Creating a MED-V Image](creating-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md b/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md deleted file mode 100644 index 7669269fc7..0000000000 --- a/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: How to Configure a Domain User or Group -description: How to Configure a Domain User or Group -author: dansimp -ms.assetid: 055aba81-a9c9-4b98-969d-775e603becf3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure a Domain User or Group - - -The deployment settings enable you to control which users or groups can access the MED-V workspace, as well as how long the MED-V workspace can be utilized and whether it can be used offline. You can also configure additional rules to control access between the MED-V workspace and the host. - -All MED-V workspace permissions are configured in the **Policy** module, on the **Deployment** tab. - -To allow users to utilize the MED-V workspace, you must first add domain users or groups to the MED-V workspace permissions. You can then set permissions for each user or group. - -## How to Add a Domain User or Group - - -**To add a domain user or group** - -1. In the **Users / Groups** window, click **Add.** - -2. In the **Enter User or Group names** dialog box, select domain users or groups by doing one of the following: - - - In the **Enter User or Group names** field, type a user or group that exists in the domain or as a local user or group on the computer. Then click **Check Names** to resolve it to the full existent name. - - - Click **Find** to open the standard **Select Users or Groups** dialog box. Then select domain users or groups. - -3. Click **OK**. - - The domain users or groups are added. - - **Note** - Users from trusted domains should be added manually. - - - -~~~ -**Warning** -Do not run the management application from a computer that is part of a domain that is not trusted by the domain the server is installed on. -~~~ - - - -## How to Remove a Domain User or Group - - -**To remove a domain user or group** - -1. In the **Users / Groups** window, select a user or group. - -2. Click **Remove**. - - The user or group is deleted. - -## How to Set Permissions for a User or a Group - - -**To set permissions for a user or a group** - -1. Click the user or group for which you are setting the permissions. - -2. Configure the MED-V workspace properties as described in the following table. - -3. On the **Policy** menu, select **Commit**. - -**Workspace Deployment Properties** - -Property -Description -*General* - -Enable Workspace for <user or group> - -Select this check box to enable the MED-V workspace for this user or group. - -Workspace expires on this date - -Select this check box to assign an expiration date for the permissions set for this user or group. - -When selected, the date box is enabled. Set the date, and permissions will expire at the end of the date specified. - -Offline work is restricted to - -Select this check box to assign a time period in which the policy must be refreshed for this user or group. When selected, the time period box is enabled. Set the number of days or hours, and at the end of the specified time period, the user or group will not be able to connect if the policy is not refreshed. - -Workspace deletion options - -Click to set the MED-V workspace deletion options. For more information, see [How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md). - -*Data Transfer* - -Support clipboard between host and Workspace - -Select this check box to enable copying and pasting between the host and the MED-V workspace. - -Support file transfer between the host and Workspace - -Select this check box to enable transferring files between the host and MED-V workspace. Select one of the following options from the **File Transfer** box: - -- **Both**—Enable transferring files between the host and the MED-V workspace. - -- **Host to Workspace**—Enable transferring files from the host to the MED-V workspace. - -- **Workspace to Host**—Enable transferring files from the MED-V workspace to the host. - -**Note** -If a user without permissions attempts to transfer files, a window will appear prompting him to enter the credentials of a user with permissions to perform the file transfer. - - - -**Important** -To support file transfer in Windows XP SP3, you must disable offline file synchronization by editing the registry as follows: - -`REG ADD HKLM\software\microsoft\windows\currentversion\netcache /V Enabled /T REG_DWORD /F /D 0` - - - -Advanced - -Click to set the advanced file transfer options. For more information, see [How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md). - -*Device Control* - -Enable printing to printers connected to the host - -Select this check box to enable users to print from the MED-V workspace using the host printer. - -**Note** -The printing is performed by the printers defined on the host. - - - -Enable access to CD / DVD - -Select this check box to allow access to a CD or DVD drive from this MED-V workspace. - - - -**Multiple Memberships** - -1. If the user is part of a group and permissions are applied to the user as well as to the group they are part of, all permissions are applied. - -2. If the user is a member of two different groups, the least restrictive permissions are applied. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md) - -[How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-image-pre-staging.md b/mdop/medv-v1/how-to-configure-image-pre-staging.md deleted file mode 100644 index 5503edfefa..0000000000 --- a/mdop/medv-v1/how-to-configure-image-pre-staging.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: How to Configure Image Pre-staging -description: How to Configure Image Pre-staging -author: dansimp -ms.assetid: 92781b5a-208f-45a4-a078-ee90cf9efd9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Image Pre-staging - - -**Note**   -Image pre-staging is useful only for the initial image download. It is not supported for image update. - - - -## How to Configure Image Pre-staging - - -**To configure image pre-staging** - -1. On the client computer, under the image store directory, create a folder for the pre-staging image, and name it *MED-V Images*. - - **Note**   - This folder must be called *MED-V Images*. - - - -2. Inside the MED-V Images folder, create a subfolder and name it *PrestagedImages*. - - **Note**   - This folder must be called *PrestagedImages*. - - - -3. To apply Access Control Lists (ACL) security to the *MED-V Images* folder, set the following ACL: - - **NT AUTHORITY\\Authenticated Users:(OI)(CI)(special access:)** - - **READ\_CONTROL** - - **SYNCHRONIZE** - - **FILE\_GENERIC\_READ** - - **FILE\_READ\_DATA** - - **                                 FILE\_APPEND\_DATA** - - **FILE\_READ\_EA** - - **FILE\_READ\_ATTRIBUTES** - - **NT AUTHORITY\\SYSTEM:(OI)(CI)F** - - **BUILTIN\\Administrators:(OI)(CI)F** - - **Note**   - It is recommended to apply ACL security to the *MED-V Images* folder. - - - -4. To apply ACL security to the *PrestagedImages* folder, set the following ACL: - - **NT AUTHORITY\\Authenticated Users:(OI)(CI)(special access:)** - - **READ\_CONTROL** - - **SYNCHRONIZE** - - **FILE\_GENERIC\_READ** - - **FILE\_READ\_DATA** - - **FILE\_READ\_EA** - - **FILE\_READ\_ATTRIBUTES** - - **NT AUTHORITY\\SYSTEM:(OI)(CI)F** - - **BUILTIN\\Administrators:(OI)(CI)F** - - **Note**   - It is recommended to apply ACL security to the *PrestagedImages* folder. - - - -5. Push the image files (CKM and INDEX files) to the *PrestagedImages* folder. - - **Note**   - After the image files have been pushed to the pre-stage folder, it is recommended to run a data integrity check and to mark the files as read-only. - - - -6. Include the following parameter in the MED-V client installation: *Client.MSI VMSFOLDER=”C:\\MED-V Images”*. - -## How to Update the Pre-stage Location - - -**To update the pre-stage location** - -1. The registry key, *PrestagedImagesPath*, points to the default image location. It is located in the following directory: - - - On an x86 - `KEY_LOCAL_MACHINE\SOFTWARE\Kidaro` - - - On an x64 - `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432node` - -2. If the image is in a different location, change the path. - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md b/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md deleted file mode 100644 index 5d812e35d6..0000000000 --- a/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md +++ /dev/null @@ -1,240 +0,0 @@ ---- -title: How to Configure Published Applications -description: How to Configure Published Applications -author: dansimp -ms.assetid: 43a59ff7-5d4e-49dc-84e5-1082bc4dd8f4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Published Applications - - -Applications that are not compatible with the host operating system can be run within the MED-V workspace and initiated from within the MED-V workspace the same way they are initiated from the desktop—from the Start menu or from a local host shortcut. Applications selected and defined are called published applications. The procedures in this section describe how to add and remove published applications. - -An application can be published in one of the following ways: - -- As an application—Select a specific application by typing in the command line for the application. Only the application selected is published. - -- As a menu—Select a folder that contains multiple applications. All applications within the folder are published and displayed as a menu. - -## How to Add a Published Application to a MED-V Workspace - - -**To add an application to the MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. In the **Applications** pane, in the **Published Applications** section, click **Add** to add a new application. - -3. Configure the application properties as described in the following table. - -4. On the **Policy** menu, select **Commit**. - - **Note** - If you are setting Internet Explorer as a published application to ensure that Web redirection works properly, make certain that any parameters are not in parentheses. - - - -**Published Application Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Enabled

    Select this check box to enable the published application.

    Display name

    The name of the shortcut in the user's Windows Start menu.

    -
    -Note

    The display name is not case sensitive.

    -
    -
    - -

    Description

    A description of the published application, which appears as a tooltip when the user's mouse hovers over the shortcut.

    Command line

    The command used to run the application from within the MED-V workspace. The full path is required, and the parameters can be passed to the application in a similar fashion as in any other Windows command.

    -

    In a revertible MED-V workspace, you can map a network drive with MapNetworkDrive syntax: "MapNetworkDrive <drive> <path>"—for example, "MapNetworkDrive t: \tux\date".

    -

    For example, to publish Windows Explorer, use the following syntax: "c:</em>" or "c:\windows."

    -
    -Note

    To have a name resolution, you need to perform one of the following:

    -
    -
    - -
    -
      -
    • Configure the DNS in the base MED-V workspace image.

    • -
    • Verify the DNS resolution is defined in the host, and configure it to use the host DNS.

    • -
    • Use the IP for defining the network drive.

    • -
    -
    -Note

    If the path includes spaces, the entire path must be inside quotation marks.

    -
    -
    - -
    -
    -Note

    The path should not end with a backslash ().

    -
    -
    - -

    Start menu

    Select this check box to create a shortcut for the application in the user's Windows Start menu.

    - - - -All published applications appear as shortcuts in the Windows **Start** menu (**Start >All Programs> MED-V Applications**). - -## How to Remove a Published Application from a MED-V Workspace - - -**To remove an application from the MED-V workspace** - -1. Click a MED-V workspace. - -2. In the **Applications** pane, in the **Published Applications** section, select an application to remove. - -3. Click **Remove**. - - The application is removed from the list of published applications. - -4. On the **Policy** menu, select **Commit**. - -## How to Add a Published Menu to a MED-V Workspace - - -**To add a published menu to the MED-V workspace** - -1. Click the MED-V workspace to configure. - -2. In the **Applications** pane, in the **Published Menus** section, click **Add** to add a new menu. - -3. Configure the menu properties as described in the following table. - -4. On the **Policy** menu, select **Commit**. - -**Published Menu Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Enabled

    Select this check box to enable the published menu.

    Display name

    The name of the shortcut in the user's Windows Start menu.

    Description

    The description, which appears as a tooltip when the user's mouse hovers over the shortcut.

    Folder in workspace

    Select the folder to publish as a menu containing all the applications within the folder.

    -

    The text displayed is a relative path from the Programs folder.

    -
    -Note

    If left blank, all programs on the host will be published as a menu.

    -
    -
    - -
    - - - -All published menus appear as shortcuts in the Windows **Start** menu (**Start >All Programs> MED-V Applications**). You can change the name of the shortcut in the **Start-menu shortcuts folder** field. - -**Note** -When configuring two MED-V workspaces, it is recommended to configure a different name for the Start menu shortcuts folder. - - - -## How to Remove a Published Menu from a MED-V Workspace - - -**To remove a published menu from a MED-V workspace** - -1. Click a MED-V workspace. - -2. In the **Applications** pane, in the **Published Menus** section, select a menu to remove. - -3. Click **Remove**. - - The menu is removed from the list of published menus. - -4. On the **Policy** menu, select **Commit**. - -## Running a Published Application from a Command Line on the Client - - -The administrator can run published applications from any location, such as a desktop shortcut, using the following command: - -``` syntax -"\Manager\KidaroCommands.exe" /run "" "" -``` - -**Note** -The MED-V workspace in which the published application is defined must be running. - - - -## Related topics - - -[How to Edit a Published Application with Advanced Settings](how-to-edit-a-published-application-with-advanced-settings.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md b/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md deleted file mode 100644 index 3db5f49a03..0000000000 --- a/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to Configure the Image Web Distribution Server -description: How to Configure the Image Web Distribution Server -author: dansimp -ms.assetid: 2d32ae79-dff5-4c05-a412-dd15452b6007 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Configure the Image Web Distribution Server - - -An image repository is an optional server that is used for image distribution (where administrators upload new images and client computers check the server every 15 minutes and update their image if a new one is available). - -## - - -An image distribution server requires the following: - -- Internet Information Services (IIS)—For information, see [Internet Information Services](https://go.microsoft.com/fwlink/?LinkId=142995). - - During the IIS installation, when adding role services, select the following supported authentication methods: - - - **Basic Authentication** - - - **Windows Authentication** - - - **Client Certificate Mapping Authentication** - - When configuring IIS, include the following: - - - Add a virtual directory, with the alias named **MEDVImages**. The physical path should point to the location of the images. - - - Enable BITS. - - - Add the following MIME types: - - - **.ckm (application/octet-stream)** - - - **.index (application/octet-stream**) - - - On the MED-V site, add read permissions to **Everyone**. - - - Restart IIS. - -- BITS Server Extensions for IIS—For information, see [Install BITS Server Extensions](https://go.microsoft.com/fwlink/?LinkId=142996). - -## Related topics - - -[Supported Configurations](supported-configurationsmedv-orientation.md) - -[Design the MED-V Image Repositories](design-the-med-v-image-repositories.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md deleted file mode 100644 index 61a363f290..0000000000 --- a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: How to Configure the Virtual Machine Setup for a MED-V Workspace -description: How to Configure the Virtual Machine Setup for a MED-V Workspace -author: dansimp -ms.assetid: a4659b4d-18b2-45b1-9605-8b5adc438f53 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Virtual Machine Setup for a MED-V Workspace - - -The procedures in this section describe how to configure the virtual machine for first-time setup. - -The virtual machine setup configures the setup performed when the virtual machine is run on the client for the first time. The virtual machine setup is configured differently for persistent and revertible MED-V workspaces. For more information about persistent and revertible MED-V workspaces, see [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md). - -## In This Section - - -[How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md) -Describes how to configure the virtual machine setup for persistent and revertible MED-V workspaces. - -[How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md) -Describes how to configure virtual machine computer name pattern properties for persistent and revertible MED-V workspaces. - -[Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md) -Provides examples of virtual machine configurations in both persistent and revertible MED-V workspaces. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[How to Set Up Script Actions](how-to-set-up-script-actions.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md deleted file mode 100644 index aded377291..0000000000 --- a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: How to Configure the Virtual Machine Setup for a MED-V Workspace -description: How to Configure the Virtual Machine Setup for a MED-V Workspace -author: dansimp -ms.assetid: 50bbf58b-842c-4b63-bb93-3783903f6c7d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure the Virtual Machine Setup for a MED-V Workspace - - -All virtual machine setup configuration settings are configured in the **Policy** module, on the **VM Setup** tab. - -## How to Configure the Virtual Machine Setup for a Persistent MED-V Workspace - - -**To configure the virtual machine setup for a persistent MED-V workspace** - -1. Click a persistent MED-V workspace to be configured. - -2. In the **Persistent VM Setup** section, configure the properties as described in the following table. - - **Note** - The persistent VM setup properties are enabled only for a persistent MED-V workspace. - - - -3. On the **Policy** menu, select **Commit**. - -**Persistent VM Setup Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Run VM Setup

    Select this check box to run a setup script the first time the MED-V workspace is run.

    Script Editor

    Click to configure the setup script. For more information, see How to Set Up Script Actions.

    -
    -Note

    This button is enabled only when Run VM Setup script is selected.

    -
    -
    - -

    Message displayed when script is running

    A message to be displayed while the script is running. If left blank, the default message is displayed.

    -
    -Note

    This field is enabled only when Run VM Setup script is checked.

    -
    -
    - -
    - - - -## How to Configure the Virtual Machine Setup for a Revertible MED-V Workspace - - -**To configure the virtual machine setup for a revertible MED-V workspace** - -1. Click a revertible MED-V workspace to configure. - -2. In the **Revertible VM Setup** section, configure the properties as described in the following table. - - **Note** - The revertible VM setup properties are enabled only for a revertible MED-V workspace. - - - -3. On the **Policy** menu, select **Commit**. - -**Revertible VM Setup Properties** - - ---- - - - - - - - - - - - - -
    PropertyDescription

    Rename the VM based on the computer name pattern

    Select this check box to assign a unique name to each computer using the MED-V workspace so that you can differentiate between multiple computers using the same MED-V workspace.

    -

    For more information on configuring computer image names, see How to Configure VM Computer Name Pattern Properties.

    - - - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md b/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md deleted file mode 100644 index 6bea34fef3..0000000000 --- a/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md +++ /dev/null @@ -1,137 +0,0 @@ ---- -title: How to Configure VM Computer Name Pattern Properties -description: How to Configure VM Computer Name Pattern Properties -author: dansimp -ms.assetid: ddf79ace-8cc3-4ee6-be5a-5940b4df5c36 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure VM Computer Name Pattern Properties - - -A virtual machine computer name pattern can be assigned both for revertible and for persistent MED-V workspaces. - -- Revertible—Administrators can assign a unique name to each revertible MED-V workspace instance to differentiate between multiple computers using the same MED-V workspace. - -- Persistent—In a persistent MED-V workspace, administrators can set a computer to be renamed during a setup script. - -## How to Assign a Virtual Machine Computer Name Pattern to a Revertible MED-V Workspace - - -**To assign a virtual machine computer name pattern to a revertible MED-V workspace** - -1. Click the revertible MED-V workspace to configure. - -2. In the **Revertible VM Setup** section, select the **Rename the VM based on the computer name pattern** check box. - -3. In the **VM Computer Name Pattern** section, enter the pattern to use for naming virtual machine images, using the following options: - - - **Constant**—Enter free text that will be constant on all computers using the MED-V workspace. - - - **Variable**—Enter a variable, by clicking **Insert Variable**, and select from one of the following: - - - **User name** - - - **Domain name** - - - **Host name** - - - **Workspace name** - - - **Virtual machine name** - - The variable selected will be specific to the computer using the MED-V workspace. For example, if **Domain name** is selected, the unique name for each computer will include the computer's domain name. - - - **Random characters**—Enter “\#” for each random character to include in the pattern. Each computer using the MED-V workspace will have a suffix of the length specified, which is generated randomly. - - **Note** - The computer name has a limit of 15 characters. If the pattern exceeds the limit, it will be truncated. - - - -4. On the **Policy** menu, select **Commit**. - - **Note** - A revertible VM computer name pattern can be assigned only when **Rename the VM based on the computer name patterns** (in the **Revertible VM Setup** section) is checked. - - - -~~~ -**Note** -A unique computer name can be assigned only if it is configured prior to MED-V workspace setup. Changing the name will not affect MED-V workspaces that were already set up. -~~~ - - - -## How to Assign a Virtual Machine Computer Name Pattern to a Persistent MED-V Workspace - - -**To assign a virtual machine computer name pattern to a persistent MED-V workspace** - -1. Click the persistent MED-V workspace to configure. - -2. In the **Persistent VM Setup** section, click **Script Editor**. - -3. In the **Script Actions** dialog box, click **Add**, and on the submenu, click **Rename Computer**. - -4. Click **OK** to close the **Script Actions** dialog box. - -5. On the **VM Setup** tab, in the **VM Computer Name Pattern** section, enter the pattern to use for renaming the computer, using the following: - - - **Constant**— Enter free text that will be included in the computer name. - - - **Variable**—Enter a variable, by clicking **Insert Variable**, and select from one of the following: - - - **User name** - - - **Domain name** - - - **Host name** - - - **Workspace name** - - - **Virtual machine name** - - The variable selected will be specific to the computer that is being renamed. For example, if **Domain name** is selected, the computer name will include the computer's domain name. - - - **Random characters**— Enter “\#” for each random character to include in the pattern. The computer will have a suffix of the length specified, which is generated randomly. - - **Note** - The computer name has a limit of 15 characters. If the pattern exceeds the limit, it will be truncated. - - - -6. On the **Policy** menu, select **Commit**. - - **Note** - The computer will be renamed only if it is set as an action in the **Script Actions** dialog box. For detailed information, see [How to Set Up Script Actions](how-to-set-up-script-actions.md). - - - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[How to Set Up Script Actions](how-to-set-up-script-actions.md) - -[Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md b/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md deleted file mode 100644 index 463ab388e1..0000000000 --- a/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md +++ /dev/null @@ -1,139 +0,0 @@ ---- -title: How to Configure Web Settings for a MED-V Workspace -description: How to Configure Web Settings for a MED-V Workspace -author: dansimp -ms.assetid: 9a6cd28f-7e4f-468f-830a-7b1d9abd3af3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Configure Web Settings for a MED-V Workspace - - -Web sites that can only be displayed in older versions of Internet Explorer and that do not exist in the host operating system can be viewed in older versions of Internet Explorer within the MED-V workspace. The user does not need to open a browser in the MED-V workspace to view the specified Web sites. The user can open a browser on the host and automatically be redirected to the MED-V workspace and vice versa. - -The following procedures describe how you can set a list of Web browsing rules for a MED-V workspace. All sites included in the rules can be browsed either in the MED-V workspace or on the host, as defined by the administrator. All sites not defined within the rules are browsed from the environment in which they were requested. However, you can configure them as a group as well, to be browsed in the MED-V workspace or the host. - -**Note** -Web settings are applied only to Internet Explorer and to no other browsers. - - - -All Web settings are configured in the **Policy** module, on the **Web** tab. - -## How to Configure Web Settings for the MED-V Workspace - - -**To configure Web settings for the MED-V workspace** - -1. Click the MED-V workspace to be configured. - -2. Select the **Browse the list of URLs defined in the following table** check box to redirect the user to a browser within the MED-V workspace or host, when the user browses to a URL that conforms to the Web rules specified. - -3. Click one of the following: - - - **In the Workspace**—Redirect to a browser in the MED-V workspace. - - - **In the host**—Redirect to a browser on the host. - -4. Select the **Browse all other URLs** check box to redirect all URLs excluded from the Web rules to the host or MED-V workspace. - -5. Click one of the following: - - - **In the Workspace**—Redirect all other URLs to a browser in the MED-V workspace. - - - **In the host**—Redirect all other URLs to a browser on the host. - -6. On the **Policy** menu, select **Commit**. - -## How to Add a Web Rule - - -**To add a Web rule** - -1. Select the **Browse the list of URLs defined in the following table** check box to enable the Web browsing rules. - -2. Click **Add**. - - A new Web rule is added. - -3. Configure the Web rule properties as described in the following table. - -4. On the **Policy** menu, select **Commit**. - -**MED-V Workspace Web Properties** - - ---- - - - - - - - - - - - - - - - - -
    PropertyDescription

    Type

      -
    • Domain suffix—Access to any host address ending with the suffix specified in the Value property and is set according to the option set in Web Browsing.

    • -
    • IP Prefix—Access to any full or partial IP address in the range of the prefix specified in the Value property and is set according to the option set in Web Browsing.

    • -
    • All Local Addresses—Access to all addresses without a '.' and is set according to the option set in Web Browsing.

    • -

    Value

      -
    • If Domain suffix is selected in the Type property, enter a domain suffix.

      -
      -Note
        -
      • Do not enter "*" before the suffix.

      • -
      • Domain suffixes support aliases as well.

      • -
      -
      -
      - -
    • -
    • If IP Prefix is selected in the Type property, enter a full or partial IP address.

    • -
    - - - -## How to Delete a Web Rule - - -**To delete a Web rule** - -1. In the **Web** pane, select the Web rule to delete. - -2. Click **Remove**. - - The Web rule is deleted. - -## Related topics - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md b/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md deleted file mode 100644 index c63893f150..0000000000 --- a/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md +++ /dev/null @@ -1,156 +0,0 @@ ---- -title: How to Create and Test a MED-V Image -description: How to Create and Test a MED-V Image -author: dansimp -ms.assetid: 40e4aba6-12cb-4794-967d-2c09dc20d808 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create and Test a MED-V Image - - -The MED-V administrator creates a MED-V image so that it can be uploaded, associated with a MED-V workspace, and then distributed to the client over the Web, added to a MED-V package, or downloaded to the client by using a third-party system. It is recommended to first create a test image and test it on MED-V client before deploying it. - -When creating a MED-V image, it goes through the following stages: - -1. **Local test image**—A basic image that can be tested locally. - -2. **Local packed image**—After the image is tested, the image is packed as it existed prior to testing. No changes made during testing are included in the packed image. - -3. **Packed image on server**—The packed image is uploaded to the server. - -## How to Create a MED-V Test Image - - -**To create a new MED-V test image** - -1. Click the **Images** management button. - - The **Images** module appears. - - - The **Images** module consists of the following panes: - - - **Local Test Images**—Local unpacked images. - - - **Local Packed Images**—All packed images on the local computer. - - - **Packed Images on Server**—All images that have been packed and uploaded to the server. - - - In the **Local Packed Images** and **Packed Images on Server** panes, the most recent version of each image is displayed as the parent node. Click the parent node to view all other existing versions of the image. - -2. In the **Local Test Images** pane, click **New**. - -3. On the **Test Image Creation** dialog box, select the virtual machine image that you want to configure as a MED-V test image by doing one of the following: - - - In the **Base image** file field, type the full path to the directory where the Microsoft Virtual PC image prepared for MED-V is located. - - - Click **Browse** to browse to the directory where the Microsoft Virtual PC image prepared for MED-V is located. - -4. In the **Image name** field, type or select the desired name. - - **Note**   - The following characters cannot be included in the image name: space " < > | \\ / : \* ? - - - -5. Click **OK**. - - A new MED-V test image is created on your host computer with the properties defined in the following table. - - For more information about configuring the MED-V workspace image, refer to [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md). - -**Local Test Images Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Image Name

    The name of the test image as it was defined when the administrator created the image.

    Image Path

    The local path of the test image.

    Created

    The date the test image was created.

    - - - -## How to Test a MED-V Image from the MED-V Client - - -After a MED-V test image is created, use the following procedure to test the image locally. - -**To test a MED-V image** - -1. Click the **Policy** management button. - -2. In the **Policy** module, assign the MED-V test image to a MED-V workspace by doing the following: - - 1. Click the **Virtual Machine** tab. - - 2. In the **Assigned Image** field, select the MED-V test image you created. If your test image is not in the list, click **Refresh**. - - 3. On the toolbar, click **Save changes**. - -3. Configure any other MED-V workspace settings to be tested. For more information, see [Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md). - -4. Start MED-V client. - -5. In the **Confirm Running Test** confirmation box, click **Use Test Image**. - -6. Test the MED-V workspace test image. - - For information about starting and running MED-V client, see [MED-V Client Operations](med-v-client-operations.md). - -**Note**   -While testing an image, do not open VPC and make changes to the image. - - - -**Note**   -When testing an image, no changes are saved to the image between sessions; instead, they are saved in a separate, temporary file. This is to ensure that when the image is packed and run on the production environment, it is the original, clean image. - - - -## Related topics - - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md) - -[MED-V Client Operations](med-v-client-operations.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-delete-a-med-v-image.md b/mdop/medv-v1/how-to-delete-a-med-v-image.md deleted file mode 100644 index 02d9bb6115..0000000000 --- a/mdop/medv-v1/how-to-delete-a-med-v-image.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: How to Delete a MED-V Image -description: How to Delete a MED-V Image -author: dansimp -ms.assetid: 974a493a-7627-4c64-9294-89441f127916 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Delete a MED-V Image - - -## How to Delete a MED-V Image - - -**To delete a MED-V image** - -1. Click the image or the version of the image to delete. - -2. On the **Images** menu, click **Delete**. - - The image is deleted. - -## Related topics - - -[How to Create and Test a MED-V Image](how-to-create-and-test-a-med-v-image.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md b/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md deleted file mode 100644 index d849956376..0000000000 --- a/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: How to Deploy a Workspace Image -description: How to Deploy a Workspace Image -author: dansimp -ms.assetid: b2c77e0d-101d-4956-a27c-8beb0e4f262e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy a Workspace Image - - -When using a deployment package, a new image can be deployed onto client computers in one of the following ways: - -- [Web download](#bkmk-howtodeployaworkspaceimageviatheweb) - -- [Image pre-staging](#bkmk-howtodeployaworkspaceimageusingimageprestaging) - -- [Deploying the image inside the deployment package](#bkmk-howtodeployaworkspaceimageusingadeploymentapackage) - -## How to Deploy a Workspace Image via the Web - - -**To deploy a workspace image via the Web** - -1. Upload the MED-V image to the server. - - For information on uploading the image, see [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md). - -2. Create a deployment package, and include the server path to the location of the image. - - For information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). - -3. Deploy the package to end users. - - For information on deploying the package, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). - - MED-V client is installed and started for the first time. On first-time startup, the client downloads the image from the server address specified in the client installation. - -## How to Deploy a Workspace Image Using Image Pre-staging - - -**To deploy a workspace image using image pre-staging** - -1. Create an image pre-stage folder, and push the image to the folder. - - For information on configuring image pre-staging, see [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md). - -2. Create a deployment package, and include the path to the image pre-stage folder. - - For information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). - -3. Deploy the package to end users. - - For information on deploying the package, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). - - MED-V client is installed and started for the first time. On first-time startup, the client fetches the image from the pre-stage folder specified in the client installation. - -## How to Deploy a Workspace Image Using a Deployment Package - - -**To deploy a workspace image using a deployment package** - -1. Create a deployment package, and include the image in the package. - - For information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). - -2. Deploy the package to end users. - - For information on deploying the package, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). - - The image is imported to the host as part of the package installation. - -## Related topics - - -[How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) - -[How to Configure a Deployment Package](how-to-configure-a-deployment-package.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md b/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md deleted file mode 100644 index 5eb6dd5c1c..0000000000 --- a/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: How to Deploy a Workspace Image -description: How to Deploy a Workspace Image -author: dansimp -ms.assetid: ccc8e89b-1625-4b58-837e-4c6d93d46070 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy a Workspace Image - - -When using an enterprise software distribution system, a new image can be deployed onto client computers in one of the following ways: - -- [Web download](#bkmk-howtodeployaworkspaceimageviatheweb) - -- [Image pre-staging](#bkmk-howtodeployaworkspaceimageusingimageprestaging) - -## How to Deploy a Workspace Image via the Web - - -**To deploy a workspace image via the Web** - -1. Upload the MED-V image to the server. - - For information on uploading the image, see [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md). - -2. Using your enterprise software distribution system, install the MED-V client .msi package on users’ computers. - - For information on installing the MED-V client .msi package, see [How to Install MED-V Client](how-to-install-med-v-clientesds.md). - - MED-V client is installed and started for the first time. On first-time startup, the client downloads the image from the server address specified in the client installation. - -## How to Deploy a Workspace Image Using Image Pre-staging - - -**To deploy a workspace image using image pre-staging** - -1. Create an image pre-stage folder, and push the image to the folder. - - For information on configuring image pre-staging, see [How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md). - -2. Using your enterprise software distribution system, install the MED-V client .msi package on users’ computers. - - For information on installing the MED-V client .msi package, see [How to Install MED-V Client](how-to-install-med-v-clientesds.md). - - MED-V client is installed and started for the first time. On first-time startup, the client fetches the image from the pre-stage folder specified in the client installation. - -## Related topics - - -[How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md b/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md deleted file mode 100644 index babf8996d1..0000000000 --- a/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: How to Edit a Published Application with Advanced Settings -description: How to Edit a Published Application with Advanced Settings -author: dansimp -ms.assetid: 06a79049-9ce9-490f-aad7-fd4fdf185590 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Edit a Published Application with Advanced Settings - - -After a published application has been added and configured, the published application can be edited and additional advanced settings can be configured. - -**To edit a published application with advanced settings** - -1. In the **Applications** pane, add and configure a published application. - -2. Select the published application to edit. - -3. Click **Edit**. - -4. In the **Published Application** dialog box, configure the parameters as described in the following table. - -5. Click **OK**. - -6. On the **Policy** menu, select **Commit**. - -**Editing Published Application Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Display name

    The name of the shortcut in the user's Windows Start menu.

    -
    -Note

    The display name is not case sensitive.

    -
    -
    - -

    Description

    A description of the published menu.

    Start in

    The directory from which to start the application.

    -
    -Note

    The path does not need to include quotation marks.

    -
    -
    - -

    Command line

    The command with which to run the application from within the MED-V workspace.

    -

    The full path is required, and the parameters can be passed to the application in a similar fashion as in any other Windows command.

    -

    In a domain configuration, a shared drive usually exists on the server where all domain computers map to. The directory should be mapped here, and if it is a folder that requires user authentication, the Use MED-V credentials to run this application check box must be selected.

    -

    In a revertible MED-V workspace, you can map a network drive with MapNetworkDrive syntax: "MapNetworkDrive <drive> <path>"—for example, "MapNetworkDrive t: \tux\data".

    -

    For example, to publish Windows Explorer, use the following syntax: "c:&quot; or "c:\windows".

    -
    -Note

    To have a name resolution, you need to perform one of the following:

    -
    -
    - -
    -
      -
    • Configure the DNS in the base MED-V workspace image.

    • -
    • Verify that the DNS resolution is defined in the host, and configure it to use the host DNS.

    • -
    • Use the IP for defining the network drive.

    • -
    -
    -Note

    If the path includes spaces, the entire path must be inside quotation marks.

    -
    -
    - -
    -
    -Note

    The path should not end with a backslash ().

    -
    -
    - -

    Add a shortcut in the host Windows Start menu

    Select this check box to create a shortcut for the application in the user's Windows Start menu.

    Launch this application when the Workspace is started

    Select this check box to run the application automatically when the MED-V workspace starts.

    Use MED-V credentials to run this application

    Select this check box to authenticate applications that request a user name and password using the MED-V credentials instead of the credentials set for the application.

    -
    -Note

    When using SSO, the command line should be C:\Windows\Explorer.exe "folder path". When not using SSO, the command line should be "folder path".

    -
    -
    - -
    - - - -## Related topics - - -[How to Configure Published Applications](how-to-configure-published-applicationsmedvv2.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-generate-reports-medvv2.md b/mdop/medv-v1/how-to-generate-reports-medvv2.md deleted file mode 100644 index e9219aa508..0000000000 --- a/mdop/medv-v1/how-to-generate-reports-medvv2.md +++ /dev/null @@ -1,313 +0,0 @@ ---- -title: How to Generate Reports -description: How to Generate Reports -author: dansimp -ms.assetid: 9f8ba28e-1993-4c11-a28a-493718051e5d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Generate Reports - - -The following report types can be created by administrators in MED-V: - -- [Status](#bkmk-generatingastatusreport)—Use the status report to review the current status of all active users and all MED-V workspaces of each user based on a defined period of time. This includes viewing computers that are currently connected to the server or, if they are not currently connected, the date and time they were last connected to the server, the status of each computer, and other relevant information. - -- [Activity Log](#bkmk-generatinganactivitylogreport)—Use this report to review events that originated from a specific host or user in a defined date range. - -- [Error Log](#bkmk-generatinganerrorlogreport)—Use this report to view errors that originated from a specific host or user in a defined date range. - -The report results can be sorted by any column by clicking the appropriate column name. - -The report results can be grouped by dragging a column header to the top of the report. Drag multiple column headers to group one column after another. - -## How to Generate a Status Report - - -**To generate a status report** - -1. Click the **Reports** management button. - -2. In the **Reports** module, on the **Report Types** menu, select **Status**, and click **Generate**. - - The Report Parameters dialog box appears. - -3. In the **Report Parameters** dialog box, in the **Number of days** field, enter a number or use the arrows to select the number of days to include in the status report, and click **OK**. - - A status report is generated. The report parameters are defined in the following table. - -**Client MED-V Workspace Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Time

    The date and time the event occurred.

    -
    -Note

    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.

    -
    -
    - -

    User Name

    The user who initiated the event.

    -
    -Note

    If the event occurred before a user logged on, the user name is SYSTEM.

    -
    -
    - -

    Host Name

    The name of the host computer.

    Workspace Name

    The name of the MED-V workspace.

    Workspace Computer Name

    The name of the computer the MED-V workspace is running on.

    Online

    The current state of the client computer:

    -
      -
    • Stopped

    • -
    • Started at <date and time the workspace was started>

    • -

    Client Version

    The version number of the client.

    Policy Version

    The policy version that the MED-V workspace is currently using.

    Image Name

    The name of the image.

    Image Version

    The image version that the MED-V workspace is currently using.

    -
    -Note

    MED-V workspace version can be Unknown if it has not yet been downloaded onto a computer.

    -
    -
    - -
    - - - -## How to Generate an Activity Log Report - - -**To generate an activity log report** - -1. Click the **Reports** management button. - - The Reports module appears. - -2. In the **Reports** module, on the **Report Types** menu, select **Activity Log**, and click **Generate**. - -3. In the **Report Parameters** dialog box, configure one or more of the following parameters: - - - **Number of days**—The number of days to display in the report. - - - **User name contains**—Any event where the user name contains the text entered is included in the report. - - - **Host name contains**—Any event where the host name contains the text entered is included in the report. - -4. Click **OK**. - - A report is generated with the events and dates selected. The report parameters are defined in the following table. - -**Activity Log Report Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Event ID

    The event ID.

    Severity

    Information, Error, Warning

    Category

    The module that the report is referring to.

    Description

    A description of the event.

    Time Received

    The date and time the event was received on the server.

    -
    -Note

    If the client is working offline, the server receives the reports when the client is online.

    -
    -
    - -
    -
    -Note

    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.

    -
    -
    - -

    Client Time

    The date and time the event occurred according to the client clock.

    Host Name

    The name of the host computer.

    User Name

    The user who initiated the event.

    Workspace Name

    The name of the MED-V workspace.

    Workspace Computer Name

    The name of the computer the MED-V workspace is running on.

    - - - -## How to Generate an Error Log Report - - -**To generate an error log report** - -1. Click the **Reports** management button. - -2. In the **Reports** module, on the **Report Types** menu, select **Error Log**, and click **Generate**. - -3. In the **Report Parameters** dialog box, configure one or more of the following parameters: - - - **Number of days**—The number of days to display in the report. - - - **User name contains**—Any event where the user name contains the text entered is included in the report. - - - **Host name contains**—Any event where the host name contains the text entered is included in the report. - -4. Click **OK**. - - A report is generated with the events and dates selected. The report parameters are defined in the following table. - -**Error Log Report Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Event ID

    The event ID.

    Category

    The module that the report is referring to.

    Description

    A description of the event.

    Time Received

    The date and time the event was received on the server.

    -
    -Note

    If the client is working offline, the server receives the reports when the client is online.

    -
    -
    - -
    -
    -Note

    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.

    -
    -
    - -

    Client Time

    The date and time the event occurred according to the client clock.

    Host Name

    The name of the host computer.

    User Name

    The user who initiated the event.

    Workspace Name

    The name of the MED-V workspace.

    - - - - - - - - - - - diff --git a/mdop/medv-v1/how-to-import-and-export-a-policy.md b/mdop/medv-v1/how-to-import-and-export-a-policy.md deleted file mode 100644 index aaa08137dc..0000000000 --- a/mdop/medv-v1/how-to-import-and-export-a-policy.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: How to Import and Export a Policy -description: How to Import and Export a Policy -author: dansimp -ms.assetid: c86455de-2096-4bb1-b9d3-22efb42f3317 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Import and Export a Policy - - -A MED-V workspace policy can be imported into MED-V or exported from MED-V. - -## How to Import a Policy - - -**To import an existing policy** - -1. In the **Policy** module, on the **Policy** menu, select **Import**. - -2. In the **Import policy** dialog box, browse to the file containing the policy to import. - -3. Click **Open**. - - The policy is imported, replacing the existing policy. - -## How to Export a Policy - - -**To export a policy** - -1. In the **Policy** module, on the **Policy** menu, select **Export**. - -2. In the **Export policy** dialog box, browse to the directory where the policy will be exported. - -3. Enter a name for the policy file. - -4. Click **Save**. - - The policy is exported. - -## Related topics - - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md b/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md deleted file mode 100644 index 16597d58b2..0000000000 --- a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md +++ /dev/null @@ -1,197 +0,0 @@ ---- -title: How to Install and Configure the MED-V Server Component -description: How to Install and Configure the MED-V Server Component -author: dansimp -ms.assetid: 2d3c5b15-df2c-4ab6-bf78-f47ef8ae7418 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Install and Configure the MED-V Server Component - - -This section explains how to [install](#bkmk-howtoinstallthemedvserver) and [configure](#bkmk-howtoconfigurethemedvserver) the MED-V server. - -## How to Install the MED-V Server - - -**To install the MED-V server** - -1. Install the MED-V Server .msi package. - - The MED-V Server .msi package is called *MED-V\_Server\_x.msi*, where x is the version number. - - For example, *MED-V\_Server\_1.0.65.msi*. - -2. When the **InstallShield Wizard Welcome** screen appears, click **Next**. - -3. On the **License Agreement** screen, read the license agreement, click **I accept the terms in the license agreement**, and then click **Next**. - - The **Destination Folder** screen appears, with the default installation folder displayed. - - The default installation folder is *%systemdrive%\\Program Files\\Microsoft Enterprise Desktop Virtualization\\*. - - - To change the folder where MED-V should be installed, click **Change** and browse to an existing folder. - -4. Click **Next**. - -5. On the **Ready to Install the Program** screen, click **Install**. - - The MED-V server installation starts. This can take several minutes, and the screen might not display text. During installation, several progress screens appear. If a message appears, follow the instructions provided. - -6. When the **InstallShield Wizard Completed** screen appears, click **Finish** to complete the wizard. - -**Note** -If you are installing the MED-V server via Microsoft Remote Desktop, use the following syntax: **mstsc/admin**. Ensure that your RDP session is directed to the console. - - - -## How to Configure the MED-V Server - - -The following server settings can be configured: - -- [Connections](#bkmk-configuringconnections) - -- [Images](#bkmk-configuringimages) - -- [Permissions](#bkmk-configuringpermissions) - -- [Reports](#bkmk-configuringreports) - -### Configuring Connections - -**To configure connections** - -1. On the Windows Start menu, select **All Programs > MED-V > MED-V Server Configuration Manager**. - - **Note** - Note: If you selected the **Launch MED-V Server Configuration Manager** check box during the server installation, the MED-V server configuration manager starts automatically after the server installation is complete. - - - -~~~ -The MED-V Server Configuration Manager appears. -~~~ - -2. On the **Connections** tab, configure the following client connections settings: - - - **Enable unencrypted connections (http), using port**—Select this check box to enable unencrypted connections using a specified port. In the port box, enter the server port on which to accept unencrypted connections (http). - - - **Enable encrypted connections (https), using port**—Select this check box to enable encrypted connections using a specified port. In the port box, enter the server port on which to accept encrypted connections (https). - - Https is an optional configuration which can be set to ensure secure transactions between the MED-V server and MED-V clients. To configure https, you must perform the following procedures: - - - Configure a certificate on the server. - - - Associate the server certificate with the port specified using netsh. For information, see the following: - - - [Netsh Commands for Hypertext Transfer Protocol (HTTP)](https://go.microsoft.com/fwlink/?LinkId=183314) - - - [How to: Configure a Port with an SSL Certificate](https://go.microsoft.com/fwlink/?LinkID=183315) - - - [How to: Configure a Port with an SSL Certificate](https://msdn.microsoft.com/library/ms733791.aspx) - -3. Click **OK**. - -### Configuring Images - -**To configure images** - -1. Click the **Images** tab. - -2. Configure the following image management settings: - - - **VMs Directory**—The virtual machine directory (the directory where the images are stored). This field contains a UNC path to the image directory on the image distribution server that should be accessible from the MED-V server. - - - **VMs URL**—The location of the server where the images are stored. - -3. Click **OK**. - -### Configuring Permissions - -**To configure permissions** - -1. Click the **Permissions** tab. - -2. A list of all users who can log in is provided. To apply read and write permissions to a user, select the check box next to the user. To apply read-only permissions to a user, clear the check box. - -3. To add domain users or groups, click **Add**. - - The **Enter User or Group names** dialog box appears. - - 1. Select domain users or groups by doing one of the following: - - - In the **Enter User or Group names** field, type a user or group that exists in the domain or exists as a local user or group on the computer. Then click **Check Names** to resolve it to the full existent name. - - - Click **Find** to open the standard **Select Users or Groups** dialog box. Then select domain users or groups. - - 2. Click **OK**. - -4. To remove domain users or groups, select a user or group and click **Remove**. - -5. Click **OK**. - -### Configuring Reports - -**To configure reports** - -1. Click the **Reports** tab. - -2. To support reports, select **Enable reports**. - -3. In the **Connection String** box, enter a connection string for the MSSQL database. - - - When SQL Server is installed on a remote server, use the following connection string: - - `Data Source=;Initial Catalog=;uid=sa;pwd=;` - - **Note** - Note: To connect to SQL Express, use: `Data Source=\sqlexpress.` - - - -4. To create the database, click **Create Database**. - -5. To test the connection, click **Test Connection**. - -6. To configure database clearing options, click **Clear Options**. - - The **Clear Database Options** dialog box appears. - - 1. Choose one of the following options: - - - **Clear data older than**—Clear all data older than the number of days specified; in the number box, enter a number of days. - - - **Clear all data from database**—Clear all existent data in the database. - - - **Drop database**—Delete the database. - - 2. Click **OK** to apply changes and close the dialog box. - -7. Click **OK** to save the changes, or click **Cancel** to close the dialog box without saving changes. - -8. If prompted, restart the MED-V server service to apply changes to the network settings. - -## Related topics - - -[Supported Configurations](supported-configurationsmedv-orientation.md) - -[Design the MED-V Server Infrastructure](design-the-med-v-server-infrastructure.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md b/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md deleted file mode 100644 index 2ab92353b5..0000000000 --- a/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: How to Install MED-V Client and MED-V Management Console -description: How to Install MED-V Client and MED-V Management Console -author: dansimp -ms.assetid: 8a5f3010-3a50-487e-99d8-e352e5cb51c6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install MED-V Client and MED-V Management Console - - -The following MED-V components are included in the client .msi package: - -- MED-V client—The MED-V software that must be installed on client computers for running MED-V workspaces. - -- MED-V management console—The administrative tool that administrators can use to create and maintain images, MED-V workspaces, and policies. - -The MED-V management console and the MED-V client are both installed from the MED-V client .msi package. The MED-V client, however, can be installed independently without the MED-V management console by clearing the **Install the MED-V Management application** check box during installation. - -**Note** -The MED-V client and MED-V management console can only be installed on Windows 7-, Windows Vista-, and Windows XP-based computers. They cannot be installed on server products. - - - -**Note** -Do not install the MED-V client using the Windows **runas** command. - - - -**To install the MED-V client** - -1. Log in as a user with local administrator rights on the local computer. - -2. Run the MED-V .msi package. - - The MED-V .msi package is called *MED-V\_x.msi*, where *x* is the version number. - - For example, *MED-V\_1.0.65.msi*. - -3. When the **InstallShield Wizard Welcome** screen appears, click **Next**. - -4. On the **License Agreement** screen, read the license agreement, click **I accept the terms in the license agreement**, and click **Next**. - - The **Destination Folder** screen appears, with the default installation folder displayed. - - The default installation folder is the directory where the operating system is installed. - - - To change the folder where MED-V should be installed, click **Change**, and browse to an existing folder. - -5. Click **Next**. - -6. On the **MED-V Settings** screen, configure the MED-V installation as follows: - - - Select the **Install the MED-V management application** check box to include the management component in the installation. - - **Note** - Enterprise Desktop Virtualization administrators should install the MED-V management application. This application is required for configuring desktop images and MED-V workspaces. - - - -~~~ -- Select the **Load MED-V when Windows starts** check box to start MED-V automatically on startup. - -- Select the **Add a MED-V shortcut to my desktop** check box to create a MED-V shortcut on your desktop. - -- In the **Server address** field, type the server address. - -- In the **Server port** field, type the server's port. - -- Select the **Server requires encrypted connections (https)** check box to work with https. - -- The default virtual machine images folder is displayed. The default installation folder is *%systemdrive%\\MED-V Images\\*. To change the folder where MED-V should be installed, click **Change**, and browse to an existing folder. -~~~ - -7. Click **Next**. - -8. On the **Ready to Install the Program** screen, click **Install**. - - The MED-V client installation starts. This can take several minutes, and the screen might not display text. During installation, several progress screens appear. If a message appears, follow the instructions provided. - - Upon successful installation, the **InstallShield Wizard Completed** screen appears. - -9. Click **Finish** to close the wizard. - -## Related topics - - -[Supported Configurations](supported-configurationsmedv-orientation.md) - -[Installation and Upgrade Checklists](installation-and-upgrade-checklists.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md b/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md deleted file mode 100644 index 908b387c82..0000000000 --- a/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Install MED-V Client -description: How to Install MED-V Client -author: dansimp -ms.assetid: bfac6de7-d96d-4b3e-bd8b-183e051e53c8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install MED-V Client - - -In a deployment package-based scenario, the MED-V client installation is included in the deployment package and installed directly from the package. - -**Important** -When using a deployment package that does not include an image, ensure that the image is uploaded to the Web or pushed to the pre-stage folder prior to installing the deployment package. - - - -**To install a deployment package** - -1. Do one of the following: - - - Download the MED-V package from the Web. - - - Insert the deployment USB or DVD into the host drive. - -2. If MED-V does not launch automatically, double-click MED-VAutoInstaller.exe. - - A dialog box appears listing the components that are already installed and those that are currently being installed. - - **Note** - If a version of the Microsoft Virtual PC that is not supported exists on the host computer, a message will appear telling you to uninstall the existing version and run the installer again. - - - -~~~ -**Note** -If an older version of the MED-V client exists, it will prompt you asking whether you want to upgrade. - - - -Depending on the components that have been installed, you might need to reboot. If rebooting is necessary, a message appears notifying you that you must reboot. -~~~ - -3. If necessary, reboot the computer. - - When the installation is complete, MED-V starts and a message appears notifying you that the installation is complete. - -4. Log in to MED-V using the following user name and password: - - - Type in the domain name and user name followed by the password of the domain user who is permitted to work with MED-V. - - Example: "domain\_name\\user\_name", "password" - -## Related topics - - -[How to Configure a Deployment Package](how-to-configure-a-deployment-package.md) - -[How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) - -[Client Installation Command Line Reference](client-installation-command-line-reference.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-install-med-v-clientesds.md b/mdop/medv-v1/how-to-install-med-v-clientesds.md deleted file mode 100644 index 46cf4d5fea..0000000000 --- a/mdop/medv-v1/how-to-install-med-v-clientesds.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: How to Install MED-V Client -description: How to Install MED-V Client -author: dansimp -ms.assetid: fb35f618-684c-474f-9053-b70bb29c3cc0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install MED-V Client - - -Before installing the MED-V client .msi package on users’ computers, ensure that the image is uploaded to the Web or pushed to the image pre-stage folder. - -To install MED-V client using an enterprise software distribution center, refer to the documentation on how to install applications using the system you are using. - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-localize-a-med-v-image.md b/mdop/medv-v1/how-to-localize-a-med-v-image.md deleted file mode 100644 index b5f0bdf42a..0000000000 --- a/mdop/medv-v1/how-to-localize-a-med-v-image.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: How to Localize a MED-V Image -description: How to Localize a MED-V Image -author: dansimp -ms.assetid: adc148b3-8cfe-42a0-8847-be6b689a673a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Localize a MED-V Image - - -A MED-V image can be localized, either by unpacking a packed image or by downloading an image from the server. All local images appear in the local repository. - -## How to Extract a MED-V Image for Use by the Local Client - - -A packed image can be unpacked to the local repository by extracting it. It then does not need to be downloaded from the server. - -**To extract a MED-V image** - -1. In the **Local Packed Images** pane, select an image. - -2. Right-click, and from the drop-down menu, select **Extract image**. - - The image is extracted to the local drive and can now be used by the local client running on the computer. - -## How to Download a MED-V Image to the Local Repository - - -**To download a MED-V image** - -1. In the **Packed Images on Server** pane, select the image or version of the image to download. - -2. Click **Download**. - - The image is downloaded to your local computer. - - **Note**   - The downloaded image will not appear in the **Local Images** pane until you refresh the page. Click Refresh to see the downloaded image in the **Local Images** pane. - - - -## Related topics - - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md b/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md deleted file mode 100644 index e620f98a5e..0000000000 --- a/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: How to Lock and Unlock a Workspace -description: How to Lock and Unlock a Workspace -author: dansimp -ms.assetid: 027166b9-0e06-4a4e-a8ac-a4d5f429656f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Lock and Unlock a Workspace - - -## How to Lock a Workspace - - -**To lock a MED-V workspace that is currently running** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Lock Workspace**. - - The MED-V workspace is locked. - -## How to Unlock a Workspace - - -**To unlock a MED-V workspace** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Unlock Workspace**. - -3. In the **Unlock Workspace** dialog box, enter your **Password**. - -4. Click **Unlock**. - - The MED-V workspace is unlocked. - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-pack-a-med-v-image.md b/mdop/medv-v1/how-to-pack-a-med-v-image.md deleted file mode 100644 index 08ccd86ef5..0000000000 --- a/mdop/medv-v1/how-to-pack-a-med-v-image.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: How to Pack a MED-V Image -description: How to Pack a MED-V Image -author: dansimp -ms.assetid: e1ce2307-0f1b-4bf8-b146-e4012dc138d2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Pack a MED-V Image - - -A MED-V image must be packed before it can be added to a deployment package or uploaded to the server. - -**To create a packed MED-V image** - -1. Click the **Images** management button. - -2. In the **Images** module, in the **Local Packed Images** pane, click **New**. - -3. In the **Packed Image Creation** dialog box, select the virtual machine image by doing one of the following: - - - In the **Base image file** field, type the full path to the directory where the Microsoft Virtual PC image prepared for MED-V is located. - - - Click **Browse** to browse to the directory where the Microsoft Virtual PC image prepared for MED-V is located. - -4. Specify the name of the new image by doing one of the following: - - - In the **Image name** field, type the desired name. - - **Note** - The following characters cannot be included in the image name: space " < > | \\ / : \* ? - - - -~~~ - A new packed image will be created. - -- From the drop-down list, select an existing name. - - A new version of the existing image will be created. -~~~ - -5. Click **OK**. - - A new MED-V packed image is created on your host computer with the properties defined in the following table. - -**Note** -In the **Local Packed Images** and **Packed Images on Server** panes, the most recent version of each image is displayed as the parent node. Click the parent node to view all other existing versions of the image. - - - -**Local Packed Images Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Image Name

    The name of the packed image as it was defined when the administrator created the image.

    Version

    The version of the displayed image.

    -
    -Note

    All previous versions are kept unless deleted.

    -
    -
    - -

    File Size (compressed)

    The physical compressed size of the image.

    Image Size (uncompressed)

    The physical uncompressed size of the image.

    - - - -## Related topics - - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md b/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md deleted file mode 100644 index 9c9183aebe..0000000000 --- a/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Set Advanced File Transfer Options -description: How to Set Advanced File Transfer Options -author: dansimp -ms.assetid: 5e9f8749-a5a9-48c6-9bfc-6b8e0cbe6cab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Advanced File Transfer Options - - -**To set advanced file transfer options** - -1. In the **Deployment** pane, click **Advanced**. - -2. In the **File Transfer Options** dialog box, configure the parameters as described in the following table. - -3. Click **OK**. - -**File Transfer Options Properties** - -Property -Description -*Workspace to Host* - -Run command on received files - -Select this check box to run a command line on all files transferred to the host. In the command-line box, enter the command line to run on all received files. - -File types - -- **Allow all file extensions**—Click to enable transferring files of any file name extension from the MED-V workspace to the host. - -- **Allow the following file extensions**—Click to enable only files with specified file name extensions to be transferred. In the empty field, enter all file name extensions allowed, separated by commas. - -*Host to Workspace* - -Run command on received files - -Select this check box to run a command line on all files transferred to the MED-V workspace. In the command-line box, enter the command line to run on all transferred files. - -File types - -- **Allow all file extensions**—Click to enable transferring files of any file name extension. - -- **Allow the following file extensions**—Click to enable only files with specified file name extensions to be transferred from the host to the MED-V workspace. In the empty field, enter all file name extensions allowed, separated by colons. - -  - -## Related topics - - -[How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md b/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md deleted file mode 100644 index f06380a126..0000000000 --- a/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How to Set MED-V Workspace Deletion Options -description: How to Set MED-V Workspace Deletion Options -author: dansimp -ms.assetid: 0f85aa81-c188-4115-9141-ceba2473c00e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set MED-V Workspace Deletion Options - - -## Workspace Deletion Options - - -The administrator can set the MED-V workspace deletion options for each user or group so that the MED-V workspace is automatically deleted under certain conditions. - -**To set MED-V workspace deletion options** - -1. In the **Deployment** pane, click **Workspace deletion options**. - -2. In the **Workspace Deletion Options** dialog box, select from the following options: - - - **The Workspace has been disabled**—If the administrator disables the MED-V workspace, the MED-V workspace is deleted from the user or group computer. - - - **The Workspace has expired**—If the MED-V workspace expires according to the date specified, the MED-V workspace is deleted from the user or group computer. - - - **User is offline for more than the allowed period**—If the policy is not refreshed in the time period specified since the user was offline, the MED-V workspace is deleted from the user or group computer. - -3. Click **OK**. - -## Related topics - - -[How to Configure a Domain User or Group](how-to-configure-a-domain-user-or-groupmedvv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-set-up-script-actions.md b/mdop/medv-v1/how-to-set-up-script-actions.md deleted file mode 100644 index cff5da73d1..0000000000 --- a/mdop/medv-v1/how-to-set-up-script-actions.md +++ /dev/null @@ -1,274 +0,0 @@ ---- -title: How to Set Up Script Actions -description: How to Set Up Script Actions -author: dansimp -ms.assetid: 367e28f1-d8c2-4845-a01b-2fff9128ccfd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Set Up Script Actions - - -The script actions editor allows the administrator to create actions to be performed during MED-V workspace setup, as well as to define the order in which they are performed. - -The following is a list of actions that can be added to the domain setup script: - -- **Restart Windows**—Restart Windows. - -- **Join Domain**—If joining a domain, include this action and configure the user name, password, fully qualified domain name, NetBIOS domain name, and organization unit (optional). - -- **Check Connectivity**—Configure a server to connect to and verify that the MED-V workspace can connect to a network resource (such as the domain server). - -- **Command Line**—Configure a script in the MED-V workspace, and enter a command line that includes the path of the script and the script arguments. - -- **Rename Computer**—Rename the virtual machine computer based on the defined settings. - -- **Disable Auto-Logon**—Disable Windows Auto-Logon. This action should be added at the end of scripts that add the computer to the domain. - -## How to Set Up Script Actions - - -**To set up script actions** - -1. On the **VM Setup** tab, click **Script Editor**. - -2. In the **Script Actions** dialog box, click **Add**, and on the submenu, click the desired actions. - -3. Configure the actions as described in the following tables. - - **Note**   - **Rename Computer** is configured in the **VM Settings** tab. For more information, see [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md). - - - -~~~ -**Note** -To rename a computer, Windows must be restarted. It is recommended to add a Restart Windows action following a Rename Computer action. -~~~ - - - -4. Set the order of the actions by selecting an action and clicking **Up** or **Down**. - -5. Click **OK**. - -**Note** -When running the Join Domain script, for the script to work, the user logged into the MED-V workspace virtual machine must have local administrator rights. - - - -**Note** -When running the Disable Auto-Logon script, it is recommended to disable the local guest account used for the auto-logon once the initial setup is complete. - - - -### - -**Join Domain Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Credentials to use when joining the VM to the domain

    Select one of the following credentials to use when joining the VM to the domain:

    -
      -
    • Use MED-V credentials—The end-user credentials.

    • -
    • Use the following credentials—The credentials specified; enter a user name and password in the corresponding fields.

    • -
    -
    -Note

    The credentials you enter are visible to all MED-V workspace users. It is not recommended to provide domain administrator credentials.

    -
    -
    - -

    Domain to join

    Select one of the following:

    -
      -
    • Use the domain name utilized in starting the Workspace—Join the domain entered by the end user when logging into the MED-V client.

      -

      To define the mapping from NetBIOS to fully qualified domain names, click Global domain mapping table. In the global domain mapping table, click Add, enter a NetBIOS domain name and a Fully qualified domain name, and click OK.

    • -
    • Use the following domain name—Join the domain specified; enter a domain name and NetBIOS domain name in the corresponding fields.

    • -

    Organization Unit

    An organization unit (OU) may be specified to join the computer to a specific OU. The format must follow an OU distinguished name: OU=<Organization Unit>,<Domain Controller> (for example, OU=QATest, DC=il, DC=MED-V, DC=com).

    -
    -Warning

    Only a single level OU is supported as is shown in the example above.

    -
    -
    - -
    - - - -### - -**Check Connectivity Properties** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    IP Address

    The IP Address of the server that you are verifying connection to.

    Port

    The port of the server that you are verifying connection to.

    Timeout

    The number of seconds to wait for a response before timing out.

    - - - -### - -**Command-Line Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Path

    The path of the command line.

    Arguments

    Command-line arguments.

    Wait for exit

    Select the check box to wait for a return before continuing with the script actions.

    Fail on error

    Select this check box if the return is anything but the value specified.

    -

    Enter the value that will indicate the command as a success.

    -

    Default: 0

    Perform only once

    Select this check box to run the command line only once. If the script fails or is canceled, this command will not be performed again.

    This command line causes a restart of Windows in the Workspace

    Select this check box if the command line causes a restart after completion.

    Allow interaction

    Select this check box if the command will require user interaction.

    Progress message

    Message to be displayed to the user while the command is running.

    Failure message

    Message to be displayed to the user if the command fails.

    - - - -When configuring the command-line action, several variables can be used as defined in the following table. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ParameterValueDescription

    %MEDVUser%

    An authenticated user name.

    MED-V authenticated user name. The user name and password can be used in the join domain VM setup script.

    %MEDVPassword%

    An authenticated password.

    MED-V authenticated password. The user name and password can be used in the join domain VM setup script.

    %MEDVDomain%

    Configured domain.

    The domain configured in the MED-V authentication. It can be used on the VM setup script.

    %DesiredMachineName%

    Computer name.

    The unique computer name configured in the management application. It can be used in the VM setup script.

    - - - -## Related topics - - -[How to Configure the Virtual Machine Setup for a MED-V Workspace](how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md) - -[How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md b/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md deleted file mode 100644 index d77de77862..0000000000 --- a/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Share Folders Between the Host and the MED-V Workspace -description: How to Share Folders Between the Host and the MED-V Workspace -author: dansimp -ms.assetid: 3cb295f2-c07e-4ee6-aa3c-ce4c8c45c191 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Share Folders Between the Host and the MED-V Workspace - - -You can share folders between the host and the MED-V workspace. The shared folders can be stored on the following: - -- An external computer on the network - -- The host computer - -The following procedures demonstrate how to share folders between the host and the MED-V workspace. - -**To share folders located on the network** - -1. Configure MED-V in full desktop mode. - -2. In MED-V management, on the Network tab, click **Use different IP address than host (Bridge)**. - -3. Do the following on the host computer: - - 1. In Control Panel, click **View network status and tasks**, and set **Network discovery** to **On**. - - 2. On the Start menu, right-click **Computer**, and click **Map network drive**. - - 3. In the **Map Network Drive** dialog box, in the **Drive** field, select a drive. - - **Note**   - Ensure that the same drive letter is not in use on both computers. - - - - 4. Click **Browse**. - - 5. In the **Browse For Folder** dialog box, browse to the shared drive, and click **OK**. - - 6. Click **Finish**. - -4. Repeat step 3 in the MED-V workspace. Point to the same drive as on the host computer. - -**To share folders located on the host** - -1. Configure the folder to be shared with the appropriate permissions. - -2. From the MED-V workspace, go to **My network places** and locate the shared folder. - -3. From the MED-V workspace, locate the shared folder. - -**Note**   -Ensure that both the host and MED-V workspace computers are in the same domain or workgroup. - - - - - - - - - - - diff --git a/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md b/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md deleted file mode 100644 index 491c545b20..0000000000 --- a/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: How to Start and Exit the MED-V Client -description: How to Start and Exit the MED-V Client -author: dansimp -ms.assetid: 3762bad1-6937-40fa-ab5d-61a905865214 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Start and Exit the MED-V Client - - -## - - -**To start the MED-V client** - -- On the Windows Start menu, point to **All Programs**, point to **MED V**, and then click **MED-V** or, on the desktop, double-click the **MED-V** icon. - -**Note**   -MED-V cannot be started from an elevated command prompt. - - - -**To exit the MED-V client** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Exit**. - - The MED-V client exits. - - - - - - - - - diff --git a/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md b/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md deleted file mode 100644 index b765e2f19c..0000000000 --- a/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Start, Stop, and Restart a MED-V Workspace -description: How to Start, Stop, and Restart a MED-V Workspace -author: dansimp -ms.assetid: 54ce139c-8f32-499e-944b-72f123ebfd2d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Start, Stop, and Restart a MED-V Workspace - - -**To start a MED-V workspace** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Start Workspace**. - - - If there are multiple MED-V workspaces running on the computer, the **Workspace Selection** window appears. - - 1. Select a MED-V workspace. - - 2. Select the **Start the selected Workspace without asking me** check box to skip this window the next time the client is started and to automatically open the selected MED-V workspace. - - 3. Click **OK**. - - The **Start Workspace Authentication** window appears. - - - If there are several MED-V workspaces on the computer and you have opted to use a specified MED-V workspace, the window shown in the following figure appears. - - ![](images/medv-logon.gif) - - - If there is only one MED-V workspace on the computer, the “Start last used Workspace” option is unavailable. - -3. Type in your domain user credentials. - - **Note**   - The first time a MED-V workspace is started, the user name should be in the following format: <domain name>\\<user name>. - - - -4. Select **Save my password** to save your password between sessions. - - **Note**   - To enable the save password feature, the EnableSavePassword attribute must be set to True in the ClientSettings.xml file. The file can be found in the *Servers\\Configuration Server\\* folder. - - - -5. Clear the **Start last used workspace** check box to choose a different MED-V workspace. - -6. Click **OK**. - - Several status screens appear depending on the MED-V workspace configuration. - - The **Starting Workspace** screen appears. - -**To restart a MED-V workspace** - -1. When the client is running, in the notification area, right-click the MED-V icon. - -2. On the submenu, click **Restart Workspace**. - - The MED-V workspace is restarted. - - - In a persistent MED-V workspace, the virtual machine is shut down and then restarted. - - - In a revertible MED-V workspace, the virtual machine does not actually shut down; instead, it returns to its original state. - -**To stop a MED-V workspace** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Stop Workspace**. - - The MED-V workspace is stopped. - -## Related topics - - -[How to Start and Exit the MED-V Client](how-to-start-and-exit-the-med-v-client.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md b/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md deleted file mode 100644 index 125a45d5b6..0000000000 --- a/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: How to Uninstall MED-V Components -description: How to Uninstall MED-V Components -author: dansimp -ms.assetid: 91bdf488-14e7-43ab-972d-9d92421acb86 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall MED-V Components - - -This section explains how to uninstall the MED-V client and server. - -## How to Uninstall the MED-V Client - - -**To uninstall MED-V client** - -1. If using Windows XP: - - - In Control Panel, open **Add or Remove Programs**. - -2. If using Windows Vista: - - - In Control Panel, open **Uninstall a Program**. - -3. Select **Microsoft Enterprise Desktop Virtualization**, and click **Uninstall**. - -4. It is recommended to delete the MED-V virtual machine folder. (The default folder is *C:\\MED-V Images*.) - -## How to Uninstall the MED-V Server - - -**To uninstall the MED-V server** - -1. In Control Panel, open **Add or Remove Programs**. - -2. Select **Microsoft Enterprise Desktop Virtualization (Server)**, and click **Uninstall**. - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-update-a-med-v-image.md b/mdop/medv-v1/how-to-update-a-med-v-image.md deleted file mode 100644 index 742368d6ac..0000000000 --- a/mdop/medv-v1/how-to-update-a-med-v-image.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: How to Update a MED-V Image -description: How to Update a MED-V Image -author: dansimp -ms.assetid: 61eacf50-3a00-4bb8-b2f3-7350a6467fa1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Update a MED-V Image - - -## How to Update a MED-V Image - - -An existing MED-V image can be updated, thereby creating a new version of the image. The new version can then be deployed on client computers, replacing the existing image. - -**Note**   -When a new version is deployed on the client, it overwrites the existing image. When updating an image, ensure that no data on the client needs to be saved. - - - -**To update a MED-V image** - -1. Open the existing image in Virtual PC 2007. - -2. Make the required changes to the image, updating the image (such as installing new software). - -3. Close Virtual PC 2007. - -4. Test the image. - -5. After the image is tested, pack it to the local repository, using the same name as the existing image. - - **Note**   - If you name the image a different name than the existing version, a new image will be created rather than a new version of the existing image. - - - -6. Upload the new version to the server or distribute it via a deployment package. - -## Related topics - - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) - -[How to Create and Test a MED-V Image](how-to-create-and-test-a-med-v-image.md) - -[How to Pack a MED-V Image](how-to-pack-a-med-v-image.md) - -[How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md) - -[Updating a MED-V Workspace Image](updating-a-med-v-workspace-image.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md b/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md deleted file mode 100644 index 18cf02c554..0000000000 --- a/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: How to Upload a MED-V Image to the Server -description: How to Upload a MED-V Image to the Server -author: dansimp -ms.assetid: 0e70dfdf-3e3a-4860-970c-535806caa907 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Upload a MED-V Image to the Server - - -After a MED-V image has been tested, it can be packed and then uploaded to the server. For information on configuring an image Web distribution server, see [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md). - -Once a MED-V image is packed and uploaded to the server, it can be distributed to users by using an enterprise software distribution center, or it can be downloaded by users using a deployment package. For information on deployment using an enterprise software distribution center, see [Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md). For information on deployment using a package, see [Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md). - -**Note** -Before uploading an image, verify that a Web proxy is not defined in your browser settings and that Windows Update is not currently running. - - - -**To upload a MED-V image to the server** - -1. In the **Local Packed Images** pane, select the image you created. - -2. Click **Upload**. - - The image is uploaded to the server. This might take a considerable amount of time. - - Images on the server are defined with the properties listed in the following table. - -**Packed Images on Server Properties** - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Image Name

    The name of the packed image as it was defined when the administrator created the image.

    Version

    The version of the displayed image.

    -
    -Note

    All previous versions are kept unless deleted.

    -
    -
    - -

    File Size (compressed)

    The physical compressed size of the image.

    Image Size (uncompressed)

    The physical uncompressed size of the image.

    - - - -## Related topics - - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) - -[How to Pack a MED-V Image](how-to-pack-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md b/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md deleted file mode 100644 index cae37d85c9..0000000000 --- a/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: How to View MED-V Settings and General Information -description: How to View MED-V Settings and General Information -author: dansimp -ms.assetid: c14e3f30-c4e5-47a3-8ad1-0570fc62d991 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to View MED-V Settings and General Information - - -## How to View MED-V Settings - - -**To view MED-V settings** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, click **Settings**. - -3. In the **Settings** dialog box, select the **Load MED-V after Windows logon** check box to load MED-V on startup. - -4. Select the **Start Workspace when MED-V starts** check box to automatically start the MED-V workspace on startup. - -5. Configure the server properties described in the following table. - -**Server Settings** - - ---- - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Server address

    The server's DNS name or IP address.

    Server port

    The server's port.

    Encrypt connections (HTTPS)

    Select this check box to use encrypted connections.

    - -  - -## How to View MED-V General Information - - -**To view MED-V general information** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, point to **Help**, and then click **About**. - - The **About Microsoft Enterprise Desktop Virtualization** screen appears. - -  - -  - - - - - diff --git a/mdop/medv-v1/how-to-work-with-reports.md b/mdop/medv-v1/how-to-work-with-reports.md deleted file mode 100644 index d9c80fd178..0000000000 --- a/mdop/medv-v1/how-to-work-with-reports.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: How to Work with Reports -description: How to Work with Reports -author: dansimp -ms.assetid: b7a660c6-74c3-4ced-a395-9e76a4362a46 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Work with Reports - - -The following functions can be used to work with MED-V reports: - -- [Refreshing an existing report](#bkmk-howtorefreshanexistingreport) - -- [Editing report parameters](#bkmk-howtoeditreportparameters) - -- [Exporting a report to Microsoft Excel](#bkmk-howtoexportareporttoexcel) - -- [Closing a report](#bkmk-howtocoseareport) - -Report results can be sorted by any column by clicking the appropriate column name. - -The report results can be grouped by dragging a column header to the top of the report. Drag multiple column headers to group one column after another. - -## How to Refresh an Existing Report - - -**To refresh an existing report** - -1. Select the report to refresh. - -2. On the management toolbar, click **Refresh**. - - The report is regenerated. - -## How to Edit Report Parameters - - -**To edit report parameters** - -1. Generate a report. - -2. On the management toolbar, click **Edit report**. - - The Report Parameters dialog box appears. - -3. In the **Report Parameters** dialog box, configure the parameters, and click **OK**. - - The report is regenerated with the new parameters. - -## How to Export a Report to Microsoft Excel - - -**To export a report to Microsoft Excel** - -1. Generate a report. - -2. On the management toolbar, click **Export to Excel**. - -3. In the **Save Report** dialog box, enter a name, and click **Save**. - - The report is exported to Microsoft Excel. - -## How to Close a Report - - -**To close a report** - -1. Select the report to close. - -2. On the management toolbar, click **Close report**. - - The report closes. - -  - -  - - - - - diff --git a/mdop/medv-v1/identify-the-number-of-med-v-instances.md b/mdop/medv-v1/identify-the-number-of-med-v-instances.md deleted file mode 100644 index 1d78567667..0000000000 --- a/mdop/medv-v1/identify-the-number-of-med-v-instances.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Identify the Number of MED-V Instances -description: Identify the Number of MED-V Instances -author: dansimp -ms.assetid: edea9bdf-a28c-4d24-9298-7bd6536c3a94 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identify the Number of MED-V Instances - - -You need to determine the number of MED-V instances, as well as define the scope for each instance so that you can design the server infrastructure. A MED-V instance includes the following: - -- The MED-V server and the MED-V workspaces stored on the server, including Active Directory permissions. - -- A SQL Server database that stores client events. The database may be shared by multiple MED-V instances. - -- The image repository for the packed MED-V images. The repository may be shared by multiple MED-V instances. - -- The management console used to create and pack images and to create MED-V workspaces. The console cannot be used simultaneously by multiple MED-V instances, but it can be disconnected from one MED-V server and then connected to a different MED-V server. - -- MED-V clients that receive MED-V workspaces, and authorization to use them, from the server. - -Separate MED-V instances cannot be integrated or share MED-V workspaces. Therefore, each additional instance decentralizes the virtualization management. - -## Determine the Number of MED-V Instances Required - - -Start by assuming you are using one MED-V instance. Then, consider the following conditions, and add additional instances for each condition that applies to your infrastructure. - -- Number of supported users—Each MED-V instance can support up to 5,000 concurrently active clients. Concurrently active means the client is online with the MED-V server and sending polls to the server for policy and image updates, as well as events. If your infrastructure will include more than 5,000 active users, add one instance for every 5,000 users. - -- Users in untrusted domains—The MED-V server associates MED-V workspace permissions with Active Directory users and/or groups. This requires MED-V users to exist within the trust boundary of the MED-V server. Add one MED-V instance for each group of MED-V users that is in a separate, untrusted domain. - -- Clients in isolated networks—Determine whether any clients reside in networks that are isolated and therefore require a separate MED-V instance. For example, organizations often isolate lab networks from production networks. Add a MED-V instance for each isolated network that will contain MED-V clients. - -- Organizational requirements—The organization may require that a group of clients be managed by a separate MED-V instance for security reasons, such as when sensitive applications are delivered only to a restricted set of users within a domain. For example, the payroll department may deny users from other departments access to the MED-V instance that stores policy for payroll processing. Additionally, if the organization uses a distributed management model, a separate MED-V instance may be required for each business group having MED-V clients in order to enable the group to manage its own virtualized environment. Add one MED-V instance for each separate organizational requirement. - -- Legal considerations—National security or privacy issues and fiduciary laws could require the separation of certain data or prevent other data from crossing national borders. If necessary, add additional MED-V instances to address this need. - -After you determine the number of MED-V instances required for your infrastructure, as well as the reasoning for each one, provide a name for each instance. - -  - -  - - - - - diff --git a/mdop/medv-v1/images/506f54d0-38fa-446a-8070-17ae26da5355.gif b/mdop/medv-v1/images/506f54d0-38fa-446a-8070-17ae26da5355.gif deleted file mode 100644 index 751dd1cdd0..0000000000 Binary files a/mdop/medv-v1/images/506f54d0-38fa-446a-8070-17ae26da5355.gif and /dev/null differ diff --git a/mdop/medv-v1/images/medv-logon.gif b/mdop/medv-v1/images/medv-logon.gif deleted file mode 100644 index bcc102a289..0000000000 Binary files a/mdop/medv-v1/images/medv-logon.gif and /dev/null differ diff --git a/mdop/medv-v1/images/medv-ui-console-general.gif b/mdop/medv-v1/images/medv-ui-console-general.gif deleted file mode 100644 index 128e43aea0..0000000000 Binary files a/mdop/medv-v1/images/medv-ui-console-general.gif and /dev/null differ diff --git a/mdop/medv-v1/images/medv.gif b/mdop/medv-v1/images/medv.gif deleted file mode 100644 index 29b45a998f..0000000000 Binary files a/mdop/medv-v1/images/medv.gif and /dev/null differ diff --git a/mdop/medv-v1/index.md b/mdop/medv-v1/index.md deleted file mode 100644 index c056dfeeaf..0000000000 --- a/mdop/medv-v1/index.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide -description: Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide -author: dansimp -ms.assetid: 7bc3e120-df77-4f4c-bc8e-7aaa4c2a6525 -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide - - -![microsoft enterprise desktop virtualization](images/medv.gif) - -Microsoft Enterprise Desktop Virtualization (MED-V) uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. - -MED-V is an integral component of the Microsoft Desktop Optimization Pack, a dynamic solution available to Software Assurance customers, which helps reduce application deployment costs, enables delivery of applications as services, and helps to better manage and control enterprise desktop environments. - -## In This Section - - -The following topics are covered in this guide: - -[About This Guide](about-this-guidemedv.md) - -[Getting Started with MED-V](getting-started-with-med-v.md) - -[MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md) - -[MED-V Deployment and Configuration](med-v-deployment-and-configuration.md) - -[MED-V Operations](med-v-operations.md) - -[Troubleshooting MED-V](troubleshooting-med-v.md) - -[Technical Reference](technical-referencemedv-10-sp1.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/installation-and-upgrade-checklists.md b/mdop/medv-v1/installation-and-upgrade-checklists.md deleted file mode 100644 index 581101261f..0000000000 --- a/mdop/medv-v1/installation-and-upgrade-checklists.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Installation and Upgrade Checklists -description: Installation and Upgrade Checklists -author: dansimp -ms.assetid: ccfdde26-4a28-4c14-888d-71b96fe7626e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installation and Upgrade Checklists - - -This section provides installation and upgrade checklists for MED-V 1.0 and MED-V 1.0 SP1. - -## In This Section - - -[MED-V 1.0 Installation Checklist](med-v-10-installation-checklist.md) -Provides a list of all the steps required for installing MED-V 1.0. - -[MED-V 1.0 SP1 Upgrade Checklist](med-v-10-sp1-upgrade-checklistmedv-10-sp1.md) -Provides a step-by-step procedure for upgrading from MED-V 1.0 to MED-V 1.0 SP1. - -  - -  - - - - - diff --git a/mdop/medv-v1/installing-and-configuring-med-v-components.md b/mdop/medv-v1/installing-and-configuring-med-v-components.md deleted file mode 100644 index 8128182f05..0000000000 --- a/mdop/medv-v1/installing-and-configuring-med-v-components.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Installing and Configuring MED-V Components -description: Installing and Configuring MED-V Components -author: dansimp -ms.assetid: 4af90e9f-3c6b-4f7c-8274-56ad24173662 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installing and Configuring MED-V Components - - -This section explains how to install the MED-V server, MED-V client, and MED-V management, as well as how to configure the MED-V server and image repository. It includes the procedure on uninstalling the components as well. - -## In This Section - - -[How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md) -Describes how to install the MED-V server and configure connections, images, permissions, and report settings. - -[How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) -Describes how to configure an image Web distribution server using IIS. - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) -Describes how to install the MED-V client and MED-V management using the client .msi package. - -[How to Uninstall MED-V Components](how-to-uninstall-med-v-componentsmedvv2.md) -Describes how to uninstall the MED-V components. - -  - -  - - - - - diff --git a/mdop/medv-v1/key-scenarios-for-using-med-v.md b/mdop/medv-v1/key-scenarios-for-using-med-v.md deleted file mode 100644 index 377facde64..0000000000 --- a/mdop/medv-v1/key-scenarios-for-using-med-v.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Key Scenarios for Using MED-V -description: Key Scenarios for Using MED-V -author: dansimp -ms.assetid: e35075e2-3401-49ae-810d-1bd51ebc7924 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Key Scenarios for Using MED-V - - -## Enable Legacy Applications and Accelerate Upgrades to New Operating Systems - - -Incompatibility of legacy applications with new versions of Windows can often delay enterprise upgrades to the latest version of Windows. Testing and migrating applications takes time, and users are unable to take advantage of the new capabilities and enhancements offered by the newest operating system. - -By delivering applications in a Virtual PC that runs a previous version of the operating system (for example, Windows XP or Windows 2000), MED-V removes the barriers to operating system upgrades and allows administrators to complete testing and address incompatible applications after the upgrade. - -From the user's perspective, these applications are accessible from the standard desktop Start menu and appear side-by-side with native applications—so there is minimal change to the user experience. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-10-installation-checklist.md b/mdop/medv-v1/med-v-10-installation-checklist.md deleted file mode 100644 index 6e306306a6..0000000000 --- a/mdop/medv-v1/med-v-10-installation-checklist.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: MED-V 1.0 Installation Checklist -description: MED-V 1.0 Installation Checklist -author: dansimp -ms.assetid: a81fd5b0-29b3-4ddc-8f60-7d44c2be9794 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 1.0 Installation Checklist - - -The following checklist is intended to provide a high-level list of items to consider and outlines the steps you should take to install Microsoft Enterprise Desktop Virtualization (MED-V) 1.0. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Ensure your computing environment meets the supported configurations required for installing MED-V 1.0.

    MED-V 1.0 Supported Configurations

    Plan and design the MED-V server infrastructure.

    MED-V Infrastructure Planning and Design

    Verify the required prerequisites are configured.

    MED-V Installation Prerequisites

    Install and configure the MED-V server.

    How to Install and Configure the MED-V Server Component

    If using an image repository, configure the image Web distribution server.

    How to Configure the Image Web Distribution Server

    Install the MED-V client and management console.

    How to Install MED-V Client and MED-V Management Console

    - - - - - - - - - - - diff --git a/mdop/medv-v1/med-v-10-release-notesmedv-10.md b/mdop/medv-v1/med-v-10-release-notesmedv-10.md deleted file mode 100644 index ba7e8f9ef6..0000000000 --- a/mdop/medv-v1/med-v-10-release-notesmedv-10.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: MED-V 1.0 Release Notes -description: MED-V 1.0 Release Notes -author: dansimp -ms.assetid: 006a3537-5c5b-43b5-8df8-4bf6ddd3cd2f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 1.0 Release Notes - - -## Known Issues with MED-V - - -This section provides the most up-to-date information about general issues with the Microsoft Enterprise Desktop Virtualization (MED-V) platform. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. Whenever possible, these issues will be addressed in later releases. - -### File downloads do not follow Web redirection rules - -File downloads do not follow Web redirection rules set in a MED-V workspace policy. - -### When expanding a console-published application window to full screen, it disappears - -If you expand a console-published application (such as cmd.exe) window to full screen inside a MED-V workspace configured in seamless integration mode, the application window might disappear or not respond. - -### When working in full desktop mode, icon locations on the desktop are not saved - -When working in full desktop mode, manual location changes of icons on the desktop are not saved between MED-V workspace sessions. - -### A local image and a test image with the same name cannot exist in the same domain - -If a local image is joined to the domain and the administrator creates a new version of the same image with the same computer name as a test image, when the test image joins the domain, either the join domain action fails or it succeeds and the local image is removed from the domain. - -### MED-V does not support Windows Aero features - -MED-V does not support Windows Aero features (such as Aero Flip 3D). - -### The management console can be used by only one Windows user per computer - -The MED-V management console can be used only by administrators and the Windows user who installed the management application. - -### The MED-V Server configuration utility tests Microsoft SQL Server connectivity under user context rather than under MED-V Server service context - -MED-V uses MED-V Server service context to collect reports from the Microsoft SQL Server reports database. The MED-V Server configuration utility verifies the database and tests the database connection string. It does not validate the access of MED-V Server service to the database. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md deleted file mode 100644 index dce6ffe881..0000000000 --- a/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: MED-V 1.0 SP1 and SP2 Release Notes -description: MED-V 1.0 SP1 and SP2 Release Notes -author: dansimp -ms.assetid: 0fde8732-8ad2-483c-b094-7996ed9f2766 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 1.0 SP1 and SP2 Release Notes - - -To search these Release Notes, press CTRL+F. - -**Note**   -Read these Release Notes thoroughly before you install the Microsoft Enterprise Desktop Virtualization (MED-V) platform. These Release Notes contain information that you must have to successfully install the MED-V platform. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other MED-V platform documentation, the latest change should be considered authoritative. These Release Notes supersede the content included with this product. - - - -## About the Product Documentation - - -Comprehensive documentation for Microsoft Enterprise Desktop Virtualization (MED-V) platform is available. Refer to the Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide. - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, you should install the latest available security updates for any new software that you are installing. For more information, see the Microsoft Security website at . - -## What’s New in MED-V 1.0 SP2 - - -MED-V 1.0 SP2 includes the following updates to the MED-V 1.0 SP1 features and functionality: - -- Support for running MED-V on a Chinese traditional or Chinese simplified workstation. - -- Support for the MED-V 1.0 SP2 client to run on Windows 7 SP1. - -- Improved performance for the applications that are running in the MED-V workspace when MED-V frames around the published applications are turned-on. Previously, under some instances the MED-V frames had to be turned-off for the applications to run correctly. - -## Known Issues with MED-V 1.0 SP1 and MED-V 1.0 SP2 - - -This section provides the most up-to-date information about issues with the Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 SP1 platform. These issues do not appear in the product documentation and in some cases may contradict existing product documentation. Whenever possible, these issues are addressed in later releases. - -### MED-V does not provide Windows 7 advanced user experience support - -MED-V 1.0 SP1 does not provide Windows 7 advanced user experience support, such as the following: - -Docking windows to the top, left, or right is not applied to published application windows. - -The Windows 7 taskbar preview does not display the published application content. - -## Release Notes Copyright Information - - -Information in this document, including URL and other Internet website references, is subject to change without notice, and is provided for informational purposes only. The entire risk of the use or results of the use of this document remains with the user, and Microsoft Corporation makes no warranties, either express or implied. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. - -Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. - - - -Microsoft, Microsoft Enterprise Desktop Virtualization, MS-DOS, Windows, Windows Server, Windows Vista, Active Directory, and ActiveSync are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. - -The names of actual companies and products mentioned herein may be the trademarks of their respective owners. - - - - - - - - - diff --git a/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md deleted file mode 100644 index 6beb4ac562..0000000000 --- a/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md +++ /dev/null @@ -1,349 +0,0 @@ ---- -title: MED-V 1.0 SP1 Supported Configurations -description: MED-V 1.0 SP1 Supported Configurations -author: dansimp -ms.assetid: 4dcf37c4-a061-43d2-878c-28efc87c3cdd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 1.0 SP1 Supported Configurations - - -This topic specifies the requirements necessary to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 Service Pack 1 (SP1) in your environment. - -## MED-V 1.0 SP1 Client System Requirements - - -### MED-V Client Operating System Requirements - -The following table lists the operating systems that are supported for MED-V 1.0 SP1 client installation. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows XP

    Professional Edition

    SP2 or SP3

    x86

    Windows Vista

    Business, Enterprise, or Ultimate

    SP1 or SP2

    x86

    Windows 7

    Professional, Enterprise, or Ultimate

    None

    x86 or x64

    - - - -**Note** -MED-V client does not run in native x64 mode. Instead, MED-V runs in Windows on Windows 64-bit (WOW64) mode on 64-bit computers. - - - -The following table lists the minimal RAM required for each operating system supported in MED-V 1.0 SP1. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemMinimal Required RAM

    Windows XP Professional

    1 GB

    Windows Vista

    2 GB

    Windows 7 x86

    2 GB

    Windows 7 x64

    3 GB

    - - - -### MED-V 1.0 SP1 Client Configuration - -**.NET Framework Version** - -The following versions of the Microsoft .NET Framework are supported for MED-V 1.0 SP1 client installation: - -- .NET Framework 2.0 or .NET Framework 2.0 SP1 - -- .NET Framework 3.0 or .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Virtualization Engine** - -Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918 is supported for MED-V 1.0 SP1 client installation in the following configurations: - -- Static Virtual Hard Disk (VHD) file - -- Multiple VHD files located within the same directory - -- Dynamic VHD file - -**Internet Browser** - -Windows Internet Explorer 7 and Windows Internet Explorer 8 are supported for MED-V 1.0 SP1 client installation. - -**Microsoft Hyper-V Server** - -The MED-V client is not supported in a Microsoft Hyper-V Server environment. - -## MED-V 1.0 SP1 Workspace System Requirements - - -MED-V 1.0 SP1 introduces changes to system requirements from those for MED-V 1.0. - -### MED-V Workspace Operating System Requirements - -The following table lists the operating systems supported for MED-V 1.0 SP1 workspaces. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows 2000

    Professional

    SP4

    X86

    Windows XP

    Professional Edition

    SP2 or SP3

    -
    -Note

    SP3 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.

    -
    -
    - -

    x86

    - - - -### MED-V 1.0 SP1 Workspace Configuration - -**.NET Framework Version** - -MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 SP1 workspace installation: - -- .NET Framework 2.0 SP1 - -- .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Note** -We recommend the .NET Framework 3.5 SP1 to ensure that the MED-V workspace is compatible with future versions of MED-V. - - - -**Internet Browser** - -Windows Internet Explorer 6 SP2 and Windows Internet Explorer 7 are supported for the MED-V 1.0 SP1 workspace installation. - -### MED-V Workspace Images - -MED-V workspace images must be created by using Virtual PC 2007 SP1. - -## MED-V 1.0 SP1 Server System Requirements - - -MED-V 1.0 SP1 introduces changes to system requirements from those for MED-V 1.0. - -### MED-V 1.0 Server Operating System Requirements - -The following table lists the operating systems supported for MED-V 1.0 SP1 server installations. - -**Note** -Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976). - - - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2008

    Standard or Enterprise

    SP1 or SP2

    X86 or x64

    Windows Server 2008 R2

    Standard or Enterprise

    None

    x64

    - - - -### MED-V 1.0 SP1 Server Configuration - -**.NET Framework Version** - -MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 SP1 workspace installation: - -- .NET Framework 2.0 or .NET Framework 2.0 SP1 - -- .NET Framework 3.0 or .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Microsoft SQL Server Version** - -The following versions of Microsoft SQL Server are supported for MED-V 1.0 SP1 when SQL Server is installed locally or remotely from the MED-V 1.0 SP1 Server: - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    SQL Server VersionEditionService PackSystem Architecture

    SQL Server 2005

    Express, Standard, or Enterprise Edition

    SP2

    X86 or x64

    SQL Server 2008

    Express, Standard, or Enterprise

    None

    X86 or x64

    - - - -**Microsoft Hyper-V Server** - -The MED-V server is supported in a Microsoft Hyper-V server environment. - -## MED-V 1.0 SP1 Globalization Information - - -Although MED-V is not released in languages other than English, the following Windows operating system language versions are supported for the MED-V 1.0 SP1 client, workspace, and server installations: - -- English - -- French - -- German - -- Italian - -- Spanish - -- Portuguese (Brazil) - -- Dutch (Netherlands) - -- Japanese - - - - - - - - - diff --git a/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md deleted file mode 100644 index 2ae432d713..0000000000 --- a/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: MED-V 1.0 SP1 Upgrade Checklist -description: MED-V 1.0 SP1 Upgrade Checklist -author: dansimp -ms.assetid: 1a462b37-8c7a-4826-9175-0b1b701d345b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 1.0 SP1 Upgrade Checklist - - -To upgrade Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 to MED-V 1.0 Service Pack 1 (SP1), the client must be upgraded. The server can optionally be upgraded. - -## Server Upgrade - - -**To upgrade the MED-V 1.0 server to MED-V 1.0 SP1** - -1. Back up the following files that are located in the *<InstallDir> / Servers / ConfigurationServer* directory: - - - OrganizationalPolicy.XML - - - ClientPolicy.XML - - - WorkspaceKeys.XML - -2. Back up the *<InstallDir> / Servers / ServerSettings.xml* file. - -3. Uninstall the MED-V 1.0 server. - -4. Install the MED-V 1.0 SP1 server. - -5. Restore the backup files to the appropriate directories. - -6. Restart the MED-V server service. - -**Note**   -If the server configuration has been changed from the default, the files might be stored in a different location. - - - -## Client Upgrade - - -To upgrade the MED-V 1.0 client to MED-V 1.0 SP1, install the .msp file on a MED-V 1.0 client. The client and MED-V are automatically upgraded. - - - - - - - - - diff --git a/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md b/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md deleted file mode 100644 index 0ad376e710..0000000000 --- a/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md +++ /dev/null @@ -1,279 +0,0 @@ ---- -title: MED-V 1.0 Supported Configurations -description: MED-V 1.0 Supported Configurations -author: dansimp -ms.assetid: 74643de6-549e-4177-a559-6407e156ed3a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 1.0 Supported Configurations - - -This topic specifies the requirements necessary to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 in your environment. - -## MED-V 1.0 Client System Requirements - - -### MED-V Client Operating System Requirements - -The following table lists the operating systems that are supported for MED-V 1.0 client installation. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows XP

    Professional Edition

    SP2 or SP3

    x86

    Windows Vista

    Business, Enterprise, or Ultimate Edition

    SP1 or SP2

    x86

    - - - -**Note** -MED-V client does not run in native x64 mode. Instead, MED-V runs in Windows on Windows 64-bit (WOW64) mode on 64-bit computers. - - - -### MED-V 1.0 Client Configuration - -**.NET Framework Version** - -The following versions of the Microsoft .NET Framework are supported for MED-V 1.0 client installation: - -- .NET Framework 2.0 or .NET Framework 2.0 SP1 - -- .NET Framework 3.0 or .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Virtualization Engine** - -Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918 is supported for MED-V 1.0 client installation in the following configurations: - -- Static Virtual Hard Disk (VHD) file - -- Multiple VHD files located within the same directory - -- Dynamic VHD file - -**Internet Browser** - -Windows Internet Explorer 7 and Windows Internet Explorer 8 are supported for MED-V 1.0 client installation. - -**Microsoft Hyper-V Server** - -The MED-V client is not supported in a Microsoft Hyper-V server environment. - -## MED-V 1.0 Workspace System Requirements - - -### MED-V Workspace Operating System Requirements - -The following table lists the operating systems supported for MED-V 1.0 workspaces. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows 2000

    Professional

    SP4

    X86

    Windows XP

    Professional Edition

    SP2 or SP3

    -
    -Note

    SP3 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.

    -
    -
    - -

    x86

    - - - -### MED-V 1.0 Workspace Configuration - -**.NET Framework Version** - -MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 workspace installation: - -- .NET Framework 2.0 SP1 - -- .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Note** -.NET Framework 3.5 SP1 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V. - - - -**Internet Browser** - -Windows Internet Explorer 6 SP2 and Windows Internet Explorer 7 are supported for the MED-V 1.0 workspace installation. - -### MED-V Workspace Images - -MED-V workspace images must be created by using Virtual PC 2007 SP1. - -## MED-V 1.0 Server System Requirements - - -### MED-V 1.0 Server Operating System Requirements - -The following table lists the operating systems supported for MED-V 1.0 server installations. - - ------ - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows Server 2008

    Standard or Enterprise

    None

    X86 or x64

    - - - -### MED-V 1.0 Server Configuration - -**.NET Framework Version** - -MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 workspace installation: - -- .NET Framework 2.0 or .NET Framework 2.0 SP1 - -- .NET Framework 3.0 or .NET Framework 3.0 SP1 - -- .NET Framework 3.5 or .NET Framework 3.5 SP1 - -**Microsoft SQL Server Version** - -The following versions of Microsoft SQL Server are supported for MED-V 1.0 when SQL Server is installed locally or remotely from the MED-V 1.0 Server: - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    SQL Server VersionEditionService PackSystem Architecture

    SQL Server 2005

    Express, Standard, or Enterprise Edition

    SP2

    X86 or x64

    SQL Server 2008

    Express, Standard, or Enterprise

    None

    X86 or x64

    - - - -**Microsoft Hyper-V Server** - -The MED-V server is supported in a Microsoft Hyper-V server environment. - -## MED-V 1.0 Globalization Information - - -Although MED-V is not released in languages other than English, the following Windows operating system language versions are supported for the MED-V 1.0 client, workspace, and server installations: - -- English - -- French - -- German - -- Italian - -- Spanish - -- Portuguese (Brazil) - - - - - - - - - diff --git a/mdop/medv-v1/med-v-client-operations.md b/mdop/medv-v1/med-v-client-operations.md deleted file mode 100644 index e295ac9750..0000000000 --- a/mdop/medv-v1/med-v-client-operations.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: MED-V Client Operations -description: MED-V Client Operations -author: dansimp -ms.assetid: 4a5fffd2-f3f4-4e86-8529-e1386ba46c9a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Client Operations - - -## In This Section - - -This section describes the MED-V operations and explains the following tasks: - -[How to Start and Exit the MED-V Client](how-to-start-and-exit-the-med-v-client.md) -Describes how to start and exit the MED-V client. - -[How to Start, Stop, and Restart a MED-V Workspace](how-to-start-stop-and-restart-a-med-v-workspace.md) -Describes how to start, stop, and restart a MED-V workspace. - -[How to View MED-V Settings and General Information](how-to-view-med-v-settings-and-general-information.md) -Describes how to view MED-V settings and general information. - -[How to Lock and Unlock a Workspace](how-to-lock-and-unlock-a-workspace.md) -Describes how to lock and unlock a MED-V workspace. - -[MED-V Client Tools](med-v-client-toolsv2.md) -Describes the file transfer tool, image downloads, and diagnostics. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-client-toolsv2.md b/mdop/medv-v1/med-v-client-toolsv2.md deleted file mode 100644 index a49324c8b9..0000000000 --- a/mdop/medv-v1/med-v-client-toolsv2.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: MED-V Client Tools -description: MED-V Client Tools -author: dansimp -ms.assetid: ea18d82e-2433-4754-85ac-6eac84bcbb01 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Client Tools - - -MED-V includes the following client tools: - -- [File Transfer Tool](#bkmk-filetransfertool) - -- [Image Downloads](#bkmk-imagedownloads) - -- [Diagnostics](#bkmk-diagnostics) - -## File Transfer Tool - - -The File Transfer Tool can be used to copy files or folders from the MED-V workspace to the host and vice versa. - -**Note**   -The File Transfer Tool is enabled only when the MED-V workspace is running. - - - -**To copy files or folders from a MED-V workspace that is currently running** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, point to **Tools**, and then click **File Transfer**. - -3. In the **File Transfer** tool, in the **Select transfer direction** field, click one of the following transfer options: - - - **Copy from My Computer to 'default workspace' Workspace**—Transfer a file or folder from the host to the active MED-V workspace. - - - **Copy from 'default workspace' Workspace to My Computer**—Transfer a file or folder from the active MED-V workspace to the host. - -4. Select the file or folder to copy by doing one of the following: - - - In the **File to copy** field, type the full path to the directory where the file or folder to copy is located. - - - Click **Browse** to browse the directory where the file or folder to copy is located. - -5. Select the **Copy a folder** check box to copy an entire folder. - -6. Select the destination where the file is being transferred by doing one of the following: - - - In the **Destination** field, type the full path of the directory where the file or folder will be transferred. - - - Click **Browse** to browse to the directory where the file or folder will be transferred. - -7. Click **Start**. - - The file transfer begins. - -## Image Downloads - - -When a new image update is available for a MED-V workspace and the MED-V workspace is active, the user receives a message indicating that a new image is ready for download. - -**To view available images for download** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, point to **Tools**, and then click **Image Downloads**. - - All available image downloads are displayed. - -## Diagnostics - - -The diagnostics tool provides all diagnostic information. - -**To view diagnostics** - -1. In the notification area, right-click the MED-V icon. - -2. On the submenu, point to **Help**, and then click **MED-V Diagnostics**. - -3. In the **Diagnostics** tool, review all diagnostic information. - -The following functions can be performed using the diagnostic tool: - -- Gather diagnostic logs—Gather the diagnostic logs, and place them on the desktop. - -- Update policy—The MED-V workspace policy automatically connects to the MED-V server to refresh the policy every 15 minutes. However, a user can use this option to perform a manual refresh immediately. - -- Enable or Disable diagnostic mode—Display the virtual machine window. This function is helpful when, for example, you need to see MED-V workspace windows that are not displayed. - -- Browse image store—View all available MED-V workspace images. - - - - - - - - - diff --git a/mdop/medv-v1/med-v-deployment-and-configuration.md b/mdop/medv-v1/med-v-deployment-and-configuration.md deleted file mode 100644 index 38648cf7f4..0000000000 --- a/mdop/medv-v1/med-v-deployment-and-configuration.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: MED-V Deployment and Configuration -description: MED-V Deployment and Configuration -author: dansimp -ms.assetid: 3a224c78-58b0-454c-ad6d-5ce87fbb2526 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Deployment and Configuration - - -## In This Section - - -This section describes Microsoft Enterprise Desktop Virtualization (MED-V) deployment and configuration and includes the following: - -[MED-V Installation Prerequisites](med-v-installation-prerequisites.md) -Describes the prerequisites required before installing MED-V. - -[Supported Configurations](supported-configurationsmedv-orientation.md) -Describes the supported configurations for both MED-V 1.0 and MED-V 1.0 SP1. - -[Installation and Upgrade Checklists](installation-and-upgrade-checklists.md) -Provides the installation checklist for MED-V 1.0 and an upgrade checklist for MED-V 1.0 SP1. - -[Installing and Configuring MED-V Components](installing-and-configuring-med-v-components.md) -Provides procedures for installing and configuring the MED-V server, image repository, MED-V client, and MED-V management console, and the procedure for uninstalling the MED-V components. - -[Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md) -Describes how to create and configure a VPC image for MED-V. - -[Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md) -Describes how to create a MED-V workspace. - -[Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md) -Describes how to configure MED-V workspace policies. - -[Configuring MED-V for Remote Networks](configuring-med-v-for-remote-networks.md) -Describes how to configure MED-V to work from inside a network, remotely, or both from inside the network and remotely. - -[Configuring MED-V Server for Cluster Mode](configuring-med-v-server-for-cluster-mode.md) -Describes how to configure MED-V server using two servers and place all files mutual to both servers on a file system. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-infrastructure-planning-and-design.md b/mdop/medv-v1/med-v-infrastructure-planning-and-design.md deleted file mode 100644 index a0654e7a12..0000000000 --- a/mdop/medv-v1/med-v-infrastructure-planning-and-design.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: MED-V Infrastructure Planning and Design -description: MED-V Infrastructure Planning and Design -author: dansimp -ms.assetid: 6129b8f6-4b20-4403-8edd-68b007791139 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Infrastructure Planning and Design - - -## In This Section - - -This section provides direction in planning and designing a Microsoft Enterprise Desktop Virtualization (MED-V) infrastructure and addresses the following tasks: - -[Define the Project Scope](define-the-project-scope.md) -Describes how to define the project scope by defining the end users, determining the MED-V images to be managed, determining the organization’s service level expectations, and validating with the business. - -[Identify the Number of MED-V Instances](identify-the-number-of-med-v-instances.md) -Describes how to identify the number of MED-V instances required. - -[Design the MED-V Server Infrastructure](design-the-med-v-server-infrastructure.md) -Describes how to design the server for each MED-V instance, the SQL Server database, and the management console. - -[Design the MED-V Image Repositories](design-the-med-v-image-repositories.md) -Describes the steps required in designing the MED-V image repositories. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-installation-prerequisites.md b/mdop/medv-v1/med-v-installation-prerequisites.md deleted file mode 100644 index 08db5ec442..0000000000 --- a/mdop/medv-v1/med-v-installation-prerequisites.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: MED-V Installation Prerequisites -description: MED-V Installation Prerequisites -author: dansimp -ms.assetid: cf3c0906-23eb-4c4a-8951-a65741720f95 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V Installation Prerequisites - - -The following are prerequisites for installing MED-V: - -[Active Directory Requirements](#bkmk-activedirectoryrequirements) - -[Report Database](#bkmk-howtoinstallthereportdatabase) - -[Antivirus/Backup Software Configuration](#bkmk-antivirusbackupsoftwareconfiguration) - -[Microsoft Virtual PC 2007 SP1](#bkmk-howtoinstallandconfiguremicrosoftvirtualpc2007sp1) - -## Active Directory Requirements - - -When configuring the MED-V server, if users are not part of the same domain the server belongs to, a trust must be set between the domains. - -## How to Install the Report Database - - -The report database is required for storing all MED-V workspace logs. The log database is then used for generating MED-V reports. For information about reports, see [MED-V Reporting](med-v-reporting.md). - -SQL Server can be installed on the same server as the MED-V server or on a remote server. If installing on a remote server, see [Installing SQL Server on a Remote Server](#bkmk-installingsqlserveronaremoteserver). - -### Installing SQL Server on a Remote Server - -**To install SQL Server on a remote server** - -1. Configure the following on the remote server: - - - Instance name—Default instance - - - Authentication mode—Mixed mode - - - User—The default user created is “sa” - - - Password—Desired password - - - Collation Settings—Default - - - Error in usage report settings—Default - -2. Install the following files on the MED-V server: - - - To install the prerequisites for the management pack objects collection for Microsoft SQL Server 2008, download [Microsoft SQL Server 2008 Native Client](https://go.microsoft.com/fwlink/?LinkId=164039) from the Microsoft Download Center. - - - To install the prerequisites for the management pack objects collection for Microsoft SQL Server 2005, download [Microsoft SQL Server 2005 Native Client](https://go.microsoft.com/fwlink/?LinkId=164038) from the Microsoft Download Center. - - - To install the required dll files for Microsoft SQL Server 2008, download [Microsoft SQL Server 2008 Management Objects Collection](https://go.microsoft.com/fwlink/?LinkId=164041) from the Microsoft Download Center. - - - To install the required dll files for Microsoft SQL Server 2005, download [Microsoft SQL Server 2005 Management Objects](https://go.microsoft.com/fwlink/?LinkId=164040) from the Microsoft Download Center. - - - To install the stand-alone install packages that provide additional value for SQL Server 2008, download the [Microsoft SQL Server 2008 Feature Pack](https://go.microsoft.com/fwlink/?LinkId=163960) from the Microsoft Download Center. - - - To install the stand-alone install packages that provide additional value for SQL Server 2005, download the [Feature Pack for Microsoft SQL Server 2005]( https://go.microsoft.com/fwlink/?LinkId=163961) from the Microsoft Download Center. - - For more information about these files, see [Microsoft SQL Server 2008 Feature Pack](https://go.microsoft.com/fwlink/?LinkId=163960) on the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=163960) or [Feature Pack for Microsoft SQL Server 2005](https://go.microsoft.com/fwlink/?LinkId=163961) on the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=163961). - -## Antivirus/Backup Software Configuration - - -To prevent antivirus activity from affecting the performance of the virtual desktop, it is recommended where possible to exclude the following virtual machine file types from any antivirus or backup processing running on the host: - -- \*.VMC - -- \*.VUD - -- \*.VSV - -- \*.CKM - -- \*.EVHD - -## How to Install and Configure Microsoft Virtual PC 2007 SP1 - - -**Important**   -If Virtual PC for Windows exists on the host computer, uninstall it before installing Virtual PC 2007 SP1. - - - -**To install Microsoft Virtual PC 2007 SP1** - -1. Download Virtual PC 2007 SP1 from the Microsoft Download Center [Virtual PC 2007 SP1](https://go.microsoft.com/fwlink/?LinkId=142994). - -2. Run the installation file on the host computer, and follow the wizard. - -3. Install Virtual PC 2007 SP1 update on the host computer in elevated mode. - - For more information, see [the description of the hotfix package for Virtual PC 2007 SP1](https://go.microsoft.com/fwlink/?LinkId=150575). - - **Note**   - The Virtual PC 2007 SP1 update is required for running Virtual PC 2007 SP1. - - - -## Related topics - - -[Supported Configurations](supported-configurationsmedv-orientation.md) - - - - - - - - - diff --git a/mdop/medv-v1/med-v-operations.md b/mdop/medv-v1/med-v-operations.md deleted file mode 100644 index c76249664e..0000000000 --- a/mdop/medv-v1/med-v-operations.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: MED-V Operations -description: MED-V Operations -author: dansimp -ms.assetid: ce362dc0-47a4-4e66-af64-66734fa50c08 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Operations - - -## In This Section - - -[Using the MED-V Management Console User Interface](using-the-med-v-management-console-user-interface.md) -Describes the Microsoft Enterprise Desktop Virtualization (MED-V) management console, as well as how to open it and log in. - -[Creating a MED-V Image](creating-a-med-v-image.md) -Describes how to configure a MED-V image on a computer on which the MED-V client and MED-V management application are installed. - -[Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md) -Describes how to deploy a MED-V workspace using an enterprise software distribution system. - -[Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md) -Describes how to deploy a MED-V workspace using a deployment package. - -[Updating a MED-V Workspace Image](updating-a-med-v-workspace-image.md) -Describes the various ways of updating a MED-V workspace image. - -[MED-V Client Operations](med-v-client-operations.md) -Describes the operations that can be performed using MED-V client. - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-reporting.md b/mdop/medv-v1/med-v-reporting.md deleted file mode 100644 index 17674e3619..0000000000 --- a/mdop/medv-v1/med-v-reporting.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: MED-V Reporting -description: MED-V Reporting -author: dansimp -ms.assetid: b379153b-be89-4a76-a284-2bb4591c3490 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Reporting - - -MED-V provides status, activity log, and error reports to help the administrator review the status, activity, and errors of MED-V users and MED-V workspace. - -## In This Section - - -[How to Generate Reports](how-to-generate-reports-medvv2.md) -Describes how to generate the different types of reports. - -[How to Work with Reports](how-to-work-with-reports.md) -Describes the functions used when working with reports. - -## Related topics - - -[How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md b/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md deleted file mode 100644 index 1aaecaa5a4..0000000000 --- a/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: MED-V Trim Transfer Technology -description: MED-V Trim Transfer Technology -author: dansimp -ms.assetid: 2744e855-a486-4028-9606-f0084794ec65 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Trim Transfer Technology - - -## - - -The MED-V advanced Trim Transfer de-duplication technology accelerates the download of initial and updated virtual machine images over the LAN or WAN, thereby reducing the network bandwidth needed to transport a MED-V workspace virtual machine to multiple end users. - -This breakthrough technology uses existing local data to build the virtual machine image, leveraging the fact that in many cases, much of the virtual machine (for example, system and application files) already exists on the end user's disk. For example, if a virtual machine containing Windows XP is delivered to a client running a local copy of Windows XP, MED-V will automatically remove the redundant Windows XP elements from the transfer. To ensure a valid and functional workspace, the MED-V client cryptographically verifies the integrity of local data before it is utilized, guaranteeing that the local blocks of data are absolutely bit-by-bit identical to those in the desired virtual machine image. Blocks that do not match are not used. - -The process is bandwidth-efficient and transparent, and transfers run in the background, utilizing unused network and CPU resources. - -When updating to a new image version (for example, when administrators want to distribute a new application or patch), only the elements that have changed ("deltas") are downloaded, and not the entire virtual machine, significantly reducing the required network bandwidth and delivery time. - -You can configure which folders are indexed on the host as part of the Trim Transfer protocol, based on the host operating system. These settings are configured in the *ClientSettings.xml* file, which can be found in the **Servers\\Configuration Server\\** folder. - -When applying new settings, the service must be restarted. - -```xml - -- -%WINDIR% -%ProgramFiles%\Common Files -%ProgramFiles%\Internet Explorer -%ProgramFiles%\MED-V -%ProgramFiles%\Microsoft Office -%ProgramFiles%\Windows NT -%ProgramFiles%\Messenger -%ProgramFiles%\Adobe -%ProgramFiles%\Outlook Express - - -- -- -%WINDIR%\MSAgent -%WINDIR%\winsxs -%WINDIR%\system -%WINDIR%\system32 -%WINDIR%\Microsoft.NET -%WINDIR%\SoftwareDistribution -%WINDIR%\L2Schemas -%WINDIR%\Cursors -%WINDIR%\Boot -%WINDIR%\Help -%WINDIR%\assembly -%WINDIR%\inf -%WINDIR%\fonts -%WINDIR%\Installer -%WINDIR%\IME -%WINDIR%\Resources -%WINDIR%\servicing -%ProgramFiles%\MED-V -%ProgramFiles%\Microsoft Office - - -``` - -  - -  - - - - - diff --git a/mdop/medv-v1/overview-of-med-v.md b/mdop/medv-v1/overview-of-med-v.md deleted file mode 100644 index 0d46bf93a7..0000000000 --- a/mdop/medv-v1/overview-of-med-v.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Overview of MED-V -description: Overview of MED-V -author: dansimp -ms.assetid: 32a85b79-91b0-4507-a57a-01ff0fa029f5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of MED-V - - -MED-V uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization. With MED-V, you can easily create, deliver, and manage corporate Virtual PC images on any Windows®-based desktop. - -MED-V is an integral component of the Microsoft Desktop Optimization Pack, a dynamic solution available to Software Assurance customers, which helps reduce application deployment costs, enables delivery of applications as services, and helps to better manage and control enterprise desktop environments. - -  - -  - - - - - diff --git a/mdop/medv-v1/supported-configurationsmedv-orientation.md b/mdop/medv-v1/supported-configurationsmedv-orientation.md deleted file mode 100644 index c66ad41ec2..0000000000 --- a/mdop/medv-v1/supported-configurationsmedv-orientation.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Supported Configurations -description: Supported Configurations -author: dansimp -ms.assetid: c1438455-445a-4bc8-ae20-483b26181f6f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Supported Configurations - - -This section provides the supported configurations for MED-V 1.0 and MED-V 1.0 SP1. - -## In This Section - - -[MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md) -Delineates the supported configurations for MED-V 1.0. - -[MED-V 1.0 SP1 Supported Configurations](med-v-10-sp1-supported-configurationsmedv-10-sp1.md) -Delineates the supported configurations for MED-V 1.0 SP1. - -  - -  - - - - - diff --git a/mdop/medv-v1/technical-referencemedv-10-sp1.md b/mdop/medv-v1/technical-referencemedv-10-sp1.md deleted file mode 100644 index 77b1fc1045..0000000000 --- a/mdop/medv-v1/technical-referencemedv-10-sp1.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Technical Reference -description: Technical Reference -author: dansimp -ms.assetid: 387462c7-bb46-40b8-b4cf-ee9453972582 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference - - -## In This Section - - -This section provides the following technical references for Microsoft Enterprise Desktop Virtualization (MED-V): - -[MED-V Reporting](med-v-reporting.md) -Describes how to generate reports and how to work with reports. - -[MED-V Trim Transfer Technology](med-v-trim-transfer-technology-medvv2.md) -Describes the MED-V Trim Transfer technology concept. - -[How to Back Up and Restore a MED-V Server](how-to-back-up-and-restore-a-med-v-server.md) -Describes how to back up and restore a MED-V server. - -[How to Share Folders Between the Host and the MED-V Workspace](how-to-share-folders-between-the-host-and-the-med-v-workspace.md) -Describes how to share folders located on the network and folders located on the host. - -[How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md) -Describes how to set MED-V workspace deletion options for each user or group. - -[How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md) -Describes the advanced file transfer options. - -[How to Edit a Published Application with Advanced Settings](how-to-edit-a-published-application-with-advanced-settings.md) -Describes editing a published application with advanced settings. - -[How to Set Up Script Actions](how-to-set-up-script-actions.md) -Describes the script actions editor. - -[Client Installation Command Line Reference](client-installation-command-line-reference.md) -Describes how to install MED-V from the command line. - -[How to Configure Image Pre-staging](how-to-configure-image-pre-staging.md) -Describes how to configure image pre-staging and how to update the pre-stage location. - -  - -  - - - - - diff --git a/mdop/medv-v1/troubleshooting-med-v.md b/mdop/medv-v1/troubleshooting-med-v.md deleted file mode 100644 index 52b110ec3b..0000000000 --- a/mdop/medv-v1/troubleshooting-med-v.md +++ /dev/null @@ -1,193 +0,0 @@ ---- -title: Troubleshooting MED-V -description: Troubleshooting MED-V -author: dansimp -ms.assetid: f43dae36-6485-4e06-9c66-0a646e27079d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting MED-V - - -This section provides information to help troubleshoot general issues with Microsoft Enterprise Desktop Virtualization (MED-V). - -## Changing the host resolution and then maximizing the MED-V workspace causes the desktop to appear black - - -When working in full desktop mode, if you change the host resolution and then maximize the MED-V workspace window, the desktop appears black and the MED-V workspace might not respond. - -### Solution - -Stop and then start the MED-V workspace. - -## Starting a MED-V workspace with a network adapter disabled and then later enabling the adapter does not restore network connectivity - - -If you configure a MED-V workspace in bridge mode and then start the MED-V workspace while a network adapter is disabled, if the adapter is later enabled, the network connectivity through that adapter is not restored. - -### Solution - -Stop and then start the MED-V workspace. - -## An image can be used by only one Windows user per computer - - -A MED-V workspace image can be used only by the Windows user who downloaded or imported the image. This user is the only user aside from administrators who have permissions to the folder where the downloaded images are located. - -### Solution - -Manually change the access control list (ACL) on the image store. - -## When installing MED-V by using Configuration Manager with users rights enabled, uninstall fails - - -If MED-V is installed by using Microsoft System Center Configuration Manager and the run mode of the package is set to users rights, uninstall fails with an error message that says that only administrative users can uninstall MED-V. - -### Solution - -When creating a Configuration Manager package for MED-V, set the run mode to administrative rights. - -## When installing MED-V by using a corporate deployment system, where the installation is configured to run the client following installation, you cannot run the client - - -If MED-V is installed by using a corporate deployment system and the installation package is configured to run MED-V client following the installation, after the client is running under the system account, you cannot see that the client is running (except in the notification area), and you cannot interact with it. - -### Solution - -When installing MED-V by using a corporate deployment system, use the *START\_MEDV=0* .msi parameter. - -## MED-V test image fails to start - - -If a MED-V test image fails to start, it will never recover and all future startups will fail with a “GINA fail to load” error message. - -### Solution - -Delete the existing test image and then re-create it. - -## After attempting to join a domain with the wrong credentials, the image never succeeds in joining the domain - - -If there is a configuration error in the join domain building block, which is part of the virtual machine first-time setup script, it causes the MED-V workspace to fail when attempting to join a domain. After the configuration error is repaired, the image included in the MED-V workspace cannot join the domain. - -### Solution - -If the image was deployed, redistribute the image. If the image was a test image, re-create the image. - -## MED-V does not support multiple monitors - - -MED-V does not support displaying published applications across multiple monitors. Published applications and other client windows may be displayed in the wrong screen, and sometimes after a screen is disconnected, MED-V attempts to send the screen to the monitor so that the connected monitor appears blank. - -### Solution - -Disconnect the additional screen, and restart the client. - -## MED-V workspace might fail to start if the host crashes during MED-V workspace startup - - -If the host crashes during the MED-V workspace startup process and an error message appears that says “Root element is missing,” the MED-V workspace might add data to an empty virtual machine configuration (VMC) file, which will cause the startup process to fail. - -### Solution - -Replace the empty VMC file with a VMC file from the base image. - -## The keyboard does not respond in published application windows - - -In a MED-V workspace, if you press the Windows logo key when a published application is in focus, the keyboard no longer responds in published application windows. - -### Solution - -Press the Windows logo key while a published application is in focus. - -## A domain MED-V workspace does not update domain credentials - - -When using a persistent MED-V workspace in a domain environment, if you change your domain password, the MED-V client does not update the MED-V workspace domain credentials. When a published application attempts to access a network resource, you will receive an error message notifying you that your credentials expired. - -### Solution - -Restart the MED-V workspace operating system. - -## Maximized published application windows cover the host taskbar - - -If you maximize a published application window to full screen, it might cover the host taskbar. - -### Solution - -Do one of the following: - -Minimize the published application window to gain access to the notification area, and restart the MED-V workspace. - -Minimize the published application window, and then restore the window to its maximized state. - -## Adding users or groups in the MED-V Server Configuration Manager does not work - - -When adding users or groups in the **Select Users or Groups** dialog box, the selected users or groups are not added to the access control list in the MED-V Server Configuration Manager. - -### Solution - -Add users or groups using the **Enter User or Group names** dialog box. For detailed information, see [How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md#bkmk-configuringpermissions). - -## MED-V does not work on computers with Windows Virtual PC for Windows 7 installed - - -MED-V requires Windows Virtual PC 2007. Windows Virtual PC for Windows 7 and Virtual PC 2007 SP1 cannot be installed on the same computer. - -### Solution - -Uninstall Virtual PC for Windows 7 before installing Virtual PC 2007 SP1 and MED-V. - -## MED-V does not support Virtual PC and Windows XP Mode images - - -MED-V 1.0 SP1 does not support images created by Windows Virtual PC for Windows 7. If a Virtual PC for Windows 7 image is used, the client will fail during startup. - -### Solution - -Create MED-V images by using Virtual PC 2007 SP1. - -## Windows firewall blocks Virtual PC 2007 SP1 network activity - - -By default, Windows firewall blocks Virtual PC 2007 SP1 network activity, and when Virtual PC 2007 SP1 initiates on the client computer, there is a firewall message that blocks its startup sequence and all network access. - -### Solution - -Update the firewall exception by using Group Policy before MED-V is used by the end user. - -## When upgrading the client an error message appears - - -When upgrading the client from MED-V 1.0 to MED-V 1.0 SP1, a message may appear notifying you that no MED-V workspace is defined. - -### Solution - -Close the client and restart it. - -## Related topics - - -[MED-V 1.0 Release Notes](med-v-10-release-notesmedv-10.md) - -[MED-V 1.0 SP1 and SP2 Release Notes](med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md) - -  - -  - - - - - diff --git a/mdop/medv-v1/updating-a-med-v-workspace-image.md b/mdop/medv-v1/updating-a-med-v-workspace-image.md deleted file mode 100644 index c030f2922c..0000000000 --- a/mdop/medv-v1/updating-a-med-v-workspace-image.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Updating a MED-V Workspace Image -description: Updating a MED-V Workspace Image -author: dansimp -ms.assetid: 1b9c4a73-3487-43d2-98e3-43dbc79e10e3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Updating a MED-V Workspace Image - - -An image can be updated in one of the following ways: - -- The update can be pushed to the guest operating system using your enterprise software distribution system. - -- The update can be uploaded to the image Web distribution server, and then downloaded by the client and applied to the MED-V image. - -- The MED-V base image can be updated and redeployed. - -## How to Update a MED-V Image Using an Enterprise Software Distribution System - - -**To update a MED-V image using an enterprise software distribution system** - -- Refer to the documentation of the system you are using. - -## How to Update a MED-V Image Using Web Download - - -**To update a MED-V image using Web download** - -1. In MED-V management, on the **Virtual Machine** tab, ensure that the following settings are applied to the MED-V workspace policies that are associated with the MED-V image being updated: - - - The **Suggest update when a new version is available** check box is selected. - - - Optionally, the **Clients should use Trim Transfer when downloading images for this Workspace** check box is selected. - - For more information, see [How to Apply Virtual Machine Settings to a MED-V Workspace](how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md). - -2. Upload the image update to the image Web distribution server. - - All clients with images that need to be updated automatically download the update and apply it to the image. - -## How to Update a MED-V Base Image - - -**To update a MED-V base image** - -1. Open the existing image in Virtual PC 2007. - -2. Make the required changes to the image, updating the image (such as installing new software). - -3. Close Virtual PC 2007. - -4. Test the image. - -5. After the image is tested, pack it to the local repository, using the same name as the existing image. - - **Note**   - If you name the image a different name than the existing version, a new image will be created rather than a new version of the existing image. - - - -6. Upload the new version to the server, push it to the image pre-stage folder, or distribute it via a deployment package. - -## Related topics - - -[Creating a MED-V Image](creating-a-med-v-image.md) - -[How to Update a MED-V Image](how-to-update-a-med-v-image.md) - -[Configuring MED-V Workspace Policies](configuring-med-v-workspace-policies.md) - -[How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md) - - - - - - - - - diff --git a/mdop/medv-v1/using-the-med-v-management-console-user-interface.md b/mdop/medv-v1/using-the-med-v-management-console-user-interface.md deleted file mode 100644 index 58bf527214..0000000000 --- a/mdop/medv-v1/using-the-med-v-management-console-user-interface.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Using the MED-V Management Console User Interface -description: Using the MED-V Management Console User Interface -author: dansimp -ms.assetid: f42714d7-6f0c-4995-ab31-d4ef0845a22c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using the MED-V Management Console User Interface - - -The console user interface is divided into the following sections: - -- The following **MED-V management buttons**, which correspond to the three modules: - - - **Policy**—The **Policy** module is used to define the MED-V workspaces and their related settings and permissions. - - - **Images**—The **Images** module is used to manage MED-V workspace images. - - - **Reports**—The **Reports** module is used for generating and viewing MED-V workspace reports. - -- The **toolbar** displays shortcuts relevant to the button selected. - -- The **display pane** displays a module corresponding to the button that is selected. - -![](images/medv-ui-console-general.gif) - -## How to Log In to the MED-V Management Console - - -**To open the MED-V management console** - -- On the Windows **Start** menu, select **All Programs > MED-V > MED-V Management**, or on the desktop, double-click the MED-V Management icon. - - The **MED-V Management Login** window appears. - -**Note**   -For security reasons, the first user to log in to the MED-V management console will become the only user on that computer allowed to access the management console. - - - -**To log in** - -1. Type in your domain user credentials in the following format: - - "domain\_name\\user\_name", "password" - - **Note**   - When configuring the server, users with full access as well as users with read-only access are defined. All users must be domain users. The domain user name and password is used for MED-V management login. - - - -2. Click **OK**. - - The **MED-V Management** console appears. - -## Related topics - - -[How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md) - - - - - - - - - diff --git a/mdop/medv-v2/TOC.md b/mdop/medv-v2/TOC.md deleted file mode 100644 index 80bb2410e7..0000000000 --- a/mdop/medv-v2/TOC.md +++ /dev/null @@ -1,85 +0,0 @@ -# [Microsoft Enterprise Desktop Virtualization 2](index.md) -## [Getting Started with MED-V](getting-started-with-med-vmedv2.md) -### [Overview of MED-V](overview-of-med-vmedv2.md) -### [Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) -### [High-Level Architecture](high-level-architecturemedv2.md) -### [About MED-V 2.0](about-med-v-20.md) -#### [What's New in MED-V 2.0](whats-new-in-med-v-20.md) -#### [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) -#### [MED-V 2.0 Release Notes](med-v-20-release-notes.md) -## [Planning for MED-V](planning-for-med-v.md) -### [End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) -### [Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) -#### [Determining How MED-V Will Be Deployed](determining-how-med-v-will-be-deployed.md) -#### [Identifying the Number and Types of MED-V Workspaces](identifying-the-number-and-types-of-med-v-workspaces.md) -### [MED-V 2.0 Best Practices](med-v-20-best-practices.md) -## [Deployment of MED-V](deployment-of-med-v.md) -### [End-to-End Deployment Scenario for MED-V 2.0](end-to-end-deployment-scenario-for-med-v-20.md) -### [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) -### [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) -### [Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) -#### [Configure Environment Prerequisites](configure-environment-prerequisites.md) -#### [Configure Installation Prerequisites](configure-installation-prerequisites.md) -### [Deploy the MED-V Components](deploy-the-med-v-components.md) -#### [How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md) -#### [How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md) -#### [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md) -#### [How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md) -## [Operations for MED-V](operations-for-med-v.md) -### [End-to-End Operations Scenario for MED-V 2.0](end-to-end-operations-scenario-for-med-v-20.md) -### [Prepare a MED-V Image](prepare-a-med-v-image.md) -#### [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md) -#### [Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) -#### [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) -### [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) -#### [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md) -### [Test And Deploy the MED-V Workspace Package](test-and-deploy-the-med-v-workspace-package.md) -#### [Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) -##### [How to Create a Test Environment](how-to-create-a-test-environment.md) -##### [How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) -##### [How to Test URL Redirection](how-to-test-url-redirection.md) -##### [How to Test Application Publishing](how-to-test-application-publishing.md) -#### [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) -##### [How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md) -##### [How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md) -##### [How to Deploy a MED-V Workspace Manually](how-to-deploy-a-med-v-workspace-manually.md) -### [Monitor MED-V Workspaces](monitor-med-v-workspaces.md) -#### [Monitoring MED-V Workspace Deployments](monitoring-med-v-workspace-deployments.md) -#### [Detecting Network Changes that Affect MED-V](detecting-network-changes-that-affect-med-v.md) -### [Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) -#### [Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md) -##### [Installing and Removing an Application on the MED-V Workspace](installing-and-removing-an-application-on-the-med-v-workspace.md) -##### [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) -#### [Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md) -#### [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md) -### [Manage MED-V URL Redirection](manage-med-v-url-redirection.md) -#### [How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace](how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md) -#### [How to Manage URL Redirection by Using the MED-V Workspace Packager](how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md) -### [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) -#### [Managing MED-V Workspace Settings by Using the MED-V Workspace Packager](managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md) -#### [Managing MED-V Workspace Settings by Using a WMI](managing-med-v-workspace-settings-by-using-a-wmi.md) -#### [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) -#### [Managing Printers on a MED-V Workspace](managing-printers-on-a-med-v-workspace.md) -## [Troubleshooting MED-V](troubleshooting-med-vmedv2.md) -### [Deployment Troubleshooting](deployment-troubleshooting.md) -### [Operations Troubleshooting](operations-troubleshooting-medv2.md) -### [Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md) -#### [Viewing and Configuring MED-V Logs](viewing-and-configuring-med-v-logs.md) -#### [Restarting and Resetting a MED-V Workspace](restarting-and-resetting-a-med-v-workspace.md) -#### [Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md) -## [Security and Protection for MED-V](security-and-protection-for-med-v.md) -### [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md) -### [Authentication of MED-V End Users](authentication-of-med-v-end-users.md) -## [Technical Reference for MED-V](technical-reference-for-med-v.md) -### [Command-Line Options for MED-V Installation Files](command-line-options-for-med-v-installation-files.md) -### [Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md) -### [MED-V Event Log Messages](med-v-event-log-messages.md) -### [Updating MED-V 2.0](updating-med-v-20.md) -### [Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md) -### [Example MED-V Checklists](example-med-v-checklists.md) -#### [Example MED-V Environment Planning Checklist](example-med-v-environment-planning-checklist.md) -#### [Example MED-V Project Planning Checklist](example-med-v-project-planning-checklist.md) -#### [Example MED-V System Installation Checklist](example-med-v-system-installation-checklist.md) -#### [Example MED-V Image Preparation Checklist](example-med-v-image-preparation-checklist.md) -#### [Example MED-V Workspace Deployment Checklist](example-med-v-workspace-deployment-checklist.md) - diff --git a/mdop/medv-v2/about-med-v-20.md b/mdop/medv-v2/about-med-v-20.md deleted file mode 100644 index dd2c32be10..0000000000 --- a/mdop/medv-v2/about-med-v-20.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: About MED-V 2.0 -description: About MED-V 2.0 -author: dansimp -ms.assetid: 7ec53f2c-db6e-4a6b-a069-99d0c25cd101 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About MED-V 2.0 - - -## In This Section - - -This section provides information related specifically to MED-V 2.0 and includes the following topics: - -[What's New in MED-V 2.0](whats-new-in-med-v-20.md) -Describes system requirements and new and changed features in MED-V 2.0. - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) -Describes the supported configurations for MED-V 2.0. - -[MED-V 2.0 Release Notes](med-v-20-release-notes.md) -Provides a list of known issues with MED-V 2.0. - -## Related topics - - -[Getting Started with MED-V](getting-started-with-med-vmedv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/authentication-of-med-v-end-users.md b/mdop/medv-v2/authentication-of-med-v-end-users.md deleted file mode 100644 index 843a257c5b..0000000000 --- a/mdop/medv-v2/authentication-of-med-v-end-users.md +++ /dev/null @@ -1,135 +0,0 @@ ---- -title: Authentication of MED-V End Users -description: Authentication of MED-V End Users -author: dansimp -ms.assetid: aaf96eb6-91d1-4f4d-9854-5fc73c7ae7ab -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Authentication of MED-V End Users - - -The authentication of Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 end users is a very important security issue. In this context, authentication refers to verifying the identity of the MED-V end user. - -The following section provides information and guidance about end-user authentication in MED-V. - -## User Authentication in MED-V - - -Authentication in MED-V generally occurs at two levels: when a user first accesses MED-V and every time that they change their password. - -Depending on how you have configured MED-V settings for authentication, the end user is typically prompted at some point to enter their password, either the first time MED-V is started or the first time that they try to open a published application. - -There are several aspects of end-user authentication that you can control, including the following: - -Whether the credentials the end user enters are stored in Credential Manager - -In what manner the end user is presented with the option of entering and saving their password - -Depending on your company’s preferred process for managing end-user authentication, you can specify whether credential caching occurs for a particular MED-V workspace. Caching the credentials of an end user is helpful because they are only prompted one time for their password. If the end user is not allowed to save their password or they decide not to, every time that they start a new MED-V session, they must enter it again. For example, if MED-V is configured to start when the end user logs on to the host but Authentication is disabled, the end user is only prompted one time during logon. In this case, credentials are valid until the end user logs off from the host. - -If it is necessary, you can use Credential Manager to remove any stored end-user credentials. - -By default, credential storing is disabled, but you can change this setting through one of the following methods: - -**While you are creating the MED-V workspace package**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - -**After you have deployed the MED-V workspace**. Edit the MED-V cmdlet parameter UxCredentialCacheEnabled to set the Terminal Services registry key. For more information, see Windows PowerShell Help. - -After MED-V workspace deployment, you can set your preference for end-user authentication by modifying the Terminal Services policy named DisablePasswordSaving. DisablePasswordSaving controls whether the password saving check box appears on the RDP client dialog window and whether the MED-V credential prompt is displayed. - -Following is the policy path for the Terminal Services policy named DisablePasswordSaving. - -**Regedit:** - -HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Virtual Machine\\Policies\\DisablePasswordSaving - -**Note** -The changes that you make to DisablePasswordSaving only affect the RDP prompt to a virtual machine. - - - -The following table lists the different ways you can configure your settings for credential storing and the effects of the different configurations: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    ValueConfigurationResult

    DisablePasswordSaving

    Disabled

    The MED-V prompt is presented and a check box to accept is available and cleared. If the end user selects the check box, credentials are cached for subsequent use. The end user also has the benefit of only being prompted when the password expires.

    -

    If the end user does not select the check box, the Remote Desktop Connection (RDC) Client prompt is presented instead of the MED-V prompt, and the check box to accept is cleared. If the end user selects the check box, the RDC Client credential is stored for later use.

    -
    -Important

    RDC does not validate credentials when the end user enters them. If the end user caches the credentials through the RDC prompt, there is a risk that incorrect credentials might be stored. In this case, the incorrect credentials must be deleted in the Windows Credential Manager.

    -
    -
    - -

    DisablePasswordSaving

    Enabled

    -Note

    This configuration is more secure because it does not allow end user credentials to be cached.

    -
    -
    - -
    - - - -By default, the MED-V installation sets a registry key in the guest to suppress the "password about to expire" prompt. The end user is only prompted for a password change on the host. Credentials that are updated on the host are passed to the guest. - -**Caution** -If you use Group Policy in your environment, know that it can override the registry key causing the password prompts from the guest to reappear. - - - -### Security Concerns with Authentication - -Even though caching the end user’s credentials provides the best user experience, you must be aware of the risks involved. - -When credential caching is enabled, the end user’s domain credential is stored in a reversible format within the Windows Credential Manager. As a result, an attacker could write a tool that runs as either a system level process or an end user process and that retrieves the end user's credentials. You can only lessen this risk by setting DisablePasswordSaving to **Enabled**. - -This same concern exists when MED-V authentication is disabled but the Terminal Services policy setting is enabled. - -## Related topics - - -[Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md) - - - - - - - - - diff --git a/mdop/medv-v2/command-line-options-for-med-v-installation-files.md b/mdop/medv-v2/command-line-options-for-med-v-installation-files.md deleted file mode 100644 index f6e9a21158..0000000000 --- a/mdop/medv-v2/command-line-options-for-med-v-installation-files.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: Command-Line Options for MED-V Installation Files -description: Command-Line Options for MED-V Installation Files -author: dansimp -ms.assetid: 7b8cd3e4-1d09-44a0-b690-f85b0d0a6b02 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Command-Line Options for MED-V Installation Files - - -When you install or uninstall Microsoft Enterprise Desktop Virtualization (MED-V) 2.0, you have the option of running the installation files at the command prompt. This section describes different options that you can specify when you install or uninstall MED-V at the command prompt. - -### Command-Line Arguments - -You can use the following command-line arguments together with their respective MED-V installation files. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Installation FileArgumentAccepted ValuesTypeDescriptionDefault

    Host Agent

    MEDVDIR

    <install path>

    Installation

    Change installed directory

    Installation goes to Program Files\Microsoft Enterprise Desktop Virtualization.

    MED-V Workspace Packager

    MEDVDIR

    <install path>

    Installation

    Change installed directory

    Installation goes to Program Files\Microsoft Enterprise Desktop Virtualization.

    MED-V workspace

    INSTALLDIR

    <install path>

    Installation

    Change installed directory

    Installation goes to ProgramData\Microsoft\Medv\Workspace.

    MED-V workspace

    OVERWRITE VHD

    0 or 1

    Installation

    Fail installation if VHD exists(0) or overwrite existing VHD(1).

    Overwrite does not occur and installation fails if a virtual hard disk (VHD) already exists.

    MED-V workspace

    SUPPRESSMEDVLAUNCH

    0 or 1

    Installation

    Start(0) or do not start(1) MED-V after MED-V workspace is installed.

    If the MED-V workspace was installed with the user interface (UI), a check box on the Finish page controls whether to start MED-V.

    MED-V workspace

    DELETEDIFFDISKS

    0 or 1

    Uninstallation

    Keep(0) or delete(1) VHDs created by MED-V

    No VHDs are deleted.

    - -  - -### Examples of Command-Line Arguments - -The following example installs the MED-V workspace created by the MED-V workspace Packager. The installation file creates a log file in the Temp directory and runs the installation file in quiet mode, but does not start the MED-V Host Agent on completion. The installation file overwrites any VHD left behind by a previous installation that has the same name. - -``` syntax -setup.exe /l* %temp%\medv-workspace-install.log /qn SUPPRESSMEDVLAUNCH=1 OVERWRITEVHD=1 -``` - -The following example uninstalls the MED-V workspace that was previously installed. The installation file creates a log file in the Temp directory and runs the installation file in quiet mode. The installation file deletes any remaining virtual hard disk files from the file system. - -``` syntax -%ProgramData%\Microsoft\Medv\Workspace\uninstall.exe /l* %temp%\medv-workspace-uninstall.log /qn DELETEDIFFDISKS=1 -``` - -## Related topics - - -[Deploy the MED-V Components](deploy-the-med-v-components.md) - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md b/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md deleted file mode 100644 index 66fc177330..0000000000 --- a/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Compacting the MED-V Virtual Hard Disk -description: Compacting the MED-V Virtual Hard Disk -author: dansimp -ms.assetid: 5e6122d1-9847-4b33-adab-594919eec3c5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Compacting the MED-V Virtual Hard Disk - - -Although it is optional, you can compact the virtual hard disk (VHD) to reclaim empty disk space and reduce the size of the VHD before you configure the Windows Virtual PC image. - -**Important**   -Before you proceed, create a backup copy of your Windows XP image. - - - -**Preparing the Virtual Hard Disk** - -1. Open your Windows XP image. - - Click **Start**, click **All Programs**, click **Windows Virtual PC**, click **Windows Virtual PC**, then double-click your Windows XP image. - -2. Clear the DLL cache. - - 1. At a command prompt in the virtual machine, type **sfc /cachesize=1**. - - 2. Restart the virtual machine. - - 3. At a command prompt in the virtual machine, type **sfc /purgecache**. - -3. Delete unnecessary files, such as uninstallers, temp files, log files, page files, shared folders, and so on. - -4. Turn off System Restore. You can also specify this step in your Sysprep.inf file. - - 1. In **Control Panel**, double-click **System**, and then select the **System Restore** tab. - - 2. Select **Turn off System Restore**, and then click **OK**. - -5. Set maximum event log sizes and clear all events. - - 1. Open the event viewer. - - Click **Start**, click **Control Panel**, double-click **Administrative Tools**, then double-click **Event Viewer**. - - 2. Right-click **Application**, and click **Properties**. - - 3. In the **Log Size** area, set **Maximum Log Size** to 512KB and then select **Overwrite events as needed**. - - 4. Click **Clear Log**. In the **Event Viewer** dialog box that appears, click **No**. - - 5. In the **Properties** window, click **OK**. - - 6. Repeat steps a through e for the **Security** and **System** logs. - -6. Run the Disk Cleanup Tool. - - Click **Start**, click **All Programs**, click **Accessories**, click **System Tools**, and then click **Disk Cleanup**. - -7. Configure your page file as needed for your applications. - - 1. In **Control Panel**, double-click **System**, and then select the **Advanced** tab. - - 2. In the **Performance** area, click **Settings**. - - 3. In the **Virtual Memory** area, click **Change**. - - 4. Configure your page file settings. - -8. Shut down the Windows XP image. - -**Defragmenting and Pre-compacting the Virtual Hard Disk** - -1. In **Control Panel** on the host computer that is running Windows 7, click **Administrative Tools**, double-click **Computer Management**, then click **Disk Management**. - -2. By using the Disk Management Console, attach (mount) the virtual hard disk and then defragment the disk. - -3. By using an ISO extraction tool, extract the precompact.iso located in the \\Program Files\\Windows Virtual PC\\Integration Components folder. - -4. Use the precompact.exe program to compress the Windows XP virtual hard disk. - -5. By using the Disk Management Console, detach the virtual hard disk. - -**Compacting the Virtual Hard Disk** - -1. Open Windows Virtual PC. - - Click **Start**, click **All Programs**, click **Windows Virtual PC**, then click **Windows Virtual PC**. - -2. Right-click your Windows XP image and select **Settings**. - -3. Click **Hard Disk** for the one that corresponds to your Windows XP image, and then click **Modify**. - -4. Click **Compact virtual hard disk**. - -5. Click **Compact** and then click **OK**. - -Create a backup copy of your compacted virtual hard disk. - -## Related topics - - -[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/configure-environment-prerequisites.md b/mdop/medv-v2/configure-environment-prerequisites.md deleted file mode 100644 index 061ec06592..0000000000 --- a/mdop/medv-v2/configure-environment-prerequisites.md +++ /dev/null @@ -1,64 +0,0 @@ ---- -title: Configure Environment Prerequisites -description: Configure Environment Prerequisites -author: dansimp -ms.assetid: 7379e8e5-1cb2-4b8e-8acc-5c04e26f8c91 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configure Environment Prerequisites - - -Before you can deploy and run Microsoft Enterprise Desktop Virtualization (MED-V) 2.0, you must ensure that your environment meets the following minimum prerequisites. - -**Windows 7** - -The MED-V Host Agent and the MED-V Workspace Packager are only supported in Windows 7 or newer. - -**Windows XP SP3** - -The MED-V Guest Agent is only supported in Windows XP SP3. - -**.NET Framework 3.5 SP1** - -The MED-V Host and Guest agents and the MED-V Workspace Packager require the Microsoft .NET Framework 3.5 SP1. - -**Important**   -You must also install the update [KB959209](https://go.microsoft.com/fwlink/?LinkId=204950) (https://go.microsoft.com/fwlink/?LinkId=204950), which addresses several known application compatibility issues. - - - -**Note**   -You must manually install the .NET Framework 3.5 SP1 and the update KB959209 into the Windows Virtual PC image that you prepare for use with MED-V. However, by default, the Microsoft .NET Framework 3.5 SP1 and the update are included when you install Windows 7 on the host computer. - - - -**An Active Directory Infrastructure** - -Group Policy provides the centralized management and configuration of operating systems, applications, and users' settings in an Active Directory environment. - -## Related topics - - -[Configure Installation Prerequisites](configure-installation-prerequisites.md) - -[High-Level Architecture](high-level-architecturemedv2.md) - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) - - - - - - - - - diff --git a/mdop/medv-v2/configure-installation-prerequisites.md b/mdop/medv-v2/configure-installation-prerequisites.md deleted file mode 100644 index efb17dc81e..0000000000 --- a/mdop/medv-v2/configure-installation-prerequisites.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Configure Installation Prerequisites -description: Configure Installation Prerequisites -author: dansimp -ms.assetid: ff9cf28a-3eac-4b6c-8ce9-bfc202f57947 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configure Installation Prerequisites - - -The following instructions are prerequisites for installing and using Microsoft Enterprise Desktop Virtualization (MED-V) 2.0: - -[Windows Virtual PC](#bkmk-howtoinstallandconfiguremicrosoftvirtualpc7) - -[Windows Virtual PC Update](#bkmk-howtoinstallandconfiguremicrosoftvirtualpc7update) - -[Antivirus/Backup Software Configuration](#bkmk-antivirusbackupsoftwareconfiguration) - -## How to Install and Configure Windows Virtual PC - - -**Important**   -If a version of Virtual PC for Windows already exists on the host computer, you must uninstall it before you install Windows Virtual PC. - - - -**To install Windows Virtual PC** - -1. Download [Windows Virtual PC](https://go.microsoft.com/fwlink/?LinkId=195918) from the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=195918). - -2. Run the installation file on the host computer, and follow the steps in the wizard. - -**Important**   -Windows Virtual PC includes the Integration Components package, which provides features that improve the interaction between the virtual environment and the physical computer. For example, it lets your mouse move between the host and the guest computers. MED-V requires the installation of the Integration Components package. - - - -## How to Install and Configure the Windows Virtual PC Update - - -The Microsoft update associated with article KB977206 enables Windows XP Mode for computers without hardware-assisted virtualization (HAV) technology. We recommended that you install this update because some integration features might not work correctly if the Integration Components package in the guest operating system do not match the version of Windows Virtual PC that is installed on the host computer. - -**Important**   -You do not have to install this update when you are installing MED-V on host computers that are running Windows 7 with Service Pack 1. - - - -**Tip**   -In addition to the update listed here, we recommend that you review all available Windows Virtual PC updates and apply those updates that are appropriate or necessary for your environment. - - - -**To install the Windows Virtual PC Update** - -1. Download the required Windows Virtual PC update from the Microsoft Download Center. - - [32-bit Update](https://go.microsoft.com/fwlink/?LinkId=195919) (https://go.microsoft.com/fwlink/?LinkId=195919). - - [64-bit Update](https://go.microsoft.com/fwlink/?LinkId=195920) (https://go.microsoft.com/fwlink/?LinkId=195920). - -2. Run the installation file on the host computer in elevated mode, and follow the steps in the wizard. - - For more information about the hotfix package for Windows Virtual PC, see [article 977206](https://go.microsoft.com/fwlink/?LinkId=195921) (https://go.microsoft.com/fwlink/?LinkId=195921). - -## How to Configure Antivirus/Backup Software - - -To prevent antivirus activity from affecting the performance of the virtual desktop, we recommend, where you can, to exclude the following virtual machine file types from any antivirus or backup process that is running on the host computer: - -- \*.VMC - -- \*.VUD - -- \*.VSV - -- \*.VHD - -## Related topics - - -[Configure Environment Prerequisites](configure-environment-prerequisites.md) - -[High-Level Architecture](high-level-architecturemedv2.md) - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) - - - - - - - - - diff --git a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md deleted file mode 100644 index 93373c0249..0000000000 --- a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Configuring a Windows Virtual PC Image for MED-V -description: Configuring a Windows Virtual PC Image for MED-V -author: dansimp -ms.assetid: d87a0df8-9e08-4d1e-bfb0-9dc3cebf0d28 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# Configuring a Windows Virtual PC Image for MED-V - - -After you have installed everything that you want to include in your MED-V image, you can configure the image for use in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. The topics in this section provide guidance for configuring your MED-V image to run first time setup before you create your MED-V workspace package. - -First time setup prepares the MED-V workspace for an end user. The process creates a virtual machine from the image packaged in the MED-V workspace and then runs Windows Mini-Setup on the virtual machine. This includes the running of both custom setup scripts and the first time setup completion application, FtsCompletion.exe. - -Follow these steps to configure your MED-V image for running first time setup: - -1. As an option, you can compact the virtual hard disk (VHD) to reclaim empty disk space and reduce the size of the VHD before you continue with configuring the Windows Virtual PC image. For more information, see [Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md). - -2. Customize the virtual machine setup process. - -3. Seal the MED-V image by using Sysprep. - - **Customizing the Virtual Machine Setup Process** - -4. As part of preparing your image for use with MED-V, you can configure various settings on the virtual machine, such as specifying the settings for running Windows Update. Specify all the necessary virtual machine settings before you create the MED-V workspace package. - -5. Before you create the MED-V workspace package, we recommend that you disable restore points on the virtual machine to prevent the differencing disk from growing unbounded. For more information, see [How to turn off and turn on System Restore in Windows XP](https://go.microsoft.com/fwlink/?LinkId=195927) (https://go.microsoft.com/fwlink/?LinkId=195927). - - **Note** - You can set up your Sysprep.inf file to disable restore points when first time setup is run. For an example of setting this GuiRunOnce key, see the sample Sysprep.inf file later in this section. - - - -6. Configure the setup process to run Mini-Setup instead of the default Windows Welcome. You must either run the Sysprep tool by using the **-mini** switch, or select the **MiniSetup** check box in the graphical user interface. For more information, see [How to Seal the Image with Sysprep](#bkmk-seal). - - **Calling the First time setup Completion File** - - 1. An executable called FtsCompletion.exe is included as part of the installation of the MED-V Guest Agent. By default, it is located in the system drive of your MED-V image under **Program Files – Microsoft Enterprise Desktop Virtualization**. - - **Important** - As the final step in the first time setup process, you must run this executable program. The user for whom the executable program is being called must be a member of the guest’s local administrator group. - - - - 2. You can decide how you want to call this executable program, for example, through a script that is deployed with the MED-V workspace. You can call this executable as the last line of your Sysprep.inf file. For an example of how to call this executable program in your Sysprep.inf file, see the sample file later in this section. - -After you have completed customization of your MED-V image, you are ready to seal the image by using Sysprep. - -**Sealing the MED-V Image by Using Sysprep** - -1. The System Preparation tool (Sysprep) is a technology that you can use to perform image-based installations throughout the network with minimal intervention by an administrator or IT-Professional. - -2. In a MED-V environment, you can use Sysprep to assign unique security IDs (SID) and other settings to each MED-V workspace the first time that they are started. - - **Note** - For more information about how to use Sysprep, see [Sysprep Technical Reference](https://go.microsoft.com/fwlink/?LinkId=195930) (https://go.microsoft.com/fwlink/?LinkId=195930). - - - -~~~ -**Caution** -When you use non-ASCII characters in the Sysprep.inf file, you must save the file by using the encoding appropriate for the characters entered. Windows XP expects the Sysprep.inf file to be encoded by using the code page for the language that you are targeting. - -You must also make sure that the System Locale of the computers to which the MED-V workspace is deployed is set to handle the language specific characters that might be present in the Sysprep.inf file. To change the settings for the System Locale, follow these steps: - -1. To open Region and Language, click **Start**, click **Control Panel**, and then click **Region and Language**. - -2. Click the **Administrative** tab, and then click **Change System Locale** under **Language for non-Unicode programs**. - - If you are prompted for an administrator password or confirmation, type the administrator password or provide confirmation. - -3. Select your preferred language and then click **OK**. - - - -**To configure Sysprep on the MED-V Guest Computer** - -1. Create a folder named *Sysprep* in the root of the MED-V image system drive. - -2. Download the deploy.cab file. For more information, see [Windows XP Service Pack 3 Deployment Tools](https://go.microsoft.com/fwlink/?LinkId=195928) From the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=195928). - -3. From the deploy.cab file, copy or extract the Setupmgr.exe, Sysprep.exe, and Setupcl.exe files to the Sysprep folder. - -4. In the Sysprep folder, run **Setup Manager** (Setupmgr.exe) to create a Sysprep.inf answer file. - - Or, you can create this file manually or use your company’s existing file. For more information, see [How to use the Sysprep tool to automate successful deployment of Windows XP](https://go.microsoft.com/fwlink/?LinkId=195929) (https://go.microsoft.com/fwlink/?LinkId=195929). - -5. Follow the **Setup Manager** wizard. - - **Important** - You must configure the MED-V guest to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host. - - - - **Caution** - When you configure a proxy account for joining virtual machines to the domain, know that it is possible for an end user to obtain the proxy account credentials. Take all the necessary security precautions to minimize risk, such as limiting account user rights. For more information about security concerns when you configure a Windows Virtual PC image for MED-V, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md). - - - - If end users must provide information during the first time setup process based on the parameters specified in the Sysprep.inf file, you must also specify that first time setup is run in **Attended** mode when you are creating your MED-V workspace package. If no information will be required from the end user, you can specify that first time setup is run in **Unattended** mode when you are creating your MED-V workspace package. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - Although you can specify any settings that you prefer, a MED-V best practice is that you create the Sysprep.inf file so that first time setup can be run in **Unattended** mode. This requires that you provide all of the required settings information as you continue through the **Setup Manager** wizard. - - **Caution** - If you have set a local policy or registry entry to include a service level agreement (SLA) in your image (VHD), you must specify that first time setup is run in **Attended** mode or first time setup will fail. Or, a MED-V best practice is to enforce the SLA through Group Policy later so that the SLA is displayed to the end user after first time setup is finished. - - - - **Note** - You can configure the MED-V workspace to set certain Sysprep.inf settings based on the configuration of the host and the identity of the end user. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - - -6. Seal the MED-V image. - - **Important** - We recommend that you make a backup copy of the MED-V image before sealing it. - - - - After you have completed all the steps in the **Setup Manager** wizard, you are ready to run Sysprep to seal the MED-V image. - -**To run Sysprep** - -1. Run the System Preparation Tool (Sysprep.exe) from the *Sysprep* folder that you created when you configured Sysprep in the MED-V virtual machine. - -2. In the warning message box that appears, click **OK**. - -3. In the **Options** dialog box, select the **Don't reset grace period for activation** and **Use Mini-Setup** check boxes. Also, make sure that the **Shutdown mode** box is set to **Shut down**. - -4. Click **Reseal**. This removes identity information and clears event logs to prepare for first time setup. - -5. If you are not satisfied with the information listed in the confirmation message box that appears, click **Cancel** and then change the selections. - -6. Click **OK** to complete the system preparation process. - -After you have run Sysprep on your MED-V image, the virtual machine shuts down and is ready for use in creating a MED-V workspace. -~~~ - -## Example - - -Here is an example of a Sysprep.inf file. - -``` syntax -;SetupMgrTag -[GuiUnattended] - EncryptedAdminPassword=NO - TimeZone=10 - OEMDuplicatorstring="MED_V v2 Host" - AdminPassword="administrator" - AutoLogon=Yes - AutoLogonCount=1 - OEMSkipRegional=1 - OemSkipWelcome=1 - -[UserData] - ProductKey= - FullName="MED-V User" - OrgName="Contoso" - ComputerName=* - -[Identification] - JoinDomain=domain.corp.contoso.com - DomainAdmin=UserName - DomainAdminPassword=Password - -[Networking] - InstallDefaultComponents=Yes - -[Branding] - BrandIEUsingUnattended=Yes - -[Proxy] - Proxy_Enable=0 - Use_Same_Proxy=0 - -[Unattended] - InstallFilesPath=C:\sysprep\i386 - TargetPath=\WINDOWS - UpdateServerProfileDirectory=1 - OemSkipEula=Yes - -[RegionalSettings] - LanguageGroup=1 - Language=00000409 - -[GuiRunOnce] - Command0="wmic /namespace:\\root\default path SystemRestore call Disable %SystemDrive%\" - Command1="c:\Program Files\Microsoft Enterprise Desktop Virtualization\FtsCompletion.exe" - -[sysprepcleanup] -``` - -## Related topics - - -[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) - -[Prepare a MED-V Image](prepare-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md b/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md deleted file mode 100644 index 36f93794e4..0000000000 --- a/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: Configuring Advanced Settings by Using Windows PowerShell -description: Configuring Advanced Settings by Using Windows PowerShell -author: dansimp -ms.assetid: 437a31cc-2a11-456f-b448-b0b869fb53f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring Advanced Settings by Using Windows PowerShell - - -The MED-V workspace package that you create includes a Windows PowerShell script (.ps1) file that you can edit before you test and deploy your MED-V workspace package. This section provides information and guidance to help you manage MED-V configuration settings by using Windows PowerShell before you deploy the MED-V workspaces. - -## Using Windows PowerShell Cmdlets in MED-V - - -The following Windows PowerShell cmdlets are available in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0: - -**New-MedvConfiguration** - -**Export-MedvConfiguration** - -**New-MedvWorkspace** - -**Export-MedvWorkspace** - -To access Windows PowerShell cmdlets for MED-V, open Windows PowerShell and type the following command to import the MED-V modules. - -``` syntax -Import-Module microsoft.medv -``` - -After the modules are imported, you can access inline help for the cmdlets by using the standard Windows PowerShell Help commands, **man** or **get-help**. For example, to access a description of the **New-MedvConfiguration** cmdlet including a complete list of available parameters, type the following command. - -``` syntax -get-help New-MedvConfiguration -``` - -You can also view help for specific parameters. For example, to view help for the parameter VmMemory, type the following: - -``` syntax -get-help New-MedvConfiguration -parameter VmMemory -``` - -To view a list of all MED-V configuration settings and their defaults, type the following command. - -``` syntax -New-MedvConfiguration -ForceDefaults -``` - -To view a list of all MED-V configuration settings and their current values, type the following command. - -``` syntax -gwmi -Class "Setting” -Namespace "root/microsoft/medv” -``` - -## Creating a MED-V Workspace with Custom Settings - - -After you successfully create a MED-V workspace package by using the MED-V Workspace Packager, a Windows PowerShell script is generated in the folder you specified for saving your packager files. The contents of this script show some of the available MED-V configuration settings that you can edit. - -Following these steps, you can customize the script and then run it in Windows PowerShell to create a MED-V workspace with the new settings. - -**Important**   -Run Windows PowerShell with administrative credentials, and ensure that the Windows PowerShell execution policy allows the running of scripts. - -1. Edit the Windows PowerShell script that was generated by the MED-V Workspace Packager, or author a new script with the configuration settings that you want. - -2. Run Windows PowerShell with administrative credentials and at the command prompt, type the following command. - - ``` syntax - & “.\.ps1” - ``` - - This command runs the Windows PowerShell script and runs the **New-MedvWorkspace** cmdlet to generate a new MED-V workspace package. The new packager files are saved in the folder that you originally specified for storing your MED-V Workspace Packager files. For additional help about this cmdlet, see the Windows PowerShell Help. - - - -## Exporting a MED-V Configuration to a Registry File - - -You can update MED-V configuration settings after the MED-V workspace is installed. Use the **New-MedvConfiguration** cmdlet to specify the parameters that you want to change. For example, to create a registry file that changes the virtual machine memory setting, type the following commands. - -``` syntax -New-MedvConfiguration -VmMemory 1024 | Export-MedvConfiguration -Path c:\medvConfiguration\myConfig.reg -``` - -You can import the resultant registry file from the host computer to a MED-V workspace to apply the new configuration settings. - -## Related topics - - -[Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) - -[Test And Deploy the MED-V Workspace Package](test-and-deploy-the-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/create-a-med-v-workspace-package.md b/mdop/medv-v2/create-a-med-v-workspace-package.md deleted file mode 100644 index 900ad453d6..0000000000 --- a/mdop/medv-v2/create-a-med-v-workspace-package.md +++ /dev/null @@ -1,460 +0,0 @@ ---- -title: Create a MED-V Workspace Package -description: Create a MED-V Workspace Package -author: dansimp -ms.assetid: 3f75fe73-41ac-4389-ae21-5efb2d437f4d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create a MED-V Workspace Package - - -A MED-V workspace is the Windows XP desktop environment where end users interact with the virtual machine provided by MED-V. The administrator creates and customizes the MED-V workspace. The workspace consists of an image and the Group Policy that defines the rules and functionality of the MED-V workspace. - -You can create multiple MED-V workspaces, each customized with its own configuration, settings, and rules. A user, group, or multiple users or groups can be associated with each MED-V workspace. The customization makes that MED-V workspace available only for that user or group. - -Use the **MED-V Workspace Packager** to create MED-V workspaces. The **MED-V Workspace Packager** is divided into two main sections: - -- A main panel that includes three buttons that you use to create and manage MED-V workspaces. The **Create a MED-V Workspace Package** button opens the **Create MED-V Workspace Package Wizard** that you use to create your MED-V workspaces. - -- A **Help Center** on the right-hand side of the window that provides information and guidance to help you create, test, and manage your MED-V workspaces. - -**Important** -Before you can use the **MED-V Workspace Packager**, you must first make sure that the Windows PowerShell execution policy is set to Unrestricted. - -`Set-ExecutionPolicy Unrestricted` - -In addition, the SAN policy for the computer on which the **MED-V Workspace Packager** is run must be set to “Online All”. To check the setting of the SAN policy, run the following commands at a command prompt with administrative credentials: - -`diskpart.exe` - -`DISKPART> san` - -`DISKPART> exit` - -If it is necessary, change the SAN policy to "Online All" by typing the following commands at the command prompt with administrative credentials: - -`diskpart.exe` - -`DISKPART> san policy=onlineall` - -`DISKPART> exit` - - - -**Important** -If automatic disk encryption software is installed on the computer that you use to mount the virtual hard disk and build the MED-V workspace package, you must disable the software before you start. Otherwise, you cannot use the MED-V workspace on any other computer. - - - -The information we provide here can help you create your MED-V workspace deployment package. - -## Prerequisites - - -Before you start to build your MED-V workspace deployment package, verify that you have access to the following items: - -- **A prepared Windows XP image** - - For more information about how to create a Windows XP image for use with MED-V, see [Prepare a MED-V Image](prepare-a-med-v-image.md). - -- **A text file or list that contains URL redirection information** - - Your URL redirection text file or list contains those URLs that you want redirected from the host computer to Internet Explorer in the MED-V workspace. When you are using the packaging wizard to create your MED-V workspace, you import, type, or copy and paste this redirection information as one of the steps in the package creation process. - - **Note** - URL redirection in MED-V only supports the protocols HTTP and HTTPS. MED-V does not provide support for FTP or any other protocols. - - - -~~~ -Enter each web address on a single line, for example: - -http://www.contoso.com/webapps/webapp1 - -http://www.contoso.com/webapps/webapp2 - -http://\*.contoso.com - -http://www.contoso.com/webapps/\* - -**Important** -If you import a text file that includes a URL that uses special characters (such as ~ ! @ \# and so on), make sure that you specify UTF-8 encoding when you save the text file. Special characters do not import correctly into the MED-V Workspace Packager if the text file was saved using the default ANSI encoding. -~~~ - - - -## Packaging a MED-V Workspace for a Language Other than the Language of the MED-V Workspace Packager Computer - - -By default, the MED-V workspace supports characters in both the language of the computer and in English. To create a MED-V workspace for a language other than the one installed on the computer, specify **-loc \[locale\]** in the PowerShell script (.ps1) after the MED-V workspace name. - -To create a MED-V workspace package in a language other than the default language of the MED-V Workspace Packager computer, generate a script in the default language by running the MED-V Workspace Packager and then modifying the output script as required for your locale. The script is located in the MED-V workspace output directory that was specified during packaging. The names of the locale settings are on the .WXL files in the following directory: - -C:\\Program Files\\Microsoft Enterprise Desktop Virtualization\\WindowsPowerShell\\Modules\\Microsoft.Medv.Administration.Commands.WorkspacePackager\\locale - -## Creating a MED-V Workspace Package - - -To create a MED-V workspace package, follow these steps: - -**** - -1. To open the **MED-V Workspace Packager**, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager**. - -2. On the **MED-V Workspace Packager** main panel, click **Create a MED-V Workspace Package**. - - The MED-V **Create MED-V Workspace Package Wizard** appears. The wizard consists of the following pages: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Package Information

    Specify a name for the MED-V workspace and select a folder where the MED-V workspace package files are saved.

    Select Windows XP Image

    Specify your prepared Windows XP Virtual PC image.

    First Time Setup

    Specify the setup process that MED-V follows during first time setup.

    MED-V Messages

    Specify the messages and optional URL for Help information that the end user sees during first time setup.

    Naming Computers

    Specify how the MED-V virtual machine is named.

    Copy Settings from Host

    Specify how the settings for the MED-V workspace are defined.

    Startup and Networking

    Specify the settings for starting the MED-V workspace, networking, and user credentials.

    Web Redirection

    Specify a text file or a list of the URLs you want redirected to Internet Explorer in the MED-V workspace.

    Summary

    Verify your MED-V workspace settings and start to build your MED-V workspace deployment package.

    - - - -3. On the **Package Information** page, enter a name for the MED-V workspace and select a folder where the MED-V workspace package files are saved. - - **Warning** - You must name the MED-V workspace and specify a folder to continue. - - - -~~~ -After you have finished, click **Next**. -~~~ - -4. On the **Select Windows XP Image** page, specify the location of your prepared MED-V Windows XP Virtual PC image (.vhd file). - - **Warning** - You must specify a Windows XP VHD image to continue. - - - -~~~ -After you have finished, click **Next**. -~~~ - -5. On the **First Time Setup** page, select whether you want first time setup to run while attended or unattended and whether you want the MED-V workspace used separately or used by all end users on a shared computer. - - If you select **Unattended setup, without any notification**, the end user is not informed before first time setup is run and the virtual machine is not shown to the end user during first time setup. In addition, the **MED-V Messages** page of the wizard is hidden because no messages are required if first time setup runs in a completely unattended mode. - - If you select **Unattended setup, but notify end users before first time setup begins**, the end user is informed before first time setup is run. However, the virtual machine is not shown to the end user during first time setup. - - Select **Attended setup** if the end user must enter information during first time setup. - - The default behavior is **Unattended setup, but notify end users before first time setup begins**. - - **Caution** - If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, you must select **Attended setup** or problems might occur during first time setup. - - - -~~~ -You can also specify how a MED-V workspace is used on computers that are shared by multiple end users. You can decide that you want to create a unique MED-V workspace for each end user or that you want the MED-V workspace made available to all end users who share the computer. The default is that the MED-V workspace is unique for each end user. - -**Important** -We recommend that you disable the fast user switching feature in Windows if you configure the MED-V workspace to be accessed by all users on a shared computer. Problems can occur if an end user logs on by using the fast user switching feature in Windows when another user is still logged on. - - - -**Tip** -When you create a name mask for the MED-V workspace on the **Naming Computers** page, make sure that each virtual machine on a shared computer has a unique computer name. - - - -You can also specify whether the MED-V workspace is added to the Administrators group or administrator credentials are managed outside MED-V. By default, the MED-V workspace is not automatically added to the Administrators group. - -After you have finished, click **Next**. -~~~ - -6. On the **MED-V Messages** page, specify the following messages that the end user sees during first time setup: - - - The message that the end user sees when first time setup starts. - - - The message that the end user sees if first time setup fails or an error occurs. - - **Note** - The **MED-V Messages** page of the wizard is hidden if you selected **Unattended setup, without any notification** on the **First Time Setup** page. - - - -~~~ -You can also specify an optional URL location for help information that is provided to the end user when first time setup is running. - -For example, the URL can point to an internal IT webpage with answers to questions such as "How long will this take and how will I know when it has completed?" or "What do you do if you get an error message?" - -**Note** -If you specify a URL, a link is shown during first time setup that points the end user to this help information. If you do not specify a URL, no link is provided. - - - -After you have finished, click **Next**. -~~~ - -7. On the **Naming Computers** page, you can specify whether computer naming is managed by MED-V or by a system management tool, such as Sysprep. The default is that computer naming is managed by a system management tool. - - If you specify that computer naming is managed by MED-V, select a predefined computer naming convention (mask) from the drop-down list. A preview of a sample computer name appears that is based on the computer that you are using to build the MED-V workspace package. - - If you select one of the custom naming conventions, the fields you can specify are limited to the following characters: - - - The prefix and suffix fields are limited to the characters A-Z, a-z, 0-9, and the special characters ! @ \# $ % ^ & ( ) - \_ ' { } . and ~. - - - The hostname and username fields are limited to the digits 0 through 9. - - **Important** - Computer names must be unique and are limited to a maximum of 15 characters. When you decide on your computer naming method, consider end users who have multiple computers or that share a computer, and avoid using computer name masks that could cause a collision on the network. - - - -~~~ -**Caution** -The computer name settings that you specify on this page override those specified in the Sysprep.inf answer file. - - - -After you have finished, click **Next**. -~~~ - -8. On the **Copy Settings from Host** page, you can select the following settings to specify how the MED-V workspace is configured: - - **Caution** - The settings that you specify on this page that are copied from the host computer to the MED-V workspace override those specified in the Sysprep.inf answer file. - - - -~~~ - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Copy regional settings

    Select this check box to copy the regional settings from the host computer to the MED-V workspace.

    If you select this check box, the following settings are set in the Sysprep.inf file:

    -
    [RegionalSettings]
    -Language
    -SystemLocale
    -UserLocale
    -UserLocale_DefaultUser
    -InputLocale
    -InputLocale_DefaultUser
    -

    Copy user settings

    Select this check box to copy certain user settings, such as user name and company name, from the host to the MED-V workspace.

    If you select this check box, the following settings are set in the Sysprep.inf file:

    -
    [UserData]
    -OrgName
    -FullName
    -
    -Note -

    Personal settings, such as Internet browsing history, are not copied over to the MED-V workspace.

    -
    -
    - -

    Copy domain name

    Select this check box to let the guest join the same domain as the host.

    -Important -

    The MED-V guest must be configured to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host.

    -
    -
    - -

    Copy domain organizational unit

    Select this check box to copy the domain organizational unit from the host computer to the MED-V workspace. This check box is only enabled if you select to copy the domain name from the host computer.

    - - - -After you have finished, click **Next**. -~~~ - -9. On the **Startup and Networking** page, you can change the default behavior for the following settings: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Start MED-V workspace

    Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts.

    The MED-V workspace starts in one of two ways: either when the end user logs on or when they first start an action that requires MED-V, such as opening a published application or entering a URL that requires redirection.

    -

    You can either define this setting for the end user or let the end user control how MED-V starts.

    -
    - Note

    If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change how MED-V starts.

    -
    -
    - -

    Networking

    Select Shared or Bridged for your networking setting. The default is Shared.

    Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.

    -

    Bridged - The MED-V workspace has its own network address, typically obtained through DHCP.

    Store credentials

    Choose whether you want to store the end user credentials.

    The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on.

    -
    - Important

    Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved.

    -

    The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. As a result, an attacker could write a program that retrieves the password and could gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end-user credentials.

    -
    -
    - -
    - - - -~~~ -After you have finished, click **Next**. -~~~ - -10. On the **Web Redirection** page, you can enter, paste, or import a list of the URLs that are redirected to Internet Explorer in the MED-V workspace. For more information about how to configure your URL redirection information, see [Prerequisites](#bkmk-prereq). - - You can also specify how Internet Explorer in the MED-V workspace is configured for end users. By default, the Internet zone security level is set to High. Also, certain default browsing capabilities, such as the address bar, are removed. This default configuration of Internet Explorer in the MED-V workspace provides a more secure browsing environment for end users. - - **Caution** - By changing the default settings, you can customize Internet Explorer in the MED-V workspace. However, realize that if you change the default settings so as to make them less secure, you can expose your organization to those security risks that are present in older versions of Internet Explorer. For more information, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md). - - - -~~~ -After you have finished, click **Next**. -~~~ - -11. On the **Summary** page, you can review the packaging settings for this MED-V workspace. If you want to change any settings, click the **Previous** button to return to the relevant page. After you have finished reviewing the settings, click **Create**. - - The **Completion** page of the **Create MED-V Workspace Package Wizard** opens to show the progress of the package creation. - - **Note** - The MED-V workspace package creation process might take several minutes to complete, depending on the size of the VHD specified. - - - -~~~ -If the MED-V workspace package is created successfully, the **Completion** page displays a list of the files that you created and their respective locations. The following is a list of the files that are created and their descriptions: - -- **setup.exe**—an installation program that you deploy and run on end-user computers to install the MED-V workspaces. - -- **<*workspace\_name*>.msi**—an installer file that you deploy to the end-user computers. The setup.exe file will run this file to install the MED-V workspaces. - -- **<*vhd\_name*>.medv**—a compressed VHD file that you deploy to the end-user computers. The setup.exe file uses it when it installs the MED-V workspaces. - -- **<*workspace\_name*>.reg**—the configuration settings that are installed when the setup.exe, <*workspace\_name*>.msi, and <*vhd\_name*>.medv files are deployed and setup.exe is run. - -- **<*workspace\_name*>.ps1**—a Windows PowerShell script that you can use to rebuild the registry file and re-build the MED-V workspace package. - - **Important** - Before deployment, you can edit configuration settings by updating the .ps1 file that has your preferred method of script editing, such as Windows PowerShell. After you change the .ps1 file, use that file to rebuild the MED-V workspace package that you deploy to your enterprise. For more information, see [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md). - - However, after the MED-V workspace is deployed, you must edit configuration settings through the registry. For a list and description of the configuration settings, see [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md). -~~~ - - - -12. Click **Close** to close the packaging wizard and return to the **MED-V Workspace Packager**. - -Your MED-V workspace package is now ready for testing before deployment. - -## Related topics - - -[Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md) - -[Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) - -[Prepare a MED-V Image](prepare-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md deleted file mode 100644 index d501b3826f..0000000000 --- a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md +++ /dev/null @@ -1,159 +0,0 @@ ---- -title: Creating a Windows Virtual PC Image for MED-V -description: Creating a Windows Virtual PC Image for MED-V -author: dansimp -ms.assetid: fd7c0b1a-0769-4e7b-ad1a-dad19cca081f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Creating a Windows Virtual PC Image for MED-V - - -Before you can deliver a MED-V workspace to users, you have to first prepare a virtual hard disk that you use to build the MED-V workspace installer package for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. To prepare the necessary virtual hard disk, you must create a Windows Virtual PC image that contains the required operating system, updates, and software to let you later deploy applications and URL redirection information to users. This section provides guidance about how to create the virtual hard disk. - -To create a virtual image for MED-V, you must follow these steps. - -1. [Create a Windows Virtual PC image](#bkmk-creatingavirtualmachinebyusingmicrosoftvirtualpc) - -2. [Install Windows XP on the image](#bkmk-installingwindowsxpontovpc) - -3. [Install the .NET Framework on the image](#bkmk-installingnet) - -4. [Apply updates to the image](#bkmk-applypatchestovpc) - -5. [Install Integration Components](#bkmk-installintegration) - -## Creating a Windows Virtual PC Image - - -To create a Windows Virtual PC image, see the Windows Virtual PC documentation: - -- [Windows Virtual PC Home Page](https://go.microsoft.com/fwlink/?LinkId=148103) (https://go.microsoft.com/fwlink/?LinkId=148103). - -- [Windows Virtual PC Help](https://go.microsoft.com/fwlink/?LinkId=182378) (https://go.microsoft.com/fwlink/?LinkId=182378). - -Alternately, if you already have a Windows Imaging (WIM) file that you want to use as the basis for your virtual image, you can convert it to a VHD that you use to build the MED-V workspace. For more information about how to convert a WIM to a virtual hard disk, see [Native VHD Support in Windows 7](https://go.microsoft.com/fwlink/?LinkId=195922) (https://go.microsoft.com/fwlink/?LinkId=195922). - -**Important**   -MED-V only supports one virtual hard disk per virtual machine and only one partition on each virtual disk. - - - -After you have created your virtual hard disk, install Windows XP on the image. - -## Installing Windows XP on a Windows Virtual PC Image - - -MED-V requires that Windows XP SP3 is installed on the Windows Virtual PC image before you build the MED-V workspace. - -For more information about how to install Windows XP, see [Create a virtual machine and install a guest operating system](https://go.microsoft.com/fwlink/?LinkId=182379) (https://go.microsoft.com/fwlink/?LinkId=182379). - -## Installing the .NET Framework 3.5 SP1 on a Windows Virtual PC Image - - -You must manually install the .NET Framework 3.5 SP1 and the update KB959209 into the Windows Virtual PC image that you prepare for use with MED-V. The update [KB959209](https://go.microsoft.com/fwlink/?LinkId=204950) (https://go.microsoft.com/fwlink/?LinkId=204950) addresses several known application compatibility issues. - -## Applying Updates to the Windows Virtual PC Image - - -After you have installed Windows XP on your virtual machine, install any required Windows XP updates on the image, such as SP3. You can also install certain optional updates for better performance. - -**Important**   -MED-V requires that Windows XP SP3 be running on the guest operating system. - - - -**Warning**   -When you install updates to Windows XP, make sure that you remain on the version of Internet Explorer in the guest that you intend to use in the MED-V workspace. For example, if you intend to run Internet Explorer 6 in the MED-V workspace, make sure that any updates that you install now do not include Internet Explorer 7 or Internet Explorer 8. In addition, we recommend that you configure the registry to prevent automatic updates from upgrading Internet Explorer. - - - -### Installing an Optional Performance Update - -Although it is optional, we recommend that you install the following update for [hotfix KB972435](https://go.microsoft.com/fwlink/?LinkId=201077) (https://go.microsoft.com/fwlink/?LinkId=201077). This update increases the performance of shared folders in a Terminal Services session: - -**Note**   -The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. - - - -### Configuring a Group Policy Performance Update - -By default, Group Policy is downloaded to a computer one byte at a time. This causes delays while MED-V is being joined to the domain. To increase the performance of Group Policy, set the following registry key value to the registry: - -Registry subkey: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon - -Entry: BufferPolicyReads - -Type: DWORD - -Value: 1 - -## Installing Integration Components - - -Windows Virtual PC includes the Integration Components package. This provides features that improve the interaction between the virtual environment and the physical computer. For example, the Integration Components package lets your mouse move between the host and the guest computers. - -**Important**   -MED-V requires the installation of the Integration Components package. - - - -When you configure the virtual image to work with MED-V, you must manually install the Integration Components package on the guest operating system to make the integration features that are available. - -For more information about how to install and use the Integration Components package, see the following: - -- [Install or Upgrade the Integration Components Package](https://go.microsoft.com/fwlink/?LinkId=195923) (https://go.microsoft.com/fwlink/?LinkId=195923). - -- [About Integration Features](https://go.microsoft.com/fwlink/?LinkId=195924) (https://go.microsoft.com/fwlink/?LinkId=195924). - -### Installing RemoteApp Update - -After you install the Integration Components package, you are prompted to install the following update: "Update for Windows XP SP3 to enable RemoteApp." This is a required component for MED-V. - -**Important**   -If you are not prompted to install the RemoteApp update, you must download and install it manually. For more information and instructions about how to download this update, see [Update for Windows XP SP3 to enable RemoteApp](https://go.microsoft.com/fwlink/?LinkId=195925) (https://go.microsoft.com/fwlink/?LinkId=195925). - - - -### Enabling Remote Desktop - -By default, Remote Desktop is enabled after you install the Integration Components package. For MED-V to be operational, ensure that Remote Desktop is enabled, and do not distribute any Group Policy that disables it. - -For information about how to enable Remote Desktop, see [Enable or disable Remote Desktop](https://go.microsoft.com/fwlink/?LinkId=201162) (https://go.microsoft.com/fwlink/?LinkId=201162). - -## Customizing Internet Explorer by Using the Internet Explorer Administration Kit - - -If you want, you can use the Internet Explorer Administration Kit to customize Internet Explorer on the guest operating system. For more information, see the [Internet Explorer 6 Administration Kit and Deployment Guide](https://go.microsoft.com/fwlink/?LinkId=200007) (http:// go.microsoft.com/fwlink/?LinkId=200007). - -**Warning**   -You should consider security concerns associated with customizing Internet Explorer in the MED-V workspace. For more information, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md). - - - -After your virtual hard disk is installed with an up-to-date guest operating system, you can install applications on the image. - -## Related topics - - -[Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) - -[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/define-and-plan-your-med-v-deployment.md b/mdop/medv-v2/define-and-plan-your-med-v-deployment.md deleted file mode 100644 index 6c0b8e2772..0000000000 --- a/mdop/medv-v2/define-and-plan-your-med-v-deployment.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Define and Plan your MED-V Deployment -description: Define and Plan your MED-V Deployment -author: dansimp -ms.assetid: a90945cc-dc37-4548-963d-e0c6f8ba0467 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Define and Plan your MED-V Deployment - - -Use the information in this section when you plan your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 project. - -## In This Section - - -[Determining How MED-V Will Be Deployed](determining-how-med-v-will-be-deployed.md) -Provides information to help you determine how to deploy MED-V throughout your enterprise. - -[Identifying the Number and Types of MED-V Workspaces](identifying-the-number-and-types-of-med-v-workspaces.md) -Provides information to help you identify the computers in your enterprise that require MED-V and to calculate the disk space necessary for a MED-V deployment. - -## Related topics - - -[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) - -[Planning for MED-V](planning-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/deploy-the-med-v-components.md b/mdop/medv-v2/deploy-the-med-v-components.md deleted file mode 100644 index 103992785c..0000000000 --- a/mdop/medv-v2/deploy-the-med-v-components.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Deploy the MED-V Components -description: Deploy the MED-V Components -author: dansimp -ms.assetid: fc2c5ef2-9c71-412a-8f6c-93df248f77d6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy the MED-V Components - - -This section provides information about how to deploy the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 components and how to uninstall the components. - -## In This Section - - -[How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md) -Describes how to install the MED-V Workspace Packager, which you use to create MED-V workspaces. - -[How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md) -Describes how to manually install the MED-V components by using an electronic software distribution (ESD) system. - -[How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md) -Describes how to install the MED-V Host Agent. - -[How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md) -Describes how to uninstall the MED-V components. - -## Related topics - - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) - -[Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/deploying-the-med-v-workspace-package.md b/mdop/medv-v2/deploying-the-med-v-workspace-package.md deleted file mode 100644 index b75d781a80..0000000000 --- a/mdop/medv-v2/deploying-the-med-v-workspace-package.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Deploying the MED-V Workspace Package -description: Deploying the MED-V Workspace Package -author: dansimp -ms.assetid: f314425a-d60f-4b8d-b71f-d13d1da9297f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the MED-V Workspace Package - - -After you have tested your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 installer package, you can deploy it throughout your enterprise by using your company’s preferred method of provisioning software and other applications. - -**Note**   -When you are ready to deploy, we recommend that you install the MED-V workspace by running the setup.exe executable program that is included in your MED-V workspace installer package. - - - -**Warning**   -Before you can install the MED-V workspace, you must first install the MED-V Host Agent. - - - -## In This Section - - -[How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md) -Provides information about how to deploy MED-V workspaces by using an ESD system. - -[How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md) -Provides information about how to deploy a MED-V workspace in a Windows 7 image. - -[How to Deploy a MED-V Workspace Manually](how-to-deploy-a-med-v-workspace-manually.md) -Provides information about how to manually deploy a MED-V workspace. - - - - - - - - - diff --git a/mdop/medv-v2/deployment-of-med-v.md b/mdop/medv-v2/deployment-of-med-v.md deleted file mode 100644 index 40216dcce3..0000000000 --- a/mdop/medv-v2/deployment-of-med-v.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Deployment of MED-V -description: Deployment of MED-V -author: dansimp -ms.assetid: 52ea8ae4-ec2e-4cb8-ab38-e6400f47d3ba -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deployment of MED-V - - -The topics in this section help you prepare your environment for deploying Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## In This Section - - -[End-to-End Deployment Scenario for MED-V 2.0](end-to-end-deployment-scenario-for-med-v-20.md) -Describes an end-to-end deployment scenario for MED-V 2.0. - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) -Describes the supported configurations for MED-V 2.0. - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) -Describes the requirements for deploying MED-V 2.0. - -[Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) -Provides procedures for configuring the MED-V 2.0 environment and installation prerequisites. - -[Deploy the MED-V Components](deploy-the-med-v-components.md) -Describes how to install the MED-V Host Agent, the MED-V Workspace Packager, and other components required to run MED-V 2.0. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/deployment-troubleshooting.md b/mdop/medv-v2/deployment-troubleshooting.md deleted file mode 100644 index 3fafc1ed70..0000000000 --- a/mdop/medv-v2/deployment-troubleshooting.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Deployment Troubleshooting -description: Deployment Troubleshooting -author: dansimp -ms.assetid: 9ee980f2-4e77-4020-9f0e-8c2ffdc390ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deployment Troubleshooting - - -This topic includes information to help you troubleshoot deployment issues in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## Troubleshooting Issues in MED-V Deployment - - -The following issue might occur when you deploy MED-V. The solution helps troubleshoot this issue. - -**Problems Occur if Installing MED-V for Current User Only.** MED-V only supports the installation of the MED-V Workspace Packager, the MED-V Host Agent, and the MED-V workspace for all users. Installing for the current user only causes failures in the installation of the components and in the setup of the MED-V workspace. - -**Solution** - -Never use the option **ALLUSERS=””** when installing the MED-V components. - -**MED-V Requires Exclusive Use of the Virtualization Stack.** Only one virtualization stack can be run at a time on a computer. Windows Virtual PC must use the virtual stack, and MED-V depends on Windows Virtual PC. Therefore, if you try to deploy or use MED-V when other applications are running that use the virtual stack, MED-V cannot run or be successfully installed. - -**Solution** - -Close any application that is running that uses the virtualization stack before you install or run MED-V. - -**Shortcuts Remain after Uninstall.** By default, when you uninstall MED-V, shortcuts in the end user’s **Start** menu are removed. However, in certain situations, such as for end users who are running roaming profiles, shortcuts to MED-V published applications remain in the end user’s **Start** menu. - -**Solution** - -To manually delete the remaining shortcuts on the **Start** menu, right-click the shortcuts, and then click **Remove**. - -**Disable Logon Message Group Policy Setting in the MED-V Workspace.** If the Windows XP logon message is enabled in the MED-V workspace, the end user must log on every time they want to open a MED-V virtual application. This creates a poor user experience. - -**Solution** - -Disable the following Group Policy settings in the MED-V virtual machine: - -**Interactive logon: Message text for users attempting to log on** - -**Interactive logon: Message title for users attempting to log on** - -## Related topics - - -[Operations Troubleshooting](operations-troubleshooting-medv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md b/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md deleted file mode 100644 index 41e3e7e9ff..0000000000 --- a/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Detecting Network Changes that Affect MED-V -description: Detecting Network Changes that Affect MED-V -author: dansimp -ms.assetid: fd29b95a-cda2-464d-b86d-50b6bd64b4ca -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Detecting Network Changes that Affect MED-V - - -The Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 solution lets you configure your environment to detect certain network changes that might occur after MED-V workspaces are deployed and that can affect MED-V. - -The feature includes a component running in the guest operating system that is notified of network configuration changes on the host computer. It allows a non-Microsoft ESD or other application that is running in the guest to resolve to the same network endpoints that the host ESD or application resolves to. - -**Note**   -This feature is only available if the virtual machine is configured for network address translation (NAT) mode. If the virtual machine is configured for BRIDGED mode, no change indications are generated. - - - -This section provides information and instruction to assist you in monitoring those network changes that can affect MED-V. - -## To detect network changes for MED-V - - -After you have deployed your MED-V workspaces, you can monitor changes to certain network configurations by preforming the following tasks: - -1. Create a Managed Object Format (MOF) file that will look for the network configuration changes that you want to monitor. The following code shows an example of the MOF file that you can create. - - ``` syntax - #pragma namespace ("\\\\.\\root\\ccm\\NetworkConfig") - - class CCM_IPConfig - { - [NotNull: ToInstance ToSubClass] uint32 AddressFamily; // AF_INET, AF_INET6 - [Key, NotNull: ToInstance ToSubClass] string IPAddress; // IPv4 or IPv6 address - [NotNull: ToInstance ToSubClass] string SubnetMask; // IPv4 subnet mask - }; - - class CCM_NetworkAdapter - { - [Key, NotNull: ToInstance ToSubClass] string Name; - [NotNull: ToInstance ToSubClass] uint32 DHCPEnabled = 0; - [NotNull: ToInstance ToSubClass] uint32 Quarantined = 0; // To check if it is quarantined. - CCM_IPConfig IPConfigInfo[]; - }; - - [singleton] - class CCM_NetworkAdapters - { - [NotNull: ToInstance ToSubClass] String ProviderName; // MED-V or other provider - CCM_NetworkAdapter AdaptersInfo[]; - }; - ``` - -2. Compile the MOF file. - -3. Install the MOF file in the guest. - -After you have installed the MOF file, you can create an event subscription that subscribes to Windows Management Instrumentation (WMI) creation, modification, or deletion events for the **CCM\_NetworkAdapters** class. This detects the following changes to the host: - -Are there any configuration changes to the network, such as changes to the IP address or network adapter? - -Is the network available or unavailable? - -Was the network setup changed from BRIDGED mode to NAT mode? - -Was the network setup changed from NAT mode to BRIDGED mode? - -A MED-V component on the host monitors the network for these changes and then signals the guest of the change. A component in the guest creates a WMI instance to monitor the MED-V workspace for these changes. - -The event subscription you created provides notification through the WMI system when one or more of these network changes – creation, modification, or deletion – occurs. - -## Related topics - - -[Monitor MED-V Workspaces](monitor-med-v-workspaces.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/determining-how-med-v-will-be-deployed.md b/mdop/medv-v2/determining-how-med-v-will-be-deployed.md deleted file mode 100644 index c618873c30..0000000000 --- a/mdop/medv-v2/determining-how-med-v-will-be-deployed.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Determining How MED-V Will Be Deployed -description: Determining How MED-V Will Be Deployed -author: dansimp -ms.assetid: addbfef6-799e-4fe7-87d2-7e096a5ef5a5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Determining How MED-V Will Be Deployed - - -You can determine how you might deploy MED-V throughout your enterprise by evaluating your existing infrastructure, a review of which you can take advantage of for your deployment. - -## Determine How You Will Deploy MED-V - - -Because MED-V is a desktop-based solution, it works with your existing infrastructure. For example, if you currently deploy applications to physical computers by using an electronic software distribution system, you can also use your electronic software distribution system to deploy to MED-V workspaces. - -If you are currently using an electronic software distribution solution, you can use that to distribute MED-V workspaces and their dependent applications. You can also use this solution for distribution of subsequent applications after MED-V is deployed. For more information about deploying MED-V with an ESD, see [How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md). - -**Note**   -Whichever electronic software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999). - - - -You might prefer to install MED-V in a Windows 7 image. Then, after you deploy the Windows 7 images throughout your enterprise, MED-V is ready to be installed when an end user needs it. For more information, see [How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md). - -## Related topics - - -[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) - -[Planning for MED-V](planning-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md deleted file mode 100644 index 7f0d4b42e8..0000000000 --- a/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: End-to-End Deployment Scenario for MED-V 2.0 -description: End-to-End Deployment Scenario for MED-V 2.0 -author: dansimp -ms.assetid: 91bb5a9a-5fb1-4743-8494-9d4dee2ec222 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# End-to-End Deployment Scenario for MED-V 2.0 - - -This sample scenario for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 helps you deploy the MED-V components in your enterprise by using multiple scenarios end-to-end. You can think of this sample scenario as a case study that helps put the individual scenarios and procedures in context. - -This section provides basic information and directions for deploying MED-V components as an end-to-end solution in your enterprise. - -## MED-V Deployment Step-by-step Scenario - - -The topics in this step-by-step scenario include the following: - -- [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) discusses the requirements that you must have to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 in your environment. This topic specifies the operating system requirements, configuration requirements, and MED-V workspace requirements. This topic also includes localization information about the languages that MED-V 2.0 supports. - -- [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) discusses general information and instructions to help you install and deploy MED-V throughout your enterprise. The MED-V components are client-based and are delivered and managed by using your existing enterprise infrastructure and processes. This topic provides an overview of the MED-V solution that includes information about the MED-V installation files and the MED-V components that you deploy. This topic also provides a high-level overview of the MED-V installation and deployment process. - -- [Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) discusses how to prepare your environment for a MED-V 2.0 deployment. This section describes the prerequisites that are required for the MED-V environment, such as Microsoft Windows 7 and an Active Directory infrastructure in which you use Group Policy to provide centralized management and configuration of operating systems, applications, and users' settings. This section also describes the prerequisites that you must have for installing and deploying MED-V 2.0 throughout your enterprise, such as Windows Virtual PC and the required Windows Virtual PC update. - -- [Deploy the MED-V Components](deploy-the-med-v-components.md) discusses the different ways you can install all of the necessary installation files and MED-V components throughout your enterprise. To install and deploy MED-V, you typically follow these steps: - - 1. Install the **MED-V Workspace Packager** on the administrator computer that you will use to build the MED-V workspace packages. For more information, see [How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md). - - 2. Create and test your MED-V workspace packages. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) and [Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md). - - 3. Deploy MED-V throughout your enterprise by using your company’s existing method for deploying applications. For more information, see [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md). - -## Related topics - - -[Deployment of MED-V](deployment-of-med-v.md) - -[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) - -[End-to-End Operations Scenario for MED-V 2.0](end-to-end-operations-scenario-for-med-v-20.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md deleted file mode 100644 index 526c5d24da..0000000000 --- a/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: End-to-End Operations Scenario for MED-V 2.0 -description: End-to-End Operations Scenario for MED-V 2.0 -author: dansimp -ms.assetid: 1d87f5f3-9fc5-4731-8bd1-c155714f34ee -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# End-to-End Operations Scenario for MED-V 2.0 - - -This sample scenario for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 helps you deploy and manage MED-V by using multiple scenarios end-to-end. You can think of this sample scenario as a case study that helps put the individual scenarios and procedures in context. - -This section provides basic information and directions for creating, deploying, and managing MED-V workspaces as an end-to-end solution in your enterprise. - -## MED-V Operations Step-by-step Scenario - - -The step-by-step procedures that you follow in a MED-V operations scenario include the following: - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-creatingavirtualmachinebyusingmicrosoftvirtualpc) reviews how to create and configure a Windows Virtual PC image for MED-V. Before you can deliver a MED-V workspace to users, you must first prepare a virtual hard disk (VHD) that you use to build the MED-V workspace installer package for MED-V. - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-installingwindowsxpontovpc) reviews how to install the Windows XP SP3 operating system on your Windows Virtual PC image. MED-V requires that Windows XP SP3 is installed on the Windows Virtual PC image before you build the MED-V workspace. - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-installingnet) reviews how to manually install the .NET Framework 3.5 SP1 and the update KB959209 into the Windows Virtual PC image that you prepare for use with MED-V. MED-V requires the .NET Framework 3.5 SP1, and the update [KB959209](https://go.microsoft.com/fwlink/?LinkId=204950) (https://go.microsoft.com/fwlink/?LinkId=204950) addresses several known application compatibility issues. - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-applypatchestovpc) reviews how to update your Windows XP image with the latest software updates and other hotfixes necessary or important for running MED-V. - -- [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md#bkmk-installintegration) reviews how to install the integration components package in your Windows XP image. These provide features that improve the interaction between the virtual environment and the physical computer. - -- [Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) reviews how you can install certain kinds of software on your Windows XP image that are helpful when you are running MED-V, such as an electronic software distribution system and antivirus software. - -- [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) discusses how to configure the image by using Sysprep to make sure that it is ready for use with MED-V. The prepared MED-V image is then used to create your MED-V workspace package. - -- [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) reviews how to build the MED-V workspace package that you deploy throughout your enterprise. You deploy the MED-V workspace package to install the MED-V workspace on end-user computers. A MED-V workspace is the Windows XP desktop environment from which end users interact with the virtual machine provided by MED-V. - -- [Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) discusses how to create a test environment in which you can test the functionality of the MED-V workspace package, such as first time setup settings and application publishing. After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy it throughout your enterprise. - -- [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) discusses how to deploy the MED-V workspace either by using an electronic software distribution system or in a Windows 7 image. Or if you prefer, this section also shows you how you can deploy the MED-V workspace manually. - -- [Monitor MED-V Workspaces](monitor-med-v-workspaces.md) reviews how to monitor the deployment of MED-V workspaces to determine whether first time setup completed successfully. Monitoring the success of first time setup is important because MED-V is not in a usable state until first time setup has completed successfully. This section also shows you can set up your environment to detect those network changes that can affect MED-V. - -- [Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) reviews how to install and remove or publish and unpublish applications on a deployed MED-V workspace. This section also shows how to manually update software in a MED-V workspace and how to manage automatic updates. The MED-V workspace is a virtual machine that contains a separate operating system whose automatic software update process must be managed exactly like the physical computers in your enterprise. - -- [Manage MED-V URL Redirection](manage-med-v-url-redirection.md) reviews how to add and remove web address redirection settings on the deployed MED-V workspace. You can add or remove URL redirection information through the registry or by rebuilding the MED-V workspace. You can also use the wizard on the MED-V Workspace Packager to manage web address redirection. - -- [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) reviews how to view and edit MED-V configuration settings by using the MED-V Workspace Packager. This section lists all the configurable MED-V registry keys and includes the type, default, and description of each. This section also includes information about how to manage printers in MED-V workspaces. In MED-V 2.0, printer redirection gives users a consistent printing experience between the MED-V virtual machine and the host computer. - -## Related topics - - -[Operations for MED-V](operations-for-med-v.md) - -[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) - -[End-to-End Deployment Scenario for MED-V 2.0](end-to-end-deployment-scenario-for-med-v-20.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md deleted file mode 100644 index f266500d1b..0000000000 --- a/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: End-to-End Planning Scenario for MED-V 2.0 -description: End-to-End Planning Scenario for MED-V 2.0 -author: dansimp -ms.assetid: e7833883-be93-4b42-9fa3-5c4d9a919058 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# End-to-End Planning Scenario for MED-V 2.0 - - -This sample scenario for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 helps you achieve your goal of planning your MED-V deployment by using multiple scenarios end-to-end. You can think of this sample scenario as a case study that helps put the individual scenarios and procedures in context. - -This section provides basic information and directions for planning you MED-V deployment as an end-to-end solution in your enterprise. - -## MED-V Planning Step-by-Step Scenario - - -The topics in this step-by-step scenario include the following: - -- [High-Level Architecture](high-level-architecturemedv2.md) discusses the high-level system architecture and component design of MED-V 2.0. MED-V enhances Windows Virtual PC to run two operating systems on one device, adding virtual image delivery, Group Policy-based provisioning, and centralized management. By using MED-V, you can easily configure, deploy, and manage corporate Windows Virtual PC images on any Windows-based desktop running Windows 7 Professional, Enterprise, or Windows 7 Ultimate. - -- [Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) discusses the considerations for planning your MED-V 2.0 deployment. This topic provides direction about identifying the systems in your enterprise that receive MED-V and calculating disk space requirements. This topic also helps evaluate your existing infrastructure and determines how it can be used for MED-V deployment. - -- [MED-V 2.0 Best Practices](med-v-20-best-practices.md) discusses the recommended best practices for planning, installing, deploying, and managing MED-V 2.0 in your environment. These best practices include recommendations that produce faster run times, better operability during first time setup, increased performance, and better virtual machine management. - -## Related topics - - -[Planning for MED-V](planning-for-med-v.md) - -[End-to-End Deployment Scenario for MED-V 2.0](end-to-end-deployment-scenario-for-med-v-20.md) - -[End-to-End Operations Scenario for MED-V 2.0](end-to-end-operations-scenario-for-med-v-20.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/example-med-v-checklists.md b/mdop/medv-v2/example-med-v-checklists.md deleted file mode 100644 index 1e439600b8..0000000000 --- a/mdop/medv-v2/example-med-v-checklists.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Example MED-V Checklists -description: Example MED-V Checklists -author: dansimp -ms.assetid: cf9c33e8-1b7a-4306-92f6-edbb70ab23b5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Checklists - - -This section provides example checklists that you can reference when you plan your MED-V project, prepare your environment, and deploy the MED-V components and MED-V workspaces throughout your enterprise. - -## In this Section - - -[Example MED-V Environment Planning Checklist](example-med-v-environment-planning-checklist.md) -Describes the tasks to be completed when planning your MED-V environment. - -[Example MED-V Project Planning Checklist](example-med-v-project-planning-checklist.md) -Describes the tasks to be completed when planning your MED-V project. - -[Example MED-V System Installation Checklist](example-med-v-system-installation-checklist.md) -Provides a list of all the steps required for installing MED-V 2.0. - -[Example MED-V Image Preparation Checklist](example-med-v-image-preparation-checklist.md) -Describes the tasks to be completed when you prepare your MED-V image for deployment. - -[Example MED-V Workspace Deployment Checklist](example-med-v-workspace-deployment-checklist.md) -Describes the tasks to be completed when you deploy your MED-V workspace. - -## Related topics - - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/example-med-v-environment-planning-checklist.md b/mdop/medv-v2/example-med-v-environment-planning-checklist.md deleted file mode 100644 index 088faff234..0000000000 --- a/mdop/medv-v2/example-med-v-environment-planning-checklist.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Example MED-V Environment Planning Checklist -description: Example MED-V Environment Planning Checklist -author: dansimp -ms.assetid: 877d1660-abef-4e81-ab3a-a8a3ec181d26 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Environment Planning Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps that you should take when planning your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 environment. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Review the components of a MED-V deployment.

    High-Level Architecture

    Ensure that your computing environment meets the supported configurations required for installing MED-V 2.0.

    MED-V 2.0 Supported Configurations

    Determine how you want to design your MED-V deployment.

    Define and Plan your MED-V Deployment

    Review the list of best practices for ensuring that your MED-V deployment environment is more secure.

    Security and Protection for MED-V

    - - - - - - - - - - - diff --git a/mdop/medv-v2/example-med-v-image-preparation-checklist.md b/mdop/medv-v2/example-med-v-image-preparation-checklist.md deleted file mode 100644 index 2a7a612cb8..0000000000 --- a/mdop/medv-v2/example-med-v-image-preparation-checklist.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Example MED-V Image Preparation Checklist -description: Example MED-V Image Preparation Checklist -author: dansimp -ms.assetid: d69f252f-624b-439e-814b-b68cdaf7d582 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Image Preparation Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps to take when you prepare your MED-V image for deployment. - - ---- - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Create a virtual machine that is running Windows XP SP3 with updates and additions.

    Creating a Windows Virtual PC Image for MED-V

    Install any predeployment software that you want on the MED-V image.

    Installing Applications on a Windows Virtual PC Image

    Package the MED-V image by using Sysprep.

    Configuring a Windows Virtual PC Image for MED-V

    - - - - - - - - - - - diff --git a/mdop/medv-v2/example-med-v-project-planning-checklist.md b/mdop/medv-v2/example-med-v-project-planning-checklist.md deleted file mode 100644 index f89d1d89ea..0000000000 --- a/mdop/medv-v2/example-med-v-project-planning-checklist.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Example MED-V Project Planning Checklist -description: Example MED-V Project Planning Checklist -author: dansimp -ms.assetid: 2b599bcb-1808-43ba-a689-1642bda24511 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Project Planning Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps that you can take when planning your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 project. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Determine how you can use MED-V to help solve your application compatibility issues.

    Planning for Application Operating System Compatibility

    Plan an end-to-end deployment scenario for your organization.

    End-to-End Planning Scenario for MED-V 2.0

    Define the project scope by defining the end users and determining the MED-V images to be managed.

    Define and Plan your MED-V Deployment

    Review the list of best practices for ensuring that your MED-V deployment is more secure.

    Security and Protection for MED-V

    - - - - - - - - - - - diff --git a/mdop/medv-v2/example-med-v-system-installation-checklist.md b/mdop/medv-v2/example-med-v-system-installation-checklist.md deleted file mode 100644 index e5a0c45347..0000000000 --- a/mdop/medv-v2/example-med-v-system-installation-checklist.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Example MED-V System Installation Checklist -description: Example MED-V System Installation Checklist -author: dansimp -ms.assetid: 9e5673ba-dee4-4680-9c57-a149beab14d3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V System Installation Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps to take when you install Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Ensure that your computing environment meets the supported configurations that are required for installing MED-V 2.0.

    MED-V 2.0 Supported Configurations

    Plan and design the MED-V deployment.

    Planning for MED-V

    Verify that the required installation prerequisites are configured.

    Configure Installation Prerequisites

    Install the MED-V Host Agent and MED-V Workspace Packager.

    Deploy the MED-V Components

    - - - - - - - - - - - diff --git a/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md b/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md deleted file mode 100644 index 67505667a8..0000000000 --- a/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Example MED-V Workspace Deployment Checklist -description: Example MED-V Workspace Deployment Checklist -author: dansimp -ms.assetid: d8857883-9b2d-40ac-9136-59e4e20e02fe -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Example MED-V Workspace Deployment Checklist - - -The following checklist provides a high-level list of items to consider and outlines the steps that you should take when you deploy your MED-V workspace. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    StepReference

    Prepare the MED-V image for deployment.

    Prepare a MED-V Image

    Create the MED-V workspace deployment package.

    Create a MED-V Workspace Package

    Test the MED-V workspace installer package.

    Testing the MED-V Workspace Package

    Deploy the MED-V workspace installer package.

    Deploying the MED-V Workspace Package

    - - - - - - - - - - - diff --git a/mdop/medv-v2/getting-started-with-med-vmedv2.md b/mdop/medv-v2/getting-started-with-med-vmedv2.md deleted file mode 100644 index a6a566459a..0000000000 --- a/mdop/medv-v2/getting-started-with-med-vmedv2.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Getting Started with MED-V -description: Getting Started with MED-V -author: dansimp -ms.assetid: 283734d7-231c-45b6-92c9-c95a46ec3628 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Getting Started with MED-V - - -This section provides general information for administrators who are evaluating and using Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## In This Section - - -[Overview of MED-V](overview-of-med-vmedv2.md) -Provides general information about the MED-V solution to your application compatibility issues. - -[Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) -Provides planning guidance for evaluating MED-V to help solve application operating system compatibility issues. - -[High-Level Architecture](high-level-architecturemedv2.md) -Describes the components of a MED-V deployment. - -[About MED-V 2.0](about-med-v-20.md) -Provides information specifically related to MED-V including what’s new in MED-V 2.0 and MED-V 2.0 supported configurations. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/high-level-architecturemedv2.md b/mdop/medv-v2/high-level-architecturemedv2.md deleted file mode 100644 index d4ad41a552..0000000000 --- a/mdop/medv-v2/high-level-architecturemedv2.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: High-Level Architecture -description: High-Level Architecture -author: dansimp -ms.assetid: a00edb9f-207b-4f32-9e8f-522ea2739d2f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture - - -This section describes the high-level system architecture and component design of Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## System Architecture - - -MED-V enhances Windows Virtual PC to run two operating systems on one device, adding virtual image delivery, Group Policy-based provisioning, and centralized management. By using MED-V, you can easily configure, deploy, and manage corporate Windows Virtual PC images on any Windows-based desktop running Windows 7 Professional, Enterprise, or Windows 7 Ultimate. The MED-V solution includes the following components: - - **MED-V Host** -A Windows 7 environment that includes a MED-V Host Agent, an electronic software distribution (ESD) system, a registry management system, and a MED-V guest. The MED-V host interacts with the MED-V guest so that certain setup functions and system information can be processed. - - **MED-V Host Agent** -The MED-V software contained in the MED-V host that provides a channel to communicate with the MED-V guest. It also provides functionality such as first time setup and application publishing. - -**Note**   -After MED-V and its required components are installed MED-V must be configured. The configuration of MED-V is referred to as first time setup. - - - -**ESD System** -Your existing software distribution method that lets you deploy and install the MED-V workspace package files that MED-V creates. - -**Registry Management System** -Your existing method of managing Group Policy settings and preferences. - -**Windows Virtual PC Image** -An administrator-defined virtual machine that contains the following components: - -**Corporate Operating System** -Your standard corporate operating system. - -**Management and Security Tools** -Your standard management and security tools, such as virus protection. - - **MED-V Guest** -A Windows XP SP3 environment, as part of a Windows Virtual PC running on Windows 7 that contains the following components: - - **MED-V Guest Agent** -The MED-V software contained in the MED-V guest that provides a channel to communicate with the MED-V host. It also supports the MED-V Host Agent with functions like performing first time setup. - -**Note**   -The MED-V Guest Agent is installed automatically during first time setup. - - - -**ESD Client** -An optional part of your ESD system that installs software packages and reports status to the ESD system. - -## Related topics - - -[Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) - -[Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md b/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md deleted file mode 100644 index 231cef0574..0000000000 --- a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace -description: How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace -author: dansimp -ms.assetid: bf55848d-bf77-452e-aaa5-4dd4868ff5bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace - - -To edit URL redirection information in a deployed MED-V workspace, we recommend that you update the system registry by using Group Policy. Although we do not recommend it, you can also rebuild and redeploy the MED-V workspace with the updated URL redirection information. - -The registry key is usually located at: - -Computer\\HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\MEDV\\v2\\UserExperience - -The following multi-string value must be present: `RedirectUrls` - -The value data for `RedirectUrls` is a list of all of the URLs that you specified for redirection when you built the MED-V workspace package by using the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - -You can add and remove URL redirection information by performing one of the following tasks: - -- [Edit the URL Redirection Registry Key and Deploy Using Group Policy](#bkmk-editreg) - -- [Edit the URL Redirection Text File and Rebuild the MED-V Workspace](#bkmk-edittext) - -**To update URL Redirection information by using Group Policy** - -1. Edit the registry key multi-string value that is named `RedirectUrls`. This value is typically located at: - - Computer\\HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\MEDV\\v2\\UserExperience - - If you are adding URLs to the registry key, enter them one per line, as was required when you built the MED-V workspace package. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - -2. Deploy the updated registry key by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931). - -**Note**   -This method of editing URL redirection information is a MED-V best practice. - - - -**To rebuild the MED-V workspace by using an updated URL text file** - -- Another method of adding and removing URLs from the redirection list is to update the URL redirection text file and then use it to build a new MED-V workspace. You can then redeploy the MED-V workspace as before, by using your standard process of deployment, such as an ESD system. - - **Important**   - We do not recommend this method of editing URL redirection information. In addition, any time that you redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved in the virtual machine is lost. - - - -## Related topics - - -[How to Test URL Redirection](how-to-test-url-redirection.md) - -[Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md) - -[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-create-a-test-environment.md b/mdop/medv-v2/how-to-create-a-test-environment.md deleted file mode 100644 index fd2ddea698..0000000000 --- a/mdop/medv-v2/how-to-create-a-test-environment.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: How to Create a Test Environment -description: How to Create a Test Environment -author: dansimp -ms.assetid: a0db2299-16f3-4516-8769-7d55ca4a1e98 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Create a Test Environment - - -The following are some steps and instructions to help you create a test environment that you can use to test your MED-V workspace package locally before deploying it throughout your enterprise. This section provides guidance about how to create a test environment, either manually or by using an electronic software distribution system. - -**To create a test environment by using an ESD** - -1. Use your company’s method of deploying software throughout the enterprise to deploy the following necessary components to a test computer. Install them in the following order: - - - **Windows Virtual PC** – if not already installed. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - - **Windows Virtual PC Additions and Updates**– if not already installed. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - - **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - - - **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - **Important**   - The VHD and Setup executable program must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe. - - - -2. After all of the components are installed on the test computer, run the MED-V Host Agent to start first time setup. - - Click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**. - - **Note**   - If you cannot physically run the MED-V Host Agent on the test computer, first time setup starts automatically the next time that the computer restarts. - - - -First time setup starts and can take ten minutes or more to finish. - -For information about testing your configuration settings when first time setup is running, see [How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md). - -**To create a test environment manually** - -1. Install the MED-V Host Agent in a local test environment that includes MED-V prerequisites, such as Windows Virtual PC with additions and updates. For information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - -2. Copy the MED-V workspace files to your test environment. The MED-V workspace files are located in the destination folder that you specified in the **MED-V Workspace Packager**. - - **Important**   - The VHD and Setup executable program must be in the same folder on your test environment as the MED-V workspace installer. - - - -3. Install the MED-V workspace by running setup.exe. - -4. Start first time setup by running the MED-V Host Agent. - - Click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**. - -First time setup starts and might take several minutes to complete, depending on the size of the VHD specified. - -You are now ready to test the different settings for configuration, application publishing, and URL redirection that you specified for your MED-V workspace. - -**Note**   -By default, MED-V overrides the screen lock policy in the guest. However, this does not pose a security problem because the host computer still honors the screen lock policy. - - - -## Related topics - - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Test URL Redirection](how-to-test-url-redirection.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md deleted file mode 100644 index c7f27598d2..0000000000 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: How to Deploy a MED-V Workspace in a Windows 7 Image -description: How to Deploy a MED-V Workspace in a Windows 7 Image -author: dansimp -ms.assetid: a83aba4e-8681-4906-9872-f431c0bb15f9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy a MED-V Workspace in a Windows 7 Image - - -You can install all the MED-V components into a Windows 7 image that you distribute throughout your enterprise just as you would any new installation of Windows 7. The end user then finishes the installation of the MED-V workspace by clicking a **Start** menu shortcut that you configure to start MED-V. First time setup starts and the end user follows the instructions to complete the configuration. - -The following section provides information and instructions to help you deploy the MED-V workspace throughout your enterprise by using a Windows 7 image. - -**To deploy a MED-V workspace in a Windows 7 image** - -1. Create a standard image of Windows 7. For more information, see [Building a Standard Image of Windows 7: Step-by-Step Guide](https://go.microsoft.com/fwlink/?LinkId=204843) (https://go.microsoft.com/fwlink/?LinkId=204843). - -2. In the Windows 7 image, install Windows Virtual PC and the Windows Virtual PC updates. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - -3. Install the MED-V Host Agent by using the MED-V\_HostAgent\_Setup installation file. For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - - **Warning**   - Internet Explorer must be closed before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - - -4. Copy the MED-V workspace package files to the Windows 7 image. The MED-V workspace package files are the MED-V workspace installer, .medv file, and setup.exe file that you created by using the **MED-V Workspace Packager**. - - **Important**   - The .medv and setup.exe file must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace by running setup.exe. - - - -5. Configure a shortcut on the **Start** menu to open the MED-V workspace package installation. - - Create a **Start** menu shortcut to the setup.exe file that lets the end user start a MED-V installation as required. - -6. By using your company’s standard image deployment process, distribute the Windows 7 image to computers in your enterprise that require MED-V. - -When the end user has to access an application published in the MED-V workspace, they can click the **Start** menu shortcut to install the MED-V workspace. This automatically starts first time setup and completes the configuration of MED-V. After first time setup is complete, the end user can access the MED-V applications on the **Start** menu. - -## Related topics - - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) - -[How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md deleted file mode 100644 index 71bc439a8b..0000000000 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: How to Deploy a MED-V Workspace Manually -description: How to Deploy a MED-V Workspace Manually -author: dansimp -ms.assetid: 94bfb209-2230-49b6-bb40-9c6ab088dbf4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Deploy a MED-V Workspace Manually - - -In some instances, you might want to deploy your MED-V workspace manually, for example, if your company does not use an electronic software distribution system to deploy applications. - -This section provides instruction about how to manually deploy a MED-V workspace. - -**To deploy a MED-V workspace manually** - -1. Copy all prerequisite applications and the MED-V workspace package files to a shared drive or to a DVD. The following is a list of the required applications and files. - - - **Windows Virtual PC**. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - - **Windows Virtual PC Additions and Updates**. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - - **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). - - **Warning** - Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - - -~~~ -- **MED-V Workspace Installer, VHD, and Setup Executable** – created with the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - **Important** - The compressed VHD file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. -~~~ - - - -2. Install the following in the order listed. The end user can perform this task manually or you can create a script to install the following: - - - Windows Virtual PC and the Windows Virtual PC additions and updates. A computer restart is required. - - - The MED-V Host Agent. - - **Note** - If it is running, Internet Explorer must be restarted before the installation of the MED-V Host Agent can finish. - - - -~~~ -- The MED-V workspace package. - - Install the MED-V workspace by running the setup.exe program that is included in the MED-V workspace package files. -~~~ - -3. Complete first time setup. - - After the MED-V workspace is installed, you have the option of starting MED-V. This starts the MED-V Host Agent. You can either start MED-V at that time, or start the MED-V Host Agent later to complete first time setup. - - To start the MED-V Host Agent, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**. - -## Related topics - - -[How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md) - -[How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md) - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md deleted file mode 100644 index e2ebe0a01f..0000000000 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md +++ /dev/null @@ -1,189 +0,0 @@ ---- -title: How to Deploy a MED-V Workspace Through an Electronic Software Distribution System -description: How to Deploy a MED-V Workspace Through an Electronic Software Distribution System -author: dansimp -ms.assetid: b5134c35-e1de-470c-93f8-ead6218d9dce -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Deploy a MED-V Workspace Through an Electronic Software Distribution System - - -An electronic software distribution system is designed to efficiently move software to many different computers over slow or fast network connections. The following section provides information and instructions to help you deploy your MED-V workspace throughout your enterprise by using a software distribution system. - -**Note** -Whichever software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999). - - - -**Important** -If you are using System Center Configuration Manager 2007 SP2 and your MED-V workspaces are configured to operate in **NAT** mode, the virtual machines are classified as Internet-based clients and cannot find the closest distribution points from which to download content. - -The [hotfix to improve the functionality for VMs that are managed by MED-V](https://go.microsoft.com/fwlink/?LinkId=201088) (https://go.microsoft.com/fwlink/?LinkId=201088) adds new functionality to virtual machines that are managed by MED-V and that are configured to operate in **NAT** mode. The new functionality lets virtual machines access the closest distribution points. Therefore, the administrator can manage the virtual machine and the host computer in the same manner. This hotfix must be installed first on the site server and then on the client. - -The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. - - - -You can also deploy the MED-V components together by using a batch file, but this requires a restart after the installation of Windows Virtual PC. To bypass this requirement, you can specify a single restart after all of the components are installed. The single restart also automatically starts MED-V because the MED-V workspace installation places an entry in the RUNKEY. - -**To deploy a MED-V workspace by using a software distribution system** - -1. Define a group of computers and users in the electronic software distribution system as the target set of computers/users. - -2. Create packages for each Microsoft installation file that needs to be distributed. The following are the required files and the order in which they must be installed: - - 1. **Windows Virtual PC** – if not already installed (a computer restart is required). For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - 2. **Windows Virtual PC Additions and Updates** – if not already installed. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - 3. **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - - **Warning** - Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - - - 4. **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - **Important** - The compressed virtual hard disk file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe. - - - -~~~ - **Tip** - Because problems can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. -~~~ - - - -3. Configure the packages to run in silent mode (no user interaction is required). - - Running in silent mode eliminates the prompt to close Internet Explorer if it is running and the prompt to start the MED-V Host Agent. Both actions are performed when the computer is restarted. - - **Note** - Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md#bkmk-batch). MED-V automatically starts when the computer is restarted. - - - -4. Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic. - - **Important** - Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart. - - - -5. Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space. - -6. Assign the packages to the target set of computers/users. - - As computers are running, the software distribution system client recognizes that new packages are available and begins to install the packages per the definition and requirements. The installations should run sequentially in silent. We recommend that this is performed as a single process that does not require a restart until all the packages are installed. - -7. After the installations are complete, restart the updated computers. - - Depending on the software distribution system, you can schedule a restart of the computer or the end users can restart the computers manually during their regular work. After the computer is restarted, MED-V automatically starts after an end user logs on. When MED-V starts for the first time, it runs first time setup. - -First time setup starts and might take several minutes to finish, depending on the size of the virtual hard disk that you specified and the number of policies applied to the MED-V workspace on startup. The end user can track the progress by watching the MED-V icon in the notification area. For more information about first time setup, see [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md). - -**To install the MED-V workspace by using a batch file** - -1. Run the installation at a command prompt with administrative credentials. - -2. Deploy each component to a single directory. If run from a network share, a longer time is required to decompress the .medv file. - -3. As a best practice, specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This means that Windows Update will not cause any interference with the installation process by requiring a restart. - -4. Restart the computer after the batch file is finished. - -After the restart, the user is prompted to run first time setup and complete the configuration of MED-V. - -The following example, with the specified arguments, shows how to install 64-bit MED-V components in a single process: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ArgumentDescription

    /norestart

    Prevents the installation of Windows Virtual PC and the Windows Virtual PC update from restarting the host computer.

    /quiet

    Installs the MED-V components in quiet mode without user interaction.

    /qn

    Installs the MED-V components without a user interface.

    IGNORE_PREREQUISITES

    Installs without checking for Windows Virtual PC.

    -
    -Note

    Only specify this argument if you are installing Windows Virtual PC as part of this installation.

    -
    -
    - -

    OVERWRITEVHD

    Forces the installation of the MED-V workspace and prevents any prompts that it might generate.

    - - - -## Example - - -``` syntax -:: Install MED-V and the Pre-requisites - -:: Install the MED-V Host Agent: install in quiet mode, ignore that Windows Virtual PC is not installed completely, and log results -start /WAIT .\MED-V_HostAgent_Setup.exe /qn IGNORE_PREREQUISITES=1 /l* %TEMP%\MEDVhost.log - -:: Install the MED-V Workspace: install in quiet mode, Overwrite the VHD if it already exists, and log results -start /WAIT .\setup.exe /qn OVERWRITEVHD=1 /l* %TEMP%\MEDVworkspace.log - -:: Install Windows Virtual PC: install in quiet mode and do not reboot -start /WAIT wusa.exe Windows6.1-KB958559-x64.msu /norestart /quiet - -:: Install Windows Virtual PC patch to support non-HAV: install in quiet mode and do not reboot -wusa.exe Windows6.1-KB977206-x64.msu /norestart /quiet - -:: After successful installation of the above components, a reboot of the host computer is required to complete installation. -``` - -## Related topics - - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) - -[How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md deleted file mode 100644 index 5dfe7451d7..0000000000 --- a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md +++ /dev/null @@ -1,180 +0,0 @@ ---- -title: How to Deploy the MED-V Components Through an Electronic Software Distribution System -description: How to Deploy the MED-V Components Through an Electronic Software Distribution System -author: dansimp -ms.assetid: 8a800bdf-6fa4-47b4-b417-df053289d4e8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Deploy the MED-V Components Through an Electronic Software Distribution System - - -An electronic software distribution system can help you efficiently move software to many computers over slow or fast network connections. The following section provides information and instructions to help you deploy the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 components throughout your enterprise by using a software distribution system. - -**Note** -Whichever software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999). - - - -**Important** -If you are using System Center Configuration Manager 2007 SP2 and your MED-V workspaces are configured to operate in **NAT** mode, the virtual machines are classified as Internet-based clients and cannot find the closest distribution points from which to download content. - -The [hotfix to improve the functionality for VMs that are managed by MED-V](https://go.microsoft.com/fwlink/?LinkId=201088) (https://go.microsoft.com/fwlink/?LinkId=201088) adds new functionality to virtual machines that are managed by MED-V and that are configured to operate in **NAT** mode. The new functionality lets virtual machines access the closest distribution points. Therefore, the administrator can manage the virtual machine and the host computer in the same manner. This hotfix must be installed first on the site server and then on the client. - -The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix. - - - -**Note** -You must install the MED-V workspace packager and build your MED-V workspaces before you can deploy the MED-V components through your software distribution system. For more information about how to prepare an image and to build your MED-V workspaces, see [Operations for MED-V](operations-for-med-v.md). - - - -**To deploy the MED-V components by using a software distribution system** - -1. Define a group of computers and users in the electronic software distribution system as the target set of computers/users. - -2. Create packages for each Microsoft installation file that needs to be distributed. The following are the required files and the order in which they must be installed: - - 1. **Windows Virtual PC** – if not already installed (a computer restart is required). For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - 2. **Windows Virtual PC Additions and Updates** – if not already installed. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - 3. **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md). - - **Warning** - Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - 4. **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - - **Important** - The compressed virtual hard disk file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe. - - **Tip** - Because problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. - -3. Configure the packages to run in silent mode (no user interaction is required). - - Running in silent mode eliminates the prompt to close Internet Explorer if it is running and the prompt to start the MED-V Host Agent. Both actions are performed when the computer is restarted. - - **Note** - Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [To install the MED-V components by using a batch file](#bkmk-batch). MED-V automatically starts when the computer is restarted. - -4. Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic. - - **Important** - Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart. - -5. Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space. - -6. Assign the packages to the target set of computers/users. - - As computers are running, the software distribution system client recognizes that new packages are available and begins to install the packages per the definition and requirements. The installations should run sequentially in silent mode. We recommend that this is performed as a single process that does not require a restart until all the packages are installed. - -7. After the installations are complete, restart the updated computers. - - Depending on the software distribution system, you can schedule a restart of the computer or the end users can restart the computers manually during their regular work. After the computer is restarted, MED-V automatically starts after an end user logs on. When MED-V starts for the first time, it runs first time setup. - -First time setup starts and might take several minutes to finish, depending on the size of the virtual hard disk that you specified and the number of policies applied to the MED-V workspace on startup. The end user can track the progress by watching the MED-V icon in the notification area. For more information about first time setup, see [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md). - -**To install the MED-V components by using a batch file** - -1. Run the installation at a command prompt with administrative credentials. - -2. Deploy each component to a single directory. If run from a network share, a longer time is required to decompress the .medv file. - -3. As a best practice, specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This means that Windows Update will not cause any interference with the installation process by requiring a restart. - -4. Restart the computer after the batch file is finished. - -After the restart, the user is prompted to run first time setup and complete the configuration of MED-V. - -The following example, with the specified arguments, shows how to install 64-bit MED-V components in a single process: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ArgumentDescription

    /norestart

    Prevents the installation of Windows Virtual PC and the Windows Virtual PC update from restarting the host computer.

    /quiet

    Installs the MED-V components in quiet mode without user interaction.

    /qn

    Installs the MED-V components without a user interface.

    IGNORE_PREREQUISITES

    Installs without checking for Windows Virtual PC.

    -
    -Note

    Only specify this argument if you are installing Windows Virtual PC as part of this installation.

    -
    -
    - -

    OVERWRITEVHD

    Forces the installation of the MED-V workspace and prevents any prompts that it might generate.

    - - - -## Example - - -``` syntax -:: Install MED-V and the Pre-requisites - -:: Install the MED-V Host Agent: install in quiet mode, ignore that Windows Virtual PC is not installed completely, and log results -start /WAIT .\MED-V_HostAgent_Setup.exe /qn IGNORE_PREREQUISITES=1 /l* %TEMP%\MEDVhost.log - -:: Install the MED-V Workspace: install in quiet mode, Overwrite the VHD if it already exists, and log results -start /WAIT .\setup.exe /qn OVERWRITEVHD=1 /l* %TEMP%\MEDVworkspace.log - -:: Install Windows Virtual PC: install in quiet mode and do not reboot -start /WAIT wusa.exe Windows6.1-KB958559-x64.msu /norestart /quiet - -:: Install Windows Virtual PC patch to support non-HAV: install in quiet mode and do not reboot -wusa.exe Windows6.1-KB977206-x64.msu /norestart /quiet - -:: After successful installation of the above components, a reboot of the host computer is required to complete installation. -``` - -## Related topics - - -[MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md) - -[Deploy the MED-V Components](deploy-the-med-v-components.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md b/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md deleted file mode 100644 index 3411624601..0000000000 --- a/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: How to Install the MED-V Workspace Packager -description: How to Install the MED-V Workspace Packager -author: dansimp -ms.assetid: 627478e9-6798-4b32-9a50-7a1b72bea295 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Install the MED-V Workspace Packager - - -Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 includes a **MED-V Workspace Packager**, which the desktop administrator uses to create the MED-V workspace deployment packages that are distributed to the end users. The packager provides step-by-step guidance on how to create MED-V workspaces and contains wizards that help in the process. - -**Important**   -Before you start to run the wizards, make sure that you have a prepared VHD ready to install. For more information, see [Prepare a MED-V Image](prepare-a-med-v-image.md). - - - -This section provides step-by-step instructions for installing or repairing the **MED-V Workspace Packager**. - -**To install the MED-V Workspace Packager** - -1. Locate the MED-V installation files that you received as part of your software download. - -2. Double-click the MED-V\_WorkspacePackager\_Setup installation file. - - The **Microsoft Enterprise Desktop Virtualization (MED-V) Workspace Packager Setup** wizard opens. Click **Next** to continue. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Select the destination folder for installing the MED-V Workspace Packager, and then click **Next**. - -5. To begin the installation, click **Install**. - -6. After the installation is completed successfully, click **Finish** to close the wizard. - - To verify that the installation of the packager was successful, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager.** - - For information about how to use the **MED-V Workspace Packager**, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md). - -If the packager does not open as expected, you can try to repair the installation. - -**To repair the MED-V Workspace Packager installation** - -1. Double-click the MED-V\_WorkspacePackager\_Setup installation file. - - The **Microsoft Enterprise Desktop Virtualization (MED-V) Workspace Packager Setup** wizard opens. Click **Next** to continue. - -2. To repair errors that might have occurred in the installation, click **Repair**. - -3. To begin the repair process, click **Repair** again. - -4. After the repair is completed successfully, click **Finish** to close the wizard. - - To verify that the repair of the packager was successful, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager.** - -## Related topics - - -[How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md) - -[How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md b/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md deleted file mode 100644 index 017ed271d8..0000000000 --- a/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: How to Manage URL Redirection by Using the MED-V Workspace Packager -description: How to Manage URL Redirection by Using the MED-V Workspace Packager -author: dansimp -ms.assetid: 1a8d25af-479f-42d3-bf5f-c7fd974bbf8c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# How to Manage URL Redirection by Using the MED-V Workspace Packager - - -You can use the MED-V Workspace Packager to manage URL redirection in the MED-V workspace. - -**To manage web address redirection in a MED-V workspace** - -1. To open the **MED-V Workspace Packager**, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager**. - -2. On the **MED-V Workspace Packager** main panel, click **Manage Web Redirection**. - -3. In the **Manage Web Redirection** window, you can type, paste, or import a list of the URLs that are redirected to Internet Explorer in the MED-V workspace. - - **Note** - URL redirection in MED-V only supports the protocols HTTP and HTTPS. MED-V does not provide support for FTP or any other protocols. - - - -~~~ -Enter each web address on a single line, for example: - -http://www.contoso.com/webapps/webapp1 - -http://www.contoso.com/webapps/webapp2 - -http://\*.contoso.com - -http://www.contoso.com/webapps/\* - -**Important** -If you import a text file that includes a URL that uses special characters (such as ~ ! @ \# and so on), make sure that you specify UTF-8 encoding when you save the text file. Special characters do not import correctly into the MED-V Workspace Packager if the text file was saved using the default ANSI encoding. -~~~ - - - -4. Click **Save as…** to save the updated URL redirection files in the specified folder. MED-V creates a registry file that contains the updated URL redirection information. Deploy the updated registry key by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931). - - MED-V also creates a Windows PowerShell script in the specified folder that you can use to re-create the updated MED-V workspace package. - -## Related topics - - -[How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace](how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md) - -[Manage MED-V URL Redirection](manage-med-v-url-redirection.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md b/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md deleted file mode 100644 index 7f5beda9c6..0000000000 --- a/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: How to Manually Install the MED-V Host Agent -description: How to Manually Install the MED-V Host Agent -author: dansimp -ms.assetid: 4becc90b-6481-4e1f-a4d3-aec74c8821ec -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Manually Install the MED-V Host Agent - - -There are two separate but related components to the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 solution: the MED-V Host Agent and Guest Agent. The Host Agent resides on the host computer (a user’s computer that is running Windows 7) and provides a channel to communicate with the MED-V guest (the MED-V virtual machine running in the host computer). It also provides certain MED-V related functionality, such as application publishing. - -Typically, you deploy and install the MED-V Host Agent by using your company’s preferred method of provisioning software. However, before deploying MED-V across your enterprise, you might prefer to install the Host Agent locally for testing. This section provides step-by-step instructions for manually installing the MED-V Host Agent. - -**Note**   -The MED-V Guest Agent is installed automatically during first time setup. - - - -**Important**   -Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution. - - - -**To install the MED-V Host Agent** - -1. Locate the MED-V installation files that you received as part of your software download. - -2. Double-click the MED-V\_HostAgent\_Setup installation file. - - The **Microsoft Enterprise Desktop Virtualization (MED-V) Host Agent Setup** wizard opens. Click **Next** to continue. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Select the destination folder for installing the MED-V Host Agent. Click **Next**. - -5. To begin the Host Agent installation, click **Install**. - -6. After the installation is completed successfully, click **Finish** to close the wizard. - - To verify that the installation of the Host Agent was successful, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**. - -**Note**   -Until a MED-V workspace is installed, the MED-V Host Agent can be started and runs, but provides no functionality. - - - -## Related topics - - -[How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md) - -[How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md) - -[How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md b/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md deleted file mode 100644 index 828340b98c..0000000000 --- a/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Publish and Unpublish an Application on the MED-V Workspace -description: How to Publish and Unpublish an Application on the MED-V Workspace -author: dansimp -ms.assetid: fd5a62e9-0577-44d2-ae17-61c0aef78ce8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Publish and Unpublish an Application on the MED-V Workspace - - -Even though an application is installed in a MED-V workspace, you might also have to publish the application before it becomes available to the end user. By default, most applications are published at the time that they are installed and shortcuts are created and enabled. - -In some cases, you might want to install applications on the MED-V workspace without making them available to the end user, for example, virus-scanning software. Similarly, there are occasions in which you want to publish an application that is installed on the MED-V workspace that was previously unavailable to the end user. For example, you might have to publish an installed application if the installation did not automatically create a shortcut on the **Start** menu. - -**Important**   -If you publish an application that does not support UNC paths, we recommend that you map the application to a drive. - - - -You can publish or unpublish applications to a deployed MED-V workspace by performing one of the following tasks: - -**To publish or unpublish an installed application** - -1. To publish an application on a deployed MED-V workspace, copy a shortcut for that application to the following folder on the virtual machine: - - C:\\Documents and Settings\\All Users\\Start Menu - - If it is necessary, use Group Policy or an ESD system to deploy a script that copies the shortcut for that application to the All Users\\Start Menu folder. - -2. To unpublish an application on a deployed MED-V workspace, delete the shortcut for that application from the following folder on the virtual machine: - - C:\\Documents and Settings\\All Users\\Start Menu - - If it is necessary, use Group Policy or an ESD system to deploy a script that deletes the shortcut for that application from the All Users\\Start Menu folder. - - **Note**   - Frequently, the shortcut is automatically deleted from the host computer **Start** menu when you uninstall the application. However, in some cases, such as for a MED-V workspace that is configured for all users of a shared computer, you might have to manually delete the shortcut on the **Start** menu after the application is uninstalled. The end-user can do this by right-clicking the shortcut and selecting **Delete**. - - - -To test that the application was published or unpublished, verify on the MED-V workspace whether the corresponding shortcut is available or not. - -**Note**   -Applications that are included in Windows XP SP3 and are located in the virtual machine Start Menu folder are not automatically published to the host. They are controlled by registry settings that block automatic publishing. For more information, see [Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md). - - - -**To publish Control Panel items** - -1. Create a shortcut on the virtual machine where the target is the name of the item, such as C:\\WINDOWS\\system32\\appwiz.cpl. - - The shortcut must be either created in or moved to the "%ALLUSERSPROFILE%\\Start Menu\\" folder or one of its subfolders. - - The item will be published to the host computer in the corresponding location in the host Start Menu folder. - -2. Start the shortcut for the item in the host. - -**Caution**   -When you create the shortcut, do not specify %SystemRoot%\\control.exe. This application will not be published because it is contained in the registry settings that block automatic publishing. - - - -**How MED-V handles automatic application publishing** - -1. During application publishing, MED-V copies the shortcuts from the guest virtual machine to the host computer by trying to match the folder hierarchy that exists in the guest. By doing this, MED-V copies shortcuts from the guest to the host by following these steps: - - 1. MED-V tries to locate a folder under Start Menu\\Programs in the host computer that is named the same as the folder in the guest where the shortcut resides. - - 2. If there is no matching folder, MED-V then tries to locate a folder in the host Start Menu folder that is named the same as the folder in the guest where the shortcut resides. - - 3. If there is no matching folder, MED-V copies the shortcut to the default folder on the host, the Start Menu\\Programs folder. - -2. Example of application publishing process: - - 1. If an application shortcut is published to the Start Menu\\Programs\\AppShortcuts folder in the guest, then MED-V looks in the host computer for a Start Menu\\Programs\\ AppShortcuts folder and if found, copies the shortcut to that folder. - - 2. If the folder is not found, then MED-V looks in the host computer for a Start Menu\\AppShortcuts folder and if found, copies the shortcut to that folder. - - 3. If the folder is not found, then MED-V copies the shortcut to the Start Menu\\Programs folder. - -**Note**   -A folder must already exist in the host computer Start Menu folder for MED-V to copy the shortcut there. MED-V does not create the folder if it does not already exist. - - - -## Related topics - - -[Installing and Removing an Application on the MED-V Workspace](installing-and-removing-an-application-on-the-med-v-workspace.md) - -[Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md) - -[Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-test-application-publishing.md b/mdop/medv-v2/how-to-test-application-publishing.md deleted file mode 100644 index 2270008b6e..0000000000 --- a/mdop/medv-v2/how-to-test-application-publishing.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: How to Test Application Publishing -description: How to Test Application Publishing -author: dansimp -ms.assetid: 17ba2e12-50a0-4f41-8300-f61f09db9f6c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Test Application Publishing - - -After your test of first time setup finishes, you can verify that the application publishing functionality is working as expected by performing the following tasks. - -**To test application publishing** - -1. Verify that the applications that you specified for publishing are visible. - - Click **Start** and then click **All Programs** and search for the specified applications. - - In some cases, you might have the same application installed two times, one time on the host computer and one time on the guest. If a published application that has the same name is published to the same location on the host **Start** menu, it is distinguished from the host application shortcut by adding the virtual machine name to the shortcut name. For example, for a virtual machine named “MEDVHost1”, a host application might be "Notepad" and a published application might be "Notepad (MEDVHost1)". - -2. Verify that the applications function as intended. - - On the host computer, start the applications that you published and verify that they open in Windows XP SP3 on the guest. The application must appear in a Windows XP-style window on the host computer desktop. - -3. If applicable, verify that document redirection functions as intended. - - If a published application on the guest has to open a folder on the host system drive, ensure that it can open the specified folder. - - **Important**   - Because Windows Virtual PC does not support creating a share from a folder that is already shared, redirection does not occur for any documents that open from a shared folder, such as a My Documents folder that is located on the network. For more information, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). - -After you have verified that published applications are installed and functioning correctly, you can test whether applications can be added or removed from the MED-V workspace. - -**To test that an application can be added or removed** - -1. Add or remove an application from the MED-V workspace. - - For information about how to add and remove applications from a MED-V workspace, see [Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md). - -2. If you added an application, repeat the steps in [To Test Application Publishing](#bkmk-apppub) to verify that the new application functions as intended. - -3. If you removed an application, click **Start** and then click **All Programs** and verify that any applications that you removed are no longer listed. - -**Note**   -If you encounter any problems when verifying your application publication settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). - -After you have completed testing application publishing, you can test other MED-V workspace configurations to verify that they function as intended. - -After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise. - -## Related topics - -[How to Test URL Redirection](how-to-test-url-redirection.md) - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-test-url-redirection.md b/mdop/medv-v2/how-to-test-url-redirection.md deleted file mode 100644 index 3a46ee7100..0000000000 --- a/mdop/medv-v2/how-to-test-url-redirection.md +++ /dev/null @@ -1,72 +0,0 @@ ---- -title: How to Test URL Redirection -description: How to Test URL Redirection -author: dansimp -ms.assetid: 38d80088-da1d-4098-b27e-76f9e78f81dc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/01/2016 ---- - - -# How to Test URL Redirection - - -After your test of first time setup finishes, you can verify that the URL redirection functionality is working as expected by performing the following tasks. - -**Important**   -The MED-V Host Agent must be running for URL redirection to function correctly. - -**To test URL Redirection** - -1. Open an Internet Explorer browser in the host computer and enter a URL that you specified for redirection. - -2. Verify that the webpage is opened in Internet Explorer on the guest virtual machine. - -3. Repeat this process for each URL that you want to test. - -**To test that a URL can be added or removed** - -1. Add or remove a URL from the MED-V workspace. - - For information about how to add and remove URLs for redirection on a MED-V workspace, see [Manage MED-V URL Redirection](manage-med-v-url-redirection.md). - -2. If you added a URL to the redirection list, repeat the steps in [To Test URL Redirection](#bkmk-urlredir) to verify that the new URL redirects as intended. - -3. If you removed a URL from the redirection list, verify that it is removed by following these steps: - - 1. Open an Internet Explorer browser in the host computer and enter the URL that you removed from the redirection list. - - 2. Verify that the webpage is opened in Internet Explorer on the host computer instead of on the guest virtual machine. - - **Note**   - It can take several seconds for the URL redirection changes to take place. - -**Note**   -If you encounter any problems when verifying your URL redirection settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). - -After you have completed testing URL redirection in your MED-V workspace, you can test other configurations to verify that they function as intended. - -After you have completed testing your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise. - -## Related topics - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-uninstall-the-med-v-components.md b/mdop/medv-v2/how-to-uninstall-the-med-v-components.md deleted file mode 100644 index f1eeaa5b43..0000000000 --- a/mdop/medv-v2/how-to-uninstall-the-med-v-components.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: How to Uninstall the MED-V Components -description: How to Uninstall the MED-V Components -author: dansimp -ms.assetid: c121dd27-6b2f-4d41-a21a-c6e8608c5c41 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Uninstall the MED-V Components - - -Under certain circumstances, you might want to uninstall all or part of the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 components from your enterprise. For example, you have resolved all application operating system compatibility issues, or you want to deploy a different MED-V workspace in your enterprise. - -Typically, you can configure your electronic software distribution (ESD) system to uninstall the MED-V components by using a Windows-based Installer. Alternately, you can uninstall all or some MED-V components manually. - -**Important**   -Before you can uninstall the MED-V Host Agent, you must first uninstall any installed MED-V workspace. - - - -Use the following procedures to uninstall the MED-V components from your enterprise. - -**To uninstall MED-V using an electronic software distribution System** - -1. Use your ESD system to distribute a script that invokes the uninstall.exe executable program for every MED-V workspace that you want to uninstall. The file is located at C:\\ProgramData\\Microsoft\\Medv\\Workspace. You can set a flag to run the uninstall executable program silently so that end users are unaware of the uninstallation. - -2. Create a package to distribute the MED-V Host Agent installation file to each computer on which a MED-V workspace was uninstalled. Configure the package to run the uninstallation in silent mode. - -The ESD client recognizes when the new packages are available and starts to uninstall the packages per the definition and requirements. - -**To manually uninstall a MED-V workspace** - -1. On the host computer, click **Start**, click **Control Panel**, and then click **Programs and Features**. - -2. In the **Programs and Features** window, select the MED-V workspace that you want to remove, and then click **Uninstall**. (The MED-V workspace is named "MED-V Workspace - <*workspace\_name*>"). The <*workspace\_name*> **Setup Wizard** opens. - -3. On the **Setup Wizard**, click **Next**, and then click **Remove**. - -4. If you prefer, select the check box to delete the master VHD disk and differencing disks created by MED-V. This is not required, but frees disk space after the uninstallation finishes. - -5. Click **Remove**. - - **Note**   - If MED-V is currently running, a dialog box appears and prompts you whether you want to shut it down. Click **Yes** to continue with the uninstallation. Click **No** to cancel the uninstallation. - - - -Alternately, you can remove a MED-V workspace by running the `uninstall.exe` file, typically located at C:\\ProgramData\\Microsoft\\Medv\\Workspace. - -**To manually uninstall the MED-V Host Agent** - -1. On the Windows 7 host computer, click **Start**, click **Control Panel**, and then click **Programs and Features**. - -2. In the **Programs and Features** window, select **MED-V Host Agent**, and then click **Uninstall**. - - The Windows Installer removes the MED-V Host Agent. - - **Note**   - If you try to uninstall the MED-V Host Agent before you uninstall the MED-V workspace, a dialog box appears that states that you must first uninstall the MED-V workspace. Click **OK** to continue. - - - -**To manually uninstall the MED-V Workspace Packager** - -1. On the host computer, click **Start**, click **Control Panel**, and then click **Programs and Features**. - -2. In the **Programs and Features** window, select **MED-V Workspace Packager**, and then click **Uninstall**. - - The Windows Installer removes the MED-V Workspace Packager. - - **Note**   - You can uninstall the MED-V Workspace Packager at any time without affecting any deployed MED-V workspaces. - - - -## Related topics - - -[Deploy the MED-V Components](deploy-the-med-v-components.md) - - - - - - - - - diff --git a/mdop/medv-v2/how-to-verify-first-time-setup-settings.md b/mdop/medv-v2/how-to-verify-first-time-setup-settings.md deleted file mode 100644 index 4be201579a..0000000000 --- a/mdop/medv-v2/how-to-verify-first-time-setup-settings.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: How to Verify First Time Setup Settings -description: How to Verify First Time Setup Settings -author: dansimp -ms.assetid: e8a07d4c-5786-4455-ac43-2deac4042efd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# How to Verify First Time Setup Settings - - -While your test of first time setup is running or after it finishes, you can verify the settings that you configured in your MED-V workspace by performing the following tasks. - -**Note**   -For information about how to monitor the successful completion of first time setup throughout your enterprise after deployment, see [Monitoring MED-V Workspace Deployments](monitoring-med-v-workspace-deployments.md). - - - -**To verify settings during first time setup** - -1. While first time setup is running, verify the following: - - If you specified **Unattended** mode, verify that the virtual machine does not appear when first time setup is running. - - If you specified attended mode, verify that the virtual machine appears and that all fields that require user input are displayed. - -2. You can also monitor the complete first time setup process by viewing the virtual machine when first time setup is running. To do this, follow these steps: - - 1. Open the Windows Virtual PC Console. - - Click **Start**, click **All Programs**, click **Windows Virtual PC**, and then click **Windows Virtual PC**. - - 2. Start MED-V if it is not already running. - - If not already present, in a short time, a virtual machine with the name of the deployed MED-V workspace appears in the list of virtual machines. - - 3. Double-click the MED-V virtual machine to open it. - - You can observe the MED-V virtual machine when it is being set up, and you can troubleshoot the Mini-Setup procedure. Verify the information in the different screens as they go by, such as configuring networking settings, computer domain join information, configuring of the Guest Agent, set up of personal settings, and shutdown. - - 4. The virtual machine closes automatically when first time setup finishes. - - **Note**   - You can close the virtual machine window at any time and first time setup continues. - - - -**To verify settings after first time setup finishes** - -1. Ensure that first time setup finished successfully. - -2. Verify that the MED-V workspace is set up correctly. - - 1. Open the Windows Virtual PC Console. - - Click **Start**, click **All Programs**, click **Windows Virtual PC**, and then click **Windows Virtual PC**. - - 2. Double-click your installed MED-V workspace. - - If the MED-V workspace is already running a virtual application, you might be prompted to close the application before you can open the virtual machine. - - 3. In the MED-V workspace, right-click **My Computer**, and then click **Properties**. - - 4. Verify that the MED-V workspace joined the correct domain. If applicable to your organization, test domain joining by specifying two different domains to verify that the guest domain is overridden by the host domain. - - 5. Verify that the MED-V workspace joined the domain organizational unit that you specified. - - 6. If you specified the computer name mask, verify that the new computer name matches what was specified. - -3. Verify that the locale settings that you specified are correct. - - 1. In the MED-V workspace, click **Start** and then click **Control Panel**. - - 2. Verify your specified configuration settings, for example, **Date and Time** and **Regional and Language**. - -**Note**   -If you encounter any problems when verifying your first time setup settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md). - - - -After you have verified that your first time setup settings are correct, you can test other MED-V workspace configurations to verify that they function as intended, such as application publishing and URL redirection. - -After you have completed all testing of your MED-V workspace package and have verified that it is functioning as intended, you can deploy the MED-V workspace to your enterprise. - -## Related topics - - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Test URL Redirection](how-to-test-url-redirection.md) - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md b/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md deleted file mode 100644 index 0b5b8bf849..0000000000 --- a/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md +++ /dev/null @@ -1,123 +0,0 @@ ---- -title: Identifying the Number and Types of MED-V Workspaces -description: Identifying the Number and Types of MED-V Workspaces -author: dansimp -ms.assetid: 11642253-6b1f-4c4a-a11e-48d8a360e1ea -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Identifying the Number and Types of MED-V Workspaces - - -MED-V creates a virtual environment for running applications that require Windows XP or that require a version of Internet Explorer that differs from the version on the host computer. This virtual environment is known as a MED-V workspace. - -Depending on the application compatibility requirements faced by your organization as you migrate to Windows 7, only certain users or departments might require MED-V workspaces. As you plan your deployment, you have to determine the number of MED-V workspaces required in your enterprise. You also have to define the requirements of each MED-V workspace. - -## Identify the Number and Types of MED-V Workspaces - - -Identify the computers and groups in your enterprise for which you will be creating MED-V workspaces. Typically, these are the users who require access to those applications that cannot be migrated to Windows 7. Identify those applications that cannot be migrated and the users who require a MED-V workspace to run these applications. - -You might also have intranet addresses that have not yet been optimized for Windows 7. The MED-V workspace provides an Internet Explorer browser through which end users can better access those web addresses that are not yet ready for the migration to Windows 7. As you are preparing and planning your MED-V deployment, you will have to identify and compile a list of the URL addresses to redirect from Internet Explorer on the host computer to Internet Explorer in the MED-V workspace. - -Finally, you have to evaluate your disk space requirements. Most MED-V workspaces are 2 gigabytes (GB) or larger. The available disk space on a system can be consumed quickly, depending on the number of users and the configuration of MED-V. Also, your company’s preferred method of distribution can require additional space. Generally, you should free a minimum of 10 GB of disk space for a MED-V workspace, but this varies greatly, depending on the size of the image. - -### Calculate the Disk Space Requirements for MED-V Workspaces - -A MED-V workspace requires memory and disk space from the host computer on which it is installed. At a minimum, 2 GB of disk space are required on the host. Disk space is variable and depends on the number of applications and the data in a user’s MED-V workspace. - -We recommend a minimum of 10 GB of disk space for MED-V. This amount allows for a basic Windows XP workspace and some basic installed applications and web redirection. It also provides available space for the host swap drive. In a basic configuration, MED-V and a single deployed MED-V workspace consume as much as 6 to 8 GB. If you include lots of applications on the MED-V workspace or have more than one user per computer, then you can use the following calculation to more accurately determine the disk space your MED-V workspace requires: - -*Base VHD + (User per computer x (Difference Disk + Saved State))* - -To calculate the required disk space, determine the following: - -- **Size of the base VHD** – the virtual hard disk that was used to create the MED-V workspace. - - **Important**   - Do not use the .medv file size for your calculation because the .medv file is compressed. - - - -- **Users per computer** – MED-V creates a MED-V workspace for each user on a computer; the MED-V workspace consumes disk space as each user logs on and the MED-V workspace is created. - -- **Size of the differencing disk** – used to track the difference from the base VHD. This size varies as you add applications and software updates to the virtual hard disk. A differencing disk is created for each MED-V user when they start MED-V for the first time. - -- **Size of the Saved State file** – used to maintain state in the virtual machine. Typically, this is just a bit larger than the allocated RAM for the virtual machine. For example, 1 GB of RAM allocated creates a file about 1,081,000 KB. - -The following example shows a calculation based on three users of a MED-V workspace that has a 2.6 GB virtual hard disk: - -*2.6gb + (3 x (1.5gb + 1gb)) = 10.1gb* - -**Note**   -A MED-V best practice is to calculate the required space by using a lab deployment to validate the requirements. - - - -### Locate the Files to Determine File Size - -The following locations contain the files for the computer and user settings: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
    TypeLocationFiles

    Base VHD

    %ProgramData%\Microsoft\Medv\Workspace

    InternalName.vhd - Where InternalName is the name of the virtual hard disk that you selected in the MED-V Workspace Packager.

    Differencing Disk

    %LocalAppData%\Microsoft\MEDV\v2\Virtual Machines

    WorkspaceName.vhd

    Saved State File

    %LocalAppData%\Microsoft\MEDV\v2\Virtual Machines

    WorkspaceName.vsv

    - - - -### Calculate the Disk Space Requirements for Shared MED-V Workspaces - -If you are calculating for a shared MED-V workspace deployment on a single computer, then the number of users per computer in your calculation is always “1” because MED-V only configures a single differencing disk for all users. - -You can find the differencing disk and the saved state file for shared MED-V workspaces in %ProgramData%\\Microsoft\\Medv\\AllUsers. - -## Related topics - - -[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) - -[Planning for MED-V](planning-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/images/med-v2logo.gif b/mdop/medv-v2/images/med-v2logo.gif deleted file mode 100644 index 4334fde270..0000000000 Binary files a/mdop/medv-v2/images/med-v2logo.gif and /dev/null differ diff --git a/mdop/medv-v2/index.md b/mdop/medv-v2/index.md deleted file mode 100644 index aa6fcbf448..0000000000 --- a/mdop/medv-v2/index.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Microsoft Enterprise Desktop Virtualization 2.0 -description: Microsoft Enterprise Desktop Virtualization 2.0 -author: dansimp -ms.assetid: 84109be0-4613-42e9-85fc-fcda8de6e4c4 -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft Enterprise Desktop Virtualization 2.0 - - -![med-v logotype](images/med-v2logo.gif) - -Welcome to Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. MED-V 2.0 uses Windows Virtual PC to provide an enterprise solution for desktop virtualization. By using MED-V, you can easily create, deliver, and manage corporate Windows Virtual PC images on any Windows-based desktop running Windows 7 Professional, Enterprise, or Windows 7 Ultimate. - -MED-V is an integral component of the Microsoft Desktop Optimization Pack, a dynamic solution available to Software Assurance customers, which helps reduce software installation costs, enables delivery of applications as services, and helps manage and control enterprise desktop environments. - -For more information about how to perform MED-V tasks, use the following sections. - -## In This Section - - -[Getting Started with MED-V](getting-started-with-med-vmedv2.md) - -[Planning for MED-V](planning-for-med-v.md) - -[Deployment of MED-V](deployment-of-med-v.md) - -[Operations for MED-V](operations-for-med-v.md) - -[Troubleshooting MED-V](troubleshooting-med-vmedv2.md) - -[Security and Protection for MED-V](security-and-protection-for-med-v.md) - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -## Reference - - -For more information about MED-V, see - -[Microsoft Windows Enterprise: Improving Virtual PCs with MED-V](https://go.microsoft.com/fwlink/?LinkId=195917) (https://go.microsoft.com/fwlink/?LinkId=195917). - -  - -  - - - - - diff --git a/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md b/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md deleted file mode 100644 index 211567c714..0000000000 --- a/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Installing and Removing an Application on the MED-V Workspace -description: Installing and Removing an Application on the MED-V Workspace -author: dansimp -ms.assetid: 24f32720-51ab-4385-adfe-4f5a65e45fdf -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Installing and Removing an Application on the MED-V Workspace - - -Applications that are incompatible with the host operating system can be run in the MED-V workspace and opened in the MED-V workspace in the same manner in which they are opened from the host computer, on the **Start** menu or by using a localhost shortcut. - -After you have deployed a MED-V workspace, you have several different options available to you for installing and removing applications in the MED-V workspace. These options include the following: - -- [Using Group Policy](#bkmk-grouppolicy) - -- [Using an Electronic Software Distribution System](#bkmk-esd) - -- [Using Application Virtualization (APP-V)](#bkmk-appv) - -- [Updating the Core Image](#bkmk-coreimage) - -**Important**   -To make sure that an installed application is automatically published to the host, install the application on the virtual machine for **All Users**. For more information about application publishing, see [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md). - - - -**Tip**   -MED-V does not support guest-to-host redirection for content handling, such as double-clicking a Microsoft Word document in Internet Explorer in the MED-V workspace. Therefore, the required applications, such as Microsoft Word, must be installed in MED-V workspace to provide the default content handling functionality that an end user might expect. - - - -## Adding and Removing Applications by Using Group Policy - - -You can use Group Policy and Group Policy objects to assign or publish applications to all or some MED-V workspaces in your enterprise. For assigned applications, when an end user logs on to their computer, the application appears on the **Start** menu. When they select the new application for the first time, the application installs and is ready for use. For published applications, the application does not appear on the **Start** menu. It is only available for the end user to install by using **Add or Remove Programs** in **Control Panel** or by opening a file that is associated with the application. - -You can also use Group Policy and Group Policy objects in the same manner to remove applications from the MED-V workspace. - -For more information about how to add and remove applications by using Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931). - -## Adding and Removing Applications by Using an ESD System - - -An electronic software distribution (ESD) system is designed to efficiently deploy software and other information to many different computers over network connections. If your organization uses an ESD system to deploy software, you can use it to add and remove applications on MED-V workspaces just as you add and remove applications on physical computers. - -## Adding and Removing Applications by Using APP-V - - -Microsoft Application Virtualization (App-V) provides the administrative capability to make applications available to end-user computers without having to install the applications directly on those computers. You might want to use MED-V and App-V together if, for example, your organization has applications that you sequenced with App-V in Windows XP, and re-sequencing them would delay your migration to Windows 7. - -You can use MED-V together with App-V to add and remove virtual applications on a deployed MED-V workspace. To manage applications in this manner, you must first install the App-V agent on the MED-V guest operating system. You can then use App-V in the MED-V workspace to add and remove the virtual applications. - -For information about how to install and use App-V, see [Application Virtualization](https://go.microsoft.com/fwlink/?LinkId=122939) (https://go.microsoft.com/fwlink/?LinkId=122939). - -**Important**   -App-V applications that you publish to the MED-V workspace have file-type associations that cannot redirect from the host computer to the guest virtual machine. However, the end user can still access these file types by clicking **File**, and then by clicking **Open** on the published App-V application. - -To force redirection of those file-type associations, query App-V for mapped file type associations by typing the following at a command prompt in the guest virtual machine: **sftmime /QUERY OBJ:TYPE**. Then, map those file type associations in the host computer. - - - -## Adding and Removing Applications on the Core Image - - -Although not considered a MED-V best practice, you can add and remove applications directly on the core image. After you have added or removed an application, you can redeploy the MED-V workspace back out to your enterprise just as you deployed it originally. - -For more information about how to add or remove applications on the core image, see [Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md). - -**Important**   -We do not recommend this method of managing applications. If you add or remove applications on the core image and redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved on the virtual machine is lost. - - - -**Note**   -Even though an application is installed into a MED-V workspace, you might also have to publish the application before it becomes available to the end user. For example, you might have to publish an installed application if the installation did not automatically create a shortcut on the **Start** menu. Likewise, to unpublish an application, you might have to manually remove a shortcut from the **Start** menu. - -By default, most applications are published at the time that they are installed, when shortcuts are automatically created and enabled. - - - -## Related topics - - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) - - - - - - - - - diff --git a/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md b/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md deleted file mode 100644 index 79b0dac9fd..0000000000 --- a/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Installing Applications on a Windows Virtual PC Image -description: Installing Applications on a Windows Virtual PC Image -author: dansimp -ms.assetid: 32651eff-e3c6-4ef4-947d-2beddc695eac -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Installing Applications on a Windows Virtual PC Image - - -After you have created a Windows Virtual PC image for use with Microsoft Enterprise Desktop Virtualization (MED-V) 2.0, you can install other components that are helpful when running MED-V, such as an electronic software distribution (ESD) system and antivirus software. - -The following section provides information to help you install software on the MED-V image. - -**Caution**   -For ease of MED-V workspace management after deployment, we recommend that you limit the number of components that you install on the MED-V image to those components that are required or that are helpful when using MED-V. For example, although they are not required to run MED-V, you can install an ESD system to use later for installing applications to a MED-V workspace and antivirus software for security on the image. - - - -**Installing Software on a MED-V Image** - -1. If it is not currently running, open your MED-V virtual machine. - - 1. Click **Start**, click **All Programs**, click **Windows Virtual PC** and then click **Windows Virtual PC**. - - 2. Double-click your MED-V virtual machine. - -2. From inside the virtual machine operating system, locate the installation files for the software that you want to install. - -3. Follow the installation instructions that are provided by the software vendor. - - **Note**   - After installation is complete, you might have to close and then restart the virtual machine. - - - -Repeat these steps for any software or application that you want to install on the MED-V image. We recommend that you limit the number of applications that you preinstall on the image. The recommended process for installing applications and other software on the image is to preinstall an ESD system now and to use it later to deploy software to the image. Alternately, you can also use Group Policy or App-V to add or remove applications on a MED-V workspace. For more information, see [Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md). - -For more information about how to install software on a virtual image, see the following articles: - -- [Publish and Use Virtual Applications](https://go.microsoft.com/fwlink/?LinkId=195926) (https://go.microsoft.com/fwlink/?LinkId=195926). - -- [Windows Virtual PC Help](https://go.microsoft.com/fwlink/?LinkId=182378) (https://go.microsoft.com/fwlink/?LinkId=182378). - -After you have installed all of the software that you want on the MED-V image, your image is ready to be packaged. - -## Related topics - - -[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) - -[Prepare a MED-V Image](prepare-a-med-v-image.md) - - - - - - - - - diff --git a/mdop/medv-v2/manage-med-v-url-redirection.md b/mdop/medv-v2/manage-med-v-url-redirection.md deleted file mode 100644 index e96d3304dc..0000000000 --- a/mdop/medv-v2/manage-med-v-url-redirection.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Manage MED-V URL Redirection -description: Manage MED-V URL Redirection -author: dansimp -ms.assetid: 274161c0-b54a-4364-bb63-89996afccd04 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage MED-V URL Redirection - - -After you deploy your MED-V workspace, you can select from different methods to add or remove URL redirection information in the MED-V workspaces. - -Included in this section are both information and instructions to help you manage URL redirection information on assigned MED-V workspaces. - -## In This Section - - -[How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace](how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md) -Provides assistance in adding and removing URL redirection information on MED-V workspaces. - -[How to Manage URL Redirection by Using the MED-V Workspace Packager](how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md) -Provides assistance in managing URL redirection information through the MED-V Workspace Packager. - -## Related topics - - -[How to Test URL Redirection](how-to-test-url-redirection.md) - -[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) - -[Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/manage-med-v-workspace-applications.md b/mdop/medv-v2/manage-med-v-workspace-applications.md deleted file mode 100644 index 99114c8379..0000000000 --- a/mdop/medv-v2/manage-med-v-workspace-applications.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Manage MED-V Workspace Applications -description: Manage MED-V Workspace Applications -author: dansimp -ms.assetid: f58c7504-a77a-41a8-ac38-7e618da131fb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage MED-V Workspace Applications - - -This section provides information about how to manage MED-V workspace applications. - -## In This Section - - -[Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md) -Describes how to install and remove applications on the VHD and how to publish existing applications. - -[Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md) -Describes how to manage software updates for MED-V workspaces. - -[Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md) -Describes how to manage automatic software updates for MED-V workspaces. - -## Related topics - - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/manage-med-v-workspace-settings.md b/mdop/medv-v2/manage-med-v-workspace-settings.md deleted file mode 100644 index 4710c68f25..0000000000 --- a/mdop/medv-v2/manage-med-v-workspace-settings.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Manage MED-V Workspace Settings -description: Manage MED-V Workspace Settings -author: dansimp -ms.assetid: 35ebd16e-31c7-4996-81be-af1d56346803 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage MED-V Workspace Settings - - -The information provided here can help administrators manage MED-V workspace settings. - -## In This Section - - -[Managing MED-V Workspace Settings by Using the MED-V Workspace Packager](managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md) -Describes how to use the MED-V Workspace Packager to manage certain MED-V workspace settings. - -[Managing MED-V Workspace Settings by Using a WMI](managing-med-v-workspace-settings-by-using-a-wmi.md) -Describes how to use Windows Management Instrumentation to manage MED-V workspace settings. - -[Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) -Describes how to manage MED-V workspace configuration settings. - -[Managing Printers on a MED-V Workspace](managing-printers-on-a-med-v-workspace.md) -Describes how MED-V manages printer redirection in a MED-V workspace. - -## Related topics - - -[Monitor MED-V Workspaces](monitor-med-v-workspaces.md) - -[Operations for MED-V](operations-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md b/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md deleted file mode 100644 index 4b652b29fc..0000000000 --- a/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Managing Applications Deployed to MED-V Workspaces -description: Managing Applications Deployed to MED-V Workspaces -author: dansimp -ms.assetid: 9a9bcdf5-0aa7-42a3-b6f0-6065adb01bcb -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing Applications Deployed to MED-V Workspaces - - -After you deploy your MED-V workspace, you have several different methods to select from to install, remove, publish, and unpublish applications on the MED-V workspaces. - -This section provides information and instructions to help you manage applications after you have deployed the MED-V workspace. - -## In This Section - - -[Installing and Removing an Application on the MED-V Workspace](installing-and-removing-an-application-on-the-med-v-workspace.md) -Provides assistance in installing and removing applications on MED-V workspaces. - -[How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) -Provides assistance in publishing and unpublishing applications on MED-V workspaces. - -## Related topics - - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md b/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md deleted file mode 100644 index 9cd51b0d7b..0000000000 --- a/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Managing Automatic Updates for MED-V Workspaces -description: Managing Automatic Updates for MED-V Workspaces -author: dansimp -ms.assetid: 306f28a2-d653-480d-b737-4b8b3132de5d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing Automatic Updates for MED-V Workspaces - - -The MED-V workspace is a virtual machine that contains a separate operating system, whose automatic software update process must be managed just like the physical computers in your enterprise. Because the guest operating system is not always necessarily running when the host operating system is running, you must ensure that the MED-V virtual machine is configured in such a way that software updates can be applied to the guest operating system as required. The Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 solution provides the functionality that lets you determine how automatic software updates are processed in a MED-V workspace. - -## Managing MED-V Workspace Wake-Up Policy - - -The MED-V workspace wake-up policy guarantees that the MED-V virtual machine is made available for updates for the time that you specify in your MED-V configuration settings. This applies to both updates that are published from Microsoft through Windows Update and updates deployed and controlled by non-Microsoft solutions, such as antivirus applications. - -**Important**   -The MED-V workspace wake-up policy is optimized for the Microsoft Update infrastructure. If you are using Microsoft System Center Configuration Manager to deploy non-Microsoft updates, we recommend that you also use the System Center Updates Publisher, which takes advantage of the same infrastructure as Microsoft Update and therefore benefits from the MED-V workspace wake-up policy. For more information, see [System Center Updates Publisher](https://go.microsoft.com/fwlink/?LinkId=200035) (https://go.microsoft.com/fwlink/?LinkId=200035). - - - -When you created your MED-V workspace package, you configured when and how it starts, either when the end user logs on (**Fast Start**) or when the end user first opens a published application (**Normal Start**). Or you set the option to let the end user control this setting. - -Either way, whenever the **Fast Start** option is selected, the virtual machine continues to run as long as the MED-V host is logged on as User. In this configuration, because MED-V is active when the host is active, automatic updates are applied without requiring any extra processing from MED-V. - -However, for those cases in which **Fast Start** is not specified or the virtual machine hibernates or stops, MED-V guarantees through its MED-V workspace wake-up policy that the guest operating system is being regularly updated even when MED-V is not used regularly. MED-V performs this function by regularly waking up the virtual machine based on the configuration settings that you specify. This enables the automatic update clients in the virtual machine to execute based on their configurations. After the time period defined by the MED-V configuration setting elapses, MED-V returns the virtual machine to its previous state. - -**Note**   -If the end user opens a published application during the update period, the required updates are applied, but MED-V is not automatically hibernated or shut down after the update period ends. Instead, MED-V continues running. - - - -The MED-V workspace wake-up policy includes three main components: - -**Guest Update Manager** - -Residing on the MED-V host, this stand-alone executable program is responsible for waking up the virtual machine according to a predefined, configurable schedule. Specify the configuration settings to indicate at what time the update manager should wake up the virtual machine every day, and how long the virtual machine should be kept awake (in minutes) to allow for updates to be applied. After the number of minutes specified has been reached, the guest update manager puts the virtual machine into hibernation, prepared for the next use. You can schedule the execution of this executable program through the Windows Task Manager. - -**Guest Restart Management Service** - -Residing on the MED-V host, this service has three primary responsibilities. Along with the Guest Update Manager, it manages the restart of the virtual machine at user logon, if it is required. It detects when virtual machine restarts are required caused by updates being installed. And it ensures that the task for the Guest Update Manager is always scheduled according to configuration. - -**Guest Update Service** - -Residing on the MED-V virtual machine, this Windows service has the responsibility of monitoring when installed updates require a restart. After the service becomes aware of the need for a restart, it notifies the guest restart management service on the host. - -### Configuration Settings for MED-V Workspace Wake-Up Policy - -You control when and for how long the virtual machine awakens to receive automatic updates by defining the following two configuration values in the registry. Both of these values are located under the HKLM\\Software\\Microsoft\\MEDV\\v2\\VM key. - -**GuestUpdateTime** – Configures the hour and minute each day when MED-V must wake up the virtual machine for updating, based on the 24-hour clock standard. Specify the time in the format HH:MM. The default value is 00:00 (midnight). - -**GuestUpdateDuration** – Configures the number of minutes that MED-V must keep the virtual machine awake for updating, starting at the time specified in the GuestUpdateTime configuration setting. The default value is 240 (4 hours). Setting this value to zero (0) disables the MED-V workspace wake-up policy. - -For more information about how to define your MED-V configuration values, see [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md). - -**Note**   -A MED-V best practice is to set your wake up interval to match the time when MED-V virtual machines are planned to be updated regularly. In addition, we recommend that you configure these settings to resemble the host computer’s behavior. - - - -### Reboot Notification Using your ESD System - -You can configure your ESD system to notify MED-V whenever a restart is required for the MED-V workspace after automatic updates have been applied. When you apply automatic updates through your ESD system that you know require a restart, you should write a script to signal the following global event on the MED-V workspace: - -**Important**   -You must open the event with Modify Only rights and then signal it. If you do not open it with the correct permissions, it does not work. - - - -``` syntax -///

    -/// The guest is required to be restarted due to an ESD update. -/// -public const string MedvGuestRebootRequiredEventName = @"Global\MedvGuestRebootRequiredEvent"; -using (EventWaitHandle notificationEvent = -EventWaitHandle.OpenExisting(eventName, EventWaitHandleRights.Modify)) -{ -notificationEvent.Set(); -} -``` - -When you signal this event, MED-V captures it and informs the virtual machine that a restart is required. - -## Related topics - - -[Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md b/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md deleted file mode 100644 index fb482d47b6..0000000000 --- a/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md +++ /dev/null @@ -1,779 +0,0 @@ ---- -title: Managing MED-V Workspace Configuration Settings -description: Managing MED-V Workspace Configuration Settings -author: dansimp -ms.assetid: 517d04de-c31f-4b50-b2b3-5f8c312ed37b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing MED-V Workspace Configuration Settings - - -Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 stores its configuration settings in the registry. The information we include here about the registry may help you better manage your MED-V services. - -MED-V uses the following search path when looking for the resultant settings values: - -MED-V first looks in the machine policy. - -If the value is not found, MED-V looks in the user policy. - -If the value is not found, MED-V looks in the HKEY\_LOCAL\_MACHINE\\System hive. - -If the value is not found, MED-V looks in the HKEY\_CURRENT USER registry hive. - -If the value is still not found, MED-V uses the default. - -A general best practice is to set the value in the HKEY\_LOCAL\_MACHINE\\System hive or in the machine policy. But if you want the end user to be able to configure a particular setting, then you should leave it out. - -**Note** -Before you deploy your MED-V workspaces, you can use a script editor to change the Windows PowerShell script (.ps1 file) that the MED-V workspace packager created. For more information, see [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md). - -After you have deployed your MED-V workspaces, you can change certain MED-V configuration settings by editing the registry entries. - - - -This section lists all the configurable MED-V registry keys and explains their uses. - -## Diagnostics Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\Diagnostics key. - - ------ - - - - - - - - - - - - - - - - -
    Name Type Data/Default Description

    EventLogLevel

    DWORD

    Default=3

    The type of information that is logged in the event log. Levels include the following: 0 (None), 1 (Error), 2 (Warning), 3 (Information), 4 (Debug).

    - - - -## Fts Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\Fts key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeData/DefaultDescription

    AddUserToAdminGroupEnabled

    DWORD

    Default=0

    Configures whether first time setup automatically adds the end user to the administrator's group. 0 = false; 1 = true.

    0 = false: First time setup does not automatically add the end user to the administrator's group.

    1 = true: First time setup automatically adds the end user to the administrator's group.

    ComputerNameMask

    SZ

    MEDV*

    The computer name mask that is used to create the guest virtual machine's computer name.

    The mask can contain a %username% tag to insert the username as part of the computer name. Likewise, the %hostname% tag inserts the name of the host computer.

    -

    Every "#" character in the mask is replaced by a random digit. An asterisk (*) character at the end of the mask is replaced by random alphanumeric characters.

    -

    A specific number of characters from %hostname% and %username% can be captured by using square brackets. For example, "%username%[3]" would use the first three characters of the username.

    DeleteVMStateTimeout

    DWORD

    Default=90

    The time-out value, in seconds, when first time setup tries to delete the virtual machine. Range = 0 to 2147483647.

    DetachVfdTimeout

    DWORD

    Default=120

    The time-out value, in seconds, when first time setup tries to detach the virtual floppy disk from the virtual machine. Range = 0 to 2147483647.

    DialogUrl

    SZ

    Customizable URL that links to internal webpage and is displayed by first time setup dialog messages.

    ExplorerTimeout

    DWORD

    Default=900

    The time-out value, in seconds, that first time setup waits for Windows Explorer. Range = 0 to 2147483647.

    FailureDialogMsg

    MULTI_SZ

    Message is found in resource file

    Customizable message that is displayed to the end user when first time setup cannot be completed.

    GiveUserGroupRightsMaxRetryCount

    DWORD

    Default=3

    The maximum number of times that MED-V tries to give an end user group rights. Exceeding the specified retry value without being able to successfully give an end user group rights most likely causes a virtual machine preparation failure that is then subject to the MaxRetryCount value. Range = 0 to 2147483647.

    GiveUserGroupRightsTimeout

    DWORD

    Default=300

    The time-out value, in seconds, when giving a user group rights. Range = 0 to 2147483647.

    LogFilePaths

    MULTI_SZ

    A list of the log file paths that MED-V collects during first time setup.

    MaxPostponeTime

    DWORD

    Default=120

    The maximum number of hours that first time setup can be postponed by the end user. Range = 0 to 2147483647.

    MaxRetryCount

    DWORD

    Default=3

    The maximum number of times that MED-V tries to prepare a virtual machine if each attempt ends in a failure other than a software error. When virtual machine preparation fails and the number of first time setup retries is exceeded, then MED-V informs the end user about the failure and does not give the option to retry. The count is re-set every time that MED-V is started. Range = 0 to 2147483647.

    Mode

    SZ

    Default=Unattended

    Configures how first time setup interacts with the user. Possible values are as follows:

    Attended. The end user must enter information during first time setup.

    -
    -Note

    If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, then you must select Attended mode or problems might occur during first time setup.

    -
    -
    - -

    Unattended. The virtual machine is not shown to the end user during first time setup, but the end user is prompted before first time setup starts.

    Silent. The virtual machine is not shown to the end user at all during first time setup.

    NonInteractiveRetryTimeoutInc

    DWORD

    Default=15

    The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode when re-attempting setup. Range = 0 to 2147483647.

    NonInteractiveTimeout

    DWORD

    Default=45

    The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode. Range = 0 to 2147483647.

    PostponeUtcDateTimeLimit

    SZ

    The date and time, in UTC DateTime format, that first time setup can be postponed. Enter in the format "yyyy-MM-dd hh:mm" with hours specified by using the 24-hour clock standard.

    RetryDialogMsg

    MULTI_SZ

    Message is found in resource file

    Customizable message that is displayed to the end user when first time setup must re-attempt setup.

    SetComputerNameEnabled

    DWORD

    Default=0

    Configures whether the ComputerName entry under the [UserData] section of the Sysprep.inf file in the guest should be updated according to the specified ComputerNameMask. 0 = false; 1 = true.

    0 = false: The ComputerName entry in the Sysprep.inf file is not updated according to the ComputerNameMask.

    1 = true: The ComputerName entry in the Sysprep.inf file is updated according to the ComputerNameMask.

    SetJoinDomainEnabled

    DWORD

    Default=0

    Configures whether the JoinDomain setting under the [Identification] section of the Sysprep.inf file in the guest should be updated to match the settings on the host. 0 = false; 1 = true.

    0 = false: The JoinDomain setting in the Sysprep.inf file is not updated to match the settings on the host.

    1 = true: The JoinDomain setting in the Sysprep.inf file is updated to match the settings on the host.

    SetMachineObjectOUEnabled

    DWORD

    Default=0

    Configures whether the MachineObjectOU setting under the [Identification] section of the Sysprep.inf file in the guest is updated to match the host. 0 = false; 1 = true.

    0 = false: The MachineObjectOU setting in the Sysprep.inf file is not updated to match the settings on the host.

    1 = true: The MachineObjectOU setting in the Sysprep.inf file is updated to match the settings on the host.

    SetRegionalSettingsEnabled

    DWORD

    Default=0

    Configures whether the settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host. 0 = false; 1 = true.

    -
    -Note

    By default, the setting for TimeZone in the guest is always synchronized with the TimeZone setting in the host.

    -
    -
    - -

    0 = false: The settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are not updated to match the host.

    1 = true: The settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host.

    SetUserDataEnabled

    DWORD

    Default=0

    Configures whether the FullName and the OrgName settings under the [UserData] section of the Sysprep.inf file in the guest are updated to match the settings on the host. 0 = false; 1 = true.

    0 = false: The FullName and OrgName settings in the Sysprep.inf file are not updated to match the settings on the host.

    1 = true: The FullName and OrgName settings in the Sysprep.inf file are updated to match the settings on the host.

    StartDialogMsg

    MULTI_SZ

    Message is found in resource file

    Customizable message that is displayed to the end user when first time setup is ready to start.

    TaskCancelTimeout

    DWORD

    Default=30

    The time-out value, in seconds, that first time setup waits for a response from the virtual machine for a Cancel operation. Range = 0 to 2147483647.

    TaskVMTurnOffTimeout

    DWORD

    Default=60

    The time-out value, in seconds, that first time setup waits for the virtual machine to shut down. Range = 0 to 2147483647.

    UpgradeTimeout

    DWORD

    Default=600

    The time, in seconds, before an attempted upgrade of the MED-V Guest Agent software times out. Range = 0 to 2147483647.

    - - - -## UserExperience Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\UserExperience key and the HKEY\_CURRENT\_USER\\Software\\Microsoft\\Medv\\v2\\UserExperience key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeData/DefaultDescription

    AppPublishingEnabled

    DWORD

    Default=1

    Configures whether application publication from the guest to the host is enabled. 0 = false; 1 = true.

    0 = false: Disables application publishing from the guest to the host.

    1 = true: Enables application publishing from the guest to the host.

    AudioSharingEnabled

    DWORD

    Default=1

    Configures whether the sharing of the audio I/O device between the guest and the host is enabled. 0 = false; 1 = true.

    0 = false: Disables the sharing of the audio I/O device between the guest and the host.

    1 = true: Enables the sharing of the audio I/O device between the guest and the host.

    ClipboardSharingEnabled

    DWORD

    Default=1

    Configures whether the sharing of the Clipboard between the guest and the host is enabled. 0 = false; 1 = true.

    0 = false: Disables the sharing of the Clipboard between the guest and the host.

    1 = true: Enables the sharing of the Clipboard between the guest and the host.

    DialogTimeout

    DWORD

    Default=300

    The time, in seconds, before the first time setup Start Dialog times out. Range = 0 to 2147483647.

    HideVmTimeout

    DWORD

    Default=30

    The time-out value, in minutes, that the full-screen virtual machine window is hidden from the end user during a long logon attempt.

    LogonStartEnabled

    DWORD

    Default=1

    Configures whether the guest should be started when the end user logs on to the desktop or when the first guest application is started. 0 = false; 1 = true.

    0 = false: The guest is started when the first guest application is started.

    1 = true: The guest is started when the end user logs on to the desktop.

    PrinterSharingEnabled

    DWORD

    Default=1

    Configures whether the sharing of printers between the guest and the host is enabled. 0 = false; 1 = true.

    0 = false: Disables the sharing of printers between the guest and the host.

    1 = true: Enables the sharing of printers between the guest and the host.

    RebootAbsoluteDelayTimeout

    DWORD

    Default=1440

    The time-out value, in minutes, that first time setup waits for a restart. Range = 0 to 2147483647.

    RedirectUrls

    MULTI_SZ

    Specified URL list

    Specifies a list of URLs to be redirected from the host to the guest.

    SmartCardLogonEnabled

    DWORD

    Default=0

    Configures whether smart cards can be used to authenticate users to MED-V. 0 = false; 1 = true.

    0 = false: Does not let Smart Cards authenticate end users to MED-V.

    1 = true: Lets Smart Cards authenticate end users to MED-V.

    -
    -Important

    If SmartCardLogonEnabled and CredentialCacheEnabled are both enabled, SmartCardLogonEnabled overrides CredentialCacheEnabled.

    -
    -
    - -

    SmartCardSharingEnabled

    DWORD

    Default=1

    Configures whether the sharing of Smart Cards between the guest and the host is enabled. 0 = false; 1 = true.

    0 = false: Disables the sharing of Smart Cards between the guest and the host.

    1 = true: Enables the sharing of Smart Cards between the guest and the host.

    USBDeviceSharingEnabled

    DWORD

    Default=1

    Configures whether the sharing of USB devices between the guest and the host is enabled. 0 = false; 1 = true.

    0 = false: Disables the sharing of USB devices between the guest and the host.

    1 = true: Enables the sharing of USB devices between the guest and the host.

    - - - -## VM Key - - -The following table provides information about the registry values associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\VM key and the HKEY\_CURRENT\_USER\\Software\\Microsoft\\Medv\\v2\\VM key. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    NameTypeData/DefaultDescription

    CloseAction

    SZ

    Default=HIBERNATE

    The action that the virtual machine performs after the last application that is running is closed. This setting is ignored if the LogonStartEnabled value is enabled. Possible options are as follows:

    HIBERNATE . This option releases all physical resources that the virtual machine is using, such as memory and CPU, and saves the state of all running applications and operations.

    SHUTDOWN . This option shuts down the guest operating system safely and then releases all physical resources that the virtual machine is using, such as memory and CPU.

    TURN-OFF. This option can cause data loss because it is the same as turning off the power button or pulling out the power cord on a physical computer. Use this option only if you cannot use one of the other two options.

    GuestMemFromHostMem

    MULTI_SZ

    378, 512, 1024, 1536, 2048

    A list of memory (MB) values for the guest. This value is used to determine how much RAM is available to the guest. Combined with HostMemToGuestMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 128 to 3712.

    GuestUpdateDuration

    DWORD

    Default=240

    The number of minutes that MED-V should keep the guest awake for automatic updating, starting at the time specified in the GuestUpdateTime value. Range = 0 to 1440. Setting this value to zero (0) disables the guest patching functionality.

    -

    For more information about guest patching for automatic updating, see Managing Automatic Updates for MED-V Workspaces.

    GuestUpdateTime

    SZ

    Default=00:00

    The hour and minute each day when MED-V should wake up the guest for automatic updating, by using the 24-hour clock standard. Specify the time in the format HH:MM

    -

    For more information about guest patching for automatic updating, see Managing Automatic Updates for MED-V Workspaces.

    HostMemToGuestMem

    MULTI_SZ

    1024, 2048, 4096, 8192, 16384

    A list of memory (MB) values for the guest, determined by the RAM available on the host. Combined with GuestMemFromHostMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 1024 to 16384.

    HostMemToGuestMemCalcEnabled

    DWORD

    Default=1

    Configures whether the memory allocated for the guest is calculated from the memory present on the host. 0 = false; 1 = true.

    0 = false: The memory allocated for the guest is not calculated from the memory present on the host.

    1 = true: The memory allocated for the guest is calculated from the memory present on the host.

    Memory

    DWORD

    Default=512

    The RAM (MB) that should be allocated for the guest virtual machine. This setting is ignored if the HostMemToGuestMemEnabled setting is enabled. Range=128 to 2048.

    MultiUserEnabled

    DWORD

    Default=0

    Configures whether multiple users share the same MED-V workspace. 0 = false; 1 = true.

    0 = false: Multiple users do not share the same MED-V workspace.

    1 = true: Multiple users share the same MED-V workspace.

    NetworkingMode

    SZ

    Default=NAT

    The kind of network connection used on the guest. Possible values are as follows:

    Bridged. MED-V has its own network address, typically obtained through DHCP.

    NAT. MED-V uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.

    TaskTimeout

    DWORD

    Default=600

    A general time-out value, in seconds, that MED-V waits for a task to be completed, such as restarting and shutting down. Range = 0 to 2147483647.

    - - - -## Guest Registry Settings - - -This section lists the configurable MED-V guest registry keys and explains their uses. - -### v2 - -The following table provides information about the guest registry value associated with the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv\\v2\\ key. - - ------ - - - - - - - - - - - - - - - - - - - - - - -
    Name Type Data/Default Description

    EnableGPWorkarounds

    DWORD

    Default=1

    Configures how MED-V handles the keys BufferPolicyReads and GroupPolicyMinTransferRate.

    By default, MED-V sets these keys as follows:

    -

    BufferPolicyReads=1 and GroupPolicyMinTransferRate=0.

    -

    Create the EnableGPWorkarounds key, if it is necessary, and set the key to zero if you do not want MED-V to change the default settings of BufferPolicyReads and GroupPolicyMinTransferRate.

    -
    -Note

    If your MED-V workspace is running in NAT mode, EnableGPWorkarounds affects the registry keys BufferPolicyReads and GroupPolicyMinTransferRate. If your MED-V workspace is running in BRIDGED mode, EnableGPWorkarounds only affects the registry key BufferPolicyReads.

    -
    -
    - -
    -

    1=true: MED-V sets the keys BufferPolicyReads=1 and GroupPolicyMinTransferRate=0 (if running in NAT mode) or just BufferPolicyReads=1 (if running in BRIDGED mode).

    -

    0=false: MED-V does not make any changes to the keys BufferPolicyReads and GroupPolicyMinTransferRate.

    - - - -## Related topics - - -[Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) - -[Manage MED-V URL Redirection](manage-med-v-url-redirection.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md deleted file mode 100644 index b27daa2e6f..0000000000 --- a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md +++ /dev/null @@ -1,145 +0,0 @@ ---- -title: Managing MED-V Workspace Settings by Using a WMI -description: Managing MED-V Workspace Settings by Using a WMI -author: dansimp -ms.assetid: 05a665a3-2309-46c1-babb-a3e3bbb0b1f9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing MED-V Workspace Settings by Using a WMI - - -You can use Windows Management Instrumentation (WMI) in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 to manage your current configuration settings. - -## To manage MED-V workspace settings with a WMI - - -A WMI browsing tool lets you view and edit the settings in a MED-V workspace. The WMI provider is implemented by using the WMI Provider Extension framework from the Microsoft .Net Framework 3.5. - -The WMI provider is implemented in the **root\\microsoft\\medv** namespace and implements the class **Setting**. The class **Setting** contains properties that correspond to the settings in the system registry under the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Medv registry key. - -**Caution**   -WMI browsing tools can be used to delete or modify classes and instances. Deleting or modifying certain classes and instances can result in the loss of valuable data and cause MED-V to function unpredictably. - - - -You can use your preferred WMI browsing tool to view and edit MED-V configuration settings by following these steps. - -1. Open your preferred WMI browsing tool with administrator permissions. - -2. Connect to the namespace **root\\microsoft\\medv**. - -3. Enumerate the instances to connect to the running instance. You want to connect to the instance of the class **Setting**. - - An **Object Editor** window opens. The MED-V configuration settings are listed as **Properties**. - -Perform the following steps to edit a MED-V configuration setting in the WMI. - -1. In the list of **Properties** on the **Object Editor** window, double-click the name of the configuration setting you want to edit. For example, to edit MED-V URL redirection information, double-click the property **UxRedirectUrls**. - - A **Property Editor** window opens. - -2. Edit the value to update the configuration information. For example, to edit MED-V URL redirection information, add or remove a web address in the list. - -3. Save the updated property settings. - -After you have finished viewing or editing MED-V configuration settings, close the WMI browsing tool. - -**Important**   -In some cases, a restart of the MED-V workspace is required for changes to MED-V configuration settings to take effect. - - - -The following code shows the Managed Object Format (MOF) file that defines the **Setting** class. - -``` syntax -[dynamic: ToInstance, provider("TroubleShooting, Version=2.0.392.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"), singleton: DisableOverride ToInstance ToSubClass] -class Setting : ConfigValueProvider -{ - boolean UxSmartCardLogonEnabled = TRUE; - [read] string User; - [implemented] void Clear([in] string propertyName); -}; -``` - -The **Setting** class inherits from the **ConfigValueProvider** class. The following code shows the Managed Object Format (MOF) file that defines the **ConfigValueProvider** class. - -``` syntax -[abstract] -class ConfigValueProvider -{ - [write] string DiagEventLogLevel; - [write] boolean FtsAddUserToAdminGroupEnabled; - [write] string FtsComputerNameMask; - [write] sint32 FtsDeleteVMStateTimeout; - [write] sint32 FtsDetachVfdTimeout; - [write] string FtsDialogUrl; - [write] sint32 FtsExplorerTimeout; - [write] string FtsFailureDialogMsg; - [write] string FtsLogFilePaths[]; - [write] sint32 FtsMaxPostponeTime; - [write] sint32 FtsMaxRetryCount; - [write] string FtsMode; - [write] sint32 FtsNonInteractiveRetryTimeoutInc; - [write] sint32 FtsNonInteractiveTimeout; - [write] string FtsPostponeUtcDateTimeLimit; - [write] string FtsRetryDialogMsg; - [write] boolean FtsSetComputerNameEnabled; - [write] boolean FtsSetJoinDomainEnabled; - [write] boolean FtsSetMachineObjectOUEnabled; - [write] boolean FtsSetRegionalSettingsEnabled; - [write] boolean FtsSetUserDataEnabled; - [write] string FtsStartDialogMsg; - [write] sint32 FtsTaskCancelTimeout; - [write] sint32 FtsTaskVMTurnOffTimeout; - [write] sint32 FtsUpgradeTimeout; - [write] boolean UxAppPublishingEnabled; - [write] boolean UxAudioSharingEnabled; - [write] boolean UxClipboardSharingEnabled; - [write] boolean UxCredentialCacheEnabled; - [write] sint32 UxDialogTimeout; - [write] sint32 UxHideVmTimeout; - [write] boolean UxLogonStartEnabled; - [write] boolean UxPrinterSharingEnabled; - [write] sint32 UxRebootAbsoluteDelayTimeout; - [write] string UxRedirectUrls[]; - [write] boolean UxShowExit; - [write] boolean UxSmartCardLogonEnabled; - [write] boolean UxSmartCardSharingEnabled; - [write] boolean UxUSBDeviceSharingEnabled; - [write] string VmCloseAction; - [write] sint32 VmGuestMemFromHostMem[]; - [write] sint32 VmGuestUpdateDuration; - [write] string VmGuestUpdateTime; - [write] sint32 VmHostMemToGuestMem[]; - [write] boolean VmHostMemToGuestMemCalcEnabled; - [write] sint32 VmMemory; - [write] boolean VmMultiUserEnabled; - [write] string VmNetworkingMode; - [write] sint32 VmTaskTimeout; -}; -``` - -## Related topics - - -[Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md deleted file mode 100644 index 335fa404ed..0000000000 --- a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Managing MED-V Workspace Settings by Using the MED-V Workspace Packager -description: Managing MED-V Workspace Settings by Using the MED-V Workspace Packager -author: dansimp -ms.assetid: e4b2c516-b9f8-44f9-9eae-caac6c2af3e7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing MED-V Workspace Settings by Using the MED-V Workspace Packager - - -You can use the MED-V Workspace Packager to manage certain settings in the MED-V workspace. - -**To manage settings in a MED-V workspace** - -1. To open the **MED-V Workspace Packager**, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager**. - -2. On the **MED-V Workspace Packager** main panel, click **Manage Settings**. - -3. In the **Manage Settings** window, you can configure the following MED-V workspace settings: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Start MED-V workspace

    Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts.

    The MED-V workspace starts in one of two ways: either when the end user logs on or when they first perform an action that requires MED-V, such as opening a published application or entering a URL that requires redirection.

    -

    You can either define this setting for the end user or let the end user control how MED-V starts.

    -
    - Note

    If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change the way in which MED-V starts.

    -
    -
    - -

    Networking

    Select Shared or Bridged for your networking setting. The default is Shared.

    Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.

    -

    Bridged - The MED-V workspace has its own network address, typically obtained through DHCP.

    Store credentials

    Choose whether you want to store the end user credentials.

    The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on.

    -
    - Important

    Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved.

    -

    The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. An attacker could write a program that retrieves the password and thus gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end user credentials.

    -
    -
    - -
    - - - -4. Click **Save as…** to save the updated configuration settings in the specified folder. MED-V creates a registry file that contains the updated settings. Deploy the updated registry file by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931). - - MED-V also creates a Windows PowerShell script in the specified folder that you can use to re-create this updated registry file. - -## Related topics - - -[Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md) - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md b/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md deleted file mode 100644 index 16d9be517a..0000000000 --- a/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Managing Printers on a MED-V Workspace -description: Managing Printers on a MED-V Workspace -author: dansimp -ms.assetid: ba0a65ad-444f-4d18-95eb-8b9fa1a3ffba -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing Printers on a MED-V Workspace - - -In Microsoft Enterprise Desktop Virtualization (MED-V) 2.0, printer redirection provides end users with a consistent printing experience between the MED-V virtual machine and the host computer. - -This topic provides information about how to manage printing in a MED-V workspace. - -## Managing Printers in MED-V Workspaces - - -In most cases, MED-V handles printer redirection automatically. After first time setup finishes, MED-V identifies all network printers installed on the host, retrieves the corresponding drivers from the network print server, and if found, installs the relevant drivers in the MED-V workspace. After all drivers are found and installed, MED-V reboots the MED-V workspace. Only after the MED-V workspace restarts, the host printers are present and available on the guest, typically in a few minutes. - -**Note**   -If applications are running on the MED-V workspace, the end user is prompted to let the restart continue or postpone it until later. If no applications are running, the restart is automatic and not shown to the end user. - - - -Every time MED-V is re-started, it checks whether any new printers are installed on the host and, if found, retrieves the corresponding drivers from the network print server and installs them on the guest. MED-V then restarts the MED-V workspace just as when first time setup was completed. - -**Important**   -After the relevant drivers are installed on the guest, the printers only become visible on the guest after the restart occurs. - - - -If at any time a driver cannot be located or installed, it must be manually installed on the guest for the network printer to be available to the end user. - -The following list offers some additional guidance: - -**MED-V only manages network printers**. Drivers for printers that are installed locally on the host are not automatically installed on the guest. - -**MED-V only installs printer drivers if found on the print server**. If not found, printer drivers must be manually installed. - -**Printers manually installed on the guest are not accessible to the host**. By default, MED-V only supports printer redirection from the guest to the host. - -**Warning**   -If a printer is manually installed on the guest, and the same printer is later installed on the host, the result is that the printer is installed two times in the guest. To avoid this situation, a MED-V best practice is to manage printer redirection in one manner only: either disable redirection and install printers manually on the guest, or enable redirection and do not install printers manually on the guest. - - - -## Related topics - - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - - - - - - - - - diff --git a/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md b/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md deleted file mode 100644 index adef226385..0000000000 --- a/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Managing Software Updates for MED-V Workspaces -description: Managing Software Updates for MED-V Workspaces -author: dansimp -ms.assetid: a28d6dcd-cb9f-46ba-8dac-1d990837a3a3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing Software Updates for MED-V Workspaces - - -You have several different options available to you for providing software updates for the applications in the deployed MED-V workspace. - -**Note**   -For information about how to specify the configuration settings that define how MED-V receives automatic updates, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md). - - - -**Updating Software in a MED-V Workspace** - -1. **Using an Electronic Software Distribution System** - - If your organization uses an Electronic Software Distribution System (ESD) system to deploy software, you can use it to provide software updates for applications on MED-V workspaces just as you provide updates for applications on physical computers. - -2. **Using Group Policy** - - If your organization deploys software by using Group Policy, you can use it to provide software updates for applications on MED-V workspaces just as you provide updates for applications on physical computers. - -3. **Using Application Virtualization (APP-V)** - - If you use MED-V together with App-V, you can provide software updates to applications in the MED-V workspace by following the steps that are required by App-V for updating software. For more information, see [Application Virtualization](https://go.microsoft.com/fwlink/?LinkId=122939) (https://go.microsoft.com/fwlink/?LinkId=122939). - -4. **Updating Software in the Core Image** - - Although not considered a MED-V best practice, you can install software updates to applications on the core image. After you have installed the updates, you can then redeploy the MED-V workspace back out to your enterprise just as you deployed it originally. - - **Important**   - We do not recommend this method of managing software updates. In addition, if you update software in the core image and redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved in the virtual machine is lost. - - - -## Related topics - - -[Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md) - -[How to Test Application Publishing](how-to-test-application-publishing.md) - -[How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) - - - - - - - - - diff --git a/mdop/medv-v2/med-v-20-best-practices.md b/mdop/medv-v2/med-v-20-best-practices.md deleted file mode 100644 index f9b4db8492..0000000000 --- a/mdop/medv-v2/med-v-20-best-practices.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -title: MED-V 2.0 Best Practices -description: MED-V 2.0 Best Practices -author: dansimp -ms.assetid: 47ba2dd1-6c6e-4d6e-8e18-b42291f8e02a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 2.0 Best Practices - - -When you are planning, deploying, and managing MED-V in your enterprise, you may find the best practice recommendations to be useful. - -### Configure first time setup to run unattended - -Although you can specify any settings that you prefer, a MED-V best practice is that you create the Sysprep.inf file so that first time setup can be run in **Unattended** mode. This requires you to provide all the required settings information as you continue through the **Setup Manager** wizard. For more information about how to configure the MED-V image, see [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md). - -### Disable restore points on the virtual machine - -Before you create the MED-V workspace package, we recommend that you disable restore points on the virtual machine to prevent the differencing disk from growing unbounded. For more information, see [How to turn off and turn on System Restore in Windows XP](https://go.microsoft.com/fwlink/?LinkId=195927) (https://go.microsoft.com/fwlink/?LinkId=195927). - -### Configure MED-V image to use local profiles - -We recommend that you apply only those policies that make sense in an application compatibility environment for Windows XP. For example, desktop customization policies do not typically have to be applied and should be disabled. For more information about how to allow only local profiles, see [Group Policy Settings for Roaming User Profiles](https://go.microsoft.com/fwlink/?LinkId=205072) (https://go.microsoft.com/fwlink/?LinkId=205072). - -### Configure a Group Policy performance update - -By default, Group Policy is downloaded to a computer one byte at a time. This causes delays when MED-V is being joined to the domain. To increase the performance of Group Policy, we recommend that you set the following registry key value to the registry: - -Registry subkey: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon - -Entry: BufferPolicyReads - -Type: DWORD - -Value: 1 - -### Distribute legal notice through Group Policy instead of in the MED-V image - -If you want end users to see a service level agreement (SLA) before they access MED-V, we recommend that you enforce the SLA through Group Policy later so that the SLA is displayed to the end user after the first time setup is finished. - -**Caution**   -Even though a best practice is to run first time setup in **Unattended** mode, if you decide to set the local policy or registry entry to include an SLA in your image (virtual hard disk), you must also specify that first time setup is run in **Attended** mode, or first time setup can fail. - - - -### Compact the virtual hard disk - -We recommend that you compact your virtual hard disk to reclaim empty disk space and reduce the size of the virtual hard disk. For more information about how to compact your virtual hard disk, see [Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md). - -### Configure virtual machine to restart on blue screen crash - -We recommend that you configure the MED-V workspace virtual machine to automatically restart when it encounters a blue screen crash. To configure this setting in the guest, set the AutoReboot value in the HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CrashControl key to “1”. - -You can also configure this setting by clicking **Start**, clicking **Control Panel**, and then clicking **System**. Then, in the **Startup and Recovery** area of the **Advanced** tab, click **Settings**. Select the **Automatically restart** check box and click **OK**. - -### Back up MED-V image before sealing it - -We recommend that you create a backup copy of the MED-V image before you seal it. For more information about sealing your MED-V image, see [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md). - -### Install Windows Virtual PC last when installing from a batch file - -When you install the MED-V components by using a batch file, specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This ensures that Windows Update will not cause any interference with the installation process by requiring a restart. - -### Install MED-V workspace from local folder - -Because of problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. - -### Manage printer redirection in one manner only - -If a printer is manually installed on the MED-V guest virtual machine, and the same printer is later installed on the host computer, the result is that it is installed two times in the guest. To avoid this situation, we recommend as MED-V best practice that you manage printer redirection in one manner only: either disable redirection and install printers manually on the guest, or enable redirection and do not install printers manually on the guest. - -### Configure settings for MED-V guest patching - -You can control when and for how long the MED-V virtual machine awakens to receive automatic updates by defining the relevant configuration values in the registry. A MED-V best practice is to set your wake-up interval to match the time when you have scheduled regular updates for MED-V virtual machines. In addition, we recommend that you configure these settings to resemble the host computer’s behavior. - -For more information about how to configure settings for MED-V guest patching, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md). - -### Configure antivirus/backup software - -To prevent antivirus activity from affecting the performance of the virtual desktop, we recommend that when you can, you exclude the following virtual machine file types from any antivirus or backup process that is running on the MED-V host computer: - -- \*.VMC - -- \*.VUD - -- \*.VSV - -- \*.VHD - -## Related topics - - -[Security and Protection for MED-V](security-and-protection-for-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/med-v-20-deployment-overview.md b/mdop/medv-v2/med-v-20-deployment-overview.md deleted file mode 100644 index fc6e77f812..0000000000 --- a/mdop/medv-v2/med-v-20-deployment-overview.md +++ /dev/null @@ -1,166 +0,0 @@ ---- -title: MED-V 2.0 Deployment Overview -description: MED-V 2.0 Deployment Overview -author: dansimp -ms.assetid: 0b8998ea-c46f-4c81-a304-f380b2ed7cf8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 2.0 Deployment Overview - - -This section provides general information and instructions about how to install and deploy Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## Overview - - -MED-V 2.0 is based on an application model, where the same methods that you use to deploy applications can be used to deploy and manage MED-V. A deployed MED-V solution includes two components: the MED-V Host Agent and Guest Agent. The MED-V Host Agent is installed on the Windows 7 desktop and the MED-V Guest Agent is installed on Windows XP inside the MED-V workspace. MED-V also includes a MED-V Workspace Packager that provides the information and tools necessary for creating and configuring MED-V workspaces. - -**Important** -MED-V only supports the installation of the MED-V Workspace Packager, the MED-V Host Agent, and the MED-V workspace for all users. Installing MED-V for the current user only by selecting **ALLUSERS=””** causes failures in the installation of the components and in the setup of the MED-V workspace. - - - -### The MED-V Installation Files - -MED-V includes the following installation files, required for running MED-V: - -**The MED-V Host Agent Installation File** - -The Host Agent installation file is named MED-V\_HostAgent\_Setup.exe. This file is distributed and installed on each relevant end-user computer as part of your enterprise-wide deployment of MED-V. - -**The MED-V Workspace Packager Installation File** - -The MED-V Workspace Packager installation file is named MED-V\_WorkspacePackager\_Setup.exe. Use this file to install the MED-V Workspace Packager on a computer where you have administrator rights and permissions. The desktop administrator uses the MED-V Workspace Packager to create and manage MED-V workspaces. - -**Note** -The MED-V Guest Agent is installed automatically during first time setup. - - - -### The MED-V Deployment Process - -The following is a high-level overview of the MED-V installation and deployment process: - -1. Install the MED-V Workspace Packager on the computer where you have administrative credentials and that you will be using to build the MED-V workspace packages. For more information, see [How to Install the MED-V Workspace Packager](how-to-install-the-med-v-workspace-packager.md). - -2. Prepare your MED-V image and create your MED-V workspace packages by using the MED-V Workspace Packager. For more information, see [Operations for MED-V](operations-for-med-v.md). - -3. Deploy the required MED-V components throughout your enterprise. The required components of MED-V are Windows Virtual PC, the MED-V Host Agent, and the MED-V workspace. - -**Important** -Installation of the MED-V components requires administrative credentials. If an end user is installing MED-V, they are prompted to enter administrative credentials. Alternately, administrative credentials can be provided in context if you are installing by using an electronic software distribution (ESD) system. - - - -### The MED-V Components - -The MED-V components that you deploy throughout your enterprise consist of the following: - -**Windows Virtual PC** - -MED-V functions inside Windows Virtual PC images for its compatibility solution. Windows Virtual PC and the update for Windows 7 (KB977206) are required. For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - -**The MED-V Host Agent Installation File** - -MED-V\_HostAgent\_Setup.exe. - -**The MED-V Workspace Installation Files** - -The MED-V workspace installation files are created when you build your MED-V workspace package that consists of the following: - -A setup.exe executable program that executes the MED-V workspace installation - -A <MED-V\_workspace\_name>.msi installer - -A <VHD\_filename>.medv file, which is the compressed virtual hard disk - -The files for configuration settings (<workspace\_name>.reg and <workspace\_name>.ps1) - -To deploy MED-V, copy all the required installation files to the host computer or to a share that can be accessed by the host computer. Run the component installation files for Windows Virtual PC, the MED-V Host Agent, and the MED-V workspace. Then start the MED-V Host Agent to complete the first time setup of MED-V. - -You can perform the installation manually. However, we recommend that you use an electronic software distribution method to automate the deployment of the components. For more information, see [How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md). - -**Note** -For information about available command-line arguments to control install options, see [Command-Line Options for MED-V Installation Files](command-line-options-for-med-v-installation-files.md). - - - -## Deployment Steps - - -When you deploy MED-V throughout your enterprise, there are two main considerations: installation and first time setup. - -### Installation - -1. **Windows Virtual PC** - During installation, MED-V checks for Windows Virtual PC and its required update for Windows 7 (KB977206). For more information, see [Configure Installation Prerequisites](configure-installation-prerequisites.md). - - You can install these as part of the Windows 7 installations before you install MED-V, or you can install them as part of the MED-V distribution. However, MED-V does not include a mechanism for their deployment; they must be deployed by using an electronic software distribution (ESD) system or as part of the Windows 7 image. - - **Important** - When you install the MED-V components by using a batch file, a best practice is to specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This means that Windows Update will not cause any interference with the installation process by requiring a restart. - - - -~~~ -**Note** -After you install Windows Virtual PC, the computer must be restarted. -~~~ - - - -2. **MED-V Host Agent** – Install the MED-V Host Agent on the Windows 7 computer where MED-V will be run. This must be installed before installing the MED-V workspace and checks to make sure that Windows Virtual PC is installed. - -3. **MED-V workspace** – You create the files that are required in this installation by using the MED-V Workspace Packager: the setup.exe, .medv, and .msi files. To install the MED-V workspace, run setup.exe; this triggers the other files as required. The installation places an entry in the registry under the local machine run key to start the MED-V Host Agent, which always runs MED-V when Windows is started. - - **Important** - The installation of the MED-V workspace can be run interactively by the end user or silently through an electronic software distribution system. Installation of the MED-V workspace requires administrative credentials, so end users must be administrators of their computers to install the MED-V workspace. Alternately, an electronic software distribution system typically runs in the system context and has sufficient permissions. - - - -~~~ -**Tip** -Because of problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe. -~~~ - - - -### First Time Setup - -After MED-V and its required components are installed, MED-V must be configured. The configuration of MED-V is known as first time setup. By using the **MED-V Workspace Packager**, you can configure first time setup to run silently or interactively. First time setup of MED-V requires end users to enter their password to authenticate to the MED-V workspace, but otherwise can be almost invisible to the user. Notifications are shown in the notification area, such as when first time setup is complete and applications are ready. The following are the actions that occur during first time setup of MED-V: - -1. The virtual hard disk must be configured. Mini-Setup runs and expands the Windows XP image. Typically, this occurs in a hidden window, but MED-V can be configured to display during this configuration. - -2. After Mini-Setup finishes, you can run commands that you must have for additional configuration, such as installing ESD software or other applications, or configuring the image. These can be called in the Sysprep.inf file, but are not required there. For more information, see [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md). - -3. Ftscompletion.exe is run as the last step in configuration. This process completes the MED-V configuration, adds the user to the RDP group to let them access the MED-V workspace, copies logs, signals MED-V that the MED-V workspace is ready, and then restarts the MED-V workspace. This process can also add the user as an administrator of the MED-V workspace if this was configured when the MED-V workspace was created. Ftscompletion.exe is typically called through the Sysprep,inf file but can also be run through another method, such as a script. However, Ftscompletion.exe must be the last action that is performed when the workstation is configured. For more information, see [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md). - -4. After the MED-V workspace is restarted by Ftscompletion.exe, the end user is logged on. If they did not save their password during first time setup, they are prompted for it again. The MED-V workspace is then started and configured for the user. Configuration includes applying Group Policy. - - We recommend that you apply only those policies that make sense in an application compatibility environment for Windows XP. For example, desktop personalization policies do not typically need to be applied and should be disabled. For more information about how to allow only local profiles, see [Group Policy Settings for Roaming User Profiles](https://go.microsoft.com/fwlink/?LinkId=205072) (https://go.microsoft.com/fwlink/?LinkId=205072). - -After first time setup is complete, the end user is notified that the published applications are ready. They are then able to access the applications installed in the MED-V workspace from their **Start** menu. - -## Related topics - - -[Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md) - -[Deployment of MED-V](deployment-of-med-v.md) - - - - - - - - - diff --git a/mdop/medv-v2/med-v-20-release-notes.md b/mdop/medv-v2/med-v-20-release-notes.md deleted file mode 100644 index e4db87aed9..0000000000 --- a/mdop/medv-v2/med-v-20-release-notes.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: MED-V 2.0 Release Notes -description: MED-V 2.0 Release Notes -author: dansimp -ms.assetid: b8f7d938-566e-434c-b4b8-28b67cdfd0b1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# MED-V 2.0 Release Notes - - -Updated: March 10, 2011 - -**To search these release notes, press CTRL+F.** - -Read these release notes thoroughly before you install the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 platform. These release notes contain information that is required to successfully install MED-V 2.0 and contain information that is not available in the product documentation. If there is a difference between these release notes and other MED-V platform documentation, the latest change should be considered authoritative. These release notes supersede the content included with this product. - -## About the Product Documentation - - -Documentation for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 is distributed with the product and is also located at [Microsoft Enterprise Desktop Virtualization 2.0](https://go.microsoft.com/fwlink/?LinkID=207065) (https://go.microsoft.com/fwlink/?LinkId=207065). - -## Protect Against Security Vulnerabilities and Viruses - - -To help protect against security vulnerabilities and viruses, we recommend that you install the latest available security updates for any new software being installed. For more information, see [Microsoft Security](https://go.microsoft.com/fwlink/?LinkId=3482) (https://go.microsoft.com/fwlink/?LinkId=3482). - -## Known Issues with MED-V 2.0 - - -This section provides the most up-to-date information about issues with the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 platform. These issues do not appear in the product documentation and in some cases might contradict existing product documentation. When it is possible, these issues will be addressed in later releases. - -**Note**   -There are currently no known issues with MED-V 2.0. - - - -## Release Notes Copyright Information - - -This document is provided “as-is”. Information and views expressed in this document, including URL and other Internet website references, may change without notice. You bear the risk of using it. - -Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred. - -This document does not provide you with any legal rights to any intellectual property in any Microsoft product. This document is confidential and proprietary to Microsoft. It is disclosed and can be used only pursuant to a nondisclosure agreement. - - - -Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and Windows Vista are trademarks of the Microsoft group of companies. - -All other trademarks are property of their respective owners. - - - - - - - - - diff --git a/mdop/medv-v2/med-v-20-supported-configurations.md b/mdop/medv-v2/med-v-20-supported-configurations.md deleted file mode 100644 index 0f1b6b5b06..0000000000 --- a/mdop/medv-v2/med-v-20-supported-configurations.md +++ /dev/null @@ -1,242 +0,0 @@ ---- -title: MED-V 2.0 Supported Configurations -description: MED-V 2.0 Supported Configurations -author: dansimp -ms.assetid: 88f1d232-aa01-45ab-8da7-d086269250b5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V 2.0 Supported Configurations - - -Your environment may already meet the configuration requirements provided here so that you can install and run Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. We have included requirements including host operating system, disk space, and MED-V workspace requirements. - -## MED-V 2.0 Host Computer Requirements - - -### MED-V 2.0 Host Operating System Requirements - -The following table lists the operating systems that are supported for MED-V 2.0 installation on the host computer. - - ------ - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows 7

    Professional, Enterprise, or Ultimate

    None or SP1

    x86 or x64

    - -  - -The following table lists the minimal RAM required for each operating system supported in MED-V 2.0. - - ---- - - - - - - - - - - - - - - - - -
    Operating SystemMinimum Required RAM

    Windows 7 x86

    2GB

    Windows 7 x64

    2GB

    - -  - -### Minimum Recommended Disk Space - -We recommend a minimum of 10GB of available storage. However, the disk space that is required varies greatly and depends on the number of applications published in the MED-V workspace. - -### MED-V 2.0 Host Configuration - -**.NET Framework Version** - -The .NET Framework 3.5 SP1 version of the Microsoft .NET Framework is required for MED-V 2.0. However, you can install the .NET Framework 4 or later version if the .NET Framework 3.5 is already installed. - -**Virtualization Engine** - -Windows Virtual PC with the hotfix that is described in Microsoft Knowledge Base article 977206 is supported for MED-V 2.0. - -**Internet Browser** - -Windows Internet Explorer 8 and Windows Internet Explorer 9 are supported for MED-V 2.0. - -**Microsoft Server Environments** - -The MED-V Host Agent and the MED-V Workspace Packager are not supported in any server environment. - -## MED-V 2.0 Workspace Requirements - - -### MED-V 2.0 Workspace Operating System Requirements - -The following table lists the operating systems supported for MED-V 2.0 workspaces. - - ------ - - - - - - - - - - - - - - - - -
    Operating SystemEditionService PackSystem Architecture

    Windows XP

    Professional Edition

    SP3

    x86

    - -  - -### MED-V 2.0 Workspace Configuration - -**.NET Framework Version** - -Only the .NET Framework 3.5 SP1 version of the Microsoft .NET Framework is supported for MED-V 2.0 workspace installation. - -**Internet Browser** - -Windows Internet Explorer 6, Windows Internet Explorer 7, Windows Internet Explorer 8, and Windows Internet Explorer 9 are supported for the MED-V 2.0 workspace installation. - -### MED-V 2.0 Workspace Creation - -The virtual hard disk used to build a MED-V 2.0 workspace package must be created by using Windows Virtual PC. - -## MED-V 2.0 Globalization Information - - -### MED-V 2.0 Host Agent Globalization Information - -The following Windows operating system language versions are supported for the MED-V 2.0 Host Agent: - -- French - -- Italian - -- German - -- Spanish - -- Korean - -- Japanese - -- Brazilian Portuguese - -- Russian - -- Chinese Traditional - -- Chinese Simplified - -- Dutch - -- Swedish - -- Danish - -- Finnish - -- Portuguese - -- Norwegian - -- Polish - -- Turkish - -- Hungarian - -- Czech - -- Greek - -- Slovak - -- Slovenian - -### MED-V 2.0 Workspace Packager Globalization Information - -The following Windows operating system language versions are supported for the MED-V 2.0 Workspace Packager: - -- French - -- Italian - -- German - -- Spanish - -- Korean - -- Japanese - -- Brazilian Portuguese - -- Russian - -- Chinese Traditional - -- Chinese Simplified - -## Related topics - - -[Deployment of MED-V](deployment-of-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/med-v-event-log-messages.md b/mdop/medv-v2/med-v-event-log-messages.md deleted file mode 100644 index 1dac7a402f..0000000000 --- a/mdop/medv-v2/med-v-event-log-messages.md +++ /dev/null @@ -1,485 +0,0 @@ ---- -title: MED-V Event Log Messages -description: MED-V Event Log Messages -author: dansimp -ms.assetid: 7ba7344d-153b-4cc4-a00a-5d42aee9986b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MED-V Event Log Messages - - -The log files for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 provide detailed information about how to deploy and manage MED-V in your enterprise and help verify functionality or help troubleshoot issues. - -## Event IDs - - -The following are a list of MED-V event IDs to help troubleshoot issues that you might encounter when you deploy or manage MED-V. - -### Fts - -Shows the event IDs for first time setup. - -### Event ID 3066 - -Start virtual machine operation failed. - -**Description** -A potential problem exists with the virtual hard disk (VHD) that you are using to create a MED-V workspace. - -**Solution** -Verify that you can create a virtual machine with the VHD for MED-V and that it can be started. - -### Event ID 3071 - -Virtual machine preparation failed. - -**Description** -A problem occurred with first time setup that might have been caused by many different issues. These include problems with network connectivity. - -**Solution** -Restart the MED-V Host Agent to rerun first time setup. - -### Event ID 3078 - -Virtual machine preparation failed. - -**Description** -A potential problem exists with the VHD that you are using to create a MED-V workspace. - -**Solution** -Verify that you can create a virtual machine with the VHD for MED-V and that it can be started. - -### Event ID 3079 - -Retrying virtual machine preparation. - -**Description** -MED-V is trying to prepare the virtual machine. - -**Solution** -No action is required. Let first time setup finish. - -### Event ID 3080 - -The client was stopped when preparing the virtual machine. - -**Description** -MED-V stops unexpectedly when it tries to prepare the virtual machine. - -**Solution** -Start the MED-V Host Agent and let first time setup complete - -### Event ID 3084 - -Virtual machine is not valid. First time setup needs to be re-run. - -**Description** -The MED-V Host Agent detected a problem with the virtual machine. - -**Solution** -No action is required. Let first time setup finish. - -### Event ID 3099 - -Call to start virtual machine failed. - -**Description** -A potential problem exists with the VHD you are using to create a MED-V workspace. - -**Solution** -Verify that you can create a virtual machine with the VHD for MED-V and that it can be opened. - -### VM Management - -### Event ID 4022 - -VMManagerException Fatal error while issuing command to VM. - -**Description** -The end user tried to exit MED-V by logging off or by shutting down the MED-V host, and the VMTaskTimeout configuration setting was exceeded. - -**Solution** -Restart MED-V. - -### Event ID 4028 - -VM Operation timed out. - -**Description** -The end user tried to exit MED-V by logging off or by shutting down the host, and the VMTaskTimeout configuration setting was exceeded. - -**Solution** -Restart MED-V. - -### Event ID 4038 - -Vmsal posted an error message to the user. - -**Description** -An error message is displayed to the end user stating that MED-V could not start the virtual application. - -**Solution** -If the error is logged two or more times in a row, stop MED-V and connect to the virtual machine by using Windows Virtual PC console and attempt to start the application in Full Screen. - -### Event ID 4040 - -Recycling Additions because TerminalServices is not initialized in the guest. - -**Description** -MED-V rebooted the virtual machine because Remote Desktop Services was not initialized on the virtual machine. - -**Solution** -If the error is logged two or more times in a row, stop MED-V and connect to the virtual machine by using Windows Virtual PC console. - -### Event ID 4042 - -Failed to recycle additions in the guest. - -**Description** -MED-V failed to recycle virtual machine additions on the virtual machine. - -**Solution** -If the error is logged two or more times in a row, stop MED-V and connect to the virtual machine by using Windows Virtual PC console. - -### Event ID 4043 - -Failed to reset expired password in the virtual machine. - -**Description** -The end user did not reset the password in the virtual machine before it expired. As a result, the user might not be able to access network resources or save work. - -**Solution** -Shut down the MED-V guest and restart it. - -### URL Redirection - -### Event ID 5005 - -Couldn’t get VM name from configuration; can’t launch guest browser. - -**Description** -URL Redirection could not obtain the MED-V workspace name from the configuration. As a result, it cannot inform Windows Virtual PC to open the redirected URL in the MED-V workspace browser. - -**Solution** -Ensure that the MED-V workspace name is set and that it matches a virtual machine name in the C:\\Users\\<*user*>\\Virtual Machines directory. The MED-V workspace name is located at HKLM\\SOFTWARE\\Microsoft\\Medv\\v2\\VM\\Name. - -For example, if the user is "Matt" and the workspace name is "mattsworkspace", the value of HKLM\\SOFTWARE\\Microsoft\\Medv\\v2\\VM\\Name should be "mattsworkspace", and there should be a file that is named C:\\Users\\Matt\\Virtual Machines\\mattsworkspace.vcmx. - -### Event ID 5006 - -Failed to create pipe server. - -**Description** -The URL Redirection service could not create the pipe server to communicate with Internet Explorer. - -**Solution** -Check system event logs for attempts to create a file or resource whose path begins similar to the following: "\\\\.\\pipe\\MEDVUrlRedirectionPipe\_" and ends with the user’s user name and domain name. If this is not present in the event log, restart the computer. - -### ConfigMgr (Guest) - -### Event ID 7001 - -The host network configuration data is not properly formatted. - -**Description** -Either the network configuration received from the host is an incorrectly formatted XML string, or the network information returned from the host cannot be written to an XML document. - -**Solution** -Restart the host computer and the virtual machine. - -### Event ID 7005 - -A change to the host network configuration was detected, but was not able to be applied because the host network configuration data was not properly formatted. - -**Description** -A change to the host network configuration was communicated to the virtual machine, but could not be processed in the virtual machine because of an error. This error could be caused by incorrectly formatted data or the inability to set the information into the Windows Management Instrumentation (WMI) CCMNetworkAdapter instance. - -**Solution** -Restart the host and virtual machine. - -### ConfigMgr (Host) - -### Event ID 8006 - -The virtual machine cannot be found. - -**Description** -Windows Virtual PC 7 cannot locate the virtual machine. The virtual machine might have been deleted, moved, removed, or access was denied. - -**Solution** -Reinstall the virtual machine. - -### Event ID 8008 - -The workstation's network configuration information could not be retrieved. - -**Description** -Network configuration information could not be collected from the MED-V host, most likely because of a system call failure in the .NET Framework. This failure can also occur if the network information returned from the MED-V host cannot be written to an XML document. - -**Solution** -Restart the host workstation. - -### Event ID 8010 - -The network configuration data could not be set in the virtual machine. - -**Description** -The MED-V host network address translation (NAT) could not be communicated to the virtual machine, most likely because the virtual machine is in a bad state or the Windows Virtual PC Additions were not installed or enabled. - -**Solution** -Shut down and restart the virtual machine. In addition, you might have to reinstall the virtual machine. - -### Event ID 8011 - -The network configuration data could not be reset in the virtual machine. - -**Description** -The MED-V host network configuration (BRIDGED) could not be communicated to the virtual machine, most likely because the virtual machine is in a bad state or the Windows Virtual PC Additions were not installed or enabled. - -**Solution** -Shut down and restart the virtual machine. In addition, you might have to reinstall the virtual machine. - -### Printer Redirection - -### Event ID 9001 - -File Permission Error. - -**Description** -The end user is not authorized to access the folder required to open or create the MED-V printer file for reading. - -**Solution** -Verify that the User\\AppData\\ path can be accessed and that the user has permission to read and write to it. For example, if the user is "Matt", the path C:\\Users\\Matt\\AppData\\, and all files therein should have Read and Write permissions. And if it exists, the path C:\\Users\\Matt\\AppData\\Local\\Microsoft\\MEDV\\v2\\ and all files therein should have Read and Write permissions. - -### Event ID 9002 - -File Permission Error. - -**Description** -The end user is not authorized to access the folder required to open or create the MED-V printer file for writing. - -**Solution** -Ensure that the User\\AppData\\ path can be accessed, and that the user has permission to read and write to it. For example, if the user is "Matt", the path C:\\Users\\Matt\\AppData\\ and all files therein should have Read and Write permissions. And if it exists, the path C:\\Users\\Matt\\AppData\\Local\\Microsoft\\MEDV\\v2\\ and all files therein should have Read and Write permissions. - -### Event ID 9004 - -Could not create path for storing MEDV printer files. - -**Description** -The printer redirection service could not access files or create directories required for storing the printer information. - -**Solution** -Verify that the User\\AppData\\ path can be accessed and that the user has permission to read and write to it. For example, if the user is "Matt", the path C:\\Users\\Matt\\AppData\\ and all files therein should have Read and Write permissions. And if it exists, the path C:\\Users\\Matt\\AppData\\Local\\Microsoft\\MEDV\\v2\\ and all files therein should have Read and Write permissions. - -### Event ID 9005 - -Couldn’t get VM name from configuration; cannot launch guest installer. Cannot update MED-V – No host network detected. - -**Description** -The printer redirection service was not able to obtain the MED-V workspace name from the MED-V configuration and cannot inform Windows Virtual PC to start the installer on the MED-V guest. - -**Solution** -Ensure that the MED-V workspace name is set and that it matches a virtual machine name in the C:\\Users\\<*user*>\\Virtual Machines directory. The MED-V workspace name is located at HKLM\\SOFTWARE\\Microsoft\\Medv\\v2\\VM\\Name. - -For example, if the user is "Matt" and the workspace name is "mattsworkspace", the value of HKLM\\SOFTWARE\\Microsoft\\Medv\\v2\\VM\\Name should be "mattsworkspace" and there should be a file that is named C:\\Users\\Matt\\Virtual Machines\\mattsworkspace.vcmx. - -### Application Publishing - -### Event ID 10015 - -A file system error occurred during the reconcile process. The reconcile process will not process the file <*filename*> but will continue to process any other changes. - -**Description** -An unauthorized access or I/O error occurred when a shortcut was being created or deleted. - -**Solution** -Check that the file path can be accessed and that the user has permissions to create or delete the specified file. - -### Event ID 10021 - -Error <*error\_information*> for file operation <*operation\_name*> on file <*filename*>. - -**Description** -An unauthorized access or I/O error occurred when a shortcut was being created or deleted. - -**Solution** -Check that the file path can be accessed and that the user has permissions to create or delete the specified file. - -### Guest Patching - -### Event ID 11001 - -Guest wakeup task usage message. - -**Description** -MedvHost.exe with the /GuestWakeup option was executed incorrectly, or the command is formatted incorrectly. - -**Solution** -Ensure that the command is executed with the following format: - -Medvhost.exe /GuestWakeup /d:< *duration\_in\_minutes*> /v:”< *workspace\_name*>” where - -<*duration\_in\_minutes*> is the number of minutes that the virtual machine should stay awake (default is 240) and - -<*workspace\_name*> is the name of the virtual machine that should be awakened. - -### Event ID 11002 - -Cannot update MED-V – No host network detected. - -**Description** -Guest patching could not finish because no host network connection was detected. - -**Solution** -Connect the MED-V host to an active network connection before you run guest patching. - -### Event ID 11003 - -Cannot update MED-V – Host not running on A/C powerFailed to create pipe server. - -**Description** -Guest patching could not finish because the host appears to be running on battery power instead of from a power cord. - -**Solution** -Connect the host computer to a power cord before you run guest patching. - -### Client UX - -### Event ID 14003 - -The following tray status message was too long and could not be displayed: <*tray\_status\_message*> - -**Description** -MED-V created an unanticipated string that was too long for the tray tooltip or balloon message. As a result, the displayed message was truncated. - -**Solution** -This is a rare error that can occur when MED-V is randomly creating the tooltip text. There is no solution. - -### Event ID 14004 - -MED-V stopped due to an unhandled exception. - -**Description** -An unhandled exception caused MED-V to stop unexpectedly. - -**Solution** -Restart MED-V. - -### Event ID 14005 - -Server attempted to create mutex but it already existed. - -**Description** -A second instance of MedvHost.exe is stuck in memory. - -**Solution** -Open TaskManager and end all MedvHost.exe processes. - -### Event ID 14006 - -Error modifying or deleting registry value <*registry\_value*>. - -**Description** -MED-V is unable to modify the specified entry in the registry. - -**Solution** -Ensure that you install or uninstall MED-V with administrative credentials. - -### Event ID 14007 - -The file specified (<*filename*>) is not valid. - -**Description** -During install or uninstall, a corrupted temp file was passed to MED-V host. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. - -### Event ID 14008 - -File not found: <*filename*>. - -**Description** -During install or uninstall, a path of a required temp file was not found. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. - -### Event ID 14009 - -Unable to read parameter file <*filename*>. - -**Description** -During the install or uninstall process, MED-V was unable to read a temp file. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. In addition, verify that the user has the necessary rights and permissions to the Temp folder. - -### Event ID 14010 - -Error deserializing parameter file <*filename*>. - -**Description** -During the install or uninstall process, MED-V encountered a corrupted temp file. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. In addition, verify that the user has the necessary rights and permissions to the Temp folder. - -### Event ID 14011 - -Unexpected error deserializing parameter file <*filename*>. - -**Description** -During the install or uninstall process, MED-V encountered a corrupted temp file. - -**Solution** -Delete all files in the Temp folder and reinstall or uninstall MED-V. In addition, verify that the user has the necessary rights and permissions to the Temp folder. - -### Event ID 14012 - -Unexpected error when settings rights on folder <*folder\_name*> for user <*username*>. - -**Description** -An error occurs when MED-V is unable to set rights and permissions on certain folders during installation. - -**Solution** -Check the administrator rights to the following folders: - -@"%ProgramData%\\Microsoft\\Medv\\AllUsers" - -@"%ProgramData%\\Microsoft\\Medv\\MedvLock" - -@"%ProgramData%\\Microsoft\\Medv\\Monitoring" - -### Event ID 14013 - -Unexpected error when creating lock file. - -**Description** -An error occurs when MED-V is unable to create a file in the @"%ProgramData%\\Microsoft\\Medv\\MedvLock" folder during installation. - -**Solution** -Check the administrator rights to the MedvLock folder. - -## Related topics - - -[Troubleshooting MED-V](troubleshooting-med-vmedv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/monitor-med-v-workspaces.md b/mdop/medv-v2/monitor-med-v-workspaces.md deleted file mode 100644 index 9d0f3f1006..0000000000 --- a/mdop/medv-v2/monitor-med-v-workspaces.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Monitor MED-V Workspaces -description: Monitor MED-V Workspaces -author: dansimp -ms.assetid: f514afe2-8add-4105-9520-1a491733fa79 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitor MED-V Workspaces - - -This section provides information and contains procedures to help administrators monitor MED-V workspaces. - -## In This Section - - -[Monitoring MED-V Workspace Deployments](monitoring-med-v-workspace-deployments.md) -Describes how to monitor the deployment of MED-V workspaces to determine whether first time setup finished. - -[Detecting Network Changes that Affect MED-V](detecting-network-changes-that-affect-med-v.md) -Describes how to set up your environment to detect those network changes that can affect MED-V. - -## Related topics - - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) - -[Operations for MED-V](operations-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/monitoring-med-v-workspace-deployments.md b/mdop/medv-v2/monitoring-med-v-workspace-deployments.md deleted file mode 100644 index dcdb458c8a..0000000000 --- a/mdop/medv-v2/monitoring-med-v-workspace-deployments.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Monitoring MED-V Workspace Deployments -description: Monitoring MED-V Workspace Deployments -author: dansimp -ms.assetid: 5de0cb06-b8a9-48a5-b8b3-836954295765 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Monitoring MED-V Workspace Deployments - - -The monitoring feature in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 lets you run queries on individual MED-V workspaces to determine whether first time setup succeeded throughout your enterprise after the MED-V workspaces are deployed. Monitoring the success of first time setup is important because MED-V is not in a usable state until first time setup has been completed successfully. - -This section provides information and instruction to assist you in monitoring the success or failure of first time setup. - -## To monitor MED-V workspace deployments - - -The monitoring feature consists of a coupled in-process Windows Management Instrumentation (WMI) provider that you can query using WMI Query Language to discover the status of first time setup for all end users on a MED-V workspace. - -The WMI provider is implemented by using the WMI Provider Extension framework from the Microsoft .Net Framework 3.5. The WMI provider executes in the context of LocalService and stores the first time setup state securely under \\ProgramData. - -The WMI provider is implemented in the **root\\microsoft\\medv** namespace and implements the class **FTS\_Status**, which exposes the method **SetFtsState**. MED-V uses **SetFtsState** to set the first time setup state. - -The class contains the following properties. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    PropertyDescription

    Machine

    Read Only property that contains the name of the guest virtual machine provisioned by first time setup. This key contains the name that the guest would have had on first time setup failure.

    StatusCode

    Read Only property that contains zero if first time setup succeeded. Any other value returned equals the event ID for the error that is logged.

    Time

    The UTC time that first time setup completed.

    User

    The user for which first time setup was run.

    - -  - -The following code shows the Managed Object Format (MOF) file that defines the **FTS\_Status** class. - -``` syntax -[dynamic: ToInstance, provider("MedvWmi, Version=2.0.258.0, Culture=neutral, PublicKeyToken=14986c3f172d1c2c")] -class FTS_Status -{ -[read, key] string User; -[read] string Machine; -[read] sint32 StatusCode; -[read] datetime Time; -[static, implemented] void SetFtsState([in] sint32 statusCode, [in] string machine); -}; -``` - -Because your main concern is most likely those MED-V workspaces for which first time setup was not completed successfully, you can write your query to only return those that failed first time setup, for example: - -``` syntax -Select * from FTS_Status where StatusCode != 0 -``` - -In this case, the monitoring feature returns a list of those MED-V workspaces that failed first time setup, which you can use to take the appropriate actions to resolve the failure. - -## Related topics - - -[Monitor MED-V Workspaces](monitor-med-v-workspaces.md) - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/operations-for-med-v.md b/mdop/medv-v2/operations-for-med-v.md deleted file mode 100644 index 700f62afaa..0000000000 --- a/mdop/medv-v2/operations-for-med-v.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations for MED-V -description: Operations for MED-V -author: dansimp -ms.assetid: 8f3f367d-fa9d-4468-814a-f0495adfaea4 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for MED-V - - -The topics in this section provide step-by-step instructions and help you deploy and manage the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 environment and its components. - -## In This Section - - -[End-to-End Operations Scenario for MED-V 2.0](end-to-end-operations-scenario-for-med-v-20.md) -Describes an end-to-end operations scenario for MED-V 2.0. - -[Prepare a MED-V Image](prepare-a-med-v-image.md) -Describes how to create, install, configure, package, and test a Windows Virtual PC image for MED-V 2.0. - -[Create a MED-V Workspace Package](create-a-med-v-workspace-package.md) -Describes how to use the MED-V Workspace Packager to create or modify a MED-V workspace deployment package. - -[Test And Deploy the MED-V Workspace Package](test-and-deploy-the-med-v-workspace-package.md) -Describes how to test and deploy a MED-V workspace deployment package. - -[Monitor MED-V Workspaces](monitor-med-v-workspaces.md) -Describes how to monitor successful MED-V workspace deployments. - -[Manage MED-V Workspace Applications](manage-med-v-workspace-applications.md) -Describes how to manage the applications that are deployed to a MED-V workspace. - -[Manage MED-V URL Redirection](manage-med-v-url-redirection.md) -Describes how to manage URL redirection in a MED-V workspace. - -[Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md) -Describes how to manage configuration settings and printers in a MED-V workspace. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/operations-troubleshooting-medv2.md b/mdop/medv-v2/operations-troubleshooting-medv2.md deleted file mode 100644 index dca90ef2ec..0000000000 --- a/mdop/medv-v2/operations-troubleshooting-medv2.md +++ /dev/null @@ -1,141 +0,0 @@ ---- -title: Operations Troubleshooting -description: Operations Troubleshooting -author: dansimp -ms.assetid: 948d7869-accd-44da-974f-93409234dee7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Operations Troubleshooting - - -This topic includes information that you can use to help troubleshoot general operational issues in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## Troubleshooting Issues in MED-V Operations - - -The following are some issues end users might encounter when they run MED-V and solutions to help troubleshoot these issues: - -**Documentation Redirection Fails**. This issue typically occurs when an end user’s My Documents folder points to a network location. Windows does not support creating a share from another shared folder. When a drive or folder is redirected to the guest, RDP\\Windows Virtual PC creates a share for that folder. Therefore, if the My Documents folder on the host is already pointing to a share, RDP\\Windows Virtual PC cannot create a share of a share. - -Another possible cause of this issue is that the credentials that are required to connect to the network resource might differ from the user’s domain credentials. MED-V might be detecting that documents are redirected on the host, send that information to the guest, and then try to reconnect the network resource. If the user’s credentials do not authenticate, MED-V might stop trying to authenticate. - -**Solution** - -Try one of the following to resolve this issue: - -- Set the user’s root directory inside Active Directory. The guest and host should then connect to the same network resource. - -- Instead of redirecting the My Documents folder to a UNC path, map it to a drive letter (on the host, map a drive that points to the network resource). The My Documents folder can then be set to use the drive letter instead of the UNC path. The guest will then redirect to that same mapped drive as expected. - -- Create a startup script in the guest that redirects the My Documents folder to the network resource and provides additional credentials as needed. - -**URL Redirection Fails**. A URL that you have specified for redirection from the host to the guest is not redirecting as intended or is returning an error message that indicates that the website does not exist. - -**Solution** - -This error can occur when there is a misspelling or incorrect use of characters, such as asterisk (\*), in the URL redirection information. Check the registry value for URL redirection and correct any mistakes. - -The registry key is called `RedirectUrls` and is typically located at: - -Computer\\HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\MEDV\\v2\\UserExperience - -**Icon in Taskbar Misleading**. By default, the icon that appears in an end user’s taskbar for published applications and redirected URLs is the icon for Windows Virtual PC. If an end user is not aware of this default behavior, they can become confused when looking at the taskbar to locate their application. - -**Solution** - -The only way to avoid this default behavior is to change the user settings for the taskbar properties as follows: - -1. Right-click the taskbar and then click **Properties**. - -2. In the **Taskbar and Start Menu Properties** dialog box, click the **Taskbar** tab. - -3. In the drop-down bar for the **Taskbar buttons** box, select **Never combine**. - -4. Click **OK**. - -The expected icons for published applications and redirected URLs are displayed. - -**Warning Issued if Second User Attempts Log on or if Virtual Machine is in Use**. A warning message is issued when a second user logs on to a MED-V workspace while a first user is still running MED-V. The warning is also issued if MED-V is started while the virtual machine is being used, for example, if the virtual machine was started through Windows Virtual PC on the **Start** menu. When the end user accepts the warning message, MED-V shuts down. - -**Solution** - -An end user must verify that all other users are logged off MED-V before they try to log on. This ensures that no other instance of MED-V is running and that Windows Virtual PC is not in control of the virtual machine. - -**Beeps Heard During First Time Setup**. Occasionally, beeps are heard while MED-V is running first time setup. This can be confusing to an end user. The beeps are originating from the virtual machine when it performs certain actions, such as shutting down. - -**Solution** - -You can stop the beep service by specifying the "net stop beep" command at the beginning of each virtual machine start sequence. Or you can disable the beep service by specifying the “sc config beep start= disabled" command. You can specify these commands either before you seal the image or as part of Sysprep. - -**Multiple Network Connections Created for MED-V Workspaces in BRIDGED Mode**. If first time setup is creating a MED-V workspace that is configured for NAT mode, it only creates a single network connection in Windows Virtual PC. However, if first time setup is creating a MED-V workspace that is configured for BRIDGED mode, it creates a separate network connection for each network adapter that is installed in the computer, because MED-V cannot determine which network adapter is active. This also ensures that roaming users always have a network adapter available for wired and wireless connections. - -**Solution** - -None. - -**MED-V Application is Unresponsive for Too Long when Closing**. In some instances, a MED-V application stops responding when it is trying to close. - -**Solution** - -You can specify the length of time that MED-V waits to close unresponsive applications by setting the WaitToKillAppTimeout registry key in the guest virtual machine. For more information, see [How To Increase Shutdown Time So That Processes Can Quit Properly in Windows XP](https://go.microsoft.com/fwlink/?LinkId=206819) (https://go.microsoft.com/fwlink/?LinkId=206819). - -**Renaming a Published Application Shortcut in the Guest Virtual Machine does not Change the Published Name in the Host**. When you publish an application by creating a shortcut and then rename the shortcut in the guest virtual machine, the original application name remains in the host **Start** menu. The program continues to run as expected, however the program will always retain the original name. - -**Solution** - -None. This is a known behavior of Windows Virtual PC. - -**Moving a Shortcut in the Guest Virtual Machine does not Update the Location on the Host Computer Start Menu**. MED-V application shortcuts that are published to the host computer **Start** menu are cataloged in the registry. If you move an application shortcut into a subfolder, the registry is not updated to reflect the change. - -**Solution** - -Follow these steps to change the location of a MED-V application shortcut: - -1. When MED-V is running, open up Windows Explorer on the MED-V guest virtual machine. - -2. Browse to the "%ALLUSERSPROFILE%\\Start Menu\\Programs" directory. - -3. Move the application shortcuts out of the startmenu or programs folders. - -4. After about 30 seconds, validate that the shortcuts are removed from the host computer **Start** menu. - -5. Move the application shortcuts back in to the new program folders under the Start Menu\\Programs directory. - -6. After about 30 seconds, validate that the shortcuts are updated in the host computer **Start** Menu. - -**Published Applications can Time Out after Sitting Idle**. In some cases, published applications will time out if they have sat idle for some time. This situation only occurs if IPsec is enabled and the MED-V workspace is configured for NAT mode. This situation does not occur if running in BRIDGED mode. - -**Solution** - -Disable IPsec when you are running the MED-V workspace in NAT mode. - -**Pinning a Published Application to the Taskbar Bypasses MED-V**. If an end user pins a published application to the taskbar and then closes the application, MED-V is bypassed the next time that the application is opened from the taskbar icon. Instead, the application opens directly in a VMSAL window. - -**Solution** - -Do not pin the applications published in MED-V to the taskbar. - -## Related topics - - -[Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md) - -[Deployment Troubleshooting](deployment-troubleshooting.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/overview-of-med-vmedv2.md b/mdop/medv-v2/overview-of-med-vmedv2.md deleted file mode 100644 index 325b6c6151..0000000000 --- a/mdop/medv-v2/overview-of-med-vmedv2.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Overview of MED-V -description: Overview of MED-V -author: dansimp -ms.assetid: 393daa9b-2d76-43e1-861a-9d8c00f68cf6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Overview of MED-V - - -Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 enables the deployment and management of Windows Virtual PC images throughout an enterprise. By providing large-scale deployments of desktops running Windows XP Professional SP3 that are hosted through Windows Virtual PC, MED-V lets businesses upgrade to Windows 7, even though some of their applications might not yet be fully functional or supported. - -This guide helps you understand, deploy, and manage your MED-V environment. By using the information provided in this guide, you can plan for and prepare your MED-V deployment, learn how to monitor and manage MED-V workspaces, and understand how to use MED-V to benefit your IT organization. - -## Key Scenarios for Using MED-V - - -Incompatibility of legacy applications together with new versions of Windows can often delay enterprise upgrades to the latest version of Windows. Testing and migrating applications takes time, and users cannot take advantage of the new capabilities and enhancements offered by the newest operating system. - -By delivering applications in a Windows Virtual PC that is running Windows XP SP3, MED-V removes the barriers to operating system upgrades and lets administrators complete testing and address incompatible applications after the upgrade. - -From the user's perspective, these applications can be accessed from the standard desktop **Start** menu and appear side-by-side with native applications, so there is minimal change to the user experience. - -## Related topics - - -[Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md) - -[MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/planning-for-application-operating-system-compatibility.md b/mdop/medv-v2/planning-for-application-operating-system-compatibility.md deleted file mode 100644 index 459c9b83f8..0000000000 --- a/mdop/medv-v2/planning-for-application-operating-system-compatibility.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: Planning for Application Operating System Compatibility -description: Planning for Application Operating System Compatibility -author: dansimp -ms.assetid: cdb0a7f0-9da4-4562-8277-12972eb0fea8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Application Operating System Compatibility - - -This topic helps determine how to resolve application operating system compatibility issues, and discusses how Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 works as a solution for your organization. - -This topic discusses the business requirements for MED-V and compares MED-V to Windows XP Mode and Microsoft Application Virtualization (App-V): - -- [Business Requirements for MED-V](#bkmk-whenmedv) - -- [Benefits of MED-V versus Windows XP Mode](#bkmk-medvvsxp) - -- [Benefits of MED-V versus App-V](#bkmk-medvvsappv) - -## Business Requirements for MED-V - - -When your company’s IT department is determining whether to upgrade to Windows 7, it must pay attention to its line-of-business applications and web-based line-of-business applications to make certain that these can run on the new operating system. Often, these applications and URLs were created to work specifically with an older version of Windows or Internet Explorer, and problems can occur when trying to use them in the new operating system. Microsoft offers many different methods for handling the various compatibility issues that can occur when you upgrade, such as the Application Compatibility Toolkit (ACT) and the Windows 7 Program Compatibility Assistant. But even after all applications have been tested for compatibility and fixes have been determined, some applications still do not work correctly on Windows 7 or are too costly to resolve. - -By using MED-V, you can run these legacy applications through a Windows Virtual PC environment that is running Windows XP. Because you no longer have to test and validate these problem applications on the new operating system before upgrading, your migration to Windows 7 is much smoother and quicker. - -### Using MED-V Checklist - -Consider MED-V if any of the following scenarios apply to you: - -- You are a large organization (for example, 500 users and more), have an Enterprise Agreement with Microsoft, and plan to upgrade to Windows 7. - -- You have tested your line-of-business applications and have found some that are incompatible with Windows 7. - -- You have resolved the compatibility issues for some of these problem applications by upgrading the application or by using a Microsoft-provided shim, such as the Application Compatibility Toolkit (ACT), but compatibility issues remain for some applications. - -- You have considered App-V as an option for delivering the incompatible applications and have concluded that even after you implement App-V, you still have application operating system compatibility issues that you must address. - -- You have considered Windows XP Mode as a solution and have determined that it is not an efficient option because: - - - You want to be able to deploy virtual images that contain the problem applications to all end users at the same time, instead of individually, and have the virtual images automatically joined to the domain. - - - You have decided it is much more cost effective to manage these legacy applications (that are delivered virtually) and control the Windows Virtual PC settings from a centralized location instead of on each end user’s desktop. - - - You want to be able to update and support the virtual machines in scale instead of per desktop. - - - You want the ability to redirect URLs that run better on an older version of Internet Explorer to the virtual machines and to easily manage URL redirection later. - -- You have determined that it would be more cost effective and helpful to upgrade to Windows 7 as soon as possible and have decided to postpone resolving your remaining application compatibility issues until a later date, knowing that you have a solution available in MED-V. - -## Benefits of MED-V versus Windows XP Mode - - -Windows Virtual PC for Windows 7 lets you run different versions of an operating system at the same time on a single device and is included in Windows 7 Professional Edition and higher. - -Windows XP Mode functionality takes advantage of Windows Virtual PC by providing a preconfigured Windows XP image that lets you create a virtual Windows XP environment. In this virtual environment, you can manually install applications that are incompatible with Windows 7 and that run seamlessly from your desktop through Windows Virtual PC. - -**By using Windows XP Mode, you can do the following:** - -- Run applications that are compatible with Windows XP inside a virtual machine that runs in Windows Virtual PC. - -- Publish these applications to the host’s desktop or Program menu. - -When you want to deliver these virtual machines on a large scale as part of an enterprise migration to Windows 7, you must be able to deploy the virtual machines quickly, provision, and customize them efficiently, control their settings, and support them easily. - -MED-V builds upon Windows XP Mode to deliver enterprise-wide application compatibility. Whereas Windows XP mode is limited to providing virtual application functionality to individuals and small businesses, MED-V allows for large-scale deployments of preconfigured Windows XP images throughout your corporate network. It gives you an enterprise-ready management solution for the configuration, deployment, and maintenance of these virtual MED-V workspaces. MED-V also gives enterprise administrators a set of policies to control image use. This includes which users will have access to which specific applications within these images. - -**By using MED-V, you can do the following:** - -- Upgrade to your new operating system without having to test and resolve every incompatible application and URL. - -- Deploy virtual Windows XP images that are automatically domain-joined and customized per user. - -- Provision applications and URL redirection information to users. - -- Control the Windows Virtual PC settings. - -- Maintain and support endpoints through monitoring and troubleshooting. - -- Ensure that guest computers are patched, even if in a suspended state. - -- Automate per-user virtual machine creation and sysprep initialization. - -- Easily diagnose issues on the host and guest computers. - -- Seamlessly manage guest computers that are connected through Windows Virtual PC NAT mode. - -## Benefits of MED-V versus App-V - - -MED-V and App-V are two very different technologies that can easily work together to solve your application operating system compatibility issues. By using App-V, you create an individualized package for each application, each of which is then kept separate from the others. Each virtual application can then be immediately delivered to the end user, which is very useful for a Windows 7 deployment strategy. - -MED-V does not handle applications individually. Instead, it creates an additional instance of Windows XP on the same desktop that is running Windows 7. You can install as many applications as necessary into this virtual image and manage the image just as you would any other desktop in your organization. - -In addition, you can use MED-V together with App-V so that virtual applications that are sequenced through App-V are installed, published, and managed by using MED-V. - -## Related topics - - -[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/planning-for-med-v.md b/mdop/medv-v2/planning-for-med-v.md deleted file mode 100644 index 98c665b7e8..0000000000 --- a/mdop/medv-v2/planning-for-med-v.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Planning for MED-V -description: Planning for MED-V -author: dansimp -ms.assetid: 8124b765-6930-4607-8bd9-93068403c7a2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for MED-V - - -The topics in this section help you plan and design your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 deployment. - -## In This Section - - -[End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md) -Provides planning guidance for end-to-end deployment scenarios. - -[Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md) -Describes how to define the project scope by defining the end users, determining the MED-V images to be managed, and determining the organization’s service level expectations. - -[MED-V 2.0 Best Practices](med-v-20-best-practices.md) -Provides guidance for planning your deployment following MED-V 2.0 best practices. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/prepare-a-med-v-image.md b/mdop/medv-v2/prepare-a-med-v-image.md deleted file mode 100644 index 2746ab886a..0000000000 --- a/mdop/medv-v2/prepare-a-med-v-image.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Prepare a MED-V Image -description: Prepare a MED-V Image -author: dansimp -ms.assetid: 1bc757e5-8aef-4163-8542-1bdccc028961 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Prepare a MED-V Image - - -To deploy a Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 image to multiple computers, you must first prepare the image for deployment. - -This section provides information about the steps that are required to prepare a MED-V image for deployment. - -## In This Section - - -[Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md) -Describes how to create and configure a Windows Virtual PC image for MED-V. This includes installing Windows XP on the image with the required updates and integration components. - -[Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md) -Describes the process of installing applications on your MED-V image. - -[Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md) -Describes how to configure and package a Windows Virtual PC image for MED-V by using Sysprep. - -## Related topics - - -[Operations for MED-V](operations-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md b/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md deleted file mode 100644 index 73bc76772a..0000000000 --- a/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Prepare the Deployment Environment for MED-V -description: Prepare the Deployment Environment for MED-V -author: dansimp -ms.assetid: d15ea370-7fdb-4852-a1ba-730ec7568e3e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Prepare the Deployment Environment for MED-V - - -This section provides information about preparing your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 deployment environment. - -## In This Section - - -[Configure Environment Prerequisites](configure-environment-prerequisites.md) -Describes the prerequisites that are required as part of the MED-V 2.0 environment. - -[Configure Installation Prerequisites](configure-installation-prerequisites.md) -Describes the prerequisites that are required before you install MED-V 2.0. - -## Related topics - - -[Example MED-V System Installation Checklist](example-med-v-system-installation-checklist.md) - -[Deploy the MED-V Components](deploy-the-med-v-components.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md b/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md deleted file mode 100644 index a97672a4dc..0000000000 --- a/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Restarting and Resetting a MED-V Workspace -description: Restarting and Resetting a MED-V Workspace -author: dansimp -ms.assetid: a959cdb3-a727-47c7-967e-e58f224e74de -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restarting and Resetting a MED-V Workspace - - -During troubleshooting, you may sometimes find it necessary to restart or reset the MED-V workspace. Restarting the MED-V workspace is basically the same as restarting a physical computer. Resetting the MED-V workspace reruns first time setup and deletes all data that is stored in the virtual machine. Because all stored data is deleted, you typically should only reset the MED-V workspace to resolve the most serious troubleshooting issues, or to restore a previously working MED-V workspace back to a working state. - -For information about how to open the MED-V Administration Toolkit, see [Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md). - -**Restarting a MED-V Workspace** - -1. On the **MED-V Administration Toolkit** window, click **Restart MED-V Workspace**. A dialog window opens in which you must confirm that you want to restart the MED-V workspace. - -2. Click **Restart**. - - Any published applications that are running or redirected web sites that are open will be closed when the MED-V workspace restarts. - -**Resetting a MED-V Workspace** - -1. On the **MED-V Administration Toolkit** window, click **Reset MED-V Workspace**. A dialog window opens in which you must confirm that you want to reset the MED-V workspace. - - **Warning**   - Resetting the MED-V workspace causes first time setup to run again, and thus reloads the original virtual hard disk. All data that is stored in the MED-V workspace since first time setup was originally run will be deleted. - - - -2. Click **Reset**. - - Any published applications that are running or redirected web sites that are open will be closed when the MED-V workspace resets. - -## Related topics - - -[Viewing and Configuring MED-V Logs](viewing-and-configuring-med-v-logs.md) - -[Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md) - - - - - - - - - diff --git a/mdop/medv-v2/security-and-protection-for-med-v.md b/mdop/medv-v2/security-and-protection-for-med-v.md deleted file mode 100644 index 5424443a54..0000000000 --- a/mdop/medv-v2/security-and-protection-for-med-v.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Security and Protection for MED-V -description: Security and Protection for MED-V -author: dansimp -ms.assetid: 5db66d56-eb65-4bff-a9e4-3d52de4256bd -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Protection for MED-V - - -The following section contains best practices that we recommend for running Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 in a secure configuration. - -## In This Section - - -[Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md) -Describes best practices to follow to help maintain security when preparing, building, testing, deploying, and managing MED-V workspaces. - -[Authentication of MED-V End Users](authentication-of-med-v-end-users.md) -Describes best practices to follow to help maintain security when verifying the identity of MED-V end users. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/security-best-practices-for-med-v-operations.md b/mdop/medv-v2/security-best-practices-for-med-v-operations.md deleted file mode 100644 index 26401fc3ba..0000000000 --- a/mdop/medv-v2/security-best-practices-for-med-v-operations.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: Security Best Practices for MED-V Operations -description: Security Best Practices for MED-V Operations -author: dansimp -ms.assetid: 231e2b9a-8b49-42fe-93b5-2ef12fe17bac -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security Best Practices for MED-V Operations - - -As an authorized administrator, you are responsible to protect the information of the users and maintain security of your organization during and after the deployment of MED-V workspaces. In particular, consider the following issues. - -**Customizing Internet Explorer in the MED-V workspace**. Earlier versions of the Windows operating system and of Internet Explorer are not as secure as current versions. Therefore, Internet Explorer in the MED-V workspace is configured to prevent browsing and other activities that can pose security risks. In addition, the Internet security zone setting for Internet Explorer in the MED-V workspace is set to the highest level. By default, both of these configurations are set in the MED-V Workspace Packager when you create your MED-V workspace package. - -By using Internet Explorer Administration Kit (IEAK) or by changing the defaults in the MED-V Workspace Packager, you can customize Internet Explorer in the MED-V workspace. However, realize that if you customize Internet Explorer in the MED-V workspace in such a way as to make it less secure, you can expose your organization to those security risks that are present in older versions of Internet Explorer. - -From a security perspective, best practices for managing Internet Explorer in the MED-V workspace are as follows: - -- When creating your MED-V workspace package, leave the defaults set so that Internet Explorer in the MED-V workspace is configured to prevent browsing and other activities that can pose security risks. - -- When creating your MED-V workspace package, leave the defaults set so that the security setting for the Internet security zone remains at the highest level. - -- Configure your enterprise proxy or Internet Explorer Content Advisor to block domains that are outside your company’s intranet. - -**Configuring a MED-V workspace for all users on a shared computer.** When configuring a MED-V workspace so that it can be accessed by all users on a shared computer, realize that the guest virtual machine (VHD) is put in a location that gives Read and Write access to all users on that system. - -**Configuring a proxy account for domain joining.** When configuring a proxy account for joining virtual machines to the domain, you must know that it is possible for an end user to obtain the proxy account credentials. Thus, necessary precautions must be taken, such as limiting account user rights, to prevent an end user from using the credentials for causing harm. - -**Sysprep Configuration.** Although the Sysprep.inf file is encrypted by default, its contents can be decrypted and read by any determined end user who can successfully log on to the virtual machine. This raises security concerns because the Sysprep.inf file can contain credentials in addition to a Windows product key. - -You can lessen this risk by setting up a limited account for joining virtual machines to the domain and specifying the credentials for that account when configuring Sysprep. Alternately, you can also configure Sysprep and first time setup to run in **Attended** mode and require end users to provide their credentials for joining the virtual machine to the domain. - -A MED-V best practice is to specify that FtsCompletion.exe is run under an account that gives the end user rights to connect to the guest through the Remote Desktop Connection (RDC) Client. - -**End-user authentication.** Enabling the caching of end-user credentials provides the best user experience of MED-V, but creates the potential that someone could gain access to the end user’s credentials. The only way to lessen this risk is by specifying on the **MED-V Workspace Packager** that end-user credentials are not stored. For more information about authentication of end users, see [Authentication of MED-V End Users](authentication-of-med-v-end-users.md). - -## Related topics - - -[Operations Troubleshooting](operations-troubleshooting-medv2.md) - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/technical-reference-for-med-v.md b/mdop/medv-v2/technical-reference-for-med-v.md deleted file mode 100644 index 3b1d052a9b..0000000000 --- a/mdop/medv-v2/technical-reference-for-med-v.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Technical Reference for MED-V -description: Technical Reference for MED-V -author: dansimp -ms.assetid: 52aa15ae-6ca8-4494-8660-313c7b723406 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Technical Reference for MED-V - - -The technical reference information we provide here includes example checklists for planning, deployment, and operations for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## In This Section - - -[Command-Line Options for MED-V Installation Files](command-line-options-for-med-v-installation-files.md) -Provides a list and description of the options that you can specify when you install or uninstall MED-V at the command prompt. - -[Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md) -Describes the steps to follow to compact your virtual hard disk before you configure your Windows XP image for use with MED-V. - -[MED-V Event Log Messages](med-v-event-log-messages.md) -Describes how to use the event logs in MED-V to troubleshoot deployment and operations issues. - -[Updating MED-V 2.0](updating-med-v-20.md) -Provides information about how to upgrade your MED-V installation. - -[Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md) -Describes how to specify certain installed applications that you do not want published to the host computer. - -[MED-V 2 Configuration Cmdlets](https://go.microsoft.com/fwlink/?LinkId=213301) -Provides information about cmdlets you can use to perform various MED-V configuration tasks from the command line. - -[MED-V 2 Workspace Cmdlets](https://go.microsoft.com/fwlink/?LinkId=213302) -Provides information about cmdlets you can use to perform various MED-V workspace configuration tasks from the command line. - -[Example MED-V Checklists](example-med-v-checklists.md) -Provides several checklist examples that you can reference when planning, deploying, or managing MED-V. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -[Security and Protection for MED-V](security-and-protection-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md b/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md deleted file mode 100644 index df04230dd8..0000000000 --- a/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Test And Deploy the MED-V Workspace Package -description: Test And Deploy the MED-V Workspace Package -author: dansimp -ms.assetid: 0238dea7-a08c-4859-b8b1-2b52bc63fda6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Test And Deploy the MED-V Workspace Package - - -This section provides information and instructions for testing and deploying your Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 image. - -## In This Section - - -[Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md) -Provides instructions and guidance for testing the MED-V workspace installer package. - -[Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md) -Provides general information about how to deploy MED-V workspaces. - -  - -  - - - - - diff --git a/mdop/medv-v2/testing-the-med-v-workspace-package.md b/mdop/medv-v2/testing-the-med-v-workspace-package.md deleted file mode 100644 index c854d25c0e..0000000000 --- a/mdop/medv-v2/testing-the-med-v-workspace-package.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Testing the MED-V Workspace Package -description: Testing the MED-V Workspace Package -author: dansimp -ms.assetid: 83edcb6e-9615-4d18-96b8-f085a647294e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Testing the MED-V Workspace Package - - -After you have created your MED-V workspace deployment package, you can test the package locally before deploying it throughout your enterprise. The topics in this section provide some steps and instructions to help you test your MED-V workspace deployment package. - -## In This Section - - -[How to Create a Test Environment](how-to-create-a-test-environment.md) -Provides information about how to create a test environment, either manually or by using an electronic software distribution (ESD) system. - -[How to Verify First Time Setup Settings](how-to-verify-first-time-setup-settings.md) -Provides information and guidance for testing your first time setup settings. - -[How to Test URL Redirection](how-to-test-url-redirection.md) -Provides information and guidance for testing your URL redirection settings. - -[How to Test Application Publishing](how-to-test-application-publishing.md) -Provides information and guidance for testing application publishing. - -  - -  - - - - - diff --git a/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md b/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md deleted file mode 100644 index 202763a51f..0000000000 --- a/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Troubleshooting MED-V by Using the Administration Toolkit -description: Troubleshooting MED-V by Using the Administration Toolkit -author: dansimp -ms.assetid: 6c096a1c-b9ce-4ec7-8dfd-5286e3b9a617 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting MED-V by Using the Administration Toolkit - - -Use the MED-V Administration Toolkit to troubleshoot certain problems in a MED-V workspace. The MED-V Administration Toolkit lets you access and configure event logs, restart or reset the MED-V workspace, and view the published applications and redirected web addresses in the MED-V workspace. You can also use the MED-V Administration Toolkit to open the MED-V workspace virtual machine in full-screen mode. - -## To Open the MED-V Administration Toolkit - - -Perform the following steps to open the MED-V Administration Toolkit: - -1. On the host computer that contains the MED-V workspace you are troubleshooting, open a Command Prompt window. - -2. Browse to %systemdrive%\\Program Files\\Microsoft Enterprise Desktop Virtualization. - -3. At the command prompt, type **MedvHost /toolkit**. - -After the MED-V Administration Toolkit opens, you can use the toolkit to help resolve issues in the MED-V workspace found during troubleshooting. - -## In this Section - - -[Viewing and Configuring MED-V Logs](viewing-and-configuring-med-v-logs.md) -Describes how to use the MED-V Administration Toolkit to collect and manage MED-V event logs in the host computer and the guest virtual machine. - -[Restarting and Resetting a MED-V Workspace](restarting-and-resetting-a-med-v-workspace.md) -Describes how to restart and reset MED-V workspaces by using the MED-V Administration Toolkit. - -[Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md) -Describes how to use the MED-V Administration Toolkit to view the published applications and redirected web addresses in a MED-V workspace and how to open the MED-V workspace virtual machine in full-screen mode. - -## Related topics - - -[MED-V Event Log Messages](med-v-event-log-messages.md) - -[Troubleshooting MED-V](troubleshooting-med-vmedv2.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/troubleshooting-med-vmedv2.md b/mdop/medv-v2/troubleshooting-med-vmedv2.md deleted file mode 100644 index 64042f1f8f..0000000000 --- a/mdop/medv-v2/troubleshooting-med-vmedv2.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Troubleshooting MED-V -description: Troubleshooting MED-V -author: dansimp -ms.assetid: 4502d62b-a7db-4f83-81e2-23fd8b0820e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Troubleshooting MED-V - - -You can use the information provided here to help you troubleshoot issues in Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## In This Section - - -[Deployment Troubleshooting](deployment-troubleshooting.md) -Describes how to troubleshoot deployment issues in your MED-V environment. - -[Operations Troubleshooting](operations-troubleshooting-medv2.md) -Describes how to troubleshoot common issues that can occur during the operation of MED-V. - -[Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md) -Describes how to access and use the MED-V Administration Toolkit to troubleshoot deployment and operations issues. - -## Related topics - - -[Microsoft Enterprise Desktop Virtualization 2.0](index.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/updating-med-v-20.md b/mdop/medv-v2/updating-med-v-20.md deleted file mode 100644 index 0d1f80a70b..0000000000 --- a/mdop/medv-v2/updating-med-v-20.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Updating MED-V 2.0 -description: Updating MED-V 2.0 -author: dansimp -ms.assetid: beea2f54-42d7-4a17-98e0-d243a8562265 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Updating MED-V 2.0 - - -Help secure your system by applying the appropriate security updates for Microsoft Enterprise Desktop Virtualization (MED-V) 2.0. - -## Updating MED-V - - -You can update MED-V interactively, by the end user, or silently by using an electronic software distribution system. Installation of the MED-V Host Agent upgrades the MED-V Host Agent and then updates the MED-V workspace if required. The MED-V Host Agent and Guest Agent keep in sync. If applications are running from the MED-V workspace while the MED-V Host Agent is being updated, a restart of the host computer is required to complete the update. If no applications are running, MED-V is restarted automatically and the upgrade is completed without a restart of the host computer. - -If you are updating MED-V by using an electronic software distribution system, you can control the restart behavior. To do this, suppress the restart by typing **REBOOT=”ReallySuppress”** at the command prompt when installing MED-V\_HostAgent\_Setup.exe. Then, configure the electronic software distribution system to capture the 3010 return code (which signals that a restart is required) and perform the set restart behavior. - -## Related topics - - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/viewing-and-configuring-med-v-logs.md b/mdop/medv-v2/viewing-and-configuring-med-v-logs.md deleted file mode 100644 index 35d8f398a0..0000000000 --- a/mdop/medv-v2/viewing-and-configuring-med-v-logs.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Viewing and Configuring MED-V Logs -description: Viewing and Configuring MED-V Logs -author: dansimp -ms.assetid: a15537ce-981d-4f55-9c3c-e7fbf94b8fe5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing and Configuring MED-V Logs - - -When you are troubleshooting MED-V issues and problems, you may find it helpful or necessary to access the MED-V event logs. You can open Event Viewer for the host computer and the guest virtual machine by using the MED-V Administration Toolkit. You can also use the MED-V Administration Toolkit to set the logging level at which the MED-V event logs report MED-V events. - -For information about how to open the MED-V Administration Toolkit, see [Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md). - -## Viewing MED-V Event Logs - - -On the **MED-V Administration Toolkit** window, click **Host Events** to open the event viewer for the host computer. Or, click **Guest Events** to open Event Viewer for the guest virtual machine. - -Event Viewer opens and displays the corresponding event logs that you can use to troubleshoot the issues that you might encounter when you deploy or manage MED-V. By default, only errors and warnings are displayed. For more information about specific event IDs and messages, see [MED-V Event Log Messages](med-v-event-log-messages.md). - -**Note**   -End users can only save event log files in the guest if they have administrative permissions. - - - -### To manually open the Event Viewer in the host computer - -1. Click **Start**, click **Control Panel**, and then click **Administrative Tools**. - -2. Double-click **Event Viewer**, and then click **Applications and Services Logs**. - -3. Double-click **MEDV**. - -## Configuring MED-V Event Logs - - -You can specify the MED-V event logging level by selecting the corresponding option button on the MED-V Administration Toolkit. You can decide whether event logging includes errors only, errors and warnings, or errors, warnings and informational messages. The event logging level specified is set for both the host computer and the guest virtual machine. - -You can also specify the event logging level by editing the EventLogLevel registry value. For more information, see [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md). - -**Note**   -The level you specify on the **MED-V Administration Toolkit** window applies to future MED-V event logging. If you set the level to capture all errors, warnings, and informational messages, then the event logs fill more quickly and older events are removed. - - - -## Related topics - - -[Restarting and Resetting a MED-V Workspace](restarting-and-resetting-a-med-v-workspace.md) - -[Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md) - - - - - - - - - diff --git a/mdop/medv-v2/viewing-med-v-workspace-configurations.md b/mdop/medv-v2/viewing-med-v-workspace-configurations.md deleted file mode 100644 index c009bcb559..0000000000 --- a/mdop/medv-v2/viewing-med-v-workspace-configurations.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Viewing MED-V Workspace Configurations -description: Viewing MED-V Workspace Configurations -author: dansimp -ms.assetid: 5de6cf04-6beb-4ac9-ad52-26ac8c0c8ce6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Viewing MED-V Workspace Configurations - - -When you are troubleshooting MED-V issues and problems, you can use the MED-V Administration Toolkit to view the published applications and redirected web addresses in the MED-V workspace. You can also use the MED-V Administration Toolkit to open the MED-V workspace in full-screen mode. - -For information about how to open the MED-V Administration Toolkit, see [Troubleshooting MED-V by Using the Administration Toolkit](troubleshooting-med-v-by-using-the-administration-toolkit.md). - -## Viewing MED-V Published Applications - - -On the **MED-V Administration Toolkit** window, click **View Published Applications**. - -The **MED-V Workspace Published Applications** window opens and displays a list of the applications that were published in the MED-V workspace. You can use this information to troubleshoot certain issues, such as determining whether an application was published as expected. - -For information about how to publish applications to the MED-V workspace, see [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md). - -## Viewing MED-V Redirected Web Addresses - - -On the **MED-V Administration Toolkit** window, click **View Redirected Web Addresses**. - -The **Web Addresses Redirected to the MED-V Workspace** window opens and displays a list of the redirected web addresses specified for the MED-V workspace. You can use this information to troubleshoot certain issues, such as determining whether a web address was specified correctly for redirection. - -For information about how to manage web addresses redirection in the MED-V workspace, see [How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace](how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md). - -## Opening the MED-V Workspace Virtual Machine - - -On the **MED-V Administration Toolkit** window, click **View MED-V Workspace Full Screen**. - -MED-V closes if it was running, and the MED-V workspace virtual machine opens in full-screen mode. You can use this full-screen window to easily access all the components of the virtual machine that might be helpful in troubleshooting, such as its hard disk and settings files. - -## Related topics - - -[Viewing and Configuring MED-V Logs](viewing-and-configuring-med-v-logs.md) - -[Restarting and Resetting a MED-V Workspace](restarting-and-resetting-a-med-v-workspace.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/whats-new-in-med-v-20.md b/mdop/medv-v2/whats-new-in-med-v-20.md deleted file mode 100644 index 0024381a3d..0000000000 --- a/mdop/medv-v2/whats-new-in-med-v-20.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: What's New in MED-V 2.0 -description: What's New in MED-V 2.0 -author: dansimp -ms.assetid: 53b10bff-2b6f-463b-bdc2-5edc56526792 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in MED-V 2.0 - - -Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 has evolved the application compatibility support for Windows 7 and removed functionality that is not required for this scenario. For example, features such as encryption of the MED-V workspace, the centralized MED-V server, and MED-V workspace trim transfer have been removed. - -## Changes in Standard Functionality - - -This section discusses the key areas where MED-V 2.0 functionality has changed. - -### MED-V Workspace Creation - -The virtual hard disk used for the MED-V workspace is now created in Windows Virtual PC. The methods that are used to create the MED-V workspace include installing Windows XP SP3, updating the operating system, and preparing it to be managed through software management infrastructure. - -The offline management and trim transfer functionality were removed, in addition to the proprietary MED-V workspace encryption and compression functionality. When you create a MED-V workspace, an administrator should prepare and configure appropriate applications and management tools in the image instead of using the virtual machine preparation tool that is provided in MED-V 1.0. - -Running Sysprep on the MED-V image is now required and validated during the packaging of the MED-V workspace. The MED-V Workspace Packager provides a graphical user interface (GUI) that guides the administrator through the packaging process. The console from MED-V 1.0 was removed together with the functionality of managing images, managing MED-V workspace profiles, and the requirement to stage and encrypt MED-V workspaces. - -### MED-V Workspace Deployment - -To deploy a MED-V workspace, an administrator is now able to take advantage of their electronic software distribution tools. The client-pull method available in MED-V 1.0 was removed and the MED-V workspace is now delivered by using methods outside MED-V. Administrators can treat MED-V workspaces as they would any other application package and can schedule deployments and installations of MED-V by using their existing tools and processes. MED-V installations can be deployed silently and can easily be managed inside an existing software distribution infrastructure. - -### MED-V Workspace Management - -The MED-V workspace in MED-V 2.0 is based on a Windows Virtual PC virtual hard disk. MED-V has extended the capabilities that Windows Virtual PC provides by improving the seamless experience without requiring encryption or special tools to access the MED-V workspace. - -After MED-V is deployed to a workstation, the MED-V workspace can be opened in full-screen mode by using Windows Virtual PC. This new functionality removed the requirement for policies that set a preference for seamless or full-screen modes and also removed the need to force full-screen for diagnostics and troubleshooting. - -Publishing applications to the MED-V workspace is no longer performed with profiles and by manually entering the path to applications. Instead, it occurs automatically as applications are installed on the guest. The central image repository that included versions of the images that were delivered through trim transfer is removed. Instead, MED-V enables administrators to manage the MED-V workspace as they would a physical computer, by letting applications and updates be distributed without the complexity of a dedicated MED-V infrastructure. - -## Changes in MED-V Features - - -Several key areas of MED-V 2.0 reflect improvements or additions to the following features. - -### MED-V Workspace Creation - -MED-V workspaces must be created by using Windows Virtual PC. Existing Virtual PC 2007 images must be migrated. The virtual machine Prep tool is not included in MED-V 2.0 and administrators should configure, update, and optimize their images according to the MED-V 2.0 Help file. Running Sysprep on the MED-V image is a required step and must be performed before packaging. - -### MED-V Workspace Packaging - -Windows PowerShell is the foundation of the MED-V Workspace Packager. This functionality replaces some former console abilities and functionality that managed centralized functions of MED-V. The MED-V Workspace Packager merely packages the virtual hard disk with the appropriate settings and image so that it can be easily deployed by administrators. Advanced features are provided by using Windows PowerShell. - -### MED-V Workspace Distribution - -Dedicated server infrastructure is no longer required for MED-V 2.0 and the client pull method to deploy MED-V workspaces was removed. MED-V workspaces are now deployed using your electronic software distribution infrastructure and can be stored on common shares that are used for other installation packages. - -### First Time Setup - -The first time setup process is now integrated with the standard imaging convention of Sysprep. The MED-V workspace first time setup process can dynamically apply settings specified in the MED-V Workspace Packager to the image as it begins Mini-Setup. The scripting tool in the console was removed and the first time setup process is now based on options that are configured in the MED-V Workspace Packager by the administrator. - -### Application Publishing - -Administrators can install applications on the MED-V image either before packaging, after the MED-V workspace is deployed, or by using a combination of both. MED-V no longer examines MED-V workspace policy to publish applications, but instead refers to what is actually installed on the guest. As applications are installed on the guest, they are automatically detected and published to the host **Start** menu and are ready to be started by the end user. - -### URL Redirection - -MED-V 2.0 provides seamless host-to-guest web address redirection based on the policies configured and managed by the administrator. After a URL is redirected to the guest browser, the default experience is to attempt to limit the user to that redirected site. This minimizes the browsing activities that a user can perform that are not intended by the administrator. Guest-to-host browser redirection was removed. - -### Troubleshooting - -MED-V now takes advantage of standard host-based processes for troubleshooting. Because the MED-V workspace is no longer encrypted, it can be opened in full-screen mode within the Windows Virtual PC console, where it can be viewed and worked with as a standard workstation. In addition, the logs are no longer encrypted locally and logged centrally. MED-V now makes extensive use of the local event logs, and the logging level of the output, from informational to debug levels, can be easily configured. Finally, a troubleshooting toolkit is now provided so administrators and helpdesk personnel can have a graphical, aggregated view of all the troubleshooting options, and they can effortlessly select the activities that most suit their needs. - -MED-V is no longer run as a system service. Instead, it is run as user-owned processes, and it only runs when a user is logged on. Functionality that was formerly provided by the system-owned service is now provided in the user-side processes. - -## Related topics - - -[Deployment of MED-V](deployment-of-med-v.md) - -[Operations for MED-V](operations-for-med-v.md) - -  - -  - - - - - diff --git a/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md b/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md deleted file mode 100644 index 34ca784d07..0000000000 --- a/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Windows Virtual PC Application Exclude List -description: Windows Virtual PC Application Exclude List -author: dansimp -ms.assetid: 7715f198-f5ed-421e-8740-0cec2ca4ece3 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/28/2017 ---- - - -# Windows Virtual PC Application Exclude List - - -In some instances, you might not want applications that are installed in the MED-V workspace to be published to the host computer **Start** menu. You can unpublish these applications by following the instructions at [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md). However, if the program ever automatically updates, it might also be automatically republished. This causes you to have to unpublish the application again. - -Windows Virtual PC includes a feature known as the "Exclude List" that lets you specify certain installed applications that you do not want published to the host **Start** menu. The "Exclude List" is located in the guest registry in the HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Virtual Machine\\VPCVAppExcludeList key and lists those applications that are not published to the host **Start** menu. You can think of the “Exclude List” as permanently unpublishing the specified applications because any automatic updates to the applications that are listed will not cause them to be automatically republished. - -## Managing Applications by Using the Exclude List in Windows Virtual PC - - -**** - -1. Open the MED-V workspace in full screen. - - For information about opening the MED-V workspace in full-screen mode by using the MED-V Administration Toolkit, see [Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md#bkmk-fullscreen). Or you can manually open it in full screen by clicking **Start**, click **All Programs**, click **Windows Virtual PC**, click **Windows Virtual PC**, and then double-click the MED-V workspace. - -2. In the MED-V workspace Windows Virtual PC window, open Registry Editor. - - Click **Start**, click **Run**, and then type regedit. Then click **OK**. - -3. In Registry Editor, locate the HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Virtual Machine\\VPCVAppExcludeList registry key. - -4. Create a new registry value for the installed application that you do not want published to the host computer **Start** menu. For example, if you want to unpublish the automatically published program Microsoft Silverlight, follow these steps: - - 1. With the VPCVAppExcludeList registry key highlighted, click **Edit**, click **New**, and then click **String Value**. - - 2. Enter the name for the new registry value. For example, for Microsoft Silverlight, you might enter sllauncher.exe. - - 3. Double-click the new registry value and enter the value data. - - The value data is the full path for the command that you want to unpublish. You can find the full path by right-clicking on the shortcut on the **Start** menu for the application that you do not want published and then clicking **Properties**. The full path is listed in the **Shortcut** tab under **Target**. - - For example, for the program Microsoft Silverlight, the full path might be "C:\\Program Files\\Microsoft Silverlight\\4.0.50917.0\\Silverlight.Configuration.exe." - - **Important**   - If applicable, remove the quotation marks from the full path when you enter it into the value data field. - - - -5. Close Registry Editor and restart the MED-V workspace virtual machine. - - The application is still installed in the MED-V workspace but is now removed from the host computer **Start** menu. - -You can also republish an excluded application to the host **Start** menu by deleting the corresponding value from the VPCVAppExcludeList key. For example, to republish Microsoft Silverlight, right-click the registry value sllauncher.exe and select **Delete**. - -## Related topics - - -[Technical Reference for MED-V](technical-reference-for-med-v.md) - -[How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md) - - - - - - - - - diff --git a/mdop/softgrid-application-virtualization.md b/mdop/softgrid-application-virtualization.md deleted file mode 100644 index 9951bcd5f1..0000000000 --- a/mdop/softgrid-application-virtualization.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: SoftGrid Application Virtualization -description: SoftGrid Application Virtualization -author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: manage -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 -ms.reviewer: -manager: dansimp -ms.author: dansimp ---- - -# SoftGrid Application Virtualization - -Selecting the link for [SoftGrid Application Virtualization documentation](https://technet.microsoft.com/library/bb906040.aspx) will take you to another website. Use your browser's **Back** button to return to this page. diff --git a/mdop/solutions/TOC.md b/mdop/solutions/TOC.md deleted file mode 100644 index dcd2d78a28..0000000000 --- a/mdop/solutions/TOC.md +++ /dev/null @@ -1,7 +0,0 @@ -# [MDOP Solutions and Scenarios](index.md) -## [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md) -## [Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0](virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md) -## [Creating App-V 4.5 Databases Using SQL Scripting](creating-app-v-45-databases-using-sql-scripting.md) -## [Application Publishing and Client Interaction for App-V 5](application-publishing-and-client-interaction-for-app-v-5-solutions.md) -## [How to Download and Deploy MDOP Group Policy (.admx) Templates](how-to-download-and-deploy-mdop-group-policy--admx--templates.md) - diff --git a/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md b/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md deleted file mode 100644 index 93e2506108..0000000000 --- a/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Application Publishing and Client Interaction for App-V 5 -description: Application Publishing and Client Interaction for App-V 5 -author: dansimp -ms.assetid: 9854afdc-00f9-40ec-8275-d168e5151286 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Publishing and Client Interaction for App-V 5 - - -This article has been moved to [Application Publishing and Client Interaction](../appv-v5/application-publishing-and-client-interaction.md) in the App-V 5.0 library. - -The article describes how the following App-V client operations affect the local operating system: - -- App-V Files and Data Storage Locations - -- Package Registry - -- App-V Package Store Behavior - -- Roaming Registry and Data - -- App -V Client Application Lifecycle Management - -- Integration of App-V Packages - -- Dynamic Configuration - -- Side by Side Assemblies - -- Client Logging - -  - -  - - - - - diff --git a/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md b/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md deleted file mode 100644 index 860cc5c118..0000000000 --- a/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md +++ /dev/null @@ -1,258 +0,0 @@ ---- -title: Creating App-V 4.5 Databases Using SQL Scripting -description: Creating App-V 4.5 Databases Using SQL Scripting -author: dansimp -ms.assetid: 6cd0b180-163e-463f-a658-939ab9a7cfa1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Creating App-V 4.5 Databases Using SQL Scripting - - -**Who is this solution intended for?** Information technology professionals who manage Application Virtualization (App-V) 4.5 databases. - -**How can this guide help you?** This solution explains and documents the procedure to install the Microsoft Application Virtualization Server when the administrator installing does not have “sysadmin” privileges to the SQL Server. - -## Overview - - -One of the challenges of installing Microsoft Application Virtualization 4.5 (App-V) is that the install program assumes that the user installing the server features will not only be a local computer administrator, but also have SQL administrator privileges on the SQL server that will host the Data Store. This requirement is based on the fact that the database, as well as the appropriate roles and permissions, are created as part of the install. However, in most enterprises, SQL servers are managed separately from the infrastructure team who will be installing App-V. These security requirements will make it difficult to get SQL administrators to give the infrastructure administrator installing App-V adequate rights; similarly, the SQL administrators will not have the required privileges to install the product for the infrastructure team. - -Currently, an administrator attempting the installation of App-V must have SQL “sysadmin” privileges. In previous versions of the product the setup allowed for the SQL administrators to either create a temporary “sysadmin” account or be present during installation to provide credentials with “sysadmin” privileges. In this release, scripts are provided in the released product for all administrators to use when implementing their infrastructure. - -This whitepaper discusses the scenario in which the install will need to be divided into two separate tasks: creating the SQL database, and installing the App-V server features. The SQL administrators would be able to review the SQL scripts and make modifications to resolve any conflicts with other databases, or to support integration with other tools. The result of the scripts is to allow SQL administrators to prepare the database so that the infrastructure administrators do not have to be granted any advanced rights on the SQL server. This is important in environments where security policies would prohibit this. - -### SQL Database Creation Process - -The SQL scripts allow for SQL administrators to create the required database and also set up the privileges for the App-V administrators to successfully install and manage the environment. The steps for completing these tasks are listed later in this document. - -This process separates the database creation and configuration actions from the actual App-V installation. - -**Information to be provided to SQL administrators** - -- Name of AD group that is going to be the App-V admin’s - -- Name of the server where App-V Management Server will be installed - -**Information to be returned to the Infrastructure administrators** - -- Name of the database server or instance and the name of the App-V database - -Once the database has been prepared, the App-V administrators can run the App-V installation without SQL administrator privileges. - -### Using the SQL Setup Scripts - -**Requirements** - -The following is a list of requirements for using the scripts which are located in the support\\createdb folder at the root of the selected extract location. - -- Scripts must be copied to a writeable location on the computer where they will be run (be sure to remove the read only attribute from these scripts after they have been copied) and SQL client tools must be loaded on that computer (osql is only required for running the sample batch files on the local computer). - -- The SQL Server must support Windows Authentication. - -- Ensure that the SQL Server Instance and SQL Agent Service are running. - -- Log on with a domain account that is a SQL administrator (sysadmin) on the computer where the scripts will be done. - -The scripts runs under the logged-on user’s domain credentials. - -**Database Creation Using SQL Scripts** - -**Tasks to be performed by SQL administrators:** - -1. Copy the scripts contained in the support\\createdb folder from the root of the selected extract location to the computer where the scripts will be run. The following files are required for the scripts to run properly and must be called in the order presented below. - - - database.sql - - - roles.sql - - - table\_CODES.sql - - - functions\_before\_tables.sql - - - tables.sql - - - functions.sql - - - views.sql - - - procedures.sql - - - triggers.sql - - - data\_codes.sql - - - data\_messages.sql - - - data\_defaults.sql - - - alerts\_jobs.sql - - - dbversion.sql - -2. Review and modify, if necessary, the `database.sql` file. The default settings will name the database “APPVIRTDB.” - - - If necessary replace instances of `APPVIRTDB` with the `database name` that will be used. - - - Modify the `FILENAME` property in the script with the appropriate path for the SQL Server where the database will be created. - -3. Review and modify, if necessary, the `database name [APPVIRTDB]` in the `roles.sql` file that was used in the database.sql file. - -**** - -### Example of how to automate the process using batch files - -If used, the two sample batch files provided run the SQL scripts in the following manner: - -1. **Create\_schema.bat (1)** - - - database.sql - - - roles.sql - -2. **Create\_tables.bat (2)** - - - table\_CODES.sql - - - functions\_before\_tables.sql - - - tables.sql - - - functions.sql - - - views.sql - - - procedures.sql - - - triggers.sql - - - data\_codes.sql - - - data\_messages.sql - - - data\_defaults.sql - - - alerts\_jobs.sql - - - dbversion.sql - -**Note** -Careful consideration when modifying the scripts must be taken and should only be done by someone with the appropriate knowledge. Also, of the sample files presented only the following should be changed: **create\_schema.bat**, **create\_tables.bat**, **database.sql**, and **roles.sql**. All other files should not be modified in any way as this could cause the database to be created incorrectly, which will lead to the failure of App-V services to be installed. - - - -The two sample batch files must be placed in the same directory where the rest of the SQL scripts were copied to on the computer. - -1. Run the sample **create\_schema.bat** file to create the database. This script will take several seconds to complete and should not be interrupted. - - - Run the create schema.bat file from the directory where it was copied to. Syntax is: “Create\_schema.bat `SQLSERVERNAME`” - - ![AppV46SQLcreatebat](images/appv46sqlcreatebat.bmp) - - - If this script fails during the creation of the new “APPVIRTDB” database, check the log as indicated to correct the issue. It will be necessary to delete the database that was created with a partial running of the scripts in order to ensure that subsequent attempts will work properly. - -2. Run the `create_tables.bat` file to create the tables in the database. This script will take several seconds to complete and should not be interrupted. - - - Run the create\_tables.bat file from the directory where it was copied. Syntax is: “create\_tables.bat `SQLSERVERNAME DBNAME`” - - ![app-v 4.6 sql create\-table.bat](images/appv46sqlcreate-tablebat.gif) - - If the script fails during the creation of the tables, check the log as indicated to correct the issue. It will be necessary to delete the database and run create\_schema.bat before attempting to run the create\_tables.bat file on all subsequent attempts. - -### Setting permissions on the App-V database - -The following accounts will need to be created on the SQL server with specific permissions and roles to the new database for the installation, deployment and ongoing administration of the App-V environment. - -- Create a login for the App-V administrators group on the SQL Server and the APPVIRTDB database for the “domain\\App-V Admins” (where “domain” and “App-V Admins” will be changed to reflect your own environment) and add them to the SFTAdmin and SFTEveryone database role. - - ![app-v 4.6 sql script set permissions and roles](images/appv46sqlscriptsetpermsroles.gif) - -- Grant this group “VIEW ANY DEFINITION” permission at the global level (This allows the Microsoft Application Virtualization Management Server setup process to verify that the Management Server login already exists). Under MS-SQL 2005 and above access restrictions to the metadata contained in master.db were added. The user created in the previous step will by default not have the rights needed by the server installation. Open the properties of the previously created login, Login Properties->Securables. Add the Database instance and enable “GRANT” for “View any definition” as shown in the screenshot below. - - ![app-v 4.6 sql script grant perm for view any def](images/appv46sqlscriptviewanydef.gif) - -- Add a role to the ROLE\_ASSIGNMENTS table for the login created in the previous step to allow App-V administrators access to the Application Virtualization Management Console, with role = “ADMIN” and group\_ref = “domain\\App-V Admins” (where “domain” and “App-V Admins” will be changed to reflect your own environment). - - ![app-v 4.6 sql script role assignment](images/appv46sqlscriptroleassign.gif) - -- Create login for SQL Server and App-V database for the Management Server. This account is used by the Microsoft Application Virtualization Management Server to connect to the data store and is responsible for servicing client requests for streamed applications. There are two options, depending on where the SQL Server and Management Server are to be installed: - - 1. If Management Server and SQL Server are going to be installed on the same computer, add a login for NT AUTHORITY\\NETWORK SERVICE and add it to the SFTUser and SFTEveryone database roles. - - 2. If the Management Server and SQL Server are to be installed on different computers, add a login for “domain\\App-V Server Name$” (where “App-V Server Name” is the name of the server where the App-V Management Server will be installed) and add it to the SFTUser and SFTEveryone database roles. - -- Open the query window on the SQL window and run the following SQL: - - ``` syntax - USE APPVIRTDB - GRANT ALTER ON ROLE::SFTuser TO “domain\App-V Admins” - ``` - - Where the APPVIRTDB is the name of the App-V Database created on the SQL Server in the previous step, and the user who is going to do the install of the App-v server needs to be a member of “domain\\App-V Admins” (where “domain” and “App-V Admins” will be changed to reflect your own environment). - -### Tasks to be performed by the Infrastructure administrators - -1. Administrator in the “App-V Admins” group should install App-V. - - Use information from the SQL administrators for selecting the SQL Server and database created in the previous steps. - -2. Administrator in the “App-V Admins” group logs in to Application Virtualization Management Console and deletes the following objects from the Management Console. - - **Warning** - This is required as the traditional setup populates certain records in the database that are not populated if you run the install against an already existing database. Delete the following objects: - - - Under “Server Groups,” “Default Server Group,” delete “Application Virtualization Management Server” - - - Under “Server Groups,” delete “Default Server Group” - - - Under “Provider Policies,” delete “Default Provider” - - - -3. Administrator in the App-V admins group should then create: - - - Under “Provider Policies,” create a New Provider Policy - - - Create a “Default Server Group” - - **Note** - You must create a “Default Server” group even if you will not be used. The server installer only looks for the "Default Server Group" when trying to add the server. If there is no "Default Server Group" then the installation will fail. If you plan on using server groups other than the default that is fine, it’s just necessary to retain the "Default Server Group" if you plan on adding subsequent App-V Management Servers to your infrastructure. - - - -~~~ -- Assign the App-V Users Group to the New Provider Policy created above - -- Under “Server Groups,” create a New Server Group, specifying the New Provider Policy - -- Under the New Server group, create a New Application Virtualization Management Server - - **Important** - Do not restart the service before completing all of the above steps! - - - -- Administrator restarts the Application Virtualization Management Server service. -~~~ - -## Conclusion - - -In conclusion, the information in this document allows an administrator to work with the SQL administrators to develop a deployment path that works for the security and administrative divisions in an organization. After reading this document and testing the tasks documented, an administrator should be ready to implement their App-V infrastructure in this type of environment. - - - - - - - - - diff --git a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md b/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md deleted file mode 100644 index 5be26f09e4..0000000000 --- a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md +++ /dev/null @@ -1,153 +0,0 @@ ---- -title: How to Download and Deploy MDOP Group Policy (.admx) Templates -description: How to Download and Deploy MDOP Group Policy (.admx) Templates -author: dansimp -ms.assetid: fdb64505-6c66-4fdf-ad74-a6a161191e3f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/15/2018 ---- - - -# How to Download and Deploy MDOP Group Policy (.admx) Templates - - -You can manage the feature settings of certain Microsoft Desktop Optimization Pack (MDOP) technologies (for example, App-V, UE-V, or MBAM) by using Group Policy templates, the .admx and .adml files. MDOP Group Policy templates are available for download in a self-extracting, compressed file, grouped by technology and version. - -## MDOP Group Policy templates - -**How to download and deploy the MDOP Group Policy templates** - -1. Download the latest [MDOP Group Policy templates](https://www.microsoft.com/download/details.aspx?id=55531) - -2. Expand the downloaded .cab file by running `expand \MDOP_ADMX_Templates.cab -F:* ` - - **Warning** - Do not extract the templates directly to the Group Policy deployment directory. Multiple technologies and versions are bundled in this file. - -3. In the extracted folder, locate the technology-version .admx file. Certain MDOP technologies have multiple sets of Group Policy Objects (GPOs). For example, MBAM includes MBAM Management settings and MBAM User settings. - -4. Locate the appropriate .adml file by language-culture (that is, *en-us* for English-United States). - -5. Copy the .admx and .adml files to a policy definition folder. Depending on where you store the templates, you can configure Group Policy settings from the local device or from any computer on the domain. - - - **Local files:** To configure Group Policy settings from the local device, copy template files to the following locations: - - - - - - - - - - - - - - - - - - - - - - -
    File typeFile location

    Group Policy template (.admx)

    %systemroot%<strong>policyDefinitions

    Group Policy language file (.adml)

    %systemroot%<strong>policyDefinitions[MUIculture]

    - - - **Domain central store:** To enable Group Policy settings configuration by a Group Policy administrator from any computer on the domain, copy files to the following locations on the domain controller: - - - - - - - - - - - - - - - - - - - - - - -
    File typeFile location

    Group Policy template (.admx)

    %systemroot%<strong>sysvol\domain\policies\PolicyDefinitions

    Group Policy language file (.adml)

    %systemroot%<strong>sysvol\domain\policies\PolicyDefinitions[MUIculture][MUIculture]

    -

    For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us.

    - -6. Edit the Group Policy settings using Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) to configure Group Policy settings for the MDOP technology. - -### MDOP Group Policy by technology - -For more information about supported MDOP Group Policy, see the specific documentation for the technology. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    MDOP TechnologyVersion bundlesNotes

    Application Virtualization (App-V)

    App-V 5.0 and App-V 5.0 Service Packs

    How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy

    User Experience Virtualization (UE-V)

    UE-V 2.0 and UE-V 2.1

    Configuring UE-V 2.x with Group Policy Objects

    UE-V 1.0 including 1.0 SP1

    Configuring UE-V with Group Policy Objects

    Microsoft BitLocker Administration and Monitoring (MBAM)

    MBAM 2.5

    Planning for MBAM 2.5 Group Policy Requirements

    MBAM 2.0 including 2.0 SP1

    Planning for MBAM 2.0 Group Policy Requirements

    -

    Deploying MBAM 2.0 Group Policy Objects

    MBAM 1.0

    How to Edit MBAM 1.0 GPO Settings

    - - - - - - - - - - - diff --git a/mdop/solutions/images/appv46sqlcreate-tablebat.gif b/mdop/solutions/images/appv46sqlcreate-tablebat.gif deleted file mode 100644 index da105aa8ee..0000000000 Binary files a/mdop/solutions/images/appv46sqlcreate-tablebat.gif and /dev/null differ diff --git a/mdop/solutions/images/appv46sqlcreatebat.bmp b/mdop/solutions/images/appv46sqlcreatebat.bmp deleted file mode 100644 index 4c71e8ab17..0000000000 Binary files a/mdop/solutions/images/appv46sqlcreatebat.bmp and /dev/null differ diff --git a/mdop/solutions/images/appv46sqlscriptroleassign.gif b/mdop/solutions/images/appv46sqlscriptroleassign.gif deleted file mode 100644 index 58d3090997..0000000000 Binary files a/mdop/solutions/images/appv46sqlscriptroleassign.gif and /dev/null differ diff --git a/mdop/solutions/images/appv46sqlscriptsetpermsroles.gif b/mdop/solutions/images/appv46sqlscriptsetpermsroles.gif deleted file mode 100644 index 18dc004aed..0000000000 Binary files a/mdop/solutions/images/appv46sqlscriptsetpermsroles.gif and /dev/null differ diff --git a/mdop/solutions/images/appv46sqlscriptviewanydef.gif b/mdop/solutions/images/appv46sqlscriptviewanydef.gif deleted file mode 100644 index 682cd43de0..0000000000 Binary files a/mdop/solutions/images/appv46sqlscriptviewanydef.gif and /dev/null differ diff --git a/mdop/solutions/index.md b/mdop/solutions/index.md deleted file mode 100644 index 20c7e2da8e..0000000000 --- a/mdop/solutions/index.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: MDOP Solutions and Scenarios -description: MDOP Solutions and Scenarios -author: dansimp -ms.assetid: 1cb18bef-fbae-4e96-a4f1-90cf111c3b5f -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# MDOP Solutions and Scenarios - - -The Solutions for Microsoft Desktop Optimization Pack (MDOP) guide provides documentation that presents example customer scenarios that are solved by using technologies that are part of the MDOP suite. - -## Application Virtualization Solutions - - -- [Deploying Microsoft Office 2013 by Using App-V](../appv-v5/deploying-microsoft-office-2013-by-using-app-v.md) - - This solution explains how to deploy Office 2013 by using App-V 5.0 and includes procedures for customization, upgrading, and licensing for deployment in the enterprise. - -- [Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md) - - This solution explains how to deploy Office 2010 by using App-V 5.0. - -- [Creating App-V 4.5 Databases Using SQL Scripting](creating-app-v-45-databases-using-sql-scripting.md) - - This solution explains and documents the procedure to install the Microsoft Application Virtualization Server when the administrator installing does not have “sysadmin” privileges to the SQL Server. - -- [Application Publishing and Client Interaction](../appv-v5/application-publishing-and-client-interaction.md) - - This solution explains and how the App-V Client processes packages and presents them to users. It includes typical client operations with important locations for data storage, how the publishing refresh process works, and the available integration points with the local operating system. - -- [How to Download and Deploy MDOP Group Policy (.admx) Templates](how-to-download-and-deploy-mdop-group-policy--admx--templates.md) - - You can manage the feature settings of certain Microsoft Desktop Optimization Pack (MDOP) technologies (for example, App-V, UE-V, or MBAM) by using Group Policy templates, the .admx and .adml files. MDOP Group Policy templates are available for download in a self-extracting, compressed file, grouped by technology and version. - -  - -  - - - - - diff --git a/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md b/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md deleted file mode 100644 index ac39025c59..0000000000 --- a/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0 -description: Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0 -author: dansimp -ms.assetid: bd16c20f-cc47-4172-ae16-47b23c9b7f5c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0 - - -This article has been moved to the TechNet Application Virtualization (App-V) 5.0 library and renamed to: - -[Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md) - -  - -  - - - - - diff --git a/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md b/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md deleted file mode 100644 index 83c7defae3..0000000000 --- a/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0 -description: Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0 -author: dansimp -ms.assetid: 742e64de-6ace-4eb4-901a-7a282ca7ae85 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0 - - -This article has been moved to the TechNet Application Virtualization (App-V) 5.0 library and renamed to: - -[Deploying Microsoft Office 2013 by Using App-V](../appv-v5/deploying-microsoft-office-2013-by-using-app-v.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/TOC.md b/mdop/uev-v1/TOC.md deleted file mode 100644 index d52629378d..0000000000 --- a/mdop/uev-v1/TOC.md +++ /dev/null @@ -1,43 +0,0 @@ -# [Microsoft User Experience Virtualization (UE-V) 1.0](index.md) -## [Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) -### [About User Experience Virtualization 1.0](about-user-experience-virtualization-10.md) -#### [Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md) -### [About User Experience Virtualization 1.0 SP1](about-user-experience-virtualization-10-sp1.md) -#### [Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md) -### [High-Level Architecture for UE-V 1.0](high-level-architecture-for-ue-v-10.md) -### [Accessibility for UE-V](accessibility-for-ue-v.md) -## [Planning for UE-V 1.0](planning-for-ue-v-10.md) -### [Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md) -#### [Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) -### [Planning for UE-V Configuration](planning-for-ue-v-configuration.md) -#### [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) -#### [Checklist for Evaluating Line-of-Business Applications for UE-V 1.0](checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md) -#### [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) -#### [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) -### [UE-V Checklist](ue-v-checklist.md) -## [Deploying UE-V 1.0](deploying-ue-v-10.md) -### [Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) -### [Deploying the UE-V Agent](deploying-the-ue-v-agent.md) -### [Installing the UE-V Group Policy ADMX Templates](installing-the-ue-v-group-policy-admx-templates.md) -### [Installing the UE-V Generator](installing-the-ue-v-generator.md) -### [Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md) -### [Deploying UE-V Settings Location Templates for UE-V 1.0](deploying-ue-v-settings-location-templates-for-ue-v-10.md) -## [Operations for UE-V 1.0](operations-for-ue-v-10.md) -### [Administering UE-V 1.0](administering-ue-v-10.md) -#### [Changing the Frequency of UE-V Scheduled Tasks](changing-the-frequency-of-ue-v-scheduled-tasks.md) -#### [Sharing Settings Location Templates with the UE-V Template Gallery](sharing-settings-location-templates-with-the-ue-v-template-gallery.md) -#### [Restoring Application and Windows Settings Synchronized with UE-V 1.0](restoring-application-and-windows-settings-synchronized-with-ue-v-10.md) -#### [Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md) -#### [Migrating UE-V Settings Packages](migrating-ue-v-settings-packages.md) -### [Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) -#### [Create UE-V Settings Location Templates with the UE-V Generator](create-ue-v-settings-location-templates-with-the-ue-v-generator.md) -#### [Edit UE-V Settings Location Templates with the UE-V Generator](edit-ue-v-settings-location-templates-with-the-ue-v-generator.md) -#### [Validate UE-V Settings Location Templates with UE-V Generator](validate-ue-v-settings-location-templates-with-ue-v-generator.md) -### [Administering UE-V with PowerShell and WMI](administering-ue-v-with-powershell-and-wmi.md) -#### [Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md) -#### [Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI](managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md) -### [Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) -#### [UE-V 1.0 Security Considerations](ue-v-10-security-considerations.md) -#### [User Experience Virtualization Privacy Statement](user-experience-virtualization-privacy-statement.md) -## [Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - diff --git a/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md b/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md deleted file mode 100644 index dbed7e3471..0000000000 --- a/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md +++ /dev/null @@ -1,273 +0,0 @@ ---- -title: About User Experience Virtualization 1.0 SP1 -description: About User Experience Virtualization 1.0 SP1 -author: dansimp -ms.assetid: 0212d3fb-e882-476c-9496-9eb52301703d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About User Experience Virtualization 1.0 SP1 - - -Microsoft User Experience Virtualization (UE-V) 1.0 Service Pack 1 changes the version from 1.0.414 to 1.0.520. When the UE-V Agent setup.exe or UE-V Generator setup.exe is launched it will detect the need for an upgrade and will upgrade the UE-V Agent or Generator. - -## Additional Languages Now Supported - - -UE-V 1.0 Service Pack 1 provides updates for both the UE-V Agent and the UE-V Generator supporting additional languages. All supported languages are installed when the setup program runs. The following languages are included in UE-V 1 SP1: - - ---- - - - - - - - - - - - - -
    UE-V AgentUE-V Generator
      -
    • Chinese Simplified (PRC) zh-CN

    • -
    -
      -
    • Chinese Traditional - Taiwan zh-TW

    • -
    -
      -
    • Czech (Czech Republic) cs-CZ

    • -
    -
      -
    • Danish (Denmark) da-DK

    • -
    -
      -
    • Dutch (Netherlands) nl-NL

    • -
    -
      -
    • Finnish (Finland) fi-FI

    • -
    -
      -
    • French (France) fr-FR

    • -
    -
      -
    • German (Germany) de-DE

    • -
    -
      -
    • Greek (Greece) el-GR

    • -
    -
      -
    • Hungarian (Hungary) hu-HU

    • -
    -
      -
    • Italian (Italy) it-IT

    • -
    -
      -
    • Japanese (Japan) ja-JP

    • -
    -
      -
    • Korean (Korea) ko-KR

    • -
    -
      -
    • Norwegian - Norway Bokmal nb-NO

    • -
    -
      -
    • Polish (Poland) pl-PL

    • -
    -
      -
    • Portuguese (Brazil) pt-BR

    • -
    -
      -
    • Portuguese (Portugal) pt-PT

    • -
    -
      -
    • Russian (Russia) ru-RU

    • -
    -
      -
    • Slovak (Slovakia) sk-SK

    • -
    -
      -
    • Slovenian (Slovenia) sl-SL

    • -
    -
      -
    • Spanish, International Sort (Spain) es-ES

    • -
    -
      -
    • Swedish (Sweden) sv-SE

    • -
    -
      -
    • Turkish (Turkey) tr-TR

    • -
    -

      -
    • Chinese Simplified (PRC) zh-CN

    • -
    -
      -
    • Chinese Traditional - Taiwan zh-TW

    • -
    -
      -
    • French (France) fr-FR

    • -
    -
      -
    • German (Germany) de-DE

    • -
    -
      -
    • Italian (Italy) it-IT

    • -
    -
      -
    • Japanese (Japan) ja-JP

    • -
    -
      -
    • Korean (Korea) ko-KR

    • -
    -
      -
    • Portuguese (Brazil) pt-BR

    • -
    -
      -
    • Russian (Russia) ru-RU

    • -
    -
      -
    • Spanish, International Sort (Spain) es-ES

    • -
    - - - -**Important**   -While the UE-V Agent installation program (AgentSetup.exe) and UE-V Generator installation program (ToolSetup.exe) are translated into the languages above, the Windows Installer (.msi) files are only available in English. - - - -## Office 2007 Settings Location Templates - - -The UE-V Agent installation software installs the agent and registers a default group of settings location templates for common Microsoft applications. Microsoft Office 2007 is now part of these applications. There are two Office 2007 templates: MicrosoftOffice2007.xml and MicrosoftCommunicator2007.xml. These settings location templates capture settings in Microsoft Office 2007 for the following applications: - -- Microsoft Access 2007 - -- Microsoft Communicator 2007 - -- Microsoft Excel 2007 - -- Microsoft InfoPath 2007 - -- Microsoft OneNote 2007 - -- Microsoft Outlook 2007 - -- Microsoft PowerPoint 2007 - -- Microsoft Project 2007 - -- Microsoft Publisher 2007 - -- Microsoft SharePoint Designer 2007 - -- Microsoft Visio 2007 - -- Microsoft Word 2007 - -### Office 2010 Settings Location Templates Updates - -An update to the Settings Location Templates has also been made. Those changes include: - -- Added support for Microsoft SharePoint Designer 2010 by adding a new template to the Office 2010 templates (MicrosoftOffice2010Win32.xml and MicrosoftOffice2010Win64.xml) - -- Minor bug fixes, including Customize Status Bar – Word, Excel, and PowerPoint - -## Scheduled Task for Catalog Updates is now randomized - - -The Template Auto Update task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The Template Auto Update task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent install directory and with UE-V SP1 has been changed to randomize the update over a one hour period. - -## Support for Citrix EdgeSight - - -There was a conflict discovered with UE-V running on a server with Citrix EdgeSight. UE-V 1.0 SP1 resolves this issue. - -## Indexing of Internet Explorer favorites - - -When UE-V roams Internet Explorer favorites from one computer to another computer, the indexing of favorite addresses in the address bar on the synced computer is now updated. When a user types in the address bar, the roamed favorites now appear as available search result on synced computers. - -## New setup.exe command line parameters for UE-V Agent and UE-V Generator - - -With the release of UE-V 1.0 SP1, the setup.exe for both the UE-V Agent and the UE-V Generator have been updated to allow the following additional command line parameters: - -1. `CEIPENABLED` – Allows setup to accept the option to be included in the Microsoft Customer Experience Improvement Program. - -2. `INSTALLFOLDER` – Allows a different installation folder to be set for the Agent or Generator. - -3. `MUENABLED` – Allows setup to accept the option to be included in the Microsoft Update program. - -## New error codes for setup - - -When running the UE-V setup for UE-V Agent (AgentSetup.exe), the following return codes can be viewed in the install log “/log <log.txt>.” - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    0

    Setup completed successfully.

    2

    An older version of UE-V was used in attempting to uninstall. To uninstall UE-V, use the same version of UE-V that was used to install.

    3

    A newer version of UE-V was used to uninstall. To uninstall UE-V, use the same version of UE-V that was used to install.

    4

    Unexpected error from the setup program.

    5

    The Full version of UE-V cannot be installed on top of the Trial (Evaluation) version. Uninstall the Trial version and try again.

    6

    Unexpected error during installation.

    7

    The .NET 3.5 Framework was not found on Windows 7 or Windows Server2008 R2 computer.

    8

    The Offline Files feature is not enabled.

    9

    The UE-V setup program cannot determine whether UE-V is already installed or there was an error in the setup file.

    - - - - - - - - - - - diff --git a/mdop/uev-v1/about-user-experience-virtualization-10.md b/mdop/uev-v1/about-user-experience-virtualization-10.md deleted file mode 100644 index 30ca82aab4..0000000000 --- a/mdop/uev-v1/about-user-experience-virtualization-10.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: About User Experience Virtualization 1.0 -description: About User Experience Virtualization 1.0 -author: dansimp -ms.assetid: 3758b100-35a8-4e10-ac08-f583fb8ddbd9 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# About User Experience Virtualization 1.0 - - -Microsoft User Experience Virtualization (UE-V) monitors the changes that are made by users to application settings and Windows operating system settings. The user settings are captured and centralized to a settings storage location. These settings can then be applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -User Experience Virtualization uses settings location templates to specify what applications and Windows settings on the user computers are monitored and centralized. The settings location template is an XML file that specifies which file and registry locations are associated with each application or operating system setting. The template does not contain values for the settings; it contains only the locations of the settings that are to be monitored. - -The application settings and Windows settings are monitored by UE-V when users are working on their computers. The values for the application settings are stored on the settings storage server when the user closes the application. The values for the Windows settings are stored when the user logs off, when the computer is locked, or when they disconnect remotely from a computer. - -An administrator can create a UE-V settings location template to specify which enterprise application settings will roam. UE-V includes a set of settings location templates for some Microsoft applications and Windows settings. For a list of default applications and settings in UE-V, see [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md). - -## UEV 1.0 Release Notes - - -For more information, and for late-breaking news that did not make it into the documentation, see [Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md). - -## Related topics - - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[High-Level Architecture for UE-V 1.0](high-level-architecture-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/accessibility-for-ue-v.md b/mdop/uev-v1/accessibility-for-ue-v.md deleted file mode 100644 index 25be013a5c..0000000000 --- a/mdop/uev-v1/accessibility-for-ue-v.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Accessibility for UE-V -description: Accessibility for UE-V -author: dansimp -ms.assetid: 059a76e5-bcf0-4459-b5d2-8b71ff2ef433 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for UE-V - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -You can access most commands by using two keystrokes. To use an access key: - -1. Press ALT. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter shown in the keyboard shortcut over the feature that you want to use. - -**Note**   -To cancel the action that you are taking and hide the keyboard shortcuts, press ALT. - - - -### Documentation in alternative formats - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally, formerly known as Recording for the Blind & Dyslexic, Inc. Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, contact: - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here.

    - - - -### Customer service for people with hearing impairments - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time that the service is used. - -## For more information - - -For more information about how accessible technology for computers can help to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/p/?linkid=8431). - -## Related topics - - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/administering-ue-v-10.md b/mdop/uev-v1/administering-ue-v-10.md deleted file mode 100644 index d0cfef26e9..0000000000 --- a/mdop/uev-v1/administering-ue-v-10.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Administering UE-V 1.0 -description: Administering UE-V 1.0 -author: dansimp -ms.assetid: c399ae8d-c839-4f84-9bfc-adacd8f89f34 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering UE-V 1.0 - - -After you have deployed Microsoft User Experience Virtualization (UE-V), you must be able to perform various ongoing administrative tasks. These post-installation tasks are described in the following sections. - -## Managing UE-V resources - - -In the course of the UE-V lifecycle, you will need to manage the configuration of the UE-V agent and also manage storage locations for resources such as settings packages. You might need to perform other tasks such as to restore a user’s settings to their original state from before UE-V was installed in order to recover lost settings. The following topics provide guidance for managing UE-V resources. - -### Changing the Frequency of UE-V Scheduled Tasks - -You can configure the scheduled tasks that manage when UE-V checks for new, updated, or removed custom settings location templates in the settings template catalog. - -[Changing the Frequency of UE-V Scheduled Tasks](changing-the-frequency-of-ue-v-scheduled-tasks.md) - -### Sharing Settings Location Templates with the UE-V Template Gallery - -The UE-V template gallery facilitates the sharing of UE-V settings location templates. The gallery enables you to upload your settings location templates to share with other people and to download templates that other people have created. - -[Sharing Settings Location Templates with the UE-V Template Gallery](sharing-settings-location-templates-with-the-ue-v-template-gallery.md) - -### Restoring application and Windows settings synchronized with UE-V 1.0 - -WMI and PowerShell features of UE-V provide the ability to restore settings packages. WMI and PowerShell commands allow you to restore application settings and Windows settings to the settings values that were on the computer the first time the application was started after the UE-V agent was launched. - -[Restoring Application and Windows Settings Synchronized with UE-V 1.0](restoring-application-and-windows-settings-synchronized-with-ue-v-10.md) - -### Configuring UE-V with Group Policy Objects - -You can use Group Policy to modify the settings that define how UE-V synchronizes settings on computers. - -[Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md) - -### Administering UE-V with PowerShell and WMI - -You can use PowerShell and WMI to modify the settings that define how UE-V synchronizes settings on computers. - -[Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md) - -### Migrating UE-V Settings Packages - -You can relocate the user settings packages either when migrating to a new server or for backup purposes. - -[Migrating UE-V Settings Packages](migrating-ue-v-settings-packages.md) - -## Other resources for this product - - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md b/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md deleted file mode 100644 index 1c64c98eb7..0000000000 --- a/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Administering UE-V with PowerShell and WMI -description: Administering UE-V with PowerShell and WMI -author: dansimp -ms.assetid: 26cc864f-c628-4c04-a18c-dd60fce8187c -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering UE-V with PowerShell and WMI - - -Microsoft User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets which can help administrators perform various UE-V tasks. The following sections provide more information about using PowerShell with UE-V. - -## Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI - - -You can use PowerShell and WMI to manage Microsoft User Experience Virtualization (UE-V) Agent configuration and synchronization behavior. - -[Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md) - -## Managing UE-V 1.0 Settings Location Templates with PowerShell and WMI - - -After you create and deploy UE-V settings location templates you can manage those templates using PowerShell or WMI. - -[Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI](managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md) - -## Other resources for this product - - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md b/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md deleted file mode 100644 index d063140038..0000000000 --- a/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Changing the Frequency of UE-V Scheduled Tasks -description: Changing the Frequency of UE-V Scheduled Tasks -author: dansimp -ms.assetid: 33c2674e-0df4-4717-9c3d-820a90b16e19 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Changing the Frequency of UE-V Scheduled Tasks - - -The Microsoft User Experience Virtualization (UE-V) Agent installer, AgentSetup.exe, creates two scheduled tasks during the UE-V Agent installation. The two tasks are the **Template Auto Update** task and the **Setting Storage Location Status** task. These scheduled tasks are not configurable with the UE-V tools. Administrators who wish to change the scheduled task for these items can create a script that uses the Schtasks.exe command-line options. - -For more information about Schtasks.exe, see [How to use Schtasks,exe to Schedule Tasks in Windows Server 2003](https://go.microsoft.com/fwlink/?LinkID=264854). - -## Template Auto-Update - - -The **Template Auto Update** task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The **Template Auto Update** task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent install directory. - - ---- - - - - - - - - - - - - -
    Task nameDefault trigger

    \Microsoft\UE-V\Template Auto Update

    3:30 AM every day

    - -  - -**Example:** The following command configures the agent to check the settings template catalog store every hour. - -``` syntax -schtasks /change /tn "Microsoft\UE-V\Template Auto Update" /ri 60 -``` - -## Settings Storage Location Status - - -The **Setting Storage Location Status** task performs the following actions: - -1. Checks to make sure the UE-V folders are still pinned or registered with the offline files feature. - -2. Checks whether the settings storage location is offline or online. - -3. Forces a synchronization on the specified interval instead of the default interval for offline files. - -4. Synchronizes any settings packages that are configured to be pre-fetched. - -5. Checks if the Active Directory home directory path has changed. - -6. Writes the current settings storage configuration under the following location - - - - - - - - - - - - - - - - - - -
    Task nameDefault trigger

    \Microsoft\UE-V\Settings Storage Location Status

    At logon of any user – After triggered, repeat every 30 minutes indefinitely.

    - -   - -**Example:** The following command configures the agent to run the action above every hour. - -``` syntax -schtasks /change /tn "\Microsoft\UE-V\Settings Storage Location Status" /ri 60 -``` - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md b/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md deleted file mode 100644 index 350d61d863..0000000000 --- a/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Checklist for Evaluating Line-of-Business Applications for UE-V 1.0 -description: Checklist for Evaluating Line-of-Business Applications for UE-V 1.0 -author: dansimp -ms.assetid: 3bfaab30-59f7-4099-abb1-d248ce0086b8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Checklist for Evaluating Line-of-Business Applications for UE-V 1.0 - - -To evaluate which line-of-business applications should be included in your UE-V deployment, consider the following: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Description
    Checklist box

    Does this application contain settings that the user can customize?

    Checklist box

    Is it important for the user that these settings roam?

    Checklist box

    Are these user settings already managed by an application management or settings policy solution? UE-V applies application settings at application launch and Windows settings at logon, unlock, or remote connect events. If you use UE-V with other settings policy solutions, users might experience inconsistency across roamed settings.

    Checklist box

    Are the application settings specific to the computer? Application preferences and customizations that are associated with hardware or specific computer configurations do not consistently roam across sessions and can cause a poor application experience.

    Checklist box

    Does the application store settings in the Program Files directory or in the file directory that is located in the Users \ [User name] \ AppData \ LocalLow directory? Application data that is stored in either of these locations usually should not roam with the user, because this data is specific to the computer or because the data is too large to roam.

    Checklist box

    Does the application store any settings in a file that contains other application data that should not roam? UE-V synchronizes files as a single unit. If settings are stored in files that include application data other than settings, then synchronizing this additional data may cause a poor application experience.

    Checklist box

    How large are the files that contain the settings? The performance of the settings synchronization can be affected by large files. Including large files can impact the performance of settings synchronization.

    - -  - -## Related topics - - -[Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md b/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md deleted file mode 100644 index 37690af84f..0000000000 --- a/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Configuring UE-V with Group Policy Objects -description: Configuring UE-V with Group Policy Objects -author: dansimp -ms.assetid: 5c9be706-a05f-4397-9a38-e6b73ebff1e5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring UE-V with Group Policy Objects - - -Some Microsoft User Experience Virtualization (UE-V) Group Policy settings can be defined for computers and others can be defined for users. UE-V agent configuration policy settings can be defined for computers or users. For information about how to install UE-V Group Policy ADMX files, see [Installing the UE-V Group Policy ADMX Templates](installing-the-ue-v-group-policy-admx-templates.md). - -The following policy settings can be configured for UE-V: - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Policy setting name

    Target

    Policy setting description

    Configuration options

    Use User Experience Virtualization (UE-V)

    Computers and Users

    This policy setting allows you to enable or disable User Experience Virtualization (UE-V).

    Enable or disable this policy setting.

    Settings storage path

    Computers and Users

    This policy setting configures where the user settings will be stored.

    Provide a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.

    Settings template catalog path

    Computers Only

    This policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog will be used to replace the default Microsoft templates that are installed with the UE-V agent.

    Provide a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.

    -

    -

    Select the check box to replace the default Microsoft templates.

    Do not use Offline Files

    Computers and Users

    This policy setting allows you to configure whether UE-V will use the Windows Offline Files feature. This policy setting also allows you to enable notification to occur when the import of user settings is delayed.

    To configure the UE-V Agent to not use offline files, enable this setting.

    -

    -

    Specify if notifications should be given when settings import is delayed.

    -

    -

    Specify the length of time in seconds to wait before the notification appears.

    Synchronization timeout

    Computers and Users

    This policy setting configures the number of milliseconds that the computer waits before a timeout when retrieving user settings from the remote settings location. If the remote storage location is unavailable, the application launch is delayed by this many milliseconds.

    Specify the preferred synchronization timeout in milliseconds. The default value of 2000 milliseconds.

    Package size warning threshold

    Computers and Users

    This policy setting allows you to configure the UE-V agent to report when a settings package file size reaches a defined threshold.

    Specified the preferred threshold for settings package sizes in kilobytes.

    -

    By default, the UE-V agent does not have a package file size threshold.

    Roaming Application settings

    Users Only

    This policy setting configures the roaming of user settings of applications.

    Select which Windows settings will roam between computers.

    -

    By default, the user settings of applications with settings template provided by UE-V are roamed between computers.

    Roaming Windows settings

    Users Only

    This policy setting configures the roaming of Windows settings.

    Select which applications will roam between computers.

    -

    By default, Windows themes are roamed between computers of the same operating system version. Windows desktop settings and Ease of Access settings are not roamed.

    - - - -**To configure computer-targeted policies** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) on the domain controller computer that manages Group Policy for UE-V computers. Navigate to **Computer configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the policy setting to be edited. - -**To configure user-targeted policies** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) tool in Microsoft Desktop Optimization Pack (MDOP) on the domain controller computer that manages Group Policy for UE-V. Navigate to **User configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the policy setting edited. - -The UE-V agent uses the following order of precedence to determine synchronization. - -**Order of precedence for UE-V settings** - -1. User-targeted settings managed by Group Policy - These configuration settings are stored in the registry key by Group Policy under `HKEY_CURRENT_USER\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -2. Computer-targeted settings managed by Group Policy - These configuration settings are stored in the registry key by Group Policy under `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -3. Configuration settings defined by the current user using PowerShell or WMI - These configuration settings are stored by the UE-V agent under this registry location: `HKEY_CURRENT_USER\Software\Microsoft\Uev\Agent\Configuration`. - -4. Configuration settings defined for the computer using PowerShell or WMI. These configuration settings are stored by the UE-V agent under the `HKEY_LOCAL_MACHINE \Software\Microsoft\Uev\Agent\Configuration`. - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md b/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md deleted file mode 100644 index 7c342a42af..0000000000 --- a/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md +++ /dev/null @@ -1,125 +0,0 @@ ---- -title: Create UE-V Settings Location Templates with the UE-V Generator -description: Create UE-V Settings Location Templates with the UE-V Generator -author: dansimp -ms.assetid: b8e50e2f-0cc6-4f74-bb48-c471fefdc7d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Create UE-V Settings Location Templates with the UE-V Generator - - -Microsoft User Experience Virtualization (UE-V) uses *settings location templates* to roam application settings between user computers. Some standard settings location templates are included with User Experience Virtualization. You can also create, edit, or validate custom settings location templates with the UE-V Generator. - -The UE-V Generator monitors an application to discover and capture the locations where the application stores its settings. The application that is being monitored must be a traditional application. The UE-V Generator cannot create a settings location template from the following application types: - -- Virtualized applications - -- Application offered through terminal services - -- Java applications - -- Windows 8 applications - -**Note**   -UE-V templates cannot be created from virtualized applications or terminal services applications. However, settings synchronized using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and terminal services applications, open a Windows Installer File (.msi) version of the application with UE-V Generator. - - - -**Excluded Locations** - -The discovery process excludes locations which commonly store application software files that do not roam well between user computers or environments. The following are excluded: - -- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values - -- HKEY\_CURRENT\_USER registry keys and files associated with the core functionality of the Windows operating system - -- All registry keys located in the HKEY\_LOCAL\_MACHINE hive - -- Files located in Program Files directories - -- Files located in Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files located in %systemroot% - -If registry keys and files stored in these excluded locations are required in order to roam application settings, administrators can manually add the locations to the settings location template during the template creation process. - -## Create UE-V templates - - -Use the UE-V Generator to create settings location templates for line-of-business applications or other applications. After the template for an application is created, you can deploy the template to computers so users can roam the settings for that application. - -**To create a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Create a settings location template**. - -3. Specify the application. Browse to the file path of the application (.exe) or the application shortcut (.lnk) for which you want to create a settings location template. Specify the command line arguments, if any, and working directory, if any. Click **Next** to continue. - - **Note**   - Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings. - - - -4. After the application starts, close the application. The UE-V Generator records the locations where the application stores its settings. - -5. After the process is complete, click **Next** to continue. - -6. Review and select the check boxes next to the appropriate registry settings locations and settings file locations to roam for this application. The list includes the following two categories for settings locations: - - - **Standard**: Application settings that are stored in the registry under the HKEY\_CURRENT\_USER keys or in the file folders under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming**. The UE-V Generator includes these settings by default. - - - **Nonstandard**: Application settings that are stored outside the locations specified in the best practices for settings data storage (optional). These include files and folders under **Users** \\ \[User name\] \\ **AppData** \\ **Local**. Review these locations to determine whether to include them in the settings location template. Select the locations check boxes to include them. - - Click **Next** to continue. - -7. Review and edit any **Properties**, **Registry** locations, and **Files** locations for the settings location template. - - - Edit the following properties on the **Properties** tab: - - - **Application Name**: The application name written in the description of the program files properties. - - - **Program name**: The name of the program taken from the program file properties. This name usually has the .exe extension. - - - **Product version**: The product version number of the .exe file of the application. This property, in conjunction with the File version, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template will apply to all versions of the product. - - - **File version**: The file version number of the.exe file of the application. This property, in conjunction with the Product version, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template will apply to all versions of the program. - - - **Template author name** (optional): The name of the settings location template author. - - - **Template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. Edit the registry locations by use of the **Tasks** drop-down menu. Tasks include adding new keys, editing the name or scope of existing keys, deleting keys, and browsing the registry where the keys are located. Use the **All Settings** scope to include all the registry settings under the specified key. Use the **All Settings and Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations included in the settings location template. Edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations include adding new files or folder locations, editing the scope of existing files or folders, deleting files or folders, and opening the selected location in Windows Explorer. Leave the file mask empty to include all files in the specified folder. - -8. Click **Create** and save the settings location template on the computer. - -9. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you have created the settings location template for an application, you should test the template. Deploy the template in a lab environment before putting it into production in the enterprise. - -## Related topics - - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md b/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md deleted file mode 100644 index 485a0704eb..0000000000 --- a/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: Deploying the Settings Storage Location for UE-V 1.0 -description: Deploying the Settings Storage Location for UE-V 1.0 -author: dansimp -ms.assetid: b187d44d-649b-487e-98d3-a61ee2be8c2f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the Settings Storage Location for UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) deployment requires a settings storage location where the user settings are stored in a settings package file. The settings storage location can be configured in one of the following two ways: - -- **Active Directory home directory** – if a home directory is defined for the user in Active Directory, the UE-V agent will use this location to store settings location packages. The UE-V agent dynamically creates the user-specific storage folder below the root of the home directory. The agent only uses the home directory of the Active Directory if a settings storage location is not defined. - -- **Create a settings storage share** – the settings storage share is a standard network share that is accessible by UE-V users. - -## Deploy a UE-V settings storage share - - -When you create the settings storage share, you should limit access only to users that need access. The necessary permissions are shown in the tables below. - -**To deploy the UE-V network share** - -1. Create a new security group for UE-V users. - -2. Create a new folder on the centrally located computer that will store the UE-V settings packages, and then grant the UE-V users with group permissions to the folder. The administrator supporting UE-V will need permissions to this shared folder. - -3. Set the following share-level (SMB) permissions for the setting storage location folder: - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissions

    Everyone

    No Permissions

    Security group of UE-V users

    Full Control

    - - - -4. Set the following NTFS permissions for the settings storage location folder: - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissionsFolder

    Creator/Owner

    Full Control

    Subfolders and Files Only

    Security group of UE-V users

    List Folder/Read Data, Create Folders/Append Data

    This Folder Only

    - - - -5. Click **OK** to close the dialog boxes. - -This permission configuration allows users to create folders for settings storage. The UE-V agent creates and secures a `settingspackage` folder while running in the context of the user. The user receives full control to their `settingspackage` folder. Other users do not inherit access to this folder. You do not need to create and secure individual user directories, because this will be done automatically by the agent that runs in the context of the user. - -**Note**   -Additional security can be configured when a Windows server is utilized for the settings storage share. UE-V can be configured to verify that either the local administrator's group or the current user is the owner of the folder where settings packages are stored. To enable additional security complete the following: - -1. Add a **REG\_DWORD** registry key named "RepositoryOwnerCheckEnabled" to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration.** - -2. Set registry key value to 1. - - - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) - -Deploy the Central Storage for User Experience Virtualization Settings Templates and Settings Packages -[Installing the UE-V Generator](installing-the-ue-v-generator.md) - -[Deploying the UE-V Agent](deploying-the-ue-v-agent.md) - - - - - - - - - diff --git a/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md b/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md deleted file mode 100644 index c178943956..0000000000 --- a/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Deploying the Settings Template Catalog for UE-V 1.0 -description: Deploying the Settings Template Catalog for UE-V 1.0 -author: dansimp -ms.assetid: 0e6ab5ef-8eeb-40b4-be7b-a841bd83be96 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the Settings Template Catalog for UE-V 1.0 - - -Custom settings location templates can be stored on a folder path on Microsoft User Experience Virtualization (UE-V) computers or on a Server Message Block (SMB) network share. A scheduled task on the computer checks for new or updated templates from this location. The task checks this location once each day and updates its synchronization behavior based on the templates in this folder. Templates that are added or updated in this folder since the last check are registered by the UE-V agent. The UE-V agent deregisters templates that were removed from this folder. The scheduled task runs as SYSTEM. At a minimum, the network share must grant permissions for the Domain Computers group. In addition, grant access permissions for the network share folder to administrators who will manage the stored templates. For more information about custom setting location templates, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -**To configure the settings template catalog for UE-V** - -1. Create a new folder on the computer that will store the UE-V settings template catalog. - -2. Set the following share-level (SMB) permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommend permissions

    Everyone

    No Permissions

    Domain Computers

    Read Permission Levels

    Administrators

    Read/Write Permission Levels

    - -   - -3. Set the following NTFS permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User AccountRecommended PermissionsApply To

    Creator/Owner

    Full Control

    This Folder, Subfolders and Files

    Domain Computers

    List Folder Contents and Read

    This Folder, Subfolders and Files

    Everyone

    No Permissions

    No Permissions

    Administrators

    Full Control

    This Folder, Subfolders and Files

    - -   - -4. Click **OK** to close the dialog boxes. - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/deploying-the-ue-v-agent.md b/mdop/uev-v1/deploying-the-ue-v-agent.md deleted file mode 100644 index ced4f1d88b..0000000000 --- a/mdop/uev-v1/deploying-the-ue-v-agent.md +++ /dev/null @@ -1,204 +0,0 @@ ---- -title: Deploying the UE-V Agent -description: Deploying the UE-V Agent -author: dansimp -ms.assetid: ec1c16c4-4be0-41ff-93bc-3e2b1afb5832 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying the UE-V Agent - - -The Microsoft User Experience Virtualization (UE-V) agent must run on each computer that uses UE-V to roam application and Windows settings. A single installer file, AgentSetup.exe, installs the UE-V agent on both 32-bit and 64-bit operating systems. The command-line parameters of the UE-V Agent are the following: - -**AgentSetup.exe command-line parameters** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Command-line parameterDefinitionNotes

    /help or /h or /?

    Displays the AgentSetup.exe usage dialog.

    SettingsStoragePath

    Indicates the Universal Naming Convention (UNC) path that defines where settings are stored.

    %username% or %computername% environment variables are accepted. Scripting may require escaped variables.

    -

    Default: <none> (Active Directory user home)

    SettingsTemplateCatalogPath

    Indicates the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates.

    Only required for custom settings location templates

    RegisterMSTemplates

    Specifies whether the default Microsoft templates should be registered during installation.

    True | False

    -

    Default: True

    SyncMethod

    Specifies which synchronization method should be used.

    OfflineFiles | None

    -

    Default: OfflineFiles

    SyncTimeoutInMilliseconds

    Specifies the number of milliseconds that the computer waits before timeout when it retrieves user settings from the settings storage location.

    Default: 2000 milliseconds

    -

    (wait up to 2 seconds)

    SyncEnabled

    Specifies whether UE-V synchronization is enabled or disabled.

    True | False

    -

    Default: True

    MaxPackageSizeInBytes

    Specifies a settings package file size in bytes when the UE-V agent reports that files exceed the threshold.

    <size>

    -

    Default: none (no warning threshold)

    CEIPEnabled

    Specifies the setting for participation in the Customer Experience Improvement program. If set to true, then installer information is uploaded to the Microsoft Customer Experience Improvement Program site. If set to false, then no information is uploaded.

    True | False

    -

    Default: False

    -

    On Windows 7: True

    - - - -During installation, the SettingsStoragePath command-line parameter specifies the settings storage location for the settings values. A settings storage location can be defined before deploying the UE-V Agent. If no settings storage location is defined, then UE-V uses the Active Directory user Home Directory as the settings storage location. When you specify the SettingsStoragePath configuration during setup and use the %username% as part of the value, this will roam the same user settings experience on all computers or sessions that a user logs into. If you specify the %username%\\%computername% variables as part of the SettingsStoragePath value, this will preserve the settings experience for each computer. - -Architecture-specific Windows Installer (.msi) files are provided for the UE-V agent installation in addition to the combined 32-bit and 64-bit installer. The AgentSetupx86.msi or AgentSetupx64.msi install files are smaller than the AgentSetup.exe file and might streamline the agent deployments. The command-line parameters for the AgentSetup.exe installer are supported for the Windows Installer (.msi) installation. - -**Note**   -During UE-V agent installation or uninstallation you can either use the AgentSetup.exe file or the AgentSetup<arch>.msi file, but not both. The same file must be used to uninstall the UE-V Agent as it was used to install the UE-V Agent. - - - -Be sure to use the correct variable format when you install the UE-V agent. The following table provides examples of deployment options for using the AgentSetup.exe or the Windows Installer (.msi) installation files. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Deployment typeDeployment descriptionExample

    Command prompt

    When you install the UE-V agent from a command prompt, use the %^username% variable format. If quotation marks are needed because of spaces in the settings storage path, use a batch script file for deployment.

    -

    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%

    -

    -

    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%

    Batch script

    When you install the UE-V Agent from a batch script file, use the %%username%% variable format. If you use this install method, you must escape the variable with the %% characters. Without this character, the script expands the username variable at install time, rather than at run time, causing UE-V to use a single settings storage location for all users.

    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"

    -

    -

    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"

    -

    PowerShell

    When you install the UE-V agent from a PowerShell prompt or PowerShell script, use the %username% variable format.

    & AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%

    -

    -

    & msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%

    -

    Electronic software distribution, such as deployment of Configuration Manager Software Deployment)

    When you install the UE-V Agent with Configuration Manager, use the ^%username^% variable format.

    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%

    -

    -

    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%

    - - - -**Note**   -The installation of the U-EV Agent requires Administrator rights and the computer will require a restart before the UE-V agent can run. - - - -## UE-V Agent deployment methods from a network share - - -You can use the following methods to deploy the UE-V agent: - -- An electronic software distribution (ESD) solution that can install a Windows Installer (.msi) file. - -- An installation script that references the Windows Installer (.msi) file that is stored centrally on a share. - -- Manually running the installation program on the computer. - -To deploy the UE-V agent from a network share, use the following steps: - -**To install and configure the UE-V Agent from a network share** - -1. Stage the UE-V agent installation file (AgentSetup.exe) on a network share to which users have “read” permission. - -2. Deploy a script to user computers that installs the UE-V agent. The script should specify the settings storage location. - -**Update the UE-V Agent** - -Updates for the UE-V agent software will be provided through Microsoft Update. During a UE-V agent upgrade, the default group of settings location templates for common Microsoft applications and Windows settings may be updated. UE-V agent updates can be deployed by using Enterprise Software Distribution (ESD) infrastructure. - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) - -[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) - -[Installing the UE-V Generator](installing-the-ue-v-generator.md) - -Deploy the User Experience Virtualization Agent - - - - - - - - diff --git a/mdop/uev-v1/deploying-ue-v-10.md b/mdop/uev-v1/deploying-ue-v-10.md deleted file mode 100644 index 27e673050d..0000000000 --- a/mdop/uev-v1/deploying-ue-v-10.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: Deploying UE-V 1.0 -description: Deploying UE-V 1.0 -author: dansimp -ms.assetid: 519598bb-8c81-4af7-bee7-357696bff880 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying UE-V 1.0 - - -There are a number of different deployment configurations that Microsoft User Experience Virtualization (UE-V) supports. This section includes general information and step-by-step procedures to help you successfully perform the tasks that you must complete at different stages of your deployment. - -## Deployment information for UE-V - - -A UE-V deployment requires a settings storage location on a network share and a UE-V agent installed on every computer that synchronizes settings. The UE-V Group Policy templates can be used to manage UE-V settings. The following topics describe how to deploy these features. - -[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) - -All UE-V deployments require a settings storage location where the settings packages that contain the synchronized setting values are located. - -[Deploying the UE-V Agent](deploying-the-ue-v-agent.md) - -To synchronize settings by using UE-V, a computer must have the UE-V Agent installed and running. - -[Installing the UE-V Group Policy ADMX Templates](installing-the-ue-v-group-policy-admx-templates.md) - -You can use Group Policy to preconfigure UE-V settings before you deploy the UE-V Agent as well as standard UE-V configuration. - -## Deployment information for custom template deployment - - -If you plan to create custom settings location templates for applications other than the Microsoft applications that are included in UE-V, such as line-of-business applications, then you can deploy a settings template catalog and you must install the UE-V Generator to create those templates. For more information, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -[Installing the UE-V Generator](installing-the-ue-v-generator.md) - -Use the UE-V Generator to create, edit, and validate custom settings location templates that help synchronize settings of applications other than the default applications. - -[Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md) - -If you need to deploy custom settings location templates to support applications other than the default applications in the UE-V Agent, you must configure a settings template catalog to store them. - -[Deploying UE-V Settings Location Templates for UE-V 1.0](deploying-ue-v-settings-location-templates-for-ue-v-10.md) - -If you need to synchronize applications other than the default applications in the UE-V Agent, the custom setting location templates that are created with UE-V Generator can be distributed to the UE-V settings template catalog. - -**Note**   -Deploying custom templates requires a settings template catalog. The default Microsoft application templates are deployed with the UE-V Agent. - - - -## Topics for this product - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md b/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md deleted file mode 100644 index b0afb56983..0000000000 --- a/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Deploying UE-V Settings Location Templates for UE-V 1.0 -description: Deploying UE-V Settings Location Templates for UE-V 1.0 -author: dansimp -ms.assetid: 7e0cc553-14f7-40fa-828a-281c8d2d1934 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploying UE-V Settings Location Templates for UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) uses settings location templates (XML files) that define the settings that are captured and applied by User Experience Virtualization. UE-V includes a set of standard templates, as well as a tool, the UE-V Generator, which allows you to create custom settings location templates. After you create a settings location template, you should test it to ensure that the application settings roam correctly in a test environment. You can then safely deploy the settings location template to computers in the enterprise. - -Settings location templates can be deployed by using enterprise software distribution (ESD), Group Policy preferences, or by configuring a UE-V settings template catalog. Templates that are deployed by using an ESD or Group Policy must be registered through UE-V WMI or PowerShell. Templates that are stored in the settings template catalog location are automatically registered by the UE-V agent. - -## Deploy the settings location templates with a settings template catalog path - - -The UE-V settings location template catalog path can be defined by using the following methods: Group Policy, the agent install command-line parameters, WMI, or PowerShell. After the template catalog path has been defined, the UE-V agent retrieves the new or updated templates from this location. The UE-V agent checks this location once each day and updates its synchronization behavior based on the templates found in this folder. Templates that have been added or updated in this folder since the last check are registered by the UE-V agent. The UE-V agent also unregisters templates that have been removed from this folder. Templates are registered and unregistered one time per day by the task scheduler. - -**To use settings template catalog path to deploy UE-V settings location templates** - -1. Navigate to the network share folder that is defined as the settings template catalog. - -2. Add, remove, or update settings location templates in the settings template catalog to reflect the desired UE-V agent template configuration for UE-V computers. - -3. Templates on computers are updated daily based on changes to the settings template catalog. - -4. Open an elevated command prompt and navigate to **%program files%\\Microsoft user Experience Virtualization \\ Agent \\ <x86 or x64 >**, and then run **ApplySettingsTemplateCatalog.exe** to manually update templates on a computer that runs the UE-V agent. - -## Related topics - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md b/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md deleted file mode 100644 index 3b8b828a43..0000000000 --- a/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Edit UE-V Settings Location Templates with the UE-V Generator -description: Edit UE-V Settings Location Templates with the UE-V Generator -author: dansimp -ms.assetid: da78f9c8-1624-4111-8c96-79db7224bd0b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Edit UE-V Settings Location Templates with the UE-V Generator - - -Use the Microsoft User Experience Virtualization (UE-V) Generator to edit settings location templates. When the revised settings are added to the templates using the UE-V Generator, the version information within the template is automatically updated to ensure that any existing templates deployed in the enterprise are updated correctly. - -**How to edit a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Edit a settings location template**. - -3. In the list of recently used templates, select the template to be edited. Alternatively, **Browse** to the settings template file. Click **Next** to continue. - -4. Review the **Properties**, **Registry** locations, and **Files** locations for the settings template. Edit as needed. - - - The **Properties** tab allows you to view and edit the following properties: - - - **Application name**: The application name written in the description of the program file properties. - - - **Program name**: The name of the program taken from the program file properties. This name usually has the .exe extension. - - - **Product version**: The product version number of the .exe file of the application. This property, together with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, then the settings location template will apply to all versions of the product. - - - **File version**: The file version number of the.exe file of the application. This property, along with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template will apply to all versions of the program. - - - **Template author name** (optional): The name of the settings template author. - - - **Template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. You can edit the registry locations by use of the **Tasks** drop-down menu. Tasks include adding new keys, editing the name or scope of existing keys, deleting keys, and browsing the registry in which the keys are located. When you define the scope for the registry, you can use the **All Settings** scope to include all the registry settings under the specified key. Use **All Settings** and **Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations included in the settings location template. You can edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations include adding new files or folder locations, editing the scope of existing files or folders, deleting files or folders, and opening the selected location in Windows Explorer. To include all files in the specified folder, leave the file mask empty. - -5. Click **Save** to save the changes to the settings location template. - -6. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After editing the settings location template for an application, you should test the template. Deploy the revised settings location template in a lab environment before putting it into production in the enterprise. - -**How to manually edit a settings location template** - -1. Create a local copy of the settings location template (.xml file). UE-V settings location templates are .xml files identifying the locations where application store settings values. - -2. Open the settings location template file with an XML editor. - -3. Edit the settings location template file. All changes must conform to the UE-V schema file defined in SettingsLocationTempate.xsd. A copy of the .xsd file is located in `\ProgramData\Microsoft\UEV\Templates` by default. - -4. Save the settings location template file and close the XML editor. - -5. Validate the modified settings location template file with the UE-V Generator. For more information about validating with the UE-V Generator, see [Validate UE-V Settings Location Templates with UE-V Generator](validate-ue-v-settings-location-templates-with-ue-v-generator.md). - -## Related topics - - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md b/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md deleted file mode 100644 index f7d00db09e..0000000000 --- a/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Getting Started With User Experience Virtualization 1.0 -description: Getting Started With User Experience Virtualization 1.0 -author: dansimp -ms.assetid: 74a068dc-4f87-4cb4-b114-8ca2a37149f7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Getting Started With User Experience Virtualization 1.0 - - -Microsoft User Experience Virtualization (UE-V) captures and centralizes application settings and Windows operating system settings for the user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -UE-V offers settings synchronization for common Microsoft applications and Windows settings. It also delivers user settings at any time to wherever users work throughout the enterprise. UE-V allows administrators to specify which application settings and Windows settings roam. UE-V helps administrators to create custom settings location templates for third-party or line-of-business applications that are used in the enterprise. - -User Experience Virtualization delivers an enhanced user state virtualization experience. It provides consistent personalization of the user’s settings in the following scenarios: - -- Roaming user application and Windows settings between computers. - -- Roaming user settings between the instances of an application that are deployed by using different methods: - - - Installed applications - - - Application Virtualization (App-V) sequenced applications - - - RemoteApp (Remote Desktop Virtualization) applications - -- Recovering settings for a computer after replacement, hardware upgrade, or reimage. - -This product requires thorough planning before you deploy it or use its features. Because this product can affect every computer in your organization, you might disrupt your entire network if you do not plan your deployment carefully. However, if you plan your deployment carefully and manage it so that it meets your business needs, this product can help reduce your administrative overhead and total cost of ownership. - -If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. For more information about Microsoft training opportunities, see the Microsoft Training Overview at . - -**Note**   -A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at (https://go.microsoft.com/fwlink/?LinkId=272497). - - - -## Getting started with Microsoft User Experience Virtualization topics - - -- [About User Experience Virtualization 1.0](about-user-experience-virtualization-10.md) - - Describes the functionality and features of User Experience Virtualization. - -- [High-Level Architecture for UE-V 1.0](high-level-architecture-for-ue-v-10.md) - - Explains the features of User Experience Virtualization. - -- [Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md) - - Describes the known issues for UE-V. - -- [Accessibility for UE-V](accessibility-for-ue-v.md) - - Describes the keyboard shortcuts and accessibility information for UE-V. - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -- [Planning for UE-V 1.0](planning-for-ue-v-10.md) - -- [Deploying UE-V 1.0](deploying-ue-v-10.md) - -- [Operations for UE-V 1.0](operations-for-ue-v-10.md) - -- [Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/high-level-architecture-for-ue-v-10.md b/mdop/uev-v1/high-level-architecture-for-ue-v-10.md deleted file mode 100644 index fc68a953dd..0000000000 --- a/mdop/uev-v1/high-level-architecture-for-ue-v-10.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: High-Level Architecture for UE-V 1.0 -description: High-Level Architecture for UE-V 1.0 -author: dansimp -ms.assetid: d54f9f10-1a4d-4e56-802d-22d51646e1cc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# High-Level Architecture for UE-V 1.0 - - -This topic describes high-level architectural elements of the Microsoft User Experience Virtualization (UE-V) settings roaming solution. The following elements are part of a standard UE-V deployment. - -![ue-v agent architectural diagram](images/ue-vagentarchitecturaldiagram.gif) - -The UE-V Agent monitors the applications and the operating system processes as they are identified in the UE-V settings location templates. When the application or operating system starts, the settings are read from the settings package and applied to the computer. When the application closes or when the operating system is locked or shut down, settings are saved in a UE-V settings package in the settings storage location. - -## Settings storage location - - -The settings storage location is a file share that the User Experience Virtualization agent accesses to read and write settings. This location is either the Active Directory home directory or defined during the UE-V installation. You can set the location during the installation of the UE-V agent, or you can set it later with Group Policy, WMI, or PowerShell. The location can be on any common file share that users can access. If no setting storage location is set during installation then UE-V will use the home directory in Active Directory. The UE-V agent verifies the location and creates a system folder that is hidden from the user in which to store and access the user settings. For more information about settings storage, see [Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md). - -## UE-V Agent - - -The UE-V agent is installed on each computer with settings that are synchronized by User Experience Virtualization. The agent monitors the registered applications and the operating system for any changes to that are made to settings, and it synchronizes those settings between computers. Settings are applied from the settings storage location to the application when the application is started. The settings are then saved back to the settings storage location when the application closes. The operating system settings are applied when the user logs on, when the computer is unlocked, or when the user connects remotely to the computer by using remote desktop protocol (RDP). The agent saves settings when the user logs off, when the computer is locked, or when a remote connection is disconnected. For more information about the UE-V Agent, see [Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md). - -## Settings location templates - - -The settings location template is an XML file that defines the settings locations to be monitored by User Experience Virtualization. Only the settings locations defined in these settings templates are captured or applied on computers running the UE-V Agent. The settings location template does not contain settings values, only the locations where values are stored on the computer. - -UE-V includes a set of settings location templates that specify settings locations for some Microsoft applications and Windows settings. An administrator can create custom settings location templates by using the UE-V Generator. - -[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -## Settings packages - - -Application settings and Windows settings are stored in settings packages, which are created by the UE-V Agent. A settings package is a collection of the settings that are represented in the settings location templates. These settings packages are built, locally stored, and then copied to the settings storage location. “Last write wins” determines which settings are preserved when a single user synchronizes the more than one computer to a storage location. The agent that runs on one computer reads and writes to the settings location independent of agents that run on other computers. The most recently written settings and values are applied when the next agent reads from the settings storage location. - -![ue-v generator process](images/ue-vgeneratorprocess.gif) - -## Settings template catalog - - -The settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. The UE-V agent retrieves new or updated templates from this location. The UE-V agent checks this location once each day and it updates its synchronization behavior based on the templates in this folder. The templates that were added or updated in this folder since the last check are registered by the UE-V agent. The UE-V agent deregisters the templates that were removed from this folder. Templates are registered and unregistered one time per day by the task scheduler. If you will use only the default settings location templates that are included with UE-V, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -## User Experience Virtualization Generator - - -The User Experience Virtualization Generator enables you to create custom settings location templates which will store the settings locations of the applications that are used in the enterprise and that you want to include in the roaming settings solution. The UE-V Generator will seek to discover the locations of registry values and the settings files for applications and then it will record those locations in a settings location template XML file. You can then distribute these settings location templates to the user computers. The UE-V Generator also allows an administrator to edit an existing template or validate a template that was created with another XML editor. - -The UE-V Generator monitors an application to discover and record where it stores its settings. To do this, it monitors where the application reads or writes in the HKEY\_CURRENT\_USER registry or in the file folders under **Users** \\ \[User name\] \\ **AppData** \\ **Roaming and Users** \\ \[User name\] \\ **AppData** \\ **Local**. - -The discovery process excludes registry keys and files to which the logged-in user cannot write values. None of these will be included in the XML file. The discovery process also excludes registry keys and files that are associated with the core functionality of the Windows operating system. - -For more information about the UE-V Generator, see [Installing the UE-V Generator](installing-the-ue-v-generator.md). - -## Related topics - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[About User Experience Virtualization 1.0](about-user-experience-virtualization-10.md) - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/images/checklistbox.gif b/mdop/uev-v1/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/uev-v1/images/checklistbox.gif and /dev/null differ diff --git a/mdop/uev-v1/images/ue-vagentarchitecturaldiagram.gif b/mdop/uev-v1/images/ue-vagentarchitecturaldiagram.gif deleted file mode 100644 index a09e120130..0000000000 Binary files a/mdop/uev-v1/images/ue-vagentarchitecturaldiagram.gif and /dev/null differ diff --git a/mdop/uev-v1/images/ue-vgeneratorprocess.gif b/mdop/uev-v1/images/ue-vgeneratorprocess.gif deleted file mode 100644 index 1c1ef4331d..0000000000 Binary files a/mdop/uev-v1/images/ue-vgeneratorprocess.gif and /dev/null differ diff --git a/mdop/uev-v1/index.md b/mdop/uev-v1/index.md deleted file mode 100644 index 3fe3f036fa..0000000000 --- a/mdop/uev-v1/index.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 1.0 -description: Microsoft User Experience Virtualization (UE-V) 1.0 -author: dansimp -ms.assetid: 7c2b59f6-bbe9-4373-8b08-c1738665a37b -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Microsoft User Experience Virtualization (UE-V) 1.0 - ->[!NOTE] ->This documentation is a for version of UE-V that was included in the Microsoft Desktop Optimization Pack (MDOP). For information about the latest version of UE-V which is included in Windows 10 Enterprise, see [Get Started with UE-V](https://docs.microsoft.com/windows/configuration/ue-v/uev-getting-started). - - -Microsoft User Experience Virtualization (UE-V) captures and centralizes application settings and Windows operating system settings for the user. These settings are then applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[About User Experience Virtualization 1.0 SP1](about-user-experience-virtualization-10-sp1.md)  **|**  [Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md)  **|**  [About User Experience Virtualization 1.0](about-user-experience-virtualization-10.md)  **|**  [Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md)  **|**  [High-Level Architecture for UE-V 1.0](high-level-architecture-for-ue-v-10.md)  **|**  [Accessibility for UE-V](accessibility-for-ue-v.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md)  **|**  [Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md)  **|**  [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md)  **|**  [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md)  **|**  [UE-V Checklist](ue-v-checklist.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md)  **|**  [Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md)  **|**  [Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md)  **|**  [Deploying UE-V Settings Location Templates for UE-V 1.0](deploying-ue-v-settings-location-templates-for-ue-v-10.md)  **|**  [Deploying the UE-V Agent](deploying-the-ue-v-agent.md)  **|**  [Installing the UE-V Generator](installing-the-ue-v-generator.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Administering UE-V 1.0](administering-ue-v-10.md)  **|**  [Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md)  **|**  [Administering UE-V with PowerShell and WMI](administering-ue-v-with-powershell-and-wmi.md)  |  [Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) - -[Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - -### More information - -[Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes](microsoft-user-experience-virtualization--ue-v--10-release-notes.md) -View updated product information and known issues for UE-V 1.0. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - - diff --git a/mdop/uev-v1/installing-the-ue-v-generator.md b/mdop/uev-v1/installing-the-ue-v-generator.md deleted file mode 100644 index 90bba89eb5..0000000000 --- a/mdop/uev-v1/installing-the-ue-v-generator.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Installing the UE-V Generator -description: Installing the UE-V Generator -author: dansimp -ms.assetid: 198b9a5f-3dfc-46be-9005-d33451914f87 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Installing the UE-V Generator - - -The Microsoft User Experience Virtualization (UE-V) generator can be installed on a computer and used to create a custom settings location template. This computer should have the applications installed for which custom settings location templates will be generated. To install the UE-V Generator, run **ToolsSetup.exe**. If the architecture of the computer is known, then you can run the appropriate Windows Installer (.msi) file, **ToolsSetupx64.msi** or **ToolsSetupx86.msi**. - -**To install the UE-V Generator** - -1. As a user with local computer administrator rights, locate the UE-V Generator installation file (ToolSetup.exe) provided with the User Experience Virtualization software. - -2. Double-click the installation file. The User Experience Virtualization Generator Setup wizard opens. Click **Next** to continue. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Specify the options for Microsoft Updates and the Customer Experience Improvement Program. - -5. Select the destination folder in which the UE-V Generator will be installed, and then click **Next**. - -6. Click **Install** to begin the installation. - - **Note**   - A prompt for User Account Control appears before the application is installed. Permission is required to install the UE-V generator. - - - -7. Click **Finish** to close the wizard after the installation is complete. You will need to restart your computer before you can run the UE-V Generator. - - To verify that the installation was successful, click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md b/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md deleted file mode 100644 index 81dc8f85cc..0000000000 --- a/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Installing the UE-V Group Policy ADMX Templates -description: Installing the UE-V Group Policy ADMX Templates -author: dansimp -ms.assetid: 7bd1f12e-7ba6-49f9-af9c-22c496b13b39 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 07/12/2017 ---- - - -# Installing the UE-V Group Policy ADMX Templates - - -The Microsoft User Experience Virtualization (UE-V) agent can be managed by using the existing Group Policy infrastructure. The UE-V ADMX template configures the synchronization settings for the UE-V agent. The ADMX template enables the central management of common UE-V Agent configuration settings by using an existing Group Policy infrastructure. - -**System requirements** - -Supported operating systems for the Domain Controller that deploys the Group Policy Objects include the following: - -- Windows Server 2008 R2 - -- Windows Server 2012 - -ADMX files can be installed and tested locally on any computer that runs the Windows operating system. - -**To download the UE-V ADMX templates** - -1. Download the UE-V ADMX template files: . - -2. For more information about how to deploy the Group Policy templates, see . - -## Related topics - - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md b/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md deleted file mode 100644 index 317975228c..0000000000 --- a/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md +++ /dev/null @@ -1,292 +0,0 @@ ---- -title: Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI -description: Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI -author: dansimp -ms.assetid: c8989b01-1769-4e69-82b1-4aadb261d2d5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI - - -You can use WMI and PowerShell to manage Microsoft User Experience Virtualization (UE-V) Agent configuration and synchronization behavior. - -**How to deploy the UE-V agent with PowerShell** - -1. Stage the UE-V installer file in an accessible network share. - - **Note** - Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer Files versions, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time using the installation file, you must use the same file type. - - - -2. Use one of the following PowerShell commands to install the agent. - - `& AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - - `& msiexec.exe /i "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - -**How to configure the UE-V Agent with PowerShell** - -1. Use an account with administrator rights to open a PowerShell window. Import the UE-V PowerShell module by using the following command. - - ``` syntax - Import-module UEV - ``` - -2. Use the following PowerShell commands to configure the agent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    PowerShell command

    Description

    Get-UevConfiguration

    -

    View the effective UE-V agent settings. User-specific settings have precedence over the computer settings.

    Get-UevConfiguration - CurrentComputerUser

    -

    View the UE-V agent settings values for the current user only.

    Get-UevConfiguration -Computer

    View the UE-V agent configuration settings values for all users on the computer.

    Set-UevConfiguration -Computer -SettingsStoragePath <path to _settings_storage_location>

    Define a per-computer settings storage location.

    Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath <path to _settings_storage_location>

    Define a per-user settings storage location.

    Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds <timeout in milliseconds>

    Set the synchronization timeout in milliseconds

    Set-UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds <timeout in milliseconds>

    Set the synchronization timeout for the current user.

    Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes>

    Configure the UE-V agent to report when a settings package file size reaches a defined threshold. Set the threshold package size in bytes.

    Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes>

    Set the package size warning threshold for the current user.

    Set-UevConfiguration –Computer –SettingsTemplateCatalogPath <path to catalog>

    Set the settings template catalog path.

    Set-UevConfiguration -Computer -SyncMethod <sync method>

    Set the synchronization method: OfflineFiles or None.

    Set-UevConfiguration -CurrentComputerUser -SyncMethod <sync method>

    Set the synchronization method for the current user: OfflineFiles or None.

    Set-UEVConfiguration -Computer –EnableSettingsImportNotify

    Enable notification to occur when the import of user settings is delayed.

    -

    Use –DisableSettingsImportNotify to disable notification.

    Set-UEVConfiguration - CurrentComputerUser -EnableSettingsImportNotify

    Enable notification for the current user when the import of user settings is delayed.

    -

    Use –DisableSettingsImportNotify to disable notification.

    Set-UEVConfiguration -Computer -SettingsImportNotifyDelayInSeconds

    Specify the time in seconds before the user is notified

    Set-UEVConfiguration - CurrentComputerUser -SettingsImportNotifyDelayInSeconds

    Specify the time in seconds before notification for the current user.

    Set-UevConfiguration –Computer –DisableSync

    Disable UE-V for all the users on the computer.

    -

    Use –EnableSync to enable or re-enable.

    Set-UevConfiguration –CurrentComputerUser -DisableSync

    Disable UE-V for the current user on the computer.

    -

    Use –EnableSync to enable or re-enable.

    Clear-UevConfiguration –Computer -<setting name>

    Clear a specific setting for all users on the computer.

    Clear-UevConfiguration –CurrentComputerUser -<setting name>

    Clear a specific setting for the current user only.

    Export-UevConfiguration <settings migration file>

    Export the UE-V computer configuration to a settings migration file. The extension of the file must be “.uev”.

    -

    The export cmdlet exports all UE-V agent settings that are configurable with the -computer parameter.

    Import-UevConfiguration <settings migration file>

    Import the UE-V computer configuration from a settings migration file (.uev file).

    - - - -**How to export UE-V package settings and repair UE-V templates with PowerShell** - -1. Open a PowerShell window as an Administrator. Import the UE-V PowerShell module with the following command. - - ``` syntax - Import-module UEV - ``` - -2. Use the following PowerShell commands to configure the agent. - - - - - - - - - - - - - - - - - - - - -

    PowerShell command

    Description

    Export-UevPackage MicrosoftCalculator6.pkgx

    Extracts the settings from a Microsoft Calculator package file and converts them into a human-readable format in XML.

    Repair-UevTemplateIndex

    Repairs the index of the UE-V settings location templates.

    - - - -**How to configure the UE-V Agent with WMI** - -1. User Experience Virtualization provides the following set of WMI commands. Administrators can use this interface to configure the UE-V agent from the command line and automate typical configuration tasks. - - Use an account with administrator rights to open a PowerShell window. - -2. Use the following WMI commands to configure the agent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PowerShell commandDescription

    Get-WmiObject -Namespace root\Microsoft\UEV Configuration

    -

    View the active UE-V agent settings. User-specific settings have precedence over the computer settings.

    Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

    View the UE-V agent configuration that is defined for user.

    Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    View the UE-V agent configuration that is defined for computer.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.SettingsStoragePath = <path_to_settings_storage_location>

    -

    $config.Put()

    Define a per-computer settings storage location.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

    -

    $config.SettingsStoragePath = <path_to_settings_storage_location>

    -

    $config.Put()

    Define a per-user settings storage location.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.SyncTimeoutInMilliseconds = <timeout_in_milliseconds>

    -

    $config.Put()

    Set the synchronization timeout in milliseconds.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.MaxPackageSizeInBytes = <size_in_bytes>

    -

    $config.Put()

    Configure the UE-V agent to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.SyncMethod = <sync_method>

    -

    $config.Put()

    Set the synchronization method: OfflineFiles or None.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.<setting name> = <setting value>

    -

    $config.Put()

    Update a specific per-computer setting. To clear the setting, use $null as the setting value.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.<setting name> = <setting value>

    -

    $config.Put()

    Update a specific per-user setting. To clear the setting, use $null as the setting value.

    - - - -~~~ -Upon configuration of the UE-V Agent with WMI and PowerShell, the defined configuration is stored in the registry in the following locations: - -`\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration` - -`\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration` -~~~ - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md b/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md deleted file mode 100644 index be26ce0c20..0000000000 --- a/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md +++ /dev/null @@ -1,198 +0,0 @@ ---- -title: Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI -description: Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI -author: dansimp -ms.assetid: 4b911c78-a5e9-4199-bfeb-72ab764d47c1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI - - -Microsoft User Experience Virtualization (UE-V) uses settings location templates (XML files) that define the settings captured and applied by User Experience Virtualization. UE-V includes a set of standard settings location templates. It also includes the UE-V Generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates you can manage those templates using PowerShell or WMI. - -## Manage settings location templates with WMI and PowerShell - - -The WMI and PowerShell features of UE-V include the ability to enable, disable, register, update, and unregister settings location templates. By using these features, you can automate the process of registering, updating, or unregistering templates with the UE-V agent. You can also manually register templates using WMI and PowerShell commands. By using these features in conjunction with an electronic software distribution solution, Group Policy, or another automated deployment method such as a script, you can further automate that process. - -You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable or disable templates. - -**To manage settings location templates with PowerShell** - -1. Use an account with administrator rights to open a Windows PowerShell window. To import the **Microsoft UE-V PowerShell** module, type the following command at the PowerShell command prompt. - - ``` syntax - Import-module UEV - ``` - -2. Use the following PowerShell cmdlets to register and manage the UE-V settings location templates. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    PowerShell commandDescription

    Get-UevTemplate

    Lists all the settings location templates registered on the computer.

    Register-UevTemplate

    Registers a settings location template with UE-V. Once a template is registered, UE-V will synchronize the settings that are defined in the template between computers that have the template registered.

    Unregister-UevTemplate

    Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V will no longer synchronize the settings that are defined in the template between computers.

    Update-UevTemplate

    Updates a settings location template with a more recent version of the template. The new template should have a version that is later than the existing one.

    Disable-UevTemplate

    Disables a settings location template for the current user of the computer.

    Enable-UevTemplate

    Enables a settings location template for the current user of the computer.

    Test-UevTemplate

    Determines whether a given settings location template complies with its XML schema.

    - - - -The UE-V PowerShell features allow you to manage a group of settings templates deployed in your enterprise. To manage a group of templates using PowerShell, do the following. - -**To manage a group of settings location templates with PowerShell** - -1. Modify or update the desired settings location templates. - -2. Deploy the desired settings location templates to a folder accessible to the local computer. - -3. On the local computer, open a Windows PowerShell window with administrator rights. - -4. Import the Microsoft UE-V PowerShell module, by typing the following command. - - ``` syntax - Import-module UEV - ``` - -5. Unregister all the previously registered versions of the templates by typing the following command. - - ``` syntax - Get-UevTemplate | Unregister-UevTemplate - ``` - - This will unregister all active templates on the computer. - -6. Register the updated templates by typing the following command. - - ``` syntax - Register-UevTemplate \*.xml - ``` - - This will register all of the settings location templates located in the specified template folder. - -User Experience Virtualization provides the following set of WMI commands. Administrators can use these interfaces to manage settings location templates from Windows PowerShell and automate template administrative tasks. - -**To manage settings location templates with WMI** - -1. Use an account with administrator rights to open a Windows PowerShell window. - -2. Use the following WMI commands to register and manage the UE-V settings location templates. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    PowerShell command

    Description

    Get-WmiObject -Namespace root\Microsoft\UEV SettingsLocationTemplate | Select-Object TemplateId,TemplateName, TemplateVersion,Enabled | Format-Table -Autosize

    Lists all the settings location templates registered for the computer.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Register -ArgumentList <template path >

    Registers a settings location template with UE-V.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name UnregisterByTemplateId -ArgumentList <template ID>

    Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V will no longer synchronize the settings that are defined in the template between computers.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name EnableByTemplateId -ArgumentList <template ID>

    Enables a settings location template with UE-V

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name DisableByTemplateId -ArgumentList <template ID>

    Disables a settings location template with UE-V

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Update -ArgumentList <template path>

    Updates a settings location template with UE-V. The new template should have a version that is higher than the existing one.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Validate -ArgumentList <template path>

    Determines whether a given settings location template complies with its XML schema.

    - - - -**How to deploy the UE-V agent with PowerShell** - -1. Stage the UE-V installer file in an accessible network share. - - **Note**   - Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer Files versions, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time using the installation file, you must use the same file type. - - - -2. Use one of the following PowerShell commands to install the agent. - - `& AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - - `& msiexec.exe /i "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - -## Related topics - - -[Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md) - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md deleted file mode 100644 index b16ae11350..0000000000 --- a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes -author: dansimp -ms.assetid: 920f3fae-e9b5-4b94-beda-32c19d31e94b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes - - -To search Microsoft User Experience Virtualization (UE-V) release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Providing feedback - - -Tell us what you think about our documentation for MDOP by giving us your feedback and comments. Send your documentation feedback to [mdopdocs@microsoft.com](mailto:mdopdocs@microsoft.com?subject=UE-V%20Documentation). - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization. - -### Registry settings fail to synchronize between App-V and native applications on the same computer - -When a computer has an application that is available through both the Application Virtualization (App-V) application and a native installation application (installed with an .msi file), the registry-based settings do not synchronize between the technologies. - -WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Windows 8 setting synchronization fails with error: "boost::filesystem::exists::Incorrect user name or password" - -The Windows® 8 operating system settings synchronization fails with the following error message: **boost::filesystem::exists::Incorrect user name or password**. To check for operational log events, open the **Event Viewer** and navigate to **Applications and Services Logs** / **Microsoft** / **User Experience Virtualization** / **Logging** / **Operational**. Network shares that are used for UE-V settings storage locations should reside in the same Active Directory domain as the user. Otherwise, the following error might occur: "Incorrect user name or password". - -WORKAROUND: Use network shares from the same Active Directory domain as the user. . - -### Email signature roaming for Outlook 2010 - -UE-V will roam the Outlook 2010 signature files between devices. However, the default signature options for new messages and replies/forwards are not.  These two settings are stored in the Outlook profile, which UE-Vdoes not roam. - -WORKAROUND: None. - -### Synchronization settings do not synchronize on expected interval when running in slow-link mode - -Under normal conditions, settings storage locations should be available over a fast link network connection. In slow-link mode, synchronization will only occur on a periodic basis. By default, the slow-link mode synchronization schedule is set to every 360 minutes. - -WORKAROUND: To change the frequency of the background synchronization for computers in slow-link mode, you can configure the Group Policy for Background Sync policy for **Offline files**. - -### Special characters do not synchronize - -Certain characters, such as currency symbols, do not synchronize between Windows 7 and Windows 8 computers that run the UE-V agent. - -WORKAROUND: None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click here. ([http://office.microsoft.com/word-help/choose-the-32-bit-or-64-bit-version-of-microsoft-office-HA010369476.aspx](https://go.microsoft.com/fwlink/?LinkID=247623)). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -WORKAROUND: None - -### Other folders on the share with the setting storage location are unavailable in slow-connection mode - -Settings store shares should not be located on a network share that is used for other folders that must always be available. When the network share that hosts the setting storage location goes into slow-connection mode, the only available folder is the settings storage location folder. Other folders on the Share are not available in slow-connection mode. - -Workaround: None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Paths longer than 260 characters are not supported - -Settings storage paths that are longer than 260 characters are not supported. Copying the UE-V settings packages to settings storage paths that are longer than 260 characters will fail and generate the following exception message in the UE-V operational event log: **\[boost::filesystem::copy\_file: The system cannot find the path specified\]**. To check for operational log events, open the **Event Viewer** and navigate to **Applications and Services Logs** / **Microsoft** / **User Experience Virtualization** / **Logging** / **Operational**. - -File settings paths that are longer than 260 characters are not currently supported. File settings that are referenced in UE-V settings location templates cannot be located in a directory path that is longer than 260 characters. - -WORKAROUND: None. - -### UE-V agent delays upon logout or login - -If a logon or logout occurs before Offline Files has determined that a slow link is in place, logout or login might be delayed. The Offline Files feature may take up to three minutes to detect the current network state. If the logon or shutdown occurs before Offline Files has determined that the computer is connected to a slow link, the UE-V settings package will be sent to the server instead of the local cache. - -WORKAROUND: None. - -### Settings conflict when trying to roam operating system settings on Windows 8 - -On Windows 8 if Microsoft Account Sync is enabled along with UE-V for operating system settings, the settings that are applied may be inconsistent. - -WORKAROUND: Do one of the following: - -- Disable Microsoft Account Sync if you are using UE-V to roam operating system settings - -- Disable UE-V for operating system settings - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale will only roam across like operating system versions of Windows. For example currency characters will only roam from Windows 7 to Windows 7. - -WORKAROUND: None - -### Internet Explorer bookmarks do not appear in the Internet Explorer smartbar - -When Internet Explorer bookmarks roam from one computer to another computer, the index on the second computer cannot update, so when typing in the address bar, the favorite will not appear as a possible search result on computer 2. - -WORKAROUND: None - - - - - - - - - diff --git a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md deleted file mode 100644 index e95de8309a..0000000000 --- a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes -author: dansimp -ms.assetid: 447fae0c-fe87-4d1c-b616-6f92fbdaf6d5 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes - - -To search Microsoft User Experience Virtualization (UE-V) 1.0 Service Pack 1 release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization 1.0 SP1. - -### Registry settings fail to synchronize between App-V and native applications on the same computer - -When a computer has an application that is available through both the Application Virtualization (App-V) application and a native installation application installed with a Windows Installer (.msi file), the registry-based settings do not synchronize between the technologies. - -WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Windows 8 setting synchronization fails when network share is outside user’s domain - -When Windows® 8 attempts operating system settings synchronization, the synchrnization fails with the following error message: **boost::filesystem::exists::Incorrect user name or password**. This error can indicate that the network share is outside the user’s domain. To check for operational log events, open the **Event Viewer** and navigate to **Applications and Services Logs** / **Microsoft** / **User Experience Virtualization** / **Logging** / **Operational**. Network shares that are used for UE-V settings storage locations should reside in the same Active Directory domain as the user. - -WORKAROUND: Use network shares from the same Active Directory domain as the user. . - -### Email signature roaming for Outlook 2010 - -UE-V will roam the Outlook 2010 signature files between devices. However, the default signature options for new messages and replies/forwards are not roamed. These two settings are stored in the Outlook profile, which UE-V does not roam. - -WORKAROUND: None. - -### Synchronization settings do not synchronize on expected interval when running in slow-link mode - -Under normal conditions, settings storage locations should be available over a fast link network connection. In slow-link mode, synchronization will only occur on a periodic basis. By default, the slow-link mode synchronization schedule is set to every 360 minutes. - -WORKAROUND: To change the frequency of the background synchronization for computers in slow-link mode, you can configure the Group Policy for Background Sync policy for **Offline files**. - -### Special characters do not synchronize - -Certain characters, such as currency symbols, do not synchronize between Windows 7 and Windows 8 computers that run the UE-V agent. - -WORKAROUND: None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click here ([http://office.microsoft.com/word-help/choose-the-32-bit-or-64-bit-version-of-microsoft-office-HA010369476.aspx](https://go.microsoft.com/fwlink/?LinkID=247623)). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -WORKAROUND: None - -### MSI’s are not localized - -UE-V 1.0 SP1 includes a localized setup program for both the UE-V Agent and UE-V generator. These MSI files are still available but the user interface is minimized and the MSI’s only display in English. Despite the file being in English, the setup program installs all supported languages during the installation. - -WORKAROUND: None - -### Other folders on the share with the setting storage location are unavailable in slow-connection mode - -Settings store shares should not be located on a network share that is used for other folders that must always be available. When the network share that hosts the setting storage location goes into slow-connection mode, the only available folder is the settings storage location folder. Other folders on the Share are not available in slow-connection mode. - -Workaround: None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Long Settings Storage Paths could cause an error - -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID). If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: - -`[boost::filesystem::copy_file: The system cannot find the path specified]` - -To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. - -WORKAROUND: None. - -### UE-V agent delays upon logout or login - -If a logon or logout occurs before Offline Files has determined that a slow link is in place, logout or login might be delayed. The Offline Files feature may take up to three minutes to detect the current network state. If the logon or shutdown occurs before Offline Files has determined that the computer is connected to a slow link, the UE-V settings package will be sent to the server instead of the local cache. - -WORKAROUND: None. - -### Settings conflict when trying to roam operating system settings on Windows 8 - -On Windows 8 if Microsoft Account Sync is enabled along with UE-V for operating system settings, the settings that are applied may be inconsistent. - -WORKAROUND: Do one of the following: - -- Disable Microsoft Account Sync if you are using UE-V to roam operating system settings - -- Disable UE-V for operating system settings - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale will only roam across like operating system versions of Windows. For example currency characters will only roam from Windows 7 to Windows 7. - -WORKAROUND: None - -  - -  - - - - - diff --git a/mdop/uev-v1/migrating-ue-v-settings-packages.md b/mdop/uev-v1/migrating-ue-v-settings-packages.md deleted file mode 100644 index 0b4de51c02..0000000000 --- a/mdop/uev-v1/migrating-ue-v-settings-packages.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Migrating UE-V Settings Packages -description: Migrating UE-V Settings Packages -author: dansimp -ms.assetid: 93d99254-3e17-4e96-92ad-87059d8554a7 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Migrating UE-V Settings Packages - - -In the lifecycle of a Microsoft User Experience Virtualization (UE-V) deployment, you might need to relocate the user settings packages either when migrating to a new server or for backup purposes. Migration of settings packages might be needed in the following scenarios: - -- Upgrade of existing server hardware to a more modern server. - -- Migration of a settings storage location share from a lab to a production server. - -Simply copying the files and folders will not preserve the security settings and permissions. The following described steps will properly copy the settings package files with their NTFS permissions to a new share. - -**How to preserve UE-V settings packages when migrating to a new server** - -1. In a new location on a different server, create a new folder; for example, MySettings. - -2. Disable sharing for the old folder share on the old server. - -3. Move the existing settings packages to the new server with Robocopy from the command line. For example: - - ``` syntax - c:\start robocopy "\\servername\E$\MySettings" "\\servername\E$\MySettings" /b /sec /secfix /e /LOG:D:\Robocopylogs\MySettings.txt - ``` - - **Note**   - To monitor the copy progress, open MySettings.txt with a log file reader such as Trace32. - - - -4. Grant share-level permissions to the new share. Leave the NTFS permissions as they were set by Robocopy. - - On computers that run the UE-V agent, update the SettingsStoragePath configuration setting to the UNC path of the new share. - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/operations-for-ue-v-10.md b/mdop/uev-v1/operations-for-ue-v-10.md deleted file mode 100644 index 9026d54de9..0000000000 --- a/mdop/uev-v1/operations-for-ue-v-10.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Operations for UE-V 1.0 -description: Operations for UE-V 1.0 -author: dansimp -ms.assetid: 5b4a82fd-3145-49e8-ac06-f9cc583abe5f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Operations for UE-V 1.0 - - -This operations section includes information about the various types of Microsoft User Experience Virtualization (UE-V) administration and operating tasks that are typically performed by an administrator. This section also includes step-by-step procedures to help you successfully perform these tasks. - -## Operations information - - -- [Administering UE-V 1.0](administering-ue-v-10.md) - - This topic provides instructions for how to restore user settings, change synchronization frequency, and configure UE-V settings. - -- [Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - - This topic provides instructions for how to use the UE-V Generator and manage custom settings location templates. - -- [Administering UE-V with PowerShell and WMI](administering-ue-v-with-powershell-and-wmi.md) - - Microsoft User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets which can help administrators perform various UE-V tasks. - -- [Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) - - This topic covers general security considerations for UE-V and the UE-V privacy statement. - -## Other resources for this product - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md b/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md deleted file mode 100644 index a6a104caaa..0000000000 --- a/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Planning for Custom Template Deployment for UE-V 1.0 -description: Planning for Custom Template Deployment for UE-V 1.0 -author: dansimp -ms.assetid: be76fc9a-31ca-4290-af11-7640dcb87d50 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for Custom Template Deployment for UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) uses settings location templates (XML files) that define the settings that are captured and applied by UE-V. You can use the UE-V Generator to create custom settings location templates that let users roam the settings of applications other than those that are included in the default UE-V templates. After you test the custom template to ensure that the application settings roam correctly in a test environment, you can deploy these settings location templates to computers in the enterprise. - -You can deploy your custom settings location templates with an existing deployment infrastructure, such as Enterprise Software Distribution (ESD), with Group Policy preferences, or by configuring a UE-V settings template catalog. Templates that are deployed by using ESD or Group Policy must be registered with UE-V WMI or PowerShell. - -## Settings template catalog - - -The User Experience Virtualization settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. The UE-V agent retrieves new or updated templates from this location. The UE-V agent checks this location once each day and updates its synchronization behavior based on the templates in this folder. Templates that were added or updated in this folder since the last time that the folder was checked are registered by the UE-V agent. The UE-V agent deregisters templates that are removed from this folder. By default, templates are registered and unregistered one time per day at 3:30 A.M. local time by the task scheduler. For more information about the UE-V tasks, see [Changing the Frequency of UE-V Scheduled Tasks](changing-the-frequency-of-ue-v-scheduled-tasks.md). - -You can configure the settings template catalog path by using the install command-line options, Group Policy, WMI, or PowerShell. Templates that are stored at the settings template catalog path are automatically registered and unregistered by a scheduled task. You can customize this scheduled task as needed. - -## Replace the default Microsoft templates - - -The UE-V agent installs a default group of settings location templates for common Microsoft applications and Windows settings. If your enterprise needs customized versions of these templates, the UE-V agent can be configured to use a settings template catalog and you should then replace the default Microsoft templates. - -During the installation of the UE-V agent, the command-line parameter, `RegisterMSTemplates`, can be used to disable the registration of the default Microsoft templates. For more information about how to set the UE-V parameters, see [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md). - -When you use Group Policy to configure the settings template catalog path, you can choose to replace the default Microsoft templates. If you configure the policy settings to replace the default Microsoft templates, all of the default Microsoft templates that are installed by the UE-V agent will be deleted from the computer, and only the templates that are located in the settings template catalog will be used. The UE-V Agent configuration setting `RegisterMSTemplates` must be set to true in order to override the default Microsoft template. - -**Note**   -If you disable this policy setting after it has been enabled, the UE-V agent will not restore the default Microsoft templates. - - - -If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, and the UE-V agent is not configured to replace the default Microsoft templates, the Microsoft templates in the catalog will be ignored. - -You can also replace the default templates by using the UE-V PowerShell features. To replace the default Microsoft Template with PowerShell, unregister all of the default Microsoft templates, and then register the customized templates. - -**Note**   -Old settings packages remain in the settings storage location even if new settings templates are deployed for an application. These packages are not read by the agent, but neither are they automatically deleted. - - - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) - -[Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) - -Planning for Custom Template Deployment - - - - - - - - diff --git a/mdop/uev-v1/planning-for-ue-v-10.md b/mdop/uev-v1/planning-for-ue-v-10.md deleted file mode 100644 index 5f62386c65..0000000000 --- a/mdop/uev-v1/planning-for-ue-v-10.md +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: Planning for UE-V 1.0 -description: Planning for UE-V 1.0 -author: dansimp -ms.assetid: fc44aa5f-1d4f-4c03-b326-37ecd6bd913f -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for UE-V 1.0 - - -The goal of deployment planning is to help you successfully and efficiently deploy Microsoft User Experience Virtualization (UE-V) so that it does not disrupt the user experience or the network. There are a number of different deployment configurations and prerequisites that you must consider before you create your deployment plan. This section includes information that can help you gather the necessary information to formulate a deployment plan that best meets your business requirements. - -## Planning information - - -[Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md) - -Provides prerequisites and recommended network configurations for UE-V. - -[Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) - -Lists the operating systems and computer configurations that are required for UE-V. - -[Planning for UE-V Configuration](planning-for-ue-v-configuration.md) - -Includes the following topics which provide specific guidance on UE-V configuration: - -- [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) – specifies whether to use the default Microsoft settings location templates or to deploy custom templates that are created with the UE-V Generator. - -- [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) – provides options for creation and deployment of custom settings location templates. - -- [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) – helps you decide how to configure the UE-V Agent and manage settings synchronization. - -[UE-V Checklist](ue-v-checklist.md) - -Provides a list of steps to plan, deploy, and manage UE-V. - -## Other resources for this product - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/planning-for-ue-v-configuration-methods.md b/mdop/uev-v1/planning-for-ue-v-configuration-methods.md deleted file mode 100644 index 52a0686c4c..0000000000 --- a/mdop/uev-v1/planning-for-ue-v-configuration-methods.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Planning for UE-V Configuration Methods -description: Planning for UE-V Configuration Methods -author: dansimp -ms.assetid: 57bce7ab-1be5-434b-9ee5-c96026bbe010 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for UE-V Configuration Methods - - -Microsoft User Experience Virtualization (UE-V) configurations determine how settings are synchronized throughout the enterprise. This topic describes how UE-V configurations are created to help you formulate a configuration plan that best meets your business requirements. - -## Configuration methods for UE-V - - -You can configure UE-V before, during, or after agent installation, depending on the configuration method that you use. - -**Group Policy:** existing Group Policy infrastructure can be used to configure UE-V before or after UE-V Agent deployment. The UE-V ADMX template enables the central management of common UE-V Agent configuration options, and it includes settings to configure UE-V synchronization. Network environments that use Group Policy can preconfigure UE-V in anticipation of agent deployment. - -[Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md) - -[Installing the UE-V Group Policy ADMX Templates](installing-the-ue-v-group-policy-admx-templates.md) - -**Command-line or Batch Script Installation:** parameters that are used with the deployment of the UE-V Agent allow the configuration of many UE-V settings. Electronic software distribution systems, such as System Center Configuration Manager, use these parameters to configure their clients when deploying and installing the UE-V Agent software. For a list of installation parameters and sample installation scripts, see [Deploying the UE-V Agent](deploying-the-ue-v-agent.md). - -**PowerShell and WMI:** scripted commands using PowerShell or WMI can be used to modify configurations after the UE-V Agent has been installed. For a list of PowerShell and WMI commands, see [Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md). - -**Edit Registry Settings:** UE-V settings are stored in the registry and can be modified by using any tool that can modify registry settings, such as RegEdit. - -**Note**   -Registry modification can result in data loss or the computer becoming unresponsive. We recommend that you use other configuration methods. - - - -### UE-V configuration settings - -The following are examples of UE-V configuration settings: - -- **Setting Storage Path:** specifies the location of the file share that stores the UE-V settings. - -- **Settings Template Catalog Path:** specifies the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates. - -- **Register Microsoft Templates:** specifies whether the default Microsoft templates should be registered during installation. - -- **Synchronization Method:** specifies whether the Windows Offline Files feature is used for offline support. - -- **Synchronization Timeout:** specifies the number of milliseconds that the computer waits before timeout when retrieving the user settings from the settings storage location. - -- **Synchronization Enable:** specifies whether the UE-V settings synchronization is enabled or disabled. - -- **Maximum Package Size:** specifies a settings package file threshold size in bytes at which the UE-V Agent reports a warning. - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Planning for UE-V Configuration](planning-for-ue-v-configuration.md) - - - - - - - - - diff --git a/mdop/uev-v1/planning-for-ue-v-configuration.md b/mdop/uev-v1/planning-for-ue-v-configuration.md deleted file mode 100644 index f30fd8a640..0000000000 --- a/mdop/uev-v1/planning-for-ue-v-configuration.md +++ /dev/null @@ -1,62 +0,0 @@ ---- -title: Planning for UE-V Configuration -description: Planning for UE-V Configuration -author: dansimp -ms.assetid: db78dad4-78e0-45d6-a235-8b7345cb79f8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning for UE-V Configuration - - -You can configure Microsoft User Experience Virtualization (UE-V) to meet the specific needs of your enterprise by defining which applications are deployed and which configurations define the UE-V behavior. - -## Plan which applications to synchronize with UE-V - - -UE-V includes a set of predefined settings location templates. UE-V also allows administrators to create custom settings location templates for other applications, including third-party or line-of-business applications that are used in the enterprise. This topic includes a list of applications that are included with the UE-V client and guidance on how to include custom settings location templates. - -[Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md) - -## Checklist for Evaluating Line-of-Business Applications for UE-V - - -Guidance on whether a line-of-business application should be synchronized. - -[Checklist for Evaluating Line-of-Business Applications for UE-V 1.0](checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md) - -## Plan custom template deployment - - -In order to support other applications, including third-party applications, you must create custom settings location templates by using the UE-V Generator, and deploy them to a settings template catalog. - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - -## Plan for UE-V configuration - - -UE-V configurations determine how settings are synchronized throughout the enterprise. These configurations can be made before, during, or after the UE-V Agent is deployed. UE-V provides a variety of configuration methods - -[Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md) - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md b/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md deleted file mode 100644 index d666e1873b..0000000000 --- a/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -title: Planning Which Applications to Synchronize with UE-V 1.0 -description: Planning Which Applications to Synchronize with UE-V 1.0 -author: dansimp -ms.assetid: c718274f-87b4-47f3-8ef7-5e1bd5557a9d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Planning Which Applications to Synchronize with UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) uses settings location templates (XML files) that define the settings that are captured and applied by UE-V. UE-V includes a set of predefined settings location templates and also allows administrators to create custom settings location templates for third-party or line-of-business applications that are used in the enterprise. - -As an administrator, when you consider which applications to include in your UE-V solution, consider which settings can be customized by users, and how and where the application stores its settings. Not all applications have settings that can be customized or that are routinely customized by users. In addition, not all applications settings can safely roam across multiple computers or environments. Synchronize settings that meet the following criteria: - -- Settings that are stored in user-accessible locations. For example, do not synchronize settings that are stored in system32 or outside HKCU section of the registry. - -- Settings that are not specific to the particular computer. For example, exclude network or hardware configurations. - -- Settings that can be synchronized between computers without risk of corrupted data. For example, do not use settings that are stored in a database file. - -## Settings location templates that are included in UE-V - - -**UE-V application settings location templates** - -The UE-V agent installation software installs the agent and registers a default group of settings location templates for common Microsoft applications. These settings location templates capture settings values for the following applications: - - ---- - - - - - - - - - - - - - - - - - - - - -
    Application categoryDescription

    Microsoft Office 2010 applications

    Microsoft Word 2010

    -

    Microsoft Excel 2010

    -

    Microsoft Outlook 2010

    -

    Microsoft Access 2010

    -

    Microsoft Project 2010

    -

    Microsoft PowerPoint 2010

    -

    Microsoft Publisher 2010

    -

    Microsoft Visio 2010

    -

    Microsoft SharePoint Workspace 2010

    -

    Microsoft InfoPath 2010

    -

    Microsoft Lync 2010

    -

    Microsoft OneNote 2010

    Browser options (Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10)

    Favorites, home page, tabs, and toolbars.

    Windows accessories

    Calculator, Notepad, WordPad.

    - - - -Application settings are applied to the application when the application is started. They are saved when the application closes. - -**UE-V Windows settings location templates** - -User Experience Virtualization includes settings location templates that capture settings values for the following Windows settings: - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows settingsDescriptionApply onDefault state

    Desktop background

    Currently active desktop background.

    Logon, unlock, remote connect.

    Enabled

    Ease of Access

    Accessibility and input settings, magnifier, Narrator, and on-Screen keyboard.

    Logon, unlock, remote connect.

    Disabled

    Desktop settings

    Start menu and Taskbar settings, Folder options, default desktop icons, additional clocks, and region and Language settings.

    Logon only.

    Disabled

    - - - -The Windows desktop background and Ease of Access settings are applied when the user logs on, when the computer is unlocked, or upon remote connection to another computer. The agent saves these settings when the user logs off, when the computer is locked, or when a remote connection is disconnected. By default, Windows desktop background settings are roamed between computers of the same operating system version. - -Windows desktop and Ease of Access settings are applied at logon before the desktop is presented to the user. To optimize the logon experience, these settings are not roamed by default. Desktop and Ease of Access settings can be enabled by using Group Policy, PowerShell, and WMI. - -UE-V does not support the roaming of settings between operating systems with different languages. For example, synchronization between English and German is not supported. The language of all computers to which UE-V roams the user settings must match. - -**Note**   -If you change the settings location templates that are provided by Microsoft, User Experience Virtualization might not work properly for the designated application or Windows settings group. - - - -## Prevent unintentional user Settings configuration - - -User Experience Virtualization checks for new user settings information, and downloads that information accordingly from a settings storage location. Then, it applies the settings to the local computer in the following cases: - -- Every time an application is launched that has a registered UE-V template. - -- When a user logs on to their computer. - -- When a user unlocks their computer. - -- When a connection is made to a remote desktop computer that has UE-V installed. - -If UE-V is installed on computer A and computer B, and the desired settings for the application are on computer A, then computer A must open and close the application first. If an application is opened and closed on computer B first, then the application settings on computer A will be configured to be the same as the application settings on computer B. - -This scenario also applies to Windows settings. If the Windows settings on computer B should be the same as the Windows settings on computer A, then the user should logon and logoff computer A first. - -If the desired user settings are applied in the wrong order, they can be recovered by performing a restore operation for the specific application or Windows configuration on the computer on which the settings were overwritten. For more information, see [Restoring Application and Windows Settings Synchronized with UE-V 1.0](restoring-application-and-windows-settings-synchronized-with-ue-v-10.md). - -## Custom UE-V settings location templates - - -You can create custom settings location templates by using the UE-V Generator. After you create and test a custom settings location template in a test environment, you can deploy the settings location templates to computers in the enterprise. Custom settings location templates must be deployed with an existing deployment infrastructure, such as enterprise software distribution (ESD) method, with preferences, or by configuring an UE-V settings template catalog. Templates that are deployed with ESD or Group Policy must be registered by using UE-V WMI or PowerShell. For more information about custom settings location templates, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -For guidance on whether a line-of-business application should be synchronized, see [Checklist for Evaluating Line-of-Business Applications for UE-V 1.0](checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md). - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/preparing-your-environment-for-ue-v.md b/mdop/uev-v1/preparing-your-environment-for-ue-v.md deleted file mode 100644 index d6c66d49ac..0000000000 --- a/mdop/uev-v1/preparing-your-environment-for-ue-v.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: Preparing Your Environment for UE-V -description: Preparing Your Environment for UE-V -author: dansimp -ms.assetid: c93d3b33-e032-451a-9e1b-8534e1625396 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Preparing Your Environment for UE-V - - -Microsoft User Experience Virtualization (UE-V) roams settings between computers by the use of a settings storage location. The settings storage location is a file share and should be configured during the UE-V Agent deployment. It must be defined either as a settings storage location or as an Active Directory home directory. In addition, the administrator should configure a time server to support consistent synchronization. To prepare your environment for UE-V, you should consider the following: - -- [UE-V Settings Storage](#bkmk-uevsettingsstorage): - - - [Defining a Settings Storage Location](#bkmk-definingsettingsstoragelocation) - - - [Using Active Directory Home Directory with UE-V](#bkmk-usingactivedirectoryhomedirectory) - -- [Synchronize Computer Clocks for UE-V Settings Synchronization](#bkmk-synchronizecomputerclocks) - -- [Performance and Capacity Planning](#bkmk-performancecapacityplanning) - -For more information about operating system and computer requirements, see [Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md). - -## UE-V settings storage - - -You can define the User Experience Virtualization settings storage in one of two configurations: a settings storage location or an Active Directory home directory. - -### Define a settings storage location - -The UE-V settings storage location is a standard network share that is accessible by UE-V users. Before you define the settings storage location, you must create a root directory. Users who will store settings on the share must have read/write permissions to the storage location. The UE-V Agent will create user-specific folders under this root directory. The settings storage location is defined by setting the **SettingsStoragePath** configuration option. This option can be configured in the following ways: - -- During the installation of the UE-V agent through a command-line parameter or in a batch script. - -- Using Group Policy. - -- After installation, by using PowerShell or WMI. - -The path must be in a universal naming convention (UNC) path of the server and share. For example, **\\\\server\\settingsshare\\**. This configuration option supports the use of variables to enable specific roaming scenarios. - -You can use the `%username%` variable with the UNC path of the server and share. This will provide the same settings experience on all computers or sessions that a user logs into. Consider this configuration for the following scenarios: - -1. Users in the enterprise have multiple, similarly configured physical computers and each user’s settings should be the same across all computers. - -2. Users in the enterprise use virtual desktop infrastructure (VDI) pools where settings should be retained across each user’s VDI sessions. - -3. Users in the enterprise have one physical computer and additionally use a VDI. Each user’s settings experience should be the same whether using the physical computer or VDI session. - -4. Multiple enterprise computers are used by multiple users. Each user’s settings experience should be the same across all computers. - -You can use the **%username%\\%computername%** variables with the UNC path of the server and share. This will preserve the settings experience for each computer. Consider this configuration for the following scenarios: - -1. Users in the enterprise have multiple physical computers and you want to preserve the settings experience for each computer. - -2. The enterprise computers are used by multiple users. The settings experience should be preserved for each computer that the user logs into. - -The UE-V agent dynamically creates the user-specific settings storage path based on a UE-V `SettingsStoragePath` configuration setting and the variables that are defined. - -The UE-V agent dynamically creates a hidden system folder named `SettingsPackages` within each user-specific storage location. The UE-V agent reads and writes settings to this location as defined by registered UE-V settings location templates. - -If the settings storage location is the same for a set of managed computers of a user, the applicable UE-V settings are determined by a “Last write wins” rule. The agent that runs on one computer reads and writes to the settings location independently of agents that run on other computers. The last settings and values written are the settings that are applied when the next agent reads from the settings storage location. For more information, see [Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md). - -### Use Active Directory home directory with UE-V - -If no settings storage location is configured for UE-V when the agent is deployed, then the user’s Active Directory (AD) home directory is used to store settings location packages. The UE-V agent dynamically creates the settings storage folder below the root of the AD home directory of each user. The agent only uses the Active Directory home directory if a settings storage location (SettingsStoragePath) is not otherwise defined. - -## Synchronize computer clocks for UE-V settings synchronization - - -Computers that run the UE-V agent to synchronize settings must use a time server. Time stamps are used to determine if settings need to be synchronized from the settings storage location. If the computer clock is inaccurate, older settings can overwrite newer settings, or the new settings might not be saved to the settings storage location. The use of a time server enables UE-V to maintain a consistent settings experience. - -## Performance and capacity planning - - -Capacity requirements for UE-V can be determined by use of standard disk capacity and network health monitoring. UE-V uses a Server Message Block (SMB) share for the storage of settings packages. The size of settings packages varies depending on the settings information for a specific application. While most settings packages are small, the synchronization of potentially large files, such as desktop images, can result in poor performance, particularly on slower networks. To minimize problems with network latency, you should create settings storage locations on the same local networks where the users’ computers reside. - -By default, the UE-V synchronization will time out after 2 seconds if the network is slow or the settings package is large. You can configure the timeout with Group Policy. For more information about how to set the timeout, see [Configuring UE-V with Group Policy Objects](configuring-ue-v-with-group-policy-objects.md). - -## Related topics - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Supported Configurations for UE-V 1.0](supported-configurations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md b/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md deleted file mode 100644 index 411cb7cc83..0000000000 --- a/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: Restoring Application and Windows Settings Synchronized with UE-V 1.0 -description: Restoring Application and Windows Settings Synchronized with UE-V 1.0 -author: dansimp -ms.assetid: 254a16b1-f186-44a4-8e22-49a4ee87c734 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Restoring Application and Windows Settings Synchronized with UE-V 1.0 - - -WMI and PowerShell features of Microsoft User Experience Virtualization (UE-V) provide the ability to restore settings packages. WMI and PowerShell commands allow you to restore application and Windows settings to the settings values that were on the computer the first time the application launched after the UE-V Agent was installed. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application is run or when the user logs on to the operating system. - -**To restore application settings and Windows settings with PowerShell** - -1. Open the Windows PowerShell window. To import the Microsoft UE-V PowerShell module, enter the following command: - - ``` syntax - Import-module UEV - ``` - -2. Enter the following PowerShell cmdlet to restore the application settings and Windows settings. - - - - - - - - - - - - - - - - - - -
    PowerShell cmdletDescription

    Restore-UevUserSetting

    Restores the user settings for an application or restores a group of Windows settings

    - -   - -**To restore application settings and Windows settings with WMI** - -1. Open a PowerShell window. - -2. Enter the following WMI command to restore application settings and Windows settings. - - - - - - - - - - - - - - - - - - -
    WMI commandDescription

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name RestoreByTemplateId -ArgumentList <template_ID>

    Restores the user settings for an application or restores a group of Windows settings

    - -   - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/security-and-privacy-for-ue-v-10.md b/mdop/uev-v1/security-and-privacy-for-ue-v-10.md deleted file mode 100644 index aadcb96e82..0000000000 --- a/mdop/uev-v1/security-and-privacy-for-ue-v-10.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Security and Privacy for UE-V 1.0 -description: Security and Privacy for UE-V 1.0 -author: dansimp -ms.assetid: c23d867d-7991-4c78-a123-a8a92758e5ba -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Security and Privacy for UE-V 1.0 - - -The following listed topics can help you plan for security and privacy considerations in Microsoft User Experience Virtualization (UE-V). - -## Security considerations for UE-V 1.0 - - -There are many security-related considerations that you should plan for when you deploy and use UE-V. The Security Considerations topic provides an overview of Active Directory Domain Services user accounts and groups, log files, and other security-related considerations for UE-V. - -[UE-V 1.0 Security Considerations](ue-v-10-security-considerations.md) - -## Privacy for UE-V 1.0 - - -The information in this section explains many of the data collection and use practices of UE-V. - -[User Experience Virtualization Privacy Statement](user-experience-virtualization-privacy-statement.md) - -## Other resources for this product - - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Administering UE-V 1.0](administering-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md b/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md deleted file mode 100644 index ebf7bc2cac..0000000000 --- a/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Sharing Settings Location Templates with the UE-V Template Gallery -description: Sharing Settings Location Templates with the UE-V Template Gallery -author: dansimp -ms.assetid: 3830ae0c-96dd-4a8d-96a2-df87aea81b27 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Sharing Settings Location Templates with the UE-V Template Gallery - - -## Share location templates with the template gallery - - -The Microsoft User Experience Virtualization (UE-V) template gallery allows administrators to share their UE-V settings location templates. In the gallery, you can upload your settings location templates for other people to use, and you can download templates that other people have created. The UE-V template gallery is located on Microsoft TechNet here: . - -Before you share a settings location template on the UE-V template gallery, make sure it does not contain any personal or company information. You can use any XML viewer to open and view the contents of a settings location template file. The following template values should be reviewed before you share it with anyone outside your company. - -- Template Author Name – Specify a general, non-identifying name for the template author name or exclude this data from the template. - -- Template Author Email – Specify a general, non-identifying template author email or exclude this data from the template. - -Before you deploy any settings location template that you have downloaded from the UE-V gallery, you should first test the template to ensure that the application settings roam correctly in a test environment. - -## Related topics - - -[Administering UE-V 1.0](administering-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/supported-configurations-for-ue-v-10.md b/mdop/uev-v1/supported-configurations-for-ue-v-10.md deleted file mode 100644 index b03acac6d8..0000000000 --- a/mdop/uev-v1/supported-configurations-for-ue-v-10.md +++ /dev/null @@ -1,181 +0,0 @@ ---- -title: Supported Configurations for UE-V 1.0 -description: Supported Configurations for UE-V 1.0 -author: dansimp -ms.assetid: d90ab83e-741f-48eb-b1d8-a64cb9259f7a -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Supported Configurations for UE-V 1.0 - - -Microsoft User Experience Virtualization (UE-V) supports the following described configurations. - -**Note**   -Microsoft provides support for the current service pack, and in some cases, the preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For more information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976). - - - -## Supported configurations for UE-V Agent and UE-V Generator - - -The following table lists the operating systems that support the User Experience Virtualization Generator and the User Experience Virtualization agent. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architectureMicrosoft .NET Framework

    Windows 7

    Ultimate, Enterprise, or Professional Edition

    SP1

    32-bit or 64-bit

    .NET Framework 3.5 SP1

    -

    .NET Framework 4 (Generator)

    Windows Server 2008 R2

    Standard, Enterprise, Data Center, or Web Server

    SP1

    64-bit

    .NET Framework 3.5 SP1

    -

    .NET Framework 4 (Generator)

    Windows 8

    Enterprise or Professional Edition

    None

    32-bit or 64-bit

    .NET Framework 4 or .NET Framework 3.5 SP1 (Agent)

    -

    .NET Framework 4 (Generator)

    Windows Server 2012

    Standard or Datacenter

    None

    64-bit

    .NET Framework 4 or .NET Framework 3.5 SP1 (Agent)

    -

    .NET Framework 4 (Generator)

    - - - -There are no special RAM requirements that are specific to UE-V. - -The installation of the UE-V agent requires administrative rights and will require a restart the computer before the UE-V agent can run. - -**Important**   -The Sync Your Settings feature in Windows 8 must be disabled to allow UE-V to function properly. Synchronization of settings with both Windows 8 and UE-V will result in unpredictable synchronization behavior. - - - -### Requirements for the Offline Files feature - -The UE-V agent can synchronize user settings for computers that are not always connected to the enterprise network, such as a laptop computer or computers that are located at remote offices, as well as computers that are always connected to the enterprise network, such as Windows Servers that host virtual desktop interface (VDI) sessions. - -The UE-V default configuration uses the Windows Offline File feature to synchronize settings. Offline Files ensures that the user’s settings are available even when the computer leaves the enterprise network. Any changes that are made to settings are automatically synchronized with the settings storage location when the connection to the enterprise network is reestablished. Offline Files also ensures that the user’s settings are available for computers that are located in a remote office with a slow or limited connection. - -To synchronize settings for computers that occasionally leave the enterprise network, the Offline Files feature must be enabled and started before the UE-V agent deployment begins. The Offline Files feature is enabled by default on Windows 7. The feature is disabled by default on Windows Server 2008 R2, Windows Server 2012, and Windows 8. If the Offline Files feature is not enabled, then UE-V settings synchronization will fail. - -- **Windows 7** - - The Offline Files feature is enabled by default on Windows 7. If necessary, Offline Files can be enabled by using the following command at an elevated command prompt: - - ``` syntax - sc config CscService start=auto - ``` - -- **Windows 8** - - The Offline Files feature is disabled by default on Windows 8 version. Offline Files can be enabled on Windows 8 by using the following command at an elevated command prompt: - - ``` syntax - sc config CscService start=auto - ``` - -- **Windows Server 2008 R2, and Windows Server 2012** - - The Offline Files feature is not installed by default on Windows Server 2008 R2 or Windows Server 2012. In order to enable the Offline Files feature, the Desktop Experience pack must be installed. This is an optional server component that includes the Offline Files feature. Once it is installed, start the Offline Files feature with the following commands at an elevated command prompt: - - ``` syntax - sc config csc start= system - ``` - - ``` syntax - sc config cscservice start= auto - ``` - -The computer must be rebooted before the settings will start to synchronize. - -### Synchronization for computers with always-available connections - -When you use UE-V on computers that are always connected to the enterprise network, such as a Windows Server computer that hosts VDI sessions, then Offline Files should be disabled. - -When the UE-V agent is configured to synchronize settings without using Offline Files, the settings storage server is treated as a standard network share. Settings are synchronized when the network is available. In this configuration the UE-V agent can be configured to give a notification if the import of the application settings is delayed. - -If the Offline Files feature will not be used, you must disable the UE-V default behavior before or during the UE-V agent deployment. To disable Offline Files for UE-V, do one of the following: - -- Before you deploy the UE-V agent, mark the “Do not use Offline Files” checkbox in the UE-V Group Policy setting. - -- During UE-V installation, set the AgentSetup.exe parameter `SyncMethod = None` at the command prompt or in a batch file. For more information about how to deploy the agent, see [Deploying the UE-V Agent](deploying-the-ue-v-agent.md). - -If you disable the Offline Files setting for UE-V and you do not specify the **SyncMethod** parameter at the installation time, the UE-V agent installation will fail. You can also disable the Offline Files with PowerShell or WMI. For more information about WMI and PowerShell commands, see [Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI](managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md). - -The computer must be rebooted before the settings will start to synchronize. - -### Prerequisites for the UE-V PowerShell feature - -The UE-V PowerShell feature of the agent requires .NET Framework version 3.5 SP1 to be enabled and PowerShell version 2.0 or higher. - -### Prerequisites for UE-V Generator support - -Install the UE-V Generator on the computer that is used to create custom settings location templates. This computer should have those applications installed whose settings will roam. You must be a member of the Administrators group on the computer that runs the UE-V Generator software. Additionally, the UE-V Generator must be installed on a computer that uses an NTFS file system. The UE-V Generator software requires .NET Framework version 4. For more information, see [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md). - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -Supported Configurations for User Experience Virtualization -[Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md) - -[Installing the UE-V Generator](installing-the-ue-v-generator.md) - -[Deploying the UE-V Agent](deploying-the-ue-v-agent.md) - - - - - - - - - diff --git a/mdop/uev-v1/troubleshooting-ue-v-10.md b/mdop/uev-v1/troubleshooting-ue-v-10.md deleted file mode 100644 index 2efd5fe123..0000000000 --- a/mdop/uev-v1/troubleshooting-ue-v-10.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Troubleshooting UE-V 1.0 -description: Troubleshooting UE-V 1.0 -author: dansimp -ms.assetid: e40f46a9-34f6-40ee-801b-9bf91f65c0e1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting UE-V 1.0 - - -Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## Find troubleshooting information - - -You can use the following information to find troubleshooting content or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. After you search the MDOP documentation, you can search the troubleshooting information for the product in the TechNet Wiki. These search methods are described in the following sections. - -**To search the MDOP product documentation** - -1. Open a web browser and navigate to the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) home page on TechNet. - -2. Locate the **Search TechNet with Bing** search box and enter your search term. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Open a web browser and navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Locate the **Search TechNet Wiki** search box and enter your search term. - -3. Review the search results for assistance. - -## Create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP Online Help or TechNet Wiki, you can create your own TechNet Wiki article. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Open a web browser and navigate to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Log on with your Windows Live ID. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article** in the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template (**Troubleshooting.html**), and then click **Insert**. - -6. Give the article a descriptive title and then overwrite the template information as needed to create your article. - -7. After you review your article, add a tag that is named **Troubleshooting** and another tag for the product name. This helps others to find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for this product - - -[Microsoft User Experience Virtualization (UE-V) 1.0](index.md) - -[Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md) - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/ue-v-10-security-considerations.md b/mdop/uev-v1/ue-v-10-security-considerations.md deleted file mode 100644 index ce833afd9f..0000000000 --- a/mdop/uev-v1/ue-v-10-security-considerations.md +++ /dev/null @@ -1,256 +0,0 @@ ---- -title: UE-V 1.0 Security Considerations -description: UE-V 1.0 Security Considerations -author: dansimp -ms.assetid: c5cdf9ff-dc96-4491-98e9-0eada898ffe0 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UE-V 1.0 Security Considerations - - -This topic contains a brief overview of accounts and groups, log files, and other security-related considerations for Microsoft User Experience Virtualization (UE-V). For more information, follow the links that are provided here. - -## Security considerations for UE-V configuration - - -**When you create the settings storage share, limit the share access to users that need access.** - -Because settings packages may contain personal information, you should take care to protect them as well as possible. In general, do the following: - -- Restrict the share to only the users that need access. Create a security group for users that have redirected folders on a particular share, and limit access to only those users. - -- When you create the share, hide the share by putting a $ after the share name. This will hide the share from casual browsers, and the share will not be visible in My Network Places. - -- Only give users the minimum amount of permissions needed. The permissions needed are shown in the tables below. - - 1. Set the following share-level (SMB) permissions for the setting storage location folder: - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissions

    Everyone

    No Permissions

    Security group of UE-V

    Full Control

    - - - -~~~ -2. Set the following NTFS permissions for the settings storage location folder: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissionsFolder

    Creator/Owner

    No Permissions

    No Permissions

    Domain Admins

    Full Control

    This Folder, Subfolders and Files

    Security group of UE-V users

    List Folder/Read Data, Create Folders/Append Data

    This Folder Only

    Everyone

    Remove all Permissions

    No Permissions

    - - - -3. Set the following share-level (SMB) permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommend permissions

    Everyone

    No Permissions

    Domain Computers

    Read Permission Levels

    Administrators

    Read/Write Permission Levels

    - - - -4. Set the following NTFS permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissionsApply to

    Creator/Owner

    Full Control

    This Folder, Subfolders and Files

    Domain Computers

    List Folder Contents and Read

    This Folder, Subfolders and Files

    Everyone

    No Permissions

    No Permissions

    Administrators

    Full Control

    This Folder, Subfolders and Files

    -~~~ - - - -### Use Windows Server 2003 or later servers to host redirected file shares - -User settings package files contain personal information that is transferred between the client computer and the server that stores the settings packages. Because of this, you should ensure that the data is protected while it travels over the network. - -User settings data is vulnerable to these potential threats: interception of the data as it passes over the network; tampering with the data as it passes over the network; and spoofing of the server that hosts the data. - -Several features of Windows Server 2003 and above can help to secure user data: - -- **Kerberos** - Kerberos is standard on all versions of Windows 2000 and Windows Server 2003 and later. Kerberos ensures the highest level of security to network resources. NTLM authenticates the client only; Kerberos authenticates the server and the client. When NTLM is used, the client does not know whether the server is valid. This is particularly important if the client is exchanging personal files with the server, as is the case with Roaming Profiles. Kerberos provides better security than NTLM. Kerberos is not available on Windows NT version 4.0 or earlier operating systems. - -- **IPsec** - The IP Security Protocol (IPsec) provides network-level authentication, data integrity, and encryption. IPsec ensures the following: - - - Roamed data is safe from data modification while en route. - - - Roamed data is safe from interception, viewing, or copying. - - - Roamed data is safe from being accessed by unauthenticated parties. - -- **SMB Signing** - The Server Message Block (SMB) authentication protocol supports message authentication which prevents active message and "man-in-the-middle" attacks. SMB signing provides this authentication by placing a digital signature into each SMB. The digital signature is then verified by both the client and the server. In order to use SMB signing, you must first either enable it or require it on both the SMB client and the SMB server. Note that the SMB signing imposes a performance penalty. It does not consume any more network bandwidth, but it uses more CPU cycles on the client and server side. - -### Always use the NTFS File system for volumes holding users data - -For the most secure configuration, configure servers that host the UE-V settings files to use the NTFS File System. Unlike FAT, NTFS supports Discretionary access control lists (DACLs) and system access control lists (SACLs). DACLs and SACLs control who can perform operations on a file and what events will trigger the logging of actions performed on a file. - -### Do not rely on EFS to encrypt users’ files when transmitted over the network - -When you use Encrypting File System (EFS) to encrypt files on a remote server, the encrypted data is not encrypted during transit over the network; It only becomes encrypted when stored on disk. - -The exceptions to this are when your system includes Internet Protocol security (IPsec) or Web Distributed Authoring and Versioning (WebDAV). IPsec encrypts data while it is transported over a TCP/IP network. If the file is encrypted before being copied or moved to a WebDAV folder on a server, it will remain encrypted during the transmission and while it is stored on the server. - -### Encrypt the Offline Files cache - -By default, the Offline Files cache is protected on NTFS partitions by ACLs, but encrypting the cache further enhances security on a local computer. By default, the cache on the local computer is not encrypted, so any encrypted files cached from the network will not be encrypted on the local computer. This may pose a security risk in some environments. - -When encryption is enabled, all files in the Offline Files cache are encrypted. This includes encrypting existing files as well as files that are added later. The cached copy on the local computer is affected, but the associated network copy is not. - -The cache can be encrypted in one of two ways: - -1. Via Group Policy. - Enable the **Encrypt the Offline Files Cache** setting, located at Computer Configuration\\Administrative Templates\\Network\\Offline Files, in the Group Policy editor. - -2. Manually. - Select Tools and then Folder Options in the command menu of Windows Explorer. Select the Offline Files tab, and then select the **Encrypt offline files to secure data** check box. - -### Let the UE-V Agent create folders for each user - -To ensure that UE-V works optimally, create only the root share on the server, and let the UE-V Agent create the folders for each user. UE-V will create these user folders with the appropriate security. - -This permission configuration allows users to create folders for settings storage. The UE-V agent creates and secures a settingspackage folder while running in the context of the user. The user receives full control to their settingspackage folder. Other users do not inherit access to this folder. You do not need to create and secure individual user directories. This will be done automatically by the agent that runs in the context of the user. - -**Note** -Additional security can be configured when a Windows server is utilized for the settings storage share. UE-V can be configured to verify that either the local administrator's group or the current user is the owner of the folder where settings packages are stored. To enable additional security use the following command: - -1. Add a REG\_DWORD registry key named "RepositoryOwnerCheckEnabled" to `HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration`. - -2. Set registry key value to 1. - -When this configuration setting is in place, the UE-V agent verifies that the local administrator’s group or current user is the owner of the settingspackage folder. If not, then the UE-V agent will not allow access to the folder. - - - -If you must create folders for the users and ensure that you have the correct permissions set. - -We strongly recommend that you do not precreate folders and that instead, you allow the UE-V agent to create the folder for the user. - -### Ensure that correct permissions are set when storing UE-V settings in a user’s home directory - -If you redirect UE-V settings to a user’s home directory, be sure that the permissions on the user's home directory are set appropriately for your organization. - -## Related topics - - -[Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/ue-v-checklist.md b/mdop/uev-v1/ue-v-checklist.md deleted file mode 100644 index 6cba1a8c57..0000000000 --- a/mdop/uev-v1/ue-v-checklist.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: UE-V Checklist -description: UE-V Checklist -author: dansimp -ms.assetid: 0e4b9bd5-4e60-4673-b698-90612008fc2b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# UE-V Checklist - - -Use this checklist to plan for preparing your computing environment for Microsoft User Experience Virtualization (UE-V) deployment. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TaskReferences

    Review the Getting Started information about UE-V to gain a basic understanding of the product before you begin the deployment planning.

    Getting Started With User Experience Virtualization 1.0

    Prepare your environment for UE-V 1.0 deployment.

    Preparing Your Environment for UE-V

    Plan which applications end users can synchronize with UE-V 1.0.

    Planning Which Applications to Synchronize with UE-V 1.0

    Custom settings templates only - create custom settings location templates and then define a setting template catalog.

    Deploying the Settings Template Catalog for UE-V 1.0

    -

    Create UE-V Settings Location Templates with the UE-V Generator

    Decide which method of configuration (Group Policy, PowerShell, ESD-command line, or batch file) works best for your environment and plan how to configure UE-V 1.0.

    Planning for UE-V Configuration Methods

    Deploy the network share to store settings packages.

    Deploying the Settings Storage Location for UE-V 1.0

    Custom settings templates only – deploy the features that are required to create and store applications other than the UE-V default applications.

    Deploying the Settings Template Catalog for UE-V 1.0

    -

    Installing the UE-V Generator

    Familiarize yourself with the administration and management tasks for UE-V.

    Administering UE-V 1.0

    - - - -## Related topics - - -[Planning for UE-V 1.0](planning-for-ue-v-10.md) - -[Deploying UE-V 1.0](deploying-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/user-experience-virtualization-privacy-statement.md b/mdop/uev-v1/user-experience-virtualization-privacy-statement.md deleted file mode 100644 index 32718bfa04..0000000000 --- a/mdop/uev-v1/user-experience-virtualization-privacy-statement.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: User Experience Virtualization Privacy Statement -description: User Experience Virtualization Privacy Statement -author: dansimp -ms.assetid: c2919034-f2cf-48d6-b18e-4dd318252426 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# User Experience Virtualization Privacy Statement - - -Microsoft is committed to protecting your privacy, while delivering software that brings you the performance, power, and convenience you desire in your personal computing. This privacy statement explains many of the data collection and use practices of Microsoft User Experience Virtualization (“UE-V”). This is a preliminary disclosure that focuses on features that communicate with the Internet and is not intended to be an exhaustive list. - -Microsoft User Experience Virtualization allows the separation of settings from an application or operating system. Those settings can then be transferred to a remote storage location, eliminating the constraints of local storage and giving users the ability to have their settings follow them to other computers. - -## Collection and Use of Your Information - - -The information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you are using and provide the service(s) or carry out the transaction(s) you have requested or authorized. It may also be used to analyze and improve Microsoft products and services. - -We may send certain mandatory service communications such as welcome letters, billing reminders, information on technical service issues, and security announcements. Some Microsoft services may send periodic member letters that are considered part of the service. We may occasionally request your feedback, invite you to participate in surveys, or send you promotional mailings to inform you of other products or services available from Microsoft and its affiliates. - -In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services. We may also supplement the information we collect with information obtained from other companies. For example, we may use services from other companies that enable us to derive a general geographic area based on your IP address in order to customize certain services to your geographic area. - -Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as packaging, sending and delivering purchases and other mailings, answering customer questions about products or services, processing event registration, or performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose. - -Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the services; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public. We may also disclose personal information as part of a corporate transaction such as a merger or sale of assets. - -Information that is collected by or sent to Microsoft by UE-V may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland. - -## Collection and Use of Information about Your Computer - - -When you use software with Internet-enabled features, information about your computer ("standard computer information") is sent to the Web sites you visit and online services you use. Microsoft uses standard computer information to provide you Internet-enabled services, to help improve our products and services, and for statistical analysis. Standard computer information typically includes information such as your IP address, operating system version, browser version, and regional and language settings. In some cases, standard computer information may also include hardware ID, which indicates the device manufacturer, device name, and version. If a particular feature or service sends information to Microsoft, standard computer information will be sent as well. - -The privacy details for each UE-V feature, software or service listed in this privacy statement describe what additional information is collected and how it is used. - -## Security of Your Information - - -Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. - -## Changes to This Privacy Statement - - -We will occasionally update this privacy statement to reflect changes in our products, services, and customer feedback. When we post changes, we will revise the "last updated" date at the top of this statement. If there are material changes to this statement or in how Microsoft will use your personal information, we will notify you either by posting a notice of such changes prior to implementing the change or by directly sending you a notification. We encourage you to periodically review this statement to be informed of how Microsoft is protecting your information. - -## For More Information - - -Microsoft welcomes your comments regarding this privacy statement. If you have questions about this statement or believe that we have not adhered to it, please contact us [MSUEVPrivacy@microsoft.com](mailto:%20MSUEVPrivacy@microsoft.com). - -## Specific features - - -The remainder of this document will address the following specific features: - -### UE-V Generator - -**What This Feature Does**: - -The UE-V generator is used to create settings location templates. These templates allow users to roam the settings for their applications. - -**Information Collected, Processed, or Transmitted**: - -When creating a settings location template the UE-V generator uses a Lightweight Directory Access Protocol (LDAP) query to get username and email address of the current logged in user. This information is stored in the template as the template author name and template author email. None of this information is sent to Microsoft. - -If you plan to share settings location templates with anyone outside your organization you should review all the settings locations and ensure the settings location template do not contain any personal or company information. You can view the contents by opening the settings location template files using any XML viewer. The following are ways you can view and remove any personal or company information from the settings location template files before sharing with anyone outside your company: - -- **Template Author Name** – Specify a general, non-identifying name for the template author name or exclude this data from the template. - -- **Template Author Email** – Specify a general, non-identifying template author email or exclude this data from the template. - -**Use of Information**: - -The template author name and template author email can be used to identify the author of settings location template. If you share the template, the author name and email is viewable to all who use the template. No information is sent to Microsoft. - -**Choice/Control**:  - -To remove the template author name or template author email, start the UE-V generator application. Select **Edit a Settings Location Template**. Select the settings location template to edit from the recently used templates or Browse to the settings template file. Select **Next** to continue. On the Properties page, remove the data from the Template author name or Template author email text fields. Save the settings location template. - -## Customer Experience Improvement Program - - -**What This Feature Does:** - -The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We will not collect your name, address, or other contact information. - -**Information Collected, Processed, or Transmitted:** - -For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . - -**Use of Information:** - -We use this information to improve the quality, reliability, and performance of Microsoft software and services. - -**Choice/Control:** - -You are offered the opportunity to participate in CEIP during setup of the UE-V Agent. If you choose to participate and later change your mind, you can turn off CEIP at any time by:Re-running the UE-V agent setup and opting out of CEIP or by setting the following registry key either manually or via Group Policy: - -``` syntax -Key = HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent -RegEntry name = CustomerExperienceImprovementProgram -Entry type REG_DWORD (Hexadecimal): -0 is off -1 is on -``` - -## Microsoft Error Reporting - - -**What This Feature Does:** - -Microsoft Error Reporting provides a service that allows you to report problems you may be having with UE-V or other enabled applications to Microsoft and to receive information that may help you avoid or solve such problems. - -**Information Collected, Processed, or Transmitted:** - -For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at . - -**Use of Information:** - -We use the error reporting data to solve customer problems and improve our software and services. - -**Choice/Control:** - -If you choose the recommended settings during Windows setup, you turn on automatic checking for solutions, which will send basic error reports and look for solutions to the problems reported. If you use automatic checking, you are not typically prompted to send basic information about errors to Microsoft. If a more detailed error report is required, you will be prompted to review it. You can change this setting at any time by going to Action Center in Control Panel. - -**Important Information:** - -Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at . - -UE-V will not modify the Microsoft Error Reporting preference and will honor the system setting in the Control Panel and/or the setting enforced via Group Policy. - -## Microsoft Update - - -**What This Feature Does:** - -Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software. - -**Information Collected, Processed, or Transmitted:** - -For details about what information is collected and how it is used, see the Update Services Privacy Statement at - -**Use of Information:** - -- For details about what information is collected and how it is used, see the Update Services Privacy Statement at . - -- Choice/Control: - - For details about controlling this feature, see the Update Services Privacy Statement at . - -## Related topics - - -[Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md) - - - - - - - - - diff --git a/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md b/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md deleted file mode 100644 index c94f45ff95..0000000000 --- a/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Validate UE-V Settings Location Templates with UE-V Generator -description: Validate UE-V Settings Location Templates with UE-V Generator -author: dansimp -ms.assetid: 131c636c-173a-4b41-af5d-9a75b453b9d8 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Validate UE-V Settings Location Templates with UE-V Generator - - -It is possible to create or edit settings locations templates in an XML editor without using the UE-V Generator. If you do so, you can use the UE-V Generator to validate that the new or revised XML matches the schema that has been defined for the template. - -**To validate a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, and then point to **All Programs**. Point to **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Validate a settings location template**. - -3. In the list of recently used templates, select the template to be edited. Alternatively, you can **Browse** to the settings template file. Click **Next** to continue. - -4. Click **Validate** to continue. - -5. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you validate the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into production in the enterprise. - -## Related topics - - -[Working with Custom UE-V Templates and the UE-V Generator](working-with-custom-ue-v-templates-and-the-ue-v-generator.md) - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md b/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md deleted file mode 100644 index 4447b5f189..0000000000 --- a/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Working with Custom UE-V Templates and the UE-V Generator -description: Working with Custom UE-V Templates and the UE-V Generator -author: dansimp -ms.assetid: 7bb2583a-b032-4800-9bf9-eb33528e1d0d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Working with Custom UE-V Templates and the UE-V Generator - - -In order to roam applications between user computers, Microsoft User Experience Virtualization (UE-V) uses *settings location templates*. Some settings location templates are included with User Experience Virtualization. You can also create, edit, or validate custom settings location templates with the UE-V Generator. - -The UE-V Generator monitors an application to discover and capture the locations where the application stores its settings. The application being monitored must be a traditional application. The UE-V Generator cannot create a settings location template for the following application types: - -- Virtualized applications - -- Application offered through terminal services - -- Java applications - -- Windows 8 applications - -## Create UE-V Settings Location Templates with the UE-V Generator - - -How to use the UE-V Generator to create settings location templates. - -[Create UE-V Settings Location Templates with the UE-V Generator](create-ue-v-settings-location-templates-with-the-ue-v-generator.md) - -## Edit UE-V Settings Location Templates with the UE-V Generator - - -How to use the UE-V Generator to edit settings location templates. - -[Edit UE-V Settings Location Templates with the UE-V Generator](edit-ue-v-settings-location-templates-with-the-ue-v-generator.md) - -## Validate UE-V Settings Location Templates with UE-V Generator - - -How to use the UE-V Generator to validate settings location templates modified outside the UE-V Generator. - -[Validate UE-V Settings Location Templates with UE-V Generator](validate-ue-v-settings-location-templates-with-ue-v-generator.md) - -## Standard and Nonstandard settings locations - - -The UE-V Generator helps you identify where applications look for settings files and registry settings that applications use to store settings information. You can use the UE-V Generator to open the application as part of the discovery process to capture settings in standard locations. Standard locations include the following: - -- **Registry Settings** – Registry locations under **HKEY\_CURRENT\_USER** - -- **Application Settings Files** – Files stored under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming** - -The UE-V Generator excludes locations which commonly store application software files do not roam well between user computers or environments. The UE-V Generator excludes these locations. Excluded locations are as follows: - -- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values - -- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system - -- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive (Requires Administrator rights and might require UAC agreement to set) - -- Files that are located in Program Files directories (Requires Administrator rights and might require UAC agreement to set) - -- Files located in Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files that are located in %systemroot% (Requires Administrator rights and might require UAC agreement to set) - -If registry keys and files stored in these locations are required in order to roam application settings, you can manually add the excluded locations to the settings location template during the template creation process. - -## Other resources for this product - - -[Operations for UE-V 1.0](operations-for-ue-v-10.md) - -[Administering UE-V 1.0](administering-ue-v-10.md) - -  - -  - - - - - diff --git a/mdop/uev-v2/TOC.md b/mdop/uev-v2/TOC.md deleted file mode 100644 index 3b2e1f1d06..0000000000 --- a/mdop/uev-v2/TOC.md +++ /dev/null @@ -1,33 +0,0 @@ -# [User Experience Virtualization 2.x](index.md) -## [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) -### [What's New in UE-V 2.1 SP1](whats-new-in-ue-v-21-sp1uevv21-sp1.md) -#### [Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md) -### [What's New in UE-V 2.1](whats-new-in-ue-v-21-new-uevv2.md) -#### [Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md) -### [What's New in UE-V 2.0](whats-new-in-ue-v-20-new-uevv2.md) -#### [Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md) -## [Prepare and Deploy UE-V 2.x](prepare-a-ue-v-2x-deployment-new-uevv2.md) -### [Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md) -### [Custom Application Deployment for UE-V 2.x](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) -## [Administer UE-V 2.x](administering-ue-v-2x-new-uevv2.md) -### [Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md) -#### [Configure UE-V 2.x with Group Policy](configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md) -#### [Configure UE-V 2.x with Configuration Manager](configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md) -#### [Administer UE-V 2.x with PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) -##### [Manage UE-V 2.x Agent and Packages](managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md) -##### [Manage UE-V 2.x Templates](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md) -#### [Configure the Company Settings Center for UE-V 2.x](configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md) -### [Custom UE-V 2.x Templates and the UE-V 2.x Generator](working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md) -### [Backup and Restore in UE-V 2.x](manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md) -### [UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md) -### [Migrate UE-V 2.x Settings Packages](migrating-ue-v-2x-settings-packages-both-uevv2.md) -### [UE-V 2.x and App-V](using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md) -## [Troubleshoot UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) -## [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) -### [Sync Methods for UE-V 2.x](sync-methods-for-ue-v-2x-both-uevv2.md) -### [Sync Trigger Events for UE-V 2.x](sync-trigger-events-for-ue-v-2x-both-uevv2.md) -### [Sync Office 2013 with UE-V 2.0](synchronizing-office-2013-with-ue-v-20-both-uevv2.md) -### [Schema Reference for UE-V 2.x](application-template-schema-reference-for-ue-v-2x-both-uevv2.md) -### [Accessibility for UE-V 2.x](accessibility-for-ue-v-2x-both-uevv2.md) -### [Security Considerations for UE-V 2.x](security-considerations-for-ue-v-2x-both-uevv2.md) - diff --git a/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index e27695620c..0000000000 --- a/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Accessibility for UE-V 2.x -description: Accessibility for UE-V 2.x -author: dansimp -ms.assetid: ec05da5f-4558-4d4d-9b58-3b8ed68cf2fe -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Accessibility for UE-V 2.x - - -Microsoft is committed to making its products and services easier for everyone to use. This section provides information about features and services that make this product and its corresponding documentation more accessible for people with disabilities. - -## Access any command with a few keystrokes - - -You can access most commands by using two keystrokes. To use an access key: - -1. Press Alt. - - The keyboard shortcuts are displayed over each feature that is available in the current view. - -2. Press the letter that is shown in the keyboard shortcut over the feature that you want to use. - -### Documentation in alternative formats - -If you have difficulty reading or handling printed materials, you can obtain the documentation for many Microsoft products in more accessible formats. You can view an index of accessible product documentation on the Microsoft Accessibility website. In addition, you can obtain additional Microsoft publications from Learning Ally, formerly known as Recording for the Blind & Dyslexic, Inc. Learning Ally distributes these documents to registered, eligible members of their distribution service. - -For information about the availability of Microsoft product documentation and books from Microsoft Press, use the following contact. - - ---- - - - - - - - - - - - - - - - - - - - - - - -

    Learning Ally (formerly Recording for the Blind & Dyslexic, Inc.)

    -

    20 Roszel Road

    -

    Princeton, NJ 08540

    Telephone number from within the United States:

    (800) 221-4792

    Telephone number from outside the United States and Canada:

    (609) 452-0606

    Fax:

    (609) 987-8116

    http://www.learningally.org/

    Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here.

    - - - -### Customer service for people with hearing impairments - -If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TTY/TDD) service: - -- For customer service, contact Microsoft Sales Information Center at (800) 892-5234 between 6:30 AM and 5:30 PM Pacific Time, Monday through Friday, excluding holidays. - -- For technical assistance in the United States, contact Microsoft Product Support Services at (800) 892-5234 between 6:00 AM and 6:00 PM Pacific Time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 AM and 8:00 PM Eastern Time, Monday through Friday, excluding holidays. - -Microsoft Support Services are subject to the prices, terms, and conditions in place at the time that the service is used. - -## For more information - - -For more information about how accessible technology for computers can help to improve the lives of people with disabilities, see the [Microsoft Accessibility website](https://go.microsoft.com/fwlink/p/?linkid=8431). - - - - - - -## Related topics - - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md b/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md deleted file mode 100644 index 67f7c914ec..0000000000 --- a/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Administering UE-V 2.x -description: Administering UE-V 2.x -author: dansimp -ms.assetid: 996e4797-8383-4627-b714-24a84c907798 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Administering UE-V 2.x - - -After you have deployed Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1, you must be able to perform various ongoing administrative tasks, such as managing the configuration of the UE-V Agent and recovering lost settings. These post-installation tasks are described in the following sections. - -## Managing UE-V 2.x configurations - - -In the course of the UE-V lifecycle, you have to manage the configuration of the UE-V Agent and also manage storage locations for resources such as settings package files. - -[Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md) - -## Working with custom UE-V templates and the UE-V 2.x Generator - - -This topic provides instructions for how to use the UE-V Generator and manage custom settings location templates. - -[Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator](working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md) - -## Backup and restore application and Windows settings that are synchronized with UE-V 2.x - - -Windows Management Instrumentation (WMI) and Windows PowerShell features of UE-V provide the ability to restore settings packages. By using WMI and Windows PowerShell commands, you can restore application and Windows settings to their original state and restore additional settings when a user adopts a new device. - -[Manage Administrative Backup and Restore in UE-V 2.x](manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md) - -## Changing the frequency of UE-V 2.x scheduled tasks - - -You can configure the scheduled tasks that manage when UE-V checks for new or updated settings or for updated custom settings location templates in the settings template catalog. - -[Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md) - -## Migrating UE-V 2.x settings packages - - -You can relocate the user settings packages either when they migrate to a new server or for backup purposes. - -[Migrating UE-V 2.x Settings Packages](migrating-ue-v-2x-settings-packages-both-uevv2.md) - -## Using UE-V 2.x with Application Virtualization applications - - -You can use UE-V with Microsoft Application Virtualization (App-V) to share settings between virtual applications and installed applications across multiple computers. - -[Using UE-V 2.x with Application Virtualization Applications](using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md) - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - -  - -  - - - - - diff --git a/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md deleted file mode 100644 index a34f4ed131..0000000000 --- a/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Administering UE-V 2.x with Windows PowerShell and WMI -description: Administering UE-V 2.x with Windows PowerShell and WMI -author: dansimp -ms.assetid: e749ac03-0adf-475a-a4f2-5cc023549b12 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Administering UE-V 2.x with Windows PowerShell and WMI - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 provide Windows PowerShell cmdlets, which can help administrators perform various UE-V tasks. The following sections provide more information about using Windows PowerShell in UE-V. - -**Note**   -Administering UE-V 2 with Windows PowerShell requires Windows PowerShell 3.0 or higher. For a complete list of UE-V PowerShell cmdlets, see [UE-V 2 Cmdlet Reference](https://go.microsoft.com/fwlink/p/?LinkId=393495). - - - -## Managing the UE-V 2.x Agent and packages by using Windows PowerShell and WMI - - -You can use Windows PowerShell and Windows Management Instrumentation (WMI) to manage UE-V Agent configuration and synchronization behavior. The following topic describes how to manage configuration and synchronization. The following topic describes how to manage configuration and synchronization. - -[Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI](managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md) - -## Managing UE-V 2.x settings location templates by using Windows PowerShell and WMI - - -After you create and deploy UE-V settings location templates, you can manage those templates by using Windows PowerShell or WMI. The following topic describes how to manage the settings location templates by using Windows PowerShell and WMI. - -[Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md) - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index f230087d93..0000000000 --- a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,1888 +0,0 @@ ---- -title: Application Template Schema Reference for UE-V 2.x -description: Application Template Schema Reference for UE-V 2.x -author: dansimp -ms.assetid: be8735a5-6a3e-4b1f-ba14-2a3bc3e5a8b6 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Application Template Schema Reference for UE-V 2.x - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 use XML settings location templates to define the desktop application settings and Windows settings that are captured and applied by UE-V. UE-V includes a set of default settings location templates. You can also create custom settings location templates with the UE-V Generator. - -An advanced user can customize the XML file for a settings location template. This topic details the XML structure of the UE-V 2.1 (SP1) and 2.0 settings location templates and provides guidance for editing these files. - -## UE-V 2.1 and 2.1 SP1 Application Template Schema Reference - - -This section details the XML structure of the UE-V 2.1 and 2.1 SP1 settings location template and provides guidance for editing this file. - -### In This Section - -- [XML Declaration and Encoding Attribute](#xml21) - -- [Namespace and Root Element](#namespace21) - -- [Data types](#data21) - -- [Name Element](#name21) - -- [ID Element](#id21) - -- [Version Element](#version21) - -- [Author Element](#author21) - -- [Processes and Process Element](#processes21) - -- [Application Element](#application21) - -- [Common Element](#common21) - -- [SettingsLocationTemplate Element](#settingslocationtemplate21) - -- [Appendix: SettingsLocationTemplate.xsd](#appendix21) - -### XML Declaration and Encoding Attribute - -**Mandatory: True** - -**Type: String** - -The XML declaration must specify the XML version 1.0 attribute (<?xml version="1.0">). Settings location templates created by the UE-V Generator are saved in UTF-8 encoding, although the encoding is not explicitly specified. We recommend that you include the encoding="UTF-8" attribute in this element as a best practice. All templates included with the product specify this tag as well (see the documents in %ProgramFiles%\\Microsoft User Experience Virtualization\\Templates for reference). For example: - -`` - -### Namespace and Root Element - -**Mandatory: True** - -**Type: String** - -UE-V uses the https://schemas.microsoft.com/UserExperienceVirtualization/2012/SettingsLocationTemplate namespace for all applications. SettingsLocationTemplate is the root element and contains all other elements. Reference SettingsLocationTemplate in all templates using this tag: - -`` - -### Data types - -These are the data types for the UE-V application template schema. - -**GUID** -GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders. - -**FilenameString** -FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters). - -**IDString** -IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It is restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+). - -**TemplateVersion** -TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647. - -**Empty** -Empty refers to a null value. This is used in Process\\ShellProcess to indicate that there is no process to monitor. This value should not be used in any application templates. - -**Author** -The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element. - -**Range** -Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included. - -**ProcessVersion** -ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional. - -**Architecture** -Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture. - -**Process** -The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Element

    Data Type

    Mandatory

    Filename

    FilenameString

    True

    Architecture

    Architecture

    False

    ProductName

    String

    False

    FileDescription

    String

    False

    ProductVersion

    ProcessVersion

    False

    FileVersion

    ProcessVersion

    False

    - - - -**Processes** -The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence. - -**Path** -Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default=”False”. - -Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders are not included. For registry paths, all values in the current path are captured but child registry keys are not captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items. - -The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server. - -**FileMask** -FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files. - -**RegistrySetting** -RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V Agent. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**. - -**FileSetting** -FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional. - -**Settings** -Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described: - - ---- - - - - - - - - - - - - - - - - - - -

    Element

    Description

    Asynchronous

    Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those get/set through an API, like SystemParameterSetting.

    PreventOverlappingSynchronization

    By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed.

    AlwaysApplySettings

    (introduced in 2.1)

    -

    This parameter forces an imported settings package to be applied even if there are no differences between the package and the current state of the application. This parameter should be used only in special cases since it can slow down settings import.

    - - - -### Name Element - -**Mandatory: True** - -**Type: String** - -Name specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. In general, avoid referencing version information, as this can be objected from the ProductVersion element. For example, specify `My Application` rather than `My Application 1.1`. - -**Note**   -UE-V does not reference external DTDs, so it is not possible to use named entities in a settings location template. For example, do not use ® to refer to the registered trade mark sign ®. Instead, use canonical numbered references to include these types of special characters, for example, &\#174 for the ® character. This rule applies to all string values in this document. - -See for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V Generator converts character entities to their Unicode representations automatically. - - - -### ID Element - -**Mandatory: True** - -**Type: String** - -ID populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime (for example, see the output of the Get-UevTemplate and Get-UevTemplateProgram PowerShell cmdlets). By convention, this tag should not contain any spaces, which simplifies scripting. Version numbers of applications should be specified in this element to allow for easy identification of the template, such as `MicrosoftCalculator6` or `MicrosoftOffice2010Win64`. - -### Version Element - -**Mandatory: True** - -**Type: Integer** - -**Minimum Value: 0** - -**Maximum Value: 2147483647** - -Version identifies the version of the settings location template for administrative tracking of changes. The UE-V Generator automatically increments this number by one each time the template is saved. Notice that this field must be a whole number integer; fractional values, such as `2.5` are not allowed. - -**Hint:** You can save notes about version changes using XML comment tags ``, for example: - -```xml - - 4 -``` - -**Important**   -This value is queried to determine if a new version of a template should be applied to an existing template in these instances: - -- When the scheduled Template Auto Update task executes - -- When the Update-UevTemplate PowerShell cmdlet is executed - -- When the microsoft\\uev:SettingsLocationTemplate Update method is called through WMI - - - -### Author Element - -**Mandatory: False** - -**Type: String** - -Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V). - -### Processes and Process Element - -**Mandatory: True** - -**Type: Element** - -Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example: - -```xml - - MyApplication.exe - Win64 - MyApplication - MyApplication.exe - - - - - - - - - - - - - -``` - -### Filename - -**Mandatory: True** - -**Type: String** - -Filename refers to the actual file name of the executable as it appears in the file system. This element specifies the primary criterion that UE-V uses to evaluate whether a template applies to a process or not. This element must be specified in the settings location template XML. - -Valid filenames must not match the regular expression \[^\\\\\\?\\\*\\|<>/:\]+, that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon (the \\ ? \* | < > / or : characters.). - -**Hint:** To test a string against this regex, use a PowerShell command window and substitute your executable’s name for **YourFileName**: - -`"YourFileName.exe" -match "[\\\?\*\|<>/:]+"` - -A value of **True** indicates that the string contains illegal characters. Here are some examples of illegal values: - -- \\\\server\\share\\program.exe - -- Program\*.exe - -- Pro?ram.exe - -- Program<1>.exe - -**Note**   -The UE-V Generator encodes the greater than and less than characters as > and < respectively. - - - -In rare circumstances, the FileName value will not necessarily include the .exe extension, but it should be specified as part of the value. For example, `MyApplictication.exe` should be specified instead of `MyApplictication`. The second example will not apply the template to the process if the actual name of the executable file is “MyApplication.exe”. - -### Architecture - -**Mandatory: False** - -**Type: Architecture (String)** - -Architecture refers to the processor architecture for which the target executable was compiled. Valid values are Win32 for 32-bit applications or Win64 for 64-bit applications. If present, this tag limits the applicability of the settings location template to a particular application architecture. For an example of this, compare the %ProgramFiles%\\Microsoft User Experience Virtualization\\templates\\ MicrosoftOffice2010Win32.xml and MicrosoftOffice2010Win64.xml files included with UE-V. This is useful when relative paths change between different versions of an executable or if settings have been added or removed when moving from one processor architecture to another. - -If this element is absent, the settings location template ignores the process’ architecture and applies to both 32 and 64-bit processes if the file name and other attributes apply. - -**Note**   -UE-V does not support ARM processors in this version. - - - -### ProductName - -**Mandatory: False** - -**Type: String** - -ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example: - -```xml - - MyApplication.exe - My Application 6.x by Contoso.com - - - - -``` - -### FileDescription - -**Mandatory: False** - -**Type: String** - -FileDescription is an optional tag that allows for an administrative description of the executable file. This is a free text field and can be useful in distinguishing multiple executables within a software package where there is a need to identify the function of the executable. - -For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here: - -```xml - - - MyApplication.exe - My Application Main Engine - - - - - - MyApplicationHelper.exe - My Application Background Process Executable - - - - - -``` - -### ProductVersion - -**Mandatory: False** - -**Type: String** - -ProductVersion refers to the major and minor product versions of a file, as well as a build and patch level. ProductVersion is an optional element, but if specified, it must contain at least the Major child element. The value must express a range in the form Minimum="X" Maximum="Y" where X and Y are integers. The Minimum and Maximum values can be identical. - -The product and file version elements may be left unspecified. Doing so makes the template “version agnostic”, meaning that the template will apply to all versions of the specified executable. - -**Example 1:** - -Product version: 1.0 specified in the UE-V Generator produces the following XML: - -```xml - - - - -``` - -**Example 2:** - -File version: 5.0.2.1000 specified in the UE-V Generator produces the following XML: - -```xml - - - - - - -``` - -**Incorrect Example 1 – incomplete range:** - -Only the Minimum attribute is present. Maximum must be included in a range as well. - -```xml - - - -``` - -**Incorrect Example 2 – Minor specified without Major element:** - -Only the Minor element is present. Major must be included as well. - -```xml - - - -``` - -### FileVersion - -**Mandatory: False** - -**Type: String** - -FileVersion differentiates between the release version of a published application and the internal build details of a component executable. For the majority of commercial applications, these numbers are identical. Where they vary, the product version of a file indicates a generic version identification of a file, while file version indicates a specific build of a file (as in the case of a hotfix or update). This uniquely identifies files without breaking detection logic. - -To determine the product version and file version of a particular executable, right-click on the file in Windows Explorer, select Properties, then click on the Details tab. - -Including a FileVersion element for an application allows for more granular fine-tuning detection logic, but is not necessary for most applications. The ProductVersion element settings are checked first, and then FileVersion is checked. The more restrictive setting will apply. - -The child elements and syntax rules for FileVersion are identical to those of ProductVersion. - -```xml - - MSACCESS.EXE - Win32 - - - - - - - - - -``` - -### Application Element - -Application is a container for settings that apply to a particular application. It is a collection of the following fields/types. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Field/Type

    Description

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    Version

    Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.

    DeferToMSAccount

    Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

    DeferToOffice365

    Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

    FixedProfile (Introduced in 2.1)

    Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.

    Processes

    A container for a collection of one or more Process elements. For more information, see Processes.

    Settings

    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.

    - - - -### Common Element - -Common is similar to an Application element, but it is always associated with two or more Application elements. The Common section represents the set of settings that are shared between those Application instances. It is a collection of the following fields/types. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Field/Type

    Description

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    Version

    Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.

    DeferToMSAccount

    Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

    DeferToOffice365

    Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

    FixedProfile (Introduced in 2.1)

    Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.

    Settings

    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.

    - - - -### SettingsLocationTemplate Element - -This element defines the settings for a single application or a suite of applications. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Field/Type

    Description

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    - - - -### Appendix: SettingsLocationTemplate.xsd - -Here is the SettingsLocationTemplate.xsd file showing its elements, child elements, attributes, and parameters: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -## UE-V 2.0 Application Template Schema Reference - - -This section details the XML structure of the UE-V 2.0 settings location template and provides guidance for editing this file. - -### In This Section - -- [XML Declaration and Encoding Attribute](#xml) - -- [Namespace and Root Element](#namespace) - -- [Data types](#data) - -- [Name Element](#name) - -- [ID Element](#id) - -- [Version Element](#version) - -- [Author Element](#author) - -- [Processes and Process Element](#processes) - -- [Application Element](#application) - -- [Common Element](#common) - -- [SettingsLocationTemplate Element](#settingslocationtemplate) - -- [Appendix: SettingsLocationTemplate.xsd](#appendix) - -### XML Declaration and Encoding Attribute - -**Mandatory: True** - -**Type: String** - -The XML declaration must specify the XML version 1.0 attribute (<?xml version="1.0">). Settings location templates created by the UE-V Generator are saved in UTF-8 encoding, although the encoding is not explicitly specified. We recommend that you include the encoding="UTF-8" attribute in this element as a best practice. All templates included with the product specify this tag as well (see the documents in %ProgramFiles%\\Microsoft User Experience Virtualization\\Templates for reference). For example: - -`` - -### Namespace and Root Element - -**Mandatory: True** - -**Type: String** - -UE-V uses the https://schemas.microsoft.com/UserExperienceVirtualization/2012/SettingsLocationTemplate namespace for all applications. SettingsLocationTemplate is the root element and contains all other elements. Reference SettingsLocationTemplate in all templates using this tag: - -`` - -### Data types - -These are the data types for the UE-V application template schema. - -**GUID** -GUID describes a standard globally unique identifier regular expression in the form "\\{\[a-fA-F0-9\]{8}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{4}-\[a-fA-F0-9\]{12}\\}". This is used in the Filesetting\\Root\\KnownFolder element to verify the formatting of well-known folders. - -**FilenameString** -FilenameString refers to the file name of a process to be monitored. Its values are restricted by the regex \[^\\\\\\?\\\*\\|<>/:\]+, (that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon characters). - -**IDString** -IDString refers to the ID value of Application elements, SettingsLocationTemplate, and Common elements (used to describe application suites that share common settings). It is restricted by the same regex as FilenameString (\[^\\\\\\?\\\*\\|<>/:\]+). - -**TemplateVersion** -TemplateVersion is an integer value used to describe the revision of the settings location template. Its value may range from 0 to 2147483647. - -**Empty** -Empty refers to a null value. This is used in Process\\ShellProcess to indicate that there is no process to monitor. This value should not be used in any application templates. - -**Author** -The Author data type is a complex type that identifies the author of a template. It contains two child elements: **Name** and **Email**. Within the Author data type, the Name element is mandatory while the Email element is optional. This type is described in more detail under the SettingsLocationTemplate element. - -**Range** -Range defines an integer class consisting of two child elements: **Minimum** and **Maximum**. This data type is implemented in the ProcessVersion data type. If specified, both Minimum and Maximum values must be included. - -**ProcessVersion** -ProcessVersion defines a type with four child elements: **Major**, **Minor**, **Build**, and **Patch**. This data type is used by the Process element to populate its ProductVersion and FileVersion values. The data for this type is a Range value. The Major child element is mandatory and the others are optional. - -**Architecture** -Architecture enumerates two possible values: **Win32** and **Win64**. These values are used to specify process architecture. - -**Process** -The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ElementData TypeMandatory

    Filename

    FilenameString

    True

    Architecture

    Architecture

    False

    ProductName

    String

    False

    FileDescription

    String

    False

    ProductVersion

    ProcessVersion

    False

    FileVersion

    ProcessVersion

    False

    - - - -**Processes** -The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence. - -**Path** -Path is consumed by RegistrySetting and FileSetting to refer to registry and file paths. This element supports two optional attributes: **Recursive** and **DeleteIfNotFound**. Both values are set to default=”False”. - -Recursive indicates that the path and all subfolders are included for file settings or that all child registry keys are included for registry settings. In both cases, all items at the current level are included in the data captured. For a FileSettings object, all files within the specified folder are included in the data captured by UE-V but folders are not included. For registry paths, all values in the current path are captured but child registry keys are not captured. In both cases, care should be taken to avoid capturing large data sets or large numbers of items. - -The DeleteIfNotFound attribute removes the setting from the user’s settings storage path data. This may be desirable in cases where removing these settings from the package will save a large amount of disk space on the settings storage path file server. - -**FileMask** -FileMask specifies only certain file types for the folder that is defined by Path. For example, Path might be `C:\users\username\files` and FileMask could be `*.txt` to include only text files. - -**RegistrySetting** -RegistrySetting represents a container for registry keys and values and the associated desired behavior on the part of the UE-V Agent. Four child elements are defined within this type: **Path**, **Name**, **Exclude**, and a sequence of the values **Path** and **Name**. - -**FileSetting** -FileSetting contains parameters associated with files and files paths. Four child elements are defined: **Root**, **Path**, **FileMask**, and **Exclude**. Root is mandatory and the others are optional. - -**Settings** -Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described: - - ---- - - - - - - - - - - - - - - - - -
    ElementDescription

    Asynchronous

    Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those get/set through an API, like SystemParameterSetting.

    PreventOverlappingSynchronization

    By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed.

    - - - -### Name Element - -**Mandatory: True** - -**Type: String** - -Name specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. In general, avoid referencing version information, as this can be objected from the ProductVersion element. For example, specify `My Application` rather than `My Application 1.1`. - -**Note**   -UE-V does not reference external DTDs, so it is not possible to use named entities in a settings location template. For example, do not use ® to refer to the registered trade mark sign ®. Instead, use canonical numbered references to include these types of special characters, for example, &\#174 for the ® character. This rule applies to all string values in this document. - -See for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V Generator converts character entities to their Unicode representations automatically. - - - -### ID Element - -**Mandatory: True** - -**Type: String** - -ID populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime (for example, see the output of the Get-UevTemplate and Get-UevTemplateProgram PowerShell cmdlets). By convention, this tag should not contain any spaces, which simplifies scripting. Version numbers of applications should be specified in this element to allow for easy identification of the template, such as `MicrosoftCalculator6` or `MicrosoftOffice2010Win64`. - -### Version Element - -**Mandatory: True** - -**Type: Integer** - -**Minimum Value: 0** - -**Maximum Value: 2147483647** - -Version identifies the version of the settings location template for administrative tracking of changes. The UE-V Generator automatically increments this number by one each time the template is saved. Notice that this field must be a whole number integer; fractional values, such as `2.5` are not allowed. - -**Hint:** You can save notes about version changes using XML comment tags ``, for example: - -```xml - -4 -``` - -**Important**   -This value is queried to determine if a new version of a template should be applied to an existing template in these instances: - -- When the scheduled Template Auto Update task executes - -- When the Update-UevTemplate PowerShell cmdlet is executed - -- When the microsoft\\uev:SettingsLocationTemplate Update method is called through WMI - - - -### Author Element - -**Mandatory: False** - -**Type: String** - -Author identifies the creator of the settings location template. Two optional child elements are supported: **Name** and **Email**. Both attributes are optional, but, if the Email child element is specified, it must be accompanied by the Name element. Author refers to the full name of the contact for the settings location template, and email should refer to an email address for the author. We recommend that you include this information in templates published publicly, for example, on the [UE-V Template Gallery](https://gallery.technet.microsoft.com/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=UE-V). - -### Processes and Process Element - -**Mandatory: True** - -**Type: Element** - -Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example: - -```xml - - MyApplication.exe - Win64 - MyApplication - MyApplication.exe - - - - - - - - - - - - - -``` - -### Filename - -**Mandatory: True** - -**Type: String** - -Filename refers to the actual file name of the executable as it appears in the file system. This element specifies the primary criterion that UE-V uses to evaluate whether a template applies to a process or not. This element must be specified in the settings location template XML. - -Valid filenames must not match the regular expression \[^\\\\\\?\\\*\\|<>/:\]+, that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon (the \\ ? \* | < > / or : characters.). - -**Hint:** To test a string against this regex, use a PowerShell command window and substitute your executable’s name for **YourFileName**: - -`"YourFileName.exe" -match "[\\\?\*\|<>/:]+"` - -A value of **True** indicates that the string contains illegal characters. Here are some examples of illegal values: - -- \\\\server\\share\\program.exe - -- Program\*.exe - -- Pro?ram.exe - -- Program<1>.exe - -**Note**   -The UE-V Generator encodes the greater than and less than characters as > and < respectively. - - - -In rare circumstances, the FileName value will not necessarily include the .exe extension, but it should be specified as part of the value. For example, `MyApplictication.exe` should be specified instead of `MyApplictication`. The second example will not apply the template to the process if the actual name of the executable file is “MyApplication.exe”. - -### Architecture - -**Mandatory: False** - -**Type: Architecture (String)** - -Architecture refers to the processor architecture for which the target executable was compiled. Valid values are Win32 for 32-bit applications or Win64 for 64-bit applications. If present, this tag limits the applicability of the settings location template to a particular application architecture. For an example of this, compare the %ProgramFiles%\\Microsoft User Experience Virtualization\\templates\\ MicrosoftOffice2010Win32.xml and MicrosoftOffice2010Win64.xml files included with UE-V. This is useful when relative paths change between different versions of an executable or if settings have been added or removed when moving from one processor architecture to another. - -If this element is absent, the settings location template ignores the process’ architecture and applies to both 32 and 64-bit processes if the file name and other attributes apply. - -**Note**   -UE-V does not support ARM processors in this version. - - - -### ProductName - -**Mandatory: False** - -**Type: String** - -ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example: - -```xml - - MyApplication.exe - My Application 6.x by Contoso.com - - - - -``` - -### FileDescription - -**Mandatory: False** - -**Type: String** - -FileDescription is an optional tag that allows for an administrative description of the executable file. This is a free text field and can be useful in distinguishing multiple executables within a software package where there is a need to identify the function of the executable. - -For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here: - -```xml - - - MyApplication.exe - My Application Main Engine - - - - - - MyApplicationHelper.exe - My Application Background Process Executable - - - - - -``` - -### ProductVersion - -**Mandatory: False** - -**Type: String** - -ProductVersion refers to the major and minor product versions of a file, as well as a build and patch level. ProductVersion is an optional element, but if specified, it must contain at least the Major child element. The value must express a range in the form Minimum="X" Maximum="Y" where X and Y are integers. The Minimum and Maximum values can be identical. - -The product and file version elements may be left unspecified. Doing so makes the template “version agnostic”, meaning that the template will apply to all versions of the specified executable. - -**Example 1:** - -Product version: 1.0 specified in the UE-V Generator produces the following XML: - -```xml - - - - -``` - -**Example 2:** - -File version: 5.0.2.1000 specified in the UE-V Generator produces the following XML: - -```xml - - - - - - -``` - -**Incorrect Example 1 – incomplete range:** - -Only the Minimum attribute is present. Maximum must be included in a range as well. - -```xml - - - -``` - -**Incorrect Example 2 – Minor specified without Major element:** - -Only the Minor element is present. Major must be included as well. - -```xml - - - -``` - -### FileVersion - -**Mandatory: False** - -**Type: String** - -FileVersion differentiates between the release version of a published application and the internal build details of a component executable. For the majority of commercial applications, these numbers are identical. Where they vary, the product version of a file indicates a generic version identification of a file, while file version indicates a specific build of a file (as in the case of a hotfix or update). This uniquely identifies files without breaking detection logic. - -To determine the product version and file version of a particular executable, right-click on the file in Windows Explorer, select Properties, then click on the Details tab. - -Including a FileVersion element for an application allows for more granular fine-tuning detection logic, but is not necessary for most applications. The ProductVersion element settings are checked first, and then FileVersion is checked. The more restrictive setting will apply. - -The child elements and syntax rules for FileVersion are identical to those of ProductVersion. - -```xml - - MSACCESS.EXE - Win32 - - - - - - - - - -``` - -### Application Element - -Application is a container for settings that apply to a particular application. It is a collection of the following fields/types. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Field/TypeDescription

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    Version

    Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.

    DeferToMSAccount

    Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

    DeferToOffice365

    Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

    Processes

    A container for a collection of one or more Process elements. For more information, see Processes.

    Settings

    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.

    - - - -### Common Element - -Common is similar to an Application element, but it is always associated with two or more Application elements. The Common section represents the set of settings that are shared between those Application instances. It is a collection of the following fields/types. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Field/TypeDescription

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    Version

    Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.

    DeferToMSAccount

    Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.

    DeferToOffice365

    Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.

    Settings

    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.

    - - - -### SettingsLocationTemplate Element - -This element defines the settings for a single application or a suite of applications. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Field/TypeDescription

    Name

    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.

    ID

    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.

    Description

    An optional description of the template.

    LocalizedNames

    An optional name displayed in the UI, localized by a language locale.

    LocalizedDescriptions

    An optional template description localized by a language locale.

    - - - -### Appendix: SettingsLocationTemplate.xsd - -Here is the SettingsLocationTemplate.xsd file showing its elements, child elements, attributes, and parameters: - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - - - - - - -## Related topics - - -[Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator](working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md) - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md b/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md deleted file mode 100644 index f5e5b49ddb..0000000000 --- a/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md +++ /dev/null @@ -1,337 +0,0 @@ ---- -title: Changing the Frequency of UE-V 2.x Scheduled Tasks -description: Changing the Frequency of UE-V 2.x Scheduled Tasks -author: dansimp -ms.assetid: ee486570-c6cf-4fd9-ba48-0059ba877c10 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 09/29/2016 ---- - - -# Changing the Frequency of UE-V 2.x Scheduled Tasks - - -The Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1 Agent installer, AgentSetup.exe, creates the following scheduled tasks during the UE-V Agent installation: - -- **Monitor Application Settings** - -- **Sync Controller Application** - -- **Synchronize Settings at Logoff** - -- **Template Auto Update** - -- **Collect CEIP data** - -- **Upload CEIP Data** - -**Note**   -With the exception of Collect CEIP Data, these tasks must remain enabled as UE-V cannot function without them. - - - -These scheduled tasks are not configurable with the UE-V tools. Administrators who want to change the scheduled task for these items can create a script that uses the Schtasks.exe command-line options. - -For more information about Schtasks.exe, see [How to use Schtasks,exe to Schedule Tasks in Windows Server 2003](https://go.microsoft.com/fwlink/?LinkID=264854). - -For more information about - -## UE-V Scheduled Tasks - - -The following scheduled tasks are included in UE-V 2 with sample scheduled task configuration commands. - -### Collect CEIP Data - -If upon installation the user or administrator choses to participate in the Customer Experience Improvement Program (CEIP), UE-V collects data to help improve the product in future releases. This scheduled task only runs at logon. The **Collect CEIP Data** task runs the UevSqmSession.exe, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
    Task nameDefault event

    \Microsoft\UE-V\Collect CEIP data

    Logon

    - - - -### Monitor Application Settings - -The **Monitor Application Settings** task is used to synchronize settings for Windows apps. It is run at logon but is delayed by 30 seconds to not affect the logon detrimentally. The Monitor Application Status task runs the UevAppMonitor.exe file, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
    Task nameDefault event

    \Microsoft\UE-V\Monitor Application Status

    Logon

    - - - -### Sync Controller Application - -The **Sync Controller Application** task is used to start the Sync Controller to synchronize settings from the computer to the settings storage location. By default, the task runs every 30 minutes. At that time, local settings are synchronized to the settings storage location, and updated settings on the settings storage location are synchronized to the computer. The Sync Controller application runs the Microsoft.Uev.SyncController.exe, which is located in the UE-V Agent installation directory. -**Note:** As per the **Monitor Application Settings** task, this task is run at logon but is delayed by 30 seconds to not affect the logon detrimentally. - ---- - - - - - - - - - - - - -
    Task nameDefault event

    \Microsoft\UE-V\Sync Controller Application

    Logon, and every 30 minutes thereafter

    - - - -For example, the following command configures the agent to synchronize settings every 15 minutes instead of the default 30 minutes. - -``` syntax -Schtasks /change /tn “Microsoft\UE-V\Sync Controller Application” /ri 15 -``` - -### Synchronize Settings at Logoff - -The **Synchronize Settings at Logoff** task is used to start an application at logon that controls the synchronization of applications at logoff for UE-V. The Synchronize Settings at Logoff task runs the Microsoft.Uev.SyncController.exe file, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
    Task nameDefault event

    \Microsoft\UE-V\Synchronize Settings at Logoff

    Logon

    - - - -### Template Auto Update - -The **Template Auto Update** task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The **Template Auto Update** task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
    Task nameDefault event

    \Microsoft\UE-V\Template Auto Update

    System startup and at 3:30 AM every day, at a random time within a 1-hour window

    - - - -**Example:** The following command configures the UE-V Agent to check the settings template catalog store every hour. - -``` syntax -schtasks /change /tn "Microsoft\UE-V\Template Auto Update" /ri 60 -``` - -### Upload CEIP Data - -The **Upload CEIP Data** task runs during the installation if the user or the administrator chose to participate in the Customer Experience Improvement Program (CEIP). This task uploads the data to the CEIP servers where the data is used to help improve the product for future releases of UE-V. This scheduled task runs at logon and every 4 hours afterwards. The **Upload CEIP data** task runs the UevSqmUploader.exe file, which is located in the UE-V Agent installation directory. - - ---- - - - - - - - - - - - - -
    Task nameDefault event

    \Microsoft\UE-V\Upload CEIP data

    At logon and every 4 hours

    - - - -## UE-V 2 Scheduled Task Details - - -The following chart provides additional information about scheduled tasks for UE-V 2: - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Task Name (file name)

    Default Frequency

    Power Toggle

    Idle Only

    Network Connection

    Description

    Monitor Application Settings (UevAppMonitor.exe)

    Starts 30 seconds after logon and continues until logoff.

    No

    Yes

    N/A

    Synchronizes settings for Windows (AppX) apps.

    Sync Controller Application (Microsoft.Uev.SyncController.exe)

    At logon and every 30 min thereafter.

    Yes

    Yes

    Only if Network is connected

    Starts the Sync Controller which synchronizes local settings with the settings storage location.

    Synchronize Settings at Logoff (Microsoft.Uev.SyncController.exe)

    Runs at logon and then waits for Logoff to Synchronize settings.

    No

    Yes

    N/A

    Start an application at logon that controls the synchronization of applications at logoff.

    Template Auto Update (ApplySettingsCatalog.exe)

    Runs at initial logon and at 3:30 AM every day thereafter.

    Yes

    No

    N/A

    Checks the settings template catalog for new, updated, or removed templates. This task only runs if SettingsTemplateCatalog is configured.

    Collect CEIP data (UevSqmSession.exe)

    At logon launches service

    No

    Yes

    N/A

    If the user or administrator opts in to the Customer Experience Improvement Program (CEIP), this task collects data that helps improve UE-V future releases.

    Upload CEIP Data (UevSqmUploader.exe)

    Runs at logon and at 4:00 AM every day thereafter.

    No

    Yes

    Only if Network is connected

    If the user or administrator opts in to the Customer Experience Improvement Program (CEIP), this task uploads the data to the CEIP servers.

    - - - -**Legend** - -- **Power Toggle** – Task Scheduler will optimize power consumption when not connected to AC power. The task might stop running if the computer switches to battery power. - -- **Idle Only** – The task will stop running if the computer ceases to be idle. By default the task will not restart when the computer is idle again. Instead the task will begin again on the next task trigger. - -- **Network Connection** – Tasks marked “Yes” only run if the computer has a network connection available. Tasks marked “N/A” run regardless of network connectivity. - -### How to Manage Scheduled Tasks - -To find Scheduled Tasks, perform the following: - -1. Open “Schedule Tasks” on the user computer. - -2. Navigate to: Task Scheduler -> Task Scheduler Library -> Microsoft -> UE-V - -3. Select the scheduled task you wish to manage and configure in the details pane. - -### Additional information - -The following additional information applies to UE-V scheduled tasks: - -- ll task sequence programs are located in the UE-V Agent installation folder, `%programFiles%\Microsoft User Experience Virtualization\Agent\[architecture]\`, by default. - -- The Sync Controller Application Scheduled task is the crucial component when the UE-V SyncMethod is set to “SyncProvider” (UE-V 2 default configuration). This scheduled task keeps the SettingsSToragePath synchronized with the locally cached versions of the settings package files. If users complain that settings do not synchronize often enough, then you can reduce the scheduled task setting to as little as 1 minute.  You can also increase the 30 min default to a higher amount if necessary. If users complain that settings do not synchronize fast enough on logon, then you can remove the delay setting for the scheduled task. (You can find the delay setting in the **Edit Trigger** dialogue box) - -- You do not need to disable the Template Auto Update scheduled task if you use another method to keep the clients’ templates in sync (i.e. Group Policy or Configuration Manager Baselines). Leaving the SettingsTemplateCatalog property value blank prevents UE-V from checking the settings catalog for custom templates. This scheduled task runs ApplySettingsCatalog.exe and will essentially return immediately. - -- The Monitor Application Settings scheduled task will update Windows app (AppX) settings in real time, based on Windows app program setting triggers built into each app. - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -[Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md#deploycatalogue) - - - - - - - - - diff --git a/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index ae34b00c58..0000000000 --- a/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Configuring the Company Settings Center for UE-V 2.x -description: Configuring the Company Settings Center for UE-V 2.x -author: dansimp -ms.assetid: 48fadb0a-c0dc-4287-9474-f94ce1417003 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Configuring the Company Settings Center for UE-V 2.x - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 include a new application, the Company Settings Center, which helps users manage settings to synchronize. The Company Settings Center is installed by using the UE-V Agent. Users access the Company Settings Center in Control Panel, in the **Start** menu or on the **Start** screen, and via the UE-V notification area icon. Company Settings Center displays which settings are synchronized and helps users see the synchronization status of UE-V. Users can use the Company Settings Center to select which applications or Windows features synchronize their settings between computers. They can also click the **Sync Now** button to synchronize all settings immediately. The administrator can also include a link for support in the Company Settings Center. - -## About the Company Settings Center - - -The Company Settings Center desktop application provides users with information about UE-V settings synchronization. The Company Settings Center is accessible in several different ways: - -- Notification area icon – With the **Tray Icon** Group Policy setting or Windows PowerShell configuration enabled, the UE-V icon appears in the notification area. Click the UE-V icon to open the Company Settings Center. - - **Note**   - The notification area icon can be disabled by using the following settings: - - - Group Policy setting: `Policy Tray Icon` - - - Windows PowerShell cmdlet: `TrayIconEnabled` - - - Configuration item in the UE-V Configuration Pack for System Center 2012 Configuration Manager: `Tray icon enabled` - - - -- Control Panel application – In Control Panel, browse to **Appearance and Personalization**, and then click **Company Settings Center**. - -- First use notification – Unless disabled, the UE-V Agent alerts the user that settings are now synchronized when the UE-V agent runs for the first time on a computer. Click the notification dialog box to open the Company Settings Center. - -- The **Start** screen or **Start** menu includes a link to the Company Settings Center. A search for Company Settings Center finds the application. - -## Configuring the support link in the Company Settings Center - - -The Company Settings Center can include a hyperlink that users can click to get support with UE-V settings synchronization problems. This link can open any valid URL protocol, such as http:// for a webpage or mailto:// for an email. The support link can be configured by using Group Policy, Windows PowerShell, or the System Center 2012 Configuration Manager UE-V Configuration Pack. - -**How to configure the Company Settings Center support link** - -1. Open your preferred management tool: - - - **Group Policy** - If you have not already done so, download the ADMX template for UE-V 2 from [MDOP Administrative Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941). - - - **Windows PowerShell** – On a computer with the UE-V Agent installed, open **Windows PowerShell**. For more information about administering UE-V by using Windows PowerShell, see [Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md). - - - **System Center 2012 Configuration Pack for Microsoft User Experience Virtualization (UE-V)** – Import the UE-V Configuration Pack and follow the Configuration Pack documentation to create configuration items. For more information about the UE-V Configuration Pack, see [Configuring UE-V 2.x with System Center Configuration Manager 2012](configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md). - -2. Edit the settings for the following policies: - - - **Contact IT Link Text** - This setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center. If you enable this setting, the Company Settings Center displays the specified text in the link to the Contact IT URL. - - - Group Policy settings: `Contact IT Link Text` - - - Windows PowerShell cmdlet: `ContactITDescription` - - - Configuration Pack configuration item: `IT contact descriptive text` - - - **Contact IT URL** - This setting specifies the URL for the Contact IT link in the Company Settings Center in a valid URL protocol, such as http:// for a webpage or mailto:// for an email. - - - Group Policy settings: `Contact IT URL` - - - Windows PowerShell cmdlet: `ContactITUrl` - - - Configuration Pack configuration item: `IT contact URL` - -3. Deploy settings to users’ computers by using the management tool. - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md deleted file mode 100644 index b55e44d53b..0000000000 --- a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md +++ /dev/null @@ -1,217 +0,0 @@ ---- -title: Configuring UE-V 2.x with Group Policy Objects -description: Configuring UE-V 2.x with Group Policy Objects -author: dansimp -ms.assetid: 2bb55834-26ee-4f19-9860-dfdf3c797143 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Configuring UE-V 2.x with Group Policy Objects - - -Some Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 Group Policy settings can be defined for computers, and other Group Policy settings can be defined for users. For information about how to install UE-V Group Policy ADMX files, see [Installing the UE-V 2 Group Policy ADMX Templates](https://technet.microsoft.com/library/dn458891.aspx#admx). - -The following policy settings can be configured for UE-V. - -**Group Policy settings** - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Group Policy setting nameTargetGroup Policy setting descriptionConfiguration options

    Contact IT Link Text

    Computers Only

    This Group Policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center.

    If you enable this Group Policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL.

    Contact IT URL

    Computers Only

    This Group Policy setting specifies the URL for the Contact IT link in the Company Settings Center.

    If you enable this setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol, such as HTTP or mailto.

    Do not use the sync provider

    Computers and Users

    By using this Group Policy setting, you can configure whether UE-V uses the sync provider feature. This policy setting also lets you enable notification to appear when the import of user settings is delayed.

    Enable this setting to configure the UE-V Agent not to use the sync provider.

    First Use Notification

    Computers Only

    This Group Policy setting enables a notification in the notification area that appears when the UE-V

    -

    agent runs for the first time.

    The default is enabled.

    Roam Windows settings

    Computers and Users

    This Group Policy setting configures the synchronization of Windows settings.

    Select which Windows settings synchronize between computers.

    -

    By default, Windows themes, desktop settings, and Ease of Access settings synchronize settings between computers of the same operating system version.

    Settings package size warning threshold

    Computers and Users

    This Group Policy setting lets you configure the UE-V Agent to report when a settings package file size reaches a defined threshold.

    Specify the preferred threshold for settings package sizes in kilobytes (KB).

    -

    By default, the UE-V Agent does not have a package file size threshold.

    Settings storage path

    Computers and Users

    This Group Policy setting configures where the user settings are to be stored.

    Enter a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.

    Settings template catalog path

    Computers Only

    This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V Agent.

    Enter a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.

    -

    Select the check box to replace the default Microsoft templates.

    Sync settings over metered connections

    Computers and Users

    This Group Policy setting defines whether UE-V synchronizes settings over metered connections.

    By default, the UE-V Agent does not synchronize settings over a metered connection.

    Sync settings over metered connections even when roaming

    Computers and Users

    This Group Policy setting defines whether UE-V synchronizes settings over metered connections outside of the home provider network, for example, when the data connection is in roaming mode.

    By default, UE-V does not synchronize settings over a metered connection when it is in roaming mode.

    Synchronization timeout

    Computers and Users

    This Group Policy setting configures the number of milliseconds that the computer waits before a time-out when it retrieves user settings from the remote settings location. If the remote storage location is unavailable, and the user does not use the sync provider, the application start is delayed by this many milliseconds.

    Specify the preferred synchronization time-out in milliseconds. The default value is 2000 milliseconds.

    Tray Icon

    Computers Only

    This Group Policy setting enables the User Experience Virtualization (UE-V) tray icon.

    The default is enabled.

    Use User Experience Virtualization (UE-V)

    Computers and Users

    This Group Policy setting lets you enable or disable User Experience Virtualization (UE-V).

    Enable or disable this Group Policy setting.

    - - - -**Note**   -In addition, Group Policy settings are available for many desktop applications and Windows apps. You can use these settings to enable or disable settings synchronization for specific applications. - - - -**Windows App Group Policy settings** - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Group Policy setting nameTargetGroup Policy setting descriptionConfiguration options

    Do not synchronize Windows Apps

    Computers and Users

    This Group Policy setting defines whether the UE-V Agent synchronizes settings for Windows apps.

    The default is to synchronize Windows apps.

    Windows App List

    Computer and User

    This setting lists the family package names of the Windows apps and states expressly whether UE-V synchronizes that app’s settings.

    You can use this setting to specify that settings of an app are never synchronized by UE-V, even if the settings of all other Windows apps are synchronized.

    Sync Unlisted Windows Apps

    Computer and User

    This Group Policy setting defines the default settings sync behavior of the UE-V Agent for Windows apps that are not explicitly listed in the Windows app list.

    By default, the UE-V Agent only synchronizes settings of those Windows apps that are included in the Windows app list.

    - - - -For more information about synchronizing Windows apps, see [Windows App List](https://technet.microsoft.com/library/dn458925.aspx#win8applist). - -**To configure computer-targeted Group Policy settings** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) on the computer that acts as a domain controller to manage Group Policy settings for UE-V computers. Navigate to **Computer configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the Group Policy setting to be edited. - -**To configure user-targeted Group Policy settings** - -1. Use the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) tool in Microsoft Desktop Optimization Pack (MDOP) on the domain controller computer to manage Group Policy settings for UE-V. Navigate to **User configuration**, select **Policies**, select **Administrative Templates**, click **Windows Components**, and then select **Microsoft User Experience Virtualization**. - -2. Select the edited Group Policy setting. - -The UE-V Agent uses the following order of precedence to determine synchronization. - -**Order of precedence for UE-V settings** - -1. User-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_CURRENT_USER\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -2. Computer-targeted settings that are managed by Group Policy settings - These configuration settings are stored in the registry key by Group Policy under `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Uev\Agent\Configuration`. - -3. Configuration settings that are defined by the current user by using Windows PowerShell or Windows management Instrumentation (WMI) - These configuration settings are stored by the UE-V Agent under this registry location: `HKEY_CURRENT_USER\Software\Microsoft\Uev\Agent\Configuration`. - -4. Configuration settings that are defined for the computer by using Windows PowerShell or WMI. These configuration settings are stored by the UE-V Agent under this registry location: `HKEY_LOCAL_MACHINE\Software\Microsoft\Uev\Agent\Configuration`. - - **Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev). - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -[Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md deleted file mode 100644 index 713779f789..0000000000 --- a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md +++ /dev/null @@ -1,248 +0,0 @@ ---- -title: Configuring UE-V 2.x with System Center Configuration Manager 2012 -description: Configuring UE-V 2.x with System Center Configuration Manager 2012 -author: dansimp -ms.assetid: 9a4e2a74-7646-4a77-b58f-2b4456487295 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 11/02/2016 ---- - - -# Configuring UE-V 2.x with System Center Configuration Manager 2012 - - -After you install Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1 and their required features, UE-V must be configured. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of System Center Configuration Manager 2012 SP1 or later to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - -## UE-V Configuration Pack supported features - - -The UE-V Configuration Pack includes tools to perform the following tasks: - -- Create or update UE-V settings location template distribution baselines. - - - Define UE-V templates to be registered or unregistered - - - Update UE-V template configuration items and baselines as templates are added or updated - - - Distribute and register UE-V templates using standard Configuration Item remediation - -- Create or update a UE-V Agent policy configuration item to set or clear these settings. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Max package size

    Enable/disable Windows app sync

    Wait for sync on application start

    Setting import delay

    Sync unlisted Windows apps

    Wait for sync on logon

    Settings import notification

    IT contact URL

    Wait for sync timeout

    Settings storage path

    IT contact descriptive text

    Settings template catalog path

    Sync enablement

    Tray icon enabled

    Start/Stop UE-V agent service

    Sync method

    First use notification

    Define which Windows apps will roam settings

    Sync timeout

    - - - -- Verify compliance by confirming that UE-V is running. - -## Generate a UE-V Agent Policy Configuration Item - - -All UE-V Agent policy and configuration is distributed through a single configuration item that is generated using the UevAgentPolicyGenerator.exe tool. This tool reads the desired configuration from an XML configuration file and creates a CI containing the discovery and remediation settings needed to bring the machine into compliance. - -The UE-V Agent policy configuration item CAB file is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: - -- Site <site code> - -- PolicyName <name> Optional: Defaults to “UE-V Agent Policy” if not present - -- PolicyDescription <description> Optional: A description is provided if not present - -- CabFilePath <full path to configuration item .CAB file> - -- ConfigurationFile <full path to agent configuration XML file> - -**Note**   -It might be necessary to change the PowerShell execution policy to allow these scripts to run in your environment. Perform these steps in the Configuration Manager console: - -1. Select **Administration > Client Settings > Properties** - -2. In the **User Agent** tab, set the **PowerShell Execution Policy** to **Bypass** - -**Create the First UE-V Policy Configuration Item** - -1. Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console: - - ``` syntax - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\AgentConfiguration.xml c:\ - ``` - - The default configuration file contains five sections: - - **Computer Policy** - All UE-V machine level settings. The DesiredState attribute can be - - - **Set** to have the value assigned in the registry - - - **Clear** to remove the setting - - - **Unmanaged** to have the configuration item left at its current state - - Do not remove lines from this section. Instead, set the DesiredState to ‘Unmanaged’ if you do not want Configuration Manager to alter current or default values. - - **CurrentComputerUserPolicy** - All UE-V user level settings. These entries override the machine settings for a user. The DesiredState attribute can be - - - **Set** to have the value assigned in the registry - - - **Clear** to remove the setting - - - **Unmanaged** to have the configuration item left at its current state - - Do not remove lines from this section. Instead, set the DesiredState to ‘Unmanaged’ if you do not want Configuration Manager to alter current or default values. - - **Services** - Entries in this section control service operation. The default configuration file contains a single entry for the UevAgentService. The DesiredState attribute can be set to **Running** or **Stopped**. - - **Windows8AppsComputerPolicy** - All machine level Windows app synchronization settings. Each PackageFamilyName listed in this section can be assigned a DesiredState of - - - **Enabled** to have settings roam - - - **Disabled** to prevent settings from roaming - - - **Cleared** to have the entry removed from UE-V control - - Additional lines can be added to this section based on the list of installed Windows apps that can be viewed using the PowerShell cmdlet GetAppxPackage. - - **Windows8AppsCurrentComputerUserPolicy** - Identical to the Windows8AppsComputerPolicy with settings that override machine settings for an individual user. - -2. Edit the configuration file by changing the desired state and value fields. - -3. Run this command on a machine running the ConfigMgr Admin Console: - - ``` syntax - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevAgentPolicyGenerator.exe –Site ABC –CabFilePath "C:\MyCabFiles\UevPolicyItem.cab" –ConfigurationFile "c:\AgentConfiguration.xml" - ``` - -4. Import the CAB file using ConfigMgr console or PowerShell Import-CMConfigurationItem - -**Update a UE-V Policy Configuration Item** - -1. Edit the configuration file by changing the desired state and value fields. - -2. Run the command from Step 3 in [Create the First UE-V Policy Configuration Item](#create). If you changed the name with the PolicyName parameter, make sure you enter the same name. - -3. Reimport the CAB file. The version in ConfigMgr will be updated. - -## Generate a UE-V Template Baseline -UE-V templates are distributed using a baseline containing multiple configuration items. Each configuration item contains the discovery and remediation scripts needed to install one UE-V template. The actual UE-V template is embedded within the remediation script for distribution using standard Configuration Item functionality. - -The UE-V template baseline is created using the UevTemplateBaselineGenerator.exe command line tool, which has these parameters: - -- Site <site code> - -- BaselineName <name> (Optional: defaults to “UE-V Template Distribution Baseline” if not present) - -- BaselineDescription <description> (Optional: a description is provided if not present) - -- TemplateFolder <UE-V template folder> - -- Register <comma separated template file list> - -- Unregister <comma separated template list> - -- CabFilePath <Full path to baseline CAB file to generate> - -The result is a baseline CAB file that is ready for import into Configuration Manager. If at a future date, you update or add a template, you can rerun the command using the same baseline name. Importing the CAB results in CI version updates on the changed templates. - -### Create the First UE-V Template Baseline - -1. Create a “master” set of UE-V templates in a stable folder location visible to the machine running your ConfigMgr Admin Console. As templates are added or updated, this folder is where they are pulled for distribution. The initial list of templates can be copied from a machine with UE-V installed. The default template location is C:\\Program Files\\Microsoft User Experience Virtualization\\Templates. - -2. Create a text.bat file where you can add the template generator command. This is optional, but will make regeneration simpler if you save the command parameters. - -3. Add the command and parameters to the .bat file that will generate the baseline. The following example creates a baseline that distributes Notepad and Calculator: - - ``` syntax - C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevTemplateBaselineGenerator.exe –Site "ABC" –TemplateFolder "C:\ProductionUevTemplates" –Register "MicrosoftNotepad.xml, MicrosoftCalculator.xml" –CabFilePath "C:\MyCabFiles\UevTemplateBaseline.cab" - ``` - -4. Run the .bat file to create UevTemplateBaseline.cab ready for import into Configuration Manager. - -### Update a UE-V Template Baseline - -The template generator uses the template version to determine if a template should be updated. If you make a template change and update the version, the baseline generator compares the template in your master folder with the template contained in the CI on the ConfigMgr server. If a difference is found, the generated baseline and modified CI versions are updated. - -To distribute a new Notepad template, you would perform these steps: - -1. Update the template and template version located in the <Version> element of the template. - -2. Copy the template to your master template directory. - -3. Run the command in the .bat file that you created in Step 3 in [Create the First UE-V Template Baseline](#create2). - -4. Import the generated CAB file into ConfigMgr using the console or PowerShell Import-CMBaseline. - -## Get the UE-V Configuration Pack - - -The UE-V Configuration Pack for Configuration Manager 2012 SP1 or later can be downloaded [here](https://go.microsoft.com/fwlink/?LinkId=317263). - - - - - - -## Related topics - - -[Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md deleted file mode 100644 index ba9af1726e..0000000000 --- a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md +++ /dev/null @@ -1,459 +0,0 @@ ---- -title: Deploy Required Features for UE-V 2.x -description: Deploy Required Features for UE-V 2.x -author: dansimp -ms.assetid: 10399bb3-cc7b-4578-bc0c-2f6b597abe4d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Deploy Required Features for UE-V 2.x - - -All Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 deployments require these features - -- [Deploy a Settings Storage Location](#ssl) that is accessible to end users. - - This is a standard network share that stores and retrieves user settings. - -- [Choose the Configuration Method for UE-V](#config) - - UE-V can be deployed and configured using common management tools including group policy, Configuration Manager, or Windows Management Infrastructure and Powershell. - -- [Deploy a UE-V Agent](#agent) to be installed on every computer that synchronizes settings. - - This monitors registered applications and the operating system for any settings changes and synchronizes those settings between computers. - -The topics in this section describe how to deploy these features. - -## Deploy a UE-V Settings Storage Location - - -UE-V requires a location in which to store user settings in settings package files. You can configure this settings storage location in one of these ways: - -- Create your own settings storage location - -- Use existing Active Directory for your settings storage location - -If you don’t create a settings storage location, the UE-V Agent will use Active Directory (AD) by default. - -**Note** -As a matter of [performance and capacity planning](https://technet.microsoft.com/library/dn458932.aspx#capacity) and to reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location. - - - -### Create a UE-V Settings Storage Location - -Before you define the settings storage location, you must create a root directory with read/write permissions for users who store settings on the share. The UE-V Agent creates user-specific folders under this root directory. - -The settings storage location is defined by setting the SettingsStoragePath configuration option, which you can configure by using one of these methods: - -- When you [Deploy the UE-V Agent](#agent) through a command-line parameter or in a batch script - -- Through [Group Policy](https://technet.microsoft.com/library/dn458893.aspx) settings - -- With the [System Center Configuration Pack](https://technet.microsoft.com/library/dn458917.aspx) for UE-V - -- After installation of the UE-V Agent, by using [Windows PowerShell or Windows Management Instrumentation (WMI)](https://technet.microsoft.com/library/dn458937.aspx) - -The path must be in a universal naming convention (UNC) path of the server and share. For example, **\\\\Server\\Settingsshare\\**. This configuration option supports the use of variables to enable specific synchronization scenarios. For example, you can use the `%username%\%computername%` variables to preserve the end user settings experience in these scenarios: - -- End users that use multiple physical computers in your enterprise - -- Enterprise computers that are used by multiple end users - -The UE-V Agent dynamically creates a user-specific settings storage path, with a hidden system folder named `SettingsPackages`, based on the configuration setting of **SettingsStoragePath**. The agent reads and writes settings to this location as defined by the registered UE-V settings location templates. - -**UE-V settings are determined by a "Last write wins" rule:** If the settings storage location is the same for user with multiple managed computers, one UE-V Agent reads and writes to the settings location independently of agents running on other computers. The last written settings and values are the ones applied when the next agent reads from the settings storage location. - -**Deploy the settings storage location:** Follow these steps to define the settings storage location rather than using your existing Active Directory service. You should limit access to the settings storage share to those users that require it, as shown in the tables below. - -**To deploy the UE-V network share** - -1. Create a new security group for UE-V users. - -2. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant the UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. - -3. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissions

    Everyone

    No permissions

    Security group of UE-V users

    Full control

    - - - -4. Set the following NTFS file system permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissionsFolder

    Creator/owner

    Full control

    Subfolders and files only

    Security group of UE-V users

    List folder/read data, create folders/append data

    This folder only

    - - - -With this configuration, the UE-V Agent creates and secures a Settingspackage folder while it runs in the context of the user, and grants each user permission to create folders for settings storage. Users receive full control to their Settingspackage folder while other users cannot access it. - -**Note** -If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: - -1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. - -2. Set the registry key value to *1*. - - - -### Use Active Directory with UE-V 2.x - -The UE-V Agent uses Active Directory (AD) by default if a settings storage location is not otherwise defined. In these cases, the UE-V Agent dynamically creates the settings storage folder under the root of the AD home directory of each user. But, if a custom directory setting is configured in AD, then that directory is used instead. - -## Choose the Configuration Method for UE-V 2.x - - -You want to figure out which configuration method you'll use to manage UE-V after deployment since this will be the configuration method you use to deploy the UE-V Agent. Typically, this is the configuration method that you already use in your environment, such as Windows PowerShell or Configuration Manager. - -You can configure UE-V before, during, or after UE-V Agent installation, depending on the configuration method that you use. - -- [Group Policy](https://technet.microsoft.com/library/dn458893.aspx)**:** You can use your existing Group Policy infrastructure to configure UE-V before or after UE-V Agent deployment. The UE-V Group Policy ADMX template enables the central management of common UE-V Agent configuration options, and it includes settings to configure UE-V synchronization. - - **Installing the UE-V Group Policy ADMX Templates:** Group Policy ADMX templates for UE-V configure the synchronization settings for the UE-V Agent and enable the central management of common UE-V Agent configuration settings by using an existing Group Policy infrastructure. - - Supported operating systems for the domain controller that deploys the Group Policy Objects include the following: - - Windows Server 2008 R2 - - Windows Server 2012 and Windows Server 2012 R2 - -- [Configuration Manager](https://technet.microsoft.com/library/dn458917.aspx)**:** The UE-V Configuration Pack lets you use the Compliance Settings feature of System Center Configuration Manager 2012 SP1 or later to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - -- [Windows PowerShell and WMI](https://technet.microsoft.com/library/dn458937.aspx)**:** You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify configurations after you install the UE-V Agent. - - **Note** - Registry modification can result in data loss, or the computer becomes unresponsive. We recommend that you use other configuration methods. - - - -- **Command-line or Batch Script Installation:** Parameters that are used when you [Deploy the UE-V Agent](#agent) configure many UE-V settings. Electronic software distribution systems, such as System Center 2012 Configuration Manager, use these parameters to configure their clients when they deploy and install the UE-V Agent software. - -## Deploy the UE-V 2.x Agent - - -The UE-V Agent is the core of a UE-V deployment and must run on each computer that uses UE-V to synchronize application and Windows settings. - -**UE-V Agent Installation Files:** A single installation file, AgentSetup.exe, installs the UE-V Agent on both 32-bit and 64-bit operating systems. In addition, AgentSetupx86.msi or AgentSetupx64.msi architecture-specific Windows Installer files are provided, and since they are smaller, they might streamline the agent deployments. The [command-line parameters for the AgentSetup.exe installer](#params) are supported for the Windows Installer installation as well. - -**Important** -During UE-V Agent installation or uninstallation, you can either use the AgentSetup.exe file or the AgentSetup<arch>.msi file, but not both. The same file must be used to uninstall the UE-V Agent that was used to install the UE-V Agent. - - - -### To Deploy the UE-V Agent - -You can use the following methods to deploy the UE-V Agent: - -- An electronic software distribution (ESD) solution system, such as Configuration Manager, that can install a Windows Installer (.msi) file. - -- An installation script that references the Windows Installer (.msi) file that is stored centrally on a share. - -- An installation program that you run manually on the computer. - -Use the following procedure to deploy the UE-V Agent from a network share. - -**To install and configure the UE-V Agent from a network share** - -1. Stage the UE-V Agent installation file AgentSetup.exe on a network share to which users have Read permission. - -2. Deploy a script to user computers that installs the UE-V Agent. The script should specify the settings storage location. - -**Deployment options:** Be sure to use the correct variable format when you install the UE-V Agent. The following table provides examples of deployment options for using the AgentSetup.exe or the Windows Installer (.msi) files. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Deployment typeDeployment descriptionExample

    Command prompt

    When you install the UE-V Agent at a command prompt, use the %^username% variable format. If quotation marks are required because of spaces in the settings storage path, use a batch script file for deployment.

    -

    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%

    -

    -

    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%

    Batch script

    When you install the UE-V Agent from a batch script file, use the %%username%% variable format. If you use this installation method, you must escape the variable with the %% characters. Without this character, the script expands the username variable at installation time, rather than at run time, which causes UE-V to use a single settings storage location for all users.

    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"

    -

    -

    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"

    -

    Windows PowerShell

    When you install the UE-V Agent from a Windows PowerShell prompt or a Windows PowerShell script, use the %username% variable format.

    & AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%

    -

    -

    & msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%

    -

    Electronic software distribution, such as deployment of Configuration Manager Software Deployment

    When you install the UE-V Agent by using Configuration Manager, use the ^%username^% variable format.

    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%

    -

    -

    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%

    - - - -**Note** -The installation of the UE-V Agent requires administrator rights, and the computer requires a restart before the UE-V Agent can run. - - - -### Command-line parameters for UE-V Agent deployment - -The command-line parameters of the UE-V Agent are as follows. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Command-line parameterDefinitionNotes

    /help or /h or /?

    Displays the AgentSetup.exe usage dialog box.

    SettingsStoragePath

    Indicates the Universal Naming Convention (UNC) path that defines where settings are stored.

    -Important

    You must specify a SettingsStoragePath in UE-V 2.1 and UE-V 2.1 SP1. You can set the AdHomePath string to specify that the user's Active Directory home path is used. For example, SettingsStoragePath = \share\path|AdHomePath.

    -

    In UE-V 2.0, you can leave SettingsStoragePath blank to use the Active Directory home path instead.

    -
    -
    - -
    -

    %username% or %computername% environment variables are accepted. Scripting can require escaped variables.

    -

    Default: <none>

    SettingsStoragePathReg

    Gets the SettingsStoragePath value from the registry during installation.

    At the command prompt, type the following example to force UE-V to use the Active Directory home path instead of a specific UNC.

    -

    msiexec.exe /i AgentSetupx64.msi acceptlicenseterms=true SettingsStoragePathReg=TRUE /quiet /norestart

    SettingsTemplateCatalogPath

    Indicates the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates.

    Only required for custom settings location templates

    RegisterMSTemplates

    Specifies whether the default Microsoft templates should be registered during installation.

    True | False

    -

    Default: True

    SyncMethod

    Specifies which synchronization method should be used.

    SyncProvider | None

    -

    Default: SyncProvider

    SyncTimeoutInMilliseconds

    Specifies the number of milliseconds that the computer waits before time-out when it retrieves user settings from the settings storage location.

    Default: 2000 milliseconds

    -

    (wait up to 2 seconds)

    SyncEnabled

    Specifies whether UE-V synchronization is enabled or disabled.

    True | False

    -

    Default: True

    MaxPackageSizeInBytes

    Specifies a settings package file size in bytes when the UE-V Agent reports that files exceed the threshold.

    <size>

    -

    Default: none (no warning threshold)

    CEIPEnabled

    Specifies the setting for participation in the Customer Experience Improvement program. If set to True, installer information is uploaded to the Microsoft Customer Experience Improvement Program site. If set to False, no information is uploaded.

    True | False

    -

    Default: False

    NoRestart

    Supports deferral of the restart of the computer after the UE-V Agent is installed.

    INSTALLFOLDER

    Enables a different installation folder to be set for the UE-V Agent or UE-V Generator.

    MUENABLED

    Enables Setup to accept the option to be included in the Microsoft Update program.

    ACCEPTLICENSETERMS

    Lets UE-V be installed silently. This must be set to True to install UE-V silently and bypass the requirement that the user accepts the UE-V license terms. If set to False or left empty, the user receives an error message and UE-V is not installed.

    -Important

    This parameter is required to install UE-V silently.

    -
    -
    - -

    NORESTART

    Prevents a mandatory restart after the UE-V Agent is installed.

    - - - -### Update the UE-V Agent - -Updates for the UE-V Agent software are provided through Microsoft Update. You can deploy UE-V Agent updates by using Enterprise Software Distribution (ESD) infrastructure systems. - -During a UE-V Agent upgrade, the default group of settings location templates for common Microsoft applications and Windows settings can be updated. - -### Upgrade the UE-V 2.x Agent - -The UE-V 2.x Agent introduces many new features and modifies how and when the agent uploads content to the settings storage share. The upgrade process automates these changes. To upgrade the UE-V Agent, run the UE-V Agent install package (AgentSetup.exe, AgentSetupx86.msi, or AgentSetupx64.msi) on users’ computers. - -**Note** -When you upgrade the UE-V Agent, you must use the same installer type (.exe file or .msi packet) that installed the previous UE-V Agent. For example, use the UE-V 2 AgentSetup.exe to upgrade UE-V 1.0 Agents that were installed by using AgentSetup.exe. - - - -The following configurations are preserved when the Agent Setup program runs: - -- Settings storage path - -- Registry settings - -- Scheduled tasks (Interval settings are reset to their defaults) - -**Note** -A computer with UE-V 2.x settings location templates that are registered in the UE-V 1.0 Agent register errors in the Windows Event Log. - - - -You can use Microsoft System Center 2012 Configuration Manager or another enterprise software distribution tool to automate and distribute the UE-V Agent upgrade. - -**Recommendations:** We recommend that you upgrade all of the UE-V 1.0 Agents in a computing environment, but it is not required. UE-V 2.x settings location templates can interact with a UE-V 1.0 Agent because they only share the settings from the settings storage path. We recommend, however, that you move the deployments to a single agent version to simplify management and to support UE-V. - -### Repair the UE-V Agent after an unsuccessful upgrade - -You might experience errors after you attempt one of the following operations: - -- Upgrade from UE-V 1.0 to UE-V 2 - -- Upgrade to a newer version of Windows, for example, from Windows 7 to Windows 8 or from Windows 8 to Windows 8.1. - -- Uninstall the agent after upgrading the UE-V Agent - -To resolve any issues, attempt to repair the UE-V Agent by entering this command at a command prompt on the computer where the agent is installed. - -``` syntax -msiexec.exe /f "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log -``` - -You can then retry the uninstall process or upgrade by installing the newer version of the UE-V Agent. - - - - - - -## Related topics - - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md b/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md deleted file mode 100644 index 8362ffa04c..0000000000 --- a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md +++ /dev/null @@ -1,344 +0,0 @@ ---- -title: Deploy UE-V 2.x for Custom Applications -description: Deploy UE-V 2.x for Custom Applications -author: dansimp -ms.assetid: f7cb089f-d764-4a93-82b6-926fe0385a23 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 07/19/2016 ---- - - -# Deploy UE-V 2.x for Custom Applications - - -Microsoft User Experience Virtualization (UE-V) 2.0. 2.1, and 2.1 SP1 use XML files called **settings location templates** to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V. But if you want to synchronize settings for desktop applications other than those included in the default templates, you can create your own custom settings location templates by using the UE-V Generator. - -Once you have read through the planning material in [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) and have decided that you want to synchronize settings for custom applications (third-party, line-of-business, etc.), you will deploy the features of UE-V as described in this topic. To start, here are the main steps required to synchronize settings for custom applications: - -- [Install the UEV Generator](#uevgen) - - Use the UEV Generator to create custom XML settings location templates. - -- [Configure a UE-V settings template catalog](#deploycatalogue) - - You can define this path where custom settings location templates are stored. - -- [Create custom settings location templates](#createcustomtemplates) - - These custom templates let users sync settings for custom applications. - -- [Deploy the custom settings location templates](#deploycustomtemplates) - - After you test the custom template to ensure that settings are synced correctly, you can deploy these templates in one of these ways: - - - Through your existing deployment infrastructure, such as Configuration Manager - - - By using Group Policy preferences - - - [Deploy a UE-V settings template catalog](#deploycatalogue) - - **Note**   - Templates that are deployed by using ESD or Group Policy must be registered with UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. - - - -## Prepare to Deploy UE-V 2.x for Custom Applications - - -Before you start deploying the UE-V features that handle custom applications, there are just a couple things to review. - -### The UE-V Generator - -The UE-V Generator monitors an application to discover and capture the locations where the application stores its settings. The application that is monitored must be a traditional application. You use the UE-V Generator to create settings location templates, but it cannot create a settings location template from these application types: - -- Virtualized applications - -- Applications that are offered through Terminal Services - -- Java applications - -- Windows apps - -**Note**   -UE-V settings location templates cannot be created from virtualized applications or Terminal Services applications. However, settings that are synchronized by using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and Terminal Services applications, open a version of the Windows Installer (.msi) package of the application by using the UE-V Generator. For more information about synchronizing settings for virtual applications, see [Using UE-V 2.x with Application Virtualization Applications](using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md). - - - -**Excluded Locations:** The discovery process excludes locations that commonly store application software files that do not synchronize settings well between user computers or computing environments. By default, these are excluded: - -- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values - -- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system - -- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive - -- Files that are located in Program Files directories - -- Files that are located in Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files that are located in %Systemroot% - -If registry keys and files that are stored in excluded locations are required to synchronize application settings, you can manually add the locations to the settings location template during the template creation process. -However, only changes to the HKEY\_CURRENT\_USER hive will be sync-ed. - -### Replace the default Microsoft templates - -The UE-V Agent installs a default group of settings location templates for common Microsoft applications and Windows settings. If you customize these templates, or create settings location templates to synchronize settings for custom applications, the UE-V Agent can be configured to use a settings template catalog to store the templates. In this case, you will need to include the default templates along with the custom templates in the settings template catalog. - -When you [Deploy a UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent), you can use the command-line parameter `RegisterMSTemplates` to disable the registration of the default Microsoft templates. - -When you use Group Policy to configure the settings template catalog path, you can choose to replace the default Microsoft templates. If you configure the policy settings to replace the default Microsoft templates, all of the default Microsoft templates that are installed by the UE-V Agent are deleted and only the templates that are located in the settings template catalog are used. The UE-V Agent configuration setting parameter `RegisterMSTemplates` must be set to *true* in order to override the default Microsoft template. - -**Note**   -If you disable this policy setting after it has been enabled, the UE-V Agent does not restore the default Microsoft templates. - - - -If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, and the UE-V Agent is not configured to replace the default Microsoft templates, the Microsoft templates are ignored. - -You can also replace the default templates by using the UE-V Windows PowerShell features. To replace the default Microsoft template with Windows PowerShell, unregister all of the default Microsoft templates, and then register the customized templates. - -**Note**   -Old settings packages remain in the settings storage location even if you deploy new settings location templates for an application. These packages are not read by the agent, but neither are they automatically deleted. - - - -## Install the UEV 2.x Generator - - -Install the Microsoft User Experience Virtualization (UE-V) 2.0 Generator on a computer that you can then use to create a custom settings location template. This computer should have the applications installed for which custom settings location templates are to be generated. - -**To install the UE-V Generator** - -1. As a user with local administrator rights, locate the UE-V Generator installation file **ToolSetup.exe** provided with the UE-V software. Or, if you know the computer architecture, you can run the appropriate Windows Installer (.msi) file, **ToolsSetupx64.msi** or **ToolsSetupx86.msi**. - -2. Double-click the installation file. The User Experience Virtualization Generator Setup wizard opens. Click **Next** to continue. - -3. Accept the Microsoft Software License Terms, and then click **Next**. - -4. Click the options for Microsoft Updates and the Customer Experience Improvement Program. - -5. Select the destination folder in which to install the UE-V Generator, and then click **Next**. - -6. Click **Install** to begin the installation. - - **Note**   - A prompt for **User Account Control** appears before the application is installed. Permission is required to install the UE-V Generator. - - - -7. Click **Finish** to close the wizard after the installation is finished. You must restart your computer before you can run the UE-V Generator. - - To verify that the installation was successful, click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - - **Note**   - The UE-V 2 Generator can only be used to create templates for UE-V 2 Agents. In a mixed deployment of UE-V 1.0 Agents and UE-V 2 Agents, you should continue to use the UE-V 1.0 Generator until you have upgraded all UE-V Agents. - - - -## Deploy a Settings Template Catalog - - -The User Experience Virtualization settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores all the custom settings location templates. A scheduled task in the UE-V Agent checks this location one time each day and updates its synchronization behavior, based on the templates in this folder. - -The UE-V Agent registers templates that were added or updated in this folder after the last time that the folder was checked and unregisters templates that are removed. By default, templates are registered and unregistered one time per day at 3:30 A.M. local time by the Task Scheduler and at system startup. To customize the frequency of this scheduled task, see [Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md). - -You can configure the settings template catalog path by using the installation command-line options, Group Policy, WMI, or Windows PowerShell. Templates that are stored at the settings template catalog path are automatically registered and unregistered by a scheduled task. - -**To configure the settings template catalog for UE-V 2.x** - -1. Create a new folder on the computer that stores the UE-V settings template catalog. - -2. Set the following share-level (SMB) permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissions

    Everyone

    No Permissions

    Domain Computers

    Read Permission Levels

    Administrators

    Read/Write Permission Levels

    - - - -3. Set the following NTFS file system permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissionsApply to

    Creator/Owner

    Full Control

    This Folder, Subfolders and Files

    Domain Computers

    List Folder Contents and Read

    This Folder, Subfolders and Files

    Everyone

    No Permissions

    No Permissions

    Administrators

    Full Control

    This Folder, Subfolders and Files

    - - - -4. Click **OK** to close the dialog boxes. - -At a minimum, the network share must grant permissions for the Domain Computers group. In addition, grant access permissions for the network share folder to administrators who are to manage the stored templates. - -## Create Custom Settings Location Templates - - -Use the UE-V Generator to create settings location templates for line-of-business applications or other custom applications. After the template for an application is created, you can deploy it to computers so that settings are synchronized for that application. - -**To create a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Create a settings location template**. - -3. Specify the application. Browse to the file path of the application (.exe) or the application shortcut (.lnk) for which you want to create a settings location template. Specify the command-line arguments, if any, and working directory, if any. Click **Next** to continue. - - **Note**   - Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings. - - - -4. After the application starts, close the application. The UE-V Generator records the locations where the application stores its settings. - -5. After the process is completed, click **Next** to continue. - -6. Review and select the check boxes that are next to the appropriate registry settings locations and settings file locations to synchronize for this application. The list includes the following two categories for settings locations: - - - **Standard**: Application settings that are stored in the registry under the HKEY\_CURRENT\_USER keys or in the file folders under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming**. The UE-V Generator includes these settings by default. - - - **Nonstandard**: Application settings that are stored outside the locations are specified in the best practices for settings data storage (optional). These include files and folders under **Users** \\ \[User name\] \\ **AppData** \\ **Local**. Review these locations to determine whether to include them in the settings location template. Select the locations check boxes to include them. - - Click **Next** to continue. - -7. Review and edit any **Properties**, **Registry** locations, and **Files** locations for the settings location template. - - - Edit the following properties on the **Properties** tab: - - - **Application Name**: The application name that is written in the description of the program files properties. - - - **Program name**: The name of the program that is taken from the program file properties. This name usually has the .exe file name extension. - - - **Product version**: The product version number of the .exe file of the application. This property, in conjunction with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the product. - - - **File version**: The file version number of the .exe file of the application. This property, in conjunction with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the program. - - - **Template author name** (optional): The name of the settings location template author. - - - **Template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. Edit the registry locations by using the **Tasks** drop-down menu. Tasks enable you to add new keys, edit the name or scope of existing keys, delete keys, and browse the registry where the keys are located. Use the **All Settings** scope to include all the registry settings under the specified key. Use the **All Settings and Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations that are included in the settings location template. Edit the file locations by use of the **Tasks** drop-down menu. Tasks for file locations enable you to add new files or folder locations, edit the scope of existing files or folders, delete files or folders, and open the selected location in Windows Explorer. Leave the file mask empty to include all files in the specified folder. - -8. Click **Create**, and then click **Save** to save the settings location template on the computer. - -9. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you have created the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into production in the enterprise. - -[Application Template Schema Reference for UE-V](https://technet.microsoft.com/library/dn763947.aspx) details the XML structure of the UE-V settings location template and provides guidance for editing these files. - -## Deploy the Custom Settings Location Templates - - -After you create a settings location template with the UE-V Generator, you should test it to ensure that the application settings are synchronized correctly. You can then safely deploy the settings location template to computers in the enterprise. - -Settings location templates can be deployed by using one of these methods: - -- An enterprise software distribution (ESD) system such as System Center Configuration Manager - -- Group Policy preferences - -- A UE-V settings template catalog - -Templates that are deployed by using an ESD system or Group Policy Objects must be registered through UE-V Windows Management Instrumentation (WMI) or Windows PowerShell. Templates that are stored in the settings template catalog location are automatically registered by the UE-V Agent. - -**To use the settings template catalog path to deploy UE-V settings location templates** - -1. Browse to the network share folder that is defined as the settings template catalog. - -2. Add, remove, or update settings location templates in the settings template catalog to reflect the UE-V Agent template configuration that you want for UE-V computers. - - **Note**   - Templates on computers are updated daily. The update is based on changes to the settings template catalog. - - - -3. To manually update templates on a computer that runs the UE-V Agent, open an elevated command prompt, and browse to **%Program Files%\\Microsoft User Experience Virtualization \\ Agent \\ <x86 or x64 >**, and then run **ApplySettingsTemplateCatalog.exe**. - - **Note**   - This program runs automatically during computer startup and daily at 3:30 A. M. to gather any new templates that were recently added to the catalog. - - - - - - - - -## Related topics - - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md b/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md deleted file mode 100644 index 70de32e73b..0000000000 --- a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md +++ /dev/null @@ -1,269 +0,0 @@ ---- -title: Get Started with UE-V 2.x -description: Get Started with UE-V 2.x -author: dansimp -ms.assetid: 526ecbf0-0dee-4f0b-b017-8f8d25357b14 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 02/13/2017 ---- - - -# Get Started with UE-V 2.x - - -Follow the steps in this guide to quickly deploy Microsoft User Experience Virtualization (UE-V) 2.0 or 2.1 in a small test environment. This helps you determine whether UE-V is the right solution to manage user settings across multiple devices within your enterprise. - -**Note**   -The information in this section is repeated in greater detail throughout the rest of the documentation. So if you already know that UE-V 2 is the right solution and you don’t need to evaluate it, you can just go right to [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md). - - - -The standard installation of UE-V synchronizes the default Microsoft Windows and Office settings and many Windows app settings. Make sure your test environment includes two or more user computers that share network access and you’ll be evaluating UE-V in just a short time. - -- [Step 1: Confirm Prerequisites](#step1): Make sure your environment is able to run UE-V, including details about supported configurations. - -- [Step 2: Deploy the Settings Storage Location for UE-V 2](#step2): All UE-V deployments require a location for settings packages that contain the synchronized setting values. - -- [Step 3: Deploy the UE-V 2 Agent](#step3): To synchronize settings using UE-V, devices must have the UE-V Agent installed and running. - -- [Step 4: Test Your UE-V 2 Evaluation Deployment](#step4): Run a few tests on two computers that have the UE-V Agent installed and see how UE-V works. - -That’s it! Once you follow the steps, you’ll be able to evaluate how UE-V can work in your enterprise. - -**Further evaluation:** You can also perform additional steps to configure some third-party and line-of-business applications to synchronize their settings using UE-V as detailed in [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md). - -## Step 1: Confirm Prerequisites - - -Before you proceed, make sure your environment includes these requirements for running UE-V. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architectureWindows PowerShellMicrosoft .NET Framework

    Windows 7

    Ultimate, Enterprise, or Professional Edition

    SP1

    32-bit or 64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4 or higher

    Windows Server 2008 R2

    Standard, Enterprise, Datacenter, or Web Server

    SP1

    64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4 or higher

    Windows 8.1

    Enterprise or Pro

    None

    32-bit or 64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.5

    Windows Server 2012 or Windows Server 2012 R2

    Standard or Datacenter

    None

    64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.5

    Windows 10, pre-1607 verison

    Enterprise or Pro

    32-bit or 64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.5

    Windows Server 2016

    Standard or Datacenter

    None

    64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.5

    - -**Note:** Starting with Windows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack - -Also… - -- **MDOP License:** This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see How Do I Get MDOP (https://go.microsoft.com/fwlink/p/?LinkId=322049). - -- **Administrative Credentials** for any computer on which you’ll be installing - -## Step 2: Deploy the Settings Storage Location for UE-V 2 - - -You’ll need to deploy a settings storage location, a standard network share where user settings are stored in a settings package file. When you create the settings storage share, you should limit access to users that require it. [Deploy a Settings Storage Location](https://technet.microsoft.com/library/dn458891.aspx#ssl) provides more detailed information. - -**Create a network share** - -1. Create a new security group and add UE-V users to it. - -2. Create a new folder on the centrally located computer that stores the UE-V settings packages, and then grant the UE-V users access with group permissions to the folder. The administrator who supports UE-V must have permissions to this shared folder. - -3. Assign UE-V users permission to create a directory when they connect. Grant full permission to all subdirectories of that directory, but block access to anything above. - - 1. Set the following share-level Server Message Block (SMB) permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissions

    Everyone

    No permissions

    Security group of UE-V users

    Full control

    - - - - 2. Set the following NTFS file system permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - - - - - -
    User accountRecommended permissionsFolder

    Creator/owner

    Full control

    Subfolders and files only

    Security group of UE-V users

    List folder/read data, create folders/append data

    This folder only

    - - - -**Security Note:** - -If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: - -1. Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**. - -2. Set the registry key value to *1*. - -## Step 3: Deploy the UE-V 2 Agent - - -The UE-V Agent synchronizes application and Windows settings between users’ computers and devices. For evaluation purposes, install the agent on at least two computers in your test environment that belong to the same user. - -Run the AgentSetup.exe file from the command line to install the UE-V Agent. It installs on both 32-bit and 64-bit operating systems. - -``` syntax -AgentSetup.exe SettingsStoragePath=\\server\settingsshare\%username% -``` - -You must specify the SettingsStoragePath command line parameter as the network share from Step 2. [Deploy a UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) provides more detailed information. - -## Step 4: Test Your UE-V 2 Evaluation Deployment - - -You can now run a few tests on your UE-V evaluation deployment to see how UE-V works. - -**** - -1. On the first computer (Computer A), make one or more of these changes: - - 1. Open to Windows Desktop and move the taskbar to a different location in the window. - - 2. Change the default fonts. - - 3. Open Calculator and set to **scientific**. - - 4. Change the behavior of any Windows app, as detailed in [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md). - - 5. Disable Microsoft Account settings synchronization and Roaming Profiles. - -2. Log off Computer A. Settings are saved in a UE-V settings package when users lock, logoff, exit an application, or when the sync provider runs (every 30 minutes by default). - -3. Log in to the second computer (Computer B) as the same user as Computer A. - -4. Open to Windows Desktop and verify that the taskbar location matches that of Computer A. Verify that the default fonts match and that Calculator is set to **scientific**. Also verify the change you made to any Windows app. - -You can change the settings in Computer B back to the original Computer A settings. Then log off Computer B and log in to Computer A to verify the changes. - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/images/checklistbox.gif b/mdop/uev-v2/images/checklistbox.gif deleted file mode 100644 index 8af13c51d1..0000000000 Binary files a/mdop/uev-v2/images/checklistbox.gif and /dev/null differ diff --git a/mdop/uev-v2/images/deploymentworkflow.png b/mdop/uev-v2/images/deploymentworkflow.png deleted file mode 100644 index b665a0bfea..0000000000 Binary files a/mdop/uev-v2/images/deploymentworkflow.png and /dev/null differ diff --git a/mdop/uev-v2/images/ue-vgeneratorprocess.gif b/mdop/uev-v2/images/ue-vgeneratorprocess.gif deleted file mode 100644 index 1c1ef4331d..0000000000 Binary files a/mdop/uev-v2/images/ue-vgeneratorprocess.gif and /dev/null differ diff --git a/mdop/uev-v2/images/uev2archdiagram.gif b/mdop/uev-v2/images/uev2archdiagram.gif deleted file mode 100644 index 8b1647b48c..0000000000 Binary files a/mdop/uev-v2/images/uev2archdiagram.gif and /dev/null differ diff --git a/mdop/uev-v2/index.md b/mdop/uev-v2/index.md deleted file mode 100644 index b0a92410ba..0000000000 --- a/mdop/uev-v2/index.md +++ /dev/null @@ -1,324 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 2.x -description: Microsoft User Experience Virtualization (UE-V) 2.x -author: dansimp -ms.assetid: b860fed0-b846-415d-bdd6-ba60231a64be -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Microsoft User Experience Virtualization (UE-V) 2.x - ->[!NOTE] ->This documentation is a for version of UE-V that was included in the Microsoft Desktop Optimization Pack (MDOP). For information about the latest version of UE-V which is included in Windows 10 Enterprise, see [Get Started with UE-V](https://docs.microsoft.com/windows/configuration/ue-v/uev-getting-started). - - -Capture and centralize your users’ application settings and Windows OS settings by implementing Microsoft User Experience Virtualization (UE-V) 2.0 or 2.1. Then, apply these settings to the devices users access in your enterprise, like desktop computers, laptops, or virtual desktop infrastructure (VDI) sessions. - -**With UE-V you can…** - -- Specify which application and desktop settings synchronize - -- Deliver the settings anytime and anywhere users work throughout the enterprise - -- Create custom templates for your third-party or line-of-business applications - -- Recover settings after hardware replacement or upgrade, or after reimaging a virtual machine to its initial state - -## Components of UE-V 2.x - - -This diagram shows how deployed UE-V components work together to synchronize settings. - -![uev2 architectural diagram](images/uev2archdiagram.gif) - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ComponentFunction

    UE-V Agent

    Installed on every computer that needs to synchronize settings, the UE-V Agent monitors registered applications and the operating system for any settings changes, then synchronizes those settings between computers.

    Settings packages

    Application settings and Windows settings are stored in settings packages created by the UE-V Agent. Settings packages are built, locally stored, and copied to the settings storage location.

    -
      -
    • The setting values for desktop applications are stored when the user closes the application.

    • -
    • Values for Windows settings are stored when the user logs off, when the computer is locked, or when the user disconnects remotely from a computer.

    • -
    -

    The sync provider determines when the application or operating system settings are read from the Settings Packages and synchronized.

    Settings storage location

    This is a standard network share that your users can access. The UE-V Agent verifies the location and creates a hidden system folder in which to store and retrieve user settings.

    Settings location templates

    UE-V uses XML files as settings location templates to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V . You can also create, edit, or validate custom settings location templates by managing settings synchronization for custom applications.

    -
    -Note

    Settings location templates are not required for Windows apps.

    -
    -
    - -

    Windows app list

    Settings for Windows apps are captured and applied dynamically. The app developer specifies the settings that are synchronized for each app. UE-V determines which Windows apps are enabled for settings synchronization using a managed list of apps. By default, this list includes most Windows apps.

    -

    You can add or remove applications in the Windows app list by following the procedures shown here.

    - - - -### Managing Settings Synchronization for Custom Applications - -Use these UE-V components to create and manage custom templates for your third-party or line-of-business applications. - - ---- - - - - - - - - - - -

    UE-V Generator

    Use the UE-V Generator to create custom settings location templates that you can then distribute to user computers. The UE-V Generator also lets you edit an existing template or validate a template that was created by using another XML editor.

    Settings template catalog

    The settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores the custom settings location templates. The UE-V Agent checks this location once a day, retrieves new or updated templates, and updates its synchronization behavior.

    -

    If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see Configure a UE-V settings template catalog.

    - - - -![ue-v generator process](images/ue-vgeneratorprocess.gif) - -## Settings Synchronized by Default - - -UE-V synchronizes settings for these applications by default. For a complete list and more detailed information, see [Settings that are automatically synchronized in a UE-V deployment](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). - -Microsoft Office 2013 applications (UE-V 2.1 SP1 and 2.1) - -Microsoft Office 2010 applications (UE-V 2.1 SP1, 2.1, and 2.0) - -Microsoft Office 2007 applications (UE-V 2.0 only) - -Internet Explorer 8, 9, and 10 - -Internet Explorer 11 in UE-V 2.1 SP1 and 2.1 - -Many Windows applications, such as Xbox - -Many Windows desktop applications, such as Notepad - -Many Windows settings, such as desktop background or wallpaper - -**Note** -You can also [customize UE-V to synchronize settings](https://technet.microsoft.com/library/dn458942.aspx) for applications other than those synchronized by default. - - - -## Compare UE-V to other Microsoft products - - -Use this table to compare UE-V to Synchronize Profiles in Windows 7, Synchronize Profiles in Windows 8, and the Sync PC Settings feature of Microsoft account. - - --------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FeatureSynchronize Profiles using Windows 7Synchronize Profiles using Windows 8Synchronize Profiles using Windows 10Microsoft accountUE-V 2.0UE-V 2.1 and 2.1 SP1

    Synchronize settings between multiple computers

    Synchronize settings between physical and virtual apps

    Synchronize Windows app settings

    Manage via WMI

    Synchronize settings changes on a regular basis

    Minimal configuration for Setup

    Supported on non-domain joined computers

    Supports Primary Computer Active Directory attribute

    Synchronizes settings between virtual desktop infrastructure (VDI)/Remote Desktop Services (RDS) and rich desktops

    Unlimited setting storage space

    Choice in which app settings to synchronize

    Backup/Restore for IT Pro

    Partial

    - - - -## UE-V 2.x Release Notes - - -For more information, and for late-breaking news that did not make it into the documentation, see - -- [Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md) - -- [Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md) - -- [Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md) - -## Other resources for this product - - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - -### More information - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md b/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md deleted file mode 100644 index 2bee981420..0000000000 --- a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -title: Manage Administrative Backup and Restore in UE-V 2.x -description: Manage Administrative Backup and Restore in UE-V 2.x -author: dansimp -ms.assetid: 2eb5ae75-65e5-4afc-adb6-4e83cf4364ae -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage Administrative Backup and Restore in UE-V 2.x - - -As an administrator of Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1, you can restore application and Windows settings to their original state. And new in UE-V 2.1, you can also restore additional settings when a user adopts a new device. - -## Restore Settings in UE-V 2.1 or UE-V 2.1 SP1 when a User Adopts a New Device - - -To restore settings when a user adopts a new device, you can put a settings location template in **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To backup settings for a template, use the following cmdlet in Windows PowerShell: - -``` syntax -Set-UevTemplateProfile -ID -Profile -``` - -- <TemplateID> is the UE-V Template ID - -- <backup> can either be Backup or Roaming - -When replacing a user’s device UE-V automatically restores settings if the user’s domain, username, and device name all match. All synchronized and any backup data is restored on the device automatically. - -You can also use the new PowerShell cmdlet, Restore-UevBackup, to restore settings from a different device. To clone the settings packages for the new device, use the following cmdlet in Windows PowerShell: - -``` syntax -Restore-UevBackup –Machine -``` - -where <MachineName> is the computer name of the device. - -Templates such as the Office 2013 template that include many applications can either all be included in the roamed (default) or backed up profile. Individual apps in a template suite follow the group. Office 2013 in-box templates include both roaming and backup-only settings. Backup-only settings cannot be included in a roaming profile. - -As part of the Backup/Restore feature, UE-V added **last known good (LKG)** to the options for rolling back to settings. In this release, you can roll back to either the original settings or LKG settings. The LKG settings let users roll back to an intermediate and stable point ahead of the pre-UE-V state of the settings. - -### How to Backup/Restore Templates with UE-V - -These are the key backup and restore components of UE-V: - -- Template profiles - -- Settings packages location within the Settings Storage Location template - -- Backup trigger - -- How settings are restored - -**Template Profiles** - -A UE-V template profile is defined when the template is registered on the device or post registration through the PowerShell/WMI configuration utility. The profile types include: - -- Roaming (default) - -- Backup - -- BackupOnly - -All templates are included in the roaming profile when registered unless otherwise specified. These templates synchronize settings to all UE-V enabled devices with the corresponding template enabled. - -Templates can be added to the Backup Profile with PowerShell or WMI using the Set-UevTemplateProfile cmdlet. Templates in the Backup Profile back up these settings to the Settings Storage Location in a special Device name directory. Specified settings are backed up to this location. - -Templates designated BackupOnly include settings specific to that device that should not be synchronized unless explicitly restored. These settings are stored in the same device-specific settings package location on the settings storage location as the Backedup Settings. These templates have a special identifier embedded in the template that specifies they should be part of this profile. - -**Settings packages location within the Settings Storage Location template** - -Roaming Profile settings are stored on the settings storage location. Templates assigned to the Backup or the BackupOnly profile store their settings to the Settings Storage Location in a special Device name directory. Each device with templates in these profiles has its own device name. UE-V does not clean up these directories. - -**Backup trigger** - -Backup is triggered by the same events that trigger a UE-V synchronization. - -**How settings are restored** - -Restoring a user’s device restores the currently registered Template’s settings from another device’s backup folder and all synchronized settings to the current machine. Settings are restored in these two ways: - -- **Automatic restore** - - If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user logs on to a new device for the first time and these criteria are met, the settings data is applied to that device. - - **Note** - Accessibility and Windows Desktop settings require the user to re-logon to Windows to be applied. - - - -- **Manual Restore** - - If you want to assist users by restoring a device during a refresh, you can choose to use the Restore-UevBackup cmdlet. This command causes the user’s settings to be downloaded from the Settings Storage Location. - -## Restore Application and Windows Settings to Original State - - -WMI and Windows PowerShell commands let you restore application and Windows settings to the settings values that were on the computer the first time that the application started after the UE-V Agent was installed. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application runs, or the settings are restored when the user logs on to the operating system. - -**To restore application settings and Windows settings with Windows PowerShell for UE-V 2.x** - -1. Open the Windows PowerShell window. - -2. Enter the following Windows PowerShell cmdlet to restore the application settings and Windows settings. - - - - - - - - - - - - - - - - - - -
    Windows PowerShell cmdletDescription

    Restore-UevUserSetting -<TemplateID>

    Restores the user settings for an application or restores a group of Windows settings.

    - - - -**To restore application settings and Windows settings with WMI** - -1. Open a Windows PowerShell window. - -2. Enter the following WMI command to restore application settings and Windows settings. - - - - - - - - - - - - - - - - - - -
    WMI commandDescription

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name RestoreByTemplateId -ArgumentList <template_ID>

    Restores the user settings for an application or restores a group of Windows settings.

    - - - -~~~ -**Note** -UE-V does not provide a settings rollback for Windows apps. -~~~ - - - - - - - - -## Related topics - - -[Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md deleted file mode 100644 index 0a0c3a72bf..0000000000 --- a/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Manage Configurations for UE-V 2.x -description: Manage Configurations for UE-V 2.x -author: dansimp -ms.assetid: e2332eca-a9cd-4446-8f7c-d17058b03466 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Manage Configurations for UE-V 2.x - - -In the course of the Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1 lifecycle, you have to manage the configuration of the UE-V Agent and also manage storage locations for resources such as settings package files. You might have to perform other tasks, for example, configuring the Company Settings Center to define how users interact with UE-V. The following topics provide guidance for managing these UE-V resources. - -## Configuring UE-V 2.x by using Group Policy Objects - - -You can use Group Policy Objects to modify the settings that define how UE-V synchronizes settings on computers. - -[Configuring UE-V 2.x with Group Policy Objects](configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md) - -## Configuring UE-V 2.x with System Center Configuration Manager 2012 - - -You can use System Center 2012 Configuration Manager to manage the UE-V Agent by using the UE-V 2 Configuration Pack. - -[Configuring UE-V 2.x with System Center Configuration Manager 2012](configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md) - -## Administering UE-V 2.x with PowerShell and WMI - - -UE-V provides Windows PowerShell cmdlets, which can help administrators perform various UE-V tasks. - -[Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) - -## Configuring the Company Settings Center for UE-V 2.x - - -You can configure the Company Settings Center that is installed by using the UE-V Agent to define how users interact with UE-V. - -[Configuring the Company Settings Center for UE-V 2.x](configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md) - -## Examples of configuration settings for UE-V 2.x - - -Here are some examples of UE-V configuration settings: - -- **Settings Storage Path:** Specifies the location of the file share that stores the UE-V settings. - -- **Settings Template Catalog Path:** Specifies the Universal Naming Convention (UNC) path that defines the location that was checked for new settings location templates. - -- **Register Microsoft Templates:** Specifies whether the default Microsoft templates should be registered during installation. - -- **Synchronization Method:** Specifies whether UE-V uses the sync provider or "none". The "SyncProvider" supports computers that are disconnected from the network. "None" applies when the computer is always connected to the network. For more information about the Sync Method, see [Sync Methods for UE-V 2.x](sync-methods-for-ue-v-2x-both-uevv2.md). - -- **Synchronization Timeout:** Specifies the number of milliseconds that the computer waits before time-out when it retrieves the user settings from the settings storage location. - -- **Synchronization Enable:** Specifies whether the UE-V settings synchronization is enabled or disabled. - -- **Maximum Package Size:** Specifies a settings package file threshold size in bytes at which the UE-V Agent reports a warning. - -- **Don’t Sync Windows App Settings:** Specifies that UE-V should not synchronize Windows apps. - -- **Enable/Disable First Use Notification:** Specifies whether UE-V displays a dialog box the first time that the UE-V Agent runs on a user’s computer. - -- **Enable/Disable Tray Icon:** Specifies whether UE-V displays an icon in the notification area and any notifications associated with it. The icon provides a link to the Company Settings Center. - -- **Custom Contact IT Hyperlink:** Defines the path, text, and description for the **Contact IT** hyperlink in the Company Settings Center. - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -[Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md) - -[Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) - -  - -  - - - - - diff --git a/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md deleted file mode 100644 index 1b9749d6ca..0000000000 --- a/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md +++ /dev/null @@ -1,380 +0,0 @@ ---- -title: Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI -description: Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI -author: dansimp -ms.assetid: 56e6780b-8b2c-4717-91c8-2af63062ab75 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI - - -You can use Windows Management Instrumentation (WMI) and Windows PowerShell to manage Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 Agent configuration and synchronization behavior. For a complete list of UE-V PowerShell cmdlets, see [UE-V 2 Cmdlet Reference](https://go.microsoft.com/fwlink/?LinkId=393495) (https://go.microsoft.com/fwlink/?LinkId=393495). - -**To deploy the UE-V Agent by using Windows PowerShell** - -1. Stage the UE-V installer file in an accessible network share. - - **Note** - Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer packages, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time by using the installation file, you must use the same file type. - - - -2. Use one of the following Windows PowerShell commands to install the UE-V Agent. - - - `& AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - - - `& msiexec.exe /i "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - -**To configure the UE-V Agent by using Windows PowerShell** - -1. Open a Windows PowerShell window. To manage computer settings that affect all users of the computer by using the *Computer* parameter, open the window with an account that has administrator rights. - -2. Use the following Windows PowerShell commands to configure the agent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows PowerShell commandDescription

    Get-UevConfiguration

    -

    Gets the effective UE-V Agent settings. User-specific settings have precedence over the computer settings.

    Get-UevConfiguration - CurrentComputerUser

    -

    Gets the UE-V Agent settings values for the current user only.

    Get-UevConfiguration -Computer

    Gets the UE-V Agent configuration settings values for all users on the computer.

    Get-UevConfiguration -Details

    Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid.

    Set-UevConfiguration -Computer –ContactITDescription <IT description>

    Sets the text that is displayed in the Company Settings Center for the help link.

    Set-UevConfiguration -Computer -ContactITUrl <string>

    Sets the URL of the link in the Company Settings Center for the help link. Any URL protocol can be used.

    Set-UevConfiguration -Computer –EnableDontSyncWindows8AppSettings

    Configures the UE-V Agent to not synchronize any Windows apps for all users on the computer.

    Set-UevConfiguration -CurrentComputerUser – EnableDontSyncWindows8AppSettings

    Configures the UE-V Agent to not synchronize any Windows apps for the current computer user.

    Set-UevConfiguration -Computer –EnableFirstUseNotification

    Configures the UE-V Agent to display notification the first time the agent runs for all users on the computer.

    Set-UevConfiguration -Computer –DisableFirstUseNotification

    Configures the UE-V Agent to not display notification the first time that the agent runs for all users on the computer.

    Set-UevConfiguration -Computer –EnableSettingsImportNotify

    Configures the UE-V Agent to notify all users on the computer when settings synchronization is delayed.

    -

    Use the DisableSettingsImportNotify parameter to disable notification.

    Set-UevConfiguration - CurrentComputerUser -EnableSettingsImportNotify

    Configures the UE-V Agent to notify the current user when settings synchronization is delayed.

    -

    Use the DisableSettingsImportNotify parameter to disable notification.

    Set-UevConfiguration -Computer –EnableSyncUnlistedWindows8Apps

    Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI.

    -

    Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List.

    Set-UevConfiguration - CurrentComputerUser - EnableSyncUnlistedWindows8Apps

    Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI.

    -

    Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List.

    Set-UevConfiguration –Computer –DisableSync

    Disables UE-V for all the users on the computer.

    -

    Use the EnableSync parameter to enable or re-enable.

    Set-UevConfiguration –CurrentComputerUser -DisableSync

    Disables UE-V for the current user on the computer.

    -

    Use the EnableSync parameter to enable or re-enable.

    Set-UevConfiguration -Computer –EnableTrayIcon

    Enables the UE-V icon in the notification area for all users of the computer.

    -

    Use the DisableTrayIcon parameter to disable the icon.

    Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes>

    Configures the UE-V agent to report when a settings package file size reaches the defined threshold for all users on the computer. Sets the threshold package size in bytes.

    Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes>

    Configures the UE-V agent to report when a settings package file size reaches the defined threshold. Sets the package size warning threshold for the current user.

    Set-UevConfiguration -Computer -SettingsImportNotifyDelayInSeconds

    Specifies the time in seconds before the user is notified for all users of the computer

    Set-UevConfiguration - CurrentComputerUser -SettingsImportNotifyDelayInSeconds

    Specifies the time in seconds before notification for the current user is sent.

    Set-UevConfiguration -Computer -SettingsStoragePath <path to _settings_storage_location>

    Defines a per-computer settings storage location for all users of the computer.

    Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath <path to _settings_storage_location>

    Defines a per-user settings storage location.

    Set-UevConfiguration –Computer –SettingsTemplateCatalogPath <path to catalog>

    Sets the settings template catalog path for all users of the computer.

    Set-UevConfiguration -Computer -SyncMethod <sync method>

    Sets the synchronization method for all users of the computer: SyncProvider or None.

    Set-UevConfiguration -CurrentComputerUser -SyncMethod <sync method>

    Sets the synchronization method for the current user: SyncProvider or None.

    Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds <timeout in milliseconds>

    Sets the synchronization time-out in milliseconds for all users of the computer

    Set- UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds <timeout in milliseconds>

    Set the synchronization time-out for the current user.

    Clear-UevConfiguration –Computer -<setting name>

    Clears the specified setting for all users on the computer.

    Clear-UevConfiguration –CurrentComputerUser -<setting name>

    Clears the specified setting for the current user only.

    Export-UevConfiguration <settings migration file>

    Exports the UE-V computer configuration to a settings migration file. The file name extension must be .uev.

    -

    The Export cmdlet exports all UE-V Agent settings that are configurable with the Computer parameter.

    Import-UevConfiguration <settings migration file>

    Imports the UE-V computer configuration from a settings migration file. The file name extension must be .uev.

    - - - -**To export UE-V package settings and repair UE-V templates by using Windows PowerShell** - -1. Open a Windows PowerShell window as an administrator. - -2. Use the following Windows PowerShell commands to configure the agent. - - - - - - - - - - - - - - - - - - - - -

    Windows PowerShell command

    Description

    Export-UevPackage MicrosoftCalculator6.pkgx

    Extracts the settings from a Microsoft Calculator package file and converts them into a human-readable format in XML.

    Repair-UevTemplateIndex

    Repairs the index of the UE-V settings location templates.

    - - - -**To configure the UE-V Agent by using WMI** - -1. User Experience Virtualization provides the following set of WMI commands. Administrators can use this interface to configure the UE-V agent at the command line and automate typical configuration tasks. - - Use an account with administrator rights to open a Windows PowerShell window. - -2. Use the following WMI commands to configure the agent. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows PowerShell commandDescription

    Get-WmiObject -Namespace root\Microsoft\UEV Configuration

    -

    Displays the active UE-V Agent settings. User-specific settings have precedence over the computer settings.

    Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

    Displays the UE-V Agent configuration that is defined for a user.

    Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    Displays the UE-V Agent configuration that is defined for a computer.

    Get-WmiObject –Namespace root\Microsoft\Uev ConfigurationItem

    Displays the details for each configuration item.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.SettingsStoragePath = <path_to_settings_storage_location>

    -

    $config.Put()

    Defines a per-computer settings storage location.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration

    -

    $config.SettingsStoragePath = <path_to_settings_storage_location>

    -

    $config.Put()

    Defines a per-user settings storage location.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.SyncTimeoutInMilliseconds = <timeout_in_milliseconds>

    -

    $config.Put()

    Sets the synchronization time-out in milliseconds for all users of the computer.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.MaxPackageSizeInBytes = <size_in_bytes>

    -

    $config.Put()

    Configures the UE-V Agent to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes for all users of the computer.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.SyncMethod = <sync_method>

    -

    $config.Put()

    Sets the synchronization method for all users of the computer: SyncProvider or None.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.<setting name> = $true

    -

    $config.Put()

    To enable a specific per-computer setting, clear the setting, and use $null as the setting value. Use UserConfiguration for per-user settings.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.<setting name> = $false

    -

    $config.Put()

    To disable a specific per-computer setting, clear the setting, and use $null as the setting value. Use User Configuration for per-user settings.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.<setting name> = <setting value>

    -

    $config.Put()

    Updates a specific per-computer setting. To clear the setting, use $null as the setting value.

    $config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration

    -

    $config.<setting name> = <setting value>

    -

    $config.Put()

    Updates a specific per-user setting for all users of the computer. To clear the setting, use $null as the setting value.

    - - - -~~~ -Upon configuration of the UE-V Agent with WMI and Windows PowerShell, the defined configuration is stored in the registry in the following locations. - -`\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration` - -`\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration` -~~~ - -**To export UE-V package settings and repair UE-V templates by using WMI** - -1. UE-V provides the following set of WMI commands. Administrators can use this interface to export a package or repair UE-V templates. - -2. Use the following WMI commands. - - - - - - - - - - - - - - - - - - - - - - -
    WMI commandDescription

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name ExportPackage -ArgumentList <package name>

    Extracts the settings from a package file and converts them into a human-readable format in XML.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name RebuildIndex

    Repairs the index of the UE-V settings location templates. Must be run as administrator.

    - - - -~~~ -**Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev). -~~~ - -## Related topics - - -[Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md deleted file mode 100644 index d1c3e2c0aa..0000000000 --- a/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md +++ /dev/null @@ -1,379 +0,0 @@ ---- -title: Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI -description: Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI -author: dansimp -ms.assetid: b5253050-acc3-4274-90d0-1fa4c480331d -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 use XML settings location templates to define the settings that User Experience Virtualization captures and applies. UE-V includes a set of standard settings location templates. It also includes the UE-V Generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates, you can manage those templates by using Windows PowerShell and the Windows Management Instrumentation (WMI). For a complete list of UE-V PowerShell cmdlets, see [UE-V 2 Cmdlet Reference](https://go.microsoft.com/fwlink/p/?LinkId=393495) (https://go.microsoft.com/fwlink/p/?LinkId=393495). - -## Manage UE-V 2 settings location templates by using Windows PowerShell - - -The WMI and Windows PowerShell features of UE-V include the ability to enable, disable, register, update, and unregister settings location templates. By using these features, you can automate the process of registering, updating, or unregistering templates with the UE-V Agent. You can also manually register templates by using WMI and Windows PowerShell commands. By using these features in conjunction with an electronic software distribution solution, Group Policy, or another automated deployment method such as a script, you can further automate that process. - -You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable, disable, or list templates. - -***To manage settings location templates by using Windows PowerShell*** - -1. Use an account with administrator rights to open a Windows PowerShell command prompt. - -2. Use the following Windows PowerShell cmdlets to register and manage the UE-V settings location templates. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows PowerShell commandDescription

    Get-UevTemplate

    Lists all the settings location templates that are registered on the computer.

    Get-UevTemplate –Application <string>

    Lists all the settings location templates that are registered on the computer where the application name or template name contains <string>.

    Get-UevTemplate –TemplateID <string>

    Lists all the settings location templates that are registered on the computer where the template ID contains <string>.

    Get-UevTemplate [-ApplicationOrTemplateID] <string>

    Lists all the settings location templates that are registered on the computer where the application or template name, or template ID contains <string>.

    Get-UevTemplateProgram [-ID] <template ID>

    Gets the name of the program and version information, which depend on the template ID.

    Get-UevAppXPackage

    Gets the effective list of Windows apps.

    Get-UevAppXPackage -Computer

    Gets the list of Windows apps that are configured for the computer.

    Get-UevAppXPackage -CurrentComputerUser

    Gets the list of Windows apps that are configured for the current user.

    Register-UevTemplate [-Path] <template file path>[,<template file path>]

    Registers one or more settings location template with UE-V by using relative paths and/or wildcard characters in file paths. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.

    Register-UevTemplate –LiteralPath <template file path>[,<template file path>]

    Registers one or more settings location template with UE-V by using literal paths, where no characters can be interpreted as wildcard characters. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.

    Unregister-UevTemplate [-ID] <template ID>

    Unregisters a settings location template with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

    Unregister-UevTemplate -All

    Unregisters all settings location templates with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

    Update-UevTemplate [-Path] <template file path>[,<template file path>]

    Updates one or more settings location templates with a more recent version of the template. Use relative paths and/or wildcard characters in the file paths. The new template should be a newer version than the existing template.

    Update-UevTemplate –LiteralPath <template file path>[,<template file path>]

    Updates one or more settings location templates with a more recent version of the template. Use full paths to template files, where no characters can be interpreted as wildcard characters. The new template should be a newer version than the existing template.

    Clear-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

    Removes one or more Windows apps from the computer Windows app list.

    Clear-UevAppXPackage -CurrentComputerUser

    Removes Windows app from the current user Windows app list.

    Clear-UevAppXPackage –Computer -All

    Removes all Windows apps from the computer Windows app list.

    Clear-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

    Removes one or more Windows apps from the current user Windows app list.

    Clear-UevAppXPackage [–CurrentComputerUser] -All

    Removes all Windows apps from the current user Windows app list.

    Disable-UevTemplate [-ID] <template ID>

    Disables a settings location template for the current user of the computer.

    Disable-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

    Disables one or more Windows apps in the computer Windows app list.

    Disable-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

    Disables one or more Windows apps in the current user Windows app list.

    Enable-UevTemplate [-ID] <template ID>

    Enables a settings location template for the current user of the computer.

    Enable-UevAppXPackage –Computer [-PackageFamilyName] <package family name>[,<package family name>]

    Enables one or more Windows apps in the computer Windows app list.

    Enable-UevAppXPackage [–CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]

    Enables one or more Windows apps in the current user Windows app list.

    Test-UevTemplate [-Path] <template file path>[,<template file path>]

    Determines whether one or more settings location templates comply with its XML schema. Can use relative paths and wildcard characters.

    Test-UevTemplate –LiteralPath <template file path>[,<template file path>]

    Determines whether one or more settings location templates comply with its XML schema. The path must be a full path to the template file, but does not include wildcard characters.

    - - - -The UE-V Windows PowerShell features enable you to manage a group of settings templates that are deployed in your enterprise. Use the following procedure to manage a group of templates by using Windows PowerShell. - -**To manage a group of settings location templates by using Windows PowerShell** - -1. Modify or update the desired settings location templates. - -2. If you want to modify or update the settings location templates, deploy those settings location templates to a folder that is accessible to the local computer. - -3. On the local computer, open a Windows PowerShell window with administrator rights. - -4. Unregister all the previously registered versions of the templates by typing the following command. - - ``` syntax - Unregister-UevTemplate -All - ``` - - This command unregisters all active templates on the computer. - -5. Register the updated templates by typing the following command. - - ``` syntax - Register-UevTemplate \*.xml - ``` - - This command registers all of the settings location templates that are located in the specified template folder. - -### Windows app list - -By listing a Windows app in the Windows app list, you specify whether that app is enabled or disabled for settings synchronization. Apps are identified in the list by their Package Family name and whether settings synchronization should be enabled or disabled for that app. When you use these settings along with the Unlisted Default Sync Behavior setting, you can control whether Windows apps are synchronized. - -To display the Package Family Name of installed Windows apps, at a Windows PowerShell command prompt, enter: - -``` syntax -Get-AppxPackage | Sort-Object PackageFamilyName | Format-Table PackageFamilyName -``` - -To display a list of Windows apps that can synchronize settings on a computer with their package family name, enabled status, and enabled source, at a Windows PowerShell command prompt, enter: `Get-UevAppxPackage` - -**Definitions of Get-UevAppxPackage properties** - -**DisplayName** -The name that is displayed to the user in the Company Settings Center application. The `DisplayName` property is derived from the `PackageFamilyName` property. - -**PackageFamilyName** -The name of the package that is installed for the current user. - -**Enabled** -Defines whether the settings for the app are configured to synchronize. - -**EnabledSource** -The location where the configuration that enables or disables the app is set. Possible values are: *NotSet*, *LocalMachine*, *LocalUser*, *PolicyMachine*, and *PolicyUser*. - -**NotSet** -The policy is not configured to synchronize this app. - -**LocalMachine** -The enabled state is set in the local computer section of the registry. - -**LocalUser** -The enabled state is set in the current user section of the registry. - -**PolicyMachine** -The enabled state is set in the policy section of the local computer section of the registry. - -To get the user-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage –CurrentComputerUser` - -To get the computer-configured list of Windows apps, at the Windows PowerShell command prompt, enter: `Get-UevAppxPackage –Computer` - -For either parameter, CurrentComputerUser or Computer, the cmdlet returns a list of the Windows apps that are configured at the user or at the computer level. - -**Definitions of properties** - -**DisplayName** -The name that is displayed to the user in the Company Settings Center application. The `DisplayName` property is derived from the `PackageFamilyName` property. - -**PackageFamilyName** -The name of the package that is installed for the current user. - -**Enabled** -Defines whether the settings for the app are configured to synchronize for the specified switch, that is, **user** or **computer**. - -**Installed** -True if the app, that is, the PackageFamilyName is installed for the current user. - -### Manage UE-V 2 settings location templates by using WMI - -User Experience Virtualization provides the following set of WMI commands. Administrators can use these interfaces to manage settings location templates from Windows PowerShell and automate template administrative tasks. - -**To manage settings location templates by using WMI** - -1. Use an account with administrator rights to open a Windows PowerShell window. - -2. Use the following WMI commands to register and manage the UE-V settings location templates. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows PowerShell commandDescription

    Get-WmiObject -Namespace root\Microsoft\UEV SettingsLocationTemplate | Select-Object TemplateId,TemplateName, TemplateVersion,Enabled | Format-Table -Autosize

    Lists all the settings location templates that are registered for the computer.

    Invoke-WmiMethod –Namespace root\Microsoft\UEV –Class SettingsLocationTemplate –Name GetProcessInfoByTemplateId <template Id>

    Gets the name of the program and version information, which depends on the template name.

    Get-WmiObject -Namespace root\Microsoft\UEV EffectiveWindows8App

    Gets the effective list of Windows apps.

    Get-WmiObject -Namespace root\Microsoft\UEV MachineConfiguredWindows8App

    Gets the list of Windows apps that are configured for the computer.

    Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguredWindows8App

    Gets the list of Windows apps that are configured for the current user.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Register -ArgumentList <template path >

    Registers a settings location template with UE-V.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name UnregisterByTemplateId -ArgumentList <template ID>

    Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Update -ArgumentList <template path>

    Updates a settings location template with UE-V. The new template should be a newer version than the existing one.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name RemoveApp -ArgumentList <package family name | package family name>

    Removes one or more Windows apps from the computer Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name RemoveApp -ArgumentList <package family name | package family name>

    Removes one or more Windows apps from the current user Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name DisableByTemplateId -ArgumentList <template ID>

    Disables one or more settings location templates with UE-V.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name DisableApp -ArgumentList <package family name | package family name>

    Disables one or more Windows apps in the computer Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name DisableApp -ArgumentList <package family name | package family name>

    Disables one or more Windows apps in the current user Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name EnableByTemplateId -ArgumentList <template ID>

    Enables a settings location template with UE-V.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name EnableApp -ArgumentList <package family name | package family name>

    Enables Windows apps in the computer Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name EnableApp -ArgumentList <package family name | package family name>

    Enables Windows apps in the current user Windows app list.

    Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Validate -ArgumentList <template path>

    Determines whether a given settings location template complies with its XML schema.

    - - - -~~~ -**Note** -Where a list of Package Family Names is called by the WMI command, the list must be in quotes and separated by a pipe symbol, for example, `""`. -~~~ - - - -### Deploying the UE-V Agent using Windows PowerShell - -**How to deploy the UE-V Agent by using Windows PowerShell** - -1. Stage the UE-V Agent installation package in an accessible network share. - - **Note** - Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. The Windows Installer packages, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time by using the installation file, you must use the same file type. - - - -2. Use one of the following Windows PowerShell commands to install the UE-V Agent. - - - `& AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - - - `& msiexec.exe /i "" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%` - -**Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev). - -## Related topics - - -[Administering UE-V 2.x with Windows PowerShell and WMI](administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md) - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md deleted file mode 100644 index 66a3f0adb8..0000000000 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md +++ /dev/null @@ -1,217 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes -author: dansimp -ms.assetid: 5ef66cd1-ba2b-4383-9f45-e7cde41f1ba1 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes - - -To search Microsoft User Experience Virtualization (UE-V) 2.0 release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Providing feedback - - -Tell us what you think about our documentation for MDOP by giving us your feedback and comments. Send your documentation feedback to [mdopdocs@microsoft.com](mailto:mdopdocs@microsoft.com?subject=UE-V%20Documentation). - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization. - -### Registry settings do not synchronize between App-V and native applications on the same computer - -When a computer has an application that is installed through both Application Virtualization (App-V) and a locally with a Windows Installer (.msi) file, the registry-based settings do not synchronize between the technologies. - -**WORKAROUND:** To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Settings do not synchronization when network share is outside user’s domain - -When Windows® 8 attempts operating system settings synchronization, the synchronization fails with the following error message: **boost::filesystem::exists::Incorrect user name or password**. This error can indicate that the network share is outside the user’s domain or a domain with a trust relationship to that domain. To check for operational log events, open the **Event Viewer** and navigate to **Applications and Services Logs** / **Microsoft** / **User Experience Virtualization** / **Logging** / **Operational**. Network shares that are used for UE-V settings storage locations should reside in the same Active Directory domain as the user or a trusted domain of the user’s domain. - -**WORKAROUND:** Use network shares from the same Active Directory domain as the user. - -### Unpredictable results with both Office 2010 and Office 2013 installed - -When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. - -**WORKAROUND:** Install only one version of Office or limit which settings are synchronized by UE-V. - -### Uninstall and re-install of Windows 8 app reverts settings to initial state - -While using UE-V settings synchronization for a Windows 8 app, if the user uninstalls the app and then reinstalls the app, the app’s settings revert to their default values.  This happens because the uninstall removes the local (cached) copy of the app’s settings but does not remove the local UE-V settings package.  When the app is reinstalled and launched, UE-V gather the app settings that were reset to the app defaults and then uploads the default settings to the central storage location.  Other computers running the app then download the default settings.  This behavior is identical to the behavior of desktop applications. - -**WORKAROUND:** None. - -### Email signature roaming for Outlook 2010 - -UE-V will roam the Outlook 2010 signature files between devices. However, the default signature options for new messages and replies or forwards are not synchronized. These two settings are stored in the Outlook profile, which UE-V does not roam. - -**WORKAROUND:** None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 64-bit version of Microsoft Office for modern computers. To determine which version you need, [click here](https://support.office.com/article/choose-between-the-64-bit-or-32-bit-version-of-office-2dee7807-8f95-4d0c-b5fe-6c6f49b8d261?ui=en-US&rs=en-US&ad=US#32or64Bit=Newer_Versions). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -**WORKAROUND:** None - -### MSI’s are not localized - -UE-V 2.0 includes a localized setup program for both the UE-V Agent and UE-V generator. These MSI files are still available but the user interface is minimized and the MSI’s only display in English. Despite the file being in English, the setup program installs all supported languages during the installation. - -**WORKAROUND:** None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -**WORKAROUND:** Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -**WORKAROUND:** Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Long Settings Storage Paths could cause an error - -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: - -`[boost::filesystem::copy_file: The system cannot find the path specified]` - -To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. - -**WORKAROUND:** None. - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. - -**WORKAROUND:** None - -### Windows 8 apps do not sync settings when the app restarts after closing unexpectedly - -If a Windows 8 app closes unexpectedly soon after startup, settings for the application may not be synchronized when the application is restarted. - -**WORKAROUND:** Close the Windows 8 app, close and restart the UevAppMonitor.exe application (can use TaskManager), and then restart the Windows 8 app. - -### UE-V 1 agent generates errors when running UE-V 2 templates - -If a UE-V 2 settings location template is distributed to a computer installed with a UE-V 1 agent, some settings fail to synchronize between computers and the agent reports errors in the event log. - -**WORKAROUND:** When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have computers running the previous version of the agent, create a separate UE-V 2.0 catalog to support the UE-V 2.0 Agent and templates. - -## Hotfixes and Knowledge Base articles for UE-V 2.0 - - -This section contains hotfixes and KB articles for UE-V 2.0. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    KB ArticleTitleLink

    2927019

    Hotfix Package 1 for Microsoft User Experience Virtualization 2.0

    support.microsoft.com/kb/2927019

    2903501

    UE-V: User Experience Virtualization (UE-V) compatibility with user profiles

    support.microsoft.com/kb/2903501/EN-US

    2770042

    UE-V Registry Settings

    support.microsoft.com/kb/2770042/EN-US

    2847017

    UE-V settings replicated by Internet Explorer

    support.microsoft.com/kb/2847017/EN-US

    2930271

    Understanding the limitations of roaming Outlook signatures in Microsoft UE-V

    support.microsoft.com/kb/2930271/EN-US

    2769631

    How to repair a corrupted UE-V install

    support.microsoft.com/kb/2769631/EN-US

    2850989

    Migrating MAPI profiles with Microsoft UE-V is not supported

    support.microsoft.com/kb/2850989/EN-US

    2769586

    UE-V roams empty folders and registry keys

    support.microsoft.com/kb/2769586/EN-US

    2782997

    How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)

    support.microsoft.com/kb/2782997/EN-US

    2769570

    UE-V does not update the theme on RDS or VDI sessions

    support.microsoft.com/kb/2769570/EN-US

    2901856

    Application settings do not sync after you force a restart on a UE-V-enabled computer

    support.microsoft.com/kb/2901856/EN-US

    2850582

    How To Use Microsoft User Experience Virtualization With App-V Applications

    support.microsoft.com/kb/2850582/EN-US

    3041879

    Current file versions for Microsoft User Experience Virtualization

    support.microsoft.com/kb/3041879/EN-US

    2843592

    Information on User Experience Virtualization and High Availability

    support.microsoft.com/kb/2843592/EN-US

    - - - - - - - - - - - diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md deleted file mode 100644 index 4da60e1c20..0000000000 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md +++ /dev/null @@ -1,233 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes -author: dansimp -ms.assetid: 79a36c77-fa0c-4651-8028-4a79763a2fd2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes - - -To search Microsoft User Experience Virtualization (UE-V) 2.0 release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Providing feedback - - -Tell us what you think about our documentation for MDOP by giving us your feedback and comments. Send your documentation feedback to [mdopdocs@microsoft.com](mailto:mdopdocs@microsoft.com?subject=UE-V%20Documentation). - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization. - -### UE-V settings location templates for Skype cause Skype to crash - -When a user generates a valid settings location template for the Skype desktop application, registers it, and then launches the Skype desktop application, Skype crashes. An ACCESS\_VIOLATION is recorded in the Application Event Log. - -WORKAROUND: Remove or unregister the Skype template to allow Skype to work again. - -### Existing scripts for silent installations of UE-V may fail - -Two changes made to the UE-V installer can cause silent installation scripts that worked for previous versions of UE-V to fail when installing UE-V 2.1. The first is a new requirement that users must accept the license terms and agree to or decline participation in the Customer Experience Improvement Program (CEIP), even during a silent installation. Using the /q parameter is no longer sufficient to indicate acceptance of the license terms and agreement to participate in CEIP. - -Second, the installer now forces a computer restart after installing the UE-V Agent. This can cause an install script to fail if it is not expecting the restart (for example, it installs the UE-V Agent first and then immediately installs the generator). - -WORKAROUND: The UE-V installer (.msi) has two new command-line parameters that support silent installations. - - ---- - - - - - - - - - - - - - - - - -
    ParameterDescription

    /ACCEPTLICENSETERMS=True

    Set this parameter to True to install UE-V silently. Adding this parameter implies that the user accepts the UE-V license terms, which are found (by default) here: %ProgramFiles%\Microsoft User Experience Virtualization\Agent

    /NORESTART

    This parameter prevents the mandatory restart after the UE-V agent is installed. A return code of 3010 indicates that a restart is required prior to using UE-V.

    - - - -### Registry settings do not synchronize between App-V and native applications on the same computer - -When a computer has an application that is installed through both Application Virtualization (App-V) and locally with a Windows Installer (.msi) file, the registry-based settings do not synchronize between the technologies. - -WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Unpredictable results with both Office 2010 and Office 2013 installed - -When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. - -WORKAROUND: Install only one version of Office or limit which settings are synchronized by UE-V. - -### Uninstall and re-install of Windows 8 app reverts settings to initial state - -While using UE-V settings synchronization for a Windows 8 app, if the user uninstalls the app and then reinstalls the app, the app’s settings revert to their default values.  This happens because the uninstall removes the local (cached) copy of the app’s settings but does not remove the local UE-V settings package.  When the app is reinstalled and launched, UE-V gather the app settings that were reset to the app defaults and then uploads the default settings to the central storage location.  Other computers running the app then download the default settings.  This behavior is identical to the behavior of desktop applications. - -WORKAROUND: None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click here. ([http://office.microsoft.com/word-help/choose-the-32-bit-or-64-bit-version-of-microsoft-office-HA010369476.aspx](https://go.microsoft.com/fwlink/?LinkID=247623)). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -WORKAROUND: None - -### MSI’s are not localized - -UE-V 2.0 includes a localized setup program for both the UE-V Agent and UE-V generator. These MSI files are still available but the user interface is minimized and the MSI’s only display in English. Despite the file being in English, the setup program installs all supported languages during the installation. - -WORKAROUND: None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Long Settings Storage Paths could cause an error - -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: - -`[boost::filesystem::copy_file: The system cannot find the path specified]` - -To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. - -WORKAROUND: None. - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. - -WORKAROUND: None - -### UE-V 1 agent generates errors when running UE-V 2 templates - -If a UE-V 2 settings location template is distributed to a computer installed with a UE-V 1 agent, some settings fail to synchronize between computers and the agent reports errors in the event log. - -WORKAROUND: When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have computers running the previous version of the agent, create a separate UE-V 2.0 catalog to support the UE-V 2.0 Agent and templates. - -## Hotfixes and Knowledge Base articles for UE-V 2.1 - - -This section contains hotfixes and KB articles for UE-V 2.1. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    KB ArticleTitleLink

    3018608

    UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing

    support.microsoft.com/kb/3018608/EN-US

    2903501

    UE-V: User Experience Virtualization (UE-V) compatibility with user profiles

    support.microsoft.com/kb/2903501/EN-US

    2770042

    UE-V Registry Settings

    support.microsoft.com/kb/2770042/EN-US

    2847017

    UE-V settings replicated by Internet Explorer

    support.microsoft.com/kb/2847017/EN-US

    2769631

    How to repair a corrupted UE-V install

    support.microsoft.com/kb/2769631/EN-US

    2850989

    Migrating MAPI profiles with Microsoft UE-V is not supported

    support.microsoft.com/kb/2850989/EN-US

    2769586

    UE-V roams empty folders and registry keys

    support.microsoft.com/kb/2769586/EN-US

    2782997

    How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)

    support.microsoft.com/kb/2782997/EN-US

    2769570

    UE-V does not update the theme on RDS or VDI sessions

    support.microsoft.com/kb/2769570/EN-US

    2850582

    How To Use Microsoft User Experience Virtualization With App-V Applications

    support.microsoft.com/kb/2850582/EN-US

    3041879

    Current file versions for Microsoft User Experience Virtualization

    support.microsoft.com/kb/3041879/EN-US

    2843592

    Information on User Experience Virtualization and High Availability

    support.microsoft.com/kb/2843592/EN-US

    - - - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md deleted file mode 100644 index 0a0b7124ef..0000000000 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md +++ /dev/null @@ -1,244 +0,0 @@ ---- -title: Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes -description: Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes -author: dansimp -ms.assetid: 561988c4-cc5c-4e15-970b-16e942c8f2ef -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 03/30/2017 ---- - - -# Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes - - -To search Microsoft User Experience Virtualization 2.1 SP1 release notes, press Ctrl+F. - -You should read these release notes thoroughly before you install UE-V. The release notes contain information that is required to successfully install User Experience Virtualization, and contain additional information that is not available in the product documentation. If there are differences between these release notes and other UE-V documentation, the latest change should be considered authoritative. These release notes supersede the content that is included with this product. - -## Providing feedback - - -Tell us what you think about our documentation for MDOP by giving us your feedback and comments. Send your documentation feedback to [mdopdocs@microsoft.com](mailto:mdopdocs@microsoft.com?subject=UE-V%20Documentation). - -## UE-V known issues - - -This section contains release notes for User Experience Virtualization 2.1 SP1. - -### UE-V settings location templates for Skype cause Skype to crash - -When a user generates a valid settings location template for the Skype desktop application, registers it, and then launches the Skype desktop application, Skype crashes. An ACCESS\_VIOLATION is recorded in the Application Event Log. - -WORKAROUND: Remove or unregister the Skype template to allow Skype to work again. - -### Existing scripts for silent installations of UE-V may fail - -Two changes made to the UE-V installer can cause silent installation scripts that worked for previous versions of UE-V to fail when installing UE-V 2.1 SP1. The first is a new requirement that users must accept the license terms and agree to or decline participation in the Customer Experience Improvement Program (CEIP), even during a silent installation. Using the /q parameter is no longer sufficient to indicate acceptance of the license terms and agreement to participate in CEIP. - -Second, the installer now forces a computer restart after installing the UE-V Agent. This can cause an install script to fail if it is not expecting the restart (for example, it installs the UE-V Agent first and then immediately installs the generator). - -WORKAROUND: The UE-V installer (.msi) has two new command-line parameters that support silent installations. - - ---- - - - - - - - - - - - - - - - - -
    ParameterDescription

    /ACCEPTLICENSETERMS=True

    Set this parameter to True to install UE-V silently. Adding this parameter implies that the user accepts the UE-V license terms, which are found (by default) here: %ProgramFiles%\Microsoft User Experience Virtualization\Agent

    /NORESTART

    This parameter prevents the mandatory restart after the UE-V agent is installed. A return code of 3010 indicates that a restart is required prior to using UE-V.

    - - - -### Registry settings do not synchronize between App-V and native applications on the same computer - -When a computer has an application that is installed through both Application Virtualization (App-V) and locally with a Windows Installer (.msi) file, the registry-based settings do not synchronize between the technologies. - -WORKAROUND: To resolve this problem, run the application by selecting one of the two technologies, but not both. - -### Unpredictable results with both Office 2010 and Office 2013 installed - -When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. - -WORKAROUND: Install only one version of Office or limit which settings are synchronized by UE-V. - -### Uninstall and re-install of Windows 8 app reverts settings to initial state - -While using UE-V settings synchronization for a Windows 8 app, if the user uninstalls the app and then reinstalls the app, the app’s settings revert to their default values.  This happens because the uninstall removes the local (cached) copy of the app’s settings but does not remove the local UE-V settings package.  When the app is reinstalled and launched, UE-V gather the app settings that were reset to the app defaults and then uploads the default settings to the central storage location.  Other computers running the app then download the default settings.  This behavior is identical to the behavior of desktop applications. - -WORKAROUND: None. - -### UE-V does not support roaming settings between 32-bit and 64-bit versions of Microsoft Office - -We recommend that you install the 32-bit version of Microsoft Office for both 32-bit and 64-bit operating systems. To choose the Microsoft Office version that you need, click here. ([http://office.microsoft.com/word-help/choose-the-32-bit-or-64-bit-version-of-microsoft-office-HA010369476.aspx](https://go.microsoft.com/fwlink/?LinkID=247623)). UE-V supports roaming settings between identical architecture versions of Office. For example, 32-bit Office settings will roam between all 32-bit Office instances. UE-V does not support roaming settings between 32-bit and 64-bit versions of Office. - -WORKAROUND: None - -### MSI’s are not localized - -UE-V includes a localized setup program for both the UE-V Agent and UE-V generator. These MSI files are still available but the user interface is minimized and the MSI’s only display in English. Despite the file being in English, the setup program installs all supported languages during the installation. - -WORKAROUND: None - -### Favicons that are associated with Internet Explorer 9 favorites do not roam - -The favicons that are associated with Internet Explorer 9 favorites are not roamed by User Experience Virtualization and do not appear when the favorites first appear on a new computer. - -WORKAROUND: Favicons will appear with their associated favorites once the bookmark is used and cached in the Internet Explorer 9 browser. - -### File settings paths are stored in registry - -Some application settings store the paths of their configuration and settings files as values in the registry. The files that are referenced as paths in the registry must be synchronized when settings are roamed between computers. - -WORKAROUND: Use folder redirection or some other technology to ensure that any files that are referenced as file settings paths are present and placed in the same location on all computers where settings roam. - -### Long Settings Storage Paths could cause an error - -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: - -`[boost::filesystem::copy_file: The system cannot find the path specified]` - -To check the operational log events, open the Event Viewer and navigate to Applications and Services Logs / Microsoft / User Experience Virtualization / Logging / Operational. - -WORKAROUND: None. - -### Some operating system settings only roam between like operating system versions - -Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. - -WORKAROUND: None - -### UE-V 1 agent generates errors when running UE-V 2 templates - -If a UE-V 2 settings location template is distributed to a computer installed with a UE-V 1 agent, some settings fail to synchronize between computers and the agent reports errors in the event log. - -WORKAROUND: When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have computers running the previous version of the agent, create a separate UE-V 2.x catalog to support the UE-V 2.x Agent and templates. - -### UE-V logoff delay - -Occasionally on logoff, UE-V takes a long time to sync settings. Typically, this is due to a high latency network or incorrect use of Distrubuted File System (DFS). -For DFS support, see [Microsoft’s Support Statement Around Replicated User Profile Data](https://support.microsoft.com/kb/2533009) for further details. - -WORKAROUND: Starting with HF03, a new registry key has been introduced -The following registry key provides a mechanism by which the maximum logoff delay can be specified -\\Software\\Microsoft\\UEV\\Agent\\Configuration\\LogOffWaitInterval - -See [UE-V registry settings](https://support.microsoft.com/kb/2770042) for further details - -## Hotfixes and Knowledge Base articles for UE-V 2.1 SP1 - - -This section contains hotfixes and KB articles for UE-V 2.1 SP1. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    KB ArticleTitleLink

    3018608

    UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing

    support.microsoft.com/kb/3018608/EN-US

    2903501

    UE-V: User Experience Virtualization (UE-V) compatibility with user profiles

    support.microsoft.com/kb/2903501/EN-US

    2770042

    UE-V Registry Settings

    support.microsoft.com/kb/2770042/EN-US

    2847017

    UE-V settings replicated by Internet Explorer

    support.microsoft.com/kb/2847017/EN-US

    2769631

    How to repair a corrupted UE-V install

    support.microsoft.com/kb/2769631/EN-US

    2850989

    Migrating MAPI profiles with Microsoft UE-V is not supported

    support.microsoft.com/kb/2850989/EN-US

    2769586

    UE-V roams empty folders and registry keys

    support.microsoft.com/kb/2769586/EN-US

    2782997

    How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)

    support.microsoft.com/kb/2782997/EN-US

    2769570

    UE-V does not update the theme on RDS or VDI sessions

    support.microsoft.com/kb/2769570/EN-US

    2850582

    How To Use Microsoft User Experience Virtualization With App-V Applications

    support.microsoft.com/kb/2850582/EN-US

    3041879

    Current file versions for Microsoft User Experience Virtualization

    support.microsoft.com/kb/3041879/EN-US

    2843592

    Information on User Experience Virtualization and High Availability

    support.microsoft.com/kb/2843592/EN-US

    - - - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md b/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md deleted file mode 100644 index d87870c3ad..0000000000 --- a/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -title: Migrating UE-V 2.x Settings Packages -description: Migrating UE-V 2.x Settings Packages -author: dansimp -ms.assetid: f79381f4-e142-405c-b728-5c048502aa70 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Migrating UE-V 2.x Settings Packages - - -In the lifecycle of a Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, or 2.1 SP1 deployment, you might have to relocate the user settings packages either when you migrate to a new server or when you perform backups. Settings packages might have to be migrated in the following scenarios: - -- Upgrade of existing server hardware to a more modern server. - -- Migration of a settings storage location share from a test server to a production server. - -Simply copying the files and folders does not preserve the security settings and permissions. The following steps describe how to correctly copy the settings package along with their NTFS file system permissions to a new share. - -**To preserve UE-V 2 settings packages when you migrate to a new server** - -1. In a new location on a different server, create a new folder, for example, MySettings. - -2. Disable sharing for the old folder share on the old server. - -3. To copy the existing settings packages to the new server with Robocopy - - ``` syntax - C:\start robocopy "\\servername\E$\MySettings" "\\servername\E$\MySettings" /b /sec /secfix /e /LOG:D:\Robocopylogs\MySettings.txt - ``` - - **Note**   - To monitor the copy progress, open MySettings.txt with a log viewer such as Trace32. - - - -4. Grant share-level permissions to the new share. Leave the NTFS file system permissions as they were set by Robocopy. - - On computers that run the UE-V Agent, update the **SettingsStoragePath** configuration setting to the Universal Naming Convention (UNC) path of the new share. - - **Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev). - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md deleted file mode 100644 index 80cc0caffa..0000000000 --- a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md +++ /dev/null @@ -1,804 +0,0 @@ ---- -title: Prepare a UE-V 2.x Deployment -description: Prepare a UE-V 2.x Deployment -author: dansimp -ms.assetid: c429fd06-13ff-48c5-b9c9-fa1ec01ab800 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 04/19/2017 ---- - - -# Prepare a UE-V 2.x Deployment - - -There is some planning and preparation to do before you deploy Microsoft User Experience Virtualization (UE-V) 2.0 or 2.1 as a solution for synchronizing settings between devices that users access in your enterprise. This topic helps you determine what type of deployment you'll be doing and what preparation you can make beforehand so that your deployment is successful. - -First, let’s look at the tasks you’ll do to deploy UE-V: - -- Plan your UE-V Deployment - - Before you deploy anything, a good first step is to do a little bit of planning so that you can determine which UE-V features you’ll deploy. So if you leave this page, make sure you come back and read through the planning information below. - -- [Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md) - - Every UE-V deployment requires these activities: - - - [Define a settings storage location](https://technet.microsoft.com/library/dn458891.aspx#ssl) - - - [Decide how to deploy the UE-V Agent and manage UE-V configurations](https://technet.microsoft.com/library/dn458891.aspx#config) - - - [Install the UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) on every user computer that needs settings synchronized - -- Optionally, you can [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) - - Planning will help you figure out whether you want UE-V to support the synchronization of settings for custom applications (third-party or line-of-business), which requires these UE-V features: - - - [Install the UEV Generator](https://technet.microsoft.com/library/dn458942.aspx#uevgen) so you can create, edit, and validate the custom settings location templates required to synchronize custom application settings - - - [Create custom settings location templates](https://technet.microsoft.com/library/dn458942.aspx#createcustomtemplates) by using the UE-V Generator - - - [Deploy a UE-V settings template catalog](https://technet.microsoft.com/library/dn458942.aspx#deploycatalogue) that you use to store your custom settings location templates - -This workflow diagram provides a high-level understanding of a UE-V deployment and the decisions that determine how you deploy UE-V in your enterprise. - -![deploymentworkflow](images/deploymentworkflow.png) - -**Planning a UE-V deployment:** First, you want to do a little bit of planning so that you can determine which UE-V components you’ll be deploying. Planning a UE-V deployment involves these things: - -- [Decide whether to synchronize settings for custom applications](#deciding) - - This determines whether you will install the UE-V Generator during deployment, which lets you create custom settings location templates. It involves the following: - - Review the [settings that are synchronized automatically in a UE-V deployment](#autosyncsettings). - - [Determine whether you need settings synchronized for other applications](#determinesettingssync). - -- Review [other considerations for deploying UE-V](#considerations), such as high availability and capacity planning. - -- [Confirm prerequisites and supported configurations for UE-V](#prereqs) - -## Decide Whether to Synchronize Settings for Custom Applications - - -In a UE-V deployment, many settings are automatically synchronized. But you can also customize UE-V to synchronize settings for other applications, such as line-of-business and third-party apps. - -Deciding if you want UE-V to synchronize settings for custom applications is probably the most important part of planning your UE-V deployment. The topics in this section will help you make that decision. - -### Settings that are automatically synchronized in a UE-V deployment - -This section provides information about the settings that are synchronized by default in UE-V, including the following: - -Desktop applications whose settings are synchronized by default - -Windows desktop settings that are synchronized by default - -A statement of support for Windows app setting synchronization - -See [User Experience Virtualization (UE-V) settings templates for Microsoft Office](https://www.microsoft.com/download/details.aspx?id=46367) to download a complete list of the specific Microsoft Office 2013, Microsoft Office 2010, and Microsoft Office 2007 settings that are synchronized by UE-V. - -### Desktop applications synchronized by default in UE-V 2.1 and UE-V 2.1 SP1 - -When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of settings location templates that capture settings values for these common Microsoft applications. - -**Tip** -**Microsoft Office 2007 Settings Synchronization** – In UE-V 2.1 and 2.1 SP1, a settings location template is no longer included by default for Office 2007 applications. However, you can still use Office 2007 templates from UE-V 2.0 or earlier and can get the templates from the [UE-V template gallery](https://go.microsoft.com/fwlink/p/?LinkID=246589). - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Application categoryDescription

    Microsoft Office 2010 applications

    -

    (Download a list of all settings synced)

    Microsoft Word 2010

    -

    Microsoft Excel 2010

    -

    Microsoft Outlook 2010

    -

    Microsoft Access 2010

    -

    Microsoft Project 2010

    -

    Microsoft PowerPoint 2010

    -

    Microsoft Publisher 2010

    -

    Microsoft Visio 2010

    -

    Microsoft SharePoint Workspace 2010

    -

    Microsoft InfoPath 2010

    -

    Microsoft Lync 2010

    -

    Microsoft OneNote 2010

    -

    Microsoft SharePoint Designer 2010

    Microsoft Office 2013 applications

    -

    (Download a list of all settings synced)

    Microsoft Word 2013

    -

    Microsoft Excel 2013

    -

    Microsoft Outlook 2013

    -

    Microsoft Access 2013

    -

    Microsoft Project 2013

    -

    Microsoft PowerPoint 2013

    -

    Microsoft Publisher 2013

    -

    Microsoft Visio 2013

    -

    Microsoft InfoPath 2013

    -

    Microsoft Lync 2013

    -

    Microsoft OneNote 2013

    -

    Microsoft SharePoint Designer 2013

    -

    Microsoft Office 2013 Upload Center

    -

    Microsoft OneDrive for Business 2013

    -

    The UE-V 2.1 and 2.1 SP1 Microsoft Office 2013 settings location templates include improved Outlook signature support. We’ve added synchronization of default signature settings for new, reply, and forwarded emails.

    -
    -Note

    An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.

    -
    -
    - -

    Browser options: Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11

    Favorites, home page, tabs, and toolbars.

    -
    -Note

    UE-V does not roam settings for Internet Explorer cookies.

    -
    -
    - -

    Windows accessories

    Microsoft Calculator, Notepad, WordPad.

    - - - -**Note** -UE-V 2.1 SP1 does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems. - - - -### Desktop applications synchronized by default in UE-V 2.0 - -When you install the UE-V 2.0 Agent, it registers a default group of settings location templates that capture settings values for these common Microsoft applications. - -**Tip** -**Microsoft Office 2013 Settings Synchronization** – In UE-V 2.0, a settings location template is not included by default for Office 2013 applications, but is available for download from the [UE-V template gallery](https://go.microsoft.com/fwlink/p/?LinkID=246589). [Synchronizing Office 2013 with UE-V 2.0](synchronizing-office-2013-with-ue-v-20-both-uevv2.md) provides details about the supported templates that synchronize Office 2013 settings. - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
    Application categoryDescription

    Microsoft Office 2007 applications

    -

    (Download a list of all settings synced)

    Microsoft Access 2007

    -

    Microsoft Communicator 2007

    -

    Microsoft Excel 2007

    -

    Microsoft InfoPath 2007

    -

    Microsoft OneNote 2007

    -

    Microsoft Outlook 2007

    -

    Microsoft PowerPoint 2007

    -

    Microsoft Project 2007

    -

    Microsoft Publisher 2007

    -

    Microsoft SharePoint Designer 2007

    -

    Microsoft Visio 2007

    -

    Microsoft Word 2007

    Microsoft Office 2010 applications

    -

    (Download a list of all settings synced)

    Microsoft Word 2010

    -

    Microsoft Excel 2010

    -

    Microsoft Outlook 2010

    -

    Microsoft Access 2010

    -

    Microsoft Project 2010

    -

    Microsoft PowerPoint 2010

    -

    Microsoft Publisher 2010

    -

    Microsoft Visio 2010

    -

    Microsoft SharePoint Workspace 2010

    -

    Microsoft InfoPath 2010

    -

    Microsoft Lync 2010

    -

    Microsoft OneNote 2010

    -

    Microsoft SharePoint Designer 2010

    Browser options: Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10

    Favorites, home page, tabs, and toolbars.

    -
    -Note

    UE-V does not roam settings for Internet Explorer cookies.

    -
    -
    - -

    Windows accessories

    Microsoft Calculator, Notepad, WordPad.

    - - - -### Windows settings synchronized by default - -UE-V includes settings location templates that capture settings values for these Windows settings. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows settingsDescriptionApply onExport onDefault state

    Desktop background

    Currently active desktop background or wallpaper.

    Logon, unlock, remote connect, Scheduled Task events.

    Logoff, lock, remote disconnect, user clicking Sync Now in Company Settings Center, or scheduled task interval

    Enabled

    Ease of Access

    Accessibility and input settings, Microsoft Magnifier, Narrator, and on-Screen Keyboard.

    Logon only.

    Logoff, user clicking Sync Now in Company Settings Center, or scheduled task interval

    Enabled

    Desktop settings

    Start menu and Taskbar settings, Folder options, Default desktop icons, Additional clocks, and Region and Language settings.

    Logon only.

    Logoff, user clicking Sync Now in Company Settings Center, or scheduled task

    Enabled

    - - - -**Note** -Starting in Windows 8, UE-V does not roam settings related to the Start screen, such as items and locations. In addition, UE-V does not support synchronization of pinned taskbar items or Windows file shortcuts. - - - -**Important** -UE-V 2.1 SP1 roams taskbar settings between Windows 10 devices. However, UE-V does not synchronize taskbar settings between Windows 10 devices and devices running previous operating systems. - - - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Settings groupCategoryCaptureApply

    Application Settings

    Windows apps

    Close app

    -

    Windows app settings change event

    Start the UE-V App Monitor at startup

    -

    Open app

    -

    Windows App Settings change event

    -

    Arrival of a settings package

    Desktop applications

    Application closes

    Application opens and closes

    Desktop settings

    Desktop background

    Lock or logoff

    Logon, unlock, remote connect, notification of new package arrival, user clicks Sync Now in Company Settings Center, or scheduled task runs.

    Ease of Access (Common – Accessibility, Narrator, Magnifier, On-Screen-Keyboard)

    Lock or Logoff

    Logon

    Ease of Access (Shell - Audio, Accessibility, Keyboard, Mouse)

    Lock or logoff

    Logon, unlock, remote connect, notification of new package arrival, user clicks Sync Now in Company Settings Center, or scheduled task runs

    Desktop settings

    Lock or logoff

    Logon

    - - - -### UE-V-support for Windows Apps - -For Windows apps, the app developer specifies the settings that are synchronized. You can specify which Windows apps are enabled for settings synchronization. - -To display a list of Windows apps that can synchronize settings on a computer with their package family name, enabled status, and enabled source, at a Windows PowerShell command prompt, enter: `Get-UevAppxPackage` - -**Note** -As of Windows 8, UE-V does not synchronize Windows app settings if the domain user links their sign-in credentials to their Microsoft Account. This linking synchronizes settings to Microsoft OneDrive so UE-V, which disables synchronization of Windows app settings. - - - -### UE-V-support for Roaming Printers - -UE-V 2.1 SP1 lets network printers roam between devices so that a user has access to their network printers when logged on to any device on the network. This includes roaming the printer that they set as the default. - -Printer roaming in UE-V requires one of these scenarios: - -- The print server can download the required driver when it roams to a new device. - -- The driver for the roaming network printer is pre-installed on any device that needs to access that network printer. - -- The printer driver can be obtained from Windows Update. - -**Note** -The UE-V printer roaming feature does **not** roam printer settings or preferences, such as printing double-sided. - - - -### Determine whether you need settings synchronized for other applications - -After you have reviewed the settings that are synchronized automatically in a UE-V deployment, you want to decide whether you will synchronize settings for other applications since this determines how you deploy UE-V throughout your enterprise. - -As an administrator, when you consider which desktop applications to include in your UE-V solution, consider which settings can be customized by users, and how and where the application stores its settings. Not all desktop applications have settings that can be customized or that are routinely customized by users. In addition, not all desktop applications settings can safely be synchronized across multiple computers or environments. - -In general, you can synchronize settings that meet the following criteria: - -- Settings that are stored in user-accessible locations. For example, do not synchronize settings that are stored in System32 or outside the HKEY\_CURRENT\_USER (HKCU) section of the registry. - -- Settings that are not specific to the particular computer. For example, exclude network or hardware configurations. - -- Settings that can be synchronized between computers without risk of corrupted data. For example, do not use settings that are stored in a database file. - -### Checklist for evaluating custom applications - -If you’ve decided that you need settings synchronized for other applications, you can use this checklist to help figure out which applications you’ll include. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Description
    Checklist box

    Does this application contain settings that the user can customize?

    Checklist box

    Is it important for the user that these settings are synchronized?

    Checklist box

    Are these user settings already managed by an application management or settings policy solution? UE-V applies application settings at application startup and Windows settings at logon, unlock, or remote connect events. If you use UE-V with other settings sharing solutions, users might experience inconsistency across synchronized settings.

    Checklist box

    Are the application settings specific to the computer? Application preferences and customizations that are associated with hardware or specific computer configurations do not consistently synchronize across sessions and can cause a poor application experience.

    Checklist box

    Does the application store settings in the Program Files directory or in the file directory that is located in the Users[User name]<strong>AppData<strong>LocalLow directory? Application data that is stored in either of these locations usually should not synchronize with the user, because this data is specific to the computer or because the data is too large to synchronize.

    Checklist box

    Does the application store any settings in a file that contains other application data that should not synchronize? UE-V synchronizes files as a single unit. If settings are stored in files that include application data other than settings, then synchronizing this additional data can cause a poor application experience.

    Checklist box

    How large are the files that contain the settings? The performance of the settings synchronization can be affected by large files. Including large files can affect the performance of settings synchronization.

    - - - -## Other Considerations when Preparing a UE-V Deployment - - -You should also consider these things when you are preparing to deploy UE-V: - -- [Managing credentials synchronization](#creds) - -- [Windows app settings synchronization](#appxsettings) - -- [Custom UE-V settings location templates](#custom) - -- [Unintentional user settings configurations](#prevent) - -- [Performance and capacity](#capacity) - -- [High availability](#high) - -- [Computer clock synchronization](#clocksync) - -### Managing credentials synchronization in UE-V 2.1 and UE-V 2.1 SP1 - -Many enterprise applications, including Microsoft Outlook and Lync, prompt users for their domain credentials at login. Users have the option of saving their credentials to disk to prevent having to enter them every time they open these applications. Enabling roaming credentials synchronization lets users save their credentials on one computer and avoid re-entering them on every computer they use in their environment. Users can synchronize some domain credentials with UE-V 2.1 and 2.1 SP1. - -**Important** -Credentials synchronization is disabled by default. You must explicitly enable credentials synchronization during deployment to implement this feature. - - - -UE-V 2.1 and 2.1 SP1 can synchronize enterprise credentials, but do not roam credentials intended only for use on the local computer. - -Credentials are synchronous settings, meaning they are applied to your profile the first time you log in to your computer after UE-V synchronizes. - -Credentials synchronization is managed by its own settings location template, which is disabled by default. You can enable or disable this template through the same methods used for other templates. The template identifier for this feature is RoamingCredentialSettings. - -**Important** -If you are using Active Directory Credential Roaming in your environment, we recommend that you don’t enable the UE-V credential roaming template. - - - -Use one of these methods to enable credentials synchronization: - -- Company Settings Center - -- PowerShell - -- Group Policy - -**Note** -Credentials are encrypted during synchronization. - - - -[Company Settings Center](https://technet.microsoft.com/library/dn458903.aspx)**:** Check the Roaming Credential Settings check box under Windows Settings to enable credential synchronization. Uncheck the box to disable it. This check box only appears in Company Settings Center if your account is not configured to synchronize settings using a Microsoft Account. - -[PowerShell](https://technet.microsoft.com/library/dn458937.aspx)**:** This PowerShell cmdlet enables credential synchronization: - -``` syntax -Enable-UevTemplate RoamingCredentialSettings -``` - -This PowerShell cmdlet disables credential synchronization: - -``` syntax -Disable-UevTemplate RoamingCredentialSettings -``` - -[Group Policy](https://technet.microsoft.com/library/dn458893.aspx)**:** You must [deploy the latest MDOP ADMX template](https://go.microsoft.com/fwlink/p/?LinkId=393944) to enable credential synchronization through group policy. Credentials synchronization is managed with the Windows settings. To manage this feature with Group Policy, enable the Synchronize Windows settings policy. - -1. Open Group Policy Editor and navigate to **User Configuration – Administrative Templates – Windows Components – Microsoft User Experience Virtualization**. - -2. Double-click on **Synchronize Windows settings**. - -3. If this policy is enabled, you can enable credentials synchronization by checking the **Roaming Credentials** check box, or disable credentials synchronization by unchecking it. - -4. Click **OK**. - -### Credential locations synchronized by UE-V - -Credential files saved by applications into the following locations are synchronized: - -- %UserProfile%\\AppData\\Roaming\\Microsoft\\Credentials\\ - -- %UserProfile%\\AppData\\Roaming\\Microsoft\\Crypto\\ - -- %UserProfile%\\AppData\\Roaming\\Microsoft\\Protect\\ - -- %UserProfile%\\AppData\\Roaming\\Microsoft\\SystemCertificates\\ - -Credentials saved to other locations are not synchronized by UE-V. - -### Windows app settings synchronization - -UE-V manages Windows app settings synchronization in three ways: - -- **Sync Windows Apps:** Allow or deny any Windows app synchronization - -- **Windows App List:** Synchronize a list of Windows apps - -- **Unlisted Default Sync Behavior:** Determine the synchronization behavior of Windows apps that are not in the Windows app list. - -For more information, see the [Windows App List](https://technet.microsoft.com/library/dn458925.aspx#win8applist). - -### Custom UE-V settings location templates - -If you are deploying UE-V to synchronize settings for custom applications, you will use the UE-V Generator to create custom settings location templates for those desktop applications. After you create and test a custom settings location template in a test environment, you can deploy the settings location templates to computers in the enterprise. - -Custom settings location templates must be deployed with an existing deployment infrastructure, like an enterprise software distribution (ESD) method such as System Center Configuration Manager, with preferences, or by configuring an UE-V settings template catalog. Templates that are deployed with Configuration Manager or Group Policy must be registered by using UE-V WMI or Windows PowerShell. - -For more information about custom settings location templates, see [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md). For more information about using UE-V with Configuration Manager, see [Configuring UE-V 2.x with System Center Configuration Manager 2012](configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md). - -### Prevent unintentional user settings configuration - -UE-V downloads new user settings information from a settings storage location and applies the settings to the local computer in these instances: - -- Every time an application is started that has a registered UE-V template. - -- When a user logs on to a computer. - -- When a user unlocks a computer. - -- When a connection is made to a remote desktop computer that has UE-V installed. - -- When the Sync Controller Application scheduled task is run. - -If UE-V is installed on computer A and computer B, and the settings that you want for the application are on computer A, then computer A should open and close the application first. If the application is opened and closed on computer B first, then the application settings on computer A are configured to the application settings on computer B. Settings are synchronized between computers on per-application basis. Over time, settings become consistent between computers as they are opened and closed with preferred settings. - -This scenario also applies to Windows settings. If the Windows settings on computer B should be the same as the Windows settings on computer A, then the user should log on and log off computer A first. - -If the user settings that the user wants are applied in the wrong order, they can be recovered by performing a restore operation for the specific application or Windows configuration on the computer on which the settings were overwritten. For more information, see [Manage Administrative Backup and Restore in UE-V 2.x](manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md). - -### Performance and capacity planning - -Specify your requirements for UE-V with standard disk capacity and network health monitoring. - -UE-V uses a Server Message Block (SMB) share for the storage of settings packages. The size of settings packages varies depending on the settings information for each application. While most settings packages are small, the synchronization of potentially large files, such as desktop images, can result in poor performance, particularly on slower networks. - -To reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location. - -By default, UE-V synchronization times out after 2 seconds to prevent excessive lag due to a large settings package. You can configure the SyncMethod=SyncProvider setting by using [Group Policy Objects](https://technet.microsoft.com/library/dn458893.aspx). - -### High Availability for UE-V - -The UE-V settings storage location and settings template catalog support storing user data on any writable share. To ensure high availability, follow these criteria: - -- Format the storage volume with an NTFS file system. - -- The share can use Distributed File System (DFS) but there are restrictions. -Specifically, Distributed File System Replication (DFS-R) single target configuration with or without a Distributed File System Namespace (DFS-N) is supported. -Likewise, only single target configuration is supported with DFS-N. -For detailed information, see [Microsoft’s Support Statement Around Replicated User Profile Data](https://go.microsoft.com/fwlink/p/?LinkId=313991) -and also [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](https://support.microsoft.com/kb/2533009). - - In addition, because SYSVOL uses DFS-R for replication, SYSVOL cannot be used for UE-V data file replication. - -- Configure the share permissions and NTFS access control lists (ACLs) as specified in [Deploying the Settings Storage Location for UE-V 2.x](https://technet.microsoft.com/library/dn458891.aspx#ssl). - -- Use file server clustering along with the UE-V Agent to provide access to copies of user state data in the event of communications failures. - -- You can store the settings storage path data (user data) and settings template catalog templates on clustered shares, on DFS-N shares, or on both. - -### Synchronize computer clocks for UE-V settings synchronization - -Computers that run the UE-V Agent must use a time server to maintain a consistent settings experience. UE-V uses time stamps to determine if settings must be synchronized from the settings storage location. If the computer clock is inaccurate, older settings can overwrite newer settings, or the new settings might not be saved to the settings storage location. - -## Confirm Prerequisites and Supported Configurations for UE-V - - -Before you proceed, make sure your environment includes these requirements for running UE-V. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Operating systemEditionService packSystem architectureWindows PowerShellMicrosoft .NET Framework

    Windows 7

    Ultimate, Enterprise, or Professional Edition

    SP1

    32-bit or 64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.5 or higher for UE-V 2.1.

    -

    .NET Framework 4 or higher for UE-V 2.0.

    Windows Server 2008 R2

    Standard, Enterprise, Datacenter, or Web Server

    SP1

    64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.5 or higher for UE-V 2.1.

    -

    .NET Framework 4 or higher for UE-V 2.0.

    Windows 8 and Windows 8.1

    Enterprise or Pro

    None

    32-bit or 64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.5 or higher

    Windows 10, pre-1607 version

    -
    -Note

    Only UE-V 2.1 SP1 supports Windows 10, pre-1607 version

    -
    -
    - -

    Enterprise or Pro

    None

    32-bit or 64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.6

    Windows Server 2012 and Windows Server 2012 R2

    Standard or Datacenter

    None

    64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.5 or higher

    Windows Server 2016

    Standard or Datacenter

    None

    64-bit

    Windows PowerShell 3.0 or higher

    .NET Framework 4.6 or higher

    - - - -Also… - -- **MDOP License:** This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Enterprise customers can get MDOP with Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see How Do I Get MDOP (https://go.microsoft.com/fwlink/p/?LinkId=322049). - -- **Administrative Credentials** for any computer on which you’ll be installing - -**Note** - -- Starting with WIndows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack. - -- The UE-V Windows PowerShell feature of the UE-V Agent requires .NET Framework 4 or higher and Windows PowerShell 3.0 or higher to be enabled. Download Windows PowerShell 3.0 [here](https://go.microsoft.com/fwlink/?LinkId=309609). - -- Install .NET Framework 4 or .NET Framework 4.5 on computers that run the Windows 7 or the Windows Server 2008 R2 operating system. The Windows 8, Windows 8.1, and Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed. -- The “Delete Roaming Cache” policy for Mandatory profiles is not supported with UE-V and should not be used. - - - -There are no special random access memory (RAM) requirements specific to UE-V. - -### Synchronization of Settings through the Sync Provider - -Sync Provider is the default setting for users, which synchronizes a local cache with the settings storage location in these instances: - -- Logon/logoff - -- Lock/unlock - -- Remote desktop connect/disconnect - -- Application open/close - -A scheduled task manages this synchronization of settings every 30 minutes or through certain trigger events for certain applications. For more information, see [Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md). - -The UE-V Agent synchronizes user settings for computers that are not always connected to the enterprise network (remote computers and laptops) and computers that are always connected to the network (computers that run Windows Server and host virtual desktop interface (VDI) sessions). - -**Synchronization for computers with always-available connections:** When you use UE-V on computers that are always connected to the network, you must configure the UE-V Agent to synchronize settings by using the *SyncMethod=None* parameter, which treats the settings storage server as a standard network share. In this configuration, the UE-V Agent can be configured to notify if the import of the application settings is delayed. - -Enable this configuration through one of these methods: - -- During UE-V installation, at the command prompt or in a batch file, set the AgentSetup.exe parameter *SyncMethod = None*. [Deploying the UE-V 2.x Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) provides more information. - -- After the UE-V installation, use the Settings Management feature in System Center 2012 Configuration Manager or the MDOP ADMX templates to push the *SyncMethod = None* configuration. - -- Use Windows PowerShell or Windows Management Instrumentation (WMI) to set the *SyncMethod = None* configuration. - - **Note** - These last two methods do not work for pooled virtual desktop infrastructure (VDI) environments. - - - -You must restart the computer before the settings start to synchronize. - -**Note** -If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on logoff, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path. - - - -**Synchronization for external sync engines:** The *SyncMethod=External* parameter specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access. - -**Support for shared VDI sessions:** UE-V 2.1 and 2.1 SP1 provide support for VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions. - -**Note** -If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](https://technet.microsoft.com/library/dn878331.aspx). - - - -The VDI template is provided with UE-V 2.1 and 2.1 SP1 and is typically available here after installation: C:\\Program Files\\Microsoft User Experience Virtualization\\Templates\\VdiState.xml - -### Prerequisites for UE-V Generator support - -Install the UE-V Generator on the computer that is used to create custom settings location templates. This computer should be able to run the applications whose settings are synchronized. You must be a member of the Administrators group on the computer that runs the UE-V Generator software. - -The UE-V Generator must be installed on a computer that uses an NTFS file system. The UE-V Generator software requires .NET Framework 4. For more information, see [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md). - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - - - - - - diff --git a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index f9c72070dc..0000000000 --- a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,143 +0,0 @@ ---- -title: Security Considerations for UE-V 2.x -description: Security Considerations for UE-V 2.x -author: dansimp -ms.assetid: 9d5c3cae-9fcb-4dea-bd67-741b3dea63be -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Security Considerations for UE-V 2.x - - -This topic contains a brief overview of accounts and groups, log files, and other security-related considerations for Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1. For more information, follow the links that are provided here. - -## Security considerations for UE-V configuration - - -**Important**   -When you create the settings storage share, limit the share access to users who require access. - - - -Because settings packages might contain personal information, you should take care to protect them as well as possible. In general, do the following: - -- Restrict the share to only those users who require access. Create a security group for users who have redirected folders on a particular share and limit access to only those users. - -- When you create the share, hide the share by putting a $ after the share name. This addition hides the share from casual browsers, and the share is not visible in My Network Places. - -- Only give users the minimum amount of permissions that they must have. The following tables show the required permissions. - - 1. Set the following share-level SMB permissions for the setting storage location folder. - - | User account | Recommended permissions | - | - | - | - | Everyone | No permissions | - |Security group of UE-V | Full control | - - 2. Set the following NTFS file system permissions for the settings storage location folder. - - | User account | Recommended permissions | Folder | - | - | - | - | - | Creator/Owner | Full control | Subfolders and files only| - | Domain Admins | Full control | This folder, subfolders, and files | - | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | - | Everyone | Remove all permissions | No permissions | - - 3. Set the following share-level SMB permissions for the settings template catalog folder. - - | User account | Recommend permissions | - | - | - | - | Everyone | No permissions | - | Domain computers | Read permission Levels | - | Administrators | Read/write permission levels | - - 4. Set the following NTFS permissions for the settings template catalog folder. - - | User account | Recommended permissions | Apply to | - | - | - | - | - | Creator/Owner | Full control | This folder, subfolders, and files | - | Domain Computers | List folder contents and Read permissions | This folder, subfolders, and files| - | Everyone| No permissions| No permissions| - | Administrators| Full Control| This folder, subfolders, and files| - -### Use Windows Server as of Windows Server 2003 to host redirected file shares - -User settings package files contain personal information that is transferred between the client computer and the server that stores the settings packages. Because of this process, you should ensure that the data is protected while it travels over the network. - -User settings data is vulnerable to these potential threats: interception of the data as it passes over the network, tampering with the data as it passes over the network, and spoofing of the server that hosts the data. - -As of Windows Server 2003, several features of the Windows Server operating system can help secure user data: - -- **Kerberos** - Kerberos is standard on all versions of Microsoft Windows 2000 Server and Windows Server beginning with Windows Server 2003. Kerberos ensures the highest level of security to network resources. NTLM authenticates the client only; Kerberos authenticates the server and the client. When NTLM is used, the client does not know whether the server is valid. This difference is particularly important if the client exchanges personal files with the server, as is the case with Roaming User Profiles. Kerberos provides better security than NTLM. Kerberos is not available on the Microsoft Windows NT Server 4.0 or earlier operating systems. - -- **IPsec** - The IP Security Protocol (IPsec) provides network-level authentication, data integrity, and encryption. IPsec ensures the following: - - - Roamed data is safe from data modification while data is en route. - - - Roamed data is safe from interception, viewing, or copying. - - - Roamed data is safe from access by unauthenticated parties. - -- **SMB Signing** - The Server Message Block (SMB) authentication protocol supports message authentication, which prevents active message and "man-in-the-middle" attacks. SMB signing provides this authentication by placing a digital signature into each SMB. The digital signature is then verified by both the client and the server. In order to use SMB signing, you must first either enable it, or you must require it on both the SMB client and the SMB server. Note that the SMB signing imposes a performance penalty. It does not consume any more network bandwidth, but it uses more CPU cycles on the client and server side. - -### Always use the NTFS file system for volumes that hold user data - -For the most secure configuration, configure servers that host the UE-V settings files to use the NTFS file system. Unlike the FAT file system, NTFS supports Discretionary access control lists (DACLs) and system access control lists (SACLs). DACLs and SACLs control who can perform operations on a file and what events trigger the logging of actions that is performed on a file. - -### Do not rely on EFS to encrypt user files when they are transmitted over the network - -When you use the Encrypting File System (EFS) to encrypt files on a remote server, the encrypted data is not encrypted during transit over the network; it only becomes encrypted when it is stored on disk. - -This encryption process does not apply when your system includes Internet Protocol security (IPsec) or Web Distributed Authoring and Versioning (WebDAV). IPsec encrypts data while it is transported over a TCP/IP network. If the file is encrypted before it is copied or moved to a WebDAV folder on a server, it remains encrypted during the transmission and while it is stored on the server. - -### Let the UE-V Agent create folders for each user - -To ensure that UE-V works optimally, create only the root share on the server, and let the UE-V Agent create the folders for each user. UE-V creates these user folders with the appropriate security. - -This permission configuration enables users to create folders for settings storage. The UE-V Agent creates and secures a settings package folder while it runs in the context of the user. Users receive full control to their settings package folder. Other users do not inherit access to this folder. You do not have to create and secure individual user directories. The agent that runs in the context of the user does it automatically. - -**Note**   -Additional security can be configured when a Windows Server is used for the settings storage share. UE-V can be configured to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable additional security, use the following command: - -1. Add the REG\_DWORD registry key RepositoryOwnerCheckEnabled to `HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration`. - -2. Set the registry key value to *1*. - -When this configuration setting is in place, the UE-V Agent verifies that the local Administrators group or current user is the owner of the settings package folder. If not, then the UE-V Agent does not grant access to the folder. - - - -If you must create folders for the users, ensure that you have the correct permissions set. - -We strongly recommend that you do not pre-create folders. Instead, let the UE-V Agent create the folder for the user. - -### Ensure correct permissions to store UE-V 2 settings in a home directory or custom directory - -If you redirect UE-V settings to a user’s home directory or a custom Active Directory (AD) directory, ensure that the permissions on the directory are set appropriately for your organization. - - - - - - -## Related topics - - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index b18eef56fe..0000000000 --- a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Sync Methods for UE-V 2.x -description: Sync Methods for UE-V 2.x -author: dansimp -ms.assetid: af0ae894-dfdc-41d2-927b-c2ab1b355ffe -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sync Methods for UE-V 2.x - - -The Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 Agent lets you synchronize users’ application and Windows settings with the settings storage location. The *Sync Method* configuration defines how the UE-V Agent uploads and downloads those settings to the settings storage location. UE-V 2.x introduces a new SyncMethod called the *SyncProvider*. For more information about trigger events that start the synchronization of application and Windows settings, see [Sync Trigger Events for UE-V 2.x](sync-trigger-events-for-ue-v-2x-both-uevv2.md). - -## SyncMethod Configuration - - -This table explains the changes to SyncMethod from UE-V v1.0 to v2.0 to v2.1, as well as the settings for each configuration: - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    SyncMethod Configuration

    V1.0

    V2.0

    V2.1 and V2.1 SP1

    Description

    SyncProvider

    n/a

    Default

    Default

    Settings changes for a specific application or for global Windows desktop settings are saved locally to a cache folder. These changes are then synchronized with the settings storage location when a synchronization trigger event takes place. Pushing out changes will save the local changes to the settings storage path.

    -

    This default setting is the gold standard for computers. This option attempts to synchronize the setting and times out after a short delay to ensure that the application or operating system startup isn’t delayed for a long period of time.

    -

    This functionality is also tied to the Scheduled task – Sync Controller Application. The administrator controls the frequency of the Scheduled task. By default, computers synchronize their settings every 30 min after logging on.

    OfflineFiles

    Default

    Deprecated

    Deprecated

    Behaves the same as SyncProvider in V2.0.

    -

    If Offline files are enabled and the folder is pinned then UE-V will unpin this folder and sync directly to the central SMB directory.

    -

    NOTE: In V1.0 if you wanted to use UE-V in a CorpNet disconnected manner (aka traveling with a Laptop), then the guidance is to use Offline Files to ensure that your settings roamed.  We received sufficient customer feedback that turning on Offline files is a non-trivial enterprise blocker. So in UE-V 2, we created a tightly coupled synchronization engine to cache your data locally and synchronize the settings to the central server. This feature area does not replace Offline Files or Folder Redirection.

    -

    UE-V 2 does not work well with Offline folders so the guidance is not to set the settings storage path to a pinned Offline or CSC folder.

    External

    n/a

    n/a

    Supported

    New in UE-V 2.1, this configuration method specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access.

    None

    Yes

    Yes

    Yes

    This configuration setting is designed for the Virtual Desktop Infrastructure (VDI) and Streamed Application experience primarily. This setting should be used on Windows Server boxes used in a datacenter, where the connection will always be available.

    -

    Any settings changes are saved directly to the server. If the network connection to the settings storage path is not available, then the settings changes are cached on the device and are synchronized the next time that the Sync Provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on logoff, then these settings changes are lost, and the user must reapply the change when the computer can again reach the settings storage path.

    -

    Apps and OS will wait indefinitely for the location to be present. This could cause App load or OS logon time to dramatically increase if the location is not found.

    - -  - -You can configure the sync method in these ways: - -- When you [Deploy the UE-V Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) through a command-line parameter or in a batch script - -- Through [Group Policy](https://technet.microsoft.com/library/dn458893.aspx) settings - -- With the [System Center Configuration Pack](https://technet.microsoft.com/library/dn458917.aspx) for UE-V - -- After installation of the UE-V Agent, by using [Windows PowerShell or Windows Management Instrumentation (WMI)](https://technet.microsoft.com/library/dn458937.aspx) - - - - - - -## Related topics - - -[Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md#ssl) - -[Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md#config) - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - -  - -  - - - - - diff --git a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index acfdf37a3e..0000000000 --- a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Sync Trigger Events for UE-V 2.x -description: Sync Trigger Events for UE-V 2.x -author: dansimp -ms.assetid: 4ed71a13-6a4f-4376-996f-74b126536bbc -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Sync Trigger Events for UE-V 2.x - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 lets you synchronize your application and Windows settings across all your domain-joined devices. *Sync trigger events* define when the UE-V Agent synchronizes those settings with the settings storage location. UE-V 2 introduces a new *Sync Method* called the *SyncProvider*. For more information about Sync Method configuration, see [Sync Methods for UE-V 2.x](sync-methods-for-ue-v-2x-both-uevv2.md). - -## UE-V 2 Sync Trigger Events - - -The following table explains the trigger events for classic applications and Windows settings. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    UE-V 2 Trigger Event

    SyncMethod=SyncProvider

    SyncMethod=None

    Windows Logon

      -
    • Application and Windows settings are imported to the local cache from the settings storage location.

    • -
    • Asynchronous Windows settings are applied.

    • -
    • Synchronous Windows settings will be applied during the next Windows logon.

    • -
    • Application settings will be applied when the application starts.

    • -
      -
    • Application and Windows settings are read directly from the settings storage location.

    • -
    • Asynchronous and synchronous Windows settings are applied.

    • -
    • Application settings will be applied when the application starts.

    • -

    Windows Logoff

    Store changes locally and cache and copy asynchronous and synchronous Windows settings to the settings storage location server, if available

    Store changes to asynchronous and synchronous Windows settings storage location

    Windows Connect (RDP) / Unlock

    Synchronize any asynchronous Windows settings from settings storage location to local cache, if available.

    -

    Apply cached Windows settings

    Download and apply asynchronous windows settings from settings storage location

    Windows Disconnect (RDP) / Lock

    Store asynchronous Windows settings changes to the local cache.

    -

    Synchronize any asynchronous Windows settings from the local cache to settings storage location, if available

    Store asynchronous Windows settings changes to the settings storage location

    Application start

    Apply application settings from local cache as the application starts

    Apply application settings from settings storage location as the application starts

    Application closes

    Store any application settings changes to the local cache and copy settings to settings storage location, if available

    Store any application settings changes to settings storage location

    Sync Controller Scheduled Task or “Sync Now” is run from the Company Settings Center

    -

    Application and Windows settings are synchronized between the settings storage location and the local cache.

    -
    -Note

    Settings changes are not cached locally until an application closes. This trigger will not export changes made to a currently running application.

    -

    For Windows settings, this means that any changes will not be cached locally and exported until the next Lock (Asynchronous) or Logoff (Asynchronous and Synchronous).

    -
    -
    - -
    -

    Settings are applied in these cases:

    -
      -
    • Asynchronous Windows settings are applied directly.

    • -
    • Application settings are applied when the application starts.

    • -
    • Both asynchronous and synchronous Windows settings are applied during the next Windows logon.

    • -
    • Windows app (AppX) settings are applied during the next refresh. See Monitor Application Settings for more information.

    • -

    NA

    Asynchronous Settings updated on remote store*

    Load and apply new asynchronous settings from the cache.

    Load and apply settings from central server

    - - - - - - - - -## Related topics - - -[Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - -[Changing the Frequency of UE-V 2.x Scheduled Tasks](changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md) - -[Choose the Configuration Method for UE-V 2.x](https://technet.microsoft.com/library/dn458891.aspx#config) - - - - - - - - - diff --git a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md b/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md deleted file mode 100644 index 880b23d11f..0000000000 --- a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Synchronizing Office 2013 with UE-V 2.0 -description: Synchronizing Office 2013 with UE-V 2.0 -author: dansimp -ms.assetid: c46feb6d-28a8-4799-888d-053531dc5842 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Synchronizing Office 2013 with UE-V 2.0 - - -Microsoft User Experience Virtualization (UE-V) 2.0 supports the synchronization of Microsoft Office 2013 application setting using a template available from the UE-V template gallery. The combination of UE-V 2 and App-V 5.0 SP2 support of Office 2013 Professional Plus enables the same experience on virtualized instance of Office 2013 from any UE-V-enabled device or virtualized desktop. - -To activate UE-V application settings support of Office 2013, you can download official UE-V Office 2013 templates from the [Microsoft User Experience Virtualization (UE-V) 2 Template Gallery](https://go.microsoft.com/fwlink/p/?LinkId=246589). This resource provides Microsoft-authored UE-V settings location templates as well as community-developed settings location templates. - -## Microsoft Office support in UE-V - - -UE-V 1.0 and UE-V 2 include settings location templates for Microsoft Office 2010. These templates are distributed and registered as part of the UE-V Agent installation process. These templates help synchronize users’ Office experience between devices. The UE-V templates for Office 2013 provide a very similar settings experience to the templates for Office 2010. Microsoft Office 2013 settings roamed by Office 365 experience are not included in these settings. For a list of Office 365-specific settings, see [Overview of user and roaming settings for Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=391220). - -## Synchronized Office 2013 Settings - - -The following tables contain the details for Office 2013 support in UE-V: - -### Supported UE-V templates for Microsoft Office - - ---- - - - - - - - - - - - - -
    Office 2013 templates (UE-V 2.0, available on UE-V gallery):Office 2010 templates (UE-V 1.0 & 1.0 SP1):

    MicrosoftOffice2013Win32.xml

    -

    MicrosoftOffice2013Win64.xml

    -

    MicrosoftLync2013Win32.xml

    -

    MicrosoftLync2013Win64.xml

    MicrosoftOffice2010Win32.xml

    -

    MicrosoftOffice2010Win64.xml

    -

    MicrosoftLync2010.xml

    -

    - -  - -### Microsoft Office Applications supported by the UE-V templates - - ---- - - - - - - -

    Microsoft Access 2013

    -

    Microsoft Lync 2013

    -

    Microsoft Excel 2013

    -

    Microsoft InfoPath 2013

    -

    Microsoft OneNote 2013

    -

    Microsoft Outlook 2013

    -

    Microsoft PowerPoint 2013

    -

    Microsoft Project 2013

    -

    Microsoft Publisher 2013

    -

    Microsoft SharePoint Designer 2013

    -

    Microsoft Visio 2013

    -

    Microsoft Word 2013

    -

    Microsoft Office Upload Manager

    Microsoft Access 2010

    -

    Microsoft Lync 2010

    -

    Microsoft Excel 2010

    -

    Microsoft InfoPath 2010

    -

    Microsoft OneNote 2010

    -

    Microsoft Outlook 2010

    -

    Microsoft PowerPoint 2010

    -

    Microsoft Project 2010

    -

    Microsoft Publisher 2010

    -

    Microsoft SharePoint Designer 2010

    -

    Microsoft Visio 2010

    -

    Microsoft Word 2010

    -

    - -  - -## Deploying the Office 2013 templates - - -You can deploy UE-V settings location template with the following methods: - -- **Registering template via PowerShell**. If you use Windows PowerShell to manage computers, run the following Windows PowerShell command open as an administrator to register this settings location template: - - ``` syntax - Register-UevTemplate -Path - ``` - - For more information using UE-V and Windows PowerShell, see [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md). - -- **Registering template via Template Catalog Path**. If you use the Settings Template Catalog Path to manage templates on users’ computers, copy the Office 2013 template into the folder defined in the UE-V Agent. The next time the Template Auto Update (ApplySettingsCatalog.exe) scheduled task runs, the settings location template will be registered on the device. For more information, see [Deploying the Settings Template Catalog for UE-V 2](https://technet.microsoft.com/library/dn458942.aspx#deploycatalogue). - -- **Registering template via Configuration Manager**. If you use Configuration Manager to manage your UE-V settings storage templates, then recreate the Template Baseline CAB, import it into Configuration Manager, and then deploy the baseline to your clients. For more information, see the guidance provided in the documentation for the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2](https://go.microsoft.com/fwlink/?LinkId=317263). - - - - - - -  - -  - - - - - diff --git a/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md deleted file mode 100644 index 44d264f0d9..0000000000 --- a/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Technical Reference for UE-V 2.x -description: Technical Reference for UE-V 2.x -author: dansimp -ms.assetid: 303cff9a-a96d-4e83-9e94-19b0d3744e1e -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Technical Reference for UE-V 2.x - - -This technical reference section includes additional technical documentation about the various features of Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1. This information is provided to help the administrator better understand UE-V. - -## Technical reference topics for UE-V 2.x - - -- [Sync Methods for UE-V 2.x](sync-methods-for-ue-v-2x-both-uevv2.md) - - Defines how UE-V synchronizes settings between computers and the settings storage location. Sync Provider is the default sync method for UE-V 2.0. This topic provides technical reference information for sync methods, including the Sync Provider. - -- [Sync Trigger Events for UE-V 2.x](sync-trigger-events-for-ue-v-2x-both-uevv2.md) - - Defines when the UE-V Agent synchronizes those settings with the settings storage location. This topic provides technical reference information about when synchronization takes place based upon the sync method deployed. - -- [Synchronizing Office 2013 with UE-V 2.0](synchronizing-office-2013-with-ue-v-20-both-uevv2.md) - - Provides guidance for downloading and enabling the Microsoft-authored UE-V 2.0 settings location template that supports Office 2013 settings synchronization. - -- [Application Template Schema Reference for UE-V 2.x](application-template-schema-reference-for-ue-v-2x-both-uevv2.md) - - Details the XML structure of UE-V settings location templates and provides guidance for editing these files. - -- [Accessibility for UE-V 2.x](accessibility-for-ue-v-2x-both-uevv2.md) - - Describes features and services that make UE-V more accessible for people with disabilities. - -- [Security Considerations for UE-V 2.x](security-considerations-for-ue-v-2x-both-uevv2.md) - - Provides a brief overview of accounts, groups, and other security-related considerations for UE-V. - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Troubleshooting UE-V 2.x](troubleshooting-ue-v-2x-both-uevv2.md) - - - - - - -  - -  - - - - - diff --git a/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md b/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md deleted file mode 100644 index a431995b0b..0000000000 --- a/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Troubleshooting UE-V 2.x -description: Troubleshooting UE-V 2.x -author: dansimp -ms.assetid: a02847f8-6986-4612-8307-ba1b72d7919b -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Troubleshooting UE-V 2.x - - -Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). - -## Find troubleshooting information - - -You can use the following information to find troubleshooting content or additional technical content for this product. - -### Search the MDOP documentation - -The first step to find help content in the Administrator’s Guide is to search the MDOP documentation on TechNet. After you search the MDOP documentation, you can search the troubleshooting information for the product in the TechNet Wiki. These search methods are described in the following sections. - -**To search the MDOP product documentation** - -1. Open a web browser and browse to the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) home page on TechNet. - -2. Locate the **Search TechNet with Bing** search box and enter your search term. - -3. Review the search results for assistance. - -**To search the TechNet Wiki** - -1. Open a web browser and browse to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Locate the **Search TechNet Wiki** search box and enter your search term. - -3. Review the search results for assistance. - -## Create a troubleshooting article - - -If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP Online Help or TechNet Wiki, you can create your own TechNet Wiki article. - -**To create a TechNet Wiki troubleshooting or best practices article** - -1. Open a web browser and browse to the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905) home page. - -2. Sign in with your Microsoft account. - -3. Review the **Getting Started** section to learn the basics of the TechNet Wiki and its articles. - -4. Select **Post an article** in the **Getting Started** section. - -5. On the Wiki article **Add Page** page, select **Insert Template** from the toolbar, select the troubleshooting article template, which is named **Troubleshooting.html**, and then click **Insert**. - -6. Give the article a descriptive title, and then overwrite the template information as needed to create your article. - -7. After you review your article, add a tag that is named **Troubleshooting** and another tag for the product name. To add tags help other users find your content. - -8. Click **Save** to publish the article to the TechNet Wiki. - -## Other resources for this product - - -- [Microsoft User Experience Virtualization (UE-V) 2.x](index.md) - -- [Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -- [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -- [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -- [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md) - - - - - - -  - -  - - - - - diff --git a/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md b/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md deleted file mode 100644 index 9e9871e1c9..0000000000 --- a/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Using UE-V 2.x with Application Virtualization Applications -description: Using UE-V 2.x with Application Virtualization Applications -author: dansimp -ms.assetid: 4644b810-fc48-4fd0-96e4-2fc6cd64d8ad -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# Using UE-V 2.x with Application Virtualization Applications - - -Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 support Microsoft Application Virtualization (App-V) applications without any required modifications to either the App-V package or the UE-V template. However, an additional step is required because you cannot run the UE-V Generator directly on a virtualized App-V application. Instead, you must install the application locally, generate the template, and then apply the template to the virtualized application. UE-V supports App-V 4.5, App-V 4.6, and App-V 5.0 packages. - -## UE-V settings synchronization for App-V applications - - -UE-V monitors when an application opens by the program name and, optionally, by file version numbers and product version numbers, whether the application is installed locally or virtually by using App-V. When the application starts, UE-V monitors the App-V process, applies any settings that are stored in the user's settings storage path, and then enables the application to start normally. UE-V monitors App-V applications and automatically translates the relevant file and registry paths to the virtualized location as opposed to the physical location outside the App-V computing environment. - - **To implement settings synchronization for a virtualized application** - -1. Run the UE-V Generator to collect the settings of the locally installed application whose settings you want to synchronize between computers. This process creates a settings location template. If you use a built-in template such as the Microsoft Office 2010 template, skip this step. For more information about running the UE-V Generator, see [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md#createcustomtemplates). - -2. Install the App-V application package if you have not already done so. - -3. Publish the template to the location of your settings template catalog or manually install the template by using the `Register-UEVTemplate` Windows PowerShell cmdlet. - - **Note**   - If you publish the newly created template to the settings template catalog, the client does not receive the template until the sync provider updates the settings. To manually start this process, open **Task Scheduler**, expand **Task Scheduler Library**, expand **Microsoft**, and expand **UE-V**. In the results pane, right-click **Template Auto Update**, and then click **Run**. - - - -4. Start the App-V package. - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md deleted file mode 100644 index 873c05ac3b..0000000000 --- a/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: What's New in UE-V 2.0 -description: What's New in UE-V 2.0 -author: dansimp -ms.assetid: 5d852beb-f293-4e3a-a33b-c40df59a7515 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 06/16/2016 ---- - - -# What's New in UE-V 2.0 - - -Microsoft User Experience Virtualization (UE-V) 2.0 provides these new features and functionality compared to UE-V 1.0. The [Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md) provide more information about the UE-V 2.0 release. - -## Client-side cache (CSC) no longer required - - -This version of UE-V introduces the **sync provider**, which replaces the requirement for the Windows Offline Files feature to support a client-side cache of settings. - -Whereas UE-V used to synchronize settings only when an application opened, closed, or when Windows locked or unlocked, or at logon or logoff, the sync provider also … - -- Synchronizes local application and Windows settings out-of-band using "**trigger events**" - -- Uses a **scheduled task** to sync the settings storage package in any interval you choose for your enterprise requirements (every 30 minutes by default) - -Certain conditions provide more frequent synchronization. - -- Settings synchronize when the user clicks the **Sync Now** button in the new Company Settings Center application. - -- The sync provider can also start for a single application without waiting for the scheduled synchronization task. For example, when an application is closed, any settings changes are written to the local cache, and the sync provider process runs asynchronously to move those new settings changes to the settings storage location. - -## Windows app synchronization - - -The developer of a Windows app can define which settings, if any, are to be synchronized, and these settings can now be captured and synchronized with UE-V. - -By default, UE-V synchronizes the settings of many of the Windows apps included in Windows 8 and Windows 8.1. You can modify the list of synchronized apps with Windows PowerShell, Windows Management Instrumentation (WMI), or Group Policy. - -**Note**   -UE-V does not synchronize Windows app settings if the domain users link their sign-in credentials to their Microsoft account. This linking synchronizes settings to Microsoft OneDrive so UE-V only synchronizes the desktop applications. - - - -## Microsoft account linking - - -Settings synchronization via OneDrive is new to Windows 8 when you are signed in with a Microsoft account or if you link your Microsoft account to your domain account. If a domain user uses UE-V and has signed in to a Microsoft account, then… - -- UE-V only synchronizes settings for desktop applications - -- Microsoft account handles Windows app settings and Windows desktop settings - -## Company Settings Center - - -You can provide your users with some control over which settings are synchronized through an application in UE-V 2 called Company Settings Center. Company Settings Center is installed along with the UE-V Agent, and users can access it from Control Panel, the **Start** menu or **Start** screen, and from the UE-V notification area icon. - -Company Settings Center displays which settings are synchronized and lets users see the synchronization status of UE-V. If you let them, users can use Company Settings Center to select which settings to synchronize. They can also click the **Sync Now** button to synchronize all settings immediately. - - - - - - -## Related topics - - -[Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md) - - - - - - - - - diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md deleted file mode 100644 index 3951f6c67a..0000000000 --- a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: What's New in UE-V 2.1 -description: What's New in UE-V 2.1 -author: dansimp -ms.assetid: 7f385183-7d97-4602-b19a-baa710334ade -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# What's New in UE-V 2.1 - - -User Experience Virtualization 2.1 provides these new features and functionality compared to UE-V 2.0. The [Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md) provide more information about the UE-V 2.1 release. - -## Office 2013 Settings Location Template - - -UE-V 2.1 includes the Microsoft Office 2013 settings location template with improved Outlook signature support. In UE-V 2.1, the signature data synchronizes between user devices. We’ve added synchronization of default signature settings for new, reply, and forwarded emails. Customers no longer have to choose the default signature settings. - -**Note**   -An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization. - - - -Previously UE-V included Microsoft Office 2010 settings location templates that were automatically distributed and registered with the UE-V Agent. UE-V 2.1 works with Office 365 to determine whether Office 2013 settings are roamed by Office 365. If settings are roamed by Office 365 they are not roamed by UE-V. [Overview of user and roaming settings for Office 2013](https://go.microsoft.com/fwlink/p/?LinkID=391220) provides more information. - -To enable settings synchronization using UE-V 2.1, do one of the following: - -- Use Group Policy to disable Office 365 synchronization - -- Do not enable the Office 365 synchronization experience during Office 2013 installation - -UE-V 2.1 ships [Office 2013 and Office 2010 templates](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). This release removes the Office 2007 templates. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](https://go.microsoft.com/fwlink/p/?LinkID=246589). - -## Fix for Distributed File System Namespace Users - - -UE-V has improved Distributed File System Namespace (DFSN) support by adding a UE-V configuration called SyncProviderPingEnabled. Disabling this configuration using PowerShell or WMI allows users to disable the UE-V ping. The UE-V ping causes an error when using DFSN servers because these servers do not respond to pings. The non-response prevents UE-V from synchronizing settings. Disabling the UE-V ping allows UE-V synchronization to work normally. - -To disable UE-V ping, use this PowerShell cmdlet: - -``` syntax -Set-UevConfiguration -DisableSyncProviderPing -``` - -## Synchronization for Credentials - - -UE-V 2.1 gives customers the ability to synchronize credentials and certificates stored in the Windows Credential Manager. This component is disabled by default. Enabling this component lets users keep their domain credentials and certificates in sync. Users can sign in one time on a device, and these credentials will roam for that user across all of their UE-V enabled devices. [Manage Credentials with UE-V 2.1](https://technet.microsoft.com/library/dn458932.aspx#creds) provides more information. - -**Note**   -In Windows 8 and later, Credential Manager contains web credentials. These credentials are not synchronized between users’ devices. - - - -## UE-V and Microsoft Account Synchronization - - -UE-V detects if “Sync settings with OneDrive”, also known as Microsoft Account synchronization, is on. If the Microsoft Account is not configured to synchronize settings, UE-V synchronizes Windows apps, AppX packages, and Windows desktop settings between devices. This lets users access their Store apps, music, pictures and other Microsoft Account-enabled applications without syncing outside of the enterprise firewall. UE-V checks whether Group Policy will stop synchronizing settings with OneDrive or if the user disables **Sync your settings on this computer** in the user controls. - -## Support for the SyncMethod External - - -A new [SyncMethod configuration](https://technet.microsoft.com/library/dn554321.aspx) called **External** specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access. - -## Enhanced Support for VDI Mode - - -UE-V 2.1 includes [support for VDI sessions](https://technet.microsoft.com/library/dn458932.aspx#vdi) that are shared among end users. As an administrator, you can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions. - -**Note**   -If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as back-up/restore and LKG. - - - -## Administrative Backup and Restore - - -You can restore additional settings when a user adopts a new device by putting a settings location template in **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. [Manage Administrative Backup and Restore in UE-V 2.x](manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md) provides more information. - -## Synchronization for Additional Windows Settings - - -UE-V now synchronizes touch keyboard personalization, the spelling dictionary, and enables the App Switching for recent apps and screen edge settings to synchronize between Windows 8 and Windows 8.1 devices. - - - - - - -## Related topics - - -[Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md) - - - - - - - - - diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md b/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md deleted file mode 100644 index c58430ce8b..0000000000 --- a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: What's New in UE-V 2.1 SP1 -description: What's New in UE-V 2.1 SP1 -author: dansimp -ms.assetid: 9a40c737-ad9a-4ec1-b42b-31bfabe0f170 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# What's New in UE-V 2.1 SP1 - - -User Experience Virtualization 2.1 SP1 provides these new features and functionality compared to UE-V 2.1. The [Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md) provide more information about the UE-V 2.1 SP1 release. - -## Support for Windows 10 - - -UE-V 2.1 SP1 adds support for Windows 10, in addition to the same software that is supported in earlier versions of UE-V. - -### Compatibility with Microsoft Azure - -Windows 10 lets enterprise users synchronize Windows app settings and Windows operating system settings to Azure instead of to OneDrive. You can use the Windows 10 enterprise sync functionality together with UE-V for on-premises domain-joined computers only. To enable coexistence between Windows 10 and UE-V, you must disable the following UE-V templates using either PowerShell on each client or Group Policy. - -In Group Policy, under the Microsoft User Experience Virtualization node, configure these policy settings: - -- Enable “Do Not Synchronize Windows Apps” - -- Disable “Sync Windows Settings” - -### Settings Synchronization Behavior Changed for Windows 10 Support - -UE-V 2.1 SP1 roams taskbar settings between Windows 10 devices. However, UE-V does not synchronize taskbar settings between Windows 10 devices and devices running previous operating systems. - -In addition, UE-V 2.1 SP1 does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems. - -## Support Added for Roaming Network Printers - - -UE-V 2.1 SP1 lets network printers roam between devices so that a user has access to their network printers when logged on to any device on the network. This includes roaming the printer that they set as the default. - -Printer roaming in UE-V requires one of these scenarios: - -- The print server can download the required driver when it roams to a new device. - -- The driver for the roaming network printer is pre-installed on any device that needs to access that network printer. - -- The printer driver can be obtained from Windows Update. - -**Note**   -The UE-V printer roaming feature does **not** roam printer settings or preferences, such as printing double-sided. - - - -## Office 2013 Settings Location Template - - -UE-V 2.1 and 2.1 SP1 include the Microsoft Office 2013 settings location template with improved Outlook signature support. We’ve added synchronization of default signature settings for new, reply, and forwarded emails. Customers no longer have to choose the default signature settings. - -**Note**   -An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization. - - - -Previously UE-V included Microsoft Office 2010 settings location templates that were automatically distributed and registered with the UE-V Agent. UE-V 2.1 works with Office 365 to determine whether Office 2013 settings are roamed by Office 365. If settings are roamed by Office 365 they are not roamed by UE-V. [Overview of user and roaming settings for Office 2013](https://go.microsoft.com/fwlink/p/?LinkID=391220) provides more information. - -To enable settings synchronization using UE-V 2.1, do one of the following: - -- Use Group Policy to disable Office 365 synchronization - -- Do not enable the Office 365 synchronization experience during Office 2013 installation - -UE-V 2.1 ships [Office 2013 and Office 2010 templates](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings). This release removes the Office 2007 templates. Users can still use Office 2007 templates from UE-V 2.0 or earlier and can still get the templates from the UE-V template gallery located [here](https://go.microsoft.com/fwlink/p/?LinkID=246589). - - - - - - -## Related topics - - -[Get Started with UE-V 2.x](get-started-with-ue-v-2x-new-uevv2.md) - -[Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md) - -[Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md) - - - - - - - - - diff --git a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md b/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md deleted file mode 100644 index d39f7e4f80..0000000000 --- a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -title: Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator -description: Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator -author: dansimp -ms.assetid: f0bb4920-0132-472c-a564-abf06a884275 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.pagetype: mdop, virtualization -ms.mktglfcycl: deploy -ms.sitesec: library -ms.prod: w10 -ms.date: 08/30/2016 ---- - - -# Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator - - -To synchronize application settings between user computers, Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 use *settings location templates*. Some settings location templates are included in User Experience Virtualization. You can also create, edit, or validate custom settings location templates by using the UE-V Generator. - -The UE-V Generator monitors Windows desktop applications to discover and capture the locations where the application stores its settings. The application that is monitored must be a desktop application. The UE-V Generator cannot create a settings location template for the following application types: - -- Virtualized applications - -- Applications that are offered through Terminal Services - -- Java applications - -- Windows apps - -This topic - -**Standard and Nonstandard settings locations:** The UE-V Generator helps you identify where applications search for settings files and registry settings that applications use to store settings information. The generator only discovers settings in locations that are accessible to a standard user. Settings that are stored in other locations are excluded. Discovered settings are grouped into two categories: **Standard** and **Non-standard**. Standard settings are recommended for synchronization, and UE-V can readily capture and apply them. Non-standard settings can potentially synchronize settings but, because of the rules that UE-V uses, these settings might not consistently or dependably synchronize settings. These settings might depend on temporary files, result in unreliable synchronization, or might not be useful. These settings locations are presented in the UE-V Generator. You can choose to include or exclude them on a case-by-case basis. - -The UE-V Generator opens the application as part of the discovery process. The generator can capture settings in the following locations: - -- **Registry Settings** – Registry locations under **HKEY\_CURRENT\_USER** - -- **Application Settings Files** – Files that are stored under \\ **Users** \\ \[User name\] \\ **AppData** \\ **Roaming** - -The UE-V Generator excludes locations, which commonly store application software files, but do not synchronize well between user computers or environments. The UE-V Generator excludes these locations. Excluded locations are as follows: - -- HKEY\_CURRENT\_USER registry keys and files to which the logged-on user cannot write values - -- HKEY\_CURRENT\_USER registry keys and files that are associated with the core functionality of the Windows operating system - -- All registry keys that are located in the HKEY\_LOCAL\_MACHINE hive, which requires administrator rights and might require to set a User Account Control (UAC) agreement - -- Files that are located in Program Files directories, which requires administrator rights and might require to set a UAC agreement - -- Files that are located under Users \\ \[User name\] \\ AppData \\ LocalLow - -- Windows operating system files that are located in %Systemroot%, which requires administrator rights and might require to set a UAC agreement - -If registry keys and files that are stored in these locations are required to synchronize application settings, you can manually add the excluded locations to the settings location template during the template creation process - (except for registry entries in the HKEY\_LOCAL\_MACHINE hive). - -## Edit Settings Location Templates with the UE-V Generator - - -Use the UE-V Generator to edit settings location templates. When the revised settings are added to the templates by using the UE-V Generator, the version information within the template is automatically updated to ensure that any existing templates that are deployed in the enterprise are updated correctly. - -**Note**   -If you edit a UE-V 1.0 template by using the UE-V 2 Generator, the template is automatically converted to a UE-V 2 template. UE-V 1.0 Agents can no longer use the edited template. - - - -**To edit a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, click **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Edit a settings location template**. - -3. In the list of recently used templates, select the template to be edited. Alternatively, click **Browse** to search for the settings template file. Click **Next** to continue. - -4. Review the **Properties**, **Registry** locations, and **Files** locations for the settings template. Edit as required. - - - On the **Properties** tab, you can view and edit the following properties: - - - **Application name**: The application name that is written in the description of the program file properties. - - - **Program name**: The name of the program that is taken from the program file properties. This name usually has the .exe file name extension. - - - **Product version**: The product version number of the .exe file of the application. This property, together with the **File version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, then the settings location template applies to all versions of the product. - - - **File version**: The file version number of the .exe file of the application. This property, along with the **Product version**, helps determine which applications are targeted by the settings location template. This property accepts a major version number. If this property is empty, the settings location template applies to all versions of the program. - - - **Template author name** (optional): The name of the settings template author. - - - **Template author email** (optional): The email address of the settings location template author. - - - The **Registry** tab lists the **Key** and **Scope** of the registry locations that are included in the settings location template. You can edit the registry locations by using the **Tasks** drop-down menu. In the Tasks menu, you can add new keys, edit the name or scope of existing keys, delete keys, and browse the registry in which the keys are located. When you define the scope for the registry, you can use the **All Settings** scope to include all the registry settings under the specified key. Use **All Settings** and **Subkeys** to include all the registry settings under the specified key, subkeys, and subkey settings. - - - The **Files** tab lists the file path and file mask of the file locations that are included in the settings location template. You can edit the file locations by using the **Tasks** drop-down menu. In the **Tasks** menu for file locations, you can add new files or folder locations, edit the scope of existing files or folders, delete files or folders, and open the selected location in Windows Explorer. To include all files in the specified folder, leave the file mask empty. - -5. Click **Save** to save the changes to the settings location template. - -6. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you edit the settings location template for an application, you should test the template. Deploy the revised settings location template in a lab environment before you put it into production in the enterprise. - -**How to manually edit a settings location template** - -1. Create a local copy of the settings location template .xml file. UE-V settings location templates are .xml files that identify the locations where application store settings values. - - **Note**   - A settings location template is unique because of the template **ID**. If you copy the template and rename the .xml file, template registration fails because UE-V reads the template **ID** tag in the .xml file to determine the name, not the file name of the .xml file. UE-V also reads the **Version** number to know if anything has changed. If the version number is higher, UE-V updates the template. - - - -2. Open the settings location template file with an XML editor. - -3. Edit the settings location template file. All changes must conform to the UE-V schema file that is defined in [SettingsLocationTempate.xsd](https://technet.microsoft.com/library/dn763947.aspx). By default, a copy of the .xsd file is located in \\ProgramData\\Microsoft\\UEV\\Templates. - -4. Increment the **Version** number for the settings location template. - -5. Save the settings location template file, and then close the XML editor. - -6. Validate the modified settings location template file by using the UE-V Generator. - -7. You must register the edited UE-V settings location template before it can synchronize settings between client computers. To register a template, open Windows PowerShell, and then run the following cmdlet: `update-uevtemplate [templatefilename]`. You can then copy the file to the settings storage catalog. The UE-V Agent on users’ computers should then update as scheduled in the scheduled task. - -## Validate Settings Location Templates with the UE-V Generator - - -It is possible to create or edit settings location templates in an XML editor without using the UE-V Generator. If you do, you can use the UE-V Generator to validate that the new or revised XML matches the schema that has been defined for the template. - -**To validate a UE-V settings location template with the UE-V Generator** - -1. Click **Start**, point to **All Programs**, click **Microsoft User Experience Virtualization**, and then click **Microsoft User Experience Virtualization Generator**. - -2. Click **Validate a settings location template**. - -3. In the list of recently used templates, select the template to be edited. Alternatively, you can **Browse** to the settings template file. Click **Next** to continue. - -4. Click **Validate** to continue. - -5. Click **Close** to close the Settings Template Wizard. Exit the UE-V Generator application. - - After you validate the settings location template for an application, you should test the template. Deploy the template in a lab environment before you put it into a production environment in enterprise. - -## Share Settings Location Templates with the Template Gallery - - -The Microsoft User Experience Virtualization (UE-V) 2.0 template gallery enables administrators to share their UE-V settings location templates. In the gallery, you can upload your settings location templates for other users to use, and you can download templates that other users have created. The UE-V template gallery is located on Microsoft TechNet [here](https://go.microsoft.com/fwlink/p/?LinkId=246589). - -Before you share a settings location template on the UE-V template gallery, ensure it does not contain any personal or company information. You can use any XML viewer to open and view the contents of a settings location template file. The following template values should be reviewed before you share a template with anyone outside your company. - -- Template Author Name – Specify a general, non-identifying name for the template author name or exclude this data from the template. - -- Template Author Email – Specify a general, non-identifying template author email or exclude this data from the template. - -Before you deploy any settings location template that you have downloaded from the UE-V gallery, you should first test the template to ensure that the application settings synchronize settings correctly in a test environment. - - - - - - -## Related topics - - -[Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md) - -[Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md) - - - - - - - - - diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index b62b89b55a..9b5f3ae040 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -2,7 +2,7 @@ title: Deploy and manage a full cloud IT solution for your business description: Learn how to set up a cloud infrastructure for your business, acquire devices and apps, and configure and deploy policies to your devices. keywords: smb, full cloud IT solution, small to medium business, deploy, setup, manage, Windows, Intune, Office 365 -ms.prod: +ms.prod: w10 ms.technology: ms.author: eravena audience: itpro @@ -13,6 +13,7 @@ author: eavena ms.reviewer: manager: dansimp ms.localizationpriority: medium +ms.topic: conceptual --- # Get started: Deploy and manage a full cloud IT solution for your business diff --git a/smb/docfx.json b/smb/docfx.json index a5644a3f2b..379f9d6f3e 100644 --- a/smb/docfx.json +++ b/smb/docfx.json @@ -30,6 +30,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/smb/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "feedback_system": "None", "hideEdit": true, "_op_documentIdPathDepotMapping": { diff --git a/smb/index.md b/smb/index.md index 5cc2746261..1f9527ebf2 100644 --- a/smb/index.md +++ b/smb/index.md @@ -2,16 +2,17 @@ title: Windows 10 for small to midsize businesses description: Microsoft products and devices to transform and grow your businessLearn how to use Windows 10 for your small to midsize business. keywords: Windows 10, SMB, small business, midsize business, business -ms.prod: +ms.prod: w10 ms.technology: ms.topic: article -ms.author: celested +ms.author: dansimp ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: smb -author: CelesteDG +author: dansimp ms.localizationpriority: medium manager: dansimp +audience: itpro --- # Windows 10 for SMB diff --git a/store-for-business/add-unsigned-app-to-code-integrity-policy.md b/store-for-business/add-unsigned-app-to-code-integrity-policy.md index bddb37739a..c57643bd16 100644 --- a/store-for-business/add-unsigned-app-to-code-integrity-policy.md +++ b/store-for-business/add-unsigned-app-to-code-integrity-policy.md @@ -17,6 +17,23 @@ ms.date: 10/17/2017 # Add unsigned app to code integrity policy +> [!IMPORTANT] +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> +> Following are the major changes we are making to the service: +> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. +> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> +> The following functionality will be available via these PowerShell cmdlets: +> - Get a CI policy +> - Sign a CI policy +> - Sign a catalog +> - Download root cert +> - Download history of your signing operations +> +> For any questions, please contact us at DGSSMigration@microsoft.com. + **Applies to** @@ -45,7 +62,7 @@ Before you get started, be sure to review these best practices and requirements: **Best practices** -- **Naming convention** -- Using a naming convention makes it easier to find deployed catalog files. We'll use \*-Contoso.cat as the naming convention in this topic. For more information, see the section Inventorying catalog files by using Configuration Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). +- **Naming convention** -- Using a naming convention makes it easier to find deployed catalog files. We'll use \*-Contoso.cat as the naming convention in this topic. For more information, see the section Inventorying catalog files by using Microsoft Endpoint Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). - **Where to deploy code integrity policy** -- The [code integrity policy that you created](#create-ci-policy) should be deployed to the system on which you are running Package Inspector. This will ensure that the code integrity policy binaries are trusted. Copy the commands for each step into an elevated Windows PowerShell session. You'll use Package Inspector to find and trust all binaries in the app. @@ -100,4 +117,4 @@ Catalog signing is a vital step to adding your unsigned apps to your code integr When you use the Device Guard signing portal to sign a catalog file, the signing certificate is added to the default policy. When you download the signed catalog file, you should also download the default policy and merge this code integrity policy with your existing code integrity policies to protect machines running the catalog file. You need to do this step to trust and run your catalog files. For more information, see the Merging code integrity policies in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). 6. Open the root certificate that you downloaded, and follow the steps in **Certificate Import wizard** to install the certificate in your machine's certificate store. -7. Deploy signed catalogs to your managed devices. For more information, see Deploy catalog files with Group Policy, or Deploy catalog files with Microsoft Endpoint Configuration Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). +7. Deploy signed catalogs to your managed devices. For more information, see Deploy catalog files with Group Policy, or Deploy catalog files with Microsoft Endpoint Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide). diff --git a/store-for-business/device-guard-signing-portal.md b/store-for-business/device-guard-signing-portal.md index 6a2720e035..a891ecd541 100644 --- a/store-for-business/device-guard-signing-portal.md +++ b/store-for-business/device-guard-signing-portal.md @@ -17,6 +17,23 @@ ms.date: 10/17/2017 # Device Guard signing +> [!IMPORTANT] +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> +> Following are the major changes we are making to the service: +> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. +> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> +> The following functionality will be available via these PowerShell cmdlets: +> - Get a CI policy +> - Sign a CI policy +> - Sign a catalog +> - Download root cert +> - Download history of your signing operations +> +> For any questions, please contact us at DGSSMigration@microsoft.com. + **Applies to** diff --git a/store-for-business/distribute-offline-apps.md b/store-for-business/distribute-offline-apps.md index 5c70fb1b0b..8a5ead4fe6 100644 --- a/store-for-business/distribute-offline-apps.md +++ b/store-for-business/distribute-offline-apps.md @@ -18,10 +18,10 @@ ms.date: 10/17/2017 # Distribute offline apps -**Applies to** +**Applies to:** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile Offline licensing is a new licensing option for Windows 10 with Microsoft Store for Business and Microsoft Store for Education. With offline licenses, organizations can download apps and their licenses to deploy within their network, or on devices that are not connected to the Internet. ISVs or devs can opt-in their apps for offline licensing when they submit them to the Windows Dev Center. Only apps that are opted in to offline licensing will show that they are available for offline licensing in Microsoft Store for Business and Microsoft Store for Education. This model allows organizations to deploy apps when users or devices do not have connectivity to the Store. @@ -29,23 +29,23 @@ Offline licensing is a new licensing option for Windows 10 with Microsoft Store Offline-licensed apps offer an alternative to online apps, and provide additional deployment options. Some reasons to use offline-licensed apps: -- **You don't have access to Microsoft Store services** - If your employees don't have access to the internet and Microsoft Store services, downloading offline-licensed apps and deploying them with imaging is an alternative to online-licensed apps. +- **You don't have access to Microsoft Store services** - If your employees don't have access to the Internet and Microsoft Store services, downloading offline-licensed apps and deploying them with imaging is an alternative to online-licensed apps. -- **You use imaging to manage devices in your organization** - Offline-licensed apps can be added to images and deployed with Deployment Image Servicing and Management (DISM), or Windows Imaging and Configuration Designer (ICD). +- **You use imaging to manage devices in your organization** - Offline-licensed apps can be added to images and deployed with Deployment Image Servicing and Management (DISM), or Windows Imaging and Configuration Designer (ICD). -- **Your employees do not have Azure Active Directory (AD) accounts** - Azure AD accounts are required for employees that install apps assigned to them from Microsoft Store or that claim apps from a private store. +- **Your employees do not have Azure Active Directory (AD) accounts** - Azure AD accounts are required for employees that install apps assigned to them from Microsoft Store or that claim apps from a private store. ## Distribution options for offline-licensed apps You can't distribute offline-licensed apps directly from Microsoft Store. Once you download the items for the offline-licensed app, you have options for distributing the apps: -- **Deployment Image Servicing and Management**. DISM is a command-line tool that is used to mount and service Microsoft Windows images before deployment. You can also use DISM to install, uninstall, configure, and update Windows features, packages, drivers, and international settings in a .wim file or VHD using the DISM servicing commands. DISM commands are used on offline images. For more information, see [Deployment Image Servicing and Management](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows). +- **Deployment Image Servicing and Management**. DISM is a command-line tool that is used to mount and service Microsoft Windows images before deployment. You can also use DISM to install, uninstall, configure, and update Windows features, packages, drivers, and international settings in a .wim file or VHD using the DISM servicing commands. DISM commands are used on offline images. For more information, see [Deployment Image Servicing and Management](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows). -- **Create provisioning package**. You can use Windows Imaging and Configuration Designer (ICD) to create a provisioning package for your offline app. Once you have the package, there are options to [apply the provisioning package](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package). For more information, see [Provisioning Packages for Windows 10](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages). +- **Create provisioning package**. You can use Windows Imaging and Configuration Designer (ICD) to create a provisioning package for your offline app. Once you have the package, there are options to [apply the provisioning package](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package). For more information, see [Provisioning Packages for Windows 10](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages). -- **Mobile device management provider or management server.** You can use a mobile device management (MDM) provider or management server to distribute offline apps. For more information, see these topics: - - [Manage apps from Microsoft Store for Business with Microsoft Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - - [Manage apps from Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
    +- **Mobile device management provider or management server.** You can use a mobile device management (MDM) provider or management server to distribute offline apps. For more information, see these topics: + - [Manage apps from Microsoft Store for Business with Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) + - [Manage apps from Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/mem/intune/apps/windows-store-for-business)
    For third-party MDM providers or management servers, check your product documentation. @@ -53,23 +53,22 @@ For third-party MDM providers or management servers, check your product document There are several items to download or create for offline-licensed apps. The app package and app license are required; app metadata and app frameworks are optional. This section includes more info on each item, and tells you how to download an offline-licensed app. -- **App metadata** - App metadata is optional. The metadata includes app details, links to icons, product id, localized product ids, and other items. Devs who plan to use an app as part of another app or tool, might want the app metadata. +- **App metadata** - App metadata is optional. The metadata includes app details, links to icons, product id, localized product ids, and other items. Devs who plan to use an app as part of another app or tool, might want the app metadata. -- **App package** - App packages are required for distributing offline apps. There are app packages for different combinations of app platform and device architecture. You'll need to know what device architectures you have in your organization to know if there are app packages to support your devices. +- **App package** - App packages are required for distributing offline apps. There are app packages for different combinations of app platform and device architecture. You'll need to know what device architectures you have in your organization to know if there are app packages to support your devices. -- **App license** - App licenses are required for distributing offline apps. Use encoded licenses when you distribute offline-licensed apps using a management tool or ICD. Use unencoded licenses when you distribute offline-licensed apps using DISM. +- **App license** - App licenses are required for distributing offline apps. Use encoded licenses when you distribute offline-licensed apps using a management tool or ICD. Use unencoded licenses when you distribute offline-licensed apps using DISM. -- **App frameworks** - App frameworks are optional. If you already have the required framework, you don't need to download another copy. The Store for Business will select the app framework needed for the app platform and architecture that you selected. +- **App frameworks** - App frameworks are optional. If you already have the required framework, you don't need to download another copy. The Store for Business will select the app framework needed for the app platform and architecture that you selected. - -**To download an offline-licensed app** +**To download an offline-licensed app** -1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com). -2. Click **Manage**. -3. Click **Settings**. -4. Click **Shop**. Search for the **Shopping experience** section, change the License type to **Offline**, and click **Get the app**, which will add the app to your inventory. -5. Click **Manage**. You now have access to download the appx bundle package metadata and license file. -6. Go to **Products & services**, and select **Apps & software**. (The list may be empty, but it will auto-populate after some time.) +1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com). +2. Click **Manage**. +3. Click **Settings**. +4. Click **Shop**. Search for the **Shopping experience** section, change the License type to **Offline**, and click **Get the app**, which will add the app to your inventory. +5. Click **Manage**. You now have access to download the appx bundle package metadata and license file. +6. Go to **Products & services**, and select **Apps & software**. (The list may be empty, but it will auto-populate after some time.) - **To download app metadata**: Choose the language for the app metadata, and then click **Download**. Save the downloaded app metadata. This is optional. - **To download app package**: Click to expand the package details information, choose the Platform and Architecture combination that you need for your organization, and then click **Download**. Save the downloaded app package. This is required. @@ -78,16 +77,3 @@ There are several items to download or create for offline-licensed apps. The app > [!NOTE] > You need the framework to support your app package, but if you already have a copy, you don't need to download it again. Frameworks are backward compatible. - - - -   - -  - -  - - - - - diff --git a/store-for-business/includes/store-for-business-content-updates.md b/store-for-business/includes/store-for-business-content-updates.md new file mode 100644 index 0000000000..82518ed170 --- /dev/null +++ b/store-for-business/includes/store-for-business-content-updates.md @@ -0,0 +1,18 @@ + + + + +## Week of January 25, 2021 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 1/29/2021 | [Distribute offline apps (Windows 10)](/microsoft-store/distribute-offline-apps) | modified | + + +## Week of January 11, 2021 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 1/14/2021 | [Add unsigned app to code integrity policy (Windows 10)](/microsoft-store/add-unsigned-app-to-code-integrity-policy) | modified | diff --git a/store-for-business/index.md b/store-for-business/index.md index 71a8c271d1..9ec42cc879 100644 --- a/store-for-business/index.md +++ b/store-for-business/index.md @@ -2,6 +2,7 @@ title: Microsoft Store for Business and Education (Windows 10) description: Welcome to the Microsoft Store for Business and Education. You can use Microsoft Store, to find, acquire, distribute, and manage apps for your organization or school. ms.assetid: 527E611E-4D47-44F0-9422-DCC2D1ACBAB8 +manager: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -10,7 +11,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: high -ms.date: 10/17/2017 +ms.date: 05/14/2020 --- # Microsoft Store for Business and Education diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md index b7fea1a9ef..04c86ceb64 100644 --- a/store-for-business/microsoft-store-for-business-education-powershell-module.md +++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md @@ -9,7 +9,6 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.author: ms.date: 10/22/2017 ms.reviewer: manager: dansimp diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md index 4b9707b563..59be6fdc1c 100644 --- a/store-for-business/microsoft-store-for-business-overview.md +++ b/store-for-business/microsoft-store-for-business-overview.md @@ -12,7 +12,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.date: 10/17/2017 +ms.date: --- # Microsoft Store for Business and Microsoft Store for Education overview @@ -22,7 +22,10 @@ ms.date: 10/17/2017 - Windows 10 - Windows 10 Mobile -Designed for organizations, Microsoft Store for Business and Microsoft Store for Education give IT decision makers and administrators in businesses or schools a flexible way to find, acquire, manage, and distribute free and paid apps in select markets to Windows 10 devices in volume. IT administrators can manage Microsoft Store apps and private line-of-business apps in one inventory, plus assign and re-use licenses as needed. You can choose the best distribution method for your organization: directly assign apps to individuals and teams, publish apps to private pages in Microsoft Store, or connect with management solutions for more options. +Designed for organizations, Microsoft Store for Business and Microsoft Store for Education give IT decision makers and administrators in businesses or schools a flexible way to find, acquire, manage, and distribute free and paid apps in select markets to Windows 10 devices in volume. IT administrators can manage Microsoft Store apps and private line-of-business apps in one inventory, plus assign and re-use licenses as needed. You can choose the best distribution method for your organization: directly assign apps to individuals and teams, publish apps to private pages in Microsoft Store, or connect with management solutions for more options. + +> [!IMPORTANT] +> Customers who are in the Office 365 GCC environment or are eligible to buy with government pricing cannot use Microsoft Store for Business. ## Features Organizations or schools of any size can benefit from using Microsoft Store for Business or Microsoft Store for Education: diff --git a/store-for-business/prerequisites-microsoft-store-for-business.md b/store-for-business/prerequisites-microsoft-store-for-business.md index 0d054ed947..0dc7ab9ece 100644 --- a/store-for-business/prerequisites-microsoft-store-for-business.md +++ b/store-for-business/prerequisites-microsoft-store-for-business.md @@ -12,7 +12,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.date: 10/13/2017 +ms.date: --- # Prerequisites for Microsoft Store for Business and Education @@ -22,6 +22,9 @@ ms.date: 10/13/2017 - Windows 10 - Windows 10 Mobile +> [!IMPORTANT] +> Customers who are in the Office 365 GCC environment or are eligible to buy with government pricing cannot use Microsoft Store for Business. + There are a few prerequisites for using Microsoft Store for Business or Microsoft Store for Education. ## Prerequisites @@ -63,7 +66,8 @@ If your organization restricts computers on your network from connecting to the - www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com starting with Windows 10, version 1607) - +Store for Business requires Microsoft Windows HTTP Services (WinHTTP) to install, or update apps. +For more information about how to configure WinHTTP proxy settings to devices, see [Use Group Policy to apply WinHTTP proxy settings to Windows clients](https://support.microsoft.com/help/4494447/use-group-policy-to-apply-winhttp-proxy-settings-to-clients). diff --git a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md index e0db1ee7c7..6512584c76 100644 --- a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md +++ b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md @@ -17,6 +17,24 @@ ms.date: 10/17/2017 # Sign code integrity policy with Device Guard signing +> [!IMPORTANT] +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> +> Following are the major changes we are making to the service: +> - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. +> - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> +> The following functionality will be available via these PowerShell cmdlets: +> - Get a CI policy +> - Sign a CI policy +> - Sign a catalog +> - Download root cert +> - Download history of your signing operations +> +> For any questions, please contact us at DGSSMigration@microsoft.com. + + **Applies to** - Windows 10 diff --git a/windows/access-protection/docfx.json b/windows/access-protection/docfx.json index 9df4554e37..3f6ef46e23 100644 --- a/windows/access-protection/docfx.json +++ b/windows/access-protection/docfx.json @@ -40,7 +40,16 @@ "depot_name": "MSDN.win-access-protection", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md index 1ef657304d..8e37f9eb2f 100644 --- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to Add or Remove an Administrator by Using the Management Console (Windows 10) -description: How to add or remove an administrator by using the Management Console +description: Add or remove an administrator on the Microsoft Application Virtualization (App-V) server by using the Management Console. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md index ce050e817b..c26f77e8e4 100644 --- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to Add or Upgrade Packages by Using the Management Console (Windows 10) -description: How to add or upgrade packages by using the Management Console +description: Add or remove an administrator on the Microsoft Application Virtualization (App-V) server by using the Management Console. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md index ea02c9ad1f..58a0c8b25d 100644 --- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md +++ b/windows/application-management/app-v/appv-administering-appv-with-powershell.md @@ -1,6 +1,6 @@ --- title: Administering App-V by using Windows PowerShell (Windows 10) -description: Administering App-V by Using Windows PowerShell +description: Administer App-V by using Windows PowerShell and learn where to find more information about PowerShell for App-V. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md index 55dcc71e05..e9537f973b 100644 --- a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md +++ b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md @@ -1,6 +1,6 @@ --- title: Only Allow Admins to Enable Connection Groups (Windows 10) -description: How to Allow Only Administrators to Enable Connection Groups +description: Configure the App-V client so that only administrators, not users, can enable or disable connection groups. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index a913ce8a38..88430660e3 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -1,6 +1,6 @@ --- title: Application Publishing and Client Interaction (Windows 10) -description: Application publishing and client interaction. +description: Learn technical information about common App-V Client operations and their integration with the local operating system. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md index 6bb52f7eb3..8c4f4b2b2d 100644 --- a/windows/application-management/app-v/appv-available-mdm-settings.md +++ b/windows/application-management/app-v/appv-available-mdm-settings.md @@ -1,6 +1,6 @@ --- title: Available Mobile Device Management (MDM) settings for App-V (Windows 10) -description: A list of the available MDM settings for App-V on Windows 10. +description: Learn the available Mobile Device Management (MDM) settings you can use to configure App-V on Windows 10. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-capacity-planning.md b/windows/application-management/app-v/appv-capacity-planning.md index 099bcdf1c4..d3c80a88c9 100644 --- a/windows/application-management/app-v/appv-capacity-planning.md +++ b/windows/application-management/app-v/appv-capacity-planning.md @@ -1,6 +1,6 @@ --- title: App-V Capacity Planning (Windows 10) -description: App-V Capacity Planning +description: Use these recommendations as a baseline to help determine capacity planning information that is appropriate to your organization’s App-V infrastructure. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-client-configuration-settings.md b/windows/application-management/app-v/appv-client-configuration-settings.md index 693a058d7e..f641b232d6 100644 --- a/windows/application-management/app-v/appv-client-configuration-settings.md +++ b/windows/application-management/app-v/appv-client-configuration-settings.md @@ -1,6 +1,6 @@ --- title: About Client Configuration Settings (Windows 10) -description: About Client Configuration Settings +description: Learn about the App-V client configuration settings and how to use Windows PowerShell to modify the client configuration settings. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md index ae887fc389..52632f558e 100644 --- a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md +++ b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md @@ -1,6 +1,6 @@ --- title: How to make a connection group ignore the package version (Windows 10) -description: How to make a connection group ignore the package version. +description: Learn how to make a connection group ignore the package version with the App-V Server Management Console. author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-connect-to-the-management-console.md b/windows/application-management/app-v/appv-connect-to-the-management-console.md index f878e5f7a4..dd38c101dd 100644 --- a/windows/application-management/app-v/appv-connect-to-the-management-console.md +++ b/windows/application-management/app-v/appv-connect-to-the-management-console.md @@ -1,7 +1,7 @@ --- title: How to connect to the Management Console (Windows 10) -description: How to Connect to the App-V Management Console. -author: lomayor +description: In this article, learn the procedure for connecting to the App-V Management Console through your web browser. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-connection-group-virtual-environment.md b/windows/application-management/app-v/appv-connection-group-virtual-environment.md index ed2d425dc4..743c824815 100644 --- a/windows/application-management/app-v/appv-connection-group-virtual-environment.md +++ b/windows/application-management/app-v/appv-connection-group-virtual-environment.md @@ -1,7 +1,7 @@ --- title: About the connection group virtual environment (Windows 10) -description: Overview of how the connection group virtual environment works. -author: lomayor +description: Learn how the connection group virtual environment works and how package priority is determined. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md index 794615f010..36691ab472 100644 --- a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md +++ b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md @@ -1,7 +1,7 @@ --- title: How to convert a package created in a previous version of App-V (Windows 10) -description: How to convert a package created in a previous version of App-V. -author: lomayor +description: Use the package converter utility to convert a virtual application package created in a previous version of App-V. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md index 312adeb09b..62787b9a7c 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md @@ -1,7 +1,7 @@ --- title: How to create a connection croup with user-published and globally published packages (Windows 10) description: How to create a connection croup with user-published and globally published packages. -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-create-a-connection-group.md b/windows/application-management/app-v/appv-create-a-connection-group.md index 9f08b25b41..509167b5f4 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group.md +++ b/windows/application-management/app-v/appv-create-a-connection-group.md @@ -1,7 +1,7 @@ --- title: How to create a connection group (Windows 10) -description: How to create a connection group with the App-V Management Console. -author: lomayor +description: Learn how to create a connection group with the App-V Management Console and where to find information about managing connection groups. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md index 273b520a59..42081976ef 100644 --- a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md +++ b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md @@ -1,7 +1,7 @@ --- title: How to create a custom configuration file by using the App-V Management Console (Windows 10) description: How to create a custom configuration file by using the App-V Management Console. -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md index fb72cbc762..d6a62ddf52 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md @@ -1,7 +1,7 @@ --- title: How to create a package accelerator by using Windows PowerShell (Windows 10) -description: How to create a package accelerator with Windows PowerShell. -author: lomayor +description: Learn how to create an App-v Package Accelerator by using Windows PowerShell. App-V Package Accelerators automatically sequence large, complex applications. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator.md b/windows/application-management/app-v/appv-create-a-package-accelerator.md index 7f2ec6c3c5..d2c69c8afb 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator.md @@ -1,7 +1,7 @@ --- title: How to create a package accelerator (Windows 10) -description: How to create a package accelerator. -author: lomayor +description: Learn how to create App-V Package Accelerators to automatically generate new virtual application packages. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md index c6983aab02..200f0481e4 100644 --- a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md @@ -1,7 +1,7 @@ --- title: How to create a virtual application package using an App-V Package Accelerator (Windows 10) description: How to create a virtual application package using an App-V Package Accelerator. -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-create-and-use-a-project-template.md b/windows/application-management/app-v/appv-create-and-use-a-project-template.md index 54aa412604..0af67b340d 100644 --- a/windows/application-management/app-v/appv-create-and-use-a-project-template.md +++ b/windows/application-management/app-v/appv-create-and-use-a-project-template.md @@ -1,7 +1,7 @@ --- title: Create and apply an App-V project template to a sequenced App-V package (Windows 10) description: Steps for how to create and apply an App-V project template (.appvt) to a sequenced App-V package. -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md index 197cff66cb..30debd58c4 100644 --- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md +++ b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md @@ -1,7 +1,7 @@ --- title: Creating and managing App-V virtualized applications (Windows 10) -description: Creating and managing App-V virtualized applications -author: lomayor +description: Create and manage App-V virtualized applications to monitor and record the installation process for an application to be run as a virtualized application. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library @@ -18,7 +18,7 @@ ms.topic: article After you have properly deployed the Microsoft Application Virtualization (App-V) sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application. -For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](). +For more information about configuring the App-V sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx). >[!NOTE] >The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. diff --git a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md index aae5ad7d4c..ebbdf508c3 100644 --- a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md @@ -1,7 +1,7 @@ --- title: How to customize virtual application extensions for a specific AD group by using the Management Console (Windows 10) description: How to customize virtual application extensions for a specific AD group by using the Management Console. -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-delete-a-connection-group.md b/windows/application-management/app-v/appv-delete-a-connection-group.md index 9747e3066d..60a5518fe9 100644 --- a/windows/application-management/app-v/appv-delete-a-connection-group.md +++ b/windows/application-management/app-v/appv-delete-a-connection-group.md @@ -1,7 +1,7 @@ --- title: How to delete a connection group (Windows 10) -description: How to delete a connection group. -author: lomayor +description: Learn how to delete an existing App-V connection group in the App-V Management Console and where to find information about managing connection groups. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md index 3b5027c30b..27a1adeb35 100644 --- a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md @@ -1,7 +1,7 @@ --- title: How to delete a package in the Management Console (Windows 10) -description: How to delete a package in the Management Console. -author: lomayor +description: Learn how to delete a package in the App-V Management Console and where to find information about operations for App-V. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md index fa0a2dca44..f7ccc22f58 100644 --- a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md +++ b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md @@ -1,7 +1,7 @@ --- title: How to Deploy the App-V Databases by Using SQL Scripts (Windows 10) -description: How to Deploy the App-V Databases by Using SQL Scripts -author: lomayor +description: Learn how to use SQL scripts to install the App-V databases and upgrade the App-V databases to a later version. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md index 0c013faf96..29719a0f8c 100644 --- a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md @@ -1,7 +1,7 @@ --- title: How to deploy App-V packages using electronic software distribution (Windows 10) -description: How to deploy App-V packages using electronic software distribution. -author: lomayor +description: Learn how use an electronic software distribution (ESD) system to deploy App-V virtual applications to App-V clients. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md index 9ee527503b..f2c8cc0af3 100644 --- a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md @@ -1,7 +1,7 @@ --- title: How to Deploy the App-V Server Using a Script (Windows 10) -description: How to Deploy the App-V Server Using a Script -author: lomayor +description: 'Learn how to deploy the App-V server by using a script (appv_server_setup.exe) from the command line.' +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server.md b/windows/application-management/app-v/appv-deploy-the-appv-server.md index d30cf24d63..ec7bcac622 100644 --- a/windows/application-management/app-v/appv-deploy-the-appv-server.md +++ b/windows/application-management/app-v/appv-deploy-the-appv-server.md @@ -1,7 +1,7 @@ --- title: How to Deploy the App-V Server (Windows 10) -description: How to Deploy the App-V Server in App-V for Windows 10 -author: lomayor +description: Use these instructions to deploy the Application Virtualization (App-V) Server in App-V for Windows 10. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploying-appv.md b/windows/application-management/app-v/appv-deploying-appv.md index d71a0f0476..5061447ca8 100644 --- a/windows/application-management/app-v/appv-deploying-appv.md +++ b/windows/application-management/app-v/appv-deploying-appv.md @@ -1,7 +1,7 @@ --- title: Deploying App-V (Windows 10) -description: Deploying App-V -author: lomayor +description: App-V supports several different deployment options. Learn how to complete App-V deployment at different stages in your App-V deployment. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md index 2e77179b7c..143b808f76 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md @@ -1,7 +1,7 @@ --- title: Deploying Microsoft Office 2010 by Using App-V (Windows 10) -description: Deploying Microsoft Office 2010 by Using App-V -author: lomayor +description: Create Office 2010 packages for Microsoft Application Virtualization (App-V) using the App-V Sequencer or the App-V Package Accelerator. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md index 4379625ee0..d4567acef0 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md @@ -1,7 +1,7 @@ --- title: Deploying Microsoft Office 2013 by Using App-V (Windows 10) -description: Deploying Microsoft Office 2013 by Using App-V -author: lomayor +description: Use Application Virtualization (App-V) to deliver Microsoft Office 2013 as a virtualized application to computers in your organization. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md index e90fc8be78..5a7bb4a95a 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md @@ -1,7 +1,7 @@ --- title: Deploying Microsoft Office 2016 by using App-V (Windows 10) -description: Deploying Microsoft Office 2016 by using App-V -author: lomayor +description: Use Application Virtualization (App-V) to deliver Microsoft Office 2016 as a virtualized application to computers in your organization. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md index 37adcaae5e..5e3c484a69 100644 --- a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md @@ -1,7 +1,7 @@ --- title: Deploying App-V packages by using electronic software distribution (ESD) description: Deploying App-V packages by using electronic software distribution (ESD) -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md index 4edf732dd1..15f8f520d4 100644 --- a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md +++ b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md @@ -1,7 +1,7 @@ --- title: Deploying the App-V Sequencer and configuring the client (Windows 10) -description: Deploying the App-V Sequencer and configuring the client -author: lomayor +description: Learn how to deploy the App-V Sequencer and configure the client by using the ADMX template and Group Policy. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deploying-the-appv-server.md b/windows/application-management/app-v/appv-deploying-the-appv-server.md index 576764fb91..fad40ca584 100644 --- a/windows/application-management/app-v/appv-deploying-the-appv-server.md +++ b/windows/application-management/app-v/appv-deploying-the-appv-server.md @@ -1,7 +1,7 @@ --- title: Deploying the App-V Server (Windows 10) -description: Deploying the App-V Server in App-V for Windows 10 -author: lomayor +description: Learn how to deploy the Application Virtualization (App-V) Server in App-V for Windows 10 by using different deployment configurations described in this article. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md index bb97e27472..e64dfcb45c 100644 --- a/windows/application-management/app-v/appv-deployment-checklist.md +++ b/windows/application-management/app-v/appv-deployment-checklist.md @@ -1,7 +1,7 @@ --- title: App-V Deployment Checklist (Windows 10) -description: App-V Deployment Checklist -author: lomayor +description: Use the App-V deployment checklist to understand the recommended steps and items to consider when deploying App-V features. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-dynamic-configuration.md b/windows/application-management/app-v/appv-dynamic-configuration.md index 13a82055b6..fac027c816 100644 --- a/windows/application-management/app-v/appv-dynamic-configuration.md +++ b/windows/application-management/app-v/appv-dynamic-configuration.md @@ -1,7 +1,7 @@ --- title: About App-V Dynamic Configuration (Windows 10) -description: About App-V Dynamic Configuration -author: lomayor +description: Learn how to create or edit an existing Application Virtualization (App-V) dynamic configuration file. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md index 656f0264ce..013c9bf60d 100644 --- a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md @@ -1,7 +1,7 @@ --- title: How to Enable Only Administrators to Publish Packages by Using an ESD (Windows 10) -description: How to Enable Only Administrators to Publish Packages by Using an ESD -author: lomayor +description: Learn how to enable only administrators to publish packages by bsing an electronic software delivery (ESD). +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md index 39a072c558..ba86d9400f 100644 --- a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md +++ b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md @@ -1,7 +1,7 @@ --- title: How to Enable Reporting on the App-V Client by Using Windows PowerShell (Windows 10) description: How to Enable Reporting on the App-V Client by Using Windows PowerShell -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md index d9644226fb..e9352f15ee 100644 --- a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md +++ b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md @@ -1,7 +1,7 @@ --- title: Enable the App-V in-box client (Windows 10) -description: How to enable the App-V in-box client installed with Windows 10. -author: lomayor +description: Learn how to enable the Microsoft Application Virtualization (App-V) in-box client installed with Windows 10. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-evaluating-appv.md b/windows/application-management/app-v/appv-evaluating-appv.md index df7f76ca07..c5d8ac6964 100644 --- a/windows/application-management/app-v/appv-evaluating-appv.md +++ b/windows/application-management/app-v/appv-evaluating-appv.md @@ -1,7 +1,7 @@ --- title: Evaluating App-V (Windows 10) -description: Evaluating App-V for Windows 10 -author: lomayor +description: Learn how to evaluate App-V for Windows 10 in a lab environment before deploying into a production environment. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-for-windows.md b/windows/application-management/app-v/appv-for-windows.md index 459032925c..d089cb3371 100644 --- a/windows/application-management/app-v/appv-for-windows.md +++ b/windows/application-management/app-v/appv-for-windows.md @@ -1,7 +1,7 @@ --- title: Application Virtualization (App-V) (Windows 10) -description: Application Virtualization (App-V) -author: lomayor +description: See various topics that can help you administer Application Virtualization (App-V) and its components. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-getting-started.md b/windows/application-management/app-v/appv-getting-started.md index 1b1f6592d5..8fc9117868 100644 --- a/windows/application-management/app-v/appv-getting-started.md +++ b/windows/application-management/app-v/appv-getting-started.md @@ -1,7 +1,7 @@ --- title: Getting Started with App-V (Windows 10) -description: Getting Started with App-V for Windows 10 -author: lomayor +description: Get started with Microsoft Application Virtualization (App-V) for Windows 10. App-V for Windows 10 delivers Win32 applications to users as virtual applications. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-high-level-architecture.md b/windows/application-management/app-v/appv-high-level-architecture.md index ab25607096..cf81569563 100644 --- a/windows/application-management/app-v/appv-high-level-architecture.md +++ b/windows/application-management/app-v/appv-high-level-architecture.md @@ -1,7 +1,7 @@ --- title: High-level architecture for App-V (Windows 10) -description: High-level Architecture for App-V. -author: lomayor +description: Use the information in this article to simplify your Microsoft Application Virtualization (App-V) deployment. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md index 82b6545be6..fed3c5c9ec 100644 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -1,7 +1,7 @@ --- title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell (Windows 10) description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md index ffffedff20..2b99c85da9 100644 --- a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -1,7 +1,7 @@ --- title: How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services (Windows 10) description: How to install the Management and Reporting Databases on separate computers from the Management and Reporting Services. -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md index 44e1be2801..f8c387ecb8 100644 --- a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md @@ -1,7 +1,7 @@ --- title: How to install the Management Server on a Standalone Computer and Connect it to the Database (Windows 10) description: How to install the Management Server on a Standalone Computer and Connect it to the Database -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md index 7209027bb8..df6dc6c726 100644 --- a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md @@ -1,7 +1,7 @@ --- title: Install the Publishing Server on a Remote Computer (Windows 10) -description: How to Install the App-V Publishing Server on a Remote Computer -author: lomayor +description: Use the procedures in this article to install the Microsoft Application Virtualization (App-V) publishing server on a separate computer. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library @@ -38,7 +38,7 @@ Use the following procedure to install the publishing server on a separate compu 3. Enter the server name and a description (if required), then select **Add**. 9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle that package to an AD group, then publish it. Using an internet browser, open the following URL: https://publishingserver:pubport. If the server is running correctly, information like the following example should appear. - ```SQL + ```xml diff --git a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md index d476fda616..17251170f3 100644 --- a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -1,7 +1,7 @@ --- title: How to install the Reporting Server on a standalone computer and connect it to the database (Windows 10) description: How to install the App-V Reporting Server on a Standalone Computer and Connect it to the Database -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md index 93180520e7..0c3ae2e9a0 100644 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ b/windows/application-management/app-v/appv-install-the-sequencer.md @@ -1,7 +1,7 @@ --- title: Install the App-V Sequencer (Windows 10) -description: Install the App-V Sequencer -author: lomayor +description: Learn how to install the App-V Sequencer to convert Win32 applications into virtual packages for deployment to user devices. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index bc8cd9361e..4c3530ae6b 100644 --- a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -1,7 +1,7 @@ --- title: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help (Windows 10) description: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-maintaining-appv.md b/windows/application-management/app-v/appv-maintaining-appv.md index 3b54154537..ca2c8811c9 100644 --- a/windows/application-management/app-v/appv-maintaining-appv.md +++ b/windows/application-management/app-v/appv-maintaining-appv.md @@ -1,7 +1,7 @@ --- title: Maintaining App-V (Windows 10) -description: Maintaining App-V -author: lomayor +description: After you have deployed App-V for Windows 10, you can use the following information to maintain the App-V infrastructure. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md index c7f1214405..78190c4689 100644 --- a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md @@ -1,7 +1,7 @@ --- title: How to manage App-V packages running on a stand-alone computer by using Windows PowerShell (Windows 10) description: How to manage App-V packages running on a stand-alone computer by using Windows PowerShell. -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md index d4e01266f8..d6e03d17a6 100644 --- a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md @@ -1,7 +1,7 @@ --- title: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell (Windows 10) description: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-managing-connection-groups.md b/windows/application-management/app-v/appv-managing-connection-groups.md index 5a94cbc421..f308ee42da 100644 --- a/windows/application-management/app-v/appv-managing-connection-groups.md +++ b/windows/application-management/app-v/appv-managing-connection-groups.md @@ -1,7 +1,7 @@ --- title: Managing Connection Groups (Windows 10) -description: Managing Connection Groups -author: lomayor +description: Connection groups can allow administrators to manage packages independently and avoid having to add the same application multiple times to a client computer. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md index dff030f470..63e362cc4c 100644 --- a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md @@ -1,7 +1,7 @@ --- title: Migrating to App-V from a Previous Version (Windows 10) -description: Migrating to App-V for Windows 10 from a previous version -author: lomayor +description: Learn how to migrate to Microsoft Application Virtualization (App-V) for Windows 10 from a previous version. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md index e2cb4eca48..6a6da20d55 100644 --- a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md +++ b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md @@ -1,7 +1,7 @@ --- title: How to Modify an Existing Virtual Application Package (Windows 10) -description: How to Modify an Existing Virtual Application Package -author: lomayor +description: Learn how to modify an existing virtual application package and add a new application to an existing virtual application package. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md index 7fe2f3896f..9b7fa5dc90 100644 --- a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md +++ b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md @@ -1,7 +1,7 @@ --- title: How to Modify Client Configuration by Using Windows PowerShell (Windows 10) -description: How to Modify Client Configuration by Using Windows PowerShell -author: lomayor +description: Learn how to modify the Application Virtualization (App-V) client configuration by using Windows PowerShell. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md index 5305207fe6..8d46833f6d 100644 --- a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md +++ b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md @@ -1,7 +1,7 @@ --- title: How to Move the App-V Server to Another Computer (Windows 10) -description: How to Move the App-V Server to Another Computer -author: lomayor +description: Learn how to create a new management server console in your environment and learn how to connect it to the App-V database. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-operations.md b/windows/application-management/app-v/appv-operations.md index c45c9ab9cf..a916d38776 100644 --- a/windows/application-management/app-v/appv-operations.md +++ b/windows/application-management/app-v/appv-operations.md @@ -1,7 +1,7 @@ --- title: Operations for App-V (Windows 10) -description: Operations for App-V -author: lomayor +description: Learn about the various types of App-V administration and operating tasks that are typically performed by an administrator. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md index 65ccf02292..d7c8078b33 100644 --- a/windows/application-management/app-v/appv-performance-guidance.md +++ b/windows/application-management/app-v/appv-performance-guidance.md @@ -1,7 +1,7 @@ --- title: Performance Guidance for Application Virtualization (Windows 10) -description: Performance Guidance for Application Virtualization -author: lomayor +description: Learn how to configure App-V for optimal performance, optimize virtual app packages, and provide a better user experience with RDS and VDI. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md index edaf668a89..e2d9776c2c 100644 --- a/windows/application-management/app-v/appv-planning-checklist.md +++ b/windows/application-management/app-v/appv-planning-checklist.md @@ -1,7 +1,7 @@ --- title: App-V Planning Checklist (Windows 10) -description: App-V Planning Checklist -author: lomayor +description: Learn about the recommended steps and items to consider when planning an Application Virtualization (App-V) deployment. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md index c9c570009a..0b9b995319 100644 --- a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md +++ b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md @@ -1,7 +1,7 @@ --- title: Planning to Use Folder Redirection with App-V (Windows 10) -description: Planning to Use Folder Redirection with App-V -author: lomayor +description: Learn about folder redirection with App-V. Folder redirection enables users and administrators to redirect the path of a folder to a new location. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md index eaf7729f22..94b436fd53 100644 --- a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for the App-V Server Deployment (Windows 10) -description: Planning for the App-V 5.1 Server Deployment -author: lomayor +description: Learn what you need to know so you can plan for the Microsoft Application Virtualization (App-V) 5.1 server deployment. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-planning-for-appv.md b/windows/application-management/app-v/appv-planning-for-appv.md index d54d848a2c..39d5199ea8 100644 --- a/windows/application-management/app-v/appv-planning-for-appv.md +++ b/windows/application-management/app-v/appv-planning-for-appv.md @@ -1,7 +1,7 @@ --- title: Planning for App-V (Windows 10) -description: Planning for App-V -author: lomayor +description: Use the information in this article to plan to deploy App-V without disrupting your existing network or user experience. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md index af66e545e4..9f01735aab 100644 --- a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md +++ b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md @@ -1,7 +1,7 @@ --- title: Planning for High Availability with App-V Server -description: Planning for High Availability with App-V Server -author: lomayor +description: Learn what you need to know so you can plan for high availability with Application Virtualization (App-V) server. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library @@ -18,7 +18,7 @@ ms.topic: article Microsoft Application Virtualization (App-V) system configurations can take advantage of options that maintain a high available service level. -The following sections will he following sections to help you understand the options to deploy App-V in a highly available configuration. +The following sections will help you understand the options to deploy App-V in a highly available configuration. ## Support for Microsoft SQL Server clustering diff --git a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md index 4fa3630f7f..52019b0496 100644 --- a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for the App-V Sequencer and Client Deployment (Windows 10) -description: Planning for the App-V Sequencer and Client Deployment -author: lomayor +description: Learn what you need to do to plan for the App-V Sequencer and Client deployment, and where to find additional information about the deployment process. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md index da919b1dbf..32b20fa1e6 100644 --- a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md +++ b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md @@ -1,7 +1,7 @@ --- title: Planning for Deploying App-V with Office (Windows 10) -description: Planning for Using App-V with Office -author: lomayor +description: Use the information in this article to plan how to deploy Office within Microsoft Application Virtualization (App-V). +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md index 49e7266314..10fd13f4cc 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy App-V with an Electronic Software Distribution System (Windows 10) description: Planning to Deploy App-V with an Electronic Software Distribution System -author: lomayor +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv.md b/windows/application-management/app-v/appv-planning-to-deploy-appv.md index ee9e0b73a9..f08a2b2b44 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy App-V (Windows 10) -description: Planning to Deploy App-V -author: lomayor +description: Learn about the different deployment configurations and requirements to consider before you deploy App-V for Windows 10. +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/app-v/appv-preparing-your-environment.md b/windows/application-management/app-v/appv-preparing-your-environment.md index 57989881e0..991209bd1b 100644 --- a/windows/application-management/app-v/appv-preparing-your-environment.md +++ b/windows/application-management/app-v/appv-preparing-your-environment.md @@ -1,13 +1,13 @@ --- title: Preparing Your Environment for App-V (Windows 10) -description: Preparing Your Environment for App-V -author: lomayor +description: Use this info to prepare for deployment configurations and prerequisites for Microsoft Application Virtualization (App-V). ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: +author: dansimp manager: dansimp ms.author: dansimp ms.topic: article diff --git a/windows/application-management/app-v/appv-prerequisites.md b/windows/application-management/app-v/appv-prerequisites.md index bc458a3f94..652eabd063 100644 --- a/windows/application-management/app-v/appv-prerequisites.md +++ b/windows/application-management/app-v/appv-prerequisites.md @@ -1,6 +1,6 @@ --- title: App-V Prerequisites (Windows 10) -description: App-V Prerequisites +description: Learn about the prerequisites you need before you begin installing Application Virtualization (App-V). author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-publish-a-connection-group.md b/windows/application-management/app-v/appv-publish-a-connection-group.md index 41d35e29a0..e48f4c43c6 100644 --- a/windows/application-management/app-v/appv-publish-a-connection-group.md +++ b/windows/application-management/app-v/appv-publish-a-connection-group.md @@ -1,6 +1,6 @@ --- title: How to Publish a Connection Group (Windows 10) -description: How to Publish a Connection Group +description: Learn how to publish a connection group to computers that run the Application Virtualization (App-V) client. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md index cd4469abe5..565f150699 100644 --- a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md @@ -1,6 +1,6 @@ --- title: How to publish a package by using the Management console (Windows 10) -description: How to publish a package by using the Management console. +description: Learn how the Management console in App-V can help you enable admin controls as well as publish App-V packages. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-reporting.md b/windows/application-management/app-v/appv-reporting.md index 57a4526ecf..41c995543f 100644 --- a/windows/application-management/app-v/appv-reporting.md +++ b/windows/application-management/app-v/appv-reporting.md @@ -1,6 +1,6 @@ --- title: About App-V Reporting (Windows 10) -description: About App-V Reporting +description: Learn how the App-V reporting feature collects information about computers running the App-V client and virtual application package usage. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md index b1a6caca2c..3138fa3ab3 100644 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md @@ -44,7 +44,7 @@ Each method accomplishes essentially the same task, but some methods may be bett To add a locally installed application to a package or to a connection group’s virtual environment, you add a subkey to the `RunVirtual` registry key in the Registry Editor, as described in the following sections. -There is no Group Policy setting available to manage this registry key, so you have to use Microsoft Endpoint Configuration Manager or another electronic software distribution (ESD) system, or manually edit the registry. +There is no Group Policy setting available to manage this registry key, so you have to use Microsoft Endpoint Manager or another electronic software distribution (ESD) system, or manually edit the registry. Starting with App-V 5.0 SP3, when using RunVirtual, you can publish packages globally or to the user. diff --git a/windows/application-management/app-v/appv-security-considerations.md b/windows/application-management/app-v/appv-security-considerations.md index ab6c1c4c32..d2dd484a97 100644 --- a/windows/application-management/app-v/appv-security-considerations.md +++ b/windows/application-management/app-v/appv-security-considerations.md @@ -1,6 +1,6 @@ --- title: App-V Security Considerations (Windows 10) -description: App-V Security Considerations +description: Learn about accounts and groups, log files, and other security-related considerations for Microsoft Application Virtualization (App-V). author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-sequence-a-new-application.md b/windows/application-management/app-v/appv-sequence-a-new-application.md index c3e16261db..2eb919d9b5 100644 --- a/windows/application-management/app-v/appv-sequence-a-new-application.md +++ b/windows/application-management/app-v/appv-sequence-a-new-application.md @@ -1,6 +1,6 @@ --- title: Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10) -description: How to manually sequence a new app using the App-V Sequencer +description: Learn how to manually sequence a new app by using the App-V Sequencer that's included with the Windows ADK. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md index 349ead11a5..2a353b9121 100644 --- a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md +++ b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md @@ -1,6 +1,6 @@ --- title: How to sequence a package by using Windows PowerShell (Windows 10) -description: How to sequence a package by using Windows PowerShell +description: Learn how to sequence a new Microsoft Application Virtualization (App-V) package by using Windows PowerShell. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md index ebab019584..340244864b 100644 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ b/windows/application-management/app-v/appv-supported-configurations.md @@ -1,6 +1,6 @@ --- title: App-V Supported Configurations (Windows 10) -description: App-V Supported Configurations +description: Learn the requirements to install and run App-V supported configurations in your Windows 10 environment. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -14,7 +14,7 @@ ms.topic: article --- # App-V Supported Configurations ->Applies to: Windows 10, version 1607; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 +>Applies to: Windows 10, version 1607; Window Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 (Extended Security Update) This topic specifies the requirements to install and run App-V in your Windows 10 environment. For information about prerequisite software such as the .NET Framework, see [App-V prerequisites](appv-prerequisites.md). @@ -34,7 +34,7 @@ The App-V server does not support the following scenarios: ### Management server operating system requirements -You can install the App-V Management server on a server running Windows Server 2008 R2 with SP1 or later. +You can install the App-V Management server on a server running Windows Server 2008 R2 with SP1 (Extended Security Update) or later. >[!IMPORTANT] >Deploying a Management server role to a computer with Remote Desktop Services enabled is not supported. @@ -104,17 +104,7 @@ Similarly, the App-V Remote Desktop Services (RDS) client is included with Windo ## Sequencer system requirements -The following table lists the operating systems that the App-V Sequencer installation supports. - -|Operating system|Service pack|System architecture| -|---|---|---| -|Microsoft Windows Server 2012 R2||64-bit| -|Microsoft Windows Server 2012||64-bit| -|Microsoft Windows Server 2008 R2|SP1|64-bit| -|Microsoft Windows 10||32-bit and 64-bit| -|Microsoft Windows 8.1||32-bit and 64-bit| -|Microsoft Windows 8||32-bit and 64-bit| -|Microsoft Windows 7|SP1|32-bit and 64-bit| +Sequencer is now part of the Windows Assessment and Deployment Kit (Windows ADK). [Download the latest Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install) that is recommended for your version of the Windows OS. ### Sequencer hardware requirements diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md index e0f6e0f48d..8cd6653c77 100644 --- a/windows/application-management/app-v/appv-technical-reference.md +++ b/windows/application-management/app-v/appv-technical-reference.md @@ -1,6 +1,6 @@ --- title: Technical Reference for App-V (Windows 10) -description: Technical Reference for App-V +description: Learn strategy and context for a number of performance optimization practices in this techincal reference for Application Virtualization (App-V). author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-troubleshooting.md b/windows/application-management/app-v/appv-troubleshooting.md index fd794d1044..29240949b5 100644 --- a/windows/application-management/app-v/appv-troubleshooting.md +++ b/windows/application-management/app-v/appv-troubleshooting.md @@ -1,6 +1,6 @@ --- title: Troubleshooting App-V (Windows 10) -description: Troubleshooting App-V +description: Learn how to find information about troubleshooting Application Virtualization (App-V) and information about other App-V topics. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index 4aedf60d24..8660d86846 100644 --- a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -1,6 +1,6 @@ --- title: Upgrading to App-V for Windows 10 from an existing installation (Windows 10) -description: Upgrading to App-V for Windows 10 from an existing installation +description: Learn about upgrading to Application Virtualization (App-V) for Windows 10 from an existing installation. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-using-the-client-management-console.md b/windows/application-management/app-v/appv-using-the-client-management-console.md index b6691c2fc5..7dc0a15d0a 100644 --- a/windows/application-management/app-v/appv-using-the-client-management-console.md +++ b/windows/application-management/app-v/appv-using-the-client-management-console.md @@ -1,6 +1,6 @@ --- title: Using the App-V Client Management Console (Windows 10) -description: Using the App-V Client Management Console +description: Learn how to use the Application Virtualization (App-V) client management console to manage packages on the computer running the App-V client. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md index eac57684c6..acbd96ca6e 100644 --- a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md +++ b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md @@ -1,6 +1,6 @@ --- title: Viewing App-V Server Publishing Metadata (Windows 10) -description: Viewing App-V Server Publishing Metadata +description: Use this procedure to view App-V Server publishing metadata, which can help you resolve publishing-related issues. author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 7f0c586ed7..31da1afc51 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -2,7 +2,7 @@ title: Windows 10 - Apps ms.reviewer: manager: dansimp -description: What are Windows, UWP, and Win32 apps +description: Use this article to understand the different types of apps that run on Windows 10, such as UWP and Win32 apps. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -39,53 +39,53 @@ You can list all provisioned Windows apps with this PowerShell command: Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName ``` -Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, and 1909. +Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, 1909, and 2004. -| Package name | App name | 1803 | 1809 | 1903 | 1909 | Uninstall through UI? | -|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------|:----:|:----:|:----:|:----:|:---------------------:| -| Microsoft.3DBuilder | [3D Builder](ms-windows-store://pdp/?PFN=Microsoft.3DBuilder_8wekyb3d8bbwe) | | | | | Yes | -| Microsoft.BingWeather | [MSN Weather](ms-windows-store://pdp/?PFN=Microsoft.BingWeather_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.DesktopAppInstaller | [App Installer](ms-windows-store://pdp/?PFN=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe) | x | x | x | x | Via Settings App | -| Microsoft.GetHelp | [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Getstarted | [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.HEIFImageExtension | [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.Messaging | [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Microsoft3DViewer | [Mixed Reality Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.MicrosoftOfficeHub | [My Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.MicrosoftSolitaireCollection | [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.MicrosoftStickyNotes | [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.MixedReality.Portal | [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.MSPaint | [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Office.OneNote | [OneNote](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | Yes | -| Microsoft.OneConnect | [Paid Wi-Fi & Cellular](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Outlook.DesktopIntegrationServices | | | | | x | | -| Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.ScreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.SkypeApp | [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | x | x | x | x | No | -| Microsoft.StorePurchaseApp | [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.VP9VideoExtensions | | | x | x | x | No | -| Microsoft.Wallet | [Microsoft Pay](ms-windows-store://pdp/?PFN=Microsoft.Wallet_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WebMediaExtensions | [Web Media Extensions](ms-windows-store://pdp/?PFN=Microsoft.WebMediaExtensions_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WebpImageExtension | [Webp Image Extension](ms-windows-store://pdp/?PFN=Microsoft.WebpImageExtension_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.Windows.Photos | [Microsoft Photos](ms-windows-store://pdp/?PFN=Microsoft.Windows.Photos_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsAlarms | [Windows Alarms & Clock](ms-windows-store://pdp/?PFN=Microsoft.WindowsAlarms_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsCalculator | [Windows Calculator](ms-windows-store://pdp/?PFN=Microsoft.WindowsCalculator_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsCamera | [Windows Camera](ms-windows-store://pdp/?PFN=Microsoft.WindowsCamera_8wekyb3d8bbwe) | x | x | x | x | No | -| microsoft.windowscommunicationsapps | [Mail and Calendar](ms-windows-store://pdp/?PFN=microsoft.windowscommunicationsapps_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsFeedbackHub | [Feedback Hub](ms-windows-store://pdp/?PFN=Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsMaps | [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsSoundRecorder | [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.WindowsStore | [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.Xbox.TCUI | [Xbox TCUI](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxApp | [Xbox](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxGameOverlay | [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxGamingOverlay | [Xbox Gaming Overlay](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxIdentityProvider | [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.XboxSpeechToTextOverlay | | x | x | x | x | No | -| Microsoft.YourPhone | [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.ZuneMusic | [Groove Music](ms-windows-store://pdp/?PFN=Microsoft.ZuneMusic_8wekyb3d8bbwe) | x | x | x | x | No | -| Microsoft.ZuneVideo | [Movies & TV](ms-windows-store://pdp/?PFN=Microsoft.ZuneVideo_8wekyb3d8bbwe) | x | x | x | x | No | +| Package name | App name | 1803 | 1809 | 1903 | 1909 | 2004 | Uninstall through UI? | +|----------------------------------------------|--------------------------------------------------------------------------------------------------------------------|:----:|:----:|:----:|:----:|:----:|:---------------------:| +| Microsoft.3DBuilder | [3D Builder](ms-windows-store://pdp/?PFN=Microsoft.3DBuilder_8wekyb3d8bbwe) | | | | | | Yes | +| Microsoft.BingWeather | [MSN Weather](ms-windows-store://pdp/?PFN=Microsoft.BingWeather_8wekyb3d8bbwe) | x | x | x | x | x | Yes | +| Microsoft.DesktopAppInstaller | [App Installer](ms-windows-store://pdp/?PFN=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe) | x | x | x | x | x | Via Settings App | +| Microsoft.GetHelp | [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Getstarted | [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.HEIFImageExtension | [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.Messaging | [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Microsoft3DViewer | [Mixed Reality Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.MicrosoftOfficeHub | [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | x | Yes | +| Microsoft.MicrosoftSolitaireCollection | [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | x | x | x | x | x | Yes | +| Microsoft.MicrosoftStickyNotes | [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.MixedReality.Portal | [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.MSPaint | [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Office.OneNote | [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | x | Yes | +| Microsoft.OneConnect | [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Outlook.DesktopIntegrationServices | | | | | x | x | | +| Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.ScreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.SkypeApp | [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | x | x | x | x | x | No | +| Microsoft.StorePurchaseApp | [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.VP9VideoExtensions | | | x | x | x | x | No | +| Microsoft.Wallet | [Microsoft Pay](ms-windows-store://pdp/?PFN=Microsoft.Wallet_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WebMediaExtensions | [Web Media Extensions](ms-windows-store://pdp/?PFN=Microsoft.WebMediaExtensions_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WebpImageExtension | [Webp Image Extension](ms-windows-store://pdp/?PFN=Microsoft.WebpImageExtension_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.Windows.Photos | [Microsoft Photos](ms-windows-store://pdp/?PFN=Microsoft.Windows.Photos_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsAlarms | [Windows Alarms & Clock](ms-windows-store://pdp/?PFN=Microsoft.WindowsAlarms_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsCalculator | [Windows Calculator](ms-windows-store://pdp/?PFN=Microsoft.WindowsCalculator_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsCamera | [Windows Camera](ms-windows-store://pdp/?PFN=Microsoft.WindowsCamera_8wekyb3d8bbwe) | x | x | x | x | x | No | +| microsoft.windowscommunicationsapps | [Mail and Calendar](ms-windows-store://pdp/?PFN=microsoft.windowscommunicationsapps_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsFeedbackHub | [Feedback Hub](ms-windows-store://pdp/?PFN=Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsMaps | [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsSoundRecorder | [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.WindowsStore | [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Xbox.TCUI | [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxApp | [Xbox Console Companion](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxGameOverlay | [Xbox Game Bar Plugin](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxGamingOverlay | [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxIdentityProvider | [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.XboxSpeechToTextOverlay | | x | x | x | x | x | No | +| Microsoft.YourPhone | [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | | x | x | x | x | No | +| Microsoft.ZuneMusic | [Groove Music](ms-windows-store://pdp/?PFN=Microsoft.ZuneMusic_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.ZuneVideo | [Movies & TV](ms-windows-store://pdp/?PFN=Microsoft.ZuneVideo_8wekyb3d8bbwe) | x | x | x | x | x | No | >[!NOTE] >The Store app can't be removed. If you want to remove and reinstall the Store app, you can only bring Store back by either restoring your system from a backup or resetting your system. Instead of removing the Store app, you should use group policies to hide or disable it. diff --git a/windows/application-management/change-history-for-application-management.md b/windows/application-management/change-history-for-application-management.md index fdb6834a7a..e7e6041a1d 100644 --- a/windows/application-management/change-history-for-application-management.md +++ b/windows/application-management/change-history-for-application-management.md @@ -1,6 +1,6 @@ --- title: Change history for Application management in Windows 10 (Windows 10) -description: View changes to documentation for application management in Windows 10. +description: View new release information and updated topics in the documentation for application management in Windows 10. keywords: ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index 09bd474c3e..460b8ecfdd 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -32,6 +32,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", @@ -43,7 +44,17 @@ "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Windows Application Management" + "titleSuffix": "Windows Application Management", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], + "searchScope": ["Windows 10"] }, "fileMetadata": {}, "template": [], diff --git a/windows/application-management/index.md b/windows/application-management/index.md index fef303c216..f9a00fdc84 100644 --- a/windows/application-management/index.md +++ b/windows/application-management/index.md @@ -1,6 +1,6 @@ --- title: Windows 10 application management -description: Windows 10 application management +description: Learn about managing applications in Windows 10 and Windows 10 Mobile clients, including how to remove background task resource restrictions. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index da98a12e3b..4414bb6e96 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -1,8 +1,8 @@ --- title: Enable or block Windows Mixed Reality apps in the enterprise (Windows 10) +description: Learn how to enable Windows Mixed Reality apps in WSUS or block the Windows Mixed Reality portal in enterprises. ms.reviewer: manager: dansimp -description: Learn how to enable or block Windows Mixed Reality apps. keyboards: ["mr", "mr portal", "mixed reality portal", "mixed reality"] ms.prod: w10 ms.mktglfcycl: manage @@ -13,7 +13,7 @@ ms.author: dansimp ms.topic: article --- -# Enable or block Windows Mixed Reality apps in the enterprise +# Enable or block Windows Mixed Reality apps in enterprises **Applies to** @@ -33,19 +33,21 @@ Organizations that use Windows Server Update Services (WSUS) must take action to 2. Windows Mixed Reality Feature on Demand (FOD) is downloaded from Windows Update. If access to Windows Update is blocked, you must manually install the Windows Mixed Reality FOD. - a. Download the FOD .cab file for [Windows 10, version 1903 and 1909](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](https://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). + 1. Download the FOD .cab file for [Windows 10, version 2004](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), [Windows 10, version 1903 and 1909](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](https://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). - >[!NOTE] - >You must download the FOD .cab file that matches your operating system version. + > [!NOTE] + > You must download the FOD .cab file that matches your operating system version. - b. Use `Add-Package` to add Windows Mixed Reality FOD to the image. + 1. Use `Dism` to add Windows Mixed Reality FOD to the image. - ```powershell - Add-Package - Dism /Online /add-package /packagepath:(path) - ``` + ```powershell + Dism /Online /Add-Package /PackagePath:(path) + ``` + + > [!NOTE] + > You must rename the FOD .CAB file to : **Microsoft-Windows-Holographic-Desktop-FOD-Package\~31bf3856ad364e35\~amd64\~\~.cab** - c. In **Settings** > **Update & Security** > **Windows Update**, select **Check for updates**. + 1. In **Settings** > **Update & Security** > **Windows Update**, select **Check for updates**. IT admins can also create [Side by side feature store (shared folder)](https://technet.microsoft.com/library/jj127275.aspx) to allow access to the Windows Mixed Reality FOD. diff --git a/windows/application-management/msix-app-packaging-tool.md b/windows/application-management/msix-app-packaging-tool.md index adcf842841..b1c60124ea 100644 --- a/windows/application-management/msix-app-packaging-tool.md +++ b/windows/application-management/msix-app-packaging-tool.md @@ -1,6 +1,6 @@ --- title: Repackage your existing win32 applications to the MSIX format. -description: Learn how to install and use the MSIX packaging tool. +description: Learn how to install and use the MSIX packaging tool to repackage your existing win32 applications to the MSIX format. keywords: ["MSIX", "application", "app", "win32", "packaging tool"] ms.prod: w10 ms.mktglfcycl: manage @@ -30,11 +30,11 @@ You can either run your installer interactively (through the UI) or create a pac - Windows 10, version 1809 (or later) - Participation in the Windows Insider Program (if you're using an Insider build) -- A valid Microsoft account (MSA) alias to access the app from the Microsoft Store +- A valid Microsoft work or school account to access the app from the Microsoft Store - Admin privileges on your PC account ### Get the app from the Microsoft Store -1. Use the MSA login associated with your Windows Insider Program credentials in the [Microsoft Store](https://www.microsoft.com/store/r/9N5LW3JBCXKF). +1. Use the Microsoft work or school account login associated with your Windows Insider Program credentials in the [Microsoft Store](https://www.microsoft.com/store/r/9N5LW3JBCXKF). 2. Open the product description page. 3. Click the install icon to begin installation. diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 1100a66787..4245e9fb23 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -1,6 +1,6 @@ --- title: Per-user services in Windows 10 and Windows Server -description: Learn about per-user services introduced in Windows 10. +description: Learn about per-user services, how to change the template service Startup Type, and manage per-user services through Group Policy and security templates. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index 2dc4591d51..7305ea48e2 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -1,6 +1,6 @@ --- title: Sideload LOB apps in Windows 10 (Windows 10) -description: Sideload line-of-business apps in Windows 10. +description: Learn how to sideload line-of-business (LOB) apps in Windows 10. When you sideload an app, you deploy a signed app package to a device. ms.assetid: C46B27D0-375B-4F7A-800E-21595CF1D53D ms.reviewer: manager: dansimp diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index b99a2d3ee4..aac950751a 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -1,5 +1,6 @@ # [Manage clients in Windows 10](index.md) ## [Administrative Tools in Windows 10](administrative-tools-in-windows-10.md) +### [Use Quick Assist to help users](quick-assist.md) ## [Create mandatory user profiles](mandatory-user-profile.md) ## [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 35c0f225b0..189e952207 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -29,7 +29,7 @@ The tools in the folder might vary depending on which edition of Windows you are ![Screenshot of folder of admin tools](images/admin-tools-folder.png) -These tools were included in previous versions of Windows and the associated documentation for each tool should help you use these tools in Windows 10. The following list links to documentation for each tool. +These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. @@ -43,6 +43,8 @@ These tools were included in previous versions of Windows and the associated doc - [ODBC Data Sources]( https://go.microsoft.com/fwlink/p/?LinkId=708494) - [Performance Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708495) - [Print Management](https://go.microsoft.com/fwlink/p/?LinkId=708496) +- [Recovery Drive](https://support.microsoft.com/help/4026852/windows-create-a-recovery-drive) +- [Registry Editor](https://docs.microsoft.com/windows/win32/sysinfo/registry) - [Resource Monitor](https://go.microsoft.com/fwlink/p/?LinkId=708497) - [Services](https://go.microsoft.com/fwlink/p/?LinkId=708498) - [System Configuration](https://go.microsoft.com/fwlink/p/?LinkId=708499) @@ -60,7 +62,3 @@ These tools were included in previous versions of Windows and the associated doc - - - - diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index 124846eb32..c27a78fa4c 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -2,7 +2,7 @@ title: Advanced Troubleshooting 802.1X Authentication ms.reviewer: manager: dansimp -description: Learn how 802.1X Authentication works +description: Troubleshoot authentication flow by learning how 802.1X Authentication works for wired and wireless clients. keywords: advanced troubleshooting, 802.1X authentication, troubleshooting, authentication, Wi-Fi ms.prod: w10 ms.mktglfcycl: @@ -17,17 +17,17 @@ ms.topic: troubleshooting ## Overview -This is a general troubleshooting of 802.1X wireless and wired clients. With 802.1X and wireless troubleshooting, it's important to know how the flow of authentication works, and then figuring out where it's breaking. It involves a lot of third party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. Since we don't make access points or switches, it won't be an end-to-end Microsoft solution. +This article includes general troubleshooting for 802.1X wireless and wired clients. While troubleshooting 802.1X and wireless, it's important to know how the flow of authentication works, and then figure out where it's breaking. It involves a lot of third-party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. We don't make access points or switches, so it's not an end-to-end Microsoft solution. ## Scenarios -This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 - 10 for clients, and Windows Server 2008 R2 - 2012 R2 for NPS. +This troubleshooting technique applies to any scenario in which wireless or wired connections with 802.1X authentication is attempted and then fails to establish. The workflow covers Windows 7 through Windows 10 for clients, and Windows Server 2008 R2 through Windows Server 2012 R2 for NPS. -## Known Issues +## Known issues None -## Data Collection +## Data collection See [Advanced troubleshooting 802.1X authentication data collection](data-collection-for-802-authentication.md). @@ -35,11 +35,11 @@ See [Advanced troubleshooting 802.1X authentication data collection](data-collec Viewing [NPS authentication status events](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735320(v%3dws.10)) in the Windows Security [event log](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc722404(v%3dws.11)) is one of the most useful troubleshooting methods to obtain information about failed authentications. -NPS event log entries contain information on the connection attempt, including the name of the connection request policy that matched the connection attempt and the network policy that accepted or rejected the connection attempt. If you are not seeing both success and failure events, see the section below on [NPS audit policy](#audit-policy). +NPS event log entries contain information about the connection attempt, including the name of the connection request policy that matched the connection attempt and the network policy that accepted or rejected the connection attempt. If you don't see both success and failure events, see the [NPS audit policy](#audit-policy) section later in this article. -Check Windows Security Event log on the NPS Server for NPS events corresponding to rejected ([event ID 6273](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735399(v%3dws.10))) or accepted ([event ID 6272](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735388(v%3dws.10))) connection attempts. +Check Windows Security Event log on the NPS Server for NPS events that correspond to rejected ([event ID 6273](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735399(v%3dws.10))) or accepted ([event ID 6272](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc735388(v%3dws.10))) connection attempts. -In the event message, scroll to the very bottom, and check the [Reason Code](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text associated with it. +In the event message, scroll to the very bottom, and then check the [Reason Code](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text that's associated with it. ![example of an audit failure](images/auditfailure.png) *Example: event ID 6273 (Audit Failure)*

    @@ -47,35 +47,35 @@ In the event message, scroll to the very bottom, and check the [Reason Code](htt ![example of an audit success](images/auditsuccess.png) *Example: event ID 6272 (Audit Success)*
    -‎The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, Wired AutoConfig operational log is equivalent one. +‎The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, the Wired AutoConfig operational log is an equivalent one. -On the client side, navigate to **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational** for wireless issues. For wired network access issues, navigate to **..\Wired-AutoConfig/Operational**. See the following example: +On the client side, go to **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational** for wireless issues. For wired network access issues, go to **..\Wired-AutoConfig/Operational**. See the following example: ![event viewer screenshot showing wired-autoconfig and WLAN autoconfig](images/eventviewer.png) -Most 802.1X authentication issues are due to problems with the certificate that is used for client or server authentication (e.g. invalid certificate, expiration, chain verification failure, revocation check failure, etc.). +Most 802.1X authentication issues are because of problems with the certificate that's used for client or server authentication. Examples include invalid certificate, expiration, chain verification failure, and revocation check failure. -First, validate the type of EAP method being used: +First, validate the type of EAP method that's used: ![eap authentication type comparison](images/comparisontable.png) -If a certificate is used for its authentication method, check if the certificate is valid. For server (NPS) side, you can confirm what certificate is being used from the EAP property menu. In **NPS snap-in**, go to **Policies** > **Network Policies**. Right click on the policy and select **Properties**. In the pop-up window, go to the **Constraints** tab and select the **Authentication Methods** section. +If a certificate is used for its authentication method, check whether the certificate is valid. For the server (NPS) side, you can confirm what certificate is being used from the EAP property menu. In **NPS snap-in**, go to **Policies** > **Network Policies**. Select and hold (or right-click) the policy, and then select **Properties**. In the pop-up window, go to the **Constraints** tab, and then select the **Authentication Methods** section. ![Constraints tab of the secure wireless connections properties](images/eappropertymenu.png) -The CAPI2 event log will be useful for troubleshooting certificate-related issues. -This log is not enabled by default. You can enable this log by expanding **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\CAPI2**, right-clicking **Operational** and then clicking **Enable Log**. +The CAPI2 event log is useful for troubleshooting certificate-related issues. +By default, this log isn't enabled. To enable this log, expand **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\CAPI2**, select and hold (or right-click) **Operational**, and then select **Enable Log**. ![screenshot of event viewer](images/capi.png) -The following article explains how to analyze CAPI2 event logs: +For information about how to analyze CAPI2 event logs, see [Troubleshooting PKI Problems on Windows Vista](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-vista/cc749296%28v=ws.10%29). -When troubleshooting complex 802.1X authentication issues, it is important to understand the 802.1X authentication process. The following figure is an example of wireless connection process with 802.1X authentication: +When troubleshooting complex 802.1X authentication issues, it's important to understand the 802.1X authentication process. Here's an example of wireless connection process with 802.1X authentication: -![authenticatior flow chart](images/authenticator_flow_chart.png) +![authenticator flow chart](images/authenticator_flow_chart.png) -If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both the client and the server (NPS) side, you can see a flow like the one below. Type **EAPOL** in the Display Filter in for a client side capture, and **EAP** for an NPS side capture. See the following examples: +If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both the client and the server (NPS) side, you can see a flow like the one below. Type **EAPOL** in the Display Filter for a client-side capture, and **EAP** for an NPS-side capture. See the following examples: ![client-side packet capture data](images/clientsidepacket_cap_data.png) *Client-side packet capture data*

    @@ -85,16 +85,16 @@ If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both ‎ > [!NOTE] -> If you have a wireless trace, you can also [view ETL files with network monitor](https://docs.microsoft.com/windows/desktop/ndf/using-network-monitor-to-view-etl-files) and apply the **ONEX_MicrosoftWindowsOneX** and **WLAN_MicrosoftWindowsWLANAutoConfig** Network Monitor filters. Follow the instructions under the **Help** menu in Network Monitor to load the reqired [parser](https://blogs.technet.microsoft.com/netmon/2010/06/04/parser-profiles-in-network-monitor-3-4/) if needed. See the example below. +> If you have a wireless trace, you can also [view ETL files with network monitor](https://docs.microsoft.com/windows/desktop/ndf/using-network-monitor-to-view-etl-files) and apply the **ONEX_MicrosoftWindowsOneX** and **WLAN_MicrosoftWindowsWLANAutoConfig** Network Monitor filters. If you need to load the required [parser](https://blogs.technet.microsoft.com/netmon/2010/06/04/parser-profiles-in-network-monitor-3-4/), see the instructions under the **Help** menu in Network Monitor. Here's an example: ![ETL parse](images/etl.png) ## Audit policy -NPS audit policy (event logging) for connection success and failure is enabled by default. If you find that one or both types of logging are disabled, use the following steps to troubleshoot. +By default, NPS audit policy (event logging) for connection success and failure is enabled. If you find that one or both types of logging are disabled, use the following steps to troubleshoot. View the current audit policy settings by running the following command on the NPS server: -``` +```console auditpol /get /subcategory:"Network Policy Server" ``` @@ -106,13 +106,12 @@ Logon/Logoff Network Policy Server Success and Failure -If it shows ‘No auditing’, you can run this command to enable it: - -``` +If it says, "No auditing," you can run this command to enable it: +```console auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable ``` -Even if audit policy appears to be fully enabled, it sometimes helps to disable and then re-enable this setting. You can also enable Network Policy Server logon/logoff auditing via Group Policy. The success/failure setting can be found under **Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff -> Audit Network Policy Server**. +Even if audit policy appears to be fully enabled, it sometimes helps to disable and then re-enable this setting. You can also enable Network Policy Server logon/logoff auditing by using Group Policy. To get to the success/failure setting, select **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Advanced Audit Policy Configuration** > **Audit Policies** > **Logon/Logoff** > **Audit Network Policy Server**. ## Additional references diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index 5986263a1e..29e2d01d30 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -1,6 +1,6 @@ --- title: Advanced troubleshooting for Windows boot problems -description: Learn how to troubleshoot when Windows is unable to boot +description: Learn to troubleshoot when Windows can't boot. This article includes advanced troubleshooting techniques intended for use by support agents and IT professionals. ms.prod: w10 ms.sitesec: library author: dansimp @@ -220,6 +220,9 @@ If Windows cannot load the system registry hive into memory, you must restore th If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced. +> [!NOTE] +> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start). + ## Kernel Phase If the system gets stuck during the kernel phase, you experience multiple symptoms or receive multiple error messages. These include, but are not limited to, the following: @@ -392,3 +395,6 @@ If the dump file shows an error that is related to a driver (for example, window 3. Navigate to C:\Windows\System32\Config\. 4. Rename the all five hives by appending ".old" to the name. 5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode. + +> [!NOTE] +> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start). diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md index c04dae805a..ce50bd2b54 100644 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md @@ -2,7 +2,7 @@ title: Advanced Troubleshooting Wireless Network Connectivity ms.reviewer: manager: dansimp -description: Learn how troubleshooting of establishing Wi-Fi connections +description: Learn how to troubleshoot Wi-Fi connections. Troubleshooting Wi-Fi connections requires understanding the basic flow of the Wi-Fi autoconnect state machine. keywords: troubleshooting, wireless network connectivity, wireless, Wi-Fi ms.prod: w10 ms.mktglfcycl: diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md index 5de58be176..69fa51d4e4 100644 --- a/windows/client-management/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/change-default-removal-policy-external-storage-media.md @@ -4,11 +4,11 @@ description: In Windows 10, version 1809, the default removal policy for externa ms.prod: w10 author: Teresa-Motiv ms.author: v-tea -ms.date: 12/13/2019 -ms.prod: w10 +ms.date: 11/25/2020 ms.topic: article ms.custom: - CI 111493 +- CI 125140 - CSSTroubleshooting audience: ITPro ms.localizationpriority: medium @@ -45,6 +45,13 @@ To change the policy for an external storage device: ![In Disk Management, right-click the device and click Properties.](./images/change-def-rem-policy-1.png) -6. Select **Policies**, and then select the policy you want to use. +6. Select **Policies**. + + > [!NOTE] + > Some recent versions of Windows may use a different arrangement of tabs in the disk properties dialog box. + > + > If you do not see the **Policies** tab, select **Hardware**, select the removable drive from the **All disk drives** list, and then select **Properties**. The **Policies** tab should now be available. + +7. Select the policy that you want to use. ![Policy options for disk management](./images/change-def-rem-policy-2.png) diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md index fa3febbd0f..3c7c213761 100644 --- a/windows/client-management/change-history-for-client-management.md +++ b/windows/client-management/change-history-for-client-management.md @@ -1,6 +1,6 @@ --- title: Change history for Client management (Windows 10) -description: View changes to documentation for client management in Windows 10. +description: Learn about new and updated topics in the Client management documentation for Windows 10 and Windows 10 Mobile. keywords: ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 54f8565c87..3e360929de 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -20,74 +20,67 @@ ms.topic: article **Applies to** -- Windows 10 +- Windows 10 -From its release, Windows 10 has supported remote connections to PCs that are joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/user-help/device-management-azuread-joined-devices-setup). +From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](https://docs.microsoft.com/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). ![Remote Desktop Connection client](images/rdp.png) ->[!TIP] ->Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session.](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics) - ## Set up -- Both PCs (local and remote) must be running Windows 10, version 1607 (or later). Remote connection to an Azure AD-joined PC that is running earlier versions of Windows 10 is not supported. -- Your local PC (where you are connecting from) must be either Azure AD joined or Hybrid Azure AD joined. Remote connection to an Azure AD joined PC from an unjoined device or a non-Windows 10 device is not supported. -Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC that you are using to connect to the remote PC. -- On the PC that you want to connect to: - 1. Open system properties for the remote PC. - 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. +- Both PCs (local and remote) must be running Windows 10, version 1607 or later. Remote connections to an Azure AD-joined PC running earlier versions of Windows 10 are not supported. +- Your local PC (where you are connecting from) must be either Azure AD-joined or Hybrid Azure AD-joined if using Windows 10, version 1607 and above, or [Azure AD registered](https://docs.microsoft.com/azure/active-directory/devices/concept-azure-ad-register) if using Windows 10, version 2004 and above. Remote connections to an Azure AD-joined PC from an unjoined device or a non-Windows 10 device are not supported. +- The local PC and remote PC must be in the same Azure AD tenant. Azure AD B2B guests are not supported for Remote desktop. + +Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC you are using to connect to the remote PC. + +- On the PC you want to connect to: + + 1. Open system properties for the remote PC. + + 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. ![Allow remote connections to this computer](images/allow-rdp.png) - 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users to connect to the PC, you must allow remote connections for the local **Authenticated Users** group. Click **Select Users**. - >[!NOTE] - >You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once and then running the following PowerShell cmdlet: - > - >`net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"`, where *FirstnameLastname* is the name of the user profile in C:\Users\, which is created based on DisplayName attribute in Azure AD. - > - > This command only works for AADJ device users already added to any of the local groups (administrators). - > Otherwise this command throws the below error. For example:
    - > for cloud only user: "There is no such global user or group : *name*"
    - > for synced user: "There is no such global user or group : *name*"
    - > - >In Windows 10, version 1709, the user does not have to sign in to the remote device first. - > - >In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices. + 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Users can be added either manually or through MDM policies: + + - Adding users manually + + You can specify individual Azure AD accounts for remote connections by running the following PowerShell cmdlet: + ```powershell + net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user" + ``` + where *the-UPN-attribute-of-your-user* is the name of the user profile in C:\Users\, which is created based on the DisplayName attribute in Azure AD. - 4. Enter **Authenticated Users**, then click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC. + This command only works for AADJ device users already added to any of the local groups (administrators). + Otherwise this command throws the below error. For example: + - for cloud only user: "There is no such global user or group : *name*" + - for synced user: "There is no such global user or group : *name*"
    - > [!TIP] - > When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant. + > [!NOTE] + > For devices running Windows 10, version 1703 or earlier, the user must sign in to the remote device first before attempting remote connections. + > + > Starting in Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices. + + - Adding users using policy + + Starting in Windows 10, version 2004, you can add users or Azure AD groups to the Remote Desktop Users using MDM policies as described in [How to manage the local administrators group on Azure AD joined devices](https://docs.microsoft.com/azure/active-directory/devices/assign-local-admin#manage-administrator-privileges-using-azure-ad-groups-preview). + + > [!TIP] + > When you connect to the remote PC, enter your account name in this format: AzureAD\yourloginid@domain.com. + + > [!NOTE] + > If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in this [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e). -> [!Note] -> If you cannot connect using Remote Desktop Connection 6.0, then you must turn off new features of RDP 6.0 and revert back to RDP 5.0 by changing a few changes in the RDP file. See the details in the [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e). - ## Supported configurations - -In organizations that have integrated Active Directory and Azure AD, you can connect from a Hybrid-joined PC to an Azure AD-joined PC using: -- Password -- Smartcards -- Windows Hello for Business, if the domain is managed by Microsoft Endpoint Configuration Manager +The table below lists the supported configurations for remotely connecting to an Azure AD-joined PC: -In organizations that have integrated Active Directory and Azure AD, you can connect from an Azure AD-joined PC to an AD-joined PC when the Azure AD-joined PC is on the corporate network using: +| Criteria | RDP from Azure AD registered device| RDP from Azure AD joined device| RDP from hybrid Azure AD joined device | +| - | - | - | - | +| **Client operating systems**| Windows 10, version 2004 and above| Windows 10, version 1607 and above | Windows 10, version 1607 and above | +| **Supported credentials**| Password, smartcard| Password, smartcard, Windows Hello for Business certificate trust | Password, smartcard, Windows Hello for Business certificate trust | -- Password -- Smartcards -- Windows Hello for Business, if the organization has a mobile device management (MDM) subscription. - -In organizations that have integrated Active Directory and Azure AD, you can connect from an Azure AD-joined PC to another Azure AD-joined PC using: - -- Password -- Smartcards -- Windows Hello for Business, with or without an MDM subscription. - - -In organizations using only Azure AD, you can connect from an Azure AD-joined PC to another Azure AD-joined PC using: - -- Password -- Windows Hello for Business, with or without an MDM subscription. > [!NOTE] > If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Azure Active Directory-joined PCs, it must [allow Public Key Cryptography Based User-to-User (PKU2U) authentication requests to use online identities](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities). @@ -95,15 +88,3 @@ In organizations using only Azure AD, you can connect from an Azure AD-joined PC ## Related topics [How to use Remote Desktop](https://support.microsoft.com/instantanswers/ff521c86-2803-4bc0-a5da-7df445788eb9/how-to-use-remote-desktop) - - - - - - - - - - - - diff --git a/windows/client-management/data-collection-for-802-authentication.md b/windows/client-management/data-collection-for-802-authentication.md index e866b0d7c4..58f94bd27e 100644 --- a/windows/client-management/data-collection-for-802-authentication.md +++ b/windows/client-management/data-collection-for-802-authentication.md @@ -2,7 +2,7 @@ title: Data collection for troubleshooting 802.1X authentication ms.reviewer: manager: dansimp -description: Data needed for reviewing 802.1X Authentication issues +description: Use the steps in this article to collect data that can be used to troubleshoot 802.1X authentication issues. keywords: troubleshooting, data collection, data, 802.1X authentication, authentication, data ms.prod: w10 ms.mktglfcycl: diff --git a/windows/client-management/determine-appropriate-page-file-size.md b/windows/client-management/determine-appropriate-page-file-size.md index b6abb3661e..8daf0f4ce4 100644 --- a/windows/client-management/determine-appropriate-page-file-size.md +++ b/windows/client-management/determine-appropriate-page-file-size.md @@ -8,8 +8,8 @@ author: Deland-Han ms.localizationpriority: medium ms.author: delhan ms.date: 8/28/2019 -ms.reviewer: -manager: dcscontentpm +ms.reviewer: dcscontentpm +manager: dansimp --- # How to determine the appropriate page file size for 64-bit versions of Windows diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index ffd1c9d266..694a7e8b07 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -32,6 +32,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", @@ -45,7 +46,17 @@ "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Windows Client Management" + "titleSuffix": "Windows Client Management", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], + "searchScope": ["Windows 10"] }, "fileMetadata": {}, "template": [], diff --git a/windows/client-management/generate-kernel-or-complete-crash-dump.md b/windows/client-management/generate-kernel-or-complete-crash-dump.md index 52a10357c5..835007dc33 100644 --- a/windows/client-management/generate-kernel-or-complete-crash-dump.md +++ b/windows/client-management/generate-kernel-or-complete-crash-dump.md @@ -1,6 +1,6 @@ --- title: Generate a kernel or complete crash dump -description: Learn how to generate a kernel or complete crash dump. +description: Learn how to generate a kernel or complete crash dump, and then use the output to troubleshoot several issues. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/images/quick-assist-flow.png b/windows/client-management/images/quick-assist-flow.png new file mode 100644 index 0000000000..5c1d83741f Binary files /dev/null and b/windows/client-management/images/quick-assist-flow.png differ diff --git a/windows/client-management/img-boot-sequence.md b/windows/client-management/img-boot-sequence.md index dbcd186131..b1077e5be6 100644 --- a/windows/client-management/img-boot-sequence.md +++ b/windows/client-management/img-boot-sequence.md @@ -1,6 +1,6 @@ --- title: Boot sequence flowchart -description: A full-sized view of the boot sequence flowchart. +description: View a full-sized view of the boot sequence flowchart. Use the link to return to the Advanced troubleshooting for Windows boot problems article. ms.date: 11/16/2018 ms.reviewer: manager: dansimp diff --git a/windows/client-management/index.md b/windows/client-management/index.md index 3838366e1a..477c88252a 100644 --- a/windows/client-management/index.md +++ b/windows/client-management/index.md @@ -1,6 +1,6 @@ --- title: Client management (Windows 10) -description: Windows 10 client management +description: Learn about the administrative tools, tasks and best practices for managing Windows 10 and Windows 10 Mobile clients across your enterprise. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/client-management/introduction-page-file.md b/windows/client-management/introduction-page-file.md index cee81bcd72..b1964db01a 100644 --- a/windows/client-management/introduction-page-file.md +++ b/windows/client-management/introduction-page-file.md @@ -1,14 +1,14 @@ --- title: Introduction to the page file -description: Learn about the page files in Windows. +description: Learn about the page files in Windows. A page file is an optional, hidden system file on a hard disk. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting author: Deland-Han ms.localizationpriority: medium ms.author: delhan -ms.reviewer: greglin -manager: dcscontentpm +ms.reviewer: dcscontentpm +manager: dansimp --- # Introduction to page files diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index 97ea145013..2950a6c6d9 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -1,6 +1,6 @@ --- title: Manage the Settings app with Group Policy (Windows 10) -description: Find out how to manage the Settings app with Group Policy. +description: Find out how to manage the Settings app with Group Policy so you can hide specific pages from users. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -19,13 +19,13 @@ ms.topic: article - Windows 10, Windows Server 2016 -You can now manage the pages that are shown in the Settings app by using Group Policy. This lets you hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely. -To make use of the Settings App group polices on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. +You can now manage the pages that are shown in the Settings app by using Group Policy. When you use Group Policy to manage pages, you can hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely. +To make use of the Settings App group policies on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. >[!Note] >Each server that you want to manage access to the Settings App must be patched. -To centrally manage the new policies copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) if your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management. +If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra). This policy is available for both User and Computer depending on the version of the OS. Windows Server 2016 with KB 4457127 applied will have both User and Computer policy. Windows 10, version 1703, added Computer policy for the Settings app. Windows 10, version 1809, added User policy for the Settings app. @@ -39,7 +39,7 @@ Policy paths: ## Configuring the Group Policy -The Group Policy can be configured in one of two ways: specify a list of pages that are shown or specify a list of pages to hide. To do this, add either **ShowOnly:** or **Hide:** followed by a semicolon delimited list of URIs in **Settings Page Visiblity**. For a full list of URIs, see the URI scheme reference section in [Launch the Windows Settings app](https://docs.microsoft.com/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference). +The Group Policy can be configured in one of two ways: specify a list of pages that are shown or specify a list of pages to hide. To do this, add either **ShowOnly:** or **Hide:** followed by a semicolon-delimited list of URIs in **Settings Page Visibility**. For a full list of URIs, see the URI scheme reference section in [Launch the Windows Settings app](https://docs.microsoft.com/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference). >[!NOTE] > When you specify the URI in the Settings Page Visibility textbox, don't include **ms-settings:** in the string. diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 45de1ade9b..f4a048f445 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -53,7 +53,7 @@ As indicated in the diagram, Microsoft continues to provide support for deep man With Windows 10, you can continue to use traditional OS deployment, but you can also “manage out of the box.” To transform new devices into fully-configured, fully-managed devices, you can: -- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services such as [Microsoft Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot) or [Microsoft Intune](https://docs.microsoft.com/intune/understand-explore/introduction-to-microsoft-intune). +- Avoid reimaging by using dynamic provisioning, enabled by a cloud-based device management services such as [Microsoft Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot) or [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/). - Create self-contained provisioning packages built with the [Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages). @@ -69,7 +69,7 @@ You can envision user and device management as falling into these two categories - **Corporate (CYOD) or personal (BYOD) devices used by mobile users for SaaS apps such as Office 365.** With Windows 10, your employees can self-provision their devices: - - For corporate devices, they can set up corporate access with [Azure AD Join](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-overview/). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://blogs.technet.microsoft.com/ad/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/), all from the cloud.
    Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. + - For corporate devices, they can set up corporate access with [Azure AD Join](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-overview/). When you offer them Azure AD Join with automatic Intune MDM enrollment, they can bring devices into a corporate-managed state in [*one step*](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/windows-10-azure-ad-and-microsoft-intune-automatic-mdm/ba-p/244067), all from the cloud.
    Azure AD Join is also a great solution for temporary staff, partners, or other part-time employees. These accounts can be kept separate from the on-premises AD domain but still access needed corporate resources. - Likewise, for personal devices, employees can use a new, simplified [BYOD experience](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-windows10-devices/) to add their work account to Windows, then access work resources on the device. @@ -135,6 +135,6 @@ There are a variety of steps you can take to begin the process of modernizing de ## Related topics -- [What is Intune?](https://docs.microsoft.com/intune/introduction-intune) +- [What is Intune?](https://docs.microsoft.com//mem/intune/fundamentals/what-is-intune) - [Windows 10 Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) - [Windows 10 Configuration service Providers](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference) diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 9d7b5546ff..211519bdec 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -15,23 +15,18 @@ ms.topic: article # Create mandatory user profiles - **Applies to** -- Windows 10 +- Windows 10 +A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. +Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. -A mandatory user profile is a roaming user profile that has been pre-configured by an administrator to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. - -Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. - -When the server that stores the mandatory profile is unavailable, such as when the user is not connected to the corporate network, users with mandatory profiles can sign in with the locally cached copy of the mandatory profile, if one exists. Otherwise, the user will be signed in with a temporary profile. +When the server that stores the mandatory profile is unavailable, such as when the user is not connected to the corporate network, users with mandatory profiles can sign in with the locally cached copy of the mandatory profile, if one exists. Otherwise, the user will be signed in with a temporary profile. User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) of each user's profile in the file system of the profile server from `NTuser.dat` to `NTuser.man`. The `.man` extension causes the user profile to be a read-only profile. - - ## Profile extension for each Windows version The name of the folder in which you store the mandatory profile must use the correct extension for the operating system it will be applied to. The following table lists the correct extension for each operating system version. @@ -43,123 +38,114 @@ The name of the folder in which you store the mandatory profile must use the cor | Windows 8 | Windows Server 2012 | v3 | | Windows 8.1 | Windows Server 2012 R2 | v4 | | Windows 10, versions 1507 and 1511 | N/A | v5 | -| Windows 10, versions 1607, 1703, 1709, 1803, 1809 and 1903 | Windows Server 2016 and Windows Server 2019 | v6 | +| Windows 10, versions 1607, 1703, 1709, 1803, 1809, 1903 and 1909 | Windows Server 2016 and Windows Server 2019 | v6 | -For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). +For more information, see [Deploy Roaming User Profiles, Appendix B](https://docs.microsoft.com/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). -## How to create a mandatory user profile +## Mandatory user profile First, you create a default user profile with the customizations that you want, run Sysprep with CopyProfile set to **True** in the answer file, copy the customized default user profile to a network share, and then you rename the profile to make it mandatory. -**To create a default user profile** +### How to create a default user profile 1. Sign in to a computer running Windows 10 as a member of the local Administrator group. Do not use a domain account. > [!NOTE] > Use a lab or extra computer running a clean installation of Windows 10 to create a default user profile. Do not use a computer that is required for business (that is, a production computer). This process removes all domain accounts from the computer, including user profile folders. -2. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. +1. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. - >[!NOTE] - >Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). + > [!NOTE] + > Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). -3. [Create an answer file (Unattend.xml)](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) that sets the [CopyProfile](https://msdn.microsoft.com/library/windows/hardware/dn922656.aspx) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. +1. [Create an answer file (Unattend.xml)](https://docs.microsoft.com/windows-hardware/customize/desktop/wsim/create-or-open-an-answer-file) that sets the [CopyProfile](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-copyprofile) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](https://docs.microsoft.com/windows-hardware/customize/desktop/wsim/windows-system-image-manager-technical-reference), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. -3. Uninstall any application you do not need or want from the PC. For examples on how to uninstall Windows 10 Application see [Remove-AppxProvisionedPackage](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage?view=winserver2012-ps). For a list of uninstallable applications, see [Understand the different apps included in Windows 10](https://docs.microsoft.com/windows/application-management/apps-in-windows-10). +1. Uninstall any application you do not need or want from the PC. For examples on how to uninstall Windows 10 Application see [Remove-AppxProvisionedPackage](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps). For a list of uninstallable applications, see [Understand the different apps included in Windows 10](https://docs.microsoft.com/windows/application-management/apps-in-windows-10). + > [!NOTE] + > It is highly recommended to uninstall unwanted or unneeded apps as it will speed up user sign-in times. - >[!NOTE] - >It is highly recommended to uninstall unwanted or unneeded apps as it will speed up user sign-in times. +1. At a command prompt, type the following command and press **ENTER**. -3. At a command prompt, type the following command and press **ENTER**. + ```dos + sysprep /oobe /reboot /generalize /unattend:unattend.xml + ``` - `sysprep /oobe /reboot /generalize /unattend:unattend.xml` - - (Sysprep.exe is located at: C:\Windows\System32\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) + (Sysprep.exe is located at: C:\\Windows\\System32\\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) > [!TIP] - > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\System32\Sysprep\Panther\setupact.log and look for an entry like the following: - > + > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\\System32\\Sysprep\\Panther\\setupact.log and look for an entry like the following: + > > ![Microsoft Bing Translator package](images/sysprep-error.png) - > - > Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) and [Remove-AppxPackage -AllUsers](https://docs.microsoft.com/powershell/module/appx/remove-appxpackage?view=win10-ps) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. + > + > Use the [Remove-AppxProvisionedPackage](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps) and [Remove-AppxPackage -AllUsers](https://docs.microsoft.com/powershell/module/appx/remove-appxpackage?view=win10-ps) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. -4. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. +1. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. -5. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. +1. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. -6. In **User Profiles**, click **Default Profile**, and then click **Copy To**. +1. In **User Profiles**, click **Default Profile**, and then click **Copy To**. ![Example of UI](images/copy-to.png) -7. In **Copy To**, under **Permitted to use**, click **Change**. +1. In **Copy To**, under **Permitted to use**, click **Change**. ![Example of UI](images/copy-to-change.png) -8. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. +1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. -9. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#extension) for the operating system version. For example, the folder name must end with “.v6” to identify it as a user profile folder for Windows 10, version 1607. +1. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#profile-extension-for-each-windows-version) for the operating system version. For example, the folder name must end with ".v6" to identify it as a user profile folder for Windows 10, version 1607. - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. - - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. + - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - ![Example of UI](images/copy-to-path.png) + ![Example of UI](images/copy-to-path.png) -10. Click **OK** to copy the default user profile. +1. Click **OK** to copy the default user profile. +### How to make the user profile mandatory -**To make the user profile mandatory** +1. In File Explorer, open the folder where you stored the copy of the profile. + > [!NOTE] + > If the folder is not displayed, click **View** > **Options** > **Change folder and search options**. On the **View** tab, select **Show hidden files and folders**, clear **Hide protected operating system files**, click **Yes** to confirm that you want to show operating system files, and then click **OK** to save your changes. -3. In File Explorer, open the folder where you stored the copy of the profile. +1. Rename `Ntuser.dat` to `Ntuser.man`. - >[!NOTE] - >If the folder is not displayed, click **View** > **Options** > **Change folder and search options**. On the **View** tab, select **Show hidden files and folders**, clear **Hide protected operating system files**, click **Yes** to confirm that you want to show operating system files, and then click **OK** to save your changes. - -4. Rename `Ntuser.dat` to `Ntuser.man`. - -## How to apply a mandatory user profile to users +## Apply a mandatory user profile to users In a domain, you modify properties for the user account to point to the mandatory profile in a shared folder residing on the server. -**To apply a mandatory user profile to users** +### How to apply a mandatory user profile to users 1. Open **Active Directory Users and Computers** (dsa.msc). -2. Navigate to the user account that you will assign the mandatory profile to. +1. Navigate to the user account that you will assign the mandatory profile to. -3. Right-click the user name and open **Properties**. +1. Right-click the user name and open **Properties**. -4. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is \\\\*server*\profile.v6, you would enter \\\\*server*\profile. +1. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is \\\\*server*\\profile.v6, you would enter \\\\*server*\\profile. -5. Click **OK**. +1. Click **OK**. It may take some time for this change to replicate to all domain controllers. - - ## Apply policies to improve sign-in time When a user is configured with a mandatory profile, Windows 10 starts as though it was the first sign-in each time the user signs in. To improve sign-in performance for users with mandatory user profiles, apply the Group Policy settings shown in the following table. (The table shows which operating system versions each policy setting can apply to.) - | Group Policy setting | Windows 10 | Windows Server 2016 | Windows 8.1 | Windows Server 2012 | | --- | --- | --- | --- | --- | | Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | | Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | | Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | -> [!Note] +> [!NOTE] > The Group Policy settings above can be applied in Windows 10 Professional edition. - - - - ## Related topics - [Manage Windows 10 Start layout and taskbar options](/windows/configuration/windows-10-start-layout-options-and-policies) - [Lock down Windows 10 to specific apps](/windows/configuration/lock-down-windows-10-to-specific-apps) - [Windows Spotlight on the lock screen](/windows/configuration/windows-spotlight) - [Configure devices without MDM](/windows/configuration/configure-devices-without-mdm) - diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 9241a7fdf7..3675333e76 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -1,5 +1,6 @@ # [Mobile device management](index.md) ## [What's new in MDM enrollment and management](new-in-windows-mdm-enrollment-management.md) +### [Change history for MDM documentation](change-history-for-mdm-documentation.md) ## [Mobile device enrollment](mobile-device-enrollment.md) ### [MDM enrollment of Windows devices](mdm-enrollment-of-windows-devices.md) #### [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md) @@ -159,18 +160,120 @@ #### [Personalization DDF file](personalization-ddf.md) ### [Policy CSP](policy-configuration-service-provider.md) #### [Policy DDF file](policy-ddf-file.md) -#### [Policies supported by Group Policy](policies-supported-by-group-policy.md) -#### [ADMX-backed policies](policies-admx-backed.md) -#### [Policies supported by HoloLens 2](policies-supported-by-hololens2.md) -#### [Policies supported by HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) -#### [Policies supported by HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) -#### [Policies supported by Windows 10 IoT Enterprise](policies-supported-by-iot-enterprise.md) -#### [Policies supported by Windows 10 IoT Core](policies-supported-by-iot-core.md) -#### [Policies supported by Microsoft Surface Hub](policies-supported-by-surface-hub.md) -#### [Policies that can be set using Exchange Active Sync (EAS)](policies-that-can-be-set-using-eas.md) +#### [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md) +#### [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) +#### [Policies in Policy CSP supported by HoloLens 2](policy-csps-supported-by-hololens2.md) +#### [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +#### [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +#### [Policies in Policy CSP supported by Windows 10 IoT Enterprise](policy-csps-supported-by-iot-enterprise.md) +#### [Policies in Policy CSP supported by Windows 10 IoT Core](policy-csps-supported-by-iot-core.md) +#### [Policies in Policy CSP supported by Microsoft Surface Hub](policy-csps-supported-by-surface-hub.md) +#### [Policy CSPs that can be set using Exchange Active Sync (EAS)](policy-csps-that-can-be-set-using-eas.md) #### [AboveLock](policy-csp-abovelock.md) #### [Accounts](policy-csp-accounts.md) #### [ActiveXControls](policy-csp-activexcontrols.md) +#### [ADMX_ActiveXInstallService](policy-csp-admx-activexinstallservice.md) +#### [ADMX_AddRemovePrograms](policy-csp-admx-addremoveprograms.md) +#### [ADMX_AppCompat](policy-csp-admx-appcompat.md) +#### [ADMX_AppxPackageManager](policy-csp-admx-appxpackagemanager.md) +#### [ADMX_AppXRuntime](policy-csp-admx-appxruntime.md) +#### [ADMX_AttachmentManager](policy-csp-admx-attachmentmanager.md) +#### [ADMX_AuditSettings](policy-csp-admx-auditsettings.md) +#### [ADMX_Bits](policy-csp-admx-bits.md) +#### [ADMX_CipherSuiteOrder](policy-csp-admx-ciphersuiteorder.md) +#### [ADMX_COM](policy-csp-admx-com.md) +#### [ADMX_ControlPanel](policy-csp-admx-controlpanel.md) +#### [ADMX_ControlPanelDisplay](policy-csp-admx-controlpaneldisplay.md) +#### [ADMX_Cpls](policy-csp-admx-cpls.md) +#### [ADMX_CredentialProviders](policy-csp-admx-credentialproviders.md) +#### [ADMX_CredSsp](policy-csp-admx-credssp.md) +#### [ADMX_CredUI](policy-csp-admx-credui.md) +#### [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md) +#### [ADMX_DataCollection](policy-csp-admx-datacollection.md) +#### [ADMX_Desktop](policy-csp-admx-desktop.md) +#### [ADMX_DeviceInstallation](policy-csp-admx-deviceinstallation.md) +#### [ADMX_DeviceSetup](policy-csp-admx-devicesetup.md) +#### [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) +#### [ADMX_DnsClient](policy-csp-admx-dnsclient.md) +#### [ADMX_DWM](policy-csp-admx-dwm.md) +#### [ADMX_EAIME](policy-csp-admx-eaime.md) +#### [ADMX_EncryptFilesonMove](policy-csp-admx-encryptfilesonmove.md) +#### [ADMX_EnhancedStorage](policy-csp-admx-enhancedstorage.md) +#### [ADMX_ErrorReporting](policy-csp-admx-errorreporting.md) +#### [ADMX_EventForwarding](policy-csp-admx-eventforwarding.md) +#### [ADMX_EventLog](policy-csp-admx-eventlog.md) +#### [ADMX_Explorer](policy-csp-admx-explorer.md) +#### [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) +#### [ADMX_FileSys](policy-csp-admx-filesys.md) +#### [ADMX_FolderRedirection](policy-csp-admx-folderredirection.md) +#### [ADMX_Globalization](policy-csp-admx-globalization.md) +#### [ADMX_GroupPolicy](policy-csp-admx-grouppolicy.md) +#### [ADMX_Help](policy-csp-admx-help.md) +#### [ADMX_HelpAndSupport](policy-csp-admx-helpandsupport.md) +#### [ADMX_ICM](policy-csp-admx-icm.md) +#### [ADMX_kdc](policy-csp-admx-kdc.md) +#### [ADMX_Kerberos](policy-csp-admx-kerberos.md) +#### [ADMX_LanmanServer](policy-csp-admx-lanmanserver.md) +#### [ADMX_LanmanWorkstation](policy-csp-admx-lanmanworkstation.md) +#### [ADMX_LinkLayerTopologyDiscovery](policy-csp-admx-linklayertopologydiscovery.md) +#### [ADMX_Logon](policy-csp-admx-logon.md) +#### [ADMX_MicrosoftDefenderAntivirus](policy-csp-admx-microsoftdefenderantivirus.md) +#### [ADMX_MMC](policy-csp-admx-mmc.md) +#### [ADMX_MMCSnapins](policy-csp-admx-mmcsnapins.md) +#### [ADMX_MSAPolicy](policy-csp-admx-msapolicy.md) +#### [ADMX_msched](policy-csp-admx-msched.md) +#### [ADMX_MSDT](policy-csp-admx-msdt.md) +#### [ADMX_MSI](policy-csp-admx-msi.md) +#### [ADMX_nca](policy-csp-admx-nca.md) +#### [ADMX_NCSI](policy-csp-admx-ncsi.md) +#### [ADMX_Netlogon](policy-csp-admx-netlogon.md) +#### [ADMX_NetworkConnections](policy-csp-admx-networkconnections.md) +#### [ADMX_OfflineFiles](policy-csp-admx-offlinefiles.md) +#### [ADMX_PeerToPeerCaching](policy-csp-admx-peertopeercaching.md) +#### [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) +#### [ADMX_Power](policy-csp-admx-power.md) +#### [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) +#### [ADMX_Printing](policy-csp-admx-printing.md) +#### [ADMX_Printing2](policy-csp-admx-printing2.md) +#### [ADMX_Programs](policy-csp-admx-programs.md) +#### [ADMX_Reliability](policy-csp-admx-reliability.md) +#### [ADMX_RemoteAssistance](policy-csp-admx-remoteassistance.md) +#### [ADMX_RemovableStorage](policy-csp-admx-removablestorage.md) +#### [ADMX_RPC](policy-csp-admx-rpc.md) +#### [ADMX_Scripts](policy-csp-admx-scripts.md) +#### [ADMX_sdiageng](policy-csp-admx-sdiageng.md) +#### [ADMX_Securitycenter](policy-csp-admx-securitycenter.md) +#### [ADMX_Sensors](policy-csp-admx-sensors.md) +#### [ADMX_Servicing](policy-csp-admx-servicing.md) +#### [ADMX_SettingSync](policy-csp-admx-settingsync.md) +#### [ADMX_SharedFolders](policy-csp-admx-sharedfolders.md) +#### [ADMX_Sharing](policy-csp-admx-sharing.md) +#### [ADMX_ShellCommandPromptRegEditTools](policy-csp-admx-shellcommandpromptregedittools.md) +#### [ADMX_SkyDrive](policy-csp-admx-skydrive.md) +#### [ADMX_Smartcard](policy-csp-admx-smartcard.md) +#### [ADMX_Snmp](policy-csp-admx-snmp.md) +#### [ADMX_StartMenu](policy-csp-admx-startmenu.md) +#### [ADMX_SystemRestore](policy-csp-admx-systemrestore.md) +#### [ADMX_Taskbar](policy-csp-admx-taskbar.md) +#### [ADMX_tcpip](policy-csp-admx-tcpip.md) +#### [ADMX_Thumbnails](policy-csp-admx-thumbnails.md) +#### [ADMX_TPM](policy-csp-admx-tpm.md) +#### [ADMX_UserExperienceVirtualization](policy-csp-admx-userexperiencevirtualization.md) +#### [ADMX_UserProfiles](policy-csp-admx-userprofiles.md) +#### [ADMX_W32Time](policy-csp-admx-w32time.md) +#### [ADMX_WCM](policy-csp-admx-wcm.md) +#### [ADMX_WinCal](policy-csp-admx-wincal.md) +#### [ADMX_WindowsAnytimeUpgrade](policy-csp-admx-windowsanytimeupgrade.md) +#### [ADMX_WindowsConnectNow](policy-csp-admx-windowsconnectnow.md) +#### [ADMX_WindowsExplorer](policy-csp-admx-windowsexplorer.md) +#### [ADMX_WindowsMediaDRM](policy-csp-admx-windowsmediadrm.md) +#### [ADMX_WindowsMediaPlayer](policy-csp-admx-windowsmediaplayer.md) +#### [ADMX_WindowsRemoteManagement](policy-csp-admx-windowsremotemanagement.md) +#### [ADMX_WindowsStore](policy-csp-admx-windowsstore.md) +#### [ADMX_WinInit](policy-csp-admx-wininit.md) +#### [ADMX_WinLogon](policy-csp-admx-winlogon.md) +#### [ADMX_wlansvc](policy-csp-admx-wlansvc.md) +#### [ADMX_WPN](policy-csp-admx-wpn.md) #### [ApplicationDefaults](policy-csp-applicationdefaults.md) #### [ApplicationManagement](policy-csp-applicationmanagement.md) #### [AppRuntime](policy-csp-appruntime.md) @@ -179,7 +282,7 @@ #### [Audit](policy-csp-audit.md) #### [Authentication](policy-csp-authentication.md) #### [Autoplay](policy-csp-autoplay.md) -#### [Bitlocker](policy-csp-bitlocker.md) +#### [BitLocker](policy-csp-bitlocker.md) #### [BITS](policy-csp-bits.md) #### [Bluetooth](policy-csp-bluetooth.md) #### [Browser](policy-csp-browser.md) @@ -217,11 +320,14 @@ #### [LanmanWorkstation](policy-csp-lanmanworkstation.md) #### [Licensing](policy-csp-licensing.md) #### [LocalPoliciesSecurityOptions](policy-csp-localpoliciessecurityoptions.md) +#### [LocalUsersAndGroups](policy-csp-localusersandgroups.md) #### [LockDown](policy-csp-lockdown.md) #### [Maps](policy-csp-maps.md) #### [Messaging](policy-csp-messaging.md) +#### [MixedReality](policy-csp-mixedreality.md) #### [MSSecurityGuide](policy-csp-mssecurityguide.md) #### [MSSLegacy](policy-csp-msslegacy.md) +#### [Multitasking](policy-csp-multitasking.md) #### [NetworkIsolation](policy-csp-networkisolation.md) #### [Notifications](policy-csp-notifications.md) #### [Power](policy-csp-power.md) @@ -256,6 +362,7 @@ #### [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md) #### [WindowsLogon](policy-csp-windowslogon.md) #### [WindowsPowerShell](policy-csp-windowspowershell.md) +#### [WindowsSandbox](policy-csp-windowssandbox.md) #### [WirelessDisplay](policy-csp-wirelessdisplay.md) ### [PolicyManager CSP](policymanager-csp.md) ### [Provisioning CSP](provisioning-csp.md) diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md index 40de22d2b3..455f749b5b 100644 --- a/windows/client-management/mdm/accounts-csp.md +++ b/windows/client-management/mdm/accounts-csp.md @@ -40,7 +40,7 @@ Available naming macros: Supported operation is Add. > [!Note] -> For desktop PCs on the next major release of Windows 10 or later, use the **Ext/Microsoft/DNSComputerName** node in [DevDetail CSP](devdetail-csp.md). +> For desktop PCs on Windows 10, version 2004 or later, use the **Ext/Microsoft/DNSComputerName** node in [DevDetail CSP](devdetail-csp.md). **Users** Interior node for the user account information. @@ -52,6 +52,7 @@ This node specifies the username for a new local user account. This setting can This node specifies the password for a new local user account. This setting can be managed remotely. Supported operation is Add. +GET operation is not supported. This setting will report as failed when deployed from the Endpoint Manager. **Users/_UserName_/LocalUserGroup** This optional node specifies the local user group that a local user account should be joined to. If the node is not set, the new local user account is joined just to the Standard Users group. Set the value to 2 for Administrators group. This setting can be managed remotely. diff --git a/windows/client-management/mdm/accounts-ddf-file.md b/windows/client-management/mdm/accounts-ddf-file.md index c4a1538d53..c1b570d222 100644 --- a/windows/client-management/mdm/accounts-ddf-file.md +++ b/windows/client-management/mdm/accounts-ddf-file.md @@ -1,6 +1,6 @@ --- title: Accounts DDF file -description: XML file containing the device description framework for the Accounts configuration service provider. +description: XML file containing the device description framework (DDF) for the Accounts configuration service provider. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index e2f9441b9c..37f6157570 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -1,6 +1,6 @@ --- title: ActiveSync CSP -description: ActiveSync CSP +description: Learn how the ActiveSync configuration service provider is used to set up and change settings for Exchange ActiveSync. ms.assetid: c65093ef-bd36-4f32-9dab-edb7bcfb3188 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index 6e4c1c5000..1b1ae61c78 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -1,6 +1,6 @@ --- title: ActiveSync DDF file -description: ActiveSync DDF file +description: Learn about the OMA DM device description framework (DDF) for the ActiveSync configuration service provider. ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index 1a79f57833..4ad36bbd99 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: AllJoynManagement DDF -description: AllJoynManagement DDF +description: Learn the OMA DM device description framework (DDF) for the AllJoynManagement configuration service provider. ms.assetid: 540C2E60-A041-4749-A027-BBAF0BB046E4 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/application-csp.md b/windows/client-management/mdm/application-csp.md index d4fe92e943..69a0b61ca3 100644 --- a/windows/client-management/mdm/application-csp.md +++ b/windows/client-management/mdm/application-csp.md @@ -1,6 +1,6 @@ --- title: APPLICATION configuration service provider -description: APPLICATION configuration service provider +description: Learn how the APPLICATION configuration service provider is used to configure an application transport using Open Mobile Alliance (OMA) Client Provisioning. ms.assetid: 0705b5e9-a1e7-4d70-a73d-7f758ffd8099 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 121f28dad6..2c64c89cd9 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -1,29 +1,27 @@ --- title: ApplicationControl CSP description: The ApplicationControl CSP allows you to manage multiple Windows Defender Application Control (WDAC) policies from a MDM server. -keywords: whitelisting, security, malware +keywords: security, malware ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: ManikaDhiman ms.reviewer: jsuther1974 -ms.date: 05/21/2019 +ms.date: 09/10/2020 --- # ApplicationControl CSP -Windows Defender Application Control (WDAC) policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). This CSP provides expanded diagnostic capabilities and support for [multiple policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) (introduced in Windows 10, version 1903). It also provides support for rebootless policy deployment (introduced in Windows 10, version 1709). Unlike [AppLocker CSP](applocker-csp.md), ApplicationControl CSP correctly detects the presence of no-reboot option and consequently does not schedule a reboot. -Existing WDAC policies deployed using AppLocker CSP’s CodeIntegrity node can now be deployed using ApplicationControl CSP URI. Although WDAC policy deployment via AppLocker CSP will continue to be supported, all new feature work will be done in ApplicationControl CSP only. +Windows Defender Application Control (WDAC) policies can be managed from an MDM server or locally using PowerShell via the WMI Bridge through the ApplicationControl configuration service provider (CSP). The ApplicationControl CSP was added in Windows 10, version 1903. This CSP provides expanded diagnostic capabilities and support for [multiple policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) (introduced in Windows 10, version 1903). It also provides support for rebootless policy deployment (introduced in Windows 10, version 1709). Unlike the [AppLocker CSP](applocker-csp.md), the ApplicationControl CSP correctly detects the presence of no-reboot option and consequently does not schedule a reboot. +Existing WDAC policies deployed using the AppLocker CSP's CodeIntegrity node can now be deployed using the ApplicationControl CSP URI. Although WDAC policy deployment via the AppLocker CSP will continue to be supported, all new feature work will be done in the ApplicationControl CSP only. -ApplicationControl CSP was added in Windows 10, version 1903. - -The following diagram shows ApplicationControl CSP in tree format. +The following diagram shows the ApplicationControl CSP in tree format. ![tree diagram for applicationcontrol csp](images/provisioning-csp-applicationcontrol.png) **./Vendor/MSFT/ApplicationControl** -Defines the root node for ApplicationControl CSP. +Defines the root node for the ApplicationControl CSP. Scope is permanent. Supported operation is Get. @@ -33,7 +31,7 @@ An interior node that contains all the policies, each identified by their global Scope is permanent. Supported operation is Get. **ApplicationControl/Policies/_Policy GUID_** -ApplicationControl CSP enforces that the “ID” segment of a given policy URI is the same GUID as the policy ID in the policy blob. Each *Policy GUID* node contains a Policy node and a corresponding PolicyInfo node. +The ApplicationControl CSP enforces that the "ID" segment of a given policy URI is the same GUID as the policy ID in the policy blob. Each *Policy GUID* node contains a Policy node and a corresponding PolicyInfo node. Scope is dynamic. Supported operation is Get. @@ -121,11 +119,11 @@ Value type is char. For customers using Intune standalone or hybrid management with Configuration Manager (MEMCM) to deploy custom policies via the ApplicationControl CSP, refer to [Deploy Windows Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune) -## Non-Intune Usage Guidance +## Generic MDM Server Usage Guidance In order to leverage the ApplicationControl CSP without using Intune, you must: -1. Know a generated policy’s GUID, which can be found in the policy xml as or for pre-1903 systems. +1. Know a generated policy's GUID, which can be found in the policy xml as `` or `` for pre-1903 systems. 2. Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned. 3. Create a policy node (a Base64-encoded blob of the binary policy representation) using the certutil -encode command line tool. @@ -205,7 +203,7 @@ The following example shows the deployment of two base policies and a supplement ### Get policies -Perform a GET using a deployed policy’s GUID to interrogate/inspect the policy itself or information about it. +Perform a GET using a deployed policy's GUID to interrogate/inspect the policy itself or information about it. The following table displays the result of Get operation on different nodes: @@ -265,3 +263,33 @@ The following is an example of Delete command: ``` + +## PowerShell and WMI Bridge Usage Guidance + +The ApplicationControl CSP can also be managed locally from PowerShell or via Microsoft Endpoint Manager Configuration Manager's (MEMCM, formerly known as SCCM) task sequence scripting by leveraging the [WMI Bridge Provider](https://docs.microsoft.com/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). + +### Setup for using the WMI Bridge + +1. Convert your WDAC policy to Base64 +2. Open PowerShell in Local System context (through PSExec or something similar) +3. Use WMI Interface: + + ```powershell + $namespace = "root\cimv2\mdm\dmmap" + $policyClassName = "MDM_AppControl_Policies" + $policyBase64 = … + ``` + +### Deploying a policy via WMI Bridge + +Run the following command. PolicyID is a GUID which can be found in the policy xml, and should be used here without braces. + +```powershell + New-CimInstance -Namespace $namespace -ClassName $policyClassName -Property @{ParentID="./Vendor/MSFT/ApplicationControl/Policies";InstanceID="";Policy=$policyBase64} +``` + +### Querying all policies via WMI Bridge + +```powershell +Get-CimInstance -Namespace $namespace -ClassName $policyClassName +``` diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index 5f163fa7a7..9904301173 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -1,6 +1,6 @@ --- title: AppLocker CSP -description: AppLocker CSP +description: Learn how the AppLocker configuration service provider is used to specify which applications are allowed or disallowed. ms.assetid: 32FEA2C9-3CAD-40C9-8E4F-E3C69637580F ms.reviewer: manager: dansimp @@ -34,11 +34,12 @@ Defines restrictions for applications. > > Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node. +> [!NOTE] +> The AppLocker CSP will schedule a reboot when a policy is applied or a deletion occurs using the AppLocker/ApplicationLaunchRestrictions/Grouping/CodeIntegrity/Policy URI. Additional information: - [Find publisher and product name of apps](#productname) - step-by-step guide for getting the publisher and product names for various Windows apps. -- [Whitelist example](#whitelist-examples) - example for Windows 10 Mobile that denies all apps except the ones listed. **AppLocker/ApplicationLaunchRestrictions/_Grouping_** Grouping nodes are dynamic nodes, and there may be any number of them for a given enrollment (or a given context). The actual identifiers are selected by the management endpoint, whose job it is to determine what their purpose is, and to not conflict with other identifiers that they define. @@ -483,7 +484,7 @@ The following list shows the apps that may be included in the inbox.
Colour profileColor profile b08997ca-60ab-4dce-b088-f92e9c7994f3
diff --git a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index 706b102207..61ff7e767b 100644 --- a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -1,24 +1,29 @@ --- title: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal -description: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal +description: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new portal ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 01/17/2018 +ms.date: 12/18/2020 ms.reviewer: manager: dansimp --- # Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal -Go to your Azure AD Blade, select the Mobility (MDM and MAM) and there should be the Microsoft Intune "App" Visible, select the Microsoft Intune and configure the Blade +> [!NOTE] +> Microsoft Intune portal can be accessed at the following link: [https://endpoint.microsoft.com](https://endpoint.microsoft.com). + +1. Go to your Azure AD Blade. +2. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. +3. Select **Microsoft Intune** and configure the blade. ![How to get to the Blade](images/azure-mdm-intune.png) -Configure the Blade +Configure the blade ![Configure the Blade](images/azure-intune-configure-scope.png) -Select all for allow all users to enroll a Device and make it Intune ready, or Some, then you can add a Group of Users. +You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users). diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 6ba943ffca..03a48da95f 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1,21 +1,18 @@ --- title: BitLocker CSP -description: BitLocker CSP +description: Learn how the BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor ms.localizationpriority: medium -ms.date: 09/27/2019 +ms.date: 04/16/2020 ms.reviewer: manager: dansimp --- # BitLocker CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it is also supported in Windows 10 Pro. > [!NOTE] @@ -25,7 +22,7 @@ The BitLocker configuration service provider (CSP) is used by the enterprise to A Get operation on any of the settings, except for RequireDeviceEncryption and RequireStorageCardEncryption, returns the setting configured by the admin. -For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if TPM protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption does not verify that the a minimum PIN length is enforced (SystemDrivesMinimumPINLength). +For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if Trusted Platform Module (TPM) protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption does not verify that the a minimum PIN length is enforced (SystemDrivesMinimumPINLength). The following diagram shows the BitLocker configuration service provider in tree format. @@ -162,7 +159,7 @@ If you want to disable this policy, use the following SyncML: **EncryptionMethodByDriveType** -Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". +Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".
@@ -215,7 +212,7 @@ EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operat EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives. EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for removable data drives. - The possible values for 'xx' are: + The possible values for 'xx' are: - 3 = AES-CBC 128 - 4 = AES-CBC 256 @@ -237,7 +234,7 @@ EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for remov chr - <disabled/> + ``` @@ -247,7 +244,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRequireStartupAuthentication** -This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup". +This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup".
@@ -284,12 +281,12 @@ ADMX Info: > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This setting is applied when you turn on BitLocker. +This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a TPM. This setting is applied when you turn on BitLocker. > [!NOTE] > Only one of the additional authentication options can be required at startup, otherwise an error occurs. -If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive. +If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive. On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both. @@ -303,6 +300,10 @@ If you disable or do not configure this setting, users can configure only basic > [!NOTE] > If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. +> [!NOTE] +> Devices that pass Hardware Security Testability Specification (HSTI) validation or Modern +> Standby devices will not be able to configure a Startup PIN using this CSP. Users are required to manually configure the PIN. + Sample value for this node to enable this policy is: ```xml @@ -317,13 +318,13 @@ Data id:
  • ConfigureTPMUsageDropDown_Name = (for computer with TPM) Configure TPM startup.
  • -The possible values for 'xx' are: +The possible values for 'xx' are:
    • true = Explicitly allow
    • false = Policy not set
    -The possible values for 'yy' are: +The possible values for 'yy' are:
    • 2 = Optional
    • 1 = Required
    • @@ -333,25 +334,25 @@ The possible values for 'yy' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesMinimumPINLength** -This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup". +This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup".
    @@ -408,18 +409,18 @@ Sample value for this node to enable this policy is: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -427,7 +428,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRecoveryMessage** -This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" +This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name). @@ -468,11 +469,11 @@ ADMX Info: This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked. -If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL). +If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL). -If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message. +If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message. -If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen. +If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen. Sample value for this node to enable this policy is: @@ -480,7 +481,7 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: +The possible values for 'xx' are: - 0 = Empty - 1 = Use default recovery message and URL (in this case you don't need to specify a value for "RecoveryMessage_Input" or "RecoveryUrl_Input"). @@ -495,18 +496,18 @@ The possible values for 'xx' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage + + + chr + + + + ``` > [!NOTE] @@ -517,7 +518,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRecoveryOptions** -This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name). +This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).
    @@ -556,18 +557,18 @@ ADMX Info: This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker. -The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. +The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. -In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. +In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. +Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. -Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS. +Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS. -Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. +Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -> [!Note] -> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. +> [!NOTE] +> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives. @@ -579,34 +580,34 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: +The possible values for 'xx' are: - true = Explicitly allow - false = Policy not set -The possible values for 'yy' are: +The possible values for 'yy' are: - 2 = Allowed - 1 = Required - 0 = Disallowed -The possible values for 'zz' are: +The possible values for 'zz' are: - 2 = Store recovery passwords only - 1 = Store recovery passwords and key packages Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -614,7 +615,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **FixedDrivesRecoveryOptions** -This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" (). +This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().
    @@ -653,19 +654,20 @@ ADMX Info: This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker. -The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. +The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. -In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. +In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. +Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. -Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD. +Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD. -Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. +Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS. +Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS. -> [!Note]
    > If the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field is set, a recovery password is automatically generated. +> [!NOTE] +> If the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field is set, a recovery password is automatically generated. If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. @@ -677,13 +679,13 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: +The possible values for 'xx' are:
    • true = Explicitly allow
    • false = Policy not set
    -The possible values for 'yy' are: +The possible values for 'yy' are:
    • 2 = Allowed
    • 1 = Required
    • @@ -691,7 +693,7 @@ The possible values for 'yy' are:
    -The possible values for 'zz' are: +The possible values for 'zz' are:
    • 2 = Store recovery passwords only
    • 1 = Store recovery passwords and key packages
    • @@ -700,18 +702,18 @@ The possible values for 'zz' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -719,7 +721,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **FixedDrivesRequireEncryption** -This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name). +This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).
    @@ -769,18 +771,18 @@ Sample value for this node to enable this policy is: If you disable or do not configure this setting, all fixed data drives on the computer will be mounted with read and write access. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption + + + chr + + + + ``` Data type is string. Supported operations are Add, Get, Replace, and Delete. @@ -788,7 +790,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **RemovableDrivesRequireEncryption** -This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name). +This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).
    @@ -829,11 +831,12 @@ This setting configures whether BitLocker protection is required for a computer If you enable this setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. -If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting. +If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting. If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access. -> [!Note]
    > This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. +> [!NOTE] +> This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. Sample value for this node to enable this policy is: @@ -841,7 +844,7 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: +The possible values for 'xx' are:
    • true = Explicitly allow
    • false = Policy not set
    • @@ -850,18 +853,18 @@ The possible values for 'xx' are: Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml - - $CmdID$ - - - ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption - - - chr - - <disabled/> - - + + $CmdID$ + + + ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption + + + chr + + + + ``` @@ -931,12 +934,35 @@ The following list shows the supported values: Allows Admin to enforce "RequireDeviceEncryption" policy for scenarios where policy is pushed while current logged on user is non-admin/standard user Azure AD account. + > [!NOTE] > This policy is only supported in Azure AD accounts. "AllowStandardUserEncryption" policy is tied to "AllowWarningForOtherDiskEncryption" policy being set to "0", i.e, silent encryption is enforced. If "AllowWarningForOtherDiskEncryption" is not set, or is set to "1", "RequireDeviceEncryption" policy will not try to encrypt drive(s) if a standard user is the current logged on user in the system. + +
    + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    + The expected values for this policy are: @@ -1050,6 +1076,16 @@ Each server-side recovery key rotation is represented by a request ID. The serve Value type is string. Supported operation is Execute. Request ID is expected as a parameter. +> [!TIP] +> Key rotation feature will only work when: +> +> - For Operating system drives: +> - OSRequireActiveDirectoryBackup_Name is set to 1 ("Required") +> - OSActiveDirectoryBackup_Name is set to true +> - For Fixed data drives: +> - FDVRequireActiveDirectoryBackup_Name is set to 1 = ("Required") +> - FDVActiveDirectoryBackup_Name is set to true + **Status** Interior node. Supported operation is Get. @@ -1058,7 +1094,7 @@ Interior node. Supported operation is Get. **Status/DeviceEncryptionStatus** -This node reports compliance state of device encryption on the system. +This node reports compliance state of device encryption on the system. @@ -1084,12 +1120,33 @@ This node reports compliance state of device encryption on the system. +Value type is int. Supported operation is Get. + Supported values: - 0 - Indicates that the device is compliant. -- Any other value represents a non-compliant device. +- Any non-zero value - Indicates that the device is not compliant. This value represents a bitmask with each bit and the corresponding error code described in the following table: + +| Bit | Error Code | +|-----|------------| +| 0 |The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| +| 1 |The encryption method of the OS volume doesn't match the BitLocker policy.| +| 2 |The OS volume is unprotected.| +| 3 |The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| +| 4 |The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| +| 5 |The BitLocker policy requires TPM+startup key protection for the OS volume, but a TPM+startup key protector isn't used.| +| 6 |The BitLocker policy requires TPM+PIN+startup key protection for the OS volume, but a TPM+PIN+startup key protector isn't used.| +| 7 |The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| +| 8 |Recovery key backup failed.| +| 9 |A fixed drive is unprotected.| +| 10 |The encryption method of the fixed drive doesn't match the BitLocker policy.| +| 11 |To encrypt drives, the BitLocker policy requires either the user to sign in as an Administrator or, if the device is joined to Azure AD, the AllowStandardUserEncryption policy must be set to 1.| +| 12 |Windows Recovery Environment (WinRE) isn't configured.| +| 13 |A TPM isn't available for BitLocker, either because it isn't present, it has been made unavailable in the Registry, or the OS is on a removable drive. | +| 14 |The TPM isn't ready for BitLocker.| +| 15 |The network isn't available, which is required for recovery key backup. | +| 16-31 |For future use.| -Value type is int. Supported operation is Get. @@ -1211,10 +1268,10 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/EncryptionMethodByDriveType - <enabled/> - <data id="EncryptionMethodWithXtsOsDropDown_Name" value="4"/> - <data id="EncryptionMethodWithXtsFdvDropDown_Name" value="7"/> - <data id="EncryptionMethodWithXtsRdvDropDown_Name" value="4"/> + + + + @@ -1226,12 +1283,12 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication - <enabled/> - <data id="ConfigureNonTPMStartupKeyUsage_Name" value="true"/> - <data id="ConfigureTPMStartupKeyUsageDropDown_Name" value="2"/> - <data id="ConfigurePINUsageDropDown_Name" value="2"/> - <data id="ConfigureTPMPINKeyUsageDropDown_Name" value="2"/> - <data id="ConfigureTPMUsageDropDown_Name" value="2"/> + + + + + + @@ -1243,8 +1300,8 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesMinimumPINLength - <enabled/> - <data id="MinPINLength" value="6"/> + + @@ -1256,10 +1313,10 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage - <enabled/> - <data id="RecoveryMessage_Input" value="blablablabla"/> - <data id="PrebootRecoveryInfoDropDown_Name" value="2"/> - <data id="RecoveryUrl_Input" value="blablabla"/> + + + + @@ -1271,14 +1328,14 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryOptions - <enabled/> - <data id="OSAllowDRA_Name" value="true"/> - <data id="OSRecoveryPasswordUsageDropDown_Name" value="2"/> - <data id="OSRecoveryKeyUsageDropDown_Name" value="2"/> - <data id="OSHideRecoveryPage_Name" value="true"/> - <data id="OSActiveDirectoryBackup_Name" value="true"/> - <data id="OSActiveDirectoryBackupDropDown_Name" value="2"/> - <data id="OSRequireActiveDirectoryBackup_Name" value="true"/> + + + + + + + + @@ -1290,14 +1347,14 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/FixedDrivesRecoveryOptions - <enabled/> - <data id="FDVAllowDRA_Name" value="true"/> - <data id="FDVRecoveryPasswordUsageDropDown_Name" value="2"/> - <data id="FDVRecoveryKeyUsageDropDown_Name" value="2"/> - <data id="FDVHideRecoveryPage_Name" value="true"/> - <data id="FDVActiveDirectoryBackup_Name" value="true"/> - <data id="FDVActiveDirectoryBackupDropDown_Name" value="2"/> - <data id="FDVRequireActiveDirectoryBackup_Name" value="true"/> + + + + + + + + @@ -1309,7 +1366,7 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/FixedDrivesRequireEncryption - <enabled/> + @@ -1321,8 +1378,8 @@ The following example is provided to show proper format and should not be taken ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption - <enabled/> - <data id="RDVCrossOrg" value="true"/> + + @@ -1331,4 +1388,5 @@ The following example is provided to show proper format and should not be taken ``` + diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index 19421997ba..693a48b687 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -1,6 +1,6 @@ --- title: BitLocker DDF file -description: BitLocker DDF file +description: Learn about the OMA DM device description framework (DDF) for the BitLocker configuration service provider. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # BitLocker DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **BitLocker** configuration service provider. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/bootstrap-csp.md b/windows/client-management/mdm/bootstrap-csp.md index 1f88d3ae9f..2381889266 100644 --- a/windows/client-management/mdm/bootstrap-csp.md +++ b/windows/client-management/mdm/bootstrap-csp.md @@ -1,6 +1,6 @@ --- title: BOOTSTRAP CSP -description: BOOTSTRAP CSP +description: Use the BOOTSTRAP configuration service provider to set the Trusted Provisioning Server (TPS) for the device. ms.assetid: b8acbddc-347f-4543-a45b-ad2ffae3ffd0 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md index 9e1c5633df..908672c4ef 100644 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ b/windows/client-management/mdm/browserfavorite-csp.md @@ -1,6 +1,6 @@ --- title: BrowserFavorite CSP -description: BrowserFavorite CSP +description: Learn how the BrowserFavorite configuration service provider is used to add and remove URLs from the favorites list on a device. ms.assetid: 5d2351ff-2d6a-4273-9b09-224623723cbf ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md index 2818c2e55f..c0c9fdf44c 100644 --- a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md @@ -35,7 +35,7 @@ On the desktop and mobile devices, you can use an enrollment certificate or enro > [!NOTE] > - Bulk-join is not supported in Azure Active Directory Join. > - Bulk enrollment does not work in Intune standalone environment. -> - Bulk enrollment works in Microsoft Endpoint Configuration Manager where the ppkg is generated from the Configuration Manager console. +> - Bulk enrollment works in Microsoft Endpoint Manager where the ppkg is generated from the Configuration Manager console. > - To change bulk enrollment settings, login to **AAD**, then **Devices**, and then click **Device Settings**. Change the number under **Maximum number of devices per user**. ## What you need diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index edb5e3bdfa..953ddf78ae 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -1,6 +1,6 @@ --- title: CellularSettings CSP -description: CellularSettings CSP +description: Learn how the CellularSettings configuration service provider is used to configure cellular settings on a mobile device. ms.assetid: ce8b6f16-37ca-4aaf-98b0-306d12e326df ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/certificate-authentication-device-enrollment.md b/windows/client-management/mdm/certificate-authentication-device-enrollment.md index dd72081354..565fd3436d 100644 --- a/windows/client-management/mdm/certificate-authentication-device-enrollment.md +++ b/windows/client-management/mdm/certificate-authentication-device-enrollment.md @@ -14,15 +14,13 @@ ms.date: 06/26/2017 # Certificate authentication device enrollment - This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). -> **Note**  To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107). - +> [!Note] +> To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107). ## In this topic - - [Discovery service](#discovery-service) - [Enrollment policy web service](#enrollment-policy-web-service) - [Enrollment web service](#enrollment-web-service) @@ -507,10 +505,3 @@ The following example shows the encoded provisioning XML. protocol. This configuration service provider is being deprecated for Windows 10. --> ``` - -  - - - - - diff --git a/windows/client-management/mdm/certificate-renewal-windows-mdm.md b/windows/client-management/mdm/certificate-renewal-windows-mdm.md index 26580c5095..0db0669275 100644 --- a/windows/client-management/mdm/certificate-renewal-windows-mdm.md +++ b/windows/client-management/mdm/certificate-renewal-windows-mdm.md @@ -1,6 +1,6 @@ --- title: Certificate Renewal -description: The enrolled client certificate expires after a period of use. +description: Learn how to find all the resources that you need to provide continuous access to client certificates. MS-HAID: - 'p\_phdevicemgmt.certificate\_renewal' - 'p\_phDeviceMgmt.certificate\_renewal\_windows\_mdm' @@ -17,16 +17,13 @@ ms.date: 06/26/2017 # Certificate Renewal - The enrolled client certificate expires after a period of use. The expiration date of the certificate is specified by the server. To ensure continuous access to enterprise applications, Windows supports a user-triggered certificate renewal process. The user is prompted to provide the current password for the corporate account, and the enrollment client gets a new client certificate from the enrollment server and deletes the old certificate. The client generates a new private/public key pair, generates a PKCS\#7 request, and signs the PKCS\#7 request with the existing certificate. In Windows, automatic MDM client certificate renewal is also supported. -> **Note**  Make sure that the EntDMID in the DMClient configuration service provider is set before the certificate renewal request is triggered. - -  +> [!Note] +> Make sure that the EntDMID in the DMClient configuration service provider is set before the certificate renewal request is triggered. ## In this topic - - [Automatic certificate renewal request](#automatic-certificate-renewal-request) - [Certificate renewal schedule configuration](#certificate-renewal-schedule-configuration) - [Certificate renewal response](#certificate-renewal-response) @@ -35,12 +32,10 @@ The enrolled client certificate expires after a period of use. The expiration da ## Automatic certificate renewal request - In addition to manual certificate renewal, Windows includes support for automatic certificate renewal, also known as Renew On Behalf Of (ROBO), that does not require any user interaction. For auto renewal, the enrollment client uses the existing MDM client certificate to perform client Transport Layer Security (TLS). The user security token is not needed in the SOAP header. As a result, the MDM certificate enrollment server is required to support client TLS for certificate based client authentication for automatic certificate renewal. -> **Note**  Certificate renewal of the enrollment certificate through ROBO is only supported with Microsoft PKI. - -  +> [!Note] +> Certificate renewal of the enrollment certificate through ROBO is only supported with Microsoft PKI. Auto certificate renewal is the only supported MDM client certificate renewal method for the device that is enrolled using WAB authentication (meaning that the AuthPolicy is set to Federated). It also means if the server supports WAB authentication, the MDM certificate enrollment server MUST also support client TLS in order to renew the MDM client certificate. @@ -54,7 +49,7 @@ During the automatic certificate renew process, the device will deny HTTP redire The following example shows the details of an automatic renewal request. -``` +``` xml @@ -106,7 +101,6 @@ The following example shows the details of an automatic renewal request. ``` - ## Certificate renewal schedule configuration @@ -116,11 +110,10 @@ For more information about the parameters, see the CertificateStore configuratio Unlike manual certificate renewal, the device will not perform an automatic MDM client certificate renewal if the certificate is already expired. To make sure that the device has enough time to perform an automatic renewal, we recommend that you set a renewal period a couple months (40-60 days) before the certificate expires and set the renewal retry interval to be every few days such as every 4-5 days instead every 7 days (weekly) to increase the chance that the device will a connectivity at different days of the week. -> **Note**  For PCs that were previously enrolled in MDM in Windows 8.1 and then upgraded to Windows 10, renewal will be triggered for the enrollment certificate. Thereafter, renewal will happen at the configured ROBO interval. +> [!Note] +> For PCs that were previously enrolled in MDM in Windows 8.1 and then upgraded to Windows 10, renewal will be triggered for the enrollment certificate. Thereafter, renewal will happen at the configured ROBO interval. > For Windows Phone 8.1 devices upgraded to Windows 10 Mobile, renewal will happen at the configured ROBO internal. This is expected and by design. -  - ## Certificate renewal response When RequestType is set to Renew, the web service verifies the following (in additional to initial enrollment): @@ -133,12 +126,12 @@ When RequestType is set to Renew, the web service verifies the following (in add After validation is completed, the web service retrieves the PKCS\#10 content from the PKCS\#7 BinarySecurityToken. The rest is the same as initial enrollment, except that the Provisioning XML only needs to have the new certificate issued by the CA. -> **Note**  The HTTP server response must not be chunked; it must be sent as one message. - +> [!Note] +> The HTTP server response must not be chunked; it must be sent as one message. The following example shows the details of an certificate renewal response. -``` +``` xml @@ -163,25 +156,15 @@ The following example shows the details of an certificate renewal response. ``` -> **Note**  The client receives a new certificate, instead of renewing the initial certificate. The administrator controls which certificate template the client should use. The templates may be different at renewal time than the initial enrollment time. - -  +> [!Note] +The client receives a new certificate, instead of renewing the initial certificate. The administrator controls which certificate template the client should use. The templates may be different at renewal time than the initial enrollment time. ## Configuration service providers supported during MDM enrollment and certificate renewal - The following configuration service providers are supported during MDM enrollment and certificate renewal process. See Configuration service provider reference for detailed descriptions of each configuration service provider. - CertificateStore - w7 APPLICATION - DMClient - EnterpriseAppManagement - -  - - - - - - diff --git a/windows/client-management/mdm/certificatestore-csp.md b/windows/client-management/mdm/certificatestore-csp.md index 1ed78230d4..f709de39d0 100644 --- a/windows/client-management/mdm/certificatestore-csp.md +++ b/windows/client-management/mdm/certificatestore-csp.md @@ -1,6 +1,6 @@ --- title: CertificateStore CSP -description: CertificateStore CSP +description: Use the The CertificateStore configuration service provider (CSP) to add secure socket layers (SSL), intermediate, and self-signed certificates. ms.assetid: 0fe28629-3cc3-42a0-91b3-3624c8462fd3 ms.reviewer: manager: dansimp @@ -17,7 +17,9 @@ ms.date: 02/28/2020 The CertificateStore configuration service provider is used to add secure socket layers (SSL), intermediate, and self-signed certificates. -> **Note**   The CertificateStore configuration service provider does not support installing client certificates. +> [!Note] +> The CertificateStore configuration service provider does not support installing client certificates. +> The Microsoft protocol version of Open Mobile Alliance (OMA) is case insensitive. @@ -643,4 +645,3 @@ Configure the device to automatically renew an MDM client certificate with the s - diff --git a/windows/client-management/mdm/change-history-for-mdm-documentation.md b/windows/client-management/mdm/change-history-for-mdm-documentation.md new file mode 100644 index 0000000000..556ff58e7a --- /dev/null +++ b/windows/client-management/mdm/change-history-for-mdm-documentation.md @@ -0,0 +1,1085 @@ +--- +title: Change history for MDM documentation +description: This article lists new and updated articles for Mobile Device Management. +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/19/2020 +--- + +# Change history for Mobile Device Management documentation + +This article lists new and updated articles for the Mobile Device Management (MDM) documentation. Updated articles are those that had content addition, removal, or corrections—minor fixes, such as correction of typos, style, or formatting issues are not listed. + +## November 2020 + +|New or updated article | Description| +|--- | ---| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policy:
    - [Multitasking/BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) | +| [SurfaceHub CSP](surfacehub-csp.md) | Added the following new node:
    -Properties/SleepMode | + +## October 2020 + +|New or updated article | Description| +|--- | ---| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies
    - [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)
    - [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)
    - [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)
    - [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)
    - [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)
    - [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)
    - [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)
    - [Update/DisableWUfBSafeguards](policy-csp-update.md#update-disablewufbsafeguards)
    - [WindowsSandbox/AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput)
    - [WindowsSandbox/AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection)
    - [WindowsSandbox/AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking)
    - [WindowsSandbox/AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection)
    - [WindowsSandbox/AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu)
    - [WindowsSandbox/AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) | + +## September 2020 + +|New or updated article | Description| +|--- | ---| +|[NetworkQoSPolicy CSP](networkqospolicy-csp.md)|Updated support information of the NetworkQoSPolicy CSP.| +|[Policy CSP - LocalPoliciesSecurityOptions](policy-csp-localpoliciessecurityoptions.md)|Removed the following unsupported LocalPoliciesSecurityOptions policy settings from the documentation:
    - RecoveryConsole_AllowAutomaticAdministrativeLogon
    - DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
    - DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
    - DomainMember_DisableMachineAccountPasswordChanges
    - SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
    | + +## August 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - System](policy-csp-system.md)|Removed the following policy settings:
    - System/AllowDesktopAnalyticsProcessing
    - System/AllowMicrosoftManagedDesktopProcessing
    - System/AllowUpdateComplianceProcessing
    - System/AllowWUfBCloudProcessing
    | + +## July 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policy settings:
    - System/AllowDesktopAnalyticsProcessing
    - System/AllowMicrosoftManagedDesktopProcessing
    - System/AllowUpdateComplianceProcessing
    - System/AllowWUfBCloudProcessing


    Updated the following policy setting:
    - System/AllowCommercialDataPipeline
    | + +## June 2020 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added SKU support table for **AllowStandardUserEncryption**.| +|[Policy CSP - NetworkIsolation](policy-csp-networkisolation.md)|Updated the description from Boolean to Integer for the following policy settings:
    EnterpriseIPRangesAreAuthoritative, EnterpriseProxyServersAreAuthoritative.| + +## May 2020 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added the bitmask table for the Status/DeviceEncryptionStatus node.| +|[Policy CSP - RestrictedGroups](policy-csp-restrictedgroups.md)| Updated the topic with additional details. Added policy timeline table. + +## February 2020 + +|New or updated article | Description| +|--- | ---| +|[CertificateStore CSP](certificatestore-csp.md)
    [ClientCertificateInstall CSP](clientcertificateinstall-csp.md)|Added details about SubjectName value.| + +## January 2020 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Defender](policy-csp-defender.md)|Added descriptions for supported actions for Defender/ThreatSeverityDefaultAction.| + +## November 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added option 5 in the supported values list for DeliveryOptimization/DOGroupIdSource.| +|[DiagnosticLog CSP](diagnosticlog-csp.md)|Added substantial updates to this CSP doc.| + +## October 2019 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes:
    ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.| +|[Defender CSP](defender-csp.md)|Added the following new nodes:
    Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.| + +## September 2019 + +|New or updated article | Description| +|--- | ---| +|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node:
    IsStub.| +|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| +|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies:
    DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| + +## August 2019 + +|New or updated article | Description| +|--- | ---| +|[DiagnosticLog CSP](diagnosticlog-csp.md)
    [DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
    Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| +|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
    Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| + +## July 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following list:
    Policies supported by HoloLens 2| +|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.| +|[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903:
    SecurityKey, SecurityKey/UseSecurityKeyForSignin| +|[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies:
    LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock| +|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
    Create a custom configuration service provider
    Design a custom configuration service provider
    IConfigServiceProvider2
    IConfigServiceProvider2::ConfigManagerNotification
    IConfigServiceProvider2::GetNode
    ICSPNode
    ICSPNode::Add
    ICSPNode::Clear
    ICSPNode::Copy
    ICSPNode::DeleteChild
    ICSPNode::DeleteProperty
    ICSPNode::Execute
    ICSPNode::GetChildNodeNames
    ICSPNode::GetProperty
    ICSPNode::GetPropertyIdentifiers
    ICSPNode::GetValue
    ICSPNode::Move
    ICSPNode::SetProperty
    ICSPNode::SetValue
    ICSPNodeTransactioning
    ICSPValidate
    Samples for writing a custom configuration service provider.| + +## June 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md)|Added the following new policies:
    AllowDeviceHealthMonitoring, ConfigDeviceHealthMonitoringScope, ConfigDeviceHealthMonitoringUploadDestination.| +|[Policy CSP - TimeLanguageSettings](policy-csp-timelanguagesettings.md)|Added the following new policy:
    ConfigureTimeZone.| + +## May 2019 + +|New or updated article | Description| +|--- | ---| +|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
    DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| +|[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
    DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

    Updated description of the following policies:
    DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| +|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
    ShowLockOnUserTile.| +|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
    AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| +|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
    EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| +|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
    AllowFindMyFiles.| +|[Policy CSP - ServiceControlManager](policy-csp-servicecontrolmanager.md)|Added the following new policy:
    SvchostProcessMitigation.| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
    AllowCommercialDataPipeline, TurnOffFileHistory.| +|[Policy CSP - Troubleshooting](policy-csp-troubleshooting.md)|Added the following new policy:
    AllowRecommendations.| +|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
    AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| +|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
    AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.

    Removed the following policy:
    SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart. This policy is replaced by AllowAutomaticRestartSignOn.| + +## April 2019 + +| New or updated article | Description | +|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md) | Added the following warning at the end of the Overview section:
    Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. | +| [Policy CSP - UserRights](policy-csp-userrights.md) | Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields. | + +## March 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
    AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

    Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| + +## February 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP](policy-configuration-service-provider.md)|Updated supported policies for Holographic.| + +## January 2019 + +|New or updated article | Description| +|--- | ---| +|[Policy CSP - Storage](policy-csp-storage.md)|Added the following new policies: AllowStorageSenseGlobal, ConfigStorageSenseGlobalCadence, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseRecycleBinCleanupThreshold, ConfigStorageSenseDownloadsCleanupThreshold, and ConfigStorageSenseCloudContentCleanupThreshold.| +|[SharedPC CSP](sharedpc-csp.md)|Updated values and supported operations.| +|[Mobile device management](index.md)|Updated information about MDM Security Baseline.| + +## December 2018 + +|New or updated article | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Updated AllowWarningForOtherDiskEncryption policy description to describe silent and non-silent encryption scenarios, as well as where and how the recovery key is backed up for each scenario.| + +## September 2018 + +|New or updated article | Description| +|--- | ---| +|[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).| +|[Policy CSP - DeviceGuard](policy-csp-deviceguard.md) | Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.| + +## August 2018 + +
    ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    BitLocker CSP

    Added support for Windows 10 Pro starting in the version 1809.

    +
    Office CSP

    Added FinalStatus setting in Windows 10, version 1809.

    +
    RemoteWipe CSP

    Added new settings in Windows 10, version 1809.

    +
    TenantLockdown CSP

    Added new CSP in Windows 10, version 1809.

    +
    WindowsDefenderApplicationGuard CSP

    Added new settings in Windows 10, version 1809.

    +
    Policy DDF file

    Posted an updated version of the Policy DDF for Windows 10, version 1809.

    +
    Policy CSP

    Added the following new policies in Windows 10, version 1809:

    +
      +
    • Browser/AllowFullScreenMode
    • +
    • Browser/AllowPrelaunch
    • +
    • Browser/AllowPrinting
    • +
    • Browser/AllowSavingHistory
    • +
    • Browser/AllowSideloadingOfExtensions
    • +
    • Browser/AllowTabPreloading
    • +
    • Browser/AllowWebContentOnNewTabPage
    • +
    • Browser/ConfigureFavoritesBar
    • +
    • Browser/ConfigureHomeButton
    • +
    • Browser/ConfigureKioskMode
    • +
    • Browser/ConfigureKioskResetAfterIdleTimeout
    • +
    • Browser/ConfigureOpenMicrosoftEdgeWith
    • +
    • Browser/ConfigureTelemetryForMicrosoft365Analytics
    • +
    • Browser/PreventCertErrorOverrides
    • +
    • Browser/SetHomeButtonURL
    • +
    • Browser/SetNewTabPageURL
    • +
    • Browser/UnlockHomeButton
    • +
    • Experience/DoNotSyncBrowserSettings
    • +
    • Experience/PreventUsersFromTurningOnBrowserSyncing
    • +
    • Kerberos/UPNNameHints
    • +
    • Privacy/AllowCrossDeviceClipboard
    • +
    • Privacy/DisablePrivacyExperience
    • +
    • Privacy/UploadUserActivities
    • +
    • System/AllowDeviceNameInDiagnosticData
    • +
    • System/ConfigureMicrosoft365UploadEndpoint
    • +
    • System/DisableDeviceDelete
    • +
    • System/DisableDiagnosticDataViewer
    • +
    • Storage/RemovableDiskDenyWriteAccess
    • +
    • Update/UpdateNotificationLevel
    • +
    +

    Start/DisableContextMenus - added in Windows 10, version 1803.

    +

    RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.

    +
    + +## July 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    AssignedAccess CSP

    Added the following note:

    +
      +
    • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
    • +
    +
    PassportForWork CSP

    Added new settings in Windows 10, version 1809.

    +
    EnterpriseModernAppManagement CSP

    Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

    +
    Win32CompatibilityAppraiser CSP

    Added new configuration service provider in Windows 10, version 1809.

    +
    WindowsLicensing CSP

    Added S mode settings and SyncML examples in Windows 10, version 1809.

    +
    SUPL CSP

    Added 3 new certificate nodes in Windows 10, version 1809.

    +
    Defender CSP

    Added a new node Health/ProductStatus in Windows 10, version 1809.

    +
    BitLocker CSP

    Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

    +
    DevDetail CSP

    Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

    +
    Policy CSP

    Added the following new policies in Windows 10, version 1809:

    +
      +
    • ApplicationManagement/LaunchAppAfterLogOn
    • +
    • ApplicationManagement/ScheduleForceRestartForUpdateFailures
    • +
    • Authentication/EnableFastFirstSignIn (Preview mode only)
    • +
    • Authentication/EnableWebSignIn (Preview mode only)
    • +
    • Authentication/PreferredAadTenantDomainName
    • +
    • Defender/CheckForSignaturesBeforeRunningScan
    • +
    • Defender/DisableCatchupFullScan
    • +
    • Defender/DisableCatchupQuickScan
    • +
    • Defender/EnableLowCPUPriority
    • +
    • Defender/SignatureUpdateFallbackOrder
    • +
    • Defender/SignatureUpdateFileSharesSources
    • +
    • DeviceGuard/ConfigureSystemGuardLaunch
    • +
    • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    • +
    • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    • +
    • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • +
    • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    • +
    • DmaGuard/DeviceEnumerationPolicy
    • +
    • Experience/AllowClipboardHistory
    • +
    • Security/RecoveryEnvironmentAuthentication
    • +
    • TaskManager/AllowEndTask
    • +
    • WindowsDefenderSecurityCenter/DisableClearTpmButton
    • +
    • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
    • +
    • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
    • +
    • WindowsLogon/DontDisplayNetworkSelectionUI
    • +
    +

    Recent changes:

    +
      +
    • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
    • +
    +
    + +## June 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    Wifi CSP

    Added a new node WifiCost in Windows 10, version 1809.

    +
    Diagnose MDM failures in Windows 10

    Recent changes:

    +
      +
    • Added procedure for collecting logs remotely from Windows 10 Holographic.
    • +
    • Added procedure for downloading the MDM Diagnostic Information log.
    • +
    +
    BitLocker CSP

    Added new node AllowStandardUserEncryption in Windows 10, version 1809.

    +
    Policy CSP

    Recent changes:

    +
      +
    • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
    • +
    • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
    • +
    • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
    • +
    • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
    • +
    • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
    • +
    • Security/RequireDeviceEncryption is supported in the Home SKU.
    • +
    • Start/StartLayout - added a table of SKU support information.
    • +
    • Start/ImportEdgeAssets - added a table of SKU support information.
    • +
    +

    Added the following new policies in Windows 10, version 1809:

    +
      +
    • Update/EngagedRestartDeadlineForFeatureUpdates
    • +
    • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
    • +
    • Update/EngagedRestartTransitionScheduleForFeatureUpdates
    • +
    • Update/SetDisablePauseUXAccess
    • +
    • Update/SetDisableUXWUAccess
    • +
    +
    WiredNetwork CSPNew CSP added in Windows 10, version 1809. +
    + +## May 2018 + + ++++ + + + + + + + + + + + +
    New or updated articleDescription
    Policy DDF file

    Updated the DDF files in the Windows 10 version 1703 and 1709.

    + +
    + +## April 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    WindowsDefenderApplicationGuard CSP

    Added the following node in Windows 10, version 1803:

    +
      +
    • Settings/AllowVirtualGPU
    • +
    • Settings/SaveFilesToHost
    • +
    +
    NetworkProxy CSP

    Added the following node in Windows 10, version 1803:

    +
      +
    • ProxySettingsPerUser
    • +
    +
    Accounts CSP

    Added a new CSP in Windows 10, version 1803.

    +
    MDM Migration Analysis Tool (MMAT)

    Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

    +
    CSP DDF files download

    Added the DDF download of Windows 10, version 1803 configuration service providers.

    +
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    +
      +
    • Bluetooth/AllowPromptedProximalConnections
    • +
    • KioskBrowser/EnableEndSessionButton
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    • +
    +
    + +## March 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    eUICCs CSP

    Added the following node in Windows 10, version 1803:

    +
      +
    • IsEnabled
    • +
    +
    DeviceStatus CSP

    Added the following node in Windows 10, version 1803:

    +
      +
    • OS/Mode
    • +
    +
    Understanding ADMX-backed policies

    Added the following videos:

    + +
    AccountManagement CSP

    Added a new CSP in Windows 10, version 1803.

    +
    RootCATrustedCertificates CSP

    Added the following node in Windows 10, version 1803:

    +
      +
    • UntrustedCertificates
    • +
    +
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    +
      +
    • ApplicationDefaults/EnableAppUriHandlers
    • +
    • ApplicationManagement/MSIAllowUserControlOverInstall
    • +
    • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    • +
    • Connectivity/AllowPhonePCLinking
    • +
    • Notifications/DisallowCloudNotification
    • +
    • Notifications/DisallowTileNotification
    • +
    • RestrictedGroups/ConfigureGroupMembership
    • +
    +

    The following existing policies were updated:

    +
      +
    • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
    • +
    • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
    • +
    • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
    • +
    +

    Added a new section:

    + +
    Policy CSP - Bluetooth

    Added new section ServicesAllowedList usage guide.

    +
    MultiSIM CSP

    Added SyncML examples and updated the settings descriptions.

    +
    RemoteWipe CSP

    Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

    +
    + +## February 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    +
      +
    • Display/DisablePerProcessDpiForApps
    • +
    • Display/EnablePerProcessDpi
    • +
    • Display/EnablePerProcessDpiForApps
    • +
    • Experience/AllowWindowsSpotlightOnSettings
    • +
    • TextInput/ForceTouchKeyboardDockedState
    • +
    • TextInput/TouchKeyboardDictationButtonAvailability
    • +
    • TextInput/TouchKeyboardEmojiButtonAvailability
    • +
    • TextInput/TouchKeyboardFullModeAvailability
    • +
    • TextInput/TouchKeyboardHandwritingModeAvailability
    • +
    • TextInput/TouchKeyboardNarrowModeAvailability
    • +
    • TextInput/TouchKeyboardSplitModeAvailability
    • +
    • TextInput/TouchKeyboardWideModeAvailability
    • +
        +
    VPNv2 ProfileXML XSD

    Updated the XSD and Plug-in profile example for VPNv2 CSP.

    +
    AssignedAccess CSP

    Added the following nodes in Windows 10, version 1803:

    +
      +
    • Status
    • +
    • ShellLauncher
    • +
    • StatusConfiguration
    • +
    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    +
    MultiSIM CSP

    Added a new CSP in Windows 10, version 1803.

    +
    EnterpriseModernAppManagement CSP

    Added the following node in Windows 10, version 1803:

    +
      +
    • MaintainProcessorArchitectureOnUpdate
    • +
    +
    + +## January 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    +
      +
    • Browser/AllowConfigurationUpdateForBooksLibrary
    • +
    • Browser/AlwaysEnableBooksLibrary
    • +
    • Browser/EnableExtendedBooksTelemetry
    • +
    • Browser/UseSharedFolderForBooks
    • +
    • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    • +
    • DeliveryOptimization/DODelayForegroundDownloadFromHttp
    • +
    • DeliveryOptimization/DOGroupIdSource
    • +
    • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
    • +
    • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
    • +
    • DeliveryOptimization/DORestrictPeerSelectionBy
    • +
    • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
    • +
    • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
    • +
    • KioskBrowser/BlockedUrlExceptions
    • +
    • KioskBrowser/BlockedUrls
    • +
    • KioskBrowser/DefaultURL
    • +
    • KioskBrowser/EnableHomeButton
    • +
    • KioskBrowser/EnableNavigationButtons
    • +
    • KioskBrowser/RestartOnIdleTime
    • +
    • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
    • +
    • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • +
    • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • +
    • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • +
    • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • +
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • +
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • +
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
    • +
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
    • +
    • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
    • +
    • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
    • +
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • +
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • +
    • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
    • +
    • RestrictedGroups/ConfigureGroupMembership
    • +
    • Search/AllowCortanaInAAD
    • +
    • Search/DoNotUseWebResults
    • +
    • Security/ConfigureWindowsPasswords
    • +
    • System/FeedbackHubAlwaysSaveDiagnosticsLocally
    • +
    • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
    • +
    • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    • +
    • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
    • +
    • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
    • +
    • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
    • +
    • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
    • +
    • TaskScheduler/EnableXboxGameSaveTask
    • +
    • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    • +
    • Update/ConfigureFeatureUpdateUninstallPeriod
    • +
    • UserRights/AccessCredentialManagerAsTrustedCaller
    • +
    • UserRights/AccessFromNetwork
    • +
    • UserRights/ActAsPartOfTheOperatingSystem
    • +
    • UserRights/AllowLocalLogOn
    • +
    • UserRights/BackupFilesAndDirectories
    • +
    • UserRights/ChangeSystemTime
    • +
    • UserRights/CreateGlobalObjects
    • +
    • UserRights/CreatePageFile
    • +
    • UserRights/CreatePermanentSharedObjects
    • +
    • UserRights/CreateSymbolicLinks
    • +
    • UserRights/CreateToken
    • +
    • UserRights/DebugPrograms
    • +
    • UserRights/DenyAccessFromNetwork
    • +
    • UserRights/DenyLocalLogOn
    • +
    • UserRights/DenyRemoteDesktopServicesLogOn
    • +
    • UserRights/EnableDelegation
    • +
    • UserRights/GenerateSecurityAudits
    • +
    • UserRights/ImpersonateClient
    • +
    • UserRights/IncreaseSchedulingPriority
    • +
    • UserRights/LoadUnloadDeviceDrivers
    • +
    • UserRights/LockMemory
    • +
    • UserRights/ManageAuditingAndSecurityLog
    • +
    • UserRights/ManageVolume
    • +
    • UserRights/ModifyFirmwareEnvironment
    • +
    • UserRights/ModifyObjectLabel
    • +
    • UserRights/ProfileSingleProcess
    • +
    • UserRights/RemoteShutdown
    • +
    • UserRights/RestoreFilesAndDirectories
    • +
    • UserRights/TakeOwnership
    • +
    • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
    • +
    • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
    • +
    • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
    • +
    • WindowsDefenderSecurityCenter/HideSecureBoot
    • +
    • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    • +
    +

    Added the following policies the were added in Windows 10, version 1709

    +
      +
    • DeviceLock/MinimumPasswordAge
    • +
    • Settings/AllowOnlineTips
    • +
    • System/DisableEnterpriseAuthProxy
    • +
    +

    Security/RequireDeviceEncryption - updated to show it is supported in desktop.

    +
    BitLocker CSP

    Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

    +
    EnterpriseModernAppManagement CSP

    Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

    +
    DMClient CSP

    Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

    +
      +
    • AADSendDeviceToken
    • +
    • BlockInStatusPage
    • +
    • AllowCollectLogsButton
    • +
    • CustomErrorText
    • +
    • SkipDeviceStatusPage
    • +
    • SkipUserStatusPage
    • +
    +
    Defender CSP

    Added new node (OfflineScan) in Windows 10, version 1803.

    +
    UEFI CSP

    Added a new CSP in Windows 10, version 1803.

    +
    Update CSP

    Added the following nodes in Windows 10, version 1803:

    +
      +
    • Rollback
    • +
    • Rollback/FeatureUpdate
    • +
    • Rollback/QualityUpdateStatus
    • +
    • Rollback/FeatureUpdateStatus
    • +
    +
    + +## December 2017 + + ++++ + + + + + + + + + + + +
    New or updated articleDescription
    Configuration service provider reference

    Added new section CSP DDF files download

    +
    + +## November 2017 + + ++++ + + + + + + + + + + + +
    New or updated articleDescription
    Policy CSP

    Added the following policies for Windows 10, version 1709:

    +
      +
    • Authentication/AllowFidoDeviceSignon
    • +
    • Cellular/LetAppsAccessCellularData
    • +
    • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    • +
    • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    • +
    • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
    • +
    • Start/HidePeopleBar
    • +
    • Storage/EnhancedStorageDevices
    • +
    • Update/ManagePreviewBuilds
    • +
    • WirelessDisplay/AllowMdnsAdvertisement
    • +
    • WirelessDisplay/AllowMdnsDiscovery
    • +
    +

    Added missing policies from previous releases:

    +
      +
    • Connectivity/DisallowNetworkConnectivityActiveTest
    • +
    • Search/AllowWindowsIndexer
    • +
    +
    + +## October 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    Policy DDF file

    Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

    +
    Policy CSP

    Updated the following policies:

    +
      +
    • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
    • +
    • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
    • +
    +
    eUICCs CSP

    Added new CSP in Windows 10, version 1709.

    +
    AssignedAccess CSP

    Added SyncML examples for the new Configuration node.

    +
    DMClient CSP

    Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

    +
    + +## September 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1709:

    +
      +
    • Authentication/AllowAadPasswordReset
    • +
    • Handwriting/PanelDefaultModeDocked
    • +
    • Search/AllowCloudSearch
    • +
    • System/LimitEnhancedDiagnosticDataWindowsAnalytics
    • +
    +

    Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

    +
    AssignedAccess CSP

    Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

    +
    Microsoft Store for Business and Microsoft Store

    Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

    +
    The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

    The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

    +
      +
    • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
    • +
    • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
    • +
    • DomainName - fully qualified domain name if the device is domain-joined.
    • +
    +

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

    +
    EnterpriseAPN CSP

    Added a SyncML example.

    +
    VPNv2 CSP

    Added RegisterDNS setting in Windows 10, version 1709.

    +
    Enroll a Windows 10 device automatically using Group Policy

    Added new topic to introduce a new Group Policy for automatic MDM enrollment.

    +
    MDM enrollment of Windows-based devices

    New features in the Settings app:

    +
      +
    • User sees installation progress of critical policies during MDM enrollment.
    • +
    • User knows what policies, profiles, apps MDM has configured
    • +
    • IT helpdesk can get detailed MDM diagnostic information using client tools
    • +
    +

    For details, see Managing connections and Collecting diagnostic logs

    +
    + +## August 2017 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated articleDescription
    Enable ADMX-backed policies in MDM

    Added new step-by-step guide to enable ADMX-backed policies.

    +
    Mobile device enrollment

    Added the following statement:

    +
      +
    • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
    • +
    +
    CM_CellularEntries CSP

    Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

    +
    EnterpriseDataProtection CSP

    Updated the Settings/EDPEnforcementLevel values to the following:

    +
      +
    • 0 (default) – Off / No protection (decrypts previously protected data).
    • +
    • 1 – Silent mode (encrypt and audit only).
    • +
    • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
    • +
    • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
    • +
    +
    AppLocker CSP

    Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Allow list examples.

    +
    DeviceManageability CSP

    Added the following settings in Windows 10, version 1709:

    +
      +
    • Provider/ProviderID/ConfigInfo
    • +
    • Provider/ProviderID/EnrollmentInfo
    • +
    +
    Office CSP

    Added the following setting in Windows 10, version 1709:

    +
      +
    • Installation/CurrentStatus
    • +
    +
    BitLocker CSPAdded information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. +
    Firewall CSPUpdated the CSP and DDF topics. Here are the changes: +
      +
    • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
    • +
    • Changed some data types from integer to bool.
    • +
    • Updated the list of supported operations for some settings.
    • +
    • Added default values.
    • +
    +
    Policy DDF fileAdded another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies: +
      +
    • Browser/AllowMicrosoftCompatibilityList
    • +
    • Update/DisableDualScan
    • +
    • Update/FillEmptyContentUrls
    • +
    +
    Policy CSP

    Added the following new policies for Windows 10, version 1709:

    +
      +
    • Browser/ProvisionFavorites
    • +
    • Browser/LockdownFavorites
    • +
    • ExploitGuard/ExploitProtectionSettings
    • +
    • Games/AllowAdvancedGamingServices
    • +
    • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    • +
    • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
    • +
    • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
    • +
    • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
    • +
    • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    • +
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
    • +
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
    • +
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
    • +
    • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
    • +
    • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
    • +
    • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
    • +
    • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    • +
    • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    • +
    • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
    • +
    • Privacy/EnableActivityFeed
    • +
    • Privacy/PublishUserActivities
    • +
    • Update/DisableDualScan
    • +
    • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    • +
    +

    Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

    +

    Changed the names of the following policies:

    +
      +
    • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
    • +
    • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
    • +
    • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
    • +
    +

    Added links to the additional ADMX-backed BitLocker policies.

    +

    There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

    +
      +
    • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
    • +
    • Start/HideAppList
    • +
    +
    diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index 8837ad757e..0337dad577 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -1,6 +1,6 @@ --- title: ClientCertificateInstall CSP -description: ClientCertificateInstall CSP +description: The ClientCertificateInstall configuration service provider (CSP) enables the enterprise to install client certificates. ms.assetid: B624EB73-2972-47F2-9D7E-826D641BF8A7 ms.reviewer: manager: dansimp @@ -14,17 +14,15 @@ ms.date: 02/28/2020 # ClientCertificateInstall CSP - -The ClientCertificateInstall configuration service provider enables the enterprise to install client certificates. A client certificate has a unique ID, which is the *\[UniqueID\]* for this configuration. Each client certificate must have different UniqueIDs for the SCEP enrollment request. +The ClientCertificateInstall configuration service provider enables the enterprise to install client certificates. A client certificate has a unique ID, which is the *\[UniqueID\]* for this configuration. Each client certificate must have different UniqueIDs for the SCEP enrollment request. For PFX certificate installation and SCEP installation, the SyncML commands must be wrapped in atomic commands to ensure enrollment execution is not triggered until all settings are configured. The Enroll command must be the last item in the atomic block. -> **Note**   -Currently in Windows 10, version 1511, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We are working to fix this issue. +> [!Note] +> Currently in Windows 10, version 1511, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We are working to fix this issue. You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail. - The following image shows the ClientCertificateInstall configuration service provider in tree format. ![clientcertificateinstall csp](images/provisioning-csp-clientcertificateinstall.png) @@ -63,7 +61,6 @@ The data type is an integer corresponding to one of the following values: | 3 | Install to software. | | 4 | Install to Windows Hello for Business (formerly known as Microsoft Passport for Work) whose name is specified | - **ClientCertificateInstall/PFXCertInstall/*UniqueID*/ContainerName** Optional. Specifies the Windows Hello for Business (formerly known as Microsoft Passport for Work) container name (if Windows Hello for Business storage provider (KSP) is chosen for the KeyLocation). If this node is not specified when Windows Hello for Business KSP is chosen, enrollment will fail. @@ -107,9 +104,9 @@ Supported operations are Get, Add, and Replace. **ClientCertificateInstall/PFXCertInstall/*UniqueID*/PFXKeyExportable** Optional. Used to specify if the private key installed is exportable (and can be exported later). The PFX is not exportable when it is installed to TPM. -> **Note**  You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail. +> [!Note] +> You can only set PFXKeyExportable to true if KeyLocation=3. For any other KeyLocation value, the CSP will fail. - The data type bool. Supported operations are Get, Add, and Replace. @@ -138,21 +135,20 @@ Supported operations are Add, Get, and Replace. **ClientCertificateInstall/SCEP** Node for SCEP. -> **Note**  An alert is sent after the SCEP certificate is installed. +> [!Note] +> An alert is sent after the SCEP certificate is installed. - **ClientCertificateInstall/SCEP/***UniqueID* A unique ID to differentiate different certificate installation requests. - **ClientCertificateInstall/SCEP/*UniqueID*/Install** A node required for SCEP certificate enrollment. Parent node to group SCEP cert installation related requests. Supported operations are Get, Add, Replace, and Delete. -> **Note**  Although the child nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values that are set when the Exec command is accepted. The server should not expect the node value change after Exec command is accepted, as it will impact the current enrollment underway. The server should check the Status node value and make sure the device is not at an unknown state before changing child node values. +> [!Note] +> Although the child nodes under Install support Replace commands, once the Exec command is sent to the device, the device will take the values that are set when the Exec command is accepted. The server should not expect the node value change after Exec command is accepted, as it will impact the current enrollment underway. The server should check the Status node value and make sure the device is not at an unknown state before changing child node values. - **ClientCertificateInstall/SCEP/*UniqueID*/Install/ServerURL** Required for SCEP certificate enrollment. Specifies the certificate enrollment server. Multiple server URLs can be listed, separated by semicolons. @@ -191,9 +187,9 @@ Supported operations are Add, Get, and Replace. **ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyProtection** Optional. Specifies where to keep the private key. -> **Note**  Even if the private key is protected by TPM, it is not protected with a TPM PIN. +> [!Note] +> Even if the private key is protected by TPM, it is not protected with a TPM PIN. - The data type is an integer corresponding to one of the following values: | Value | Description | @@ -203,7 +199,6 @@ The data type is an integer corresponding to one of the following values: | 3 | (Default) Private key saved in software KSP. | | 4 | Private key protected by Windows Hello for Business (formerly known as Microsoft Passport for Work). If this option is specified, the ContainerName must be specified, otherwise enrollment will fail. | - Supported operations are Add, Get, Delete, and Replace. **ClientCertificateInstall/SCEP/*UniqueID*/Install/KeyUsage** @@ -238,9 +233,9 @@ Supported operations are Add, Get, Delete, and Replace. **ClientCertificateInstall/SCEP/*UniqueID*/Install/TemplateName** Optional. OID of certificate template name. -> **Note**  This name is typically ignored by the SCEP server; therefore the MDM server typically doesn’t need to provide it. +> [!Note] +> This name is typically ignored by the SCEP server; therefore the MDM server typically doesn’t need to provide it. - Data type is string. Supported operations are Add, Get, Delete, and Replace. @@ -294,7 +289,6 @@ Valid values are: > **Note**  The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) to the SCEP server as part of certificate enrollment request. Depending on the server configuration, the server defines how to use this valid period to create the certificate. - Supported operations are Add, Get, Delete, and Replace. **ClientCertificateInstall/SCEP/*UniqueID*/Install/ValidPeriodUnits** @@ -302,9 +296,9 @@ Optional. Specifies the desired number of units used in the validity period. Thi Data type is string. ->**Note**  The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) to the SCEP server as part of certificate enrollment request. Depending on the server configuration, the server defines how to use this valid period to create the certificate. +> [!Note] +> The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPeriod) to the SCEP server as part of certificate enrollment request. Depending on the server configuration, the server defines how to use this valid period to create the certificate. - Supported operations are Add, Get, Delete, and Replace. **ClientCertificateInstall/SCEP/*UniqueID*/Install/ContainerName** @@ -358,7 +352,6 @@ The only supported operation is Get. | 16 | Action failed | | 32 | Unknown | - **ClientCertificateInstall/SCEP/*UniqueID*/ErrorCode** Optional. An integer value that indicates the HRESULT of the last enrollment error code. @@ -373,7 +366,6 @@ The only supported operation is Get. ## Example - Enroll a client certificate through SCEP. ```xml @@ -669,15 +661,4 @@ Add a PFX certificate. The PFX certificate password is encrypted with a custom c ## Related topics - [Configuration service provider reference](configuration-service-provider-reference.md) - - - - - - - - - - diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index 8601f82b20..ed787a3b0f 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -1,6 +1,6 @@ --- title: ClientCertificateInstall DDF file -description: ClientCertificateInstall DDF file +description: Learn about the OMA DM device description framework (DDF) for the ClientCertificateInstall configuration service provider. ms.assetid: 7F65D045-A750-4CDE-A1CE-7D152AA060CA ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 567dfd207e..5063181c3f 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -1,6 +1,6 @@ --- title: CM\_CellularEntries CSP -description: CM\_CellularEntries CSP +description: Learn how to configure the General Packet Radio Service (GPRS) entries using the CM\_CellularEntries CSP. ms.assetid: f8dac9ef-b709-4b76-b6f5-34c2e6a3c847 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cm-proxyentries-csp.md b/windows/client-management/mdm/cm-proxyentries-csp.md index 301c28ea8e..816b5c188b 100644 --- a/windows/client-management/mdm/cm-proxyentries-csp.md +++ b/windows/client-management/mdm/cm-proxyentries-csp.md @@ -1,6 +1,6 @@ --- title: CM\_ProxyEntries CSP -description: CM\_ProxyEntries CSP +description: Learn how the CM\_ProxyEntries configuration service provider is used to configure proxy connections on the mobile device. ms.assetid: f4c3dc71-c85a-4c68-9ce9-19f408ff7a0a ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md index 1dfca8abb1..67872d03da 100644 --- a/windows/client-management/mdm/cmpolicy-csp.md +++ b/windows/client-management/mdm/cmpolicy-csp.md @@ -1,6 +1,6 @@ --- title: CMPolicy CSP -description: CMPolicy CSP +description: Learn how the CMPolicy configuration service provider (CSP) is used to define rules that the Connection Manager uses to identify correct connections. ms.assetid: 62623915-9747-4eb1-8027-449827b85e6b ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md index 08d0040594..df773dcb43 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-csp.md +++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md @@ -1,6 +1,6 @@ --- title: CMPolicyEnterprise CSP -description: CMPolicyEnterprise CSP +description: Learn how the CMPolicyEnterprise CSP is used to define rules that the Connection Manager uses to identify the correct connection for a connection request. ms.assetid: A0BE3458-ABED-4F80-B467-F842157B94BF ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md index 1eb4a02627..5c1c136c23 100644 --- a/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md +++ b/windows/client-management/mdm/cmpolicyenterprise-ddf-file.md @@ -1,6 +1,6 @@ --- title: CMPolicyEnterprise DDF file -description: CMPolicyEnterprise DDF file +description: Learn about the OMA DM device description framework (DDF) for the CMPolicyEnterprise configuration service provider. ms.assetid: 065EF07A-0CF3-4EE5-B620-3464A75B7EED ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 68141ff2a5..dcf8eec173 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/13/2019 +ms.date: 09/18/2020 --- # Configuration service provider reference -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - A configuration service provider (CSP) is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. Some configuration service providers support the WAP format, some support SyncML, and some support both. SyncML is only used over–the–air for Open Mobile Alliance Device Management (OMA DM), whereas WAP can be used over–the–air for OMA Client Provisioning, or it can be included in the phone image as a .provxml file that is installed during boot. For information about the bridge WMI provider classes that map to these CSPs, see [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224). For CSP DDF files, see [CSP DDF files download](#csp-ddf-files-download). @@ -1111,7 +1108,8 @@ Additional lists: Mobile Enterprise - cross mark + check mark +Only for mobile application management (MAM) check mark check mark @@ -1559,13 +1557,13 @@ Additional lists: Mobile Enterprise - cross mark - cross mark - cross mark - cross mark - cross mark - cross mark - cross mark + check mark + check mark + check mark + check mark + check mark + check mark + check mark @@ -2699,6 +2697,7 @@ Additional lists: ## CSP DDF files download You can download the DDF files for various CSPs from the links below: +- [Download all the DDF files for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/Windows10_2004_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1903](https://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1809](https://download.microsoft.com/download/6/A/7/6A735141-5CFA-4C1B-94F4-B292407AF662/Windows10_1809_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1803](https://download.microsoft.com/download/6/2/7/6276FE19-E3FD-4254-9C16-3C31CAA2DE50/Windows10_1803_DDF_download.zip) @@ -2714,29 +2713,32 @@ The following list shows the CSPs supported in HoloLens devices: | Configuration service provider | HoloLens (1st gen) Development Edition | HoloLens (1st gen) Commercial Suite | HoloLens 2 | |------|--------|--------|--------| -| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) +| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | | [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | -| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | | [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | | [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | +| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | | [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | | [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | | [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 8| | [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | [PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | -| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | | [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | | [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [VPNv2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | @@ -2745,6 +2747,9 @@ The following list shows the CSPs supported in HoloLens devices: ## CSPs supported in Microsoft Surface Hub +- [Accounts CSP](accounts-csp.md)9 + > [!NOTE] + > Support in Surface Hub is limited to **Domain\ComputerName**. - [AccountManagement CSP](accountmanagement-csp.md) - [APPLICATION CSP](application-csp.md) - [CertificateStore CSP](certificatestore-csp.md) @@ -2758,18 +2763,21 @@ The following list shows the CSPs supported in HoloLens devices: - [DMAcc CSP](dmacc-csp.md) - [DMClient CSP](dmclient-csp.md) - [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +- [Firewall-CSP](firewall-csp.md)9 - [HealthAttestation CSP](healthattestation-csp.md) - [NetworkQoSPolicy CSP](networkqospolicy-csp.md) - [NodeCache CSP](nodecache-csp.md) - [PassportForWork CSP](passportforwork-csp.md) - [Policy CSP](policy-configuration-service-provider.md) - [Reboot CSP](reboot-csp.md) -- [RemoteWipe CSP](remotewipe-csp.md) +- [RemoteWipe CSP](remotewipe-csp.md)9 - [Reporting CSP](reporting-csp.md) - [RootCATrustedCertificates CSP](rootcacertificates-csp.md) - [SurfaceHub CSP](surfacehub-csp.md) - [UEFI CSP](uefi-csp.md) +- [Wifi-CSP](wifi-csp.md)9 - [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) +- [Wirednetwork-CSP](wirednetwork-csp.md)9 ## CSPs supported in Windows 10 IoT Core @@ -2806,3 +2814,7 @@ The following list shows the CSPs supported in HoloLens devices: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. +- 7 - Added in Windows 10, version 1909. +- 8 - Added in Windows 10, version 2004. +- 9 - Added in Windows 10 Team 2020 Update +- 10 - Added in [Windows Holographic, version 20H2](https://docs.microsoft.com/hololens/hololens-release-notes#windows-holographic-version-20h2) diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 05add93e6a..17b165ed51 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -1,6 +1,6 @@ --- title: CustomDeviceUI CSP -description: CustomDeviceUI CSP +description: Learn how the CustomDeviceUI configuration service provider (CSP) allows OEMs to implement their custom foreground application. ms.assetid: 20ED1867-7B9E-4455-B397-53B8B15C95A3 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index 12b590ef8c..7623b155f2 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -1,6 +1,6 @@ --- title: CustomDeviceUI DDF -description: CustomDeviceUI DDF +description: Learn about the OMA DM device description framework (DDF) for the CustomDeviceUI configuration service provider. ms.assetid: E6D6B902-C57C-48A6-9654-CCBA3898455E ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 99080ed5f3..37205534c5 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,6 +1,6 @@ --- title: Defender CSP -description: Defender CSP +description: Learn how the Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. ms.assetid: 481AA74F-08B2-4A32-B95D-5A3FD05B335C ms.reviewer: manager: dansimp @@ -10,13 +10,13 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 10/21/2019 +ms.date: 08/11/2020 --- # Defender CSP > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. The Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. @@ -51,7 +51,7 @@ Supported operation is Get. **Detections/*ThreatId*/Severity** Threat severity ID. -The data type is a integer. +The data type is integer. The following list shows the supported values: @@ -66,7 +66,7 @@ Supported operation is Get. **Detections/*ThreatId*/Category** Threat category ID. -The data type is a integer. +The data type is integer. The following table describes the supported values: @@ -123,14 +123,12 @@ The following table describes the supported values: | 50 | Ransomware | | 51 | ASR Rule | - - Supported operation is Get. **Detections/*ThreatId*/CurrentStatus** Information about the current status of the threat. -The data type is a integer. +The data type is integer. The following list shows the supported values: @@ -151,7 +149,7 @@ Supported operation is Get. **Detections/*ThreatId*/ExecutionStatus** Information about the execution status of the threat. -The data type is a integer. +The data type is integer. Supported operation is Get. @@ -172,7 +170,7 @@ Supported operation is Get. **Detections/*ThreatId*/NumberOfDetections** Number of times this threat has been detected on a particular client. -The data type is a integer. +The data type is integer. Supported operation is Get. @@ -182,9 +180,9 @@ An interior node to group information about Windows Defender health status. Supported operation is Get. **Health/ProductStatus** -Added in Windows 10, version 1809. Provide the current state of the product. This is a bitmask flag value that can represent one or multiple product states from below list. +Added in Windows 10, version 1809. Provide the current state of the product. This is a bitmask flag value that can represent one or multiple product states from below list. -Data type is integer. Supported operation is Get. +The data type is integer. Supported operation is Get. Supported product status values: - No status = 0 @@ -235,7 +233,7 @@ Example: **Health/ComputerState** Provide the current state of the device. -The data type is a integer. +The data type is integer. The following list shows the supported values: @@ -251,60 +249,60 @@ Supported operation is Get. **Health/DefenderEnabled** Indicates whether the Windows Defender service is running. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/RtpEnabled** Indicates whether real-time protection is running. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/NisEnabled** Indicates whether network protection is running. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/QuickScanOverdue** Indicates whether a Windows Defender quick scan is overdue for the device. -A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and [catchup Quick scans](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupquickscan) are disabled (default) +A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and [catchup Quick scans](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupquickscan) are disabled (default). -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/FullScanOverdue** Indicates whether a Windows Defender full scan is overdue for the device. -A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and [catchup Full scans](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupfullscan) are disabled (default) +A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and [catchup Full scans](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-disablecatchupfullscan) are disabled (default). -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/SignatureOutOfDate** Indicates whether the Windows Defender signature is outdated. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/RebootRequired** Indicates whether a device reboot is needed. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. **Health/FullScanRequired** Indicates whether a Windows Defender full scan is required. -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. @@ -360,7 +358,7 @@ Supported operation is Get. **Health/TamperProtectionEnabled** Indicates whether the Windows Defender tamper protection feature is enabled.​ -The data type is a boolean. +The data type is a Boolean. Supported operation is Get. @@ -392,11 +390,19 @@ Intune tamper protection setting UX supports three states: When enabled or disabled exists on the client and admin moves the setting to not configured, it will not have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. -**Configuration/EnableFileHashComputation** -Enables or disables file hash computation feature. -When this feature is enabled Windows defender will compute hashes for files it scans. +**Configuration/DisableLocalAdminMerge**
    +This policy setting controls whether or not complex list settings configured by a local administrator are merged with managed settings. This setting applies to lists such as threats and exclusions. -The data type is a integer. +If you disable or do not configure this setting, unique items defined in preference settings configured by the local administrator will be merged into the resulting effective policy. In the case of conflicts, management settings will override preference settings. + +If you enable this setting, only items defined by management will be used in the resulting effective policy. Managed settings will override preference settings configured by the local administrator. + +> [!NOTE] +> Applying this setting will not remove exclusions from the device registry, it will only prevent them from being applied/used. This is reflected in **Get-MpPreference**. + +Supported OS versions: Windows 10 + +The data type is integer. Supported operations are Add, Delete, Get, Replace. @@ -404,6 +410,38 @@ Valid values are: - 1 – Enable. - 0 (default) – Disable. +**Configuration/EnableFileHashComputation** +Enables or disables file hash computation feature. +When this feature is enabled Windows defender will compute hashes for files it scans. + +The data type is integer. + +Supported operations are Add, Delete, Get, Replace. + +Valid values are: +- 1 – Enable. +- 0 (default) – Disable. + +**Configuration/SupportLogLocation** +The support log location setting allows the administrator to specify where the Microsoft Defender Antivirus diagnostic data collection tool (**MpCmdRun.exe**) will save the resulting log files. This setting is configured with an MDM solution, such as Intune, and is available for Windows 10 Enterprise. + +Data type is string. + +Supported operations are Add, Delete, Get, Replace. + +Intune Support log location setting UX supports three states: + +- Not configured (default) - Does not have any impact on the default state of the device. +- 1 - Enabled. Enables the Support log location feature. Requires admin to set custom file path. +- 0 - Disabled. Turns off the Support log location feature. + +When enabled or disabled exists on the client and admin moves the setting to not configured, it will not have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. + +More details: + +- [Microsoft Defender AV diagnostic data](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data) +- [Collect investigation package from devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#collect-investigation-package-from-devices) + **Scan** Node that can be used to start a Windows Defender scan on a device. @@ -419,11 +457,10 @@ Node that can be used to perform signature updates for Windows Defender. Supported operations are Get and Execute. **OfflineScan** -Added in Windows 10, version 1803. OfflineScan action starts a Windows Defender offline scan on the computer where you run the command. After the next OS reboot, the device will start in Windows Defender offline mode to begin the scan. +Added in Windows 10, version 1803. OfflineScan action starts a Microsoft Defender Offline scan on the computer where you run the command. After the next OS reboot, the device will start in Microsoft Defender Offline mode to begin the scan. Supported operations are Get and Execute. ## Related topics - [Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index e5c1dcd59e..a63f4dec92 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,6 +1,6 @@ --- title: Defender DDF file -description: Defender DDF file +description: Learn how the OMA DM device description framework (DDF) for the Defender configuration service provider is used. ms.assetid: 39B9E6CF-4857-4199-B3C3-EC740A439F65 ms.reviewer: manager: dansimp @@ -10,12 +10,11 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 10/21/2019 +ms.date: 08/11/2020 --- # Defender DDF file - This topic shows the OMA DM device description framework (DDF) for the **Defender** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). @@ -46,7 +45,7 @@ The XML below is the current version for this CSP. - com.microsoft/1.2/MDM/Defender + com.microsoft/1.3/MDM/Defender @@ -735,6 +734,29 @@ The XML below is the current version for this CSP. + + SupportLogLocation + + + + + + + + + + + + + + + + + + text/plain + + + Scan diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index 859ffd1672..11ab51bf9e 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -1,6 +1,6 @@ --- title: DevDetail CSP -description: DevDetail CSP +description: Learn how the DevDetail configuration service provider handles the management object which provides device-specific parameters to the OMA DM server. ms.assetid: 719bbd2d-508d-439b-b175-0874c7e6c360 ms.reviewer: manager: dansimp @@ -14,9 +14,6 @@ ms.date: 03/27/2020 # DevDetail CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The DevDetail configuration service provider handles the management object which provides device-specific parameters to the OMA DM server. These device parameters are not sent from the client to the server automatically, but can be queried by servers using OMA DM commands. > [!NOTE] @@ -135,7 +132,7 @@ Value type is string. Supported operations are Get and Replace. **Ext/Microsoft/DNSComputerName** -Added in the next major release of Windows 10. This node specifies the DNS computer name for a device. The server must explicitly reboot the device for this value to take effect. A couple of macros can be embedded within the value for dynamic substitution. Using any of these macros will limit the new name to 63 characters. This node replaces the **Domain/ComputerName** node in [Accounts CSP](accounts-csp.md). +Added in Windows 10, version 2004. This node specifies the DNS computer name for a device. The server must explicitly reboot the device for this value to take effect. A couple of macros can be embedded within the value for dynamic substitution. Using any of these macros will limit the new name to 63 characters. This node replaces the **Domain/ComputerName** node in [Accounts CSP](accounts-csp.md). The following are the available naming macros: diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index 47df0219d5..25be11c21b 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -1,6 +1,6 @@ --- title: DevDetail DDF file -description: DevDetail DDF file +description: Learn about the OMA DM device description framework (DDF) for the DevDetail configuration service provider. ms.assetid: 645fc2b5-2d2c-43b1-9058-26bedbe9f00d ms.reviewer: manager: dansimp @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/11/2018 +ms.date: 06/03/2020 --- # DevDetail DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **DevDetail** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). @@ -724,4 +721,5 @@ The XML below is the current version for this CSP. + ``` diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index 09d6af05e4..f24564545c 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -1,6 +1,6 @@ --- title: DeviceInstanceService CSP -description: DeviceInstanceService CSP +description: Learn how the DeviceInstanceService configuration service provider (CSP) provides some device inventory information that could be useful for an enterprise. ms.assetid: f113b6bb-6ce1-45ad-b725-1b6610721e2d ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index 246408076e..cef65071ec 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -1,6 +1,6 @@ --- title: DeviceLock CSP -description: DeviceLock CSP +description: Learn how the DeviceLock configuration service provider (CSP) is used by the enterprise management server to configure device lock related policies. ms.assetid: 9a547efb-738e-4677-95d3-5506d350d8ab ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index 545ebcdb9b..eb63ef11fe 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -1,6 +1,6 @@ --- title: DeviceLock DDF file -description: DeviceLock DDF file +description: Learn about the OMA DM device description framework (DDF) for the DeviceLock configuration service provider (CSP). ms.assetid: 46a691b9-6350-4987-bfc7-f8b1eece3ad9 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index 06e4d21323..6ab35ba018 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -36,9 +36,8 @@ Supported operation is Get. **DeviceStatus/CellularIdentities** Required. Node for queries on the SIM cards. -> **Note**  Multiple SIMs are supported. - - +>[!NOTE] +>Multiple SIMs are supported. **DeviceStatus/CellularIdentities/***IMEI* The unique International Mobile Station Equipment Identity (IMEI) number of the mobile device. An IMEI is present for each SIM card on the device. @@ -107,7 +106,7 @@ Supported operation is Get. Node for the compliance query. **DeviceStatus/Compliance/EncryptionCompliance** -Boolean value that indicates compliance with the enterprise encryption policy. The value is one of the following: +Boolean value that indicates compliance with the enterprise encryption policy for OS (system) drives. The value is one of the following: - 0 - not encrypted - 1 - encrypted diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md index 7252e076c2..ba02947ada 100644 --- a/windows/client-management/mdm/devinfo-csp.md +++ b/windows/client-management/mdm/devinfo-csp.md @@ -1,6 +1,6 @@ --- title: DevInfo CSP -description: DevInfo CSP +description: Learn now the DevInfo configuration service provider handles the managed object which provides device information to the OMA DM server. ms.assetid: d3eb70db-1ce9-4c72-a13d-651137c1713c ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index b81a21b82e..aec2b4cc91 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -1,6 +1,6 @@ --- title: DevInfo DDF file -description: DevInfo DDF file +description: Learn about the OMA DM device description framework (DDF) for the DevInfo configuration service provider (CSP). ms.assetid: beb07cc6-4133-4c0f-aa05-64db2b4a004f ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 2e5300fe0d..fb9c1a57d8 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -1,6 +1,6 @@ --- title: DiagnosticLog CSP -description: DiagnosticLog CSP +description: Learn about the feature areas of the DiagnosticLog configuration service provider (CSP), including the DiagnosticLog area and Policy area. ms.assetid: F76E0056-3ACD-48B2-BEA1-1048C96571C3 ms.reviewer: manager: dansimp @@ -56,21 +56,16 @@ The supported operations are Add and Execute. The data type is string. Expected value: -Set and Execute are functionality equivalent, and each accepts an XML snippet (as a string) describing what data to gather and where to upload it. - -The following is an example of the XML. This example instructs the CSP to gather: -- All the keys and values under a registry path -- All the *.etl files in a folder -- The output of two commands -- Additional files created by one of the commands -- All the Application event log events. - -The results are zipped and uploaded to the specified SasUrl. The filename format is "DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip". +Set and Execute are functionality equivalent, and each accepts a `Collection` XML snippet (as a string) describing what data to gather and where to upload it. The results are zipped and uploaded to the specified SasUrl. The zipped filename format is "DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip". + +The following is an example of a `Collection` XML. ``` xml - server generated guid value such as f1e20cb4-9789-4f6b-8f6a-766989764c6d - server generated url where the HTTP PUT will be accepted + + f1e20cb4-9789-4f6b-8f6a-766989764c6d + + HKLM\Software\Policies %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl %windir%\system32\ipconfig.exe /all @@ -83,15 +78,13 @@ The results are zipped and uploaded to the specified SasUrl. The filename format The XML should include the following elements within the `Collection` element: **ID** -The ID value is a server-generated GUID string that identifies this data-gathering request. To avoid accidental repetition of data gathering, the CSP ignores subsequent Set or Execute invocations with the same ID value. +The ID value uniquely identifies this data-gathering request. To avoid accidental repetition of data gathering, the CSP ignores subsequent Set or Execute invocations with the same ID value. The CSP expects the value to be populated when the request is received, so it must be generated by the IT admin or the management server. **SasUrl** -The SasUrl value is the target URI to which the CSP uploads the results zip file. It is the responsibility of the management server to provision storage in such a way that the server accepts the HTTP PUT to this URL. For example, the device management service could: -- Provision cloud storage, such as an Azure blob storage container or other storage managed by the device management server -- Generate a dynamic https SAS token URL representing the storage location (and which is understood by the server to allow a one-time upload or time-limited uploads) -- Pass this value to the CSP as the SasUrl value. - -Assuming a case where the management server's customer (such as an IT admin) is meant to access the data, the management server would also expose the stored data through its user interface or APIs. +The SasUrl value is the target URI to which the CSP uploads the zip file containing the gathered data. It is the responsibility of the management server to provision storage in such a way that the storage server accepts the device's HTTP PUT to this URL. For example, the device management service could: +- Provision cloud storage reachable by the target device, such as a Microsoft Azure blob storage container +- Generate a Shared Access Signature URL granting the possessor (the target device) time-limited write access to the storage container +- Pass this value to the CSP on the target device through the `Collection` XML as the `SasUrl` value. **One or more data gathering directives, which may include any of the following:** @@ -206,8 +199,111 @@ A Get to the above URI will return the results of the data gathering for the las Each data gathering node is annotated with the HRESULT of the action and the collection is also annotated with an overall HRESULT. In this example, note that the mdmdiagnosticstool.exe command failed. -The zip file which is created also contains a results.xml file whose contents align to the Data section in the SyncML for ArchiveResults. Accordingly, an IT admin using the zip file for troubleshooting can determine the order and success of each directive without needing a permanent record of the SyncML value for DiagnosticArchive/ArchiveResults. +### Making use of the uploaded data +The zip archive which is created and uploaded by the CSP contains a folder structure like the following: +```powershell +PS C:\> dir C:\DiagArchiveExamples\DiagLogs-MYDEVICE-20201202T182748Z + + Directory: C:\DiagArchiveExamples\DiagLogs-MYDEVICE-20201202T182748Z + +Mode LastWriteTime Length Name +---- ------------- ------ ---- +la--- 1/4/2021 2:45 PM 1 +la--- 1/4/2021 2:45 PM 2 +la--- 12/2/2020 6:27 PM 2701 results.xml +``` +Each data gathering directive from the original `Collection` XML corresponds to a folder in the output. For example, if the first directive was HKLM\Software\Policies then folder `1` will contain the corresponding `export.reg` file. + +The `results.xml` file is the authoritative map to the output. It includes a status code for each directive. The order of the directives in the file corresponds to the order of the output folders. Using `results.xml` the administrator can see what data was gathered, what failures may have occurred, and which folders contain which output. For example, the following `results.xml` content indicates that registry export of HKLM\Software\Policies was successful and the data can be found in folder `1`. It also indicates that `netsh.exe wlan show profiles` command failed. + +```xml + + 268b3056-8c15-47c6-a1bd-4bc257aef7b2 + HKLM\Software\Policies + %windir%\system32\netsh.exe wlan show profiles + +``` + +Administrators can apply automation to 'results.xml' to create their own preferred views of the data. For example, the following PowerShell one-liner extracts from the XML an ordered list of the directives with status code and details. +```powershell +Select-XML -Path results.xml -XPath '//RegistryKey | //Command | //Events | //FoldersFiles' | Foreach-Object -Begin {$i=1} -Process { [pscustomobject]@{DirectiveNumber=$i; DirectiveHRESULT=$_.Node.HRESULT; DirectiveInput=$_.Node.('#text')} ; $i++} +``` +This example produces output similar to the following: +``` +DirectiveNumber DirectiveHRESULT DirectiveInput +--------------- ---------------- -------------- + 1 0 HKLM\Software\Policies + 2 0 HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall + 3 0 HKLM\Software\Microsoft\IntuneManagementExtension + 4 0 HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall + 5 0 %windir%\system32\ipconfig.exe /all + 6 0 %windir%\system32\netsh.exe advfirewall show allprofiles + 7 0 %windir%\system32\netsh.exe advfirewall show global + 8 -2147024895 %windir%\system32\netsh.exe wlan show profiles +``` + +The next example extracts the zip archive into a customized flattened file structure. Each file name includes the directive number, HRESULT, and so on. This example could be customized to make different choices about what information to include in the file names and what formatting choices to make for special characters. + +```powershell +param( $DiagnosticArchiveZipPath = "C:\DiagArchiveExamples\DiagLogs-MYDEVICE-20201202T182748Z.zip" ) + +#region Formatting Choices +$flatFileNameTemplate = '({0:D2}) ({3}) (0x{2:X8})' +$maxLengthForInputTextPassedToOutput = 80 +#endregion + +#region Create Output Folders and Expand Zip +$diagnosticArchiveTempUnzippedPath = $DiagnosticArchiveZipPath + "_expanded" +if(-not (Test-Path $diagnosticArchiveTempUnzippedPath)){mkdir $diagnosticArchiveTempUnzippedPath} +$reformattedArchivePath = $DiagnosticArchiveZipPath + "_formatted" +if(-not (Test-Path $reformattedArchivePath)){mkdir $reformattedArchivePath} +Expand-Archive -Path $DiagnosticArchiveZipPath -DestinationPath $diagnosticArchiveTempUnzippedPath +#endregion + +#region Discover and Move/rename Files +$resultElements = ([xml](Get-Content -Path (Join-Path -Path $diagnosticArchiveTempUnzippedPath -ChildPath "results.xml"))).Collection.ChildNodes | Foreach-Object{ $_ } +$n = 0 +foreach( $element in $resultElements ) +{ + $directiveNumber = $n + $n++ + if($element.Name -eq 'ID'){ continue } + $directiveType = $element.Name + $directiveStatus = [int]$element.Attributes.ItemOf('HRESULT').psbase.Value + $directiveUserInputRaw = $element.InnerText + $directiveUserInputFileNameCompatible = $directiveUserInputRaw -replace '[\\|/\[\]<>\:"\?\*%\.\s]','_' + $directiveUserInputTrimmed = $directiveUserInputFileNameCompatible.substring(0, [System.Math]::Min($maxLengthForInputTextPassedToOutput, $directiveUserInputFileNameCompatible.Length)) + $directiveSummaryString = $flatFileNameTemplate -f $directiveNumber,$directiveType,$directiveStatus,$directiveUserInputTrimmed + $directiveOutputFolder = Join-Path -Path $diagnosticArchiveTempUnzippedPath -ChildPath $directiveNumber + $directiveOutputFiles = Get-ChildItem -Path $directiveOutputFolder -File + foreach( $file in $directiveOutputFiles) + { + $leafSummaryString = $directiveSummaryString,$file.Name -join ' ' + Copy-Item $file.FullName -Destination (Join-Path -Path $reformattedArchivePath -ChildPath $leafSummaryString) + } +} +#endregion +Remove-Item -Path $diagnosticArchiveTempUnzippedPath -Force -Recurse +``` +That example script produces a set of files similar to the following, which can be a useful view for an administrator interactively browsing the results without needing to navigate any sub-folders or refer to `results.xml` repeatedly: + +```powershell +PS C:\> dir C:\DiagArchiveExamples\DiagLogs-MYDEVICE-20201202T182748Z.zip_formatted | format-table Length,Name + + Length Name + ------ ---- + 46640 (01) (HKLM_Software_Policies) (0x00000000) export.reg + 203792 (02) (HKLM_Software_Microsoft_Windows_CurrentVersion_Uninstall) (0x00000000) export.reg + 214902 (03) (HKLM_Software_Microsoft_IntuneManagementExtension) (0x00000000) export.reg + 212278 (04) (HKLM_SOFTWARE_WOW6432Node_Microsoft_Windows_CurrentVersion_Uninstall) (0x00000000) export.reg + 2400 (05) (_windir__system32_ipconfig_exe__all) (0x00000000) output.log + 2147 (06) (_windir__system32_netsh_exe_advfirewall_show_allprofiles) (0x00000000) output.log + 1043 (07) (_windir__system32_netsh_exe_advfirewall_show_global) (0x00000000) output.log + 59 (08) (_windir__system32_netsh_exe_wlan_show_profiles) (0x80070001) output.log + 1591 (09) (_windir__system32_ping_exe_-n_50_localhost) (0x00000000) output.log + 5192 (10) (_windir__system32_Dsregcmd_exe__status) (0x00000000) output.log +``` ## Policy area @@ -1482,4 +1578,4 @@ To read a log file: 5. Set **BlockIndexToRead** to initialize read start point. 6. Get **BlockData** for upload log block. 7. Increase **BlockIndexToRead**. -8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**. \ No newline at end of file +8. Repeat steps 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**. diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index 8bedac1205..f635ed44c6 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1,6 +1,6 @@ --- title: DiagnosticLog DDF -description: DiagnosticLog DDF +description: Learn about the the OMA DM device description framework (DDF) for the DiagnosticLog configuration service provider (CSP). ms.assetid: 9DD75EDA-5913-45B4-9BED-20E30CDEBE16 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 3cb1682333..35fe6568b0 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -44,7 +44,8 @@ In Windows, after the user confirms the account deletion command and before the This action utilizes the OMA DM generic alert 1226 function to send a user an MDM unenrollment user alert to the MDM server after the device accepts the user unenrollment request, but before it deletes any enterprise data. The server should set the expectation that unenrollment may succeed or fail, and the server can check whether the device is unenrolled by either checking whether the device calls back at scheduled time or by sending a push notification to the device to see whether it responds back. If the server plans to send a push notification, it should allow for some delay to give the device the time to complete the unenrollment work. -> **Note**  The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, refer to the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526). +> [!NOTE] +> The user unenrollment is an OMA DM standard. For more information about the 1226 generic alert, refer to the OMA Device Management Protocol specification (OMA-TS-DM\_Protocol-V1\_2\_1-20080617-A), available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).   The vendor uses the Type attribute to specify what type of generic alert it is. For device initiated MDM unenrollment, the alert type is **com.microsoft:mdm.unenrollment.userrequest**. @@ -157,4 +158,3 @@ When the disconnection is completed, the user is notified that the device has be - diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index aa61f9d50b..4a45bf4eb2 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,6 +1,6 @@ --- title: DMAcc CSP -description: DMAcc CSP +description: Learn how the DMAcc configuration service provider (CSP) allows an OMA Device Management (DM) version 1.2 server to handle OMA DM account objects. ms.assetid: 43e73d8a-6617-44e7-8459-5c96f4422e63 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index 232f5672cd..b10dcad38a 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,6 +1,6 @@ --- title: DMAcc DDF file -description: DMAcc DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMAcc configuration service provider (CSP). ms.assetid: 44dc99aa-2a85-498b-8f52-a81863765606 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index 9469f12408..6ed30e55f1 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -21,11 +21,15 @@ The following diagram shows the DMClient CSP in tree format. ![dmclient csp](images/provisioning-csp-dmclient-th2.png) + +**./Vendor/MSFT** +All the nodes in this CSP are supported in the device context, except for the **ExchangeID** node, which is supported in the user context. For the device context, use the **./Device/Vendor/MSFT** path and for the user context, use the **./User/Vendor/MSFT** path. + **DMClient** Root node for the CSP. **UpdateManagementServiceAddress** -For provisioning packages only. Specifies the list of servers (semicolon delimited). The first server in the semicolon delimited list is the server that will be used to instantiate MDM sessions. The list can be a permutation or a subset of the existing server list. You cannot add new servers to the list using this node. +For provisioning packages only. Specifies the list of servers (semicolon delimited). The first server in the semicolon-delimited list is the server that will be used to instantiate MDM sessions. The list can be a permutation or a subset of the existing server list. You cannot add new servers to the list using this node. **HWDevID** Added in Windows 10, version 1703. Returns the hardware device ID. @@ -221,7 +225,7 @@ Added in Windows 10, version 1607. Returns the hardware device ID. Supported operation is Get. **Provider/*ProviderID*/CommercialID** -Added in Windows 10, version 1607. Configures the identifier used to uniquely associate this diagnostic data of this device as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data with your organization.. +Added in Windows 10, version 1607. Configures the identifier used to uniquely associate this diagnostic data of this device as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its diagnostic data with your organization. Supported operations are Add, Get, Replace, and Delete. @@ -265,7 +269,7 @@ Supported operations are Add, Delete, Get, and Replace. Value type is integer. **Provider/*ProviderID*/AADSendDeviceToken** -Device. Added in Windows 10 version 1803. For Azure AD backed enrollments, this will cause the client to send a Device Token if the User Token can not be obtained. +Device. Added in Windows 10 version 1803. For Azure AD backed enrollments, this will cause the client to send a Device Token if the User Token cannot be obtained. Supported operations are Add, Delete, Get, and Replace. Value type is bool. diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 15b21d0197..c5ba87da90 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -1,6 +1,6 @@ --- title: DMClient DDF file -description: DMClient DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMClient configuration service provider (CSP). ms.assetid: A21B33AF-DB76-4059-8170-FADF2CB898A0 ms.reviewer: manager: dansimp @@ -1022,7 +1022,6 @@ The XML below is for Windows 10, version 1803. - diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index 25b59bccc1..b9ed5780d0 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -1,6 +1,6 @@ --- title: DMProcessConfigXMLFiltered function -description: Configures phone settings by using OMA Client Provisioning XML. +description: Learn how the DMProcessConfigXMLFiltered function configures phone settings by using OMA Client Provisioning XML. Search.Refinement.TopicID: 184 ms.assetid: 31D79901-6206-454C-AE78-9B85A3B3487F ms.reviewer: @@ -24,8 +24,8 @@ ms.date: 06/26/2017 # DMProcessConfigXMLFiltered function -> **Important**   -The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. Please see [Connectivity configuration](https://msdn.microsoft.com/library/windows/hardware/dn757424) for more information about the new process for provisioning connectivity configuration. However, this function is still supported for other OEM uses. +> [!Important] +> The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. Please see [Connectivity configuration](https://msdn.microsoft.com/library/windows/hardware/dn757424) for more information about the new process for provisioning connectivity configuration. However, this function is still supported for other OEM uses. Configures phone settings by using OMA Client Provisioning XML. Use of this function is strictly limited to the following scenarios. diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index b395c7c3ba..65aeb1a961 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -1,6 +1,6 @@ --- title: DMSessionActions CSP -description: DMSessionActions CSP +description: Learn how the DMSessionActions configuration service provider (CSP) is used to manage the number of sessions the client skips if the device is in a low power state. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index aef1210842..61b4b4754a 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -1,6 +1,6 @@ --- title: DMSessionActions DDF file -description: DMSessionActions DDF file +description: Learn about the OMA DM device description framework (DDF) for the DMSessionActions configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index e7d55aedc0..b6fe50d931 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -1,6 +1,6 @@ --- title: DynamicManagement CSP -description: DynamicManagement CSP +description: Learn how the Dynamic Management configuration service provider (CSP) enables configuration of policies that change how the device is managed. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index 3439bf646a..2690fa4e23 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: DynamicManagement DDF file -description: DynamicManagement DDF file +description: Learn about the OMA DM device description framework (DDF) for the DynamicManagement configuration service provider (CSP). ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md index ddb14a8d3f..844fc1be39 100644 --- a/windows/client-management/mdm/email2-csp.md +++ b/windows/client-management/mdm/email2-csp.md @@ -1,6 +1,6 @@ --- title: EMAIL2 CSP -description: EMAIL2 CSP +description: Learn how the EMAIL2 configuration service provider (CSP) is used to configure Simple Mail Transfer Protocol (SMTP) email accounts. ms.assetid: bcfc9d98-bc2e-42c6-9b81-0b5bf65ce2b8 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index f24a64e3e3..4f11b5b64d 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -1,6 +1,6 @@ --- title: EMAIL2 DDF file -description: EMAIL2 DDF file +description: Learn how the OMA DM device description framework (DDF) for the EMAIL2 configuration service provider (CSP). ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index 384babdddb..d79b428c0e 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -1,6 +1,6 @@ --- title: Enable ADMX-backed policies in MDM -description: Guide to configuring ADMX-backed policies in MDM +description: Use this step-by-step guide to configure a selected set of Group Policy administrative templates (ADMX-backed policies) in Mobile Device Management (MDM). ms.author: dansimp ms.topic: article ms.prod: w10 @@ -17,7 +17,7 @@ manager: dansimp This is a step-by-step guide to configuring ADMX-backed policies in MDM. -Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support was expanded to allow access of select Group Policy administrative templates (ADMX-backed policies) for Windows PCs via the [Policy configuration service provider (CSP)](policy-configuration-service-provider.md). Configuring ADMX-backed policies in Policy CSP is different from the typical way you configure a traditional MDM policy. +Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support was expanded to allow access of [selected set of Group Policy administrative templates (ADMX-backed policies)](https://docs.microsoft.com/windows/client-management/mdm/policy-csps-admx-backed) for Windows PCs via the [Policy configuration service provider (CSP)](policy-configuration-service-provider.md). Configuring ADMX-backed policies in Policy CSP is different from the typical way you configure a traditional MDM policy. Summary of steps to enable a policy: - Find the policy from the list ADMX-backed policies. @@ -33,9 +33,9 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( ## Enable a policy > [!NOTE] -> See [Understanding ADMX-backed policies](https://docs.microsoft.com/windows/client-management/mdm/understanding-admx-backed-policies). +> See [Understanding ADMX-backed policies in Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/understanding-admx-backed-policies). -1. Find the policy from the list [ADMX-backed policies](policies-admx-backed.md). You need the following information listed in the policy description. +1. Find the policy from the list [ADMX-backed policies](policy-csps-admx-backed.md). You need the following information listed in the policy description. - GP English name - GP name - GP ADMX file name @@ -65,37 +65,37 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( In this example you configure **Enable App-V Client** to **Enabled**. -> [!NOTE] -> The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. - -```xml - - - - 2 - - - chr - text/plain - - - ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/AllowAppVClient - - - - - - - -``` + > [!NOTE] + > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. + + ```xml + + + + 2 + + + chr + text/plain + + + ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/AllowAppVClient + + + + + + + + ``` ## Enable a policy that requires parameters -1. Create the SyncML to enable the policy that requires parameters. + 1. Create the SyncML to enable the policy that requires parameters. - In this example, the policy is in **Administrative Templates > System > App-V > Publishing**. + In this example, the policy is in **Administrative Templates > System > App-V > Publishing**. 1. Double-click **Publishing Server 2 Settings** to see the parameters you need to configure when you enable this policy. @@ -107,7 +107,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](policy-configuration-service-provider.md#appvirtualization-publishingallowserver2). - ![Publishing server 2 policy description](images/admx-appv-policy-description.png) + ![Publishing server 2 policy description](images/admx-appv-policy-description.png) 3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the admx files) and open appv.admx. @@ -227,41 +227,41 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( Here is the example for **AppVirtualization/PublishingAllowServer2**: -> [!NOTE] -> The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. - - ```xml - - - - - 2 - - - chr - text/plain - - - ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2 - - - ]]> - - - - - - - ``` + > [!NOTE] + > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. + + ```xml + + + + + 2 + + + chr + text/plain + + + ./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2 + + + ]]> + + + + + + + ``` ## Disable a policy diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index 32ac15d67d..f4c951af17 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -1,6 +1,6 @@ --- title: Enable offline upgrades to Windows 10 for Windows Embedded 8.1 Handheld devices -description: Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. +description: Overview of how to enable offline updates using Microsoft Endpoint Configuration Manager. ms.assetid: ED3DAF80-847C-462B-BDB1-486577906772 ms.reviewer: manager: dansimp @@ -15,9 +15,9 @@ ms.date: 06/26/2017 # Enable offline upgrades to Windows 10 for Windows Embedded 8.1 Handheld devices -Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. However, in some enterprise environments, devices may not be able to access the Internet to retrieve their updates. Because of network restrictions or other enterprise policies, devices must download their updates from an internal location. This document describes how to enable offline updates using Microsoft Endpoint Configuration Manager. +Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. However, in some enterprise environments, devices may not be able to access the Internet to retrieve their updates. There are also situations where network restrictions or other enterprise policies require that devices download updates from an internal location. This article describes how to enable offline updates using Microsoft Endpoint Configuration Manager. -Here is a table of update path to Windows 10 Mobile. +The following table describes the update path to Windows 10 Mobile. @@ -47,9 +47,7 @@ Here is a table of update path to Windows 10 Mobile.
      -To configure the MDM service provider and enable the mobile devices to download updates from a predefined internal location, an IT administrator or device administrator must perform a series of manual and automated steps. - -Here is the outline of the process: +To configure the mobile device management (MDM) service provider and enable mobile devices to download updates from a predefined internal location, an IT administrator or device administrator must perform a series of manual and automated steps: 1. Prepare a test device that can connect to the Internet to download the released update packages. 2. After the updates are downloaded and before pressing the install button, retrieve an XML file on the device that contains all the metadata about each update package. @@ -61,64 +59,65 @@ Here is the outline of the process: 8. Create two additional XML files that define the specific updates to download and the specific locations from which to download the updates, and deploy them onto the production device. 9. Start the update process from the devices. -As a part of the update process, Windows will run data migrators to bring forward configured settings and data on the device. For instance, if the device was configured with a maintenance time or other update policy in Windows Embedded 8.1 Handheld, these settings will automatically get migrated to Windows 10 as part of the update process. If the Handheld device was configured for assigned access lockdown, then this configuration will also get migrated to Windows 10 as part of the update process. This includes ProductId & AumId conversion for all internal apps (including buttonremapping apps). +As a part of the update process, Windows runs data migrators to bring forward configured settings and data on the device. For instance, if the device was configured with a maintenance time or other update policy in Windows Embedded 8.1 Handheld, these settings are automatically migrated to Windows 10 as part of the update process. If the handheld device was configured for assigned access lockdown, then this configuration is also migrated to Windows 10 as part of the update process. This includes ProductId and AumId conversion for all internal apps (including buttonremapping apps). -Note that the migrators do not take care of the following: +Be aware that the migrators do not take care of the following: -- 3rd party apps provided by OEMs -- deprecated 1st party apps, such as Bing News -- deprecated system/application settings, such as Microsoft.Game, Microsoft.IE +- Third-party apps provided by OEMs. +- Deprecated first-party apps, such as Bing News. +- Deprecated system or application settings, such as Microsoft.Game and Microsoft.IE. In the event of an Enterprise Reset, these migrated settings are automatically persisted. -Down the road, after the upgrade to Windows 10 is complete, if you decide to push down a new wehlockdown.xml, you would need to take the following steps to ensure that the updated settings are persisted through an Enterprise Reset: +After the upgrade to Windows 10 is complete, if you decide to push down a new wehlockdown.xml, you need to take the following steps to ensure that the updated settings are persisted through an Enterprise Reset: 1. Delete the TPK\*ppkg and push down a new ppkg with your new configuration to the persistent folder. -2. Push down a new ppkg with your new configuration with higher priority. Note that in ICD, Owner=Microsoft, Rank=0 is the lowest priority; and vise versa. With this step, the old assigned access lockdown configuration will be overwritten. +2. Push down a new ppkg with your new configuration with higher priority. (Be aware that in ICD, Owner=Microsoft, Rank=0 is the lowest priority, and vice versa. With this step, the old assigned access lockdown configuration is overwritten.) **Requirements:** - The test device must be same as the other production devices that are receiving the updates. -- Your test device must be enrolled with Microsoft Endpoint Configuration Manager. -- Your device can connect to the Internet. -- Your device must have an SD card with at least 0.5 GB of free space. -- Ensure that the settings app and PhoneUpdate applet are available via Assigned Access. +- The test device must be enrolled with Microsoft Endpoint Configuration Manager. +- The test device must be connected to the Internet. +- The test device must have an SD card with at least 0.5 GB of free space. +- Ensure that the settings app and PhoneUpdate applet are available through Assigned Access. -The following diagram is a high-level overview of the process. +The following diagram shows a high-level overview of the process. ![update process for windows embedded 8.1 devices](images/windowsembedded-update.png) ## Step 1: Prepare a test device to download updates from Microsoft Update -Define the baseline update set that will be applied to other devices. Use a device that is running the most recent image as the test device. +Define the baseline update set that you want to apply to other devices. Use a device that is running the most recent image as the test device. Trigger the device to check for updates either manually or using Microsoft Endpoint Configuration Manager. -**Manually** +**Check for updates manually** -1. From the device, go to **Settings** > **Phone updates** > **Check for updates**. -2. Sync the device. Go to **Settings** > **Workplace** > **Enrolled** and click the refresh icon. Repeat as needed. -3. Follow the prompts to download the updates, but do not press the install button. +1. On the device, go to **Settings** > **Phone updates** > **Check for updates**. +2. Sync the device, go to **Settings** > **Workplace** > **Enrolled**, and then select the refresh icon. Repeat as needed. +3. Follow the prompts to download the updates, but do not select the **Install** button. -> **Note**  There is a bug in all OS versions up to GDR2 where the CSP will not set the assigned value. There is no way to change or set this until GDR2 is deployed onto the device. +> [!NOTE] +> There is a bug in all OS versions up to GDR2 where the Cloud Solution Provider (CSP) does not set the assigned value. There is no way to change or set this until GDR2 is deployed onto the device. -**Using Microsoft Endpoint Configuration Manager** +**Check for updates by using Microsoft Endpoint Configuration Manager** -1. Remotely trigger a scan of the test device by deploying a Trigger Scan Configuration Baseline. +1. Remotely trigger a scan of the test device by deploying a Trigger Scan configuration baseline. ![device scan using Configuration Manager](images/windowsembedded-update2.png) -2. Set the value of this OMA-URI by browsing to the settings of this Configuration Item and selecting the newly created Trigger Scan settings from the previous step. +2. Set the value of this OMA-URI by going to **Configuration Item**, and then selecting the newly created Trigger Scan settings from the previous step. ![device scan using Configuration Manager](images/windowsembedded-update3.png) -3. Ensure that the value that is specified for this URI is greater than the value on the device(s) and that the Remediate noncompliant rules when supported option is checked. For the first time, any value that is greater than 0 will work, but for subsequent configurations, ensure that you specify an incremented value. +3. Ensure that the value that is specified for this URI is greater than the value on the device(s), and that the **Remediate noncompliant rules when supported** option is selected. For the first time, any value that is greater than 0 will work, but for subsequent configurations, ensure that you specify an incremented value. ![device scan using Configuration Manager](images/windowsembedded-update4.png) -4. Create a Configuration Baseline for TriggerScan and Deploy. It is recommended that this Configuration Baseline be deployed after the Controlled Updates Baseline has been applied to the device (the corresponding files are deployed on the device through a device sync session). +4. Create a configuration baseline for Trigger Scan and Deploy. We recommend that this configuration baseline be deployed after the Controlled Updates baseline has been applied to the device. (The corresponding files are deployed on the device through a device sync session.) 5. Follow the prompts for downloading the updates, but do not install the updates on the device. @@ -130,23 +129,25 @@ There are two ways to retrieve this file from the device; one pre-GDR1 and one p **Pre-GDR1: Parse a compliance log from the device in ConfigMgr** -1. Create a Configuration Item using ConfigMgr to look at the registry entry ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/ApprovedUpdatesXml. +1. Use ConfigMgr to create a configuration item to look at the registry entry ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/ApprovedUpdatesXml. - > **Note**  In Microsoft Endpoint Configuration Manager, you may see an error about exceeding the file limit when using ApprovedUpdatesXml. However, the process still completes even if the file is large. + > [!NOTE] + > In Microsoft Endpoint Configuration Manager, you may see an error about exceeding the file limit when using ApprovedUpdatesXml, but the process still completes even if the file is large. - If the XML file is greater than 32K you can also use ./Vendor/MSFT/FileSystem/<*filename*>. -2. Set a baseline for this Configuration Item with a “dummy” value (such as zzz), and ensure that you do not remediate it. + If the XML file is greater than 32 KB, you can also use ./Vendor/MSFT/FileSystem/<*filename*>. +2. Set a baseline for this configuration item with a “dummy” value (such as zzz), and ensure that you do not remediate it. - The dummy value is not be set; it is only used for comparison. -3. After the report XML is sent to the device, Microsoft Endpoint Configuration Manager displays a compliance log that contains the report information. The log can contain significant amount of data. + The dummy value is not set; it is only used for comparison. +3. After the report XML is sent to the device, Microsoft Endpoint Manager displays a compliance log that contains the report information. The log can contain significant amount of data. 4. Parse this log for the report XML content. -For a step-by-step walkthrough, see [How to retrieve a device update report using Microsoft Endpoint Configuration Manager logs](#how-to-retrieve-a-device-update-report-using-microsoft-endpoint-configuration-manager-logs). +For a step-by-step walkthrough, see [Retrieve a device update report using Microsoft Endpoint Manager logs](#retrieve-a-device-update-report-using-microsoft-endpoint-manager-logs). + **Post-GDR1: Retrieve the report xml file using an SD card** -1. Create a Configuration Item using ConfigMgr to set a registry value for ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/CopyUpdateReportToSDCard. -2. The value that you define for this Configuration Item is defined by the relative path to the SD card which includes the filename of the XML file (such as SDCardRoot\\Update\\DUReport.xml). +1. Use ConfigMgr to create a configuration item to set a registry value for ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/CopyUpdateReportToSDCard. +2. The value that you define for this configuration item is defined by the relative path to the SD card, which includes the filename of the XML file (such as SDCardRoot\\Update\\DUReport.xml). 3. Remove the SD card from device and copy the XML file to your PC. ## Step 3: Check the status code in the XML file @@ -197,46 +198,49 @@ Here are the two files.   -For a walkthrough of these steps, [How to deploy controlled updates](#how-to-deploy-controlled-updates). Ensure that the trigger scan configuration baseline HAS NOT been deployed. +For a walkthrough of these steps, see [Deploy controlled updates](#deploy-controlled-updates). Ensure that the Trigger Scan configuration baseline has NOT been deployed. -### How to deploy controlled updates -This process has three parts: +### Deploy controlled updates -- Create a configuration item for DUControlledUpdates.xml -- Create a configuration item for DUCustomContentURIs.xml +The deployment process has three parts: + +- Create a configuration item for DUControlledUpdates.xml. +- Create a configuration item for DUCustomContentURIs.xml. - Create a configuration item for approved updates. + **Create a configuration item for DUControlledUpdates.xml** -1. Create a configuration item. In the **Browse Settings** window, select **Device File** as a filter, and then click **Select**. +1. Create a configuration item. In the **Browse Settings** window, select **Device File** as a filter, and then select **Select**. ![embedded device update](images/windowsembedded-update18.png) -2. Browse to the DUControlledUpdates.xml that was created from the test device and specify that file path and name on the device as `NonPersistent\DUControlledUpdates.xml`. +2. Browse to the DUControlledUpdates.xml that was created from the test device, and then specify the file path and name on the device as `NonPersistent\DUControlledUpdates.xml`. ![embedded device update](images/windowsembedded-update19.png) -3. Check the box **Remediate noncompliant settings**. -4. Click **OK**. +3. Select **Remediate noncompliant settings**, and then select **OK**. + **Create a configuration item for DUCustomContentURIs.xml** -1. Create a configuration item and specify that file path and name on the device as `NonPersistent\DUCustomContentURIs.xml` -2. Check the box **Remediate noncompliant settings**. +1. Create a configuration item and specify the file path and name on the device as `NonPersistent\DUCustomContentURIs.xml` +2. Select **Remediate noncompliant settings**. ![embedded device update](images/windowsembedded-update21.png) -3. Click **OK**. +3. Select **OK**. + **Create a configuration baseline for approved updates** 1. Create a configuration baseline item and give it a name (such as ControlledUpdates). -2. Add the DUControlledUpdates and DUCustomContentURIs configuration items, and then click **OK**. +2. Add the DUControlledUpdates and DUCustomContentURIs configuration items, and then select **OK**. ![embedded device update](images/windowsembedded-update22.png) @@ -244,20 +248,20 @@ This process has three parts: ![embedded device update](images/windowsembedded-update23.png) -4. Click **OK**. +4. Select **OK**. ## Step 7: Trigger the other devices to scan, download, and install updates Now that the other "production" or "in-store" devices have the necessary information to download updates from an internal share, the devices are ready for updates. -### Use this process for unmanaged devices +### Update unmanaged devices If the update policy of the device is not managed or restricted by Microsoft Endpoint Configuration Manager, an update process can be initiated on the device in one of the following ways: -- Initiated by a periodic scan that the device automatically performs. -- Initiated manually through **Settings** -> **Phone Update** -> **Check for Updates**. +- A periodic scan that the device automatically performs. +- Manually through **Settings** > **Phone Update** > **Check for Updates**. -### Use this process for managed devices +### Update managed devices If the update policy of the device is managed or restricted by MDM, an update process can be initiated on the device in one of the following ways: @@ -265,12 +269,13 @@ If the update policy of the device is managed or restricted by MDM, an update pr Ensure that the trigger scan has successfully executed, and then remove the trigger scan configuration baseline. - > **Note**  Ensure that the PhoneUpdateRestriction Policy is set to a value of 0, to ensure that the device will not perform an automatic scan. + > [!NOTE] + > Ensure that the PhoneUpdateRestriction Policy is set to a value of 0 so that the device doesn't perform an automatic scan. - Trigger the device to scan as part of a Maintenance Window defined by the IT Admin in Microsoft Endpoint Configuration Manager. -After the installation of updates is completed, the IT Admin can use the DUReport generated in the production devices to determine if the device successfully installed the list of updates. If the device did not, error codes are provided in the DUReport.xml. To retrieve the device update report from a device, perform the same steps defined in [Step 2](#step2). +After the updates are installed, the IT Admin can use the DUReport generated in the production devices to determine whether the device successfully installed the list of updates. If the device did not, error codes are provided in the DUReport.xml. To retrieve the device update report from a device, perform the same steps defined in [Step 2](#step2). ## Example PowerShell script @@ -456,71 +461,70 @@ DownloadFiles $inputFile $downloadCache $localCacheURL ``` -## How to retrieve a device update report using Microsoft Endpoint Configuration Manager logs - -Use this procedure for pre-GDR1 devices. +## Retrieve a device update report using Microsoft Endpoint Manager logs **For pre-GDR1 devices** +Use this procedure for pre-GDR1 devices: -1. Trigger a device scan. Go to **Settings** -> **Phone Update** -> **Check for Updates**. +1. Trigger a device scan by going to **Settings** > **Phone Update** > **Check for Updates**. Since the DUReport settings have not been remedied, you should see a non-compliance. -2. In Microsoft Endpoint Configuration Manager under **Assets and Compliance** > **Compliance Settings**, right-click on **Configuration Items**. +2. In Microsoft Endpoint Configuration Manager, under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Items**. 3. Select **Create Configuration Item**. ![device update using Configuration Manager](images/windowsembedded-update5.png) -4. Enter a filename (such as GetDUReport) and then choose **Mobile Device**. -5. In the **Mobile Device Settings** page, check the box **Configure Additional Settings that are not in the default settings group**, and the click **Next**. +4. Enter a filename (such as GetDUReport), and then select **Mobile Device**. +5. On the **Mobile Device Settings** page, select **Configure Additional Settings that are not in the default settings group**, and then select **Next**. ![device update using Configuration Manager](images/windowsembedded-update6.png) -6. In the **Additional Settings** page, click **Add**. +6. On the **Additional Settings** page, select **Add**. ![device update using Configuration Manager](images/windowsembedded-update7.png) -7. In the **Browse Settings** page, click **Create Setting**. +7. On the **Browse Settings** page, select **Create Setting**. ![device update](images/windowsembedded-update8.png) -8. Enter a unique **Name**. For the **Setting type**, select **OMA-URI** and for the **Data type**, select **String**. -9. In the **OMA-URI** text box, enter `./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml`, the click **OK**. +8. Enter a unique **Name**. For **Setting type**, select **OMA-URI**, and for **Data type**, select **String**. +9. In the **OMA-URI** text box, enter `./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml`, and then select **OK**. ![handheld device update](images/windowsembedded-update9.png) -10. In the **Browse Settings** page, click **Close**. -11. In the **Create Configuration Item Wizard** page, check **All Windows Embedded 8.1 Handheld** as the supported platform, and then click **Next**. +10. On the **Browse Settings** page, select **Close**. +11. On the **Create Configuration Item Wizard** page, select **All Windows Embedded 8.1 Handheld** as the supported platform, and then select **Next**. ![embedded device update](images/windowsembedded-update10.png) 12. Close the **Create Configuration Item Wizard** page. 13. Right-click on the newly create configuration item, and then select the **Compliance Rules** tab. -14. Click the new created mobile device setting (such as DUReport) and then click **Select**. +14. Select the new created mobile device setting (such as DUReport), and then select **Select**. 15. Enter a dummy value (such as zzz) that is different from the one on the device. ![embedded device update](images/windowsembedded-update11.png) -16. Disable remediation by unchecking the **Remediate noncompliant rules when supported** option. -17. Click **OK** to close the Edit Rule page. -18. Create a new configuration baseline. Under **Assets and Compliance** > **Compliance Settings**, right-click on **Configuration Baselines**. +16. Disable remediation by deselecting the **Remediate noncompliant rules when supported** option. +17. Select **OK** to close the **Edit Rule** page. +18. Create a new configuration baseline. Under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Baselines**. 19. Select **Create Configuration Item**. ![embedded device update](images/windowsembedded-update12.png) 20. Enter a baseline name (such as RetrieveDUReport). -21. Add the configuration item that you just created. Select **Add** and then select the configuration item that you just created (such as DUReport). +21. Add the configuration item that you just created. Select **Add**, and then select the configuration item that you just created (such as DUReport). ![embedded device update](images/windowsembedded-update13.png) -22. Click **OK**, then click **OK** again to complete the configuration baseline. -23. Deploy the newly created configuration baseline to the appropriate device collection. Right-click on the configuration baseline that you created and the select **Deploy**. +22. Select **OK**, and then select **OK** again to complete the configuration baseline. +23. Deploy the newly created configuration baseline to the appropriate device collection. Right-click on the configuration baseline that you created, and then select **Deploy**. ![embedded device update](images/windowsembedded-update14.png) -24. Check the check box **Remediate noncompliant rules when supported**. +24. Select **Remediate noncompliant rules when supported**. 25. Select the appropriate device collection and define the schedule. ![device update](images/windowsembedded-update15.png) -26. To view the DUReport content, select the appropriate deployment for the configuration saseline that you created. Right-click on the deployment and select **View Status**. -27. Click **Run Summarization** and then click **Refresh**. On the Non-Compliant tab, the test device(s) should be listed. +26. To view the DUReport content, select the appropriate deployment for the configuration baseline that you created. Right-click on the deployment, and then select **View Status**. +27. Select **Run Summarization**, and then select **Refresh**. The test device(s) should be listed on the **Non-Compliant** tab. 28. Under **Asset Details**, right-click on the test device, and then select **Mode Details**. ![device update](images/windowsembedded-update16.png) -29. In the Non-compliant tab, you will see the DUReport, but you cannot retrieve the content from here. +29. On the **Non-compliant** tab, you can see the DUReport, but you cannot retrieve the content from here. ![device update](images/windowsembedded-update17.png) -30. To retrieve the DUReport, open an Explorer windows to C:\\Program Files\\SMS\_CCM\\SMS\_DM.log. -31. In the log file, search from the bottom for "./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml" RuleExression="Equals zzz" where zzz is the dummy value. Just above this copy the information for UpdateData and use this information to create the DUControlledUpdates.xml. +30. To retrieve the DUReport, open C:\\Program Files\\SMS\_CCM\\SMS\_DM.log. +31. In the log file, search from the bottom for "./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml" RuleExression="Equals zzz," where zzz is the dummy value. Just above this, copy the information for UpdateData and use this information to create the DUControlledUpdates.xml.   diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index dcc548afd6..08073b46d6 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -1,28 +1,28 @@ --- title: Enroll a Windows 10 device automatically using Group Policy -description: Enroll a Windows 10 device automatically using Group Policy +description: Learn how to use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/29/2019 -ms.reviewer: +ms.date: +ms.reviewer: manager: dansimp --- # Enroll a Windows 10 device automatically using Group Policy -Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. +Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account. Requirements: - AD-joined PC running Windows 10, version 1709 or later -- The enterprise has configured a mobile device management (MDM) service -- The enterprise AD must be [registered with Azure Active Directory (Azure AD)](azure-active-directory-integration-with-mdm.md) +- The enterprise has configured a mobile device management (MDM) service +- The on-premises AD must be [integrated with Azure AD (via Azure AD Connect)](https://docs.microsoft.com/azure/architecture/reference-architectures/identity/azure-ad) - The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`) -- The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. +- The minimum Windows Server version requirement is based on the Hybrid Azure AD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. > [!TIP] > For additional information, see the following topics: @@ -30,32 +30,32 @@ Requirements: > - [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) > - [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm) -The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically AAD registered. +The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically Azure AD–registered. > [!NOTE] -> In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation. +> In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation. When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page. -In Windows 10, version 1709, when the same policy is configured in GP and MDM, the GP policy wins (GP policy takes precedence over MDM). Since Windows 10, version 1803, a new setting allows you to change the policy conflict winner to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](https://blogs.technet.microsoft.com/cbernier/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/). +In Windows 10, version 1709 or later, when the same policy is configured in GP and MDM, the GP policy wins (GP policy takes precedence over MDM). Since Windows 10, version 1803, a new setting allows you to change the policy conflict winner to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](https://blogs.technet.microsoft.com/cbernier/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/) For this policy to work, you must verify that the MDM service provider allows the GP triggered MDM enrollment for domain joined devices. ## Verify auto-enrollment requirements and settings -To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. +To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. The following steps demonstrate required settings using the Intune service: 1. Verify that the user who is going to enroll the device has a valid Intune license. ![Intune license verification](images/auto-enrollment-intune-license-verification.png) -2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal). +2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal). ![Auto-enrollment activation verification](images/auto-enrollment-activation-verification.png) -> [!IMPORTANT] -> For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. - -> For corporate devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled. + > [!IMPORTANT] + > For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. + > + > For corporate devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled. 3. Verify that the device OS version is Windows 10, version 1709 or later. 4. Auto-enrollment into Intune via Group Policy is valid only for devices which are hybrid Azure AD joined. This means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. @@ -80,7 +80,7 @@ The following steps demonstrate required settings using the Intune service: ![Mobility setting MDM intune](images/auto-enrollment-microsoft-intune-setting.png) -7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is properly deployed to all devices which should be enrolled into Intune. +7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. 8. Verify that the device is not enrolled with the old Intune client used on the Intune Silverlight Portal (this is the Intune portal used before the Azure portal). @@ -94,43 +94,46 @@ You may contact your domain administrators to verify if the group policy has bee This procedure is only for illustration purposes to show how the new auto-enrollment policy works. It is not recommended for the production environment in the enterprise. For bulk deployment, you should use the [Group Policy Management Console process](#configure-the-auto-enrollment-for-a-group-of-devices). Requirements: -- AD-joined PC running Windows 10, version 1709 -- Enterprise has MDM service already configured +- AD-joined PC running Windows 10, version 1709 or later +- Enterprise has MDM service already configured - Enterprise AD must be registered with Azure AD 1. Run GPEdit.msc - Click Start, then in the text box type gpedit. + Click Start, then in the text box type gpedit. ![GPEdit desktop app search result](images/autoenrollment-gpedit.png) 2. Under **Best match**, click **Edit group policy** to launch it. -3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**. +3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**. - ![MDM policies](images/autoenrollment-mdm-policies.png) + ![MDM policies](images/autoenrollment-mdm-policies.png) -4. Double-click **Enable Automatic MDM enrollment using default Azure AD credentials**. +4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. - ![MDM autoenrollment policy](images/autoenrollment-policy.png) + > [!NOTE] + > **Device Credential** Credential Type may work, however, it is not yet supported by Intune. We don't recommend using this option until it's supported. + ![MDM autoenrollment policy](images/autoenrollment-policy.png) -5. Click **Enable**, then click **OK**. +5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. -> [!NOTE] -> In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have the Windows 10, version 1903 feature update installed. -The default behavior for older releases is to revert to **User Credential**. + > [!NOTE] + > In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. + > The default behavior for older releases is to revert to **User Credential**. + > **Device Credential** is not supported for enrollment type when you have a ConfigMgr Agent on your device. -When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." + When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." -To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). + To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). -If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. + If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. -![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) + ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) -> [!Tip] -> You can avoid this behavior by using Conditional Access Policies in Azure AD. -Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview). + > [!Tip] + > You can avoid this behavior by using Conditional Access Policies in Azure AD. + Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview). 6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. @@ -149,52 +152,80 @@ Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/a 2. Under **Best match**, click **Task Scheduler** to launch it. -3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. +3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. ![Auto-enrollment scheduled task](images/autoenrollment-scheduled-task.png) - To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab. + To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab. If the device enrollment is blocked, your IT admin may have enabled the **Disable MDM Enrollment** policy. Note that the GPEdit console does not reflect the status of policies set by your IT admin on your device. It is only used by the user to set policies. ## Configure the auto-enrollment for a group of devices Requirements: -- AD-joined PC running Windows 10, version 1709 -- Enterprise has MDM service already configured (with Intune or a third party service provider) +- AD-joined PC running Windows 10, version 1709 or later +- Enterprise has MDM service already configured (with Intune or a third-party service provider) - Enterprise AD must be integrated with Azure AD. - Ensure that PCs belong to same computer group. > [!IMPORTANT] -> If you do not see the policy, it may be because you don’t have the ADMX installed for Windows 10, version 1803, version 1809, or version 1903. To fix the issue, follow these steps (Note: the latest MDM.admx is backwards compatible): -> 1. Download: -> 1803 -->[Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) or -> 1809 --> [Administrative Templates for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576) or -> 1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495&WT.mc_id=rss_alldownloads_all) -> 2. Install the package on the Domain Controller. -> 3. Navigate, depending on the version to the folder: -> 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2**, or -> 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2**, or -> 1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3** -> 4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**. -> 5. Copy PolicyDefinitions folder to **C:\Windows\SYSVOL\domain\Policies**. -> (If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain). -> 6. Restart the Domain Controller for the policy to be available. -> This procedure will work for any future version as well. +> If you do not see the policy, it may be because you don't have the ADMX for Windows 10, version 1803, version 1809, or version 1903 installed. To fix the issue, use the following procedures. Note that the latest MDM.admx is backwards compatible. + +1. Download: + + - 1803 --> [Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) + + - 1809 --> [Administrative Templates (.admx) for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576) + + - 1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495) + + - 1909 --> [Administrative Templates (.admx) for Windows 10 November 2019 Update (1909)](https://www.microsoft.com/download/confirmation.aspx?id=100591) + + - 2004 --> [Administrative Templates (.admx) for Windows 10 May 2020 Update (2004)](https://www.microsoft.com/download/confirmation.aspx?id=101445) + + - 20H2 --> [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) + +2. Install the package on the Domain Controller. + +3. Navigate, depending on the version to the folder: + + - 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2** + + - 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2** + + - 1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3** + + - 1909 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2019 Update (1909)** + + - 2004 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2020 Update (2004)** + + - 20H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2020 Update (20H2)** + +4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**. + +5. Copy PolicyDefinitions folder to **C:\Windows\SYSVOL\domain\Policies**. + + If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain. + +6. Restart the Domain Controller for the policy to be available. + +This procedure will work for any future version as well. 1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. + 2. Create a Security Group for the PCs. + 3. Link the GPO. + 4. Filter using Security Groups. ## Troubleshoot auto-enrollment of devices - -Investigate the log file if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows 10 device. +Investigate the log file if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows 10 device. To collect Event Viewer logs: 1. Open Event Viewer. -2. Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin. +2. Navigate to **Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin**. > [!Tip] > For guidance on how to collect event logs for Intune, see [Collect MDM Event Viewer Log YouTube video](https://www.youtube.com/watch?v=U_oCe2RmQEc). @@ -208,14 +239,14 @@ To collect Event Viewer logs: To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information. - The auto-enrollment did not trigger at all. In this case, you will not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section. - The auto-enrollment process is triggered by a task (Microsoft > Windows > EnterpriseMgmt) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is successfully deployed to the target machine as shown in the following screenshot: + The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot: ![Task scheduler](images/auto-enrollment-task-scheduler.png) > [!Note] > This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task. This task runs every 5 minutes for the duration of 1 day. To confirm if the task succeeded, check the task scheduler event logs: - Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational. + **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107. ![Event ID 107](images/auto-enrollment-event-id-107.png) @@ -225,13 +256,13 @@ To collect Event Viewer logs: Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment. - If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. - One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (HKLM > Software > Microsoft > Enrollments). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: + If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. + One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: ![Outdated enrollment entries](images/auto-enrollment-outdated-enrollment-entries.png) - By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational event log file under event ID 7016. - A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display less entries as shown in the following screenshot: + By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016. + A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: ![Manually deleted entries](images/auto-enrollment-activation-verification-less-entries.png) @@ -242,10 +273,10 @@ To collect Event Viewer logs: - [Link a Group Policy Object](https://technet.microsoft.com/library/cc732979(v=ws.11).aspx) - [Filter Using Security Groups](https://technet.microsoft.com/library/cc752992(v=ws.11).aspx) - [Enforce a Group Policy Object Link](https://technet.microsoft.com/library/cc753909(v=ws.11).aspx) +- [Group Policy Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) ### Useful Links - [Windows 10 Administrative Templates for Windows 10 November 2019 Update 1909](https://www.microsoft.com/download/details.aspx?id=100591) - [Windows 10 Administrative Templates for Windows 10 May 2019 Update 1903](https://www.microsoft.com/download/details.aspx?id=58495) - [Windows 10 Administrative Templates for Windows 10 October 2018 Update 1809](https://www.microsoft.com/download/details.aspx?id=57576) -- [Windows 10 Administrative Templates for Windows 10 April 2018 Update 1803](https://www.microsoft.com/download/details.aspx?id=56880) diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md index e70eed0ce5..98739efcb1 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -1,6 +1,6 @@ --- title: EnrollmentStatusTracking DDF -description: View the OMA DM device description framework (DDF) for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM DDF for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index 319356f336..5e7af9b60d 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseAPN DDF -description: EnterpriseAPN DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAPN configuration service provider (CSP). ms.assetid: A953ADEF-4523-425F-926C-48DA62EB9E21 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index 486334505b..011e741b15 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseAppManagement CSP -description: EnterpriseAppManagement CSP +description: Handle enterprise application management tasks using EnterpriseAppManagement configuration service provider (CSP). ms.assetid: 698b8bf4-652e-474b-97e4-381031357623 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index ab13935f66..272f60f44f 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseAppVManagement CSP -description: EnterpriseAppVManagement CSP +description: Examine the tree format for EnterpriseAppVManagement CSP to manage virtual applications in Windows 10 PCs.(Enterprise and Education editions). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md index 626981e0ff..8cf951cf55 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseAppVManagement DDF file -description: EnterpriseAppVManagement DDF file +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseAppVManagement configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/enterpriseassignedaccess-csp.md b/windows/client-management/mdm/enterpriseassignedaccess-csp.md index 118cc974f5..45d11904d5 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-csp.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseAssignedAccess CSP -description: EnterpriseAssignedAccess CSP +description: Use the EnterpriseAssignedAccess configuration service provider (CSP) to configure custom layouts on a device. ms.assetid: 5F88E567-77AA-4822-A0BC-3B31100639AA ms.reviewer: manager: dansimp @@ -306,7 +306,7 @@ Starting in Windows 10, version 1511, you can specify the following quick acti

    Dependencies - none

    -Starting in Windows 10, version 1703, Quick action settings no longer require any dependencis from related group or page. Here is the list: +Starting in Windows 10, version 1703, Quick action settings no longer require any dependencies from related group or page. Here is the list: - QuickActions_Launcher_AllSettings - QuickActions_Launcher_DeviceDiscovery - SystemSettings_BatterySaver_LandingPage_OverrideControl @@ -1600,7 +1600,7 @@ The following table lists the product ID and AUMID for each app that is included Microsoft.MSPodcast_8wekyb3d8bbwe!xc3215724yb279y4206y8c3ey61d1a9d63ed3x -Powerpoint +PowerPoint B50483C4-8046-4E1B-81BA-590B24935798 Microsoft.Office.PowerPoint_8wekyb3d8bbwe!microsoft.pptim @@ -1665,4 +1665,4 @@ The following table lists the product ID and AUMID for each app that is included Microsoft.XboxApp_8wekyb3d8bbwe!Microsoft.XboxApp - \ No newline at end of file + diff --git a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md index e5392fcc55..5d0a19de74 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseAssignedAccess DDF -description: EnterpriseAssignedAccess DDF +description: Utilize the OMA DM device description framework (DDF) for the EnterpriseAssignedAccess configuration service provider. ms.assetid: 8BD6FB05-E643-4695-99A2-633995884B37 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseassignedaccess-xsd.md b/windows/client-management/mdm/enterpriseassignedaccess-xsd.md index f73c18d744..3ee96832c7 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-xsd.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-xsd.md @@ -1,6 +1,6 @@ --- title: EnterpriseAssignedAccess XSD -description: EnterpriseAssignedAccess XSD +description: This XSD can be used to validate that the lockdown XML in the \ block of the AssignedAccessXML node. ms.assetid: BB3B633E-E361-4B95-9D4A-CE6E08D67ADA ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md index 70759a6c03..8cc8149b7f 100644 --- a/windows/client-management/mdm/enterprisedataprotection-csp.md +++ b/windows/client-management/mdm/enterprisedataprotection-csp.md @@ -14,17 +14,17 @@ ms.date: 08/09/2017 # EnterpriseDataProtection CSP -The EnterpriseDataProtection configuration service provider (CSP) is used to configure Windows Information Protection (WIP) (formerly known as Enterprise Data Protection) specific settings. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip). +The EnterpriseDataProtection configuration service provider (CSP) is used to configure settings for Windows Information Protection (WIP), formerly known as Enterprise Data Protection. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip). -> **Note**   ->- To make WIP functional the AppLocker CSP and the network isolation specific settings must also be configured. For more information, see [AppLocker CSP](applocker-csp.md) and NetworkIsolation policies in [Policy CSP](policy-configuration-service-provider.md). ->- This CSP was added in Windows 10, version 1607. +> [!Note] +> To make WIP functional, the AppLocker CSP and the network isolation-specific settings must also be configured. For more information, see [AppLocker CSP](applocker-csp.md) and NetworkIsolation policies in [Policy CSP](policy-configuration-service-provider.md). +> - This CSP was added in Windows 10, version 1607. While WIP has no hard dependency on VPN, for best results you should configure VPN profiles first before you configure the WIP policies. For VPN best practice recommendations, see [VPNv2 CSP](vpnv2-csp.md). -To learn more about WIP, see the following TechNet topics: +To learn more about WIP, see the following articles: - [Create a Windows Information Protection (WIP) policy](https://technet.microsoft.com/itpro/windows/keep-secure/overview-create-wip-policy) - [General guidance and best practices for Windows Information Protection (WIP)](https://technet.microsoft.com/itpro/windows/keep-secure/guidance-and-best-practices-wip) @@ -34,79 +34,82 @@ The following diagram shows the EnterpriseDataProtection CSP in tree format. ![enterprisedataprotection csp diagram](images/provisioning-csp-enterprisedataprotection.png) **./Device/Vendor/MSFT/EnterpriseDataProtection** -

    The root node for the CSP. +The root node for the CSP. **Settings** -

    The root node for the Windows Information Protection (WIP) configuration settings. +The root node for the Windows Information Protection (WIP) configuration settings. **Settings/EDPEnforcementLevel** -

    Set the WIP enforcement level. Note that setting this value is not sufficient to enable WIP on the device. Attempts to change this value will fail when the WIP cleanup is running. +Set the WIP enforcement level. Note that setting this value is not sufficient to enable WIP on the device. Attempts to change this value will fail when the WIP cleanup is running. -

    The following list shows the supported values: +The following list shows the supported values: - 0 (default) – Off / No protection (decrypts previously protected data). - 1 – Silent mode (encrypt and audit only). - 2 – Allow override mode (encrypt, prompt and allow overrides, and audit). - 3 – Hides overrides (encrypt, prompt but hide overrides, and audit). -

    Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/EnterpriseProtectedDomainNames** -

    A list of domains used by the enterprise for its user identities separated by pipes ("|").The first domain in the list must be the primary enterprise ID, that is, the one representing the managing authority for WIP. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. For example, the domains for all email accounts owned by the enterprise would be expected to appear in this list. Attempts to change this value will fail when the WIP cleanup is running. +A list of domains used by the enterprise for its user identities separated by pipes ("|").The first domain in the list must be the primary enterprise ID, that is, the one representing the managing authority for WIP. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. For example, the domains for all email accounts owned by the enterprise would be expected to appear in this list. Attempts to change this value will fail when the WIP cleanup is running. -

    Changing the primary enterprise ID is not supported and may cause unexpected behavior on the client. +Changing the primary enterprise ID is not supported and may cause unexpected behavior on the client. -> **Note**  The client requires domain name to be canonical, otherwise the setting will be rejected by the client. +> [!Note] +> The client requires domain name to be canonical, otherwise the setting will be rejected by the client. -

    Here are the steps to create canonical domain names: +Here are the steps to create canonical domain names: -1. Transform the ASCII characters (A-Z only) to lower case. For example, Microsoft.COM -> microsoft.com. +1. Transform the ASCII characters (A-Z only) to lowercase. For example, Microsoft.COM -> microsoft.com. 2. Call [IdnToAscii](https://msdn.microsoft.com/library/windows/desktop/dd318149.aspx) with IDN\_USE\_STD3\_ASCII\_RULES as the flags. 3. Call [IdnToUnicode](https://msdn.microsoft.com/library/windows/desktop/dd318151.aspx) with no flags set (dwFlags = 0). -

    Supported operations are Add, Get, Replace and Delete. Value type is string. +Supported operations are Add, Get, Replace, and Delete. Value type is string. **Settings/AllowUserDecryption** -

    Allows the user to decrypt files. If this is set to 0 (Not Allowed), then the user will not be able to remove protection from enterprise content through the operating system or the application user experiences. +Allows the user to decrypt files. If this is set to 0 (Not Allowed), then the user will not be able to remove protection from enterprise content through the operating system or the application user experiences. > [!IMPORTANT] > Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported. -

    The following list shows the supported values: +The following list shows the supported values: - 0 – Not allowed. - 1 (default) – Allowed. -

    Most restricted value is 0. +Most restricted value is 0. -

    Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/RequireProtectionUnderLockConfig** -

    Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured. A PIN must be configured on the device before you can apply this policy. +Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured. A PIN must be configured on the device before you can apply this policy. -

    The following list shows the supported values: +The following list shows the supported values: - 0 (default) – Not required. - 1 – Required. -

    Most restricted value is 1. +Most restricted value is 1. -

    The CSP checks the current edition and hardware support (TPM), and returns an error message if the device does not have the required hardware. +The CSP checks the current edition and hardware support (TPM), and returns an error message if the device does not have the required hardware. -> **Note**  This setting is only supported in Windows 10 Mobile. +> [!Note] +> This setting is only supported in Windows 10 Mobile. -

    Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/DataRecoveryCertificate** -

    Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy. +Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through mobile device management (MDM) instead of Group Policy. -> **Note**  If this policy and the corresponding Group Policy setting are both configured, the Group Policy setting is enforced. +> [!Note] +> If this policy and the corresponding Group Policy setting are both configured, the Group Policy setting is enforced. -

    DRA information from MDM policy must be a serialized binary blob identical to what we expect from GP. +DRA information from MDM policy must be a serialized binary blob identical to what we expect from GP. The binary blob is the serialized version of following structure: ``` syntax @@ -231,60 +234,59 @@ typedef enum _PUBLIC_KEY_SOURCE_TAG { ``` -

    For EFSCertificate KeyTag, it is expected to be a DER ENCODED binary certificate. +For EFSCertificate KeyTag, it is expected to be a DER ENCODED binary certificate. -

    Supported operations are Add, Get, Replace and Delete. Value type is base-64 encoded certificate. +Supported operations are Add, Get, Replace, and Delete. Value type is base-64 encoded certificate. **Settings/RevokeOnUnenroll** -

    This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently. Prior to sending the unenroll command, when you want a device to do a selective wipe when it is unenrolled, then you should explicitly set this policy to 1. +This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently. Prior to sending the unenroll command, when you want a device to do a selective wipe when it is unenrolled, then you should explicitly set this policy to 1. -

    The following list shows the supported values: +The following list shows the supported values: - 0 – Don't revoke keys. - 1 (default) – Revoke keys. -

    Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/RevokeOnMDMHandoff** -

    Added in Windows 10, version 1703. This policy controls whether to revoke the WIP keys when a device upgrades from MAM to MDM. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after upgrade. This is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service. +Added in Windows 10, version 1703. This policy controls whether to revoke the WIP keys when a device upgrades from mobile application management (MAM) to MDM. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after upgrade. This is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service. - 0 - Don't revoke keys - 1 (default) - Revoke keys -

    Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/RMSTemplateIDForEDP** -

    TemplateID GUID to use for RMS encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access. +TemplateID GUID to use for Rights Management Service (RMS) encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access. -

    Supported operations are Add, Get, Replace and Delete. Value type is string (GUID). +Supported operations are Add, Get, Replace, and Delete. Value type is string (GUID). **Settings/AllowAzureRMSForEDP** -

    Specifies whether to allow Azure RMS encryption for WIP. +Specifies whether to allow Azure RMS encryption for WIP. - 0 (default) – Don't use RMS. - 1 – Use RMS. -

    Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/SMBAutoEncryptedFileExtensions** -

    Added in Windows 10, version 1703. Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an SMB share within the corporate boundary as defined in the Policy CSP nodes for NetworkIsolation/EnterpriseIPRange and NetworkIsolation/EnterpriseNetworkDomainNames. Use semicolon (;) delimiter in the list. -

    When this policy is not specified, the existing auto-encryption behavior is applied. When this policy is configured, only files with the extensions in the list will be encrypted. -

    Supported operations are Add, Get, Replace and Delete. Value type is string. +Added in Windows 10, version 1703. Specifies a list of file extensions, so that files with these extensions are encrypted when copying from an Server Message Block (SMB) share within the corporate boundary as defined in the Policy CSP nodes for NetworkIsolation/EnterpriseIPRange and NetworkIsolation/EnterpriseNetworkDomainNames. Use semicolon (;) delimiter in the list. +When this policy is not specified, the existing auto-encryption behavior is applied. When this policy is configured, only files with the extensions in the list will be encrypted. +Supported operations are Add, Get, Replace and Delete. Value type is string. **Settings/EDPShowIcons** -

    Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles in the Start menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app. - -

    The following list shows the supported values: +Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles on the **Start** menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the WIP icon in the title bar of a WIP-protected app. +The following list shows the supported values: - 0 (default) - No WIP overlays on icons or tiles. - 1 - Show WIP overlays on protected files and apps that can only create enterprise content. -

    Supported operations are Add, Get, Replace and Delete. Value type is integer. +Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Status** -

    A read-only bit mask that indicates the current state of WIP on the Device. The MDM service can use this value to determine the current overall state of WIP. WIP is only on (bit 0 = 1) if WIP mandatory policies and WIP AppLocker settings are configured. +A read-only bit mask that indicates the current state of WIP on the Device. The MDM service can use this value to determine the current overall state of WIP. WIP is only on (bit 0 = 1) if WIP mandatory policies and WIP AppLocker settings are configured. -

    Suggested values: +Suggested values: @@ -319,13 +321,13 @@ typedef enum _PUBLIC_KEY_SOURCE_TAG { -

    Bit 0 indicates whether WIP is on or off. +Bit 0 indicates whether WIP is on or off. -

    Bit 1 indicates whether AppLocker WIP policies are set. +Bit 1 indicates whether AppLocker WIP policies are set. -

    Bit 3 indicates whether the mandatory WIP policies are configured. If one or more of the mandatory WIP policies are not configured, the bit 3 is set to 0 (zero). +Bit 3 indicates whether the mandatory WIP policies are configured. If one or more of the mandatory WIP policies are not configured, the bit 3 is set to 0 (zero). -

    Here's the list of mandatory WIP policies: +Here's the list of mandatory WIP policies: - EDPEnforcementLevel in EnterpriseDataProtection CSP - DataRecoveryCertificate in EnterpriseDataProtection CSP @@ -333,9 +335,9 @@ typedef enum _PUBLIC_KEY_SOURCE_TAG { - NetworkIsolation/EnterpriseIPRange in Policy CSP - NetworkIsolation/EnterpriseNetworkDomainNames in Policy CSP -

    Bits 2 and 4 are reserved for future use. +Bits 2 and 4 are reserved for future use. -

    Supported operation is Get. Value type is integer. +Supported operation is Get. Value type is integer. diff --git a/windows/client-management/mdm/enterpriseext-csp.md b/windows/client-management/mdm/enterpriseext-csp.md index 782bc735ed..24cadf3270 100644 --- a/windows/client-management/mdm/enterpriseext-csp.md +++ b/windows/client-management/mdm/enterpriseext-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseExt CSP -description: EnterpriseExt CSP +description: Learn how the EnterpriseExt CSP allows OEMs to set their own unique ID for their devices, set display brightness values, and set the LED behavior. ms.assetid: ACA5CD79-BBD5-4DD1-86DA-0285B93982BD ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseext-ddf.md b/windows/client-management/mdm/enterpriseext-ddf.md index e30ceeb37f..4b3d4b0afd 100644 --- a/windows/client-management/mdm/enterpriseext-ddf.md +++ b/windows/client-management/mdm/enterpriseext-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseExt DDF -description: EnterpriseExt DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseExt configuration service provider (CSP). ms.assetid: 71BF81D4-FBEC-4B03-BF99-F7A5EDD4F91B ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseextfilessystem-csp.md b/windows/client-management/mdm/enterpriseextfilessystem-csp.md index 3e7c2b1693..8f00e3fe0b 100644 --- a/windows/client-management/mdm/enterpriseextfilessystem-csp.md +++ b/windows/client-management/mdm/enterpriseextfilessystem-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseExtFileSystem CSP -description: EnterpriseExtFileSystem CSP +description: Add, retrieve, or change files through the Mobile Device Management (MDM) service using the EnterpriseExtFileSystem CSP. ms.assetid: F773AD72-A800-481A-A9E2-899BA56F4426 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md index 997493aee9..7efb54af20 100644 --- a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md +++ b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseExtFileSystem DDF -description: EnterpriseExtFileSystem DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseExtFileSystem configuration service provider (CSP). ms.assetid: 2D292E4B-15EE-4AEB-8884-6FEE8B92D2D1 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index 1c440edf96..77b6e72ff9 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement CSP -description: EnterpriseModernAppManagement CSP +description: Learn how the EnterpriseModernAppManagement configuration service provider (CSP) is used for the provisioning and reporting of modern enterprise apps. ms.assetid: 9DD0741A-A229-41A0-A85A-93E185207C42 ms.reviewer: manager: dansimp @@ -14,9 +14,6 @@ ms.date: 09/27/2019 # EnterpriseModernAppManagement CSP -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - The EnterpriseModernAppManagement configuration service provider (CSP) is used for the provisioning and reporting of modern enterprise apps. For details about how to use this CSP to for reporting apps inventory, installation and removal of apps for users, provisioning apps to devices, and managing app licenses, see [Enterprise app management](enterprise-app-management.md). > [!Note] @@ -329,6 +326,7 @@ Required. The value is 0 or 1 that indicates if the app is provisioned on the de Supported operation is Get. **.../*PackageFamilyName*/*PackageFullName*/IsStub** +Added in Windows 10, version 2004. Required. This node is used to identify whether the package is a stub package. A stub package is a version of the package with minimal functionality that will reduce the size of the app. The value is 1 if the package is a stub package and 0 (zero) for all other cases. Value type is int. diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index c9d550f250..237000b2f0 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement DDF -description: EnterpriseModernAppManagement DDF +description: Learn about the OMA DM device description framework (DDF) for the EnterpriseModernAppManagement configuration service provider (CSP). ms.assetid: ms.reviewer: manager: dansimp @@ -14,9 +14,6 @@ ms.date: 10/01/2019 # EnterpriseModernAppManagement DDF -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **EnterpriseModernAppManagement** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md index 99150bef80..f8b15504cc 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md @@ -1,6 +1,6 @@ --- title: EnterpriseModernAppManagement XSD -description: Here is the XSD for the application parameters. +description: In this article, view the EnterpriseModernAppManagement XSD example so you can set application parameters. ms.assetid: D393D094-25E5-4E66-A60F-B59CC312BF57 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/esim-enterprise-management.md b/windows/client-management/mdm/esim-enterprise-management.md index 386f5a8c48..4f516e8c19 100644 --- a/windows/client-management/mdm/esim-enterprise-management.md +++ b/windows/client-management/mdm/esim-enterprise-management.md @@ -1,6 +1,6 @@ --- title: eSIM Enterprise Management -description: Managing eSIM devices in an enterprise +description: Learn how Mobile Device Management (MDM) Providers support the eSIM Profile Management Solution on Windows. keywords: eSIM enterprise management ms.prod: w10 ms.mktglfcycl: @@ -8,19 +8,21 @@ ms.sitesec: library author: dansimp ms.localizationpriority: medium ms.author: dansimp -ms.topic: +ms.topic: conceptual --- # How Mobile Device Management Providers support eSIM Management on Windows -The eSIM Profile Management Solution puts the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to leverage an already existing solution that customers are familiar with and that they use to manage devices. The expectations from an MDM are that it will leverage the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and installation happens on the background and not impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management. - If you are a Mobile Device Management (MDM) Provider and would like to support eSIM Management on Windows, you should do the following: +The eSIM Profile Management Solution puts the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to use an already existing solution that customers are familiar with and that they use to manage devices. The expectations from an MDM are that it will use the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and the installation happen in the background without impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management. + If you are a Mobile Device Management (MDM) Provider and want to support eSIM Management on Windows, perform the following steps: - Onboard to Azure Active Directory -- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, please contact them and learn more about their onboarding. If you would like to support multiple mobile operators, [orchestrator providers]( https://www.idemia.com/esim-management-facilitation) are there to act as a proxy that will handle MDM onboarding as well as mobile operator onboarding. Their main [role]( https://www.idemia.com/smart-connect-hub) is to enable the process to be as painless but scalable to all parties. +- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, contact them and learn more about their onboarding. If you would like to integrate and work with only one MDM provider, contact that provider directly. If you would like to offer eSIM management to customers using different MDM providers, contact an orchestrator provider. Orchestrator providers act as proxy handling MDM onboarding as well as mobile operator onboarding. Their role is to make the process as painless and scalable as possible for all parties. Potential orchestrator providers you could contact include: + - [HPE’s Device Entitlement Gateway](https://www.hpe.com/emea_europe/en/solutions/digital-communications-services.html) + - [IDEMIA’s The Smart Connect - Hub](https://www.idemia.com/smart-connect-hub) - Assess solution type that you would like to provide your customers - Batch/offline solution - IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices. -- Operator does not have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to +- Operator doesn't have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to - Real-time solution - MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via sim vendor solution component. IT Admin can view subscription pool and provision eSIM in real time. - Operator is notified of the status of each eSIM profile and has visibility on which devices are being used -**Note:** The solution type is not noticeable to the end-user. The choice between the two is made between the MDM and the Mobile Operator. +**Note:** End users don't notice the solution type. The choice between the two is made between the MDM and the Mobile Operator. diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 43626310a0..1f42e3e43d 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -1,6 +1,6 @@ --- title: eUICCs CSP -description: eUICCs CSP +description: Learn how the eUICCs CSP is used to support eUICC enterprise use cases and enables the IT admin to manage (assign, re-assign, remove) subscriptions to employees. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 3f3e71df8d..38bb8e5f6f 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -1,6 +1,6 @@ --- title: eUICCs DDF file -description: eUICCs DDF file +description: Learn about the OMA DM device description framework (DDF) for the eUICCs configuration service provider (CSP). ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index e8ad3c9cd8..01d4daf010 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -14,16 +14,14 @@ ms.date: 07/28/2017 # Federated authentication device enrollment - This section provides an example of the mobile device enrollment protocol using federated authentication policy. When the authentication policy is set to Federated, the web authentication broker is leveraged by the enrollment client to get a security token. The enrollment client calls the web authentication broker API within the response message to start the process. The server should build the web authentication broker pages to fit the device screen and should be consistent with the existing enrollment UI. The opaque security token that is returned from the broker as an end page is used by the enrollment client as the device security secret during the client certificate request call. The <AuthenticationServiceURL> element the discovery response message specifies web authentication broker page start URL. -For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). +For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347). ## In this topic - [Discovery service](#discovery-service) [Enrollment policy web service](#enrollment-policy-web-service) [Enrollment web service](#enrollment-web-service) @@ -32,12 +30,10 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme ## Discovery service - The discovery web service provides the configuration information necessary for a user to enroll a phone with a management service. The service is a restful web service over HTTPS (server authentication only). -> **Note**  The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. - - +> [!NOTE] +> The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -45,28 +41,28 @@ The first request is a standard HTTP GET request. The following example shows a request via HTTP GET to the discovery server given user@contoso.com as the email address. -``` +```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: unknown Header Byte Count: 153 Body Byte Count: 0 ``` -``` +```http GET /EnrollmentServer/Discovery.svc HTTP/1.1 User-Agent: Windows Phone 8 Enrollment Client Host: EnterpriseEnrollment.contoso.com Pragma: no-cache ``` -``` +```http Request Full Url: http://EnterpriseEnrollment.contoso.com/EnrollmentServer/Discovery.svc Content Type: text/html Header Byte Count: 248 Body Byte Count: 0 ``` -``` +```http HTTP/1.1 200 OK Connection: Keep-Alive Pragma: no-cache @@ -86,7 +82,7 @@ The following logic is applied: The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address -``` +```http https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc ``` @@ -131,24 +127,21 @@ The discovery response is in the XML format and includes the following fields: - Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. - In Windows, Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +> [!Note] +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. When authentication policy is set to be Federated, Web Authentication Broker (WAB) will be leveraged by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client will call the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage will be used by the enrollment client as the device security secret during the client certificate enrollment request call. -> **Note**  Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: +> [!Note] +> Instead of relying on the user agent string that is passed during authentication to get information, such as the OS version, use the following guidance: > - Parse the OS version from the data sent up during the discovery request. > - Append the OS version as a parameter in the AuthenticationServiceURL. > - Parse out the OS version from the AuthenticiationServiceURL when the OS sends the response for authentication. - - A new XML tag, AuthenticationServiceUrl, is introduced in the DiscoveryResponse XML to allow the server to specify the WAB page start URL. For Federated authentication, this XML tag must exist. -> **Note**  The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. - - +> [!Note] +> The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. The following are the explicit requirements for the server. @@ -170,7 +163,7 @@ After authentication is complete, the auth server should return an HTML form doc > [!NOTE] > To make an application compatible with strict Content Security Policy, it is usually necessary to make some changes to HTML templates and client-side code, add the policy header, and test that everything works properly once the policy is deployed. -``` +```html HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding @@ -237,7 +230,6 @@ The following example shows a response received from the discovery web service w ## Enrollment policy web service - Policy service is optional. By default, if no policies are specified, the minimum key length is 2k and the hash algorithm is SHA-1. This web service implements the X.509 Certificate Enrollment Policy Protocol (MS-XCEP) specification that allows customizing certificate enrollment to match different security needs of enterprises at different times (cryptographic agility). The service processes the GetPolicies message from the client, authenticates the client, and returns matching enrollment policies in the GetPoliciesResponse message. @@ -302,9 +294,8 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. For Windows device, we will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +> [!NOTE] +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -387,7 +378,6 @@ The following snippet shows the policy web service response. ## Enrollment web service - This web service implements the MS-WSTEP protocol. It processes the RequestSecurityToken (RST) message from the client, authenticates the client, requests the certificate from the CA, and returns it in the RequestSecurityTokenResponse (RSTR) to the client. Besides the issued certificate, the response also contains configurations needed to provision the DM client. The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on match the certificate template), the client can enroll successfully. @@ -396,9 +386,8 @@ Note that the RequestSecurityToken will use a custom TokenType (http: **Note**  The policy service and the enrollment service must be on the same server; that is, they must have the same host name. - - +> [!Note] +> The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for federated authentication. @@ -487,9 +476,8 @@ The following example shows the enrollment web service request for federated aut After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR). -> **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. - - +> [!Note] +> The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. Similar to the TokenType in the RST, the RSTR will use a custom ValueType in the BinarySecurityToken (http://schemas.microsoft.com/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc), because the token is more than an X.509 v3 certificate. @@ -553,7 +541,7 @@ The following example shows the enrollment web service response. The following code shows sample provisioning XML (presented in the preceding package as a security token): -``` +```xml @@ -640,11 +628,3 @@ The following code shows sample provisioning XML (presented in the preceding pac - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. - - - - - - - - diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md index 653b03b527..12547591ba 100644 --- a/windows/client-management/mdm/filesystem-csp.md +++ b/windows/client-management/mdm/filesystem-csp.md @@ -1,6 +1,6 @@ --- title: FileSystem CSP -description: FileSystem CSP +description: Learn how the FileSystem CSP is used to query, add, modify, and delete files, file directories, and file attributes on the mobile device. ms.assetid: 9117ee16-ca7a-4efa-9270-c9ac8547e541 ms.reviewer: manager: dansimp @@ -14,41 +14,38 @@ ms.date: 06/26/2017 # FileSystem CSP - The FileSystem configuration service provider is used to query, add, modify, and delete files, file directories, and file attributes on the mobile device. It can retrieve information about or manage files in ROM, files in persistent store and files on any removable storage card that is present in the device. It works for files that are hidden from the user as well as those that are visible to the user. -> **Note**  FileSystem CSP is only supported in Windows 10 Mobile. -> -> -> -> **Note**   This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_OEM capabilities to be accessed from a network configuration application. +> [!NOTE] +> FileSystem CSP is only supported in Windows 10 Mobile. - +> [!NOTE] +> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_OEM capabilities to be accessed from a network configuration application. The following diagram shows the FileSystem configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider. ![filesystem csp (dm)](images/provisioning-csp-filesystem-dm.png) -**FileSystem** +**FileSystem** Required. Defines the root of the file system management object. It functions as the root directory for file system queries. Recursive queries or deletes are not supported for this element. Add commands will add a new file or directory under the root path. The following properties are supported for the root node: -- `Name`: The root node name. The Get command is the only supported command. +- `Name`: The root node name. The Get command is the only supported command. -- `Type`: The MIME type of the file, which is com.microsoft/windowsmobile/1.1/FileSystemMO. The Get command is the only supported command. +- `Type`: The MIME type of the file, which is com.microsoft/windowsmobile/1.1/FileSystemMO. The Get command is the only supported command. -- `Format`: The format, which is `node`. The Get command is the only supported command. +- `Format`: The format, which is `node`. The Get command is the only supported command. -- `TStamp`: A standard OMA property that indicates the last time the file directory was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command. +- `TStamp`: A standard OMA property that indicates the last time the file directory was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command. -- `Size`: Not supported. +- `Size`: Not supported. -- `msft:SystemAttributes`: A custom property that contains file directory attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file winnt.h. This supports the Get command and the Replace command. +- `msft:SystemAttributes`: A custom property that contains file directory attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file winnt.h. This supports the Get command and the Replace command. -***file directory*** +***file directory*** Optional. Returns the name of a directory in the device file system. Any *file directory* element can contain directories and files as child elements. The Get command returns the name of the file directory. The Get command with `?List=Struct` will recursively return all child element names (including sub-directory names). The Get command with `?list=StructData` query is not supported and returns a 406 error code. @@ -61,19 +58,19 @@ The Delete command is used to delete all files and subfolders under this *file d The following properties are supported for file directories: -- `Name`: The file directory name. The Get command is the only supported command. +- `Name`: The file directory name. The Get command is the only supported command. -- `Type`: The MIME type of the file, which an empty string for directories that are not the root node. The Get command is the only supported command. +- `Type`: The MIME type of the file, which is an empty string for directories that are not the root node. The Get command is the only supported command. -- `Format`: The format, which is `node`. The Get command is the only supported command. +- `Format`: The format, which is `node`. The Get command is the only supported command. -- `TStamp`: A standard OMA property that indicates the last time the file directory was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command. +- `TStamp`: A standard OMA property that indicates the last time the file directory was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command. -- `Size`: Not supported. +- `Size`: Not supported. -- `msft:SystemAttributes`: A custom property that contains file directory attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file winnt.h. This supports the Get command and the Replace command. +- `msft:SystemAttributes`: A custom property that contains file directory attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file `winnt.h`. This supports the Get command and the Replace command. -***file name*** +***file name*** Optional. Return a file in binary format. If the file is too large for the configuration service to return, it returns error code 413 (Request entity too large) instead. The Delete command deletes the file. @@ -86,29 +83,18 @@ The Get command is not supported on a *file name* element, only on the propertie The following properties are supported for files: -- `Name`: The file name. The Get command is the only supported command. +- `Name`: The file name. The Get command is the only supported command. -- `Type`: The MIME type of the file. This value is always set to the generic MIME type: `application/octet-stream`. The Get command is the only supported command. +- `Type`: The MIME type of the file. This value is always set to the generic MIME type: `application/octet-stream`. The Get command is the only supported command. -- `Format`: The format, which is b64 encoded for binary data is sent over XML, and bin format for binary data sent over wbxml. The Get command is the only supported command. +- `Format`: The format, which is b64 encoded for binary data is sent over XML, and bin format for binary data sent over WBXML. The Get command is the only supported command. -- `TStamp`: A standard OMA property that indicates the last time the file was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command. +- `TStamp`: A standard OMA property that indicates the last time the file was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command. -- `Size`: The unencoded file content size in bytes. The Get command is the only supported command. +- `Size`: The unencoded file content size in bytes. The Get command is the only supported command. -- `msft:SystemAttributes`: A custom property that contains file attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file winnt.h. This supports the Get command and the Replace command. +- `msft:SystemAttributes`: A custom property that contains file attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file winnt.h. This supports the Get command and the Replace command. ## Related topics - [Configuration service provider reference](configuration-service-provider-reference.md) - - - - - - - - - - diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index b8f27a73dc..bf8a5ea5ad 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -1,6 +1,6 @@ --- title: Firewall CSP -description: Firewall CSP +description: The Firewall configuration service provider (CSP) allows the mobile device management (MDM) server to configure the Windows Defender Firewall global settings. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -248,10 +248,10 @@ Sample syncxml to provision the firewall settings to evaluate

    Value type is string. Supported operations are Add, Get, Replace, and Delete.

    **FirewallRules/*FirewallRuleName*/LocalAddressRanges** -

    Comma separated list of local addresses covered by the rule. The default value is "". Valid tokens include:

    +

    Comma separated list of local addresses covered by the rule. The default value is "*". Valid tokens include:

      -
    • "" indicates any local address. If present, this must be the only token included.
    • -
    • A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.
    • +
    • "*" indicates any local address. If present, this must be the only token included.
    • +
    • A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.
    • A valid IPv6 address.
    • An IPv4 address range in the format of "start address - end address" with no spaces included.
    • An IPv6 address range in the format of "start address - end address" with no spaces included.
    • @@ -260,9 +260,9 @@ Sample syncxml to provision the firewall settings to evaluate

      Value type is string. Supported operations are Add, Get, Replace, and Delete.

      **FirewallRules/*FirewallRuleName*/RemoteAddressRanges** -

      List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "". Valid tokens include:

      +

      List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "*". Valid tokens include:

        -
      • "" indicates any remote address. If present, this must be the only token included.
      • +
      • "*" indicates any remote address. If present, this must be the only token included.
      • "Defaultgateway"
      • "DHCP"
      • "DNS"
      • diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index 20172a8f10..72829fc3a9 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -1,6 +1,6 @@ --- title: Firewall DDF file -description: Firewall DDF file +description: Learn about the OMA DM device description framework (DDF) for the Firewall configuration service provider. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/get-localized-product-details.md b/windows/client-management/mdm/get-localized-product-details.md index c2e89912d8..52848ed620 100644 --- a/windows/client-management/mdm/get-localized-product-details.md +++ b/windows/client-management/mdm/get-localized-product-details.md @@ -1,6 +1,6 @@ --- title: Get localized product details -description: The Get localized product details operation retrieves the localization information of a product from the Micosoft Store for Business. +description: The Get localized product details operation retrieves the localization information of a product from the Microsoft Store for Business. ms.assetid: EF6AFCA9-8699-46C9-A3BB-CD2750C07901 ms.reviewer: manager: dansimp @@ -9,12 +9,12 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/18/2017 +ms.date: 12/07/2020 --- # Get localized product details -The **Get localized product details** operation retrieves the localization information of a product from the Micosoft Store for Business. +The **Get localized product details** operation retrieves the localization information of a product from the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/get-offline-license.md b/windows/client-management/mdm/get-offline-license.md index 772d402b87..87699a8b11 100644 --- a/windows/client-management/mdm/get-offline-license.md +++ b/windows/client-management/mdm/get-offline-license.md @@ -1,6 +1,6 @@ --- title: Get offline license -description: The Get offline license operation retrieves the offline license information of a product from the Micosoft Store for Business. +description: The Get offline license operation retrieves the offline license information of a product from the Microsoft Store for Business. ms.assetid: 08DAD813-CF4D-42D6-A783-994A03AEE051 ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get offline license -The **Get offline license** operation retrieves the offline license information of a product from the Micosoft Store for Business. +The **Get offline license** operation retrieves the offline license information of a product from the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/get-product-package.md b/windows/client-management/mdm/get-product-package.md index 7f75857534..662580acde 100644 --- a/windows/client-management/mdm/get-product-package.md +++ b/windows/client-management/mdm/get-product-package.md @@ -1,6 +1,6 @@ --- title: Get product package -description: The Get product package operation retrieves the information about a specific application in the Micosoft Store for Business. +description: The Get product package operation retrieves the information about a specific application in the Microsoft Store for Business. ms.assetid: 4314C65E-6DDC-405C-A591-D66F799A341F ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get product package -The **Get product package** operation retrieves the information about a specific application in the Micosoft Store for Business. +The **Get product package** operation retrieves the information about a specific application in the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/get-seat.md b/windows/client-management/mdm/get-seat.md index 2169488622..598d24ea19 100644 --- a/windows/client-management/mdm/get-seat.md +++ b/windows/client-management/mdm/get-seat.md @@ -1,6 +1,6 @@ --- title: Get seat -description: The Get seat operation retrieves the information about an active seat for a specified user in the Micosoft Store for Business. +description: The Get seat operation retrieves the information about an active seat for a specified user in the Microsoft Store for Business. ms.assetid: 715BAEB2-79FD-4945-A57F-482F9E7D07C6 ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get seat -The **Get seat** operation retrieves the information about an active seat for a specified user in the Micosoft Store for Business. +The **Get seat** operation retrieves the information about an active seat for a specified user in the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 3870f7d385..f128954ea6 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -1,6 +1,6 @@ --- title: Device HealthAttestation CSP -description: Device HealthAttestation CSP +description: Learn how the DHA-CSP enables enterprise IT managers to assess if a device is booted to a trusted and compliant state, and take enterprise policy actions. ms.assetid: 6F2D783C-F6B4-4A81-B9A2-522C4661D1AC ms.reviewer: manager: dansimp @@ -74,7 +74,7 @@ The following is a list of functions performed by the Device HealthAttestation C DHA-Enabled MDM (Device HealthAttestation enabled device management solution)

        Device HealthAttestation enabled (DHA-Enabled) device management solution is a device management tool that is integrated with the DHA feature.

        -

        DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromized by advanced security threats or running a malicious (jailbroken) operating system.

        +

        DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromised by advanced security threats or running a malicious (jailbroken) operating system.

        The following list of operations are performed by DHA-Enabled-MDM:

        • Enables the DHA feature on a DHA-Enabled device
        • @@ -195,10 +195,10 @@ The following diagram shows the Device HealthAttestation configuration service p

          The following list shows some examples of supported values. For the complete list of status see Device HealthAttestation CSP status and error codes.

          -- 0 - (HEALTHATTESTATION\_CERT\_RETRI_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service -- 1 - (HEALTHATTESTATION\_CERT\_RETRI_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device +- 0 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service +- 1 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device - 2 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_FAILED): A valid DHA-EncBlob could not be retrieved from the DHA-Service for reasons other than discussed in the DHA error/status codes -- 3 - (HEALTHATTESTATION\_CERT\_RETRI_COMPLETE): DHA-Data is ready for pick up +- 3 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_COMPLETE): DHA-Data is ready for pick up **ForceRetrieve** (Optional)

          Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.

          @@ -220,7 +220,7 @@ The following diagram shows the Device HealthAttestation configuration service p **CorrelationId** (Required)

          Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting.

          -

          Value type is integer, the minimum value is - 2,147,483,648 and the maximun value is 2,147,483,647. The supported operation is Get.

          +

          Value type is integer, the minimum value is - 2,147,483,648 and the maximum value is 2,147,483,647. The supported operation is Get.

          **HASEndpoint** (Optional)

          Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service.

          @@ -359,8 +359,8 @@ The following example shows a sample call that triggers collection and verificat After the client receives the health attestation request, it sends a response. The following list describes the responses, along with a recommended action to take. -- If the response is HEALTHATTESTATION\_CERT_RETRI_COMPLETE (3) then proceed to the next section. -- If the response is HEALTHATTESTATION_CERT_RETRI_REQUESTED (1) or HEALTHATTESTATION_CERT_RETRI_UNINITIALIZED (0) wait for an alert, then proceed to the next section. +- If the response is HEALTHATTESTATION\_CERT_RETRIEVAL_COMPLETE (3) then proceed to the next section. +- If the response is HEALTHATTESTATION_CERT_RETRIEVAL_REQUESTED (1) or HEALTHATTESTATION_CERT_RETRIEVAL_UNINITIALIZED (0) wait for an alert, then proceed to the next section. Here is a sample alert that is issued by DHA_CSP: @@ -748,13 +748,13 @@ Each of these are described in further detail in the following sections, along w **PCR0**

          The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.

          -

          Enterprise managers can create a whitelist of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the whitelist, and then make a trust decision based on the result of the comparison.

          +

          Enterprise managers can create a allow list of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the allow list, and then make a trust decision based on the result of the comparison.

          -

          If your enterprise does not have a whitelist of accepted PCR[0] values, then take no action.

          +

          If your enterprise does not have a allow list of accepted PCR[0] values, then take no action.

          -

          If PCR[0] equals an accepted whitelisted value, then allow access.

          +

          If PCR[0] equals an accepted allow list value, then allow access.

          -

          If PCR[0] does not equal any accepted whitelisted value, then take one of the following actions that align with your enterprise policies:

          +

          If PCR[0] does not equal any accepted listed value, then take one of the following actions that align with your enterprise policies:

          - Disallow all access - Direct the device to an enterprise honeypot, to further monitor the device's activities. @@ -762,9 +762,9 @@ Each of these are described in further detail in the following sections, along w **SBCPHash**

          SBCPHash is the finger print of the Custom Secure Boot Configuration Policy (SBCP) that was loaded during boot in Windows devices, except PCs.

          -

          If SBCPHash is not present, or is an accepted (whitelisted) value, then allow access. +

          If SBCPHash is not present, or is an accepted allow-listed value, then allow access. -

          If SBCPHash is present in DHA-Report, and is not a whitelisted value, then take one of the following actions that align with your enterprise policies:

          +

          If SBCPHash is present in DHA-Report, and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

          - Disallow all access - Place the device in a watch list to monitor the device more closely for potential risks. @@ -772,9 +772,9 @@ Each of these are described in further detail in the following sections, along w **CIPolicy**

          This attribute indicates the Code Integrity policy that is controlling the security of the boot environment.

          -

          If CIPolicy is not present, or is an accepted (whitelisted) value, then allow access.

          +

          If CIPolicy is not present, or is an accepted allow-listed value, then allow access.

          -

          If CIPolicy is present and is not a whitelisted value, then take one of the following actions that align with your enterprise policies:

          +

          If CIPolicy is present and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

          - Disallow all access - Place the device in a watch list to monitor the device more closely for potential risks. @@ -830,7 +830,7 @@ Each of these are described in further detail in the following sections, along w
    - + diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index 21934f6452..d7209b1cf2 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -1,6 +1,6 @@ --- title: HealthAttestation DDF -description: HealthAttestation DDF +description: Learn about the OMA DM device description framework (DDF) for the HealthAttestation configuration service provider. ms.assetid: D20AC78D-D2D4-434B-B9FD-294BCD9D1DDE ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/hotspot-csp.md b/windows/client-management/mdm/hotspot-csp.md index 025ce63385..f4a14359a1 100644 --- a/windows/client-management/mdm/hotspot-csp.md +++ b/windows/client-management/mdm/hotspot-csp.md @@ -1,6 +1,6 @@ --- title: HotSpot CSP -description: HotSpot CSP +description: Learn how HotSpot configuration service provider (CSP) is used to configure and enable Internet sharing on a device. ms.assetid: ec49dec1-fa79-420a-a9a7-e86668b3eebf ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/images/Provisioning_CSP_Defender.png b/windows/client-management/mdm/images/Provisioning_CSP_Defender.png deleted file mode 100644 index 6ee31a8f16..0000000000 Binary files a/windows/client-management/mdm/images/Provisioning_CSP_Defender.png and /dev/null differ diff --git a/windows/client-management/mdm/images/autoenrollment-policy.png b/windows/client-management/mdm/images/autoenrollment-policy.png index 61421babee..1de089a0c6 100644 Binary files a/windows/client-management/mdm/images/autoenrollment-policy.png and b/windows/client-management/mdm/images/autoenrollment-policy.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-defender.png b/windows/client-management/mdm/images/provisioning-csp-defender.png index 793b1568ff..ccf57208df 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-defender.png and b/windows/client-management/mdm/images/provisioning-csp-defender.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-devdetail-dm.png b/windows/client-management/mdm/images/provisioning-csp-devdetail-dm.png index 6ece851369..76df1eafea 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-devdetail-dm.png and b/windows/client-management/mdm/images/provisioning-csp-devdetail-dm.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png index 5c90ec5a2b..4328edcad7 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png and b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png b/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png index 498ce66f47..f123d98073 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png and b/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png b/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png index 5d8eaab42f..5896b7c1df 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png and b/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-38.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-38.png deleted file mode 100644 index 7ee23eda5d..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-38.png and /dev/null differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-39.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-39.png deleted file mode 100644 index a1ca65c3f4..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-39.png and /dev/null differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-40.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-40.png deleted file mode 100644 index 87f685d460..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-40.png and /dev/null differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-41.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-41.png deleted file mode 100644 index 1832454fbc..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-41.png and /dev/null differ diff --git a/windows/client-management/mdm/images/unifiedenrollment-rs1-42.png b/windows/client-management/mdm/images/unifiedenrollment-rs1-42.png deleted file mode 100644 index c85e74d141..0000000000 Binary files a/windows/client-management/mdm/images/unifiedenrollment-rs1-42.png and /dev/null differ diff --git a/windows/client-management/mdm/index.md b/windows/client-management/mdm/index.md index 44d416b67a..aef061ccd2 100644 --- a/windows/client-management/mdm/index.md +++ b/windows/client-management/mdm/index.md @@ -33,7 +33,7 @@ With Windows 10, version 1809, Microsoft is also releasing a Microsoft MDM secur The MDM security baseline includes policies that cover the following areas: -- Microsoft inbox security technology (not deprecated) such as Bitlocker, Windows Defender Smartscreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall +- Microsoft inbox security technology (not deprecated) such as BitLocker, Windows Defender SmartScreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall - Restricting remote access to devices - Setting credential requirements for passwords and PINs - Restricting use of legacy technology @@ -42,12 +42,13 @@ The MDM security baseline includes policies that cover the following areas: For more details about the MDM policies defined in the MDM security baseline and what Microsoft’s recommended baseline policy values are, see: +- [MDM Security baseline for Windows 10, version 2004](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/2004-MDM-SecurityBaseLine-Document.zip) - [MDM Security baseline for Windows 10, version 1909](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1909-MDM-SecurityBaseLine-Document.zip) - [MDM Security baseline for Windows 10, version 1903](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1903-MDM-SecurityBaseLine-Document.zip) - [MDM Security baseline for Windows 10, version 1809](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1809-MDM-SecurityBaseLine-Document-[Preview].zip) -For information about the MDM policies defined in the Intune security baseline public preview, see [Windows security baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-windows) +For information about the MDM policies defined in the Intune security baseline public preview, see [Windows security baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-windows). diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index 87c13cbc3e..f74caeda09 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -1,6 +1,6 @@ --- -title: MDM enrollment of Windows-based devices -description: MDM enrollment of Windows-based devices +title: MDM enrollment of Windows 10-based devices +description: Learn about mobile device management (MDM) enrollment of Windows 10-based devices to simplify access to your organization’s resources. MS-HAID: - 'p\_phdevicemgmt.enrollment\_ui' - 'p\_phDeviceMgmt.mdm\_enrollment\_of\_windows\_devices' @@ -12,38 +12,32 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 11/15/2017 +ms.date: 11/19/2020 --- -# MDM enrollment of Windows-based devices +# MDM enrollment of Windows 10-based devices +In today’s cloud-first world, enterprise IT departments increasingly want to let employees use their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization’s resources, such as apps, the corporate network, and email. -This topic describes the user experience of enrolling Windows 10-based PCs and devices. +> [!NOTE] +> When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. -In today’s cloud-first world, enterprise IT departments increasingly want to let employees bring their own devices, or even choose and purchase corporate-owned devices. Connecting your devices to work makes it easy for you to access your organization’s resources (such as apps, the corporate network, and email). +## Connect corporate-owned Windows 10-based devices -> **Note**  When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. - - - -## Connecting corporate-owned Windows 10-based devices - - -Corporate owned devices can be connected to work either by joining the device to an Active Directory domain or an Azure Active Directory (Azure AD) domain. Windows 10 does not require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. +You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 does not require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. ![active directory azure ad signin](images/unifiedenrollment-rs1-1.png) -### Connecting your device to an Active Directory domain (Join a domain) +### Connect your device to an Active Directory domain (join a domain) -Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education can be connected to an Active Directory domain. These devices can be connected using the Settings app. +Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education can be connected to an Active Directory domain using the Settings app. -> **Note**  Mobile devices cannot be connected to an Active Directory domain. +> [!NOTE] +> Mobile devices cannot be connected to an Active Directory domain. - +### Out-of-box-experience -### Out-of-box-experience (OOBE) - -Because joining your device to an Active Directory domain during the OOBE is not supported, you’ll need to first create a local account and then connect the device using the Settings app. +Joining your device to an Active Directory domain during the out-of-box-experience (OOBE) is not supported. To join a domain: 1. On the **Who Owns this PC?** page, select **My work or school owns it**. @@ -53,11 +47,13 @@ Because joining your device to an Active Directory domain during the OOBE is not ![select domain or azure ad](images/unifiedenrollment-rs1-3.png) -3. You will next see a prompt to set up a local account on the device. Enter your local account details and then click **Next** to continue. +3. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. ![create pc account](images/unifiedenrollment-rs1-4.png) -### Using the Settings app +### Use the Settings app + +To create a local account and connect the device: 1. Launch the Settings app. @@ -71,42 +67,44 @@ Because joining your device to an Active Directory domain during the OOBE is not ![select access work or school](images/unifiedenrollment-rs1-7.png) -4. Click **Connect**. +4. Select **Connect**. ![connect to work or school](images/unifiedenrollment-rs1-8.png) -5. Under **Alternate actions**, click **Join this device to a local Active Directory domain**. +5. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. ![join account to active directory domain](images/unifiedenrollment-rs1-9.png) -6. Type in your domain name, follow the instructions, and then click **Next** to continue. After you complete the flow and reboot your device, it should be connected to your Active Directory domain. You can now log into the device using your domain credentials. +6. Type in your domain name, follow the instructions, and then select **Next** to continue. After you complete the flow and restart your device, it should be connected to your Active Directory domain. You can now sign in to the device using your domain credentials. ![type in domain name](images/unifiedenrollment-rs1-10.png) ### Help with connecting to an Active Directory domain -There are a few instances where your device cannot be connected to an Active Directory domain: +There are a few instances where your device cannot be connected to an Active Directory domain. -| Connection issue | Explanation | +| Connection issue | Description | |-----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Your device is already connected to an Active Directory domain. | Your device can be connected to only a single Active Directory domain at a time. | +| Your device is already connected to an Active Directory domain. | Your device can only be connected to a single Active Directory domain at a time. | | Your device is connected to an Azure AD domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You cannot connect to both simultaneously. | | You are logged in as a standard user. | Your device can only be connected to an Azure AD domain if you are logged in as an administrative user. You’ll need to switch to an administrator account to continue. | | Your device is running Windows 10 Home. | This feature is not available on Windows 10 Home, so you will be unable to connect to an Active Directory domain. You will need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | -### Connecting your device to an Azure AD domain (Join Azure AD) +### Connect your device to an Azure AD domain (join Azure AD) All Windows devices can be connected to an Azure AD domain. These devices can be connected during OOBE. Additionally, desktop devices can be connected to an Azure AD domain using the Settings app. -### Out-of-box-experience (OOBE) +### Out-of-box-experience -1. Select **My work or school owns it**, then click **Next.** +To join a domain: + +1. Select **My work or school owns it**, then select **Next.** ![oobe local account creation](images/unifiedenrollment-rs1-11.png) -2. Click **Join Azure AD**, then click **Next.** +2. Select **Join Azure AD**, and then select **Next.** ![select domain or azure ad](images/unifiedenrollment-rs1-12.png) @@ -118,7 +116,9 @@ All Windows devices can be connected to an Azure AD domain. These devices can be ![azure ad signin](images/unifiedenrollment-rs1-13.png) -### Using the Settings app +### Use the Settings app + +To create a local account and connect the device: 1. Launch the Settings app. @@ -132,11 +132,11 @@ All Windows devices can be connected to an Azure AD domain. These devices can be ![select access work or school](images/unifiedenrollment-rs1-16.png) -4. Click **Connect**. +4. Select **Connect**. ![connect to work or school](images/unifiedenrollment-rs1-17.png) -5. Under **Alternate Actions**, click **Join this device to Azure Active Directory**. +5. Under **Alternate Actions**, selct **Join this device to Azure Active Directory**. ![join work or school account to azure ad](images/unifiedenrollment-rs1-18.png) @@ -144,7 +144,7 @@ All Windows devices can be connected to an Azure AD domain. These devices can be ![azure ad sign in](images/unifiedenrollment-rs1-19.png) -7. If the tenant is a cloud only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly on this page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as AD FS, for authentication. +7. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. @@ -156,9 +156,9 @@ All Windows devices can be connected to an Azure AD domain. These devices can be ### Help with connecting to an Azure AD domain -There are a few instances where your device cannot be connected to an Azure AD domain: +There are a few instances where your device cannot be connected to an Azure AD domain. -| Connection issue | Explanation | +| Connection issue | Description | |-----------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Your device is connected to an Azure AD domain. | Your device can only be connected to a single Azure AD domain at a time. | | Your device is already connected to an Active Directory domain. | Your device can either be connected to an Azure AD domain or an Active Directory domain. You cannot connect to both simultaneously. | @@ -169,18 +169,20 @@ There are a few instances where your device cannot be connected to an Azure AD d -## Connecting personally-owned devices (Bring your own device) +## Connect personally-owned devices -Personally owned devices, also known as bring your own device or BYOD, can be connected to a work or school account or to MDM. Windows 10 does not require a personal Microsoft account on devices to connect to work or school. +Personally-owned devices, also known as bring your own device (BYOD), can be connected to a work or school account, or to MDM. Windows 10 does not require a personal Microsoft account on devices to connect to work or school. -### Connecting to a work or school account +### Connect to a work or school account -All Windows 10-based devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps such as the universal Office apps. +All Windows 10-based devices can be connected to a work or school account. You can connect to a work or school account either through the Settings app or through any of the numerous Universal Windows Platform (UWP) apps, such as the universal Office apps. -### Using the Settings app +### Use the Settings app -1. Launch the Settings app and then click **Accounts**. Click **Start**, then the Settings icon, and then select **Accounts** +To create a local account and connect the device: + +1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**. ![windows settings page](images/unifiedenrollment-rs1-21-b.png) @@ -188,7 +190,7 @@ All Windows 10-based devices can be connected to a work or school account. You ![select access work or school](images/unifiedenrollment-rs1-23-b.png) -3. Click **Connect**. +3. Select **Connect**. ![connect to work or school](images/unifiedenrollment-rs1-24-b.png) @@ -196,7 +198,7 @@ All Windows 10-based devices can be connected to a work or school account. You ![join work or school account to azure ad](images/unifiedenrollment-rs1-25-b.png) -5. If the tenant is a cloud only, password hash sync, or pass-through authentication tenant, this page will change to show the organization's custom branding, and you will be able to enter your password directly into the page. If the tenant is part of a federated domain, you will be redirected to the organization's on-premises federation server, such as AD FS, for authentication. +5. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. @@ -210,11 +212,13 @@ All Windows 10-based devices can be connected to a work or school account. You ![account successfully added](images/unifiedenrollment-rs1-27.png) -### Connecting to MDM on a desktop (Enrolling in device management) +### Connect to MDM on a desktop (enrolling in device management) -All Windows 10-based devices can be connected to an MDM. You can connect to an MDM through the Settings app. +All Windows 10-based devices can be connected to MDM. You can connect to an MDM through the Settings app. -### Using the Settings app +### Use the Settings app + +To create a local account and connect the device: 1. Launch the Settings app. @@ -228,7 +232,7 @@ All Windows 10-based devices can be connected to an MDM. You can connect to an ![access work or school](images/unifiedenrollment-rs1-30.png) -4. Click the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows-10-based-device-to-work-using-a-deep-link). +4. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). ![connect to work or school](images/unifiedenrollment-rs1-31.png) @@ -244,36 +248,9 @@ All Windows 10-based devices can be connected to an MDM. You can connect to an After you complete the flow, your device will be connected to your organization’s MDM. - -### Connecting to MDM on a phone (Enrolling in device management) - -1. Launch the **Settings** app and then click **Accounts**. - - ![phone settings](images/unifiedenrollment-rs1-38.png) - -2. Click **Access work or school**. - - ![phone settings](images/unifiedenrollment-rs1-39.png) - -3. Click the **Enroll only in device management** link. This is only available in the servicing build 14393.82 (KB3176934). For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows-10-based-device-to-work-using-a-deep-link). - - ![access work or school page](images/unifiedenrollment-rs1-40.png) - -4. Enter your work email address. - - ![enter your email address](images/unifiedenrollment-rs1-41.png) - -5. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. - - Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - -6. After you complete the flow, your device will be connected to your organization’s MDM. - - ![completed mdm enrollment](images/unifiedenrollment-rs1-42.png) - ### Help with connecting personally-owned devices -There are a few instances where your device may not be able to connect to work, as described in the following table. +There are a few instances where your device may not be able to connect to work. | Error Message | Description | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -284,20 +261,20 @@ There are a few instances where your device may not be able to connect to work, | We couldn’t auto-discover a management endpoint matching the username entered. Please check your username and try again. If you know the URL to your management endpoint, please enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | -## Connecting your Windows 10-based device to work using a deep link +## Connect your Windows 10-based device to work using a deep link -Windows 10-based devices may be connected to work using a deep link. Users will be able to click or open a link in a particular format from anywhere in Windows 10 and be directed to the new enrollment experience. +Windows 10-based devices may be connected to work using a deep link. Users will be able to select or open a link in a particular format from anywhere in Windows 10, and be directed to the new enrollment experience. In Windows 10, version 1607, deep linking will only be supported for connecting devices to MDM. It will not support adding a work or school account, joining a device to Azure AD, and joining a device to Active Directory. -The deep link used for connecting your device to work will always use the following format: +The deep link used for connecting your device to work will always use the following format. **ms-device-enrollment:?mode={mode\_name}** | Parameter | Description | Supported Value for Windows 10| |-----------|--------------------------------------------------------------|----------------------------------------------| -| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| MDM (Mobile Device Management), AWA (Adding Work Account), and AADJ (Azure Active Directory Joined). | +| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| Mobile Device Management (MDM), Adding Work Account (AWA), and Azure Active Directory Joined (AADJ). | |username | Specifies the email address or UPN of the user who should be enrolled into MDM. Added in Windows 10, version 1703. | string | | servername | Specifies the MDM server URL that will be used to enroll the device. Added in Windows 10, version 1703. | string| | accesstoken | Custom parameter for MDM servers to use as they see fit. Typically, this can be used as a token to validate the enrollment request. Added in Windows 10, version 1703. | string | @@ -305,47 +282,45 @@ The deep link used for connecting your device to work will always use the follow | tenantidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this can be used to identify which tenant the device or user belongs to. Added in Windows 10, version 1703. | GUID or string | | ownership | Custom parameter for MDM servers to use as they see fit. Typically, this can be used to determine whether the device is BYOD or Corp Owned. Added in Windows 10, version 1703. | 1, 2, or 3 | -> **Note** "awa" and "aadj" values for mode are only supported on Windows 10, version 1709 and later. +> [!NOTE] +> AWA and AADJ values for mode are only supported on Windows 10, version 1709 and later. -### Connecting to MDM using a deep link +### Connect to MDM using a deep link -> **Note** Deep links only work with Internet Explorer or Edge browsers. -When connecting to MDM using a deep link, the URI you should use is +> [!NOTE] +> Deep links only work with Internet Explorer or Microsoft Edge browsers. When connecting to MDM using a deep link, the URI you should use is: +> **ms-device-enrollment:?mode=mdm** +> **ms-device-enrollment:?mode=mdm&username=someone@example.com&servername=** -**ms-device-enrollment:?mode=mdm** -**ms-device-enrollment:?mode=mdm&username=someone@example.com&servername=** +To connect your devices to MDM using deep links: -The following procedure describes how users can connect their devices to MDM using deep links. +1. Starting with Windows 10, version 1607, create a link to launch the built-in enrollment app using the URI **ms-device-enrollment:?mode=mdm**, and user-friendly display text, such as **Click here to connect Windows to work**: -1. Starting with Windows 10, version 1607, you can create a link to launch the built-in enrollment app using the URI **ms-device-enrollment:?mode=mdm** and user-friendly display text, such as **Click here to connect Windows to work**: + (Be aware that this will launch the flow equivalent to the Enroll into the device management option in Windows 10, version 1511.) - > **Note**  This will launch the flow equivalent to the Enroll into device management option in Windows 10, version 1511. - - - IT admins can add this link to a welcome email that users can click on to enroll into MDM. + - IT admins can add this link to a welcome email that users can select to enroll into MDM. ![using enrollment deeplink in email](images/deeplinkenrollment1.png) - IT admins can also add this link to an internal web page that users refer to enrollment instructions. -2. After clicking the link or running it, Windows 10 will launch the enrollment app in a special mode that only allows MDM enrollments (similar to the Enroll into device management option in Windows 10, version 1511). +2. After you select the link or run it, Windows 10 launches the enrollment app in a special mode that only allows MDM enrollments (similar to the Enroll into device management option in Windows 10, version 1511). Type in your work email address. ![set up work or school account](images/deeplinkenrollment3.png) -3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. +3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - > **Note**  Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. - - After you complete the flow, your device will be connected to your organization’s MDM. + After you complete the flow, your device will be connected to your organization's MDM. ![corporate sign in](images/deeplinkenrollment4.png) -## Managing connections +## Manage connections -Your work or school connections can be managed on the **Settings** > **Accounts** > **Access work or school** page. Your connections will show on this page and clicking on one will expand options for that connection. +To manage your work or school connections, select **Settings** > **Accounts** > **Access work or school**. Your connections will show on this page and selecting one will expand options for that connection. ![managing work or school account](images/unifiedenrollment-rs1-34-b.png) @@ -357,30 +332,31 @@ The **Info** button can be found on work or school connections involving MDM. Th - Connecting your device to a work or school account that has auto-enroll into MDM configured. - Connecting your device to MDM. -Clicking the **Info** button will open a new page in the Settings app that provides details about your MDM connection. You’ll be able to view your organization’s support information (if configured) on this page. You’ll also be able to start a sync session which will force your device to communicate to the MDM server and fetch any updates to policies if needed. +Selecting the **Info** button will open a new page in the Settings app that provides details about your MDM connection. You’ll be able to view your organization’s support information (if configured) on this page. You’ll also be able to start a sync session which forces your device to communicate to the MDM server and fetch any updates to policies if needed. -Starting in Windows 10, version 1709, clicking the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screenshot. +Starting in Windows 10, version 1709, selecting the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screenshot. ![work or school info](images/unifiedenrollment-rs1-35-b.png) -> [NOTE] +> [!NOTE] > Starting in Windows 10, version 1709, the **Manage** button is no longer available. ### Disconnect -The **Disconnect** button can be found on all work connections. Generally, clicking the **Disconnect** button will remove the connection from the device. There are a few exceptions to this: +The **Disconnect** button can be found on all work connections. Generally, selecting the **Disconnect** button will remove the connection from the device. There are a few exceptions to this: - Devices that enforce the AllowManualMDMUnenrollment policy will not allow users to remove MDM enrollments. These connections must be removed by a server-initiated unenroll command. - On mobile devices, you cannot disconnect from Azure AD. These connections can only be removed by wiping the device. -> **Warning**  Disconnecting might result in the loss of data on the device. +> [!WARNING] +> Disconnecting might result in the loss of data on the device. ## Collecting diagnostic logs -You can collect diagnostic logs around your work connections by going to **Settings** > **Accounts** > **Access work or school**, and clicking the **Export your management logs** link under **Related Settings**. After you click the link, click **Export** and follow the path displayed to retrieve your management log files. +You can collect diagnostic logs around your work connections by going to **Settings** > **Accounts** > **Access work or school**, and then selecting the **Export your management logs** link under **Related Settings**. Next, select **Export**, and follow the path displayed to retrieve your management log files. -Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and clicking the **Info** button. At the bottom of the Settings page you will see the button to create a report. Here is an example screenshot. +Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you will see the button to create a report, as shown here. ![collecting enrollment management log files](images/unifiedenrollment-rs1-37-c.png) diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index e7fcc04cf0..e9383e871f 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -1,6 +1,6 @@ --- title: Messaging CSP -description: Messaging CSP +description: Use the Messaging configuration service provider (CSP) to configure the ability to get text messages audited on a mobile device. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/messaging-ddf.md b/windows/client-management/mdm/messaging-ddf.md index 3dd896d26b..22207f104b 100644 --- a/windows/client-management/mdm/messaging-ddf.md +++ b/windows/client-management/mdm/messaging-ddf.md @@ -1,6 +1,6 @@ --- title: Messaging DDF file -description: Messaging DDF file +description: Utilize the OMA DM device description framework (DDF) for the Messaging configuration service provider. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 38e128bd28..061a5abdb2 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -1,6 +1,6 @@ --- title: Mobile device enrollment -description: Mobile device enrollment is the first phase of enterprise management. +description: Learn how mobile device enrollment verifies that only authenticated and authorized devices can be managed by their enterprise. ms.assetid: 08C8B3DB-3263-414B-A368-F47B94F47A11 ms.reviewer: manager: dansimp @@ -14,7 +14,6 @@ ms.date: 08/11/2017 # Mobile device enrollment - Mobile device enrollment is the first phase of enterprise management. The device is configured to communicate with the MDM server using security precautions during the enrollment process. The enrollment service verifies that only authenticated and authorized devices can be managed by their enterprise. The enrollment process includes the following steps: @@ -33,21 +32,20 @@ The enrollment process includes the following steps: ## Enrollment protocol - There are a number of changes made to the enrollment protocol to better support a variety of scenarios across all platforms. For detailed information about the mobile device enrollment protocol, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). The enrollment process involves the following steps: -**Discovery request** +### Discovery request The discovery request is a simple HTTP post call that returns XML over HTTP. The returned XML includes the authentication URL, the management service URL, and the user credential type. -**Certificate enrollment policy** +### Certificate enrollment policy The certificate enrollment policy configuration is an implementation of the MS-XCEP protocol, which is described in \[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol Specification. Section 4 of the specification provides an example of the policy request and response. The X.509 Certificate Enrollment Policy Protocol is a minimal messaging protocol that includes a single client request message (GetPolicies) with a matching server response message (GetPoliciesResponse). For more information, see [\[MS-XCEP\]: X.509 Certificate Enrollment Policy Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619345) -**Certificate enrollment** +### Certificate enrollment The certificate enrollment is an implementation of the MS-WSTEP protocol. -**Management configuration** +### Management configuration The server sends provisioning XML that contains a server certificate (for SSL server authentication), a client certificate issued by enterprise CA, DM client bootstrap information (for the client to communicate with the management server), an enterprise application token (for the user to install enterprise applications), and the link to download the Company Hub application. The following topics describe the end-to-end enrollment process using various authentication methods: @@ -56,19 +54,18 @@ The following topics describe the end-to-end enrollment process using various au - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) - [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) -> **Note**  As a best practice, do not use hardcoded server-side checks on values such as: +> [!Note] +> As a best practice, do not use hardcoded server-side checks on values such as: > - User agent string > - Any fixed URIs that are passed during enrollment > - Specific formatting of any value unless otherwise noted, such as the format of the device ID. - ## Enrollment support for domain-joined devices -  + Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in **Settings**. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device. ## Disable MDM enrollments - Starting in Windows 10, version 1607, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. ![Disable MDM enrollment policy in GP Editor](images/mdm-enrollment-disable-policy.png) @@ -89,7 +86,6 @@ The following scenarios do not allow MDM enrollments: ## Enrollment migration - **Desktop:** After the MDM client upgrade from Windows 8.1 to Windows 10, enrollment migration starts at the first client-initiated sync with the MDM service. The enrollment migration start time depends on the MDM server configuration. For example, for Intune it runs every 6 hours. Until the enrollment migration is completed, the user interface will show no enrollment and server push will not work. @@ -100,7 +96,6 @@ To manually trigger enrollment migration, you can run MDMMaintenenceTask. ## Enrollment error messages - The enrollment server can decline enrollment messages using the SOAP Fault format. Errors created can be sent as follows: ```xml @@ -196,8 +191,6 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma
    3 HEALTHATTESTATION_CERT_RETRIEVAL_COMPLETEThis state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server.This state signifies that the device has successfully retrieved DHA-EncBlob from the DHA-Server.
    4
    -  - In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here is an example: ```xml @@ -291,20 +284,11 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. -  - TraceID is a freeform text node which is logged. It should identify the server side state for this enrollment attempt. This information may be used by support to look up why the server declined the enrollment. ## Related topics - - [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) - [Federated authentication device enrollment](federated-authentication-device-enrollment.md) - [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md) - [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md) - - - - - - diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index 7d719b40aa..3597ffa5fe 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -1,6 +1,6 @@ --- title: MultiSIM CSP -description: MultiSIM CSP allows the enterprise to manage devices with dual SIM single active configuration. +description: MultiSIM configuration service provider (CSP) allows the enterprise to manage devices with dual SIM single active configuration. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index c4dbd6410a..dcaef76767 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -1,6 +1,6 @@ --- title: NAP CSP -description: NAP CSP +description: Learn how the Network Access Point (NAP) configuration service provider (CSP) is used to manage and query GPRS and CDMA connections. ms.assetid: 82f04492-88a6-4afd-af10-a62b8d444d21 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 80a87e53d1..1b5f5ecdd4 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -1,6 +1,6 @@ --- title: NAPDEF CSP -description: NAPDEF CSP +description: Learn how the NAPDEF configuration service provider (CSP) is used to add, modify, or delete WAP network access points (NAPs). ms.assetid: 9bcc65dd-a72b-4f90-aba7-4066daa06988 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index c82e246263..43aff61d37 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -1,6 +1,6 @@ --- title: NetworkProxy CSP -description: NetworkProxy CSP +description: Learn how the NetworkProxy configuration service provider (CSP) is used to configure a proxy server for ethernet and Wi-Fi connections. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index ee81816701..19a52ed0be 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -25,7 +25,7 @@ The following actions are supported: - Layer 3 tagging using a differentiated services code point (DSCP) value > [!NOTE] -> The NetworkQoSPolicy configuration service provider is supported only in Microsoft Surface Hub. +> The NetworkQoSPolicy configuration service provider is officially supported for devices that are Intune managed and Azure AD joined. Currently, this CSP is not supported on Azure AD Hybrid joined devices and for devices using GPO and CSP at the same time. The minimum operating system requirement for this CSP is Windows 10, version 2004. This CSP is supported only in Microsoft Surface Hub prior to Window 10, version 2004. The following diagram shows the NetworkQoSPolicy configuration service provider in tree format. diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 7535a3ce20..c2d3ea4a5e 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,6 +1,6 @@ --- title: NetworkQoSPolicy DDF -description: View the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML +description: View the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index ad7b6964a4..15c29f831f 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -13,1638 +13,209 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 07/01/2019 +ms.date: 10/20/2020 --- # What's new in mobile device enrollment and management - -This topic provides information about what's new and breaking changes in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. +This article provides information about what's new in Windows 10 mobile device management (MDM) enrollment and management experience across all Windows 10 devices. This article also provides details about the breaking changes and known issues and frequently asked questions. For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). -- **What’s new in MDM for Windows 10 versions** - - [What’s new in MDM for Windows 10, version 1909](#whats-new-in-mdm-for-windows-10-version-1909) - - [What’s new in MDM for Windows 10, version 1903](#whats-new-in-mdm-for-windows-10-version-1903) - - [What’s new in MDM for Windows 10, version 1809](#whats-new-in-mdm-for-windows-10-version-1809) - - [What’s new in MDM for Windows 10, version 1803](#whats-new-in-mdm-for-windows-10-version-1803) - - [What’s new in MDM for Windows 10, version 1709](#whats-new-in-mdm-for-windows-10-version-1709) - - [What’s new in MDM for Windows 10, version 1703](#whats-new-in-mdm-for-windows-10-version-1703) - - [What’s new in MDM for Windows 10, version 1607](#whats-new-in-mdm-for-windows-10-version-1607) - - [What’s new in MDM for Windows 10, version 1511](#whats-new-in-mdm-for-windows-10-version-1511) +## What’s new in MDM for Windows 10, version 20H2 -- **Breaking changes and known issues** - - [Get command inside an atomic command is not supported](#get-command-inside-an-atomic-command-is-not-supported) - - [Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10](#notification-channel-uri-not-preserved-during-upgrade-from-windows-81-to-windows-10) - - [Apps installed using WMI classes are not removed](#apps-installed-using-wmi-classes-are-not-removed) - - [Passing CDATA in SyncML does not work](#passing-cdata-in-syncml-does-not-work) - - [SSL settings in IIS server for SCEP must be set to "Ignore"](#ssl-settings-in-iis-server-for-scep-must-be-set-to-ignore) - - [MDM enrollment fails on the mobile device when traffic is going through proxy](#mdm-enrollment-fails-on-the-mobile-device-when-traffic-is-going-through-proxy) - - [Server-initiated unenrollment failure](#server-initiated-unenrollment-failure) - - [Certificates causing issues with Wi-Fi and VPN](#certificates-causing-issues-with-wi-fi-and-vpn) - - [Version information for mobile devices](#version-information-for-mobile-devices) - - [Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues](#upgrading-windows-phone-81-devices-with-app-whitelisting-using-applicationrestriction-policy-has-issues) - - [Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218](#apps-dependent-on-microsoft-frameworks-may-get-blocked-in-phones-prior-to-build-10586218) - - [Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile](#multiple-certificates-might-cause-wi-fi-connection-instabilities-in-windows-10-mobile) - - [Remote PIN reset not supported in Azure Active Directory joined mobile devices](#remote-pin-reset-not-supported-in-azure-active-directory-joined-mobile-devices) - - [MDM client will immediately check-in with the MDM server after client renews WNS channel URI](#mdm-client-will-immediately-check-in-with-the-mdm-server-after-client-renews-wns-channel-uri) - - [User provisioning failure in Azure Active Directory joined Windows 10 PC](#user-provisioning-failure-in-azure-active-directory-joined-windows-10-pc) - - [Requirements to note for VPN certificates also used for Kerberos Authentication](#requirements-to-note-for-vpn-certificates-also-used-for-kerberos-authentication) - - [Device management agent for the push-button reset is not working](#device-management-agent-for-the-push-button-reset-is-not-working) +|New or updated article|Description| +|-----|-----| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:
    - [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)
    - [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)
    - [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)
    - [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)
    - [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)
    - [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)
    - [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)
    - [Multitasking/BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) | +| [SurfaceHub CSP](surfacehub-csp.md) | Added the following new node:
    -Properties/SleepMode | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Updated the description of the following node:
    - Settings/AllowWindowsDefenderApplicationGuard | -- **Frequently Asked Questions** - - [Can there be more than 1 MDM server to enroll and manage devices in Windows 10?](#can-there-be-more-than-1-mdm-server-to-enroll-and-manage-devices-in-windows-10) - - [How do I set the maximum number of Azure Active Directory joined devices per user?](#how-do-i-set-the-maximum-number-of-azure-active-directory-joined-devices-per-user) - - [What is dmwappushsvc?](#what-is-dmwappushsvc) +## What’s new in MDM for Windows 10, version 2004 -- **Change history in MDM documentation** - - [February 2020](#february-2020) - - [January 2020](#january-2020) - - [November 2019](#november-2019) - - [October 2019](#october-2019) - - [September 2019](#september-2019) - - [August 2019](#august-2019) - - [July 2019](#july-2019) - - [June 2019](#june-2019) - - [May 2019](#may-2019) - - [April 2019](#april-2019) - - [March 2019](#march-2019) - - [February 2019](#february-2019) - - [January 2019](#january-2019) - - [December 2018](#december-2018) - - [September 2018](#september-2018) - - [August 2018](#august-2018) - - [July 2018](#july-2018) - - [June 2018](#june-2018) - - [May 2018](#may-2018) - - [April 2018](#april-2018) - - [March 2018](#march-2018) - - [February 2018](#february-2018) - - [January 2018](#january-2018) - - [December 2017](#december-2017) - - [November 2017](#november-2017) - - [October 2017](#october-2017) - - [September 2017](#september-2017) - - [August 2017](#august-2017) +| New or updated article | Description | +|-----|-----| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 2004:
    - [ApplicationManagement/BlockNonAdminUserInstall](policy-csp-applicationmanagement.md#applicationmanagement-blocknonadminuserinstall)
    - [Bluetooth/SetMinimumEncryptionKeySize](policy-csp-bluetooth.md#bluetooth-setminimumencryptionkeysize)
    - [DeliveryOptimization/DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource)
    - [DeliveryOptimization/DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth)
    - [DeliveryOptimization/DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth)
    - [Education/AllowGraphingCalculator](policy-csp-education.md#education-allowgraphingcalculator)
    - [TextInput/ConfigureJapaneseIMEVersion](policy-csp-textinput.md#textinput-configurejapaneseimeversion)
    - [TextInput/ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#textinput-configuresimplifiedchineseimeversion)
    - [TextInput/ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#textinput-configuretraditionalchineseimeversion)

    Updated the following policy in Windows 10, version 2004:
    - [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost)

    Deprecated the following policies in Windows 10, version 2004:
    - [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth)
    - [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth)
    - [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) | +| [DevDetail CSP](devdetail-csp.md) | Added the following new node:
    - Ext/Microsoft/DNSComputerName | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following new node:
    - IsStub | +| [SUPL CSP](supl-csp.md) | Added the following new node:
    - FullVersion | ## What’s new in MDM for Windows 10, version 1909 - ---- - - - - - - - - - - - -
    New or updated topicDescription
    BitLocker CSP
    Added the following new nodes in Windows 10, version 1909:

    -ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID. -
    + +| New or updated article | Description | +|-----|-----| +| [BitLocker CSP](bitlocker-csp.md) | Added the following new nodes in Windows 10, version 1909:
    - ConfigureRecoveryPasswordRotation
    - RotateRecoveryPasswords
    - RotateRecoveryPasswordsStatus
    - RotateRecoveryPasswordsRequestID| ## What’s new in MDM for Windows 10, version 1903 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Policy CSP

    Added the following new policies in Windows 10, version 1903:

    -
    Policy CSP - Audit

    Added new Audit policies in Windows 10, version 1903.

    -
    ApplicationControl CSP

    Added new CSP in Windows 10, version 1903.

    -
    Defender CSP

    Added the following new nodes:
    Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.

    -
    DiagnosticLog CSP
    -DiagnosticLog DDF

    Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
    -Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults. -

    -
    EnrollmentStatusTracking CSP

    Added new CSP in Windows 10, version 1903.

    -
    PassportForWork CSP

    Added the following new nodes in Windows 10, version 1903:
    SecurityKey, SecurityKey/UseSecurityKeyForSignin

    -
    + +| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 1903:
    - [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground)
    - [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground)
    - [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring)
    - [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope)
    - [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination)
    - [DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceinstanceids)
    - [DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceinstanceids)
    - [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile)
    - [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar)
    - [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload)
    - [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview)
    - [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync)
    - [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation)
    - [InternetExplorer/DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete)
    - [InternetExplorer/NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage)
    - [Power/EnergySaverBatteryThresholdOnBattery](policy-csp-power.md#power-energysaverbatterythresholdonbattery)
    - [Power/EnergySaverBatteryThresholdPluggedIn](policy-csp-power.md#power-energysaverbatterythresholdpluggedin)
    - [Power/SelectLidCloseActionOnBattery](policy-csp-power.md#power-selectlidcloseactiononbattery)
    - [Power/SelectLidCloseActionPluggedIn](policy-csp-power.md#power-selectlidcloseactionpluggedin)
    - [Power/SelectPowerButtonActionOnBattery](policy-csp-power.md#power-selectpowerbuttonactiononbattery)
    - [Power/SelectPowerButtonActionPluggedIn](policy-csp-power.md#power-selectpowerbuttonactionpluggedin)
    - [Power/SelectSleepButtonActionOnBattery](policy-csp-power.md#power-selectsleepbuttonactiononbattery)
    - [Power/SelectSleepButtonActionPluggedIn](policy-csp-power.md#power-selectsleepbuttonactionpluggedin)
    - [Power/TurnOffHybridSleepOnBattery](policy-csp-power.md#power-turnoffhybridsleeponbattery)
    - [Power/TurnOffHybridSleepPluggedIn](policy-csp-power.md#power-turnoffhybridsleeppluggedin)
    - [Power/UnattendedSleepTimeoutOnBattery](policy-csp-power.md#power-unattendedsleeptimeoutonbattery)
    - [Power/UnattendedSleepTimeoutPluggedIn](policy-csp-power.md#power-unattendedsleeptimeoutpluggedin)
    - [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice)
    - [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock)
    - [Search/AllowFindMyFiles](policy-csp-search.md#search-allowfindmyfiles)
    - [ServiceControlManager/SvchostProcessMitigation](policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation)
    - [System/AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline)
    - [System/TurnOffFileHistory](policy-csp-system.md#system-turnofffilehistory)
    - [TimeLanguageSettings/ConfigureTimeZone](policy-csp-timelanguagesettings.md#timelanguagesettings-configuretimezone)
    - [Troubleshooting/AllowRecommendations](policy-csp-troubleshooting.md#troubleshooting-allowrecommendations)
    - [Update/AutomaticMaintenanceWakeUp](policy-csp-update.md#update-automaticmaintenancewakeup)
    - [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates)
    - [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates)
    - [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod)
    - [WindowsLogon/AllowAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon)
    - [WindowsLogon/ConfigAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon)
    - [WindowsLogon/EnableFirstLogonAnimation](policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation)| +| [Policy CSP - Audit](policy-csp-audit.md) | Added the new Audit policy CSP. | +| [ApplicationControl CSP](applicationcontrol-csp.md) | Added the new CSP. | +| [Defender CSP](defender-csp.md) | Added the following new nodes:
    - Health/TamperProtectionEnabled
    - Health/IsVirtualMachine
    - Configuration
    - Configuration/TamperProtection
    - Configuration/EnableFileHashComputation | +| [DiagnosticLog CSP](diagnosticlog-csp.md)
    [DiagnosticLog DDF](diagnosticlog-ddf.md) | Added version 1.4 of the CSP in Windows 10, version 1903.
    Added the new 1.4 version of the DDF.
    Added the following new nodes:
    - Policy
    - Policy/Channels
    - Policy/Channels/ChannelName
    - Policy/Channels/ChannelName/MaximumFileSize
    - Policy/Channels/ChannelName/SDDL
    - Policy/Channels/ChannelName/ActionWhenFull
    - Policy/Channels/ChannelName/Enabled
    - DiagnosticArchive
    - DiagnosticArchive/ArchiveDefinition
    - DiagnosticArchive/ArchiveResults | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | Added the new CSP. | +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new nodes:
    - SecurityKey
    - SecurityKey/UseSecurityKeyForSignin | + ## What’s new in MDM for Windows 10, version 1809 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Policy CSP

    Added the following new policies in Windows 10, version 1809:

    -
      -
    • ApplicationManagement/LaunchAppAfterLogOn
    • -
    • ApplicationManagement/ScheduleForceRestartForUpdateFailures
    • -
    • Authentication/EnableFastFirstSignIn (Preview mode only)
    • -
    • Authentication/EnableWebSignIn (Preview mode only)
    • -
    • Authentication/PreferredAadTenantDomainName
    • -
    • Browser/AllowFullScreenMode
    • -
    • Browser/AllowPrelaunch
    • -
    • Browser/AllowPrinting
    • -
    • Browser/AllowSavingHistory
    • -
    • Browser/AllowSideloadingOfExtensions
    • -
    • Browser/AllowTabPreloading
    • -
    • Browser/AllowWebContentOnNewTabPage
    • -
    • Browser/ConfigureFavoritesBar
    • -
    • Browser/ConfigureHomeButton
    • -
    • Browser/ConfigureKioskMode
    • -
    • Browser/ConfigureKioskResetAfterIdleTimeout
    • -
    • Browser/ConfigureOpenMicrosoftEdgeWith
    • -
    • Browser/ConfigureTelemetryForMicrosoft365Analytics
    • -
    • Browser/PreventCertErrorOverrides
    • -
    • Browser/SetHomeButtonURL
    • -
    • Browser/SetNewTabPageURL
    • -
    • Browser/UnlockHomeButton
    • -
    • Defender/CheckForSignaturesBeforeRunningScan
    • -
    • Defender/DisableCatchupFullScan
    • -
    • Defender/DisableCatchupQuickScan
    • -
    • Defender/EnableLowCPUPriority
    • -
    • Defender/SignatureUpdateFallbackOrder
    • -
    • Defender/SignatureUpdateFileSharesSources
    • -
    • DeviceGuard/ConfigureSystemGuardLaunch
    • -
    • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    • -
    • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    • -
    • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • -
    • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    • -
    • DmaGuard/DeviceEnumerationPolicy
    • -
    • Experience/AllowClipboardHistory
    • -
    • Experience/DoNotSyncBrowserSettings
    • -
    • Experience/PreventUsersFromTurningOnBrowserSyncing
    • -
    • Kerberos/UPNNameHints
    • -
    • Privacy/AllowCrossDeviceClipboard
    • -
    • Privacy/DisablePrivacyExperience
    • -
    • Privacy/UploadUserActivities
    • -
    • Security/RecoveryEnvironmentAuthentication
    • -
    • System/AllowDeviceNameInDiagnosticData
    • -
    • System/ConfigureMicrosoft365UploadEndpoint
    • -
    • System/DisableDeviceDelete
    • -
    • System/DisableDiagnosticDataViewer
    • -
    • Storage/RemovableDiskDenyWriteAccess
    • -
    • TaskManager/AllowEndTask
    • -
    • Update/EngagedRestartDeadlineForFeatureUpdates
    • -
    • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
    • -
    • Update/EngagedRestartTransitionScheduleForFeatureUpdates
    • -
    • Update/SetDisablePauseUXAccess
    • -
    • Update/SetDisableUXWUAccess
    • -
    • WindowsDefenderSecurityCenter/DisableClearTpmButton
    • -
    • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
    • -
    • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
    • -
    • WindowsLogon/DontDisplayNetworkSelectionUI
    • -
    -
    PassportForWork CSP

    Added new settings in Windows 10, version 1809.

    -
    EnterpriseModernAppManagement CSP

    Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

    -
    Win32CompatibilityAppraiser CSP

    Added new configuration service provider in Windows 10, version 1809.

    -
    WindowsLicensing CSP

    Added S mode settings and SyncML examples in Windows 10, version 1809.

    -
    SUPL CSP

    Added 3 new certificate nodes in Windows 10, version 1809.

    -
    Defender CSP

    Added a new node Health/ProductStatus in Windows 10, version 1809.

    -
    BitLocker CSP

    Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro.

    -
    DevDetail CSP

    Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

    -
    Wifi CSP

    Added a new node WifiCost in Windows 10, version 1809.

    -
    WindowsDefenderApplicationGuard CSP

    Added new settings in Windows 10, version 1809.

    -
    RemoteWipe CSP

    Added new settings in Windows 10, version 1809.

    -
    TenantLockdown CSP

    Added new CSP in Windows 10, version 1809.

    -
    Office CSP

    Added FinalStatus setting in Windows 10, version 1809.

    -
    +| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings in Windows 10, version 1809:
    - ApplicationManagement/LaunchAppAfterLogOn
    - ApplicationManagement/ScheduleForceRestartForUpdateFailures
    - Authentication/EnableFastFirstSignIn (Preview mode only)
    - Authentication/EnableWebSignIn (Preview mode only)
    - Authentication/PreferredAadTenantDomainName
    - Browser/AllowFullScreenMode
    - Browser/AllowPrelaunch
    - Browser/AllowPrinting
    - Browser/AllowSavingHistory
    - Browser/AllowSideloadingOfExtensions
    - Browser/AllowTabPreloading
    - Browser/AllowWebContentOnNewTabPage
    - Browser/ConfigureFavoritesBar
    - Browser/ConfigureHomeButton
    - Browser/ConfigureKioskMode
    - Browser/ConfigureKioskResetAfterIdleTimeout
    - Browser/ConfigureOpenMicrosoftEdgeWith
    - Browser/ConfigureTelemetryForMicrosoft365Analytics
    - Browser/PreventCertErrorOverrides
    - Browser/SetHomeButtonURL
    - Browser/SetNewTabPageURL
    - Browser/UnlockHomeButton
    - Defender/CheckForSignaturesBeforeRunningScan
    - Defender/DisableCatchupFullScan
    - Defender/DisableCatchupQuickScan
    - Defender/EnableLowCPUPriority
    - Defender/SignatureUpdateFallbackOrder
    - Defender/SignatureUpdateFileSharesSources
    - DeviceGuard/ConfigureSystemGuardLaunch
    - DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    - DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    - DeviceInstallation/PreventDeviceMetadataFromNetwork
    - DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    - DmaGuard/DeviceEnumerationPolicy
    - Experience/AllowClipboardHistory
    - Experience/DoNotSyncBrowserSettings
    - Experience/PreventUsersFromTurningOnBrowserSyncing
    - Kerberos/UPNNameHints
    - Privacy/AllowCrossDeviceClipboard
    - Privacy/DisablePrivacyExperience
    - Privacy/UploadUserActivities
    - Security/RecoveryEnvironmentAuthentication
    - System/AllowDeviceNameInDiagnosticData
    - System/ConfigureMicrosoft365UploadEndpoint
    - System/DisableDeviceDelete
    - System/DisableDiagnosticDataViewer
    - Storage/RemovableDiskDenyWriteAccess
    - TaskManager/AllowEndTask
    - Update/DisableWUfBSafeguards
    - Update/EngagedRestartDeadlineForFeatureUpdates
    - Update/EngagedRestartSnoozeScheduleForFeatureUpdates
    - Update/EngagedRestartTransitionScheduleForFeatureUpdates
    - Update/SetDisablePauseUXAccess
    - Update/SetDisableUXWUAccess
    - WindowsDefenderSecurityCenter/DisableClearTpmButton
    - WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
    - WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
    - WindowsLogon/DontDisplayNetworkSelectionUI | +| [BitLocker CSP](bitlocker-csp.md) | Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro. | +| [Defender CSP](defender-csp.md) | Added a new node Health/ProductStatus in Windows 10, version 1809. | +| [DevDetail CSP](devdetail-csp.md) | Added a new node SMBIOSSerialNumber in Windows 10, version 1809. | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added NonRemovable setting under AppManagement node in Windows 10, version 1809. | +| [Office CSP](office-csp.md) | Added FinalStatus setting in Windows 10, version 1809. | +| [PassportForWork CSP](passportforwork-csp.md) | Added new settings in Windows 10, version 1809. | +| [RemoteWipe CSP](remotewipe-csp.md) | Added new settings in Windows 10, version 1809. | +| [SUPL CSP](supl-csp.md) | Added 3 new certificate nodes in Windows 10, version 1809. | +| [TenantLockdown CSP](tenantlockdown-csp.md) | Added new CSP in Windows 10, version 1809. | +| [Wifi CSP](wifi-csp.md) | Added a new node WifiCost in Windows 10, version 1809. | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Added new settings in Windows 10, version 1809. | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added S mode settings and SyncML examples in Windows 10, version 1809. | +| [Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md) | Added new configuration service provider in Windows 10, version 1809. | + ## What’s new in MDM for Windows 10, version 1803 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • ApplicationDefaults/EnableAppUriHandlers
    • -
    • ApplicationManagement/MSIAllowUserControlOverInstall
    • -
    • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    • -
    • Bluetooth/AllowPromptedProximalConnections
    • -
    • Browser/AllowConfigurationUpdateForBooksLibrary
    • -
    • Browser/AlwaysEnableBooksLibrary
    • -
    • Browser/EnableExtendedBooksTelemetry
    • -
    • Browser/UseSharedFolderForBooks
    • -
    • Connectivity/AllowPhonePCLinking
    • -
    • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    • -
    • DeliveryOptimization/DODelayForegroundDownloadFromHttp
    • -
    • DeliveryOptimization/DOGroupIdSource
    • -
    • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
    • -
    • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
    • -
    • DeliveryOptimization/DORestrictPeerSelectionBy
    • -
    • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
    • -
    • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
    • -
    • Display/DisablePerProcessDpiForApps
    • -
    • Display/EnablePerProcessDpi
    • -
    • Display/EnablePerProcessDpiForApps
    • -
    • Experience/AllowWindowsSpotlightOnSettings
    • -
    • KioskBrowser/BlockedUrlExceptions
    • -
    • KioskBrowser/BlockedUrls
    • -
    • KioskBrowser/DefaultURL
    • -
    • KioskBrowser/EnableEndSessionButton
    • -
    • KioskBrowser/EnableHomeButton
    • -
    • KioskBrowser/EnableNavigationButtons
    • -
    • KioskBrowser/RestartOnIdleTime
    • -
    • LanmanWorkstation/EnableInsecureGuestLogons
    • -
    • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
    • -
    • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • -
    • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • -
    • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
    • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
    • -
    • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
    • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    • -
    • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • -
    • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
    • -
    • Notifications/DisallowCloudNotification
    • -
    • RestrictedGroups/ConfigureGroupMembership
    • -
    • Search/AllowCortanaInAAD
    • -
    • Search/DoNotUseWebResults
    • -
    • Security/ConfigureWindowsPasswords
    • -
    • Start/DisableContextMenus
    • -
    • System/FeedbackHubAlwaysSaveDiagnosticsLocally
    • -
    • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
    • -
    • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    • -
    • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
    • -
    • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
    • -
    • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
    • -
    • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
    • -
    • TaskScheduler/EnableXboxGameSaveTask
    • -
    • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    • -
    • TextInput/ForceTouchKeyboardDockedState
    • -
    • TextInput/TouchKeyboardDictationButtonAvailability
    • -
    • TextInput/TouchKeyboardEmojiButtonAvailability
    • -
    • TextInput/TouchKeyboardFullModeAvailability
    • -
    • TextInput/TouchKeyboardHandwritingModeAvailability
    • -
    • TextInput/TouchKeyboardNarrowModeAvailability
    • -
    • TextInput/TouchKeyboardSplitModeAvailability
    • -
    • TextInput/TouchKeyboardWideModeAvailability
    • -
    • Update/ConfigureFeatureUpdateUninstallPeriod
    • -
    • UserRights/AccessCredentialManagerAsTrustedCaller
    • -
    • UserRights/AccessFromNetwork
    • -
    • UserRights/ActAsPartOfTheOperatingSystem
    • -
    • UserRights/AllowLocalLogOn
    • -
    • UserRights/BackupFilesAndDirectories
    • -
    • UserRights/ChangeSystemTime
    • -
    • UserRights/CreateGlobalObjects
    • -
    • UserRights/CreatePageFile
    • -
    • UserRights/CreatePermanentSharedObjects
    • -
    • UserRights/CreateSymbolicLinks
    • -
    • UserRights/CreateToken
    • -
    • UserRights/DebugPrograms
    • -
    • UserRights/DenyAccessFromNetwork
    • -
    • UserRights/DenyLocalLogOn
    • -
    • UserRights/DenyRemoteDesktopServicesLogOn
    • -
    • UserRights/EnableDelegation
    • -
    • UserRights/GenerateSecurityAudits
    • -
    • UserRights/ImpersonateClient
    • -
    • UserRights/IncreaseSchedulingPriority
    • -
    • UserRights/LoadUnloadDeviceDrivers
    • -
    • UserRights/LockMemory
    • -
    • UserRights/ManageAuditingAndSecurityLog
    • -
    • UserRights/ManageVolume
    • -
    • UserRights/ModifyFirmwareEnvironment
    • -
    • UserRights/ModifyObjectLabel
    • -
    • UserRights/ProfileSingleProcess
    • -
    • UserRights/RemoteShutdown
    • -
    • UserRights/RestoreFilesAndDirectories
    • -
    • UserRights/TakeOwnership
    • -
    • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
    • -
    • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
    • -
    • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
    • -
    • WindowsDefenderSecurityCenter/HideSecureBoot
    • -
    • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    • -
    -

    Security/RequireDeviceEncryption - updated to show it is supported in desktop.

    -
    BitLocker CSP

    Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

    -
    DMClient CSP

    Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

    -
      -
    • AADSendDeviceToken
    • -
    • BlockInStatusPage
    • -
    • AllowCollectLogsButton
    • -
    • CustomErrorText
    • -
    • SkipDeviceStatusPage
    • -
    • SkipUserStatusPage
    • -
    -
    Defender CSP

    Added new node (OfflineScan) in Windows 10, version 1803.

    -
    UEFI CSP

    Added a new CSP in Windows 10, version 1803.

    -
    Update CSP

    Added the following nodes in Windows 10, version 1803:

    -
      -
    • Rollback
    • -
    • Rollback/FeatureUpdate
    • -
    • Rollback/QualityUpdateStatus
    • -
    • Rollback/FeatureUpdateStatus
    • -
    -
    AssignedAccess CSP

    Added the following nodes in Windows 10, version 1803:

    -
      -
    • Status
    • -
    • ShellLauncher
    • -
    • StatusConfiguration
    • -
    -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    -
    MultiSIM CSP

    Added a new CSP in Windows 10, version 1803.

    -
    EnterpriseModernAppManagement CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • MaintainProcessorArchitectureOnUpdate
    • -
    -
    eUICCs CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • IsEnabled
    • -
    -
    DeviceStatus CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • OS/Mode
    • -
    -
    AccountManagement CSP

    Added a new CSP in Windows 10, version 1803.

    -
    RootCATrustedCertificates CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • UntrustedCertificates
    • -
    -
    NetworkProxy CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • ProxySettingsPerUser
    • -
    -
    Accounts CSP

    Added a new CSP in Windows 10, version 1803.

    -
    MDM Migration Analysis Too (MMAT)

    Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

    -
    CSP DDF files download

    Added the DDF download of Windows 10, version 1803 configuration service providers.

    -
    +| New or updated article | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policies for Windows 10, version 1803:
    - ApplicationDefaults/EnableAppUriHandlers
    - ApplicationManagement/MSIAllowUserControlOverInstall
    - ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    - Bluetooth/AllowPromptedProximalConnections
    - Browser/AllowConfigurationUpdateForBooksLibrary
    - Browser/AlwaysEnableBooksLibrary
    - Browser/EnableExtendedBooksTelemetry
    - Browser/UseSharedFolderForBooks
    - Connectivity/AllowPhonePCLinking
    - DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    - DeliveryOptimization/DODelayForegroundDownloadFromHttp
    - DeliveryOptimization/DOGroupIdSource
    - DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
    - DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
    - DeliveryOptimization/DORestrictPeerSelectionBy
    - DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
    - DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
    - Display/DisablePerProcessDpiForApps
    - Display/EnablePerProcessDpi
    - Display/EnablePerProcessDpiForApps
    - Experience/AllowWindowsSpotlightOnSettings
    - KioskBrowser/BlockedUrlExceptions
    - KioskBrowser/BlockedUrls
    - KioskBrowser/DefaultURL
    - KioskBrowser/EnableEndSessionButton
    - KioskBrowser/EnableHomeButton
    - KioskBrowser/EnableNavigationButtons
    - KioskBrowser/RestartOnIdleTime
    - LanmanWorkstation/EnableInsecureGuestLogons
    - LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
    - LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    - LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    - LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    - LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    - LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
    - LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
    - LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
    - LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
    - LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    - LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    - LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    - LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    - LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    - LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
    - LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
    - LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
    - LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    - LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    - LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
    - LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
    - Notifications/DisallowCloudNotification
    - RestrictedGroups/ConfigureGroupMembership
    - Search/AllowCortanaInAAD
    - Search/DoNotUseWebResults
    - Security/ConfigureWindowsPasswords
    - Start/DisableContextMenus
    - System/FeedbackHubAlwaysSaveDiagnosticsLocally
    - SystemServices/ConfigureHomeGroupListenerServiceStartupMode
    - SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    - SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
    - SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
    - SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
    - SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
    - TaskScheduler/EnableXboxGameSaveTask
    - TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    - TextInput/ForceTouchKeyboardDockedState
    - TextInput/TouchKeyboardDictationButtonAvailability
    - TextInput/TouchKeyboardEmojiButtonAvailability
    - TextInput/TouchKeyboardFullModeAvailability
    - TextInput/TouchKeyboardHandwritingModeAvailability
    - TextInput/TouchKeyboardNarrowModeAvailability
    - TextInput/TouchKeyboardSplitModeAvailability
    - TextInput/TouchKeyboardWideModeAvailability
    - Update/ConfigureFeatureUpdateUninstallPeriod
    - Update/TargetReleaseVersion
    - UserRights/AccessCredentialManagerAsTrustedCaller
    - UserRights/AccessFromNetwork
    - UserRights/ActAsPartOfTheOperatingSystem
    - UserRights/AllowLocalLogOn
    - UserRights/BackupFilesAndDirectories
    - UserRights/ChangeSystemTime
    - UserRights/CreateGlobalObjects
    - UserRights/CreatePageFile
    - UserRights/CreatePermanentSharedObjects
    - UserRights/CreateSymbolicLinks
    - UserRights/CreateToken
    - UserRights/DebugPrograms
    - UserRights/DenyAccessFromNetwork
    - UserRights/DenyLocalLogOn
    - UserRights/DenyRemoteDesktopServicesLogOn
    - UserRights/EnableDelegation
    - UserRights/GenerateSecurityAudits
    - UserRights/ImpersonateClient
    - UserRights/IncreaseSchedulingPriority
    - UserRights/LoadUnloadDeviceDrivers
    - UserRights/LockMemory
    - UserRights/ManageAuditingAndSecurityLog
    - UserRights/ManageVolume
    - UserRights/ModifyFirmwareEnvironment
    - UserRights/ModifyObjectLabel
    - UserRights/ProfileSingleProcess
    - UserRights/RemoteShutdown
    - UserRights/RestoreFilesAndDirectories
    - UserRights/TakeOwnership
    - WindowsDefenderSecurityCenter/DisableAccountProtectionUI
    - WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
    - WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
    - WindowsDefenderSecurityCenter/HideSecureBoot
    - WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    - Security/RequireDeviceEncryption - updated to show it is supported in desktop. | +| [Accounts CSP](accounts-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [AccountManagement CSP](accountmanagement-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added the following nodes in Windows 10, version 1803:
    - Status
    - ShellLauncher
    - StatusConfiguration

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite. | +| [BitLocker CSP](bitlocker-csp.md) | Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803. | +| [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) | Added the DDF download of Windows 10, version 1803 configuration service providers. | +| [Defender CSP](defender-csp.md) | Added new node (OfflineScan) in Windows 10, version 1803. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following node in Windows 10, version 1803:
    - OS/Mode | +| [DMClient CSP](dmclient-csp.md) | Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:
    - AADSendDeviceToken
    - BlockInStatusPage
    - AllowCollectLogsButton
    - CustomErrorText
    - SkipDeviceStatusPage
    - SkipUserStatusPage | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following node in Windows 10, version 1803:
    - MaintainProcessorArchitectureOnUpdate | +| [eUICCs CSP](euiccs-csp.md) | Added the following node in Windows 10, version 1803:
    - IsEnabled | +| [MDM Migration Analysis Too (MMAT)](https://aka.ms/mmat) | MDM Migration Analysis Too (MMAT)
    Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies. | +| [MultiSIM CSP](multisim-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [NetworkProxy CSP](networkproxy-csp.md) | Added the following node in Windows 10, version 1803:
    - ProxySettingsPerUser | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | Added the following node in Windows 10, version 1803:
    - UntrustedCertificates | +| [UEFI CSP](uefi-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [Update CSP](update-csp.md) | Added the following nodes in Windows 10, version 1803:
    - Rollback
    - Rollback/FeatureUpdate
    - Rollback/QualityUpdateStatus
    - Rollback/FeatureUpdateStatus | ## What’s new in MDM for Windows 10, version 1709 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ItemDescription
    The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

    The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

    -
      -
    • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
    • -
    • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
    • -
    • DomainName - fully qualified domain name if the device is domain-joined.
    • -
    -

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

    -
    Firewall CSP

    Added new CSP in Windows 10, version 1709.

    -
    eUICCs CSP

    Added new CSP in Windows 10, version 1709.

    -
    WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
    CM_ProxyEntries CSP and CMPolicy CSPIn Windows 10, version 1709, support for desktop SKUs were added to these CSPs. The table of SKU information in the Configuration service provider reference was updated.
    WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
    VPNv2 CSP

    Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709.

    -
    DeviceStatus CSP

    Added the following settings in Windows 10, version 1709:

    -
      -
    • DeviceStatus/DomainName
    • -
    • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
    • -
    • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
    • -
    • DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus
    • -
    -
    AssignedAccess CSP

    Added the following setting in Windows 10, version 1709.

    -
      -
    • Configuration
    • -
    -

    Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro.

    -
    DeviceManageability CSP

    Added the following settings in Windows 10, version 1709:

    -
      -
    • Provider/ProviderID/ConfigInfo
    • -
    • Provider/ProviderID/EnrollmentInfo
    • -
    -
    Office CSP

    Added the following setting in Windows 10, version 1709:

    -
      -
    • Installation/CurrentStatus
    • -
    -
    DMClient CSP

    Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

    -
    Bitlocker CSP

    Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.

    -
    ADMX-backed policies in Policy CSP

    Added new policies.

    -
    Microsoft Store for Business and Microsoft Store

    Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

    -
    MDM enrollment of Windows-based devices

    New features in the Settings app:

    -
      -
    • User sees installation progress of critical policies during MDM enrollment.
    • -
    • User knows what policies, profiles, apps MDM has configured
    • -
    • IT helpdesk can get detailed MDM diagnostic information using client tools
    • -
    -

    For details, see Managing connection and Collecting diagnostic logs

    -
    Enroll a Windows 10 device automatically using Group Policy

    Added new topic to introduce a new Group Policy for automatic MDM enrollment.

    -
    Policy CSP

    Added the following new policies for Windows 10, version 1709:

    -
      -
    • Authentication/AllowAadPasswordReset
    • -
    • Authentication/AllowFidoDeviceSignon
    • -
    • Browser/LockdownFavorites
    • -
    • Browser/ProvisionFavorites
    • -
    • Cellular/LetAppsAccessCellularData
    • -
    • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    • -
    • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    • -
    • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
    • -
    • CredentialProviders/DisableAutomaticReDeploymentCredentials
    • -
    • DeviceGuard/EnableVirtualizationBasedSecurity
    • -
    • DeviceGuard/RequirePlatformSecurityFeatures
    • -
    • DeviceGuard/LsaCfgFlags
    • -
    • DeviceLock/MinimumPasswordAge
    • -
    • ExploitGuard/ExploitProtectionSettings
    • -
    • Games/AllowAdvancedGamingServices
    • -
    • Handwriting/PanelDefaultModeDocked
    • -
    • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    • -
    • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
    • -
    • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
    • -
    • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
    • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
    • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    • -
    • LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
    • -
    • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
    • -
    • Power/DisplayOffTimeoutOnBattery
    • -
    • Power/DisplayOffTimeoutPluggedIn
    • -
    • Power/HibernateTimeoutOnBattery
    • -
    • Power/HibernateTimeoutPluggedIn
    • -
    • Power/StandbyTimeoutOnBattery
    • -
    • Power/StandbyTimeoutPluggedIn
    • -
    • Privacy/EnableActivityFeed
    • -
    • Privacy/PublishUserActivities
    • -
    • Defender/AttackSurfaceReductionOnlyExclusions
    • -
    • Defender/AttackSurfaceReductionRules
    • -
    • Defender/CloudBlockLevel
    • -
    • Defender/CloudExtendedTimeout
    • -
    • Defender/ControlledFolderAccessAllowedApplications
    • -
    • Defender/ControlledFolderAccessProtectedFolders
    • -
    • Defender/EnableControlledFolderAccess
    • -
    • Defender/EnableNetworkProtection
    • -
    • Education/DefaultPrinterName
    • -
    • Education/PreventAddingNewPrinters
    • -
    • Education/PrinterNames
    • -
    • Search/AllowCloudSearch
    • -
    • Security/ClearTPMIfNotReady
    • -
    • Settings/AllowOnlineTips
    • -
    • Start/HidePeopleBar
    • -
    • Storage/AllowDiskHealthModelUpdates
    • -
    • System/DisableEnterpriseAuthProxy
    • -
    • System/LimitEnhancedDiagnosticDataWindowsAnalytics
    • -
    • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    • -
    • Update/DisableDualScan
    • -
    • Update/ManagePreviewBuilds
    • -
    • Update/ScheduledInstallEveryWeek
    • -
    • Update/ScheduledInstallFirstWeek
    • -
    • Update/ScheduledInstallFourthWeek
    • -
    • Update/ScheduledInstallSecondWeek
    • -
    • Update/ScheduledInstallThirdWeek
    • -
    • WindowsDefenderSecurityCenter/CompanyName
    • -
    • WindowsDefenderSecurityCenter/DisableAppBrowserUI
    • -
    • WindowsDefenderSecurityCenter/DisableEnhancedNotifications
    • -
    • WindowsDefenderSecurityCenter/DisableFamilyUI
    • -
    • WindowsDefenderSecurityCenter/DisableHealthUI
    • -
    • WindowsDefenderSecurityCenter/DisableNetworkUI
    • -
    • WindowsDefenderSecurityCenter/DisableNotifications
    • -
    • WindowsDefenderSecurityCenter/DisableVirusUI
    • -
    • WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
    • -
    • WindowsDefenderSecurityCenter/Email
    • -
    • WindowsDefenderSecurityCenter/EnableCustomizedToasts
    • -
    • WindowsDefenderSecurityCenter/EnableInAppCustomization
    • -
    • WindowsDefenderSecurityCenter/Phone
    • -
    • WindowsDefenderSecurityCenter/URL
    • -
    • WirelessDisplay/AllowMdnsAdvertisement
    • -
    • WirelessDisplay/AllowMdnsDiscovery
    • -
    -
    +| New or updated article | Description | +|-----|-----| +| The [The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2](https://docs.microsoft.com/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692?redirectedfrom=MSDN) | The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:
    - UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
    -ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
    - DomainName - fully qualified domain name if the device is domain-joined. | +| [Firewall CSP](firewall-csp.md) | Added new CSP in Windows 10, version 1709. | +| [eUICCs CSP](euiccs-csp.md) | Added new CSP in Windows 10, version 1709. | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)
    [WindowsDefenderApplicationGuard DDF file](windowsdefenderapplicationguard-ddf-file.md) | New CSP added in Windows 10, version 1709. Also added the DDF topic. | +| [CM_ProxyEntries CSP](cm-proxyentries-csp.md) and [CMPolicy CSP](cmpolicy-csp.md) | In Windows 10, version 1709, support for desktop SKUs were added to these CSPs. | +| [VPNv2 CSP](vpnv2-csp.md) | Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following settings in Windows 10, version 1709:
    - DeviceStatus/DomainName
    - DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
    - DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
    - DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added the following setting in Windows 10, version 1709:
    - Configuration
    Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro. | +| [DeviceManageability CSP](devicemanageability-csp.md) | Added the following settings in Windows 10, version 1709:
    - Provider/_ProviderID_/ConfigInfo
    - Provider/_ProviderID_/EnrollmentInfo | +| [Office CSP](office-csp.md) | Added the following setting in Windows 10, version 1709:
    - Installation/CurrentStatus | +| [DMClient CSP](dmclient-csp.md) | Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF articles. | +| [Bitlocker CSP](bitlocker-csp.md) | Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. | +| [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) | Added new policies. | +| Microsoft Store for Business and Microsoft Store | Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store. | +| [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) | New features in the Settings app:
    - User sees installation progress of critical policies during MDM enrollment.
    - User knows what policies, profiles, apps MDM has configured
    - IT helpdesk can get detailed MDM diagnostic information using client tools
    For details, see [Managing connection](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#manage-connections) and [Collecting diagnostic logs](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#collecting-diagnostic-logs).| +| [Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md) | Added new topic to introduce a new Group Policy for automatic MDM enrollment. | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies for Windows 10, version 1709:
    - Authentication/AllowAadPasswordReset
    - Authentication/AllowFidoDeviceSignon
    - Browser/LockdownFavorites
    - Browser/ProvisionFavorites
    - Cellular/LetAppsAccessCellularData
    - Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    - Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    - Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
    - CredentialProviders/DisableAutomaticReDeploymentCredentials
    - DeviceGuard/EnableVirtualizationBasedSecurity
    - DeviceGuard/RequirePlatformSecurityFeatures
    - DeviceGuard/LsaCfgFlags
    - DeviceLock/MinimumPasswordAge
    - ExploitGuard/ExploitProtectionSettings
    - Games/AllowAdvancedGamingServices
    - Handwriting/PanelDefaultModeDocked
    - LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    - LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
    - LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
    - LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
    - LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    - LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
    - LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
    - LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
    - LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
    - LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
    - LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
    - LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
    - LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    - LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    - LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    - LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
    - LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
    - LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
    - LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
    - LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    - LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    - LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
    - Power/DisplayOffTimeoutOnBattery
    - Power/DisplayOffTimeoutPluggedIn
    - Power/HibernateTimeoutOnBattery
    - Power/HibernateTimeoutPluggedIn
    - Power/StandbyTimeoutOnBattery
    - Power/StandbyTimeoutPluggedIn
    - Privacy/EnableActivityFeed
    - Privacy/PublishUserActivities
    - Defender/AttackSurfaceReductionOnlyExclusions
    - Defender/AttackSurfaceReductionRules
    - Defender/CloudBlockLevel
    - Defender/CloudExtendedTimeout
    - Defender/ControlledFolderAccessAllowedApplications
    - Defender/ControlledFolderAccessProtectedFolders
    - Defender/EnableControlledFolderAccess
    - Defender/EnableNetworkProtection
    - Education/DefaultPrinterName
    - Education/PreventAddingNewPrinters
    - Education/PrinterNames
    - Search/AllowCloudSearch
    - Security/ClearTPMIfNotReady
    - Settings/AllowOnlineTips
    - Start/HidePeopleBar
    - Storage/AllowDiskHealthModelUpdates
    - System/DisableEnterpriseAuthProxy
    - System/LimitEnhancedDiagnosticDataWindowsAnalytics
    - Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    - Update/DisableDualScan
    - Update/ManagePreviewBuilds
    - Update/ScheduledInstallEveryWeek
    - Update/ScheduledInstallFirstWeek
    - Update/ScheduledInstallFourthWeek
    - Update/ScheduledInstallSecondWeek
    - Update/ScheduledInstallThirdWeek
    - WindowsDefenderSecurityCenter/CompanyName
    - WindowsDefenderSecurityCenter/DisableAppBrowserUI
    - WindowsDefenderSecurityCenter/DisableEnhancedNotifications
    - WindowsDefenderSecurityCenter/DisableFamilyUI
    - WindowsDefenderSecurityCenter/DisableHealthUI
    - WindowsDefenderSecurityCenter/DisableNetworkUI
    - WindowsDefenderSecurityCenter/DisableNotifications
    - WindowsDefenderSecurityCenter/DisableVirusUI
    - WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
    - WindowsDefenderSecurityCenter/Email
    - WindowsDefenderSecurityCenter/EnableCustomizedToasts
    - WindowsDefenderSecurityCenter/EnableInAppCustomization
    - WindowsDefenderSecurityCenter/Phone
    - WindowsDefenderSecurityCenter/URL
    - WirelessDisplay/AllowMdnsAdvertisement
    - WirelessDisplay/AllowMdnsDiscovery | + ## What’s new in MDM for Windows 10, version 1703 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ItemDescription

    Update CSP

    Added the following nodes:

    -
      -
    • FailedUpdates/Failed Update Guid/RevisionNumber
    • -
    • InstalledUpdates/Installed Update Guid/RevisionNumber
    • -
    • PendingRebootUpdates/Pending Reboot Update Guid/RevisionNumber
    • -
    -
    CM_CellularEntries CSP

    To PurposeGroups setting, added the following values:

    -
      -
    • Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
    • -
    • Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364
    • -
    -

    CertificateStore CSP

    Added the following setting:

    -
      -
    • My/WSTEP/Renew/RetryAfterExpiryInterval
    • -
    -

    ClientCertificateInstall CSP

    Added the following setting:

    -
      -
    • SCEP/UniqueID/Install/AADKeyIdentifierList
    • -
    -

    DMAcc CSP

    Added the following setting:

    -
      -
    • AccountUID/EXT/Microsoft/InitiateSession
    • -
    -

    DMClient CSP

    Added the following nodes and settings:

    -
      -
    • HWDevID
    • -
    • Provider/ProviderID/ManagementServerToUpgradeTo
    • -
    • Provider/ProviderID/CustomEnrollmentCompletePage
    • -
    • Provider/ProviderID/CustomEnrollmentCompletePage/Title
    • -
    • Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
    • -
    • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
    • -
    • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText
    • -
    -

    CellularSettings CSP

    CM_CellularEntries CSP

    EnterpriseAPN CSP

    For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.

    -
    SecureAssessment CSP

    Added the following settings:

    -
      -
    • AllowTextSuggestions
    • -
    • RequirePrinting
    • -
    -
    EnterpriseAPN CSP

    Added the following setting:

    -
      -
    • Roaming
    • -
    -
    Messaging CSP

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.

    -
    Policy CSP

    Added the following new policies:

    -
      -
    • Accounts/AllowMicrosoftAccountSignInAssistant
    • -
    • ApplicationDefaults/DefaultAssociationsConfiguration
    • -
    • Browser/AllowAddressBarDropdown
    • -
    • Browser/AllowFlashClickToRun
    • -
    • Browser/AllowMicrosoftCompatibilityList
    • -
    • Browser/AllowSearchEngineCustomization
    • -
    • Browser/ClearBrowsingDataOnExit
    • -
    • Browser/ConfigureAdditionalSearchEngines
    • -
    • Browser/DisableLockdownOfStartPages
    • -
    • Browser/PreventFirstRunPage
    • -
    • Browser/PreventLiveTileDataCollection
    • -
    • Browser/SetDefaultSearchEngine
    • -
    • Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
    • -
    • Connectivity/AllowConnectedDevices
    • -
    • DeliveryOptimization/DOAllowVPNPeerCaching
    • -
    • DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
    • -
    • DeliveryOptimization/DOMinDiskSizeAllowedToPeer
    • -
    • DeliveryOptimization/DOMinFileSizeToCache
    • -
    • DeliveryOptimization/DOMinRAMAllowedToPeer
    • -
    • DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
    • -
    • Display/TurnOffGdiDPIScalingForApps
    • -
    • Display/TurnOnGdiDPIScalingForApps
    • -
    • EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
    • -
    • EnterpriseCloudPrint/CloudPrintOAuthAuthority
    • -
    • EnterpriseCloudPrint/CloudPrintOAuthClientId
    • -
    • EnterpriseCloudPrint/CloudPrintResourceId
    • -
    • EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
    • -
    • EnterpriseCloudPrint/MopriaDiscoveryResourceId
    • -
    • Experience/AllowFindMyDevice
    • -
    • Experience/AllowTailoredExperiencesWithDiagnosticData
    • -
    • Experience/AllowWindowsSpotlightOnActionCenter
    • -
    • Experience/AllowWindowsSpotlightWindowsWelcomeExperience
    • -
    • Location/EnableLocation
    • -
    • Messaging/AllowMMS
    • -
    • Messaging/AllowRCS
    • -
    • Privacy/LetAppsAccessTasks
    • -
    • Privacy/LetAppsAccessTasks_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessTasks_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsGetDiagnosticInfo
    • -
    • Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
    • -
    • Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
    • -
    • Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsRunInBackground
    • -
    • Privacy/LetAppsRunInBackground_ForceAllowTheseApps
    • -
    • Privacy/LetAppsRunInBackground_ForceDenyTheseApps
    • -
    • Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
    • -
    • Settings/ConfigureTaskbarCalendar
    • -
    • Settings/PageVisibilityList
    • -
    • SmartScreen/EnableAppInstallControl
    • -
    • SmartScreen/EnableSmartScreenInShell
    • -
    • SmartScreen/PreventOverrideForFilesInShell
    • -
    • Start/AllowPinnedFolderDocuments
    • -
    • Start/AllowPinnedFolderDownloads
    • -
    • Start/AllowPinnedFolderFileExplorer
    • -
    • Start/AllowPinnedFolderHomeGroup
    • -
    • Start/AllowPinnedFolderMusic
    • -
    • Start/AllowPinnedFolderNetwork
    • -
    • Start/AllowPinnedFolderPersonalFolder
    • -
    • Start/AllowPinnedFolderPictures
    • -
    • Start/AllowPinnedFolderSettings
    • -
    • Start/AllowPinnedFolderVideos
    • -
    • Start/HideAppList
    • -
    • Start/HideChangeAccountSettings
    • -
    • Start/HideFrequentlyUsedApps
    • -
    • Start/HideHibernate
    • -
    • Start/HideLock
    • -
    • Start/HidePowerButton
    • -
    • Start/HideRecentJumplists
    • -
    • Start/HideRecentlyAddedApps
    • -
    • Start/HideRestart
    • -
    • Start/HideShutDown
    • -
    • Start/HideSignOut
    • -
    • Start/HideSleep
    • -
    • Start/HideSwitchAccount
    • -
    • Start/HideUserTile
    • -
    • Start/ImportEdgeAssets
    • -
    • Start/NoPinningToTaskbar
    • -
    • System/AllowFontProviders
    • -
    • System/DisableOneDriveFileSync
    • -
    • TextInput/AllowKeyboardTextSuggestions
    • -
    • TimeLanguageSettings/AllowSet24HourClock
    • -
    • Update/ActiveHoursMaxRange
    • -
    • Update/AutoRestartDeadlinePeriodInDays
    • -
    • Update/AutoRestartNotificationSchedule
    • -
    • Update/AutoRestartRequiredNotificationDismissal
    • -
    • Update/DetectionFrequency
    • -
    • Update/EngagedRestartDeadline
    • -
    • Update/EngagedRestartSnoozeSchedule
    • -
    • Update/EngagedRestartTransitionSchedule
    • -
    • Update/IgnoreMOAppDownloadLimit
    • -
    • Update/IgnoreMOUpdateDownloadLimit
    • -
    • Update/PauseFeatureUpdatesStartTime
    • -
    • Update/PauseQualityUpdatesStartTime
    • -
    • Update/SetAutoRestartNotificationDisable
    • -
    • Update/SetEDURestart
    • -
    • WiFi/AllowWiFiDirect
    • -
    • WindowsLogon/HideFastUserSwitching
    • -
    • WirelessDisplay/AllowProjectionFromPC
    • -
    • WirelessDisplay/AllowProjectionFromPCOverInfrastructure
    • -
    • WirelessDisplay/AllowProjectionToPCOverInfrastructure
    • -
    • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
    • -

    Removed TextInput/AllowLinguisticDataCollection

    -

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

    -

    Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

    -

    Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

    -

    Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

    -

    Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files.

    -
    DevDetail CSP

    Added the following setting:

    -
      -
    • DeviceHardwareData
    • -
    -
    CleanPC CSP

    Added new CSP.

    DeveloperSetup CSP

    Added new CSP.

    NetworkProxy CSP

    Added new CSP.

    BitLocker CSP

    Added new CSP.

    -

    Added the following setting:

    -
      -
    • AllowWarningForOtherDiskEncryption
    • -
    -
    EnterpriseDataProtection CSP

    Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.

    Added the following settings:

    -
      -
    • RevokeOnMDMHandoff
    • -
    • SMBAutoEncryptedFileExtensions
    • -
    DynamicManagement CSP

    Added new CSP.

    Implement server-side support for mobile application management on Windows

    New mobile application management (MAM) support added in Windows 10, version 1703.

    PassportForWork CSP

    Added the following new node and settings:

    -
      -
    • TenantId/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
    • -
    • TenantId/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
    • -
    • TenantId/Policies/EnablePinRecovery
    • -
    Office CSP

    Added new CSP.

    Personalization CSP

    Added new CSP.

    EnterpriseAppVManagement CSP

    Added new CSP.

    HealthAttestation CSP

    Added the following settings:

    -
      -
    • HASEndpoint - added in Windows 10, version 1607, but not documented
    • -
    • TpmReadyStatus - added in the March service release of Windows 10, version 1607
    • -

    SurfaceHub CSP

    Added the following nodes and settings:

    -
      -
    • InBoxApps/SkypeForBusiness
    • -
    • InBoxApps/SkypeForBusiness/DomainName
    • -
    • InBoxApps/Connect
    • -
    • InBoxApps/Connect/AutoLaunch
    • -
    • Properties/DefaultVolume
    • -
    • Properties/ScreenTimeout
    • -
    • Properties/SessionTimeout
    • -
    • Properties/SleepTimeout
    • -
    • Properties/AllowSessionResume
    • -
    • Properties/AllowAutoProxyAuth
    • -
    • Properties/DisableSigninSuggestions
    • -
    • Properties/DoNotShowMyMeetingsAndFiles
    • -
    -
    NetworkQoSPolicy CSP

    Added new CSP.

    WindowsLicensing CSP

    Added the following setting:

    -
      -
    • ChangeProductKey
    • -
    -
    WindowsAdvancedThreatProtection CSP

    Added the following setting:

    -
      -
    • Configuration/TelemetryReportingFrequency
    • -
    -
    DMSessionActions CSP

    Added new CSP.

    -
    SharedPC CSP

    Added new settings in Windows 10, version 1703.

    -
      -
    • RestrictLocalStorage
    • -
    • KioskModeAUMID
    • -
    • KioskModeUserTileDisplayText
    • -
    • InactiveThreshold
    • -
    • MaxPageFileSizeMB
    • -
    -

    The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300.

    -
    RemoteLock CSP

    Added following setting:

    -
      -
    • LockAndRecoverPIN
    • -
    -
    NodeCache CSP

    Added following settings:

    -
      -
    • ChangedNodesData
    • -
    • AutoSetExpectedValue
    • -
    -
    Download all the DDF files for Windows 10, version 1703

    Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs.

    -
    RemoteWipe CSP

    Added new setting in Windows 10, version 1703.

    -
      -
    • doWipeProtected
    • -
    -
    MDM Bridge WMI Provider

    Added new classes and properties.

    -
    Understanding ADMX-backed policies

    Added a section describing SyncML examples of various ADMX elements.

    -
    Win32 and Desktop Bridge app policy configurationNew topic.
    Deploy and configure App-V apps using MDM

    Added a new topic describing how to deploy and configure App-V apps using MDM.

    -
    EnterpriseDesktopAppManagement CSP

    Added new setting in the March service release of Windows 10, version 1607.

    -
      -
    • MSI/UpgradeCode/[Guid]
    • -
    -
    Reporting CSP

    Added new settings in Windows 10, version 1703.

    -
      -
    • EnterpriseDataProtection/RetrieveByTimeRange/Type
    • -
    • EnterpriseDataProtection/RetrieveByCount/Type
    • -
    -
    Connecting your Windows 10-based device to work using a deep link

    Added following deep link parameters to the table:

    -
      -
    • Username
    • -
    • Servername
    • -
    • Accesstoken
    • -
    • Deviceidentifier
    • -
    • Tenantidentifier
    • -
    • Ownership
    • -
    -
    MDM support for Windows 10 S

    Updated the following topics to indicate MDM support in Windows 10 S.

    - -
    TPMPolicy CSPNew CSP added in Windows 10, version 1703.
      - +| New or updated article | Description | +|-----|-----| +| [Update CSP](update-csp.md) | Added the following nodes:
    - FailedUpdates/_Failed Update Guid_/RevisionNumber
    - InstalledUpdates/_Installed Update Guid_/RevisionNumber
    - PendingRebootUpdates/_Pending Reboot Update Guid_/RevisionNumber | +| [CM_CellularEntries CSP](cm-cellularentries-csp.md) | To PurposeGroups setting, added the following values:
    - Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
    - Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364 | +| [CertificateStore CSP](certificatestore-csp.md) | Added the following setting:
    - My/WSTEP/Renew/RetryAfterExpiryInterval | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | Added the following setting:
    - SCEP/UniqueID/Install/AADKeyIdentifierList | +| [DMAcc CSP](dmacc-csp.md) | Added the following setting:
    - AccountUID/EXT/Microsoft/InitiateSession | +| [DMClient CSP](dmclient-csp.md) | Added the following nodes and settings:
    - HWDevID
    - Provider/ProviderID/ManagementServerToUpgradeTo
    - Provider/ProviderID/CustomEnrollmentCompletePage
    - Provider/ProviderID/CustomEnrollmentCompletePage/Title
    - Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
    - Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
    - Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText | +| [CellularSettings CSP](cellularsettings-csp.md)
    [CM_CellularEntries CSP](cm-cellularentries-csp.md)
    [EnterpriseAPN CSP](enterpriseapn-csp.md) | For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions. | +| [SecureAssessment CSP](secureassessment-csp.md) | Added the following settings:
    - AllowTextSuggestions
    - RequirePrinting | +| [EnterpriseAPN CSP](enterpriseapn-csp.md) | Added the following setting:
    - Roaming | +| [Messaging CSP](messaging-csp.md) | Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions. | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies:
    - Accounts/AllowMicrosoftAccountSignInAssistant
    - ApplicationDefaults/DefaultAssociationsConfiguration
    - Browser/AllowAddressBarDropdown
    - Browser/AllowFlashClickToRun
    - Browser/AllowMicrosoftCompatibilityList
    - Browser/AllowSearchEngineCustomization
    - Browser/ClearBrowsingDataOnExit
    - Browser/ConfigureAdditionalSearchEngines
    - Browser/DisableLockdownOfStartPages
    - Browser/PreventFirstRunPage
    - Browser/PreventLiveTileDataCollection
    - Browser/SetDefaultSearchEngine
    - Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
    - Connectivity/AllowConnectedDevices
    - DeliveryOptimization/DOAllowVPNPeerCaching
    - DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
    - DeliveryOptimization/DOMinDiskSizeAllowedToPeer
    - DeliveryOptimization/DOMinFileSizeToCache
    - DeliveryOptimization/DOMinRAMAllowedToPeer
    - DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
    - Display/TurnOffGdiDPIScalingForApps
    - Display/TurnOnGdiDPIScalingForApps
    - EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
    - EnterpriseCloudPrint/CloudPrintOAuthAuthority
    - EnterpriseCloudPrint/CloudPrintOAuthClientId
    - EnterpriseCloudPrint/CloudPrintResourceId
    - EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
    - EnterpriseCloudPrint/MopriaDiscoveryResourceId
    - Experience/AllowFindMyDevice
    - Experience/AllowTailoredExperiencesWithDiagnosticData
    - Experience/AllowWindowsSpotlightOnActionCenter
    - Experience/AllowWindowsSpotlightWindowsWelcomeExperience
    - Location/EnableLocation
    - Messaging/AllowMMS
    - Messaging/AllowRCS
    - Privacy/LetAppsAccessTasks
    - Privacy/LetAppsAccessTasks_ForceAllowTheseApps
    - Privacy/LetAppsAccessTasks_ForceDenyTheseApps
    - Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
    - Privacy/LetAppsGetDiagnosticInfo
    - Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
    - Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
    - Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
    - Privacy/LetAppsRunInBackground
    - Privacy/LetAppsRunInBackground_ForceAllowTheseApps
    - Privacy/LetAppsRunInBackground_ForceDenyTheseApps
    - Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
    - Settings/ConfigureTaskbarCalendar
    - Settings/PageVisibilityList
    - SmartScreen/EnableAppInstallControl
    - SmartScreen/EnableSmartScreenInShell
    - SmartScreen/PreventOverrideForFilesInShell
    - Start/AllowPinnedFolderDocuments
    - Start/AllowPinnedFolderDownloads
    - Start/AllowPinnedFolderFileExplorer
    - Start/AllowPinnedFolderHomeGroup
    - Start/AllowPinnedFolderMusic
    - Start/AllowPinnedFolderNetwork
    - Start/AllowPinnedFolderPersonalFolder
    - Start/AllowPinnedFolderPictures
    - Start/AllowPinnedFolderSettings
    - Start/AllowPinnedFolderVideos
    - Start/HideAppList
    - Start/HideChangeAccountSettings
    - Start/HideFrequentlyUsedApps
    - Start/HideHibernate
    - Start/HideLock
    - Start/HidePowerButton
    - Start/HideRecentJumplists
    - Start/HideRecentlyAddedApps
    - Start/HideRestart
    - Start/HideShutDown
    - Start/HideSignOut
    - Start/HideSleep
    - Start/HideSwitchAccount
    - Start/HideUserTile
    - Start/ImportEdgeAssets
    - Start/NoPinningToTaskbar
    - System/AllowFontProviders
    - System/DisableOneDriveFileSync
    - TextInput/AllowKeyboardTextSuggestions
    - TimeLanguageSettings/AllowSet24HourClock
    - Update/ActiveHoursMaxRange
    - Update/AutoRestartDeadlinePeriodInDays
    - Update/AutoRestartNotificationSchedule
    - Update/AutoRestartRequiredNotificationDismissal
    - Update/DetectionFrequency
    - Update/EngagedRestartDeadline
    - Update/EngagedRestartSnoozeSchedule
    - Update/EngagedRestartTransitionSchedule
    - Update/IgnoreMOAppDownloadLimit
    - Update/IgnoreMOUpdateDownloadLimit
    - Update/PauseFeatureUpdatesStartTime
    - Update/PauseQualityUpdatesStartTime
    - Update/SetAutoRestartNotificationDisable
    - Update/SetEDURestart
    - WiFi/AllowWiFiDirect
    - WindowsLogon/HideFastUserSwitching
    - WirelessDisplay/AllowProjectionFromPC
    - WirelessDisplay/AllowProjectionFromPCOverInfrastructure
    - WirelessDisplay/AllowProjectionToPCOverInfrastructure
    - WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
    Removed TextInput/AllowLinguisticDataCollection
    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise
    Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.
    Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.
    Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.
    Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files. | +| [DevDetail CSP](devdetail-csp.md) | Added the following setting:
    - DeviceHardwareData | +| [CleanPC CSP](cleanpc-csp.md) | Added the new CSP. | +| [DeveloperSetup CSP](developersetup-csp.md) | Added the new CSP. | +| [NetworkProxy CSP](networkproxy-csp.md) | Added the new CSP. | +| [BitLocker CSP](bitlocker-csp.md) | Added the new CSP.

    Added the following setting:
    - AllowWarningForOtherDiskEncryption | +| [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) | Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.
    Added the following settings:
    - RevokeOnMDMHandoff
    - SMBAutoEncryptedFileExtensions | +| [DynamicManagement CSP](dynamicmanagement-csp.md) | Added the new CSP. | +| [Implement server-side support for mobile application management on Windows](https://docs.microsoft.com/windows/client-management/mdm/implement-server-side-mobile-application-management) | New mobile application management (MAM) support added in Windows 10, version 1703. | +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new node and settings:
    - _TenantId_/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
    - _TenantId_/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
    - _TenantId_/Policies/EnablePinRecovery | +| [Office CSP](office-csp.md) | Added the new CSP. | +| [Personalization CSP](personalization-csp.md) | Added the new CSP. | +| [EnterpriseAppVManagement CSP](enterpriseappvmanagement-csp.md) | Added the new CSP. | +| [HealthAttestation CSP](healthattestation-csp.md) | Added the following settings:
    - HASEndpoint - added in Windows 10, version 1607, but not documented
    - TpmReadyStatus - added in the March service release of Windows 10, version 1607 | +| [SurfaceHub CSP](surfacehub-csp.md) | Added the following nodes and settings:
    - InBoxApps/SkypeForBusiness
    - InBoxApps/SkypeForBusiness/DomainName
    - InBoxApps/Connect
    - InBoxApps/Connect/AutoLaunch
    - Properties/DefaultVolume
    - Properties/ScreenTimeout
    - Properties/SessionTimeout
    - Properties/SleepTimeout
    - Properties/AllowSessionResume
    - Properties/AllowAutoProxyAuth
    - Properties/DisableSigninSuggestions
    - Properties/DoNotShowMyMeetingsAndFiles | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | Added the new CSP. | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added the following setting:
    - ChangeProductKey | +| [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) | Added the following setting:
    - Configuration/TelemetryReportingFrequency | +| [DMSessionActions CSP](dmsessionactions-csp.md) | Added the new CSP. | +| [SharedPC CSP](dmsessionactions-csp.md) | Added new settings in Windows 10, version 1703:
    - RestrictLocalStorage
    - KioskModeAUMID
    - KioskModeUserTileDisplayText
    - InactiveThreshold
    - MaxPageFileSizeMB
    The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300. | +| [RemoteLock CSP](remotelock-csp.md) | Added following setting:
    - LockAndRecoverPIN | +| [NodeCache CSP](nodecache-csp.md) | Added following settings:
    - ChangedNodesData
    - AutoSetExpectedValue | +| [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) | Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF articles of various CSPs. | +| [RemoteWipe CSP](remotewipe-csp.md) | Added new setting in Windows 10, version 1703:
    - doWipeProtected | +| [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224) | Added new classes and properties. | +| [Understanding ADMX-backed policies](https://docs.microsoft.com/windows/client-management/mdm/understanding-admx-backed-policies) | Added a section describing SyncML examples of various ADMX elements. | +| [Win32 and Desktop Bridge app policy configuration](https://docs.microsoft.com/windows/client-management/mdm/win32-and-centennial-app-policy-configuration) | New article. | +| [Deploy and configure App-V apps using MDM](https://docs.microsoft.com/windows/client-management/mdm/appv-deploy-and-config) | Added a new article describing how to deploy and configure App-V apps using MDM. | +| [EnterpriseDesktopAppManagement CSP](enterprisedesktopappmanagement-csp.md) | Added new setting in the March service release of Windows 10, version 1607.
    - MSI/UpgradeCode/[Guid] | +| [Reporting CSP](reporting-csp.md) | Added new settings in Windows 10, version 1703.
    - EnterpriseDataProtection/RetrieveByTimeRange/Type
    - EnterpriseDataProtection/RetrieveByCount/Type | +| [Connect your Windows 10-based device to work using a deep link](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#connect-your-windows-10-based-device-to-work-using-a-deep-link) | Added following deep link parameters to the table:
    - Username
    - Servername
    - Accesstoken
    - Deviceidentifier
    - Tenantidentifier
    - Ownership | +| MDM support for Windows 10 S | Updated the following articles to indicate MDM support in Windows 10 S.
    - [Configuration service provider reference](configuration-service-provider-reference.md)
    - [Policy CSP](policy-configuration-service-provider.md) | +| [TPMPolicy CSP](tpmpolicy-csp.md) | Added the new CSP. | ## What’s new in MDM for Windows 10, version 1607 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ItemDescription

    Sideloading of apps

    Starting in Windows 10, version 1607, sideloading of apps is only allowed through EnterpriseModernAppManagement CSP. Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices.

    New value for NodeCache CSP

    In NodeCache CSP, the value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache.

    EnterpriseDataProtection CSP

    New CSP.

    Policy CSP

    Removed the following policies:

    -
      -
    • DataProtection/AllowAzureRMSForEDP - moved this policy to EnterpriseDataProtection CSP
    • -
    • DataProtection/AllowUserDecryption - moved this policy to EnterpriseDataProtection CSP
    • -
    • DataProtection/EDPEnforcementLevel - moved this policy to EnterpriseDataProtection CSP
    • -
    • DataProtection/RequireProtectionUnderLockConfig - moved this policy to EnterpriseDataProtection CSP
    • -
    • DataProtection/RevokeOnUnenroll - moved this policy to EnterpriseDataProtection CSP
    • -
    • DataProtection/EnterpriseCloudResources - moved this policy to NetworkIsolation policy
    • -
    • DataProtection/EnterpriseInternalProxyServers - moved this policy to NetworkIsolation policy
    • -
    • DataProtection/EnterpriseIPRange - moved this policy to NetworkIsolation policy
    • -
    • DataProtection/EnterpriseNetworkDomainNames - moved this policy to NetworkIsolation policy
    • -
    • DataProtection/EnterpriseProxyServers - moved this policy to NetworkIsolation policy
    • -
    • Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices - this policy has been deprecated.
    • -
    -

    Added the WiFi/AllowManualWiFiConfiguration and WiFi/AllowWiFi policies for Windows 10, version 1607:

    -
      -
    • Windows 10 Pro
    • -
    • Windows 10 Enterprise
    • -
    • Windows 10 Education
    • -
    -

    Added the following new policies:

    -
      -
    • AboveLock/AllowCortanaAboveLock
    • -
    • ApplicationManagement/DisableStoreOriginatedApps
    • -
    • Authentication/AllowSecondaryAuthenticationDevice
    • -
    • Bluetooth/AllowPrepairing
    • -
    • Browser/AllowExtensions
    • -
    • Browser/PreventAccessToAboutFlagsInMicrosoftEdge
    • -
    • Browser/ShowMessageWhenOpeningSitesInInternetExplorer
    • -
    • DeliveryOptimization/DOAbsoluteMaxCacheSize
    • -
    • DeliveryOptimization/DOMaxDownloadBandwidth
    • -
    • DeliveryOptimization/DOMinBackgroundQoS
    • -
    • DeliveryOptimization/DOModifyCacheDrive
    • -
    • DeliveryOptimization/DOMonthlyUploadDataCap
    • -
    • DeliveryOptimization/DOPercentageMaxDownloadBandwidth
    • -
    • DeviceLock/EnforceLockScreenAndLogonImage
    • -
    • DeviceLock/EnforceLockScreenProvider
    • -
    • Defender/PUAProtection
    • -
    • Experience/AllowThirdPartySuggestionsInWindowsSpotlight
    • -
    • Experience/AllowWindowsSpotlight
    • -
    • Experience/ConfigureWindowsSpotlightOnLockScreen
    • -
    • Experience/DoNotShowFeedbackNotifications
    • -
    • Licensing/AllowWindowsEntitlementActivation
    • -
    • Licensing/DisallowKMSClientOnlineAVSValidation
    • -
    • LockDown/AllowEdgeSwipe
    • -
    • Maps/EnableOfflineMapsAutoUpdate
    • -
    • Maps/AllowOfflineMapsDownloadOverMeteredConnection
    • -
    • Messaging/AllowMessageSync
    • -
    • NetworkIsolation/EnterpriseCloudResources
    • -
    • NetworkIsolation/EnterpriseInternalProxyServers
    • -
    • NetworkIsolation/EnterpriseIPRange
    • -
    • NetworkIsolation/EnterpriseIPRangesAreAuthoritative
    • -
    • NetworkIsolation/EnterpriseNetworkDomainNames
    • -
    • NetworkIsolation/EnterpriseProxyServers
    • -
    • NetworkIsolation/EnterpriseProxyServersAreAuthoritative
    • -
    • NetworkIsolation/NeutralResources
    • -
    • Notifications/DisallowNotificationMirroring
    • -
    • Privacy/DisableAdvertisingId
    • -
    • Privacy/LetAppsAccessAccountInfo
    • -
    • Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessCalendar
    • -
    • Privacy/LetAppsAccessCalendar_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessCalendar_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessCallHistory
    • -
    • Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessCamera
    • -
    • Privacy/LetAppsAccessCamera_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessCamera_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessCamera_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessContacts
    • -
    • Privacy/LetAppsAccessContacts_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessContacts_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessContacts_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessEmail
    • -
    • Privacy/LetAppsAccessEmail_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessEmail_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessLocation
    • -
    • Privacy/LetAppsAccessLocation_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessLocation_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessLocation_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessMessaging
    • -
    • Privacy/LetAppsAccessMessaging_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessMessaging_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessMicrophone
    • -
    • Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessMotion
    • -
    • Privacy/LetAppsAccessMotion_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessMotion_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessMotion_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessNotifications
    • -
    • Privacy/LetAppsAccessNotifications_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessNotifications_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessPhone
    • -
    • Privacy/LetAppsAccessPhone_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessPhone_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessPhone_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessRadios
    • -
    • Privacy/LetAppsAccessRadios_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessRadios_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessRadios_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsAccessTrustedDevices
    • -
    • Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps
    • -
    • Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps
    • -
    • Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
    • -
    • Privacy/LetAppsSyncWithDevices
    • -
    • Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps
    • -
    • Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps
    • -
    • Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
    • -
    • Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
    • -
    • Settings/AllowEditDeviceName
    • -
    • Speech/AllowSpeechModelUpdate
    • -
    • System/TelemetryProxy
    • -
    • Update/ActiveHoursStart
    • -
    • Update/ActiveHoursEnd
    • -
    • Update/AllowMUUpdateService
    • -
    • Update/BranchReadinessLevel
    • -
    • Update/DeferFeatureUpdatesPeriodInDays
    • -
    • Update/DeferQualityUpdatesPeriodInDays
    • -
    • Update/ExcludeWUDriversInQualityUpdate
    • -
    • Update/PauseFeatureUpdates
    • -
    • Update/PauseQualityUpdates
    • -
    • Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
    • -
    • WindowsInkWorkspace/AllowWindowsInkWorkspace
    • -
    • WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
    • -
    • WirelessDisplay/AllowProjectionToPC
    • -
    • WirelessDisplay/RequirePinForPairing
    • -
    -

    Updated the Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts description to remove outdated information.

    -

    Updated DeliveryOptimization/DODownloadMode to add new values.

    -

    Updated Experience/AllowCortana description to clarify what each supported value does.

    -

    Updated Security/AntiTheftMode description to clarify what each supported value does.

    DMClient CSP

    Added the following settings:

    -
      -
    • ManagementServerAddressList
    • -
    • AADDeviceID
    • -
    • EnrollmentType
    • -
    • HWDevID
    • -
    • CommercialID
    • -
    -

    Removed the EnrollmentID setting.

    DeviceManageability CSP

    New CSP.

    DeviceStatus CSP

    Added the following new settings:

    -
      -
    • DeviceStatus/TPM/SpecificationVersion
    • -
    • DeviceStatus/OS/Edition
    • -
    • DeviceStatus/Antivirus/SignatureStatus
    • -
    • DeviceStatus/Antivirus/Status
    • -
    • DeviceStatus/Antispyware/SignatureStatus
    • -
    • DeviceStatus/Antispyware/Status
    • -
    • DeviceStatus/Firewall/Status
    • -
    • DeviceStatus/UAC/Status
    • -
    • DeviceStatus/Battery/Status
    • -
    • DeviceStatus/Battery/EstimatedChargeRemaining
    • -
    • DeviceStatus/Battery/EstimatedRuntime
    • -
    AssignedAccess CSP

    Added SyncML examples.

    EnterpriseAssignedAccess CSP
      -
    • Added a new Folder table entry in the AssignedAccess/AssignedAccessXml description.
    • -
    • Updated the DDF and XSD file sections.
    • -
    SecureAssessment CSP

    New CSP for Windows 10, version 1607

    DiagnosticLog CSP -

    DiagnosticLog DDF

    Added version 1.3 of the CSP with two new settings. Added the new 1.3 version of the DDF. Added the following new settings in Windows 10, version 1607.

    -
      -
    • DeviceStateData
    • -
    • DeviceStateData/MdmConfiguration
    • -
    Reboot CSP

    New CSP for Windows 10, version 1607

    CMPolicyEnterprise CSP

    New CSP for Windows 10, version 1607

    VPNv2 CSP

    Added the following settings for Windows 10, version 1607

    -
      -
    • ProfileName/RouteList/routeRowId/ExclusionRoute
    • -
    • ProfileName/DomainNameInformationList/dniRowId/AutoTrigger
    • -
    • ProfileName/DomainNameInformationList/dniRowId/Persistent
    • -
    • ProfileName/ProfileXML
    • -
    • ProfileName/DeviceCompliance/Enabled
    • -
    • ProfileName/DeviceCompliance/Sso
    • -
    • ProfileName/DeviceCompliance/Sso/Enabled
    • -
    • ProfileName/DeviceCompliance/Sso/IssuerHash
    • -
    • ProfileName/DeviceCompliance/Sso/Eku
    • -
    • ProfileName/NativeProfile/CryptographySuite
    • -
    • ProfileName/NativeProfile/CryptographySuite/AuthenticationTransformConstants
    • -
    • ProfileName/NativeProfile/CryptographySuite/CipherTransformConstants
    • -
    • ProfileName/NativeProfile/CryptographySuite/EncryptionMethod
    • -
    • ProfileName/NativeProfile/CryptographySuite/IntegrityCheckMethod
    • -
    • ProfileName/NativeProfile/CryptographySuite/DHGroup
    • -
    • ProfileName/NativeProfile/CryptographySuite/PfsGroup
    • -
    • ProfileName/NativeProfile/L2tpPsk
    • -
    Win32AppInventory CSP -

    Win32AppInventory DDF

    New CSP for Windows 10, version 1607.

    SharedPC CSP

    New CSP for Windows 10, version 1607.

    WindowsAdvancedThreatProtection CSP

    New CSP for Windows 10, version 1607.

    MDM Bridge WMI Provider

    Added new classes for Windows 10, version 1607.

    MDM enrollment of Windows devices

    Topic renamed from "Enrollment UI".

    -

    Completely updated enrollment procedures and screenshots.

    UnifiedWriteFilter CSP -

    UnifiedWriteFilter DDF File

    Added the following new setting for Windows 10, version 1607:

    -
      -
    • NextSession/HORMEnabled
    • -
    CertificateStore CSP -

    CertificateStore DDF file

    Added the following new settings in Windows 10, version 1607:

    -
      -
    • My/WSTEP/Renew/LastRenewalAttemptTime
    • -
    • My/WSTEP/Renew/RenewNow
    • -

    WindowsLicensing CSP

    Added the following new node and settings in Windows 10, version 1607, but not documented:

    -
      -
    • Subscriptions
    • -
    • Subscriptions/SubscriptionId
    • -
    • Subscriptions/SubscriptionId/Status
    • -
    • Subscriptions/SubscriptionId/Name
    • -
    -

    WiFi CSP

    Deprecated the following node in Windows 10, version 1607:

    -
      -
    • DisableInternetConnectivityChecks
    • -
    -
    +| New or updated article | Description | +|-----|-----| +| Sideloading of apps | Starting in Windows 10, version 1607, sideloading of apps is only allowed through [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md). Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices. | +| [NodeCache CSP](nodecache-csp.md) | The value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache. | +| [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) | New CSP. | +| [Policy CSP](policy-configuration-service-provider.md) | Removed the following policies:
    - DataProtection/AllowAzureRMSForEDP - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
    - DataProtection/AllowUserDecryption - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
    - DataProtection/EDPEnforcementLevel - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
    - DataProtection/RequireProtectionUnderLockConfig - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
    - DataProtection/RevokeOnUnenroll - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
    - DataProtection/EnterpriseCloudResources - moved this policy to NetworkIsolation policy
    - DataProtection/EnterpriseInternalProxyServers - moved this policy to NetworkIsolation policy
    - DataProtection/EnterpriseIPRange - moved this policy to NetworkIsolation policy
    - DataProtection/EnterpriseNetworkDomainNames - moved this policy to NetworkIsolation policy
    - DataProtection/EnterpriseProxyServers - moved this policy to NetworkIsolation policy
    - Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices - this policy has been deprecated.

    Added the WiFi/AllowManualWiFiConfiguration and WiFi/AllowWiFi policies for Windows 10, version 1607:
    - Windows 10 Pro
    - Windows 10 Enterprise
    - Windows 10 Education

    Added the following new policies:
    - AboveLock/AllowCortanaAboveLock
    - ApplicationManagement/DisableStoreOriginatedApps
    - Authentication/AllowSecondaryAuthenticationDevice
    - Bluetooth/AllowPrepairing
    - Browser/AllowExtensions
    - Browser/PreventAccessToAboutFlagsInMicrosoftEdge
    - Browser/ShowMessageWhenOpeningSitesInInternetExplorer
    - DeliveryOptimization/DOAbsoluteMaxCacheSize
    - DeliveryOptimization/DOMaxDownloadBandwidth
    - DeliveryOptimization/DOMinBackgroundQoS
    - DeliveryOptimization/DOModifyCacheDrive
    - DeliveryOptimization/DOMonthlyUploadDataCap
    - DeliveryOptimization/DOPercentageMaxDownloadBandwidth
    - DeviceLock/EnforceLockScreenAndLogonImage
    - DeviceLock/EnforceLockScreenProvider
    - Defender/PUAProtection
    - Experience/AllowThirdPartySuggestionsInWindowsSpotlight
    - Experience/AllowWindowsSpotlight
    - Experience/ConfigureWindowsSpotlightOnLockScreen
    - Experience/DoNotShowFeedbackNotifications
    - Licensing/AllowWindowsEntitlementActivation
    - Licensing/DisallowKMSClientOnlineAVSValidation
    - LockDown/AllowEdgeSwipe
    - Maps/EnableOfflineMapsAutoUpdate
    - Maps/AllowOfflineMapsDownloadOverMeteredConnection
    - Messaging/AllowMessageSync
    - NetworkIsolation/EnterpriseCloudResources
    - NetworkIsolation/EnterpriseInternalProxyServers
    - NetworkIsolation/EnterpriseIPRange
    - NetworkIsolation/EnterpriseIPRangesAreAuthoritative
    - NetworkIsolation/EnterpriseNetworkDomainNames
    - NetworkIsolation/EnterpriseProxyServers
    - NetworkIsolation/EnterpriseProxyServersAreAuthoritative
    - NetworkIsolation/NeutralResources
    - Notifications/DisallowNotificationMirroring
    - Privacy/DisableAdvertisingId
    - Privacy/LetAppsAccessAccountInfo
    - Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps
    - Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps
    - Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
    - Privacy/LetAppsAccessCalendar
    - Privacy/LetAppsAccessCalendar_ForceAllowTheseApps
    - Privacy/LetAppsAccessCalendar_ForceDenyTheseApps
    - Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps
    - Privacy/LetAppsAccessCallHistory
    - Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps
    - Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps
    - Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps
    - Privacy/LetAppsAccessCamera
    - Privacy/LetAppsAccessCamera_ForceAllowTheseApps
    - Privacy/LetAppsAccessCamera_ForceDenyTheseApps
    - Privacy/LetAppsAccessCamera_UserInControlOfTheseApps
    - Privacy/LetAppsAccessContacts
    - Privacy/LetAppsAccessContacts_ForceAllowTheseApps
    - Privacy/LetAppsAccessContacts_ForceDenyTheseApps
    - Privacy/LetAppsAccessContacts_UserInControlOfTheseApps
    - Privacy/LetAppsAccessEmail
    - Privacy/LetAppsAccessEmail_ForceAllowTheseApps
    - Privacy/LetAppsAccessEmail_ForceDenyTheseApps
    - Privacy/LetAppsAccessEmail_UserInControlOfTheseApps
    - Privacy/LetAppsAccessLocation
    - Privacy/LetAppsAccessLocation_ForceAllowTheseApps
    - Privacy/LetAppsAccessLocation_ForceDenyTheseApps
    - Privacy/LetAppsAccessLocation_UserInControlOfTheseApps
    - Privacy/LetAppsAccessMessaging
    - Privacy/LetAppsAccessMessaging_ForceAllowTheseApps
    - Privacy/LetAppsAccessMessaging_ForceDenyTheseApps
    - Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps
    - Privacy/LetAppsAccessMicrophone
    - Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps
    - Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps
    - Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps
    - Privacy/LetAppsAccessMotion
    - Privacy/LetAppsAccessMotion_ForceAllowTheseApps
    - Privacy/LetAppsAccessMotion_ForceDenyTheseApps
    - Privacy/LetAppsAccessMotion_UserInControlOfTheseApps
    - Privacy/LetAppsAccessNotifications
    - Privacy/LetAppsAccessNotifications_ForceAllowTheseApps
    - Privacy/LetAppsAccessNotifications_ForceDenyTheseApps
    - Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps
    - Privacy/LetAppsAccessPhone
    - Privacy/LetAppsAccessPhone_ForceAllowTheseApps
    - Privacy/LetAppsAccessPhone_ForceDenyTheseApps
    - Privacy/LetAppsAccessPhone_UserInControlOfTheseApps
    - Privacy/LetAppsAccessRadios
    - Privacy/LetAppsAccessRadios_ForceAllowTheseApps
    - Privacy/LetAppsAccessRadios_ForceDenyTheseApps
    - Privacy/LetAppsAccessRadios_UserInControlOfTheseApps
    - Privacy/LetAppsAccessTrustedDevices
    - Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps
    - Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps
    - Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
    - Privacy/LetAppsSyncWithDevices
    - Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps
    - Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps
    - Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps
    - Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
    - Settings/AllowEditDeviceName
    - Speech/AllowSpeechModelUpdate
    - System/TelemetryProxy
    - Update/ActiveHoursStart
    - Update/ActiveHoursEnd
    - Update/AllowMUUpdateService
    - Update/BranchReadinessLevel
    - Update/DeferFeatureUpdatesPeriodInDays
    - Update/DeferQualityUpdatesPeriodInDays
    - Update/ExcludeWUDriversInQualityUpdate
    - Update/PauseFeatureUpdates
    - Update/PauseQualityUpdates
    - Update/SetProxyBehaviorForUpdateDetection
    - Update/UpdateServiceUrlAlternate (Added in the January service release of Windows 10, version 1607)
    - WindowsInkWorkspace/AllowWindowsInkWorkspace
    - WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace
    - WirelessDisplay/AllowProjectionToPC
    - WirelessDisplay/RequirePinForPairing

    Updated the Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts description to remove outdated information.

    Updated DeliveryOptimization/DODownloadMode to add new values.

    Updated Experience/AllowCortana description to clarify what each supported value does.

    Updated Security/AntiTheftMode description to clarify what each supported value does. | +| [DMClient CSP](dmclient-csp.md) | Added the following settings:
    - ManagementServerAddressList
    - AADDeviceID
    - EnrollmentType
    - HWDevID
    - CommercialID

    Removed the EnrollmentID setting. | +| [DeviceManageability CSP](devicemanageability-csp.md) | New CSP. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following new settings:
    - DeviceStatus/TPM/SpecificationVersion
    - DeviceStatus/OS/Edition
    - DeviceStatus/Antivirus/SignatureStatus
    - DeviceStatus/Antivirus/Status
    - DeviceStatus/Antispyware/SignatureStatus
    - DeviceStatus/Antispyware/Status
    - DeviceStatus/Firewall/Status
    - DeviceStatus/UAC/Status
    - DeviceStatus/Battery/Status
    - DeviceStatus/Battery/EstimatedChargeRemaining
    - DeviceStatus/Battery/EstimatedRuntime | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added SyncML examples. | +| [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md) | Added a new Folder table entry in the AssignedAccess/AssignedAccessXml description.
    Updated the DDF and XSD file sections. | +| [SecureAssessment CSP](secureassessment-csp.md) | New CSP. | +| [DiagnosticLog CSP](diagnosticlog-csp.md)
    [DiagnosticLog DDF](diagnosticlog-ddf.md) | Added version 1.3 of the CSP with two new settings.

    Added the new 1.3 version of the DDF.

    Added the following new settings in Windows 10, version 1607
    - DeviceStateData
    - DeviceStateData/MdmConfiguration | +| [Reboot CSP](reboot-csp.md) | New CSP. | +| [CMPolicyEnterprise CSP](cmpolicyenterprise-csp.md) | New CSP. | +| [VPNv2 CSP](vpnv2-csp.md) | Added the following settings for Windows 10, version 1607:
    - _ProfileName_/RouteList/routeRowId/ExclusionRoute
    - _ProfileName_/DomainNameInformationList/_dniRowId_/AutoTrigger
    - _ProfileName_/DomainNameInformationList/dniRowId/Persistent
    - _ProfileName_/ProfileXML
    - _ProfileName_/DeviceCompliance/Enabled
    - _ProfileName_/DeviceCompliance/Sso
    - _ProfileName_/DeviceCompliance/Sso/Enabled
    - _ProfileName_/DeviceCompliance/Sso/IssuerHash
    - _ProfileName_/DeviceCompliance/Sso/Eku
    - _ProfileName_/NativeProfile/CryptographySuite
    - _ProfileName_/NativeProfile/CryptographySuite/AuthenticationTransformConstants
    - _ProfileName_/NativeProfile/CryptographySuite/CipherTransformConstants
    - _ProfileName_/NativeProfile/CryptographySuite/EncryptionMethod
    - _ProfileName_/NativeProfile/CryptographySuite/IntegrityCheckMethod
    - _ProfileName_/NativeProfile/CryptographySuite/DHGroup
    - _ProfileName_/NativeProfile/CryptographySuite/PfsGroup
    - _ProfileName_/NativeProfile/L2tpPsk | +| [Win32AppInventory CSP](win32appinventory-csp.md) | New CSP. | +| [SharedPC CSP](sharedpc-csp.md) | New CSP. | +| [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) | New CSP. | +| [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224) | Added new classes for Windows 10, version 1607. | +| [MDM enrollment of Windows devices](mdm-enrollment-of-windows-devices.md) | Article renamed from "Enrollment UI".

    Completely updated enrollment procedures and screenshots. | +| [UnifiedWriteFilter CSP](unifiedwritefilter-csp.md)
    [UnifiedWriteFilter DDF File](unifiedwritefilter-ddf.md) | Added the following new setting for Windows 10, version 1607:
    - NextSession/HORMEnabled | +| [CertificateStore CSP](certificatestore-csp.md)
    [CertificateStore DDF file](certificatestore-ddf-file.md) | Added the following new settings in Windows 10, version 1607:
    - My/WSTEP/Renew/LastRenewalAttemptTime
    - My/WSTEP/Renew/RenewNow | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added the following new node and settings in Windows 10, version 1607, but not documented:
    - Subscriptions
    - Subscriptions/SubscriptionId
    - Subscriptions/SubscriptionId/Status
    - Subscriptions/SubscriptionId/Name | +| [WiFi CSP](wifi-csp.md) | Deprecated the following node in Windows 10, version 1607:
    - DisableInternetConnectivityChecks | ## What’s new in MDM for Windows 10, version 1511 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ItemDescription

    New configuration service providers added in Windows 10, version 1511

    New and updated policies in Policy CSP

    The following policies have been added to the Policy CSP:

    -
      -
    • ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
    • -
    • Bluetooth/ServicesAllowedList
    • -
    • DataProtection/AllowAzureRMSForEDP
    • -
    • DataProtection/RevokeOnUnenroll
    • -
    • DeviceLock/DevicePasswordExpiration
    • -
    • DeviceLock/DevicePasswordHistory
    • -
    • TextInput/AllowInputPanel
    • -
    • Update/PauseDeferrals
    • -
    • Update/RequireDeferUpdate
    • -
    • Update/RequireUpdateApproval
    • -
    -

    The following policies have been updated in the Policy CSP:

    -
      -
    • System/AllowLocation
    • -
    • Update/RequireDeferUpgrade
    • -
    -

    The following policies have been deprecated in the Policy CSP:

    -
      -
    • TextInput/AllowKoreanExtendedHanja
    • -
    • WiFi/AllowWiFiHotSpotReporting
    • -

    Management tool for the Microsoft Store for Business

    New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.

    Custom header for generic alert

    The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format:

    -MDM-GenericAlert: <AlertType1><AlertType2> -

    If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this OMA website.

    Alert message for slow client response

    When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

    -

    To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the DMClient CSP.

    New node in DMClient CSP

    Added a new node EnableOmaDmKeepAliveMessage to the DMClient CSP and updated the ManagementServerAddress to indicate that it can contain a list of URLs.

    New nodes in EnterpriseModernAppManagement CSP

    Added the following nodes to the EnterpriseModernAppManagement CSP:

    -
      -
    • AppManagement/GetInventoryQuery
    • -
    • AppManagement/GetInventoryResults
    • -
    • .../PackageFamilyName/AppSettingPolicy/SettingValue
    • -
    • AppLicenses/StoreLicenses/LicenseID/LicenseCategory
    • -
    • AppLicenses/StoreLicenses/LicenseID/LicenseUsage
    • -
    • AppLicenses/StoreLicenses/LicenseID/RequesterID
    • -
    • AppLicenses/StoreLicenses/LicenseID/GetLicenseFromStore
    • -

    New nodes in EnterpriseExt CSP

    Added the following nodes to the EnterpriseExt CSP:

    -
      -
    • DeviceCustomData (CustomID, CustomeString)
    • -
    • Brightness (Default, MaxAuto)
    • -
    • LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount)
    • -

    New node in EnterpriseExtFileSystem CSP

    Added OemProfile node to EnterpriseExtFileSystem CSP.

    New nodes in PassportForWork CSP

    Added the following nodes to PassportForWork CSP:

    -
      -
    • TenantId/Policies/PINComplexity/History
    • -
    • TenantId/Policies/PINComplexity/Expiration
    • -
    • TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
    • -
    • Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
    • -
    • Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT)
    • -

    Updated EnterpriseAssignedAccess CSP

    Here are the changes to the EnterpriseAssignedAccess CSP:

    -
      -
    • In AssignedAccessXML node, added new page settings and quick action settings.
    • -
    • In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
    • -
    • Updated the EnterpriseAssignedAccess XSD topic.
    • -

    New nodes in the DevDetail CSP

    Here are the changes to the DevDetail CSP:

    -
      -
    • Added TotalStore and TotalRAM settings.
    • -
    • Added support for Replace command for the DeviceName setting.
    • -

    Handling large objects

    Added support for the client to handle uploading of large objects to the server.

    +| New or updated article | Description | +|-----|-----| +| New configuration service providers added in Windows 10, version 1511 | - [AllJoynManagement CSP](alljoynmanagement-csp.md)
    - [Maps CSP](maps-csp.md)
    - [Reporting CSP](reporting-csp.md)
    - [SurfaceHub CSP](surfacehub-csp.md)
    - [WindowsSecurityAuditing CSP](windowssecurityauditing-csp.md) | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings:
    - ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
    - Bluetooth/ServicesAllowedList
    - DataProtection/AllowAzureRMSForEDP
    - DataProtection/RevokeOnUnenroll
    - DeviceLock/DevicePasswordExpiration
    - DeviceLock/DevicePasswordHistory
    - TextInput/AllowInputPanel
    - Update/PauseDeferrals
    - Update/RequireDeferUpdate
    - Update/RequireUpdateApproval

    Updated the following policy settings:
    - System/AllowLocation
    - Update/RequireDeferUpgrade

    Deprecated the following policy settings:
    - TextInput/AllowKoreanExtendedHanja
    - WiFi/AllowWiFiHotSpotReporting | +| Management tool for the Microsoft Store for Business | New articles. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates. | +| Custom header for generic alert | The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format: `MDM-GenericAlert: `

    If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526). | +| Alert message for slow client response | When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

    To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the [DMClient CSP](dmclient-csp.md). | +| [DMClient CSP](dmclient-csp.md) | Added a new node EnableOmaDmKeepAliveMessage to the [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) and updated the ManagementServerAddress to indicate that it can contain a list of URLs. | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following new nodes:
    - AppManagement/GetInventoryQuery
    - AppManagement/GetInventoryResults
    - .../_PackageFamilyName_/AppSettingPolicy/_SettingValue_
    - AppLicenses/StoreLicenses/_LicenseID_/LicenseCategory
    - AppLicenses/StoreLicenses/_LicenseID_/LicenseUsage
    - AppLicenses/StoreLicenses/_LicenseID_/RequesterID
    - AppLicenses/StoreLicenses/_LicenseID_/GetLicenseFromStore | +| [EnterpriseExt CSP](enterpriseext-csp.md) | Added the following new nodes:
    - DeviceCustomData (CustomID, CustomeString)
    - Brightness (Default, MaxAuto)
    - LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount) | +| [EnterpriseExtFileSystem CSP](enterpriseextfilessystem-csp.md) | Added the OemProfile node. +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new nodes:
    - TenantId/Policies/PINComplexity/History
    - TenantId/Policies/PINComplexity/Expiration
    - TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
    - Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
    - Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT) | +| [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md) | The following updates are done to the [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md):
    - In AssignedAccessXML node, added new page settings and quick action settings.
    - In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
    - Updated the [EnterpriseAssignedAccess XSD](enterpriseassignedaccess-xsd.md) article. | +| [DevDetail CSP](devdetail-csp.md) | The following updates are done to [DevDetail CSP](devdetail-csp.md):
    - Added TotalStore and TotalRAM settings.
    - Added support for Replace command for the DeviceName setting. | +| Handling large objects | Added support for the client to handle uploading of large objects to the server. | ## Breaking changes and known issues @@ -1690,7 +261,7 @@ Currently in Windows 10, version 1511, when using the ClientCertificateInstall The software version information from **DevDetail/SwV** does not match the version in **Settings** under **System/About**. -### Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues +### Upgrading Windows Phone 8.1 devices with app allow-listing using ApplicationRestriction policy has issues - When you upgrade Windows Phone 8.1 devices to Windows 10 Mobile using ApplicationRestrictions with a list of allowed apps, some Windows inbox apps get blocked causing unexpected behavior. To work around this issue, you must include the [inbox apps](applocker-csp.md#inboxappsandcomponents) that you need to your list of allowed apps. @@ -1760,8 +331,7 @@ The following list describes the prerequisites for a certificate to be used with The following XML sample explains the properties for the EAP TLS XML including certificate filtering. > [!NOTE] ->For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. - +> For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. ```xml @@ -1863,18 +433,17 @@ The following XML sample explains the properties for the EAP TLS XML including c ``` > [!NOTE] ->The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** - - +> The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** Alternatively you can use the following procedure to create an EAP Configuration XML. -1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) topic. +1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) article. 2. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop down (this selects EAP TLS.) ![vpn selfhost properties window](images/certfiltering1.png) - > **Note**  For PEAP or TTLS, select the appropriate method and continue following this procedure. + > [!NOTE] + > For PEAP or TTLS, select the appropriate method and continue following this procedure. 3. Click the **Properties** button underneath the drop down menu. 4. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. @@ -1885,10 +454,10 @@ Alternatively you can use the following procedure to create an EAP Configuration ![configure certificate selection window](images/certfiltering3.png) 6. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. 7. Close the rasphone dialog box. -8. Continue following the procedure in the [EAP configuration](eap-configuration.md) topic from Step 9 to get an EAP TLS profile with appropriate filtering. +8. Continue following the procedure in the [EAP configuration](eap-configuration.md) article from Step 9 to get an EAP TLS profile with appropriate filtering. > [!NOTE] ->You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) Settings for Network Access](https://technet.microsoft.com/library/hh945104.aspx) topic. +> You can also set all the other applicable EAP Properties through this UI as well. A guide to what these properties mean can be found in [Extensible Authentication Protocol (EAP) Settings for Network Access](https://technet.microsoft.com/library/hh945104.aspx). ### Remote PIN reset not supported in Azure Active Directory joined mobile devices @@ -1914,7 +483,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Frequently Asked Questions -### **Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** +### **Can there be more than one MDM server to enroll and manage devices in Windows 10?** No. Only one MDM is allowed. ### **How do I set the maximum number of Azure Active Directory joined devices per user?** @@ -1932,1037 +501,9 @@ No. Only one MDM is allowed. Entry | Description --------------- | -------------------- What is dmwappushsvc? | It is a Windows service that ships in Windows 10 operating system as a part of the windows management platform. It is used internally by the operating system as a queue for categorizing and processing all WAP messages, which include Windows management messages, MMS, NabSync, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | -What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. | -How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | +What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. This service does not send telemetry.| +How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. Disabling this will cause your management to fail.| -## Change history in MDM documentation +## Change history for MDM documentation -### February 2020 -|New or updated topic | Description| -|--- | ---| -|[CertificateStore CSP](certificatestore-csp.md)
    [ClientCertificateInstall CSP](clientcertificateinstall-csp.md)|Added details about SubjectName value.| - -### January 2020 -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - Defender](policy-csp-defender.md)|Added descriptions for supported actions for Defender/ThreatSeverityDefaultAction.| - - -### November 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added option 5 in the supported values list for DeliveryOptimization/DOGroupIdSource.| -|[DiagnosticLog CSP](diagnosticlog-csp.md)|Added substantial updates to this CSP doc.| - -### October 2019 - -|New or updated topic | Description| -|--- | ---| -|[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes:
    ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.| -|[Defender CSP](defender-csp.md)|Added the following new nodes:
    Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.| - -### September 2019 - -|New or updated topic | Description| -|--- | ---| -|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node:
    IsStub.| -|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| -|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies:
    DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| - -### August 2019 - -|New or updated topic | Description| -|--- | ---| -|[DiagnosticLog CSP](diagnosticlog-csp.md)
    [DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
    Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| -|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
    Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| - -### July 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP](policy-configuration-service-provider.md)|Added the following list:
    Policies supported by HoloLens 2| -|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.| -|[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903:
    SecurityKey, SecurityKey/UseSecurityKeyForSignin| -|[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies:
    LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock| -|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
    Create a custom configuration service provider
    Design a custom configuration service provider
    IConfigServiceProvider2
    IConfigServiceProvider2::ConfigManagerNotification
    IConfigServiceProvider2::GetNode
    ICSPNode
    ICSPNode::Add
    ICSPNode::Clear
    ICSPNode::Copy
    ICSPNode::DeleteChild
    ICSPNode::DeleteProperty
    ICSPNode::Execute
    ICSPNode::GetChildNodeNames
    ICSPNode::GetProperty
    ICSPNode::GetPropertyIdentifiers
    ICSPNode::GetValue
    ICSPNode::Move
    ICSPNode::SetProperty
    ICSPNode::SetValue
    ICSPNodeTransactioning
    ICSPValidate
    Samples for writing a custom configuration service provider.| - - -### June 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md)|Added the following new policies:
    AllowDeviceHealthMonitoring, ConfigDeviceHealthMonitoringScope, ConfigDeviceHealthMonitoringUploadDestination.| -|[Policy CSP - TimeLanguageSettings](policy-csp-timelanguagesettings.md)|Added the following new policy:
    ConfigureTimeZone.| - - -### May 2019 - -|New or updated topic | Description| -|--- | ---| -|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
    DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| -|[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| -|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
    DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

    Updated description of the following policies:
    DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| -|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
    ShowLockOnUserTile.| -|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
    AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| -|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
    EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| -|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
    AllowFindMyFiles.| -|[Policy CSP - ServiceControlManager](policy-csp-servicecontrolmanager.md)|Added the following new policy:
    SvchostProcessMitigation.| -|[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
    AllowCommercialDataPipeline, TurnOffFileHistory.| -|[Policy CSP - Troubleshooting](policy-csp-troubleshooting.md)|Added the following new policy:
    AllowRecommendations.| -|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
    AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| -|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
    AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.

    Removed the following policy:
    SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart. This policy is replaced by AllowAutomaticRestartSignOn.| - -### April 2019 - -| New or updated topic | Description | -|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md) | Added the following warning at the end of the Overview section:
    Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. | -| [Policy CSP - UserRights](policy-csp-userrights.md) | Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields. | - -### March 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
    AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

    Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| - - -### February 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP](policy-configuration-service-provider.md)|Updated supported policies for Holographic.| - -### January 2019 - -|New or updated topic | Description| -|--- | ---| -|[Policy CSP - Storage](policy-csp-storage.md)|Added the following new policies: AllowStorageSenseGlobal, ConfigStorageSenseGlobalCadence, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseRecycleBinCleanupThreshold, ConfigStorageSenseDownloadsCleanupThreshold, and ConfigStorageSenseCloudContentCleanupThreshold.| -|[SharedPC CSP](sharedpc-csp.md)|Updated values and supported operations.| -|[Mobile device management](index.md)|Updated information about MDM Security Baseline.| - -### December 2018 - -|New or updated topic | Description| -|--- | ---| -|[BitLocker CSP](bitlocker-csp.md)|Updated AllowWarningForOtherDiskEncryption policy description to describe silent and non-silent encryption scenarios, as well as where and how the recovery key is backed up for each scenario.| - -### September 2018 - -|New or updated topic | Description| -|--- | ---| -|[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).| -|[Policy CSP - DeviceGuard](policy-csp-deviceguard.md) | Updated ConfigureSystemGuardLaunch policy and replaced EnableSystemGuard with it.| - -### August 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    BitLocker CSP

    Added support for Windows 10 Pro starting in the version 1809.

    -
    Office CSP

    Added FinalStatus setting in Windows 10, version 1809.

    -
    RemoteWipe CSP

    Added new settings in Windows 10, version 1809.

    -
    TenantLockdown CSP

    Added new CSP in Windows 10, version 1809.

    -
    WindowsDefenderApplicationGuard CSP

    Added new settings in Windows 10, version 1809.

    -
    Policy DDF file

    Posted an updated version of the Policy DDF for Windows 10, version 1809.

    -
    Policy CSP

    Added the following new policies in Windows 10, version 1809:

    -
      -
    • Browser/AllowFullScreenMode
    • -
    • Browser/AllowPrelaunch
    • -
    • Browser/AllowPrinting
    • -
    • Browser/AllowSavingHistory
    • -
    • Browser/AllowSideloadingOfExtensions
    • -
    • Browser/AllowTabPreloading
    • -
    • Browser/AllowWebContentOnNewTabPage
    • -
    • Browser/ConfigureFavoritesBar
    • -
    • Browser/ConfigureHomeButton
    • -
    • Browser/ConfigureKioskMode
    • -
    • Browser/ConfigureKioskResetAfterIdleTimeout
    • -
    • Browser/ConfigureOpenMicrosoftEdgeWith
    • -
    • Browser/ConfigureTelemetryForMicrosoft365Analytics
    • -
    • Browser/PreventCertErrorOverrides
    • -
    • Browser/SetHomeButtonURL
    • -
    • Browser/SetNewTabPageURL
    • -
    • Browser/UnlockHomeButton
    • -
    • Experience/DoNotSyncBrowserSettings
    • -
    • Experience/PreventUsersFromTurningOnBrowserSyncing
    • -
    • Kerberos/UPNNameHints
    • -
    • Privacy/AllowCrossDeviceClipboard
    • -
    • Privacy/DisablePrivacyExperience
    • -
    • Privacy/UploadUserActivities
    • -
    • System/AllowDeviceNameInDiagnosticData
    • -
    • System/ConfigureMicrosoft365UploadEndpoint
    • -
    • System/DisableDeviceDelete
    • -
    • System/DisableDiagnosticDataViewer
    • -
    • Storage/RemovableDiskDenyWriteAccess
    • -
    • Update/UpdateNotificationLevel
    • -
    -

    Start/DisableContextMenus - added in Windows 10, version 1803.

    -

    RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.

    -
    - -### July 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    AssignedAccess CSP

    Added the following note:

    -
      -
    • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
    • -
    -
    PassportForWork CSP

    Added new settings in Windows 10, version 1809.

    -
    EnterpriseModernAppManagement CSP

    Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

    -
    Win32CompatibilityAppraiser CSP

    Added new configuration service provider in Windows 10, version 1809.

    -
    WindowsLicensing CSP

    Added S mode settings and SyncML examples in Windows 10, version 1809.

    -
    SUPL CSP

    Added 3 new certificate nodes in Windows 10, version 1809.

    -
    Defender CSP

    Added a new node Health/ProductStatus in Windows 10, version 1809.

    -
    BitLocker CSP

    Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

    -
    DevDetail CSP

    Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

    -
    Policy CSP

    Added the following new policies in Windows 10, version 1809:

    -
      -
    • ApplicationManagement/LaunchAppAfterLogOn
    • -
    • ApplicationManagement/ScheduleForceRestartForUpdateFailures
    • -
    • Authentication/EnableFastFirstSignIn (Preview mode only)
    • -
    • Authentication/EnableWebSignIn (Preview mode only)
    • -
    • Authentication/PreferredAadTenantDomainName
    • -
    • Defender/CheckForSignaturesBeforeRunningScan
    • -
    • Defender/DisableCatchupFullScan
    • -
    • Defender/DisableCatchupQuickScan
    • -
    • Defender/EnableLowCPUPriority
    • -
    • Defender/SignatureUpdateFallbackOrder
    • -
    • Defender/SignatureUpdateFileSharesSources
    • -
    • DeviceGuard/ConfigureSystemGuardLaunch
    • -
    • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    • -
    • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    • -
    • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • -
    • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    • -
    • DmaGuard/DeviceEnumerationPolicy
    • -
    • Experience/AllowClipboardHistory
    • -
    • Security/RecoveryEnvironmentAuthentication
    • -
    • TaskManager/AllowEndTask
    • -
    • WindowsDefenderSecurityCenter/DisableClearTpmButton
    • -
    • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
    • -
    • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
    • -
    • WindowsLogon/DontDisplayNetworkSelectionUI
    • -
    -

    Recent changes:

    -
      -
    • DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
    • -
    -
    - -### June 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Wifi CSP

    Added a new node WifiCost in Windows 10, version 1809.

    -
    Diagnose MDM failures in Windows 10

    Recent changes:

    -
      -
    • Added procedure for collecting logs remotely from Windows 10 Holographic.
    • -
    • Added procedure for downloading the MDM Diagnostic Information log.
    • -
    -
    Bitlocker CSP

    Added new node AllowStandardUserEncryption in Windows 10, version 1809.

    -
    Policy CSP

    Recent changes:

    -
      -
    • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
    • -
    • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
    • -
    • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
    • -
    • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
    • -
    • Security/RequireDeviceEncryption is supported in the Home SKU.
    • -
    • Start/StartLayout - added a table of SKU support information.
    • -
    • Start/ImportEdgeAssets - added a table of SKU support information.
    • -
    -

    Added the following new policies in Windows 10, version 1809:

    -
      -
    • Update/EngagedRestartDeadlineForFeatureUpdates
    • -
    • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
    • -
    • Update/EngagedRestartTransitionScheduleForFeatureUpdates
    • -
    • Update/SetDisablePauseUXAccess
    • -
    • Update/SetDisableUXWUAccess
    • -
    -
    WiredNetwork CSPNew CSP added in Windows 10, version 1809. -
    - - -### May 2018 - - ---- - - - - - - - - - - - -
    New or updated topicDescription
    Policy DDF file

    Updated the DDF files in the Windows 10 version 1703 and 1709.

    - -
    - -### April 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    WindowsDefenderApplicationGuard CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • Settings/AllowVirtualGPU
    • -
    • Settings/SaveFilesToHost
    • -
    -
    NetworkProxy CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • ProxySettingsPerUser
    • -
    -
    Accounts CSP

    Added a new CSP in Windows 10, version 1803.

    -
    MDM Migration Analysis Too (MMAT)

    Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

    -
    CSP DDF files download

    Added the DDF download of Windows 10, version 1803 configuration service providers.

    -
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • Bluetooth/AllowPromptedProximalConnections
    • -
    • KioskBrowser/EnableEndSessionButton
    • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
    • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
    • -
    • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    • -
    -
    - -### March 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    eUICCs CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • IsEnabled
    • -
    -
    DeviceStatus CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • OS/Mode
    • -
    -
    Understanding ADMX-backed policies

    Added the following videos:

    - -
    AccountManagement CSP

    Added a new CSP in Windows 10, version 1803.

    -
    RootCATrustedCertificates CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • UntrustedCertificates
    • -
    -
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • ApplicationDefaults/EnableAppUriHandlers
    • -
    • ApplicationManagement/MSIAllowUserControlOverInstall
    • -
    • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    • -
    • Connectivity/AllowPhonePCLinking
    • -
    • Notifications/DisallowCloudNotification
    • -
    • Notifications/DisallowTileNotification
    • -
    • RestrictedGroups/ConfigureGroupMembership
    • -
    -

    The following existing policies were updated:

    -
      -
    • Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
    • -
    • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
    • -
    • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
    • -
    -

    Added a new section:

    -
      -
    • Policies supported by Group Policy - list of policies in Policy CSP that has corresponding Group Policy. The policy description contains the GP information, such as GP policy name and variable name.
    • -
    -
    Policy CSP - Bluetooth

    Added new section ServicesAllowedList usage guide.

    -
    MultiSIM CSP

    Added SyncML examples and updated the settings descriptions.

    -
    RemoteWipe CSP

    Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

    -
    - -### February 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • Display/DisablePerProcessDpiForApps
    • -
    • Display/EnablePerProcessDpi
    • -
    • Display/EnablePerProcessDpiForApps
    • -
    • Experience/AllowWindowsSpotlightOnSettings
    • -
    • TextInput/ForceTouchKeyboardDockedState
    • -
    • TextInput/TouchKeyboardDictationButtonAvailability
    • -
    • TextInput/TouchKeyboardEmojiButtonAvailability
    • -
    • TextInput/TouchKeyboardFullModeAvailability
    • -
    • TextInput/TouchKeyboardHandwritingModeAvailability
    • -
    • TextInput/TouchKeyboardNarrowModeAvailability
    • -
    • TextInput/TouchKeyboardSplitModeAvailability
    • -
    • TextInput/TouchKeyboardWideModeAvailability
    • -
        -
    VPNv2 ProfileXML XSD

    Updated the XSD and Plug-in profile example for VPNv2 CSP.

    -
    AssignedAccess CSP

    Added the following nodes in Windows 10, version 1803:

    -
      -
    • Status
    • -
    • ShellLauncher
    • -
    • StatusConfiguration
    • -
    -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    -
    MultiSIM CSP

    Added a new CSP in Windows 10, version 1803.

    -
    EnterpriseModernAppManagement CSP

    Added the following node in Windows 10, version 1803:

    -
      -
    • MaintainProcessorArchitectureOnUpdate
    • -
    -
    - -### January 2018 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1803:

    -
      -
    • Browser/AllowConfigurationUpdateForBooksLibrary
    • -
    • Browser/AlwaysEnableBooksLibrary
    • -
    • Browser/EnableExtendedBooksTelemetry
    • -
    • Browser/UseSharedFolderForBooks
    • -
    • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    • -
    • DeliveryOptimization/DODelayForegroundDownloadFromHttp
    • -
    • DeliveryOptimization/DOGroupIdSource
    • -
    • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
    • -
    • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
    • -
    • DeliveryOptimization/DORestrictPeerSelectionBy
    • -
    • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
    • -
    • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
    • -
    • KioskBrowser/BlockedUrlExceptions
    • -
    • KioskBrowser/BlockedUrls
    • -
    • KioskBrowser/DefaultURL
    • -
    • KioskBrowser/EnableHomeButton
    • -
    • KioskBrowser/EnableNavigationButtons
    • -
    • KioskBrowser/RestartOnIdleTime
    • -
    • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
    • -
    • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • -
    • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • -
    • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
    • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • -
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • -
    • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • -
    • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
    • -
    • RestrictedGroups/ConfigureGroupMembership
    • -
    • Search/AllowCortanaInAAD
    • -
    • Search/DoNotUseWebResults
    • -
    • Security/ConfigureWindowsPasswords
    • -
    • System/FeedbackHubAlwaysSaveDiagnosticsLocally
    • -
    • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
    • -
    • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    • -
    • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
    • -
    • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
    • -
    • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
    • -
    • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
    • -
    • TaskScheduler/EnableXboxGameSaveTask
    • -
    • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    • -
    • Update/ConfigureFeatureUpdateUninstallPeriod
    • -
    • UserRights/AccessCredentialManagerAsTrustedCaller
    • -
    • UserRights/AccessFromNetwork
    • -
    • UserRights/ActAsPartOfTheOperatingSystem
    • -
    • UserRights/AllowLocalLogOn
    • -
    • UserRights/BackupFilesAndDirectories
    • -
    • UserRights/ChangeSystemTime
    • -
    • UserRights/CreateGlobalObjects
    • -
    • UserRights/CreatePageFile
    • -
    • UserRights/CreatePermanentSharedObjects
    • -
    • UserRights/CreateSymbolicLinks
    • -
    • UserRights/CreateToken
    • -
    • UserRights/DebugPrograms
    • -
    • UserRights/DenyAccessFromNetwork
    • -
    • UserRights/DenyLocalLogOn
    • -
    • UserRights/DenyRemoteDesktopServicesLogOn
    • -
    • UserRights/EnableDelegation
    • -
    • UserRights/GenerateSecurityAudits
    • -
    • UserRights/ImpersonateClient
    • -
    • UserRights/IncreaseSchedulingPriority
    • -
    • UserRights/LoadUnloadDeviceDrivers
    • -
    • UserRights/LockMemory
    • -
    • UserRights/ManageAuditingAndSecurityLog
    • -
    • UserRights/ManageVolume
    • -
    • UserRights/ModifyFirmwareEnvironment
    • -
    • UserRights/ModifyObjectLabel
    • -
    • UserRights/ProfileSingleProcess
    • -
    • UserRights/RemoteShutdown
    • -
    • UserRights/RestoreFilesAndDirectories
    • -
    • UserRights/TakeOwnership
    • -
    • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
    • -
    • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
    • -
    • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
    • -
    • WindowsDefenderSecurityCenter/HideSecureBoot
    • -
    • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    • -
    -

    Added the following policies the were added in Windows 10, version 1709

    -
      -
    • DeviceLock/MinimumPasswordAge
    • -
    • Settings/AllowOnlineTips
    • -
    • System/DisableEnterpriseAuthProxy
    • -
    -

    Security/RequireDeviceEncryption - updated to show it is supported in desktop.

    -
    BitLocker CSP

    Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

    -
    EnterpriseModernAppManagement CSP

    Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

    -
    DMClient CSP

    Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

    -
      -
    • AADSendDeviceToken
    • -
    • BlockInStatusPage
    • -
    • AllowCollectLogsButton
    • -
    • CustomErrorText
    • -
    • SkipDeviceStatusPage
    • -
    • SkipUserStatusPage
    • -
    -
    Defender CSP

    Added new node (OfflineScan) in Windows 10, version 1803.

    -
    UEFI CSP

    Added a new CSP in Windows 10, version 1803.

    -
    Update CSP

    Added the following nodes in Windows 10, version 1803:

    -
      -
    • Rollback
    • -
    • Rollback/FeatureUpdate
    • -
    • Rollback/QualityUpdateStatus
    • -
    • Rollback/FeatureUpdateStatus
    • -
    -
    - -### December 2017 - - ---- - - - - - - - - - - - -
    New or updated topicDescription
    Configuration service provider reference

    Added new section CSP DDF files download

    -
    - -### November 2017 - - ---- - - - - - - - - - - - -
    New or updated topicDescription
    Policy CSP

    Added the following policies for Windows 10, version 1709:

    -
      -
    • Authentication/AllowFidoDeviceSignon
    • -
    • Cellular/LetAppsAccessCellularData
    • -
    • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    • -
    • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    • -
    • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
    • -
    • Start/HidePeopleBar
    • -
    • Storage/EnhancedStorageDevices
    • -
    • Update/ManagePreviewBuilds
    • -
    • WirelessDisplay/AllowMdnsAdvertisement
    • -
    • WirelessDisplay/AllowMdnsDiscovery
    • -
    -

    Added missing policies from previous releases:

    -
      -
    • Connectivity/DisallowNetworkConnectivityActiveTest
    • -
    • Search/AllowWindowsIndexer
    • -
    -
    - -### October 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Policy DDF file

    Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

    -
    Policy CSP

    Updated the following policies:

    -
      -
    • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
    • -
    • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
    • -
    -
    eUICCs CSP

    Added new CSP in Windows 10, version 1709.

    -
    AssignedAccess CSP

    Added SyncML examples for the new Configuration node.

    -
    DMClient CSP

    Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

    -
    - - -### September 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Policy CSP

    Added the following new policies for Windows 10, version 1709:

    -
      -
    • Authentication/AllowAadPasswordReset
    • -
    • Handwriting/PanelDefaultModeDocked
    • -
    • Search/AllowCloudSearch
    • -
    • System/LimitEnhancedDiagnosticDataWindowsAnalytics
    • -
    -

    Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

    -
    AssignedAccess CSP

    Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

    -
    Microsoft Store for Business and Microsoft Store

    Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

    -
    The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

    The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

    -
      -
    • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
    • -
    • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
    • -
    • DomainName - fully qualified domain name if the device is domain-joined.
    • -
    -

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

    -
    EnterpriseAPN CSP

    Added a SyncML example.

    -
    VPNv2 CSP

    Added RegisterDNS setting in Windows 10, version 1709.

    -
    Enroll a Windows 10 device automatically using Group Policy

    Added new topic to introduce a new Group Policy for automatic MDM enrollment.

    -
    MDM enrollment of Windows-based devices

    New features in the Settings app:

    -
      -
    • User sees installation progress of critical policies during MDM enrollment.
    • -
    • User knows what policies, profiles, apps MDM has configured
    • -
    • IT helpdesk can get detailed MDM diagnostic information using client tools
    • -
    -

    For details, see Managing connections and Collecting diagnostic logs

    -
    - -### August 2017 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    New or updated topicDescription
    Enable ADMX-backed policies in MDM

    Added new step-by-step guide to enable ADMX-backed policies.

    -
    Mobile device enrollment

    Added the following statement:

    -
      -
    • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
    • -
    -
    CM_CellularEntries CSP

    Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

    -
    EnterpriseDataProtection CSP

    Updated the Settings/EDPEnforcementLevel values to the following:

    -
      -
    • 0 (default) – Off / No protection (decrypts previously protected data).
    • -
    • 1 – Silent mode (encrypt and audit only).
    • -
    • 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
    • -
    • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
    • -
    -
    AppLocker CSP

    Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Whitelist examples.

    -
    DeviceManageability CSP

    Added the following settings in Windows 10, version 1709:

    -
      -
    • Provider/ProviderID/ConfigInfo
    • -
    • Provider/ProviderID/EnrollmentInfo
    • -
    -
    Office CSP

    Added the following setting in Windows 10, version 1709:

    -
      -
    • Installation/CurrentStatus
    • -
    -
    BitLocker CSPAdded information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. -
    Firewall CSPUpdated the CSP and DDF topics. Here are the changes: -
      -
    • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
    • -
    • Changed some data types from integer to bool.
    • -
    • Updated the list of supported operations for some settings.
    • -
    • Added default values.
    • -
    -
    Policy DDF fileAdded another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies: -
      -
    • Browser/AllowMicrosoftCompatibilityList
    • -
    • Update/DisableDualScan
    • -
    • Update/FillEmptyContentUrls
    • -
    -
    Policy CSP

    Added the following new policies for Windows 10, version 1709:

    -
      -
    • Browser/ProvisionFavorites
    • -
    • Browser/LockdownFavorites
    • -
    • ExploitGuard/ExploitProtectionSettings
    • -
    • Games/AllowAdvancedGamingServices
    • -
    • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    • -
    • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
    • -
    • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
    • -
    • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
    • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
    • -
    • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
    • -
    • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
    • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    • -
    • LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
    • -
    • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    • -
    • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
    • -
    • Privacy/EnableActivityFeed
    • -
    • Privacy/PublishUserActivities
    • -
    • Update/DisableDualScan
    • -
    • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    • -
    -

    Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.

    -

    Changed the names of the following policies:

    -
      -
    • Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
    • -
    • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
    • -
    • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
    • -
    -

    Added links to the additional ADMX-backed BitLocker policies.

    -

    There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

    -
      -
    • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
    • -
    • Start/HideAppList
    • -
    -
    +To know what's changed in MDM documentation, see [Change history for MDM documentation](change-history-for-mdm-documentation.md). diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md index 9072c3eb82..045b8152d9 100644 --- a/windows/client-management/mdm/nodecache-csp.md +++ b/windows/client-management/mdm/nodecache-csp.md @@ -1,6 +1,6 @@ --- title: NodeCache CSP -description: NodeCache CSP +description: Use the NodeCache configuration service provider (CSP) to synchronize, monitor, and manage the client cache. ms.assetid: b4dd2b0d-79ef-42ac-ab5b-ee07b3097876 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index 7d58ebbea3..06a74f2979 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -1,6 +1,6 @@ --- title: NodeCache DDF file -description: NodeCache DDF file +description: Learn about the OMA DM device description framework (DDF) for the NodeCache configuration service provider (CSP). ms.assetid: d7605098-12aa-4423-89ae-59624fa31236 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index 7f8b60345e..88e2b4dee5 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -14,9 +14,6 @@ ms.date: 08/15/2018 # Office DDF -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **Office** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md index e852fe64e8..40757af748 100644 --- a/windows/client-management/mdm/oma-dm-protocol-support.md +++ b/windows/client-management/mdm/oma-dm-protocol-support.md @@ -1,6 +1,6 @@ --- title: OMA DM protocol support -description: OMA DM protocol support +description: See how the OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. ms.assetid: e882aaae-447e-4bd4-9275-463824da4fa0 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md index 22c3ac4fbe..2ff94e841f 100644 --- a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md @@ -31,7 +31,7 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme The discovery web service provides the configuration information necessary for a user to enroll a device with a management service. The service is a restful web service over HTTPS (server authentication only). > [!NOTE] ->The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. +> The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The device’s automatic discovery flow uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -78,7 +78,7 @@ The following logic is applied: - If the device is not redirected, it prompts the user for the server address. - If the device is redirected, it prompts the user to allow the redirect. -The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address +The following example shows a request via an HTTP POST command to the discovery web service given user@contoso.com as the email address: ``` https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc @@ -130,7 +130,7 @@ The discovery response is in the XML format and includes the following fields: - Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. > [!NOTE] ->The HTTP server response must not be chunked; it must be sent as one message. +> The HTTP server response must not be chunked; it must be sent as one message. The following example shows a response received from the discovery web service for OnPremise authentication: @@ -215,7 +215,7 @@ After the user is authenticated, the web service retrieves the certificate templ MS-XCEP supports very flexible enrollment policies using various Complex Types and Attributes. We will first support the minimalKeyLength, the hashAlgorithmOIDReference policies, and the CryptoProviders. The hashAlgorithmOIDReference has related OID and OIDReferenceID and policySchema in the GetPolicesResponse. The policySchema refers to the certificate template version. Version 3 of MS-XCEP supports hashing algorithms. > [!NOTE] ->The HTTP server response must not be chunked; it must be sent as one message. +> The HTTP server response must not be chunked; it must be sent as one message. The following snippet shows the policy web service response. @@ -307,7 +307,7 @@ The RequestSecurityToken will use a custom TokenType (http://schema The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. > [!NOTE] ->The policy service and the enrollment service must be on the same server; that is, they must have the same host name. +> The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for OnPremise authentication. diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index e3914d786d..8d4f260502 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -1,6 +1,6 @@ --- title: Personalization CSP -description: Personalization CSP +description: Use the Personalization CSP to lock screen and desktop background images, prevent users from changing the image, and use the settings in a provisioning package. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index 2492302fed..5a9ac5cc69 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,6 +1,6 @@ --- title: Personalization DDF file -description: Personalization DDF file +description: Learn how to set the OMA DM device description framework (DDF) for the Personalization configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/policies-admx-backed.md b/windows/client-management/mdm/policies-admx-backed.md deleted file mode 100644 index 6e6b86877e..0000000000 --- a/windows/client-management/mdm/policies-admx-backed.md +++ /dev/null @@ -1,420 +0,0 @@ ---- -title: ADMX-backed policies -description: ADMX-backed policies -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 07/18/2019 ---- - -# ADMX-backed policies - -> [!div class="op_single_selector"] -> -> - [Policies supported by Group Policy](policies-supported-by-group-policy.md) -> - [ADMX-backed policies](policies-admx-backed.md) -> - -- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) -- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) -- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) -- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) -- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) -- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) -- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) -- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) -- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) -- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) -- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) -- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) -- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) -- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) -- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) -- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) -- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) -- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) -- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) -- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) -- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) -- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) -- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) -- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) -- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) -- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) -- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) -- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) -- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) -- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) -- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) -- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) -- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) -- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) -- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) -- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) - -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md new file mode 100644 index 0000000000..c6e37891f5 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -0,0 +1,1742 @@ +--- +title: ADMX-backed policies in Policy CSP +description: ADMX-backed policies in Policy CSP +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/08/2020 +--- + +# ADMX-backed policies in Policy CSP + +> [!div class="op_single_selector"] +> +> - [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md) +> - [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) +> + +- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [ADMX_ActiveXInstallService/AxISURLZonePolicies](./policy-csp-admx-activexinstallservice.md#admx-activexinstallservice-axisurlzonepolicies) +- [ADMX_AddRemovePrograms/DefaultCategory](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-defaultcategory) +- [ADMX_AddRemovePrograms/NoAddFromCDorFloppy](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromcdorfloppy) +- [ADMX_AddRemovePrograms/NoAddFromInternet](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfrominternet) +- [ADMX_AddRemovePrograms/NoAddFromNetwork](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromnetwork) +- [ADMX_AddRemovePrograms/NoAddPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddpage) +- [ADMX_AddRemovePrograms/NoAddRemovePrograms](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddremoveprograms) +- [ADMX_AddRemovePrograms/NoChooseProgramsPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nochooseprogramspage) +- [ADMX_AddRemovePrograms/NoRemovePage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noremovepage) +- [ADMX_AddRemovePrograms/NoServices](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noservices) +- [ADMX_AddRemovePrograms/NoSupportInfo](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nosupportinfo) +- [ADMX_AddRemovePrograms/NoWindowsSetupPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nowindowssetuppage) +- [ADMX_AppCompat/AppCompatPrevent16BitMach](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatprevent16bitmach) +- [ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatremoveprogramcompatproppage) +- [ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffapplicationimpacttelemetry) +- [ADMX_AppCompat/AppCompatTurnOffSwitchBack](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffswitchback) +- [ADMX_AppCompat/AppCompatTurnOffEngine](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffengine) +- [ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant_1) +- [ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant_2) +- [ADMX_AppCompat/AppCompatTurnOffUserActionRecord](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffuseractionrecord) +- [ADMX_AppCompat/AppCompatTurnOffProgramInventory](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprograminventory) +- [ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles](./policy-csp-admx-appxpackagemanager.md#admx-appxpackagemanager-allowdeploymentinspecialprofiles) +- [ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeapplicationcontenturirules) +- [ADMX_AppXRuntime/AppxRuntimeBlockFileElevation](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation) +- [ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockhostedappaccesswinrt) +- [ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation) +- [ADMX_AttachmentManager/AM_EstimateFileHandlerRisk](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-estimatefilehandlerrisk) +- [ADMX_AttachmentManager/AM_SetFileRiskLevel](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setfilerisklevel) +- [ADMX_AttachmentManager/AM_SetHighRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-sethighriskinclusion) +- [ADMX_AttachmentManager/AM_SetLowRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setlowriskinclusion) +- [ADMX_AttachmentManager/AM_SetModRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setmodriskinclusion) +- [ADMX_AuditSettings/IncludeCmdLine](./policy-csp-admx-auditsettings.md#admx-auditsettings-includecmdline) +- [ADMX_Bits/BITS_DisableBranchCache](./policy-csp-admx-bits.md#admx-bits-bits-disablebranchcache) +- [ADMX_Bits/BITS_DisablePeercachingClient](./policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingclient) +- [ADMX_Bits/BITS_DisablePeercachingServer](./policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingserver) +- [ADMX_Bits/BITS_EnablePeercaching](./policy-csp-admx-bits.md#admx-bits-bits-enablepeercaching) +- [ADMX_Bits/BITS_MaxBandwidthServedForPeers](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthservedforpeers) +- [ADMX_Bits/BITS_MaxBandwidthV2_Maintenance](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-maintenance) +- [ADMX_Bits/BITS_MaxBandwidthV2_Work](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-work) +- [ADMX_Bits/BITS_MaxCacheSize](./policy-csp-admx-bits.md#admx-bits-bits-maxcachesize) +- [ADMX_Bits/BITS_MaxContentAge](./policy-csp-admx-bits.md#admx-bits-bits-maxcontentage) +- [ADMX_Bits/BITS_MaxDownloadTime](./policy-csp-admx-bits.md#admx-bits-bits-maxdownloadtime) +- [ADMX_Bits/BITS_MaxFilesPerJob](./policy-csp-admx-bits.md#admx-bits-bits-maxfilesperjob) +- [ADMX_Bits/BITS_MaxJobsPerMachine](./policy-csp-admx-bits.md#admx-bits-bits-maxjobspermachine) +- [ADMX_Bits/BITS_MaxJobsPerUser](./policy-csp-admx-bits.md#admx-bits-bits-maxjobsperuser) +- [ADMX_Bits/BITS_MaxRangesPerFile](./policy-csp-admx-bits.md#admx-bits-bits-maxrangesperfile) +- [ADMX_CipherSuiteOrder/SSLCipherSuiteOrder](./policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslciphersuiteorder) +- [ADMX_CipherSuiteOrder/SSLCurveOrder](./policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslcurveorder) +- [ADMX_COM/AppMgmt_COM_SearchForCLSID_1](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-1) +- [ADMX_COM/AppMgmt_COM_SearchForCLSID_2](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-2) +- [ADMX_ControlPanel/DisallowCpls](./policy-csp-admx-controlpanel.md#admx-controlpanel-disallowcpls) +- [ADMX_ControlPanel/ForceClassicControlPanel](./policy-csp-admx-controlpanel.md#admx-controlpanel-forceclassiccontrolpanel) +- [ADMX_ControlPanel/NoControlPanel](./policy-csp-admx-controlpanel.md#admx-controlpanel-nocontrolpanel) +- [ADMX_ControlPanel/RestrictCpls](./policy-csp-admx-controlpanel.md#admx-controlpanel-restrictcpls) +- [ADMX_ControlPanelDisplay/CPL_Display_Disable](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-disable) +- [ADMX_ControlPanelDisplay/CPL_Display_HideSettings](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-hidesettings) +- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablecolorschemechoice) +- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablethemechange) +- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablevisualstyle) +- [ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-enablescreensaver) +- [ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen) +- [ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-lockfontsize) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nocolorappearanceui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopbackgroundui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopiconsui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nolockscreen) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nomousepointersui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-noscreensaverui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nosoundschemeui) +- [ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-personalcolors) +- [ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensaverissecure) +- [ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensavertimeout) +- [ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setscreensaver) +- [ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme) +- [ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setvisualstyle) +- [ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-startbackground) +- [ADMX_Cpls/UseDefaultTile](./policy-csp-admx-cpls.md#admx-cpls-usedefaulttile) +- [ADMX_CredentialProviders/AllowDomainDelayLock](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-allowdomaindelaylock) +- [ADMX_CredentialProviders/DefaultCredentialProvider](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-defaultcredentialprovider) +- [ADMX_CredentialProviders/ExcludedCredentialProviders](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-excludedcredentialproviders) +- [ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowdefcredentialswhenntlmonly) +- [ADMX_CredSsp/AllowDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowdefaultcredentials) +- [ADMX_CredSsp/AllowEncryptionOracle](./policy-csp-admx-credssp.md#admx-credssp-allowencryptionoracle) +- [ADMX_CredSsp/AllowFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentials) +- [ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentialswhenntlmonly) +- [ADMX_CredSsp/AllowSavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentials) +- [ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentialswhenntlmonly) +- [ADMX_CredSsp/DenyDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-denydefaultcredentials) +- [ADMX_CredSsp/DenyFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-denyfreshcredentials) +- [ADMX_CredSsp/DenySavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-denysavedcredentials) +- [ADMX_CredSsp/RestrictedRemoteAdministration](./policy-csp-admx-credssp.md#admx-credssp-restrictedremoteadministration) +- [ADMX_CredUI/EnableSecureCredentialPrompting](./policy-csp-admx-credui.md#admx-credui-enablesecurecredentialprompting) +- [ADMX_CredUI/NoLocalPasswordResetQuestions](./policy-csp-admx-credui.md#admx-credui-nolocalpasswordresetquestions) +- [ADMX_CtrlAltDel/DisableChangePassword](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablechangepassword) +- [ADMX_CtrlAltDel/DisableLockComputer](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) +- [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) +- [ADMX_CtrlAltDel/NoLogoff](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) +- [ADMX_DataCollection/CommercialIdPolicy](./policy-csp-admx-datacollection.md#admx-datacollection-commercialidpolicy) +- [ADMX_Desktop/AD_EnableFilter](./policy-csp-admx-desktop.md#admx-desktop-ad-enablefilter) +- [ADMX_Desktop/AD_HideDirectoryFolder](./policy-csp-admx-desktop.md#admx-desktop-ad-hidedirectoryfolder) +- [ADMX_Desktop/AD_QueryLimit](./policy-csp-admx-desktop.md#admx-desktop-ad-querylimit) +- [ADMX_Desktop/ForceActiveDesktopOn](./policy-csp-admx-desktop.md#admx-desktop-forceactivedesktopon) +- [ADMX_Desktop/NoActiveDesktop](./policy-csp-admx-desktop.md#admx-desktop-noactivedesktop) +- [ADMX_Desktop/NoActiveDesktopChanges](./policy-csp-admx-desktop.md#admx-desktop-noactivedesktopchanges) +- [ADMX_Desktop/NoDesktop](./policy-csp-admx-desktop.md#admx-desktop-nodesktop) +- [ADMX_Desktop/NoDesktopCleanupWizard](./policy-csp-admx-desktop.md#admx-desktop-nodesktopcleanupwizard) +- [ADMX_Desktop/NoInternetIcon](./policy-csp-admx-desktop.md#admx-desktop-nointerneticon) +- [ADMX_Desktop/NoMyComputerIcon](./policy-csp-admx-desktop.md#admx-desktop-nomycomputericon) +- [ADMX_Desktop/NoMyDocumentsIcon](./policy-csp-admx-desktop.md#admx-desktop-nomydocumentsicon) +- [ADMX_Desktop/NoNetHood](./policy-csp-admx-desktop.md#admx-desktop-nonethood) +- [ADMX_Desktop/NoPropertiesMyComputer](./policy-csp-admx-desktop.md#admx-desktop-nopropertiesmycomputer) +- [ADMX_Desktop/NoPropertiesMyDocuments](./policy-csp-admx-desktop.md#admx-desktop-nopropertiesmydocuments) +- [ADMX_Desktop/NoRecentDocsNetHood](./policy-csp-admx-desktop.md#admx-desktop-norecentdocsnethood) +- [ADMX_Desktop/NoRecycleBinIcon](./policy-csp-admx-desktop.md#admx-desktop-norecyclebinicon) +- [ADMX_Desktop/NoRecycleBinProperties](./policy-csp-admx-desktop.md#admx-desktop-norecyclebinproperties) +- [ADMX_Desktop/NoSaveSettings](./policy-csp-admx-desktop.md#admx-desktop-nosavesettings) +- [ADMX_Desktop/NoWindowMinimizingShortcuts](./policy-csp-admx-desktop.md#admx-desktop-nowindowminimizingshortcuts) +- [ADMX_Desktop/Wallpaper](./policy-csp-admx-desktop.md#admx-desktop-wallpaper) +- [ADMX_Desktop/sz_ATC_DisableAdd](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableadd) +- [ADMX_Desktop/sz_ATC_DisableClose](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableclose) +- [ADMX_Desktop/sz_ATC_DisableDel](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disabledel) +- [ADMX_Desktop/sz_ATC_DisableEdit](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableedit) +- [ADMX_Desktop/sz_ATC_NoComponents](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-nocomponents) +- [ADMX_Desktop/sz_AdminComponents_Title](./policy-csp-admx-desktop.md#admx-desktop-sz-admincomponents-title) +- [ADMX_Desktop/sz_DB_DragDropClose](./policy-csp-admx-desktop.md#admx-desktop-sz-db-dragdropclose) +- [ADMX_Desktop/sz_DB_Moving](./policy-csp-admx-desktop.md#admx-desktop-sz-db-moving) +- [ADMX_Desktop/sz_DWP_NoHTMLPaper](./policy-csp-admx-desktop.md#admx-desktop-sz-dwp-nohtmlpaper) +- [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) +- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) +- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) +- [ADMX_DeviceInstallation/DeviceInstall_InstallTimeout](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-installtimeout) +- [ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) +- [ADMX_DeviceInstallation/DeviceInstall_Removable_Deny](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) +- [ADMX_DeviceInstallation/DeviceInstall_SystemRestore](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) +- [ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-classes-allowuser) +- [ADMX_DeviceSetup/DeviceInstall_BalloonTips](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-balloontips) +- [ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchorderconfiguration) +- [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-1) +- [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-2) +- [ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-allowfqdnnetbiosqueries) +- [ADMX_DnsClient/DNS_AppendToMultiLabelName](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-appendtomultilabelname) +- [ADMX_DnsClient/DNS_Domain](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domain) +- [ADMX_DnsClient/DNS_DomainNameDevolutionLevel](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domainnamedevolutionlevel) +- [ADMX_DnsClient/DNS_IdnEncoding](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnencoding) +- [ADMX_DnsClient/DNS_IdnMapping](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnmapping) +- [ADMX_DnsClient/DNS_NameServer](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-nameserver) +- [ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-preferlocalresponsesoverlowerorderdns) +- [ADMX_DnsClient/DNS_PrimaryDnsSuffix](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-primarydnssuffix) +- [ADMX_DnsClient/DNS_RegisterAdapterName](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registeradaptername) +- [ADMX_DnsClient/DNS_RegisterReverseLookup](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registerreverselookup) +- [ADMX_DnsClient/DNS_RegistrationEnabled](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationenabled) +- [ADMX_DnsClient/DNS_RegistrationOverwritesInConflict](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationoverwritesinconflict) +- [ADMX_DnsClient/DNS_RegistrationRefreshInterval](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationrefreshinterval) +- [ADMX_DnsClient/DNS_RegistrationTtl](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationttl) +- [ADMX_DnsClient/DNS_SearchList](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-searchlist) +- [ADMX_DnsClient/DNS_SmartMultiHomedNameResolution](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartmultihomednameresolution) +- [ADMX_DnsClient/DNS_SmartProtocolReorder](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartprotocolreorder) +- [ADMX_DnsClient/DNS_UpdateSecurityLevel](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatesecuritylevel) +- [ADMX_DnsClient/DNS_UpdateTopLevelDomainZones](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatetopleveldomainzones) +- [ADMX_DnsClient/DNS_UseDomainNameDevolution](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-usedomainnamedevolution) +- [ADMX_DnsClient/Turn_Off_Multicast](./policy-csp-admx-dnsclient.md#admx-dnsclient-turn-off-multicast) +- [ADMX_DWM/DwmDefaultColorizationColor_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-1) +- [ADMX_DWM/DwmDefaultColorizationColor_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-2) +- [ADMX_DWM/DwmDisallowAnimations_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-1) +- [ADMX_DWM/DwmDisallowAnimations_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-2) +- [ADMX_DWM/DwmDisallowColorizationColorChanges_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-1) +- [ADMX_DWM/DwmDisallowColorizationColorChanges_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-2) +- [ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList](./policy-csp-admx-eaime.md#admx-eaime-l-donotincludenonpublishingstandardglyphinthecandidatelist) +- [ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion](./policy-csp-admx-eaime.md#admx-eaime-l-restrictcharactercoderangeofconversion) +- [ADMX_EAIME/L_TurnOffCustomDictionary](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffcustomdictionary) +- [ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffhistorybasedpredictiveinput) +- [ADMX_EAIME/L_TurnOffInternetSearchIntegration](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffinternetsearchintegration) +- [ADMX_EAIME/L_TurnOffOpenExtendedDictionary](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffopenextendeddictionary) +- [ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffsavingautotuningdatatofile) +- [ADMX_EAIME/L_TurnOnCloudCandidate](./policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidate) +- [ADMX_EAIME/L_TurnOnCloudCandidateCHS](./policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidatechs) +- [ADMX_EAIME/L_TurnOnLexiconUpdate](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlexiconupdate) +- [ADMX_EAIME/L_TurnOnLiveStickers](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlivestickers) +- [ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport](./policy-csp-admx-eaime.md#admx-eaime-l-turnonmisconversionloggingformisconversionreport) +- [ADMX_EncryptFilesonMove/NoEncryptOnMove](./policy-csp-admx-encryptfilesonmove.md#admx-encryptfilesonmove-noencryptonmove) +- [ADMX_EnhancedStorage/ApprovedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedenstordevices) +- [ADMX_EnhancedStorage/ApprovedSilos](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedsilos) +- [ADMX_EnhancedStorage/DisablePasswordAuthentication](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disablepasswordauthentication) +- [ADMX_EnhancedStorage/DisallowLegacyDiskDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disallowlegacydiskdevices) +- [ADMX_EnhancedStorage/LockDeviceOnMachineLock](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-lockdeviceonmachinelock) +- [ADMX_EnhancedStorage/RootHubConnectedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-roothubconnectedenstordevices) +- [ADMX_ErrorReporting/PCH_AllOrNoneDef](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornonedef) +- [ADMX_ErrorReporting/PCH_AllOrNoneEx](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneex) +- [ADMX_ErrorReporting/PCH_AllOrNoneInc](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneinc) +- [ADMX_ErrorReporting/PCH_ConfigureReport](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-configurereport) +- [ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-reportoperatingsystemfaults) +- [ADMX_ErrorReporting/WerArchive_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-1) +- [ADMX_ErrorReporting/WerArchive_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-2) +- [ADMX_ErrorReporting/WerAutoApproveOSDumps_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-1) +- [ADMX_ErrorReporting/WerAutoApproveOSDumps_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-2) +- [ADMX_ErrorReporting/WerBypassDataThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-1) +- [ADMX_ErrorReporting/WerBypassDataThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-2) +- [ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-1) +- [ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-2) +- [ADMX_ErrorReporting/WerBypassPowerThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-1) +- [ADMX_ErrorReporting/WerBypassPowerThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-2) +- [ADMX_ErrorReporting/WerCER](./policy-csp-admx-errorreporting.md#admx-errorreporting-wercer) +- [ADMX_ErrorReporting/WerConsentCustomize_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentcustomize-1) +- [ADMX_ErrorReporting/WerConsentOverride_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-1) +- [ADMX_ErrorReporting/WerConsentOverride_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-2) +- [ADMX_ErrorReporting/WerDefaultConsent_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-1) +- [ADMX_ErrorReporting/WerDefaultConsent_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-2) +- [ADMX_ErrorReporting/WerDisable_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdisable-1) +- [ADMX_ErrorReporting/WerExlusion_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-1) +- [ADMX_ErrorReporting/WerExlusion_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-2) +- [ADMX_ErrorReporting/WerNoLogging_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-1) +- [ADMX_ErrorReporting/WerNoLogging_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-2) +- [ADMX_ErrorReporting/WerNoSecondLevelData_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernosecondleveldata-1) +- [ADMX_ErrorReporting/WerQueue_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-1) +- [ADMX_ErrorReporting/WerQueue_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-2) +- [ADMX_EventForwarding/ForwarderResourceUsage](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-forwarderresourceusage) +- [ADMX_EventForwarding/SubscriptionManager](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-subscriptionmanager) +- [ADMX_EventLog/Channel_LogEnabled](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logenabled) +- [ADMX_EventLog/Channel_LogFilePath_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-1) +- [ADMX_EventLog/Channel_LogFilePath_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-2) +- [ADMX_EventLog/Channel_LogFilePath_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-3) +- [ADMX_EventLog/Channel_LogFilePath_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-4) +- [ADMX_EventLog/Channel_LogMaxSize_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logmaxsize-3) +- [ADMX_EventLog/Channel_Log_AutoBackup_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-1) +- [ADMX_EventLog/Channel_Log_AutoBackup_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-2) +- [ADMX_EventLog/Channel_Log_AutoBackup_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-3) +- [ADMX_EventLog/Channel_Log_AutoBackup_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-4) +- [ADMX_EventLog/Channel_Log_FileLogAccess_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-1) +- [ADMX_EventLog/Channel_Log_FileLogAccess_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-2) +- [ADMX_EventLog/Channel_Log_FileLogAccess_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-3) +- [ADMX_EventLog/Channel_Log_FileLogAccess_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-4) +- [ADMX_EventLog/Channel_Log_FileLogAccess_5](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-5) +- [ADMX_EventLog/Channel_Log_FileLogAccess_6](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-6) +- [ADMX_EventLog/Channel_Log_FileLogAccess_7](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-7) +- [ADMX_EventLog/Channel_Log_FileLogAccess_8](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-8) +- [ADMX_EventLog/Channel_Log_Retention_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-2) +- [ADMX_EventLog/Channel_Log_Retention_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-3) +- [ADMX_EventLog/Channel_Log_Retention_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-4) +- [ADMX_Explorer/AdminInfoUrl](./policy-csp-admx-explorer.md#admx-explorer-admininfourl) +- [ADMX_Explorer/AlwaysShowClassicMenu](./policy-csp-admx-explorer.md#admx-explorer-alwaysshowclassicmenu) +- [ADMX_Explorer/DisableRoamedProfileInit](./policy-csp-admx-explorer.md#admx-explorer-disableroamedprofileinit) +- [ADMX_Explorer/PreventItemCreationInUsersFilesFolder](./policy-csp-admx-explorer.md#admx-explorer-preventitemcreationinusersfilesfolder) +- [ADMX_Explorer/TurnOffSPIAnimations](./policy-csp-admx-explorer.md#admx-explorer-turnoffspianimations) +- [ADMX_FileServerVSSProvider/Pol_EncryptProtocol](./policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) +- [ADMX_FileSys/DisableCompression](./policy-csp-admx-filesys.md#admx-filesys-disablecompression) +- [ADMX_FileSys/DisableDeleteNotification](./policy-csp-admx-filesys.md#admx-filesys-disabledeletenotification) +- ADMX_FileSys/DisableEncryption](./policy-csp-admx-filesys.md#admx-filesys-disableencryption) +- [ADMX_FileSys/EnablePagefileEncryption](./policy-csp-admx-filesys.md#admx-filesys-enablepagefileencryption) +- [ADMX_FileSys/LongPathsEnabled](./policy-csp-admx-filesys.md#admx-filesys-longpathsenabled) +- [ADMX_FileSys/ShortNameCreationSettings](./policy-csp-admx-filesys.md#admx-filesys-shortnamecreationsettings) +- [ADMX_FileSys/SymlinkEvaluation](./policy-csp-admx-filesys.md#admx-filesys-symlinkevaluation) +- [ADMX_FileSys/TxfDeprecatedFunctionality](./policy-csp-admx-filesys.md#admx-filesys-txfdeprecatedfunctionality) +- [ADMX_FolderRedirection/DisableFRAdminPin](./policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpin) +- [ADMX_FolderRedirection/DisableFRAdminPinByFolder](./policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpinbyfolder) +- [ADMX_FolderRedirection/FolderRedirectionEnableCacheRename](./policy-csp-admx-folderredirection.md#admx-folderredirection-folderredirectionenablecacherename) +- [ADMX_FolderRedirection/LocalizeXPRelativePaths_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-1) +- [ADMX_FolderRedirection/LocalizeXPRelativePaths_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-2) +- [ADMX_FolderRedirection/PrimaryComputer_FR_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-1) +- [ADMX_FolderRedirection/PrimaryComputer_FR_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-2) +- [ADMX_Globalization/BlockUserInputMethodsForSignIn](./policy-csp-admx-globalization.md#admx-globalization-blockuserinputmethodsforsignin) +- [ADMX_Globalization/CustomLocalesNoSelect_1](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-1) +- [ADMX_Globalization/CustomLocalesNoSelect_2](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-2) +- [ADMX_Globalization/HideAdminOptions](./policy-csp-admx-globalization.md#admx-globalization-hideadminoptions) +- [ADMX_Globalization/HideCurrentLocation](./policy-csp-admx-globalization.md#admx-globalization-hidecurrentlocation) +- [ADMX_Globalization/HideLanguageSelection](./policy-csp-admx-globalization.md#admx-globalization-hidelanguageselection) +- [ADMX_Globalization/HideLocaleSelectAndCustomize](./policy-csp-admx-globalization.md#admx-globalization-hidelocaleselectandcustomize) +- [ADMX_Globalization/ImplicitDataCollectionOff_1](./policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-1) +- [ADMX_Globalization/ImplicitDataCollectionOff_2](./policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-2) +- [ADMX_Globalization/LocaleSystemRestrict](./policy-csp-admx-globalization.md#admx-globalization-localesystemrestrict) +- [ADMX_Globalization/LocaleUserRestrict_1](./policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-1) +- [ADMX_Globalization/LocaleUserRestrict_2](./policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-2) +- [ADMX_Globalization/LockMachineUILanguage](./policy-csp-admx-globalization.md#admx-globalization-lockmachineuilanguage) +- [ADMX_Globalization/LockUserUILanguage](./policy-csp-admx-globalization.md#admx-globalization-lockuseruilanguage) +- [ADMX_Globalization/PreventGeoIdChange_1](./policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-1) +- [ADMX_Globalization/PreventGeoIdChange_2](./policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-2) +- [ADMX_Globalization/PreventUserOverrides_1](./policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-1) +- [ADMX_Globalization/PreventUserOverrides_2](./policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-2) +- [ADMX_Globalization/RestrictUILangSelect](./policy-csp-admx-globalization.md#admx-globalization-restrictuilangselect) +- [ADMX_Globalization/TurnOffAutocorrectMisspelledWords](./policy-csp-admx-globalization.md#admx-globalization-turnoffautocorrectmisspelledwords) +- [ADMX_Globalization/TurnOffHighlightMisspelledWords](./policy-csp-admx-globalization.md#admx-globalization-turnoffhighlightmisspelledwords) +- [ADMX_Globalization/TurnOffInsertSpace](./policy-csp-admx-globalization.md#admx-globalization-turnoffinsertspace) +- [ADMX_Globalization/TurnOffOfferTextPredictions](./policy-csp-admx-globalization.md#admx-globalization-turnoffoffertextpredictions) +- [ADMX_Globalization/Y2K](./policy-csp-admx-globalization.md#admx-globalization-y2k) +- [ADMX_GroupPolicy/AllowX-ForestPolicy-and-RUP](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-allowx-forestpolicy-and-rup) +- [ADMX_GroupPolicy/CSE_AppMgmt](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-appmgmt) +- [ADMX_GroupPolicy/CSE_DiskQuota](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-diskquota) +- [ADMX_GroupPolicy/CSE_EFSRecovery](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-efsrecovery) +- [ADMX_GroupPolicy/CSE_FolderRedirection](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-folderredirection) +- [ADMX_GroupPolicy/CSE_IEM](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-iem) +- [ADMX_GroupPolicy/CSE_IPSecurity](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-ipsecurity) +- [ADMX_GroupPolicy/CSE_Registry](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-registry) +- [ADMX_GroupPolicy/CSE_Scripts](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-scripts) +- [ADMX_GroupPolicy/CSE_Security](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-security) +- [ADMX_GroupPolicy/CSE_Wired](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-wired) +- [ADMX_GroupPolicy/CSE_Wireless](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-wireless) +- [ADMX_GroupPolicy/CorpConnSyncWaitTime](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-corpconnsyncwaittime) +- [ADMX_GroupPolicy/DenyRsopToInteractiveUser_1](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-denyrsoptointeractiveuser-1) +- [ADMX_GroupPolicy/DenyRsopToInteractiveUser_2](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-denyrsoptointeractiveuser-2) +- [ADMX_GroupPolicy/DisableAOACProcessing](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableaoacprocessing) +- [ADMX_GroupPolicy/DisableAutoADMUpdate](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableautoadmupdate) +- [ADMX_GroupPolicy/DisableBackgroundPolicy](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disablebackgroundpolicy) +- [ADMX_GroupPolicy/DisableLGPOProcessing](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disablelgpoprocessing) +- [ADMX_GroupPolicy/DisableUsersFromMachGP](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableusersfrommachgp) +- [ADMX_GroupPolicy/EnableCDP](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablecdp) +- [ADMX_GroupPolicy/EnableLogonOptimization](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablelogonoptimization) +- [ADMX_GroupPolicy/EnableLogonOptimizationOnServerSKU](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablelogonoptimizationonserversku) +- [ADMX_GroupPolicy/EnableMMX](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablemmx) +- [ADMX_GroupPolicy/EnforcePoliciesOnly](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enforcepoliciesonly) +- [ADMX_GroupPolicy/FontMitigation](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-fontmitigation) +- [ADMX_GroupPolicy/GPDCOptions](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-gpdcoptions) +- [ADMX_GroupPolicy/GPTransferRate_1](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-gptransferrate-1) +- [ADMX_GroupPolicy/GPTransferRate_2](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-gptransferrate-2) +- [ADMX_GroupPolicy/GroupPolicyRefreshRate](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshrate) +- [ADMX_GroupPolicy/GroupPolicyRefreshRateDC](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshratedc) +- [ADMX_GroupPolicy/GroupPolicyRefreshRateUser](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshrateuser) +- [ADMX_GroupPolicy/LogonScriptDelay](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-logonscriptdelay) +- [ADMX_GroupPolicy/NewGPODisplayName](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-newgpodisplayname) +- [ADMX_GroupPolicy/NewGPOLinksDisabled](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-newgpolinksdisabled) +- [ADMX_GroupPolicy/OnlyUseLocalAdminFiles](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-onlyuselocaladminfiles) +- [ADMX_GroupPolicy/ProcessMitigationOptions](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-processmitigationoptions) +- [ADMX_GroupPolicy/RSoPLogging](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-rsoplogging) +- [ADMX_GroupPolicy/ResetDfsClientInfoDuringRefreshPolicy](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-resetdfsclientinfoduringrefreshpolicy) +- [ADMX_GroupPolicy/SlowLinkDefaultForDirectAccess](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-slowlinkdefaultfordirectaccess) +- [ADMX_GroupPolicy/SlowlinkDefaultToAsync](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-slowlinkdefaulttoasync) +- [ADMX_GroupPolicy/SyncWaitTime](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-syncwaittime) +- [ADMX_GroupPolicy/UserPolicyMode](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-userpolicymode) +- [ADMX_Help/DisableHHDEP](./policy-csp-admx-help.md#admx-help-disablehhdep) +- [ADMX_Help/HelpQualifiedRootDir_Comp](./policy-csp-admx-help.md#admx-help-helpqualifiedrootdir-comp) +- [ADMX_Help/RestrictRunFromHelp](./policy-csp-admx-help.md#admx-help-restrictrunfromhelp) +- [ADMX_Help/RestrictRunFromHelp_Comp](./policy-csp-admx-help.md#admx-help-restrictrunfromhelp-comp) +- [ADMX_HelpAndSupport/ActiveHelp](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-activehelp) +- [ADMX_HelpAndSupport/HPExplicitFeedback](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpexplicitfeedback) +- [ADMX_HelpAndSupport/HPImplicitFeedback](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpimplicitfeedback) +- [ADMX_HelpAndSupport/HPOnlineAssistance](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hponlineassistance) +- [ADMX_ICM/CEIPEnable](./policy-csp-admx-icm.md#admx-icm-ceipenable) +- [ADMX_ICM/CertMgr_DisableAutoRootUpdates](./policy-csp-admx-icm.md#admx-icm-certmgr-disableautorootupdates) +- [ADMX_ICM/DisableHTTPPrinting_1](./policy-csp-admx-icm.md#admx-icm-disablehttpprinting-1) +- [ADMX_ICM/DisableWebPnPDownload_1](./policy-csp-admx-icm.md#admx-icm-disablewebpnpdownload-1) +- [ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate](./policy-csp-admx-icm.md#admx-icm-driversearchplaces-dontsearchwindowsupdate) +- [ADMX_ICM/EventViewer_DisableLinks](./policy-csp-admx-icm.md#admx-icm-eventviewer-disablelinks) +- [ADMX_ICM/HSS_HeadlinesPolicy](./policy-csp-admx-icm.md#admx-icm-hss-headlinespolicy) +- [ADMX_ICM/HSS_KBSearchPolicy](./policy-csp-admx-icm.md#admx-icm-hss-kbsearchpolicy) +- [ADMX_ICM/InternetManagement_RestrictCommunication_1](./policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-1) +- [ADMX_ICM/InternetManagement_RestrictCommunication_2](./policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-2) +- [ADMX_ICM/NC_ExitOnISP](./policy-csp-admx-icm.md#admx-icm-nc-exitonisp) +- [ADMX_ICM/NC_NoRegistration](./policy-csp-admx-icm.md#admx-icm-nc-noregistration) +- [ADMX_ICM/PCH_DoNotReport](./policy-csp-admx-icm.md#admx-icm-pch-donotreport) +- [ADMX_ICM/RemoveWindowsUpdate_ICM](./policy-csp-admx-icm.md#admx-icm-removewindowsupdate-icm) +- [ADMX_ICM/SearchCompanion_DisableFileUpdates](./policy-csp-admx-icm.md#admx-icm-searchcompanion-disablefileupdates) +- [ADMX_ICM/ShellNoUseInternetOpenWith_1](./policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-1) +- [ADMX_ICM/ShellNoUseInternetOpenWith_2](./policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-2) +- [ADMX_ICM/ShellNoUseStoreOpenWith_1](./policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-1) +- [ADMX_ICM/ShellNoUseStoreOpenWith_2](./policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-2) +- [ADMX_ICM/ShellPreventWPWDownload_1](./policy-csp-admx-icm.md#admx-icm-shellpreventwpwdownload-1) +- [ADMX_ICM/ShellRemoveOrderPrints_1](./policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-1) +- [ADMX_ICM/ShellRemoveOrderPrints_2](./policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-2) +- [ADMX_ICM/ShellRemovePublishToWeb_1](./policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-1) +- [ADMX_ICM/ShellRemovePublishToWeb_2](./policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-2) +- [ADMX_ICM/WinMSG_NoInstrumentation_1](./policy-csp-admx-icm.md#admx-icm-winmsg_noinstrumentation-1) +- [ADMX_ICM/WinMSG_NoInstrumentation_2](./policy-csp-admx-icm.md#admx-icm-winmsg_noinstrumentation-2) +- [ADMX_kdc/CbacAndArmor](./policy-csp-admx-kdc.md#admx-kdc-cbacandarmor) +- [ADMX_kdc/ForestSearch](./policy-csp-admx-kdc.md#admx-kdc-forestsearch) +- [ADMX_kdc/PKINITFreshness](./policy-csp-admx-kdc.md#admx-kdc-pkinitfreshness) +- [ADMX_kdc/RequestCompoundId](./policy-csp-admx-kdc.md#admx-kdc-requestcompoundid) +- [ADMX_kdc/TicketSizeThreshold](./policy-csp-admx-kdc.md#admx-kdc-ticketsizethreshold) +- [ADMX_kdc/emitlili](./policy-csp-admx-kdc.md#admx-kdc-emitlili) +- [ADMX_Kerberos/AlwaysSendCompoundId](./policy-csp-admx-kerberos.md#admx-kerberos-alwayssendcompoundid) +- [ADMX_Kerberos/DevicePKInitEnabled](./policy-csp-admx-kerberos.md#admx-kerberos-devicepkinitenabled) +- [ADMX_Kerberos/HostToRealm](./policy-csp-admx-kerberos.md#admx-kerberos-hosttorealm) +- [ADMX_Kerberos/KdcProxyDisableServerRevocationCheck](./policy-csp-admx-kerberos.md#admx-kerberos-kdcproxydisableserverrevocationcheck) +- [ADMX_Kerberos/KdcProxyServer](./policy-csp-admx-kerberos.md#admx-kerberos-kdcproxyserver) +- [ADMX_Kerberos/MitRealms](./policy-csp-admx-kerberos.md#admx-kerberos-mitrealms) +- [ADMX_Kerberos/ServerAcceptsCompound](./policy-csp-admx-kerberos.md#admx-kerberos-serveracceptscompound) +- [ADMX_Kerberos/StrictTarget](./policy-csp-admx-kerberos.md#admx-kerberos-stricttarget) +- [ADMX_LanmanServer/Pol_CipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-ciphersuiteorder) +- [ADMX_LanmanServer/Pol_HashPublication](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashpublication) +- [ADMX_LanmanServer/Pol_HashSupportVersion](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashsupportversion) +- [ADMX_LanmanServer/Pol_HonorCipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-honorciphersuiteorder) +- [ADMX_LanmanWorkstation/Pol_CipherSuiteOrder](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-ciphersuiteorder) +- [ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enablehandlecachingforcafiles) +- [ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enableofflinefilesforcashares) +- [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablelltdio) +- [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablerspndr) +- [ADMX_Logon/BlockUserFromShowingAccountDetailsOnSignin](./policy-csp-admx-logon.md#admx-logon-blockuserfromshowingaccountdetailsonsignin) +- [ADMX_Logon/DisableAcrylicBackgroundOnLogon](./policy-csp-admx-logon.md#admx-logon-disableacrylicbackgroundonlogon) +- [ADMX_Logon/DisableExplorerRunLegacy_1](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-1) +- [ADMX_Logon/DisableExplorerRunLegacy_2](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-2) +- [ADMX_Logon/DisableExplorerRunOnceLegacy_1](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunoncelegacy-1) +- [ADMX_Logon/DisableExplorerRunOnceLegacy_2](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunoncelegacy-2) +- [ADMX_Logon/DisableStatusMessages](./policy-csp-admx-logon.md#admx-logon-disablestatusmessages) +- [ADMX_Logon/DontEnumerateConnectedUsers](./policy-csp-admx-logon.md#admx-logon-dontenumerateconnectedusers) +- [ADMX_Logon/NoWelcomeTips_1](./policy-csp-admx-logon.md#admx-logon-nowelcometips-1) +- [ADMX_Logon/NoWelcomeTips_2](./policy-csp-admx-logon.md#admx-logon-nowelcometips-2) +- [ADMX_Logon/Run_1](./policy-csp-admx-logon.md#admx-logon-run-1) +- [ADMX_Logon/Run_2](./policy-csp-admx-logon.md#admx-logon-run-2) +- [ADMX_Logon/SyncForegroundPolicy](./policy-csp-admx-logon.md#admx-logon-syncforegroundpolicy) +- [ADMX_Logon/UseOEMBackground](./policy-csp-admx-logon.md#admx-logon-useoembackground) +- [ADMX_Logon/VerboseStatus](./policy-csp-admx-logon.md#admx-logon-verbosestatus) +- [ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-allowfastservicestartup) +- [ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableantispywaredefender) +- [ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableautoexclusions) +- [ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableblockatfirstseen) +- [ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablelocaladminmerge) +- [ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablerealtimemonitoring) +- [ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableroutinelytakingaction) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-extensions) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-paths) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-processes) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-asronlyexclusions) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-rules) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-allowedapplications) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-protectedfolders) +- [ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-mpengine-enablefilehashcomputation) +- [ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-disablesignatureretirement) +- [ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-sku-differentiation-signature-set-guid) +- [ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-disableprotocolrecognition) +- [ADMX_MicrosoftDefenderAntivirus/ProxyBypass](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxybypass) +- [ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxypacurl) +- [ADMX_MicrosoftDefenderAntivirus/ProxyServer](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxyserver) +- [ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-localsettingoverridepurgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-purgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-randomizescheduletasktimes) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablebehaviormonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableioavprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableonaccessprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablerawwritenotification) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablescanonrealtimeenable) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-ioavmaxsize) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablebehaviormonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableioavprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableonaccessprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablerealtimemonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverriderealtimescandirection) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-localsettingoverridescan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-additionalactiontimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-criticalfailuretimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disableenhancednotifications) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disablegenericreports) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-noncriticaltimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-recentlycleanedtimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracingcomponents) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracinglevel) +- [ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-allowpause) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxdepth) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxsize) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablearchivescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableemailscanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableheuristics) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablepackedexescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableremovabledrivescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablereparsepointscanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablerestorepoint) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningmappednetworkdrivesforfullscan) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningnetworkfiles) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideavgcpuloadfactor) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescanparameters) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideschedulequickscantime) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-lowcpupriority) +- [ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-missedscheduledscancountbeforecatchup) +- [ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-purgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-quickscaninterval) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scanonlyifidle) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-servicekeepalive) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-assignaturedue) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-avsignaturedue) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-definitionupdatefilesharessources) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescanonupdate) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescheduledsignatureupdateonbattery) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disableupdateonstartupwithoutengine) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-fallbackorder) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-forceupdatefrommu) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-realtimesignaturedelivery) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-sharedsignatureslocation) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signaturedisablenotification) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signatureupdatecatchupinterval) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-updateonstartup) +- [ADMX_MicrosoftDefenderAntivirus/SpynetReporting](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynetreporting) +- [ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynet-localsettingoverridespynetreporting) +- [ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-threats-threatiddefaultaction) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-customdefaultactiontoaststring) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-notification-suppress) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-suppressrebootnotification) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-uilockdown) +- [ADMX_MMC/MMC_ActiveXControl](./policy-csp-admx-mmc.md#admx-mmc-mmc-activexcontrol) +- [ADMX_MMC/MMC_ExtendView](./policy-csp-admx-mmc.md#admx-mmc-mmc-extendview) +- [ADMX_MMC/MMC_LinkToWeb](./policy-csp-admx-mmc.md#admx-mmc-mmc-linktoweb) +- [ADMX_MMC/MMC_Restrict_Author](./policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-author) +- [ADMX_MMC/MMC_Restrict_To_Permitted_Snapins](./policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-to-permitted-snapins) +- [ADMX_MMCSnapins/MMC_ADMComputers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-1) +- [ADMX_MMCSnapins/MMC_ADMComputers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-2) +- [ADMX_MMCSnapins/MMC_ADMUsers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-1) +- [ADMX_MMCSnapins/MMC_ADMUsers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-2) +- [ADMX_MMCSnapins/MMC_ADSI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-adsi) +- [ADMX_MMCSnapins/MMC_ActiveDirDomTrusts](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirdomtrusts) +- [ADMX_MMCSnapins/MMC_ActiveDirSitesServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirsitesservices) +- [ADMX_MMCSnapins/MMC_ActiveDirUsersComp](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activediruserscomp) +- [ADMX_MMCSnapins/MMC_AppleTalkRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-appletalkrouting) +- [ADMX_MMCSnapins/MMC_AuthMan](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-authman) +- [ADMX_MMCSnapins/MMC_CertAuth](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauth) +- [ADMX_MMCSnapins/MMC_CertAuthPolSet](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauthpolset) +- [ADMX_MMCSnapins/MMC_Certs](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certs) +- [ADMX_MMCSnapins/MMC_CertsTemplate](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certstemplate) +- [ADMX_MMCSnapins/MMC_ComponentServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-componentservices) +- [ADMX_MMCSnapins/MMC_ComputerManagement](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-computermanagement) +- [ADMX_MMCSnapins/MMC_ConnectionSharingNAT](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-connectionsharingnat) +- [ADMX_MMCSnapins/MMC_DCOMCFG](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dcomcfg) +- [ADMX_MMCSnapins/MMC_DFS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dfs) +- [ADMX_MMCSnapins/MMC_DHCPRelayMgmt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dhcprelaymgmt) +- [ADMX_MMCSnapins/MMC_DeviceManager_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-1) +- [ADMX_MMCSnapins/MMC_DeviceManager_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-2) +- [ADMX_MMCSnapins/MMC_DiskDefrag](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskdefrag) +- [ADMX_MMCSnapins/MMC_DiskMgmt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskmgmt) +- [ADMX_MMCSnapins/MMC_EnterprisePKI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-enterprisepki) +- [ADMX_MMCSnapins/MMC_EventViewer_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-1) +- [ADMX_MMCSnapins/MMC_EventViewer_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-2) +- [ADMX_MMCSnapins/MMC_EventViewer_3](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-3) +- [ADMX_MMCSnapins/MMC_EventViewer_4](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-4) +- [ADMX_MMCSnapins/MMC_FAXService](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-faxservice) +- [ADMX_MMCSnapins/MMC_FailoverClusters](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-failoverclusters) +- [ADMX_MMCSnapins/MMC_FolderRedirection_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-1) +- [ADMX_MMCSnapins/MMC_FolderRedirection_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-2) +- [ADMX_MMCSnapins/MMC_FrontPageExt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-frontpageext) +- [ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicymanagementsnapin) +- [ADMX_MMCSnapins/MMC_GroupPolicySnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicysnapin) +- [ADMX_MMCSnapins/MMC_GroupPolicyTab](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicytab) +- [ADMX_MMCSnapins/MMC_HRA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-hra) +- [ADMX_MMCSnapins/MMC_IAS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ias) +- [ADMX_MMCSnapins/MMC_IASLogging](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iaslogging) +- [ADMX_MMCSnapins/MMC_IEMaintenance_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-1) +- [ADMX_MMCSnapins/MMC_IEMaintenance_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-2) +- [ADMX_MMCSnapins/MMC_IGMPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-igmprouting) +- [ADMX_MMCSnapins/MMC_IIS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iis) +- [ADMX_MMCSnapins/MMC_IPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iprouting) +- [ADMX_MMCSnapins/MMC_IPSecManage_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage-gp) +- [ADMX_MMCSnapins/MMC_IPXRIPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxriprouting) +- [ADMX_MMCSnapins/MMC_IPXRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxrouting) +- [ADMX_MMCSnapins/MMC_IPXSAPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxsaprouting) +- [ADMX_MMCSnapins/MMC_IndexingService](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-indexingservice) +- [ADMX_MMCSnapins/MMC_IpSecManage](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage) +- [ADMX_MMCSnapins/MMC_IpSecMonitor](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmonitor) +- [ADMX_MMCSnapins/MMC_LocalUsersGroups](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-localusersgroups) +- [ADMX_MMCSnapins/MMC_LogicalMappedDrives](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-logicalmappeddrives) +- [ADMX_MMCSnapins/MMC_NPSUI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-npsui) +- [ADMX_MMCSnapins/MMC_NapSnap](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap) +- [ADMX_MMCSnapins/MMC_NapSnap_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap-gp) +- [ADMX_MMCSnapins/MMC_Net_Framework](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-net-framework) +- [ADMX_MMCSnapins/MMC_OCSP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ocsp) +- [ADMX_MMCSnapins/MMC_OSPFRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ospfrouting) +- [ADMX_MMCSnapins/MMC_PerfLogsAlerts](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-perflogsalerts) +- [ADMX_MMCSnapins/MMC_PublicKey](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-publickey) +- [ADMX_MMCSnapins/MMC_QoSAdmission](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-qosadmission) +- [ADMX_MMCSnapins/MMC_RAS_DialinUser](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ras-dialinuser) +- [ADMX_MMCSnapins/MMC_RIPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-riprouting) +- [ADMX_MMCSnapins/MMC_RIS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ris) +- [ADMX_MMCSnapins/MMC_RRA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rra) +- [ADMX_MMCSnapins/MMC_RSM](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rsm) +- [ADMX_MMCSnapins/MMC_RemStore](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remstore) +- [ADMX_MMCSnapins/MMC_RemoteAccess](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remoteaccess) +- [ADMX_MMCSnapins/MMC_RemoteDesktop](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remotedesktop) +- [ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-resultantsetofpolicysnapin) +- [ADMX_MMCSnapins/MMC_Routing](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-routing) +- [ADMX_MMCSnapins/MMC_SCA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sca) +- [ADMX_MMCSnapins/MMC_SMTPProtocol](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-smtpprotocol) +- [ADMX_MMCSnapins/MMC_SNMP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-snmp) +- [ADMX_MMCSnapins/MMC_ScriptsMachine_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-1) +- [ADMX_MMCSnapins/MMC_ScriptsMachine_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-2) +- [ADMX_MMCSnapins/MMC_ScriptsUser_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-1) +- [ADMX_MMCSnapins/MMC_ScriptsUser_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-2) +- [ADMX_MMCSnapins/MMC_SecuritySettings_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-1) +- [ADMX_MMCSnapins/MMC_SecuritySettings_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-2) +- [ADMX_MMCSnapins/MMC_SecurityTemplates](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitytemplates) +- [ADMX_MMCSnapins/MMC_SendConsoleMessage](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sendconsolemessage) +- [ADMX_MMCSnapins/MMC_ServerManager](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servermanager) +- [ADMX_MMCSnapins/MMC_ServiceDependencies](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servicedependencies) +- [ADMX_MMCSnapins/MMC_Services](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-services) +- [ADMX_MMCSnapins/MMC_SharedFolders](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders) +- [ADMX_MMCSnapins/MMC_SharedFolders_Ext](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders-ext) +- [ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-1) +- [ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-2) +- [ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-1) +- [ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-2) +- [ADMX_MMCSnapins/MMC_SysInfo](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysinfo) +- [ADMX_MMCSnapins/MMC_SysProp](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysprop) +- [ADMX_MMCSnapins/MMC_TPMManagement](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-tpmmanagement) +- [ADMX_MMCSnapins/MMC_Telephony](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-telephony) +- [ADMX_MMCSnapins/MMC_TerminalServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-terminalservices) +- [ADMX_MMCSnapins/MMC_WMI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wmi) +- [ADMX_MMCSnapins/MMC_WindowsFirewall](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall) +- [ADMX_MMCSnapins/MMC_WindowsFirewall_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall-gp) +- [ADMX_MMCSnapins/MMC_WiredNetworkPolicy](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirednetworkpolicy) +- [ADMX_MMCSnapins/MMC_WirelessMon](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessmon) +- [ADMX_MMCSnapins/MMC_WirelessNetworkPolicy](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessnetworkpolicy) +- [ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine](./policy-csp-admx-msapolicy.md#admx-msapolicy-microsoftaccount-disableuserauth) +- [ADMX_msched/ActivationBoundaryPolicy](./policy-csp-admx-msched.md#admx-msched-activationboundarypolicy) +- [ADMX_msched/RandomDelayPolicy](./policy-csp-admx-msched.md#admx-msched-randomdelaypolicy) +- [ADMX_MSDT/MsdtSupportProvider](./policy-csp-admx-msdt.md#admx-msdt-msdtsupportprovider) +- [ADMX_MSDT/MsdtToolDownloadPolicy](./policy-csp-admx-msdt.md#admx-msdt-msdttooldownloadpolicy) +- [ADMX_MSDT/WdiScenarioExecutionPolicy](./policy-csp-admx-msdt.md#admx-msdt-wdiscenarioexecutionpolicy) +- [ADMX_MSI/AllowLockdownBrowse](./policy-csp-admx-msi.md#admx-msi-allowlockdownbrowse) +- [ADMX_MSI/AllowLockdownMedia](./policy-csp-admx-msi.md#admx-msi-allowlockdownmedia) +- [ADMX_MSI/AllowLockdownPatch](./policy-csp-admx-msi.md#admx-msi-allowlockdownpatch) +- [ADMX_MSI/DisableAutomaticApplicationShutdown](./policy-csp-admx-msi.md#admx-msi-disableautomaticapplicationshutdown) +- [ADMX_MSI/DisableBrowse](./policy-csp-admx-msi.md#admx-msi-disablebrowse) +- [ADMX_MSI/DisableFlyweightPatching](./policy-csp-admx-msi.md#admx-msi-disableflyweightpatching) +- [ADMX_MSI/DisableLoggingFromPackage](./policy-csp-admx-msi.md#admx-msi-disableloggingfrompackage) +- [ADMX_MSI/DisableMSI](./policy-csp-admx-msi.md#admx-msi-disablemsi) +- [ADMX_MSI/DisableMedia](./policy-csp-admx-msi.md#admx-msi-disablemedia) +- [ADMX_MSI/DisablePatch](./policy-csp-admx-msi.md#admx-msi-disablepatch) +- [ADMX_MSI/DisableRollback_1](./policy-csp-admx-msi.md#admx-msi-disablerollback-1) +- [ADMX_MSI/DisableRollback_2](./policy-csp-admx-msi.md#admx-msi-disablerollback-2) +- [ADMX_MSI/DisableSharedComponent](./policy-csp-admx-msi.md#admx-msi-disablesharedcomponent) +- [ADMX_MSI/MSILogging](./policy-csp-admx-msi.md#admx-msi-msilogging) +- [ADMX_MSI/MSI_DisableLUAPatching](./policy-csp-admx-msi.md#admx-msi-msi-disableluapatching) +- [ADMX_MSI/MSI_DisablePatchUninstall](./policy-csp-admx-msi.md#admx-msi-msi-disablepatchuninstall) +- [ADMX_MSI/MSI_DisableSRCheckPoints](./policy-csp-admx-msi.md#admx-msi-msi-disablesrcheckpoints) +- [ADMX_MSI/MSI_DisableUserInstalls](./policy-csp-admx-msi.md#admx-msi-msi-disableuserinstalls) +- [ADMX_MSI/MSI_EnforceUpgradeComponentRules](./policy-csp-admx-msi.md#admx-msi-msi-enforceupgradecomponentrules) +- [ADMX_MSI/MSI_MaxPatchCacheSize](./policy-csp-admx-msi.md#admx-msi-msi-maxpatchcachesize) +- [ADMX_MSI/MsiDisableEmbeddedUI](./policy-csp-admx-msi.md#admx-msi-msidisableembeddedui) +- [ADMX_MSI/SafeForScripting](./policy-csp-admx-msi.md#admx-msi-safeforscripting) +- [ADMX_MSI/SearchOrder](./policy-csp-admx-msi.md#admx-msi-searchorder) +- [ADMX_MSI/TransformsSecure](./policy-csp-admx-msi.md#admx-msi-transformssecure) +- [ADMX_nca/CorporateResources](./policy-csp-admx-nca.md#admx-nca-corporateresources) +- [ADMX_nca/CustomCommands](./policy-csp-admx-nca.md#admx-nca-customcommands) +- [ADMX_nca/DTEs](./policy-csp-admx-nca.md#admx-nca-dtes) +- [ADMX_nca/FriendlyName](./policy-csp-admx-nca.md#admx-nca-friendlyname) +- [ADMX_nca/LocalNamesOn](./policy-csp-admx-nca.md#admx-nca-localnameson) +- [ADMX_nca/PassiveMode](./policy-csp-admx-nca.md#admx-nca-passivemode) +- [ADMX_nca/ShowUI](./policy-csp-admx-nca.md#admx-nca-showui) +- [ADMX_nca/SupportEmail](./policy-csp-admx-nca.md#admx-nca-supportemail) +- [ADMX_NCSI/NCSI_CorpDnsProbeContent](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobecontent) +- [ADMX_NCSI/NCSI_CorpDnsProbeHost](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobehost) +- [ADMX_NCSI/NCSI_CorpSitePrefixes](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpsiteprefixes) +- [ADMX_NCSI/NCSI_CorpWebProbeUrl](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpwebprobeurl) +- [ADMX_NCSI/NCSI_DomainLocationDeterminationUrl](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-domainlocationdeterminationurl) +- [ADMX_NCSI/NCSI_GlobalDns](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-globaldns) +- [ADMX_NCSI/NCSI_PassivePolling](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-passivepolling) +- [ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresslookuponpingbehavior) +- [ADMX_Netlogon/Netlogon_AddressTypeReturned](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresstypereturned) +- [ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowdnssuffixsearch) +- [ADMX_Netlogon/Netlogon_AllowNT4Crypto](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allownt4crypto) +- [ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowsinglelabeldnsdomain) +- [ADMX_Netlogon/Netlogon_AutoSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-autositecoverage) +- [ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidfallbacknetbiosdiscovery) +- [ADMX_Netlogon/Netlogon_AvoidPdcOnWan](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidpdconwan) +- [ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryinitialperiod) +- [ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretrymaximumperiod) +- [ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryquittime) +- [ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundsuccessfulrefreshperiod) +- [ADMX_Netlogon/Netlogon_DebugFlag](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-debugflag) +- [ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsavoidregisterrecords) +- [ADMX_Netlogon/Netlogon_DnsRefreshInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsrefreshinterval) +- [ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnssrvrecorduselowercasehostnames) +- [ADMX_Netlogon/Netlogon_DnsTtl](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsttl) +- [ADMX_Netlogon/Netlogon_ExpectedDialupDelay](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-expecteddialupdelay) +- [ADMX_Netlogon/Netlogon_ForceRediscoveryInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-forcerediscoveryinterval) +- [ADMX_Netlogon/Netlogon_GcSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-gcsitecoverage) +- [ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ignoreincomingmailslotmessages) +- [ADMX_Netlogon/Netlogon_LdapSrvPriority](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvpriority) +- [ADMX_Netlogon/Netlogon_LdapSrvWeight](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvweight) +- [ADMX_Netlogon/Netlogon_MaximumLogFileSize](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-maximumlogfilesize) +- [ADMX_Netlogon/Netlogon_NdncSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ndncsitecoverage) +- [ADMX_Netlogon/Netlogon_NegativeCachePeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-negativecacheperiod) +- [ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-netlogonsharecompatibilitymode) +- [ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-nonbackgroundsuccessfulrefreshperiod) +- [ADMX_Netlogon/Netlogon_PingUrgencyMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-pingurgencymode) +- [ADMX_Netlogon/Netlogon_ScavengeInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-scavengeinterval) +- [ADMX_Netlogon/Netlogon_SiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitecoverage) +- [ADMX_Netlogon/Netlogon_SiteName](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitename) +- [ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sysvolsharecompatibilitymode) +- [ADMX_Netlogon/Netlogon_TryNextClosestSite](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-trynextclosestsite) +- [ADMX_Netlogon/Netlogon_UseDynamicDns](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-usedynamicdns) +- [ADMX_NetworkConnections/NC_AddRemoveComponents](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-addremovecomponents) +- [ADMX_NetworkConnections/NC_AdvancedSettings](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-advancedsettings) +- [ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-allowadvancedtcpipconfig) +- [ADMX_NetworkConnections/NC_ChangeBindState](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-changebindstate) +- [ADMX_NetworkConnections/NC_DeleteAllUserConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deletealluserconnection) +- [ADMX_NetworkConnections/NC_DeleteConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deleteconnection) +- [ADMX_NetworkConnections/NC_DialupPrefs](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-dialupprefs) +- [ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-donotshowlocalonlyicon) +- [ADMX_NetworkConnections/NC_EnableAdminProhibits](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-enableadminprohibits) +- [ADMX_NetworkConnections/NC_ForceTunneling](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-forcetunneling) +- [ADMX_NetworkConnections/NC_IpStateChecking](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-ipstatechecking) +- [ADMX_NetworkConnections/NC_LanChangeProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanchangeproperties) +- [ADMX_NetworkConnections/NC_LanConnect](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanconnect) +- [ADMX_NetworkConnections/NC_LanProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanproperties) +- [ADMX_NetworkConnections/NC_NewConnectionWizard](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-newconnectionwizard) +- [ADMX_NetworkConnections/NC_PersonalFirewallConfig](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-personalfirewallconfig) +- [ADMX_NetworkConnections/NC_RasAllUserProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasalluserproperties) +- [ADMX_NetworkConnections/NC_RasChangeProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-raschangeproperties) +- [ADMX_NetworkConnections/NC_RasConnect](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasconnect) +- [ADMX_NetworkConnections/NC_RasMyProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasmyproperties) +- [ADMX_NetworkConnections/NC_RenameAllUserRasConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamealluserrasconnection) +- [ADMX_NetworkConnections/NC_RenameConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renameconnection) +- [ADMX_NetworkConnections/NC_RenameLanConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamelanconnection) +- [ADMX_NetworkConnections/NC_RenameMyRasConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamemyrasconnection) +- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) +- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) +- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) +- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) +- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) +- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2) +- [ADMX_OfflineFiles/Pol_BackgroundSyncSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-backgroundsyncsettings) +- [ADMX_OfflineFiles/Pol_CacheSize](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-cachesize) +- [ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-1) +- [ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-2) +- [ADMX_OfflineFiles/Pol_DefCacheSize](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-defcachesize) +- [ADMX_OfflineFiles/Pol_Enabled](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-enabled) +- [ADMX_OfflineFiles/Pol_EncryptOfflineFiles](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-encryptofflinefiles) +- [ADMX_OfflineFiles/Pol_EventLoggingLevel_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-1) +- [ADMX_OfflineFiles/Pol_EventLoggingLevel_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-2) +- [ADMX_OfflineFiles/Pol_ExclusionListSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-exclusionlistsettings) +- [ADMX_OfflineFiles/Pol_ExtExclusionList](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-extexclusionlist) +- [ADMX_OfflineFiles/Pol_GoOfflineAction_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-1) +- [ADMX_OfflineFiles/Pol_GoOfflineAction_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-2) +- [ADMX_OfflineFiles/Pol_NoCacheViewer_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-1) +- [ADMX_OfflineFiles/Pol_NoCacheViewer_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-2) +- [ADMX_OfflineFiles/Pol_NoConfigCache_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-1) +- [ADMX_OfflineFiles/Pol_NoConfigCache_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-2) +- [ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-1) +- [ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-2) +- [ADMX_OfflineFiles/Pol_NoPinFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-1) +- [ADMX_OfflineFiles/Pol_NoPinFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-2) +- [ADMX_OfflineFiles/Pol_NoReminders_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-1) +- [ADMX_OfflineFiles/Pol_NoReminders_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-2) +- [ADMX_OfflineFiles/Pol_OnlineCachingSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-onlinecachingsettings) +- [ADMX_OfflineFiles/Pol_PurgeAtLogoff](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-purgeatlogoff) +- [ADMX_OfflineFiles/Pol_QuickAdimPin](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-quickadimpin) +- [ADMX_OfflineFiles/Pol_ReminderFreq_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-1) +- [ADMX_OfflineFiles/Pol_ReminderFreq_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-2) +- [ADMX_OfflineFiles/Pol_ReminderInitTimeout_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-1) +- [ADMX_OfflineFiles/Pol_ReminderInitTimeout_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-2) +- [ADMX_OfflineFiles/Pol_ReminderTimeout_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-1) +- [ADMX_OfflineFiles/Pol_ReminderTimeout_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-2) +- [ADMX_OfflineFiles/Pol_SlowLinkSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinksettings) +- [ADMX_OfflineFiles/Pol_SlowLinkSpeed](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinkspeed) +- [ADMX_OfflineFiles/Pol_SyncAtLogoff_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-1) +- [ADMX_OfflineFiles/Pol_SyncAtLogoff_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-2) +- [ADMX_OfflineFiles/Pol_SyncAtLogon_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-1) +- [ADMX_OfflineFiles/Pol_SyncAtLogon_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-2) +- [ADMX_OfflineFiles/Pol_SyncAtSuspend_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-1) +- [ADMX_OfflineFiles/Pol_SyncAtSuspend_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-2) +- [ADMX_OfflineFiles/Pol_SyncOnCostedNetwork](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-synconcostednetwork) +- [ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-1) +- [ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-2) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-distributed) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hosted) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedcachediscovery) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedmultipleservers) +- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-smb) +- [ADMX_PeerToPeerCaching/SetCachePercent](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setcachepercent) +- [ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdatacacheentrymaxage) +- [ADMX_PeerToPeerCaching/SetDowngrading](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdowngrading) +- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-1) +- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-2) +- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-3) +- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-4) +- [ADMX_Power/ACConnectivityInStandby_2](./policy-csp-admx-power.md#admx-power-acconnectivityinstandby-2) +- [ADMX_Power/ACCriticalSleepTransitionsDisable_2](./policy-csp-admx-power.md#admx-power-accriticalsleeptransitionsdisable-2) +- [ADMX_Power/ACStartMenuButtonAction_2](./policy-csp-admx-power.md#admx-power-acstartmenubuttonaction-2) +- [ADMX_Power/AllowSystemPowerRequestAC](./policy-csp-admx-power.md#admx-power-allowsystempowerrequestac) +- [ADMX_Power/AllowSystemPowerRequestDC](./policy-csp-admx-power.md#admx-power-allowsystempowerrequestdc) +- [ADMX_Power/AllowSystemSleepWithRemoteFilesOpenAC](./policy-csp-admx-power.md#admx-power-allowsystemsleepwithremotefilesopenac) +- [ADMX_Power/AllowSystemSleepWithRemoteFilesOpenDC](./policy-csp-admx-power.md#admx-power-allowsystemsleepwithremotefilesopendc) +- [ADMX_Power/CustomActiveSchemeOverride_2](./policy-csp-admx-power.md#admx-power-customactiveschemeoverride-2) +- [ADMX_Power/DCBatteryDischargeAction0_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargeaction0-2) +- [ADMX_Power/DCBatteryDischargeAction1_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargeaction1-2) +- [ADMX_Power/DCBatteryDischargeLevel0_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargelevel0-2) +- [ADMX_Power/DCBatteryDischargeLevel1UINotification_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargelevel1uinotification-2) +- [ADMX_Power/DCBatteryDischargeLevel1_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargelevel1-2) +- [ADMX_Power/DCConnectivityInStandby_2](./policy-csp-admx-power.md#admx-power-dcconnectivityinstandby-2) +- [ADMX_Power/DCCriticalSleepTransitionsDisable_2](./policy-csp-admx-power.md#admx-power-dccriticalsleeptransitionsdisable-2) +- [ADMX_Power/DCStartMenuButtonAction_2](./policy-csp-admx-power.md#admx-power-dcstartmenubuttonaction-2) +- [ADMX_Power/DiskACPowerDownTimeOut_2](./policy-csp-admx-power.md#admx-power-diskacpowerdowntimeout-2) +- [ADMX_Power/DiskDCPowerDownTimeOut_2](./policy-csp-admx-power.md#admx-power-diskdcpowerdowntimeout-2) +- [ADMX_Power/Dont_PowerOff_AfterShutdown](./policy-csp-admx-power.md#admx-power-dont-poweroff-aftershutdown) +- [ADMX_Power/EnableDesktopSlideShowAC](./policy-csp-admx-power.md#admx-power-enabledesktopslideshowac) +- [ADMX_Power/EnableDesktopSlideShowDC](./policy-csp-admx-power.md#admx-power-enabledesktopslideshowdc) +- [ADMX_Power/InboxActiveSchemeOverride_2](./policy-csp-admx-power.md#admx-power-inboxactiveschemeoverride-2) +- [ADMX_Power/PW_PromptPasswordOnResume](./policy-csp-admx-power.md#admx-power-pw-promptpasswordonresume) +- [ADMX_Power/PowerThrottlingTurnOff](./policy-csp-admx-power.md#admx-power-powerthrottlingturnoff) +- [ADMX_Power/ReserveBatteryNotificationLevel](./policy-csp-admx-power.md#admx-power-reservebatterynotificationlevel) +- [ADMX_PowerShellExecutionPolicy/EnableModuleLogging](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablemodulelogging) +- [ADMX_PowerShellExecutionPolicy/EnableScripts](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) +- [ADMX_PowerShellExecutionPolicy/EnableTranscripting](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) +- [ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) +- [ADMX_Printing/AllowWebPrinting](./policy-csp-admx-printing.md#admx-printing-allowwebprinting) +- [ADMX_Printing/ApplicationDriverIsolation](./policy-csp-admx-printing.md#admx-printing-applicationdriverisolation) +- [ADMX_Printing/CustomizedSupportUrl](./policy-csp-admx-printing.md#admx-printing-customizedsupporturl) +- [ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate](./policy-csp-admx-printing.md#admx-printing-donotinstallcompatibledriverfromwindowsupdate) +- [ADMX_Printing/DomainPrinters](./policy-csp-admx-printing.md#admx-printing-domainprinters) +- [ADMX_Printing/DownlevelBrowse](./policy-csp-admx-printing.md#admx-printing-downlevelbrowse) +- [ADMX_Printing/EMFDespooling](./policy-csp-admx-printing.md#admx-printing-emfdespooling) +- [ADMX_Printing/ForceSoftwareRasterization](./policy-csp-admx-printing.md#admx-printing-forcesoftwarerasterization) +- [ADMX_Printing/IntranetPrintersUrl](./policy-csp-admx-printing.md#admx-printing-intranetprintersurl) +- [ADMX_Printing/KMPrintersAreBlocked](./policy-csp-admx-printing.md#admx-printing-kmprintersareblocked) +- [ADMX_Printing/LegacyDefaultPrinterMode](./policy-csp-admx-printing.md#admx-printing-legacydefaultprintermode) +- [ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS](./policy-csp-admx-printing.md#admx-printing-mxdwuselegacyoutputformatmsxps) +- [ADMX_Printing/NoDeletePrinter](./policy-csp-admx-printing.md#admx-printing-nodeleteprinter) +- [ADMX_Printing/NonDomainPrinters](./policy-csp-admx-printing.md#admx-printing-nondomainprinters) +- [ADMX_Printing/PackagePointAndPrintOnly](./policy-csp-admx-printing.md#admx-printing-packagepointandprintonly) +- [ADMX_Printing/PackagePointAndPrintOnly_Win7](./policy-csp-admx-printing.md#admx-printing-packagepointandprintonly-win7) +- [ADMX_Printing/PackagePointAndPrintServerList](./policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist) +- [ADMX_Printing/PackagePointAndPrintServerList_Win7](./policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist-win7) +- [ADMX_Printing/PhysicalLocation](./policy-csp-admx-printing.md#admx-printing-physicallocation) +- [ADMX_Printing/PhysicalLocationSupport](./policy-csp-admx-printing.md#admx-printing-physicallocationsupport) +- [ADMX_Printing/PrintDriverIsolationExecutionPolicy](./policy-csp-admx-printing.md#admx-printing-printdriverisolationexecutionpolicy +) +- [ADMX_Printing/PrintDriverIsolationOverrideCompat](./policy-csp-admx-printing.md#admx-printing-printdriverisolationoverridecompat) +- [ADMX_Printing/PrinterDirectorySearchScope](./policy-csp-admx-printing.md#admx-printing-printerdirectorysearchscope) +- [ADMX_Printing/PrinterServerThread](./policy-csp-admx-printing.md#admx-printing-printerserverthread) +- [ADMX_Printing/ShowJobTitleInEventLogs](./policy-csp-admx-printing.md#admx-printing-showjobtitleineventlogs) +- [ADMX_Printing/V4DriverDisallowPrinterExtension](./policy-csp-admx-printing.md#admx-printing-v4driverdisallowprinterextension) +- [ADMX_Printing2/AutoPublishing](./policy-csp-admx-printing2.md#admx-printing2-autopublishing) +- [ADMX_Printing2/ImmortalPrintQueue](./policy-csp-admx-printing2.md#admx-printing2-immortalprintqueue) +- [ADMX_Printing2/PruneDownlevel](./policy-csp-admx-printing2.md#admx-printing2-prunedownlevel) +- [ADMX_Printing2/PruningInterval](./policy-csp-admx-printing2.md#admx-printing2-pruninginterval) +- [ADMX_Printing2/PruningPriority](./policy-csp-admx-printing2.md#admx-printing2-pruningpriority) +- [ADMX_Printing2/PruningRetries](./policy-csp-admx-printing2.md#admx-printing2-pruningretries) +- [ADMX_Printing2/PruningRetryLog](./policy-csp-admx-printing2.md#admx-printing2-pruningretrylog) +- [ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint](./policy-csp-admx-printing2.md#admx-printing2-registerspoolerremoterpcendpoint) +- [ADMX_Printing2/VerifyPublishedState](./policy-csp-admx-printing2.md#admx-printing2-verifypublishedstate) +- [ADMX_Programs/NoDefaultPrograms](./policy-csp-admx-programs.md#admx-programs-nodefaultprograms) +- [ADMX_Programs/NoGetPrograms](./policy-csp-admx-programs.md#admx-programs-nogetprograms) +- [ADMX_Programs/NoInstalledUpdates](./policy-csp-admx-programs.md#admx-programs-noinstalledupdates) +- [ADMX_Programs/NoProgramsAndFeatures](./policy-csp-admx-programs.md#admx-programs-noprogramsandfeatures) +- [ADMX_Programs/NoProgramsCPL](./policy-csp-admx-programs.md#admx-programs-noprogramscpl) +- [ADMX_Programs/NoWindowsFeatures](./policy-csp-admx-programs.md#admx-programs-nowindowsfeatures) +- [ADMX_Programs/NoWindowsMarketplace](./policy-csp-admx-programs.md#admx-programs-nowindowsmarketplace) +- [ADMX_Reliability/EE_EnablePersistentTimeStamp](./policy-csp-admx-reliability.md#admx-reliability-ee-enablepersistenttimestamp) +- [ADMX_Reliability/PCH_ReportShutdownEvents](./policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) +- [ADMX_Reliability/ShutdownEventTrackerStateFile](./policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) +- [ADMX_Reliability/ShutdownReason](./policy-csp-admx-reliability.md#admx-reliability-shutdownreason) +- [ADMX_RemoteAssistance/RA_EncryptedTicketOnly](./policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-encryptedticketonly) +- [ADMX_RemoteAssistance/RA_Optimize_Bandwidth](./policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-optimize-bandwidth) +- [ADMX_RemovableStorage/AccessRights_RebootTime_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-1) +- [ADMX_RemovableStorage/AccessRights_RebootTime_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-2) +- [ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyexecute-access-2) +- [ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-1) +- [ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-2) +- [ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-1) +- [ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-2) +- [ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-1) +- [ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-2) +- [ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-1) +- [ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-2) +- [ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyexecute-access-2) +- [ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-1) +- [ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-2) +- [ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-1) +- [ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-2) +- [ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyexecute-access-2) +- [ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-1) +- [ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-2) +- [ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denywrite-access-1) +- [ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-1) +- [ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-2) +- [ADMX_RemovableStorage/Removable_Remote_Allow_Access](./policy-csp-admx-removablestorage.md#admx-removablestorage-removable-remote-allow-access) +- [ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyexecute-access-2) +- [ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-1) +- [ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-2) +- [ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-1) +- [ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-2) +- [ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-1) +- [ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-2) +- [ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-1) +- [ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-2) +- [ADMX_RPC/RpcExtendedErrorInformation](./policy-csp-admx-rpc.md#admx-rpc-rpcextendederrorinformation) +- [ADMX_RPC/RpcIgnoreDelegationFailure](./policy-csp-admx-rpc.md#admx-rpc-rpcignoredelegationfailure) +- [ADMX_RPC/RpcMinimumHttpConnectionTimeout](./policy-csp-admx-rpc.md#admx-rpc-rpcminimumhttpconnectiontimeout) +- [ADMX_RPC/RpcStateInformation](./policy-csp-admx-rpc.md#admx-rpc-rpcstateinformation) +- [ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled](./policy-csp-admx-scripts.md#admx-scripts-allow-logon-script-netbiosdisabled) +- [ADMX_Scripts/MaxGPOScriptWaitPolicy](./policy-csp-admx-scripts.md#admx-scripts-maxgposcriptwaitpolicy) +- [ADMX_Scripts/Run_Computer_PS_Scripts_First](./policy-csp-admx-scripts.md#admx-scripts-run-computer-ps-scripts-first) +- [ADMX_Scripts/Run_Legacy_Logon_Script_Hidden](./policy-csp-admx-scripts.md#admx-scripts-run-legacy-logon-script-hidden) +- [ADMX_Scripts/Run_Logoff_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-logoff-script-visible) +- [ADMX_Scripts/Run_Logon_Script_Sync_1](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-1) +- [ADMX_Scripts/Run_Logon_Script_Sync_2](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-2) +- [ADMX_Scripts/Run_Logon_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-visible) +- [ADMX_Scripts/Run_Shutdown_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-shutdown-script-visible) +- [ADMX_Scripts/Run_Startup_Script_Sync](./policy-csp-admx-scripts.md#admx-scripts-run-startup-script-sync) +- [ADMX_Scripts/Run_Startup_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-startup-script-visible) +- [ADMX_Scripts/Run_User_PS_Scripts_First](./policy-csp-admx-scripts.md#admx-scripts-run-user-ps-scripts-first) +- [ADMX_sdiageng/BetterWhenConnected](./policy-csp-admx-sdiageng.md#admx-sdiageng-betterwhenconnected) +- [ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticsexecutionpolicy) +- [ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticssecuritypolicy) +- [ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain](/policy-csp-admx-securitycenter.md#admx-securitycenter-securitycenter-securitycenterindomain) +- [ADMX_Sensors/DisableLocationScripting_1](./policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-1) +- [ADMX_Sensors/DisableLocationScripting_2](./policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-2) +- [ADMX_Sensors/DisableLocation_1](./policy-csp-admx-sensors.md#admx-sensors-disablelocation-1) +- [ADMX_Sensors/DisableSensors_1](./policy-csp-admx-sensors.md#admx-sensors-disablesensors-1) +- [ADMX_Sensors/DisableSensors_2](./policy-csp-admx-sensors.md#admx-sensors-disablesensors-2) +- [ADMX_Servicing/Servicing](./policy-csp-admx-servicing.md#admx-servicing-servicing) +- [ADMX_SettingSync/DisableAppSyncSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disableappsyncsettingsync) +- [ADMX_SettingSync/DisableApplicationSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disableapplicationsettingsync) +- [ADMX_SettingSync/DisableCredentialsSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablecredentialssettingsync) +- [ADMX_SettingSync/DisableDesktopThemeSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disabledesktopthemesettingsync) +- [ADMX_SettingSync/DisablePersonalizationSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablepersonalizationsettingsync) +- [ADMX_SettingSync/DisableSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablesettingsync) +- [ADMX_SettingSync/DisableStartLayoutSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablestartlayoutsettingsync) +- [ADMX_SettingSync/DisableSyncOnPaidNetwork](./policy-csp-admx-settingsync.md#admx-settingsync-disablesynconpaidnetwork) +- [ADMX_SettingSync/DisableWindowsSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablewindowssettingsync) +- [ADMX_SharedFolders/PublishDfsRoots](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishdfsroots) +- [ADMX_SharedFolders/PublishSharedFolders](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishsharedfolders) +- [ADMX_Sharing/NoInplaceSharing](./policy-csp-admx-sharing.md#admx-sharing-noinplacesharing) +- [ADMX_ShellCommandPromptRegEditTools/DisableCMD](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) +- [ADMX_ShellCommandPromptRegEditTools/DisableRegedit](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disableregedit) +- [ADMX_ShellCommandPromptRegEditTools/DisallowApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disallowapps) +- [ADMX_ShellCommandPromptRegEditTools/RestrictApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) +- [ADMX_SkyDrive/PreventNetworkTrafficPreUserSignIn](./policy-csp-admx-skydrive.md#admx-skydrive-preventnetworktrafficpreusersignin) +- [ADMX_Smartcard/AllowCertificatesWithNoEKU](./policy-csp-admx-smartcard.md#admx-smartcard-allowcertificateswithnoeku) +- [ADMX_Smartcard/AllowIntegratedUnblock](./policy-csp-admx-smartcard.md#admx-smartcard-allowintegratedunblock) +- [ADMX_Smartcard/AllowSignatureOnlyKeys](./policy-csp-admx-smartcard.md#admx-smartcard-allowsignatureonlykeys) +- [ADMX_Smartcard/AllowTimeInvalidCertificates](./policy-csp-admx-smartcard.md#admx-smartcard-allowtimeinvalidcertificates) +- [ADMX_Smartcard/CertPropEnabledString](./policy-csp-admx-smartcard.md#admx-smartcard-certpropenabledstring) +- [ADMX_Smartcard/CertPropRootCleanupString](./policy-csp-admx-smartcard.md#admx-smartcard-certproprootcleanupstring) +- [ADMX_Smartcard/CertPropRootEnabledString](./policy-csp-admx-smartcard.md#admx-smartcard-certproprootenabledstring) +- [ADMX_Smartcard/DisallowPlaintextPin](./policy-csp-admx-smartcard.md#admx-smartcard-disallowplaintextpin) +- [ADMX_Smartcard/EnumerateECCCerts](./policy-csp-admx-smartcard.md#admx-smartcard-enumerateecccerts) +- [ADMX_Smartcard/FilterDuplicateCerts](./policy-csp-admx-smartcard.md#admx-smartcard-filterduplicatecerts) +- [ADMX_Smartcard/ForceReadingAllCertificates](./policy-csp-admx-smartcard.md#admx-smartcard-forcereadingallcertificates) +- [ADMX_Smartcard/IntegratedUnblockPromptString](./policy-csp-admx-smartcard.md#admx-smartcard-integratedunblockpromptstring) +- [ADMX_Smartcard/ReverseSubject](./policy-csp-admx-smartcard.md#admx-smartcard-reversesubject) +- [ADMX_Smartcard/SCPnPEnabled](./policy-csp-admx-smartcard.md#admx-smartcard-scpnpenabled) +- [ADMX_Smartcard/SCPnPNotification](./policy-csp-admx-smartcard.md#admx-smartcard-scpnpnotification) +- [ADMX_Smartcard/X509HintsNeeded](./policy-csp-admx-smartcard.md#admx-smartcard-x509hintsneeded) +- [ADMX_Snmp/SNMP_Communities](./policy-csp-admx-snmp.md#admx-snmp-snmp-communities) +- [ADMX_Snmp/SNMP_PermittedManagers](./policy-csp-admx-snmp.md#admx-snmp-snmp-permittedmanagers) +- [ADMX_Snmp/SNMP_Traps_Public](./policy-csp-admx-snmp.md#admx-snmp-snmp-traps-public) +- [ADMX_StartMenu/AddSearchInternetLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-addsearchinternetlinkinstartmenu) +- [ADMX_StartMenu/ClearRecentDocsOnExit](./policy-csp-admx-startmenu.md#admx-startmenu-clearrecentdocsonexit) +- [ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-clearrecentprogfornewuserinstartmenu) +- [ADMX_StartMenu/ClearTilesOnExit](./policy-csp-admx-startmenu.md#admx-startmenu-cleartilesonexit) +- [ADMX_StartMenu/DesktopAppsFirstInAppsView](./policy-csp-admx-startmenu.md#admx-startmenu-desktopappsfirstinappsview) +- [ADMX_StartMenu/DisableGlobalSearchOnAppsView](./policy-csp-admx-startmenu.md#admx-startmenu-disableglobalsearchonappsview) +- [ADMX_StartMenu/ForceStartMenuLogOff](./policy-csp-admx-startmenu.md#admx-startmenu-forcestartmenulogoff) +- [ADMX_StartMenu/GoToDesktopOnSignIn](./policy-csp-admx-startmenu.md#admx-startmenu-gotodesktoponsignin) +- [ADMX_StartMenu/GreyMSIAds](./policy-csp-admx-startmenu.md#admx-startmenu-greymsiads) +- [ADMX_StartMenu/HidePowerOptions](./policy-csp-admx-startmenu.md#admx-startmenu-hidepoweroptions) +- [ADMX_StartMenu/Intellimenus](./policy-csp-admx-startmenu.md#admx-startmenu-intellimenus) +- [ADMX_StartMenu/LockTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-locktaskbar) +- [ADMX_StartMenu/MemCheckBoxInRunDlg](./policy-csp-admx-startmenu.md#admx-startmenu-memcheckboxinrundlg) +- [ADMX_StartMenu/NoAutoTrayNotify](./policy-csp-admx-startmenu.md#admx-startmenu-noautotraynotify) +- [ADMX_StartMenu/NoBalloonTip](./policy-csp-admx-startmenu.md#admx-startmenu-noballoontip) +- [ADMX_StartMenu/NoChangeStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nochangestartmenu) +- [ADMX_StartMenu/NoClose](./policy-csp-admx-startmenu.md#admx-startmenu-noclose) +- [ADMX_StartMenu/NoCommonGroups](./policy-csp-admx-startmenu.md#admx-startmenu-nocommongroups) +- [ADMX_StartMenu/NoFavoritesMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nofavoritesmenu) +- [ADMX_StartMenu/NoFind](./policy-csp-admx-startmenu.md#admx-startmenu-nofind) +- [ADMX_StartMenu/NoGamesFolderOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nogamesfolderonstartmenu) +- [ADMX_StartMenu/NoHelp](./policy-csp-admx-startmenu.md#admx-startmenu-nohelp) +- [ADMX_StartMenu/NoInstrumentation](./policy-csp-admx-startmenu.md#admx-startmenu-noinstrumentation) +- [ADMX_StartMenu/NoMoreProgramsList](./policy-csp-admx-startmenu.md#admx-startmenu-nomoreprogramslist) +- [ADMX_StartMenu/NoNetAndDialupConnect](./policy-csp-admx-startmenu.md#admx-startmenu-nonetanddialupconnect) +- [ADMX_StartMenu/NoPinnedPrograms](./policy-csp-admx-startmenu.md#admx-startmenu-nopinnedprograms) +- [ADMX_StartMenu/NoRecentDocsMenu](./policy-csp-admx-startmenu.md#admx-startmenu-norecentdocsmenu) +- [ADMX_StartMenu/NoResolveSearch](./policy-csp-admx-startmenu.md#admx-startmenu-noresolvesearch) +- [ADMX_StartMenu/NoResolveTrack](./policy-csp-admx-startmenu.md#admx-startmenu-noresolvetrack) +- [ADMX_StartMenu/NoRun](./policy-csp-admx-startmenu.md#admx-startmenu-norun) +- [ADMX_StartMenu/NoSMConfigurePrograms](./policy-csp-admx-startmenu.md#admx-startmenu-nosmconfigureprograms) +- [ADMX_StartMenu/NoSMMyDocuments](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmydocuments) +- [ADMX_StartMenu/NoSMMyMusic](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmymusic) +- [ADMX_StartMenu/NoSMMyNetworkPlaces](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmynetworkplaces) +- [ADMX_StartMenu/NoSMMyPictures](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmypictures) +- [ADMX_StartMenu/NoSearchCommInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomminstartmenu) +- [ADMX_StartMenu/NoSearchComputerLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomputerlinkinstartmenu) +- [ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearcheverywherelinkinstartmenu) +- [ADMX_StartMenu/NoSearchFilesInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchfilesinstartmenu) +- [ADMX_StartMenu/NoSearchInternetInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchinternetinstartmenu) +- [ADMX_StartMenu/NoSearchProgramsInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchprogramsinstartmenu) +- [ADMX_StartMenu/NoSetFolders](./policy-csp-admx-startmenu.md#admx-startmenu-nosetfolders) +- [ADMX_StartMenu/NoSetTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-nosettaskbar) +- [ADMX_StartMenu/NoStartMenuDownload](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenudownload) +- [ADMX_StartMenu/NoStartMenuHomegroup](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuhomegroup) +- [ADMX_StartMenu/NoStartMenuRecordedTV](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenurecordedtv) +- [ADMX_StartMenu/NoStartMenuSubFolders](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenusubfolders) +- [ADMX_StartMenu/NoStartMenuVideos](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuvideos) +- [ADMX_StartMenu/NoStartPage](./policy-csp-admx-startmenu.md#admx-startmenu-nostartpage) +- [ADMX_StartMenu/NoTaskBarClock](./policy-csp-admx-startmenu.md#admx-startmenu-notaskbarclock) +- [ADMX_StartMenu/NoTaskGrouping](./policy-csp-admx-startmenu.md#admx-startmenu-notaskgrouping) +- [ADMX_StartMenu/NoToolbarsOnTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-notoolbarsontaskbar) +- [ADMX_StartMenu/NoTrayContextMenu](./policy-csp-admx-startmenu.md#admx-startmenu-notraycontextmenu) +- [ADMX_StartMenu/NoTrayItemsDisplay](./policy-csp-admx-startmenu.md#admx-startmenu-notrayitemsdisplay) +- [ADMX_StartMenu/NoUninstallFromStart](./policy-csp-admx-startmenu.md#admx-startmenu-nouninstallfromstart) +- [ADMX_StartMenu/NoUserFolderOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nouserfolderonstartmenu) +- [ADMX_StartMenu/NoUserNameOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nousernameonstartmenu) +- [ADMX_StartMenu/NoWindowsUpdate](./policy-csp-admx-startmenu.md#admx-startmenu-nowindowsupdate) +- [ADMX_StartMenu/PowerButtonAction](./policy-csp-admx-startmenu.md#admx-startmenu-powerbuttonaction) +- [ADMX_StartMenu/QuickLaunchEnabled](./policy-csp-admx-startmenu.md#admx-startmenu-quicklaunchenabled) +- [ADMX_StartMenu/RemoveUnDockPCButton](./policy-csp-admx-startmenu.md#admx-startmenu-removeundockpcbutton) +- [ADMX_StartMenu/ShowAppsViewOnStart](./policy-csp-admx-startmenu.md#admx-startmenu-showappsviewonstart) +- [ADMX_StartMenu/ShowRunAsDifferentUserInStart](./policy-csp-admx-startmenu.md#admx-startmenu-showrunasdifferentuserinstart) +- [ADMX_StartMenu/ShowRunInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-showruninstartmenu) +- [ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey](./policy-csp-admx-startmenu.md#admx-startmenu-showstartondisplaywithforegroundonwinkey) +- [ADMX_StartMenu/StartMenuLogOff](./policy-csp-admx-startmenu.md#admx-startmenu-startmenulogoff) +- [ADMX_StartMenu/StartPinAppsWhenInstalled](./policy-csp-admx-startmenu.md#admx-startmenu-startpinappswheninstalled) +- [ADMX_SystemRestore/SR_DisableConfig](./policy-csp-admx-systemrestore.md#admx-systemrestore-sr-disableconfig) +- [ADMX_Taskbar/DisableNotificationCenter](./policy-csp-admx-taskbar.md#admx-taskbar-disablenotificationcenter) +- [ADMX_Taskbar/EnableLegacyBalloonNotifications](./policy-csp-admx-taskbar.md#admx-taskbar-enablelegacyballoonnotifications) +- [ADMX_Taskbar/HideSCAHealth](./policy-csp-admx-taskbar.md#admx-taskbar-hidescahealth) +- [ADMX_Taskbar/HideSCANetwork](./policy-csp-admx-taskbar.md#admx-taskbar-hidescanetwork) +- [ADMX_Taskbar/HideSCAPower](./policy-csp-admx-taskbar.md#admx-taskbar-hidescapower) +- [ADMX_Taskbar/HideSCAVolume](./policy-csp-admx-taskbar.md#admx-taskbar-hidescavolume) +- [ADMX_Taskbar/NoBalloonFeatureAdvertisements](./policy-csp-admx-taskbar.md#admx-taskbar-noballoonfeatureadvertisements) +- [ADMX_Taskbar/NoPinningStoreToTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningstoretotaskbar) +- [ADMX_Taskbar/NoPinningToDestinations](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningtodestinations) +- [ADMX_Taskbar/NoPinningToTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningtotaskbar) +- [ADMX_Taskbar/NoRemoteDestinations](./policy-csp-admx-taskbar.md#admx-taskbar-noremotedestinations) +- [ADMX_Taskbar/NoSystraySystemPromotion](./policy-csp-admx-taskbar.md#admx-taskbar-nosystraysystempromotion) +- [ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-showwindowsstoreappsontaskbar) +- [ADMX_Taskbar/TaskbarLockAll](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarlockall) +- [ADMX_Taskbar/TaskbarNoAddRemoveToolbar](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoaddremovetoolbar) +- [ADMX_Taskbar/TaskbarNoDragToolbar](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnodragtoolbar) +- [ADMX_Taskbar/TaskbarNoMultimon](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnomultimon) +- [ADMX_Taskbar/TaskbarNoNotification](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnonotification) +- [ADMX_Taskbar/TaskbarNoPinnedList](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnopinnedlist) +- [ADMX_Taskbar/TaskbarNoRedock](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoredock) +- [ADMX_Taskbar/TaskbarNoResize](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoresize) +- [ADMX_Taskbar/TaskbarNoThumbnail](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnothumbnail) +- [ADMX_tcpip/6to4_Router_Name](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name) +- [ADMX_tcpip/6to4_Router_Name_Resolution_Interval](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name-resolution-interval) +- [ADMX_tcpip/6to4_State](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-state) +- [ADMX_tcpip/IPHTTPS_ClientState](./policy-csp-admx-tcpip.md#admx-tcpip-iphttps-clientstate) +- [ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State](./policy-csp-admx-tcpip.md#admx-tcpip-ip-stateless-autoconfiguration-limits-state) +- [ADMX_tcpip/ISATAP_Router_Name](./policy-csp-admx-tcpip.md#admx-tcpip-isatap-router-name) +- [ADMX_tcpip/ISATAP_State](./policy-csp-admx-tcpip.md#admx-tcpip-isatap-state) +- [ADMX_tcpip/Teredo_Client_Port](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-client-port) +- [ADMX_tcpip/Teredo_Default_Qualified](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-default-qualified) +- [ADMX_tcpip/Teredo_Refresh_Rate](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-refresh-rate) +- [ADMX_tcpip/Teredo_Server_Name](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-server-name) +- [ADMX_tcpip/Teredo_State](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-state) +- [ADMX_tcpip/Windows_Scaling_Heuristics_State](./policy-csp-admx-tcpip.md#admx-tcpip-windows-scaling-heuristics-state) +- [ADMX_Thumbnails/DisableThumbnails](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnails) +- [ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnailsonnetworkfolders) +- [ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbsdbonnetworkfolders) +- [ADMX_TPM/BlockedCommandsList_Name](./policy-csp-admx-tpm.md#admx-tpm-blockedcommandslist-name) +- [ADMX_TPM/ClearTPMIfNotReady_Name](./policy-csp-admx-tpm.md#admx-tpm-cleartpmifnotready-name) +- [ADMX_TPM/IgnoreDefaultList_Name](./policy-csp-admx-tpm.md#admx-tpm-ignoredefaultlist-name) +- [ADMX_TPM/IgnoreLocalList_Name](./policy-csp-admx-tpm.md#admx-tpm-ignorelocallist-name) +- [ADMX_TPM/OSManagedAuth_Name](./policy-csp-admx-tpm.md#admx-tpm-osmanagedauth-name) +- [ADMX_TPM/OptIntoDSHA_Name](./policy-csp-admx-tpm.md#admx-tpm-optintodsha-name) +- [ADMX_TPM/StandardUserAuthorizationFailureDuration_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureduration-name) +- [ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureindividualthreshold-name) +- [ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailuretotalthreshold-name) +- [ADMX_TPM/UseLegacyDAP_Name](./policy-csp-admx-tpm.md#admx-tpm-uselegacydap-name) +- [ADMX_UserExperienceVirtualization/Calculator](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-calculator) +- [ADMX_UserExperienceVirtualization/ConfigureSyncMethod](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configuresyncmethod) +- [ADMX_UserExperienceVirtualization/ConfigureVdi](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configurevdi) +- [ADMX_UserExperienceVirtualization/ContactITDescription](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactitdescription) +- [ADMX_UserExperienceVirtualization/ContactITUrl](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactiturl) +- [ADMX_UserExperienceVirtualization/DisableWin8Sync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewin8sync) +- [ADMX_UserExperienceVirtualization/DisableWindowsOSSettings](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewindowsossettings) +- [ADMX_UserExperienceVirtualization/EnableUEV](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-enableuev) +- [ADMX_UserExperienceVirtualization/Finance](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-finance) +- [ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-firstusenotificationenabled) +- [ADMX_UserExperienceVirtualization/Games](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-games) +- [ADMX_UserExperienceVirtualization/InternetExplorer8](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer8) +- [ADMX_UserExperienceVirtualization/InternetExplorer9](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer9) +- [ADMX_UserExperienceVirtualization/InternetExplorer10](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer10) +- [ADMX_UserExperienceVirtualization/InternetExplorer11](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer11) +- [ADMX_UserExperienceVirtualization/InternetExplorerCommon](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorercommon) +- [ADMX_UserExperienceVirtualization/Maps](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maps) +- [ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maxpackagesizeinbytes) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010access) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010common) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010excel) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010infopath) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010lync) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010onenote) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010outlook) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010powerpoint) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010project) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010publisher) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointdesigner) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointworkspace) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010visio) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010word) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013access) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013accessbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013common) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013commonbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excel) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excelbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopath) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopathbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lync) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lyncbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onedriveforbusiness) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenote) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenotebackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlook) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlookbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpoint) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpointbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013project) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013projectbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisher) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisherbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesigner) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesignerbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013uploadcenter) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visio) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visiobackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013word) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013wordbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016access) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016accessbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016common) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016commonbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excel) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excelbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lync) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lyncbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onedriveforbusiness) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenote) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenotebackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlook) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlookbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpoint) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpointbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016project) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016projectbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisher) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisherbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016uploadcenter) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visio) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visiobackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016word) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016wordbackup) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365infopath2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365sharepointdesigner2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2016) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2013) +- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2016) +- [ADMX_UserExperienceVirtualization/Music](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-music) +- [ADMX_UserExperienceVirtualization/News](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-news) +- [ADMX_UserExperienceVirtualization/Notepad](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-notepad) +- [ADMX_UserExperienceVirtualization/Reader](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-reader) +- [ADMX_UserExperienceVirtualization/RepositoryTimeout](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-repositorytimeout) +- [ADMX_UserExperienceVirtualization/SettingsStoragePath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingsstoragepath) +- [ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingstemplatecatalogpath) +- [ADMX_UserExperienceVirtualization/Sports](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-sports) +- [ADMX_UserExperienceVirtualization/SyncEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncenabled) +- [ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetwork) +- [ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetworkwhenroaming) +- [ADMX_UserExperienceVirtualization/SyncProviderPingEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncproviderpingenabled) +- [ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncunlistedwindows8apps) +- [ADMX_UserExperienceVirtualization/Travel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-travel) +- [ADMX_UserExperienceVirtualization/TrayIconEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-trayiconenabled) +- [ADMX_UserExperienceVirtualization/Video](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-video) +- [ADMX_UserExperienceVirtualization/Weather](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-weather) +- [ADMX_UserExperienceVirtualization/Wordpad](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-wordpad) +- [ADMX_UserProfiles/CleanupProfiles](./policy-csp-admx-userprofiles.md#admx-userprofiles-cleanupprofiles) +- [ADMX_UserProfiles/DontForceUnloadHive](./policy-csp-admx-userprofiles.md#admx-userprofiles-dontforceunloadhive) +- [ADMX_UserProfiles/LeaveAppMgmtData](./policy-csp-admx-userprofiles.md#admx-userprofiles-leaveappmgmtdata) +- [ADMX_UserProfiles/LimitSize](./policy-csp-admx-userprofiles.md#admx-userprofiles-limitsize) +- [ADMX_UserProfiles/ProfileErrorAction](./policy-csp-admx-userprofiles.md#admx-userprofiles-profileerroraction) +- [ADMX_UserProfiles/SlowLinkTimeOut](./policy-csp-admx-userprofiles.md#admx-userprofiles-slowlinktimeout) +- [ADMX_UserProfiles/USER_HOME](./policy-csp-admx-userprofiles.md#admx-userprofiles-user-home) +- [ADMX_UserProfiles/UserInfoAccessAction](./policy-csp-admx-userprofiles.md#admx-userprofiles-userinfoaccessaction) +- [ADMX_W32Time/W32TIME_POLICY_CONFIG](./policy-csp-admx-w32time.md#admx-w32time-policy-config) +- [ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT](./policy-csp-admx-w32time.md#admx-w32time-policy-configure-ntpclient) +- [ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT](./policy-csp-admx-w32time.md#admx-w32time-policy-enable-ntpclient) +- [ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER](./policy-csp-admx-w32time.md#admx-w32time-policy-enable-ntpserver) +- [ADMX_WCM/WCM_DisablePowerManagement](./policy-csp-admx-wcm.md#admx-wcm-wcm-disablepowermanagement) +- [ADMX_WCM/WCM_EnableSoftDisconnect](./policy-csp-admx-wcm.md#admx-wcm-wcm-enablesoftdisconnect) +- [ADMX_WCM/WCM_MinimizeConnections](./policy-csp-admx-wcm.md#admx-wcm-wcm-minimizeconnections) +- [ADMX_WinCal/TurnOffWinCal_1](./policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-1) +- [ADMX_WinCal/TurnOffWinCal_2](./policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-2) +- [ADMX_WindowsAnytimeUpgrade/Disabled](./policy-csp-admx-windowsanytimeupgrade.md#admx-windowsanytimeupgrade-disabled) +- [ADMX_WindowsConnectNow/WCN_DisableWcnUi_1](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-1) +- [ADMX_WindowsConnectNow/WCN_DisableWcnUi_2](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-2) +- [ADMX_WindowsConnectNow/WCN_EnableRegistrar](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-enableregistrar) +- [ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-checksamesourceandtargetforfranddfs) +- [ADMX_WindowsExplorer/ClassicShell](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-classicshell) +- [ADMX_WindowsExplorer/ConfirmFileDelete](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-confirmfiledelete) +- [ADMX_WindowsExplorer/DefaultLibrariesLocation](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-defaultlibrarieslocation) +- [ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablebinddirectlytopropertysetstorage) +- [ADMX_WindowsExplorer/DisableIndexedLibraryExperience](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableindexedlibraryexperience) +- [ADMX_WindowsExplorer/DisableKnownFolders](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableknownfolders) +- [ADMX_WindowsExplorer/DisableSearchBoxSuggestions](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablesearchboxsuggestions) +- [ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enableshellshortcuticonremotepath) +- [ADMX_WindowsExplorer/EnableSmartScreen](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enablesmartscreen) +- [ADMX_WindowsExplorer/EnforceShellExtensionSecurity](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enforceshellextensionsecurity) +- [ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-explorerribbonstartsminimized) +- [ADMX_WindowsExplorer/HideContentViewModeSnippets](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-hidecontentviewmodesnippets) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internet) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internetlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranet) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranetlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachine) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachinelockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restricted) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restrictedlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trusted) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trustedlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internet) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internetlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranet) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranetlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachine) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachinelockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restricted) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restrictedlockdown) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trusted) +- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trustedlockdown) +- [ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-linkresolveignorelinkinfo) +- [ADMX_WindowsExplorer/MaxRecentDocs](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-maxrecentdocs) +- [ADMX_WindowsExplorer/NoBackButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nobackbutton) +- [ADMX_WindowsExplorer/NoCDBurning](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocdburning) +- [ADMX_WindowsExplorer/NoCacheThumbNailPictures](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocachethumbnailpictures) +- [ADMX_WindowsExplorer/NoChangeAnimation](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangeanimation) +- [ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangekeyboardnavigationindicators) +- [ADMX_WindowsExplorer/NoDFSTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodfstab) +- [ADMX_WindowsExplorer/NoDrives](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodrives) +- [ADMX_WindowsExplorer/NoEntireNetwork](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noentirenetwork) +- [ADMX_WindowsExplorer/NoFileMRU](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemru) +- [ADMX_WindowsExplorer/NoFileMenu](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemenu) +- [ADMX_WindowsExplorer/NoFolderOptions](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofolderoptions) +- [ADMX_WindowsExplorer/NoHardwareTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nohardwaretab) +- [ADMX_WindowsExplorer/NoManageMyComputerVerb](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomanagemycomputerverb) +- [ADMX_WindowsExplorer/NoMyComputerSharedDocuments](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomycomputershareddocuments) +- [ADMX_WindowsExplorer/NoNetConnectDisconnect](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonetconnectdisconnect) +- [ADMX_WindowsExplorer/NoNewAppAlert](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonewappalert) +- [ADMX_WindowsExplorer/NoPlacesBar](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noplacesbar) +- [ADMX_WindowsExplorer/NoRecycleFiles](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norecyclefiles) +- [ADMX_WindowsExplorer/NoRunAsInstallPrompt](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norunasinstallprompt) +- [ADMX_WindowsExplorer/NoSearchInternetTryHarderButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosearchinternettryharderbutton) +- [ADMX_WindowsExplorer/NoSecurityTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosecuritytab) +- [ADMX_WindowsExplorer/NoShellSearchButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noshellsearchbutton) +- [ADMX_WindowsExplorer/NoStrCmpLogical](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nostrcmplogical) +- [ADMX_WindowsExplorer/NoViewContextMenu](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewcontextmenu) +- [ADMX_WindowsExplorer/NoViewOnDrive](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewondrive) +- [ADMX_WindowsExplorer/NoWindowsHotKeys](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nowindowshotkeys) +- [ADMX_WindowsExplorer/NoWorkgroupContents](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noworkgroupcontents) +- [ADMX_WindowsExplorer/PlacesBar](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-placesbar) +- [ADMX_WindowsExplorer/PromptRunasInstallNetPath](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-promptrunasinstallnetpath) +- [ADMX_WindowsExplorer/RecycleBinSize](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-recyclebinsize) +- [ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-1) +- [ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-2) +- [ADMX_WindowsExplorer/ShowHibernateOption](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showhibernateoption) +- [ADMX_WindowsExplorer/ShowSleepOption](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showsleepoption) +- [ADMX_WindowsExplorer/TryHarderPinnedLibrary](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedlibrary) +- [ADMX_WindowsExplorer/TryHarderPinnedOpenSearch](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedopensearch) +- [ADMX_WindowsMediaDRM/DisableOnline](./policy-csp-admx-windowsmediadrm.md#admx-windowsmediadrm-disableonline) +- [ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurehttpproxysettings) +- [ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configuremmsproxysettings) +- [ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurertspproxysettings) +- [ADMX_WindowsMediaPlayer/DisableAutoUpdate](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disableautoupdate) +- [ADMX_WindowsMediaPlayer/DisableNetworkSettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablenetworksettings) +- [ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablesetupfirstuseconfiguration) +- [ADMX_WindowsMediaPlayer/DoNotShowAnchor](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-donotshowanchor) +- [ADMX_WindowsMediaPlayer/DontUseFrameInterpolation](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-dontuseframeinterpolation) +- [ADMX_WindowsMediaPlayer/EnableScreenSaver](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-enablescreensaver) +- [ADMX_WindowsMediaPlayer/HidePrivacyTab](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hideprivacytab) +- [ADMX_WindowsMediaPlayer/HideSecurityTab](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hidesecuritytab) +- [ADMX_WindowsMediaPlayer/NetworkBuffering](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-networkbuffering) +- [ADMX_WindowsMediaPlayer/PolicyCodecUpdate](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-policycodecupdate) +- [ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventcddvdmetadataretrieval) +- [ADMX_WindowsMediaPlayer/PreventLibrarySharing](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventlibrarysharing) +- [ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventmusicfilemetadataretrieval) +- [ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventquicklaunchshortcut) +- [ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventradiopresetsretrieval) +- [ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventwmpdesktopshortcut) +- [ADMX_WindowsMediaPlayer/SkinLockDown](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-skinlockdown) +- [ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-windowsstreamingmediaprotocols) +- [ADMX_WindowsRemoteManagement/DisallowKerberos_1](./policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-1) +- [ADMX_WindowsRemoteManagement/DisallowKerberos_2](./policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-2) +- [ADMX_WindowsStore/DisableAutoDownloadWin8](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableautodownloadwin8) +- [ADMX_WindowsStore/DisableOSUpgrade_1](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-1) +- [ADMX_WindowsStore/DisableOSUpgrade_2](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-2) +- [ADMX_WindowsStore/RemoveWindowsStore_1](./policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-1) +- [ADMX_WindowsStore/RemoveWindowsStore_2](./policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-2) +- [ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription](./policy-csp-admx-wininit.md#admx-wininit-disablenamedpipeshutdownpolicydescription) +- [ADMX_WinInit/Hiberboot](./policy-csp-admx-wininit.md#admx-wininit-hiberboot) +- [ADMX_WinInit/ShutdownTimeoutHungSessionsDescription](./policy-csp-admx-wininit.md#admx-wininit-shutdowntimeouthungsessionsdescription) +- [ADMX_WinLogon/CustomShell](./policy-csp-admx-winlogon.md#admx-winlogon-customshell) +- [ADMX_WinLogon/DisplayLastLogonInfoDescription](./policy-csp-admx-winlogon.md#admx-winlogon-displaylastlogoninfodescription) +- [ADMX_WinLogon/LogonHoursNotificationPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-logonhoursnotificationpolicydescription) +- [ADMX_WinLogon/LogonHoursPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-logonhourspolicydescription) +- [ADMX_WinLogon/ReportCachedLogonPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription) +- [ADMX_WinLogon/SoftwareSASGeneration](./policy-csp-admx-winlogon.md#admx-winlogon-softwaresasgeneration) +- [ADMX_wlansvc/SetCost](./policy-csp-admx-wlansvc.md#admx-wlansvc-setcost) +- [ADMX_wlansvc/SetPINEnforced](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinenforced) +- [ADMX_wlansvc/SetPINPreferred](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinpreferred) +- [ADMX_WPN/NoCallsDuringQuietHours](./policy-csp-admx-wpn.md#admx-wpn-nocallsduringquiethours) +- [ADMX_WPN/NoLockScreenToastNotification](./policy-csp-admx-wpn.md#admx-wpn-nolockscreentoastnotification) +- [ADMX_WPN/NoQuietHours](./policy-csp-admx-wpn.md#admx-wpn-noquiethours) +- [ADMX_WPN/NoToastNotification](./policy-csp-admx-wpn.md#admx-wpn-notoastnotification) +- [ADMX_WPN/QuietHoursDailyBeginMinute](./policy-csp-admx-wpn.md#admx-wpn-quiethoursdailybeginminute) +- [ADMX_WPN/QuietHoursDailyEndMinute](./policy-csp-admx-wpn.md#admx-wpn-quiethoursdailyendminute) +- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) +- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) +- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) +- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) +- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) +- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) +- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) +- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) +- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) +- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) +- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) +- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) +- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) +- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) +- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) +- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) +- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) +- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) +- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) +- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) +- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) +- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) +- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) +- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) +- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) +- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) +- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) +- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) +- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) +- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) +- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) +- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) +- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) +- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) +- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) +- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) +- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) +- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) +- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) +- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) +- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) +- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) +- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) +- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) +- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) +- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) +- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) +- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) +- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) +- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) +- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) +- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) +- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) +- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) +- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) +- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) +- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) +- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) +- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) +- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) +- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) +- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) +- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) +- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) +- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) +- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) +- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) +- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) +- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) +- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) +- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) +- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) +- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) +- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) +- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) +- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) +- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) +- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) +- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) +- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) +- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) +- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) +- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) +- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) +- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) +- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) +- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) +- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) +- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) +- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) +- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) +- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) +- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) +- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) +- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) +- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) +- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) +- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) +- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) +- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) +- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) +- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) +- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) +- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) +- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) +- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) +- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) +- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) +- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) +- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) +- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) +- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) +- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) +- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) +- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) +- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md new file mode 100644 index 0000000000..82ebb94a80 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -0,0 +1,909 @@ +--- +title: Policies in Policy CSP supported by Group Policy +description: Policies in Policy CSP supported by Group Policy +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies in Policy CSP supported by Group Policy + +> [!div class="op_single_selector"] +> +> - [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md) +> - [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) +> + +- [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) +- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) +- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) +- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) +- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) +- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) +- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) +- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) +- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) +- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) +- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) +- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) +- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) +- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) +- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) +- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) +- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) +- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) +- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) +- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) +- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) +- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) +- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) +- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) +- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) +- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) +- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) +- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) +- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) +- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) +- [ApplicationDefaults/DefaultAssociationsConfiguration](./policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) +- [ApplicationDefaults/EnableAppUriHandlers](./policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) +- [ApplicationManagement/AllowAllTrustedApps](./policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowGameDVR](./policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) +- [ApplicationManagement/AllowSharedUserAppData](./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) +- [ApplicationManagement/DisableStoreOriginatedApps](./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) +- [ApplicationManagement/MSIAllowUserControlOverInstall](./policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) +- [ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges](./policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) +- [ApplicationManagement/RequirePrivateStoreOnly](./policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) +- [ApplicationManagement/RestrictAppDataToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) +- [ApplicationManagement/RestrictAppToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) +- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) +- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) +- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) +- [Authentication/AllowSecondaryAuthenticationDevice](./policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) +- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [BITS/BandwidthThrottlingEndTime](./policy-csp-bits.md#bits-bandwidththrottlingendtime) +- [BITS/BandwidthThrottlingStartTime](./policy-csp-bits.md#bits-bandwidththrottlingstarttime) +- [BITS/BandwidthThrottlingTransferRate](./policy-csp-bits.md#bits-bandwidththrottlingtransferrate) +- [BITS/CostedNetworkBehaviorBackgroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) +- [BITS/CostedNetworkBehaviorForegroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) +- [BITS/JobInactivityTimeout](./policy-csp-bits.md#bits-jobinactivitytimeout) +- [Browser/AllowAddressBarDropdown](./policy-csp-browser.md#browser-allowaddressbardropdown) +- [Browser/AllowAutofill](./policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](./policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDeveloperTools](./policy-csp-browser.md#browser-allowdevelopertools) +- [Browser/AllowDoNotTrack](./policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowExtensions](./policy-csp-browser.md#browser-allowextensions) +- [Browser/AllowFlash](./policy-csp-browser.md#browser-allowflash) +- [Browser/AllowFlashClickToRun](./policy-csp-browser.md#browser-allowflashclicktorun) +- [Browser/AllowFullScreenMode](./policy-csp-browser.md#browser-allowfullscreenmode) +- [Browser/AllowInPrivate](./policy-csp-browser.md#browser-allowinprivate) +- [Browser/AllowMicrosoftCompatibilityList](./policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) +- [Browser/AllowPasswordManager](./policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](./policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowPrelaunch](./policy-csp-browser.md#browser-allowprelaunch) +- [Browser/AllowPrinting](./policy-csp-browser.md#browser-allowprinting) +- [Browser/AllowSavingHistory](./policy-csp-browser.md#browser-allowsavinghistory) +- [Browser/AllowSearchEngineCustomization](./policy-csp-browser.md#browser-allowsearchenginecustomization) +- [Browser/AllowSearchSuggestionsinAddressBar](./policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSideloadingOfExtensions](./policy-csp-browser.md#browser-allowsideloadingofextensions) +- [Browser/AllowSmartScreen](./policy-csp-browser.md#browser-allowsmartscreen) +- [Browser/AllowTabPreloading](./policy-csp-browser.md#browser-allowtabpreloading) +- [Browser/AllowWebContentOnNewTabPage](./policy-csp-browser.md#browser-allowwebcontentonnewtabpage) +- [Browser/AlwaysEnableBooksLibrary](./policy-csp-browser.md#browser-alwaysenablebookslibrary) +- [Browser/ClearBrowsingDataOnExit](./policy-csp-browser.md#browser-clearbrowsingdataonexit) +- [Browser/ConfigureAdditionalSearchEngines](./policy-csp-browser.md#browser-configureadditionalsearchengines) +- [Browser/ConfigureFavoritesBar](./policy-csp-browser.md#browser-configurefavoritesbar) +- [Browser/ConfigureHomeButton](./policy-csp-browser.md#browser-configurehomebutton) +- [Browser/ConfigureKioskMode](./policy-csp-browser.md#browser-configurekioskmode) +- [Browser/ConfigureKioskResetAfterIdleTimeout](./policy-csp-browser.md#browser-configurekioskresetafteridletimeout) +- [Browser/ConfigureOpenMicrosoftEdgeWith](./policy-csp-browser.md#browser-configureopenmicrosoftedgewith) +- [Browser/ConfigureTelemetryForMicrosoft365Analytics](./policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) +- [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) +- [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) +- [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) +- [Browser/HomePages](./policy-csp-browser.md#browser-homepages) +- [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) +- [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) +- [Browser/PreventCertErrorOverrides](./policy-csp-browser.md#browser-preventcerterroroverrides) +- [Browser/PreventFirstRunPage](./policy-csp-browser.md#browser-preventfirstrunpage) +- [Browser/PreventLiveTileDataCollection](./policy-csp-browser.md#browser-preventlivetiledatacollection) +- [Browser/PreventSmartScreenPromptOverride](./policy-csp-browser.md#browser-preventsmartscreenpromptoverride) +- [Browser/PreventSmartScreenPromptOverrideForFiles](./policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) +- [Browser/PreventUsingLocalHostIPAddressForWebRTC](./policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) +- [Browser/ProvisionFavorites](./policy-csp-browser.md#browser-provisionfavorites) +- [Browser/SendIntranetTraffictoInternetExplorer](./policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) +- [Browser/SetDefaultSearchEngine](./policy-csp-browser.md#browser-setdefaultsearchengine) +- [Browser/SetHomeButtonURL](./policy-csp-browser.md#browser-sethomebuttonurl) +- [Browser/SetNewTabPageURL](./policy-csp-browser.md#browser-setnewtabpageurl) +- [Browser/ShowMessageWhenOpeningSitesInInternetExplorer](./policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) +- [Browser/SyncFavoritesBetweenIEAndMicrosoftEdge](./policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) +- [Browser/UnlockHomeButton](./policy-csp-browser.md#browser-unlockhomebutton) +- [Browser/UseSharedFolderForBooks](./policy-csp-browser.md#browser-usesharedfolderforbooks) +- [Camera/AllowCamera](./policy-csp-camera.md#camera-allowcamera) +- [Cellular/LetAppsAccessCellularData](./policy-csp-cellular.md#cellular-letappsaccesscellulardata) +- [Cellular/LetAppsAccessCellularData_ForceAllowTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) +- [Cellular/LetAppsAccessCellularData_ForceDenyTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) +- [Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) +- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/AllowCellularDataRoaming](./policy-csp-connectivity.md#connectivity-allowcellulardataroaming) +- [Connectivity/AllowPhonePCLinking](./policy-csp-connectivity.md#connectivity-allowphonepclinking) +- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) +- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) +- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) +- [Connectivity/DisallowNetworkConnectivityActiveTests](./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) +- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) +- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) +- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) +- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) +- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) +- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) +- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) +- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) +- [Defender/AllowCloudProtection](./policy-csp-defender.md#defender-allowcloudprotection) +- [Defender/AllowEmailScanning](./policy-csp-defender.md#defender-allowemailscanning) +- [Defender/AllowFullScanOnMappedNetworkDrives](./policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) +- [Defender/AllowFullScanRemovableDriveScanning](./policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) +- [Defender/AllowIOAVProtection](./policy-csp-defender.md#defender-allowioavprotection) +- [Defender/AllowOnAccessProtection](./policy-csp-defender.md#defender-allowonaccessprotection) +- [Defender/AllowRealtimeMonitoring](./policy-csp-defender.md#defender-allowrealtimemonitoring) +- [Defender/AllowScanningNetworkFiles](./policy-csp-defender.md#defender-allowscanningnetworkfiles) +- [Defender/AllowUserUIAccess](./policy-csp-defender.md#defender-allowuseruiaccess) +- [Defender/AttackSurfaceReductionOnlyExclusions](./policy-csp-defender.md#defender-attacksurfacereductiononlyexclusions) +- [Defender/AttackSurfaceReductionRules](./policy-csp-defender.md#defender-attacksurfacereductionrules) +- [Defender/AvgCPULoadFactor](./policy-csp-defender.md#defender-avgcpuloadfactor) +- [Defender/CheckForSignaturesBeforeRunningScan](./policy-csp-defender.md#defender-checkforsignaturesbeforerunningscan) +- [Defender/CloudBlockLevel](./policy-csp-defender.md#defender-cloudblocklevel) +- [Defender/CloudExtendedTimeout](./policy-csp-defender.md#defender-cloudextendedtimeout) +- [Defender/ControlledFolderAccessAllowedApplications](./policy-csp-defender.md#defender-controlledfolderaccessallowedapplications) +- [Defender/ControlledFolderAccessProtectedFolders](./policy-csp-defender.md#defender-controlledfolderaccessprotectedfolders) +- [Defender/DaysToRetainCleanedMalware](./policy-csp-defender.md#defender-daystoretaincleanedmalware) +- [Defender/DisableCatchupFullScan](./policy-csp-defender.md#defender-disablecatchupfullscan) +- [Defender/DisableCatchupQuickScan](./policy-csp-defender.md#defender-disablecatchupquickscan) +- [Defender/EnableControlledFolderAccess](./policy-csp-defender.md#defender-enablecontrolledfolderaccess) +- [Defender/EnableLowCPUPriority](./policy-csp-defender.md#defender-enablelowcpupriority) +- [Defender/EnableNetworkProtection](./policy-csp-defender.md#defender-enablenetworkprotection) +- [Defender/ExcludedExtensions](./policy-csp-defender.md#defender-excludedextensions) +- [Defender/ExcludedPaths](./policy-csp-defender.md#defender-excludedpaths) +- [Defender/ExcludedProcesses](./policy-csp-defender.md#defender-excludedprocesses) +- [Defender/RealTimeScanDirection](./policy-csp-defender.md#defender-realtimescandirection) +- [Defender/ScanParameter](./policy-csp-defender.md#defender-scanparameter) +- [Defender/ScheduleQuickScanTime](./policy-csp-defender.md#defender-schedulequickscantime) +- [Defender/ScheduleScanDay](./policy-csp-defender.md#defender-schedulescanday) +- [Defender/ScheduleScanTime](./policy-csp-defender.md#defender-schedulescantime) +- [Defender/SignatureUpdateFallbackOrder](./policy-csp-defender.md#defender-signatureupdatefallbackorder) +- [Defender/SignatureUpdateFileSharesSources](./policy-csp-defender.md#defender-signatureupdatefilesharessources) +- [Defender/SignatureUpdateInterval](./policy-csp-defender.md#defender-signatureupdateinterval) +- [Defender/SubmitSamplesConsent](./policy-csp-defender.md#defender-submitsamplesconsent) +- [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](./policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [DeviceGuard/ConfigureSystemGuardLaunch](./policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) +- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) +- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) +- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) +- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) +- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) +- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) +- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) +- [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) +- [Display/EnablePerProcessDpiForApps](./policy-csp-display.md#display-enableperprocessdpiforapps) +- [Display/TurnOffGdiDPIScalingForApps](./policy-csp-display.md#display-turnoffgdidpiscalingforapps) +- [Display/TurnOnGdiDPIScalingForApps](./policy-csp-display.md#display-turnongdidpiscalingforapps) +- [DmaGuard/DeviceEnumerationPolicy](./policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) +- [Education/PreventAddingNewPrinters](./policy-csp-education.md#education-preventaddingnewprinters) +- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) +- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) +- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) +- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) +- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) +- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) +- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) +- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) +- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [Experience/AllowClipboardHistory](./policy-csp-experience.md#experience-allowclipboardhistory) +- [Experience/AllowCortana](./policy-csp-experience.md#experience-allowcortana) +- [Experience/AllowFindMyDevice](./policy-csp-experience.md#experience-allowfindmydevice) +- [Experience/AllowTailoredExperiencesWithDiagnosticData](./policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) +- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](./policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) +- [Experience/AllowWindowsConsumerFeatures](./policy-csp-experience.md#experience-allowwindowsconsumerfeatures) +- [Experience/AllowWindowsSpotlight](./policy-csp-experience.md#experience-allowwindowsspotlight) +- [Experience/AllowWindowsSpotlightOnActionCenter](./policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) +- [Experience/AllowWindowsSpotlightOnSettings](./policy-csp-experience.md#experience-allowwindowsspotlightonsettings) +- [Experience/AllowWindowsSpotlightWindowsWelcomeExperience](./policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) +- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) +- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) +- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) +- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting) +- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) +- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile) +- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) +- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) +- [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) +- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) +- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) +- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) +- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) +- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) +- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) +- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) +- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) +- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) +- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) +- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) +- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) +- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) +- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [LanmanWorkstation/EnableInsecureGuestLogons](./policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) +- [Licensing/AllowWindowsEntitlementReactivation](./policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) +- [Licensing/DisallowKMSClientOnlineAVSValidation](./policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) +- [LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) +- [LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) +- [LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) +- [LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) +- [LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) +- [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) +- [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) +- [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) +- [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) +- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) +- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) +- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) +- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) +- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) +- [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) +- [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) +- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) +- [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) +- [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) +- [LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) +- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) +- [LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) +- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) +- [LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) +- [LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) +- [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) +- [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) +- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) +- [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) +- [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) +- [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) +- [NetworkIsolation/EnterpriseIPRange](./policy-csp-networkisolation.md#networkisolation-enterpriseiprange) +- [NetworkIsolation/EnterpriseIPRangesAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) +- [NetworkIsolation/EnterpriseInternalProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) +- [NetworkIsolation/EnterpriseProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) +- [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) +- [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) +- [Notifications/DisallowCloudNotification](./policy-csp-notifications.md#notifications-disallowcloudnotification) +- [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) +- [Notifications/DisallowTileNotification](./policy-csp-notifications.md#notifications-disallowtilenotification) +- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) +- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) +- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#power-energysaverbatterythresholdonbattery) +- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#power-energysaverbatterythresholdpluggedin) +- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) +- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) +- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) +- [Power/SelectLidCloseActionOnBattery](./policy-csp-power.md#power-selectlidcloseactiononbattery) +- [Power/SelectLidCloseActionPluggedIn](./policy-csp-power.md#power-selectlidcloseactionpluggedin) +- [Power/SelectPowerButtonActionOnBattery](./policy-csp-power.md#power-selectpowerbuttonactiononbattery) +- [Power/SelectPowerButtonActionPluggedIn](./policy-csp-power.md#power-selectpowerbuttonactionpluggedin) +- [Power/SelectSleepButtonActionOnBattery](./policy-csp-power.md#power-selectsleepbuttonactiononbattery) +- [Power/SelectSleepButtonActionPluggedIn](./policy-csp-power.md#power-selectsleepbuttonactionpluggedin) +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) +- [Power/TurnOffHybridSleepOnBattery](./policy-csp-power.md#power-turnoffhybridsleeponbattery) +- [Power/TurnOffHybridSleepPluggedIn](./policy-csp-power.md#power-turnoffhybridsleeppluggedin) +- [Power/UnattendedSleepTimeoutOnBattery](./policy-csp-power.md#power-unattendedsleeptimeoutonbattery) +- [Power/UnattendedSleepTimeoutPluggedIn](./policy-csp-power.md#power-unattendedsleeptimeoutpluggedin) +- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) +- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) +- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) +- [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) +- [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) +- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#privacy-disableprivacyexperience) +- [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) +- [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) +- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [Privacy/LetAppsAccessCalendar](./policy-csp-privacy.md#privacy-letappsaccesscalendar) +- [Privacy/LetAppsAccessCalendar_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) +- [Privacy/LetAppsAccessCalendar_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) +- [Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) +- [Privacy/LetAppsAccessCallHistory](./policy-csp-privacy.md#privacy-letappsaccesscallhistory) +- [Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) +- [Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) +- [Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) +- [Privacy/LetAppsAccessCamera](./policy-csp-privacy.md#privacy-letappsaccesscamera) +- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) +- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) +- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) +- [Privacy/LetAppsAccessContacts](./policy-csp-privacy.md#privacy-letappsaccesscontacts) +- [Privacy/LetAppsAccessContacts_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) +- [Privacy/LetAppsAccessContacts_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) +- [Privacy/LetAppsAccessContacts_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) +- [Privacy/LetAppsAccessEmail](./policy-csp-privacy.md#privacy-letappsaccessemail) +- [Privacy/LetAppsAccessEmail_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) +- [Privacy/LetAppsAccessEmail_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) +- [Privacy/LetAppsAccessEmail_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) +- [Privacy/LetAppsAccessLocation](./policy-csp-privacy.md#privacy-letappsaccesslocation) +- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) +- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) +- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) +- [Privacy/LetAppsAccessMessaging](./policy-csp-privacy.md#privacy-letappsaccessmessaging) +- [Privacy/LetAppsAccessMessaging_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) +- [Privacy/LetAppsAccessMessaging_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) +- [Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) +- [Privacy/LetAppsAccessMicrophone](./policy-csp-privacy.md#privacy-letappsaccessmicrophone) +- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) +- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) +- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) +- [Privacy/LetAppsAccessMotion](./policy-csp-privacy.md#privacy-letappsaccessmotion) +- [Privacy/LetAppsAccessMotion_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) +- [Privacy/LetAppsAccessMotion_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) +- [Privacy/LetAppsAccessMotion_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) +- [Privacy/LetAppsAccessNotifications](./policy-csp-privacy.md#privacy-letappsaccessnotifications) +- [Privacy/LetAppsAccessNotifications_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) +- [Privacy/LetAppsAccessNotifications_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) +- [Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) +- [Privacy/LetAppsAccessPhone](./policy-csp-privacy.md#privacy-letappsaccessphone) +- [Privacy/LetAppsAccessPhone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) +- [Privacy/LetAppsAccessPhone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) +- [Privacy/LetAppsAccessPhone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) +- [Privacy/LetAppsAccessRadios](./policy-csp-privacy.md#privacy-letappsaccessradios) +- [Privacy/LetAppsAccessRadios_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) +- [Privacy/LetAppsAccessRadios_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) +- [Privacy/LetAppsAccessRadios_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) +- [Privacy/LetAppsAccessTasks](./policy-csp-privacy.md#privacy-letappsaccesstasks) +- [Privacy/LetAppsAccessTasks_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) +- [Privacy/LetAppsAccessTasks_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) +- [Privacy/LetAppsAccessTasks_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) +- [Privacy/LetAppsAccessTrustedDevices](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) +- [Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) +- [Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) +- [Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) +- [Privacy/LetAppsGetDiagnosticInfo](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) +- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) +- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) +- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) +- [Privacy/LetAppsRunInBackground](./policy-csp-privacy.md#privacy-letappsruninbackground) +- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) +- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) +- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) +- [Privacy/LetAppsSyncWithDevices](./policy-csp-privacy.md#privacy-letappssyncwithdevices) +- [Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) +- [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) +- [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) +- [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) +- [Privacy/UploadUserActivities](./policy-csp-privacy.md#privacy-uploaduseractivities) +- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) +- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) +- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) +- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) +- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) +- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) +- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) +- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) +- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) +- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) +- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) +- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) +- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) +- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) +- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) +- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) +- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) +- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) +- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) +- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) +- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) +- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) +- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) +- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) +- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) +- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) +- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) +- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) +- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) +- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) +- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) +- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) +- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) +- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch) +- [Search/AllowFindMyFiles](./policy-csp-search.md#search-allowfindmyfiles) +- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems) +- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation) +- [Search/AllowUsingDiacritics](./policy-csp-search.md#search-allowusingdiacritics) +- [Search/AlwaysUseAutoLangDetection](./policy-csp-search.md#search-alwaysuseautolangdetection) +- [Search/DisableBackoff](./policy-csp-search.md#search-disablebackoff) +- [Search/DisableRemovableDriveIndexing](./policy-csp-search.md#search-disableremovabledriveindexing) +- [Search/DoNotUseWebResults](./policy-csp-search.md#search-donotusewebresults) +- [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) +- [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) +- [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) +- [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) +- [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) +- [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) +- [SmartScreen/EnableAppInstallControl](./policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) +- [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) +- [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) +- [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) +- [Start/DisableContextMenus](./policy-csp-start.md#start-disablecontextmenus) +- [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) +- [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) +- [Start/StartLayout](./policy-csp-start.md#start-startlayout) +- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates) +- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) +- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview) +- [System/AllowCommercialDataPipeline](./policy-csp-system.md#system-allowcommercialdatapipeline) +- [System/AllowDeviceNameInDiagnosticData](./policy-csp-system.md#system-allowdevicenameindiagnosticdata) +- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders) +- [System/AllowLocation](./policy-csp-system.md#system-allowlocation) +- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) +- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) +- [System/ConfigureMicrosoft365UploadEndpoint](./policy-csp-system.md#system-configuremicrosoft365uploadendpoint) +- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification) +- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux) +- [System/DisableDeviceDelete](./policy-csp-system.md#system-disabledevicedelete) +- [System/DisableDiagnosticDataViewer](./policy-csp-system.md#system-disablediagnosticdataviewer) +- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) +- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) +- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) +- [System/LimitEnhancedDiagnosticDataWindowsAnalytics](./policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) +- [System/TelemetryProxy](./policy-csp-system.md#system-telemetryproxy) +- [System/TurnOffFileHistory](./policy-csp-system.md#system-turnofffilehistory) +- [SystemServices/ConfigureHomeGroupListenerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) +- [SystemServices/ConfigureHomeGroupProviderServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) +- [SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) +- [SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) +- [SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) +- [SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) +- [TextInput/AllowLanguageFeaturesUninstall](./policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) +- [TextInput/AllowLinguisticDataCollection](./policy-csp-textinput.md#textinput-allowlinguisticdatacollection) +- [Troubleshooting/AllowRecommendations](./policy-csp-troubleshooting.md#troubleshooting-allowrecommendations) +- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) +- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) +- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) +- [Update/AllowAutoUpdate](./policy-csp-update.md#update-allowautoupdate) +- [Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork](./policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) +- [Update/AllowMUUpdateService](./policy-csp-update.md#update-allowmuupdateservice) +- [Update/AllowUpdateService](./policy-csp-update.md#update-allowupdateservice) +- [Update/AutoRestartDeadlinePeriodInDays](./policy-csp-update.md#update-autorestartdeadlineperiodindays) +- [Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates](./policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) +- [Update/AutoRestartNotificationSchedule](./policy-csp-update.md#update-autorestartnotificationschedule) +- [Update/AutoRestartRequiredNotificationDismissal](./policy-csp-update.md#update-autorestartrequirednotificationdismissal) +- [Update/AutomaticMaintenanceWakeUp](./policy-csp-update.md#update-automaticmaintenancewakeup) +- [Update/BranchReadinessLevel](./policy-csp-update.md#update-branchreadinesslevel) +- [Update/ConfigureDeadlineForFeatureUpdates](./policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](./policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](./policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](./policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Update/DeferFeatureUpdatesPeriodInDays](./policy-csp-update.md#update-deferfeatureupdatesperiodindays) +- [Update/DeferQualityUpdatesPeriodInDays](./policy-csp-update.md#update-deferqualityupdatesperiodindays) +- [Update/DeferUpdatePeriod](./policy-csp-update.md#update-deferupdateperiod) +- [Update/DeferUpgradePeriod](./policy-csp-update.md#update-deferupgradeperiod) +- [Update/DetectionFrequency](./policy-csp-update.md#update-detectionfrequency) +- [Update/DisableDualScan](./policy-csp-update.md#update-disabledualscan) +- [Update/EngagedRestartDeadline](./policy-csp-update.md#update-engagedrestartdeadline) +- [Update/EngagedRestartDeadlineForFeatureUpdates](./policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) +- [Update/EngagedRestartSnoozeSchedule](./policy-csp-update.md#update-engagedrestartsnoozeschedule) +- [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) +- [Update/EngagedRestartTransitionSchedule](./policy-csp-update.md#update-engagedrestarttransitionschedule) +- [Update/EngagedRestartTransitionScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) +- [Update/ExcludeWUDriversInQualityUpdate](./policy-csp-update.md#update-excludewudriversinqualityupdate) +- [Update/FillEmptyContentUrls](./policy-csp-update.md#update-fillemptycontenturls) +- [Update/ManagePreviewBuilds](./policy-csp-update.md#update-managepreviewbuilds) +- [Update/PauseDeferrals](./policy-csp-update.md#update-pausedeferrals) +- [Update/PauseFeatureUpdates](./policy-csp-update.md#update-pausefeatureupdates) +- [Update/PauseFeatureUpdatesStartTime](./policy-csp-update.md#update-pausefeatureupdatesstarttime) +- [Update/PauseQualityUpdates](./policy-csp-update.md#update-pausequalityupdates) +- [Update/PauseQualityUpdatesStartTime](./policy-csp-update.md#update-pausequalityupdatesstarttime) +- [Update/RequireDeferUpgrade](./policy-csp-update.md#update-requiredeferupgrade) +- [Update/ScheduleImminentRestartWarning](./policy-csp-update.md#update-scheduleimminentrestartwarning) +- [Update/ScheduleRestartWarning](./policy-csp-update.md#update-schedulerestartwarning) +- [Update/ScheduledInstallDay](./policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallEveryWeek](./policy-csp-update.md#update-scheduledinstalleveryweek) +- [Update/ScheduledInstallFirstWeek](./policy-csp-update.md#update-scheduledinstallfirstweek) +- [Update/ScheduledInstallFourthWeek](./policy-csp-update.md#update-scheduledinstallfourthweek) +- [Update/ScheduledInstallSecondWeek](./policy-csp-update.md#update-scheduledinstallsecondweek) +- [Update/ScheduledInstallThirdWeek](./policy-csp-update.md#update-scheduledinstallthirdweek) +- [Update/ScheduledInstallTime](./policy-csp-update.md#update-scheduledinstalltime) +- [Update/SetAutoRestartNotificationDisable](./policy-csp-update.md#update-setautorestartnotificationdisable) +- [Update/SetDisablePauseUXAccess](./policy-csp-update.md#update-setdisablepauseuxaccess) +- [Update/SetDisableUXWUAccess](./policy-csp-update.md#update-setdisableuxwuaccess) +- [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) +- [Update/UpdateNotificationLevel](./policy-csp-update.md#update-updatenotificationlevel) +- [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) +- [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) +- [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) +- [UserRights/AccessFromNetwork](./policy-csp-userrights.md#userrights-accessfromnetwork) +- [UserRights/ActAsPartOfTheOperatingSystem](./policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) +- [UserRights/AllowLocalLogOn](./policy-csp-userrights.md#userrights-allowlocallogon) +- [UserRights/BackupFilesAndDirectories](./policy-csp-userrights.md#userrights-backupfilesanddirectories) +- [UserRights/ChangeSystemTime](./policy-csp-userrights.md#userrights-changesystemtime) +- [UserRights/CreateGlobalObjects](./policy-csp-userrights.md#userrights-createglobalobjects) +- [UserRights/CreatePageFile](./policy-csp-userrights.md#userrights-createpagefile) +- [UserRights/CreatePermanentSharedObjects](./policy-csp-userrights.md#userrights-createpermanentsharedobjects) +- [UserRights/CreateSymbolicLinks](./policy-csp-userrights.md#userrights-createsymboliclinks) +- [UserRights/CreateToken](./policy-csp-userrights.md#userrights-createtoken) +- [UserRights/DebugPrograms](./policy-csp-userrights.md#userrights-debugprograms) +- [UserRights/DenyAccessFromNetwork](./policy-csp-userrights.md#userrights-denyaccessfromnetwork) +- [UserRights/DenyLocalLogOn](./policy-csp-userrights.md#userrights-denylocallogon) +- [UserRights/DenyRemoteDesktopServicesLogOn](./policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) +- [UserRights/EnableDelegation](./policy-csp-userrights.md#userrights-enabledelegation) +- [UserRights/GenerateSecurityAudits](./policy-csp-userrights.md#userrights-generatesecurityaudits) +- [UserRights/ImpersonateClient](./policy-csp-userrights.md#userrights-impersonateclient) +- [UserRights/IncreaseSchedulingPriority](./policy-csp-userrights.md#userrights-increaseschedulingpriority) +- [UserRights/LoadUnloadDeviceDrivers](./policy-csp-userrights.md#userrights-loadunloaddevicedrivers) +- [UserRights/LockMemory](./policy-csp-userrights.md#userrights-lockmemory) +- [UserRights/ManageAuditingAndSecurityLog](./policy-csp-userrights.md#userrights-manageauditingandsecuritylog) +- [UserRights/ManageVolume](./policy-csp-userrights.md#userrights-managevolume) +- [UserRights/ModifyFirmwareEnvironment](./policy-csp-userrights.md#userrights-modifyfirmwareenvironment) +- [UserRights/ModifyObjectLabel](./policy-csp-userrights.md#userrights-modifyobjectlabel) +- [UserRights/ProfileSingleProcess](./policy-csp-userrights.md#userrights-profilesingleprocess) +- [UserRights/RemoteShutdown](./policy-csp-userrights.md#userrights-remoteshutdown) +- [UserRights/RestoreFilesAndDirectories](./policy-csp-userrights.md#userrights-restorefilesanddirectories) +- [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) +- [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) +- [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) +- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) +- [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) +- [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) +- [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) +- [WindowsDefenderSecurityCenter/DisableClearTpmButton](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) +- [WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) +- [WindowsDefenderSecurityCenter/DisableEnhancedNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) +- [WindowsDefenderSecurityCenter/DisableFamilyUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) +- [WindowsDefenderSecurityCenter/DisableHealthUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) +- [WindowsDefenderSecurityCenter/DisableNetworkUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) +- [WindowsDefenderSecurityCenter/DisableNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) +- [WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) +- [WindowsDefenderSecurityCenter/DisableVirusUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) +- [WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) +- [WindowsDefenderSecurityCenter/Email](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) +- [WindowsDefenderSecurityCenter/EnableCustomizedToasts](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) +- [WindowsDefenderSecurityCenter/EnableInAppCustomization](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) +- [WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) +- [WindowsDefenderSecurityCenter/HideSecureBoot](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) +- [WindowsDefenderSecurityCenter/HideTPMTroubleshooting](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) +- [WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) +- [WindowsDefenderSecurityCenter/Phone](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) +- [WindowsDefenderSecurityCenter/URL](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) +- [WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) +- [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) +- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) +- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) +- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) +- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/EnableFirstLogonAnimation](./policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation) +- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) +- [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) +- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) +- [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) +- [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md new file mode 100644 index 0000000000..0a8beec733 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md @@ -0,0 +1,71 @@ +--- +title: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite +description: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/17/2019 +--- + +# Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policy-csps-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +> + +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#authentication-preferredaadtenantdomainname) +- [Bluetooth/AllowAdvertising](policy-csp-bluetooth.md#bluetooth-allowadvertising) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowAutofill](policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) +- [Update/RequireUpdateApproval](policy-csp-update.md#update-requireupdateapproval) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md new file mode 100644 index 0000000000..256ddb3528 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md @@ -0,0 +1,69 @@ +--- +title: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition +description: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies in Policy CSP supported by HoloLens (1st gen) Development Edition + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policy-csps-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +> + +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Bluetooth/AllowAdvertising](policy-csp-bluetooth.md#bluetooth-allowadvertising) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/RequireUpdateApproval](policy-csp-update.md#update-requireupdateapproval) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Update/RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md new file mode 100644 index 0000000000..bd4bcafd21 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md @@ -0,0 +1,131 @@ +--- +title: Policies in Policy CSP supported by HoloLens 2 +description: Policies in Policy CSP supported by HoloLens 2 +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/08/2020 +--- + +# Policies in Policy CSP supported by HoloLens 2 + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policy-csps-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) +> + +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#authentication-preferredaadtenantdomainname) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowAutofill](policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordExpiration](policy-csp-devicelock.md#devicelock-devicepasswordexpiration) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Experience/AllowManualMDMUnenrollment](policy-csp-experience.md#experience-allowmanualmdmunenrollment) +- [MixedReality/AADGroupMembershipCacheValidityInDays](./policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays) 9 +- [MixedReality/BrightnessButtonDisabled](./policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled) 9 +- [MixedReality/FallbackDiagnostics](./policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics) 9 +- [MixedReality/MicrophoneDisabled](./policy-csp-mixedreality.md#mixedreality-microphonedisabled) 9 +- [MixedReality/VolumeButtonDisabled](./policy-csp-mixedreality.md#mixedreality-volumebuttondisabled) 9 +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) 9 +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) 9 +- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#power-energysaverbatterythresholdonbattery) 9 +- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#power-energysaverbatterythresholdpluggedin) 9 +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) 9 +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) 9 +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Privacy/LetAppsAccessAccountInfo](policy-csp-privacy.md#privacy-letappsaccessaccountinfo) +- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-forceallowtheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-forcedenytheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-userincontroloftheseapps) +- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) 8 +- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) 8 +- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) 8 +- [Privacy/LetAppsAccessGazeInput](policy-csp-privacy.md#privacy-letappsaccessgazeinput) 8 +- [Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessgazeinput-forceallowtheseapps) 8 +- [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessgazeinput-forcedenytheseapps) 8 +- [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessgazeinput-userincontroloftheseapps) 8 +- [Privacy/LetAppsAccessCamera](policy-csp-privacy.md#privacy-letappsaccesscamera) +- [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#privacy-letappsaccesslocation) +- [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#privacy-letappsaccessmicrophone) +- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) 8 +- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) 8 +- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) 8 +- [RemoteLock/Lock](https://docs.microsoft.com/windows/client-management/mdm/remotelock-csp) 9 +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/AllowAddProvisioningPackage](policy-csp-security.md#security-allowaddprovisioningpackage) 9 +- [Security/AllowRemoveProvisioningPackage](policy-csp-security.md#security-allowremoveprovisioningpackage) 9 +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Settings/PageVisibilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) 9 +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [TimeLanguageSettings/ConfigureTimeZone](./policy-csp-timelanguagesettings.md#timelanguagesettings-configuretimezone) 9 +- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) 9 +- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) 9 +- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) 9 +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/BranchReadinessLevel](policy-csp-update.md#update-branchreadinesslevel) +- [Update/DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#update-deferfeatureupdatesperiodindays) +- [Update/DeferQualityUpdatesPeriodInDays](policy-csp-update.md#update-deferqualityupdatesperiodindays) +- [Update/ManagePreviewBuilds](policy-csp-update.md#update-managepreviewbuilds) +- [Update/PauseFeatureUpdates](policy-csp-update.md#update-pausefeatureupdates) +- [Update/PauseQualityUpdates](policy-csp-update.md#update-pausequalityupdates) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/SetDisablePauseUXAccess](policy-csp-update.md#update-setdisablepauseuxaccess) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) 8 + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. +- 9 - Available in [Windows Holographic, version 20H2](https://docs.microsoft.com/hololens/hololens-release-notes#windows-holographic-version-20h2) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md new file mode 100644 index 0000000000..f3143ed222 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md @@ -0,0 +1,77 @@ +--- +title: Policies in Policy CSP supported by Windows 10 IoT Core +description: Policies in Policy CSP supported by Windows 10 IoT Core +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/16/2019 +--- + +# Policies in Policy CSP supported by Windows 10 IoT Core + +> [!div class="op_single_selector"] +> +> - [IoT Enterprise](policy-csps-supported-by-iot-enterprise.md) +> - [IoT Core](policy-csps-supported-by-iot-core.md) +> + +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [CredentialProviders/AllowPINLogon](policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md#dataprotection-allowdirectmemoryaccess) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) (deprecated) +- [DeliveryOptimization/DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) (deprecated) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) (deprecated) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) +- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) +- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) +- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Wifi/AllowAutoConnectToWiFiSenseHotspots](policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) +- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) +- [Wifi/WLANScanMode](policy-csp-wifi.md#wifi-wlanscanmode) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-enterprise.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-enterprise.md new file mode 100644 index 0000000000..afb79c5bfe --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-enterprise.md @@ -0,0 +1,73 @@ +--- +title: Policies in Policy CSP supported by Windows 10 IoT Enterprise +description: Policies in Policy CSP supported by Windows 10 IoT Enterprise +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies in Policy CSP supported by Windows 10 IoT Enterprise + +> [!div class="op_single_selector"] +> +> - [IoT Enterprise](policy-csps-supported-by-iot-enterprise.md) +> - [IoT Core](policy-csps-supported-by-iot-core.md) +> + +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) (deprecated) +- [DeliveryOptimization/DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) (deprecated) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) (deprecated) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) +- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) +- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) +- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Update/SetProxyBehaviorForUpdateDetection](policy-csp-update.md#update-setproxybehaviorforupdatedetection) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md new file mode 100644 index 0000000000..e39b0aef27 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -0,0 +1,98 @@ +--- +title: Policies in Policy CSP supported by Microsoft Surface Hub +description: Policies in Policy CSP supported by Microsoft Surface Hub +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/22/2020 +--- + +# Policies in Policy CSP supported by Microsoft Surface Hub + + +- [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock) +- [Accounts/AllowMicrosoftAccountConnection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection) +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) +- [Cryptography/TLSCipherSuites](policy-csp-cryptography.md#cryptography-tlsciphersuites) +- [Defender/AllowArchiveScanning](policy-csp-defender.md#defender-allowarchivescanning) +- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#defender-allowbehaviormonitoring) +- [Defender/AllowCloudProtection](policy-csp-defender.md#defender-allowcloudprotection) +- [Defender/AllowEmailScanning](policy-csp-defender.md#defender-allowemailscanning) +- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) +- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) +- [Defender/AllowIOAVProtection](policy-csp-defender.md#defender-allowioavprotection) +- [Defender/AllowIntrusionPreventionSystem](policy-csp-defender.md#defender-allowintrusionpreventionsystem) +- [Defender/AllowOnAccessProtection](policy-csp-defender.md#defender-allowonaccessprotection) +- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#defender-allowrealtimemonitoring) +- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#defender-allowscanningnetworkfiles) +- [Defender/AllowScriptScanning](policy-csp-defender.md#defender-allowscriptscanning) +- [Defender/AllowUserUIAccess](policy-csp-defender.md#defender-allowuseruiaccess) +- [Defender/AvgCPULoadFactor](policy-csp-defender.md#defender-avgcpuloadfactor) +- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#defender-daystoretaincleanedmalware) +- [Defender/ExcludedExtensions](policy-csp-defender.md#defender-excludedextensions) +- [Defender/ExcludedPaths](policy-csp-defender.md#defender-excludedpaths) +- [Defender/ExcludedProcesses](policy-csp-defender.md#defender-excludedprocesses) +- [Defender/PUAProtection](policy-csp-defender.md#defender-puaprotection) +- [Defender/RealTimeScanDirection](policy-csp-defender.md#defender-realtimescandirection) +- [Defender/ScanParameter](policy-csp-defender.md#defender-scanparameter) +- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#defender-schedulequickscantime) +- [Defender/ScheduleScanDay](policy-csp-defender.md#defender-schedulescanday) +- [Defender/ScheduleScanTime](policy-csp-defender.md#defender-schedulescantime) +- [Defender/SignatureUpdateInterval](policy-csp-defender.md#defender-signatureupdateinterval) +- [Defender/SubmitSamplesConsent](policy-csp-defender.md#defender-submitsamplesconsent) +- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#defender-threatseveritydefaultaction) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [RestrictedGroups/ConfigureGroupMembership](policy-csp-restrictedgroups.md) +- [TextInput/AllowIMELogging](policy-csp-textinput.md#textinput-allowimelogging) +- [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#textinput-allowimenetworkaccess) +- [TextInput/AllowInputPanel](policy-csp-textinput.md#textinput-allowinputpanel) +- [TextInput/AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#textinput-allowjapaneseimesurrogatepaircharacters) +- [TextInput/AllowJapaneseIVSCharacters](policy-csp-textinput.md#textinput-allowjapaneseivscharacters) +- [TextInput/AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#textinput-allowjapanesenonpublishingstandardglyph) +- [TextInput/AllowJapaneseUserDictionary](policy-csp-textinput.md#textinput-allowjapaneseuserdictionary) +- [TextInput/AllowLanguageFeaturesUninstall](policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) +- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208) +- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc) +- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) +- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) +- [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting) +- [WiFi/WLANScanMode](policy-csp-wifi.md#wifi-wlanscanmode) +- [Wifi/AllowWiFiDirect](policy-csp-wifi.md#wifi-allowwifidirect) +- [WirelessDisplay/AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#wirelessdisplay-allowmdnsadvertisement) +- [WirelessDisplay/AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#wirelessdisplay-allowmdnsdiscovery) +- [WirelessDisplay/AllowProjectionFromPC](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectionfrompc) +- [WirelessDisplay/AllowProjectionFromPCOverInfrastructure](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectionfrompcoverinfrastructure) +- [WirelessDisplay/AllowProjectionToPC](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) +- [WirelessDisplay/AllowProjectionToPCOverInfrastructure](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopcoverinfrastructure) +- [WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver](policy-csp-wirelessdisplay.md#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) +- [WirelessDisplay/RequirePinForPairing](policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) + + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md new file mode 100644 index 0000000000..4fa3380c87 --- /dev/null +++ b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md @@ -0,0 +1,40 @@ +--- +title: Policies in Policy CSP that can be set using Exchange Active Sync (EAS) +description: Policies in Policy CSP that can be set using Exchange Active Sync (EAS) +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies in Policy CSP that can be set using Exchange Active Sync (EAS) + +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowCellularDataRoaming](policy-csp-connectivity.md#connectivity-allowcellulardataroaming) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordExpiration](policy-csp-devicelock.md#devicelock-devicepasswordexpiration) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [DeviceLock/PreventLockScreenSlideShow](policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard) +- [System/TelemetryProxy](policy-csp-system.md#system-telemetryproxy) +- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) + +## Related topics + +[Policy CSP](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-supported-by-group-policy.md b/windows/client-management/mdm/policies-supported-by-group-policy.md deleted file mode 100644 index 97ea0d7de0..0000000000 --- a/windows/client-management/mdm/policies-supported-by-group-policy.md +++ /dev/null @@ -1,911 +0,0 @@ ---- -title: Policies supported by Group Policy -description: Policies supported by Group Policy -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 07/18/2019 ---- - -# Policies supported by Group Policy - -> [!div class="op_single_selector"] -> -> - [Policies supported by Group Policy](policies-supported-by-group-policy.md) -> - [ADMX-backed policies](policies-admx-backed.md) -> - -- [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) -- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) -- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) -- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) -- [ApplicationDefaults/DefaultAssociationsConfiguration](./policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) -- [ApplicationDefaults/EnableAppUriHandlers](./policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) -- [ApplicationManagement/AllowAllTrustedApps](./policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) -- [ApplicationManagement/AllowGameDVR](./policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) -- [ApplicationManagement/AllowSharedUserAppData](./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) -- [ApplicationManagement/DisableStoreOriginatedApps](./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) -- [ApplicationManagement/MSIAllowUserControlOverInstall](./policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) -- [ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges](./policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) -- [ApplicationManagement/RequirePrivateStoreOnly](./policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) -- [ApplicationManagement/RestrictAppDataToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) -- [ApplicationManagement/RestrictAppToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) -- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) -- [Authentication/AllowSecondaryAuthenticationDevice](./policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) -- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [BITS/BandwidthThrottlingEndTime](./policy-csp-bits.md#bits-bandwidththrottlingendtime) -- [BITS/BandwidthThrottlingStartTime](./policy-csp-bits.md#bits-bandwidththrottlingstarttime) -- [BITS/BandwidthThrottlingTransferRate](./policy-csp-bits.md#bits-bandwidththrottlingtransferrate) -- [BITS/CostedNetworkBehaviorBackgroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) -- [BITS/CostedNetworkBehaviorForegroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) -- [BITS/JobInactivityTimeout](./policy-csp-bits.md#bits-jobinactivitytimeout) -- [Browser/AllowAddressBarDropdown](./policy-csp-browser.md#browser-allowaddressbardropdown) -- [Browser/AllowAutofill](./policy-csp-browser.md#browser-allowautofill) -- [Browser/AllowCookies](./policy-csp-browser.md#browser-allowcookies) -- [Browser/AllowDeveloperTools](./policy-csp-browser.md#browser-allowdevelopertools) -- [Browser/AllowDoNotTrack](./policy-csp-browser.md#browser-allowdonottrack) -- [Browser/AllowExtensions](./policy-csp-browser.md#browser-allowextensions) -- [Browser/AllowFlash](./policy-csp-browser.md#browser-allowflash) -- [Browser/AllowFlashClickToRun](./policy-csp-browser.md#browser-allowflashclicktorun) -- [Browser/AllowFullScreenMode](./policy-csp-browser.md#browser-allowfullscreenmode) -- [Browser/AllowInPrivate](./policy-csp-browser.md#browser-allowinprivate) -- [Browser/AllowMicrosoftCompatibilityList](./policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) -- [Browser/AllowPasswordManager](./policy-csp-browser.md#browser-allowpasswordmanager) -- [Browser/AllowPopups](./policy-csp-browser.md#browser-allowpopups) -- [Browser/AllowPrelaunch](./policy-csp-browser.md#browser-allowprelaunch) -- [Browser/AllowPrinting](./policy-csp-browser.md#browser-allowprinting) -- [Browser/AllowSavingHistory](./policy-csp-browser.md#browser-allowsavinghistory) -- [Browser/AllowSearchEngineCustomization](./policy-csp-browser.md#browser-allowsearchenginecustomization) -- [Browser/AllowSearchSuggestionsinAddressBar](./policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSideloadingOfExtensions](./policy-csp-browser.md#browser-allowsideloadingofextensions) -- [Browser/AllowSmartScreen](./policy-csp-browser.md#browser-allowsmartscreen) -- [Browser/AllowTabPreloading](./policy-csp-browser.md#browser-allowtabpreloading) -- [Browser/AllowWebContentOnNewTabPage](./policy-csp-browser.md#browser-allowwebcontentonnewtabpage) -- [Browser/AlwaysEnableBooksLibrary](./policy-csp-browser.md#browser-alwaysenablebookslibrary) -- [Browser/ClearBrowsingDataOnExit](./policy-csp-browser.md#browser-clearbrowsingdataonexit) -- [Browser/ConfigureAdditionalSearchEngines](./policy-csp-browser.md#browser-configureadditionalsearchengines) -- [Browser/ConfigureFavoritesBar](./policy-csp-browser.md#browser-configurefavoritesbar) -- [Browser/ConfigureHomeButton](./policy-csp-browser.md#browser-configurehomebutton) -- [Browser/ConfigureKioskMode](./policy-csp-browser.md#browser-configurekioskmode) -- [Browser/ConfigureKioskResetAfterIdleTimeout](./policy-csp-browser.md#browser-configurekioskresetafteridletimeout) -- [Browser/ConfigureOpenMicrosoftEdgeWith](./policy-csp-browser.md#browser-configureopenmicrosoftedgewith) -- [Browser/ConfigureTelemetryForMicrosoft365Analytics](./policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) -- [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) -- [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) -- [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) -- [Browser/HomePages](./policy-csp-browser.md#browser-homepages) -- [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) -- [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) -- [Browser/PreventCertErrorOverrides](./policy-csp-browser.md#browser-preventcerterroroverrides) -- [Browser/PreventFirstRunPage](./policy-csp-browser.md#browser-preventfirstrunpage) -- [Browser/PreventLiveTileDataCollection](./policy-csp-browser.md#browser-preventlivetiledatacollection) -- [Browser/PreventSmartScreenPromptOverride](./policy-csp-browser.md#browser-preventsmartscreenpromptoverride) -- [Browser/PreventSmartScreenPromptOverrideForFiles](./policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) -- [Browser/PreventUsingLocalHostIPAddressForWebRTC](./policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) -- [Browser/ProvisionFavorites](./policy-csp-browser.md#browser-provisionfavorites) -- [Browser/SendIntranetTraffictoInternetExplorer](./policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) -- [Browser/SetDefaultSearchEngine](./policy-csp-browser.md#browser-setdefaultsearchengine) -- [Browser/SetHomeButtonURL](./policy-csp-browser.md#browser-sethomebuttonurl) -- [Browser/SetNewTabPageURL](./policy-csp-browser.md#browser-setnewtabpageurl) -- [Browser/ShowMessageWhenOpeningSitesInInternetExplorer](./policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) -- [Browser/SyncFavoritesBetweenIEAndMicrosoftEdge](./policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) -- [Browser/UnlockHomeButton](./policy-csp-browser.md#browser-unlockhomebutton) -- [Browser/UseSharedFolderForBooks](./policy-csp-browser.md#browser-usesharedfolderforbooks) -- [Camera/AllowCamera](./policy-csp-camera.md#camera-allowcamera) -- [Cellular/LetAppsAccessCellularData](./policy-csp-cellular.md#cellular-letappsaccesscellulardata) -- [Cellular/LetAppsAccessCellularData_ForceAllowTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) -- [Cellular/LetAppsAccessCellularData_ForceDenyTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) -- [Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) -- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/AllowCellularDataRoaming](./policy-csp-connectivity.md#connectivity-allowcellulardataroaming) -- [Connectivity/AllowPhonePCLinking](./policy-csp-connectivity.md#connectivity-allowphonepclinking) -- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/DisallowNetworkConnectivityActiveTests](./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) -- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) -- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) -- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) -- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](./policy-csp-defender.md#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](./policy-csp-defender.md#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](./policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](./policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](./policy-csp-defender.md#defender-allowioavprotection) -- [Defender/AllowOnAccessProtection](./policy-csp-defender.md#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](./policy-csp-defender.md#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](./policy-csp-defender.md#defender-allowscanningnetworkfiles) -- [Defender/AllowUserUIAccess](./policy-csp-defender.md#defender-allowuseruiaccess) -- [Defender/AttackSurfaceReductionOnlyExclusions](./policy-csp-defender.md#defender-attacksurfacereductiononlyexclusions) -- [Defender/AttackSurfaceReductionRules](./policy-csp-defender.md#defender-attacksurfacereductionrules) -- [Defender/AvgCPULoadFactor](./policy-csp-defender.md#defender-avgcpuloadfactor) -- [Defender/CheckForSignaturesBeforeRunningScan](./policy-csp-defender.md#defender-checkforsignaturesbeforerunningscan) -- [Defender/CloudBlockLevel](./policy-csp-defender.md#defender-cloudblocklevel) -- [Defender/CloudExtendedTimeout](./policy-csp-defender.md#defender-cloudextendedtimeout) -- [Defender/ControlledFolderAccessAllowedApplications](./policy-csp-defender.md#defender-controlledfolderaccessallowedapplications) -- [Defender/ControlledFolderAccessProtectedFolders](./policy-csp-defender.md#defender-controlledfolderaccessprotectedfolders) -- [Defender/DaysToRetainCleanedMalware](./policy-csp-defender.md#defender-daystoretaincleanedmalware) -- [Defender/DisableCatchupFullScan](./policy-csp-defender.md#defender-disablecatchupfullscan) -- [Defender/DisableCatchupQuickScan](./policy-csp-defender.md#defender-disablecatchupquickscan) -- [Defender/EnableControlledFolderAccess](./policy-csp-defender.md#defender-enablecontrolledfolderaccess) -- [Defender/EnableLowCPUPriority](./policy-csp-defender.md#defender-enablelowcpupriority) -- [Defender/EnableNetworkProtection](./policy-csp-defender.md#defender-enablenetworkprotection) -- [Defender/ExcludedExtensions](./policy-csp-defender.md#defender-excludedextensions) -- [Defender/ExcludedPaths](./policy-csp-defender.md#defender-excludedpaths) -- [Defender/ExcludedProcesses](./policy-csp-defender.md#defender-excludedprocesses) -- [Defender/RealTimeScanDirection](./policy-csp-defender.md#defender-realtimescandirection) -- [Defender/ScanParameter](./policy-csp-defender.md#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](./policy-csp-defender.md#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](./policy-csp-defender.md#defender-schedulescanday) -- [Defender/ScheduleScanTime](./policy-csp-defender.md#defender-schedulescantime) -- [Defender/SignatureUpdateFallbackOrder](./policy-csp-defender.md#defender-signatureupdatefallbackorder) -- [Defender/SignatureUpdateFileSharesSources](./policy-csp-defender.md#defender-signatureupdatefilesharessources) -- [Defender/SignatureUpdateInterval](./policy-csp-defender.md#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](./policy-csp-defender.md#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) - [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](./policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DeviceGuard/ConfigureSystemGuardLaunch](./policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) -- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) -- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) -- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) -- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) -- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) -- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) -- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) -- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) -- [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) -- [Display/EnablePerProcessDpiForApps](./policy-csp-display.md#display-enableperprocessdpiforapps) -- [Display/TurnOffGdiDPIScalingForApps](./policy-csp-display.md#display-turnoffgdidpiscalingforapps) -- [Display/TurnOnGdiDPIScalingForApps](./policy-csp-display.md#display-turnongdidpiscalingforapps) -- [DmaGuard/DeviceEnumerationPolicy](./policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) -- [Education/PreventAddingNewPrinters](./policy-csp-education.md#education-preventaddingnewprinters) -- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) -- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) -- [Experience/AllowClipboardHistory](./policy-csp-experience.md#experience-allowclipboardhistory) -- [Experience/AllowCortana](./policy-csp-experience.md#experience-allowcortana) -- [Experience/AllowFindMyDevice](./policy-csp-experience.md#experience-allowfindmydevice) -- [Experience/AllowTailoredExperiencesWithDiagnosticData](./policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) -- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](./policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) -- [Experience/AllowWindowsConsumerFeatures](./policy-csp-experience.md#experience-allowwindowsconsumerfeatures) -- [Experience/AllowWindowsSpotlight](./policy-csp-experience.md#experience-allowwindowsspotlight) -- [Experience/AllowWindowsSpotlightOnActionCenter](./policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) -- [Experience/AllowWindowsSpotlightOnSettings](./policy-csp-experience.md#experience-allowwindowsspotlightonsettings) -- [Experience/AllowWindowsSpotlightWindowsWelcomeExperience](./policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) -- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) -- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) -- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) -- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting) -- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) -- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile) -- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) -- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) -- [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) -- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) -- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) -- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [LanmanWorkstation/EnableInsecureGuestLogons](./policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) -- [Licensing/AllowWindowsEntitlementReactivation](./policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) -- [Licensing/DisallowKMSClientOnlineAVSValidation](./policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) -- [LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) -- [LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) -- [LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) -- [LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) -- [LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) -- [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) -- [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) -- [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible) -- [LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) -- [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) -- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) -- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) -- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) -- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) -- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) -- [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) -- [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) -- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) -- [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) -- [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) -- [LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) -- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) -- [LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) -- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) -- [LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) -- [LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) -- [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) -- [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) -- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) -- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) -- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) -- [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) -- [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) -- [NetworkIsolation/EnterpriseIPRange](./policy-csp-networkisolation.md#networkisolation-enterpriseiprange) -- [NetworkIsolation/EnterpriseIPRangesAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) -- [NetworkIsolation/EnterpriseInternalProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) -- [NetworkIsolation/EnterpriseProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) -- [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) -- [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) -- [Notifications/DisallowCloudNotification](./policy-csp-notifications.md#notifications-disallowcloudnotification) -- [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) -- [Notifications/DisallowTileNotification](./policy-csp-notifications.md#notifications-disallowtilenotification) -- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) -- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) -- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) -- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#power-energysaverbatterythresholdonbattery) -- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#power-energysaverbatterythresholdpluggedin) -- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) -- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [Power/SelectLidCloseActionOnBattery](./policy-csp-power.md#power-selectlidcloseactiononbattery) -- [Power/SelectLidCloseActionPluggedIn](./policy-csp-power.md#power-selectlidcloseactionpluggedin) -- [Power/SelectPowerButtonActionOnBattery](./policy-csp-power.md#power-selectpowerbuttonactiononbattery) -- [Power/SelectPowerButtonActionPluggedIn](./policy-csp-power.md#power-selectpowerbuttonactionpluggedin) -- [Power/SelectSleepButtonActionOnBattery](./policy-csp-power.md#power-selectsleepbuttonactiononbattery) -- [Power/SelectSleepButtonActionPluggedIn](./policy-csp-power.md#power-selectsleepbuttonactionpluggedin) -- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) -- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) -- [Power/TurnOffHybridSleepOnBattery](./policy-csp-power.md#power-turnoffhybridsleeponbattery) -- [Power/TurnOffHybridSleepPluggedIn](./policy-csp-power.md#power-turnoffhybridsleeppluggedin) -- [Power/UnattendedSleepTimeoutOnBattery](./policy-csp-power.md#power-unattendedsleeptimeoutonbattery) -- [Power/UnattendedSleepTimeoutPluggedIn](./policy-csp-power.md#power-unattendedsleeptimeoutpluggedin) -- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) -- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) -- [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) -- [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) -- [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) -- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#privacy-disableprivacyexperience) -- [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) -- [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) -- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [Privacy/LetAppsAccessCalendar](./policy-csp-privacy.md#privacy-letappsaccesscalendar) -- [Privacy/LetAppsAccessCalendar_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) -- [Privacy/LetAppsAccessCalendar_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) -- [Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) -- [Privacy/LetAppsAccessCallHistory](./policy-csp-privacy.md#privacy-letappsaccesscallhistory) -- [Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) -- [Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) -- [Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) -- [Privacy/LetAppsAccessCamera](./policy-csp-privacy.md#privacy-letappsaccesscamera) -- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) -- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) -- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) -- [Privacy/LetAppsAccessContacts](./policy-csp-privacy.md#privacy-letappsaccesscontacts) -- [Privacy/LetAppsAccessContacts_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) -- [Privacy/LetAppsAccessContacts_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) -- [Privacy/LetAppsAccessContacts_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) -- [Privacy/LetAppsAccessEmail](./policy-csp-privacy.md#privacy-letappsaccessemail) -- [Privacy/LetAppsAccessEmail_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) -- [Privacy/LetAppsAccessEmail_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) -- [Privacy/LetAppsAccessEmail_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) -- [Privacy/LetAppsAccessLocation](./policy-csp-privacy.md#privacy-letappsaccesslocation) -- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) -- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) -- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) -- [Privacy/LetAppsAccessMessaging](./policy-csp-privacy.md#privacy-letappsaccessmessaging) -- [Privacy/LetAppsAccessMessaging_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) -- [Privacy/LetAppsAccessMessaging_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) -- [Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) -- [Privacy/LetAppsAccessMicrophone](./policy-csp-privacy.md#privacy-letappsaccessmicrophone) -- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) -- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) -- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) -- [Privacy/LetAppsAccessMotion](./policy-csp-privacy.md#privacy-letappsaccessmotion) -- [Privacy/LetAppsAccessMotion_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) -- [Privacy/LetAppsAccessMotion_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) -- [Privacy/LetAppsAccessMotion_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) -- [Privacy/LetAppsAccessNotifications](./policy-csp-privacy.md#privacy-letappsaccessnotifications) -- [Privacy/LetAppsAccessNotifications_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) -- [Privacy/LetAppsAccessNotifications_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) -- [Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) -- [Privacy/LetAppsAccessPhone](./policy-csp-privacy.md#privacy-letappsaccessphone) -- [Privacy/LetAppsAccessPhone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) -- [Privacy/LetAppsAccessPhone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) -- [Privacy/LetAppsAccessPhone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) -- [Privacy/LetAppsAccessRadios](./policy-csp-privacy.md#privacy-letappsaccessradios) -- [Privacy/LetAppsAccessRadios_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) -- [Privacy/LetAppsAccessRadios_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) -- [Privacy/LetAppsAccessRadios_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) -- [Privacy/LetAppsAccessTasks](./policy-csp-privacy.md#privacy-letappsaccesstasks) -- [Privacy/LetAppsAccessTasks_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) -- [Privacy/LetAppsAccessTasks_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) -- [Privacy/LetAppsAccessTasks_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) -- [Privacy/LetAppsAccessTrustedDevices](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) -- [Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) -- [Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) -- [Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) -- [Privacy/LetAppsGetDiagnosticInfo](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](./policy-csp-privacy.md#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) -- [Privacy/LetAppsSyncWithDevices](./policy-csp-privacy.md#privacy-letappssyncwithdevices) -- [Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) -- [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) -- [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) -- [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) -- [Privacy/UploadUserActivities](./policy-csp-privacy.md#privacy-uploaduseractivities) -- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) -- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) -- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) -- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) -- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch) -- [Search/AllowCortanaInAAD](./policy-csp-search.md#search-allowcortanainaad) -- [Search/AllowFindMyFiles](./policy-csp-search.md#search-allowfindmyfiles) -- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems) -- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation) -- [Search/AllowUsingDiacritics](./policy-csp-search.md#search-allowusingdiacritics) -- [Search/AlwaysUseAutoLangDetection](./policy-csp-search.md#search-alwaysuseautolangdetection) -- [Search/DisableBackoff](./policy-csp-search.md#search-disablebackoff) -- [Search/DisableRemovableDriveIndexing](./policy-csp-search.md#search-disableremovabledriveindexing) -- [Search/DoNotUseWebResults](./policy-csp-search.md#search-donotusewebresults) -- [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) -- [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) -- [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) -- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) -- [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) -- [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) -- [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) -- [SmartScreen/EnableAppInstallControl](./policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) -- [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) -- [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) -- [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) -- [Start/DisableContextMenus](./policy-csp-start.md#start-disablecontextmenus) -- [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) -- [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) -- [Start/StartLayout](./policy-csp-start.md#start-startlayout) -- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates) -- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) -- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview) -- [System/AllowCommercialDataPipeline](./policy-csp-system.md#system-allowcommercialdatapipeline) -- [System/AllowDeviceNameInDiagnosticData](./policy-csp-system.md#system-allowdevicenameindiagnosticdata) -- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders) -- [System/AllowLocation](./policy-csp-system.md#system-allowlocation) -- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) -- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) -- [System/ConfigureMicrosoft365UploadEndpoint](./policy-csp-system.md#system-configuremicrosoft365uploadendpoint) -- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification) -- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux) -- [System/DisableDeviceDelete](./policy-csp-system.md#system-disabledevicedelete) -- [System/DisableDiagnosticDataViewer](./policy-csp-system.md#system-disablediagnosticdataviewer) -- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) -- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) -- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) -- [System/LimitEnhancedDiagnosticDataWindowsAnalytics](./policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) -- [System/TelemetryProxy](./policy-csp-system.md#system-telemetryproxy) -- [System/TurnOffFileHistory](./policy-csp-system.md#system-turnofffilehistory) -- [SystemServices/ConfigureHomeGroupListenerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) -- [SystemServices/ConfigureHomeGroupProviderServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) -- [SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) -- [SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) -- [SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) -- [SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) -- [TextInput/AllowLanguageFeaturesUninstall](./policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) -- [TextInput/AllowLinguisticDataCollection](./policy-csp-textinput.md#textinput-allowlinguisticdatacollection) -- [Troubleshooting/AllowRecommendations](./policy-csp-troubleshooting.md#troubleshooting-allowrecommendations) -- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) -- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) -- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) -- [Update/AllowAutoUpdate](./policy-csp-update.md#update-allowautoupdate) -- [Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork](./policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) -- [Update/AllowMUUpdateService](./policy-csp-update.md#update-allowmuupdateservice) -- [Update/AllowUpdateService](./policy-csp-update.md#update-allowupdateservice) -- [Update/AutoRestartDeadlinePeriodInDays](./policy-csp-update.md#update-autorestartdeadlineperiodindays) -- [Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates](./policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) -- [Update/AutoRestartNotificationSchedule](./policy-csp-update.md#update-autorestartnotificationschedule) -- [Update/AutoRestartRequiredNotificationDismissal](./policy-csp-update.md#update-autorestartrequirednotificationdismissal) -- [Update/AutomaticMaintenanceWakeUp](./policy-csp-update.md#update-automaticmaintenancewakeup) -- [Update/BranchReadinessLevel](./policy-csp-update.md#update-branchreadinesslevel) -- [Update/ConfigureDeadlineForFeatureUpdates](./policy-csp-update.md#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](./policy-csp-update.md#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](./policy-csp-update.md#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](./policy-csp-update.md#update-configuredeadlinenoautoreboot) -- [Update/DeferFeatureUpdatesPeriodInDays](./policy-csp-update.md#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](./policy-csp-update.md#update-deferqualityupdatesperiodindays) -- [Update/DeferUpdatePeriod](./policy-csp-update.md#update-deferupdateperiod) -- [Update/DeferUpgradePeriod](./policy-csp-update.md#update-deferupgradeperiod) -- [Update/DetectionFrequency](./policy-csp-update.md#update-detectionfrequency) -- [Update/DisableDualScan](./policy-csp-update.md#update-disabledualscan) -- [Update/EngagedRestartDeadline](./policy-csp-update.md#update-engagedrestartdeadline) -- [Update/EngagedRestartDeadlineForFeatureUpdates](./policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) -- [Update/EngagedRestartSnoozeSchedule](./policy-csp-update.md#update-engagedrestartsnoozeschedule) -- [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) -- [Update/EngagedRestartTransitionSchedule](./policy-csp-update.md#update-engagedrestarttransitionschedule) -- [Update/EngagedRestartTransitionScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) -- [Update/ExcludeWUDriversInQualityUpdate](./policy-csp-update.md#update-excludewudriversinqualityupdate) -- [Update/FillEmptyContentUrls](./policy-csp-update.md#update-fillemptycontenturls) -- [Update/ManagePreviewBuilds](./policy-csp-update.md#update-managepreviewbuilds) -- [Update/PauseDeferrals](./policy-csp-update.md#update-pausedeferrals) -- [Update/PauseFeatureUpdates](./policy-csp-update.md#update-pausefeatureupdates) -- [Update/PauseFeatureUpdatesStartTime](./policy-csp-update.md#update-pausefeatureupdatesstarttime) -- [Update/PauseQualityUpdates](./policy-csp-update.md#update-pausequalityupdates) -- [Update/PauseQualityUpdatesStartTime](./policy-csp-update.md#update-pausequalityupdatesstarttime) -- [Update/RequireDeferUpgrade](./policy-csp-update.md#update-requiredeferupgrade) -- [Update/ScheduleImminentRestartWarning](./policy-csp-update.md#update-scheduleimminentrestartwarning) -- [Update/ScheduleRestartWarning](./policy-csp-update.md#update-schedulerestartwarning) -- [Update/ScheduledInstallDay](./policy-csp-update.md#update-scheduledinstallday) -- [Update/ScheduledInstallEveryWeek](./policy-csp-update.md#update-scheduledinstalleveryweek) -- [Update/ScheduledInstallFirstWeek](./policy-csp-update.md#update-scheduledinstallfirstweek) -- [Update/ScheduledInstallFourthWeek](./policy-csp-update.md#update-scheduledinstallfourthweek) -- [Update/ScheduledInstallSecondWeek](./policy-csp-update.md#update-scheduledinstallsecondweek) -- [Update/ScheduledInstallThirdWeek](./policy-csp-update.md#update-scheduledinstallthirdweek) -- [Update/ScheduledInstallTime](./policy-csp-update.md#update-scheduledinstalltime) -- [Update/SetAutoRestartNotificationDisable](./policy-csp-update.md#update-setautorestartnotificationdisable) -- [Update/SetDisablePauseUXAccess](./policy-csp-update.md#update-setdisablepauseuxaccess) -- [Update/SetDisableUXWUAccess](./policy-csp-update.md#update-setdisableuxwuaccess) -- [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) -- [Update/UpdateNotificationLevel](./policy-csp-update.md#update-updatenotificationlevel) -- [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) -- [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) -- [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) -- [UserRights/AccessFromNetwork](./policy-csp-userrights.md#userrights-accessfromnetwork) -- [UserRights/ActAsPartOfTheOperatingSystem](./policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) -- [UserRights/AllowLocalLogOn](./policy-csp-userrights.md#userrights-allowlocallogon) -- [UserRights/BackupFilesAndDirectories](./policy-csp-userrights.md#userrights-backupfilesanddirectories) -- [UserRights/ChangeSystemTime](./policy-csp-userrights.md#userrights-changesystemtime) -- [UserRights/CreateGlobalObjects](./policy-csp-userrights.md#userrights-createglobalobjects) -- [UserRights/CreatePageFile](./policy-csp-userrights.md#userrights-createpagefile) -- [UserRights/CreatePermanentSharedObjects](./policy-csp-userrights.md#userrights-createpermanentsharedobjects) -- [UserRights/CreateSymbolicLinks](./policy-csp-userrights.md#userrights-createsymboliclinks) -- [UserRights/CreateToken](./policy-csp-userrights.md#userrights-createtoken) -- [UserRights/DebugPrograms](./policy-csp-userrights.md#userrights-debugprograms) -- [UserRights/DenyAccessFromNetwork](./policy-csp-userrights.md#userrights-denyaccessfromnetwork) -- [UserRights/DenyLocalLogOn](./policy-csp-userrights.md#userrights-denylocallogon) -- [UserRights/DenyRemoteDesktopServicesLogOn](./policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) -- [UserRights/EnableDelegation](./policy-csp-userrights.md#userrights-enabledelegation) -- [UserRights/GenerateSecurityAudits](./policy-csp-userrights.md#userrights-generatesecurityaudits) -- [UserRights/ImpersonateClient](./policy-csp-userrights.md#userrights-impersonateclient) -- [UserRights/IncreaseSchedulingPriority](./policy-csp-userrights.md#userrights-increaseschedulingpriority) -- [UserRights/LoadUnloadDeviceDrivers](./policy-csp-userrights.md#userrights-loadunloaddevicedrivers) -- [UserRights/LockMemory](./policy-csp-userrights.md#userrights-lockmemory) -- [UserRights/ManageAuditingAndSecurityLog](./policy-csp-userrights.md#userrights-manageauditingandsecuritylog) -- [UserRights/ManageVolume](./policy-csp-userrights.md#userrights-managevolume) -- [UserRights/ModifyFirmwareEnvironment](./policy-csp-userrights.md#userrights-modifyfirmwareenvironment) -- [UserRights/ModifyObjectLabel](./policy-csp-userrights.md#userrights-modifyobjectlabel) -- [UserRights/ProfileSingleProcess](./policy-csp-userrights.md#userrights-profilesingleprocess) -- [UserRights/RemoteShutdown](./policy-csp-userrights.md#userrights-remoteshutdown) -- [UserRights/RestoreFilesAndDirectories](./policy-csp-userrights.md#userrights-restorefilesanddirectories) -- [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) -- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) -- [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) -- [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) -- [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) -- [WindowsDefenderSecurityCenter/DisableClearTpmButton](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) -- [WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) -- [WindowsDefenderSecurityCenter/DisableEnhancedNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) -- [WindowsDefenderSecurityCenter/DisableFamilyUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) -- [WindowsDefenderSecurityCenter/DisableHealthUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) -- [WindowsDefenderSecurityCenter/DisableNetworkUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) -- [WindowsDefenderSecurityCenter/DisableNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) -- [WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) -- [WindowsDefenderSecurityCenter/DisableVirusUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) -- [WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) -- [WindowsDefenderSecurityCenter/Email](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) -- [WindowsDefenderSecurityCenter/EnableCustomizedToasts](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) -- [WindowsDefenderSecurityCenter/EnableInAppCustomization](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) -- [WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) -- [WindowsDefenderSecurityCenter/HideSecureBoot](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) -- [WindowsDefenderSecurityCenter/HideTPMTroubleshooting](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) -- [WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) -- [WindowsDefenderSecurityCenter/Phone](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) -- [WindowsDefenderSecurityCenter/URL](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) -- [WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) -- [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) -- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) -- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) -- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [WindowsLogon/EnableFirstLogonAnimation](./policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation) -- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) -- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) -- [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) -- [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-commercial-suite.md deleted file mode 100644 index 7e2622844c..0000000000 --- a/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-commercial-suite.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Policies supported by HoloLens (1st gen) Commercial Suite -description: Policies supported by HoloLens (1st gen) Commercial Suite -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 09/17/2019 ---- - -# Policies supported by HoloLens (1st gen) Commercial Suite - -> [!div class="op_single_selector"] -> -> - [HoloLens 2](policies-supported-by-hololens2.md) -> - [HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) -> - [HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) -> -- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) -- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#authentication-preferredaadtenantdomainname) -- [Bluetooth/AllowAdvertising](policy-csp-bluetooth.md#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) -- [Browser/AllowAutofill](policy-csp-browser.md#browser-allowautofill) -- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) -- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) -- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) -- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) -- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) -- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) -- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) -- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) -- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) -- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) -- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) -- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) -- [System/AllowLocation](policy-csp-system.md#system-allowlocation) -- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) -- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) -- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) -- [Update/RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](policy-csp-update.md#update-requireupdateapproval) -- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) -- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) - -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-development-edition.md deleted file mode 100644 index 4aefceaece..0000000000 --- a/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-development-edition.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Policies supported by HoloLens (1st gen) Development Edition -description: Policies supported by HoloLens (1st gen) Development Edition -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 07/18/2019 ---- - -# Policies supported by HoloLens (1st gen) Development Edition - -> [!div class="op_single_selector"] -> -> - [HoloLens 2](policies-supported-by-hololens2.md) -> - [HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) -> - [HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) -> - -- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) -- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) -- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) -- [Bluetooth/AllowAdvertising](policy-csp-bluetooth.md#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) -- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) -- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) -- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) -- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) -- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) -- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) -- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) -- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) -- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) -- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) -- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) -- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) -- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) -- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) -- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) -- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) -- [System/AllowLocation](policy-csp-system.md#system-allowlocation) -- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) -- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) -- [Update/RequireUpdateApproval](policy-csp-update.md#update-requireupdateapproval) -- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) -- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) -- [Update/RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) - -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-hololens2.md b/windows/client-management/mdm/policies-supported-by-hololens2.md deleted file mode 100644 index 4fa3a7f423..0000000000 --- a/windows/client-management/mdm/policies-supported-by-hololens2.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: Policies supported by HoloLens 2 -description: Policies supported by HoloLens 2 -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 07/18/2019 ---- - -# Policies supported by HoloLens 2 - -> [!div class="op_single_selector"] -> -> - [HoloLens 2](policies-supported-by-hololens2.md) -> - [HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) -> - [HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) -> -- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) -- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#authentication-preferredaadtenantdomainname) -- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) -- [Browser/AllowAutofill](policy-csp-browser.md#browser-allowautofill) -- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) -- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) -- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) -- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) -- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) -- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordExpiration](policy-csp-devicelock.md#devicelock-devicepasswordexpiration) -- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) -- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) -- [Experience/AllowManualMDMUnenrollment](policy-csp-experience.md#experience-allowmanualmdmunenrollment) -- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) -- [Privacy/LetAppsAccessAccountInfo](policy-csp-privacy.md#privacy-letappsaccessaccountinfo) -- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [Privacy/LetAppsAccessBackgroundSpatialPerception](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception) -- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-forceallowtheseapps) -- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-forcedenytheseapps) -- [Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-userincontroloftheseapps) -- [Privacy/LetAppsAccessCamera](policy-csp-privacy.md#privacy-letappsaccesscamera) -- [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#privacy-letappsaccesslocation) -- [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#privacy-letappsaccessmicrophone) -- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) -- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) -- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) -- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) -- [System/AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline) -- [System/AllowLocation](policy-csp-system.md#system-allowlocation) -- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard) -- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) -- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) -- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) -- [Update/BranchReadinessLevel](policy-csp-update.md#update-branchreadinesslevel) -- [Update/DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](policy-csp-update.md#update-deferqualityupdatesperiodindays) -- [Update/ManagePreviewBuilds](policy-csp-update.md#update-managepreviewbuilds) -- [Update/PauseFeatureUpdates](policy-csp-update.md#update-pausefeatureupdates) -- [Update/PauseQualityUpdates](policy-csp-update.md#update-pausequalityupdates) -- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) -- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) - -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-iot-core.md b/windows/client-management/mdm/policies-supported-by-iot-core.md deleted file mode 100644 index 8e2efa62c5..0000000000 --- a/windows/client-management/mdm/policies-supported-by-iot-core.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Policies supported by Windows 10 IoT Core -description: Policies supported by Windows 10 IoT Core -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 09/16/2019 ---- - -# Policies supported by Windows 10 IoT Core - -> [!div class="op_single_selector"] -> -> - [IoT Enterprise](policies-supported-by-iot-enterprise.md) -> - [IoT Core](policies-supported-by-iot-core.md) -> - -- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) -- [CredentialProviders/AllowPINLogon](policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md#dataprotection-allowdirectmemoryaccess) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) -- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) -- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) -- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) -- [Wifi/WLANScanMode](policy-csp-wifi.md#wifi-wlanscanmode) - -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-iot-enterprise.md b/windows/client-management/mdm/policies-supported-by-iot-enterprise.md deleted file mode 100644 index 4602e64513..0000000000 --- a/windows/client-management/mdm/policies-supported-by-iot-enterprise.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Policies supported by Windows 10 IoT Enterprise -description: Policies supported by Windows 10 IoT Enterprise -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 07/18/2019 ---- - -# Policies supported by Windows 10 IoT Enterprise - -> [!div class="op_single_selector"] -> -> - [IoT Enterprise](policies-supported-by-iot-enterprise.md) -> - [IoT Core](policies-supported-by-iot-core.md) -> - -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) -- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) -- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) -- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) - -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-surface-hub.md b/windows/client-management/mdm/policies-supported-by-surface-hub.md deleted file mode 100644 index 778ff39d58..0000000000 --- a/windows/client-management/mdm/policies-supported-by-surface-hub.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Policies supported by Microsoft Surface Hub -description: Policies supported by Microsoft Surface Hub -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 07/18/2019 ---- - -# Policies supported by Microsoft Surface Hub - -- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](policy-csp-cryptography.md#cryptography-tlsciphersuites) -- [Defender/AllowArchiveScanning](policy-csp-defender.md#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](policy-csp-defender.md#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](policy-csp-defender.md#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](policy-csp-defender.md#defender-allowioavprotection) -- [Defender/AllowIntrusionPreventionSystem](policy-csp-defender.md#defender-allowintrusionpreventionsystem) -- [Defender/AllowOnAccessProtection](policy-csp-defender.md#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#defender-allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](policy-csp-defender.md#defender-allowscriptscanning) -- [Defender/AllowUserUIAccess](policy-csp-defender.md#defender-allowuseruiaccess) -- [Defender/AvgCPULoadFactor](policy-csp-defender.md#defender-avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#defender-daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](policy-csp-defender.md#defender-excludedextensions) -- [Defender/ExcludedPaths](policy-csp-defender.md#defender-excludedpaths) -- [Defender/ExcludedProcesses](policy-csp-defender.md#defender-excludedprocesses) -- [Defender/PUAProtection](policy-csp-defender.md#defender-puaprotection) -- [Defender/RealTimeScanDirection](policy-csp-defender.md#defender-realtimescandirection) -- [Defender/ScanParameter](policy-csp-defender.md#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](policy-csp-defender.md#defender-schedulescanday) -- [Defender/ScheduleScanTime](policy-csp-defender.md#defender-schedulescantime) -- [Defender/SignatureUpdateInterval](policy-csp-defender.md#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](policy-csp-defender.md#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#defender-threatseveritydefaultaction) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [TextInput/AllowIMELogging](policy-csp-textinput.md#textinput-allowimelogging) -- [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#textinput-allowimenetworkaccess) -- [TextInput/AllowInputPanel](policy-csp-textinput.md#textinput-allowinputpanel) -- [TextInput/AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#textinput-allowjapaneseimesurrogatepaircharacters) -- [TextInput/AllowJapaneseIVSCharacters](policy-csp-textinput.md#textinput-allowjapaneseivscharacters) -- [TextInput/AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#textinput-allowjapanesenonpublishingstandardglyph) -- [TextInput/AllowJapaneseUserDictionary](policy-csp-textinput.md#textinput-allowjapaneseuserdictionary) -- [TextInput/AllowLanguageFeaturesUninstall](policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc) -- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) -- [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting) - -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-that-can-be-set-using-eas.md deleted file mode 100644 index 3c0303c2c0..0000000000 --- a/windows/client-management/mdm/policies-that-can-be-set-using-eas.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Policies that can be set using Exchange Active Sync (EAS) -description: Policies that can be set using Exchange Active Sync (EAS) -ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: manikadhiman -ms.localizationpriority: medium -ms.date: 07/18/2019 ---- - -# Policies that can be set using Exchange Active Sync (EAS) - -- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) -- [Connectivity/AllowCellularDataRoaming](policy-csp-connectivity.md#connectivity-allowcellulardataroaming) -- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordExpiration](policy-csp-devicelock.md#devicelock-devicepasswordexpiration) -- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) -- [DeviceLock/PreventLockScreenSlideShow](policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) -- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard) -- [System/TelemetryProxy](policy-csp-system.md#system-telemetryproxy) -- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) - -## Related topics -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 6704ebd00c..70fdf7d6d4 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,6 +1,6 @@ --- title: Policy CSP -description: Policy CSP +description: Learn how the Policy configuration service provider (CSP) enables the enterprise to configure policies on Windows 10. ms.assetid: 4F3A1134-D401-44FC-A583-6EDD3070BA4F ms.reviewer: manager: dansimp @@ -15,9 +15,6 @@ ms.date: 07/18/2019 # Policy CSP -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - The Policy configuration service provider enables the enterprise to configure policies on Windows 10. Use this configuration service provider to configure any company policies. The Policy configuration service provider has the following sub-categories: @@ -171,6 +168,4460 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_ActiveXInstallService policies + +

    +
    + ADMX_ActiveXInstallService/AxISURLZonePolicies +
    +
    + +### ADMX_AddRemovePrograms policies +
    +
    + ADMX_AddRemovePrograms/DefaultCategory +
    +
    + ADMX_AddRemovePrograms/NoAddFromCDorFloppy +
    +
    + ADMX_AddRemovePrograms/NoAddFromInternet +
    +
    + ADMX_AddRemovePrograms/NoAddFromNetwork +
    +
    + ADMX_AddRemovePrograms/NoAddPage +
    +
    + ADMX_AddRemovePrograms/NoAddRemovePrograms +
    +
    + ADMX_AddRemovePrograms/NoChooseProgramsPage +
    +
    + ADMX_AddRemovePrograms/NoRemovePage +
    +
    + ADMX_AddRemovePrograms/NoServices +
    +
    + ADMX_AddRemovePrograms/NoSupportInfo +
    +
    + ADMX_AddRemovePrograms/NoWindowsSetupPage +
    +
    + +### ADMX_AppCompat policies + +
    +
    + ADMX_AppCompat/AppCompatPrevent16BitMach +
    +
    + ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage +
    +
    + ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry +
    +
    + ADMX_AppCompat/AppCompatTurnOffSwitchBack +
    +
    + ADMX_AppCompat/AppCompatTurnOffEngine +
    +
    + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1 +
    +
    + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2 +
    +
    + ADMX_AppCompat/AppCompatTurnOffUserActionRecord +
    +
    + ADMX_AppCompat/AppCompatTurnOffProgramInventory +
    +
    + +### ADMX_AppxPackageManager policies + +
    +
    + ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles +
    +
    + +### ADMX_AppXRuntime policies + +
    +
    + ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules +
    +
    + ADMX_AppXRuntime/AppxRuntimeBlockFileElevation +
    +
    + ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT +
    +
    + ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation +
    +
    + +### ADMX_AttachmentManager policies + +
    +
    + ADMX_AttachmentManager/AM_EstimateFileHandlerRisk +
    +
    + ADMX_AttachmentManager/AM_SetFileRiskLevel +
    +
    + ADMX_AttachmentManager/AM_SetHighRiskInclusion +
    +
    + ADMX_AttachmentManager/AM_SetLowRiskInclusion +
    +
    + ADMX_AttachmentManager/AM_SetModRiskInclusion +
    +
    + +### ADMX_AuditSettings policies + +
    +
    + ADMX_AuditSettings/IncludeCmdLine +
    +
    + + +### ADMX_Bits policies + +
    +
    + ADMX_Bits/BITS_DisableBranchCache +
    +
    + ADMX_Bits/BITS_DisablePeercachingClient +
    +
    + ADMX_Bits/BITS_DisablePeercachingServer +
    +
    + ADMX_Bits/BITS_EnablePeercaching +
    +
    + ADMX_Bits/BITS_MaxBandwidthServedForPeers +
    +
    + ADMX_Bits/BITS_MaxBandwidthV2_Maintenance +
    +
    + ADMX_Bits/BITS_MaxBandwidthV2_Work +
    +
    + ADMX_Bits/BITS_MaxCacheSize +
    +
    + ADMX_Bits/BITS_MaxContentAge +
    +
    + ADMX_Bits/BITS_MaxDownloadTime +
    +
    + ADMX_Bits/BITS_MaxFilesPerJob +
    +
    + ADMX_Bits/BITS_MaxJobsPerMachine +
    +
    + ADMX_Bits/BITS_MaxJobsPerUser +
    +
    + ADMX_Bits/BITS_MaxRangesPerFile +
    +
    + +### ADMX_CipherSuiteOrder policies + +
    +
    + ADMX_CipherSuiteOrder/SSLCipherSuiteOrder +
    +
    + ADMX_CipherSuiteOrder/SSLCurveOrder +
    +
    + +### ADMX_COM policies + +
    +
    + ADMX_COM/AppMgmt_COM_SearchForCLSID_1 +
    +
    + ADMX_COM/AppMgmt_COM_SearchForCLSID_2 +
    +
    + +### ADMX_ControlPanel policies + +
    +
    + ADMX_ControlPanel/DisallowCpls +
    +
    + ADMX_ControlPanel/ForceClassicControlPanel +
    +
    + ADMX_ControlPanel/NoControlPanel +
    +
    + ADMX_ControlPanel/RestrictCpls +
    +
    + +### ADMX_ControlPanelDisplay policies + +
    +
    + ADMX_ControlPanelDisplay/CPL_Display_Disable +
    +
    + ADMX_ControlPanelDisplay/CPL_Display_HideSettings +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground +
    +
    + +### ADMX_Cpls policies + +
    +
    + ADMX_CtrlAltDel/DisableChangePassword +
    +
    + ADMX_CtrlAltDel/DisableLockComputer +
    +
    + ADMX_CtrlAltDel/DisableTaskMgr +
    +
    + ADMX_CtrlAltDel/NoLogoff +
    +
    + +### ADMX_CredentialProviders policies + +
    +
    + ADMX_CredentialProviders/AllowDomainDelayLock +
    +
    + ADMX_CredentialProviders/DefaultCredentialProvider +
    +
    + ADMX_CredentialProviders/ExcludedCredentialProviders +
    +
    + +### ADMX_CredSsp policies + +
    +
    + ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly +
    +
    + ADMX_CredSsp/AllowDefaultCredentials +
    +
    + ADMX_CredSsp/AllowEncryptionOracle +
    +
    + ADMX_CredSsp/AllowFreshCredentials +
    +
    + ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly +
    +
    + ADMX_CredSsp/AllowSavedCredentials +
    +
    + ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly +
    +
    + ADMX_CredSsp/DenyDefaultCredentials +
    +
    + ADMX_CredSsp/DenyFreshCredentials +
    +
    + ADMX_CredSsp/DenySavedCredentials +
    +
    + ADMX_CredSsp/RestrictedRemoteAdministration + +### ADMX_CredUI policies + +
    +
    + ADMX_CredUI/EnableSecureCredentialPrompting +
    +
    + ADMX_CredUI/NoLocalPasswordResetQuestions +
    +
    + +### ADMX_CtrlAltDel policies +
    +
    + ADMX_Cpls/UseDefaultTile +
    +
    + +### ADMX_DataCollection policies + +
    +
    + ADMX_DataCollection/CommercialIdPolicy +
    +
    + +### ADMX_Desktop policies + +
    +
    + ADMX_Desktop/AD_EnableFilter +
    +
    + ADMX_Desktop/AD_HideDirectoryFolder +
    +
    + ADMX_Desktop/AD_QueryLimit +
    +
    + ADMX_Desktop/ForceActiveDesktopOn +
    +
    + ADMX_Desktop/NoActiveDesktop +
    +
    + ADMX_Desktop/NoActiveDesktopChanges +
    +
    + ADMX_Desktop/NoDesktop +
    +
    + ADMX_Desktop/NoDesktopCleanupWizard +
    +
    + ADMX_Desktop/NoInternetIcon +
    +
    + ADMX_Desktop/NoMyComputerIcon +
    +
    + ADMX_Desktop/NoMyDocumentsIcon +
    +
    + ADMX_Desktop/NoNetHood +
    +
    + ADMX_Desktop/NoPropertiesMyComputer +
    +
    + ADMX_Desktop/NoPropertiesMyDocuments +
    +
    + ADMX_Desktop/NoRecentDocsNetHood +
    +
    + ADMX_Desktop/NoRecycleBinIcon +
    +
    + ADMX_Desktop/NoRecycleBinProperties +
    +
    + ADMX_Desktop/NoSaveSettings +
    +
    + ADMX_Desktop/NoWindowMinimizingShortcuts +
    +
    + ADMX_Desktop/Wallpaper +
    +
    + ADMX_Desktop/sz_ATC_DisableAdd +
    +
    + ADMX_Desktop/sz_ATC_DisableClose +
    +
    + ADMX_Desktop/sz_ATC_DisableDel +
    +
    + ADMX_Desktop/sz_ATC_DisableEdit +
    +
    + ADMX_Desktop/sz_ATC_NoComponents +
    +
    + ADMX_Desktop/sz_AdminComponents_Title +
    +
    + ADMX_Desktop/sz_DB_DragDropClose +
    +
    + ADMX_Desktop/sz_DB_Moving +
    +
    + ADMX_Desktop/sz_DWP_NoHTMLPaper +
    +
    + +### ADMX_DeviceInstallation policies + +
    +
    + ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall +
    +
    + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText +
    +
    + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText +
    +
    + ADMX_DeviceInstallation/DeviceInstall_InstallTimeout +
    +
    + ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime +
    +
    + ADMX_DeviceInstallation/DeviceInstall_Removable_Deny +
    +
    + ADMX_DeviceInstallation/DeviceInstall_SystemRestore +
    +
    + ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser +
    +
    + +### ADMX_DeviceSetup policies + +
    +
    + ADMX_DeviceSetup/DeviceInstall_BalloonTips +
    +
    + ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration +
    +
    + +### ADMX_DigitalLocker policies +
    +
    + ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1 +
    +
    + ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2 +
    +
    + +### ADMX_DnsClient policies + +
    +
    + ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries +
    +
    + ADMX_DnsClient/DNS_AppendToMultiLabelName +
    +
    + ADMX_DnsClient/DNS_Domain +
    +
    + ADMX_DnsClient/DNS_DomainNameDevolutionLevel +
    +
    + ADMX_DnsClient/DNS_IdnEncoding +
    +
    + ADMX_DnsClient/DNS_IdnMapping +
    +
    + ADMX_DnsClient/DNS_NameServer +
    +
    + ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns +
    +
    + ADMX_DnsClient/DNS_PrimaryDnsSuffix +
    +
    + ADMX_DnsClient/DNS_RegisterAdapterName +
    +
    + ADMX_DnsClient/DNS_RegisterReverseLookup +
    +
    + ADMX_DnsClient/DNS_RegistrationEnabled +
    +
    + ADMX_DnsClient/DNS_RegistrationOverwritesInConflict +
    +
    + ADMX_DnsClient/DNS_RegistrationRefreshInterval +
    +
    + ADMX_DnsClient/DNS_RegistrationTtl +
    +
    + ADMX_DnsClient/DNS_SearchList +
    +
    + ADMX_DnsClient/DNS_SmartMultiHomedNameResolution +
    +
    + ADMX_DnsClient/DNS_SmartProtocolReorder +
    +
    + ADMX_DnsClient/DNS_UpdateSecurityLevel +
    +
    + ADMX_DnsClient/DNS_UpdateTopLevelDomainZones +
    +
    + ADMX_DnsClient/DNS_UseDomainNameDevolution +
    +
    + ADMX_DnsClient/Turn_Off_Multicast +
    +
    + +### ADMX_DWM policies + +
    +
    + ADMX_DWM/DwmDefaultColorizationColor_1 +
    +
    + ADMX_DWM/DwmDefaultColorizationColor_2 +
    +
    + ADMX_DWM/DwmDisallowAnimations_1 +
    +
    + ADMX_DWM/DwmDisallowAnimations_2 +
    +
    + ADMX_DWM/DwmDisallowColorizationColorChanges_1 +
    +
    + ADMX_DWM/DwmDisallowColorizationColorChanges_2 +
    +
    + +### ADMX_EAIME policies + +
    +
    + ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList +
    +
    + ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion +
    +
    + ADMX_EAIME/L_TurnOffCustomDictionary +
    +
    + ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput +
    +
    + ADMX_EAIME/L_TurnOffInternetSearchIntegration +
    +
    + ADMX_EAIME/L_TurnOffOpenExtendedDictionary +
    +
    + ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile +
    +
    + ADMX_EAIME/L_TurnOnCloudCandidate +
    +
    + ADMX_EAIME/L_TurnOnCloudCandidateCHS +
    +
    + ADMX_EAIME/L_TurnOnLexiconUpdate +
    +
    + ADMX_EAIME/L_TurnOnLiveStickers +
    +
    + ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport +
    +
    + +### ADMX_EncryptFilesonMove policies +
    +
    + ADMX_EncryptFilesonMove/NoEncryptOnMove +
    +
    + +### ADMX_EnhancedStorage policies + +
    +
    + ADMX_EnhancedStorage/ApprovedEnStorDevices +
    +
    + ADMX_EnhancedStorage/ApprovedSilos +
    +
    + ADMX_EnhancedStorage/DisablePasswordAuthentication +
    +
    + ADMX_EnhancedStorage/DisallowLegacyDiskDevices +
    +
    + ADMX_EnhancedStorage/LockDeviceOnMachineLock +
    +
    + ADMX_EnhancedStorage/RootHubConnectedEnStorDevices +
    +
    + +### ADMX_ErrorReporting policies + +
    +
    + ADMX_ErrorReporting/PCH_AllOrNoneDef +
    +
    + ADMX_ErrorReporting/PCH_AllOrNoneEx +
    +
    + ADMX_ErrorReporting/PCH_AllOrNoneInc +
    +
    + ADMX_ErrorReporting/PCH_ConfigureReport +
    +
    + ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults +
    +
    + ADMX_ErrorReporting/WerArchive_1 +
    +
    + ADMX_ErrorReporting/WerArchive_2 +
    +
    + ADMX_ErrorReporting/WerAutoApproveOSDumps_1 +
    +
    + ADMX_ErrorReporting/WerAutoApproveOSDumps_2 +
    +
    + ADMX_ErrorReporting/WerBypassDataThrottling_1 +
    +
    + ADMX_ErrorReporting/WerBypassDataThrottling_2 +
    +
    + ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1 +
    +
    + ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2 +
    +
    + ADMX_ErrorReporting/WerBypassPowerThrottling_1 +
    +
    + ADMX_ErrorReporting/WerBypassPowerThrottling_2 +
    +
    + ADMX_ErrorReporting/WerCER +
    +
    + ADMX_ErrorReporting/WerConsentCustomize_1 +
    +
    + ADMX_ErrorReporting/WerConsentOverride_1 +
    +
    + ADMX_ErrorReporting/WerConsentOverride_2 +
    +
    + ADMX_ErrorReporting/WerDefaultConsent_1 +
    +
    + ADMX_ErrorReporting/WerDefaultConsent_2 +
    +
    + ADMX_ErrorReporting/WerDisable_1 +
    +
    + ADMX_ErrorReporting/WerExlusion_1 +
    +
    + ADMX_ErrorReporting/WerExlusion_2 +
    +
    + ADMX_ErrorReporting/WerNoLogging_1 +
    +
    + ADMX_ErrorReporting/WerNoLogging_2 +
    +
    + ADMX_ErrorReporting/WerNoSecondLevelData_1 +
    +
    + ADMX_ErrorReporting/WerQueue_1 +
    +
    + ADMX_ErrorReporting/WerQueue_2 +
    +
    + +### ADMX_EventForwarding policies + +
    +
    + ADMX_EventForwarding/ForwarderResourceUsage +
    +
    + ADMX_EventForwarding/SubscriptionManager +
    +
    + +### ADMX_EventLog policies + +
    +
    + ADMX_EventLog/Channel_LogEnabled +
    +
    + ADMX_EventLog/Channel_LogFilePath_1 +
    +
    + ADMX_EventLog/Channel_LogFilePath_2 +
    +
    + ADMX_EventLog/Channel_LogFilePath_3 +
    +
    + ADMX_EventLog/Channel_LogFilePath_4 +
    +
    + ADMX_EventLog/Channel_LogMaxSize_3 +
    +
    + ADMX_EventLog/Channel_Log_AutoBackup_1 +
    +
    + ADMX_EventLog/Channel_Log_AutoBackup_2 +
    +
    + ADMX_EventLog/Channel_Log_AutoBackup_3 +
    +
    + ADMX_EventLog/Channel_Log_AutoBackup_4 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_1 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_2 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_3 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_4 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_5 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_6 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_7 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_8 +
    +
    + ADMX_EventLog/Channel_Log_Retention_2 +
    +
    + ADMX_EventLog/Channel_Log_Retention_3 +
    +
    + ADMX_EventLog/Channel_Log_Retention_4 +
    +
    + +### ADMX_Explorer policies + +
    +
    + ADMX_Explorer/AdminInfoUrl +
    +
    + ADMX_Explorer/AlwaysShowClassicMenu +
    +
    + ADMX_Explorer/DisableRoamedProfileInit +
    +
    + ADMX_Explorer/PreventItemCreationInUsersFilesFolder +
    +
    + ADMX_Explorer/TurnOffSPIAnimations +
    +
    + +### ADMX_FileServerVSSProvider policies +
    +
    + ADMX_FileServerVSSProvider/Pol_EncryptProtocol +
    +
    + +### ADMX_FileSys policies +
    +
    + ADMX_FileSys/DisableCompression +
    +
    + ADMX_FileSys/DisableDeleteNotification +
    +
    + ADMX_FileSys/DisableEncryption +
    +
    + ADMX_FileSys/EnablePagefileEncryption +
    +
    + ADMX_FileSys/LongPathsEnabled +
    +
    + ADMX_FileSys/ShortNameCreationSettings +
    +
    + ADMX_FileSys/SymlinkEvaluation +
    +
    + ADMX_FileSys/TxfDeprecatedFunctionality +
    +
    + +### ADMX_FolderRedirection policies +
    +
    + ADMX_FolderRedirection/DisableFRAdminPin +
    +
    + ADMX_FolderRedirection/DisableFRAdminPinByFolder +
    +
    + ADMX_FolderRedirection/FolderRedirectionEnableCacheRename +
    +
    + ADMX_FolderRedirection/LocalizeXPRelativePaths_1 +
    +
    + ADMX_FolderRedirection/LocalizeXPRelativePaths_2 +
    +
    + ADMX_FolderRedirection/PrimaryComputer_FR_1 +
    +
    + ADMX_FolderRedirection/PrimaryComputer_FR_2 +
    +
    + +### ADMX_Help policies +
    +
    + ADMX_Help/DisableHHDEP +
    +
    + ADMX_Help/HelpQualifiedRootDir_Comp +
    +
    + ADMX_Help/RestrictRunFromHelp +
    +
    + ADMX_Help/RestrictRunFromHelp_Comp +
    +
    + +### ADMX_Globalization policies + +
    +
    + ADMX_Globalization/BlockUserInputMethodsForSignIn +
    +
    + ADMX_Globalization/CustomLocalesNoSelect_1 +
    +
    + ADMX_Globalization/CustomLocalesNoSelect_2 +
    +
    + ADMX_Globalization/HideAdminOptions +
    +
    + ADMX_Globalization/HideCurrentLocation +
    +
    + ADMX_Globalization/HideLanguageSelection +
    +
    + ADMX_Globalization/HideLocaleSelectAndCustomize +
    +
    + ADMX_Globalization/ImplicitDataCollectionOff_1 +
    +
    + ADMX_Globalization/ImplicitDataCollectionOff_2 +
    +
    + ADMX_Globalization/LocaleSystemRestrict +
    +
    + ADMX_Globalization/LocaleUserRestrict_1 +
    +
    + ADMX_Globalization/LocaleUserRestrict_2 +
    +
    + ADMX_Globalization/LockMachineUILanguage +
    +
    + ADMX_Globalization/LockUserUILanguage +
    +
    + ADMX_Globalization/PreventGeoIdChange_1 +
    +
    + ADMX_Globalization/PreventGeoIdChange_2 +
    +
    + ADMX_Globalization/PreventUserOverrides_1 +
    +
    + ADMX_Globalization/PreventUserOverrides_2 +
    +
    + ADMX_Globalization/RestrictUILangSelect +
    +
    + ADMX_Globalization/TurnOffAutocorrectMisspelledWords +
    +
    + ADMX_Globalization/TurnOffHighlightMisspelledWords +
    +
    + ADMX_Globalization/TurnOffInsertSpace +
    +
    + ADMX_Globalization/TurnOffOfferTextPredictions +
    +
    + ADMX_Globalization/Y2K +
    +
    + +### ADMX_GroupPolicy policies + +
    +
    + ADMX_GroupPolicy/AllowX-ForestPolicy-and-RUP +
    +
    + ADMX_GroupPolicy/CSE_AppMgmt +
    +
    + ADMX_GroupPolicy/CSE_DiskQuota +
    +
    + ADMX_GroupPolicy/CSE_EFSRecovery +
    +
    + ADMX_GroupPolicy/CSE_FolderRedirection +
    +
    + ADMX_GroupPolicy/CSE_IEM +
    +
    + ADMX_GroupPolicy/CSE_IPSecurity +
    +
    + ADMX_GroupPolicy/CSE_Registry +
    +
    + ADMX_GroupPolicy/CSE_Scripts +
    +
    + ADMX_GroupPolicy/CSE_Security +
    +
    + ADMX_GroupPolicy/CSE_Wired +
    +
    + ADMX_GroupPolicy/CSE_Wireless +
    +
    + ADMX_GroupPolicy/CorpConnSyncWaitTime +
    +
    + ADMX_GroupPolicy/DenyRsopToInteractiveUser_1 +
    +
    + ADMX_GroupPolicy/DenyRsopToInteractiveUser_2 +
    +
    + ADMX_GroupPolicy/DisableAOACProcessing +
    +
    + ADMX_GroupPolicy/DisableAutoADMUpdate +
    +
    + ADMX_GroupPolicy/DisableBackgroundPolicy +
    +
    + ADMX_GroupPolicy/DisableLGPOProcessing +
    +
    + ADMX_GroupPolicy/DisableUsersFromMachGP +
    +
    + ADMX_GroupPolicy/EnableCDP +
    +
    + ADMX_GroupPolicy/EnableLogonOptimization +
    +
    + ADMX_GroupPolicy/EnableLogonOptimizationOnServerSKU +
    +
    + ADMX_GroupPolicy/EnableMMX +
    +
    + ADMX_GroupPolicy/EnforcePoliciesOnly +
    +
    + ADMX_GroupPolicy/FontMitigation +
    +
    + ADMX_GroupPolicy/GPDCOptions +
    +
    + ADMX_GroupPolicy/GPTransferRate_1 +
    +
    + ADMX_GroupPolicy/GPTransferRate_2 +
    +
    + ADMX_GroupPolicy/GroupPolicyRefreshRate +
    +
    + ADMX_GroupPolicy/GroupPolicyRefreshRateDC +
    +
    + ADMX_GroupPolicy/GroupPolicyRefreshRateUser +
    +
    + ADMX_GroupPolicy/LogonScriptDelay +
    +
    + ADMX_GroupPolicy/NewGPODisplayName +
    +
    + ADMX_GroupPolicy/NewGPOLinksDisabled +
    +
    + ADMX_GroupPolicy/OnlyUseLocalAdminFiles +
    +
    + ADMX_GroupPolicy/ProcessMitigationOptions +
    +
    + ADMX_GroupPolicy/RSoPLogging +
    +
    + ADMX_GroupPolicy/ResetDfsClientInfoDuringRefreshPolicy +
    +
    + ADMX_GroupPolicy/SlowLinkDefaultForDirectAccess +
    +
    + ADMX_GroupPolicy/SlowlinkDefaultToAsync +
    +
    + ADMX_GroupPolicy/SyncWaitTime +
    +
    + ADMX_GroupPolicy/UserPolicyMode +
    +
    + +### ADMX_HelpAndSupport policies +
    +
    + ADMX_HelpAndSupport/ActiveHelp +
    +
    + ADMX_HelpAndSupport/HPExplicitFeedback +
    +
    + ADMX_HelpAndSupport/HPImplicitFeedback +
    +
    + ADMX_HelpAndSupport/HPOnlineAssistance +
    +
    + +## ADMX_ICM policies + +
    +
    + ADMX_ICM/CEIPEnable +
    +
    + ADMX_ICM/CertMgr_DisableAutoRootUpdates +
    +
    + ADMX_ICM/DisableHTTPPrinting_1 +
    +
    + ADMX_ICM/DisableWebPnPDownload_1 +
    +
    + ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate +
    +
    + ADMX_ICM/EventViewer_DisableLinks +
    +
    + ADMX_ICM/HSS_HeadlinesPolicy +
    +
    + ADMX_ICM/HSS_KBSearchPolicy +
    +
    + ADMX_ICM/InternetManagement_RestrictCommunication_1 +
    +
    + ADMX_ICM/InternetManagement_RestrictCommunication_2 +
    +
    + ADMX_ICM/NC_ExitOnISP +
    +
    + ADMX_ICM/NC_NoRegistration +
    +
    + ADMX_ICM/PCH_DoNotReport +
    +
    + ADMX_ICM/RemoveWindowsUpdate_ICM +
    +
    + ADMX_ICM/SearchCompanion_DisableFileUpdates +
    +
    + ADMX_ICM/ShellNoUseInternetOpenWith_1 +
    +
    + ADMX_ICM/ShellNoUseInternetOpenWith_2 +
    +
    + ADMX_ICM/ShellNoUseStoreOpenWith_1 +
    +
    + ADMX_ICM/ShellNoUseStoreOpenWith_2 +
    +
    + ADMX_ICM/ShellPreventWPWDownload_1 +
    +
    + ADMX_ICM/ShellRemoveOrderPrints_1 +
    +
    + ADMX_ICM/ShellRemoveOrderPrints_2 +
    +
    + ADMX_ICM/ShellRemovePublishToWeb_1 +
    +
    + ADMX_ICM/ShellRemovePublishToWeb_2 +
    +
    + ADMX_ICM/WinMSG_NoInstrumentation_1 +
    +
    + ADMX_ICM/WinMSG_NoInstrumentation_2 +
    +
    + +### ADMX_kdc policies +
    +
    + ADMX_kdc/CbacAndArmor +
    +
    + ADMX_kdc/ForestSearch +
    +
    + ADMX_kdc/PKINITFreshness +
    +
    + ADMX_kdc/RequestCompoundId +
    +
    + ADMX_kdc/TicketSizeThreshold +
    +
    + ADMX_kdc/emitlili +
    +
    + +### ADMX_Kerberos policies + +
    +
    + ADMX_Kerberos/AlwaysSendCompoundId +
    +
    + ADMX_Kerberos/DevicePKInitEnabled +
    +
    + ADMX_Kerberos/HostToRealm +
    +
    + ADMX_Kerberos/KdcProxyDisableServerRevocationCheck +
    +
    + ADMX_Kerberos/KdcProxyServer +
    +
    + ADMX_Kerberos/MitRealms +
    +
    + ADMX_Kerberos/ServerAcceptsCompound +
    +
    + ADMX_Kerberos/StrictTarget +
    +
    + +### ADMX_LanmanServer policies +
    +
    + ADMX_LanmanServer/Pol_CipherSuiteOrder +
    +
    + ADMX_LanmanServer/Pol_HashPublication +
    +
    + ADMX_LanmanServer/Pol_HashSupportVersion +
    +
    + ADMX_LanmanServer/Pol_HonorCipherSuiteOrder +
    +
    + +### ADMX_LanmanWorkstation policies + +
    +
    + ADMX_LanmanWorkstation/Pol_CipherSuiteOrder +
    +
    + ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles +
    +
    + ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares +
    +
    + +### ADMX_LinkLayerTopologyDiscovery policies +
    +
    + ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO +
    +
    + ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr +
    +
    + +### ADMX_Logon policies + +
    +
    + ADMX_Logon/BlockUserFromShowingAccountDetailsOnSignin +
    +
    + ADMX_Logon/DisableAcrylicBackgroundOnLogon +
    +
    + ADMX_Logon/DisableExplorerRunLegacy_1 +
    +
    + ADMX_Logon/DisableExplorerRunLegacy_2 +
    +
    + ADMX_Logon/DisableExplorerRunOnceLegacy_1 +
    +
    + ADMX_Logon/DisableExplorerRunOnceLegacy_2 +
    +
    + ADMX_Logon/DisableStatusMessages +
    +
    + ADMX_Logon/DontEnumerateConnectedUsers +
    +
    + ADMX_Logon/NoWelcomeTips_1 +
    +
    + ADMX_Logon/NoWelcomeTips_2 +
    +
    + ADMX_Logon/Run_1 +
    +
    + ADMX_Logon/Run_2 +
    +
    + ADMX_Logon/SyncForegroundPolicy +
    +
    + ADMX_Logon/UseOEMBackground +
    +
    + ADMX_Logon/VerboseStatus +
    +
    + +### ADMX_MicrosoftDefenderAntivirus policies + +
    +
    + ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction +
    +
    + ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions +
    +
    + ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths +
    +
    + ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes +
    +
    + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions +
    +
    + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules +
    +
    + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications +
    +
    + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders +
    +
    + ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation +
    +
    + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement +
    +
    + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid +
    +
    + ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition +
    +
    + ADMX_MicrosoftDefenderAntivirus/ProxyBypass +
    +
    + ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl +
    +
    + ADMX_MicrosoftDefenderAntivirus/ProxyServer +
    +
    + ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay +
    +
    + ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection +
    +
    + ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup +
    +
    + ADMX_MicrosoftDefenderAntivirus/SpynetReporting +
    +
    + ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting +
    +
    + ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction +
    +
    + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString +
    +
    + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress +
    +
    + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification +
    +
    + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown +
    +
    + +### ADMX_MMC policies +
    +
    + ADMX_MMC/MMC_ActiveXControl +
    +
    + ADMX_MMC/MMC_ExtendView +
    +
    + ADMX_MMC/MMC_LinkToWeb +
    +
    + ADMX_MMC/MMC_Restrict_Author +
    +
    + ADMX_MMC/MMC_Restrict_To_Permitted_Snapins +
    +
    + +### ADMX_MMCSnapins policies + +
    +
    + ADMX_MMCSnapins/MMC_ADMComputers_1 +
    +
    + ADMX_MMCSnapins/MMC_ADMComputers_2 +
    +
    + ADMX_MMCSnapins/MMC_ADMUsers_1 +
    +
    + ADMX_MMCSnapins/MMC_ADMUsers_2 +
    +
    + ADMX_MMCSnapins/MMC_ADSI +
    +
    + ADMX_MMCSnapins/MMC_ActiveDirDomTrusts +
    +
    + ADMX_MMCSnapins/MMC_ActiveDirSitesServices +
    +
    + ADMX_MMCSnapins/MMC_ActiveDirUsersComp +
    +
    + ADMX_MMCSnapins/MMC_AppleTalkRouting +
    +
    + ADMX_MMCSnapins/MMC_AuthMan +
    +
    + ADMX_MMCSnapins/MMC_CertAuth +
    +
    + ADMX_MMCSnapins/MMC_CertAuthPolSet +
    +
    + ADMX_MMCSnapins/MMC_Certs +
    +
    + ADMX_MMCSnapins/MMC_CertsTemplate +
    +
    + ADMX_MMCSnapins/MMC_ComponentServices +
    +
    + ADMX_MMCSnapins/MMC_ComputerManagement +
    +
    + ADMX_MMCSnapins/MMC_ConnectionSharingNAT +
    +
    + ADMX_MMCSnapins/MMC_DCOMCFG +
    +
    + ADMX_MMCSnapins/MMC_DFS +
    +
    + ADMX_MMCSnapins/MMC_DHCPRelayMgmt +
    +
    + ADMX_MMCSnapins/MMC_DeviceManager_1 +
    +
    + ADMX_MMCSnapins/MMC_DeviceManager_2 +
    +
    + ADMX_MMCSnapins/MMC_DiskDefrag +
    +
    + ADMX_MMCSnapins/MMC_DiskMgmt +
    +
    + ADMX_MMCSnapins/MMC_EnterprisePKI +
    +
    + ADMX_MMCSnapins/MMC_EventViewer_1 +
    +
    + ADMX_MMCSnapins/MMC_EventViewer_2 +
    +
    + ADMX_MMCSnapins/MMC_EventViewer_3 +
    +
    + ADMX_MMCSnapins/MMC_EventViewer_4 +
    +
    + ADMX_MMCSnapins/MMC_FAXService +
    +
    + ADMX_MMCSnapins/MMC_FailoverClusters +
    +
    + ADMX_MMCSnapins/MMC_FolderRedirection_1 +
    +
    + ADMX_MMCSnapins/MMC_FolderRedirection_2 +
    +
    + ADMX_MMCSnapins/MMC_FrontPageExt +
    +
    + ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn +
    +
    + ADMX_MMCSnapins/MMC_GroupPolicySnapIn +
    +
    + ADMX_MMCSnapins/MMC_GroupPolicyTab +
    +
    + ADMX_MMCSnapins/MMC_HRA +
    +
    + ADMX_MMCSnapins/MMC_IAS +
    +
    + ADMX_MMCSnapins/MMC_IASLogging +
    +
    + ADMX_MMCSnapins/MMC_IEMaintenance_1 +
    +
    + ADMX_MMCSnapins/MMC_IEMaintenance_2 +
    +
    + ADMX_MMCSnapins/MMC_IGMPRouting +
    +
    + ADMX_MMCSnapins/MMC_IIS +
    +
    + ADMX_MMCSnapins/MMC_IPRouting +
    +
    + ADMX_MMCSnapins/MMC_IPSecManage_GP +
    +
    + ADMX_MMCSnapins/MMC_IPXRIPRouting +
    +
    + ADMX_MMCSnapins/MMC_IPXRouting +
    +
    + ADMX_MMCSnapins/MMC_IPXSAPRouting +
    +
    + ADMX_MMCSnapins/MMC_IndexingService +
    +
    + ADMX_MMCSnapins/MMC_IpSecManage +
    +
    + ADMX_MMCSnapins/MMC_IpSecMonitor +
    +
    + ADMX_MMCSnapins/MMC_LocalUsersGroups +
    +
    + ADMX_MMCSnapins/MMC_LogicalMappedDrives +
    +
    + ADMX_MMCSnapins/MMC_NPSUI +
    +
    + ADMX_MMCSnapins/MMC_NapSnap +
    +
    + ADMX_MMCSnapins/MMC_NapSnap_GP +
    +
    + ADMX_MMCSnapins/MMC_Net_Framework +
    +
    + ADMX_MMCSnapins/MMC_OCSP +
    +
    + ADMX_MMCSnapins/MMC_OSPFRouting +
    +
    + ADMX_MMCSnapins/MMC_PerfLogsAlerts +
    +
    + ADMX_MMCSnapins/MMC_PublicKey +
    +
    + ADMX_MMCSnapins/MMC_QoSAdmission +
    +
    + ADMX_MMCSnapins/MMC_RAS_DialinUser +
    +
    + ADMX_MMCSnapins/MMC_RIPRouting +
    +
    + ADMX_MMCSnapins/MMC_RIS +
    +
    + ADMX_MMCSnapins/MMC_RRA +
    +
    + ADMX_MMCSnapins/MMC_RSM +
    +
    + ADMX_MMCSnapins/MMC_RemStore +
    +
    + ADMX_MMCSnapins/MMC_RemoteAccess +
    +
    + ADMX_MMCSnapins/MMC_RemoteDesktop +
    +
    + ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn +
    +
    + ADMX_MMCSnapins/MMC_Routing +
    +
    + ADMX_MMCSnapins/MMC_SCA +
    +
    + ADMX_MMCSnapins/MMC_SMTPProtocol +
    +
    + ADMX_MMCSnapins/MMC_SNMP +
    +
    + ADMX_MMCSnapins/MMC_ScriptsMachine_1 +
    +
    + ADMX_MMCSnapins/MMC_ScriptsMachine_2 +
    +
    + ADMX_MMCSnapins/MMC_ScriptsUser_1 +
    +
    + ADMX_MMCSnapins/MMC_ScriptsUser_2 +
    +
    + ADMX_MMCSnapins/MMC_SecuritySettings_1 +
    +
    + ADMX_MMCSnapins/MMC_SecuritySettings_2 +
    +
    + ADMX_MMCSnapins/MMC_SecurityTemplates +
    +
    + ADMX_MMCSnapins/MMC_SendConsoleMessage +
    +
    + ADMX_MMCSnapins/MMC_ServerManager +
    +
    + ADMX_MMCSnapins/MMC_ServiceDependencies +
    +
    + ADMX_MMCSnapins/MMC_Services +
    +
    + ADMX_MMCSnapins/MMC_SharedFolders +
    +
    + ADMX_MMCSnapins/MMC_SharedFolders_Ext +
    +
    + ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1 +
    +
    + ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2 +
    +
    + ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1 +
    +
    + ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2 +
    +
    + ADMX_MMCSnapins/MMC_SysInfo +
    +
    + ADMX_MMCSnapins/MMC_SysProp +
    +
    + ADMX_MMCSnapins/MMC_TPMManagement +
    +
    + ADMX_MMCSnapins/MMC_Telephony +
    +
    + ADMX_MMCSnapins/MMC_TerminalServices +
    +
    + ADMX_MMCSnapins/MMC_WMI +
    +
    + ADMX_MMCSnapins/MMC_WindowsFirewall +
    +
    + ADMX_MMCSnapins/MMC_WindowsFirewall_GP +
    +
    + ADMX_MMCSnapins/MMC_WiredNetworkPolicy +
    +
    + ADMX_MMCSnapins/MMC_WirelessMon +
    +
    + ADMX_MMCSnapins/MMC_WirelessNetworkPolicy +
    +
    + +### ADMX_MSAPolicy policies +
    +
    + ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine +
    +
    + +### ADMX_msched policies + +
    +
    + ADMX_msched/ActivationBoundaryPolicy +
    +
    + ADMX_msched/RandomDelayPolicy +
    +
    + +### ADMX_MSDT policies + +
    +
    + ADMX_MSDT/MsdtSupportProvider +
    +
    + ADMX_MSDT/MsdtToolDownloadPolicy +
    +
    + ADMX_MSDT/WdiScenarioExecutionPolicy +
    +
    + +### ADMX_MSI policies + +
    +
    + ADMX_MSI/AllowLockdownBrowse +
    +
    + ADMX_MSI/AllowLockdownMedia +
    +
    + ADMX_MSI/AllowLockdownPatch +
    +
    + ADMX_MSI/DisableAutomaticApplicationShutdown +
    +
    + ADMX_MSI/DisableBrowse +
    +
    + ADMX_MSI/DisableFlyweightPatching +
    +
    + ADMX_MSI/DisableLoggingFromPackage +
    +
    + ADMX_MSI/DisableMSI +
    +
    + ADMX_MSI/DisableMedia +
    +
    + ADMX_MSI/DisablePatch +
    +
    + ADMX_MSI/DisableRollback_1 +
    +
    + ADMX_MSI/DisableRollback_2 +
    +
    + ADMX_MSI/DisableSharedComponent +
    +
    + ADMX_MSI/MSILogging +
    +
    + ADMX_MSI/MSI_DisableLUAPatching +
    +
    + ADMX_MSI/MSI_DisablePatchUninstall +
    +
    + ADMX_MSI/MSI_DisableSRCheckPoints +
    +
    + ADMX_MSI/MSI_DisableUserInstalls +
    +
    + ADMX_MSI/MSI_EnforceUpgradeComponentRules +
    +
    + ADMX_MSI/MSI_MaxPatchCacheSize +
    +
    + ADMX_MSI/MsiDisableEmbeddedUI +
    +
    + ADMX_MSI/SafeForScripting +
    +
    + ADMX_MSI/SearchOrder +
    +
    + ADMX_MSI/TransformsSecure +
    +
    + +### ADMX_nca policies +
    +
    + ADMX_nca/CorporateResources +
    +
    + ADMX_nca/CustomCommands +
    +
    + ADMX_nca/DTEs +
    +
    + ADMX_nca/FriendlyName +
    +
    + ADMX_nca/LocalNamesOn +
    +
    + ADMX_nca/PassiveMode +
    +
    + ADMX_nca/ShowUI +
    +
    + ADMX_nca/SupportEmail +
    +
    + +### ADMX_NCSI policies +
    +
    + ADMX_NCSI/NCSI_CorpDnsProbeContent +
    +
    + ADMX_NCSI/NCSI_CorpDnsProbeHost +
    +
    + ADMX_NCSI/NCSI_CorpSitePrefixes +
    +
    + ADMX_NCSI/NCSI_CorpWebProbeUrl +
    +
    + ADMX_NCSI/NCSI_DomainLocationDeterminationUrl +
    +
    + ADMX_NCSI/NCSI_GlobalDns +
    +
    + ADMX_NCSI/NCSI_PassivePolling +
    +
    + +### ADMX_Netlogon policies + +
    +
    + ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior +
    +
    + ADMX_Netlogon/Netlogon_AddressTypeReturned +
    +
    + ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch +
    +
    + ADMX_Netlogon/Netlogon_AllowNT4Crypto +
    +
    + ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain +
    +
    + ADMX_Netlogon/Netlogon_AutoSiteCoverage +
    +
    + ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery +
    +
    + ADMX_Netlogon/Netlogon_AvoidPdcOnWan +
    +
    + ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod +
    +
    + ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod +
    +
    + ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime +
    +
    + ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod +
    +
    + ADMX_Netlogon/Netlogon_DebugFlag +
    +
    + ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords +
    +
    + ADMX_Netlogon/Netlogon_DnsRefreshInterval +
    +
    + ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames +
    +
    + ADMX_Netlogon/Netlogon_DnsTtl +
    +
    + ADMX_Netlogon/Netlogon_ExpectedDialupDelay +
    +
    + ADMX_Netlogon/Netlogon_ForceRediscoveryInterval +
    +
    + ADMX_Netlogon/Netlogon_GcSiteCoverage +
    +
    + ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages +
    +
    + ADMX_Netlogon/Netlogon_LdapSrvPriority +
    +
    + ADMX_Netlogon/Netlogon_LdapSrvWeight +
    +
    + ADMX_Netlogon/Netlogon_MaximumLogFileSize +
    +
    + ADMX_Netlogon/Netlogon_NdncSiteCoverage +
    +
    + ADMX_Netlogon/Netlogon_NegativeCachePeriod +
    +
    + ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode +
    +
    + ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod +
    +
    + ADMX_Netlogon/Netlogon_PingUrgencyMode +
    +
    + ADMX_Netlogon/Netlogon_ScavengeInterval +
    +
    + ADMX_Netlogon/Netlogon_SiteCoverage +
    +
    + ADMX_Netlogon/Netlogon_SiteName +
    +
    + ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode +
    +
    + ADMX_Netlogon/Netlogon_TryNextClosestSite +
    +
    + ADMX_Netlogon/Netlogon_UseDynamicDns +
    +
    + +### ADMX_NetworkConnections policies + +
    +
    + ADMX_NetworkConnections/NC_AddRemoveComponents +
    +
    + ADMX_NetworkConnections/NC_AdvancedSettings +
    +
    + ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig +
    +
    + ADMX_NetworkConnections/NC_ChangeBindState +
    +
    + ADMX_NetworkConnections/NC_DeleteAllUserConnection +
    +
    + ADMX_NetworkConnections/NC_DeleteConnection +
    +
    + ADMX_NetworkConnections/NC_DialupPrefs +
    +
    + ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon +
    +
    + ADMX_NetworkConnections/NC_EnableAdminProhibits +
    +
    + ADMX_NetworkConnections/NC_ForceTunneling +
    +
    + ADMX_NetworkConnections/NC_IpStateChecking +
    +
    + ADMX_NetworkConnections/NC_LanChangeProperties +
    +
    + ADMX_NetworkConnections/NC_LanConnect +
    +
    + ADMX_NetworkConnections/NC_LanProperties +
    +
    + ADMX_NetworkConnections/NC_NewConnectionWizard +
    +
    + ADMX_NetworkConnections/NC_PersonalFirewallConfig +
    +
    + ADMX_NetworkConnections/NC_RasAllUserProperties +
    +
    + ADMX_NetworkConnections/NC_RasChangeProperties +
    +
    + ADMX_NetworkConnections/NC_RasConnect +
    +
    + ADMX_NetworkConnections/NC_RasMyProperties +
    +
    + ADMX_NetworkConnections/NC_RenameAllUserRasConnection +
    +
    + ADMX_NetworkConnections/NC_RenameConnection +
    +
    + ADMX_NetworkConnections/NC_RenameLanConnection +
    +
    + ADMX_NetworkConnections/NC_RenameMyRasConnection +
    +
    + ADMX_NetworkConnections/NC_ShowSharedAccessUI +
    +
    + ADMX_NetworkConnections/NC_Statistics +
    +
    + ADMX_NetworkConnections/NC_StdDomainUserSetLocation +
    +
    + +### ADMX_OfflineFiles policies + +
    + ADMX_OfflineFiles/Pol_AlwaysPinSubFolders +
    +
    + ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1 +
    +
    + ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2 +
    +
    + ADMX_OfflineFiles/Pol_BackgroundSyncSettings +
    +
    + ADMX_OfflineFiles/Pol_CacheSize +
    +
    + ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1 +
    +
    + ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2 +
    +
    + ADMX_OfflineFiles/Pol_DefCacheSize +
    +
    + ADMX_OfflineFiles/Pol_Enabled +
    +
    + ADMX_OfflineFiles/Pol_EncryptOfflineFiles +
    +
    + ADMX_OfflineFiles/Pol_EventLoggingLevel_1 +
    +
    + ADMX_OfflineFiles/Pol_EventLoggingLevel_2 +
    +
    + ADMX_OfflineFiles/Pol_ExclusionListSettings +
    +
    + ADMX_OfflineFiles/Pol_ExtExclusionList +
    +
    + ADMX_OfflineFiles/Pol_GoOfflineAction_1 +
    +
    + ADMX_OfflineFiles/Pol_GoOfflineAction_2 +
    +
    + ADMX_OfflineFiles/Pol_NoCacheViewer_1 +
    +
    + ADMX_OfflineFiles/Pol_NoCacheViewer_2 +
    +
    + ADMX_OfflineFiles/Pol_NoConfigCache_1 +
    +
    + ADMX_OfflineFiles/Pol_NoConfigCache_2 +
    +
    + ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1 +
    +
    + ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2 +
    +
    + ADMX_OfflineFiles/Pol_NoPinFiles_1 +
    +
    + ADMX_OfflineFiles/Pol_NoPinFiles_2 +
    +
    + ADMX_OfflineFiles/Pol_NoReminders_1 +
    +
    + ADMX_OfflineFiles/Pol_NoReminders_2 +
    +
    + ADMX_OfflineFiles/Pol_OnlineCachingSettings +
    +
    + ADMX_OfflineFiles/Pol_PurgeAtLogoff +
    +
    + ADMX_OfflineFiles/Pol_QuickAdimPin +
    +
    + ADMX_OfflineFiles/Pol_ReminderFreq_1 +
    +
    + ADMX_OfflineFiles/Pol_ReminderFreq_2 +
    +
    + ADMX_OfflineFiles/Pol_ReminderInitTimeout_1 +
    +
    + ADMX_OfflineFiles/Pol_ReminderInitTimeout_2 +
    +
    + ADMX_OfflineFiles/Pol_ReminderTimeout_1 +
    +
    + ADMX_OfflineFiles/Pol_ReminderTimeout_2 +
    +
    + ADMX_OfflineFiles/Pol_SlowLinkSettings +
    +
    + ADMX_OfflineFiles/Pol_SlowLinkSpeed +
    +
    + ADMX_OfflineFiles/Pol_SyncAtLogoff_1 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtLogoff_2 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtLogon_1 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtLogon_2 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtSuspend_1 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtSuspend_2 +
    +
    + ADMX_OfflineFiles/Pol_SyncOnCostedNetwork +
    +
    + ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1 +
    +
    + ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2 +
    +
    + +### ADMX_PeerToPeerCaching policies + +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB +
    +
    + ADMX_PeerToPeerCaching/SetCachePercent +
    +
    + ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge +
    +
    + ADMX_PeerToPeerCaching/SetDowngrading +
    +
    + +### ADMX_PerformanceDiagnostics policies + +
    +
    + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1 +
    +
    + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2 +
    +
    + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3 +
    +
    + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4 +
    +
    + +### ADMX_Power policies + +
    +
    + ADMX_Power/ACConnectivityInStandby_2 +
    +
    + ADMX_Power/ACCriticalSleepTransitionsDisable_2 +
    +
    + ADMX_Power/ACStartMenuButtonAction_2 +
    +
    + ADMX_Power/AllowSystemPowerRequestAC +
    +
    + ADMX_Power/AllowSystemPowerRequestDC +
    +
    + ADMX_Power/AllowSystemSleepWithRemoteFilesOpenAC +
    +
    + ADMX_Power/AllowSystemSleepWithRemoteFilesOpenDC +
    +
    + ADMX_Power/CustomActiveSchemeOverride_2 +
    +
    + ADMX_Power/DCBatteryDischargeAction0_2 +
    +
    + ADMX_Power/DCBatteryDischargeAction1_2 +
    +
    + ADMX_Power/DCBatteryDischargeLevel0_2 +
    +
    + ADMX_Power/DCBatteryDischargeLevel1UINotification_2 +
    +
    + ADMX_Power/DCBatteryDischargeLevel1_2 +
    +
    + ADMX_Power/DCConnectivityInStandby_2 +
    +
    + ADMX_Power/DCCriticalSleepTransitionsDisable_2 +
    +
    + ADMX_Power/DCStartMenuButtonAction_2 +
    +
    + ADMX_Power/DiskACPowerDownTimeOut_2 +
    +
    + ADMX_Power/DiskDCPowerDownTimeOut_2 +
    +
    + ADMX_Power/Dont_PowerOff_AfterShutdown +
    +
    + ADMX_Power/EnableDesktopSlideShowAC +
    +
    + ADMX_Power/EnableDesktopSlideShowDC +
    +
    + ADMX_Power/InboxActiveSchemeOverride_2 +
    +
    + ADMX_Power/PW_PromptPasswordOnResume +
    +
    + ADMX_Power/PowerThrottlingTurnOff +
    +
    + ADMX_Power/ReserveBatteryNotificationLevel +
    +
    + +### ADMX_PowerShellExecutionPolicy policies + +
    +
    + ADMX_PowerShellExecutionPolicy/EnableModuleLogging +
    +
    + ADMX_PowerShellExecutionPolicy/EnableScripts +
    +
    + ADMX_PowerShellExecutionPolicy/EnableTranscripting +
    +
    + ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath +
    +
    + +### ADMX_Printing policies + +
    +
    + ADMX_Printing/AllowWebPrinting +
    +
    + ADMX_Printing/ApplicationDriverIsolation +
    +
    + ADMX_Printing/CustomizedSupportUrl +
    +
    + ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate +
    +
    + ADMX_Printing/DomainPrinters +
    +
    + ADMX_Printing/DownlevelBrowse +
    +
    + ADMX_Printing/EMFDespooling +
    +
    + ADMX_Printing/ForceSoftwareRasterization +
    +
    + ADMX_Printing/IntranetPrintersUrl +
    +
    + ADMX_Printing/KMPrintersAreBlocked +
    +
    + ADMX_Printing/LegacyDefaultPrinterMode +
    +
    + ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS +
    +
    + ADMX_Printing/NoDeletePrinter +
    +
    + ADMX_Printing/NonDomainPrinters +
    +
    + ADMX_Printing/PackagePointAndPrintOnly +
    +
    + ADMX_Printing/PackagePointAndPrintOnly_Win7 +
    +
    + ADMX_Printing/PackagePointAndPrintServerList +
    +
    + ADMX_Printing/PackagePointAndPrintServerList_Win7 +
    +
    + ADMX_Printing/PhysicalLocation +
    +
    + ADMX_Printing/PhysicalLocationSupport +
    +
    + ADMX_Printing/PrintDriverIsolationExecutionPolicy +
    +
    + ADMX_Printing/PrintDriverIsolationOverrideCompat +
    +
    + ADMX_Printing/PrinterDirectorySearchScope +
    +
    + ADMX_Printing/PrinterServerThread +
    +
    + ADMX_Printing/ShowJobTitleInEventLogs +
    +
    + ADMX_Printing/V4DriverDisallowPrinterExtension +
    +
    + +### ADMX_Printing2 policies + +
    +
    + ADMX_Printing2/AutoPublishing +
    +
    + ADMX_Printing2/ImmortalPrintQueue +
    +
    + ADMX_Printing2/PruneDownlevel +
    +
    + ADMX_Printing2/PruningInterval +
    +
    + ADMX_Printing2/PruningPriority +
    +
    + ADMX_Printing2/PruningRetries +
    +
    + ADMX_Printing2/PruningRetryLog +
    +
    + ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint +
    +
    + ADMX_Printing2/VerifyPublishedState +
    +
    + +### ADMX_Programs policies + +
    +
    + ADMX_Programs/NoDefaultPrograms +
    +
    + ADMX_Programs/NoGetPrograms +
    +
    + ADMX_Programs/NoInstalledUpdates +
    +
    + ADMX_Programs/NoProgramsAndFeatures +
    +
    + ADMX_Programs/NoProgramsCPL +
    +
    + ADMX_Programs/NoWindowsFeatures +
    +
    + ADMX_Programs/NoWindowsMarketplace +
    +
    + +### ADMX_Reliability policies + +
    +
    + ADMX_Reliability/EE_EnablePersistentTimeStamp +
    +
    + ADMX_Reliability/PCH_ReportShutdownEvents +
    +
    + ADMX_Reliability/ShutdownEventTrackerStateFile +
    +
    + ADMX_Reliability/ShutdownReason +
    +
    + +### ADMX_RemoteAssistance policies + +
    +
    + ADMX_RemoteAssistance/RA_EncryptedTicketOnly +
    +
    + ADMX_RemoteAssistance/RA_Optimize_Bandwidth +
    +
    + +### ADMX_RemovableStorage policies + +
    +
    + ADMX_RemovableStorage/AccessRights_RebootTime_1 +
    +
    + ADMX_RemovableStorage/AccessRights_RebootTime_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2 +
    +
    + ADMX_RemovableStorage/Removable_Remote_Allow_Access +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2 +
    +
    + +### ADMX_RPC policies + +
    +
    + ADMX_RPC/RpcExtendedErrorInformation +
    +
    + ADMX_RPC/RpcIgnoreDelegationFailure +
    +
    + ADMX_RPC/RpcMinimumHttpConnectionTimeout +
    +
    + ADMX_RPC/RpcStateInformation +
    +
    + +### ADMX_Scripts policies + +
    +
    + ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled +
    +
    + ADMX_Scripts/MaxGPOScriptWaitPolicy +
    +
    + ADMX_Scripts/Run_Computer_PS_Scripts_First +
    +
    + ADMX_Scripts/Run_Legacy_Logon_Script_Hidden +
    +
    + ADMX_Scripts/Run_Logoff_Script_Visible +
    +
    + ADMX_Scripts/Run_Logon_Script_Sync_1 +
    +
    + ADMX_Scripts/Run_Logon_Script_Sync_2 +
    +
    + ADMX_Scripts/Run_Logon_Script_Visible +
    +
    + ADMX_Scripts/Run_Shutdown_Script_Visible +
    +
    + ADMX_Scripts/Run_Startup_Script_Sync +
    +
    + ADMX_Scripts/Run_Startup_Script_Visible +
    +
    + ADMX_Scripts/Run_User_PS_Scripts_First +
    +
    + +### ADMX_sdiageng policies + +
    +
    + ADMX_sdiageng/BetterWhenConnected +
    +
    + ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy +
    +
    + ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy +
    +
    + +### ADMX_Securitycenter policies + +
    +
    + ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain +
    +
    + +### ADMX_Sensors policies + +
    +
    + ADMX_Sensors/DisableLocationScripting_1 +
    +
    + ADMX_Sensors/DisableLocationScripting_2 +
    +
    + ADMX_Sensors/DisableLocation_1 +
    +
    + ADMX_Sensors/DisableSensors_1 +
    +
    + ADMX_Sensors/DisableSensors_2 +
    +
    + +### ADMX_Servicing policies + +
    +
    + ADMX_Servicing/Servicing +
    +
    + +### ADMX_SettingSync policies + +
    +
    + ADMX_SettingSync/DisableAppSyncSettingSync +
    +
    + ADMX_SettingSync/DisableApplicationSettingSync +
    +
    + ADMX_SettingSync/DisableCredentialsSettingSync +
    +
    + ADMX_SettingSync/DisableDesktopThemeSettingSync +
    +
    + ADMX_SettingSync/DisablePersonalizationSettingSync +
    +
    + ADMX_SettingSync/DisableSettingSync +
    +
    + ADMX_SettingSync/DisableStartLayoutSettingSync +
    +
    + ADMX_SettingSync/DisableSyncOnPaidNetwork +
    +
    + ADMX_SettingSync/DisableWindowsSettingSync +
    +
    + +### ADMX_SharedFolders policies + +
    +
    + ADMX_SharedFolders/PublishDfsRoots +
    +
    + ADMX_SharedFolders/PublishSharedFolders +
    +
    + +### ADMX_Sharing policies + +
    +
    + ADMX_Sharing/NoInplaceSharing +
    +
    + +## ADMX_ShellCommandPromptRegEditTools policies + +
    +
    + ADMX_ShellCommandPromptRegEditTools/DisableCMD +
    +
    + ADMX_ShellCommandPromptRegEditTools/DisableRegedit +
    +
    + ADMX_ShellCommandPromptRegEditTools/DisallowApps +
    +
    + ADMX_ShellCommandPromptRegEditTools/RestrictApps +
    +
    + +### ADMX_SkyDrive policies + +
    +
    + ADMX_SkyDrive/PreventNetworkTrafficPreUserSignIn +
    +
    + +### ADMX_Smartcard policies + +
    +
    + ADMX_Smartcard/AllowCertificatesWithNoEKU +
    +
    + ADMX_Smartcard/AllowIntegratedUnblock +
    +
    + ADMX_Smartcard/AllowSignatureOnlyKeys +
    +
    + ADMX_Smartcard/AllowTimeInvalidCertificates +
    +
    + ADMX_Smartcard/CertPropEnabledString +
    +
    + ADMX_Smartcard/CertPropRootCleanupString +
    +
    + ADMX_Smartcard/CertPropRootEnabledString +
    +
    + ADMX_Smartcard/DisallowPlaintextPin +
    +
    + ADMX_Smartcard/EnumerateECCCerts +
    +
    + ADMX_Smartcard/FilterDuplicateCerts +
    +
    + ADMX_Smartcard/ForceReadingAllCertificates +
    +
    + ADMX_Smartcard/IntegratedUnblockPromptString +
    +
    + ADMX_Smartcard/ReverseSubject +
    +
    + ADMX_Smartcard/SCPnPEnabled +
    +
    + ADMX_Smartcard/SCPnPNotification +
    +
    + ADMX_Smartcard/X509HintsNeeded +
    +
    + +### ADMX_Snmp policies + +
    +
    + ADMX_Snmp/SNMP_Communities +
    +
    + ADMX_Snmp/SNMP_PermittedManagers +
    +
    + ADMX_Snmp/SNMP_Traps_Public +
    +
    + +### ADMX_StartMenu policies + +
    +
    + ADMX_StartMenu/AddSearchInternetLinkInStartMenu +
    +
    + ADMX_StartMenu/ClearRecentDocsOnExit +
    +
    + ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu +
    +
    + ADMX_StartMenu/ClearTilesOnExit +
    +
    + ADMX_StartMenu/DesktopAppsFirstInAppsView +
    +
    + ADMX_StartMenu/DisableGlobalSearchOnAppsView +
    +
    + ADMX_StartMenu/ForceStartMenuLogOff +
    +
    + ADMX_StartMenu/GoToDesktopOnSignIn +
    +
    + ADMX_StartMenu/GreyMSIAds +
    +
    + ADMX_StartMenu/HidePowerOptions +
    +
    + ADMX_StartMenu/Intellimenus +
    +
    + ADMX_StartMenu/LockTaskbar +
    +
    + ADMX_StartMenu/MemCheckBoxInRunDlg +
    +
    + ADMX_StartMenu/NoAutoTrayNotify +
    +
    + ADMX_StartMenu/NoBalloonTip +
    +
    + ADMX_StartMenu/NoChangeStartMenu +
    +
    + ADMX_StartMenu/NoClose +
    +
    + ADMX_StartMenu/NoCommonGroups +
    +
    + ADMX_StartMenu/NoFavoritesMenu +
    +
    + ADMX_StartMenu/NoFind +
    +
    + ADMX_StartMenu/NoGamesFolderOnStartMenu +
    +
    + ADMX_StartMenu/NoHelp +
    +
    + ADMX_StartMenu/NoInstrumentation +
    +
    + ADMX_StartMenu/NoMoreProgramsList +
    +
    + ADMX_StartMenu/NoNetAndDialupConnect +
    +
    + ADMX_StartMenu/NoPinnedPrograms +
    +
    + ADMX_StartMenu/NoRecentDocsMenu +
    +
    + ADMX_StartMenu/NoResolveSearch +
    +
    + ADMX_StartMenu/NoResolveTrack +
    +
    + ADMX_StartMenu/NoRun +
    +
    + ADMX_StartMenu/NoSMConfigurePrograms +
    +
    + ADMX_StartMenu/NoSMMyDocuments +
    +
    + ADMX_StartMenu/NoSMMyMusic +
    +
    + ADMX_StartMenu/NoSMMyNetworkPlaces +
    +
    + ADMX_StartMenu/NoSMMyPictures +
    +
    + ADMX_StartMenu/NoSearchCommInStartMenu +
    +
    + ADMX_StartMenu/NoSearchComputerLinkInStartMenu +
    +
    + ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu +
    +
    + ADMX_StartMenu/NoSearchFilesInStartMenu +
    +
    + ADMX_StartMenu/NoSearchInternetInStartMenu +
    +
    + ADMX_StartMenu/NoSearchProgramsInStartMenu +
    +
    + ADMX_StartMenu/NoSetFolders +
    +
    + ADMX_StartMenu/NoSetTaskbar +
    +
    + ADMX_StartMenu/NoStartMenuDownload +
    +
    + ADMX_StartMenu/NoStartMenuHomegroup +
    +
    + ADMX_StartMenu/NoStartMenuRecordedTV +
    +
    + ADMX_StartMenu/NoStartMenuSubFolders +
    +
    + ADMX_StartMenu/NoStartMenuVideos +
    +
    + ADMX_StartMenu/NoStartPage +
    +
    + ADMX_StartMenu/NoTaskBarClock +
    +
    + ADMX_StartMenu/NoTaskGrouping +
    +
    + ADMX_StartMenu/NoToolbarsOnTaskbar +
    +
    + ADMX_StartMenu/NoTrayContextMenu +
    +
    + ADMX_StartMenu/NoTrayItemsDisplay +
    +
    + ADMX_StartMenu/NoUninstallFromStart +
    +
    + ADMX_StartMenu/NoUserFolderOnStartMenu +
    +
    + ADMX_StartMenu/NoUserNameOnStartMenu +
    +
    + ADMX_StartMenu/NoWindowsUpdate +
    +
    + ADMX_StartMenu/PowerButtonAction +
    +
    + ADMX_StartMenu/QuickLaunchEnabled +
    +
    + ADMX_StartMenu/RemoveUnDockPCButton +
    +
    + ADMX_StartMenu/ShowAppsViewOnStart +
    +
    + ADMX_StartMenu/ShowRunAsDifferentUserInStart +
    +
    + ADMX_StartMenu/ShowRunInStartMenu +
    +
    + ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey +
    +
    + ADMX_StartMenu/StartMenuLogOff +
    +
    + ADMX_StartMenu/StartPinAppsWhenInstalled +
    +
    + +### ADMX_SystemRestore policies + +
    +
    + ADMX_SystemRestore/SR_DisableConfig +
    +
    + +### ADMX_Taskbar policies + +
    +
    + ADMX_Taskbar/DisableNotificationCenter +
    +
    + ADMX_Taskbar/EnableLegacyBalloonNotifications +
    +
    + ADMX_Taskbar/HideSCAHealth +
    +
    + ADMX_Taskbar/HideSCANetwork +
    +
    + ADMX_Taskbar/HideSCAPower +
    +
    + ADMX_Taskbar/HideSCAVolume +
    +
    + ADMX_Taskbar/NoBalloonFeatureAdvertisements +
    +
    + ADMX_Taskbar/NoPinningStoreToTaskbar +
    +
    + ADMX_Taskbar/NoPinningToDestinations +
    +
    + ADMX_Taskbar/NoPinningToTaskbar +
    +
    + ADMX_Taskbar/NoRemoteDestinations +
    +
    + ADMX_Taskbar/NoSystraySystemPromotion +
    +
    + ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar +
    +
    + ADMX_Taskbar/TaskbarLockAll +
    +
    + ADMX_Taskbar/TaskbarNoAddRemoveToolbar +
    +
    + ADMX_Taskbar/TaskbarNoDragToolbar +
    +
    + ADMX_Taskbar/TaskbarNoMultimon +
    +
    + ADMX_Taskbar/TaskbarNoNotification +
    +
    + ADMX_Taskbar/TaskbarNoPinnedList +
    +
    + ADMX_Taskbar/TaskbarNoRedock +
    +
    + ADMX_Taskbar/TaskbarNoResize +
    +
    + ADMX_Taskbar/TaskbarNoThumbnail +
    +
    + +### ADMX_tcpip policies + +
    +
    + ADMX_tcpip/6to4_Router_Name +
    +
    + ADMX_tcpip/6to4_Router_Name_Resolution_Interval +
    +
    + ADMX_tcpip/6to4_State +
    +
    + ADMX_tcpip/IPHTTPS_ClientState +
    +
    + ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State +
    +
    + ADMX_tcpip/ISATAP_Router_Name +
    +
    + ADMX_tcpip/ISATAP_State +
    +
    + ADMX_tcpip/Teredo_Client_Port +
    +
    + ADMX_tcpip/Teredo_Default_Qualified +
    +
    + ADMX_tcpip/Teredo_Refresh_Rate +
    +
    + ADMX_tcpip/Teredo_Server_Name +
    +
    + ADMX_tcpip/Teredo_State +
    +
    + ADMX_tcpip/Windows_Scaling_Heuristics_State +
    +
    + +### ADMX_Thumbnails policies + +
    +
    + ADMX_Thumbnails/DisableThumbnails +
    +
    + ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders +
    +
    + ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders +
    +
    + +### ADMX_TPM policies + +
    +
    + ADMX_TPM/BlockedCommandsList_Name +
    +
    + ADMX_TPM/ClearTPMIfNotReady_Name +
    +
    + ADMX_TPM/IgnoreDefaultList_Name +
    +
    + ADMX_TPM/IgnoreLocalList_Name +
    +
    + ADMX_TPM/OSManagedAuth_Name +
    +
    + ADMX_TPM/OptIntoDSHA_Name +
    +
    + ADMX_TPM/StandardUserAuthorizationFailureDuration_Name +
    +
    + ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name +
    +
    + ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name +
    +
    + ADMX_TPM/UseLegacyDAP_Name +
    +
    + +### ADMX_UserExperienceVirtualization policies + +
    +
    + ADMX_UserExperienceVirtualization/Calculator +
    +
    + ADMX_UserExperienceVirtualization/ConfigureSyncMethod +
    +
    + ADMX_UserExperienceVirtualization/ConfigureVdi +
    +
    + ADMX_UserExperienceVirtualization/ContactITDescription +
    +
    + ADMX_UserExperienceVirtualization/ContactITUrl +
    +
    + ADMX_UserExperienceVirtualization/DisableWin8Sync +
    +
    + ADMX_UserExperienceVirtualization/DisableWindowsOSSettings +
    +
    + ADMX_UserExperienceVirtualization/EnableUEV +
    +
    + ADMX_UserExperienceVirtualization/Finance +
    +
    + ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled +
    +
    + ADMX_UserExperienceVirtualization/Games +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorer8 +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorer9 +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorer10 +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorer11 +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorerCommon +
    +
    + ADMX_UserExperienceVirtualization/Maps +
    +
    + ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016 +
    +
    + ADMX_UserExperienceVirtualization/Music +
    +
    + ADMX_UserExperienceVirtualization/News +
    +
    + ADMX_UserExperienceVirtualization/Notepad +
    +
    + ADMX_UserExperienceVirtualization/Reader +
    +
    + ADMX_UserExperienceVirtualization/RepositoryTimeout +
    +
    + ADMX_UserExperienceVirtualization/SettingsStoragePath +
    +
    + ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath +
    +
    + ADMX_UserExperienceVirtualization/Sports +
    +
    + ADMX_UserExperienceVirtualization/SyncEnabled +
    +
    + ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork +
    +
    + ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming +
    +
    + ADMX_UserExperienceVirtualization/SyncProviderPingEnabled +
    +
    + ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps +
    +
    + ADMX_UserExperienceVirtualization/Travel +
    +
    + ADMX_UserExperienceVirtualization/TrayIconEnabled +
    +
    + ADMX_UserExperienceVirtualization/Video +
    +
    + ADMX_UserExperienceVirtualization/Weather +
    +
    + ADMX_UserExperienceVirtualization/Wordpad +
    +
    + +### ADMX_UserProfiles policies + +
    +
    + ADMX_UserProfiles/CleanupProfiles +
    +
    + ADMX_UserProfiles/DontForceUnloadHive +
    +
    + ADMX_UserProfiles/LeaveAppMgmtData +
    +
    + ADMX_UserProfiles/LimitSize +
    +
    + ADMX_UserProfiles/ProfileErrorAction +
    +
    + ADMX_UserProfiles/SlowLinkTimeOut +
    +
    + ADMX_UserProfiles/USER_HOME +
    +
    + ADMX_UserProfiles/UserInfoAccessAction +
    +
    + +### ADMX_W32Time policies + +
    +
    + ADMX_W32Time/W32TIME_POLICY_CONFIG +
    +
    + ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT +
    +
    + ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT +
    +
    + ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER +
    +
    + +### ADMX_WCM policies + +
    +
    + ADMX_WCM/WCM_DisablePowerManagement +
    +
    + ADMX_WCM/WCM_EnableSoftDisconnect +
    +
    + ADMX_WCM/WCM_MinimizeConnections +
    +
    + +### ADMX_WinCal policies + +
    +
    + ADMX_WinCal/TurnOffWinCal_1 +
    +
    + ADMX_WinCal/TurnOffWinCal_2 +
    +
    + +### ADMX_WindowsAnytimeUpgrade policies + +
    +
    + ADMX_WindowsAnytimeUpgrade/Disabled +
    +
    + +### ADMX_WindowsConnectNow policies + +
    +
    + ADMX_WindowsConnectNow/WCN_DisableWcnUi_1 +
    +
    + ADMX_WindowsConnectNow/WCN_DisableWcnUi_2 +
    +
    + ADMX_WindowsConnectNow/WCN_EnableRegistrar +
    +
    + + +### ADMX_WindowsExplorer policies + +
    +
    + ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS +
    +
    + ADMX_WindowsExplorer/ClassicShell +
    +
    + ADMX_WindowsExplorer/ConfirmFileDelete +
    +
    + ADMX_WindowsExplorer/DefaultLibrariesLocation +
    +
    + ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage +
    +
    + ADMX_WindowsExplorer/DisableIndexedLibraryExperience +
    +
    + ADMX_WindowsExplorer/DisableKnownFolders +
    +
    + ADMX_WindowsExplorer/DisableSearchBoxSuggestions +
    +
    + ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath +
    +
    + ADMX_WindowsExplorer/EnableSmartScreen +
    +
    + ADMX_WindowsExplorer/EnforceShellExtensionSecurity +
    +
    + ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized +
    +
    + ADMX_WindowsExplorer/HideContentViewModeSnippets +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown +
    +
    + ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo +
    +
    + ADMX_WindowsExplorer/MaxRecentDocs +
    +
    + ADMX_WindowsExplorer/NoBackButton +
    +
    + ADMX_WindowsExplorer/NoCDBurning +
    +
    + ADMX_WindowsExplorer/NoCacheThumbNailPictures +
    +
    + ADMX_WindowsExplorer/NoChangeAnimation +
    +
    + ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators +
    +
    + ADMX_WindowsExplorer/NoDFSTab +
    +
    + ADMX_WindowsExplorer/NoDrives +
    +
    + ADMX_WindowsExplorer/NoEntireNetwork +
    +
    + ADMX_WindowsExplorer/NoFileMRU +
    +
    + ADMX_WindowsExplorer/NoFileMenu +
    +
    + ADMX_WindowsExplorer/NoFolderOptions +
    +
    + ADMX_WindowsExplorer/NoHardwareTab +
    +
    + ADMX_WindowsExplorer/NoManageMyComputerVerb +
    +
    + ADMX_WindowsExplorer/NoMyComputerSharedDocuments +
    +
    + ADMX_WindowsExplorer/NoNetConnectDisconnect +
    +
    + ADMX_WindowsExplorer/NoNewAppAlert +
    +
    + ADMX_WindowsExplorer/NoPlacesBar +
    +
    + ADMX_WindowsExplorer/NoRecycleFiles +
    +
    + ADMX_WindowsExplorer/NoRunAsInstallPrompt +
    +
    + ADMX_WindowsExplorer/NoSearchInternetTryHarderButton +
    +
    + ADMX_WindowsExplorer/NoSecurityTab +
    +
    + ADMX_WindowsExplorer/NoShellSearchButton +
    +
    + ADMX_WindowsExplorer/NoStrCmpLogical +
    +
    + ADMX_WindowsExplorer/NoViewContextMenu +
    +
    + ADMX_WindowsExplorer/NoViewOnDrive +
    +
    + ADMX_WindowsExplorer/NoWindowsHotKeys +
    +
    + ADMX_WindowsExplorer/NoWorkgroupContents +
    +
    + ADMX_WindowsExplorer/PlacesBar +
    +
    + ADMX_WindowsExplorer/PromptRunasInstallNetPath +
    +
    + ADMX_WindowsExplorer/RecycleBinSize +
    +
    + ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1 +
    +
    + ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2 +
    +
    + ADMX_WindowsExplorer/ShowHibernateOption +
    +
    + ADMX_WindowsExplorer/ShowSleepOption +
    +
    + ADMX_WindowsExplorer/TryHarderPinnedLibrary +
    +
    + ADMX_WindowsExplorer/TryHarderPinnedOpenSearch +
    +
    + +### ADMX_WindowsMediaDRM policies + +
    +
    + ADMX_WindowsMediaDRM/DisableOnline +
    +
    + +### ADMX_WindowsMediaPlayer policies + +
    +
    + ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings +
    +
    + ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings +
    +
    + ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings +
    +
    + ADMX_WindowsMediaPlayer/DisableAutoUpdate +
    +
    + ADMX_WindowsMediaPlayer/DisableNetworkSettings +
    +
    + ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration +
    +
    + ADMX_WindowsMediaPlayer/DoNotShowAnchor +
    +
    + ADMX_WindowsMediaPlayer/DontUseFrameInterpolation +
    +
    + ADMX_WindowsMediaPlayer/EnableScreenSaver +
    +
    + ADMX_WindowsMediaPlayer/HidePrivacyTab +
    +
    + ADMX_WindowsMediaPlayer/HideSecurityTab +
    +
    + ADMX_WindowsMediaPlayer/NetworkBuffering +
    +
    + ADMX_WindowsMediaPlayer/PolicyCodecUpdate +
    +
    + ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval +
    +
    + ADMX_WindowsMediaPlayer/PreventLibrarySharing +
    +
    + ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval +
    +
    + ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut +
    +
    + ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval +
    +
    + ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut +
    +
    + ADMX_WindowsMediaPlayer/SkinLockDown +
    +
    + ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols +
    +
    + +### ADMX_WindowsRemoteManagement policies + +
    +
    + ADMX_WindowsRemoteManagement/DisallowKerberos_1 +
    +
    + ADMX_WindowsRemoteManagement/DisallowKerberos_2 +
    +
    + +### ADMX_WindowsStore policies + +
    +
    + ADMX_WindowsStore/DisableAutoDownloadWin8 +
    +
    + ADMX_WindowsStore/DisableOSUpgrade_1 +
    +
    + ADMX_WindowsStore/DisableOSUpgrade_2 +
    +
    + ADMX_WindowsStore/RemoveWindowsStore_1 +
    +
    + ADMX_WindowsStore/RemoveWindowsStore_2 +
    +
    + +### ADMX_WinInit policies + +
    +
    + ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription +
    +
    + ADMX_WinInit/Hiberboot +
    +
    + ADMX_WinInit/ShutdownTimeoutHungSessionsDescription +
    +
    + +### ADMX_WinLogon policies + +
    +
    + ADMX_WinLogon/CustomShell +
    +
    + ADMX_WinLogon/DisplayLastLogonInfoDescription +
    +
    + ADMX_WinLogon/LogonHoursNotificationPolicyDescription +
    +
    + ADMX_WinLogon/LogonHoursPolicyDescription +
    +
    + ADMX_WinLogon/ReportCachedLogonPolicyDescription +
    +
    + ADMX_WinLogon/SoftwareSASGeneration +
    +
    + +### ADMX_wlansvc policies + +
    +
    + ADMX_wlansvc/SetCost +
    +
    + ADMX_wlansvc/SetPINEnforced +
    +
    + ADMX_wlansvc/SetPINPreferred +
    +
    + +### ADMX_WPN policies + +
    +
    + ADMX_WPN/NoCallsDuringQuietHours +
    +
    + ADMX_WPN/NoLockScreenToastNotification +
    +
    + ADMX_WPN/NoQuietHours +
    +
    + ADMX_WPN/NoToastNotification +
    +
    + ADMX_WPN/QuietHoursDailyBeginMinute +
    +
    + ADMX_WPN/QuietHoursDailyEndMinute +
    +
    + ### ApplicationDefaults policies
    @@ -565,11 +5016,11 @@ The following diagram shows the Policy configuration service provider in tree fo
    -### Bitlocker policies +### BitLocker policies
    - Bitlocker/EncryptionMethod + BitLocker/EncryptionMethod
    @@ -1078,6 +5529,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    DeliveryOptimization/DOCacheHost
    +
    + DeliveryOptimization/DOCacheHostSource +
    DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    @@ -1098,6 +5552,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    DeliveryOptimization/DOGroupIdSource +
    +
    + DeliveryOptimization/DOMaxBackgroundDownloadBandwidth
    DeliveryOptimization/DOMaxCacheAge @@ -1106,10 +5563,13 @@ The following diagram shows the Policy configuration service provider in tree fo DeliveryOptimization/DOMaxCacheSize
    - DeliveryOptimization/DOMaxDownloadBandwidth + DeliveryOptimization/DOMaxDownloadBandwidth (deprecated)
    - DeliveryOptimization/DOMaxUploadBandwidth + DeliveryOptimization/DOMaxForegroundDownloadBandwidth +
    +
    + DeliveryOptimization/DOMaxUploadBandwidth (deprecated)
    DeliveryOptimization/DOMinBackgroundQos @@ -1136,7 +5596,7 @@ The following diagram shows the Policy configuration service provider in tree fo DeliveryOptimization/DOPercentageMaxBackgroundBandwidth
    - DeliveryOptimization/DOPercentageMaxDownloadBandwidth + DeliveryOptimization/DOPercentageMaxDownloadBandwidth (deprecated)
    DeliveryOptimization/DOPercentageMaxForegroundBandwidth @@ -1426,6 +5886,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Experience/ConfigureWindowsSpotlightOnLockScreen
    +
    + Experience/DisableCloudOptimizedContent +
    Experience/DoNotShowFeedbackNotifications
    @@ -2333,15 +6796,6 @@ The following diagram shows the Policy configuration service provider in tree fo
    LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    -
    - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways -
    -
    - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible -
    -
    - LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges -
    LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    @@ -2390,6 +6844,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    +
    + LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM +
    LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    @@ -2399,6 +6856,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    +
    + LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients +
    LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    @@ -2414,18 +6874,12 @@ The following diagram shows the Policy configuration service provider in tree fo
    LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    -
    - LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon -
    LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    -
    - LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems -
    LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    @@ -2458,7 +6912,13 @@ The following diagram shows the Policy configuration service provider in tree fo +### LocalUsersAndGroups policies +
    +
    + LocalUsersAndGroups/Configure +
    +
    ### LockDown policies @@ -2487,6 +6947,26 @@ The following diagram shows the Policy configuration service provider in tree fo +### MixedReality policies + +
    +
    + MixedReality/AADGroupMembershipCacheValidityInDays +
    +
    + MixedReality/BrightnessButtonDisabled +
    +
    + MixedReality/FallbackDiagnostics +
    +
    + MixedReality/MicrophoneDisabled +
    +
    + MixedReality/VolumeButtonDisabled +
    +
    + ### MSSecurityGuide policies
    @@ -2527,6 +7007,14 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### Multitasking policies + +
    +
    + Multitasking/BrowserAltTabBlowout +
    +
    + ### NetworkIsolation policies
    @@ -3083,9 +7571,6 @@ The following diagram shows the Policy configuration service provider in tree fo
    Search/AllowCloudSearch
    -
    - Search/AllowCortanaInAAD -
    Search/AllowFindMyFiles
    @@ -3651,6 +8136,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Update/DisableDualScan
    +
    + Update/DisableWUfBSafeguards +
    Update/EngagedRestartDeadline
    @@ -3747,6 +8235,13 @@ The following diagram shows the Policy configuration service provider in tree fo
    Update/SetEDURestart
    +
    + Update/SetProxyBehaviorForUpdateDetection +
    +
    + Update/TargetReleaseVersion +
    +
    Update/UpdateNotificationLevel
    @@ -4000,6 +8495,29 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### WindowsSandbox policies + +
    +
    + WindowsSandbox/AllowAudioInput +
    +
    + WindowsSandbox/AllowClipboardRedirection +
    +
    + WindowsSandbox/AllowNetworking +
    +
    + WindowsSandbox/AllowPrinterRedirection +
    +
    + WindowsSandbox/AllowVGPU +
    +
    + WindowsSandbox/AllowVideoInput +
    +
    + ### WirelessDisplay policies
    @@ -4029,24 +8547,27 @@ The following diagram shows the Policy configuration service provider in tree fo
    -## Policies supported by Group Policy and ADMX-backed policies -- [Policies supported by Group Policy](policies-supported-by-group-policy.md) -- [ADMX-backed policies](policies-admx-backed.md) +## Policies in Policy CSP supported by Group Policy and ADMX-backed policies in Policy CSP +- [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md) +- [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) -## Policies supported by HoloLens devices -- [Policies supported by HoloLens 2](policies-supported-by-hololens2.md) -- [Policies supported by HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) -- [Policies supported by HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) +> [!NOTE] +> Not all Policies in Policy CSP supported by Group Policy are ADMX-backed. For more details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -## Policies supported by Windows 10 IoT -- [Policies supported by Windows 10 IoT Enterprise](policies-supported-by-iot-enterprise.md) -- [Policies supported by Windows 10 IoT Core](policies-supported-by-iot-core.md) +## Policies in Policy CSP supported by HoloLens devices +- [Policies in Policy CSP supported by HoloLens 2](policy-csps-supported-by-hololens2.md) +- [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md) +- [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md) -## Policies supported by Microsoft Surface Hub -- [Policies supported by Microsoft Surface Hub](policies-supported-by-surface-hub.md) +## Policies in Policy CSP supported by Windows 10 IoT +- [Policies in Policy CSP supported by Windows 10 IoT Enterprise](policy-csps-supported-by-iot-enterprise.md) +- [Policies in Policy CSP supported by Windows 10 IoT Core](policy-csps-supported-by-iot-core.md) -## Policies that can be set using Exchange Active Sync (EAS) -- [Policies that can be set using Exchange Active Sync (EAS)](policies-that-can-be-set-using-eas.md) +## Policies in Policy CSP supported by Microsoft Surface Hub +- [Policies in Policy CSP supported by Microsoft Surface Hub](policy-csps-supported-by-surface-hub.md) + +## Policies in Policy CSP that can be set using Exchange ActiveSync (EAS) +- [Policies in Policy CSP that can be set using Exchange ActiveSync (EAS)](policy-csps-that-can-be-set-using-eas.md) ## Related topics diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 493575d365..23c1bb8142 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AboveLock -description: Policy CSP - AboveLock +description: Learn the various AboveLock Policy configuration service provider (CSP) for Windows editions of Home, Pro, Business, and more. ms.author: dansimp ms.localizationpriority: medium ms.topic: article @@ -161,12 +161,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index f097cc7b37..4367ed3ed6 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Accounts -description: Policy CSP - Accounts +description: Learn about the Policy configuration service provider (CSP). This articles describes account policies. ms.author: dansimp ms.localizationpriority: medium ms.topic: article @@ -248,12 +248,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 98588acfa2..d760021b1e 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ActiveXControls -description: Policy CSP - ActiveXControls +description: Learn about various Policy configuration service provider (CSP) - ActiveXControls settings, including SyncML, for Windows 10. ms.author: dansimp ms.localizationpriority: medium ms.topic: article @@ -74,7 +74,7 @@ manager: dansimp -This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL. +This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved ActiveX Install sites specified by host URL. If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL. @@ -103,12 +103,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md new file mode 100644 index 0000000000..2b4c414ae7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -0,0 +1,120 @@ +--- +title: Policy CSP - ADMX_ActiveXInstallService +description: Policy CSP - ADMX_ActiveXInstallService +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ActiveXInstallService +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_ActiveXInstallService policies + +
    +
    + ADMX_ActiveXInstallService/AxISURLZonePolicies +
    +
    + + +
    + + +**ADMX_ActiveXInstallService/AxISURLZonePolicies** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the installation of ActiveX controls for sites in Trusted zone. + +If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting. + +If you disable or do not configure this policy setting, ActiveX controls prompt the user before installation. + +If the trusted site uses the HTTPS protocol, this policy setting can also control how ActiveX Installer Service responds to certificate errors. By default all HTTPS connections must supply a server certificate that passes all validation criteria. If you are aware that a trusted site has a certificate error but you want to trust it anyway you can select the certificate errors that you want to ignore. + +> [!NOTE] +> This policy setting applies to all sites in Trusted zones. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Establish ActiveX installation policy for sites in Trusted zones* +- GP name: *AxISURLZonePolicies* +- GP path: *Windows Components\ActiveX Installer Service* +- GP ADMX file name: *ActiveXInstallService.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md new file mode 100644 index 0000000000..0c6e0067ac --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -0,0 +1,955 @@ +--- +title: Policy CSP - ADMX_AddRemovePrograms +description: Policy CSP - ADMX_AddRemovePrograms +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AddRemovePrograms + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## Policy CSP - ADMX_AddRemovePrograms + +
    +
    + ADMX_AddRemovePrograms/DefaultCategory +
    +
    + ADMX_AddRemovePrograms/NoAddFromCDorFloppy +
    +
    + ADMX_AddRemovePrograms/NoAddFromInternet +
    +
    + ADMX_AddRemovePrograms/NoAddFromNetwork +
    +
    + ADMX_AddRemovePrograms/NoAddPage +
    +
    + ADMX_AddRemovePrograms/NoAddRemovePrograms +
    +
    + ADMX_AddRemovePrograms/NoChooseProgramsPage +
    +
    + ADMX_AddRemovePrograms/NoRemovePage +
    +
    + ADMX_AddRemovePrograms/NoServices +
    +
    + ADMX_AddRemovePrograms/NoSupportInfo +
    +
    + ADMX_AddRemovePrograms/NoWindowsSetupPage +
    +
    + + +
    + + +**ADMX_AddRemovePrograms/DefaultCategory** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. The policy setting specifies the category of programs that appears when users open the "Add New Programs" page. If you enable this setting, only the programs in the category you specify are displayed when the "Add New Programs" page opens. You can use the Category box on the "Add New Programs" page to display programs in other categories. + +To use this setting, type the name of a category in the Category box for this setting. You must enter a category that is already defined in Add or Remove Programs. To define a category, use Software Installation. + +If you disable this setting or do not configure it, all programs (Category: All) are displayed when the "Add New Programs" page opens. You can use this setting to direct users to the programs they are most likely to need. + +> [!NOTE] +> This setting is ignored if either the "Remove Add or Remove Programs" setting or the "Hide Add New Programs page" setting is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify default category for Add New Programs* +- GP name: *DefaultCategory* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoAddFromCDorFloppy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or Remove Programs to install programs from removable media. + +If you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users. This setting does not prevent users from using other tools and methods to add or remove program components. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. Also, if the "Prevent removable media source for any install" setting (located in User Configuration\Administrative Templates\Windows Components\Windows Installer) is enabled, users cannot add programs from removable media, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add a program from CD-ROM or floppy disk" option* +- GP name: *NoAddFromCDorFloppy* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoAddFromInternet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or Remove Programs to connect to Windows Update. + +If you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users. This setting does not prevent users from using other tools and methods to connect to Windows Update. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add programs from Microsoft" option* +- GP name: *NoAddFromInternet* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoAddFromNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from viewing or installing published programs. This setting removes the "Add programs from your network" section from the Add New Programs page. The "Add programs from your network" section lists published programs and provides an easy way to install them. Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users that the programs are available, to recommend their use, or to enable users to install them without having to search for installation files. + +If you enable this setting, users cannot tell which programs have been published by the system administrator, and they cannot use Add or Remove Programs to install published programs. However, they can still install programs by using other methods, and they can view and install assigned (partially installed) programs that are offered on the desktop or on the Start menu. + +If you disable this setting or do not configure it, "Add programs from your network" is available to all users. + +> [!NOTE] +> If the "Hide Add New Programs page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the "Add programs from your network" option* +- GP name: *NoAddFromNetwork* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoAddPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the Add New Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page. The Add New Programs button lets users install programs published or assigned by a system administrator. + +If you disable this setting or do not configure it, the Add New Programs button is available to all users. This setting does not prevent users from using other tools and methods to install programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Add New Programs page* +- GP name: *NoAddPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoAddRemovePrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from using Add or Remove Programs. This setting removes Add or Remove Programs from Control Panel and removes the Add or Remove Programs item from menus. Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs. + +If you disable this setting or do not configure it, Add or Remove Programs is available to all users. When enabled, this setting takes precedence over the other settings in this folder. This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Add or Remove Programs* +- GP name: *NoAddRemovePrograms* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoChooseProgramsPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the Set Program Access and Defaults button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page. The Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations. + +If you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users. This setting does not prevent users from using other tools and methods to change program access or defaults. This setting does not prevent the Set Program Access and Defaults icon from appearing on the Start menu. See the "Remove Set Program Access and Defaults from Start menu" setting. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Set Program Access and Defaults page* +- GP name: *NoChooseProgramsPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoRemovePage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the Change or Remove Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page. The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs. + +If you disable this setting or do not configure it, the Change or Remove Programs page is available to all users. This setting does not prevent users from using other tools and methods to delete or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Change or Remove Programs page* +- GP name: *NoRemovePage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from using Add or Remove Programs to configure installed services. This setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools. + +If you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services. If you enable this setting, "Set up services" never appears. This setting does not prevent users from using other methods to configure services. + +> [!NOTE] +> When "Set up services" does not appear, clicking the Add/Remove Windows Components button starts the Windows Component Wizard immediately. Because the only remaining option on the Add/Remove Windows Components page starts the wizard, that option is selected automatically, and the page is bypassed. To remove "Set up services" and prevent the Windows Component Wizard from starting, enable the "Hide Add/Remove Windows Components page" setting. If the "Hide Add/Remove Windows Components page" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Go directly to Components Wizard* +- GP name: *NoServices* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoSupportInfo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes links to the Support Info dialog box from programs on the Change or Remove Programs page. Programs listed on the Change or Remove Programs page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page. + +If you disable this setting or do not configure it, the Support Info hyperlink appears. + +> [!NOTE] +> Not all programs provide a support information hyperlink. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Support Information* +- GP name: *NoSupportInfo* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +
    + + +**ADMX_AddRemovePrograms/NoWindowsSetupPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the Add/Remove Windows Components button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page. The Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files. + +If you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users. This setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Add/Remove Windows Components page* +- GP name: *NoWindowsSetupPage* +- GP path: *Control Panel/Add or Remove Programs* +- GP ADMX file name: *addremoveprograms.admx* + + + + + + + + + + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md new file mode 100644 index 0000000000..b626e67721 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -0,0 +1,745 @@ +--- +title: Policy CSP - ADMX_AppCompat +description: Policy CSP - ADMX_AppCompat +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 08/20/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AppCompat + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## Policy CSP - ADMX_AppCompat + +
    +
    + ADMX_AppCompat/AppCompatPrevent16BitMach + +
    +
    + ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage + +
    +
    + ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry + +
    +
    + ADMX_AppCompat/AppCompatTurnOffSwitchBack + +
    +
    + ADMX_AppCompat/AppCompatTurnOffEngine + +
    +
    + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1 + +
    +
    + ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2 + +
    +
    + ADMX_AppCompat/AppCompatTurnOffUserActionRecord + +
    +
    + ADMX_AppCompat/AppCompatTurnOffProgramInventory + +
    +
    + + +
    + + +**ADMX_AppCompat/AppCompatPrevent16BitMach** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to prevent the MS-DOS subsystem (**ntvdm.exe**) from running on this computer. This setting affects the launching of 16-bit applications in the operating system. + +You can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, **ntvdm.exe** must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the MS-DOS subsystem is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased. + +If the status is set to Enabled, the MS-DOS subsystem is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components cannot run. + +If the status is set to Disabled, the MS-DOS subsystem runs for all users on this computer. + +If the status is set to Not Configured, the OS falls back on a local policy set by the registry DWORD value **HKLM\System\CurrentControlSet\Control\WOW\DisallowedPolicyDefault**. If that value is non-0, this prevents all 16-bit applications from running. If that value is 0, 16-bit applications are allowed to run. If that value is also not present, on Windows 10 and above, the OS will launch the 16-bit application support control panel to allow an elevated administrator to make the decision; on Windows 7 and down-level, the OS will allow 16-bit applications to run. + +> [!NOTE] +> This setting appears only in Computer Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to 16-bit applications* +- GP name: *AppCompatPrevent16BitMach* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
    + + +**ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the visibility of the Program Compatibility property page shell extension. This shell extension is visible on the property context-menu of any program shortcut or executable file. + +The compatibility property page displays a list of options that can be selected and applied to the application to resolve the most common issues affecting legacy applications. + +Enabling this policy setting removes the property page from the context-menus, but does not affect previous compatibility settings applied to application using this interface. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Program Compatibility Property Page* +- GP name: *AppCompatRemoveProgramCompatPropPage* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
    + + +**ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. The policy setting controls the state of the Application Telemetry engine in the system. + +Application Telemetry is a mechanism that tracks anonymous usage of specific Windows system components by applications. + +Turning Application Telemetry off by selecting "enable" will stop the collection of usage data. + +If the customer Experience Improvement program is turned off, Application Telemetry will be turned off regardless of how this policy is set. + +Disabling telemetry will take effect on any newly launched applications. To ensure that telemetry collection has stopped for all applications, please reboot your machine. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Application Telemetry* +- GP name: *AppCompatTurnOffApplicationImpactTelemetry* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
    + + +**ADMX_AppCompat/AppCompatTurnOffSwitchBack** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. The policy setting controls the state of the Switchback compatibility engine in the system. + +Switchback is a mechanism that provides generic compatibility mitigations to older applications by providing older behavior to old applications and new behavior to new applications. + +Switchback is on by default. + +If you enable this policy setting, Switchback will be turned off. Turning Switchback off may degrade the compatibility of older applications. This option is useful for server administrators who require performance and are aware of compatibility of the applications they are using. + +If you disable or do not configure this policy setting, the Switchback will be turned on. + +Reboot the system after changing the setting to ensure that your system accurately reflects those changes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off SwitchBack Compatibility Engine* +- GP name: *AppCompatTurnOffSwitchBack* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
    + + +**ADMX_AppCompat/AppCompatTurnOffEngine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the state of the application compatibility engine in the system. + +The engine is part of the loader and looks through a compatibility database every time an application is started on the system. If a match for the application is found it provides either run-time solutions or compatibility fixes, or displays an Application Help message if the application has a know problem. + +Turning off the application compatibility engine will boost system performance. However, this will degrade the compatibility of many popular legacy applications, and will not block known incompatible applications from installing. For example, this may result in a blue screen if an old anti-virus application is installed. + +The Windows Resource Protection and User Account Control features of Windows use the application compatibility engine to provide mitigations for application problems. If the engine is turned off, these mitigations will not be applied to applications and their installers and these applications may fail to install or run properly. + +This option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using. It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential. + +> [!NOTE] +> Many system processes cache the value of this setting for performance reasons. If you make changes to this setting, reboot to ensure that your system accurately reflects those changes. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Application Compatibility Engine* +- GP name: *AppCompatTurnOffEngine* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
    + + +**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting exists only for backward compatibility, and is not valid for this version of Windows. To configure the Program Compatibility Assistant, use the 'Turn off Program Compatibility Assistant' setting under Computer Configuration\Administrative Templates\Windows Components\Application Compatibility. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Program Compatibility Assistant* +- GP name: *AppCompatTurnOffProgramCompatibilityAssistant_1* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
    + + +**ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the state of the Program Compatibility Assistant (PCA). The PCA monitors applications run by the user. When a potential compatibility issue with an application is detected, the PCA will prompt the user with recommended solutions. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. + +If you enable this policy setting, the PCA will be turned off. The user will not be presented with solutions to known compatibility issues when running applications. Turning off the PCA can be useful for system administrators who require better performance and are already aware of application compatibility issues. + +If you disable or do not configure this policy setting, the PCA will be turned on. To configure the diagnostic settings for the PCA, go to System->Troubleshooting and Diagnostics->Application Compatibility Diagnostics. + +> [!NOTE] +> The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to run. These services can be configured by using the Services snap-in to the Microsoft Management Console. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Program Compatibility Assistant* +- GP name: *AppCompatTurnOffProgramCompatibilityAssistant_2* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
    + + +**ADMX_AppCompat/AppCompatTurnOffUserActionRecord** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the state of Steps Recorder. + +Steps Recorder keeps a record of steps taken by the user. The data generated by Steps Recorder can be used in feedback systems such as Windows Error Reporting to help developers understand and fix problems. The data includes user actions such as keyboard input and mouse input, user interface data, and screenshots. Steps Recorder includes an option to turn on and off data collection. + +If you enable this policy setting, Steps Recorder will be disabled. + +If you disable or do not configure this policy setting, Steps Recorder will be enabled. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Steps Recorder* +- GP name: *AppCompatTurnOffUserActionRecord* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +
    + + +**ADMX_AppCompat/AppCompatTurnOffProgramInventory** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the state of the Inventory Collector. + +The Inventory Collector inventories applications, files, devices, and drivers on the system and sends the information to Microsoft. This information is used to help diagnose compatibility problems. + +If you enable this policy setting, the Inventory Collector will be turned off and data will not be sent to Microsoft. Collection of installation data through the Program Compatibility Assistant is also disabled. + +If you disable or do not configure this policy setting, the Inventory Collector will be turned on. + +> [!NOTE] +> This policy setting has no effect if the Customer Experience Improvement Program is turned off. The Inventory Collector will be off. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Inventory Collector* +- GP name: *AppCompatTurnOffProgramInventory* +- GP path: *Windows Components/Application Compatibility* +- GP ADMX file name: *AppCompat.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md new file mode 100644 index 0000000000..086c0dafc1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -0,0 +1,121 @@ +--- +title: Policy CSP - ADMX_AppxPackageManager +description: Policy CSP - ADMX_AppxPackageManager +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AppxPackageManager +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_AppxPackageManager policies + +
    +
    + ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles +
    +
    + + +
    + + +**ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile. + +Special profiles are the following user profiles, where changes are discarded after the user signs off: + +- Roaming user profiles to which the "Delete cached copies of roaming profiles" Group Policy setting applies +- Mandatory user profiles and super-mandatory profiles, which are created by an administrator +- Temporary user profiles, which are created when an error prevents the correct profile from loading +- User profiles for the Guest account and members of the Guests group + +If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of Windows Store apps when using a special profile. + +If you disable or do not configure this policy setting, Group Policy blocks deployment operations of Windows Store apps when using a special profile. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow deployment operations in special profiles* +- GP name: *AllowDeploymentInSpecialProfiles* +- GP path: *Windows Components\App Package Deployment* +- GP ADMX file name: *AppxPackageManager.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md new file mode 100644 index 0000000000..6d76bd5f74 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -0,0 +1,339 @@ +--- +title: Policy CSP - ADMX_AppXRuntime +description: Policy CSP - ADMX_AppXRuntime +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AppXRuntime +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_AppXRuntime policies + +
    +
    + ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules +
    +
    + ADMX_AppXRuntime/AppxRuntimeBlockFileElevation +
    +
    + ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT +
    +
    + ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation +
    +
    + + +
    + + +**ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer. + +If you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use. + +If you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on dynamic Content URI Rules for Windows store apps* +- GP name: *AppxRuntimeApplicationContentUriRules* +- GP path: *Windows Components\App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
    + + +**ADMX_AppXRuntime/AppxRuntimeBlockFileElevation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type. + +If you enable this policy setting, Windows Store apps cannot open files in the default desktop app for a file type; they can open files only in other Windows Store apps. + +If you disable or do not configure this policy setting, Windows Store apps can open files in the default desktop app for a file type. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block launching desktop apps associated with a file.* +- GP name: *AppxRuntimeBlockFileElevation* +- GP path: *Windows Components\App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
    + + +**ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched. + +If you enable this policy setting, Universal Windows apps which declare Windows Runtime API access in ApplicationContentUriRules section of the manifest cannot be launched; Universal Windows apps which have not declared Windows Runtime API access in the manifest are not affected. + +If you disable or do not configure this policy setting, all Universal Windows apps can be launched. + +> [!WARNING] +> This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block launching Universal Windows apps with Windows Runtime API access from hosted content.* +- GP name: *AppxRuntimeBlockHostedAppAccessWinRT* +- GP path: *Windows Components\App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
    + + +**ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app. + +If you enable this policy setting, Windows Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps. + +If you disable or do not configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme. + +> [!NOTE] +> Enabling this policy setting does not block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block launching desktop apps associated with a URI scheme* +- GP name: *AppxRuntimeBlockProtocolElevation* +- GP path: *Windows Components\App runtime* +- GP ADMX file name: *AppXRuntime.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md new file mode 100644 index 0000000000..895402efef --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -0,0 +1,423 @@ +--- +title: Policy CSP - ADMX_AttachmentManager +description: Policy CSP - ADMX_AttachmentManager +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AttachmentManager +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_AttachmentManager policies + +
    +
    + ADMX_AttachmentManager/AM_EstimateFileHandlerRisk +
    +
    + ADMX_AttachmentManager/AM_SetFileRiskLevel +
    +
    + ADMX_AttachmentManager/AM_SetHighRiskInclusion +
    +
    + ADMX_AttachmentManager/AM_SetLowRiskInclusion +
    +
    + ADMX_AttachmentManager/AM_SetModRiskInclusion +
    +
    + + +
    + + +**ADMX_AttachmentManager/AM_EstimateFileHandlerRisk** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the logic that Windows uses to determine the risk for file attachments. + +Preferring the file handler instructs Windows to use the file handler data over the file type data. For example, trust notepad.exe, but don't trust .txt files. + +Preferring the file type instructs Windows to use the file type data over the file handler data. For example, trust .txt files, regardless of the file handler. Using both the file handler and type data is the most restrictive option. Windows chooses the more restrictive recommendation which will cause users to see more trust prompts than choosing the other options. + +If you enable this policy setting, you can choose the order in which Windows processes risk assessment data. + +If you disable this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type. + +If you do not configure this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Trust logic for file attachments* +- GP name: *AM_EstimateFileHandlerRisk* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
    + + +**ADMX_AttachmentManager/AM_SetFileRiskLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments. + +High Risk: If the attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. + +Moderate Risk: If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. + +Low Risk: If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. + +If you enable this policy setting, you can specify the default risk level for file types. + +If you disable this policy setting, Windows sets the default risk level to moderate. + +If you do not configure this policy setting, Windows sets the default risk level to moderate. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default risk level for file attachments* +- GP name: *AM_SetFileRiskLevel* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
    + + +**ADMX_AttachmentManager/AM_SetHighRiskInclusion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of high-risk file types. If the file attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. This inclusion list takes precedence over the medium-risk and low-risk inclusion lists (where an extension is listed in more than one inclusion list). + +If you enable this policy setting, you can create a custom list of high-risk file types. + +If you disable this policy setting, Windows uses its built-in list of file types that pose a high risk. + +If you do not configure this policy setting, Windows uses its built-in list of high-risk file types. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Inclusion list for high risk file types* +- GP name: *AM_SetHighRiskInclusion* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
    + + +**ADMX_AttachmentManager/AM_SetLowRiskInclusion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of low-risk file types. If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. This inclusion list overrides the list of high-risk file types built into Windows and has a lower precedence than the high-risk or medium-risk inclusion lists (where an extension is listed in more than one inclusion list). + +If you enable this policy setting, you can specify file types that pose a low risk. + +If you disable this policy setting, Windows uses its default trust logic. + +If you do not configure this policy setting, Windows uses its default trust logic. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Inclusion list for low file types* +- GP name: *AM_SetLowRiskInclusion* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
    + + +**ADMX_AttachmentManager/AM_SetModRiskInclusion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of moderate-risk file types. If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high-risk file types built into Windows and it takes precedence over the low-risk inclusion list but has a lower precedence than the high-risk inclusion list (where an extension is listed in more than one inclusion list). + +If you enable this policy setting, you can specify file types which pose a moderate risk. + +If you disable this policy setting, Windows uses its default trust logic. + +If you do not configure this policy setting, Windows uses its default trust logic. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Inclusion list for moderate risk file types* +- GP name: *AM_SetModRiskInclusion* +- GP path: *Windows Components\Attachment Manager* +- GP ADMX file name: *AttachmentManager.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md new file mode 100644 index 0000000000..2564a91801 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -0,0 +1,120 @@ +--- +title: Policy CSP - ADMX_AuditSettings +description: Policy CSP - ADMX_AuditSettings +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_AuditSettings +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_AuditSettings policies + +
    +
    + ADMX_AuditSettings/IncludeCmdLine +
    +
    + + +
    + + +**ADMX_AuditSettings/IncludeCmdLine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. + +If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. + +If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. + +Default is Not configured. + +> [!NOTE] +> When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information, such as passwords or user data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Include command line in process creation events* +- GP name: *IncludeCmdLine* +- GP path: *System/Audit Process Creation* +- GP ADMX file name: *AuditSettings.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md new file mode 100644 index 0000000000..35597b677e --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -0,0 +1,1102 @@ +--- +title: Policy CSP - ADMX_Bits +description: Policy CSP - ADMX_Bits +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/20/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Bits +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Bits policies + +
    +
    + ADMX_Bits/BITS_DisableBranchCache +
    +
    + ADMX_Bits/BITS_DisablePeercachingClient +
    +
    + ADMX_Bits/BITS_DisablePeercachingServer +
    +
    + ADMX_Bits/BITS_EnablePeercaching +
    +
    + ADMX_Bits/BITS_MaxBandwidthServedForPeers +
    +
    + ADMX_Bits/BITS_MaxBandwidthV2_Maintenance +
    +
    + ADMX_Bits/BITS_MaxBandwidthV2_Work +
    +
    + ADMX_Bits/BITS_MaxCacheSize +
    +
    + ADMX_Bits/BITS_MaxContentAge +
    +
    + ADMX_Bits/BITS_MaxDownloadTime +
    +
    + ADMX_Bits/BITS_MaxFilesPerJob +
    +
    + ADMX_Bits/BITS_MaxJobsPerMachine +
    +
    + ADMX_Bits/BITS_MaxJobsPerUser +
    +
    + ADMX_Bits/BITS_MaxRangesPerFile +
    +
    + + +
    + + +**ADMX_Bits/BITS_DisableBranchCache** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects whether the BITS client is allowed to use Windows Branch Cache. If the Windows Branch Cache component is installed and enabled on a computer, BITS jobs on that computer can use Windows Branch Cache by default. + +If you enable this policy setting, the BITS client does not use Windows Branch Cache. + +If you disable or do not configure this policy setting, the BITS client uses Windows Branch Cache. + +> [!NOTE] +> This policy setting does not affect the use of Windows Branch Cache by applications other than BITS. This policy setting does not apply to BITS transfers over SMB. This setting has no effect if the computer's administrative settings for Windows Branch Cache disable its use entirely. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow the BITS client to use Windows Branch Cache* +- GP name: *BITS_DisableBranchCache* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_DisablePeercachingClient** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the computer will act as a BITS peer caching client. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers). + +If you enable this policy setting, the computer will no longer use the BITS peer caching feature to download files; files will be downloaded only from the origin server. However, the computer will still make files available to its peers. + +If you disable or do not configure this policy setting, the computer attempts to download peer-enabled BITS jobs from peer computers before reverting to the origin server. + +> [!NOTE] +> This policy setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow the computer to act as a BITS Peercaching client* +- GP name: *BITS_DisablePeercachingClient* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_DisablePeercachingServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the computer will act as a BITS peer caching server. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers). + +If you enable this policy setting, the computer will no longer cache downloaded files and offer them to its peers. However, the computer will still download files from peers. + +If you disable or do not configure this policy setting, the computer will offer downloaded and cached files to its peers. + +> [!NOTE] +> This setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow the computer to act as a BITS Peercaching server* +- GP name: *BITS_DisablePeercachingServer* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + + +
    + + +**ADMX_Bits/BITS_EnablePeercaching** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines if the Background Intelligent Transfer Service (BITS) peer caching feature is enabled on a specific computer. By default, the files in a BITS job are downloaded only from the origin server specified by the job's owner. + +If BITS peer caching is enabled, BITS caches downloaded files and makes them available to other BITS peers. When transferring a download job, BITS first requests the files for the job from its peers in the same IP subnet. If none of the peers in the subnet have the requested files, BITS downloads them from the origin server. + +If you enable this policy setting, BITS downloads files from peers, caches the files, and responds to content requests from peers. Using the "Do not allow the computer to act as a BITS peer caching server" and "Do not allow the computer to act as a BITS peer caching client" policy settings, it is possible to control BITS peer caching functionality at a more detailed level. However, it should be noted that the "Allow BITS peer caching" policy setting must be enabled for the other two policy settings to have any effect. + +If you disable or do not configure this policy setting, the BITS peer caching feature will be disabled, and BITS will download files directly from the origin server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow BITS Peercaching* +- GP name: *BITS_EnablePeercaching* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + + +
    + + +**ADMX_Bits/BITS_MaxBandwidthServedForPeers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that BITS uses for peer cache transfers (this setting does not affect transfers from the origin server). + +To prevent any negative impact to a computer caused by serving other peers, by default BITS will use up to 30 percent of the bandwidth of the slowest active network interface. For example, if a computer has both a 100 Mbps network card and a 56 Kbps modem, and both are active, BITS will use a maximum of 30 percent of 56 Kbps. + +You can change the default behavior of BITS, and specify a fixed maximum bandwidth that BITS will use for peer caching. + +If you enable this policy setting, you can enter a value in bits per second (bps) between 1048576 and 4294967200 to use as the maximum network bandwidth used for peer caching. + +If you disable this policy setting or do not configure it, the default value of 30 percent of the slowest active network interface will be used. + +> [!NOTE] +> This setting has no effect if the "Allow BITS peer caching" policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum network bandwidth used for Peercaching* +- GP name: *BITS_MaxBandwidthServedForPeers* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_MaxBandwidthV2_Maintenance** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the maintenance days and hours. Maintenance schedules further limit the network bandwidth that is used for background transfers. + +If you enable this policy setting, you can define a separate set of network bandwidth limits and set up a schedule for the maintenance period. + +You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A.M. to 10:00 A.M. on a maintenance schedule. + +If you disable or do not configure this policy setting, the limits defined for work or non-work schedules will be used. + +> [!NOTE] +> The bandwidth limits that are set for the maintenance period supersede any limits defined for work and other schedules. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers* +- GP name: *BITS_MaxBandwidthV2_Maintenance* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + + +
    + + +**ADMX_Bits/BITS_MaxBandwidthV2_Work** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and non-work days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that are not defined in a work schedule are considered non-work hours. + +If you enable this policy setting, you can set up a schedule for limiting network bandwidth during both work and non-work hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low. + +You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A.M. to 5:00 P.M. on Monday through Friday, and then set the limit to 512 Kbps for non-work hours. + +If you disable or do not configure this policy setting, BITS uses all available unused bandwidth for background job transfers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers* +- GP name: *BITS_MaxBandwidthV2_Work* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + + +
    + + +**ADMX_Bits/BITS_MaxCacheSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the maximum amount of disk space that can be used for the BITS peer cache, as a percentage of the total system disk size. BITS will add files to the peer cache and make those files available to peers until the cache content reaches the specified cache size. By default, BITS will use 1 percent of the total system disk for the peercache. + +If you enable this policy setting, you can enter the percentage of disk space to be used for the BITS peer cache. You can enter a value between 1 percent and 80 percent. + +If you disable or do not configure this policy setting, the default size of the BITS peer cache is 1 percent of the total system disk size. + +> [!NOTE] +> This policy setting has no effect if the "Allow BITS peer caching" setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the BITS Peercache size* +- GP name: *BITS_MaxCacheSize* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_MaxContentAge** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the maximum age of files in the Background Intelligent Transfer Service (BITS) peer cache. In order to make the most efficient use of disk space, by default BITS removes any files in the peer cache that have not been accessed in the past 90 days. + +If you enable this policy setting, you can specify in days the maximum age of files in the cache. You can enter a value between 1 and 120 days. + +If you disable or do not configure this policy setting, files that have not been accessed for the past 90 days will be removed from the peer cache. + +> [!NOTE] +> This policy setting has no effect if the "Allow BITS Peercaching" policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the age of files in the BITS Peercache* +- GP name: *BITS_MaxContentAge* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_MaxDownloadTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the amount of time that Background Intelligent Transfer Service (BITS) will take to download the files in a BITS job. + +The time limit applies only to the time that BITS is actively downloading files. When the cumulative download time exceeds this limit, the job is placed in the error state. + +By default BITS uses a maximum download time of 90 days (7,776,000 seconds). + +If you enable this policy setting, you can set the maximum job download time to a specified number of seconds. + +If you disable or do not configure this policy setting, the default value of 90 days (7,776,000 seconds) will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum BITS job download time* +- GP name: *BITS_MaxDownloadTime* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_MaxFilesPerJob** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS jobs can contain. + +If you enable this policy setting, BITS will limit the maximum number of files a job can contain to the specified number. + +If you disable or do not configure this policy setting, BITS will use the default value of 200 for the maximum number of files a job can contain. + +> [!NOTE] +> BITS Jobs created by services and the local administrator account do not count toward this limit. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum number of files allowed in a BITS job* +- GP name: *BITS_MaxFilesPerJob* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_MaxJobsPerMachine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of BITS jobs that can be created for all users of the computer. By default, BITS limits the total number of jobs that can be created on the computer to 300 jobs. You can use this policy setting to raise or lower the maximum number of user BITS jobs. + +If you enable this policy setting, BITS will limit the maximum number of BITS jobs to the specified number. + +If you disable or do not configure this policy setting, BITS will use the default BITS job limit of 300 jobs. + +> [!NOTE] +> BITS jobs created by services and the local administrator account do not count toward this limit. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum number of BITS jobs for this computer* +- GP name: *BITS_MaxJobsPerMachine* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_MaxJobsPerUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of BITS jobs that can be created by a user. By default, BITS limits the total number of jobs that can be created by a user to 60 jobs. You can use this setting to raise or lower the maximum number of BITS jobs a user can create. + +If you enable this policy setting, BITS will limit the maximum number of BITS jobs a user can create to the specified number. + +If you disable or do not configure this policy setting, BITS will use the default user BITS job limit of 300 jobs. + +> [!NOTE] +> This limit must be lower than the setting specified in the "Maximum number of BITS jobs for this computer" policy setting, or 300 if the "Maximum number of BITS jobs for this computer" policy setting is not configured. BITS jobs created by services and the local administrator account do not count toward this limit. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum number of BITS jobs for each user* +- GP name: *BITS_MaxJobsPerUser* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + + +**ADMX_Bits/BITS_MaxRangesPerFile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of ranges that can be added to a file in a BITS job. By default, files in a BITS job are limited to 500 ranges per file. You can use this setting to raise or lower the maximum number ranges per file. + +If you enable this policy setting, BITS will limit the maximum number of ranges that can be added to a file to the specified number. + +If you disable or do not configure this policy setting, BITS will limit ranges to 500 ranges per file. + +> [!NOTE] +> BITS Jobs created by services and the local administrator account do not count toward this limit. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit the maximum number of ranges that can be added to the file in a BITS job* +- GP name: *BITS_MaxRangesPerFile* +- GP path: *Network\Background Intelligent Transfer Service (BITS)* +- GP ADMX file name: *Bits.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md new file mode 100644 index 0000000000..e8a57b01bf --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -0,0 +1,204 @@ +--- +title: Policy CSP - ADMX_CipherSuiteOrder +description: Policy CSP - ADMX_CipherSuiteOrder +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CipherSuiteOrder + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_CipherSuiteOrder policies + +
    +
    + ADMX_CipherSuiteOrder/SSLCipherSuiteOrder +
    +
    + ADMX_CipherSuiteOrder/SSLCurveOrder +
    +
    + + +
    + + +**ADMX_CipherSuiteOrder/SSLCipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the cipher suites used by the Secure Socket Layer (SSL). + +If you enable this policy setting, SSL cipher suites are prioritized in the order specified. + +If you disable or do not configure this policy setting, default cipher suite order is used. + +For information about supported cipher suites, see [Cipher Suites in TLS/SSL (Schannel SSP)](https://go.microsoft.com/fwlink/?LinkId=517265). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SSL Cipher Suite Order* +- GP name: *SSLCipherSuiteOrder* +- GP path: *Network/SSL Configuration Settings* +- GP ADMX file name: *CipherSuiteOrder.admx* + + + +
    + +
    + + +**ADMX_CipherSuiteOrder/SSLCurveOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the priority order of ECC curves used with ECDHE cipher suites. + +If you enable this policy setting, ECC curves are prioritized in the order specified. Enter one curve name per line. + +If you disable or do not configure this policy setting, the default ECC curve order is used. + +The default curve order is as follows: + +- curve25519 +- NistP256 +- NistP384 + +To see all the curves supported on the system, enter the following command: + +``` cmd +CertUtil.exe -DisplayEccCurve +``` + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *ECC Curve Order* +- GP name: *SSLCurveOrder* +- GP path: *Network/SSL Configuration Settings* +- GP ADMX file name: *CipherSuiteOrder.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md new file mode 100644 index 0000000000..aaaa28a510 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -0,0 +1,198 @@ +--- +title: Policy CSP - ADMX_COM +description: Policy CSP - ADMX_COM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_COM + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_COM policies + +
    +
    + ADMX_COM/AppMgmt_COM_SearchForCLSID_1 +
    +
    + ADMX_COM/AppMgmt_COM_SearchForCLSID_2 +
    +
    + + +
    + + +**ADMX_COM/AppMgmt_COM_SearchForCLSID_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. + +Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. + +If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly. + +If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Download missing COM components* +- GP name: *AppMgmt_COM_SearchForCLSID_1* +- GP path: *System* +- GP ADMX file name: *COM.admx* + + + +
    + +
    + + +**ADMX_COM/AppMgmt_COM_SearchForCLSID_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. + +Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. + +If you enable this policy setting and a component registration is missing, the system searches for it in Active Directory and, if it is found, downloads it. The resulting searches might make some programs start or run slowly. + +If you disable or do not configure this policy setting, the program continues without the registration. As a result, the program might not perform all its functions, or it might stop. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Download missing COM components* +- GP name: *AppMgmt_COM_SearchForCLSID_2* +- GP path: *System* +- GP ADMX file name: *COM.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md new file mode 100644 index 0000000000..4a340834f9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -0,0 +1,363 @@ +--- +title: Policy CSP - ADMX_ControlPanel +description: Policy CSP - ADMX_ControlPanel +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/05/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ControlPanel +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_ControlPanel policies + +
    +
    + ADMX_ControlPanel/DisallowCpls +
    +
    + ADMX_ControlPanel/ForceClassicControlPanel +
    +
    + ADMX_ControlPanel/NoControlPanel +
    +
    + ADMX_ControlPanel/RestrictCpls +
    +
    + + +
    + + +**ADMX_ControlPanel/DisallowCpls** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. + +If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. + +To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization. + +> [!NOTE] +> For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name should be entered, for example timedate.cpl or inetcpl.cpl. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered, for example @systemcpl.dll,-1 for System, or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names can be found in MSDN by searching "Control Panel items". + +If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored. + +> [!NOTE] +> The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. Note: To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide specified Control Panel items* +- GP name: *DisallowCpls* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + + +
    + + +**ADMX_ControlPanel/ForceClassicControlPanel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the default Control Panel view, whether by category or icons. + +If this policy setting is enabled, the Control Panel opens to the icon view. + +If this policy setting is disabled, the Control Panel opens to the category view. + +If this policy setting is not configured, the Control Panel opens to the view used in the last Control Panel session. + +> [!NOTE] +> Icon size is dependent upon what the user has set it to in the previous session. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always open All Control Panel Items when opening Control Panel* +- GP name: *ForceClassicControlPanel* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + + +
    + + +**ADMX_ControlPanel/NoControlPanel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Disables all Control Panel programs and the PC settings app. + +This setting prevents Control.exe and SystemSettings.exe, the program files for Control Panel and PC settings, from starting. As a result, users cannot start Control Panel or PC settings, or run any of their items. + +This setting removes Control Panel from: + +- The Start screen +- File Explorer + +This setting removes PC settings from: + +- The Start screen +- Settings charm +- Account picture +- Search results + +If users try to select a Control Panel item from the Properties item on a context menu, a message appears explaining that a setting prevents the action. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to Control Panel and PC settings* +- GP name: *NoControlPanel* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + + +
    + + +**ADMX_ControlPanel/RestrictCpls** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls which Control Panel items such as Mouse, System, or Personalization, are displayed on the Control Panel window and the Start screen. The only items displayed in Control Panel are those you specify in this setting. This setting affects the Start screen and Control Panel, as well as other ways to access Control Panel items such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. + +To display a Control Panel item, enable this policy setting and click Show to access the list of allowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization. + +> [!NOTE] +> For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name, for example timedate.cpl or inetcpl.cpl, should be entered. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered. For example, enter @systemcpl.dll,-1 for System or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names of Control Panel items can be found in MSDN by searching "Control Panel items". + +If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored. + +> [!NOTE] +> The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. +> +> To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show only specified Control Panel items* +- GP name: *RestrictCpls* +- GP path: *Control Panel* +- GP ADMX file name: *ControlPanel.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md new file mode 100644 index 0000000000..a03950bfdc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -0,0 +1,1826 @@ +--- +title: Policy CSP - ADMX_ControlPanelDisplay +description: Policy CSP - ADMX_ControlPanelDisplay +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/05/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ControlPanelDisplay +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_ControlPanelDisplay policies + +
    +
    + ADMX_ControlPanelDisplay/CPL_Display_Disable +
    +
    + ADMX_ControlPanelDisplay/CPL_Display_HideSettings +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle +
    +
    + ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground +
    +
    + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Display_Disable** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Disables the Display Control Panel. + +If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action. + +Also, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu & Taskbar) settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable the Display Control Panel* +- GP name: *CPL_Display_Disable* +- GP path: *Control Panel\Display* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Display_HideSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Settings tab from Display in Control Panel. + +This setting prevents users from using Control Panel to add, configure, or change the display settings on the computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Settings tab* +- GP name: *CPL_Display_HideSettings* +- GP path: *Control Panel\Display* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting forces the theme color scheme to be the default color scheme. + +If you enable this setting, a user cannot change the color scheme of the current desktop theme. + +If you disable or do not configure this setting, a user may change the color scheme of the current desktop theme. + +For Windows 7 and later, use the "Prevent changing color and appearance" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing color scheme* +- GP name: *CPL_Personalization_DisableColorSchemeChoice* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting disables the theme gallery in the Personalization Control Panel. + +If you enable this setting, users cannot change or save a theme. Elements of a theme such as the desktop background, color, sounds, and screen saver can still be changed (unless policies are set to turn them off). + +If you disable or do not configure this setting, there is no effect. + +> [!NOTE] +> If you enable this setting but do not specify a theme using the "load a specific theme" setting, the theme defaults to whatever the user previously set or the system default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing theme* +- GP name: *CPL_Personalization_DisableThemeChange* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users or applications from changing the visual style of the windows and buttons displayed on their screens. + +When enabled on Windows XP, this setting disables the "Windows and buttons" drop-down list on the Appearance tab in Display Properties. + +When enabled on Windows XP and later systems, this setting prevents users and applications from changing the visual style through the command line. Also, a user may not apply a different visual style when changing themes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing visual style for windows and buttons* +- GP name: *CPL_Personalization_DisableVisualStyle* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enables desktop screen savers. + +If you disable this setting, screen savers do not run. Also, this setting disables the Screen Saver section of the Screen Saver dialog in the Personalization or Display Control Panel. As a result, users cannot change the screen saver options. + +If you do not configure it, this setting has no effect on the system. + +If you enable it, a screen saver runs, provided the following two conditions hold: First, a valid screen saver on the client is specified through the "Screen Saver executable name" setting or through Control Panel on the client computer. Second, the screen saver timeout is set to a nonzero value through the setting or Control Panel. + +Also, see the "Prevent changing Screen Saver" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable screen saver* +- GP name: *CPL_Personalization_EnableScreenSaver* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows you to force a specific default lock screen and logon image by entering the path (location) of the image file. The same image will be used for both the lock and logon screens. + +This setting lets you specify the default lock screen and logon image shown when no user is signed in, and also sets the specified image as the default for all users (it replaces the inbox default image). + +To use this setting, type the fully qualified path and name of the file that stores the default lock screen and logon image. You can type a local path, such as C:\Windows\Web\Screen\img104.jpg or a UNC path, such as `\\Server\Share\Corp.jpg`. + +This can be used in conjunction with the "Prevent changing lock screen and logon image" setting to always force the specified lock screen and logon image to be shown. + +Note: This setting only applies to Enterprise, Education, and Server SKUs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force a specific default lock screen and logon image* +- GP name: *CPL_Personalization_ForceDefaultLockScreen* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the size of the font in the windows and buttons displayed on their screens. + +If this setting is enabled, the "Font size" drop-down list on the Appearance tab in Display Properties is disabled. + +If you disable or do not configure this setting, a user may change the font size using the "Font size" drop-down list on the Appearance tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit selection of visual style font size* +- GP name: *CPL_Personalization_LockFontSize* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the background image shown when the machine is locked or when on the logon screen. + +By default, users can change the background image shown when the machine is locked or displaying the logon screen. + +If you enable this setting, the user will not be able to change their lock screen and logon image, and they will instead see the default image. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing lock screen and logon image* +- GP name: *CPL_Personalization_NoChangingLockScreen* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the look of their start menu background, such as its color or accent. + +By default, users can change the look of their start menu background, such as its color or accent. + +If you enable this setting, the user will be assigned the default start menu background and colors and will not be allowed to change them. + +If the "Force a specific background and accent color" policy is also set on a supported version of Windows, then those colors take precedence over this policy. + +If the "Force a specific Start background" policy is also set on a supported version of Windows, then that background takes precedence over this policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing start menu background* +- GP name: *CPL_Personalization_NoChangingStartMenuBackground* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Disables the Color (or Window Color) page in the Personalization Control Panel, or the Color Scheme dialog in the Display Control Panel on systems where the Personalization feature is not available. + +This setting prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows. + +If this setting is disabled or not configured, the Color (or Window Color) page or Color Scheme dialog is available in the Personalization or Display Control Panel. + +For systems prior to Windows Vista, this setting hides the Appearance and Themes tabs in the in Display in Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing color and appearance* +- GP name: *CPL_Personalization_NoColorAppearanceUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adding or changing the background design of the desktop. + +By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop. + +If you enable this setting, none of the Desktop Background settings can be changed by the user. + +To specify wallpaper for a group, use the "Desktop Wallpaper" setting. + +Note: You must also enable the "Desktop Wallpaper" setting to prevent users from changing the desktop wallpaper. Refer to KB article: Q327998 for more information. + +Also, see the "Allow only bitmapped wallpaper" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing desktop background* +- GP name: *CPL_Personalization_NoDesktopBackgroundUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the desktop icons. + +By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons. + +If you enable this setting, none of the desktop icons can be changed by the user. + +For systems prior to Windows Vista, this setting also hides the Desktop tab in the Display Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing desktop icons* +- GP name: *CPL_Personalization_NoDesktopIconsUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the lock screen appears for users. + +If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC. + +If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not display the lock screen* +- GP name: *CPL_Personalization_NoLockScreen* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the mouse pointers. + +By default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers. + +If you enable this setting, none of the mouse pointer scheme settings can be changed by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing mouse pointers* +- GP name: *CPL_Personalization_NoMousePointersUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents the Screen Saver dialog from opening in the Personalization or Display Control Panel. + +This setting prevents users from using Control Panel to add, configure, or change the screen saver on the computer. It does not prevent a screen saver from running. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing screen saver* +- GP name: *CPL_Personalization_NoScreenSaverUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the sound scheme. + +By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme. + +If you enable this setting, none of the Sound Scheme settings can be changed by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changing sounds* +- GP name: *CPL_Personalization_NoSoundSchemeUI* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Forces Windows to use the specified colors for the background and accent. The color values are specified in hex as #RGB. + +By default, users can change the background and accent colors. + +If this setting is enabled, the background and accent colors of Windows will be set to the specified colors and users cannot change those colors. This setting will not be applied if the specified colors do not meet a contrast ratio of 2:1 with white text. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force a specific background and accent color* +- GP name: *CPL_Personalization_PersonalColors* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether screen savers used on the computer are password protected. + +If you enable this setting, all screen savers are password protected. If you disable this setting, password protection cannot be set on any screen saver. + +This setting also disables the "Password protected" checkbox on the Screen Saver dialog in the Personalization or Display Control Panel, preventing users from changing the password protection setting. + +If you do not configure this setting, users can choose whether or not to set password protection on each screen saver. + +To ensure that a computer will be password protected, enable the "Enable Screen Saver" setting and specify a timeout via the "Screen Saver timeout" setting. + +> [!NOTE] +> To remove the Screen Saver dialog, use the "Prevent changing Screen Saver" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Password protect the screen saver* +- GP name: *CPL_Personalization_ScreenSaverIsSecure* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies how much user idle time must elapse before the screen saver is launched. + +When configured, this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver will not be started. + +This setting has no effect under any of the following circumstances: + +- The setting is disabled or not configured. + +- The wait time is set to zero. + +- The "Enable Screen Saver" setting is disabled. + +- Neither the "Screen saver executable name" setting nor the Screen Saver dialog of the client computer's Personalization or Display Control Panel specifies a valid existing screen saver program on the client. + +When not configured, whatever wait time is set on the client through the Screen Saver dialog in the Personalization or Display Control Panel is used. The default is 15 minutes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Screen saver timeout* +- GP name: *CPL_Personalization_ScreenSaverTimeOut* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the screen saver for the user's desktop. + +If you enable this setting, the system displays the specified screen saver on the user's desktop. Also, this setting disables the drop-down list of screen savers in the Screen Saver dialog in the Personalization or Display Control Panel, which prevents users from changing the screen saver. + +If you disable this setting or do not configure it, users can select any screen saver. + +If you enable this setting, type the name of the file that contains the screen saver, including the .scr file name extension. If the screen saver file is not in the %Systemroot%\System32 directory, type the fully qualified path to the file. + +If the specified screen saver is not installed on a computer to which this setting applies, the setting is ignored. + +> [!NOTE] +> This setting can be superseded by the "Enable Screen Saver" setting. If the "Enable Screen Saver" setting is disabled, this setting is ignored, and screen savers do not run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force specific screen saver* +- GP name: *CPL_Personalization_SetScreenSaver* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies which theme file is applied to the computer the first time a user logs on. + +If you enable this setting, the theme that you specify will be applied when a new user logs on for the first time. This policy does not prevent the user from changing the theme or any of the theme elements such as the desktop background, color, sounds, or screen saver after the first logon. + +If you disable or do not configure this setting, the default theme will be applied at the first logon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Load a specific theme* +- GP name: *CPL_Personalization_SetTheme* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows you to force a specific visual style file by entering the path (location) of the visual style file. + +This can be a local computer visual style (aero.msstyles), or a file located on a remote server using a UNC path (\\Server\Share\aero.msstyles). + +If you enable this setting, the visual style file that you specify will be used. Also, a user may not apply a different visual style when changing themes. + +If you disable or do not configure this setting, the users can select the visual style that they want to use by changing themes (if the Personalization Control Panel is available). + +> [!NOTE] +> If this setting is enabled and the file is not available at user logon, the default visual style is loaded. +> +> When running Windows XP, you can select the Luna visual style by typing %windir%\resources\Themes\Luna\Luna.msstyles. +> +> To select the Windows Classic visual style, leave the box blank beside "Path to Visual Style:" and enable this setting. When running Windows 8 or Windows RT, you cannot apply the Windows Classic visual style. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force a specific visual style file or force Windows Classic* +- GP name: *CPL_Personalization_SetVisualStyle* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + + +**ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Forces the Start screen to use one of the available backgrounds, 1 through 20, and prevents the user from changing it. + +If this setting is set to zero or not configured, then Start uses the default background, and users can change it. + +If this setting is set to a nonzero value, then Start uses the specified background, and users cannot change it. If the specified background is not supported, the default background is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force a specific Start background* +- GP name: *CPL_Personalization_StartBackground* +- GP path: *Control Panel\Personalization* +- GP ADMX file name: *ControlPanelDisplay.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md new file mode 100644 index 0000000000..d198e617ff --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -0,0 +1,118 @@ +--- +title: Policy CSP - ADMX_Cpls +description: Policy CSP - ADMX_Cpls +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Cpls +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Cpls policies + +
    +
    + ADMX_Cpls/UseDefaultTile +
    +
    + + +
    + + +**ADMX_Cpls/UseDefaultTile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo. + +> [!NOTE] +> The default account picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\user.jpg. The default guest picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\guest.jpg. If the default pictures do not exist, an empty frame is displayed. + +If you enable this policy setting, the default user account picture will display for all users on the system with no customization allowed. + +If you disable or do not configure this policy setting, users will be able to customize their account pictures. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Apply the default account picture to all users* +- GP name: *UseDefaultTile* +- GP path: *Control Panel/User Accounts* +- GP ADMX file name: *Cpls.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md new file mode 100644 index 0000000000..dcaa5fa29f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -0,0 +1,270 @@ +--- +title: Policy CSP - ADMX_CredentialProviders +description: Policy CSP - ADMX_CredentialProviders +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/11/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CredentialProviders +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_CredentialProviders policies + +
    +
    + ADMX_CredentialProviders/AllowDomainDelayLock +
    +
    + ADMX_CredentialProviders/DefaultCredentialProvider +
    +
    + ADMX_CredentialProviders/ExcludedCredentialProviders +
    +
    + + +
    + + +**ADMX_CredentialProviders/AllowDomainDelayLock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether a user can change the time before a password is required when a Connected Standby device screen turns off. + +If you enable this policy setting, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose. + +If you disable this policy setting, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off. + +If you don't configure this policy setting on a domain-joined device, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off. + +If you don't configure this policy setting on a workgroup device, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to select when a password is required when resuming from connected standby* +- GP name: *AllowDomainDelayLock* +- GP path: *System\Logon* +- GP ADMX file name: *CredentialProviders.admx* + + + +
    + + +**ADMX_CredentialProviders/DefaultCredentialProvider** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to assign a specified credential provider as the default credential provider. + +If you enable this policy setting, the specified credential provider is selected on other user tile. + +If you disable or do not configure this policy setting, the system picks the default credential provider on other user tile. + +> [!NOTE] +> A list of registered credential providers and their GUIDs can be found in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Assign a default credential provider* +- GP name: *DefaultCredentialProvider* +- GP path: *System\Logon* +- GP ADMX file name: *CredentialProviders.admx* + + + +
    + + + +**ADMX_CredentialProviders/ExcludedCredentialProviders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to exclude the specified credential providers from use during authentication. + +> [!NOTE] +> Credential providers are used to process and validate user credentials during logon or when authentication is required. Windows Vista provides two default credential providers: Password and Smart Card. An administrator can install additional credential providers for different sets of credentials (for example, to support biometric authentication). + +If you enable this policy, an administrator can specify the CLSIDs of the credential providers to exclude from the set of installed credential providers available for authentication purposes. + +If you disable or do not configure this policy, all installed and otherwise enabled credential providers are available for authentication purposes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Exclude credential providers* +- GP name: *ExcludedCredentialProviders* +- GP path: *System\Logon* +- GP ADMX file name: *CredentialProviders.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md new file mode 100644 index 0000000000..7cf1e14d14 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -0,0 +1,970 @@ +--- +title: Policy CSP - ADMX_CredSsp +description: Policy CSP - ADMX_CredSsp +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CredSsp +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_CredSsp policies + +
    +
    + ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly +
    +
    + ADMX_CredSsp/AllowDefaultCredentials +
    +
    + ADMX_CredSsp/AllowEncryptionOracle +
    +
    + ADMX_CredSsp/AllowFreshCredentials +
    +
    + ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly +
    +
    + ADMX_CredSsp/AllowSavedCredentials +
    +
    + ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly +
    +
    + ADMX_CredSsp/DenyDefaultCredentials +
    +
    + ADMX_CredSsp/DenyFreshCredentials +
    +
    + ADMX_CredSsp/DenySavedCredentials +
    +
    + ADMX_CredSsp/RestrictedRemoteAdministration +
    +
    + + +
    + + +**ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows). + +If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating default credentials with NTLM-only server authentication* +- GP name: *AllowDefCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/AllowDefaultCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows). + +The policy becomes effective the next time the user signs on to a computer running Windows. + +If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB. + +FWlink for KB: +https://go.microsoft.com/fwlink/?LinkId=301508 + +> [!NOTE] +> The "Allow delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating default credentials* +- GP name: *AllowDefaultCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/AllowEncryptionOracle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection). + +Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability. + +If you enable this policy setting, CredSSP version support will be selected based on the following options: + +- Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. + + > [!NOTE] + > This setting should not be deployed until all remote hosts support the newest version. + +- Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. + +- Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. + +For more information about the vulnerability and servicing requirements for protection, see https://go.microsoft.com/fwlink/?linkid=866660 + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Encryption Oracle Remediation* +- GP name: *AllowEncryptionOracle* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/AllowFreshCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating fresh credentials* +- GP name: *AllowFreshCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating fresh credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating fresh credentials with NTLM-only server authentication* +- GP name: *AllowFreshCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/AllowSavedCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of saved credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating saved credentials* +- GP name: *AllowSavedCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine. + +If you disable this policy setting, delegation of saved credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating saved credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating saved credentials with NTLM-only server authentication* +- GP name: *AllowSavedCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/DenyDefaultCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating default credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating default credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating default credentials* +- GP name: *DenyDefaultCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/DenyFreshCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating fresh credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating fresh credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating fresh credentials* +- GP name: *DenyFreshCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/DenySavedCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating saved credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating saved credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating saved credentials* +- GP name: *DenySavedCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + + +**ADMX_CredSsp/RestrictedRemoteAdministration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. When running in Restricted Admin or Remote Credential Guard mode, participating apps do not expose signed in or supplied credentials to a remote host. Restricted Admin limits access to resources located on other servers or networks from the remote host because credentials are not delegated. Remote Credential Guard does not limit access to resources because it redirects all requests back to the client device. + +Participating apps: +Remote Desktop Client + +If you enable this policy setting, the following options are supported: + +- Restrict credential delegation: Participating applications must use Restricted Admin or Remote Credential Guard to connect to remote hosts. +- Require Remote Credential Guard: Participating applications must use Remote Credential Guard to connect to remote hosts. +- Require Restricted Admin: Participating applications must use Restricted Admin to connect to remote hosts. + +If you disable or do not configure this policy setting, Restricted Admin and Remote Credential Guard mode are not enforced and participating apps can delegate credentials to remote devices. + +> [!NOTE] +> To disable most credential delegation, it may be sufficient to deny delegation in Credential Security Support Provider (CredSSP) by modifying Administrative template settings (located at Computer Configuration\Administrative Templates\System\Credentials Delegation). +> +> On Windows 8.1 and Windows Server 2012 R2, enabling this policy will enforce Restricted Administration mode, regardless of the mode chosen. These versions do not support Remote Credential Guard. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict delegation of credentials to remote servers* +- GP name: *RestrictedRemoteAdministration* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md new file mode 100644 index 0000000000..cf430cc22f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -0,0 +1,186 @@ +--- +title: Policy CSP - ADMX_CredUI +description: Policy CSP - ADMX_CredUI +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CredUI +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_CredUI policies + +
    +
    + ADMX_CredUI/EnableSecureCredentialPrompting +
    +
    + ADMX_CredUI/NoLocalPasswordResetQuestions +
    +
    + + +
    + + +**ADMX_CredUI/EnableSecureCredentialPrompting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or other types of malicious code from stealing the user’s Windows credentials. + +> [!NOTE] +> This policy affects nonlogon authentication tasks only. As a security best practice, this policy should be enabled. + +If you enable this policy setting, users will be required to enter Windows credentials on the Secure Desktop by means of the trusted path mechanism. + +If you disable or do not configure this policy setting, users will enter Windows credentials within the user’s desktop session, potentially allowing malicious code access to the user’s Windows credentials. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require trusted path for credential entry* +- GP name: *EnableSecureCredentialPrompting* +- GP path: *Windows Components\Credential User Interface* +- GP ADMX file name: *CredUI.admx* + + + +
    + + +**ADMX_CredUI/NoLocalPasswordResetQuestions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you turn this policy setting on, local users won’t be able to set up and use security questions to reset their passwords. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent the use of security questions for local accounts* +- GP name: *NoLocalPasswordResetQuestions* +- GP path: *Windows Components\Credential User Interface* +- GP ADMX file name: *CredUI.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md new file mode 100644 index 0000000000..7ec6bdd7bc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -0,0 +1,340 @@ +--- +title: Policy CSP - ADMX_CtrlAltDel +description: Policy CSP - ADMX_CtrlAltDel +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CtrlAltDel +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_CtrlAltDel policies + +
    +
    + ADMX_CtrlAltDel/DisableChangePassword +
    +
    + ADMX_CtrlAltDel/DisableLockComputer +
    +
    + ADMX_CtrlAltDel/DisableTaskMgr +
    +
    + ADMX_CtrlAltDel/NoLogoff +
    +
    + + +
    + + +**ADMX_CtrlAltDel/DisableChangePassword** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from changing their Windows password on demand. + +If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del. + +However, users are still able to change their password when prompted by the system. The system prompts users for a new password when an administrator requires a new password or their password is expiring. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Change Password* +- GP name: *DisableChangePassword* +- GP path: *System/Ctrl+Alt+Del Options* +- GP ADMX file name: *CtrlAltDel.admx* + + + + +
    + + +**ADMX_CtrlAltDel/DisableLockComputer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from locking the system. + +While locked, the desktop is hidden and the system cannot be used. Only the user who locked the system or the system administrator can unlock it. + +If you enable this policy setting, users cannot lock the computer from the keyboard using Ctrl+Alt+Del. + +If you disable or do not configure this policy setting, users will be able to lock the computer from the keyboard using Ctrl+Alt+Del. + +> [!TIP] +> To lock a computer without configuring a setting, press Ctrl+Alt+Delete, and then click Lock this computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Lock Computer* +- GP name: *DisableLockWorkstation* +- GP path: *System/Ctrl+Alt+Del Options* +- GP ADMX file name: *CtrlAltDel.admx* + + + +
    + + +**ADMX_CtrlAltDel/DisableTaskMgr** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from starting Task Manager. + +Task Manager (**taskmgr.exe**) lets users start and stop programs, monitor the performance of their computers, view and monitor all programs running on their computers, including system services, find the executable names of programs, and change the priority of the process in which programs run. + +If you enable this policy setting, users will not be able to access Task Manager. If users try to start Task Manager, a message appears explaining that a policy prevents the action. + +If you disable or do not configure this policy setting, users can access Task Manager to start and stop programs, monitor the performance of their computers, view and monitor all programs running on their computers, including system services, find the executable names of programs, and change the priority of the process in which programs run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Task Manager* +- GP name: *DisableTaskMgr* +- GP path: *System/Ctrl+Alt+Del Options* +- GP ADMX file name: *CtrlAltDel.admx* + + + +
    + + +**ADMX_CtrlAltDel/NoLogoff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting disables or removes all menu items and buttons that log the user off the system. + +If you enable this policy setting, users will not see the Log off menu item when they press Ctrl+Alt+Del. This will prevent them from logging off unless they restart or shutdown the computer, or clicking Log off from the Start menu. + +Also, see the 'Remove Logoff on the Start Menu' policy setting. + +If you disable or do not configure this policy setting, users can see and select the Log off menu item when they press Ctrl+Alt+Del. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Logoff* +- GP name: *NoLogoff* +- GP path: *System/Ctrl+Alt+Del Options* +- GP ADMX file name: *CtrlAltDel.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md new file mode 100644 index 0000000000..b550db06f6 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -0,0 +1,115 @@ +--- +title: Policy CSP - ADMX_DataCollection +description: Policy CSP - ADMX_DataCollection +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DataCollection +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_DataCollection policies + +
    +
    + ADMX_DataCollection/CommercialIdPolicy +
    +
    + + +
    + + +**ADMX_DataCollection/CommercialIdPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the identifier used to uniquely associate this device’s telemetry data as belonging to a given organization. + +If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. + +If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its telemetry data with your organization. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the Commercial ID* +- GP name: *CommercialIdPolicy* +- GP path: *Windows Components\Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md new file mode 100644 index 0000000000..8c3fd1a932 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -0,0 +1,2183 @@ +--- +title: Policy CSP - ADMX_Desktop +description: Policy CSP - ADMX_Desktop +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Desktop +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Desktop policies + +
    +
    + ADMX_Desktop/AD_EnableFilter +
    +
    + ADMX_Desktop/AD_HideDirectoryFolder +
    +
    + ADMX_Desktop/AD_QueryLimit +
    +
    + ADMX_Desktop/ForceActiveDesktopOn +
    +
    + ADMX_Desktop/NoActiveDesktop +
    +
    + ADMX_Desktop/NoActiveDesktopChanges +
    +
    + ADMX_Desktop/NoDesktop +
    +
    + ADMX_Desktop/NoDesktopCleanupWizard +
    +
    + ADMX_Desktop/NoInternetIcon +
    +
    + ADMX_Desktop/NoMyComputerIcon +
    +
    + ADMX_Desktop/NoMyDocumentsIcon +
    +
    + ADMX_Desktop/NoNetHood +
    +
    + ADMX_Desktop/NoPropertiesMyComputer +
    +
    + ADMX_Desktop/NoPropertiesMyDocuments +
    +
    + ADMX_Desktop/NoRecentDocsNetHood +
    +
    + ADMX_Desktop/NoRecycleBinIcon +
    +
    + ADMX_Desktop/NoRecycleBinProperties +
    +
    + ADMX_Desktop/NoSaveSettings +
    +
    + ADMX_Desktop/NoWindowMinimizingShortcuts +
    +
    + ADMX_Desktop/Wallpaper +
    +
    + ADMX_Desktop/sz_ATC_DisableAdd +
    +
    + ADMX_Desktop/sz_ATC_DisableClose +
    +
    + ADMX_Desktop/sz_ATC_DisableDel +
    +
    + ADMX_Desktop/sz_ATC_DisableEdit +
    +
    + ADMX_Desktop/sz_ATC_NoComponents +
    +
    + ADMX_Desktop/sz_AdminComponents_Title +
    +
    + ADMX_Desktop/sz_DB_DragDropClose +
    +
    + ADMX_Desktop/sz_DB_Moving +
    +
    + ADMX_Desktop/sz_DWP_NoHTMLPaper +
    +
    + + +
    + + +**ADMX_Desktop/AD_EnableFilter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results. + +If you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it. + +If you disable this setting or do not configure it, the filter bar does not appear, but users can display it by selecting "Filter" on the "View" menu. + +To see the filter bar, open Network Locations, click Entire Network, and then click Directory. Right-click the name of a Windows domain, and click Find. Type the name of an object in the directory, such as "Administrator." If the filter bar does not appear above the resulting display, on the View menu, click Filter. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable filter in Find dialog box* +- GP name: *AD_EnableFilter* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/AD_HideDirectoryFolder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Hides the Active Directory folder in Network Locations. + +The Active Directory folder displays Active Directory objects in a browse window. + +If you enable this setting, the Active Directory folder does not appear in the Network Locations folder. + +If you disable this setting or do not configure it, the Active Directory folder appears in the Network Locations folder. + +This setting is designed to let users search Active Directory but not tempt them to casually browse Active Directory. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Active Directory folder* +- GP name: *AD_HideDirectoryFolder* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/AD_QueryLimit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the maximum number of objects the system displays in response to a command to browse or search Active Directory. This setting affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users and Computers, and dialog boxes used to set permissions for user or group objects in Active Directory. + +If you enable this setting, you can use the "Number of objects returned" box to limit returns from an Active Directory search. + +If you disable this setting or do not configure it, the system displays up to 10,000 objects. This consumes approximately 2 MB of memory or disk space. + +This setting is designed to protect the network and the domain controller from the effect of expansive searches. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maximum size of Active Directory searches* +- GP name: *AD_QueryLimit* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/ForceActiveDesktopOn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enables Active Desktop and prevents users from disabling it. + +This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. + +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. + +> [!NOTE] +> If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both of these policies are ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Active Desktop* +- GP name: *ForceActiveDesktopOn* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoActiveDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Disables Active Desktop and prevents users from enabling it. + +This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. + +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. + +> [!NOTE] +> If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both these policies are ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Active Desktop* +- GP name: *NoActiveDesktop* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoActiveDesktopChanges** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration. + +This is a comprehensive setting that locks down the configuration you establish by using other policies in this folder. This setting removes the Web tab from Display in Control Panel. As a result, users cannot enable or disable Active Desktop. If Active Desktop is already enabled, users cannot add, remove, or edit Web content or disable, lock, or synchronize Active Desktop components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit changes* +- GP name: *NoActiveDesktopChanges* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, Computer, and Network Locations. + +Removing icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent. + +Also, see "Items displayed in Places Bar" in User Configuration\Administrative Templates\Windows Components\Common Open File Dialog to remove the Desktop icon from the Places Bar. This will help prevent users from saving data to the Desktop. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide and disable all items on the desktop* +- GP name: *NoDesktop* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoDesktopCleanupWizard** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from using the Desktop Cleanup Wizard. + +If you enable this setting, the Desktop Cleanup wizard does not automatically run on a users workstation every 60 days. The user will also not be able to access the Desktop Cleanup Wizard. + +If you disable this setting or do not configure it, the default behavior of the Desktop Clean Wizard running every 60 days occurs. + +> [!NOTE] +> When this setting is not enabled, users can run the Desktop Cleanup Wizard, or have it run automatically every 60 days from Display, by clicking the Desktop tab and then clicking the Customize Desktop button. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the Desktop Cleanup Wizard* +- GP name: *NoDesktopCleanupWizard* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoInternetIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar. + +This setting does not prevent the user from starting Internet Explorer by using other methods. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Internet Explorer icon on desktop* +- GP name: *NoInternetIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoMyComputerIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting hides Computer from the desktop and from the new Start menu. It also hides links to Computer in the Web view of all Explorer windows, and it hides Computer in the Explorer folder tree pane. If the user navigates into Computer via the "Up" button while this setting is enabled, they view an empty Computer folder. This setting allows administrators to restrict their users from seeing Computer in the shell namespace, allowing them to present their users with a simpler desktop environment. + +If you enable this setting, Computer is hidden on the desktop, the new Start menu, the Explorer folder tree pane, and the Explorer Web views. If the user manages to navigate to Computer, the folder will be empty. + +If you disable this setting, Computer is displayed as usual, appearing as normal on the desktop, Start menu, folder tree pane, and Web views, unless restricted by another setting. + +If you do not configure this setting, the default is to display Computer as usual. + +> [!NOTE] +> In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Computer icon. Hiding Computer and its contents does not hide the contents of the child folders of Computer. For example, if the users navigate into one of their hard drives, they see all of their folders and files there, even if this setting is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Computer icon on the desktop* +- GP name: *NoMyComputerIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoMyDocumentsIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes most occurrences of the My Documents icon. + +This setting removes the My Documents icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box. + +This setting does not prevent the user from using other methods to gain access to the contents of the My Documents folder. + +This setting does not remove the My Documents icon from the Start menu. To do so, use the "Remove My Documents icon from Start Menu" setting. + +> [!NOTE] +> To make changes to this setting effective, you must log off from and log back on to Windows 2000 Professional. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove My Documents icon on the desktop* +- GP name: *NoMyDocumentsIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoNetHood** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Network Locations icon from the desktop. + +This setting only affects the desktop icon. It does not prevent users from connecting to the network or browsing for shared computers on the network. + +> [!NOTE] +> In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Network Places icon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Network Locations icon on desktop* +- GP name: *NoNetHood* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoPropertiesMyComputer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting hides Properties on the context menu for Computer. + +If you enable this setting, the Properties option will not be present when the user right-clicks My Computer or clicks Computer and then goes to the File menu. Likewise, Alt-Enter does nothing when Computer is selected. + +If you disable or do not configure this setting, the Properties option is displayed as usual. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Computer icon context menu* +- GP name: *NoPropertiesMyComputer* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoPropertiesMyDocuments** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting hides the Properties menu command on the shortcut menu for the My Documents icon. + +If you enable this policy setting, the Properties menu command will not be displayed when the user does any of the following: + +- Right-clicks the My Documents icon. +- Clicks the My Documents icon, and then opens the File menu. +- Clicks the My Documents icon, and then presses ALT+ENTER. + +If you disable or do not configure this policy setting, the Properties menu command is displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Documents icon context menu* +- GP name: *NoPropertiesMyDocuments* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoRecentDocsNetHood** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Remote shared folders are not added to Network Locations whenever you open a document in the shared folder. + +If you disable this setting or do not configure it, when you open a document in a remote shared folder, the system adds a connection to the shared folder to Network Locations. + +If you enable this setting, shared folders are not added to Network Locations automatically when you open a document in the shared folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not add shares of recently opened documents to Network Locations* +- GP name: *NoRecentDocsNetHood* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoRecycleBinIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes most occurrences of the Recycle Bin icon. + +This setting removes the Recycle Bin icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box. + +This setting does not prevent the user from using other methods to gain access to the contents of the Recycle Bin folder. + +> [!NOTE] +> To make changes to this setting effective, you must log off and then log back on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Recycle Bin icon from desktop* +- GP name: *NoRecycleBinIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoRecycleBinProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Properties option from the Recycle Bin context menu. + +If you enable this setting, the Properties option will not be present when the user right-clicks on Recycle Bin or opens Recycle Bin and then clicks File. Likewise, Alt-Enter does nothing when Recycle Bin is selected. + +If you disable or do not configure this setting, the Properties option is displayed as usual. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Recycle Bin context menu* +- GP name: *NoRecycleBinProperties* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoSaveSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from saving certain changes to the desktop. + +If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Don't save settings at exit* +- GP name: *NoSaveSettings* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/NoWindowMinimizingShortcuts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents windows from being minimized or restored when the active window is shaken back and forth with the mouse. + +If you enable this policy, application windows will not be minimized or restored when the active window is shaken back and forth with the mouse. + +If you disable or do not configure this policy, this window minimizing and restoring gesture will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Aero Shake window minimizing mouse gesture* +- GP name: *NoWindowMinimizingShortcuts* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/Wallpaper** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the desktop background ("wallpaper") displayed on all users' desktops. + +This setting lets you specify the wallpaper on users' desktops and prevents users from changing the image or its presentation. The wallpaper you specify can be stored in a bitmap (*.bmp) or JPEG (*.jpg) file. + +To use this setting, type the fully qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Windows\web\wallpaper\home.jpg or a UNC path, such as \\\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification. + +If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice. + +Also, see the "Allow only bitmapped wallpaper" in the same location, and the "Prevent changing wallpaper" setting in User Configuration\Administrative Templates\Control Panel. + +> [!NOTE] +> This setting does not apply to remote desktop server sessions. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Desktop Wallpaper* +- GP name: *Wallpaper* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_ATC_DisableAdd** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adding Web content to their Active Desktop. + +This setting removes the "New" button from Web tab in Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. This setting does not remove existing Web content from their Active Desktop, or prevent users from removing existing Web content. + +Also, see the "Disable all items" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit adding items* +- GP name: *sz_ATC_DisableAdd* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_ATC_DisableClose** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from removing Web content from their Active Desktop. + +In Active Desktop, you can add items to the desktop but close them so they are not displayed. + +If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel. + +> [!NOTE] +> This setting does not prevent users from deleting items from their Active Desktop. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit closing items* +- GP name: *sz_ATC_DisableClose* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_ATC_DisableDel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from deleting Web content from their Active Desktop. + +This setting removes the Delete button from the Web tab in Display in Control Panel. As a result, users can temporarily remove, but not delete, Web content from their Active Desktop. + +This setting does not prevent users from adding Web content to their Active Desktop. + +Also, see the "Prohibit closing items" and "Disable all items" settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit deleting items* +- GP name: *sz_ATC_DisableDel* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_ATC_DisableEdit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the properties of Web content items on their Active Desktop. + +This setting disables the Properties button on the Web tab in Display in Control Panel. Also, it removes the Properties item from the menu for each item on the Active Desktop. As a result, users cannot change the properties of an item, such as its synchronization schedule, password, or display characteristics. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit editing items* +- GP name: *sz_ATC_DisableEdit* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_ATC_NoComponents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes Active Desktop content and prevents users from adding Active Desktop content. + +This setting removes all Active Desktop items from the desktop. It also removes the Web tab from Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. + +> [!NOTE] +> This setting does not disable Active Desktop. Users can still use image formats, such as JPEG and GIF, for their desktop wallpaper. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable all items* +- GP name: *sz_ATC_NoComponents* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_AdminComponents_Title** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Adds and deletes specified Web content items. + +You can use the "Add" box in this setting to add particular Web-based items or shortcuts to users' desktops. Users can close or delete the items (if settings allow), but the items are added again each time the setting is refreshed. + +You can also use this setting to delete particular Web-based items from users' desktops. Users can add the item again (if settings allow), but the item is deleted each time the setting is refreshed. + +> [!NOTE] +> Removing an item from the "Add" list for this setting is not the same as deleting it. Items that are removed from the "Add" list are not removed from the desktop. They are simply not added again. + +> [!NOTE] +> For this setting to take affect, you must log off and log on to the system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add/Delete items* +- GP name: *sz_AdminComponents_Title* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_DB_DragDropClose** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from manipulating desktop toolbars. + +If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars. + +> [!NOTE] +> If users have added or removed toolbars, this setting prevents them from restoring the default configuration. + +> [!TIP] +> To view the toolbars that can be added to the desktop, right-click a docked toolbar (such as the taskbar beside the Start button), and point to "Toolbars." + +Also, see the "Prohibit adjusting desktop toolbars" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent adding, dragging, dropping and closing the Taskbar's toolbars* +- GP name: *sz_DB_DragDropClose* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_DB_Moving** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars. + +This setting does not prevent users from adding or removing toolbars on the desktop. + +> [!NOTE] +> If users have adjusted their toolbars, this setting prevents them from restoring the default configuration. + +Also, see the "Prevent adding, dragging, dropping and closing the Taskbar's toolbars" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit adjusting desktop toolbars* +- GP name: *sz_DB_Moving* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + + +**ADMX_Desktop/sz_DWP_NoHTMLPaper** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Permits only bitmap images for wallpaper. This setting limits the desktop background ("wallpaper") to bitmap (.bmp) files. If users select files with other image formats, such as JPEG, GIF, PNG, or HTML, through the Browse button on the Desktop tab, the wallpaper does not load. Files that are autoconverted to a .bmp format, such as JPEG, GIF, and PNG, can be set as Wallpaper by right-clicking the image and selecting "Set as Wallpaper". + +Also, see the "Desktop Wallpaper" and the "Prevent changing wallpaper" (in User Configuration\Administrative Templates\Control Panel\Display) settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only bitmapped wallpaper* +- GP name: *sz_DWP_NoHTMLPaper* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md new file mode 100644 index 0000000000..69e459d10c --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -0,0 +1,619 @@ +--- +title: Policy CSP - ADMX_DeviceInstallation +description: Policy CSP - ADMX_DeviceInstallation +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DeviceInstallation +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_DeviceInstallation policies + +
    +
    + ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall +
    +
    + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText +
    +
    + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText +
    +
    + ADMX_DeviceInstallation/DeviceInstall_InstallTimeout +
    +
    + ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime +
    +
    + ADMX_DeviceInstallation/DeviceInstall_Removable_Deny +
    +
    + ADMX_DeviceInstallation/DeviceInstall_SystemRestore +
    +
    + ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser +
    +
    + + +
    + + +**ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings. + +If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow administrators to override Device Installation Restriction policies* +- GP name: *DeviceInstall_AllowAdminInstall* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
    + + +**ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to display a custom message to users in a notification when a device installation is attempted and a policy setting prevents the installation. + +If you enable this policy setting, Windows displays the text you type in the Detail Text box when a policy setting prevents device installation. + +If you disable or do not configure this policy setting, Windows displays a default message when a policy setting prevents device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display a custom message when installation is prevented by a policy setting* +- GP name: *DeviceInstall_DeniedPolicy_DetailText* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
    + + +**ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to display a custom message title in a notification when a device installation is attempted and a policy setting prevents the installation. + +If you enable this policy setting, Windows displays the text you type in the Main Text box as the title text of a notification when a policy setting prevents device installation. + +If you disable or do not configure this policy setting, Windows displays a default title in a notification when a policy setting prevents device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display a custom message title when device installation is prevented by a policy setting* +- GP name: *DeviceInstall_DeniedPolicy_SimpleText* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
    + + +**ADMX_DeviceInstallation/DeviceInstall_InstallTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete. + +If you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation. + +If you disable or do not configure this policy setting, Windows waits 240 seconds for a device installation task to complete before terminating the installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure device installation time-out* +- GP name: *DeviceInstall_InstallTimeout* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
    + + +**ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies. + +If you enable this policy setting, set the amount of seconds you want the system to wait until a reboot. + +If you disable or do not configure this policy setting, the system does not force a reboot. + +Note: If no reboot is forced, the device installation restriction right will not take effect until the system is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Time (in seconds) to force reboot when required for policy changes to take effect* +- GP name: *DeviceInstall_Policy_RebootTime* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
    + + +**ADMX_DeviceInstallation/DeviceInstall_Removable_Deny** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device. + +If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, Windows can install and update device drivers for removable devices as allowed or prevented by other policy settings. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent installation of removable devices* +- GP name: *DeviceInstall_Removable_Deny* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
    + + +**ADMX_DeviceInstallation/DeviceInstall_SystemRestore** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity. + +If you enable this policy setting, Windows does not create a system restore point when one would normally be created. + +If you disable or do not configure this policy setting, Windows creates a system restore point as it normally would. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point* +- GP name: *DeviceInstall_SystemRestore* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
    + + +**ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a list of device setup class GUIDs describing device drivers that non-administrator members of the built-in Users group may install on the system. + +If you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store. + +If you disable or do not configure this policy setting, only members of the Administrators group are allowed to install new device drivers on the system. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow non-administrators to install drivers for these device setup classes* +- GP name: *DriverInstall_Classes_AllowUser* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md new file mode 100644 index 0000000000..5da6627e8f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -0,0 +1,188 @@ +--- +title: Policy CSP - ADMX_DeviceSetup +description: Policy CSP - ADMX_DeviceSetup +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DeviceSetup +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_DeviceSetup policies + +
    +
    + ADMX_DeviceSetup/DeviceInstall_BalloonTips +
    +
    + ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration +
    +
    + + +
    + + +**ADMX_DeviceSetup/DeviceInstall_BalloonTips** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off "Found New Hardware" balloons during device installation. + +If you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed. + +If you disable or do not configure this policy setting, "Found New Hardware" balloons appear while a device is being installed, unless the driver for the device suppresses the balloons. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off "Found New Hardware" balloons during device installation* +- GP name: *DeviceInstall_BalloonTips* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
    + + +**ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the order in which Windows searches source locations for device drivers. + +If you enable this policy setting, you can select whether Windows searches for drivers on Windows Update unconditionally, only if necessary, or not at all. + +Note that searching always implies that Windows will attempt to search Windows Update exactly one time. With this setting, Windows will not continually search for updates. This setting is used to ensure that the best software will be found for the device, even if the network is temporarily available. If the setting for searching only if needed is specified, then Windows will search for a driver only if a driver is not locally available on the system. + +If you disable or do not configure this policy setting, members of the Administrators group can determine the priority order in which Windows searches source locations for device drivers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify search order for device driver source locations* +- GP name: *DriverSearchPlaces_SearchOrderConfiguration* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-digitallocker.md b/windows/client-management/mdm/policy-csp-admx-digitallocker.md new file mode 100644 index 0000000000..08a7dab278 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-digitallocker.md @@ -0,0 +1,191 @@ +--- +title: Policy CSP - ADMX_DigitalLocker +description: Policy CSP - ADMX_DigitalLocker +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/31/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DigitalLocker +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_DigitalLocker policies + +
    +
    + ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1 +
    +
    + ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2 +
    +
    + + +
    + + +**ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Digital Locker can run. + +Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker. + +If you enable this setting, Digital Locker will not run. + +If you disable or do not configure this setting, Digital Locker can be run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow Digital Locker to run* +- GP name: *Digitalx_DiableApplication_TitleText_1* +- GP path: *Windows Components/Digital Locker* +- GP ADMX file name: *DigitalLocker.admx* + + + +
    + + +**ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Digital Locker can run. + +Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker. + +If you enable this setting, Digital Locker will not run. + +If you disable or do not configure this setting, Digital Locker can be run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow Digital Locker to run* +- GP name: *Digitalx_DiableApplication_TitleText_2* +- GP path: *Windows Components/Digital Locker* +- GP ADMX file name: *DigitalLocker.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md new file mode 100644 index 0000000000..9aba6d0482 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -0,0 +1,1725 @@ +--- +title: Policy CSP - ADMX_DnsClient +description: Policy CSP - ADMX_DnsClient +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DnsClient + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_DnsClient policies + +
    +
    + ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries +
    +
    + ADMX_DnsClient/DNS_AppendToMultiLabelName +
    +
    + ADMX_DnsClient/DNS_Domain +
    +
    + ADMX_DnsClient/DNS_DomainNameDevolutionLevel +
    +
    + ADMX_DnsClient/DNS_IdnEncoding +
    +
    + ADMX_DnsClient/DNS_IdnMapping +
    +
    + ADMX_DnsClient/DNS_NameServer +
    +
    + ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns +
    +
    + ADMX_DnsClient/DNS_PrimaryDnsSuffix +
    +
    + ADMX_DnsClient/DNS_RegisterAdapterName +
    +
    + ADMX_DnsClient/DNS_RegisterReverseLookup +
    +
    + ADMX_DnsClient/DNS_RegistrationEnabled +
    +
    + ADMX_DnsClient/DNS_RegistrationOverwritesInConflict +
    +
    + ADMX_DnsClient/DNS_RegistrationRefreshInterval +
    +
    + ADMX_DnsClient/DNS_RegistrationTtl +
    +
    + ADMX_DnsClient/DNS_SearchList +
    +
    + ADMX_DnsClient/DNS_SmartMultiHomedNameResolution +
    +
    + ADMX_DnsClient/DNS_SmartProtocolReorder +
    +
    + ADMX_DnsClient/DNS_UpdateSecurityLevel +
    +
    + ADMX_DnsClient/DNS_UpdateTopLevelDomainZones +
    +
    + ADMX_DnsClient/DNS_UseDomainNameDevolution +
    +
    + ADMX_DnsClient/Turn_Off_Multicast +
    +
    + + +
    + + +**ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that NetBIOS over TCP/IP (NetBT) queries are issued for fully qualified domain names. + +If you enable this policy setting, NetBT queries will be issued for multi-label and fully qualified domain names, such as "www.example.com" in addition to single-label names. + +If you disable this policy setting, or if you do not configure this policy setting, NetBT queries will only be issued for single-label names, such as "example" and not for multi-label and fully qualified domain names. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow NetBT queries for fully qualified domain names* +- GP name: *DNS_AllowFQDNNetBiosQueries* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + +
    + + +**ADMX_DnsClient/DNS_AppendToMultiLabelName** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that computers may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails. + +A name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example "server.corp" is an unqualified multi-label name. The name "server.corp.contoso.com." is an example of a fully qualified name because it contains a terminating dot. + +For example, if attaching suffixes is allowed, an unqualified multi-label name query for "server.corp" will be queried by the DNS client first. If the query succeeds, the response is returned to the client. If the query fails, the unqualified multi-label name is appended with DNS suffixes. These suffixes can be derived from a combination of the local DNS client's primary domain suffix, a connection-specific domain suffix, and a DNS suffix search list. + +If attaching suffixes is allowed, and a DNS client with a primary domain suffix of "contoso.com" performs a query for "server.corp" the DNS client will send a query for "server.corp" first, and then a query for "server.corp.contoso.com." second if the first query fails. + +If you enable this policy setting, suffixes are allowed to be appended to an unqualified multi-label name if the original name query fails. + +If you disable this policy setting, no suffixes are appended to unqualified multi-label name queries if the original name query fails. + +If you do not configure this policy setting, computers will use their local DNS client settings to determine the query behavior for unqualified multi-label names. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow DNS suffix appending to unqualified multi-label name queries* +- GP name: *DNS_AppendToMultiLabelName* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_Domain** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP. To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix. + +If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied connection specific DNS suffix, if configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Connection-specific DNS suffix* +- GP name: *DNS_Domain* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_DomainNameDevolutionLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies if the devolution level that DNS clients will use if they perform primary DNS suffix devolution during the name resolution process. + +With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name. + +The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box. + +Devolution is not enabled if a global suffix search list is configured using Group Policy. + +If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries: + +- The primary DNS suffix, as specified on the Computer Name tab of the System control panel. +- Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection. + +For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. + +If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. + +For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using this policy setting. The default devolution level is two. + +If you enable this policy setting and DNS devolution is also enabled, DNS clients use the DNS devolution level that you specify. + +If you disable this policy setting or do not configure it, DNS clients use the default devolution level of two provided that DNS devolution is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix devolution level* +- GP name: *DNS_DomainNameDevolutionLevel* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_IdnEncoding** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the computer is on non-domain networks with no WINS servers configured. + +If this policy setting is enabled, IDNs are not converted to Punycode. + +If this policy setting is disabled, or if this policy setting is not configured, IDNs are converted to Punycode when the computer is on non-domain networks with no WINS servers configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off IDN encoding* +- GP name: *DNS_IdnEncoding* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_IdnMapping** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to the Nameprep form, a canonical Unicode representation of the string. + +If this policy setting is enabled, IDNs are converted to the Nameprep form. + +If this policy setting is disabled, or if this policy setting is not configured, IDNs are not converted to the Nameprep form. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IDN mapping* +- GP name: *DNS_IdnMapping* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_NameServer** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the DNS servers to which a computer sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. + +To use this policy setting, click Enabled, and then enter a space-delimited list of IP addresses in the available field. To use this policy setting, you must enter at least one IP address. + +If you enable this policy setting, the list of DNS servers is applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied list of DNS servers, if configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DNS servers* +- GP name: *DNS_NameServer* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that responses from link local name resolution protocols received over a network interface that is higher in the binding order are preferred over DNS responses from network interfaces lower in the binding order. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT). + +If you enable this policy setting, responses from link local protocols will be preferred over DNS responses if the local responses are from a network with a higher binding order. + +If you disable this policy setting, or if you do not configure this policy setting, then DNS responses from networks lower in the binding order will be preferred over responses from link local protocols received from networks higher in the binding order. + +> [!NOTE] +> This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prefer link local responses over DNS when received over a network with higher precedence* +- GP name: *DNS_PreferLocalResponsesOverLowerOrderDns* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + + +
    + + +**ADMX_DnsClient/DNS_PrimaryDnsSuffix** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the primary DNS suffix used by computers in DNS name registration and DNS name resolution. + +To use this policy setting, click Enabled and enter the entire primary DNS suffix you want to assign. For example: microsoft.com. + +> [!IMPORTANT] +> In order for changes to this policy setting to be applied on computers that receive it, you must restart Windows. + +If you enable this policy setting, it supersedes the primary DNS suffix configured in the DNS Suffix and NetBIOS Computer Name dialog box using the System control panel. + +You can use this policy setting to prevent users, including local administrators, from changing the primary DNS suffix. + +If you disable this policy setting, or if you do not configure this policy setting, each computer uses its local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it is joined. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix* +- GP name: *DNS_PrimaryDnsSuffix* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_RegisterAdapterName** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies if a computer performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix. + +By default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: mycomputer.microsoft.com. + +If you enable this policy setting, a computer will register A and PTR resource records with its connection-specific DNS suffix, in addition to the primary DNS suffix. This applies to all network connections used by computers that receive this policy setting. + +For example, with a computer name of mycomputer, a primary DNS suffix of microsoft.com, and a connection specific DNS suffix of VPNconnection, a computer will register A and PTR resource records for mycomputer.VPNconnection and mycomputer.microsoft.com when this policy setting is enabled. + +Important: This policy setting is ignored on a DNS client computer if dynamic DNS registration is disabled. + +If you disable this policy setting, or if you do not configure this policy setting, a DNS client computer will not register any A and PTR resource records using a connection-specific DNS suffix. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Register DNS records with connection-specific DNS suffix* +- GP name: *DNS_RegisterAdapterName* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_RegisterReverseLookup** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies if DNS client computers will register PTR resource records. + +By default, DNS clients configured to perform dynamic DNS registration will attempt to register PTR resource record only if they successfully registered the corresponding A resource record. + +If you enable this policy setting, registration of PTR records will be determined by the option that you choose under Register PTR records. + +To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: + +- Do not register: Computers will not attempt to register PTR resource records +- Register: Computers will attempt to register PTR resource records even if registration of the corresponding A records was not successful. +- Register only if A record registration succeeds: Computers will attempt to register PTR resource records only if registration of the corresponding A records was successful. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use locally configured settings. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Register PTR records* +- GP name: *DNS_RegisterReverseLookup* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_RegistrationEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies if DNS dynamic update is enabled. Computers configured for DNS dynamic update automatically register and update their DNS resource records with a DNS server. + +If you enable this policy setting, or you do not configure this policy setting, computers will attempt to use dynamic DNS registration on all network connections that have connection-specific dynamic DNS registration enabled. For a dynamic DNS registration to be enabled on a network connection, the connection-specific configuration must allow dynamic DNS registration, and this policy setting must not be disabled. + +If you disable this policy setting, computers may not use dynamic DNS registration for any of their network connections, regardless of the configuration for individual network connections. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Dynamic update* +- GP name: *DNS_RegistrationEnabled* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_RegistrationOverwritesInConflict** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether dynamic updates should overwrite existing resource records that contain conflicting IP addresses. + +This policy setting is designed for computers that register address (A) resource records in DNS zones that do not use Secure Dynamic Updates. Secure Dynamic Update preserves ownership of resource records and does not allow a DNS client to overwrite records that are registered by other computers. + +During dynamic update of resource records in a zone that does not use Secure Dynamic Updates, an A resource record might exist that associates the client's host name with an IP address different than the one currently in use by the client. By default, the DNS client attempts to replace the existing A resource record with an A resource record that has the client's current IP address. + +If you enable this policy setting or if you do not configure this policy setting, DNS clients maintain their default behavior and will attempt to replace conflicting A resource records during dynamic update. + +If you disable this policy setting, existing A resource records that contain conflicting IP addresses will not be replaced during a dynamic update, and an error will be recorded in Event Viewer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Replace addresses in conflicts* +- GP name: *DNS_RegistrationOverwritesInConflict* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_RegistrationRefreshInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the interval used by DNS clients to refresh registration of A and PTR resource. This policy setting only applies to computers performing dynamic DNS updates. + +Computers configured to perform dynamic DNS registration of A and PTR resource records periodically reregister their records with DNS servers, even if the record has not changed. This reregistration is required to indicate to DNS servers that records are current and should not be automatically removed (scavenged) when a DNS server is configured to delete stale records. + +> [!WARNING] +> If record scavenging is enabled on the zone, the value of this policy setting should never be longer than the value of the DNS zone refresh interval. Configuring the registration refresh interval to be longer than the refresh interval of the DNS zone might result in the undesired deletion of A and PTR resource records. + +To specify the registration refresh interval, click Enabled and then enter a value of 1800 or greater. The value that you specify is the number of seconds to use for the registration refresh interval. For example, 1800 seconds is 30 minutes. + +If you enable this policy setting, registration refresh interval that you specify will be applied to all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the local or DHCP supplied setting. By default, client computers configured with a static IP address attempt to update their DNS resource records once every 24 hours and DHCP clients will attempt to update their DNS resource records when a DHCP lease is granted or renewed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Registration refresh interval* +- GP name: *DNS_RegistrationRefreshInterval* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_RegistrationTtl** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the value of the time to live (TTL) field in A and PTR resource records that are registered by computers to which this policy setting is applied. + +To specify the TTL, click Enabled and then enter a value in seconds (for example, 900 is 15 minutes). + +If you enable this policy setting, the TTL value that you specify will be applied to DNS resource records registered for all network connections used by computers that receive this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use the TTL settings specified in DNS. By default, the TTL is 1200 seconds (20 minutes). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *TTL value for A and PTR records* +- GP name: *DNS_RegistrationTtl* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_SearchList** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the DNS suffixes to attach to an unqualified single-label name before submission of a DNS query for that name. + +An unqualified single-label name contains no dots. The name "example" is a single-label name. This is different from a fully qualified domain name such as "example.microsoft.com." + +Client computers that receive this policy setting will attach one or more suffixes to DNS queries for a single-label name. For example, a DNS query for the single-label name "example" will be modified to "example.microsoft.com" before sending the query to a DNS server if this policy setting is enabled with a suffix of "microsoft.com." + +To use this policy setting, click Enabled, and then enter a string value representing the DNS suffixes that should be appended to single-label names. You must specify at least one suffix. Use a comma-delimited string, such as "microsoft.com,serverua.microsoft.com,office.microsoft.com" to specify multiple suffixes. + +If you enable this policy setting, one DNS suffix is attached at a time for each query. If a query is unsuccessful, a new DNS suffix is added in place of the failed suffix, and this new query is submitted. The values are used in the order they appear in the string, starting with the leftmost value and proceeding to the right until a query is successful or all suffixes are tried. + +If you disable this policy setting, or if you do not configure this policy setting, the primary DNS suffix and network connection-specific DNS suffixes are appended to the unqualified queries. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DNS suffix search list* +- GP name: *DNS_SearchList* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_SmartMultiHomedNameResolution** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that a multi-homed DNS client should optimize name resolution across networks. The setting improves performance by issuing parallel DNS, link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT) queries across all networks. In the event that multiple positive responses are received, the network binding order is used to determine which response to accept. + +If you enable this policy setting, the DNS client will not perform any optimizations. DNS queries will be issued across all networks first. LLMNR queries will be issued if the DNS queries fail, followed by NetBT queries if LLMNR queries fail. + +If you disable this policy setting, or if you do not configure this policy setting, name resolution will be optimized when issuing DNS, LLMNR and NetBT queries. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off smart multi-homed name resolution* +- GP name: *DNS_SmartMultiHomedNameResolution* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_SmartProtocolReorder** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that the DNS client should prefer responses from link local name resolution protocols on non-domain networks over DNS responses when issuing queries for flat names. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT). + +If you enable this policy setting, the DNS client will prefer DNS responses, followed by LLMNR, followed by NetBT for all networks. + +If you disable this policy setting, or if you do not configure this policy setting, the DNS client will prefer link local responses for flat name queries on non-domain networks. + +> [!NOTE] +> This policy setting is applicable only if the turn off smart multi-homed name resolution policy setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off smart protocol reordering* +- GP name: *DNS_SmartProtocolReorder* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_UpdateSecurityLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security level for dynamic DNS updates. + +To use this policy setting, click Enabled and then select one of the following values: + +- Unsecure followed by secure - computers send secure dynamic updates only when nonsecure dynamic updates are refused. +- Only unsecure - computers send only nonsecure dynamic updates. +- Only secure - computers send only secure dynamic updates. + +If you enable this policy setting, computers that attempt to send dynamic DNS updates will use the security level that you specify in this policy setting. + +If you disable this policy setting, or if you do not configure this policy setting, computers will use local settings. By default, DNS clients attempt to use unsecured dynamic update first. If an unsecured update is refused, clients try to use secure update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Update security level* +- GP name: *DNS_UpdateSecurityLevel* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_UpdateTopLevelDomainZones** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies if computers may send dynamic updates to zones with a single label name. These zones are also known as top-level domain zones, for example: "com." + +By default, a DNS client that is configured to perform dynamic DNS update will update the DNS zone that is authoritative for its DNS resource records unless the authoritative zone is a top-level domain or root zone. + +If you enable this policy setting, computers send dynamic updates to any zone that is authoritative for the resource records that the computer needs to update, except the root zone. + +If you disable this policy setting, or if you do not configure this policy setting, computers do not send dynamic updates to the root zone or top-level domain zones that are authoritative for the resource records that the computer needs to update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Update top level domain zones* +- GP name: *DNS_UpdateTopLevelDomainZones* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/DNS_UseDomainNameDevolution** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies if the DNS client performs primary DNS suffix devolution during the name resolution process. + +With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name. + +The DNS client appends DNS suffixes to the single-label, unqualified domain name based on the state of the Append primary and connection specific DNS suffixes radio button and Append parent suffixes of the primary DNS suffix check box on the DNS tab in Advanced TCP/IP Settings for the Internet Protocol (TCP/IP) Properties dialog box. + +Devolution is not enabled if a global suffix search list is configured using Group Policy. + +If a global suffix search list is not configured, and the Append primary and connection specific DNS suffixes radio button is selected, the DNS client appends the following names to a single-label name when it sends DNS queries: + +The primary DNS suffix, as specified on the Computer Name tab of the System control panel. + +Each connection-specific DNS suffix, assigned either through DHCP or specified in the DNS suffix for this connection box on the DNS tab in the Advanced TCP/IP Settings dialog box for each connection. + +For example, when a user submits a query for a single-label name such as "example," the DNS client attaches a suffix such as "microsoft.com" resulting in the query "example.microsoft.com," before sending the query to a DNS server. + +If a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the primary DNS suffix of the computer (drops the leftmost label of the primary DNS suffix), attaches this devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server. + +For example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted, corresponding to a devolution level of two. The primary DNS suffix cannot be devolved beyond a devolution level of two. The devolution level can be configured using the primary DNS suffix devolution level policy setting. The default devolution level is two. + +If you enable this policy setting, or if you do not configure this policy setting, DNS clients attempt to resolve single-label names using concatenations of the single-label name to be resolved and the devolved primary DNS suffix. + +If you disable this policy setting, DNS clients do not attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved primary DNS suffix. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Primary DNS suffix devolution* +- GP name: *DNS_UseDomainNameDevolution* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +
    + + +**ADMX_DnsClient/Turn_Off_Multicast** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that link local multicast name resolution (LLMNR) is disabled on client computers. + +LLMNR is a secondary name resolution protocol. With LLMNR, queries are sent using multicast over a local network link on a single subnet from a client computer to another client computer on the same subnet that also has LLMNR enabled. LLMNR does not require a DNS server or DNS client configuration, and provides name resolution in scenarios in which conventional DNS name resolution is not possible. + +If you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer. + +If you disable this policy setting, or you do not configure this policy setting, LLMNR will be enabled on all available network adapters. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off multicast name resolution* +- GP name: *Turn_Off_Multicast* +- GP path: *Network/DNS Client* +- GP ADMX file name: *DnsClient.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-dwm.md b/windows/client-management/mdm/policy-csp-admx-dwm.md new file mode 100644 index 0000000000..71f9b3638f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-dwm.md @@ -0,0 +1,491 @@ +--- +title: Policy CSP - ADMX_DWM +description: Policy CSP - ADMX_DWM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/31/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DWM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_DWM policies + +
    +
    + ADMX_DWM/DwmDefaultColorizationColor_1 +
    +
    + ADMX_DWM/DwmDefaultColorizationColor_2 +
    +
    + ADMX_DWM/DwmDisallowAnimations_1 +
    +
    + ADMX_DWM/DwmDisallowAnimations_2 +
    +
    + ADMX_DWM/DwmDisallowColorizationColorChanges_1 +
    +
    + ADMX_DWM/DwmDisallowColorizationColorChanges_2 +
    +
    + + +
    + + +**ADMX_DWM/DwmDefaultColorizationColor_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the default color for window frames when the user does not specify a color. + +If you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not specify a color. + +If you disable or do not configure this policy setting, the default internal color is used, if the user does not specify a color. + +> [!NOTE] +> This policy setting can be used in conjunction with the "Prevent color changes of window frames" setting, to enforce a specific color for window frames that cannot be changed by users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify a default color* +- GP name: *DwmDefaultColorizationColor_1* +- GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* +- GP ADMX file name: *DWM.admx* + + + + +
    + + +**ADMX_DWM/DwmDefaultColorizationColor_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the default color for window frames when the user does not specify a color. + +If you enable this policy setting and specify a default color, this color is used in glass window frames, if the user does not specify a color. + +If you disable or do not configure this policy setting, the default internal color is used, if the user does not specify a color. + +> [!NOTE] +> This policy setting can be used in conjunction with the "Prevent color changes of window frames" setting, to enforce a specific color for window frames that cannot be changed by users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify a default color* +- GP name: *DwmDefaultColorizationColor_2* +- GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* +- GP ADMX file name: *DWM.admx* + + + +
    + + +**ADMX_DWM/DwmDisallowAnimations_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing windows. + +If you enable this policy setting, window animations are turned off. + +If you disable or do not configure this policy setting, window animations are turned on. + +Changing this policy setting requires a logoff for it to be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow window animations* +- GP name: *DwmDisallowAnimations_1* +- GP path: *Windows Components/Desktop Window Manager* +- GP ADMX file name: *DWM.admx* + + + +
    + + +**ADMX_DWM/DwmDisallowAnimations_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing windows. + +If you enable this policy setting, window animations are turned off. + +If you disable or do not configure this policy setting, window animations are turned on. + +Changing this policy setting requires a logoff for it to be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow window animations* +- GP name: *DwmDisallowAnimations_2* +- GP path: *Windows Components/Desktop Window Manager* +- GP ADMX file name: *DWM.admx* + + + +
    + + +**ADMX_DWM/DwmDisallowColorizationColorChanges_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability to change the color of window frames. + +If you enable this policy setting, you prevent users from changing the default window frame color. + +If you disable or do not configure this policy setting, you allow users to change the default window frame color. + +> [!NOTE] +> This policy setting can be used in conjunction with the "Specify a default color for window frames" policy setting, to enforce a specific color for window frames that cannot be changed by users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow color changes* +- GP name: *DwmDisallowColorizationColorChanges_1* +- GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* +- GP ADMX file name: *DWM.admx* + + + +
    + + +**ADMX_DWM/DwmDisallowColorizationColorChanges_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability to change the color of window frames. + +If you enable this policy setting, you prevent users from changing the default window frame color. + +If you disable or do not configure this policy setting, you allow users to change the default window frame color. + +> [!NOTE] +> This policy setting can be used in conjunction with the "Specify a default color for window frames" policy setting, to enforce a specific color for window frames that cannot be changed by users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow color changes* +- GP name: *DwmDisallowColorizationColorChanges_2* +- GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* +- GP ADMX file name: *DWM.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md new file mode 100644 index 0000000000..b56ce8c52a --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -0,0 +1,972 @@ +--- +title: Policy CSP - ADMX_EAIME +description: Policy CSP - ADMX_EAIME +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EAIME +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_EAIME policies + +
    +
    + ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList +
    +
    + ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion +
    +
    + ADMX_EAIME/L_TurnOffCustomDictionary +
    +
    + ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput +
    +
    + ADMX_EAIME/L_TurnOffInternetSearchIntegration +
    +
    + ADMX_EAIME/L_TurnOffOpenExtendedDictionary +
    +
    + ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile +
    +
    + ADMX_EAIME/L_TurnOnCloudCandidate +
    +
    + ADMX_EAIME/L_TurnOnCloudCandidateCHS +
    +
    + ADMX_EAIME/L_TurnOnLexiconUpdate +
    +
    + ADMX_EAIME/L_TurnOnLiveStickers +
    +
    + ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport +
    +
    + + +
    + + +**ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to include the Non-Publishing Standard Glyph in the candidate list when Publishing Standard Glyph for the word exists. + +If you enable this policy setting, Non-Publishing Standard Glyph is not included in the candidate list when Publishing Standard Glyph for the word exists. + +If you disable or do not configure this policy setting, both Publishing Standard Glyph and Non-Publishing Standard Glyph are included in the candidate list. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not include Non-Publishing Standard Glyph in the candidate list* +- GP name: *L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to restrict character code range of conversion by setting character filter. + +If you enable this policy setting, then only the character code ranges specified by this policy setting are used for conversion of IME. You can specify multiple ranges by setting a value combined with a bitwise OR of following values: + +- 0x0001 // JIS208 area +- 0x0002 // NEC special char code +- 0x0004 // NEC selected IBM extended code +- 0x0008 // IBM extended code +- 0x0010 // Half width katakana code +- 0x0100 // EUDC(GAIJI) +- 0x0200 // S-JIS unmapped area +- 0x0400 // Unicode char +- 0x0800 // surrogate char +- 0x1000 // IVS char +- 0xFFFF // no definition. + +If you disable or do not configure this policy setting, no range of characters are filtered by default. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict character code range of conversion* +- GP name: *L_RestrictCharacterCodeRangeOfConversion* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOffCustomDictionary** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off the ability to use a custom dictionary. + +If you enable this policy setting, you cannot add, edit, and delete words in the custom dictionary either with GUI tools or APIs. A word registered in the custom dictionary before enabling this policy setting can continue to be used for conversion. + +If you disable or do not configure this policy setting, the custom dictionary can be used by default. + +For Japanese Microsoft IME, [Clear auto-tuning information] works, even if this policy setting is enabled, and it clears self-tuned words from the custom dictionary. + +This policy setting is applied to Japanese Microsoft IME. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off custom dictionary* +- GP name: *L_TurnOffCustomDictionary* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off history-based predictive input. + +If you enable this policy setting, history-based predictive input is turned off. + +If you disable or do not configure this policy setting, history-based predictive input is on by default. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off history-based predictive input* +- GP name: *L_TurnOffHistorybasedPredictiveInput* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOffInternetSearchIntegration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Internet search integration. + +Search integration includes both using Search Provider (Japanese Microsoft IME) and performing Bing search from predictive input for Japanese Microsoft IME. + +If you enable this policy setting, you cannot use search integration. + +If you disable or do not configure this policy setting, the search integration function can be used by default. + +This policy setting applies to Japanese Microsoft IME. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet search integration* +- GP name: *L_TurnOffInternetSearchIntegration* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOffOpenExtendedDictionary** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Open Extended Dictionary. + +If you enable this policy setting, Open Extended Dictionary is turned off. You cannot add a new Open Extended Dictionary. + +For Japanese Microsoft IME, an Open Extended Dictionary that is added before enabling this policy setting is not used for conversion. + +If you disable or do not configure this policy setting, Open Extended Dictionary can be added and used by default. + +This policy setting is applied to Japanese Microsoft IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Open Extended Dictionary* +- GP name: *L_TurnOffOpenExtendedDictionary* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off saving the auto-tuning result to file. + +If you enable this policy setting, the auto-tuning data is not saved to file. + +If you disable or do not configure this policy setting, auto-tuning data is saved to file by default. + +This policy setting applies to Japanese Microsoft IME only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off saving auto-tuning data to file* +- GP name: *L_TurnOffSavingAutoTuningDataToFile* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOnCloudCandidate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the cloud candidates feature, which uses an online service to provide input suggestions that don't exist in a PC's local dictionary. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the suggestions, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the cloud candidates feature. + +This Policy setting applies to Microsoft CHS Pinyin IME and JPN IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on cloud candidate* +- GP name: *L_TurnOnCloudCandidate* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOnCloudCandidateCHS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the cloud candidates feature, which uses an online service to provide input suggestions that don't exist in a PC's local dictionary. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the suggestions, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the cloud candidates feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on cloud candidate for CHS* +- GP name: *L_TurnOnCloudCandidateCHS* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOnLexiconUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the lexicon update feature, which downloads hot and popular words lexicon to local PC. + +If you enable this policy setting, the functionality associated with this feature is turned on, hot and popular words lexicon can be downloaded to local PC, the user is able to turn it on or off in settings. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned on by default, and the user can turn on and turn off the lexicon update feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on lexicon update* +- GP name: *L_TurnOnLexiconUpdate* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOnLiveStickers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the live sticker feature, which uses an online service to provide stickers online. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the live stickers, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the live sticker feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Live Sticker* +- GP name: *L_TurnOnLiveStickers* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + + +**ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn on logging of misconversion for the misconversion report. + +If you enable this policy setting, misconversion logging is turned on. + +If you disable or do not configure this policy setting, misconversion logging is turned off. + +This policy setting applies to Japanese Microsoft IME and Traditional Chinese IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on misconversion logging for misconversion report* +- GP name: *L_TurnOnMisconversionLoggingForMisconversionReport* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md new file mode 100644 index 0000000000..1dd5a4e6cb --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md @@ -0,0 +1,117 @@ +--- +title: Policy CSP - ADMX_EncryptFilesonMove +description: Policy CSP - ADMX_EncryptFilesonMove +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EncryptFilesonMove +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_EncryptFilesonMove policies + +
    +
    + ADMX_EncryptFilesonMove/NoEncryptOnMove +
    +
    + + +
    + + +**ADMX_EncryptFilesonMove/NoEncryptOnMove** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents File Explorer from encrypting files that are moved to an encrypted folder. + +If you enable this policy setting, File Explorer will not automatically encrypt files that are moved to an encrypted folder. + +If you disable or do not configure this policy setting, File Explorer automatically encrypts files that are moved to an encrypted folder. + +This setting applies only to files moved within a volume. When files are moved to other volumes, or if you create a new file in an encrypted folder, File Explorer encrypts those files automatically. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not automatically encrypt files moved to encrypted folders* +- GP name: *NoEncryptOnMove* +- GP path: *System* +- GP ADMX file name: *EncryptFilesonMove.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md new file mode 100644 index 0000000000..7e217f1364 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md @@ -0,0 +1,477 @@ +--- +title: Policy CSP - ADMX_EnhancedStorage +description: Policy CSP - ADMX_EnhancedStorage +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EnhancedStorage +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_EnhancedStorage policies + +
    +
    + ADMX_EnhancedStorage/ApprovedEnStorDevices +
    +
    + ADMX_EnhancedStorage/ApprovedSilos +
    +
    + ADMX_EnhancedStorage/DisablePasswordAuthentication +
    +
    + ADMX_EnhancedStorage/DisallowLegacyDiskDevices +
    +
    + ADMX_EnhancedStorage/LockDeviceOnMachineLock +
    +
    + ADMX_EnhancedStorage/RootHubConnectedEnStorDevices +
    +
    + + +
    + + +**ADMX_EnhancedStorage/ApprovedEnStorDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure a list of Enhanced Storage devices by manufacturer and product ID that are usable on your computer. + +If you enable this policy setting, only Enhanced Storage devices that contain a manufacturer and product ID specified in this policy are usable on your computer. + +If you disable or do not configure this policy setting, all Enhanced Storage devices are usable on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure list of Enhanced Storage devices usable on your computer* +- GP name: *ApprovedEnStorDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
    + + +**ADMX_EnhancedStorage/ApprovedSilos** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to create a list of IEEE 1667 silos, compliant with the Institute of Electrical and Electronics Engineers, Inc. (IEEE) 1667 specification, that are usable on your computer. + +If you enable this policy setting, only IEEE 1667 silos that match a silo type identifier specified in this policy are usable on your computer. + +If you disable or do not configure this policy setting, all IEEE 1667 silos on Enhanced Storage devices are usable on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure list of IEEE 1667 silos usable on your computer* +- GP name: *ApprovedSilos* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
    + + +**ADMX_EnhancedStorage/DisablePasswordAuthentication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not a password can be used to unlock an Enhanced Storage device. + +If you enable this policy setting, a password cannot be used to unlock an Enhanced Storage device. + +If you disable or do not configure this policy setting, a password can be used to unlock an Enhanced Storage device. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow password authentication of Enhanced Storage devices* +- GP name: *DisablePasswordAuthentication* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
    + + +**ADMX_EnhancedStorage/DisallowLegacyDiskDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not non-Enhanced Storage removable devices are allowed on your computer. + +If you enable this policy setting, non-Enhanced Storage removable devices are not allowed on your computer. + +If you disable or do not configure this policy setting, non-Enhanced Storage removable devices are allowed on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow non-Enhanced Storage removable devices* +- GP name: *DisallowLegacyDiskDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
    + + +**ADMX_EnhancedStorage/LockDeviceOnMachineLock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting locks Enhanced Storage devices when the computer is locked. + +This policy setting is supported in Windows Server SKUs only. + +If you enable this policy setting, the Enhanced Storage device remains locked when the computer is locked. + +If you disable or do not configure this policy setting, the Enhanced Storage device state is not changed when the computer is locked. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lock Enhanced Storage when the computer is locked* +- GP name: *LockDeviceOnMachineLock* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
    + + +**ADMX_EnhancedStorage/RootHubConnectedEnStorDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not only USB root hub connected Enhanced Storage devices are allowed. Allowing only root hub connected Enhanced Storage devices minimizes the risk of an unauthorized USB device reading data on an Enhanced Storage device. + +If you enable this policy setting, only USB root hub connected Enhanced Storage devices are allowed. + +If you disable or do not configure this policy setting, USB Enhanced Storage devices connected to both USB root hubs and non-root hubs will be allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only USB root hub connected Enhanced Storage devices* +- GP name: *RootHubConnectedEnStorDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md new file mode 100644 index 0000000000..5f3fc5e33b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -0,0 +1,2202 @@ +--- +title: Policy CSP - ADMX_ErrorReporting +description: Policy CSP - ADMX_ErrorReporting +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ErrorReporting +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_ErrorReporting policies + +
    +
    + ADMX_ErrorReporting/PCH_AllOrNoneDef +
    +
    + ADMX_ErrorReporting/PCH_AllOrNoneEx +
    +
    + ADMX_ErrorReporting/PCH_AllOrNoneInc +
    +
    + ADMX_ErrorReporting/PCH_ConfigureReport +
    +
    + ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults +
    +
    + ADMX_ErrorReporting/WerArchive_1 +
    +
    + ADMX_ErrorReporting/WerArchive_2 +
    +
    + ADMX_ErrorReporting/WerAutoApproveOSDumps_1 +
    +
    + ADMX_ErrorReporting/WerAutoApproveOSDumps_2 +
    +
    + ADMX_ErrorReporting/WerBypassDataThrottling_1 +
    +
    + ADMX_ErrorReporting/WerBypassDataThrottling_2 +
    +
    + ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1 +
    +
    + ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2 +
    +
    + ADMX_ErrorReporting/WerBypassPowerThrottling_1 +
    +
    + ADMX_ErrorReporting/WerBypassPowerThrottling_2 +
    +
    + ADMX_ErrorReporting/WerCER +
    +
    + ADMX_ErrorReporting/WerConsentCustomize_1 +
    +
    + ADMX_ErrorReporting/WerConsentOverride_1 +
    +
    + ADMX_ErrorReporting/WerConsentOverride_2 +
    +
    + ADMX_ErrorReporting/WerDefaultConsent_1 +
    +
    + ADMX_ErrorReporting/WerDefaultConsent_2 +
    +
    + ADMX_ErrorReporting/WerDisable_1 +
    +
    + ADMX_ErrorReporting/WerExlusion_1 +
    +
    + ADMX_ErrorReporting/WerExlusion_2 +
    +
    + ADMX_ErrorReporting/WerNoLogging_1 +
    +
    + ADMX_ErrorReporting/WerNoLogging_2 +
    +
    + ADMX_ErrorReporting/WerNoSecondLevelData_1 +
    +
    + ADMX_ErrorReporting/WerQueue_1 +
    +
    + ADMX_ErrorReporting/WerQueue_2 +
    +
    + + +
    + + +**ADMX_ErrorReporting/PCH_AllOrNoneDef** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether errors in general applications are included in reports when Windows Error Reporting is enabled. + +If you enable this policy setting, you can instruct Windows Error Reporting in the Default pull-down menu to report either all application errors (the default setting), or no application errors. + +If the Report all errors in Microsoft applications check box is filled, all errors in Microsoft applications are reported, regardless of the setting in the Default pull-down menu. When the Report all errors in Windows check box is filled, all errors in Windows applications are reported, regardless of the setting in the Default dropdown list. The Windows applications category is a subset of Microsoft applications. + +If you disable or do not configure this policy setting, users can enable or disable Windows Error Reporting in Control Panel. The default setting in Control Panel is Upload all applications. + +This policy setting is ignored if the Configure Error Reporting policy setting is disabled or not configured. + +For related information, see the Configure Error Reporting and Report Operating System Errors policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default application reporting settings* +- GP name: *PCH_AllOrNoneDef* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/PCH_AllOrNoneEx** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors. + +If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. If an application is listed both in the List of applications to always report errors for policy setting, and in the exclusion list in this policy setting, the application is excluded from error reporting. You can also use the exclusion list in this policy setting to exclude specific Microsoft applications or parts of Windows if the check boxes for these categories are filled in the Default application reporting settings policy setting. + +If you disable or do not configure this policy setting, the Default application reporting settings policy setting takes precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to never report errors for* +- GP name: *PCH_AllOrNoneEx* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/PCH_AllOrNoneInc** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies applications for which Windows Error Reporting should always report errors. + +To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors. + +If you enable this policy setting, you can create a list of applications that are always included in error reporting. To add applications to the list, click Show under the Report errors for applications on this list setting, and edit the list of application file names in the Show Contents dialog box. The file names must include the .exe file name extension (for example, notepad.exe). Errors that are generated by applications on this list are always reported, even if the Default dropdown in the Default application reporting policy setting is set to report no application errors. + +If the Report all errors in Microsoft applications or Report all errors in Windows components check boxes in the Default Application Reporting policy setting are filled, Windows Error Reporting reports errors as if all applications in these categories were added to the list in this policy setting. (Note: The Microsoft applications category includes the Windows components category.) + +If you disable this policy setting or do not configure it, the Default application reporting settings policy setting takes precedence. + +Also see the "Default Application Reporting" and "Application Exclusion List" policies. + +This setting will be ignored if the 'Configure Error Reporting' setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to always report errors for* +- GP name: *PCH_AllOrNoneInc* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/PCH_ConfigureReport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures how errors are reported to Microsoft, and what information is sent when Windows Error Reporting is enabled. + +This policy setting does not enable or disable Windows Error Reporting. To turn Windows Error Reporting on or off, see the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings. + +> [!IMPORTANT] +> If the Turn off Windows Error Reporting policy setting is not configured, then Control Panel settings for Windows Error Reporting override this policy setting. + +If you enable this policy setting, the setting overrides any user changes made to Windows Error Reporting settings in Control Panel, and default values are applied for any Windows Error Reporting policy settings that are not configured (even if users have changed settings by using Control Panel). If you enable this policy setting, you can configure the following settings in the policy setting: + +- "Do not display links to any Microsoft ‘More information’ websites": Select this option if you do not want error dialog boxes to display links to Microsoft websites. + +- "Do not collect additional files": Select this option if you do not want additional files to be collected and included in error reports. + +- "Do not collect additional computer data": Select this if you do not want additional information about the computer to be collected and included in error reports. + +- "Force queue mode for application errors": Select this option if you do not want users to report errors. When this option is selected, errors are stored in a queue directory, and the next administrator to log on to the computer can send the error reports to Microsoft. + +- "Corporate file path": Type a UNC path to enable Corporate Error Reporting. All errors are stored at the specified location instead of being sent directly to Microsoft, and the next administrator to log onto the computer can send the error reports to Microsoft. + +- "Replace instances of the word ‘Microsoft’ with": You can specify text with which to customize your error report dialog boxes. The word ""Microsoft"" is replaced with the specified text. + +If you do not configure this policy setting, users can change Windows Error Reporting settings in Control Panel. By default, these settings are Enable Reporting on computers that are running Windows XP, and Report to Queue on computers that are running Windows Server 2003. + +If you disable this policy setting, configuration settings in the policy setting are left blank. + +See related policy settings Display Error Notification (same folder as this policy setting), and Turn off Windows Error Reporting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Error Reporting* +- GP name: *PCH_ConfigureReport* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether errors in the operating system are included Windows Error Reporting is enabled. + +If you enable this policy setting, Windows Error Reporting includes operating system errors. + +If you disable this policy setting, operating system errors are not included in error reports. + +If you do not configure this policy setting, users can change this setting in Control Panel. By default, Windows Error Reporting settings in Control Panel are set to upload operating system errors. + +See also the Configure Error Reporting policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Report operating system errors* +- GP name: *PCH_ReportOperatingSystemFaults* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerArchive_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the behavior of the Windows Error Reporting archive. + +If you enable this policy setting, you can configure Windows Error Reporting archiving behavior. If Archive behavior is set to Store all, all data collected for each error report is stored in the appropriate location. If Archive behavior is set to Store parameters only, only the minimum information required to check for an existing solution is stored. The Maximum number of reports to store setting determines how many reports are stored before older reports are automatically deleted. + +If you disable or do not configure this policy setting, no Windows Error Reporting information is stored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Archive* +- GP name: *WerArchive_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerArchive_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the behavior of the Windows Error Reporting archive. + +If you enable this policy setting, you can configure Windows Error Reporting archiving behavior. If Archive behavior is set to Store all, all data collected for each error report is stored in the appropriate location. If Archive behavior is set to Store parameters only, only the minimum information required to check for an existing solution is stored. The Maximum number of reports to store setting determines how many reports are stored before older reports are automatically deleted. + +If you disable or do not configure this policy setting, no Windows Error Reporting information is stored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Archive* +- GP name: *WerArchive_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerAutoApproveOSDumps_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether memory dumps in support of OS-generated error reports can be sent to Microsoft automatically. This policy does not apply to error reports generated by 3rd-party products, or additional data other than memory dumps. + +If you enable or do not configure this policy setting, any memory dumps generated for error reports by Microsoft Windows are automatically uploaded, without notification to the user. + +If you disable this policy setting, then all memory dumps are uploaded according to the default consent and notification settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatically send memory dumps for OS-generated error reports* +- GP name: *WerAutoApproveOSDumps_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerAutoApproveOSDumps_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether memory dumps in support of OS-generated error reports can be sent to Microsoft automatically. This policy does not apply to error reports generated by 3rd-party products, or additional data other than memory dumps. + +If you enable or do not configure this policy setting, any memory dumps generated for error reports by Microsoft Windows are automatically uploaded, without notification to the user. + +If you disable this policy setting, then all memory dumps are uploaded according to the default consent and notification settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatically send memory dumps for OS-generated error reports* +- GP name: *WerAutoApproveOSDumps_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerBypassDataThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) sends additional, second-level report data even if a CAB file containing data about the same event types has already been uploaded to the server. + +If you enable this policy setting, WER does not throttle data; that is, WER uploads additional CAB files that can contain data about the same event types as an earlier uploaded report. + +If you disable or do not configure this policy setting, WER throttles data by default; that is, WER does not upload more than one CAB file for a report that contains data about the same event types. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not throttle additional data* +- GP name: *WerBypassDataThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerBypassDataThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) sends additional, second-level report data even if a CAB file containing data about the same event types has already been uploaded to the server. + +If you enable this policy setting, WER does not throttle data; that is, WER uploads additional CAB files that can contain data about the same event types as an earlier uploaded report. + +If you disable or do not configure this policy setting, WER throttles data by default; that is, WER does not upload more than one CAB file for a report that contains data about the same event types. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not throttle additional data* +- GP name: *WerBypassDataThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks for a network cost policy that restricts the amount of data that is sent over the network. + +If you enable this policy setting, WER does not check for network cost policy restrictions, and transmits data even if network cost is restricted. + +If you disable or do not configure this policy setting, WER does not send data, but will check the network cost policy again if the network profile is changed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send data when on connected to a restricted/costed network* +- GP name: *WerBypassNetworkCostThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks for a network cost policy that restricts the amount of data that is sent over the network. + +If you enable this policy setting, WER does not check for network cost policy restrictions, and transmits data even if network cost is restricted. + +If you disable or do not configure this policy setting, WER does not send data, but will check the network cost policy again if the network profile is changed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send data when on connected to a restricted/costed network* +- GP name: *WerBypassNetworkCostThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerBypassPowerThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks if the computer is running on battery power. By default, when a computer is running on battery power, WER only checks for solutions, but does not upload additional report data until the computer is connected to a more permanent power source. + +If you enable this policy setting, WER does not determine whether the computer is running on battery power, but checks for solutions and uploads report data normally. + +If you disable or do not configure this policy setting, WER checks for solutions while a computer is running on battery power, but does not upload report data until the computer is connected to a more permanent power source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send additional data when on battery power* +- GP name: *WerBypassPowerThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerBypassPowerThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks if the computer is running on battery power. By default, when a computer is running on battery power, WER only checks for solutions, but does not upload additional report data until the computer is connected to a more permanent power source. + +If you enable this policy setting, WER does not determine whether the computer is running on battery power, but checks for solutions and uploads report data normally. + +If you disable or do not configure this policy setting, WER checks for solutions while a computer is running on battery power, but does not upload report data until the computer is connected to a more permanent power source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send additional data when on battery power* +- GP name: *WerBypassPowerThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerCER** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a corporate server to which Windows Error Reporting sends reports (if you do not want to send error reports to Microsoft). + +If you enable this policy setting, you can specify the name or IP address of an error report destination server on your organization’s network. You can also select Connect using SSL to transmit error reports over a Secure Sockets Layer (SSL) connection, and specify a port number on the destination server for transmission. + +If you disable or do not configure this policy setting, Windows Error Reporting sends error reports to Microsoft. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Corporate Windows Error Reporting* +- GP name: *WerCER* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerConsentCustomize_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the consent behavior of Windows Error Reporting for specific event types. + +If you enable this policy setting, you can add specific event types to a list by clicking Show, and typing event types in the Value Name column of the Show Contents dialog box. Event types are those for generic, non-fatal errors: crash, no response, and kernel fault errors. For each specified event type, you can set a consent level of 0, 1, 2, 3, or 4. + +- 0 (Disable): Windows Error Reporting sends no data to Microsoft for this event type. + +- 1 (Always ask before sending data): Windows prompts the user for consent to send reports. + +- 2 (Send parameters): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, and Windows prompts the user for consent to send any additional data requested by Microsoft. + +- 3 (Send parameters and safe additional data): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, as well as data which Windows has determined (within a high probability) does not contain personally identifiable data, and prompts the user for consent to send any additional data requested by Microsoft. + +- 4 (Send all data): Any data requested by Microsoft is sent automatically. + +If you disable or do not configure this policy setting, then the default consent settings that are applied are those specified by the user in Control Panel, or in the Configure Default Consent policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Customize consent settings* +- GP name: *WerConsentCustomize_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerConsentOverride_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Configure Default Consent setting in relation to custom consent settings. + +If you enable this policy setting, the default consent levels of Windows Error Reporting always override any other consent policy setting. + +If you disable or do not configure this policy setting, custom consent policy settings for error reporting determine the consent level for specified event types, and the default consent setting determines only the consent level of any other error reports. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore custom consent settings* +- GP name: *WerConsentOverride_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerConsentOverride_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Configure Default Consent setting in relation to custom consent settings. + +If you enable this policy setting, the default consent levels of Windows Error Reporting always override any other consent policy setting. + +If you disable or do not configure this policy setting, custom consent policy settings for error reporting determine the consent level for specified event types, and the default consent setting determines only the consent level of any other error reports. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore custom consent settings* +- GP name: *WerConsentOverride_2* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerDefaultConsent_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the default consent behavior of Windows Error Reporting. + +If you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting: + +- Always ask before sending data: Windows prompts users for consent to send reports. + +- Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft. + +- Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft. + +- Send all data: any error reporting data requested by Microsoft is sent automatically. + +If this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Default consent* +- GP name: *WerDefaultConsent_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerDefaultConsent_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the default consent behavior of Windows Error Reporting. + +If you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting: + +- Always ask before sending data: Windows prompts users for consent to send reports. + +- Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft. + +- Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft. + +- Send all data: any error reporting data requested by Microsoft is sent automatically. + +If this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Default consent* +- GP name: *WerDefaultConsent_2* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerDisable_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails. + +If you enable this policy setting, Windows Error Reporting does not send any problem information to Microsoft. Additionally, solution information is not available in Security and Maintenance in Control Panel. + +If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Windows Error Reporting* +- GP name: *WerDisable_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerExlusion_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. + +If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to be excluded* +- GP name: *WerExlusion_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerExlusion_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. + +If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to be excluded* +- GP name: *WerExlusion_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerNoLogging_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows Error Reporting saves its own events and error messages to the system event log. + +If you enable this policy setting, Windows Error Reporting events are not recorded in the system event log. + +If you disable or do not configure this policy setting, Windows Error Reporting events and errors are logged to the system event log, as with other Windows-based programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable logging* +- GP name: *WerNoLogging_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerNoLogging_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows Error Reporting saves its own events and error messages to the system event log. + +If you enable this policy setting, Windows Error Reporting events are not recorded in the system event log. + +If you disable or do not configure this policy setting, Windows Error Reporting events and errors are logged to the system event log, as with other Windows-based programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable logging* +- GP name: *WerNoLogging_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerNoSecondLevelData_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether additional data in support of error reports can be sent to Microsoft automatically. + +If you enable this policy setting, any additional data requests from Microsoft in response to a Windows Error Reporting report are automatically declined, without notification to the user. + +If you disable or do not configure this policy setting, then consent policy settings in Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting/Consent take precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not send additional data* +- GP name: *WerNoSecondLevelData_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerQueue_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Windows Error Reporting report queue. + +If you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel. + +The Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder. + +If you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Queue* +- GP name: *WerQueue_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + + +**ADMX_ErrorReporting/WerQueue_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Windows Error Reporting report queue. + +If you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel. If Queuing behavior is set to Always queue for administrator, reports are queued until an administrator is prompted to send them, or until the administrator sends them by using the Solutions to Problems page in Control Panel. + +The Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder. + +If you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Queue* +- GP name: *WerQueue_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md new file mode 100644 index 0000000000..449bed0b21 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md @@ -0,0 +1,201 @@ +--- +title: Policy CSP - ADMX_EventForwarding +description: Policy CSP - ADMX_EventForwarding +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EventForwarding + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_EventForwarding policies + +
    +
    + ADMX_EventForwarding/ForwarderResourceUsage +
    +
    + ADMX_EventForwarding/SubscriptionManager +
    +
    + + +
    + + +**ADMX_EventForwarding/ForwarderResourceUsage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls resource usage for the forwarder (source computer) by controlling the events/per second sent to the Event Collector. + +If you enable this policy setting, you can control the volume of events sent to the Event Collector by the source computer. This may be required in high volume environments. + +If you disable or do not configure this policy setting, forwarder resource usage is not specified. + +This setting applies across all subscriptions for the forwarder (source computer). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure forwarder resource usage* +- GP name: *ForwarderResourceUsage* +- GP path: *Windows Components/Event Forwarding* +- GP ADMX file name: *EventForwarding.admx* + + + +
    + +
    + + +**ADMX_EventForwarding/SubscriptionManager** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the server address, refresh interval, and issuer certificate authority (CA) of a target Subscription Manager. + +If you enable this policy setting, you can configure the Source Computer to contact a specific FQDN (Fully Qualified Domain Name) or IP Address and request subscription specifics. + +Use the following syntax when using the HTTPS protocol: + +``` syntax + +Server=https://:5986/wsman/SubscriptionManager/WEC,Refresh=,IssuerCA=. +``` + +When using the HTTP protocol, use port 5985. + +If you disable or do not configure this policy setting, the Event Collector computer will not be specified. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure target Subscription Manager* +- GP name: *SubscriptionManager* +- GP path: *Windows Components/Event Forwarding* +- GP ADMX file name: *EventForwarding.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md new file mode 100644 index 0000000000..ea4b084c38 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -0,0 +1,1589 @@ +--- +title: Policy CSP - ADMX_EventLog +description: Policy CSP - ADMX_EventLog +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EventLog +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_EventLog policies + +
    +
    + ADMX_EventLog/Channel_LogEnabled +
    +
    + ADMX_EventLog/Channel_LogFilePath_1 +
    +
    + ADMX_EventLog/Channel_LogFilePath_2 +
    +
    + ADMX_EventLog/Channel_LogFilePath_3 +
    +
    + ADMX_EventLog/Channel_LogFilePath_4 +
    +
    + ADMX_EventLog/Channel_LogMaxSize_3 +
    +
    + ADMX_EventLog/Channel_Log_AutoBackup_1 +
    +
    + ADMX_EventLog/Channel_Log_AutoBackup_2 +
    +
    + ADMX_EventLog/Channel_Log_AutoBackup_3 +
    +
    + ADMX_EventLog/Channel_Log_AutoBackup_4 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_1 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_2 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_3 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_4 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_5 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_6 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_7 +
    +
    + ADMX_EventLog/Channel_Log_FileLogAccess_8 +
    +
    + ADMX_EventLog/Channel_Log_Retention_2 +
    +
    + ADMX_EventLog/Channel_Log_Retention_3 +
    +
    + ADMX_EventLog/Channel_Log_Retention_4 +
    +
    + + +
    + + +**ADMX_EventLog/Channel_LogEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns on logging. + +If you enable or do not configure this policy setting, then events can be written to this log. + +If the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on logging* +- GP name: *Channel_LogEnabled* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_LogFilePath_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_LogFilePath_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_LogFilePath_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_LogFilePath_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on logging* +- GP name: *Channel_LogFilePath_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_LogMaxSize_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the maximum size of the log file in kilobytes. + +If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments. + +If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum log file size (KB)* +- GP name: *Channel_LogMaxSize_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_AutoBackup_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_AutoBackup_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_AutoBackup_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_AutoBackup_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_FileLogAccess_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_FileLogAccess_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log. + +If you disable or do not configure this policy setting, only system software and administrators can read or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_FileLogAccess_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_FileLogAccess_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only users whose security descriptor matches the configured value can access the log. + +If you disable or do not configure this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_FileLogAccess_5** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable this policy setting, all authenticated users and system services can write, read, or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_5* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_FileLogAccess_6** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log. + +If you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log. + +If you disable this policy setting, only system software and administrators can read or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_6* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_FileLogAccess_7** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable this policy setting, all authenticated users and system services can write, read, or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_7* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_FileLogAccess_8** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only users whose security descriptor matches the configured value can access the log. + +If you disable this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_8* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_Retention_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_Retention_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
    + + +**ADMX_EventLog/Channel_Log_Retention_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md new file mode 100644 index 0000000000..da74235b97 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -0,0 +1,400 @@ +--- +title: Policy CSP - ADMX_Explorer +description: Policy CSP - ADMX_Explorer +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Explorer +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Explorer policies + +
    +
    + ADMX_Explorer/AdminInfoUrl +
    +
    + ADMX_Explorer/AlwaysShowClassicMenu +
    +
    + ADMX_Explorer/DisableRoamedProfileInit +
    +
    + ADMX_Explorer/PreventItemCreationInUsersFilesFolder +
    +
    + ADMX_Explorer/TurnOffSPIAnimations +
    +
    + + +
    + + +**ADMX_Explorer/AdminInfoUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Sets the target of the More Information link that will be displayed when the user attempts to run a program that is blocked by policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set a support web page link* +- GP name: *AdminInfoUrl* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + + +**ADMX_Explorer/AlwaysShowClassicMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures File Explorer to always display the menu bar. + +> [!NOTE] +> By default, the menu bar is not displayed in File Explorer. + +If you enable this policy setting, the menu bar will be displayed in File Explorer. + +If you disable or do not configure this policy setting, the menu bar will not be displayed in File Explorer. + +> [!NOTE] +> When the menu bar is not displayed, users can access the menu bar by pressing the 'ALT' key. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display the menu bar in File Explorer* +- GP name: *AlwaysShowClassicMenu* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + + +**ADMX_Explorer/DisableRoamedProfileInit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows administrators who have configured roaming profile in conjunction with Delete Cached Roaming Profile Group Policy setting to ensure that Explorer will not reinitialize default program associations and other settings to default values. + +If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not reinitialize a pre-existing roamed user profile when it is loaded on a machine for the first time* +- GP name: *DisableRoamedProfileInit* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + + +**ADMX_Explorer/PreventItemCreationInUsersFilesFolder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows administrators to prevent users from adding new items such as files or folders to the root of their Users Files folder in File Explorer. + +If you enable this policy setting, users will no longer be able to add new items such as files or folders to the root of their Users Files folder in File Explorer. + +If you disable or do not configure this policy setting, users will be able to add new items such as files or folders to the root of their Users Files folder in File Explorer. + +> [!NOTE] +> Enabling this policy setting does not prevent the user from being able to add new items such as files and folders to their actual file system profile folder at %userprofile%. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from adding files to the root of their Users Files folder.* +- GP name: *PreventItemCreationInUsersFilesFolder* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + + +**ADMX_Explorer/TurnOffSPIAnimations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy is similar to settings directly available to computer users. Disabling animations can improve usability for users with some visual disabilities as well as improving performance and battery life in some scenarios. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off common control and window animations* +- GP name: *TurnOffSPIAnimations* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md new file mode 100644 index 0000000000..a1b52fa8fd --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md @@ -0,0 +1,118 @@ +--- +title: Policy CSP - ADMX_FileServerVSSProvider +description: Policy CSP - ADMX_FileServerVSSProvider +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_FileServerVSSProvider +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_FileServerVSSProvider policies + +
    +
    + ADMX_FileServerVSSProvider/Pol_EncryptProtocol +
    +
    + + +
    + + +**ADMX_FileServerVSSProvider/Pol_EncryptProtocol** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the RPC protocol messages used by VSS for SMB2 File Shares feature is enabled. + +VSS for SMB2 File Shares feature enables VSS aware backup applications to perform application consistent backup and restore of VSS aware applications storing data on SMB2 File Shares. + +By default, the RPC protocol message between File Server VSS provider and File Server VSS Agent is signed but not encrypted. + +> [!NOTE] +> To make changes to this setting effective, you must restart Volume Shadow Copy (VSS) Service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.* +- GP name: *Pol_EncryptProtocol* +- GP path: *System/File Share Shadow Copy Provider* +- GP ADMX file name: *FileServerVSSProvider.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md new file mode 100644 index 0000000000..768b9ea68d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -0,0 +1,589 @@ +--- +title: Policy CSP - ADMX_FileSys +description: Policy CSP - ADMX_FileSys +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_FileSys +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_FileSys policies + +
    +
    + ADMX_FileSys/DisableCompression +
    +
    + ADMX_FileSys/DisableDeleteNotification +
    +
    + ADMX_FileSys/DisableEncryption +
    +
    + ADMX_FileSys/EnablePagefileEncryption +
    +
    + ADMX_FileSys/LongPathsEnabled +
    +
    + ADMX_FileSys/ShortNameCreationSettings +
    +
    + ADMX_FileSys/SymlinkEvaluation +
    +
    + ADMX_FileSys/TxfDeprecatedFunctionality +
    +
    + + +
    + + +**ADMX_FileSys/DisableCompression** + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Compression can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of compressed files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow compression on all NTFS volumes* +- GP name: *DisableCompression* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
    + + +**ADMX_FileSys/DisableDeleteNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Delete notification is a feature that notifies the underlying storage device of clusters that are freed due to a file delete operation. + +A value of 0, the default, will enable delete notifications for all volumes. + +A value of 1 will disable delete notifications for all volumes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable delete notifications on all volumes* +- GP name: *DisableDeleteNotification* +- GP path: *System/Filesystem* +- GP ADMX file name: *FileSys.admx* + + + +
    + + +**ADMX_FileSys/DisableEncryption** + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Encryption can add to the processing overhead of filesystem operations. Enabling this setting will prevent access to and creation of encrypted files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow encryption on all NTFS volumes* +- GP name: *DisableEncryption* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
    + + +**ADMX_FileSys/EnablePagefileEncryption** + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Encrypting the page file prevents malicious users from reading data that has been paged to disk, but also adds processing overhead for filesystem operations. Enabling this setting will cause the page files to be encrypted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable NTFS pagefile encryption* +- GP name: *EnablePagefileEncryption* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
    + + +**ADMX_FileSys/LongPathsEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enabling Win32 long paths will allow manifested win32 applications and Windows Store applications to access paths beyond the normal 260 character limit per node on file systems that support it. Enabling this setting will cause the long paths to be accessible within the process. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Win32 long paths* +- GP name: *LongPathsEnabled* +- GP path: *System/Filesystem* +- GP ADMX file name: *FileSys.admx* + + + +
    + + +**ADMX_FileSys/ShortNameCreationSettings** + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting provides control over whether or not short names are generated during file creation. Some applications require short names for compatibility, but short names have a negative performance impact on the system. + +If you enable short names on all volumes then short names will always be generated. If you disable them on all volumes then they will never be generated. If you set short name creation to be configurable on a per volume basis then an on-disk flag will determine whether or not short names are created on a given volume. If you disable short name creation on all data volumes then short names will only be generated for files created on the system volume. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Short name creation options* +- GP name: *ShortNameCreationSettings* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
    + + +**ADMX_FileSys/SymlinkEvaluation** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Symbolic links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disable the evaluation of these types of symbolic links: + +- Local Link to a Local Target +- Local Link to a Remote Target +- Remote Link to Remote Target +- Remote Link to Local Target + +For more information, refer to the Windows Help section. + +> [!NOTE] +> If this policy is disabled or not configured, local administrators may select the types of symbolic links to be evaluated. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Selectively allow the evaluation of a symbolic link* +- GP name: *SymlinkEvaluation* +- GP path: *System/Filesystem* +- GP ADMX file name: *FileSys.admx* + + + +
    + + +**ADMX_FileSys/TxfDeprecatedFunctionality** + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. TXF deprecated features included savepoints, secondary RM, miniversion and roll forward. Enable it if you want to use the APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable / disable TXF deprecated features* +- GP name: *TxfDeprecatedFunctionality* +- GP path: *System/Filesystem/NTFS* +- GP ADMX file name: *FileSys.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md new file mode 100644 index 0000000000..c1b7ee3ab0 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -0,0 +1,571 @@ +--- +title: Policy CSP - ADMX_FolderRedirection +description: Policy CSP - ADMX_FolderRedirection +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_FolderRedirection +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_FolderRedirection policies + +
    +
    + ADMX_FolderRedirection/DisableFRAdminPin +
    +
    + ADMX_FolderRedirection/DisableFRAdminPinByFolder +
    +
    + ADMX_FolderRedirection/FolderRedirectionEnableCacheRename +
    +
    + ADMX_FolderRedirection/LocalizeXPRelativePaths_1 +
    +
    + ADMX_FolderRedirection/LocalizeXPRelativePaths_2 +
    +
    + ADMX_FolderRedirection/PrimaryComputer_FR_1 +
    +
    + ADMX_FolderRedirection/PrimaryComputer_FR_2 +
    +
    + + +
    + + +**ADMX_FolderRedirection/DisableFRAdminPin** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether all redirected shell folders, such as Contacts, Documents, Desktop, Favorites, Music, Pictures, Videos, Start Menu, and AppData\Roaming, are available offline by default. + +If you enable this policy setting, users must manually select the files they wish to make available offline. + +If you disable or do not configure this policy setting, redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline. + +> [!NOTE] +> This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface. +> +> Do not enable this policy setting if users will need access to their redirected files if the network or server holding the redirected files becomes unavailable. +> +> If one or more valid folder GUIDs are specified in the policy setting "Do not automatically make specific redirected folders available offline", that setting will override the configured value of "Do not automatically make all redirected folders available offline". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not automatically make all redirected folders available offline* +- GP name: *DisableFRAdminPin* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
    + + +**ADMX_FolderRedirection/DisableFRAdminPinByFolder** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether individual redirected shell folders are available offline by default. + +For the folders affected by this setting, users must manually select the files they wish to make available offline. + +If you disable or do not configure this policy setting, all redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline. + +> [!NOTE] +> This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Always available offline" menu option in the user interface. +> +> The configuration of this policy for any folder will override the configured value of "Do not automatically make all redirected folders available offline". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not automatically make specific redirected folders available offline* +- GP name: *DisableFRAdminPinByFolder* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
    + + +**ADMX_FolderRedirection/FolderRedirectionEnableCacheRename** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the contents of redirected folders is copied from the old location to the new location or simply renamed in the Offline Files cache when a folder is redirected to a new location. + +If you enable this policy setting, when the path to a redirected folder is changed from one network location to another and Folder Redirection is configured to move the content to the new location, instead of copying the content to the new location, the cached content is renamed in the local cache and not copied to the new location. To use this policy setting, you must move or restore the server content to the new network location using a method that preserves the state of the files, including their timestamps, before updating the Folder Redirection location. + +If you disable or do not configure this policy setting, when the path to a redirected folder is changed and Folder Redirection is configured to move the content to the new location, Windows copies the contents of the local cache to the new network location, then deleted the content from the old network location. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable optimized move of contents in Offline Files cache on Folder Redirection server path change* +- GP name: *FolderRedirectionEnableCacheRename* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
    + + +**ADMX_FolderRedirection/LocalizeXPRelativePaths_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively. + +If you enable this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use localized folder names for these subfolders when redirecting the Start Menu or legacy My Documents folder. + +If you disable or not configure this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use the standard English names for these subfolders when redirecting the Start Menu or legacy My Documents folder. + +> [!NOTE] +> This policy is valid only on Windows Vista, Windows 7, Windows 8, and Windows Server 2012 when it processes a legacy redirection policy already deployed for these folders in your existing localized environment. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use localized subfolder names when redirecting Start Menu and My Documents* +- GP name: *LocalizeXPRelativePaths_1* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
    + + +**ADMX_FolderRedirection/LocalizeXPRelativePaths_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent Start Menu and legacy My Documents folder respectively. + +If you enable this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use localized folder names for these subfolders when redirecting the Start Menu or legacy My Documents folder. + +If you disable or not configure this policy setting, Windows Vista, Windows 7, Windows 8, and Windows Server 2012 will use the standard English names for these subfolders when redirecting the Start Menu or legacy My Documents folder. + +> [!NOTE] +> This policy is valid only on Windows Vista, Windows 7, Windows 8, and Windows Server 2012 when it processes a legacy redirection policy already deployed for these folders in your existing localized environment. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use localized subfolder names when redirecting Start Menu and My Documents* +- GP name: *LocalizeXPRelativePaths_2* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
    + + +**ADMX_FolderRedirection/PrimaryComputer_FR_1** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether folders are redirected on a user's primary computers only. This policy setting is useful to improve logon performance and to increase security for user data on computers where the user might not want to download private data, such as on a meeting room computer or on a computer in a remote office. + +To designate a user's primary computers, an administrator must use management software or a script to add primary computer attributes to the user's account in Active Directory Domain Services (AD DS). This policy setting also requires the Windows Server 2012 version of the Active Directory schema to function. + +If you enable this policy setting and the user has redirected folders, such as the Documents and Pictures folders, the folders are redirected on the user's primary computer only. + +If you disable or do not configure this policy setting and the user has redirected folders, the folders are redirected on every computer that the user logs on to. + +> [!NOTE] +> If you enable this policy setting in Computer Configuration and User Configuration, the Computer Configuration policy setting takes precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Redirect folders on primary computers only* +- GP name: *PrimaryComputer_FR_1* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
    + + +**ADMX_FolderRedirection/PrimaryComputer_FR_2** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether folders are redirected on a user's primary computers only. This policy setting is useful to improve logon performance and to increase security for user data on computers where the user might not want to download private data, such as on a meeting room computer or on a computer in a remote office. + +To designate a user's primary computers, an administrator must use management software or a script to add primary computer attributes to the user's account in Active Directory Domain Services (AD DS). This policy setting also requires the Windows Server 2012 version of the Active Directory schema to function. + +If you enable this policy setting and the user has redirected folders, such as the Documents and Pictures folders, the folders are redirected on the user's primary computer only. + +If you disable or do not configure this policy setting and the user has redirected folders, the folders are redirected on every computer that the user logs on to. + +> [!NOTE] +> If you enable this policy setting in Computer Configuration and User Configuration, the Computer Configuration policy setting takes precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Redirect folders on primary computers only* +- GP name: *PrimaryComputer_FR_2* +- GP path: *System/Folder Redirection* +- GP ADMX file name: *FolderRedirection.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-globalization.md b/windows/client-management/mdm/policy-csp-admx-globalization.md new file mode 100644 index 0000000000..4a4c00cd36 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-globalization.md @@ -0,0 +1,1897 @@ +--- +title: Policy CSP - ADMX_Globalization +description: Policy CSP - ADMX_Globalization +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Globalization +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Globalization policies + +
    +
    + ADMX_Globalization/BlockUserInputMethodsForSignIn +
    +
    + ADMX_Globalization/CustomLocalesNoSelect_1 +
    +
    + ADMX_Globalization/CustomLocalesNoSelect_2 +
    +
    + ADMX_Globalization/HideAdminOptions +
    +
    + ADMX_Globalization/HideCurrentLocation +
    +
    + ADMX_Globalization/HideLanguageSelection +
    +
    + ADMX_Globalization/HideLocaleSelectAndCustomize +
    +
    + ADMX_Globalization/ImplicitDataCollectionOff_1 +
    +
    + ADMX_Globalization/ImplicitDataCollectionOff_2 +
    +
    + ADMX_Globalization/LocaleSystemRestrict +
    +
    + ADMX_Globalization/LocaleUserRestrict_1 +
    +
    + ADMX_Globalization/LocaleUserRestrict_2 +
    +
    + ADMX_Globalization/LockMachineUILanguage +
    +
    + ADMX_Globalization/LockUserUILanguage +
    +
    + ADMX_Globalization/PreventGeoIdChange_1 +
    +
    + ADMX_Globalization/PreventGeoIdChange_2 +
    +
    + ADMX_Globalization/PreventUserOverrides_1 +
    +
    + ADMX_Globalization/PreventUserOverrides_2 +
    +
    + ADMX_Globalization/RestrictUILangSelect +
    +
    + ADMX_Globalization/TurnOffAutocorrectMisspelledWords +
    +
    + ADMX_Globalization/TurnOffHighlightMisspelledWords +
    +
    + ADMX_Globalization/TurnOffInsertSpace +
    +
    + ADMX_Globalization/TurnOffOfferTextPredictions +
    +
    + ADMX_Globalization/Y2K +
    +
    + + +
    + + +**ADMX_Globalization/BlockUserInputMethodsForSignIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy prevents automatic copying of user input methods to the system account for use on the sign-in screen. The user is restricted to the set of input methods that are enabled in the system account. + +Note this does not affect the availability of user input methods on the lock screen or with the UAC prompt. + +If the policy is Enabled, then the user will get input methods enabled for the system account on the sign-in page. + +If the policy is Disabled or Not Configured, then the user will be able to use input methods enabled for their user account on the sign-in page. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow copying of user input methods to the system account for sign-in* +- GP name: *BlockUserInputMethodsForSignIn* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/CustomLocalesNoSelect_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system. + +This does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locales by unauthorized users. + +The policy setting "Restrict user locales" can also be enabled to disallow selection of a custom locale, even if this policy setting is not configured. + +If you enable this policy setting, the user cannot select a custom locale as their user locale, but they can still select a replacement locale if one is installed. + +If you disable or do not configure this policy setting, the user can select a custom locale as their user locale. + +If this policy setting is enabled at the machine level, it cannot be disabled by a per-user policy setting. If this policy setting is disabled at the machine level, the per-user policy setting will be ignored. If this policy setting is not configured at the machine level, restrictions will be based on per-user policy settings. + +To set this policy setting on a per-user basis, make sure that you do not configure the per-machine policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow selection of Custom Locales* +- GP name: *CustomLocalesNoSelect_1* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/CustomLocalesNoSelect_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system. + +This does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locales by unauthorized users. + +The policy setting "Restrict user locales" can also be enabled to disallow selection of a custom locale, even if this policy setting is not configured. + +If you enable this policy setting, the user cannot select a custom locale as their user locale, but they can still select a replacement locale if one is installed. + +If you disable or do not configure this policy setting, the user can select a custom locale as their user locale. + +If this policy setting is enabled at the machine level, it cannot be disabled by a per-user policy setting. If this policy setting is disabled at the machine level, the per-user policy setting will be ignored. If this policy setting is not configured at the machine level, restrictions will be based on per-user policy settings. + +To set this policy setting on a per-user basis, make sure that you do not configure the per-machine policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow selection of Custom Locales* +- GP name: *CustomLocalesNoSelect_2* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/HideAdminOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the Administrative options from the Region settings control panel. + +Administrative options include interfaces for setting system locale and copying settings to the default user. This policy setting does not, however, prevent an administrator or another application from changing these values programmatically. + +This policy setting is used only to simplify the Regional Options control panel. + +If you enable this policy setting, the user cannot see the Administrative options. + +If you disable or do not configure this policy setting, the user can see the Administrative options. + +> [!NOTE] +> Even if a user can see the Administrative options, other policies may prevent them from modifying the values. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Regional and Language Options administrative options* +- GP name: *HideAdminOptions* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/HideCurrentLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the option to change the user's geographical location (GeoID) from the Region settings control panel. + +This policy setting is used only to simplify the Regional Options control panel. + +If you enable this policy setting, the user does not see the option to change the GeoID. This does not prevent the user or an application from changing the GeoID programmatically. + +If you disable or do not configure this policy setting, the user sees the option for changing the user location (GeoID). + +> [!NOTE] +> Even if a user can see the GeoID option, the "Disallow changing of geographical location" option can prevent them from actually changing their current geographical location. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the geographic location option* +- GP name: *HideCurrentLocation* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/HideLanguageSelection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the option to change the user's menus and dialogs (UI) language from the Language and Regional Options control panel. + +This policy setting is used only to simplify the Regional Options control panel. + +If you enable this policy setting, the user does not see the option for changing the UI language. This does not prevent the user or an application from changing the UI language programmatically. If you disable or do not configure this policy setting, the user sees the option for changing the UI language. + +> [!NOTE] +> Even if a user can see the option to change the UI language, other policy settings can prevent them from changing their UI language. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the select language group options* +- GP name: *HideLanguageSelection* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/HideLocaleSelectAndCustomize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the regional formats interface from the Region settings control panel. + +This policy setting is used only to simplify the Regional and Language Options control panel. + +If you enable this policy setting, the user does not see the regional formats options. This does not prevent the user or an application from changing their user locale or user overrides programmatically. + +If you disable or do not configure this policy setting, the user sees the regional formats options for changing and customizing the user locale. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide user locale selection and customization options* +- GP name: *HideLocaleSelectAndCustomize* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/ImplicitDataCollectionOff_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the automatic learning component of handwriting recognition personalization. + +Automatic learning enables the collection and storage of text and ink written by the user in order to help adapt handwriting recognition to the vocabulary and handwriting style of the user. Text that is collected includes all outgoing messages in Windows Mail, and MAPI enabled email clients, as well as URLs from the Internet Explorer browser history. The information that is stored includes word frequency and new words not already known to the handwriting recognition engines (for example, proper names and acronyms). Deleting email content or the browser history does not delete the stored personalization data. Ink entered through Input Panel is collected and stored. + +> [!NOTE] +> Automatic learning of both text and ink might not be available for all languages, even when handwriting personalization is available. See Tablet PC Help for more information. + +If you enable this policy setting, automatic learning stops and any stored data is deleted. Users cannot configure this setting in Control Panel. + +If you disable this policy setting, automatic learning is turned on. Users cannot configure this policy setting in Control Panel. Collected data is only used for handwriting recognition, if handwriting personalization is turned on. + +If you do not configure this policy, users can choose to enable or disable automatic learning either from the Handwriting tab in the Tablet Settings in Control Panel or from the opt-in dialog. + +This policy setting is related to the "Turn off handwriting personalization" policy setting. + +> [!NOTE] +> The amount of stored ink is limited to 50 MB and the amount of text information to approximately 5 MB. When these limits are reached and new data is collected, old data is deleted to make room for more recent data. +> +> Handwriting personalization works only for Microsoft handwriting recognizers, and not with third-party recognizers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off automatic learning* +- GP name: *ImplicitDataCollectionOff_1* +- GP path: *Control Panel\Regional and Language Options\Handwriting personalization* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/ImplicitDataCollectionOff_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the automatic learning component of handwriting recognition personalization. + +Automatic learning enables the collection and storage of text and ink written by the user in order to help adapt handwriting recognition to the vocabulary and handwriting style of the user. Text that is collected includes all outgoing messages in Windows Mail, and MAPI enabled email clients, as well as URLs from the Internet Explorer browser history. The information that is stored includes word frequency and new words not already known to the handwriting recognition engines (for example, proper names and acronyms). Deleting email content or the browser history does not delete the stored personalization data. Ink entered through Input Panel is collected and stored. + +> [!NOTE] +> Automatic learning of both text and ink might not be available for all languages, even when handwriting personalization is available. See Tablet PC Help for more information. + +If you enable this policy setting, automatic learning stops and any stored data is deleted. Users cannot configure this setting in Control Panel. + +If you disable this policy setting, automatic learning is turned on. Users cannot configure this policy setting in Control Panel. Collected data is only used for handwriting recognition, if handwriting personalization is turned on. + +If you do not configure this policy, users can choose to enable or disable automatic learning either from the Handwriting tab in the Tablet Settings in Control Panel or from the opt-in dialog. + +This policy setting is related to the "Turn off handwriting personalization" policy setting. + +> [!NOTE] +> The amount of stored ink is limited to 50 MB and the amount of text information to approximately 5 MB. When these limits are reached and new data is collected, old data is deleted to make room for more recent data. +> +> Handwriting personalization works only for Microsoft handwriting recognizers, and not with third-party recognizers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off automatic learning* +- GP name: *ImplicitDataCollectionOff_2* +- GP path: *Control Panel\Regional and Language Options\Handwriting personalization* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LocaleSystemRestrict** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the permitted system locales to the specified list. If the list is empty, it locks the system locale to its current value. This policy setting does not change the existing system locale; however, the next time that an administrator attempts to change the computer's system locale, they will be restricted to the specified list. + +The locale list is specified using language names, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-US;en-CA" would restrict the system locale to English (United States) and English (Canada). + +If you enable this policy setting, administrators can select a system locale only from the specified system locale list. + +If you disable or do not configure this policy setting, administrators can select any system locale shipped with the operating system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict system locales* +- GP name: *LocaleSystemRestrict* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LocaleUserRestrict_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts users on a computer to the specified list of user locales. If the list is empty, it locks all user locales to their current values. This policy setting does not change existing user locale settings; however, the next time a user attempts to change their user locale, their choices will be restricted to locales in this list. + +To set this policy setting on a per-user basis, make sure that you do not configure the per-computer policy setting. + +The locale list is specified using language tags, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-CA;fr-CA" would restrict the user locale to English (Canada) and French (Canada). + +If you enable this policy setting, only locales in the specified locale list can be selected by users. + +If you disable or do not configure this policy setting, users can select any locale installed on the computer, unless restricted by the "Disallow selection of Custom Locales" policy setting. If this policy setting is enabled at the computer level, it cannot be disabled by a per-user policy. If this policy setting is disabled at the computer level, the per-user policy is ignored. If this policy setting is not configured at the computer level, restrictions are based on per-user policies. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict user locales* +- GP name: *LocaleUserRestrict_1* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LocaleUserRestrict_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts users on a computer to the specified list of user locales. If the list is empty, it locks all user locales to their current values. This policy setting does not change existing user locale settings; however, the next time a user attempts to change their user locale, their choices will be restricted to locales in this list. + +To set this policy setting on a per-user basis, make sure that you do not configure the per-computer policy setting. + +The locale list is specified using language tags, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-CA;fr-CA" would restrict the user locale to English (Canada) and French (Canada). + +If you enable this policy setting, only locales in the specified locale list can be selected by users. + +If you disable or do not configure this policy setting, users can select any locale installed on the computer, unless restricted by the "Disallow selection of Custom Locales" policy setting. + +If this policy setting is enabled at the computer level, it cannot be disabled by a per-user policy. If this policy setting is disabled at the computer level, the per-user policy is ignored. If this policy setting is not configured at the computer level, restrictions are based on per-user policies. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict user locales* +- GP name: *LocaleUserRestrict_2* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LockMachineUILanguage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the Windows UI language for all users. + +This is a policy setting for computers with more than one UI language installed. + +If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language will follow the language specified by the administrator as the system UI languages. The UI language selected by the user will be ignored if it is different than any of the system UI languages. + +If you disable or do not configure this policy setting, the user can specify which UI language is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restricts the UI language Windows uses for all logged users* +- GP name: *LockMachineUILanguage* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LockUserUILanguage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the Windows UI language for specific users. + +This policy setting applies to computers with more than one UI language installed. + +If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language is restricted to a specified language for the selected user. If the specified language is not installed on the target computer or you disable this policy setting, the language selection defaults to the language selected by the user. + +If you disable or do not configure this policy setting, there is no restriction on which language users should use. + +To enable this policy setting in Windows Server 2003, Windows XP, or Windows 2000, to use the "Restrict selection of Windows menus and dialogs language" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restricts the UI languages Windows should use for the selected user* +- GP name: *LockUserUILanguage* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/PreventGeoIdChange_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from changing their user geographical location (GeoID). + +If you enable this policy setting, users cannot change their GeoID. + +If you disable or do not configure this policy setting, users may select any GeoID. + +If you enable this policy setting at the computer level, it cannot be disabled by a per-user policy setting. If you disable this policy setting at the computer level, the per-user policy is ignored. If you do not configure this policy setting at the computer level, restrictions are based on per-user policy settings. + +To set this policy setting on a per-user basis, make sure that the per-computer policy setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow changing of geographic location* +- GP name: *PreventGeoIdChange_1* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/PreventGeoIdChange_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from changing their user geographical location (GeoID). + +If you enable this policy setting, users cannot change their GeoID. + +If you disable or do not configure this policy setting, users may select any GeoID. + +If you enable this policy setting at the computer level, it cannot be disabled by a per-user policy setting. If you disable this policy setting at the computer level, the per-user policy is ignored. If you do not configure this policy setting at the computer level, restrictions are based on per-user policy settings. + +To set this policy setting on a per-user basis, make sure that the per-computer policy setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow changing of geographic location* +- GP name: *PreventGeoIdChange_2* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/PreventUserOverrides_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the user from customizing their locale by changing their user overrides. + +Any existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy. + +When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they will be unable to customize those choices. + +The user cannot customize their user locale with user overrides. + +If this policy setting is disabled or not configured, then the user can customize their user locale overrides. + +If this policy is set to Enabled at the computer level, then it cannot be disabled by a per-User policy. If this policy is set to Disabled at the computer level, then the per-User policy will be ignored. If this policy is set to Not Configured at the computer level, then restrictions will be based on per-User policies. + +To set this policy on a per-user basis, make sure that the per-computer policy is set to Not Configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow user override of locale settings* +- GP name: *PreventUserOverrides_1* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/PreventUserOverrides_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the user from customizing their locale by changing their user overrides. + +Any existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy. + +When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they will be unable to customize those choices. + +The user cannot customize their user locale with user overrides. + +If this policy setting is disabled or not configured, then the user can customize their user locale overrides. + +If this policy is set to Enabled at the computer level, then it cannot be disabled by a per-User policy. If this policy is set to Disabled at the computer level, then the per-User policy will be ignored. If this policy is set to Not Configured at the computer level, then restrictions will be based on per-User policies. + +To set this policy on a per-user basis, make sure that the per-computer policy is set to Not Configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow user override of locale settings* +- GP name: *PreventUserOverrides_2* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/RestrictUILangSelect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts users to the specified language by disabling the menus and dialog box controls in the Region settings control panel. If the specified language is not installed on the target computer, the language selection defaults to English. + +If you enable this policy setting, the dialog box controls in the Regional and Language Options control panel are not accessible to the logged on user. This prevents users from specifying a language different than the one used. + +To enable this policy setting in Windows Vista, use the "Restricts the UI languages Windows should use for the selected user" policy setting. + +If you disable or do not configure this policy setting, the logged-on user can access the dialog box controls in the Regional and Language Options control panel to select any available UI language. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict selection of Windows menus and dialogs language* +- GP name: *RestrictUILangSelect* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/TurnOffAutocorrectMisspelledWords** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy turns off the autocorrect misspelled words option. This does not, however, prevent the user or an application from changing the setting programmatically. + +The autocorrect misspelled words option controls whether or not errors in typed text will be automatically corrected. + +If the policy is Enabled, then the option will be locked to not autocorrect misspelled words. + +If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference. + +Note that the availability and function of this setting is dependent on supported languages being enabled. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off autocorrect misspelled words* +- GP name: *TurnOffAutocorrectMisspelledWords* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/TurnOffHighlightMisspelledWords** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy turns off the highlight misspelled words option. This does not, however, prevent the user or an application from changing the setting programmatically. + +The highlight misspelled words option controls whether or next spelling errors in typed text will be highlighted. + +If the policy is Enabled, then the option will be locked to not highlight misspelled words. + +If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference. + +Note that the availability and function of this setting is dependent on supported languages being enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off highlight misspelled words* +- GP name: *TurnOffHighlightMisspelledWords* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/TurnOffInsertSpace** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy turns off the insert a space after selecting a text prediction option. This does not, however, prevent the user or an application from changing the setting programmatically. + +The insert a space after selecting a text prediction option controls whether or not a space will be inserted after the user selects a text prediction candidate when using the on-screen keyboard. + +If the policy is Enabled, then the option will be locked to not insert a space after selecting a text prediction. + +If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference. + +Note that the availability and function of this setting is dependent on supported languages being enabled. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off insert a space after selecting a text prediction* +- GP name: *TurnOffInsertSpace* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/TurnOffOfferTextPredictions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy turns off the offer text predictions as I type option. This does not, however, prevent the user or an application from changing the setting programmatically. + +The offer text predictions as I type option controls whether or not text prediction suggestions will be presented to the user on the on-screen keyboard. + +If the policy is Enabled, then the option will be locked to not offer text predictions. + +If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference. + +Note that the availability and function of this setting is dependent on supported languages being enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off offer text predictions as I type* +- GP name: *TurnOffOfferTextPredictions* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/Y2K** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how programs interpret two-digit years. + +This policy setting affects only the programs that use this Windows feature to interpret two-digit years. If a program does not interpret two-digit years correctly, consult the documentation or manufacturer of the program. + +If you enable this policy setting, the system specifies the largest two-digit year interpreted as being preceded by 20. All numbers less than or equal to the specified value are interpreted as being preceded by 20. All numbers greater than the specified value are interpreted as being preceded by 19. + +For example, the default value, 2029, specifies that all two-digit years less than or equal to 29 (00 to 29) are interpreted as being preceded by 20, that is 2000 to 2029. Conversely, all two-digit years greater than 29 (30 to 99) are interpreted as being preceded by 19, that is, 1930 to 1999. + +If you disable or do not configure this policy setting, Windows does not interpret two-digit year formats using this scheme for the program. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Century interpretation for Year 2000* +- GP name: *Y2K* +- GP path: *System* +- GP ADMX file name: *Globalization.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md new file mode 100644 index 0000000000..1b089bd628 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md @@ -0,0 +1,3411 @@ +--- +title: Policy CSP - ADMX_GroupPolicy +description: Policy CSP - ADMX_GroupPolicy +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_GroupPolicy +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_GroupPolicy policies + +
    +
    + ADMX_GroupPolicy/AllowX-ForestPolicy-and-RUP +
    +
    + ADMX_GroupPolicy/CSE_AppMgmt +
    +
    + ADMX_GroupPolicy/CSE_DiskQuota +
    +
    + ADMX_GroupPolicy/CSE_EFSRecovery +
    +
    + ADMX_GroupPolicy/CSE_FolderRedirection +
    +
    + ADMX_GroupPolicy/CSE_IEM +
    +
    + ADMX_GroupPolicy/CSE_IPSecurity +
    +
    + ADMX_GroupPolicy/CSE_Registry +
    +
    + ADMX_GroupPolicy/CSE_Scripts +
    +
    + ADMX_GroupPolicy/CSE_Security +
    +
    + ADMX_GroupPolicy/CSE_Wired +
    +
    + ADMX_GroupPolicy/CSE_Wireless +
    +
    + ADMX_GroupPolicy/CorpConnSyncWaitTime +
    +
    + ADMX_GroupPolicy/DenyRsopToInteractiveUser_1 +
    +
    + ADMX_GroupPolicy/DenyRsopToInteractiveUser_2 +
    +
    + ADMX_GroupPolicy/DisableAOACProcessing +
    +
    + ADMX_GroupPolicy/DisableAutoADMUpdate +
    +
    + ADMX_GroupPolicy/DisableBackgroundPolicy +
    +
    + ADMX_GroupPolicy/DisableLGPOProcessing +
    +
    + ADMX_GroupPolicy/DisableUsersFromMachGP +
    +
    + ADMX_GroupPolicy/EnableCDP +
    +
    + ADMX_GroupPolicy/EnableLogonOptimization +
    +
    + ADMX_GroupPolicy/EnableLogonOptimizationOnServerSKU +
    +
    + ADMX_GroupPolicy/EnableMMX +
    +
    + ADMX_GroupPolicy/EnforcePoliciesOnly +
    +
    + ADMX_GroupPolicy/FontMitigation +
    +
    + ADMX_GroupPolicy/GPDCOptions +
    +
    + ADMX_GroupPolicy/GPTransferRate_1 +
    +
    + ADMX_GroupPolicy/GPTransferRate_2 +
    +
    + ADMX_GroupPolicy/GroupPolicyRefreshRate +
    +
    + ADMX_GroupPolicy/GroupPolicyRefreshRateDC +
    +
    + ADMX_GroupPolicy/GroupPolicyRefreshRateUser +
    +
    + ADMX_GroupPolicy/LogonScriptDelay +
    +
    + ADMX_GroupPolicy/NewGPODisplayName +
    +
    + ADMX_GroupPolicy/NewGPOLinksDisabled +
    +
    + ADMX_GroupPolicy/OnlyUseLocalAdminFiles +
    +
    + ADMX_GroupPolicy/ProcessMitigationOptions +
    +
    + ADMX_GroupPolicy/RSoPLogging +
    +
    + ADMX_GroupPolicy/ResetDfsClientInfoDuringRefreshPolicy +
    +
    + ADMX_GroupPolicy/SlowLinkDefaultForDirectAccess +
    +
    + ADMX_GroupPolicy/SlowlinkDefaultToAsync +
    +
    + ADMX_GroupPolicy/SyncWaitTime +
    +
    + ADMX_GroupPolicy/UserPolicyMode +
    +
    + + +
    + + +**ADMX_GroupPolicy/AllowX-ForestPolicy-and-RUP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows user-based policy processing, roaming user profiles, and user object logon scripts for interactive logons across forests. + +This policy setting affects all user accounts that interactively log on to a computer in a different forest when a trust across forests or a two-way forest trust exists. + +If you do not configure this policy setting: + +- No user-based policy settings are applied from the user's forest. +- Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted. +- Loopback Group Policy processing is applied, using the Group Policy Objects (GPOs) that are scoped to the computer. +- An event log message (1109) is posted, stating that loopback was invoked in Replace mode. + +If you enable this policy setting, the behavior is exactly the same as in Windows 2000: user policy is applied, and a roaming user profile is allowed from the trusted forest. + +If you disable this policy setting, the behavior is the same as if it is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow cross-forest user policy and roaming user profiles* +- GP name: *AllowX-ForestPolicy-and-RUP* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_AppMgmt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when software installation policies are updated. + +This policy setting affects all policy settings that use the software installation component of Group Policy, such as policy settings in Software Settings\Software Installation. You can set software installation policy only for Group Policy Objects stored in Active Directory, not for Group Policy Objects on the local computer. + +This policy setting overrides customized settings that the program implementing the software installation policy set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy setting implementations specify that they are updated only when changed. However, you might want to update unchanged policy settings, such as reapplying a desired policies in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure software Installation policy processing* +- GP name: *CSE_AppMgmt* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_DiskQuota** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when disk quota policies are updated. + +This policy setting affects all policies that use the disk quota component of Group Policy, such as those in Computer Configuration\Administrative Templates\System\Disk Quotas. + +This policy setting overrides customized settings that the program implementing the disk quota policy set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure disk quota policy processing* +- GP name: *CSE_DiskQuota* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_EFSRecovery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when encryption policies are updated. + +This policy setting affects all policies that use the encryption component of Group Policy, such as policies related to encryption in Windows Settings\Security Settings. + +It overrides customized settings that the program implementing the encryption policy set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure EFS recovery policy processing* +- GP name: *CSE_EFSRecovery* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_FolderRedirection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when folder redirection policies are updated. + +This policy setting affects all policies that use the folder redirection component of Group Policy, such as those in WindowsSettings\Folder Redirection. You can only set folder redirection policy for Group Policy objects, stored in Active Directory, not for Group Policy objects on the local computer. + +This policy setting overrides customized settings that the program implementing the folder redirection policy setting set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure folder redirection policy processing* +- GP name: *CSE_FolderRedirection* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_IEM** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when Internet Explorer Maintenance policies are updated. + +This policy setting affects all policies that use the Internet Explorer Maintenance component of Group Policy, such as those in Windows Settings\Internet Explorer Maintenance. + +This policy setting overrides customized settings that the program implementing the Internet Explorer Maintenance policy set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Internet Explorer Maintenance policy processing* +- GP name: *CSE_IEM* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_IPSecurity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when IP security policies are updated. + +This policy setting affects all policies that use the IP security component of Group Policy, such as policies in Computer Configuration\Windows Settings\Security Settings\IP Security Policies on Local Machine. + +This policy setting overrides customized settings that the program implementing the IP security policy set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure IP security policy processing* +- GP name: *CSE_IPSecurity* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_Registry** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when registry policies are updated. + +This policy setting affects all policies in the Administrative Templates folder and any other policies that store values in the registry. It overrides customized settings that the program implementing a registry policy set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure registry policy processing* +- GP name: *CSE_Registry* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_Scripts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when policies that assign shared scripts are updated. + +This policy setting affects all policies that use the scripts component of Group Policy, such as those in WindowsSettings\Scripts. It overrides customized settings that the program implementing the scripts policy set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this setting, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure scripts policy processing* +- GP name: *CSE_Scripts* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_Security** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when security policies are updated. + +This policy setting affects all policies that use the security component of Group Policy, such as those in Windows Settings\Security Settings. + +This policy setting overrides customized settings that the program implementing the security policy set when it was installed. + +If you enable this policy setting, you can use the check boxes provided to change the options. If you disable or do not configure this policy setting, it has no effect on the system. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they be updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure security policy processing* +- GP name: *CSE_Security* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_Wired** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when policies that assign wired network settings are updated. + +This policy setting affects all policies that use the wired network component of Group Policy, such as those in Windows Settings\Wired Network Policies. + +It overrides customized settings that the program implementing the wired network set when it was installed. + +If you enable this policy, you can use the check boxes provided to change the options. + +If you disable this setting or do not configure it, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure wired policy processing* +- GP name: *CSE_Wired* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CSE_Wireless** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when policies that assign wireless network settings are updated. + +This policy setting affects all policies that use the wireless network component of Group Policy, such as those in WindowsSettings\Wireless Network Policies. + +It overrides customized settings that the program implementing the wireless network set when it was installed. + +If you enable this policy, you can use the check boxes provided to change the options. + +If you disable this setting or do not configure it, it has no effect on the system. + +The "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. + +The "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart. + +The "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure wireless policy processing* +- GP name: *CSE_Wireless* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/CorpConnSyncWaitTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies how long Group Policy should wait for workplace connectivity notifications during startup policy processing. If the startup policy processing is synchronous, the computer is blocked until workplace connectivity is available or the wait time is reached. If the startup policy processing is asynchronous, the computer is not blocked and policy processing will occur in the background. In either case, configuring this policy setting overrides any system-computed wait times. + +If you enable this policy setting, Group Policy uses this administratively configured maximum wait time for workplace connectivity, and overrides any default or system-computed wait time. + +If you disable or do not configure this policy setting, Group Policy will use the default wait time of 60 seconds on computers running Windows operating systems greater than Windows 7 configured for workplace connectivity. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify workplace connectivity wait time for policy processing* +- GP name: *CorpConnSyncWaitTime* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/DenyRsopToInteractiveUser_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability of users to view their Resultant Set of Policy (RSoP) data. + +By default, interactively logged on users can view their own Resultant Set of Policy (RSoP) data. + +If you enable this policy setting, interactive users cannot generate RSoP data. + +If you disable or do not configure this policy setting, interactive users can generate RSoP. + +> [!NOTE] +> This policy setting does not affect administrators. If you enable or disable this policy setting, by default administrators can view RSoP data. +> +> To view RSoP data on a client computer, use the RSoP snap-in for the Microsoft Management Console. You can launch the RSoP snap-in from the command line by typing RSOP.msc. +> +> This policy setting exists as both a User Configuration and Computer Configuration setting. Also, see the "Turn off Resultant set of Policy logging" policy setting in Computer Configuration\Administrative Templates\System\GroupPolicy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Determine if interactive users can generate Resultant Set of Policy data* +- GP name: *DenyRsopToInteractiveUser_1* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/DenyRsopToInteractiveUser_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability of users to view their Resultant Set of Policy (RSoP) data. + +By default, interactively logged on users can view their own Resultant Set of Policy (RSoP) data. + +If you enable this policy setting, interactive users cannot generate RSoP data. + +If you disable or do not configure this policy setting, interactive users can generate RSoP + +> [!NOTE] +> This policy setting does not affect administrators. If you enable or disable this policy setting, by default administrators can view RSoP data. +> +> To view RSoP data on a client computer, use the RSoP snap-in for the Microsoft Management Console. You can launch the RSoP snap-in from the command line by typing RSOP.msc. +> +> This policy setting exists as both a User Configuration and Computer Configuration setting. Also, see the "Turn off Resultant set of Policy logging" policy setting in Computer Configuration\Administrative Templates\System\GroupPolicy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Determine if interactive users can generate Resultant Set of Policy data* +- GP name: *DenyRsopToInteractiveUser_2* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/DisableAOACProcessing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the Group Policy Client Service from stopping when idle. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Group Policy Client Service AOAC optimization* +- GP name: *DisableAOACProcessing* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/DisableAutoADMUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents the system from updating the Administrative Templates source files automatically when you open the Group Policy Object Editor. + +Administrators might want to use this if they are concerned about the amount of space used on the system volume of a DC. + +By default, when you start the Group Policy Object Editor, a timestamp comparison is performed on the source files in the local %SYSTEMROOT%\inf directory and the source files stored in the GPO. + +If the local files are newer, they are copied into the GPO. + +Changing the status of this setting to Enabled will keep any source files from copying to the GPO. + +Changing the status of this setting to Disabled will enforce the default behavior. + +Files will always be copied to the GPO if they have a later timestamp. + +> [!NOTE] +> If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off automatic update of ADM files* +- GP name: *DisableAutoADMUpdate* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/DisableBackgroundPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents Group Policy from being updated while the computer is in use. This policy setting applies to Group Policy for computers, users, and domain controllers. + +If you enable this policy setting, the system waits until the current user logs off the system before updating the computer and user settings. + +If you disable or do not configure this policy setting, updates can be applied while users are working. The frequency of updates is determined by the "Set Group Policy refresh interval for computers" and "Set Group Policy refresh interval for users" policy settings. + +> [!NOTE] +> If you make changes to this policy setting, you must restart your computer for it to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off background refresh of Group Policy* +- GP name: *DisableBackgroundPolicy* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/DisableLGPOProcessing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents Local Group Policy Objects (Local GPOs) from being applied. + +By default, the policy settings in Local GPOs are applied before any domain-based GPO policy settings. These policy settings can apply to both users and the local computer. You can disable the processing and application of all Local GPOs to ensure that only domain-based GPOs are applied. + +If you enable this policy setting, the system does not process and apply any Local GPOs. + +If you disable or do not configure this policy setting, Local GPOs continue to be applied. + +> [!NOTE] +> For computers joined to a domain, it is strongly recommended that you only configure this policy setting in domain-based GPOs. This policy setting will be ignored on computers that are joined to a workgroup. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Local Group Policy Objects processing* +- GP name: *DisableLGPOProcessing* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/DisableUsersFromMachGP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control a user's ability to invoke a computer policy refresh. + +If you enable this policy setting, users are not able to invoke a refresh of computer policy. Computer policy will still be applied at startup or when an official policy refresh occurs. + +If you disable or do not configure this policy setting, the default behavior applies. By default, computer policy is applied when the computer starts up. It also applies at a specified refresh interval or when manually invoked by the user. + +Note: This policy setting applies only to non-administrators. Administrators can still invoke a refresh of computer policy at any time, no matter how this policy setting is configured. + +Also, see the "Set Group Policy refresh interval for computers" policy setting to change the policy refresh interval. + +> [!NOTE] +> If you make changes to this policy setting, you must restart your computer for it to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove users' ability to invoke machine policy refresh* +- GP name: *DisableUsersFromMachGP* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/EnableCDP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the Windows device is allowed to participate in cross-device experiences (continue experiences). + +If you enable this policy setting, the Windows device is discoverable by other Windows devices that belong to the same user, and can participate in cross-device experiences. + +If you disable this policy setting, the Windows device is not discoverable by other devices, and cannot participate in cross-device experiences. + +If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Continue experiences on this device* +- GP name: *EnableCDP* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/EnableLogonOptimization** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Group Policy caching behavior. + +If you enable or do not configure this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.) + +The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds. + +The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds. + +If you disable this policy setting, the Group Policy client will not cache applicable GPOs or settings that are contained within the GPOs. When Group Policy runs synchronously, it downloads the latest version of the policy from the network and uses bandwidth estimates to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.) + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Group Policy Caching* +- GP name: *EnableLogonOptimization* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/EnableLogonOptimizationOnServerSKU** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Group Policy caching behavior on Windows Server machines. + +If you enable this policy setting, Group Policy caches policy information after every background processing session. This cache saves applicable GPOs and the settings contained within them. When Group Policy runs in synchronous foreground mode, it refers to this cache, which enables it to run faster. When the cache is read, Group Policy attempts to contact a logon domain controller to determine the link speed. When Group Policy runs in background mode or asynchronous foreground mode, it continues to download the latest version of the policy information, and it uses a bandwidth estimate to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.) + +The slow link value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before reporting the link speed as slow. The default is 500 milliseconds. + +The timeout value that is defined in this policy setting determines how long Group Policy will wait for a response from the domain controller before determining that there is no network connectivity. This stops the current Group Policy processing. Group Policy will run in the background the next time a connection to a domain controller is established. Setting this value too high might result in longer waits for the user at boot or logon. The default is 5000 milliseconds. + +If you disable or do not configure this policy setting, the Group Policy client will not cache applicable GPOs or settings that are contained within the GPOs. When Group Policy runs synchronously, it downloads the latest version of the policy from the network and uses bandwidth estimates to determine slow link thresholds. (See the “Configure Group Policy Slow Link Detection” policy setting to configure asynchronous foreground behavior.) + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Group Policy Caching for Servers* +- GP name: *EnableLogonOptimizationOnServerSKU* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/EnableMMX** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy allows IT admins to turn off the ability to Link a Phone with a PC to continue reading, emailing and other tasks that requires linking between Phone and PC. + +If you enable this policy setting, the Windows device will be able to enroll in Phone-PC linking functionality and participate in Continue on PC experiences. + +If you disable this policy setting, the Windows device is not allowed to be linked to Phones, will remove itself from the device list of any linked Phones, and cannot participate in Continue on PC experiences. + +If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Phone-PC linking on this device* +- GP name: *EnableMMX* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/EnforcePoliciesOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents administrators from viewing or using Group Policy preferences. + +A Group Policy administration (.adm) file can contain both true settings and preferences. True settings, which are fully supported by Group Policy, must use registry entries in the Software\Policies or Software\Microsoft\Windows\CurrentVersion\Policies registry subkeys. Preferences, which are not fully supported, use registry entries in other subkeys. + +If you enable this policy setting, the "Show Policies Only" command is turned on, and administrators cannot turn it off. As a result, Group Policy Object Editor displays only true settings; preferences do not appear. + +If you disable or do not configure this policy setting, the "Show Policies Only" command is turned on by default, but administrators can view preferences by turning off the "Show Policies Only" command. + +> [!NOTE] +> To find the "Show Policies Only" command, in Group Policy Object Editor, click the Administrative Templates folder (either one), right-click the same folder, and then point to "View." + +In Group Policy Object Editor, preferences have a red icon to distinguish them from true settings, which have a blue icon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enforce Show Policies Only* +- GP name: *EnforcePoliciesOnly* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/FontMitigation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the %windir%\Fonts directory. + +This feature can be configured to be in 3 modes: On, Off, and Audit. By default, it is Off and no fonts are blocked. If you aren't quite ready to deploy this feature into your organization, you can run it in Audit mode to see if blocking untrusted fonts causes any usability or compatibility issues. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Untrusted Font Blocking* +- GP name: *DisableUsersFromMachGP* +- GP path: *System\Mitigation Options* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/GPDCOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines which domain controller the Group Policy Object Editor snap-in uses. + +If you enable this setting, you can which domain controller is used according to these options: + +"Use the Primary Domain Controller" indicates that the Group Policy Object Editor snap-in reads and writes changes to the domain controller designated as the PDC Operations Master for the domain. + +"Inherit from Active Directory Snap-ins" indicates that the Group Policy Object Editor snap-in reads and writes changes to the domain controller that Active Directory Users and Computers or Active Directory Sites and Services snap-ins use. + +"Use any available domain controller" indicates that the Group Policy Object Editor snap-in can read and write changes to any available domain controller. + +If you disable this setting or do not configure it, the Group Policy Object Editor snap-in uses the domain controller designated as the PDC Operations Master for the domain. + +> [!NOTE] +> To change the PDC Operations Master for a domain, in Active Directory Users and Computers, right-click a domain, and then click "Operations Masters." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Group Policy domain controller selection* +- GP name: *GPDCOptions* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/GPTransferRate_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines a slow connection for purposes of applying and updating Group Policy. + +If the rate at which data is transferred from the domain controller providing a policy update to the computers in this group is slower than the rate specified by this setting, the system considers the connection to be slow. + +The system's response to a slow policy connection varies among policies. The program implementing the policy can specify the response to a slow link. Also, the policy processing settings in this folder lets you override the programs' specified responses to slow links. + +If you enable this setting, you can, in the "Connection speed" box, type a decimal number between 0 and 4,294,967,200, indicating a transfer rate in kilobits per second. Any connection slower than this rate is considered to be slow. If you type 0, all connections are considered to be fast. + +If you disable this setting or do not configure it, the system uses the default value of 500 kilobits per second. + +This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder. + +Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. Note: If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Group Policy slow link detection* +- GP name: *GPTransferRate_1* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/GPTransferRate_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines a slow connection for purposes of applying and updating Group Policy. + +If the rate at which data is transferred from the domain controller providing a policy update to the computers in this group is slower than the rate specified by this setting, the system considers the connection to be slow. + +The system's response to a slow policy connection varies among policies. The program implementing the policy can specify the response to a slow link. Also, the policy processing settings in this folder lets you override the programs' specified responses to slow links. + +If you enable this setting, you can, in the "Connection speed" box, type a decimal number between 0 and 4,294,967,200, indicating a transfer rate in kilobits per second. Any connection slower than this rate is considered to be slow. If you type 0, all connections are considered to be fast. + +If you disable this setting or do not configure it, the system uses the default value of 500 kilobits per second. + +This setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder. + +Also, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. Note: If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Group Policy slow link detection* +- GP name: *GPTransferRate_2* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/GroupPolicyRefreshRate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies how often Group Policy for computers is updated while the computer is in use (in the background). This setting specifies a background update rate only for Group Policies in the Computer Configuration folder. + +In addition to background updates, Group Policy for the computer is always updated when the system starts. + +By default, computer Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes. + +If you enable this setting, you can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations. + +If you disable this setting, Group Policy is updated every 90 minutes (the default). To specify that Group Policy should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" policy. + +The Set Group Policy refresh interval for computers policy also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly. + +This setting establishes the update rate for computer Group Policy. To set an update rate for user policies, use the "Set Group Policy refresh interval for users" setting (located in User Configuration\Administrative Templates\System\Group Policy). + +This setting is only used when the "Turn off background refresh of Group Policy" setting is not enabled. + +> [!NOTE] +> Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs users can run, might interfere with tasks in progress. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Group Policy refresh interval for computers* +- GP name: *GroupPolicyRefreshRate* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/GroupPolicyRefreshRateDC** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies how often Group Policy is updated on domain controllers while they are running (in the background). The updates specified by this setting occur in addition to updates performed when the system starts. + +By default, Group Policy on the domain controllers is updated every five minutes. + +If you enable this setting, you can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the domain controller tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations. + +If you disable or do not configure this setting, the domain controller updates Group Policy every 5 minutes (the default). To specify that Group Policies for users should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" setting. + +This setting also lets you specify how much the actual update interval varies. To prevent domain controllers with the same update interval from requesting updates simultaneously, the system varies the update interval for each controller by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that update requests overlap. However, updates might be delayed significantly. + +> [!NOTE] +> This setting is used only when you are establishing policy for a domain, site, organizational unit (OU), or customized group. If you are establishing policy for a local computer only, the system ignores this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Group Policy refresh interval for domain controllers* +- GP name: *GroupPolicyRefreshRateDC* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/GroupPolicyRefreshRateUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies how often Group Policy for users is updated while the computer is in use (in the background). This setting specifies a background update rate only for the Group Policies in the User Configuration folder. + +In addition to background updates, Group Policy for users is always updated when users log on. + +By default, user Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes. + +If you enable this setting, you can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update user Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations. + +If you disable this setting, user Group Policy is updated every 90 minutes (the default). To specify that Group Policy for users should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" setting. + +This setting also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly. + +> [!IMPORTANT] +> If the "Turn off background refresh of Group Policy" setting is enabled, this setting is ignored. + +> [!NOTE] +> This setting establishes the update rate for user Group Policies. To set an update rate for computer Group Policies, use the "Group Policy refresh interval for computers" setting (located in Computer Configuration\Administrative Templates\System\Group Policy). + +> [!TIP] +> Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs a user can run, might interfere with tasks in progress. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Group Policy refresh interval for users* +- GP name: *GroupPolicyRefreshRateUser* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/LogonScriptDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enter “0” to disable Logon Script Delay. + +This policy setting allows you to configure how long the Group Policy client waits after logon before running scripts. + +By default, the Group Policy client waits five minutes before running logon scripts. This helps create a responsive desktop environment by preventing disk contention. + +If you enable this policy setting, Group Policy will wait for the specified amount of time before running logon scripts. + +If you disable this policy setting, Group Policy will run scripts immediately after logon. + +If you do not configure this policy setting, Group Policy will wait five minutes before running logon scripts. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Logon Script Delay* +- GP name: *LogonScriptDelay* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/NewGPODisplayName** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to set the default display name for new Group Policy objects. + +This setting allows you to specify the default name for new Group Policy objects created from policy compliant Group Policy Management tools including the Group Policy tab in Active Directory tools and the GPO browser. + +The display name can contain environment variables and can be a maximum of 255 characters long. + +If this setting is Disabled or Not Configured, the default display name of New Group Policy object is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set default name for new Group Policy objects* +- GP name: *NewGPODisplayName* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/NewGPOLinksDisabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to create new Group Policy object links in the disabled state. + +If you enable this setting, you can create all new Group Policy object links in the disabled state by default. After you configure and test the new object links by using a policy compliant Group Policy management tool such as Active Directory Users and Computers or Active Directory Sites and Services, you can enable the object links for use on the system. + +If you disable this setting or do not configure it, new Group Policy object links are created in the enabled state. If you do not want them to be effective until they are configured and tested, you must disable the object link. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Create new Group Policy Object links disabled by default* +- GP name: *NewGPOLinksDisabled* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/OnlyUseLocalAdminFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you always use local ADM files for the Group Policy snap-in. + +By default, when you edit a Group Policy Object (GPO) using the Group Policy Object Editor snap-in, the ADM files are loaded from that GPO into the Group Policy Object Editor snap-in. This allows you to use the same version of the ADM files that were used to create the GPO while editing this GPO. + +This leads to the following behavior: + +- If you originally created the GPO with, for example, an English system, the GPO contains English ADM files. + +- If you later edit the GPO from a different-language system, you get the English ADM files as they were in the GPO. + +You can change this behavior by using this setting. + +If you enable this setting, the Group Policy Object Editor snap-in always uses local ADM files in your %windir%\inf directory when editing GPOs. + +This leads to the following behavior: + +- If you had originally created the GPO with an English system, and then you edit the GPO with a Japanese system, the Group Policy Object Editor snap-in uses the local Japanese ADM files, and you see the text in Japanese under Administrative Templates. + +If you disable or do not configure this setting, the Group Policy Object Editor snap-in always loads all ADM files from the actual GPO. + +> [!NOTE] +> If the ADMs that you require are not all available locally in your %windir%\inf directory, you might not be able to see all the settings that have been configured in the GPO that you are editing. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always use local ADM files for Group Policy Object Editor* +- GP name: *OnlyUseLocalAdminFiles* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/ProcessMitigationOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This security feature provides a means to override individual process MitigationOptions settings. This can be used to enforce a number of security policies specific to applications. The application name is specified as the Value name, including extension. The Value is specified as a bit field with a series of flags in particular positions. Bits can be set to either 0 (setting is forced off), 1 (setting is forced on), or ? (setting retains its existing value prior to GPO evaluation). The recognized bit locations are: + +PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE (0x00000001) +Enables data execution prevention (DEP) for the child process + +PROCESS_CREATION_MITIGATION_POLICY_DEP_ATL_THUNK_ENABLE (0x00000002) +Enables DEP-ATL thunk emulation for the child process. DEP-ATL thunk emulation causes the system to intercept NX faults that originate from the Active Template Library (ATL) thunk layer. + +PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE (0x00000004) +Enables structured exception handler overwrite protection (SEHOP) for the child process. SEHOP blocks exploits that use the structured exception handler (SEH) overwrite technique. + +PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON (0x00000100) +The force Address Space Layout Randomization (ASLR) policy forcibly rebases images that are not dynamic base compatible by acting as though an image base collision happened at load time. If relocations are required, images that do not have a base relocation section will not be loaded. + +PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON (0x00010000) +PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF (0x00020000) +The bottom-up randomization policy, which includes stack randomization options, causes a random location to be used as the lowest user address. + +For instance, to enable PROCESS_CREATION_MITIGATION_POLICY_DEP_ENABLE and PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON, disable PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_OFF, and to leave all other options at their default values, specify a value of: +???????????????0???????1???????1 + +Setting flags not specified here to any value other than ? results in undefined behavior. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Process Mitigation Options* +- GP name: *ProcessMitigationOptions* +- GP path: *System\Mitigation Options* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/RSoPLogging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows you to enable or disable Resultant Set of Policy (RSoP) logging on a client computer. + +RSoP logs information on Group Policy settings that have been applied to the client. This information includes details such as which Group Policy Objects (GPO) were applied, where they came from, and the client-side extension settings that were included. + +If you enable this setting, RSoP logging is turned off. + +If you disable or do not configure this setting, RSoP logging is turned on. By default, RSoP logging is always on. + +> [!NOTE] +> To view the RSoP information logged on a client computer, you can use the RSoP snap-in in the Microsoft Management Console (MMC). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Resultant Set of Policy logging* +- GP name: *RSoPLogging* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/ResetDfsClientInfoDuringRefreshPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enabling this setting will cause the Group Policy Client to connect to the same domain controller for DFS shares as is being used for Active Directory. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable AD/DFS domain controller synchronization during policy refresh* +- GP name: *ResetDfsClientInfoDuringRefreshPolicy* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/SlowLinkDefaultForDirectAccess** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows an administrator to define the Direct Access connection to be considered a fast network connection for the purposes of applying and updating Group Policy. + +When Group Policy detects the bandwidth speed of a Direct Access connection, the detection can sometimes fail to provide any bandwidth speed information. If Group Policy detects a bandwidth speed, Group Policy will follow the normal rules for evaluating if the Direct Access connection is a fast or slow network connection. If no bandwidth speed is detected, Group Policy will default to a slow network connection. This policy setting allows the administrator the option to override the default to slow network connection and instead default to using a fast network connection in the case that no network bandwidth speed is determined. + +> [!NOTE] +> When Group Policy detects a slow network connection, Group Policy will only process those client side extensions configured for processing across a slow link (slow network connection). + +If you enable this policy, when Group Policy cannot determine the bandwidth speed across Direct Access, Group Policy will evaluate the network connection as a fast link and process all client side extensions. + +If you disable this setting or do not configure it, Group Policy will evaluate the network connection as a slow link and process only those client side extensions configured to process over a slow link. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Direct Access connections as a fast network connection* +- GP name: *SlowLinkDefaultForDirectAccess* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/SlowlinkDefaultToAsync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy directs Group Policy processing to skip processing any client side extension that requires synchronous processing (that is, whether computers wait for the network to be fully initialized during computer startup and user logon) when a slow network connection is detected. + +If you enable this policy setting, when a slow network connection is detected, Group Policy processing will always run in an asynchronous manner. +Client computers will not wait for the network to be fully initialized at startup and logon. Existing users will be logged on using cached credentials, +which will result in shorter logon times. Group Policy will be applied in the background after the network becomes available. +Note that because this is a background refresh, extensions requiring synchronous processing such as Software Installation, Folder Redirection +and Drive Maps preference extension will not be applied. + +> [!NOTE] +> There are two conditions that will cause Group Policy to be processed synchronously even if this policy setting is enabled: +> +> - 1 - At the first computer startup after the client computer has joined the domain. +> - 2 - If the policy setting "Always wait for the network at computer startup and logon" is enabled. + +If you disable or do not configure this policy setting, detecting a slow network connection will not affect whether Group Policy processing will be synchronous or asynchronous. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Change Group Policy processing to run asynchronously when a slow network connection is detected.* +- GP name: *SlowlinkDefaultToAsync* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/SyncWaitTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies how long Group Policy should wait for network availability notifications during startup policy processing. If the startup policy processing is synchronous, the computer is blocked until the network is available or the default wait time is reached. If the startup policy processing is asynchronous, the computer is not blocked and policy processing will occur in the background. In either case, configuring this policy setting overrides any system-computed wait times. + +If you enable this policy setting, Group Policy will use this administratively configured maximum wait time and override any default or system-computed wait time. + +If you disable or do not configure this policy setting, Group Policy will use the default wait time of 30 seconds on computers running Windows Vista operating system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify startup policy processing wait time* +- GP name: *SyncWaitTime* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + + +**ADMX_GroupPolicy/UserPolicyMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this setting. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user setting based on the computer that is being used. + +By default, the user's Group Policy Objects determine which user settings apply. If this setting is enabled, then, when a user logs on to this computer, the computer's Group Policy Objects determine which set of Group Policy Objects applies. + +If you enable this setting, you can select one of the following modes from the Mode box: + +"Replace" indicates that the user settings defined in the computer's Group Policy Objects replace the user settings normally applied to the user. + +"Merge" indicates that the user settings defined in the computer's Group Policy Objects and the user settings normally applied to the user are combined. If the settings conflict, the user settings in the computer's Group Policy Objects take precedence over the user's normal settings. + +If you disable this setting or do not configure it, the user's Group Policy Objects determines which user settings apply. + +> [!NOTE] +> This setting is effective only when both the computer account and the user account are in at least Windows 2000 domains. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure user Group Policy loopback processing mode* +- GP name: *UserPolicyMode* +- GP path: *System\Group Policy* +- GP ADMX file name: *GroupPolicy.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md new file mode 100644 index 0000000000..3b42429ea9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -0,0 +1,356 @@ +--- +title: Policy CSP - ADMX_Help +description: Policy CSP - ADMX_Help +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/03/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Help +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +**ADMX_Help/DisableHHDEP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to exclude HTML Help Executable from being monitored by software-enforced Data Execution Prevention. + +Data Execution Prevention (DEP) is designed to block malicious code that takes advantage of exception-handling mechanisms in Windows by monitoring your programs to make sure that they use system memory safely. + +If you enable this policy setting, DEP for HTML Help Executable is turned off. This will allow certain legacy ActiveX controls to function without DEP shutting down HTML Help Executable. + +If you disable or do not configure this policy setting, DEP is turned on for HTML Help Executable. This provides an additional security benefit, but HTML Help stops if DEP detects system memory abnormalities. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Data Execution Prevention for HTML Help Executible* +- GP name: *DisableHHDEP* +- GP path: *System* +- GP ADMX file name: *Help.admx* + + + +
    + + +**ADMX_Help/HelpQualifiedRootDir_Comp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders. Alternatively, you can disable these commands on the entire system. It is strongly recommended that only folders requiring administrative privileges be added to this policy setting. + +If you enable this policy setting, the commands function only for .chm files in the specified folders and their subfolders. + +To restrict the commands to one or more folders, enable the policy setting and enter the desired folders in the text box on the Settings tab of the Policy Properties dialog box. Use a semicolon to separate folders. For example, to restrict the commands to only .chm files in the %windir%\help folder and D:\somefolder, add the following string to the edit box: "%windir%\help;D:\somefolder". + +> [!NOTE] +> An environment variable may be used, (for example, %windir%), as long as it is defined on the system. For example, %programfiles% is not defined on some early versions of Windows. + +The "Shortcut" command is used to add a link to a Help topic, and runs executables that are external to the Help file. The "WinHelp" command is used to add a link to a Help topic, and runs a WinHLP32.exe Help (.hlp) file. + +To disallow the "Shortcut" and "WinHelp" commands on the entire local system, enable the policy setting and leave the text box on the Settings tab of the Policy Properties dialog box blank. + +If you disable or do not configure this policy setting, these commands are fully functional for all Help files. + +> [!NOTE] +> Only folders on the local computer can be specified in this policy setting. You cannot use this policy setting to enable the "Shortcut" and "WinHelp" commands for .chm files that are stored on mapped drives or accessed using UNC paths. + +For additional options, see the "Restrict these programs from being launched from Help" policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict potentially unsafe HTML Help functions to specified folders* +- GP name: *HelpQualifiedRootDir_Comp* +- GP path: *System* +- GP ADMX file name: *Help.admx* + + + +
    + + +**ADMX_Help/RestrictRunFromHelp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to restrict programs from being run from online Help. + +If you enable this policy setting, you can prevent specified programs from being run from Help. When you enable this policy setting, enter the file names names of the programs you want to restrict, separated by commas. + +If you disable or do not configure this policy setting, users can run all applications from online Help. + +> [!NOTE] +> You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings. +> +> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict these programs from being launched from Help* +- GP name: *RestrictRunFromHelp* +- GP path: *System* +- GP ADMX file name: *Help.admx* + + + +
    + + +**ADMX_Help/RestrictRunFromHelp_Comp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to restrict programs from being run from online Help. + +If you enable this policy setting, you can prevent specified programs from being run from Help. When you enable this policy setting, enter the file names names of the programs you want to restrict, separated by commas. + +If you disable or do not configure this policy setting, users can run all applications from online Help. + +> [!NOTE] +> You can also restrict users from running applications by using the Software Restriction Policy settings available in Computer Configuration\Security Settings. +> +> This policy setting is available under Computer Configuration and User Configuration. If both are settings are used, any programs listed in either of these locations cannot launched from Help. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict these programs from being launched from Help* +- GP name: *RestrictRunFromHelp_Comp* +- GP path: *System* +- GP ADMX file name: *Help.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md new file mode 100644 index 0000000000..ca46354852 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md @@ -0,0 +1,332 @@ +--- +title: Policy CSP - ADMX_HelpAndSupport +description: Policy CSP - ADMX_HelpAndSupport +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/03/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_HelpAndSupport +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_HelpAndSupport policies + +
    +
    + ADMX_HelpAndSupport/ActiveHelp +
    +
    + ADMX_HelpAndSupport/HPExplicitFeedback +
    +
    + ADMX_HelpAndSupport/HPImplicitFeedback +
    +
    + ADMX_HelpAndSupport/HPOnlineAssistance +
    +
    + + +
    + + +**ADMX_HelpAndSupport/ActiveHelp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether active content links in trusted assistance content are rendered. By default, the Help viewer renders trusted assistance content with active elements such as ShellExecute links and Guided Help links. + +If you enable this policy setting, active content links are not rendered. The text is displayed, but there are no clickable links for these elements. + +If you disable or do not configure this policy setting, the default behavior applies (Help viewer renders trusted assistance content with active elements). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Active Help* +- GP name: *ActiveHelp* +- GP path: *Windows Components/Online Assistance* +- GP ADMX file name: *HelpAndSupport.admx* + + + +
    + + +**ADMX_HelpAndSupport/HPExplicitFeedback** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether users can provide ratings for Help content. + +If you enable this policy setting, ratings controls are not added to Help content. + +If you disable or do not configure this policy setting, ratings controls are added to Help topics. + +Users can use the control to provide feedback on the quality and usefulness of the Help and Support content. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Help Ratings* +- GP name: *HPExplicitFeedback* +- GP path: *System/Internet Communication Management/Internet Communication settings* +- GP ADMX file name: *HelpAndSupport.admx* + + + +
    + + +**ADMX_HelpAndSupport/HPImplicitFeedback** + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether users can participate in the Help Experience Improvement program. The Help Experience Improvement program collects information about how customers use Windows Help so that Microsoft can improve it. + +If you enable this policy setting, users cannot participate in the Help Experience Improvement program. + +If you disable or do not configure this policy setting, users can turn on the Help Experience Improvement program feature from the Help and Support settings page. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Help Experience Improvement Program* +- GP name: *HPImplicitFeedback* +- GP path: *System/Internet Communication Management/Internet Communication settings* +- GP ADMX file name: *HelpAndSupport.admx* + + + +
    + + +**ADMX_HelpAndSupport/HPOnlineAssistance** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether users can search and view content from Windows Online in Help and Support. Windows Online provides the most up-to-date Help content for Windows. + +If you enable this policy setting, users are prevented from accessing online assistance content from Windows Online. + +If you disable or do not configure this policy setting, users can access online assistance if they have a connection to the Internet and have not disabled Windows Online from the Help and Support Options page. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Online* +- GP name: *HPOnlineAssistance* +- GP path: *System/Internet Communication Management/Internet Communication settings* +- GP ADMX file name: *HelpAndSupport.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md new file mode 100644 index 0000000000..63e72f5539 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -0,0 +1,1991 @@ +--- +title: Policy CSP - ADMX_ICM +description: Policy CSP - ADMX_ICM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ICM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_ICM policies + +
    +
    + ADMX_ICM/CEIPEnable +
    +
    + ADMX_ICM/CertMgr_DisableAutoRootUpdates +
    +
    + ADMX_ICM/DisableHTTPPrinting_1 +
    +
    + ADMX_ICM/DisableWebPnPDownload_1 +
    +
    + ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate +
    +
    + ADMX_ICM/EventViewer_DisableLinks +
    +
    + ADMX_ICM/HSS_HeadlinesPolicy +
    +
    + ADMX_ICM/HSS_KBSearchPolicy +
    +
    + ADMX_ICM/InternetManagement_RestrictCommunication_1 +
    +
    + ADMX_ICM/InternetManagement_RestrictCommunication_2 +
    +
    + ADMX_ICM/NC_ExitOnISP +
    +
    + ADMX_ICM/NC_NoRegistration +
    +
    + ADMX_ICM/PCH_DoNotReport +
    +
    + ADMX_ICM/RemoveWindowsUpdate_ICM +
    +
    + ADMX_ICM/SearchCompanion_DisableFileUpdates +
    +
    + ADMX_ICM/ShellNoUseInternetOpenWith_1 +
    +
    + ADMX_ICM/ShellNoUseInternetOpenWith_2 +
    +
    + ADMX_ICM/ShellNoUseStoreOpenWith_1 +
    +
    + ADMX_ICM/ShellNoUseStoreOpenWith_2 +
    +
    + ADMX_ICM/ShellPreventWPWDownload_1 +
    +
    + ADMX_ICM/ShellRemoveOrderPrints_1 +
    +
    + ADMX_ICM/ShellRemoveOrderPrints_2 +
    +
    + ADMX_ICM/ShellRemovePublishToWeb_1 +
    +
    + ADMX_ICM/ShellRemovePublishToWeb_2 +
    +
    + ADMX_ICM/WinMSG_NoInstrumentation_1 +
    +
    + ADMX_ICM/WinMSG_NoInstrumentation_2 +
    +
    + + +
    + + +**ADMX_ICM/CEIPEnable** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the Windows Customer Experience Improvement Program. The Windows Customer Experience Improvement Program collects information about your hardware configuration and how you use our software and services to identify trends and usage patterns. Microsoft will not collect your name, address, or any other personally identifiable information. There are no surveys to complete, no salesperson will call, and you can continue working without interruption. It is simple and user-friendly. + +If you enable this policy setting, all users are opted out of the Windows Customer Experience Improvement Program. + +If you disable this policy setting, all users are opted into the Windows Customer Experience Improvement Program. + +If you do not configure this policy setting, the administrator can use the Problem Reports and Solutions component in Control Panel to enable Windows Customer Experience Improvement Program for all users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Customer Experience Improvement Program* +- GP name: *CEIPEnable* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/CertMgr_DisableAutoRootUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to automatically update root certificates using the Windows Update website. + +Typically, a certificate is used when you use a secure website or when you send and receive secure email. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA). Microsoft has included a list in Windows XP and other products of companies and organizations that it considers trusted authorities. + +If you enable this policy setting, when you are presented with a certificate issued by an untrusted root authority, your computer will not contact the Windows Update website to see if Microsoft has added the CA to its list of trusted authorities. + +If you disable or do not configure this policy setting, your computer will contact the Windows Update website. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Automatic Root Certificates Update* +- GP name: *CertMgr_DisableAutoRootUpdates* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/DisableHTTPPrinting_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to allow printing over HTTP from this client. + +Printing over HTTP allows a client to print to printers on the intranet as well as the Internet. + +> [!NOTE] +> This policy setting affects the client side of Internet printing only. It does not prevent this computer from acting as an Internet Printing server and making its shared printers available via HTTP. + +If you enable this policy setting, it prevents this client from printing to Internet printers over HTTP. + +If you disable or do not configure this policy setting, users can choose to print to Internet printers over HTTP. Also, see the "Web-based printing" policy setting in Computer Configuration/Administrative Templates/Printers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off printing over HTTP* +- GP name: *DisableHTTPPrinting_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/DisableWebPnPDownload_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to allow this client to download print driver packages over HTTP. + +To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP. + +> [!NOTE] +> This policy setting does not prevent the client from printing to printers on the Intranet or the Internet over HTTP. + +It only prohibits downloading drivers that are not already installed locally. + +If you enable this policy setting, print drivers cannot be downloaded over HTTP. + +If you disable or do not configure this policy setting, users can download print drivers over HTTP. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off downloading of print drivers over HTTP* +- GP name: *DisableWebPnPDownload_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows searches Windows Update for device drivers when no local drivers for a device are present. + +If you enable this policy setting, Windows Update is not searched when a new device is installed. + +If you disable this policy setting, Windows Update is always searched for drivers when no local drivers are present. + +If you do not configure this policy setting, searching Windows Update is optional when installing a device. + +Also see "Turn off Windows Update device driver search prompt" in "Administrative Templates/System," which governs whether an administrator is prompted before searching Windows Update for device drivers if a driver is not found locally. + +> [!NOTE] +> This policy setting is replaced by "Specify Driver Source Search Order" in "Administrative Templates/System/Device Installation" on newer versions of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Update device driver searching* +- GP name: *DriverSearchPlaces_DontSearchWindowsUpdate* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/EventViewer_DisableLinks** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether "Events.asp" hyperlinks are available for events within the Event Viewer application. + +The Event Viewer normally makes all HTTP(S) URLs into hyperlinks that activate the Internet browser when clicked. In addition, "More Information" is placed at the end of the description text if the event is created by a Microsoft component. This text contains a link (URL) that, if clicked, sends information about the event to Microsoft, and allows users to learn more about why that event occurred. + +If you enable this policy setting, event description hyperlinks are not activated and the text "More Information" is not displayed at the end of the description. + +If you disable or do not configure this policy setting, the user can click the hyperlink, which prompts the user and then sends information about the event over the Internet to Microsoft. + +Also, see "Events.asp URL", "Events.asp program", and "Events.asp Program Command Line Parameters" settings in "Administrative Templates/Windows Components/Event Viewer". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Event Viewer "Events.asp" links* +- GP name: *EventViewer_DisableLinks* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/HSS_HeadlinesPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to show the "Did you know?" section of Help and Support Center. + +This content is dynamically updated when users who are connected to the Internet open Help and Support Center, and provides up-to-date information about Windows and the computer. + +If you enable this policy setting, the Help and Support Center no longer retrieves nor displays "Did you know?" content. + +If you disable or do not configure this policy setting, the Help and Support Center retrieves and displays "Did you know?" content. + +You might want to enable this policy setting for users who do not have Internet access, because the content in the "Did you know?" section will remain static indefinitely without an Internet connection. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Help and Support Center "Did you know?" content* +- GP name: *HSS_HeadlinesPolicy* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/HSS_KBSearchPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether users can perform a Microsoft Knowledge Base search from the Help and Support Center. + +The Knowledge Base is an online source of technical support information and self-help tools for Microsoft products, and is searched as part of all Help and Support Center searches with the default search options. + +If you enable this policy setting, it removes the Knowledge Base section from the Help and Support Center "Set search options" page, and only Help content on the local computer is searched. + +If you disable or do not configure this policy setting, the Knowledge Base is searched if the user has a connection to the Internet and has not disabled the Knowledge Base search from the Search Options page. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Help and Support Center Microsoft Knowledge Base search* +- GP name: *HSS_KBSearchPolicy* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_1* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_2* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/NC_ExitOnISP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the Internet Connection Wizard can connect to Microsoft to download a list of Internet Service Providers (ISPs). + +If you enable this policy setting, the "Choose a list of Internet Service Providers" path in the Internet Connection Wizard causes the wizard to exit. This prevents users from retrieving the list of ISPs, which resides on Microsoft servers. + +If you disable or do not configure this policy setting, users can connect to Microsoft to download a list of ISPs for their area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com* +- GP name: *NC_ExitOnISP* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/NC_NoRegistration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the Windows Registration Wizard connects to Microsoft.com for online registration. + +If you enable this policy setting, it blocks users from connecting to Microsoft.com for online registration and users cannot register their copy of Windows online. + +If you disable or do not configure this policy setting, users can connect to Microsoft.com to complete the online Windows Registration. + +Note that registration is optional and involves submitting some personal information to Microsoft. However, Windows Product Activation is required but does not involve submitting any personal information (except the country/region you live in). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Registration if URL connection is referring to Microsoft.com* +- GP name: *NC_NoRegistration* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/PCH_DoNotReport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not errors are reported to Microsoft. + +Error Reporting is used to report information about a system or application that has failed or has stopped responding and is used to improve the quality of the product. + +If you enable this policy setting, users are not given the option to report errors. + +If you disable or do not configure this policy setting, the errors may be reported to Microsoft via the Internet or to a corporate file share. + +This policy setting overrides any user setting made from the Control Panel for error reporting. + +Also see the "Configure Error Reporting", "Display Error Notification" and "Disable Windows Error Reporting" policy settings under Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Error Reporting* +- GP name: *PCH_DoNotReport* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/RemoveWindowsUpdate_ICM** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove access to Windows Update. + +If you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at https://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website. + +If you disable or do not configure this policy setting, users can access the Windows Update website and enable automatic updating to receive notifications and critical updates from Windows Update. + +> [!NOTE] +> This policy applies only when this PC is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off access to all Windows Update features* +- GP name: *RemoveWindowsUpdate_ICM* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/SearchCompanion_DisableFileUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Search Companion should automatically download content updates during local and Internet searches. + +When users search the local computer or the Internet, Search Companion occasionally connects to Microsoft to download an updated privacy policy and additional content files used to format and display results. + +If you enable this policy setting, Search Companion does not download content updates during searches. + +If you disable or do not configure this policy setting, Search Companion downloads content updates unless the user is using Classic Search. + +> [!NOTE] +> Internet searches still send the search text and information about the search to Microsoft and the chosen search provider. Choosing Classic Search turns off the Search Companion feature completely. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Search Companion content file updates* +- GP name: *SearchCompanion_DisableFileUpdates* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellNoUseInternetOpenWith_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association. + +When a user opens a file that has an extension that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Web service to find an application. + +If you enable this policy setting, the link and the dialog for using the Web service to open an unhandled file association are removed. + +If you disable or do not configure this policy setting, the user is allowed to use the Web service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet File Association service* +- GP name: *ShellNoUseInternetOpenWith_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellNoUseInternetOpenWith_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association. + +When a user opens a file that has an extension that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Web service to find an application. + +If you enable this policy setting, the link and the dialog for using the Web service to open an unhandled file association are removed. + +If you disable or do not configure this policy setting, the user is allowed to use the Web service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet File Association service* +- GP name: *ShellNoUseInternetOpenWith_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellNoUseStoreOpenWith_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to use the Store service for finding an application to open a file with an unhandled file type or protocol association. + +When a user opens a file type or protocol that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Store service to find an application. + +If you enable this policy setting, the "Look for an app in the Store" item in the Open With dialog is removed. + +If you disable or do not configure this policy setting, the user is allowed to use the Store service and the Store item is available in the Open With dialog. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off access to the Store* +- GP name: *ShellNoUseStoreOpenWith_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellNoUseStoreOpenWith_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to use the Store service for finding an application to open a file with an unhandled file type or protocol association. + +When a user opens a file type or protocol that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Store service to find an application. + +If you enable this policy setting, the "Look for an app in the Store" item in the Open With dialog is removed. + +If you disable or do not configure this policy setting, the user is allowed to use the Store service and the Store item is available in the Open With dialog. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off access to the Store* +- GP name: *ShellNoUseStoreOpenWith_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellPreventWPWDownload_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows should download a list of providers for the web publishing and online ordering wizards. These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry. + +If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed. + +If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards. + +See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet download for Web publishing and online ordering wizards* +- GP name: *ShellPreventWPWDownload_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellRemoveOrderPrints_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders. + +The Order Prints Online Wizard is used to download a list of providers and allow users to order prints online. If you enable this policy setting, the task "Order Prints Online" is removed from Picture Tasks in File Explorer folders. + +If you disable or do not configure this policy setting, the task is displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the "Order Prints" picture task* +- GP name: *ShellRemoveOrderPrints_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellRemoveOrderPrints_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders. + +The Order Prints Online Wizard is used to download a list of providers and allow users to order prints online. + +If you enable this policy setting, the task "Order Prints Online" is removed from Picture Tasks in File Explorer folders. + +If you disable or do not configure this policy setting, the task is displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the "Order Prints" picture task* +- GP name: *ShellRemoveOrderPrints_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellRemovePublishToWeb_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to the Web" are available from File and Folder Tasks in Windows folders. + +The Web Publishing Wizard is used to download a list of providers and allow users to publish content to the web. + +If you enable this policy setting, these tasks are removed from the File and Folder tasks in Windows folders. If you disable or do not configure this policy setting, the tasks are shown. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the "Publish to Web" task for files and folders* +- GP name: *ShellRemovePublishToWeb_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellRemovePublishToWeb_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to the Web" are available from File and Folder Tasks in Windows folders. + +The Web Publishing Wizard is used to download a list of providers and allow users to publish content to the web. + +If you enable this policy setting, these tasks are removed from the File and Folder tasks in Windows folders. + +If you disable or do not configure this policy setting, the tasks are shown. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the "Publish to Web" task for files and folders* +- GP name: *ShellRemovePublishToWeb_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/WinMSG_NoInstrumentation_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows Messenger collects anonymous information about how Windows Messenger software and service is used. + +With the Customer Experience Improvement program, users can allow Microsoft to collect anonymous information about how the product is used. + +This information is used to improve the product in future releases. + +If you enable this policy setting, Windows Messenger does not collect usage information, and the user settings to enable the collection of usage information are not shown. + +If you disable this policy setting, Windows Messenger collects anonymous usage information, and the setting is not shown. If you do not configure this policy setting, users have the choice to opt in and allow information to be collected. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the Windows Messenger Customer Experience Improvement Program* +- GP name: *WinMSG_NoInstrumentation_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/WinMSG_NoInstrumentation_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows Messenger collects anonymous information about how Windows Messenger software and service is used. + +With the Customer Experience Improvement program, users can allow Microsoft to collect anonymous information about how the product is used. + +This information is used to improve the product in future releases. + +If you enable this policy setting, Windows Messenger does not collect usage information, and the user settings to enable the collection of usage information are not shown. + +If you disable this policy setting, Windows Messenger collects anonymous usage information, and the setting is not shown. + +If you do not configure this policy setting, users have the choice to opt in and allow information to be collected. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the Windows Messenger Customer Experience Improvement Program* +- GP name: *WinMSG_NoInstrumentation_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md new file mode 100644 index 0000000000..ec9b9e660a --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -0,0 +1,518 @@ +--- +title: Policy CSP - ADMX_kdc +description: Policy CSP - ADMX_kdc +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_kdc +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_kdc policies + +
    +
    + ADMX_kdc/CbacAndArmor +
    +
    + ADMX_kdc/ForestSearch +
    +
    + ADMX_kdc/PKINITFreshness +
    +
    + ADMX_kdc/RequestCompoundId +
    +
    + ADMX_kdc/TicketSizeThreshold +
    +
    + ADMX_kdc/emitlili +
    +
    + + +
    + + +**ADMX_kdc/CbacAndArmor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure a domain controller to support claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication. + +If you enable this policy setting, client computers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware will use this feature for Kerberos authentication messages. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain. + +If you disable or do not configure this policy setting, the domain controller does not support claims, compound authentication or armoring. + +If you configure the "Not supported" option, the domain controller does not support claims, compound authentication or armoring which is the default behavior for domain controllers running Windows Server 2008 R2 or earlier operating systems. + +> [!NOTE] +> For the following options of this KDC policy to be effective, the Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must be enabled on supported systems. If the Kerberos policy setting is not enabled, Kerberos authentication messages will not use these features. + +If you configure "Supported", the domain controller supports claims, compound authentication and Kerberos armoring. The domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring. + +**Domain functional level requirements** + +For the options "Always provide claims" and "Fail unarmored authentication requests", when the domain functional level is set to Windows Server 2008 R2 or earlier then domain controllers behave as if the "Supported" option is selected. + +When the domain functional level is set to Windows Server 2012 then the domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring, and: + +- If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST). +- If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages. + +> [!WARNING] +> When "Fail unarmored authentication requests" is set, then client computers which do not support Kerberos armoring will fail to authenticate to the domain controller. + +To ensure this feature is effective, deploy enough domain controllers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware to handle the authentication requests. Insufficient number of domain controllers that support this policy result in authentication failures whenever Dynamic Access Control or Kerberos armoring is required (that is, the "Supported" option is enabled). + +Impact on domain controller performance when this policy setting is enabled: + +- Secure Kerberos domain capability discovery is required resulting in additional message exchanges. +- Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size. +- Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *KDC support for claims, compound authentication and Kerberos armoring* +- GP name: *CbacAndArmor* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
    + + +**ADMX_kdc/ForestSearch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs). + +If you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a global catalog or name suffix hints. If a match is found, the KDC will return a referral ticket to the client for the appropriate domain. + +If you disable or do not configure this policy setting, the KDC will not search the listed forests to resolve the SPN. If the KDC is unable to resolve the SPN because the name is not found, NTLM authentication might be used. + +To ensure consistent behavior, this policy setting must be supported and set identically on all domain controllers in the domain. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use forest search order* +- GP name: *ForestSearch* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
    + + +**ADMX_kdc/PKINITFreshness** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Support for PKInit Freshness Extension requires Windows Server 2016 domain functional level (DFL). If the domain controller’s domain is not at Windows Server 2016 DFL or higher this policy will not be applied. + +This policy setting allows you to configure a domain controller (DC) to support the PKInit Freshness Extension. + +If you enable this policy setting, the following options are supported: + +Supported: PKInit Freshness Extension is supported on request. Kerberos clients successfully authenticating with the PKInit Freshness Extension will get the fresh public key identity SID. + +Required: PKInit Freshness Extension is required for successful authentication. Kerberos clients which do not support the PKInit Freshness Extension will always fail when using public key credentials. + +If you disable or not configure this policy setting, then the DC will never offer the PKInit Freshness Extension and accept valid authentication requests without checking for freshness. Users will never receive the fresh public key identity SID. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *KDC support for PKInit Freshness Extension* +- GP name: *PKINITFreshness* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
    + + +**ADMX_kdc/RequestCompoundId** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure a domain controller to request compound authentication. + +> [!NOTE] +> For a domain controller to request compound authentication, the policy "KDC support for claims, compound authentication, and Kerberos armoring" must be configured and enabled. + +If you enable this policy setting, domain controllers will request compound authentication. The returned service ticket will contain compound authentication only when the account is explicitly configured. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain. + +If you disable or do not configure this policy setting, domain controllers will return service tickets that contain compound authentication any time the client sends a compound authentication request regardless of the account configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Request compound authentication* +- GP name: *RequestCompoundId* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
    + + +**ADMX_kdc/TicketSizeThreshold** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure at what size Kerberos tickets will trigger the warning event issued during Kerberos authentication. The ticket size warnings are logged in the System log. + +If you enable this policy setting, you can set the threshold limit for Kerberos ticket which trigger the warning events. If set too high, then authentication failures might be occurring even though warning events are not being logged. If set too low, then there will be too many ticket warnings in the log to be useful for analysis. This value should be set to the same value as the Kerberos policy "Set maximum Kerberos SSPI context token buffer size" or the smallest MaxTokenSize used in your environment if you are not configuring using Group Policy. + +If you disable or do not configure this policy setting, the threshold value defaults to 12,000 bytes, which is the default Kerberos MaxTokenSize for Windows 7, Windows Server 2008 R2 and prior versions. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Warning for large Kerberos tickets* +- GP name: *TicketSizeThreshold* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
    + + +**ADMX_kdc/emitlili** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the domain controller provides information about previous logons to client computers. + +If you enable this policy setting, the domain controller provides the information message about previous logons. + +For Windows Logon to leverage this feature, the "Display information about previous logons during user logon" policy setting located in the Windows Logon Options node under Windows Components also needs to be enabled. + +If you disable or do not configure this policy setting, the domain controller does not provide information about previous logons unless the "Display information about previous logons during user logon" policy setting is enabled. + +> [!NOTE] +> Information about previous logons is provided only if the domain functional level is Windows Server 2008. In domains with a domain functional level of Windows Server 2003, Windows 2000 native, or Windows 2000 mixed, domain controllers cannot provide information about previous logons, and enabling this policy setting does not affect anything. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Provide information about previous logons to client computers* +- GP name: *emitlili* +- GP path: *System/KDC* +- GP ADMX file name: *kdc.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md new file mode 100644 index 0000000000..7f36359852 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -0,0 +1,641 @@ +--- +title: Policy CSP - ADMX_Kerberos +description: Policy CSP - ADMX_Kerberos +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Kerberos +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Kerberos policies + +
    +
    + ADMX_Kerberos/AlwaysSendCompoundId +
    +
    + ADMX_Kerberos/DevicePKInitEnabled +
    +
    + ADMX_Kerberos/HostToRealm +
    +
    + ADMX_Kerberos/KdcProxyDisableServerRevocationCheck +
    +
    + ADMX_Kerberos/KdcProxyServer +
    +
    + ADMX_Kerberos/MitRealms +
    +
    + ADMX_Kerberos/ServerAcceptsCompound +
    +
    + ADMX_Kerberos/StrictTarget +
    +
    + + +
    + + +**ADMX_Kerberos/AlwaysSendCompoundId** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether a device always sends a compound authentication request when the resource domain requests compound identity. + +> [!NOTE] +> For a domain controller to request compound authentication, the policies "KDC support for claims, compound authentication, and Kerberos armoring" and "Request compound authentication" must be configured and enabled in the resource account domain. + +If you enable this policy setting and the resource domain requests compound authentication, devices that support compound authentication always send a compound authentication request. + +If you disable or do not configure this policy setting and the resource domain requests compound authentication, devices will send a non-compounded authentication request first then a compound authentication request when the service requests compound authentication. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always send compound authentication first* +- GP name: *AlwaysSendCompoundId* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
    + + +**ADMX_Kerberos/DevicePKInitEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts. + +This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain. + +If you enable this policy setting, the device's credentials will be selected based on the following options: + +- Automatic: Device will attempt to authenticate using its certificate. If the DC does not support computer account authentication using certificates then authentication with password will be attempted. +- Force: Device will always authenticate using its certificate. If a DC cannot be found which support computer account authentication using certificates then authentication will fail. + +If you disable this policy setting, certificates will never be used. + +If you do not configure this policy setting, Automatic will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Support device authentication using certificate* +- GP name: *DevicePKInitEnabled* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
    + + +**ADMX_Kerberos/HostToRealm** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm. + +If you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. To view the list of mappings, enable the policy setting and then click the Show button. To add a mapping, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type a realm name. In the Value column, type the list of DNS host names and DNS suffixes using the appropriate syntax format. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable this policy setting, the host name-to-Kerberos realm mappings list defined by Group Policy is deleted. + +If you do not configure this policy setting, the system uses the host name-to-Kerberos realm mappings that are defined in the local registry, if they exist. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define host name-to-Kerberos realm mappings* +- GP name: *HostToRealm* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
    + + +**ADMX_Kerberos/KdcProxyDisableServerRevocationCheck** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server. + +If you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections. +Warning: When revocation check is ignored, the server represented by the certificate is not guaranteed valid. + +If you disable or do not configure this policy setting, the Kerberos client enforces the revocation check for the SSL certificate. The connection to the KDC proxy server is not established if the revocation check fails. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable revocation checking for the SSL certificate of KDC proxy servers* +- GP name: *KdcProxyDisableServerRevocationCheck* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
    + + +**ADMX_Kerberos/KdcProxyServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the Kerberos client's mapping to KDC proxy servers for domains based on their DNS suffix names. + +If you enable this policy setting, the Kerberos client will use the KDC proxy server for a domain when a domain controller cannot be located based on the configured mappings. To map a KDC proxy server to a domain, enable the policy setting, click Show, and then map the KDC proxy server name(s) to the DNS name for the domain using the syntax described in the options pane. In the Show Contents dialog box in the Value Name column, type a DNS suffix name. In the Value column, type the list of proxy servers using the appropriate syntax format. To view the list of mappings, enable the policy setting and then click the Show button. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable or do not configure this policy setting, the Kerberos client does not have KDC proxy servers settings defined by Group Policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify KDC proxy servers for Kerberos clients* +- GP name: *KdcProxyServer* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
    + + +**ADMX_Kerberos/MitRealms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined by this policy setting. + +If you enable this policy setting, you can view and change the list of interoperable Kerberos V5 realms and their settings. To view the list of interoperable Kerberos V5 realms, enable the policy setting and then click the Show button. To add an interoperable Kerberos V5 realm, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type the interoperable Kerberos V5 realm name. In the Value column, type the realm flags and host names of the host KDCs using the appropriate syntax format. To remove an interoperable Kerberos V5 realm Value Name or Value entry from the list, click the entry, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable this policy setting, the interoperable Kerberos V5 realm settings defined by Group Policy are deleted. + +If you do not configure this policy setting, the system uses the interoperable Kerberos V5 realm settings that are defined in the local registry, if they exist. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define interoperable Kerberos V5 realm settings* +- GP name: *MitRealms* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
    + + +**ADMX_Kerberos/ServerAcceptsCompound** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls configuring the device's Active Directory account for compound authentication. + +Support for providing compound authentication which is used for access control will require enough domain controllers in the resource account domains to support the requests. The Domain Administrator must configure the policy "Support Dynamic Access Control and Kerberos armoring" on all the domain controllers to support this policy. + +If you enable this policy setting, the device's Active Directory account will be configured for compound authentication by the following options: + +- Never: Compound authentication is never provided for this computer account. +- Automatic: Compound authentication is provided for this computer account when one or more applications are configured for Dynamic Access Control. +- Always: Compound authentication is always provided for this computer account. + +If you disable this policy setting, Never will be used. + +If you do not configure this policy setting, Automatic will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Support compound authentication* +- GP name: *ServerAcceptsCompound* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
    + + +**ADMX_Kerberos/StrictTarget** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure this server so that Kerberos can decrypt a ticket that contains this system-generated SPN. When an application attempts to make a remote procedure call (RPC) to this server with a NULL value for the service principal name (SPN), computers running Windows 7 or later attempt to use Kerberos by generating an SPN. + +If you enable this policy setting, only services running as LocalSystem or NetworkService are allowed to accept these connections. Services running as identities different from LocalSystem or NetworkService might fail to authenticate. + +If you disable or do not configure this policy setting, any service is allowed to accept incoming connections by using this system-generated SPN. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require strict target SPN match on remote procedure calls* +- GP name: *StrictTarget* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanserver.md b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md new file mode 100644 index 0000000000..74d7cb2b32 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-lanmanserver.md @@ -0,0 +1,381 @@ +--- +title: Policy CSP - ADMX_LanmanServer +description: Policy CSP - ADMX_LanmanServer +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_LanmanServer +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_LanmanServer policies + +
    +
    + ADMX_LanmanServer/Pol_CipherSuiteOrder +
    +
    + ADMX_LanmanServer/Pol_HashPublication +
    +
    + ADMX_LanmanServer/Pol_HashSupportVersion +
    +
    + ADMX_LanmanServer/Pol_HonorCipherSuiteOrder +
    +
    + + +
    + + +**ADMX_LanmanServer/Pol_CipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the cipher suites used by the SMB server. + +If you enable this policy setting, cipher suites are prioritized in the order specified. + +If you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used. + +SMB 3.11 cipher suites: + +- AES_128_GCM +- AES_128_CCM + +SMB 3.0 and 3.02 cipher suites: + +- AES_128_CCM + +**How to modify this setting:** + +Arrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use. + +> [!NOTE] +> When configuring this security setting, changes will not take effect until you restart Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Cipher suite order* +- GP name: *Pol_CipherSuiteOrder* +- GP path: *Network/Lanman Server* +- GP ADMX file name: *LanmanServer.admx* + + + +
    + + + +
    + + +**ADMX_LanmanServer/Pol_HashPublication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether a hash generation service generates hashes, also called content information, for data that is stored in shared folders. This policy setting must be applied to server computers that have the File Services role and both the File Server and the BranchCache for Network Files role services installed. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, hash publication settings are not applied to file servers. In the circumstance where file servers are domain members but you do not want to enable BranchCache on all file servers, you can specify Not Configured for this domain Group Policy setting, and then configure local machine policy to enable BranchCache on individual file servers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual servers where you want to enable BranchCache. +- Enabled. With this selection, hash publication is turned on for all file servers where Group Policy is applied. For example, if Hash Publication for BranchCache is enabled in domain Group Policy, hash publication is turned on for all domain member file servers to which the policy is applied. The file servers are then able to create content information for all content that is stored in BranchCache-enabled file shares. +- Disabled. With this selection, hash publication is turned off for all file servers where Group Policy is applied. + +In circumstances where this policy setting is enabled, you can also select the following configuration options: + +- Allow hash publication for all shared folders. With this option, BranchCache generates content information for all content in all shares on the file server. +- Allow hash publication only for shared folders on which BranchCache is enabled. With this option, content information is generated only for shared folders on which BranchCache is enabled. If you use this setting, you must enable BranchCache for individual shares in Share and Storage Management on the file server. +- Disallow hash publication on all shared folders. With this option, BranchCache does not generate content information for any shares on the computer and does not send content information to client computers that request content. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hash Publication for BranchCache* +- GP name: *Pol_HashPublication* +- GP path: *Network/Lanman Server* +- GP ADMX file name: *LanmanServer.admx* + + + +
    + + + +
    + + +**ADMX_LanmanServer/Pol_HashSupportVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the BranchCache hash generation service supports version 1 (V1) hashes, version 2 (V2) hashes, or both V1 and V2 hashes. Hashes, also called content information, are created based on the data in shared folders where BranchCache is enabled. + +If you specify only one version that is supported, content information for that version is the only type that is generated by BranchCache, and it is the only type of content information that can be retrieved by client computers. For example, if you enable support for V1 hashes, BranchCache generates only V1 hashes and client computers can retrieve only V1 hashes. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting. In this circumstance, which is the default, both V1 and V2 hash generation and retrieval are supported. +- Enabled. With this selection, the policy setting is applied and the hash version(s) that are specified in "Hash version supported" are generated and retrieved. +- Disabled. With this selection, both V1 and V2 hash generation and retrieval are supported. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +Hash version supported: + +- To support V1 content information only, configure "Hash version supported" with the value of 1. +- To support V2 content information only, configure "Hash version supported" with the value of 2. +- To support both V1 and V2 content information, configure "Hash version supported" with the value of 3. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hash Version support for BranchCache* +- GP name: *Pol_HashSupportVersion* +- GP path: *Network/Lanman Server* +- GP ADMX file name: *LanmanServer.admx* + + + +
    + + +**ADMX_LanmanServer/Pol_HonorCipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how the SMB server selects a cipher suite when negotiating a new connection with an SMB client. + +If you enable this policy setting, the SMB server will select the cipher suite it most prefers from the list of client-supported cipher suites, ignoring the client's preferences. + +If you disable or do not configure this policy setting, the SMB server will select the cipher suite the client most prefers from the list of server-supported cipher suites. + +> [!NOTE] +> When configuring this security setting, changes will not take effect until you restart Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Honor cipher suite order* +- GP name: *Pol_HonorCipherSuiteOrder* +- GP path: *Network/Lanman Server* +- GP ADMX file name: *LanmanServer.admx* + + + +
    + +Footnotes: +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md new file mode 100644 index 0000000000..96da8caef4 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md @@ -0,0 +1,285 @@ +--- +title: Policy CSP - ADMX_LanmanWorkstation +description: Policy CSP - ADMX_LanmanWorkstation +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_LanmanWorkstation +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_LanmanWorkstation policies + +
    +
    + ADMX_LanmanWorkstation/Pol_CipherSuiteOrder +
    +
    + ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles +
    +
    + ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares +
    +
    + + +
    + + +**ADMX_LanmanWorkstation/Pol_CipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the cipher suites used by the SMB client. + +If you enable this policy setting, cipher suites are prioritized in the order specified. + +If you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used. + +SMB 3.11 cipher suites: + +- AES_128_GCM +- AES_128_CCM +- AES_256_GCM +- AES_256_CCM + +> [!NOTE] +> AES_256 is not supported on Windows 10 version 20H2 and lower. If you enter only AES_256 crypto lines, the older clients will not be able to connect anymore. + +SMB 3.0 and 3.02 cipher suites: + +- AES_128_CCM + +How to modify this setting: + +Arrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use. + +> [!NOTE] +> When configuring this security setting, changes will not take effect until you restart Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Cipher suite order* +- GP name: *Pol_CipherSuiteOrder* +- GP path: *Network\Lanman Workstation* +- GP ADMX file name: *LanmanWorkstation.admx* + + + +
    + + +**ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of SMB handle caching for clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled. + +If you enable this policy setting, the SMB client will allow cached handles to files on CA shares. This may lead to better performance when repeatedly accessing a large number of unstructured data files on CA shares running in Microsoft Azure Files. + +If you disable or do not configure this policy setting, Windows will prevent use of cached handles to files opened through CA shares. + +> [!NOTE] +> This policy has no effect when connecting Scale-out File Server shares provided by a Windows Server. Microsoft does not recommend enabling this policy for clients that routinely connect to files hosted on a Windows Failover Cluster with the File Server for General Use role, as it can lead to adverse failover times and increased memory and CPU usage. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Handle Caching on Continuous Availability Shares* +- GP name: *Pol_EnableHandleCachingForCAFiles* +- GP path: *Network\Lanman Workstation* +- GP ADMX file name: *LanmanWorkstation.admx* + + + +
    + + +**ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of Offline Files on clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled. + +If you enable this policy setting, the "Always Available offline" option will appear in the File Explorer menu on a Windows computer when connecting to a CA-enabled share. Pinning of files on CA-enabled shares using client-side caching will also be possible. + +If you disable or do not configure this policy setting, Windows will prevent use of Offline Files with CA-enabled shares. + +> [!NOTE] +> Microsoft does not recommend enabling this group policy. Use of CA with Offline Files will lead to very long transition times between the online and offline states. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Offline Files Availability on Continuous Availability Shares* +- GP name: *Pol_EnableOfflineFilesforCAShares* +- GP path: *Network\Lanman Workstation* +- GP ADMX file name: *LanmanWorkstation.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md new file mode 100644 index 0000000000..d8eee0b351 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-linklayertopologydiscovery.md @@ -0,0 +1,191 @@ +--- +title: Policy CSP - ADMX_LinkLayerTopologyDiscovery +description: Policy CSP - ADMX_LinkLayerTopologyDiscovery +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/04/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_LinkLayerTopologyDiscovery +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_LinkLayerTopologyDiscovery policies + +
    +
    + ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO +
    +
    + ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr +
    +
    + + +
    + + +**ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting changes the operational behavior of the Mapper I/O network protocol driver. + +LLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Service requests such as bandwidth estimation and network health analysis. + +If you enable this policy setting, additional options are available to fine-tune your selection. You may choose the "Allow operation while in domain" option to allow LLTDIO to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the "Allow operation while in public network" and "Prohibit operation while in private network" options instead. + +If you disable or do not configure this policy setting, the default behavior of LLTDIO will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Mapper I/O (LLTDIO) driver* +- GP name: *LLTD_EnableLLTDIO* +- GP path: *Network/Link-Layer Topology Discovery* +- GP ADMX file name: *LinkLayerTopologyDiscovery.admx* + + + +
    + + +**ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting changes the operational behavior of the Responder network protocol driver. + +The Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. It also allows a computer to participate in Quality-of-Service activities such as bandwidth estimation and network health analysis. + +If you enable this policy setting, additional options are available to fine-tune your selection. You may choose the "Allow operation while in domain" option to allow the Responder to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the "Allow operation while in public network" and "Prohibit operation while in private network" options instead. + +If you disable or do not configure this policy setting, the default behavior for the Responder will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Responder (RSPNDR) driver* +- GP name: *LLTD_EnableRspndr* +- GP path: *Network/Link-Layer Topology Discovery* +- GP ADMX file name: *LinkLayerTopologyDiscovery.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-logon.md b/windows/client-management/mdm/policy-csp-admx-logon.md new file mode 100644 index 0000000000..b463924f33 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-logon.md @@ -0,0 +1,1208 @@ +--- +title: Policy CSP - ADMX_Logon +description: Policy CSP - ADMX_Logon +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Logon +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Logon policies + +
    +
    + ADMX_Logon/BlockUserFromShowingAccountDetailsOnSignin +
    +
    + ADMX_Logon/DisableAcrylicBackgroundOnLogon +
    +
    + ADMX_Logon/DisableExplorerRunLegacy_1 +
    +
    + ADMX_Logon/DisableExplorerRunLegacy_2 +
    +
    + ADMX_Logon/DisableExplorerRunOnceLegacy_1 +
    +
    + ADMX_Logon/DisableExplorerRunOnceLegacy_2 +
    +
    + ADMX_Logon/DisableStatusMessages +
    +
    + ADMX_Logon/DontEnumerateConnectedUsers +
    +
    + ADMX_Logon/NoWelcomeTips_1 +
    +
    + ADMX_Logon/NoWelcomeTips_2 +
    +
    + ADMX_Logon/Run_1 +
    +
    + ADMX_Logon/Run_2 +
    +
    + ADMX_Logon/SyncForegroundPolicy +
    +
    + ADMX_Logon/UseOEMBackground +
    +
    + ADMX_Logon/VerboseStatus +
    +
    + + +
    + + +**ADMX_Logon/BlockUserFromShowingAccountDetailsOnSignin** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy prevents the user from showing account details (email address or user name) on the sign-in screen. + +If you enable this policy setting, the user cannot choose to show account details on the sign-in screen. + +If you disable or do not configure this policy setting, the user may choose to show account details on the sign-in screen. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block user from showing account details on sign-in* +- GP name: *BlockUserFromShowingAccountDetailsOnSignin* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/DisableAcrylicBackgroundOnLogon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting disables the acrylic blur effect on logon background image. + +If you enable this policy, the logon background image shows without blur. + +If you disable or do not configure this policy, the logon background image adopts the acrylic blur effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show clear logon background* +- GP name: *DisableAcrylicBackgroundOnLogon* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/DisableExplorerRunLegacy_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting ignores the customized run list. + +You can create a customized list of additional programs and documents that the system starts automatically when it runs on Windows Vista, Windows XP Professional, and Windows 2000 Professional. These programs are added to the standard run list of programs and services that the system starts. + +If you enable this policy setting, the system ignores the run list for Windows Vista, Windows XP Professional, and Windows 2000 Professional. + +If you disable or do not configure this policy setting, Windows Vista adds any customized run list configured to its run list. + +This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration. + +> [!NOTE] +> To create a customized run list by using a policy setting, use the "Run these applications at startup" policy setting. Also, see the "Do not process the run once list" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not process the legacy run list* +- GP name: *DisableExplorerRunLegacy_1* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/DisableExplorerRunLegacy_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting ignores the customized run list. + +You can create a customized list of additional programs and documents that the system starts automatically when it runs on Windows Vista, Windows XP Professional, and Windows 2000 Professional. These programs are added to the standard run list of programs and services that the system starts. + +If you enable this policy setting, the system ignores the run list for Windows Vista, Windows XP Professional, and Windows 2000 Professional. + +If you disable or do not configure this policy setting, Windows Vista adds any customized run list configured to its run list. + +This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration. + +> [!NOTE] +> To create a customized run list by using a policy setting, use the "Run these applications at startup" policy setting. Also, see the "Do not process the run once list" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not process the legacy run list* +- GP name: *DisableExplorerRunLegacy_2* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/DisableExplorerRunOnceLegacy_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting ignores customized run-once lists. + +You can create a customized list of additional programs and documents that are started automatically the next time the system starts (but not thereafter). These programs are added to the standard list of programs and services that the system starts. + +If you enable this policy setting, the system ignores the run-once list. + +If you disable or do not configure this policy setting, the system runs the programs in the run-once list. + +This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration. + +> [!NOTE] +> Customized run-once lists are stored in the registry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce. Also, see the "Do not process the legacy run list" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not process the run once list* +- GP name: *DisableExplorerRunOnceLegacy_1* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/DisableExplorerRunOnceLegacy_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting ignores customized run-once lists. + +You can create a customized list of additional programs and documents that are started automatically the next time the system starts (but not thereafter). These programs are added to the standard list of programs and services that the system starts. + +If you enable this policy setting, the system ignores the run-once list. + +If you disable or do not configure this policy setting, the system runs the programs in the run-once list. + +This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration. + +> [!NOTE] +> Customized run-once lists are stored in the registry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce. Also, see the "Do not process the legacy run list" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not process the run once list* +- GP name: *DisableExplorerRunOnceLegacy_2* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/DisableStatusMessages** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting suppresses system status messages. + +If you enable this setting, the system does not display a message reminding users to wait while their system starts or shuts down, or while users log on or off. + +If you disable or do not configure this policy setting, the system displays the message reminding users to wait while their system starts or shuts down, or while users log on or off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Boot / Shutdown / Logon / Logoff status messages* +- GP name: *DisableStatusMessages* +- GP path: *System* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/DontEnumerateConnectedUsers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents connected users from being enumerated on domain-joined computers. + +If you enable this policy setting, the Logon UI will not enumerate any connected users on domain-joined computers. + +If you disable or do not configure this policy setting, connected users will be enumerated on domain-joined computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not enumerate connected users on domain-joined computers* +- GP name: *DontEnumerateConnectedUsers* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/NoWelcomeTips_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting hides the welcome screen that is displayed on Windows 2000 Professional each time the user logs on. + +If you enable this policy setting, the welcome screen is hidden from the user logging on to a computer where this policy is applied. + +Users can still display the welcome screen by selecting it on the Start menu or by typing "Welcome" in the Run dialog box. + +If you disable or do not configure this policy, the welcome screen is displayed each time a user logs on to the computer. + +This setting applies only to Windows 2000 Professional. It does not affect the "Configure Your Server on a Windows 2000 Server" screen on Windows 2000 Server. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To display the welcome screen, click Start, point to Programs, point to Accessories, point to System Tools, and then click "Getting Started." To suppress the welcome screen without specifying a setting, clear the "Show this screen at startup" check box on the welcome screen. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not display the Getting Started welcome screen at logon* +- GP name: *NoWelcomeTips_1* +- GP path: *System* +- GP ADMX file name: *Logon.admx* + + + + +
    + + +**ADMX_Logon/NoWelcomeTips_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting hides the welcome screen that is displayed on Windows 2000 Professional each time the user logs on. + +If you enable this policy setting, the welcome screen is hidden from the user logging on to a computer where this policy is applied. + +Users can still display the welcome screen by selecting it on the Start menu or by typing "Welcome" in the Run dialog box. + +If you disable or do not configure this policy, the welcome screen is displayed each time a user logs on to the computer. This setting applies only to Windows 2000 Professional. It does not affect the "Configure Your Server on a Windows 2000 Server" screen on Windows 2000 Server. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To display the welcome screen, click Start, point to Programs, point to Accessories, point to System Tools, and then click "Getting Started." To suppress the welcome screen without specifying a setting, clear the "Show this screen at startup" check box on the welcome screen. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not display the Getting Started welcome screen at logon* +- GP name: *NoWelcomeTips_2* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/Run_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies additional programs or documents that Windows starts automatically when a user logs on to the system. + +If you enable this policy setting, you can specify which programs can run at the time the user logs on to this computer that has this policy applied. + +To specify values for this policy setting, click Show. In the Show Contents dialog box in the Value column, type the name of the executable program (.exe) file or document file. To specify another name, press ENTER, and type the name. Unless the file is located in the %Systemroot% directory, you must specify the fully qualified path to the file. + +If you disable or do not configure this policy setting, the user will have to start the appropriate programs after logon. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the system starts the programs specified in the Computer Configuration setting just before it starts the programs specified in the User Configuration setting. + +Also, see the "Do not process the legacy run list" and the "Do not process the run once list" settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run these programs at user logon* +- GP name: *Run_1* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/Run_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies additional programs or documents that Windows starts automatically when a user logs on to the system. + +If you enable this policy setting, you can specify which programs can run at the time the user logs on to this computer that has this policy applied. + +To specify values for this policy setting, click Show. In the Show Contents dialog box in the Value column, type the name of the executable program (.exe) file or document file. To specify another name, press ENTER, and type the name. Unless the file is located in the %Systemroot% directory, you must specify the fully qualified path to the file. + +If you disable or do not configure this policy setting, the user will have to start the appropriate programs after logon. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the system starts the programs specified in the Computer Configuration setting just before it starts the programs specified in the User Configuration setting. + +Also, see the "Do not process the legacy run list" and the "Do not process the run once list" settings. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run these programs at user logon* +- GP name: *Run_2* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/SyncForegroundPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Group Policy processing is synchronous (that is, whether computers wait for the network to be fully initialized during computer startup and user logon). By default, on client computers, Group Policy processing is not synchronous; client computers typically do not wait for the network to be fully initialized at startup and logon. Existing users are logged on using cached credentials, which results in shorter logon times. Group Policy is applied in the background after the network becomes available. + +Note that because this is a background refresh, extensions such as Software Installation and Folder Redirection take two logons to apply changes. To be able to operate safely, these extensions require that no users be logged on. Therefore, they must be processed in the foreground before users are actively using the computer. In addition, changes that are made to the user object, such as adding a roaming profile path, home directory, or user object logon script, may take up to two logons to be detected. + +If a user with a roaming profile, home directory, or user object logon script logs on to a computer, computers always wait for the network to be initialized before logging the user on. If a user has never logged on to this computer before, computers always wait for the network to be initialized. + +If you enable this policy setting, computers wait for the network to be fully initialized before users are logged on. Group Policy is applied in the foreground, synchronously. + +On servers running Windows Server 2008 or later, this policy setting is ignored during Group Policy processing at computer startup and Group Policy processing will be synchronous (these servers wait for the network to be initialized during computer startup). + +If the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon: + +- The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and +- The “Allow asynchronous user Group Policy processing when logging on through Terminal Services” policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\\. + +If this configuration is not implemented on the server, this policy setting is ignored. In this case, Group Policy processing at user logon is synchronous (these servers wait for the network to be initialized during user logon). + +If you disable or do not configure this policy setting and users log on to a client computer or a server running Windows Server 2008 or later and that is configured as described earlier, the computer typically does not wait for the network to be fully initialized. In this case, users are logged on with cached credentials. Group Policy is applied asynchronously in the background. + +> [!NOTE] +> +> - If you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this policy setting to ensure that Windows waits for the network to be available before applying policy. +> - If Folder Redirection policy will apply during the next logon, security policies will be applied asynchronously during the next update cycle, if network connectivity is available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always wait for the network at computer startup and logon* +- GP name: *SyncForegroundPolicy* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/UseOEMBackground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting ignores Windows Logon Background. + +This policy setting may be used to make Windows give preference to a custom logon background. If you enable this policy setting, the logon screen always attempts to load a custom background instead of the Windows-branded logon background. + +If you disable or do not configure this policy setting, Windows uses the default Windows logon background or custom background. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always use custom logon background* +- GP name: *UseOEMBackground* +- GP path: *System\Logon* +- GP ADMX file name: *Logon.admx* + + + +
    + + +**ADMX_Logon/VerboseStatus** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting directs the system to display highly detailed status messages. + +This policy setting is designed for advanced users who require this information. + +If you enable this policy setting, the system displays status messages that reflect each step in the process of starting, shutting down, logging on, or logging off the system. + +If you disable or do not configure this policy setting, only the default status messages are displayed to the user during these processes. + +> [!NOTE] +> This policy setting is ignored if the "Remove Boot/Shutdown/Logon/Logoff status messages" policy setting is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display highly detailed status messages* +- GP name: *VerboseStatus* +- GP path: *System* +- GP ADMX file name: *Logon.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md new file mode 100644 index 0000000000..995d54e477 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -0,0 +1,6853 @@ +--- +title: Policy CSP - ADMX_MicrosoftDefenderAntivirus +description: Policy CSP - ADMX_MicrosoftDefenderAntivirus +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MicrosoftDefenderAntivirus +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_MicrosoftDefenderAntivirus policies + +
    +
    + ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring +
    +
    + ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction +
    +
    + ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions +
    +
    + ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths +
    +
    + ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes +
    +
    + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions +
    +
    + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules +
    +
    + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications +
    +
    + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders +
    +
    + ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation +
    +
    + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement +
    +
    + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid +
    +
    + ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition +
    +
    + ADMX_MicrosoftDefenderAntivirus/ProxyBypass +
    +
    + ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl +
    +
    + ADMX_MicrosoftDefenderAntivirus/ProxyServer +
    +
    + ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay +
    +
    + ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring +
    +
    + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection +
    +
    + ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents +
    +
    + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay +
    +
    + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval +
    +
    + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup +
    +
    + ADMX_MicrosoftDefenderAntivirus/SpynetReporting +
    +
    + ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting +
    +
    + ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction +
    +
    + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString +
    +
    + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress +
    +
    + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification +
    +
    + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown +
    +
    + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Microsoft Defender Antivirus. + +If you enable this policy setting, Microsoft Defender Antivirus does not run, and will not scan computers for malware or other potentially unwanted software. + +If you disable this policy setting, Microsoft Defender Antivirus will run regardless of any other installed antivirus product. + +If you do not configure this policy setting, Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program, Windows automatically disables Microsoft Defender Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers for malware and other potentially unwanted software. + +Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Microsoft Defender Antivirus* +- GP name: *DisableAntiSpywareDefender* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off. + +Disabled (Default): +Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance. + +Enabled: +Microsoft Defender will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios. + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Auto Exclusions* +- GP name: *DisableAutoExclusions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device. + +Enabled – The Block at First Sight setting is turned on. +Disabled – The Block at First Sight setting is turned off. + +This feature requires these Group Policy settings to be set as follows: + +- MAPS -> The “Join Microsoft MAPS” must be enabled or the “Block at First Sight” feature will not function. +- MAPS -> The “Send file samples when further analysis is required” should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the “Block at First Sight” feature will not function. +- Real-time Protection -> The “Scan all downloaded files and attachments” policy must be enabled or the “Block at First Sight” feature will not function. +- Real-time Protection -> Do not enable the “Turn off real-time protection” policy or the “Block at First Sight” feature will not function. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the 'Block at First Sight' feature* +- GP name: *DisableBlockAtFirstSeen* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not complex list settings configured by a local administrator are merged with Group Policy settings. This setting applies to lists such as threats and Exclusions. + +If you enable or do not configure this setting, unique items defined in Group Policy and in preference settings configured by the local administrator will be merged into the resulting effective policy. In the case of conflicts, Group policy Settings will override preference settings. + +If you disable this setting, only items defined by Group Policy will be used in the resulting effective policy. Group Policy settings will override preference settings configured by the local administrator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local administrator merge behavior for lists* +- GP name: *DisableLocalAdminMerge* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off real-time protection prompts for known malware detection. + +Microsoft Defender Antivirus alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer. + +If you enable this policy setting, Microsoft Defender Antivirus will not prompt users to take actions on malware detections. + +If you disable or do not configure this policy setting, Microsoft Defender Antivirus will prompt users to take actions on malware detections. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off real-time protection* +- GP name: *DisableRealtimeMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether Microsoft Defender Antivirus automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action, user-defined action, and the signature-defined action. + +If you enable this policy setting, Microsoft Defender Antivirus does not automatically take action on the detected threats, but prompts users to choose from the actions available for each threat. + +If you disable or do not configure this policy setting, Microsoft Defender Antivirus automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off routine remediation* +- GP name: *DisableRoutinelyTakingAction* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as "obj" or "lib"). The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Extension Exclusions* +- GP name: *Exclusions_Extensions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. + +As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Path Exclusions* +- GP name: *Exclusions_Paths* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable scheduled and real-time scanning for any file opened by any of the specified processes. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Process Exclusions* +- GP name: *Exclusions_Processes* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Exclude files and paths from Attack Surface Reduction (ASR) rules. + +Enabled: +Specify the folders or files and resources that should be excluded from ASR rules in the Options section. +Enter each rule on a new line as a name-value pair: + +- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder +- Value column: Enter "0" for each item + +Disabled: +No exclusions will be applied to the ASR rules. + +Not configured: +Same as Disabled. + +You can configure ASR rules in the Configure Attack Surface Reduction rules GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Exclude files and paths from Attack Surface Reduction Rules* +- GP name: *ExploitGuard_ASR_ASROnlyExclusions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Set the state for each Attack Surface Reduction (ASR) rule. + +After enabling this setting, you can set each rule to the following in the Options section: + +- Block: the rule will be applied +- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) +- Off: the rule will not be applied + +Enabled: +Specify the state for each ASR rule under the Options section for this setting. +Enter each rule on a new line as a name-value pair: + +- Name column: Enter a valid ASR rule ID +- Value column: Enter the status ID that relates to state you want to specify for the associated rule + +The following status IDs are permitted under the value column: +- 1 (Block) +- 0 (Off) +- 2 (Audit) + +Example: +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 0 +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 1 +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 2 + +Disabled: +No ASR rules will be configured. + +Not configured: +Same as Disabled. + +You can exclude folders or files in the "Exclude files and paths from Attack Surface Reduction Rules" GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Attack Surface Reduction rules* +- GP name: *ExploitGuard_ASR_Rules* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Add additional applications that should be considered "trusted" by controlled folder access. + +These applications are allowed to modify or delete files in controlled folder access folders. + +Microsoft Defender Antivirus automatically determines which applications should be trusted. You can configure this setting to add additional applications. + +Enabled: +Specify additional allowed applications in the Options section.. + +Disabled: +No additional applications will be added to the trusted list. + +Not configured: +Same as Disabled. + +You can enable controlled folder access in the Configure controlled folder access GP setting. + +Default system folders are automatically guarded, but you can add folders in the configure protected folders GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure allowed applications* +- GP name: *ExploitGuard_ControlledFolderAccess_AllowedApplications* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specify additional folders that should be guarded by the Controlled folder access feature. + +Files in these folders cannot be modified or deleted by untrusted applications. + +Default system folders are automatically protected. You can configure this setting to add additional folders. +The list of default system folders that are protected is shown in Windows Security. + +Enabled: +Specify additional folders that should be protected in the Options section. + +Disabled: +No additional folders will be protected. + +Not configured: +Same as Disabled. + +You can enable controlled folder access in the Configure controlled folder access GP setting. + +Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure protected folders* +- GP name: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enable or disable file hash computation feature. + +Enabled: +When this feature is enabled Microsoft Defender will compute hash value for files it scans. + +Disabled: +File hash value is not computed + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable file hash computation feature* +- GP name: *MpEngine_EnableFileHashComputation* +- GP path: *Windows Components\Microsoft Defender Antivirus\MpEngine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure definition retirement for network protection against exploits of known vulnerabilities. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system is not vulnerable to the exploit detected by a definition, then that definition is "retired". If all security intelligence for a given protocol are retired then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up-to-date with all the latest security updates, network protection will have no impact on network performance. + +If you enable or do not configure this setting, definition retirement will be enabled. + +If you disable this setting, definition retirement will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on definition retirement* +- GP name: *Nis_Consumers_IPS_DisableSignatureRetirement* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines additional definition sets to enable for network traffic inspection. Definition set GUIDs should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a definition set GUID. As an example, the definition set GUID to enable test security intelligence is defined as: “{b54b6ac9-a737-498e-9120-6616ad3bf590}”. The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify additional definition sets for network traffic inspection* +- GP name: *Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure protocol recognition for network protection against exploits of known vulnerabilities. + +If you enable or do not configure this setting, protocol recognition will be enabled. + +If you disable this setting, protocol recognition will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on protocol recognition* +- GP name: *Nis_DisableProtocolRecognition* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/ProxyBypass** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy, if defined, will prevent antimalware from using the configured proxy server when communicating with the specified IP addresses. The address value should be entered as a valid URL. + +If you enable this setting, the proxy server will be bypassed for the specified addresses. + +If you disable or do not configure this setting, the proxy server will not be bypassed for the specified addresses. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define addresses to bypass proxy server* +- GP name: *ProxyBypass* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the URL of a proxy .pac file that should be used when the client attempts to connect the network for security intelligence updates and MAPS reporting. If the proxy auto-config fails or if there is no proxy auto-config specified, the client will fall back to the alternative options (in order): + +1. Proxy server (if specified) +2. Proxy .pac URL (if specified) +3. None +4. Internet Explorer proxy settings +5. Autodetect + +If you enable this setting, the proxy setting will be set to use the specified proxy .pac according to the order specified above. + +If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define proxy auto-config (.pac) for connecting to the network* +- GP name: *ProxyPacUrl* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/ProxyServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the named proxy that should be used when the client attempts to connect to the network for security intelligence updates and MAPS reporting. If the named proxy fails or if there is no proxy specified, the client will fall back to the alternative options (in order): + +1. Proxy server (if specified) +2. Proxy .pac URL (if specified) +3. None +4. Internet Explorer proxy settings +5. Autodetect + +If you enable this setting, the proxy will be set to the specified URL according to the order specified above. The URL should be proceeded with either http:// or https://. + +If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define proxy server for connecting to the network* +- GP name: *ProxyServer* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the number of days items should be kept in the Quarantine folder before being removed. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for the removal of items from Quarantine folder* +- GP name: *Quarantine_LocalSettingOverridePurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Quarantine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the number of days items should be kept in the Quarantine folder before being removed. + +If you enable this setting, items will be removed from the Quarantine folder after the number of days specified. + +If you disable or do not configure this setting, items will be kept in the quarantine folder indefinitely and will not be automatically removed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure removal of items from Quarantine folder* +- GP name: *Quarantine_PurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Quarantine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable or disable randomization of the scheduled scan start time and the scheduled security intelligence update start time. This setting is used to distribute the resource impact of scanning. For example, it could be used in guest virtual machines sharing a host, to prevent multiple guest virtual machines from undertaking a disk-intensive operation at the same time. + +If you enable or do not configure this setting, scheduled tasks will begin at a random time within an interval of 30 minutes before and after the specified start time. + +If you disable this setting, scheduled tasks will begin at the specified start time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Randomize scheduled task times* +- GP name: *RandomizeScheduleTaskTimes* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure behavior monitoring. + +If you enable or do not configure this setting, behavior monitoring will be enabled. + +If you disable this setting, behavior monitoring will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on behavior monitoring* +- GP name: *RealtimeProtection_DisableBehaviorMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for all downloaded files and attachments. + +If you enable or do not configure this setting, scanning for all downloaded files and attachments will be enabled. + +If you disable this setting, scanning for all downloaded files and attachments will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan all downloaded files and attachments* +- GP name: *RealtimeProtection_DisableIOAVProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure monitoring for file and program activity. + +If you enable or do not configure this setting, monitoring for file and program activity will be enabled. + +If you disable this setting, monitoring for file and program activity will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Monitor file and program activity on your computer* +- GP name: *RealtimeProtection_DisableOnAccessProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether raw volume write notifications are sent to behavior monitoring. + +If you enable or do not configure this setting, raw write notifications will be enabled. + +If you disable this setting, raw write notifications be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on raw volume write notifications* +- GP name: *RealtimeProtection_DisableRawWriteNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. + +If you enable or do not configure this setting, a process scan will be initiated when real-time protection is turned on. + +If you disable this setting, a process scan will not be initiated when real-time protection is turned on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on process scanning whenever real-time protection is enabled* +- GP name: *RealtimeProtection_DisableScanOnRealtimeEnable* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the maximum size (in kilobytes) of downloaded files and attachments that will be scanned. + +If you enable this setting, downloaded files and attachments smaller than the size specified will be scanned. + +If you disable or do not configure this setting, a default size will be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the maximum size of downloaded files and attachments to be scanned* +- GP name: *RealtimeProtection_IOAVMaxSize* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for turn on behavior monitoring* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for scanning all downloaded files and attachments* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableIOAVProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for monitoring file and program activity on your computer* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override to turn on real-time protection* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for monitoring for incoming and outgoing file activity* +- GP name: *RealtimeProtection_LocalSettingOverrideRealtimeScanDirection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the time to run a scheduled full scan to complete remediation. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for the time of day to run a scheduled full scan to complete remediation* +- GP name: *Remediation_LocalSettingOverrideScan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to perform a scheduled full scan in order to complete remediation. The scan can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never (default) + +If you enable this setting, a scheduled full scan to complete remediation will run at the frequency specified. + +If you disable or do not configure this setting, a scheduled full scan to complete remediation will run at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to run a scheduled full scan to complete remediation* +- GP name: *Remediation_Scan_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to perform a scheduled full scan in order to complete remediation. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a scheduled full scan to complete remediation will run at the time of day specified. + +If you disable or do not configure this setting, a scheduled full scan to complete remediation will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time of day to run a scheduled full scan to complete remediation* +- GP name: *Remediation_Scan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "additional action" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections requiring additional action* +- GP name: *Reporting_AdditionalActionTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the “critically failed” state to moves to either the “additional action” state or the “cleared” state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in critically failed state* +- GP name: *Reporting_CriticalFailureTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Use this policy setting to specify if you want Microsoft Defender Antivirus enhanced notifications to display on clients. + +If you disable or do not configure this setting, Microsoft Defender Antivirus enhanced notifications will display on clients. + +If you enable this setting, Microsoft Defender Antivirus enhanced notifications will not display on clients. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off enhanced notifications* +- GP name: *Reporting_DisableEnhancedNotifications* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + +**ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not Watson events are sent. + +If you enable or do not configure this setting, Watson events will be sent. + +If you disable this setting, Watson events will not be sent. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Watson events* +- GP name: *Reporting_DisablegenericrePorts* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "non-critically failed" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in non-critical failed state* +- GP name: *Reporting_NonCriticalTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + +**ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "completed" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in recently remediated state* +- GP name: *Reporting_RecentlyCleanedTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy configures Windows software trace preprocessor (WPP Software Tracing) components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Windows software trace preprocessor components* +- GP name: *Reporting_WppTracingComponents* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy allows you to configure tracing levels for Windows software trace preprocessor (WPP Software Tracing). + +Tracing levels are defined as: + +- 1 - Error +- 2 - Warning +- 3 - Info +- 4 - Debug + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure WPP tracing level* +- GP name: *Reporting_WppTracingLevel* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether or not end users can pause a scan in progress. + +If you enable or do not configure this setting, a new context menu will be added to the task tray icon to allow the user to pause a scan. + +If you disable this setting, users will not be able to pause scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to pause scan* +- GP name: *Scan_AllowPause* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the maximum directory depth level into which archive files such as .ZIP or .CAB are unpacked during scanning. The default directory depth level is 0. + +If you enable this setting, archive files will be scanned to the directory depth level specified. + +If you disable or do not configure this setting, archive files will be scanned to the default directory depth level. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum depth to scan archive files* +- GP name: *Scan_ArchiveMaxDepth* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the maximum size of archive files such as .ZIP or .CAB that will be scanned. The value represents file size in kilobytes (KB). The default value is 0 and represents no limit to archive size for scanning. + +If you enable this setting, archive files less than or equal to the size specified will be scanned. + +If you disable or do not configure this setting, archive files will be scanned according to the default value. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum size of archive files to be scanned* +- GP name: *Scan_ArchiveMaxSize* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. + +If you enable or do not configure this setting, archive files will be scanned. + +If you disable this setting, archive files will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan archive files* +- GP name: *Scan_DisableArchiveScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files, according to their specific format, in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac). + +If you enable this setting, e-mail scanning will be enabled. + +If you disable or do not configure this setting, e-mail scanning will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on e-mail scanning* +- GP name: *Scan_DisableEmailScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure heuristics. Suspicious detections will be suppressed right before reporting to the engine client. Turning off heuristics will reduce the capability to flag new threats. It is recommended that you do not turn off heuristics. + +If you enable or do not configure this setting, heuristics will be enabled. + +If you disable this setting, heuristics will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on heuristics* +- GP name: *Scan_DisableHeuristics* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for packed executables. It is recommended that this type of scanning remain enabled. + +If you enable or do not configure this setting, packed executables will be scanned. + +If you disable this setting, packed executables will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan packed executables* +- GP name: *Scan_DisablePackedExeScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan. + +If you enable this setting, removable drives will be scanned during any type of scan. + +If you disable or do not configure this setting, removable drives will not be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan removable drives* +- GP name: *Scan_DisableRemovableDriveScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure reparse point scanning. If you allow reparse points to be scanned, there is a possible risk of recursion. However, the engine supports following reparse points to a maximum depth so at worst scanning could be slowed. Reparse point scanning is disabled by default and this is the recommended state for this functionality. + +If you enable this setting, reparse point scanning will be enabled. + +If you disable or do not configure this setting, reparse point scanning will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on reparse point scanning* +- GP name: *Scan_DisableReparsePointScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to create a system restore point on the computer on a daily basis prior to cleaning. + +If you enable this setting, a system restore point will be created. + +If you disable or do not configure this setting, a system restore point will not be created. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Create a system restore point* +- GP name: *Scan_DisableRestorePoint* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning mapped network drives. + +If you enable this setting, mapped network drives will be scanned. + +If you disable or do not configure this setting, mapped network drives will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run full scan on mapped network drives* +- GP name: *Scan_DisableScanningMappedNetworkDrivesForFullScan* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting. + +If you enable this setting, network files will be scanned. + +If you disable or do not configure this setting, network files will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan network files* +- GP name: *Scan_DisableScanningNetworkFiles* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of maximum percentage of CPU utilization during scan. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for maximum percentage of CPU utilization* +- GP name: *Scan_LocalSettingOverrideAvgCPULoadFactor* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the scan type to use during a scheduled scan. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for the scan type to use for a scheduled scan* +- GP name: *Scan_LocalSettingOverrideScanParameters* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled scan day. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for schedule scan day* +- GP name: *Scan_LocalSettingOverrideScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled quick scan time. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for scheduled quick scan time* +- GP name: *Scan_LocalSettingOverrideScheduleQuickScantime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled scan time. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for scheduled scan time* +- GP name: *Scan_LocalSettingOverrideScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable or disable low CPU priority for scheduled scans. + +If you enable this setting, low CPU priority will be used during scheduled scans. + +If you disable or do not configure this setting, not changes will be made to CPU priority for scheduled scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure low CPU priority for scheduled scans* +- GP name: *Scan_LowCpuPriority* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of consecutive scheduled scans that can be missed after which a catch-up scan will be forced. By default, the value of this setting is 2 consecutive scheduled scans. + +If you enable this setting, a catch-up scan will occur after the specified number consecutive missed scheduled scans. + +If you disable or do not configure this setting, a catch-up scan will occur after the 2 consecutive missed scheduled scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days after which a catch-up scan is forced* +- GP name: *Scan_MissedScheduledScanCountBeforeCatchup* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the number of days items should be kept in the scan history folder before being permanently removed. The value represents the number of days to keep items in the folder. If set to zero, items will be kept forever and will not be automatically removed. By default, the value is set to 30 days. + +If you enable this setting, items will be removed from the scan history folder after the number of days specified. + +If you disable or do not configure this setting, items will be kept in the scan history folder for the default number of days. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on removal of items from scan history folder* +- GP name: *Scan_PurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify an interval at which to perform a quick scan. The time value is represented as the number of hours between quick scans. Valid values range from 1 (every hour) to 24 (once per day). If set to zero, interval quick scans will not occur. By default, this setting is set to 0. + +If you enable this setting, a quick scan will run at the interval specified. + +If you disable or do not configure this setting, a quick scan will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the interval to run quick scans per day* +- GP name: *Scan_QuickScanInterval* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scheduled scans to start only when your computer is on but not in use. + +If you enable or do not configure this setting, scheduled scans will only run when the computer is on but not in use. + +If you disable this setting, scheduled scans will run at the scheduled time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Start the scheduled scan only when computer is on but not in use* +- GP name: *Scan_ScanOnlyIfIdle* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never (default) + +If you enable this setting, a scheduled scan will run at the frequency specified. + +If you disable or do not configure this setting, a scheduled scan will run at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to run a scheduled scan* +- GP name: *Scan_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to perform a scheduled scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to a time value of 2:00 AM. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a scheduled scan will run at the time of day specified. + +If you disable or do not configure this setting, a scheduled scan will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time of day to run a scheduled scan* +- GP name: *Scan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not the antimalware service remains running when antivirus and antispyware security intelligence is disabled. It is recommended that this setting remain disabled. + +If you enable this setting, the antimalware service will always remain running even if both antivirus and antispyware security intelligence is disabled. + +If you disable or do not configure this setting, the antimalware service will be stopped when both antivirus and antispyware security intelligence is disabled. If the computer is restarted, the service will be started if it is set to Automatic startup. After the service has started, there will be a check to see if antivirus and antispyware security intelligence is enabled. If at least one is enabled, the service will remain running. If both are disabled, the service will be stopped. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to remain running always* +- GP name: *ServiceKeepAlive* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days that must pass before spyware security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. + +If you enable this setting, spyware security intelligence will be considered out of date after the number of days specified have passed without an update. + +If you disable or do not configure this setting, spyware security intelligence will be considered out of date after the default number of days have passed without an update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days before spyware security intelligence is considered out of date* +- GP name: *SignatureUpdate_ASSignatureDue* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days that must pass before virus security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. + +If you enable this setting, virus security intelligence will be considered out of date after the number of days specified have passed without an update. + +If you disable or do not configure this setting, virus security intelligence will be considered out of date after the default number of days have passed without an update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days before virus security intelligence is considered out of date* +- GP name: *SignatureUpdate_AVSignatureDue* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure UNC file share sources for downloading security intelligence updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources. For example: "{\\\unc1 | \\\unc2 }". The list is empty by default. + +If you enable this setting, the specified sources will be contacted for security intelligence updates. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. + +If you disable or do not configure this setting, the list will remain empty by default and no sources will be contacted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define file shares for downloading security intelligence updates* +- GP name: *SignatureUpdate_DefinitionUpdateFileSharesSources* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the automatic scan which starts after a security intelligence update has occurred. + +If you enable or do not configure this setting, a scan will start following a security intelligence update. + +If you disable this setting, a scan will not start following a security intelligence update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on scan after security intelligence update* +- GP name: *SignatureUpdate_DisableScanOnUpdate* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure security intelligence updates when the computer is running on battery power. + +If you enable or do not configure this setting, security intelligence updates will occur as usual regardless of power state. + +If you disable this setting, security intelligence updates will be turned off while the computer is running on battery power. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow security intelligence updates when running on battery power* +- GP name: *SignatureUpdate_DisableScheduledSignatureUpdateonBattery* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure security intelligence updates on startup when there is no antimalware engine present. + +If you enable or do not configure this setting, security intelligence updates will be initiated on startup when there is no antimalware engine present. + +If you disable this setting, security intelligence updates will not be initiated on startup when there is no antimalware engine present. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Initiate security intelligence update on startup* +- GP name: *SignatureUpdate_DisableUpdateOnStartupWithoutEngine* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: “InternalDefinitionUpdateServer”, “MicrosoftUpdateServer”, “MMPC”, and “FileShares”. + +For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } + +If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. + +If you disable or do not configure this setting, security intelligence update sources will be contacted in a default order. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the order of sources for downloading security intelligence updates* +- GP name: *SignatureUpdate_FallbackOrder* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable download of security intelligence updates from Microsoft Update even if the Automatic Updates default server is configured to another download source such as Windows Update. + +If you enable this setting, security intelligence updates will be downloaded from Microsoft Update. + +If you disable or do not configure this setting, security intelligence updates will be downloaded from the configured download source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow security intelligence updates from Microsoft Update* +- GP name: *SignatureUpdate_ForceUpdateFromMU* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable real-time security intelligence updates in response to reports sent to Microsoft MAPS. If the service reports a file as an unknown and Microsoft MAPS finds that the latest security intelligence update has security intelligence for a threat involving that file, the service will receive all of the latest security intelligence for that threat immediately. You must have configured your computer to join Microsoft MAPS for this functionality to work. + +If you enable or do not configure this setting, real-time security intelligence updates will be enabled. + +If you disable this setting, real-time security intelligence updates will disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow real-time security intelligence updates based on reports to Microsoft MAPS* +- GP name: *SignatureUpdate_RealtimeSignatureDelivery* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to check for security intelligence updates. The check can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day (default) +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never + +If you enable this setting, the check for security intelligence updates will occur at the frequency specified. + +If you disable or do not configure this setting, the check for security intelligence updates will occur at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to check for security intelligence updates* +- GP name: *SignatureUpdate_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. + +If you enable this setting, the check for security intelligence updates will occur at the time of day specified. + +If you disable or do not configure this setting, the check for security intelligence updates will occur at the default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time to check for security intelligence updates* +- GP name: *SignatureUpdate_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the security intelligence location for VDI-configured computers. + +If you disable or do not configure this setting, security intelligence will be referred from the default local source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define security intelligence location for VDI clients.* +- GP name: *SignatureUpdate_SharedSignaturesLocation* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the antimalware service to receive notifications to disable individual security intelligence in response to reports it sends to Microsoft MAPS. Microsoft MAPS uses these notifications to disable security intelligence that are causing false positive reports. You must have configured your computer to join Microsoft MAPS for this functionality to work. + +If you enable this setting or do not configure, the antimalware service will receive notifications to disable security intelligence. + +If you disable this setting, the antimalware service will not receive notifications to disable security intelligence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow notifications to disable security intelligence based reports to Microsoft MAPS* +- GP name: *SignatureUpdate_SignatureDisableNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days after which a catch-up security intelligence update will be required. By default, the value of this setting is 1 day. + +If you enable this setting, a catch-up security intelligence update will occur after the specified number of days. + +If you disable or do not configure this setting, a catch-up security intelligence update will be required after the default number of days. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days after which a catch-up security intelligence update is required* +- GP name: *SignatureUpdate_SignatureUpdateCatchupInterval* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a check for new virus and spyware security intelligence will occur immediately after service startup. + +If you enable this setting, a check for new security intelligence will occur after service startup. + +If you disable this setting or do not configure this setting, a check for new security intelligence will not occur after service startup. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Check for the latest virus and spyware security intelligence on startup* +- GP name: *SignatureUpdate_UpdateOnStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/SpynetReporting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. + +You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new security intelligence and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you. + +Possible options are: + +- (0x0) Disabled (default) +- (0x1) Basic membership +- (0x2) Advanced membership + +Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful. + +Advanced membership, in addition to basic information, will send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer. + +If you enable this setting, you will join Microsoft MAPS with the membership specified. + +If you disable or do not configure this setting, you will not join Microsoft MAPS. + +In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Join Microsoft MAPS* +- GP name: *SpynetReporting* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for reporting to Microsoft MAPS* +- GP name: *Spynet_LocalSettingOverrideSpynetReporting* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting customize which remediation action will be taken for each listed Threat ID when it is detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken. + +Valid remediation action values are: + +- 2 = Quarantine +- 3 = Remove +- 6 = Ignore + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify threats upon which default action should not be taken when detected* +- GP name: *Threats_ThreatIdDefaultAction* +- GP path: *Windows Components\Microsoft Defender Antivirus\Threats* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not to display additional text to clients when they need to perform an action. The text displayed is a custom administrator-defined string. For example, the phone number to call the company help desk. The client interface will only display a maximum of 1024 characters. Longer strings will be truncated before display. + +If you enable this setting, the additional text specified will be displayed. + +If you disable or do not configure this setting, there will be no additional text displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display additional text to clients when they need to perform an action* +- GP name: *UX_Configuration_CustomDefaultActionToastString* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Use this policy setting to specify if you want Microsoft Defender Antivirus notifications to display on clients. + +If you disable or do not configure this setting, Microsoft Defender Antivirus notifications will display on clients. + +If you enable this setting, Microsoft Defender Antivirus notifications will not display on clients. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Suppress all notifications* +- GP name: *UX_Configuration_Notification_Suppress* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows user to suppress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode). + +If you enable this setting AM UI won't show reboot notifications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Suppresses reboot notifications* +- GP name: *UX_Configuration_SuppressRebootNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + + +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not to display AM UI to the users. + +If you enable this setting AM UI won't be available to users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable headless UI mode* +- GP name: *UX_Configuration_UILockdown* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-mmc.md b/windows/client-management/mdm/policy-csp-admx-mmc.md new file mode 100644 index 0000000000..dc9f501685 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-mmc.md @@ -0,0 +1,446 @@ +--- +title: Policy CSP - ADMX_MMC +description: Policy CSP - ADMX_MMC +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/03/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MMC +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_MMC policies + +
    +
    + ADMX_MMC/MMC_ActiveXControl +
    +
    + ADMX_MMC/MMC_ExtendView +
    +
    + ADMX_MMC/MMC_LinkToWeb +
    +
    + ADMX_MMC/MMC_Restrict_Author +
    +
    + ADMX_MMC/MMC_Restrict_To_Permitted_Snapins +
    +
    + + +
    + + +**ADMX_MMC/MMC_ActiveXControl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits use of this snap-in. + +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. + +If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. + +To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. + +To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *ActiveX Control* +- GP name: *MMC_ActiveXControl* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMC.admx* + + + +
    + + +**ADMX_MMC/MMC_ExtendView** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits use of this snap-in. + +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. + +If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. + +To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. + +To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Extended View (Web View)* +- GP name: *MMC_ExtendView* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMC.admx* + + + +
    + + +**ADMX_MMC/MMC_LinkToWeb** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits use of this snap-in. + +If you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited. + +If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. + +To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited. + +- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. + +To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Link to Web Address* +- GP name: *MMC_LinkToWeb* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMC.admx* + + + +
    + + +**ADMX_MMC/MMC_Restrict_Author** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from entering author mode. + +This setting prevents users from opening the Microsoft Management Console (MMC) in author mode, explicitly opening console files in author mode, and opening any console files that open in author mode by default. + +As a result, users cannot create console files or add or remove snap-ins. Also, because they cannot open author-mode console files, they cannot use the tools that the files contain. + +This setting permits users to open MMC user-mode console files, such as those on the Administrative Tools menu in Windows 2000 Server family or Windows Server 2003 family. However, users cannot open a blank MMC console window on the Start menu. (To open the MMC, click Start, click Run, and type mmc.) Users also cannot open a blank MMC console window from a command prompt. + +If you disable this setting or do not configure it, users can enter author mode and open author-mode console files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict the user from entering author mode* +- GP name: *MMC_Restrict_Author* +- GP path: *Windows Components\Microsoft Management Console* +- GP ADMX file name: *MMC.admx* + + + +
    + + +**ADMX_MMC/MMC_Restrict_To_Permitted_Snapins** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you selectively permit or prohibit the use of Microsoft Management Console (MMC) snap-ins. + +- If you enable this setting, all snap-ins are prohibited, except those that you explicitly permit. Use this setting if you plan to prohibit use of most snap-ins. + +To explicitly permit a snap-in, open the Restricted/Permitted snap-ins setting folder and enable the settings representing the snap-in you want to permit. If a snap-in setting in the folder is disabled or not configured, the snap-in is prohibited. + +- If you disable this setting or do not configure it, all snap-ins are permitted, except those that you explicitly prohibit. Use this setting if you plan to permit use of most snap-ins. + +To explicitly prohibit a snap-in, open the Restricted/Permitted snap-ins setting folder and then disable the settings representing the snap-ins you want to prohibit. If a snap-in setting in the folder is enabled or not configured, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!NOTE] +> If you enable this setting, and you do not enable any settings in the Restricted/Permitted snap-ins folder, users cannot use any MMC snap-ins. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict users to the explicitly permitted list of snap-ins* +- GP name: *MMC_Restrict_To_Permitted_Snapins* +- GP path: *Windows Components\Microsoft Management Console* +- GP ADMX file name: *MMC.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md new file mode 100644 index 0000000000..dcbb289b4b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -0,0 +1,8450 @@ +--- +title: Policy CSP - ADMX_MMCSnapins +description: Policy CSP - ADMX_MMCSnapins +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MMCSnapins +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_MMCSnapins policies + +
    +
    + ADMX_MMCSnapins/MMC_ADMComputers_1 +
    +
    + ADMX_MMCSnapins/MMC_ADMComputers_2 +
    +
    + ADMX_MMCSnapins/MMC_ADMUsers_1 +
    +
    + ADMX_MMCSnapins/MMC_ADMUsers_2 +
    +
    + ADMX_MMCSnapins/MMC_ADSI +
    +
    + ADMX_MMCSnapins/MMC_ActiveDirDomTrusts +
    +
    + ADMX_MMCSnapins/MMC_ActiveDirSitesServices +
    +
    + ADMX_MMCSnapins/MMC_ActiveDirUsersComp +
    +
    + ADMX_MMCSnapins/MMC_AppleTalkRouting +
    +
    + ADMX_MMCSnapins/MMC_AuthMan +
    +
    + ADMX_MMCSnapins/MMC_CertAuth +
    +
    + ADMX_MMCSnapins/MMC_CertAuthPolSet +
    +
    + ADMX_MMCSnapins/MMC_Certs +
    +
    + ADMX_MMCSnapins/MMC_CertsTemplate +
    +
    + ADMX_MMCSnapins/MMC_ComponentServices +
    +
    + ADMX_MMCSnapins/MMC_ComputerManagement +
    +
    + ADMX_MMCSnapins/MMC_ConnectionSharingNAT +
    +
    + ADMX_MMCSnapins/MMC_DCOMCFG +
    +
    + ADMX_MMCSnapins/MMC_DFS +
    +
    + ADMX_MMCSnapins/MMC_DHCPRelayMgmt +
    +
    + ADMX_MMCSnapins/MMC_DeviceManager_1 +
    +
    + ADMX_MMCSnapins/MMC_DeviceManager_2 +
    +
    + ADMX_MMCSnapins/MMC_DiskDefrag +
    +
    + ADMX_MMCSnapins/MMC_DiskMgmt +
    +
    + ADMX_MMCSnapins/MMC_EnterprisePKI +
    +
    + ADMX_MMCSnapins/MMC_EventViewer_1 +
    +
    + ADMX_MMCSnapins/MMC_EventViewer_2 +
    +
    + ADMX_MMCSnapins/MMC_EventViewer_3 +
    +
    + ADMX_MMCSnapins/MMC_EventViewer_4 +
    +
    + ADMX_MMCSnapins/MMC_FAXService +
    +
    + ADMX_MMCSnapins/MMC_FailoverClusters +
    +
    + ADMX_MMCSnapins/MMC_FolderRedirection_1 +
    +
    + ADMX_MMCSnapins/MMC_FolderRedirection_2 +
    +
    + ADMX_MMCSnapins/MMC_FrontPageExt +
    +
    + ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn +
    +
    + ADMX_MMCSnapins/MMC_GroupPolicySnapIn +
    +
    + ADMX_MMCSnapins/MMC_GroupPolicyTab +
    +
    + ADMX_MMCSnapins/MMC_HRA +
    +
    + ADMX_MMCSnapins/MMC_IAS +
    +
    + ADMX_MMCSnapins/MMC_IASLogging +
    +
    + ADMX_MMCSnapins/MMC_IEMaintenance_1 +
    +
    + ADMX_MMCSnapins/MMC_IEMaintenance_2 +
    +
    + ADMX_MMCSnapins/MMC_IGMPRouting +
    +
    + ADMX_MMCSnapins/MMC_IIS +
    +
    + ADMX_MMCSnapins/MMC_IPRouting +
    +
    + ADMX_MMCSnapins/MMC_IPSecManage_GP +
    +
    + ADMX_MMCSnapins/MMC_IPXRIPRouting +
    +
    + ADMX_MMCSnapins/MMC_IPXRouting +
    +
    + ADMX_MMCSnapins/MMC_IPXSAPRouting +
    +
    + ADMX_MMCSnapins/MMC_IndexingService +
    +
    + ADMX_MMCSnapins/MMC_IpSecManage +
    +
    + ADMX_MMCSnapins/MMC_IpSecMonitor +
    +
    + ADMX_MMCSnapins/MMC_LocalUsersGroups +
    +
    + ADMX_MMCSnapins/MMC_LogicalMappedDrives +
    +
    + ADMX_MMCSnapins/MMC_NPSUI +
    +
    + ADMX_MMCSnapins/MMC_NapSnap +
    +
    + ADMX_MMCSnapins/MMC_NapSnap_GP +
    +
    + ADMX_MMCSnapins/MMC_Net_Framework +
    +
    + ADMX_MMCSnapins/MMC_OCSP +
    +
    + ADMX_MMCSnapins/MMC_OSPFRouting +
    +
    + ADMX_MMCSnapins/MMC_PerfLogsAlerts +
    +
    + ADMX_MMCSnapins/MMC_PublicKey +
    +
    + ADMX_MMCSnapins/MMC_QoSAdmission +
    +
    + ADMX_MMCSnapins/MMC_RAS_DialinUser +
    +
    + ADMX_MMCSnapins/MMC_RIPRouting +
    +
    + ADMX_MMCSnapins/MMC_RIS +
    +
    + ADMX_MMCSnapins/MMC_RRA +
    +
    + ADMX_MMCSnapins/MMC_RSM +
    +
    + ADMX_MMCSnapins/MMC_RemStore +
    +
    + ADMX_MMCSnapins/MMC_RemoteAccess +
    +
    + ADMX_MMCSnapins/MMC_RemoteDesktop +
    +
    + ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn +
    +
    + ADMX_MMCSnapins/MMC_Routing +
    +
    + ADMX_MMCSnapins/MMC_SCA +
    +
    + ADMX_MMCSnapins/MMC_SMTPProtocol +
    +
    + ADMX_MMCSnapins/MMC_SNMP +
    +
    + ADMX_MMCSnapins/MMC_ScriptsMachine_1 +
    +
    + ADMX_MMCSnapins/MMC_ScriptsMachine_2 +
    +
    + ADMX_MMCSnapins/MMC_ScriptsUser_1 +
    +
    + ADMX_MMCSnapins/MMC_ScriptsUser_2 +
    +
    + ADMX_MMCSnapins/MMC_SecuritySettings_1 +
    +
    + ADMX_MMCSnapins/MMC_SecuritySettings_2 +
    +
    + ADMX_MMCSnapins/MMC_SecurityTemplates +
    +
    + ADMX_MMCSnapins/MMC_SendConsoleMessage +
    +
    + ADMX_MMCSnapins/MMC_ServerManager +
    +
    + ADMX_MMCSnapins/MMC_ServiceDependencies +
    +
    + ADMX_MMCSnapins/MMC_Services +
    +
    + ADMX_MMCSnapins/MMC_SharedFolders +
    +
    + ADMX_MMCSnapins/MMC_SharedFolders_Ext +
    +
    + ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1 +
    +
    + ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2 +
    +
    + ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1 +
    +
    + ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2 +
    +
    + ADMX_MMCSnapins/MMC_SysInfo +
    +
    + ADMX_MMCSnapins/MMC_SysProp +
    +
    + ADMX_MMCSnapins/MMC_TPMManagement +
    +
    + ADMX_MMCSnapins/MMC_Telephony +
    +
    + ADMX_MMCSnapins/MMC_TerminalServices +
    +
    + ADMX_MMCSnapins/MMC_WMI +
    +
    + ADMX_MMCSnapins/MMC_WindowsFirewall +
    +
    + ADMX_MMCSnapins/MMC_WindowsFirewall_GP +
    +
    + ADMX_MMCSnapins/MMC_WiredNetworkPolicy +
    +
    + ADMX_MMCSnapins/MMC_WirelessMon +
    +
    + ADMX_MMCSnapins/MMC_WirelessNetworkPolicy +
    +
    + + +
    + + +**ADMX_MMCSnapins/MMC_ADMComputers_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Administrative Templates (Computers)* +- GP name: *MMC_ADMComputers_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + +
    + + +**ADMX_MMCSnapins/MMC_ADMComputers_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Administrative Templates (Computers)* +- GP name: *MMC_ADMComputers_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ADMUsers_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Administrative Templates (Users)* +- GP name: *MMC_ADMUsers_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ADMUsers_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Administrative Templates (Users)* +- GP name: *MMC_ADMUsers_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ADSI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *ADSI Edit* +- GP name: *MMC_ADSI* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ActiveDirDomTrusts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable.For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Active Directory Domains and Trusts* +- GP name: *MMC_ActiveDirDomTrusts* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ActiveDirSitesServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable.For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Active Directory Sites and Services* +- GP name: *MMC_ActiveDirSitesServices* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ActiveDirUsersComp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Active Directory Users and Computers* +- GP name: *MMC_ActiveDirUsersComp* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_AppleTalkRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *AppleTalk Routing* +- GP name: *MMC_AppleTalkRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_AuthMan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Authorization Manager* +- GP name: *MMC_AuthMan* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_CertAuth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Certification Authority* +- GP name: *MMC_CertAuth* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_CertAuthPolSet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Certification Authority Policy Settings* +- GP name: *MMC_CertAuthPolSet* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_Certs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Certificates* +- GP name: *MMC_Certs* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_CertsTemplate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Certificate Templates* +- GP name: *MMC_CertsTemplate* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ComponentServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Component Services* +- GP name: *MMC_ComponentServices* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ComputerManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Computer Management* +- GP name: *MMC_ComputerManagement* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ConnectionSharingNAT** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Connection Sharing (NAT)* +- GP name: *MMC_ConnectionSharingNAT* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_DCOMCFG** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DCOM Configuration Extension* +- GP name: *MMC_DCOMCFG* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_DFS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Distributed File System* +- GP name: *MMC_DFS* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_DHCPRelayMgmt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DHCP Relay Management* +- GP name: *MMC_DHCPRelayMgmt* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_DeviceManager_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Device Manager* +- GP name: *MMC_DeviceManager_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_DeviceManager_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Device Manager* +- GP name: *MMC_DeviceManager_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_DiskDefrag** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disk Defragmenter* +- GP name: *MMC_DiskDefrag* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_DiskMgmt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disk Management* +- GP name: *MMC_DiskMgmt* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_EnterprisePKI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enterprise PKI* +- GP name: *MMC_EnterprisePKI* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_EventViewer_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer* +- GP name: *MMC_EventViewer_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_EventViewer_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer (Windows Vista)* +- GP name: *MMC_EventViewer_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_EventViewer_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer* +- GP name: *MMC_EventViewer_3* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_EventViewer_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer (Windows Vista)* +- GP name: *MMC_EventViewer_4* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + + +
    + + +**ADMX_MMCSnapins/MMC_EventViewer_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event Viewer (Windows Vista)* +- GP name: *MMC_EventViewer_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_FAXService** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *FAX Service* +- GP name: *MMC_FAXService* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_FailoverClusters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Failover Clusters Manager* +- GP name: *MMC_FailoverClusters* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_FolderRedirection_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Folder Redirection* +- GP name: *MMC_FolderRedirection_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_FolderRedirection_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Folder Redirection* +- GP name: *MMC_FolderRedirection_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_FrontPageExt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *FrontPage Server Extensions* +- GP name: *MMC_FrontPageExt* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Group Policy Management* +- GP name: *MMC_GroupPolicyManagementSnapIn* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_GroupPolicySnapIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Group Policy Object Editor* +- GP name: *MMC_GroupPolicySnapIn* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_GroupPolicyTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits use of the Group Policy tab in property sheets for the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. + +If you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit displayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins. + +If this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this tab is displayed. + +- If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users will not have access to the Group Policy tab. + +To explicitly permit use of the Group Policy tab, enable this setting. If this setting is not configured (or disabled), the Group Policy tab is inaccessible. + +- If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users will have access to the Group Policy tab. + +To explicitly prohibit use of the Group Policy tab, disable this setting. If this setting is not configured (or enabled), the Group Policy tab is accessible. + +When the Group Policy tab is inaccessible, it does not appear in the site, domain, or organizational unit property sheets. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Group Policy tab for Active Directory Tools* +- GP name: *MMC_GroupPolicyTab* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_HRA** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Health Registration Authority (HRA)* +- GP name: *MMC_HRA* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IAS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Authentication Service (IAS)* +- GP name: *MMC_IAS* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IASLogging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IAS Logging* +- GP name: *MMC_IASLogging* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IEMaintenance_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer Maintenance* +- GP name: *MMC_IEMaintenance_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IEMaintenance_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer Maintenance* +- GP name: *MMC_IEMaintenance_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IGMPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IGMP Routing* +- GP name: *MMC_IGMPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IIS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Information Services* +- GP name: *MMC_IIS* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IP Routing* +- GP name: *MMC_IPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IPSecManage_GP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IP Security Policy Management* +- GP name: *MMC_IPSecManage_GP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IPXRIPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IPX RIP Routing* +- GP name: *MMC_IPXRIPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IPXRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IPX Routing* +- GP name: *MMC_IPXRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IPXSAPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IPX SAP Routing* +- GP name: *MMC_IPXSAPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IndexingService** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Indexing Service* +- GP name: *MMC_IndexingService* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IpSecManage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IP Security Policy Management* +- GP name: *MMC_IpSecManage* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_IpSecMonitor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IP Security Monitor* +- GP name: *MMC_IpSecMonitor* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_LocalUsersGroups** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Local Users and Groups* +- GP name: *MMC_LocalUsersGroups* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_LogicalMappedDrives** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Logical and Mapped Drives* +- GP name: *MMC_LogicalMappedDrives* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_NPSUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Network Policy Server (NPS)* +- GP name: *MMC_NPSUI* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_NapSnap** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *NAP Client Configuration* +- GP name: *MMC_NapSnap* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_NapSnap_GP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *NAP Client Configuration* +- GP name: *MMC_NapSnap_GP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_Net_Framework** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *.Net Framework Configuration* +- GP name: *MMC_Net_Framework* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_OCSP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Online Responder* +- GP name: *MMC_OCSP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_OSPFRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *OSPF Routing* +- GP name: *MMC_OSPFRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_PerfLogsAlerts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Performance Logs and Alerts* +- GP name: *MMC_PerfLogsAlerts* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_PublicKey** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Public Key Policies* +- GP name: *MMC_PublicKey* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_QoSAdmission** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *QoS Admission Control* +- GP name: *MMC_QoSAdmission* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_RAS_DialinUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *RAS Dialin - User Node* +- GP name: *MMC_RAS_DialinUser* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_RIPRouting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *RIP Routing* +- GP name: *MMC_RIPRouting* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_RIS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote Installation Services* +- GP name: *MMC_RIS* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_RRA** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Routing and Remote Access* +- GP name: *MMC_RRA* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_RSM** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Storage Management* +- GP name: *MMC_RSM* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_RemStore** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Storage* +- GP name: *MMC_RemStore* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_RemoteAccess** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote Access* +- GP name: *MMC_RemoteAccess* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_RemoteDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote Desktops* +- GP name: *MMC_RemoteDesktop* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Resultant Set of Policy snap-in* +- GP name: *MMC_ResultantSetOfPolicySnapIn* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_Routing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Routing* +- GP name: *MMC_Routing* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SCA** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Security Configuration and Analysis* +- GP name: *MMC_SCA* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SMTPProtocol** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SMTP Protocol* +- GP name: *MMC_SMTPProtocol* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SNMP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SNMP* +- GP name: *MMC_SNMP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ScriptsMachine_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scripts (Startup/Shutdown)* +- GP name: *MMC_ScriptsMachine_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ScriptsMachine_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scripts (Startup/Shutdown)* +- GP name: *MMC_ScriptsMachine_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ScriptsUser_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scripts (Logon/Logoff)* +- GP name: *MMC_ScriptsUser_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ScriptsUser_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scripts (Logon/Logoff)* +- GP name: *MMC_ScriptsUser_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SecuritySettings_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Security Settings* +- GP name: *MMC_SecuritySettings_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SecuritySettings_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Security Settings* +- GP name: *MMC_SecuritySettings_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SecurityTemplates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Security Templates* +- GP name: *MMC_SecurityTemplates* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SendConsoleMessage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send Console Message* +- GP name: *MMC_SendConsoleMessage* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ServerManager** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Server Manager* +- GP name: *MMC_ServerManager* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_ServiceDependencies** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Service Dependencies* +- GP name: *MMC_ServiceDependencies* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_Services** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Services* +- GP name: *MMC_Services* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SharedFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Shared Folders* +- GP name: *MMC_SharedFolders* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SharedFolders_Ext** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Shared Folders Ext* +- GP name: *MMC_SharedFolders_Ext* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Software Installation (Computers)* +- GP name: *MMC_SoftwareInstalationComputers_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Software Installation (Computers)* +- GP name: *MMC_SoftwareInstalationComputers_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Software Installation (Users)* +- GP name: *MMC_SoftwareInstallationUsers_1* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Software Installation (Users)* +- GP name: *MMC_SoftwareInstallationUsers_2* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SysInfo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *System Information* +- GP name: *MMC_SysInfo* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_SysProp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *System Properties* +- GP name: *MMC_SysProp* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_TPMManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *TPM Management* +- GP name: *MMC_TPMManagement* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_Telephony** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Telephony* +- GP name: *MMC_Telephony* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_TerminalServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remote Desktop Services Configuration* +- GP name: *MMC_TerminalServices* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_WMI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WMI Control* +- GP name: *MMC_WMI* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_WindowsFirewall** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Windows Firewall with Advanced Security* +- GP name: *MMC_WindowsFirewall* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_WindowsFirewall_GP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Windows Firewall with Advanced Security* +- GP name: *MMC_WindowsFirewall_GP* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_WiredNetworkPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Wired Network (IEEE 802.3) Policies* +- GP name: *MMC_WiredNetworkPolicy* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_WirelessMon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Wireless Monitor* +- GP name: *MMC_WirelessMon* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* +- GP ADMX file name: *MMCSnapins.admx* + + + + +
    + + +**ADMX_MMCSnapins/MMC_WirelessNetworkPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits or prohibits the use of this snap-in. + +If you enable this policy setting, the snap-in is permitted and can be added into the Microsoft Management Console or run from the command line as a standalone console. + +If you disable this policy setting, the snap-in is prohibited and cannot be added into the Microsoft Management Console or run from the command line as a standalone console. An error message is displayed stating that policy is prohibiting the use of this snap-in. + +If this policy setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy setting. If this policy setting is not configured or disabled, this snap-in is prohibited. + +- If the policy setting "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy setting. If this policy setting is not configured or enabled, the snap-in is permitted. + +When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Wireless Network (IEEE 802.11) Policies* +- GP name: *MMC_WirelessNetworkPolicy* +- GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* +- GP ADMX file name: *MMCSnapins.admx* + + + + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md new file mode 100644 index 0000000000..3532d29c56 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -0,0 +1,117 @@ +--- +title: Policy CSP - ADMX_MSAPolicy +description: Policy CSP - ADMX_MSAPolicy +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MSAPolicy +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_MSAPolicy policies + +
    +
    + ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine +
    +
    + + +
    + + +**ADMX_MSAPolicy/MicrosoftAccount_DisableUserAuth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether users can provide Microsoft accounts for authentication for applications or services. If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication. + +This applies both to existing users of a device and new users who may be added. However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires. + +It is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present. If this setting is disabled or not configured, applications and services can use Microsoft accounts for authentication. + +By default, this setting is Disabled. This setting does not affect whether users can sign in to devices by using Microsoft accounts, or the ability for users to provide Microsoft accounts via the browser for authentication with web-based applications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block all consumer Microsoft account user authentication* +- GP name: *MicrosoftAccount_DisableUserAuth* +- GP path: *Windows Components\Microsoft account* +- GP ADMX file name: *MSAPolicy.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-msched.md b/windows/client-management/mdm/policy-csp-admx-msched.md new file mode 100644 index 0000000000..c5cb159658 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-msched.md @@ -0,0 +1,192 @@ +--- +title: Policy CSP - ADMX_msched +description: Policy CSP - ADMX_msched +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_msched +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_msched policies + +
    +
    + ADMX_msched/ActivationBoundaryPolicy +
    +
    + ADMX_msched/RandomDelayPolicy +
    +
    + + +
    + + +**ADMX_msched/ActivationBoundaryPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Automatic Maintenance activation boundary. The maintenance activation boundary is the daily scheduled time at which Automatic Maintenance starts. + +If you enable this policy setting, this will override the default daily scheduled time as specified in Security and Maintenance/Automatic Maintenance Control Panel. + +If you disable or do not configure this policy setting, the daily scheduled time as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatic Maintenance Activation Boundary* +- GP name: *ActivationBoundaryPolicy* +- GP path: *Windows Components\Maintenance Scheduler* +- GP ADMX file name: *msched.admx* + + + +
    + + +**ADMX_msched/RandomDelayPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Automatic Maintenance activation random delay. + +The maintenance random delay is the amount of time up to which Automatic Maintenance will delay starting from its Activation Boundary. + +If you enable this policy setting, Automatic Maintenance will delay starting from its Activation Boundary, by up to this time. + +If you do not configure this policy setting, 4 hour random delay will be applied to Automatic Maintenance. + +If you disable this policy setting, no random delay will be applied to Automatic Maintenance. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatic Maintenance Random Delay* +- GP name: *RandomDelayPolicy* +- GP path: *Windows Components\Maintenance Scheduler* +- GP ADMX file name: *msched.admx* + + + +
    + + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md new file mode 100644 index 0000000000..e6ab53acce --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -0,0 +1,289 @@ +--- +title: Policy CSP - ADMX_MSDT +description: Policy CSP - ADMX_MSDT +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MSDT +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_MSDT policies + +
    +
    + ADMX_MSDT/MsdtSupportProvider +
    +
    + ADMX_MSDT/MsdtToolDownloadPolicy +
    +
    + ADMX_MSDT/WdiScenarioExecutionPolicy +
    +
    + + +
    + + +**ADMX_MSDT/MsdtSupportProvider** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures Microsoft Support Diagnostic Tool (MSDT) interactive communication with the support provider. MSDT gathers diagnostic data for analysis by support professionals. + +If you enable this policy setting, users can use MSDT to collect and send diagnostic data to a support professional to resolve a problem. + +By default, the support provider is set to Microsoft Corporation. + +If you disable this policy setting, MSDT cannot run in support mode, and no data can be collected or sent to the support provider. + +If you do not configure this policy setting, MSDT support mode is enabled by default. + +No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider* +- GP name: *MsdtSupportProvider* +- GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* + + + +
    + + +**ADMX_MSDT/MsdtToolDownloadPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the tool download policy for Microsoft Support Diagnostic Tool. + +Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals. + +For some problems, MSDT may prompt the user to download additional tools for troubleshooting. These tools are required to completely troubleshoot the problem. + +If tool download is restricted, it may not be possible to find the root cause of the problem. + +If you enable this policy setting for remote troubleshooting, MSDT prompts the user to download additional tools to diagnose problems on remote computers only. + +If you enable this policy setting for local and remote troubleshooting, MSDT always prompts for additional tool downloading. + +If you disable this policy setting, MSDT never downloads tools, and is unable to diagnose problems on remote computers. + +If you do not configure this policy setting, MSDT prompts the user before downloading any additional tools. No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately. + +This policy setting will take effect only when MSDT is enabled. + +This policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state. + +When the service is stopped or disabled, diagnostic scenarios are not executed. + +The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Support Diagnostic Tool: Restrict tool download* +- GP name: *MsdtToolDownloadPolicy* +- GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* + + + +
    + + +**ADMX_MSDT/WdiScenarioExecutionPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the execution level for Microsoft Support Diagnostic Tool. + +Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals. If you enable this policy setting, administrators can use MSDT to collect and send diagnostic data to a support professional to resolve a problem. + +If you disable this policy setting, MSDT cannot gather diagnostic data. If you do not configure this policy setting, MSDT is turned on by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Support Diagnostic Tool: Configure execution level* +- GP name: *WdiScenarioExecutionPolicy* +- GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md new file mode 100644 index 0000000000..3e2094f298 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -0,0 +1,1875 @@ +--- +title: Policy CSP - ADMX_MSI +description: Policy CSP - ADMX_MSI +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/16/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MSI +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_MSI policies + +
    +
    + ADMX_MSI/AllowLockdownBrowse +
    +
    + ADMX_MSI/AllowLockdownMedia +
    +
    + ADMX_MSI/AllowLockdownPatch +
    +
    + ADMX_MSI/DisableAutomaticApplicationShutdown +
    +
    + ADMX_MSI/DisableBrowse +
    +
    + ADMX_MSI/DisableFlyweightPatching +
    +
    + ADMX_MSI/DisableLoggingFromPackage +
    +
    + ADMX_MSI/DisableMSI +
    +
    + ADMX_MSI/DisableMedia +
    +
    + ADMX_MSI/DisablePatch +
    +
    + ADMX_MSI/DisableRollback_1 +
    +
    + ADMX_MSI/DisableRollback_2 +
    +
    + ADMX_MSI/DisableSharedComponent +
    +
    + ADMX_MSI/MSILogging +
    +
    + ADMX_MSI/MSI_DisableLUAPatching +
    +
    + ADMX_MSI/MSI_DisablePatchUninstall +
    +
    + ADMX_MSI/MSI_DisableSRCheckPoints +
    +
    + ADMX_MSI/MSI_DisableUserInstalls +
    +
    + ADMX_MSI/MSI_EnforceUpgradeComponentRules +
    +
    + ADMX_MSI/MSI_MaxPatchCacheSize +
    +
    + ADMX_MSI/MsiDisableEmbeddedUI +
    +
    + ADMX_MSI/SafeForScripting +
    +
    + ADMX_MSI/SearchOrder +
    +
    + ADMX_MSI/TransformsSecure +
    +
    + +
    + + +**ADMX_MSI/AllowLockdownBrowse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to search for installation files during privileged installations. + +If you enable this policy setting, the Browse button in the "Use feature from" dialog box is enabled. As a result, users can search for installation files even when the installation program is running with elevated system privileges. + +Because the installation is running with elevated system privileges, users can browse through directories that their own permissions would not allow. + +This policy setting does not affect installations that run in the user's security context. Also, see the "Remove browse dialog box for new source" policy setting. + +If you disable or do not configure this policy setting, by default, only system administrators can browse during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to browse for source while elevated* +- GP name: *AllowLockdownBrowse* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/AllowLockdownMedia** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to install programs from removable media during privileged installations. + +If you enable this policy setting, all users are permitted to install programs from removable media, such as floppy disks and CD-ROMs, even when the installation program is running with elevated system privileges. + +This policy setting does not affect installations that run in the user's security context. By default, users can install from removable media when the installation runs in their own security context. + +If you disable or do not configure this policy setting, by default, users can install programs from removable media only when the installation runs in the user's security context. During privileged installations, such as those offered on the desktop or displayed in Add or Remove Programs, only system administrators can install from removable media. + +Also, see the "Prevent removable media source for any install" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to use media source while elevated* +- GP name: *AllowLockdownMedia* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/AllowLockdownPatch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to patch elevated products. + +If you enable this policy setting, all users are permitted to install patches, even when the installation program is running with elevated system privileges. Patches are updates or upgrades that replace only those program files that have changed. Because patches can easily be vehicles for malicious programs, some installations prohibit their use. + +If you disable or do not configure this policy setting, by default, only system administrators can apply patches during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs. + +This policy setting does not affect installations that run in the user's security context. By default, users can install patches to programs that run in their own security context. Also, see the "Prohibit patching" policy setting. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to patch elevated products* +- GP name: *AllowLockdownPatch* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableAutomaticApplicationShutdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Windows Installer's interaction with the Restart Manager. The Restart Manager API can eliminate or reduce the number of system restarts that are required to complete an installation or update. + +If you enable this policy setting, you can use the options in the Prohibit Use of Restart Manager box to control file in use detection behavior. + +- The "Restart Manager On" option instructs Windows Installer to use Restart Manager to detect files in use and mitigate a system restart, when possible. + +- The "Restart Manager Off" option turns off Restart Manager for file in use detection and the legacy file in use behavior is used. + +- The "Restart Manager Off for Legacy App Setup" option applies to packages that were created for Windows Installer versions lesser than 4.0. This option lets those packages display the legacy files in use UI while still using Restart Manager for detection. + +If you disable or do not configure this policy setting, Windows Installer will use Restart Manager to detect files in use and mitigate a system restart, when possible. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit use of Restart Manager* +- GP name: *DisableAutomaticApplicationShutdown* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableBrowse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from searching for installation files when they add features or components to an installed program. + +If you enable this policy setting, the Browse button beside the "Use feature from" list in the Windows Installer dialog box is disabled. As a result, users must select an installation file source from the "Use features from" list that the system administrator configures. + +This policy setting applies even when the installation is running in the user's security context. + +If you disable or do not configure this policy setting, the Browse button is enabled when an installation is running in the user's security context. But only system administrators can browse when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs. + +This policy setting affects Windows Installer only. It does not prevent users from selecting other browsers, such as File Explorer or Network Locations, to search for installation files. + +Also, see the "Enable user to browse for source while elevated" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove browse dialog box for new source* +- GP name: *DisableBrowse* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableFlyweightPatching** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability to turn off all patch optimizations. + +If you enable this policy setting, all Patch Optimization options are turned off during the installation. + +If you disable or do not configure this policy setting, it enables faster application of patches by removing execution of unnecessary actions. The flyweight patching mode is primarily designed for patches that just update a few files or registry values. The Installer will analyze the patch for specific changes to determine if optimization is possible. If so, the patch will be applied using a minimal set of processing. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit flyweight patching* +- GP name: *DisableFlyweightPatching* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableLoggingFromPackage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Windows Installer's processing of the MsiLogging property. The MsiLogging property in an installation package can be used to enable automatic logging of all install operations for the package. + +If you enable this policy setting, you can use the options in the Disable logging via package settings box to control automatic logging via package settings behavior. + +- The "Logging via package settings on" option instructs Windows Installer to automatically generate log files for packages that include the MsiLogging property. + +- The "Logging via package settings off" option turns off the automatic logging behavior when specified via the MsiLogging policy. Log files can still be generated using the logging command line switch or the Logging policy. + +If you disable or do not configure this policy setting, Windows Installer will automatically generate log files for those packages that include the MsiLogging property. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off logging via package settings* +- GP name: *DisableLoggingFromPackage* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableMSI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the use of Windows Installer. + +If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting. + +- The "Never" option indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional and Windows Vista when the policy is not configured. + +- The "For non-managed applications only" option permits users to install only those programs that a system administrator assigns (offers on the desktop) or publishes (adds them to Add or Remove Programs). This is the default behavior of Windows Installer on Windows Server 2003 family when the policy is not configured. + +- The "Always" option indicates that Windows Installer is disabled. + +This policy setting affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Installer* +- GP name: *DisableMSI* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableMedia** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from installing any programs from removable media. + +If you enable this policy setting, if a user tries to install a program from removable media, such as CD-ROMs, floppy disks, and DVDs, a message appears stating that the feature cannot be found. + +This policy setting applies even when the installation is running in the user's security context. + +If you disable or do not configure this policy setting, users can install from removable media when the installation is running in their own security context, but only system administrators can use removable media when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs. + +Also, see the "Enable user to use media source while elevated" and "Hide the 'Add a program from CD-ROM or floppy disk' option" policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent removable media source for any installation* +- GP name: *DisableMedia* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisablePatch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from using Windows Installer to install patches. + +If you enable this policy setting, users are prevented from using Windows Installer to install patches. Patches are updates or upgrades that replace only those program files that have changed. Because patches can be easy vehicles for malicious programs, some installations prohibit their use. + +> [!NOTE] +> This policy setting applies only to installations that run in the user's security context. + +If you disable or do not configure this policy setting, by default, users who are not system administrators cannot apply patches to installations that run with elevated system privileges, such as those offered on the desktop or in Add or Remove Programs. + +Also, see the "Enable user to patch elevated products" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from using Windows Installer to install updates and upgrades* +- GP name: *DisablePatch* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableRollback_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. + +If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. + +This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential. + +This policy setting appears in the Computer Configuration and User Configuration folders. If the policy setting is enabled in either folder, it is considered be enabled, even if it is explicitly disabled in the other folder. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit rollback* +- GP name: *DisableRollback_1* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableRollback_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. + +If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. + +This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential. + +This policy setting appears in the Computer Configuration and User Configuration folders. If the policy setting is enabled in either folder, it is considered be enabled, even if it is explicitly disabled in the other folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit rollback* +- GP name: *DisableRollback_2* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/DisableSharedComponent** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability to turn off shared components. + +If you enable this policy setting, no packages on the system get the shared component functionality enabled by the msidbComponentAttributesShared attribute in the Component Table. + +If you disable or do not configure this policy setting, by default, the shared component functionality is allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off shared components* +- GP name: *DisableSharedComponent* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/MSILogging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the types of events that Windows Installer records in its transaction log for each installation. The log, Msi.log, appears in the Temp directory of the system volume. + +When you enable this policy setting, you can specify the types of events you want Windows Installer to record. To indicate that an event type is recorded, type the letter representing the event type. You can type the letters in any order and list as many or as few event types as you want. + +To disable logging, delete all of the letters from the box. + +If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the types of events Windows Installer records in its transaction log* +- GP name: *MSILogging* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + + +**ADMX_MSI/MSI_DisableLUAPatching** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. + +Non-administrator updates provide a mechanism for the author of an application to create digitally signed updates that can be applied by non-privileged users. + +If you enable this policy setting, only administrators or users with administrative privileges can apply updates to Windows Installer based applications. + +If you disable or do not configure this policy setting, users without administrative privileges can install non-administrator updates. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit non-administrators from applying vendor signed updates* +- GP name: *MSI_DisableLUAPatching* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + + +**ADMX_MSI/MSI_DisablePatchUninstall** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability for users or administrators to remove Windows Installer based updates. + +This policy setting should be used if you need to maintain a tight control over updates. One example is a lockdown environment where you want to ensure that updates once installed cannot be removed by users or administrators. + +If you enable this policy setting, updates cannot be removed from the computer by a user or an administrator. The Windows Installer can still remove an update that is no longer applicable to the product. + +If you disable or do not configure this policy setting, a user can remove an update from the computer only if the user has been granted privileges to remove the update. This can depend on whether the user is an administrator, whether "Disable Windows Installer" and "Always install with elevated privileges" policy settings are set, and whether the update was installed in a per-user managed, per-user unmanaged, or per-machine context." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit removal of updates* +- GP name: *MSI_DisablePatchUninstall* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + + +**ADMX_MSI/MSI_DisableSRCheckPoints** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents Windows Installer from creating a System Restore checkpoint each time an application is installed. System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. + +If you enable this policy setting, the Windows Installer does not generate System Restore checkpoints when installing applications. + +If you disable or do not configure this policy setting, by default, the Windows Installer automatically creates a System Restore checkpoint each time an application is installed, so that users can restore their computer to the state it was in before installing the application. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off creation of System Restore checkpoints* +- GP name: *MSI_DisableSRCheckPoints* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + + +**ADMX_MSI/MSI_DisableUserInstalls** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure user installs. To configure this policy setting, set it to enabled and use the drop-down list to select the behavior you want. + +If you do not configure this policy setting, or if the policy setting is enabled and "Allow User Installs" is selected, the installer allows and makes use of products that are installed per user, and products that are installed per computer. If the installer finds a per-user install of an application, this hides a per-computer installation of that same product. + +If you enable this policy setting and "Hide User Installs" is selected, the installer ignores per-user applications. This causes a per-computer installed application to be visible to users, even if those users have a per-user install of the product registered in their user profile. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit User Installs* +- GP name: *MSI_DisableUserInstalls* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + + +**ADMX_MSI/MSI_EnforceUpgradeComponentRules** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting causes the Windows Installer to enforce strict rules for component upgrades. + +If you enable this policy setting, strict upgrade rules will be enforced by the Windows Installer which may cause some upgrades to fail. Upgrades can fail if they attempt to do one of the following: + +(1) Remove a component from a feature. +This can also occur if you change the GUID of a component. The component identified by the original GUID appears to be removed and the component as identified by the new GUID appears as a new component. + +(2) Add a new feature to the top or middle of an existing feature tree. +The new feature must be added as a new leaf feature to an existing feature tree. + +If you disable or do not configure this policy setting, the Windows Installer will use less restrictive rules for component upgrades. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enforce upgrade component rules* +- GP name: *MSI_EnforceUpgradeComponentRules* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/MSI_MaxPatchCacheSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls the percentage of disk space available to the Windows Installer baseline file cache. + +The Windows Installer uses the baseline file cache to save baseline files modified by binary delta difference updates. The cache is used to retrieve the baseline file for future updates. The cache eliminates user prompts for source media when new updates are applied. + +If you enable this policy setting you can modify the maximum size of the Windows Installer baseline file cache. + +If you set the baseline cache size to 0, the Windows Installer will stop populating the baseline cache for new updates. The existing cached files will remain on disk and will be deleted when the product is removed. + +If you set the baseline cache to 100, the Windows Installer will use available free space for the baseline file cache. + +If you disable or do not configure this policy setting, the Windows Installer will uses a default value of 10 percent for the baseline file cache maximum size. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control maximum size of baseline file cache* +- GP name: *MSI_MaxPatchCacheSize* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/MsiDisableEmbeddedUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability to prevent embedded UI. + +If you enable this policy setting, no packages on the system can run embedded UI. + +If you disable or do not configure this policy setting, embedded UI is allowed to run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent embedded UI* +- GP name: *MsiDisableEmbeddedUI* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/SafeForScripting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows Web-based programs to install software on the computer without notifying the user. + +If you disable or do not configure this policy setting, by default, when a script hosted by an Internet browser tries to install a program on the system, the system warns users and allows them to select or refuse the installation. + +If you enable this policy setting, the warning is suppressed and allows the installation to proceed. + +This policy setting is designed for enterprises that use Web-based tools to distribute programs to their employees. However, because this policy setting can pose a security risk, it should be applied cautiously. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Internet Explorer security prompt for Windows Installer scripts* +- GP name: *SafeForScripting* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/SearchOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the order in which Windows Installer searches for installation files. + +If you disable or do not configure this policy setting, by default, the Windows Installer searches the network first, then removable media (floppy drive, CD-ROM, or DVD), and finally, the Internet (URL). + +If you enable this policy setting, you can change the search order by specifying the letters representing each file source in the order that you want Windows Installer to search: + +- "n" represents the network +- "m" represents media +- "u" represents URL, or the Internet + +To exclude a file source, omit or delete the letter representing that source type. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the order in which Windows Installer searches for installation files* +- GP name: *SearchOrder* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + + +
    + + +**ADMX_MSI/TransformsSecure** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting saves copies of transform files in a secure location on the local computer. + +Transform files consist of instructions to modify or customize a program during installation. + +If you enable this policy setting, the transform file is saved in a secure location on the user's computer. + +If you do not configure this policy setting on Windows Server 2003, Windows Installer requires the transform file in order to repeat an installation in which the transform file was used, therefore, the user must be using the same computer or be connected to the original or identical media to reinstall, remove, or repair the installation. + +This policy setting is designed for enterprises to prevent unauthorized or malicious editing of transform files. + +If you disable this policy setting, Windows Installer stores transform files in the Application Data directory in the user's profile. + +If you do not configure this policy setting on Windows 2000 Professional, Windows XP Professional and Windows Vista, when a user reinstalls, removes, or repairs an installation, the transform file is available, even if the user is on a different computer or is not connected to the network. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Save copies of transform files in a secure location on workstation* +- GP name: *TransformsSecure* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md new file mode 100644 index 0000000000..aaa011b575 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -0,0 +1,627 @@ +--- +title: Policy CSP - ADMX_nca +description: Policy CSP - ADMX_nca +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_nca +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_nca policies + +
    +
    + ADMX_nca/CorporateResources +
    +
    + ADMX_nca/CustomCommands +
    +
    + ADMX_nca/DTEs +
    +
    + ADMX_nca/FriendlyName +
    +
    + ADMX_nca/LocalNamesOn +
    +
    + ADMX_nca/PassiveMode +
    +
    + ADMX_nca/ShowUI +
    +
    + ADMX_nca/SupportEmail +
    +
    + + +
    + + +**ADMX_nca/CorporateResources** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies resources on your intranet that are normally accessible to DirectAccess clients. Each entry is a string that identifies the type of resource and the location of the resource. + +Each string can be one of the following types: + +- A DNS name or IPv6 address that NCA pings. The syntax is “PING:” followed by a fully qualified domain name (FQDN) that resolves to an IPv6 address, or an IPv6 address. Examples: PING:myserver.corp.contoso.com or PING:2002:836b:1::1. + +> [!NOTE] +> We recommend that you use FQDNs instead of IPv6 addresses wherever possible. + +> [!IMPORTANT] +> At least one of the entries must be a PING: resource. +> - A Uniform Resource Locator (URL) that NCA queries with a Hypertext Transfer Protocol (HTTP) request. The contents of the web page do not matter. The syntax is “HTTP:” followed by a URL. The host portion of the URL must resolve to an IPv6 address of a Web server or contain an IPv6 address. Examples: HTTP:http://myserver.corp.contoso.com/ or HTTP:http://2002:836b:1::1/. +> - A Universal Naming Convention (UNC) path to a file that NCA checks for existence. The contents of the file do not matter. The syntax is “FILE:” followed by a UNC path. The ComputerName portion of the UNC path must resolve to an IPv6 address or contain an IPv6 address. Examples: FILE:\\myserver\myshare\test.txt or FILE:\\2002:836b:1::1\myshare\test.txt. + +You must configure this setting to have complete NCA functionality. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Corporate Resources* +- GP name: *CorporateResources* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
    + + +**ADMX_nca/CustomCommands** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies commands configured by the administrator for custom logging. These commands will run in addition to default log commands. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Commands* +- GP name: *CustomCommands* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
    + + +**ADMX_nca/DTEs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the IPv6 addresses of the endpoints of the Internet Protocol security (IPsec) tunnels that enable DirectAccess. NCA attempts to access the resources that are specified in the Corporate Resources setting through these configured tunnel endpoints. + +By default, NCA uses the same DirectAccess server that the DirectAccess client computer connection is using. In default configurations of DirectAccess, there are typically two IPsec tunnel endpoints: one for the infrastructure tunnel and one for the intranet tunnel. You should configure one endpoint for each tunnel. + +Each entry consists of the text PING: followed by the IPv6 address of an IPsec tunnel endpoint. Example: PING:2002:836b:1::836b:1. + +You must configure this setting to have complete NCA functionality. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *IPsec Tunnel Endpoints* +- GP name: *DTEs* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
    + + +**ADMX_nca/FriendlyName** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the string that appears for DirectAccess connectivity when the user clicks the Networking notification area icon. For example, you can specify “Contoso Intranet Access” for the DirectAccess clients of the Contoso Corporation. + +If this setting is not configured, the string that appears for DirectAccess connectivity is “Corporate Connection”. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Friendly Name* +- GP name: *FriendlyName* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
    + + +**ADMX_nca/LocalNamesOn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the user has Connect and Disconnect options for the DirectAccess entry when the user clicks the Networking notification area icon. + +If the user clicks the Disconnect option, NCA removes the DirectAccess rules from the Name Resolution Policy Table (NRPT) and the DirectAccess client computer uses whatever normal name resolution is available to the client computer in its current network configuration, including sending all DNS queries to the local intranet or Internet DNS servers. Note that NCA does not remove the existing IPsec tunnels and users can still access intranet resources across the DirectAccess server by specifying IPv6 addresses rather than names. + +The ability to disconnect allows users to specify single-label, unqualified names (such as “PRINTSVR”) for local resources when connected to a different intranet and for temporary access to intranet resources when network location detection has not correctly determined that the DirectAccess client computer is connected to its own intranet. + +To restore the DirectAccess rules to the NRPT and resume normal DirectAccess functionality, the user clicks Connect. + +> [!NOTE] +> If the DirectAccess client computer is on the intranet and has correctly determined its network location, the Disconnect option has no effect because the rules for DirectAccess are already removed from the NRPT. + +If this setting is not configured, users do not have Connect or Disconnect options. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prefer Local Names Allowed* +- GP name: *LocalNamesOn* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
    + + +**ADMX_nca/PassiveMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether NCA service runs in Passive Mode or not. + +Set this to Disabled to keep NCA probing actively all the time. If this setting is not configured, NCA probing is in active mode by default. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *DirectAccess Passive Mode* +- GP name: *PassiveMode* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
    + + +**ADMX_nca/ShowUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether an entry for DirectAccess connectivity appears when the user clicks the Networking notification area icon. + +Set this to Disabled to prevent user confusion when you are just using DirectAccess to remotely manage DirectAccess client computers from your intranet and not providing seamless intranet access. + +If this setting is not configured, the entry for DirectAccess connectivity appears. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *User Interface* +- GP name: *ShowUI* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
    + + +**ADMX_nca/SupportEmail** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the e-mail address to be used when sending the log files that are generated by NCA to the network administrator. + +When the user sends the log files to the Administrator, NCA uses the default e-mail client to open a new message with the support email address in the To: field of the message, then attaches the generated log files as a .html file. The user can review the message and add additional information before sending the message. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Support Email Address* +- GP name: *SupportEmail* +- GP path: *Network\DirectAccess Client Experience Settings* +- GP ADMX file name: *nca.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md new file mode 100644 index 0000000000..2dc203705f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -0,0 +1,522 @@ +--- +title: Policy CSP - ADMX_NCSI +description: Policy CSP - ADMX_NCSI +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_NCSI +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_NCSI policies + +
    +
    + ADMX_NCSI/NCSI_CorpDnsProbeContent +
    +
    + ADMX_NCSI/NCSI_CorpDnsProbeHost +
    +
    + ADMX_NCSI/NCSI_CorpSitePrefixes +
    +
    + ADMX_NCSI/NCSI_CorpWebProbeUrl +
    +
    + ADMX_NCSI/NCSI_DomainLocationDeterminationUrl +
    +
    + ADMX_NCSI/NCSI_GlobalDns +
    +
    + ADMX_NCSI/NCSI_PassivePolling +
    +
    + + +
    + + +**ADMX_NCSI/NCSI_CorpDnsProbeContent** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables you to specify the expected address of the host name used for the DNS probe. Successful resolution of the host name to this address indicates corporate connectivity. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify corporate DNS probe host address* +- GP name: *NCSI_CorpDnsProbeContent* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
    + + +**ADMX_NCSI/NCSI_CorpDnsProbeHost** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables you to specify the host name of a computer known to be on the corporate network. Successful resolution of this host name to the expected address indicates corporate connectivity. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify corporate DNS probe host name* +- GP name: *NCSI_CorpDnsProbeHost* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
    + + +**ADMX_NCSI/NCSI_CorpSitePrefixes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables you to specify the list of IPv6 corporate site prefixes to monitor for corporate connectivity. Reachability of addresses with any of these prefixes indicates corporate connectivity. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify corporate site prefix list* +- GP name: *NCSI_CorpSitePrefixes* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
    + + +**ADMX_NCSI/NCSI_CorpWebProbeUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables you to specify the URL of the corporate website, against which an active probe is performed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify corporate Website probe URL* +- GP name: *NCSI_CorpWebProbeUrl* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
    + + +
    + + +**ADMX_NCSI/NCSI_DomainLocationDeterminationUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables you to specify the HTTPS URL of the corporate website that clients use to determine the current domain location (i.e. whether the computer is inside or outside the corporate network). Reachability of the URL destination indicates that the client location is inside corporate network; otherwise it is outside the network. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify domain location determination URL* +- GP name: *NCSI_DomainLocationDeterminationUrl* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
    + + +**ADMX_NCSI/NCSI_GlobalDns** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables you to specify DNS binding behavior. NCSI by default will restrict DNS lookups to the interface it is currently probing on. If you enable this setting, NCSI will allow the DNS lookups to happen on any interface. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify global DNS* +- GP name: *NCSI_GlobalDns* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
    + + +**ADMX_NCSI/NCSI_PassivePolling** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This Policy setting enables you to specify passive polling behavior. NCSI polls various measurements throughout the network stack on a frequent interval to determine if network connectivity has been lost. Use the options to control the passive polling behavior. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify passive polling* +- GP name: *NCSI_PassivePolling* +- GP path: *Network\Network Connectivity Status Indicator* +- GP ADMX file name: *NCSI.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md new file mode 100644 index 0000000000..45405c7cc2 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -0,0 +1,2768 @@ +--- +title: Policy CSP - ADMX_Netlogon +description: Policy CSP - ADMX_Netlogon +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/15/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Netlogon +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Netlogon policies + +
    +
    + ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior +
    +
    + ADMX_Netlogon/Netlogon_AddressTypeReturned +
    +
    + ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch +
    +
    + ADMX_Netlogon/Netlogon_AllowNT4Crypto +
    +
    + ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain +
    +
    + ADMX_Netlogon/Netlogon_AutoSiteCoverage +
    +
    + ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery +
    +
    + ADMX_Netlogon/Netlogon_AvoidPdcOnWan +
    +
    + ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod +
    +
    + ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod +
    +
    + ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime +
    +
    + ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod +
    +
    + ADMX_Netlogon/Netlogon_DebugFlag +
    +
    + ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords +
    +
    + ADMX_Netlogon/Netlogon_DnsRefreshInterval +
    +
    + ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames +
    +
    + ADMX_Netlogon/Netlogon_DnsTtl +
    +
    + ADMX_Netlogon/Netlogon_ExpectedDialupDelay +
    +
    + ADMX_Netlogon/Netlogon_ForceRediscoveryInterval +
    +
    + ADMX_Netlogon/Netlogon_GcSiteCoverage +
    +
    + ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages +
    +
    + ADMX_Netlogon/Netlogon_LdapSrvPriority +
    +
    + ADMX_Netlogon/Netlogon_LdapSrvWeight +
    +
    + ADMX_Netlogon/Netlogon_MaximumLogFileSize +
    +
    + ADMX_Netlogon/Netlogon_NdncSiteCoverage +
    +
    + ADMX_Netlogon/Netlogon_NegativeCachePeriod +
    +
    + ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode +
    +
    + ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod +
    +
    + ADMX_Netlogon/Netlogon_PingUrgencyMode +
    +
    + ADMX_Netlogon/Netlogon_ScavengeInterval +
    +
    + ADMX_Netlogon/Netlogon_SiteCoverage +
    +
    + ADMX_Netlogon/Netlogon_SiteName +
    +
    + ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode +
    +
    + ADMX_Netlogon/Netlogon_TryNextClosestSite +
    +
    + ADMX_Netlogon/Netlogon_UseDynamicDns +
    +
    + + +
    + + +**ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures how a domain controller (DC) behaves when responding to a client whose IP address does not map to any configured site. + +Domain controllers use the client IP address during a DC locator ping request to compute which Active Directory site the client belongs to. If no site mapping can be computed, the DC may do an address lookup on the client network name to discover other IP addresses which may then be used to compute a matching site for the client. + +The allowable values for this setting result in the following behaviors: + +- 0 - DCs will never perform address lookups. +- 1 - DCs will perform an exhaustive address lookup to discover additional client IP addresses. +- 2 - DCs will perform a fast, DNS-only address lookup to discover additional client IP addresses. + +To specify this behavior in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 2. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify address lookup behavior for DC locator ping* +- GP name: *Netlogon_AddressLookupOnPingBehavior* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + + +**ADMX_Netlogon/Netlogon_AddressTypeReturned** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the type of IP address that is returned for a domain controller. The DC Locator APIs return the IP address of the DC with the other parts of information. Before the support of IPv6, the returned DC IP address was IPv4. But with the support of IPv6, the DC Locator APIs can return IPv6 DC address. The returned IPv6 DC address may not be correctly handled by some of the existing applications. So this policy is provided to support such scenarios. + +By default, DC Locator APIs can return IPv4/IPv6 DC address. But if some applications are broken due to the returned IPv6 DC address, this policy can be used to disable the default behavior and enforce to return only IPv4 DC address. Once applications are fixed, this policy can be used to enable the default behavior. + +If you enable this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator. + +If you disable this policy setting, DC Locator APIs will ONLY return IPv4 DC address if any. So if the domain controller supports both IPv4 and IPv6 addresses, DC Locator APIs will return IPv4 address. But if the domain controller supports only IPv6 address, then DC Locator APIs will fail. + +If you do not configure this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Return domain controller address type* +- GP name: *Netlogon_AddressTypeReturned* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the computers to which this setting is applied attempts DNS name resolution of single-label domain names, by appending different registered DNS suffixes, and uses NetBIOS name resolution only if DNS name resolution fails. This policy, including the specified default behavior, is not used if the AllowSingleLabelDnsDomain policy setting is enabled. + +By default, when no setting is specified for this policy, the behavior is the same as explicitly enabling this policy, unless the AllowSingleLabelDnsDomain policy setting is enabled. + +If you enable this policy setting, when the AllowSingleLabelDnsDomain policy is not enabled, computers to which this policy is applied, will locate a domain controller hosting an Active Directory domain specified with a single-label name, by appending different registered DNS suffixes to perform DNS name resolution. The single-label name is not used without appending DNS suffixes unless the computer is joined to a domain that has a single-label DNS name in the Active Directory forest. NetBIOS name resolution is performed on the single-label name only, in the event that DNS resolution fails. + +If you disable this policy setting, when the AllowSingleLabelDnsDomain policy is not enabled, computers to which this policy is applied, will only use NetBIOS name resolution to attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name. The computers will not attempt DNS name resolution in this case, unless the computer is searching for a domain with a single label DNS name to which this computer is joined, in the Active Directory forest. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use DNS name resolution when a single-label domain name is used, by appending different registered DNS suffixes, if the AllowSingleLabelDnsDomain setting is not enabled.* +- GP name: *Netlogon_AllowDnsSuffixSearch* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_AllowNT4Crypto** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the Net Logon service will allow the use of older cryptography algorithms that are used in Windows NT 4.0. The cryptography algorithms used in Windows NT 4.0 and earlier are not as secure as newer algorithms used in Windows 2000 or later, including this version of Windows. + +By default, Net Logon will not allow the older cryptography algorithms to be used and will not include them in the negotiation of cryptography algorithms. Therefore, computers running Windows NT 4.0 will not be able to establish a connection to this domain controller. + +If you enable this policy setting, Net Logon will allow the negotiation and use of older cryptography algorithms compatible with Windows NT 4.0. However, using the older algorithms represents a potential security risk. + +If you disable this policy setting, Net Logon will not allow the negotiation and use of older cryptography algorithms. + +If you do not configure this policy setting, Net Logon will not allow the negotiation and use of older cryptography algorithms. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow cryptography algorithms compatible with Windows NT 4.0* +- GP name: *Netlogon_AllowNT4Crypto* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names. + +By default, the behavior specified in the AllowDnsSuffixSearch is used. If the AllowDnsSuffixSearch policy is disabled, then NetBIOS name resolution is used exclusively, to locate a domain controller hosting an Active Directory domain specified with a single-label name. + +If you enable this policy setting, computers to which this policy is applied will attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name using DNS name resolution. + +If you disable this policy setting, computers to which this setting is applied will use the AllowDnsSuffixSearch policy, if it is not disabled or perform NetBIOS name resolution otherwise, to attempt to locate a domain controller that hosts an Active Directory domain specified with a single-label name. the computers will not the DNS name resolution in this case, unless the computer is searching for a domain with a single label DNS name that exists in the Active Directory forest to which this computer is joined. + +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC* +- GP name: *Netlogon_AllowSingleLabelDnsDomain* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_AutoSiteCoverage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether domain controllers (DC) will dynamically register DC Locator site-specific SRV records for the closest sites where no DC for the same domain exists (or no Global Catalog for the same forest exists). These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. + +If you enable this policy setting, the DCs to which this setting is applied dynamically register DC Locator site-specific DNS SRV records for the closest sites where no DC for the same domain, or no Global Catalog for the same forest, exists. + +If you disable this policy setting, the DCs will not register site-specific DC Locator DNS SRV records for any other sites but their own. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use automated site coverage by the DC Locator DNS SRV Records* +- GP name: *Netlogon_AutoSiteCoverage* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control the domain controller (DC) location algorithm. By default, the DC location algorithm prefers DNS-based discovery if the DNS domain name is known. If DNS-based discovery fails and the NetBIOS domain name is known, the algorithm then uses NetBIOS-based discovery as a fallback mechanism. + +NetBIOS-based discovery uses a WINS server and mailslot messages but does not use site information. Hence it does not ensure that clients will discover the closest DC. It also allows a hub-site client to discover a branch-site DC even if the branch-site DC only registers site-specific DNS records (as recommended). For these reasons, NetBIOS-based discovery is not recommended. + +> [!NOTE] +> This policy setting does not affect NetBIOS-based discovery for DC location if only the NetBIOS domain name is known. + +If you enable or do not configure this policy setting, the DC location algorithm does not use NetBIOS-based discovery as a fallback mechanism when DNS-based discovery fails. This is the default behavior. + +If you disable this policy setting, the DC location algorithm can use NetBIOS-based discovery as a fallback mechanism when DNS based discovery fails. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not use NetBIOS-based discovery for domain controller location when DNS-based discovery fails* +- GP name: *Netlogon_AvoidFallbackNetbiosDiscovery* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_AvoidPdcOnWan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines whether a domain controller (DC) should attempt to verify the password provided by a client with the PDC emulator if the DC failed to validate the password. + +Contacting the PDC emulator is useful in case the client’s password was recently changed and did not propagate to the DC yet. Users may want to disable this feature if the PDC emulator is located over a slow WAN connection. + +If you enable this policy setting, the DCs to which this policy setting applies will attempt to verify a password with the PDC emulator if the DC fails to validate the password. + +If you disable this policy setting, the DCs will not attempt to verify any passwords with the PDC emulator. + +If you do not configure this policy setting, it is not applied to any DCs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Contact PDC on logon failure* +- GP name: *Netlogon_AvoidPdcOnWan* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the amount of time (in seconds) to wait before the first retry for applications that perform periodic searches for domain controllers (DC) that are unable to find a DC. + +The default value for this setting is 10 minutes (10*60). + +The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0. + +This setting is relevant only to those callers of DsGetDcName that have specified the DS_BACKGROUND_ONLY flag. + +If the value of this setting is less than the value specified in the NegativeCachePeriod subkey, the value in the NegativeCachePeriod subkey is used. + +> [!WARNING] +> If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value set in this setting is very small and the DC is not available, the traffic caused by periodic DC discoveries may be excessive. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use initial DC discovery retry setting for background callers* +- GP name: *Netlogon_BackgroundRetryInitialPeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the maximum retry interval allowed when applications performing periodic searches for Domain Controllers (DCs) are unable to find a DC. + +For example, the retry intervals may be set at 10 minutes, then 20 minutes and then 40 minutes, but when the interval reaches the value set in this setting, that value becomes the retry interval for all subsequent retries until the value set in Final DC Discovery Retry Setting is reached. + +The default value for this setting is 60 minutes (60*60). + +The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0. + +If the value for this setting is smaller than the value specified for the Initial DC Discovery Retry Setting, the Initial DC Discovery Retry Setting is used. + +> [!WARNING] +> If the value for this setting is too large, a client may take very long periods to try to find a DC. + +If the value for this setting is too small and the DC is not available, the frequent retries may produce excessive network traffic. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use maximum DC discovery retry interval setting for background callers* +- GP name: *Netlogon_BackgroundRetryMaximumPeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when retries are no longer allowed for applications that perform periodic searches for domain controllers (DC) are unable to find a DC. For example, retires may be set to occur according to the Use maximum DC discovery retry interval policy setting, but when the value set in this policy setting is reached, no more retries occur. If a value for this policy setting is smaller than the value in the Use maximum DC discovery retry interval policy setting, the value for Use maximum DC discovery retry interval policy setting is used. + +The default value for this setting is to not quit retrying (0). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0. + +> [!WARNING] +> If the value for this setting is too small, a client will stop trying to find a DC too soon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use final DC discovery retry setting for background callers* +- GP name: *Netlogon_BackgroundRetryQuitTime* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when a successful DC cache entry is refreshed. This policy setting is applied to caller programs that periodically attempt to locate DCs, and it is applied before returning the DC information to the caller program. The default value for this setting is infinite (4294967200). The maximum value for this setting is (4294967200), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value is treated as infinity. The minimum value for this setting is to always refresh (0). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use positive periodic DC cache refresh for background callers* +- GP name: *Netlogon_BackgroundSuccessfulRefreshPeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_DebugFlag** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the level of debug output for the Net Logon service. + +The Net Logon service outputs debug information to the log file netlogon.log in the directory %windir%\debug. By default, no debug information is logged. + +If you enable this policy setting and specify a non-zero value, debug information will be logged to the file. Higher values result in more verbose logging; the value of 536936447 is commonly used as an optimal setting. + +If you specify zero for this policy setting, the default behavior occurs as described above. + +If you disable this policy setting or do not configure it, the default behavior occurs as described above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify log file debug output level* +- GP name: *Netlogon_DebugFlag* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines which DC Locator DNS records are not registered by the Net Logon service. + +If you enable this policy setting, select Enabled and specify a list of space-delimited mnemonics (instructions) for the DC Locator DNS records that will not be registered by the DCs to which this setting is applied. + +Select the mnemonics from the following table: + +|Mnemonic|Type|DNS Record| +|--------|---------|-----------| +|LdapIpAddress|A|``| +|Ldap|SRV|_ldap._tcp.``| +|LdapAtSite|SRV|_ldap._tcp.``._sites.``| +|Pdc|SRV|_ldap._tcp.pdc._msdcs.``| +|Gc|SRV|_ldap._tcp.gc._msdcs.``| +|GcAtSite|SRV|_ldap._tcp.``._sites.gc._msdcs.``| +|DcByGuid|SRV|_ldap._tcp.``.domains._msdcs.``| +|GcIpAddress|A|gc._msdcs.``| +|DsaCname|CNAME|``._msdcs.``| +|Kdc|SRV|_kerberos._tcp.dc._msdcs.``| +|KdcAtSite|SRV|_kerberos._tcp.``._sites.dc._msdcs.| +|KdcAtSite|SRV|_kerberos._tcp.``._sites.dc._msdcs.``| +|Dc|SRV|_ldap._tcp.dc._msdcs.``| +|DcAtSite|SRV|_ldap._tcp.``._sites.dc._msdcs.``| +|Rfc1510Kdc|SRV|_kerberos._tcp.``| +|Rfc1510KdcAtSite|SRV|_kerberos._tcp.``._sites.``| +|GenericGc|SRV|_gc._tcp.``| +|GenericGcAtSite|SRV|_gc._tcp.``._sites.``| +|Rfc1510UdpKdc|SRV|_kerberos._udp.``| +|Rfc1510Kpwd|SRV|_kpasswd._tcp.``| +|Rfc1510UdpKpwd|SRV|_kpasswd._udp.``| + +If you disable this policy setting, DCs configured to perform dynamic registration of DC Locator DNS records register all DC Locator DNS resource records. + +If you do not configure this policy setting, DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify DC Locator DNS records not registered by the DCs* +- GP name: *Netlogon_DnsAvoidRegisterRecords* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_DnsRefreshInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the Refresh Interval of the DC Locator DNS resource records for DCs to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used by the DC Locator algorithm to locate the DC. This setting may be applied only to DCs using dynamic update. + +DCs configured to perform dynamic registration of the DC Locator DNS resource records periodically reregister their records with DNS servers, even if their records’ data has not changed. If authoritative DNS servers are configured to perform scavenging of the stale records, this reregistration is required to instruct the DNS servers configured to automatically remove (scavenge) stale records that these records are current and should be preserved in the database. + +> [!WARNING] +> If the DNS resource records are registered in zones with scavenging enabled, the value of this setting should never be longer than the Refresh Interval configured for these zones. Setting the Refresh Interval of the DC Locator DNS records to longer than the Refresh Interval of the DNS zones may result in the undesired deletion of DNS resource records. + +To specify the Refresh Interval of the DC records, click Enabled, and then enter a value larger than 1800. This value specifies the Refresh Interval of the DC records in seconds (for example, the value 3600 is 60 minutes). + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify Refresh Interval of the DC Locator DNS records* +- GP name: *Netlogon_DnsRefreshInterval* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether the domain controllers to which this setting is applied will lowercase their DNS host name when registering SRV records. + +If enabled, domain controllers will lowercase their DNS host name when registering domain controller SRV records. A best-effort attempt will be made to delete any previously registered SRV records that contain mixed-case DNS host names. For more information and potential manual cleanup procedures, see the link below. + +If disabled, domain controllers will use their configured DNS host name as-is when registering domain controller SRV records. + +If not configured, domain controllers will default to using their local configuration. + +The default local configuration is enabled. + +A reboot is not required for changes to this setting to take effect. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use lowercase DNS host names when registering domain controller SRV records* +- GP name: *Netlogon_DnsSrvRecordUseLowerCaseHostNames* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_DnsTtl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the value for the Time-To-Live (TTL) field in SRV resource records that are registered by the Net Logon service. These DNS records are dynamically registered, and they are used to locate the domain controller (DC). + +To specify the TTL for DC Locator DNS records, click Enabled, and then enter a value in seconds (for example, the value "900" is 15 minutes). + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set TTL in the DC Locator DNS Records* +- GP name: *Netlogon_DnsTtl* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_ExpectedDialupDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the additional time for the computer to wait for the domain controller’s (DC) response when logging on to the network. + +To specify the expected dial-up delay at logon, click Enabled, and then enter the desired value in seconds (for example, the value "60" is 1 minute). + +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify expected dial-up delay on logon* +- GP name: *Netlogon_ExpectedDialupDelay* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_ForceRediscoveryInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the interval for when a Force Rediscovery is carried out by DC Locator. + +The Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domain. When DC Locator finds a domain controller, it caches domain controllers to improve the efficiency of the location algorithm. As long as the cached domain controller meets the requirements and is running, DC Locator will continue to return it. If a new domain controller is introduced, existing clients will only discover it when a Force Rediscovery is carried out by DC Locator. To adapt to changes in network conditions DC Locator will by default carry out a Force Rediscovery according to a specific time interval and maintain efficient load-balancing of clients across all available domain controllers in all domains or forests. The default time interval for Force Rediscovery by DC Locator is 12 hours. Force Rediscovery can also be triggered if a call to DC Locator uses the DS_FORCE_REDISCOVERY flag. Rediscovery resets the timer on the cached domain controller entries. + +If you enable this policy setting, DC Locator on the machine will carry out Force Rediscovery periodically according to the configured time interval. The minimum time interval is 3600 seconds (1 hour) to avoid excessive network traffic from rediscovery. The maximum allowed time interval is 4294967200 seconds, while any value greater than 4294967 seconds (~49 days) will be treated as infinity. + +If you disable this policy setting, Force Rediscovery will be used by default for the machine at every 12 hour interval. + +If you do not configure this policy setting, Force Rediscovery will be used by default for the machine at every 12 hour interval, unless the local machine setting in the registry is a different value. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force Rediscovery Interval* +- GP name: *Netlogon_ForceRediscoveryInterval* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_GcSiteCoverage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the sites for which the global catalogs (GC) should register site-specific GC locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the GC resides, and records registered by a GC configured to register GC Locator DNS SRV records for those sites without a GC that are closest to it. + +The GC Locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the GC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. A GC is a domain controller that contains a partial replica of every domain in Active Directory. + +To specify the sites covered by the GC Locator DNS SRV records, click Enabled, and enter the sites' names in a space-delimited format. + +If you do not configure this policy setting, it is not applied to any GCs, and GCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify sites covered by the GC Locator DNS SRV Records* +- GP name: *Netlogon_GcSiteCoverage* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control the processing of incoming mailslot messages by a local domain controller (DC). + +> [!NOTE] +> To locate a remote DC based on its NetBIOS (single-label) domain name, DC Locator first gets the list of DCs from a WINS server that is configured in its local client settings. DC Locator then sends a mailslot message to each remote DC to get more information. DC location succeeds only if a remote DC responds to the mailslot message. + +This policy setting is recommended to reduce the attack surface on a DC, and can be used in an environment without WINS, in an IPv6-only environment, and whenever DC location based on a NetBIOS domain name is not required. This policy setting does not affect DC location based on DNS names. + +If you enable this policy setting, this DC does not process incoming mailslot messages that are used for NetBIOS domain name based DC location. + +If you disable or do not configure this policy setting, this DC processes incoming mailslot messages. This is the default behavior of DC Locator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not process incoming mailslot messages used for domain controller location based on NetBIOS domain names* +- GP name: *Netlogon_IgnoreIncomingMailslotMessages* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_LdapSrvPriority** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the Priority field in the SRV resource records registered by domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used to locate the DC. + +The Priority field in the SRV record sets the preference for target hosts (specified in the SRV record’s Target field). DNS clients that query for SRV resource records attempt to contact the first reachable host with the lowest priority number listed. + +To specify the Priority in the DC Locator DNS SRV resource records, click Enabled, and then enter a value. The range of values is from 0 to 65535. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Priority in the DC Locator DNS SRV records* +- GP name: *Netlogon_LdapSrvPriority* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_LdapSrvWeight** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the Weight field in the SRV resource records registered by the domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. + +The Weight field in the SRV record can be used in addition to the Priority value to provide a load-balancing mechanism where multiple servers are specified in the SRV records Target field and are all set to the same priority. The probability with which the DNS client randomly selects the target host to be contacted is proportional to the Weight field value in the SRV record. + +To specify the Weight in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is from 0 to 65535. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Weight in the DC Locator DNS SRV records* +- GP name: *Netlogon_LdapSrvWeight* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_MaximumLogFileSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\debug when logging is enabled. + +By default, the maximum size of the log file is 20MB. If you enable this policy setting, the maximum size of the log file is set to the specified size. Once this size is reached the log file is saved to netlogon.bak and netlogon.log is truncated. A reasonable value based on available storage should be specified. + +If you disable or do not configure this policy setting, the default behavior occurs as indicated above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify maximum log file size* +- GP name: *Netlogon_MaximumLogFileSize* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_NdncSiteCoverage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the sites for which the domain controllers (DC) that host the application directory partition should register the site-specific, application directory partition-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it. + +The application directory partition DC Locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the application directory partition-specific DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. + +To specify the sites covered by the DC Locator application directory partition-specific DNS SRV records, click Enabled, and then enter the site names in a space-delimited format. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify sites covered by the application directory partition DC Locator DNS SRV records* +- GP name: *Netlogon_NdncSiteCoverage* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_NegativeCachePeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the amount of time (in seconds) the DC locator remembers that a domain controller (DC) could not be found in a domain. When a subsequent attempt to locate the DC occurs within the time set in this setting, DC Discovery immediately fails, without attempting to find the DC. + +The default value for this setting is 45 seconds. The maximum value for this setting is 7 days (7*24*60*60). The minimum value for this setting is 0. + +> [!WARNING] +> If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value for this setting is too small, clients will attempt to find DCs even when none are available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify negative DC Discovery cache setting* +- GP name: *Netlogon_NegativeCachePeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not the Netlogon share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications. + +If you enable this policy setting, the Netlogon share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission. + +If you disable or do not configure this policy setting, the Netlogon share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission. + +By default, the Netlogon share will grant shared read access to files on the share when exclusive access is requested. + +> [!NOTE] +> The Netlogon share is a share created by the Net Logon service for use by client machines in the domain. The default behavior of the Netlogon share ensures that no application with only read permission to files on the Netlogon share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the Netlogon share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the Netlogon share on the domain will be decreased. + +If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Netlogon share compatibility* +- GP name: *Netlogon_NetlogonShareCompatibilityMode* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines when a successful DC cache entry is refreshed. This policy setting is applied to caller programs that do not periodically attempt to locate DCs, and it is applied before the returning the DC information to the caller program. This policy setting is relevant to only those callers of DsGetDcName that have not specified the DS_BACKGROUND_ONLY flag. + +The default value for this setting is 30 minutes (1800). The maximum value for this setting is (4294967200), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value will be treated as infinity. The minimum value for this setting is to always refresh (0). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify positive periodic DC Cache refresh for non-background callers* +- GP name: *Netlogon_NonBackgroundSuccessfulRefreshPeriod* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_PingUrgencyMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether the computers to which this setting is applied are more aggressive when trying to locate a domain controller (DC). + +When an environment has a large number of DCs running both old and new operating systems, the default DC locator discovery behavior may be insufficient to find DCs running a newer operating system. This policy setting can be enabled to configure DC locator to be more aggressive about trying to locate a DC in such an environment, by pinging DCs at a higher frequency. Enabling this setting may result in additional network traffic and increased load on DCs. You should disable this setting once all DCs are running the same OS version. + +The allowable values for this setting result in the following behaviors: + +- 1 - Computers will ping DCs at the normal frequency. +- 2 - Computers will ping DCs at the higher frequency. + +To specify this behavior, click Enabled and then enter a value. The range of values is from 1 to 2. + +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use urgent mode when pinging domain controllers* +- GP name: *Netlogon_PingUrgencyMode* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_ScavengeInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the interval at which Netlogon performs the following scavenging operations: + +- Checks if a password on a secure channel needs to be modified, and modifies it if necessary. + +- On the domain controllers (DC), discovers a DC that has not been discovered. + +- On the PDC, attempts to add the ``[1B] NetBIOS name if it hasn’t already been successfully added. + +None of these operations are critical. 15 minutes is optimal in all but extreme cases. For instance, if a DC is separated from a trusted domain by an expensive (e.g., ISDN) line, this parameter might be adjusted upward to avoid frequent automatic discovery of DCs in a trusted domain. + +To enable the setting, click Enabled, and then specify the interval in seconds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set scavenge interval* +- GP name: *Netlogon_ScavengeInterval* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_SiteCoverage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the sites for which the domain controllers (DC) register the site-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it. + +The DC Locator DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. + +To specify the sites covered by the DC Locator DNS SRV records, click Enabled, and then enter the sites names in a space-delimited format. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify sites covered by the DC Locator DNS SRV records* +- GP name: *Netlogon_SiteCoverage* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_SiteName** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the Active Directory site to which computers belong. + +An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. + +To specify the site name for this setting, click Enabled, and then enter the site name. When the site to which a computer belongs is not specified, the computer automatically discovers its site from Active Directory. + +If you do not configure this policy setting, it is not applied to any computers, and computers use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify site name* +- GP name: *Netlogon_SiteName* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not the SYSVOL share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier applications. + +When this setting is enabled, the SYSVOL share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission. + +When this setting is disabled or not configured, the SYSVOL share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission. + +By default, the SYSVOL share will grant shared read access to files on the share when exclusive access is requested. + +> [!NOTE] +> The SYSVOL share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the SYSVOL share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the SYSVOL share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the SYSVOL share on the domain will be decreased. + +If you enable this policy setting, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set SYSVOL share compatibility* +- GP name: *Netlogon_SysvolShareCompatibilityMode* +- GP path: *System\Net Logon* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_TryNextClosestSite** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables DC Locator to attempt to locate a DC in the nearest site based on the site link cost if a DC in same the site is not found. In scenarios with multiple sites, failing over to the try next closest site during DC Location streamlines network traffic more effectively. + +The DC Locator service is used by clients to find domain controllers for their Active Directory domain. The default behavior for DC Locator is to find a DC in the same site. If none are found in the same site, a DC in another site, which might be several site-hops away, could be returned by DC Locator. Site proximity between two sites is determined by the total site-link cost between them. A site is closer if it has a lower site link cost than another site with a higher site link cost. + +If you enable this policy setting, Try Next Closest Site DC Location will be turned on for the computer. + +If you disable this policy setting, Try Next Closest Site DC Location will not be used by default for the computer. However, if a DC Locator call is made using the DS_TRY_NEXTCLOSEST_SITE flag explicitly, the Try Next Closest Site behavior is honored. + +If you do not configure this policy setting, Try Next Closest Site DC Location will not be used by default for the machine. If the DS_TRY_NEXTCLOSEST_SITE flag is used explicitly, the Next Closest Site behavior will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Try Next Closest Site* +- GP name: *Netlogon_TryNextClosestSite* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +
    + + +**ADMX_Netlogon/Netlogon_UseDynamicDns** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines if dynamic registration of the domain controller (DC) locator DNS resource records is enabled. These DNS records are dynamically registered by the Net Logon service and are used by the Locator algorithm to locate the DC. + +If you enable this policy setting, DCs to which this setting is applied dynamically register DC Locator DNS resource records through dynamic DNS update-enabled network connections. + +If you disable this policy setting, DCs will not register DC Locator DNS resource records. + +If you do not configure this policy setting, it is not applied to any DCs, and DCs use their local configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify dynamic registration of the DC Locator DNS Records* +- GP name: *Netlogon_UseDynamicDns* +- GP path: *System\Net Logon\DC Locator DNS Records* +- GP ADMX file name: *Netlogon.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md new file mode 100644 index 0000000000..7e542154a7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -0,0 +1,2200 @@ +--- +title: Policy CSP - ADMX_NetworkConnections +description: Policy CSP - ADMX_NetworkConnections +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_NetworkConnections + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_NetworkConnections policies + +
    +
    + ADMX_NetworkConnections/NC_AddRemoveComponents +
    +
    + ADMX_NetworkConnections/NC_AdvancedSettings +
    +
    + ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig +
    +
    + ADMX_NetworkConnections/NC_ChangeBindState +
    +
    + ADMX_NetworkConnections/NC_DeleteAllUserConnection +
    +
    + ADMX_NetworkConnections/NC_DeleteConnection +
    +
    + ADMX_NetworkConnections/NC_DialupPrefs +
    +
    + ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon +
    +
    + ADMX_NetworkConnections/NC_EnableAdminProhibits +
    +
    + ADMX_NetworkConnections/NC_ForceTunneling +
    +
    + ADMX_NetworkConnections/NC_IpStateChecking +
    +
    + ADMX_NetworkConnections/NC_LanChangeProperties +
    +
    + ADMX_NetworkConnections/NC_LanConnect +
    +
    + ADMX_NetworkConnections/NC_LanProperties +
    +
    + ADMX_NetworkConnections/NC_NewConnectionWizard +
    +
    + ADMX_NetworkConnections/NC_PersonalFirewallConfig +
    +
    + ADMX_NetworkConnections/NC_RasAllUserProperties +
    +
    + ADMX_NetworkConnections/NC_RasChangeProperties +
    +
    + ADMX_NetworkConnections/NC_RasConnect +
    +
    + ADMX_NetworkConnections/NC_RasMyProperties +
    +
    + ADMX_NetworkConnections/NC_RenameAllUserRasConnection +
    +
    + ADMX_NetworkConnections/NC_RenameConnection +
    +
    + ADMX_NetworkConnections/NC_RenameLanConnection +
    +
    + ADMX_NetworkConnections/NC_RenameMyRasConnection +
    +
    + ADMX_NetworkConnections/NC_ShowSharedAccessUI +
    +
    + ADMX_NetworkConnections/NC_Statistics +
    +
    + ADMX_NetworkConnections/NC_StdDomainUserSetLocation +
    +
    + + +
    + + +**ADMX_NetworkConnections/NC_AddRemoveComponents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether administrators can add and remove network components for a LAN or remote access connection. This setting has no effect on nonadministrators. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Install and Uninstall buttons for components of connections are disabled, and administrators are not permitted to access network components in the Windows Components Wizard. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Install and Uninstall buttons for components of connections in the Network Connections folder are enabled. Also, administrators can gain access to network components in the Windows Components Wizard. + +The Install button opens the dialog boxes used to add network components. Clicking the Uninstall button removes the selected component in the components list (above the button). + +The Install and Uninstall buttons appear in the properties dialog box for connections. These buttons are on the General tab for LAN connections and on the Networking tab for remote access connections. + +> [!NOTE] +> When the "Prohibit access to properties of a LAN connection", "Ability to change properties of an all user remote access connection", or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the connection properties dialog box, the Install and Uninstall buttons for connections are blocked. +> +> Nonadministrators are already prohibited from adding and removing connection components, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit adding and removing components for a LAN or remote access connection* +- GP name: *NC_AddRemoveComponents* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_AdvancedSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the Advanced Settings item on the Advanced menu in Network Connections is enabled for administrators. + +The Advanced Settings item lets users view and change bindings and view and change the order in which the computer accesses connections, network providers, and print providers. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Advanced Settings item is disabled for administrators. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Advanced Settings item is enabled for administrators. + +> [!NOTE] +> Nonadministrators are already prohibited from accessing the Advanced Settings dialog box, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to the Advanced Settings item on the Advanced menu* +- GP name: *NC_AdvancedSettings* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can configure advanced TCP/IP settings. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Advanced button on the Internet Protocol (TCP/IP) Properties dialog box is disabled for all users (including administrators). As a result, users cannot open the Advanced TCP/IP Settings Properties page and modify IP settings, such as DNS and WINS server information. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting, the Advanced button is enabled, and all users can open the Advanced TCP/IP Setting dialog box. + +This setting is superseded by settings that prohibit access to properties of connections or connection components. When these policies are set to deny access to the connection properties dialog box or Properties button for connection components, users cannot gain access to the Advanced button for TCP/IP configuration. + +Changing this setting from Enabled to Not Configured does not enable the Advanced button until the user logs off. + +> [!NOTE] +> Nonadministrators (excluding Network Configuration Operators) do not have permission to access TCP/IP advanced configuration for a LAN connection, regardless of this setting. + +> [!TIP] +> To open the Advanced TCP/IP Setting dialog box, in the Network Connections folder, right-click a connection icon, and click Properties. For remote access connections, click the Networking tab. In the "Components checked are used by this connection" box, click Internet Protocol (TCP/IP), click the Properties button, and then click the Advanced button. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit TCP/IP advanced configuration* +- GP name: *NC_AllowAdvancedTCPIPConfig* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_ChangeBindState** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting Determines whether administrators can enable and disable the components used by LAN connections. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the check boxes for enabling and disabling components are disabled. As a result, administrators cannot enable or disable the components that a connection uses. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Properties dialog box for a connection includes a check box beside the name of each component that the connection uses. Selecting the check box enables the component, and clearing the check box disables the component. + +> [!NOTE] +> When the "Prohibit access to properties of a LAN connection" setting is enabled, users are blocked from accessing the check boxes for enabling and disabling the components of a LAN connection. +> +> Nonadministrators are already prohibited from enabling or disabling components for a LAN connection, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit Enabling/Disabling components of a LAN connection* +- GP name: *NC_ChangeBindState* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_DeleteAllUserConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can delete all user remote access connections. + +To create an all-user remote access connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option. + +If you enable this setting, all users can delete shared remote access connections. In addition, if your file system is NTFS, users need to have Write access to Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk to delete a shared remote access connection. + +If you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), users (including administrators) cannot delete all-user remote access connections. (By default, users can still delete their private connections, but you can change the default by using the "Prohibit deletion of remote access connections" setting.) + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you do not configure this setting, only Administrators and Network Configuration Operators can delete all user remote access connections. + +When enabled, the "Prohibit deletion of remote access connections" setting takes precedence over this setting. Users (including administrators) cannot delete any remote access connections, and this setting is ignored. + +> [!NOTE] +> LAN connections are created and deleted automatically by the system when a LAN adapter is installed or removed. You cannot use the Network Connections folder to create or delete a LAN connection. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to delete all user remote access connections* +- GP name: *NC_DeleteAllUserConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_DeleteConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can delete remote access connections. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), users (including administrators) cannot delete any remote access connections. This setting also disables the Delete option on the context menu for a remote access connection and on the File menu in the Network Connections folder. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, all users can delete their private remote access connections. Private connections are those that are available only to one user. (By default, only Administrators and Network Configuration Operators can delete connections available to all users, but you can change the default by using the "Ability to delete all user remote access connections" setting.) + +When enabled, this setting takes precedence over the "Ability to delete all user remote access connections" setting. Users cannot delete any remote access connections, and the "Ability to delete all user remote access connections" setting is ignored. + +> [!NOTE] +> LAN connections are created and deleted automatically when a LAN adapter is installed or removed. You cannot use the Network Connections folder to create or delete a LAN connection. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit deletion of remote access connections* +- GP name: *NC_DeleteConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_DialupPrefs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the Remote Access Preferences item on the Advanced menu in Network Connections folder is enabled. + +The Remote Access Preferences item lets users create and change connections before logon and configure automatic dialing and callback features. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Remote Access Preferences item is disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Remote Access Preferences item is enabled for all users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to the Remote Access Preferences item on the Advanced menu* +- GP name: *NC_DialupPrefs* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether or not the "local access only" network icon will be shown. + +When enabled, the icon for Internet access will be shown in the system tray even when a user is connected to a network with local access only. + +If you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not show the "local access only" network icon* +- GP name: *NC_DoNotShowLocalOnlyIcon* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_EnableAdminProhibits** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether settings that existed in Windows 2000 Server family will apply to Administrators. + +The set of Network Connections group settings that existed in Windows 2000 Professional also exists in Windows XP Professional. In Windows 2000 Professional, all of these settings had the ability to prohibit the use of certain features from Administrators. + +By default, Network Connections group settings in Windows XP Professional do not have the ability to prohibit the use of features from Administrators. + +If you enable this setting, the Windows XP settings that existed in Windows 2000 Professional will have the ability to prohibit Administrators from using certain features. These settings are "Ability to rename LAN connections or remote access connections available to all users", "Prohibit access to properties of components of a LAN connection", "Prohibit access to properties of components of a remote access connection", "Ability to access TCP/IP advanced configuration", "Prohibit access to the Advanced Settings Item on the Advanced Menu", "Prohibit adding and removing components for a LAN or remote access connection", "Prohibit access to properties of a LAN connection", "Prohibit Enabling/Disabling components of a LAN connection", "Ability to change properties of an all user remote access connection", "Prohibit changing properties of a private remote access connection", "Prohibit deletion of remote access connections", "Ability to delete all user remote access connections", "Prohibit connecting and disconnecting a remote access connection", "Ability to Enable/Disable a LAN connection", "Prohibit access to the New Connection Wizard", "Prohibit renaming private remote access connections", "Prohibit access to the Remote Access Preferences item on the Advanced menu", "Prohibit viewing of status for an active connection". When this setting is enabled, settings that exist in both Windows 2000 Professional and Windows XP Professional behave the same for administrators. + +If you disable this setting or do not configure it, Windows XP settings that existed in Windows 2000 will not apply to administrators. + +> [!NOTE] +> This setting is intended to be used in a situation in which the Group Policy object that these settings are being applied to contains both Windows 2000 Professional and Windows XP Professional computers, and identical Network Connections policy behavior is required between all Windows 2000 Professional and Windows XP Professional computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Windows 2000 Network Connections settings for Administrators* +- GP name: *NC_EnableAdminProhibits* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_ForceTunneling** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether a remote client computer routes Internet traffic through the internal network or whether the client accesses the Internet directly. + +When a remote client computer connects to an internal network using DirectAccess, it can access the Internet in two ways: through the secure tunnel that DirectAccess establishes between the computer and the internal network, or directly through the local default gateway. + +If you enable this policy setting, all traffic between a remote client computer running DirectAccess and the Internet is routed through the internal network. + +If you disable this policy setting, traffic between remote client computers running DirectAccess and the Internet is not routed through the internal network. + +If you do not configure this policy setting, traffic between remote client computers running DirectAccess and the Internet is not routed through the internal network. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Route all traffic through the internal network* +- GP name: *NC_ForceTunneling* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_IpStateChecking** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether notifications are shown to the user when a DHCP-configured connection is unable to retrieve an IP address from a DHCP server. This is often signified by the assignment of an automatic private IP address"(i.e. an IP address in the range 169.254.*.*). This indicates that a DHCP server could not be reached or the DHCP server was reached but unable to respond to the request with a valid IP address. By default, a notification is displayed providing the user with information on how the problem can be resolved. + +If you enable this policy setting, this condition will not be reported as an error to the user. + +If you disable or do not configure this policy setting, a DHCP-configured connection that has not been assigned an IP address will be reported via a notification, providing the user with information as to how the problem can be resolved. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off notifications when a connection has only limited or no connectivity* +- GP name: *NC_IpStateChecking* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_LanChangeProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Administrators and Network Configuration Operators can change the properties of components used by a LAN connection. + +This setting determines whether the Properties button for components of a LAN connection is enabled. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties button is disabled for Administrators. Network Configuration Operators are prohibited from accessing connection components, regardless of the "Enable Network Connections settings for Administrators" setting. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting does not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Properties button is enabled for administrators and Network Configuration Operators. + +The Local Area Connection Properties dialog box includes a list of the network components that the connection uses. To view or change the properties of a component, click the name of the component, and then click the Properties button beneath the component list. + +> [!NOTE] +> Not all network components have configurable properties. For components that are not configurable, the Properties button is always disabled. +> +> When the "Prohibit access to properties of a LAN connection" setting is enabled, users are blocked from accessing the Properties button for LAN connection components. +> +> Network Configuration Operators only have permission to change TCP/IP properties. Properties for all other components are unavailable to these users. +> +> Nonadministrators are already prohibited from accessing properties of components for a LAN connection, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to properties of components of a LAN connection* +- GP name: *NC_LanChangeProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_LanConnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can enable/disable LAN connections. + +If you enable this setting, the Enable and Disable options for LAN connections are available to users (including nonadministrators). Users can enable/disable a LAN connection by double-clicking the icon representing the connection, by right-clicking it, or by using the File menu. + +If you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), double-clicking the icon has no effect, and the Enable and Disable menu items are disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you do not configure this setting, only Administrators and Network Configuration Operators can enable/disable LAN connections. + +> [!NOTE] +> Administrators can still enable/disable LAN connections from Device Manager when this setting is disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to Enable/Disable a LAN connection* +- GP name: *NC_LanConnect* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_LanProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can change the properties of a LAN connection. + +This setting determines whether the Properties menu item is enabled, and thus, whether the Local Area Connection Properties dialog box is available to users. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled for all users, and users cannot open the Local Area Connection Properties dialog box. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, a Properties menu item appears when users right-click the icon representing a LAN connection. Also, when users select the connection, Properties is enabled on the File menu. + +> [!NOTE] +> This setting takes precedence over settings that manipulate the availability of features inside the Local Area Connection Properties dialog box. If this setting is enabled, nothing within the properties dialog box for a LAN connection is available to users. +> +> Nonadministrators have the right to view the properties dialog box for a connection but not to make changes, regardless of this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to properties of a LAN connection* +- GP name: *NC_LanProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_NewConnectionWizard** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can use the New Connection Wizard, which creates new network connections. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Make New Connection icon does not appear in the Start Menu on in the Network Connections folder. As a result, users (including administrators) cannot start the New Connection Wizard. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Make New Connection icon appears in the Start menu and in the Network Connections folder for all users. Clicking the Make New Connection icon starts the New Connection Wizard. + +> [!NOTE] +> Changing this setting from Enabled to Not Configured does not restore the Make New Connection icon until the user logs off or on. When other changes to this setting are applied, the icon does not appear or disappear in the Network Connections folder until the folder is refreshed. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to the New Connection Wizard* +- GP name: *NC_NewConnectionWizard* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_PersonalFirewallConfig** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prohibits use of Internet Connection Firewall on your DNS domain network. + +Determines whether users can enable the Internet Connection Firewall feature on a connection, and if the Internet Connection Firewall service can run on a computer. + +> [!IMPORTANT] +> This setting is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply. + +The Internet Connection Firewall is a stateful packet filter for home and small office users to protect them from Internet network security threats. + +If you enable this setting, Internet Connection Firewall cannot be enabled or configured by users (including administrators), and the Internet Connection Firewall service cannot run on the computer. The option to enable the Internet Connection Firewall through the Advanced tab is removed. In addition, the Internet Connection Firewall is not enabled for remote access connections created through the Make New Connection Wizard. The Network Setup Wizard is disabled. + +If you enable the "Windows Firewall: Protect all network connections" policy setting, the "Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting has no effect on computers that are running Windows Firewall, which replaces Internet Connection Firewall when you install Windows XP Service Pack 2. + +If you disable this setting or do not configure it, the Internet Connection Firewall is disabled when a LAN Connection or VPN connection is created, but users can use the Advanced tab in the connection properties to enable it. The Internet Connection Firewall is enabled by default on the connection for which Internet Connection Sharing is enabled. In addition, remote access connections created through the Make New Connection Wizard have the Internet Connection Firewall enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit use of Internet Connection Firewall on your DNS domain network* +- GP name: *NC_PersonalFirewallConfig* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_RasAllUserProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether a user can view and change the properties of remote access connections that are available to all users of the computer. + +To create an all-user remote access connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option. + +This setting determines whether the Properties menu item is enabled, and thus, whether the Remote Access Connection Properties dialog box is available to users. + +If you enable this setting, a Properties menu item appears when any user right-clicks the icon for a remote access connection. Also, when any user selects the connection, Properties appears on the File menu. + +If you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled, and users (including administrators) cannot open the remote access connection properties dialog box. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you do not configure this setting, only Administrators and Network Configuration Operators can change properties of all-user remote access connections. + +> [!NOTE] +> This setting takes precedence over settings that manipulate the availability of features inside the Remote Access Connection Properties dialog box. If this setting is disabled, nothing within the properties dialog box for a remote access connection will be available to users. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to change properties of an all user remote access connection* +- GP name: *NC_RasAllUserProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_RasChangeProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can view and change the properties of components used by a private or all-user remote access connection. + +This setting determines whether the Properties button for components used by a private or all-user remote access connection is enabled. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties button is disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting does not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Properties button is enabled for all users. + +The Networking tab of the Remote Access Connection Properties dialog box includes a list of the network components that the connection uses. To view or change the properties of a component, click the name of the component, and then click the Properties button beneath the component list. + +> [NOTE] +> Not all network components have configurable properties. For components that are not configurable, the Properties button is always disabled. +> +> When the "Ability to change properties of an all user remote access connection" or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the Remote Access Connection Properties dialog box, the Properties button for remote access connection components is blocked. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access to properties of components of a remote access connection* +- GP name: *NC_RasChangeProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_RasConnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can connect and disconnect remote access connections. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), double-clicking the icon has no effect, and the Connect and Disconnect menu items are disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Connect and Disconnect options for remote access connections are available to all users. Users can connect or disconnect a remote access connection by double-clicking the icon representing the connection, by right-clicking it, or by using the File menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit connecting and disconnecting a remote access connection* +- GP name: *NC_RasConnect* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_RasMyProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can view and change the properties of their private remote access connections. + +Private connections are those that are available only to one user. To create a private connection, on the Connection Availability page in the New Connection Wizard, click the "Only for myself" option. + +This setting determines whether the Properties menu item is enabled, and thus, whether the Remote Access Connection Properties dialog box for a private connection is available to users. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled, and no users (including administrators) can open the Remote Access Connection Properties dialog box for a private connection. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, a Properties menu item appears when any user right-clicks the icon representing a private remote access connection. Also, when any user selects the connection, Properties appears on the File menu. + +> [!NOTE] +> This setting takes precedence over settings that manipulate the availability of features in the Remote Access Connection Properties dialog box. If this setting is enabled, nothing within the properties dialog box for a remote access connection will be available to users. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit changing properties of a private remote access connection* +- GP name: *NC_RasMyProperties* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_RenameAllUserRasConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether nonadministrators can rename all-user remote access connections. + +To create an all-user connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option. + +If you enable this setting, the Rename option is enabled for all-user remote access connections. Any user can rename all-user connections by clicking an icon representing the connection or by using the File menu. + +If you disable this setting, the Rename option is disabled for nonadministrators only. + +If you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections. + +> [!NOTE] +> This setting does not apply to Administrators. + +When the "Ability to rename LAN connections or remote access connections available to all users" setting is configured (set to either Enabled or Disabled), this setting does not apply. + +This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to rename all user remote access connections* +- GP name: *NC_RenameAllUserRasConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_RenameConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting Determines whether users can rename LAN or all user remote access connections. + +If you enable this setting, the Rename option is enabled for all users. Users can rename connections by clicking the icon representing a connection or by using the File menu. + +If you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Rename option for LAN and all user remote access connections is disabled for all users (including Administrators and Network Configuration Operators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If this setting is not configured, only Administrators and Network Configuration Operators have the right to rename LAN or all user remote access connections. + +> [!NOTE] +> When configured, this setting always takes precedence over the "Ability to rename LAN connections" and "Ability to rename all user remote access connections" settings. +> +> This setting does not prevent users from using other programs, such as Internet Explorer, to rename remote access connections. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to rename LAN connections or remote access connections available to all users* +- GP name: *NC_RenameConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_RenameLanConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether nonadministrators can rename a LAN connection. + +If you enable this setting, the Rename option is enabled for LAN connections. Nonadministrators can rename LAN connections by clicking an icon representing the connection or by using the File menu. + +If you disable this setting, the Rename option is disabled for nonadministrators only. + +If you do not configure this setting, only Administrators and Network Configuration Operators can rename LAN connections + +> [!NOTE] +> This setting does not apply to Administrators. + +When the "Ability to rename LAN connections or remote access connections available to all users" setting is configured (set to either enabled or disabled), this setting does not apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ability to rename LAN connections* +- GP name: *NC_RenameLanConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_RenameMyRasConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can rename their private remote access connections. + +Private connections are those that are available only to one user. To create a private connection, on the Connection Availability page in the New Connection Wizard, click the "Only for myself" option. + +If you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Rename option is disabled for all users (including administrators). + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the Rename option is enabled for all users' private remote access connections. Users can rename their private connection by clicking an icon representing the connection or by using the File menu. + +> [!NOTE] +> This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit renaming private remote access connections* +- GP name: *NC_RenameMyRasConnection* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_ShowSharedAccessUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether administrators can enable and configure the Internet Connection Sharing (ICS) feature of an Internet connection and if the ICS service can run on the computer. + +ICS lets administrators configure their system as an Internet gateway for a small network and provides network services, such as name resolution and addressing through DHCP, to the local private network. + +If you enable this setting, ICS cannot be enabled or configured by administrators, and the ICS service cannot run on the computer. The Advanced tab in the Properties dialog box for a LAN or remote access connection is removed. The Internet Connection Sharing page is removed from the New Connection Wizard. The Network Setup Wizard is disabled. + +If you disable this setting or do not configure it and have two or more connections, administrators can enable ICS. The Advanced tab in the properties dialog box for a LAN or remote access connection is available. In addition, the user is presented with the option to enable Internet Connection Sharing in the Network Setup Wizard and Make New Connection Wizard. (The Network Setup Wizard is available only in Windows XP Professional.) + +By default, ICS is disabled when you create a remote access connection, but administrators can use the Advanced tab to enable it. When running the New Connection Wizard or Network Setup Wizard, administrators can choose to enable ICS. + +> [!NOTE] +> Internet Connection Sharing is only available when two or more network connections are present. + +When the "Prohibit access to properties of a LAN connection," "Ability to change properties of an all user remote access connection," or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the Connection Properties dialog box, the Advanced tab for the connection is blocked. + +Nonadministrators are already prohibited from configuring Internet Connection Sharing, regardless of this setting. + +Disabling this setting does not prevent Wireless Hosted Networking from using the ICS service for DHCP services. To prevent the ICS service from running, on the Network Permissions tab in the network's policy properties, select the "Don't use hosted networks" check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit use of Internet Connection Sharing on your DNS domain network* +- GP name: *NC_ShowSharedAccessUI* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_Statistics** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether users can view the status for an active connection. + +Connection status is available from the connection status taskbar icon or from the Status dialog box. The Status dialog box displays information about the connection and its activity. It also provides buttons to disconnect and to configure the properties of the connection. + +If you enable this setting, the connection status taskbar icon and Status dialog box are not available to users (including administrators). The Status option is disabled in the context menu for the connection and on the File menu in the Network Connections folder. Users cannot choose to show the connection icon in the taskbar from the Connection Properties dialog box. + +If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers. + +If you disable this setting or do not configure it, the connection status taskbar icon and Status dialog box are available to all users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit viewing of status for an active connection* +- GP name: *NC_Statistics* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + + +**ADMX_NetworkConnections/NC_StdDomainUserSetLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether to require domain users to elevate when setting a network's location. + +If you enable this policy setting, domain users must elevate when setting a network's location. + +If you disable or do not configure this policy setting, domain users can set a network's location without elevating. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require domain users to elevate when setting a network's location* +- GP name: *NC_StdDomainUserSetLocation* +- GP path: *Network\Network Connections* +- GP ADMX file name: *NetworkConnections.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md new file mode 100644 index 0000000000..27b56e21e6 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -0,0 +1,3705 @@ +--- +title: Policy CSP - ADMX_OfflineFiles +description: Policy CSP - ADMX_OfflineFiles +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_OfflineFiles +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_OfflineFiles policies + +
    +
    + ADMX_OfflineFiles/Pol_AlwaysPinSubFolders +
    +
    + ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1 +
    +
    + ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2 +
    +
    + ADMX_OfflineFiles/Pol_BackgroundSyncSettings +
    +
    + ADMX_OfflineFiles/Pol_CacheSize +
    +
    + ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1 +
    +
    + ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2 +
    +
    + ADMX_OfflineFiles/Pol_DefCacheSize +
    +
    + ADMX_OfflineFiles/Pol_Enabled +
    +
    + ADMX_OfflineFiles/Pol_EncryptOfflineFiles +
    +
    + ADMX_OfflineFiles/Pol_EventLoggingLevel_1 +
    +
    + ADMX_OfflineFiles/Pol_EventLoggingLevel_2 +
    +
    + ADMX_OfflineFiles/Pol_ExclusionListSettings +
    +
    + ADMX_OfflineFiles/Pol_ExtExclusionList +
    +
    + ADMX_OfflineFiles/Pol_GoOfflineAction_1 +
    +
    + ADMX_OfflineFiles/Pol_GoOfflineAction_2 +
    +
    + ADMX_OfflineFiles/Pol_NoCacheViewer_1 +
    +
    + ADMX_OfflineFiles/Pol_NoCacheViewer_2 +
    +
    + ADMX_OfflineFiles/Pol_NoConfigCache_1 +
    +
    + ADMX_OfflineFiles/Pol_NoConfigCache_2 +
    +
    + ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1 +
    +
    + ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2 +
    +
    + ADMX_OfflineFiles/Pol_NoPinFiles_1 +
    +
    + ADMX_OfflineFiles/Pol_NoPinFiles_2 +
    +
    + ADMX_OfflineFiles/Pol_NoReminders_1 +
    +
    + ADMX_OfflineFiles/Pol_NoReminders_2 +
    +
    + ADMX_OfflineFiles/Pol_OnlineCachingSettings +
    +
    + ADMX_OfflineFiles/Pol_PurgeAtLogoff +
    +
    + ADMX_OfflineFiles/Pol_QuickAdimPin +
    +
    + ADMX_OfflineFiles/Pol_ReminderFreq_1 +
    +
    + ADMX_OfflineFiles/Pol_ReminderFreq_2 +
    +
    + ADMX_OfflineFiles/Pol_ReminderInitTimeout_1 +
    +
    + ADMX_OfflineFiles/Pol_ReminderInitTimeout_2 +
    +
    + ADMX_OfflineFiles/Pol_ReminderTimeout_1 +
    +
    + ADMX_OfflineFiles/Pol_ReminderTimeout_2 +
    +
    + ADMX_OfflineFiles/Pol_SlowLinkSettings +
    +
    + ADMX_OfflineFiles/Pol_SlowLinkSpeed +
    +
    + ADMX_OfflineFiles/Pol_SyncAtLogoff_1 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtLogoff_2 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtLogon_1 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtLogon_2 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtSuspend_1 +
    +
    + ADMX_OfflineFiles/Pol_SyncAtSuspend_2 +
    +
    + ADMX_OfflineFiles/Pol_SyncOnCostedNetwork +
    +
    + ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1 +
    +
    + ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2 +
    +
    + + +
    + + +**ADMX_OfflineFiles/Pol_AlwaysPinSubFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting makes subfolders available offline whenever their parent folder is made available offline. + +This setting automatically extends the "make available offline" setting to all new and existing subfolders of a folder. Users do not have the option of excluding subfolders. + +If you enable this setting, when you make a folder available offline, all folders within that folder are also made available offline. Also, new folders that you create within a folder that is available offline are made available offline when the parent folder is synchronized. + +If you disable this setting or do not configure it, the system asks users whether they want subfolders to be made available offline when they make a parent folder available offline. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Subfolders always available offline* +- GP name: *Pol_AlwaysPinSubFolders* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lists network files and folders that are always available for offline use. This ensures that the specified files and folders are available offline to users of the computer. + +If you enable this policy setting, the files you enter are always available offline to users of the computer. To specify a file or folder, click Show. In the Show Contents dialog box in the Value Name column, type the fully qualified UNC path to the file or folder. Leave the Value column field blank. + +If you disable this policy setting, the list of files or folders made always available offline (including those inherited from lower precedence GPOs) is deleted and no files or folders are made available for offline use by Group Policy (though users can still specify their own files and folders for offline use). + +If you do not configure this policy setting, no files or folders are made available for offline use by Group Policy. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings will be combined and all specified files will be available for offline use. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify administratively assigned Offline Files* +- GP name: *Pol_AssignedOfflineFiles_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lists network files and folders that are always available for offline use. This ensures that the specified files and folders are available offline to users of the computer. + +If you enable this policy setting, the files you enter are always available offline to users of the computer. To specify a file or folder, click Show. In the Show Contents dialog box in the Value Name column, type the fully qualified UNC path to the file or folder. Leave the Value column field blank. + +If you disable this policy setting, the list of files or folders made always available offline (including those inherited from lower precedence GPOs) is deleted and no files or folders are made available for offline use by Group Policy (though users can still specify their own files and folders for offline use). + +If you do not configure this policy setting, no files or folders are made available for offline use by Group Policy. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings will be combined and all specified files will be available for offline use. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify administratively assigned Offline Files* +- GP name: *Pol_AssignedOfflineFiles_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_BackgroundSyncSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls when background synchronization occurs while operating in slow-link mode, and applies to any user who logs onto the specified machine while this policy is in effect. To control slow-link mode, use the "Configure slow-link mode" policy setting. + +If you enable this policy setting, you can control when Windows synchronizes in the background while operating in slow-link mode. Use the 'Sync Interval' and 'Sync Variance' values to override the default sync interval and variance settings. Use 'Blockout Start Time' and 'Blockout Duration' to set a period of time where background sync is disabled. Use the 'Maximum Allowed Time Without A Sync' value to ensure that all network folders on the machine are synchronized with the server on a regular basis. + +You can also configure Background Sync for network shares that are in user selected Work Offline mode. This mode is in effect when a user selects the Work Offline button for a specific share. When selected, all configured settings will apply to shares in user selected Work Offline mode as well. + +If you disable or do not configure this policy setting, Windows performs a background sync of offline folders in the slow-link mode at a default interval with the start of the sync varying between 0 and 60 additional minutes. In Windows 7 and Windows Server 2008 R2, the default sync interval is 360 minutes. In Windows 8 and Windows Server 2012, the default sync interval is 120 minutes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Background Sync* +- GP name: *Pol_BackgroundSyncSettings* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_CacheSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits the amount of disk space that can be used to store offline files. This includes the space used by automatically cached files and files that are specifically made available offline. Files can be automatically cached if the user accesses a file on an automatic caching network share. + +This setting also disables the ability to adjust, through the Offline Files control panel applet, the disk space limits on the Offline Files cache. This prevents users from trying to change the option while a policy setting controls it. + +If you enable this policy setting, you can specify the disk space limit (in megabytes) for offline files and also specify how much of that disk space can be used by automatically cached files. + +If you disable this policy setting, the system limits the space that offline files occupy to 25 percent of the total space on the drive where the Offline Files cache is located. The limit for automatically cached files is 100 percent of the total disk space limit. + +If you do not configure this policy setting, the system limits the space that offline files occupy to 25 percent of the total space on the drive where the Offline Files cache is located. The limit for automatically cached files is 100 percent of the total disk space limit. However, the users can change these values using the Offline Files control applet. + +If you enable this setting and specify a total size limit greater than the size of the drive hosting the Offline Files cache, and that drive is the system drive, the total size limit is automatically adjusted downward to 75 percent of the size of the drive. If the cache is located on a drive other than the system drive, the limit is automatically adjusted downward to 100 percent of the size of the drive. + +If you enable this setting and specify a total size limit less than the amount of space currently used by the Offline Files cache, the total size limit is automatically adjusted upward to the amount of space currently used by offline files. The cache is then considered full. + +If you enable this setting and specify an auto-cached space limit greater than the total size limit, the auto-cached limit is automatically adjusted downward to equal the total size limit. + +This setting replaces the Default Cache Size setting used by pre-Windows Vista systems. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit disk space used by Offline Files* +- GP name: *Pol_CacheSize* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files. + +This setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, you can use the "Action" box to specify how computers in the group respond. + +- "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible. + +- "Never go offline" indicates that network files are not available while the server is inaccessible. + +If you disable this setting or select the "Work offline" option, users can work offline if disconnected. + +If you do not configure this setting, users can work offline by default, but they can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section. + +Also, see the "Non-default server disconnect actions" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Action on server disconnect* +- GP name: *Pol_CustomGoOfflineActions_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files. + +This setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, you can use the "Action" box to specify how computers in the group respond. + +- "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible. + +- "Never go offline" indicates that network files are not available while the server is inaccessible. + +If you disable this setting or select the "Work offline" option, users can work offline if disconnected. + +If you do not configure this setting, users can work offline by default, but they can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section. + +Also, see the "Non-default server disconnect actions" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Action on server disconnect* +- GP name: *Pol_CustomGoOfflineActions_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_DefCacheSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Limits the percentage of the computer's disk space that can be used to store automatically cached offline files. + +This setting also disables the "Amount of disk space to use for temporary offline files" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +Automatic caching can be set on any network share. When a user opens a file on the share, the system automatically stores a copy of the file on the user's computer. + +This setting does not limit the disk space available for files that user's make available offline manually. + +If you enable this setting, you can specify an automatic-cache disk space limit. + +If you disable this setting, the system limits the space that automatically cached files occupy to 10 percent of the space on the system drive. + +If you do not configure this setting, disk space for automatically cached files is limited to 10 percent of the system drive by default, but users can change it. + +> [!TIP] +> To change the amount of disk space used for automatic caching without specifying a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then use the slider bar associated with the "Amount of disk space to use for temporary offline files" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default cache size* +- GP name: *Pol_DefCacheSize* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_Enabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build.This policy setting determines whether the Offline Files feature is enabled. Offline Files saves a copy of network files on the user's computer for use when the computer is not connected to the network. + +If you enable this policy setting, Offline Files is enabled and users cannot disable it. + +If you disable this policy setting, Offline Files is disabled and users cannot enable it. + +If you do not configure this policy setting, Offline Files is enabled on Windows client computers, and disabled on computers running Windows Server, unless changed by the user. + +> [!NOTE] +> Changes to this policy setting do not take effect until the affected computer is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow or Disallow use of the Offline Files feature* +- GP name: *Pol_Enabled* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_EncryptOfflineFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether offline files are encrypted. + +Offline files are locally cached copies of files from a network share. Encrypting this cache reduces the likelihood that a user could access files from the Offline Files cache without proper permissions. + +If you enable this policy setting, all files in the Offline Files cache are encrypted. This includes existing files as well as files added later. The cached copy on the local computer is affected, but the associated network copy is not. The user cannot unencrypt Offline Files through the user interface. + +If you disable this policy setting, all files in the Offline Files cache are unencrypted. This includes existing files as well as files added later, even if the files were stored using NTFS encryption or BitLocker Drive Encryption while on the server. The cached copy on the local computer is affected, but the associated network copy is not. The user cannot encrypt Offline Files through the user interface. + +If you do not configure this policy setting, encryption of the Offline Files cache is controlled by the user through the user interface. The current cache state is retained, and if the cache is only partially encrypted, the operation completes so that it is fully encrypted. The cache does not return to the unencrypted state. The user must be an administrator on the local computer to encrypt or decrypt the Offline Files cache. + +> [!NOTE] +> By default, this cache is protected on NTFS partitions by ACLs. + +This setting is applied at user logon. If this setting is changed after user logon then user logoff and logon is required for this setting to take effect. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Encrypt the Offline Files cache* +- GP name: *Pol_EncryptOfflineFiles* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_EventLoggingLevel_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines which events the Offline Files feature records in the event log. + +Offline Files records events in the Application log in Event Viewer when it detects errors. By default, Offline Files records an event only when the offline files storage cache is corrupted. However, you can use this setting to specify additional events you want Offline Files to record. + +To use this setting, in the "Enter" box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels. + +- "0" records an error when the offline storage cache is corrupted. + +- "1" also records an event when the server hosting the offline file is disconnected from the network. + +- "2" also records events when the local computer is connected and disconnected from the network. + +- "3" also records an event when the server hosting the offline file is reconnected to the network. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event logging level* +- GP name: *Pol_EventLoggingLevel_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_EventLoggingLevel_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines which events the Offline Files feature records in the event log. + +Offline Files records events in the Application log in Event Viewer when it detects errors. By default, Offline Files records an event only when the offline files storage cache is corrupted. However, you can use this setting to specify additional events you want Offline Files to record. + +To use this setting, in the "Enter" box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels. + +- "0" records an error when the offline storage cache is corrupted. + +- "1" also records an event when the server hosting the offline file is disconnected from the network. + +- "2" also records events when the local computer is connected and disconnected from the network. + +- "3" also records an event when the server hosting the offline file is reconnected to the network. + +> [!NOTE] +> This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Event logging level* +- GP name: *Pol_EventLoggingLevel_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_ExclusionListSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables administrators to block certain file types from being created in the folders that have been made available offline. + +If you enable this policy setting, a user will be unable to create files with the specified file extensions in any of the folders that have been made available offline. + +If you disable or do not configure this policy setting, a user can create a file of any type in the folders that have been made available offline. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable file screens* +- GP name: *Pol_ExclusionListSettings* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_ExtExclusionList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Lists types of files that cannot be used offline. + +This setting lets you exclude certain types of files from automatic and manual caching for offline use. The system does not cache files of the type specified in this setting even when they reside on a network share configured for automatic caching. Also, if users try to make a file of this type available offline, the operation will fail and the following message will be displayed in the Synchronization Manager progress dialog box: "Files of this type cannot be made available offline." + +This setting is designed to protect files that cannot be separated, such as database components. + +To use this setting, type the file name extension in the "Extensions" box. To type more than one extension, separate the extensions with a semicolon (;). + +> [!NOTE] +> To make changes to this setting effective, you must log off and log on again. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Files not cached* +- GP name: *Pol_ExtExclusionList* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_GoOfflineAction_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files. + +This setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, you can use the "Action" box to specify how computers in the group respond. + +- "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible. + +- "Never go offline" indicates that network files are not available while the server is inaccessible. + +If you disable this setting or select the "Work offline" option, users can work offline if disconnected. + +If you do not configure this setting, users can work offline by default, but they can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section. + +Also, see the "Non-default server disconnect actions" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Action on server disconnect* +- GP name: *Pol_GoOfflineAction_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_GoOfflineAction_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files. + +This setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, you can use the "Action" box to specify how computers in the group respond. + +- "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible. + +- "Never go offline" indicates that network files are not available while the server is inaccessible. + +If you disable this setting or select the "Work offline" option, users can work offline if disconnected. + +If you do not configure this setting, users can work offline by default, but they can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To configure this setting without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section. + +Also, see the "Non-default server disconnect actions" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Action on server disconnect* +- GP name: *Pol_GoOfflineAction_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoCacheViewer_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting disables the Offline Files folder. + +This setting disables the "View Files" button on the Offline Files tab. As a result, users cannot use the Offline Files folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location. + +This setting does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as Windows Explorer, to view their offline files. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To view the Offline Files Folder, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click "View Files." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent use of Offline Files folder* +- GP name: *Pol_NoCacheViewer_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoCacheViewer_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting disables the Offline Files folder. + +This setting disables the "View Files" button on the Offline Files tab. As a result, users cannot use the Offline Files folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location. + +This setting does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as Windows Explorer, to view their offline files. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To view the Offline Files Folder, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click "View Files." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent use of Offline Files folder* +- GP name: *Pol_NoCacheViewer_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoConfigCache_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from enabling, disabling, or changing the configuration of Offline Files. + +This setting removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the Settings button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box. + +This is a comprehensive setting that locks down the configuration you establish by using other settings in this folder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> This setting provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this setting. You do not have to disable any other settings in this folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit user configuration of Offline Files* +- GP name: *Pol_NoConfigCache_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoConfigCache_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from enabling, disabling, or changing the configuration of Offline Files. + +This setting removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the Settings button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box. + +This is a comprehensive setting that locks down the configuration you establish by using other settings in this folder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> This setting provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this setting. You do not have to disable any other settings in this folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit user configuration of Offline Files* +- GP name: *Pol_NoConfigCache_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from making network files and folders available offline. + +If you enable this policy setting, users cannot designate files to be saved on their computer for offline use. However, Windows will still cache local copies of files that reside on network shares designated for automatic caching. + +If you disable or do not configure this policy setting, users can manually specify files and folders that they want to make available offline. + +> [!NOTE] +> - This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence. +> - The "Make Available Offline" command is called "Always available offline" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Make Available Offline" command* +- GP name: *Pol_NoMakeAvailableOffline_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from making network files and folders available offline. + +If you enable this policy setting, users cannot designate files to be saved on their computer for offline use. However, Windows will still cache local copies of files that reside on network shares designated for automatic caching. + +If you disable or do not configure this policy setting, users can manually specify files and folders that they want to make available offline. + +> [!NOTE] +> - This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence. +> - The "Make Available Offline" command is called "Always available offline" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Make Available Offline" command* +- GP name: *Pol_NoMakeAvailableOffline_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoPinFiles_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage a list of files and folders for which you want to block the "Make Available Offline" command. + +If you enable this policy setting, the "Make Available Offline" command is not available for the files and folders that you list. To specify these files and folders, click Show. In the Show Contents dialog box, in the Value Name column box, type the fully qualified UNC path to the file or folder. Leave the Value column field blank. + +If you disable this policy setting, the list of files and folders is deleted, including any lists inherited from lower precedence GPOs, and the "Make Available Offline" command is displayed for all files and folders. + +If you do not configure this policy setting, the "Make Available Offline" command is available for all files and folders. + +> [!NOTE] +> - This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings are combined, and the "Make Available Offline" command is unavailable for all specified files and folders. +> - The "Make Available Offline" command is called "Always available offline" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista. +> - This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching." It only affects the display of the "Make Available Offline" command in File Explorer. +> - If the "Remove 'Make Available Offline' command" policy setting is enabled, this setting has no effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Make Available Offline" for these files and folders* +- GP name: *Pol_NoPinFiles_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoPinFiles_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage a list of files and folders for which you want to block the "Make Available Offline" command. + +If you enable this policy setting, the "Make Available Offline" command is not available for the files and folders that you list. To specify these files and folders, click Show. In the Show Contents dialog box, in the Value Name column box, type the fully qualified UNC path to the file or folder. Leave the Value column field blank. + +If you disable this policy setting, the list of files and folders is deleted, including any lists inherited from lower precedence GPOs, and the "Make Available Offline" command is displayed for all files and folders. + +If you do not configure this policy setting, the "Make Available Offline" command is available for all files and folders. + +> [!NOTE] +> - This policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings are combined, and the "Make Available Offline" command is unavailable for all specified files and folders. +> - The "Make Available Offline" command is called "Always available offline" on computers running Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, Windows 7, or Windows Vista. +> - This policy setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching." It only affects the display of the "Make Available Offline" command in File Explorer. +> - If the "Remove 'Make Available Offline' command" policy setting is enabled, this setting has no effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Make Available Offline" for these files and folders* +- GP name: *Pol_NoPinFiles_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoReminders_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Hides or displays reminder balloons, and prevents users from changing the setting. + +Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed. + +If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. + +If you disable the setting, the system displays the reminder balloons and prevents users from hiding them. + +If this setting is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting. + +To prevent users from changing the setting while a setting is in effect, the system disables the "Enable reminders" option on the Offline Files tab + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To display or hide reminder balloons without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Enable reminders" check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off reminder balloons* +- GP name: *Pol_NoReminders_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_NoReminders_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Hides or displays reminder balloons, and prevents users from changing the setting. + +Reminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed. + +If you enable this setting, the system hides the reminder balloons, and prevents users from displaying them. + +If you disable the setting, the system displays the reminder balloons and prevents users from hiding them. + +If this setting is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting. + +To prevent users from changing the setting while a setting is in effect, the system disables the "Enable reminders" option on the Offline Files tab + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To display or hide reminder balloons without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Enable reminders" check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off reminder balloons* +- GP name: *Pol_NoReminders_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_OnlineCachingSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether files read from file shares over a slow network are transparently cached in the Offline Files cache for future reads. When a user tries to access a file that has been transparently cached, Windows reads from the cached copy after verifying its integrity. This improves end-user response times and decreases bandwidth consumption over WAN links. + +The cached files are temporary and are not available to the user when offline. The cached files are not kept in sync with the version on the server, and the most current version from the server is always available for subsequent reads. + +This policy setting is triggered by the configured round trip network latency value. We recommend using this policy setting when the network connection to the server is slow. For example, you can configure a value of 60 ms as the round trip latency of the network above which files should be transparently cached in the Offline Files cache. If the round trip latency of the network is less than 60ms, reads to remote files will not be cached. + +If you enable this policy setting, transparent caching is enabled and configurable. + +If you disable or do not configure this policy setting, remote files will be not be transparently cached on client computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Transparent Caching* +- GP name: *Pol_OnlineCachingSettings* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_AlwaysPinSubFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting makes subfolders available offline whenever their parent folder is made available offline. + +This setting automatically extends the "make available offline" setting to all new and existing subfolders of a folder. Users do not have the option of excluding subfolders. + +If you enable this setting, when you make a folder available offline, all folders within that folder are also made available offline. Also, new folders that you create within a folder that is available offline are made available offline when the parent folder is synchronized. + +If you disable this setting or do not configure it, the system asks users whether they want subfolders to be made available offline when they make a parent folder available offline. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Subfolders always available offline* +- GP name: *Pol_AlwaysPinSubFolders* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_PurgeAtLogoff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting deletes local copies of the user's offline files when the user logs off. + +This setting specifies that automatically and manually cached offline files are retained only while the user is logged on to the computer. When the user logs off, the system deletes all local copies of offline files. + +If you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use. + +> [!CAUTION] +> Files are not synchronized before they are deleted. Any changes to local files since the last synchronization are lost. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *At logoff, delete local copy of user’s offline files* +- GP name: *Pol_PurgeAtLogoff* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_QuickAdimPin** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn on economical application of administratively assigned Offline Files. + +If you enable or do not configure this policy setting, only new files and folders in administratively assigned folders are synchronized at logon. Files and folders that are already available offline are skipped and are synchronized later. + +If you disable this policy setting, all administratively assigned folders are synchronized at logon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on economical application of administratively assigned Offline Files* +- GP name: *Pol_QuickAdimPin* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_ReminderFreq_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how often reminder balloon updates appear. + +If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To set reminder balloon frequency without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Display reminder balloons every ... minutes" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reminder balloon frequency* +- GP name: *Pol_ReminderFreq_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_ReminderFreq_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how often reminder balloon updates appear. + +If you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To set reminder balloon frequency without establishing a setting, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Display reminder balloons every ... minutes" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reminder balloon frequency* +- GP name: *Pol_ReminderFreq_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_ReminderInitTimeout_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how long the first reminder balloon for a network status change is displayed. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the first reminder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Initial reminder balloon lifetime* +- GP name: *Pol_ReminderInitTimeout_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_ReminderInitTimeout_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how long the first reminder balloon for a network status change is displayed. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the first reminder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Initial reminder balloon lifetime* +- GP name: *Pol_ReminderInitTimeout_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_ReminderTimeout_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how long updated reminder balloons are displayed. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the update reminder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reminder balloon lifetime* +- GP name: *Pol_ReminderTimeout_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_ReminderTimeout_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how long updated reminder balloons are displayed. + +Reminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the update reminder. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reminder balloon lifetime* +- GP name: *Pol_ReminderTimeout_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_SlowLinkSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the network latency and throughput thresholds that will cause a client computers to transition files and folders that are already available offline to the slow-link mode so that the user's access to this data is not degraded due to network slowness. When Offline Files is operating in the slow-link mode, all network file requests are satisfied from the Offline Files cache. This is similar to a user working offline. + +If you enable this policy setting, Offline Files uses the slow-link mode if the network throughput between the client and the server is below (slower than) the Throughput threshold parameter, or if the round-trip network latency is above (slower than) the Latency threshold parameter. + +You can configure the slow-link mode by specifying threshold values for Throughput (in bits per second) and/or Latency (in milliseconds) for specific UNC paths. We recommend that you always specify a value for Latency, since the round-trip network latency detection is faster. You can use wildcard characters (*) for specifying UNC paths. If you do not specify a Latency or Throughput value, computers running Windows Vista or Windows Server 2008 will not use the slow-link mode. + +If you do not configure this policy setting, computers running Windows Vista or Windows Server 2008 will not transition a shared folder to the slow-link mode. Computers running Windows 7 or Windows Server 2008 R2 will use the default latency value of 80 milliseconds when transitioning a folder to the slow-link mode. Computers running Windows 8 or Windows Server 2012 will use the default latency value of 35 milliseconds when transitioning a folder to the slow-link mode. To avoid extra charges on cell phone or broadband plans, it may be necessary to configure the latency threshold to be lower than the round-trip network latency. + +In Windows Vista or Windows Server 2008, once transitioned to slow-link mode, users will continue to operate in slow-link mode until the user clicks the Work Online button on the toolbar in Windows Explorer. Data will only be synchronized to the server if the user manually initiates synchronization by using Sync Center. + +In Windows 7, Windows Server 2008 R2, Windows 8 or Windows Server 2012, when operating in slow-link mode Offline Files synchronizes the user's files in the background at regular intervals, or as configured by the "Configure Background Sync" policy. While in slow-link mode, Windows periodically checks the connection to the folder and brings the folder back online if network speeds improve. + +In Windows 8 or Windows Server 2012, set the Latency threshold to 1ms to keep users always working offline in slow-link mode. + +If you disable this policy setting, computers will not use the slow-link mode. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure slow-link mode* +- GP name: *Pol_SlowLinkSettings* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_SlowLinkSpeed** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the threshold value at which Offline Files considers a network connection to be "slow". Any network speed below this value is considered to be slow. + +When a connection is considered slow, Offline Files automatically adjust its behavior to avoid excessive synchronization traffic and will not automatically reconnect to a server when the presence of a server is detected. + +If you enable this setting, you can configure the threshold value that will be used to determine a slow network connection. + +If this setting is disabled or not configured, the default threshold value of 64,000 bps is used to determine if a network connection is considered to be slow. + +> [!NOTE] +> Use the following formula when entering the slow link value: [ bps / 100]. For example, if you want to set a threshold value of 128,000 bps, enter a value of 1280. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Slow link speed* +- GP name: *Pol_SlowLinkSpeed* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_SyncAtLogoff_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether offline files are fully synchronized when users log off. + +This setting also disables the "Synchronize all offline files before logging off" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current. + +If you disable this setting, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current. + +If you do not configure this setting, the system performs a quick synchronization by default, but users can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To change the synchronization method without changing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging off" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize all offline files before logging off* +- GP name: *Pol_SyncAtLogoff_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_SyncAtLogoff_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether offline files are fully synchronized when users log off. + +This setting also disables the "Synchronize all offline files before logging off" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current. + +If you disable this setting, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current. + +If you do not configure this setting, the system performs a quick synchronization by default, but users can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To change the synchronization method without changing a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging off" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize all offline files before logging off* +- GP name: *Pol_SyncAtLogoff_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_SyncAtLogon_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether offline files are fully synchronized when users log on. + +This setting also disables the "Synchronize all offline files before logging on" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, offline files are fully synchronized at logon. Full synchronization ensures that offline files are complete and current. Enabling this setting automatically enables logon synchronization in Synchronization Manager. + +If this setting is disabled and Synchronization Manager is configured for logon synchronization, the system performs only a quick synchronization. Quick synchronization ensures that files are complete but does not ensure that they are current. + +If you do not configure this setting and Synchronization Manager is configured for logon synchronization, the system performs a quick synchronization by default, but users can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To change the synchronization method without setting a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging on" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize all offline files when logging on* +- GP name: *Pol_SyncAtLogon_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + +
    + + +**ADMX_OfflineFiles/Pol_SyncAtLogon_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether offline files are fully synchronized when users log on. + +This setting also disables the "Synchronize all offline files before logging on" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it. + +If you enable this setting, offline files are fully synchronized at logon. Full synchronization ensures that offline files are complete and current. Enabling this setting automatically enables logon synchronization in Synchronization Manager. + +If this setting is disabled and Synchronization Manager is configured for logon synchronization, the system performs only a quick synchronization. Quick synchronization ensures that files are complete but does not ensure that they are current. + +If you do not configure this setting and Synchronization Manager is configured for logon synchronization, the system performs a quick synchronization by default, but users can change this option. + +This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. + +> [!TIP] +> To change the synchronization method without setting a setting, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging on" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize all offline files when logging on* +- GP name: *Pol_SyncAtLogon_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_SyncAtSuspend_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether offline files are synchronized before a computer is suspended. + +If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version. + +If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. + +> [!NOTE] +> If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize offline files before suspend* +- GP name: *Pol_SyncAtSuspend_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_SyncAtSuspend_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether offline files are synchronized before a computer is suspended. + +If you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version. + +If you disable or do not configuring this setting, files are not synchronized when the computer is suspended. + +> [!NOTE] +> If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize offline files before suspend* +- GP name: *Pol_SyncAtSuspend_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_SyncOnCostedNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether offline files are synchronized in the background when it could result in extra charges on cell phone or broadband plans. + +If you enable this setting, synchronization can occur in the background when the user's network is roaming, near, or over the plan's data limit. This may result in extra charges on cell phone or broadband plans. + +If this setting is disabled or not configured, synchronization will not run in the background on network folders when the user's network is roaming, near, or over the plan's data limit. The network folder must also be in "slow-link" mode, as specified by the "Configure slow-link mode" policy to avoid network usage. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable file synchronization on costed networks* +- GP name: *Pol_SyncOnCostedNetwork* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the "Work offline" command from Explorer, preventing users from manually changing whether Offline Files is in online mode or offline mode. + +If you enable this policy setting, the "Work offline" command is not displayed in File Explorer. + +If you disable or do not configure this policy setting, the "Work offline" command is displayed in File Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Work offline" command* +- GP name: *Pol_WorkOfflineDisabled_1* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + + +**ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the "Work offline" command from Explorer, preventing users from manually changing whether Offline Files is in online mode or offline mode. + +If you enable this policy setting, the "Work offline" command is not displayed in File Explorer. + +If you disable or do not configure this policy setting, the "Work offline" command is displayed in File Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Work offline" command* +- GP name: *Pol_WorkOfflineDisabled_2* +- GP path: *Network\Offline Files* +- GP ADMX file name: *OfflineFiles.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md new file mode 100644 index 0000000000..ed16a33a35 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -0,0 +1,806 @@ +--- +title: Policy CSP - ADMX_PeerToPeerCaching +description: Policy CSP - ADMX_PeerToPeerCaching +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/16/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_PeerToPeerCaching +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_PeerToPeerCaching policies + +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers +
    +
    + ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB +
    +
    + ADMX_PeerToPeerCaching/SetCachePercent +
    +
    + ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge +
    +
    + ADMX_PeerToPeerCaching/SetDowngrading +
    +
    + +
    + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether BranchCache is enabled on client computers to which this policy is applied. In addition to this policy setting, you must specify whether the client computers are hosted cache mode or distributed cache mode clients. To do so, configure one of the following the policy settings: + +- Set BranchCache Distributed Cache mode +- Set BranchCache Hosted Cache mode +- Configure Hosted Cache Servers + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache. +- Enabled. With this selection, BranchCache is turned on for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache is turned off for all client computers where the policy is applied. + +> [!NOTE] +> This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on BranchCache* +- GP name: *EnableWindowsBranchCache* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether BranchCache distributed cache mode is enabled on client computers to which this policy is applied. In addition to this policy, you must use the policy "Turn on BranchCache" to enable BranchCache on client computers. + +In distributed cache mode, client computers download content from BranchCache-enabled main office content servers, cache the content locally, and serve the content to other BranchCache distributed cache mode clients in the branch office. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache. +- Enabled. With this selection, BranchCache distributed cache mode is enabled for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache distributed cache mode is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache distributed cache mode is turned off for all client computers where the policy is applied. + +> [!NOTE] +> This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set BranchCache Distributed Cache mode* +- GP name: *EnableWindowsBranchCache_Distributed* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether BranchCache hosted cache mode is enabled on client computers to which this policy is applied. In addition to this policy, you must use the policy "Turn on BranchCache" to enable BranchCache on client computers. + +When a client computer is configured as a hosted cache mode client, it is able to download cached content from a hosted cache server that is located at the branch office. In addition, when the hosted cache client obtains content from a content server, the client can upload the content to the hosted cache server for access by other hosted cache clients at the branch office. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to enable BranchCache on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the enabled setting that you use on individual client computers where you want to enable BranchCache. +- Enabled. With this selection, BranchCache hosted cache mode is enabled for all client computers where the policy is applied. For example, if this policy is enabled in domain Group Policy, BranchCache hosted cache mode is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache hosted cache mode is turned off for all client computers where the policy is applied. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +- Type the name of the hosted cache server. Specifies the computer name of the hosted cache server. Because the hosted cache server name is also specified in the certificate enrolled to the hosted cache server, the name that you enter here must match the name of the hosted cache server that is specified in the server certificate. + +Hosted cache clients must trust the server certificate that is issued to the hosted cache server. Ensure that the issuing CA certificate is installed in the Trusted Root Certification Authorities certificate store on all hosted cache client computers. + +> [!NOTE] +> This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set BranchCache Hosted Cache mode* +- GP name: *EnableWindowsBranchCache_Hosted* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether client computers should attempt the automatic configuration of hosted cache mode by searching for hosted cache servers publishing service connection points that are associated with the client's current Active Directory site. If you enable this policy setting, client computers to which the policy setting is applied search for hosted cache servers using Active Directory, and will prefer both these servers and hosted cache mode rather than manual BranchCache configuration or BranchCache configuration by other group policies. + +If you enable this policy setting in addition to the "Turn on BranchCache" policy setting, BranchCache clients attempt to discover hosted cache servers in the local branch office. If client computers detect hosted cache servers, hosted cache mode is turned on. If they do not detect hosted cache servers, hosted cache mode is not turned on, and the client uses any other configuration that is specified manually or by Group Policy. + +When this policy setting is applied, the client computer performs or does not perform automatic hosted cache server discovery under the following circumstances: + +If no other BranchCache mode-based policy settings are applied, the client computer performs automatic hosted cache server discovery. If one or more hosted cache servers is found, the client computer self-configures for hosted cache mode. + +If the policy setting "Set BranchCache Distributed Cache Mode" is applied in addition to this policy, the client computer performs automatic hosted cache server discovery. If one or more hosted cache servers are found, the client computer self-configures for hosted cache mode only. + +If the policy setting "Set BranchCache Hosted Cache Mode" is applied, the client computer does not perform automatic hosted cache discovery. This is also true in cases where the policy setting "Configure Hosted Cache Servers" is applied. + +This policy setting can only be applied to client computers that are running at least Windows 8. This policy has no effect on computers that are running Windows 7 or Windows Vista. + +If you disable, or do not configure this setting, a client will not attempt to discover hosted cache servers by service connection point. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting, and client computers do not perform hosted cache server discovery. +- Enabled. With this selection, the policy setting is applied to client computers, which perform automatic hosted cache server discovery and which are configured as hosted cache mode clients. +- Disabled. With this selection, this policy is not applied to client computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Automatic Hosted Cache Discovery by Service Connection Point* +- GP name: *EnableWindowsBranchCache_HostedCacheDiscovery* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether client computers are configured to use hosted cache mode and provides the computer name of the hosted cache servers that are available to the client computers. Hosted cache mode enables client computers in branch offices to retrieve content from one or more hosted cache servers that are installed in the same office location. You can use this setting to automatically configure client computers that are configured for hosted cache mode with the computer names of the hosted cache servers in the branch office. + +If you enable this policy setting and specify valid computer names of hosted cache servers, hosted cache mode is enabled for all client computers to which the policy setting is applied. For this policy setting to take effect, you must also enable the "Turn on BranchCache" policy setting. + +This policy setting can only be applied to client computers that are running at least Windows 8. This policy has no effect on computers that are running Windows 7 or Windows Vista. Client computers to which this policy setting is applied, in addition to the "Set BranchCache Hosted Cache mode" policy setting, use the hosted cache servers that are specified in this policy setting and do not use the hosted cache server that is configured in the policy setting "Set BranchCache Hosted Cache Mode." + +If you do not configure this policy setting, or if you disable this policy setting, client computers that are configured with hosted cache mode still function correctly. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache settings are not applied to client computers by this policy setting. +- Enabled. With this selection, the policy setting is applied to client computers, which are configured as hosted cache mode clients that use the hosted cache servers that you specify in "Hosted cache servers." +- Disabled. With this selection, this policy is not applied to client computers. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +- Hosted cache servers. To add hosted cache server computer names to this policy setting, click Enabled, and then click Show. The Show Contents dialog box opens. Click Value, and then type the computer names of the hosted cache servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Hosted Cache Servers* +- GP name: *EnableWindowsBranchCache_HostedMultipleServers* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + + +**ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting is used only when you have deployed one or more BranchCache-enabled file servers at your main office. This policy setting specifies when client computers in branch offices start caching content from file servers based on the network latency - or delay - that occurs when the clients download content from the main office over a Wide Area Network (WAN) link. When you configure a value for this setting, which is the maximum round trip network latency allowed before caching begins, clients do not cache content until the network latency reaches the specified value; when network latency is greater than the value, clients begin caching content after they receive it from the file servers. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache latency settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache latency setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache latency settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the latency setting that you use on individual client computers. +- Enabled. With this selection, the BranchCache maximum round trip latency setting is enabled for all client computers where the policy is applied. For example, if Configure BranchCache for network files is enabled in domain Group Policy, the BranchCache latency setting that you specify in the policy is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache client computers use the default latency setting of 80 milliseconds. + +In circumstances where this policy setting is enabled, you can also select and configure the following option: + +- Type the maximum round trip network latency (milliseconds) after which caching begins. Specifies the amount of time, in milliseconds, after which BranchCache client computers begin to cache content locally. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure BranchCache for network files* +- GP name: *EnableWindowsBranchCache_SMB* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + + +**ADMX_PeerToPeerCaching/SetCachePercent** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the default percentage of total disk space that is allocated for the BranchCache disk cache on client computers. + +If you enable this policy setting, you can configure the percentage of total disk space to allocate for the cache. + +If you disable or do not configure this policy setting, the cache is set to 5 percent of the total disk space on the client computer. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache client computer cache settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache client computer cache setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache client computer cache settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the client computer cache setting that you use on individual client computers. +- Enabled. With this selection, the BranchCache client computer cache setting is enabled for all client computers where the policy is applied. For example, if Set percentage of disk space used for client computer cache is enabled in domain Group Policy, the BranchCache client computer cache setting that you specify in the policy is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache client computers use the default client computer cache setting of five percent of the total disk space on the client computer. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +- Specify the percentage of total disk space allocated for the cache. Specifies an integer that is the percentage of total client computer disk space to use for the BranchCache client computer cache. + +> [!NOTE] +> This policy setting is supported on computers that are running Windows Vista Business, Enterprise, and Ultimate editions with Background Intelligent Transfer Service (BITS) 4.0 installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set percentage of disk space used for client computer cache* +- GP name: *SetCachePercent* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + + +**ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the default age in days for which segments are valid in the BranchCache data cache on client computers. + +If you enable this policy setting, you can configure the age for segments in the data cache. + +If you disable or do not configure this policy setting, the age is set to 28 days. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, BranchCache client computer cache age settings are not applied to client computers by this policy. In the circumstance where client computers are domain members but you do not want to configure a BranchCache client computer cache age setting on all client computers, you can specify Not Configured for this domain Group Policy setting, and then configure local computer policy to enable BranchCache client computer cache age settings on individual client computers. Because the domain Group Policy setting is not configured, it will not over-write the client computer cache age setting that you use on individual client computers. +- Enabled. With this selection, the BranchCache client computer cache age setting is enabled for all client computers where the policy is applied. For example, if this policy setting is enabled in domain Group Policy, the BranchCache client computer cache age that you specify in the policy is turned on for all domain member client computers to which the policy is applied. +- Disabled. With this selection, BranchCache client computers use the default client computer cache age setting of 28 days on the client computer. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +- Specify the age in days for which segments in the data cache are valid. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set age for segments in the data cache* +- GP name: *SetDataCacheEntryMaxAge* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + + +**ADMX_PeerToPeerCaching/SetDowngrading** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether BranchCache-capable client computers operate in a downgraded mode in order to maintain compatibility with previous versions of BranchCache. If client computers do not use the same BranchCache version, cache efficiency might be reduced because client computers that are using different versions of BranchCache might store cache data in incompatible formats. + +If you enable this policy setting, all clients use the version of BranchCache that you specify in "Select from the following versions." + +If you do not configure this setting, all clients will use the version of BranchCache that matches their operating system. + +Policy configuration + +Select one of the following: + +- Not Configured. With this selection, this policy setting is not applied to client computers, and the clients run the version of BranchCache that is included with their operating system. +- Enabled. With this selection, this policy setting is applied to client computers based on the value of the option setting "Select from the following versions" that you specify. +- Disabled. With this selection, this policy setting is not applied to client computers, and the clients run the version of BranchCache that is included with their operating system. + +In circumstances where this setting is enabled, you can also select and configure the following option: + +Select from the following versions + +- Windows Vista with BITS 4.0 installed, Windows 7, or Windows Server 2008 R2. If you select this version, later versions of Windows run the version of BranchCache that is included in these operating systems rather than later versions of BranchCache. +- Windows 8. If you select this version, Windows 8 will run the version of BranchCache that is included in the operating system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Client BranchCache Version Support* +- GP name: *SetDowngrading* +- GP path: *Network\BranchCache* +- GP ADMX file name: *PeerToPeerCaching.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md new file mode 100644 index 0000000000..0e39a89004 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md @@ -0,0 +1,363 @@ +--- +title: Policy CSP - ADMX_PerformanceDiagnostics +description: Policy CSP - ADMX_PerformanceDiagnostics +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/16/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_PerformanceDiagnostics +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_PerformanceDiagnostics policies + +
    +
    + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1 +
    +
    + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2 +
    +
    + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3 +
    +
    + ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4 +
    +
    + + +
    + + +**ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the execution level for Windows Boot Performance Diagnostics. + +If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Boot Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Boot Performance problems and indicate to the user that assisted resolution is available. + +If you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Boot Performance problems that are handled by the DPS. + +If you do not configure this policy setting, the DPS will enable Windows Boot Performance for resolution by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No system restart or service restart is required for this policy to take effect: changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Scenario Execution Level* +- GP name: *WdiScenarioExecutionPolicy_1* +- GP path: *System\Troubleshooting and Diagnostics\Windows Boot Performance Diagnostics* +- GP ADMX file name: *PerformanceDiagnostics.admx* + + + +
    + + +**ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines the execution level for Windows Standby/Resume Performance Diagnostics. + +If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Standby/Resume Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Standby/Resume Performance problems and indicate to the user that assisted resolution is available. + +If you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Standby/Resume Performance problems that are handled by the DPS. + +If you do not configure this policy setting, the DPS will enable Windows Standby/Resume Performance for resolution by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No system restart or service restart is required for this policy to take effect: changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Scenario Execution Level* +- GP name: *WdiScenarioExecutionPolicy_2* +- GP path: *System\Troubleshooting and Diagnostics\Windows System Responsiveness Performance Diagnostics* +- GP ADMX file name: *PerformanceDiagnostics.admx* + + + +
    + + +**ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the execution level for Windows Shutdown Performance Diagnostics. + +If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Shutdown Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Shutdown Performance problems and indicate to the user that assisted resolution is available. + +If you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Shutdown Performance problems that are handled by the DPS. + +If you do not configure this policy setting, the DPS will enable Windows Shutdown Performance for resolution by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No system restart or service restart is required for this policy to take effect: changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Scenario Execution Level* +- GP name: *WdiScenarioExecutionPolicy_3* +- GP path: *System\Troubleshooting and Diagnostics\Windows Shutdown Performance Diagnostics* +- GP ADMX file name: *PerformanceDiagnostics.admx* + + + +
    + + +**ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines the execution level for Windows Standby/Resume Performance Diagnostics. + +If you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Standby/Resume Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Standby/Resume Performance problems and indicate to the user that assisted resolution is available. + +If you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Standby/Resume Performance problems that are handled by the DPS. + +If you do not configure this policy setting, the DPS will enable Windows Standby/Resume Performance for resolution by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No system restart or service restart is required for this policy to take effect: changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Scenario Execution Level* +- GP name: *WdiScenarioExecutionPolicy_4* +- GP path: *System\Troubleshooting and Diagnostics\Windows Standby/Resume Performance Diagnostics* +- GP ADMX file name: *PerformanceDiagnostics.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-power.md b/windows/client-management/mdm/policy-csp-admx-power.md new file mode 100644 index 0000000000..3d1a58a8f1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-power.md @@ -0,0 +1,1882 @@ +--- +title: Policy CSP - ADMX_Power +description: Policy CSP - ADMX_Power +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/22/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Power +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Power policies + +
    +
    + ADMX_Power/ACConnectivityInStandby_2 +
    +
    + ADMX_Power/ACCriticalSleepTransitionsDisable_2 +
    +
    + ADMX_Power/ACStartMenuButtonAction_2 +
    +
    + ADMX_Power/AllowSystemPowerRequestAC +
    +
    + ADMX_Power/AllowSystemPowerRequestDC +
    +
    + ADMX_Power/AllowSystemSleepWithRemoteFilesOpenAC +
    +
    + ADMX_Power/AllowSystemSleepWithRemoteFilesOpenDC +
    +
    + ADMX_Power/CustomActiveSchemeOverride_2 +
    +
    + ADMX_Power/DCBatteryDischargeAction0_2 +
    +
    + ADMX_Power/DCBatteryDischargeAction1_2 +
    +
    + ADMX_Power/DCBatteryDischargeLevel0_2 +
    +
    + ADMX_Power/DCBatteryDischargeLevel1UINotification_2 +
    +
    + ADMX_Power/DCBatteryDischargeLevel1_2 +
    +
    + ADMX_Power/DCConnectivityInStandby_2 +
    +
    + ADMX_Power/DCCriticalSleepTransitionsDisable_2 +
    +
    + ADMX_Power/DCStartMenuButtonAction_2 +
    +
    + ADMX_Power/DiskACPowerDownTimeOut_2 +
    +
    + ADMX_Power/DiskDCPowerDownTimeOut_2 +
    +
    + ADMX_Power/Dont_PowerOff_AfterShutdown +
    +
    + ADMX_Power/EnableDesktopSlideShowAC +
    +
    + ADMX_Power/EnableDesktopSlideShowDC +
    +
    + ADMX_Power/InboxActiveSchemeOverride_2 +
    +
    + ADMX_Power/PW_PromptPasswordOnResume +
    +
    + ADMX_Power/PowerThrottlingTurnOff +
    +
    + ADMX_Power/ReserveBatteryNotificationLevel +
    +
    + + +
    + + +**ADMX_Power/ACConnectivityInStandby_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control the network connectivity state in standby on modern standby-capable systems. + +If you enable this policy setting, network connectivity will be maintained in standby. + +If you disable this policy setting, network connectivity in standby is not guaranteed. This connectivity restriction currently applies to WLAN networks only, and is subject to change. + +If you do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow network connectivity during connected-standby (plugged in)* +- GP name: *ACConnectivityInStandby_2* +- GP path: *System\Power Management\Sleep Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/ACCriticalSleepTransitionsDisable_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn on the ability for applications and services to prevent the system from sleeping. + +If you enable this policy setting, an application or service may prevent the system from sleeping (Hybrid Sleep, Stand By, or Hibernate). + +If you disable or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on the ability for applications to prevent sleep transitions (plugged in)* +- GP name: *ACCriticalSleepTransitionsDisable_2* +- GP path: *System\Power Management\Sleep Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/ACStartMenuButtonAction_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the action that Windows takes when a user presses the Start menu Power button. + +If you enable this policy setting, select one of the following actions: + +- Sleep +- Hibernate +- Shut down + +If you disable this policy or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Select the Start menu Power button action (plugged in)* +- GP name: *ACStartMenuButtonAction_2* +- GP path: *System\Power Management\Button Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/AllowSystemPowerRequestAC** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows applications and services to prevent automatic sleep. + +If you enable this policy setting, any application, service, or device driver prevents Windows from automatically transitioning to sleep after a period of user inactivity. + +If you disable or do not configure this policy setting, applications, services, or drivers do not prevent Windows from automatically transitioning to sleep. Only user input is used to determine if Windows should automatically sleep. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow applications to prevent automatic sleep (plugged in)* +- GP name: *AllowSystemPowerRequestAC* +- GP path: *System\Power Management\Sleep Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/AllowSystemPowerRequestDC** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows applications and services to prevent automatic sleep. + +If you enable this policy setting, any application, service, or device driver prevents Windows from automatically transitioning to sleep after a period of user inactivity. + +If you disable or do not configure this policy setting, applications, services, or drivers do not prevent Windows from automatically transitioning to sleep. Only user input is used to determine if Windows should automatically sleep. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow applications to prevent automatic sleep (on battery)* +- GP name: *AllowSystemPowerRequestDC* +- GP path: *System\Power Management\Sleep Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/AllowSystemSleepWithRemoteFilesOpenAC** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage automatic sleep with open network files. + +If you enable this policy setting, the computer automatically sleeps when network files are open. + +If you disable or do not configure this policy setting, the computer does not automatically sleep when network files are open. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow automatic sleep with Open Network Files (plugged in)* +- GP name: *AllowSystemSleepWithRemoteFilesOpenAC* +- GP path: *System\Power Management\Sleep Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/AllowSystemSleepWithRemoteFilesOpenDC** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage automatic sleep with open network files. + +If you enable this policy setting, the computer automatically sleeps when network files are open. + +If you disable or do not configure this policy setting, the computer does not automatically sleep when network files are open. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow automatic sleep with Open Network Files (on battery)* +- GP name: *AllowSystemSleepWithRemoteFilesOpenDC* +- GP path: *System\Power Management\Sleep Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/CustomActiveSchemeOverride_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the active power plan from a specified power plan’s GUID. The GUID for a custom power plan GUID can be retrieved by using powercfg, the power configuration command line tool. + +If you enable this policy setting, you must specify a power plan, specified as a GUID using the following format: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX (For example, 103eea6e-9fcd-4544-a713-c282d8e50083), indicating the power plan to be active. + +If you disable or do not configure this policy setting, users can see and change this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify a custom active power plan* +- GP name: *CustomActiveSchemeOverride_2* +- GP path: *System\Power Management* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DCBatteryDischargeAction0_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the action that Windows takes when battery capacity reaches the critical battery notification level. + +If you enable this policy setting, select one of the following actions: + +- Take no action +- Sleep +- Hibernate +- Shut down + +If you disable or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Critical battery notification action* +- GP name: *DCBatteryDischargeAction0_2* +- GP path: *System\Power Management\Notification Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DCBatteryDischargeAction1_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the action that Windows takes when battery capacity reaches the low battery notification level. + +If you enable this policy setting, select one of the following actions: + +- Take no action +- Sleep +- Hibernate +- Shut down + +If you disable or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Low battery notification action* +- GP name: *DCBatteryDischargeAction1_2* +- GP path: *System\Power Management\Notification Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DCBatteryDischargeLevel0_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the percentage of battery capacity remaining that triggers the critical battery notification action. + +If you enable this policy setting, you must enter a numeric value (percentage) to set the battery level that triggers the critical notification. + +To set the action that is triggered, see the "Critical Battery Notification Action" policy setting. + +If you disable this policy setting or do not configure it, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Critical battery notification level* +- GP name: *DCBatteryDischargeLevel0_2* +- GP path: *System\Power Management\Notification Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DCBatteryDischargeLevel1UINotification_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the user notification when the battery capacity remaining equals the low battery notification level. + +If you enable this policy setting, Windows shows a notification when the battery capacity remaining equals the low battery notification level. + +To configure the low battery notification level, see the "Low Battery Notification Level" policy setting. + +The notification will only be shown if the "Low Battery Notification Action" policy setting is configured to "No Action". + +If you disable or do not configure this policy setting, users can control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off low battery user notification* +- GP name: *DCBatteryDischargeLevel1UINotification_2* +- GP path: *System\Power Management\Notification Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DCBatteryDischargeLevel1_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the percentage of battery capacity remaining that triggers the low battery notification action. + +If you enable this policy setting, you must enter a numeric value (percentage) to set the battery level that triggers the low notification. + +To set the action that is triggered, see the "Low Battery Notification Action" policy setting. + +If you disable this policy setting or do not configure it, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Low battery notification level* +- GP name: *DCBatteryDischargeLevel1_2* +- GP path: *System\Power Management\Notification Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DCConnectivityInStandby_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control the network connectivity state in standby on modern standby-capable systems. + +If you enable this policy setting, network connectivity will be maintained in standby. + +If you disable this policy setting, network connectivity in standby is not guaranteed. This connectivity restriction currently applies to WLAN networks only, and is subject to change. + +If you do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow network connectivity during connected-standby (on battery)* +- GP name: *DCConnectivityInStandby_2* +- GP path: *System\Power Management\Sleep Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DCCriticalSleepTransitionsDisable_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn on the ability for applications and services to prevent the system from sleeping. + +If you enable this policy setting, an application or service may prevent the system from sleeping (Hybrid Sleep, Stand By, or Hibernate). + +If you disable or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on the ability for applications to prevent sleep transitions (on battery)* +- GP name: *DCCriticalSleepTransitionsDisable_2* +- GP path: *System\Power Management\Sleep Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DCStartMenuButtonAction_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the action that Windows takes when a user presses the Start menu Power button. + +If you enable this policy setting, select one of the following actions: + +- Sleep +- Hibernate +- Shut down + +If you disable this policy or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Select the Start menu Power button action (on battery)* +- GP name: *DCStartMenuButtonAction_2* +- GP path: *System\Power Management\Button Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DiskACPowerDownTimeOut_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the period of inactivity before Windows turns off the hard disk. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the hard disk. + +If you disable or do not configure this policy setting, users can see and change this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn Off the hard disk (plugged in)* +- GP name: *DiskACPowerDownTimeOut_2* +- GP path: *System\Power Management\Hard Disk Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/DiskDCPowerDownTimeOut_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the period of inactivity before Windows turns off the hard disk. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the hard disk. + +If you disable or do not configure this policy setting, users can see and change this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn Off the hard disk (on battery)* +- GP name: *DiskDCPowerDownTimeOut_2* +- GP path: *System\Power Management\Hard Disk Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/Dont_PowerOff_AfterShutdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether power is automatically turned off when Windows shutdown completes. + +This setting does not affect Windows shutdown behavior when shutdown is manually selected using the Start menu or Task Manager user interfaces. + +Applications such as UPS software may rely on Windows shutdown behavior. + +This setting is only applicable when Windows shutdown is initiated by software programs invoking the Windows programming interfaces ExitWindowsEx() or InitiateSystemShutdown(). + +If you enable this policy setting, the computer system safely shuts down and remains in a powered state, ready for power to be safely removed. + +If you disable or do not configure this policy setting, the computer system safely shuts down to a fully powered-off state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not turn off system power after a Windows system shutdown has occurred.* +- GP name: *Dont_PowerOff_AfterShutdown* +- GP path: *System* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/EnableDesktopSlideShowAC** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify if Windows should enable the desktop background slideshow. + +If you enable this policy setting, desktop background slideshow is enabled. + +If you disable this policy setting, the desktop background slideshow is disabled. + +If you disable or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on desktop background slideshow (plugged in)* +- GP name: *EnableDesktopSlideShowAC* +- GP path: *System\Power Management\Video and Display Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/EnableDesktopSlideShowDC** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify if Windows should enable the desktop background slideshow. + +If you enable this policy setting, desktop background slideshow is enabled. + +If you disable this policy setting, the desktop background slideshow is disabled. + +If you disable or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on desktop background slideshow (on battery)* +- GP name: *EnableDesktopSlideShowDC* +- GP path: *System\Power Management\Video and Display Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/InboxActiveSchemeOverride_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the active power plan from a list of default Windows power plans. To specify a custom power plan, use the Custom Active Power Plan setting. + +If you enable this policy setting, specify a power plan from the Active Power Plan list. + +If you disable or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Select an active power plan* +- GP name: *InboxActiveSchemeOverride_2* +- GP path: *System\Power Management* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/PW_PromptPasswordOnResume** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure client computers to lock and prompt for a password when resuming from a hibernate or suspend state. + +If you enable this policy setting, the client computer is locked and prompted for a password when it is resumed from a suspend or hibernate state. + +If you disable or do not configure this policy setting, users control if their computer is automatically locked or not after performing a resume operation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prompt for password on resume from hibernate/suspend* +- GP name: *PW_PromptPasswordOnResume* +- GP path: *System\Power Management* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/PowerThrottlingTurnOff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Power Throttling. + +If you enable this policy setting, Power Throttling will be turned off. + +If you disable or do not configure this policy setting, users control this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Power Throttling* +- GP name: *PowerThrottlingTurnOff* +- GP path: *System\Power Management\Power Throttling Settings* +- GP ADMX file name: *Power.admx* + + + +
    + + +**ADMX_Power/ReserveBatteryNotificationLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the percentage of battery capacity remaining that triggers the reserve power mode. + +If you enable this policy setting, you must enter a numeric value (percentage) to set the battery level that triggers the reserve power notification. + +If you disable or do not configure this policy setting, users can see and change this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reserve battery notification level* +- GP name: *ReserveBatteryNotificationLevel* +- GP path: *System\Power Management\Notification Settings* +- GP ADMX file name: *Power.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md new file mode 100644 index 0000000000..5880faae13 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md @@ -0,0 +1,352 @@ +--- +title: Policy CSP - ADMX_PowerShellExecutionPolicy +description: Policy CSP - ADMX_PowerShellExecutionPolicy +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_PowerShellExecutionPolicy +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_PowerShellExecutionPolicy policies + +
    +
    + ADMX_PowerShellExecutionPolicy/EnableModuleLogging +
    +
    + ADMX_PowerShellExecutionPolicy/EnableScripts +
    +
    + ADMX_PowerShellExecutionPolicy/EnableTranscripting +
    +
    + ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath +
    +
    + + +
    + + +**ADMX_PowerShellExecutionPolicy/EnableModuleLogging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn on logging for Windows PowerShell modules. + +If you enable this policy setting, pipeline execution events for members of the specified modules are recorded in the Windows PowerShell log in Event Viewer. Enabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to True. + +If you disable this policy setting, logging of execution events is disabled for all Windows PowerShell modules. Disabling this policy setting for a module is equivalent to setting the LogPipelineExecutionDetails property of the module to False. If this policy setting is not configured, the LogPipelineExecutionDetails property of a module or snap-in determines whether the execution events of a module or snap-in are logged. By default, the LogPipelineExecutionDetails property of all modules and snap-ins is set to False. + +To add modules and snap-ins to the policy setting list, click Show, and then type the module names in the list. The modules and snap-ins in the list must be installed on the computer. + +> [!NOTE] +> This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Module Logging* +- GP name: *EnableModuleLogging* +- GP path: *Windows Components\Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
    + + +**ADMX_PowerShellExecutionPolicy/EnableScripts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you configure the script execution policy, controlling which scripts are allowed to run. + +If you enable this policy setting, the scripts selected in the drop-down list are allowed to run. The "Allow only signed scripts" policy setting allows scripts to execute only if they are signed by a trusted publisher. + +The "Allow local scripts and remote signed scripts" policy setting allows any local scripts to run; scripts that originate from the Internet must be signed by a trusted publisher. The "Allow all scripts" policy setting allows all scripts to run. + +If you disable this policy setting, no scripts are allowed to run. + +> [!NOTE] +> This policy setting exists under both "Computer Configuration" and "User Configuration" in the Local Group Policy Editor. The "Computer Configuration" has precedence over "User Configuration." If you disable or do not configure this policy setting, it reverts to a per-machine preference setting; the default if that is not configured is "No scripts allowed." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Script Execution* +- GP name: *EnableScripts* +- GP path: *Windows Components\Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
    + + +**ADMX_PowerShellExecutionPolicy/EnableTranscripting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you capture the input and output of Windows PowerShell commands into text-based transcripts. + +If you enable this policy setting, Windows PowerShell will enable transcripting for Windows PowerShell, the Windows PowerShell ISE, and any other applications that leverage the Windows PowerShell engine. By default, Windows PowerShell will record transcript output to each users' My Documents directory, with a file name that includes 'PowerShell_transcript', along with the computer name and time started. Enabling this policy is equivalent to calling the Start-Transcript cmdlet on each Windows PowerShell session. + +If you disable this policy setting, transcripting of PowerShell-based applications is disabled by default, although transcripting can still be enabled through the Start-Transcript cmdlet. + +If you use the OutputDirectory setting to enable transcript logging to a shared location, be sure to limit access to that directory to prevent users from viewing the transcripts of other users or computers. + +> [!NOTE] +> This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on PowerShell Transcription* +- GP name: *EnableTranscripting* +- GP path: *Windows Components\Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
    + + +**ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to set the default value of the SourcePath parameter on the Update-Help cmdlet. + +If you enable this policy setting, the Update-Help cmdlet will use the specified value as the default value for the SourcePath parameter. This default value can be overridden by specifying a different value with the SourcePath parameter on the Update-Help cmdlet. + +If this policy setting is disabled or not configured, this policy setting does not set a default value for the SourcePath parameter of the Update-Help cmdlet. + +> [!NOTE] +> This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes precedence over the User Configuration policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the default source path for Update-Help* +- GP name: *EnableUpdateHelpDefaultSourcePath* +- GP path: *Windows Components\Windows PowerShell* +- GP ADMX file name: *PowerShellExecutionPolicy.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md new file mode 100644 index 0000000000..e97cb3df92 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -0,0 +1,2028 @@ +--- +title: Policy CSP - ADMX_Printing +description: Policy CSP - ADMX_Printing +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/15/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Printing +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Printing policies + +
    +
    + ADMX_Printing/AllowWebPrinting +
    +
    + ADMX_Printing/ApplicationDriverIsolation +
    +
    + ADMX_Printing/CustomizedSupportUrl +
    +
    + ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate +
    +
    + ADMX_Printing/DomainPrinters +
    +
    + ADMX_Printing/DownlevelBrowse +
    +
    + ADMX_Printing/EMFDespooling +
    +
    + ADMX_Printing/ForceSoftwareRasterization +
    +
    + ADMX_Printing/IntranetPrintersUrl +
    +
    + ADMX_Printing/KMPrintersAreBlocked +
    +
    + ADMX_Printing/LegacyDefaultPrinterMode +
    +
    + ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS +
    +
    + ADMX_Printing/NoDeletePrinter +
    +
    + ADMX_Printing/NonDomainPrinters +
    +
    + ADMX_Printing/PackagePointAndPrintOnly +
    +
    + ADMX_Printing/PackagePointAndPrintOnly_Win7 +
    +
    + ADMX_Printing/PackagePointAndPrintServerList +
    +
    + ADMX_Printing/PackagePointAndPrintServerList_Win7 +
    +
    + ADMX_Printing/PhysicalLocation +
    +
    + ADMX_Printing/PhysicalLocationSupport +
    +
    + ADMX_Printing/PrintDriverIsolationExecutionPolicy +
    +
    + ADMX_Printing/PrintDriverIsolationOverrideCompat +
    +
    + ADMX_Printing/PrinterDirectorySearchScope +
    +
    + ADMX_Printing/PrinterServerThread +
    +
    + ADMX_Printing/ShowJobTitleInEventLogs +
    +
    + ADMX_Printing/V4DriverDisallowPrinterExtension +
    +
    + + +
    + + +**ADMX_Printing/AllowWebPrinting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Internet printing lets you display printers on Web pages so that printers can be viewed, managed, and used across the Internet or an intranet. + +If you enable this policy setting, Internet printing is activated on this server. + +If you disable this policy setting or do not configure it, Internet printing is not activated. + +Internet printing is an extension of Internet Information Services (IIS). To use Internet printing, IIS must be installed, and printing support and this setting must be enabled. + +> [!NOTE] +> This setting affects the server side of Internet printing only. It does not prevent the print client on the computer from printing across the Internet. + +Also, see the "Custom support URL in the Printers folder's left pane" setting in this folder and the "Browse a common Web site to find printers" setting in User Configuration\Administrative Templates\Control Panel\Printers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Activate Internet printing* +- GP name: *AllowWebPrinting* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/ApplicationDriverIsolation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines if print driver components are isolated from applications instead of normally loading them into applications. Isolating print drivers greatly reduces the risk of a print driver failure causing an application crash. + +Not all applications support driver isolation. By default, Microsoft Excel 2007, Excel 2010, Word 2007, Word 2010 and certain other applications are configured to support it. Other applications may also be capable of isolating print drivers, depending on whether they are configured for it. + +If you enable or do not configure this policy setting, then applications that are configured to support driver isolation will be isolated. + +If you disable this policy setting, then print drivers will be loaded within all associated application processes. + +> [!NOTE] +> - This policy setting applies only to applications opted into isolation. +> - This policy setting applies only to print drivers loaded by applications. Print drivers loaded by the print spooler are not affected. +> - This policy setting is only checked once during the lifetime of a process. After changing the policy, a running application must be relaunched before settings take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Isolate print drivers from applications* +- GP name: *ApplicationDriverIsolation* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/CustomizedSupportUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. By default, the Printers folder includes a link to the Microsoft Support Web page called "Get help with printing". It can also include a link to a Web page supplied by the vendor of the currently selected printer. + +If you enable this policy setting, you replace the "Get help with printing" default link with a link to a Web page customized for your enterprise. + +If you disable this setting or do not configure it, or if you do not enter an alternate Internet address, the default link will appear in the Printers folder. + +> [!NOTE] +> Web pages links only appear in the Printers folder when Web view is enabled. If Web view is disabled, the setting has no effect. (To enable Web view, open the Printers folder, and, on the Tools menu, click Folder Options, click the General tab, and then click "Enable Web content in folders.") + +Also, see the "Activate Internet printing" setting in this setting folder and the "Browse a common web site to find printers" setting in User Configuration\Administrative Templates\Control Panel\Printers. + +Web view is affected by the "Turn on Classic Shell" and "Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon" settings in User Configuration\Administrative Templates\Windows Components\Windows Explorer, and by the "Enable Active Desktop" setting in User Configuration\Administrative Templates\Desktop\Active Desktop. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom support URL in the Printers folder's left pane* +- GP name: *CustomizedSupportUrl* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage where client computers search for Point and Printer drivers. + +If you enable this policy setting, the client computer will continue to search for compatible Point and Print drivers from Windows Update after it fails to find the compatible driver from the local driver store and the server driver cache. + +If you disable this policy setting, the client computer will only search the local driver store and server driver cache for compatible Point and Print drivers. If it is unable to find a compatible driver, then the Point and Print connection will fail. + +This policy setting is not configured by default, and the behavior depends on the version of Windows that you are using. + +By default, Windows Ultimate, Professional and Home SKUs will continue to search for compatible Point and Print drivers from Windows Update, if needed. However, you must explicitly enable this policy setting for other versions of Windows (for example Windows Enterprise, and all versions of Windows Server 2008 R2 and later) to have the same behavior. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Extend Point and Print connection to search Windows Update* +- GP name: *DoNotInstallCompatibleDriverFromWindowsUpdate* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/DomainPrinters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy setting, it sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed network (when the computer is able to reach a domain controller, e.g. a domain-joined laptop on a corporate network.) + +If this policy setting is disabled, the network scan page will not be displayed. + +If this policy setting is not configured, the Add Printer wizard will display the default number of printers of each type: + +- Directory printers: 20 +- TCP/IP printers: 0 +- Web Services printers: 0 +- Bluetooth printers: 10 +- Shared printers: 0 + +In order to view available Web Services printers on your network, ensure that network discovery is turned on. To turn on network discovery, click "Start", click "Control Panel", and then click "Network and Internet". On the "Network and Internet" page, click "Network and Sharing Center". On the Network and Sharing Center page, click "Change advanced sharing settings". On the Advanced sharing settings page, click the arrow next to "Domain" arrow, click "turn on network discovery", and then click "Save changes". + +If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. + +In Windows 10 and later, only TCP/IP printers can be shown in the wizard. If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. + +In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add Printer wizard - Network scan page (Managed network)* +- GP name: *DomainPrinters* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/DownlevelBrowse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Allows users to use the Add Printer Wizard to search the network for shared printers. + +If you enable this setting or do not configure it, when users choose to add a network printer by selecting the "A network printer, or a printer attached to another computer" radio button on Add Printer Wizard's page 2, and also check the "Connect to this printer (or to browse for a printer, select this option and click Next)" radio button on Add Printer Wizard's page 3, and do not specify a printer name in the adjacent "Name" edit box, then Add Printer Wizard displays the list of shared printers on the network and invites to choose a printer from the shown list. + +If you disable this setting, the network printer browse page is removed from within the Add Printer Wizard, and users cannot search the network but must type a printer name. + +> [!NOTE] +> This setting affects the Add Printer Wizard only. It does not prevent users from using other programs to search for shared printers or to connect to network printers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Browse the network to find printers* +- GP name: *DownlevelBrowse* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/EMFDespooling** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. When printing through a print server, determines whether the print spooler on the client will process print jobs itself, or pass them on to the server to do the work. + +This policy setting only effects printing to a Windows print server. + +If you enable this policy setting on a client machine, the client spooler will not process print jobs before sending them to the print server. This decreases the workload on the client at the expense of increasing the load on the server. + +If you disable this policy setting on a client machine, the client itself will process print jobs into printer device commands. These commands will then be sent to the print server, and the server will simply pass the commands to the printer. This increases the workload of the client while decreasing the load on the server. + +If you do not enable this policy setting, the behavior is the same as disabling it. + +> [!NOTE] +> This policy does not determine whether offline printing will be available to the client. The client print spooler can always queue print jobs when not connected to the print server. Upon reconnecting to the server, the client will submit any pending print jobs. +> +> Some printer drivers require a custom print processor. In some cases the custom print processor may not be installed on the client machine, such as when the print server does not support transferring print processors during point-and-print. In the case of a print processor mismatch, the client spooler will always send jobs to the print server for rendering. Disabling the above policy setting does not override this behavior. +> +> In cases where the client print driver does not match the server print driver (mismatched connection), the client will always process the print job, regardless of the setting of this policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always render print jobs on the server* +- GP name: *EMFDespooling* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/ForceSoftwareRasterization** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether the XPS Rasterization Service or the XPS-to-GDI conversion (XGC) is forced to use a software rasterizer instead of a Graphics Processing Unit (GPU) to rasterize pages. + +This setting may improve the performance of the XPS Rasterization Service or the XPS-to-GDI conversion (XGC) on machines that have a relatively powerful CPU as compared to the machine’s GPU. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always rasterize content to be printed using a software rasterizer* +- GP name: *ForceSoftwareRasterization* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/IntranetPrintersUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Adds a link to an Internet or intranet Web page to the Add Printer Wizard. + +You can use this setting to direct users to a Web page from which they can install printers. + +If you enable this setting and type an Internet or intranet address in the text box, the system adds a Browse button to the "Specify a Printer" page in the Add Printer Wizard. The Browse button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers. + +This setting makes it easy for users to find the printers you want them to add. + +Also, see the "Custom support URL in the Printers folder's left pane" and "Activate Internet printing" settings in "Computer Configuration\Administrative Templates\Printers." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Browse a common web site to find printers* +- GP name: *IntranetPrintersUrl* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/KMPrintersAreBlocked** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether printers using kernel-mode drivers may be installed on the local computer. Kernel-mode drivers have access to system-wide memory, and therefore poorly-written kernel-mode drivers can cause stop errors. + +If you disable this setting, or do not configure it, then printers using a kernel-mode drivers may be installed on the local computer running Windows XP Home Edition and Windows XP Professional. + +If you do not configure this setting on Windows Server 2003 family products, the installation of kernel-mode printer drivers will be blocked. + +If you enable this setting, installation of a printer using a kernel-mode driver will not be allowed. + +> [!NOTE] +> By applying this policy, existing kernel-mode drivers will be disabled upon installation of service packs or reinstallation of the Windows XP operating system. This policy does not apply to 64-bit kernel-mode printer drivers as they cannot be installed and associated with a print queue. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow installation of printers using kernel-mode drivers* +- GP name: *KMPrintersAreBlocked* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/LegacyDefaultPrinterMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This preference allows you to change default printer management. + +If you enable this setting, Windows will not manage the default printer. + +If you disable this setting, Windows will manage the default printer. + +If you do not configure this setting, default printer management will not change. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows default printer management* +- GP name: *LegacyDefaultPrinterMode* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Microsoft XPS Document Writer (MXDW) generates OpenXPS (*.oxps) files by default in Windows 10, Windows 10 and Windows Server 2019. + +If you enable this group policy setting, the default MXDW output format is the legacy Microsoft XPS (*.xps). + +If you disable or do not configure this policy setting, the default MXDW output format is OpenXPS (*.oxps). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Change Microsoft XPS Document Writer (MXDW) default output format to the legacy Microsoft XPS format (*.xps)* +- GP name: *MXDWUseLegacyOutputFormatMSXPS* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/NoDeletePrinter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If this policy setting is enabled, it prevents users from deleting local and network printers. + +If a user tries to delete a printer, such as by using the Delete option in Printers in Control Panel, a message appears explaining that a setting prevents the action. + +This setting does not prevent users from running other programs to delete a printer. + +If this policy is disabled, or not configured, users can delete printers using the methods described above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent deletion of printers* +- GP name: *NoDeletePrinter* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/NonDomainPrinters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on an unmanaged network (when the computer is not able to reach a domain controller, e.g. a domain-joined laptop on a home network.) + +If this setting is disabled, the network scan page will not be displayed. + +If this setting is not configured, the Add Printer wizard will display the default number of printers of each type: + +- TCP/IP printers: 50 +- Web Services printers: 50 +- Bluetooth printers: 10 +- Shared printers: 50 + +If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. + +In Windows 10 and later, only TCP/IP printers can be shown in the wizard. If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. + +In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add Printer wizard - Network scan page (Unmanaged network)* +- GP name: *NonDomainPrinters* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PackagePointAndPrintOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy restricts clients computers to use package point and print only. + +If this setting is enabled, users will only be able to point and print to printers that use package-aware drivers. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers. + +If this setting is disabled, or not configured, users will not be restricted to package-aware point and print only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Only use Package Point and print* +- GP name: *PackagePointAndPrintOnly* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PackagePointAndPrintOnly_Win7** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy restricts clients computers to use package point and print only. + +If this setting is enabled, users will only be able to point and print to printers that use package-aware drivers. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers. + +If this setting is disabled, or not configured, users will not be restricted to package-aware point and print only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Only use Package Point and print* +- GP name: *PackagePointAndPrintOnly_Win7* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PackagePointAndPrintServerList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Restricts package point and print to approved servers. + +This policy setting restricts package point and print connections to approved servers. This setting only applies to Package Point and Print connections, and is completely independent from the "Point and Print Restrictions" policy that governs the behavior of non-package point and print connections. + +Windows Vista and later clients will attempt to make a non-package point and print connection anytime a package point and print connection fails, including attempts that are blocked by this policy. Administrators may need to set both policies to block all print connections to a specific print server. + +If this setting is enabled, users will only be able to package point and print to print servers approved by the network administrator. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers. + +If this setting is disabled, or not configured, package point and print will not be restricted to specific print servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Package Point and print - Approved servers* +- GP name: *PackagePointAndPrintServerList* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PackagePointAndPrintServerList_Win7** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Restricts package point and print to approved servers. + +This policy setting restricts package point and print connections to approved servers. This setting only applies to Package Point and Print connections, and is completely independent from the "Point and Print Restrictions" policy that governs the behavior of non-package point and print connections. + +Windows Vista and later clients will attempt to make a non-package point and print connection anytime a package point and print connection fails, including attempts that are blocked by this policy. Administrators may need to set both policies to block all print connections to a specific print server. + +If this setting is enabled, users will only be able to package point and print to print servers approved by the network administrator. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers. + +If this setting is disabled, or not configured, package point and print will not be restricted to specific print servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Package Point and print - Approved servers* +- GP name: *PackagePointAndPrintServerList_Win7* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PhysicalLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If this policy setting is enabled, it specifies the default location criteria used when searching for printers. + +This setting is a component of the Location Tracking feature of Windows printers. To use this setting, enable Location Tracking by enabling the "Pre-populate printer search location text" setting. + +When Location Tracking is enabled, the system uses the specified location as a criterion when users search for printers. The value you type here overrides the actual location of the computer conducting the search. + +Type the location of the user's computer. When users search for printers, the system uses the specified location (and other search criteria) to find a printer nearby. You can also use this setting to direct users to a particular printer or group of printers that you want them to use. + +If you disable this setting or do not configure it, and the user does not type a location as a search criterion, the system searches for a nearby printer based on the IP address and subnet mask of the user's computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Computer location* +- GP name: *PhysicalLocation* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PhysicalLocationSupport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enables the physical Location Tracking setting for Windows printers. + +Use Location Tracking to design a location scheme for your enterprise and assign computers and printers to locations in the scheme. Location Tracking overrides the standard method used to locate and associate computers and printers. The standard method uses a printer's IP address and subnet mask to estimate its physical location and proximity to computers. + +If you enable this setting, users can browse for printers by location without knowing the printer's location or location naming scheme. Enabling Location Tracking adds a Browse button in the Add Printer wizard's Printer Name and Sharing Location screen and to the General tab in the Printer Properties dialog box. If you enable the Group Policy Computer location setting, the default location you entered appears in the Location field by default. + +If you disable this setting or do not configure it, Location Tracking is disabled. Printer proximity is estimated using the standard method (that is, based on IP address and subnet mask). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Pre-populate printer search location text* +- GP name: *PhysicalLocationSupport* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PrintDriverIsolationExecutionPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the print spooler will execute print drivers in an isolated or separate process. When print drivers are loaded in an isolated process (or isolated processes), a print driver failure will not cause the print spooler service to fail. + +If you enable or do not configure this policy setting, the print spooler will execute print drivers in an isolated process by default. + +If you disable this policy setting, the print spooler will execute print drivers in the print spooler process. + +> [!NOTE] +> - Other system or driver policy settings may alter the process in which a print driver is executed. +> - This policy setting applies only to print drivers loaded by the print spooler. Print drivers loaded by applications are not affected. +> - This policy setting takes effect without restarting the print spooler service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Execute print drivers in isolated processes* +- GP name: *PrintDriverIsolationExecutionPolicy* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PrintDriverIsolationOverrideCompat** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the print spooler will override the Driver Isolation compatibility reported by the print driver. This enables executing print drivers in an isolated process, even if the driver does not report compatibility. + +If you enable this policy setting, the print spooler isolates all print drivers that do not explicitly opt out of Driver Isolation. + +If you disable or do not configure this policy setting, the print spooler uses the Driver Isolation compatibility flag value reported by the print driver. + +> [!NOTE] +> - Other system or driver policy settings may alter the process in which a print driver is executed. +> - This policy setting applies only to print drivers loaded by the print spooler. Print drivers loaded by applications are not affected. +> - This policy setting takes effect without restarting the print spooler service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Override print driver execution compatibility setting reported by print driver* +- GP name: *PrintDriverIsolationOverrideCompat* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PrinterDirectorySearchScope** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the Active Directory location where searches for printers begin. + +The Add Printer Wizard gives users the option of searching Active Directory for a shared printer. + +If you enable this policy setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory. + +This setting only provides a starting point for Active Directory searches for printers. It does not restrict user searches through Active Directory. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default Active Directory path when searching for printers* +- GP name: *PrinterDirectorySearchScope* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PrinterServerThread** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Announces the presence of shared printers to print browse master servers for the domain. + +On domains with Active Directory, shared printer resources are available in Active Directory and are not announced. + +If you enable this setting, the print spooler announces shared printers to the print browse master servers. + +If you disable this setting, shared printers are not announced to print browse master servers, even if Active Directory is not available. + +If you do not configure this setting, shared printers are announced to browse master servers only when Active Directory is not available. + +> [!NOTE] +> A client license is used each time a client computer announces a printer to a print browse master on the domain. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Printer browsing* +- GP name: *PrinterServerThread* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/ShowJobTitleInEventLogs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls whether the print job name will be included in print event logs. + +If you disable or do not configure this policy setting, the print job name will not be included. + +If you enable this policy setting, the print job name will be included in new log entries. + +> [!NOTE] +> This setting does not apply to Branch Office Direct Printing jobs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow job name in event logs* +- GP name: *ShowJobTitleInEventLogs* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/V4DriverDisallowPrinterExtension** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy determines if v4 printer drivers are allowed to run printer extensions. + +V4 printer drivers may include an optional, customized user interface known as a printer extension. These extensions may provide access to more device features, but this may not be appropriate for all enterprises. + +If you enable this policy setting, then all printer extensions will not be allowed to run. + +If you disable this policy setting or do not configure it, then all printer extensions that have been installed will be allowed to run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow v4 printer drivers to show printer extensions* +- GP name: *V4DriverDisallowPrinterExtension* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md new file mode 100644 index 0000000000..8ce369426a --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -0,0 +1,741 @@ +--- +title: Policy CSP - ADMX_Printing2 +description: Policy CSP - ADMX_Printing2 +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/15/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Printing2 +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Printing2 policies + +
    +
    + ADMX_Printing2/AutoPublishing +
    +
    + ADMX_Printing2/ImmortalPrintQueue +
    +
    + ADMX_Printing2/PruneDownlevel +
    +
    + ADMX_Printing2/PruningInterval +
    +
    + ADMX_Printing2/PruningPriority +
    +
    + ADMX_Printing2/PruningRetries +
    +
    + ADMX_Printing2/PruningRetryLog +
    +
    + ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint +
    +
    + ADMX_Printing2/VerifyPublishedState +
    +
    + + +
    + + +**ADMX_Printing2/AutoPublishing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether the Add Printer Wizard automatically publishes the computer's shared printers in Active Directory. + +If you enable this setting or do not configure it, the Add Printer Wizard automatically publishes all shared printers. + +If you disable this setting, the Add Printer Wizard does not automatically publish printers. However, you can publish shared printers manually. + +The default behavior is to automatically publish shared printers in Active Directory. + +> [!NOTE] +> This setting is ignored if the "Allow printers to be published" setting is disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatically publish new printers in Active Directory* +- GP name: *AutoPublishing* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/ImmortalPrintQueue** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether the domain controller can prune (delete from Active Directory) the printers published by this computer. + +By default, the pruning service on the domain controller prunes printer objects from Active Directory if the computer that published them does not respond to contact requests. When the computer that published the printers restarts, it republishes any deleted printer objects. + +If you enable this setting or do not configure it, the domain controller prunes this computer's printers when the computer does not respond. + +If you disable this setting, the domain controller does not prune this computer's printers. This setting is designed to prevent printers from being pruned when the computer is temporarily disconnected from the network. + +> [!NOTE] +> You can use the "Directory Pruning Interval" and "Directory Pruning Retry" settings to adjust the contact interval and number of contact attempts. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow pruning of published printers* +- GP name: *ImmortalPrintQueue* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruneDownlevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether the pruning service on a domain controller prunes printer objects that are not automatically republished whenever the host computer does not respond,just as it does with Windows 2000 printers. This setting applies to printers running operating systems other than Windows 2000 and to Windows 2000 printers published outside their forest. + +The Windows pruning service prunes printer objects from Active Directory when the computer that published them does not respond to contact requests. Computers running Windows 2000 Professional detect and republish deleted printer objects when they rejoin the network. However, because non-Windows 2000 computers and computers in other domains cannot republish printers in Active Directory automatically, by default, the system never prunes their printer objects. + +You can enable this setting to change the default behavior. To use this setting, select one of the following options from the "Prune non-republishing printers" box: + +- "Never" specifies that printer objects that are not automatically republished are never pruned. "Never" is the default. + +- "Only if Print Server is found" prunes printer objects that are not automatically republished only when the print server responds, but the printer is unavailable. + +- "Whenever printer is not found" prunes printer objects that are not automatically republished whenever the host computer does not respond, just as it does with Windows 2000 printers. + +> [!NOTE] +> This setting applies to printers published by using Active Directory Users and Computers or Pubprn.vbs. It does not apply to printers published by using Printers in Control Panel. + +> [!TIP] +> If you disable automatic pruning, remember to delete printer objects manually whenever you remove a printer or print server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prune printers that are not automatically republished* +- GP name: *PruneDownlevel* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruningInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies how often the pruning service on a domain controller contacts computers to verify that their printers are operational. + +The pruning service periodically contacts computers that have published printers. If a computer does not respond to the contact message (optionally, after repeated attempts), the pruning service "prunes" (deletes from Active Directory) printer objects the computer has published. + +By default, the pruning service contacts computers every eight hours and allows two repeated contact attempts before deleting printers from Active Directory. + +If you enable this setting, you can change the interval between contact attempts. + +If you do not configure or disable this setting the default values will be used. + +> [!NOTE] +> This setting is used only on domain controllers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Directory pruning interval* +- GP name: *PruningInterval* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruningPriority** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Sets the priority of the pruning thread. + +The pruning thread, which runs only on domain controllers, deletes printer objects from Active Directory if the printer that published the object does not respond to contact attempts. This process keeps printer information in Active Directory current. + +The thread priority influences the order in which the thread receives processor time and determines how likely it is to be preempted by higher priority threads. + +By default, the pruning thread runs at normal priority. However, you can adjust the priority to improve the performance of this service. + +> [!NOTE] +> This setting is used only on domain controllers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Directory pruning priority* +- GP name: *PruningPriority* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruningRetries** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies how many times the pruning service on a domain controller repeats its attempt to contact a computer before pruning the computer's printers. + +The pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact message, the message is repeated for the specified number of times. If the computer still fails to respond, then the pruning service "prunes" (deletes from Active Directory) printer objects the computer has published. + +By default, the pruning service contacts computers every eight hours and allows two retries before deleting printers from Active Directory. You can use this setting to change the number of retries. + +If you enable this setting, you can change the interval between attempts. + +If you do not configure or disable this setting, the default values are used. + +> [!NOTE] +> This setting is used only on domain controllers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Directory pruning retry* +- GP name: *PruningRetries* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruningRetryLog** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies whether or not to log events when the pruning service on a domain controller attempts to contact a computer before pruning the computer's printers. + +The pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact attempt, the attempt is retried a specified number of times, at a specified interval. The "Directory pruning retry" setting determines the number of times the attempt is retried; the default value is two retries. The "Directory Pruning Interval" setting determines the time interval between retries; the default value is every eight hours. If the computer has not responded by the last contact attempt, its printers are pruned from the directory. + +If you enable this policy setting, the contact events are recorded in the event log. + +If you disable or do not configure this policy setting, the contact events are not recorded in the event log. + +Note: This setting does not affect the logging of pruning events; the actual pruning of a printer is always logged. + +> [!NOTE] +> This setting is used only on domain controllers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Log directory pruning retry events* +- GP name: *PruningRetryLog* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls whether the print spooler will accept client connections. + +When the policy is not configured or enabled, the spooler will always accept client connections. + +When the policy is disabled, the spooler will not accept client connections nor allow users to share printers. All printers currently shared will continue to be shared. + +The spooler must be restarted for changes to this policy to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow Print Spooler to accept client connections* +- GP name: *RegisterSpoolerRemoteRpcEndPoint* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/VerifyPublishedState** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Directs the system to periodically verify that the printers published by this computer still appear in Active Directory. This setting also specifies how often the system repeats the verification. + +By default, the system only verifies published printers at startup. This setting allows for periodic verification while the computer is operating. + +To enable this additional verification, enable this setting, and then select a verification interval. + +To disable verification, disable this setting, or enable this setting and select "Never" for the verification interval. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Check published state* +- GP name: *VerifyPublishedState* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md new file mode 100644 index 0000000000..d7e0d1fec9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -0,0 +1,569 @@ +--- +title: Policy CSP - ADMX_Programs +description: Policy CSP - ADMX_Programs +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Programs +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Programs policies + +
    +
    + ADMX_Programs/NoDefaultPrograms +
    +
    + ADMX_Programs/NoGetPrograms +
    +
    + ADMX_Programs/NoInstalledUpdates +
    +
    + ADMX_Programs/NoProgramsAndFeatures +
    +
    + ADMX_Programs/NoProgramsCPL +
    +
    + ADMX_Programs/NoWindowsFeatures +
    +
    + ADMX_Programs/NoWindowsMarketplace +
    +
    + + +
    + + +**ADMX_Programs/NoDefaultPrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting removes the Set Program Access and Defaults page from the Programs Control Panel. As a result, users cannot view or change the associated page. + +The Set Program Access and Computer Defaults page allows administrators to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as specify the programs that are accessible from the Start menu, desktop, and other locations. + +If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users. + +This setting does not prevent users from using other tools and methods to change program access or defaults. + +This setting does not prevent the Default Programs icon from appearing on the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Set Program Access and Computer Defaults" page* +- GP name: *NoDefaultPrograms* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
    + + +**ADMX_Programs/NoGetPrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from viewing or installing published programs from the network. + +This setting prevents users from accessing the "Get Programs" page from the Programs Control Panel in Category View, Programs and Features in Classic View and the "Install a program from the network" task. The "Get Programs" page lists published programs and provides an easy way to install them. + +Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users of their availability, to recommend their use, or to enable users to install them without having to search for installation files. + +If this setting is enabled, users cannot view the programs that have been published by the system administrator, and they cannot use the "Get Programs" page to install published programs. Enabling this feature does not prevent users from installing programs by using other methods. Users will still be able to view and installed assigned (partially installed) programs that are offered on the desktop or on the Start menu. + +If this setting is disabled or is not configured, the "Install a program from the network" task to the "Get Programs" page will be available to all users. + +> [!NOTE] +> If the "Hide Programs Control Panel" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Get Programs" page* +- GP name: *NoGetPrograms* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
    + + +**ADMX_Programs/NoInstalledUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing "Installed Updates" page from the "View installed updates" task. + +"Installed Updates" allows users to view and uninstall updates currently installed on the computer. The updates are often downloaded directly from Windows Update or from various program publishers. + +If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users. + +This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Installed Updates" page* +- GP name: *NoInstalledUpdates* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
    + + +**ADMX_Programs/NoProgramsAndFeatures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing "Programs and Features" to view, uninstall, change, or repair programs that are currently installed on the computer. + +If this setting is disabled or not configured, "Programs and Features" will be available to all users. + +This setting does not prevent users from using other tools and methods to view or uninstall programs. It also does not prevent users from linking to related Programs Control Panel Features including Windows Features, Get Programs, or Windows Marketplace. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Programs and Features" page* +- GP name: *NoProgramsAndFeatures* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
    + + +**ADMX_Programs/NoProgramsCPL** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from using the Programs Control Panel in Category View and Programs and Features in Classic View. + +The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to the user by the system administrator also appear in the Programs Control Panel. + +If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users. + +When enabled, this setting takes precedence over the other settings in this folder. + +This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Programs Control Panel* +- GP name: *NoProgramsCPL* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
    + + +**ADMX_Programs/NoWindowsFeatures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing the "Turn Windows features on or off" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. As a result, users cannot view, enable, or disable various Windows features and services. + +If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users. + +This setting does not prevent users from using other tools and methods to configure services or enable or disable program components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Windows Features"* +- GP name: *NoWindowsFeatures* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
    + + +**ADMX_Programs/NoWindowsMarketplace** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from access the "Get new programs from Windows Marketplace" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. + +Windows Marketplace allows users to purchase and/or download various programs to their computer for installation. + +Enabling this feature does not prevent users from navigating to Windows Marketplace using other methods. + +If this feature is disabled or is not configured, the "Get new programs from Windows Marketplace" task link will be available to all users. + +> [!NOTE] +> If the "Hide Programs control Panel" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Windows Marketplace"* +- GP name: *NoWindowsMarketplace* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-reliability.md b/windows/client-management/mdm/policy-csp-admx-reliability.md new file mode 100644 index 0000000000..398c939856 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-reliability.md @@ -0,0 +1,362 @@ +--- +title: Policy CSP - ADMX_Reliability +description: Policy CSP - ADMX_Reliability +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Reliability +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Reliability policies + +
    +
    + ADMX_Reliability/EE_EnablePersistentTimeStamp +
    +
    + ADMX_Reliability/PCH_ReportShutdownEvents +
    +
    + ADMX_Reliability/ShutdownEventTrackerStateFile +
    +
    + ADMX_Reliability/ShutdownReason +
    +
    + + +
    + + +**ADMX_Reliability/EE_EnablePersistentTimeStamp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the system to detect the time of unexpected shutdowns by writing the current time to disk on a schedule controlled by the Timestamp Interval. + +If you enable this policy setting, you are able to specify how often the Persistent System Timestamp is refreshed and subsequently written to the disk. You can specify the Timestamp Interval in seconds. + +If you disable this policy setting, the Persistent System Timestamp is turned off and the timing of unexpected shutdowns is not recorded. + +If you do not configure this policy setting, the Persistent System Timestamp is refreshed according the default, which is every 60 seconds beginning with Windows Server 2003. + +> [!NOTE] +> This feature might interfere with power configuration settings that turn off hard disks after a period of inactivity. These power settings may be accessed in the Power Options Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Persistent Time Stamp* +- GP name: *EE_EnablePersistentTimeStamp* +- GP path: *System* +- GP ADMX file name: *Reliability.admx* + + + +
    + +
    + + +**ADMX_Reliability/PCH_ReportShutdownEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not unplanned shutdown events can be reported when error reporting is enabled. + +If you enable this policy setting, error reporting includes unplanned shutdown events. + +If you disable this policy setting, unplanned shutdown events are not included in error reporting. + +If you do not configure this policy setting, users can adjust this setting using the control panel, which is set to "Upload unplanned shutdown events" by default. + +Also see the "Configure Error Reporting" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Report unplanned shutdown events* +- GP name: *PCH_ReportShutdownEvents* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *Reliability.admx* + + + +
    + +
    + + +**ADMX_Reliability/ShutdownEventTrackerStateFile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines when the Shutdown Event Tracker System State Data feature is activated. + +The system state data file contains information about the basic system state as well as the state of all running processes. + +If you enable this policy setting, the System State Data feature is activated when the user indicates that the shutdown or restart is unplanned. + +If you disable this policy setting, the System State Data feature is never activated. + +If you do not configure this policy setting, the default behavior for the System State Data feature occurs. + +> [!NOTE] +> By default, the System State Data feature is always enabled on Windows Server 2003. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Activate Shutdown Event Tracker System State Data feature* +- GP name: *ShutdownEventTrackerStateFile* +- GP path: *System* +- GP ADMX file name: *Reliability.admx* + + + +
    + +
    + + +**ADMX_Reliability/ShutdownReason** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. The Shutdown Event Tracker can be displayed when you shut down a workstation or server. This is an extra set of questions that is displayed when you invoke a shutdown to collect information related to why you are shutting down the computer. + +If you enable this setting and choose "Always" from the drop-down menu list, the Shutdown Event Tracker is displayed when the computer shuts down. + +If you enable this policy setting and choose "Server Only" from the drop-down menu list, the Shutdown Event Tracker is displayed when you shut down a computer running Windows Server. (See "Supported on" for supported versions.) + +If you enable this policy setting and choose "Workstation Only" from the drop-down menu list, the Shutdown Event Tracker is displayed when you shut down a computer running a client version of Windows. (See "Supported on" for supported versions.) + +If you disable this policy setting, the Shutdown Event Tracker is not displayed when you shut down the computer. + +If you do not configure this policy setting, the default behavior for the Shutdown Event Tracker occurs. + +> [!NOTE] +> By default, the Shutdown Event Tracker is only displayed on computers running Windows Server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display Shutdown Event Tracker* +- GP name: *ShutdownReason* +- GP path: *System* +- GP ADMX file name: *Reliability.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md new file mode 100644 index 0000000000..692487c12d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md @@ -0,0 +1,206 @@ +--- +title: Policy CSP - ADMX_RemoteAssistance +description: Policy CSP - ADMX_RemoteAssistance +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_RemoteAssistance +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_RemoteAssistance policies + +
    +
    + ADMX_RemoteAssistance/RA_EncryptedTicketOnly +
    +
    + ADMX_RemoteAssistance/RA_Optimize_Bandwidth +
    +
    + + +
    + + +**ADMX_RemoteAssistance/RA_EncryptedTicketOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables Remote Assistance invitations to be generated with improved encryption so that only computers running this version (or later versions) of the operating system can connect. This policy setting does not affect Remote Assistance connections that are initiated by instant messaging contacts or the unsolicited Offer Remote Assistance. + +If you enable this policy setting, only computers running this version (or later versions) of the operating system can connect to this computer. + +If you disable this policy setting, computers running this version and a previous version of the operating system can connect to this computer. + +If you do not configure this policy setting, users can configure the setting in System Properties in the Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only Windows Vista or later connections* +- GP name: *RA_EncryptedTicketOnly* +- GP path: *System\Remote Assistance* +- GP ADMX file name: *RemoteAssistance.admx* + + + +
    + + +**ADMX_RemoteAssistance/RA_Optimize_Bandwidth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to improve performance in low bandwidth scenarios. + +This setting is incrementally scaled from "No optimization" to "Full optimization". Each incremental setting includes the previous optimization setting. + +For example: + +"Turn off background" will include the following optimizations: + +- No full window drag +- Turn off background + +"Full optimization" will include the following optimizations: + +- Use 16-bit color (8-bit color in Windows Vista) +- Turn off font smoothing (not supported in Windows Vista) +- No full window drag +- Turn off background + +If you enable this policy setting, bandwidth optimization occurs at the level specified. + +If you disable this policy setting, application-based settings are used. + +If you do not configure this policy setting, application-based settings are used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on bandwidth optimization* +- GP name: *RA_Optimize_Bandwidth* +- GP path: *System\Remote Assistance* +- GP ADMX file name: *RemoteAssistance.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-removablestorage.md b/windows/client-management/mdm/policy-csp-admx-removablestorage.md new file mode 100644 index 0000000000..6a9c3b8bfa --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-removablestorage.md @@ -0,0 +1,2329 @@ +--- +title: Policy CSP - ADMX_RemovableStorage +description: Policy CSP - ADMX_RemovableStorage +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_RemovableStorage +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_RemovableStorage policies + +
    +
    + ADMX_RemovableStorage/AccessRights_RebootTime_1 +
    +
    + ADMX_RemovableStorage/AccessRights_RebootTime_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2 +
    +
    + ADMX_RemovableStorage/Removable_Remote_Allow_Access +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2 +
    +
    + + +
    + + +**ADMX_RemovableStorage/AccessRights_RebootTime_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the amount of time (in seconds) that the operating system waits to reboot in order to enforce a change in access rights to removable storage devices. + +If you enable this policy setting, you can set the number of seconds you want the system to wait until a reboot. + +If you disable or do not configure this setting, the operating system does not force a reboot. + +> [!NOTE] +> If no reboot is forced, the access right does not take effect until the operating system is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set time (in seconds) to force reboot* +- GP name: *AccessRights_RebootTime_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/AccessRights_RebootTime_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the amount of time (in seconds) that the operating system waits to reboot in order to enforce a change in access rights to removable storage devices. + +If you enable this policy setting, you can set the number of seconds you want the system to wait until a reboot. + +If you disable or do not configure this setting, the operating system does not force a reboot + +> [!NOTE] +> If no reboot is forced, the access right does not take effect until the operating system is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set time (in seconds) to force reboot* +- GP name: *AccessRights_RebootTime_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies execute access to the CD and DVD removable storage class. + +If you enable this policy setting, execute access is denied to this removable storage class. + +If you disable or do not configure this policy setting, execute access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny execute access* +- GP name: *CDandDVD_DenyExecute_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the CD and DVD removable storage class. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny read access* +- GP name: *CDandDVD_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the CD and DVD removable storage class. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny read access* +- GP name: *CDandDVD_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the CD and DVD removable storage class. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny write access* +- GP name: *CDandDVD_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the CD and DVD removable storage class. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny write access* +- GP name: *CDandDVD_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to custom removable storage classes. + +If you enable this policy setting, read access is denied to these removable storage classes. + +If you disable or do not configure this policy setting, read access is allowed to these removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Classes: Deny read access* +- GP name: *CustomClasses_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to custom removable storage classes. + +If you enable this policy setting, read access is denied to these removable storage classes. + +If you disable or do not configure this policy setting, read access is allowed to these removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Classes: Deny read access* +- GP name: *CustomClasses_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to custom removable storage classes. + +If you enable this policy setting, write access is denied to these removable storage classes. + +If you disable or do not configure this policy setting, write access is allowed to these removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Classes: Deny write access* +- GP name: *CustomClasses_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to custom removable storage classes. + +If you enable this policy setting, write access is denied to these removable storage classes. + +If you disable or do not configure this policy setting, write access is allowed to these removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Classes: Deny write access* +- GP name: *CustomClasses_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies execute access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, execute access is denied to this removable storage class. + +If you disable or do not configure this policy setting, execute access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny execute access* +- GP name: *FloppyDrives_DenyExecute_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny read access* +- GP name: *FloppyDrives_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny read access* +- GP name: *FloppyDrives_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny write access* +- GP name: *FloppyDrives_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny write access* +- GP name: *FloppyDrives_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies execute access to removable disks. + +If you enable this policy setting, execute access is denied to this removable storage class. + +If you disable or do not configure this policy setting, execute access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Disks: Deny execute access* +- GP name: *RemovableDisks_DenyExecute_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to removable disks. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Disks: Deny read access* +- GP name: *RemovableDisks_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to removable disks. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Disks: Deny read access* +- GP name: *RemovableDisks_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to removable disks. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!NOTE] +> To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Disks: Deny write access* +- GP name: *RemovableDisks_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Configure access to all removable storage classes. + +This policy setting takes precedence over any individual removable storage policy settings. To manage individual classes, use the policy settings available for each class. + +If you enable this policy setting, no access is allowed to any removable storage class. + +If you disable or do not configure this policy setting, write and read accesses are allowed to all removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *All Removable Storage classes: Deny all access* +- GP name: *RemovableStorageClasses_DenyAll_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Configure access to all removable storage classes. + +This policy setting takes precedence over any individual removable storage policy settings. To manage individual classes, use the policy settings available for each class. + +If you enable this policy setting, no access is allowed to any removable storage class. + +If you disable or do not configure this policy setting, write and read accesses are allowed to all removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *All Removable Storage classes: Deny all access* +- GP name: *RemovableStorageClasses_DenyAll_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/Removable_Remote_Allow_Access** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting grants normal users direct access to removable storage devices in remote sessions. + +If you enable this policy setting, remote users can open direct handles to removable storage devices in remote sessions. + +If you disable or do not configure this policy setting, remote users cannot open direct handles to removable storage devices in remote sessions. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *All Removable Storage: Allow direct access in remote sessions* +- GP name: *Removable_Remote_Allow_Access* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies execute access to the Tape Drive removable storage class. + +If you enable this policy setting, execute access is denied to this removable storage class. + +If you disable or do not configure this policy setting, execute access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny execute access* +- GP name: *TapeDrives_DenyExecute_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the Tape Drive removable storage class. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny read access* +- GP name: *TapeDrives_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the Tape Drive removable storage class. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny read access* +- GP name: *TapeDrives_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the Tape Drive removable storage class. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny write access* +- GP name: *TapeDrives_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the Tape Drive removable storage class. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny write access* +- GP name: *TapeDrives_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WPD Devices: Deny read access* +- GP name: *WPDDevices_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WPD Devices: Deny read access* +- GP name: *WPDDevices_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WPD Devices: Deny write access* +- GP name: *WPDDevices_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WPD Devices: Deny write access* +- GP name: *WPDDevices_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md new file mode 100644 index 0000000000..4c77e82fa2 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -0,0 +1,391 @@ +--- +title: Policy CSP - ADMX_RPC +description: Policy CSP - ADMX_RPC +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_RPC +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_RPC policies + +
    +
    + ADMX_RPC/RpcExtendedErrorInformation +
    +
    + ADMX_RPC/RpcIgnoreDelegationFailure +
    +
    + ADMX_RPC/RpcMinimumHttpConnectionTimeout +
    +
    + ADMX_RPC/RpcStateInformation +
    +
    + + +
    + + +**ADMX_RPC/RpcExtendedErrorInformation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the RPC runtime generates extended error information when an error occurs. + +Extended error information includes the local time that the error occurred, the RPC version, and the name of the computer on which the error occurred, or from which it was propagated. Programs can retrieve the extended error information by using standard Windows application programming interfaces (APIs). + +If you disable this policy setting, the RPC Runtime only generates a status code to indicate an error condition. + +If you do not configure this policy setting, it remains disabled. It will only generate a status code to indicate an error condition. + +If you enable this policy setting, the RPC runtime will generate extended error information. + +You must select an error response type in the drop-down box. + +- "Off" disables all extended error information for all processes. RPC only generates an error code. +- "On with Exceptions" enables extended error information, but lets you disable it for selected processes. To disable extended error information for a process while this policy setting is in effect, the command that starts the process must begin with one of the strings in the Extended Error Information Exception field. +- "Off with Exceptions" disables extended error information, but lets you enable it for selected processes. To enable extended error information for a process while this policy setting is in effect, the command that starts the process must begin with one of the strings in the Extended Error Information Exception field. +- "On" enables extended error information for all processes. + +> [!NOTE] +> For information about the Extended Error Information Exception field, see the Windows Software Development Kit (SDK). +> +> Extended error information is formatted to be compatible with other operating systems and older Microsoft operating systems, but only newer Microsoft operating systems can read and respond to the information. +> +> The default policy setting, "Off," is designed for systems where extended error information is considered to be sensitive, and it should not be made available remotely. +> +> This policy setting will not be applied until the system is rebooted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Propagate extended error information* +- GP name: *RpcExtendedErrorInformation* +- GP path: *System\Remote Procedure Call* +- GP ADMX file name: *RPC.admx* + + + +
    + + +**ADMX_RPC/RpcIgnoreDelegationFailure** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the RPC Runtime ignores delegation failures when delegation is requested. + +The constrained delegation model, introduced in Windows Server 2003, does not report that delegation was enabled on a security context when a client connects to a server. Callers of RPC and COM are encouraged to use the RPC_C_QOS_CAPABILITIES_IGNORE_DELEGATE_FAILURE flag, but some applications written for the traditional delegation model prior to Windows Server 2003 may not use this flag and will encounter RPC_S_SEC_PKG_ERROR when connecting to a server that uses constrained delegation. + +If you disable this policy setting, the RPC Runtime will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. + +If you do not configure this policy setting, it remains disabled and will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. + +If you enable this policy setting, then: + +- "Off" directs the RPC Runtime to generate RPC_S_SEC_PKG_ERROR if the client asks for delegation, but the created security context does not support delegation. + +- "On" directs the RPC Runtime to accept security contexts that do not support delegation even if delegation was asked for. + +> [!NOTE] +> This policy setting will not be applied until the system is rebooted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore Delegation Failure* +- GP name: *RpcIgnoreDelegationFailure* +- GP path: *System\Remote Procedure Call* +- GP ADMX file name: *RPC.admx* + + + + +
    + + +**ADMX_RPC/RpcMinimumHttpConnectionTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the idle connection timeout for RPC/HTTP connections. + +This policy setting is useful in cases where a network agent like an HTTP proxy or a router uses a lower idle connection timeout than the IIS server running the RPC/HTTP proxy. In such cases, RPC/HTTP clients may encounter errors because connections will be timed out faster than expected. Using this policy setting you can force the RPC Runtime and the RPC/HTTP Proxy to use a lower connection timeout. + +This policy setting is only applicable when the RPC Client, the RPC Server and the RPC HTTP Proxy are all running Windows Server 2003 family/Windows XP SP1 or higher versions. If either the RPC Client or the RPC Server or the RPC HTTP Proxy run on an older version of Windows, this policy setting will be ignored. + +The minimum allowed value for this policy setting is 90 seconds. The maximum is 7200 seconds (2 hours). + +If you disable this policy setting, the idle connection timeout on the IIS server running the RPC HTTP proxy will be used. + +If you do not configure this policy setting, it will remain disabled. The idle connection timeout on the IIS server running the RPC HTTP proxy will be used. + +If you enable this policy setting, and the IIS server running the RPC HTTP proxy is configured with a lower idle connection timeout, the timeout on the IIS server is used. Otherwise, the provided timeout value is used. The timeout is given in seconds. + +> [!NOTE] +> This policy setting will not be applied until the system is rebooted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Minimum Idle Connection Timeout for RPC/HTTP connections* +- GP name: *RpcMinimumHttpConnectionTimeout* +- GP path: *System\Remote Procedure Call* +- GP ADMX file name: *RPC.admx* + + + +
    + + +**ADMX_RPC/RpcStateInformation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the RPC Runtime maintains RPC state information for the system, and how much information it maintains. Basic state information, which consists only of the most commonly needed state data, is required for troubleshooting RPC problems. + +If you disable this policy setting, the RPC runtime defaults to "Auto2" level. + +If you do not configure this policy setting, the RPC defaults to "Auto2" level. + +If you enable this policy setting, you can use the drop-down box to determine which systems maintain RPC state information. + +- "None" indicates that the system does not maintain any RPC state information. Note: Because the basic state information required for troubleshooting has a negligible effect on performance and uses only about 4K of memory, this setting is not recommended for most installations. + +- "Auto1" directs RPC to maintain basic state information only if the computer has at least 64 MB of memory. + +- "Auto2" directs RPC to maintain basic state information only if the computer has at least 128 MB of memory and is running Windows 2000 Server, Windows 2000 Advanced Server, or Windows 2000 Datacenter Server. + +- "Server" directs RPC to maintain basic state information on the computer, regardless of its capacity. + +- "Full" directs RPC to maintain complete RPC state information on the system, regardless of its capacity. Because this level can degrade performance, it is recommended for use only while you are investigating an RPC problem. + +> [!NOTE] +> To retrieve the RPC state information from a system that maintains it, you must use a debugging tool. +> +> This policy setting will not be applied until the system is rebooted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maintain RPC Troubleshooting State Information* +- GP name: *RpcStateInformation* +- GP path: *System\Remote Procedure Call* +- GP ADMX file name: *RPC.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-scripts.md b/windows/client-management/mdm/policy-csp-admx-scripts.md new file mode 100644 index 0000000000..56b8fa10a1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-scripts.md @@ -0,0 +1,986 @@ +--- +title: Policy CSP - ADMX_Scripts +description: Policy CSP - ADMX_Scripts +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Scripts +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Scripts policies + +
    +
    + ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled +
    +
    + ADMX_Scripts/MaxGPOScriptWaitPolicy +
    +
    + ADMX_Scripts/Run_Computer_PS_Scripts_First +
    +
    + ADMX_Scripts/Run_Legacy_Logon_Script_Hidden +
    +
    + ADMX_Scripts/Run_Logoff_Script_Visible +
    +
    + ADMX_Scripts/Run_Logon_Script_Sync_1 +
    +
    + ADMX_Scripts/Run_Logon_Script_Sync_2 +
    +
    + ADMX_Scripts/Run_Logon_Script_Visible +
    +
    + ADMX_Scripts/Run_Shutdown_Script_Visible +
    +
    + ADMX_Scripts/Run_Startup_Script_Sync +
    +
    + ADMX_Scripts/Run_Startup_Script_Visible +
    +
    + ADMX_Scripts/Run_User_PS_Scripts_First +
    +
    + + +
    + + +**ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows user logon scripts to run when the logon cross-forest, DNS suffixes are not configured, and NetBIOS or WINS is disabled. This policy setting affects all user accounts interactively logging on to the computer. + +If you enable this policy setting, user logon scripts run if NetBIOS or WINS is disabled during cross-forest logons without the DNS suffixes being configured. + +If you disable or do not configure this policy setting, user account cross-forest, interactive logging cannot run logon scripts if NetBIOS or WINS is disabled, and the DNS suffixes are not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow logon scripts when NetBIOS or WINS is disabled* +- GP name: *Allow_Logon_Script_NetbiosDisabled* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/MaxGPOScriptWaitPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how long the system waits for scripts applied by Group Policy to run. + +This setting limits the total time allowed for all logon, logoff, startup, and shutdown scripts applied by Group Policy to finish running. If the scripts have not finished running when the specified time expires, the system stops script processing and records an error event. + +If you enable this setting, then, in the Seconds box, you can type a number from 1 to 32,000 for the number of seconds you want the system to wait for the set of scripts to finish. To direct the system to wait until the scripts have finished, no matter how long they take, type 0. + +This interval is particularly important when other system tasks must wait while the scripts complete. By default, each startup script must complete before the next one runs. Also, you can use the "Run logon scripts synchronously" setting to direct the system to wait for the logon scripts to complete before loading the desktop. + +An excessively long interval can delay the system and inconvenience users. However, if the interval is too short, prerequisite tasks might not be done, and the system can appear to be ready prematurely. + +If you disable or do not configure this setting the system lets the combined set of scripts run for up to 600 seconds (10 minutes). This is the default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify maximum wait time for Group Policy scripts* +- GP name: *MaxGPOScriptWaitPolicy* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Computer_PS_Scripts_First** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows PowerShell scripts are run before non-Windows PowerShell scripts during computer startup and shutdown. By default, Windows PowerShell scripts run after non-Windows PowerShell scripts. + +If you enable this policy setting, within each applicable Group Policy Object (GPO), Windows PowerShell scripts are run before non-Windows PowerShell scripts during computer startup and shutdown. + +For example, assume the following scenario: + +There are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. + +GPO B and GPO C include the following computer startup scripts: + +GPO B: B.cmd, B.ps1 +GPO C: C.cmd, C.ps1 + +Assume also that there are two computers, DesktopIT and DesktopSales. +For DesktopIT, GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for DesktopIT: + +Within GPO B: B.ps1, B.cmd +Within GPO C: C.ps1, C.cmd + +For DesktopSales, GPOs B and C are applied, but not GPO A. Therefore, the scripts for GPOs B and C run in the following order for DesktopSales: + +Within GPO B: B.cmd, B.ps1 +Within GPO C: C.cmd, C.ps1 + +> [!NOTE] +> This policy setting determines the order in which computer startup and shutdown scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO: +> - Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown)\Startup +> - Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown)\Shutdown + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run Windows PowerShell scripts first at computer startup, shutdown* +- GP name: *Run_Computer_PS_Scripts_First* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Legacy_Logon_Script_Hidden** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting hides the instructions in logon scripts written for Windows NT 4.0 and earlier. + +Logon scripts are batch files of instructions that run when the user logs on. By default, Windows 2000 displays the instructions in logon scripts written for Windows NT 4.0 and earlier in a command window as they run, although it does not display logon scripts written for Windows 2000. + +If you enable this setting, Windows 2000 does not display logon scripts written for Windows NT 4.0 and earlier. + +If you disable or do not configure this policy setting, Windows 2000 displays login scripts written for Windows NT 4.0 and earlier. + +Also, see the "Run Logon Scripts Visible" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run legacy logon scripts hidden* +- GP name: *Run_Legacy_Logon_Script_Hidden* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Logoff_Script_Visible** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting displays the instructions in logoff scripts as they run. + +Logoff scripts are batch files of instructions that run when the user logs off. By default, the system does not display the instructions in the logoff script. + +If you enable this policy setting, the system displays each instruction in the logoff script as it runs. The instructions appear in a command window. This policy setting is designed for advanced users. + +If you disable or do not configure this policy setting, the instructions are suppressed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display instructions in logoff scripts as they run* +- GP name: *Run_Logoff_Script_Visible* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Logon_Script_Sync_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting directs the system to wait for logon scripts to finish running before it starts the File Explorer interface program and creates the desktop. + +If you enable this policy setting, File Explorer does not start until the logon scripts have finished running. This policy setting ensures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop. + +If you disable or do not configure this policy setting, the logon scripts and File Explorer are not synchronized and can run simultaneously. + +This policy setting appears in the Computer Configuration and User Configuration folders. The policy setting set in Computer Configuration takes precedence over the policy setting set in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run logon scripts synchronously* +- GP name: *Run_Logon_Script_Sync_1* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Logon_Script_Sync_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting directs the system to wait for logon scripts to finish running before it starts the File Explorer interface program and creates the desktop. + +If you enable this policy setting, File Explorer does not start until the logon scripts have finished running. This policy setting ensures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop. + +If you disable or do not configure this policy setting, the logon scripts and File Explorer are not synchronized and can run simultaneously. + +This policy setting appears in the Computer Configuration and User Configuration folders. The policy setting set in Computer Configuration takes precedence over the policy setting set in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run logon scripts synchronously* +- GP name: *Run_Logon_Script_Sync_2* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Logon_Script_Visible** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting displays the instructions in logon scripts as they run. + +Logon scripts are batch files of instructions that run when the user logs on. By default, the system does not display the instructions in logon scripts. + +If you enable this policy setting, the system displays each instruction in the logon script as it runs. The instructions appear in a command window. This policy setting is designed for advanced users. + +If you disable or do not configure this policy setting, the instructions are suppressed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display instructions in logon scripts as they run* +- GP name: *Run_Logon_Script_Visible* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Shutdown_Script_Visible** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting displays the instructions in shutdown scripts as they run. + +Shutdown scripts are batch files of instructions that run when the user restarts the system or shuts it down. By default, the system does not display the instructions in the shutdown script. + +If you enable this policy setting, the system displays each instruction in the shutdown script as it runs. The instructions appear in a command window. + +If you disable or do not configure this policy setting, the instructions are suppressed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display instructions in shutdown scripts as they run* +- GP name: *Run_Shutdown_Script_Visible* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Startup_Script_Sync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets the system run startup scripts simultaneously. + +Startup scripts are batch files that run before the user is invited to log on. By default, the system waits for each startup script to complete before it runs the next startup script. + +If you enable this policy setting, the system does not coordinate the running of startup scripts. As a result, startup scripts can run simultaneously. + +If you disable or do not configure this policy setting, a startup cannot run until the previous script is complete. + +> [!NOTE] +> Starting with Windows Vista operating system, scripts that are configured to run asynchronously are no longer visible on startup, whether the "Run startup scripts visible" policy setting is enabled or not. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run startup scripts asynchronously* +- GP name: *Run_Startup_Script_Sync* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_Startup_Script_Visible** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting displays the instructions in startup scripts as they run. + +Startup scripts are batch files of instructions that run before the user is invited to log on. By default, the system does not display the instructions in the startup script. + +If you enable this policy setting, the system displays each instruction in the startup script as it runs. Instructions appear in a command window. This policy setting is designed for advanced users. + +If you disable or do not configure this policy setting, the instructions are suppressed. + +> [!NOTE] +> Starting with Windows Vista operating system, scripts that are configured to run asynchronously are no longer visible on startup, whether this policy setting is enabled or not. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display instructions in startup scripts as they run* +- GP name: *Run_Startup_Script_Visible* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + + +**ADMX_Scripts/Run_User_PS_Scripts_First** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows PowerShell scripts are run before non-Windows PowerShell scripts during user logon and logoff. By default, Windows PowerShell scripts run after non-Windows PowerShell scripts. + +If you enable this policy setting, within each applicable Group Policy Object (GPO), PowerShell scripts are run before non-PowerShell scripts during user logon and logoff. + +For example, assume the following scenario: + +There are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. + +GPO B and GPO C include the following user logon scripts: + +GPO B: B.cmd, B.ps1 +GPO C: C.cmd, C.ps1 + +Assume also that there are two users, Qin Hong and Tamara Johnston. +For Qin, GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for Qin: + +Within GPO B: B.ps1, B.cmd +Within GPO C: C.ps1, C.cmd + +For Tamara, GPOs B and C are applied, but not GPO A. Therefore, the scripts for GPOs B and C run in the following order for Tamara: + +Within GPO B: B.cmd, B.ps1 +Within GPO C: C.cmd, C.ps1 + +> [!NOTE] +> This policy setting determines the order in which user logon and logoff scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO: +> - User Configuration\Policies\Windows Settings\Scripts (Logon/Logoff)\Logon +> - User Configuration\Policies\Windows Settings\Scripts (Logon/Logoff)\Logoff + +This policy setting appears in the Computer Configuration and User Configuration folders. The policy setting set in Computer Configuration takes precedence over the setting set in User Configuration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run Windows PowerShell scripts first at user logon, logoff* +- GP name: *Run_User_PS_Scripts_First* +- GP path: *System\Scripts* +- GP ADMX file name: *Scripts.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-sdiageng.md b/windows/client-management/mdm/policy-csp-admx-sdiageng.md new file mode 100644 index 0000000000..dca614dec2 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sdiageng.md @@ -0,0 +1,260 @@ +--- +title: Policy CSP - ADMX_sdiageng +description: Policy CSP - ADMX_sdiageng +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_sdiageng +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_sdiageng policies + +
    +
    + ADMX_sdiageng/BetterWhenConnected +
    +
    + ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy +
    +
    + ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy +
    +
    + + +
    + + +**ADMX_sdiageng/BetterWhenConnected** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users who are connected to the Internet to access and search troubleshooting content that is hosted on Microsoft content servers. Users can access online troubleshooting content from within the Troubleshooting Control Panel UI by clicking "Yes" when they are prompted by a message that states, "Do you want the most up-to-date troubleshooting content?" + +If you enable or do not configure this policy setting, users who are connected to the Internet can access and search troubleshooting content that is hosted on Microsoft content servers from within the Troubleshooting Control Panel user interface. + +If you disable this policy setting, users can only access and search troubleshooting content that is available locally on their computers, even if they are connected to the Internet. They are prevented from connecting to the Microsoft servers that host the Windows Online Troubleshooting Service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)* +- GP name: *BetterWhenConnected* +- GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* +- GP ADMX file name: *sdiageng.admx* + + + +
    + + +**ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to access and run the troubleshooting tools that are available in the Troubleshooting Control Panel and to run the troubleshooting wizard to troubleshoot problems on their computers. + +If you enable or do not configure this policy setting, users can access and run the troubleshooting tools from the Troubleshooting Control Panel. + +If you disable this policy setting, users cannot access or run the troubleshooting tools from the Control Panel. + +Note that this setting also controls a user's ability to launch standalone troubleshooting packs such as those found in .diagcab files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access and run Troubleshooting Wizards* +- GP name: *ScriptedDiagnosticsExecutionPolicy* +- GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* +- GP ADMX file name: *sdiageng.admx* + + + +
    + + +**ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether scripted diagnostics will execute diagnostic packages that are signed by untrusted publishers. + +If you enable this policy setting, the scripted diagnostics execution engine validates the signer of any diagnostic package and runs only those signed by trusted publishers. + +If you disable or do not configure this policy setting, the scripted diagnostics execution engine runs all digitally signed packages. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Security Policy for Scripted Diagnostics* +- GP name: *ScriptedDiagnosticsSecurityPolicy* +- GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* +- GP ADMX file name: *sdiageng.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-securitycenter.md b/windows/client-management/mdm/policy-csp-admx-securitycenter.md new file mode 100644 index 0000000000..7590b70934 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-securitycenter.md @@ -0,0 +1,127 @@ +--- +title: Policy CSP - ADMX_Securitycenter +description: Policy CSP - ADMX_Securitycenter +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Securitycenter +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Securitycenter policies + +
    +
    + ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain +
    +
    + + +
    + + +**ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Security Center is turned on or off for computers that are joined to an Active Directory domain. When Security Center is turned on, it monitors essential security settings and notifies the user when the computer might be at risk. The Security Center Control Panel category view also contains a status section, where the user can get recommendations to help increase the computer's security. When Security Center is not enabled on the domain, neither the notifications nor the Security Center status section are displayed. + +Note that Security Center can only be turned off for computers that are joined to a Windows domain. When a computer is not joined to a Windows domain, the policy setting will have no effect. + +If you do not configure this policy setting, the Security Center is turned off for domain members. + +If you enable this policy setting, Security Center is turned on for all users. + +If you disable this policy setting, Security Center is turned off for domain members. + +**Windows XP SP2** + +In Windows XP SP2, the essential security settings that are monitored by Security Center include firewall, antivirus, and Automatic Updates. Note that Security Center might not be available following a change to this policy setting until after the computer is restarted for Windows XP SP2 computers. + +**Windows Vista** + +In Windows Vista, this policy setting monitors essential security settings to include firewall, antivirus, antispyware, Internet security settings, User Account Control, and Automatic Updates. Windows Vista computers do not require a reboot for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Security Center (Domain PCs only)* +- GP name: *SecurityCenter_SecurityCenterInDomain* +- GP path: *Windows Components\Security Center* +- GP ADMX file name: *Securitycenter.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-sensors.md b/windows/client-management/mdm/policy-csp-admx-sensors.md new file mode 100644 index 0000000000..66a0fdf6d6 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sensors.md @@ -0,0 +1,402 @@ +--- +title: Policy CSP - ADMX_Sensors +description: Policy CSP - ADMX_Sensors +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/22/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Sensors +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Sensors policies + +
    +
    + ADMX_Sensors/DisableLocationScripting_1 +
    +
    + ADMX_Sensors/DisableLocationScripting_2 +
    +
    + ADMX_Sensors/DisableLocation_1 +
    +
    + ADMX_Sensors/DisableSensors_1 +
    +
    + ADMX_Sensors/DisableSensors_2 +
    +
    + + +
    + + +**ADMX_Sensors/DisableLocationScripting_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off scripting for the location feature. + +If you enable this policy setting, scripts for the location feature will not run. + +If you disable or do not configure this policy setting, all location scripts will run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off location scripting* +- GP name: *DisableLocationScripting_1* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
    + + +**ADMX_Sensors/DisableLocationScripting_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off scripting for the location feature. + +If you enable this policy setting, scripts for the location feature will not run. + +If you disable or do not configure this policy setting, all location scripts will run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off location scripting* +- GP name: *DisableLocationScripting_2* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
    + + +**ADMX_Sensors/DisableLocation_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the location feature for this computer. + +If you enable this policy setting, the location feature is turned off, and all programs on this computer are prevented from using location information from the location feature. + +If you disable or do not configure this policy setting, all programs on this computer will not be prevented from using location information from the location feature. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off location* +- GP name: *DisableLocation_1* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
    + + +**ADMX_Sensors/DisableSensors_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the sensor feature for this computer. + +If you enable this policy setting, the sensor feature is turned off, and all programs on this computer cannot use the sensor feature. + +If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off sensors* +- GP name: *DisableSensors_1* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
    + + +**ADMX_Sensors/DisableSensors_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the sensor feature for this computer. + +If you enable this policy setting, the sensor feature is turned off, and all programs on this computer cannot use the sensor feature. + +If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off sensors* +- GP name: *DisableSensors_2* +- GP path: *Windows Components\Location and Sensors* +- GP ADMX file name: *Sensors.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-servicing.md b/windows/client-management/mdm/policy-csp-admx-servicing.md new file mode 100644 index 0000000000..af834f2656 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-servicing.md @@ -0,0 +1,117 @@ +--- +title: Policy CSP - ADMX_Servicing +description: Policy CSP - ADMX_Servicing +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/18/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Servicing +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Servicing policies + +
    +
    + ADMX_Servicing/Servicing +
    +
    + + +
    + + +**ADMX_Servicing/Servicing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed. + +If you enable this policy setting and specify the new location, the files in that location will be used to repair operating system corruption and for enabling optional features that have had their payload files removed. You must enter the fully qualified path to the new location in the ""Alternate source file path"" text box. Multiple locations can be specified when each path is separated by a semicolon. + +The network location can be either a folder, or a WIM file. If it is a WIM file, the location should be specified by prefixing the path with “wim:” and include the index of the image to use in the WIM file. For example “wim:\\server\share\install.wim:3”. + +If you disable or do not configure this policy setting, or if the required files cannot be found at the locations specified in this policy setting, the files will be downloaded from Windows Update, if that is allowed by the policy settings for the computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify settings for optional component installation and component repair* +- GP name: *Servicing* +- GP path: *System* +- GP ADMX file name: *Servicing.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md new file mode 100644 index 0000000000..53ca6431fc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -0,0 +1,706 @@ +--- +title: Policy CSP - ADMX_SettingSync +description: Policy CSP - ADMX_SettingSync +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SettingSync +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_SettingSync policies + +
    +
    + ADMX_SettingSync/DisableAppSyncSettingSync +
    +
    + ADMX_SettingSync/DisableApplicationSettingSync +
    +
    + ADMX_SettingSync/DisableCredentialsSettingSync +
    +
    + ADMX_SettingSync/DisableDesktopThemeSettingSync +
    +
    + ADMX_SettingSync/DisablePersonalizationSettingSync +
    +
    + ADMX_SettingSync/DisableSettingSync +
    +
    + ADMX_SettingSync/DisableStartLayoutSettingSync +
    +
    + ADMX_SettingSync/DisableSyncOnPaidNetwork +
    +
    + ADMX_SettingSync/DisableWindowsSettingSync +
    +
    + + +
    + + +**ADMX_SettingSync/DisableAppSyncSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "AppSync" group from syncing to and from this PC. This turns off and disables the "AppSync" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "AppSync" group will not be synced. + +Use the option "Allow users to turn app syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "AppSync" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync Apps* +- GP name: *DisableAppSyncSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + + +**ADMX_SettingSync/DisableApplicationSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "app settings" group from syncing to and from this PC. This turns off and disables the "app settings" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "app settings" group will not be synced. + +Use the option "Allow users to turn app settings syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "app settings" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync app settings* +- GP name: *DisableApplicationSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + + +**ADMX_SettingSync/DisableCredentialsSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "passwords" group from syncing to and from this PC. This turns off and disables the "passwords" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "passwords" group will not be synced. + +Use the option "Allow users to turn passwords syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "passwords" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync passwords* +- GP name: *DisableCredentialsSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + + +**ADMX_SettingSync/DisableDesktopThemeSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "desktop personalization" group from syncing to and from this PC. This turns off and disables the "desktop personalization" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "desktop personalization" group will not be synced. + +Use the option "Allow users to turn desktop personalization syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "desktop personalization" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync desktop personalization* +- GP name: *DisableDesktopThemeSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + + +**ADMX_SettingSync/DisablePersonalizationSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "personalize" group from syncing to and from this PC. This turns off and disables the "personalize" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "personalize" group will not be synced. + +Use the option "Allow users to turn personalize syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "personalize" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync personalize* +- GP name: *DisablePersonalizationSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + + +**ADMX_SettingSync/DisableSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings. + +If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC. + +Use the option "Allow users to turn syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, "sync your settings" is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync* +- GP name: *DisableSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + + +**ADMX_SettingSync/DisableStartLayoutSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "Start layout" group from syncing to and from this PC. This turns off and disables the "Start layout" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "Start layout" group will not be synced. + +Use the option "Allow users to turn start syncing on" so that syncing is turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "Start layout" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync start settings* +- GP name: *DisableStartLayoutSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + + +**ADMX_SettingSync/DisableSyncOnPaidNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent syncing to and from this PC when on metered Internet connections. This turns off and disables "sync your settings on metered connections" switch on the "sync your settings" page in PC Settings. + +If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection. + +If you do not set or disable this setting, syncing on metered connections is configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync on metered connections* +- GP name: *DisableSyncOnPaidNetwork* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + + +**ADMX_SettingSync/DisableWindowsSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "Other Windows settings" group from syncing to and from this PC. This turns off and disables the "Other Windows settings" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "Other Windows settings" group will not be synced. + +Use the option "Allow users to turn other Windows settings syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "Other Windows settings" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync other Windows settings* +- GP name: *DisableWindowsSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md new file mode 100644 index 0000000000..a9749a346b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -0,0 +1,193 @@ +--- +title: Policy CSP - ADMX_SharedFolders +description: Policy CSP - ADMX_SharedFolders +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SharedFolders +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_SharedFolders policies + +
    +
    + ADMX_SharedFolders/PublishDfsRoots +
    +
    + ADMX_SharedFolders/PublishSharedFolders +
    +
    + +
    + + +**ADMX_SharedFolders/PublishDfsRoots** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the user can publish DFS roots in Active Directory Domain Services (AD DS). + +If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in AD DS . + +If you disable this policy setting, users cannot publish DFS roots in AD DS and the "Publish in Active Directory" option is disabled. + +> [!NOTE] +> The default is to allow shared folders to be published when this setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow DFS roots to be published* +- GP name: *PublishDfsRoots* +- GP path: *Shared Folders* +- GP ADMX file name: *SharedFolders.admx* + + + + +
    + + +**ADMX_SharedFolders/PublishSharedFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the user can publish shared folders in Active Directory Domain Services (AD DS). + +If you enable or do not configure this policy setting, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in AD DS. + +If you disable this policy setting, users cannot publish shared folders in AD DS, and the "Publish in Active Directory" option is disabled. + +> [!NOTE] +> The default is to allow shared folders to be published when this setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow shared folders to be published* +- GP name: *PublishSharedFolders* +- GP path: *Shared Folders* +- GP ADMX file name: *SharedFolders.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md new file mode 100644 index 0000000000..42e13cdd7d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -0,0 +1,113 @@ +--- +title: Policy CSP - ADMX_Sharing +description: Policy CSP - ADMX_Sharing +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Sharing +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Sharing policies + +
    +
    + ADMX_Sharing/NoInplaceSharing +
    +
    + +
    + + +**ADMX_Sharing/NoInplaceSharing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether users can share files within their profile. By default users are allowed to share files within their profile to other users on their network after an administrator opts in the computer. An administrator can opt in the computer by using the sharing wizard to share a file within their profile. + +If you enable this policy setting, users cannot share files within their profile using the sharing wizard. Also, the sharing wizard cannot create a share at %root%\users and can only be used to create SMB shares on folders. + +If you disable or don't configure this policy setting, users can share files out of their user profile after an administrator has opted in the computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from sharing files within their profile.* +- GP name: *NoInplaceSharing* +- GP path: *Windows Components\Network Sharing* +- GP ADMX file name: *Sharing.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md new file mode 100644 index 0000000000..58d1a90759 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -0,0 +1,349 @@ +--- +title: Policy CSP - ADMX_ShellCommandPromptRegEditTools +description: Policy CSP - ADMX_ShellCommandPromptRegEditTools +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/21/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ShellCommandPromptRegEditTools +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_ShellCommandPromptRegEditTools policies + +
    +
    + ADMX_ShellCommandPromptRegEditTools/DisableCMD +
    +
    + ADMX_ShellCommandPromptRegEditTools/DisableRegedit +
    +
    + ADMX_ShellCommandPromptRegEditTools/DisallowApps +
    +
    + ADMX_ShellCommandPromptRegEditTools/RestrictApps +
    +
    + + +
    + + +**ADMX_ShellCommandPromptRegEditTools/DisableCMD** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from running the interactive command prompt, Cmd.exe. This policy setting also determines whether batch files (.cmd and .bat) can run on the computer. + +If you enable this policy setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action. + +If you disable this policy setting or do not configure it, users can run Cmd.exe and batch files normally. + +> [!NOTE] +> Do not prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Remote Desktop Services. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to the command prompt* +- GP name: *DisableCMD* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
    + + +**ADMX_ShellCommandPromptRegEditTools/DisableRegedit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Disables the Windows registry editor Regedit.exe. + +If you enable this policy setting and the user tries to start Regedit.exe, a message appears explaining that a policy setting prevents the action. + +If you disable this policy setting or do not configure it, users can run Regedit.exe normally. + +To prevent users from using other administrative tools, use the "Run only specified Windows applications" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to registry editing tools* +- GP name: *DisableRegedit* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + + +
    + + +**ADMX_ShellCommandPromptRegEditTools/DisallowApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents Windows from running the programs you specify in this policy setting. + +If you enable this policy setting, users cannot run programs that you add to the list of disallowed applications. + +If you disable this policy setting or do not configure it, users can run any programs. + +This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. + +> [!NOTE] +> Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +> To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (for example, Winword.exe, Poledit.exe, Powerpnt.exe). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Don't run specified Windows applications* +- GP name: *DisallowApps* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
    + + +**ADMX_ShellCommandPromptRegEditTools/RestrictApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Limits the Windows programs that users have permission to run on the computer. + +If you enable this policy setting, users can only run programs that you add to the list of allowed applications. + +If you disable this policy setting or do not configure it, users can run all applications. + +This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. + +> [!NOTE] +> Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. +> To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (for example, Winword.exe, Poledit.exe, Powerpnt.exe). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run only specified Windows applications* +- GP name: *RestrictApps* +- GP path: *System* +- GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-skydrive.md b/windows/client-management/mdm/policy-csp-admx-skydrive.md new file mode 100644 index 0000000000..e42d009528 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-skydrive.md @@ -0,0 +1,117 @@ +--- +title: Policy CSP - ADMX_SkyDrive +description: Policy CSP - ADMX_SkyDrive +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SkyDrive +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_SkyDrive policies + +
    +
    + ADMX_SkyDrive/PreventNetworkTrafficPreUserSignIn +
    +
    + + +
    + + +**ADMX_SkyDrive/PreventNetworkTrafficPreUserSignIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enable this setting to prevent the OneDrive sync client (OneDrive.exe) from generating network traffic (checking for updates, etc.) until the user signs in to OneDrive or starts syncing files to the local computer. + +If you enable this setting, users must sign in to the OneDrive sync client on the local computer, or select to sync OneDrive or SharePoint files on the computer, for the sync client to start automatically. + +If this setting is not enabled, the OneDrive sync client will start automatically when users sign in to Windows. + +If you enable or disable this setting, do not return the setting to Not Configured. Doing so will not change the configuration and the last configured setting will remain in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent OneDrive from generating network traffic until the user signs in to OneDrive* +- GP name: *PreventNetworkTrafficPreUserSignIn* +- GP path: *Windows Components\OneDrive* +- GP ADMX file name: *SkyDrive.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md new file mode 100644 index 0000000000..b75b3b086d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -0,0 +1,1230 @@ +--- +title: Policy CSP - ADMX_Smartcard +description: Policy CSP - ADMX_Smartcard +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Smartcard +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Smartcard policies + +
    +
    + ADMX_Smartcard/AllowCertificatesWithNoEKU +
    +
    + ADMX_Smartcard/AllowIntegratedUnblock +
    +
    + ADMX_Smartcard/AllowSignatureOnlyKeys +
    +
    + ADMX_Smartcard/AllowTimeInvalidCertificates +
    +
    + ADMX_Smartcard/CertPropEnabledString +
    +
    + ADMX_Smartcard/CertPropRootCleanupString +
    +
    + ADMX_Smartcard/CertPropRootEnabledString +
    +
    + ADMX_Smartcard/DisallowPlaintextPin +
    +
    + ADMX_Smartcard/EnumerateECCCerts +
    +
    + ADMX_Smartcard/FilterDuplicateCerts +
    +
    + ADMX_Smartcard/ForceReadingAllCertificates +
    +
    + ADMX_Smartcard/IntegratedUnblockPromptString +
    +
    + ADMX_Smartcard/ReverseSubject +
    +
    + ADMX_Smartcard/SCPnPEnabled +
    +
    + ADMX_Smartcard/SCPnPNotification +
    +
    + ADMX_Smartcard/X509HintsNeeded +
    +
    + + +
    + + +**ADMX_Smartcard/AllowCertificatesWithNoEKU** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon. + +In versions of Windows prior to Windows Vista, smart card certificates that are used for logon require an enhanced key usage (EKU) extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. + +If you enable this policy setting, certificates with the following attributes can also be used to log on with a smart card: + +- Certificates with no EKU +- Certificates with an All Purpose EKU +- Certificates with a Client Authentication EKU + +If you disable or do not configure this policy setting, only certificates that contain the smart card logon object identifier can be used to log on with a smart card. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow certificates with no extended key usage certificate attribute* +- GP name: *AllowCertificatesWithNoEKU* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/AllowIntegratedUnblock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you determine whether the integrated unblock feature will be available in the logon User Interface (UI). + +In order to use the integrated unblock feature your smart card must support this feature. Please check with your hardware manufacturer to see if your smart card supports this feature. + +If you enable this policy setting, the integrated unblock feature will be available. + +If you disable or do not configure this policy setting then the integrated unblock feature will not be available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow Integrated Unblock screen to be displayed at the time of logon* +- GP name: *AllowIntegratedUnblock* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/AllowSignatureOnlyKeys** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you allow signature key-based certificates to be enumerated and available for logon. + +If you enable this policy setting then any certificates available on the smart card with a signature only key will be listed on the logon screen. + +If you disable or do not configure this policy setting, any available smart card signature key-based certificates will not be listed on the logon screen. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow signature keys valid for Logon* +- GP name: *AllowSignatureOnlyKeys* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/AllowTimeInvalidCertificates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting permits those certificates to be displayed for logon that are either expired or not yet valid. + +Under previous versions of Microsoft Windows, certificates were required to contain a valid time and not be expired. The certificate must still be accepted by the domain controller in order to be used. This setting only controls the displaying of the certificate on the client machine. + +If you enable this policy setting certificates will be listed on the logon screen regardless of whether they have an invalid time or their time validity has expired. + +If you disable or do not configure this policy setting, certificates which are expired or not yet valid will not be listed on the logon screen. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow time invalid certificates* +- GP name: *AllowTimeInvalidCertificates* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/CertPropEnabledString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the certificate propagation that occurs when a smart card is inserted. + +If you enable or do not configure this policy setting then certificate propagation will occur when you insert your smart card. + +If you disable this policy setting, certificate propagation will not occur and the certificates will not be made available to applications such as Outlook. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on certificate propagation from smart card* +- GP name: *CertPropEnabledString* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/CertPropRootCleanupString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the cleanup behavior of root certificates. If you enable this policy setting then root certificate cleanup will occur according to the option selected. If you disable or do not configure this setting then root certificate cleanup will occur on logoff. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure root certificate clean up* +- GP name: *CertPropRootCleanupString* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/CertPropRootEnabledString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted. + +If you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card. + +> [!NOTE] +> For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card. + +If you disable this policy setting then root certificates will not be propagated from the smart card. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on root certificate propagation from smart card* +- GP name: *CertPropRootEnabledString* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/DisallowPlaintextPin** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents plaintext PINs from being returned by Credential Manager. + +If you enable this policy setting, Credential Manager does not return a plaintext PIN. + +If you disable or do not configure this policy setting, plaintext PINs can be returned by Credential Manager. + +> [!NOTE] +> Enabling this policy setting could prevent certain smart cards from working on Windows. Please consult your smart card manufacturer to find out whether you will be affected by this policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent plaintext PINs from being returned by Credential Manager* +- GP name: *DisallowPlaintextPin* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/EnumerateECCCerts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to log on to a domain. + +If you enable this policy setting, ECC certificates on a smart card can be used to log on to a domain. + +If you disable or do not configure this policy setting, ECC certificates on a smart card cannot be used to log on to a domain. + +> [!NOTE] +> This policy setting only affects a user's ability to log on to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting. +> If you use an ECDSA key to log on, you must also have an associated ECDH key to permit logons when you are not connected to the network. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow ECC certificates to be used for logon and authentication* +- GP name: *EnumerateECCCerts* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/FilterDuplicateCerts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you configure if all your valid logon certificates are displayed. + +During the certificate renewal period, a user can have multiple valid logon certificates issued from the same certificate template. This can cause confusion as to which certificate to select for logon. The common case for this behavior is when a certificate is renewed and the old one has not yet expired. Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (determined by their UPN). + +If there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the certificate with the expiration time furthest in the future will be shown. + +> [!NOTE] +> This setting will be applied after the following policy: "Allow time invalid certificates" + +If you enable or do not configure this policy setting, filtering will take place. + +If you disable this policy setting, no filtering will take place. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Filter duplicate logon certificates* +- GP name: *FilterDuplicateCerts* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/ForceReadingAllCertificates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the reading of all certificates from the smart card for logon. + +During logon Windows will by default only read the default certificate from the smart card unless it supports retrieval of all certificates in a single call. This setting forces Windows to read all the certificates from the card. This can introduce a significant performance decrease in certain situations. Please contact your smart card vendor to determine if your smart card and associated CSP supports the required behavior. + +If you enable this setting, then Windows will attempt to read all certificates from the smart card regardless of the feature set of the CSP. + +If you disable or do not configure this setting, Windows will only attempt to read the default certificate from those cards that do not support retrieval of all certificates in a single call. Certificates other than the default will not be available for logon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force the reading of all certificates from the smart card* +- GP name: *ForceReadingAllCertificates* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/IntegratedUnblockPromptString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the displayed message when a smart card is blocked. + +If you enable this policy setting, the specified message will be displayed to the user when the smart card is blocked. + +> [!NOTE] +> The following policy setting must be enabled: Allow Integrated Unblock screen to be displayed at the time of logon. + +If you disable or do not configure this policy setting, the default message will be displayed to the user when the smart card is blocked, if the integrated unblock feature is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display string when smart card is blocked* +- GP name: *IntegratedUnblockPromptString* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/ReverseSubject** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you reverse the subject name from how it is stored in the certificate when displaying it during logon. + +By default the user principal name (UPN) is displayed in addition to the common name to help users distinguish one certificate from another. For example, if the certificate subject was CN=User1, OU=Users, DN=example, DN=com and had an UPN of user1@example.com then "User1" will be displayed along with "user1@example.com." If the UPN is not present then the entire subject name will be displayed. This setting controls the appearance of that subject name and might need to be adjusted per organization. + +If you enable this policy setting or do not configure this setting, then the subject name will be reversed. + +If you disable, the subject name will be displayed as it appears in the certificate. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reverse the subject name stored in a certificate when displaying* +- GP name: *ReverseSubject* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/SCPnPEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether Smart Card Plug and Play is enabled. + +If you enable or do not configure this policy setting, Smart Card Plug and Play will be enabled and the system will attempt to install a Smart Card device driver when a card is inserted in a Smart Card Reader for the first time. + +If you disable this policy setting, Smart Card Plug and Play will be disabled and a device driver will not be installed when a card is inserted in a Smart Card Reader. + +> [!NOTE] +> This policy setting is applied only for smart cards that have passed the Windows Hardware Quality Labs (WHQL) testing process. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Smart Card Plug and Play service* +- GP name: *SCPnPEnabled* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/SCPnPNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether a confirmation message is displayed when a smart card device driver is installed. + +If you enable or do not configure this policy setting, a confirmation message will be displayed when a smart card device driver is installed. + +If you disable this policy setting, a confirmation message will not be displayed when a smart card device driver is installed. + +> [!NOTE] +> This policy setting is applied only for smart cards that have passed the Windows Hardware Quality Labs (WHQL) testing process. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Notify user of successful smart card driver installation* +- GP name: *SCPnPNotification* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + + +**ADMX_Smartcard/X509HintsNeeded** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets you determine whether an optional field will be displayed during logon and elevation that allows a user to enter his or her user name or user name and domain, thereby associating a certificate with that user. + +If you enable this policy setting then an optional field that allows a user to enter their user name or user name and domain will be displayed. + +If you disable or do not configure this policy setting, an optional field that allows users to enter their user name or user name and domain will not be displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow user name hint* +- GP name: *X509HintsNeeded* +- GP path: *Windows Components\Smart Card* +- GP ADMX file name: *Smartcard.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-snmp.md b/windows/client-management/mdm/policy-csp-admx-snmp.md new file mode 100644 index 0000000000..8b1a15bdca --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-snmp.md @@ -0,0 +1,291 @@ +--- +title: Policy CSP - ADMX_Snmp +description: Policy CSP - ADMX_Snmp +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/24/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Snmp +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Snmp policies + +
    +
    + ADMX_Snmp/SNMP_Communities +
    +
    + ADMX_Snmp/SNMP_PermittedManagers +
    +
    + ADMX_Snmp/SNMP_Traps_Public +
    +
    + + +
    + + +**ADMX_Snmp/SNMP_Communities** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a list of the communities defined to the Simple Network Management Protocol (SNMP) service. + +SNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events. + +A valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network. + +If you enable this policy setting, the SNMP agent only accepts requests from management systems within the communities it recognizes, and only SNMP Read operation is allowed for the community. + +If you disable or do not configure this policy setting, the SNMP service takes the Valid Communities configured on the local computer instead. + +Best practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control. + +> [!NOTE] +> - It is good practice to use a cryptic community name. +> - This policy setting has no effect if the SNMP agent is not installed on the client computer. + +Also, see the other two SNMP settings: "Specify permitted managers" and "Specify trap configuration". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify communities* +- GP name: *SNMP_Communities* +- GP path: *Network\SNMP* +- GP ADMX file name: *Snmp.admx* + + + +
    + + +**ADMX_Snmp/SNMP_PermittedManagers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the permitted list of hosts that can submit a query to the Simple Network Management (SNMP) agent running on the client computer. + +Simple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring network events. + +The manager is located on the host computer on the network. The manager's role is to poll the agents for certain requested information. + +If you enable this policy setting, the SNMP agent only accepts requests from the list of permitted managers that you configure using this setting. + +If you disable or do not configure this policy setting, SNMP service takes the permitted managers configured on the local computer instead. + +Best practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\PermittedManagers key to allow only the local admin group full control. + +> [!NOTE] +> This policy setting has no effect if the SNMP agent is not installed on the client computer. + +Also, see the other two SNMP policy settings: "Specify trap configuration" and "Specify Community Name". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify permitted managers* +- GP name: *SNMP_PermittedManagers* +- GP path: *Network\SNMP* +- GP ADMX file name: *Snmp.admx* + + + +
    + + +**ADMX_Snmp/SNMP_Traps_Public** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows trap configuration for the Simple Network Management Protocol (SNMP) agent. + +Simple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring network events. + +This policy setting allows you to configure the name of the hosts that receive trap messages for the community sent by the SNMP service. A trap message is an alert or significant event that allows the SNMP agent to notify management systems asynchronously. + +If you enable this policy setting, the SNMP service sends trap messages to the hosts within the "public" community. + +If you disable or do not configure this policy setting, the SNMP service takes the trap configuration configured on the local computer instead. + +> [!NOTE] +> This setting has no effect if the SNMP agent is not installed on the client computer. + +Also, see the other two SNMP settings: "Specify permitted managers" and "Specify Community Name". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify traps for public community* +- GP name: *SNMP_Traps_Public* +- GP path: *Network\SNMP* +- GP ADMX file name: *Snmp.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md new file mode 100644 index 0000000000..2c16014c48 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -0,0 +1,5011 @@ +--- +title: Policy CSP - ADMX_StartMenu +description: Policy CSP - ADMX_StartMenu +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/20/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_StartMenu +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_StartMenu policies + +
    +
    + ADMX_StartMenu/AddSearchInternetLinkInStartMenu +
    +
    + ADMX_StartMenu/ClearRecentDocsOnExit +
    +
    + ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu +
    +
    + ADMX_StartMenu/ClearTilesOnExit +
    +
    + ADMX_StartMenu/DesktopAppsFirstInAppsView +
    +
    + ADMX_StartMenu/DisableGlobalSearchOnAppsView +
    +
    + ADMX_StartMenu/ForceStartMenuLogOff +
    +
    + ADMX_StartMenu/GoToDesktopOnSignIn +
    +
    + ADMX_StartMenu/GreyMSIAds +
    +
    + ADMX_StartMenu/HidePowerOptions +
    +
    + ADMX_StartMenu/Intellimenus +
    +
    + ADMX_StartMenu/LockTaskbar +
    +
    + ADMX_StartMenu/MemCheckBoxInRunDlg +
    +
    + ADMX_StartMenu/NoAutoTrayNotify +
    +
    + ADMX_StartMenu/NoBalloonTip +
    +
    + ADMX_StartMenu/NoChangeStartMenu +
    +
    + ADMX_StartMenu/NoClose +
    +
    + ADMX_StartMenu/NoCommonGroups +
    +
    + ADMX_StartMenu/NoFavoritesMenu +
    +
    + ADMX_StartMenu/NoFind +
    +
    + ADMX_StartMenu/NoGamesFolderOnStartMenu +
    +
    + ADMX_StartMenu/NoHelp +
    +
    + ADMX_StartMenu/NoInstrumentation +
    +
    + ADMX_StartMenu/NoMoreProgramsList +
    +
    + ADMX_StartMenu/NoNetAndDialupConnect +
    +
    + ADMX_StartMenu/NoPinnedPrograms +
    +
    + ADMX_StartMenu/NoRecentDocsMenu +
    +
    + ADMX_StartMenu/NoResolveSearch +
    +
    + ADMX_StartMenu/NoResolveTrack +
    +
    + ADMX_StartMenu/NoRun +
    +
    + ADMX_StartMenu/NoSMConfigurePrograms +
    +
    + ADMX_StartMenu/NoSMMyDocuments +
    +
    + ADMX_StartMenu/NoSMMyMusic +
    +
    + ADMX_StartMenu/NoSMMyNetworkPlaces +
    +
    + ADMX_StartMenu/NoSMMyPictures +
    +
    + ADMX_StartMenu/NoSearchCommInStartMenu +
    +
    + ADMX_StartMenu/NoSearchComputerLinkInStartMenu +
    +
    + ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu +
    +
    + ADMX_StartMenu/NoSearchFilesInStartMenu +
    +
    + ADMX_StartMenu/NoSearchInternetInStartMenu +
    +
    + ADMX_StartMenu/NoSearchProgramsInStartMenu +
    +
    + ADMX_StartMenu/NoSetFolders +
    +
    + ADMX_StartMenu/NoSetTaskbar +
    +
    + ADMX_StartMenu/NoStartMenuDownload +
    +
    + ADMX_StartMenu/NoStartMenuHomegroup +
    +
    + ADMX_StartMenu/NoStartMenuRecordedTV +
    +
    + ADMX_StartMenu/NoStartMenuSubFolders +
    +
    + ADMX_StartMenu/NoStartMenuVideos +
    +
    + ADMX_StartMenu/NoStartPage +
    +
    + ADMX_StartMenu/NoTaskBarClock +
    +
    + ADMX_StartMenu/NoTaskGrouping +
    +
    + ADMX_StartMenu/NoToolbarsOnTaskbar +
    +
    + ADMX_StartMenu/NoTrayContextMenu +
    +
    + ADMX_StartMenu/NoTrayItemsDisplay +
    +
    + ADMX_StartMenu/NoUninstallFromStart +
    +
    + ADMX_StartMenu/NoUserFolderOnStartMenu +
    +
    + ADMX_StartMenu/NoUserNameOnStartMenu +
    +
    + ADMX_StartMenu/NoWindowsUpdate +
    +
    + ADMX_StartMenu/PowerButtonAction +
    +
    + ADMX_StartMenu/QuickLaunchEnabled +
    +
    + ADMX_StartMenu/RemoveUnDockPCButton +
    +
    + ADMX_StartMenu/ShowAppsViewOnStart +
    +
    + ADMX_StartMenu/ShowRunAsDifferentUserInStart +
    +
    + ADMX_StartMenu/ShowRunInStartMenu +
    +
    + ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey +
    +
    + ADMX_StartMenu/StartMenuLogOff +
    +
    + ADMX_StartMenu/StartPinAppsWhenInstalled +
    +
    + + +
    + + +**ADMX_StartMenu/AddSearchInternetLinkInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy, a "Search the Internet" link is shown when the user performs a search in the start menu search box. This button launches the default browser with the search terms. + +If you disable this policy, there will not be a "Search the Internet" link when the user performs a search in the start menu search box. + +If you do not configure this policy (default), there will not be a "Search the Internet" link on the start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add Search Internet link to Start Menu* +- GP name: *AddSearchInternetLinkInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/ClearRecentDocsOnExit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Clear history of recently opened documents on exit. + +If you enable this setting, the system deletes shortcuts to recently used document files when the user logs off. As a result, the Recent Items menu on the Start menu is always empty when the user logs on. In addition, recently and frequently used items in the Jump Lists off of programs in the Start Menu and Taskbar will be cleared when the user logs off. + +If you disable or do not configure this setting, the system retains document shortcuts, and when a user logs on, the Recent Items menu and the Jump Lists appear just as it did when the user logged off. + +> [!NOTE] +> The system saves document shortcuts in the user profile in the System-drive\Users\User-name\Recent folder. + +Also, see the "Remove Recent Items menu from Start Menu" and "Do not keep history of recently opened documents" policies in this folder. The system only uses this setting when neither of these related settings are selected. + +This setting does not clear the list of recent files that Windows programs display at the bottom of the File menu. See the "Do not keep history of recently opened documents" setting. + +This policy setting also does not hide document shortcuts displayed in the Open dialog box. See the "Hide the dropdown list of recent files" setting. + +This policy also does not clear items that the user may have pinned to the Jump Lists, or Tasks that the application has provided for their menu. See the "Do not allow pinning items in Jump Lists" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Clear history of recently opened documents on exit* +- GP name: *ClearRecentDocsOnExit* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy setting, the recent programs list in the start menu will be blank for each new user. + +If you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Clear the recent programs list for new users* +- GP name: *ClearRecentProgForNewUserInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/ClearTilesOnExit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the system deletes tile notifications when the user logs on. As a result, the Tiles in the start view will always show their default content when the user logs on. In addition, any cached versions of these notifications will be cleared when the user logs on. + +If you disable or do not configure this setting, the system retains notifications, and when a user logs on, the tiles appear just as they did when the user logged off, including the history of previous notifications for each tile. + +This setting does not prevent new notifications from appearing. See the "Turn off Application Notifications" setting to prevent new notifications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Clear tile notifications during log on* +- GP name: *ClearTilesOnExit* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/DesktopAppsFirstInAppsView** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows desktop apps to be listed first in the Apps view in Start. + +If you enable this policy setting, desktop apps would be listed first when the apps are sorted by category in the Apps view. The other sorting options would continue to be available and the user could choose to change their default sorting options. + +If you disable or don't configure this policy setting, the desktop apps won't be listed first when the apps are sorted by category, and the user can configure this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List desktop apps first in the Apps view* +- GP name: *DesktopAppsFirstInAppsView* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/DisableGlobalSearchOnAppsView** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the user from searching apps, files, settings (and the web if enabled) when the user searches from the Apps view. + +This policy setting is only applied when the Apps view is set as the default view for Start. + +If you enable this policy setting, searching from the Apps view will only search the list of installed apps. + +If you disable or don’t configure this policy setting, the user can configure this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Search just apps from the Apps view* +- GP name: *DisableGlobalSearchOnAppsView* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/ForceStartMenuLogOff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy only applies to the classic version of the start menu and does not affect the new style start menu. + +Adds the "Log Off ``" item to the Start menu and prevents users from removing it. + +If you enable this setting, the Log Off `` item appears in the Start menu. This setting also removes the Display Logoff item from Start Menu Options. As a result, users cannot remove the Log Off `` item from the Start Menu. + +If you disable this setting or do not configure it, users can use the Display Logoff item to add and remove the Log Off item. + +This setting affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press Ctrl+Alt+Del. + +Note: To add or remove the Log Off item on a computer, click Start, click Settings, click Taskbar and Start Menu, click the Start Menu Options tab, and then, in the Start Menu Settings box, click Display Logoff. + +Also, see "Remove Logoff" in User Configuration\Administrative Templates\System\Logon/Logoff. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add Logoff to the Start Menu* +- GP name: *ForceStartMenuLogOff* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/GoToDesktopOnSignIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to go to the desktop instead of the Start screen when they sign in. + +If you enable this policy setting, users will always go to the desktop when they sign in. + +If you disable this policy setting, users will always go to the Start screen when they sign in. + +If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Go to the desktop instead of Start when signing in* +- GP name: *GoToDesktopOnSignIn* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/GreyMSIAds** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Displays Start menu shortcuts to partially installed programs in gray text. + +This setting makes it easier for users to distinguish between programs that are fully installed and those that are only partially installed. + +Partially installed programs include those that a system administrator assigns using Windows Installer and those that users have configured for full installation upon first use. + +If you disable this setting or do not configure it, all Start menu shortcuts appear as black text. + +> [!NOTE] +> Enabling this setting can make the Start menu slow to open. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Gray unavailable Windows Installer programs Start Menu shortcuts* +- GP name: *GreyMSIAds* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/HidePowerOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from performing the following commands from the Windows security screen, the logon screen, and the Start menu: Shut Down, Restart, Sleep, and Hibernate. This policy setting does not prevent users from running Windows-based programs that perform these functions. + +If you enable this policy setting, the shutdown, restart, sleep, and hibernate commands are removed from the Start menu. The Power button is also removed from the Windows Security screen, which appears when you press CTRL+ALT+DELETE, and from the logon screen. + +If you disable or do not configure this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are available on the Start menu. The Power button on the Windows Security and logon screens is also available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands* +- GP name: *HidePowerOptions* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/Intellimenus** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Disables personalized menus. + +Windows personalizes long menus by moving recently used items to the top of the menu and hiding items that have not been used recently. Users can display the hidden items by clicking an arrow to extend the menu. + +If you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect. + +> [!NOTE] +> Personalized menus require user tracking. If you enable the "Turn off user tracking" setting, the system disables user tracking and personalized menus and ignores this setting. + +To Turn off personalized menus without specifying a setting, click Start, click Settings, click Taskbar and Start Menu, and then, on the General tab, clear the "Use Personalized Menus" option. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off personalized menus* +- GP name: *Intellimenus* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/LockTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the taskbar, which is used to switch between running applications. + +The taskbar includes the Start button, list of currently running tasks, and the notification area. By default, the taskbar is located at the bottom of the screen, but it can be dragged to any side of the screen. When it is locked, it cannot be moved or resized. + +If you enable this setting, it prevents the user from moving or resizing the taskbar. While the taskbar is locked, auto-hide and other taskbar options are still available in Taskbar properties. + +If you disable this setting or do not configure it, the user can configure the taskbar position. + +> [!NOTE] +> Enabling this setting also locks the QuickLaunch bar and any other toolbars that the user has on their taskbar. The toolbar's position is locked, and the user cannot show and hide various toolbars using the taskbar context menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lock the Taskbar* +- GP name: *LockTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/MemCheckBoxInRunDlg** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting lets users run a 16-bit program in a dedicated (not shared) Virtual DOS Machine (VDM) process. + +All DOS and 16-bit programs run on Windows 2000 Professional and Windows XP Professional in the Windows Virtual DOS Machine program. VDM simulates a 16-bit environment, complete with the DLLs required by 16-bit programs. By default, all 16-bit programs run as threads in a single, shared VDM process. As such, they share the memory space allocated to the VDM process and cannot run simultaneously. + +Enabling this setting adds a check box to the Run dialog box, giving users the option of running a 16-bit program in its own dedicated NTVDM process. The additional check box is enabled only when a user enters a 16-bit program in the Run dialog box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add "Run in Separate Memory Space" check box to Run dialog box* +- GP name: *MemCheckBoxInRunDlg* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoAutoTrayNotify** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the notification area, also called the "system tray." + +The notification area is located in the task bar, generally at the bottom of the screen, and it includes the clock and current notifications. This setting determines whether the items are always expanded or always collapsed. By default, notifications are collapsed. The notification cleanup << icon can be referred to as the "notification chevron." + +If you enable this setting, the system notification area expands to show all of the notifications that use this area. + +If you disable this setting, the system notification area will always collapse notifications. + +If you do not configure it, the user can choose if they want notifications collapsed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off notification area cleanup* +- GP name: *NoAutoTrayNotify* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoBalloonTip** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Hides pop-up text on the Start menu and in the notification area. + +When you hold the cursor over an item on the Start menu or in the notification area, the system displays pop-up text providing additional information about the object. + +If you enable this setting, some of this pop-up text is not displayed. The pop-up text affected by this setting includes "Click here to begin" on the Start button, "Where have all my programs gone" on the Start menu, and "Where have my icons gone" in the notification area. + +If you disable this setting or do not configure it, all pop-up text is displayed on the Start menu and in the notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Balloon Tips on Start Menu items* +- GP name: *NoBalloonTip* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoChangeStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from changing their Start screen layout. + +If you enable this setting, you will prevent a user from selecting an app, resizing a tile, pinning/unpinning a tile or a secondary tile, entering the customize mode and rearranging tiles within Start and Apps. + +If you disable or do not configure this setting, you will allow a user to select an app, resize a tile, pin/unpin a tile or a secondary tile, enter the customize mode and rearrange tiles within Start and Apps. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from customizing their Start Screen* +- GP name: *NoChangeStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoClose** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from performing the following commands from the Start menu or Windows Security screen: Shut Down, Restart, Sleep, and Hibernate. This policy setting does not prevent users from running Windows-based programs that perform these functions. + +If you enable this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are removed from the Start menu. The Power button is also removed from the Windows Security screen, which appears when you press CTRL+ALT+DELETE. + +If you disable or do not configure this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are available on the Start menu. The Power button on the Windows Security screen is also available. + +> [!NOTE] +> Third-party programs certified as compatible with Microsoft Windows Vista, Windows XP SP2, Windows XP SP1, Windows XP, or Windows 2000 Professional are required to support this policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands* +- GP name: *NoClose* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoCommonGroups** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes items in the All Users profile from the Programs menu on the Start menu. + +By default, the Programs menu contains items from the All Users profile and items from the user's profile. If you enable this setting, only items in the user's profile appear in the Programs menu. + +To see the Program menu items in the All Users profile, on the system drive, go to ProgramData\Microsoft\Windows\Start Menu\Programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove common program groups from Start Menu* +- GP name: *NoCommonGroups* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoFavoritesMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adding the Favorites menu to the Start menu or classic Start menu. + +If you enable this setting, the Display Favorites item does not appear in the Advanced Start menu options box. + +If you disable or do not configure this setting, the Display Favorite item is available. + +> [!NOTE] +> The Favorities menu does not appear on the Start menu by default. To display the Favorites menu, right-click Start, click Properties, and then click Customize. If you are using Start menu, click the Advanced tab, and then, under Start menu items, click the Favorites menu. If you are using the classic Start menu, click Display Favorites under Advanced Start menu options. +> +> The items that appear in the Favorites menu when you install Windows are preconfigured by the system to appeal to most users. However, users can add and remove items from this menu, and system administrators can create a customized Favorites menu for a user group. +> +> This setting only affects the Start menu. The Favorites item still appears in File Explorer and in Internet Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Favorites menu from Start Menu* +- GP name: *NoFavoritesMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoFind** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Search link from the Start menu, and disables some File Explorer search elements. Note that this does not remove the search box from the new style Start menu. + +If you enable this policy setting, the Search item is removed from the Start menu and from the context menu that appears when you right-click the Start menu. Also, the system does not respond when users press the Application key (the key with the Windows logo)+ F. + +Note: Enabling this policy setting also prevents the user from using the F3 key. + +In File Explorer, the Search item still appears on the Standard buttons toolbar, but the system does not respond when the user presses Ctrl+F. Also, Search does not appear in the context menu when you right-click an icon representing a drive or a folder. + +This policy setting affects the specified user interface elements only. It does not affect Internet Explorer and does not prevent the user from using other methods to search. + +If you disable or do not configure this policy setting, the Search link is available from the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Search link from Start Menu* +- GP name: *NoFind* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoGamesFolderOnStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the start menu will not show a link to the Games folder. + +If you disable or do not configure this policy, the start menu will show a link to the Games folder, unless the user chooses to remove it in the start menu control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Games link from Start Menu* +- GP name: *NoGamesFolderOnStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoHelp** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Help command from the Start menu. + +If you enable this policy setting, the Help command is removed from the Start menu. + +If you disable or do not configure this policy setting, the Help command is available from the Start menu. + +This policy setting only affects the Start menu. It does not remove the Help menu from File Explorer and does not prevent users from running Help. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Help menu from Start Menu* +- GP name: *NoHelp* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoInstrumentation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off user tracking. + +If you enable this policy setting, the system does not track the programs that the user runs, and does not display frequently used programs in the Start Menu. + +If you disable or do not configure this policy setting, the system tracks the programs that the user runs. The system uses this information to customize Windows features, such as showing frequently used programs in the Start Menu. + +Also, see these related policy settings: "Remove frequent programs liist from the Start Menu" and "Turn off personalized menus". + +This policy setting does not prevent users from pinning programs to the Start Menu or Taskbar. See the "Remove pinned programs list from the Start Menu" and "Do not allow pinning programs to the Taskbar" policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off user tracking* +- GP name: *NoInstrumentation* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoMoreProgramsList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the Start Menu will either collapse or remove the all apps list from the Start menu. + +Selecting "Collapse" will not display the app list next to the pinned tiles in Start. An "All apps" button will be displayed on Start to open the all apps list. This is equivalent to setting the "Show app list in Start" in Settings to Off. + +Selecting "Collapse and disable setting" will do the same as the collapse option and disable the "Show app list in Start menu" in Settings, so users cannot turn it to On. + +Selecting "Remove and disable setting" will remove the all apps list from Start and disable the "Show app list in Start menu" in Settings, so users cannot turn it to On. Select this option for compatibility with earlier versions of Windows. + +If you disable or do not configure this setting, the all apps list will be visible by default, and the user can change "Show app list in Start" in Settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove All Programs list from the Start menu* +- GP name: *NoMoreProgramsList* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoNetAndDialupConnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove Network Connections from the Start Menu. + +If you enable this policy setting, users are prevented from running Network Connections. + +Enabling this policy setting prevents the Network Connections folder from opening. This policy setting also removes Network Connections from Settings on the Start menu. + +Network Connections still appears in Control Panel and in File Explorer, but if users try to start it, a message appears explaining that a setting prevents the action. + +If you disable or do not configure this policy setting, Network Connections is available from the Start Menu. + +Also, see the "Disable programs on Settings menu" and "Disable Control Panel" policy settings and the policy settings in the Network Connections folder (Computer Configuration and User Configuration\Administrative Templates\Network\Network Connections). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Network Connections from Start Menu* +- GP name: *NoNetAndDialupConnect* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoPinnedPrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the "Pinned Programs" list is removed from the Start menu. Users cannot pin programs to the Start menu. + +In Windows XP and Windows Vista, the Internet and email checkboxes are removed from the 'Customize Start Menu' dialog. + +If you disable this setting or do not configure it, the "Pinned Programs" list remains on the Start menu. Users can pin and unpin programs in the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove pinned programs list from the Start Menu* +- GP name: *NoPinnedPrograms* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoRecentDocsMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Recent Items menu from the Start menu. Removes the Documents menu from the classic Start menu. + +The Recent Items menu contains links to the non-program files that users have most recently opened. It appears so that users can easily reopen their documents. + +If you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on. + +If you later disable the setting, so that the Recent Items menu appears in the Start Menu, the document shortcuts saved before the setting was enabled and while it was in effect appear in the Recent Items menu. + +When the setting is disabled, the Recent Items menu appears in the Start Menu, and users cannot remove it. + +If the setting is not configured, users can turn the Recent Items menu on and off. + +> [!NOTE] +> This setting does not prevent Windows programs from displaying shortcuts to recently opened documents. See the "Do not keep history of recently opened documents" setting. + +This setting also does not hide document shortcuts displayed in the Open dialog box. See the "Hide the dropdown list of recent files" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Recent Items menu from Start Menu* +- GP name: *NoRecentDocsMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoResolveSearch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the system from conducting a comprehensive search of the target drive to resolve a shortcut. + +If you enable this policy setting, the system does not conduct the final drive search. It just displays a message explaining that the file is not found. + +If you disable or do not configure this policy setting, by default, when the system cannot find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path is not correct, it conducts a comprehensive search of the target drive in an attempt to find the file. + +> [!NOTE] +> This policy setting only applies to target files on NTFS partitions. FAT partitions do not have this ID tracking and search capability. + +Also, see the "Do not track Shell shortcuts during roaming" and the "Do not use the tracking-based method when resolving shell shortcuts" policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not use the search-based method when resolving shell shortcuts* +- GP name: *NoResolveSearch* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoResolveTrack** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the system from using NTFS tracking features to resolve a shortcut. + +If you enable this policy setting, the system does not try to locate the file by using its file ID. It skips this step and begins a comprehensive search of the drive specified in the target path. + +If you disable or do not configure this policy setting, by default, when the system cannot find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path is not correct, it conducts a comprehensive search of the target drive in an attempt to find the file. + +> [!NOTE] +> This policy setting only applies to target files on NTFS partitions. FAT partitions do not have this ID tracking and search capability. + +Also, see the "Do not track Shell shortcuts during roaming" and the "Do not use the search-based method when resolving shell shortcuts" policy settings. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not use the tracking-based method when resolving shell shortcuts* +- GP name: *NoResolveTrack* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoRun** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Allows you to remove the Run command from the Start menu, Internet Explorer, and Task Manager. + +If you enable this setting, the following changes occur: + +1. The Run command is removed from the Start menu. + +2. The New Task (Run) command is removed from Task Manager. + +3. The user will be blocked from entering the following into the Internet Explorer Address Bar: + + - A UNC path: `\\\` + + - Accessing local drives: e.g., C: + + - Accessing local folders: e.g., `\` + +Also, users with extended keyboards will no longer be able to display the Run dialog box by pressing the Application key (the key with the Windows logo) + R. + +If you disable or do not configure this setting, users will be able to access the Run command in the Start menu and in Task Manager and use the Internet Explorer Address Bar. + +> [!NOTE] +> This setting affects the specified interface only. It does not prevent users from using other methods to run programs. +> +> It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Run menu from Start Menu* +- GP name: *NoRun* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSMConfigurePrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Default Programs link from the Start menu. + +If you enable this policy setting, the Default Programs link is removed from the Start menu. + +Clicking the Default Programs link from the Start menu opens the Default Programs control panel and provides administrators the ability to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations. + +If you disable or do not configure this policy setting, the Default Programs link is available from the Start menu. + +> [!NOTE] +> This policy setting does not prevent the Set Default Programs for This Computer option from appearing in the Default Programs control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Default Programs link from the Start menu.* +- GP name: *NoSMConfigurePrograms* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSMMyDocuments** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Documents icon from the Start menu and its submenus. + +If you enable this policy setting, the Documents icon is removed from the Start menu and its submenus. Enabling this policy setting only removes the icon. It does not prevent the user from using other methods to gain access to the contents of the Documents folder. + +> [!NOTE] +> To make changes to this policy setting effective, you must log off and then log on. + +If you disable or do not configure this policy setting, he Documents icon is available from the Start menu. + +Also, see the "Remove Documents icon on the desktop" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Documents icon from Start Menu* +- GP name: *NoSMMyDocuments* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSMMyMusic** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Music icon from Start Menu. + +If you enable this policy setting, the Music icon is no longer available from Start Menu. + +If you disable or do not configure this policy setting, the Music icon is available from Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Music icon from Start Menu* +- GP name: *NoSMMyMusic* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSMMyNetworkPlaces** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build.This policy setting allows you to remove the Network icon from Start Menu. + +If you enable this policy setting, the Network icon is no longer available from Start Menu. + +If you disable or do not configure this policy setting, the Network icon is available from Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Network icon from Start Menu* +- GP name: *NoSMMyNetworkPlaces* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSMMyPictures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Pictures icon from Start Menu. + +If you enable this policy setting, the Pictures icon is no longer available from Start Menu. + +If you disable or do not configure this policy setting, the Pictures icon is available from Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Pictures icon from Start Menu* +- GP name: *NoSMMyPictures* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSearchCommInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the start menu search box will not search for communications. + +If you disable or do not configure this policy, the start menu will search for communications, unless the user chooses not to in the start menu control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not search communications* +- GP name: *NoSearchCommInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSearchComputerLinkInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy, the "See all results" link will not be shown when the user performs a search in the start menu search box. + +If you disable or do not configure this policy, the "See all results" link will be shown when the user performs a search in the start menu search box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Search Computer link* +- GP name: *NoSearchComputerLinkInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. + +If you disable or do not configure this policy, a "See more results" link will be shown when the user performs a search in the start menu search box. If a 3rd party protocol handler is installed, a "Search Everywhere" link will be shown instead of the "See more results" link. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove See More Results / Search Everywhere link* +- GP name: *NoSearchEverywhereLinkInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSearchFilesInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy setting the Start menu search box will not search for files. + +If you disable or do not configure this policy setting, the Start menu will search for files, unless the user chooses not to do so directly in Control Panel. If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not search for files* +- GP name: *NoSearchFilesInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSearchInternetInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the start menu search box will not search for internet history or favorites. + +If you disable or do not configure this policy, the start menu will search for for internet history or favorites, unless the user chooses not to in the start menu control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not search Internet* +- GP name: *NoSearchInternetInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSearchProgramsInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy setting the Start menu search box will not search for programs or Control Panel items. + +If you disable or do not configure this policy setting, the Start menu search box will search for programs and Control Panel items, unless the user chooses not to do so directly in Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not search programs and Control Panel items* +- GP name: *NoSearchProgramsInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSetFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove programs on Settings menu. + +If you enable this policy setting, the Control Panel, Printers, and Network and Connection folders are removed from Settings on the Start menu, and from Computer and File Explorer. It also prevents the programs represented by these folders (such as Control.exe) from running. + +However, users can still start Control Panel items by using other methods, such as right-clicking the desktop to start Display or right-clicking Computer to start System. + +If you disable or do not configure this policy setting, the Control Panel, Printers, and Network and Connection folders from Settings are available on the Start menu, and from Computer and File Explorer. + +Also, see the "Disable Control Panel," "Disable Display in Control Panel," and "Remove Network Connections from Start Menu" policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove programs on Settings menu* +- GP name: *NoSetFolders* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoSetTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent changes to Taskbar and Start Menu Settings. + +If you enable this policy setting, The user will be prevented from opening the Taskbar Properties dialog box. + +If the user right-clicks the taskbar and then clicks Properties, a message appears explaining that a setting prevents the action. + +If you disable or do not configure this policy setting, the Taskbar and Start Menu items are available from Settings on the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent changes to Taskbar and Start Menu Settings* +- GP name: *NoSetTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoStartMenuDownload** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Downloads link from the Start Menu. + +If you enable this policy setting, the Start Menu does not show a link to the Downloads folder. + +If you disable or do not configure this policy setting, the Downloads link is available from the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Downloads link from Start Menu* +- GP name: *NoStartMenuDownload* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoStartMenuHomegroup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the Start menu will not show a link to Homegroup. It also removes the homegroup item from the Start Menu options. As a result, users cannot add the homegroup link to the Start Menu. + +If you disable or do not configure this policy, users can use the Start Menu options to add or remove the homegroup link from the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Homegroup link from Start Menu* +- GP name: *NoStartMenuHomegroup* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoStartMenuRecordedTV** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Recorded TV link from the Start Menu. + +If you enable this policy setting, the Start Menu does not show a link to the Recorded TV library. + +If you disable or do not configure this policy setting, the Recorded TV link is available from the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Recorded TV link from Start Menu* +- GP name: *NoStartMenuRecordedTV* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoStartMenuSubFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Hides all folders on the user-specific (top) section of the Start menu. Other items appear, but folders are hidden. + +This setting is designed for use with redirected folders. Redirected folders appear on the main (bottom) section of the Start menu. However, the original, user-specific version of the folder still appears on the top section of the Start menu. Because the appearance of two folders with the same name might confuse users, you can use this setting to hide user-specific folders. + +Note that this setting hides all user-specific folders, not just those associated with redirected folders. + +If you enable this setting, no folders appear on the top section of the Start menu. If users add folders to the Start Menu directory in their user profiles, the folders appear in the directory but not on the Start menu. + +If you disable this setting or do not configured it, Windows 2000 Professional and Windows XP Professional display folders on both sections of the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove user's folders from the Start Menu* +- GP name: *NoStartMenuSubFolders* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoStartMenuVideos** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Videos link from the Start Menu. + +If you enable this policy setting, the Start Menu does not show a link to the Videos library. + +If you disable or do not configure this policy setting, the Videos link is available from the Start Menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Videos link from Start Menu* +- GP name: *NoStartMenuVideos* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoStartPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the presentation of the Start menu. + +The classic Start menu in Windows 2000 Professional allows users to begin common tasks, while the new Start menu consolidates common items onto one menu. When the classic Start menu is used, the following icons are placed on the desktop: Documents, Pictures, Music, Computer, and Network. The new Start menu starts them directly. + +If you enable this setting, the Start menu displays the classic Start menu in the Windows 2000 style and displays the standard desktop icons. + +If you disable this setting, the Start menu only displays in the new style, meaning the desktop icons are now on the Start page. + +If you do not configure this setting, the default is the new style, and the user can change the view. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force classic Start Menu* +- GP name: *NoStartPage* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoTaskBarClock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents the clock in the system notification area from being displayed. + +If you enable this setting, the clock will not be displayed in the system notification area. + +If you disable or do not configure this setting, the default behavior of the clock appearing in the notification area will occur. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Clock from the system notification area* +- GP name: *NoTaskBarClock* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoTaskGrouping** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the taskbar buttons used to switch between running programs. + +Taskbar grouping consolidates similar applications when there is no room on the taskbar. It kicks in when the user's taskbar is full. + +If you enable this setting, it prevents the taskbar from grouping items that share the same program name. By default, this setting is always enabled. + +If you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent grouping of taskbar items* +- GP name: *NoTaskGrouping* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoToolbarsOnTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the taskbar. + +The taskbar includes the Start button, buttons for currently running tasks, custom toolbars, the notification area, and the system clock. Toolbars include Quick Launch, Address, Links, Desktop, and other custom toolbars created by the user or by an application. + +If this setting is enabled, the taskbar does not display any custom toolbars, and the user cannot add any custom toolbars to the taskbar. Moreover, the "Toolbars" menu command and submenu are removed from the context menu. The taskbar displays only the Start button, taskbar buttons, the notification area, and the system clock. + +If this setting is disabled or is not configured, the taskbar displays all toolbars. Users can add or remove custom toolbars, and the "Toolbars" command appears in the context menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not display any custom toolbars in the taskbar* +- GP name: *NoToolbarsOnTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoTrayContextMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove access to the context menus for the taskbar. + +If you enable this policy setting, the menus that appear when you right-click the taskbar and items on the taskbar are hidden, such as the Start button, the clock, and the taskbar buttons. + +If you disable or do not configure this policy setting, the context menus for the taskbar are available. + +This policy setting does not prevent users from using other methods to issue the commands that appear on these menus. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove access to the context menus for the taskbar* +- GP name: *NoTrayContextMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoTrayItemsDisplay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting affects the notification area (previously called the "system tray") on the taskbar. + +The notification area is located at the far right end of the task bar and includes the icons for current notifications and the system clock. + +If this setting is enabled, the user’s entire notification area, including the notification icons, is hidden. The taskbar displays only the Start button, taskbar buttons, custom toolbars (if any), and the system clock. + +If this setting is disabled or is not configured, the notification area is shown in the user's taskbar. + +> [!NOTE] +> Enabling this setting overrides the "Turn off notification area cleanup" setting, because if the notification area is hidden, there is no need to clean up the icons. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the notification area* +- GP name: *NoTrayItemsDisplay* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoUninstallFromStart** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, users cannot uninstall apps from Start. + +If you disable this setting or do not configure it, users can access the uninstall command from Start. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from uninstalling applications from Start* +- GP name: *NoUninstallFromStart* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoUserFolderOnStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy the start menu will not show a link to the user's storage folder. + +If you disable or do not configure this policy, the start menu will display a link, unless the user chooses to remove it in the start menu control panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove user folder link from Start Menu* +- GP name: *NoUserFolderOnStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoUserNameOnStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the user name label from the Start Menu in Windows XP and Windows Server 2003. + +If you enable this policy setting, the user name label is removed from the Start Menu in Windows XP and Windows Server 2003. + +To remove the user name folder on Windows Vista, set the "Remove user folder link from Start Menu" policy setting. + +If you disable or do not configure this policy setting, the user name label appears on the Start Menu in Windows XP and Windows Server 2003. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove user name from Start Menu* +- GP name: *NoUserNameOnStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/NoWindowsUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove links and access to Windows Update. + +If you enable this policy setting, users are prevented from connecting to the Windows Update Web site. + +Enabling this policy setting blocks user access to the Windows Update Web site at https://windowsupdate.microsoft.com. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. + +Windows Update, the online extension of Windows, offers software updates to keep a user’s system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need and shows the newest versions available for download. + +If you disable or do not configure this policy setting, the Windows Update hyperlink is available from the Start menu and from the Tools menu in Internet Explorer. + +Also, see the "Hide the "Add programs from Microsoft" option" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove links and access to Windows Update* +- GP name: *NoWindowsUpdate* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/PowerButtonAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Set the default action of the power button on the Start menu. + +If you enable this setting, the Start Menu will set the power button to the chosen action, and not let the user change this action. + +If you set the button to either Sleep or Hibernate, and that state is not supported on a computer, then the button will fall back to Shut Down. + +If you disable or do not configure this setting, the Start Menu power button will be set to Shut Down by default, and the user can change this setting to another action. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Change Start Menu power button* +- GP name: *PowerButtonAction* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/QuickLaunchEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the QuickLaunch bar is displayed in the Taskbar. + +If you enable this policy setting, the QuickLaunch bar will be visible and cannot be turned off. + +If you disable this policy setting, the QuickLaunch bar will be hidden and cannot be turned on. + +If you do not configure this policy setting, then users will be able to turn the QuickLaunch bar on and off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show QuickLaunch on Taskbar* +- GP name: *QuickLaunchEnabled* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/RemoveUnDockPCButton** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the "Undock PC" button is removed from the simple Start Menu, and your PC cannot be undocked. + +If you disable this setting or do not configure it, the "Undock PC" button remains on the simple Start menu, and your PC can be undocked. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the "Undock PC" button from the Start Menu* +- GP name: *RemoveUnDockPCButton* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/ShowAppsViewOnStart** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the Apps view to be opened by default when the user goes to Start. + +If you enable this policy setting, the Apps view will appear whenever the user goes to Start. Users will still be able to switch between the Apps view and the Start screen. + +If you disable or don’t configure this policy setting, the Start screen will appear by default whenever the user goes to Start, and the user will be able to switch between the Apps view and the Start screen. Also, the user will be able to configure this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show the Apps view automatically when the user goes to Start* +- GP name: *ShowAppsViewOnStart* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/ShowRunAsDifferentUserInStart** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting shows or hides the "Run as different user" command on the Start application bar. + +If you enable this setting, users can access the "Run as different user" command from Start for applications which support this functionality. + +If you disable this setting or do not configure it, users cannot access the "Run as different user" command from Start for any applications. + +> [!NOTE] +> This setting does not prevent users from using other methods, such as the shift right-click menu on application's jumplists in the taskbar to issue the "Run as different user" command. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show "Run as different user" command on Start* +- GP name: *ShowRunAsDifferentUserInStart* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/ShowRunInStartMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this setting, the Run command is added to the Start menu. + +If you disable or do not configure this setting, the Run command is not visible on the Start menu by default, but it can be added from the Taskbar and Start menu properties. + +If the Remove Run link from Start Menu policy is set, the Add the Run command to the Start menu policy has no effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add the Run command to the Start Menu* +- GP name: *ShowRunInStartMenu* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the Start screen to appear on the display the user is using when they press the Windows logo key. This setting only applies to users who are using multiple displays. + +If you enable this policy setting, the Start screen will appear on the display the user is using when they press the Windows logo key. + +If you disable or don't configure this policy setting, the Start screen will always appear on the main display when the user presses the Windows logo key. Users will still be able to open Start on other displays by pressing the Start button on that display. Also, the user will be able to configure this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show Start on the display the user is using when they press the Windows logo key* +- GP name: *ShowStartOnDisplayWithForegroundOnWinKey* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/StartMenuLogOff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to removes the "Log Off ``" item from the Start menu and prevents users from restoring it. + +If you enable this policy setting, the Log Off `` item does not appear in the Start menu. This policy setting also removes the Display Logoff item from Start Menu Options. As a result, users cannot restore the Log Off `` item to the Start Menu. + +If you disable or do not configure this policy setting, users can use the Display Logoff item to add and remove the Log Off item. + +This policy setting affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press Ctrl+Alt+Del, and it does not prevent users from using other methods to log off. + +Tip: To add or remove the Log Off item on a computer, click Start, click Settings, click Taskbar and Start Menu, click the Start Menu Options tab and, in the Start Menu Settings box, click Display Logoff. + +See also: "Remove Logoff" policy setting in User Configuration\Administrative Templates\System\Logon/Logoff. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Logoff on the Start Menu* +- GP name: *StartMenuLogOff* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + + +**ADMX_StartMenu/StartPinAppsWhenInstalled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows pinning apps to Start by default, when they are included by AppID on the list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Pin Apps to Start when installed* +- GP name: *StartPinAppsWhenInstalled* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-systemrestore.md b/windows/client-management/mdm/policy-csp-admx-systemrestore.md new file mode 100644 index 0000000000..70b84425c0 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-systemrestore.md @@ -0,0 +1,121 @@ +--- +title: Policy CSP - ADMX_SystemRestore +description: Policy CSP - ADMX_SystemRestore +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SystemRestore +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_SystemRestore policies + +
    +
    + ADMX_SystemRestore/SR_DisableConfig +
    +
    + + +
    + + +**ADMX_SystemRestore/SR_DisableConfig** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Allows you to disable System Restore configuration through System Protection. + +This policy setting allows you to turn off System Restore configuration through System Protection. + +System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. The behavior of this policy setting depends on the "Turn off System Restore" policy setting. + +If you enable this policy setting, the option to configure System Restore through System Protection is disabled. + +If you disable or do not configure this policy setting, users can change the System Restore settings through System Protection. + +Also, see the "Turn off System Restore" policy setting. If the "Turn off System Restore" policy setting is enabled, the "Turn off System Restore configuration" policy setting is overwritten. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Configuration* +- GP name: *SR_DisableConfig* +- GP path: *System\System Restore* +- GP ADMX file name: *SystemRestore.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md new file mode 100644 index 0000000000..bff61dc5f1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -0,0 +1,1664 @@ +--- +title: Policy CSP - ADMX_Taskbar +description: Policy CSP - ADMX_Taskbar +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Taskbar +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Taskbar policies + +
    +
    + ADMX_Taskbar/DisableNotificationCenter +
    +
    + ADMX_Taskbar/EnableLegacyBalloonNotifications +
    +
    + ADMX_Taskbar/HideSCAHealth +
    +
    + ADMX_Taskbar/HideSCANetwork +
    +
    + ADMX_Taskbar/HideSCAPower +
    +
    + ADMX_Taskbar/HideSCAVolume +
    +
    + ADMX_Taskbar/NoBalloonFeatureAdvertisements +
    +
    + ADMX_Taskbar/NoPinningStoreToTaskbar +
    +
    + ADMX_Taskbar/NoPinningToDestinations +
    +
    + ADMX_Taskbar/NoPinningToTaskbar +
    +
    + ADMX_Taskbar/NoRemoteDestinations +
    +
    + ADMX_Taskbar/NoSystraySystemPromotion +
    +
    + ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar +
    +
    + ADMX_Taskbar/TaskbarLockAll +
    +
    + ADMX_Taskbar/TaskbarNoAddRemoveToolbar +
    +
    + ADMX_Taskbar/TaskbarNoDragToolbar +
    +
    + ADMX_Taskbar/TaskbarNoMultimon +
    +
    + ADMX_Taskbar/TaskbarNoNotification +
    +
    + ADMX_Taskbar/TaskbarNoPinnedList +
    +
    + ADMX_Taskbar/TaskbarNoRedock +
    +
    + ADMX_Taskbar/TaskbarNoResize +
    +
    + ADMX_Taskbar/TaskbarNoThumbnail +
    +
    + + +
    + + +**ADMX_Taskbar/DisableNotificationCenter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes Notifications and Action Center from the notification area on the taskbar. + +The notification area is located at the far right end of the taskbar and includes icons for current notifications and the system clock. + +If this setting is enabled, Notifications and Action Center is not displayed in the notification area. The user will be able to read notifications when they appear, but they won’t be able to review any notifications they miss. + +If you disable or do not configure this policy setting, Notification and Security and Maintenance will be displayed on the taskbar. + +A reboot is required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Notifications and Action Center* +- GP name: *DisableNotificationCenter* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/EnableLegacyBalloonNotifications** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy disables the functionality that converts balloons to toast notifications. + +If you enable this policy setting, system and application notifications will render as balloons instead of toast notifications. + +Enable this policy setting if a specific app or system component that uses balloon notifications has compatibility issues with toast notifications. + +If you disable or don’t configure this policy setting, all notifications will appear as toast notifications. + +A reboot is required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable showing balloon notifications as toasts.* +- GP name: *EnableLegacyBalloonNotifications* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/HideSCAHealth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove Security and Maintenance from the system control area. + +If you enable this policy setting, the Security and Maintenance icon is not displayed in the system notification area. + +If you disable or do not configure this policy setting, the Security and Maintenance icon is displayed in the system notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the Security and Maintenance icon* +- GP name: *HideSCAHealth* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/HideSCANetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the networking icon from the system control area. + +If you enable this policy setting, the networking icon is not displayed in the system notification area. + +If you disable or do not configure this policy setting, the networking icon is displayed in the system notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the networking icon* +- GP name: *HideSCANetwork* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/HideSCAPower** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the battery meter from the system control area. + +If you enable this policy setting, the battery meter is not displayed in the system notification area. + +If you disable or do not configure this policy setting, the battery meter is displayed in the system notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the battery meter* +- GP name: *HideSCAPower* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/HideSCAVolume** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the volume control icon from the system control area. + +If you enable this policy setting, the volume control icon is not displayed in the system notification area. + +If you disable or do not configure this policy setting, the volume control icon is displayed in the system notification area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the volume control icon* +- GP name: *HideSCAVolume* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/NoBalloonFeatureAdvertisements** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off feature advertisement balloon notifications. + +If you enable this policy setting, certain notification balloons that are marked as feature advertisements are not shown. + +If you disable do not configure this policy setting, feature advertisement balloons are shown. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off feature advertisement balloon notifications* +- GP name: *NoBalloonFeatureAdvertisements* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/NoPinningStoreToTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control pinning the Store app to the Taskbar. + +If you enable this policy setting, users cannot pin the Store app to the Taskbar. If the Store app is already pinned to the Taskbar, it will be removed from the Taskbar on next login. + +If you disable or do not configure this policy setting, users can pin the Store app to the Taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow pinning Store app to the Taskbar* +- GP name: *NoPinningStoreToTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/NoPinningToDestinations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control pinning items in Jump Lists. + +If you enable this policy setting, users cannot pin files, folders, websites, or other items to their Jump Lists in the Start Menu and Taskbar. Users also cannot unpin existing items pinned to their Jump Lists. Existing items already pinned to their Jump Lists will continue to show. + +If you disable or do not configure this policy setting, users can pin files, folders, websites, and other items to a program's Jump List so that the items is always present in this menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow pinning items in Jump Lists* +- GP name: *NoPinningToDestinations* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + + +**ADMX_Taskbar/NoPinningToTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control pinning programs to the Taskbar. + +If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar. + +If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow pinning programs to the Taskbar* +- GP name: *NoPinningToTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/NoRemoteDestinations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control displaying or tracking items in Jump Lists from remote locations. + +The Start Menu and Taskbar display Jump Lists off of programs. These menus include files, folders, websites and other relevant items for that program. This helps users more easily reopen their most important documents and other tasks. + +If you enable this policy setting, the Start Menu and Taskbar only track the files that the user opens locally on this computer. Files that the user opens over the network from remote computers are not tracked or shown in the Jump Lists. Use this setting to reduce network traffic, particularly over slow network connections. + +If you disable or do not configure this policy setting, all files that the user opens appear in the menus, including files located remotely on another computer. Note: This setting does not prevent Windows from displaying remote files that the user has explicitly pinned to the Jump Lists. See the "Do not allow pinning items in Jump Lists" policy setting. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not display or track items in Jump Lists from remote locations* +- GP name: *NoRemoteDestinations* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/NoSystraySystemPromotion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off automatic promotion of notification icons to the taskbar. + +If you enable this policy setting, newly added notification icons are not temporarily promoted to the Taskbar. Users can still configure icons to be shown or hidden in the Notification Control Panel. + +If you disable or do not configure this policy setting, newly added notification icons are temporarily promoted to the Taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off automatic promotion of notification icons to the taskbar* +- GP name: *NoSystraySystemPromotion* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to see Windows Store apps on the taskbar. + +If you enable this policy setting, users will see Windows Store apps on the taskbar. + +If you disable this policy setting, users won’t see Windows Store apps on the taskbar. + +If you don’t configure this policy setting, the default setting for the user’s device will be used, and the user can choose to change it. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show Windows Store apps on the taskbar* +- GP name: *ShowWindowsStoreAppsOnTaskbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarLockAll** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to lock all taskbar settings. + +If you enable this policy setting, the user cannot access the taskbar control panel. The user is also unable to resize, move or rearrange toolbars on their taskbar. + +If you disable or do not configure this policy setting, the user will be able to set any taskbar setting that is not prevented by another policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lock all taskbar settings* +- GP name: *TaskbarLockAll* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarNoAddRemoveToolbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from adding or removing toolbars. + +If you enable this policy setting, the user is not allowed to add or remove any toolbars to the taskbar. Applications are not able to add toolbars either. + +If you disable or do not configure this policy setting, the users and applications are able to add toolbars to the taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from adding or removing toolbars* +- GP name: *TaskbarNoAddRemoveToolbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarNoDragToolbar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from rearranging toolbars. + +If you enable this policy setting, users are not able to drag or drop toolbars to the taskbar. + +If you disable or do not configure this policy setting, users are able to rearrange the toolbars on the taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from rearranging toolbars* +- GP name: *TaskbarNoDragToolbar* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarNoMultimon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent taskbars from being displayed on more than one monitor. + +If you enable this policy setting, users are not able to show taskbars on more than one display. The multiple display section is not enabled in the taskbar properties dialog. + +If you disable or do not configure this policy setting, users can show taskbars on more than one display. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow taskbars on more than one display* +- GP name: *TaskbarNoMultimon* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarNoNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off all notification balloons. + +If you enable this policy setting, no notification balloons are shown to the user. + +If you disable or do not configure this policy setting, notification balloons are shown to the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off all balloon notifications* +- GP name: *TaskbarNoNotification* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarNoPinnedList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove pinned programs from the taskbar. + +If you enable this policy setting, pinned programs are prevented from being shown on the Taskbar. Users cannot pin programs to the Taskbar. + +If you disable or do not configure this policy setting, users can pin programs so that the program shortcuts stay on the Taskbar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove pinned programs from the Taskbar* +- GP name: *TaskbarNoPinnedList* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarNoRedock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from moving taskbar to another screen dock location. + +If you enable this policy setting, users are not able to drag their taskbar to another area of the monitor(s). + +If you disable or do not configure this policy setting, users are able to drag their taskbar to another area of the monitor unless prevented by another policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from moving taskbar to another screen dock location* +- GP name: *TaskbarNoRedock* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarNoResize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from resizing the taskbar. + +If you enable this policy setting, users are not be able to resize their taskbar. + +If you disable or do not configure this policy setting, users are able to resize their taskbar unless prevented by another setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from resizing the taskbar* +- GP name: *TaskbarNoResize* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +
    + + +**ADMX_Taskbar/TaskbarNoThumbnail** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off taskbar thumbnails. + +If you enable this policy setting, the taskbar thumbnails are not displayed and the system uses standard text for the tooltips. + +If you disable or do not configure this policy setting, the taskbar thumbnails are displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off taskbar thumbnails* +- GP name: *TaskbarNoThumbnail* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *Taskbar.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md new file mode 100644 index 0000000000..3cd6999994 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -0,0 +1,1012 @@ +--- +title: Policy CSP - ADMX_tcpip +description: Policy CSP - ADMX_tcpip +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_tcpip +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_tcpip policies + +
    +
    + ADMX_tcpip/6to4_Router_Name +
    +
    + ADMX_tcpip/6to4_Router_Name_Resolution_Interval +
    +
    + ADMX_tcpip/6to4_State +
    +
    + ADMX_tcpip/IPHTTPS_ClientState +
    +
    + ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State +
    +
    + ADMX_tcpip/ISATAP_Router_Name +
    +
    + ADMX_tcpip/ISATAP_State +
    +
    + ADMX_tcpip/Teredo_Client_Port +
    +
    + ADMX_tcpip/Teredo_Default_Qualified +
    +
    + ADMX_tcpip/Teredo_Refresh_Rate +
    +
    + ADMX_tcpip/Teredo_Server_Name +
    +
    + ADMX_tcpip/Teredo_State +
    +
    + ADMX_tcpip/Windows_Scaling_Heuristics_State +
    +
    + + +
    + + +**ADMX_tcpip/6to4_Router_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify a 6to4 relay name for a 6to4 host. A 6to4 relay is used as a default gateway for IPv6 network traffic sent by the 6to4 host. The 6to4 relay name setting has no effect if 6to4 connectivity is not available on the host. + +If you enable this policy setting, you can specify a relay name for a 6to4 host. + +If you disable or do not configure this policy setting, the local host setting is used, and you cannot specify a relay name for a 6to4 host. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set 6to4 Relay Name* +- GP name: *6to4_Router_Name* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/6to4_Router_Name_Resolution_Interval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the interval at which the relay name is resolved. The 6to4 relay name resolution interval setting has no effect if 6to4 connectivity is not available on the host. + +If you enable this policy setting, you can specify the value for the duration at which the relay name is resolved periodically. + +If you disable or do not configure this policy setting, the local host setting is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set 6to4 Relay Name Resolution Interval* +- GP name: *6to4_Router_Name_Resolution_Interval* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/6to4_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure 6to4, an address assignment and router-to-router automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 sites and hosts across the IPv4 Internet. 6to4 uses the global address prefix: 2002:WWXX:YYZZ::/48 in which the letters are a hexadecimal representation of the global IPv4 address (w.x.y.z) assigned to a site. + +If you disable or do not configure this policy setting, the local host setting is used. + +If you enable this policy setting, you can configure 6to4 with one of the following settings: + +Policy Default State: 6to4 is turned off and connectivity with 6to4 will not be available. + +Policy Enabled State: If a global IPv4 address is present, the host will have a 6to4 interface. If no global IPv4 address is present, the host will not have a 6to4 interface. + +Policy Disabled State: 6to4 is turned off and connectivity with 6to4 will not be available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set 6to4 State* +- GP name: *6to4_State* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/IPHTTPS_ClientState** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure IP-HTTPS, a tunneling technology that uses the HTTPS protocol to provide IP connectivity to a remote network. + +If you disable or do not configure this policy setting, the local host settings are used. + +If you enable this policy setting, you can specify an IP-HTTPS server URL. You will be able to configure IP-HTTPS with one of the following settings: + +Policy Default State: The IP-HTTPS interface is used when there are no other connectivity options. + +Policy Enabled State: The IP-HTTPS interface is always present, even if the host has other connectivity options. + +Policy Disabled State: No IP-HTTPS interfaces are present on the host. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set IP-HTTPS State* +- GP name: *IPHTTPS_ClientState* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure IP Stateless Autoconfiguration Limits. + +If you enable or do not configure this policy setting, IP Stateless Autoconfiguration Limits will be enabled and system will limit the number of autoconfigured addresses and routes. + +If you disable this policy setting, IP Stateless Autoconfiguration Limits will be disabled and system will not limit the number of autoconfigured addresses and routes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set IP Stateless Autoconfiguration Limits State* +- GP name: *IP_Stateless_Autoconfiguration_Limits_State* +- GP path: *Network\TCPIP Settings\Parameters* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/ISATAP_Router_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify a router name or Internet Protocol version 4 (IPv4) address for an ISATAP router. + +If you enable this policy setting, you can specify a router name or IPv4 address for an ISATAP router. If you enter an IPv4 address of the ISATAP router in the text box, DNS services are not required. + +If you disable or do not configure this policy setting, the local host setting is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set ISATAP Router Name* +- GP name: *ISATAP_Router_Name* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/ISATAP_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), an address-to-router and host-to-host, host-to-router and router-to-host automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 hosts across an IPv4 intranet. + +If you disable or do not configure this policy setting, the local host setting is used. + +If you enable this policy setting, you can configure ISATAP with one of the following settings: + +Policy Default State: No ISATAP interfaces are present on the host. + +Policy Enabled State: If the ISATAP name is resolved successfully, the host will have ISATAP configured with a link-local address and an address for each prefix received from the ISATAP router through stateless address auto-configuration. If the ISATAP name is not resolved successfully, the host will have an ISATAP interface configured with a link-local address. + +Policy Disabled State: No ISATAP interfaces are present on the host. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set ISATAP State* +- GP name: *ISATAP_State* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/Teredo_Client_Port** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to select the UDP port the Teredo client will use to send packets. If you leave the default of 0, the operating system will select a port (recommended). If you select a UDP port that is already in use by a system, the Teredo client will fail to initialize. + +If you enable this policy setting, you can customize a UDP port for the Teredo client. + +If you disable or do not configure this policy setting, the local host setting is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo Client Port* +- GP name: *Teredo_Client_Port* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/Teredo_Default_Qualified** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state. + +If you disable or do not configure this policy setting, the local host setting is used. + +This policy setting contains only one state: + +Policy Enabled State: If Default Qualified is enabled, Teredo will attempt qualification immediately and remain qualified if the qualification process succeeds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo Default Qualified* +- GP name: *Teredo_Default_Qualified* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/Teredo_Refresh_Rate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the Teredo refresh rate. + +> [!NOTE] +> On a periodic basis (by default, every 30 seconds), Teredo clients send a single Router Solicitation packet to the Teredo server. The Teredo server sends a Router Advertisement Packet in response. This periodic packet refreshes the IP address and UDP port mapping in the translation table of the Teredo client's NAT device. + +If you enable this policy setting, you can specify the refresh rate. If you choose a refresh rate longer than the port mapping in the Teredo client's NAT device, Teredo might stop working or connectivity might be intermittent. + +If you disable or do not configure this policy setting, the refresh rate is configured using the local settings on the computer. The default refresh rate is 30 seconds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo Refresh Rate* +- GP name: *Teredo_Refresh_Rate* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/Teredo_Server_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the name of the Teredo server. This server name will be used on the Teredo client computer where this policy setting is applied. + +If you enable this policy setting, you can specify a Teredo server name that applies to a Teredo client. + +If you disable or do not configure this policy setting, the local settings on the computer are used to determine the Teredo server name. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo Server Name* +- GP name: *Teredo_Server_Name* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/Teredo_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Teredo, an address assignment and automatic tunneling technology that provides unicast IPv6 connectivity across the IPv4 Internet. + +If you disable or do not configure this policy setting, the local host settings are used. + +If you enable this policy setting, you can configure Teredo with one of the following settings: + +Default: The default state is "Client." + +Disabled: No Teredo interfaces are present on the host. + +Client: The Teredo interface is present only when the host is not on a network that includes a domain controller. + +Enterprise Client: The Teredo interface is always present, even if the host is on a network that includes a domain controller. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Teredo State* +- GP name: *Teredo_State* +- GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* +- GP ADMX file name: *tcpip.admx* + + + +
    + + +**ADMX_tcpip/Windows_Scaling_Heuristics_State** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Window Scaling Heuristics. Window Scaling Heuristics is an algorithm to identify connectivity and throughput problems caused by many Firewalls and other middle boxes that don't interpret Window Scaling option correctly. + +If you do not configure this policy setting, the local host settings are used. + +If you enable this policy setting, Window Scaling Heuristics will be enabled and system will try to identify connectivity and throughput problems and take appropriate measures. + +If you disable this policy setting, Window Scaling Heuristics will be disabled and system will not try to identify connectivity and throughput problems caused by Firewalls or other middle boxes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Window Scaling Heuristics State* +- GP name: *Windows_Scaling_Heuristics_State* +- GP path: *Network\TCPIP Settings\Parameters* +- GP ADMX file name: *tcpip.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-thumbnails.md b/windows/client-management/mdm/policy-csp-admx-thumbnails.md new file mode 100644 index 0000000000..73f6ca56cd --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-thumbnails.md @@ -0,0 +1,265 @@ +--- +title: Policy CSP - ADMX_Thumbnails +description: Policy CSP - ADMX_Thumbnails +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/25/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Thumbnails +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Thumbnails policies + +
    +
    + ADMX_Thumbnails/DisableThumbnails +
    +
    + ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders +
    +
    + ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders +
    +
    + +
    + + +**ADMX_Thumbnails/DisableThumbnails** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure how File Explorer displays thumbnail images or icons on the local computer. + +File Explorer displays thumbnail images by default. + +If you enable this policy setting, File Explorer displays only icons and never displays thumbnail images. + +If you disable or do not configure this policy setting, File Explorer displays only thumbnail images. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the display of thumbnails and only display icons.* +- GP name: *DisableThumbnails* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Thumbnails.admx* + + + +
    + + +**ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure how File Explorer displays thumbnail images or icons on network folders. + +File Explorer displays thumbnail images on network folders by default. + +If you enable this policy setting, File Explorer displays only icons and never displays thumbnail images on network folders. + +If you disable or do not configure this policy setting, File Explorer displays only thumbnail images on network folders. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the display of thumbnails and only display icons on network folders* +- GP name: *DisableThumbnailsOnNetworkFolders* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Thumbnails.admx* + + + +
    + + +**ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Turns off the caching of thumbnails in hidden thumbs.db files. + +This policy setting allows you to configure File Explorer to cache thumbnails of items residing in network folders in hidden thumbs.db files. + +If you enable this policy setting, File Explorer does not create, read from, or write to thumbs.db files. + +If you disable or do not configure this policy setting, File Explorer creates, reads from, and writes to thumbs.db files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the caching of thumbnails in hidden thumbs.db files* +- GP name: *DisableThumbsDBOnNetworkFolders* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Thumbnails.admx* + + + +
    + + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md new file mode 100644 index 0000000000..d12a0686f7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -0,0 +1,804 @@ +--- +title: Policy CSP - ADMX_TPM +description: Policy CSP - ADMX_TPM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/25/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_TPM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_TPM policies + +
    +
    + ADMX_TPM/BlockedCommandsList_Name +
    +
    + ADMX_TPM/ClearTPMIfNotReady_Name +
    +
    + ADMX_TPM/IgnoreDefaultList_Name +
    +
    + ADMX_TPM/IgnoreLocalList_Name +
    +
    + ADMX_TPM/OSManagedAuth_Name +
    +
    + ADMX_TPM/OptIntoDSHA_Name +
    +
    + ADMX_TPM/StandardUserAuthorizationFailureDuration_Name +
    +
    + ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name +
    +
    + ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name +
    +
    + ADMX_TPM/UseLegacyDAP_Name +
    +
    + + +
    + + +**ADMX_TPM/BlockedCommandsList_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands blocked by Windows. + +If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is TPM_OwnerReadInternalPub, and command number 170 is TPM_FieldUpgrade. To find the command number associated with each TPM command with TPM 1.2, run "tpm.msc" and navigate to the "Command Management" section. + +If you disable or do not configure this policy setting, only those TPM commands specified through the default or local lists may be blocked by Windows. The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See related policy settings to enforce or ignore the default and local lists of blocked TPM commands. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the list of blocked TPM commands* +- GP name: *BlockedCommandsList_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/ClearTPMIfNotReady_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the system to prompt the user to clear the TPM if the TPM is detected to be in any state other than Ready. This policy will take effect only if the system’s TPM is in a state other than Ready, including if the TPM is “Ready, with reduced functionality”. The prompt to clear the TPM will start occurring after the next reboot, upon user login only if the logged in user is part of the Administrators group for the system. The prompt can be dismissed, but will reappear after every reboot and login until the policy is disabled or until the TPM is in a Ready state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the system to clear the TPM if it is not in a ready state.* +- GP name: *ClearTPMIfNotReady_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/IgnoreDefaultList_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands. + +If you enable this policy setting, Windows will ignore the computer's default list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the local list. + +The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See the related policy setting to configure the Group Policy list of blocked TPM commands. + +If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to commands in the Group Policy and local lists of blocked TPM commands. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore the default list of blocked TPM commands* +- GP name: *IgnoreDefaultList_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/IgnoreLocalList_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands. + +If you enable this policy setting, Windows will ignore the computer's local list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the default list. + +The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. The default list of blocked TPM commands is pre-configured by Windows. See the related policy setting to configure the Group Policy list of blocked TPM commands. + +If you disable or do not configure this policy setting, Windows will block the TPM commands found in the local list, in addition to commands in the Group Policy and default lists of blocked TPM commands. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore the local list of blocked TPM commands* +- GP name: *IgnoreLocalList_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/OSManagedAuth_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures how much of the TPM owner authorization information is stored in the registry of the local computer. Depending on the amount of TPM owner authorization information stored locally, the operating system and TPM-based applications can perform certain TPM actions which require TPM owner authorization without requiring the user to enter the TPM owner password. + +You can choose to have the operating system store either the full TPM owner authorization value, the TPM administrative delegation blob plus the TPM user delegation blob, or none. + +If you enable this policy setting, Windows will store the TPM owner authorization in the registry of the local computer according to the operating system managed TPM authentication setting you choose. + +Choose the operating system managed TPM authentication setting of "Full" to store the full TPM owner authorization, the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting allows use of the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios which do not depend on preventing reset of the TPM anti-hammering logic or changing the TPM owner authorization value. Some TPM-based applications may require this setting be changed before features which depend on the TPM anti-hammering logic can be used. + +Choose the operating system managed TPM authentication setting of "Delegated" to store only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM anti-hammering logic. + +Choose the operating system managed TPM authentication setting of "None" for compatibility with previous operating systems and applications or for use with scenarios that require TPM owner authorization not be stored locally. Using this setting might cause issues with some TPM-based applications. + +> [!NOTE] +> If the operating system managed TPM authentication setting is changed from "Full" to "Delegated", the full TPM owner authorization value will be regenerated and any copies of the original TPM owner authorization value will be invalid. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the level of TPM owner authorization information available to the operating system* +- GP name: *OSManagedAuth_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/OptIntoDSHA_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This group policy enables Device Health Attestation reporting (DHA-report) on supported devices. It enables supported devices to send Device Health Attestation related information (device boot logs, PCR values, TPM certificate, etc.) to Device Health Attestation Service (DHA-Service) every time a device starts. Device Health Attestation Service validates the security state and health of the devices, and makes the findings accessible to enterprise administrators via a cloud based reporting portal. This policy is independent of DHA reports that are initiated by device manageability solutions (like MDM or SCCM), and will not interfere with their workflows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Device Health Attestation Monitoring and Reporting* +- GP name: *OptIntoDSHA_Name* +- GP path: *System\Device Health Attestation Service* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/StandardUserAuthorizationFailureDuration_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the duration in minutes for counting standard user authorization failures for Trusted Platform Module (TPM) commands requiring authorization. If the number of TPM commands with an authorization failure within the duration equals a threshold, a standard user is prevented from sending commands requiring authorization to the TPM. + +This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. + +An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than this duration are ignored. + +For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. + +The Standard User Lockout Threshold Individual value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. + +The Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. + +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. + +An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately. + +If this value is not configured, a default value of 480 minutes (8 hours) is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Standard User Lockout Duration* +- GP name: *StandardUserAuthorizationFailureDuration_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the maximum number of authorization failures for each standard user for the Trusted Platform Module (TPM). If the number of authorization failures for the user within the duration for Standard User Lockout Duration equals this value, the standard user is prevented from sending commands to the Trusted Platform Module (TPM) that require authorization. + +This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. + +An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. + +For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. + +This value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. + +The Standard User Lockout Total Threshold value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. + +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. + +An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately. + +If this value is not configured, a default value of 4 is used. + +A value of zero means the OS will not allow standard users to send commands to the TPM which may cause an authorization failure. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Standard User Individual Lockout Threshold* +- GP name: *StandardUserAuthorizationFailureIndividualThreshold_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the maximum number of authorization failures for all standard users for the Trusted Platform Module (TPM). If the total number of authorization failures for all standard users within the duration for Standard User Lockout Duration equals this value, all standard users are prevented from sending commands to the Trusted Platform Module (TPM) that require authorization. + +This setting helps administrators prevent the TPM hardware from entering a lockout mode because it slows the speed standard users can send commands requiring authorization to the TPM. + +An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored. + +For each standard user two thresholds apply. Exceeding either threshold will prevent the standard user from sending a command to the TPM that requires authorization. + +The Standard User Individual Lockout value is the maximum number of authorization failures each standard user may have before the user is not allowed to send commands requiring authorization to the TPM. + +This value is the maximum total number of authorization failures all standard users may have before all standard users are not allowed to send commands requiring authorization to the TPM. + +The TPM is designed to protect itself against password guessing attacks by entering a hardware lockout mode when it receives too many commands with an incorrect authorization value. When the TPM enters a lockout mode it is global for all users including administrators and Windows features like BitLocker Drive Encryption. The number of authorization failures a TPM allows and how long it stays locked out vary by TPM manufacturer. Some TPMs may enter lockout mode for successively longer periods of time with fewer authorization failures depending on past failures. Some TPMs may require a system restart to exit the lockout mode. Other TPMs may require the system to be on so enough clock cycles elapse before the TPM exits the lockout mode. + +An administrator with the TPM owner password may fully reset the TPM's hardware lockout logic using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic all prior standard user TPM authorization failures are ignored; allowing standard users to use the TPM normally again immediately. + +If this value is not configured, a default value of 9 is used. + +A value of zero means the OS will not allow standard users to send commands to the TPM which may cause an authorization failure. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Standard User Total Lockout Threshold* +- GP name: *StandardUserAuthorizationFailureTotalThreshold_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + + +**ADMX_TPM/UseLegacyDAP_Name** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below. Setting this policy will take effect only if a) the TPM was originally prepared using a version of Windows after Windows 10 Version 1607 and b) the System has a TPM 2.0. Note that enabling this policy will only take effect after the TPM maintenance task runs (which typically happens after a system restart). Once this policy has been enabled on a system and has taken effect (after a system restart), disabling it will have no impact and the system's TPM will remain configured using the legacy Dictionary Attack Prevention parameters, regardless of the value of this group policy. The only way for the disabled setting of this policy to take effect on a system where it was once enabled is to a) disable it from group policy and b)clear the TPM on the system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.* +- GP name: *UseLegacyDAP_Name* +- GP path: *System\Trusted Platform Module Services* +- GP ADMX file name: *TPM.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md new file mode 100644 index 0000000000..7f23f18d6f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -0,0 +1,9477 @@ +--- +title: Policy CSP - ADMX_UserExperienceVirtualization +description: Policy CSP - ADMX_UserExperienceVirtualization +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/30/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_UserExperienceVirtualization +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_UserExperienceVirtualization policies + +
    +
    + ADMX_UserExperienceVirtualization/Calculator +
    +
    + ADMX_UserExperienceVirtualization/ConfigureSyncMethod +
    +
    + ADMX_UserExperienceVirtualization/ConfigureVdi +
    +
    + ADMX_UserExperienceVirtualization/ContactITDescription +
    +
    + ADMX_UserExperienceVirtualization/ContactITUrl +
    +
    + ADMX_UserExperienceVirtualization/DisableWin8Sync +
    +
    + ADMX_UserExperienceVirtualization/DisableWindowsOSSettings +
    +
    + ADMX_UserExperienceVirtualization/EnableUEV +
    +
    + ADMX_UserExperienceVirtualization/Finance +
    +
    + ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled +
    +
    + ADMX_UserExperienceVirtualization/Games +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorer8 +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorer9 +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorer10 +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorer11 +
    +
    + ADMX_UserExperienceVirtualization/InternetExplorerCommon +
    +
    + ADMX_UserExperienceVirtualization/Maps +
    +
    + ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013 +
    +
    + ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016 +
    +
    + ADMX_UserExperienceVirtualization/Music +
    +
    + ADMX_UserExperienceVirtualization/News +
    +
    + ADMX_UserExperienceVirtualization/Notepad +
    +
    + ADMX_UserExperienceVirtualization/Reader +
    +
    + ADMX_UserExperienceVirtualization/RepositoryTimeout +
    +
    + ADMX_UserExperienceVirtualization/SettingsStoragePath +
    +
    + ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath +
    +
    + ADMX_UserExperienceVirtualization/Sports +
    +
    + ADMX_UserExperienceVirtualization/SyncEnabled +
    +
    + ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork +
    +
    + ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming +
    +
    + ADMX_UserExperienceVirtualization/SyncProviderPingEnabled +
    +
    + ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps +
    +
    + ADMX_UserExperienceVirtualization/Travel +
    +
    + ADMX_UserExperienceVirtualization/TrayIconEnabled +
    +
    + ADMX_UserExperienceVirtualization/Video +
    +
    + ADMX_UserExperienceVirtualization/Weather +
    +
    + ADMX_UserExperienceVirtualization/Wordpad +
    +
    + + +
    + + +**ADMX_UserExperienceVirtualization/Calculator** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings of Calculator. + +By default, the user settings of Calculator synchronize between computers. Use the policy setting to prevent the user settings of Calculator from synchronization between computers. + +If you enable this policy setting, the Calculator user settings continue to synchronize. + +If you disable this policy setting, Calculator user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Calculator* +- GP name: *Calculator* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/ConfigureSyncMethod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the sync provider used by User Experience Virtualization (UE-V) to sync settings between users’ computers. + +With Sync Method set to ”SyncProvider,” the UE-V Agent uses a built-in sync provider to keep user settings synchronized between the computer and the settings storage location. This is the default value. You can disable the sync provider on computers that never go offline and are always connected to the settings storage location. + +When SyncMethod is set to “None,” the UE-V Agent uses no sync provider. Settings are written directly to the settings storage location rather than being cached to sync later. + +Set SyncMethod to “External” when an external synchronization engine is being deployed for settings sync. This could use OneDrive, Work Folders, SharePoint or any other engine that uses a local folder to synchronize data between users’ computers. In this mode, UE-V writes settings data to the local folder specified in the settings storage path. + +These settings are then synchronized to other computers by an external synchronization engine. UE-V has no control over this synchronization. It only reads and writes the settings data when the normal UE-V triggers take place. +With notifications enabled, UE-V users receive a message when the settings sync is delayed. The notification delay policy setting defines the delay before a notification appears. + +If you disable this policy setting, the sync provider is used to synchronize settings between computers and the settings storage location. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Sync Method* +- GP name: *ConfigureSyncMethod* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/ConfigureVdi** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of User Experience Virtualization (UE-V) rollback information for computers running in a non-persistent, pooled VDI environment. + +UE-V settings rollback data and checkpoints are normally stored only on the local computer. With this policy setting enabled, the rollback information is copied to the settings storage location when the user logs off or shuts down their VDI session. + +Enable this setting to register a VDI-specific settings location template and restore data on computers in pooled VDI environments that reset to a clean state on logout. With this policy enabled you can roll settings back to the state when UE-V was installed or to “last-known-good” configurations. Only enable this policy setting on computers running in a non-persistent VDI environment. The VDI Collection Name defines the name of the virtual desktop collection containing the virtual computers. + +If you enable this policy setting, the UE-V rollback state is copied to the settings storage location on logout and restored on login. + +If you disable this policy setting, no UE-V rollback state is copied to the settings storage location. + +If you do not configure this policy, no UE-V rollback state is copied to the settings storage location. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *VDI Configuration* +- GP name: *ConfigureVdi* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/ContactITDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the text of the Contact IT URL hyperlink in the Company Settings Center. + +If you enable this policy setting, the Company Settings Center displays the specified text in the link to the Contact IT URL. + +If you disable this policy setting, the Company Settings Center does not display an IT Contact link. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Contact IT Link Text* +- GP name: *ContactITDescription* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/ContactITUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the URL for the Contact IT link in the Company Settings Center. + +If you enable this policy setting, the Company Settings Center Contact IT text links to the specified URL. The link can be of any standard protocol such as http or mailto. + +If you disable this policy setting, the Company Settings Center does not display an IT Contact link. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Contact IT URL* +- GP name: *ContactITUrl* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/DisableWin8Sync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings for Windows apps. + +By default, the UE-V Agent synchronizes settings for Windows apps between the computer and the settings storage location. + +If you enable this policy setting, the UE-V Agent will not synchronize settings for Windows apps. + +If you disable this policy setting, the UE-V Agent will synchronize settings for Windows apps. + +If you do not configure this policy setting, any defined values are deleted. + +> [!NOTE] +> If the user connects their Microsoft account for their computer then the UE-V Agent will not synchronize Windows apps. The Windows apps will default to whatever settings are configured in the Sync your settings configuration in Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not synchronize Windows Apps* +- GP name: *DisableWin8Sync* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/DisableWindowsOSSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of Windows settings between computers. Certain Windows settings will synchronize between computers by default. These settings include Windows themes, Windows desktop settings, Ease of Access settings, and network printers. Use this policy setting to specify which Windows settings synchronize between computers. You can also use these settings to enable synchronization of users' sign-in information for certain apps, networks, and certificates. + +If you enable this policy setting, only the selected Windows settings synchronize. Unselected Windows settings are excluded from settings synchronization. + +If you disable this policy setting, all Windows Settings are excluded from the settings synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronize Windows settings* +- GP name: *DisableWindowsOSSettings* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/EnableUEV** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. + +Reboot is needed for enable to take effect. With Auto-register inbox templates enabled, the UE-V inbox templates such as Office 2016 will be automatically registered when the UE-V Service is enabled. If this option is changed, it will only take effect when UE-V service is re-enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable UEV* +- GP name: *EnableUEV* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Finance** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Finance app. By default, the user settings of Finance sync between computers. Use the policy setting to prevent the user settings of Finance from synchronizing between computers. + +If you enable this policy setting, Finance user settings continue to sync. + +If you disable this policy setting, Finance user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Finance* +- GP name: *Finance* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables a notification in the system tray that appears when the User Experience Virtualization (UE-V) Agent runs for the first time. By default, a notification informs users that Company Settings Center, the user-facing name for the UE-V Agent, now helps to synchronize settings between their work computers. + +With this setting enabled, the notification appears the first time that the UE-V Agent runs. + +With this setting disabled, no notification appears. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *First Use Notification* +- GP name: *FirstUseNotificationEnabled* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Games** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Games app. By default, the user settings of Games sync between computers. Use the policy setting to prevent the user settings of Games from synchronizing between computers. + +If you enable this policy setting, Games user settings continue to sync. + +If you disable this policy setting, Games user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Games* +- GP name: *Games* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/InternetExplorer8** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Internet Explorer 8. + +By default, the user settings of Internet Explorer 8 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 8 from synchronization between computers. + +If you enable this policy setting, the Internet Explorer 8 user settings continue to synchronize. + +If you disable this policy setting, Internet Explorer 8 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer 8* +- GP name: *InternetExplorer8* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/InternetExplorer9** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Internet Explorer 9. By default, the user settings of Internet Explorer 9 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 9 from synchronization between computers. + +If you enable this policy setting, the Internet Explorer 9 user settings continue to synchronize. + +If you disable this policy setting, Internet Explorer 9 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer 9* +- GP name: *InternetExplorer9* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/InternetExplorer10** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings of Internet Explorer 10. By default, the user settings of Internet Explorer 10 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 10 from synchronization between computers. + +If you enable this policy setting, the Internet Explorer 10 user settings continue to synchronize. + +If you disable this policy setting, Internet Explorer 10 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer 10* +- GP name: *InternetExplorer10* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/InternetExplorer11** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings of Internet Explorer 11. By default, the user settings of Internet Explorer 11 synchronize between computers. Use the policy setting to prevent the user settings for Internet Explorer 11 from synchronization between computers. + +If you enable this policy setting, the Internet Explorer 11 user settings continue to synchronize. + +If you disable this policy setting, Internet Explorer 11 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer 11* +- GP name: *InternetExplorer11* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/InternetExplorerCommon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings which are common between the versions of Internet Explorer. +By default, the user settings which are common between the versions of Internet Explorer synchronize between computers. Use the policy setting to prevent the user settings of Internet Explorer from synchronization between computers. + +If you enable this policy setting, the user settings which are common between the versions of Internet Explorer continue to synchronize. + +If you disable this policy setting, the user settings which are common between the versions of Internet Explorer are excluded from settings synchronization. If any version of the Internet Explorer settings are enabled this policy setting should not be disabled. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Internet Explorer Common Settings* +- GP name: *InternetExplorerCommon* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + + + +**ADMX_UserExperienceVirtualization/Maps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Maps app. By default, the user settings of Maps sync between computers. Use the policy setting to prevent the user settings of Maps from synchronizing between computers. + +If you enable this policy setting, Maps user settings continue to sync. + +If you disable this policy setting, Maps user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maps* +- GP name: *Maps* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the UE-V Agent to write a warning event to the event log when a settings package file size reaches a defined threshold. By default the UE-V Agent does not report information about package file size. + +If you enable this policy setting, specify the threshold file size in bytes. When the settings package file exceeds this threshold the UE-V Agent will write a warning event to the event log. + +If you disable or do not configure this policy setting, no event is written to the event log to report settings package size. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Settings package size warning threshold* +- GP name: *MaxPackageSizeInBytes* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Access 2010. By default, the user settings of Microsoft Access 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Access 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Access 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Access 2010* +- GP name: *MicrosoftOffice2010Access* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2010 applications. By default, the user settings which are common between the Microsoft Office Suite 2010 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2010 applications from synchronization between computers. + +If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications continue to synchronize. + +If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2010 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2010 applications are enabled, this policy setting should not be disabled + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2010 Common Settings* +- GP name: *MicrosoftOffice2010Common* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Excel 2010. By default, the user settings of Microsoft Excel 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Excel 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Excel 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Excel 2010* +- GP name: *MicrosoftOffice2010Excel* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft InfoPath 2010. By default, the user settings of Microsoft InfoPath 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft InfoPath 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft InfoPath 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft InfoPath 2010* +- GP name: *MicrosoftOffice2010InfoPath* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Lync 2010. By default, the user settings of Microsoft Lync 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Lync 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Lync 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Lync 2010* +- GP name: *MicrosoftOffice2010Lync* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft OneNote 2010. By default, the user settings of Microsoft OneNote 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft OneNote 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft OneNote 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneNote 2010* +- GP name: *MicrosoftOffice2010OneNote* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Outlook 2010. By default, the user settings of Microsoft Outlook 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Outlook 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Outlook 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Outlook 2010* +- GP name: *MicrosoftOffice2010Outlook* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2010. By default, the user settings of Microsoft PowerPoint 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft PowerPoint 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft PowerPoint 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft PowerPoint 2010* +- GP name: *MicrosoftOffice2010PowerPoint* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Project 2010. By default, the user settings of Microsoft Project 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Project 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Project 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Project 2010* +- GP name: *MicrosoftOffice2010Project* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Publisher 2010. By default, the user settings of Microsoft Publisher 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Publisher 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Publisher 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Publisher 2010* +- GP name: *MicrosoftOffice2010Publisher* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2010. By default, the user settings of Microsoft SharePoint Designer 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft SharePoint Designer 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft SharePoint Designer 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft SharePoint Designer 2010* +- GP name: *MicrosoftOffice2010SharePointDesigner* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft SharePoint Workspace 2010. By default, the user settings of Microsoft SharePoint Workspace 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Workspace 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft SharePoint Workspace 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft SharePoint Workspace 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft SharePoint Workspace 2010* +- GP name: *MicrosoftOffice2010SharePointWorkspace* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Visio 2010. By default, the user settings of Microsoft Visio 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Visio 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Visio 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Visio 2010* +- GP name: *MicrosoftOffice2010Visio* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Word 2010. By default, the user settings of Microsoft Word 2010 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2010 from synchronization between computers. + +If you enable this policy setting, Microsoft Word 2010 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Word 2010 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Word 2010* +- GP name: *MicrosoftOffice2010Word* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Access 2013. By default, the user settings of Microsoft Access 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Access 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Access 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Access 2013* +- GP name: *MicrosoftOffice2013Access* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Access 2013. Microsoft Access 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Access 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Access 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Access 2013 backup only* +- GP name: *MicrosoftOffice2013AccessBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications. By default, the user settings which are common between the Microsoft Office Suite 2013 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers. + +If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize. + +If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2013 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2013 applications are enabled, this policy setting should not be disabled. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2013 Common Settings* +- GP name: *MicrosoftOffice2013Common* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2013 applications. +Microsoft Office Suite 2013 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2013 applications. + +If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will continue to be backed up. + +If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2013 applications will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Common 2013 backup only* +- GP name: *MicrosoftOffice2013CommonBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Excel 2013. + +By default, the user settings of Microsoft Excel 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Excel 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Excel 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Excel 2013* +- GP name: *MicrosoftOffice2013Excel* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Excel 2013. Microsoft Excel 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Excel 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Excel 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Excel 2013 backup only* +- GP name: *MicrosoftOffice2013ExcelBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft InfoPath 2013. By default, the user settings of Microsoft InfoPath 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft InfoPath 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft InfoPath 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft InfoPath 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft InfoPath 2013* +- GP name: *MicrosoftOffice2013InfoPath* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft InfoPath 2013. Microsoft InfoPath 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft InfoPath 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft InfoPath 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft InfoPath 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *InfoPath 2013 backup only* +- GP name: *MicrosoftOffice2013InfoPathBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Lync 2013. By default, the user settings of Microsoft Lync 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Lync 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Lync 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Lync 2013* +- GP name: *MicrosoftOffice2013Lync* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Lync 2013. Microsoft Lync 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Lync 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Lync 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lync 2013 backup only* +- GP name: *MicrosoftOffice2013LyncBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for OneDrive for Business 2013. By default, the user settings of OneDrive for Business 2013 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2013 from synchronization between computers. + +If you enable this policy setting, OneDrive for Business 2013 user settings continue to synchronize. + +If you disable this policy setting, OneDrive for Business 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneDrive for Business 2013* +- GP name: *MicrosoftOffice2013OneDriveForBusiness* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft OneNote 2013. By default, the user settings of Microsoft OneNote 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft OneNote 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft OneNote 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneNote 2013* +- GP name: *MicrosoftOffice2013OneNote* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft OneNote 2013. Microsoft OneNote 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft OneNote 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft OneNote 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *OneNote 2013 backup only* +- GP name: *MicrosoftOffice2013OneNoteBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Outlook 2013. By default, the user settings of Microsoft Outlook 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Outlook 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Outlook 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Outlook 2013* +- GP name: *MicrosoftOffice2013Outlook* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Outlook 2013. Microsoft Outlook 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Outlook 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Outlook 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Outlook 2013 backup only* +- GP name: *MicrosoftOffice2013OutlookBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2013. By default, the user settings of Microsoft PowerPoint 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft PowerPoint 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft PowerPoint 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft PowerPoint 2013* +- GP name: *MicrosoftOffice2013PowerPoint* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2013. Microsoft PowerPoint 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft PowerPoint 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft PowerPoint 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *PowerPoint 2013 backup only* +- GP name: *MicrosoftOffice2013PowerPointBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Project 2013. By default, the user settings of Microsoft Project 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Project 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Project 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Project 2013* +- GP name: *MicrosoftOffice2013Project* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Project 2013. Microsoft Project 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Project 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Project 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Project 2013 backup only* +- GP name: *MicrosoftOffice2013ProjectBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Publisher 2013. By default, the user settings of Microsoft Publisher 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Publisher 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Publisher 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Publisher 2013* +- GP name: *MicrosoftOffice2013Publisher* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Publisher 2013. Microsoft Publisher 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Publisher 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Publisher 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Publisher 2013 backup only* +- GP name: *MicrosoftOffice2013PublisherBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft SharePoint Designer 2013. By default, the user settings of Microsoft SharePoint Designer 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft SharePoint Designer 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft SharePoint Designer 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft SharePoint Designer 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft SharePoint Designer 2013* +- GP name: *MicrosoftOffice2013SharePointDesigner* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft SharePoint Designer 2013. Microsoft SharePoint Designer 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft SharePoint Designer 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft SharePoint Designer 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *SharePoint Designer 2013 backup only* +- GP name: *MicrosoftOffice2013SharePointDesignerBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 2013 Upload Center. By default, the user settings of Microsoft Office 2013 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2013 Upload Center from synchronization between computers. + +If you enable this policy setting, Microsoft Office 2013 Upload Center user settings continue to synchronize. + +If you disable this policy setting, Microsoft Office 2013 Upload Center user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2013 Upload Center* +- GP name: *MicrosoftOffice2013UploadCenter* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Visio 2013. By default, the user settings of Microsoft Visio 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Visio 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Visio 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Visio 2013* +- GP name: *MicrosoftOffice2013Visio* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Visio 2013. Microsoft Visio 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Visio 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Visio 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Visio 2013 backup only* +- GP name: *MicrosoftOffice2013VisioBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Word 2013. By default, the user settings of Microsoft Word 2013 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2013 from synchronization between computers. + +If you enable this policy setting, Microsoft Word 2013 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Word 2013 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Word 2013* +- GP name: *MicrosoftOffice2013Word* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Word 2013. Microsoft Word 2013 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2013 settings. + +If you enable this policy setting, certain user settings of Microsoft Word 2013 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Word 2013 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Word 2013 backup only* +- GP name: *MicrosoftOffice2013WordBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Access 2016. By default, the user settings of Microsoft Access 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Access 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Access 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Access 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Access 2016* +- GP name: *MicrosoftOffice2016Access* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Access 2016. Microsoft Access 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Access 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Access 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Access 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Access 2016 backup only* +- GP name: *MicrosoftOffice2016AccessBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications. By default, the user settings which are common between the Microsoft Office Suite 2016 applications synchronize between computers. Use the policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers. + +If you enable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize. + +If you disable this policy setting, the user settings which are common between the Microsoft Office Suite 2016 applications are excluded from the synchronization settings. If any of the Microsoft Office Suite 2016 applications are enabled, this policy setting should not be disabled. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2016 Common Settings* +- GP name: *MicrosoftOffice2016Common* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings which are common between the Microsoft Office Suite 2016 applications. +Microsoft Office Suite 2016 has user settings which are common between applications and are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific common Microsoft Office Suite 2016 applications. + +If you enable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will continue to be backed up. + +If you disable this policy setting, certain user settings which are common between the Microsoft Office Suite 2016 applications will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Common 2016 backup only* +- GP name: *MicrosoftOffice2016CommonBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Excel 2016. By default, the user settings of Microsoft Excel 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Excel 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Excel 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Excel 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Excel 2016* +- GP name: *MicrosoftOffice2016Excel* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Excel 2016. Microsoft Excel 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Excel 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Excel 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Excel 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Excel 2016 backup only* +- GP name: *MicrosoftOffice2016ExcelBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Lync 2016. By default, the user settings of Microsoft Lync 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Lync 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Lync 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Lync 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Lync 2016* +- GP name: *MicrosoftOffice2016Lync* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Lync 2016. Microsoft Lync 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Lync 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Lync 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Lync 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lync 2016 backup only* +- GP name: *MicrosoftOffice2016LyncBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for OneDrive for Business 2016. By default, the user settings of OneDrive for Business 2016 synchronize between computers. Use the policy setting to prevent the user settings of OneDrive for Business 2016 from synchronization between computers. + +If you enable this policy setting, OneDrive for Business 2016 user settings continue to synchronize. + +If you disable this policy setting, OneDrive for Business 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneDrive for Business 2016* +- GP name: *MicrosoftOffice2016OneDriveForBusiness* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft OneNote 2016. By default, the user settings of Microsoft OneNote 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft OneNote 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft OneNote 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft OneNote 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft OneNote 2016* +- GP name: *MicrosoftOffice2016OneNote* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft OneNote 2016. Microsoft OneNote 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft OneNote 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft OneNote 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft OneNote 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *OneNote 2016 backup only* +- GP name: *MicrosoftOffice2016OneNoteBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Outlook 2016. By default, the user settings of Microsoft Outlook 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Outlook 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Outlook 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Outlook 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Outlook 2016* +- GP name: *MicrosoftOffice2016Outlook* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Outlook 2016. Microsoft Outlook 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Outlook 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Outlook 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Outlook 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Outlook 2016 backup only* +- GP name: *MicrosoftOffice2016OutlookBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft PowerPoint 2016. By default, the user settings of Microsoft PowerPoint 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft PowerPoint 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft PowerPoint 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft PowerPoint 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft PowerPoint 2016* +- GP name: *MicrosoftOffice2016PowerPoint* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft PowerPoint 2016. Microsoft PowerPoint 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft PowerPoint 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft PowerPoint 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft PowerPoint 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *PowerPoint 2016 backup only* +- GP name: *MicrosoftOffice2016PowerPointBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Project 2016. +By default, the user settings of Microsoft Project 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Project 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Project 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Project 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Project 2016* +- GP name: *MicrosoftOffice2016Project* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Project 2016. Microsoft Project 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Project 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Project 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Project 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Project 2016 backup only* +- GP name: *MicrosoftOffice2016ProjectBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Publisher 2016. By default, the user settings of Microsoft Publisher 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Publisher 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Publisher 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Publisher 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Publisher 2016* +- GP name: *MicrosoftOffice2016Publisher* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Publisher 2016. Microsoft Publisher 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Publisher 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Publisher 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Publisher 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Publisher 2016 backup only* +- GP name: *MicrosoftOffice2016PublisherBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 2016 Upload Center. By default, the user settings of Microsoft Office 2016 Upload Center synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Office 2016 Upload Center from synchronization between computers. + +If you enable this policy setting, Microsoft Office 2016 Upload Center user settings continue to synchronize. + +If you disable this policy setting, Microsoft Office 2016 Upload Center user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 2016 Upload Center* +- GP name: *MicrosoftOffice2016UploadCenter* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Visio 2016. By default, the user settings of Microsoft Visio 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Visio 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Visio 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Visio 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Visio 2016* +- GP name: *MicrosoftOffice2016Visio* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Visio 2016. Microsoft Visio 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Visio 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Visio 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Visio 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Visio 2016 backup only* +- GP name: *MicrosoftOffice2016VisioBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Word 2016. By default, the user settings of Microsoft Word 2016 synchronize between computers. Use the policy setting to prevent the user settings of Microsoft Word 2016 from synchronization between computers. + +If you enable this policy setting, Microsoft Word 2016 user settings continue to synchronize. + +If you disable this policy setting, Microsoft Word 2016 user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Word 2016* +- GP name: *MicrosoftOffice2016Word* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the backup of certain user settings for Microsoft Word 2016. Microsoft Word 2016 has user settings that are backed up instead of synchronizing between computers. Use the policy setting to suppress the backup of specific Microsoft Word 2016 settings. + +If you enable this policy setting, certain user settings of Microsoft Word 2016 will continue to be backed up. + +If you disable this policy setting, certain user settings of Microsoft Word 2016 will not be backed up. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Word 2016 backup only* +- GP name: *MicrosoftOffice2016WordBackup* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Access 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Access 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Access 2013* +- GP name: *MicrosoftOffice365Access2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Access 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Access 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Access 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Access 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Access 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Access 2016* +- GP name: *MicrosoftOffice365Access2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2013 applications. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2013 applications will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2013 applications from synchronization between computers with UE-V. + +If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications continue to synchronize with UE-V. + +If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2013 applications are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Common 2013* +- GP name: *MicrosoftOffice365Common2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings which are common between the Microsoft Office Suite 2016 applications. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings which are common between the Microsoft Office Suite 2016 applications will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings which are common between the Microsoft Office Suite 2016 applications from synchronization between computers with UE-V. + +If you enable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications continue to synchronize with UE-V. + +If you disable this policy setting, user settings which are common between the Microsoft Office Suite 2016 applications are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Common 2016* +- GP name: *MicrosoftOffice365Common2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Excel 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Excel 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Excel 2013* +- GP name: *MicrosoftOffice365Excel2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Excel 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Excel 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Excel 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Excel 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Excel 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Excel 2016* +- GP name: *MicrosoftOffice365Excel2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 InfoPath 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 InfoPath 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 InfoPath 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 InfoPath 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 InfoPath 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 InfoPath 2013* +- GP name: *MicrosoftOffice365InfoPath2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Lync 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Lync 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Lync 2013* +- GP name: *MicrosoftOffice365Lync2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Lync 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Lync 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Lync 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Lync 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Lync 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Lync 2016* +- GP name: *MicrosoftOffice365Lync2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 OneNote 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 OneNote 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 OneNote 2013* +- GP name: *MicrosoftOffice365OneNote2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 OneNote 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 OneNote 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 OneNote 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 OneNote 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 OneNote 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 OneNote 2016* +- GP name: *MicrosoftOffice365OneNote2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Outlook 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Outlook 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Outlook 2013* +- GP name: *MicrosoftOffice365Outlook2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Outlook 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Outlook 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Outlook 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Outlook 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Outlook 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Outlook 2016* +- GP name: *MicrosoftOffice365Outlook2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 PowerPoint 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 PowerPoint 2013* +- GP name: *MicrosoftOffice365PowerPoint2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 PowerPoint 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 PowerPoint 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 PowerPoint 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 PowerPoint 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 PowerPoint 2016* +- GP name: *MicrosoftOffice365PowerPoint2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Project 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Project 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Project 2013* +- GP name: *MicrosoftOffice365Project2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Project 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Project 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Project 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Project 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Project 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Project 2016* +- GP name: *MicrosoftOffice365Project2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Publisher 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Publisher 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Publisher 2013* +- GP name: *MicrosoftOffice365Publisher2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Publisher 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Publisher 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Publisher 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Publisher 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Publisher 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Publisher 2016* +- GP name: *MicrosoftOffice365Publisher2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 SharePoint Designer 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 SharePoint Designer 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 SharePoint Designer 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 SharePoint Designer 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 SharePoint Designer 2013* +- GP name: *MicrosoftOffice365SharePointDesigner2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Visio 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Visio 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Visio 2013* +- GP name: *MicrosoftOffice365Visio2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Visio 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Visio 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Visio 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Visio 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Visio 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Visio 2016* +- GP name: *MicrosoftOffice365Visio2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2013. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2013 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2013 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Word 2013 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Word 2013 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Word 2013* +- GP name: *MicrosoftOffice365Word2013* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for Microsoft Office 365 Word 2016. Microsoft Office 365 synchronizes certain settings by default without UE-V. If the synchronization capabilities of Microsoft Office 365 are disabled, then the user settings of Microsoft Office 365 Word 2016 will synchronize between a user’s work computers with UE-V by default. Use this policy setting to prevent the user settings of Microsoft Office 365 Word 2016 from synchronization between computers with UE-V. + +If you enable this policy setting, Microsoft Office 365 Word 2016 user settings continue to sync with UE-V. + +If you disable this policy setting, Microsoft Office 365 Word 2016 user settings are excluded from synchronization with UE-V. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Office 365 Word 2016* +- GP name: *MicrosoftOffice365Word2016* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Music** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Music app. By default, the user settings of Music sync between computers. Use the policy setting to prevent the user settings of Music from synchronizing between computers. + +If you enable this policy setting, Music user settings continue to sync. + +If you disable this policy setting, Music user settings are excluded from the synchronizing settings. + +If you do not configure this policy setting, any defined values will be deleted. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Music* +- GP name: *Music* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/News** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the News app. By default, the user settings of News sync between computers. Use the policy setting to prevent the user settings of News from synchronizing between computers. + +If you enable this policy setting, News user settings continue to sync. + +If you disable this policy setting, News user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *News* +- GP name: *News* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Notepad** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings of Notepad. By default, the user settings of Notepad synchronize between computers. Use the policy setting to prevent the user settings of Notepad from synchronization between computers. + +If you enable this policy setting, the Notepad user settings continue to synchronize. + +If you disable this policy setting, Notepad user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Notepad* +- GP name: *Notepad* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Reader** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Reader app. By default, the user settings of Reader sync between computers. Use the policy setting to prevent the user settings of Reader from synchronizing between computers. + +If you enable this policy setting, Reader user settings continue to sync. + +If you disable this policy setting, Reader user settings are excluded from the synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Reader* +- GP name: *Reader* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/RepositoryTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the number of milliseconds that the computer waits when retrieving user settings from the settings storage location. You can use this setting to override the default value of 2000 milliseconds. + +If you enable this policy setting, set the number of milliseconds that the system waits to retrieve settings. + +If you disable or do not configure this policy setting, the default value of 2000 milliseconds is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Synchronization timeout* +- GP name: *RepositoryTimeout* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/SettingsStoragePath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures where the settings package files that contain user settings are stored. + +If you enable this policy setting, the user settings are stored in the specified location. + +If you disable or do not configure this policy setting, the user settings are stored in the user’s home directory if configured for your environment. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Settings storage path* +- GP name: *SettingsStoragePath* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures where custom settings location templates are stored and if the catalog will be used to replace the default Microsoft templates installed with the UE-V Agent. + +If you enable this policy setting, the UE-V Agent checks the specified location once each day and updates its synchronization behavior based on the templates in this location. Settings location templates added or updated since the last check are registered by the UE-V Agent. The UE-V Agent deregisters templates that were removed from this location. + +If you specify a UNC path and leave the option to replace the default Microsoft templates unchecked, the UE-V Agent will use the default Microsoft templates installed by the UE-V Agent and custom templates in the settings template catalog. If there are custom templates in the settings template catalog which use the same ID as the default Microsoft templates, they will be ignored. + +If you specify a UNC path and check the option to replace the default Microsoft templates, all of the default Microsoft templates installed by the UE-V Agent will be deleted from the computer and only the templates located in the settings template catalog will be used. + +If you disable this policy setting, the UE-V Agent will not use the custom settings location templates. If you disable this policy setting after it has been enabled, the UE-V Agent will not restore the default Microsoft templates. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Settings template catalog path* +- GP name: *SettingsTemplateCatalogPath* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Sports** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Sports app. By default, the user settings of Sports sync between computers. Use the policy setting to prevent the user settings of Sports from synchronizing between computers. + +If you enable this policy setting, Sports user settings continue to sync. + +If you disable this policy setting, Sports user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sports* +- GP name: *Sports* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/SyncEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable or disable User Experience Virtualization (UE-V). Only applies to Windows 10 or earlier. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use User Experience Virtualization (UE-V)* +- GP name: *SyncEnabled* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + +**ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings over metered connections. By default, the UE-V Agent does not synchronize settings over a metered connection. + +With this setting enabled, the UE-V Agent synchronizes settings over a metered connection. + +With this setting disabled, the UE-V Agent does not synchronize settings over a metered connection. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sync settings over metered connections* +- GP name: *SyncOverMeteredNetwork* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines whether the User Experience Virtualization (UE-V) Agent synchronizes settings over metered connections outside of the home provider network, for example when connected via a roaming connection. By default, the UE-V Agent does not synchronize settings over a metered connection that is roaming. + +With this setting enabled, the UE-V Agent synchronizes settings over a metered connection that is roaming. + +With this setting disabled, the UE-V Agent will not synchronize settings over a metered connection that is roaming. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sync settings over metered connections even when roaming* +- GP name: *SyncOverMeteredNetworkWhenRoaming* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/SyncProviderPingEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the User Experience Virtualization (UE-V) sync provider to ping the settings storage path before attempting to sync settings. If the ping is successful then the sync provider attempts to synchronize the settings packages. If the ping is unsuccessful then the sync provider doesn’t attempt the synchronization. + +If you enable this policy setting, the sync provider pings the settings storage location before synchronizing settings packages. + +If you disable this policy setting, the sync provider doesn’t ping the settings storage location before synchronizing settings packages. + +If you do not configure this policy, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ping the settings storage location before sync* +- GP name: *SyncProviderPingEnabled* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the default settings sync behavior of the User Experience Virtualization (UE-V) Agent for Windows apps that are not explicitly listed in Windows App List. By default, the UE-V Agent only synchronizes settings of those Windows apps included in the Windows App List. + +With this setting enabled, the settings of all Windows apps not expressly disable in the Windows App List are synchronized. + +With this setting disabled, only the settings of the Windows apps set to synchronize in the Windows App List are synchronized. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sync Unlisted Windows Apps* +- GP name: *SyncUnlistedWindows8Apps* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Travel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Travel app. By default, the user settings of Travel sync between computers. Use the policy setting to prevent the user settings of Travel from synchronizing between computers. + +If you enable this policy setting, Travel user settings continue to sync. + +If you disable this policy setting, Travel user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Travel* +- GP name: *Travel* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/TrayIconEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables the User Experience Virtualization (UE-V) tray icon. By default, an icon appears in the system tray that displays notifications for UE-V. This icon also provides a link to the UE-V Agent application, Company Settings Center. Users can open the Company Settings Center by right-clicking the icon and selecting Open or by double-clicking the icon. When this group policy setting is enabled, the UE-V tray icon is visible, the UE-V notifications display, and the Company Settings Center is accessible from the tray icon. + +With this setting disabled, the tray icon does not appear in the system tray, UE-V never displays notifications, and the user cannot access Company Settings Center from the system tray. The Company Settings Center remains accessible through the Control Panel and the Start menu or Start screen. + +If you do not configure this policy setting, any defined values are deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tray Icon* +- GP name: *TrayIconEnabled* +- GP path: *Windows Components\Microsoft User Experience Virtualization* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Video** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Video app. By default, the user settings of Video sync between computers. Use the policy setting to prevent the user settings of Video from synchronizing between computers. + +If you enable this policy setting, Video user settings continue to sync. + +If you disable this policy setting, Video user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Video* +- GP name: *Video* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + + +**ADMX_UserExperienceVirtualization/Weather** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings for the Weather app. By default, the user settings of Weather sync between computers. Use the policy setting to prevent the user settings of Weather from synchronizing between computers. + +If you enable this policy setting, Weather user settings continue to sync. + +If you disable this policy setting, Weather user settings are excluded from synchronization. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Weather* +- GP name: *Weather* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    + +**ADMX_UserExperienceVirtualization/Wordpad** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the synchronization of user settings of WordPad. By default, the user settings of WordPad synchronize between computers. Use the policy setting to prevent the user settings of WordPad from synchronization between computers. + +If you enable this policy setting, the WordPad user settings continue to synchronize. + +If you disable this policy setting, WordPad user settings are excluded from the synchronization settings. + +If you do not configure this policy setting, any defined values will be deleted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WordPad* +- GP name: *Wordpad* +- GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* +- GP ADMX file name: *UserExperienceVirtualization.admx* + + + +
    +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md new file mode 100644 index 0000000000..dcc45e4c5e --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -0,0 +1,655 @@ +--- +title: Policy CSP - ADMX_UserProfiles +description: Policy CSP - ADMX_UserProfiles +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/11/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_UserProfiles +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_UserProfiles policies + +
    +
    + ADMX_UserProfiles/CleanupProfiles +
    +
    + ADMX_UserProfiles/DontForceUnloadHive +
    +
    + ADMX_UserProfiles/LeaveAppMgmtData +
    +
    + ADMX_UserProfiles/LimitSize +
    +
    + ADMX_UserProfiles/ProfileErrorAction +
    +
    + ADMX_UserProfiles/SlowLinkTimeOut +
    +
    + ADMX_UserProfiles/USER_HOME +
    +
    + ADMX_UserProfiles/UserInfoAccessAction +
    +
    + + +
    + + +**ADMX_UserProfiles/CleanupProfiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days. Note: One day is interpreted as 24 hours after a specific user profile was accessed. + +If you enable this policy setting, the User Profile Service will automatically delete on the next system restart all user profiles on the computer that have not been used within the specified number of days. + +If you disable or do not configure this policy setting, User Profile Service will not automatically delete any profiles on the next system restart. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Delete user profiles older than a specified number of days on system restart* +- GP name: *CleanupProfiles* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
    + + +**ADMX_UserProfiles/DontForceUnloadHive** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows forcefully unloads the user's registry at logoff, even if there are open handles to the per-user registry keys. + +Note: This policy setting should only be used for cases where you may be running into application compatibility issues due to this specific Windows behavior. It is not recommended to enable this policy by default as it may prevent users from getting an updated version of their roaming user profile. + +If you enable this policy setting, Windows will not forcefully unload the users registry at logoff, but will unload the registry when all open handles to the per-user registry keys are closed. + +If you disable or do not configure this policy setting, Windows will always unload the users registry at logoff, even if there are any open handles to the per-user registry keys at user logoff. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not forcefully unload the users registry at user logoff* +- GP name: *DontForceUnloadHive* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
    + + +**ADMX_UserProfiles/LeaveAppMgmtData** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the system retains a roaming user's Windows Installer and Group Policy based software installation data on their profile deletion. + +By default Windows deletes all information related to a roaming user (which includes the user's settings, data, Windows Installer related data, and the like) when their profile is deleted. As a result, the next time a roaming user whose profile was previously deleted on that client logs on, they will need to reinstall all apps published via policy at logon increasing logon time. You can use this policy setting to change this behavior. + +If you enable this policy setting, Windows will not delete Windows Installer or Group Policy software installation data for roaming users when profiles are deleted from the machine. This will improve the performance of Group Policy based Software Installation during user logon when a user profile is deleted and that user subsequently logs on to the machine. + +If you disable or do not configure this policy setting, Windows will delete the entire profile for roaming users, including the Windows Installer and Group Policy software installation data when those profiles are deleted. + +> [!NOTE] +> If this policy setting is enabled for a machine, local administrator action is required to remove the Windows Installer or Group Policy software installation data stored in the registry and file system of roaming users' profiles on the machine. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Leave Windows Installer and Group Policy Software Installation Data* +- GP name: *LeaveAppMgmtData* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
    + + +**ADMX_UserProfiles/LimitSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting sets the maximum size of each user profile and determines the system's response when a user profile reaches the maximum size. This policy setting affects both local and roaming profiles. + +If you disable this policy setting or do not configure it, the system does not limit the size of user profiles. + +If you enable this policy setting, you can: + +- Set a maximum permitted user profile size. +- Determine whether the registry files are included in the calculation of the profile size. +- Determine whether users are notified when the profile exceeds the permitted maximum size. +- Specify a customized message notifying users of the oversized profile. +- Determine how often the customized message is displayed. + +> [!NOTE] +> In operating systems earlier than Microsoft Windows Vista, Windows will not allow users to log off until the profile size has been reduced to within the allowable limit. In Microsoft Windows Vista, Windows will not block users from logging off. Instead, if the user has a roaming user profile, Windows will not synchronize the user's profile with the roaming profile server if the maximum profile size limit specified here is exceeded. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Limit profile size* +- GP name: *LimitSize* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
    + + +**ADMX_UserProfiles/ProfileErrorAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting will automatically log off a user when Windows cannot load their profile. + +If Windows cannot access the user profile folder or the profile contains errors that prevent it from loading, Windows logs on the user with a temporary profile. This policy setting allows the administrator to disable this behavior, preventing Windows from logging on the user with a temporary profile. + +If you enable this policy setting, Windows will not log on a user with a temporary profile. Windows logs the user off if their profile cannot be loaded. + +If you disable this policy setting or do not configure it, Windows logs on the user with a temporary profile when Windows cannot load their user profile. + +Also, see the "Delete cached copies of roaming profiles" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not log users on with temporary profiles* +- GP name: *ProfileErrorAction* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
    + + +**ADMX_UserProfiles/SlowLinkTimeOut** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines a slow connection for roaming user profiles and establishes thresholds for two tests of network speed. + +To determine the network performance characteristics, a connection is made to the file share storing the user's profile and 64 kilobytes of data is transferred. From that connection and data transfer, the network's latency and connection speed are determined. + +This policy setting and related policy settings in this folder together define the system's response when roaming user profiles are slow to load. + +If you enable this policy setting, you can change how long Windows waits for a response from the server before considering the connection to be slow. + +If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond.Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections.Important: If the "Do not detect slow network connections" policy setting is enabled, this policy setting is ignored. Also, if the "Delete cached copies of roaming profiles" policy setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control slow network connection timeout for user profiles* +- GP name: *SlowLinkTimeOut* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
    + + +**ADMX_UserProfiles/USER_HOME** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the location and root (file share or local path) of a user's home folder for a logon session. + +If you enable this policy setting, the user's home folder is configured to the specified local or network location, creating a new folder for each user name. + +To use this policy setting, in the Location list, choose the location for the home folder. If you choose “On the network,” enter the path to a file share in the Path box (for example, \\\\ComputerName\ShareName), and then choose the drive letter to assign to the file share. If you choose “On the local computer,” enter a local path (for example, C:\HomeFolder) in the Path box. + +Do not specify environment variables or ellipses in the path. Also, do not specify a placeholder for the user name because the user name will be appended at logon. + +> [!NOTE] +> The Drive letter box is ignored if you choose “On the local computer” from the Location list. If you choose “On the local computer” and enter a file share, the user's home folder will be placed in the network location without mapping the file share to a drive letter. + +If you disable or do not configure this policy setting, the user's home folder is configured as specified in the user's Active Directory Domain Services account. + +If the "Set Remote Desktop Services User Home Directory" policy setting is enabled, the “Set user home folder” policy setting has no effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set user home folder* +- GP name: *USER_HOME* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +
    + + +**ADMX_UserProfiles/UserInfoAccessAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from managing the ability to allow apps to access the user name, account picture, and domain information. + +If you enable this policy setting, sharing of user name, picture and domain information may be controlled by setting one of the following options: + +- "Always on" - users will not be able to change this setting and the user's name and account picture will be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will also be able to retrieve the user's UPN, SIP/URI, and DNS. + +- "Always off" - users will not be able to change this setting and the user's name and account picture will not be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will not be able to retrieve the user's UPN, SIP/URI, and DNS. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources. + +If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *User management of sharing user name, account picture, and domain information with apps (not desktop apps)* +- GP name: *UserInfoAccessAction* +- GP path: *System\User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md new file mode 100644 index 0000000000..37697fb185 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -0,0 +1,430 @@ +--- +title: Policy CSP - ADMX_W32Time +description: Policy CSP - ADMX_W32Time +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/28/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_W32Time +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_W32Time policies + +
    +
    + ADMX_W32Time/W32TIME_POLICY_CONFIG +
    +
    + ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT +
    +
    + ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT +
    +
    + ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER +
    +
    + + +
    + + +**ADMX_W32Time/W32TIME_POLICY_CONFIG** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify Clock discipline and General values for the Windows Time service (W32time) for domain controllers including RODCs. + +If this policy setting is enabled, W32time Service on target machines use the settings provided here. Otherwise, the service on target machines use locally configured settings values. + +For more details on individual parameters, combinations of parameter values as well as definitions of flags, see https://go.microsoft.com/fwlink/?linkid=847809. + +**FrequencyCorrectRate** +This parameter controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause more frequent corrections. Default: 4 (scalar). + +**HoldPeriod** +This parameter indicates how many consistent time samples the client computer must receive in a series before subsequent time samples are evaluated as potential spikes. Default: 5 + +**LargePhaseOffset** +If a time sample differs from the client computer's local clock by more than LargePhaseOffset, the local clock is deemed to have drifted considerably, or in other words, spiked. Default: 50,000,000 100-nanosecond units (ns) or 5 seconds. + +**MaxAllowedPhaseOffset** +If a response is received that has a time variation that is larger than this parameter value, W32time sets the client computer's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client computer's local clock is corrected gradually. Default: 300 seconds. + +**MaxNegPhaseCorrection** +If a time sample is received that indicates a time in the past (as compared to the client computer's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. + +**MaxPosPhaseCorrection** +If a time sample is received that indicates a time in the future (as compared to the client computer's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. + +**PhaseCorrectRate** +This parameter controls how quickly W32time corrects the client computer's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar). + +**PollAdjustFactor** +This parameter controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar). + +**SpikeWatchPeriod** +This parameter specifies the amount of time that samples with time offset larger than LargePhaseOffset are received before these samples are accepted as accurate. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds. + +**UpdateInterval** +This parameter specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, or 1 second. + +General parameters: + +**AnnounceFlags** +This parameter is a bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal + +**EventLogFlags** +This parameter controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. + +**LocalClockDispersion** +This parameter indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds. + +**MaxPollInterval** +This parameter controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, or 1024 seconds. (Should not be set higher than 15.) + +**MinPollInterval** +This parameter controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, or 64 seconds. + +**ClockHoldoverPeriod** +This parameter indicates the maximum number of seconds a system clock can nominally hold its accuracy without synchronizing with a time source. If this period of time passes without W32time obtaining new samples from any of its input providers, W32time initiates a rediscovery of time sources. Default: 7800 seconds. + +**RequireSecureTimeSyncRequests** +This parameter controls whether or not the DC will respond to time sync requests that use older authentication protocols. If enabled (set to 1), the DC will not respond to requests using such protocols. Default: 0 Boolean. + +**UtilizeSslTimeData** +This parameter controls whether W32time will use time data computed from SSL traffic on the machine as an additional input for correcting the local clock. Default: 1 (enabled) Boolean + +**ClockAdjustmentAuditLimit** +This parameter specifies the smallest local clock adjustments that may be logged to the W32time service event log on the target machine. Default: 800 Parts per million (PPM). + +RODC parameters: + +**ChainEntryTimeout** +This parameter specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds. + +**ChainMaxEntries** +This parameter controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries. + +**ChainMaxHostEntries** +This parameter controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. + +**ChainDisable** +This parameter controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean. + +**ChainLoggingRate** +This parameter controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Global Configuration Settings* +- GP name: *W32TIME_POLICY_CONFIG* +- GP path: *System\Windows Time Service* +- GP ADMX file name: *W32Time.admx* + + + +
    + + +**ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a set of parameters for controlling the Windows NTP Client. + +If you enable this policy setting, you can specify the following parameters for the Windows NTP Client. + +If you disable or do not configure this policy setting, the Windows NTP Client uses the defaults of each of the following parameters. + +**NtpServer** +The Domain Name System (DNS) name or IP address of an NTP time source. This value is in the form of ""dnsName,flags"" where ""flags"" is a hexadecimal bitmask of the flags for that host. For more information, see the NTP Client Group Policy Settings Associated with Windows Time section of the Windows Time Service Group Policy Settings. The default value is ""time.windows.com,0x09"". + +**Type** +This value controls the authentication that W32time uses. The default value is NT5DS. + +**CrossSiteSyncFlags** +This value, expressed as a bitmask, controls how W32time chooses time sources outside its own site. The possible values are 0, 1, and 2. Setting this value to 0 (None) indicates that the time client should not attempt to synchronize time outside its site. Setting this value to 1 (PdcOnly) indicates that only the computers that function as primary domain controller (PDC) emulator operations masters in other domains can be used as synchronization partners when the client has to synchronize time with a partner outside its own site. Setting a value of 2 (All) indicates that any synchronization partner can be used. This value is ignored if the NT5DS value is not set. The default value is 2 decimal (0x02 hexadecimal). + +**ResolvePeerBackoffMinutes** +This value, expressed in minutes, controls how long W32time waits before it attempts to resolve a DNS name when a previous attempt failed. The default value is 15 minutes. + +**ResolvePeerBackoffMaxTimes** +This value controls how many times W32time attempts to resolve a DNS name before the discovery process is restarted. Each time DNS name resolution fails, the amount of time to wait before the next attempt will be twice the previous amount. The default value is seven attempts. + +**SpecialPollInterval** +This NTP client value, expressed in seconds, controls how often a manually configured time source is polled when the time source is configured to use a special polling interval. If the SpecialInterval flag is enabled on the NTPServer setting, the client uses the value that is set as the SpecialPollInterval, instead of a variable interval between MinPollInterval and MaxPollInterval values, to determine how frequently to poll the time source. SpecialPollInterval must be in the range of [MinPollInterval, MaxPollInterval], else the nearest value of the range is picked. Default: 1024 seconds. + +**EventLogFlags** +This value is a bitmask that controls events that may be logged to the System log in Event Viewer. Setting this value to 0x1 indicates that W32time will create an event whenever a time jump is detected. Setting this value to 0x2 indicates that W32time will create an event whenever a time source change is made. Because it is a bitmask value, setting 0x3 (the addition of 0x1 and 0x2) indicates that both time jumps and time source changes will be logged. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Windows NTP Client* +- GP name: *W32TIME_POLICY_CONFIGURE_NTPCLIENT* +- GP path: *System\Windows Time Service\Time Providers* +- GP ADMX file name: *W32Time.admx* + + + +
    + + +**ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the Windows NTP Client is enabled. + +Enabling the Windows NTP Client allows your computer to synchronize its computer clock with other NTP servers. You might want to disable this service if you decide to use a third-party time provider. + +If you enable this policy setting, you can set the local computer clock to synchronize time with NTP servers. + +If you disable or do not configure this policy setting, the local computer clock does not synchronize time with NTP servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Windows NTP Client* +- GP name: *W32TIME_POLICY_ENABLE_NTPCLIENT* +- GP path: *System\Windows Time Service\Time Providers* +- GP ADMX file name: *W32Time.admx* + + + +
    + + +**ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify whether the Windows NTP Server is enabled. + +If you enable this policy setting for the Windows NTP Server, your computer can service NTP requests from other computers. + +If you disable or do not configure this policy setting, your computer cannot service NTP requests from other computers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Windows NTP Server* +- GP name: *W32TIME_POLICY_ENABLE_NTPSERVER* +- GP path: *System\Windows Time Service\Time Providers* +- GP ADMX file name: *W32Time.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md new file mode 100644 index 0000000000..0c5ea22e12 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -0,0 +1,273 @@ +--- +title: Policy CSP - ADMX_WCM +description: Policy CSP - ADMX_WCM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/22/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WCM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WCM policies + +
    +
    + ADMX_WCM/WCM_DisablePowerManagement +
    +
    + ADMX_WCM/WCM_EnableSoftDisconnect +
    +
    + ADMX_WCM/WCM_MinimizeConnections +
    +
    + + +
    + + +**ADMX_WCM/WCM_DisablePowerManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that power management is disabled when the machine enters connected standby mode. + +If this policy setting is enabled, Windows Connection Manager does not manage adapter radios to reduce power consumption when the machine enters connected standby mode. + +If this policy setting is not configured or is disabled, power management is enabled when the machine enters connected standby mode. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable power management in connected standby mode* +- GP name: *WCM_DisablePowerManagement* +- GP path: *Network\Windows Connection Manager* +- GP ADMX file name: *WCM.admx* + + + +
    + + +**ADMX_WCM/WCM_EnableSoftDisconnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows will soft-disconnect a computer from a network. + +If this policy setting is enabled or not configured, Windows will soft-disconnect a computer from a network when it determines that the computer should no longer be connected to a network. + +If this policy setting is disabled, Windows will disconnect a computer from a network immediately when it determines that the computer should no longer be connected to a network. + +When soft disconnect is enabled: + +- When Windows decides that the computer should no longer be connected to a network, it waits for traffic to settle on that network. The existing TCP session will continue uninterrupted. +- Windows then checks the traffic level on the network periodically. If the traffic level is above a certain threshold, no further action is taken. The computer stays connected to the network and continues to use it. For example, if the network connection is currently being used to download files from the Internet, the files will continue to be downloaded using that network connection. +- When the network traffic drops below this threshold, the computer will be disconnected from the network. Apps that keep a network connection active even when they’re not actively using it (for example, email apps) might lose their connection. If this happens, these apps should re-establish their connection over a different network. + +This policy setting depends on other group policy settings. For example, if 'Minimize the number of simultaneous connections to the Internet or a Windows Domain' is disabled, Windows will not disconnect from any networks. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Windows to soft-disconnect a computer from a network* +- GP name: *WCM_EnableSoftDisconnect* +- GP path: *Network\Windows Connection Manager* +- GP ADMX file name: *WCM.admx* + + + +
    + + +**ADMX_WCM/WCM_MinimizeConnections** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines if a computer can have multiple connections to the internet or to a Windows domain. If multiple connections are allowed, it then determines how network traffic will be routed. + +If this policy setting is set to 0, a computer can have simultaneous connections to the internet, to a Windows domain, or to both. Internet traffic can be routed over any connection - including a cellular connection and any metered network. This was previously the Disabled state for this policy setting. This option was first available in Windows 8. + +If this policy setting is set to 1, any new automatic internet connection is blocked when the computer has at least one active internet connection to a preferred type of network. Here's the order of preference (from most preferred to least preferred): Ethernet, WLAN, then cellular. Ethernet is always preferred when connected. Users can still manually connect to any network. This was previously the Enabled state for this policy setting. This option was first available in Windows 8. + +If this policy setting is set to 2, the behavior is similar to 1. However, if a cellular data connection is available, it will always stay connected for services that require a cellular connection. When the user is connected to a WLAN or Ethernet connection, no internet traffic will be routed over the cellular connection. This option was first available in Windows 10 (Version 1703). + +If this policy setting is set to 3, the behavior is similar to 2. However, if there's an Ethernet connection, Windows won't allow users to connect to a WLAN manually. A WLAN can only be connected (automatically or manually) when there's no Ethernet connection. + +This policy setting is related to the "Enable Windows to soft-disconnect a computer from a network" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Minimize the number of simultaneous connections to the Internet or a Windows Domain* +- GP name: *WCM_MinimizeConnections* +- GP path: *Network\Windows Connection Manager* +- GP ADMX file name: *WCM.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-wincal.md b/windows/client-management/mdm/policy-csp-admx-wincal.md new file mode 100644 index 0000000000..399309047c --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wincal.md @@ -0,0 +1,193 @@ +--- +title: Policy CSP - ADMX_WinCal +description: Policy CSP - ADMX_WinCal +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/28/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WinCal +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WinCal policies + +
    +
    + ADMX_WinCal/TurnOffWinCal_1 +
    +
    + ADMX_WinCal/TurnOffWinCal_2 +
    +
    + + +
    + + +**ADMX_WinCal/TurnOffWinCal_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars. + +If you enable this setting, Windows Calendar will be turned off. + +If you disable or do not configure this setting, Windows Calendar will be turned on. + +The default is for Windows Calendar to be turned on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Calendar* +- GP name: *TurnOffWinCal_1* +- GP path: *Windows Components\Windows Calendar* +- GP ADMX file name: *WinCal.admx* + + + +
    + +
    + + +**ADMX_WinCal/TurnOffWinCal_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Windows Calendar is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars. + +If you enable this setting, Windows Calendar will be turned off. + +If you disable or do not configure this setting, Windows Calendar will be turned on. + +The default is for Windows Calendar to be turned on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Calendar* +- GP name: *TurnOffWinCal_2* +- GP path: *Windows Components\Windows Calendar* +- GP ADMX file name: *WinCal.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md b/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md new file mode 100644 index 0000000000..efff151d08 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md @@ -0,0 +1,115 @@ +--- +title: Policy CSP - ADMX_WindowsAnytimeUpgrade +description: Policy CSP - ADMX_WindowsAnytimeUpgrade +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/29/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsAnytimeUpgrade +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WindowsAnytimeUpgrade policies + +
    +
    + ADMX_WindowsAnytimeUpgrade/Disabled +
    +
    + + +
    + + +**ADMX_WindowsAnytimeUpgrade/Disabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. By default, Add features to Windows 10 is available for all administrators. + +If you enable this policy setting, the wizard will not run. + +If you disable this policy setting or set it to Not Configured, the wizard will run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent the wizard from running.* +- GP name: *Disabled* +- GP path: *Windows Components\Add features to Windows 10* +- GP ADMX file name: *WindowsAnytimeUpgrade.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md new file mode 100644 index 0000000000..086405efd2 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md @@ -0,0 +1,265 @@ +--- +title: Policy CSP - ADMX_WindowsConnectNow +description: Policy CSP - ADMX_WindowsConnectNow +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/28/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsConnectNow +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WindowsConnectNow policies + +
    +
    + ADMX_WindowsConnectNow/WCN_DisableWcnUi_1 +
    +
    + ADMX_WindowsConnectNow/WCN_DisableWcnUi_2 +
    +
    + ADMX_WindowsConnectNow/WCN_EnableRegistrar +
    +
    + + +
    + + +**ADMX_WindowsConnectNow/WCN_DisableWcnUi_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prohibits access to Windows Connect Now (WCN) wizards. + +If you enable this policy setting, the wizards are turned off and users have no access to any of the wizard tasks. All the configuration related tasks, including "Set up a wireless router or access point" and "Add a wireless device" are disabled. + +If you disable or do not configure this policy setting, users can access the wizard tasks, including "Set up a wireless router or access point" and "Add a wireless device." The default for this policy setting allows users to access all WCN wizards. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access of the Windows Connect Now wizards* +- GP name: *WCN_DisableWcnUi_1* +- GP path: *Network\Windows Connect Now* +- GP ADMX file name: *WindowsConnectNow.admx* + + + +
    + + +**ADMX_WindowsConnectNow/WCN_DisableWcnUi_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prohibits access to Windows Connect Now (WCN) wizards. + +If you enable this policy setting, the wizards are turned off and users have no access to any of the wizard tasks. All the configuration related tasks, including "Set up a wireless router or access point" and "Add a wireless device" are disabled. + +If you disable or do not configure this policy setting, users can access the wizard tasks, including "Set up a wireless router or access point" and "Add a wireless device." The default for this policy setting allows users to access all WCN wizards. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit access of the Windows Connect Now wizards* +- GP name: *WCN_DisableWcnUi_2* +- GP path: *Network\Windows Connect Now* +- GP ADMX file name: *WindowsConnectNow.admx* + + + +
    + + +**ADMX_WindowsConnectNow/WCN_EnableRegistrar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows the configuration of wireless settings using Windows Connect Now (WCN). The WCN Registrar enables the discovery and configuration of devices over Ethernet (UPnP), over In-band 802.11 WLAN, through the Windows Portable Device API (WPD), and via USB Flash drives. + +Additional options are available to allow discovery and configuration over a specific medium. + +If you enable this policy setting, additional choices are available to turn off the operations over a specific medium. + +If you disable this policy setting, operations are disabled over all media. + +If you do not configure this policy setting, operations are enabled over all media. + +The default for this policy setting allows operations over all media. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configuration of wireless settings using Windows Connect Now* +- GP name: *WCN_EnableRegistrar* +- GP path: *Network\Windows Connect Now* +- GP ADMX file name: *WindowsConnectNow.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md new file mode 100644 index 0000000000..004f66dae4 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -0,0 +1,5368 @@ +--- +title: Policy CSP - ADMX_WindowsExplorer +description: Policy CSP - ADMX_WindowsExplorer +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/29/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsExplorer +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + + +## ADMX_WindowsExplorer policies + +
    +
    + ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS +
    +
    + ADMX_WindowsExplorer/ClassicShell +
    +
    + ADMX_WindowsExplorer/ConfirmFileDelete +
    +
    + ADMX_WindowsExplorer/DefaultLibrariesLocation +
    +
    + ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage +
    +
    + ADMX_WindowsExplorer/DisableIndexedLibraryExperience +
    +
    + ADMX_WindowsExplorer/DisableKnownFolders +
    +
    + ADMX_WindowsExplorer/DisableSearchBoxSuggestions +
    +
    + ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath +
    +
    + ADMX_WindowsExplorer/EnableSmartScreen +
    +
    + ADMX_WindowsExplorer/EnforceShellExtensionSecurity +
    +
    + ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized +
    +
    + ADMX_WindowsExplorer/HideContentViewModeSnippets +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted +
    +
    + ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown +
    +
    + ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo +
    +
    + ADMX_WindowsExplorer/MaxRecentDocs +
    +
    + ADMX_WindowsExplorer/NoBackButton +
    +
    + ADMX_WindowsExplorer/NoCDBurning +
    +
    + ADMX_WindowsExplorer/NoCacheThumbNailPictures +
    +
    + ADMX_WindowsExplorer/NoChangeAnimation +
    +
    + ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators +
    +
    + ADMX_WindowsExplorer/NoDFSTab +
    +
    + ADMX_WindowsExplorer/NoDrives +
    +
    + ADMX_WindowsExplorer/NoEntireNetwork +
    +
    + ADMX_WindowsExplorer/NoFileMRU +
    +
    + ADMX_WindowsExplorer/NoFileMenu +
    +
    + ADMX_WindowsExplorer/NoFolderOptions +
    +
    + ADMX_WindowsExplorer/NoHardwareTab +
    +
    + ADMX_WindowsExplorer/NoManageMyComputerVerb +
    +
    + ADMX_WindowsExplorer/NoMyComputerSharedDocuments +
    +
    + ADMX_WindowsExplorer/NoNetConnectDisconnect +
    +
    + ADMX_WindowsExplorer/NoNewAppAlert +
    +
    + ADMX_WindowsExplorer/NoPlacesBar +
    +
    + ADMX_WindowsExplorer/NoRecycleFiles +
    +
    + ADMX_WindowsExplorer/NoRunAsInstallPrompt +
    +
    + ADMX_WindowsExplorer/NoSearchInternetTryHarderButton +
    +
    + ADMX_WindowsExplorer/NoSecurityTab +
    +
    + ADMX_WindowsExplorer/NoShellSearchButton +
    +
    + ADMX_WindowsExplorer/NoStrCmpLogical +
    +
    + ADMX_WindowsExplorer/NoViewContextMenu +
    +
    + ADMX_WindowsExplorer/NoViewOnDrive +
    +
    + ADMX_WindowsExplorer/NoWindowsHotKeys +
    +
    + ADMX_WindowsExplorer/NoWorkgroupContents +
    +
    + ADMX_WindowsExplorer/PlacesBar +
    +
    + ADMX_WindowsExplorer/PromptRunasInstallNetPath +
    +
    + ADMX_WindowsExplorer/RecycleBinSize +
    +
    + ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1 +
    +
    + ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2 +
    +
    + ADMX_WindowsExplorer/ShowHibernateOption +
    +
    + ADMX_WindowsExplorer/ShowSleepOption +
    +
    + ADMX_WindowsExplorer/TryHarderPinnedLibrary +
    +
    + ADMX_WindowsExplorer/TryHarderPinnedOpenSearch +
    +
    + + +
    + + +**ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent data loss when you change the target location for Folder Redirection, and the new and old targets point to the same network share, but have different network paths. + +If you enable this policy setting, Folder Redirection creates a temporary file in the old location in order to verify that new and old locations point to the same network share. If both new and old locations point to the same share, the target path is updated and files are not copied or deleted. The temporary file is deleted. + +If you disable or do not configure this policy setting, Folder Redirection does not create a temporary file and functions as if both new and old locations point to different shares when their network paths are different. + +> [!NOTE] +> If the paths point to different network shares, this policy setting is not required. If the paths point to the same network share, any data contained in the redirected folders is deleted if this policy setting is not enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Verify old and new Folder Redirection targets point to the same share before redirecting* +- GP name: *CheckSameSourceAndTargetForFRAndDFS* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
    + + +**ADMX_WindowsExplorer/ClassicShell** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting allows an administrator to revert specific Windows Shell behavior to classic Shell behavior. + +If you enable this setting, users cannot configure their system to open items by single-clicking (such as in Mouse in Control Panel). As a result, the user interface looks and operates like the interface for Windows NT 4.0, and users cannot restore the new features. + +Enabling this policy will also turn off the preview pane and set the folder options for File Explorer to Use classic folders view and disable the users ability to change these options. + +If you disable or not configure this policy, the default File Explorer behavior is applied to the user. + +> [!NOTE] +> In operating systems earlier than Windows Vista, enabling this policy will also disable the Active Desktop and Web view. This setting will also take precedence over the "Enable Active Desktop" setting. If both policies are enabled, Active Desktop is disabled. Also, see the "Disable Active Desktop" setting in User Configuration\Administrative Templates\Desktop\Active Desktop and the "Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon" setting in User Configuration\Administrative Templates\Windows Components\File Explorer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Classic Shell* +- GP name: *ClassicShell* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/ConfirmFileDelete** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Allows you to have File Explorer display a confirmation dialog whenever a file is deleted or moved to the Recycle Bin. + +If you enable this setting, a confirmation dialog is displayed when a file is deleted or moved to the Recycle Bin by the user. + +If you disable or do not configure this setting, the default behavior of not displaying a confirmation dialog occurs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display confirmation dialog when deleting files* +- GP name: *ConfirmFileDelete* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/DefaultLibrariesLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify a location where all default Library definition files for users/machines reside. + +If you enable this policy setting, administrators can specify a path where all default Library definition files for users reside. The user will not be allowed to make changes to these Libraries from the UI. On every logon, the policy settings are verified and Libraries for the user are updated or changed according to the path defined. + +If you disable or do not configure this policy setting, no changes are made to the location of the default Library definition files. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Location where all default Library definition files for users/machines reside.* +- GP name: *DefaultLibrariesLocation* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Changes the behavior of IShellFolder::BindToObject for IID_IPropertySetStorage to not bind directly to the IPropertySetStorage implementation, and to include the intermediate layers provided by the Property System. + +This behavior is consistent with Windows Vista's behavior in this scenario. + +This disables access to user-defined properties, and properties stored in NTFS secondary streams. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable binding directly to IPropertySetStorage without intermediate layers.* +- GP name: *DisableBindDirectlyToPropertySetStorage* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/DisableIndexedLibraryExperience** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Windows Libraries features that need indexed file metadata to function properly. + +If you enable this policy, some Windows Libraries features will be turned off to better handle included folders that have been redirected to non-indexed network locations. + +Setting this policy will: + +- Disable all Arrangement views except for "By Folder" +- Disable all Search filter suggestions other than "Date Modified" and "Size" +- Disable view of file content snippets in Content mode when search results are returned +- Disable ability to stack in the Context menu and Column headers +- Exclude Libraries from the scope of Start search This policy will not enable users to add unsupported locations to Libraries + +If you enable this policy, Windows Libraries features that rely on indexed file data will be disabled. + +If you disable or do not configure this policy, all default Windows Libraries features will be enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Libraries features that rely on indexed file data* +- GP name: *DisableIndexedLibraryExperience* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
    + + +**ADMX_WindowsExplorer/DisableKnownFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify a list of known folders that should be disabled. + +Disabling a known folder will prevent the underlying file or directory from being created via the known folder API. If the folder exists before the policy is applied, the folder must be manually deleted since the policy only blocks the creation of the folder. + +You can specify a known folder using its known folder id or using its canonical name. For example, the Sample Videos known folder can be disabled by specifying {440fcffd-a92b-4739-ae1a-d4a54907c53f} or SampleVideos. + +> [!NOTE] +> Disabling a known folder can introduce application compatibility issues in applications that depend on the existence of the known folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Known Folders* +- GP name: *DisableKnownFolders* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/DisableSearchBoxSuggestions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Disables suggesting recent queries for the Search Box and prevents entries into the Search Box from being stored in the registry for future references. + +File Explorer shows suggestion pop-ups as users type into the Search Box. + +These suggestions are based on their past entries into the Search Box. + +> [!NOTE] +> If you enable this policy, File Explorer will not show suggestion pop-ups as users type into the Search Box, and it will not store Search Box entries into the registry for future references. If the user types a property, values that match this property will be shown but no data will be saved in the registry or re-shown on subsequent uses of the search box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off display of recent search entries in the File Explorer search box* +- GP name: *DisableSearchBoxSuggestions* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
    + + +**ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether remote paths can be used for file shortcut (.lnk file) icons. + +If you enable this policy setting, file shortcut icons are allowed to be obtained from remote paths. + +If you disable or do not configure this policy setting, file shortcut icons that use remote paths are prevented from being displayed. + +> [!NOTE] +> Allowing the use of remote paths in file shortcut icons can expose users’ computers to security risks. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow the use of remote paths in file shortcut icons* +- GP name: *EnableShellShortcutIconRemotePath* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
    + + +**ADMX_WindowsExplorer/EnableSmartScreen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy allows you to turn Windows Defender SmartScreen on or off. SmartScreen helps protect PCs by warning users before running potentially malicious programs downloaded from the Internet. This warning is presented as an interstitial dialog shown before running an app that has been downloaded from the Internet and is unrecognized or known to be malicious. No dialog is shown for apps that do not appear to be suspicious. + +Some information is sent to Microsoft about files and programs run on PCs with this feature enabled. + +If you enable this policy, SmartScreen will be turned on for all users. Its behavior can be controlled by the following options: + +- Warn and prevent bypass +- Warn + +If you enable this policy with the "Warn and prevent bypass" option, SmartScreen's dialogs will not present the user with the option to disregard the warning and run the app. SmartScreen will continue to show the warning on subsequent attempts to run the app. If you enable this policy with the "Warn" option, SmartScreen's dialogs will warn the user that the app appears suspicious, but will permit the user to disregard the warning and run the app anyway. SmartScreen will not warn the user again for that app if the user tells SmartScreen to run the app. + +If you disable this policy, SmartScreen will be turned off for all users. Users will not be warned if they try to run suspicious apps from the Internet. + +If you do not configure this policy, SmartScreen will be enabled by default, but users may change their settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Windows Defender SmartScreen* +- GP name: *EnableSmartScreen* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/EnforceShellExtensionSecurity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This setting is designed to ensure that shell extensions can operate on a per-user basis. + +If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine. A shell extension only runs if there is an entry in at least one of the following locations in registry. + +For shell extensions that have been approved by the administrator and are available to all users of the computer, there must be an entry at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved. + +For shell extensions to run on a per-user basis, there must be an entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only per user or approved shell extensions* +- GP name: *EnforceShellExtensionSecurity* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify whether the ribbon appears minimized or in full when new File Explorer windows are opened. + +If you enable this policy setting, you can set how the ribbon appears the first time users open File Explorer and whenever they open new windows. + +If you disable or do not configure this policy setting, users can choose how the ribbon appears when they open new windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Start File Explorer with ribbon minimized* +- GP name: *ExplorerRibbonStartsMinimized* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/HideContentViewModeSnippets** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off the display of snippets in Content view mode. + +If you enable this policy setting, File Explorer will not display snippets in Content view mode. + +If you disable or do not configure this policy setting, File Explorer shows snippets in Content view mode by default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the display of snippets in Content view mode* +- GP name: *HideContentViewModeSnippets* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_Internet* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_InternetLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_Intranet* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_IntranetLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_LocalMachine* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_LocalMachineLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_Restricted* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_RestrictedLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_Trusted* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in File Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the File Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in File Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in File Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item. Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item. + +If you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +If you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using File Explorer. + +Changes to this setting may not be applied until the user logs off from Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP name: *IZ_Policy_OpenSearchPreview_TrustedLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_Internet* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_InternetLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_Intranet* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_IntranetLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_LocalMachine* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_LocalMachineLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_Restricted* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_RestrictedLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_Trusted* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in File Explorer. Search Connectors allow rich searching of remote sources from within File Explorer. Search results will be returned in File Explorer and can be acted upon like local files. + +If you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + +If you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors. + +If you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow OpenSearch queries in File Explorer* +- GP name: *IZ_Policy_OpenSearchQuery_TrustedLockdown* +- GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows traces shortcuts back to their sources when it cannot find the target on the user's system. + +Shortcut files typically include an absolute path to the original target file as well as the relative path to the current target file. When the system cannot find the file in the current target path, then, by default, it searches for the target in the original path. If the shortcut has been copied to a different computer, the original path might lead to a network computer, including external resources, such as an Internet server. + +If you enable this policy setting, Windows only searches the current target path. It does not search for the original path even when it cannot find the target file in the current target path. + +If you disable or do not configure this policy setting, Windows searches for the original path when it cannot find the target file in the current target path. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not track Shell shortcuts during roaming* +- GP name: *LinkResolveIgnoreLinkInfo* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/MaxRecentDocs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to set the maximum number of shortcuts the system can display in the Recent Items menu on the Start menu. The Recent Items menu contains shortcuts to the nonprogram files the user has most recently opened. + +If you enable this policy setting, the system displays the number of shortcuts specified by the policy setting. + +If you disable or do not configure this policy setting, by default, the system displays shortcuts to the 10 most recently opened documents. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maximum number of recent documents* +- GP name: *MaxRecentDocs* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoBackButton** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Hide the Back button in the Open dialog box. This policy setting lets you remove new features added in Microsoft Windows 2000 Professional, so the Open dialog box appears as it did in Windows NT 4.0 and earlier. This policy setting affects only programs that use the standard Open dialog box provided to developers of Windows programs. + +If you enable this policy setting, the Back button is removed from the standard Open dialog box. + +If you disable or do not configure this policy setting, the Back button is displayed for any standard Open dialog box. To see an example of the standard Open dialog box, start Notepad and, on the File menu, click Open. + +> [!NOTE] +> In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. Also, third-party applications with Windows 2000 or later certification to are required to adhere to this policy setting. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the common dialog back button* +- GP name: *NoBackButton* +- GP path: *Windows Components\File Explorer\Common Open File Dialog* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoCDBurning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove CD Burning features. File Explorer allows you to create and modify re-writable CDs if you have a CD writer connected to your PC. + +If you enable this policy setting, all features in the File Explorer that allow you to use your CD writer are removed. + +If you disable or do not configure this policy setting, users are able to use the File Explorer CD burning features. + +> [!NOTE] +> This policy setting does not prevent users from using third-party applications to create or modify CDs using a CD writer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove CD Burning features* +- GP name: *NoCDBurning* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoCacheThumbNailPictures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off caching of thumbnail pictures. + +If you enable this policy setting, thumbnail views are not cached. + +If you disable or do not configure this policy setting, thumbnail views are cached. + +> [!NOTE] +> For shared corporate workstations or computers where security is a top concern, you should enable this policy setting to turn off the thumbnail view cache, because the thumbnail cache can be read by everyone. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off caching of thumbnail pictures* +- GP name: *NoCacheThumbNailPictures* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoChangeAnimation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from enabling or disabling minor animations in the operating system for the movement of windows, menus, and lists. + +If you enable this policy setting, the "Use transition effects for menus and tooltips" option in Display in Control Panel is disabled, and cannot be toggled by users. + +Effects, such as animation, are designed to enhance the user's experience but might be confusing or distracting to some users. + +If you disable or do not configure this policy setting, users are allowed to turn on or off these minor system animations using the "Use transition effects for menus and tooltips" option in Display in Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove UI to change menu animation setting* +- GP name: *NoChangeAnimation* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Disables the "Hide keyboard navigation indicators until I use the ALT key" option in Display in Control Panel. When this Display Properties option is selected, the underlining that indicates a keyboard shortcut character (hot key) does not appear on menus until you press ALT. + +Effects, such as transitory underlines, are designed to enhance the user's experience but might be confusing or distracting to some users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove UI to change keyboard navigation indicator setting* +- GP name: *NoChangeKeyboardNavigationIndicators* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoDFSTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the DFS tab from File Explorer. + +If you enable this policy setting, the DFS (Distributed File System) tab is removed from File Explorer and from other programs that use the File Explorer browser, such as My Computer. As a result, users cannot use this tab to view or change the properties of the DFS shares available from their computer. This policy setting does not prevent users from using other methods to configure DFS. + +If you disable or do not configure this policy setting, the DFS tab is available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove DFS tab* +- GP name: *NoDFSTab* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoDrives** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to hide these specified drives in My Computer. + +This policy setting allows you to remove the icons representing selected hard drives from My Computer and File Explorer. Also, the drive letters representing the selected drives do not appear in the standard Open dialog box. + +If you enable this policy setting, select a drive or combination of drives in the drop-down list. + +> [!NOTE] +> This policy setting removes the drive icons. Users can still gain access to drive contents by using other methods, such as by typing the path to a directory on the drive in the Map Network Drive dialog box, in the Run dialog box, or in a command window. Also, this policy setting does not prevent users from using programs to access these drives or their contents. And, it does not prevent users from using the Disk Management snap-in to view and change drive characteristics. + +If you disable or do not configure this policy setting, all drives are displayed, or select the "Do not restrict drives" option in the drop-down list. Also, see the "Prevent access to drives from My Computer" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide these specified drives in My Computer* +- GP name: *NoDrives* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoEntireNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes all computers outside of the user's workgroup or local domain from lists of network resources in File Explorer and Network Locations. + +If you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option. + +This setting does not prevent users from viewing or connecting to computers in their workgroup or domain. It also does not prevent users from connecting to remote computers by other commonly used methods, such as by typing the share name in the Run dialog box or the Map Network Drive dialog box. + +To remove computers in the user's workgroup or domain from lists of network resources, use the "No Computers Near Me in Network Locations" setting. + +> [!NOTE] +> It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *No Entire Network in Network Locations* +- GP name: *NoEntireNetwork* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoFileMRU** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the list of most recently used files from the Open dialog box. + +If you disable this setting or do not configure it, the "File name" field includes a drop-down list of recently used files. If you enable this setting, the "File name" field is a simple text box. Users must browse directories to find a file or type a file name in the text box. + +This setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs. + +To see an example of the standard Open dialog box, start WordPad and, on the File menu, click Open. + +> [!NOTE] +> In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the dropdown list of recent files* +- GP name: *NoFileMRU* +- GP path: *Windows Components\File Explorer\Common Open File Dialog* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoFileMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the File menu from My Computer and File Explorer. + +This setting does not prevent users from using other methods to perform tasks available on the File menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove File menu from File Explorer* +- GP name: *NoFileMenu* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoFolderOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent users from accessing Folder Options through the View tab on the ribbon in File Explorer. + +Folder Options allows users to change the way files and folders open, what appears in the navigation pane, and other advanced view settings. + +If you enable this policy setting, users will receive an error message if they tap or click the Options button or choose the Change folder and search options command, and they will not be able to open Folder Options. + +If you disable or do not configure this policy setting, users can open Folder Options from the View tab on the ribbon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon* +- GP name: *NoFolderOptions* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoHardwareTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Hardware tab. This setting removes the Hardware tab from Mouse, Keyboard, and Sounds and Audio Devices in Control Panel. It also removes the Hardware tab from the Properties dialog box for all local drives, including hard drives, floppy disk drives, and CD-ROM drives. As a result, users cannot use the Hardware tab to view or change the device list or device properties, or use the Troubleshoot button to resolve problems with the device. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Hardware tab* +- GP name: *NoHardwareTab* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoManageMyComputerVerb** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Manage item from the File Explorer context menu. This context menu appears when you right-click File Explorer or My Computer. + +The Manage item opens Computer Management (Compmgmt.msc), a console tool that includes many of the primary Windows 2000 administrative tools, such as Event Viewer, Device Manager, and Disk Management. You must be an administrator to use many of the features of these tools. + +This setting does not remove the Computer Management item from the Start menu (Start, Programs, Administrative Tools, Computer Management), nor does it prevent users from using other methods to start Computer Management. + +> [!TIP] +> To hide all context menus, use the "Remove File Explorer's default context menu" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hides the Manage item on the File Explorer context menu* +- GP name: *NoManageMyComputerVerb* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoMyComputerSharedDocuments** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Shared Documents folder from My Computer. When a Windows client is in a workgroup, a Shared Documents icon appears in the File Explorer Web view under "Other Places" and also under "Files Stored on This Computer" in My Computer. Using this policy setting, you can choose not to have these items displayed. + +If you enable this policy setting, the Shared Documents folder is not displayed in the Web view or in My Computer. + +If you disable or do not configure this policy setting, the Shared Documents folder is displayed in Web view and also in My Computer when the client is part of a workgroup. + +> [!NOTE] +> The ability to remove the Shared Documents folder via Group Policy is only available on Windows XP Professional. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Shared Documents from My Computer* +- GP name: *NoMyComputerSharedDocuments* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoNetConnectDisconnect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from using File Explorer or Network Locations to map or disconnect network drives. + +If you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in File Explorer and Network Locations and from menus that appear when you right-click the File Explorer or Network Locations icons. + +This setting does not prevent users from connecting to another computer by typing the name of a shared folder in the Run dialog box. + +> [!NOTE] +> This setting was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab states incorrectly that this setting prevents users from connecting and disconnecting drives. +> +> It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove "Map Network Drive" and "Disconnect Network Drive"* +- GP name: *NoNetConnectDisconnect* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoNewAppAlert** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy removes the end-user notification for new application associations. These associations are based on file types (e.g. *.txt) or protocols (e.g. http:). + +If this group policy is enabled, no notifications will be shown. If the group policy is not configured or disabled, notifications will be shown to the end user if a new application has been installed that can handle the file type or protocol association that was invoked. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not show the 'new application installed' notification* +- GP name: *NoNewAppAlert* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoPlacesBar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the shortcut bar from the Open dialog box. This setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs. + +To see an example of the standard Open dialog box, start WordPad and, on the File menu, click Open. + +> [!NOTE] +> In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the common dialog places bar* +- GP name: *NoPlacesBar* +- GP path: *Windows Components\File Explorer\Common Open File Dialog* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoRecycleFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. When a file or folder is deleted in File Explorer, a copy of the file or folder is placed in the Recycle Bin. Using this setting, you can change this behavior. + +If you enable this setting, files and folders that are deleted using File Explorer will not be placed in the Recycle Bin and will therefore be permanently deleted. + +If you disable or do not configure this setting, files and folders deleted using File Explorer will be placed in the Recycle Bin. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not move deleted files to the Recycle Bin* +- GP name: *NoRecycleFiles* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoRunAsInstallPrompt** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from submitting alternate logon credentials to install a program. + +This setting suppresses the "Install Program As Other User" dialog box for local and network installations. This dialog box, which prompts the current user for the user name and password of an administrator, appears when users who are not administrators try to install programs locally on their computers. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials. + +Many programs can be installed only by an administrator. If you enable this setting and a user does not have sufficient permissions to install a program, the installation continues with the current user's logon credentials. As a result, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly. + +If you disable this setting or do not configure it, the "Install Program As Other User" dialog box appears whenever users install programs locally on the computer. + +By default, users are not prompted for alternate logon credentials when installing programs from a network share. If enabled, this setting overrides the "Request credentials for network installations" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not request alternate credentials* +- GP name: *NoRunAsInstallPrompt* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoSearchInternetTryHarderButton** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy, the "Internet" "Search again" link will not be shown when the user performs a search in the Explorer window. + +If you disable this policy, there will be an "Internet" "Search again" link when the user performs a search in the Explorer window. This button launches a search in the default browser with the search terms. + +If you do not configure this policy (default), there will be an "Internet" link when the user performs a search in the Explorer window. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the Search the Internet "Search again" link* +- GP name: *NoSearchInternetTryHarderButton* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoSecurityTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes the Security tab from File Explorer. + +If you enable this setting, users opening the Properties dialog box for all file system objects, including folders, files, shortcuts, and drives, will not be able to access the Security tab. As a result, users will be able to neither change the security settings nor view a list of all users that have access to the resource in question. + +If you disable or do not configure this setting, users will be able to access the security tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Security tab* +- GP name: *NoSecurityTab* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoShellSearchButton** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove the Search button from the File Explorer toolbar. If you enable this policy setting, the Search button is removed from the Standard Buttons toolbar that appears in File Explorer and other programs that use the File Explorer window, such as My Computer and Network Locations. Enabling this policy setting does not remove the Search button or affect any search features of Internet browser windows, such as the Internet Explorer window. + +If you disable or do not configure this policy setting, the Search button is available from the File Explorer toolbar. + +This policy setting does not affect the Search items on the File Explorer context menu or on the Start menu. To remove Search from the Start menu, use the "Remove Search menu from Start menu" policy setting (in User Configuration\Administrative Templates\Start Menu and Taskbar). To hide all context menus, use the "Remove File Explorer's default context menu" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Search button from File Explorer* +- GP name: *NoShellSearchButton* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoStrCmpLogical** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to have file names sorted literally (as in Windows 2000 and earlier) rather than in numerical order. + +If you enable this policy setting, File Explorer will sort file names by each digit in a file name (for example, 111 < 22 < 3). + +If you disable or do not configure this policy setting, File Explorer will sort file names by increasing number value (for example, 3 < 22 < 111). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off numerical sorting in File Explorer* +- GP name: *NoStrCmpLogical* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoViewContextMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Removes shortcut menus from the desktop and File Explorer. Shortcut menus appear when you right-click an item. + +If you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in File Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove File Explorer's default context menu* +- GP name: *NoViewContextMenu* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoViewOnDrive** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from using My Computer to gain access to the content of selected drives. + +If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives. + +To use this setting, select a drive or combination of drives from the drop-down list. To allow access to all drive directories, disable this setting or select the "Do not restrict drives" option from the drop-down list. + +> [!NOTE] +> The icons representing the specified drives still appear in My Computer, but if users double-click the icons, a message appears explaining that a setting prevents the action. +> +> Also, this setting does not prevent users from using programs to access local and network drives. And, it does not prevent them from using the Disk Management snap-in to view and change drive characteristics. Also, see the "Hide these specified drives in My Computer" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent access to drives from My Computer* +- GP name: *NoViewOnDrive* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoWindowsHotKeys** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Turn off Windows Key hotkeys. Keyboards with a Windows key provide users with shortcuts to common shell features. For example, pressing the keyboard sequence Windows+R opens the Run dialog box; pressing Windows+E starts File Explorer. + +By using this setting, you can disable these Windows Key hotkeys. + +If you enable this setting, the Windows Key hotkeys are unavailable. + +If you disable or do not configure this setting, the Windows Key hotkeys are available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Key hotkeys* +- GP name: *NoWindowsHotKeys* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/NoWorkgroupContents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove computers in the user's workgroup and domain from lists of network resources in File Explorer and Network Locations. + +If you enable this policy setting, the system removes the "Computers Near Me" option and the icons representing nearby computers from Network Locations. This policy setting also removes these icons from the Map Network Drive browser. + +If you disable or do not configure this policy setting, computers in the user's workgroup and domain appear in lists of network resources in File Explorer and Network Locations. + +This policy setting does not prevent users from connecting to computers in their workgroup or domain by other commonly used methods, such as typing the share name in the Run dialog box or the Map Network Drive dialog box. + +To remove network computers from lists of network resources, use the "No Entire Network in Network Locations" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *No Computers Near Me in Network Locations* +- GP name: *NoWorkgroupContents* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/PlacesBar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Configures the list of items displayed in the Places Bar in the Windows File/Open dialog. If enable this setting you can specify from 1 to 5 items to be displayed in the Places Bar. + +The valid items you may display in the Places Bar are: + +1. Shortcuts to a local folders -- (example: `C:\Windows`) +2. Shortcuts to remote folders -- (`\\server\share`) +3. FTP folders +4. web folders +5. Common Shell folders. + +The list of Common Shell Folders that may be specified: + +Desktop, Recent Places, Documents, Pictures, Music, Recently Changed, Attachments and Saved Searches. + +If you disable or do not configure this setting the default list of items will be displayed in the Places Bar. + +> [!NOTE] +> In Windows Vista, this policy setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Items displayed in Places Bar* +- GP name: *PlacesBar* +- GP path: *Windows Components\File Explorer\Common Open File Dialog* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/PromptRunasInstallNetPath** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Prompts users for alternate logon credentials during network-based installations. + +This setting displays the "Install Program As Other User" dialog box even when a program is being installed from files on a network computer across a local area network connection. + +If you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media. + +The "Install Program as Other User" dialog box prompts the current user for the user name and password of an administrator. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials. + +If the dialog box does not appear, the installation proceeds with the current user's permissions. If these permissions are not sufficient, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly. + +> [!NOTE] +> If it is enabled, the "Do not request alternate credentials" setting takes precedence over this setting. When that setting is enabled, users are not prompted for alternate logon credentials on any installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Request credentials for network installations* +- GP name: *PromptRunasInstallNetPath* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/RecycleBinSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Limits the percentage of a volume's disk space that can be used to store deleted files. + +If you enable this setting, the user has a maximum amount of disk space that may be used for the Recycle Bin on their workstation. + +If you disable or do not configure this setting, users can change the total amount of disk space used by the Recycle Bin. + +> [!NOTE] +> This setting is applied to all volumes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maximum allowed Recycle Bin size* +- GP name: *RecycleBinSize* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows. + +If you enable this policy setting the protocol is fully enabled, allowing the opening of folders and files. + +If you disable this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. + +If you do not configure this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off shell protocol protected mode* +- GP name: *ShellProtocolProtectedModeTitle_1* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows. + +If you enable this policy setting the protocol is fully enabled, allowing the opening of folders and files. + +If you disable this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. + +If you do not configure this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off shell protocol protected mode* +- GP name: *ShellProtocolProtectedModeTitle_2* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/ShowHibernateOption** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Shows or hides hibernate from the power options menu. + +If you enable this policy setting, the hibernate option will be shown in the Power Options menu (as long as it is supported by the machine's hardware). + +If you disable this policy setting, the hibernate option will never be shown in the Power Options menu. + +If you do not configure this policy setting, users will be able to choose whether they want hibernate to show through the Power Options Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show hibernate in the power options menu* +- GP name: *ShowHibernateOption* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/ShowSleepOption** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Shows or hides sleep from the power options menu. + +If you enable this policy setting, the sleep option will be shown in the Power Options menu (as long as it is supported by the machine's hardware). + +If you disable this policy setting, the sleep option will never be shown in the Power Options menu. + +If you do not configure this policy setting, users will be able to choose whether they want sleep to show through the Power Options Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Show sleep in the power options menu* +- GP name: *ShowSleepOption* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/TryHarderPinnedLibrary** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows up to five Libraries or Search Connectors to be pinned to the "Search again" links and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location. To add a Library or Search Connector link, specify the path of the .Library-ms or .searchConnector-ms file in the "Location" text box (for example, "C:\sampleLibrary.Library-ms" for the Documents library, or "C:\sampleSearchConnector.searchConnector-ms" for a Search Connector). The pinned link will only work if this path is valid and the location contains the specified .Library-ms or .searchConnector-ms file. + +You can add up to five additional links to the "Search again" links at the bottom of results returned in File Explorer after a search is executed. These links will be shared between Internet search sites and Search Connectors/Libraries. Search Connector/Library links take precedence over Internet search links. + +The first several links will also be pinned to the Start menu. A total of four links can be included on the Start menu. The "See more results" link will be pinned first by default, unless it is disabled via Group Policy. The "Search the Internet" link is pinned second, if it is pinned via Group Policy (though this link is disabled by default). If a custom Internet search link is pinned using the "Custom Internet search provider" Group Policy, this link will be pinned third on the Start menu. The remaining link(s) will be shared between pinned Search Connectors/Libraries and pinned Internet/intranet search links. Search Connector/Library links take precedence over Internet/intranet search links. + +If you enable this policy setting, the specified Libraries or Search Connectors will appear in the "Search again" links and the Start menu links. + +If you disable or do not configure this policy setting, no Libraries or Search Connectors will appear in the "Search again" links or the Start menu links. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Pin Libraries or Search Connectors to the "Search again" links and the Start menu* +- GP name: *TryHarderPinnedLibrary* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + + +**ADMX_WindowsExplorer/TryHarderPinnedOpenSearch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to add Internet or intranet sites to the "Search again" links located at the bottom of search results in File Explorer and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location. The Internet search site will be searched with the text in the search box. To add an Internet search site, specify the URL of the search site in OpenSearch format with {searchTerms} for the query string (for example, http://www.example.com/results.aspx?q={searchTerms}). + +You can add up to five additional links to the "Search again" links at the bottom of results returned in File Explorer after a search is executed. These links will be shared between Internet search sites and Search Connectors/Libraries. Search Connector/Library links take precedence over Internet search links. + +The first several links will also be pinned to the Start menu. A total of four links can be pinned on the Start menu. The "See more results" link will be pinned first by default, unless it is disabled via Group Policy. The "Search the Internet" link is pinned second, if it is pinned via Group Policy (though this link is disabled by default). If a custom Internet search link is pinned using the "Custom Internet search provider" Group Policy, this link will be pinned third on the Start menu. The remaining link(s) will be shared between pinned Internet/intranet links and pinned Search Connectors/Libraries. Search Connector/Library links take precedence over Internet/intranet search links. + +If you enable this policy setting, the specified Internet sites will appear in the "Search again" links and the Start menu links. + +If you disable or do not configure this policy setting, no custom Internet search sites will be added to the "Search again" links or the Start menu links. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Pin Internet search sites to the "Search again" links and the Start menu* +- GP name: *TryHarderPinnedOpenSearch* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md new file mode 100644 index 0000000000..66570c3061 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md @@ -0,0 +1,117 @@ +--- +title: Policy CSP - ADMX_WindowsMediaDRM +description: Policy CSP - ADMX_WindowsMediaDRM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsMediaDRM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WindowsMediaDRM policies + +
    +
    + ADMX_WindowsMediaDRM/DisableOnline +
    +
    + + +
    + + +**ADMX_WindowsMediaDRM/DisableOnline** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet). + +When enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades. + +When this policy is enabled, programs are not able to acquire licenses for secure content, upgrade Windows Media DRM security components, or restore backed up content licenses. Secure content that is already licensed to the local computer will continue to play. Users are also able to protect music that they copy from a CD and play this protected content on their computer, since the license is generated locally in this scenario. + +When this policy is either disabled or not configured, Windows Media DRM functions normally and will connect to the Internet (or intranet) to acquire licenses, download security upgrades, and perform license restoration. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Windows Media DRM Internet Access* +- GP name: *DisableOnline* +- GP path: *Windows Components\Windows Media Digital Rights Management* +- GP ADMX file name: *WindowsMediaDRM.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md new file mode 100644 index 0000000000..f0273482cf --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md @@ -0,0 +1,1615 @@ +--- +title: Policy CSP - ADMX_WindowsMediaPlayer +description: Policy CSP - ADMX_WindowsMediaPlayer +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsMediaPlayer +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WindowsMediaPlayer policies + +
    +
    + ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings +
    +
    + ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings +
    +
    + ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings +
    +
    + ADMX_WindowsMediaPlayer/DisableAutoUpdate +
    +
    + ADMX_WindowsMediaPlayer/DisableNetworkSettings +
    +
    + ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration +
    +
    + ADMX_WindowsMediaPlayer/DoNotShowAnchor +
    +
    + ADMX_WindowsMediaPlayer/DontUseFrameInterpolation +
    +
    + ADMX_WindowsMediaPlayer/EnableScreenSaver +
    +
    + ADMX_WindowsMediaPlayer/HidePrivacyTab +
    +
    + ADMX_WindowsMediaPlayer/HideSecurityTab +
    +
    + ADMX_WindowsMediaPlayer/NetworkBuffering +
    +
    + ADMX_WindowsMediaPlayer/PolicyCodecUpdate +
    +
    + ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval +
    +
    + ADMX_WindowsMediaPlayer/PreventLibrarySharing +
    +
    + ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval +
    +
    + ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut +
    +
    + ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval +
    +
    + ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut +
    +
    + ADMX_WindowsMediaPlayer/SkinLockDown +
    +
    + ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols +
    +
    + + +
    + + +**ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the HTTP proxy settings for Windows Media Player. + +If you enable this policy setting, select one of the following proxy types: + +- Autodetect: the proxy settings are automatically detected. +- Custom: unique proxy settings are used. +- Use browser proxy settings: browser's proxy settings are used. + +If the Custom proxy type is selected, the rest of the options on the Setting tab must be specified because no default settings are used for the proxy. The options are ignored if Autodetect or Browser is selected. + +The Configure button on the Network tab in the Player is not available for the HTTP protocol and the proxy cannot be configured. If the "Hide network tab" policy setting is also enabled, the entire Network tab is hidden. + +This policy is ignored if the "Streaming media protocols" policy setting is enabled and HTTP is not selected. + +If you disable this policy setting, the HTTP proxy server cannot be used and the user cannot configure the HTTP proxy. + +If you do not configure this policy setting, users can configure the HTTP proxy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure HTTP Proxy* +- GP name: *ConfigureHTTPProxySettings* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the MMS proxy settings for Windows Media Player. + +If you enable this policy setting, select one of the following proxy types: + +- Autodetect: the proxy settings are automatically detected. +- Custom: unique proxy settings are used. + +If the Custom proxy type is selected, the rest of the options on the Setting tab must be specified; otherwise, the default settings are used. The options are ignored if Autodetect is selected. + +The Configure button on the Network tab in the Player is not available and the protocol cannot be configured. If the "Hide network tab" policy setting is also enabled, the entire Network tab is hidden. + +This policy setting is ignored if the "Streaming media protocols" policy setting is enabled and Multicast is not selected. + +If you disable this policy setting, the MMS proxy server cannot be used and users cannot configure the MMS proxy settings. + +If you do not configure this policy setting, users can configure the MMS proxy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure MMS Proxy* +- GP name: *ConfigureMMSProxySettings* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the RTSP proxy settings for Windows Media Player. + +If you enable this policy setting, select one of the following proxy types: + +- Autodetect: the proxy settings are automatically detected. +- Custom: unique proxy settings are used. + +If the Custom proxy type is selected, the rest of the options on the Setting tab must be specified; otherwise, the default settings are used. The options are ignored if Autodetect is selected. + +The Configure button on the Network tab in the Player is not available and the protocol cannot be configured. If the "Hide network tab" policy setting is also enabled, the entire Network tab is hidden. + +If you disable this policy setting, the RTSP proxy server cannot be used and users cannot change the RTSP proxy settings. + +If you do not configure this policy setting, users can configure the RTSP proxy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure RTSP Proxy* +- GP name: *ConfigureRTSPProxySettings* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/DisableAutoUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off do not show first use dialog boxes. + +If you enable this policy setting, the Privacy Options and Installation Options dialog boxes are prevented from being displayed the first time a user starts Windows Media Player. + +This policy setting prevents the dialog boxes which allow users to select privacy, file types, and other desktop options from being displayed when the Player is first started. Some of the options can be configured by using other Windows Media Player group policies. + +If you disable or do not configure this policy setting, the dialog boxes are displayed when the user starts the Player for the first time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Automatic Updates* +- GP name: *DisableAutoUpdate* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/DisableNetworkSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to hide the Network tab. + +If you enable this policy setting, the Network tab in Windows Media Player is hidden. The default network settings are used unless the user has previously defined network settings for the Player. + +If you disable or do not configure this policy setting, the Network tab appears and users can use it to configure network settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Network Tab* +- GP name: *DisableNetworkSettings* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent the anchor window from being displayed when Windows Media Player is in skin mode. + +If you enable this policy setting, the anchor window is hidden when the Player is in skin mode. In addition, the option on the Player tab in the Player that enables users to choose whether the anchor window displays is not available. + +If you disable or do not configure this policy setting, users can show or hide the anchor window when the Player is in skin mode by using the Player tab in the Player. + +If you do not configure this policy setting, and the "Set and lock skin" policy setting is enabled, some options in the anchor window are not available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do Not Show First Use Dialog Boxes* +- GP name: *DisableSetupFirstUseConfiguration* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/DoNotShowAnchor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the anchor window from being displayed when Windows Media Player is in skin mode. + +This policy hides the anchor window when the Player is in skin mode. In addition, the option on the Player tab in the Player that enables users to choose whether the anchor window displays is not available. + +When this policy is not configured or disabled, users can show or hide the anchor window when the Player is in skin mode by using the Player tab in the Player. + +When this policy is not configured and the Set and Lock Skin policy is enabled, some options in the anchor window are not available. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do Not Show Anchor* +- GP name: *DoNotShowAnchor* +- GP path: *Windows Components\Windows Media Player\User Interface* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/DontUseFrameInterpolation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent video smoothing from occurring. + +If you enable this policy setting, video smoothing is prevented, which can improve video playback on computers with limited resources. In addition, the Use Video Smoothing check box in the Video Acceleration Settings dialog box in the Player is cleared and is not available. + +If you disable this policy setting, video smoothing occurs if necessary, and the Use Video Smoothing check box is selected and is not available. + +If you do not configure this policy setting, video smoothing occurs if necessary. Users can change the setting for the Use Video Smoothing check box. + +Video smoothing is available only on the Windows XP Home Edition and Windows XP Professional operating systems. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Video Smoothing* +- GP name: *DontUseFrameInterpolation* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/EnableScreenSaver** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows a screen saver to interrupt playback. + +If you enable this policy setting, a screen saver is displayed during playback of digital media according to the options selected on the Screen Saver tab in the Display Properties dialog box in Control Panel. The Allow screen saver during playback check box on the Player tab in the Player is selected and is not available. + +If you disable this policy setting, a screen saver does not interrupt playback even if users have selected a screen saver. The Allow screen saver during playback check box is cleared and is not available. + +If you do not configure this policy setting, users can change the setting for the Allow screen saver during playback check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow Screen Saver* +- GP name: *EnableScreenSaver* +- GP path: *Windows Components\Windows Media Player\Playback* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/HidePrivacyTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to hide the Privacy tab in Windows Media Player. + +If you enable this policy setting, the "Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet" check box on the Media Library tab is available, even though the Privacy tab is hidden, unless the "Prevent music file media information retrieval" policy setting is enabled. + +The default privacy settings are used for the options on the Privacy tab unless the user changed the settings previously. + +If you disable or do not configure this policy setting, the Privacy tab is not hidden, and users can configure any privacy settings not configured by other polices. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Automatic Updates* +- GP name: *HidePrivacyTab* +- GP path: *Windows Components\Windows Media Player\User Interface* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/HideSecurityTab** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to hide the Security tab in Windows Media Player. + +If you enable this policy setting, the default security settings for the options on the Security tab are used unless the user changed the settings previously. Users can still change security and zone settings by using Internet Explorer unless these settings have been hidden or disabled by Internet Explorer policies. + +If you disable or do not configure this policy setting, users can configure the security settings on the Security tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Security Tab* +- GP name: *HideSecurityTab* +- GP path: *Windows Components\Windows Media Player\User Interface* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/NetworkBuffering** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify whether network buffering uses the default or a specified number of seconds. + +If you enable this policy setting, select one of the following options to specify the number of seconds streaming media is buffered before it is played. + +- Custom: the number of seconds, up to 60, that streaming media is buffered. +- Default: default network buffering is used and the number of seconds that is specified is ignored. + +The "Use default buffering" and "Buffer" options on the Performance tab in the Player are not available. + +If you disable or do not configure this policy setting, users can change the buffering options on the Performance tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Network Buffering* +- GP name: *NetworkBuffering* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/PolicyCodecUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows Media Player from downloading codecs. + +If you enable this policy setting, the Player is prevented from automatically downloading codecs to your computer. In addition, the Download codecs automatically check box on the Player tab in the Player is not available. + +If you disable this policy setting, codecs are automatically downloaded and the Download codecs automatically check box is not available. + +If you do not configure this policy setting, users can change the setting for the Download codecs automatically check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Codec Download* +- GP name: *PolicyCodecUpdate* +- GP path: *Windows Components\Windows Media Player\Playback* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent media information for CDs and DVDs from being retrieved from the Internet. + +If you enable this policy setting, the Player is prevented from automatically obtaining media information from the Internet for CDs and DVDs played by users. In addition, the Retrieve media information for CDs and DVDs from the Internet check box on the Privacy Options tab in the first use dialog box and on the Privacy tab in the Player are not selected and are not available. + +If you disable or do not configure this policy setting, users can change the setting of the Retrieve media information for CDs and DVDs from the Internet check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent CD and DVD Media Information Retrieval* +- GP name: *PreventCDDVDMetadataRetrieval* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/PreventLibrarySharing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent media sharing from Windows Media Player. + +If you enable this policy setting, any user on this computer is prevented from sharing digital media content from Windows Media Player with other computers and devices that are on the same network. Media sharing is disabled from Windows Media Player or from programs that depend on the Player's media sharing feature. + +If you disable or do not configure this policy setting, anyone using Windows Media Player can turn media sharing on or off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Media Sharing* +- GP name: *PreventLibrarySharing* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent media information for music files from being retrieved from the Internet. + +If you enable this policy setting, the Player is prevented from automatically obtaining media information for music files such as Windows Media Audio (WMA) and MP3 files from the Internet. In addition, the Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet check box in the first use dialog box and on the Privacy and Media Library tabs in the Player are not selected and are not available. + +If you disable or do not configure this policy setting, users can change the setting of the Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet check box. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Music File Media Information Retrieval* +- GP name: *PreventMusicFileMetadataRetrieval* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent a shortcut for the Player from being added to the Quick Launch bar. + +If you enable this policy setting, the user cannot add the shortcut for the Player to the Quick Launch bar. + +If you disable or do not configure this policy setting, the user can choose whether to add the shortcut for the Player to the Quick Launch bar. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Quick Launch Toolbar Shortcut Creation* +- GP name: *PreventQuickLaunchShortcut* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent radio station presets from being retrieved from the Internet. + +If you enable this policy setting, the Player is prevented from automatically retrieving radio station presets from the Internet and displaying them in Media Library. In addition, presets that exist before the policy is configured are not be updated, and presets a user adds are not be displayed. + +If you disable or do not configure this policy setting, the Player automatically retrieves radio station presets from the Internet. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *PPrevent Radio Station Preset Retrieval* +- GP name: *PreventRadioPresetsRetrieval* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent a shortcut icon for the Player from being added to the user's desktop. + +If you enable this policy setting, users cannot add the Player shortcut icon to their desktops. + +If you disable or do not configure this policy setting, users can choose whether to add the Player shortcut icon to their desktops. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Desktop Shortcut Creation* +- GP name: *PreventWMPDeskTopShortcut* +- GP path: *Windows Components\Windows Media Player* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/SkinLockDown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to set and lock Windows Media Player in skin mode, using a specified skin. + +If you enable this policy setting, the Player displays only in skin mode using the skin specified in the Skin box on the Setting tab. + +You must use the complete file name for the skin (for example, skin_name.wmz), and the skin must be installed in the %programfiles%\Windows Media Player\Skins Folder on a user's computer. If the skin is not installed on a user's computer, or if the Skin box is blank, the Player opens by using the Corporate skin. The only way to specify the Corporate skin is to leave the Skin box blank. + +A user has access only to the Player features that are available with the specified skin. Users cannot switch the Player to full mode and cannot choose a different skin. + +If you disable or do not configure this policy setting, users can display the Player in full or skin mode and have access to all available features of the Player. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set and Lock Skin* +- GP name: *SkinLockDown* +- GP path: *Windows Components\Windows Media Player\User Interface* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + + +**ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify that Windows Media Player can attempt to use selected protocols when receiving streaming media from a server running Windows Media Services. + +If you enable this policy setting, the protocols that are selected on the Network tab of the Player are used to receive a stream initiated through an MMS or RTSP URL from a Windows Media server. If the RSTP/UDP check box is selected, a user can specify UDP ports in the Use ports check box. If the user does not specify UDP ports, the Player uses default ports when using the UDP protocol. This policy setting also specifies that multicast streams can be received if the "Allow the Player to receive multicast streams" check box on the Network tab is selected. + +If you enable this policy setting, the administrator must also specify the protocols that are available to users on the Network tab. If the administrator does not specify any protocols, the Player cannot access an MMS or RTSP URL from a Windows Media server. If the "Hide network tab" policy setting is enabled, the entire Network tab is hidden. + +If you do not configure this policy setting, users can select the protocols to use on the Network tab. + +If you disable this policy setting, the Protocols for MMS URLs and Multicast streams areas of the Network tab are not available and the Player cannot receive an MMS or RTSP stream from a Windows Media server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Streaming Media Protocols* +- GP name: *WindowsStreamingMediaProtocols* +- GP path: *Windows Components\Windows Media Player\Networking* +- GP ADMX file name: *WindowsMediaPlayer.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md new file mode 100644 index 0000000000..dc7bcf1f15 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md @@ -0,0 +1,185 @@ +--- +title: Policy CSP - ADMX_WindowsRemoteManagement +description: Policy CSP - ADMX_WindowsRemoteManagement +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/16/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsRemoteManagement +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WindowsRemoteManagement policies + +
    +
    + ADMX_WindowsRemoteManagement/DisallowKerberos_1 +
    +
    + ADMX_WindowsRemoteManagement/DisallowKerberos_2 +
    +
    + + +
    + + +**ADMX_WindowsRemoteManagement/DisallowKerberos_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Kerberos credentials over the network. + +If you enable this policy setting, the WinRM service does not accept Kerberos credentials over the network. If you disable or do not configure this policy setting, the WinRM service accepts Kerberos authentication from a remote client. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow Kerberos authentication* +- GP name: *DisallowKerberos_1* +- GP path: *Windows Components\Windows Remote Management (WinRM)\WinRM Service* +- GP ADMX file name: *WindowsRemoteManagement.admx* + + + + +
    + + +**ADMX_WindowsRemoteManagement/DisallowKerberos_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Kerberos authentication directly. + +If you enable this policy setting, the Windows Remote Management (WinRM) client does not use Kerberos authentication directly. Kerberos can still be used if the WinRM client is using the Negotiate authentication and Kerberos is selected. + +If you disable or do not configure this policy setting, the WinRM client uses the Kerberos authentication directly. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow Kerberos authentication* +- GP name: *DisallowKerberos_2* +- GP path: *Windows Components\Windows Remote Management (WinRM)\WinRM Client* +- GP ADMX file name: *WindowsRemoteManagement.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-windowsstore.md b/windows/client-management/mdm/policy-csp-admx-windowsstore.md new file mode 100644 index 0000000000..cec2e2bd4f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsstore.md @@ -0,0 +1,409 @@ +--- +title: Policy CSP - ADMX_WindowsStore +description: Policy CSP - ADMX_WindowsStore +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/26/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsStore +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WindowsStore policies + +
    +
    + ADMX_WindowsStore/DisableAutoDownloadWin8 +
    +
    + ADMX_WindowsStore/DisableOSUpgrade_1 +
    +
    + ADMX_WindowsStore/DisableOSUpgrade_2 +
    +
    + ADMX_WindowsStore/RemoveWindowsStore_1 +
    +
    + ADMX_WindowsStore/RemoveWindowsStore_2 +
    +
    + + +
    + + +**ADMX_WindowsStore/DisableAutoDownloadWin8** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables or disables the automatic download of app updates on PCs running Windows 8. + +If you enable this setting, the automatic download of app updates is turned off. If you disable this setting, the automatic download of app updates is turned on. + +If you don't configure this setting, the automatic download of app updates is determined by a registry setting that the user can change using Settings in the Windows Store. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Automatic Download of updates on Win8 machines* +- GP name: *DisableAutoDownloadWin8* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
    + +
    + + +**ADMX_WindowsStore/DisableOSUpgrade_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables or disables the Store offer to update to the latest version of Windows. + +If you enable this setting, the Store application will not offer updates to the latest version of Windows. + +If you disable or do not configure this setting the Store application will offer updates to the latest version of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the offer to update to the latest version of Windows* +- GP name: *DisableOSUpgrade_1* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
    + +
    + + +**ADMX_WindowsStore/DisableOSUpgrade_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables or disables the Store offer to update to the latest version of Windows. + +If you enable this setting, the Store application will not offer updates to the latest version of Windows. + +If you disable or do not configure this setting the Store application will offer updates to the latest version of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the offer to update to the latest version of Windows* +- GP name: *DisableOSUpgrade_2* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
    + +
    + + +**ADMX_WindowsStore/RemoveWindowsStore_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies or allows access to the Store application. + +If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates. + +If you disable or don't configure this setting, access to the Store application is allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the Store application* +- GP name: *RemoveWindowsStore_1* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
    + +
    + + +**ADMX_WindowsStore/RemoveWindowsStore_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies or allows access to the Store application. + +If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates. + +If you disable or don't configure this setting, access to the Store application is allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the Store application* +- GP name: *RemoveWindowsStore_2* +- GP path: *Windows Components\Store* +- GP ADMX file name: *WindowsStore.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-wininit.md b/windows/client-management/mdm/policy-csp-admx-wininit.md new file mode 100644 index 0000000000..93d25c2f1e --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wininit.md @@ -0,0 +1,259 @@ +--- +title: Policy CSP - ADMX_WinInit +description: Policy CSP - ADMX_WinInit +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/29/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WinInit +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WinInit policies + +
    +
    + ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription +
    +
    + ADMX_WinInit/Hiberboot +
    +
    + ADMX_WinInit/ShutdownTimeoutHungSessionsDescription +
    +
    + + +
    + + +**ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the legacy remote shutdown interface (named pipe). The named pipe remote shutdown interface is needed in order to shutdown this system from a remote Windows XP or Windows Server 2003 system. + +If you enable this policy setting, the system does not create the named pipe remote shutdown interface. + +If you disable or do not configure this policy setting, the system creates the named pipe remote shutdown interface. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off legacy remote shutdown interface* +- GP name: *DisableNamedPipeShutdownPolicyDescription* +- GP path: *Windows Components\Shutdown Options* +- GP ADMX file name: *WinInit.admx* + + + +
    + + +**ADMX_WinInit/Hiberboot** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the use of fast startup. + +If you enable this policy setting, the system requires hibernate to be enabled. + +If you disable or do not configure this policy setting, the local setting is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require use of fast startup* +- GP name: *Hiberboot* +- GP path: *System\Shutdown* +- GP ADMX file name: *WinInit.admx* + + + +
    + + +**ADMX_WinInit/ShutdownTimeoutHungSessionsDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the number of minutes the system waits for the hung logon sessions before proceeding with the system shutdown. + +If you enable this policy setting, the system waits for the hung logon sessions for the number of minutes specified. + +If you disable or do not configure this policy setting, the default timeout value is 3 minutes for workstations and 15 minutes for servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Timeout for hung logon sessions during shutdown* +- GP name: *ShutdownTimeoutHungSessionsDescription* +- GP path: *Windows Components\Shutdown Options* +- GP ADMX file name: *WinInit.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md new file mode 100644 index 0000000000..f1998bb579 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -0,0 +1,494 @@ +--- +title: Policy CSP - ADMX_WinLogon +description: Policy CSP - ADMX_WinLogon +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WinLogon +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WinLogon policies + +
    +
    + ADMX_WinLogon/CustomShell +
    +
    + ADMX_WinLogon/DisplayLastLogonInfoDescription +
    +
    + ADMX_WinLogon/LogonHoursNotificationPolicyDescription +
    +
    + ADMX_WinLogon/LogonHoursPolicyDescription +
    +
    + ADMX_WinLogon/ReportCachedLogonPolicyDescription +
    +
    + ADMX_WinLogon/SoftwareSASGeneration +
    +
    + + +
    + + +**ADMX_WinLogon/CustomShell** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies an alternate user interface. The Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, but you can use this setting to specify an alternate interface. + +If you enable this setting, the system starts the interface you specify instead of Explorer.exe. To use this setting, copy your interface program to a network share or to your system drive. Then, enable this setting, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file is not located in a folder specified in the Path environment variable for your system, enter the fully qualified path to the file. + +If you disable this setting or do not configure it, the setting is ignored and the system displays the Explorer interface. + +> [!TIP] +> To find the folders indicated by the Path environment variable, click System Properties in Control Panel, click the Advanced tab, click the Environment Variables button, and then, in the System variables box, click Path. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom User Interface* +- GP name: *CustomShell* +- GP path: *System* +- GP ADMX file name: *WinLogon.admx* + + + +
    + + +**ADMX_WinLogon/DisplayLastLogonInfoDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not the system displays information about previous logons and logon failures to the user. + +For local user accounts and domain user accounts in domains of at least a Windows Server 2008 functional level, if you enable this setting, a message appears after the user logs on that displays the date and time of the last successful logon by that user, the date and time of the last unsuccessful logon attempted with that user name, and the number of unsuccessful logons since the last successful logon by that user. This message must be acknowledged by the user before the user is presented with the Microsoft Windows desktop. + +For domain user accounts in Windows Server 2003, Windows 2000 native, or Windows 2000 mixed functional level domains, if you enable this setting, a warning message will appear that Windows could not retrieve the information and the user will not be able to log on. Therefore, you should not enable this policy setting if the domain is not at the Windows Server 2008 domain functional level. + +If you disable or do not configure this setting, messages about the previous logon or logon failures are not displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display information about previous logons during user logon* +- GP name: *DisplayLastLogonInfoDescription* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
    + + + +**ADMX_WinLogon/LogonHoursNotificationPolicyDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls whether the logged on user should be notified when his logon hours are about to expire. By default, a user is notified before logon hours expire, if actions have been set to occur when the logon hours expire. + +If you enable this setting, warnings are not displayed to the user before the logon hours expire. + +If you disable or do not configure this setting, users receive warnings before the logon hours expire, if actions have been set to occur when the logon hours expire. + +> [!NOTE] +> If you configure this setting, you might want to examine and appropriately configure the “Set action to take when logon hours expire” setting. If “Set action to take when logon hours expire” is disabled or not configured, the “Remove logon hours expiration warnings” setting will have no effect, and users receive no warnings about logon hour expiration + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove logon hours expiration warnings* +- GP name: *LogonHoursNotificationPolicyDescription* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
    + + +**ADMX_WinLogon/LogonHoursPolicyDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls which action will be taken when the logon hours expire for the logged on user. The actions include lock the workstation, disconnect the user, or log the user off completely. + +If you choose to lock or disconnect a session, the user cannot unlock the session or reconnect except during permitted logon hours. + +If you choose to log off a user, the user cannot log on again except during permitted logon hours. If you choose to log off a user, the user might lose unsaved data. If you enable this setting, the system will perform the action you specify when the user’s logon hours expire. + +If you disable or do not configure this setting, the system takes no action when the user’s logon hours expire. The user can continue the existing session, but cannot log on to a new session. + +> [!NOTE] +> If you configure this setting, you might want to examine and appropriately configure the “Remove logon hours expiration warnings” setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set action to take when logon hours expire* +- GP name: *LogonHoursPolicyDescription* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
    + + +**ADMX_WinLogon/ReportCachedLogonPolicyDescription** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he has been logged on using previously stored account information. + +If enabled, a notification popup will be displayed to the user when the user logs on with cached credentials. + +If disabled or not configured, no popup will be displayed to the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Report when logon server was not available during user logon* +- GP name: *ReportCachedLogonPolicyDescription* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
    + + +**ADMX_WinLogon/SoftwareSASGeneration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not software can simulate the Secure Attention Sequence (SAS). + +If you enable this policy setting, you have one of four options: + +- If you set this policy setting to "None," user mode software cannot simulate the SAS. +- If you set this policy setting to "Services," services can simulate the SAS. +- If you set this policy setting to "Ease of Access applications," Ease of Access applications can simulate the SAS. +- If you set this policy setting to "Services and Ease of Access applications," both services and Ease of Access applications can simulate the SAS. + +If you disable or do not configure this setting, only Ease of Access applications running on the secure desktop can simulate the SAS. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable or enable software Secure Attention Sequence* +- GP name: *SoftwareSASGeneration* +- GP path: *Windows Components\Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-wlansvc.md b/windows/client-management/mdm/policy-csp-admx-wlansvc.md new file mode 100644 index 0000000000..c66f4a6598 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wlansvc.md @@ -0,0 +1,261 @@ +--- +title: Policy CSP - ADMX_wlansvc +description: Policy CSP - ADMX_wlansvc +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/27/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_wlansvc +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_wlansvc policies + +
    +
    + ADMX_wlansvc/SetCost +
    +
    + ADMX_wlansvc/SetPINEnforced +
    +
    + ADMX_wlansvc/SetPINPreferred +
    +
    + + +
    + + +**ADMX_wlansvc/SetCost** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the cost of Wireless LAN (WLAN) connections on the local machine. + +If this policy setting is enabled, a drop-down list box presenting possible cost values will be active. Selecting one of the following values from the list will set the cost of all WLAN connections on the local machine: + +- Unrestricted: Use of this connection is unlimited and not restricted by usage charges and capacity constraints. +- Fixed: Use of this connection is not restricted by usage charges and capacity constraints up to a certain data limit. +- Variable: This connection is costed on a per byte basis. If this policy setting is disabled or is not configured, the cost of Wireless LAN connections is Unrestricted by default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Cost* +- GP name: *IncludeCmdLine* +- GP path: *Network\WLAN Service\WLAN Media Cost* +- GP ADMX file name: *wlansvc.admx* + + + +
    + + +**ADMX_wlansvc/SetPINEnforced** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy applies to Wireless Display connections. This policy means that the use of a PIN for pairing to Wireless Display devices is required rather than optional. + +Conversely it means that Push Button is NOT allowed. + +If this policy setting is disabled or is not configured, by default Push Button pairing is allowed (but not necessarily preferred). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require PIN pairing* +- GP name: *SetPINEnforced* +- GP path: *Network\Wireless Display* +- GP ADMX file name: *wlansvc.admx* + + + +
    + + +**ADMX_wlansvc/SetPINPreferred** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy applies to Wireless Display connections. This policy changes the preference order of the pairing methods. + +When enabled, it makes the connections to prefer a PIN for pairing to Wireless Display devices over the Push Button pairing method. + +If this policy setting is disabled or is not configured, by default Push Button pairing is preferred (if allowed by other policies). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prefer PIN pairing* +- GP name: *SetPINPreferred* +- GP path: *Network\Wireless Display* +- GP ADMX file name: *wlansvc.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + + diff --git a/windows/client-management/mdm/policy-csp-admx-wpn.md b/windows/client-management/mdm/policy-csp-admx-wpn.md new file mode 100644 index 0000000000..7e7e4ee561 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wpn.md @@ -0,0 +1,490 @@ +--- +title: Policy CSP - ADMX_WPN +description: Policy CSP - ADMX_WPN +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WPN +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WPN policies + +
    +
    + ADMX_WPN/NoCallsDuringQuietHours +
    +
    + ADMX_WPN/NoLockScreenToastNotification +
    +
    + ADMX_WPN/NoQuietHours +
    +
    + ADMX_WPN/NoToastNotification +
    +
    + ADMX_WPN/QuietHoursDailyBeginMinute +
    +
    + ADMX_WPN/QuietHoursDailyEndMinute +
    +
    + + +
    + + +**ADMX_WPN/NoCallsDuringQuietHours** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting blocks voice and video calls during Quiet Hours. + +If you enable this policy setting, voice and video calls will be blocked during the designated Quiet Hours time window each day, and users will not be able to customize any other Quiet Hours settings. + +If you disable this policy setting, voice and video calls will be allowed during Quiet Hours, and users will not be able to customize this or any other Quiet Hours settings. + +If you do not configure this policy setting, voice and video calls will be allowed during Quiet Hours by default. Administrators and users will be able to modify this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off calls during Quiet Hours* +- GP name: *NoCallsDuringQuietHours* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
    + + +**ADMX_WPN/NoLockScreenToastNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off toast notifications on the lock screen. + +If you enable this policy setting, applications will not be able to raise toast notifications on the lock screen. + +If you disable or do not configure this policy setting, toast notifications on the lock screen are enabled and can be turned off by the administrator or user. + +No reboots or service restarts are required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off toast notifications on the lock screen* +- GP name: *NoLockScreenToastNotification* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
    + + +**ADMX_WPN/NoQuietHours** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Quiet Hours functionality. + +If you enable this policy setting, toast notifications will not be suppressed and some background tasks will not be deferred during the designated Quiet Hours time window each day. + +If you disable this policy setting, toast notifications will be suppressed and some background task deferred during the designated Quiet Hours time window. Users will not be able to change this or any other Quiet Hours settings. + +If you do not configure this policy setting, Quiet Hours are enabled by default but can be turned off or by the administrator or user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Quiet Hours* +- GP name: *NoQuietHours* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
    + + +**ADMX_WPN/NoToastNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off toast notifications for applications. + +If you enable this policy setting, applications will not be able to raise toast notifications. + +Note that this policy does not affect taskbar notification balloons. + +Note that Windows system features are not affected by this policy. You must enable/disable system features individually to stop their ability to raise toast notifications. + +If you disable or do not configure this policy setting, toast notifications are enabled and can be turned off by the administrator or user. + +No reboots or service restarts are required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off toast notifications* +- GP name: *NoToastNotification* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
    + + +**ADMX_WPN/QuietHoursDailyBeginMinute** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the number of minutes after midnight (local time) that Quiet Hours is to begin each day. + +If you enable this policy setting, the specified time will be used, and users will not be able to customize any Quiet Hours settings. + +If you disable this policy setting, a default value will be used, and users will not be able to change it or any other Quiet Hours setting. + +If you do not configure this policy setting, a default value will be used, which administrators and users will be able to modify. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the time Quiet Hours begins each day* +- GP name: *QuietHoursDailyBeginMinute* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
    + + +**ADMX_WPN/QuietHoursDailyEndMinute** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the number of minutes after midnight (local time) that Quiet Hours is to end each day. + +If you enable this policy setting, the specified time will be used, and users will not be able to customize any Quiet Hours settings. + +If you disable this policy setting, a default value will be used, and users will not be able to change it or any other Quiet Hours setting. + +If you do not configure this policy setting, a default value will be used, which administrators and users will be able to modify. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the time Quiet Hours ends each day* +- GP name: *QuietHoursDailyEndMinute* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607 +- 2 - Available in Windows 10, version 1703 +- 3 - Available in Windows 10, version 1709 +- 4 - Available in Windows 10, version 1803 +- 5 - Available in Windows 10, version 1809 +- 6 - Available in Windows 10, version 1903 +- 7 - Available in Windows 10, version 1909 +- 8 - Available in Windows 10, version 2004 +- 9 - Available in Windows 10, version 20H2 + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 76ac87c616..eb4a7086d1 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ApplicationDefaults -description: Policy CSP - ApplicationDefaults +description: Learn about various Policy configuration service provider (CSP) - ApplicationDefaults, including SyncML, for Windows 10. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -219,12 +219,14 @@ This setting supports a range of values between 0 and 1. Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 798bbae111..1f128f9b64 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ApplicationManagement -description: Policy CSP - ApplicationManagement +description: Learn about various Policy configuration service provider (CSP) - ApplicationManagement, including SyncML, for Windows 10. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,10 +14,6 @@ manager: dansimp # Policy CSP - ApplicationManagement -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - -
    @@ -436,15 +432,15 @@ Most restricted value: 0 Business - check mark7 + check mark8 Enterprise - check mark7 + check mark8 Education - check mark7 + check mark8 @@ -462,7 +458,7 @@ Most restricted value: 0 -Added in the next major release of Windows 10. +Added in Windows 10, version 2004. Manages non-administrator users' ability to install Windows app packages. @@ -1106,13 +1102,13 @@ XSD: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. -- 7 - Added in the next major release of Windows 10. - +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 7c7efc8c73..2a224f8bfe 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AppRuntime -description: Policy CSP - AppRuntime +description: Learn how the Policy CSP - AppRuntime setting controls whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -99,5 +99,16 @@ ADMX Info:
    +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index adce29e627..63cdb4036d 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AppVirtualization -description: Policy CSP - AppVirtualization +description: Learn how the Policy CSP - AppVirtualization setting allows you to enable or disable Microsoft Application Virtualization (App-V) feature. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -2060,12 +2060,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index b09a07d3b2..e808f11e13 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - AttachmentManager -description: Policy CSP - AttachmentManager +description: Manage Windows marks file attachments with information about their zone of origin, such as restricted, internet, intranet, local. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -253,12 +253,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 96103d4ca7..7d0997f275 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Audit -description: Policy CSP - Audit +description: Learn how the Policy CSP - Audit setting causes an audit event to be generated when an account can't log on to a computer because the account is locked out. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -12,10 +12,6 @@ ms.date: 09/27/2019 # Policy CSP - Audit -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - -
    @@ -4798,12 +4794,14 @@ The following are the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 26a3e3120b..51f56ffbbb 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Authentication -description: Policy CSP - Authentication +description: The Policy CSP - Authentication setting allows the Azure AD tenant administrators to enable self service password reset feature on the Windows sign in screen. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -569,12 +569,14 @@ Value type is string. Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index 38a9ace228..15b769497e 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Autoplay -description: Policy CSP - Autoplay +description: Learn how the Policy CSP - Autoplay setting disallows AutoPlay for MTP devices like cameras or phones. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -269,12 +269,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 3ab3d8246b..2f4c7acf11 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Bitlocker -description: Policy CSP - Bitlocker +description: Use the Policy configuration service provider (CSP) - Bitlocker to manage encryption of PCs and devices. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -97,12 +97,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index 07a7f51c0f..2bcc10ea45 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -1,6 +1,6 @@ --- title: Policy CSP - BITS -description: Policy CSP - BITS +description: Use StartTime, EndTime and Transfer rate together to define the BITS bandwidth-throttling schedule and transfer rate. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,10 +14,6 @@ manager: dansimp # Policy CSP - BITS -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - - The following bandwidth policies are used together to define the bandwidth-throttling schedule and transfer rate. - BITS/BandwidthThrottlingEndTime @@ -546,12 +542,14 @@ Supported values range: 0 - 999 Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 40e770a691..6426fba5e8 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Bluetooth -description: Policy CSP - Bluetooth +description: Learn how the Policy CSP - Bluetooth setting specifies whether the device can send out Bluetooth advertisements. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Bluetooth -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
    @@ -412,19 +409,19 @@ The default value is an empty string. For more information, see [ServicesAllowed Pro - check mark7 + check mark8 Business - check mark7 + check mark8 Enterprise - check mark7 + check mark8 Education - check mark7 + check mark8 @@ -441,8 +438,7 @@ The default value is an empty string. For more information, see [ServicesAllowed -Added in the next major release of Windows 10. -There are multiple levels of encryption strength when pairing Bluetooth devices. This policy helps prevent weaker devices cryptographically being used in high security environments. +Added in Windows 10, version 2004. There are multiple levels of encryption strength when pairing Bluetooth devices. This policy helps prevent weaker devices cryptographically being used in high security environments. @@ -464,14 +460,14 @@ For more information on allowed key sizes, refer to Bluetooth Core Specification Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. -- 7 - Added in the next major release of Windows 10. - +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004.
    diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 64a83cf92a..d2c9190e0b 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Browser -description: Policy CSP - Browser +description: Learn how to use the Policy CSP - Browser settings so you can configure Microsoft Edge browser, version 45 and earlier. ms.topic: article ms.prod: w10 ms.technology: windows @@ -17,11 +17,6 @@ ms.localizationpriority: medium > [!NOTE] > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). -
    - -> [!NOTE] -> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). - ## Browser policies @@ -4302,12 +4297,13 @@ Most restricted value: 0 Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index c3b2407f95..93e5c5d6cf 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Camera -description: Policy CSP - Camera +description: Learn how to use the Policy CSP - Camera setting so that you can configure it to disable or enable the camera. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -99,12 +99,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 8eea1718e2..ccd0ab26c1 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Cellular -description: Policy CSP - Cellular +description: Learn how to use the Policy CSP - Cellular setting so you can specify whether Windows apps can access cellular data. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -372,12 +372,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 9f039348ee..503ee130bc 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Connectivity -description: Policy CSP - Connectivity +description: Learn how to use the Policy CSP - Connectivity setting to allow the user to enable Bluetooth or restrict access. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -1020,12 +1020,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 1cb56dfe89..2cde160250 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ControlPolicyConflict -description: Policy CSP - ControlPolicyConflict +description: Use the Policy CSP - ControlPolicyConflict setting to control which policy is used whenever both the MDM policy and its equivalent Group Policy are set on the device. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -100,8 +100,8 @@ The [Policy DDF](policy-ddf-file.md) contains the following tags to identify the - \ - \ -For the list MDM-GP mapping list, see [Policies supported by Group Policy -](policies-supported-by-group-policy.md). +For the list MDM-GP mapping list, see [Policies in Policy CSP supported by Group Policy +](policy-csps-supported-by-group-policy.md). The MDM Diagnostic report shows the applied configurations states of a device including policies, certificates, configuration sources, and resource information. The report includes a list of blocked GP settings because MDM equivalent is configured, if any. To get the diagnostic report, go to **Settings** > **Accounts** > **Access work or school** > and then click the desired work or school account. Scroll to the bottom of the page to **Advanced Diagnostic Report** and then click **Create Report**. @@ -118,12 +118,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index a246711f54..89e4817ce7 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -1,6 +1,6 @@ --- title: Policy CSP - CredentialProviders -description: Policy CSP - CredentialProviders +description: Learn how to use the policy CSP for credential provider so you can control whether a domain user can sign in using a convenience PIN. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -243,12 +243,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 8ff0e68902..71447f45ab 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -1,6 +1,6 @@ --- title: Policy CSP - CredentialsDelegation -description: Policy CSP - CredentialsDelegation +description: Learn how to use the Policy CSP - CredentialsDelegation setting so that remote host can allow delegation of non-exportable credentials. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -103,12 +103,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index ddbe0fbb42..5ccf34a12e 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -1,6 +1,6 @@ --- title: Policy CSP - CredentialsUI -description: Policy CSP - CredentialsUI +description: Learn how to use the Policy CSP - CredentialsUI setting to configure the display of the password reveal button in password entry user experiences. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -179,12 +179,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index e65d65744a..b141d4387b 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Cryptography -description: Policy CSP - Cryptography +description: Learn how to use the Policy CSP - Cryptography setting to allow or disallow the Federal Information Processing Standard (FIPS) policy. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -166,12 +166,14 @@ Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index a59ff61127..9da8c6ce2c 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DataProtection -description: Policy CSP - DataProtection +description: Use the Policy CSP - DataProtection setting to block direct memory access (DMA) for all hot pluggable PCI downstream ports until a user logs into Windows. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -152,12 +152,14 @@ Setting used by Windows 8.1 Selective Wipe. Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 13ed5363fb..cb540b3415 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DataUsage -description: Policy CSP - DataUsage +description: Learn how to use the Policy CSP - DataUsage setting to configure the cost of 4G connections on the local machine. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -123,12 +123,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index d691487aa2..6387efccc5 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Defender -description: Policy CSP - Defender +description: Learn how to use the Policy CSP - Defender setting so you can allow or disallow scanning of archives. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -205,7 +205,7 @@ Allows or disallows scanning of archives. ADMX Info: - GP English name: *Scan archive files* - GP name: *Scan_DisableArchiveScanning* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -275,7 +275,7 @@ Allows or disallows Windows Defender Behavior Monitoring functionality. ADMX Info: - GP English name: *Turn on behavior monitoring* - GP name: *RealtimeProtection_DisableBehaviorMonitoring* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -346,7 +346,7 @@ ADMX Info: - GP English name: *Join Microsoft MAPS* - GP name: *SpynetReporting* - GP element: *SpynetReporting* -- GP path: *Windows Components/Windows Defender Antivirus/MAPS* +- GP path: *Windows Components/Microsoft Defender Antivirus/MAPS* - GP ADMX file name: *WindowsDefender.admx* @@ -416,7 +416,7 @@ Allows or disallows scanning of email. ADMX Info: - GP English name: *Turn on e-mail scanning* - GP name: *Scan_DisableEmailScanning* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -486,7 +486,7 @@ Allows or disallows a full scan of mapped network drives. ADMX Info: - GP English name: *Run full scan on mapped network drives* - GP name: *Scan_DisableScanningMappedNetworkDrivesForFullScan* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -556,7 +556,7 @@ Allows or disallows a full scan of removable drives. During a quick scan, remova ADMX Info: - GP English name: *Scan removable drives* - GP name: *Scan_DisableRemovableDriveScanning* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -626,7 +626,7 @@ Allows or disallows Windows Defender IOAVP Protection functionality. ADMX Info: - GP English name: *Scan all downloaded files and attachments* - GP name: *RealtimeProtection_DisableIOAVProtection* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -758,7 +758,7 @@ Allows or disallows Windows Defender On Access Protection functionality. ADMX Info: - GP English name: *Monitor file and program activity on your computer* - GP name: *RealtimeProtection_DisableOnAccessProtection* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -828,7 +828,7 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. ADMX Info: - GP English name: *Turn off real-time protection* - GP name: *DisableRealtimeMonitoring* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -898,7 +898,7 @@ Allows or disallows a scanning of network files. ADMX Info: - GP English name: *Scan network files* - GP name: *Scan_DisableScanningNetworkFiles* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1030,7 +1030,7 @@ Allows or disallows user access to the Windows Defender UI. If disallowed, all W ADMX Info: - GP English name: *Enable headless UI mode* - GP name: *UX_Configuration_UILockdown* -- GP path: *Windows Components/Windows Defender Antivirus/Client Interface* +- GP path: *Windows Components/Microsoft Defender Antivirus/Client Interface* - GP ADMX file name: *WindowsDefender.admx* @@ -1103,7 +1103,7 @@ ADMX Info: - GP English name: *Exclude files and paths from Attack Surface Reduction Rules* - GP name: *ExploitGuard_ASR_ASROnlyExclusions* - GP element: *ExploitGuard_ASR_ASROnlyExclusions* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* - GP ADMX file name: *WindowsDefender.admx* @@ -1171,7 +1171,7 @@ ADMX Info: - GP English name: *Configure Attack Surface Reduction rules* - GP name: *ExploitGuard_ASR_Rules* - GP element: *ExploitGuard_ASR_Rules* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* - GP ADMX file name: *WindowsDefender.admx* @@ -1238,7 +1238,7 @@ ADMX Info: - GP English name: *Specify the maximum percentage of CPU utilization during a scan* - GP name: *Scan_AvgCPULoadFactor* - GP element: *Scan_AvgCPULoadFactor* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1315,7 +1315,7 @@ ADMX Info: - GP English name: *Check for the latest virus and spyware definitions before running a scheduled scan* - GP name: *CheckForSignaturesBeforeRunningScan* - GP element: *CheckForSignaturesBeforeRunningScan* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1380,11 +1380,11 @@ ADMX Info: > This policy is only enforced in Windows 10 for desktop. -Added in Windows 10, version 1709. This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. +Added in Windows 10, version 1709. This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. -If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. +If this setting is on, Microsoft Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. -For more information about specific values that are supported, see the Windows Defender Antivirus documentation site. +For more information about specific values that are supported, see the Microsoft Defender Antivirus documentation site. > [!NOTE] > This feature requires the "Join Microsoft MAPS" setting enabled in order to function. @@ -1395,7 +1395,7 @@ ADMX Info: - GP English name: *Select cloud protection level* - GP name: *MpEngine_MpCloudBlockLevel* - GP element: *MpCloudBlockLevel* -- GP path: *Windows Components/Windows Defender Antivirus/MpEngine* +- GP path: *Windows Components/Microsoft Defender Antivirus/MpEngine* - GP ADMX file name: *WindowsDefender.admx* @@ -1459,7 +1459,7 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -Added in Windows 10, version 1709. This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. +Added in Windows 10, version 1709. This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds. @@ -1474,7 +1474,7 @@ ADMX Info: - GP English name: *Configure extended cloud check* - GP name: *MpEngine_MpBafsExtendedTimeout* - GP element: *MpBafsExtendedTimeout* -- GP path: *Windows Components/Windows Defender Antivirus/MpEngine* +- GP path: *Windows Components/Microsoft Defender Antivirus/MpEngine* - GP ADMX file name: *WindowsDefender.admx* @@ -1529,7 +1529,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersAllowedApplications and changed to ControlledFolderAccessAllowedApplications. -Added in Windows 10, version 1709. This policy setting allows user-specified applications to the controlled folder access feature. Adding an allowed application means the controlled folder access feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it will not be necessary to add entries. Windows Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the | as the substring separator. +Added in Windows 10, version 1709. This policy setting allows user-specified applications to the controlled folder access feature. Adding an allowed application means the controlled folder access feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it will not be necessary to add entries. Microsoft Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the | as the substring separator. @@ -1537,7 +1537,7 @@ ADMX Info: - GP English name: *Configure allowed applications* - GP name: *ExploitGuard_ControlledFolderAccess_AllowedApplications* - GP element: *ExploitGuard_ControlledFolderAccess_AllowedApplications* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* - GP ADMX file name: *WindowsDefender.admx* @@ -1600,7 +1600,7 @@ ADMX Info: - GP English name: *Configure protected folders* - GP name: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* - GP element: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* - GP ADMX file name: *WindowsDefender.admx* @@ -1667,7 +1667,7 @@ ADMX Info: - GP English name: *Configure removal of items from Quarantine folder* - GP name: *Quarantine_PurgeItemsAfterDelay* - GP element: *Quarantine_PurgeItemsAfterDelay* -- GP path: *Windows Components/Windows Defender Antivirus/Quarantine* +- GP path: *Windows Components/Microsoft Defender Antivirus/Quarantine* - GP ADMX file name: *WindowsDefender.admx* @@ -1725,14 +1725,14 @@ Valid values: 0–90 This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. -If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. +If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. -If you enable this setting, catch-up scans for scheduled full scans will be disabled. +If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned off. Supported values: -- 0 - Disabled -- 1 - Enabled (default) +- 1 - Disabled (default) +- 0 - Enabled OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupFullScan @@ -1742,7 +1742,7 @@ ADMX Info: - GP English name: *Turn on catch-up full scan* - GP name: *Scan_DisableCatchupFullScan* - GP element: *Scan_DisableCatchupFullScan* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1811,8 +1811,8 @@ If you disable or do not configure this setting, catch-up scans for scheduled qu Supported values: -- 0 - Disabled -- 1 - Enabled (default) +- 1 - Disabled (default) +- 0 - Enabled OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupQuickScan @@ -1822,7 +1822,7 @@ ADMX Info: - GP English name: *Turn on catch-up quick scan* - GP name: *Scan_DisableCatchupQuickScan* - GP element: *Scan_DisableCatchupQuickScan* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1894,7 +1894,7 @@ ADMX Info: - GP English name: *Configure Controlled folder access* - GP name: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* - GP element: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* - GP ADMX file name: *WindowsDefender.admx* @@ -1971,7 +1971,7 @@ ADMX Info: - GP English name: *Configure low CPU priority for scheduled scans* - GP name: *Scan_LowCpuPriority* - GP element: *Scan_LowCpuPriority* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -2049,7 +2049,7 @@ ADMX Info: - GP English name: *Prevent users and apps from accessing dangerous websites* - GP name: *ExploitGuard_EnableNetworkProtection* - GP element: *ExploitGuard_EnableNetworkProtection* -- GP path: *Windows Components/Windows Defender Antivirus/Windows Defender Exploit Guard/Network Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Network Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2121,7 +2121,7 @@ ADMX Info: - GP English name: *Path Exclusions* - GP name: *Exclusions_Paths* - GP element: *Exclusions_PathsList* -- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* - GP ADMX file name: *WindowsDefender.admx* @@ -2185,7 +2185,7 @@ ADMX Info: - GP English name: *Extension Exclusions* - GP name: *Exclusions_Extensions* - GP element: *Exclusions_ExtensionsList* -- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* - GP ADMX file name: *WindowsDefender.admx* @@ -2255,7 +2255,7 @@ ADMX Info: - GP English name: *Process Exclusions* - GP name: *Exclusions_Processes* - GP element: *Exclusions_ProcessesList* -- GP path: *Windows Components/Windows Defender Antivirus/Exclusions* +- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* - GP ADMX file name: *WindowsDefender.admx* @@ -2313,7 +2313,19 @@ ADMX Info: Added in Windows 10, version 1607. Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer. +> [!NOTE] +> Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices. For more information about PUA, see [Detect and block potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus). + + +ADMX Info: +- GP English name: *Configure detection for potentially unwanted applications* +- GP name: *Root_PUAProtection* +- GP element: *Root_PUAProtection* +- GP path: *Windows Components/Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -2385,7 +2397,7 @@ ADMX Info: - GP English name: *Configure monitoring for incoming and outgoing file and program activity* - GP name: *RealtimeProtection_RealtimeScanDirection* - GP element: *RealtimeProtection_RealtimeScanDirection* -- GP path: *Windows Components/Windows Defender Antivirus/Real-time Protection* +- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2457,7 +2469,7 @@ ADMX Info: - GP English name: *Specify the scan type to use for a scheduled scan* - GP name: *Scan_ScanParameters* - GP element: *Scan_ScanParameters* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -2537,7 +2549,7 @@ ADMX Info: - GP English name: *Specify the time for a daily quick scan* - GP name: *Scan_ScheduleQuickScantime* - GP element: *Scan_ScheduleQuickScantime* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -2608,7 +2620,7 @@ ADMX Info: - GP English name: *Specify the day of the week to run a scheduled scan* - GP name: *Scan_ScheduleDay* - GP element: *Scan_ScheduleDay* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -2695,7 +2707,7 @@ ADMX Info: - GP English name: *Specify the time of day to run a scheduled scan* - GP name: *Scan_ScheduleTime* - GP element: *Scan_ScheduleTime* -- GP path: *Windows Components/Windows Defender Antivirus/Scan* +- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -2774,7 +2786,7 @@ ADMX Info: - GP English name: *Define the order of sources for downloading definition updates* - GP name: *SignatureUpdate_FallbackOrder* - GP element: *SignatureUpdate_FallbackOrder* -- GP path: *Windows Components/Windows Defender Antivirus/Signature Updates* +- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* - GP ADMX file name: *WindowsDefender.admx* @@ -2853,7 +2865,7 @@ ADMX Info: - GP English name: *Define file shares for downloading definition updates* - GP name: *SignatureUpdate_DefinitionUpdateFileSharesSources* - GP element: *SignatureUpdate_DefinitionUpdateFileSharesSources* -- GP path: *Windows Components/Windows Defender Antivirus/Signature Updates* +- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* - GP ADMX file name: *WindowsDefender.admx* @@ -2933,7 +2945,7 @@ ADMX Info: - GP English name: *Specify the interval to check for definition updates* - GP name: *SignatureUpdate_SignatureUpdateInterval* - GP element: *SignatureUpdate_SignatureUpdateInterval* -- GP path: *Windows Components/Windows Defender Antivirus/Signature Updates* +- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* - GP ADMX file name: *WindowsDefender.admx* @@ -3001,7 +3013,7 @@ ADMX Info: - GP English name: *Send file samples when further analysis is required* - GP name: *SubmitSamplesConsent* - GP element: *SubmitSamplesConsent* -- GP path: *Windows Components/Windows Defender Antivirus/MAPS* +- GP path: *Windows Components/Microsoft Defender Antivirus/MAPS* - GP ADMX file name: *WindowsDefender.admx* @@ -3092,7 +3104,7 @@ ADMX Info: - GP English name: *Specify threat alert levels at which default action should not be taken when detected* - GP name: *Threats_ThreatSeverityDefaultAction* - GP element: *Threats_ThreatSeverityDefaultActionList* -- GP path: *Windows Components/Windows Defender Antivirus/Threats* +- GP path: *Windows Components/Microsoft Defender Antivirus/Threats* - GP ADMX file name: *WindowsDefender.admx* @@ -3101,12 +3113,15 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. +- 9 - Available in Windows 10, version 20H2. diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 8a8184ba9a..1031aada9c 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -1,13 +1,13 @@ --- title: Policy CSP - DeliveryOptimization -description: Policy CSP - DeliveryOptimization +description: Learn how to use the Policy CSP - DeliveryOptimization setting to configure one or more Microsoft Connected Cache servers to be used by Delivery Optimization. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 09/27/2019 +ms.date: 06/09/2020 ms.reviewer: manager: dansimp --- @@ -31,6 +31,9 @@ manager: dansimp
    DeliveryOptimization/DOCacheHost
    +
    + DeliveryOptimization/DOCacheHostSource +
    DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    @@ -52,6 +55,9 @@ manager: dansimp
    DeliveryOptimization/DOGroupIdSource
    +
    + DeliveryOptimization/DOMaxBackgroundDownloadBandwidth +
    DeliveryOptimization/DOMaxCacheAge
    @@ -61,6 +67,9 @@ manager: dansimp
    DeliveryOptimization/DOMaxDownloadBandwidth
    +
    + DeliveryOptimization/DOMaxForegroundDownloadBandwidth +
    DeliveryOptimization/DOMaxUploadBandwidth
    @@ -289,12 +298,15 @@ The following list shows the supported values: -[Reserved for future use] + +This policy allows you to configure one or more Microsoft Connected Cache servers to be used by Delivery Optimization. + +One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas. ADMX Info: -- GP English name: *[Reserved for future use] Cache Server Hostname* +- GP English name: *Cache Server Hostname* - GP name: *CacheHost* - GP element: *CacheHost* - GP path: *Windows Components/Delivery Optimization* @@ -314,6 +326,86 @@ ADMX Info:
    + +**DeliveryOptimization/DOCacheHostSource** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procheck mark8
    Businesscheck mark8
    Enterprisecheck mark8
    Educationcheck mark8
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + + +This policy allows you to configure one or more Delivery Optimization in Network Cache servers through a custom DHCP Option. One or more values can be added as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address by commas. + + + +ADMX Info: +- GP English name: *Cache Server Hostname Source* +- GP name: *CacheHostSource* +- GP element: *CacheHostSource* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + +The following are the supported values: +- 1 = DHCP Option ID. +- 2 = DHCP Option ID Force. + +When DHCP Option ID (1) is set, the client will query DHCP Option ID 235 and use the returned FQDN or IP value as Cache Server Hostname value. This policy will be overridden when the [Cache Server Hostname](#deliveryoptimization-docachehost) policy has been set. + +When DHCP Option ID Force (2) is set, the client will query DHCP Option ID 235 and use the returned FQDN or IP value as Cache Server Hostname value, and will override the Cache Server Hostname policy if it has been set. + +> [!Note] +> If the DHCP Option ID is formatted incorrectly, the client will fall back to the [Cache Server Hostname](#deliveryoptimization-docachehost) policy value if that value has been set. + + + + + + + + + + +
    + **DeliveryOptimization/DODelayBackgroundDownloadFromHttp** @@ -662,8 +754,7 @@ The following list shows the supported values: - 2 – HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if it exists) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2. - 3 – HTTP blended with Internet peering. - 99 - Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services. Added in Windows 10, version 1607. -- 100 - Bypass mode. Do not use Delivery Optimization and use BITS instead. Added in Windows 10, version 1607. - +- 100 - Bypass mode. Do not use Delivery Optimization and use BITS instead. Added in Windows 10, version 1607. Note that this value is deprecated and will be removed in a future release. @@ -790,7 +881,7 @@ The options set in this policy only apply to Group (2) download mode. If Group ( For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID. -Starting with Windows 10, version 1903, you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this, set the value of DOGroupIdSource to 5. +Starting with Windows 10, version 1903, you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To do this, set the value of DOGroupIdSource to 5. @@ -816,6 +907,68 @@ The following list shows the supported values:
    + +**DeliveryOptimization/DOMaxBackgroundDownloadBandwidth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procheck mark8
    Businesscheck mark8
    Enterprisecheck mark8
    Educationcheck mark8
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy specifies the maximum background download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. + +The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. + + + +ADMX Info: +- GP English name: *Maximum Background Download Bandwidth (in KB/s)* +- GP name: *MaxBackgroundDownloadBandwidth* +- GP element: *MaxBackgroundDownloadBandwidth* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + + +
    + **DeliveryOptimization/DOMaxCacheAge** @@ -952,70 +1105,27 @@ ADMX Info: **DeliveryOptimization/DOMaxDownloadBandwidth** - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows EditionSupported?
    Homecross mark
    Procheck mark1
    Businesscheck mark1
    Enterprisecheck mark1
    Educationcheck mark1
    +
    -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
    -> [!NOTE] -> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. - - -Added in Windows 10, version 1607. Specifies the maximum download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. - -The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. +This policy is deprecated. Use [DOMaxForegroundDownloadBandwidth](#deliveryoptimization-domaxforegrounddownloadbandwidth) and [DOMaxBackgroundDownloadBandwidth](#deliveryoptimization-domaxbackgrounddownloadbandwidth) policies instead. -ADMX Info: -- GP English name: *Maximum Download Bandwidth (in KB/s)* -- GP name: *MaxDownloadBandwidth* -- GP element: *MaxDownloadBandwidth* -- GP path: *Windows Components/Delivery Optimization* -- GP ADMX file name: *DeliveryOptimization.admx* -
    -**DeliveryOptimization/DOMaxUploadBandwidth** +**DeliveryOptimization/DOMaxForegroundDownloadBandwidth** @@ -1029,19 +1139,19 @@ ADMX Info: - + - + - + - +
    Procheck markcheck mark8
    Businesscheck markcheck mark8
    Enterprisecheck markcheck mark8
    Educationcheck markcheck mark8
    @@ -1058,20 +1168,16 @@ ADMX Info: -> [!NOTE] -> This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. +This policy specifies the maximum foreground download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. - -Specifies the maximum upload bandwidth in KiloBytes/second that a device will use across all concurrent upload activity using Delivery Optimization. - -The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth). +The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. ADMX Info: -- GP English name: *Max Upload Bandwidth (in KB/s)* -- GP name: *MaxUploadBandwidth* -- GP element: *MaxUploadBandwidth* +- GP English name: *Maximum Foreground Download Bandwidth (in KB/s)* +- GP name: *MaxForegroundDownloadBandwidth* +- GP element: *MaxForegroundDownloadBandwidth* - GP path: *Windows Components/Delivery Optimization* - GP ADMX file name: *DeliveryOptimization.admx* @@ -1080,6 +1186,25 @@ ADMX Info:
    + +**DeliveryOptimization/DOMaxUploadBandwidth** + + + + + + + + +This policy is deprecated because it only applies to uploads to Internet peers (only allowed when DownloadMode is set to 3) which is not used in commercial deployments. There is no alternate policy to use. + + + + + + +
    + **DeliveryOptimization/DOMinBackgroundQos** @@ -1901,12 +2026,14 @@ This policy allows an IT Admin to define the following: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index d1562413d5..dfbed26745 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Desktop -description: Policy CSP - Desktop +description: Learn how to use the Policy CSP - Desktop setting to prevent users from changing the path to their profile folders. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -101,12 +101,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index f34ee27dd5..2eae3ea3be 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DeviceGuard -description: Policy CSP - DeviceGuard +description: Learn how to use the Policy CSP - DeviceGuard setting to allow the IT admin to configure the launch of System Guard. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - DeviceGuard -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
    @@ -93,7 +90,7 @@ Secure Launch configuration: - 1 - Enables Secure Launch if supported by hardware - 2 - Disables Secure Launch. -For more information about System Guard, see [Introducing Windows Defender System Guard runtime attestation](https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/) and [How hardware-based containers help protect Windows 10](https://docs.microsoft.com/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows). +For more information about System Guard, see [Introducing Windows Defender System Guard runtime attestation](https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/) and [How a hardware-based root of trust helps protect Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows). @@ -320,12 +317,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index 0968a81bc8..60d4832fae 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DeviceHealthMonitoring -description: Learn which DeviceHealthMonitoring policies are supported for your edition of Windows. +description: Learn how the Policy CSP - DeviceHealthMonitoring setting is used as an opt-in health monitoring connection between the device and Microsoft. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -227,12 +227,14 @@ In most cases, an IT Pro does not need to define this policy. Instead, it is exp Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 4ced8ce8ab..24c7b04cbf 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -2,7 +2,7 @@ title: Policy CSP - DeviceInstallation ms.reviewer: manager: dansimp -description: Policy CSP - DeviceInstallation +description: Use the Policy CSP - DeviceInstallation setting to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. ms.author: dansimp ms.date: 09/27/2019 ms.topic: article @@ -14,9 +14,6 @@ ms.localizationpriority: medium # Policy CSP - DeviceInstallation -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
    @@ -949,12 +946,14 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 8d3fe92592..b106637736 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DeviceLock -description: Policy CSP - DeviceLock +description: Learn how to use the Policy CSP - DeviceLock setting to specify whether the user must input a PIN or password when the device resumes from an idle state. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -677,7 +677,7 @@ The following list shows the supported values: -Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app. +Specifies the maximum amount of time (in seconds) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app. * On Mobile, the Lumia 950 and 950XL have a maximum timeout value of 5 minutes, regardless of the value set by this policy. * On HoloLens, this timeout is controlled by the device's system sleep timeout, regardless of the value set by this policy. @@ -1119,12 +1119,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 5379d5fbac..82dbb630ae 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Display -description: Policy CSP - Display +description: Learn how to use the Policy CSP - Display setting to disable Per-Process System DPI for a semicolon-separated list of applications. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -393,12 +393,14 @@ To validate on Desktop, do the following: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 08eaddf872..0d8f6b40f8 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -1,6 +1,6 @@ --- title: Policy CSP - DmaGuard -description: Policy CSP - DmaGuard +description: Learn how to use the Policy CSP - DmaGuard setting to provide additional security against external DMA capable devices. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - DmaGuard -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
    @@ -76,7 +73,7 @@ manager: dansimp -This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with DMA Remapping/device memory isolation and sandboxing. +This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with [DMA Remapping](https://docs.microsoft.com/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers)/device memory isolation and sandboxing. Device memory sandboxing allows the OS to leverage the I/O Memory Management Unit (IOMMU) of a device to block unallowed I/O, or memory access, by the peripheral. In other words, the OS assigns a certain memory range to the peripheral. If the peripheral attempts to read/write to memory outside of the assigned range, the OS blocks it. @@ -116,12 +113,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 825ac41a15..18cce493eb 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Education -description: Policy CSP - Education +description: Learn how to use the Policy CSP - Education setting to control graphing functionality in the Windows Calculator app. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Education -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
    @@ -52,23 +49,23 @@ manager: dansimp Home - check mark + check mark8 Pro - check mark + check mark8 Business - check mark + check mark8 Enterprise - check mark + check mark8 Education - check mark + check mark8 @@ -85,7 +82,7 @@ manager: dansimp -Added in next major release of Windows 10. This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, you will be able to access graphing functionality. +Added in Windows 10, version 2004. This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, you will be able to access graphing functionality. ADMX Info: @@ -277,12 +274,14 @@ The policy value is expected to be a `````` separated list of printer na Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 4cecf73ce0..e9d1cb8436 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -1,6 +1,6 @@ --- title: Policy CSP - EnterpriseCloudPrint -description: Policy CSP - EnterpriseCloudPrint +description: Use the Policy CSP - EnterpriseCloudPrint setting to define the maximum number of printers that should be queried from a discovery end point. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -376,12 +376,14 @@ The default value is an empty string. Otherwise, the value should contain a URL. Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index 9cdc8a23f1..b4f27cc7c0 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ErrorReporting -description: Policy CSP - ErrorReporting +description: Learn how to use the Policy CSP - ErrorReporting setting to determine the consent behavior of Windows Error Reporting for specific event types. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -407,12 +407,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index 85d7cfd540..d86bd44edc 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -1,6 +1,6 @@ --- title: Policy CSP - EventLogService -description: Policy CSP - EventLogService +description: Learn how to use the Policy CSP - EventLogService settting to control Event Log behavior when the log file reaches its maximum size. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -322,12 +322,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 644621a01e..8550d25403 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1,13 +1,13 @@ --- title: Policy CSP - Experience -description: Policy CSP - Experience +description: Learn how to use the Policy CSP - Experience setting to allow history of clipboard items to be stored in memory. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 09/27/2019 +ms.date: 11/02/2020 ms.reviewer: manager: dansimp --- @@ -73,6 +73,9 @@ manager: dansimp
    Experience/ConfigureWindowsSpotlightOnLockScreen
    +
    + Experience/DisableCloudOptimizedContent +
    Experience/DoNotShowFeedbackNotifications
    @@ -283,7 +286,7 @@ The following list shows the supported values: Allows users to turn on/off device discovery UX. -When set to 0 , the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on. +When set to 0, the projection pane is disabled. The Win+P and Win+K shortcut keys will not work on. Most restricted value is 0. @@ -413,7 +416,7 @@ The following list shows the supported values: -Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), then disabling the MDM unenrollment has no effect. +Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g., auto-enrolled), then disabling the MDM unenrollment has no effect. > [!NOTE] > The MDM server can always remotely delete the account. @@ -507,7 +510,7 @@ Allows or disallows all Windows sync settings on the device. For information abo The following list shows the supported values: -- 0 – Sync settings is not allowed. +- 0 – Sync settings are not allowed. - 1 (default) – Sync settings allowed. @@ -566,7 +569,8 @@ Added in Windows 10, version 1703. This policy allows you to prevent Windows fro Diagnostic data can include browser, app and feature usage, depending on the "Diagnostic and usage data" setting value. -> **Note** This setting does not control Cortana cutomized experiences because there are separate policies to configure it. +> [!NOTE] +> This setting does not control Cortana cutomized experiences because there are separate policies to configure it. Most restricted value is 0. @@ -1153,6 +1157,74 @@ The following list shows the supported values: + +**Experience/DisableCloudOptimizedContent** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecheck mark9
    Procheck mark9
    Businesscheck mark9
    Enterprisecheck mark9
    Educationcheck mark9
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting lets you turn off cloud optimized content in all Windows experiences. + +If you enable this policy setting, Windows experiences that use the cloud optimized content client component will present the default fallback content. + +If you disable or do not configure this policy setting, Windows experiences will be able to use cloud optimized content. + + + +ADMX Info: +- GP English name: *Turn off cloud optimized content* +- GP name: *DisableCloudOptimizedContent* +- GP path: *Windows Components/Cloud Content* +- GP ADMX file name: *CloudContent.admx* + + + +The following list shows the supported values: + +- 0 (default) – Disabled. +- 1 – Enabled. + + + +
    @@ -1286,7 +1358,7 @@ ADMX Info: Supported values: -- 0 (default) - Allowed/turned on. The "browser" group syncs automatically between user’s devices and lets users to make changes. +- 0 (default) - Allowed/turned on. The "browser" group synchronizes automatically between users' devices and lets users make changes. - 2 - Prevented/turned off. The "browser" group does not use the _Sync your Settings_ option. @@ -1492,12 +1564,15 @@ Supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. +- 9 - Available in Windows 10, version 20H2. diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index adf4eb44d5..92829f957e 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ExploitGuard -description: Policy CSP - ExploitGuard +description: Use the Policy CSP - ExploitGuard setting to push out the desired system configuration and application mitigation options to all the devices in the organization. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -120,12 +120,14 @@ Here is an example: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index ddc419671c..58b2bf5175 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -1,6 +1,6 @@ --- title: Policy CSP - FileExplorer -description: Policy CSP - FileExplorer +description: Use the Policy CSP - FileExplorer setting so you can allow certain legacy plug-in applications to function without terminating Explorer. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -166,12 +166,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index b114cb8f6a..f62143e2a6 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Games -description: Policy CSP - Games +description: Learn to use the Policy CSP - Games setting so that you can specify whether advanced gaming services can be used. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -89,12 +89,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 16d5bde9bd..dea9168e36 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Handwriting -description: Policy CSP - Handwriting +description: Use the Policy CSP - Handwriting setting to allow an enterprise to configure the default mode for the handwriting panel. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -103,12 +103,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 6e0db74b13..c63c654abe 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -1,6 +1,6 @@ --- title: Policy CSP - InternetExplorer -description: Policy CSP - InternetExplorer +description: Use the Policy CSP - InternetExplorer setting to add a specific list of search providers to the user's default list of search providers. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -19457,12 +19457,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 200fde9087..b5331fa661 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Kerberos -description: Policy CSP - Kerberos +description: Define the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs). ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Kerberos -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
    @@ -467,12 +464,14 @@ Devices joined to Azure Active Directory in a hybrid environment need to interac Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 83b8e5e9a2..be0176ca9b 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -1,6 +1,6 @@ --- title: Policy CSP - KioskBrowser -description: Policy CSP - KioskBrowser +description: Use the Policy CSP - KioskBrowser setting to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -429,12 +429,14 @@ The value is an int 1-1440 that specifies the amount of minutes the session is i Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index 86575f2093..bb03f10884 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -1,6 +1,6 @@ --- title: Policy CSP - LanmanWorkstation -description: Policy CSP - LanmanWorkstation +description: Use the Policy CSP - LanmanWorkstation setting to determine if the SMB client will allow insecure guest logons to an SMB server. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -100,12 +100,14 @@ This setting supports a range of values between 0 and 1. Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index e6cfff8888..bfef6090cc 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Licensing -description: Policy CSP - Licensing +description: Use the Policy CSP - Licensing setting to enable or disable Windows license reactivation on managed devices. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -166,12 +166,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 9263511ddf..8b0191b9c6 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -1,6 +1,6 @@ --- title: Policy CSP - LocalPoliciesSecurityOptions -description: Policy CSP - LocalPoliciesSecurityOptions +description: These settings prevents users from adding new Microsoft accounts on a specific computer using LocalPoliciesSecurityOptions. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -45,15 +45,6 @@ manager: dansimp
    LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    -
    - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways -
    -
    - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible -
    -
    - LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges -
    LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    @@ -102,6 +93,9 @@ manager: dansimp
    LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    +
    + LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM +
    LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    @@ -111,6 +105,9 @@ manager: dansimp
    LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    +
    + LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients +
    LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    @@ -126,18 +123,12 @@ manager: dansimp
    LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    -
    - LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon -
    LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    -
    - LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems -
    LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    @@ -708,256 +699,6 @@ GP Info:
    - -**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows EditionSupported?
    Homecross mark
    Procheck mark4
    Businesscheck mark4
    Enterprisecheck mark4
    Educationcheck mark4
    - - -
    - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - - -> [!WARNING] -> Starting in the version 1809 of Windows, this policy is deprecated. - -Domain member: Digitally encrypt or sign secure channel data (always) - -This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies: - -Domain member: Digitally encrypt secure channel data (when possible) -Domain member: Digitally sign secure channel data (when possible) - -Default: Enabled. - -Notes: - -If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. -If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. -Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not. - - - -GP Info: -- GP English name: *Domain member: Digitally encrypt or sign secure channel data (always)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - - - - - - -
    - - -**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows EditionSupported?
    Homecross mark
    Procheck mark4
    Businesscheck mark4
    Enterprisecheck mark4
    Educationcheck mark4
    - - -
    - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - - -> [!WARNING] -> Starting in the version 1809 of Windows, this policy is deprecated. - -Domain member: Digitally encrypt secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption. - -Default: Enabled. - -Important - -There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted. - -Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains. - - - -GP Info: -- GP English name: *Domain member: Digitally encrypt secure channel data (when possible)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - - - - - - -
    - - -**LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows EditionSupported?
    Homecross mark
    Procheck mark4
    Businesscheck mark4
    Enterprisecheck mark4
    Educationcheck mark4
    - - -
    - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - - -> [!WARNING] -> Starting in the version 1809 of Windows, this policy is deprecated. - -Domain member: Disable machine account password changes - -Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days. - -Default: Disabled. - -Notes - -This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions. -This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names. - - - -GP Info: -- GP English name: *Domain member: Disable machine account password changes* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - - - - - - -
    - **LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked** @@ -2166,6 +1907,73 @@ GP Info:
    + +**LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procheck mark3
    Businesscheck mark3
    Enterprisecheck mark3
    Educationcheck mark3
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Network security: Allow Local System to use computer identity for NTLM. + +When services connect to devices that are running versions of the Windows operating system earlier than Windows Vista or Windows Server 2008, services that run as Local System and use SPNEGO (Negotiate) that revert to NTLM will authenticate anonymously. In Windows Server 2008 R2 and Windows 7 and later, if a service connects to a computer running Windows Server 2008 or Windows Vista, the system service uses the computer identity. + +When a service connects with the device identity, signing and encryption are supported to provide data protection. (When a service connects anonymously, a system-generated session key is created, which provides no protection, but it allows applications to sign and encrypt data without errors. Anonymous authentication uses a NULL session, which is a session with a server in which no user authentication is performed; and therefore, anonymous access is allowed.) + + + +GP Info: +- GP English name: *Network security: Allow Local System to use computer identity for NTLM* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + +Valid values: +- 0 - Disabled +- 1 - Enabled (Allow Local System to use computer identity for NTLM.) + + + + +
    + **LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests** @@ -2385,6 +2193,74 @@ GP Info:
    + +**LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procheck mark4
    Businesscheck mark4
    Enterprisecheck mark4
    Educationcheck mark4
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Network security: Minimum session security for NTLM SSP based (including secure RPC) clients. + +This security setting allows a client device to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: + +- Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. +- Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. + +Default: + +Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. + +Windows 7 and Windows Server 2008 R2: Require 128-bit encryption. + + + +GP Info: +- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* +- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + +
    + **LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers** @@ -2761,60 +2637,6 @@ GP Info:
    - -**LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows EditionSupported?
    Homecross mark
    Procheck mark3
    Businesscheck mark3
    Enterprisecheck mark3
    Educationcheck mark3
    - - -
    - - -Recovery console: Allow automatic administrative logon - -This security setting determines if the password for the Administrator account must be given before access to the system is granted. If this option is enabled, the Recovery Console does not require you to provide a password, and it automatically logs on to the system. - -Default: This policy is not defined and automatic administrative logon is not allowed. - -Value type is integer. Supported operations are Add, Get, Replace, and Delete. - - - -Valid values: -- 0 - disabled -- 1 - enabled (allow automatic administrative logon) - - - - -
    - **LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn** @@ -2954,63 +2776,6 @@ GP Info:
    - -**LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows EditionSupported?
    Homecross mark
    Procheck mark4
    Businesscheck mark4
    Enterprisecheck mark4
    Educationcheck mark4
    - - -
    - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -System objects: Require case insensitivity for non-Windows subsystems - -This security setting determines whether case insensitivity is enforced for all subsystems. The Win32 subsystem is case insensitive. However, the kernel supports case sensitivity for other subsystems, such as POSIX. - -If this setting is enabled, case insensitivity is enforced for all directory objects, symbolic links, and IO objects, including file objects. Disabling this setting does not allow the Win32 subsystem to become case sensitive. - -Default: Enabled. - - - - -
    - **LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation** @@ -3693,11 +3458,13 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md new file mode 100644 index 0000000000..38ef9aa0b9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -0,0 +1,232 @@ +--- +title: Policy CSP - LocalUsersAndGroups +description: Policy CSP - LocalUsersAndGroups +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - LocalUsersAndGroups + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## LocalUsersAndGroups policies + +
    +
    + LocalUsersAndGroups/Configure +
    +
    + + +
    + + +**LocalUsersAndGroups/Configure** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procheck mark9
    Businesscheck mark9
    Enterprisecheck mark9
    Educationcheck mark9
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in Windows 10, version 20H2. This policy setting allows IT admins to add, remove, or replace members of local groups on a managed device. + +> [!NOTE] +> The [RestrictedGroups/ConfigureGroupMembership](./policy-csp-restrictedgroups.md#restrictedgroups-configuregroupmembership) policy setting also allows you to configure members (users or AAD groups) to a Windows 10 local group. However, it allows only for a full replace of the existing groups with the new members and does not allow selective add or remove. +> +> Starting from Windows 10, version 20H2, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. Applying both the policies to the same device is unsupported and may yield unpredictable results. + +Here's an example of the policy definition XML for group configuration: + +```xml + + + + + + + +``` + +where: + +- ``: Specifies the name or SID of the local group to configure. If you specify a SID, the [LookupAccountSid](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API is used to translate the SID to a valid group name. If you specify a name, the [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API is used to lookup the group and validate the name. If name/SID lookup fails, the group is skipped and the next group in the XML file is processed. If there are multiple errors, the last error is returned at the end of the policy processing. +- ``: Specifies the action to take on the local group, which can be Update and Restrict, represented by U and R: + - Update. This action must be used to keep the current group membership intact and add or remove members of the specific group. + - Restrict. This action must be used to replace current membership with the newly specified groups. This action provides the same functionality as the [RestrictedGroups/ConfigureGroupMembership](./policy-csp-restrictedgroups.md#restrictedgroups-configuregroupmembership) policy setting. +- ``: Specifies the SID or name of the member to configure. +- ``: Specifies the SID or name of the member to remove from the specified group. + + > [!NOTE] + > When specifying member names of domain accounts, use fully qualified account names where possible (for example, domain_name\user_name) instead of isolated names (for example, group_name). This way, you can avoid getting ambiguous results when users or groups with the same name exist in multiple domains and locally. See [LookupAccountNameA function](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea#remarks) for more information. + +See [Use custom settings for Windows 10 devices in Intune](https://docs.microsoft.com/mem/intune/configuration/custom-settings-windows-10) for information on how to create custom profiles. + +> [!IMPORTANT] +> - `` and `` can use an Azure AD SID or the user's name. For adding or removing Azure AD groups using this policy, you must use the group's SID. Azure AD group SIDs can be obtained using [Graph](https://docs.microsoft.com/graph/api/resources/group?view=graph-rest-1.0#json-representation) API for Groups. The SID is present in the `securityIdentifier` attribute. +> - When specifying a SID in the `` or ``, member SIDs are added without attempting to resolve them. Therefore, be very careful when specifying a SID to ensure it is correct. +> - `` is not valid for the R (Restrict) action and will be ignored if present. +> - The list in the XML is processed in the given order except for the R actions, which get processed last to ensure they win. It also means that if a group is present multiple times with different add/remove values, all of them will be processed in the order they are present. + + + + + + +**Examples** + +Example 1: Update action for adding and removing group members. + +The following example shows how you can update a local group (**Backup Operators**)—add a domain group as a member using its name (**Contoso\ITAdmins**), add the built-in Administrators group using its [well known SID](https://docs.microsoft.com/windows/win32/secauthz/well-known-sids), add a AAD group by its SID (**S-1-12-1-111111111-22222222222-3333333333-4444444444**), and remove a local account (**Guest**). + +```xml + + + + + + + + + +``` + +Example 2: Restrict action for replacing the group membership. + +The following example shows how you can restrict a local group (**Backup Operators**)—replace its membership with the built-in Administrators group using its [well known SID](https://docs.microsoft.com/windows/win32/secauthz/well-known-sids) and add a local account (**Guest**). + +```xml + + + + + + + +``` + + + + + +
    + +## FAQs + +This section provides answers to some common questions you might have about the LocalUsersAndGroups policy CSP. + +### What happens if I accidentally remove the built-in Administrator SID from the Administrators group? + +Removing the built-in Administrator account from the built-in Administrators group is blocked at SAM/OS level for security reasons. Attempting to do so will result in failure with the following error: + +| Error Code | Symbolic Name | Error Description | Header | +|----------|----------|----------|----------| +| 0x55b (Hex)
    1371 (Dec) |ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.| winerror.h | + +When configuring the built-in Administrators group with the R (Restrict) action, specify the built-in Administrator account SID/Name in `` to avoid this error. + +### Can I add a member that already exists? + +Yes, you can add a member that is already a member of a group. This will result in no changes to the group and no error. + +### Can I remove a member if it isn't a member of the group? + +Yes, you can remove a member even if it isn't a member of the group. This will result in no changes to the group and no error. + +### How can I add a domain group as a member to a local group? + +To add a domain group as a member to a local group, specify the domain group in `` of the local group. Use fully qualified account names (for example, domain_name\group_name) instead of isolated names (for example, group_name) for the best results. See [LookupAccountNameA function](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea#remarks) for more information. + +### Can I apply more than one LocalUserAndGroups policy/XML to the same device? + +No, this is not allowed. Attempting to do so will result in a conflict in Intune. + +### What happens if I specify a group name that doesn't exist? + +Invalid group names or SIDs will be skipped. Valid parts of the policy will apply, and error will be returned at the end of the processing. This behavior aligns with the on-prem AD GPP (Group Policy Preferences) LocalUsersAndGroups policy. Similarly, invalid member names will be skipped, and error will be returned at the end to notify that not all settings were applied successfully. + +### What happens if I specify R and U in the same XML? + +If you specify both R and U in the same XML, the R (Restrict) action takes precedence over U (Update). Therefore, if a group appears twice in the XML, once with U and again with R, the R action wins. + +### How do I check the result of a policy that is applied on the client device? + +After a policy is applied on the client device, you can investigate the event log to review the result: + +1. Open Event Viewer (**eventvwr.exe**). +2. Navigate to **Applications and Services Logs** > **Microsoft** > **Windows** > **DeviceManagement-Enterprise- +Diagnostics-Provider** > **Admin**. +3. Search for the `LocalUsersAndGroups` string to review the relevant details. + +### How can I troubleshoot Name/SID lookup APIs? + +To troubleshoot Name/SID lookup APIs: + +1. Enable **lsp.log** on the client device by running the following commands: + + ```cmd + Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgInfoLevel -Value 0x800 -Type dword -Force + + Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgTraceOptions -Value 0x1 -Type dword -Force + ``` + + The **lsp.log** file (**C:\windows\debug\lsp.log**) will be displayed. This log file tracks the SID-Name resolution. + +2. Turn the logging off by running the following command: + + ```cmd + Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name LspDbgInfoLevel -Value 0x0 -Type dword -Force + ``` + + +Footnotes: + +- 9 - Available in Windows 10, version 20H2. + + diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index 18d00b257a..bc065532ed 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -1,6 +1,6 @@ --- title: Policy CSP - LockDown -description: Policy CSP - LockDown +description: Use the Policy CSP - LockDown setting to allow the user to invoke any system user interface by swiping in from any screen edge using touch. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -99,12 +99,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index 8635166d18..34c246f134 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Maps -description: Policy CSP - Maps +description: Use the Policy CSP - Maps setting to allow the download and update of map data over metered connections. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -164,12 +164,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index aefb521407..43fe8e0e47 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Messaging -description: Policy CSP - Messaging +description: Enable, and disable, text message back up and restore as well as Messaging Everywhere by using the Policy CSP for messaging. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -98,12 +98,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md new file mode 100644 index 0000000000..9b9c05d03d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -0,0 +1,314 @@ +--- +title: Policy CSP - MixedReality +description: Policy CSP - MixedReality +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 10/06/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - MixedReality +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
    + + +## MixedReality policies + +
    +
    + MixedReality/AADGroupMembershipCacheValidityInDays +
    +
    + MixedReality/BrightnessButtonDisabled +
    +
    + MixedReality/FallbackDiagnostics +
    +
    + MixedReality/MicrophoneDisabled +
    +
    + MixedReality/VolumeButtonDisabled +
    +
    + + +
    + + +**MixedReality/AADGroupMembershipCacheValidityInDays** + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    HoloLens (1st gen) Development Editioncross mark
    HoloLens (1st gen) Commercial Suitecross mark
    HoloLens 2check mark9
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls for how many days Azure AD group membership cache is allowed to be used for Assigned Access configurations targeting Azure AD groups for signed in user. Once this policy setting is set only then cache is used otherwise not. In order for this policy setting to take effect, user must sign out and sign in with Internet available at least once before the cache can be used for subsequent "disconnected" sessions. + + + + + + + +Supported values are 0-60. The default value is 0 (day) and maximum value is 60 (days). + + + +
    + + +**MixedReality/BrightnessButtonDisabled** + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    HoloLens (1st gen) Development Editioncross mark
    HoloLens (1st gen) Commercial Suitecross mark
    HoloLens 2check mark9
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls if pressing the brightness button changes the brightness or not. It only impacts brightness on HoloLens and not the functionality of the button when it is used with other buttons as combination for other purposes. + + + + + + + +The following list shows the supported values: + +- 0 - False (Default) +- 1 - True + + + +
    + + +**MixedReality/FallbackDiagnostics** + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    HoloLens (1st gen) Development Editioncross mark
    HoloLens (1st gen) Commercial Suitecross mark
    HoloLens 2check mark9
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls when and if diagnostic logs can be collected using specific button combination on HoloLens. + + + + + + + +The following list shows the supported values: + +- 0 - Disabled +- 1 - Enabled for device owners +- 2 - Enabled for all (Default) + + + +
    + + +**MixedReality/MicrophoneDisabled** + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    HoloLens (1st gen) Development Editioncross mark
    HoloLens (1st gen) Commercial Suitecross mark
    HoloLens 2check mark9
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls whether microphone on HoloLens 2 is disabled or not. + + + + + + + +The following list shows the supported values: + +- 0 - False (Default) +- 1 - True + + + +
    + + +**MixedReality/VolumeButtonDisabled** + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    HoloLens (1st gen) Development Editioncross mark
    HoloLens (1st gen) Commercial Suitecross mark
    HoloLens 2check mark9
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls if pressing the volume button changes the volume or not. It only impacts volume on HoloLens and not the functionality of the button when it is used with other buttons as combination for other purposes. + + + + + + + +The following list shows the supported values: + +- 0 - False (Default) +- 1 - True + + + +
    + +Footnotes: + +- 9 - Available in Windows 10, version 20H2. + + + diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 598cad17d2..d464f4c063 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -1,6 +1,6 @@ --- title: Policy CSP - MSSecurityGuide -description: Policy CSP - MSSecurityGuide +description: Learn how Policy CSP - MSSecurityGuide, an ADMX-backed policy, requires a special SyncML format to enable or disable. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -424,12 +424,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index 80b3024ffa..d4a5030052 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -1,6 +1,6 @@ --- title: Policy CSP - MSSLegacy -description: Policy CSP - MSSLegacy +description: Learn how Policy CSP - MSSLegacy, an ADMX-backed policy, requires a special SyncML format to enable or disable. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -292,12 +292,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md new file mode 100644 index 0000000000..fd1e3372e8 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -0,0 +1,131 @@ +--- +title: Policy CSP - Multitasking +description: Policy CSP - Multitasking +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/30/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - Multitasking + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## Multitasking policies + +
    +
    + Multitasking/BrowserAltTabBlowout +
    +
    + + +
    + + +**Multitasking/BrowserAltTabBlowout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procheck mark9
    Businesscheck mark9
    Enterprisecheck mark9
    Educationcheck mark9
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + + +> [!Warning] +> This policy is currently in preview mode only and will be supported in future releases. It may be used for testing purposes, but should not be used in a production environment at this time. + +This policy controls the inclusion of Edge tabs into Alt+Tab. + +Enabling this policy restricts the number of Edge tabs that are allowed to appear in the Alt+Tab switcher. Alt+Tab can be configured to show all open Edge tabs, only the 5 most recent tabs, only the 3 most recent tabs, or no tabs. Setting the policy to no tabs configures the Alt+Tab switcher to show app windows only, which is the classic Alt+Tab behavior. + +This policy only applies to the Alt+Tab switcher. When the policy is not enabled, the feature respects the user's setting in the Settings app. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the inclusion of Edge tabs into Alt-Tab* +- GP name: *BrowserAltTabBlowout* +- GP path: *Windows Components/Multitasking* +- GP ADMX file name: *Multitasking.admx* + + + + +The following list shows the supported values: + +- 1 - Open windows and all tabs in Edge. +- 2 - Open windows and 5 most recent tabs in Edge. +- 3 - Open windows and 3 most recent tabs in Edge. +- 4 - Open windows only. + + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. +- 9 - Available in Windows 10, version 20H2. + + + diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 3d7afccb49..95d9af4a93 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -1,6 +1,6 @@ --- title: Policy CSP - NetworkIsolation -description: Policy CSP - NetworkIsolation +description: Learn how Policy CSP - NetworkIsolation contains a list of Enterprise resource domains hosted in the cloud that need to be protected. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -228,7 +228,7 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff -Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. +Integer value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. @@ -468,7 +468,7 @@ ADMX Info: -Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. +Integer value that tells the client to accept the configured list of proxies and not try to detect other work proxies. @@ -544,12 +544,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 8433af94b3..fb3651acb0 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Notifications -description: Policy CSP - Notifications +description: Block applications from using the network to send tile, badge, toast, and raw notifications for Policy CSP - Notifications. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -264,12 +264,14 @@ Validation: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index e5adaec521..d17cdbe1bc 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Power -description: Policy CSP - Power +description: Learn how the Policy CSP - Power setting manages whether or not Windows is allowed to use standby states when putting the computer in a sleep state. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -1731,12 +1731,14 @@ Default value for unattended sleep timeout (plugged in): Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index 16ec44e238..e93f27025d 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Printers -description: Policy CSP - Printers +description: Use this policy setting to control the client Point and Print behavior, including security prompts for Windows Vista computers. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -287,12 +287,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 0079133981..ca873b0393 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Privacy -description: Policy CSP - Privacy +description: Learn how the Policy CSP - Privacy setting allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -5964,12 +5964,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 599dc2d1f3..340bef38c2 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -1,6 +1,6 @@ --- title: Policy CSP - RemoteAssistance -description: Policy CSP - RemoteAssistance +description: Learn how the Policy CSP - RemoteAssistance setting allows you to specify a custom message to display. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -371,12 +371,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index e5588c0da4..a33ad83d33 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -1,6 +1,6 @@ --- title: Policy CSP - RemoteDesktopServices -description: Policy CSP - RemoteDesktopServices +description: Learn how the Policy CSP - RemoteDesktopServices setting allows you to configure remote access to computers by using Remote Desktop Services. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -498,12 +498,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 0eecb5bda9..fae950baec 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -1,6 +1,6 @@ --- title: Policy CSP - RemoteManagement -description: Policy CSP - RemoteManagement +description: Learn how the Policy CSP - RemoteManagement setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -1152,12 +1152,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index 1870b26735..493027a454 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -1,6 +1,6 @@ --- title: Policy CSP - RemoteProcedureCall -description: Policy CSP - RemoteProcedureCall +description: The Policy CSP - RemoteProcedureCall setting controls whether RPC clients authenticate when the call they are making contains authentication information. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -190,12 +190,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 8062074499..ac6201611a 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -1,6 +1,6 @@ --- title: Policy CSP - RemoteShell -description: Policy CSP - RemoteShell +description: Learn details about the Policy CSP - RemoteShell setting so that you can configure access to remote shells. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -543,12 +543,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 8053b57d73..4b9506c5c9 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -1,6 +1,6 @@ --- title: Policy CSP - RestrictedGroups -description: Policy CSP - RestrictedGroups +description: Learn how the Policy CSP - RestrictedGroups setting allows an administrator to define the members that are part of a security-sensitive (restricted) group. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -8,13 +8,14 @@ ms.technology: windows author: manikadhiman ms.localizationpriority: medium ms.date: 04/07/2020 - ms.reviewer: manager: dansimp --- # Policy CSP - RestrictedGroups +> [!IMPORTANT] +> Starting from Windows 10, version 20H2, it is recommended to use the [LocalUsersandGroups](policy-csp-localusersandgroups.md) policy instead of the RestrictedGroups policy to configure members (users or AAD groups) to a Windows 10 local group. Applying both the policies to the same device is unsupported and may yield unpredictable results.
    @@ -86,7 +87,7 @@ For example, you can create a Restricted Groups policy to allow only specified u > |----------|----------|----------|----------| > | 0x55b (Hex)
    1371 (Dec) |ERROR_SPECIAL_ACCOUNT|Cannot perform this operation on built-in accounts.| winerror.h | -Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. +Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of zero members when applying the policy implies clearing the access group and should be used with caution. ```xml @@ -139,32 +140,46 @@ Here's an example:
    - + ``` where: -- `` contains the local group SID or group name to configure. If an SID is specified here, the policy uses the [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API to get the local group name. For best results, use names for ``. -- `` contains the members to add to the group in ``. If a name is specified here, the policy will try to get the corresponding SID using the [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. (**Note:** This doesn't query Azure AD). For best results, use SID for ``. As groups can be renamed and account name lookups are limited to AD/local machine, hence SID is the best and most deterministic way to configure. -The member SID can be a user account or a group in AD, Azure AD, or on the local machine. Membership is configured using the [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API. -- In this example, `Group1` and `Group2` are local groups on the device being configured. +- `` contains the local group SID or group name to configure. If a SID is specified here, the policy uses the [LookupAccountName](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountnamea) API to get the local group name. For best results, use names for ``. +- `` contains the members to add to the group in ``. A member can be specified as a name or as a SID. For best results, use a SID for ``. The member SID can be a user account or a group in AD, Azure AD, or on the local machine. If a name is specified here, the policy will try to get the corresponding SID using the [LookupAccountSID](https://docs.microsoft.com/windows/win32/api/winbase/nf-winbase-lookupaccountsida) API. Name can be used for a user account or a group in AD or on the local machine. Membership is configured using the [NetLocalGroupSetMembers](https://docs.microsoft.com/windows/win32/api/lmaccess/nf-lmaccess-netlocalgroupsetmembers) API. +- In this example, `Group1` and `Group2` are local groups on the device being configured, and `Group3` is a domain group. -> [!Note] -> Currently, the RestrictedGroups/ConfigureGroupMembership policy does not have a MemberOf functionality. However, you can add a local group as a member to another local group by using the member portion, as shown in the above example. +> [!NOTE] +> Currently, the RestrictedGroups/ConfigureGroupMembership policy does not have a MemberOf functionality. However, you can add a domain group as a member to a local group by using the member portion, as shown in the previous example. +### Policy timeline + +The behavior of this policy setting differs in different Windows 10 versions. For Windows 10, version 1809 through version 1909, you can use name in `` and SID in ``. For Windows 10, version 2004, you can use name or SID for both the elements, as described in this topic. + +The following table describes how this policy setting behaves in different Windows 10 versions: + +| Windows 10 version | Policy behavior | +| ------------------ | --------------- | +|Windows 10, version 1803 | Added this policy setting.
    XML accepts group and member only by name.
    Supports configuring the administrators group using the group name.
    Expects member name to be in the account name format. | +| Windows 10, version 1809
    Windows 10, version 1903
    Windows 10, version 1909 | Supports configuring any local group.
    `` accepts only name.
    `` accepts a name or an SID.
    This is useful when you want to ensure a certain local group always has a well-known SID as member. | +| Windows 10, version 2004 | Behaves as described in this topic.
    Accepts name or SID for group and members and translates as appropriate. | + +
    Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 273291c10b..b3290f82dc 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -1,13 +1,13 @@ --- title: Policy CSP - Search -description: Policy CSP - Search +description: Learn how the Policy CSP - Search setting allows search and Cortana to search cloud sources like OneDrive and SharePoint. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 09/27/2019 +ms.date: 02/12/2021 ms.reviewer: manager: dansimp --- @@ -25,9 +25,6 @@ manager: dansimp
    Search/AllowCloudSearch
    -
    - Search/AllowCortanaInAAD -
    Search/AllowFindMyFiles
    @@ -137,7 +134,6 @@ The following list shows the supported values:
    -**Search/AllowCortanaInAAD** @@ -178,30 +174,6 @@ The following list shows the supported values:
    - - -Added in Windows 10, version 1803. This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. If this policy is left in its default state, Cortana will not be shown in the AAD OOBE flow. If you opt-in to this policy, then the Cortana consent page will appear in the AAD OOBE flow.. - - - -ADMX Info: -- GP English name: *Allow Cortana Page in OOBE on an AAD account* -- GP name: *AllowCortanaInAAD* -- GP path: *Windows Components/Search* -- GP ADMX file name: *Search.admx* - - - -The following list shows the supported values: - -- 0 (default) - Not allowed. The Cortana consent page will not appear in AAD OOBE during setup. -- 1 - Allowed. The Cortana consent page will appear in Azure AAD OOBE during setup. - - - - -
    - **Search/AllowFindMyFiles** @@ -959,12 +931,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 0a4dcd146d..7c7feb1aeb 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Security -description: Policy CSP - Security +description: Learn how the Policy CSP - Security setting can specify whether to allow the runtime configuration agent to install provisioning packages. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Security -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
    @@ -710,12 +707,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index fff74ab134..8f43acb2ab 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - ServiceControlManager -description: Policy CSP - ServiceControlManager +description: Learn how the Policy CSP - ServiceControlManager setting enables process mitigation options on svchost.exe processes. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -78,6 +78,9 @@ If you enable this policy setting, built-in system services hosted in svchost.ex This includes a policy requiring all binaries loaded in these processes to be signed by Microsoft, as well as a policy disallowing dynamically-generated code. +> [!IMPORTANT] +> Enabling this policy could cause compatibility issues with third-party software that uses svchost.exe processes (for example, third-party antivirus software). + If you disable or do not configure this policy setting, the stricter security settings will not be applied. @@ -112,12 +115,13 @@ Supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 5b737586b2..1e16989ede 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Settings -description: Policy CSP - Settings +description: Learn how to use the Policy CSP - Settings setting so that you can allow the user to change Auto Play settings. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -897,12 +897,13 @@ To validate on Desktop, do the following: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. - +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 83b2b4ee01..2cdf136faf 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -1,6 +1,6 @@ --- title: Policy CSP - SmartScreen -description: Policy CSP - SmartScreen +description: Use the Policy CSP - SmartScreen setting to allow IT Admins to control whether users are allowed to install apps from places other than the Store. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -239,12 +239,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 8ecc09d034..39cd9db038 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Speech -description: Policy CSP - Speech +description: Learn how the Policy CSP - Speech setting specifies whether the device will receive updates to the speech recognition and speech synthesis models. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -97,12 +97,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index c5e74893fc..0b6888322b 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Start -description: Policy CSP - Start +description: Use the Policy CSP - Start setting to control the visibility of the Documents shortcut on the Start menu. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Start -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
    @@ -1377,7 +1374,7 @@ To validate on Desktop, do the following: > [!NOTE] > This policy requires reboot to take effect. -Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently opened items in the jumplists from appearing. +Added in Windows 10, version 1703. Allows IT Admins to configure Start by hiding recently opened items in the jump lists from appearing. @@ -1392,13 +1389,13 @@ To validate on Desktop, do the following: 1. Enable "Show recently opened items in Jump Lists on Start of the taskbar" in Settings. 2. Pin Photos to the taskbar, and open some images in the photos app. -3. Right click the pinned photos app and verify that a jumplist of recently opened items pops up. +3. Right click the pinned photos app and verify that a jump list of recently opened items pops up. 4. Toggle "Show recently opened items in Jump Lists on Start of the taskbar" in Settings to clear jump lists. 5. Enable policy. 6. Restart explorer.exe 7. Check that Settings toggle is grayed out. 8. Repeat Step 2. -9. Right Click pinned photos app and verify that there is no jumplist of recent items. +9. Right Click pinned photos app and verify that there is no jump list of recent items. @@ -2097,12 +2094,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index bc6f3d7253..52f43753a2 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Storage -description: Policy CSP - Storage +description: Learn to use the Policy CSP - Storage settings to automatically clean some of the user’s files to free up disk space. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -731,12 +731,14 @@ See [Use custom settings for Windows 10 devices in Intune](https://docs.microsof Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 7cb986c7fd..6012a60ed9 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -1,13 +1,13 @@ --- title: Policy CSP - System -description: Policy CSP - System +description: Learn policy settings that determine whether users can access the Insider build controls in the advanced options for Windows Update. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 09/27/2019 +ms.date: 10/14/2020 ms.reviewer: manager: dansimp --- @@ -212,16 +212,13 @@ The following list shows the supported values: -> [!NOTE] -> This policy setting applies only to the Windows operating system and apps included with Windows, it does not apply to third-party apps or services running on Windows 10. +This policy setting opts the device into the Windows enterprise data pipeline. -This policy setting opts the device into the Windows enterprise data pipeline. +If you enable this setting, data collected from the device will be opted into the Windows enterprise data pipeline. -If you enable this setting, data collected from the device is opted into the Windows enterprise data pipeline. +If you disable or don't configure this setting, all data from the device will be collected and processed in accordance with our policies for the Windows standard data pipeline. -If you disable or do not configure this setting, all data from the device is collected and processed in accordance with the policies for the Windows standard data pipeline. - -Configuring this setting does not change the telemetry collection level or the ability of the user to change the level. +Configuring this setting does not change the telemetry collection level or the ability of the user to change the level. This setting only applies to the Windows operating system and apps included with Windows, not third-party apps or services running on Windows 10. @@ -236,8 +233,8 @@ ADMX Info: The following list shows the supported values: -- 0 (default) - Do not use the Windows Commercial Data Pipeline -- 1 - Use the Windows Commercial Data Pipeline +- 0 (default) - Disabled. +- 1 - Enabled. @@ -492,7 +489,7 @@ The following list shows the supported values: -Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts. +Added in Windows 10, version 1703. Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally installed fonts. This MDM setting corresponds to the EnableFontProviders Group Policy setting. If both the Group Policy and the MDM settings are configured, the group policy setting takes precedence. If neither is configured, the behavior depends on a DisableFontProviders registry value. In server editions, this registry value is set to 1 by default, so the default behavior is false (disabled). In all other editions, the registry value is not set by default, so the default behavior is true (enabled). @@ -513,7 +510,7 @@ ADMX Info: The following list shows the supported values: -- 0 - false - No traffic to fs.microsoft.com and only locally-installed fonts are available. +- 0 - false - No traffic to fs.microsoft.com and only locally installed fonts are available. - 1 - true (default) - There may be network traffic to fs.microsoft.com and downloadable fonts are available to apps that support them. @@ -600,7 +597,6 @@ The following list shows the supported values: -
    @@ -708,14 +704,11 @@ The following list shows the supported values: -Allow the device to send diagnostic and usage telemetry data, such as Watson. +Allows the device to send diagnostic and usage telemetry data, such as Watson. For more information about diagnostic data, including what is and what is not collected by Windows, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization). -The following tables describe the supported values: - -Windows 8.1 Values: - +The following list shows the supported values for Windows 8.1: - 0 - Not allowed. - 1 – Allowed, except for Secondary Data Requests. - 2 (default) – Allowed. @@ -743,13 +736,12 @@ Windows 8.1 Values:
    --> -Windows 10 Values: - -- 0 – Security. Information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. - Note: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1. -- 1 – Basic. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the Security level. -- 2 – Enhanced. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the Basic and the Security levels. -- 3 – Full. All data necessary to identify and help to fix problems, plus data from the Security, Basic, and Enhanced levels. +In Windows 10, you can configure this policy setting to decide what level of diagnostic data to send to Microsoft. The following list shows the supported values for Windows 10: +- 0 – (**Security**) Sends information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Microsoft Defender. + **Note:** This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), Hololens 2, and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1. +- 1 – (**Basic**) Sends the same data as a value of 0, plus additional basic device info, including quality-related data, app compatibility, and app usage data. +- 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows, Windows Server, System Center, and apps are used, how they perform, and advanced reliability data. +- 3 – (**Full**) Sends the same data as a value of 2, plus all data necessary to identify and fix problems with devices.
    - **System/BootStartDriverInitialization** @@ -1069,6 +1060,11 @@ ADMX Info: - GP ADMX file name: *DataCollection.admx* + +The following list shows the supported values: +- 0 (default) - Enable telemetry change notifications +- 1 - Disable telemetry change notifications +
    @@ -1124,7 +1120,7 @@ If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry If you set this policy setting to "Enable Telemetry opt-in Settings" or don't configure this policy setting, people can change their own telemetry levels in Settings. > [!Note] -> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. +> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's acceptable level of data disclosure. @@ -1136,6 +1132,11 @@ ADMX Info: - GP ADMX file name: *DataCollection.admx* + +The following list shows the supported values: +- 0 (default) - Enable Telemetry opt-in Settings +- 1 - Disable Telemetry opt-in Settings +
    @@ -1605,7 +1606,7 @@ The following list shows the supported values: This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. -To enable this behavior you must complete two steps: +To enable this behavior, you must complete two steps:
    • Enable this policy setting
    • Set Allow Telemetry to level 2 (Enhanced)
    • @@ -1769,12 +1770,13 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 85d08130a7..a7f98a6c0c 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -1,6 +1,6 @@ --- title: Policy CSP - SystemServices -description: Policy CSP - SystemServices +description: Learn how to use the Policy CSP - SystemServices setting to determine whether the service's start type is Automatic(2), Manual(3), Disabled(4). ms.author: dansimp ms.topic: article ms.prod: w10 @@ -388,12 +388,14 @@ GP Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 8a69418c47..ce84398393 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - TaskManager -description: Policy CSP - TaskManager +description: Learn how to use the Policy CSP - TaskManager setting to determine whether non-administrators can use Task Manager to end tasks. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - TaskManager -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
      @@ -100,12 +97,14 @@ When the policy is set to 0 - users CANNOT execute 'End task' on processes in Ta Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index 4bc5ef3a22..ab6ec4d46c 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -1,6 +1,6 @@ --- title: Policy CSP - TaskScheduler -description: Policy CSP - TaskScheduler +description: Learn how to use the Policy CSP - TaskScheduler setting to determine whether the specific task is enabled (1) or disabled (0). ms.author: dansimp ms.topic: article ms.prod: w10 @@ -82,12 +82,13 @@ Added in Windows 10, version 1803. This setting determines whether the specific Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. - +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 7786a5eb5c..99360d692b 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1,6 +1,6 @@ --- title: Policy CSP - TextInput -description: Policy CSP - TextInput +description: The Policy CSP - TextInput setting allows the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -16,10 +16,6 @@ manager: dansimp -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before they are commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - -
      @@ -815,19 +811,19 @@ This setting supports a range of values between 0 and 1. Pro - check mark + check mark8 Business - check mark + check mark8 Enterprise - check mark + check mark8 Education - check mark + check mark8 @@ -848,7 +844,7 @@ This setting supports a range of values between 0 and 1. > - The policy is only enforced in Windows 10 for desktop. > - This policy requires reboot to take effect. -Added in next major release of Windows 10. Allows IT admins to configure Microsoft Japanese IME version in the desktop. +Added in Windows 10, version 2004. Allows IT admins to configure Microsoft Japanese IME version in the desktop. @@ -878,19 +874,19 @@ The following list shows the supported values: Pro - check mark + check mark8 Business - check mark + check mark8 Enterprise - check mark + check mark8 Education - check mark + check mark8 @@ -911,7 +907,7 @@ The following list shows the supported values: > - This policy is enforced only in Windows 10 for desktop. > - This policy requires reboot to take effect. -Added in next major release of Windows 10. Allows IT admins to configure Microsoft Simplified Chinese IME version in the desktop. +Added in Windows 10, version 2004. Allows IT admins to configure Microsoft Simplified Chinese IME version in the desktop. @@ -941,19 +937,19 @@ The following list shows the supported values: Pro - check mark + check mark8 Business - check mark + check mark8 Enterprise - check mark + check mark8 Education - check mark + check mark8 @@ -974,7 +970,7 @@ The following list shows the supported values: > - This policy is enforced only in Windows 10 for desktop. > - This policy requires reboot to take effect. -Added in next major release of Windows 10. Allows IT admins to configure Microsoft Traditional Chinese IME version in the desktop. +Added in Windows 10, version 2004. Allows IT admins to configure Microsoft Traditional Chinese IME version in the desktop. @@ -1712,12 +1708,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index ffc5c62bec..8ef9349148 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -1,6 +1,6 @@ --- title: Policy CSP - TimeLanguageSettings -description: Learn which TimeLanguageSettings policies are supported for your edition of Windows. +description: Learn to use the Policy CSP - TimeLanguageSettings setting to specify the time zone to be applied to the device. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -91,12 +91,14 @@ Specifies the time zone to be applied to the device. This is the standard Window Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 191bcd30d7..c7862d0866 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Troubleshooting -description: Policy CSP - Troubleshooting +description: The Policy CSP - Troubleshooting setting allows IT admins to configure how to apply recommended troubleshooting for known problems on the devices in their domains. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -140,12 +140,14 @@ By default, this policy is not configured and the SKU based defaults are used fo Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 52098ee14c..1a7026a930 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,21 +1,19 @@ --- title: Policy CSP - Update -description: Policy CSP - Update +description: The Policy CSP - Update allows the IT admin, when used with Update/ActiveHoursStart, to manage a range of active hours where update reboots aren't scheduled. ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 10/04/2019 +ms.date: 11/03/2020 ms.reviewer: manager: dansimp --- # Policy CSP - Update -> [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
      @@ -98,6 +96,9 @@ manager: dansimp
      Update/DisableDualScan
      +
      + Update/DisableWUfBSafeguards +
      Update/EngagedRestartDeadline
      @@ -194,6 +195,12 @@ manager: dansimp
      Update/SetEDURestart
      +
      + Update/SetProxyBehaviorForUpdateDetection +
      +
      + Update/TargetReleaseVersion +
      Update/UpdateNotificationLevel
      @@ -454,11 +461,6 @@ Enables the IT admin to manage automatic update behavior to scan, download, and Supported operations are Get and Replace. - -> [!IMPORTANT] -> This option should be used only for systems under regulatory compliance, as you will not get security updates as well. - - If the policy is not configured, end-users get the default behavior (Auto install and restart). @@ -481,6 +483,11 @@ The following list shows the supported values: - 4 – Auto install and restart without end-user control. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates right away. If a restart is required, then the device is automatically restarted when the device is not actively being used. This setting option also sets the end-user control panel to read-only. - 5 – Turn off automatic updates. + +> [!IMPORTANT] +> This option should be used only for systems under regulatory compliance, as you will not get security updates as well. + + @@ -1106,8 +1113,8 @@ ADMX Info: Supported values: -- true - Enable -- false - Disable (Default) +- 0 - Disable +- 1 - Enable (Default) @@ -1726,18 +1733,19 @@ OS upgrade: Update: - Maximum deferral: 1 month - Deferral increment: 1 week -- Update type/notes: - If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic. - - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 - - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 - - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F - - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 - - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB - - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F - - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 - - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 +- Update type/notes: If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic: + + - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 + - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 + - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F + - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 + - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB + - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F + - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 + - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 Other/cannot defer: + - Maximum deferral: No deferral - Deferral increment: No deferral - Update type/notes: @@ -1921,7 +1929,7 @@ ADMX Info: -Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours. +Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 22 hours with a random variant of 0 - 4 hours. Default is 22 hours. This policy should only be enabled when Update/UpdateServiceUrl is configured to point the device at a WSUS server rather than Microsoft Update. @@ -2009,6 +2017,85 @@ The following list shows the supported values:
      + +**Update/DisableWUfBSafeguards** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark5
      Businesscheck mark5
      Enterprisecheck mark5
      Educationcheck mark5
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Available in Windows Update for Business (WUfB) devices running Windows 10, version 1809 and above and installed with October 2020 security update. This policy setting specifies that a WUfB device should skip safeguards. + +Safeguard holds prevent a device with a known compatibility issue from being offered a new OS version. The offering will proceed once a fix is issued and is verified on a held device. The aim of safeguards is to protect the device and user from a failed or poor upgrade experience. + +The safeguard holds protection is provided by default to all the devices trying to update to a new Windows 10 Feature Update version via Windows Update. + +IT admins can, if necessary, opt devices out of safeguard protections using this policy setting or via the “Disable safeguards for Feature Updates” Group Policy. + +> [!NOTE] +> Opting out of the safeguards can put devices at risk from known performance issues. We recommend opting out only in an IT environment for validation purposes. Further, you can leverage the Windows Insider Program for Business Release Preview Channel in order to validate the upcoming Windows 10 Feature Update version without the safeguards being applied. +> +> The disable safeguards policy will revert to “Not Configured” on a device after moving to a new Windows 10 version, even if previously enabled. This ensures the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. +> +> Disabling safeguards does not guarantee your device will be able to successfully update. The update may still fail on the device and will likely result in a bad experience post upgrade as you are bypassing the protection given by Microsoft pertaining to known issues. + + + +ADMX Info: +- GP English name: *Disable safeguards for Feature Updates* +- GP name: *DisableWUfBSafeguards* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + + +The following list shows the supported values: + +- 0 (default) - Safeguards are enabled and devices may be blocked for upgrades until the safeguard is cleared. +- 1 - Safeguards are not enabled and upgrades will be deployed without blocking on safeguards. + + + + +
      + **Update/EngagedRestartDeadline** @@ -2914,7 +3001,7 @@ The following list shows the supported values: Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. -Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. +Added in Windows 10, version 1607. Allows IT Admins to pause feature updates for up to 35 days. We recomment that you use the *Update/PauseFeatureUpdatesStartTime* policy if you are running Windows 10, version 1703 or later. @@ -2930,7 +3017,7 @@ ADMX Info: The following list shows the supported values: - 0 (default) – Feature Updates are not paused. -- 1 – Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner. +- 1 – Feature Updates are paused for 35 days or until value set to back to 0, whichever is sooner. @@ -2981,7 +3068,7 @@ The following list shows the supported values: -Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates. +Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates. When this policy is configured, Feature Updates will be paused for 35 days from the specified start date. Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. @@ -3043,7 +3130,7 @@ ADMX Info: -Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates. +Added in Windows 10, version 1607. Allows IT Admins to pause quality updates. For those running Windows 10, version 1703 or later, we recommend that you use *Update/PauseQualityUpdatesStartTime* instead. @@ -3110,7 +3197,7 @@ The following list shows the supported values: -Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates. +Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates. When this policy is configured, Quality Updates will be paused for 35 days from the specified start date. Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. @@ -3253,7 +3340,7 @@ The following list shows the supported values: > [!NOTE] -> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. +> This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. @@ -4130,6 +4217,146 @@ The following list shows the supported values:
      + + +**Update/SetProxyBehaviorForUpdateDetection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark1
      Businesscheck mark1
      Enterprisecheck mark1
      Educationcheck mark1
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Available in Windows 10, version 1607 and later. By default, HTTP WSUS servers scan only if system proxy is configured. This policy setting allows you to configure user proxy as a fallback for detecting updates while using an HTTP based intranet server despite the vulnerabilities it presents. + +This policy setting does not impact those customers who have, per Microsoft recommendation, secured their WSUS server with TLS/SSL protocol, thereby using HTTPS based intranet servers to keep systems secure. That said, if a proxy is required, we recommend configuring a system proxy to ensure the highest level of security. + + + +ADMX Info: +- GP English name: *Select the proxy behavior for Windows Update client for detecting updates with non-TLS (HTTP) based service* +- GP name: *Select the proxy behavior* +- GP element: *Select the proxy behavior* +- GP path: *Windows Components/Windows Update/Specify intranet Microsoft update service location* +- GP ADMX file name: *WindowsUpdate.admx* + + + +The following list shows the supported values: + +- 0 (default) - Allow system proxy only for HTTP scans. +- 1 - Allow user proxy to be used as a fallback if detection using system proxy fails. +> [!NOTE] +> Configuring this policy setting to 1 exposes your environment to potential security risk and makes scans unsecure. + + + + +
      + + +**Update/TargetReleaseVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark4
      Businesscheck mark4
      Enterprisecheck mark4
      Educationcheck mark4
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +Available in Windows 10, version 1803 and later. Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information/). + + +ADMX Info: +- GP English name: *Select the target Feature Update version* +- GP name: *TargetReleaseVersion* +- GP element: *TargetReleaseVersionId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Value type is a string containing Windows 10 version number. For example, 1809, 1903. + + + + + + + + + +
      + **Update/UpdateNotificationLevel** @@ -4371,11 +4598,13 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. - +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 25159c3271..b1a0a67245 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,6 +1,6 @@ --- title: Policy CSP - UserRights -description: Policy CSP - UserRights +description: Learn how user rights are assigned for user accounts or groups, and how the name of the policy defines the user right in question. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -18,9 +18,11 @@ manager: dansimp
      -User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. Here is a list for reference, [Well-Known SID Structures](https://msdn.microsoft.com/library/cc980032.aspx). Even though strings are supported for well-known accounts and groups, it is better to use SIDs because strings are localized for different languages. Some user rights allow things like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork. +User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. For reference, see [Well-Known SID Structures](https://msdn.microsoft.com/library/cc980032.aspx). -Here is an example syncml for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups. +Even though strings are supported for well-known accounts and groups, it is better to use SIDs, because strings are localized for different languages. Some user rights allow things like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork. + +Here is an example for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups. ```xml @@ -46,44 +48,58 @@ Here is an example syncml for setting the user right BackupFilesAndDirectories f Here are examples of data fields. The encoded 0xF000 is the standard delimiter/separator. -- Grant an user right to Administrators group via SID: - ``` +- Grant a user right to Administrators group via SID: + ```xml *S-1-5-32-544 ``` -- Grant an user right to multiple groups (Administrators, Authenticated Users) via SID - ``` +- Grant a user right to multiple groups (Administrators, Authenticated Users) via SID: + ```xml *S-1-5-32-544*S-1-5-11 ``` -- Grant an user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings - ``` +- Grant a user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings: + ```xml *S-1-5-32-544Authenticated Users ``` -- Grant an user right to multiple groups (Authenticated Users, Administrators) via strings - ``` +- Grant a user right to multiple groups (Authenticated Users, Administrators) via strings: + ```xml Authenticated UsersAdministrators ``` -- Empty input indicates that there are no users configured to have that user right - ``` +- Empty input indicates that there are no users configured to have that user right: + ```xml ``` + If you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag (``) to wrap the data fields. You can specify one or more user groups within the CDATA tag by using 0xF000 as the delimiter/separator. -> [!Note] +> [!NOTE] > `` is the entity encoding of 0xF000. For example, the following syntax grants user rights to Authenticated Users and Replicator user groups: -``` + +```xml ``` +For example, the following syntax grants user rights to two specific Azure Active Directory (AAD) users from Contoso, user1 and user2: + +```xml + +``` + +For example, the following syntax grants user rights to a specific user or group, by using the Security Identifier (SID) of the account or group: + +```xml + +``` +
      -## UserRights policies +## UserRights policies
      @@ -179,7 +195,7 @@ For example, the following syntax grants user rights to Authenticated Users and
      -**UserRights/AccessCredentialManagerAsTrustedCaller** +**UserRights/AccessCredentialManagerAsTrustedCaller** @@ -193,19 +209,19 @@ For example, the following syntax grants user rights to Authenticated Users and - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -226,7 +242,7 @@ This user right is used by Credential Manager during Backup/Restore. No accounts -GP Info: +GP Info: - GP English name: *Access Credential Manager as a trusted caller* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -236,7 +252,7 @@ GP Info:
      -**UserRights/AccessFromNetwork** +**UserRights/AccessFromNetwork** @@ -250,19 +266,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -279,11 +295,13 @@ GP Info: -This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. +This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right. +> [!NOTE] +> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. -GP Info: +GP Info: - GP English name: *Access this computer from the network* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -293,7 +311,7 @@ GP Info:
      -**UserRights/ActAsPartOfTheOperatingSystem** +**UserRights/ActAsPartOfTheOperatingSystem** @@ -307,19 +325,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -336,11 +354,13 @@ GP Info: -This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. +This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. +> [!CAUTION] +> Assigning this user right can be a security risk. Assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Act as part of the operating system* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -350,7 +370,7 @@ GP Info:
      -**UserRights/AllowLocalLogOn** +**UserRights/AllowLocalLogOn** @@ -364,19 +384,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -393,11 +413,13 @@ GP Info: -This user right determines which users can log on to the computer. Note: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. +This user right determines which users can log on to the computer. +> [!NOTE] +> Modifying this setting might affect compatibility with clients, services, and applications. For compatibility information about this setting, see [Allow log on locally](https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. -GP Info: +GP Info: - GP English name: *Allow log on locally* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -407,7 +429,7 @@ GP Info:
      -**UserRights/BackupFilesAndDirectories** +**UserRights/BackupFilesAndDirectories** @@ -421,19 +443,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -450,11 +472,13 @@ GP Info: -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. Caution: Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system: Traverse Folder/Execute File, Read. +> [!CAUTION] +> Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Back up files and directories* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -464,7 +488,7 @@ GP Info:
      -**UserRights/ChangeSystemTime** +**UserRights/ChangeSystemTime** @@ -478,19 +502,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -511,7 +535,7 @@ This user right determines which users and groups can change the time and date o -GP Info: +GP Info: - GP English name: *Change the system time* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -521,7 +545,7 @@ GP Info:
      -**UserRights/CreateGlobalObjects** +**UserRights/CreateGlobalObjects** @@ -535,19 +559,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -564,11 +588,13 @@ GP Info: -This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Caution: Assigning this user right can be a security risk. Assign this user right only to trusted users. +This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. +> [!CAUTION] +> Assigning this user right can be a security risk. Assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Create global objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -578,7 +604,7 @@ GP Info:
      -**UserRights/CreatePageFile** +**UserRights/CreatePageFile** @@ -592,19 +618,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -621,11 +647,11 @@ GP Info: -This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users +This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users. -GP Info: +GP Info: - GP English name: *Create a pagefile* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -635,7 +661,7 @@ GP Info:
      -**UserRights/CreatePermanentSharedObjects** +**UserRights/CreatePermanentSharedObjects** @@ -649,19 +675,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -682,7 +708,7 @@ This user right determines which accounts can be used by processes to create a d -GP Info: +GP Info: - GP English name: *Create permanent shared objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -692,7 +718,7 @@ GP Info:
      -**UserRights/CreateSymbolicLinks** +**UserRights/CreateSymbolicLinks** @@ -706,19 +732,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -735,11 +761,15 @@ GP Info: -This user right determines if the user can create a symbolic link from the computer he is logged on to. Caution: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Note: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. +This user right determines if the user can create a symbolic link from the computer he is logged on to. +> [!CAUTION] +> This privilege should be given to trusted users only. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. +> [!NOTE] +> This setting can be used in conjunction with a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. -GP Info: +GP Info: - GP English name: *Create symbolic links* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -749,7 +779,7 @@ GP Info:
      -**UserRights/CreateToken** +**UserRights/CreateToken** @@ -763,19 +793,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -792,11 +822,13 @@ GP Info: -This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. +This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. +> [!CAUTION] +> Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. -GP Info: +GP Info: - GP English name: *Create a token object* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -806,7 +838,7 @@ GP Info:
      -**UserRights/DebugPrograms** +**UserRights/DebugPrograms** @@ -820,19 +852,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -849,11 +881,13 @@ GP Info: -This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. +This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. +> [!CAUTION] +> Assigning this user right can be a security risk. Assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Debug programs* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -863,7 +897,7 @@ GP Info:
      -**UserRights/DenyAccessFromNetwork** +**UserRights/DenyAccessFromNetwork** @@ -877,19 +911,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -910,7 +944,7 @@ This user right determines which users are prevented from accessing a computer o -GP Info: +GP Info: - GP English name: *Deny access to this computer from the network* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -920,7 +954,7 @@ GP Info:
      -**UserRights/DenyLocalLogOn** +**UserRights/DenyLocalLogOn** @@ -934,19 +968,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -963,11 +997,13 @@ GP Info: -This security setting determines which service accounts are prevented from registering a process as a service. Note: This security setting does not apply to the System, Local Service, or Network Service accounts. +This security setting determines which service accounts are prevented from registering a process as a service. +> [!NOTE] +> This security setting does not apply to the System, Local Service, or Network Service accounts. -GP Info: +GP Info: - GP English name: *Deny log on as a service* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -977,7 +1013,7 @@ GP Info:
      -**UserRights/DenyRemoteDesktopServicesLogOn** +**UserRights/DenyRemoteDesktopServicesLogOn** @@ -991,19 +1027,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1020,11 +1056,11 @@ GP Info: -This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. +This user right determines which users and groups are prohibited from logging on as Remote Desktop Services clients. -GP Info: +GP Info: - GP English name: *Deny log on through Remote Desktop Services* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1034,7 +1070,7 @@ GP Info:
      -**UserRights/EnableDelegation** +**UserRights/EnableDelegation** @@ -1048,19 +1084,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1077,11 +1113,13 @@ GP Info: -This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. Caution: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. +This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. +> [!CAUTION] +> Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. -GP Info: +GP Info: - GP English name: *Enable computer and user accounts to be trusted for delegation* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1091,7 +1129,7 @@ GP Info:
      -**UserRights/GenerateSecurityAudits** +**UserRights/GenerateSecurityAudits** @@ -1105,19 +1143,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1138,7 +1176,7 @@ This user right determines which accounts can be used by a process to add entrie -GP Info: +GP Info: - GP English name: *Generate security audits* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1148,7 +1186,7 @@ GP Info:
      -**UserRights/ImpersonateClient** +**UserRights/ImpersonateClient** @@ -1162,19 +1200,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1191,15 +1229,21 @@ GP Info: -Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. +Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. +> [!CAUTION] +> Assigning this user right can be a security risk. Assign this user right to trusted users only. +> [!NOTE] +> By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. 1) The access token that is being impersonated is for this user. 2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. 3) The requested level is less than Impersonate, such as Anonymous or Identify. -Because of these factors, users do not usually need this user right. Warning: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. +Because of these factors, users do not usually need this user right. +> [!WARNING] +> If you enable this setting, programs that previously had the Impersonate privilege might lose it, and they might not run. -GP Info: +GP Info: - GP English name: *Impersonate a client after authentication* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1209,7 +1253,7 @@ GP Info:
      -**UserRights/IncreaseSchedulingPriority** +**UserRights/IncreaseSchedulingPriority** @@ -1223,19 +1267,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1256,17 +1300,22 @@ This user right determines which accounts can use a process with Write Property -GP Info: +GP Info: - GP English name: *Increase scheduling priority* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* +> [!WARNING] +> If you remove **Window Manager\Window Manager Group** from the **Increase scheduling priority** user right, certain applications and computers do not function correctly. In particular, the INK workspace does not function correctly on unified memory architecture (UMA) laptop and desktop computers that run Windows 10, version 1903 (or later) and that use the Intel GFX driver. +> +> On affected computers, the display blinks when users draw on INK workspaces such as those that are used by Microsoft Edge, Microsoft PowerPoint, or Microsoft OneNote. The blinking occurs because the inking-related processes repeatedly try to use the Real-Time priority, but are denied permission. +
      -**UserRights/LoadUnloadDeviceDrivers** +**UserRights/LoadUnloadDeviceDrivers** @@ -1280,19 +1329,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1309,11 +1358,13 @@ GP Info: -This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. +This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. +> [!CAUTION] +> Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. -GP Info: +GP Info: - GP English name: *Load and unload device drivers* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1323,7 +1374,7 @@ GP Info:
      -**UserRights/LockMemory** +**UserRights/LockMemory** @@ -1337,19 +1388,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1366,11 +1417,11 @@ GP Info: -This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). +This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege might significantly affect system performance by decreasing the amount of available random access memory (RAM). -GP Info: +GP Info: - GP English name: *Lock pages in memory* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1380,7 +1431,7 @@ GP Info:
      -**UserRights/ManageAuditingAndSecurityLog** +**UserRights/ManageAuditingAndSecurityLog** @@ -1394,19 +1445,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1423,11 +1474,11 @@ GP Info: -This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log. +This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege also can view and clear the security log. -GP Info: +GP Info: - GP English name: *Manage auditing and security log* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1437,7 +1488,7 @@ GP Info:
      -**UserRights/ManageVolume** +**UserRights/ManageVolume** @@ -1451,19 +1502,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1484,7 +1535,7 @@ This user right determines which users and groups can run maintenance tasks on a -GP Info: +GP Info: - GP English name: *Perform volume maintenance tasks* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1494,7 +1545,7 @@ GP Info:
      -**UserRights/ModifyFirmwareEnvironment** +**UserRights/ModifyFirmwareEnvironment** @@ -1508,19 +1559,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1537,11 +1588,13 @@ GP Info: -This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. +This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor. On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should be modified only by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows. +> [!NOTE] +> This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. -GP Info: +GP Info: - GP English name: *Modify firmware environment values* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1551,7 +1604,7 @@ GP Info:
      -**UserRights/ModifyObjectLabel** +**UserRights/ModifyObjectLabel** @@ -1565,19 +1618,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1598,7 +1651,7 @@ This user right determines which user accounts can modify the integrity label of -GP Info: +GP Info: - GP English name: *Modify an object label* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1608,7 +1661,7 @@ GP Info:
      -**UserRights/ProfileSingleProcess** +**UserRights/ProfileSingleProcess** @@ -1622,19 +1675,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1655,7 +1708,7 @@ This user right determines which users can use performance monitoring tools to m -GP Info: +GP Info: - GP English name: *Profile single process* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1665,7 +1718,7 @@ GP Info:
      -**UserRights/RemoteShutdown** +**UserRights/RemoteShutdown** @@ -1679,19 +1732,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1712,7 +1765,7 @@ This user right determines which users are allowed to shut down a computer from -GP Info: +GP Info: - GP English name: *Force shutdown from a remote system* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1722,7 +1775,7 @@ GP Info:
      -**UserRights/RestoreFilesAndDirectories** +**UserRights/RestoreFilesAndDirectories** @@ -1736,19 +1789,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1765,11 +1818,13 @@ GP Info: -This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. Caution: Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. +This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and it determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system: Traverse Folder/Execute File, Write. +> [!CAUTION] +> Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Restore files and directories* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1779,7 +1834,7 @@ GP Info:
      -**UserRights/TakeOwnership** +**UserRights/TakeOwnership** @@ -1793,19 +1848,19 @@ GP Info: - + - + - + - +
      Procheck mark4check mark1
      Businesscheck mark4check mark1
      Enterprisecheck mark4check mark1
      Educationcheck mark4check mark1
      @@ -1822,11 +1877,13 @@ GP Info: -This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Caution: Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. +This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. +> [!CAUTION] +> Assigning this user right can be a security risk. Since owners of objects have full control of them, assign this user right to trusted users only. -GP Info: +GP Info: - GP English name: *Take ownership of files or other objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1836,12 +1893,12 @@ GP Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. - +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. - diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index dbae4b5780..db63da7a5a 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -1,6 +1,6 @@ --- title: Policy CSP - Wifi -description: Policy CSP - Wifi +description: Learn how the Policy CSP - Wifi setting allows or disallows the device to automatically connect to Wi-Fi hotspots. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -436,12 +436,14 @@ Supported operations are Add, Delete, Get, and Replace. Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 12c192e3e0..4f89b78bcf 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsConnectionManager -description: Policy CSP - WindowsConnectionManager +description: The Policy CSP - WindowsConnectionManager setting prevents computers from connecting to a domain based network and a non-domain based network simultaneously. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -109,12 +109,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 4db39b31f2..a4cd3536f0 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsDefenderSecurityCenter -description: Policy CSP - WindowsDefenderSecurityCenter +description: Learn how to use the Policy CSP - WindowsDefenderSecurityCenter setting to display the Account protection area in Windows Defender Security Center. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - WindowsDefenderSecurityCenter -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
      @@ -1605,12 +1602,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index 5b88961f3e..e60269d795 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsInkWorkspace -description: Policy CSP - WindowsInkWorkspace +description: Learn to use the Policy CSP - WindowsInkWorkspace setting to specify whether to allow the user to access the ink workspace. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -168,12 +168,14 @@ Value type is int. The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index f5558370d6..c7ccb54106 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsLogon -description: Policy CSP - WindowsLogon +description: Use the Policy CSP - WindowsLogon setting to control whether a device automatically signs in and locks the last interactive user after the system restarts. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -606,12 +606,14 @@ To validate on Desktop, do the following: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 6ea895cd9a..b60def1361 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsPowerShell -description: Policy CSP - WindowsPowerShell +description: Use the Policy CSP - WindowsPowerShell setting to enable logging of all PowerShell script input to the Microsoft-Windows-PowerShell/Operational event log. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -106,12 +106,14 @@ ADMX Info: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md new file mode 100644 index 0000000000..77c69597e9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -0,0 +1,561 @@ +--- +title: Policy CSP - WindowsSandbox +description: Policy CSP - WindowsSandbox +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/14/2020 +--- + +# Policy CSP - WindowsSandbox + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
      + + +## WindowsSandbox policies + +
      +
      + WindowsSandbox/AllowAudioInput +
      +
      + WindowsSandbox/AllowClipboardRedirection +
      +
      + WindowsSandbox/AllowNetworking +
      +
      + WindowsSandbox/AllowPrinterRedirection +
      +
      + WindowsSandbox/AllowVGPU +
      +
      + WindowsSandbox/AllowVideoInput +
      +
      + + +
      + + +**WindowsSandbox/AllowAudioInput** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark
      Businesscross mark
      Enterprisecheck mark
      Educationcheck mark
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting allows the IT admin to enable or disable audio input to the Sandbox. + +> [!NOTE] +> There may be security implications of exposing host audio input to the container. + +If this policy is not configured, end-users get the default behavior (audio input enabled). + +If audio input is disabled, a user will not be able to enable audio input from their own configuration file. + +If audio input is enabled, a user will be able to disable audio input from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow audio input in Windows Sandbox* +- GP name: *AllowAudioInput* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 - Disabled +- 1 (default) - Enabled + + + + + + + + + + +
      + + + +**WindowsSandbox/AllowClipboardRedirection** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark
      Businesscross mark
      Enterprisecheck mark
      Educationcheck mark
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting allows the IT admin to enable or disable sharing of the host clipboard with the sandbox. + +If this policy is not configured, end-users get the default behavior (clipboard redirection enabled. + +If clipboard sharing is disabled, a user will not be able to enable clipboard sharing from their own configuration file. + +If clipboard sharing is enabled, a user will be able to disable clipboard sharing from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow clipboard sharing with Windows Sandbox* +- GP name: *AllowClipboardRedirection* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 - Disabled +- 1 (default) - Enabled + + + + + + + + + + + +
      + + +**WindowsSandbox/AllowNetworking** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark
      Businesscross mark
      Enterprisecheck mark
      Educationcheck mark
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting allows the IT admin to enable or disable networking in Windows Sandbox. Disabling network access can decrease the attack surface exposed by the Sandbox. Enabling networking can expose untrusted applications to the internal network. + +If this policy is not configured, end-users get the default behavior (networking enabled). + +If networking is disabled, a user will not be able to enable networking from their own configuration file. + +If networking is enabled, a user will be able to disable networking from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow networking in Windows Sandbox* +- GP name: *AllowNetworking* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: +- 0 - Disabled +- 1 (default) - Enabled + + + + + + + + + + +
      + + +**WindowsSandbox/AllowPrinterRedirection** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark
      Businesscross mark
      Enterprisecheck mark
      Educationcheck mark
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting allows the IT admin to enable or disable printer sharing from the host into the Sandbox. + +If this policy is not configured, end-users get the default behavior (printer sharing disabled). + +If printer sharing is disabled, a user will not be able to enable printer sharing from their own configuration file. + +If printer sharing is enabled, a user will be able to disable printer sharing from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow printer sharing with Windows Sandbox* +- GP name: *AllowPrinterRedirection* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 - Disabled +- 1 (default) - Enabled + + + + + + + + + + +
      + + +**WindowsSandbox/AllowVGPU** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark
      Businesscross mark
      Enterprisecheck mark
      Educationcheck mark
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting allows the IT admin to enable or disable virtualized GPU for Windows Sandbox. + +> [!NOTE] +> Enabling virtualized GPU can potentially increase the attack surface of Windows Sandbox. + +If this policy is not configured, end-users get the default behavior (vGPU is disabled). + +If vGPU is disabled, a user will not be able to enable vGPU support from their own configuration file. + +If vGPU is enabled, a user will be able to disable vGPU support from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: + +- GP English Name: *Allow vGPU sharing for Windows Sandbox* +- GP name: *AllowVGPU* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 (default) - Disabled +- 1 - Enabled + + + + + + + + + + +
      + + +**WindowsSandbox/AllowVideoInput** + +Available in the latest Windows 10 insider preview build. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      Windows EditionSupported?
      Homecross mark
      Procheck mark
      Businesscross mark
      Enterprisecheck mark
      Educationcheck mark
      + + +
      + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
      + + + +This policy setting allows the IT admin to enable or disable video input to the Sandbox. + +> [!NOTE] +> There may be security implications of exposing host video input to the container. + +If this policy is not configured, users get the default behavior (video input disabled). + +If video input is disabled, users will not be able to enable video input from their own configuration file. + +If video input is enabled, users will be able to disable video input from their own configuration file to make the device more secure. + +> [!NOTE] +> You must restart Windows Sandbox for any changes to this policy setting to take effect. + + + +ADMX Info: +- GP English Name: *Allow video input in Windows Sandbox* +- GP name: *AllowVideoInput* +- GP path: *Windows Components/Windows Sandbox* +- GP ADMX file name: *WindowsSandbox.admx* + + + +The following are the supported values: + +- 0 (default) - Disabled +- 1 - Enabled + + + + + + + + + + +
      + + diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 056759ea10..3aff9aac6c 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WirelessDisplay -description: Policy CSP - WirelessDisplay +description: Use the Policy CSP - WirelessDisplay setting to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -540,12 +540,14 @@ The following list shows the supported values: Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 8a9c1a34dc..0ed48a5776 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -1,6 +1,6 @@ --- title: Policy DDF file -description: Policy DDF file +description: Learn about the OMA DM device description framework (DDF) for the Policy configuration service provider. ms.assetid: D90791B5-A772-4AF8-B058-5D566865AF8D ms.reviewer: manager: dansimp @@ -10,7 +10,7 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 05/21/2019 +ms.date: 10/28/2020 --- # Policy DDF file @@ -20,6 +20,8 @@ This topic shows the OMA DM device description framework (DDF) for the **Policy* You can view various Policy DDF files by clicking the following links: +- [View the Policy DDF file for Windows 10, version 20H2](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_20H2.xml) +- [View the Policy DDF file for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_2004.xml) - [View the Policy DDF file for Windows 10, version 1903](https://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml) - [View the Policy DDF file for Windows 10, version 1809](https://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml) - [View the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) @@ -31,7 +33,7 @@ You can view various Policy DDF files by clicking the following links: You can download DDF files for various CSPs from [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the DDF for Windows 10, version 1903. +The XML below is the DDF for Windows 10, version 20H2. ```xml @@ -57,7 +59,7 @@ The XML below is the DDF for Windows 10, version 1903. - com.microsoft/9.0/MDM/Policy + com.microsoft/10.0/MDM/Policy @@ -1646,7 +1648,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -1657,11 +1659,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -2119,6 +2121,30 @@ Related policy: + + AllowGraphingCalculator + + + + + + + + This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality. + + + + + + + + + + + text/plain + + + DefaultPrinterName @@ -8688,6 +8714,52 @@ Related policy: + + Multitasking + + + + + + + + + + + + + + + + + + + + + BrowserAltTabBlowout + + + + + + + + Configures the inclusion of Edge tabs into Alt-Tab. + + + + + + + + + + + text/plain + + + + Notifications @@ -11023,7 +11095,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -11034,11 +11106,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -11541,6 +11613,33 @@ Related policy: + + AllowGraphingCalculator + + + + + 1 + This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality. + + + + + + + + + + + text/plain + + + Programs.admx + Programs~AT~WindowsComponents~Calculator + AllowGraphingCalculator + LowestValueMostSecure + + DefaultPrinterName @@ -18867,6 +18966,55 @@ Related policy: + + Multitasking + + + + + + + + + + + + + + + + + + + BrowserAltTabBlowout + + + + + 1 + Configures the inclusion of Edge tabs into Alt-Tab. + + + + + + + + + + + text/plain + + + phone + multitasking.admx + AltTabFilterDropdown + multitasking~AT~WindowsComponents~MULTITASKING + MultiTaskingAltTabFilter + LastWrite + + + Notifications @@ -19509,7 +19657,7 @@ Related policy: - com.microsoft/9.0/MDM/Policy + com.microsoft/10.0/MDM/Policy @@ -19578,6 +19726,99 @@ Related policy: + + Properties + + + + + + + Properties of Win32 App ADMX Ingestion + + + + + + + + + + + + + + + * + + + + + + + Setting Type of Win32 App. Policy Or Preference + + + + + + + + + + + + + + + * + + + + + + + Unique ID of ADMX file + + + + + + + + + + + + + + + Version + + + + + + + + Version of ADMX file + + + + + + + + + + + + + + + + + * @@ -19607,6 +19848,7 @@ Related policy: + Unique ID of ADMX file @@ -20165,6 +20407,30 @@ Related policy: + + BlockNonAdminUserInstall + + + + + + + + + + + + + + + + + + + text/plain + + + DisableStoreOriginatedApps @@ -21098,6 +21364,1785 @@ Related policy: + + Audit + + + + + + + + + + + + + + + + + + + + + AccountLogon_AuditCredentialValidation + + + + + + + + This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditKerberosAuthenticationService + + + + + + + + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditKerberosServiceTicketOperations + + + + + + + + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditOtherAccountLogonEvents + + + + + + + + This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditAccountLockout + + + + + + + + This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditGroupMembership + + + + + + + + This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecExtendedMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecMainMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecQuickMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If + you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditLogoff + + + + + + + + This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditLogon + + + + + + + + This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: + Successful logon attempts. + Failed logon attempts. + Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. + Security identifiers (SIDs) were filtered and not allowed to log on. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditNetworkPolicyServer + + + + + + + + This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditOtherLogonLogoffEvents + + + + + + + + This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: + Terminal Services session disconnections. + New Terminal Services sessions. + Locking and unlocking a workstation. + Invoking a screen saver. + Dismissal of a screen saver. + Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. + Access to a wireless network granted to a user or computer account. + Access to a wired 802.1x network granted to a user or computer account. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditSpecialLogon + + + + + + + + This policy setting allows you to audit events generated by special logons such as the following : + The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. + A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditUserDeviceClaims + + + + + + + + This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditApplicationGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to application groups such as the following: + Application group is created, changed, or deleted. + Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditComputerAccountManagement + + + + + + + + This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditDistributionGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to distribution groups such as the following: + Distribution group is created, changed, or deleted. + Member is added or removed from a distribution group. + Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +Note: Events in this subcategory are logged only on domain controllers. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditOtherAccountManagementEvents + + + + + + + + This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: + The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. + The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. + Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditSecurityGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to security groups such as the following: + Security group is created, changed, or deleted. + Member is added or removed from a security group. + Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditUserAccountManagement + + + + + + + + This policy setting allows you to audit changes to user accounts. Events include the following: + A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. + A user account’s password is set or changed. + A security identifier (SID) is added to the SID History of a user account. + The Directory Services Restore Mode password is configured. + Permissions on administrative user accounts are changed. + Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditDPAPIActivity + + + + + + + + This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditPNPActivity + + + + + + + + This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditProcessCreation + + + + + + + + This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditProcessTermination + + + + + + + + This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditRPCEvents + + + + + + + + This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditTokenRightAdjusted + + + + + + + + This policy setting allows you to audit events generated by adjusting the privileges of a token. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDetailedDirectoryServiceReplication + + + + + + + + This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceAccess + + + + + + + + This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceChanges + + + + + + + + This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceReplication + + + + + + + + This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditApplicationGenerated + + + + + + + + This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: + Creation of an application client context. + Deletion of an application client context. + Initialization of an application client context. + Other application operations using the Windows Auditing APIs. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditCentralAccessPolicyStaging + + + + + + + + This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2) Failure audits when configured records access attempts when: + a) The current central access policy does not grant access but the proposed policy grants access. + b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditCertificationServices + + + + + + + + This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + AD CS startup/shutdown/backup/restore. + Changes to the certificate revocation list (CRL). + New certificate requests. + Issuing of a certificate. + Revocation of a certificate. + Changes to the Certificate Manager settings for AD CS. + Changes in the configuration of AD CS. + Changes to a Certificate Services template. + Importing of a certificate. + Publishing of a certification authority certificate is to Active Directory Domain Services. + Changes to the security permissions for AD CS. + Archival of a key. + Importing of a key. + Retrieval of a key. + Starting of Online Certificate Status Protocol (OCSP) Responder Service. + Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditDetailedFileShare + + + + + + + + This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFileShare + + + + + + + + This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFileSystem + + + + + + + + This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFilteringPlatformConnection + + + + + + + + This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: + The Windows Firewall Service blocks an application from accepting incoming connections on the network. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits a bind to a local port. + The WFP blocks a bind to a local port. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits an application or service to listen on a port for incoming connections. + The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFilteringPlatformPacketDrop + + + + + + + + This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditHandleManipulation + + + + + + + + This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditKernelObject + + + + + + + + This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditOtherObjectAccessEvents + + + + + + + + This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: + Job created. + Job deleted. + Job enabled. + Job disabled. + Job updated. +For COM+ objects, the following are audited: + Catalog object added. + Catalog object updated. + Catalog object deleted. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditRegistry + + + + + + + + This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +Note: You can set a SACL on a registry object using the Permissions dialog box. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditRemovableStorage + + + + + + + + This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditSAM + + + + + + + + This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: + SAM_ALIAS -- A local group. + SAM_GROUP -- A group that is not a local group. + SAM_USER – A user account. + SAM_DOMAIN – A domain. + SAM_SERVER – A computer account. +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. +Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditAuthenticationPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the authentication policy such as the following: + Creation of forest and domain trusts. + Modification of forest and domain trusts. + Removal of forest and domain trusts. + Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. + Granting of any of the following user rights to a user or group: + Access This Computer From the Network. + Allow Logon Locally. + Allow Logon Through Terminal Services. + Logon as a Batch Job. + Logon a Service. + Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditAuthorizationPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the authorization policy such as the following: + Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Changes in the Encrypted File System (EFS) policy. + Changes to the Resource attributes of an object. + Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditFilteringPlatformPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: + IPsec services status. + Changes to IPsec policy settings. + Changes to Windows Firewall policy settings. + Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditMPSSVCRuleLevelPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: + Reporting of active policies when Windows Firewall service starts. + Changes to Windows Firewall rules. + Changes to Windows Firewall exception list. + Changes to Windows Firewall settings. + Rules ignored or not applied by Windows Firewall Service. + Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditOtherPolicyChangeEvents + + + + + + + + This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: + Trusted Platform Module (TPM) configuration changes. + Kernel-mode cryptographic self tests. + Cryptographic provider operations. + Cryptographic context operations or modifications. + Applied Central Access Policies (CAPs) changes. + Boot Configuration Data (BCD) modifications. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditPolicyChange + + + + + + + + This policy setting allows you to audit changes in the security audit policy settings such as the following: + Settings permissions and audit settings on the Audit Policy object. + Changes to the system audit policy. + Registration of security event sources. + De-registration of security event sources. + Changes to the per-user audit settings. + Changes to the value of CrashOnAuditFail. + Changes to the system access control list on a file system or registry object. + Changes to the Special Groups list. + +Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditNonSensitivePrivilegeUse + + + + + + + + This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: + Access Credential Manager as a trusted caller. + Access this computer from the network. + Add workstations to domain. + Adjust memory quotas for a process. + Allow log on locally. + Allow log on through Terminal Services. + Bypass traverse checking. + Change the system time. + Create a pagefile. + Create global objects. + + Create permanent shared objects. + Create symbolic links. + Deny access this computer from the network. + Deny log on as a batch job. + Deny log on as a service. + Deny log on locally. + Deny log on through Terminal Services. + Force shutdown from a remote system. + Increase a process working set. + Increase scheduling priority. + Lock pages in memory. + Log on as a batch job. + Log on as a service. + Modify an object label. + Perform volume maintenance tasks. + Profile single process. + Profile system performance. + Remove computer from docking station. + Shut down the system. + Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditOtherPrivilegeUseEvents + + + + + + + + Not used. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditSensitivePrivilegeUse + + + + + + + + This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: + A privileged service is called. + One of the following privileges are called: + Act as part of the operating system. + Back up files and directories. + Create a token object. + Debug programs. + Enable computer and user accounts to be trusted for delegation. + Generate security audits. + Impersonate a client after authentication. + Load and unload device drivers. + Manage auditing and security log. + Modify firmware environment values. + Replace a process-level token. + Restore files and directories. + Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + + + + + + + + + + + + text/plain + + + + + System_AuditIPsecDriver + + + + + + + + This policy setting allows you to audit events generated by the IPsec filter driver such as the following: + Startup and shutdown of the IPsec services. + Network packets dropped due to integrity check failure. + Network packets dropped due to replay check failure. + Network packets dropped due to being in plaintext. + Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. + Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + + + + + + + + + + + text/plain + + + + + System_AuditOtherSystemEvents + + + + + + + + This policy setting allows you to audit any of the following events: + Startup and shutdown of the Windows Firewall service and driver. + Security policy processing by the Windows Firewall Service. + Cryptography key file and migration operations. + + + + + + + + + + + text/plain + + + + + System_AuditSecurityStateChange + + + + + + + + This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: + Startup and shutdown of the computer. + Change of system time. + Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + + + + + + + + + + + text/plain + + + + + System_AuditSecuritySystemExtension + + + + + + + + This policy setting allows you to audit events related to security system extensions or services such as the following: + A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. + A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + + + + + + + + + + + text/plain + + + + + System_AuditSystemIntegrity + + + + + + + + This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: + Events that could not be written to the event log because of a problem with the auditing system. + A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. + The detection of a Remote Procedure Call (RPC) that compromises system integrity. + The detection of a hash value of an executable file that is not valid as determined by Code Integrity. + Cryptographic operations that compromise system integrity. + + + + + + + + + + + text/plain + + + + Authentication @@ -21759,6 +23804,30 @@ Related policy: + + SetMinimumEncryptionKeySize + + + + + + + + + + + + + + + + + + + text/plain + + + Browser @@ -23021,7 +25090,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -23032,11 +25101,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -25494,6 +27563,30 @@ Related policy: + + DOCacheHostSource + + + + + + + + + + + + + + + + + + + text/plain + + + DODelayBackgroundDownloadFromHttp @@ -25662,6 +27755,30 @@ Related policy: + + DOMaxBackgroundDownloadBandwidth + + + + + + + + + + + + + + + + + + + text/plain + + + DOMaxCacheAge @@ -25711,31 +27828,7 @@ Related policy: - DOMaxDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMaxUploadBandwidth + DOMaxForegroundDownloadBandwidth @@ -25950,30 +28043,6 @@ Related policy: - - DOPercentageMaxDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - DOPercentageMaxForegroundBandwidth @@ -26328,6 +28397,30 @@ Related policy: + + AllowInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + + + text/plain + + + AllowInstallationOfMatchingDeviceSetupClasses @@ -26424,6 +28517,30 @@ Related policy: + + PreventInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + + + text/plain + + + PreventInstallationOfMatchingDeviceSetupClasses @@ -27736,6 +29853,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableCloudOptimizedContent + + + + + + + + This policy controls Windows experiences that use the cloud optimized content client component. If you enable this policy, they will present only default content. If you disable or do not configure this policy, they will be able to use cloud provided content. + + + + + + + + + + + text/plain + + + DoNotShowFeedbackNotifications @@ -27888,6 +30029,124 @@ If you do not configure this policy setting, users will be able to choose whethe + + FactoryComposer + + + + + + + + + + + + + + + + + + + + + BackgroundImagePath + + + + + + + + + + + + + + + + + + + text/plain + + + + + OEMVersion + + + + + + + + + + + + + + + + + + + text/plain + + + + + UserToSignIn + + + + + + + + + + + + + + + + + + + text/plain + + + + + UWPLaunchOnBoot + + + + + + + + + + + + + + + + + + + text/plain + + + + FileExplorer @@ -28767,30 +31026,6 @@ If you do not configure this policy setting, users will be able to choose whethe - - DisableActiveXVersionListAutoDownload - - - - - - - - - - - - - - - - - - - text/plain - - - DisableAdobeFlash @@ -36238,6 +38473,60 @@ The options are: + + LocalUsersAndGroups + + + + + + + + + + + + + + + + + + + + + Configure + + + + + + + + This Setting allows an administrator to manage local groups on a Device. + Possible settings: + 1. Update Group Membership: Update a group and add and/or remove members though the 'U' action. + When using Update, existing group members that are not specified in the policy remain untouched. + 2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action. + When using Replace, existing group membership is replaced by the list of members specified in + the add member section. This option works in the same way as a Restricted Group and any group + members that are not specified in the policy are removed. + Caution: If the same group is configured with both Replace and Update, then Replace will win. + + + + + + + + + + + text/plain + + + + LockDown @@ -36448,6 +38737,148 @@ The options are: + + MixedReality + + + + + + + + + + + + + + + + + + + + + AADGroupMembershipCacheValidityInDays + + + + + + + + + + + + + + + + + + + text/plain + + + + + BrightnessButtonDisabled + + + + + + + + + + + + + + + + + + + text/plain + + + + + FallbackDiagnostics + + + + + + + + + + + + + + + + + + + text/plain + + + + + MicrophoneDisabled + + + + + + + + + + + + + + + + + + + text/plain + + + + + VolumeButtonDisabled + + + + + + + + + + + + + + + + + + + text/plain + + + + MSSecurityGuide @@ -37961,6 +40392,102 @@ If the user has configured a slide show to run on the lock screen when the machi + + LetAppsAccessBackgroundSpatialPerception + + + + + + + + This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + LetAppsAccessCalendar @@ -44048,6 +46575,90 @@ If you disable or do not configure this policy setting, File History can be acti + + ConfigureJapaneseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Japanese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Japanese IME is on by default. Allow to control Microsoft Japanese IME version to use. +1 - The previous version of Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. +2 - The new Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. + + + + + + + + + + + text/plain + + + + + ConfigureSimplifiedChineseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Simplified Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Simplified Chinese IME is on by default. Allow to control Microsoft Simplified Chinese IME version to use. +1 - The previous version of Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. +2 - The new Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. + + + + + + + + + + + text/plain + + + + + ConfigureTraditionalChineseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Traditional Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Traditional Chinese IME is on by default. Allow to control Microsoft Traditional Chinese IME version to use. +1 - The previous version of Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. +2 - The new Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. + + + + + + + + + + + text/plain + + + EnableTouchKeyboardAutoInvokeInDesktopMode @@ -45089,6 +47700,30 @@ If you disable or do not configure this policy setting, the wake setting as spec + + DisableWUfBSafeguards + + + + + + + + + + + + + + + + + + + text/plain + + + EngagedRestartDeadline @@ -45857,6 +48492,54 @@ If you disable or do not configure this policy setting, the wake setting as spec + + SetProxyBehaviorForUpdateDetection + + + + + + + + + + + + + + + + + + + text/plain + + + + + TargetReleaseVersion + + + + + + + + + + + + + + + + + + + text/plain + + + UpdateNotificationLevel @@ -48510,6 +51193,33 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi LastWrite + + BlockNonAdminUserInstall + + + + + 0 + + + + + + + + + + + + text/plain + + + AppxPackageManager.admx + AppxPackageManager~AT~WindowsComponents~AppxDeployment + BlockNonAdminUserInstall + LowestValueMostSecure + + DisableStoreOriginatedApps @@ -49577,6 +52287,1960 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi + + Audit + + + + + + + + + + + + + + + + + + + AccountLogon_AuditCredentialValidation + + + + + 0 + This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Credential Validation + LastWrite + + + + AccountLogon_AuditKerberosAuthenticationService + + + + + 0 + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Kerberos Authentication Service + LastWrite + + + + AccountLogon_AuditKerberosServiceTicketOperations + + + + + 0 + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Kerberos Service Ticket Operations + LastWrite + + + + AccountLogon_AuditOtherAccountLogonEvents + + + + + 0 + This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Other Account Logon Events + LastWrite + + + + AccountLogonLogoff_AuditAccountLockout + + + + + 1 + This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Account Lockout + LastWrite + + + + AccountLogonLogoff_AuditGroupMembership + + + + + 0 + This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Group Membership + LastWrite + + + + AccountLogonLogoff_AuditIPsecExtendedMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Extended Mode + LastWrite + + + + AccountLogonLogoff_AuditIPsecMainMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Main Mode + LastWrite + + + + AccountLogonLogoff_AuditIPsecQuickMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If + you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Quick Mode + LastWrite + + + + AccountLogonLogoff_AuditLogoff + + + + + 1 + This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Logoff + LastWrite + + + + AccountLogonLogoff_AuditLogon + + + + + 1 + This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: + Successful logon attempts. + Failed logon attempts. + Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. + Security identifiers (SIDs) were filtered and not allowed to log on. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Logon + LastWrite + + + + AccountLogonLogoff_AuditNetworkPolicyServer + + + + + 3 + This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Network Policy Server + LastWrite + + + + AccountLogonLogoff_AuditOtherLogonLogoffEvents + + + + + 0 + This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: + Terminal Services session disconnections. + New Terminal Services sessions. + Locking and unlocking a workstation. + Invoking a screen saver. + Dismissal of a screen saver. + Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. + Access to a wireless network granted to a user or computer account. + Access to a wired 802.1x network granted to a user or computer account. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Other Logon Logoff Events + LastWrite + + + + AccountLogonLogoff_AuditSpecialLogon + + + + + 1 + This policy setting allows you to audit events generated by special logons such as the following : + The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. + A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Special Logon + LastWrite + + + + AccountLogonLogoff_AuditUserDeviceClaims + + + + + 0 + This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit User Device Claims + LastWrite + + + + AccountManagement_AuditApplicationGroupManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to application groups such as the following: + Application group is created, changed, or deleted. + Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Application Group Management + LastWrite + + + + AccountManagement_AuditComputerAccountManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Computer Account Management + LastWrite + + + + AccountManagement_AuditDistributionGroupManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to distribution groups such as the following: + Distribution group is created, changed, or deleted. + Member is added or removed from a distribution group. + Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +Note: Events in this subcategory are logged only on domain controllers. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Distributio Group Management + LastWrite + + + + AccountManagement_AuditOtherAccountManagementEvents + + + + + 0 + This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: + The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. + The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. + Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Other Account Management Events + LastWrite + + + + AccountManagement_AuditSecurityGroupManagement + + + + + 1 + This policy setting allows you to audit events generated by changes to security groups such as the following: + Security group is created, changed, or deleted. + Member is added or removed from a security group. + Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Security Group Management + LastWrite + + + + AccountManagement_AuditUserAccountManagement + + + + + 1 + This policy setting allows you to audit changes to user accounts. Events include the following: + A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. + A user account’s password is set or changed. + A security identifier (SID) is added to the SID History of a user account. + The Directory Services Restore Mode password is configured. + Permissions on administrative user accounts are changed. + Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit User Account Management + LastWrite + + + + DetailedTracking_AuditDPAPIActivity + + + + + 0 + This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit DPAPI Activity + LastWrite + + + + DetailedTracking_AuditPNPActivity + + + + + 0 + This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit PNP Activity + LastWrite + + + + DetailedTracking_AuditProcessCreation + + + + + 0 + This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Process Creation + LastWrite + + + + DetailedTracking_AuditProcessTermination + + + + + 0 + This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Process Termination + LastWrite + + + + DetailedTracking_AuditRPCEvents + + + + + 0 + This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit RPC Events + LastWrite + + + + DetailedTracking_AuditTokenRightAdjusted + + + + + 0 + This policy setting allows you to audit events generated by adjusting the privileges of a token. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Token Right Adjusted + LastWrite + + + + DSAccess_AuditDetailedDirectoryServiceReplication + + + + + 0 + This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Detailed Directory Service Replication + LastWrite + + + + DSAccess_AuditDirectoryServiceAccess + + + + + 0 + This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Access + LastWrite + + + + DSAccess_AuditDirectoryServiceChanges + + + + + 0 + This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Changes + LastWrite + + + + DSAccess_AuditDirectoryServiceReplication + + + + + 0 + This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Replication + LastWrite + + + + ObjectAccess_AuditApplicationGenerated + + + + + 0 + This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: + Creation of an application client context. + Deletion of an application client context. + Initialization of an application client context. + Other application operations using the Windows Auditing APIs. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Application Generated + LastWrite + + + + ObjectAccess_AuditCentralAccessPolicyStaging + + + + + 0 + This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2) Failure audits when configured records access attempts when: + a) The current central access policy does not grant access but the proposed policy grants access. + b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Central Access Policy Staging + LastWrite + + + + ObjectAccess_AuditCertificationServices + + + + + 0 + This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + AD CS startup/shutdown/backup/restore. + Changes to the certificate revocation list (CRL). + New certificate requests. + Issuing of a certificate. + Revocation of a certificate. + Changes to the Certificate Manager settings for AD CS. + Changes in the configuration of AD CS. + Changes to a Certificate Services template. + Importing of a certificate. + Publishing of a certification authority certificate is to Active Directory Domain Services. + Changes to the security permissions for AD CS. + Archival of a key. + Importing of a key. + Retrieval of a key. + Starting of Online Certificate Status Protocol (OCSP) Responder Service. + Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Certification Services + LastWrite + + + + ObjectAccess_AuditDetailedFileShare + + + + + 0 + This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Detailed File Share + LastWrite + + + + ObjectAccess_AuditFileShare + + + + + 0 + This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit File Share + LastWrite + + + + ObjectAccess_AuditFileSystem + + + + + 0 + This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit File System + LastWrite + + + + ObjectAccess_AuditFilteringPlatformConnection + + + + + 0 + This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: + The Windows Firewall Service blocks an application from accepting incoming connections on the network. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits a bind to a local port. + The WFP blocks a bind to a local port. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits an application or service to listen on a port for incoming connections. + The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Filtering Platform Connection + LastWrite + + + + ObjectAccess_AuditFilteringPlatformPacketDrop + + + + + 0 + This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Filtering Platform Packet Drop + LastWrite + + + + ObjectAccess_AuditHandleManipulation + + + + + 0 + This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Handle Manipulation + LastWrite + + + + ObjectAccess_AuditKernelObject + + + + + 0 + This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Kernel Object + LastWrite + + + + ObjectAccess_AuditOtherObjectAccessEvents + + + + + 0 + This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: + Job created. + Job deleted. + Job enabled. + Job disabled. + Job updated. +For COM+ objects, the following are audited: + Catalog object added. + Catalog object updated. + Catalog object deleted. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Other Object Access Events + LastWrite + + + + ObjectAccess_AuditRegistry + + + + + 0 + This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +Note: You can set a SACL on a registry object using the Permissions dialog box. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Registry + LastWrite + + + + ObjectAccess_AuditRemovableStorage + + + + + 0 + This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Removable Storage + LastWrite + + + + ObjectAccess_AuditSAM + + + + + 0 + This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: + SAM_ALIAS -- A local group. + SAM_GROUP -- A group that is not a local group. + SAM_USER – A user account. + SAM_DOMAIN – A domain. + SAM_SERVER – A computer account. +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. +Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit SAM + LastWrite + + + + PolicyChange_AuditAuthenticationPolicyChange + + + + + 1 + This policy setting allows you to audit events generated by changes to the authentication policy such as the following: + Creation of forest and domain trusts. + Modification of forest and domain trusts. + Removal of forest and domain trusts. + Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. + Granting of any of the following user rights to a user or group: + Access This Computer From the Network. + Allow Logon Locally. + Allow Logon Through Terminal Services. + Logon as a Batch Job. + Logon a Service. + Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Authentication Policy Change + LastWrite + + + + PolicyChange_AuditAuthorizationPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes to the authorization policy such as the following: + Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Changes in the Encrypted File System (EFS) policy. + Changes to the Resource attributes of an object. + Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Authorization Policy Change + LastWrite + + + + PolicyChange_AuditFilteringPlatformPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: + IPsec services status. + Changes to IPsec policy settings. + Changes to Windows Firewall policy settings. + Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Filtering Platform Policy Change + LastWrite + + + + PolicyChange_AuditMPSSVCRuleLevelPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: + Reporting of active policies when Windows Firewall service starts. + Changes to Windows Firewall rules. + Changes to Windows Firewall exception list. + Changes to Windows Firewall settings. + Rules ignored or not applied by Windows Firewall Service. + Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit MPSSVC Rule Level Policy Change + LastWrite + + + + PolicyChange_AuditOtherPolicyChangeEvents + + + + + 0 + This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: + Trusted Platform Module (TPM) configuration changes. + Kernel-mode cryptographic self tests. + Cryptographic provider operations. + Cryptographic context operations or modifications. + Applied Central Access Policies (CAPs) changes. + Boot Configuration Data (BCD) modifications. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Other Policy Change Events + LastWrite + + + + PolicyChange_AuditPolicyChange + + + + + 1 + This policy setting allows you to audit changes in the security audit policy settings such as the following: + Settings permissions and audit settings on the Audit Policy object. + Changes to the system audit policy. + Registration of security event sources. + De-registration of security event sources. + Changes to the per-user audit settings. + Changes to the value of CrashOnAuditFail. + Changes to the system access control list on a file system or registry object. + Changes to the Special Groups list. + +Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Policy Change + LastWrite + + + + PrivilegeUse_AuditNonSensitivePrivilegeUse + + + + + 0 + This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: + Access Credential Manager as a trusted caller. + Access this computer from the network. + Add workstations to domain. + Adjust memory quotas for a process. + Allow log on locally. + Allow log on through Terminal Services. + Bypass traverse checking. + Change the system time. + Create a pagefile. + Create global objects. + + Create permanent shared objects. + Create symbolic links. + Deny access this computer from the network. + Deny log on as a batch job. + Deny log on as a service. + Deny log on locally. + Deny log on through Terminal Services. + Force shutdown from a remote system. + Increase a process working set. + Increase scheduling priority. + Lock pages in memory. + Log on as a batch job. + Log on as a service. + Modify an object label. + Perform volume maintenance tasks. + Profile single process. + Profile system performance. + Remove computer from docking station. + Shut down the system. + Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Non Sensitive Privilege Use + LastWrite + + + + PrivilegeUse_AuditOtherPrivilegeUseEvents + + + + + 0 + Not used. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Other Privilege Use Events + LastWrite + + + + PrivilegeUse_AuditSensitivePrivilegeUse + + + + + 0 + This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: + A privileged service is called. + One of the following privileges are called: + Act as part of the operating system. + Back up files and directories. + Create a token object. + Debug programs. + Enable computer and user accounts to be trusted for delegation. + Generate security audits. + Impersonate a client after authentication. + Load and unload device drivers. + Manage auditing and security log. + Modify firmware environment values. + Replace a process-level token. + Restore files and directories. + Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Sensitive Privilege Use + LastWrite + + + + System_AuditIPsecDriver + + + + + 0 + This policy setting allows you to audit events generated by the IPsec filter driver such as the following: + Startup and shutdown of the IPsec services. + Network packets dropped due to integrity check failure. + Network packets dropped due to replay check failure. + Network packets dropped due to being in plaintext. + Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. + Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit IPsec Driver + LastWrite + + + + System_AuditOtherSystemEvents + + + + + 3 + This policy setting allows you to audit any of the following events: + Startup and shutdown of the Windows Firewall service and driver. + Security policy processing by the Windows Firewall Service. + Cryptography key file and migration operations. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Other System Events + LastWrite + + + + System_AuditSecurityStateChange + + + + + 1 + This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: + Startup and shutdown of the computer. + Change of system time. + Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Security State Change + LastWrite + + + + System_AuditSecuritySystemExtension + + + + + 0 + This policy setting allows you to audit events related to security system extensions or services such as the following: + A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. + A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Security System Extension + LastWrite + + + + System_AuditSystemIntegrity + + + + + 3 + This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: + Events that could not be written to the event log because of a problem with the auditing system. + A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. + The detection of a Remote Procedure Call (RPC) that compromises system integrity. + The detection of a hash value of an executable file that is not valid as determined by Code Integrity. + Cryptographic operations that compromise system integrity. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit System Integrity + LastWrite + + + Authentication @@ -50264,6 +54928,30 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi LastWrite + + SetMinimumEncryptionKeySize + + + + + 0 + + + + + + + + + + + + text/plain + + + LastWrite + + Browser @@ -51675,7 +56363,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -51686,11 +56374,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -54424,6 +59112,34 @@ Related policy: LastWrite + + DOCacheHostSource + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + CacheHostSource + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + CacheHostSource + LastWrite + + DODelayBackgroundDownloadFromHttp @@ -54619,6 +59335,34 @@ Related policy: LastWrite + + DOMaxBackgroundDownloadBandwidth + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + MaxBackgroundDownloadBandwidth + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MaxBackgroundDownloadBandwidth + LastWrite + + DOMaxCacheAge @@ -54676,7 +59420,7 @@ Related policy: - DOMaxDownloadBandwidth + DOMaxForegroundDownloadBandwidth @@ -54697,37 +59441,9 @@ Related policy: DeliveryOptimization.admx - MaxDownloadBandwidth + MaxForegroundDownloadBandwidth DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxDownloadBandwidth - LastWrite - - - - DOMaxUploadBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MaxUploadBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxUploadBandwidth + MaxForegroundDownloadBandwidth LastWrite @@ -54954,35 +59670,6 @@ Related policy: LastWrite - - DOPercentageMaxDownloadBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - DeliveryOptimization.admx - PercentageMaxDownloadBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - PercentageMaxDownloadBandwidth - LastWrite - - DOPercentageMaxForegroundBandwidth @@ -55429,6 +60116,33 @@ Related policy: LastWrite + + AllowInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + text/plain + + phone + deviceinstallation.admx + DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category + DeviceInstall_Instance_IDs_Allow + LastWrite + + AllowInstallationOfMatchingDeviceSetupClasses @@ -55537,6 +60251,33 @@ Related policy: LastWrite + + PreventInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + text/plain + + phone + deviceinstallation.admx + DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category + DeviceInstall_Instance_IDs_Deny + LastWrite + + PreventInstallationOfMatchingDeviceSetupClasses @@ -56921,6 +61662,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LowestValueMostSecure + + DisableCloudOptimizedContent + + + + + 0 + This policy controls Windows experiences that use the cloud optimized content client component. If you enable this policy, they will present only default content. If you disable or do not configure this policy, they will be able to use cloud provided content. + + + + + + + + + + + text/plain + + + CloudContent.admx + CloudContent~AT~WindowsComponents~CloudContent + DisableCloudOptimizedContent + HighestValueMostSecure + + DoNotShowFeedbackNotifications @@ -57087,6 +61855,118 @@ If you do not configure this policy setting, users will be able to choose whethe + + FactoryComposer + + + + + + + + + + + + + + + + + + + BackgroundImagePath + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + + OEMVersion + + + + + unset; partners can set via settings customization! + + + + + + + + + + + + text/plain + + LastWrite + + + + UserToSignIn + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + + UWPLaunchOnBoot + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + FileExplorer @@ -58055,33 +62935,6 @@ If you do not configure this policy setting, users will be able to choose whethe LastWrite - - DisableActiveXVersionListAutoDownload - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VersionListAutomaticDownloadDisable - LastWrite - - DisableAdobeFlash @@ -66349,6 +71202,116 @@ The options are: + + LocalUsersAndGroups + + + + + + + + + + + + + + + + + + + Configure + + + + + + This Setting allows an administrator to manage local groups on a Device. + Possible settings: + 1. Update Group Membership: Update a group and add and/or remove members though the 'U' action. + When using Update, existing group members that are not specified in the policy remain untouched. + 2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action. + When using Replace, existing group membership is replaced by the list of members specified in + the add member section. This option works in the same way as a Restricted Group and any group + members that are not specified in the policy are removed. + Caution: If the same group is configured with both Replace and Update, then Replace will win. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + + + + + + + + + Group Configuration Action + + + + + + + + Group Member to Add + + + + + + + + Group Member to Remove + + + + + + + + Group property to configure + + + + + + + + + + + + + + + + Local Group Configuration + + + + + + + + + LockDown @@ -66565,6 +71528,146 @@ The options are: + + MixedReality + + + + + + + + + + + + + + + + + + + AADGroupMembershipCacheValidityInDays + + + + + 0 + + + + + + + + + + + + text/plain + + + LastWrite + + + + BrightnessButtonDisabled + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + FallbackDiagnostics + + + + + 2 + + + + + + + + + + + + text/plain + + + LastWrite + + + + MicrophoneDisabled + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + VolumeButtonDisabled + + + + + 0 + + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + MSSecurityGuide @@ -68232,6 +73335,102 @@ If the user has configured a slide show to run on the lock screen when the machi ; + + LetAppsAccessBackgroundSpatialPerception + + + + + 0 + This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + LetAppsAccessCalendar @@ -74951,6 +80150,99 @@ If you disable or do not configure this policy setting, File History can be acti LowestValueMostSecure + + ConfigureJapaneseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Japanese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Japanese IME is on by default. Allow to control Microsoft Japanese IME version to use. +1 - The previous version of Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. +2 - The new Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureJapaneseImeVersion + LowestValueMostSecure + + + + ConfigureSimplifiedChineseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Simplified Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Simplified Chinese IME is on by default. Allow to control Microsoft Simplified Chinese IME version to use. +1 - The previous version of Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. +2 - The new Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureSimplifiedChineseImeVersion + LowestValueMostSecure + + + + ConfigureTraditionalChineseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Traditional Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Traditional Chinese IME is on by default. Allow to control Microsoft Traditional Chinese IME version to use. +1 - The previous version of Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. +2 - The new Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureTraditionalChineseImeVersion + LowestValueMostSecure + + EnableTouchKeyboardAutoInvokeInDesktopMode @@ -76082,6 +81374,30 @@ If you disable or do not configure this policy setting, the wake setting as spec LastWrite + + DisableWUfBSafeguards + + + + + 0 + + + + + + + + + + + + text/plain + + + LastWrite + + EngagedRestartDeadline @@ -76956,6 +82272,61 @@ If you disable or do not configure this policy setting, the wake setting as spec LastWrite + + SetProxyBehaviorForUpdateDetection + + + + + 0 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + SetProxyBehaviorForUpdateDetection + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + CorpWuURL + LastWrite + + + + TargetReleaseVersion + + + + + + + + + + + + + + + + + text/plain + + WindowsUpdate.admx + TargetReleaseVersionId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + TargetReleaseVersion + LastWrite + + UpdateNotificationLevel diff --git a/windows/client-management/mdm/policymanager-csp.md b/windows/client-management/mdm/policymanager-csp.md index ad4bb24be7..656e292b4e 100644 --- a/windows/client-management/mdm/policymanager-csp.md +++ b/windows/client-management/mdm/policymanager-csp.md @@ -1,6 +1,6 @@ --- title: PolicyManager CSP -description: PolicyManager CSP +description: Learn how PolicyManager CSP is deprecated. For Windows 10 devices you should use Policy CSP, which replaces PolicyManager CSP. ms.assetid: 048427b1-6024-4660-8660-bd91c583f7f9 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/proxy-csp.md b/windows/client-management/mdm/proxy-csp.md index cced09bc2b..c1d9034fe8 100644 --- a/windows/client-management/mdm/proxy-csp.md +++ b/windows/client-management/mdm/proxy-csp.md @@ -1,6 +1,6 @@ --- title: PROXY CSP -description: PROXY CSP +description: Learn how the PROXY configuration service provider (CSP) is used to configure proxy connections. ms.assetid: 9904d44c-4a1e-4ae7-a6c7-5dba06cb16ce ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 5e0bc0b2d9..48baff3fe8 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -1,6 +1,6 @@ --- title: PXLOGICAL configuration service provider -description: PXLOGICAL configuration service provider +description: The PXLOGICAL configuration service provider is used to add, remove, or modify WAP logical and physical proxies by using WAP or the standard Windows techniques. ms.assetid: b5fc84d4-aa32-4edd-95f1-a6a9c0feb459 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index e7cb92b9c4..d906bca3da 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -1,6 +1,6 @@ --- title: Reboot CSP -description: Reboot CSP +description: Learn how the Reboot configuration service provider (CSP) is used to configure reboot settings. ms.assetid: 4E3F1225-BBAD-40F5-A1AB-FF221B6BAF48 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md index ae536fae17..3beb6993e3 100644 --- a/windows/client-management/mdm/reclaim-seat-from-user.md +++ b/windows/client-management/mdm/reclaim-seat-from-user.md @@ -1,6 +1,6 @@ --- title: Reclaim seat from user -description: The Reclaim seat from user operation returns reclaimed seats for a user in the Micosoft Store for Business. +description: The Reclaim seat from user operation returns reclaimed seats for a user in the Microsoft Store for Business. ms.assetid: E2C3C899-D0AD-469A-A319-31A420472A4C ms.reviewer: manager: dansimp @@ -9,12 +9,12 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/18/2017 +ms.date: 05/05/2020 --- # Reclaim seat from user -The **Reclaim seat from user** operation returns reclaimed seats for a user in the Micosoft Store for Business. +The **Reclaim seat from user** operation returns reclaimed seats for a user in the Microsoft Store for Business. ## Request diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md index 61d34774a7..4978cc70e0 100644 --- a/windows/client-management/mdm/registry-csp.md +++ b/windows/client-management/mdm/registry-csp.md @@ -1,6 +1,6 @@ --- title: Registry CSP -description: Registry CSP +description: In this article, learn how to use the Registry configuration service provider (CSP) to update registry settings. ms.assetid: 2307e3fd-7b61-4f00-94e1-a639571f2c9d ms.reviewer: manager: dansimp @@ -17,7 +17,8 @@ ms.date: 06/26/2017 The Registry configuration service provider is used to update registry settings. However, if there is configuration service provider that is specific to the settings that need to be updated, use the specific configuration service provider. -> **Note**   The Registry CSP is only supported in Windows 10 Mobile for OEM configuration. Do not use this CSP for enterprise remote management. +> [!NOTE] +> The Registry CSP is only supported in Windows 10 Mobile for OEM configuration. Do not use this CSP for enterprise remote management. For Windows 10 Mobile only, this configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_OEM capabilities to be accessed from a network configuration application.   @@ -32,13 +33,12 @@ For OMA Client Provisioning, the follows notes apply: - This documentation describes the default characteristics. Additional characteristics may be added. -- Because the **Registry** configuration service provider uses the backslash (\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\). +- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\). The default security role maps to each subnode unless specific permission is granted to the subnode. The security role for subnodes is implementation specific, and can be changed by OEMs and mobile operators. ## Microsoft Custom Elements - The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning. @@ -75,11 +75,10 @@ The following table shows the Microsoft custom elements that this configuration
        - Use these elements to build standard OMA Client Provisioning configuration XML. For information about specific elements, see MSPROV DTD elements. -## Supported Data Types +## Supported Data Types The following table shows the data types this configuration service provider supports. diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md index 164f8d4a66..6b6bc9c191 100644 --- a/windows/client-management/mdm/registry-ddf-file.md +++ b/windows/client-management/mdm/registry-ddf-file.md @@ -1,6 +1,6 @@ --- title: Registry DDF file -description: Registry DDF file +description: Learn about the OMA DM device description framework (DDF) for the Registry configuration service provider (CSP). ms.assetid: 29b5cc07-f349-4567-8a77-387d816a9d15 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md index 3ea4ca8ee0..57368cb103 100644 --- a/windows/client-management/mdm/remotelock-csp.md +++ b/windows/client-management/mdm/remotelock-csp.md @@ -1,6 +1,6 @@ --- title: RemoteLock CSP -description: RemoteLock CSP +description: Learn how RemoteLock CSP supports the ability to lock a device that has a PIN set on the device or reset the PIN on a device that may or may not have a PIN set. ms.assetid: c7889331-5aa3-4efe-9a7e-20d3f433659b ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/remotelock-ddf-file.md b/windows/client-management/mdm/remotelock-ddf-file.md index 2408353c86..d740994fc1 100644 --- a/windows/client-management/mdm/remotelock-ddf-file.md +++ b/windows/client-management/mdm/remotelock-ddf-file.md @@ -1,6 +1,6 @@ --- title: RemoteLock DDF file -description: RemoteLock DDF file +description: Learn about the OMA DM device description framework (DDF) for the RemoteLock configuration service provider (CSP). ms.assetid: A301AE26-1BF1-4328-99AB-1ABBA4960797 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md index 726df442f0..999d8b629e 100644 --- a/windows/client-management/mdm/remotering-csp.md +++ b/windows/client-management/mdm/remotering-csp.md @@ -1,6 +1,6 @@ --- title: RemoteRing CSP -description: RemoteRing CSP +description: The RemoteRing CSP can be used to remotely trigger a device to produce an audible ringing sound regardless of the volume that's set on the device. ms.assetid: 70015243-c07f-46cb-a0f9-4b4ad13a5609 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index bdf604d6d8..efd8cdac2b 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -1,6 +1,6 @@ --- title: RemoteWipe CSP -description: RemoteWipe CSP +description: Learn how the RemoteWipe configuration service provider (CSP) can be used by mobile operators DM server or enterprise management server to remotely wipe a device. ms.assetid: 6e89bd37-7680-4940-8a67-11ed062ffb70 ms.reviewer: manager: dansimp @@ -48,16 +48,16 @@ Supported operation is Exec. Added in Windows 10, version 1709. Exec on this node will perform a remote reset on the device and persist user accounts and data. The return status code shows whether the device accepted the Exec command. **AutomaticRedeployment** -Added in Windows 10, next major update. Node for the Autopilot Reset operation. +Added in Windows 10, version 1809. Node for the Autopilot Reset operation. **AutomaticRedeployment/doAutomaticRedeployment** -Added in Windows 10, next major update. Exec on this node triggers Autopilot Reset operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard. +Added in Windows 10, version 1809. Exec on this node triggers Autopilot Reset operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard. **AutomaticRedeployment/LastError** -Added in Windows 10, next major update. Error value, if any, associated with Autopilot Reset operation (typically an HRESULT). +Added in Windows 10, version 1809. Error value, if any, associated with Autopilot Reset operation (typically an HRESULT). **AutomaticRedeployment/Status** -Added in Windows 10, next major update. Status value indicating current state of an Autopilot Reset operation. +Added in Windows 10, version 1809. Status value indicating current state of an Autopilot Reset operation. Supported values: diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 12a8de389a..36a83bee33 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -1,6 +1,6 @@ --- title: RemoteWipe DDF file -description: RemoteWipe DDF file +description: Learn about the OMA DM device description framework (DDF) for the RemoteWipe configuration service provider. ms.assetid: 10ec4fb7-f911-4d0c-9a8f-e96bf5faea0c ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md index efafe7ae2f..ad6dd045e3 100644 --- a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md +++ b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md @@ -1,6 +1,6 @@ --- title: REST API reference for Microsoft Store for Business -description: REST API reference for Microsoft Store for Business +description: Learn how the REST API reference for Microsoft Store for Business includes available operations and data structures. MS-HAID: - 'p\_phdevicemgmt.business\_store\_portal\_management\_rest\_api\_reference' - 'p\_phDeviceMgmt.rest\_api\_reference\_windows\_store\_for\_Business' diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 132e196cc0..1c5b7912aa 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -1,6 +1,6 @@ --- title: RootCATrustedCertificates CSP -description: RootCATrustedCertificates CSP +description: Learn how the RootCATrustedCertificates configuration service provider (CSP) enables the enterprise to set the Root Certificate Authority (CA) certificates. ms.assetid: F2F25DEB-9DB3-40FB-BC3C-B816CE470D61 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index a80fb75af6..166dfc0d43 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -1,6 +1,6 @@ --- title: RootCATrustedCertificates DDF file -description: RootCATrustedCertificates DDF file +description: Learn about the OMA DM device description framework (DDF) for the RootCACertificates configuration service provider (CSP). ms.assetid: 06D8787B-D3E1-4D4B-8A21-8045A8F85C1C ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index 7d972a5a96..6585261229 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -1,6 +1,6 @@ --- title: SecureAssessment CSP -description: SecureAssessment CSP +description: Learn how the SecureAssessment configuration service provider (CSP) is used to provide configuration information for the secure assessment browser. ms.assetid: 6808BE4B-961E-4638-BF15-FD7841D1C00A ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 9b8b3ce65d..9e203d4d39 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -1,6 +1,6 @@ --- title: SecurityPolicy CSP -description: SecurityPolicy CSP +description: The SecurityPolicy CSP is used to configure security policy settings for WAP push, OMA DM, Service Indication (SI), Service Loading (SL), and MMS. ms.assetid: 6014f8fe-f91b-49f3-a357-bdf625545bc9 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/server-requirements-windows-mdm.md b/windows/client-management/mdm/server-requirements-windows-mdm.md index 50b8b73b30..032469c901 100644 --- a/windows/client-management/mdm/server-requirements-windows-mdm.md +++ b/windows/client-management/mdm/server-requirements-windows-mdm.md @@ -1,6 +1,6 @@ --- title: Server requirements for using OMA DM to manage Windows devices -description: Server requirements for using OMA DM to manage Windows devices +description: Learn about the general server requirements for using OMA DM to manage Windows devices, including the supported versions of OMA DM. MS-HAID: - 'p\_phDeviceMgmt.server\_requirements\_for\_oma\_dm' - 'p\_phDeviceMgmt.server\_requirements\_windows\_mdm' diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md index eaae458518..cf00680823 100644 --- a/windows/client-management/mdm/sharedpc-csp.md +++ b/windows/client-management/mdm/sharedpc-csp.md @@ -1,6 +1,6 @@ --- title: SharedPC CSP -description: SharedPC CSP +description: Learn how the SharedPC configuration service provider is used to configure settings for Shared PC usage. ms.assetid: 31273166-1A1E-4F96-B176-CB42ECB80957 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index b9ea9c1767..61e26ea7a0 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -1,6 +1,6 @@ --- title: SharedPC DDF file -description: SharedPC DDF file +description: Learn how the OMA DM device description framework (DDF) for the SharedPC configuration service provider (CSP). ms.assetid: 70234197-07D4-478E-97BB-F6C651C0B970 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md index 6ed19c97e1..3cb5d8920c 100644 --- a/windows/client-management/mdm/storage-csp.md +++ b/windows/client-management/mdm/storage-csp.md @@ -1,6 +1,6 @@ --- title: Storage CSP -description: Storage CSP +description: Learn how the Storage enterprise configuration service provider (CSP) is used to configure the storage card settings. ms.assetid: b19bdb54-53ed-42ce-a5a1-269379013f57 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md index ee4f4c5e68..17340fbf2d 100644 --- a/windows/client-management/mdm/storage-ddf-file.md +++ b/windows/client-management/mdm/storage-ddf-file.md @@ -1,6 +1,6 @@ --- title: Storage DDF file -description: Storage DDF file +description: Learn about the OMA DM device description framework (DDF) for the Storage configuration service provider (CSP). ms.assetid: 247062A3-4DFB-4B14-A3D1-68D02C27703C ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md index 0e0293bca8..2b482383bd 100644 --- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md @@ -1,6 +1,6 @@ --- title: Structure of OMA DM provisioning files -description: Structure of OMA DM provisioning files +description: Learn about the structure of OMA DM provisioning files, for example how each message is composed of a header, specified by the SyncHdr element, and a message body. ms.assetid: 7bd3ef57-c76c-459b-b63f-c5a333ddc2bc ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index 64077761f8..45e335fdf9 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -1,6 +1,6 @@ --- title: SUPL CSP -description: SUPL CSP +description: Learn how the SUPL configuration service provider (CSP) is used to configure the location client. ms.assetid: afad0120-1126-4fc5-8e7a-64b9f2a5eae1 ms.reviewer: manager: dansimp @@ -14,9 +14,6 @@ ms.date: 09/12/2019 # SUPL CSP -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - The SUPL configuration service provider is used to configure the location client, as shown in the following table: @@ -89,7 +86,7 @@ For OMA DM, if the format for this node is incorrect the entry will be ignored a Optional. Determines the major version of the SUPL protocol to use. For SUPL 1.0.0, set this value to 1. For SUPL 2.0.0, set this value to 2. The default is 1. Refer to FullVersion to define the minor version and the service indicator. **FullVersion** -Added in the next major release of Windows 10. Optional. Determines the full version (X.Y.Z where X, Y, and Z are the major version, the minor version, and the service indicator, respectively) of the SUPL protocol to use. The default is 1.0.0. If FullVersion is defined, Version field is ignored. +Added in Windows 10, version 2004. Optional. Determines the full version (X.Y.Z where X, Y, and Z are the major version, the minor version, and the service indicator, respectively) of the SUPL protocol to use. The default is 1.0.0. If FullVersion is defined, Version field is ignored. **MCCMNCPairs** Required. List all of the MCC and MNC pairs owned by the mobile operator. This list is used to verify that the UICC matches the network and SUPL can be used. When the UICC and network do not match, the device uses the default location service and does not use SUPL. diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index e2b10b625a..2c1db8dd46 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/20/2018 +ms.date: 06/03/2020 --- # SUPL DDF file -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **SUPL** configuration service provider (CSP). Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index fcb23c170c..c03b4d3430 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -20,23 +20,23 @@ The following diagram shows the SurfaceHub CSP management objects in tree format ![surface hub diagram](images/provisioning-csp-surfacehub.png) -**./Vendor/MSFT/SurfaceHub** +**./Vendor/MSFT/SurfaceHub**

      The root node for the Surface Hub configuration service provider. -**DeviceAccount** +**DeviceAccount**

      Node for setting device account information. A device account is a Microsoft Exchange account that is connected with Skype for Business, which allows people to join scheduled meetings, make Skype for Business calls, and share content from the device. See the Surface Hub administrator guide for more information about setting up a device account.

      To use a device account from Azure Active Directory -1. Set the UserPrincipalName (for Azure AD). -2. Set a valid Password. -3. Execute ValidateAndCommit to validate the specified username and password combination against Azure AD. -4. Get the ErrorContext in case something goes wrong during validation. +1. Set the UserPrincipalName (for Azure AD). +2. Set a valid Password. +3. Execute ValidateAndCommit to validate the specified username and password combination against Azure AD. +4. Get the ErrorContext in case something goes wrong during validation. > [!NOTE] > If the device cannot auto-discover the Exchange server and Session Initiation Protocol (SIP) address from this information, you should specify the ExchangeServer and SipAddress. - +

      Here's a SyncML example. ```xml @@ -89,67 +89,72 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

      To use a device account from Active Directory -1. Set the DomainName. -2. Set the UserName. -3. Set a valid Password. -4. Execute the ValidateAndCommit node. +1. Set the DomainName. +2. Set the UserName. +3. Set a valid Password. +4. Execute the ValidateAndCommit node. -**DeviceAccount/DomainName** +**DeviceAccount/DomainName**

      Domain of the device account when you are using Active Directory. To use a device account from Active Directory, you should specify both DomainName and UserName for the device account.

      The data type is string. Supported operation is Get and Replace. -**DeviceAccount/UserName** +**DeviceAccount/UserName**

      Username of the device account when you are using Active Directory. To use a device account from Active Directory, you should specify both DomainName and UserName for the device account.

      The data type is string. Supported operation is Get and Replace. -**DeviceAccount/UserPrincipalName** +**DeviceAccount/UserPrincipalName**

      User principal name (UPN) of the device account. To use a device account from Azure Active Directory or a hybrid deployment, you should specify the UPN of the device account.

      The data type is string. Supported operation is Get and Replace. -**DeviceAccount/SipAddress** +**DeviceAccount/SipAddress**

      Session Initiation Protocol (SIP) address of the device account. Normally, the device will try to auto-discover the SIP. This field is only required if auto-discovery fails.

      The data type is string. Supported operation is Get and Replace. -**DeviceAccount/Password** +**DeviceAccount/Password**

      Password for the device account.

      The data type is string. Supported operation is Get and Replace. The operation Get is allowed, but it will always return a blank. -**DeviceAccount/ValidateAndCommit** +**DeviceAccount/ValidateAndCommit**

      This method validates the data provided and then commits the changes.

      The data type is string. Supported operation is Execute. -**DeviceAccount/Email** +**DeviceAccount/Email**

      Email address of the device account.

      The data type is string. -**DeviceAccount/PasswordRotationEnabled** +**DeviceAccount/PasswordRotationEnabled**

      Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, use this setting to allow the device to manage its own password by changing it frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory (or Azure AD).

      Valid values: -- 0 - password rotation enabled -- 1 - disabled +- 0 - password rotation enabled +- 1 - disabled

      The data type is integer. Supported operation is Get and Replace. -**DeviceAccount/ExchangeServer** +**DeviceAccount/ExchangeServer**

      Exchange server of the device account. Normally, the device will try to auto-discover the Exchange server. This field is only required if auto-discovery fails.

      The data type is string. Supported operation is Get and Replace. -**DeviceAccount/CalendarSyncEnabled** +**DeviceAccount/ExchangeModernAuthEnabled** +

      Added in KB4598291 for Windows 10, version 20H2. Specifies whether Device Account calendar sync will attempt to use token-based Modern Authentication to connect to the Exchange Server. Default value is True. + +

      The data type is boolean. Supported operation is Get and Replace. + +**DeviceAccount/CalendarSyncEnabled**

      Specifies whether calendar sync and other Exchange server services is enabled.

      The data type is boolean. Supported operation is Get and Replace. -**DeviceAccount/ErrorContext** +**DeviceAccount/ErrorContext**

      If there is an error calling ValidateAndCommit, there is additional context for that error in this node. Here are the possible error values:

      @@ -161,7 +166,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format - + @@ -206,67 +211,67 @@ The following diagram shows the SurfaceHub CSP management objects in tree format  

      The data type is integer. Supported operation is Get. -**MaintenanceHoursSimple/Hours** +**MaintenanceHoursSimple/Hours**

      Node for maintenance schedule. -**MaintenanceHoursSimple/Hours/StartTime** +**MaintenanceHoursSimple/Hours/StartTime**

      Specifies the start time for maintenance hours in minutes from midnight. For example, to set a 2:00 am start time, set this value to 120.

      The data type is integer. Supported operation is Get and Replace. -**MaintenanceHoursSimple/Hours/Duration** +**MaintenanceHoursSimple/Hours/Duration**

      Specifies the duration of maintenance window in minutes. For example, to set a 3-hour duration, set this value to 180.

      The data type is integer. Supported operation is Get and Replace. -**InBoxApps** +**InBoxApps**

      Node for the in-box app settings. -**InBoxApps/SkypeForBusiness** +**InBoxApps/SkypeForBusiness**

      Added in Windows 10, version 1703. Node for the Skype for Business settings. -**InBoxApps/SkypeForBusiness/DomainName** +**InBoxApps/SkypeForBusiness/DomainName**

      Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see Set up Skype for Business Online.

      The data type is string. Supported operation is Get and Replace. -**InBoxApps/Welcome** +**InBoxApps/Welcome**

      Node for the welcome screen. -**InBoxApps/Welcome/AutoWakeScreen** +**InBoxApps/Welcome/AutoWakeScreen**

      Automatically turn on the screen using motion sensors.

      The data type is boolean. Supported operation is Get and Replace. -**InBoxApps/Welcome/CurrentBackgroundPath** -

      Background image for the welcome screen. To set this, specify a https URL to a PNG file (only PNGs are supported for security reasons). +**InBoxApps/Welcome/CurrentBackgroundPath** +

      Background image for the welcome screen. To set this, specify an https URL to a PNG file (only PNGs are supported for security reasons). If any certificate authorities need to be trusted in order to access the URL, please ensure they are valid and installed on the Hub, otherwise it may not be able to load the image.

      The data type is string. Supported operation is Get and Replace. -**InBoxApps/Welcome/MeetingInfoOption** +**InBoxApps/Welcome/MeetingInfoOption**

      Meeting information displayed on the welcome screen.

      Valid values: -- 0 - Organizer and time only -- 1 - Organizer, time, and subject. Subject is hidden in private meetings. +- 0 - Organizer and time only +- 1 - Organizer, time, and subject. Subject is hidden in private meetings.

      The data type is integer. Supported operation is Get and Replace. -**InBoxApps/WirelessProjection** +**InBoxApps/WirelessProjection**

      Node for the wireless projector app settings. -**InBoxApps/WirelessProjection/PINRequired** +**InBoxApps/WirelessProjection/PINRequired**

      Users must enter a PIN to wirelessly project to the device.

      The data type is boolean. Supported operation is Get and Replace. -**InBoxApps/WirelessProjection/Enabled** +**InBoxApps/WirelessProjection/Enabled**

      Enables wireless projection to the device.

      The data type is boolean. Supported operation is Get and Replace. -**InBoxApps/WirelessProjection/Channel** +**InBoxApps/WirelessProjection/Channel**

      Wireless channel to use for Miracast operation. The supported channels are defined by the Wi-Fi Alliance Wi-Fi Direct specification.

      ErrorContext valueStage where error occuredStage where error occurred Description and suggestions
      @@ -290,36 +295,36 @@ The following diagram shows the SurfaceHub CSP management objects in tree format
      - +

      The default value is 255. Outside of regulatory concerns, if the channel is configured incorrectly the driver will either not boot, or will broadcast on the wrong channel (which senders won't be looking for).

      The data type is integer. Supported operation is Get and Replace. -**InBoxApps/Connect** +**InBoxApps/Connect**

      Added in Windows 10, version 1703. Node for the Connect app. -**InBoxApps/Connect/AutoLaunch** +**InBoxApps/Connect/AutoLaunch**

      Added in Windows 10, version 1703. Specifies whether to automatically launch the Connect app whenever a projection is initiated.

      If this setting is true, the Connect app will be automatically launched. If false, the user will need to launch the Connect app manually from the Hub’s settings.

      The data type is boolean. Supported operation is Get and Replace. -**Properties** +**Properties**

      Node for the device properties. -**Properties/FriendlyName** +**Properties/FriendlyName**

      Friendly name of the device. Specifies the name that users see when they want to wirelessly project to the device.

      The data type is string. Supported operation is Get and Replace. -**Properties/DefaultVolume** +**Properties/DefaultVolume**

      Added in Windows 10, version 1703. Specifies the default volume value for a new session. Permitted values are 0-100. The default is 45.

      The data type is integer. Supported operation is Get and Replace. -**Properties/ScreenTimeout** -

      Added in Windows 10, version 1703. Specifies the number of minutes until the Hub screen turns off. +**Properties/ScreenTimeout** +

      Added in Windows 10, version 1703. Specifies the number of minutes until the Hub screen turns off.

      The following table shows the permitted values. @@ -333,7 +338,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format 0 -Never timeout +Never time out 1 1 minute @@ -370,8 +375,8 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

      The data type is integer. Supported operation is Get and Replace. -**Properties/SessionTimeout** -

      Added in Windows 10, version 1703. Specifies the number of minutes until the session times out. +**Properties/SessionTimeout** +

      Added in Windows 10, version 1703. Specifies the number of minutes until the session times out.

      The following table shows the permitted values. @@ -385,7 +390,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format 0 -Never timeout +Never time out 1 1 minute (default) @@ -422,8 +427,8 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

      The data type is integer. Supported operation is Get and Replace. -**Properties/SleepTimeout** -

      Added in Windows 10, version 1703. Specifies the number of minutes until the Hub enters sleep mode. +**Properties/SleepTimeout** +

      Added in Windows 10, version 1703. Specifies the number of minutes until the Hub enters sleep mode.

      The following table shows the permitted values. @@ -437,7 +442,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format 0 -Never timeout +Never time out 1 1 minute @@ -474,53 +479,54 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

      The data type is integer. Supported operation is Get and Replace. -**Properties/AllowSessionResume** -

      Added in Windows 10, version 1703. Specifies whether to allow the ability to resume a session when the session times out. +**Properties/SleepMode** +

      Added in Windows 10, version 20H2. Specifies the type of sleep mode for the Surface Hub. -

      If this setting is true, the "Resume Session" feature will be available on the welcome screen when the screen is idle. If false, once the screen idles, the session will be automatically cleaned up as if the “End Session" feature was initiated. +

      Valid values: + +- 0 - Connected Standby (default) +- 1 - Hibernate + +

      The data type is integer. Supported operation is Get and Replace. + +**Properties/AllowSessionResume** +

      Added in Windows 10, version 1703. Specifies whether to allow the ability to resume a session when the session times out. + +

      If this setting is true, the "Resume Session" feature will be available on the welcome screen when the screen is idle. If false, once the screen idles, the session will be automatically cleaned up as if the “End Session" feature was initiated.

      The data type is boolean. Supported operation is Get and Replace. -**Properties/AllowAutoProxyAuth** +**Properties/AllowAutoProxyAuth**

      Added in Windows 10, version 1703. Specifies whether to use the device account for proxy authentication.

      If this setting is true, the device account will be used for proxy authentication. If false, a separate account will be used.

      The data type is boolean. Supported operation is Get and Replace. -**Properties/DisableSigninSuggestions** -

      Added in Windows 10, version 1703. Specifies whether to disable auto-populating of the sign-in dialog with invitees from scheduled meetings. +**Properties/DisableSigninSuggestions** +

      Added in Windows 10, version 1703. Specifies whether to disable auto-populating of the sign-in dialog with invitees from scheduled meetings.

      If this setting is true, the sign-in dialog will not be populated. If false, the dialog will auto-populate.

      The data type is boolean. Supported operation is Get and Replace. -**Properties/DoNotShowMyMeetingsAndFiles** +**Properties/DoNotShowMyMeetingsAndFiles**

      Added in Windows 10, version 1703. Specifies whether to disable the "My meetings and files" feature in the Start menu, which shows the signed-in user's meetings and files from Office 365.

      If this setting is true, the “My meetings and files” feature will not be shown. When false, the “My meetings and files” feature will be shown.

      The data type is boolean. Supported operation is Get and Replace. -**MOMAgent** +**MOMAgent**

      Node for the Microsoft Operations Management Suite. -**MOMAgent/WorkspaceID** +**MOMAgent/WorkspaceID**

      GUID identifying the Microsoft Operations Management Suite workspace ID to collect the data. Set this to an empty string to disable the MOM agent.

      The data type is string. Supported operation is Get and Replace. -**MOMAgent/WorkspaceKey** +**MOMAgent/WorkspaceKey**

      Primary key for authenticating with the workspace.

      The data type is string. Supported operation is Get and Replace. The Get operation is allowed, but it will always return an empty string. - - - - - - - - - diff --git a/windows/client-management/mdm/tenantlockdown-ddf.md b/windows/client-management/mdm/tenantlockdown-ddf.md index ad901702a5..b064d57b68 100644 --- a/windows/client-management/mdm/tenantlockdown-ddf.md +++ b/windows/client-management/mdm/tenantlockdown-ddf.md @@ -1,6 +1,6 @@ --- title: TenantLockdown DDF file -description: XML file containing the device description framework for the TenantLockdown configuration service provider. +description: XML file containing the device description framework for the TenantLockdown configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md index 36f46f9df1..f97ea96a00 100644 --- a/windows/client-management/mdm/tpmpolicy-csp.md +++ b/windows/client-management/mdm/tpmpolicy-csp.md @@ -1,6 +1,6 @@ --- title: TPMPolicy CSP -description: TPMPolicy CSP +description: The TPMPolicy configuration service provider (CSP) provides a mechanism to enable zero exhaust configuration on a Windows device for TPM software components. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/tpmpolicy-ddf-file.md b/windows/client-management/mdm/tpmpolicy-ddf-file.md index fcdb101ad2..fd463047e0 100644 --- a/windows/client-management/mdm/tpmpolicy-ddf-file.md +++ b/windows/client-management/mdm/tpmpolicy-ddf-file.md @@ -1,6 +1,6 @@ --- title: TPMPolicy DDF file -description: TPMPolicy DDF file +description: Learn about the OMA DM device description framework (DDF) for the TPMPolicy configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/uefi-ddf.md b/windows/client-management/mdm/uefi-ddf.md index 808685d36d..1432ef811a 100644 --- a/windows/client-management/mdm/uefi-ddf.md +++ b/windows/client-management/mdm/uefi-ddf.md @@ -1,6 +1,6 @@ --- title: UEFI DDF file -description: UEFI DDF file +description: Learn about the OMA DM device description framework (DDF) for the Uefi configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index ab3a46a409..14cd5810b2 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -260,7 +260,7 @@ Note that the data payload of the SyncML needs to be encoded so that it does not The **LocURI** for the above GP policy is: -`.\Device\Vendor\MSFT\Policy\Config\AppVirtualization\PublishingAllowServer2` +`./Device/Vendor/MSFT/Policy/Config/AppVirtualization/PublishingAllowServer2` To construct SyncML for your area/policy using the samples below, you need to update the **data id** and the **value** in the `` section of the SyncML. The items prefixed with an '&' character are the escape characters needed and can be retained as shown. diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index bacfd4f923..183c89df6d 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -1,6 +1,6 @@ --- title: Update CSP -description: Update CSP +description: Learn how the Update configuration service provider (CSP) enables IT administrators to manage and control the rollout of new updates. ms.assetid: F1627B57-0749-47F6-A066-677FDD3D7359 ms.reviewer: manager: dansimp @@ -16,6 +16,9 @@ ms.date: 02/23/2018 The Update configuration service provider enables IT administrators to manage and control the rollout of new updates. +> [!Note] +> The Update CSP functionality of 'AprrovedUpdates' is not recommended for managing desktop devices. To manage updates to desktop devices from Windows Update, see the [Policy CSP - Updates](policy-csp-update.md) documentation for the recommended policies. + The following diagram shows the Update configuration service provider in tree format. ![update csp diagram](images/provisioning-csp-update.png) diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index 731adeeb60..44f580cb4f 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -1,6 +1,6 @@ --- title: Update DDF file -description: Update DDF file +description: Learn about the OMA DM device description framework (DDF) for the Update configuration service provider (CSP). ms.assetid: E236E468-88F3-402A-BA7A-834ED38DD388 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 7b8f154145..60702d4f69 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -1,6 +1,6 @@ --- title: VPN CSP -description: VPN CSP +description: Learn how the VPN configuration service provider (CSP) allows the mobile device management (MDM) server to configure the VPN profile of the device. ms.assetid: 05ca946a-1c0b-4e11-8d7e-854e14740707 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/vpn-ddf-file.md b/windows/client-management/mdm/vpn-ddf-file.md index b3e8aef28c..889a2f8f25 100644 --- a/windows/client-management/mdm/vpn-ddf-file.md +++ b/windows/client-management/mdm/vpn-ddf-file.md @@ -1,6 +1,6 @@ --- title: VPN DDF file -description: VPN DDF file +description: Learn about the OMA DM device description framework (DDF) for the VPN configuration service provider (CSP). ms.assetid: 728FCD9C-0B8E-413B-B54A-CD72C9F2B9EE ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index c7555d45bf..dc6cd495a9 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -1,15 +1,15 @@ --- title: VPNv2 CSP -description: VPNv2 CSP +description: Learn how the VPNv2 configuration service provider (CSP) allows the mobile device management (MDM) server to configure the VPN profile of the device. ms.assetid: 51ADA62E-1EE5-4F15-B2AD-52867F5B2AD2 -ms.reviewer: +ms.reviewer: pesmith manager: dansimp ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 11/01/2017 +ms.date: 10/30/2020 --- # VPNv2 CSP @@ -19,19 +19,19 @@ The VPNv2 configuration service provider allows the mobile device management (MD Here are the requirements for this CSP: -- VPN configuration commands must be wrapped in an Atomic block in SyncML. -- For best results, configure your VPN certificates first before pushing down VPN profiles to devices. If you are using Windows Information Protection (WIP) (formerly known as Enterprise Data Protection), then you should configure VPN first before you configure WIP policies. -- Instead of changing individual properties, follow these steps to make any changes: +- VPN configuration commands must be wrapped in an Atomic block in SyncML. +- For best results, configure your VPN certificates first before pushing down VPN profiles to devices. If you are using Windows Information Protection (WIP) (formerly known as Enterprise Data Protection), then you should configure VPN first before you configure WIP policies. +- Instead of changing individual properties, follow these steps to make any changes: - - Send a Delete command for the ProfileName to delete the entire profile. - - Send the entire profile again with new values wrapped in an Atomic block. + - Send a Delete command for the ProfileName to delete the entire profile. + - Send the entire profile again with new values wrapped in an Atomic block. In certain conditions you can change some properties directly, but we do not recommend it. The XSDs for all EAP methods are shipped in the box and can be found at the following locations: -- C:\\Windows\\schemas\\EAPHost -- C:\\Windows\\schemas\\EAPMethods +- `C:\\Windows\\schemas\\EAPHost` +- `C:\\Windows\\schemas\\EAPMethods` The following diagram shows the VPNv2 configuration service provider in tree format. @@ -45,13 +45,14 @@ Unique alpha numeric identifier for the profile. The profile name must not inclu Supported operations include Get, Add, and Delete. -> **Note**  If the profile name has a space or other non-alphanumeric character, it must be properly escaped according to the URL encoding standard. +> [!NOTE] +> If the profile name has a space or other non-alphanumeric character, it must be properly escaped according to the URL encoding standard. **VPNv2/**ProfileName**/AppTriggerList** Optional node. List of applications set to trigger the VPN. If any of these apps are launched and the VPN profile is currently the active profile, this VPN profile will be triggered to connect. **VPNv2/**ProfileName**/AppTriggerList/**appTriggerRowId -A sequential integer identifier which allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you should not skip numbers. +A sequential integer identifier that allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you should not skip numbers. Supported operations include Get, Add, Replace, and Delete. @@ -64,8 +65,8 @@ App identity, which is either an app’s package family name or file path. The t **VPNv2/**ProfileName**/AppTriggerList/**appTriggerRowId**/App/Type** Returns the type of **App/Id**. This value can be either of the following: -- PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Microsoft Store application. -- FilePath - When this is returned, the App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. +- PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Microsoft Store application. +- FilePath - When this is returned, the App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. Value type is chr. Supported operation is Get. @@ -99,8 +100,8 @@ Value type is int. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/RouteList/**routeRowId**/ExclusionRoute** Added in Windows 10, version 1607. A boolean value that specifies if the route being added should point to the VPN Interface or the Physical Interface as the Gateway. Valid values: -- False (default) - This route will direct traffic over the VPN -- True - This route will direct traffic over the physical interface. +- False (default) - This route will direct traffic over the VPN +- True - This route will direct traffic over the physical interface. Supported operations include Get, Add, Replace, and Delete. @@ -117,30 +118,29 @@ Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DomainName** Used to indicate the namespace to which the policy applies. When a Name query is issued, the DNS client compares the name in the query to all of the namespaces under DomainNameInformationList to find a match. This parameter can be one of the following types: -- FQDN - Fully qualified domain name -- Suffix - A domain suffix that will be appended to the shortname query for DNS resolution. To specify a suffix, prepend a **.** to the DNS suffix. +- FQDN - Fully qualified domain name +- Suffix - A domain suffix that will be appended to the shortname query for DNS resolution. To specify a suffix, prepend a **.** to the DNS suffix. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DomainNameType** Returns the namespace type. This value can be one of the following: -- FQDN - If the DomainName was not prepended with a **.** and applies only to the fully qualified domain name (FQDN) of a specified host. -- Suffix - If the DomainName was prepended with a **.** and applies to the specified namespace, all records in that namespace, and all subdomains. +- FQDN - If the DomainName was not prepended with a **.** and applies only to the fully qualified domain name (FQDN) of a specified host. +- Suffix - If the DomainName was prepended with a **.** and applies to the specified namespace, all records in that namespace, and all subdomains. Value type is chr. Supported operation is Get. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DnsServers** -List of comma separated DNS Server IP addresses to use for the namespace. +List of comma-separated DNS Server IP addresses to use for the namespace. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/WebProxyServers** Optional. Web Proxy Server IP address if you are redirecting traffic through your intranet. -> **Note**  Currently only one web proxy server is supported. - - +> [!NOTE] +> Currently only one web proxy server is supported. Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -166,9 +166,8 @@ Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList** An optional node that specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. -> **Note**  Once a TrafficFilterList is added, all traffic are blocked other than the ones matching the rules. - - +> [!NOTE] +> Once a TrafficFilterList is added, all traffic are blocked other than the ones matching the rules. When adding multiple rules, each rule operates based on an OR with the other rules. Within each rule, each property operates based on an AND with each other. @@ -183,9 +182,9 @@ App identity for the app-based traffic filter. The value for this node can be one of the following: -- PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application. -- FilePath - This App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. -- SYSTEM – This value enables Kernel Drivers to send traffic through VPN (for example, PING or SMB). +- PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application. +- FilePath - This App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. +- SYSTEM – This value enables Kernel Drivers to send traffic through VPN (for example, PING or SMB). Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -203,43 +202,51 @@ Numeric value from 0-255 representing the IP protocol to allow. For example, TCP Value type is int. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/LocalPortRanges** -A list of comma separated values specifying local port ranges to allow. For example, `100-120, 200, 300-320`. +A list of comma-separated values specifying local port ranges to allow. For example, `100-120, 200, 300-320`. -> **Note**  Ports are only valid when the protocol is set to TCP=6 or UDP=17. - - +> [!NOTE] +> Ports are only valid when the protocol is set to TCP=6 or UDP=17. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RemotePortRanges** -A list of comma separated values specifying remote port ranges to allow. For example, `100-120, 200, 300-320`. +A list of comma-separated values specifying remote port ranges to allow. For example, `100-120, 200, 300-320`. -> **Note**  Ports are only valid when the protocol is set to TCP=6 or UDP=17. - - +> [!NOTE] +> Ports are only valid when the protocol is set to TCP=6 or UDP=17. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/LocalAddressRanges** -A list of comma separated values specifying local IP address ranges to allow. +A list of comma-separated values specifying local IP address ranges to allow. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RemoteAddressRanges** -A list of comma separated values specifying remote IP address ranges to allow. +A list of comma-separated values specifying remote IP address ranges to allow. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RoutingPolicyType** Specifies the routing policy if an App or Claims type is used in the traffic filter. The scope of this property is for this traffic filter rule alone. The value can be one of the following: -- SplitTunnel - For this traffic filter rule, only the traffic meant for the VPN interface (as determined by the networking stack) goes over the interface. Internet traffic can continue to go over the other interfaces. -- ForceTunnel - For this traffic rule all IP traffic must go through the VPN Interface only. +- SplitTunnel - For this traffic filter rule, only the traffic meant for the VPN interface (as determined by the networking stack) goes over the interface. Internet traffic can continue to go over the other interfaces. +- ForceTunnel - For this traffic rule all IP traffic must go through the VPN Interface only. This is only applicable for App ID based Traffic Filter rules. Value type is chr. Supported operations include Get, Add, Replace, and Delete. +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/Direction** +Added in Windows 10, version 2004. Specifies the traffic direction to apply this policy to. Default is Outbound. The value can be one of the following: + +- Outbound - The rule applies to all outbound traffic +- Inbound - The rule applies to all inbound traffic + +If no inbound filter is provided, then by default all unsolicited inbound traffic will be blocked. + +Value type is chr. Supported operations include Get, Add, Replace, and Delete. + **VPNv2/**ProfileName**/EdpModeId** Enterprise ID, which is required for connecting this VPN profile with an WIP policy. When this is set, the networking stack looks for this Enterprise ID in the app token to determine if the traffic is allowed to go over the VPN. If the profile is active, it also automatically triggers the VPN to connect. We recommend having only one such profile per device. @@ -255,40 +262,22 @@ Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/AlwaysOn** An optional flag to enable Always On mode. This will automatically connect the VPN at sign-in and will stay connected until the user manually disconnects. -> **Note**  Always On only works for the active profile. The first profile provisioned that can be auto triggered will automatically be set as active. +> [!NOTE] +> Always On only works for the active profile. The first profile provisioned that can be auto triggered will automatically be set as active. Preserving user Always On preference Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value AutoTriggerDisabledProfilesList. Should a management tool remove/add the same profile name back and set AlwaysOn to true, Windows will not check the box if the profile name exists in the below registry value in order to preserve user preference. -Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config +Key: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config` Value: AutoTriggerDisabledProfilesList Type: REG_MULTI_SZ Valid values: -- False (default) - Always On is turned off. -- True - Always On is turned on. - -Value type is bool. Supported operations include Get, Add, Replace, and Delete. - -**VPNv2/**ProfileName**/LockDown** (./Device only profile) -Lockdown profile. - -Valid values: - -- False (default) - this is not a LockDown profile. -- True - this is a LockDown profile. - -When the LockDown profile is turned on, it does the following things: - -- First, it automatically becomes an "always on" profile. -- Second, it can never be disconnected. -- Third, if the profile is not connected, then the user has no network. -- Fourth, no other profiles may be connected or modified. - -A Lockdown profile must be deleted before you can add, remove, or connect other profiles. +- False (default) - Always On is turned off. +- True - Always On is turned on. Value type is bool. Supported operations include Get, Add, Replace, and Delete. @@ -297,14 +286,14 @@ Device tunnel profile. Valid values: -- False (default) - this is not a device tunnel profile. -- True - this is a device tunnel profile. +- False (default) - this is not a device tunnel profile. +- True - this is a device tunnel profile. When the DeviceTunnel profile is turned on, it does the following things: -- First, it automatically becomes an "always on" profile. -- Second, it does not require the presence or logging in of any user to the machine in order for it to connect. -- Third, no other device tunnel profile maybe be present on the same machine. +- First, it automatically becomes an "always on" profile. +- Second, it does not require the presence or logging in of any user to the machine in order for it to connect. +- Third, no other device tunnel profile maybe be present on the same machine. A device tunnel profile must be deleted before another device tunnel profile can be added, removed, or connected. @@ -315,11 +304,11 @@ Allows registration of the connection's address in DNS. Valid values: -- False = Do not register the connection's address in DNS (default). -- True = Register the connection's addresses in DNS. +- False = Do not register the connection's address in DNS (default). +- True = Register the connection's addresses in DNS. **VPNv2/**ProfileName**/DnsSuffix** -Optional. Specifies one or more comma separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList. +Optional. Specifies one or more comma-separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList. Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -337,7 +326,10 @@ Added in Windows 10, version 1607. The XML schema for provisioning all the fiel Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/Proxy** -A collection of configuration objects to enable a post-connect proxy support for VPN. The proxy defined for this profile is applied when this profile is active and connected. +A collection of configuration objects to enable a post-connect proxy support for VPN Force Tunnel connections. The proxy defined for this profile is applied when this profile is active and connected. + +> [!NOTE] +> VPN proxy settings are used only on Force Tunnel connections. On Split Tunnel connections, the general proxy settings are used. **VPNv2/**ProfileName**/Proxy/Manual** Optional node containing the manual server settings. @@ -428,29 +420,30 @@ Required for native profiles. Public or routable IP address or DNS name for the The name can be a server name plus a friendly name separated with a semi-colon. For example, server2.example.com;server2FriendlyName. When you get the value, the return will include both the server name and the friendly name; if no friendly name had been supplied it will default to the server name. -You can make a list of server by making a list of server names (with optional friendly names) seperated by commas. For example, server1.example.com,server2.example.com. +You can make a list of server by making a list of server names (with optional friendly names) separated by commas. For example, server1.example.com,server2.example.com. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/NativeProfile/RoutingPolicyType** Optional for native profiles. Type of routing policy. This value can be one of the following: -- SplitTunnel - Traffic can go over any interface as determined by the networking stack. -- ForceTunnel - All IP traffic must go over the VPN interface. +- SplitTunnel - Traffic can go over any interface as determined by the networking stack. +- ForceTunnel - All IP traffic must go over the VPN interface. Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/NativeProfile/NativeProtocolType** Required for native profiles. Type of tunneling protocol used. This value can be one of the following: -- PPTP -- L2TP -- IKEv2 -- Automatic +- PPTP +- L2TP +- IKEv2 +- Automatic Value type is chr. Supported operations include Get, Add, Replace, and Delete. -> **Note** The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt protocols in following order: SSTP, IKEv2, PPTP and then L2TP. This order is not customizable. +> [!NOTE] +> The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt protocols in following order: SSTP, IKEv2, PPTP and then L2TP. This order is not customizable. **VPNv2/**ProfileName**/NativeProfile/Authentication** Required node for native profile. It contains authentication information for the native VPN profile. @@ -502,12 +495,12 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- MD596 -- SHA196 -- SHA256128 -- GCMAES128 -- GCMAES192 -- GCMAES256 +- MD596 +- SHA196 +- SHA256128 +- GCMAES128 +- GCMAES192 +- GCMAES256 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -516,14 +509,14 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- DES -- DES3 -- AES128 -- AES192 -- AES256 -- GCMAES128 -- GCMAES192 -- GCMAES256 +- DES +- DES3 +- AES128 +- AES192 +- AES256 +- GCMAES128 +- GCMAES192 +- GCMAES256 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -532,13 +525,13 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- DES -- DES3 -- AES128 -- AES192 -- AES256 -- AES\_GCM_128 -- AES\_GCM_256 +- DES +- DES3 +- AES128 +- AES192 +- AES256 +- AES\_GCM_128 +- AES\_GCM_256 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -547,10 +540,10 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- MD5 -- SHA196 -- SHA256 -- SHA384 +- MD5 +- SHA196 +- SHA256 +- SHA384 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -559,12 +552,12 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- Group1 -- Group2 -- Group14 -- ECP256 -- ECP384 -- Group24 +- Group1 +- Group2 +- Group14 +- ECP256 +- ECP384 +- Group24 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -573,13 +566,13 @@ Added in Windows 10, version 1607. The following list contains the valid values: -- PFS1 -- PFS2 -- PFS2048 -- ECP256 -- ECP384 -- PFSMM -- PFS24 +- PFS1 +- PFS2 +- PFS2048 +- ECP256 +- ECP384 +- PFSMM +- PFS24 Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -1308,8 +1301,7 @@ Servers ``` -## Related topics - +## See also [Configuration service provider reference](configuration-service-provider-reference.md) @@ -1321,4 +1313,3 @@ Servers - diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index aa531d9602..ea97295698 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -2,14 +2,14 @@ title: VPNv2 DDF file description: This topic shows the OMA DM device description framework (DDF) for the VPNv2 configuration service provider. ms.assetid: 4E2F36B7-D2EE-4F48-AD1A-6BDE7E72CC94 -ms.reviewer: +ms.reviewer: pesmith manager: dansimp ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 12/05/2017 +ms.date: 10/30/2020 --- # VPNv2 DDF file @@ -19,7 +19,7 @@ This topic shows the OMA DM device description framework (DDF) for the **VPNv2** Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1709. +The XML below is for Windows 10, version 2004. ```xml @@ -32,7 +32,7 @@ The XML below is for Windows 10, version 1709. 1.2 VPNv2 - ./Device/Vendor/MSFT + ./Vendor/MSFT @@ -830,6 +830,33 @@ The XML below is for Windows 10, version 1709. + + Direction + + + + + + + + + Outbound - The traffic filter allows traffic to reach destinations matching this rule. This is the default. + Inbound - The traffic filter allows traffic coming from external locations matching this rule. + + + + + + + + + + + + text/plain + + + @@ -1625,6 +1652,76 @@ The XML below is for Windows 10, version 1709. + + WebAuth + + + + + + Nodes under WebAuth can be used to enable WebToken based authentication for 3rd Party Plugin VPN Profiles. + + + + + + + + + + + + + + + Enabled + + + + + + + + Enables the WebToken based authentication flow. + + + + + + + + + + + text/plain + + + + + ClientId + + + + + + + + The client ID to specify when communicating with the Web Account provider in retrieving the token. + + + + + + + + + + + text/plain + + + + NativeProfile @@ -2225,6 +2322,33 @@ The XML below is for Windows 10, version 1709. + + PlumbIKEv2TSAsRoutes + + + + + + + + + True: Plumb traffic selectors as routes onto VPN interface + False: Do not plumb traffic selectors as routes + + + + + + + + + + + + text/plain + + + @@ -3718,6 +3842,76 @@ The XML below is for Windows 10, version 1709. + + WebAuth + + + + + + Nodes under WebAuth can be used to enable WebToken based authentication for 3rd Party Plugin VPN Profiles. + + + + + + + + + + + + + + + Enabled + + + + + + + + Enables the WebToken based authentication flow. + + + + + + + + + + + text/plain + + + + + ClientId + + + + + + + + The client ID to specify when communicating with the Web Account provider in retrieving the token. + + + + + + + + + + + text/plain + + + + NativeProfile @@ -4318,6 +4512,33 @@ The XML below is for Windows 10, version 1709. + + PlumbIKEv2TSAsRoutes + + + + + + + + + True: Plumb traffic selectors as routes onto VPN interface + False: Do not plumb traffic selectors as routes + + + + + + + + + + + + text/plain + + + diff --git a/windows/client-management/mdm/vpnv2-profile-xsd.md b/windows/client-management/mdm/vpnv2-profile-xsd.md index eecc7c7075..ee3e5cfb4c 100644 --- a/windows/client-management/mdm/vpnv2-profile-xsd.md +++ b/windows/client-management/mdm/vpnv2-profile-xsd.md @@ -1,25 +1,23 @@ --- title: ProfileXML XSD -description: Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples. +description: Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples. ms.assetid: 2F32E14B-F9B9-4760-AE94-E57F1D4DFDB3 -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 02/05/2018 +ms.date: 07/14/2020 --- # ProfileXML XSD - -Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples. +Here's the XSD for the ProfileXML node in the VPNv2 CSP and VpnManagementAgent::AddProfileFromXmlAsync for Windows 10 and some profile examples. ## XSD for the VPN profile - ```xml @@ -27,15 +25,16 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro + - + @@ -51,15 +50,15 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - + - - - - + + + + @@ -89,7 +88,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - + @@ -109,13 +108,20 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro + - + + + + + + + @@ -123,6 +129,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro + @@ -134,6 +141,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro + @@ -148,34 +156,37 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - - + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - + - + + @@ -187,16 +198,79 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro ## Native profile example +```xml + + corp.contoso.com + true + false + corp.contoso.com + contoso.com -``` - - - testServer.VPN.com - IKEv2 - - Eap - - + + Helloworld.Com + + HelloServer + + + + + true + + true + This is my Eku + This is my issuer hash + + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + + + + C:\windows\system32\ping.exe + + + + + hrsite.corporate.contoso.com + 1.2.3.4,5.6.7.8 + 5.5.5.5 + true + + + .corp.contoso.com + 10.10.10.10,20.20.20.20 + 100.100.100.100 + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + 6 + 10,20-50,100-200 + 20-50,100-200,300 + 30.30.0.0/16,10.10.10.10-20.20.20.20 + ForceTunnel + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + 3.3.3.3/32,1.1.1.1-2.2.2.2 + + + + testServer.VPN.com + SplitTunnel + IKEv2 + true + + Eap + + 25 @@ -261,178 +335,110 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - - - SplitTunnel - true - - - -

      192.168.0.0
      - 24 - - -
      10.10.0.0
      - 16 -
      - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - - - - C:\windows\system32\ping.exe - - - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - 6 - 10,20-50,100-200 - 20-50,100-200,300 - 30.30.0.0/16,10.10.10.10-20.20.20.20 - ForceTunnel - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - 3.3.3.3/32,1.1.1.1-2.2.2.2 - - - - - hrsite.corporate.contoso.com - 1.2.3.4,5.6.7.8 - 5.5.5.5 - true - - - .corp.contoso.com - 10.10.10.10,20.20.20.20 - 100.100.100.100 - - - corp.contoso.com - true - false - corp.contoso.com - contoso.com - - - HelloServer - - Helloworld.Com - - - - true - - true - This is my Eku - This is my issuer hash - - - + + + + + +
      192.168.0.0
      + 24 +
      + +
      10.10.0.0
      + 16 +
      + ``` ## Plug-in profile example - ```xml - - testserver1.contoso.com;testserver2.contoso..com - JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy - true - - -
      192.168.0.0
      - 24 -
      - -
      10.10.0.0
      - 16 -
      - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - - - - %ProgramFiles%\Internet Explorer\iexplore.exe - - 6 - 10,20-50,100-200 - 20-50,100-200,300 - 30.30.0.0/16,10.10.10.10-20.20.20.20 - - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - 3.3.3.3/32,1.1.1.1-2.2.2.2 - - - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - O:SYG:SYD:(A;;CC;;;AU) - - - - corp.contoso.com - 1.2.3.4,5.6.7.8 - 5.5.5.5 - false - - - corp.contoso.com - 10.10.10.10,20.20.20.20 - 100.100.100.100 - - - true - false - false - false - corp.contoso.com - contoso.com,test.corp.contoso.com - - - HelloServer - - Helloworld.Com - - - - - - - - - -
      + + true + false + corp.contoso.com + contoso.com,test.corp.contoso.com + false + false + + + Helloworld.Com + + HelloServer + + + + + + + + + + true + + + + + testserver1.contoso.com;testserver2.contoso..com + true + JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + + + + corp.contoso.com + 1.2.3.4,5.6.7.8 + 5.5.5.5 + false + + + corp.contoso.com + 10.10.10.10,20.20.20.20 + 100.100.100.100 + + + + + %ProgramFiles%\Internet Explorer\iexplore.exe + + 6 + 10,20-50,100-200 + 20-50,100-200,300 + 30.30.0.0/16,10.10.10.10-20.20.20.20 + + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + 3.3.3.3/32,1.1.1.1-2.2.2.2 + + + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + O:SYG:SYD:(A;;CC;;;AU) + + + + +
      192.168.0.0
      + 24 +
      + +
      10.10.0.0
      + 16 +
      + ``` - -  - -  - - - - - - diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index e4c93ad525..51a1739756 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -1,6 +1,6 @@ --- title: w4 APPLICATION CSP -description: w4 APPLICATION CSP +description: Use an APPLICATION configuration service provider (CSP) that has an APPID of w4 to configure Multimedia Messaging Service (MMS). ms.assetid: ef42b82a-1f04-49e4-8a48-bd4e439fc43a ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index eff35b4fd4..20f21f79bc 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -1,6 +1,6 @@ --- title: w7 APPLICATION CSP -description: w7 APPLICATION CSP +description: Learn that the APPLICATION configuration service provider (CSP) that has an APPID of w7 is used for bootstrapping a device with an OMA DM account. ms.assetid: 10f8aa16-5c89-455d-adcd-d7fb45d4e768 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 79992abc08..174c633ba4 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -1,6 +1,6 @@ --- title: WiFi CSP -description: WiFi CSP +description: The WiFi configuration service provider (CSP) provides the functionality to add or delete Wi-Fi networks on a Windows device. ms.assetid: f927cb5f-9555-4029-838b-03fb68937f06 ms.reviewer: manager: dansimp @@ -102,7 +102,7 @@ Added in Windows 10, version 1607. Optional. When set to true it enables Web Pr Value type is bool. **WiFiCost** -Added in Windows 10, version 1809. Optional. This policy sets the cost of WLAN connection for the Wi-Fi profile. Default behaviour: Unrestricted. +Added in Windows 10, version 1809. Optional. This policy sets the cost of WLAN connection for the Wi-Fi profile. Default behavior: Unrestricted. Supported values: diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index 2c51e50a62..8dff039754 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -1,6 +1,6 @@ --- title: WiFi DDF file -description: WiFi DDF file +description: Learn about the OMA DM device description framework (DDF) for the WiFi configuration service provider (CSP). ms.assetid: 00DE1DA7-23DE-4871-B3F0-28EB29A62D61 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/win32appinventory-csp.md b/windows/client-management/mdm/win32appinventory-csp.md index abcbb92914..f6b422ce6d 100644 --- a/windows/client-management/mdm/win32appinventory-csp.md +++ b/windows/client-management/mdm/win32appinventory-csp.md @@ -1,6 +1,6 @@ --- title: Win32AppInventory CSP -description: Win32AppInventory CSP +description: Learn how the Win32AppInventory configuration service provider (CSP) is used to provide an inventory of installed applications on a device. ms.assetid: C0DEDD51-4EAD-4F8E-AEE2-CBE9658BCA22 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/win32appinventory-ddf-file.md b/windows/client-management/mdm/win32appinventory-ddf-file.md index 8757e65d3b..1f20685d75 100644 --- a/windows/client-management/mdm/win32appinventory-ddf-file.md +++ b/windows/client-management/mdm/win32appinventory-ddf-file.md @@ -1,6 +1,6 @@ --- title: Win32AppInventory DDF file -description: Win32AppInventory DDF file +description: Learn about the OMA DM device description framework (DDF) for the Win32AppInventory configuration service provider (CSP). ms.assetid: F6BCC10B-BFE4-40AB-AEEE-34679A4E15B0 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/win32compatibilityappraiser-csp.md b/windows/client-management/mdm/win32compatibilityappraiser-csp.md index 2570e65b3d..be248b783d 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-csp.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-csp.md @@ -1,6 +1,6 @@ --- -title: Win32CompatibilityAppraiser CSP -description: +title: Win32CompatibilityAppraiser CSP +description: Learn how the Win32CompatibilityAppraiser configuration service provider enables the IT admin to query the current status of the Appraiser and UTC telementry health. ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index 2508fa2863..c68424cd04 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -1,6 +1,6 @@ --- title: WindowsAdvancedThreatProtection CSP -description: WindowsAdvancedThreatProtection CSP +description: The Windows Defender Advanced Threat Protection (WDATP) CSP allows IT Admins to onboard, determine configuration and health status, and offboard endpoints for WDATP. ms.assetid: 6C3054CA-9890-4C08-9DB6-FBEEB74699A8 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md index 583ea67e75..5877c32e22 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md @@ -1,6 +1,6 @@ --- title: WindowsAdvancedThreatProtection DDF file -description: WindowsAdvancedThreatProtection DDF file +description: Learn how the OMA DM device description framework (DDF) for the WindowsAdvancedThreatProtection configuration service provider (CSP). ms.assetid: 0C62A790-4351-48AF-89FD-7D46C42D13E0 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 7831cfbce6..6699a32617 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -1,22 +1,19 @@ --- title: WindowsDefenderApplicationGuard CSP -description: WindowsDefenderApplicationGuard CSP +description: Configure the settings in Microsoft Defender Application Guard by using the WindowsDefenderApplicationGuard configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/10/2018 +ms.date: 07/07/2020 ms.reviewer: manager: dansimp --- # WindowsDefenderApplicationGuard CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Windows Defender Application Guard. This CSP was added in Windows 10, version 1709. +The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in Microsoft Defender Application Guard. This CSP was added in Windows 10, version 1709. The following diagram shows the WindowsDefenderApplicationGuard configuration service provider in tree format. @@ -29,129 +26,277 @@ Root node. Supported operation is Get. Interior node. Supported operation is Get. **Settings/AllowWindowsDefenderApplicationGuard** -Turn on Windows Defender Application Guard in Enterprise Mode. Value type is integer. Supported operations are Add, Get, Replace, and Delete. +Turn on Microsoft Defender Application Guard in Enterprise Mode. -- 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment. -- 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container. +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +The following list shows the supported values: +- 0 - Disable Microsoft Defender Application Guard +- 1 - Enable Microsoft Defender Application Guard for Microsoft Edge ONLY +- 2 - Enable Microsoft Defender Application Guard for isolated Windows environments ONLY +- 3 - Enable Microsoft Defender Application Guard for Microsoft Edge AND isolated Windows environments **Settings/ClipboardFileType** -Determines the type of content that can be copied from the host to Application Guard environment and vice versa. Value type is integer. Supported operations are Add, Get, Replace, and Delete. +Determines the type of content that can be copied from the host to Application Guard environment and vice versa. -- 0 - Disables content copying. +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: - 1 - Allow text copying. - 2 - Allow image copying. - 3 - Allow text and image copying. -**Settings/ClipboardSettings** -This policy setting allows you to decide how the clipboard behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete + +ADMX Info: +- GP English name: *Configure Microsoft Defender Application Guard clipboard settings* +- GP name: *AppHVSIClipboardFileType* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + +**Settings/ClipboardSettings** +This policy setting allows you to decide how the clipboard behaves while in Application Guard. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: - 0 (default) - Completely turns Off the clipboard functionality for the Application Guard. -- 1 - Turns On clipboard operation from an isolated session to the host -- 2 - Turns On clipboard operation from the host to an isolated session -- 3 - Turns On clipboard operation in both the directions +- 1 - Turns On clipboard operation from an isolated session to the host. +- 2 - Turns On clipboard operation from the host to an isolated session. +- 3 - Turns On clipboard operation in both the directions. > [!IMPORTANT] > Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended. + +ADMX Info: +- GP English name: *Configure Microsoft Defender Application Guard clipboard settings* +- GP name: *AppHVSIClipboardSettings* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + **Settings/PrintingSettings** -This policy setting allows you to decide how the print functionality behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - -- 0 - Disables all print functionality (default) -- 1 - Enables only XPS printing -- 2 - Enables only PDF printing -- 3 - Enables both PDF and XPS printing -- 4 - Enables only local printing -- 5 - Enables both local and XPS printing - 6 - Enables both local and PDF printing -- 7 - Enables local, PDF, and XPS printing -- 8 - Enables only network printing -- 9 - Enables both network and XPS printing -- 10 - Enables both network and PDF printing -- 11 - Enables network, PDF, and XPS printing -- 12 - Enables both network and local printing -- 13 - Enables network, local, and XPS printing -- 14 - Enables network, local, and PDF printing -- 15 - Enables all printing - -**Settings/BlockNonEnterpriseContent** -This policy setting allows you to decide whether websites can load non-enterprise content in Microsoft Edge and Internet Explorer. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - -- 0 (default) - Non-enterprise content embedded in enterprise sites is allowed to open outside of the Windows Defender Application Guard container, directly in Internet Explorer and Microsoft Edge.. -- 1 - Non-enterprise content embedded on enterprise sites are stopped from opening in Internet Explorer or Microsoft Edge outside of Windows Defender Application Guard. - -**Settings/AllowPersistence** -This policy setting allows you to decide whether data should persist across different sessions in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - -- 0 - Application Guard discards user-downloaded files and other items (such as, cookies, Favorites, and so on) during machine restart or user log-off. -- 1 - Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions. - -**Settings/AllowVirtualGPU** -Added in Windows 10, version 1803. This policy setting allows you to determine whether Application Guard can use the virtual GPU to process graphics. Supported operations are Add, Get, Replace, and Delete. Value type is integer. - -- 0 (default) - Cannot access the vGPU and uses the CPU to support rendering graphics. When the policy is not configured, it is the same as disabled (0). -- 1 - Turns on the functionality to access the vGPU offloading graphics rendering from the CPU. This can create a faster experience when working with graphics intense websites or watching video within the container. - -**Settings/SaveFilesToHost** -Added in Windows 10, version 1803. This policy setting allows you to determine whether users can elect to download files from Edge in the container and persist files them from container to the host operating system. Supported operations are Add, Get, Replace, and Delete. Value type is integer. - -- 0 (default) - The user cannot download files from Edge in the container to the host file system. When the policy is not configured, it is the same as disabled (0). -- 1 - Turns on the functionality to allow users to download files from Edge in the container to the host file system. - -**Settings/FileTrustCriteria** -Placeholder for future use. Do not use in production code. - -**Settings/FileTrustOriginRemovableMedia** -Placeholder for future use. Do not use in production code. - -**Settings/FileTrustOriginNetworkShare** -Placeholder for future use. Do not use in production code. - -**Settings/FileTrustOriginMarkOfTheWeb** -Placeholder for future use. Do not use in production code. - -**Settings/CertificateThumbprints** -Added in Windows 10, version 1809. This policy setting allows certain Root Certificates to be shared with the Windows Defender Application Guard container. - -Value type is string. Supported operations are Add, Get, Replace, and Delete. - -If you enable this setting, certificates with a thumbprint matching the ones specified will be transferred into the container. You can specify multiple certificates using a comma to separate the thumbprints for each certificate you want to transfer. - -Example: b4e72779a8a362c860c36a6461f31e3aa7e58c14,1b1d49f06d2a697a544a1059bd59a7b058cda924 - -If you disable or don’t configure this setting, certificates are not shared with the Windows Defender Application Guard container. - -**Settings/AllowCameraMicrophoneRedirection** -Added in Windows 10, version 1809. The policy allows you to determine whether applications inside Windows Defender Application Guard can access the device’s camera and microphone when these settings are enabled on the user’s device. +This policy setting allows you to decide how the print functionality behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete. -If you enable this policy, applications inside Windows Defender Application Guard will be able to access the camera and microphone on the user’s device. +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. -If you disable or don't configure this policy, applications inside Windows Defender Application Guard will be unable to access the camera and microphone on the user’s device. +The following list shows the supported values: +- 0 (default) - Disables all print functionality. +- 1 - Enables only XPS printing. +- 2 - Enables only PDF printing. +- 3 - Enables both PDF and XPS printing. +- 4 - Enables only local printing. +- 5 - Enables both local and XPS printing. +- 6 - Enables both local and PDF printing. +- 7 - Enables local, PDF, and XPS printing. +- 8 - Enables only network printing. +- 9 - Enables both network and XPS printing. +- 10 - Enables both network and PDF printing. +- 11 - Enables network, PDF, and XPS printing. +- 12 - Enables both network and local printing. +- 13 - Enables network, local, and XPS printing. +- 14 - Enables network, local, and PDF printing. +- 15 - Enables all printing. + + +ADMX Info: +- GP English name: *Configure Microsoft Defender Application Guard print settings* +- GP name: *AppHVSIPrintingSettings* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/BlockNonEnterpriseContent** +This policy setting allows you to decide whether websites can load non-enterprise content in Microsoft Edge and Internet Explorer. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: +- 0 (default) - Non-enterprise content embedded in enterprise sites is allowed to open outside of the Microsoft Defender Application Guard container, directly in Internet Explorer and Microsoft Edge. +- 1 - Non-enterprise content embedded on enterprise sites are stopped from opening in Internet Explorer or Microsoft Edge outside of Microsoft Defender Application Guard. + +> [!NOTE] +> This policy setting is no longer supported in the new Microsoft Edge browser. The policy will be deprecated and removed in a future release. Webpages that contain mixed content, both enterprise and non-enterprise, may load incorrectly or fail completely if this feature is enabled. + + +ADMX Info: +- GP English name: *Prevent enterprise websites from loading non-enterprise content in Microsoft Edge and Internet Explorer* +- GP name: *BlockNonEnterpriseContent* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/AllowPersistence** +This policy setting allows you to decide whether data should persist across different sessions in Application Guard. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: +- 0 - Application Guard discards user-downloaded files and other items (such as, cookies, Favorites, and so on) during machine restart or user log-off. +- 1 - Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions. + + +ADMX Info: +- GP English name: *Allow data persistence for Microsoft Defender Application Guard* +- GP name: *AllowPersistence* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/AllowVirtualGPU** +Added in Windows 10, version 1803. This policy setting allows you to determine whether Application Guard can use the virtual Graphics Processing Unit (GPU) to process graphics. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +If you enable this setting, Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If you enable this setting without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering. + +The following list shows the supported values: +- 0 (default) - Cannot access the vGPU and uses the CPU to support rendering graphics. When the policy is not configured, it is the same as disabled (0). +- 1 - Turns on the functionality to access the vGPU offloading graphics rendering from the CPU. This can create a faster experience when working with graphics intense websites or watching video within the container. + +> [!WARNING] +> Enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device. + + +ADMX Info: +- GP English name: *Allow hardware-accelerated rendering for Microsoft Defender Application Guard* +- GP name: *AllowVirtualGPU* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/SaveFilesToHost** +Added in Windows 10, version 1803. This policy setting allows you to determine whether users can elect to download files from Edge in the container and persist files them from container to the host operating system. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: +- 0 (default) - The user cannot download files from Edge in the container to the host file system. When the policy is not configured, it is the same as disabled (0). +- 1 - Turns on the functionality to allow users to download files from Edge in the container to the host file system. + + +ADMX Info: +- GP English name: *Allow files to download and save to the host operating system from Microsoft Defender Application Guard* +- GP name: *SaveFilesToHost* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/CertificateThumbprints** +Added in Windows 10, version 1809. This policy setting allows certain device level Root Certificates to be shared with the Microsoft Defender Application Guard container. + +Value type is string. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +If you enable this setting, certificates with a thumbprint matching the ones specified will be transferred into the container. Multiple certificates can be specified by using a comma to separate the thumbprints for each certificate you want to transfer. + +Here's an example: +b4e72779a8a362c860c36a6461f31e3aa7e58c14,1b1d49f06d2a697a544a1059bd59a7b058cda924 + +If you disable or don’t configure this setting, certificates are not shared with the Microsoft Defender Application Guard container. + + +ADMX Info: +- GP English name: *Allow Microsoft Defender Application Guard to use Root Certificate Authorities from the user's device* +- GP name: *CertificateThumbprints* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + + +**Settings/AllowCameraMicrophoneRedirection** +Added in Windows 10, version 1809. This policy setting allows you to determine whether applications inside Microsoft Defender Application Guard can access the device’s camera and microphone when these settings are enabled on the user’s device. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Microsoft Edge on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +If you enable this policy setting, applications inside Microsoft Defender Application Guard will be able to access the camera and microphone on the user’s device. + +If you disable or don't configure this policy setting, applications inside Microsoft Defender Application Guard will be unable to access the camera and microphone on the user’s device. + +The following list shows the supported values: +- 0 (default) - Microsoft Defender Application Guard cannot access the device’s camera and microphone. When the policy is not configured, it is the same as disabled (0). +- 1 - Turns on the functionality to allow Microsoft Defender Application Guard to access the device’s camera and microphone. > [!IMPORTANT] -> If you turn on this policy, a compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge. To prevent unauthorized access, we recommend that camera and microphone privacy settings be turned off on the user's device when they are not needed. +> If you turn on this policy setting, a compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge. To prevent unauthorized access, we recommend that camera and microphone privacy settings be turned off on the user's device when they are not needed. + + +ADMX Info: +- GP English name: *Allow camera and microphone access in Microsoft Defender Application Guard* +- GP name: *AllowCameraMicrophoneRedirection* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + **Status** -Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device. Value type is integer. Supported operation is Get. +Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device. -- Bit 0 - Set to 1 when WDAG is enabled into enterprise manage mode -- Bit 1 - Set to 1 when the client machine is Hyper-V capable -- Bit 2 - Set to 1 when the client machine has a valid OS license and SKU -- Bit 3 - Set to 1 when WDAG installed on the client machine -- Bit 4 - Set to 1 when required Network Isolation Policies are configured -- Bit 5 - Set to 1 when the client machine meets minimum hardware requirements +Value type is integer. Supported operation is Get. + +- Bit 0 - Set to 1 when Application Guard is enabled into enterprise manage mode. +- Bit 1 - Set to 1 when the client machine is Hyper-V capable. +- Bit 2 - Set to 1 when the client machine has a valid OS license and SKU. +- Bit 3 - Set to 1 when Application Guard installed on the client machine. +- Bit 4 - Set to 1 when required Network Isolation Policies are configured. +- Bit 5 - Set to 1 when the client machine meets minimum hardware requirements. +- Bit 6 - Set to 1 when system reboot is required. + +**PlatformStatus** +Returns bitmask that indicates status of Application Guard platform installation and prerequisites on the device. + +Value type is integer. Supported operation is Get. + +- Bit 0 - Set to 1 when Application Guard is enabled into enterprise manage mode. +- Bit 1 - Set to 1 when the client machine is Hyper-V capable. +- Bit 2 - Reserved for Microsoft. +- Bit 3 - Set to 1 when Application Guard is installed on the client machine. +- Bit 4 - Reserved for Microsoft. +- Bit 5 - Set to 1 when the client machine meets minimum hardware requirements. **InstallWindowsDefenderApplicationGuard** -Initiates remote installation of Application Guard feature. Supported operations are Get and Execute. +Initiates remote installation of Application Guard feature. -- Install - Will initiate feature install -- Uninstall - Will initiate feature uninstall +Supported operations are Get and Execute. + +The following list shows the supported values: +- Install - Will initiate feature install. +- Uninstall - Will initiate feature uninstall. **Audit** -Interior node. Supported operation is Get +Interior node. Supported operation is Get. **Audit/AuditApplicationGuard** -This policy setting allows you to decide whether auditing events can be collected from Application Guard. Value type in integer. Supported operations are Add, Get, Replace, and Delete. +This policy setting allows you to decide whether auditing events can be collected from Application Guard. -- 0 (default) - - Audit event logs aren't collected for Application Guard. -- 1 - Application Guard inherits its auditing policies from Microsoft Edge and starts to audit system events specifically for Application Guard. +Value type in integer. Supported operations are Add, Get, Replace, and Delete. + +This policy setting is supported on Windows 10 Enterprise or Windows 10 Education with Microsoft Defender Application Guard in Enterprise mode. + +The following list shows the supported values: +- 0 (default) - Audit event logs aren't collected for Application Guard. +- 1 - Application Guard inherits its auditing policies from system and starts to audit security events for Application Guard container. + + +ADMX Info: +- GP English name: *Allow auditing events in Microsoft Defender Application Guard* +- GP name: *AuditApplicationGuard* +- GP path: *Windows Components/Microsoft Defender Application Guard* +- GP ADMX file name: *AppHVSI.admx* + diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index 6b319f1404..847d9d69c8 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -1,6 +1,6 @@ --- title: WindowsDefenderApplicationGuard DDF file -description: WindowsDefenderApplicationGuard DDF file +description: learn about the OMA DM device description framework (DDF) for the WindowsDefenderApplicationGuard DDF file configuration service provider (CSP). ms.author: dansimp ms.topic: article ms.prod: w10 diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index 58a5040b72..b46f76e935 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -1,6 +1,6 @@ --- title: WindowsLicensing CSP -description: WindowsLicensing CSP +description: Learn how the WindowsLicensing configuration service provider (CSP) is designed for licensing related management scenarios. ms.assetid: E6BC6B0D-1F16-48A5-9AC4-76D69A7EDDA6 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index c5037971d9..7b8cb3437e 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -1,6 +1,6 @@ --- title: WindowsLicensing DDF file -description: WindowsLicensing DDF file +description: Learn about the OMA DM device description framework (DDF) for the WindowsLicensing configuration service provider (CSP). ms.assetid: 2A24C922-A167-4CEE-8F74-08E7453800D2 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/wirednetwork-csp.md b/windows/client-management/mdm/wirednetwork-csp.md index 92f6496c2d..d4f5426134 100644 --- a/windows/client-management/mdm/wirednetwork-csp.md +++ b/windows/client-management/mdm/wirednetwork-csp.md @@ -34,3 +34,23 @@ Supported operations are Add, Get, Replace, and Delete. Value type is string. Optional. Enable block period (minutes), used to specify the duration for which automatic authentication attempts will be blocked from occurring after a failed authentication attempt. Supported operations are Add, Get, Replace, and Delete. Value type is integer. + +The following example shows how to add a wired network profile: +```xml + + + + 1 + + + ./Device/Vendor/MSFT/WiredNetwork/LanXML + + + chr + + falsetrue2500025falsetruefalse26falsefalsefalsetruefalsetrue + + + + +``` diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index 914c39c364..206aa9dbc0 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -1,6 +1,6 @@ --- title: WMI providers supported in Windows 10 -description: WMI providers supported in Windows 10 +description: Manage settings and applications on devices that subscribe to the Mobile Device Management (MDM) service with Windows Management Infrastructure (WMI). MS-HAID: - 'p\_phdevicemgmt.wmi\_providers\_supported\_in\_windows\_10\_technical\_preview' - 'p\_phDeviceMgmt.wmi\_providers\_supported\_in\_windows' diff --git a/windows/client-management/media/image1.png b/windows/client-management/media/image1.png new file mode 100644 index 0000000000..1f6394616a Binary files /dev/null and b/windows/client-management/media/image1.png differ diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index da5cc3e5c8..239c1f1379 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -1,11 +1,11 @@ --- title: New policies for Windows 10 (Windows 10) -description: Windows 10 includes the following new policies for management. +description: Learn how Windows 10 includes new policies for management, like Group Policy settings for the Windows system and components. ms.assetid: 1F24ABD8-A57A-45EA-BA54-2DA2238C573D ms.reviewer: manager: dansimp ms.author: dansimp -keywords: ["MDM", "Group Policy"] +keywords: ["MDM", "Group Policy", "GP"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -21,10 +21,40 @@ ms.topic: reference **Applies to** - Windows 10 -- Windows 10 Mobile -Windows 10 includes the following new policies for management. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://www.microsoft.com/download/100591). +As of September 2020 This page will no longer be updated. To find the Group Polices that ship in each version of Windows, refer to the Group Policy Settings Reference Spreadsheet. You can always locate the most recent version of the Spreadsheet by searching the Internet for "Windows Version + Group Policy Settings Reference". +For example, searching for "Windows 2004" + "Group Policy Settings Reference Spreadsheet" in a web browser will return to you the link to download the Group Policy Settings Reference Spreadsheet for Windows 2004. + +The latest [group policy reference for Windows 10 version 2004 is available here](https://www.microsoft.com/download/101451). + +## New Group Policy settings in Windows 10, version 1903 + +The following Group Policy settings were added in Windows 10, version 1903: + +**System** + +- System\Service Control Manager Settings\Security Settings\Enable svchost.exe mitigation options +- System\Storage Sense\Allow Storage Sense +- System\Storage Sense\Allow Storage Sense Temporary Files cleanup +- System\Storage Sense\Configure Storage Sense +- System\Storage Sense\Configure Storage Sense Cloud content dehydration threshold +- System\Storage Sense\Configure Storage Sense Recycle Bin cleanup threshold +- System\Storage Sense\Configure Storage Sense Downloads cleanup threshold +- System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool\Troubleshooting:Allow users to access recommended troubleshooting for known problems + + +**Windows Components** + +- Windows Components\App Privacy\Let Windows apps activate with voice +- Windows Components\App Privacy\Let Windows apps activate with voice while the system is locked +- Windows Components\Data Collection and Preview Builds\Allow commercial data pipeline +- Windows Components\Data Collection and Preview Builds\Configure collection of browsing data for Desktop Analytics +- Windows Components\Data Collection and Preview Builds\Configure diagnostic data upload endpoint for Desktop Analytics +- Windows Components\Delivery Optimization\Delay background download Cache Server fallback (in seconds) +- Windows Components\Delivery Optimization\Delay Foreground download Cache Server fallback (in seconds) +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use WDDM graphics display driver for Remote Desktop Connections +- Windows Components\Windows Logon Options\Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot ## New Group Policy settings in Windows 10, version 1809 @@ -148,8 +178,8 @@ The following Group Policy settings were added in Windows 10, version 1809: - Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Remove remote desktop wallpaper - Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions - Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions -- Windows Components\Windows Defender Antivirus\Configure detection for potentially unwanted applications -- Windows Components\Windows Defender Antivirus\Scan\Configure low CPU priority for scheduled scans +- Windows Components\Microsoft Defender Antivirus\Configure detection for potentially unwanted applications +- Windows Components\Microsoft Defender Antivirus\Scan\Configure low CPU priority for scheduled scans - Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard - Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard - Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user’s device @@ -291,12 +321,12 @@ The following Group Policy settings were added in Windows 10, version 1709: - Windows Components\Search\Allow Cloud Search - Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard - Windows Components\Windows Defender Application Guard\Allow auditing events in Windows Defender Application Guard -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Network Protection\Prevent users and apps from accessing dangerous websites -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure Controlled folder access -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction rules -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Exclude files and paths from Attack Surface Reduction Rules -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure allowed applications -- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure protected folders +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Network Protection\Prevent users and apps from accessing dangerous websites +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure Controlled folder access +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction rules +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Exclude files and paths from Attack Surface Reduction Rules +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure allowed applications +- Windows Components\Microsoft Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure protected folders - Windows Components\Windows Defender Exploit Guard\Exploit Protection\Use a common set of exploit protection settings - Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Virus and threat protection area - Windows Components\Windows Defender Security Center\Firewall and network protection\Hide the Firewall and network protection area @@ -431,9 +461,9 @@ The following Group Policy settings were added in Windows 10, version 1703: - Windows Components\Smart Card\Turn on certificate propagation from smart card - Windows Components\Tablet PC\Pen UX Behaviors\Prevent flicks - Windows Components\BitLocker Drive Encryption\Choose drive encryption method and cipher strength (Windows 8, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows 10 [Version 1507]) -- Windows Components\Windows Defender Antivirus\Real-time Protection\Turn on behavior monitoring -- Windows Components\Windows Defender Antivirus\Signature Updates\Define file shares for downloading definition updates -- Windows Components\Windows Defender Antivirus\Signature Updates\Turn on scan after signature update +- Windows Components\Microsoft Defender Antivirus\Real-time Protection\Turn on behavior monitoring +- Windows Components\Microsoft Defender Antivirus\Signature Updates\Define file shares for downloading definition updates +- Windows Components\Microsoft Defender Antivirus\Signature Updates\Turn on scan after signature update - Windows Components\File Explorer\Display confirmation dialog when deleting files - Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone\Allow OpenSearch queries in File Explorer - Windows Components\Windows Update\Remove access to use all Windows Update features @@ -496,4 +526,3 @@ No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId= - diff --git a/windows/client-management/quick-assist.md b/windows/client-management/quick-assist.md new file mode 100644 index 0000000000..6a50151342 --- /dev/null +++ b/windows/client-management/quick-assist.md @@ -0,0 +1,121 @@ +--- +title: Use Quick Assist to help users +description: How IT Pros can use Quick Assist to help users +ms.prod: w10 +ms.sitesec: library +ms.topic: article +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +--- + +# Use Quick Assist to help users + +Quick Assist is a Windows 10 application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user’s device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. + +## Before you begin + +All that's required to use Quick Assist is suitable network and internet connectivity. No particular roles, permissions, or policies are involved. Neither party needs to be in a domain. The helper must have a Microsoft account. The sharer doesn’t have to authenticate. + +### Authentication + +The helper can authenticate when they sign in by using a Microsoft Account (MSA) or Azure Active Directory. Local Active Directory authentication is not supported at this time. + +### Network considerations + +Quick Assist communicates over port 443 (https) and connects to the Remote Assistance Service at `https://remoteassistance.support.services.microsoft.com` by using the Remote Desktop Protocol (RDP). The traffic is encrypted with TLS 1.2. + +Both the helper and sharer must be able to reach these endpoints over port 443: + +| Domain/Name | Description | +|-----------------------------------|-------------------------------------------------------| +| \*.support.services.microsoft.com | Primary endpoint used for Quick Assist application | +| \*.resources.lync.com | Required for the Skype framework used by Quick Assist | +| \*.infra.lync.com | Required for the Skype framework used by Quick Assist | +| \*.latest-swx.cdn.skype.com | Required for the Skype framework used by Quick Assist | +| \*.login.microsoftonline.com | Required for logging in to the application (MSA) | +| \*.channelwebsdks.azureedge.net | Used for chat services within Quick Assist | +| \*.aria.microsoft.com | Used for accessibility features within the app | +| \*.api.support.microsoft.com | API access for Quick Assist | +| \*.vortex.data.microsoft.com | Used for diagnostic data | +| \*.channelservices.microsoft.com | Required for chat services within Quick Assist | + +## How it works + +1. Both the helper and the sharer start Quick Assist. + +2. The helper selects **Assist another person**. Quick Assist on the helper's side contacts the Remote Assistance Service to obtain a session code. An RCC chat session is established and the helper's Quick Assist instance joins it. The helper then provides the code to the sharer. + +3. After the sharer enters the code in their Quick Assist app, Quick Assist uses that code to contact the Remote Assistance Service and join that specific session. The sharer's Quick Assist instance joins the RCC chat session. + +4. The helper is prompted to select **View Only** or **Full Control**. + +5. The sharer is prompted to confirm allowing the helper to share their desktop with the helper. + +6. Quick Assist starts RDP control and connects to the RDP Relay service. + +7. RDP shares the video to the helper over https (port 443) through the RDP relay service to the helper's RDP control. Input is shared from the helper to the sharer through the RDP relay service. + +:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established"::: + +### Data and privacy + +Microsoft logs a small amount of session data to monitor the health of the Quick Assist system. This data includes the following information: + +- Start and end time of the session + +- Errors arising from Quick Assist itself, such as unexpected disconnections + +- Features used inside the app such as view only, annotation, and session pause + +No logs are created on either the helper’s or sharer’s device. Microsoft cannot access a session or view any actions or keystrokes that occur in the session. + +The sharer sees only an abbreviated version of the helper’s name (first name, last initial) and no other information about them. Microsoft does not store any data about either the sharer or the helper for longer than three days. + +In some scenarios, the helper does require the sharer to respond to application permission prompts (User Account Control), but otherwise the helper has the same permissions as the sharer on the device. + +## Working with Quick Assist + +Either the support staff or a user can start a Quick Assist session. + + +1. Support staff (“helper”) starts Quick Assist in any of a few ways: + + - Type *Quick Assist* in the search box and press ENTER. + - From the Start menu, select **Windows Accessories**, and then select **Quick Assist**. + - Type CTRL+Windows+Q + +2. In the **Give assistance** section, helper selects **Assist another person**. The helper might be asked to choose their account or sign in. Quick Assist generates a time-limited security code. + +3. Helper shares the security code with the user over the phone or with a messaging system. + +4. Quick Assist opens on the sharer’s device. The user enters the provided code in the **Code from assistant** box, and then selects **Share screen**. + +5. The helper receives a dialog offering the opportunity to take full control of the device or just view its screen. After choosing, the helper selects **Continue**. + +6. The sharer receives a dialog asking for permission to show their screen or allow access. The sharer gives permission by selecting the **Allow** button. + +## If Quick Assist is missing + +If for some reason a user doesn't have Quick Assist on their system or it's not working properly, they might need to uninstall and reinstall it. + +### Uninstall Quick Assist + +1. Start the Settings app, and then select **Apps**. +2. Select **Optional features**. +3. In the **Installed features** search bar, type *Quick Assist*. +4. Select **Microsoft Quick Assist**, and then select **Uninstall**. + +### Reinstall Quick Assist + +1. Start the Settings app, and then select **Apps**. +2. Select **Optional features**. +3. Select **Add a feature**. +4. In the new dialog that opens, in the **Add an optional feature** search bar, type *Quick Assist*. +5. Select the check box for **Microsoft Quick Assist**, and then select **Install**. +6. Restart the device. + +## Next steps + +If you have any problems, questions, or suggestions for Quick Assist, contact us by using the [Feedback Hub app](https://www.microsoft.com/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0&rtc=1#activetab=pivot:overviewtab). diff --git a/windows/client-management/system-failure-recovery-options.md b/windows/client-management/system-failure-recovery-options.md index 28f7edaab0..4f7a2555e1 100644 --- a/windows/client-management/system-failure-recovery-options.md +++ b/windows/client-management/system-failure-recovery-options.md @@ -1,6 +1,6 @@ --- title: Configure system failure and recovery options in Windows -description: Learn about the system failure and recovery options in Windows. +description: Learn how to configure the actions that Windows takes when a system error occurs and what the recovery options are. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting @@ -8,8 +8,8 @@ author: Deland-Han ms.localizationpriority: medium ms.author: delhan ms.date: 8/22/2019 -ms.reviewer: -manager: dcscontentpm +ms.reviewer: dcscontentpm +manager: dansimp --- # Configure system failure and recovery options in Windows diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index 3acffc551f..bdb67e2528 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -1,6 +1,6 @@ --- title: Advanced advice for Stop error 7B, Inaccessible_Boot_Device -description: Learn how to troubleshoot Stop error 7B or Inaccessible_Boot_Device +description: Learn how to troubleshoot Stop error 7B or Inaccessible_Boot_Device. This error might occur after some changes are made to the computer, ms.prod: w10 ms.mktglfcycl: ms.sitesec: library @@ -15,27 +15,27 @@ manager: dansimp # Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device -This article provides steps to troubleshoot **Stop error 7B: Inaccessible_Boot_Device**. This error may occur after some changes are made to the computer, or immediately after you deploy Windows on the computer. +This article provides steps to troubleshoot **Stop error 7B: Inaccessible_Boot_Device**. This error might occur after some changes are made to the computer, or immediately after you deploy Windows on the computer. ## Causes of the Inaccessible_Boot_Device Stop error -Any one of the following factors may cause the stop error: +Any one of the following factors might cause the stop error: -* Missing, corrupted, or misbehaving filter drivers that are related to the storage stack +* Missing, corrupted, or misbehaving filter drivers that are related to the storage stack -* File system corruption +* File system corruption -* Changes to the storage controller mode or settings in the BIOS +* Changes to the storage controller mode or settings in the BIOS -* Using a different storage controller than the one that was used when Windows was installed +* Using a different storage controller than the one that was used when Windows was installed -* Moving the hard disk to a different computer that has a different controller +* Moving the hard disk to a different computer that has a different controller -* A faulty motherboard or storage controller, or faulty hardware +* A faulty motherboard or storage controller, or faulty hardware -* In unusual cases: the failure of the TrustedInstaller service to commit newly installed updates because of Component Based Store corruptions +* In unusual cases, the failure of the TrustedInstaller service to commit newly installed updates is because of component-based store corruptions -* Corrupted files in the **Boot** partition (for example, corruption in the volume that is labeled **SYSTEM** when you run the `diskpart` > `list vol` command) +* Corrupted files in the **Boot** partition (for example, corruption in the volume that's labeled **SYSTEM** when you run the `diskpart` > `list vol` command) ## Troubleshoot this error @@ -43,9 +43,9 @@ Start the computer in [Windows Recovery Mode (WinRE)](https://docs.microsoft.com 1. Start the system by using [the installation media for the installed version of Windows](https://support.microsoft.com/help/15088). -2. On the **Install Windows** screen, select **Next** > **Repair your computer** . +2. On the **Install Windows** screen, select **Next** > **Repair your computer**. -3. On the **System Recovery Options** screen, select **Next** > **Command Prompt** . +3. On the **System Recovery Options** screen, select **Next** > **Command Prompt**. ### Verify that the boot disk is connected and accessible @@ -55,7 +55,7 @@ Start the computer in [Windows Recovery Mode (WinRE)](https://docs.microsoft.com A list of the physical disks that are attached to the computer should be displayed and resemble the following display: -``` +```console Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- @@ -65,7 +65,7 @@ A list of the physical disks that are attached to the computer should be display If the computer uses a Unified Extensible Firmware Interface (UEFI) startup interface, there will be an asterisk () in the **GPT* column. -If the computer uses a basic input/output system (BIOS) interface, there will not be an asterisk in the **Dyn** column. +If the computer uses a basic input/output system (BIOS) interface, there won't be an asterisk in the **Dyn** column. #### Step 2 @@ -73,7 +73,7 @@ If the `list disk` command lists the OS disks correctly, run the `list vol` comm `list vol` generates an output that resembles the following display: -``` +```console Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- @@ -86,7 +86,7 @@ If the `list disk` command lists the OS disks correctly, run the `list vol` comm ``` >[!NOTE] ->If the disk that contains the OS is not listed in the output, you will have to engage the OEM or virtualization manufacturer. +>If the disk that contains the OS isn't listed in the output, you'll have to engage the OEM or virtualization manufacturer. ### Verify the integrity of Boot Configuration Database @@ -94,57 +94,57 @@ Check whether the Boot Configuration Database (BCD) has all the correct entries. To verify the BCD entries: -1. Examine the **Windows Boot Manager** section that has the **{bootmgr}** identifier. Make sure that the **device** and **path** entries point to the correct device and boot loader file. +1. Examine the **Windows Boot Manager** section that has the **{bootmgr}** identifier. Make sure that the **device** and **path** entries point to the correct device and boot loader file. - An example output if the computer is UEFI-based: + If the computer is UEFI-based, here's example output: - ``` + ```cmd device partition=\Device\HarddiskVolume2 path \EFI\Microsoft\Boot\bootmgfw.efi ``` - An example output if the machine is BIOS based: - ``` + If the machine is BIOS-based, here's example output: + ```cmd Device partition=C: ``` >[!NOTE] - >This output may not contain a path. + >This output might not contain a path. -2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device** , **path** , **osdevice,** and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder. +2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device**, **path**, **osdevice**, and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder. - >[!NOTE] - >If the computer is UEFI-based, the **bootmgr** and **winload** entires under **{default}** will contain an **.efi** extension. + > [!NOTE] + > If the computer is UEFI-based, the file path value that's specified in the **path** parameter of **{bootmgr}** and **{default}** contains an **.efi** extension. ![bcdedit](images/screenshot1.png) -If any of the information is wrong or missing, we recommend that you create a backup of the BCD store. To do this, run `bcdedit /export C:\temp\bcdbackup`. This command creates a backup in **C:\\temp\\** that is named **bcdbackup** . To restore the backup, run `bcdedit /import C:\temp\bcdbackup`. This command overwrites all BCD settings by using the settings in **bcdbackup** . +If any of the information is wrong or missing, we recommend that you create a backup of the BCD store. To do this, run `bcdedit /export C:\temp\bcdbackup`. This command creates a backup in **C:\\temp\\** that's named **bcdbackup**. To restore the backup, run `bcdedit /import C:\temp\bcdbackup`. This command overwrites all BCD settings by using the settings in **bcdbackup**. -After the backup is completed, run the following command to make the changes: +After the backup completes, run the following command to make the changes:
      bcdedit /set *{identifier}* option value
      -For example, if the device under {default} is wrong or missing, run the following command to set it: `bcdedit /set {default} device partition=C:` +For example, if the device under {default} is wrong or missing, run this command to set it: `bcdedit /set {default} device partition=C:` - If you want to re-create the BCD completely, or if you get a message that states that "**The boot configuration data store could not be opened. The system could not find the file specified,** " run `bootrec /rebuildbcd`. + If you want to completely re-create the BCD, or if you get a message that states that "**The boot configuration data store could not be opened. The system could not find the file specified,** " run `bootrec /rebuildbcd`. -If the BCD has the correct entries, check whether the **winload** and **bootmgr** entries exist in the correct location per the path that is specified in the **bcdedit** command. By default, **bootmgr** in the BIOS partition will be in the root of the **SYSTEM** partition. To see the file, run `Attrib -s -h -r`. +If the BCD has the correct entries, check whether the **winload** and **bootmgr** entries exist in the correct location, which is in the specified path in the **bcdedit** command. By default, **bootmgr** in the BIOS partition is in the root of the **SYSTEM** partition. To see the file, run `Attrib -s -h -r`. If the files are missing, and you want to rebuild the boot files, follow these steps: -1. Copy all the contents under the **SYSTEM** partition to another location. Alternatively, you can use the command prompt to navigate to the OS drive, create a new folder, and then copy all the files and folders from the **SYSTEM** volume, as follows: +1. Copy all the contents under the **SYSTEM** partition to another location. Alternatively, you can use the command prompt to navigate to the OS drive, create a new folder, and then copy all the files and folders from the **SYSTEM** volume, like shown here: -``` -D:\> Mkdir BootBackup -R:\> Copy *.* D:\BootBackup -``` + ```cmd + D:\> Mkdir BootBackup + R:\> Copy *.* D:\BootBackup + ``` -2. If you are using Windows 10, or if you are troubleshooting by using a Windows 10 ISO at the Windows Pre-Installation Environment command prompt, you can use the **bcdboot** command to re-create the boot files, as follows: +2. If you're using Windows 10, or if you're troubleshooting by using a Windows 10 ISO at the Windows Pre-Installation Environment command prompt, you can use the **bcdboot** command to re-create the boot files, like shown here: ```cmd Bcdboot <**OSDrive* >:\windows /s <**SYSTEMdrive* >: /f ALL ``` - For example: if we assign the `` (WinRE drive) the letter R and the `` is the letter D, this command would be the following: + For example, if we assign the `` (WinRE drive) the letter R and the `` is the letter D, the following is the command that we would use: ```cmd Bcdboot D:\windows /s R: /f ALL @@ -153,13 +153,13 @@ R:\> Copy *.* D:\BootBackup >[!NOTE] >The **ALL** part of the **bcdboot** command writes all the boot files (both UEFI and BIOS) to their respective locations. -If you do not have a Windows 10 ISO, you must format the partition and copy **bootmgr** from another working computer that has a similar Windows build. To do this, follow these steps: +If you don't have a Windows 10 ISO, format the partition and copy **bootmgr** from another working computer that has a similar Windows build. To do this, follow these steps: -1. Start **Notepad** . +1. Start **Notepad**. 2. Press Ctrl+O. -3. Navigate to the system partition (in this example, it is R). +3. Navigate to the system partition (in this example, it's R). 4. Right-click the partition, and then format it. @@ -171,7 +171,7 @@ Run the following command to verify the Windows update installation and dates: Dism /Image:: /Get-packages ``` -After you run this command, you will see the **Install pending** and **Uninstall Pending** packages: +After you run this command, you'll see the **Install pending** and **Uninstall Pending** packages: ![Dism output](images/pendingupdate.png) @@ -179,27 +179,27 @@ After you run this command, you will see the **Install pending** and **Uninstall ![Dism output](images/revertpending.png) -2. Navigate to ***OSdriveLetter* :\Windows\WinSxS** , and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. +2. Navigate to ***OSdriveLetter*:\Windows\WinSxS**, and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. -3. To revert the registry changes, type **regedit** at the command prompt to open **Registry Editor**. +3. To revert the registry changes, type **regedit** at the command prompt to open **Registry Editor**. 4. Select **HKEY_LOCAL_MACHINE**, and then go to **File** > **Load Hive**. -5. Navigate to **OSdriveLetter:\Windows\System32\config**, select the file that is named **COMPONENT** (with no extension), and then select **Open**. When you are prompted, enter the name **OfflineComponentHive** for the new hive +5. Navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **COMPONENT** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineComponentHive** for the new hive. ![Load Hive](images/loadhive.png) 6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. -7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. +7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. ![Unload Hive](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) -8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter* :\Windows\System32\config**, select the file that is named **SYSTEM** (with no extension), and then select **Open** . When you are prompted, enter the name **OfflineSystemHive** for the new hive. +8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **SYSTEM** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineSystemHive** for the new hive. 9. Expand **HKEY_LOCAL_MACHINE\OfflineSystemHive**, and then select the **Select** key. Check the data for the **Default** value. -10. If the data in **HKEY_LOCAL_MACHINE\OfflineSystemHive\Select\Default** is **1** , expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001**. If it is **2**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet002**, and so on. +10. If the data in **HKEY_LOCAL_MACHINE\OfflineSystemHive\Select\Default** is **1**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001**. If it's **2**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet002**, and so on. 11. Expand **Control\Session Manager**. Check whether the **PendingFileRenameOperations** key exists. If it does, back up the **SessionManager** key, and then delete the **PendingFileRenameOperations** key. @@ -207,7 +207,7 @@ After you run this command, you will see the **Install pending** and **Uninstall #### Check services -1. Follow steps 1-10 in the "Troubleshooting if this issue occurs after an Windows Update installation" section. (Step 11 does not apply to this procedure.) +1. Follow steps 1-10 in the "Troubleshooting if this issue occurs after a Windows Update installation" section. (Step 11 doesn't apply to this procedure.) 2. Expand **Services**. @@ -225,9 +225,9 @@ After you run this command, you will see the **Install pending** and **Uninstall * VOLUME -If these keys exist, check each one to make sure that it has a value that is named **Start** and that it is set to **0**. If not, set the value to **0**. +If these keys exist, check each one to make sure that it has a value that's named **Start**, and that it's set to **0**. If it's not, set the value to **0**. -If any of these keys do not exist, you can try to replace the current registry hive by using the hive from **RegBack**. To do this, run the following commands: +If any of these keys don't exist, you can try to replace the current registry hive by using the hive from **RegBack**. To do this, run the following commands: ```cmd cd OSdrive:\Windows\System32\config @@ -237,7 +237,7 @@ copy OSdrive:\Windows\System32\config\RegBack\SYSTEM OSdrive:\Windows\System32\c #### Check upper and lower filter drivers -Check whether there are any non-Microsoft upper and lower filter drivers on the computer and that they do not exist on another, similar working computer. if they do exist, remove the upper and lower filter drivers: +Check whether there are any non-Microsoft upper and lower filter drivers on the computer and that they don't exist on another, similar working computer. If they do exist, remove the upper and lower filter drivers: 1. Expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001\Control**. @@ -245,8 +245,8 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the >[!NOTE] >These filters are mainly related to storage. After you expand the **Control** key in the registry, you can search for **UpperFilters** and **LowerFilters**. - - The following are some of the different registry entries in which you may find these filter drivers. These entries are located under **ControlSet** and are designated as **Default** : + + You might find these filter drivers in some of the following registry entries. These entries are under **ControlSet** and are designated as **Default**: \Control\Class\\{4D36E96A-E325-11CE-BFC1-08002BE10318} @@ -258,19 +258,19 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the ![Registry](images/controlset.png) -If an **UpperFilters** or **LowerFilters** entry is non-standard (for example, it is not a Windows default filter driver, such as PartMgr), remove the entry by double-clicking it in the right pane, and then deleting only that value. +If an **UpperFilters** or **LowerFilters** entry is non-standard (for example, it's not a Windows default filter driver, such as PartMgr), remove the entry. To remove it, double-click it in the right pane, and then delete only that value. >[!NOTE] >There could be multiple entries. -The reason that these entries may affect us is because there may be an entry in the **Services** branch that has a START type set to 0 or 1 (indicating that it is loaded at the Boot or Automatic part of the boot process). Also, either the file that is referred to is missing or corrupted, or it may be named differently than what is listed in the entry. +These entries might affect us because there might be an entry in the **Services** branch that has a START type set to 0 or 1, which means that it's loaded at the Boot or Automatic part of the boot process. Also, either the file that's referred to is missing or corrupted, or it might be named differently than what's listed in the entry. >[!NOTE] ->If there actually is a service that is set to **0** or **1** that corresponds to an **UpperFilters** or **LowerFilters** entry, setting the service to disabled in the **Services** registry (as discussed in steps 2 and 3 of the Check services section) without removing the **Filter Driver** entry causes the computer to crash and generate a 0x7b Stop error. +>If there's a service that's set to **0** or **1** that corresponds to an **UpperFilters** or **LowerFilters** entry, setting the service to disabled in the **Services** registry (as discussed in steps 2 and 3 of the Check services section) without removing the **Filter Driver** entry causes the computer to crash and generate a 0x7b Stop error. ### Running SFC and Chkdsk - If the computer still does not start, you can try to run a **chkdisk** process on the system drive, and also run System File Checker. To do this, run the following commands at a WinRE command prompt: + If the computer still doesn't start, you can try to run a **chkdisk** process on the system drive, and then also run System File Checker. To do this, run the following commands at a WinRE command prompt: * `chkdsk /f /r OsDrive:` @@ -279,4 +279,3 @@ The reason that these entries may affect us is because there may be an entry in * `sfc /scannow /offbootdir=OsDrive:\ /offwindir=OsDrive:\Windows` ![SFC scannow](images/sfc-scannow.png) - diff --git a/windows/client-management/troubleshoot-networking.md b/windows/client-management/troubleshoot-networking.md index 57398a2764..7ff85215fe 100644 --- a/windows/client-management/troubleshoot-networking.md +++ b/windows/client-management/troubleshoot-networking.md @@ -2,7 +2,7 @@ title: Advanced troubleshooting for Windows networking ms.reviewer: manager: dansimp -description: Learn how to troubleshoot networking +description: Learn about the topics that are available to help you troubleshoot common problems related to Windows networking. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 3fe73d34ec..0ed8e1db70 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -2,7 +2,7 @@ title: Advanced troubleshooting for Stop error or blue screen error issue ms.reviewer: manager: dansimp -description: Learn how to troubleshoot Stop error or blue screen issues. +description: Learn advanced options for troubleshooting Stop errors, also known as blue screen errors or bug check errors. ms.prod: w10 ms.mktglfcycl: ms.sitesec: library @@ -43,7 +43,9 @@ To troubleshoot Stop error messages, follow these general steps: 2. As a best practice, we recommend that you do the following: a. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system: - + - [Windows 10, version 2004](https://support.microsoft.com/help/4555932) + - [Windows 10, version 1909](https://support.microsoft.com/help/4529964) + - [Windows 10, version 1903](https://support.microsoft.com/help/4498140) - [Windows 10, version 1809](https://support.microsoft.com/help/4464619) - [Windows 10, version 1803](https://support.microsoft.com/help/4099479) - [Windows 10, version 1709](https://support.microsoft.com/help/4043454) diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md index fe6e32ce59..77e524634d 100644 --- a/windows/client-management/troubleshoot-tcpip-connectivity.md +++ b/windows/client-management/troubleshoot-tcpip-connectivity.md @@ -1,6 +1,6 @@ --- title: Troubleshoot TCP/IP connectivity -description: Learn how to troubleshoot TCP/IP connectivity. +description: Learn how to troubleshoot TCP/IP connectivity and what you should do if you come across TCP reset in a network capture. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting @@ -14,27 +14,33 @@ manager: dansimp # Troubleshoot TCP/IP connectivity -You might come across connectivity errors on the application end or timeout errors. Most common scenarios would include application connectivity to a database server, SQL timeout errors, BizTalk application timeout errors, Remote Desktop Protocol (RDP) failures, file share access failures, or general connectivity. +You might come across connectivity errors on the application end or timeout errors. The following are the most common scenarios: +- Application connectivity to a database server +- SQL timeout errors +- BizTalk application timeout errors +- Remote Desktop Protocol (RDP) failures +- File share access failures +- General connectivity -When you suspect that the issue is on the network, you collect a network trace. The network trace would then be filtered. During troubleshooting connectivity errors, you might come across TCP reset in a network capture which could indicate a network issue. +When you suspect that the issue is on the network, you collect a network trace. The network trace would then be filtered. During troubleshooting connectivity errors, you might come across TCP reset in a network capture that could indicate a network issue. -* TCP is defined as connection-oriented and reliable protocol. One of the ways in which TCP ensures this is through the handshake process. Establishing a TCP session would begin with a 3-way handshake, followed by data transfer, and then a 4-way closure. The 4-way closure where both sender and receiver agree on closing the session is termed as *graceful closure*. After the 4-way closure, the server will allow 4 minutes of time (default), during which any pending packets on the network are to be processed, this is the TIME_WAIT state. Once the TIME_WAIT state is done, all the resources allocated for this connection are released. +* TCP is defined as connection-oriented and reliable protocol. One of the ways in which TCP ensures reliability is through the handshake process. Establishing a TCP session would begin with a three-way handshake, followed by data transfer, and then a four-way closure. The four-way closure where both sender and receiver agree on closing the session is termed as *graceful closure*. After the 4-way closure, the server will allow 4 minutes of time (default), during which any pending packets on the network are to be processed, this is the TIME_WAIT state. After the TIME_WAIT state completes, all the resources allocated for this connection are released. -* TCP reset is an abrupt closure of the session which causes the resources allocated to the connection to be immediately released and all other information about the connection is erased. +* TCP reset is an abrupt closure of the session; it causes the resources allocated to the connection to be immediately released and all other information about the connection is erased. * TCP reset is identified by the RESET flag in the TCP header set to `1`. -A network trace on the source and the destination which will help you determine the flow of the traffic and see at what point the failure is observed. +A network trace on the source and the destination helps you to determine the flow of the traffic and see at what point the failure is observed. The following sections describe some of the scenarios when you will see a RESET. ## Packet drops -When one TCP peer is sending out TCP packets for which there is no response received from the other end, the TCP peer would end up re-transmitting the data and when there is no response received, it would end the session by sending an ACK RESET( meaning, application acknowledges whatever data exchanged so far, but due to packet drop closing the connection). +When one TCP peer is sending out TCP packets for which there is no response received from the other end, the TCP peer would end up retransmitting the data and when there is no response received, it would end the session by sending an ACK RESET (this means that the application acknowledges whatever data is exchanged so far, but because of packet drop, the connection is closed). The simultaneous network traces on source and destination will help you verify this behavior where on the source side you would see the packets being retransmitted and on the destination none of these packets are seen. This would mean, the network device between the source and destination is dropping the packets. -If the initial TCP handshake is failing because of packet drops then you would see that the TCP SYN packet is retransmitted only 3 times. +If the initial TCP handshake is failing because of packet drops, then you would see that the TCP SYN packet is retransmitted only three times. Source side connecting on port 445: @@ -44,7 +50,7 @@ Destination side: applying the same filter, you do not see any packets. ![Screenshot of frame summary with filter in Network Monitor](images/tcp-ts-7.png) -For the rest of the data, TCP will retransmit the packets 5 times. +For the rest of the data, TCP will retransmit the packets five times. **Source 192.168.1.62 side trace:** @@ -58,16 +64,16 @@ If you are seeing that the SYN packets are reaching the destination, but the des ## Incorrect parameter in the TCP header -You see this behavior when the packets are modified in the network by middle devices and TCP on the receiving end is unable to accept the packet, such as the sequence number being modified, or packets being re-played by middle device by changing the sequence number. Again, the simultaneous network trace on the source and destination will be able to tell you if any of the TCP headers are modified. Start by comparing the source trace and destination trace, you will be able to notice if there is a change in the packets itself or if any new packets are reaching the destination on behalf of the source. +You see this behavior when the packets are modified in the network by middle devices and TCP on the receiving end is unable to accept the packet, such as the sequence number being modified, or packets being replayed by middle device by changing the sequence number. Again, the simultaneous network trace on the source and destination will be able to tell you if any of the TCP headers are modified. Start by comparing the source trace and destination trace, you will be able to notice if there is a change in the packets itself or if any new packets are reaching the destination on behalf of the source. -In this case, you will again need help from the network team to identify any such device which is modifying packets or re-playing packets to the destination. The most common ones are RiverBed devices or WAN accelerators. +In this case, you'll again need help from the network team to identify any device that's modifying packets or replaying packets to the destination. The most common ones are RiverBed devices or WAN accelerators. ## Application side reset When you have identified that the resets are not due to retransmits or incorrect parameter or packets being modified with the help of network trace, then you have narrowed it down to application level reset. -The application resets are the ones where you see the Acknowledgement flag set to `1` along with the reset flag. This would mean that the server is acknowledging the receipt of the packet but for some reason it will not accept the connection. This is when the application that received the packet did not like something it received. +The application resets are the ones where you see the Acknowledgment flag set to `1` along with the reset flag. This would mean that the server is acknowledging the receipt of the packet but for some reason it will not accept the connection. This is when the application that received the packet did not like something it received. In the below screenshots, you see that the packets seen on the source and the destination are the same without any modification or any drops, but you see an explicit reset sent by the destination to the source. @@ -83,7 +89,7 @@ You also see an ACK+RST flag packet in a case when the TCP establishment packet ![Screenshot of packet flag](images/tcp-ts-11.png) -The application which is causing the reset (identified by port numbers) should be investigated to understand what is causing it to reset the connection. +The application that's causing the reset (identified by port numbers) should be investigated to understand what is causing it to reset the connection. >[!Note] >The above information is about resets from a TCP standpoint and not UDP. UDP is a connectionless protocol and the packets are sent unreliably. You would not see retransmission or resets when using UDP as a transport protocol. However, UDP makes use of ICMP as a error reporting protocol. When you have the UDP packet sent out on a port and the destination does not have port listed, you will see the destination sending out **ICMP Destination host unreachable: Port unreachable** message immediately after the UDP packet @@ -96,7 +102,7 @@ The application which is causing the reset (identified by port numbers) should b ``` -During the course of troubleshooting connectivity issue, you might also see in the network trace that a machine receives packets but does not respond to. In such cases, there could be a drop at the server level. You should enable firewall auditing on the machine to understand if the local firewall is dropping the packet. +During the course of troubleshooting connectivity issue, you might also see in the network trace that a machine receives packets but does not respond to. In such cases, there could be a drop at the server level. To understand whether the local firewall is dropping the packet, enable the firewall auditing on the machine. ``` auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable @@ -106,6 +112,6 @@ You can then review the Security event logs to see for a packet drop on a partic ![Screenshot of Event Properties](images/tcp-ts-12.png) -Now, run the command `netsh wfp show state`, this will generate a wfpstate.xml file. Once you open this file and filter for the ID you find in the above event (2944008), you will be able to see a firewall rule name associated with this ID which is blocking the connection. +Now, run the command `netsh wfp show state`, this will generate a wfpstate.xml file. After you open this file and filter for the ID that you find in the above event (2944008), you'll be able to see a firewall rule name that's associated with this ID that's blocking the connection. ![Screenshot of wfpstate.xml file](images/tcp-ts-13.png) diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md index 739c11d55d..ed2dc15ba1 100644 --- a/windows/client-management/troubleshoot-tcpip-netmon.md +++ b/windows/client-management/troubleshoot-tcpip-netmon.md @@ -16,7 +16,10 @@ manager: dansimp In this topic, you will learn how to use Microsoft Network Monitor 3.4, which is a tool for capturing network traffic. -To get started, [download and run NM34_x64.exe](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image. +> [!NOTE] +> Network Monitor is the archived protocol analyzer and is no longer under development. **Microsoft Message Analyzer** is the replacement for Network Monitor. For more details, see [Microsoft Message Analyzer Operating Guide](https://docs.microsoft.com/message-analyzer/microsoft-message-analyzer-operating-guide). + +To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image: ![Adapters](images/nm-adapters.png) diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index a33d808d2f..40c0ff98c2 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -1,6 +1,6 @@ --- title: Troubleshoot port exhaustion issues -description: Learn how to troubleshoot port exhaustion issues. +description: Learn how to troubleshoot port exhaustion issues. Port exhaustion occurs when all the ports on a machine are used. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md index 7fd5ff086f..37b4dfa002 100644 --- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md +++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md @@ -1,6 +1,6 @@ --- title: Troubleshoot Remote Procedure Call (RPC) errors -description: Learn how to troubleshoot Remote Procedure Call (RPC) errors +description: Learn how to troubleshoot Remote Procedure Call (RPC) errors when connecting to Windows Management Instrumentation (WMI), SQL Server, or during a remote connection. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/troubleshoot-tcpip.md b/windows/client-management/troubleshoot-tcpip.md index b6a0283109..48a95cd4e0 100644 --- a/windows/client-management/troubleshoot-tcpip.md +++ b/windows/client-management/troubleshoot-tcpip.md @@ -1,6 +1,6 @@ --- title: Advanced troubleshooting for TCP/IP issues -description: Learn how to troubleshoot TCP/IP issues. +description: Learn how to troubleshoot common problems in a TCP/IP network environment, for example by collecting data using Network monitor. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md index c9691539ef..ee292cb2a6 100644 --- a/windows/client-management/troubleshoot-windows-freeze.md +++ b/windows/client-management/troubleshoot-windows-freeze.md @@ -2,7 +2,7 @@ title: Advanced troubleshooting for Windows-based computer freeze issues ms.reviewer: manager: dansimp -description: Learn how to troubleshoot computer freeze issues. +description: Learn how to troubleshoot computer freeze issues on Windows-based computers and servers. Also, you can learn how to diagnose, identify, and fix these issues. ms.prod: w10 ms.mktglfcycl: ms.sitesec: library @@ -251,7 +251,7 @@ If the physical computer is still running in a frozen state, follow these steps Pool Monitor shows you the number of allocations and outstanding bytes of allocation by type of pool and the tag that is passed into calls of ExAllocatePoolWithTag. -Learn [how to use Pool Monitor](https://support.microsoft.com/help/177415) and how to [use the data to troubleshoot pool leaks](https://blogs.technet.com/b/markrussinovich/archive/2009/03/26/3211216.aspx). +Learn [how to use Memory Pool Monitor to troubleshoot kernel mode memory leaks](https://support.microsoft.com/office/how-to-use-memory-pool-monitor-poolmon-exe-to-troubleshoot-kernel-mode-memory-leaks-4f4a05c2-ef8a-fca4-3ae0-670b940af398). ### Use memory dump to collect data for the virtual machine that's running in a frozen state diff --git a/windows/client-management/troubleshoot-windows-startup.md b/windows/client-management/troubleshoot-windows-startup.md index 0e39db4b3f..bd9f09bfd0 100644 --- a/windows/client-management/troubleshoot-windows-startup.md +++ b/windows/client-management/troubleshoot-windows-startup.md @@ -1,6 +1,6 @@ --- title: Advanced troubleshooting for Windows start-up issues -description: Learn how to troubleshoot Windows start-up issues. +description: Learn advanced options for how to troubleshoot common Windows start-up issues, like system crashes and freezes. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index afb9c4241f..e8a8cb2a19 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -12,7 +12,7 @@ ms.sitesec: library ms.pagetype: mobile, devices, security ms.localizationpriority: medium author: dansimp -ms.date: 01/26/2019 +ms.date: ms.topic: article --- @@ -24,7 +24,7 @@ ms.topic: article This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies. -Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution. +Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement, by using a comprehensive mobile device management solution. **In this article** - [Deploy](#deploy) @@ -36,8 +36,8 @@ Windows 10 supports end-to-end device lifecycle management to give companies con ## Deploy -Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which Mobile Device Management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. -Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or Microsoft Endpoint Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select whichever system best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050). +Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which mobile device management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. +Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or Microsoft Endpoint Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select the system that best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050). ### Deployment scenarios @@ -47,7 +47,7 @@ The built-in MDM client is common to all editions of the Windows 10 operating s Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee. Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Microsoft Store for Business, or by using their MDM system, which can also work with the Microsoft Store for Business for public store apps. -Knowing who owns the device and what the employee will use it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. +Knowing who owns the device and what the employee uses it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic. @@ -69,46 +69,47 @@ The way in which personal and corporate devices are enrolled into an MDM system - -Personal devices -Corporate devices + +Personal devices +Corporate devices -Ownership +Ownership Employee Organization Device Initialization -In the Out-of-the-Box Experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device. +In the out-of-box experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device. The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext). -Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory organizational identity. -Skipping the account setup in OOBE will result in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device will have to be reset. +Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory (Azure AD) organizational identity. +Skipping the account setup in OOBE results in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device must be reset. Device Enrollment Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. -Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+AAD+MDM). If your organization does not have Azure AD, the employee’s device will automatically be enrolled into your organization’s MDM system (MSA+MDM). +Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+Azure AD+MDM). If your organization does not have Azure AD, the employee’s device is automatically enrolled into your organization’s MDM system (MSA+MDM). MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM). -The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (AAD+MDM). +The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (Azure AD+MDM). -**Recommendation:** Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (AAD+MDM) and personal devices (MSA+AAD+MDM). This requires Azure AD Premium. +Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (Azure AD+MDM) and personal devices (MSA+Azure AD+MDM). This requires Azure AD Premium. ### Identity management *Applies to: Corporate and personal devices* -Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities. +Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen determines who controls the device and influences your management capabilities. ->**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/account/) and an [Azure AD account](https://www.microsoft.com/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. +> [!NOTE] +> Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, and so on. Both an [MSA](https://www.microsoft.com/account/) and an [Azure AD account](https://www.microsoft.com/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) provide access to these services. The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios. @@ -133,13 +134,13 @@ The following table describes the impact of identity choice on device management Ease of enrollment -Employees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+AAD+MDM). -Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (AAD+MDM – requires Azure AD Premium). +Employees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+Azure AD+MDM). +Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (Azure AD+MDM – requires Azure AD Premium). Credential management Employees sign in to the device with Microsoft Account credentials. -Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft account. +Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft Account. Employees sign in to the device with Azure AD credentials. IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations. @@ -153,7 +154,7 @@ IT can block the addition of a personal identity, such as an MSA or Google Accou User settings and data roaming across multiple Windows devices User and app settings roam across all devices activated with the same personal identity through OneDrive. -If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD- joined device, this will not be the case. Microsoft is investigating Enterprise roaming for a future release. +If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD-joined device, this is not the case. Microsoft is investigating Enterprise roaming for a future release. Level of control @@ -174,23 +175,25 @@ IT can block the addition of a personal identity, such as an MSA or Google Accou ->**Note:** In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities will change in the future. +> [!NOTE] +> In the context of [Windows-as-a-Service](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing), differentiation of MDM capabilities may change in the future. ### Infrastructure choices *Applies to: Corporate and personal devices* -For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/library/mt627908.aspx). +For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD Premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](https://technet.microsoft.com/library/mt627908.aspx). **Azure Active Directory** Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. **Mobile Device Management** -Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. -Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. +Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Microsoft 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. +Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. ->**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. -In addition, Microsoft recently added MDM capabilities powered by Intune to Office 365. MDM for Office 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. MDM for Office 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information about MDM for Office 365 capabilities, see [Overview of Mobile Device Management for Office 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx). +> [!NOTE] +> Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Microsoft 365. +In addition, Microsoft recently added MDM capabilities powered by Intune to Microsoft 365, called Basic Mobility and Security for Microsoft 365. Basic Mobility and Security for Microsoft 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. Basic Mobility and Security for Microsoft 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information, see [Overview of Basic Mobility and Security for Microsoft 365](https://technet.microsoft.com/library/ms.o365.cc.devicepolicy.aspx). **Cloud services** On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect diagnostic and usage data. Windows 10 Mobile enables organizations to manage how devices consume these cloud services. @@ -210,19 +213,20 @@ The Microsoft Store for Business is the place where IT administrators can find, ## Configure -MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. What configuration settings you use will differ based on the deployment scenario, and corporate devices will offer IT the broadest range of control. +MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. The configuration settings you use depend on the deployment scenario, and corporate devices offer IT the broadest range of control. ->**Note:** This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor. +> [!NOTE] +> This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor. Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors. ### Account profile *Applies to: Corporate devices* -Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. +Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization reduces the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. - **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Microsoft Store, Xbox, or Groove. -- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than Microsoft accounts. +- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than a Microsoft Account. ### Email accounts @@ -230,7 +234,7 @@ Enforcing what accounts employees can use on a corporate device is important for Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies. -- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017(v=vs.85).aspx). +- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [Exchange ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017(v=vs.85).aspx). - **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](https://msdn.microsoft.com/library/windows/hardware/dn904953(v=vs.85).aspx). Microsoft Intune does not currently support the creation of an SMTP email profile. ### Device Lock restrictions @@ -239,41 +243,42 @@ Email and associated calendar and contacts are the primary apps that users acces It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](https://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices. ->**Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. -To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based. -Companion devices must be paired with Windows 10 PC’s via Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires Pro or Enterprise edition on the Windows 10 PC being signed into. +> [!NOTE] +> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware-based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based. +Companion devices must be paired with a Windows 10 PC using Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires the Pro or Enterprise edition of Windows 10. -Most of the device lock restriction policies have been available via ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply. +Most of the device lock restriction policies have been available through Exchange ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply: - **Device Password Enabled** Specifies whether users are required to use a device lock password. -- **Allow Simple Device Password** Whether users can use a simple password (e.g., 1111 or 1234). -- **Alphanumeric Device Password Required** Whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user will be able to enter a numeric PIN on the keyboard. -- **Min Device Password Complex Characters** The number of password element types (i.e., uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords. -- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history (Users cannot reuse passwords in the history to create new passwords.) +- **Allow Simple Device Password** Specifies whether users can use a simple password (for example, 1111 or 1234). +- **Alphanumeric Device Password Required** Specifies whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user can enter a numeric PIN on the keyboard. +- **Min Device Password Complex Characters** The number of password element types (uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords. +- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history. (Users cannot reuse passwords in the history to create new passwords.) - **Min Device Password Length** The minimum number of characters required to create new passwords. - **Max Inactivity Time Device Lock** The number of minutes of inactivity before devices are locked and require a password to unlock. -- **Allow Idle Return Without Password** Whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached. -- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped (A value of zero disables device wipe functionality.) -- **Screen Timeout While Locked** The number of minutes before the lock screen times out (this policy influences device power management). -- **Allow Screen Timeout While Locked User Configuration** Whether users can manually configure screen timeout while the device is on the lock screen (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting). +- **Allow Idle Return Without Password** Specifies whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached. +- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped. (A value of zero disables device wipe functionality.) +- **Screen Timeout While Locked** The number of minutes before the lock screen times out. (This policy influences device power management.) +- **Allow Screen Timeout While Locked User Configuration** Specifies whether users can manually configure screen timeout while the device is on the lock screen. (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting.) Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario. -Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an AAD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment. +Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an Azure AD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment. -You will notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies will be applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information. +You may notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies are applied, with the strongest policy retained. Read [PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099(v=vs.85).aspx), [DeviceLock CSP](https://msdn.microsoft.com/library/windows/hardware/dn904945(v=vs.85).aspx) (Windows Phone 8.1), and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#DeviceLock_AllowIdleReturnWithoutPassword) for more detailed information. ### Prevent changing of settings *Applies to: Corporate devices* -Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change. +Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change, including: -- **Allow Your Account** Specifies whether users are able to change account configuration in the Your Email and Accounts panel in Settings -- **Allow VPN** Allows the user to change VPN settings -- **Allow Data Sense** Allows the user to change Data Sense settings -- **Allow Date Time** Allows the user to change data and time setting -- **Allow Edit Device Name** Allows users to change the device name -- **Allow Speech Model Update** Specifies whether the device will receive updates to the speech recognition and speech synthesis models (to improve accuracy and performance) +- **Allow Your Account** Specifies whether users are allowed to change account configuration in the **Your Email and Accounts** panel in Settings +- **Allow VPN** Specifies whether users are allowed to change VPN settings +- **Allow Data Sense** Specifies whether users are allowed to change Data Sense settings +- **Allow Date Time** Specifies whether users are allowed to change data and time setting +- **Allow Edit Device Name** Specifies whether users are allowed to change the device name +- **Allow Speech Model Update** Specifies whether the device receives updates to the speech recognition and speech synthesis models (to improve accuracy and performance) ### Hardware restrictions @@ -281,35 +286,37 @@ Employees are usually allowed to change certain personal device settings that yo Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can use hardware restrictions to control the availability of these features. -The following lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. +The following is a list of the MDM settings that Windows 10 Mobile supports to configure hardware restrictions: ->**Note:** Some of these hardware restrictions provide connectivity and assist in data protection. +> [!NOTE] +> Some of these hardware restrictions provide connectivity and assist in data protection. -- **Allow NFC:** Whether the NFC radio is enabled -- **Allow USB Connection:** Whether the USB connection is enabled (doesn’t affect USB charging) -- **Allow Bluetooth:** Whether users can enable and use the Bluetooth radio on their devices -- **Allow Bluetooth Advertising:** Whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices -- **Allow Bluetooth Discoverable Mode:** Whether the device can discover other devices (e.g., headsets) -- **Allow Bluetooth pre-pairing** Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device +- **Allow NFC:** Specifies whether the NFC radio is enabled +- **Allow USB Connection:** Specifies whether the USB connection is enabled (doesn’t affect USB charging) +- **Allow Bluetooth:** Specifies whether users can enable and use the Bluetooth radio on their devices +- **Allow Bluetooth Advertising:** Specifies whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices +- **Allow Bluetooth Discoverable Mode:** Specifies whether the device can discover other devices (such as headsets) +- **Allow Bluetooth pre-pairing** Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device - **Bluetooth Services Allowed List:** The list of Bluetooth services and profiles to which the device can connect - **Set Bluetooth Local Device Name:** The local Bluetooth device name -- **Allow Camera:** Whether the camera is enabled -- **Allow Storage Card:** Whether the storage card slot is enabled -- **Allow Voice Recording:** Whether the user can use the microphone to create voice recordings -- **Allow Location:** Whether the device can use the GPS sensor or other methods to determine location so applications can use location information +- **Allow Camera:** Specifies whether the camera is enabled +- **Allow Storage Card:** Specifies whether the storage card slot is enabled +- **Allow Voice Recording:** Specifies whether the user can use the microphone to create voice recordings +- **Allow Location:** Specifies whether the device can use the GPS sensor or other methods to determine location so applications can use location information ### Certificates *Applies to: Personal and corporate devices* Certificates help improve security by providing account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. -To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes. -Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. +To install certificates manually, you can post them on Microsoft Edge website or send them directly by using email, which is ideal for testing purposes. +Using Simple Certificate Enrollment Protocol (SCEP) and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device, as long as the MDM system supports the SCEP or Personal Information Exchange (PFX). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings. -Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile). +For more detailed information about MDM certificate management, see [Client Certificate Install CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile). Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidentally. -> **Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you: +> [!NOTE] +> To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you: > - View a summary of all personal certificates > - View the details of individual certificates > - View the certificates used for VPN, Wi-Fi, and email authentication @@ -322,7 +329,7 @@ Use the Allow Manual Root Certificate Installation setting to prevent users from *Applies to: Corporate and personal devices* Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. -You can create multiple Wi-Fi profiles in your MDM system. The below table lists the Windows 10 Mobile Wi Fi connection profile settings that can be configured by administrators. +You can create multiple Wi-Fi profiles in your MDM system. The Windows 10 Mobile Wi-Fi connection profile settings that can be configured by administrators include: - **SSID** The case-sensitive name of the Wi-Fi network Service Set Identifier - **Security type** The type of security the Wi-Fi network uses; can be one of the following authentication types: @@ -345,14 +352,14 @@ You can create multiple Wi-Fi profiles in your MDM system. The below table lists - **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file - **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled -In addition, you can set a few device wide Wi-Fi settings. -- **Allow Auto Connect to Wi-Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks -- **Allow Manual Wi-Fi Configuration** Whether the user can manually configure Wi-Fi settings -- **Allow Wi-Fi** Whether the Wi-Fi hardware is enabled -- **Allow Internet Sharing** Allow or disallow Internet sharing -- **WLAN Scan Mode** How actively the device scans for Wi-Fi networks +In addition, you can set the following device wide Wi-Fi settings: +- **Allow Auto Connect to Wi-Fi Sense Hotspots** Specifies whether the device automatically detects and connects to Wi-Fi networks +- **Allow Manual Wi-Fi Configuration** Specifies whether the user can manually configure Wi-Fi settings +- **Allow Wi-Fi** Specifies whether the Wi-Fi hardware is enabled +- **Allow Internet Sharing** Allows or disallows Internet sharing +- **WLAN Scan Mode** Specifies how actively the device scans for Wi-Fi networks -Get more detailed information about Wi-Fi connection profile settings in the [Wi-Fi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx). +For more detailed information about Wi-Fi connection profile settings, see [Wi-Fi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981(v=vs.85).aspx) and [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx). ### APN profiles @@ -360,7 +367,7 @@ Get more detailed information about Wi-Fi connection profile settings in the [Wi An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. -You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles. +You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles: - **APN name** The APN name - *IP connection type* The IP connection type; set to one of the following values: @@ -368,7 +375,7 @@ You can define and deploy APN profiles in MDM systems that configure cellular da - IPv6 only - IPv4 and IPv6 concurrently - IPv6 with IPv4 provided by 46xlat -- **LTE attached** Whether the APN should be attached as part of an LTE Attach +- **LTE attached** Specifies whether the APN should be attached as part of an LTE Attach - **APN class ID** The globally unique identifier that defines the APN class to the modem - **APN authentication type** The APN authentication type; set to one of the following values: - None @@ -379,22 +386,22 @@ You can define and deploy APN profiles in MDM systems that configure cellular da - **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type - **Password** The password for the user account specified in User name - **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile -- **Always on** Whether the connection manager will automatically attempt to connect to the APN whenever it is available +- **Always on** Specifies whether the connection manager automatically attempts to connect to the APN when it is available - **Connection enabled** Specifies whether the APN connection is enabled - **Allow user control** Allows users to connect with other APNs than the enterprise APN -- **Hide view** Whether the cellular UX will allow the user to view enterprise APNs +- **Hide view** Specifies whether the cellular UX allows the user to view enterprise APNs -Get more detailed information about APN settings in the [APN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617(v=vs.85).aspx). +For more detailed information about APN settings, see [APN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617(v=vs.85).aspx). ### Proxy *Applies to: Corporate devices* -The below lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity. +The following lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity: - **Connection name** Specifies the name of the connection the proxy is associated with (this is the APN name of a configured connection) -- **Bypass Local** Specifies if the proxy should be bypassed when local hosts are accessed by the device -- **Enable** Specifies if the proxy is enabled +- **Bypass Local** Specifies whether the proxy should be bypassed when local hosts are accessed by the device +- **Enable** Specifies whether the proxy is enabled - **Exception** Specifies a semi-colon delimited list of external hosts which should bypass the proxy when accessed - **User Name** Specifies the username used to connect to the proxy - **Password** Specifies the password used to connect to the proxy @@ -408,15 +415,15 @@ For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.micro *Applies to: Corporate and personal devices* -Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management). +Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management). You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile. To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings: - **VPN Servers** The VPN server for the VPN profile - **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values: - - Split tunnel. Only network traffic destined to the intranet goes through the VPN connection - - Force tunnel. All traffic goes through the VPN connection + - Split tunnel: Only network traffic destined to the intranet goes through the VPN connection + - Force tunnel: All traffic goes through the VPN connection - **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic - **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections) - **Machine certificate** The machine certificate used for IKEv2-based VPN connections @@ -424,24 +431,25 @@ To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such a - **L2tpPsk** The pre-shared key used for an L2TP connection - **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling ->**Note:** The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard will walk you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. +> [!NOTE] +> The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard walks you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. Microsoft Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes: - **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address -- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (e.g., authentication information) that the plugin provider requires +- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (such as authentication information) that the plugin provider requires - **Microsoft Store VPN plugin family name** Specifies the Microsoft Store package family name for the Microsoft Store–based VPN plugin -In addition, you can specify per VPN Profile: +In addition, you can specify per VPN profile: -- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list will automatically trigger the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. +- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list automatically triggers the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. - **Route List** List of routes to be added to the routing table for the VPN interface. This is required for split tunneling cases where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface. - **Domain Name Information List** Name Resolution Policy Table (NRPT) rules for the VPN profile. - **Traffic Filter List** Specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. - **DNS suffixes** A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List. - **Proxy** Any post-connection proxy support required for the VPN connection; including Proxy server name and Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings. - **Always on connection** Windows 10 Mobile features always-on VPN, which makes it possible to automatically start a VPN connection when a user signs in. The VPN stays connected until the user manually disconnects it. -- **Remember credentials** Whether the VPN connection caches credentials. +- **Remember credentials** Specifies whether the VPN connection caches credentials. - **Trusted network detection** A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible (Wi-Fi). - **Enterprise Data Protection Mode ID** Enterprise ID, which is an optional field that allows the VPN to automatically trigger based on an app defined with a Windows Information Protection policy. - **Device Compliance** To set up Azure AD-based Conditional Access for VPN and allow that SSO with a certificate different from the VPN Authentication certificate for Kerberos Authentication in the case of Device Compliance. @@ -452,12 +460,12 @@ In addition, you can specify per VPN Profile: - No other VPN profiles can be connected or modified. - **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require. -For more details about VPN profiles, see the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776(v=vs.85).aspx) +For more details about VPN profiles, see [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776(v=vs.85).aspx). -Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges. -- **Allow VPN** Whether users can change VPN settings -- **Allow VPN Over Cellular** Whether users can establish VPN connections over cellular networks -- **Allow VPN Over Cellular when Roaming** Whether users can establish VPN connections over cellular networks when roaming +Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges: +- **Allow VPN** Specifies whether users can change VPN settings +- **Allow VPN Over Cellular** Specifies whether users can establish VPN connections over cellular networks +- **Allow VPN Over Cellular when Roaming** Specifies whether users can establish VPN connections over cellular networks when roaming ### Storage management @@ -471,16 +479,16 @@ The SD card is uniquely paired with a device. No other devices can see the apps You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards. -Here is a list of MDM storage management settings that Windows 10 Mobile provides. +Here is a list of MDM storage management settings that Windows 10 Mobile provides: -- **Allow Storage Card** Whether the use of storage cards for data storage is allowed -- **Require Device Encryption** Whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off) +- **Allow Storage Card** Specifies whether the use of storage cards for data storage is allowed +- **Require Device Encryption** Specifies whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off) - **Encryption method** Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values: - AES-Cipher Block Chaining (CBC) 128-bit - AES-CBC 256-bit - XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default) - XTS-AES-256-bit -- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Whether the device allows or disallows the FIPS algorithm policy +- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Specifies whether the device allows or disallows the FIPS algorithm policy - **SSL cipher suites** Specifies a list of the allowed cryptographic cipher algorithms for SSL connections - **Restrict app data to the system volume** Specifies whether app data is restricted to the system drive - **Restrict apps to the system volume** Specifies whether apps are restricted to the system drive @@ -513,11 +521,11 @@ Azure AD authenticated managers have access to Microsoft Store for Business func Microsoft Store for Business supports app distribution under two licensing models: online and offline. The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps. -Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. +Corporate device users can find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system App Catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps. -Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device. +Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it's automatically installed from the cloud. Also, apps are automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device. To distribute an app offline (organization-managed), the app must be downloaded from the Microsoft Store for Business. This can be accomplished in the Microsoft Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Microsoft Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Microsoft Store, then you must obtain the files directly from the developer or use the online licensing method. @@ -525,7 +533,7 @@ To install acquired Microsoft Store or LOB apps offline on a Windows 10 Mobile d Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition. -Learn more about the [Microsoft Store for Business](/microsoft-store/index). +For more information, see [Microsoft Store for Business](/microsoft-store/index). ### Managing apps @@ -533,25 +541,25 @@ Learn more about the [Microsoft Store for Business](/microsoft-store/index). IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date. -Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store. +Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store. -For more details, see [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx). +For more information, see [AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019(v=vs.85).aspx). -In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM. +In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM: -- **Allow All Trusted Apps** Whether users can sideload apps on the device. -- **Allow App Store Auto Update** Whether automatic updates of apps from Microsoft Store are allowed. -- **Allow Developer Unlock** Whether developer unlock is allowed. -- **Allow Shared User App Data** Whether multiple users of the same app can share data. -- **Allow Store** Whether Microsoft Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system. +- **Allow All Trusted Apps** Specifies whether users can sideload apps on the device. +- **Allow App Store Auto Update** Specifies whether automatic updates of apps from Microsoft Store are allowed. +- **Allow Developer Unlock** Specifies whether developer unlock is allowed. +- **Allow Shared User App Data** Specifies whether multiple users of the same app can share data. +- **Allow Store** Specifies whether Microsoft Store app is allowed to run. This completely blocks the user from installing apps from the Store, but still allows app distribution through an MDM system. - **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above. - **Disable Store Originated Apps** Disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded before the policy was applied. -- **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. -- **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card. -- **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card. -- **Start screen layout** An XML blob used to configure the Start screen (see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/library/windows/hardware/mt171093(v=vs.85).aspx) for more information). +- **Require Private Store Only** Specifies whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. +- **Restrict App Data to System Volume** Specifies whether app data is allowed only on the system drive or can be stored on an SD card. +- **Restrict App to System Volume** Specifies whether app installation is allowed only to the system drive or can be installed on an SD card. +- **Start screen layout** An XML blob used to configure the Start screen (for more information, see [Start layout for Windows 10 Mobile](https://msdn.microsoft.com/library/windows/hardware/mt171093(v=vs.85).aspx)). -Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps) +Find more details on application management options in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#ApplicationManagement_AllowAllTrustedApps). ### Data leak prevention @@ -561,7 +569,7 @@ One of the biggest challenges in protecting corporate information on mobile devi Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email. -Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data will be encrypted at all times and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps consider all data corporate and encrypt everything by default. +Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlightened apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data is encrypted at all times and any attempt to copy/paste or share this information with non-corporate apps or users fails. Unenlightened apps consider all data corporate and encrypt everything by default. Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including: - Microsoft Edge @@ -581,19 +589,19 @@ The following table lists the settings that can be configured for Windows Inform - Override mode (encrypt, prompt, and audit) - Block mode (encrypt, block, and audit) - **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. -- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user will not be able to remove protection from enterprise content through the OS or app user experience. +- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user is not able to remove protection from enterprise content through the OS or app user experience. - **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured. - **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy. -- **Revoke on unenroll** Whether to revoke the information protection keys when a device unenrolls from the management service. +- **Revoke on unenroll** Specifies whether to revoke the information protection keys when a device unenrolls from the management service. - **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long. - **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection. -- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the Start menu. +- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the **Start** menu. - **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection. -- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers will be considered part of the enterprise and protected. -- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device will be considered enterprise data and protected. +- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers is considered part of the enterprise and protected. +- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device is considered enterprise data and is protected. - **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected. ->**Note:** * Are mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings - specifically Enterprise IP Range and Enterprise Network Domain Names – must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key (so that others in the company can access it. +* Mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings (specifically Enterprise IP Range and Enterprise Network Domain Names) must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key so that others in the company can access it. For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt697634(v=vs.85).aspx) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). @@ -601,18 +609,18 @@ For more information on Windows Information Protection, see the [EnterpriseDataP *Applies to: Corporate devices* -On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks. +On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks: -- **Allow copy and paste** Whether users can copy and paste content -- **Allow Cortana** Whether users can use Cortana on the device (where available) -- **Allow device discovery** Whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed) -- **Allow input personalization** Whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation) -- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) -- **Allow screen capture** Whether users are allowed to capture screenshots on the device +- **Allow copy and paste** Specifies whether users can copy and paste content +- **Allow Cortana** Specifies whether users can use Cortana on the device (where available) +- **Allow device discovery** Specifies whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed) +- **Allow input personalization** Specifies whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation) +- **Allow manual MDM unenrollment** Specifies whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) +- **Allow screen capture** Specifies whether users are allowed to capture screenshots on the device - **Allow SIM error dialog prompt** Specifies whether to display a dialog prompt when no SIM card is installed -- **Allow sync my settings** Whether the user experience settings are synchronized between devices (works with Microsoft accounts only) -- **Allow toasts notifications above lock screen** Whether users are able to view toast notification on the device lock screen -- **Allow voice recording** Whether users are allowed to perform voice recordings +- **Allow sync my settings** Specifies whether the user experience settings are synchronized between devices (works with Microsoft accounts only) +- **Allow toasts notifications above lock screen** Specifies whether users are able to view toast notification on the device lock screen +- **Allow voice recording** Specifies whether users are allowed to perform voice recordings - **Do Not Show Feedback Notifications** Prevents devices from showing feedback questions from Microsoft - **Allow Task Switcher** Allows or disallows task switching on the device to prevent visibility of App screen tombstones in the task switcher - **Enable Offline Maps Auto Update** Disables the automatic download and update of map data @@ -626,19 +634,19 @@ You can find more details on the experience settings in Policy CSP. MDM systems also give you the ability to manage Microsoft Edge on mobile devices. Microsoft Edge is the only browser available on Windows 10 Mobile devices. It differs slightly from the desktop version as it does not support Flash or Extensions. Edge is also an excellent PDF viewer as it can be managed and integrates with Windows Information Protection. -The following settings for Microsoft Edge on Windows 10 Mobile can be managed. +The following settings for Microsoft Edge on Windows 10 Mobile can be managed: -- **Allow Browser** Whether users can run Microsoft Edge on the device -- **Allow Do Not Track headers** Whether Do Not Track headers are allowed -- **Allow InPrivate** Whether users can use InPrivate browsing -- **Allow Password Manager** Whether users can use Password Manager to save and manage passwords locally -- **Allow Search Suggestions in Address Bar** Whether search suggestions are shown in the address bar -- **Allow Windows Defender SmartScreen** Whether Windows Defender SmartScreen is enabled -- **Cookies** Whether cookies are allowed +- **Allow Browser** Specifies whether users can run Microsoft Edge on the device +- **Allow Do Not Track headers** Specifies whether Do Not Track headers are allowed +- **Allow InPrivate** Specifies whether users can use InPrivate browsing +- **Allow Password Manager** Specifies whether users can use Password Manager to save and manage passwords locally +- **Allow Search Suggestions in Address Bar** Specifies whether search suggestions are shown in the address bar +- **Allow Windows Defender SmartScreen** Specifies whether Windows Defender SmartScreen is enabled +- **Cookies** Specifies whether cookies are allowed - **Favorites** Configure Favorite URLs - **First Run URL** The URL to open when a user launches Microsoft Edge for the first time -- **Prevent Windows Defender SmartScreen Prompt Override** Whether users can override the Windows Defender SmartScreen warnings for URLs -- **Prevent Smart Screen Prompt Override for Files** Whether users can override the Windows Defender SmartScreen warnings for files +- **Prevent Windows Defender SmartScreen Prompt Override** Specifies whether users can override the Windows Defender SmartScreen warnings for URLs +- **Prevent Smart Screen Prompt Override for Files** Specifies whether users can override the Windows Defender SmartScreen warnings for files ## Manage @@ -646,7 +654,7 @@ In enterprise IT environments, the need for security and cost control must be ba ### Servicing options -**A streamlined update process** +#### A streamlined update process *Applies to: Corporate and personal devices* @@ -682,11 +690,11 @@ Microsoft has streamlined the Windows product engineering and release cycle so n -Microsoft will also deliver and install monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process. +Microsoft also delivers and installs monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process. -Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates will take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process will apply to both feature and quality updates. +Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process apply to both feature and quality updates. -Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device will Auto Scan for available updates. However, depending on the device’s network and power status, update methods and timing will vary. +Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device uses Auto Scan to search for available updates. However, depending on the device’s network and power status, update methods and timing may vary. @@ -717,8 +725,8 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au - - + + @@ -733,22 +741,22 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au
      Cellular Device is only connected to a cellular network (standard data charges apply)Will skip a daily scan if scan was successfully completed in the last 5 daysWill only occur if update package is small and does not exceed the mobile operator data limit.Skips a daily scan if scan was successfully completed in the last 5 daysOnly occurs if update package is small and does not exceed the mobile operator data limit. Yes Idem
      -**Keeping track of updates releases** +#### Keeping track of updates releases *Applies to: Corporate and Personal devices* Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](https://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about. ->**Note:** -We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback via the Feedback Hub +> [!NOTE] +> We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback by using the Feedback Hub. -**Windows as a Service** +#### Windows as a Service *Applies to: Corporate and Personal devices* Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure. -Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the chart below: +Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the following chart. @@ -790,7 +798,7 @@ Update availability depends on what servicing option you choose for the device.
      -**Enterprise Edition** +#### Enterprise edition *Applies to: Corporate devices* @@ -805,11 +813,12 @@ To learn more about diagnostic, see [Configure Windows diagnostic data in your o To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required. -Details on updating a device to Enterprise edition with [WindowsLicensing CSP](https://msdn.microsoft.com/library/windows/hardware/dn904983(v=vs.85).aspx) +For more information on updating a device to Enterprise edition, see [WindowsLicensing CSP](https://msdn.microsoft.com/library/windows/hardware/dn904983(v=vs.85).aspx). ->**Recommendation:** Microsoft recommends using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices. +> [!NOTE] +> We recommend using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices. -**Deferring and Approving Updates with MDM** +#### Deferring and approving updates with MDM *Applies to: Corporate devices with Enterprise edition* @@ -845,11 +854,11 @@ The following table summarizes applicable update policy settings by version of W Subscribe device to CBB, to defer Feature Updates RequireDeferUpgrade -Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB). Defers feature update for minimum of 4 months after Current Branch was release. BranchReadinessLevel -Defers Feature Update until next CBB release. Device will receive quality updates from Current Branch for Business (CBB). +Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB). Defers feature update for minimum of 4 months after Current Branch was release. Defer Updates @@ -880,7 +889,7 @@ Pause Feature Updates for up to 35 days -**Managing the Update Experience** +#### Managing the update experience *Applies to: Corporate devices with Enterprise edition* @@ -892,33 +901,33 @@ This can include: - Automatically downloading and restarting devices with user notification. - Automatically downloading and restarting devices at a specified time. - Automatically downloading and restarting devices without user interaction. -- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device will not receive any updates. +- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device does not receive any updates. -In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, etc.) or on a specific what [day of the week](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, etc.). +In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ActiveHoursEnd) (supported values are 0-23, where 0 is 12am, 1 is 1am, and so on) or on a specific [day of the week](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Update_ScheduledInstallDay) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, and so on). -**Managing the source of updates with MDM** +#### Managing the source of updates with MDM *Applies to: Corporate devices with Enterprise edition* Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system. -Learn more about [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb). +For more information, see [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb). -IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS. +IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS). -**Managing Updates with Windows Update Server** +#### Managing Updates with Windows Update Server *Applies to: Corporate devices with Enterprise edition* When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices. -Learn more about [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx) +For more information, see [managing updates with Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx). -**Querying the device update status** +#### Querying the device update status *Applies to: Personal and corporate devices* -In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates. +In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates: The device update status query provides an overview of: - Installed updates: A list of updates that are installed on the device. @@ -936,7 +945,7 @@ Device Health Attestation (DHA) is another line of defense that is new to Window Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN. -The first version of Device Health Attestation (DHA) was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, Device Health Attestation (DHA) capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network. +The first version of DHA was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, DHA capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network. The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that: - Run Windows 10 operating system (mobile phone or PC) @@ -953,26 +962,27 @@ DHA-enabled device management solutions help IT managers create a unified securi - Trigger further investigation and monitoring (route the device to a honeypot for further monitoring) - Simply alert the user or the admin to fix the issue ->**Note:** Windows Device Health Attestation Service can be used for conditional access scenarios which may be enabled by Mobile Device Management solutions (e.g.: Microsoft Intune) and other types of management systems (e.g.: SCCM) purchased separately. +> [!NOTE] +> Windows Device Health Attestation Service can be used for conditional access scenarios that may be enabled by Mobile Device Management solutions (such as Microsoft Intune) and other types of management systems (such as SCCM) purchased separately. For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide). -This is a list of attributes that are supported by DHA and can trigger the corrective actions mentioned above. +This is a list of attributes that are supported by DHA and can trigger the corrective actions mentioned above: - **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK). -- **Data Execution Prevention (DEP) enabled** Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. +- **Data Execution Prevention (DEP) enabled** Specifies whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. - **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. -- **Secure Boot enabled** Whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. -- **Code integrity enabled** Whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. -- **Safe mode** Whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. -- **Boot debug enabled** Whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. -- **OS kernel debugging enabled** Whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. -- **Test signing enabled** Whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. +- **Secure Boot enabled** Specifies whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. +- **Code integrity enabled** Specifies whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. +- **Safe mode** Specifies whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. +- **Boot debug enabled** Specifies whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. +- **OS kernel debugging enabled** Specifies whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. +- **Test signing enabled** Specifies whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. - **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). - **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). -- **Secure Boot Configuration Policy (SBCP) present** Whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. -- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published whitelist. A device that complies with the whitelist is more trustworthy (secure) than a device that is noncompliant. +- **Secure Boot Configuration Policy (SBCP) present** Specifies whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. +- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published allow list. A device that complies with the allow list is more trustworthy (secure) than a device that is noncompliant. -**Example scenario** +#### Example scenario Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device. @@ -988,9 +998,9 @@ Here is what occurs when a smartphone is turned on: *Applies to: Corporate devices with Enterprise edition* -Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (e.g., installed updates). +Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (such as installed updates). -The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide. +The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide: - **Installed enterprise apps** List of the enterprise apps installed on the device - **Device name** The device name configured for the device @@ -1004,7 +1014,7 @@ The following list shows examples of the Windows 10 Mobile software and hardware - **Device language** Language in use on the device - **Phone number** Phone number assigned to the device - **Roaming status** Indicates whether the device has a roaming cellular connection -- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI) Unique identifiers for the cellular connection for the phone; Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user +- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI)** Unique identifiers for the cellular connection for the phone (Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user) - **Wi-Fi IP address** IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device - **Wi-Fi media access control (MAC) address** MAC address assigned to the Wi-Fi adapter in the device - **Wi-Fi DNS suffix and subnet mask** DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device @@ -1021,14 +1031,15 @@ You can control the level of data that diagnostic data systems collect. To confi For more information, see [Configure Windows diagnostic data in Your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization). ->**Note:** Diagnostic data can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition. +> [!NOTE] +> Diagnostic data can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition. ### Remote assistance *Applies to: Personal and corporate devices* The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: -- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (e.g., leaving the device at a customer site). +- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (such as leaving the device at a customer site). - **Remote PIN reset** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost and users are able to quickly gain access to their devices. - **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. - **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device. @@ -1040,7 +1051,8 @@ The remote assistance features in Windows 10 Mobile help resolve issues that use These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. ->**Remote control software** Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Microsoft Store. +> [!NOTE] +> Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Microsoft Store. ## Retire @@ -1050,19 +1062,20 @@ Device retirement is the last phase of the device lifecycle, which in today’s Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected. ->**Note:** All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration. +> [!NOTE] +> All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration. **Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world. If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data. -A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data will be tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles will immediately be removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and will be reported to the MDM system. +A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data is tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles are immediately removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and is reported to the MDM system. -**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that will also make the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process. +**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that also makes the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process. **Settings for personal or corporate device retirement** -- **Allow manual MDM unenrollment** Whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) -- **Allow user to reset phone** Whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults +- **Allow manual MDM unenrollment** Specifies whether users are allowed to delete the workplace account (unenroll the device from the MDM system) +- **Allow user to reset phone** Specifies whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults ## Related topics diff --git a/windows/client-management/windows-10-support-solutions.md b/windows/client-management/windows-10-support-solutions.md index 8c30018235..9274477150 100644 --- a/windows/client-management/windows-10-support-solutions.md +++ b/windows/client-management/windows-10-support-solutions.md @@ -1,6 +1,6 @@ --- title: Troubleshooting Windows 10 -description: Get links to troubleshooting articles for Windows 10 issues +description: Learn where to find information about troubleshooting Windows 10 issues, for example Bitlocker issues and bugcheck errors. ms.reviewer: kaushika manager: dansimp ms.prod: w10 @@ -131,4 +131,4 @@ This section contains advanced troubleshooting topics and links to help you reso ## Other Resources -### [Troubleshooting Windows Server components](https://docs.microsoft.com/windows-server/troubleshoot/windows-server-support-solutions) +- [Troubleshooting Windows Server components](https://docs.microsoft.com/windows-server/troubleshoot/windows-server-troubleshooting) diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index 7428624219..0d01784273 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -1,21 +1,27 @@ # [Configure Windows 10](index.md) ## [Accessibility information for IT Pros](windows-10-accessibility-for-ITPros.md) ## [Configure access to Microsoft Store](stop-employees-from-using-microsoft-store.md) -## [Cortana integration in your business or enterprise](cortana-at-work/cortana-at-work-overview.md) -### [Testing scenarios using Cortana in your business or organization](cortana-at-work/cortana-at-work-testing-scenarios.md) -#### [Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook](cortana-at-work/cortana-at-work-scenario-1.md) -#### [Test scenario 2 - Perform a quick search with Cortana at work](cortana-at-work/cortana-at-work-scenario-2.md) -#### [Test scenario 3 - Set a reminder for a specific location using Cortana at work](cortana-at-work/cortana-at-work-scenario-3.md) -#### [Test scenario 4 - Use Cortana at work to find your upcoming meetings](cortana-at-work/cortana-at-work-scenario-4.md) -#### [Test scenario 5 - Use Cortana to send email to a co-worker](cortana-at-work/cortana-at-work-scenario-5.md) -#### [Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work/cortana-at-work-scenario-6.md) -#### [Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device](cortana-at-work/cortana-at-work-scenario-7.md) -### [Set up and test Cortana with Office 365 in your organization](cortana-at-work/cortana-at-work-o365.md) -### [Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization](cortana-at-work/cortana-at-work-crm.md) -### [Set up and test Cortana for Power BI in your organization](cortana-at-work/cortana-at-work-powerbi.md) -### [Set up and test custom voice commands in Cortana for your organization](cortana-at-work/cortana-at-work-voice-commands.md) -### [Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization](cortana-at-work/cortana-at-work-policy-settings.md) -### [Send feedback about Cortana at work back to Microsoft](cortana-at-work/cortana-at-work-feedback.md) +## [Configure Cortana in Windows 10](cortana-at-work/cortana-at-work-overview.md) +## [Set up and test Cortana in Windows 10, version 2004 and later](cortana-at-work/set-up-and-test-cortana-in-windows-10.md) +## [Testing scenarios using Cortana in your business or organization](cortana-at-work/cortana-at-work-testing-scenarios.md) +### [Test scenario 1 - Sign into Azure AD, enable the wake word, and try a voice query](cortana-at-work/cortana-at-work-scenario-1.md) +### [Test scenario 2 - Perform a Bing search with Cortana](cortana-at-work/cortana-at-work-scenario-2.md) +### [Test scenario 3 - Set a reminder](cortana-at-work/cortana-at-work-scenario-3.md) +### [Test scenario 4 - Use Cortana to find free time on your calendar](cortana-at-work/cortana-at-work-scenario-4.md) +### [Test scenario 5 - Find out about a person](cortana-at-work/cortana-at-work-scenario-5.md) +### [Test scenario 6 - Change your language and perform a quick search with Cortana](cortana-at-work/cortana-at-work-scenario-6.md) +## [Send feedback about Cortana back to Microsoft](cortana-at-work/cortana-at-work-feedback.md) +## [Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization](cortana-at-work/cortana-at-work-o365.md) +## [Testing scenarios using Cortana in your business or organization](cortana-at-work/cortana-at-work-testing-scenarios.md) +### [Test scenario 1 - Sign into Azure AD, enable the wake word, and try a voice query](cortana-at-work/test-scenario-1.md) +### [Test scenario 2 - Perform a quick search with Cortana at work](cortana-at-work/test-scenario-2.md) +### [Test scenario 3 - Set a reminder for a specific location using Cortana at work](cortana-at-work/test-scenario-3.md) +### [Test scenario 4 - Use Cortana at work to find your upcoming meetings](cortana-at-work/test-scenario-4.md) +### [Test scenario 5 - Use Cortana to send email to a co-worker](cortana-at-work/test-scenario-5.md) +### [Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work/test-scenario-6.md) +### [Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device](cortana-at-work/cortana-at-work-scenario-7.md) +## [Set up and test custom voice commands in Cortana for your organization](cortana-at-work/cortana-at-work-voice-commands.md) +## [Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization](cortana-at-work/cortana-at-work-policy-settings.md) ## [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) ## [Configure kiosks and digital signs on Windows desktop editions](kiosk-methods.md) ### [Prepare a device for kiosk configuration](kiosk-prepare.md) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 700b2a16cc..875beb0290 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -2,7 +2,7 @@ title: Change history for Configure Windows 10 (Windows 10) ms.reviewer: manager: dansimp -description: View changes to documentation for configuring Windows 10. +description: Learn about new and updated topics in the Configure Windows 10 documentation for Windows 10 and Windows 10 Mobile. keywords: ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/changes-to-start-policies-in-windows-10.md b/windows/configuration/changes-to-start-policies-in-windows-10.md index 0a333370c9..fe5186f6cf 100644 --- a/windows/configuration/changes-to-start-policies-in-windows-10.md +++ b/windows/configuration/changes-to-start-policies-in-windows-10.md @@ -1,6 +1,6 @@ --- title: Changes to Group Policy settings for Windows 10 Start menu (Windows 10) -description: Windows 10 has a brand new Start experience. +description: Learn about changes to Group Policy settings for the Windows 10 Start menu. Also, learn about the new Windows 10 Start experience. ms.assetid: 612FB68A-3832-451F-AA97-E73791FEAA9F ms.reviewer: manager: dansimp diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index 037e389943..1e6ec5db4b 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -1,6 +1,6 @@ --- title: Configure Windows 10 taskbar (Windows 10) -description: Admins can pin apps to users' taskbars. +description: Administrators can pin additional apps to the taskbar and remove default pinned apps from the taskbar by adding a section to a layout modification XML file. keywords: ["taskbar layout","pin apps"] ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index 250b7d99b0..9e2aea142f 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -13,10 +13,6 @@ manager: dansimp --- # Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, your salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. This can even include getting company-specific news that surfaces when the person is meeting with a representative from another company. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md index 8def5a04c7..d89ff3d90b 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md @@ -1,6 +1,6 @@ --- -title: Send feedback about Cortana at work back to Microsoft (Windows 10) -description: How to send feedback to Microsoft about Cortana at work. +title: Send feedback about Cortana at work back to Microsoft +description: Learn how to send feedback to Microsoft about Cortana at work so you can provide more information to help diagnose reported issues.. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -12,15 +12,14 @@ ms.reviewer: manager: dansimp --- -# Send feedback about Cortana at work back to Microsoft -**Applies to:** +# Send feedback about Cortana back to Microsoft -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +To provide feedback on an individual request or response, select the item in the conversation history and then select **Give feedback**. This opens the Feedback Hub application where you can provide more information to help diagnose reported issues. -We ask that you report bugs and issues. To provide feedback, you can click the **Feedback** icon in the Cortana window. When you send this form to Microsoft it also includes troubleshooting info, in case you run into problems. +:::image type="content" source="../screenshot1.png" alt-text="Screenshot: Send feedback page"::: -![Cortana at work, showing how to provide feedback to Microsoft](../images/cortana-feedback.png) +To provide feedback about the application in general, go to the **Settings** menu by selecting the three dots in the top left of the application, and select **Feedback**. This opens the Feedback Hub where more information on the issue can be provided. -If you don't want to use the feedback tool in Cortana, you can add feedback through the general Windows Insider Program feedback app. For info about the feedback app, see [How to use Windows Insider Preview – Updates and feedback](https://windows.microsoft.com/en-us/windows/preview-updates-feedback-pc). +:::image type="content" source="../screenshot12.png" alt-text="Screenshot: Select Feedback to go to the Feedback Hub"::: +In order for enterprise users to provide feedback, admins must unblock the Feedback Hub in the [Azure portal](https://portal.azure.com/). Go to the **Enterprise applications section** and enable **Users can allow apps to access their data**. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md index 3ec17f6e6c..e78c383c6d 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md @@ -1,5 +1,5 @@ --- -title: Set up and test Cortana with Office 365 in your organization (Windows 10) +title: Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization description: Learn how to connect Cortana to Office 365 so employees are notified about regular meetings and unusual events. You can even set an alarm for early meetings. ms.prod: w10 ms.mktglfcycl: manage @@ -12,63 +12,45 @@ ms.reviewer: manager: dansimp --- -# Set up and test Cortana with Office 365 in your organization -**Applies to:** +# Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 -Cortana in Windows 10 is already great at letting your employees quickly see what the day is going to look like, do meeting prep work like researching people in LinkedIn or getting documents ready, see where and when their meetings are going to be, get a sense of travel times to and from work, and even get updates from a calendar for upcoming trips. +## What can you do with in Windows 10, versions 1909 and earlier? +Your employees can use Cortana to help manage their day and be more productive by getting quick answers to common questions, setting reminders, adding tasks to their To-Do lists, and find out where their next meeting is. -But Cortana works even harder when she connects to Office 365, helping employees to be notified about unusual events, such as meetings over lunch or during a typical commute time, and about early meetings, even setting an alarm so the employee isn’t late. +**See also:** -![Cortana at work, showing the day's schedule pulled from Office 365](../images/cortana-o365-screen.png) +[Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10). -We’re continuing to add more and more capabilities to Cortana so she can become even more helpful with your productivity-related tasks, such as emailing, scheduling, and other tasks that are important to help you be successful. +### Before you begin +There are a few things to be aware of before you start using Cortana in Windows 10, versions 1909 and earlier. ->[!NOTE] ->For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](https://go.microsoft.com/fwlink/p/?LinkId=717379). +- **Azure Active Directory (Azure AD) account.** Before your employees can use Cortana in your org, they must be logged in using their Azure AD account through Cortana's notebook. They must also authorize Cortana to access Microsoft 365 on their behalf. -## Before you begin -There are a few things to be aware of before you start using Cortana with Office 365 in your organization. +- **Office 365 Trust Center.** Cortana in Windows 10, version 1909 and earlier, isn't a service governed by the [Online Services Terms](https://www.microsoft.com/en-us/licensing/product-licensing/products). [Learn more about how Cortana in Windows 10, versions 1909 and earlier, treats your data](https://support.microsoft.com/en-us/help/4468233/cortana-and-privacy-microsoft-privacy). -- **Software requirements.** O365 integration with Cortana is available in all countries/regions where Cortana is supported for consumers today. This includes the United States, United Kingdom, Canada, France, Italy, Germany, Spain, China, Japan, India, and Australia. As Cortana comes to more countries, it will also become available to organizations. - -- **Azure Active Directory (Azure AD) account.** Before your employees can use Cortana in your org, they must be logged in using their Azure AD account through Cortana’s notebook. They must also authorize Cortana to access Office 365 on their behalf. - -- **Office 365 Trust Center.** Cortana isn't a service covered by the Office 365 Trust Center. [Learn more about how Cortana treats your data](https://go.microsoft.com/fwlink/p/?LinkId=536419). +- Windows Information Protection (WIP). If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft Endpoint Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution. - **Troubleshooting tips.** If you run into issues, check out these [troubleshooting tips](https://go.microsoft.com/fwlink/p/?LinkId=620763). -## Turn on Cortana with Office 365 on employees’ devices -You must tell your employees to turn on Cortana before they’ll be able to use it with Office 365. +### Turn on Cortana enterprise services on employees' devices +Your employees must connect Cortana to their Microsoft 365 account to be able to use skills like email and calendar. -**To turn on local Cortana with Office 365** +#### Turn on Cortana enterprise services -1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. +1. Select the **Cortana** search box in the taskbar, and then select the **Notebook** icon. -2. Click on **Connected Services**, click **Office 365**, and then click **Connect**. - - ![Cotana at work, showing how to turn on the connected services for Office 365](../images/cortana-connect-o365.png) - - The employee can also disconnect by clicking **Disconnect** from the **Office 365** screen. - -## Turn off Cortana with Office 365 -Cortana can only access data in your Office 365 org when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off in the Microsoft 365 admin center. - -**To turn off Cortana with Office 365** -1. [Sign in to Office 365](https://www.office.com/signin) using your Azure AD account. - -2. Go to the [admin center](https://support.office.com/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547). - -3. Expand **Service Settings**, and select **Cortana**. - -4. Click **Cortana** to toggle Cortana off. - - All Office 365 functionality related to Cortana is turned off in your organization and your employees are unable to use her at work. +2. Select **Manage Skills** , select **Manage accounts** , and under **Microsoft 365** select **Link**. The employee will be directed to sign into their Microsoft 365 account. +3. The employee can also disconnect by selecting **Microsoft 365**, then **Unlink**. +#### Turn off Cortana enterprise services +Cortana in Windows 10, versions 1909 and earlier can only access data in your Microsoft 365 organization when it's turned on. If you don't want Cortana to access your corporate data, you can turn it off in the Microsoft 365 admin center. +1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/) using your admin account. +2. Select the app launcher icon in the upper-left and choose **Admin**. +3. Expand **Settings** and select **Org Settings**. +4. Select **Cortana** to toggle Cortana's access to Microsoft 365 data off. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md index cad5f5470d..5d8a6999f8 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md @@ -1,5 +1,5 @@ --- -title: Cortana integration in your business or enterprise (Windows 10) +title: Configure Cortana in Windows 10 ms.reviewer: manager: dansimp description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. @@ -11,53 +11,81 @@ ms.localizationpriority: medium ms.author: dansimp --- -# Cortana integration in your business or enterprise -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +# Configure Cortana in Windows 10 ## Who is Cortana? -Cortana is Microsoft’s personal digital assistant, who helps busy people get things done, even while at work. -Cortana has powerful configuration options, specifically optimized for your business. By signing in with an Azure Active Directory (Azure AD) account, your employees can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work. -Using Azure AD also means that you can remove an employee’s profile (for example, when an employee leaves your organization) while respecting Windows Information Protection (WIP) policies and ignoring enterprise content, such as emails, calendar items, and people lists that are marked as enterprise data. +Cortana is a personal productivity assistant in Microsoft 365, helping your users achieve more with less effort and focus on what matters. The Cortana app in Windows 10 helps users quickly get information across Microsoft 365, using typed or spoken queries to connect with people, check calendars, set reminders, add tasks, and more. -![Cortana at work, showing the About me screen](../images/cortana-about-me.png) +:::image type="content" source="../screenshot1.png" alt-text="Screenshot: Cortana home page example"::: ## Where is Cortana available for use in my organization? -You can use Cortana at work in all countries/regions where Cortana is supported for consumers. This includes the United States, United Kingdom, Canada, France, Italy, Germany, Spain, China, Japan, India, and Australia. As Cortana comes to more countries, she will also become available to enterprise customers. -Cortana is available on Windows 10, version 1703 and with limited functionality on Windows 10 Mobile, version 1703. +Your employees can use Cortana in the languages listed [here](https://support.microsoft.com/help/4026948/cortanas-regions-and-languages). However, most productivity skills are currently only enabled for English (United States), for users with mailboxes in the United States. + +The Cortana app in Windows 10, version 2004 requires the latest Microsoft Store update to support languages other than English (United States). ## Required hardware and software -Cortana requires the following hardware and software to successfully run the included scenario in your organization. -|Hardware |Description | -|---------|------------| -|Microphone |For speech interaction with Cortana. If you don't have a microphone, you can still interact with Cortana by typing in the Cortana Search Box in the taskbar. | -|Windows Phone |For location-specific reminders. You can also use a desktop device to run through this scenario, but location accuracy is usually better on phones. | -|Desktop devices |For non-phone-related scenarios. | +Cortana requires a PC running Windows 10, version 1703 or later, as well as the following software to successfully run the included scenario in your organization. +>[!NOTE] +>A microphone isn't required to use Cortana. -|Software |Minimum version | -|---------|------------| -|Client operating system |
      • **Desktop:** Windows 10, version 1703
      • **Mobile:** Windows 10 Mobile, version 1703 (with limited functionality)
      • | -|Azure Active Directory (Azure AD) |While all employees signing into Cortana need an Azure AD account; an Azure AD premium tenant isn’t required. | -|Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana, but won't turn Cortana off.

        For example:

        If you turn **Location** off, Cortana won't be able to provide location-based reminders, such as reminding you to visit the mail room when you get to work.

        If you turn **Speech** off, your employees won't be able to use “Hello Cortana” for hands free usage or voice commands to easily ask for help. | -|Windows Information Protection (WIP) (optional) |If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip)

        If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft Endpoint Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.| +| Software | Minimum version | +|---------|---------| +|Client operating system | Desktop:
        - Windows 10, version 2004 (recommended)

        - Windows 10, version 1703 (legacy version of Cortana)

        Mobile: Windows 10 mobile, version 1703 (legacy version of Cortana)

        For more information on the differences between Cortana in Windows 10, version 2004 and earlier versions, see [**How is my data processed by Cortana**](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview#how-is-my-data-processed-by-cortana) below. | +|Azure Active Directory (Azure AD) | While all employees signing into Cortana need an Azure AD account, an Azure AD premium tenant isn't required. | +|Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana but won't turn Cortana off. For example, if you turn **Speech** off, your employees won't be able to use the wake word ("Cortana") for hands-free activation or voice commands to easily ask for help. | ## Signing in using Azure AD -Your organization must have an Azure AD tenant and your employees’ devices must all be Azure AD-joined for Cortana to work properly. For info about what an Azure AD tenant is, how to get your devices joined, and other Azure AD maintenance info, see [What is an Azure AD directory?](https://msdn.microsoft.com/library/azure/jj573650.aspx) -## Cortana and privacy -We understand that there are some questions about Cortana and your organization’s privacy, including concerns about what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. For more details about these concerns, see the [Cortana, Search, and privacy: FAQ](https://windows.microsoft.com/windows-10/cortana-privacy-faq) topic. +Your organization must have an Azure AD tenant and your employees' devices must all be Azure AD-joined for the best Cortana experience. (Users may also sign into Cortana with a Microsoft account, but will not be able to use their enterprise email or calendar.) For info about what an Azure AD tenant is, how to get your devices joined, and other Azure AD maintenance info, see [Azure Active Directory documentation.](https://docs.microsoft.com/azure/active-directory/) + +## How is my data processed by Cortana? + +Cortana's approach to integration with Microsoft 365 has changed with Windows 10, version 2004 and later. + +### Cortana in Windows 10, version 2004 and later + +Cortana enterprise services that can be accessed using Azure AD through Cortana in Windows 10, version 2004 and later, meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](https://docs.microsoft.com/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365). + +#### How does Microsoft store, retain, process, and use Customer Data in Cortana? + +The table below describes the data handling for Cortana enterprise services. + + +| Name | Description | +|---------|---------| +|**Storage** |Customer Data is stored on Microsoft servers inside the Office 365 cloud. Your data is part of your tenant. Speech audio is not retained. | +|**Stays in Geo** |Customer Data is stored on Microsoft servers inside the Office 365 cloud in Geo. Your data is part of your tenant. | +|**Retention** |Customer Data is deleted when the account is closed by the tenant administrator or when a GDPR Data Subject Rights deletion request is made. Speech audio is not retained. | +|**Processing and confidentiality** |Personnel engaged in the processing of Customer Data and personal data (i) will process such data only on instructions from Customer, and (ii) will be obligated to maintain the confidentiality and security of such data even after their engagement ends. | +|**Usage** |Microsoft uses Customer Data only to provide the services agreed upon, and for purposes that are compatible with those services. Machine learning to develop and improve models is one of those purposes. Machine learning is done inside the Office 365 cloud consistent with the Online Services Terms. Your data is not used to target advertising. | + +#### How does the wake word (Cortana) work? If I enable it, is Cortana always listening? + +>[!NOTE] +>The wake word has been re-enabled in the latest version of Cortana in Windows. If you're on Windows 10, version 2004, be sure that you've updated to build 19041.329 or later to use the wake word with Cortana. For earlier builds, you can still click on the microphone button to use your voice with Cortana. + +Cortana only begins listening for commands or queries when the wake word is detected, or the microphone button has been selected. + +First, the user must enable the wake word from within Cortana settings. Once it has been enabled, a component of Windows called the [Windows Multiple Voice Assistant platform](https://docs.microsoft.com/windows-hardware/drivers/audio/voice-activation-mva#voice-activation) will start listening for the wake word. No audio is processed by speech recognition unless two local wake word detectors and a server-side one agree with high confidence that the wake word was heard. + +The first decision is made by the Windows Multiple Voice Assistant platform leveraging hardware optionally included in the user's PC for power savings. If the wake word is detected, Windows will show a microphone icon in the system tray indicating an assistant app is listening. + +:::image type="content" source="../screenshot2.png" alt-text="Screenshot: Microphone icon in the system tray indicating an assistant app is listening"::: + +At that point, the Cortana app will receive the audio, run a second, more accurate wake word detector, and optionally send it to a Microsoft cloud service where a third wake word detector will confirm. If the service does not confirm that the activation was valid, the audio will be discarded and deleted from any further processing or server logs. On the user's PC, the Cortana app will be silently dismissed, and no query will be shown in conversation history because the query was discarded. + +If all three wake word detectors agree, the Cortana canvas will show what speech has been recognized. + +### Cortana in Windows 10, versions 1909 and earlier + +Cortana in Windows 10, versions 1909 and earlier, isn't a service covered by the Office 365 Trust Center. [Learn more about how Cortana in Windows 10, version 1909 and earlier, treats your data](https://go.microsoft.com/fwlink/p/?LinkId=536419). Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). ## See also + - [What is Cortana?](https://go.microsoft.com/fwlink/p/?LinkId=746818) - -- [Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10) - -- [Cortana for developers](https://go.microsoft.com/fwlink/?LinkId=717385) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md index 0122fb2eb7..1729809a44 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md @@ -13,34 +13,40 @@ manager: dansimp --- # Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization -**Applies to:** - -- Windows 10 -- Windows 10 Mobile >[!NOTE] ->For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=717381). - -|Group policy |MDM policy |Description | -|-------------|-----------|------------| -|Computer Configuration\Administrative Templates\Windows Components\Search\AllowCortanaAboveLock|AboveLock/AllowCortanaAboveLock|Specifies whether an employee can interact with Cortana using voice commands when the system is locked.

        **Note**
        This setting only applies to Windows 10 for desktop devices. | -|Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options\Allow users to enable online speech recognition services|Privacy/AllowInputPersonalization|Specifies whether an employee can use voice commands with Cortana in your organization.

        **In Windows 10, version 1511**
        Cortana won’t work if this setting is turned off (disabled).

        **In Windows 10, version 1607 and later**
        Cortana still works if this setting is turned off (disabled).| -|None|System/AllowLocation|Specifies whether to allow app access to the Location service.

        **In Windows 10, version 1511**
        Cortana won’t work if this setting is turned off (disabled).

        **In Windows 10, version 1607 and later**
        Cortana still works if this setting is turned off (disabled).| -|None|Accounts/AllowMicrosoftAccountConnection|Specifies whether to allow employees to sign in using a Microsoft account (MSA) from Windows apps.

        Use this setting if you only want to support Azure AD in your organization.| -|Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location|Search/AllowSearchToUseLocation|Specifies whether Cortana can use your current location during searches and for location reminders.| -|Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search|Search/SafeSearchPermissions|Specifies what level of safe search (filtering adult content) is required.

        **Note**
        This setting only applies to Windows 10 Mobile. Other versions of Windows should use Don't search the web or display web results. | -|User Configuration\Administrative Templates\Windows Components\File Explorer\Turn off display of recent search entries in the File Explorer search box|None|Specifies whether the search box can suggest recent queries and prevent entries from being stored in the registry for future reference.| -|Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results|None|Specifies whether search can perform queries on the web and if the web results are displayed in search.

        **In Windows 10 Pro edition**
        This setting can’t be managed.

        **In Windows 10 Enterprise edition**
        Cortana won't work if this setting is turned off (disabled).| -|Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana|Experience/AllowCortana|Specifies whether employees can use Cortana.

        **Important**
        Cortana won’t work if this setting is turned off (disabled). However, employees can still perform local searches even with Cortana turned off.| - - - - - - - - - - +>For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) topic, located in the configuration service provider reference topics. +|**Group policy** |**MDM policy** |**Description** | +|---------|---------|---------| +|Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana |Experience/AllowCortana |Specifies whether employees can use Cortana.
        +> [!IMPORTANT] +> Cortana won’t work if this setting is turned off (disabled). However, on Windows 10, version 1809 and below, employees can still perform local searches even with Cortana turned off. | +|Computer Configuration\Administrative Templates\Windows Components\Search\AllowCortanaAboveLock |AboveLock/AllowCortanaAboveLock |Specifies whether an employee can interact with Cortana using voice commands when the system is locked.
        +> [!NOTE] +> Cortana in Windows 10, versions 2004 and later do not currently support Above Lock. | +|Computer Configuration\Administrative Templates\Windows Components\App Privacy\LetAppsActivateWithVoice |[Privacy/LetAppsActivateWithVoice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsactivatewithvoice) |Specifies whether apps (such as Cortana or other voice assistants) can activate using a wake word (e.g. “Hey Cortana”).
        +> [!NOTE] +> This setting only applies to Windows 10 versions 2004 and later. To disable wake word activation on Windows 10 versions 1909 and earlier, you will need to disable voice commands using Privacy/AllowInputPersonalization. | +|Computer Configuration\Administrative Templates\Windows Components\App Privacy\LetAppsAccessMicrophone |[Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmicrophone-forcedenytheseapps) | Use this to disable Cortana’s access to the microphone. To do so, specify Cortana’s Package Family Name: Microsoft.549981C3F5F10_8wekyb3d8bbwe
        +Users will still be able to type queries to Cortana. | +|Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options\Allow users to enable online speech recognition services |Privacy/AllowInputPersonalization |Specifies whether an employee can use voice commands with Cortana in your organization.
        +**In Windows 10, version 1511**
        Cortana won’t work if this setting is turned off (disabled).
        **In Windows 10, version 1607 and later**
        Non-speech aspects of Cortana will still work if this setting is turned off (disabled).
        **In Windows 10, version 2004 and later**
        Cortana will work, but voice input will be disabled. | +|None |System/AllowLocation |Specifies whether to allow app access to the Location service.
        +**In Windows 10, version 1511**
        Cortana won’t work if this setting is turned off (disabled).
        +**In Windows 10, version 1607 and later**
        +Cortana still works if this setting is turned off (disabled).
        +**In Windows 10, version 2004 and later**
        +Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later do not currently use the Location service. | +|None |Accounts/AllowMicrosoftAccountConnection |Specifies whether to allow employees to sign in using a Microsoft account (MSA) from Windows apps.
        +Disable this setting if you only want to allow users to sign in with their Azure AD account. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location |Search/AllowSearchToUseLocation |Specifies whether Cortana can use your current location during searches and for location reminders.
        +**In Windows 10, version 2004 and later**
        Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later, do not currently use the Location service. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results |Search/DoNotUseWebResults |Specifies whether search can perform queries on the web and if the web results are displayed in search.
        +**In Windows 10 Pro edition**
        This setting can’t be managed. +**In Windows 10 Enterprise edition**
        Cortana won't work if this setting is turned off (disabled). +**In Windows 10, version 2004 and later**
        This setting no longer affects Cortana. | +|Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search |Search/SafeSearchPermissions |Specifies what level of safe search (filtering adult content) is required.
        +> [!NOTE] +> This setting only applies to Windows 10 Mobile. Other versions of Windows should use Don't search the web or display web results. | \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index 1239cdfc7a..6bf6aaf7bd 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -13,10 +13,6 @@ manager: dansimp --- # Set up and test Cortana for Power BI in your organization -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 >[!IMPORTANT] >Cortana for Power BI is deprecated and will not be available in future releases. This topic is provided as a reference for previous versions only. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md index a7b6e72c12..e2dfea47f8 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md @@ -1,5 +1,5 @@ --- -title: Sign-in to Azure AD and manage notebook with Cortana (Windows 10) +title: Sign into Azure AD, enable the wake word, and try a voice query description: A test scenario walking you through signing in and managing the notebook. ms.prod: w10 ms.mktglfcycl: manage @@ -7,54 +7,28 @@ ms.sitesec: library author: dansimp ms.localizationpriority: medium ms.author: dansimp -ms.date: 10/05/2017 ms.reviewer: manager: dansimp --- -# Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook +# Test scenario 1 – Sign into Azure AD, enable the wake word, and try a voice query -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +>[!NOTE] +>The wake word has been re-enabled in the latest version of Cortana in Windows. If you're on Windows 10, version 2004, be sure that you've updated to build 19041.329 or later to use the wake word with Cortana. For earlier builds, you can still click on the microphone button to use your voice with Cortana. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +1. Select the **Cortana** icon in the task bar and sign in using your Azure AD account. -This scenario turns on Azure AD and let's your employee use Cortana to manage an entry in the notebook. +2. Select the "…" menu and select **Talking to Cortana**. -## Turn on Azure AD -This process helps you to sign out of a Microsoft Account and to sign into an Azure AD account. +3. Toggle **Wake word** to **On** and close Cortana. -1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, and then click **About Me**. +4. Say **Cortana, what can you do?** -2. Click your email address. + When you say **Cortana**, Cortana will open in listening mode to acknowledge the wake word. - A dialog box appears, showing the associated account info. + :::image type="content" source="../screenshot4.png" alt-text="Screenshot: Cortana listening mode"::: -3. Click your email address again, and then click **Sign out**. + Once you finish saying your query, Cortana will open with the result. - This signs out the Microsoft account, letting you continue to add and use the Azure AD account. - -4. Click the **Search** box and then the **Notebook** icon in the left rail. This will start the sign-in request. - -5. Click **Sign-In** and follow the instructions. - -6. When you’re asked to sign in, you’ll need to choose an Azure AD account, which will look like kelliecarlson@contoso.com. - - >[!IMPORTANT] - >If there’s no Azure AD account listed, you’ll need to go to **Windows Settings > Accounts > Email & app accounts**, and then click **Add a work or school account** to add it. - -## Use Cortana to manage the notebook content -This process helps you to manage the content Cortana shows in your Notebook. - -1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, scroll down and click **Weather**. - -2. In the **Weather** settings, scroll down to the **Cities your tracking** area, and then click **Add a city**. - -3. Add *Redmond, Washington*, double-click the search result, click **Add**, and then click **Save**. - - ![Cortana at work, showing the multiple Weather screens](../images/cortana-weather-multipanel.png) - -4. Click on the **Home** icon and scroll to the weather forecast for Redmond, Washington. - - ![Cortana at work, showing Redmond, WA weather](../images/cortana-redmond-weather.png) +>[!NOTE] +>If you've disabled the wake word using MDM or Group Policy, you will need to manually activate the microphone by selecting Cortana, then the mic button. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md index c58d165771..d4e6253873 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md @@ -12,32 +12,15 @@ ms.reviewer: manager: dansimp --- -# Test scenario 2 - Perform a quick search with Cortana at work +# Test scenario 2 – Perform a Bing search with Cortana -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +1. Select the **Cortana** icon in the taskbar. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +2. Type **What time is it in Hyderabad?**. -This scenario helps you perform a quick search using Cortana, both by typing and through voice commands. +Cortana will respond with the information from Bing. -## Search using Cortana -This process helps you use Cortana at work to perform a quick search. +:::image type="content" source="../screenshot5.png" alt-text="Screenshot: Cortana showing current time in Hyderabad"::: -1. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. - -2. Type *Weather in New York*. - - You should see the weather in New York, New York at the top of the search results. - - ![Cortana at work, showing the weather in New York, New York](../images/cortana-newyork-weather.png) - -## Search with Cortana, by using voice commands -This process helps you to use Cortana at work and voice commands to perform a quick search. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). - -2. Say *What's the weather in Chicago?* Cortana tells you and shows you the current weather in Chicago. - - ![Cortana at work, showing the current weather in Chicago, IL](../images/cortana-chicago-weather.png) +>[!NOTE] +>This scenario requires Bing Answers to be enabled. To learn more, see [Set up and configure the Bing Answers feature](https://docs.microsoft.com/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10#set-up-and-configure-the-bing-answers-feature). \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md index d072cdb5fa..5382e5665c 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md @@ -12,77 +12,14 @@ ms.reviewer: manager: dansimp --- -# Test scenario 3 - Set a reminder for a specific location using Cortana at work +# Test scenario 3 - Set a reminder -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +This scenario helps you set up, review, and edit a reminder. For example, you can remind yourself to send someone a link to a document after a meeting. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +1. Select the **Cortana** icon in the taskbar and type **Remind me to send a link to the deck at 3:05pm** and press **Enter**. -This scenario helps you set up, review, and edit a reminder based on a location. For example, reminding yourself to grab your expense report receipts before you leave the house. +Cortana will create a reminder in Microsoft To Do and will remind you at the appropriate time. ->[!NOTE] ->You can set each reminder location individually as you create the reminders, or you can go into the **About me** screen and add both **Work** and **Home** addresses as favorites. Make sure that you use real addresses since you’ll need to go to these locations to complete your testing scenario.

        Additionally, if you’ve turned on the **Meeting & reminder cards & notifications** option (in the **Meetings & reminders** option of your Notebook), you’ll also see your pending reminders on the Cortana **Home** page. +:::image type="content" source="../screenshot6.png" alt-text="Screenshot: Cortana set a reminder"::: -## Create a reminder for a specific location -This process helps you to create a reminder based on a specific location. - -1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. - -2. Click the **+** sign, add a subject for your reminder, such as _Remember to file expense report receipts_, and then click **Place**. - - ![Cortana at work, showing the add a reminder screens](../images/cortana-add-reminder.png) - -3. Choose **Arrive** from the drop-down box, and then type a location to associate with your reminder. For example, you can use the physical address of where you work. Just make sure you can physically get to your location, so you can test the reminder. - - ![Cortana at work, showing how to add a place to the reminder screens](../images/cortana-place-reminder.png) - -4. Click **Done**. - - >[!NOTE] - >If you’ve never used this location before, you’ll be asked to add a name for it so it can be added to the **Favorites list** in Windows Maps. - -5. Choose to be reminded the **Next time you arrive at the location** or on a specific day of the week from the drop-down box. - -6. Take a picture of your receipts and store them locally on your device. - -7. Click **Add Photo**, click **Library**, browse to your picture, and then click **OK**. - - The photo is stored with the reminder. - - ![Cortana at work, showing the stored image in the reminder screens](../images/cortana-final-reminder.png) - -8. Review the reminder info, and then click **Remind**. - - The reminder is saved and ready to be triggered. - - ![Cortana at work, showing the final reminder](../images/cortana-reminder-pending.png) - -## Create a reminder for a specific location by using voice commands -This process helps you to use Cortana at work and voice commands to create a reminder for a specific location. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). - -2. Say _Remind me to grab my expense report receipts before I leave home_. - - Cortana opens a new reminder task and asks if it sounds good. - - ![Cortana at work, showing the reminder created through voice commands](../images/cortana-reminder-mic.png) - -3. Say _Yes_ so Cortana can save the reminder. - - ![Cortana at work, showing the final reminder created through voice commands](../images/cortana-reminder-pending-mic.png) - -## Edit or archive an existing reminder -This process helps you to edit or archive and existing or completed reminder. - -1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. - - ![Cortana at work, showing the list of pending reminders](../images/cortana-reminder-list.png) - -2. Click the pending reminder you want to edit. - - ![Cortana at work, showing the reminder editing screen](../images/cortana-reminder-edit.png) - -3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click **Save** to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. +:::image type="content" source="../screenshot7.png" alt-text="Screenshot: Cortana showing reminder on page"::: \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md index 4ea208fcfd..1a34778608 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md @@ -12,42 +12,16 @@ ms.reviewer: manager: dansimp --- -# Test scenario 4 - Use Cortana at work to find your upcoming meetings +# Test scenario 4 - Use Cortana to find free time on your calendar -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +This scenario helps you find out if a time slot is free on your calendar. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. - -This scenario helps you search for both general upcoming meetings, and specific meetings, both manually and verbally. - ->[!NOTE] ->If you’ve turned on the **Meeting & reminder cards & notifications** option (in the **Meetings & reminders** option of your Notebook), you’ll also see your pending reminders on the Cortana **Home** page. - -## Find out about upcoming meetings -This process helps you find your upcoming meetings. - -1. Check to make sure your work calendar is connected and synchronized with your Azure AD account. +1. Select the **Cortana** icon in the taskbar. 2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. -3. Type _Show me my meetings for tomorrow_. - - You’ll see all your meetings scheduled for the next day. - - ![Cortana at work, showing all upcoming meetings](../images/cortana-meeting-tomorrow.png) - -## Find out about upcoming meetings by using voice commands -This process helps you to use Cortana at work and voice commands to find your upcoming meetings. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. - -2. Say _Show me what meeting I have at 3pm tomorrow_. - - >[!IMPORTANT] - >Make sure that you have a meeting scheduled for the time you specify here. - - ![Cortana at work, showing the meeting scheduled for 3pm](../images/cortana-meeting-specific-time.png) +3. Type **Am I free at 3 PM tomorrow?** +Cortana will respond with your availability for that time, as well as nearby meetings. +:::image type="content" source="../screenshot8.png" alt-text="Screenshot: Cortana showing free time on a calendar"::: \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md index f5efc05577..6312ad8983 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md @@ -12,48 +12,14 @@ ms.reviewer: manager: dansimp --- -# Test scenario 5 - Use Cortana to send email to a co-worker +# Test scenario 5 - Test scenario 5 – Find out about a person -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +Cortana can help you quickly look up information about someone or the org chart. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +1. Select the **Cortana** icon in the taskbar. -This scenario helps you to send an email to a co-worker listed in your work address book, both manually and verbally. +2. Type or select the mic and say, **Who is name of person in your organization's?** -## Send an email to a co-worker -This process helps you to send a quick message to a co-worker from the work address book. +:::image type="content" source="../screenshot9.png" alt-text="Screenshot: Cortana showing name of person in your organization"::: -1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. - -2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. - -3. Type _Send an email to <contact_name>_. - - Where _<contact_name>_ is the name of someone in your work address book. - -4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. - - ![Cortana at work, showing the email text](../images/cortana-send-email-coworker.png) - -## Send an email to a co-worker by using voice commands -This process helps you to use Cortana at work and voice commands to send a quick message to a co-worker from the work address book. - -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. - -2. Say _Send an email to <contact_name>_. - - Where _<contact_name>_ is the name of someone in your work address book. - -3. Add your email message by saying, _Hello this is a test email using Cortana at work._ - - The message is added and you’re asked if you want to **Send it**, **Add more**, or **Make changes**. - - ![Cortana at work, showing the email text created from verbal commands](../images/cortana-send-email-coworker-mic.png) - -4. Say _Send it_. - - The email is sent. - - ![Cortana at work, showing the sent email text](../images/cortana-complete-send-email-coworker-mic.png) +Cortana will respond with information about the person. You can select the person to see more information about them in Microsoft Search. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md index f5ffb003b7..b2c7bdd9dd 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md @@ -12,38 +12,14 @@ ms.reviewer: manager: dansimp --- -# Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email +# Test scenario 6 – Change your language and perform a quick search with Cortana -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 +Cortana can help employees in regions outside the US search for quick answers like currency conversions, time zone conversions, or weather in their location. ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). +1. Select the **Cortana** icon in the taskbar. -Cortana automatically finds patterns in your email, suggesting reminders based things that you said you would do so you don’t forget about them. For example, Cortana recognizes that if you include the text, _I’ll get this to you by the end of the week_ in an email, you're making a commitment to provide something by a specific date. Cortana can now suggest that you be reminded about this event, letting you decide whether to keep it or to cancel it. +2. Select the **…** menu, then select **Settings**, **Language**, then select **Español (España)**. You will be prompted to restart the app. ->[!NOTE] ->The Suggested reminders feature is currently only available in English (en-us). - -**To use Cortana to create Suggested reminders for you** - -1. Make sure that you've connected Cortana to Office 365. For the steps to connect, see [Set up and test Cortana with Office 365 in your organization](cortana-at-work-o365.md). - -2. Click on the **Cortana** search box in the taskbar, click the **Notebook** icon, and then click **Permissions**. - -3. Make sure the **Contacts, email, calendar, and communication history** option is turned on. - - ![Permissions options for Cortana at work](../images/cortana-communication-history-permissions.png) - -4. Click the **Notebook** icon again, click the **Suggested reminders** option, click to turn on the **All reminder suggestions cards** option, click the **Notify me when something I mentioned doing is coming up** box, and then click **Save**. - - ![Suggested reminders options for Cortana at work](../images/cortana-suggested-reminder-settings.png) - -5. Create and send an email to yourself (so you can see the Suggested reminder), including the text, _I’ll finish this project by end of day today_. - -6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. - - If the reminder has a specific date or time associated with it, like end of day, Cortana notifies you at the appropriate time and puts the reminder into the Action Center. Also from the Home screen, you can view the email where you made the promise, set aside time on your calendar, officially set the reminder, or mark the reminder as completed. - - ![Cortana Home screen with your suggested reminder showing](../images/cortana-suggested-reminder.png) +3. Once the app has restarted, type or say **Convierte 100 Euros a Dólares**. +:::image type="content" source="../screenshot10.png" alt-text="Screenshot: Cortana showing a change your language and showing search results in Spanish"::: \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md index a00867e25b..c10a722ceb 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md @@ -14,9 +14,6 @@ manager: dansimp # Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md index 936f8b5788..9ab3b96e22 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md @@ -13,26 +13,19 @@ manager: dansimp --- # Testing scenarios using Cortana in your business or organization -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: -- [Sign-in to Cortana using Azure AD, manage entries in the notebook, and search for content across your device, Bing, and the cloud, using Cortana](cortana-at-work-scenario-1.md) +- [Sign into Azure AD, enable the Cortana wake word, and try a voice query](cortana-at-work-scenario-1.md) -- [Perform a quick search with Cortana at work](cortana-at-work-scenario-2.md) +- [Perform a Bing search with Cortana](cortana-at-work-scenario-2.md) -- [Set a reminder and have it remind you when you’ve reached a specific location](cortana-at-work-scenario-3.md) +- [Set a reminder](cortana-at-work-scenario-3.md) -- [Search for your upcoming meetings on your work calendar](cortana-at-work-scenario-4.md) +- [Use Cortana to find free time on your calendar](cortana-at-work-scenario-4.md) -- [Send an email to a co-worker from your work email app](cortana-at-work-scenario-5.md) +- [Find out about a person](cortana-at-work-scenario-5.md) -- [Review a reminder suggested by Cortana based on what you’ve promised in email](cortana-at-work-scenario-6.md) +- [Change your language and perform a quick search with Cortana](cortana-at-work-scenario-6.md) -- [Use Windows Information Protection (WIP) to secure content on a device and then try to manage your organization’s entries in the notebook](cortana-at-work-scenario-7.md) - ->[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. +- [Use Windows Information Protection (WIP) to secure content on a device and then try to manage your organization’s entries in the notebook](cortana-at-work-scenario-7.md) \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index 9ae00ff891..a0e470eed5 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -13,15 +13,11 @@ manager: dansimp --- # Set up and test custom voice commands in Cortana for your organization -**Applies to:** - -- Windows 10, version 1703 -- Windows 10 Mobile, version 1703 - -Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. >[!NOTE] ->For more info about how your developer can extend your current apps to work directly with Cortana, see [The Cortana Skills Kit](https://docs.microsoft.com/cortana/getstarted). +>This content applies to Cortana in versions 1909 and earlier, but will not be available in future releases. + +Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. ## High-level process Cortana uses a Voice Command Definition (VCD) file, aimed at an installed app, to define the actions that are to happen during certain vocal commands. A VCD file can be very simple to very complex, supporting anything from a single sound to a collection of more flexible, natural language sounds, all with the same intent. @@ -36,7 +32,7 @@ To enable voice commands in Cortana - **Start Cortana removing focus from your app, using specific voice-enabled statements.** [Activate a background app in Cortana using voice commands](https://docs.microsoft.com/cortana/voice-commands/launch-a-background-app-with-voice-commands-in-cortana). -2. **Install the VCD file on employees' devices**. You can use Microsoft Endpoint Configuration Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization. +2. **Install the VCD file on employees' devices**. You can use Microsoft Endpoint Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization. ## Test scenario: Use voice commands in a Microsoft Store app While these aren't line-of-business apps, we've worked to make sure to implement a VCD file, allowing you to test how the functionality works with Cortana in your organization. diff --git a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md new file mode 100644 index 0000000000..da23d57297 --- /dev/null +++ b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md @@ -0,0 +1,49 @@ +--- +title: Set up and test Cortana in Windows 10, version 2004 and later +ms.reviewer: +manager: dansimp +description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +--- + +# Set up and test Cortana in Windows 10, version 2004 and later + +## Before you begin + +- If your enterprise had previously disabled Cortana for your employees using the **Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana** Group Policy or the **Experience\AllowCortana** MDM setting but want to enable it now that Cortana is part of Microsoft 365, you will need to re-enable it at least for Windows 10, version 2004 and later. +- **Cortana is regularly updated through the Microsoft Store.** Beginning with Windows 10, version 2004, Cortana is an appx preinstalled with Windows and is regularly updated through the Microsoft Store. To receive the latest updates to Cortana, you will need to [enable updates through the Microsoft Store](https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store). + +## Set up and configure the Bing Answers feature +Bing Answers provides fast, authoritative results to search queries based on search terms. When the Bing Answers feature is enabled, users will be able to ask Cortana web-related questions in the Cortana in Windows app, such as "What's the current weather?" or "Who is the president of the U.S.?," and get a response, based on public results from Bing.com. + +The above experience is powered by Microsoft Bing, and Cortana sends the user queries to Bing. The use of Microsoft Bing is governed by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) and [Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). + +## Configure the Bing Answers feature + +Admins can configure the Cortana in Windows Bing Answers feature for their organizations. As the admin, use the following steps to change the setting for Bing Answers at the tenant/security group level. This setting is enabled by default, so that all users who have Cortana enabled will be able to receive Bing Answers. By default, the Bing Answer feature will be available to your users. + +Users cannot enable or disable the Bing Answer feature individually. So, if you disable this feature at the tenant/security group level, no users in your organization or specific security group will be able to use Bing Answers in Cortana in Windows. + +Sign in to the [Office Configuration Admin tool](https://config.office.com/). + +Follow the steps [here](https://docs.microsoft.com/deployoffice/overview-office-cloud-policy-service#steps-for-creating-a-policy-configuration) to create this policy configuration. Once completed, the policy will look as shown below: + +:::image type="content" source="../screenshot3.png" alt-text="Screenshot: Bing policy example"::: + +## How does Microsoft handle customer data for Bing Answers? + +When a user enters a search query (by speech or text), Cortana evaluates if the request is for any of our first-party compliant skills if enabled in a specific market, and does the following: + +1. If it is for any of the first-party compliant skills, the query is sent to that skill, and results/action are returned. + +2. If it is not for any of the first-party compliant skills, the query is sent to Bing for a search of public results from Bing.com. Because enterprise searches might be sensitive, similar to [Microsoft Search in Bing](https://docs.microsoft.com/MicrosoftSearch/security-for-search#microsoft-search-in-bing-protects-workplace-searches), Bing Answers in Cortana has implemented a set of trust measures, described below, that govern how the separate search of public results from Bing.com is handled. The Bing Answers in Cortana trust measures are consistent with the enhanced privacy and security measures described in [Microsoft Search in Bing](https://docs.microsoft.com/MicrosoftSearch/security-for-search). All Bing.com search logs that pertain to Cortana traffic are disassociated from users' workplace identity. All Cortana queries issued via a work or school account are stored separately from public, non-Cortana traffic. + +Bing Answers is enabled by default for all users. However, admins can configure and change this for specific users and user groups in their organization. + +## How the Bing Answer policy configuration is applied +Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of an AAD group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-1.md b/windows/configuration/cortana-at-work/test-scenario-1.md new file mode 100644 index 0000000000..27402c3b61 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-1.md @@ -0,0 +1,46 @@ +--- +title: Test scenario 1 – Sign in with your work or school account and use Cortana to manage the notebook +description: A test scenario about how to sign in with your work or school account and use Cortana to manage the notebook. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 1 – Sign in with your work or school account and use Cortana to manage the notebook + +This scenario turns on Azure AD and lets your employee use Cortana to manage an entry in the notebook. + +## Sign in with your work or school account + +This process helps you to sign out of a Microsoft Account and to sign into an Azure AD account. + +1. Click on the **Cortana** icon in the taskbar, then click the profile picture in the navigation to open Cortana settings. + +2. Click your email address. + +A dialog box appears, showing the associated account info. + +3. Click **Sign out** under your email address. + +This signs out the Microsoft account, letting you continue to add your work or school account. + +4. Open Cortana again and select the **Sign in** glyph in the left rail and follow the instructions to sign in with your work or school account. + +## Use Cortana to manage the notebook content + +This process helps you to manage the content Cortana shows in your Notebook. + +1. Select the **Cortana** icon in the taskbar, click **Notebook**, select **Manage Skills.** Scroll down and click **Weather**. + +2. In the **Weather** settings, scroll down to the **Cities you're tracking** area, and then click **Add a city**. + +3. Add **Redmond, Washington**. + +> [!IMPORTANT] +> The data created as part of these scenarios will be uploaded to Microsoft's Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-2.md b/windows/configuration/cortana-at-work/test-scenario-2.md new file mode 100644 index 0000000000..caf24e5f85 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-2.md @@ -0,0 +1,38 @@ +--- +title: Test scenario 2 - Perform a quick search with Cortana at work +description: A test scenario about how to perform a quick search with Cortana at work. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 2 – Perform a quick search with Cortana at work + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. + +This scenario helps you perform a quick search using Cortana, both by typing and through voice commands. + +## Search using Cortana + +1. Click on the Cortana icon in the taskbar, and then click in the Search bar. + +2. Type **Type Weather in New York**. + +You should see the weather in New York, New York at the top of the search results. +Insert screenshot + +## Search with Cortana, by using voice commands + +This process helps you to use Cortana at work and voice commands to perform a quick search. + +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box). + +2. Say **What's the weather in Chicago?** Cortana tells you and shows you the current weather in Chicago. +Insert screenshot \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-3.md b/windows/configuration/cortana-at-work/test-scenario-3.md new file mode 100644 index 0000000000..e348a1cee9 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-3.md @@ -0,0 +1,79 @@ +--- +title: Test scenario 3 - Set a reminder for a specific location using Cortana at work +description: A test scenario about how to set up, review, and edit a reminder based on a location. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 3 - Set a reminder for a specific location using Cortana at work + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. + +This scenario helps you set up, review, and edit a reminder based on a location. For example, reminding yourself to grab your expense report receipts before you leave the house. + +>[!Note] +>You can set each reminder location individually as you create the reminders, or you can go into the About me screen and add both Work and Home addresses as favorites. Make sure that you use real addresses since you’ll need to go to these locations to complete your testing scenario. + +Additionally, if you’ve turned on the Meeting & reminder cards & notifications option (in the Meetings & reminders option of your Notebook), you’ll also see your pending reminders on the Cortana Home page. + +## Create a reminder for a specific location + +This process helps you to create a reminder based on a specific location. + +1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. + +2. Click the **+** sign, add a subject for your reminder, such as **Remember to file expense report receipts**, and then click **Place**. + +3. Choose **Arrive** from the drop-down box, and then type a location to associate with your reminder. For example, you can use the physical address of where you work. Just make sure you can physically get to your location, so you can test the reminder. + +4. Click **Done**. + +>[!Note] +>If you’ve never used this location before, you’ll be asked to add a name for it so it can be added to the Favorites list in Windows Maps. + +5. Choose to be reminded the Next time you arrive at the location or on a specific day of the week from the drop-down box. + +6. Take a picture of your receipts and store them locally on your device. + +7. Click **Add Photo**, click **Library**, browse to your picture, and then click **OK**. + +The photo is stored with the reminder. + +Insert screenshot 6 + +8. Review the reminder info, and then click **Remind**. + +The reminder is saved and ready to be triggered. +Insert screenshot + +## Create a reminder for a specific location by using voice commands + +This process helps you to use Cortana at work and voice commands to create a reminder for a specific location. + +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone* icon (to the right of the Search box). + +2. Say **Remind me to grab my expense report receipts before I leave home**. + +Cortana opens a new reminder task and asks if it sounds good. +insert screenshot + +3. Say **Yes** so Cortana can save the reminder. +insert screenshot + +## Edit or archive an existing reminder + +This process helps you to edit or archive and existing or completed reminder. + +1. Click on the **Cortana** icon in the taskbar, click on the **Notebook** icon, and then click **Reminders**. + +2. Click the pending reminder you want to edit. + +3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click Save to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-4.md b/windows/configuration/cortana-at-work/test-scenario-4.md new file mode 100644 index 0000000000..a0ea0e6332 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-4.md @@ -0,0 +1,52 @@ +--- +title: Use Cortana at work to find your upcoming meetings (Windows 10) +description: A test scenario about how to use Cortana at work to find your upcoming meetings. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 4 - Use Cortana at work to find your upcoming meetings + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. + +This scenario helps you search for both general upcoming meetings, and specific meetings, both manually and verbally. + +>[!Note] +>If you’ve turned on the Meeting & reminder cards & notifications option (in the Meetings & reminders option of your Notebook), you’ll also see your pending reminders on the Cortana Home page. + +## Find out about upcoming meetings + +This process helps you find your upcoming meetings. + +1. Check to make sure your work calendar is connected and synchronized with your Azure AD account. + +2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. + +3. Type **Show me my meetings for tomorrow**. + +You’ll see all your meetings scheduled for the next day. + +Cortana at work, showing all upcoming meetings +screenshot + +## Find out about upcoming meetings by using voice commands + +This process helps you to use Cortana at work and voice commands to find your upcoming meetings. + +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box. + +2. Say **Show me what meeting I have at 3pm tomorrow**. + +>[!Important] +>Make sure that you have a meeting scheduled for the time you specify here. + +Cortana at work, showing the meeting scheduled for 3pm +screenshot \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-5.md b/windows/configuration/cortana-at-work/test-scenario-5.md new file mode 100644 index 0000000000..ec1cb06e32 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-5.md @@ -0,0 +1,61 @@ +--- +title: Use Cortana to send email to a co-worker (Windows 10) +description: A test scenario about how to use Cortana at work to send email to a co-worker. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 5 - Use Cortana to send email to a co-worker + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. + +This scenario helps you to send an email to a co-worker listed in your work address book, both manually and verbally. + +## Send email to a co-worker + +This process helps you to send a quick message to a co-worker from the work address book. + +1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. + +2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. + +3. Type **Send an email to **. + +Where is the name of someone in your work address book. + +4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. + +Cortana at work, showing the email text +screenshot + +## Send an email to a co-worker by using voice commands + +This process helps you to use Cortana at work and voice commands to send a quick message to a co-worker from the work address book. + +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the Search box. + +2. Say **Send an email** to . + +Where is the name of someone in your work address book. + +3. Add your email message by saying, **Hello this is a test email using Cortana at work**. + +The message is added and you’re asked if you want to **Send it**, **Add more**, or **Make changes**. + +Cortana at work, showing the email text created from verbal commands +screenshot + +4. Say **Send it**. + +The email is sent. + +Cortana at work, showing the sent email text +screenshot \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/test-scenario-6.md b/windows/configuration/cortana-at-work/test-scenario-6.md new file mode 100644 index 0000000000..cd22204b99 --- /dev/null +++ b/windows/configuration/cortana-at-work/test-scenario-6.md @@ -0,0 +1,48 @@ +--- +title: Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email +description: A test scenario about how to use Cortana with the Suggested reminders feature. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email + +>[!Important] +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). + +Cortana automatically finds patterns in your email, suggesting reminders based things that you said you would do so you don’t forget about them. For example, Cortana recognizes that if you include the text, I’ll get this to you by the end of the week in an email, you're making a commitment to provide something by a specific date. Cortana can now suggest that you be reminded about this event, letting you decide whether to keep it or to cancel it. + +>[!Important] +>The Suggested reminders feature is currently only available in English (en-us). + +## Use Cortana to create suggested reminders for you + +1. Make sure that you've connected Cortana to Office 365. For the steps to connect, see [Set up and test Cortana with Office 365 in your organization](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365). + +2. Click on the **Cortana** search box in the taskbar, click the **Notebook** icon, and then click **Permissions**. + +3. Make sure the **Contacts**, **email**, **calendar**, and **communication history** option is turned on. + +Permissions options for Cortana at work +screenshot + +4. Click the **Notebook** icon again, click the **Suggested reminders** option, click to turn on the **All reminder suggestions cards** option, click the **Notify me when something I mentioned doing is coming up** box, and then click **Save**. + +Suggested reminders options for Cortana at work +screenshot + +5. Create and send an email to yourself (so you can see the Suggested reminder), including the text, **I’ll finish this project by end of day today**. + +6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. + +If the reminder has a specific date or time associated with it, like end of day, Cortana notifies you at the appropriate time and puts the reminder into the Action Center. Also from the Home screen, you can view the email where you made the promise, set aside time on your calendar, officially set the reminder, or mark the reminder as completed. + +Cortana Home screen with your suggested reminder showing +screenshot \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md b/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md new file mode 100644 index 0000000000..01bd26ace5 --- /dev/null +++ b/windows/configuration/cortana-at-work/testing-scenarios-using-cortana-in-business-org.md @@ -0,0 +1,25 @@ +--- +title: Testing scenarios using Cortana in your business or organization +description: A list of suggested testing scenarios that you can use to test Cortana in your organization. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp +--- + +# Testing scenarios using Cortana in your business or organization + +We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: + +- [Sign in with your work or school account and use Cortana to manage the notebook](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1) +- [Perform a quick search with Cortana at work](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2) +- [Set a reminder for a specific location using Cortana at work](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3) +- [Use Cortana at work to find your upcoming meetings](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4) +- [Use Cortana to send email to a co-worker](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5) +- [Review a reminder suggested by Cortana based on what you've promised in email](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6) +- [Use Cortana and Windows Information Protection (WIP) to help protect your organization's data on a device](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7) \ No newline at end of file diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 3cd4ad2b71..ebadfd9803 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -1,5 +1,5 @@ --- -title: Customize Windows 10 Start and tasbkar with Group Policy (Windows 10) +title: Customize Windows 10 Start and taskbar with Group Policy (Windows 10) description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain. ms.assetid: F4A47B36-F1EF-41CD-9CBA-04C83E960545 ms.reviewer: diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index ea2a557e39..0a784d5c01 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -32,18 +32,29 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", "feedback_system": "None", - "hideEdit": true, + "hideEdit": false, "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-configuration", "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Configure Windows" + "titleSuffix": "Configure Windows", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], + "searchScope": ["Windows 10"] }, "fileMetadata": {}, "template": [], diff --git a/windows/configuration/images/Shared_PC_1.jpg b/windows/configuration/images/Shared_PC_1.jpg new file mode 100644 index 0000000000..7b993b00a8 Binary files /dev/null and b/windows/configuration/images/Shared_PC_1.jpg differ diff --git a/windows/configuration/images/Shared_PC_2.png b/windows/configuration/images/Shared_PC_2.png new file mode 100644 index 0000000000..c9d2362634 Binary files /dev/null and b/windows/configuration/images/Shared_PC_2.png differ diff --git a/windows/configuration/images/Shared_PC_3.png b/windows/configuration/images/Shared_PC_3.png new file mode 100644 index 0000000000..83b3a66fc8 Binary files /dev/null and b/windows/configuration/images/Shared_PC_3.png differ diff --git a/windows/configuration/images/configmgr-assets.PNG b/windows/configuration/images/configmgr-assets.PNG deleted file mode 100644 index 2cc50f5758..0000000000 Binary files a/windows/configuration/images/configmgr-assets.PNG and /dev/null differ diff --git a/windows/configuration/index.md b/windows/configuration/index.md index ca42852107..6d72ff398f 100644 --- a/windows/configuration/index.md +++ b/windows/configuration/index.md @@ -1,6 +1,6 @@ --- title: Configure Windows 10 (Windows 10) -description: Learn about configuring Windows 10. +description: Apply custom accessibility configurations to devices for their users using the all the features and methods available with Windows 10. keywords: Windows 10, MDM, WSUS, Windows update ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/kiosk-mdm-bridge.md b/windows/configuration/kiosk-mdm-bridge.md index 51eeccc08b..ff85a3537a 100644 --- a/windows/configuration/kiosk-mdm-bridge.md +++ b/windows/configuration/kiosk-mdm-bridge.md @@ -1,6 +1,6 @@ --- title: Use MDM Bridge WMI Provider to create a Windows 10 kiosk (Windows 10) -description: Environments that use Windows Management Instrumentation (WMI)can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. +description: Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC ms.reviewer: manager: dansimp @@ -22,9 +22,9 @@ ms.topic: article - Windows 10 Pro, Enterprise, and Education -Environments that use [Windows Management Instrumentation (WMI)](https://msdn.microsoft.com/library/aa394582.aspx) can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the MDM_AssignedAccess class. See [PowerShell Scripting with WMI Bridge Provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/using-powershell-scripting-with-the-wmi-bridge-provider) for more details about using a PowerShell script to configure AssignedAccess. +Environments that use [Windows Management Instrumentation (WMI)](https://msdn.microsoft.com/library/aa394582.aspx) can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the MDM_AssignedAccess class. For more information about using a PowerShell script to configure AssignedAccess, see [PowerShell Scripting with WMI Bridge Provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). -Here’s an example to set AssignedAccess configuration: +Here's an example to set AssignedAccess configuration: 1. Download the [psexec tool](https://technet.microsoft.com/sysinternals/bb897553.aspx). 2. Run `psexec.exe -i -s cmd.exe`. diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md index c319385e70..0ff39ff4c9 100644 --- a/windows/configuration/kiosk-methods.md +++ b/windows/configuration/kiosk-methods.md @@ -3,7 +3,7 @@ title: Configure kiosks and digital signs on Windows desktop editions (Windows 1 ms.reviewer: manager: dansimp ms.author: dansimp -description: Learn about the methods for configuring kiosks. +description: In this article, learn about the methods for configuring kiosks and digital signs on Windows desktop editions. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md index aaa526a014..f7be8e35d2 100644 --- a/windows/configuration/kiosk-prepare.md +++ b/windows/configuration/kiosk-prepare.md @@ -1,6 +1,6 @@ --- title: Prepare a device for kiosk configuration (Windows 10) -description: Some tips for device settings on kiosks. +description: Learn how to prepare a device for kiosk configuration. Also, learn about the recommended kiosk configuration changes. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC ms.reviewer: manager: dansimp @@ -158,7 +158,7 @@ The following table describes some features that have interoperability issues we

        Key sequences blocked by assigned access

        When in assigned access, some key combinations are blocked for assigned access users.

        -

        Alt+F4, Alt+Shift+TaB, Alt+Tab are not blocked by Assigned Access, it is recommended you use Keyboard Filter to block these key combinations.

        +

        Alt+F4, Alt+Shift+Tab, Alt+Tab are not blocked by Assigned Access, it is recommended you use Keyboard Filter to block these key combinations.

        Ctrl+Alt+Delete is the key to break out of Assigned Access. If needed, you can use Keyboard Filter to configure a different key combination to break out of assigned access by setting BreakoutKeyScanCode as described in WEKF_Settings.

        diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md index 327042ee5c..43317581df 100644 --- a/windows/configuration/kiosk-shelllauncher.md +++ b/windows/configuration/kiosk-shelllauncher.md @@ -20,10 +20,7 @@ ms.topic: article **Applies to** - Windows 10 Ent, Edu ->[!WARNING] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -Using Shell Launcher, you can configure a device that runs an application as the user interface, replacing the default shell (explorer.exe). In **Shell Launcher v1**, available in Windows 10, version 1809 and earlier, you can only specify a Windows desktop application as the replacement shell. In **Shell Launcher v2**, available in the next feature update to Windows 10, you can also specify a UWP app as the replacement shell. +Using Shell Launcher, you can configure a device that runs an application as the user interface, replacing the default shell (explorer.exe). In **Shell Launcher v1**, available in Windows 10, you can only specify a Windows desktop application as the replacement shell. In **Shell Launcher v2**, available in Windows 10, version 1809 and above, you can also specify a UWP app as the replacement shell. To use **Shell Launcher v2** in version 1809, you need to install the [KB4551853](https://support.microsoft.com/help/4551853) update. >[!NOTE] >Shell Launcher controls which application the user sees as the shell after sign-in. It does not prevent the user from accessing other desktop applications and system components. diff --git a/windows/configuration/kiosk-troubleshoot.md b/windows/configuration/kiosk-troubleshoot.md index 6a42e81700..479b7ca96e 100644 --- a/windows/configuration/kiosk-troubleshoot.md +++ b/windows/configuration/kiosk-troubleshoot.md @@ -1,6 +1,6 @@ --- title: Troubleshoot kiosk mode issues (Windows 10) -description: Tips for troubleshooting multi-app kiosk configuration. +description: Learn how to troubleshoot single-app and multi-app kiosk configurations, as well as common problems like sign-in issues. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 ms.reviewer: manager: dansimp diff --git a/windows/configuration/kiosk-validate.md b/windows/configuration/kiosk-validate.md index ea34adf834..02e0fbc422 100644 --- a/windows/configuration/kiosk-validate.md +++ b/windows/configuration/kiosk-validate.md @@ -1,6 +1,6 @@ --- title: Validate kiosk configuration (Windows 10) -description: This topic explains what to expect on a multi-app kiosk. +description: In this article, learn what to expect on a multi-app kiosk in Windows 10 Pro, Enterprise, and Education. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC ms.reviewer: manager: dansimp diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index c9d6d3b2c0..c0eb573c32 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -1,6 +1,6 @@ --- title: Assigned Access configuration kiosk XML reference (Windows 10) -description: XML and XSD for kiosk device configuration. +description: Learn about the assigned access configuration (kiosk) for XML and XSD for kiosk device configuration in Windows 10. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 ms.reviewer: manager: dansimp @@ -255,7 +255,7 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom ``` ## [Preview] Global Profile Sample XML -Global Profile is currently supported in Windows 10 Insider Preview (20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lock down mode, or used as mitigation when a profile cannot be determined for an user. +Global Profile is currently supported in Windows 10 Insider Preview (20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lockdown mode, or used as mitigation when a profile cannot be determined for a user. This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in ```xml @@ -309,7 +309,7 @@ This sample demonstrates that only a global profile is used, no active user conf ``` -Below sample shows dedicated profile and global profile mixed usage, aauser would use one profile, everyone else that's non-admin will use another profile. +Below sample shows dedicated profile and global profile mixed usage, a user would use one profile, everyone else that's non-admin will use another profile. ```xml @@ -889,7 +889,7 @@ Schema for Windows 10 Insider Preview (19H2, 20H1 builds) ``` -To authorize a compatible configuration XML that includes elements and attributes from Windows 10, version 1809 or newer, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the auto-launch feature which is added in Windows 10, version 1809, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10, version 1809, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. +To authorize a compatible configuration XML that includes elements and attributes from Windows 10, version 1809 or newer, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the autolaunch feature that was added in Windows 10, version 1809, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10, version 1809, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. ```xml [!NOTE] ->This explanation of CSPs and CSP documentation also applies to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. +> [!NOTE] +> The information provided here about CSPs and CSP documentation also applies to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. [See what's new for CSPs in Windows 10, version 1809.](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1809) ## What is a CSP? -A CSP is an interface in the client operating system, between configuration settings specified in a provisioning document, and configuration settings on the device. CSPs are similar to Group Policy client-side extensions, in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files or permissions. Some of these settings are configurable, and some are read-only. +In the client operating system, a CSP is the interface between configuration settings that are specified in a provisioning document and configuration settings that are on the device. CSPs are similar to Group Policy client-side extensions in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files, or permissions. Some of these settings are configurable, and some are read-only. Starting with Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. On the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10. @@ -42,15 +40,15 @@ CSPs are behind many of the management tasks and policies for Windows 10, both i ![how intune maps to csp](../images/policytocsp.png) -CSPs receive configuration policies in the XML-based SyncML format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Endpoint Configuration Manager, can also target CSPs, by using a client-side WMI-to-CSP bridge. +CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Endpoint Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. ### Synchronization Markup Language (SyncML) -The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based Synchronization Markup Language (SyncML) for data exchange between compliant servers and clients. SyncML offers an open standard to use as an alternative to vendor-specific management solutions (such as WMI). The value for enterprises adopting industry standard management protocols is that it allows the management of a broader set of vendor devices using a single platform (such as Microsoft Intune). Device policies, including VPN connection profiles, are delivered to client devices formatted as in SyncML. The target CSP reads this information and applies the necessary configurations. +The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based SyncML for data exchange between compliant servers and clients. SyncML offers an open standard to use as an alternative to vendor-specific management solutions (such as WMI). The value for enterprises adopting industry standard management protocols is that it allows the management of a broader set of vendor devices using a single platform (such as Microsoft Intune). Device policies, including VPN connection profiles, are delivered to client devices formatted as in SyncML. The target CSP reads this information and applies the necessary configurations. ### The WMI-to-CSP Bridge -The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs via scripts and traditional enterprise management software, such as Configuration Manager using Windows Management Instrumentation (WMI). The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. +The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs using scripts and traditional enterprise management software, such as Configuration Manager using WMI. The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. [Learn how to use the WMI Bridge Provider with PowerShell.](https://go.microsoft.com/fwlink/p/?LinkId=761090) @@ -60,7 +58,7 @@ Generally, enterprises rely on Group Policy or MDM to configure and manage devic In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. -Some of the topics in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md), which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. +Some of the articles in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md), which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. ### CSPs in Windows Configuration Designer @@ -74,7 +72,7 @@ Many settings in Windows Configuration Designer will display documentation for t ### CSPs in MDM -Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might simply be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). +Most, if not all, CSPs are surfaced through your MDM service. If you see a CSP that provides a capability that you want to make use of and cannot find that capability in your MDM service, contact your MDM provider for assistance. It might be named differently than you expected. You can see the CSPs supported by MDM in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). When a CSP is available but is not explicitly included in your MDM solution, you may be able to make use of the CSP by using OMA-URI settings. In Intune, for example, you can use [custom policy settings](https://go.microsoft.com/fwlink/p/?LinkID=616316) to deploy settings. Intune documents [a partial list of settings](https://go.microsoft.com/fwlink/p/?LinkID=616317) that you can enter in the **OMA-URI Settings** section of a custom policy, if your MDM service provides that extension. You'll notice that the list doesn't explain the meanings of the allowed and default values, so use the [CSP reference documentation](https://go.microsoft.com/fwlink/p/?LinkId=717390) to locate that information. @@ -116,13 +114,13 @@ The documentation for most CSPs will also include an XML example. ## CSP examples -CSPs provide access to a number of settings useful to enterprises. This section introduces two CSPs that an enterprise might find particularly useful. +CSPs provide access to a number of settings useful to enterprises. This section introduces the CSPs that an enterprise might find useful. - [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601) - The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. + The EnterpriseAssignedAccess CSP lets IT administrators configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. - In addition to lockscreen wallpaper, theme, time zone, and language, the EnterpriseAssignedAccess CSP includes AssignedAccessXml which can be used to lock down the device through the following settings: + In addition to lock screen wallpaper, theme, time zone, and language, the EnterpriseAssignedAccess CSP includes AssignedAccessXml that can be used to lock down the device through the following settings: - Enabling or disabling the Action Center. - Configuring the number of tile columns in the Start layout. @@ -132,27 +130,28 @@ CSPs provide access to a number of settings useful to enterprises. This section - Restricting access to the context menu. - Enabling or disabling tile manipulation. - Creating role-specific configurations. + - [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244) - The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. + The Policy CSP enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. Some of the settings available in the Policy CSP include the following: - - **Accounts**, such as whether a non-Microsoft account can be added to the device - - **Application management**, such as whether only Microsoft Store apps are allowed - - **Bluetooth**, such as the services allowed to use it - - **Browser**, such as restricting InPrivate browsing - - **Connectivity**, such as whether the device can be connected to a computer by USB - - **Defender** (for desktop only), such as day and time to scan - - **Device lock**, such as the type of PIN or password required to unlock the device - - **Experience**, such as allowing Cortana - - **Security**, such as whether provisioning packages are allowed - - **Settings**, such as allowing the user to change VPN settings - - **Start**, such as applying a standard Start layout - - **System**, such as allowing the user to reset the device - - **Text input**, such as allowing the device to send anonymized user text input data samples to Microsoft - - **Update**, such as specifying whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store - - **WiFi**, such as whether to enable Internet sharing + - **Accounts**, such as whether a non-Microsoft account can be added to the device. + - **Application management**, such as whether only Microsoft Store apps are allowed. + - **Bluetooth**, such as the services allowed to use it. + - **Browser**, such as restricting InPrivate browsing. + - **Connectivity**, such as whether the device can be connected to a computer by USB. + - **Defender** (for desktop only), such as day and time to scan. + - **Device lock**, such as the type of PIN or password required to unlock the device. + - **Experience**, such as allowing Cortana. + - **Security**, such as whether provisioning packages are allowed. + - **Settings**, such as enabling the user to change VPN settings. + - **Start**, such as applying a standard Start layout. + - **System**, such as allowing the user to reset the device. + - **Text input**, such as allowing the device to send anonymized user text input data samples to Microsoft. + - **Update**, such as whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. + - **WiFi**, such as whether Internet sharing is enabled. Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both: diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index 3de98a5454..f82225a7fe 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -1,6 +1,6 @@ --- title: Provision PCs with apps (Windows 10) -description: Add apps to a Windows 10 provisioning package. +description: Learn how to install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. keywords: ["runtime provisioning", "provisioning package"] ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 035bdf4010..5b464073a9 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -1,6 +1,6 @@ --- title: Create a provisioning package (Windows 10) -description: Learn how to create a provisioning package for Windows 10. Provisioning packages let you quickly configure a device without having to install a new image. +description: Learn how to create a provisioning package for Windows 10, which lets you quickly configure a device without having to install a new image. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -21,44 +21,46 @@ manager: dansimp - Windows 10 - Windows 10 Mobile -You use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings. You can apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. +You can use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings, and then apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. >[Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) ->[!TIP] ->We recommend creating a local admin account when developing and testing your provisioning package. We also recommend using a “least privileged” domain user account to join devices to the Active Directory domain. +> [!TIP] +> We recommend creating a local admin account when you develop and test your provisioning package. We also recommend using a *least privileged* domain user account to join devices to the Active Directory domain. ## Start a new project 1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, + - From either the Start screen or Start menu search, type **Windows Configuration Designer**, and then select the **Windows Configuration Designer** shortcut. or - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. + - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then select **ICD.exe**. 2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: ![Configuration Designer wizards](../images/icd-create-options-1703.png) - - The wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices. Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizardS](provisioning-packages.md#configuration-designer-wizards). + - The following wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices: - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - [Instructions for HoloLens wizard](https://technet.microsoft.com/itpro/hololens/hololens-provisioning) - [Instructions for Surface Hub wizard](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) + + Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizards](provisioning-packages.md#configuration-designer-wizards). - - The **Advanced provisioning** option opens a new project with all **Runtime settings** available. *The rest of this procedure uses advanced provisioning.* + - The **Advanced provisioning** option opens a new project with all the runtime settings available. (The rest of this procedure uses advanced provisioning.) >[!TIP] > You can start a project in the simple wizard editor and then switch the project to the advanced editor. > > ![Switch to advanced editor](../images/icd-switch.png) -3. Enter a name for your project, and then click **Next**. +3. Enter a name for your project, and then select **Next**. -4. Select the settings you want to configure, based on the type of device, and then click **Next**. The following table describes the options. +4. Select the settings you want to configure, based on the type of device, and then select **Next**. The following table describes the options. | Windows edition | Settings available for customization | Provisioning package can apply to | @@ -71,12 +73,12 @@ You use Windows Configuration Designer to create a provisioning package (.ppkg) | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) | -5. On the **Import a provisioning package (optional)** page, you can click **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then click **Finish**. +5. On the **Import a provisioning package (optional)** page, you can select **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then select **Finish**. >[!TIP] ->**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages you create so you don't have to reconfigure those common settings repeatedly. +>**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages that you create so you don't have to reconfigure those common settings repeatedly. -After you click **Finish**, Windows Configuration Designer will open the **Available customizations** pane and you can then configure settings for the package. +6. In the **Available customizations** pane, you can now configure settings for the package. @@ -94,7 +96,7 @@ The process for configuring settings is similar for all settings. The following
        - +
        step one
        Expand a category.
        Expand Certificates category
        step two
        Select a setting.
        Select ClientCertificates
        step three
        Enter a value for the setting. Click Add if the button is displayed.
        Enter a name for the certificate
        step three
        Enter a value for the setting. Select Add if the button is displayed.
        Enter a name for the certificate
        step four
        Some settings, such as this example, require additional information. In Available customizations, select the value you just created, and additional settings are displayed.
        Additional settings for client certificate
        step five
        When the setting is configured, it is displayed in the Selected customizations pane.
        Selected customizations pane
        @@ -106,39 +108,39 @@ For details on each specific setting, see [Windows Provisioning settings referen ## Build package -1. After you're done configuring your customizations, click **Export** and select **Provisioning Package**. +1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. ![Export on top bar](../images/icd-export-menu.png) -2. In the **Describe the provisioning package** window, enter the following information, and then click **Next**: +2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. - - **Version (in Major.Minor format** - - Optional. You can change the default package version by specifying a new value in the **Version** field. + - **Version (in Major.Minor format** - Optional. You can change the default package version by specifying a new value in the **Version** field. - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages). - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0. -3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate. Both selections are optional. Click **Next** after you make your selections. +3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate, and then select **Next**. Both selections are optional: - **Encrypt package** - If you select this option, an auto-generated password will be shown on the screen. - - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package. + - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by selecting **Select** and choosing the certificate you want to use to sign the package. >[!NOTE] - >You should only configure provisioning package security when the package is used for device provisioning and the package has contents with sensitive security data such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. + >You should only configure provisioning package security when the package is used for device provisioning and when the package has content with sensitive security data, such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. > >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. -4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then click **Next**. By default, Windows Configuration Designer uses the project folder as the output location. +4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then select **Next**. By default, Windows Configuration Designer uses the project folder as the output location. -5. In the **Build the provisioning package** window, click **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +5. In the **Build the provisioning package** window, select **Build**. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - If you need to cancel the build, click Cancel. This cancels the current build process, closes the wizard, and takes you back to the Customizations Page. + If you need to cancel the build, select **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations** page. -6. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +6. If your build fails, an error message will appear that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, select **Back** to change the output package name and path, and then select **Next** to start another build. -7. When you are done, click **Finish** to close the wizard and go back to the Customizations page. +7. When you are done, select **Finish** to close the wizard and go back to the **Customizations** page. **Next step**: [How to apply a provisioning package](provisioning-apply-package.md) diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index f1bf1aa323..6fc7d6234f 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -1,6 +1,6 @@ --- title: Install Windows Configuration Designer (Windows 10) -description: Learn how to install and run Windows Configuration Designer. +description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index af989096a8..b5816befcb 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -38,10 +38,10 @@ The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://develop - The tool for creating provisioning packages is renamed Windows Configuration Designer, replacing the Windows Imaging and Configuration Designer (ICD) tool. The components for creating images have been removed from Windows Configuration Designer, which now provides access to runtime settings only. - Windows Configuration Designer can still be installed from the Windows ADK. You can also install it from the Microsoft Store. - Windows Configuration Designer adds more wizards to make it easier to create provisioning packages for specific scenarios. See [What you can configure](#configuration-designer-wizards) for wizard descriptions. -- The wizard **Provision desktop devices** (previously called **Simple provisioning**) now enables joining Azure Active Directory (Azure AD) domains and also allows you to remove non-Microsoft software from Windows desktop devices during provisioning. +- The Provision desktop devices wizard (previously called Simple provisioning) now enables joining Azure Active Directory (Azure AD) domains and also allows you to remove non-Microsoft software from Windows desktop devices during provisioning. - When provisioning packages are applied to a device, a status screen indicates successful or failed provisioning. - Windows 10 includes PowerShell cmdlets that simplify scripted provisioning. Using these cmdlets, you can add provisioning packages, remove provisioning packages and generate log files to investigate provisioning errors. -- The **Provision school devices** wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store. +- The Provision school devices wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store. @@ -112,15 +112,15 @@ The following table provides some examples of settings that you can configure us | Start menu customization | Start menu layout, application pinning | | Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on | -\* Using a provisioning package for auto-enrollment to Microsoft Endpoint Configuration Manager is not supported. Use the Configuration Manager console to enroll devices. +\* Using a provisioning package for auto-enrollment to Microsoft Endpoint Manager is not supported. Use the Configuration Manager console to enroll devices. For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). ## Changes to provisioning in Windows 10, version 1607 ->[!NOTE] ->This section is retained for customers using Windows 10, version 1607, on the Current Branch for Business. Some of this information is not applicable in Windows 10, version 1703. +> [!NOTE] +> This section is retained for customers using Windows 10, version 1607, on the Current Branch for Business. Some of this information is not applicable in Windows 10, version 1703. Windows ICD for Windows 10, version 1607, simplified common provisioning scenarios. @@ -130,7 +130,7 @@ Windows ICD in Windows 10, version 1607, supported the following scenarios for I * **Simple provisioning** – Enables IT administrators to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. - > [Learn how to use simple provisioning to configure Windows 10 computers.](provision-pcs-for-initial-deployment.md) +[Learn how to use simple provisioning to configure Windows 10 computers.](provision-pcs-for-initial-deployment.md) * **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use Windows ICD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. @@ -146,9 +146,11 @@ Windows ICD in Windows 10, version 1607, supported the following scenarios for I ## Learn more -- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921) +For more information about provisioning, watch the following videos: -- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) +- [Provisioning Windows 10 devices with new tools](https://go.microsoft.com/fwlink/p/?LinkId=615921) + +- [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) ## Related topics diff --git a/windows/configuration/screenshot1.png b/windows/configuration/screenshot1.png new file mode 100644 index 0000000000..ed62740e92 Binary files /dev/null and b/windows/configuration/screenshot1.png differ diff --git a/windows/configuration/screenshot10.png b/windows/configuration/screenshot10.png new file mode 100644 index 0000000000..5cb1567235 Binary files /dev/null and b/windows/configuration/screenshot10.png differ diff --git a/windows/configuration/screenshot11.png b/windows/configuration/screenshot11.png new file mode 100644 index 0000000000..0ce852ebaa Binary files /dev/null and b/windows/configuration/screenshot11.png differ diff --git a/windows/configuration/screenshot12.png b/windows/configuration/screenshot12.png new file mode 100644 index 0000000000..cd85d80c7e Binary files /dev/null and b/windows/configuration/screenshot12.png differ diff --git a/windows/configuration/screenshot2.png b/windows/configuration/screenshot2.png new file mode 100644 index 0000000000..fb7995600e Binary files /dev/null and b/windows/configuration/screenshot2.png differ diff --git a/windows/configuration/screenshot3.png b/windows/configuration/screenshot3.png new file mode 100644 index 0000000000..07e01661c5 Binary files /dev/null and b/windows/configuration/screenshot3.png differ diff --git a/windows/configuration/screenshot4.png b/windows/configuration/screenshot4.png new file mode 100644 index 0000000000..ab1f083c71 Binary files /dev/null and b/windows/configuration/screenshot4.png differ diff --git a/windows/configuration/screenshot5.png b/windows/configuration/screenshot5.png new file mode 100644 index 0000000000..0ec6fda3a7 Binary files /dev/null and b/windows/configuration/screenshot5.png differ diff --git a/windows/configuration/screenshot6.png b/windows/configuration/screenshot6.png new file mode 100644 index 0000000000..2f3284ee77 Binary files /dev/null and b/windows/configuration/screenshot6.png differ diff --git a/windows/configuration/screenshot7.png b/windows/configuration/screenshot7.png new file mode 100644 index 0000000000..e3d80a3ac9 Binary files /dev/null and b/windows/configuration/screenshot7.png differ diff --git a/windows/configuration/screenshot8.png b/windows/configuration/screenshot8.png new file mode 100644 index 0000000000..f85eaffdff Binary files /dev/null and b/windows/configuration/screenshot8.png differ diff --git a/windows/configuration/screenshot9.png b/windows/configuration/screenshot9.png new file mode 100644 index 0000000000..f617991a63 Binary files /dev/null and b/windows/configuration/screenshot9.png differ diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index 95cf9806b1..00fb65ab30 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -9,7 +9,6 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 10/02/2018 ms.reviewer: manager: dansimp --- @@ -58,7 +57,7 @@ Apps can take advantage of shared PC mode with the following three APIs: ### Customization -Shared PC mode exposes a set of customizations to tailor the behavior to your requirements. These customizations are the options that you'll set either using MDM or a provisioning package as explained in [Configuring shared PC mode on Windows](#configuring-shared-pc-mode-on-windows). The options are listed in the following table. +Shared PC mode exposes a set of customizations to tailor the behavior to your requirements. These customizations are the options that you'll set either using MDM or a provisioning package as explained in [Configuring Shared PC mode for Windows](#configuring-shared-pc-mode-for-windows). The options are listed in the following table. | Setting | Value | |:---|:---| @@ -80,16 +79,33 @@ Shared PC mode exposes a set of customizations to tailor the behavior to your re | Customization: SleepTimeout | Specifies all timeouts for when the PC should sleep. Enter the amount of idle time in seconds. If you don't set sleep timeout, the default of 1 hour applies. | [Policies: Authentication](wcd/wcd-policies.md#authentication) (optional related setting) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. +## Configuring Shared PC mode for Windows -## Configuring shared PC mode on Windows You can configure Windows to be in shared PC mode in a couple different ways: -- Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx). Your MDM policy can contain any of the options listed in the [Customization](#customization) section. The following image shows a Microsoft Intune policy with the shared PC options added as OMA-URI settings. [Learn more about Windows 10 policy settings in Microsoft Intune.](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune) -![custom OMA-URI policy in Intune](images/oma-uri-shared-pc.png) +- Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/sharedpc-csp). To setup a shared device policy for Windows 10 in Intune, complete the following steps: -- A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx), exposed in Windows Configuration Designer as **SharedPC**. + 1. Go to the [Microsoft Endpoint Manager portal](https://endpoint.microsoft.com/#home). + 2. Select **Devices** from the navigation. + 3. Under **Policy**, select **Configuration profiles**. + 4. Select **Create profile**. + 5. From the **Platform** menu, select **Windows 10 and later**. + 6. From the **Profile** menu, select **Shared multi-user device**. -![Shared PC settings in ICD](images/icd-adv-shared-pc.png) + ![custom OMA-URI policy in Intune](images/shared_pc_1.jpg) + + 7. Select **Create**. + 8. Enter a name for the policy (e.g. My Win10 Shared devices policy). You can optionally add a description should you wish to do so. + 9. Select **Next**. + 10. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**. + + ![Shared PC settings in ICD](images/shared_pc_3.png) + + 11. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 6**. + +- A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/sharedpc-csp), exposed in Windows Configuration Designer as **SharedPC**. + + ![Shared PC settings in ICD](images/icd-adv-shared-pc.png) - WMI bridge: Environments that use Group Policy can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the [MDM_SharedPC class](https://msdn.microsoft.com/library/windows/desktop/mt779129.aspx). For all device settings, the WMI Bridge client must be executed under local system user; for more information, see [Using PowerShell scripting with the WMI Bridge Provider](https://docs.microsoft.com/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). For example, open PowerShell as an administrator and enter the following: diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index beff0509a7..f373bc8c78 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -1,6 +1,6 @@ --- title: Troubleshoot Start menu errors -description: Troubleshoot common errors related to Start menu in Windows 10. +description: Learn how to troubleshoot common Start menu errors in Windows 10. For example, learn to troubleshoot errors related to deployment, crashes, and performance. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -12,41 +12,41 @@ manager: dansimp ms.topic: troubleshooting --- -# Troubleshoot Start Menu errors +# Troubleshoot Start menu errors Start failures can be organized into these categories: - **Deployment/Install issues** - Easiest to identify but difficult to recover. This failure is consistent and usually permanent. Reset, restore from backup, or rollback to recover. - **Performance issues** - More common with older hardware, low-powered machines. Symptoms include: High CPU utilization, disk contention, memory resources. This makes Start very slow to respond. Behavior is intermittent depending on available resources. - **Crashes** - Also easy to identify. Crashes in Shell Experience Host or related can be found in System or Application event logs. This can be a code defect or related to missing or altered permissions to files or registry keys by a program or incorrect security tightening configurations. Determining permissions issues can be time consuming but a [SysInternals tool called Procmon](https://docs.microsoft.com/sysinternals/downloads/procmon) will show **Access Denied**. The other option is to get a dump of the process when it crashes and depending on comfort level, review the dump in the debugger, or have support review the data. -- **Hangs** in Shell Experience host or related. These are the hardest issues to identify as there are few events logged, but behavior is typically intermittent or recovers with a reboot. If a background application or service hangs, Start will not have resources to respond in time. Clean boot may help identify if the issue is related to additional software. Procmon is also useful in this scenario. +- **Hangs** - in Shell Experience host or related. These are the hardest issues to identify as there are few events logged, but behavior is typically intermittent or recovers with a reboot. If a background application or service hangs, Start will not have resources to respond in time. Clean boot may help identify if the issue is related to additional software. Procmon is also useful in this scenario. - **Other issues** - Customization, domain policies, deployment issues. ## Basic troubleshooting -When troubleshooting basic Start issues (and for the most part, all other Windows apps), there are a few things to check if they are not working as expected. When experiencing issues where the Start Menu or sub-component are not working, there are some quick tests to narrow down where the issue may reside. +When troubleshooting basic Start issues (and for the most part, all other Windows apps), there are a few things to check if they are not working as expected. For issues where the Start menu or subcomponent isn't working, you can do some quick tests to narrow down where the issue may reside. ### Check the OS and update version - Is the system running the latest Feature and Cumulative Monthly update? - Did the issue start immediately after an update? Ways to check: - - Powershell:[System.Environment]::OSVersion.Version + - PowerShell:[System.Environment]::OSVersion.Version - WinVer from CMD.exe ### Check if Start is installed - If Start fails immediately after a feature update, on thing to check is if the App package failed to install successfully. -- If Start was working and just fails intermittently, it's likely that Start is installed correctly, but the issue occurs downstream. The way to check for this is to look for output from these two PS commands: +- If Start was working and just fails intermittently, it's likely that Start is installed correctly, but the issue occurs downstream. The way to check for this problem is to look for output from these two PS commands: - `get-AppXPackage -Name Microsoft.Windows.ShellExperienceHost` - `get-AppXPackage -Name Microsoft.Windows.Cortana` ![Example of output from cmdlets](images/start-ts-1.png) - Failure messages will appear if they are not installed + Failure messages will appear if they aren't installed -- If Start is not installed the fastest resolution is to revert to a known good configuration. This can be rolling back the update, resetting the PC to defaults (where there is a choice to save to delete user data), or restoring from backup. There is no supported method to install Start Appx files. The results are often problematic and unreliable. +- If Start is not installed, then the fastest resolution is to revert to a known good configuration. This can be rolling back the update, resetting the PC to defaults (where there is a choice to save to delete user data), or restoring from backup. No method is supported to install Start Appx files. The results are often problematic and unreliable. ### Check if Start is running @@ -54,7 +54,7 @@ If either component is failing to start on boot, reviewing the event logs for er - `get-process -name shellexperiencehost` - `get-process -name searchui` -If it is installed but not running, test booting into safe mode or use MSCONFIG to eliminate 3rd party or additional drivers and applications. +If it is installed but not running, test booting into safe mode or use MSCONFIG to eliminate third-party or additional drivers and applications. ### Check whether the system a clean install or upgrade @@ -76,9 +76,9 @@ If these events are found, Start is not activated correctly. Each event will hav ### Other things to consider -When did this start? +When did the problem start? -- Top issues for Start Menu failure are triggered +- Top issues for Start menu failure are triggered - After an update - After installation of an application - After joining a domain or applying a domain policy @@ -87,7 +87,7 @@ When did this start? - Start or related component crashes or hangs - Customization failure -To narrow this down further, it's good to note: +To narrow down the problem further, it's good to note: - What is the install background? - Was this a deployment, install from media, other @@ -103,7 +103,7 @@ To narrow this down further, it's good to note: - Some Group Policies intended for Windows 7 or older have been known to cause issues with Start - Untested Start Menu customizations can cause unexpected behavior by typically not complete Start failures. -- Is this a virtualized environment? +- Is the environment virtualized? - VMware - Citrix - Other @@ -123,13 +123,13 @@ To narrow this down further, it's good to note: - Microsoft-Windows-CloudStore* -- Check for crashes that may be related to Start (explorer.exe, taskbar, etc) +- Check for crashes that may be related to Start (explorer.exe, taskbar, and so on) - Application log event 1000, 1001 - Check WER reports - C:\ProgramData\Microsoft\Windows\WER\ReportArchive\ - C:\ProgramData\Micrt\Windowsosof\WER\ReportQueue\ -If there is a component of Start that is consistently crashing, capture a dump which can be reviewed by Microsoft Support. +If there is a component of Start that is consistently crashing, capture a dump that can be reviewed by Microsoft Support. ## Common errors and mitigation @@ -169,7 +169,8 @@ The PDC registry key is: **Type**=dword:00000001 In addition to the listed dependencies for the service, Background Tasks Infrastructure Service requires the Power Dependency Coordinator Driver to be loaded. If the PDC does not load at boot, Background Tasks Infrastructure Service will fail and affect Start Menu. -Events for both PDC and Background Tasks Infrastructure Service will be recorded in the event logs. PDC should not be disabled or deleted. BrokerInfrastructure is an automatic service. This Service is required for all these operating Systems as running to have a stable Start Menu. + +Events for both PDC and Background Tasks Infrastructure Service will be recorded in the event logs. PDC shouldn't be disabled or deleted. BrokerInfrastructure is an automatic service. This Service is required for all these operating Systems as running to have a stable Start Menu. >[!NOTE] >You cannot stop this automatic service when machine is running (C:\windows\system32\svchost.exe -k DcomLaunch -p). @@ -179,17 +180,17 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded **Cause**: There was a change in the All Apps list between Windows 10, versions 1511 and 1607. These changes mean the original Group Policy and corresponding registry key no longer apply. -**Resolution**: This issue was resolved in the June 2017 updates. Please update Windows 10, version 1607 to the latest cumulative or feature updates. +**Resolution**: This issue was resolved in the June 2017 updates. Update Windows 10, version 1607, to the latest cumulative or feature updates. >[!NOTE] >When the Group Policy is enabled, the desired behavior also needs to be selected. By default, it is set to **None**. -### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start Menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted +### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted ![Screenshots that show download icons on app tiles and missing app tiles](images/start-ts-2.png) -**Cause**: This is a known issue where the first-time logon experience is not detected and does not trigger the install of some Apps. +**Cause**: This issue is known. The first-time sign-in experience is not detected and does not trigger the install of some apps. **Resolution**: This issue has been fixed for Windows 10, version 1709 in [KB 4089848](https://support.microsoft.com/help/4089848) March 22, 2018—KB4089848 (OS Build 16299.334) @@ -202,17 +203,17 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded - Event ID 22 is logged when the xml is malformed, meaning the specified file simply isn’t valid xml. - When editing the xml file, it should be saved in UTF-8 format. -- Unexpected information: This occurs when possibly trying to add a tile via unexpected or undocumented method. +- Unexpected information: This occurs when possibly trying to add a tile via an unexpected or undocumented method. - **Event ID: 64** is logged when the xml is valid but has unexpected values. - For example: The following error occurred while parsing a layout xml file: The attribute 'LayoutCustomizationRestrictiontype' on the element '{http://schemas.microsoft.com/Start/2014/LayoutModification}DefaultLayoutOverride' is not defined in the DTD/Schema. XML files can and should be tested locally on a Hyper-V or other virtual machine before deployment or application by Group Policy -### Symptom: Start menu no longer works after a PC is refreshed using F12 during start up +### Symptom: Start menu no longer works after a PC is refreshed using F12 during startup -**Description**: If a user is having problems with a PC, is can be refreshed, reset, or restored. Refreshing the PC is a beneficial option because it maintains personal files and settings. When users have trouble starting the PC, "Change PC settings" in Settings is not accessible. So, to access the System Refresh, users may use the F12 key at start up. Refreshing the PC finishes, but Start Menu is not accessible. +**Description**: If a user is having problems with a PC, it can be refreshed, reset, or restored. Refreshing the PC is a beneficial option because it maintains personal files and settings. When users have trouble starting the PC, "Change PC settings" in Settings is not accessible. So, to access the System Refresh, users may use the F12 key at startup. Refreshing the PC finishes, but Start Menu is not accessible. -**Cause**: This is a known issue and has been resolved in a cumulative update released August 30th 2018. +**Cause**: This issue is known and was resolved in a cumulative update released August 30, 2018. **Resolution**: Install corrective updates; a fix is included in the [September 11, 2018-KB4457142 release](https://support.microsoft.com/help/4457142). @@ -232,7 +233,7 @@ Specifically, behaviors include - Applications (apps or icons) pinned to the start menu are missing. - Entire tile window disappears. - The start button fails to respond. -- If a new roaming user is created, the first logon appears normal, but on subsequent logons, tiles are missing. +- If a new roaming user is created, the first sign-in appears normal, but on subsequent sign-ins, tiles are missing. ![Example of a working layout](images/start-ts-3.png) @@ -261,12 +262,12 @@ After the upgrade the user pinned tiles are missing: ![Example of Start screen with previously pinned tiles missing](images/start-ts-6.png) -Additionally, users may see blank tiles if logon was attempted without network connectivity. +Additionally, users may see blank tiles if sign-in was attempted without network connectivity. ![Example of blank tiles](images/start-ts-7.png) -**Resolution**: This is fixed in [October 2017 update](https://support.microsoft.com/en-us/help/4041676). +**Resolution**: This issue was fixed in the [October 2017 update](https://support.microsoft.com/en-us/help/4041676). ### Symptom: Tiles are missing after upgrade from Windows 10, version 1607 to version 1709 for users with Roaming User Profiles (RUP) enabled and managed Start Menu layout with partial lockdown @@ -278,13 +279,13 @@ Additionally, users may see blank tiles if logon was attempted without network c ### Symptom: Start Menu issues with Tile Data Layer corruption -**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update)). +**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update).) **Resolution** There are steps you can take to fix the icons, first is to confirm that is the issue that needs to be addressed. -1. The App or Apps work fine when you click on the tiles. +1. The App or Apps work fine when you select the tiles. 2. The tiles are blank, have a generic placeholder icon, have the wrong or strange title information. -3. The app is missing, but listed as installed via Powershell and works if you launch via URI. +3. The app is missing, but listed as installed via PowerShell and works if you launch via URI. - Example: `windows-feedback://` 4. In some cases, Start can be blank, and Action Center and Cortana do not launch. @@ -301,9 +302,9 @@ Although a reboot is not required, it may help clear up any residual issues afte ### Symptoms: Start Menu and Apps cannot start after upgrade to Windows 10 version 1809 when Symantec Endpoint Protection is installed -**Description** Start Menu, Search and Apps do not start after you upgrade a Windows 7-based computer that has Symantec Endpoint Protection installed to Windows 10 version 1809. +**Description**: Start menu, Search, and Apps do not start after you upgrade a computer running Windows 7 that has Symantec Endpoint Protection installed to Windows 10 version 1809. -**Cause** This occurs because of a failure to load sysfer.dll. During upgrade, the setup process does not set the privilege group "All Application Packages" on sysfer.dll and other Symantec modules. +**Cause**: This problem occurs because of a failure to load sysfer.dll. During upgrade, the setup process does not set the privilege group "All Application Packages" on sysfer.dll and other Symantec modules. **Resolution** This issue was fixed by the Windows Cumulative Update that were released on December 5, 2018—KB4469342 (OS Build 17763.168). @@ -321,7 +322,7 @@ If you have already encountered this issue, use one of the following two options 4. Confirm that **All Application Packages** group is missing. -5. Click **Edit**, and then click **Add** to add the group. +5. Select **Edit**, and then select **Add** to add the group. 6. Test Start and other Apps. diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index 0f0d1cd783..a6c45ca8c1 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -32,7 +32,6 @@ IT pros can configure access to Microsoft Store for client computers in their or ## Options to configure access to Microsoft Store - You can use these tools to configure access to Microsoft Store: AppLocker or Group Policy. For Windows 10, this is only supported on Windows 10 Enterprise edition. ## Block Microsoft Store using AppLocker @@ -64,6 +63,20 @@ For more information on AppLocker, see [What is AppLocker?](/windows/device-secu 8. Optional: On **Exceptions**, specify conditions by which to exclude files from being affected by the rule. This allows you to add exceptions based on the same rule reference and rule scope as you set before. Click **Next**. +## Block Microsoft Store using configuration service provider + +Applies to: Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education + +If you have Windows 10 devices in your organization that are managed using a mobile device management (MDM) system, such as Microsoft Intune, you can block access to Microsoft Store app using the following configuration service providers (CSPs): + +- [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) +- [AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp) + +For more information, see [Configure an MDM provider](https://docs.microsoft.com/microsoft-store/configure-mdm-provider-microsoft-store-for-business). + +For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements). + + ## Block Microsoft Store using Group Policy @@ -78,21 +91,21 @@ You can also use Group Policy to manage access to Microsoft Store. 1. Type gpedit in the search bar to find and start Group Policy Editor. -2. In the console tree of the snap-in, click **Computer Configuration**, click **Administrative Templates** , click **Windows Components**, and then click **Store**. +2. In the console tree of the snap-in, click **Computer Configuration**, click **Administrative Templates**, click **Windows Components**, and then click **Store**. -3. In the Setting pane, click **Turn off Store application**, and then click **Edit policy setting**. +3. In the Setting pane, click **Turn off the Store application**, and then click **Edit policy setting**. -4. On the **Turn off Store application** setting page, click **Enabled**, and then click **OK**. +4. On the **Turn off the Store application** setting page, click **Enabled**, and then click **OK**. > [!Important] -> Enabling **Turn off Store application** policy turns off app updates from Microsoft Store. +> Enabling **Turn off the Store application** policy turns off app updates from Microsoft Store. -## Block Microsoft Store using management tool +## Block Microsoft Store on Windows 10 Mobile Applies to: Windows 10 Mobile -If you have mobile devices in your organization that you upgraded from earlier versions of Windows Phone 8 to Windows 10 Mobile, existing policies created using the Windows Phone 8.1 configuration service providers (CSP) with your MDM tool will continue to work on Windows 10 Mobile. If you are starting with Windows 10 Mobile, we recommend using [AppLocker](#block-store-applocker) to manage access to Microsoft Store app. +If you have mobile devices in your organization that you upgraded from earlier versions of Windows Phone 8 to Windows 10 Mobile, existing policies created using the Windows Phone 8.1 CSPs with your MDM tool will continue to work on Windows 10 Mobile. If you are starting with Windows 10 Mobile, we recommend using [AppLocker](#block-store-applocker) to manage access to Microsoft Store app. When your MDM tool supports Microsoft Store for Business, the MDM can use these CSPs to block Microsoft Store app: diff --git a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md index e6a50b2114..159d0b1376 100644 --- a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md +++ b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md @@ -1,7 +1,7 @@ --- title: Administering UE-V with Windows PowerShell and WMI -description: Administering UE-V with Windows PowerShell and WMI -author: trudyha +description: Learn how User Experience Virtualization (UE-V) provides Windows PowerShell cmdlets to help administrators perform various UE-V tasks. +author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/configuration/ue-v/uev-administering-uev.md b/windows/configuration/ue-v/uev-administering-uev.md index 16154765ea..ae0c0dc0e4 100644 --- a/windows/configuration/ue-v/uev-administering-uev.md +++ b/windows/configuration/ue-v/uev-administering-uev.md @@ -1,7 +1,7 @@ --- title: Administering UE-V -description: Administering UE-V -author: trudyha +description: Learn how to perform administrative tasks for User Experience Virtualization (UE-V). These tasks include configuring the UE-V service and recovering lost settings. +author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md index f9fb4b255a..9fb9d1704d 100644 --- a/windows/configuration/ue-v/uev-application-template-schema-reference.md +++ b/windows/configuration/ue-v/uev-application-template-schema-reference.md @@ -1,7 +1,7 @@ --- title: Application Template Schema Reference for UE-V -description: Application Template Schema Reference for UE-V -author: trudyha +description: Learn details about the XML structure of the UE-V settings location templates and learn how to edit these files. +author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md index 63eb702d7d..a4d2addc34 100644 --- a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md +++ b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md @@ -1,7 +1,7 @@ --- title: Changing the Frequency of UE-V Scheduled Tasks -description: Changing the Frequency of UE-V Scheduled Tasks -author: trudyha +description: Learn how to create a script that uses the Schtasks.exe command-line options so you can change the frequency of UE-V scheduled tasks. +author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md index fbaeb69dbf..2a85dc79f2 100644 --- a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md +++ b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md @@ -1,7 +1,7 @@ --- title: Configuring UE-V with Group Policy Objects -description: Configuring UE-V with Group Policy Objects -author: trudyha +description: In this article, learn how to configure User Experience Virtualization (UE-V) with Group Policy objects. +author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md index f7f8d70fcd..2ced4afd25 100644 --- a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md +++ b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md @@ -1,6 +1,6 @@ --- title: Configuring UE-V with Microsoft Endpoint Configuration Manager -description: Configuring UE-V with Microsoft Endpoint Configuration Manager +description: Learn how to configure User Experience Virtualization (UE-V) with Microsoft Endpoint Configuration Manager. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -14,12 +14,12 @@ ms.topic: article --- -# Configuring UE-V with Microsoft Endpoint Configuration Manager +# Configuring UE-V with Microsoft Endpoint Manager **Applies to** - Windows 10, version 1607 -After you deploy User Experience Virtualization (UE-V) and its required features, you can start to configure it to meet your organization's need. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of Microsoft Endpoint Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. +After you deploy User Experience Virtualization (UE-V) and its required features, you can start to configure it to meet your organization's need. The UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of Microsoft Endpoint Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. ## UE-V Configuration Pack supported features diff --git a/windows/configuration/ue-v/uev-deploy-required-features.md b/windows/configuration/ue-v/uev-deploy-required-features.md index b8b4cb2155..dd861cea0f 100644 --- a/windows/configuration/ue-v/uev-deploy-required-features.md +++ b/windows/configuration/ue-v/uev-deploy-required-features.md @@ -1,6 +1,6 @@ --- title: Deploy required UE-V features -description: Deploy required UE-V features +description: Learn how to install and configure User Experience Virtualization (UE-V) features, for example a network share that stores and retrieves user settings. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -117,7 +117,7 @@ You can configure UE-V before, during, or after you enable the UE-V service on u Windows Server 2012 and Windows Server 2012 R2 -- [**Configuration Manager**](uev-configuring-uev-with-system-center-configuration-manager.md) The UE-V Configuration Pack lets you use the Compliance Settings feature of Microsoft Endpoint Configuration Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. +- [**Configuration Manager**](uev-configuring-uev-with-system-center-configuration-manager.md) The UE-V Configuration Pack lets you use the Compliance Settings feature of Microsoft Endpoint Manager to apply consistent configurations across sites where UE-V and Configuration Manager are installed. - [**Windows PowerShell and WMI**](uev-administering-uev-with-windows-powershell-and-wmi.md) You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify the configuration of the UE-V service. diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md index 918e018c48..8e69dc7cf3 100644 --- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md +++ b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md @@ -1,6 +1,6 @@ --- title: Use UE-V with custom applications -description: Use UE-V with custom applications +description: Use User Experience Virtualization (UE-V) to create your own custom settings location templates with the UE-V template generator. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-getting-started.md b/windows/configuration/ue-v/uev-getting-started.md index d67437503a..28a035aedc 100644 --- a/windows/configuration/ue-v/uev-getting-started.md +++ b/windows/configuration/ue-v/uev-getting-started.md @@ -1,6 +1,6 @@ --- title: Get Started with UE-V -description: Get Started with UE-V +description: Use the steps in this article to deploy User Experience Virtualization (UE-V) for the first time in a test environment. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md index 9b68ba56df..f953320ab4 100644 --- a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md +++ b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md @@ -1,6 +1,6 @@ --- title: Manage Administrative Backup and Restore in UE-V -description: Manage Administrative Backup and Restore in UE-V +description: Learn how an administrator of User Experience Virtualization (UE-V) can back up and restore application and Windows settings to their original state. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -24,7 +24,7 @@ As an administrator of User Experience Virtualization (UE-V), you can restore ap ## Restore Settings in UE-V when a User Adopts a New Device -To restore settings when a user adopts a new device, you can put a settings location template in **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To backup settings for a template, use the following cmdlet in Windows PowerShell: +To restore settings when a user adopts a new device, you can put a settings location template in a **backup** or **roam (default)** profile using the Set-UevTemplateProfile PowerShell cmdlet. This setup lets computer settings sync to the new computer, in addition to user settings. Templates assigned to the backup profile are backed up for that device and configured on a per-device basis. To back up settings for a template, use the following cmdlet in Windows PowerShell: ```powershell Set-UevTemplateProfile -ID -Profile @@ -50,7 +50,7 @@ As part of the Backup/Restore feature, UE-V added **last known good (LKG)** to t ### How to Backup/Restore Templates with UE-V -These are the key backup and restore components of UE-V: +Here are the key backup and restore components of UE-V: - Template profiles @@ -74,7 +74,7 @@ All templates are included in the roaming profile when registered unless otherwi Templates can be added to the Backup Profile with PowerShell or WMI using the Set-UevTemplateProfile cmdlet. Templates in the Backup Profile back up these settings to the Settings Storage Location in a special Device name directory. Specified settings are backed up to this location. -Templates designated BackupOnly include settings specific to that device that should not be synchronized unless explicitly restored. These settings are stored in the same device-specific settings package location on the settings storage location as the Backedup Settings. These templates have a special identifier embedded in the template that specifies they should be part of this profile. +Templates designated BackupOnly include settings specific to that device that shouldn't be synchronized unless explicitly restored. These settings are stored in the same device-specific settings package location on the settings storage location as the Backedup Settings. These templates have a special identifier embedded in the template that specifies they should be part of this profile. **Settings packages location within the Settings Storage Location template** @@ -90,10 +90,10 @@ Restoring a user’s device restores the currently registered Template’s setti - **Automatic restore** - If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user logs on to a new device for the first time and these criteria are met, the settings data is applied to that device. + If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user signs in to a new device for the first time and these criteria are met, the settings data is applied to that device. **Note** - Accessibility and Windows Desktop settings require the user to re-logon to Windows to be applied. + Accessibility and Windows Desktop settings require the user to sign in again to Windows to be applied. @@ -104,7 +104,7 @@ Restoring a user’s device restores the currently registered Template’s setti ## Restore Application and Windows Settings to Original State -WMI and Windows PowerShell commands let you restore application and Windows settings to the settings values that were on the computer the first time that the application started after the UE-V service was enabled. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application runs, or the settings are restored when the user logs on to the operating system. +WMI and Windows PowerShell commands let you restore application and Windows settings to the settings values that were on the computer the first time that the application started after the UE-V service was enabled. This restoring action is performed on a per-application or Windows settings basis. The settings are restored the next time that the application runs, or the settings are restored when the user signs in to the operating system. **To restore application settings and Windows settings with Windows PowerShell for UE-V** diff --git a/windows/configuration/ue-v/uev-manage-configurations.md b/windows/configuration/ue-v/uev-manage-configurations.md index 71d5841793..7189998439 100644 --- a/windows/configuration/ue-v/uev-manage-configurations.md +++ b/windows/configuration/ue-v/uev-manage-configurations.md @@ -1,6 +1,6 @@ --- title: Manage Configurations for UE-V -description: Manage Configurations for UE-V +description: Learn to manage the configuration of the User Experience Virtualization (UE-V) service and also learn to manage storage locations for UE-V resources. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-migrating-settings-packages.md b/windows/configuration/ue-v/uev-migrating-settings-packages.md index 4ed5adc8a9..f9658f41a1 100644 --- a/windows/configuration/ue-v/uev-migrating-settings-packages.md +++ b/windows/configuration/ue-v/uev-migrating-settings-packages.md @@ -1,6 +1,6 @@ --- title: Migrating UE-V settings packages -description: Migrating UE-V settings packages +description: Learn to relocate User Experience Virtualization (UE-V) user settings packages either when you migrate to a new server or when you perform backups. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md index c56e5b4661..d1971558f4 100644 --- a/windows/configuration/ue-v/uev-prepare-for-deployment.md +++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md @@ -1,6 +1,6 @@ --- title: Prepare a UE-V Deployment -description: Prepare a UE-V Deployment +description: Learn about the types of User Experience Virtualization (UE-V) deployment you can execute and what preparations you can make beforehand to be successful. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -362,7 +362,7 @@ The UE-V service synchronizes user settings for devices that are not always conn Enable this configuration using one of these methods: -- After you enable the UE-V service, use the Settings Management feature in Microsoft Endpoint Configuration Manager or the UE-V ADMX templates (installed with Windows 10, version 1607) to push the SyncMethod = None configuration. +- After you enable the UE-V service, use the Settings Management feature in Microsoft Endpoint Manager or the UE-V ADMX templates (installed with Windows 10, version 1607) to push the SyncMethod = None configuration. - Use Windows PowerShell or Windows Management Instrumentation (WMI) to set the SyncMethod = None configuration. diff --git a/windows/configuration/ue-v/uev-release-notes-1607.md b/windows/configuration/ue-v/uev-release-notes-1607.md index f3d37601d0..7c5805ff7d 100644 --- a/windows/configuration/ue-v/uev-release-notes-1607.md +++ b/windows/configuration/ue-v/uev-release-notes-1607.md @@ -1,6 +1,6 @@ --- title: User Experience Virtualization (UE-V) Release Notes -description: User Experience Virtualization (UE-V) Release Notes +description: Read the latest information required to successfully install and use User Experience Virtualization (UE-V) that is not included in the UE-V documentation. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -37,7 +37,7 @@ Administrators can still define which user-customized application settings can s ### Upgrading from UE-V 1.0 to the in-box version of UE-V is blocked -Version 1.0 of UE-V used Offline Files (Client Side Caching) for settings synchronization and pinned the UE-V sync folder to be available when the network was offline, however, this technology was removed in UE-V 2.x. As a result, UE-V 1.0 users are blocked from upgrading to UE-V for Windows 10, version 1607. +Version 1.0 of UE-V used Offline Files (Client-Side Caching) for settings synchronization and pinned the UE-V sync folder to be available when the network was offline, however, this technology was removed in UE-V 2.x. As a result, UE-V 1.0 users are blocked from upgrading to UE-V for Windows 10, version 1607. WORKAROUND: Remove the UE-V 1.0 sync folder from the Offline Files configuration and then upgrade to the in-box version of UE-V for Windows, version 1607 release. @@ -55,13 +55,13 @@ WORKAROUND: To resolve this problem, run the application by selecting one of the ### Unpredictable results when both Office 2010 and Office 2013 are installed on the same device -When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be quite large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. +When a user has both Office 2010 and Office 2013 installed, any common settings between the two versions of Office are roamed by UE-V. This could cause the Office 2010 package size to be large or result in unpredictable conflicts with 2013, particularly if Office 365 is used. WORKAROUND: Install only one version of Office or limit which settings are synchronized by UE-V. -### Uninstall and re-install of Windows 8 applications reverts settings to initial state +### Uninstallation and reinstallation of Windows 8 applications reverts settings to initial state -While using UE-V settings synchronization for a Windows 8 application, if the user uninstalls the application and then reinstalls the application, the application’s settings revert to their default values. This happens because the uninstall removes the local (cached) copy of the application’s settings but does not remove the local UE-V settings package. When the application is reinstalled and launched, UE-V gather the application settings that were reset to the application defaults and then uploads the default settings to the central storage location. Other computers running the application then download the default settings. This behavior is identical to the behavior of desktop applications. +While using UE-V settings synchronization for a Windows 8 application, if the user uninstalls the application and then reinstalls the application, the application’s settings revert to their default values. This result happens because the uninstall removes the local (cached) copy of the application’s settings but does not remove the local UE-V settings package. When the application is reinstalled and launched, UE-V gathers the application settings that were reset to the application defaults and then uploads the default settings to the central storage location. Other computers running the application then download the default settings. This behavior is identical to the behavior of desktop applications. WORKAROUND: None. @@ -85,7 +85,7 @@ WORKAROUND: Use folder redirection or some other technology to ensure that any f ### Long Settings Storage Paths could cause an error -Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + “settingspackages” + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: +Keep settings storage paths as short as possible. Long paths could prevent resolution or synchronization. UE-V uses the Settings storage path as part of the calculated path to store settings. That path is calculated in the following way: settings storage path + "settingspackages" + package dir (template ID) + package name (template ID) + .pkgx. If that calculated path exceeds 260 characters, package storage will fail and generate the following error message in the UE-V operational event log: \[boost::filesystem::copy\_file: The system cannot find the path specified\] @@ -95,7 +95,7 @@ WORKAROUND: None. ### Some operating system settings only roam between like operating system versions -Operating system settings for Narrator and currency characters specific to the locale (i.e. language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. +Operating system settings for Narrator and currency characters specific to the locale (that is, language and regional settings) will only roam across like operating system versions of Windows. For example, currency characters will not roam between Windows 7 and Windows 8. WORKAROUND: None diff --git a/windows/configuration/ue-v/uev-security-considerations.md b/windows/configuration/ue-v/uev-security-considerations.md index a036b1fb3a..c45565ed5f 100644 --- a/windows/configuration/ue-v/uev-security-considerations.md +++ b/windows/configuration/ue-v/uev-security-considerations.md @@ -1,6 +1,6 @@ --- title: Security Considerations for UE-V -description: Security Considerations for UE-V +description: Learn about accounts and groups, log files, and other security-related considerations for User Experience Virtualization (UE-V). author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-sync-methods.md b/windows/configuration/ue-v/uev-sync-methods.md index ebe670eed2..02d1e1d9af 100644 --- a/windows/configuration/ue-v/uev-sync-methods.md +++ b/windows/configuration/ue-v/uev-sync-methods.md @@ -1,6 +1,6 @@ --- title: Sync Methods for UE-V -description: Sync Methods for UE-V +description: Learn how User Experience Virtualization (UE-V) service sync methods let you synchronize users’ application and Windows settings with the settings storage location. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-sync-trigger-events.md b/windows/configuration/ue-v/uev-sync-trigger-events.md index 3dc4b9727d..0db2a582f4 100644 --- a/windows/configuration/ue-v/uev-sync-trigger-events.md +++ b/windows/configuration/ue-v/uev-sync-trigger-events.md @@ -1,6 +1,6 @@ --- title: Sync Trigger Events for UE-V -description: Sync Trigger Events for UE-V +description: Learn how User Experience Virtualization (UE-V) lets you synchronize your application and Windows settings across all your domain-joined devices. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md index 3bf783b488..32ed4968bb 100644 --- a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md +++ b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md @@ -1,6 +1,6 @@ --- title: Synchronizing Microsoft Office with UE-V -description: Synchronizing Office with UE-V +description: Learn how User Experience Virtualization (UE-V) supports the synchronization of Microsoft Office application settings. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-technical-reference.md b/windows/configuration/ue-v/uev-technical-reference.md index 5edddf9109..8f0feaabbc 100644 --- a/windows/configuration/ue-v/uev-technical-reference.md +++ b/windows/configuration/ue-v/uev-technical-reference.md @@ -1,6 +1,6 @@ --- title: Technical Reference for UE-V -description: Technical Reference for UE-V +description: Use this technical reference to learn about the various features of User Experience Virtualization (UE-V). author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-troubleshooting.md b/windows/configuration/ue-v/uev-troubleshooting.md index 1ffb99a964..7e51868298 100644 --- a/windows/configuration/ue-v/uev-troubleshooting.md +++ b/windows/configuration/ue-v/uev-troubleshooting.md @@ -1,6 +1,6 @@ --- title: Troubleshooting UE-V -description: Troubleshooting UE-V +description: Use this technical reference to find resources for troubleshooting User Experience Virtualization (UE-V) for Windows 10. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md index bead7186c8..d726744568 100644 --- a/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md +++ b/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases.md @@ -1,6 +1,6 @@ --- title: Upgrade to UE-V for Windows 10 -description: Explains how to upgrade to the latest version of UE-V. +description: Use these few adjustments to upgrade from User Experience Virtualization (UE-V) 2.x to the latest version of UE-V. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -30,7 +30,8 @@ If you’re already using UE-V 2.x and you’re planning to upgrade user devices 5. Install the UE-V template generator if you want to synchronize application settings for custom applications. -> **Important**  You can upgrade your existing UE-V installation to Windows 10, version 1607 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10, version 1607.. +> [!IMPORTANT] +> You can upgrade your existing UE-V installation to Windows 10, version 1607 from UE-V versions 2.1 or 2.0 only. If you are using a previous version of UE-V, you’ll need to upgrade from that version to UE-V 2.x before you upgrade to Windows 10, version 1607. ## Upgrade user devices to Windows 10, version 1607 @@ -38,7 +39,7 @@ Performing an in-place upgrade on user devices automatically installs the UE-V s ## Verify that UE-V settings were migrated correctly -After upgrading a user device to Windows 10, version 1607, it’s important to verify that UE-V settings and template registrations were migrated correctly during the upgrade. You can verify UE-V settings using Windows Powershell or the device’s registry. +After upgrading a user device to Windows 10, version 1607, it’s important to verify that UE-V settings and template registrations were migrated correctly during the upgrade. You can verify UE-V settings using Windows PowerShell or the device’s registry. **To verify UE-V settings using Windows PowerShell** @@ -48,7 +49,8 @@ After upgrading a user device to Windows 10, version 1607, it’s important to v 3. Type **Get-UEVTemplate** and press ENTER to check that your templates are still registered. - > **Note** You’ll need to register the NotePad template again after you upgrade the device to Windows 10. + > [!NOTE] + > You’ll need to register the NotePad template again after you upgrade the device to Windows 10. **To verify UE-V settings using the device’s registry** @@ -68,7 +70,8 @@ The UE-V service is the client-side component that captures user-personalized ap With Windows 10, version 1607 and later, the UE-V service replaces the UE-V Agent and no longer requires a separate download and installation. Enable the service on user devices to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell. -> **Important**  The UE-V Agent used in prior releases of UE-V is replaced with the UE service. The UE-V service included with Windows 10, version 1607 and later releases, does not include the agent user interface and is configurable through cmdlets or registry settings only. +> [!IMPORTANT] +> The UE-V Agent used in prior releases of UE-V is replaced with the UE service. The UE-V service included with Windows 10, version 1607 and later releases, does not include the agent user interface and is configurable through cmdlets or registry settings only. **To enable the UE-V service with Group Policy** diff --git a/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md b/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md index d2e019723d..2d435e85ed 100644 --- a/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md +++ b/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications.md @@ -1,6 +1,6 @@ --- title: Using UE-V with Application Virtualization applications -description: Using UE-V with Application Virtualization applications +description: Learn how to use User Experience Virtualization (UE-V) with Microsoft Application Virtualization (App-V). author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -23,7 +23,6 @@ User Experience Virtualization (UE-V) supports Microsoft Application Virtualizat ## UE-V settings synchronization for App-V applications - UE-V monitors when an application opens by the program name and, optionally, by file version numbers and product version numbers, whether the application is installed locally or virtually by using App-V. When the application starts, UE-V monitors the App-V process, applies any settings that are stored in the user's settings storage path, and then enables the application to start normally. UE-V monitors App-V applications and automatically translates the relevant file and registry paths to the virtualized location as opposed to the physical location outside the App-V computing environment. **To implement settings synchronization for a virtualized application** @@ -34,28 +33,11 @@ UE-V monitors when an application opens by the program name and, optionally, by 3. Publish the template to the location of your settings template catalog or manually install the template by using the `Register-UEVTemplate` Windows PowerShell cmdlet. - **Note**   - If you publish the newly created template to the settings template catalog, the client does not receive the template until the sync provider updates the settings. To manually start this process, open **Task Scheduler**, expand **Task Scheduler Library**, expand **Microsoft**, and expand **UE-V**. In the results pane, right-click **Template Auto Update**, and then click **Run**. - - + > [!NOTE] + > If you publish the newly created template to the settings template catalog, the client does not receive the template until the sync provider updates the settings. To manually start this process, open **Task Scheduler**, expand **Task Scheduler Library**, expand **Microsoft**, and expand **UE-V**. In the results pane, right-click **Template Auto Update**, and then click **Run**. 4. Start the App-V package. - - - - - ## Related topics - [Administering UE-V](uev-administering-uev.md) - - - - - - - - - diff --git a/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md b/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md index c17b9cedb8..09d5d2ace3 100644 --- a/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md +++ b/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows.md @@ -1,6 +1,6 @@ --- title: What's New in UE-V for Windows 10, version 1607 -description: What's New in UE-V for Windows 10, version 1607 +description: Learn about what's new in User Experience Virtualization (UE-V) for Windows 10, including new features and capabilities. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md index a2663f503d..0a5cc1a242 100644 --- a/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md +++ b/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator.md @@ -1,6 +1,6 @@ --- title: Working with Custom UE-V Templates and the UE-V Template Generator -description: Working with Custom UE-V Templates and the UE-V Template Generator +description: Create your own custom settings location templates by working with Custom User Experience Virtualization (UE-V) Templates and the UE-V Template Generator. author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy @@ -98,9 +98,8 @@ Use the UE-V template generator to edit settings location templates. When the re 1. Create a local copy of the settings location template .xml file. UE-V settings location templates are .xml files that identify the locations where application store settings values. - >**Note**   - A settings location template is unique because of the template **ID**. If you copy the template and rename the .xml file, template registration fails because UE-V reads the template **ID** tag in the .xml file to determine the name, not the file name of the .xml file. UE-V also reads the **Version** number to know if anything has changed. If the version number is higher, UE-V updates the template. - + > [!NOTE] + > A settings location template is unique because of the template **ID**. If you copy the template and rename the .xml file, template registration fails because UE-V reads the template **ID** tag in the .xml file to determine the name, not the file name of the .xml file. UE-V also reads the **Version** number to know if anything has changed. If the version number is higher, UE-V updates the template. 2. Open the settings location template file with an XML editor. diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md index 6a6265ee5a..d39c37513b 100644 --- a/windows/configuration/wcd/wcd-accounts.md +++ b/windows/configuration/wcd/wcd-accounts.md @@ -45,7 +45,7 @@ Specifies the settings you can configure when joining a device to a domain, incl | --- | --- | --- | | Account | string | Account to use to join computer to domain | | AccountOU | Enter the full path for the organizational unit. For example: OU=testOU,DC=domain,DC=Domain,DC=com. | Name of organizational unit for the computer account | -| ComputerName | Specify a unique name for the domain-joined computers using %RAND:x%, where x is an integer less than 15 digits long, or using %SERIAL% characters in the name.

        ComputerName is a string with a maximum length of 15 bytes of content:

        - ComputerName can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.

        - ComputerName cannot use spaces or any of the following characters: \{ | \} ~ \[ \\ \] ^ ' : ; < = > ? @ ! " \# $ % ` \( \) + / . , \* &, or contain any spaces.

        - ComputerName cannot use some non-standard characters, such as emoji.

        Computer names that cannot be validated through the DnsValidateName function cannot be used, for example, computer names that only contain numbers (0-9). For more information, see the [DnsValidateName function](https://go.microsoft.com/fwlink/?LinkId=257040). | Specifies the name of the Windows device (computer name on PCs) | +| ComputerName | Specify a unique name for the domain-joined computers using %RAND:x%, where x is an integer that includes fewer than 15 digits, or using %SERIAL% characters in the name.

        ComputerName is a string with a maximum length of 15 bytes of content:

        - ComputerName can use ASCII characters (1 byte each) and/or multi-byte characters such as Kanji, so long as you do not exceed 15 bytes of content.

        - ComputerName cannot use spaces or any of the following characters: \{ | \} ~ \[ \\ \] ^ ' : ; < = > ? @ ! " \# $ % ` \( \) + / . , \* &, or contain any spaces.

        - ComputerName cannot use some non-standard characters, such as emoji.

        Computer names that cannot be validated through the DnsValidateName function cannot be used, for example, computer names that only contain numbers (0-9). For more information, see the [DnsValidateName function](https://go.microsoft.com/fwlink/?LinkId=257040). | Specifies the name of the Windows device (computer name on PCs) | | DomainName | string (cannot be empty) | Specify the name of the domain that the device will join | | Password | string (cannot be empty) | Corresponds to the password of the user account that's authorized to join the computer account to the domain. | @@ -56,6 +56,6 @@ Use these settings to add local user accounts to the device. | Setting | Value | Description | | --- | --- | --- | | UserName | string (cannot be empty) | Specify a name for the local user account | -| HomeDir | string (cannot be ampty) | Specify the path of the home directory for the user | +| HomeDir | string (cannot be empty) | Specify the path of the home directory for the user | | Password | string (cannot be empty) | Specify the password for the user account | | UserGroup | string (cannot be empty) | Specify the local user group for the user | diff --git a/windows/configuration/wcd/wcd-cellcore.md b/windows/configuration/wcd/wcd-cellcore.md index b9b724b0b7..5e739a99ce 100644 --- a/windows/configuration/wcd/wcd-cellcore.md +++ b/windows/configuration/wcd/wcd-cellcore.md @@ -139,7 +139,7 @@ Select from the following: ### eSim -Configure **FwUpdate** > **AllowedAppIdList** to whitelist apps that are allowed to update the firmware. Obtain the app IDs from the card vendor. +Configure **FwUpdate** > **AllowedAppIdList** to list apps that are allowed to update the firmware. Obtain the app IDs from the card vendor. ### External diff --git a/windows/configuration/wcd/wcd-maps.md b/windows/configuration/wcd/wcd-maps.md index d50b2c93ed..c8d1a683fb 100644 --- a/windows/configuration/wcd/wcd-maps.md +++ b/windows/configuration/wcd/wcd-maps.md @@ -27,7 +27,7 @@ Use for settings related to Maps. ## ChinaVariantWin10 -Use **ChinaVariantWin10** to specify that the Windows device is intended to ship in China. When set to **True**, maps approved by the State Bureau of Surveying and Mapping in China are used, which are obtained from a server located in China. +Use **ChinaVariantWin10** to specify that the Windows device is intended to ship in China. When set to **True**, maps approved by the State Bureau of Surveying and Mapping in China are used. These maps are obtained from a server located in China. This customization may result in different maps, servers, or other configuration changes on the device. @@ -38,7 +38,7 @@ Use to store map data on an SD card. Map data is used by the Maps application and the map control for third-party applications. This data can be store on an SD card, which provides the advantage of saving internal memory space for user data and allows the user to download more offline map data. Microsoft recommends enabling the **UseExternalStorage** setting on devices that have less than 8 GB of user storage and an SD card slot. -You can use **UseExternalStorage** whether or not you include an SD card with preloaded map data on the phone. If set to **True**, the OS only allows the user to download offline maps when an SD card is present. If an SD card is not present, users can still view and cache maps, but they will not be able to download a region of offline maps until an SD card is inserted. +You can use **UseExternalStorage** whether or not you include an SD card with preloaded map data on the phone. If set to **True**, the OS only allows the user to download offline maps when an SD card is present. If no SD card is present, users can view and cache maps, but they can't download a region of offline maps until an SD card is inserted. If set to **False**, map data will always be stored on the internal data partition of the device. @@ -47,4 +47,4 @@ If set to **False**, map data will always be stored on the internal data partiti ## UseSmallerCache -Do not use. +Don't use this setting. diff --git a/windows/configuration/wcd/wcd-personalization.md b/windows/configuration/wcd/wcd-personalization.md index c452d22dbc..2bd33a11a5 100644 --- a/windows/configuration/wcd/wcd-personalization.md +++ b/windows/configuration/wcd/wcd-personalization.md @@ -27,20 +27,20 @@ Use to configure settings to personalize a PC. ## DeployDesktopImage -Deploy a jpg, jpeg or png image to the device to be used as desktop image. If you have a local file and want to embed it into the package being deployed, you configure this setting and [DesktopImageUrl](#desktopimageurl). +Deploy a .jpg, .jpeg, or .png image to the device to be used as a desktop image. If you have a local file and want to embed it into the package being deployed, you configure this setting and [DesktopImageUrl](#desktopimageurl). When using **DeployDesktopImage** and [DeployLockScreenImageFile](#deploylockscreenimage, the file names need to be different. ## DeployLockScreenImage -Deploy a jpg, jpeg or png image to the device to be used as lock screen image. If you have a local file and want to embed it into the package being deployed, you configure this setting and [LockScreenImageUrl](#lockscreenimageurl). +Deploy a .jpg, .jpeg, or .png image to the device to be used as lock screen image. If you have a local file and want to embed it into the package being deployed, you configure this setting and [LockScreenImageUrl](#lockscreenimageurl). When using [DeployDesktopImage](#deploydesktopimage) and **DeployLockScreenImageFile**, the file names need to be different. ## DesktopImageUrl -Specify a jpg, jpeg or png image to be used as desktop image. This setting can take a http or https url to a remote image to be downloaded or a file url to a local image. If you have a local file and want to embed it into the package being deployed, you also set [DeployDesktopImage](#deploydesktopimage). +Specify a .jpg, .jpeg, or .png image to be used as desktop image. This setting can take an HTTP or HTTPS URL to a remote image to be downloaded or a file URL to a local image. If you have a local file and want to embed it into the package being deployed, you also set [DeployDesktopImage](#deploydesktopimage). ## LockScreenImageUrl -Specify a jpg, jpeg or png image to be used as Lock Screen Image. This setting can take a http or https Url to a remote image to be downloaded or a file Url to an existing local image. If you have a local file and want to embed it into the package being deployed, you also set [DeployLockScreenImage](#deploylockscreenimage). +Specify a .jpg, .jpeg, or .png image to be used as Lock Screen Image. This setting can take an HTTP or HTTPS URL to a remote image to be downloaded or a file URL to an existing local image. If you have a local file and want to embed it into the package being deployed, you also set [DeployLockScreenImage](#deploylockscreenimage). diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index 55ae0af5f2..058df52109 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -20,7 +20,7 @@ ms.date: 06/19/2018 **Applies to** -- Windows 10 +- Windows 10, Windows Server 2016 with Desktop Experience, Windows Server 2019 with Desktop Experience > **Looking for consumer information?** [See what's on the Start menu](https://support.microsoft.com/help/17195/windows-10-see-whats-on-the-menu) @@ -132,7 +132,7 @@ If your Start layout customization is not applied as expected, open **Event View - [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/windows-spotlight.md b/windows/configuration/windows-spotlight.md index fa8b0e3378..5fcc9f5c5c 100644 --- a/windows/configuration/windows-spotlight.md +++ b/windows/configuration/windows-spotlight.md @@ -44,7 +44,7 @@ For managed devices running Windows 10 Enterprise and Windows 10 Education, en - **Feature suggestions, fun facts, tips** - The lock screen background will occasionally suggest Windows 10 features that the user hasn't tried yet, such as **Snap assist**. + The lock screen background will occasionally make recommendations on how to enhance your productivity and enjoyment of Microsoft products including suggesting other relevant Microsoft products and services. ![fun facts](images/funfacts.png) diff --git a/windows/configure/docfx.json b/windows/configure/docfx.json index 3dcf319a94..a7f9b909e9 100644 --- a/windows/configure/docfx.json +++ b/windows/configure/docfx.json @@ -36,7 +36,16 @@ "./": { "depot_name": "MSDN.windows-configure" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/deploy/docfx.json b/windows/deploy/docfx.json index e287ca8721..58a98d4813 100644 --- a/windows/deploy/docfx.json +++ b/windows/deploy/docfx.json @@ -35,7 +35,16 @@ "depot_name": "MSDN.windows-deploy", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md deleted file mode 100644 index d4e56af1b7..0000000000 --- a/windows/deployment/TOC.md +++ /dev/null @@ -1,283 +0,0 @@ -# [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment) -## [Deployment process posters](windows-10-deployment-posters.md) -## [Deploy Windows 10 with Microsoft 365](deploy-m365.md) -## [What's new in Windows 10 deployment](deploy-whats-new.md) -## [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) -## [Windows Autopilot](windows-autopilot/windows-autopilot.md) - -## Subscription Activation -### [Windows 10 Subscription Activation](windows-10-subscription-activation.md) -### [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) -### [Configure VDA for Subscription Activation](vda-subscription-activation.md) -### [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) - -## Resolve upgrade errors -### [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) -### [Quick fixes](upgrade\quick-fixes.md) -### [SetupDiag](upgrade/setupdiag.md) -### [Troubleshooting upgrade errors](upgrade/troubleshoot-upgrade-errors.md) -### [Windows error reporting](upgrade/windows-error-reporting.md) -### [Upgrade error codes](upgrade/upgrade-error-codes.md) -### [Log files](upgrade/log-files.md) -### [Resolution procedures](upgrade/resolution-procedures.md) -### [Submit Windows 10 upgrade errors](upgrade/submit-errors.md) - -## Deploy Windows 10 -### [Deploying Windows 10](deploy.md) - -### [Windows Autopilot](windows-autopilot/windows-autopilot.md) -### [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) -### [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) -### [Windows 10 volume license media](windows-10-media.md) - -### [Windows 10 in S mode](s-mode.md) -#### [Switch to Windows 10 Pro/Enterprise from S mode](windows-10-pro-in-s-mode.md) - -### [Windows 10 deployment test lab](windows-10-poc.md) -#### [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) -#### [Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md) - -### [Plan for Windows 10 deployment](planning/index.md) -#### [Windows 10 Enterprise FAQ for IT Pros](planning/windows-10-enterprise-faq-itpro.md) -#### [Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md) -#### [Windows 10 compatibility](planning/windows-10-compatibility.md) -#### [Windows 10 infrastructure requirements](planning/windows-10-infrastructure-requirements.md) - -#### [Volume Activation [client]](volume-activation/volume-activation-windows-10.md) -##### [Plan for volume activation [client]](volume-activation/plan-for-volume-activation-client.md) -##### [Activate using Key Management Service [client]](volume-activation/activate-using-key-management-service-vamt.md) -##### [Activate using Active Directory-based activation [client]](volume-activation/activate-using-active-directory-based-activation-client.md) -##### [Activate clients running Windows 10](volume-activation/activate-windows-10-clients-vamt.md) -##### [Monitor activation [client]](volume-activation/monitor-activation-client.md) -##### [Use the Volume Activation Management Tool [client]](volume-activation/use-the-volume-activation-management-tool-client.md) -##### [Appendix: Information sent to Microsoft during activation [client]](volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md) - -#### [Application Compatibility Toolkit (ACT) Technical Reference](planning/act-technical-reference.md) -##### [SUA User's Guide](planning/sua-users-guide.md) -###### [Using the SUA Wizard](planning/using-the-sua-wizard.md) -###### [Using the SUA Tool](planning/using-the-sua-tool.md) -####### [Tabs on the SUA Tool Interface](planning/tabs-on-the-sua-tool-interface.md) -####### [Showing Messages Generated by the SUA Tool](planning/showing-messages-generated-by-the-sua-tool.md) -####### [Applying Filters to Data in the SUA Tool](planning/applying-filters-to-data-in-the-sua-tool.md) -####### [Fixing Applications by Using the SUA Tool](planning/fixing-applications-by-using-the-sua-tool.md) -##### [Compatibility Administrator User's Guide](planning/compatibility-administrator-users-guide.md) -###### [Using the Compatibility Administrator Tool](planning/using-the-compatibility-administrator-tool.md) -####### [Available Data Types and Operators in Compatibility Administrator](planning/available-data-types-and-operators-in-compatibility-administrator.md) -####### [Searching for Fixed Applications in Compatibility Administrator](planning/searching-for-fixed-applications-in-compatibility-administrator.md) -####### [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md) -####### [Creating a Custom Compatibility Fix in Compatibility Administrator](planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md) -####### [Creating a Custom Compatibility Mode in Compatibility Administrator](planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md) -####### [Creating an AppHelp Message in Compatibility Administrator](planning/creating-an-apphelp-message-in-compatibility-administrator.md) -####### [Viewing the Events Screen in Compatibility Administrator](planning/viewing-the-events-screen-in-compatibility-administrator.md) -####### [Enabling and Disabling Compatibility Fixes in Compatibility Administrator](planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md) -####### [Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator](planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md) -###### [Managing Application-Compatibility Fixes and Custom Fix Databases](planning/managing-application-compatibility-fixes-and-custom-fix-databases.md) -####### [Understanding and Using Compatibility Fixes](planning/understanding-and-using-compatibility-fixes.md) -####### [Compatibility Fix Database Management Strategies and Deployment](planning/compatibility-fix-database-management-strategies-and-deployment.md) -####### [Testing Your Application Mitigation Packages](planning/testing-your-application-mitigation-packages.md) -###### [Using the Sdbinst.exe Command-Line Tool](planning/using-the-sdbinstexe-command-line-tool.md) -##### [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) - - -### Deploy Windows 10 with the Microsoft Deployment Toolkit (MDT) -#### [Get started with MDT](deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md) - -#### Deploy Windows 10 with MDT -##### [Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) -##### [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) -##### [Deploy a Windows 10 image using MDT](deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md) -##### [Build a distributed environment for Windows 10 deployment](deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md) -##### [Refresh a Windows 7 computer with Windows 10](deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md) -##### [Replace a Windows 7 computer with a Windows 10 computer](deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md) -##### [Perform an in-place upgrade to Windows 10 with MDT](deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) - -#### Customize MDT -##### [Configure MDT settings](deploy-windows-mdt/configure-mdt-settings.md) -##### [Set up MDT for BitLocker](deploy-windows-mdt/set-up-mdt-for-bitlocker.md) -##### [Configure MDT deployment share rules](deploy-windows-mdt/configure-mdt-deployment-share-rules.md) -##### [Configure MDT for UserExit scripts](deploy-windows-mdt/configure-mdt-for-userexit-scripts.md) -##### [Simulate a Windows 10 deployment in a test environment](deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md) -##### [Use the MDT database to stage Windows 10 deployment information](deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md) -##### [Assign applications using roles in MDT](deploy-windows-mdt/assign-applications-using-roles-in-mdt.md) -##### [Use web services in MDT](deploy-windows-mdt/use-web-services-in-mdt.md) -##### [Use Orchestrator runbooks with MDT](deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md) - -### Deploy Windows 10 with Microsoft Endpoint Configuration Manager -#### Prepare for Windows 10 deployment with Configuration Manager -##### [Prepare for Zero Touch Installation with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) -##### [Create a custom Windows PE boot image with Configuration Manager](deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md) -##### [Add a Windows 10 operating system image using Configuration Manager](deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md) -##### [Create an application to deploy with Windows 10 using Configuration Manager](deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) -##### [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) -##### [Create a task sequence with Configuration Manager and MDT](deploy-windows-cm/create-a-task-sequence-with-configuration-manager-and-mdt.md) -##### [Finalize the operating system configuration for Windows 10 deployment with Configuration Manager](deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md) - -#### Deploy Windows 10 with Configuration Manager -##### [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md) -##### [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) -##### [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) -##### [Perform an in-place upgrade to Windows 10 using Configuration Manager](deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md) - -### [Windows 10 deployment tools](windows-10-deployment-tools.md) - -#### [Windows 10 deployment scenarios and tools](windows-deployment-scenarios-and-tools.md) -#### [Convert MBR partition to GPT](mbr-to-gpt.md) -#### [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) -#### [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) - -#### [Deploy Windows To Go in your organization](deploy-windows-to-go.md) -##### [Windows To Go: feature overview](planning/windows-to-go-overview.md) -###### [Best practice recommendations for Windows To Go](planning/best-practice-recommendations-for-windows-to-go.md) -###### [Deployment considerations for Windows To Go](planning/deployment-considerations-for-windows-to-go.md) -###### [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) -###### [Security and data protection considerations for Windows To Go](planning/security-and-data-protection-considerations-for-windows-to-go.md) -###### [Windows To Go: frequently asked questions](planning/windows-to-go-frequently-asked-questions.md) - -#### [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) -##### [Introduction to VAMT](volume-activation/introduction-vamt.md) -##### [Active Directory-Based Activation Overview](volume-activation/active-directory-based-activation-overview.md) -##### [Install and Configure VAMT](volume-activation/install-configure-vamt.md) -###### [VAMT Requirements](volume-activation/vamt-requirements.md) -###### [Install VAMT](volume-activation/install-vamt.md) -###### [Configure Client Computers](volume-activation/configure-client-computers-vamt.md) -##### [Add and Manage Products](volume-activation/add-manage-products-vamt.md) -###### [Add and Remove Computers](volume-activation/add-remove-computers-vamt.md) -###### [Update Product Status](volume-activation/update-product-status-vamt.md) -###### [Remove Products](volume-activation/remove-products-vamt.md) -##### [Manage Product Keys](volume-activation/manage-product-keys-vamt.md) -###### [Add and Remove a Product Key](volume-activation/add-remove-product-key-vamt.md) -###### [Install a Product Key](volume-activation/install-product-key-vamt.md) -###### [Install a KMS Client Key](volume-activation/install-kms-client-key-vamt.md) -##### [Manage Activations](volume-activation/manage-activations-vamt.md) -###### [Perform Online Activation](volume-activation/online-activation-vamt.md) -###### [Perform Proxy Activation](volume-activation/proxy-activation-vamt.md) -###### [Perform KMS Activation](volume-activation/kms-activation-vamt.md) -###### [Perform Local Reactivation](volume-activation/local-reactivation-vamt.md) -###### [Activate an Active Directory Forest Online](volume-activation/activate-forest-vamt.md) -###### [Activate by Proxy an Active Directory Forest](volume-activation/activate-forest-by-proxy-vamt.md) -##### [Manage VAMT Data](volume-activation/manage-vamt-data.md) -###### [Import and Export VAMT Data](volume-activation/import-export-vamt-data.md) -###### [Use VAMT in Windows PowerShell](volume-activation/use-vamt-in-windows-powershell.md) -##### [VAMT Step-by-Step Scenarios](volume-activation/vamt-step-by-step.md) -###### [Scenario 1: Online Activation](volume-activation/scenario-online-activation-vamt.md) -###### [Scenario 2: Proxy Activation](volume-activation/scenario-proxy-activation-vamt.md) -###### [Scenario 3: KMS Client Activation](volume-activation/scenario-kms-activation-vamt.md) -##### [VAMT Known Issues](volume-activation/vamt-known-issues.md) -#### [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) -##### [User State Migration Tool (USMT) Overview Topics](usmt/usmt-topics.md) -###### [User State Migration Tool (USMT) Overview](usmt/usmt-overview.md) -###### [Getting Started with the User State Migration Tool (USMT)](usmt/getting-started-with-the-user-state-migration-tool.md) -###### [Windows Upgrade and Migration Considerations](upgrade/windows-upgrade-and-migration-considerations.md) -##### [User State Migration Tool (USMT) How-to topics](usmt/usmt-how-to.md) -###### [Exclude Files and Settings](usmt/usmt-exclude-files-and-settings.md) -###### [Extract Files from a Compressed USMT Migration Store](usmt/usmt-extract-files-from-a-compressed-migration-store.md) -###### [Include Files and Settings](usmt/usmt-include-files-and-settings.md) -###### [Migrate Application Settings](usmt/migrate-application-settings.md) -###### [Migrate EFS Files and Certificates](usmt/usmt-migrate-efs-files-and-certificates.md) -###### [Migrate User Accounts](usmt/usmt-migrate-user-accounts.md) -###### [Reroute Files and Settings](usmt/usmt-reroute-files-and-settings.md) -###### [Verify the Condition of a Compressed Migration Store](usmt/verify-the-condition-of-a-compressed-migration-store.md) -##### [User State Migration Tool (USMT) Troubleshooting](usmt/usmt-troubleshooting.md) -###### [Common Issues](usmt/usmt-common-issues.md) -###### [Frequently Asked Questions](usmt/usmt-faq.md) -###### [Log Files](usmt/usmt-log-files.md) -###### [Return Codes](usmt/usmt-return-codes.md) -###### [USMT Resources](usmt/usmt-resources.md) -##### [User State Migration Toolkit (USMT) Reference](usmt/usmt-reference.md) -###### [USMT Requirements](usmt/usmt-requirements.md) -###### [USMT Best Practices](usmt/usmt-best-practices.md) -###### [How USMT Works](usmt/usmt-how-it-works.md) -###### [Plan Your Migration](usmt/usmt-plan-your-migration.md) -####### [Common Migration Scenarios](usmt/usmt-common-migration-scenarios.md) -####### [What Does USMT Migrate?](usmt/usmt-what-does-usmt-migrate.md) -####### [Choose a Migration Store Type](usmt/usmt-choose-migration-store-type.md) -######## [Migration Store Types Overview](usmt/migration-store-types-overview.md) -######## [Estimate Migration Store Size](usmt/usmt-estimate-migration-store-size.md) -######## [Hard-Link Migration Store](usmt/usmt-hard-link-migration-store.md) -######## [Migration Store Encryption](usmt/usmt-migration-store-encryption.md) -####### [Determine What to Migrate](usmt/usmt-determine-what-to-migrate.md) -######## [Identify Users](usmt/usmt-identify-users.md) -######## [Identify Applications Settings](usmt/usmt-identify-application-settings.md) -######## [Identify Operating System Settings](usmt/usmt-identify-operating-system-settings.md) -######## [Identify File Types, Files, and Folders](usmt/usmt-identify-file-types-files-and-folders.md) -####### [Test Your Migration](usmt/usmt-test-your-migration.md) -###### [User State Migration Tool (USMT) Command-line Syntax](usmt/usmt-command-line-syntax.md) -####### [ScanState Syntax](usmt/usmt-scanstate-syntax.md) -####### [LoadState Syntax](usmt/usmt-loadstate-syntax.md) -####### [UsmtUtils Syntax](usmt/usmt-utilities.md) -###### [USMT XML Reference](usmt/usmt-xml-reference.md) -####### [Understanding Migration XML Files](usmt/understanding-migration-xml-files.md) -####### [Config.xml File](usmt/usmt-configxml-file.md) -####### [Customize USMT XML Files](usmt/usmt-customize-xml-files.md) -####### [Custom XML Examples](usmt/usmt-custom-xml-examples.md) -####### [Conflicts and Precedence](usmt/usmt-conflicts-and-precedence.md) -####### [General Conventions](usmt/usmt-general-conventions.md) -####### [XML File Requirements](usmt/xml-file-requirements.md) -####### [Recognized Environment Variables](usmt/usmt-recognized-environment-variables.md) -####### [XML Elements Library](usmt/usmt-xml-elements-library.md) -###### [Offline Migration Reference](usmt/offline-migration-reference.md) -### [Install fonts in Windows 10](windows-10-missing-fonts.md) - -## Update Windows 10 -### [Update Windows 10 in enterprise deployments](update/index.md) -### Windows as a service -#### [Windows as a service - introduction](update/windows-as-a-service.md) -#### [Quick guide to Windows as a service](update/waas-quick-start.md) -#### [Servicing stack updates](update/servicing-stack-updates.md) -#### [Overview of Windows as a service](update/waas-overview.md) -### [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) -### [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) -### [Assign devices to servicing channels for Windows 10 updates](update/waas-servicing-channels-windows-10-updates.md) -### Get started -#### [Get started with Windows Update](update/windows-update-overview.md) -#### [How Windows Update works](update/how-windows-update-works.md) -#### [Windows Update log files](update/windows-update-logs.md) -#### [How to troubleshoot Windows Update](update/windows-update-troubleshooting.md) -#### [Common Windows Update errors](update/windows-update-errors.md) -#### [Windows Update error code reference](update/windows-update-error-reference.md) -#### [Other Windows Update resources](update/windows-update-resources.md) -### Optimize delivery -#### [Optimize Windows 10 update delivery](update/waas-optimize-windows-10-updates.md) -#### [Delivery Optimization for Windows 10 updates](update/waas-delivery-optimization.md) -#### [Set up Delivery Optimization for Windows 10 updates](update/waas-delivery-optimization-setup.md) -#### [Delivery Optimization reference](update/waas-delivery-optimization-reference.md) -#### [Configure BranchCache for Windows 10 updates](update/waas-branchcache.md) -#### [Whitepaper: Windows Updates using forward and reverse differentials](update/PSFxWhitepaper.md) -### Monitor Windows Updates -#### [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md) -#### [Get started with Update Compliance](update/update-compliance-get-started.md) -##### [Update Compliance Configuration Script](update/update-compliance-configuration-script.md) -##### [Manually Configuring Devices for Update Compliance](update/update-compliance-configuration-manual.md) -#### [Use Update Compliance](update/update-compliance-using.md) -##### [Need Attention! report](update/update-compliance-need-attention.md) -##### [Security Update Status report](update/update-compliance-security-update-status.md) -##### [Feature Update Status report](update/update-compliance-feature-update-status.md) -##### [Delivery Optimization in Update Compliance](update/update-compliance-delivery-optimization.md) -##### [Data Handling and Privacy in Update Compliance](update/update-compliance-privacy.md) -##### [Update Compliance Schema Reference](update/update-compliance-schema.md) -###### [WaaSUpdateStatus](update/update-compliance-schema-waasupdatestatus.md) -###### [WaaSInsiderStatus](update/update-compliance-schema-waasinsiderstatus.md) -###### [WaaSDeploymentStatus](update/update-compliance-schema-waasdeploymentstatus.md) -###### [WUDOStatus](update/update-compliance-schema-wudostatus.md) -###### [WUDOAggregatedStatus](update/update-compliance-schema-wudoaggregatedstatus.md) -### Best practices -#### [Best practices for feature updates on mission-critical devices](update/feature-update-mission-critical.md) -#### [Update Windows 10 media with Dynamic Update](update/media-dynamic-update.md) -#### [Deploy feature updates during maintenance windows](update/feature-update-maintenance-window.md) -#### [Deploy feature updates for user-initiated installations](update/feature-update-user-install.md) -#### [Conclusion](update/feature-update-conclusion.md) -### [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](update/waas-mobile-updates.md) -### Use Windows Update for Business -#### [Deploy updates using Windows Update for Business](update/waas-manage-updates-wufb.md) -#### [Configure Windows Update for Business](update/waas-configure-wufb.md) -#### [Enforcing compliance deadlines for updates](update/wufb-compliancedeadlines.md) -#### [Integrate Windows Update for Business with management solutions](update/waas-integrate-wufb.md) -#### [Walkthrough: use Group Policy to configure Windows Update for Business](update/waas-wufb-group-policy.md) -#### [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) -### Use Windows Server Update Services -#### [Deploy Windows 10 updates using Windows Server Update Services](update/waas-manage-updates-wsus.md) -#### [Enable FoD and language pack updates in Windows Update](update/fod-and-lang-packs.md) -### [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](update/waas-manage-updates-configuration-manager.md) -### [Manage device restarts after updates](update/waas-restart.md) -### [Manage additional Windows Update settings](update/waas-wu-settings.md) -### [Determine the source of Windows updates](update/windows-update-sources.md) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml new file mode 100644 index 0000000000..fdc36528a1 --- /dev/null +++ b/windows/deployment/TOC.yml @@ -0,0 +1,535 @@ +- name: Deploy and update Windows 10 + href: index.yml + items: + - name: Get started + items: + - name: What's new + href: deploy-whats-new.md + - name: Windows 10 deployment scenarios + href: windows-10-deployment-scenarios.md + - name: What is Windows as a service? + href: update/waas-quick-start.md + - name: Windows update fundamentals + href: update/waas-overview.md + - name: Basics of Windows updates, channels, and tools + href: update/get-started-updates-channels-tools.md + - name: Servicing the Windows 10 operating system + href: update/waas-servicing-strategy-windows-10-updates.md + + - name: Deployment proof of concept + items: + - name: Demonstrate Autopilot deployment on a VM + href: windows-autopilot/demonstrate-deployment-on-vm.md + - name: Deploy Windows 10 with MDT and Configuration Manager + items: + - name: 'Step by step guide: Configure a test lab to deploy Windows 10' + href: windows-10-poc.md + - name: Deploy Windows 10 in a test lab using MDT + href: windows-10-poc-mdt.md + - name: Deploy Windows 10 in a test lab using Configuration Manager + href: windows-10-poc-sc-config-mgr.md + - name: Deployment process posters + href: windows-10-deployment-posters.md + + - name: Plan + items: + - name: Create a deployment plan + href: update/create-deployment-plan.md + - name: Define readiness criteria + href: update/plan-define-readiness.md + - name: Evaluate infrastructure and tools + href: update/eval-infra-tools.md + - name: Determine application readiness + href: update/plan-determine-app-readiness.md + - name: Define your servicing strategy + href: update/plan-define-strategy.md + - name: Delivery Optimization for Windows 10 updates + href: update/waas-delivery-optimization.md + items: + - name: Using a proxy with Delivery Optimization + href: update/delivery-optimization-proxy.md + - name: Best practices for feature updates on mission-critical devices + href: update/feature-update-mission-critical.md + - name: Windows 10 deployment considerations + href: planning/windows-10-deployment-considerations.md + - name: Windows 10 infrastructure requirements + href: planning/windows-10-infrastructure-requirements.md + - name: Plan for volume activation + href: volume-activation/plan-for-volume-activation-client.md + - name: Features removed or planned for replacement + items: + - name: Windows 10 features lifecycle + href: planning/features-lifecycle.md + - name: Features we're no longer developing + href: planning/windows-10-deprecated-features.md + - name: Features we removed + href: planning/windows-10-removed-features.md + + - name: Prepare + items: + - name: Prepare to deploy Windows 10 updates + href: update/prepare-deploy-windows.md + - name: Evaluate and update infrastructure + href: update/update-policies.md + - name: Update Baseline + href: update/update-baseline.md + - name: Set up Delivery Optimization for Windows 10 updates + href: update/waas-delivery-optimization-setup.md + - name: Configure BranchCache for Windows 10 updates + href: update/waas-branchcache.md + - name: Prepare your deployment tools + items: + - name: Prepare for deployment with MDT + href: deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md + - name: Prepare for deployment with Configuration Manager + href: deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md + - name: Build a successful servicing strategy + items: + - name: Build deployment rings for Windows 10 updates + href: update/waas-deployment-rings-windows-10-updates.md + - name: Prepare updates using Windows Update for Business + href: update/waas-manage-updates-wufb.md + - name: Prepare updates using WSUS + href: update/waas-manage-updates-wsus.md + + - name: Deploy + items: + - name: Deploy Windows 10 + items: + - name: Deploy Windows 10 with Autopilot + href: windows-autopilot/index.yml + - name: Deploy Windows 10 with Configuration Manager + items: + - name: Deploy to a new device + href: deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md + - name: Refresh a device + href: deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md + - name: Replace a device + href: deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md + - name: In-place upgrade + href: deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md + - name: Deploy Windows 10 with MDT + items: + - name: Deploy to a new device + href: deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md + - name: Refresh a device + href: deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md + - name: Replace a device + href: deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md + - name: In-place upgrade + href: deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md + - name: Subscription Activation + items: + - name: Windows 10 Subscription Activation + href: windows-10-subscription-activation.md + - name: Windows 10 Enterprise E3 in CSP + href: windows-10-enterprise-e3-overview.md + - name: Configure VDA for Subscription Activation + href: vda-subscription-activation.md + - name: Deploy Windows 10 Enterprise licenses + href: deploy-enterprise-licenses.md + - name: Deploy Windows 10 updates + items: + - name: Assign devices to servicing channels + href: update/waas-servicing-channels-windows-10-updates.md + - name: Deploy updates with Configuration Manager + href: update/deploy-updates-configmgr.md + - name: Deploy updates with Intune + href: update/deploy-updates-intune.md + - name: Deploy updates with WSUS + href: update/waas-manage-updates-wsus.md + - name: Deploy updates with Group Policy + href: update/waas-wufb-group-policy.md + - name: Update Windows 10 media with Dynamic Update + href: update/media-dynamic-update.md + - name: Migrating and acquiring optional Windows content + href: update/optional-content.md + - name: Safeguard holds + href: update/safeguard-holds.md + - name: Manage the Windows 10 update experience + items: + - name: Manage device restarts after updates + href: update/waas-restart.md + - name: Manage additional Windows Update settings + href: update/waas-wu-settings.md + - name: Deploy feature updates during maintenance windows + href: update/feature-update-maintenance-window.md + - name: Deploy feature updates for user-initiated installations + href: update/feature-update-user-install.md + - name: Use Windows Update for Business + items: + - name: What is Windows Update for Business? + href: update/waas-manage-updates-wufb.md + - name: Configure Windows Update for Business + href: update/waas-configure-wufb.md + - name: Enforcing compliance deadlines for updates + href: update/wufb-compliancedeadlines.md + - name: Integrate Windows Update for Business with management solutions + href: update/waas-integrate-wufb.md + - name: 'Walkthrough: use Group Policy to configure Windows Update for Business' + href: update/waas-wufb-group-policy.md + - name: 'Walkthrough: use Intune to configure Windows Update for Business' + href: update/deploy-updates-intune.md + - name: Monitor Windows 10 updates + items: + - name: Monitor Delivery Optimization + href: update/waas-delivery-optimization-setup.md#monitor-delivery-optimization + - name: Monitor Windows Updates + items: + - name: Monitor Windows Updates with Update Compliance + href: update/update-compliance-monitor.md + - name: Get started + items: + - name: Get started with Update Compliance + href: update/update-compliance-get-started.md + - name: Update Compliance configuration script + href: update/update-compliance-configuration-script.md + - name: Manually configuring devices for Update Compliance + href: update/update-compliance-configuration-manual.md + - name: Update Compliance monitoring + items: + - name: Use Update Compliance + href: update/update-compliance-using.md + - name: Need attention report + href: update/update-compliance-need-attention.md + - name: Security update status report + href: update/update-compliance-security-update-status.md + - name: Feature update status report + href: update/update-compliance-feature-update-status.md + - name: Delivery Optimization in Update Compliance + href: update/update-compliance-delivery-optimization.md + - name: Data handling and privacy in Update Compliance + href: update/update-compliance-privacy.md + - name: Update Compliance schema reference + href: update/update-compliance-schema.md + items: + - name: WaaSUpdateStatus + href: update/update-compliance-schema-waasupdatestatus.md + - name: WaaSInsiderStatus + href: update/update-compliance-schema-waasinsiderstatus.md + - name: WaaSDepoymentStatus + href: update/update-compliance-schema-waasdeploymentstatus.md + - name: WUDOStatus + href: update/update-compliance-schema-wudostatus.md + - name: WUDOAggregatedStatus + href: update/update-compliance-schema-wudoaggregatedstatus.md + - name: Troubleshooting + items: + - name: Resolve upgrade errors + items: + - name: Resolve Windows 10 upgrade errors + href: upgrade/resolve-windows-10-upgrade-errors.md + - name: Quick fixes + href: upgrade/quick-fixes.md + - name: SetupDiag + href: upgrade/setupdiag.md + - name: Troubleshooting upgrade errors + href: upgrade/troubleshoot-upgrade-errors.md + - name: Windows error reporting + href: upgrade/windows-error-reporting.md + - name: Upgrade error codes + href: upgrade/upgrade-error-codes.md + - name: Log files + href: upgrade/log-files.md + - name: Resolution procedures + href: upgrade/resolution-procedures.md + - name: Submit Windows 10 upgrade errors + href: upgrade/submit-errors.md + - name: Troubleshoot Windows Update + items: + - name: How to troubleshoot Windows Update + href: update/windows-update-troubleshooting.md + - name: Opt out of safeguard holds + href: update/safeguard-opt-out.md + - name: Determine the source of Windows Updates + href: update/windows-update-sources.md + - name: Common Windows Update errors + href: update/windows-update-errors.md + - name: Windows Update error code reference + href: update/windows-update-error-reference.md + + - name: Reference + items: + - name: How does Windows Update work? + href: update/how-windows-update-works.md + - name: Deploy Windows 10 with Microsoft 365 + href: deploy-m365.md + - name: Understanding the Unified Update Platform + href: update/windows-update-overview.md + - name: Servicing stack updates + href: update/servicing-stack-updates.md + - name: Additional Windows Update settings + href: update/waas-wu-settings.md + - name: Delivery Optimization reference + href: update/waas-delivery-optimization-reference.md + - name: Windows 10 in S mode + href: s-mode.md + - name: Switch to Windows 10 Pro or Enterprise from S mode + href: windows-10-pro-in-s-mode.md + - name: Windows 10 deployment tools + items: + - name: Windows 10 deployment scenarios and tools + items: + - name: Convert MBR partition to GPT + href: mbr-to-gpt.md + - name: Configure a PXE server to load Windows PE + href: configure-a-pxe-server-to-load-windows-pe.md + - name: Windows ADK for Windows 10 scenarios for IT Pros + href: windows-adk-scenarios-for-it-pros.md + - name: Windows To Go + items: + - name: Deploy Windows To Go in your organization + href: deploy-windows-to-go.md + - name: "Windows To Go: feature overview" + href: planning/windows-to-go-overview.md + - name: Best practice recommendations for Windows To Go + href: planning/best-practice-recommendations-for-windows-to-go.md + - name: Deployment considerations for Windows To Go + href: planning/deployment-considerations-for-windows-to-go.md + - name: Prepare your organization for Windows To Go + href: planning/prepare-your-organization-for-windows-to-go.md + - name: Security and data protection considerations for Windows To Go + href: planning/security-and-data-protection-considerations-for-windows-to-go.md + - name: "Windows To Go: frequently asked questions" + href: planning/windows-to-go-frequently-asked-questions.md + + - name: Volume Activation Management Tool (VAMT) technical reference + items: + - name: VAMT technical reference + href: volume-activation/volume-activation-management-tool.md + - name: Introduction to VAMT + href: volume-activation/introduction-vamt.md + - name: Active Directory-Based Activation Overview + href: volume-activation/active-directory-based-activation-overview.md + - name: Install and Configure VAMT + href: volume-activation/install-configure-vamt.md + - name: VAMT Requirements + href: volume-activation/vamt-requirements.md + - name: Install VAMT + href: volume-activation/install-vamt.md + - name: Configure Client Computers + href: volume-activation/configure-client-computers-vamt.md + - name: Add and Manage Products + href: volume-activation/add-manage-products-vamt.md + - name: Add and Remove Computers + href: volume-activation/add-remove-computers-vamt.md + - name: Update Product Status + href: volume-activation/update-product-status-vamt.md + - name: Remove Products + href: volume-activation/remove-products-vamt.md + - name: Manage Product Keys + href: volume-activation/manage-product-keys-vamt.md + - name: Add and Remove a Product Key + href: volume-activation/add-remove-product-key-vamt.md + - name: Install a Product Key + href: volume-activation/install-product-key-vamt.md + - name: Install a KMS Client Key + href: volume-activation/install-kms-client-key-vamt.md + - name: Manage Activations + href: volume-activation/manage-activations-vamt.md + - name: Perform Online Activation + href: volume-activation/online-activation-vamt.md + - name: Perform Proxy Activation + href: volume-activation/proxy-activation-vamt.md + - name: Perform KMS Activation + href: volume-activation/kms-activation-vamt.md + - name: Perform Local Reactivation + href: volume-activation/local-reactivation-vamt.md + - name: Activate an Active Directory Forest Online + href: volume-activation/activate-forest-vamt.md + - name: Activate by Proxy an Active Directory Forest + href: volume-activation/activate-forest-by-proxy-vamt.md + - name: Manage VAMT Data + href: volume-activation/manage-vamt-data.md + - name: Import and Export VAMT Data + href: volume-activation/import-export-vamt-data.md + - name: Use VAMT in Windows PowerShell + href: volume-activation/use-vamt-in-windows-powershell.md + - name: VAMT Step-by-Step Scenarios + href: volume-activation/vamt-step-by-step.md + - name: "Scenario 1: Online Activation" + href: volume-activation/scenario-online-activation-vamt.md + - name: "Scenario 2: Proxy Activation" + href: volume-activation/scenario-proxy-activation-vamt.md + - name: "Scenario 3: KMS Client Activation" + href: volume-activation/scenario-kms-activation-vamt.md + - name: VAMT Known Issues + href: volume-activation/vamt-known-issues.md + + - name: User State Migration Tool (USMT) technical reference + items: + - name: USMT overview topics + items: + - name: USMT overview + href: usmt/usmt-overview.md + - name: Getting started with the USMT + href: usmt/getting-started-with-the-user-state-migration-tool.md + - name: Windows upgrade and migration considerations + href: upgrade/windows-upgrade-and-migration-considerations.md + - name: USMT How-to topics + items: + - name: Exclude Files and Settings + href: usmt/usmt-exclude-files-and-settings.md + - name: Extract Files from a Compressed USMT Migration Store + href: usmt/usmt-extract-files-from-a-compressed-migration-store.md + - name: Include Files and Settings + href: usmt/usmt-include-files-and-settings.md + - name: Migrate Application Settings + href: usmt/migrate-application-settings.md + - name: Migrate EFS Files and Certificates + href: usmt/usmt-migrate-efs-files-and-certificates.md + - name: Migrate User Accounts + href: usmt/usmt-migrate-user-accounts.md + - name: Reroute Files and Settings + href: usmt/usmt-reroute-files-and-settings.md + - name: Verify the Condition of a Compressed Migration Store + href: usmt/verify-the-condition-of-a-compressed-migration-store.md + - name: USMT Troubleshooting + href: usmt/usmt-troubleshooting.md + - name: Common Issues + href: usmt/usmt-common-issues.md + - name: Frequently Asked Questions + href: usmt/usmt-faq.md + - name: Log Files + href: usmt/usmt-log-files.md + - name: Return Codes + href: usmt/usmt-return-codes.md + - name: USMT Resources + href: usmt/usmt-resources.md + + - name: USMT Reference + items: + - name: USMT Requirements + href: usmt/usmt-requirements.md + - name: USMT Best Practices + href: usmt/usmt-best-practices.md + - name: How USMT Works + href: usmt/usmt-how-it-works.md + - name: Plan Your Migration + href: usmt/usmt-plan-your-migration.md + - name: Common Migration Scenarios + href: usmt/usmt-common-migration-scenarios.md + - name: What Does USMT Migrate? + href: usmt/usmt-what-does-usmt-migrate.md + - name: Choose a Migration Store Type + href: usmt/usmt-choose-migration-store-type.md + - name: Migration Store Types Overview + href: usmt/migration-store-types-overview.md + - name: Estimate Migration Store Size + href: usmt/usmt-estimate-migration-store-size.md + - name: Hard-Link Migration Store + href: usmt/usmt-hard-link-migration-store.md + - name: Migration Store Encryption + href: usmt/usmt-migration-store-encryption.md + - name: Determine What to Migrate + href: usmt/usmt-determine-what-to-migrate.md + - name: Identify users + href: usmt/usmt-identify-users.md + - name: Identify Applications Settings + href: usmt/usmt-identify-application-settings.md + - name: Identify Operating System Settings + href: usmt/usmt-identify-operating-system-settings.md + - name: Identify File Types, Files, and Folders + href: usmt/usmt-identify-file-types-files-and-folders.md + - name: Test Your Migration + href: usmt/usmt-test-your-migration.md + - name: USMT Command-line Syntax + href: usmt/usmt-command-line-syntax.md + - name: ScanState Syntax + href: usmt/usmt-scanstate-syntax.md + - name: LoadState Syntax + href: usmt/usmt-loadstate-syntax.md + - name: UsmtUtils Syntax + href: usmt/usmt-utilities.md + - name: USMT XML Reference + href: usmt/usmt-xml-reference.md + - name: Understanding Migration XML Files + href: usmt/understanding-migration-xml-files.md + - name: Config.xml File + href: usmt/usmt-configxml-file.md + - name: Customize USMT XML Files + href: usmt/usmt-customize-xml-files.md + - name: Custom XML Examples + href: usmt/usmt-custom-xml-examples.md + - name: Conflicts and Precedence + href: usmt/usmt-conflicts-and-precedence.md + - name: General Conventions + href: usmt/usmt-general-conventions.md + - name: XML File Requirements + href: usmt/xml-file-requirements.md + - name: Recognized Environment Variables + href: usmt/usmt-recognized-environment-variables.md + - name: XML Elements Library + href: usmt/usmt-xml-elements-library.md + - name: Offline Migration Reference + href: usmt/offline-migration-reference.md + + - name: Application Compatibility Toolkit (ACT) Technical Reference + items: + - name: SUA User's Guide + href: planning/sua-users-guide.md + - name: Using the SUA Wizard + href: planning/using-the-sua-wizard.md + - name: Using the SUA Tool + href: planning/using-the-sua-tool.md + - name: Tabs on the SUA Tool Interface + href: planning/tabs-on-the-sua-tool-interface.md + - name: Showing Messages Generated by the SUA Tool + href: planning/showing-messages-generated-by-the-sua-tool.md + - name: Applying Filters to Data in the SUA Tool + href: planning/applying-filters-to-data-in-the-sua-tool.md + - name: Fixing Applications by Using the SUA Tool + href: planning/fixing-applications-by-using-the-sua-tool.md + - name: Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista + href: planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md + - name: Compatibility Administrator User's Guide + href: planning/compatibility-administrator-users-guide.md + - name: Using the Compatibility Administrator Tool + href: planning/using-the-compatibility-administrator-tool.md + - name: Available Data Types and Operators in Compatibility Administrator + href: planning/available-data-types-and-operators-in-compatibility-administrator.md + - name: Searching for Fixed Applications in Compatibility Administrator + href: planning/searching-for-fixed-applications-in-compatibility-administrator.md + - name: Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator + href: planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md + - name: Creating a Custom Compatibility Fix in Compatibility Administrator + href: planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md + - name: Creating a Custom Compatibility Mode in Compatibility Administrator + href: planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md + - name: Creating an AppHelp Message in Compatibility Administrator + href: planning/creating-an-apphelp-message-in-compatibility-administrator.md + - name: Viewing the Events Screen in Compatibility Administrator + href: planning/viewing-the-events-screen-in-compatibility-administrator.md + - name: Enabling and Disabling Compatibility Fixes in Compatibility Administrator + href: planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md + - name: Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator + href: planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md + - name: Managing Application-Compatibility Fixes and Custom Fix Databases + href: planning/managing-application-compatibility-fixes-and-custom-fix-databases.md + - name: Understanding and Using Compatibility Fixes + href: planning/understanding-and-using-compatibility-fixes.md + - name: Compatibility Fix Database Management Strategies and Deployment + href: planning/compatibility-fix-database-management-strategies-and-deployment.md + - name: Testing Your Application Mitigation Packages + href: planning/testing-your-application-mitigation-packages.md + - name: Using the Sdbinst.exe Command-Line Tool + href: planning/using-the-sdbinstexe-command-line-tool.md + - name: Volume Activation + href: volume-activation/volume-activation-windows-10.md + - name: Plan for volume activation + href: volume-activation/plan-for-volume-activation-client.md + - name: Activate using Key Management Service + href: volume-activation/activate-using-key-management-service-vamt.md + - name: Activate using Active Directory-based activation + href: volume-activation/activate-using-active-directory-based-activation-client.md + - name: Activate clients running Windows 10 + href: volume-activation/activate-windows-10-clients-vamt.md + - name: Monitor activation + href: volume-activation/monitor-activation-client.md + - name: Use the Volume Activation Management Tool + href: volume-activation/use-the-volume-activation-management-tool-client.md + - name: "Appendix: Information sent to Microsoft during activation " + href: volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md + + - name: Install fonts in Windows 10 + href: windows-10-missing-fonts.md \ No newline at end of file diff --git a/windows/deployment/Windows-AutoPilot-EULA-note.md b/windows/deployment/Windows-AutoPilot-EULA-note.md index ae15ebea5c..a57384798d 100644 --- a/windows/deployment/Windows-AutoPilot-EULA-note.md +++ b/windows/deployment/Windows-AutoPilot-EULA-note.md @@ -1,24 +1,25 @@ ---- -title: Windows Autopilot EULA dismissal – important information -description: A notice about EULA dismissal through Windows Autopilot -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 08/22/2017 -ms.reviewer: -manager: laurawi -audience: itpro author: greg-lindsay -ROBOTS: noindex,nofollow -ms.topic: article ---- -# Windows Autopilot EULA dismissal – important information - ->[!IMPORTANT] ->The information below isn't the EULA. It is a notice of awareness to the administrator that's configuring to skip End User License Agreement (EULA) during the OOBE (Out-of-Box Experience). - -Using this tool allows you to configure individual installations of Windows on devices managed by your organization. You may choose to suppress or hide certain set-up screens that are normally presented to users when setting up Windows, including the EULA acceptance screen. - -By using this function, you agree that suppressing or hiding any screens that are designed to provide users with notice or acceptance of terms means that you, on behalf of your organization or the individual user as the case may be, have consented to the notices and accepted the applicable terms. This includes your agreement to the terms and conditions of the license or notice that would be presented to the user if you did not suppress or hide it using this tool. You and your users may not use the Windows software on those devices if you have not validly acquired a license for the software from Microsoft or its licensed distributors. +--- +title: Windows Autopilot EULA dismissal – important information +description: A notice about EULA dismissal through Windows Autopilot +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +ms.audience: itpro +author: greg-lindsay +ms.date: 08/22/2017 +ms.reviewer: +manager: laurawi +audience: itpro +ROBOTS: noindex,nofollow +ms.topic: article +--- +# Windows Autopilot EULA dismissal – important information + +>[!IMPORTANT] +>The information below isn't the EULA. It is a notice of awareness to the administrator that's configuring to skip End User License Agreement (EULA) during the OOBE (Out-of-Box Experience). + +Using this tool allows you to configure individual installations of Windows on devices managed by your organization. You may choose to suppress or hide certain set-up screens that are normally presented to users when setting up Windows, including the EULA acceptance screen. + +By using this function, you agree that suppressing or hiding any screens that are designed to provide users with notice or acceptance of terms means that you, on behalf of your organization or the individual user as the case may be, have consented to the notices and accepted the applicable terms. This includes your agreement to the terms and conditions of the license or notice that would be presented to the user if you did not suppress or hide it using this tool. You and your users may not use the Windows software on those devices if you have not validly acquired a license for the software from Microsoft or its licensed distributors. diff --git a/windows/deployment/add-store-apps-to-image.md b/windows/deployment/add-store-apps-to-image.md index b51e38cfae..4a6d000511 100644 --- a/windows/deployment/add-store-apps-to-image.md +++ b/windows/deployment/add-store-apps-to-image.md @@ -1,6 +1,6 @@ --- title: Add Microsoft Store for Business applications to a Windows 10 image -description: This topic describes how to add Microsoft Store for Business applications to a Windows 10 image. +description: This article describes the correct way to add Microsoft Store for Business applications to a Windows 10 image. keywords: upgrade, update, windows, windows 10, deploy, store, image, wim ms.prod: w10 ms.mktglfcycl: deploy @@ -13,6 +13,7 @@ ms.author: greglin ms.reviewer: manager: laurawi ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Add Microsoft Store for Business applications to a Windows 10 image @@ -30,8 +31,7 @@ This topic describes the correct way to add Microsoft Store for Business applica * [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) for the tools required to mount and edit Windows images. -* Download an offline signed app package and license of the application you would like to add through [Microsoft Store for Business](/store-for-business/distribute-offline-apps#download-an-offline-licensed-app). -deploy-windows-cm +* Download an offline signed app package and license of the application you would like to add through [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app). * A Windows Image. For instructions on image creation, see [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md). >[!NOTE] diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md index f9405d730e..29ef793b14 100644 --- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md +++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md @@ -11,10 +11,9 @@ audience: itpro author: greg-lindsay ms.reviewer: manager: laurawi -audience: itpro -author: greg-lindsay ms.author: greglin ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Configure a PXE server to load Windows PE @@ -23,13 +22,11 @@ ms.topic: article - Windows 10 -## Summary - This walkthrough describes how to configure a PXE server to load Windows PE by booting a client computer from the network. Using the Windows PE tools and a Windows 10 image file, you can install Windows 10 from the network. ## Prerequisites -- A deployment computer: A computer with the [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) installed. +- A deployment computer: A computer with the [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) and the Windows PE add-on with ADK installed. - A DHCP server: A DHCP server or DHCP proxy configured to respond to PXE client requests is required. - A PXE server: A server running the TFTP service that can host Windows PE boot files that the client will download. - A file server: A server hosting a network file share. diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index e43658fdb5..d13e8feb57 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -26,15 +26,16 @@ This topic describes how to deploy Windows 10 Enterprise E3 or E5 licenses with >* Automatic, non-KMS activation requires Windows 10, version 1803 or later, on a device with a firmware-embedded activation key. >[!IMPORTANT] ->An issue has been identified where devices can lose activation status or be blocked from upgrading to Windows Enterprise if the device is not able to connect to Windows Update. A workaround is to ensure that devices do not have the REG_DWORD present HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations and set to 1. If this REG_DWORD is present, it must be set to 0.
        +>An issue has been identified where devices can lose activation status or be blocked from upgrading to Windows Enterprise if the device is not able to connect to Windows Update. A workaround is to ensure that devices do not have the REG_DWORD present HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations and set to 1. If this REG_DWORD is present, it must be set to 0. +> >Also ensure that the Group Policy setting: Computer Configuration > Administrative Templates > Windows Components > Windows Update > "Do not connect to any Windows Update Internet locations" is set to "Disabled". ## Firmware-embedded activation key -To determine if the computer has a firmware-embedded activation key, type the following command at an elevated Windows PowerShell prompt +To determine if the computer has a firmware-embedded activation key, type the following command at an elevated Windows PowerShell prompt: -``` -(Get-WmiObject -query ‘select * from SoftwareLicensingService’).OA3xOriginalProductKey +```PowerShell +(Get-CimInstance -query ‘select * from SoftwareLicensingService’).OA3xOriginalProductKey ``` If the device has a firmware-embedded activation key, it will be displayed in the output. If the output is blank, the device does not have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later will have a firmware-embedded key. @@ -44,19 +45,28 @@ If the device has a firmware-embedded activation key, it will be displayed in th If you are an EA customer with an existing Office 365 tenant, use the following steps to enable Windows 10 Subscription licenses on your existing tenant: 1. Work with your reseller to place an order for one $0 SKU per user. There are two SKUs available, depending on their current Windows Enterprise SA license: -2. **AAA-51069** - Win10UsrOLSActv Alng MonthlySub Addon E3 -3. **AAA-51068** - Win10UsrOLSActv Alng MonthlySub Addon E5 -4. After placing an order, the OLS admin on the agreement will receive a service activation email, indicating their subscription licenses have been provisioned on the tenant. -5. The admin can now assign subscription licenses to users. ->Use the following process if you need to update contact information and retrigger activation in order to resend the activation email: + - **AAA-51069** - Win10UsrOLSActv Alng MonthlySub Addon E3 + - **AAA-51068** - Win10UsrOLSActv Alng MonthlySub Addon E5 + +1. After placing an order, the OLS admin on the agreement will receive a service activation email, indicating their subscription licenses have been provisioned on the tenant. + +1. The admin can now assign subscription licenses to users. + +Use the following process if you need to update contact information and retrigger activation in order to resend the activation email: 1. Sign in to the [Microsoft Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). -2. Click on **Subscriptions**. -3. Click on **Online Services Agreement List**. + +2. Click **Subscriptions**. + +3. Click **Online Services Agreement List**. + 4. Enter your agreement number, and then click **Search**. + 5. Click the **Service Name**. + 6. In the **Subscription Contact** section, click the name listed under **Last Name**. + 7. Update the contact information, then click **Update Contact Details**. This will trigger a new email. Also in this article: @@ -91,17 +101,21 @@ Devices must be running Windows 10 Pro, version 1703, and be Azure Active Direct Upon acquisition of Windows 10 subscription has been completed (Windows 10 Business, E3 or E5), customers will receive an email that will provide guidance on how to use Windows as an online service: -![profile](images/al01.png) +> [!div class="mx-imgBorder"] +> ![profile](images/al01.png) The following methods are available to assign licenses: 1. When you have the required Azure AD subscription, [group-based licensing](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal) is the preferred method to assign Enterprise E3 or E5 licenses to users. + 2. You can sign in to portal.office.com and manually assign licenses: ![portal](images/al02.png) 3. You can assign licenses by uploading a spreadsheet. + 4. A per-user [PowerShell scripted method](https://social.technet.microsoft.com/wiki/contents/articles/15905.how-to-use-powershell-to-automatically-assign-licenses-to-your-office-365-users.aspx) of assigning licenses is available. + 5. Organizations can use synchronized [AD groups](https://ronnydejong.com/2015/03/04/assign-ems-licenses-based-on-local-active-directory-group-membership/) to automatically assign licenses. ## Explore the upgrade experience @@ -114,50 +128,50 @@ Users can join a Windows 10 Pro device to Azure AD the first time they start the **To join a device to Azure AD the first time the device is started** -1. During the initial setup, on the **Who owns this PC?** page, select **My organization**, and then click **Next**, as illustrated in **Figure 2**.
        +1. During the initial setup, on the **Who owns this PC?** page, select **My organization**, and then click **Next**, as illustrated in **Figure 2**.

        Who owns this PC? page in Windows 10 setup **Figure 2. The “Who owns this PC?” page in initial Windows 10 setup** -2. On the **Choose how you’ll connect** page, select **Join Azure AD**, and then click **Next**, as illustrated in **Figure 3**.
        +2. On the **Choose how you’ll connect** page, select **Join Azure AD**, and then click **Next**, as illustrated in **Figure 3**.

        Choose how you'll connect - page in Windows 10 setup **Figure 3. The “Choose how you’ll connect” page in initial Windows 10 setup** -3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 4**.
        +3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 4**.

        Let's get you signed in - page in Windows 10 setup **Figure 4. The “Let’s get you signed in” page in initial Windows 10 setup** -Now the device is Azure AD joined to the company’s subscription. +Now the device is Azure AD–joined to the company’s subscription. **To join a device to Azure AD when the device already has Windows 10 Pro, version 1703 installed and set up** >[!IMPORTANT] >Make sure that the user you're signing in with is **not** a BUILTIN/Administrator. That user cannot use the `+ Connect` button to join a work or school account. -1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 5**.
        +1. Go to **Settings > Accounts > Access work or school**, as illustrated in **Figure 5**.

        Connect to work or school configuration **Figure 5. Connect to work or school configuration in Settings** -2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 6**.
        +2. In **Set up a work or school account**, click **Join this device to Azure Active Directory**, as illustrated in **Figure 6**.

        Set up a work or school account **Figure 6. Set up a work or school account** -3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 7**.
        +3. On the **Let’s get you signed in** page, enter the Azure AD credentials, and then click **Sign in**, as illustrated in **Figure 7**.

        Let's get you signed in - dialog box **Figure 7. The “Let’s get you signed in” dialog box** -Now the device is Azure AD joined to the company’s subscription. +Now the device is Azure AD–joined to the company's subscription. ### Step 2: Pro edition activation @@ -165,7 +179,7 @@ Now the device is Azure AD joined to the company’s subscription. >If your device is running Windows 10, version 1803 or later, this step is not needed. From Windows 10, version 1803, the device will automatically activate Windows 10 Enterprise using the firmware-embedded activation key. >If the device is running Windows 10, version 1703 or 1709, then Windows 10 Pro must be successfully activated in **Settings > Update & Security > Activation**, as illustrated in **Figure 7a**. - +
        Windows 10 Pro activated
        Figure 7a - Windows 10 Pro activation in Settings @@ -176,7 +190,7 @@ Windows 10 Pro activation is required before Enterprise E3 or E5 can be enabled Once the device is joined to your Azure AD subscription, the user will sign in by using his or her Azure AD account, as illustrated in **Figure 8**. The Windows 10 Enterprise E3 or E5 license associated with the user will enable Windows 10 Enterprise edition capabilities on the device. -Sign in, Windows 10 +
        Sign in, Windows 10 **Figure 8. Sign in by using Azure AD account** @@ -184,7 +198,7 @@ Once the device is joined to your Azure AD subscription, the user will sign in b You can verify the Windows 10 Enterprise E3 or E5 subscription in **Settings > Update & Security > Activation**, as illustrated in **Figure 9**. - +
        Windows 10 activated and subscription active **Figure 9 - Windows 10 Enterprise subscription in Settings** @@ -218,19 +232,19 @@ Use the following figures to help you troubleshoot when users experience these c - [Figure 10](#win-10-not-activated) (below) illustrates a device on which Windows 10 Pro is not activated, but the Windows 10 Enterprise subscription is active. - +
        Windows 10 not activated and subscription active
        Figure 10 - Windows 10 Pro, version 1703 edition not activated in Settings - [Figure 11](#subscription-not-active) (below) illustrates a device on which Windows 10 Pro is activated, but the Windows 10 Enterprise subscription is lapsed or removed. - +
        Windows 10 activated and subscription not active
        Figure 11 - Windows 10 Enterprise subscription lapsed or removed in Settings - [Figure 12](#win-10-not-activated-subscription-not-active) (below) illustrates a device on which Windows 10 Pro license is not activated and the Windows 10 Enterprise subscription is lapsed or removed. - +
        Windows 10 not activated and subscription not active
        Figure 12 - Windows 10 Pro, version 1703 edition not activated and Windows 10 Enterprise subscription lapsed or removed in Settings diff --git a/windows/deployment/deploy-m365.md b/windows/deployment/deploy-m365.md index 750119724d..b541debb81 100644 --- a/windows/deployment/deploy-m365.md +++ b/windows/deployment/deploy-m365.md @@ -3,7 +3,7 @@ title: Deploy Windows 10 with Microsoft 365 ms.reviewer: manager: laurawi ms.author: greglin -description: Concepts about deploying Windows 10 for M365 +description: Learn about deploying Windows 10 with Microsoft 365 and how to use a free 90-day trial account to review some of the benefits of Microsoft 365. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,6 +14,7 @@ audience: itpro author: greg-lindsay ms.topic: article ms.collection: M365-modern-desktop +ms.custom: seo-marvel-apr2020 --- # Deploy Windows 10 with Microsoft 365 @@ -50,8 +51,8 @@ You can check out the Microsoft 365 deployment advisor and other resources for f >If you have not run a setup guide before, you will see the **Prepare your environment** guide first. This is to make sure you have basics covered like domain verification and a method for adding users. At the end of the "Prepare your environment" guide, there will be a **Ready to continue** button that sends you to the original guide that was selected. 1. [Obtain a free M365 trial](https://docs.microsoft.com/office365/admin/try-or-buy-microsoft-365). -2. Check out the [Microsoft 365 deployment advisor](https://portal.office.com/onboarding/Microsoft365DeploymentAdvisor#/). -3. Also check out the [Windows Analytics deployment advisor](https://portal.office.com/onboarding/WindowsAnalyticsDeploymentAdvisor#/). This advisor will walk you through deploying [Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness), [Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), and [Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor). +2. Check out the [Microsoft 365 deployment advisor](https://aka.ms/microsoft365setupguide). +3. Also check out the [Windows Analytics deployment advisor](https://aka.ms/windowsanalyticssetupguide). This advisor will walk you through deploying [Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview). That's all there is to it! diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index 4e60ac99b8..0cea204292 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -3,7 +3,7 @@ title: What's new in Windows 10 deployment ms.reviewer: manager: laurawi ms.author: greglin -description: Changes and new features related to Windows 10 deployment +description: Use this article to learn about new solutions and online content related to deploying Windows 10 in your organization. keywords: deployment, automate, tools, configure, news ms.mktglfcycl: deploy ms.localizationpriority: medium @@ -13,26 +13,29 @@ ms.pagetype: deploy audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # What's new in Windows 10 deployment -**Applies to** -- Windows 10 +**Applies to:** +- Windows 10 ## In this topic This topic provides an overview of new solutions and online content related to deploying Windows 10 in your organization. - For an all-up overview of new features in Windows 10, see [What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/index). -- For a detailed list of changes to Windows 10 ITPro TechNet library content, see [Online content change history](#online-content-change-history). -## Recent additions to this page +## Latest news -[SetupDiag](#setupdiag) 1.6 is released.
        -The [Windows ADK for Windows 10, version 1903](https://docs.microsoft.com/windows-hardware/get-started/adk-install) is available.
        -New [Windows Autopilot](#windows-autopilot) content is available.
        -[Windows 10 Subscription Activation](#windows-10-subscription-activation) now supports Windows 10 Education. +[SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later.
        +The [Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/adk-install) is available.
        +New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).
        +VPN support is added to [Windows Autopilot](#windows-autopilot)
        +An in-place upgrade wizard is available in [Configuration Manager](#microsoft-endpoint-configuration-manager).
        +The [Windows ADK](#windows-assessment-and-deployment-kit-adk) for Windows 10, version 2004 is available.
        +The Windows 10 deployment and update [landing page](index.yml) has been redesigned, with additional content added and more content coming soon.
        ## The Modern Desktop Deployment Center @@ -40,21 +43,48 @@ The [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/ ## Microsoft 365 -Microsoft 365 is a new offering from Microsoft that combines +Microsoft 365 is a new offering from Microsoft that combines - Windows 10 - Office 365 -- Enterprise Mobility and Security (EMS). +- Enterprise Mobility and Security (EMS). See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, which now includes a link to download a nifty [M365 Enterprise poster](deploy-m365.md#m365-enterprise-poster). ## Windows 10 servicing and support -- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon! -- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. -- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. +### Delivery Optimization + +Windows PowerShell cmdlets for Delivery Optimization have been improved: + +- **Get-DeliveryOptimizationStatus** has added the **-PeerInfo** option for a real-time peak behind the scenes on peer-to-peer activity (for example the peer IP Address, bytes received / sent). +- **Get-DeliveryOptimizationLogAnalysis** is a new cmdlet that provides a summary of the activity in your DO log (# of downloads, downloads from peers, overall peer efficiency). Use the **-ListConnections** option to for in-depth look at peer-to-peer connections. +- **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to assist in troubleshooting. + +Additional improvements in [Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization) include: +- Enterprise network [throttling is enhanced](https://docs.microsoft.com/windows-insider/archive/new-for-business#new-download-throttling-options-for-delivery-optimization-build-18917) to optimize foreground vs. background throttling. +- Automatic cloud-based congestion detection is available for PCs with cloud service support. +- Improved peer efficiency for enterprises and educational institutions with complex networks is enabled with [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates and Intune content, with Microsoft Endpoint Manager content coming soon! + +The following Delivery Optimization policies are removed in the Windows 10, version 2004 release: + +- Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth) + - Reason: Replaced with separate policies for foreground and background +- Max Upload Bandwidth (DOMaxUploadBandwidth) + - Reason: impacts uploads to internet peers only, which isn't used in enterprises. +- Absolute max throttle (DOMaxDownloadBandwidth) + - Reason: separated to foreground and background + +### Windows Update for Business + +[Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) enhancements in this release include: +- Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. +- Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds. + +- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically log on as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. +- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. -- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. -- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. +- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. +- **Improved update notifications**: When there's an update requiring you to restart your device, you'll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. - **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. - **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. @@ -70,12 +100,15 @@ Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel o For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) - ## Deployment solutions and tools ### Windows Autopilot -[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose and recover devices. +[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose, and recover devices. + +With the release of Windows 10, version 2004 you can configure [Windows Autopilot user-driven](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven) Hybrid Azure Active Directory join with VPN support. This support is also backported to Windows 10, version 1909 and 1903. + +If you configure the language settings in the Autopilot profile and the device is connected to Ethernet, all scenarios will now skip the language, locale, and keyboard pages. In previous versions, this was only supported with self-deploying profiles. The following Windows Autopilot features are available in Windows 10, version 1903 and later: @@ -83,7 +116,11 @@ The following Windows Autopilot features are available in Windows 10, version 19 - The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. - [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. - Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. -- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. +- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. + +### Microsoft Endpoint Configuration Manager + +An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364). ### Windows 10 Subscription Activation @@ -93,17 +130,19 @@ With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to ### SetupDiag -[SetupDiag](upgrade/setupdiag.md) is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. +[SetupDiag](upgrade/setupdiag.md) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. -SetupDiag version 1.6.0.42 was released on 08/08/2019. +In Windows 10, version 2004, SetupDiag is now automatically installed. + +During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, Windows Setup now also installs SetupDiag.exe to this directory. If there is an issue with the upgrade, SetupDiag is automatically run to determine the cause of the failure. If the upgrade process proceeds normally, this directory is moved under %SystemDrive%\Windows.Old for cleanup. ### Upgrade Readiness -The Upgrade Readiness tool moved from public preview to general availability on March 2, 2017. +The Upgrade Readiness tool moved from public preview to general availability on March 2, 2017. -Upgrade Readiness helps you ensure that applications and drivers are ready for a Windows 10 upgrade. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. +Upgrade Readiness helps you ensure that applications and drivers are ready for a Windows 10 upgrade. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. -The development of Upgrade Readiness has been heavily influenced by input from the community the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled. +The development of Upgrade Readiness has been heavily influenced by input from the community; the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled. For more information about Upgrade Readiness, see the following topics: @@ -125,33 +164,33 @@ Device Health is the newest Windows Analytics solution that complements the exis ### MBR2GPT -MBR2GPT.EXE converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. Previously, it was necessary to image, then wipe and reload a disk to change from MBR format to GPT. +MBR2GPT.EXE converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. Previously, it was necessary to image, then wipe and reload a disk to change from MBR format to GPT. There are many benefits to converting the partition style of a disk to GPT, including the use of larger disk partitions, added data reliability, and faster boot and shutdown speeds. The GPT format also enables you to use the Unified Extensible Firmware Interface (UEFI) which replaces the Basic Input/Output System (BIOS) firmware interface. Security features of Windows 10 that require UEFI mode include: Secure Boot, Early Launch Anti-malware (ELAM) driver, Windows Trusted Boot, Measured Boot, Device Guard, Credential Guard, and BitLocker Network Unlock. For more information, see [MBR2GPT.EXE](mbr-to-gpt.md). - ### Microsoft Deployment Toolkit (MDT) -MDT build 8456 (12/19/2018) is available, including support for Windows 10, version 1809, and Windows Server 2019. - -For more information about MDT, see the [MDT resource page](https://docs.microsoft.com/sccm/mdt/). +MDT version 8456 supports Windows 10, version 2004 and earlier operating systems, including Windows Server 2019. There is currently an issue that causes MDT to incorrectly detect that UEFI is present in Windows 10, version 2004. This issue is currently under investigation. +For the latest information about MDT, see the [MDT release notes](https://docs.microsoft.com/mem/configmgr/mdt/release-notes). ### Windows Assessment and Deployment Kit (ADK) -The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. See the following topics: +The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. -- [What's new in ADK kits and tools](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools) -- [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) +Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install). +For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004). + +Also see [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). ## Testing and validation guidance ### Windows 10 deployment proof of concept (PoC) -The Windows 10 PoC guide enables you to test Windows 10 deployment in a virtual environment and become familiar with deployment tools such as MDT and Configuration Manager. The PoC guide provides step-by-step instructions for installing and using Hyper-V to create a virtual lab environment. The guide makes extensive use of Windows PowerShell to streamline each phase of the installation and setup. +The Windows 10 PoC guide enables you to test Windows 10 deployment in a virtual environment and become familiar with deployment tools such as MDT and Configuration Manager. The PoC guide provides step-by-step instructions for installing and using Hyper-V to create a virtual lab environment. The guide makes extensive use of Windows PowerShell to streamline each phase of the installation and setup. For more information, see the following guides: @@ -159,25 +198,15 @@ For more information, see the following guides: - [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) - [Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md) - ## Troubleshooting guidance [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) was published in October of 2016 and will continue to be updated with new fixes. The topic provides a detailed explanation of the Windows 10 upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process. - -## Online content change history - -The following topics provide a change history for Windows 10 ITPro TechNet library content related to deploying and using Windows 10. - -[Change history for Access Protection](/windows/access-protection/change-history-for-access-protection)
        -[Change history for Device Security](/windows/device-security/change-history-for-device-security)
        -[Change history for Threat Protection](/windows/threat-protection/change-history-for-threat-protection) - ## Related topics -[Overview of Windows as a service](update/waas-overview.md) -
        [Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md) -
        [Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information) -
        [Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications) -
        [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) -
        [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md) +[Overview of Windows as a service](update/waas-overview.md)
        +[Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md)
        +[Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information)
        +[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications)
        +[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
        +[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
        diff --git a/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md index 1fd47c5505..5d44f0af26 100644 --- a/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/add-a-windows-10-operating-system-image-using-configuration-manager.md @@ -1,5 +1,5 @@ --- -title: Add a Windows 10 operating system image using Configuration Manager (Windows 10) +title: Add a Windows 10 operating system image using Configuration Manager description: Operating system images are typically the production image used for deployment throughout the organization. ms.assetid: 77f769cc-1a47-4f36-8082-201cd77b8d3b ms.reviewer: @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Add a Windows 10 operating system image using Configuration Manager diff --git a/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md index e8896d30de..85dcbc3828 100644 --- a/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md @@ -1,5 +1,5 @@ --- -title: Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager (Windows 10) +title: Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager description: Learn how to configure the Windows Preinstallation Environment (Windows PE) to include required network and storage drivers. ms.assetid: 97b3ea46-28d9-407e-8c42-ded2e45e8d5c ms.reviewer: @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager @@ -51,10 +52,10 @@ On **CM01**: 6. In the popup window that appears, click **Yes** to automatically update the distribution point. 7. Click **Next**, wait for the image to be updated, and then click **Close**. - ![Add drivers to Windows PE](../images/fig21-add-drivers1.png "Add drivers to Windows PE")
        - ![Add drivers to Windows PE](../images/fig21-add-drivers2.png "Add drivers to Windows PE")
        - ![Add drivers to Windows PE](../images/fig21-add-drivers3.png "Add drivers to Windows PE")
        - ![Add drivers to Windows PE](../images/fig21-add-drivers4.png "Add drivers to Windows PE") + ![Add drivers to Windows PE step 1](../images/fig21-add-drivers1.png)
        + ![Add drivers to Windows PE step 2](../images/fig21-add-drivers2.png)
        + ![Add drivers to Windows PE step 3](../images/fig21-add-drivers3.png)
        + ![Add drivers to Windows PE step 4](../images/fig21-add-drivers4.png) Add drivers to Windows PE @@ -64,7 +65,7 @@ This section illustrates how to add drivers for Windows 10 using the HP EliteBoo For the purposes of this section, we assume that you have downloaded the Windows 10 drivers for the HP EliteBook 8560w model and copied them to the **D:\Sources$\OSD\DriverSources\Windows 10 x64\Hewlett-Packard\HP EliteBook 8560w** folder on CM01. -![Drivers](../images/cm01-drivers-windows.png) +![Drivers in Windows](../images/cm01-drivers-windows.png) Driver folder structure on CM01 diff --git a/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md index 5ff94676d8..e4d235f852 100644 --- a/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md @@ -1,6 +1,6 @@ --- title: Create a custom Windows PE boot image with Configuration Manager (Windows 10) -description: In Microsoft Endpoint Configuration Manager, you can create custom Windows Preinstallation Environment (Windows PE) boot images that include extra components and features. +description: Learn how to create custom Windows Preinstallation Environment (Windows PE) boot images in Microsoft Endpoint Configuration Manager. ms.assetid: b9e96974-324d-4fa4-b0ce-33cfc49c4809 ms.reviewer: manager: laurawi @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Create a custom Windows PE boot image with Configuration Manager @@ -71,8 +72,8 @@ On **CM01**: 8. In the Distribute Content Wizard, add the CM01 distribution point, and complete the wizard. 9. Using Configuration Manager Trace, review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file. Do not continue until you can see that the boot image is distributed. Look for the line that reads **STATMSG: ID=2301**. You also can monitor Content Status in the Configuration Manager Console at **\Monitoring\Overview\Distribution Status\Content Status\Zero Touch WinPE x64**. See the following examples: - ![Content status for the Zero Touch WinPE x64 boot image](../images/fig16-contentstatus1.png "Content status for the Zero Touch WinPE x64 boot image")
        - ![Content status for the Zero Touch WinPE x64 boot image](../images/fig16-contentstatus2.png "Content status for the Zero Touch WinPE x64 boot image") + ![Content status for the Zero Touch WinPE x64 boot image step 1](../images/fig16-contentstatus1.png)
        + ![Content status for the Zero Touch WinPE x64 boot image step 2](../images/fig16-contentstatus2.png) Content status for the Zero Touch WinPE x64 boot image @@ -81,8 +82,8 @@ On **CM01**: 12. Using Configuration Manager Trace, review the D:\\Program Files\\Microsoft Configuration Manager\\Logs\\distmgr.log file and look for this text: **Expanding PS100009 to D:\\RemoteInstall\\SMSImages**. 13. Review the **D:\\RemoteInstall\\SMSImages** folder. You should see three folders containing boot images. Two are from the default boot images, and the third folder (PS100009) is from your new boot image with DaRT. See the examples below: - ![PS100009-1](../images/ps100009-1.png)
        - ![PS100009-2](../images/ps100009-2.png) + ![PS100009 step 1](../images/ps100009-1.png)
        + ![PS100009 step 2](../images/ps100009-2.png) >Note: Depending on your infrastructure and the number of packages and boot images present, the Image ID might be a different number than PS100009. diff --git a/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md index 7e1c6b9819..4b0eb20dcf 100644 --- a/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md @@ -1,6 +1,6 @@ --- title: Create an app to deploy with Windows 10 using Configuration Manager -description: Microsoft Microsoft Endpoint Configuration Manager supports deploying applications as part of the Windows 10 deployment process. +description: Microsoft Microsoft Endpoint Manager supports deploying applications as part of the Windows 10 deployment process. ms.assetid: 2dfb2f39-1597-4999-b4ec-b063e8a8c90c ms.reviewer: manager: laurawi @@ -22,7 +22,7 @@ ms.topic: article - Windows 10 -Microsoft Endpoint Configuration Manager supports deploying applications as part of the Windows 10 deployment process. In this section, you create an application in Microsoft Endpoint Configuration Manager that you later configure the task sequence to use. +Microsoft Endpoint Manager supports deploying applications as part of the Windows 10 deployment process. In this section, you create an application in Microsoft Endpoint Manager that you later configure the task sequence to use. For the purposes of this guide, we will use one server computer: CM01. - CM01 is a domain member server and Configuration Manager software distribution point. In this guide CM01 is a standalone primary site server. CM01 is running Windows Server 2019. However, an earlier, supported version of Windows Server can also be used. diff --git a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md index a5ea3f78c2..ccb8ed6bb5 100644 --- a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md @@ -1,6 +1,6 @@ --- title: Deploy Windows 10 using PXE and Configuration Manager (Windows 10) -description: In this topic, you will learn how to deploy Windows 10 using Microsoft Endpoint Configuration Manager deployment packages and task sequences. +description: In this topic, you will learn how to deploy Windows 10 using Microsoft Endpoint Manager deployment packages and task sequences. ms.assetid: fb93f514-5b30-4f4b-99dc-58e6860009fa ms.reviewer: manager: laurawi @@ -21,7 +21,7 @@ ms.topic: article - Windows 10 -In this topic, you will learn how to deploy Windows 10 using Microsoft Endpoint Configuration Manager deployment packages and task sequences. This topic will walk you through the process of deploying the Windows 10 Enterprise image to a Unified Extensible Firmware Interface (UEFI) computer named PC0001. An existing Configuration Manager infrastructure that is integrated with MDT is used for the procedures in this topic. +In this topic, you will learn how to deploy Windows 10 using Microsoft Endpoint Manager deployment packages and task sequences. This topic will walk you through the process of deploying the Windows 10 Enterprise image to a Unified Extensible Firmware Interface (UEFI) computer named PC0001. An existing Configuration Manager infrastructure that is integrated with MDT is used for the procedures in this topic. This topic assumes that you have completed the following prerequisite procedures: - [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) @@ -51,7 +51,7 @@ All server and client computers referenced in this guide are on the same subnet. ## Procedures 1. Start the PC0001 computer. At the Pre-Boot Execution Environment (PXE) boot menu, press **Enter** to allow it to PXE boot. -2. On the **Welcome to the Task Sequence Wizard** page, type in the password **pass@word1** and click **Next**. +2. On the **Welcome to the Task Sequence Wizard** page, type in the password **pass\@word1** and click **Next**. 3. On the **Select a task sequence to run** page, select **Windows 10 Enterprise x64 RTM** and click **Next**. 4. On the **Edit Task Sequence Variables** page, double-click the **OSDComputerName** variable, and in the **Value** field, type **PC0001** and click **OK**. Then click **Next**. 5. The operating system deployment will take several minutes to complete. @@ -99,4 +99,4 @@ Next, see [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Ma [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
        [Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
        [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
        -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
        \ No newline at end of file +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
        diff --git a/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md index b3c301d048..87bed1dd16 100644 --- a/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md @@ -1,6 +1,6 @@ --- title: Finalize operating system configuration for Windows 10 deployment -description: Follow this walk-through to finalize the configuration of your Windows 10 operating deployment. +description: This article provides a walk-through to finalize the configuration of your Windows 10 operating deployment. ms.assetid: 38b55fa8-e717-4689-bd43-8348751d493e ms.reviewer: manager: laurawi @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Finalize the operating system configuration for Windows 10 deployment with Configuration Manager diff --git a/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md index ca87d2d6b3..348d4fd07c 100644 --- a/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md @@ -1,5 +1,5 @@ --- -title: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager (Windows 10) +title: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager description: Learn how to prepare a Zero Touch Installation of Windows 10 with Configuration Manager, by integrating Configuration Manager with Microsoft Deployment Toolkit. ms.assetid: 06e3a221-31ef-47a5-b4da-3b927cb50d08 ms.reviewer: @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Prepare for Zero Touch Installation of Windows 10 with Configuration Manager @@ -21,7 +22,7 @@ ms.topic: article - Windows 10 -This topic will walk you through the Zero Touch Installation process of Windows 10 operating system deployment (OSD) using Microsoft Endpoint Configuration Manager (ConfigMgr) [integrated](#why-integrate-mdt-with-configuration-manager) with Microsoft Deployment Toolkit (MDT). +This topic will walk you through the Zero Touch Installation process of Windows 10 operating system deployment (OSD) using Microsoft Endpoint Manager (ConfigMgr) [integrated](#why-integrate-mdt-with-configuration-manager) with Microsoft Deployment Toolkit (MDT). ## Prerequisites @@ -128,7 +129,7 @@ In order for the Configuration Manager Join Domain Account (CM\_JD) to join mach On **DC01**: -1. Sign in as contoso\administrtor and enter the following at an elevated Windows PowerShell prompt: +1. Sign in as contoso\administrator and enter the following at an elevated Windows PowerShell prompt: ``` Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force @@ -240,7 +241,7 @@ On **CM01**: 2. Right-click **PS1 - Primary Site 1**, point to **Configure Site Components**, and then select **Software Distribution**. 3. On the **Network Access Account** tab, select **Specify the account that accesses network locations** and add the *New Account* **CONTOSO\\CM\_NAA** as the Network Access account (password: pass@word1). Use the new **Verify** option to verify that the account can connect to the **\\\\DC01\\sysvol** network share. -![figure 12](../images/mdt-06-fig12.png) +![figure 11](../images/mdt-06-fig12.png) Test the connection for the Network Access account. @@ -388,4 +389,4 @@ You can create reference images for Configuration Manager in Configuration Manag [Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
        [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
        [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
        -[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) \ No newline at end of file +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) diff --git a/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md index 24ea36579b..7ff3078c04 100644 --- a/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -1,5 +1,5 @@ --- -title: Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) +title: Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager description: Learn how to use Configuration Manager and Microsoft Deployment Toolkit (MDT) to refresh a Windows 7 SP1 client with Windows 10. ms.assetid: 57c81667-1019-4711-b3de-15ae9c5387c7 ms.reviewer: @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager @@ -57,9 +58,9 @@ On **PC0003**: 1. Open the Configuration Manager control panel (control smscfgrc). 2. On the **Site** tab, click **Configure Settings**, then click **Find Site**. -3. Verify that Configuration Manager has successfullyl found a site to manage this client is displayed. See the following example. +3. Verify that Configuration Manager has successfully found a site to manage this client is displayed. See the following example. -![pc0003a](../images/pc0003a.png) +![Found a site to manage this client](../images/pc0003a.png) ## Create a device collection and add the PC0003 computer @@ -123,16 +124,16 @@ On **PC0003**: 2. In the **Software Center** warning dialog box, click **Install Operating System**. 3. The client computer will run the Configuration Manager task sequence, boot into Windows PE, and install the new OS and applications. See the following examples: -![pc0003b](../images/pc0003b.png)
        -![pc0003c](../images/pc0003c.png)
        -![pc0003d](../images/pc0003d.png)
        -![pc0003e](../images/pc0003e.png)
        -![pc0003f](../images/pc0003f.png)
        -![pc0003g](../images/pc0003g.png)
        -![pc0003h](../images/pc0003h.png)
        -![pc0003i](../images/pc0003i.png)
        -![pc0003j](../images/pc0003j.png)
        -![pc0003k](../images/pc0003k.png) +![Task sequence example 1](../images/pc0003b.png)
        +![Task sequence example 2](../images/pc0003c.png)
        +![Task sequence example 3](../images/pc0003d.png)
        +![Task sequence example 4](../images/pc0003e.png)
        +![Task sequence example 5](../images/pc0003f.png)
        +![Task sequence example 6](../images/pc0003g.png)
        +![Task sequence example 7](../images/pc0003h.png)
        +![Task sequence example 8](../images/pc0003i.png)
        +![Task sequence example 9](../images/pc0003j.png)
        +![Task sequence example 10](../images/pc0003k.png) Next, see [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md). diff --git a/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md b/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md index b2ef8ff138..4c98f861cf 100644 --- a/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md @@ -1,5 +1,5 @@ --- -title: Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager (Windows 10) +title: Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager description: In this topic, you will learn how to replacing a Windows 7 SP1 computer using Microsoft Endpoint Configuration Manager. ms.assetid: 3c8a2d53-8f08-475f-923a-bca79ca8ac36 ms.reviewer: @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager @@ -159,7 +160,7 @@ On **PC0004**: 4. Confirm you want to upgrade the operating system on this computer by clicking **Install** again. 5. Allow the Replace Task Sequence to complete. The PC0004 computer will gather user data, boot into Windows PE and gather more data, then boot back to the full OS. The entire process should only take a few minutes. -![pc0004b](../images/pc0004b.png) +![Task sequence example](../images/pc0004b.png) Capturing the user state @@ -190,15 +191,15 @@ On **PC0006**: When the process is complete, you will have a new Windows 10 computer in your domain with user data and settings restored. See the following examples: -![pc0006a](../images/pc0006a.png)
        -![pc0006b](../images/pc0006b.png)
        -![pc0006c](../images/pc0006c.png)
        -![pc0006d](../images/pc0006d.png)
        -![pc0006e](../images/pc0006e.png)
        -![pc0006f](../images/pc0006f.png)
        -![pc0006g](../images/pc0006g.png)
        -![pc0006h](../images/pc0006h.png)
        -![pc0006i](../images/pc0006i.png) +![User data and setting restored example 1](../images/pc0006a.png)
        +![User data and setting restored example 2](../images/pc0006b.png)
        +![User data and setting restored example 3](../images/pc0006c.png)
        +![User data and setting restored example 4](../images/pc0006d.png)
        +![User data and setting restored example 5](../images/pc0006e.png)
        +![User data and setting restored example 6](../images/pc0006f.png)
        +![User data and setting restored example 7](../images/pc0006g.png)
        +![User data and setting restored example 8](../images/pc0006h.png)
        +![User data and setting restored example 9](../images/pc0006i.png) Next, see [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade-to-windows-10-with-configuraton-manager.md). diff --git a/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md b/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md index 553be3b239..1c8551218d 100644 --- a/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md +++ b/windows/deployment/deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md @@ -1,6 +1,6 @@ --- title: Perform in-place upgrade to Windows 10 via Configuration Manager -description: In-place upgrades make upgrading Windows 7, Windows 8, and Windows 8.1 to Windows 10 easy -- you can even automate the whole process with a Microsoft Endpoint Configuration Manager task sequence. +description: Learn how to perform an in-place upgrade to Windows 10 by automating the process with a Microsoft Endpoint Manager task sequence. ms.assetid: F8DF6191-0DB0-4EF5-A9B1-6A11D5DE4878 ms.reviewer: manager: laurawi @@ -12,6 +12,7 @@ ms.mktglfcycl: deploy audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Perform an in-place upgrade to Windows 10 using Configuration Manager @@ -21,7 +22,7 @@ ms.topic: article - Windows 10 -The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Endpoint Configuration Manager task sequence to completely automate the process. +The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Endpoint Manager task sequence to completely automate the process. >[!IMPORTANT] >Beginning with Windows 10 and Windows Server 2016, Windows Defender is already installed. A management client for Windows Defender is also installed automatically if the Configuration Manager client is installed. However, previous Windows operating systems installed the System Center Endpoint Protection (SCEP) client with the Configuration Manager client. The SCEP client can block in-place upgrade to Windows 10 due to incompatibility, and must be removed from a device before performing an in-place upgrade to Windows 10. @@ -126,13 +127,13 @@ On **PC0004**: 4. Confirm you want to upgrade the operating system on this computer by clicking **Install** again. 5. Allow the Upgrade Task Sequence to complete. The PC0004 computer will download the install.wim file, perform an in-place upgrade, and install your added applications. See the following examples: -![pc0004-a](../images/pc0004-a.png)
        -![pc0004-b](../images/pc0004-b.png)
        -![pc0004-c](../images/pc0004-c.png)
        -![pc0004-d](../images/pc0004-d.png)
        -![pc0004-e](../images/pc0004-e.png)
        -![pc0004-f](../images/pc0004-f.png)
        -![pc0004-g](../images/pc0004-g.png) +![Upgrade task sequence example 1](../images/pc0004-a.png)
        +![Upgrade task sequence example 2](../images/pc0004-b.png)
        +![Upgrade task sequence example 3](../images/pc0004-c.png)
        +![Upgrade task sequence example 4](../images/pc0004-d.png)
        +![Upgrade task sequence example 5](../images/pc0004-e.png)
        +![Upgrade task sequence example 6](../images/pc0004-f.png)
        +![Upgrade task sequence example 7](../images/pc0004-g.png) In-place upgrade with Configuration Manager diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md index c55b476746..f60f34e592 100644 --- a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md +++ b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md @@ -388,12 +388,12 @@ On **MDT01**: 1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab > Task Sequences** right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**. 2. In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start. - >[!IMPORTANT] - >The current version of MDT (8456) has a known issue generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. As a temporary workaround: - >- Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144. - >- Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe). - >- Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim). - >- After manually creating the catalog file (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install_Windows 10 Enterprise.clg), open the Deployment Workbench and proceed to edit unattend.xml. + > [!IMPORTANT] + > The ADK version 1903 has a [known issue](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1903) generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. To avoid this issue, [install the ADK, version 2004 or a later version](https://docs.microsoft.com/windows-hardware/get-started/adk-install). A workaround is also available for the ADK version 1903: + > - Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144. + > - Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe). + > - Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim). + > - After manually creating the catalog file (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install_Windows 10 Enterprise.clg), open the Deployment Workbench and proceed to edit unattend.xml. 3. In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry. 4. In the **amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral properties** window (right-hand window), set the following values: diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md index 7e06abfeb3..2779d317f6 100644 --- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md @@ -147,7 +147,7 @@ On **MDT01**: 9. On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader** and click **Next**. 10. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AcroRead.msi /q**, click **Next** twice, and then click **Finish**. -![acroread](../images/acroread.png) +![acroread image](../images/acroread.png) The Adobe Reader application added to the Deployment Workbench. @@ -170,13 +170,16 @@ The key to successful management of drivers for MDT, as well as for any other de On **MDT01**: +> [!IMPORTANT] +> In the steps below, it is critical that the folder names used for various computer makes and models exactly match the results of **wmic computersystem get model,manufacturer** on the target system. + 1. Using File Explorer, create the **D:\\drivers** folder. 2. In the **D:\\drivers** folder, create the following folder structure: 1. WinPE x86 2. WinPE x64 3. Windows 10 x64 3. In the new Windows 10 x64 folder, create the following folder structure: - - Dell + - Dell Inc - Latitude E7450 - Hewlett-Packard - HP EliteBook 8560w @@ -185,8 +188,8 @@ On **MDT01**: - Microsoft Corporation - Surface Laptop ->[!NOTE] ->Even if you are not going to use both x86 and x64 boot images, we still recommend that you add the support structure for future use. +> [!NOTE] +> Even if you are not going to use both x86 and x64 boot images, we still recommend that you add the support structure for future use. ### Create the logical driver structure in MDT @@ -197,7 +200,7 @@ When you import drivers to the MDT driver repository, MDT creates a single insta 2. WinPE x64 3. Windows 10 x64 3. In the **Windows 10 x64** folder, create the following folder structure: - - Dell + - Dell Inc - Latitude E7450 - Hewlett-Packard - HP EliteBook 8560w @@ -264,7 +267,7 @@ On **MDT01**: For the ThinkStation P500 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6. -![ThinkStation](../images/thinkstation.png) +![ThinkStation image](../images/thinkstation.png) To get the updates, download the drivers from the Lenovo ThinkVantage Update Retriever using its export function. You can also download the drivers by searching PC Support on the [Lenovo website](https://go.microsoft.com/fwlink/p/?LinkId=619543). @@ -281,12 +284,12 @@ The folder you select and all sub-folders will be checked for drivers, expanding For the Dell Latitude E7450 model, you use the Dell Driver CAB file, which is accessible via the [Dell TechCenter website](https://go.microsoft.com/fwlink/p/?LinkId=619544). -In these steps, we assume you have downloaded and extracted the CAB file for the Latitude E7450 model to the **D:\\Drivers\\Dell\\Latitude E7450** folder. +In these steps, we assume you have downloaded and extracted the CAB file for the Latitude E7450 model to the **D:\\Drivers\\Dell Inc\\Latitude E7450** folder. On **MDT01**: -1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Dell** node. -2. Right-click the **Latitude E7450** folder and select **Import Drivers** and use the following Driver source directory to import drivers: **D:\\Drivers\\Windows 10 x64\\Dell\\Latitude E7450** +1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Dell Inc** node. +2. Right-click the **Latitude E7450** folder and select **Import Drivers** and use the following Driver source directory to import drivers: **D:\\Drivers\\Windows 10 x64\\Dell Inc\\Latitude E7450** ### For the HP EliteBook 8560w @@ -358,6 +361,9 @@ In this section, you will learn how to configure the MDT Build Lab deployment sh ### Configure the rules +> [!NOTE] +> The following instructions assume the device is online. If you're offline you can remove SLShare variable. + On **MDT01**: 1. Right-click the **MDT Production** deployment share and select **Properties**. @@ -530,7 +536,7 @@ On **MDT01**: 1. Download MDOP 2015 and copy the DaRT 10 installer file to the D:\\Setup\\DaRT 10 folder on MDT01 (DaRT\\DaRT 10\\Installers\\\\\x64\\MSDaRT100.msi). 2. Install DaRT 10 (MSDaRT10.msi) using the default settings. - ![DaRT](../images/dart.png) + ![DaRT image](../images/dart.png) 2. Copy the two tools CAB files from **C:\\Program Files\\Microsoft DaRT\\v10** (**Toolsx86.cab** and **Toolsx64.cab**) to the production deployment share at **D:\\MDTProduction\\Tools\\x86** and **D:\\MDTProduction\\Tools\\x64**, respectively. 3. In the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**. @@ -601,13 +607,13 @@ On **HV01**: 2. Installs the added application. 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. -![pc0005](../images/pc0005-vm.png) +![pc0005 image1](../images/pc0005-vm.png) ### Application installation Following OS installation, Microsoft Office 365 Pro Plus - x64 is installed automatically. - ![pc0005](../images/pc0005-vm-office.png) + ![pc0005 image2](../images/pc0005-vm-office.png) ### Use the MDT monitoring feature @@ -728,7 +734,7 @@ On **MDT01**: The ISO that you got when updating the offline media item can be burned to a DVD and used directly (it will be bootable), but it is often more efficient to use USB sticks instead since they are faster and can hold more data. (A dual-layer DVD is limited to 8.5 GB.) >[!TIP] ->In this example, the .wim file is 5.5 GB in size. However, bootable USB sticks are formatted with the FAT32 file system which limits file size to 4.0 GB. This means you must split the .wim file, which can be done using DISM:
         
        Dism /Split-Image /ImageFile:D:\MDTOfflinemedia\Content\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.wim /SWMFile:E:\sources\install.swm /FileSize:3800.
         
        Windows Setup automatically installs from this file, provided you name it install.swm. The file names for the next files include numbers, for example: install2.swm, install3.swm.
         
        To enable split image in MDT, the Settings.xml file in your deployment share (ex: D:\MDTProduction\Control\Settings.xml) must have the **SkipWimSplit** value set to **False**. By default this value is set to True (\True\), so this must be changed and the offline media content updated. +>In this example, the .wim file is 5.5 GB in size. However, bootable USB sticks are formatted with the FAT32 file system which limits file size to 4.0 GB. You can place the image on a different drive (ex: E:\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.swm) and then modify E:\Deploy\Control\OperatingSystems.xml to point to it. Alternatively to keep using the USB you must split the .wim file, which can be done using DISM:
         
        Dism /Split-Image /ImageFile:D:\MDTOfflinemedia\Content\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.wim /SWMFile:E:\sources\install.swm /FileSize:3800.
         
        Windows Setup automatically installs from this file, provided you name it install.swm. The file names for the next files include numbers, for example: install2.swm, install3.swm.
         
        To enable split image in MDT, the Settings.xml file in your deployment share (ex: D:\MDTProduction\Control\Settings.xml) must have the **SkipWimSplit** value set to **False**. By default this value is set to True (\True\), so this must be changed and the offline media content updated. Follow these steps to create a bootable USB stick from the offline media content: diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index 52246fddfd..c4445493e4 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -81,7 +81,7 @@ The following OU structure is used in this guide. Instructions are provided [bel These steps assume that you have the MDT01 member server running and configured as a domain member server. -On **MTD01**: +On **MDT01**: Visit the [Download and install the Windows ADK](https://go.microsoft.com/fwlink/p/?LinkId=526803) page and download the following items to the **D:\\Downloads\\ADK** folder on MDT01 (you will need to create this folder): - [The Windows ADK for Windows 10](https://go.microsoft.com/fwlink/?linkid=2086042) diff --git a/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md index 1f16c8febd..84daf20005 100644 --- a/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md +++ b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md @@ -1,6 +1,7 @@ --- title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10) -description: Learn how to replace a Windows 7 device with a Windows 10 device. Although the process is similar to performing a refresh, you'll need to backup data externally +description: In this article, you will learn how to replace a Windows 7 device with a Windows 10 device. +ms.custom: seo-marvel-apr2020 ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a ms.reviewer: manager: laurawi diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md index c6400f67e9..231b73680a 100644 --- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md +++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md @@ -4,7 +4,7 @@ ms.assetid: 386e6713-5c20-4d2a-a220-a38d94671a38 ms.reviewer: manager: laurawi ms.author: greglin -description: +description: Learn how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. keywords: disk, encryption, TPM, configure, secure, script ms.prod: w10 ms.mktglfcycl: deploy @@ -14,6 +14,7 @@ ms.pagetype: mdt audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-mar2020 --- # Set up MDT for BitLocker @@ -88,7 +89,6 @@ Following these steps, you enable the backup of BitLocker and TPM recovery infor 3. Do not enable BitLocker until recovery information is stored in AD DS for operating system drives 2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy. 3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy. - Computer Configuration / Policies / Administrative Templates / System / Trusted Platform Module Services > [!NOTE] > If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using. diff --git a/windows/deployment/deploy-windows-to-go.md b/windows/deployment/deploy-windows-to-go.md index b54532b820..90d0dc48d1 100644 --- a/windows/deployment/deploy-windows-to-go.md +++ b/windows/deployment/deploy-windows-to-go.md @@ -1,19 +1,20 @@ --- title: Deploy Windows To Go in your organization (Windows 10) -description: This topic helps you to deploy Windows To Go in your organization. +description: Learn how to deploy Windows To Go in your organization through a wizard in the user interface as well as programatically with Windows PowerShell. ms.assetid: cfe550be-ffbd-42d1-ab4d-80efae49b07f ms.reviewer: manager: laurawi ms.audience: itpro author: greg-lindsay +ms.author: greglin keywords: deployment, USB, device, BitLocker, workspace, security, data ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobility audience: itpro -author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Deploy Windows To Go in your organization @@ -25,8 +26,8 @@ ms.topic: article This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. ## Deployment tips @@ -113,7 +114,7 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } - #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase. # # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData @@ -161,7 +162,7 @@ W:\Windows\System32\bcdboot W:\Windows /f ALL /s S: ``` ~~~ -5. Apply SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step: +5. Apply SAN policy—OFFLINE\_INTERNAL - "4" to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step: ``` @@ -291,7 +292,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i - A domain-joined computer running Windows 8 or later and is configured as a Windows To Go host computer -- A Windows To Go drive that hasn’t been booted or joined to the domain using unattend settings. +- A Windows To Go drive that hasn't been booted or joined to the domain using unattend settings. - A domain user account with rights to add computer accounts to the domain and is a member of the Administrator group on the Windows To Go host computer @@ -319,7 +320,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } - #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase. # # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData @@ -414,7 +415,7 @@ dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /ind >[!NOTE] >Depending on your DirectAccess configuration you might be asked to insert your smart card to log on to the domain. -You should now be able to access your organization’s network resources and work from your Windows To Go workspace as you would normally work from your standard desktop computer on premises. +You should now be able to access your organization's network resources and work from your Windows To Go workspace as you would normally work from your standard desktop computer on premises. ### Enable BitLocker protection for your Windows To Go drive @@ -467,7 +468,7 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } - #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with 'New-Partition…) Validate that this is the correct disk that you want to completely erase. # # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData @@ -576,17 +577,17 @@ The sample script creates an unattend file that streamlines the deployment proce * To run this sample script you must open a Windows PowerShell session as an administrator from a domain-joined computer using an account that has permission to create domain accounts. -* Using offline domain join is required by this script, since the script does not create a local administrator user account. However, domain membership will automatically put “Domain admins” into the local administrators group. Review your domain policies. If you are using DirectAccess you will need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters. +* Using offline domain join is required by this script, since the script does not create a local administrator user account. However, domain membership will automatically put "Domain admins" into the local administrators group. Review your domain policies. If you are using DirectAccess you will need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters. * The script needs to use drive letters, so you can only provision half as many drives as you have free drive letters. #### To run the advanced deployment sample script -1. Copy entire the code sample titled “Windows To Go multiple drive provisioning sample script” into a PowerShell script (.ps1) file. +1. Copy entire the code sample titled "Windows To Go multiple drive provisioning sample script" into a PowerShell script (.ps1) file. 2. Make the modifications necessary for it to be appropriate to your deployment and save the file. -3. Configure the PowerShell execution policy. By default PowerShell’s execution policy is set to Restricted; that means that scripts won’t run until you have explicitly given them permission to. To configure PowerShell’s execution policy to allow the script to run, use the following command from an elevated PowerShell prompt: +3. Configure the PowerShell execution policy. By default PowerShell's execution policy is set to Restricted; that means that scripts won't run until you have explicitly given them permission to. To configure PowerShell's execution policy to allow the script to run, use the following command from an elevated PowerShell prompt: ``` Set-ExecutionPolicy RemoteSigned diff --git a/windows/deployment/deploy.md b/windows/deployment/deploy.md index 4680e56b08..bb85dc9972 100644 --- a/windows/deployment/deploy.md +++ b/windows/deployment/deploy.md @@ -1,18 +1,19 @@ --- title: Deploy Windows 10 (Windows 10) -description: Deploying Windows 10 for IT professionals. +description: Learn about Windows 10 upgrade options for planning, testing, and managing your production deployment. ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C ms.reviewer: manager: laurawi ms.audience: itpro author: greg-lindsay +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: medium audience: itpro -author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Deploy Windows 10 @@ -30,7 +31,7 @@ Windows 10 upgrade options are discussed and information is provided about plann |[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md). | |[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning. | |[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). | -|[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) |If you have Microsoft Endpoint Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or. | +|[Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) |If you have Microsoft Endpoint Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or. | |[Windows 10 deployment tools](windows-10-deployment-tools-reference.md) |Learn about available tools to deploy Windows 10, such as the Windows ADK, DISM, USMT, WDS, MDT, Windows PE and more. | |[How to install fonts that are missing after upgrading to Windows 10](windows-10-missing-fonts.md)|Windows 10 introduced changes to the fonts that are included in the image by default. Learn how to install additional fonts from **Optional features** after you install Windows 10 or upgrade from a previous version.| diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json index d90a888be9..cecc2b30b5 100644 --- a/windows/deployment/docfx.json +++ b/windows/deployment/docfx.json @@ -35,6 +35,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", @@ -48,7 +49,17 @@ "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Windows Deployment" + "titleSuffix": "Windows Deployment", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], + "searchScope": ["Windows 10"] }, "fileMetadata": {}, "template": [], diff --git a/windows/deployment/images/mbr2gpt-volume.PNG b/windows/deployment/images/mbr2gpt-volume.png similarity index 100% rename from windows/deployment/images/mbr2gpt-volume.PNG rename to windows/deployment/images/mbr2gpt-volume.png diff --git a/windows/deployment/images/sigverif.png b/windows/deployment/images/sigverif.png new file mode 100644 index 0000000000..0ed0c2fd0c Binary files /dev/null and b/windows/deployment/images/sigverif.png differ diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 2e6bb17812..dbd960b4a7 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -1,105 +1,100 @@ -### YamlMime:YamlDocument +### YamlMime:Landing + +title: Windows 10 deployment resources and documentation # < 60 chars +summary: Learn about deploying and keeping Windows 10 up to date. # < 160 chars -documentType: LandingData -title: Deploy and update Windows 10 metadata: - document_id: - title: Deploy and update Windows 10 - description: Deploying and updating Windows 10 for IT professionals. - keywords: deploy, update, Windows, service, Microsoft365, e5, e3 - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: laurawi - ms.topic: article - ms.devlang: na + title: Windows 10 deployment resources and documentation # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about deploying Windows 10 and keeping it up to date in your organization. # Required; article description that is displayed in search results. < 160 chars. + services: windows-10 + ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. + ms.subservice: subservice + ms.topic: landing-page # Required + ms.collection: windows-10 + author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. + ms.author: greglin #Required; microsoft alias of author; optional team alias. + ms.date: 08/05/2020 #Required; mm/dd/yyyy format. + localization_priority: medium + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new -sections: -- items: - - type: markdown - text: Learn about deployment of Windows 10 for IT professionals. This includes deploying the operating system, upgrading to it from previous versions and updating Windows 10. -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - href: windows-10-deployment-scenarios - html:

        Understand the different ways that Windows 10 can be deployed

        - image: - src: https://docs.microsoft.com/media/common/i_deploy.svg" - title: Windows 10 deployment scenarios - - href: update - html:

        Update Windows 10 in the enterprise

        - image: - src: https://docs.microsoft.com/media/common/i_upgrade.svg - title: Windows as a service - - href: windows-autopilot/windows-autopilot - html:

        Windows Autopilot greatly simplifies deployment of Windows devices

        - image: - src: https://docs.microsoft.com/media/common/i_delivery.svg - title: Windows Autopilot -- title: -- items: - - type: markdown - text: " -
        - - - - - - - -
        [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home) Check out the new Modern Deskop Deployment Center and discover content to help you with your Windows 10 and Microsoft 365 Apps for enterprise deployments.
        [What's new in Windows 10 deployment](deploy-whats-new.md) See this topic for a summary of new features and some recent changes related to deploying Windows 10 in your organization.
        [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task.
        [Windows Autopilot](windows-autopilot/windows-autopilot.md) Windows Autopilot enables an IT department to pre-configure new devices and repurpose existing devices with a simple process that requires little to no infrastructure.
        [Windows 10 Subscription Activation](windows-10-subscription-activation.md) Windows 10 Enterprise has traditionally been sold as on premises software, however, with Windows 10 version 1703 (also known as the Creator’s Update), both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as true online services via subscription. You can move from Windows 10 Pro to Windows 10 Enterprise with no keys and no reboots. If you are using a Cloud Service Providers (CSP) see the related topic: [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md).
        [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade.
        - " -- title: Deploy Windows 10 -- items: - - type: markdown - text: " - Windows 10 upgrade options are discussed and information is provided about planning, testing, and managing your production deployment. -
         
        - - - - - - - - - - - -
        TopicDescription
        [Overview of Windows Autopilot](windows-autopilot/windows-autopilot.md) Windows Autopilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices.
        [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) This topic provides information about support for upgrading directly to Windows 10 from a previous operating system.
        [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) This topic provides information about support for upgrading from one edition of Windows 10 to another.
        [Windows 10 volume license media](windows-10-media.md) This topic provides information about media available in the Microsoft Volume Licensing Service Center.
        [Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
        [Windows 10 deployment test lab](windows-10-poc.md) This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md).
        [Plan for Windows 10 deployment](planning/index.md) This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning.
        [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT).
        [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-cm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or.
        [Windows 10 deployment tools](windows-10-deployment-tools-reference.md) Learn about available tools to deploy Windows 10, such as the Windows ADK, DISM, USMT, WDS, MDT, Windows PE and more.
        - " -- title: Update Windows 10 -- items: - - type: markdown - text: " - Information is provided about keeping Windows 10 up-to-date. -
         
        - - - - - - - - - - - - - - - -
        TopicDescription
        [Quick guide to Windows as a service](update/waas-quick-start.md) Provides a brief summary of the key points for the new servicing model for Windows 10.
        [Overview of Windows as a service](update/waas-overview.md) Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools.
        [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) Explains the decisions you need to make in your servicing strategy.
        [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates.
        [Assign devices to servicing branches for Windows 10 updates](update/waas-servicing-branches-windows-10-updates.md) Explains how to assign devices to Current Branch (CB) or Current Branch for Business (CBB) for feature and quality updates, and how to enroll devices in Windows Insider.
        [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md) Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization.
        [Optimize update delivery for Windows 10 updates](update/waas-optimize-windows-10-updates.md) Explains the benefits of using Delivery Optimization or BranchCache for update distribution.
        [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](update/waas-mobile-updates.md) Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile.
        [Deploy updates using Windows Update for Business](update/waas-manage-updates-wufb.md) Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune.
        [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](update/waas-manage-updates-wsus.md) Explains how to use WSUS to manage Windows 10 updates.
        [Deploy Windows 10 updates using System Center Configuration Manager](update/waas-manage-updates-configuration-manager.md) Explains how to use Configuration Manager to manage Windows 10 updates.
        [Manage device restarts after updates](update/waas-restart.md) Explains how to manage update related device restarts.
        [Manage additional Windows Update settings](update/waas-wu-settings.md) Provides details about settings available to control and configure Windows Update.
        [Windows Insider Program for Business](update/waas-windows-insider-for-business.md) Explains how the Windows Insider Program for Business works and how to become an insider.
        - " -- title: Additional topics -- items: - - type: markdown - text: " -
        - [Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade/upgrade-windows-phone-8-1-to-10.md) This topic describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile. - -  " +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Plan + linkLists: + - linkListType: overview + links: + - text: Create a deployment plan + url: update/create-deployment-plan.md + - text: Define readiness criteria + url: update/plan-define-readiness.md + - text: Evaluate infrastructure and tools + url: update/eval-infra-tools.md + - text: Define your servicing strategy + url: update/plan-define-strategy.md + + # Card (optional) + - title: Prepare + linkLists: + - linkListType: how-to-guide + links: + - text: Prepare to deploy Windows 10 updates + url: update/prepare-deploy-windows.md + - text: Prepare updates using Windows Update for Business + url: update/waas-manage-updates-wufb.md + - text: Prepare for Zero Touch Installation of Windows 10 with Configuration Manager + url: deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md + + # Card (optional) + - title: Deploy + linkLists: + - linkListType: deploy + links: + - text: Deploy Windows 10 with Autopilot + url: https://docs.microsoft.com/mem/autopilot + - text: Assign devices to servicing channels + url: update/waas-servicing-channels-windows-10-updates.md + - text: Deploy Windows updates with Configuration Manager + url: update/deploy-updates-configmgr.md + + # Card + - title: Overview + linkLists: + - linkListType: overview + links: + - text: What's new in Windows deployment + url: windows-10-deployment-scenarios.md + - text: Windows 10 deployment scenarios + url: windows-10-deployment-scenarios.md + - text: Basics of Windows updates, channels, and tools + url: update/get-started-updates-channels-tools.md + - text: Overview of Windows Autopilot + url: https://docs.microsoft.com/mem/autopilot/windows-autopilot + + # Card + - title: Support remote work + linkLists: + - linkListType: concept + links: + - text: Deploy Windows 10 for a remote world + url: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/deploying-a-new-version-of-windows-10-in-a-remote-world/ba-p/1419846 + - text: Empower remote workers with Microsoft 365 + url: https://docs.microsoft.com/microsoft-365/solutions/empower-people-to-work-remotely + - text: Top 12 tasks for security teams to support working from home + url: https://docs.microsoft.com/microsoft-365/security/top-security-tasks-for-remote-work + - text: Support your remote workforce + url: https://docs.microsoft.com/microsoftteams/faq-support-remote-workforce + + # Card (optional) + - title: Microsoft Learn + linkLists: + - linkListType: learn + links: + - text: Plan to deploy updates for Windows 10 and Microsoft 365 Apps + url: https://docs.microsoft.com/learn/modules/windows-plan + - text: Prepare to deploy updates for Windows 10 and Microsoft 365 Apps + url: https://docs.microsoft.com/learn/modules/windows-prepare/ + - text: Deploy updates for Windows 10 and Microsoft 365 Apps + url: https://docs.microsoft.com/learn/modules/windows-deploy diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 45e00f7007..7324318c18 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -1,6 +1,6 @@ --- title: MBR2GPT -description: How to use the MBR2GPT tool to convert MBR partitions to GPT +description: Use MBR2GPT.EXE to convert a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. keywords: deploy, troubleshoot, windows, 10, upgrade, partition, mbr, gpt ms.prod: w10 ms.mktglfcycl: deploy @@ -8,13 +8,14 @@ ms.sitesec: library ms.pagetype: deploy audience: itpro author: greg-lindsay +ms.author: greglin ms.date: 02/13/2018 -ms.reviewer: +ms.reviewer: manager: laurawi ms.audience: itpro -author: greg-lindsay ms.localizationpriority: medium ms.topic: article +ms.custom: seo-marvel-apr2020 --- # MBR2GPT.EXE @@ -22,9 +23,7 @@ ms.topic: article **Applies to** - Windows 10 -## Summary - -**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **/allowFullOS** option. +**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **/allowFullOS** option. >MBR2GPT.EXE is located in the **Windows\\System32** directory on a computer running Windows 10 version 1703 (also known as the Creator's Update) or later. >The tool is available in both the full OS environment and Windows PE. To use this tool in a deployment task sequence with Configuration Manager or Microsoft Deployment Toolkit (MDT), you must first update the Windows PE image (winpe.wim, boot.wim) with the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1703, or a later version. @@ -33,7 +32,7 @@ See the following video for a detailed description and demonstration of MBR2GPT. -You can use MBR2GPT to: +You can use MBR2GPT to: - Convert any attached MBR-formatted system disk to the GPT partition format. You cannot use the tool to convert non-system disks from MBR to GPT. - Convert an MBR disk with BitLocker-encrypted volumes as long as protection has been suspended. To resume BitLocker after conversion, you will need to delete the existing protectors and recreate them. @@ -97,11 +96,11 @@ MBR2GPT: Validation completed successfully In the following example: 1. Using DiskPart, the current disk partition layout is displayed prior to conversion - three partitions are present on the MBR disk (disk 0): a system reserved partition, a Windows partition, and a recovery partition. A DVD-ROM is also present as volume 0. -2. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](https://msdn.microsoft.com/library/windows/desktop/aa363990.aspx) is **07** corresponding to the installable file system (IFS) type. +2. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](https://msdn.microsoft.com/library/windows/desktop/aa363990.aspx) is **07** corresponding to the installable file system (IFS) type. 2. The MBR2GPT tool is used to convert disk 0. 3. The DiskPart tool displays that disk 0 is now using the GPT format. 4. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). -5. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](https://msdn.microsoft.com/library/windows/desktop/aa365449.aspx) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. +5. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](https://msdn.microsoft.com/library/windows/desktop/aa365449.aspx) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. >As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly. @@ -273,7 +272,7 @@ For more information about partition types, see: ### Persisting drive letter assignments -The conversion tool will attempt to remap all drive letter assignment information contained in the registry that correspond to the volumes of the converted disk. If a drive letter assignment cannot be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. **Important**: this code runs after the layout conversion has taken place, so the operation cannot be undone at this stage. +The conversion tool will attempt to remap all drive letter assignment information contained in the registry that correspond to the volumes of the converted disk. If a drive letter assignment cannot be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. **Important**: this code runs after the layout conversion has taken place, so the operation cannot be undone at this stage. The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It will then iterate through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry do the following: @@ -300,7 +299,7 @@ The default location for all these log files in Windows PE is **%windir%**. ### Interactive help -To view a list of options available when using the tool, type **mbr2gpt /?** +To view a list of options available when using the tool, type **mbr2gpt /?** The following text is displayed: @@ -377,7 +376,7 @@ Number Friendly Name Serial Number HealthStatus OperationalStatus To You can also view the partition type of a disk by opening the Disk Management tool, right-clicking the disk number, clicking **Properties**, and then clicking the **Volumes** tab. See the following example: -![Volumes](images/mbr2gpt-volume.PNG) +![Volumes](images/mbr2gpt-volume.png) If Windows PowerShell and Disk Management are not available, such as when you are using Windows PE, you can determine the partition type at a command prompt with the DiskPart tool. To determine the partition style from a command line, type **diskpart** and then type **list disk**. See the following example: @@ -401,7 +400,7 @@ DISKPART> list disk In this example, Disk 0 is formatted with the MBR partition style, and Disk 1 is formatted using GPT. -## Known issue +## Known issue ### MBR2GPT.exe cannot run in Windows PE @@ -411,7 +410,7 @@ When you start a Windows 10, version 1903-based computer in the Windows Preinsta **Issue 2** When you manually run the MBR2GPT.exe command in a Command Prompt window, there is no output from the tool. -**Issue 3** When MBR2GPT.exe runs inside an imaging process such as a Microsoft Endpoint Configuration Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781. +**Issue 3** When MBR2GPT.exe runs inside an imaging process such as a Microsoft Endpoint Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781. #### Cause @@ -426,10 +425,10 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from 2. Copy the ReAgent files and the ReAgent localization files from the Window 10, version 1903 ADK source folder to the mounted WIM. For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window: - + > [!NOTE] > You can access the ReAgent files if you have installed the User State Migration Tool (USMT) as a feature while installing Windows Assessment and Deployment Kit. - + **Command 1:** ```cmd copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32" @@ -439,20 +438,20 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from * ReAgent.admx * ReAgent.dll * ReAgent.xml - + **Command 2:** ```cmd copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us" - ``` + ``` This command copies two files: * ReAgent.adml * ReAgent.dll.mui > [!NOTE] > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language. - + 3. After you copy all the files, commit the changes and unmount the Windows PE WIM. MBR2GPT.exe now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](https://docs.microsoft.com/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). - + ## Related topics diff --git a/windows/deployment/planning/TOC.md b/windows/deployment/planning/TOC.md deleted file mode 100644 index fc4cb8fefa..0000000000 --- a/windows/deployment/planning/TOC.md +++ /dev/null @@ -1,37 +0,0 @@ -# [Plan for Windows 10 deployment](index.md) -## [Windows 10 Enterprise FAQ for IT Pros](windows-10-enterprise-faq-itpro.md) -## [Windows 10 deployment considerations](windows-10-deployment-considerations.md) -## [Windows 10 compatibility](windows-10-compatibility.md) -## [Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) - -## Features removed or planned for replacement -### [Windows 10 features lifecycle](features-lifecycle.md) -### [Features we're no longer developing](windows-10-deprecated-features.md) -### [Features we removed](windows-10-removed-features.md) - -## Application Compatibility Toolkit (ACT) -### [Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) -### [SUA User's Guide](sua-users-guide.md) -#### [Using the SUA Wizard](using-the-sua-wizard.md) -#### [Using the SUA Tool](using-the-sua-tool.md) -##### [Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md) -##### [Showing Messages Generated by the SUA Tool](showing-messages-generated-by-the-sua-tool.md) -##### [Applying Filters to Data in the SUA Tool](applying-filters-to-data-in-the-sua-tool.md) -##### [Fixing Applications by Using the SUA Tool](fixing-applications-by-using-the-sua-tool.md) -### [Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) -#### [Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) -##### [Available Data Types and Operators in Compatibility Administrator](available-data-types-and-operators-in-compatibility-administrator.md) -##### [Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md) -##### [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md) -##### [Creating a Custom Compatibility Fix in Compatibility Administrator](creating-a-custom-compatibility-fix-in-compatibility-administrator.md) -##### [Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md) -##### [Creating an AppHelp Message in Compatibility Administrator](creating-an-apphelp-message-in-compatibility-administrator.md) -##### [Viewing the Events Screen in Compatibility Administrator](viewing-the-events-screen-in-compatibility-administrator.md) -##### [Enabling and Disabling Compatibility Fixes in Compatibility Administrator](enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md) -##### [Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator](installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md) -#### [Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md) -##### [Understanding and Using Compatibility Fixes](understanding-and-using-compatibility-fixes.md) -##### [Compatibility Fix Database Management Strategies and Deployment](compatibility-fix-database-management-strategies-and-deployment.md) -##### [Testing Your Application Mitigation Packages](testing-your-application-mitigation-packages.md) -#### [Using the Sdbinst.exe Command-Line Tool](using-the-sdbinstexe-command-line-tool.md) -### [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) diff --git a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md index a202b57844..f128528a5e 100644 --- a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md +++ b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md @@ -1,238 +1,239 @@ ---- -title: Available Data Types and Operators in Compatibility Administrator (Windows 10) -description: The Compatibility Administrator tool provides a way to query your custom-compatibility databases. -ms.assetid: 67d9c03e-ab9d-4fda-8a55-8c5b90266d3b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Available Data Types and Operators in Compatibility Administrator - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The Compatibility Administrator tool provides a way to query your custom-compatibility databases. - -## Available Data Types - - -Customized-compatibility databases in Compatibility Administrator contain the following data types. - -- **Integer**. A numerical value with no fractional part. All integers are unsigned because none of the attributes can have a negative value. - -- **String**. A series of alphanumeric characters manipulated as a group. - -- **Boolean**. A value of True or False. - -## Available Attributes - - -The following table shows the attributes you can use for querying your customized-compatibility databases in Compatibility Administrator. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        AttributeDescriptionData type

        APP_NAME

        Name of the application.

        String

        DATABASE_GUID

        Unique ID for your compatibility database.

        String

        DATABASE_INSTALLED

        Specifies if you have installed the database.

        Boolean

        DATABASE_NAME

        Descriptive name of your database.

        String

        DATABASE_PATH

        Location of the database on your computer.

        String

        FIX_COUNT

        Number of compatibility fixes applied to a specific application.

        Integer

        FIX_NAME

        Name of your compatibility fix.

        String

        MATCH_COUNT

        Number of matching files for a specific, fixed application.

        Integer

        MATCHFILE_NAME

        Name of a matching file used to identify a specific, fixed application.

        String

        MODE_COUNT

        Number of compatibility modes applied to a specific, fixed application.

        Integer

        MODE_NAME

        Name of your compatibility mode.

        String

        PROGRAM_APPHELPTYPE

        Type of AppHelp message applied to an entry. The value can be 1 or 2, where 1 enables the program to run and 2 blocks the program.

        Integer

        PROGRAM_DISABLED

        Specifies if you disabled the compatibility fix for an application. If True, Compatibility Administrator does not apply the fixes to the application.

        Boolean

        PROGRAM_GUID

        Unique ID for an application.

        String

        PROGRAM_NAME

        Name of the application that you are fixing.

        String

        - - - -## Available Operators - - -The following table shows the operators that you can use for querying your customized-compatibility databases in the Compatibility Administrator. - - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        SymbolDescriptionData typePrecedence

        >

        Greater than

        Integer or string

        1

        >=

        Greater than or equal to

        Integer or string

        1

        <

        Less than

        Integer or string

        1

        <=

        Less than or equal to

        Integer or string

        1

        <>

        Not equal to

        Integer or string

        1

        =

        Equal to

        Integer, string, or Boolean

        1

        HAS

        A special SQL operator used to check if the left-hand operand contains a substring specified by the right-hand operand.

        Left-hand operand. MATCHFILE_NAME, MODE_NAME, FIX_NAME

        -
        -Note

        Only the HAS operator can be applied to the MATCHFILE_NAME, MODE_NAME, and FIX_NAME attributes.

        -
        -
        - -
        -

        Right-hand operand. String

        1

        OR

        Logical OR operator

        Boolean

        2

        AND

        Logical AND operator

        Boolean

        2

        - - - -## Related topics -[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) - - - - - - - - - +--- +title: Available Data Types and Operators in Compatibility Administrator (Windows 10) +description: The Compatibility Administrator tool provides a way to query your custom-compatibility databases. +ms.assetid: 67d9c03e-ab9d-4fda-8a55-8c5b90266d3b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Available Data Types and Operators in Compatibility Administrator + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The Compatibility Administrator tool provides a way to query your custom-compatibility databases. + +## Available Data Types + + +Customized-compatibility databases in Compatibility Administrator contain the following data types. + +- **Integer**. A numerical value with no fractional part. All integers are unsigned because none of the attributes can have a negative value. + +- **String**. A series of alphanumeric characters manipulated as a group. + +- **Boolean**. A value of True or False. + +## Available Attributes + + +The following table shows the attributes you can use for querying your customized-compatibility databases in Compatibility Administrator. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        AttributeDescriptionData type

        APP_NAME

        Name of the application.

        String

        DATABASE_GUID

        Unique ID for your compatibility database.

        String

        DATABASE_INSTALLED

        Specifies if you have installed the database.

        Boolean

        DATABASE_NAME

        Descriptive name of your database.

        String

        DATABASE_PATH

        Location of the database on your computer.

        String

        FIX_COUNT

        Number of compatibility fixes applied to a specific application.

        Integer

        FIX_NAME

        Name of your compatibility fix.

        String

        MATCH_COUNT

        Number of matching files for a specific, fixed application.

        Integer

        MATCHFILE_NAME

        Name of a matching file used to identify a specific, fixed application.

        String

        MODE_COUNT

        Number of compatibility modes applied to a specific, fixed application.

        Integer

        MODE_NAME

        Name of your compatibility mode.

        String

        PROGRAM_APPHELPTYPE

        Type of AppHelp message applied to an entry. The value can be 1 or 2, where 1 enables the program to run and 2 blocks the program.

        Integer

        PROGRAM_DISABLED

        Specifies if you disabled the compatibility fix for an application. If True, Compatibility Administrator does not apply the fixes to the application.

        Boolean

        PROGRAM_GUID

        Unique ID for an application.

        String

        PROGRAM_NAME

        Name of the application that you are fixing.

        String

        + + + +## Available Operators + + +The following table shows the operators that you can use for querying your customized-compatibility databases in the Compatibility Administrator. + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        SymbolDescriptionData typePrecedence

        >

        Greater than

        Integer or string

        1

        >=

        Greater than or equal to

        Integer or string

        1

        <

        Less than

        Integer or string

        1

        <=

        Less than or equal to

        Integer or string

        1

        <>

        Not equal to

        Integer or string

        1

        =

        Equal to

        Integer, string, or Boolean

        1

        HAS

        A special SQL operator used to check if the left-hand operand contains a substring specified by the right-hand operand.

        Left-hand operand. MATCHFILE_NAME, MODE_NAME, FIX_NAME

        +
        +Note

        Only the HAS operator can be applied to the MATCHFILE_NAME, MODE_NAME, and FIX_NAME attributes.

        +
        +
        + +
        +

        Right-hand operand. String

        1

        OR

        Logical OR operator

        Boolean

        2

        AND

        Logical AND operator

        Boolean

        2

        + + + +## Related topics +[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md) + + + + + + + + + diff --git a/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md b/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md index 0652569347..36a7463bcc 100644 --- a/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md +++ b/windows/deployment/planning/best-practice-recommendations-for-windows-to-go.md @@ -1,54 +1,55 @@ ---- -title: Best practice recommendations for Windows To Go (Windows 10) -description: Best practice recommendations for Windows To Go -ms.assetid: 05e6e0ab-94ed-4c0c-a195-0abd006f0a86 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: best practices, USB, device, boot -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: mobility -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Best practice recommendations for Windows To Go - - -**Applies to** - -- Windows 10 - ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. - -The following are the best practice recommendations for using Windows To Go: - -- Always shut down Windows and wait for shutdown to complete before removing the Windows To Go drive. -- Do not insert the Windows To Go drive into a running computer. -- Do not boot the Windows To Go drive from a USB hub. Always insert the Windows To Go drive directly into a port on the computer. -- If available, use a USB 3.0 port with Windows To Go. -- Do not install non-Microsoft core USB drivers on Windows To Go. -- Suspend BitLocker on Windows host computers before changing the BIOS settings to boot from USB and then resume BitLocker protection. - -Additionally, we recommend that when you plan your deployment you should also plan a standard operating procedure for answering questions about which USB drives can be used for Windows To Go and how to enable booting from USB to assist your IT department or help desk in supporting users and work groups that want to use Windows To Go. It may be very helpful for your organization to work with your hardware vendors to create an IT standard for USB drives for use with Windows To Go, so that if groups within your organization want to purchase drives they can quickly determine which ones they should obtain. - -## More information - - -[Windows To Go: feature overview](windows-to-go-overview.md)
        -[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
        -[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
        -[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
        -[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md)
        - -  - -  - - - - - +--- +title: Best practice recommendations for Windows To Go (Windows 10) +description: Learn about best practice recommendations for using Windows To Go, like using a USB 3.0 port with Windows to Go if it's available. +ms.assetid: 05e6e0ab-94ed-4c0c-a195-0abd006f0a86 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: best practices, USB, device, boot +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: mobility +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Best practice recommendations for Windows To Go + + +**Applies to** + +- Windows 10 + +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. + +The following are the best practice recommendations for using Windows To Go: + +- Always shut down Windows and wait for shutdown to complete before removing the Windows To Go drive. +- Do not insert the Windows To Go drive into a running computer. +- Do not boot the Windows To Go drive from a USB hub. Always insert the Windows To Go drive directly into a port on the computer. +- If available, use a USB 3.0 port with Windows To Go. +- Do not install non-Microsoft core USB drivers on Windows To Go. +- Suspend BitLocker on Windows host computers before changing the BIOS settings to boot from USB and then resume BitLocker protection. + +Additionally, we recommend that when you plan your deployment you should also plan a standard operating procedure for answering questions about which USB drives can be used for Windows To Go and how to enable booting from USB to assist your IT department or help desk in supporting users and work groups that want to use Windows To Go. It may be very helpful for your organization to work with your hardware vendors to create an IT standard for USB drives for use with Windows To Go, so that if groups within your organization want to purchase drives they can quickly determine which ones they should obtain. + +## More information + + +[Windows To Go: feature overview](windows-to-go-overview.md)
        +[Prepare your organization for Windows To Go](prepare-your-organization-for-windows-to-go.md)
        +[Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md)
        +[Security and data protection considerations for Windows To Go](security-and-data-protection-considerations-for-windows-to-go.md)
        +[Windows To Go: frequently asked questions](windows-to-go-frequently-asked-questions.md)
        + +  + +  + + + + + diff --git a/windows/deployment/planning/compatibility-administrator-users-guide.md b/windows/deployment/planning/compatibility-administrator-users-guide.md index afbb20379c..30dcd0de23 100644 --- a/windows/deployment/planning/compatibility-administrator-users-guide.md +++ b/windows/deployment/planning/compatibility-administrator-users-guide.md @@ -4,7 +4,7 @@ ms.assetid: 0ce05f66-9009-4739-a789-60f3ce380e76 ms.reviewer: manager: laurawi ms.author: greglin -description: +description: The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows. ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: appcompat @@ -12,6 +12,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-mar2020 --- # Compatibility Administrator User's Guide diff --git a/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md b/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md index 162ad2c153..18f52b5803 100644 --- a/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md +++ b/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md @@ -4,7 +4,7 @@ ms.assetid: fdfbf02f-c4c4-4739-a400-782204fd3c6c ms.reviewer: manager: laurawi ms.author: greglin -description: +description: Learn about deploying your compatibility fixes as part of an application-installation package or through a centralized compatibility-fix database. ms.prod: w10 ms.mktglfcycl: plan ms.pagetype: appcompat @@ -13,6 +13,7 @@ audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article +ms.custom: seo-marvel-mar2020 --- # Compatibility Fix Database Management Strategies and Deployment @@ -88,7 +89,7 @@ This approach tends to work best for organizations that have a well-developed de ### Merging Centralized Compatibility-Fix Databases -If you decide to use the centralized compatibility-fix database deployment strategy, you can merge any of your individual compatibility-fix databases. This enables you to create a single custom compatibility-fix database that can be used to search for and determine whether Windows® should apply a fix to a specific executable (.exe) file. We recommend merging your databases based on the following process. +If you decide to use the centralized compatibility-fix database deployment strategy, you can merge any of your individual compatibility-fix databases. This enables you to create a single custom compatibility-fix database that can be used to search for and determine whether Windows® should apply a fix to a specific executable (.exe) file. We recommend merging your databases based on the following process. **To merge your custom-compatibility databases** @@ -113,7 +114,7 @@ If you decide to use the centralized compatibility-fix database deployment strat Deploying your custom compatibility-fix database into your organization requires you to perform the following actions: -1. Store your custom compatibility-fix database (.sdb file) in a location that is accessible to all of your organization’s computers. +1. Store your custom compatibility-fix database (.sdb file) in a location that is accessible to all of your organization's computers. 2. Use the Sdbinst.exe command-line tool to install the custom compatibility-fix database locally. @@ -124,7 +125,7 @@ In order to meet the two requirements above, we recommend that you use one of th You can package your .sdb file and a custom deployment script into an .msi file, and then deploy the .msi file into your organization. > [!IMPORTANT] - > You must ensure that you mark your custom script so that it does not impersonate the calling user. For example, if you use Microsoft® Visual Basic® Scripting Edition (VBScript), the custom action type would be: + > You must ensure that you mark your custom script so that it does not impersonate the calling user. For example, if you use Microsoft® Visual Basic® Scripting Edition (VBScript), the custom action type would be: >`msidbCustomActionTypeVBScript + msidbCustomActionTypeInScript + msidbCustomActionTypeNoImpersonate = 0x0006 + 0x0400 + 0x0800 = 0x0C06 = 3078 decimal)` diff --git a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md index aa63171e92..504dc52a3c 100644 --- a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md +++ b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md @@ -1,5 +1,5 @@ --- -title: Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista (Windows 10) +title: Compatibility Fixes for Windows 10, Windows 8, Windows 7, & Windows Vista description: Find compatibility fixes for all Windows operating systems that have been released from Windows Vista through Windows 10. ms.assetid: cd51c824-557f-462a-83bb-54b0771b7dff ms.reviewer: @@ -13,6 +13,7 @@ audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista @@ -75,7 +76,7 @@ The following table lists the known compatibility fixes for all Windows operatin

        BIOSRead

        -

        This problem is indicated when an application cannot access the Device\PhysicalMemory object beyond the kernel-mode drivers, on any of the Windows Server® 2003 operating systems.

        +

        This problem is indicated when an application cannot access the Device\PhysicalMemory object beyond the kernel-mode drivers, on any of the Windows Server® 2003 operating systems.

        The fix enables OEM executable (.exe) files to use the GetSystemFirmwareTable function instead of the NtOpenSection function when the BIOS is queried for the \Device\Physical memory information..

        @@ -92,7 +93,7 @@ The following table lists the known compatibility fixes for all Windows operatin

        ChangeFolderPathToXPStyle

        This fix is required when an application cannot return shell folder paths when it uses the SHGetFolder API.

        -

        The fix intercepts the SHGetFolder path request to the common appdata file path and returns the Windows® XP-style file path instead of the Windows Vista-style file path.

        +

        The fix intercepts the SHGetFolder path request to the common appdata file path and returns the Windows® XP-style file path instead of the Windows Vista-style file path.

        ClearLastErrorStatusonIntializeCriticalSection

        @@ -188,7 +189,7 @@ The following table lists the known compatibility fixes for all Windows operatin

        DirectXVersionLie

        -

        This problem occurs when an application fails because it does not find the correct version number for DirectX®.

        +

        This problem occurs when an application fails because it does not find the correct version number for DirectX®.

        The fix modifies the DXDIAGN GetProp function call to return the correct DirectX version.

        You can control this fix further by typing the following command at the command prompt:

        MAJORVERSION.MINORVERSION.LETTER

        @@ -456,7 +457,7 @@ The following table lists the known compatibility fixes for all Windows operatin

        IgnoreMSOXMLMF

        The problem is indicated by an error message that states that the operating system cannot locate the MSVCR80D.DLL file.

        -

        The fix ignores the registered MSOXMLMF.DLL object, which Microsoft® Office 2007 loads into the operating system any time that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix will just ignore the registered MSOXMLMF and fail the CoGetClassObject for its CLSID.

        +

        The fix ignores the registered MSOXMLMF.DLL object, which Microsoft® Office 2007 loads into the operating system any time that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix will just ignore the registered MSOXMLMF and fail the CoGetClassObject for its CLSID.

        IgnoreSetROP2

        diff --git a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md index d57413d357..1c9e4706d1 100644 --- a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md +++ b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md @@ -1,6 +1,6 @@ --- title: Deployment considerations for Windows To Go (Windows 10) -description: Deployment considerations for Windows To Go +description: Learn about deployment considerations for Windows To Go, such as the boot experience, deployment methods, and tools that you can use with Windows To Go. ms.assetid: dcfc5d96-b96b-44cd-ab65-416b5611c65e ms.reviewer: manager: laurawi @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Deployment considerations for Windows To Go @@ -23,7 +24,7 @@ ms.topic: article - Windows 10 > [!IMPORTANT] -> Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. From the start, Windows To Go was designed to minimize differences between the user experience of working on a laptop and Windows To Go booted from a USB drive. Given that Windows To Go was designed as an enterprise solution, extra consideration was given to the deployment workflows that enterprises already have in place. Additionally, there has been a focus on minimizing the number of differences in deployment between Windows To Go workspaces and laptop PCs. @@ -51,7 +52,7 @@ When a Windows To Go workspace is first used at the workplace, the Windows To Go ![initial boot off-premises](images/wtg-first-boot-home.gif) -When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee’s home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized. +When the Windows To Go workspace is going to be used first on an off-premises computer, such as one at the employee's home, then the IT professional preparing the Windows To Go drives should configure the drive to be able to connect to organizational resources and to maintain the security of the workspace. In this situation, the Windows To Go workspace needs to be configured for offline domain join and BitLocker needs to be enabled before the workspace has been initialized. > [!TIP] > Applying BitLocker Drive Encryption to the drives before provisioning is a much faster process than encrypting the drives after data has already been stored on them due to a new feature called used-disk space only encryption. For more information, see [What's New in BitLocker](https://go.microsoft.com/fwlink/p/?LinkId=619076). diff --git a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md index 565b9b6833..6b42e09fe7 100644 --- a/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md +++ b/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md @@ -1,5 +1,5 @@ --- -title: Enabling and Disabling Compatibility Fixes in Compatibility Administrator (Windows 10) +title: Enabling and Disabling Compatibility Fixes in Compatibility Administrator description: You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes. ms.assetid: 6bd4a7c5-0ed9-4a35-948c-c438aa4d6cb6 ms.reviewer: @@ -12,6 +12,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Enabling and Disabling Compatibility Fixes in Compatibility Administrator diff --git a/windows/deployment/planning/features-lifecycle.md b/windows/deployment/planning/features-lifecycle.md index a59b98bcff..2b515fbbd0 100644 --- a/windows/deployment/planning/features-lifecycle.md +++ b/windows/deployment/planning/features-lifecycle.md @@ -1,6 +1,6 @@ --- title: Windows 10 features lifecycle -description: Learn about the lifecycle of Windows 10 features +description: Learn about the lifecycle of Windows 10 features, as well as features that are no longer developed, removed features, and terminology assigned to a feature. ms.prod: w10 ms.mktglfcycl: plan ms.localizationpriority: medium @@ -10,6 +10,7 @@ author: greg-lindsay manager: laurawi ms.author: greglin ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Windows 10 features lifecycle @@ -21,7 +22,7 @@ Each release of Windows 10 contains many new and improved features. Occasionally The following topic lists features that are no longer being developed. These features might be removed in a future release. -[Windows 10 features we’re no longer developing](windows-10-deprecated-features.md) +[Windows 10 features we're no longer developing](windows-10-deprecated-features.md) ## Features removed @@ -41,4 +42,4 @@ The following terms can be used to describe the status that might be assigned to ## Also see -[Windows 10 release information](https://docs.microsoft.com/windows/release-information/) +[Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information) diff --git a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md index 98986e0bfd..ea3a21ed29 100644 --- a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md +++ b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md @@ -1,76 +1,77 @@ ---- -title: Fixing Applications by Using the SUA Tool (Windows 10) -description: On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. -ms.assetid: 7f5947b1-977b-4d7e-bb52-fbe8e76f6b8b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Fixing Applications by Using the SUA Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. - -**To fix an application by using the SUA tool** - -1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). - -2. After you finish testing, open the SUA tool. - -3. On the **Mitigation** menu, click the command that corresponds to the action that you want to take. The following table describes the commands. - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Mitigation menu commandDescription

        Apply Mitigations

        Opens the Mitigate AppCompat Issues dialog box, in which you can select the fixes that you intend to apply to the application.

        Undo Mitigations

        Removes the application fixes that you just applied.

        -

        This option is available only after you apply an application fix and before you close the SUA tool. Alternatively, you can manually remove application fixes by using Programs and Features in Control Panel.

        Export Mitigations as Windows Installer file

        Exports your application fixes as a Windows® Installer (.msi) file, which can then be deployed to other computers that are running the application.

        - -   - -  - -  - - - - - +--- +title: Fixing Applications by Using the SUA Tool (Windows 10) +description: On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. +ms.assetid: 7f5947b1-977b-4d7e-bb52-fbe8e76f6b8b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Fixing Applications by Using the SUA Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application. + +**To fix an application by using the SUA tool** + +1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). + +2. After you finish testing, open the SUA tool. + +3. On the **Mitigation** menu, click the command that corresponds to the action that you want to take. The following table describes the commands. + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Mitigation menu commandDescription

        Apply Mitigations

        Opens the Mitigate AppCompat Issues dialog box, in which you can select the fixes that you intend to apply to the application.

        Undo Mitigations

        Removes the application fixes that you just applied.

        +

        This option is available only after you apply an application fix and before you close the SUA tool. Alternatively, you can manually remove application fixes by using Programs and Features in Control Panel.

        Export Mitigations as Windows Installer file

        Exports your application fixes as a Windows® Installer (.msi) file, which can then be deployed to other computers that are running the application.

        + +   + +  + +  + + + + + diff --git a/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md b/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md index 80928366c3..99acb38299 100644 --- a/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md +++ b/windows/deployment/planning/prepare-your-organization-for-windows-to-go.md @@ -1,6 +1,6 @@ --- title: Prepare your organization for Windows To Go (Windows 10) -description: Prepare your organization for Windows To Go +description: Though Windows To Go is no longer being developed, you can find info here about the the “what”, “why”, and “when” of deployment. ms.assetid: f3f3c160-90ad-40a8-aeba-2aedee18f7ff ms.reviewer: manager: laurawi @@ -13,6 +13,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Prepare your organization for Windows To Go @@ -22,10 +23,10 @@ ms.topic: article - Windows 10 ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. -The following information is provided to help you plan and design a new deployment of a Windows To Go in your production environment. It provides answers to the “what”, “why”, and “when” questions an IT professional might have when planning to deploy Windows To Go. +The following information is provided to help you plan and design a new deployment of a Windows To Go in your production environment. It provides answers to the "what", "why", and "when" questions an IT professional might have when planning to deploy Windows To Go. ## What is Windows To Go? @@ -51,16 +52,16 @@ The following scenarios are examples of situations in which Windows To Go worksp - **Continuance of operations (COO).** In this scenario, selected employees receive a USB drive with a Windows To Go workspace, which includes all of the applications that the employees use at work. The employees can keep the device at home, in a briefcase, or wherever they want to store it until needed. When the users boot their home computer from the USB drive, it will create a corporate desktop experience so that they can quickly start working. On the very first boot, the employee sees that Windows is installing devices; after that one time, the Windows To Go drive boots like a normal computer. If they have enterprise network access, employees can use a virtual private network (VPN) connection or DirectAccess to access corporate resources. If the enterprise network is available, the Windows To Go workspace will automatically be updated using your standard client management processes. -- **Contractors and temporary workers.** In this situation, an enterprise IT pro or manager would distribute the Windows To Go drive directly to the worker where they can be assisted with any necessary additional user education needs or address any possible compatibility issues. While the worker is on assignment, they can boot their computer exclusively from the Windows To Go drive and run all applications in that environment until the end of the assignment when the device is returned. No installation of software is required on the worker’s personal computer. +- **Contractors and temporary workers.** In this situation, an enterprise IT pro or manager would distribute the Windows To Go drive directly to the worker where they can be assisted with any necessary additional user education needs or address any possible compatibility issues. While the worker is on assignment, they can boot their computer exclusively from the Windows To Go drive and run all applications in that environment until the end of the assignment when the device is returned. No installation of software is required on the worker's personal computer. - **Managed free seating.** The employee is issued a Windows To Go drive that is then used with the host computer assigned to that employee for a given session (this could be a vehicle, workspace, or standalone laptop). When the employee leaves the session, the next time they return they use the same USB flash drive but use a different host computer. -- **Work from home.** In this situation, the Windows To Go drive can be provisioned for employees using various methods including Microsoft Endpoint Configuration Manager or other deployment tools and then distributed to employees. The employee is instructed to boot the Windows To Go drive initially at work, which caches the employee’s credentials on the Windows To Go workspace and allows the initial data synchronization between the enterprise network and the Windows To Go workspace. The user can then bring the Windows To Go drive home where it can be used with their home computer, with or without enterprise network connectivity. +- **Work from home.** In this situation, the Windows To Go drive can be provisioned for employees using various methods including Microsoft Endpoint Manager or other deployment tools and then distributed to employees. The employee is instructed to boot the Windows To Go drive initially at work, which caches the employee's credentials on the Windows To Go workspace and allows the initial data synchronization between the enterprise network and the Windows To Go workspace. The user can then bring the Windows To Go drive home where it can be used with their home computer, with or without enterprise network connectivity. - **Travel lightly.** In this situation you have employees who are moving from site to site, but who always will have access to a compatible host computer on site. Using Windows To Go workspaces allows them to travel without the need to pack their PC. > [!NOTE] -> If the employee wants to work offline for the majority of the time, but still maintain the ability to use the drive on the enterprise network, they should be informed of how often the Windows To Go workspace needs to be connected to the enterprise network. Doing so will ensure that the drive retains its access privileges and the workspace’s computer object is not potentially deleted from Active Directory Domain Services (AD DS). +> If the employee wants to work offline for the majority of the time, but still maintain the ability to use the drive on the enterprise network, they should be informed of how often the Windows To Go workspace needs to be connected to the enterprise network. Doing so will ensure that the drive retains its access privileges and the workspace's computer object is not potentially deleted from Active Directory Domain Services (AD DS). @@ -76,7 +77,7 @@ Windows To Go uses volume activation. You can use either Active Directory-based Microsoft software, such as Microsoft Office, distributed to a Windows To Go workspace must also be activated. Office deployment is fully supported on Windows To Go. Please note, due to the retail subscription activation method associated with Microsoft 365 Apps for enterprise, Microsoft 365 Apps for enterprise subscribers are provided volume licensing activation rights for Office Professional Plus 2013 MSI for local installation on the Windows To Go drive. This is available to organizations who purchase Microsoft 365 Apps for enterprise or Office 365 Enterprise SKUs containing Microsoft 365 Apps for enterprise via volume licensing channels. For more information about activating Microsoft Office, see [Volume activation methods in Office 2013](https://go.microsoft.com/fwlink/p/?LinkId=618922). -You should investigate other software manufacturer’s licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace. +You should investigate other software manufacturer's licensing requirements to ensure they are compatible with roaming usage before deploying them to a Windows To Go workspace. > [!NOTE] > Using Multiple Activation Key (MAK) activation is not a supported activation method for Windows To Go as each different PC-host would require separate activation. MAK activation should not be used for activating Windows, Office, or any other application on a Windows To Go drive. @@ -102,7 +103,7 @@ If you configure Windows To Go drives for scenarios where drives may remain unus ## User account and data management -People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user’s profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). +People use computers to work with data and consume content - that is their core function. The data must be stored and retrievable for it to be useful. When users are working in a Windows To Go workspace, they need to have the ability to get to the data that they work with and to keep it accessible when the workspace is not being used. For this reason we recommend that you use folder redirection and offline files to redirect the path of local folders (such as the Documents folder) to a network location, while caching the contents locally for increased speed and availability. We also recommend that you use roaming user profiles to synchronize user specific settings so that users receive the same operating system and application settings when using their Windows To Go workspace and their desktop computer. When a user signs in using a domain account that is set up with a file share as the profile path, the user's profile is downloaded to the local computer and merged with the local profile (if present). When the user logs off the computer, the local copy of their profile, including any changes, is merged with the server copy of the profile. For more information, see [Folder Redirection, Offline Files, and Roaming User Profiles overview](https://go.microsoft.com/fwlink/p/?LinkId=618924). Windows To Go is fully integrated with your Microsoft account. Setting synchronization is accomplished by connecting a Microsoft account to a user account. Windows To Go devices fully support this feature and can be managed by Group Policy so that the customization and configurations you prefer will be applied to your Windows To Go workspace. diff --git a/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md b/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md index 905e495858..952f743607 100644 --- a/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md +++ b/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go.md @@ -22,8 +22,8 @@ ms.topic: article - Windows 10 ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. One of the most important requirements to consider when you plan your Windows To Go deployment is to ensure that the data, content, and resources you work with in the Windows To Go workspace is protected and secure. diff --git a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md index 08db3b24d6..d4b510cd08 100644 --- a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md +++ b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md @@ -1,80 +1,81 @@ ---- -title: Showing Messages Generated by the SUA Tool (Windows 10) -description: On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. -ms.assetid: 767eb7f2-d6c4-414c-a7b3-a997337d904a -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Showing Messages Generated by the SUA Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. - -**To show the messages that the SUA tool has generated** - -1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). - -2. After you finish testing, in the SUA tool, click the **App Info** tab. - -3. On the **View** menu, click the command that corresponds to the messages that you want to see. The following table describes the commands. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        View menu commandDescription

        Error Messages

        When this command is selected, the user interface shows error messages that the SUA tool has generated. Error messages are highlighted in pink.

        -

        This command is selected by default.

        Warning Messages

        When this command is selected, the user interface shows warning messages that the SUA tool has generated. Warning messages are highlighted in yellow.

        Information Messages

        When this command is selected, the user interface shows informational messages that the SUA tool has generated. Informational messages are highlighted in green.

        Detailed Information

        When this command is selected, the user interface shows information that the SUA tool has generated, such as debug, stack trace, stop code, and severity information.

        - -   - -  - -  - - - - - +--- +title: Showing Messages Generated by the SUA Tool (Windows 10) +description: On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. +ms.assetid: 767eb7f2-d6c4-414c-a7b3-a997337d904a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Showing Messages Generated by the SUA Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated. + +**To show the messages that the SUA tool has generated** + +1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md). + +2. After you finish testing, in the SUA tool, click the **App Info** tab. + +3. On the **View** menu, click the command that corresponds to the messages that you want to see. The following table describes the commands. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        View menu commandDescription

        Error Messages

        When this command is selected, the user interface shows error messages that the SUA tool has generated. Error messages are highlighted in pink.

        +

        This command is selected by default.

        Warning Messages

        When this command is selected, the user interface shows warning messages that the SUA tool has generated. Warning messages are highlighted in yellow.

        Information Messages

        When this command is selected, the user interface shows informational messages that the SUA tool has generated. Informational messages are highlighted in green.

        Detailed Information

        When this command is selected, the user interface shows information that the SUA tool has generated, such as debug, stack trace, stop code, and severity information.

        + +   + +  + +  + + + + + diff --git a/windows/deployment/planning/sua-users-guide.md b/windows/deployment/planning/sua-users-guide.md index 56143ee843..2d34aa8326 100644 --- a/windows/deployment/planning/sua-users-guide.md +++ b/windows/deployment/planning/sua-users-guide.md @@ -1,6 +1,7 @@ --- title: SUA User's Guide (Windows 10) -description: Standard User Analyzer (SUA) can test your apps and monitor API calls to detect compatibility issues related to Windows' User Account Control (UAC) feature. +description: Learn how to use Standard User Analyzer (SUA). SUA can test your apps and monitor API calls to detect compatibility issues related to the Windows User Account Control (UAC) feature. +ms.custom: seo-marvel-apr2020 ms.assetid: ea525c25-b557-4ed4-b042-3e4d0e543e10 ms.reviewer: manager: laurawi @@ -67,4 +68,3 @@ You can use SUA in either of the following ways: - diff --git a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md index d58bf1d2ce..d3c279c3eb 100644 --- a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md +++ b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md @@ -1,105 +1,106 @@ ---- -title: Tabs on the SUA Tool Interface (Windows 10) -description: The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. -ms.assetid: 0d705321-1d85-4217-bf2c-0ca231ca303b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Tabs on the SUA Tool Interface - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. - -The following table provides a description of each tab on the user interface for the SUA tool. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Tab nameDescription

        App Info

        Provides the following information for the selected application:

        -
          -
        • Debugging information

        • -
        • Error, warning, and informational messages (if they are enabled)

        • -
        • Options for running the application

        • -

        File

        Provides information about access to the file system.

        -

        For example, this tab might show an attempt to write to a file that only administrators can typically access.

        Registry

        Provides information about access to the system registry.

        -

        For example, this tab might show an attempt to write to a registry key that only administrators can typically access.

        INI

        Provides information about WriteProfile API issues.

        -

        For example, in the Calculator tool (Calc.exe) in Windows® XP, when you change the view from Standard to Scientific, Calc.exe calls the WriteProfile API to write to the Windows\Win.ini file. The Win.ini file is writable only for administrators.

        Token

        Provides information about access-token checking.

        -

        For example, this tab might show an explicit check for the Builtin\Administrators security identifier (SID) in the user's access token. This operation may not work for a standard user.

        Privilege

        Provides information about permissions.

        -

        For example, this tab might show an attempt to explicitly enable permissions that do not work for a standard user.

        Name Space

        Provides information about creation of system objects.

        -

        For example, this tab might show an attempt to create a new system object, such as an event or a memory map, in a restricted namespace. Applications that attempt this kind of operation do not function for a standard user.

        Other Objects

        Provides information related to applications accessing objects other than files and registry keys.

        Process

        Provides information about process elevation.

        -

        For example, this tab might show the use of the CreateProcess API to open an executable (.exe) file that, in turn, requires process elevation that will not function for a standard user.

        - -  - -  - -  - - - - - +--- +title: Tabs on the SUA Tool Interface (Windows 10) +description: The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. +ms.assetid: 0d705321-1d85-4217-bf2c-0ca231ca303b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Tabs on the SUA Tool Interface + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze. + +The following table provides a description of each tab on the user interface for the SUA tool. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Tab nameDescription

        App Info

        Provides the following information for the selected application:

        +
          +
        • Debugging information

        • +
        • Error, warning, and informational messages (if they are enabled)

        • +
        • Options for running the application

        • +

        File

        Provides information about access to the file system.

        +

        For example, this tab might show an attempt to write to a file that only administrators can typically access.

        Registry

        Provides information about access to the system registry.

        +

        For example, this tab might show an attempt to write to a registry key that only administrators can typically access.

        INI

        Provides information about WriteProfile API issues.

        +

        For example, in the Calculator tool (Calc.exe) in Windows® XP, when you change the view from Standard to Scientific, Calc.exe calls the WriteProfile API to write to the Windows\Win.ini file. The Win.ini file is writable only for administrators.

        Token

        Provides information about access-token checking.

        +

        For example, this tab might show an explicit check for the Builtin\Administrators security identifier (SID) in the user's access token. This operation may not work for a standard user.

        Privilege

        Provides information about permissions.

        +

        For example, this tab might show an attempt to explicitly enable permissions that do not work for a standard user.

        Name Space

        Provides information about creation of system objects.

        +

        For example, this tab might show an attempt to create a new system object, such as an event or a memory map, in a restricted namespace. Applications that attempt this kind of operation do not function for a standard user.

        Other Objects

        Provides information related to applications accessing objects other than files and registry keys.

        Process

        Provides information about process elevation.

        +

        For example, this tab might show the use of the CreateProcess API to open an executable (.exe) file that, in turn, requires process elevation that will not function for a standard user.

        + +  + +  + +  + + + + + diff --git a/windows/deployment/planning/using-the-compatibility-administrator-tool.md b/windows/deployment/planning/using-the-compatibility-administrator-tool.md index b38891eae2..cb84beaa58 100644 --- a/windows/deployment/planning/using-the-compatibility-administrator-tool.md +++ b/windows/deployment/planning/using-the-compatibility-administrator-tool.md @@ -1,94 +1,95 @@ ---- -title: Using the Compatibility Administrator Tool (Windows 10) -description: This section provides information about using the Compatibility Administrator tool. -ms.assetid: 57271e47-b9b9-4018-a0b5-7115a533166d -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Using the Compatibility Administrator Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -This section provides information about using the Compatibility Administrator tool. - -## In this section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        TopicDescription

        Available Data Types and Operators in Compatibility Administrator

        The Compatibility Administrator tool provides a way to query your custom-compatibility databases.

        Searching for Fixed Applications in Compatibility Administrator

        With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application.

        Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator

        You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature.

        Creating a Custom Compatibility Fix in Compatibility Administrator

        The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages.

        Creating a Custom Compatibility Mode in Compatibility Administrator

        Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases.

        Creating an AppHelp Message in Compatibility Administrator

        The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system.

        Viewing the Events Screen in Compatibility Administrator

        The Events screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities.

        Enabling and Disabling Compatibility Fixes in Compatibility Administrator

        You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.

        Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator

        The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers.

        - - - - - - - - - - - +--- +title: Using the Compatibility Administrator Tool (Windows 10) +description: This section provides information about using the Compatibility Administrator tool. +ms.assetid: 57271e47-b9b9-4018-a0b5-7115a533166d +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Using the Compatibility Administrator Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +This section provides information about using the Compatibility Administrator tool. + +## In this section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        TopicDescription

        Available Data Types and Operators in Compatibility Administrator

        The Compatibility Administrator tool provides a way to query your custom-compatibility databases.

        Searching for Fixed Applications in Compatibility Administrator

        With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application.

        Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator

        You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature.

        Creating a Custom Compatibility Fix in Compatibility Administrator

        The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages.

        Creating a Custom Compatibility Mode in Compatibility Administrator

        Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases.

        Creating an AppHelp Message in Compatibility Administrator

        The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system.

        Viewing the Events Screen in Compatibility Administrator

        The Events screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities.

        Enabling and Disabling Compatibility Fixes in Compatibility Administrator

        You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.

        Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator

        The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers.

        + + + + + + + + + + + diff --git a/windows/deployment/planning/windows-10-compatibility.md b/windows/deployment/planning/windows-10-compatibility.md index 464e7e03de..965ad4dad7 100644 --- a/windows/deployment/planning/windows-10-compatibility.md +++ b/windows/deployment/planning/windows-10-compatibility.md @@ -1,60 +1,61 @@ ---- -title: Windows 10 compatibility (Windows 10) -description: Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. -ms.assetid: 829BE5B5-330A-4702-807A-8908B4FC94E8 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, upgrade, update, appcompat -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 compatibility - - -**Applies to** - -- Windows 10 - -Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. - -For full system requirements, see [Windows 10 specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. - -Existing desktop (Win32) application compatibility is also expected to be strong, with most existing applications working without any changes. Some applications that interface with Windows at a low level, those that use undocumented APIs, or those that do not follow recommended coding practices could experience issues. - -Existing Windows Store (WinRT) apps created for Windows 8 and Windows 8.1 should also continue to work, because compatibility can be validated against all the apps that have been submitted to the Windows Store. - -For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](https://go.microsoft.com/fwlink/p/?LinkId=734031) - -## Recommended application testing process - - -Historically, organizations have performed extensive, and often exhaustive, testing of the applications they use before deployment of a new Windows version, service pack, or any other significant update. With Windows 10, organizations are encouraged to leverage more optimized testing processes, which reflects the higher levels of compatibility that are expected. At a high level: - -- Identify mission-critical applications and websites, those that are absolutely essential to the organization’s operations. Focus testing efforts on this subset of applications, early in the Windows development cycle (for example, with Windows Insider Program builds) to identify potential issues. Report any issues you encounter with the Windows Feedback tool, so that these issues can be addressed prior to the next Windows release. - -- For less critical applications, leverage an “internal flighting” or pilot-based approach, by deploying new Windows upgrades to groups of machines, growing gradually in size and potential impact, to verify compatibility with hardware and software. Reactively address issues before you expand the pilot to more machines. - -## Related topics - - -[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md) - -[Windows 10 deployment considerations](windows-10-deployment-considerations.md) - -[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) - -  - -  - - - - - +--- +title: Windows 10 compatibility (Windows 10) +description: Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. +ms.assetid: 829BE5B5-330A-4702-807A-8908B4FC94E8 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, upgrade, update, appcompat +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 compatibility + + +**Applies to** + +- Windows 10 + +Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. + +For full system requirements, see [Windows 10 specifications](https://go.microsoft.com/fwlink/p/?LinkId=625077). Some driver updates may be required for Windows 10. + +Existing desktop (Win32) application compatibility is also expected to be strong, with most existing applications working without any changes. Some applications that interface with Windows at a low level, those that use undocumented APIs, or those that do not follow recommended coding practices could experience issues. + +Existing Windows Store (WinRT) apps created for Windows 8 and Windows 8.1 should also continue to work, because compatibility can be validated against all the apps that have been submitted to the Windows Store. + +For web apps and sites, modern HTML5-based sites should also have a high degree of compatibility and excellent performance through the new Microsoft Edge browser, while older web apps and sites can continue to use Internet Explorer 11 and the Enterprise Mode features that were first introduced in Windows 7 and Windows 8.1 and are still present in Windows 10. For more information about Internet Explorer and Enterprise Mode, see the [Internet Explorer 11 Deployment Guide for IT Pros.](https://go.microsoft.com/fwlink/p/?LinkId=734031) + +## Recommended application testing process + + +Historically, organizations have performed extensive, and often exhaustive, testing of the applications they use before deployment of a new Windows version, service pack, or any other significant update. With Windows 10, organizations are encouraged to leverage more optimized testing processes, which reflects the higher levels of compatibility that are expected. At a high level: + +- Identify mission-critical applications and websites, those that are absolutely essential to the organization’s operations. Focus testing efforts on this subset of applications, early in the Windows development cycle (for example, with Windows Insider Program builds) to identify potential issues. Report any issues you encounter with the Windows Feedback tool, so that these issues can be addressed prior to the next Windows release. + +- For less critical applications, leverage an “internal flighting” or pilot-based approach, by deploying new Windows upgrades to groups of machines, growing gradually in size and potential impact, to verify compatibility with hardware and software. Reactively address issues before you expand the pilot to more machines. + +## Related topics + + +[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md) + +[Windows 10 deployment considerations](windows-10-deployment-considerations.md) + +[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) + +  + +  + + + + + diff --git a/windows/deployment/planning/windows-10-deployment-considerations.md b/windows/deployment/planning/windows-10-deployment-considerations.md index a1156b67f9..acf11aa0ee 100644 --- a/windows/deployment/planning/windows-10-deployment-considerations.md +++ b/windows/deployment/planning/windows-10-deployment-considerations.md @@ -1,144 +1,132 @@ ---- -title: Windows 10 deployment considerations (Windows 10) -description: There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. -ms.assetid: A8DD6B37-1E11-4CD6-B588-92C2404219FE -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: deploy, upgrade, update, in-place -ms.prod: w10 -ms.localizationpriority: medium -ms.mktglfcycl: plan -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 deployment considerations - - -**Applies to** - -- Windows 10 - -There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. - -For many years, organizations have deployed new versions of Windows using a “wipe and load” deployment process. At a high level, this process captures existing data and settings from the existing device, deploys a new custom-built Windows image to a PC, injects hardware drivers, reinstalls applications, and finally restores the data and settings. With Windows 10, this process is still fully supported, and for some deployment scenarios is still necessary. - -Windows 10 also introduces two additional scenarios that organizations should consider: - -- **In-place upgrade**, which provides a simple, automated process that leverages the Windows setup process to automatically upgrade from an earlier version of Windows. This process automatically migrates existing data, settings, drivers, and applications. - -- **Dynamic provisioning**, which enables organizations to configure new Windows 10 devices for organization use without having to deploy a new custom organization image to the device. - - Both of these scenarios eliminate the image creation process altogether, which can greatly simplify the deployment process. - - So how do you choose? At a high level: - - ---- - - - - - - - - - - - - - - - - - - - - -
        Consider ...For these scenarios
        In-place upgrade
          -
        • When you want to keep all (or at least most) existing applications

        • -
        • When you do not plan to significantly change the device configuration (for example, BIOS to UEFI) or operating system configuration (for example, x86 to x64, language changes, Administrators to non-Administrators, Active Directory domain consolidations)

        • -
        • To migrate from Windows 10 to a later Windows 10 release

        • -
        Traditional wipe-and-load
          -
        • When you upgrade significant numbers of applications along with the new Windows OS

        • -
        • When you make significant device or operating system configuration changes

        • -
        • When you “start clean”. For example, scenarios where it is not necessary to preserve existing apps or data (for example, call centers) or when you move from unmanaged to well-managed PCs

        • -
        • When you migrate from Windows Vista or other previous operating system versions

        • -
        Dynamic provisioning
          -
        • For new devices, especially in “choose your own device” scenarios when simple configuration (not reimaging) is all that is required

        • -
        • When used in combination with a management tool (for example, an MDM service like Microsoft Intune) that enables self-service installation of user-specific or role-specific apps

        • -
        - -  - -## Migration from previous Windows versions - - -For existing PCs running Windows 7 or Windows 8.1, in-place upgrade is the recommended method for Windows 10 deployment and should be used whenever possible. Although wipe-and-load (OS refresh) deployments are still fully supported (and necessary in some scenarios, as mentioned previously), in-place upgrade is simpler and faster, and enables a faster Windows 10 deployment overall. - -Note that the original Windows 8 release is only supported until January 2016. Organizations that do not think they can complete a full Windows 10 migration by that date should deploy Windows 8.1 now and consider Windows 10 after Windows 8 has been removed from the environment. - -For existing Windows PCs running Windows Vista, you can perform wipe-and-load (OS refresh) deployments when you use compatible hardware. - -Note that to take advantage of the limited-time free upgrade offer for PCs running Windows 7, Windows 8, or Windows 8.1, you must leverage an in-place upgrade, either from Windows Update or by using the upgrade media available from the [Windows 10 software download page](https://go.microsoft.com/fwlink/p/?LinkId=625073) to acquire a new Windows 10 license from the Windows Store. For more information, refer to the [Windows 10 FAQ](https://go.microsoft.com/fwlink/p/?LinkId=625074). - -For organizations with Software Assurance for Windows, both in-place upgrade or wipe-and-load can be leveraged (with in-place upgrade being the preferred method, as previously discussed). - -For organizations that do not take advantage of the free upgrade offer and are not enrolled in Software Assurance for Windows, Windows 10 upgrade licenses are available for purchase through existing Volume License (VL) agreements. - -## Setup of new computers - - -For new computers acquired with Windows 10 preinstalled, you can leverage dynamic provisioning scenarios to transform the device from its initial state into a fully-configured organization PC. There are two primary dynamic provisioning scenarios you can use: - -- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their “work or school account” within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](https://go.microsoft.com/fwlink/p/?LinkId=625075). - -- **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=625076). - -In either of these scenarios, you can make a variety of configuration changes to the PC: - -- Transform the edition (SKU) of Windows 10 that is in use. - -- Apply configuration and settings to the device (for example, security settings, device restrictions, policies, Wi-Fi and VPN profiles, certificates, and so on). - -- Install apps, language packs, and updates. - -- Enroll the device in a management solution (applicable for IT admin-driven scenarios, configuring the device just enough to allow the management tool to take over configuration and ongoing management). - -## Stay up to date - - -For computers already running Windows 10 on the Semi-Annual Channel, new upgrades will periodically be deployed, approximately two to three times per year. You can deploy these upgrades by using a variety of methods: - -- Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet. - -- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they are approved (deploying like an update). Note that this will require updates to WSUS, which are only available for Windows Server 2012 and Windows Server 2012 R2, not previous versions. - -- System Center Configuration Manager task sequences (with Configuration Manager 2012, 2012 R2, and later versions). - -- System Center Configuration Manager vNext software update capabilities (deploying like an update). - -Note that these upgrades (which are installed differently than monthly updates) will leverage an in-place upgrade process. Unlike updates, which are relatively small, these upgrades will include a full operating system image (around 3 GB for 64-bit operating systems), which requires time (1-2 hours) and disk space (approximately 10 GB) to complete. Ensure that the deployment method you use can support the required network bandwidth and/or disk space requirements. - -Over time, this upgrade process will be optimized to reduce the overall time and network bandwidth consumed. - -## Related topics - - -[Windows 10 compatibility](windows-10-compatibility.md) - -[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) - -  - -  - - - - - +--- +title: Windows 10 deployment considerations (Windows 10) +description: There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. +ms.assetid: A8DD6B37-1E11-4CD6-B588-92C2404219FE +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, upgrade, update, in-place +ms.prod: w10 +ms.localizationpriority: medium +ms.mktglfcycl: plan +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 deployment considerations + + +**Applies to** + +- Windows 10 + +There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. + +For many years, organizations have deployed new versions of Windows using a “wipe and load” deployment process. At a high level, this process captures existing data and settings from the existing device, deploys a new custom-built Windows image to a PC, injects hardware drivers, reinstalls applications, and finally restores the data and settings. With Windows 10, this process is still fully supported, and for some deployment scenarios is still necessary. + +Windows 10 also introduces two additional scenarios that organizations should consider: + +- **In-place upgrade**, which provides a simple, automated process that leverages the Windows setup process to automatically upgrade from an earlier version of Windows. This process automatically migrates existing data, settings, drivers, and applications. + +- **Dynamic provisioning**, which enables organizations to configure new Windows 10 devices for organization use without having to deploy a new custom organization image to the device. + + Both of these scenarios eliminate the image creation process altogether, which can greatly simplify the deployment process. + + So how do you choose? At a high level: + + ++++ + + + + + + + + + + + + + + + + + + + + +
        Consider ...For these scenarios
        In-place upgrade
          +
        • When you want to keep all (or at least most) existing applications

        • +
        • When you do not plan to significantly change the device configuration (for example, BIOS to UEFI) or operating system configuration (for example, x86 to x64, language changes, Administrators to non-Administrators, Active Directory domain consolidations)

        • +
        • To migrate from Windows 10 to a later Windows 10 release

        • +
        Traditional wipe-and-load
          +
        • When you upgrade significant numbers of applications along with the new Windows OS

        • +
        • When you make significant device or operating system configuration changes

        • +
        • When you “start clean”. For example, scenarios where it is not necessary to preserve existing apps or data (for example, call centers) or when you move from unmanaged to well-managed PCs

        • +
        • When you migrate from Windows Vista or other previous operating system versions

        • +
        Dynamic provisioning
          +
        • For new devices, especially in “choose your own device” scenarios when simple configuration (not reimaging) is all that is required

        • +
        • When used in combination with a management tool (for example, an MDM service like Microsoft Intune) that enables self-service installation of user-specific or role-specific apps

        • +
        + +  +## Migration from previous Windows versions + +For existing PCs running Windows 7 or Windows 8.1, in-place upgrade is the recommended method for Windows 10 deployment and should be used whenever possible. Although wipe-and-load (OS refresh) deployments are still fully supported (and necessary in some scenarios, as mentioned previously), in-place upgrade is simpler and faster, and enables a faster Windows 10 deployment overall. + +The original Windows 8 release was only supported until January 2016. For devices running Windows 8.0, you can update to Windows 8.1 and then upgrade to Windows 10. + +For PCs running operating systems older than Windows 7, you can perform wipe-and-load (OS refresh) deployments when you use compatible hardware. + +For organizations with Software Assurance for Windows, both in-place upgrade or wipe-and-load can be leveraged (with in-place upgrade being the preferred method, as previously discussed). + +For organizations that did not take advantage of the free upgrade offer and are not enrolled in Software Assurance for Windows, Windows 10 upgrade licenses are available for purchase through existing Volume License (VL) agreements. + +## Setting up new computers + +For new computers acquired with Windows 10 preinstalled, you can leverage dynamic provisioning scenarios to transform the device from its initial state into a fully-configured organization PC. There are two primary dynamic provisioning scenarios you can use: + +- **User-driven, from the cloud.** By joining a device into Azure Active Directory and leveraging the automatic mobile device management (MDM) provisioning capabilities at the same time, an end user can initiate the provisioning process themselves just by entering the Azure Active Directory account and password (called their “work or school account” within Windows 10). The MDM service can then transform the device into a fully-configured organization PC. For more information, see [Azure Active Directory integration with MDM](https://go.microsoft.com/fwlink/p/?LinkId=625075). + +- **IT admin-driven, using new tools.** Using the new Windows Imaging and Configuration Designer (ICD) tool, IT administrators can create provisioning packages that can be applied to a computer to transform it into a fully-configured organization PC. For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=625076). + +In either of these scenarios, you can make a variety of configuration changes to the PC: + +- Transform the edition (SKU) of Windows 10 that is in use. +- Apply configuration and settings to the device (for example, security settings, device restrictions, policies, Wi-Fi and VPN profiles, certificates, and so on). +- Install apps, language packs, and updates. +- Enroll the device in a management solution (applicable for IT admin-driven scenarios, configuring the device just enough to allow the management tool to take over configuration and ongoing management). + +## Stay up to date + +For computers already running Windows 10 on the Semi-Annual Channel, new upgrades will be deployed two times per year. You can deploy these upgrades by using a variety of methods: + +- Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet. +- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they are approved (deploying like an update). +- Configuration Manager task sequences. +- Configuration Manager software update capabilities (deploying like an update). + +These upgrades (which are installed differently than monthly updates) leverage an in-place upgrade process. Unlike updates, which are relatively small, these upgrades will include a full operating system image (around 3 GB for 64-bit operating systems), which requires time (1-2 hours) and disk space (approximately 10 GB) to complete. Ensure that the deployment method you use can support the required network bandwidth and/or disk space requirements. + +The upgrade process is also optimized to reduce the overall time and network bandwidth consumed. + +## Related topics + + +[Windows 10 compatibility](windows-10-compatibility.md)
        +[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) + +  + +  + + + + + diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 5a34226e0f..2012a23148 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,7 +26,9 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | -| Hyper-V vSwitch on LBFO | In a future release, the Hyper-V vSwitch will no longer have the capability to be bound to an LBFO team. Instead, it can be bound via [Switch Embedded Teaming](https://docs.microsoft.com/windows-server/virtualization/hyper-v-virtual-switch/rdma-and-switch-embedded-teaming#bkmk_sswitchembedded) (SET).| 1909 | +| Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | +| Companion Device Framework | The [Companion Device Framework](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | +| Dynamic Disks | The [Dynamic Disks](https://docs.microsoft.com/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](https://docs.microsoft.com/windows-server/storage/storage-spaces/overview) in a future release.| 2004 | | Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 | | My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 | | Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user.
         
        The recommended replacement for PSR is [Azure App Service](https://docs.microsoft.com/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web. | 1909 | @@ -35,15 +37,16 @@ The features described below are no longer being actively developed, and might b | Wi-Fi WEP and TKIP | Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which are not as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | 1903 | | Windows To Go | Windows To Go is no longer being developed.

        The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.| 1903 | | Print 3D app | Going forward, 3D Builder is the recommended 3D printing app. To 3D print objects on new Windows devices, customers must first install 3D Builder from the Store.| 1903 | -|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because third party partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| 1809 | +|Companion device dynamic lock APIS|The companion device framework (CDF) APIs enable wearables and other devices to unlock a PC. In Windows 10, version 1709, we introduced [Dynamic Lock](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#dynamic-lock), including an inbox method using Bluetooth to detect whether a user is present and lock or unlock the PC. Because of this, and because non-Microsoft partners didn't adopt the CDF method, we're no longer developing CDF Dynamic Lock APIs.| 1809 | |OneSync service|The OneSync service synchronizes data for the Mail, Calendar, and People apps. We've added a sync engine to the Outlook app that provides the same synchronization.| 1809 | |Snipping Tool|The Snipping Tool is an application included in Windows 10 that is used to capture screenshots, either the full screen or a smaller, custom "snip" of the screen. In Windows 10, version 1809, we're [introducing a new universal app, Snip & Sketch](https://blogs.windows.com/windowsexperience/2018/05/03/announcing-windows-10-insider-preview-build-17661/#8xbvP8vMO0lF20AM.97), that provides the same screen snipping abilities, as well as additional features. You can launch Snip & Sketch directly and start a snip from there, or just press WIN + Shift + S. Snip & Sketch can also be launched from the “Screen snip” button in the Action Center. We're no longer developing the Snipping Tool as a separate app but are instead consolidating its functionality into Snip & Sketch.| 1809 | |[Software Restriction Policies](https://docs.microsoft.com/windows-server/identity/software-restriction-policies/software-restriction-policies) in Group Policy|Instead of using the Software Restriction Policies through Group Policy, you can use [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview) or [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control) to control which apps users can access and what code can run in the kernel.| 1803 | |[Offline symbol packages](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-symbols) (Debug symbol MSIs)|We're no longer making the symbol packages available as a downloadable MSI. Instead, the [Microsoft Symbol Server is moving to be an Azure-based symbol store](https://blogs.msdn.microsoft.com/windbg/2017/10/18/update-on-microsofts-symbol-server/). If you need the Windows symbols, connect to the Microsoft Symbol Server to cache your symbols locally or use a manifest file with SymChk.exe on a computer with internet access.| 1803 | |Windows Help Viewer (WinHlp32.exe)|All Windows help information is [available online](https://support.microsoft.com/products/windows?os=windows-10). The Windows Help Viewer is no longer supported in Windows 10. If for any reason you see an error message about "help not supported," possibly when using a non-Microsoft application, read [this support article](https://support.microsoft.com/help/917607/error-opening-help-in-windows-based-programs-feature-not-included-or-h) for additional information and any next steps.| 1803 | +|MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. For more information, see [Developer guide for creating service metadata](https://docs.microsoft.com/windows-hardware/drivers/mobilebroadband/developer-guide-for-creating-service-metadata) | 1803 | |Contacts feature in File Explorer|We're no longer developing the Contacts feature or the corresponding [Windows Contacts API](https://msdn.microsoft.com/library/ff800913.aspx). Instead, you can use the People app in Windows 10 to maintain your contacts.| 1803 | |Phone Companion|Use the **Phone** page in the Settings app. In Windows 10, version 1709, we added the new **Phone** page to help you sync your mobile phone with your PC. It includes all the Phone Companion features.| 1803 | -|IPv4/6 Transition Technologies (6to4, ISATAP, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.| 1803 | +|IPv4/6 Transition Technologies (6to4, ISATAP, Teredo, and Direct Tunnels)|6to4 has been disabled by default since Windows 10, version 1607 (the Anniversary Update), ISATAP has been disabled by default since Windows 10, version 1703 (the Creators Update), Teredo has been disabled since Windows 10, version 1803, and Direct Tunnels has always been disabled by default. Please use native IPv6 support instead.| 1803 | |[Layered Service Providers](https://msdn.microsoft.com/library/windows/desktop/bb513664)|Layered Service Providers has not been developed since Windows 8 and Windows Server 2012. Use the [Windows Filtering Platform](https://msdn.microsoft.com/library/windows/desktop/aa366510) instead. When you upgrade from an older version of Windows, any layered service providers you're using aren't migrated; you'll need to re-install them after upgrading.| 1803 | |Business Scanning| This feature is also called Distributed Scan Management (DSM) **(Added 05/03/2018)**
         
        The [Scan Management functionality](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd759124(v=ws.11)) was introduced in Windows 7 and enabled secure scanning and the management of scanners in an enterprise. We're no longer investing in this feature, and there are no devices available that support it.| 1803 | |IIS 6 Management Compatibility* | We recommend that users use alternative scripting tools and a newer management console. | 1709 | @@ -56,7 +59,7 @@ The features described below are no longer being actively developed, and might b |Trusted Platform Module (TPM) Owner Password Management |This functionality within TPM.msc will be migrated to a new user interface.| 1709 | |Trusted Platform Module (TPM): TPM.msc and TPM Remote Management | To be replaced by a new user interface in a future release. | 1709 | |Trusted Platform Module (TPM) Remote Management |This functionality within TPM.msc will be migrated to a new user interface. | 1709 | -|Windows Hello for Business deployment that uses Microsoft Endpoint Configuration Manager |Windows Server 2016 Active Directory Federation Services – Registration Authority (ADFS RA) deployment is simpler and provides a better user experience and a more deterministic certificate enrollment experience. | 1709 | +|Windows Hello for Business deployment that uses Microsoft Endpoint Manager |Windows Server 2016 Active Directory Federation Services – Registration Authority (ADFS RA) deployment is simpler and provides a better user experience and a more deterministic certificate enrollment experience. | 1709 | |Windows PowerShell 2.0 | Applications and components should be migrated to PowerShell 5.0+. | 1709 | |Apndatabase.xml | Apndatabase.xml is being replaced by the COSA database. Therefore, some constructs will no longer function. This includes Hardware ID, incoming SMS messaging rules in mobile apps, a list of privileged apps in mobile apps, autoconnect order, APN parser, and CDMAProvider ID. | 1703 | |Tile Data Layer | The [Tile Data Layer](https://docs.microsoft.com/windows/configuration/start-layout-troubleshoot#symptom-start-menu-issues-with-tile-data-layer-corruption) database stopped development in Windows 10, version 1703. | 1703 | diff --git a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md index 764b8d1ca5..b48649cf32 100644 --- a/windows/deployment/planning/windows-10-enterprise-faq-itpro.md +++ b/windows/deployment/planning/windows-10-enterprise-faq-itpro.md @@ -6,14 +6,12 @@ ms.prod: w10 ms.mktglfcycl: plan ms.localizationpriority: medium ms.sitesec: library -audience: itpro author: greg-lindsay ms.date: 08/18/2017 ms.reviewer: manager: laurawi ms.author: greglin audience: itpro -author: greg-lindsay ms.topic: article --- @@ -66,7 +64,7 @@ Many existing Win32 and Win64 applications already run reliably on Windows 10 wi Updated versions of Microsoft deployment tools, including MDT, Configuration Manager, and the Windows Assessment and Deployment Kit (Windows ADK) have been released to support Windows 10. - [MDT](https://www.microsoft.com/mdt) is Microsoft’s recommended collection of tools, processes, and guidance for automating desktop and server deployment. -- Configuration Manager simplifies the deployment and management of Windows 10. If you are not currently using Configuration Manager, you can download a free 180-day trial of [Microsoft Endpoint Configuration Manager and Endpoint Protection (current branch)](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) from the TechNet Evaluation Center. +- Configuration Manager simplifies the deployment and management of Windows 10. If you are not currently using Configuration Manager, you can download a free 180-day trial of [Microsoft Endpoint Manager and Endpoint Protection (current branch)](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) from the TechNet Evaluation Center. - The [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit#winADK) has tools that allow you to customize Windows images for large-scale deployment, and test system quality and performance. You can download the latest version of the Windows ADK for Windows 10 from the Hardware Dev Center. ### Can I upgrade computers from Windows 7 or Windows 8.1 without deploying a new image? diff --git a/windows/deployment/planning/windows-10-fall-creators-removed-features.md b/windows/deployment/planning/windows-10-fall-creators-removed-features.md deleted file mode 100644 index 9c2f192856..0000000000 --- a/windows/deployment/planning/windows-10-fall-creators-removed-features.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Windows 10 Fall Creators Update - Features removed or planned for removal -description: Which features were removed in Windows 10 Fall Creators Update (version 1709)? Which features are we thinking of removing in the future? -ms.prod: w10 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro -author: greg-lindsay -ms.date: 10/09/2017 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.topic: article ---- - -# Features removed or planned for replacement starting with Windows 10 Fall Creators Update (version 1709) - -> Applies to: Windows 10, version 1709 - -Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Read on for details about the features and functionalities that we removed in Windows 10 Fall Creators Update (version 1709). This list also includes information about features and functionality that we're considering removing in a future release of Windows 10. This list is intended to make you aware of current and future changes and inform your planning. **The list is subject to change and might not include every affected feature or functionality.** - -## Features removed from Windows 10 Fall Creators Update - -We've removed the following features and functionalities from the installed product image in Windows 10, version 1709. Applications, code, or usage that depend on these features won't function in this release unless you employ an alternate method. - -### 3D Builder - -No longer installed by default, [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) is still available for download from the Microsoft Store. You can also consider using Print 3D and Paint 3D in its place. - -### APN database (Apndatabase.xml) - -Replaced by the Country and Operator Settings Asset (COSA) database. For more information, see the following Hardware Dev Center articles: - -- [Planning your COSA/APN database submission](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission) -- [COSA – FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) - -### Enhanced Mitigation Experience Toolkit (EMET) - -Removed from the image, and you're blocked from using it. Consider using the [Exploit Protection feature](/windows/threat-protection/windows-defender-exploit-guard/exploit-protection) as a replacement. See the [Announcing Windows 10 Insider Preview Build 16232 for PC + Build 15228 for Mobile](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/) for details. - -### Outlook Express - -Removed this non-functional code. - -### Reader app - -Integrated the Reader functionality into Microsoft Edge. - -### Reading list - -Integrated the Reading list functionality into Microsoft Edge. - -### Resilient File System (ReFS) - -We changed the way that ReFS works, based on the edition of Windows 10 you have. We didn't **remove** ReFS, but how you can use ReFS depends on your edition. - -If you have Windows 10 Enterprise or Windows 10 Pro for Workstations: You can create, read, and write volumes. - -If you have any other edition of Windows 10: You can read and write volumes, but you can't create volumes. If you need to create volumes, upgrade to the Enterprise or Pro for Workstations edition. - -### Syskey.exe - -Removed this security feature. Instead, we recommend using [BitLocker](/device-security/bitlocker/bitlocker-overview). For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). - -### TCP Offload Engine - -Removed this code. The TCP Offload Engine functionality is now available in the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) - -### TPM Owner Password Management - -Removed this code. - -## Features being considered for replacement starting after Windows Fall Creators Update - -We are considering removing the following features and functionalities from the installed product image, starting with releases after Windows 10, version 1709. Eventually, we might completely remove them and replace them with other features or functionality (or, in some instances, make them available from different sources). These features and functionalities are *still available* in this release, but **you should begin planning now to either use alternate methods or to replace any applications, code, or usage that depend on these features.** - -If you have feedback to share about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). - -### IIS 6 Management Compatibility - -We're considering replacing the following specific DISM features: - -- IIS 6 Metabase Compatibility (Web-Metabase) -- IIS 6 Management Console (Web-Lgcy-Mgmt-Console) -- IIS 6 Scripting Tools (Web-Lgcy-Scripting) -- IIS 6 WMI Compatibility (Web-WMI) - -Instead of IIS 6 Metabase Compatibility (which acts as an emulation layer between IIS 6-based metabase scripts and the file-based configuration used by IIS 7 or newer versions) you should start migrating management scripts to target IIS file-based configuration directly, by using tools such as the Microsoft.Web.Administration namespace. - -You should also start migration from IIS 6.0 or earlier versions, and move to the [latest version of IIS](/iis/get-started/whats-new-in-iis-10/new-features-introduced-in-iis-10). - -### IIS Digest Authentication - -We're considering removing the IIS Digest Authentication method. Instead, you should start using other authentication methods, such as [Client Certificate Mapping](/iis/manage/configuring-security/configuring-one-to-one-client-certificate-mappings) or [Windows Authentication](/iis/configuration/system.webServer/security/authentication/windowsAuthentication/). - -### Microsoft Paint - -We're considering removing MS Paint from the basic installed product image - that means it won't be installed by default. **You'll still be able to get the app separately from the [Microsoft Store](https://www.microsoft.com/store/b/home) for free.** Alternately, you can get [Paint 3D](https://www.microsoft.com/store/p/paint-3d/9nblggh5fv99) and [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) from the Microsoft Store today; both of these offer the same functionality as Microsoft Paint, plus additional features. - -### RSA/AES Encryption for IIS - -We're considering removing RSA/AES encryption because the superior [Cryptography API: Next Generation (CNG)](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx) method is already available. - -### Sync your settings - -We're considering making changes to the back-end storage that will affect the sync process: [Enterprise State Roaming](/azure/active-directory/active-directory-windows-enterprise-state-roaming-overview) and all other users will use a single cloud storage system. Both the "Sync your settings" options and the Enterprise State Roaming feature will continue to work. diff --git a/windows/deployment/planning/windows-10-infrastructure-requirements.md b/windows/deployment/planning/windows-10-infrastructure-requirements.md index b5615f4412..ccc6b27193 100644 --- a/windows/deployment/planning/windows-10-infrastructure-requirements.md +++ b/windows/deployment/planning/windows-10-infrastructure-requirements.md @@ -26,38 +26,24 @@ There are specific infrastructure requirements to deploy and manage Windows 10 ## High-level requirements - For initial Windows 10 deployments, as well as subsequent Windows 10 upgrades, ensure that sufficient disk space is available for distribution of the Windows 10 installation files (about 3 GB for Windows 10 x64 images, slightly smaller for x86). Also, be sure to take into account the network impact of moving these large images to each PC; you may need to leverage local server storage. For persistent VDI environments, carefully consider the I/O impact from upgrading large numbers of PCs in a short period of time. Ensure that upgrades are performed in smaller numbers, or during off-peak time periods. (For pooled VDI environments, a better approach is to replace the base image with a new version.) ## Deployment tools - -A new version of the Assessment and Deployment Toolkit (ADK) has been released to support Windows 10. This new version, available for download [here](https://go.microsoft.com/fwlink/p/?LinkId=526740), is required for Windows 10; you should not use earlier versions of the ADK to deploy Windows 10. It also supports the deployment of Windows 7, Windows 8, and Windows 8.1. +The latest version of the Windows Assessment and Deployment Toolkit (ADK) is available for download [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install). Significant enhancements in the ADK for Windows 10 include new runtime provisioning capabilities, which leverage the Windows Imaging and Configuration Designer (Windows ICD), as well as updated versions of existing deployment tools (DISM, USMT, Windows PE, and more). -Microsoft Deployment Toolkit 2013 Update 1, available for download [here](https://go.microsoft.com/fwlink/p/?LinkId=625079), has also been updated to support Windows 10 and the new ADK; older versions do not support Windows 10. New in this release is task sequence support for Windows 10 in-place upgrades. +The latest version of the Microsoft Deployment Toolkit (MDT) is available for download [here](https://docs.microsoft.com/mem/configmgr/mdt/release-notes). -For System Center Configuration Manager, Windows 10 support is offered with various releases: +For Configuration Manager, Windows 10 version specific support is offered with [various releases](https://docs.microsoft.com/mem/configmgr/core/plan-design/configs/support-for-windows-10). -| Release | Windows 10 management? | Windows 10 deployment? | -|---------------------------------------------|------------------------|------------------------------------------------| -| System Center Configuration Manager 2007 | Yes, with a hotfix | No | -| System Center Configuration Manager 2012 | Yes, with SP2 and CU1 | Yes, with SP2, CU1, and the ADK for Windows 10 | -| System Center Configuration Manager 2012 R2 | Yes, with SP1 and CU1 | Yes, with SP1, CU1, and the ADK for Windows 10 | - - -> [!NOTE] -> Configuration Manager 2012 supports Windows 10 version 1507 (build 10.0.10240) and 1511 (build 10.0.10586) for the lifecycle of these builds. Future releases of Windows 10 CB/CBB are not supported With Configuration Manager 2012, and will require Microsoft Endpoint Configuration Manager current branch for supported management. -  - -For more details about Microsoft Endpoint Configuration Manager support for Windows 10, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). +For more details about Microsoft Endpoint Manager support for Windows 10, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). ## Management tools - In addition to Microsoft Endpoint Configuration Manager, Windows 10 also leverages other tools for management. For Windows Server and Active Directory, existing supported versions are fully supported for Windows 10. New Group Policy templates will be needed to configure new settings available in Windows 10; these templates are available in the Windows 10 media images, and are available as a separate download [here](https://go.microsoft.com/fwlink/p/?LinkId=625081). See [Group Policy settings reference](https://go.microsoft.com/fwlink/p/?LinkId=625082) for a list of the new and modified policy settings. If you are using a central policy store, follow the steps outlined [here](https://go.microsoft.com/fwlink/p/?LinkId=625083) to update the ADMX files stored in that central store. No new Active Directory schema updates or specific functional levels are currently required for core Windows 10 product functionality, although subsequent upgrades could require these to support new features. @@ -72,8 +58,6 @@ Microsoft Desktop Optimization Pack (MDOP) has been updated to support Windows  | Microsoft BitLocker Administration and Monitoring (MBAM) | MBAM 2.5 SP1 (2.5 is OK) | | User Experience Virtualization (UE-V) | UE-V 2.1 SP1 | -  - For more information, see the [MDOP TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=625090). For devices you manage with mobile device management (MDM) solutions such as Microsoft Intune, existing capabilities (provided initially in Windows 8.1) are fully supported in Windows 10; new Windows 10 MDM settings and capabilities will require updates to the MDM services. See [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=625084) for more information. @@ -81,20 +65,17 @@ For devices you manage with mobile device management (MDM) solutions such as Mic Windows Server Update Services (WSUS) requires some additional configuration to receive updates for Windows 10. Use the Windows Server Update Services admin tool and follow these instructions: 1. Select the **Options** node, and then click **Products and Classifications**. - 2. In the **Products** tree, select the **Windows 10** and **Windows 10 LTSB** products and any other Windows 10-related items that you want. Click **OK**. - 3. From the **Synchronizations** node, right-click and choose **Synchronize Now**. ![figure 1](images/fig4-wsuslist.png) -Figure 1. WSUS product list with Windows 10 choices +WSUS product list with Windows 10 choices Because Windows 10 updates are cumulative in nature, each month’s new update will supersede the previous month's. Consider leveraging “express installation” packages to reduce the size of the payload that needs to be sent to each PC each month; see [Express installation files](https://go.microsoft.com/fwlink/p/?LinkId=625086) for more information. (Note that this will increase the amount of disk storage needed by WSUS, and impacts all operating systems being managed with WSUS.) ## Activation - Windows 10 volume license editions of Windows 10 will continue to support all existing activation methods (KMS, MAK, and AD-based activation). An update will be required for existing KMS servers: | Product | Required update | @@ -104,26 +85,21 @@ Windows 10 volume license editions of Windows 10 will continue to support all | Windows Server 2012 and Windows 8 | [https://support.microsoft.com/kb/3058168](https://go.microsoft.com/fwlink/p/?LinkId=625087) | | Windows Server 2008 R2 and Windows 7 | [https://support.microsoft.com/kb/3079821](https://support.microsoft.com/kb/3079821) | -  - Also see: [Windows Server 2016 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2016/10/19/windows-server-2016-volume-activation-tips/) Additionally, new product keys will be needed for all types of volume license activation (KMS, MAK, and AD-based Activation); these keys are available on the Volume Licensing Service Center (VLSC) for customers with rights to the Windows 10 operating system. To find the needed keys: - Sign into the [Volume Licensing Service Center (VLSC)](https://go.microsoft.com/fwlink/p/?LinkId=625088) at with a Microsoft account that has appropriate rights. - - For KMS keys, click **Licenses** and then select **Relationship Summary**. Click the appropriate active license ID, and then select **Product Keys** near the right side of the page. For KMS running on Windows Server, find the **Windows Srv 2012R2 DataCtr/Std KMS for Windows 10** product key; for KMS running on client operating systems, find the **Windows 10** product key. - - For MAK keys, click **Downloads and Keys**, and then filter the list by using **Windows 10** as a product. Click the **Key** link next to an appropriate list entry (for example, **Windows 10 Enterprise** or **Windows 10 Enterprise LTSB**) to view the available MAK keys. (You can also find keys for KMS running on Windows 10 in this list. These keys will not work on Windows servers running KMS.) -Note that Windows 10 Enterprise and Windows 10 Enterprise LTSB installations use different MAK keys. But you can use the same KMS server or Active Directory-based activation environment for both; the KMS keys obtained from the Volume Licensing Service Center will work with both. +Note that Windows 10 Enterprise and Windows 10 Enterprise LTSC installations use different MAK keys. But you can use the same KMS server or Active Directory-based activation environment for both; the KMS keys obtained from the Volume Licensing Service Center will work with both. ## Related topics - -[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md) -
        [Windows 10 deployment considerations](windows-10-deployment-considerations.md) -
        [Windows 10 compatibility](windows-10-compatibility.md) +[Windows 10 servicing options](../update/waas-servicing-strategy-windows-10-updates.md)
        +[Windows 10 deployment considerations](windows-10-deployment-considerations.md)
        +[Windows 10 compatibility](windows-10-compatibility.md)
          diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md index 1c93c41731..edeeaeec27 100644 --- a/windows/deployment/planning/windows-10-removed-features.md +++ b/windows/deployment/planning/windows-10-removed-features.md @@ -1,6 +1,6 @@ --- title: Windows 10 - Features that have been removed -description: Learn about features and functionality that has been removed or replaced in Windows 10 +description: In this article, learn about the features and functionality that have been removed or replaced in Windows 10. ms.prod: w10 ms.mktglfcycl: plan ms.localizationpriority: medium @@ -10,6 +10,7 @@ author: greg-lindsay ms.author: greglin manager: laurawi ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Features and functionality removed in Windows 10 @@ -27,6 +28,12 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | +|MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. Metadata for the MBAE service is removed. | 20H2 | +| Connect app | The **Connect** app for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 | +| Rinna and Japanese Address suggestion | The Rinna and Japanese Address suggestion service for Microsoft Japanese Input Method Editor (IME) ended on August 13th, 2020. For more information, see [Rinna and Japanese Address suggestion will no longer be offered](https://support.microsoft.com/help/4576767/windows-10-rinna-and-japanese-address-suggestion) | 2004 | +| Cortana | Cortana has been updated and enhanced in the Windows 10 May 2020 Update. With [these changes](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-2004#cortana), some previously available consumer skills such as music, connected home, and other non-Microsoft skills are no longer available. | 2004 | +| Windows To Go | Windows To Go was announced as deprecated in Windows 10, version 1903 and is removed in this release. | 2004 | +| Mobile Plans and Messaging apps | Both apps are still supported, but are now distributed in a different way. OEMs can now include these apps in Windows images for cellular enabled devices. The apps are removed for non-cellular devices.| 2004 | | PNRP APIs| ​The Peer Name Resolution Protocol (PNRP) cloud service was removed in Windows 10, version 1809. We are planning to complete the removal process by removing the corresponding APIs. | 1909 | | Taskbar settings roaming | Roaming of taskbar settings is removed in this release. This feature was announced as no longer being developed in Windows 10, version 1903. | 1909 | | Desktop messaging app doesn't offer messages sync | The messaging app on Desktop has a sync feature that can be used to sync SMS text messages received from Windows Mobile and keep a copy of them on the Desktop. The sync feature has been removed from all devices. Due to this change, you will only be able to access messages from the device that received the message. | 1903 | @@ -36,9 +43,9 @@ The following features and functionalities have been removed from the installed |limpet.exe|We're releasing the limpet.exe tool, used to access TPM for Azure connectivity, as open source.| 1809 | |Phone Companion|When you update to Windows 10, version 1809, the Phone Companion app will be removed from your PC. Use the **Phone** page in the Settings app to sync your mobile phone with your PC. It includes all the Phone Companion features.| 1809 | |Future updates through [Windows Embedded Developer Update](https://docs.microsoft.com/previous-versions/windows/embedded/ff770079\(v=winembedded.60\)) for Windows Embedded Standard 7-SP1 (WES7-SP1) and Windows Embedded Standard 8 (WES8)|We’re no longer publishing new updates to the WEDU server. Instead, you may secure any new updates from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). [Learn how](https://techcommunity.microsoft.com/t5/Windows-Embedded/Change-to-the-Windows-Embedded-Developer-Update/ba-p/285704) to get updates from the catalog.| 1809 | -|Groove Music Pass|[We ended the Groove streaming music service and music track sales through the Microsoft Store in 2017](https://support.microsoft.com/help/4046109/groove-music-and-spotify-faq). The Groove app is being updated to reflect this change. You can still use Groove Music to play the music on your PC or to stream music from OneDrive. You can use Spotify or other music services to stream music on Windows 10, or to buy music to own.| 1803 | +|Groove Music Pass|[We ended the Groove streaming music service and music track sales through the Microsoft Store in 2017](https://support.microsoft.com/help/4046109/groove-music-and-spotify-faq). The Groove app is being updated to reflect this change. You can still use Groove Music to play the music on your PC. You can use Spotify or other music services to stream music on Windows 10, or to buy music to own.| 1803 | |People - Suggestions will no longer include unsaved contacts for non-Microsoft accounts|Manually save the contact details for people you send mail to or get mail from.| 1803 | -|Language control in the Control Panel| Use the Settings app to change your language settings.| 1803 | +|Language control in the Control Panel| Use the Settings app to change your language settings.| 1803 | |HomeGroup|We are removing [HomeGroup](https://support.microsoft.com/help/17145) but not your ability to share printers, files, and folders.

        When you update to Windows 10, version 1803, you won't see HomeGroup in File Explorer, the Control Panel, or Troubleshoot (**Settings > Update & Security > Troubleshoot**). Any printers, files, and folders that you shared using HomeGroup **will continue to be shared**.

        Instead of using HomeGroup, you can now share printers, files and folders by using features that are built into Windows 10:
        - [Share your network printer](https://www.bing.com/search?q=share+printer+windows+10)
        - [Share files in File Explorer](https://support.microsoft.com/help/4027674/windows-10-share-files-in-file-explorer) | 1803 | |**Connect to suggested open hotspots** option in Wi-Fi settings |We previously [disabled the **Connect to suggested open hotspots** option](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) and are now removing it from the Wi-Fi settings page. You can manually connect to free wireless hotspots with **Network & Internet** settings, from the taskbar or Control Panel, or by using Wi-Fi Settings (for mobile devices).| 1803 | |XPS Viewer|We're changing the way you get XPS Viewer. In Windows 10, version 1709 and earlier versions, the app is included in the installation image. If you have XPS Viewer and you update to Windows 10, version 1803, there's no action required. You'll still have XPS Viewer.

        However, if you install Windows 10, version 1803, on a new device (or as a clean installation), you may need to [install XPS Viewer from **Apps and Features** in the Settings app](https://docs.microsoft.com/windows/application-management/add-apps-and-features) or through [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you had XPS Viewer in Windows 10, version 1709, but manually removed it before updating, you'll need to manually reinstall it.| 1803 | diff --git a/windows/deployment/planning/windows-to-go-frequently-asked-questions.md b/windows/deployment/planning/windows-to-go-frequently-asked-questions.md index 77f7cfe31a..f0c41844f7 100644 --- a/windows/deployment/planning/windows-to-go-frequently-asked-questions.md +++ b/windows/deployment/planning/windows-to-go-frequently-asked-questions.md @@ -1,6 +1,6 @@ --- title: Windows To Go frequently asked questions (Windows 10) -description: Windows To Go frequently asked questions +description: Though Windows To Go is no longer being developed, these frequently asked questions (FAQ) can provide answers about the feature. ms.assetid: bfdfb824-4a19-4401-b369-22c5e6ca9d6e ms.reviewer: manager: laurawi @@ -22,8 +22,8 @@ ms.topic: article - Windows 10 ->[!IMPORTANT] ->Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. +> [!IMPORTANT] +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. The following list identifies some commonly asked questions about Windows To Go. @@ -49,13 +49,13 @@ The following list identifies some commonly asked questions about Windows To Go. - [How do I make my computer boot from USB?](#wtf-faq-startup) -- [Why isn’t my computer booting from USB?](#wtg-faq-noboot) +- [Why isn't my computer booting from USB?](#wtg-faq-noboot) - [What happens if I remove my Windows To Go drive while it is running?](#wtg-faq-surprise) - [Can I use BitLocker to protect my Windows To Go drive?](#wtg-faq-bitlocker) -- [Why can’t I enable BitLocker from Windows To Go Creator?](#wtg-faq-blfail) +- [Why can't I enable BitLocker from Windows To Go Creator?](#wtg-faq-blfail) - [What power states does Windows To Go support?](#wtg-faq-power) @@ -63,11 +63,11 @@ The following list identifies some commonly asked questions about Windows To Go. - [Does Windows To Go support crash dump analysis?](#wtg-faq-crashdump) -- [Do “Windows To Go Startup Options” work with dual boot computers?](#wtg-faq-dualboot) +- [Do "Windows To Go Startup Options" work with dual boot computers?](#wtg-faq-dualboot) -- [I plugged my Windows To Go drive into a running computer and I can’t see the partitions on the drive. Why not?](#wtg-faq-diskpart) +- [I plugged my Windows To Go drive into a running computer and I can't see the partitions on the drive. Why not?](#wtg-faq-diskpart) -- [I’m booted into Windows To Go, but I can’t browse to the internal hard drive of the host computer. Why not?](#wtg-faq-san4) +- [I'm booted into Windows To Go, but I can't browse to the internal hard drive of the host computer. Why not?](#wtg-faq-san4) - [Why does my Windows To Go drive have an MBR disk format with a FAT32 system partition?](#wtg-faq-fatmbr) @@ -95,17 +95,17 @@ The following list identifies some commonly asked questions about Windows To Go. - [How is Windows To Go licensed?](#wtg-faq-lic) -- [Does Windows Recovery Environment work with Windows To Go? What’s the guidance for recovering a Windows To Go drive?](#wtg-faq-recovery) +- [Does Windows Recovery Environment work with Windows To Go? What's the guidance for recovering a Windows To Go drive?](#wtg-faq-recovery) -- [Why won’t Windows To Go work on a computer running Windows XP or Windows Vista?](#wtg-faq-oldos) +- [Why won't Windows To Go work on a computer running Windows XP or Windows Vista?](#wtg-faq-oldos) - [Why does the operating system on the host computer matter?](#wtg-faq-oldos2) - [My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go?](#wtg-faq-blreckey) -- [I decided to stop using a drive for Windows To Go and reformatted it – why doesn’t it have a drive letter assigned and how can I fix it?](#wtg-faq-reformat) +- [I decided to stop using a drive for Windows To Go and reformatted it – why doesn't it have a drive letter assigned and how can I fix it?](#wtg-faq-reformat) -- [Why do I keep on getting the message “Installing devices…” when I boot Windows To Go?](#bkmk-roamconflict) +- [Why do I keep on getting the message "Installing devices…" when I boot Windows To Go?](#bkmk-roamconflict) - [How do I upgrade the operating system on my Windows To Go drive?](#bkmk-upgradewtg) @@ -188,7 +188,7 @@ In the **Windows To Go Startup Options** dialog box select **Yes** and then clic If the host computer is running an earlier version of the Windows operating system need to configure the computer to boot from USB manually. -To do this, early during boot time (usually when you see the manufacturer’s logo), enter your firmware/BIOS setup. (This method to enter firmware/BIOS setup differs with different computer manufacturers, but is usually entered by pressing one of the function keys, such as F12, F2, F1, Esc, and so forth. You should check the manufacturer’s site to be sure if you do not know which key to use to enter firmware setup.) +To do this, early during boot time (usually when you see the manufacturer's logo), enter your firmware/BIOS setup. (This method to enter firmware/BIOS setup differs with different computer manufacturers, but is usually entered by pressing one of the function keys, such as F12, F2, F1, Esc, and so forth. You should check the manufacturer's site to be sure if you do not know which key to use to enter firmware setup.) After you have entered firmware setup, make sure that boot from USB is enabled. Then change the boot order to boot from USB drives first. @@ -201,14 +201,14 @@ Configuring a computer to boot from USB will cause your computer to attempt to b -## Why isn’t my computer booting from USB? +## Why isn't my computer booting from USB? Computers certified for Windows 7 and later are required to have support for USB boot. Check to see if any of the following items apply to your situation: 1. Ensure that your computer has the latest BIOS installed and the BIOS is configured to boot from a USB device. -2. Ensure that the Windows To Go drive is connected directly to a USB port on the computer. Many computers don’t support booting from a device connected to a USB 3 PCI add-on card or external USB hubs. +2. Ensure that the Windows To Go drive is connected directly to a USB port on the computer. Many computers don't support booting from a device connected to a USB 3 PCI add-on card or external USB hubs. 3. If the computer is not booting from a USB 3.0 port, try to boot from a USB 2.0 port. @@ -229,7 +229,7 @@ You should never remove your Windows To Go drive when your workspace is running. Yes. In Windows 8 and later, BitLocker has added support for using a password to protect operating system drives. This means that you can use a password to secure your Windows To Go workspace and you will be prompted to enter this password every time you use the Windows To Go workspace. -## Why can’t I enable BitLocker from Windows To Go Creator? +## Why can't I enable BitLocker from Windows To Go Creator? Several different Group Policies control the use of BitLocker on your organizations computers. These policies are located in the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** folder of the local Group Policy editor. The folder contains three sub-folders for fixed, operating system and removable data drive types. @@ -265,27 +265,27 @@ When a Windows To Go workspace is hibernated, it will only successfully resume o Yes. Windows 8 and later support crash dump stack analysis for both USB 2.0 and 3.0. -## Do “Windows To Go Startup Options” work with dual boot computers? +## Do "Windows To Go Startup Options" work with dual boot computers? -Yes, if both operating systems are running the Windows 8 operating system. Enabling “Windows To Go Startup Options” should cause the computer to boot from the Windows To Go workspace when the drive is plugged in before the computer is turned on. +Yes, if both operating systems are running the Windows 8 operating system. Enabling "Windows To Go Startup Options" should cause the computer to boot from the Windows To Go workspace when the drive is plugged in before the computer is turned on. If you have configured a dual boot computer with a Windows operating system and another operating system it might work occasionally and fail occasionally. Using this configuration is unsupported. -## I plugged my Windows To Go drive into a running computer and I can’t see the partitions on the drive. Why not? +## I plugged my Windows To Go drive into a running computer and I can't see the partitions on the drive. Why not? -Windows To Go Creator and the recommended deployment steps for Windows To Go set the NO\_DEFAULT\_DRIVE\_LETTER flag on the Windows To Go drive. This flag prevents Windows from automatically assigning drive letters to the partitions on the Windows To Go drive. That’s why you can’t see the partitions on the drive when you plug your Windows To Go drive into a running computer. This helps prevent accidental data leakage between the Windows To Go drive and the host computer. If you really need to access the files on the Windows To Go drive from a running computer, you can use diskmgmt.msc or diskpart to assign a drive letter. +Windows To Go Creator and the recommended deployment steps for Windows To Go set the NO\_DEFAULT\_DRIVE\_LETTER flag on the Windows To Go drive. This flag prevents Windows from automatically assigning drive letters to the partitions on the Windows To Go drive. That's why you can't see the partitions on the drive when you plug your Windows To Go drive into a running computer. This helps prevent accidental data leakage between the Windows To Go drive and the host computer. If you really need to access the files on the Windows To Go drive from a running computer, you can use diskmgmt.msc or diskpart to assign a drive letter. **Warning**   It is strongly recommended that you do not plug your Windows To Go drive into a running computer. If the computer is compromised, your Windows To Go workspace can also be compromised. -## I’m booted into Windows To Go, but I can’t browse to the internal hard drive of the host computer. Why not? +## I'm booted into Windows To Go, but I can't browse to the internal hard drive of the host computer. Why not? -Windows To Go Creator and the recommended deployment steps for Windows To Go set SAN Policy 4 on Windows To Go drive. This policy prevents Windows from automatically mounting internal disk drives. That’s why you can’t see the internal hard drives of the host computer when you are booted into Windows To Go. This is done to prevent accidental data leakage between Windows To Go and the host system. This policy also prevents potential corruption on the host drives or data loss if the host operating system is in a hibernation state. If you really need to access the files on the internal hard drive, you can use diskmgmt.msc to mount the internal drive. +Windows To Go Creator and the recommended deployment steps for Windows To Go set SAN Policy 4 on Windows To Go drive. This policy prevents Windows from automatically mounting internal disk drives. That's why you can't see the internal hard drives of the host computer when you are booted into Windows To Go. This is done to prevent accidental data leakage between Windows To Go and the host system. This policy also prevents potential corruption on the host drives or data loss if the host operating system is in a hibernation state. If you really need to access the files on the internal hard drive, you can use diskmgmt.msc to mount the internal drive. **Warning**   It is strongly recommended that you do not mount internal hard drives when booted into the Windows To Go workspace. If the internal drive contains a hibernated Windows 8 or later operating system, mounting the drive will lead to loss of hibernation state and therefor user state or any unsaved user data when the host operating system is booted. If the internal drive contains a hibernated Windows 7 or earlier operating system, mounting the drive will lead to corruption when the host operating system is booted. @@ -340,7 +340,7 @@ If you are using a USB 3.0 port and a Windows To Go certified device, there shou ## If I lose my Windows To Go drive, will my data be safe? -Yes! If you enable BitLocker on your Windows To Go drive, all your data will be encrypted and protected and a malicious user will not be able to access your data without your password. If you don’t enable BitLocker, your data will be vulnerable if you lose your Windows To Go drive. +Yes! If you enable BitLocker on your Windows To Go drive, all your data will be encrypted and protected and a malicious user will not be able to access your data without your password. If you don't enable BitLocker, your data will be vulnerable if you lose your Windows To Go drive. ## Can I boot Windows To Go on a Mac? @@ -361,12 +361,12 @@ For more information, see the MSDN article on the [Win32\_OperatingSystem class] Windows To Go allows organization to support the use of privately owned PCs at the home or office with more secure access to their organizational resources. With Windows To Go use rights under [Software Assurance](https://go.microsoft.com/fwlink/p/?LinkId=619062), an employee will be able to use Windows To Go on any company PC licensed with Software Assurance as well as from their home PC. -## Does Windows Recovery Environment work with Windows To Go? What’s the guidance for recovering a Windows To Go drive? +## Does Windows Recovery Environment work with Windows To Go? What's the guidance for recovering a Windows To Go drive? No, use of Windows Recovery Environment is not supported on Windows To Go. It is recommended that you implement user state virtualization technologies like Folder Redirection to centralize and back up user data in the data center. If any corruption occurs on a Windows To Go drive, you should re-provision the workspace. -## Why won’t Windows To Go work on a computer running Windows XP or Windows Vista? +## Why won't Windows To Go work on a computer running Windows XP or Windows Vista? Actually it might. If you have purchased a computer certified for Windows 7 or later and then installed an older operating system, Windows To Go will boot and run as expected as long as you have configured the firmware to boot from USB. However, if the computer was certified for Windows XP or Windows Vista, it might not meet the hardware requirements for Windows To Go to run. Typically computers certified for Windows Vista and earlier operating systems have less memory, less processing power, reduced video rendering, and slower USB ports. @@ -374,7 +374,7 @@ Actually it might. If you have purchased a computer certified for Windows 7 or ## Why does the operating system on the host computer matter? -It doesn’t other than to help visually identify if the PC has compatible hardware. For a PC to be certified for Windows 7 or later it had to support booting from USB. If a computer cannot boot from USB there is no way that it can be used with Windows To Go. The Windows To Go workspace is a full Windows 10 environment, so all of the hardware requirements of Windows 10 with respect to processing speed, memory usage, and graphics rendering need to be supported to be assured that it will work as expected. +It doesn't other than to help visually identify if the PC has compatible hardware. For a PC to be certified for Windows 7 or later it had to support booting from USB. If a computer cannot boot from USB there is no way that it can be used with Windows To Go. The Windows To Go workspace is a full Windows 10 environment, so all of the hardware requirements of Windows 10 with respect to processing speed, memory usage, and graphics rendering need to be supported to be assured that it will work as expected. ## My host computer running Windows 7 is protected by BitLocker Drive Encryption. Why did I need to use the recovery key to unlock and reboot my host computer after using Windows To Go? @@ -406,10 +406,10 @@ The host computer will now be able to be booted from a USB drive without trigger -## I decided to stop using a drive for Windows To Go and reformatted it – why doesn’t it have a drive letter assigned and how can I fix it? +## I decided to stop using a drive for Windows To Go and reformatted it – why doesn't it have a drive letter assigned and how can I fix it? -Reformatting the drive erases the data on the drive, but doesn’t reconfigure the volume attributes. When a drive is provisioned for use as a Windows To Go drive the NODEFAULTDRIVELETTER attribute is set on the volume. To remove this attribute, use the following steps: +Reformatting the drive erases the data on the drive, but doesn't reconfigure the volume attributes. When a drive is provisioned for use as a Windows To Go drive the NODEFAULTDRIVELETTER attribute is set on the volume. To remove this attribute, use the following steps: 1. Open a command prompt with full administrator permissions. @@ -424,14 +424,14 @@ Reformatting the drive erases the data on the drive, but doesn’t reconfigure t 4. After selecting the disk, run the `clean` command to remove all data, formatting, and initialization information from the drive. -## Why do I keep on getting the message “Installing devices…” when I boot Windows To Go? +## Why do I keep on getting the message "Installing devices…" when I boot Windows To Go? One of the challenges involved in moving the Windows To Go drive between PCs while seamlessly booting Windows with access to all of their applications and data is that for Windows to be fully functional, specific drivers need to be installed for the hardware in each machine that runs Windows. Windows 8 or later has a process called respecialize which will identify new drivers that need to be loaded for the new PC and disable drivers which are not present on the new configuration. In general this feature is reliable and efficient when roaming between PCs of widely varying hardware configurations. -In certain cases, third party drivers for different hardware models or versions can reuse device ID’s, driver file names, registry keys (or any other operating system constructs which do not support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID’s, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver. +In certain cases, third party drivers for different hardware models or versions can reuse device ID's, driver file names, registry keys (or any other operating system constructs which do not support side-by-side storage) for similar hardware. For example, Touchpad drivers on different laptops often reuse the same device ID's, and video cards from the same manufacturer may often reuse service names. Windows handles these situations by marking the non-present device node with a flag that indicates the existing driver needs to be reinstalled before continuing to install the new driver. -This process will occur on any boot that a new driver is found and a driver conflict is detected. In some cases that will result in a respecialize progress message “Installing devices…” displaying every time that a Windows to Go drive is roamed between two PCs which require conflicting drivers. +This process will occur on any boot that a new driver is found and a driver conflict is detected. In some cases that will result in a respecialize progress message "Installing devices…" displaying every time that a Windows to Go drive is roamed between two PCs which require conflicting drivers. ## How do I upgrade the operating system on my Windows To Go drive? diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md index 23fefc02cd..c978295e6e 100644 --- a/windows/deployment/planning/windows-to-go-overview.md +++ b/windows/deployment/planning/windows-to-go-overview.md @@ -23,7 +23,7 @@ ms.topic: article - Windows 10 > [!IMPORTANT] -> Windows To Go is no longer being developed. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. +> Windows To Go is removed in Windows 10, version 2004 and later operating systems. The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs. Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. diff --git a/windows/deployment/s-mode.md b/windows/deployment/s-mode.md index 3d5adb42f4..ea76222dde 100644 --- a/windows/deployment/s-mode.md +++ b/windows/deployment/s-mode.md @@ -1,50 +1,52 @@ --- title: Windows 10 Pro in S mode -description: Overview of Windows 10 Pro/Enterprise in S mode. What is S mode for Enterprise customers? +description: Overview of Windows 10 Pro/Enterprise in S mode. What is S mode for Enterprise customers? keywords: Windows 10 S, S mode, Windows S mode, Windows 10 S mode, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Enterprise in S mode, Windows 10 Pro/Enterprise in S mode ms.mktglfcycl: deploy ms.localizationpriority: medium ms.prod: w10 ms.sitesec: library ms.pagetype: deploy -ms.date: 12/05/2018 ms.reviewer: manager: laurawi ms.audience: itpro author: greg-lindsay +ms.author: greglin audience: itpro -author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Windows 10 in S mode - What is it? -S mode is an evolution of the S SKU introduced with Windows 10 April 2018 Update. It's a configuration that's available on all Windows Editions when enabled at the time of manufacturing. The edition of Windows can be upgrade at any time as shown below. However, the switch from S mode is a onetime switch and can only be undone by a wipe and reload of the OS. + +S mode is an evolution of the S SKU introduced with Windows 10 April 2018 Update. It's a configuration that's available on all Windows Editions when enabled at the time of manufacturing. The edition of Windows can be upgrade at any time as shown below. However, the switch from S mode is a onetime switch and can only be undone by a wipe and reload of the OS. ![Configuration and features of S mode](images/smodeconfig.png) ## S mode key features + **Microsoft-verified security** -With Windows 10 in S mode, you’ll find your favorite applications, such as Office, Evernote, and Spotify in the Microsoft Store where they’re Microsoft-verified for security. You can also feel secure when you’re online. Microsoft Edge, your default browser, gives you protection against phishing and socially engineered malware. +With Windows 10 in S mode, you’ll find your favorite applications, such as Office, Evernote, and Spotify in the Microsoft Store where they’re Microsoft-verified for security. You can also feel secure when you’re online. Microsoft Edge, your default browser, gives you protection against phishing and socially engineered malware. **Performance that lasts** -Start-ups are quick, and S mode is built to keep them that way. With Microsoft Edge as your browser, your online experience is fast and secure. Plus, you’ll enjoy a smooth, responsive experience, whether you’re streaming HD video, opening apps, or being productive on the go. +Start-ups are quick, and S mode is built to keep them that way. With Microsoft Edge as your browser, your online experience is fast and secure. Plus, you’ll enjoy a smooth, responsive experience, whether you’re streaming HD video, opening apps, or being productive on the go. **Choice and flexibility** -Save your files to your favorite cloud, like OneDrive or Dropbox, and access them from any device you choose. Browse the Microsoft Store for thousands of apps, and if you don’t find exactly what you want, you can easily [switch out of S mode](https://docs.microsoft.com/windows/deployment/windows-10-pro-in-s-mode) to Windows 10 Home, Pro, or Enterprise editions at any time and search the web for more choices, as shown below. +Save your files to your favorite cloud, like OneDrive or Dropbox, and access them from any device you choose. Browse the Microsoft Store for thousands of apps, and if you don’t find exactly what you want, you can easily [switch out of S mode](https://docs.microsoft.com/windows/deployment/windows-10-pro-in-s-mode) to Windows 10 Home, Pro, or Enterprise editions at any time and search the web for more choices, as shown below. ![Switching out of S mode flow chart](images/s-mode-flow-chart.png) ## Deployment -Windows 10 in S mode is built for [modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management) which means using [Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot). Windows Autopilot lets you deploy the device directly to a user without IT having to touch the physical device. Instead of manually deploying a custom image, Windows Autopilot will start with a generic PC that can only be used to join the company domain; policies are then deployed automatically through mobile device management to customize the device to the user and the desired environment. Devices are shipped in S mode; you can either keep them in S mode or use Windows Autopilot to switch the device out of S mode during the first run process or later using mobile device management, if desired. +Windows 10 in S mode is built for [modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management) which means using [Windows Autopilot](windows-autopilot/windows-autopilot.md). Windows Autopilot lets you deploy the device directly to a user without IT having to touch the physical device. Instead of manually deploying a custom image, Windows Autopilot will start with a generic PC that can only be used to join the company domain; policies are then deployed automatically through mobile device management to customize the device to the user and the desired environment. Devices are shipped in S mode; you can either keep them in S mode or use Windows Autopilot to switch the device out of S mode during the first run process or later using mobile device management, if desired. ## Keep line of business apps functioning with Desktop Bridge -Worried about your line of business apps not working in S mode? [Desktop Bridge](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-root) enables you to convert your line of business apps to a packaged app with UWP manifest. After testing and validating you can distribute the app through the Microsoft Store, making it ideal for Windows 10 in S mode. +Worried about your line of business apps not working in S mode? [Desktop Bridge](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-root) enables you to convert your line of business apps to a packaged app with UWP manifest. After testing and validating you can distribute the app through the Microsoft Store, making it ideal for Windows 10 in S mode. ## Repackage Win32 apps into the MSIX format @@ -54,6 +56,6 @@ The [MSIX Packaging Tool](https://docs.microsoft.com/windows/application-managem ## Related links - [Consumer applications for S mode](https://www.microsoft.com/windows/s-mode) -- [S mode devices](https://www.microsoft.com/windows/view-all-devices) +- [S mode devices](https://www.microsoft.com/en-us/windows/view-all-devices) - [Windows Defender Application Control deployment guide](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) -- [Windows Defender Advanced Threat Protection](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) +- [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) diff --git a/windows/deployment/update/PSFxWhitepaper.md b/windows/deployment/update/PSFxWhitepaper.md index 8f73fcdfd0..4a6d9ab0f1 100644 --- a/windows/deployment/update/PSFxWhitepaper.md +++ b/windows/deployment/update/PSFxWhitepaper.md @@ -12,6 +12,7 @@ ms.author: jaimeo ms.reviewer: manager: laurawi ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Windows Updates using forward and reverse differentials @@ -37,8 +38,6 @@ The following general terms apply throughout this document: - *Revision*: Minor releases in between the major version releases, such as KB4464330 (Windows 10 Build 17763.55) - *Baseless Patch Storage Files (Baseless PSF)*: Patch storage files that contain full binaries or files -## Introduction - In this paper, we introduce a new technique that can produce compact software updates optimized for any origin/destination revision pair. It does this by calculating forward the differential of a changed file from the base version and diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md index 3534c08c5c..4a1087d274 100644 --- a/windows/deployment/update/WIP4Biz-intro.md +++ b/windows/deployment/update/WIP4Biz-intro.md @@ -1,15 +1,14 @@ --- title: Introduction to the Windows Insider Program for Business -description: Introduction to the Windows Insider Program for Business and why IT Pros should join +description: In this article, you'll learn about the Windows Insider Program for Business and why IT Pros should join. keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight +ms.custom: seo-marvel-apr2020 ms.prod: w10 ms.mktglfcycl: manage audience: itpro itproauthor: jaimeo author: jaimeo -ms.localizationprioauthor: jaimeo ms.audience: itpro -author: jaimeo ms.reviewer: manager: laurawi ms.topic: article diff --git a/windows/deployment/update/change-history-for-update-windows-10.md b/windows/deployment/update/change-history-for-update-windows-10.md index 99bb88d5a4..fc8013e00c 100644 --- a/windows/deployment/update/change-history-for-update-windows-10.md +++ b/windows/deployment/update/change-history-for-update-windows-10.md @@ -4,7 +4,6 @@ description: This topic lists new and updated topics in the Update Windows 10 do ms.prod: w10 ms.mktglfcycl: manage audience: itpro -itproauthor: jaimeo author: jaimeo ms.author: jaimeo ms.reviewer: diff --git a/windows/deployment/update/create-deployment-plan.md b/windows/deployment/update/create-deployment-plan.md new file mode 100644 index 0000000000..a1ce6bbe19 --- /dev/null +++ b/windows/deployment/update/create-deployment-plan.md @@ -0,0 +1,138 @@ +--- +title: Create a deployment plan +description: Devise the number of deployment rings you need and how you want to populate them +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.collection: m365initiative-coredeploy +manager: laurawi +ms.topic: article +--- + +# Create a deployment plan + +A "service management" mindset means that the devices in your organization fall into a continuum, with the software update process being constantly planned, deployed, monitored, and optimized. And once you use this process for feature updates, quality updates become a lightweight procedure that is simple and fast to execute, ultimately increasing velocity. + +When you move to a service management model, you need effective ways of rolling out updates to representative groups of devices. We’ve found that a ring-based deployment works well for us at Microsoft and many other organizations across the globe. Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method to separate devices into a deployment timeline. + +At the highest level, each “ring” comprises a group of users or devices that receive a particular update concurrently. For each ring, IT administrators set criteria to control deferral time or adoption (completion) that should be met before deployment to the next broader ring of devices or users can occur. + +A common ring structure uses three deployment groups: + +- Preview: Planning and development +- Limited: Pilot and validation +- Broad: Wide deployment + +> [!NOTE] +> Organizations often use different names for their “rings," for example: +> - First > Fast > Broad +> - Canaries > Early Adopters > Users +> - Preview > Broad > Critical + + +## How many rings should I have? + +There are no definite rules for exactly how many rings to have for your deployments. As mentioned previously, you might want to ensure zero downtime for mission-critical devices by putting them in their own ring. If you have a large organization, you might want to consider assigning devices to rings based on geographic location or the size of rings so that helpdesk resources are more available. Consider the needs of your business and introduce rings that make sense for your organization. + +## Advancing between rings + +There are basically two strategies for moving deployments from one ring to the next. One is service-based, the other project based. + +- "Red button" (service based): Assumes that content is good until proven bad. Content flows until an issue is discovered, at which point the IT administrator presses the “red button” to stop further distribution. +- Green button (project based): Assumes that content is bad until proven good. Once all validation has passed, the IT administrator presses the “green button” to push the content to the next ring. + +When it comes to deployments, having manual steps in the process usually impedes update velocity. A "red button" strategy is better when that is your goal. + +## Preview ring + +The purpose of the Preview ring is to evaluate the new features of the update. It's *not* for broad parts of the organization but is limited to the people who are responsible for knowing what is coming next, generally IT administrators. Ultimately, this phase is the time the design and planning work happens so that when the public update is shipped, you can have greater confidence in the update. + +> [!NOTE] +> Being part of the [Windows Insider Program](https://insider.windows.com/for-business/) gives you early access to Windows releases so that you can use Insider Preview builds in your Preview ring to validate your apps and infrastructure, preparing you for public Windows releases. + + +### Who goes in the Preview ring? + +The Preview ring users are the most tech savvy and resilient people, who will not lose productivity if something goes wrong. In general, these users are IT pros, and perhaps a few people in the business organization. + +During your plan and prepare phases, you should focus on the following activities: + +- Work with Windows Insider Preview builds. +- Identify the features and functionality your organization can or wants to use. +- Establish who will use the features and how they will benefit. +- Understand why you are putting out the update. +- Plan for usage feedback. + +Remember, you are working with pre-release software in the Preview ring and you will be evaluating features and testing the update for a targeted release. + +> [!IMPORTANT] +> If you are using Windows Insider (pre-release) releases for your preview ring and you are using WSUS or Windows Update for Business, be sure to set the following policies to allow for Preview builds: +> - **Manage Preview Builds: 2 - Enable preview builds** +> • Under **Branch Readiness Level**, select **When Preview Builds and Feature Updates are Received: 4--Windows Insider Program Slow** + +## Limited ring + +The purpose of the Limited ring is to validate the update on representative devices across the network. During this period, data, and feedback are generated to enable the decision to move forward to broader deployment. Desktop +Analytics can help with defining a good Limited ring of representative devices and assist in monitoring the deployment. + +### Who goes in the Limited ring? + +The most important part of this phase is finding a representative sample of devices and applications across your network. If possible, all hardware and all applications should be represented, and it's important that the people selected for this ring are using their devices regularly in order to generate the data you will need to make a decision for broader deployment across your organization. The IT department, lab devices, and users with the most cutting-edge hardware usually don’t have the applications or device drivers that are truly a representative sample of your network. + + +During your pilot and validate phases, you should focus on the following activities: + +- Deploy new innovations. +- Assess and act if issues are encountered. +- Move forward unless blocked. + +When you deploy to the Limited ring, you’ll be able to gather data and react to incidents happening in the environment, quickly addressing any issues that might arise. Ensure you monitor for sufficient adoption within this ring, because your Limited ring represents your organization across the board, and when you achieve sufficient adoption, you can have confidence that your broader deployment will run more smoothly. + +## Broad deployment + +Once the devices in the Limited ring have had a sufficient stabilization period, it’s time for broad deployment across the network. + +### Who goes in the Broad deployment ring? + +In most businesses, the Broad ring includes the rest of your organization. Because of the work in the previous ring to vet stability and minimize disruption (with diagnostic data to support your decision) broad deployment can occur relatively quickly. + +> [!NOTE] +> In some instances, you might hold back on mission critical devices (such as medical devices) until deployment in the Broad ring is complete. Get best practices and recommendations for deploying Windows 10 feature +> updates to mission critical devices. + +During the broad deployment phase, you should focus on the following activities: + +- Deploy to all devices in the organization. +- Work through any final unusual issues that were not detected in your Limited ring. + + +## Ring deployment planning + +Previously, we have provided methods for analyzing your deployments, but these have been standalone tools to assess, manage and execute deployments. In other words, you would generate an analysis, make a deployment strategy, and then move to your console for implementation, repeating these steps for each deployment. We have combined many of these tasks, and more, into a single interface with Desktop Analytics. + + +[Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) is a cloud-based service and a key tool in [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/configmgr/core/understand/microsoft-endpoint-manager-faq). Using artificial intelligence and machine learning, Desktop Analytics is a powerful tool to give you insights and intelligence to +make informed decisions about the readiness of your Windows devices. + +In Windows 10 deployments, we have seen compatibility issues on < 0.5% of apps when using Desktop Analytics. Using Desktop Analytics with Microsoft Endpoint Manager can help you assess app compatibility with the latest +feature update and create groups that represent the broadest number of hardware and software configurations on the smallest set of devices across your organization. In addition, Desktop Analytics can provide you with a device and software inventory and identify issues, giving you data that equate to actionable decisions. + +> [!IMPORTANT] +> Desktop Analytics does not support preview (Windows Insider) builds; use Configuration Manager to deploy to your Preview ring. As noted previously, the Preview ring is a small group of devices represents your ecosystem very well in terms of app, driver, and hardware diversity. + +### Deployment plan options + +There are two ways to implement a ring deployment plan, depending on how you manage your devices: + +- If you are using Configuration Manager: Desktop Analytics provides end-to-end deployment plan integration so that you can also kick off phased deployments within a ring. Learn more about [deployment plans in Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/about-deployment-plans). +- If you are using Microsoft Intune, see [Create deployment plans directly in Intune](https://docs.microsoft.com/mem/intune/fundamentals/planning-guide). + +For more about Desktop Analytics, see these articles: + +- [How to set up Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/set-up) +- [Tutorial: Deploy Windows 10 to Pilot](https://docs.microsoft.com/mem/configmgr/desktop-analytics/tutorial-windows10) +- [Desktop Analytics documentation](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) +- [Intune deployment planning, design, and implementation guide](https://docs.microsoft.com/mem/intune/fundamentals/planning-guide) + diff --git a/windows/deployment/update/delivery-optimization-proxy.md b/windows/deployment/update/delivery-optimization-proxy.md new file mode 100644 index 0000000000..21e355ea15 --- /dev/null +++ b/windows/deployment/update/delivery-optimization-proxy.md @@ -0,0 +1,79 @@ +--- +title: Using a proxy with Delivery Optimization +manager: laurawi +description: Settings to use with various proxy configurations to allow Delivery Optimization to work +keywords: updates, downloads, network, bandwidth +ms.prod: w10 +ms.mktglfcycl: deploy +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Using a proxy with Delivery Optimization + +**Applies to**: Windows 10 + +When Delivery Optimization downloads content from HTTP sources, it uses the automatic proxy discovery capability of WinHttp to streamline and maximize the support for complex proxy configurations as it makes range requests from the content server. It does this by setting the **WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY** flag in all HTTP calls. + +Delivery Optimization provides a token to WinHttp that corresponds to the user that is signed in currently. In turn, WinHttp automatically authenticates the user against the proxy server set either in Internet Explorer or in the **Proxy Settings** menu in Windows. + +For downloads that use Delivery Optimization to successfully use the proxy, you should set the proxy via Windows **Proxy Settings** or the Internet Explorer proxy settings. + +Setting the Internet Explorer proxy to apply device-wide will ensure that the device can access the proxy server even when no user is signed in. In this case, the proxy is accessed with the “NetworkService” context if proxy authentication is required. + +> [!NOTE] +> We don't recommend that you use `netsh winhttp set proxy ProxyServerName:PortNumber`. Using this offers no auto-detection of the proxy, no support for an explicit PAC URL, and no authentication to the proxy. This setting is ignored by WinHTTP for requests that use auto-discovery (if an interactive user token is used). + +If a user is signed in, the system uses the Internet Explorer proxy. + +If no user is signed in, even if both the Internet Explorer proxy and netsh configuration are set, the netsh configuration will take precedence over the Internet Explorer proxy. This can result in download failures. For example, you might receive HTTP_E_STATUS_PROXY_AUTH_REQ or HTTP_E_STATUS_DENIED errors. + +You can still use netsh to import the proxy setting from Internet Explorer (`netsh winhttp import proxy source=ie `) if your proxy configuration is a static *proxyServerName:Port*. However, the same limitations mentioned previously apply. + +### Summary of settings behavior + +These tables summarize the behavior for various combinations of settings: + +With an interactive user signed in: + +|Named proxy set by using: |Delivery Optimization successfully uses proxy | +|---------|---------| +|Internet Explorer proxy, current user | Yes | +|Internet Explorer proxy, device-wide | Yes | +|netsh proxy | No | +|Both Internet Explorer proxy (current user) *and* netsh proxy | Yes, Internet Explorer proxy is used | +|Both Internet Explorer proxy (device-wide) *and* netsh proxy | Yes, Internet Explorer proxy is used | + +With NetworkService (if unable to obtain a user token from a signed-in user): + +|Named proxy set by using: |Delivery Optimization successfully uses proxy | +|---------|---------| +|Internet Explorer proxy, current user | No | +|Internet Explorer proxy, device-wide | Yes | +|netsh proxy | Yes | +|Both Internet Explorer proxy (current user) *and* netsh proxy | Yes, netsh proxy is used | +|Both Internet Explorer proxy (device-wide) *and* netsh proxy | Yes, netsh proxy is used | + +## Setting a device-wide Internet Explorer proxy + +You can set a device-wide proxy that will apply to all users including an interactive user, LocalSystem, and NetworkService by using the [Network Proxy CSP](https://docs.microsoft.com/windows/client-management/mdm/networkproxy-csp). + +Or, if you use Group Policy, you can apply proxy settings to all users of the same device by enabling the **Computer Configuration\ Administrative Templates\ Windows Components\ Internet Explorer\ Make proxy settings per-machine (rather than per-user)** policy. + +This policy is meant to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user, so if you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer. If you disable this policy or do not configure it, users of the same computer can establish their own proxy settings. + +## Using a proxy with Microsoft Connected Cache + +Starting with Windows 10, version 2004, you can use Connected Cache behind a proxy. In older versions, when you set Delivery Optimization to download from Connected Cache, it will bypass the proxy and try to connect directly to the Connected Cache server. This can cause failure to download. + +However, you can set the Connected Cache server to use an unauthenticated proxy. For more information, see [Microsoft Connected Cache in Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache#prerequisites-and-limitations). + + ## Related articles + +- [How can I configure Proxy AutoConfigURL Setting using Group Policy Preference (GPP)?](https://docs.microsoft.com/archive/blogs/askie/how-can-i-configure-proxy-autoconfigurl-setting-using-group-policy-preference-gpp) +- [How to use GPP Registry to uncheck automatically detect settings? ](https://docs.microsoft.com/archive/blogs/askie/how-to-use-gpp-registry-to-uncheck-automatically-detect-settings) +- [How to configure a proxy server URL and Port using GPP Registry?](https://docs.microsoft.com/archive/blogs/askie/how-to-configure-a-proxy-server-url-and-port-using-gpp-registry) diff --git a/windows/deployment/update/deploy-updates-configmgr.md b/windows/deployment/update/deploy-updates-configmgr.md new file mode 100644 index 0000000000..1706180e52 --- /dev/null +++ b/windows/deployment/update/deploy-updates-configmgr.md @@ -0,0 +1,20 @@ +--- +title: Deploy Windows 10 updates with Configuration Manager (Windows 10) +description: Deploy Windows 10 updates with Configuration Manager +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Deploy Windows 10 updates with Configuration Manager + +**Applies to** + +- Windows 10 + +See the Microsoft Endpoint Manager [documentation](https://docs.microsoft.com/mem/configmgr/osd/deploy-use/manage-windows-as-a-service) for details about using Configuration Manager to deploy and manage Windows 10 updates. \ No newline at end of file diff --git a/windows/deployment/update/deploy-updates-intune.md b/windows/deployment/update/deploy-updates-intune.md new file mode 100644 index 0000000000..8737d452c6 --- /dev/null +++ b/windows/deployment/update/deploy-updates-intune.md @@ -0,0 +1,20 @@ +--- +title: Deploy updates with Intune +description: Deploy Windows 10 updates with Intune +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Deploy Windows 10 updates with Intune + +**Applies to** + +- Windows 10 + +See the Microsoft Intune [documentation](https://docs.microsoft.com/mem/intune/protect/windows-update-for-business-configure#windows-10-feature-updates) for details about using Intune to deploy and manage Windows 10 updates. \ No newline at end of file diff --git a/windows/deployment/update/eval-infra-tools.md b/windows/deployment/update/eval-infra-tools.md new file mode 100644 index 0000000000..ce3c85e030 --- /dev/null +++ b/windows/deployment/update/eval-infra-tools.md @@ -0,0 +1,69 @@ +--- +title: Evaluate infrastructure and tools +manager: laurawi +description: Steps to make sure your infrastructure is ready to deploy updates +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +ms.topic: article +ms.collection: m365initiative-coredeploy +--- + +# Evaluate infrastructure and tools + +Before you deploy an update, it's best to assess your deployment infrastructure (that is, tools such as Configuration Manager, Microsoft Intune, or similar) and current configurations (such as security baselines, administrative templates, and policies that affect updates). Then, set some criteria to define your operational readiness. + +## Infrastructure + +Do your deployment tools need updates? + +- If you use Configuration Manager, is it on the Current Branch with the latest release installed. Being on this branch ensures that it supports the next Windows 10 feature update. Configuration Manager releases are supported for 18 months. +- Using a cloud-based management tool like Microsoft Intune reduces support challenges, since no related products need to be updated. +- If you use a non-Microsoft tool, check with its product support to make sure you're using the current version and that it supports the next Windows 10 feature update. + +Rely on your experiences and data from previous deployments to help you judge how long infrastructure changes take and identify any problems you've encountered while doing so. + +## Device settings + +Make sure your security baseline, administrative templates, and policies have the right settings to support your devices once the new Windows 10 update is installed. + +### Security baseline + +Keep security baselines current to help ensure that your environment is secure and that new security feature in the coming Windows 10 update are set properly. + +- **Microsoft security baselines**: You should implement security baselines from Microsoft. They are included in the [Security Compliance Toolkit](https://www.microsoft.com/download/details.aspx?id=55319), along with tools for managing them. +- **Industry- or region-specific baselines**: Your specific industry or region might have particular baselines that you must follow per regulations. Ensure that any new baselines support the version of Windows 10 you are about to deploy. + +### Configuration updates + +There are a number of Windows policies (set by Group Policy, Intune, or other methods) that affect when Windows updates are installed, deferral, end-user experience, and many other aspects. Check these policies to make sure they are set appropriately. + +- **Windows 10 Administrative templates**: Each Windows 10 feature update has a supporting Administrative template (.admx) file. Group Policy tools use Administrative template files to populate policy settings in the user interface. The templates are available in the Download Center, for example, this one for [Windows 10, version 1909](https://www.microsoft.com/download/100591). +- **Policies for update compliance and end-user experience**: A number of settings affect when a device installs updates, whether and for how long a user can defer an update, restart behavior after installation, and many other aspects of update behavior. It's especially important to look for existing policies that are out of date or could conflict with new ones. + + +## Define operational readiness criteria + +When you’ve deployed an update, you’ll need to make sure the update isn’t introducing new operational issues. And you’ll also ensure that if incidents arise, the needed documentation and processes are available. Work with your operations and support team to define acceptable trends and what documents or processes require updating: + +- **Call trend**: Define what percentage increase in calls relating to Windows 10 feature updates are acceptable or can be supported. +- **Incident trend**: Define what percentage of increase in calls asking for support relating to Windows 10 feature updates are acceptable or can be supported. +- **Support documentation**: Review supporting documentation that requires an update to support new infrastructure tooling or configuration as part of the Windows 10 feature update. +- **Process changes:** Define and update any processes that will change as a result of the Windows 10 feature update. + +Your operations and support staff can help you determine if the appropriate information is being tracked at the moment. If it isn't, work out how to get this information so you can gain the right insight. + +## Tasks + +Finally, you can begin to carry out the work needed to ensure your infrastructure and configuration can support the update. To help you keep track, you can classify the work into the following overarching tasks: + +- **Review infrastructure requirements**: Go over the details of requirements to support the update, and ensure they’ve all been defined. +- **Validate infrastructure against requirements**: Compare your infrastructure against the requirements that have been identified for the update. +- **Define infrastructure update plan**: Detail how your infrastructure must change to support the update. +- **Review current support volume**: Understand the current support volume to understand how much of an effect the update has when it’s been deployed. +- **Identify gaps that require attention**: Identify issues that will need to be addressed to successfully deploy the update. For example, will your infrastructure engineer have to research how a new feature that comes with the update might affect the infrastructure? +- **Define operational update plan**: Detail how your operational services and processes must change to support the update. diff --git a/windows/deployment/update/feature-update-conclusion.md b/windows/deployment/update/feature-update-conclusion.md index 5c72afc8c0..d8206d5491 100644 --- a/windows/deployment/update/feature-update-conclusion.md +++ b/windows/deployment/update/feature-update-conclusion.md @@ -1,6 +1,6 @@ --- title: Best practices for feature updates - conclusion -description: Final thoughts about how to deploy feature updates +description: This article includes final thoughts about how to deploy and stay up-to-date with Windows 10 feature updates. ms.prod: w10 ms.mktglfcycl: manage audience: itpro @@ -12,6 +12,7 @@ ms.reviewer: manager: laurawi ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Conclusion diff --git a/windows/deployment/update/feature-update-maintenance-window.md b/windows/deployment/update/feature-update-maintenance-window.md index da74aafced..c586284056 100644 --- a/windows/deployment/update/feature-update-maintenance-window.md +++ b/windows/deployment/update/feature-update-maintenance-window.md @@ -1,10 +1,9 @@ --- title: Best practices - deploy feature updates during maintenance windows -description: Learn how to deploy feature updates during a maintenance window +description: Learn how to configure maintenance windows and how to deploy feature updates during a maintenance window. ms.prod: w10 ms.mktglfcycl: manage audience: itpro -itproauthor: jaimeo author: jaimeo ms.localizationpriority: medium ms.author: jaimeo @@ -12,6 +11,7 @@ ms.reviewer: manager: laurawi ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Deploy feature updates during maintenance windows @@ -34,7 +34,7 @@ Use the following information to deploy feature updates during a maintenance win ### Step 2: Review computer restart device settings -If you’re not suppressing computer restarts and the feature update will be installed when no users are present, consider deploying a custom client settings policy to your feature update target collection to shorten the settings below or consider the total duration of these settings when defining your maintenance window duration. +If you're not suppressing computer restarts and the feature update will be installed when no users are present, consider deploying a custom client settings policy to your feature update target collection to shorten the settings below or consider the total duration of these settings when defining your maintenance window duration. For example, by default, 90 minutes will be honored before the system is rebooted after the feature update install. If users will not be impacted by the user logoff or restart, there is no need to wait a full 90 minutes before rebooting the computer. If a delay and notification is needed, ensure that the maintenance window takes this into account along with the total time needed to install the feature update. @@ -51,7 +51,7 @@ Use **Peer Cache** to help manage deployment of content to clients in remote loc ### Step 4: Override the default Windows setup priority (Windows 10, version 1709 and later) -If you’re deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. +If you're deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. %systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini diff --git a/windows/deployment/update/feature-update-mission-critical.md b/windows/deployment/update/feature-update-mission-critical.md index 760c0f0182..5c4c8987f1 100644 --- a/windows/deployment/update/feature-update-mission-critical.md +++ b/windows/deployment/update/feature-update-mission-critical.md @@ -1,6 +1,6 @@ --- title: Best practices and recommendations for deploying Windows 10 Feature updates to mission-critical devices -description: Learn how to deploy feature updates to your mission-critical devices +description: Learn how to use the Microsoft Endpoint Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. ms.prod: w10 ms.mktglfcycl: manage audience: itpro @@ -12,13 +12,14 @@ ms.reviewer: manager: laurawi ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Best practices and recommendations for deploying Windows 10 Feature updates to mission critical devices **Applies to**: Windows 10 -Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren’t the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the Microsoft Endpoint Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. +Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren't the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the Microsoft Endpoint Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. For simplicity, we will outline the steps to deploy a feature update manually. If you prefer an automated approach, see [Manage Windows as a service using Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service). @@ -30,10 +31,10 @@ Devices and shared workstations that are online and available 24 hours a day, 7 You can use Configuration Manager to deploy feature updates to Windows 10 devices in two ways. The first option is to use the software updates feature. The second option is to use a task sequence to deploy feature updates. There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example: - **Upgrade to the next LTSC release.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. -- **Additional required tasks.** When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you can use task sequences to orchestrate the additional steps. Software updates do not have the ability to add steps to their deployments. +- **Additional required tasks.** When deploying a feature update requires additional steps (for example, suspending disk encryption, updating applications), you can use task sequences to orchestrate the additional steps. Software updates do not have the ability to add steps to their deployments. - **Language pack installations.** When deploying a feature update requires the installation of additional language packs, you can use task sequences to orchestrate the installation. Software updates do not have the ability to natively install language packs. -If you need to use a task sequence to deploy feature updates, see [Manage Windows as a service using Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service) for more information. If you find that your requirement for a task sequence is based solely on the need to run additional tasks preformed pre-install or pre-commit, see the new [run custom actions](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) functionality first introduced with Windows 10, version 1803. You might find this useful in deploying software updates. +If you need to use a task sequence to deploy feature updates, see [Manage Windows as a service using Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service) for more information. If you find that your requirement for a task sequence is based solely on the need to run additional tasks performed pre-install or pre-commit, see the new [run custom actions](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) functionality first introduced with Windows 10, version 1803. You might find this option useful in deploying software updates. Use the following information: diff --git a/windows/deployment/update/feature-update-user-install.md b/windows/deployment/update/feature-update-user-install.md index e22be01edd..70dcc6a516 100644 --- a/windows/deployment/update/feature-update-user-install.md +++ b/windows/deployment/update/feature-update-user-install.md @@ -1,6 +1,6 @@ --- title: Best practices - deploy feature updates for user-initiated installations -description: Learn how to manually deploy feature updates +description: Learn recommendations and best practices for manually deploying a feature update for a user-initiated installation. ms.prod: w10 ms.mktglfcycl: manage audience: itpro @@ -12,6 +12,7 @@ ms.reviewer: manager: laurawi ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Deploy feature updates for user-initiated installations (during a fixed service window) @@ -29,7 +30,7 @@ Use **Peer Cache** to help manage deployment of content to clients in remote loc ### Step 2: Override the default Windows setup priority (Windows 10, version 1709 and later) -If you’re deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. +If you're deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. %systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index d125672d4a..98579c7905 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -1,9 +1,8 @@ --- -title: Windows 10 - How to make FoD and language packs available when you're using WSUS or Configuration Manager -description: Learn how to make FoD and language packs available when you're using WSUS or Configuration Manager +title: Make FoD and language packs available for WSUS/Configuration Manager +description: Learn how to make FoD and language packs available when you're using WSUS/Configuration Manager. ms.prod: w10 ms.mktglfcycl: manage - ms.pagetype: article ms.author: jaimeo audience: itpro @@ -13,6 +12,7 @@ ms.date: 03/13/2019 ms.reviewer: manager: laurawi ms.topic: article +ms.custom: seo-marvel-apr2020 --- # How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager @@ -20,11 +20,11 @@ ms.topic: article As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS. -The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it’s important to note this policy only allows specifying one alternate location and behaves differently across OS versions. +The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions. In Windows 10 version 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired. -In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It’s currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. +In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It's currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. diff --git a/windows/deployment/update/get-started-updates-channels-tools.md b/windows/deployment/update/get-started-updates-channels-tools.md new file mode 100644 index 0000000000..93b16449ff --- /dev/null +++ b/windows/deployment/update/get-started-updates-channels-tools.md @@ -0,0 +1,106 @@ +--- +title: Windows 10 updates, channels, and tools +description: Brief summary of the kinds of Windows updates, the channels they are served through, and the tools for managing them +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Windows 10 updates, channels, and tools + +## How Windows updates work + +There are four phases to the Windows update process: + +- **Scan:** A device checks the Microsoft Update server, Windows Update service, or your Windows Server Update Services (WSUS) endpoint at random intervals to see if any updates have been added since the last time updates were searched, and then evaluates whether the update is appropriate by checking the policies that have been set up by the +administrator. This process is invisible to the user. +- **Download:** Once the device determines that an update is available, it begins downloading the update. The download process is also invisible to the user. With feature updates, download happens in multiple +sequential phases. +- **Install:** After the update is downloaded, depending on the device’s Windows Update settings, the update is installed on the system. +- **Commit and restart:** Once installed, the device usually (but not always) must be restarted in order to complete the installation and begin using the update. Before that happens, a device is still running the previous +version of the software. + +## Types of updates + +We include information here about a number of different update types you'll hear about, but the two overarching types which you have the most direct control over are *feature updates* and *quality updates*. + +- **Feature updates:** Released twice per year, during the first half and second half of each calendar year. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage. +- **Quality updates:** Quality updates deliver both security and non-security fixes to Windows 10. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They are typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously. +- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates are not necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md). +- **Driver updates**: These are updates to drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not. +- **Microsoft product updates:** These are updates for other Microsoft products, such as Office. You can enable or disable Microsoft updates by using policies controlled by various servicing tools. + + + +## Servicing channels + +Windows 10 offers three servicing channels, each of which offers you a different level of flexibility with how and when updates are delivered to devices. Using the different servicing channels allows you to deploy Windows 10 "as a service" which conceives of deployment as a continual process of updates which roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. + +The first step of controlling when and how devices install updates is assigning them to the appropriate servicing channel. You can assign devices to a particular channel with any of several tools, including Microsoft Endpoint Configuration Manager, Windows Server Update Services (WSUS), and Group Policy settings applied by any of several means. By dividing devices into different populations ("deployment groups" or "rings") you can use servicing channel assignment, followed by other management features such as update deferral policies, to create a phased deployment of any update that allows you to start with a limited pilot deployment for testing before moving to a broad deployment throughout your organization. + + +### Semi-annual Channel + +In the Semi-annual Channel, feature updates are available as soon as Microsoft releases them, twice per year. As long as a device isn't set to defer feature updates, any device using the Semi-annual Channel will install a feature update as soon as it's released. If you use Windows Update for Business, the Semi-annual Channel provides three months of additional total deployment time before being required to update to the next release. + +> [!NOTE] +> All releases of Windows 10 have **18 months of servicing for all editions**--these updates provide security and feature updates for the release. However, fall releases of the **Enterprise and Education editions** will have an **additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release**. This extended servicing window applies to Enterprise and Education editions starting with Windows 10, version 1607. + +### Windows Insider Program for Business + +Insider preview releases are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. There are actually three options within the Windows Insider Program for Business channel: + +- Windows Insider Fast +- Windows Insider Slow +- Windows Insider Release Preview + +We recommend that you use the Windows Insider Release Preview channel for validation activities. + + +### Long-term Servicing Channel + +The **Long Term Servicing Channel** is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATMs. Devices on this channel receive new feature releases every two to three years. LTSB releases service a special LTSB edition of Windows 10 and are only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). + +The Semi-Annual Channel is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each Windows 10 edition. + + +| Windows 10 edition | Semi-Annual Channel | Insider Program | Long-Term Servicing Channel | +| --- | --- | --- | --- | +| Home | ![yes](images/checkmark.png)|![no](images/crossmark.png) | ![no](images/crossmark.png)| +| Pro | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| +| Enterprise | ![yes](images/checkmark.png) |![yes](images/checkmark.png) | ![no](images/crossmark.png)| +| Enterprise LTSB | ![no](images/crossmark.png) |![no](images/crossmark.png) | ![yes](images/checkmark.png)| +| Pro Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| +| Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png)| + +## Servicing tools + +### Tools for on-premises update delivery + +Windows Server Update Services (WSUS): you set up a WSUS server, which downloads updates in bulk from Microsoft. Your individual devices then connect to your server to install their updates from there. + +You can set up, control, and manage the server and update process with a number of tools: + +- A standalone Windows Server Update Services server operated directly +- [Configuration Manager](deploy-updates-configmgr.md) +- Non-Microsoft tools + +For more information, see [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). + +### Tools for cloud-based update delivery + +Your individual devices connect to Microsoft endpoints directly to get the updates. The details of this process (how often devices download updates of various kinds, from which channels, deferrals, and details of the users' experience of installation) are set on devices either with Group Policy or MDM policies, which you can control with any of a number of tools: + +- [Group Policy Management Console](waas-wufb-group-policy.md) (Gpmc.msc) +- [Microsoft Intune](waas-wufb-intune.md) +- Non-Microsoft MDM tools + +### Hybrid scenarios + +It is also possible to combine WSUS-based on-premises update distribution with cloud-based update delivery. diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md index 7284fecba7..44bbae9ebf 100644 --- a/windows/deployment/update/how-windows-update-works.md +++ b/windows/deployment/update/how-windows-update-works.md @@ -1,6 +1,6 @@ --- title: How Windows Update works -description: Learn how Windows Update works, including architecture and troubleshooting. +description: In this article, learn about the process Windows Update uses to download and install updates on a Windows 10 devices. ms.prod: w10 ms.mktglfcycl: audience: itpro @@ -12,6 +12,7 @@ ms.reviewer: manager: laurawi ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # How does Windows Update work? @@ -27,7 +28,7 @@ The Windows Update workflow has four core areas of functionality: ### Download -1. Orchestrator initiates downloads. +1. Orchestrator starts downloads. 2. Windows Update downloads manifest files and provides them to the arbiter. 3. The arbiter evaluates the manifest and tells the Windows Update client to download files. 4. Windows Update client downloads files in a temporary folder. @@ -35,54 +36,54 @@ The Windows Update workflow has four core areas of functionality: ### Install -1. Orchestrator initiates the installation. +1. Orchestrator starts the installation. 2. The arbiter calls the installer to install the package. ### Commit -1. Orchestrator initiates a restart. +1. Orchestrator starts a restart. 2. The arbiter finalizes before the restart. ## How updating works -During the updating process, the Windows Update Orchestrator operates in the background to scan, download, and install updates. It does this automatically, according to your settings, and in a silent manner that doesn’t disrupt your computer usage. +During the updating process, the Windows Update Orchestrator operates in the background to scan, download, and install updates. It does these actions automatically, according to your settings, and silently so that doesn't disrupt your computer usage. ## Scanning updates ![Windows Update scanning step](images/update-scan-step.png) The Windows Update Orchestrator on your PC checks the Microsoft Update server or your WSUS endpoint for new updates at random intervals. The randomization ensures that the Windows Update server isn't overloaded with requests all at the same time. The Update Orchestrator searches only for updates that have been added since the last time updates were searched, allowing it to find updates quickly and efficiently. -When checking for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your computer using guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies. +When checking for updates, the Windows Update Orchestrator evaluates whether the update is appropriate for your device. It uses guidelines defined by the publisher of the update, for example, Microsoft Office including enterprise group policies. Make sure you're familiar with the following terminology related to Windows Update scan: |Term|Definition| |----|----------| -|Update|We use this term to mean a lot of different things, but in this context it's the actual patch or change.| +|Update|We use this term to mean several different things, but in this context it's the actual updated code or change.| |Bundle update|An update that contains 1-N child updates; doesn't contain payload itself.| |Child update|Leaf update that's bundled by another update; contains payload.| -|Detectoid update|A special 'update' that contains "IsInstalled" applicability rule only and no payload. Used for prereq evaluation.| -|Category update|A special 'detectoid' that has always true IsInstalled rule. Used for grouping updates and for client to filter updates. | +|Detector update|A special "update" that contains "IsInstalled" applicability rule only and no payload. Used for prereq evaluation.| +|Category update|A special "detectoid" that has an **IsInstalled** rule that is always true. Used for grouping updates and to allow the device to filter updates. | |Full scan|Scan with empty datastore.| |Delta scan|Scan with updates from previous scan already cached in datastore.| -|Online scan|Scan that hits network and goes against server on cloud. | -|Offline scan|Scan that doesn't hit network and goes against local datastore. Only useful if online scan has been performed before. | -|CatScan|Category scan where caller can specify a categoryId to get updates published under the categoryId.| -|AppCatScan|Category scan where caller can specify an AppCategoryId to get apps published under the appCategoryId.| -|Software sync|Part of the scan that looks at software updates only (OS and apps).| -|Driver sync|Part of the scan that looks at Driver updates only. This is run after Software sync and is optional.| -|ProductSync|Attributes based sync, where client provides a list of device, product and caller attributes ahead of time to allow service to evaluate applicability in the cloud. | +|Online scan|Scan that uses the network and to check an update server. | +|Offline scan|Scan that doesn't use the network and instead checks the local datastore. Only useful if online scan has been performed before. | +|CatScan|Category scan where caller can specify a **categoryId** to get updates published under that **categoryId**.| +|AppCatScan|Category scan where caller can specify an **AppCategoryId** to get apps published under that **appCategoryId**.| +|Software sync|Part of the scan that only checks for software updates (both the apps and the operating system).| +|Driver sync|Part of the scan that checks driver updates only. This sync is optional and runs after the software sync.| +|ProductSync|A sync based on attributes, in which the client provides a list of device, product, and caller attributes ahead of time to allow service to check applicability in the cloud. | ### How Windows Update scanning works -Windows Update takes the following sets of actions when it runs a scan. +Windows Update does the following actions when it runs a scan. #### Starts the scan for updates When users start scanning in Windows Update through the Settings panel, the following occurs: -- The scan first generates a “ComApi” message. The caller (Windows Defender Antivirus) tells the WU engine to scan for updates. +- The scan first generates a “ComApi” message. The caller (Microsoft Defender Antivirus) tells the Windows Update engine to scan for updates. - "Agent" messages: queueing the scan, then actually starting the work: - - Updates are identified by the different IDs ("Id = 10", "Id = 11") and from the different thread ID numbers. + - Updates are identified by the different IDs ("ID = 10", "ID = 11") and from the different thread ID numbers. - Windows Update uses the thread ID filtering to concentrate on one particular task. ![Windows Update scan log 1](images/update-scan-log-1.png) @@ -90,20 +91,19 @@ When users start scanning in Windows Update through the Settings panel, the foll #### Identifies service IDs - Service IDs indicate which update source is being scanned. - Note The next screen shot shows Microsoft Update and the Flighting service. - The Windows Update engine treats every service as a separate entity, even though multiple services may contain the same updates. ![Windows Update scan log 2](images/update-scan-log-2.png) - Common service IDs > [!IMPORTANT] - > ServiceId here identifies a client abstraction, not any specific service in the cloud. No assumption should be made of which server a serviceId is pointing to, it's totally controlled by the SLS responses. + > ServiceId here identifies a client abstraction, not any specific service in the cloud. No assumption should be made of which server a serviceId is pointing to. It's totally controlled by responses from the Service Locator Service. |Service|ServiceId| |-------|---------| -|Unspecified / Default|WU, MU or WSUS
        00000000-0000-0000-0000-000000000000 | -|WU|9482F4B4-E343-43B6-B170-9A65BC822C77| -|MU|7971f918-a847-4430-9279-4a52d1efe18d| +|Unspecified / Default|WU, MU, or WSUS
        00000000-0000-0000-0000-000000000000 | +|Windows Update|9482F4B4-E343-43B6-B170-9A65BC822C77| +|Microsoft Update|7971f918-a847-4430-9279-4a52d1efe18d| |Store|855E8A7C-ECB4-4CA3-B045-1DFA50104289| |OS Flighting|8B24B027-1DEE-BABB-9A95-3517DFB9C552| |WSUS or Configuration Manager|Via ServerSelection::ssManagedServer
        3DA21691-E39D-4da6-8A4B-B43877BCB1B7 | @@ -114,33 +114,33 @@ Common update failure is caused due to network issues. To find the root of the i - Look for "ProtocolTalker" messages to see client-server sync network traffic. - "SOAP faults" can be either client- or server-side issues; read the message. -- The WU client uses SLS (Service Locator Service) to discover the configurations and endpoints of Microsoft network update sources – WU, MU, Flighting. +- The Windows Update client uses the Service Locator Service to discover the configurations and endpoints of Microsoft network update sources: Windows update, Microsoft Update, or Flighting. > [!NOTE] - > Warning messages for SLS can be ignored if the search is against WSUS or Configuration Manager. + > If the search is against WSUS or Configuration Manager, you can ignore warning messages for the Service Locator Service. -- On sites that only use WSUS or Configuration Manager, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS or Configuration Manager, since it’s locally configured. +- On sites that only use WSUS or Configuration Manager, the Service Locator Service might be blocked at the firewall. In this case the request will fail, and though the service can’t scan against Windows Update or Microsoft Update, it can still scan against WSUS or Configuration Manager, since it’s locally configured. ![Windows Update scan log 3](images/update-scan-log-3.png) ## Downloading updates ![Windows Update download step](images/update-download-step.png) -Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does this in the background without interrupting your normal use of the computer. +Once the Windows Update Orchestrator determines which updates apply to your computer, it will begin downloading the updates, if you have selected the option to automatically download updates. It does operation in the background without interrupting your normal use of the device. -To ensure that your other downloads aren’t affected or slowed down because updates are downloading, Windows Update uses the Delivery Optimization (DO) technology which downloads updates and reduces bandwidth consumption. +To ensure that your other downloads aren't affected or slowed down because updates are downloading, Windows Update uses Delivery Optimization, which downloads updates and reduces bandwidth consumption. -For more information see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). +For more information, see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). ## Installing updates ![Windows Update install step](images/update-install-step.png) When an update is applicable, the "Arbiter" and metadata are downloaded. Depending on your Windows Update settings, when downloading is complete, the Arbiter will gather details from the device, and compare that with the downloaded metadata to create an "action list". -The action list describes all the files needed from WU, and what the install agent (such as CBS or Setup) should do with them. The action list is provided to the install agent along with the payload to begin the installation. +The action list describes all the files needed from Windows Update, and what the installation agent (such as CBS or Setup) should do with them. The action list is provided to the installation agent along with the payload to begin the installation. ## Committing Updates ![Windows Update commit step](images/update-commit-step.png) -When the option to automatically install updates is configured, the Windows Update Orchestrator, in most cases, automatically restarts the PC for you after installing the updates. This is necessary because your PC may be insecure, or not fully updated, until a restart is completed. You can use Group Policy settings, mobile device management (MDM), or the registry (not recommended) to configure when devices will restart after a Windows 10 update is installed. +When the option to automatically install updates is configured, the Windows Update Orchestrator, in most cases, automatically restarts the device for you after installing the updates. It has to restart the device because it might be insecure, or not fully updated, until it restarts. You can use Group Policy settings, mobile device management (MDM), or the registry (not recommended) to configure when devices will restart after a Windows 10 update is installed. -For more information see [Manage device restarts after updates](waas-restart.md). +For more information, see [Manage device restarts after updates](waas-restart.md). diff --git a/windows/deployment/update/images/DO-absolute-bandwidth.png b/windows/deployment/update/images/DO-absolute-bandwidth.png new file mode 100644 index 0000000000..a13d5393e6 Binary files /dev/null and b/windows/deployment/update/images/DO-absolute-bandwidth.png differ diff --git a/windows/deployment/update/images/UC_workspace_safeguard_queries.png b/windows/deployment/update/images/UC_workspace_safeguard_queries.png new file mode 100644 index 0000000000..36bb54260b Binary files /dev/null and b/windows/deployment/update/images/UC_workspace_safeguard_queries.png differ diff --git a/windows/deployment/update/images/annual-calendar.png b/windows/deployment/update/images/annual-calendar.png new file mode 100644 index 0000000000..ae785484ef Binary files /dev/null and b/windows/deployment/update/images/annual-calendar.png differ diff --git a/windows/deployment/update/images/rapid-calendar.png b/windows/deployment/update/images/rapid-calendar.png new file mode 100644 index 0000000000..b088cbbf5b Binary files /dev/null and b/windows/deployment/update/images/rapid-calendar.png differ diff --git a/windows/deployment/update/images/safeguard-hold-notification.png b/windows/deployment/update/images/safeguard-hold-notification.png new file mode 100644 index 0000000000..68714d08dc Binary files /dev/null and b/windows/deployment/update/images/safeguard-hold-notification.png differ diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md index 6c8417f572..236fb16910 100644 --- a/windows/deployment/update/index.md +++ b/windows/deployment/update/index.md @@ -47,6 +47,6 @@ Windows as a service provides a new way to think about building, deploying, and | [Windows Insider Program for Business](waas-windows-insider-for-business.md) | Explains how the Windows Insider Program for Business works and how to become an insider. | >[!TIP] ->Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as Microsoft Endpoint Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows. +>Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as Microsoft Endpoint Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows. >With each release of a new feature update for CB, Microsoft makes available new .iso files for use in updating your custom images. Each Windows 10 build has a finite servicing lifetime, so it’s important that images stay up to date with the latest build. For detailed information about how to deploy Windows 10 to bare-metal machines or to upgrade to Windows 10 from previous builds of Windows, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](../deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). Additionally, Windows 10 clients can move from any supported version of Windows 10 (i.e. Version 1511) to the latest version directly (i.e 1709). diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md index c981469bef..ea81420b8b 100644 --- a/windows/deployment/update/media-dynamic-update.md +++ b/windows/deployment/update/media-dynamic-update.md @@ -18,7 +18,7 @@ ms.topic: article **Applies to**: Windows 10 -This topic explains how to acquire and apply Dynamic Update packages to existing Windows 10 images prior to deployment and includes Windows PowerShell scripts you can use to automate this process. +This topic explains how to acquire and apply Dynamic Update packages to existing Windows 10 images *prior to deployment* and includes Windows PowerShell scripts you can use to automate this process. Volume-licensed media is available for each release of Windows 10 in the Volume Licensing Service Center (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. You can use Dynamic Update to ensure that Windows 10 devices have the latest feature update packages as part of an in-place upgrade while preserving language pack and Features on Demand (FODs) that might have been previously installed. Dynamic Update also eliminates the need to install a separate quality update as part of the in-place upgrade process. @@ -42,8 +42,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https ![Table with columns labeled Title, Products, Classification, Last Updated, Version, and Size and four rows listing various dynamic updates and associated KB articles](images/update-catalog.png) -The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the s. And you'll need to check various parts of the results to be sure you've identified the needed files. This table shows in bold the key items to search for or look for in the results. For example, to find the relevant "Setup Dynamic Update," you'll have to check the detailed description for the download by selecting the link in the **Title** column of the search results. - +The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. And you'll need to check various parts of the results to be sure you've identified the needed files. This table shows in **bold** the key items to search for or look for in the results. For example, to find the relevant "Setup Dynamic Update," you'll have to check the detailed description for the download by selecting the link in the **Title** column of the search results. |To find this Dynamic Update packages, search for or check the results here--> |Title |Product |Description (select the **Title** link to see **Details**) | |---------|---------|---------|---------| @@ -79,7 +78,7 @@ This table shows the correct sequence for applying the various tasks to the file |Add latest cumulative update | | 15 | 21 | |Clean up the image | 7 | 16 | 22 | |Add Optional Components | | | 23 | -|Add .Net and .Net cumulative updates | | | 24 | +|Add .NET and .NET cumulative updates | | | 24 | |Export image | 8 | 17 | 25 | ### Multiple Windows editions @@ -90,12 +89,11 @@ The main operating system file (install.wim) contains multiple editions of Windo You don't have to add more languages and features to the image to accomplish the updates, but it's an opportunity to customize the image with more languages, Optional Components, and Features on Demand beyond what is in your starting image. To do this, it's important to make these changes in the correct order: first apply servicing stack updates, followed by language additions, then by feature additions, and finally the latest cumulative update. The provided sample script installs a second language (in this case Japanese (ja-JP)). Since this language is backed by an lp.cab, there's no need to add a Language Experience Pack. Japanese is added to both the main operating system and to the recovery environment to allow the user to see the recovery screens in Japanese. This includes adding localized versions of the packages currently installed in the recovery image. -Optional Components, along with the .Net feature, can be installed offline, however doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid this. One option is to skip the image cleanup step, though that will result in a larger install.wim. Another option is to install the .Net and Optional Components in a step after cleanup but before export. This is the option in the sample script. By doing this, you will have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month). +Optional Components, along with the .NET feature, can be installed offline, however doing so creates pending operations that require the device to restart. As a result, the call to perform image cleanup would fail. There are two options to avoid this. One option is to skip the image cleanup step, though that will result in a larger install.wim. Another option is to install the .NET and Optional Components in a step after cleanup but before export. This is the option in the sample script. By doing this, you will have to start with the original install.wim (with no pending actions) when you maintain or update the image the next time (for example, the next month). ## Windows PowerShell scripts to apply Dynamic Updates to an existing image -These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages is stored locally in this folder structure: - +These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages are stored locally in this folder structure: |Folder |Description | |---------|---------| @@ -107,50 +105,52 @@ These examples are for illustration only, and therefore lack error handling. The The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there is a script error and it's necessary to start over from a known state. Also, it will provide a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they are not read-only. -``` -function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) } +```powershell +#Requires -RunAsAdministrator -Write-Host "$(Get-TS): Starting media refresh" +function Get-TS { return "{0:HH:mm:ss}" -f [DateTime]::Now } -# Declare media for FOD and LPs -$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" -$LP_ISO_PATH = "C:\mediaRefresh\packages\CLIENTLANGPACKDVD_OEM_MULTI.iso" +Write-Output "$(Get-TS): Starting media refresh" # Declare language for showcasing adding optional localized components -$LANG = "ja-jp" +$LANG = "ja-jp" $LANG_FONT_CAPABILITY = "jpan" +# Declare media for FOD and LPs +$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" +$LP_ISO_PATH = "C:\mediaRefresh\packages\CLIENTLANGPACKDVD_OEM_MULTI.iso" + # Declare Dynamic Update packages -$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu" -$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu" -$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab" +$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu" +$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu" +$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab" $SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\SafeOS_DU.cab" -$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu" +$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu" # Declare folders for mounted images and temp files -$WORKING_PATH = "C:\mediaRefresh\temp" -$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia" -$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia" -$MAIN_OS_MOUNT = $WORKING_PATH + "\MainOSMount" -$WINRE_MOUNT = $WORKING_PATH + "\WinREMount" -$WINPE_MOUNT = $WORKING_PATH + "\WinPEMount" +$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia" +$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia" +$WORKING_PATH = "C:\mediaRefresh\temp" +$MAIN_OS_MOUNT = "C:\mediaRefresh\temp\MainOSMount" +$WINRE_MOUNT = "C:\mediaRefresh\temp\WinREMount" +$WINPE_MOUNT = "C:\mediaRefresh\temp\WinPEMount" # Mount the language pack ISO -Write-Host "$(Get-TS): Mounting LP ISO" +Write-Output "$(Get-TS): Mounting LP ISO" $LP_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter # Declare language related cabs -$WINPE_OC_PATH = Join-Path $LP_ISO_DRIVE_LETTER":" -ChildPath "Windows Preinstallation Environment" | Join-Path -ChildPath "x64" | Join-Path -ChildPath "WinPE_OCs" -$WINPE_OC_LANG_PATH = Join-Path $WINPE_OC_PATH $LANG -$WINPE_OC_LANG_CABS = Get-ChildItem $WINPE_OC_LANG_PATH -name -$WINPE_OC_LP_PATH = Join-Path $WINPE_OC_LANG_PATH "lp.cab" -$WINPE_FONT_SUPPORT_PATH = Join-Path $WINPE_OC_PATH "WinPE-FontSupport-$LANG.cab" -$WINPE_SPEECH_TTS_PATH = Join-Path $WINPE_OC_PATH "WinPE-Speech-TTS.cab" -$WINPE_SPEECH_TTS_LANG_PATH = Join-Path $WINPE_OC_PATH "WinPE-Speech-TTS-$LANG.cab" -$OS_LP_PATH = $LP_ISO_DRIVE_LETTER + ":\x64\langpacks\" + "Microsoft-Windows-Client-Language-Pack_x64_" + $LANG + ".cab" +$WINPE_OC_PATH = "$LP_ISO_DRIVE_LETTER`:\Windows Preinstallation Environment\x64\WinPE_OCs" +$WINPE_OC_LANG_PATH = "$WINPE_OC_PATH\$LANG" +$WINPE_OC_LANG_CABS = Get-ChildItem $WINPE_OC_LANG_PATH -Name +$WINPE_OC_LP_PATH = "$WINPE_OC_LANG_PATH\lp.cab" +$WINPE_FONT_SUPPORT_PATH = "$WINPE_OC_PATH\WinPE-FontSupport-$LANG.cab" +$WINPE_SPEECH_TTS_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS.cab" +$WINPE_SPEECH_TTS_LANG_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS-$LANG.cab" +$OS_LP_PATH = "$LP_ISO_DRIVE_LETTER`:\x64\langpacks\Microsoft-Windows-Client-Language-Pack_x64_$LANG.cab" # Mount the Features on Demand ISO -Write-Host "$(Get-TS): Mounting FOD ISO" +Write-Output "$(Get-TS): Mounting FOD ISO" $FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter $FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\" @@ -160,41 +160,42 @@ New-Item -ItemType directory -Path $MAIN_OS_MOUNT -ErrorAction stop | Out-Null New-Item -ItemType directory -Path $WINRE_MOUNT -ErrorAction stop | Out-Null New-Item -ItemType directory -Path $WINPE_MOUNT -ErrorAction stop | Out-Null -# Keep the original media, make a copy of it for the new, updateed media. -Write-Host "$(Get-TS): Copying original media to new media path" +# Keep the original media, make a copy of it for the new, updated media. +Write-Output "$(Get-TS): Copying original media to new media path" Copy-Item -Path $MEDIA_OLD_PATH"\*" -Destination $MEDIA_NEW_PATH -Force -Recurse -ErrorAction stop | Out-Null Get-ChildItem -Path $MEDIA_NEW_PATH -Recurse | Where-Object { -not $_.PSIsContainer -and $_.IsReadOnly } | ForEach-Object { $_.IsReadOnly = $false } ``` + ### Update WinRE -The script assumes that only a single edition is being updated, indicated by Index = 1 (Windows 10 Education Edition). Then the script mounts the image, saves Winre.wim to the working folder, and mounts it. It then applies servicing stack Dynamic Update, since its s are used for updating other s. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package. +The script assumes that only a single edition is being updated, indicated by Index = 1 (Windows 10 Education Edition). Then the script mounts the image, saves Winre.wim to the working folder, and mounts it. It then applies servicing stack Dynamic Update, since its components are used for updating other components. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package. It finishes by cleaning and exporting the image to reduce the image size. > [!NOTE] -> Skip adding the latest cumulative update to Winre.wim because it contains unnecessary s in the recovery environment. The s that are updated and applicable are contained in the safe operating system Dynamic Update package. This also helps to keep the image small. +> Skip adding the latest cumulative update to Winre.wim because it contains unnecessary components in the recovery environment. The components that are updated and applicable are contained in the safe operating system Dynamic Update package. This also helps to keep the image small. -``` +```powershell # Mount the main operating system, used throughout the script -Write-Host "$(Get-TS): Mounting main OS" +Write-Output "$(Get-TS): Mounting main OS" Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null # # update Windows Recovery Environment (WinRE) # Copy-Item -Path $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Destination $WORKING_PATH"\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Mounting WinRE" +Write-Output "$(Get-TS): Mounting WinRE" Mount-WindowsImage -ImagePath $WORKING_PATH"\winre.wim" -Index 1 -Path $WINRE_MOUNT -ErrorAction stop | Out-Null # Add servicing stack update -Write-Host "$(Get-TS): Adding package $SSU_PATH" +Write-Output "$(Get-TS): Adding package $SSU_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null # # Optional: Add the language to recovery environment # # Install lp.cab cab -Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH" +Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null # Install language cabs for each optional package installed @@ -210,7 +211,7 @@ Foreach ($PACKAGE in $WINRE_INSTALLED_OC) { $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB - Write-Host "$(Get-TS): Adding package $OC_CAB_PATH" + Write-Output "$(Get-TS): Adding package $OC_CAB_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null } } @@ -219,7 +220,7 @@ Foreach ($PACKAGE in $WINRE_INSTALLED_OC) { # Add font support for the new language if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { - Write-Host "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null } @@ -227,35 +228,36 @@ if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { - Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null - Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null } } # Add Safe OS -Write-Host "$(Get-TS): Adding package $SAFE_OS_DU_PATH" -Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null +Write-Output "$(Get-TS): Adding package $SAFE_OS_DU_PATH" +Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null # Perform image cleanup -Write-Host "$(Get-TS): Performing image cleanup on WinRE" +Write-Output "$(Get-TS): Performing image cleanup on WinRE" DISM /image:$WINRE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null # Dismount Dismount-WindowsImage -Path $WINRE_MOUNT -Save -ErrorAction stop | Out-Null # Export -Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim" +Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim" Export-WindowsImage -SourceImagePath $WORKING_PATH"\winre.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\winre2.wim" -ErrorAction stop | Out-Null Move-Item -Path $WORKING_PATH"\winre2.wim" -Destination $WORKING_PATH"\winre.wim" -Force -ErrorAction stop | Out-Null ``` + ### Update WinPE This script is similar to the one that updates WinRE, but instead it mounts Boot.wim, applies the packages with the latest cumulative update last, and saves. It repeats this for all images inside of Boot.wim, typically two images. It starts by applying the servicing stack Dynamic Update. Since the script is customizing this media with Japanese, it installs the language pack from the WinPE folder on the language pack ISO. Additionally, add font support and text to speech (TTS) support. Since the script is adding a new language, it rebuilds lang.ini, used to identify languages installed in the image. Finally, it cleans and exports Boot.wim, and copies it back to the new media. -``` +```powershell # # update Windows Preinstallation Environment (WinPE) # @@ -266,15 +268,15 @@ $WINPE_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" Foreach ($IMAGE in $WINPE_IMAGES) { # update WinPE - Write-Host "$(Get-TS): Mounting WinPE" + Write-Output "$(Get-TS): Mounting WinPE" Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null # Add SSU - Write-Host "$(Get-TS): Adding package $SSU_PATH" + Write-Output "$(Get-TS): Adding package $SSU_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null # Install lp.cab cab - Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null # Install language cabs for each optional package installed @@ -291,7 +293,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) { $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB - Write-Host "$(Get-TS): Adding package $OC_CAB_PATH" + Write-Output "$(Get-TS): Adding package $OC_CAB_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null } } @@ -300,7 +302,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) { # Add font support for the new language if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { - Write-Host "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null } @@ -308,83 +310,84 @@ Foreach ($IMAGE in $WINPE_IMAGES) { if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { - Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null - Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null } } # Generates a new Lang.ini file which is used to define the language packs inside the image if ( (Test-Path -Path $WINPE_MOUNT"\sources\lang.ini") ) { - Write-Host "$(Get-TS): Updating lang.ini" + Write-Output "$(Get-TS): Updating lang.ini" DISM /image:$WINPE_MOUNT /Gen-LangINI /distribution:$WINPE_MOUNT | Out-Null - } + } # Add latest cumulative update - Write-Host "$(Get-TS): Adding package $LCU_PATH" + Write-Output "$(Get-TS): Adding package $LCU_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null # Perform image cleanup - Write-Host "$(Get-TS): Performing image cleanup on WinPE" + Write-Output "$(Get-TS): Performing image cleanup on WinPE" DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null # Dismount Dismount-WindowsImage -Path $WINPE_MOUNT -Save -ErrorAction stop | Out-Null #Export WinPE - Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim" + Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim" Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\boot2.wim" -ErrorAction stop | Out-Null } Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH"\sources\boot.wim" -Force -ErrorAction stop | Out-Null ``` + ### Update the main operating system For this next phase, there is no need to mount the main operating system, since it was already mounted in the previous scripts. This script starts by applying the servicing stack Dynamic Update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it leverages `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). -Now is the time to enable other Optional Components or add other Features on Demand. If such a feature has an associated cumulative update (for example, .Net), this is the time to apply those. The script then proceeds with applying the latest cumulative update. Finally, the script cleans and exports the image. +Now is the time to enable other Optional Components or add other Features on Demand. If such a feature has an associated cumulative update (for example, .NET), this is the time to apply those. The script then proceeds with applying the latest cumulative update. Finally, the script cleans and exports the image. -You can install Optional Components, along with the .Net feature, offline, but that will require the device to be restarted. This is why the script installs .Net and Optional Components after cleanup and before export. +You can install Optional Components, along with the .NET feature, offline, but that will require the device to be restarted. This is why the script installs .NET and Optional Components after cleanup and before export. -``` +```powershell # # update Main OS # # Add servicing stack update -Write-Host "$(Get-TS): Adding package $SSU_PATH" +Write-Output "$(Get-TS): Adding package $SSU_PATH" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null # Optional: Add language to main OS -Write-Host "$(Get-TS): Adding package $OS_LP_PATH" +Write-Output "$(Get-TS): Adding package $OS_LP_PATH" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null # Optional: Add a Features on Demand to the image -Write-Host "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0" Add-WindowsCapability -Name "Language.Fonts.$LANG_FONT_CAPABILITY~~~und-$LANG_FONT_CAPABILITY~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.Basic~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.OCR~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.Handwriting~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.TextToSpeech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null # Note: If I wanted to enable additional Features on Demand, I'd add these here. # Add latest cumulative update -Write-Host "$(Get-TS): Adding package $LCU_PATH" +Write-Output "$(Get-TS): Adding package $LCU_PATH" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null # Copy our updated recovery image from earlier into the main OS @@ -393,27 +396,27 @@ Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop Copy-Item -Path $WORKING_PATH"\winre.wim" -Destination $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null # Perform image cleanup -Write-Host "$(Get-TS): Performing image cleanup on main OS" +Write-Output "$(Get-TS): Performing image cleanup on main OS" DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null # # Note: If I wanted to enable additional Optional Components, I'd add these here. -# In addition, we'll add .Net 3.5 here as well. Both .Net and Optional Components might require +# In addition, we'll add .NET 3.5 here as well. Both .NET and Optional Components might require # the image to be booted, and thus if we tried to cleanup after installation, it would fail. # -Write-Host "$(Get-TS): Adding NetFX3~~~~" +Write-Output "$(Get-TS): Adding NetFX3~~~~" Add-WindowsCapability -Name "NetFX3~~~~" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -# Add .Net Cumulative Update -Write-Host "$(Get-TS): Adding package $DOTNET_CU_PATH" +# Add .NET Cumulative Update +Write-Output "$(Get-TS): Adding package $DOTNET_CU_PATH" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $DOTNET_CU_PATH -ErrorAction stop | Out-Null # Dismount Dismount-WindowsImage -Path $MAIN_OS_MOUNT -Save -ErrorAction stop | Out-Null # Export -Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim" +Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim" Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\install.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\install2.wim" -ErrorAction stop | Out-Null Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sources\install.wim" -Force -ErrorAction stop | Out-Null ``` @@ -422,20 +425,21 @@ Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sourc This part of the script updates the Setup files. It simply copies the individual files in the Setup Dynamic Update package to the new media. This step brings an updated Setup.exe as needed, along with the latest compatibility database, and replacement component manifests. -``` +```powershell # # update remaining files on media # # Add Setup DU by copy the files from the package into the newMedia -Write-Host "$(Get-TS): Adding package $SETUP_DU_PATH" +Write-Output "$(Get-TS): Adding package $SETUP_DU_PATH" cmd.exe /c $env:SystemRoot\System32\expand.exe $SETUP_DU_PATH -F:* $MEDIA_NEW_PATH"\sources" | Out-Null ``` + ### Finish up As a last step, the script removes the working folder of temporary files, and unmounts our language pack and Features on Demand ISOs. -``` +```powershell # # Perform final cleanup # @@ -444,9 +448,9 @@ As a last step, the script removes the working folder of temporary files, and un Remove-Item -Path $WORKING_PATH -Recurse -Force -ErrorAction stop | Out-Null # Dismount ISO images -Write-Host "$(Get-TS): Dismounting ISO images" +Write-Output "$(Get-TS): Dismounting ISO images" Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Out-Null Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Media refresh completed!" +Write-Output "$(Get-TS): Media refresh completed!" ``` diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index adb1e56155..8997b5e4f9 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -1,6 +1,6 @@ --- title: Olympia Corp enrollment guidelines -description: Olympia Corp enrollment guidelines +description: Learn about the Olympia Corp enrollment and setting up an Azure Active Directory-REGISTERED Windows 10 device or an Azure Active Directory-JOINED Windows 10 device. ms.author: jaimeo ms.topic: article ms.prod: w10 @@ -11,6 +11,7 @@ author: jaimeo ms.reviewer: manager: laurawi keywords: insider, trial, enterprise, lab, corporation, test +ms.custom: seo-marvel-apr2020 --- # Olympia Corp @@ -21,7 +22,7 @@ Windows Insider Lab for Enterprise is intended for Windows Insiders who want to As an Olympia user, you will have an opportunity to: -- Use various enterprise features like Windows Information Protection (WIP), Advanced Threat Protection (ATP), windows Defender Application Guard (WDAG), and Application Virtualization (APP-V). +- Use various enterprise features like Windows Information Protection (WIP), Microsoft Defender for Office 365, Windows Defender Application Guard (WDAG), and Application Virtualization (APP-V). - Learn how Microsoft is preparing for GDPR, as well as enabling enterprise customers to prepare for their own readiness. - Validate and test pre-release software in your environment. - Provide feedback. @@ -60,7 +61,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi 3. Click **Connect** and enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. - ![Set up a work or school account](images/1-3.png) + ![Entering account information when setting up a work or school account](images/1-3.png) 4. Enter the temporary password that was sent to you. Click **Sign in**. Follow the instructions to set a new password. @@ -96,10 +97,10 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi ![Settings -> Accounts](images/1-1.png) 2. If you are already connected to a domain, click the existing account and then click **Disconnect**. Click **Restart Later**. - + 3. Click **Connect**, then click **Join this device to Azure Active Directory**. - ![Update your password](images/2-3.png) + ![Joining device to Azure AD]](images/2-3.png) 4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**. @@ -110,7 +111,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi > [!NOTE] > Passwords should contain 8-16 characters, including at least one special character or number. - ![Update your password](images/2-5.png) + ![Entering temporary password](images/2-5.png) 6. When asked to make sure this is your organization, verify that the information is correct. If so, click **Join**. diff --git a/windows/deployment/update/optional-content.md b/windows/deployment/update/optional-content.md new file mode 100644 index 0000000000..607c9114e4 --- /dev/null +++ b/windows/deployment/update/optional-content.md @@ -0,0 +1,859 @@ +--- +title: Migrating and acquiring optional Windows content +description: Keep language resources and Features on Demand during operating system updates +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Migrating and acquiring optional Windows content during updates + +This article provides some background on the problem of keeping language resources and Features on Demand during operating system updates and offers guidance to help you move forward in the short term and prepare for the long term. + +When you update the operating system, it’s critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows 10 setup using a local Windows image or WIM file (a “media-based” or “task-sequence-based” update). Others do in-place updates using an approved Windows 10 feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a "servicing-based” update). + +Neither approach contains the full set of Windows optional features that a user’s device might need, so those features are not migrated to the new operating system. Further, those features are not available in Configuration Manager or WSUS for on-premises acquisition after a feature update + +## What is optional content? + +Optional content includes the following items: + +- General Features on Demand also referred to as FODs (for example, Windows Mixed Reality) +- Language-based and regional FODs (for example, Language.Basic~~~ja-jp~0.0.1.0) +- Local Experience Packs + +Optional content isn’t included by default in the Windows image file that is part of the operating system media available in the Volume Licensing Service Center (VLSC). Instead, it’s released as an additional ISO file on VLSC. Shipping these features out of the operating system media and shipping them separately reduces the disk footprint of Windows. This provides more space for user’s data. It also reduces the time needed to service the operating system, whether installing a monthly quality update or upgrading to a newer version. A smaller default Windows image also means less data to transmit over the network. + +## Why is acquiring optional content challenging? + +The challenges surrounding optional content typically fall into two groups: + +### Incomplete operating system updates + +The first challenge is related to content migration during a feature update. When Windows Setup performs an in-place update, the new operating is written to the user’s disk alongside the old version. This is a temporary folder, where a second clean operating system is installed and prepared for the user to "move into." When this happens, Windows Setup enumerates optional content installed already in the current version and plans to install the new version of this content in the new operating system. + +Windows Setup needs access to the optional content to do this. Since optional content is not in the Windows image by default, Windows Setup must look elsewhere to get the Windows packages, stage them, and then install them in the new operating system. When the content can’t be found, the result is an update that is missing features on the device, a frustrated end user, and likely a help desk call. This pain point is sometimes referred to "failure to migrate optional content during update." For media-based updates, Windows will automatically try again once the new operating system boots. We call this “latent acquisition.” + +### User-initiated feature acquisition failure + +The second challenge involves a failure to acquire features when a user requests them. Imagine a user running a device with a new version of Windows 10, either by using a clean installation or an in-place update. The user visits Settings, and attempts to install a second language, additional language experience features, or other optional content. Again, since these features are not in the operating system, the packages need to be acquired. For a typical user with internet access, Windows will acquire the features from a nearby Microsoft content delivery network, and everything works as designed. For commercial users, some might not have internet access or have policies to prevent acquisition over the internet. In these situations, Windows must acquire the content from an alternative location. When the content can’t be found, users are frustrated and another help desk call could result. This pain point is sometimes referred to as "failure to acquire optional content.” + +## Options for acquiring optional content + +Most commercial organizations understand the pain points outlined above, and discussions typically start with them asking what plans are available to address these challenges. The following table includes multiple options for consideration, depending on how you are currently deploying Windows 10. In this table, + +- Migration means it supports optional content migration during an update. +- Acquisition means it supports optional content acquisition (that is, initiated by the user). +- Media means it's applicable with media-based deployments. +- Servicing means applicable with servicing-based deployments. + + +|Method |Migration |Acquisition |Media | Servicing | +|---------|---------|---------|---------|--------------| +|Option 1: Use Windows Update | Yes | Yes | No | Yes | +|Option 2: Enable Dynamic Update | Yes | No | Yes |Yes | +|Option 3: Customize the Windows image before deployment | Yes | No | Yes |No | +|Option 4: Install language features during deployment | Partial | No | Yes | No | +|Option 5: Install optional content after deployment | Yes | No |Yes | Yes | +|Option 6: Configure alternative source for Features on Demand | No | Partial | Yes | Yes | + + + +### Option 1: Use Windows Update + +Windows Update for Business solves the optional content problem. Optional content is published and available for acquisition by Windows Setup from a nearby Microsoft content delivery network and acquired using the Unified Update Platform. Optional content migration and acquisition scenarios "just work" when the device is connected to an update service that uses the Unified Update Platform, such as Windows Update or Windows Update for Business. If for some reason a language pack fails to install during the update, the update will automatically roll back. + +Starting with Windows 10, version 1709, we introduced the [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/). The Unified Update Platform is an improvement in the underlying Windows update technology that results in smaller download sizes and a more efficient protocol for checking for updates, acquiring and installing the packages needed, and getting current in one update step. The technology is "unified" because it brings together the update stack for Windows 10, Windows Server, and other products, such as HoloLens. The Unified Update Platform is not currently integrated with WSUS. + +You should consider moving to Windows Update for Business. Not only will the optional content scenario work seamlessly (as it does for consumer devices today), but you also get the full benefits of smaller download sizes also known as Express Updates. Further, devices that use devices are immune to the challenge of upgrading a Windows 10 device where the operating system installation language is inadvertently changed to a new language. Otherwise, any future media-based feature updates can fail when the installation media has a different installation language. See [Upgrading Windows 10 devices with installation media different than the original OS install language](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/upgrading-windows-10-devices-with-installation-media-different/ba-p/746126) for more details, as well as our [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) on this topic. + +### Option 2: Enable Dynamic Update + +If you’re not ready to move to Windows Update, another option is to enable Dynamic Update during a feature update. As soon as a Windows 10 feature update starts, whether via a media-based update or a WSUS-based feature update, Dynamic Update is one of the first steps invoked. Windows 10 Setup connects to an internet-facing URL hosted by Microsoft to fetch Dynamic Update content, and then applies those updates to the operating system installation media. The content acquired includes the following: + +- Setup updates: Fixes to Setup.exe binaries or any files that Setup uses for feature updates. +- Safe OS updates: Fixes for the "safe OS" that are used to update Windows recovery environment (WinRE). +- Servicing stack updates: Fixes that are necessary to address the Windows 10 servicing stack issue and thus required to complete the feature update. +- Latest cumulative update: Installs the latest cumulative quality update. +- Driver updates: Latest version of applicable drivers that have already been published by manufacturers into Windows Update and meant specifically for Dynamic Update. + +In addition to these updates for the new operating system, Dynamic Update will acquire optional content during the update process to ensure that the device has this content present when the update completes. So, although the device is not connected to Windows Update, it will fetch content from a nearby Microsoft content download network (CDN). This addresses the first pain point with optional content, but not user-initiated acquisition. By default, [Dynamic Update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) is enabled by Windows 10 Setup. You can enable or disable Dynamic Update by using the /DynamicUpdate option in Windows Setup. If you use the servicing-based approach, you can set this with setupconfig.ini. See [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. + +Starting in Windows 10, version 2004, Dynamic Update can be configured with additional options. For example, you might want to have the benefits of optional content migration without automatically acquiring the latest quality update. You can do that with the /DynamicUpdate NoLCU option of Windows Setup. Afterward, you would separately follow your existing process for testing and approving monthly updates. The downside of this approach is the device will go through an additional reboot for the latest cumulative update since it was not available during the feature update. + +One additional consideration when using Dynamic Update is the impact to your network. One of the top blockers for this approach is the concern that each device will separately fetch this content from Microsoft. Windows 10, version 2004 setup now downloads Dynamic Update content using Delivery Optimization when available. + For devices that aren’t connected to the internet, a subset of the Dynamic Update content is available by using WSUS and the Microsoft catalog. + +### Option 3: Customize the Windows Image before deployment + + For many organizations, the deployment workflow involves a Configuration Manager task sequence that performs a media-based update. Some customers either don’t have internet connectivity, or the connectivity is poor and so they can’t enable Dynamic Update. In these cases, we recommend installing optional content prior to deployment. This is sometimes referred to as customizing the installation media. + +You can customize the Windows image in these ways: + +- Applying a cumulative (quality) update +- Applying updates to the servicing stack +- Applying updates to Setup.exe binaries or other files that Setup uses for feature updates +- Applying updates for the "safe operating system" (SafeOS) that is used for the Windows recovery environment +- Adding or removing languages +- Adding or removing Features on Demand + +The benefit of this option is that the Windows image can include those additional languages, language experience features, and other Features on Demand through one-time updates to the image. Then you can use them in an existing task sequence or custom deployment where Setup.exe is involved. The downside of this approach is that it requires some preparation of the image in advance, including scripting with DISM to install the additional packages. It also means the image is the same for all devices that consume it and might contain more features than some users need. For more information on customizing your media, see [Updating Windows 10 media with Dynamic Update packages](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/updating-windows-10-media-with-dynamic-update-packages/ba-p/982477) and our [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073). Also like Option 2, you still have a solution for migration of optional content, but not supporting user-initiated optional content acquisition. Also, there is a variation of this option in which media is updated *on the device* just before installation. This allows for device-specific image customization based on what's currently installed. + + +### Option 4: Install language features during deployment + +A partial solution to address the first pain point of failing to migrate optional content during upgrade is to inject a subset of optional content during the upgrade process. This approach uses the Windows 10 Setup option [/InstallLangPacks](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) to add Language Packs and language capabilities such as text-to-speech recognition from a folder that contains the packages. This approach lets an IT pro take a subset of optional content and stage them within their network. If you use the servicing-based approach, you can configure InstallLangPacks using setupconfig.ini. See [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) for details. + +When Setup runs, it will inject these packages into the new operating system during installation. This means it can be an alternative to enabling Dynamic Update or customizing the operating system image before deployment. You must take care with this approach, because the packages cannot be renamed. Further, the content is coming from two separate release media ISOs. The key is to copy both the FOD packages and the FOD metadata .cab from the FOD ISO into the folder, as well as the architecture-specific Language Pack .cabs from the LPLIP ISO. Also, starting with Windows 10, version 1903, the behavior changed. In Windows 10, version 1809 and earlier, failure to install the packages wasn’t a fatal error. Starting with Windows 10, version 1903, we treat InstallLangPacks failures as fatal, and roll back the entire upgrade. The idea is to not leave the user in a bad state since media-based upgrades don’t migrate FOD and languages (unless Dynamic Update is enabled). + +This approach has some interesting benefits. The original Windows image doesn’t need to be modified, possibly saving time and scripting. For some commercial customers, this is implemented as their primary pain point has to do with language support immediately after the update. + +### Option 5: Install optional content after deployment + +This option is like Option 3 in that you customize the operating system image with additional optional content after it’s deployed. IT pros can extend the behavior of Windows Setup by running their own custom action scripts during and after a feature update. See [Run custom actions during feature update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) for details. With this approach, you can create a device-specific migration of optional content by capturing the optional content that is installed in the operating system, and then saving this list to install the same optional content in the new operating system. Like Option 4, you would internally host a network share that contains the source of the optional content packages. Then, during the execution of Setup on the device, capture the list of installed optional content from the source operating system and save. Later, after Setup completes, you use the list to install the optional content, which leaves the user’s device without loss of functionality. + +### Option 6: Configure an alternative source for optional content + +Several of the options address ways to address optional content migration issues during an in-place update. To address the second pain point of easily acquiring optional content in the user-initiated case, you can configure each device by using the Specify settings for optional component installation and component repair Group Policy. This policy setting specifies the network locations that will be used for the repair of operating system corruption and for enabling optional features that have had their payload files removed. This approach has the disadvantage of additional content to be hosted within your network (additional to the operating system image you might be still deploying to some clients) but has the advantage of acquiring content within your network. Some reminders about this policy: + +- The file path to the alternate source must be a fully qualified path; multiple locations can be separated by a semicolon. +- This setting does not support installing language packs from Alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired. +- If this setting is not configured or disabled, files will be downloaded from the default Windows Update location, for example Windows Update for Business or WSUS). + +See [Configure a Windows Repair Source](https://docs.microsoft.com/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) for more information. + + +## Learn more + +For more information about the Unified Update Platform and the approaches outlined in this article, see the following resources: + +- [/InstallLangPacks](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#installlangpacks) +- [/DynamicUpdate](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#dynamicupdate) +- [Configure a Windows Repair Source](https://docs.microsoft.com/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) +- [Ignite 2019 theater session THR3073](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR3073) +- [Ignite 2019 theater session THR4002](https://medius.studios.ms/video/asset/HIGHMP4/IG19-THR4002) +- [Run custom actions during feature update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions) +- [Unified Update Platform](https://blogs.windows.com/windowsexperience/2016/11/03/introducing-unified-update-platform-uup/) +- [Updating Windows 10 media with Dynamic Update packages](media-dynamic-update.md) +- [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) + + +## Sample scripts + +Options 3 and 5 involve the most scripting. Sample scripts for Option 3 already exist, so we’ll look at sample scripts for [Option 5](#option-5-install-optional-content-after-deployment): Install Optional Content after Deployment. + +### Creating an optional content repository + +To get started, we’ll build a repository of optional content and host on a network share. This content is a subset of content from the FOD and language pack ISOs that ship with each release. We’ll configure this repository or repo with only those FODs our organization needs, using DISM /Export. For example, a superset based on taking inventory of optional features installed on existing devices. In this case, we exclude the Windows Mixed Reality feature. In addition, we copy all language packs to the root of the repository. + + + +```powershell +# Declare media for FOD and LPs +$LP_ISO_PATH = "C:\_IMAGE\2004_ISO\CLIENTLANGPACKDVD_OEM_MULTI.iso" +$FOD_ISO_PATH = "C:\_IMAGE\2004_ISO\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" + +# Declare folders +$WORKING_PATH = "C:\_IMAGE\BuildRepo" +$MEDIA_PATH = "C:\_IMAGE\2004_SETUP" + +$MAIN_OS_MOUNT = $WORKING_PATH + "\MainOSMount" +$REPO_PATH = $WORKING_PATH + "\Repo" + +# Create folders for mounting image optional content repository +if (Test-Path $MAIN_OS_MOUNT) { + Remove-Item -Path $MAIN_OS_MOUNT -Force -Recurse -ErrorAction stop| Out-Null +} + +if (Test-Path $REPO_PATH) { + Remove-Item -Path $REPO_PATH -Force -Recurse -ErrorAction stop| Out-Null +} + +New-Item -ItemType Directory -Force -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null +New-Item -ItemType Directory -Force -Path $REPO_PATH -ErrorAction stop| Out-Null + +# Mount the main OS, I'll use this throughout the script +Write-Host "Mounting main OS" +Mount-WindowsImage -ImagePath $MEDIA_PATH"\sources\install.wim" -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null + +# Mount the LP ISO +Write-Host "Mounting LP ISO" +$LP_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter + +# Declare language related cabs +$OS_LP_PATH = $LP_ISO_DRIVE_LETTER + ":\x64\langpacks\" + "*.cab" + +# Mount the FOD ISO +Write-Host "Mounting FOD ISO" +$FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter +$FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\" + +# Export the FODs from the ISO that we are interested in +Write-Host "Exporting FODs to Repo" +DISM /image:$MAIN_OS_MOUNT /export-source /source:$FOD_PATH /target:$REPO_PATH ` + /capabilityname:Accessibility.Braille~~~~0.0.1.0 ` + /capabilityname:App.StepsRecorder~~~~0.0.1.0 ` + /capabilityname:App.WirelessDisplay.Connect~~~~0.0.1.0 ` + /capabilityname:Browser.InternetExplorer~~~~0.0.11.0 ` + /capabilityname:DirectX.Configuration.Database~~~~0.0.1.0 ` + /capabilityname:Language.Basic~~~af-za~0.0.1.0 ` + /capabilityname:Language.Basic~~~ar-sa~0.0.1.0 ` + /capabilityname:Language.Basic~~~as-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~az-latn-az~0.0.1.0 ` + /capabilityname:Language.Basic~~~ba-ru~0.0.1.0 ` + /capabilityname:Language.Basic~~~be-by~0.0.1.0 ` + /capabilityname:Language.Basic~~~bg-bg~0.0.1.0 ` + /capabilityname:Language.Basic~~~bn-bd~0.0.1.0 ` + /capabilityname:Language.Basic~~~bn-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~bs-latn-ba~0.0.1.0 ` + /capabilityname:Language.Basic~~~ca-es~0.0.1.0 ` + /capabilityname:Language.Basic~~~cs-cz~0.0.1.0 ` + /capabilityname:Language.Basic~~~cy-gb~0.0.1.0 ` + /capabilityname:Language.Basic~~~da-dk~0.0.1.0 ` + /capabilityname:Language.Basic~~~de-ch~0.0.1.0 ` + /capabilityname:Language.Basic~~~de-de~0.0.1.0 ` + /capabilityname:Language.Basic~~~el-gr~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-au~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-ca~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-gb~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~en-us~0.0.1.0 ` + /capabilityname:Language.Basic~~~es-es~0.0.1.0 ` + /capabilityname:Language.Basic~~~es-mx~0.0.1.0 ` + /capabilityname:Language.Basic~~~es-us~0.0.1.0 ` + /capabilityname:Language.Basic~~~et-ee~0.0.1.0 ` + /capabilityname:Language.Basic~~~eu-es~0.0.1.0 ` + /capabilityname:Language.Basic~~~fa-ir~0.0.1.0 ` + /capabilityname:Language.Basic~~~fi-fi~0.0.1.0 ` + /capabilityname:Language.Basic~~~fil-ph~0.0.1.0 ` + /capabilityname:Language.Basic~~~fr-be~0.0.1.0 ` + /capabilityname:Language.Basic~~~fr-ca~0.0.1.0 ` + /capabilityname:Language.Basic~~~fr-ch~0.0.1.0 ` + /capabilityname:Language.Basic~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.Basic~~~ga-ie~0.0.1.0 ` + /capabilityname:Language.Basic~~~gd-gb~0.0.1.0 ` + /capabilityname:Language.Basic~~~gl-es~0.0.1.0 ` + /capabilityname:Language.Basic~~~gu-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~ha-latn-ng~0.0.1.0 ` + /capabilityname:Language.Basic~~~haw-us~0.0.1.0 ` + /capabilityname:Language.Basic~~~he-il~0.0.1.0 ` + /capabilityname:Language.Basic~~~hi-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~hr-hr~0.0.1.0 ` + /capabilityname:Language.Basic~~~hu-hu~0.0.1.0 ` + /capabilityname:Language.Basic~~~hy-am~0.0.1.0 ` + /capabilityname:Language.Basic~~~id-id~0.0.1.0 ` + /capabilityname:Language.Basic~~~ig-ng~0.0.1.0 ` + /capabilityname:Language.Basic~~~is-is~0.0.1.0 ` + /capabilityname:Language.Basic~~~it-it~0.0.1.0 ` + /capabilityname:Language.Basic~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.Basic~~~ka-ge~0.0.1.0 ` + /capabilityname:Language.Basic~~~kk-kz~0.0.1.0 ` + /capabilityname:Language.Basic~~~kl-gl~0.0.1.0 ` + /capabilityname:Language.Basic~~~kn-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~kok-deva-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~ko-kr~0.0.1.0 ` + /capabilityname:Language.Basic~~~ky-kg~0.0.1.0 ` + /capabilityname:Language.Basic~~~lb-lu~0.0.1.0 ` + /capabilityname:Language.Basic~~~lt-lt~0.0.1.0 ` + /capabilityname:Language.Basic~~~lv-lv~0.0.1.0 ` + /capabilityname:Language.Basic~~~mi-nz~0.0.1.0 ` + /capabilityname:Language.Basic~~~mk-mk~0.0.1.0 ` + /capabilityname:Language.Basic~~~ml-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~mn-mn~0.0.1.0 ` + /capabilityname:Language.Basic~~~mr-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~ms-bn~0.0.1.0 ` + /capabilityname:Language.Basic~~~ms-my~0.0.1.0 ` + /capabilityname:Language.Basic~~~mt-mt~0.0.1.0 ` + /capabilityname:Language.Basic~~~nb-no~0.0.1.0 ` + /capabilityname:Language.Basic~~~ne-np~0.0.1.0 ` + /capabilityname:Language.Basic~~~nl-nl~0.0.1.0 ` + /capabilityname:Language.Basic~~~nn-no~0.0.1.0 ` + /capabilityname:Language.Basic~~~nso-za~0.0.1.0 ` + /capabilityname:Language.Basic~~~or-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~pa-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~pl-pl~0.0.1.0 ` + /capabilityname:Language.Basic~~~ps-af~0.0.1.0 ` + /capabilityname:Language.Basic~~~pt-br~0.0.1.0 ` + /capabilityname:Language.Basic~~~pt-pt~0.0.1.0 ` + /capabilityname:Language.Basic~~~rm-ch~0.0.1.0 ` + /capabilityname:Language.Basic~~~ro-ro~0.0.1.0 ` + /capabilityname:Language.Basic~~~ru-ru~0.0.1.0 ` + /capabilityname:Language.Basic~~~rw-rw~0.0.1.0 ` + /capabilityname:Language.Basic~~~sah-ru~0.0.1.0 ` + /capabilityname:Language.Basic~~~si-lk~0.0.1.0 ` + /capabilityname:Language.Basic~~~sk-sk~0.0.1.0 ` + /capabilityname:Language.Basic~~~sl-si~0.0.1.0 ` + /capabilityname:Language.Basic~~~sq-al~0.0.1.0 ` + /capabilityname:Language.Basic~~~sr-cyrl-rs~0.0.1.0 ` + /capabilityname:Language.Basic~~~sr-latn-rs~0.0.1.0 ` + /capabilityname:Language.Basic~~~sv-se~0.0.1.0 ` + /capabilityname:Language.Basic~~~sw-ke~0.0.1.0 ` + /capabilityname:Language.Basic~~~ta-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~te-in~0.0.1.0 ` + /capabilityname:Language.Basic~~~tg-cyrl-tj~0.0.1.0 ` + /capabilityname:Language.Basic~~~th-th~0.0.1.0 ` + /capabilityname:Language.Basic~~~tk-tm~0.0.1.0 ` + /capabilityname:Language.Basic~~~tn-za~0.0.1.0 ` + /capabilityname:Language.Basic~~~tr-tr~0.0.1.0 ` + /capabilityname:Language.Basic~~~tt-ru~0.0.1.0 ` + /capabilityname:Language.Basic~~~ug-cn~0.0.1.0 ` + /capabilityname:Language.Basic~~~uk-ua~0.0.1.0 ` + /capabilityname:Language.Basic~~~ur-pk~0.0.1.0 ` + /capabilityname:Language.Basic~~~uz-latn-uz~0.0.1.0 ` + /capabilityname:Language.Basic~~~vi-vn~0.0.1.0 ` + /capabilityname:Language.Basic~~~wo-sn~0.0.1.0 ` + /capabilityname:Language.Basic~~~xh-za~0.0.1.0 ` + /capabilityname:Language.Basic~~~yo-ng~0.0.1.0 ` + /capabilityname:Language.Basic~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.Basic~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.Basic~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.Basic~~~zu-za~0.0.1.0 ` + /capabilityname:Language.Fonts.Arab~~~und-Arab~0.0.1.0 ` + /capabilityname:Language.Fonts.Beng~~~und-Beng~0.0.1.0 ` + /capabilityname:Language.Fonts.Cans~~~und-Cans~0.0.1.0 ` + /capabilityname:Language.Fonts.Cher~~~und-Cher~0.0.1.0 ` + /capabilityname:Language.Fonts.Deva~~~und-Deva~0.0.1.0 ` + /capabilityname:Language.Fonts.Ethi~~~und-Ethi~0.0.1.0 ` + /capabilityname:Language.Fonts.Gujr~~~und-Gujr~0.0.1.0 ` + /capabilityname:Language.Fonts.Guru~~~und-Guru~0.0.1.0 ` + /capabilityname:Language.Fonts.Hans~~~und-Hans~0.0.1.0 ` + /capabilityname:Language.Fonts.Hant~~~und-Hant~0.0.1.0 ` + /capabilityname:Language.Fonts.Hebr~~~und-Hebr~0.0.1.0 ` + /capabilityname:Language.Fonts.Jpan~~~und-Jpan~0.0.1.0 ` + /capabilityname:Language.Fonts.Khmr~~~und-Khmr~0.0.1.0 ` + /capabilityname:Language.Fonts.Knda~~~und-Knda~0.0.1.0 ` + /capabilityname:Language.Fonts.Kore~~~und-Kore~0.0.1.0 ` + /capabilityname:Language.Fonts.Laoo~~~und-Laoo~0.0.1.0 ` + /capabilityname:Language.Fonts.Mlym~~~und-Mlym~0.0.1.0 ` + /capabilityname:Language.Fonts.Orya~~~und-Orya~0.0.1.0 ` + /capabilityname:Language.Fonts.PanEuropeanSupplementalFonts~~~0.0.1.0 ` + /capabilityname:Language.Fonts.Sinh~~~und-Sinh~0.0.1.0 ` + /capabilityname:Language.Fonts.Syrc~~~und-Syrc~0.0.1.0 ` + /capabilityname:Language.Fonts.Taml~~~und-Taml~0.0.1.0 ` + /capabilityname:Language.Fonts.Telu~~~und-Telu~0.0.1.0 ` + /capabilityname:Language.Fonts.Thai~~~und-Thai~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~af-za~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~bs-latn-ba~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ca-es~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~cs-cz~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~cy-gb~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~da-dk~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~de-de~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~el-gr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~en-gb~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~en-us~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~es-es~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~es-mx~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~eu-es~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~fi-fi~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ga-ie~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~gd-gb~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~gl-es~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~hi-in~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~hr-hr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~id-id~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~it-it~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ko-kr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~lb-lu~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~mi-nz~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ms-bn~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ms-my~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~nb-no~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~nl-nl~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~nn-no~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~nso-za~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~pl-pl~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~pt-br~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~pt-pt~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~rm-ch~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ro-ro~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~ru-ru~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~rw-rw~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sk-sk~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sl-si~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sq-al~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sr-cyrl-rs~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sr-latn-rs~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sv-se~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~sw-ke~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~tn-za~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~tr-tr~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~wo-sn~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~xh-za~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.Handwriting~~~zu-za~0.0.1.0 ` + /capabilityname:Language.LocaleData~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.OCR~~~ar-sa~0.0.1.0 ` + /capabilityname:Language.OCR~~~bg-bg~0.0.1.0 ` + /capabilityname:Language.OCR~~~bs-latn-ba~0.0.1.0 ` + /capabilityname:Language.OCR~~~cs-cz~0.0.1.0 ` + /capabilityname:Language.OCR~~~da-dk~0.0.1.0 ` + /capabilityname:Language.OCR~~~de-de~0.0.1.0 ` + /capabilityname:Language.OCR~~~el-gr~0.0.1.0 ` + /capabilityname:Language.OCR~~~en-gb~0.0.1.0 ` + /capabilityname:Language.OCR~~~en-us~0.0.1.0 ` + /capabilityname:Language.OCR~~~es-es~0.0.1.0 ` + /capabilityname:Language.OCR~~~es-mx~0.0.1.0 ` + /capabilityname:Language.OCR~~~fi-fi~0.0.1.0 ` + /capabilityname:Language.OCR~~~fr-ca~0.0.1.0 ` + /capabilityname:Language.OCR~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.OCR~~~hr-hr~0.0.1.0 ` + /capabilityname:Language.OCR~~~hu-hu~0.0.1.0 ` + /capabilityname:Language.OCR~~~it-it~0.0.1.0 ` + /capabilityname:Language.OCR~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.OCR~~~ko-kr~0.0.1.0 ` + /capabilityname:Language.OCR~~~nb-no~0.0.1.0 ` + /capabilityname:Language.OCR~~~nl-nl~0.0.1.0 ` + /capabilityname:Language.OCR~~~pl-pl~0.0.1.0 ` + /capabilityname:Language.OCR~~~pt-br~0.0.1.0 ` + /capabilityname:Language.OCR~~~pt-pt~0.0.1.0 ` + /capabilityname:Language.OCR~~~ro-ro~0.0.1.0 ` + /capabilityname:Language.OCR~~~ru-ru~0.0.1.0 ` + /capabilityname:Language.OCR~~~sk-sk~0.0.1.0 ` + /capabilityname:Language.OCR~~~sl-si~0.0.1.0 ` + /capabilityname:Language.OCR~~~sr-cyrl-rs~0.0.1.0 ` + /capabilityname:Language.OCR~~~sr-latn-rs~0.0.1.0 ` + /capabilityname:Language.OCR~~~sv-se~0.0.1.0 ` + /capabilityname:Language.OCR~~~tr-tr~0.0.1.0 ` + /capabilityname:Language.OCR~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.OCR~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.OCR~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.Speech~~~da-dk~0.0.1.0 ` + /capabilityname:Language.Speech~~~de-de~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-au~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-ca~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-gb~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-in~0.0.1.0 ` + /capabilityname:Language.Speech~~~en-us~0.0.1.0 ` + /capabilityname:Language.Speech~~~es-es~0.0.1.0 ` + /capabilityname:Language.Speech~~~es-mx~0.0.1.0 ` + /capabilityname:Language.Speech~~~fr-ca~0.0.1.0 ` + /capabilityname:Language.Speech~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.Speech~~~it-it~0.0.1.0 ` + /capabilityname:Language.Speech~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.Speech~~~pt-br~0.0.1.0 ` + /capabilityname:Language.Speech~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.Speech~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.Speech~~~zh-tw~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ar-eg~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ar-sa~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~bg-bg~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ca-es~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~cs-cz~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~da-dk~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~de-at~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~de-ch~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~de-de~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~el-gr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-au~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-ca~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-gb~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-ie~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-in~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~en-us~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~es-es~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~es-mx~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~fi-fi~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~fr-ca~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~fr-ch~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~fr-fr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~he-il~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~hi-in~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~hr-hr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~hu-hu~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~id-id~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~it-it~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ja-jp~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ko-kr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ms-my~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~nb-no~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~nl-be~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~nl-nl~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~pl-pl~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~pt-br~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~pt-pt~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ro-ro~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ru-ru~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~sk-sk~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~sl-si~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~sv-se~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~ta-in~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~th-th~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~tr-tr~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~vi-vn~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~zh-cn~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~zh-hk~0.0.1.0 ` + /capabilityname:Language.TextToSpeech~~~zh-tw~0.0.1.0 ` + /capabilityname:MathRecognizer~~~~0.0.1.0 ` + /capabilityname:Microsoft.Onecore.StorageManagement~~~~0.0.1.0 ` + /capabilityname:Microsoft.WebDriver~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.MSPaint~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.Notepad~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.PowerShell.ISE~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.StorageManagement~~~~0.0.1.0 ` + /capabilityname:Microsoft.Windows.WordPad~~~~0.0.1.0 ` + /capabilityname:Msix.PackagingTool.Driver~~~~0.0.1.0 ` + /capabilityname:NetFX3~~ ` + /capabilityname:Network.Irda~~~~0.0.1.0 ` + /capabilityname:OneCoreUAP.OneSync~~~~0.0.1.0 ` + /capabilityname:OpenSSH.Client~~~~0.0.1.0 ` + /capabilityname:OpenSSH.Server~~~~0.0.1.0 ` + /capabilityname:Print.EnterpriseCloudPrint~~~~0.0.1.0 ` + /capabilityname:Print.Fax.Scan~~~~0.0.1.0 ` + /capabilityname:Print.Management.Console~~~~0.0.1.0 ` + /capabilityname:Print.MopriaCloudService~~~~0.0.1.0 ` + /capabilityname:RasCMAK.Client~~~~0.0.1.0 ` + /capabilityname:RIP.Listener~~~~0.0.1.0 ` + /capabilityname:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.BitLocker.Recovery.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.CertificateServices.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.DHCP.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.Dns.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.FailoverCluster.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.FileServices.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.IPAM.Client.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.LLDP.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.NetworkController.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.NetworkLoadBalancing.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.RemoteAccess.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.RemoteDesktop.Services.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.ServerManager.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.Shielded.VM.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.StorageMigrationService.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.StorageReplica.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.SystemInsights.Management.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.VolumeActivation.Tools~~~~0.0.1.0 ` + /capabilityname:Rsat.WSUS.Tools~~~~0.0.1.0 ` + /capabilityname:ServerCore.AppCompatibility~~~~0.0.1.0 ` + /capabilityname:SNMP.Client~~~~0.0.1.0 ` + /capabilityname:Tools.DeveloperMode.Core~~~~0.0.1.0 ` + /capabilityname:Tools.Graphics.DirectX~~~~0.0.1.0 ` + /capabilityname:Windows.Client.ShellComponents~~~~0.0.1.0 ` + /capabilityname:Windows.Desktop.EMS-SAC.Tools~~~~0.0.1.0 ` + /capabilityname:WMI-SNMP-Provider.Client~~~~0.0.1.0 ` + /capabilityname:XPS.Viewer~~~~0.0.1.0 + + # This one is large, lets skip for now + #/capabilityname:Analog.Holographic.Desktop~~~~0.0.1.0 ` + + +# Copy language caps to the repo +Copy-Item -Path $OS_LP_PATH -Destination $REPO_PATH -Force -ErrorAction stop | Out-Null + +# Dismount OS image +Dismount-WindowsImage -Path $MAIN_OS_MOUNT -Discard -ErrorAction ignore | Out-Null + +# Dismount ISO images +Write-Host "Dismounting ISO images" +Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction ignore | Out-Null +Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction ignore | Out-Null + +``` + +### Saving optional content in the source operating system + +To save optional content state in the source operating system, we create a custom action script to run before the operating system installs. In this script, we save optional features and language resources to a file. We also make a local copy of the repo with only those files needed based on the languages installed on the source operating system. This will limit the files to copy. + + +```powershell +$OUTPUT_PATH = "C:\TEMP\" +$LOG_PATH = $OUTPUT_PATH + "log.txt" +$OUTPUT_PATH = "C:\TEMP\" +$LOG_PATH = $OUTPUT_PATH + "log.txt" +$LANG_PATH = $OUTPUT_PATH + "sourceLang.txt" +$CAP_PATH = $OUTPUT_PATH + "sourceCapability.txt" +$OSVERSION_PATH = $OUTPUT_PATH + "sourceVersion.txt" +$REPO_PATH = "Z:\Repo\" +$LOCAL_REPO_PATH = $OUTPUT_PATH + "Local_Repo\" + +Function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) } + +Function Log +{ + param ( + [Parameter(Mandatory=$True)] + [string]$MESSAGE + ) + + $M = "$(Get-TS): PreInstall: $MESSAGE" + Write-Host $M + Add-Content -Path $LOG_PATH -Value $M + + } + +Function IsLangFile +{ + param ( + [Parameter(Mandatory=$True)] + [string]$PATH + ) + + if (($PATH -match '[-_~]ar[-_~]') -or ($PATH -match '[-_~]bg[-_~]') -or ($PATH -match '[-_~]cs[-_~]') -or ` + ($PATH -match '[-_~]da[-_~]') -or ($PATH -match '[-_~]de[-_~]') -or ($PATH -match '[-_~]el[-_~]') -or ` + ($PATH -match '[-_~]en[-_~]') -or ($PATH -match '[-_~]es[-_~]') -or ($PATH -match '[-_~]et[-_~]') -or ` + ($PATH -match '[-_~]fi[-_~]') -or ($PATH -match '[-_~]fr[-_~]') -or ($PATH -match '[-_~]he[-_~]') -or ` + ($PATH -match '[-_~]hr[-_~]') -or ($PATH -match '[-_~]hu[-_~]') -or ($PATH -match '[-_~]it[-_~]') -or ` + ($PATH -match '[-_~]ja[-_~]') -or ($PATH -match '[-_~]ko[-_~]') -or ($PATH -match '[-_~]lt[-_~]') -or ` + ($PATH -match '[-_~]lv[-_~]') -or ($PATH -match '[-_~]nb[-_~]') -or ($PATH -match '[-_~]nl[-_~]') -or ` + ($PATH -match '[-_~]pl[-_~]') -or ($PATH -match '[-_~]pt[-_~]') -or ($PATH -match '[-_~]ro[-_~]') -or ` + ($PATH -match '[-_~]ru[-_~]') -or ($PATH -match '[-_~]sk[-_~]') -or ($PATH -match '[-_~]sl[-_~]') -or ` + ($PATH -match '[-_~]sv[-_~]') -or ($PATH -match '[-_~]th[-_~]') -or ($PATH -match '[-_~]tr[-_~]') -or ` + ($PATH -match '[-_~]uk[-_~]') -or ($PATH -match '[-_~]zh[-_~]') -or ($PATH -match '[-_~]sr[-_~]')) { + return $True + } + else { + return $False + } + } + +# Remove the log +Remove-Item -Path $LOG_PATH -Force -ErrorAction ignore | Out-Null +Log "Starting" + +# Remove state files, keep repo if it exists +Remove-Item -Path $LANG_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $CAP_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $OSVERSION_PATH -Force -ErrorAction ignore | Out-Null + +# Get OS version, to use later for detecting compat scans versus OS installation +$OSINFO = Get-CimInstance Win32_OperatingSystem +Log "OS Version: $($OSINFO.Version)" +Add-Content -Path $OSVERSION_PATH -Value $OSINFO.Version + +# Get installed languages from international settings +$INTL = DISM.exe /Online /Get-Intl /English + +# Save only output lines with installed languages +$LANGUAGES = $INTL | Select-String -SimpleMatch 'Installed language(s)' + +# Replace with null so we have a simple list of language codes +$LANGUAGES = $LANGUAGES | ForEach-Object {$_.Line.Replace("Installed language(s): ","")} + +# Save System Language, save only output line with default system language +$SYSLANG = $INTL | Select-String -SimpleMatch 'Default system UI language' + +# Replace with null so we have the language code +$SYSLANG = $SYSLANG | ForEach-Object {$_.Line.Replace("Default system UI language : ","")} + +# Save these languages +Log "Default system UI language on source OS: $($SYSLANG)" +ForEach ($ITEM in $LANGUAGES) { + Log "Installed language on source OS: $($ITEM)" + Add-Content -Path $LANG_PATH -Value $ITEM +} + +# Get and save installed packages, we'll use this for debugging +$PACKAGES = Get-WindowsPackage -Online +ForEach ($ITEM in $PACKAGES) { + if($ITEM.PackageState -eq "Installed") { + Log "Package $($ITEM.PackageName) is installed" + } +} + +# Get and save capabilities +$CAPABILITIES = Get-WindowsCapability -Online +ForEach ($ITEM in $CAPABILITIES) { + if($ITEM.State -eq "Installed") { + Log "Capability $($ITEM.Name) is installed" + Add-Content -Path $CAP_PATH -Value $ITEM.Name + } +} + +# Copy a subset of the Repo files locally, all neutral files and the languages needed +$REPO_FILES = Get-ChildItem $REPO_PATH -file -Recurse +ForEach ($FILE in $REPO_FILES) { + $PATH = ($FILE.DirectoryName + "\") -Replace [Regex]::Escape($REPO_PATH), $LOCAL_REPO_PATH + If (!(Test-Path $Path)) { + New-Item -ItemType Directory -Path $PATH -Force | Out-Null + } + If ((IsLangFile $FILE.Name)) { + + # Only copy those files where we need the primary languages from the source OS + ForEach ($ITEM in $LANGUAGES) { + if ($FILE.Name -match $Item) { + + If (!(Test-Path (Join-Path $Path $File.Name))) { + Copy-Item $FILE.FullName -Destination $PATH -Force + Log "Copied file $($FILE.FullName) to local repository" + } + else { + Log "File $($FILE.Name) already exists in local repository" + } + } + } + } Else { + + # Copy all 'neutral files' and those language specific that are not in the core 38 + If (!(Test-Path (Join-Path $Path $File.Name))) { + Copy-Item $FILE.FullName -Destination $PATH -Force + Log "Copied file $($FILE.FullName) to local repository" + } + else { + Log "File $($FILE.Name) already exists in local repository" + } + } +} + +Log ("Exiting") + +``` + +### Adding optional content in the target operating system + +After setup has completed successfully, we use success.cmd to retrieve the optional content state from the source operating system and install in the new operating system only if that’s missing. Then, apply the latest monthly update as a final step. + + +```powershell +$OUTPUT_PATH = "C:\TEMP\" +$LOG_PATH = $OUTPUT_PATH + "log.txt" +$LANG_PATH = $OUTPUT_PATH + "sourceLang.txt" +$CAP_PATH = $OUTPUT_PATH + "sourceCapability.txt" +$OSVERSION_PATH = $OUTPUT_PATH + "sourceVersion.txt" +$LOCAL_REPO_PATH = $OUTPUT_PATH + "Local_Repo\" +$LCU_PATH = $OUTPUT_PATH + "Windows10.0-KB4565503-x64_PSFX.cab" +$PENDING = $false + +Function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) } + +Function Log +{ + param ( + [Parameter(Mandatory=$True)] + [string]$MESSAGE + ) + + $M = "$(Get-TS): PostInstall: $MESSAGE" + Write-Host $M + Add-Content -Path $LOG_PATH -Value $M + + } + +Log "Starting" + +# Get OS version +$OSINFO = Get-CimInstance Win32_OperatingSystem +Log "OS Version: $($OSINFO.Version)" + +# Check for source OS state, just to be sure +if (!(Test-Path $LANG_PATH) -or !(Test-Path $CAP_PATH) -or !(Test-Path $OSVERSION_PATH) ) { + Log "Source OS state is missing." +} + +# If this script is executing and the OS version hasn't changed, let's exit out. +else { + + # Retrive OS version from source OS + $SOURCE_OSVERSION = Get-Content -Path $OSVERSION_PATH + if ($OSINFO.Version -eq $SOURCE_OSVERSION) { + Log "OS Version hasn't changed." + } + + else { + + # Retrive language list from source OS + $SOURCE_LANGUAGES = Get-Content -Path $LANG_PATH + + # Get installed languages from International Settings + $INTL = DISM.exe /Online /Get-Intl /English + + # Save System Language, save only output line with default system language + $SYS_LANG = $INTL | Select-String -SimpleMatch 'Default system UI language' + + # Replace with null so we have the language code + $SYS_LANG = $SYS_LANG | ForEach-Object {$_.Line.Replace("Default system UI language : ","")} + + # Get and save installed packages, we'll use this for debugging + $PACKAGES = Get-WindowsPackage -Online + ForEach ($ITEM in $PACKAGES) { + if($ITEM.PackageState -eq "Installed") { + Log "Package $($ITEM.PackageName) is installed" + } + } + + # Loop through source OS languages, and install if missing on target OS + ForEach ($SOURCE_ITEM in $SOURCE_LANGUAGES) { + if ($SOURCE_ITEM -ne $SYS_LANG) { + + # add missing languages except the system language + Log "Adding language Microsoft-Windows-Client-Language-Pack_x64_$($SOURCE_ITEM).cab" + try { + Add-WindowsPackage -Online -PackagePath "$($LOCAL_REPO_PATH)\Microsoft-Windows-Client-Language-Pack_x64_$($SOURCE_ITEM).cab" -ErrorAction stop | Out-Null + } + catch { + Log $_.Exception.Message + } + } + } + + # Retrieve capabilities from source OS and target OS + $SOURCE_CAPABILITIES = Get-Content -Path $CAP_PATH + $CAPABILITIES = Get-WindowsCapability -Online + + # Loop through source OS capabilities, and install if missing on target OS + ForEach ($SOURCE_ITEM in $SOURCE_CAPABILITIES) { + $INSTALLED = $false + ForEach ($ITEM in $CAPABILITIES) { + if ($ITEM.Name -eq $($SOURCE_ITEM)) { + if ($ITEM.State -eq "Installed") { + $INSTALLED = $true + break + } + } + } + + # Add if not already installed + if (!($INSTALLED)) { + Log "Adding capability $SOURCE_ITEM" + try { + Add-WindowsCapability -Online -Name $SOURCE_ITEM -Source $LOCAL_REPO_PATH -ErrorAction stop | Out-Null + } + catch { + Log $_.Exception.Message + } + } + else { + Log "Capability $SOURCE_ITEM is already installed" + } + } + + # Add LCU, this is required after adding FODs and languages + Log ("Adding LCU") + Add-WindowsPackage -Online -PackagePath $LCU_PATH -NoRestart + + # Get packages, we'll use this for debugging and to see if we need to restart to install + $PACKAGES = Get-WindowsPackage -Online + ForEach ($ITEM in $PACKAGES) { + Log "Package $($ITEM.PackageName) is $($ITEM.PackageState)" + if ($ITEM.PackageState -eq "InstallPending") { + $PENDING = $true + } + } + } +} + +# Remove local repository and state files +Remove-Item -Path $LANG_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $CAP_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $OSVERSION_PATH -Force -ErrorAction ignore | Out-Null +Remove-Item -Path $LOCAL_REPO_PATH -Force -Recurse -ErrorAction ignore | Out-Null + +# Restarting the computer to let setup process to exit cleanly +if ($PENDING) { + Log ("Install pending packages exists, restarting in 10 seconds") + Start-Process -FilePath cmd -ArgumentList "/C shutdown /r /t 10 /f" +} + +Log ("Exiting") +``` \ No newline at end of file diff --git a/windows/deployment/update/plan-define-readiness.md b/windows/deployment/update/plan-define-readiness.md new file mode 100644 index 0000000000..2e371a0df1 --- /dev/null +++ b/windows/deployment/update/plan-define-readiness.md @@ -0,0 +1,113 @@ +--- +title: Define readiness criteria +manager: laurawi +description: Identify important roles and figure out how to classify apps +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +ms.topic: article +ms.collection: m365initiative-coredeploy +--- + +# Define readiness criteria + +## Figure out roles and personnel + +Planning and managing a deployment involves a variety of distinct activities and roles best suited to each. As you plan, it's worth figuring out which roles you'll need to carry out the deployment and who should fill them. Different roles are active at various phases of a deployment. Depending on the size and complexity of your organization, some of the roles could be filled by the same person. However, it's best to have an established *process manager*, who will oversee all of the tasks for the deployment. + +### Process manager + +The process manager leads the update deployment process and has the authority to push the process forward--or halt it if necessary. They also have responsibilities in organizing these activities: + + +|Compatibility workstream |Deployment |Capability and modernization | +|---------|---------|---------| +|[Assigning application priority](#set-criteria-for-rating-apps) | Reviewing infrastructure requirements | Determining infrastructure changes | +|Application assessment | Validating infrastructure against requirements | Determining configuration changes | +|Device assessment | Creating infrastructure update plan | Create capability proposal | + +It's the process manager's role to collect reports on remediation efforts, escalate failures, and to decide whether your environment is ready for pilot deployment and then broad deployment. + + +This table sketches out one view of the other roles, with their responsibilities, relevant skills, and the deployment phases where they are needed: + + +|Role |Responsibilities |Skills |Active phases | +|---------|---------|---------|---------| +|Process manager | Manages the process end to end; ensures inputs and outputs are captures; ensures that activities progress | IT Service Management | Plan, prepare, pilot deployment, broad deployment | +|Application owner | Define application test plan; assign user acceptance testers; certify the application | Knowledge of critical and important applications | Plan, prepare, pilot deployment | +|Application developer | Ensure apps are developed to stay compatible with current Windows versions | Application development; application remediation | Plan, prepare | +|End-user computing | Typically a group including infrastructure engineers or deployment engineers who ensure upgrade tools are compatible with Windows | Bare-metal deployment; infrastructure management; application delivery; update management | Plan, prepare, pilot deployment, broad deployment | +|Operations | Ensure that support is available for current Windows version. Provide post-deployment support, including user communication and rollbacks. | Platform security | Prepare, pilot deployment, broad deployment | +|Security | Review and approve the security baseline and tools | Platform security | Prepare, pilot deployment | +|Stakeholders | Represent groups affected by updates, for example, heads of finance, end-user services, or change management | Key decision maker for a business unit or department | Plan, pilot deployment, broad deployment | + + + + + + +## Set criteria for rating apps + +Some apps in your environment are fundamental to your core business activities. Other apps help workers perform their roles, but aren’t critical to your business operations. Before you start inventorying and assessing the apps in your environment, you should establish some criteria for categorizing your apps, and then determine a priority for each. This process will help you understand how best to deploy updates and how to resolve any issues that could arise. + +In the Prepare phase, you'll apply the criteria you define now to every app in your organization. + +Here's a suggested classification scheme: + + +|Classification |Definition| +|---------|---------| +|Critical | The most vital applications that handle core business activities and processes. If these applications were not available, the business, or a business unit, couldn't function at all. | +|Important | Applications that individual staff members need to support their productivity. Downtime here would affect individual users, but would only have a minimal impact on the business. | +|Not important | There is no impact on the business if these apps are not available for a while. | + +Once you have classified your applications, you should agree what each classification means to the organization in terms of priority and severity. This activity will help ensure that you can triage problems with the right level of urgency. You should assign each app a time-based priority. + +Here's an example priority rating system; the specifics could vary for your organization: + + +|Priority |Definition | +|---------|---------| +|1 | Any issues or risks identified must be investigated and resolved as soon as possible. | +|2 | Start investigating risks and issues within two business days and fix them *during* the current deployment cycle. | +|3 | Start investigating risks and issues within 10 business days. You don’t have to fix them all within the current deployment cycle. However, all issues must be fixed by the end of the next deployment cycle. | +|4 | Start investigating risks and issues within 20 business days. You can fix them in the current or any future development cycle. | + +Related to priority, but distinct, is the concept of severity. You should define a severity ranking as well, based on how you feel a problem with an app should affect the deployment cycle. + +Here's an example: + + +|Severity |Effect | +|---------|---------| +|1 | Work stoppage or loss of revenue | +|2 | Productivity loss for a business unit | +|3 | Productivity loss for individual users | +|4 | Minimal impact on users | + +## Example: a large financial corporation + +Using the suggested scheme, a financial corporation might classify their apps like this: + + +|App |Classification | +|---------|---------| +|Credit processing app | Critical | +|Frontline customer service app | Critical | +|PDF viewer | Important | +|Image-processing app | Not important | + +Further, they might combine this classification with severity and priority rankings like this: + + +|Classification |Severity |Priority |Response | +|---------|---------|---------|---------| +|Critical | 1 or 2 | 1 or 2 | For 1, stop deployment until resolved; for 2, stop deployment for affected devices or users only. | +|Important | 3 or 4 | 3 or 4 | For 3, continue deployment, even for affected devices, as long as there is workaround guidance. | +|Not important | 4 | 4 | Continue deployment for all devices. | + diff --git a/windows/deployment/update/plan-define-strategy.md b/windows/deployment/update/plan-define-strategy.md new file mode 100644 index 0000000000..bb67966504 --- /dev/null +++ b/windows/deployment/update/plan-define-strategy.md @@ -0,0 +1,51 @@ +--- +title: Define update strategy +description: Two examples of a calendar-based approach to consistent update installation +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, tools +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.topic: article +ms.collection: m365initiative-coredeploy +--- + +# Define update strategy with a calendar + +Traditionally, organizations treated the deployment of operating system updates (especially feature updates) as a discrete project that had a beginning, a middle, and an end. A release was "built" (usually in the form of an image) and then distributed to users and their devices. + +Today, more organizations are treating deployment as a continual process of updates that roll out across the organization in waves. In this approach, an update is plugged into this process and while it runs, you monitor for anomalies, errors, or user impact and respond as issues arise--without interrupting the entire process. Microsoft has been evolving its Windows 10 release cycles, update mechanisms, and relevant tools to support this model. Feature updates are released twice per year, around March and September. All releases of Windows 10 have 18 months of servicing for all editions. Fall releases of the Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. + +Though we encourage you to deploy every available release and maintain a fast cadence for some portion of your environment, we also recognize that you might have a large number of devices, and a need for little or no disruption, and so you might choose to update annually. The 18/30 month lifecycle cadence lets you allow some portion of your environment to move faster while a majority can move less quickly. + +## Calendar approaches +You can use a calendar approach for either a faster twice-per-year cadence or an annual cadence. Depending on company size, installing Windows 10 feature updates less often than once annually risks devices going out of service and becoming vulnerable to security threats, because they will stop receiving the monthly security updates. + +### Annual +Here's a calendar showing an example schedule that applies one Windows 10 feature update per calendar year, aligned with Microsoft Endpoint Manager and Microsoft 365 Apps release cycles: + +[ ![Calendar showing an annual update cadence](images/annual-calendar.png) ](images/annual-calendar.png#lightbox) + +This approach provides approximately 12 months of use from each feature update before the next update is due to be installed. By aligning to the Windows 10, version H2 feature update, each release will be serviced for 30 months from the time of availability, giving you more flexibility when applying future feature updates. + +This cadence might be most suitable for you if any of these conditions apply: + +- You are just starting your journey with the Windows 10 servicing process. If you are unfamiliar with new processes that support Windows 10 servicing, moving from a project happening once every three to five years to a twice-a-year feature update process can be daunting. This approach gives you time to learn new approaches and tools to reduce effort and cost. + +- You want to wait and see how successful other companies are at adopting a Windows 10 feature update. + +- You want to go quickly with feature updates, and want the ability to skip a feature update while keeping Windows 10 serviced in case business priorities change. Aligning to the Windows 10 feature update released in the second half of each calendar year, you get additional servicing for Windows 10 (30 months of servicing compared to 18 months). + +### Rapid +This calendar shows an example schedule that installs each feature update as it is released, twice per year: + +[ ![Update calendar showing a faster update cadence](images/rapid-calendar.png) ](images/rapid-calendar.png#lightbox) + +This cadence might be best for you if these conditions apply: + +- You have a strong appetite for change. +- You want to continuously update supporting infrastructure and unlock new scenarios. +- Your organization has a large population of information workers that can use the latest features and functionality in Windows 10 and Office. +- You have experience with feature updates for Windows 10. diff --git a/windows/deployment/update/plan-determine-app-readiness.md b/windows/deployment/update/plan-determine-app-readiness.md new file mode 100644 index 0000000000..82ecea00a3 --- /dev/null +++ b/windows/deployment/update/plan-determine-app-readiness.md @@ -0,0 +1,75 @@ +--- +title: Determine application readiness +manager: laurawi +description: How to test your apps to know which need attention prior to deploying an update +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +ms.localizationpriority: medium +ms.audience: itpro +ms.topic: article +ms.collection: m365initiative-coredeploy +ms.author: jaimeo +author: jaimeo +--- + +# Determine application readiness + +Before you deploy a Windows 10 update, you should know which apps will continue to work without problems, which need their own updates, and which just won't work and must be replaced. If you haven't already, it's worth [classifying your apps] with respect to their criticality in your organization. + +## Validation methods + +You can choose from a variety of methods to validate apps. Exactly which ones to use will depend on the specifics of your environment. + + +|Validation method |Description | +|---------|---------| +|Full regression | A full quality assurance probing. Staff who know the application well and can validate its core functionality should do this. | +|Smoke testing | The application goes through formal validation. That is, a user validates the application following a detailed plan, ideally with limited, or no knowledge of the application they’re validating. | +|Automated testing | Software performs tests automatically. The software will let you know whether the tests have passed or failed, and will provide detailed reporting for you automatically. | +|Test in pilot | You pre-select users to be in the pilot deployment group and carry out the same tasks they do on a day-to-day basis to validate the application. Normally you use this method in addition to one of the other validation types. | +|Reactive response | Applications are validated in late pilot, and no specific users are selected. These applications normally aren't installed on many devices and aren’t handled by enterprise application distribution. | + +Combining the various validation methods with the app classifications you've previously established might look like this: + + +|Validation method |Critical apps |Important apps |Not important apps | +|---------|---------|---------|---------| +|Full regression | x | | | +|Smoke testing | | x | | +|Automated testing | x | x | x | +|Test in pilot | x | x | x | + + +### Identify users + +Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you'll have to choose which users are best suited for validation testing. Some factors to consider include: + +- **Location**: If users are in different physical locations, can you support them and get validation feedback from the region they're in? +- **Application knowledge**: Do the users have appropriate knowledge of how the app is supposed to work? +- **Technical ability**: Do the users have enough technical competence to provide useful feedback from various test scenarios? + +You could seek volunteers who enjoy working with new features and include them in the pilot deployment. You might want to avoid using core users like department heads or project managers. Current application owners, operations personnel, and developers can help you identify the most appropriate pilot users. + +### Identify and set up devices for validation + +In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection will include devices representing all of the hardware models in your environment. + +There is more than one way to choose devices for app validation: + +- **Existing pilot devices**: You might already have a list of devices that you regularly use for testing updates as part of release cycles. +- **Manual selection**: Some internal groups like operations will have expertise to help choose devices manually based on specifications, usage, or records of past support problems. +- **Data-driven analysis**: With appropriate tools, you can use diagnostic data from devices to inform your choices. + + +### Desktop Analytics + +Desktop Analytics can make all of the tasks discussed in this article significantly easier: + +- Creating and maintaining an application and device inventory +- Assign owners to applications for testing +- Automatically apply your app classifications (critical, important, not important) +- Automatically identify application compatibility risks and provide recommendations for reducing those risks + +For more information, see [What is Desktop Analytics?](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md new file mode 100644 index 0000000000..19c0a83aa5 --- /dev/null +++ b/windows/deployment/update/prepare-deploy-windows.md @@ -0,0 +1,187 @@ +--- +title: Prepare to deploy Windows +description: Final steps to get ready to deploy Windows, including preparing infrastructure, environment, applications, devices, network, capability, and users +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +ms.collection: m365initiative-coredeploy +--- + +# Prepare to deploy Windows + +Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows 10. The planning phase will have left you with these useful items: + +- A clear understanding of necessary personnel and their roles and criteria for [rating app readiness](plan-define-readiness.md) +- A plan for [testing and validating](plan-determine-app-readiness.md) apps +- An assessment of your [deployment infrastructure](eval-infra-tools.md) and definitions for operational readiness +- A [deployment plan](create-deployment-plan.md) that defines the rings you want to use + +Now you're ready to actually start making changes in your environment to get ready to deploy. + +## Prepare infrastructure and environment + +- Deploy site server updates for Configuration Manager. +- Update non-Microsoft security tools like security agents or servers. +- Update non-Microsoft management tools like data loss prevention agents. + +Your infrastructure probably includes many different components and tools. You’ll need to ensure your environment isn’t affected by issues due to the changes you make to the various parts of the infrastructure. Follow these steps: + +1. Review all of the infrastructure changes that you’ve identified in your plan. It’s important to understand the changes that need to be made and to detail how to implement them. This process prevents problems later on. + +2. Validate your changes. You’ll validate the changes for your infrastructure’s components and tools, to help you understand how your changes could affect your production environment. + +3. Implement the changes. Once the changes have been validated, you can implement the changes across the wider infrastructure. + + +You should also look at your organization’s environment’s configuration and outline how you’ll implement any necessary changes previously identified in the plan phase to support the update. Consider what you’ll need to do for the various settings and policies that currently underpin the environment. For example: + +- Implement new draft security guidance. New versions of Windows can include new features that improve your environment’s security. Your security teams will want to make appropriate changes to security-related configurations. + +- Update security baselines. Security teams understand the relevant security baselines and will have to work to make sure all baselines fit into whatever guidance they have to adhere to. + +However, your configuration will consist of many different settings and policies. It’s important to only apply changes where they are necessary, and where you gain a clear improvement. Otherwise, your environment might face issues that will slow down the update process. You want to ensure your environment isn’t affected adversely because of changes you make. For example: + +1. Review new security settings. Your security team will review the new security settings to understand how they can best be set to facilitate the update, and to also investigate the potential effects they might have on your environment. + +2. Review security baselines for changes. Security teams will also review all the necessary security baselines, to ensure the changes can be implemented, and ensure your environment remains compliant. + +3. Implement and validate security settings and baseline changes. Your security teams will then implement all of the security settings and baselines, having addressed any potential outstanding issues. + + +## Prepare applications and devices + +You've previously decided on which validation methods you want to use to validate apps in the upcoming pilot deployment phase. Now is a good time to make sure that individual devices are ready and able to install the next update without difficulty. + +### Ensure updates are available + +Enable update services on devices. Ensure that every device is running all the services Windows Update relies on. Sometimes users or even malware can disable the services Windows Update requires to work correctly. Make sure the following services are running: + +- Background Intelligent Transfer Service +- Background Tasks Infrastructure Service +- BranchCache (if you use this feature for update deployment) +- ConfigMgr Task Sequence Agent (if you use Configuration Manager to deploy updates) +- Cryptographic Services +- DCOM Server Process Launcher +- Device Install +- Delivery Optimization +- Device Setup Manager +- License Manager +- Microsoft Account Sign-in Assistant +- Microsoft Software Shadow Copy Provider +- Remote Procedure Call (RPC) +- Remote Procedure Call (RPC) Locator +- RPC Endpoint Mapper +- Service Control Manager +- Task Scheduler +- Token Broker +- Update Orchestrator Service +- Volume Shadow Copy Service +- Windows Automatic Update Service +- Windows Backup +- Windows Defender Firewall +- Windows Management Instrumentation +- Windows Management Service +- Windows Module Installer +- Windows Push Notification +- Windows Security Center Service +- Windows Time Service +- Windows Update +- Windows Update Medic Service + +You can check these services manually by using Services.msc, or by using PowerShell scripts, Desktop Analytics, or other methods. + +### Network configuration + +Ensure that devices can reach necessary Windows Update endpoints through the firewall. For example, for Windows 10, version 2004, the following protocols must be able to reach these respective endpoints: + + +|Protocol |Endpoint URL | +|---------|---------| +|TLS 1.2 | `*.prod.do.dsp.mp.microsoft.com` | +|HTTP | `emdl.ws.microsoft.com` | +|HTTP | `*.dl.delivery.mp.microsoft.com` | +|HTTP | `*.windowsupdate.com` | +|HTTPS | `*.delivery.mp.microsoft.com` | +|TLS 1.2 | `*.update.microsoft.com` | +|TLS 1.2 | `tsfe.trafficshaping.dsp.mp.microsoft.com` | + +> [!NOTE] +> Be sure not to use HTTPS for those endpoints that specify HTTP, and vice versa. The connection will fail. + +The specific endpoints can vary between Windows 10 versions. See, for example, [Windows 10 2004 Enterprise connection endpoints](https://docs.microsoft.com/windows/privacy/manage-windows-2004-endpoints). Similar articles for other Windows 10 versions are available in the table of contents nearby. + + +### Optimize download bandwidth +Set up [Delivery Optimization](waas-delivery-optimization.md) for peer network sharing or Microsoft Connected Cache. + +### Address unhealthy devices + +In the course of surveying your device population, either with Desktop Analytics or by some other means, you might find devices that have systemic problems that could interfere with update installation. Now is the time to fix those problems. + +- **Low disk space:** Quality updates require a minimum of 2 GB to successfully install. Feature updates require between 8 GB and 15 GB depending upon the configuration. On Windows 10, version 1903 and later you can proactively use the "reserved storage" feature (for wipe and loads, rebuilds, and new builds) to avoid running out of disk space. If you find a group of devices that don't have enough disk space, you can often resolve the problem by cleaning up log files and asking users to clean up data if necessary. A good place to start is to delete the following files: + + - C:\Windows\temp + - C:\Windows\cbstemp (though this file might be necessary to investigate update failures) + - C:\Windows\WindowsUpdate.log (though this file might be necessary to investigate update failures) + - C:\Windows.Old (these files should automatically clean up after 10 days or might ask the device user for permission to clean up sooner when constrained for disk space) + +You can also create and run scripts to perform additional cleanup actions on devices, with administrative rights, or use Group Policy settings. + +- Clean up the Windows Store Cache by running C:\Windows\sytem32\wsreset.exe. + +- Optimize the WinSxS folder on the client machine by using **Dism.exe /online /Cleanup-Image /StartComponentCleanup**. + +- Compact the operating system by running **Compact.exe /CompactOS:always**. + +- Remove Windows Features on Demand that the user doesn't need. See [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) for more guidance. + +- Move Windows Known Folders to OneDrive. See [Use Group Policy to control OneDrive sync settings](https://docs.microsoft.com/onedrive/use-group-policy) for more information. + +- Clean up the Software Distribution folder. Try deploying these commands as a batch file to run on devices to reset the download state of Windows Updates: + + ```console + net stop wuauserv + net stop cryptSvc + net stop bits + net stop msiserver + ren C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution.old + net start wuauserv + net start cryptSvc + net start bits + net start msiserver + ``` + +- **Application and driver updates:** Out-of-date app or driver software can prevent devices from updating successfully. Desktop Analytics will help you identify drivers and applications that need attention. You can also check for known issues in order to take any appropriate action. Deploy any updates from the vendor(s) for any problematic application or driver versions to resolve issues. + +- **Corruption:** In rare circumstances, a device that has repeated installation errors might be corrupted in a way that prevents the system from applying a new update. You might have to repair the Component-Based Store from another source. You can fix the problem with the [System File Checker](https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system). + + +## Prepare capability + +In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You'll need to complete these higher-level tasks to gain those new capabilities: + +- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions will come with new policies that you use to update ADMX templates. + +- Validate new changes to understand how they affect the wider environment. + +- Remediate any potential problems that have been identified through validation. + +## Prepare users + +Users often feel like they are forced into updating their devices randomly. They often don't fully understand why an update is needed, and they don't know when updates would be applied to their devices ahead of time. It's best to ensure that upcoming updates are communicated clearly and with adequate warning. + +You can employ a variety of measures to achieve this goal, for example: + +- Send overview email about the update and how it will be deployed to the entire organization. +- Send personalized emails to users about the update with specific details. +- Set an opt-out deadline for employees that need to remain on the current version for a bit longer, due to a business need. +- Provide the ability to voluntarily update at users’ convenience. +- Inform users of a mandatory installation date when the update will be installed on all devices. + + diff --git a/windows/deployment/update/safeguard-holds.md b/windows/deployment/update/safeguard-holds.md new file mode 100644 index 0000000000..003834c35c --- /dev/null +++ b/windows/deployment/update/safeguard-holds.md @@ -0,0 +1,44 @@ +--- +title: Safeguard holds +description: What are safeguard holds, how can you tell if one is in effect, and what to do about it +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.topic: article +--- + +# Safeguard holds + +Microsoft uses quality and compatibility data to identify issues that might cause a Windows 10 feature update to fail or roll back. When we find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available. + +Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows 10. + +The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the hold. Once we release the hold, Windows Update will resume offering new operating system versions to devices. + +Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments. + + +## Am I affected by a safeguard hold? + +IT admins can use [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) to monitor various update health metrics for devices in their organization, including ones affected by a safeguard hold that prevents them from updating to a newer operating system version. + +Queries identify Safeguard IDs for each affected device, giving IT admins a detailed view into the various protections extended to devices. Safeguard IDs for publicly discussed known issues are also included in the [Windows release health](https://aka.ms/windowsreleasehealth) dashboard, where you can easily find information related to publicly available safeguards. + +On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message: + + +![Feature update message reading "The Windows 10 May 2020 Update is on its way. Once it's ready for your device, you'll see the update available on this page](images/safeguard-hold-notification.png) + +If you see this message, it means one or more holds affect your device. When the issue is fixed and the update is safe to install, we’ll release the hold and the update can resume safely. + +## What can I do? + +We recommend that you do not attempt to manually update until issues have been resolved and holds released. + +> [!CAUTION] +> Opting out of a safeguard hold can put devices at risk from known performance issues. We strongly recommend that you complete robust testing to ensure the impact is acceptable before opting out. + +With that in mind, IT admins who stay informed with [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) and the [Windows release health](https://aka.ms/windowsreleasehealth) dashboard can choose to temporarily [opt-out of the protection of all safeguard holds](safeguard-opt-out.md) and allow an update to proceed. We recommend opting out only in an IT environment and for validation purposes. If you do opt out of a hold, this condition is temporary. Once an update is complete, the protection of safeguard holds is reinstated automatically. diff --git a/windows/deployment/update/safeguard-opt-out.md b/windows/deployment/update/safeguard-opt-out.md new file mode 100644 index 0000000000..a6ad9a0b05 --- /dev/null +++ b/windows/deployment/update/safeguard-opt-out.md @@ -0,0 +1,32 @@ +--- +title: Opt out of safeguard holds +description: Steps to install an update even it if has a safeguard hold applied +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.topic: article +--- + +# Opt out of safeguard holds + +Safeguard holds prevent a device with a known compatibility issue from being offered a new Windows 10 feature update by using Windows Update. We use safeguard holds to protect the device and user from a failed or poor update experience. We renew the offering once a fix is issued and is verified on an affected device. For more information about safeguard holds, see [Safeguard holds](safeguard-holds.md). + +## How can I opt out of safeguard holds? + +IT admins can, if necessary, opt devices out of safeguard protections by using the disable safeguards policy. In a Mobile Device Management (MDM) tool, use the **Update/DisableWUfBSafeguards** CSP. In Group Policy, use the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update. + +> [!CAUTION] +> Opting out of a safeguard hold can put devices at risk from known performance issues. + +We recommend opting out only in an IT environment and for validation purposes. You can also validate an upcoming Windows 10 feature update version without the safeguards being applied by using the Release Preview channel of the Windows Insider Program for Business. + +Disabling safeguards does not guarantee your device will be able to successfully update. The update might still fail and will likely result in a bad experience since you are bypassing the protection against known issues. + +> [!NOTE] +> After a device installs a new Windows 10 version, the **Disable safeguards for Feature Updates** Group Policy will revert to “not configured” even if it was previously enabled. We do this to ensure the admin is consciously disabling Microsoft’s default protection from known issues for each new feature update. + + + diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 49d29f4d8a..e2b6404d14 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -1,6 +1,6 @@ --- title: Servicing stack updates (Windows 10) -description: Servicing stack updates improve the code that installs the other updates. +description: In this article, learn how servicing stack updates improve the code that installs the other updates. ms.prod: w10 ms.mktglfcycl: manage audience: itpro @@ -12,6 +12,7 @@ ms.reviewer: manager: laurawi ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Servicing stack updates @@ -28,6 +29,8 @@ Servicing stack updates provide fixes to the servicing stack, the component that Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. +For information about some changes to servicing stack updates, see [Simplifing Deployment of Servicing Stack Updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039) on the Windows IT Pro blog. + ## When are they released? Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical." diff --git a/windows/deployment/update/update-baseline.md b/windows/deployment/update/update-baseline.md new file mode 100644 index 0000000000..4438c95e54 --- /dev/null +++ b/windows/deployment/update/update-baseline.md @@ -0,0 +1,47 @@ +--- +title: Update Baseline +description: Use an update baseline to optimize user experience and meet monthly update goals +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, tools, group policy +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +manager: laurawi +ms.topic: article +--- + +# Update Baseline + +**Applies to:** Windows 10 + +With the large number of different policies offered for Windows 10, Update Baseline provides a clear list of recommended Windows Update policy settings for IT administrators who want the best user experience while also meeting their monthly update compliance goals. See [Policies included in the Update Baseline](#policies-included-in-the-update-baseline) for the full list of policy configurations. + +## Why is Update Baseline needed? + +Update Baseline is an industry-tested solution that improves update adoption rates while also maintaining a high-quality user experience. Whether you are just starting out, or you have been configuring policies for years, Update Baseline can help get you to a known good state with an excellent user experience. Applying the baseline is especially helpful for organizations that have many years of policy configurations to clear out lingering misconfigurations. + +## You can use Update Baseline to: + +- Ensure that user and device configuration settings are compliant with the baseline. +- Set configuration settings. You can use Group Policy to configure a device with the setting values specified in the baseline. + +Update Baseline doesn't affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices and when. + +## Policies included in the Update Baseline + +The Update Baseline configures settings in these Group Policy areas: + +- System/Power Management +- Windows Components/Delivery Optimization +- Windows Components/Windows Update + +For the complete detailed list of all settings and their values, see the MSFT Windows Update.htm file in the [Update Baseline toolkit](https://www.microsoft.com/download/details.aspx?id=101056) at the Download Center + +## How do I get started? + +The Update Baseline toolkit makes it easy by providing a single command for IT Admins to load the baseline settings into Group Policy Management Console. You can get the [Update Baseline toolkit](https://www.microsoft.com/download/details.aspx?id=101056) from the Download Center. + +Today, the Update Baseline toolkit is currently only available for use with Group Policy. + + diff --git a/windows/deployment/update/update-compliance-configuration-manual.md b/windows/deployment/update/update-compliance-configuration-manual.md index fc22965271..b96d2edfd6 100644 --- a/windows/deployment/update/update-compliance-configuration-manual.md +++ b/windows/deployment/update/update-compliance-configuration-manual.md @@ -17,13 +17,14 @@ ms.topic: article # Manually Configuring Devices for Update Compliance -There are a number of requirements to consider when manually configuring Update Compliance. These can potentially change with newer versions of Windows 10. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) will be updated when any configuration requirements change so only a redeployment of the script will be required. +There are a number of requirements to consider when manually configuring devices for Update Compliance. These can potentially change with newer versions of Windows 10. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) will be updated when any configuration requirements change so only a redeployment of the script will be required. The requirements are separated into different categories: 1. Ensuring the [**required policies**](#required-policies) for Update Compliance are correctly configured. -2. Devices in every network topography needs to send data to the [**required endpoints**](#required-endpoints) for Update Compliance, for example both devices in main and satellite offices, which may have different network configurations. +2. Devices in every network topography must send data to the [**required endpoints**](#required-endpoints) for Update Compliance. For example, devices in both main and satellite offices, which might have different network configurations must be able to reach the endpoints. 3. Ensure [**Required Windows services**](#required-services) are running or are scheduled to run. It is recommended all Microsoft and Windows services are set to their out-of-box defaults to ensure proper functionality. +4. [**Run a full Census sync**](#run-a-full-census-sync) on new devices to ensure that all necessary data points are collected. ## Required policies @@ -33,7 +34,7 @@ The requirements are separated into different categories: Update Compliance has a number of policies that must be appropriately configured in order for devices to be processed by Microsoft and visible in Update Compliance. They are enumerated below, separated by whether the policies will be configured via [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM) or Group Policy. For both tables: - **Policy** corresponds to the location and name of the policy. -- **Value** Indicates what value the policy must be set to. Update Compliance requires *at least* Basic (or Required) telemetry, but can function off Enhanced or Full (or Optional). +- **Value** Indicates what value the policy must be set to. Update Compliance requires *at least* Basic (or Required) diagnostic data, but can function off Enhanced or Full (or Optional). - **Function** details why the policy is required and what function it serves for Update Compliance. It will also detail a minimum version the policy is required, if any. ### Mobile Device Management policies @@ -43,10 +44,13 @@ Each MDM Policy links to its documentation in the CSP hierarchy, providing its e | Policy | Value | Function | |---------------------------|-|------------------------------------------------------------| |**Provider/*ProviderID*/**[**CommercialID**](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp#provider-providerid-commercialid) |[Your CommercialID](update-compliance-get-started.md#get-your-commercialid) |Identifies the device as belonging to your organization. | -|**System/**[**AllowTelemetry**](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) |1- Basic |Configures the maximum allowed telemetry to be sent to Microsoft. Individual users can still set this lower than what the policy defines, see the below policy for more information. | -|**System/**[**ConfigureTelemetryOptInSettingsUx**](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux) | Disable Telemetry opt-in Settings | (*Windows 10 1803+*) Determines whether end-users of the device can adjust telemetry to levels lower than the level defined by AllowTelemetry. It is recommended you disable this policy order the effective telemetry level on devices may not be sufficient. | +|**System/**[**AllowTelemetry**](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | 1- Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. For more information, see the following policy. | +|**System/**[**ConfigureTelemetryOptInSettingsUx**](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux) | 1 - Disable Telemetry opt-in Settings | (in Windows 10, version 1803 and later) Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy or the effective diagnostic data level on devices might not be sufficient. | |**System/**[**AllowDeviceNameInDiagnosticData**](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) | 1 - Allowed | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or set to 0 (Disabled), Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. | +> [!NOTE] +> If you use Microsoft Intune, set the **ProviderID** to *MS DM Server*. If you use another MDM product, check with its vendor. See also [DMClient CSP](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp). + ### Group Policies All Group Policies that need to be configured for Update Compliance are under **Computer Configuration>Administrative Templates>Windows Components\Data Collection and Preview Builds**. All of these policies must be in the *Enabled* state and set to the defined *Value* below. @@ -54,9 +58,9 @@ All Group Policies that need to be configured for Update Compliance are under ** | Policy | Value | Function | |---------------------------|-|-----------------------------------------------------------| |**Configure the Commercial ID** |[Your CommercialID](update-compliance-get-started.md#get-your-commercialid) | Identifies the device as belonging to your organization. | -|**Allow Telemetry** | 1 - Basic |Configures the maximum allowed telemetry to be sent to Microsoft. Individual users can still set this lower than what the policy defines, see the below policy for more information. | -|**Configure telemetry opt-in setting user interface** | Disable telemetry opt-in Settings |(*Windows 10 1803+*) Determines whether end-users of the device can adjust telemetry to levels lower than the level defined by AllowTelemetry. It is recommended you disable this policy order the effective telemetry level on devices may not be sufficient. | -|**Allow device name to be sent in Windows diagnostic data** | Enabled | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or Disabled, Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. | +|**Allow Telemetry** | 1 - Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. See the following policy for more information. | +|**Configure telemetry opt-in setting user interface** | 1 - Disable diagnostic data opt-in Settings |(in Windows 10, version 1803 and later) Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy, otherwise the effective diagnostic data level on devices might not be sufficient. | +|**Allow device name to be sent in Windows diagnostic data** | 1 - Enabled | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or Disabled, Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. | ## Required endpoints @@ -68,10 +72,21 @@ To enable data sharing between devices, your network, and Microsoft's Diagnostic | `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. | | `https://settings-win.data.microsoft.com` | Required for Windows Update functionality. | | `http://adl.windows.com` | Required for Windows Update functionality. | -| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER), used to provide more advanced error reporting in the event of certain Feature Update deployment failures. | +| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER), used to provide more advanced error reporting if certain Feature Update deployment failures occur. | | `https://oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors in the event of certain crashes. | -| `https://login.live.com` | This endpoint facilitates MSA access and is required to create the primary identifier we use for devices. Without this service, devices will not be visible in the solution. This also requires Microsoft Account Sign-in Assistant service to be running (wlidsvc). | +| `https://login.live.com` | This endpoint facilitates MSA access and is required to create the primary identifier we use for devices. Without this service, devices will not be visible in the solution. The Microsoft Account Sign-in Assistant service must also be running (wlidsvc). | ## Required services Many Windows and Microsoft services are required to ensure that not only the device can function, but Update Compliance can see device data. It is recommended that you allow all default services from the out-of-box experience to remain running. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) checks whether the majority of these services are running or are allowed to run automatically. + + +## Run a full Census sync + +Census is a service that runs on a regular schedule on Windows devices. A number of key device attributes, like what operating system edition is installed on the device, are included in the Census payload. However, to save network load and system resources, data that tends to be more static (like edition) is sent approximately once per week rather than on every daily run. Because of this behavior, these attributes can take longer to appear in Update Compliance unless you start a full Census sync. The Update Compliance Configuration Script will do a full sync. + +A full Census sync adds a new registry value to Census's path. When this registry value is added, Census's configuration is overridden to force a full sync. For Census to work normally, this registry value should be enabled, Census should be started manually, and then the registry value should be disabled. Follow these steps: + +1. For every device you are manually configuring for Update Compliance, add or modify the registry key located at **HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Census** to include a new **DWORD value** named **FullSync** and set to **1**. +2. Run Devicecensus.exe with administrator privileges on every device. Devicecensus.exe is in the System32 folder. No additional run parameters are required. +3. After Devicecensus.exe has run, the **FullSync** registry value can be removed or set to **0**. diff --git a/windows/deployment/update/update-compliance-configuration-script.md b/windows/deployment/update/update-compliance-configuration-script.md index 2167039e0c..f5f19921c9 100644 --- a/windows/deployment/update/update-compliance-configuration-script.md +++ b/windows/deployment/update/update-compliance-configuration-script.md @@ -19,7 +19,11 @@ ms.topic: article The Update Compliance Configuration Script is the recommended method of configuring devices to send data to Microsoft for use with Update Compliance. The script configures device policies via Group Policy, ensures that required services are running, and more. -You can [**download the script here**](https://www.microsoft.com/en-us/download/details.aspx?id=101086). Keep reading to learn how to configure the script and interpret error codes that are output in logs for troubleshooting. +> [!NOTE] +> The Update Compliance configuration script does not offer options to configure Delivery Optimization. You have to do that separately. + + +You can download the script from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=101086). Keep reading to learn how to configure the script and interpret error codes that are output in logs for troubleshooting. ## How the script is organized @@ -35,6 +39,10 @@ The script is organized into two folders **Pilot** and **Deployment**. Both fold > [!IMPORTANT] > If you encounter an issue with Update Compliance, the first step should be to run the script in Pilot mode on a device you are encountering issues with, and save these Logs for reference with Support. +> [!IMPORTANT] +> The script must be run in the System context. To do this, use the PsExec tool included in the file. For more about PsExec, see [PsExec](https://docs.microsoft.com/sysinternals/downloads/psexec). + + When using the script in the context of troubleshooting, use `Pilot`. Enter `RunConfig.bat`, and configure it as follows: 1. Configure `logPath` to a path where the script will have write access and a place you can easily access. This specifies the output of the log files generated when the script is in Verbose mode. diff --git a/windows/deployment/update/update-compliance-delivery-optimization.md b/windows/deployment/update/update-compliance-delivery-optimization.md index c3c6abb633..b56a569d4c 100644 --- a/windows/deployment/update/update-compliance-delivery-optimization.md +++ b/windows/deployment/update/update-compliance-delivery-optimization.md @@ -2,7 +2,7 @@ title: Delivery Optimization in Update Compliance (Windows 10) ms.reviewer: manager: laurawi -description: new Delivery Optimization data displayed in Update Compliance +description: Learn how the Update Compliance solution provides you with information about your Delivery Optimization configuration. ms.prod: w10 ms.mktglfcycl: deploy ms.pagetype: deploy @@ -13,6 +13,7 @@ keywords: oms, operations management suite, optimization, downloads, updates, lo ms.localizationpriority: medium ms.collection: M365-analytics ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Delivery Optimization in Update Compliance @@ -41,5 +42,5 @@ The table breaks down the number of bytes from each download source into specifi The download sources that could be included are: - LAN Bytes: Bytes downloaded from LAN Peers which are other devices on the same local network -- Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the “Group” download mode is used) +- Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the "Group" download mode is used) - HTTP Bytes: Non-peer bytes. The HTTP download source can be Microsoft Servers, Windows Update Servers, a WSUS server or an SCCM Distribution Point for Express Updates. diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md index 1fc602e081..12924ab50f 100644 --- a/windows/deployment/update/update-compliance-feature-update-status.md +++ b/windows/deployment/update/update-compliance-feature-update-status.md @@ -2,7 +2,7 @@ title: Update Compliance - Feature Update Status report ms.reviewer: manager: laurawi -description: an overview of the Feature Update Status report +description: Learn how the Feature Update Status report provides information about the status of feature updates across all devices. ms.prod: w10 ms.mktglfcycl: deploy ms.pagetype: deploy @@ -12,11 +12,12 @@ author: jaimeo ms.author: jaimeo ms.collection: M365-analytics ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Feature Update Status -![The Feature Update Status report](images/UC_workspace_FU_status.png) +[ ![The Feature Update Status report](images/UC_workspace_FU_status.png) ](images/UC_workspace_FU_status.png#lightbox) The Feature Update Status section provides information about the status of [feature updates](waas-quick-start.md#definitions) across all devices. This section tile in the [Overview Blade](update-compliance-using.md#overview-blade) gives a percentage of devices that are on the latest applicable feature update; [Servicing Channel](waas-overview.md#servicing-channels) is considered in determining applicability. Within this section are two blades; one providing a holistic view of feature updates, the other containing three **Deployment Status** tiles, each charged with tracking the deployment for a different [Servicing Channel](waas-overview.md#servicing-channels). @@ -35,14 +36,18 @@ Refer to the following list for what each state means: * Devices that have failed the given feature update installation are counted as **Update failed**. * If a device should be, in some way, progressing toward this security update, but its status cannot be inferred, it will count as **Status Unknown**. Devices not using Windows Update are the most likely devices to fall into this category. -## Compatibility holds +## Safeguard holds -Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *compatibility hold* is generated to delay the device's upgrade and safeguard the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all compatibility holds on the Windows 10 release information page for any given release. +Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows 10 release information page for any given release. -### Opting out of compatibility hold +## Queries for safeguard holds -Microsoft will release a device from a compatibility hold when it has determined it can safely and smoothly install a feature update, but you are ultimately in control of your devices and can opt out if desired. To opt out, set the registry key **HKLM\Software\Microsoft\Windows NT\CurrentVersion\502505fe-762c-4e80-911e-0c3fa4c63fb0** to a name of **DataRequireGatedScanForFeatureUpdates** and a value of **0**. +Update Compliance reporting offers two queries to help you retrieve data related to safeguard holds. The first query shows the device data for all devices that are affected by safeguard holds. The second query shows data specific to devices running the target build. +![Left pane showing Need Attention, Security update status, feature update status, and Windows Defender AV status, with Need Attention selected. Right pane shows the list of queries relevant to the Need Attention status, with "Devices with a safeguard hold" and "Target build distribution of devices with a safeguard hold" queries highlighted](images/UC_workspace_safeguard_queries.png) -Setting this registry key to **0** will force the device to opt out from *all* compatibility holds. Any other value, or deleting the key, will resume compatibility protection on the device. +Update Compliance reporting will display the Safeguard IDs for known issues affecting a device in the **DeploymentErrorCode** column. Safeguard IDs for publicly discussed known issues are also included in the Windows Release Health dashboard, where you can easily find information related to publicly available safeguards. +### Opt out of safeguard hold + +You can [opt out of safeguard protections](safeguard-opt-out.md) by using the **Disable safeguards for Feature Updates** Group Policy. This policy is available to Windows Update for Business devices running Windows 10, version 1809 or later that have installed the October 2020 security update. diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 102ee54ac9..14008cd234 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -1,5 +1,5 @@ --- -title: Monitor Windows Updates and Windows Defender AV with Update Compliance (Windows 10) +title: Monitor Windows Updates and Microsoft Defender AV with Update Compliance (Windows 10) ms.reviewer: manager: laurawi description: You can use Update Compliance in Azure Portal to monitor the progress of updates and key antimalware protection features on devices in your network. @@ -13,15 +13,11 @@ ms.author: jaimeo ms.localizationpriority: medium ms.collection: M365-analytics ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Monitor Windows Updates with Update Compliance -> [!IMPORTANT] -> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. A few retirements are planned, noted below, but are placed **on hold** until the current situation stabilizes. -> * The Windows Defender Antivirus reporting feature of Update Compliance will soon be retired. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). -> * As of March 31, 2020, The Perspectives feature of Update Compliance will soon be retired in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. - ## Introduction Update Compliance enables organizations to: @@ -30,7 +26,7 @@ Update Compliance enables organizations to: * View a report of device and update issues related to compliance that need attention. * Check bandwidth savings incurred across multiple content types by using [Delivery Optimization](waas-delivery-optimization.md). -Update Compliance is offered through the Azure portal, and is included as part of Windows 10 licenses listed in the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites). +Update Compliance is offered through the Azure portal, and is included as part of Windows 10 licenses listed in the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites). Azure Log Analytics ingestion and retention charges are not incurred on your Azure subscription for Update Compliance data. Update Compliance uses Windows 10 diagnostic data for all of its reporting. It collects system data including update deployment progress, [Windows Update for Business](waas-manage-updates-wufb.md) configuration data, and Delivery Optimization usage data, and then sends this data to a customer-owned [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace to power the experience. diff --git a/windows/deployment/update/update-compliance-need-attention.md b/windows/deployment/update/update-compliance-need-attention.md index b3a4ca35a7..6a441b08d7 100644 --- a/windows/deployment/update/update-compliance-need-attention.md +++ b/windows/deployment/update/update-compliance-need-attention.md @@ -1,9 +1,7 @@ --- title: Update Compliance - Need Attention! report -ms.reviewer: manager: laurawi -description: an overview of the Update Compliance Need Attention! report -ms.prod: w10 +description: Learn how the Need attention! section provides a breakdown of all Windows 10 device and update issues detected by Update Compliance. ms.mktglfcycl: deploy ms.pagetype: deploy audience: itpro @@ -12,6 +10,7 @@ author: jaimeo ms.author: jaimeo ms.collection: M365-analytics ms.topic: article +ms.prod: w10 --- # Needs attention! @@ -35,7 +34,7 @@ The different issues are broken down by Device Issues and Update Issues: * **Cancelled**: This issue occurs when a user cancels the update process. * **Rollback**: This issue occurs when a fatal error occurs during a feature update, and the device is rolled back to the previous version. * **Uninstalled**: This issue occurs when a feature update is uninstalled from a device by a user or an administrator. Note that this might not be a problem if the uninstallation was intentional, but is highlighted as it might need attention. -* **Progress stalled:** This issue occurs when an update is in progress, but has not completed over a period of 10 days. +* **Progress stalled:** This issue occurs when an update is in progress, but has not completed over a period of 7 days. Selecting any of the issues will take you to a [Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) view with all devices that have the given issue. diff --git a/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md b/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md index 3cbcbbeb28..b5fe054a3e 100644 --- a/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md +++ b/windows/deployment/update/update-compliance-schema-waasdeploymentstatus.md @@ -26,7 +26,7 @@ WaaSDeploymentStatus records track a specific update's installation progress on |**DeploymentError** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Disk Error` |A readable string describing the error, if any. If empty, there is either no string matching the error or there is no error. | |**DeploymentErrorCode** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`8003001E` |Microsoft internal error code for the error, if any. If empty, there is either no error or there is *no error code*, meaning that the issue raised does not correspond to an error, but some inferred issue. | |**DeploymentStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Failed` |The high level status of installing this update on this device. Possible values are:
      • **Update completed**: Device has completed the update installation.
      • **In Progress**: Device is in one of the various stages of installing an update, detailed in `DetailedStatus`.
      • **Deferred**: A device's deferral policy is preventing the update from being offered by Windows Update.
      • **Cancelled**: The update was cancelled.
      • **Blocked**: There is a hard block on the update being completed. This could be that another update must be completed before this one, or some other task is blocking the installation of the update.
      • **Unknown**: Update Compliance generated WaaSDeploymentStatus records for devices as soon as it detects an update newer than the one installed on the device. Devices that have not sent any deployment data for that update will have the status `Unknown`.
      • **Update paused**: Devices are paused via Windows Update for Business Pause policies, preventing the update from being offered by Windows Update.
      • **Failed**: Device encountered a failure in the update process, preventing it from installing the update. This may result in an automatic retry in the case of Windows Update, unless the `DeploymentError` indicates the issue requires action before the update can continue.| -|**DetailedStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Reboot required` |A detailed status for the installation of this update on this device. Possible values are:
      • **Update deferred**: When a device's Windows Update for Business policy dictates the update is deferred.
      • **Update paused**: The device's Windows Update for Business policy dictates the update is paused from being offered.
      • **Update offered**: The device has been offered the update, but has not begun downloading it.
      • **Pre-Download tasks passed**: The device has finished all necessary tasks prior to downloading the update.
      • **Compatibility hold**: The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds).
      • **Download started**: The update has begun downloading on the device.
      • **Download Succeeded**: The update has successfully completed downloading.
      • **Pre-Install Tasks Passed**: Tasks that must be completed prior to installing the update have been completed.
      • **Install Started**: Installation of the update has begun.
      • **Reboot Required**: The device has finished installing the update, and a reboot is required before the update can be completed.
      • **Reboot Pending**: The device has a scheduled reboot to apply the update.
      • **Reboot Initiated**: The scheduled reboot has been initiated.
      • **Commit**: Changes are being committed post-reboot. This is another step of the installation process.
      • **Update Completed**: The update has successfully installed.| +|**DetailedStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Reboot required` |A detailed status for the installation of this update on this device. Possible values are:
      • **Update deferred**: When a device's Windows Update for Business policy dictates the update is deferred.
      • **Update paused**: The device's Windows Update for Business policy dictates the update is paused from being offered.
      • **Update offered**: The device has been offered the update, but has not begun downloading it.
      • **Pre-Download tasks passed**: The device has finished all necessary tasks prior to downloading the update.
      • **Compatibility hold**: The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#safeguard-holds).
      • **Download started**: The update has begun downloading on the device.
      • **Download Succeeded**: The update has successfully completed downloading.
      • **Pre-Install Tasks Passed**: Tasks that must be completed prior to installing the update have been completed.
      • **Install Started**: Installation of the update has begun.
      • **Reboot Required**: The device has finished installing the update, and a reboot is required before the update can be completed.
      • **Reboot Pending**: The device has a scheduled reboot to apply the update.
      • **Reboot Initiated**: The scheduled reboot has been initiated.
      • **Commit**: Changes are being committed post-reboot. This is another step of the installation process.
      • **Update Completed**: The update has successfully installed.| |**ExpectedInstallDate** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`3/28/2020, 1:00:01.318 PM`|Rather than the expected date this update will be installed, this should be interpreted as the minimum date Windows Update will make the update available for the device. This takes into account Deferrals. | |**LastScan** |[datetime](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/datetime)|`3/22/2020, 1:00:01.318 PM`|The last point in time that this device sent Update Session data. | |**OriginBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.719` |The build originally installed on the device when this Update Session began. | diff --git a/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md b/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md index 2ddf505e62..52147e7fab 100644 --- a/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md +++ b/windows/deployment/update/update-compliance-schema-waasinsiderstatus.md @@ -26,7 +26,7 @@ WaaSInsiderStatus records contain device-centric data and acts as the device rec |**OSArchitecture** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`amd64` |The architecture of the Operating System. | |**OSName** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Windows 10` |The name of the Operating System. This will always be Windows 10 for Update Compliance. | |**OSVersion** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`1909` |The version of Windows 10. This typically is of the format of the year of the version's release, following the month. In this example, `1909` corresponds to 2019-09 (September). This maps to the `Major` portion of OSBuild. | -|**OSBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.720` |The currently-installed Windows 10 Build, in the format `Major`.`Revision`. `Major` corresponds to which Feature Update the device is on, whereas `Revision` corresponds to which quality update the device is on. Mappings between Feature release and Major, as well as Revision and KBs, are available at [aka.ms/win10releaseinfo](https://docs.microsoft.com/windows/release-information/). | +|**OSBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.720` |The currently-installed Windows 10 Build, in the format `Major`.`Revision`. `Major` corresponds to which Feature Update the device is on, whereas `Revision` corresponds to which quality update the device is on. Mappings between Feature release and Major, as well as Revision and KBs, are available at [aka.ms/win10releaseinfo](https://docs.microsoft.com/windows/release-health/release-information). | |**OSRevisionNumber** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`720` |An integer value for the revision number of the currently-installed Windows 10 OSBuild on the device. | |**OSEdition** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Enterprise` |The Windows 10 Edition or SKU. | |**OSFamily** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Windows.Desktop` |The Device Family of the device. Only `Windows.Desktop` is currently supported. | diff --git a/windows/deployment/update/update-compliance-schema-waasupdatestatus.md b/windows/deployment/update/update-compliance-schema-waasupdatestatus.md index 0b5adb4096..72389ab819 100644 --- a/windows/deployment/update/update-compliance-schema-waasupdatestatus.md +++ b/windows/deployment/update/update-compliance-schema-waasupdatestatus.md @@ -33,7 +33,7 @@ WaaSUpdateStatus records contain device-centric data and acts as the device reco |**OSArchitecture** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`amd64` |The architecture of the Operating System. | |**OSName** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Windows 10` |The name of the Operating System. This will always be Windows 10 for Update Compliance. | |**OSVersion** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`1909` |The version of Windows 10. This typically is of the format of the year of the version's release, following the month. In this example, `1909` corresponds to 2019-09 (September). This maps to the `Major` portion of OSBuild. | -|**OSBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.720` |The currently-installed Windows 10 Build, in the format `Major`.`Revision`. `Major` corresponds to which Feature Update the device is on, whereas `Revision` corresponds to which quality update the device is on. Mappings between Feature release and Major, as well as Revision and KBs, are available at [aka.ms/win10releaseinfo](https://docs.microsoft.com/windows/release-information/). | +|**OSBuild** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`18363.720` |The currently-installed Windows 10 Build, in the format `Major`.`Revision`. `Major` corresponds to which Feature Update the device is on, whereas `Revision` corresponds to which quality update the device is on. Mappings between Feature release and Major, as well as Revision and KBs, are available at [aka.ms/win10releaseinfo](https://docs.microsoft.com/windows/release-health/release-information). | |**OSRevisionNumber** |[int](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/int) |`720` |An integer value for the revision number of the currently-installed Windows 10 OSBuild on the device. | |**OSCurrentStatus** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Current` |*Deprecated* Whether or not the device is on the latest Windows Feature Update available, as well as the latest Quality Update for that Feature Update. | |**OSEdition** |[string](https://docs.microsoft.com/azure/kusto/query/scalar-data-types/string) |`Enterprise` |The Windows 10 Edition or SKU. | diff --git a/windows/deployment/update/update-compliance-schema.md b/windows/deployment/update/update-compliance-schema.md index 2be2ac0e78..a42e7701f0 100644 --- a/windows/deployment/update/update-compliance-schema.md +++ b/windows/deployment/update/update-compliance-schema.md @@ -20,6 +20,9 @@ When the visualizations provided in the default experience don't fulfill your re The table below summarizes the different tables that are part of the Update Compliance solution. To learn how to navigate Azure Monitor Logs to find this data, see [Get started with log queries in Azure Monitor](https://docs.microsoft.com/azure/azure-monitor/log-query/get-started-queries). +> [!NOTE] +> Data is collected daily. The TimeGenerated field shows the time data was collected. It's added by Log Analytics when data is collected. Device data from the past 28 days is collected, even if no new data has been generated since the last time. LastScan is a clearer indicator of data freshness (that is, the last time the values were updated), while TimeGenerated indicates the freshness of data within Log Analytics. + |Table |Category |Description | |--|--|--| |[**WaaSUpdateStatus**](update-compliance-schema-waasupdatestatus.md) |Device record |This table houses device-centric data and acts as the device record for Update Compliance. Each record provided in daily snapshots map to a single device in a single tenant. This table has data such as the current device's installed version of Windows, whether it is on the latest available updates, and whether the device needs attention. | diff --git a/windows/deployment/update/update-compliance-security-update-status.md b/windows/deployment/update/update-compliance-security-update-status.md index 67cc9067ac..085e47d153 100644 --- a/windows/deployment/update/update-compliance-security-update-status.md +++ b/windows/deployment/update/update-compliance-security-update-status.md @@ -2,7 +2,7 @@ title: Update Compliance - Security Update Status report ms.reviewer: manager: laurawi -description: an overview of the Security Update Status report +description: Learn how the Security Update Status section provides information about security updates across all devices. ms.prod: w10 ms.mktglfcycl: deploy ms.pagetype: deploy @@ -10,6 +10,7 @@ author: jaimeo ms.author: jaimeo ms.collection: M365-analytics ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Security Update Status diff --git a/windows/deployment/update/update-compliance-using.md b/windows/deployment/update/update-compliance-using.md index 47ea2040ed..92ae610fc5 100644 --- a/windows/deployment/update/update-compliance-using.md +++ b/windows/deployment/update/update-compliance-using.md @@ -2,7 +2,7 @@ title: Using Update Compliance (Windows 10) ms.reviewer: manager: laurawi -description: Explains how to begin using Update Compliance. +description: Learn how to use Update Compliance to monitor your device's Windows updates. keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics ms.prod: w10 ms.mktglfcycl: deploy @@ -13,11 +13,12 @@ ms.author: jaimeo ms.localizationpriority: medium ms.collection: M365-analytics ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Use Update Compliance -In this section you'll learn how to use Update Compliance to monitor your device's Windows updates and Windows Defender Antivirus status. To configure your environment for use with Update Compliance, refer to [Get started with Update Compliance](update-compliance-get-started.md). +In this section you'll learn how to use Update Compliance to monitor your device's Windows updates and Microsoft Defender Antivirus status. To configure your environment for use with Update Compliance, refer to [Get started with Update Compliance](update-compliance-get-started.md). Update Compliance: @@ -50,7 +51,7 @@ When you select this tile, you will be redirected to the Update Compliance works Update Compliance's overview blade summarizes all the data Update Compliance provides. It functions as a hub from which you can navigate to different sections. The total number of devices detected by Update Compliance is reported in the title of this blade. What follows is a distribution for all devices as to whether they are up to date on the following items: * Security updates: A device is up to date on quality updates whenever it has the latest applicable quality update installed. Quality updates are monthly cumulative updates that are specific to a version of Windows 10. * Feature updates: A device is up to date on feature updates whenever it has the latest applicable feature update installed. Update Compliance considers [Servicing Channel](waas-overview.md#servicing-channels) when determining update applicability. -* AV Signature: A device is up to date on Antivirus Signature when the latest Windows Defender Signatures have been downloaded. This distribution only considers devices that are running Windows Defender Antivirus. +* AV Signature: A device is up to date on Antivirus Signature when the latest Windows Defender Signatures have been downloaded. This distribution only considers devices that are running Microsoft Defender Antivirus. The blade also provides the time at which your Update Compliance workspace was [refreshed](#update-compliance-data-latency). @@ -62,21 +63,19 @@ The following is a breakdown of the different sections available in Update Compl ## Update Compliance data latency -Update Compliance uses Windows 10 diagnostic data as its data source. After you add Update Compliance and appropriately configure your devices, it could take 48-72 hours before they first appear. The process that follows is as follows: +Update Compliance uses Windows 10 diagnostic data as its data source. After you add Update Compliance and appropriately configure your devices, it could take 48-72 hours before they first appear. -Update Compliance is refreshed every 12 hours. This means that every 12 hours all data that has been gathered over the last 12-hour interval is pushed to Log Analytics. However, the rate at which each type of data is sent from the device and how long it takes to be ready for Update Compliance varies, roughly outlined below. +The data powering Update Compliance is refreshed every 24 hours, and refreshes with the latest data from all devices part of your organization that have been seen in the past 28 days. The entire set of data is refreshed in each daily snapshot, which means that the same data can be re-ingested even if no new data actually arrived from the device since the last snapshot. Snapshot time can be determined by the TimeGenerated field for each record, while LastScan can be used to roughly determine the freshness of each record's data. | Data Type | Data upload rate from device | Data Latency | |--|--|--| |WaaSUpdateStatus | Once per day |4 hours | |WaaSInsiderStatus| Once per day |4 hours | |WaaSDeploymentStatus|Every update event (Download, install, etc.)|24-36 hours | -|WDAVStatus|On signature update|24 hours | -|WDAVThreat|On threat detection|24 hours | |WUDOAggregatedStatus|On update event, aggregated over time|24-36 hours | |WUDOStatus|Once per day|12 hours | -This means you should generally expect to see new data device data every 24 hours, except for WaaSDeploymentStatus and WUDOAggregatedStatus, which may take 36-48 hours (if it misses the 36th hour refresh, it would be in the 48th, so the data will be present in the 48th hour refresh). +This means you should generally expect to see new data device data every 24 hours, except for WaaSDeploymentStatus and WUDOAggregatedStatus, which may take 36-48 hours. ## Using Log Analytics @@ -89,4 +88,4 @@ See below for a few topics related to Log Analytics: ## Related topics -[Get started with Update Compliance](update-compliance-get-started.md) \ No newline at end of file +[Get started with Update Compliance](update-compliance-get-started.md) diff --git a/windows/deployment/update/update-policies.md b/windows/deployment/update/update-policies.md new file mode 100644 index 0000000000..58e2b5e496 --- /dev/null +++ b/windows/deployment/update/update-policies.md @@ -0,0 +1,203 @@ +--- +title: Policies for update compliance, activity, and end-user experience +ms.reviewer: +manager: laurawi +description: +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +ms.topic: article +ms.collection: M365-modern-desktop +--- + +# Policies for update compliance, activity, and end-user experience +Keeping devices up to date is the best way to keep them working smoothly and securely. + +## Deadlines for update compliance + +You can control how strictly devices must reliably keep to your desired update schedule by using update deadline policies. Windows components adapt based on these deadlines. Also, they can make tradeoffs between user experience and velocity in order to meet your desired update deadlines. For example, they can prioritize user experience well before the +deadline approaches, and then prioritize velocity as the deadline nears, while still affording the user some control. + +### Deadlines + +Beginning with Windows 10, version 1903 and with the August 2019 security update for Windows 10, version 1709 +and late, a new policy was introduced to replace older deadline-like policies: **Specify deadlines for automatic updates and restarts**. + +The older policies started enforcing deadlines once the device reached a “restart pending” state for +an update. The new policy starts the countdown for the update installation deadline from when the +update is published plus any deferral. In addition, this policy includes a configurable grace period and the option +to opt out of automatic restarts until the deadline is reached (although we recommend always allowing automatic +restarts for maximum update velocity). + +> [!IMPORTANT] +> If you use the new **Specify deadlines for automatic updates and restarts** setting in Windows 10, +> version 1903, you must disable the [older deadline policies](wufb-compliancedeadlines.md#prior-to-windows-10-version-1709) because they could conflict. + +We recommend you set deadlines as follows: +- Quality update deadline, in days: 3 +- Feature update deadline, in days: 7 +- +Notifications are automatically presented to the user at appropriate times, and users can choose to be reminded +later, to reschedule, or to restart immediately, depending on how close the deadline is. We recommend that you +do **not** set any notification policies, because they are automatically configured with appropriate defaults. An exception is if you +have kiosks or digital signage. + +While three days for quality updates and seven days for feature updates is our recommendation, you might decide +you want more or less, depending on your organization and its requirements, and this policy is configurable down +to a minimum of two days. + + +> [!IMPORTANT] +> If the device is unable to reach the Internet, it can't determine when Microsoft +> published the update, so it won't be able to enforce the deadline. Learn more about [low activity devices](#device-activity-policies). + +### Grace periods + +You can set a period of days for Windows to find a minimally disruptive automatic restart time before the restart is enforced. This +is especially useful in cases where a user has been away for many days (for example, on vacation) so that the device will not +be forced to update immediately when the user returns. + +We recommend you set the following: + +- Grace period, in days: 2 + +Once the deadline and grace period have passed, updates are applied automatically, and a restart occurs +regardless of [active hours](#active-hours). + + +### Let Windows choose when to restart + +Windows can use user interactions to dynamically identify the least disruptive time for an +automatic restart. To take advantage of this feature, ensure **ConfigureDeadlineNoAutoReboot** is set to +**Disabled**. + +## Device activity policies + +Windows typically requires that a device is active and connected to the internet for at least six hours, with at least two +of continuous activity, in order to successfully complete a system update. The device could have other +physical circumstances that prevent successful installation of an update--for example, if a laptop is running low +on battery power, or the user has shut down the device before active hours end and the device cannot comply +with the deadline. + +You can use the settings in this section to ensure that devices are actually available to install updates during the update compliance period. + +### Active hours + +"Active hours" identify the period of time when a device is expected to be in use. Normally, restarts will occur outside of +these hours. Windows 10, version 1903 introduced "intelligent active hours," which allow the system to learn active hours based on a user’s activities, rather than you as an administrator having to make decisions for your organization or allowing the user to choose active hours that minimize the period when the system can install an update. + +> [!IMPORTANT] +> If you used the **Configure Active Hours** setting in previous versions of Windows 10, these +options must be **Disabled** in order to take advantage of intelligent active hours. + +If you do set active hours, we recommend setting the following policies to **Disabled** in order to increase update +velocity: + +- [Delay automatic reboot](waas-restart.md#delay-automatic-reboot). While it’s possible to set the system to delay restarts for users who are logged +in, this might delay an update indefinitely if a user is always either logged in or shut down. Instead, we +recommend setting the following polices to **Disabled**: + - **Turn off auto-restart during active hours** + - **No auto-restart with logged on users for scheduled automatic updates** + + - [Limit restart delays](waas-restart.md#limit-restart-delays). By using compliance deadlines, your users will receive notifications that +updates will occur, so we recommend that you set this policy to **Disabled**, to allow compliance deadlines to eliminate the user’s ability to delay a restart outside of compliance deadline settings. + +- **Do not allow users to approve updates and reboots**. Letting users approve or engage with the update process outside of the deadline policies decreases update velocity and increases risk. These policies should be set to **Disabled**: + - [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval) + - [Update/EngagedRestartDeadline](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestartdeadline) + - [Update/EngagedRestartDeadlineForFeatureUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestartdeadlineforfeatureupdates) + - [Update/EngagedRestartSnoozeSchedule](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestartsnoozeschedule) + - [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestartsnoozescheduleforfeatureupdates) + - [Update/EngagedRestartTransitionSchedule](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-engagedrestarttransitionschedule) + +- [Configure automatic update](waas-wu-settings.md#configure-automatic-updates). By properly setting policies to configure automatic updates, you can increase update velocity by having clients contact a Windows Server Update Services (WSUS) server so it can manage them. We recommend that you set this policy to **Disabled**. However, if you need to provide values, ensure that you set downloads to install automatically by setting the [Group Policy](waas-manage-updates-wsus.md#configure-automatic-updates-and-update-service-location) to **4**. If you’re using Microsoft Intune, setting the value to [Reset to Default](https://docs.microsoft.com/mem/intune/protect/windows-update-settings#user-experience-settings). +- **Allow auto Windows Update to download over metered networks**. Since more and more devices primarily use cellular data and do not have wi-fi access, consider allowing users to automatically download updates from a metered network. Though the default setting does not allow download over a metered network, setting this value to **1** can increase velocity by enabling users to get updates whether they are connected to the internet or not, provided they have cellular service. + +> [!IMPORTANT] +> Older versions of Windows don't support intelligent active hours. If your device runs a version of Windows prior to Windows 10, version 1903, we recommend setting the following policies: +>- [Configure active hours](waas-restart.md#configure-active-hours). Starting with Windows 10, version 1703, you can specify a maximum active-hour range which is counted from the active hours start time. We recommend setting +this value to **10**. +>- [Schedule update installation](waas-restart.md#schedule-update-installation). In the **Configure Automatic Updates** settings, there are two ways to control a forced restart after a specified installation time. If you use **schedule update installation**, do not enable both settings because they will most likely conflict. +> - **Specify automatic maintenance time**. This setting lets you set broader maintenance windows for updates and ensures that this schedule does not conflict with active hours. We +recommend setting this value to **3** (corresponding to 3 AM). If 3:00 AM is in the middle of the work shift, pick another time that is at least a couple hours before your scheduled work time begins. +> - **Schedule the install time**. This setting allows you to schedule an installation time for a restart. We do *not* recommend you set this to **Disabled** as it could conflict with active hours. + +### Power policies + +Devices must actually be available during non-active hours in order to an update. They can't do this if power policies prevent them from waking up. In our organization, we strive to set a balance between security and eco-friendly configurations. We recommend the following settings to achieve what we feel are the appropriate tradeoffs: + +To a user, a device is either on or off, but for Windows, there are states that will allow an update to occur (active) and states that do not (inactive). Some states are considered active (sleep), but the user may think the device is off. Also, there are power statuses (plugged in/battery) that Windows checks before starting an update. + +You can override the default settings and prevent users from changing them in order to ensure that devices are available for updates during non-active hours. + +> [!NOTE] +> One way to ensure that devices can install updates when you need them to is to educate your users to keep devices plugged in during non-active hours. Even with the best policies, a device that isn't plugged in will not be updated, even in sleep mode. + +We recommend these power management settings: + +- Sleep mode (S1 or S0 Low Power Idle or [Modern Standby](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby)). When a device is in sleep mode, the system +appears to be off but if an update is available, it can wake the device up in order to take an update. The +power consumption in sleep mode is between working (system fully usable) and hibernate (S4 - lowest +power level before shutdown). When a device is not being used, the system will generally move to sleep +mode before it goes to hibernate. Issues in velocity arise when the time between sleep and hibernate is +too short and Windows does not have time to complete an update. Sleep mode is an important setting +because the system can wake the system from sleep in order to start the update process, as long as there +is enough power. + +Set the following policies to **Enable** or **Do Not Configure** in order to allow the device to use sleep mode: +- [Power/AllowStandbyStatesWhenSleepingOnBattery](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-allowstandbystateswhensleepingonbattery) +- [Power/AllowStandbyWhenSleepingPluggedIn](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-selectlidcloseactionpluggedin) + +Set the following policies to **1 (Sleep)** so that when a user closes the lid of a device, the system goes to +sleep mode and the device has an opportunity to take an update: +- [Power/SelectLidCloseActionOnBattery](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-selectlidcloseactiononbattery) +- [Power/SelectLidCloseActionPluggedIn](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-selectlidcloseactionpluggedin) + +- **Hibernate**. When a device is hibernating, power consumption is very low and the system cannot wake up +without user intervention, like pressing the power button. If a device is in this state, it cannot be updated +unless it supports an ACPI Time and Alarm Device (TAD). That said, if a device supporting Traditional Sleep +(S3) is plugged in, and a Windows update is available, a hibernate state will be delayed until the update is complete. + +> [!NOTE] +> This does not apply to devices that support Modern Standby (S0 Low Power Idle). You can check which system sleep state (S3 or S0 Low Power Idle) a device supports by running `powercfg /a` at a command prompt. For more, see [Powercfg options](https://docs.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options#option_availablesleepstates). + +The default timeout on devices that support traditional sleep is set to three hours. We recommend that you do not reduce these policies in order to allow Windows Update the opportunity to restart the device before sending it into hibernation: + +- [Power/HibernateTimeoutOnBattery](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-power#power-hibernatetimeoutpluggedin) + +## Old or conflicting policies + +Each release of Windows 10 can introduce new policies to make the experience better for both administrators and their organizations. When we release a new client policy, we either release it purely for that release and later or we backport the policy to make it available on earlier versions. + +> [!IMPORTANT] +> If you are using Group Policy, note that we don't update the old ADMX templates and you must use the newer (1903) ADMX template in order to use the newer policy. Also, if you are +> using an MDM tool (Microsoft or non-Microsoft), you can't use the new policy until it's available in the tool interface. + +As administrators, you have set up and expect certain behaviors, so we expressly do not remove older policies since they were set up for your particular use cases. However, if you set a new policy without disabling a similar older policy, you could have conflicting behavior and updates might not perform as expected. + +> [!IMPORTANT] +> We sometimes find that administrators set devices to get both Group Policy settings and MDM settings from an MDM server such as Microsoft Intune. Policy conflicts are handled differently, depending on how they are ultimately set up: +> - Windows updates: Group Policy settings take precedence over MDM. +> - Microsoft Intune: If you set different values for the same policy on two different groups, you will +> receive an alert and neither policy will be set until the conflict is resolved. +> It is crucial that you disable conflicting policies in order for devices in your organization to take updates as +> expected. For example, if a device is not reacting to your MDM policy changes, check to see if a similar +> policy is set in Group Policy with a differing value. +> If you find that update velocity is not as high as you expect or if some devices are slower than others, it might be +> time to clear all polices and settings and specify only the recommended update policies. See the Policy and settings reference for a consolidated list of recommended polices. + +The following are policies that you might want to disable because they could decrease update velocity or there are better policies to use that might conflict: +- **Defer Feature Updates Period in Days**. For maximum update velocity, it's best to set this to **0** (no +deferral) so that the feature update can complete and monthly security updates will be offered again. Even if there is an urgent quality update that must be quickly deployed, it is best to use **Pause Feature +Updates** rather than setting a deferral policy. You can choose a longer period if you don't want to stay up to date with the latest feature update. +- **Defer Quality Updates Period in Days**. To minimize risk and maximize update velocity, the maximum time you might want to consider while evaluating the update with a different ring of devices is two to three days. +- **Pause Feature Updates Start Time**. Set to **Disabled** unless there is a known issue requiring time for a resolution. +- **Pause Quality Updates Start Time**. Set to **Disabled** unless there is a known issue requiring time for a resolution. +- **Deadline No Auto Reboot**. Default is **Disabled – Set to 0** . We recommend that devices automatically try to restart when an update is received. Windows uses user interactions to dynamically identify the least disruptive time to restart. + +There are additional policies are no longer supported or have been superseded. diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 6bb0bf7519..597bfadf2a 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -1,6 +1,6 @@ --- title: Configure BranchCache for Windows 10 updates (Windows 10) -description: Use BranchCache to optimize network bandwidth during update deployment. +description: In this article, learn how to use BranchCache to optimize network bandwidth during update deployment. ms.prod: w10 ms.mktglfcycl: manage author: jaimeo @@ -9,6 +9,7 @@ ms.author: jaimeo ms.reviewer: manager: laurawi ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Configure BranchCache for Windows 10 updates @@ -20,7 +21,7 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it’s easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. +BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and Microsoft Endpoint Manager can use BranchCache to optimize network bandwidth during update deployment, and it's easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. - Distributed Cache mode operates like the [Delivery Optimization](waas-delivery-optimization.md) feature in Windows 10: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file. @@ -33,7 +34,7 @@ For detailed information about how Distributed Cache mode and Hosted Cache mode ## Configure clients for BranchCache -Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](https://technet.microsoft.com/library/dd637820%28v=ws.10%29.aspx) in the [BranchCache Early Adopter’s Guide](https://technet.microsoft.com/library/dd637762(v=ws.10).aspx). +Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](https://technet.microsoft.com/library/dd637820%28v=ws.10%29.aspx) in the [BranchCache Early Adopter's Guide](https://technet.microsoft.com/library/dd637762(v=ws.10).aspx). In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows 10, simply set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 0c96d3ba90..68b9bc63f3 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -5,7 +5,7 @@ manager: laurawi description: You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. ms.prod: w10 ms.mktglfcycl: deploy - +ms.collection: m365initiative-coredeploy audience: itpro author: jaimeo ms.localizationpriority: medium @@ -48,7 +48,7 @@ With Windows Update for Business, you can set a device to be on either Windows I **Release branch policies** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 or later:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\BranchReadinessLevel | | GPO for Windows 10, version 1511:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpgrade | @@ -73,7 +73,7 @@ For example, a device on the Semi-Annual Channel with `DeferFeatureUpdatesPeriod

        **Policy settings for deferring feature updates** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 later:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdates
        \Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdatesPeriodInDays | | GPO for Windows 10, version 1511:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpgradePeriod | @@ -97,11 +97,11 @@ In cases where the pause policy is first applied after the configured start date **Policy settings for pausing feature updates** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | -| GPO for Windows 10, version 1607 and later:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | **1607:** \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdates
        **1703 and later:** \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdatesStartDate | +| GPO for Windows 10, version 1607 and later:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | **1607:** \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdates
        **1703 and later:** \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdatesStartTime | | GPO for Windows 10, version 1511:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\Pause | -| MDM for Windows 10, version 1607 and later:
        ../Vendor/MSFT/Policy/Config/Update/
        **PauseFeatureUpdates** | **1607:** \Microsoft\PolicyManager\default\Update\PauseFeatureUpdates
        **1703 and later:** \Microsoft\PolicyManager\default\Update\PauseFeatureUpdatesStartDate | +| MDM for Windows 10, version 1607 and later:
        ../Vendor/MSFT/Policy/Config/Update/
        **PauseFeatureUpdates** | **1607:** \Microsoft\PolicyManager\default\Update\PauseFeatureUpdates
        **1703 and later:** \Microsoft\PolicyManager\default\Update\PauseFeatureUpdatesStartTime | | MDM for Windows 10, version 1511:
        ../Vendor/MSFT/Policy/Config/Update/
        **DeferUpgrade** | \Microsoft\PolicyManager\default\Update\Pause | You can check the date that Feature Updates were paused by checking the registry key **PausedFeatureDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. @@ -134,7 +134,7 @@ You can set your system to receive updates for other Microsoft products—known **Policy settings for deferring quality updates** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 and later:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Quality Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\DeferQualityUpdates
        \Policies\Microsoft\Windows\WindowsUpdate\DeferQualityUpdatesPeriodInDays | | GPO for Windows 10, version 1511:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpdatePeriod | @@ -157,7 +157,7 @@ In cases where the pause policy is first applied after the configured start date **Policy settings for pausing quality updates** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 and later:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Quality Updates are received** |**1607:** \Policies\Microsoft\Windows\WindowsUpdate\PauseQualityUpdates
        **1703:** \Policies\Microsoft\Windows\WindowsUpdate\PauseQualityUpdatesStartTime | | GPO for Windows 10, version 1511:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\Pause | @@ -207,7 +207,7 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving **Policy settings to exclude drivers** -| Policy | Sets registry key under **HKLM\Software** | +| Policy | Sets registry key under HKLM\Software | | --- | --- | | GPO for Windows 10, version 1607 and later:
        Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Do not include drivers with Windows Updates** | \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | | MDM for Windows 10, version 1607 and later:
        ../Vendor/MSFT/Policy/Config/Update/
        **ExcludeWUDriversInQualityUpdate** | \Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate | @@ -220,13 +220,13 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| BranchReadinessLevel | REG_DWORD | 2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
        4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
        8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
        16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-annual Channel
        32: systems take Feature Updates from Semi-annual Channel
        Note: Other value or absent: receive all applicable updates | +| BranchReadinessLevel | REG_DWORD | 2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
        4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
        8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
        16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-Annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-Annual Channel
        32: systems take Feature Updates from Semi-Annual Channel
        Note: Other value or absent: receive all applicable updates | | DeferQualityUpdates | REG_DWORD | 1: defer quality updates
        Other value or absent: don’t defer quality updates | | DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-35: defer quality updates by given days | -| PauseQualityUpdatesStartDate | REG_DWORD | 1: pause quality updates
        Other value or absent: don’t pause quality updates | +| PauseQualityUpdatesStartTime | REG_DWORD | 1: pause quality updates
        Other value or absent: don’t pause quality updates | |DeferFeatureUpdates | REG_DWORD | 1: defer feature updates
        Other value or absent: don’t defer feature updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: defer feature updates by given days | -| PauseFeatureUpdatesStartDate | REG_DWORD |1: pause feature updates
        Other value or absent: don’t pause feature updates | +| PauseFeatureUpdatesStartTime | REG_DWORD |1: pause feature updates
        Other value or absent: don’t pause feature updates | | ExcludeWUDriversInQualityUpdate | REG_DWORD | 1: exclude Windows Update drivers
        Other value or absent: offer Windows Update drivers | @@ -234,11 +234,11 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | -| BranchReadinessLevel | REG_DWORD |2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
        4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
        8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
        16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-annual Channel
        32: systems take Feature Updates from Semi-annual Channel
        Note: Other value or absent: receive all applicable updates | +| BranchReadinessLevel | REG_DWORD |2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
        4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
        8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
        16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-Annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-Annual Channel
        32: systems take Feature Updates from Semi-Annual Channel
        Note: Other value or absent: receive all applicable updates | | DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-35: defer quality updates by given days | -| PauseQualityUpdatesStartDate | REG_DWORD | 1: pause quality updates
        Other value or absent: don’t pause quality updates | +| PauseQualityUpdatesStartTime | REG_DWORD | 1: pause quality updates
        Other value or absent: don’t pause quality updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: defer feature updates by given days | -| PauseFeatureUpdatesStartDate | REG_DWORD | 1: pause feature updates
        Other value or absent: don’t pause feature updates | +| PauseFeatureUpdatesStartTime | REG_DWORD | 1: pause feature updates
        Other value or absent: don’t pause feature updates | | ExcludeWUDriversinQualityUpdate | REG_DWORD | 1: exclude Windows Update drivers
        Other value or absent: offer Windows Update drivers | ## Update devices to newer versions diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md index a5d605d778..d65d59a04d 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/update/waas-delivery-optimization-reference.md @@ -2,17 +2,17 @@ title: Delivery Optimization reference ms.reviewer: manager: laurawi -description: Reference of all Delivery Optimization settings and descriptions of same +description: This article provides a summary of references and descriptions for all of the Delivery Optimization settings. keywords: oms, operations management suite, wdav, updates, downloads, log analytics ms.prod: w10 ms.mktglfcycl: deploy - audience: itpro author: jaimeo ms.localizationpriority: medium ms.author: jaimeo ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Delivery Optimization reference @@ -23,7 +23,7 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -There are a great many details you can set in Delivery Optimization to customize it to do just what you need it to. This topic summarizes them for your reference. +There are a great many details you can set in Delivery Optimization to customize it to do just what you need it to. This topic summarizes them for your reference. If you just need an overview of Delivery Optimization, see [Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). If you need information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md). ## Delivery Optimization options @@ -47,9 +47,9 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | [Absolute Max Cache Size](#absolute-max-cache-size) | DOAbsoluteMaxCacheSize | 1607 | | [Modify Cache Drive](#modify-cache-drive) | DOModifyCacheDrive | 1607 | | [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size) | DOMinFileSizeToCache | 1703 | -| [Maximum Download Bandwidth](#maximum-download-bandwidth) | DOMaxDownloadBandwidth | 1607 | -| [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) | DOPercentageMaxDownloadBandwidth | 1607 | -| [Max Upload Bandwidth](#max-upload-bandwidth) | DOMaxUploadBandwidth | 1607 | +| [Maximum Download Bandwidth](#maximum-download-bandwidth) | DOMaxDownloadBandwidth | 1607 (removed in Windows 10, version 2004; use [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) or [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-foreground-download-bandwidth-in-kbs) instead)| +| [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) | DOPercentageMaxDownloadBandwidth | 1607 (removed in Windows 10, version 2004; use [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) or [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-foreground-download-bandwidth-in-kbs) instead)| +| [Max Upload Bandwidth](#max-upload-bandwidth) | DOMaxUploadBandwidth | 1607 (removed in Windows 10, version 2004) | | [Monthly Upload Data Cap](#monthly-upload-data-cap) | DOMonthlyUploadDataCap | 1607 | | [Minimum Background QoS](#minimum-background-qos) | DOMinBackgroundQoS | 1607 | | [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) | DOAllowVPNPeerCaching | 1709 | @@ -64,6 +64,10 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) | DODelayForegroundDownloadFromHttp | 1803 | | [Delay foreground download cache server fallback (in secs)](#delay-foreground-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackForeground | 1903 | | [Delay background download cache server fallback (in secs)](#delay-background-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackBackground | 1903 | +| [Cache Server Hostname](#cache-server-hostname) | DOCacheHost | 2004 | +| [Cache Server Hostname Source](#cache-server-hostname-source) | DOCacheHostSource | 2004 | +| [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxForegroundDownloadBandwidth | 2004 | +| [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxBackgroundDownloadBandwidth | 2004 | ### More detail on Delivery Optimization settings: @@ -107,7 +111,7 @@ Download mode dictates which download sources clients are allowed to use when do | --- | --- | | HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content over HTTP from the download's original source. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. | | LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. The Delivery Optimization cloud service finds other clients that connect to the Internet using the same public IP as the target client. These clients then attempts to connect to other peers on the same network by using their private subnet IP.| -| Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | +| Group (2) | When group mode is set, the group is automatically selected based on the device's Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use GroupID option to create your own custom group independently of domains and AD DS sites. Starting with Windows 10, version 1803, you can use the GroupIDSource parameter to take advantage of other method to create groups dynamically. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | | Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | |Bypass (100) | Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set **DownloadMode** to **0** or **99**. | @@ -119,7 +123,7 @@ Download mode dictates which download sources clients are allowed to use when do By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and Active Directory Domain Services site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or Active Directory Domain Services site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. -[//]: # (Configuration Manager Boundary Group option; GroupID Source policy) +[//]: # (Configuration Manager boundary group option; GroupID Source policy) >[!NOTE] >To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/) @@ -152,7 +156,7 @@ This setting specifies the required minimum disk size (capacity in GB) for the d ### Max Cache Age -In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). +In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to "0" which means "unlimited" to avoid peers re-downloading content. When "Unlimited" value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). ### Max Cache Size @@ -184,7 +188,7 @@ This setting specifies the maximum download bandwidth that Delivery Optimization ### Max Upload Bandwidth -This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or “unlimited” which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate. +This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or "unlimited" which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate. ### Set Business Hours to Limit Background Download Bandwidth Starting in Windows 10, version 1803, specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. @@ -232,4 +236,33 @@ The device can download from peers while on battery regardless of this policy. >[!IMPORTANT] > By default, devices **will not upload while on battery**. To enable uploads while on battery, you need to enable this policy and set the battery value under which uploads pause. +### Cache Server Hostname +Set this policy to to designate one or more Microsoft Connected Cache servers to be used by Delivery Optimization. You can set one or more FQDNs or IP Addresses that are comma separated, for example: myhost.somerandomhost.com,myhost2.somrandomhost.com,10.10.1.7. + + +### Cache Server Hostname Source + +This policy allows you to specify how your client(s) can discover Delivery Optimization in Network Cache servers dynamically. There are two options: +- 1 = DHCP Option 235. +- 2 = DHCP Option 235 Force. + +With either option, the client will query DHCP Option ID 235 and use the returned value as the Cache Server Hostname. Option 2 overrides the Cache Server Hostname policy, if set. + +Set this policy to designate one or more Delivery Optimization in Network Cache servers through a custom DHCP Option. Specify the custom DHCP option on your server as *text* type. You can add one or more values as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address with commas. + +> [!NOTE] +> If you format the DHCP Option ID incorrectly, the client will fall back to the Cache Server Hostname policy value if that value has been set. + +### Maximum Foreground Download Bandwidth (in KB/s) + +Specifies the maximum foreground download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. + +The default value of 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. + + +### Maximum Background Download Bandwidth (in KB/s) + +Specifies the maximum background download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. + +The default value 0 (zero) means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. diff --git a/windows/deployment/update/waas-delivery-optimization-setup.md b/windows/deployment/update/waas-delivery-optimization-setup.md index ac14bcf549..6e19c5ba6a 100644 --- a/windows/deployment/update/waas-delivery-optimization-setup.md +++ b/windows/deployment/update/waas-delivery-optimization-setup.md @@ -2,7 +2,7 @@ title: Set up Delivery Optimization ms.reviewer: manager: laurawi -description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10 +description: In this article, learn how to set up Delivery Optimization, a new peer-to-peer distribution method in Windows 10. keywords: oms, operations management suite, wdav, updates, downloads, log analytics ms.prod: w10 ms.mktglfcycl: deploy @@ -12,6 +12,7 @@ ms.localizationpriority: medium ms.author: jaimeo ms.collection: M365-modern-desktop ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Set up Delivery Optimization for Windows 10 updates @@ -24,7 +25,7 @@ ms.topic: article ## Recommended Delivery Optimization settings -Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greatest impact if particular situations exist in your deployment: +Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greatest impact if particular situations exist in your deployment. If you just need an overview of Delivery Optimization, see [Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md). - Does your topology include multiple breakouts to the internet (i.e., a "hybrid WAN") or are there only a few connections to the internet, so that all requests appear to come from a single external IP address (a "hub and spoke" topology)? - If you use boundary groups in your topology, how many devices are present in a given group? @@ -35,6 +36,9 @@ Delivery Optimization offers a great many settings to fine-tune its behavior (se >[!NOTE] >These scenarios (and the recommended settings for each) are not mutually exclusive. It's possible that your deployment might involve more than one of these scenarios, in which case you can employ the related settings in any combination as needed. In all cases, however, "download mode" is the most important one to set. +> [!NOTE] +> Microsoft Intune includes a profile to make it easier to set Delivery Optimization policies. For details, see [Delivery Optimization settings for Intune](https://docs.microsoft.com/mem/intune/configuration/delivery-optimization-settings). + Quick-reference table: | Use case | Policy | Recommended value | Reason | @@ -47,7 +51,7 @@ Quick-reference table: ### Hybrid WAN scenario -For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren’t aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter. +For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren't aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter. @@ -66,6 +70,9 @@ To do this in Group Policy go to **Configuration\Policies\Administrative Templat To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set **DODownloadMode** to **2**. +> [!NOTE] +> For more about using Delivery Optimization with Configuration Manager boundary groups, see [Delivery Optmization](https://docs.microsoft.com/mem/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management#delivery-optimization). + ### Large number of mobile devices @@ -89,7 +96,7 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** In a lab situation, you typically have a large number of devices that are plugged in and have a lot of free disk space. By increasing the content expiration interval, you can take advantage of these devices, using them as excellent upload sources in order to upload much more content over a longer period. -To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Max Cache Age** to **6048000** (7 days) or more (up to 30 days). +To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Max Cache Age** to **604800** (7 days) or more (up to 30 days). To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DOMaxCacheAge to 7 or more (up to 30 days). @@ -97,7 +104,7 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** ## Monitor Delivery Optimization -[//]: # (How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%) +[//]: # (How to tell if it's working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%) ### Windows PowerShell cmdlets @@ -122,6 +129,7 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** | PredefinedCallerApplication | Indicates the last caller that initiated a request for the file. | | ExpireOn | The target expiration date and time for the file. | | Pinned | A yes/no value indicating whether an item has been "pinned" in the cache (see `setDeliveryOptmizationStatus`). | + `Get-DeliveryOptimizationPerfSnap` returns a list of key performance data: @@ -139,7 +147,7 @@ Using the `-Verbose` option returns additional information: - Bytes from CDN (the number of bytes received over HTTP) - Average number of peer connections per download  -Starting in Window 10, version 1903, `get-DeliveryOptimizationPerfSnap` has a new option `-CacheSummary` which provides a summary of the cache status. +**Starting in Windows 10, version 2004**, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of the connected peers. Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. @@ -166,6 +174,33 @@ You can now "pin" files to keep them persistent in the cache. You can only do th #### Work with Delivery Optimization logs +**Starting in Windows 10, version 2004:** + +- `Enable-DeliveryOptimizationVerboseLogs` +- `Disable-DeliveryOptimizationVerboseLogs` + +- `Get-DeliveryOptimizationLogAnalysis [ETL Logfile path] [-ListConnections]` + +With no options, this cmdlet returns these data: + +- total number of files +- number of foreground files +- minimum file size for it to be cached +- number of eligible files +- number of files with peers +- number of peering files [how different from the above?] +- overall efficiency +- efficiency in the peered files + +Using the `-ListConnections` option returns these details about peers: + +- destination IP address +- peer type +- status code +- bytes sent +- bytes received +- file ID + **Starting in Windows 10, version 1803:** `Get-DeliveryOptimizationLog [-Path ] [-Flush]` @@ -184,7 +219,7 @@ Log entries are written to the PowerShell pipeline as objects. To dump logs to a Update Compliance provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days. -![DO status](images/UC_workspace_DO_status.png) +[ ![DO status](images/UC_workspace_DO_status.png) ](images/UC_workspace_DO_status.png#lightbox) For details, see [Delivery Optimization in Update Compliance](update-compliance-delivery-optimization.md). diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index d37589c3e6..bbafcf8b44 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -1,18 +1,19 @@ --- -title: Configure Delivery Optimization for Windows 10 updates (Windows 10) -ms.reviewer: +title: Delivery Optimization for Windows 10 updates manager: laurawi -description: Delivery Optimization is a peer-to-peer distribution method in Windows 10 +description: This article provides information about Delivery Optimization, a peer-to-peer distribution method in Windows 10. keywords: oms, operations management suite, wdav, updates, downloads, log analytics ms.prod: w10 ms.mktglfcycl: deploy - audience: itpro author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.collection: M365-modern-desktop +ms.collection: +- M365-modern-desktop +- m365initiative-coredeploy ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Delivery Optimization for Windows 10 updates @@ -24,14 +25,49 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization in conjunction with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or Microsoft Endpoint Configuration Manager (when installation of Express Updates is enabled). +Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization in conjunction with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or Microsoft Endpoint Manager (when installation of Express Updates is enabled). Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet. +For information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md). For a comprehensive list of all Delivery Optimization settings, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). + >[!NOTE] >WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. +## New in Windows 10, version 2004 + +- Enterprise network throttling: new settings have been added in Group Policy and mobile device management (MDM) to control foreground and background throttling as absolute values (Maximum Background Download Bandwidth in (in KB/s)). These settings are also available in the Windows user interface: + + ![absolute bandwidth settings in delivery optimization interface](images/DO-absolute-bandwidth.png) + +- Activity Monitor now identifies the cache server used for as the source for Microsoft Connected Cache. For more information about using Microsoft Connected Cache with Configuration Manager, see [Microsoft Connected Cache](https://docs.microsoft.com/mem/configmgr/core/plan-design/hierarchy/microsoft-connected-cache). + +- New options for [`Get-DeliveryOptimizationPerfSnap`](waas-delivery-optimization-setup.md#analyze-usage). + +- New cmdlets: + - `Enable-DeliveryOptimizationVerboseLogs` + - `Disable-DeliveryOptimizationVerboseLogs` + - `Get-DeliveryOptimizationLogAnalysis [ETL Logfile path] [-ListConnections]` + +- New policy settings: + - [DOCacheHost](waas-delivery-optimization-reference.md#cache-server-hostname) + - [DOCacheHostSource](waas-delivery-optimization-reference.md#cache-server-hostname-source) + - [DOMaxForegroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs); replaces DOPercentageMaxDownloadBandwidth + - [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) + +- Removed policy settings (if you set these policies in Windows 10, 2004, they will have no effect): + - DOMaxDownloadBandwidth; use [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) or [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) instead. + - DOPercentageMaxDownloadBandwidth; use [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) or [DOMaxBackgroundDownloadBandwidth](waas-delivery-optimization-reference.md#maximum-foreground-download-bandwidth-in-kbs) instead. + - DOMaxUploadBandwidth + +- Support for new types of downloads: + - Office installs and updates + - Xbox game pass games + - MSIX apps (HTTP downloads only) + - Edge browser installs and updates + - [Dynamic updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-benefits-of-windows-10-dynamic-update/ba-p/467847) + ## Requirements The following table lists the minimum Windows 10 version that supports Delivery Optimization: @@ -41,7 +77,6 @@ The following table lists the minimum Windows 10 version that supports Delivery | Computers running Windows 10 | 1511 | | Computers running Server Core installations of Windows Server | 1709 | | IoT devices | 1803 | -| HoloLens devices | 1803 | **Types of download packages supported by Delivery Optimization** @@ -52,20 +87,22 @@ The following table lists the minimum Windows 10 version that supports Delivery | Windows Store files | 1511 | | Windows Store for Business files | 1511 | | Windows Defender definition updates | 1511 | -| Office Click-to-Run updates | 1709 | +| Microsoft 365 Apps and updates | 1709 (for more information, see [Delivery Optimization and Microsoft 365 Apps](https://docs.microsoft.com/deployoffice/delivery-optimization)) | | Win32 apps for Intune | 1709 | -| Configuration Manager Express Updates | 1709 + Configuration Manager version 1711 | - - +| Xbox game pass games | 2004 | +| MSIX apps (HTTP downloads only) | 2004 | +| Configuration Manager Express updates | 1709 + Configuration Manager version 1711 | +| Edge browser installs and updates | 1809 | +| [Dynamic updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-benefits-of-windows-10-dynamic-update/ba-p/467847) | 1903 | +> [!NOTE] +> Starting with Configuration Manager version 1910, you can use Delivery Optimization for the distribution of all Windows update content for clients running Windows 10 version 1709 or newer, not just express installation files. For more, see [Delivery Optimization starting in version 1910](https://docs.microsoft.com/mem/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#bkmk_DO-1910). In Windows 10 Enterprise, Professional, and Education editions, Delivery Optimization is enabled by default for peer-to-peer sharing on the local network (NAT). Specifically, all of the devices must be behind the same NAT, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. -For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md). +For more information, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md). ## Set up Delivery Optimization @@ -77,9 +114,9 @@ You can use Group Policy or an MDM solution like Intune to configure Delivery Op You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**. In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**. -Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](https://docs.microsoft.com/intune/delivery-optimization-windows)) +Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile, which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](https://docs.microsoft.com/intune/delivery-optimization-windows)) -**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. +**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (Azure AD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. ## Reference @@ -87,7 +124,7 @@ For complete list of every possible Delivery Optimization setting, see [Delivery ## How Microsoft uses Delivery Optimization -At Microsoft, to help ensure that ongoing deployments weren’t affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. +At Microsoft, to help ensure that ongoing deployments weren't affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. For more details, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study. @@ -104,7 +141,7 @@ If you set up Delivery Optimization to create peer groups that include devices a Delivery Optimization also communicates with its cloud service by using HTTP/HTTPS over port 80. -**What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. +**What are the requirements if I use a proxy?**: For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/delivery-optimization-proxy). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update). **What hostnames should I allow through my firewall to support Delivery Optimization?**: @@ -124,6 +161,30 @@ For the payloads (optional): **How does Delivery Optimization deal with congestion on the router from peer-to-peer activity on the LAN?**: Starting in Windows 10, version 1903, Delivery Optimization uses LEDBAT to relieve such congestion. For more details see this post on the [Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-Transport-converges-on-two-Congestion-Providers-Cubic/ba-p/339819). +**How does Delivery Optimization handle VPNs?** +Delivery Optimization attempts to identify VPNs by checking the network adapter type and details and will treat the connection as a VPN if the adapter description contains certain keywords, such as "VPN" or "secure." + +If the connection is identified as a VPN, Delivery Optimization will suspend uploads to other peers. However, you can allow uploads over a VPN by using the [Enable Peer Caching while the device connects via VPN](waas-delivery-optimization-reference.md#enable-peer-caching-while-the-device-connects-via-vpn) policy. + +If you have defined a boundary group in Configuration Manager for VPN IP ranges, you can set the DownloadMode policy to 0 for that boundary group to ensure that there will be no peer-to-peer activity over the VPN. When the device is not connected via VPN, it can still leverage peer-to-peer with the default of LAN. + +With split tunneling, make sure to allow direct access to these endpoints: + +Delivery Optimization service endpoint: +- `https://*.prod.do.dsp.mp.microsoft.com` + +Delivery Optimization metadata: +- `http://emdl.ws.microsoft.com` +- `http://*.dl.delivery.mp.microsoft.com` + +Windows Update and Microsoft Store backend services and Windows Update and Microsoft Store payloads + +- `http://*.windowsupdate.com` +- `https://*.delivery.mp.microsoft.com` +- `https://*.update.microsoft.com` +- `https://tsfe.trafficshaping.dsp.mp.microsoft.com` + +For more information about remote work if you're using Configuration Manager, see this post on the [Configuration Manager blog](https://techcommunity.microsoft.com/t5/configuration-manager-blog/managing-patch-tuesday-with-configuration-manager-in-a-remote/ba-p/1269444). ## Troubleshooting @@ -131,11 +192,12 @@ This section summarizes common problems and some solutions to try. ### If you don't see any bytes from peers -If you don’t see any bytes coming from peers the cause might be one of the following issues: +If you don't see any bytes coming from peers the cause might be one of the following issues: - Clients aren’t able to reach the Delivery Optimization cloud services. - The cloud service doesn’t see other peers on the network. - Clients aren’t able to connect to peers that are offered back from the cloud service. +- None of the computers on the network are getting updates from peers. ### Clients aren't able to reach the Delivery Optimization cloud services. @@ -143,18 +205,17 @@ If you don’t see any bytes coming from peers the cause might be one of the fol If you suspect this is the problem, try these steps: 1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga"). -2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. +2. Run `Get-DeliveryOptimizationStatus` from an elevated PowerShell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. 3. If **DownloadMode** is 99 it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization hostnames are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**. - ### The cloud service doesn't see other peers on the network. If you suspect this is the problem, try these steps: 1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads. -2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and ensure that **DownloadMode** is 1 or 2 on both devices. -3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated Powershell window on the second device. The **NumberOfPeers** field should be non-zero. +2. Run `Get-DeliveryOptimizationStatus` from an elevated PowerShell window and ensure that **DownloadMode** is 1 or 2 on both devices. +3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated PowerShell window on the second device. The **NumberOfPeers** field should be non-zero. 4. If the number of peers is zero and you have **DownloadMode** = 1, ensure that both devices are using the same public IP address to reach the internet. To do this, open a browser Windows and search for “what is my IP”. You can **DownloadMode 2** (Group) and a custom GroupID (Guid) to fix this if the devices aren’t reporting the same public IP address. @@ -166,6 +227,15 @@ If you suspect this is the problem, try a Telnet test between two devices on the 2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run **telnet 192.168.9.17 7680** (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success. +### None of the computers on the network are getting updates from peers + +If you suspect this is the problem, check Delivery Optimization settings that could limit participation in peer caching. Check whether the following settings in assigned group policies, local group policies, are MDM policies are too restrictive: + +- Minimum RAM (inclusive) allowed to use peer caching +- Minimum disk size allowed to use peer caching +- Enable peer caching while the device connects using VPN. +- Allow uploads when the device is on battery while under the set battery level + @@ -174,7 +244,7 @@ If you suspect this is the problem, try a Telnet test between two devices on the [Windows 10, Delivery Optimization, and WSUS](https://blogs.technet.microsoft.com/mniehaus/2016/08/16/windows-10-delivery-optimization-and-wsus-take-2/) -## Related topics +## Related articles - [Update Windows 10 in the enterprise](index.md) - [Overview of Windows as a service](waas-overview.md) diff --git a/windows/deployment/update/waas-integrate-wufb.md b/windows/deployment/update/waas-integrate-wufb.md index 9d8afa433e..f473a704b2 100644 --- a/windows/deployment/update/waas-integrate-wufb.md +++ b/windows/deployment/update/waas-integrate-wufb.md @@ -6,8 +6,7 @@ ms.mktglfcycl: manage author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 07/27/2017 -ms.reviewer: +ms.collection: m365initiative-coredeploy manager: laurawi ms.topic: article --- @@ -69,7 +68,7 @@ For Windows 10, version 1607, devices can now be configured to receive updates f - Device is configured to defer Quality Updates using Windows Update for Business and to be managed by WSUS - Device is configured to “receive updates for other Microsoft products” along with updates to Windows (**Update/AllowMUUpdateService** = enabled) -- Admin has also placed Microsoft Update, third-paprty, and locally-published update content on the WSUS server +- Admin has also placed Microsoft Update, non-Microsoft, and locally published update content on the WSUS server In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS were not enabled. - In a non-WSUS case, these updates would be deferred just as any update to Windows would be. diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 13b02958f8..01bfeb4954 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -24,7 +24,7 @@ ms.topic: article >Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy or the registry. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. -WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that Microsoft Endpoint Configuration Manager provides. +WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that Microsoft Endpoint Manager provides. When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows 10 client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 10. @@ -82,6 +82,9 @@ When using WSUS to manage updates on Windows client devices, start by configurin 9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**. ![Example of UI](images/waas-wsus-fig5.png) + + >[!IMPORTANT] + > Use Regedit.exe to check that the following key is not enabled, because it can break Windows Store connectivity: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations > [!NOTE] > There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](https://technet.microsoft.com/library/cc720539%28v=ws.10%29.aspx). diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index 0e9f6ba908..5a410e9d8c 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -1,34 +1,134 @@ --- -title: Deploy updates using Windows Update for Business (Windows 10) +title: Windows Update for Business (Windows 10) ms.reviewer: manager: laurawi -description: Windows Update for Business lets you manage when devices received updates from Windows Update. +description: Learn how Windows Update for Business lets you manage when devices receive updates from Windows Update. ms.prod: w10 ms.mktglfcycl: manage author: jaimeo ms.localizationpriority: medium ms.author: jaimeo ms.topic: article +ms.custom: seo-marvel-apr2020 --- -# Deploy updates using Windows Update for Business +# What is Windows Update for Business? **Applies to** - Windows 10 -- Windows Server 2016 -- Windows Server 2019 -Windows Update for Business is a free service that is available for Windows Pro, Enterprise, Pro for Workstation, and Education editions. + +Windows Update for Business is a free service that is available for all premium editions including Windows 10 Pro, Enterprise, Pro for Workstation, and Education editions. > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -Windows Update for Business enables IT administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Microsoft Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. +Windows Update for Business enables IT administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or Mobile Device Management (MDM) solutions such as Microsoft Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. -Specifically, Windows Update for Business allows for control over update offering and experience to allow for reliability and performance testing on a subset of systems before rolling out updates across the organization as well as a positive update experience for those within your organization. +Specifically, Windows Update for Business lets you control update offerings and experiences to allow for reliability and performance testing on a subset of devices before deploying updates across the organization. It also provides a positive update experience for people in your organization. + +## What can I do with Windows Update for Business? + +Windows Update for Business enables commercial customers to manage which Windows Updates are received when as well as the experience a device has when it receives them. + +You can control Windows Update for Business policies by using either Mobile Device Management (MDM) tools such as Microsoft Intune or Group Policy management tools such as local group policy or the Group Policy Management Console (GPMC), as well as a variety of other non-Microsoft management tools. MDMs use Configuration Service Provider (CSP) policies instead of Group Policy. Intune additionally uses Cloud Policies. Not all policies are available in all formats (CSP, Group Policy, or Cloud policy). + + +### Manage deployment of Windows Updates +By using Windows Update for Business, you can control which types of Windows Updates are offered to devices in your ecosystem, when updates are applied, and deployment to devices in your organization in waves. + +### Manage which updates are offered +Windows Update for Business enables an IT administrator to receive and manage a variety of different types of Windows Updates. + +## Types of updates managed by Windows Update for Business + +Windows Update for Business provides management policies for several types of updates to Windows 10 devices: + +- **Feature updates:** Previously referred to as "upgrades," feature updates contain not only security and quality revisions, but also significant feature additions and changes. Feature updates are released semi-annually in the fall and in the spring. +- **Quality updates:** Quality updates are traditional operating system updates, typically released on the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as updates for Microsoft Office or Visual Studio) as quality updates. These non-Windows Updates are known as "Microsoft updates" and you can set devices to receive such updates (or not) along with their Windows updates. +- **Driver updates:** Updates for non-Microsoft drivers that are relevant to your devices. Driver updates are on by default, but you can use Windows Update for Business policies to turn them off if you prefer. +- **Microsoft product updates**: Updates for other Microsoft products, such as versions of Office that are installed by using Windows Installer (MSI). Versions of Office that are installed by using Click-to-Run can't be updated by using Windows Update for Business. Product updates are off by default. You can turn them on by using Windows Update for Business policies. + + +## Offering +You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period. + +### Manage when updates are offered +You can defer or pause the installation of updates for a set period of time. + +#### Enroll in pre-release updates + +The branch readiness level enables administrators to specify which channel of feature updates they want to receive. Today there are branch readiness level options for both pre-release and released updates: + +- Windows Insider Fast +- Windows Insider Slow +- Windows Insider Release Preview +- Semi-Annual Channel + +Prior to Windows 10, version 1903, there are two channels for released updates: Semi-Annual Channel and Semi-Annual Channel (Targeted). Deferral days are calculated against the release date of the chosen channel. Starting with Windows 10, version 1903 there is only the one release channel: Semi-Annual Channel. All deferral days are calculated against a release’s Semi-Annual Channel release date. For exact release dates, see [Windows Release Information](https://docs.microsoft.com/windows/release-health/release-information). You can set the branch readiness level by using the **Select when Preview Builds and Feature Updates are Received** policy. To use this policy to manage pre-release builds, first enable preview builds by using the **Manage preview Builds** policy. + +#### Defer an update + +A Windows Update for Business administrator can defer the installation of both feature and quality updates from deploying to devices within a bounded range of time from when those updates are first made available on the Windows Update service. You can use this deferral to allow time to validate deployments as they are pushed to devices. Deferrals work by allowing you to specify the number of days after an update is released before it is offered to a device. That is, if you set a feature update deferral period of 365 days, the device will not install a feature update that has been released for less than 365 days. To defer feature updates, use the **Select when Preview Builds and Feature Updates are Received** policy. + + +|Category |Maximum deferral period | +|---------|---------| +|Feature updates | 365 days | +|Quality updates | 30 days | +|Non-deferrable | none | + + + +#### Pause an update + +If you discover a problem while deploying a feature or quality update, the IT administrator can pause the update for 35 days from a specified start date to prevent other devices from installing it until the issue is mitigated. +If you pause a feature update, quality updates are still offered to devices to ensure they stay secure. The pause period for both feature and quality updates is calculated from a start date that you set. + +To pause feature updates, use the **Select when Preview Builds and Feature Updates are Received** policy and to pause quality updates use the **Select when Quality Updates are Received** policy. For more information, see [Pause feature updates](waas-configure-wufb.md#pause-feature-updates) and [Pause quality updates](waas-configure-wufb.md#pause-quality-updates). + +Built-in benefits: +When updating from Windows Update, you get the added benefits of built-in compatibility checks to prevent against a poor update experience for your device as well as a check to prevent repeated rollbacks. + +### Recommendations + +For the best experience with Windows Update, follow these guidelines: + +- Use devices for at least 6 hours per month, including at least 2 hours of continuous use. +- Keep devices regularly charged. Plugging in devices overnight enables them to automatically update outside of active hours. +- Make sure that devices have at least 10 GB of free space. +- Give devices unobstructed access to the Windows Update service. + +### Manage the end-user experience when receiving Windows Updates + +Windows Update for Business provides controls to help meet your organization’s security standards as well as provide a great end-user experience. We do this by enabling you to set automatic updates at times that work well for people in your organization and set deadlines for quality and feature updates. Because Windows Update includes built-in intelligence, it's better to use fewer controls to manage the user experience. + +#### Recommended experience settings + +Features like the smart busy check (which ensure updates don't happen when a user is signed in) and active hours help provide the best experience for end users while keeping devices more secure and up to date. Follow these steps to take advantage of these features: + +1. Automatically download, install, and restart (default if no restart policies are set up or enabled) +2. Use the default notifications +3. Set update deadlines + +##### Setting deadlines + +A compliance deadline policy (released in June 2019) enables you to set separate deadlines and grace periods for feature and quality updates. + +This policy enables you to specify the number of days from an update's publication date that it must be installed on the device. The policy also includes a configurable grace period that specifies the number of days from when the update is installed on the device until the device is forced to restart. This approach is useful in a vacation scenario as it allows, for example, users who have been away to have a bit of time before being forced to restart their devices when they return from vacation. + +#### Update Baseline +The large number of different policies offered for Windows 10 can be overwhelming. Update Baseline provides a clear list of recommended Windows update policy settings for IT administrators who want the best user experience while also meeting their update compliance goals. The Update Baseline for Windows 10 includes policy settings recommendations covering deadline configuration, restart behavior, power policies, and more. + +The Update Baseline toolkit makes it easy by providing a single command for IT Admins to apply the Update Baseline to devices. You can get the Update Baseline toolkit from the [Download Center](https://www.microsoft.com/download/details.aspx?id=101056). + +>[!NOTE] +>The Update Baseline toolkit is available only for Group Policy. Update Baseline does not affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices when. + + - - MP3 Files - - - - - C:\* [*] - - - - - C:\* [*.mp3] - - - - - - -``` -### Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp -The following .xml file migrates all files and subfolders in C:\\Data, except the files and subfolders in C:\\Data\\tmp. - -``` xml - - - Test component - - - - - C:\Data\* [*] - - - - - C:\Data\temp\* [*] - - - - - - -``` - -### Example 3: How to exclude the files in a folder but include all subfolders -The following .xml file migrates any subfolders in C:\\EngineeringDrafts, but excludes all files that are in C:\\EngineeringDrafts. - -``` xml - - - Component to migrate all Engineering Drafts Documents without subfolders - - - - - C:\EngineeringDrafts\* [*] - - - - - C:\EngineeringDrafts\ [*] - - - - - - -``` - -### Example 4: How to exclude a file from a specific folder -The following .xml file migrates all files and subfolders in C:\\EngineeringDrafts, except for the Sample.doc file in C:\\EngineeringDrafts. - -``` xml - - - Component to migrate all Engineering Drafts Documents except Sample.doc - - - - - C:\EngineeringDrafts\* [*] - - - - - C:\EngineeringDrafts\ [Sample.doc] - - - - - - -``` - -### Example 5: How to exclude a file from any location -To exclude a Sample.doc file from any location on the C: drive, use the <pattern> element. If multiple files exist with the same name on the C: drive, all of these files will be excluded. - -``` xml - C:\* [Sample.doc] -``` - -To exclude a Sample.doc file from any drive on the computer, use the <script> element. If multiple files exist with the same name, all of these files will be excluded. - -``` xml - -``` -#### Examples of how to use XML to exclude files, folders, and registry keys -Here are some examples of how to use XML to exclude files, folders, and registry keys. For more info, see [USMT XML Reference](usmt-xml-reference.md) - -**Example 1: How to exclude all .mp3 files**
        -The following .xml file excludes all .mp3 files from the migration: - -``` xml - - - Test - - - - - - - - - - - -``` -**Example 2: How to exclude all of the files on a specific drive**
        -The following .xml file excludes only the files located on the C: drive. - -``` xml - - - Test - - - - - c:\*[*] - - - - - - -``` -**Example 3: How to exclude registry keys**
        -The following .xml file unconditionally excludes the HKEY_CURRENT_USER registry key and all of its subkeys. - -``` xml - - - - Test - - - - - HKCU\testReg[*] - - - - - HKCU\*[*] - - - - - - -``` -**Example 4: How to Exclude `C:\Windows` and `C:\Program Files`**
        -The following .xml file unconditionally excludes the system folders of `C:\Windows` and `C:\Program Files`. Note that all \*.docx, \*.xls and \*.ppt files will not be migrated because the <unconditionalExclude> element takes precedence over the <include> element. - -``` xml - - - - Test - - - - - - - - - - - - C:\Program Files\* [*] -C:\Windows\* [*] - - - - - - -``` -## Create a Config XML File -You can create and modify a Config.xml file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. Config.xml is an optional file that you can create using the **/genconfig** command-line option with the ScanState tool. For example, you can use the Config.xml file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. - -- **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the <Applications> section of the Config.xml file. - -- **To exclude an operating system setting:** Specify `migrate="no"` for the setting under the <WindowsComponents> section. - -- **To exclude My Documents:** Specify `migrate="no"` for My Documents under the <Documents> section. Note that any <include> rules in the .xml files will still apply. For example, if you have a rule that includes all the .docx files in My Documents, then only the .docx files will be migrated, but the rest of the files will not. - -See [Config.xml File](usmt-configxml-file.md) for more information. - -**Note**   -To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. - -## Related topics -- [Customize USMT XML Files](usmt-customize-xml-files.md) -- [USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: Exclude Files and Settings (Windows 10) +description: In this article, learn how to exclude files and settings when creating a custom .xml file and a config.xml file. +ms.assetid: df85baf1-6e29-4995-a4bb-ba3f8f7fed0b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Exclude Files and Settings +When you specify the migration .xml files, MigApp.xml, Migdocs, and MigUser.xml, the User State Migration Tool (USMT) 10.0 migrates the settings and components listed, as discussed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) You can create a custom .xml file to further specify what to include or exclude in the migration. In addition you can create a Config.xml file to exclude an entire component from a migration. You cannot, however, exclude users by using the migration .xml files or the Config.xml file. The only way to specify which users to include and exclude is by using the User options on the command line in the ScanState tool. For more information, see [ScanState Syntax](usmt-scanstate-syntax.md). + +In this topic: + +- [Create a custom .xml file](#create-a-custom-xml-file). You can use the following elements to specify what to exclude: + + - include and exclude: You can use the <include> and <exclude> elements to exclude objects with conditions. For example, you can migrate all files located in the C:\\ drive, except any .mp3 files. It is important to remember that [Conflicts and Precedence](usmt-conflicts-and-precedence.md) apply to these elements. + + - [unconditionalExclude](#example-1-how-to-migrate-all-files-from-c-except-mp3-files): You can use the <unconditionalExclude> element to globally exclude data. This element takes precedence over all other include and exclude rules in the .xml files. Therefore, this element excludes objects regardless of any other <include> rules that are in the .xml files. For example, you can exclude all .mp3 files on the computer, or you can exclude all files from C:\\UserData. + +- [Create a Config.xml File](#create-a-config-xml-file): You can create and modify a Config.xml file to exclude an entire component from the migration. For example, you can use this file to exclude the settings for one of the default applications. In addition, creating and modifying a Config.xml file is the only way to exclude the operating-system settings that are migrated to computers running Windows. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. + +## Create a custom .xml file +We recommend that you create a custom .xml file instead of modifying the default migration .xml files. When you use a custom .xml file, you can keep your changes separate from the default .xml files, which makes it easier to track your modifications. + +### <include> and <exclude> +The migration .xml files, MigApp.xml, MigDocs, and MigUser.xml, contain the <component> element, which typically represents a self-contained component or an application such as Microsoft® Office Outlook® and Word. To exclude the files and registry settings that are associated with these components, use the <include> and <exclude> elements. For example, you can use these elements to migrate all files and settings with pattern X except files and settings with pattern Y, where Y is more specific than X. For the syntax of these elements, see [USMT XML Reference](usmt-xml-reference.md). + +**Note**   +If you specify an <exclude> rule, always specify a corresponding <include> rule. Otherwise, if you do not specify an <include> rule, the specific files or settings will not be included. They will already be excluded from the migration. Thus, an unaccompanied <exclude> rule is unnecessary. + +- [Example 1: How to migrate all files from C:\\ except .mp3 files](#example-1-how-to-migrate-all-files-from-c-except-mp3-files) + +- [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-cdata-except-files-in-cdatatmp) + +- [Example 3: How to exclude the files in a folder but include all subfolders](#example-3-how-to-exclude-the-files-in-a-folder-but-include-all-subfolders) + +- [Example 4: How to exclude a file from a specific folder](#example-4-how-to-exclude-a-file-from-a-specific-folder) + +- [Example 5: How to exclude a file from any location](#example-5-how-to-exclude-a-file-from-any-location) + +### Example 1: How to migrate all files from C:\\ except .mp3 files +The following .xml file migrates all files located on the C: drive, except any .mp3 files. + +``` xml + + + + MP3 Files + + + + + C:\* [*] + + + + + C:\* [*.mp3] + + + + + + +``` +### Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp +The following .xml file migrates all files and subfolders in C:\\Data, except the files and subfolders in C:\\Data\\tmp. + +``` xml + + + Test component + + + + + C:\Data\* [*] + + + + + C:\Data\temp\* [*] + + + + + + +``` + +### Example 3: How to exclude the files in a folder but include all subfolders +The following .xml file migrates any subfolders in C:\\EngineeringDrafts, but excludes all files that are in C:\\EngineeringDrafts. + +``` xml + + + Component to migrate all Engineering Drafts Documents without subfolders + + + + + C:\EngineeringDrafts\* [*] + + + + + C:\EngineeringDrafts\ [*] + + + + + + +``` + +### Example 4: How to exclude a file from a specific folder +The following .xml file migrates all files and subfolders in C:\\EngineeringDrafts, except for the Sample.doc file in C:\\EngineeringDrafts. + +``` xml + + + Component to migrate all Engineering Drafts Documents except Sample.doc + + + + + C:\EngineeringDrafts\* [*] + + + + + C:\EngineeringDrafts\ [Sample.doc] + + + + + + +``` + +### Example 5: How to exclude a file from any location +To exclude a Sample.doc file from any location on the C: drive, use the <pattern> element. If multiple files exist with the same name on the C: drive, all of these files will be excluded. + +``` xml + C:\* [Sample.doc] +``` + +To exclude a Sample.doc file from any drive on the computer, use the <script> element. If multiple files exist with the same name, all of these files will be excluded. + +``` xml + +``` +#### Examples of how to use XML to exclude files, folders, and registry keys +Here are some examples of how to use XML to exclude files, folders, and registry keys. For more info, see [USMT XML Reference](usmt-xml-reference.md) + +**Example 1: How to exclude all .mp3 files**
        +The following .xml file excludes all .mp3 files from the migration: + +``` xml + + + Test + + + + + + + + + + + +``` +**Example 2: How to exclude all of the files on a specific drive**
        +The following .xml file excludes only the files located on the C: drive. + +``` xml + + + Test + + + + + c:\*[*] + + + + + + +``` +**Example 3: How to exclude registry keys**
        +The following .xml file unconditionally excludes the HKEY_CURRENT_USER registry key and all of its subkeys. + +``` xml + + + + Test + + + + + HKCU\testReg[*] + + + + + HKCU\*[*] + + + + + + +``` +**Example 4: How to Exclude `C:\Windows` and `C:\Program Files`**
        +The following .xml file unconditionally excludes the system folders of `C:\Windows` and `C:\Program Files`. Note that all \*.docx, \*.xls and \*.ppt files will not be migrated because the <unconditionalExclude> element takes precedence over the <include> element. + +``` xml + + + + Test + + + + + + + + + + + + C:\Program Files\* [*] +C:\Windows\* [*] + + + + + + +``` +## Create a Config XML File +You can create and modify a Config.xml file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. Config.xml is an optional file that you can create using the **/genconfig** command-line option with the ScanState tool. For example, you can use the Config.xml file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. + +- **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the <Applications> section of the Config.xml file. + +- **To exclude an operating system setting:** Specify `migrate="no"` for the setting under the <WindowsComponents> section. + +- **To exclude My Documents:** Specify `migrate="no"` for My Documents under the <Documents> section. Note that any <include> rules in the .xml files will still apply. For example, if you have a rule that includes all the .docx files in My Documents, then only the .docx files will be migrated, but the rest of the files will not. + +See [Config.xml File](usmt-configxml-file.md) for more information. + +**Note**   +To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. + +## Related topics +- [Customize USMT XML Files](usmt-customize-xml-files.md) +- [USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md index 6a97acb78b..a6d6154a83 100644 --- a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md +++ b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md @@ -1,122 +1,123 @@ ---- -title: Extract Files from a Compressed USMT Migration Store (Windows 10) -description: Extract Files from a Compressed USMT Migration Store -ms.assetid: ad9fbd6e-f89e-4444-8538-9b11566b1f33 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Extract Files from a Compressed USMT Migration Store - - -When you migrate files and settings during a typical PC-refresh migration, you usually create a compressed migration store file on the intermediate store. This migration store is a single image file that contains all files being migrated as well as a catalog file. To protect the compressed file, you can encrypt it by using different encryption algorithms. When you migrate the file back to the source computer after the operating system is installed, you can run the **Usmtutils** command with the **/extract** option to recover the files from the compressed migration store. You can also use the **Usmtutils** command with the **/extract** option any time you need to recover data from a migration store. - -Options used with the **/extract** option can specify: - -- The cryptographic algorithm that was used to create the migration store. - -- The encryption key or the text file that contains the encryption key. - -- Include and exclude patterns for selective data extraction. - -In addition, you can specify the file patterns that you want to extract by using the **/i** option to include file patterns or the **/e** option to exclude file patterns. When both the **/i** option and the **/e** option are used in the same command, include patterns take precedence over exclude patterns. Note that this is different from the include and exclude rules used in the ScanState and LoadState tools. - -## In this topic - - -- [To run the USMTutils tool with the /extract option](#bkmk-extractsyntax) - -- [To extract all files from a compressed migration store](#bkmk-extractallfiles) - -- [To extract specific file types from an encrypted compressed migration store](#bkmk-extractspecificfiles) - -- [To extract all but one, or more, file types from an encrypted compressed migration store](#bkmk-excludefilepattern) - -- [To extract file types using the include pattern and the exclude pattern](#bkmk-includeexcludefiles) - -### To run the USMTutils tool with the /extract option - -To extract files from the compressed migration store onto the destination computer, use the following USMTutils syntax: - -Cd /d <USMTpath> usmtutils /extract <filePath> <destinationPath> \[/i:<includePattern>\] \[/e:<excludePattern>\] \[/l:<logfile>\] \[/decrypt\[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] \[/o\] - -Where the placeholders have the following values: - -- *<USMTpath>* is the location where you have saved the USMT files and tools. - -- *<filePath>* is the location of the migration store. - -- *<destination path>* is the location of the file where you want the **/extract** option to put the extracted migration store contents. - -- *<includePattern>* specifies the pattern for the files to include in the extraction. - -- *<excludePattern>* specifies the pattern for the files to omit from the extraction. - -- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. - -- *<logfile>* is the location and name of the log file. - -- *<keystring>* is the encryption key that was used to encrypt the migration store. - -- *<filename>* is the location and name of the text file that contains the encryption key. - -### To extract all files from a compressed migration store - -To extract everything from a compressed migration store to a file on the C:\\ drive, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore -``` - -### To extract specific file types from an encrypted compressed migration store - -To extract specific files, such as .txt and .pdf files, from an encrypted compressed migration store, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt,*.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt -``` - -In this example, the file is encrypted and the encryption key is located in a text file called encryptionKey. - -### To extract all but one, or more, file types from an encrypted compressed migration store - -To extract all files except for one file type, such as .exe files, from an encrypted compressed migration store, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtutilslog.txt -``` - -### To extract file types using the include pattern and the exclude pattern - -To extract files from a compressed migration store, and to exclude files of one type (such as .exe files) while including only specific files, use both the include pattern and the exclude pattern, as in this example: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o -``` - -In this example, if there is a myProject.exe file, it will also be extracted because the include pattern option takes precedence over the exclude pattern option. - -## Related topics - - -[UsmtUtils Syntax](usmt-utilities.md) - -[Return Codes](usmt-return-codes.md) - -[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) - -  - -  - - - - - +--- +title: Extract Files from a Compressed USMT Migration Store (Windows 10) +description: In this article, learn how to extract files from a compressed User State Migration Tool (USMT) migration store. +ms.assetid: ad9fbd6e-f89e-4444-8538-9b11566b1f33 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Extract Files from a Compressed USMT Migration Store + + +When you migrate files and settings during a typical PC-refresh migration, you usually create a compressed migration store file on the intermediate store. This migration store is a single image file that contains all files being migrated as well as a catalog file. To protect the compressed file, you can encrypt it by using different encryption algorithms. When you migrate the file back to the source computer after the operating system is installed, you can run the **Usmtutils** command with the **/extract** option to recover the files from the compressed migration store. You can also use the **Usmtutils** command with the **/extract** option any time you need to recover data from a migration store. + +Options used with the **/extract** option can specify: + +- The cryptographic algorithm that was used to create the migration store. + +- The encryption key or the text file that contains the encryption key. + +- Include and exclude patterns for selective data extraction. + +In addition, you can specify the file patterns that you want to extract by using the **/i** option to include file patterns or the **/e** option to exclude file patterns. When both the **/i** option and the **/e** option are used in the same command, include patterns take precedence over exclude patterns. Note that this is different from the include and exclude rules used in the ScanState and LoadState tools. + +## In this topic + + +- [To run the USMTutils tool with the /extract option](#bkmk-extractsyntax) + +- [To extract all files from a compressed migration store](#bkmk-extractallfiles) + +- [To extract specific file types from an encrypted compressed migration store](#bkmk-extractspecificfiles) + +- [To extract all but one, or more, file types from an encrypted compressed migration store](#bkmk-excludefilepattern) + +- [To extract file types using the include pattern and the exclude pattern](#bkmk-includeexcludefiles) + +### To run the USMTutils tool with the /extract option + +To extract files from the compressed migration store onto the destination computer, use the following USMTutils syntax: + +Cd /d <USMTpath> usmtutils /extract <filePath> <destinationPath> \[/i:<includePattern>\] \[/e:<excludePattern>\] \[/l:<logfile>\] \[/decrypt\[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] \[/o\] + +Where the placeholders have the following values: + +- *<USMTpath>* is the location where you have saved the USMT files and tools. + +- *<filePath>* is the location of the migration store. + +- *<destination path>* is the location of the file where you want the **/extract** option to put the extracted migration store contents. + +- *<includePattern>* specifies the pattern for the files to include in the extraction. + +- *<excludePattern>* specifies the pattern for the files to omit from the extraction. + +- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. + +- *<logfile>* is the location and name of the log file. + +- *<keystring>* is the encryption key that was used to encrypt the migration store. + +- *<filename>* is the location and name of the text file that contains the encryption key. + +### To extract all files from a compressed migration store + +To extract everything from a compressed migration store to a file on the C:\\ drive, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore +``` + +### To extract specific file types from an encrypted compressed migration store + +To extract specific files, such as .txt and .pdf files, from an encrypted compressed migration store, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt,*.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt +``` + +In this example, the file is encrypted and the encryption key is located in a text file called encryptionKey. + +### To extract all but one, or more, file types from an encrypted compressed migration store + +To extract all files except for one file type, such as .exe files, from an encrypted compressed migration store, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtutilslog.txt +``` + +### To extract file types using the include pattern and the exclude pattern + +To extract files from a compressed migration store, and to exclude files of one type (such as .exe files) while including only specific files, use both the include pattern and the exclude pattern, as in this example: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o +``` + +In this example, if there is a myProject.exe file, it will also be extracted because the include pattern option takes precedence over the exclude pattern option. + +## Related topics + + +[UsmtUtils Syntax](usmt-utilities.md) + +[Return Codes](usmt-return-codes.md) + +[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-faq.md b/windows/deployment/usmt/usmt-faq.md index 49092e9f6f..97be09803c 100644 --- a/windows/deployment/usmt/usmt-faq.md +++ b/windows/deployment/usmt/usmt-faq.md @@ -1,137 +1,138 @@ ---- -title: Frequently Asked Questions (Windows 10) -description: Frequently Asked Questions -ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Frequently Asked Questions - - -The following sections provide frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. - -## General - - -### How much space is needed on the destination computer? - -The destination computer needs enough available space for the following: - -- Operating system - -- Applications - -- Uncompressed store - -### Can I store the files and settings directly on the destination computer or do I need a server? - -You do not need to save the files to a server. If you are moving the user state to a new computer, you can create the store on a shared folder, on media that you can remove, such as a USB flash drive (UFD), or you can store it directly on the destination computer, as in the following steps: - -1. Create and share the directory C:\\store on the destination computer. - -2. Run the ScanState tool on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store - -3. Run the LoadState tool on the destination computer and specify C:\\store as the store location. - -### Can I migrate data between operating systems with different languages? - -No. USMT does not support migrating data between operating systems with different languages; the source computer's operating-system language must match the destination computer's operating-system language. - -### Can I change the location of the temporary directory on the destination computer? - -Yes. The environment variable USMT\_WORKING\_DIR can be changed to an alternative temporary directory. There are some offline migration scenarios where this is necessary, for example, when the USMT binaries are located on read-only Windows Preinstallation Environment (WinPE) boot media. - -### How do I install USMT? - -Because USMT is included in Windows Assessment and Deployment Kit (Windows ADK), you need to install the Windows ADK package on at least one computer in your environment. However, the USMT binaries are designed to be deployed using xcopy. This means that they are installed on a computer simply by recursively copying the USMT directory from the computer containing the Windows ADK to each client computer. - -### How do I uninstall USMT? - -If you have installed the Windows ADK on the computer, uninstalling Windows ADK will uninstall USMT. For client computers that do not have the Windows ADK installed, you can simply delete the USMT directory to uninstall USMT. - -## Files and Settings - - -### How can I exclude a folder or a certain type of file from the migration? - -You can use the **<unconditionalExclude>** element to globally exclude data from the migration. For example, you can use this element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. This element excludes objects regardless of any other <include> rules that are in the .xml files. For an example, see <unconditionalExclude> in the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. For the syntax of this element, see [XML Elements Library](usmt-xml-elements-library.md). - -### What happens to files that were located on a drive that does not exist on the destination computer? - -USMT migrates the files to the %SystemDrive% while maintaining the correct folder hierarchy. For example, if E:\\data\\File.pst is on the source computer, but the destination computer does not have an E:\\ drive, the file will be migrated to C:\\data\\File.pst, if C:\\ is the system drive. This holds true even when <locationModify> rules attempt to move data to a drive that does not exist on the destination computer. - -## USMT .xml Files - - -### Where can I get examples of USMT .xml files? - -The following topics include examples of USMT .xml files: - -- [Exclude Files and Settings](usmt-exclude-files-and-settings.md) - -- [Reroute Files and Settings](usmt-reroute-files-and-settings.md) - -- [Include Files and Settings](usmt-include-files-and-settings.md) - -- [Custom XML Examples](usmt-custom-xml-examples.md) - -### Can I use custom .xml files that were written for USMT 5.0? - -Yes. You can use custom .xml files that were written for USMT 5.0 with USMT for Windows 10. However, in order to use new USMT functionality, you must revisit your custom USMT files and refresh them to include the new command-line options and XML elements. - -### How can I validate the .xml files? - -You can use the USMT XML Schema (MigXML.xsd) to write and validate migration .xml files. - -### Why must I list the .xml files with both the ScanState and LoadState commands? - -The .xml files are not copied to the store as in previous versions of USMT. Because the ScanState and LoadState tools need the .xml files to control the migration, you must specify the same set of .xml files for the **ScanState** and **LoadState** commands. If you used a particular set of mig\*.xml files in the ScanState tool, either called through the "/auto" option, or individually through the "/i" option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. However, you do not have to specify the Config.xml file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. **LoadState** will migrate only the files and settings that you want to migrate. - -If you exclude an .xml file from the **LoadState** command, then all of the data that is in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified for the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. - -### Which files can I modify and specify on the command line? - -You can specify the MigUser.xml and MigApp.xml files on the command line. You can modify each of these files. The migration of operating system settings is controlled by the manifests, which you cannot modify. If you want to exclude certain operating-system settings or any other components, create and modify the Config.xml file. - -### What happens if I do not specify the .xml files on the command line? - -- **ScanState** - - If you do not specify any files with the **ScanState** command, all user accounts and default operating system components are migrated. - -- **LoadState** - - If you do not specify any files with the **LoadState** command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in .xml files with the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. - -## Conflicts and Precedence - - -### What happens when there are conflicting XML rules or conflicting objects on the destination computer? - -For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -## Related topics - - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md) - -[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) - -  - -  - - - - - +--- +title: Frequently Asked Questions (Windows 10) +description: Learn about frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. +ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Frequently Asked Questions + + +The following sections provide frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. + +## General + + +### How much space is needed on the destination computer? + +The destination computer needs enough available space for the following: + +- Operating system + +- Applications + +- Uncompressed store + +### Can I store the files and settings directly on the destination computer or do I need a server? + +You do not need to save the files to a server. If you are moving the user state to a new computer, you can create the store on a shared folder, on media that you can remove, such as a USB flash drive (UFD), or you can store it directly on the destination computer, as in the following steps: + +1. Create and share the directory C:\\store on the destination computer. + +2. Run the ScanState tool on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store + +3. Run the LoadState tool on the destination computer and specify C:\\store as the store location. + +### Can I migrate data between operating systems with different languages? + +No. USMT does not support migrating data between operating systems with different languages; the source computer's operating-system language must match the destination computer's operating-system language. + +### Can I change the location of the temporary directory on the destination computer? + +Yes. The environment variable USMT\_WORKING\_DIR can be changed to an alternative temporary directory. There are some offline migration scenarios where this is necessary, for example, when the USMT binaries are located on read-only Windows Preinstallation Environment (WinPE) boot media. + +### How do I install USMT? + +Because USMT is included in Windows Assessment and Deployment Kit (Windows ADK), you need to install the Windows ADK package on at least one computer in your environment. However, the USMT binaries are designed to be deployed using xcopy. This means that they are installed on a computer simply by recursively copying the USMT directory from the computer containing the Windows ADK to each client computer. + +### How do I uninstall USMT? + +If you have installed the Windows ADK on the computer, uninstalling Windows ADK will uninstall USMT. For client computers that do not have the Windows ADK installed, you can simply delete the USMT directory to uninstall USMT. + +## Files and Settings + + +### How can I exclude a folder or a certain type of file from the migration? + +You can use the **<unconditionalExclude>** element to globally exclude data from the migration. For example, you can use this element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. This element excludes objects regardless of any other <include> rules that are in the .xml files. For an example, see <unconditionalExclude> in the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. For the syntax of this element, see [XML Elements Library](usmt-xml-elements-library.md). + +### What happens to files that were located on a drive that does not exist on the destination computer? + +USMT migrates the files to the %SystemDrive% while maintaining the correct folder hierarchy. For example, if E:\\data\\File.pst is on the source computer, but the destination computer does not have an E:\\ drive, the file will be migrated to C:\\data\\File.pst, if C:\\ is the system drive. This holds true even when <locationModify> rules attempt to move data to a drive that does not exist on the destination computer. + +## USMT .xml Files + + +### Where can I get examples of USMT .xml files? + +The following topics include examples of USMT .xml files: + +- [Exclude Files and Settings](usmt-exclude-files-and-settings.md) + +- [Reroute Files and Settings](usmt-reroute-files-and-settings.md) + +- [Include Files and Settings](usmt-include-files-and-settings.md) + +- [Custom XML Examples](usmt-custom-xml-examples.md) + +### Can I use custom .xml files that were written for USMT 5.0? + +Yes. You can use custom .xml files that were written for USMT 5.0 with USMT for Windows 10. However, in order to use new USMT functionality, you must revisit your custom USMT files and refresh them to include the new command-line options and XML elements. + +### How can I validate the .xml files? + +You can use the USMT XML Schema (MigXML.xsd) to write and validate migration .xml files. + +### Why must I list the .xml files with both the ScanState and LoadState commands? + +The .xml files are not copied to the store as in previous versions of USMT. Because the ScanState and LoadState tools need the .xml files to control the migration, you must specify the same set of .xml files for the **ScanState** and **LoadState** commands. If you used a particular set of mig\*.xml files in the ScanState tool, either called through the "/auto" option, or individually through the "/i" option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. However, you do not have to specify the Config.xml file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. **LoadState** will migrate only the files and settings that you want to migrate. + +If you exclude an .xml file from the **LoadState** command, then all of the data that is in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified for the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. + +### Which files can I modify and specify on the command line? + +You can specify the MigUser.xml and MigApp.xml files on the command line. You can modify each of these files. The migration of operating system settings is controlled by the manifests, which you cannot modify. If you want to exclude certain operating-system settings or any other components, create and modify the Config.xml file. + +### What happens if I do not specify the .xml files on the command line? + +- **ScanState** + + If you do not specify any files with the **ScanState** command, all user accounts and default operating system components are migrated. + +- **LoadState** + + If you do not specify any files with the **LoadState** command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in .xml files with the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. + +## Conflicts and Precedence + + +### What happens when there are conflicting XML rules or conflicting objects on the destination computer? + +For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +## Related topics + + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + +[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md) + +[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-general-conventions.md b/windows/deployment/usmt/usmt-general-conventions.md index 3439d25d7a..49cbfc3f28 100644 --- a/windows/deployment/usmt/usmt-general-conventions.md +++ b/windows/deployment/usmt/usmt-general-conventions.md @@ -1,106 +1,107 @@ ---- -title: General Conventions (Windows 10) -description: General Conventions -ms.assetid: 5761986e-a847-41bd-bf8e-7c1bd01acbc6 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# General Conventions - - -This topic describes the XML helper functions. - -## In This Topic - - -[General XML Guidelines](#bkmk-general) - -[Helper Functions](#bkmk-helperfunctions) - -## General XML Guidelines - - -Before you modify the .xml files, become familiar with the following guidelines: - -- **XML schema** - - You can use the User State Migration Tool (USMT) 10.0 XML schema, MigXML.xsd, to write and validate migration .xml files. - -- **Conflits** - - In general, when there are conflicts within the XML schema, the most specific pattern takes precedence. For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -- **Required elements** - - The required elements for a migration .xml file are **<migration>**, **<component>**, **<role>**, and **<rules>**. - -- **Required child elements** - - - USMT does not fail with an error if you do not specify the required child elements. However, you must specify the required child elements for the parent element to affect the migration. - - - The required child elements apply only to the first definition of the element. If these elements are defined and then referred to using their name, the required child elements do not apply. For example, if you define `` in **<namedElements>**, and you specify `` in **<component>** to refer to this element, the definition inside **<namedElements>** must have the required child elements, but the **<component>** element does not need to have the required child elements. - -- **File names with brackets** - - If you are migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there is a file named **file].txt**, you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`. - -- **Using quotation marks** - - When you surround code in quotation marks, you can use either double ("") or single (') quotation marks. - -## Helper Functions - - -You can use the XML helper functions in the [XML Elements Library](usmt-xml-elements-library.md) to change migration behavior. Before you use these functions in an .xml file, note the following: - -- **All of the parameters are strings** - -- **You can leave NULL parameters blank** - - As with parameters with a default value convention, if you have a NULL parameter at the end of a list, you can leave it out. For example, the following function: - - ``` syntax - SomeFunction("My String argument",NULL,NULL) - ``` - - is equivalent to: - - ``` syntax - SomeFunction("My String argument") - ``` - -- **The encoded location used in all the helper functions is an unambiguous string representation for the name of an object** - - It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. - - For example, specify the file C:\\Windows\\Notepad.exe: **c:\\Windows\[Notepad.exe\]**. Similarly, specify the directory C:\\Windows\\System32 like this: **c:\\Windows\\System32**; note the absence of the \[\] characters. - - The registry is represented in a similar way. The default value of a registry key is represented as an empty \[\] construct. For example, the default value for the HKLM\\SOFTWARE\\MyKey registry key is **HKLM\\SOFTWARE\\MyKey\[\]**. - -- **You specify a location pattern in a way that is similar to how you specify an actual location** - - The exception is that both the node and leaf part accept patterns. However, a pattern from the node does not extend to the leaf. - - For example, the pattern **c:\\Windows\\\\*** will match the \\Windows directory and all subdirectories, but it will not match any of the files in those directories. To match the files as well, you must specify **c:\\Windows\\\*\[\*\]**. - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: General Conventions (Windows 10) +description: Learn about general XML guidelines and how to use XML helper functions in the XML Elements library to change migration behavior. +ms.assetid: 5761986e-a847-41bd-bf8e-7c1bd01acbc6 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# General Conventions + + +This topic describes the XML helper functions. + +## In This Topic + + +[General XML Guidelines](#bkmk-general) + +[Helper Functions](#bkmk-helperfunctions) + +## General XML Guidelines + + +Before you modify the .xml files, become familiar with the following guidelines: + +- **XML schema** + + You can use the User State Migration Tool (USMT) 10.0 XML schema, MigXML.xsd, to write and validate migration .xml files. + +- **Conflicts** + + In general, when there are conflicts within the XML schema, the most specific pattern takes precedence. For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +- **Required elements** + + The required elements for a migration .xml file are **<migration>**, **<component>**, **<role>**, and **<rules>**. + +- **Required child elements** + + - USMT does not fail with an error if you do not specify the required child elements. However, you must specify the required child elements for the parent element to affect the migration. + + - The required child elements apply only to the first definition of the element. If these elements are defined and then referred to using their name, the required child elements do not apply. For example, if you define `` in **<namedElements>**, and you specify `` in **<component>** to refer to this element, the definition inside **<namedElements>** must have the required child elements, but the **<component>** element does not need to have the required child elements. + +- **File names with brackets** + + If you are migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there is a file named **file].txt**, you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`. + +- **Using quotation marks** + + When you surround code in quotation marks, you can use either double ("") or single (') quotation marks. + +## Helper Functions + + +You can use the XML helper functions in the [XML Elements Library](usmt-xml-elements-library.md) to change migration behavior. Before you use these functions in an .xml file, note the following: + +- **All of the parameters are strings** + +- **You can leave NULL parameters blank** + + As with parameters with a default value convention, if you have a NULL parameter at the end of a list, you can leave it out. For example, the following function: + + ``` syntax + SomeFunction("My String argument",NULL,NULL) + ``` + + is equivalent to: + + ``` syntax + SomeFunction("My String argument") + ``` + +- **The encoded location used in all the helper functions is an unambiguous string representation for the name of an object** + + It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. + + For example, specify the file C:\\Windows\\Notepad.exe: **c:\\Windows\[Notepad.exe\]**. Similarly, specify the directory C:\\Windows\\System32 like this: **c:\\Windows\\System32**; note the absence of the \[\] characters. + + The registry is represented in a similar way. The default value of a registry key is represented as an empty \[\] construct. For example, the default value for the HKLM\\SOFTWARE\\MyKey registry key is **HKLM\\SOFTWARE\\MyKey\[\]**. + +- **You specify a location pattern in a way that is similar to how you specify an actual location** + + The exception is that both the node and leaf part accept patterns. However, a pattern from the node does not extend to the leaf. + + For example, the pattern **c:\\Windows\\\\*** will match the \\Windows directory and all subdirectories, but it will not match any of the files in those directories. To match the files as well, you must specify **c:\\Windows\\\*\[\*\]**. + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md index e9bb2376d5..8c39400821 100644 --- a/windows/deployment/usmt/usmt-hard-link-migration-store.md +++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md @@ -1,6 +1,6 @@ --- title: Hard-Link Migration Store (Windows 10) -description: Hard-Link Migration Store +description: Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization. ms.assetid: b0598418-4607-4952-bfa3-b6e4aaa2c574 ms.reviewer: manager: laurawi @@ -19,7 +19,7 @@ ms.topic: article A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs and enables entirely new migration scenarios. -## In This Topic +## In this topic [When to Use a Hard-Link Migration](#bkmk-when) @@ -75,7 +75,7 @@ A hard link can only be created for a file on the same volume. If you copy a har For more information about hard links, please see [Hard Links and Junctions](https://go.microsoft.com/fwlink/p/?LinkId=132934) -In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place. +In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place. As a best practice, we recommend that you delete the hard-link migration store after you confirm that the Loadstate tool has successfully migrated the files. Since Loadstate has created new paths to the files on your new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files and will not delete the actual files or the paths to them from your new operating system. diff --git a/windows/deployment/usmt/usmt-how-it-works.md b/windows/deployment/usmt/usmt-how-it-works.md index 5c8bbb6d9b..441dccf3f7 100644 --- a/windows/deployment/usmt/usmt-how-it-works.md +++ b/windows/deployment/usmt/usmt-how-it-works.md @@ -1,150 +1,135 @@ ---- -title: How USMT Works (Windows 10) -description: How USMT Works -ms.assetid: 5c8bd669-9e1e-473d-81e6-652f40b24171 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# How USMT Works - - -USMT includes two tools that migrate settings and data: ScanState and LoadState. ScanState collects information from the source computer, and LoadState applies that information to the destination computer. - -- [ScanState Process](#bkmk-ssprocess) - -- [LoadState Process](#bkmk-lsprocess) - - **Note**   - For more information about how USMT processes the rules and the XML files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - - -## The ScanState Process - - -When you run the ScanState tool on the source computer, it goes through the following process: - -1. It parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. - -2. It collects information about all of the migration components that need to be migrated. A *migration component* is a logical group of files, registry keys, and values. For example, the set of files, registry keys, and values that store the settings of Adobe Acrobat is grouped into a single migration component. - - There are three types of components: - - - Components that migrate the operating system settings - - - Components that migrate application settings - - - Components that migrate users’ files - - The ScanState tool collects information about the application settings and user data components from the .xml files that are specified on the command line. - - In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. - -3. ScanState determines which user profiles should be migrated. By default, all user profiles on the source computer are migrated. However, you can include and exclude users using the User Options. The public profile in a source computer running Windows 7, Windows 8, and Windows 10 is always migrated, and you cannot exclude these profiles from the migration. - -4. In the "Scanning" phase, ScanState does the following for each user profile selected for migration: - - 1. For each component, ScanState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. - - **Note**   - From this point on, ScanState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. ScanState processes all components in the same way. - - - - 2. Each component that is selected in the previous step is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile that is being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents, assuming that the user profiles are stored in the C:\\Users directory. - - 3. For each selected component, ScanState evaluates the <detects> section. If the condition in the <detects> section evaluates to false, the component is not processed any further. Otherwise, the processing of this component continues. - - 4. For each selected component, ScanState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. - - 5. ScanState creates a list of migration units that need to be migrated by processing the various subsections under this <rules> section. Each unit is collected if it is mentioned in an <include> subsection, as long as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence in the .xml files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - In addition, any migration unit (such as a file, registry key, or set of registry values) that is in an <UnconditionalExclude> section is not migrated. - - **Note**   - ScanState ignores some subsections such as <destinationCleanup> and <locationModify>. These sections are evaluated only on the destination computer. - - - -5. In the "Collecting" phase, ScanState creates a master list of the migration units by combining the lists that were created for each selected user profile. - -6. In the "Saving" phase, ScanState writes the migration units that were collected to the store location. - - **Note**   - ScanState does not modify the source computer in any way. - - - -## The LoadState Process - - -The LoadState process is very similar to the ScanState process. The ScanState tool collects migration units such as file, registry key, or registry values from the source computer and saves them to the store. Similarly, the LoadState tool collects migration units from the store and applies them to the destination computer. - -1. ScanState parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. - -2. LoadState collects information about the migration components that need to be migrated. - - LoadState obtains information for the application-settings components and user-data components from the migration .xml files that are specified by the LoadState command. - - In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. - -3. LoadState determines which user profiles should be migrated. By default, all user profiles present on the source computer are migrated. However, you can include and exclude users using the User Options. The system profile, the "All users" profile in a source computer running Windows XP, or the Public profile in a source computer running Windows Vista, Windows 7, and Windows 8, is always migrated and you cannot exclude these profiles from the migration. - - - If you are migrating local user accounts and if the accounts do not already exist on the destination computer, you must use the/lac command-line option. If you do not specify the **/lac** option, any local user accounts that are not already present on the destination computer, are not migrated. - - - The **/md** and **/mu** options are processed to rename the user profile on the destination computer, if they have been included when the LoadState command was specified. - - - For each user profile selected from the store, LoadState creates a corresponding user profile on the destination computer. The destination computer does not need to be connected to the domain for domain user profiles to be created. If USMT cannot determine a domain, it attempts to apply the settings to a local account. For more information, see [Identify Users](usmt-identify-users.md). - -4. In the "Scanning" phase, LoadState does the following for each user profile: - - 1. For each component, LoadState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. - - **Note** - From this point on, LoadState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. LoadState evaluates all components in the same way. - - - - 2. Each component that is selected is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents (assuming that the user profiles are stored in the C:\\Users directory). - - **Note** - LoadState ignores the <detects> section specified in a component. At this point, all specified components are considered to be detected and are selected for migration. - - - - 3. For each selected component, LoadState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. - - 4. LoadState creates a master list of migration units by processing the various subsections under the <rules> section. Each migration unit that is in an <include> subsection is migrated as long, as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - 5. LoadState evaluates the destination computer-specific subsections; for example, the <destinationCleanup> and <locationModify> subsections. - - 6. If the destination computer is running Windows 7 or Windows 8 then the migunits that were collected by ScanState using downlevel manifest files are processed by LoadState using the corresponding Component Manifest for Windows 7. The downlevel manifest files are not used during LoadState. - - **Important** - It is important to specify the .xml files with the LoadState command if you want LoadState to use them. Otherwise, any destination-specific rules, such as <locationModify>, in these .xml files are ignored, even if the same .xml files were provided when the ScanState command ran. - - - -5. In the "Apply" phase, LoadState writes the migration units that were collected to the various locations on the destination computer. If there are conflicts and there is not a <merge> rule for the object, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally, for example, OriginalFileName(1).OriginalExtension. Some settings, such as fonts, wallpaper, and screen-saver settings, do not take effect until the next time the user logs on. For this reason, you should log off when the LoadState command actions have completed. - -## Related topics - - -[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) - - - - - - - - - +--- +title: How USMT Works (Windows 10) +description: Learn how USMT works and how it includes two tools that migrate settings and data - ScanState and LoadState. +ms.assetid: 5c8bd669-9e1e-473d-81e6-652f40b24171 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# How USMT Works + + +USMT includes two tools that migrate settings and data: ScanState and LoadState. ScanState collects information from the source computer, and LoadState applies that information to the destination computer. + +- [ScanState Process](#the-scanstate-process) +- [LoadState Process](#the-loadstate-process) + + **Note**   + For more information about how USMT processes the rules and the XML files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +## The ScanState Process + +When you run the ScanState tool on the source computer, it goes through the following process: + +1. It parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. + +2. It collects information about all of the migration components that need to be migrated. A *migration component* is a logical group of files, registry keys, and values. For example, the set of files, registry keys, and values that store the settings of Adobe Acrobat is grouped into a single migration component. + + There are three types of components: + + - Components that migrate the operating system settings + - Components that migrate application settings + - Components that migrate users’ files + + The ScanState tool collects information about the application settings and user data components from the .xml files that are specified on the command line. + + In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. + +3. ScanState determines which user profiles should be migrated. By default, all user profiles on the source computer are migrated. However, you can include and exclude users using the User Options. The public profile in a source computer running Windows 7, Windows 8, and Windows 10 is always migrated, and you cannot exclude these profiles from the migration. + +4. In the "Scanning" phase, ScanState does the following for each user profile selected for migration: + + 1. For each component, ScanState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. + + **Note**   + From this point on, ScanState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. ScanState processes all components in the same way. + + 2. Each component that is selected in the previous step is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile that is being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents, assuming that the user profiles are stored in the C:\\Users directory. + + 3. For each selected component, ScanState evaluates the <detects> section. If the condition in the <detects> section evaluates to false, the component is not processed any further. Otherwise, the processing of this component continues. + + 4. For each selected component, ScanState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. + + 5. ScanState creates a list of migration units that need to be migrated by processing the various subsections under this <rules> section. Each unit is collected if it is mentioned in an <include> subsection, as long as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence in the .xml files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + + In addition, any migration unit (such as a file, registry key, or set of registry values) that is in an <UnconditionalExclude> section is not migrated. + + **Note**   + ScanState ignores some subsections such as <destinationCleanup> and <locationModify>. These sections are evaluated only on the destination computer. + +5. In the "Collecting" phase, ScanState creates a master list of the migration units by combining the lists that were created for each selected user profile. + +6. In the "Saving" phase, ScanState writes the migration units that were collected to the store location. + + **Note**   + ScanState does not modify the source computer in any way. + +## The LoadState Process + + +The LoadState process is very similar to the ScanState process. The ScanState tool collects migration units such as file, registry key, or registry values from the source computer and saves them to the store. Similarly, the LoadState tool collects migration units from the store and applies them to the destination computer. + +1. ScanState parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. + +2. LoadState collects information about the migration components that need to be migrated. + + LoadState obtains information for the application-settings components and user-data components from the migration .xml files that are specified by the LoadState command. + + In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. + +3. LoadState determines which user profiles should be migrated. By default, all user profiles present on the source computer are migrated. However, you can include and exclude users using the User Options. The system profile, the "All users" profile in a source computer running Windows XP, or the Public profile in a source computer running Windows Vista, Windows 7, and Windows 8, is always migrated and you cannot exclude these profiles from the migration. + + - If you are migrating local user accounts and if the accounts do not already exist on the destination computer, you must use the/lac command-line option. If you do not specify the **/lac** option, any local user accounts that are not already present on the destination computer, are not migrated. + + - The **/md** and **/mu** options are processed to rename the user profile on the destination computer, if they have been included when the LoadState command was specified. + + - For each user profile selected from the store, LoadState creates a corresponding user profile on the destination computer. The destination computer does not need to be connected to the domain for domain user profiles to be created. If USMT cannot determine a domain, it attempts to apply the settings to a local account. For more information, see [Identify Users](usmt-identify-users.md). + +4. In the "Scanning" phase, LoadState does the following for each user profile: + + 1. For each component, LoadState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. + + **Note** + From this point on, LoadState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. LoadState evaluates all components in the same way. + + + + 2. Each component that is selected is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents (assuming that the user profiles are stored in the C:\\Users directory). + + **Note** + LoadState ignores the <detects> section specified in a component. At this point, all specified components are considered to be detected and are selected for migration. + + + + 3. For each selected component, LoadState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. + + 4. LoadState creates a master list of migration units by processing the various subsections under the <rules> section. Each migration unit that is in an <include> subsection is migrated as long, as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + + 5. LoadState evaluates the destination computer-specific subsections; for example, the <destinationCleanup> and <locationModify> subsections. + + 6. If the destination computer is running Windows 7 or Windows 8 then the migunits that were collected by ScanState using downlevel manifest files are processed by LoadState using the corresponding Component Manifest for Windows 7. The downlevel manifest files are not used during LoadState. + + **Important** + It is important to specify the .xml files with the LoadState command if you want LoadState to use them. Otherwise, any destination-specific rules, such as <locationModify>, in these .xml files are ignored, even if the same .xml files were provided when the ScanState command ran. + +5. In the "Apply" phase, LoadState writes the migration units that were collected to the various locations on the destination computer. If there are conflicts and there is not a <merge> rule for the object, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally, for example, OriginalFileName(1).OriginalExtension. Some settings, such as fonts, wallpaper, and screen-saver settings, do not take effect until the next time the user logs on. For this reason, you should log off when the LoadState command actions have completed. + +## Related topics + +[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-how-to.md b/windows/deployment/usmt/usmt-how-to.md index 9fdba24603..f883284978 100644 --- a/windows/deployment/usmt/usmt-how-to.md +++ b/windows/deployment/usmt/usmt-how-to.md @@ -1,35 +1,36 @@ ---- -title: User State Migration Tool (USMT) How-to topics (Windows 10) -description: User State Migration Tool (USMT) How-to topics -ms.assetid: 7b9a2f2a-a43a-4984-9746-a767f9f1c7e3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) How-to topics -The following table lists topics that describe how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. - -## In This Section - -|Topic |Description| -|------|-----------| -|[Exclude Files and Settings](usmt-exclude-files-and-settings.md)|Create a custom .xml file to exclude files, file types, folders, or registry settings from your migration.| -|[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md)|Recover files from a compressed migration store after installing the operating system.| -|[Include Files and Settings](usmt-include-files-and-settings.md)|Create a custom .xml file to include files, file types, folders, or registry settings in your migration.| -|[Migrate Application Settings](migrate-application-settings.md)|Migrate the settings of an application that the MigApp.xml file does not include by default.| -|[Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md)|Migrate Encrypting File System (EFS) certificates by using USMT.| -|[Migrate User Accounts](usmt-migrate-user-accounts.md)|Specify the users to include and exclude in your migration.| -|[Reroute Files and Settings](usmt-reroute-files-and-settings.md)|Create a custom .xml file to reroute files and settings during a migration.| -|[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md)|Determine whether a compressed migration store is intact, or whether it contains corrupt files or a corrupt catalog.| - -## Related topics -- [User State Migration Tool (USMT) Overview Topics](usmt-topics.md) -- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) -- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) +--- +title: User State Migration Tool (USMT) How-to topics (Windows 10) +description: Reference the topics in this article to learn how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. +ms.assetid: 7b9a2f2a-a43a-4984-9746-a767f9f1c7e3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) How-to topics +The following table lists topics that describe how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. + +## In This Section + +|Topic |Description| +|------|-----------| +|[Exclude Files and Settings](usmt-exclude-files-and-settings.md)|Create a custom .xml file to exclude files, file types, folders, or registry settings from your migration.| +|[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md)|Recover files from a compressed migration store after installing the operating system.| +|[Include Files and Settings](usmt-include-files-and-settings.md)|Create a custom .xml file to include files, file types, folders, or registry settings in your migration.| +|[Migrate Application Settings](migrate-application-settings.md)|Migrate the settings of an application that the MigApp.xml file does not include by default.| +|[Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md)|Migrate Encrypting File System (EFS) certificates by using USMT.| +|[Migrate User Accounts](usmt-migrate-user-accounts.md)|Specify the users to include and exclude in your migration.| +|[Reroute Files and Settings](usmt-reroute-files-and-settings.md)|Create a custom .xml file to reroute files and settings during a migration.| +|[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md)|Determine whether a compressed migration store is intact, or whether it contains corrupt files or a corrupt catalog.| + +## Related topics +- [User State Migration Tool (USMT) Overview Topics](usmt-topics.md) +- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) +- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) diff --git a/windows/deployment/usmt/usmt-identify-application-settings.md b/windows/deployment/usmt/usmt-identify-application-settings.md index 2a8a430f41..47f9aef4a9 100644 --- a/windows/deployment/usmt/usmt-identify-application-settings.md +++ b/windows/deployment/usmt/usmt-identify-application-settings.md @@ -1,62 +1,63 @@ ---- -title: Identify Applications Settings (Windows 10) -description: Identify Applications Settings -ms.assetid: eda68031-9b02-4a5b-a893-3786a6505381 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify Applications Settings - - -When planning for your migration, you should identify which applications and settings you want to migrate. For more information about how to create a custom .xml file to migrate the settings of another application, see [Customize USMT XML Files](usmt-customize-xml-files.md). - -## Applications - - -First, create and prioritize a list of applications that to be migrated. It may be helpful to review the application lists and decide which applications will be redeployed and which applications will be retired. Often, the applications are prioritized based on a combination of how widely the application is used and how complex the application is. - -Next, identify an application owner to be in charge of each application. This is necessary because the developers will not be experts on all of the applications in the organization. The application owner should have the most experience with an application. The application owner provides insight into how the organization installs, configures, and uses the application. - -## Application Settings - - -Next, determine and locate the application settings to be migrated. You can acquire much of the information that you need for this step when you are testing the new applications for compatibility with the new operating system. - -After completing the list of applications to be migrated, review the list and work with each application owner on a list of settings to be migrated. For each setting, determine whether it needs to be migrated or if the default settings are adequate. Then, determine where the setting is located; for example, in the registry or in an .ini file. Next, consider the following questions to determine what needs to be done to migrate the setting successfully: - -- Is the destination version of the application newer than the source version? - -- Do these settings work with the new version? - -- Do the settings need to be moved or altered? - -- Can the first-run process force the application to appear as if it had run already? If so, does this work correctly, or does it break the application? - -After answering these questions, create a custom .xml file to migrate settings. Work with the application owner to develop test cases and to determine the file types that need to be migrated for the application. - -## Locating Where Settings Are Stored - - -See [Migrate Application Settings](migrate-application-settings.md) and follow the directions. - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -  - -  - - - - - +--- +title: Identify Applications Settings (Windows 10) +description: Identify which applications and settings you want to migrate before using the User State Migration Tool (USMT). +ms.assetid: eda68031-9b02-4a5b-a893-3786a6505381 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify Applications Settings + + +When planning for your migration, you should identify which applications and settings you want to migrate. For more information about how to create a custom .xml file to migrate the settings of another application, see [Customize USMT XML Files](usmt-customize-xml-files.md). + +## Applications + + +First, create and prioritize a list of applications that to be migrated. It may be helpful to review the application lists and decide which applications will be redeployed and which applications will be retired. Often, the applications are prioritized based on a combination of how widely the application is used and how complex the application is. + +Next, identify an application owner to be in charge of each application. This is necessary because the developers will not be experts on all of the applications in the organization. The application owner should have the most experience with an application. The application owner provides insight into how the organization installs, configures, and uses the application. + +## Application Settings + + +Next, determine and locate the application settings to be migrated. You can acquire much of the information that you need for this step when you are testing the new applications for compatibility with the new operating system. + +After completing the list of applications to be migrated, review the list and work with each application owner on a list of settings to be migrated. For each setting, determine whether it needs to be migrated or if the default settings are adequate. Then, determine where the setting is located; for example, in the registry or in an .ini file. Next, consider the following questions to determine what needs to be done to migrate the setting successfully: + +- Is the destination version of the application newer than the source version? + +- Do these settings work with the new version? + +- Do the settings need to be moved or altered? + +- Can the first-run process force the application to appear as if it had run already? If so, does this work correctly, or does it break the application? + +After answering these questions, create a custom .xml file to migrate settings. Work with the application owner to develop test cases and to determine the file types that need to be migrated for the application. + +## Locating Where Settings Are Stored + + +See [Migrate Application Settings](migrate-application-settings.md) and follow the directions. + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md index 45cd2a17a7..e8c15402b9 100644 --- a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md +++ b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md @@ -1,51 +1,52 @@ ---- -title: Identify File Types, Files, and Folders (Windows 10) -description: Identify File Types, Files, and Folders -ms.assetid: 93bb2a33-c126-4f7a-a961-6c89686d54e0 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify File Types, Files, and Folders - - -When planning for your migration, if not using MigDocs.xml, you should identify the file types, files, folders, and settings that you want to migrate. First, you should determine the standard file locations on each computer, such as **My Documents.** , **C:\\Data** , and company-specified locations, such as **\\EngineeringDrafts**. Next, you should determine and locate the non-standard locations. For non-standard locations, consider the following: - -- **File types**. Consider which file types need to be included and excluded from the migration. You can create this list based on common applications used in your organization. Applications normally use specific file name extensions. For example, Microsoft Office Word primarily uses .doc, .docx and .dotx file name extension. However, it also uses other file types, such as templates (.dot files), on a less frequent basis. - -- **Excluded locations**. Consider the locations on the computer that should be excluded from the migration (for example, %WINDIR% and Program Files). - -- **New locations**. Decide where files should be migrated to on the destination computer for example, \\My Documents, a designated folder, or a folder matching the files' name and location on the source computer. For example, you might have shared data on source machine or you might wish to clean up documents outside the user profiles on the source system. Identify any data that needs to be redirected to a new location in the apply phase. This can be accomplished with location modify rules. - -Once you have verified which files and file types that the end users work with regularly, you will need to locate them. Files may be saved to a single folder or scattered across a drive. A good starting point for finding files types to include is to look at the registered file types on the computer. - -**To find the registered file types on a computer running Windows 7 or Windows 8** - -1. Click **Start**. Open **Control Panel**, click **Control Panel Home**, and click **Programs**. - -2. Click **Default Programs**, and click **Associate a file type or protocol with a program**. - -3. On this screen, the registered file types are displayed. - -For more information about how to change the file types, files, and folders that are migrated when you specify the MigUser.xml file, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -  - -  - - - - - +--- +title: Identify File Types, Files, and Folders (Windows 10) +description: Learn how to identify the file types, files, folders, and settings that you want to migrate when you're planning your migration. +ms.assetid: 93bb2a33-c126-4f7a-a961-6c89686d54e0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify File Types, Files, and Folders + + +When planning for your migration, if not using MigDocs.xml, you should identify the file types, files, folders, and settings that you want to migrate. First, you should determine the standard file locations on each computer, such as **My Documents.** , **C:\\Data** , and company-specified locations, such as **\\EngineeringDrafts**. Next, you should determine and locate the non-standard locations. For non-standard locations, consider the following: + +- **File types**. Consider which file types need to be included and excluded from the migration. You can create this list based on common applications used in your organization. Applications normally use specific file name extensions. For example, Microsoft Office Word primarily uses .doc, .docx and .dotx file name extension. However, it also uses other file types, such as templates (.dot files), on a less frequent basis. + +- **Excluded locations**. Consider the locations on the computer that should be excluded from the migration (for example, %WINDIR% and Program Files). + +- **New locations**. Decide where files should be migrated to on the destination computer for example, \\My Documents, a designated folder, or a folder matching the files' name and location on the source computer. For example, you might have shared data on source machine or you might wish to clean up documents outside the user profiles on the source system. Identify any data that needs to be redirected to a new location in the apply phase. This can be accomplished with location modify rules. + +Once you have verified which files and file types that the end users work with regularly, you will need to locate them. Files may be saved to a single folder or scattered across a drive. A good starting point for finding files types to include is to look at the registered file types on the computer. + +**To find the registered file types on a computer running Windows 7 or Windows 8** + +1. Click **Start**. Open **Control Panel**, click **Control Panel Home**, and click **Programs**. + +2. Click **Default Programs**, and click **Associate a file type or protocol with a program**. + +3. On this screen, the registered file types are displayed. + +For more information about how to change the file types, files, and folders that are migrated when you specify the MigUser.xml file, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-identify-operating-system-settings.md b/windows/deployment/usmt/usmt-identify-operating-system-settings.md index 1cffd2aed8..8165a6d8c3 100644 --- a/windows/deployment/usmt/usmt-identify-operating-system-settings.md +++ b/windows/deployment/usmt/usmt-identify-operating-system-settings.md @@ -1,60 +1,61 @@ ---- -title: Identify Operating System Settings (Windows 10) -description: Identify Operating System Settings -ms.assetid: 1704ab18-1765-41fb-a27c-3aa3128fa242 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify Operating System Settings - - -When planning for your migration, you should identify which operating system settings you want to migrate and to what extent you want to create a new standard environment on each of the computers. User State Migration Tool (USMT) 10.0 enables you to migrate select settings and keep the default values for all others. The operating system settings include the following: - -- **Apperance.** - - This includes items such as wallpaper, colors, sounds, and the location of the taskbar. - -- **Action.** - - This includes items such as the key-repeat rate, whether double-clicking a folder opens it in a new window or the same window, and whether you need to single-click or double-click an item to open it. - -- **Internet.** - - These are the settings that let you connect to the Internet and control how your browser operates. This includes items such as your home page URL, favorites, bookmarks, cookies, security settings, dial-up connections, and proxy settings. - -- **Mail.** - - This includes the information that you need to connect to your mail server, your signature file, views, mail rules, local mail, and contacts. - -To help you decide which settings to migrate, you should consider any previous migration experiences as well as the results of any surveys and tests that you have conducted. You should also consider the number of help-desk calls related to operating-system settings that you have had in the past, and are able to handle in the future. Also decide how much of the new operating-system functionality you want to take advantage of. - -You should migrate any settings that users need to get their jobs done, those that make the work environment comfortable, and those that will reduce help-desk calls after the migration. Although it is easy to dismiss migrating user preferences, you should consider that users can spend a significant amount of time restoring items such as wallpaper, screen savers, and other customizable user-interface features. Most users do not remember how these settings were applied. Although these items are not critical to migration success, migrating these items increases user productivity and overall satisfaction of the migration process. - -**Note**   -For more information about how to change the operating-system settings that are migrated, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). - -For information about the operating-system settings that USMT migrates, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - - - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - - - - - - - - - +--- +title: Identify Operating System Settings (Windows 10) +description: Identify which system settings you want to migrate, then use the User State Migration Tool (USMT) to select settings and keep the default values for all others. +ms.assetid: 1704ab18-1765-41fb-a27c-3aa3128fa242 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify Operating System Settings + + +When planning for your migration, you should identify which operating system settings you want to migrate and to what extent you want to create a new standard environment on each of the computers. User State Migration Tool (USMT) 10.0 enables you to migrate select settings and keep the default values for all others. The operating system settings include the following: + +- **Apperance.** + + This includes items such as wallpaper, colors, sounds, and the location of the taskbar. + +- **Action.** + + This includes items such as the key-repeat rate, whether double-clicking a folder opens it in a new window or the same window, and whether you need to single-click or double-click an item to open it. + +- **Internet.** + + These are the settings that let you connect to the Internet and control how your browser operates. This includes items such as your home page URL, favorites, bookmarks, cookies, security settings, dial-up connections, and proxy settings. + +- **Mail.** + + This includes the information that you need to connect to your mail server, your signature file, views, mail rules, local mail, and contacts. + +To help you decide which settings to migrate, you should consider any previous migration experiences as well as the results of any surveys and tests that you have conducted. You should also consider the number of help-desk calls related to operating-system settings that you have had in the past, and are able to handle in the future. Also decide how much of the new operating-system functionality you want to take advantage of. + +You should migrate any settings that users need to get their jobs done, those that make the work environment comfortable, and those that will reduce help-desk calls after the migration. Although it is easy to dismiss migrating user preferences, you should consider that users can spend a significant amount of time restoring items such as wallpaper, screen savers, and other customizable user-interface features. Most users do not remember how these settings were applied. Although these items are not critical to migration success, migrating these items increases user productivity and overall satisfaction of the migration process. + +**Note**   +For more information about how to change the operating-system settings that are migrated, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). + +For information about the operating-system settings that USMT migrates, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + + + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index b58c711dbf..d86d82ae25 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -1,6 +1,6 @@ --- title: Identify Users (Windows 10) -description: Identify Users +description: Learn how to identify users you plan to migrate, as well as how to migrate local accounts and domain accounts. ms.assetid: 957a4fe9-79fd-44a2-8c26-33e50f71f9de ms.reviewer: manager: laurawi @@ -18,7 +18,7 @@ ms.localizationpriority: medium It is important to carefully consider how you plan to migrate users. By default, all users are migrated by User State Migration Tool (USMT) 5.0. You must specify which users to include by using the command line. You cannot specify users in the .xml files. For instructions on how to migrate users, see [Migrate User Accounts](usmt-migrate-user-accounts.md). -## In This Topic +## In this topic - [Migrating Local Accounts](#bkmk-8) - [Migrating Domain Accounts](#bkmk-9) diff --git a/windows/deployment/usmt/usmt-include-files-and-settings.md b/windows/deployment/usmt/usmt-include-files-and-settings.md index c594b6ea7d..734c21960c 100644 --- a/windows/deployment/usmt/usmt-include-files-and-settings.md +++ b/windows/deployment/usmt/usmt-include-files-and-settings.md @@ -1,6 +1,6 @@ --- title: Include Files and Settings (Windows 10) -description: Include Files and Settings +description: Specify the migration .xml files you want, then use the User State Migration Tool (USMT) 10.0 to migrate the settings and components specified. ms.assetid: 9009c6a5-0612-4478-8742-abe5eb6cbac8 ms.reviewer: manager: laurawi diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md index 3bbf83959b..f421c5d9ee 100644 --- a/windows/deployment/usmt/usmt-loadstate-syntax.md +++ b/windows/deployment/usmt/usmt-loadstate-syntax.md @@ -1,6 +1,6 @@ --- title: LoadState Syntax (Windows 10) -description: LoadState Syntax +description: Learn about the syntax and usage of the command-line options available when you use the LoadState command. ms.assetid: 53d2143b-cbe9-4cfc-8506-36e9d429f6d4 ms.reviewer: manager: laurawi @@ -17,9 +17,9 @@ ms.topic: article # LoadState Syntax -This topic discusses the **LoadState** command syntax and options. +This topic discusses the **LoadState** command syntax and options available with it. -## In This Topic +## In this topic [Before You Begin](#before) @@ -462,7 +462,7 @@ You can use the **/uel**, **/ue** and **/ui** options together to migrate only t **The /ui option has precedence over the /ue and /uel options.** If a user is specified to be included using the **/ui** option, and also specified to be excluded using either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the **/ui** option takes precedence over the **/ue** option. -**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user’s profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. +**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user's profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md index d9917d3495..63fcf4af6f 100644 --- a/windows/deployment/usmt/usmt-log-files.md +++ b/windows/deployment/usmt/usmt-log-files.md @@ -1,6 +1,6 @@ --- title: Log Files (Windows 10) -description: Log Files +description: Learn how to use User State Migration Tool (USMT) 10.0 logs to monitor your migration and to troubleshoot errors and failed migrations. ms.assetid: 28185ebd-630a-4bbd-94f4-8c48aad05649 ms.reviewer: manager: laurawi @@ -251,7 +251,7 @@ The following examples describe common scenarios in which you can use the diagno **Why is this file not migrating when I authored an "include" rule for it?** -Let’s imagine that we have the following directory structure and that we want the “data” directory to be included in the migration along with the “New Text Document.txt” file in the “New Folder.” The directory of **C:\\data** contains: +Let's imagine that we have the following directory structure and that we want the "data" directory to be included in the migration along with the "New Text Document.txt" file in the "New Folder." The directory of **C:\\data** contains: ``` 01/21/2009 10:08 PM . @@ -293,7 +293,7 @@ To migrate these files you author the following migration XML: ``` -However, upon testing the migration you notice that the “New Text Document.txt” file isn’t included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: +However, upon testing the migration you notice that the "New Text Document.txt" file isn't included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered: ``` xml @@ -312,7 +312,7 @@ However, upon testing the migration you notice that the “New Text Document.txt ``` -Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The <Perform> section details the actual files that were scheduled for gathering and the result of the gathering operation. The “New Text Document.txt” file doesn’t appear in this section, which confirms that the migration rule was not correctly authored. +Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The <Perform> section details the actual files that were scheduled for gathering and the result of the gathering operation. The "New Text Document.txt" file doesn't appear in this section, which confirms that the migration rule was not correctly authored. An analysis of the XML elements reference topic reveals that the <pattern> tag needs to be modified as follows: @@ -345,7 +345,7 @@ This diagnostic log confirms that the modified <pattern> value enables the **Why is this file migrating when I authored an exclude rule excluding it?** -In this scenario, you have the following directory structure and you want all files in the “data” directory to migrate, except for text files. The **C:\\Data** folder contains: +In this scenario, you have the following directory structure and you want all files in the "data" directory to migrate, except for text files. The **C:\\Data** folder contains: ``` Directory of C:\Data @@ -395,7 +395,7 @@ You author the following migration XML: ``` -However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: +However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered: ``` xml diff --git a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md index 706f2c6a6e..17fe9cfc7d 100644 --- a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md +++ b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md @@ -1,55 +1,56 @@ ---- -title: Migrate EFS Files and Certificates (Windows 10) -description: Migrate EFS Files and Certificates -ms.assetid: 7f19a753-ec45-4433-b297-cc30f16fdee1 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migrate EFS Files and Certificates - - -This topic describes how to migrate Encrypting File System (EFS) certificates. For more information about the **/efs** For options, see [ScanState Syntax](usmt-scanstate-syntax.md). - -## To Migrate EFS Files and Certificates - - -Encrypting File System (EFS) certificates will be migrated automatically. However, by default, the User State Migration Tool (USMT) 10.0 fails if an encrypted file is found (unless you specify an **/efs** option). Therefore, you must specify **/efs:abort | skip | decryptcopy | copyraw | hardlink** with the ScanState command to migrate the encrypted files. Then, when you run the LoadState command on the destination computer, the encrypted file and the EFS certificate will be automatically migrated. - -**Note**   -The **/efs** options are not used with the LoadState command. - - - -Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you must ensure that all files in an encrypted folder are encrypted as well or remove the encryption attribute from folders that contain unencrypted files. If the encryption attribute has been removed from a file but not from the parent folder, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. - -You can run the Cipher tool at a Windows command prompt to review and change encryption settings on files and folders. For example, to remove encryption from a folder, at a command prompt type: - -``` syntax -Cipher /D /S: -``` - -Where *<Path>* is the full path of the topmost parent directory where the encryption attribute is set. - -## Related topics - - -[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - -[Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) - - - - - - - - - +--- +title: Migrate EFS Files and Certificates (Windows 10) +description: Learn how to migrate Encrypting File System (EFS) certificates. Also, learn where to find information about how to identify file types, files, and folders. +ms.assetid: 7f19a753-ec45-4433-b297-cc30f16fdee1 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migrate EFS Files and Certificates + + +This topic describes how to migrate Encrypting File System (EFS) certificates. For more information about the **/efs** For options, see [ScanState Syntax](usmt-scanstate-syntax.md). + +## To Migrate EFS Files and Certificates + + +Encrypting File System (EFS) certificates will be migrated automatically. However, by default, the User State Migration Tool (USMT) 10.0 fails if an encrypted file is found (unless you specify an **/efs** option). Therefore, you must specify **/efs:abort | skip | decryptcopy | copyraw | hardlink** with the ScanState command to migrate the encrypted files. Then, when you run the LoadState command on the destination computer, the encrypted file and the EFS certificate will be automatically migrated. + +**Note**   +The **/efs** options are not used with the LoadState command. + + + +Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you must ensure that all files in an encrypted folder are encrypted as well or remove the encryption attribute from folders that contain unencrypted files. If the encryption attribute has been removed from a file but not from the parent folder, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. + +You can run the Cipher tool at a Windows command prompt to review and change encryption settings on files and folders. For example, to remove encryption from a folder, at a command prompt type: + +``` syntax +Cipher /D /S: +``` + +Where *<Path>* is the full path of the topmost parent directory where the encryption attribute is set. + +## Related topics + + +[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + +[Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-migrate-user-accounts.md b/windows/deployment/usmt/usmt-migrate-user-accounts.md index 663964c7eb..330d9984b5 100644 --- a/windows/deployment/usmt/usmt-migrate-user-accounts.md +++ b/windows/deployment/usmt/usmt-migrate-user-accounts.md @@ -1,96 +1,97 @@ ---- -title: Migrate User Accounts (Windows 10) -description: Migrate User Accounts -ms.assetid: a3668361-43c8-4fd2-b26e-9a2deaeaeb09 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migrate User Accounts - - -By default, all users are migrated. The only way to specify which users to include and exclude is on the command line by using the User options. You cannot specify users in the migration XML files or by using the Config.xml file. - -## In this Topic - - -- [To migrate all user accounts and user settings](#bkmk-migrateall) - -- [To migrate two domain accounts (User1 and User2)](#bkmk-migratetwo) - -- [To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain](#bkmk-migratemoveuserone) - -## To migrate all user accounts and user settings -Links to detailed explanations of commands are available in the Related Topics section. - -1. Log on to the source computer as an administrator, and specify the following in a **Command-Prompt** window: - - `scanstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Do one of the following: - - - If you are migrating domain accounts, specify: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` - - - If you are migrating local accounts along with domain accounts, specify: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /lac /lae` - - **Note**   - You do not have to specify the **/lae** option, which enables the account that was created with the **/lac** option. Instead, you can create a disabled local account by specifying only the **/lac** option, and then a local administrator needs to enable the account on the destination computer. - - - -## To migrate two domain accounts (User1 and User2) -Links to detailed explanations of commands are available in the Related Topics section. - -1. Log on to the source computer as an administrator, and specify: - - `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:fabrikam\user2 /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Specify the following: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` - -## To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain -Links to detailed explanations of commands are available in the Related Topics section. - -1. Log on to the source computer as an administrator, and type the following at the command-line prompt: - - `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:contoso\user2 /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Specify the following: - - `loadstate \\server\share\migration\mystore /mu:contoso\user1:fabrikam\user2 /i:migdocs.xml /i:migapp.xml` - -## Related topics - - -[Identify Users](usmt-identify-users.md) - -[ScanState Syntax](usmt-scanstate-syntax.md) - -[LoadState Syntax](usmt-loadstate-syntax.md) - - - - - - - - - +--- +title: Migrate User Accounts (Windows 10) +description: Learn how to migrate user accounts and how to specify which users to include and exclude by using the User options on the command line. +ms.assetid: a3668361-43c8-4fd2-b26e-9a2deaeaeb09 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migrate User Accounts + + +By default, all users are migrated. The only way to specify which users to include and exclude is on the command line by using the User options. You cannot specify users in the migration XML files or by using the Config.xml file. + +## In this Topic + + +- [To migrate all user accounts and user settings](#bkmk-migrateall) + +- [To migrate two domain accounts (User1 and User2)](#bkmk-migratetwo) + +- [To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain](#bkmk-migratemoveuserone) + +## To migrate all user accounts and user settings +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and specify the following in a **Command-Prompt** window: + + `scanstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Do one of the following: + + - If you are migrating domain accounts, specify: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` + + - If you are migrating local accounts along with domain accounts, specify: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /lac /lae` + + **Note**   + You do not have to specify the **/lae** option, which enables the account that was created with the **/lac** option. Instead, you can create a disabled local account by specifying only the **/lac** option, and then a local administrator needs to enable the account on the destination computer. + + + +## To migrate two domain accounts (User1 and User2) +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and specify: + + `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:fabrikam\user2 /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Specify the following: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` + +## To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and type the following at the command-line prompt: + + `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:contoso\user2 /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Specify the following: + + `loadstate \\server\share\migration\mystore /mu:contoso\user1:fabrikam\user2 /i:migdocs.xml /i:migapp.xml` + +## Related topics + + +[Identify Users](usmt-identify-users.md) + +[ScanState Syntax](usmt-scanstate-syntax.md) + +[LoadState Syntax](usmt-loadstate-syntax.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md index 8ef1ea7592..c10a7ba4f3 100644 --- a/windows/deployment/usmt/usmt-migration-store-encryption.md +++ b/windows/deployment/usmt/usmt-migration-store-encryption.md @@ -1,76 +1,77 @@ ---- -title: Migration Store Encryption (Windows 10) -description: Migration Store Encryption -ms.assetid: b28c2657-b986-4487-bd38-cb81500b831d -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migration Store Encryption - - -This topic discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration. - -## USMT Encryption Options - - -USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data. - -The encryption algorithm you choose must be specified for both the **ScanState** and the **LoadState** commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the **ScanState** and the **LoadState** command lines by using the **/encrypt**:*"encryptionstrength"* and the **/decrypt**:*"encryptionstrength"* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the Usmtutils.exe file to determine which encryption algorithms are available to the computers' locales before you begin the migration. - -The following table describes the command-line encryption options in USMT. - -
        ----- - - - - - - - - - - - - - - - - - - - -
        ComponentOptionDescription

        ScanState

        /encrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

        This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the ScanState tool employs the 3DES algorithm.

        LoadState

        /decrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

        This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the LoadState tool employs the 3DES algorithm.

        - - - -**Important**   -Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the UsmtUtils command with the **/ec** option. For more information see [UsmtUtils Syntax](usmt-utilities.md) - - - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - - - - - - - - - +--- +title: Migration Store Encryption (Windows 10) +description:  Learn how the User State Migration Tool (USMT) enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES). +ms.assetid: b28c2657-b986-4487-bd38-cb81500b831d +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migration Store Encryption + + +This topic discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration. + +## USMT Encryption Options + + +USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data. + +The encryption algorithm you choose must be specified for both the **ScanState** and the **LoadState** commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the **ScanState** and the **LoadState** command lines by using the **/encrypt**:*"encryptionstrength"* and the **/decrypt**:*"encryptionstrength"* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the Usmtutils.exe file to determine which encryption algorithms are available to the computers' locales before you begin the migration. + +The following table describes the command-line encryption options in USMT. + + +++++ + + + + + + + + + + + + + + + + + + + +
        ComponentOptionDescription

        ScanState

        /encrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

        This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the ScanState tool employs the 3DES algorithm.

        LoadState

        /decrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

        This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the LoadState tool employs the 3DES algorithm.

        + + + +**Important**   +Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the UsmtUtils command with the **/ec** option. For more information see [UsmtUtils Syntax](usmt-utilities.md) + + + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md index 6d80871901..f8d35246e7 100644 --- a/windows/deployment/usmt/usmt-overview.md +++ b/windows/deployment/usmt/usmt-overview.md @@ -1,60 +1,53 @@ ---- -title: User State Migration Tool (USMT) Overview (Windows 10) -description: User State Migration Tool (USMT) Overview -ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 10/16/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Overview -You can use User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. USMT captures user accounts, user files, operating system settings, and application settings, and then migrates them to a new Windows installation. You can use USMT for both PC replacement and PC refresh migrations. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). - -USMT enables you to do the following: - -- Configure your migration according to your business needs by using the migration rule (.xml) files to control exactly which files and settings are migrated and how they are migrated. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). - -- Fit your customized migration into your automated deployment process by using the ScanState and LoadState tools, which control collecting and restoring the user files and settings. For more information, see [User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md). - -- Perform offline migrations. You can run migrations offline by using the ScanState command in Windows Preinstallation Environment (WinPE) or you can perform migrations from previous installations of Windows contained in Windows.old directories. For more information about migration types, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md) and [Offline Migration Reference](offline-migration-reference.md). - -## Benefits -USMT provides the following benefits to businesses that are deploying Windows operating systems: - -- Safely migrates user accounts, operating system and application settings. - -- Lowers the cost of deploying Windows by preserving user state. - -- Reduces end-user downtime required to customize desktops and find missing files. - -- Reduces help-desk calls. - -- Reduces the time needed for the user to become familiar with the new operating system. - -- Increases employee satisfaction with the migration experience. - -## Limitations -USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink. - -There are some scenarios in which the use of USMT is not recommended. These include: - -- Migrations that require end-user interaction. - -- Migrations that require customization on a machine-by-machine basis. - -## Related topics -- [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md) - - -  - - - - - +--- +title: User State Migration Tool (USMT) Overview (Windows 10) +description: Learn about using User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. +ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 10/16/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Overview +You can use User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. USMT captures user accounts, user files, operating system settings, and application settings, and then migrates them to a new Windows installation. You can use USMT for both PC replacement and PC refresh migrations. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). + +USMT enables you to do the following: + +- Configure your migration according to your business needs by using the migration rule (.xml) files to control exactly which files and settings are migrated and how they are migrated. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). + +- Fit your customized migration into your automated deployment process by using the ScanState and LoadState tools, which control collecting and restoring the user files and settings. For more information, see [User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md). + +- Perform offline migrations. You can run migrations offline by using the ScanState command in Windows Preinstallation Environment (WinPE) or you can perform migrations from previous installations of Windows contained in Windows.old directories. For more information about migration types, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md) and [Offline Migration Reference](offline-migration-reference.md). + +## Benefits +USMT provides the following benefits to businesses that are deploying Windows operating systems: + +- Safely migrates user accounts, operating system and application settings. + +- Lowers the cost of deploying Windows by preserving user state. + +- Reduces end-user downtime required to customize desktops and find missing files. + +- Reduces help-desk calls. + +- Reduces the time needed for the user to become familiar with the new operating system. + +- Increases employee satisfaction with the migration experience. + +## Limitations +USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink. + +There are some scenarios in which the use of USMT is not recommended. These include: + +- Migrations that require end-user interaction. + +- Migrations that require customization on a machine-by-machine basis. + +## Related topics +- [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md) diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md index 1fa60664bd..7ea0c4d341 100644 --- a/windows/deployment/usmt/usmt-plan-your-migration.md +++ b/windows/deployment/usmt/usmt-plan-your-migration.md @@ -1,71 +1,72 @@ ---- -title: Plan Your Migration (Windows 10) -description: Plan Your Migration -ms.assetid: c951f7df-850e-47ad-b31b-87f902955e3e -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Plan Your Migration - - -Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure. - -In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out. - -One of the most important requirements for migrating settings and data is restoring only the information that the destination computer requires. Although the data that you capture on the source computer may be more comprehensive than the restoration data for backup purposes, restoring data or settings for applications that you will not install on the destination system is redundant. This can also introduce instability in a newly deployed computer. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - -

        Common Migration Scenarios

        Determine whether you will perform a refresh migration or a replace migration.

        What Does USMT Migrate?

        Learn which applications, user data, and operating system components USMT migrates.

        Choose a Migration Store Type

        Choose an uncompressed, compressed, or hard-link migration store.

        Determine What to Migrate

        Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.

        Test Your Migration

        Test your migration before you deploy Windows to all users.

        - - - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: Plan Your Migration (Windows 10) +description: Learn how to your plan your migration carefully so your migration can proceed smoothly and so that you reduce the risk of migration failure. +ms.assetid: c951f7df-850e-47ad-b31b-87f902955e3e +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Plan Your Migration + + +Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure. + +In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out. + +One of the most important requirements for migrating settings and data is restoring only the information that the destination computer requires. Although the data that you capture on the source computer may be more comprehensive than the restoration data for backup purposes, restoring data or settings for applications that you will not install on the destination system is redundant. This can also introduce instability in a newly deployed computer. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

        Common Migration Scenarios

        Determine whether you will perform a refresh migration or a replace migration.

        What Does USMT Migrate?

        Learn which applications, user data, and operating system components USMT migrates.

        Choose a Migration Store Type

        Choose an uncompressed, compressed, or hard-link migration store.

        Determine What to Migrate

        Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.

        Test Your Migration

        Test your migration before you deploy Windows to all users.

        + + + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md index d2862feb9a..dfb923bbd4 100644 --- a/windows/deployment/usmt/usmt-recognized-environment-variables.md +++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md @@ -1,470 +1,471 @@ ---- -title: Recognized Environment Variables (Windows 10) -description: Recognized Environment Variables -ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Recognized Environment Variables - - -When using the XML files MigDocs.xml, MigApp.xml, and MigUser.xml, you can use environment variables to identify folders that may be different on different computers. Constant special item ID list (CSIDL) values provide a way to identify folders that applications use frequently but may not have the same name or location on any given computer. For example, the documents folder may be C:\\Users\\<Username>\\My Documents on one computer and C:\\Documents and Settings on another. You can use the asterisk (\*) wildcard character in MigUser.xml, MigApp.xml and MigDoc.xml files. However, you cannot use the asterisk (\*) wildcard characters in the Config.xml file. - -## In This Topic - - -- [Variables that are processed for the operating system and in the context of each user](#bkmk-1) - -- [Variables that are recognized only in the user context](#bkmk-2) - -## Variables that are processed for the operating system and in the context of each user - - -You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        VariableExplanation

        ALLUSERSAPPDATA

        Same as CSIDL_COMMON_APPDATA.

        ALLUSERSPROFILE

        Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.

        COMMONPROGRAMFILES

        Same as CSIDL_PROGRAM_FILES_COMMON.

        COMMONPROGRAMFILES(X86)

        Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.

        CSIDL_COMMON_ADMINTOOLS

        Version 10.0. The file-system directory that contains administrative tools for all users of the computer.

        CSIDL_COMMON_ALTSTARTUP

        The file-system directory that corresponds to the non-localized Startup program group for all users.

        CSIDL_COMMON_APPDATA

        The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.

        CSIDL_COMMON_DESKTOPDIRECTORY

        The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.

        CSIDL_COMMON_DOCUMENTS

        The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.

        CSIDL_COMMON_FAVORITES

        The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.

        CSIDL_COMMON_MUSIC

        The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.

        CSIDL_COMMON_PICTURES

        The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.

        CSIDL_COMMON_PROGRAMS

        The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.

        CSIDL_COMMON_STARTMENU

        The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.

        CSIDL_COMMON_STARTUP

        The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

        CSIDL_COMMON_TEMPLATES

        The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.

        CSIDL_COMMON_VIDEO

        The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.

        CSIDL_DEFAULT_APPDATA

        Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_LOCAL_APPDATA

        Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_COOKIES

        Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_CONTACTS

        Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_DESKTOP

        Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_DOWNLOADS

        Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_FAVORITES

        Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_HISTORY

        Refers to the History folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_INTERNET_CACHE

        Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_PERSONAL

        Refers to the Personal folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_MYDOCUMENTS

        Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_MYPICTURES

        Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_MYMUSIC

        Refers to the My Music folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_MYVIDEO

        Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_RECENT

        Refers to the Recent folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_SENDTO

        Refers to the Send To folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_STARTMENU

        Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_PROGRAMS

        Refers to the Programs folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_STARTUP

        Refers to the Startup folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_TEMPLATES

        Refers to the Templates folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_QUICKLAUNCH

        Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.

        CSIDL_FONTS

        A virtual folder containing fonts. A typical path is C:\Windows\Fonts.

        CSIDL_PROGRAM_FILESX86

        The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).

        CSIDL_PROGRAM_FILES_COMMONX86

        A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.

        CSIDL_PROGRAM_FILES

        The Program Files folder. A typical path is C:\Program Files.

        CSIDL_PROGRAM_FILES_COMMON

        A folder for components that are shared across applications. A typical path is C:\Program Files\Common.

        CSIDL_RESOURCES

        The file-system directory that contains resource data. A typical path is C:\Windows\Resources.

        CSIDL_SYSTEM

        The Windows System folder. A typical path is C:\Windows\System32.

        CSIDL_WINDOWS

        The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.

        DEFAULTUSERPROFILE

        Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].

        PROFILESFOLDER

        Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].

        PROGRAMFILES

        Same as CSIDL_PROGRAM_FILES.

        PROGRAMFILES(X86)

        Refers to the C:\Program Files (x86) folder on 64-bit systems.

        SYSTEM

        Refers to %WINDIR%\system32.

        SYSTEM16

        Refers to %WINDIR%\system.

        SYSTEM32

        Refers to %WINDIR%\system32.

        SYSTEMPROFILE

        Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].

        SYSTEMROOT

        Refers to the root of the system drive.

        WINDIR

        Refers to the Windows folder located on the system drive.

        - -  - -## Variables that are recognized only in the user context - - -You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        VariableExplanation

        APPDATA

        Same as CSIDL_APPDATA.

        CSIDL_ADMINTOOLS

        The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.

        CSIDL_ALTSTARTUP

        The file-system directory that corresponds to the user's non-localized Startup program group.

        CSIDL_APPDATA

        The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.

        CSIDL_BITBUCKET

        The virtual folder that contains the objects in the user's Recycle Bin.

        CSIDL_CDBURN_AREA

        The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.

        CSIDL_CONNECTIONS

        The virtual folder representing Network Connections that contains network and dial-up connections.

        CSIDL_CONTACTS

        This refers to the Contacts folder in %CSIDL_PROFILE%.

        CSIDL_CONTROLS

        The virtual folder that contains icons for the Control Panel items.

        CSIDL_COOKIES

        The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.

        CSIDL_DESKTOP

        The virtual folder representing the Windows desktop.

        CSIDL_DESKTOPDIRECTORY

        The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.

        CSIDL_DRIVES

        The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.

        CSIDL_FAVORITES

        The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.

        CSIDL_HISTORY

        The file-system directory that serves as a common repository for Internet history items.

        CSIDL_INTERNET

        A virtual folder for Internet Explorer.

        CSIDL_INTERNET_CACHE

        The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files

        CSIDL_LOCAL_APPDATA

        The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.

        CSIDL_MYDOCUMENTS

        The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.

        CSIDL_MYMUSIC

        The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.

        CSIDL_MYPICTURES

        The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.

        CSIDL_MYVIDEO

        The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.

        CSIDL_NETHOOD

        A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.

        CSIDL_NETWORK

        A virtual folder representing My Network Places, the root of the network namespace hierarchy.

        CSIDL_PERSONAL

        The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

        -

        A typical path is C:\Documents and Settings\username\My Documents.

        CSIDL_PLAYLISTS

        The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.

        CSIDL_PRINTERS

        The virtual folder that contains installed printers.

        CSIDL_PRINTHOOD

        The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.

        CSIDL_PROFILE

        The user's profile folder. A typical path is C:\Users\Username.

        CSIDL_PROGRAMS

        The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.

        CSIDL_RECENT

        The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.

        CSIDL_SENDTO

        The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.

        CSIDL_STARTMENU

        The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.

        CSIDL_STARTUP

        The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

        CSIDL_TEMPLATES

        The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.

        HOMEPATH

        Same as the standard environment variable.

        TEMP

        The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

        TMP

        The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

        USERPROFILE

        Same as CSIDL_PROFILE.

        USERSID

        Represents the current user-account security identifier (SID). For example,

        -

        S-1-5-21-1714567821-1326601894-715345443-1026.

        - -  - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - +--- +title: Recognized Environment Variables (Windows 10) +description: Learn how to use environment variables to identify folders that may be different on different computers. +ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Recognized Environment Variables + + +When using the XML files MigDocs.xml, MigApp.xml, and MigUser.xml, you can use environment variables to identify folders that may be different on different computers. Constant special item ID list (CSIDL) values provide a way to identify folders that applications use frequently but may not have the same name or location on any given computer. For example, the documents folder may be C:\\Users\\<Username>\\My Documents on one computer and C:\\Documents and Settings on another. You can use the asterisk (\*) wildcard character in MigUser.xml, MigApp.xml and MigDoc.xml files. However, you cannot use the asterisk (\*) wildcard characters in the Config.xml file. + +## In This Topic + + +- [Variables that are processed for the operating system and in the context of each user](#bkmk-1) + +- [Variables that are recognized only in the user context](#bkmk-2) + +## Variables that are processed for the operating system and in the context of each user + + +You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        VariableExplanation

        ALLUSERSAPPDATA

        Same as CSIDL_COMMON_APPDATA.

        ALLUSERSPROFILE

        Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.

        COMMONPROGRAMFILES

        Same as CSIDL_PROGRAM_FILES_COMMON.

        COMMONPROGRAMFILES(X86)

        Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.

        CSIDL_COMMON_ADMINTOOLS

        Version 10.0. The file-system directory that contains administrative tools for all users of the computer.

        CSIDL_COMMON_ALTSTARTUP

        The file-system directory that corresponds to the non-localized Startup program group for all users.

        CSIDL_COMMON_APPDATA

        The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.

        CSIDL_COMMON_DESKTOPDIRECTORY

        The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.

        CSIDL_COMMON_DOCUMENTS

        The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.

        CSIDL_COMMON_FAVORITES

        The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.

        CSIDL_COMMON_MUSIC

        The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.

        CSIDL_COMMON_PICTURES

        The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.

        CSIDL_COMMON_PROGRAMS

        The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.

        CSIDL_COMMON_STARTMENU

        The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.

        CSIDL_COMMON_STARTUP

        The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

        CSIDL_COMMON_TEMPLATES

        The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.

        CSIDL_COMMON_VIDEO

        The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.

        CSIDL_DEFAULT_APPDATA

        Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_LOCAL_APPDATA

        Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_COOKIES

        Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_CONTACTS

        Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_DESKTOP

        Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_DOWNLOADS

        Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_FAVORITES

        Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_HISTORY

        Refers to the History folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_INTERNET_CACHE

        Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_PERSONAL

        Refers to the Personal folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_MYDOCUMENTS

        Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_MYPICTURES

        Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_MYMUSIC

        Refers to the My Music folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_MYVIDEO

        Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_RECENT

        Refers to the Recent folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_SENDTO

        Refers to the Send To folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_STARTMENU

        Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_PROGRAMS

        Refers to the Programs folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_STARTUP

        Refers to the Startup folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_TEMPLATES

        Refers to the Templates folder inside %DEFAULTUSERPROFILE%.

        CSIDL_DEFAULT_QUICKLAUNCH

        Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.

        CSIDL_FONTS

        A virtual folder containing fonts. A typical path is C:\Windows\Fonts.

        CSIDL_PROGRAM_FILESX86

        The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).

        CSIDL_PROGRAM_FILES_COMMONX86

        A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.

        CSIDL_PROGRAM_FILES

        The Program Files folder. A typical path is C:\Program Files.

        CSIDL_PROGRAM_FILES_COMMON

        A folder for components that are shared across applications. A typical path is C:\Program Files\Common.

        CSIDL_RESOURCES

        The file-system directory that contains resource data. A typical path is C:\Windows\Resources.

        CSIDL_SYSTEM

        The Windows System folder. A typical path is C:\Windows\System32.

        CSIDL_WINDOWS

        The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.

        DEFAULTUSERPROFILE

        Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].

        PROFILESFOLDER

        Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].

        PROGRAMFILES

        Same as CSIDL_PROGRAM_FILES.

        PROGRAMFILES(X86)

        Refers to the C:\Program Files (x86) folder on 64-bit systems.

        SYSTEM

        Refers to %WINDIR%\system32.

        SYSTEM16

        Refers to %WINDIR%\system.

        SYSTEM32

        Refers to %WINDIR%\system32.

        SYSTEMPROFILE

        Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].

        SYSTEMROOT

        Refers to the root of the system drive.

        WINDIR

        Refers to the Windows folder located on the system drive.

        + +  + +## Variables that are recognized only in the user context + + +You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        VariableExplanation

        APPDATA

        Same as CSIDL_APPDATA.

        CSIDL_ADMINTOOLS

        The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.

        CSIDL_ALTSTARTUP

        The file-system directory that corresponds to the user's non-localized Startup program group.

        CSIDL_APPDATA

        The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.

        CSIDL_BITBUCKET

        The virtual folder that contains the objects in the user's Recycle Bin.

        CSIDL_CDBURN_AREA

        The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.

        CSIDL_CONNECTIONS

        The virtual folder representing Network Connections that contains network and dial-up connections.

        CSIDL_CONTACTS

        This refers to the Contacts folder in %CSIDL_PROFILE%.

        CSIDL_CONTROLS

        The virtual folder that contains icons for the Control Panel items.

        CSIDL_COOKIES

        The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.

        CSIDL_DESKTOP

        The virtual folder representing the Windows desktop.

        CSIDL_DESKTOPDIRECTORY

        The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.

        CSIDL_DRIVES

        The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.

        CSIDL_FAVORITES

        The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.

        CSIDL_HISTORY

        The file-system directory that serves as a common repository for Internet history items.

        CSIDL_INTERNET

        A virtual folder for Internet Explorer.

        CSIDL_INTERNET_CACHE

        The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files

        CSIDL_LOCAL_APPDATA

        The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.

        CSIDL_MYDOCUMENTS

        The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.

        CSIDL_MYMUSIC

        The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.

        CSIDL_MYPICTURES

        The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.

        CSIDL_MYVIDEO

        The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.

        CSIDL_NETHOOD

        A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.

        CSIDL_NETWORK

        A virtual folder representing My Network Places, the root of the network namespace hierarchy.

        CSIDL_PERSONAL

        The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

        +

        A typical path is C:\Documents and Settings\username\My Documents.

        CSIDL_PLAYLISTS

        The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.

        CSIDL_PRINTERS

        The virtual folder that contains installed printers.

        CSIDL_PRINTHOOD

        The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.

        CSIDL_PROFILE

        The user's profile folder. A typical path is C:\Users\Username.

        CSIDL_PROGRAMS

        The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.

        CSIDL_RECENT

        The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.

        CSIDL_SENDTO

        The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.

        CSIDL_STARTMENU

        The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.

        CSIDL_STARTUP

        The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

        CSIDL_TEMPLATES

        The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.

        HOMEPATH

        Same as the standard environment variable.

        TEMP

        The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

        TMP

        The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

        USERPROFILE

        Same as CSIDL_PROFILE.

        USERSID

        Represents the current user-account security identifier (SID). For example,

        +

        S-1-5-21-1714567821-1326601894-715345443-1026.

        + +  + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md index c5bcd4193c..7e00f19577 100644 --- a/windows/deployment/usmt/usmt-reference.md +++ b/windows/deployment/usmt/usmt-reference.md @@ -1,77 +1,78 @@ ---- -title: User State Migration Toolkit (USMT) Reference (Windows 10) -description: User State Migration Toolkit (USMT) Reference -ms.assetid: 2135dbcf-de49-4cea-b2fb-97dd016e1a1a -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Toolkit (USMT) Reference - - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

        USMT Requirements

        Describes operating system, hardware, and software requirements, and user prerequisites.

        USMT Best Practices

        Discusses general and security-related best practices when using USMT.

        How USMT Works

        Learn about the processes behind the ScanState and LoadState tools.

        Plan Your Migration

        Choose what to migrate and the best migration scenario for your enterprise.

        User State Migration Tool (USMT) Command-line Syntax

        Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.

        USMT XML Reference

        Learn about customizing a migration with XML files.

        Offline Migration Reference

        Find requirements, best practices, and other considerations for performing a migration offline.

        - - - -## Related topics - - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - - - - - - - - - +--- +title: User State Migration Toolkit (USMT) Reference (Windows 10) +description: Use this User State Migration Toolkit (USMT) article to learn details about USMT, like operating system, hardware, and software requirements, and user prerequisites. +ms.assetid: 2135dbcf-de49-4cea-b2fb-97dd016e1a1a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Toolkit (USMT) Reference + + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

        USMT Requirements

        Describes operating system, hardware, and software requirements, and user prerequisites.

        USMT Best Practices

        Discusses general and security-related best practices when using USMT.

        How USMT Works

        Learn about the processes behind the ScanState and LoadState tools.

        Plan Your Migration

        Choose what to migrate and the best migration scenario for your enterprise.

        User State Migration Tool (USMT) Command-line Syntax

        Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.

        USMT XML Reference

        Learn about customizing a migration with XML files.

        Offline Migration Reference

        Find requirements, best practices, and other considerations for performing a migration offline.

        + + + +## Related topics + + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md index 45af228e40..525801e93b 100644 --- a/windows/deployment/usmt/usmt-requirements.md +++ b/windows/deployment/usmt/usmt-requirements.md @@ -1,161 +1,162 @@ ---- -title: USMT Requirements (Windows 10) -description: USMT Requirements -ms.assetid: 2b0cf3a3-9032-433f-9622-1f9df59d6806 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 05/03/2017 -ms.topic: article ---- - -# USMT Requirements - - -## In This Topic - - -- [Supported Operating Systems](#bkmk-1) -- [Windows PE](#windows-pe) -- [Credentials](#credentials) -- [Config.xml](#configxml) -- [LoadState](#loadstate) -- [Hard Disk Requirements](#bkmk-3) -- [User Prerequisites](#bkmk-userprereqs) - -## Supported Operating Systems - - -The User State Migration Tool (USMT) 10.0 does not have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings. - -The following table lists the operating systems supported in USMT. - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Operating SystemsScanState (source computer)LoadState (destination computer)

        32-bit versions of Windows 7

        X

        X

        64-bit versions of Windows 7

        X

        X

        32-bit versions of Windows 8

        X

        X

        64-bit versions of Windows 8

        X

        X

        32-bit versions of Windows 10

        X

        X

        64-bit versions of Windows 10

        X

        X

        - - - -**Note**   -You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. - -USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7. - -USMT for Windows 10 should not be used for migrating from Windows 7 to Windows 8.1. It is meant to migrate to Windows 10. -For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564).  - -## Windows PE - -- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](https://msdn.microsoft.com/library/windows/hardware/dn938350.aspx). - -## Credentials - -- **Run as administrator** - When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. - -To open an elevated command prompt: - -1. Click **Start**. -2. Enter **cmd** in the search function. -3. Depending on the OS you are using, **cmd** or **Command Prompt** is displayed. -3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**. -4. If the current user is not already an administrator, you will be prompted to enter administrator credentials. - -**Important**
        -You must run USMT using an account with full administrative permissions, including the following privileges: - -- SeBackupPrivilege (Back up files and directories) -- SeDebugPrivilege (Debug programs) -- SeRestorePrivilege (Restore files and directories) -- SeSecurityPrivilege (Manage auditing and security log) -- SeTakeOwnership Privilege (Take ownership of files or other objects) - - -## Config.xml - -- **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
        - USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). - -## LoadState - -- **Install applications before running the LoadState command.**
        - Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved. - -## Hard-Disk Requirements - - -Ensure that there is enough available space in the migration-store location and on the source and destination computers. For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). - -## User Prerequisites - - -This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following: - -- The navigation and hierarchy of the Windows registry. -- The files and file types that applications use. -- The methods to extract application and setting information manually from applications created by internal software-development groups and non-Microsoft software vendors. -- XML-authoring basics. - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md)
        -[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
        -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
        - - - - - - - - - +--- +title: USMT Requirements (Windows 10) +description: While the User State Migration Tool (USMT) doesn't have many requirements, these tips and tricks can help smooth the migration process. +ms.assetid: 2b0cf3a3-9032-433f-9622-1f9df59d6806 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 05/03/2017 +ms.topic: article +--- + +# USMT Requirements + + +## In This Topic + + +- [Supported Operating Systems](#bkmk-1) +- [Windows PE](#windows-pe) +- [Credentials](#credentials) +- [Config.xml](#configxml) +- [LoadState](#loadstate) +- [Hard Disk Requirements](#bkmk-3) +- [User Prerequisites](#bkmk-userprereqs) + +## Supported Operating Systems + + +The User State Migration Tool (USMT) 10.0 does not have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings. + +The following table lists the operating systems supported in USMT. + + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Operating SystemsScanState (source computer)LoadState (destination computer)

        32-bit versions of Windows 7

        X

        X

        64-bit versions of Windows 7

        X

        X

        32-bit versions of Windows 8

        X

        X

        64-bit versions of Windows 8

        X

        X

        32-bit versions of Windows 10

        X

        X

        64-bit versions of Windows 10

        X

        X

        + + + +**Note**   +You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. + +USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7. + +USMT for Windows 10 should not be used for migrating from Windows 7 to Windows 8.1. It is meant to migrate to Windows 10. +For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564).  + +## Windows PE + +- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](https://msdn.microsoft.com/library/windows/hardware/dn938350.aspx). + +## Credentials + +- **Run as administrator** + When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. + +To open an elevated command prompt: + +1. Click **Start**. +2. Enter **cmd** in the search function. +3. Depending on the OS you are using, **cmd** or **Command Prompt** is displayed. +3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**. +4. If the current user is not already an administrator, you will be prompted to enter administrator credentials. + +**Important**
        +You must run USMT using an account with full administrative permissions, including the following privileges: + +- SeBackupPrivilege (Back up files and directories) +- SeDebugPrivilege (Debug programs) +- SeRestorePrivilege (Restore files and directories) +- SeSecurityPrivilege (Manage auditing and security log) +- SeTakeOwnership Privilege (Take ownership of files or other objects) + + +## Config.xml + +- **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
        + USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). + +## LoadState + +- **Install applications before running the LoadState command.**
        + Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved. + +## Hard-Disk Requirements + + +Ensure that there is enough available space in the migration-store location and on the source and destination computers. For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). + +## User Prerequisites + + +This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following: + +- The navigation and hierarchy of the Windows registry. +- The files and file types that applications use. +- The methods to extract application and setting information manually from applications created by internal software-development groups and non-Microsoft software vendors. +- XML-authoring basics. + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md)
        +[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
        +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
        + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-reroute-files-and-settings.md b/windows/deployment/usmt/usmt-reroute-files-and-settings.md index 22f64e513e..facc5fef91 100644 --- a/windows/deployment/usmt/usmt-reroute-files-and-settings.md +++ b/windows/deployment/usmt/usmt-reroute-files-and-settings.md @@ -1,6 +1,6 @@ --- title: Reroute Files and Settings (Windows 10) -description: Reroute Files and Settings +description: Learn how to create a custom .xml file and specify this file name on both the ScanState and LoadState commandlines to reroute files and settings. ms.assetid: 905e6a24-922c-4549-9732-60fa11862a6c ms.reviewer: manager: laurawi diff --git a/windows/deployment/usmt/usmt-resources.md b/windows/deployment/usmt/usmt-resources.md index eaaa49a5d4..4866b61aaf 100644 --- a/windows/deployment/usmt/usmt-resources.md +++ b/windows/deployment/usmt/usmt-resources.md @@ -1,50 +1,51 @@ ---- -title: USMT Resources (Windows 10) -description: USMT Resources -ms.assetid: a0b266c7-4bcb-49f1-b63c-48c6ace86b43 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# USMT Resources - - -## USMT Online Resources - - -- [ADK Release Notes](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx) - -- Microsoft Visual Studio - - - You can use the User State Migration Tool (USMT) XML schema (the MigXML.xsd file) to validate the migration .xml files using an XML authoring tool such as Microsoft® Visual Studio®. - - For more information about how to use the schema with your XML authoring environment, see the environment’s documentation. - -- [Ask the Directory Services Team blog](https://go.microsoft.com/fwlink/p/?LinkId=226365) - -- Forums: - - - [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=226386) - - - [Configuration Manager Operating System Deployment](https://go.microsoft.com/fwlink/p/?LinkId=226388) - -## Related topics - - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -  - -  - - - - - +--- +title: USMT Resources (Windows 10) +description: Learn about User State Migration Tool (USMT) online resources, including Microsoft Visual Studio and forums. +ms.assetid: a0b266c7-4bcb-49f1-b63c-48c6ace86b43 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# USMT Resources + + +## USMT Online Resources + + +- [ADK Release Notes](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx) + +- Microsoft Visual Studio + + - You can use the User State Migration Tool (USMT) XML schema (the MigXML.xsd file) to validate the migration .xml files using an XML authoring tool such as Microsoft® Visual Studio®. + + For more information about how to use the schema with your XML authoring environment, see the environment’s documentation. + +- [Ask the Directory Services Team blog](https://go.microsoft.com/fwlink/p/?LinkId=226365) + +- Forums: + + - [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=226386) + + - [Configuration Manager Operating System Deployment](https://go.microsoft.com/fwlink/p/?LinkId=226388) + +## Related topics + + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-return-codes.md b/windows/deployment/usmt/usmt-return-codes.md index c137197a5c..ba8e6da7c1 100644 --- a/windows/deployment/usmt/usmt-return-codes.md +++ b/windows/deployment/usmt/usmt-return-codes.md @@ -1,786 +1,787 @@ ---- -title: Return Codes (Windows 10) -description: Return Codes -ms.assetid: e71bbc6b-d5a6-4e48-ad01-af0012b35f22 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Return Codes - - -This topic describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this topic provides tips to help you use the logfiles to determine why you received an error. - -Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md). - -## In This Topic - - -[USMT Return Codes](#bkmk-returncodes) - -[USMT Error Messages](#bkmk-errormessages) - -[Troubleshooting Return Codes and Error Messages](#bkmk-tscodeserrors) - -## USMT Return Codes - - -If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps. - -Return codes are grouped into the following broad categories that describe their area of error reporting: - -Success or User Cancel - -Invalid Command Lines - -Setup and Initialization - -Non-fatal Errors - -Fatal Errors - -As a best practice, we recommend that you set verbosity level to 5, **/v**:5, on the **ScanState**, **LoadState**, and **USMTUtils** command lines so that the most detailed reporting is available in the respective USMT logs. You can use a higher verbosity level if you want the log files output to go to a debugger. - -## USMT Error Messages - - -Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **USMTUtils** tool might return a code of "11” (for “USMT\_INVALID\_PARAMETERS") and a related error message that reads "/key and /keyfile both specified". The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **USMTUtils** log files to help you determine why the return code was received. - -You can obtain more information about any listed Windows application programming interface (API) system error codes by typing **net helpmsg** on the command line and, then typing the error code number. For more information about System Error Codes, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=147060). - -## Troubleshooting Return Codes and Error Messages - - -The following table lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Return code valueReturn codeError messageTroubleshooting, mitigation, workaroundsCategory

        0

        USMT_SUCCESS

        Successful run

        Not applicable

        Success or Cancel

        1

        USMT_DISPLAY_HELP

        Command line help requested

        Not applicable

        Success or Cancel

        2

        USMT_STATUS_CANCELED

        Gather was aborted because of an EFS file

        Not applicable

        User chose to cancel (such as pressing CTRL+C)

        Not applicable

        Success or Cancel

        3

        USMT_WOULD_HAVE_FAILED

        At least one error was skipped as a result of /c

        Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.

        11

        USMT_INVALID_PARAMETERS

        /all conflicts with /ui, /ue or /uel

        Review ScanState log or LoadState log for details about command-line errors.

        /auto expects an optional parameter for the script folder

        Review ScanState log or LoadState log for details about command-line errors.

        /encrypt can't be used with /nocompress

        Review ScanState log or LoadState log for details about command-line errors.

        /encrypt requires /key or /keyfile

        Review ScanState log or LoadState log for details about command-line errors.

        /genconfig can't be used with most other options

        Review ScanState log or LoadState log for details about command-line errors.

        /genmigxml can't be used with most other options

        Review ScanState log or LoadState log for details about command-line errors.

        /hardlink requires /nocompress

        Review ScanState log or LoadState log for details about command-line errors.

        /key and /keyfile both specified

        Review ScanState log or LoadState log for details about command-line errors.

        /key or /keyfile used without enabling encryption

        Review ScanState log or LoadState log for details about command-line errors.

        /lae is only used with /lac

        Review ScanState log or LoadState log for details about command-line errors.

        /listfiles cannot be used with /p

        Review ScanState log or LoadState log for details about command-line errors.

        /offline requires a valid path to an XML file describing offline paths

        Review ScanState log or LoadState log for details about command-line errors.

        /offlinewindir requires a valid path to offline windows folder

        Review ScanState log or LoadState log for details about command-line errors.

        /offlinewinold requires a valid path to offline windows folder

        Review ScanState log or LoadState log for details about command-line errors.

        A command was already specified

        Verify that the command-line syntax is correct and that there are no duplicate commands.

        An option argument is missing

        Review ScanState log or LoadState log for details about command-line errors.

        An option is specified more than once and is ambiguous

        Review ScanState log or LoadState log for details about command-line errors.

        By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.

        Review ScanState log or LoadState log for details about command-line errors.

        Command line arguments are required. Specify /? for options.

        Review ScanState log or LoadState log for details about command-line errors.

        Command line option is not valid

        Review ScanState log or LoadState log for details about command-line errors.

        EFS parameter specified is not valid for /efs

        Review ScanState log or LoadState log for details about command-line errors.

        File argument is invalid for /genconfig

        Review ScanState log or LoadState log for details about command-line errors.

        File argument is invalid for /genmigxml

        Review ScanState log or LoadState log for details about command-line errors.

        Invalid space estimate path. Check the parameters and/or file system permissions

        Review ScanState log or LoadState log for details about command-line errors.

        List file path argument is invalid for /listfiles

        Review ScanState log or LoadState log for details about command-line errors.

        Retry argument must be an integer

        Review ScanState log or LoadState log for details about command-line errors.

        Settings store argument specified is invalid

        Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

        Specified encryption algorithm is not supported

        Review ScanState log or LoadState log for details about command-line errors.

        The /efs:hardlink requires /hardlink

        Review ScanState log or LoadState log for details about command-line errors.

        The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7

        Review ScanState log or LoadState log for details about command-line errors.

        The store parameter is required but not specified

        Review ScanState log or LoadState log for details about command-line errors.

        The source-to-target domain mapping is invalid for /md

        Review ScanState log or LoadState log for details about command-line errors.

        The source-to-target user account mapping is invalid for /mu

        Review ScanState log or LoadState log for details about command-line errors.

        Undefined or incomplete command line option

        Review ScanState log or LoadState log for details about command-line errors.

        Invalid Command Lines

        Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate

        Review ScanState log or LoadState log for details about command-line errors.

        User exclusion argument is invalid

        Review ScanState log or LoadState log for details about command-line errors.

        Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)

        Review ScanState log or LoadState log for details about command-line errors.

        Volume shadow copy feature is not supported with a hardlink store

        Review ScanState log or LoadState log for details about command-line errors.

        Wait delay argument must be an integer

        Review ScanState log or LoadState log for details about command-line errors.

        12

        USMT_ERROR_OPTION_PARAM_TOO_LARGE

        Command line arguments cannot exceed 256 characters

        Review ScanState log or LoadState log for details about command-line errors.

        Invalid Command Lines

        Specified settings store path exceeds the maximum allowed length of 256 characters

        Review ScanState log or LoadState log for details about command-line errors.

        13

        USMT_INIT_LOGFILE_FAILED

        Log path argument is invalid for /l

        When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.

        Invalid Command Lines

        14

        USMT_ERROR_USE_LAC

        Unable to create a local account because /lac was not specified

        When creating local accounts, the command-line options /lac and /lae should be used.

        Invalid Command Lines

        26

        USMT_INIT_ERROR

        Multiple Windows installations found

        Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.

        Setup and Initialization

        Software malfunction or unknown exception

        Check all loaded .xml files for errors, common error when using /I to load the Config.xml file.

        Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries

        Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping.

        27

        USMT_INVALID_STORE_LOCATION

        A store path can't be used because an existing store exists; specify /o to overwrite

        Specify /o to overwrite an existing intermediate or migration store.

        Setup and Initialization

        A store path is missing or has incomplete data

        Make sure that the store path is accessible and that the proper permission levels are set.

        An error occurred during store creation

        Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

        An inappropriate device such as a floppy disk was specified for the store

        Make sure that the store path is accessible and that the proper permission levels are set.

        Invalid store path; check the store parameter and/or file system permissions

        Invalid store path; check the store parameter and/or file system permissions

        The file layout and/or file content is not recognized as a valid store

        Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

        The store path holds a store incompatible with the current USMT version

        Make sure that the store path is accessible and that the proper permission levels are set.

        The store save location is read-only or does not support a requested storage option

        Make sure that the store path is accessible and that the proper permission levels are set.

        28

        USMT_UNABLE_GET_SCRIPTFILES

        Script file is invalid for /i

        Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.

        Setup and Initialization

        Unable to find a script file specified by /i

        Verify the location of your script files, and ensure that the command-line options are correct.

        29

        USMT_FAILED_MIGSTARTUP

        A minimum of 250 MB of free space is required for temporary files

        Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable USMT_WORKING_DIR=<path> to redirect the temporary files working directory.

        Setup and Initialization

        Another process is preventing migration; only one migration tool can run at a time

        Check the ScanState log file for migration .xml file errors.

        Failed to start main processing, look in log for system errors or check the installation

        Check the ScanState log file for migration .xml file errors.

        Migration failed because of an XML error; look in the log for specific details

        Check the ScanState log file for migration .xml file errors.

        Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table

        Check the ScanState log file for migration .xml file errors.

        31

        USMT_UNABLE_FINDMIGUNITS

        An error occurred during the discover phase; the log should have more specific information

        Check the ScanState log file for migration .xml file errors.

        Setup and Initialization

        32

        USMT_FAILED_SETMIGRATIONTYPE

        An error occurred processing the migration system

        Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

        Setup and Initialization

        33

        USMT_UNABLE_READKEY

        Error accessing the file specified by the /keyfile parameter

        Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

        Setup and Initialization

        The encryption key must have at least one character

        Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

        34

        USMT_ERROR_INSUFFICIENT_RIGHTS

        Directory removal requires elevated privileges

        Log on as Administrator, and run with elevated privileges.

        Setup and Initialization

        No rights to create user profiles; log in as Administrator; run with elevated privileges

        Log on as Administrator, and run with elevated privileges.

        No rights to read or delete user profiles; log in as Administrator, run with elevated privileges

        Log on as Administrator, and run with elevated privileges.

        35

        USMT_UNABLE_DELETE_STORE

        A reboot is required to remove the store

        Reboot to delete any files that could not be deleted when the command was executed.

        Setup and Initialization

        A store path can't be used because it contains data that could not be overwritten

        A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use USMTUtils /rd command to delete the store.

        There was an error removing the store

        Review ScanState log or LoadState log for details about command-line errors.

        36

        USMT_ERROR_UNSUPPORTED_PLATFORM

        Compliance check failure; please check the logs for details

        Investigate whether there is an active temporary profile on the system.

        Setup and Initialization

        Use of /offline is not supported during apply

        The /offline command was not used while running in the Windows Preinstallation Environment (WinPE).

        Use /offline to run gather on this platform

        The /offline command was not used while running in WinPE.

        37

        USMT_ERROR_NO_INVALID_KEY

        The store holds encrypted data but the correct encryption key was not provided

        Verify that you have included the correct encryption /key or /keyfile.

        Setup and Initialization

        38

        USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE

        An error occurred during store access

        Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

        Setup and Initialization

        39

        USMT_UNABLE_TO_READ_CONFIG_FILE

        Error reading Config.xml

        Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.

        Setup and Initialization

        File argument is invalid for /config

        Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line.

        40

        USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG

        Error writing to the progress log

        The Progress log could not be created. Verify that the location is valid and that you have write access.

        Setup and Initialization

        Progress log argument is invalid for /progress

        The Progress log could not be created. Verify that the location is valid and that you have write access.

        41

        USMT_PREFLIGHT_FILE_CREATION_FAILED

        Can't overwrite existing file

        The Progress log could not be created. Verify that the location is valid and that you have write access.

        Setup and Initialization

        Invalid space estimate path. Check the parameters and/or file system permissions

        Review ScanState log or LoadState log for details about command-line errors.

        42

        USMT_ERROR_CORRUPTED_STORE

        The store contains one or more corrupted files

        Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see Extract Files from a Compressed USMT Migration Store.

        61

        USMT_MIGRATION_STOPPED_NONFATAL

        Processing stopped due to an I/O error

        USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.

        Non-fatal Errors

        71

        USMT_INIT_OPERATING_ENVIRONMENT_FAILED

        A Windows Win32 API error occurred

        Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

        Fatal Errors

        An error occurred when attempting to initialize the diagnostic mechanisms such as the log

        Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

        Failed to record diagnostic information

        Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

        Unable to start. Make sure you are running USMT with elevated privileges

        Exit USMT and log in again with elevated privileges.

        72

        USMT_UNABLE_DOMIGRATION

        An error occurred closing the store

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        Fatal Errors

        An error occurred in the apply process

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        An error occurred in the gather process

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        Out of disk space while writing the store

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        Out of temporary disk space on the local system

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        - - - -## Related topics - - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -[Log Files](usmt-log-files.md) - - - - - - - - - +--- +title: Return Codes (Windows 10) +description: Learn about User State Migration Tool (USMT) 10.0 return codes and error messages. Also view a list of USMT return codes and their associated migration steps. +ms.assetid: e71bbc6b-d5a6-4e48-ad01-af0012b35f22 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Return Codes + + +This topic describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this topic provides tips to help you use the logfiles to determine why you received an error. + +Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md). + +## In This Topic + + +[USMT Return Codes](#bkmk-returncodes) + +[USMT Error Messages](#bkmk-errormessages) + +[Troubleshooting Return Codes and Error Messages](#bkmk-tscodeserrors) + +## USMT Return Codes + + +If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps. + +Return codes are grouped into the following broad categories that describe their area of error reporting: + +Success or User Cancel + +Invalid Command Lines + +Setup and Initialization + +Non-fatal Errors + +Fatal Errors + +As a best practice, we recommend that you set verbosity level to 5, **/v**:5, on the **ScanState**, **LoadState**, and **USMTUtils** command lines so that the most detailed reporting is available in the respective USMT logs. You can use a higher verbosity level if you want the log files output to go to a debugger. + +## USMT Error Messages + + +Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **USMTUtils** tool might return a code of "11” (for “USMT\_INVALID\_PARAMETERS") and a related error message that reads "/key and /keyfile both specified". The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **USMTUtils** log files to help you determine why the return code was received. + +You can obtain more information about any listed Windows application programming interface (API) system error codes by typing **net helpmsg** on the command line and, then typing the error code number. For more information about System Error Codes, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=147060). + +## Troubleshooting Return Codes and Error Messages + + +The following table lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. + + +++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Return code valueReturn codeError messageTroubleshooting, mitigation, workaroundsCategory

        0

        USMT_SUCCESS

        Successful run

        Not applicable

        Success or Cancel

        1

        USMT_DISPLAY_HELP

        Command line help requested

        Not applicable

        Success or Cancel

        2

        USMT_STATUS_CANCELED

        Gather was aborted because of an EFS file

        Not applicable

        User chose to cancel (such as pressing CTRL+C)

        Not applicable

        Success or Cancel

        3

        USMT_WOULD_HAVE_FAILED

        At least one error was skipped as a result of /c

        Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.

        11

        USMT_INVALID_PARAMETERS

        /all conflicts with /ui, /ue or /uel

        Review ScanState log or LoadState log for details about command-line errors.

        /auto expects an optional parameter for the script folder

        Review ScanState log or LoadState log for details about command-line errors.

        /encrypt can't be used with /nocompress

        Review ScanState log or LoadState log for details about command-line errors.

        /encrypt requires /key or /keyfile

        Review ScanState log or LoadState log for details about command-line errors.

        /genconfig can't be used with most other options

        Review ScanState log or LoadState log for details about command-line errors.

        /genmigxml can't be used with most other options

        Review ScanState log or LoadState log for details about command-line errors.

        /hardlink requires /nocompress

        Review ScanState log or LoadState log for details about command-line errors.

        /key and /keyfile both specified

        Review ScanState log or LoadState log for details about command-line errors.

        /key or /keyfile used without enabling encryption

        Review ScanState log or LoadState log for details about command-line errors.

        /lae is only used with /lac

        Review ScanState log or LoadState log for details about command-line errors.

        /listfiles cannot be used with /p

        Review ScanState log or LoadState log for details about command-line errors.

        /offline requires a valid path to an XML file describing offline paths

        Review ScanState log or LoadState log for details about command-line errors.

        /offlinewindir requires a valid path to offline windows folder

        Review ScanState log or LoadState log for details about command-line errors.

        /offlinewinold requires a valid path to offline windows folder

        Review ScanState log or LoadState log for details about command-line errors.

        A command was already specified

        Verify that the command-line syntax is correct and that there are no duplicate commands.

        An option argument is missing

        Review ScanState log or LoadState log for details about command-line errors.

        An option is specified more than once and is ambiguous

        Review ScanState log or LoadState log for details about command-line errors.

        By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.

        Review ScanState log or LoadState log for details about command-line errors.

        Command line arguments are required. Specify /? for options.

        Review ScanState log or LoadState log for details about command-line errors.

        Command line option is not valid

        Review ScanState log or LoadState log for details about command-line errors.

        EFS parameter specified is not valid for /efs

        Review ScanState log or LoadState log for details about command-line errors.

        File argument is invalid for /genconfig

        Review ScanState log or LoadState log for details about command-line errors.

        File argument is invalid for /genmigxml

        Review ScanState log or LoadState log for details about command-line errors.

        Invalid space estimate path. Check the parameters and/or file system permissions

        Review ScanState log or LoadState log for details about command-line errors.

        List file path argument is invalid for /listfiles

        Review ScanState log or LoadState log for details about command-line errors.

        Retry argument must be an integer

        Review ScanState log or LoadState log for details about command-line errors.

        Settings store argument specified is invalid

        Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

        Specified encryption algorithm is not supported

        Review ScanState log or LoadState log for details about command-line errors.

        The /efs:hardlink requires /hardlink

        Review ScanState log or LoadState log for details about command-line errors.

        The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7

        Review ScanState log or LoadState log for details about command-line errors.

        The store parameter is required but not specified

        Review ScanState log or LoadState log for details about command-line errors.

        The source-to-target domain mapping is invalid for /md

        Review ScanState log or LoadState log for details about command-line errors.

        The source-to-target user account mapping is invalid for /mu

        Review ScanState log or LoadState log for details about command-line errors.

        Undefined or incomplete command line option

        Review ScanState log or LoadState log for details about command-line errors.

        Invalid Command Lines

        Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate

        Review ScanState log or LoadState log for details about command-line errors.

        User exclusion argument is invalid

        Review ScanState log or LoadState log for details about command-line errors.

        Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)

        Review ScanState log or LoadState log for details about command-line errors.

        Volume shadow copy feature is not supported with a hardlink store

        Review ScanState log or LoadState log for details about command-line errors.

        Wait delay argument must be an integer

        Review ScanState log or LoadState log for details about command-line errors.

        12

        USMT_ERROR_OPTION_PARAM_TOO_LARGE

        Command line arguments cannot exceed 256 characters

        Review ScanState log or LoadState log for details about command-line errors.

        Invalid Command Lines

        Specified settings store path exceeds the maximum allowed length of 256 characters

        Review ScanState log or LoadState log for details about command-line errors.

        13

        USMT_INIT_LOGFILE_FAILED

        Log path argument is invalid for /l

        When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.

        Invalid Command Lines

        14

        USMT_ERROR_USE_LAC

        Unable to create a local account because /lac was not specified

        When creating local accounts, the command-line options /lac and /lae should be used.

        Invalid Command Lines

        26

        USMT_INIT_ERROR

        Multiple Windows installations found

        Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.

        Setup and Initialization

        Software malfunction or unknown exception

        Check all loaded .xml files for errors, common error when using /I to load the Config.xml file.

        Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries

        Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping.

        27

        USMT_INVALID_STORE_LOCATION

        A store path can't be used because an existing store exists; specify /o to overwrite

        Specify /o to overwrite an existing intermediate or migration store.

        Setup and Initialization

        A store path is missing or has incomplete data

        Make sure that the store path is accessible and that the proper permission levels are set.

        An error occurred during store creation

        Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

        An inappropriate device such as a floppy disk was specified for the store

        Make sure that the store path is accessible and that the proper permission levels are set.

        Invalid store path; check the store parameter and/or file system permissions

        Invalid store path; check the store parameter and/or file system permissions

        The file layout and/or file content is not recognized as a valid store

        Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

        The store path holds a store incompatible with the current USMT version

        Make sure that the store path is accessible and that the proper permission levels are set.

        The store save location is read-only or does not support a requested storage option

        Make sure that the store path is accessible and that the proper permission levels are set.

        28

        USMT_UNABLE_GET_SCRIPTFILES

        Script file is invalid for /i

        Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.

        Setup and Initialization

        Unable to find a script file specified by /i

        Verify the location of your script files, and ensure that the command-line options are correct.

        29

        USMT_FAILED_MIGSTARTUP

        A minimum of 250 MB of free space is required for temporary files

        Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable USMT_WORKING_DIR=<path> to redirect the temporary files working directory.

        Setup and Initialization

        Another process is preventing migration; only one migration tool can run at a time

        Check the ScanState log file for migration .xml file errors.

        Failed to start main processing, look in log for system errors or check the installation

        Check the ScanState log file for migration .xml file errors.

        Migration failed because of an XML error; look in the log for specific details

        Check the ScanState log file for migration .xml file errors.

        Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table

        Check the ScanState log file for migration .xml file errors.

        31

        USMT_UNABLE_FINDMIGUNITS

        An error occurred during the discover phase; the log should have more specific information

        Check the ScanState log file for migration .xml file errors.

        Setup and Initialization

        32

        USMT_FAILED_SETMIGRATIONTYPE

        An error occurred processing the migration system

        Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

        Setup and Initialization

        33

        USMT_UNABLE_READKEY

        Error accessing the file specified by the /keyfile parameter

        Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

        Setup and Initialization

        The encryption key must have at least one character

        Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

        34

        USMT_ERROR_INSUFFICIENT_RIGHTS

        Directory removal requires elevated privileges

        Log on as Administrator, and run with elevated privileges.

        Setup and Initialization

        No rights to create user profiles; log in as Administrator; run with elevated privileges

        Log on as Administrator, and run with elevated privileges.

        No rights to read or delete user profiles; log in as Administrator, run with elevated privileges

        Log on as Administrator, and run with elevated privileges.

        35

        USMT_UNABLE_DELETE_STORE

        A reboot is required to remove the store

        Reboot to delete any files that could not be deleted when the command was executed.

        Setup and Initialization

        A store path can't be used because it contains data that could not be overwritten

        A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use USMTUtils /rd command to delete the store.

        There was an error removing the store

        Review ScanState log or LoadState log for details about command-line errors.

        36

        USMT_ERROR_UNSUPPORTED_PLATFORM

        Compliance check failure; please check the logs for details

        Investigate whether there is an active temporary profile on the system.

        Setup and Initialization

        Use of /offline is not supported during apply

        The /offline command was not used while running in the Windows Preinstallation Environment (WinPE).

        Use /offline to run gather on this platform

        The /offline command was not used while running in WinPE.

        37

        USMT_ERROR_NO_INVALID_KEY

        The store holds encrypted data but the correct encryption key was not provided

        Verify that you have included the correct encryption /key or /keyfile.

        Setup and Initialization

        38

        USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE

        An error occurred during store access

        Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

        Setup and Initialization

        39

        USMT_UNABLE_TO_READ_CONFIG_FILE

        Error reading Config.xml

        Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.

        Setup and Initialization

        File argument is invalid for /config

        Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line.

        40

        USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG

        Error writing to the progress log

        The Progress log could not be created. Verify that the location is valid and that you have write access.

        Setup and Initialization

        Progress log argument is invalid for /progress

        The Progress log could not be created. Verify that the location is valid and that you have write access.

        41

        USMT_PREFLIGHT_FILE_CREATION_FAILED

        Can't overwrite existing file

        The Progress log could not be created. Verify that the location is valid and that you have write access.

        Setup and Initialization

        Invalid space estimate path. Check the parameters and/or file system permissions

        Review ScanState log or LoadState log for details about command-line errors.

        42

        USMT_ERROR_CORRUPTED_STORE

        The store contains one or more corrupted files

        Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see Extract Files from a Compressed USMT Migration Store.

        61

        USMT_MIGRATION_STOPPED_NONFATAL

        Processing stopped due to an I/O error

        USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.

        Non-fatal Errors

        71

        USMT_INIT_OPERATING_ENVIRONMENT_FAILED

        A Windows Win32 API error occurred

        Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

        Fatal Errors

        An error occurred when attempting to initialize the diagnostic mechanisms such as the log

        Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

        Failed to record diagnostic information

        Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

        Unable to start. Make sure you are running USMT with elevated privileges

        Exit USMT and log in again with elevated privileges.

        72

        USMT_UNABLE_DOMIGRATION

        An error occurred closing the store

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        Fatal Errors

        An error occurred in the apply process

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        An error occurred in the gather process

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        Out of disk space while writing the store

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        Out of temporary disk space on the local system

        Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

        + + + +## Related topics + + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + +[Log Files](usmt-log-files.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md index 83afe8628b..95c2a5e5ba 100644 --- a/windows/deployment/usmt/usmt-scanstate-syntax.md +++ b/windows/deployment/usmt/usmt-scanstate-syntax.md @@ -1,873 +1,862 @@ ---- -title: ScanState Syntax (Windows 10) -description: ScanState Syntax -ms.assetid: 004c755f-33db-49e4-8a3b-37beec1480ea -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# ScanState Syntax - - -The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. - -## In This Topic - - -[Before You Begin](#bkmk-beforeyoubegin) - -[Syntax](#bkmk-syntax) - -[Storage Options](#bkmk-storageoptions) - -[Migration Rule Options](#bkmk-migrationruleoptions) - -[Monitoring Options](#bkmk-monitoringoptions) - -[User Options](#bkmk-useroptions) - -[Encrypted File Options](#bkmk-efs) - -[Incompatible Command-Line Options](#bkmk-iclo) - -## Before You Begin - - -Before you run the **ScanState** command, note the following: - -- To ensure that all operating system settings migrate, in most cases you must run the **ScanState** commands in administrator mode from an account with administrative credentials. - -- If you encrypt the migration store, you will be required to enter an encryption key or a path to a file containing the encryption key. Be sure to make note of the key or the key file location, because this information is not kept anywhere in the migration store. You will need this information when you run the LoadState command to decrypt the migration store, or if you need to run the recovery utility. An incorrect or missing key or key file results in an error message. - -- For information about software requirements for running the **ScanState** command, see [USMT Requirements](usmt-requirements.md). - -- Unless otherwise noted, you can use each option only once when running a tool on the command line. - -- You can gather domain accounts without the source computer having domain controller access. This functionality is available without any additional configuration. - -- The [Incompatible Command-Line Options](#bkmk-iclo) table lists which options you can use together and which command-line options are incompatible. - -- The directory location where you save the migration store will be excluded from the scan. For example, if you save the migration store to the root of the D drive, the D drive and all of its subdirectories will be excluded from the scan. - -## Syntax - - -This section explains the syntax and usage of the **ScanState** command-line options. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator. - -The **ScanState** command's syntax is: - -scanstate \[*StorePath*\] \[/apps\] \[/ppkg:*FileName*\] \[/i:\[*Path*\\\]*FileName*\] \[/o\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/localonly\] \[/encrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsBeforeRetry*\] \[/c\] \[/p\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/efs:abort|skip|decryptcopy|copyraw\] \[/genconfig:\[*Path*\\\]*FileName*\[/config:\[*Path*\\\]*FileName*\] \[/?|help\] - -For example: - -To create a Config.xml file in the current directory, use: - -`scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13` - -To create an encrypted store using the Config.xml file and the default migration .xml files, use: - -`scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:13 /encrypt /key:"mykey"` - -## Storage Options - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-Line OptionDescription

        StorePath

        Indicates a folder where files and settings will be saved. Note that StorePath cannot be C:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.

        /apps

        Scans the image for apps and includes them and their associated registry settings.

        /ppkg [<FileName>]

        Exports to a specific file location.

        /o

        Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the ScanState command will fail if the migration store already contains data. You cannot use this option more than once on a command line.

        /vsc

        This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the <ErrorControl> section.

        -

        This option can be used only with the ScanState executable file and cannot be combined with the /hardlink option.

        /hardlink

        Enables the creation of a hard-link migration store at the specified location. The /nocompress option must be specified with the /hardlink option.

        /encrypt [{/key:<KeyString> | /keyfile:<file>]}

        Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key in one of the following ways:

        -
          -
        • /key:KeyString specifies the encryption key. If there is a space in KeyString, you will need to surround KeyString with quotation marks.

        • -
        • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key.

        • -
        -

        We recommend that KeyString be at least eight characters long, but it cannot exceed 256 characters. The /key and /keyfile options cannot be used on the same command line. The /encrypt and /nocompress options cannot be used on the same command line.

        -
        -Important

        You should use caution with this option, because anyone who has access to the ScanState command-line script will also have access to the encryption key.

        -
        -
        - -
        -

        The following example shows the ScanState command and the /key option:

        -

        scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /encrypt /key:mykey

        /encrypt:<EncryptionStrength>

        The /encrypt option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see Migration Store Encryption.

        /nocompress

        Disables compression of data and saves the files to a hidden folder named "File" at StorePath\USMT. Compression is enabled by default. Combining the /nocompress option with the /hardlink option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the /nocompress option with the /hardlink option.

        -

        The /nocompress and /encrypt options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the LoadState command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

        -

        For example:

        -

        scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /nocompress

        - - - -## Run the ScanState Command on an Offline Windows System - - -You can run the **ScanState** command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the **ScanState** command in WinPE or a Windows.old directory when you run the **ScanState** command in Windows. - -There are several benefits to running the **ScanState** command on an offline Windows image, including: - -- **Improved Performance.** - - Because WinPE is a thin operating system, there are fewer running services. In this environment, the **ScanState** command has more access to the local hardware resources, enabling **ScanState** to perform migration operations more quickly. - -- **Simplified end to end deployment process.** - - Migrating data from Windows.old simplifies the end-to-end deployment process by enabling the migration process to occur after the new operating system is installed. - -- **Improved success of migration.** - - The migration success rate is increased because files will not be locked for editing while offline, and because WinPE provides administrator access to files in the offline Windows file system, eliminating the need for administrator-level access to the online system. - -- **Ability to recover an unbootable computer.** - - It might be possible to recover and migrate data from an unbootable computer. - -## Offline Migration Options - - - ---- - - - - - - - - - - - - - - - - - - - - -
        Command-Line OptionDefinition

        /offline:"path to an offline.xml file"

        This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.

        /offlinewindir:"path to a Windows directory"

        This option specifies the offline Windows directory that the ScanState command gathers user state from. The offline directory can be Windows.old when you run the ScanState command in Windows or a Windows directory when you run the ScanState command in WinPE.

        /offlinewinold:"Windows.old directory"

        This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

        - - - -## Migration Rule Options - - -USMT provides the following options to specify what files you want to migrate. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-Line OptionDescription

        /i:[Path]FileName

        (include)

        -

        Specifies an .xml file that contains rules that define what user, application or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the Frequently Asked Questions topic.

        /genconfig:[Path]FileName

        (Generate Config.xml)

        -

        Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the /i option, when you specify this option.

        -

        After you create this file, you will need to make use of it with the ScanState command using the /config option.

        -

        The only options that you can specify with this option are the /i, /v, and /l options. You cannot specify StorePath, because the /genconfig option does not create a store. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

        -

        Examples:

        -
          -
        • The following example creates a Config.xml file in the current directory:

          -

          scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13

        • -

        /config:[Path</em>]FileName

        Specifies the Config.xml file that the ScanState command should use to create the store. You cannot use this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

        -

        The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:

        -

        scanstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log

        -

        The following example migrates the files and settings to the destination computer using the Config.xml, MigDocs.xml, and MigApp.xml files:

        -

        loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log

        /auto:path to script files

        This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

        /genmigxml:path to a file

        This option specifies that the ScanState command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the ScanState command is running.

        /targetwindows8

        Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command line option in the following scenarios:

        -
          -
        • To create a Config.xml file by using the /genconfig option. Using the /targetwindows8 option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.

        • -
        • To create a migration store. Using the /targetwindows8 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows8 command-line option, some settings can be lost during the migration.

        • -

        /targetwindows7

        Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command line option in the following scenarios:

        -
          -
        • To create a Config.xml file by using the /genconfig option. Using the /targetwindows7 option optimizes the Config.xml file so that it only contains components that relate to Windows 7.

        • -
        • To create a migration store. Using the /targetwindows7 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows7 command-line option, some settings can be lost during the migration.

        • -

        /localonly

        Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the /localonly option is not specified, then the ScanState command will copy files from these removable or network drives into the store.

        -

        Anything that is not considered a fixed drive by the OS will be excluded by /localonly. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see Exclude Files and Settings.

        -

        The /localonly command-line option includes or excludes data in the migration as identified in the following table:

        - ---- - - - - - - - - - - - - - - - - - - - - -
        Drive typeBehavior with /localonly

        Removable drives such as a USB flash drive

        Excluded

        Network drives

        Excluded

        Fixed drives

        Included

        -

        - - - -## Monitoring Options - - -USMT provides several options that you can use to analyze problems that occur during migration. - -**Note** -The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option. - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-Line OptionDescription

        /listfiles:<FileName>

        You can use the /listfiles command-line option with the ScanState command to generate a text file that lists all of the files included in the migration.

        /l:[Path]FileName

        Specifies the location and name of the ScanState log.

        -

        You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can use the /v option to adjust the amount of output.

        -

        If you run the ScanState or LoadState commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:scan.log command.

        /v:<VerbosityLevel>

        (Verbosity)

        -

        Enables verbose output in the ScanState log file. The default value is 0.

        -

        You can set the VerbosityLevel to one of the following levels:

        - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        LevelExplanation

        0

        Only the default errors and warnings are enabled.

        1

        Enables verbose output.

        4

        Enables error and status output.

        5

        Enables verbose and status output.

        8

        Enables error output to a debugger.

        9

        Enables verbose output to a debugger.

        12

        Enables error and status output to a debugger.

        13

        Enables verbose, status, and debugger output.

        -

        -

        For example:

        -

        scanstate \server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml

        -

        /progress:[Path</em>]FileName

        Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

        -

        For example:

        -

        scanstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log

        /c

        When this option is specified, the ScanState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the ScanState command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the /c option, the ScanState command will exit on the first error.

        -

        You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

        /r:<TimesToRetry>

        (Retry)

        -

        Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

        -

        While storing the user state, the /r option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

        /w:<SecondsBeforeRetry>

        (Wait)

        -

        Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

        /p:<pathToFile>

        When the ScanState command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:

        -

        Scanstate.exe C:\MigrationLocation [additional parameters]

        -

        /p:"C:\MigrationStoreSize.xml"

        -

        For more information, see Estimate Migration Store Size.

        -

        To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the /p option, without specifying "pathtoafile", in USMT. If you specify only the /p option, the storage space estimations are created in the same manner as with USMT3.x releases.

        /? or /help

        Displays Help at the command line.

        - - - -## User Options - - -By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md) and [Migrate User Accounts](usmt-migrate-user-accounts.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-Line OptionDescription

        /all

        Migrates all of the users on the computer.

        -

        USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.

        /ui:<DomainName>\<UserName>

        -

        or

        -

        /ui:<ComputerName>\<LocalUserName>

        (User include)

        -

        Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

        -
        -Note

        If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

        -
        -
        - -
        -

        For example:

        -
          -

          To include only User2 from the Fabrikam domain, type:

          -

          /ue:*\* /ui:fabrikam\user2

          -

          To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:

          -

          /uel:30 /ui:fabrikam\*

          -

          In this example, a user account from the Contoso domain that was last modified 2 months ago will not be migrated.

          -
        -

        For more examples, see the descriptions of the /ue and /ui options in this table.

        /uel:<NumberOfDays>

        -

        or

        -

        /uel:<YYYY/MM/DD>

        -

        or

        -

        /uel:0

        (User exclude based on last logon)

        -

        Migrates the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.

        -

        You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

        -
        -Note

        The /uel option is not valid in offline migrations.

        -
        -
        - -
        -
          -
        • /uel:0 migrates any users who are currently logged on.

        • -
        • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

        • -
        • /uel:1 migrates users whose account has been modified within the last 24 hours.

        • -
        • /uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.

        • -
        -

        For example:

        -

        scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0

        /ue:<DomainName>\<UserName>

        -

        -or-

        -

        -

        /ue:<ComputerName>\<LocalUserName>

        (User exclude)

        -

        Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.

        -

        For example:

        -

        scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1

        - - - -## How to Use /ui and /ue - - -The following examples apply to both the /**ui** and /**ue** options. You can replace the /**ue** option with the /**ui** option to include, rather than exclude, the specified users. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        BehaviorCommand

        Exclude the user named User One in the Fabrikam domain.

        /ue:"fabrikam\user one"

        Exclude the user named User1 in the Fabrikam domain.

        /ue:fabrikam\user1

        Exclude the local user named User1.

        /ue:%computername%\user1

        Exclude all domain users.

        /ue:Domain\*

        Exclude all local users.

        /ue:%computername%\*

        Exclude users in all domains named User1, User2, and so on.

        /ue:*\user*

        - - - -## Using the Options Together - - -You can use the /**uel**, /**ue** and /**ui** options together to migrate only the users that you want migrated. - -The /**ui** option has precedence over the /**ue** and /**uel** options. If a user is specified to be included using the /**ui** option, and also specified to be excluded using either the /**ue** or /**uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the /**ui** option takes precedence over the /**ue** option. - -The /**uel** option takes precedence over the /**ue** option. If a user has logged on within the specified time period set by the /**uel** option, that user’s profile will be migrated even if they are excluded by using the /**ue** option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
        BehaviorCommand

        Include only User2 from the Fabrikam domain and exclude all other users.

        /ue:*\* /ui:fabrikam\user2

        Include only the local user named User1 and exclude all other users.

        /ue:*\* /ui:user1

        Include only the domain users from Contoso, except Contoso\User1.

        This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

        -
          -
        • On the ScanState command line, type: /ue:*\* /ui:contoso\*

        • -
        • On the LoadState command line, type: /ue:contoso\user1

        • -

        Include only local (non-domain) users.

        /ue:*\* /ui:%computername%\*

        - - - -## Encrypted File Options - - -You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an /**efs** option. To migrate encrypted files, you must change the default behavior. - -For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). - -**Note** -EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files - - - -**Caution** -Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. - - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-Line OptionExplanation

        /efs:hardlink

        Creates a hard link to the EFS file instead of copying it. Use only with the /hardlink and the /nocompress options.

        /efs:abort

        Causes the ScanState command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default.

        /efs:skip

        Causes the ScanState command to ignore EFS files.

        /efs:decryptcopy

        Causes the ScanState command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the ScanState command succeeds, the file will be unencrypted in the migration store, and once you run the LoadState command, the file will be copied to the destination computer.

        /efs:copyraw

        Causes the ScanState command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an /efs option. Therefore you should specify the /efs:copyraw option with the ScanState command to migrate the encrypted file. Then, when you run the LoadState command, the encrypted file and the EFS certificate will be automatically migrated.

        -

        For example:

        -

        ScanState /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /efs:copyraw

        -
        -Important

        All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see Migrate EFS Files and Certificates.

        -
        -
        - -
        - - - -## Incompatible Command-Line Options - - -The following table indicates which command-line options are not compatible with the **ScanState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-Line Option/keyfile/nocompress/genconfig/all

        /i

        /o

        /v

        /nocompress

        X

        N/A

        /localonly

        X

        /key

        X

        X

        /encrypt

        Required*

        X

        X

        /keyfile

        N/A

        X

        /l

        /progress

        X

        /r

        X

        /w

        X

        /c

        X

        /p

        X

        N/A

        /all

        X

        /ui

        X

        X

        /ue

        X

        X

        /uel

        X

        X

        /efs:<option>

        X

        /genconfig

        N/A

        /config

        X

        <StorePath>

        X

        - - - -**Note** -You must specify either the /**key** or /**keyfile** option with the /**encrypt** option. - - - -## Related topics - - -[XML Elements Library](usmt-xml-elements-library.md) - - - - - - - - - +--- +title: ScanState Syntax (Windows 10) +description: The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. +ms.assetid: 004c755f-33db-49e4-8a3b-37beec1480ea +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# ScanState Syntax + + +The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. + +## In This Topic + + +[Before You Begin](#bkmk-beforeyoubegin) + +[Syntax](#bkmk-syntax) + +[Storage Options](#bkmk-storageoptions) + +[Migration Rule Options](#bkmk-migrationruleoptions) + +[Monitoring Options](#bkmk-monitoringoptions) + +[User Options](#bkmk-useroptions) + +[Encrypted File Options](#bkmk-efs) + +[Incompatible Command-Line Options](#bkmk-iclo) + +## Before You Begin + + +Before you run the **ScanState** command, note the following: + +- To ensure that all operating system settings migrate, in most cases you must run the **ScanState** commands in administrator mode from an account with administrative credentials. + +- If you encrypt the migration store, you will be required to enter an encryption key or a path to a file containing the encryption key. Be sure to make note of the key or the key file location, because this information is not kept anywhere in the migration store. You will need this information when you run the LoadState command to decrypt the migration store, or if you need to run the recovery utility. An incorrect or missing key or key file results in an error message. + +- For information about software requirements for running the **ScanState** command, see [USMT Requirements](usmt-requirements.md). + +- Unless otherwise noted, you can use each option only once when running a tool on the command line. + +- You can gather domain accounts without the source computer having domain controller access. This functionality is available without any additional configuration. + +- The [Incompatible Command-Line Options](#bkmk-iclo) table lists which options you can use together and which command-line options are incompatible. + +- The directory location where you save the migration store will be excluded from the scan. For example, if you save the migration store to the root of the D drive, the D drive and all of its subdirectories will be excluded from the scan. + +## Syntax + + +This section explains the syntax and usage of the **ScanState** command-line options. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator. + +The **ScanState** command's syntax is: + +> scanstate \[*StorePath*\] \[/apps\] \[/ppkg:*FileName*\] \[/i:\[*Path*\\\]*FileName*\] \[/o\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/localonly\] \[/encrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsBeforeRetry*\] \[/c\] \[/p\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/efs:abort|skip|decryptcopy|copyraw\] \[/genconfig:\[*Path*\\\]*FileName*\[/config:\[*Path*\\\]*FileName*\] \[/?|help\] + +For example, to create a Config.xml file in the current directory, use: + +`scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13` + +To create an encrypted store using the Config.xml file and the default migration .xml files, use: + +`scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:13 /encrypt /key:"mykey"` + +## Storage Options + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-Line OptionDescription

        StorePath

        Indicates a folder where files and settings will be saved. Note that StorePath cannot be C:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.

        /apps

        Scans the image for apps and includes them and their associated registry settings.

        /ppkg [<FileName>]

        Exports to a specific file location.

        /o

        Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the ScanState command will fail if the migration store already contains data. You cannot use this option more than once on a command line.

        /vsc

        This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the <ErrorControl> section.

        +

        This option can be used only with the ScanState executable file and cannot be combined with the /hardlink option.

        /hardlink

        Enables the creation of a hard-link migration store at the specified location. The /nocompress option must be specified with the /hardlink option.

        /encrypt [{/key:<KeyString> | /keyfile:<file>]}

        Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key in one of the following ways:

        +
          +
        • /key:KeyString specifies the encryption key. If there is a space in KeyString, you will need to surround KeyString with quotation marks.

        • +
        • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key.

        • +
        +

        We recommend that KeyString be at least eight characters long, but it cannot exceed 256 characters. The /key and /keyfile options cannot be used on the same command line. The /encrypt and /nocompress options cannot be used on the same command line.

        +
        +Important

        You should use caution with this option, because anyone who has access to the ScanState command-line script will also have access to the encryption key.

        +
        +
        + +
        +

        The following example shows the ScanState command and the /key option:

        +

        scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /encrypt /key:mykey

        /encrypt:<EncryptionStrength>

        The /encrypt option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see Migration Store Encryption.

        /nocompress

        Disables compression of data and saves the files to a hidden folder named "File" at StorePath\USMT. Compression is enabled by default. Combining the /nocompress option with the /hardlink option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the /nocompress option with the /hardlink option.

        +

        The /nocompress and /encrypt options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the LoadState command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

        +

        For example:

        +

        scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /nocompress

        + + + +## Run the ScanState Command on an Offline Windows System + + +You can run the **ScanState** command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the **ScanState** command in WinPE or a Windows.old directory when you run the **ScanState** command in Windows. + +There are several benefits to running the **ScanState** command on an offline Windows image, including: + +- **Improved Performance.** + + Because WinPE is a thin operating system, there are fewer running services. In this environment, the **ScanState** command has more access to the local hardware resources, enabling **ScanState** to perform migration operations more quickly. + +- **Simplified end to end deployment process.** + + Migrating data from Windows.old simplifies the end-to-end deployment process by enabling the migration process to occur after the new operating system is installed. + +- **Improved success of migration.** + + The migration success rate is increased because files will not be locked for editing while offline, and because WinPE provides administrator access to files in the offline Windows file system, eliminating the need for administrator-level access to the online system. + +- **Ability to recover an unbootable computer.** + + It might be possible to recover and migrate data from an unbootable computer. + +## Offline Migration Options + + + ++++ + + + + + + + + + + + + + + + + + + + + +
        Command-Line OptionDefinition

        /offline:"path to an offline.xml file"

        This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.

        /offlinewindir:"path to a Windows directory"

        This option specifies the offline Windows directory that the ScanState command gathers user state from. The offline directory can be Windows.old when you run the ScanState command in Windows or a Windows directory when you run the ScanState command in WinPE.

        /offlinewinold:"Windows.old directory"

        This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

        + + + +## Migration Rule Options + + +USMT provides the following options to specify what files you want to migrate. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-Line OptionDescription

        /i:[Path]FileName

        (include)

        +

        Specifies an .xml file that contains rules that define what user, application or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the Frequently Asked Questions topic.

        /genconfig:[Path]FileName

        (Generate Config.xml)

        +

        Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the /i option, when you specify this option.

        +

        After you create this file, you will need to make use of it with the ScanState command using the /config option.

        +

        The only options that you can specify with this option are the /i, /v, and /l options. You cannot specify StorePath, because the /genconfig option does not create a store. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

        +

        Examples:

        +
          +
        • The following example creates a Config.xml file in the current directory:

          +

          scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13

        • +

        /config:[Path</em>]FileName

        Specifies the Config.xml file that the ScanState command should use to create the store. You cannot use this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

        +

        The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:

        +

        scanstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log

        +

        The following example migrates the files and settings to the destination computer using the Config.xml, MigDocs.xml, and MigApp.xml files:

        +

        loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log

        /auto:path to script files

        This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

        /genmigxml:path to a file

        This option specifies that the ScanState command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the ScanState command is running.

        /targetwindows8

        Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command line option in the following scenarios:

        +
          +
        • To create a Config.xml file by using the /genconfig option. Using the /targetwindows8 option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.

        • +
        • To create a migration store. Using the /targetwindows8 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows8 command-line option, some settings can be lost during the migration.

        • +

        /targetwindows7

        Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command line option in the following scenarios:

        +
          +
        • To create a Config.xml file by using the /genconfig option. Using the /targetwindows7 option optimizes the Config.xml file so that it only contains components that relate to Windows 7.

        • +
        • To create a migration store. Using the /targetwindows7 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows7 command-line option, some settings can be lost during the migration.

        • +

        /localonly

        Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the /localonly option is not specified, then the ScanState command will copy files from these removable or network drives into the store.

        +

        Anything that is not considered a fixed drive by the OS will be excluded by /localonly. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see Exclude Files and Settings.

        +

        The /localonly command-line option includes or excludes data in the migration as identified in the following table:

        + ++++ + + + + + + + + + + + + + + + + + + + + +
        Drive typeBehavior with /localonly

        Removable drives such as a USB flash drive

        Excluded

        Network drives

        Excluded

        Fixed drives

        Included

        +

        + + + +## Monitoring Options + + +USMT provides several options that you can use to analyze problems that occur during migration. + +> [!NOTE] +> The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option. + + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-Line OptionDescription

        /listfiles:<FileName>

        You can use the /listfiles command-line option with the ScanState command to generate a text file that lists all of the files included in the migration.

        /l:[Path]FileName

        Specifies the location and name of the ScanState log.

        +

        You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can use the /v option to adjust the amount of output.

        +

        If you run the ScanState or LoadState commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:scan.log command.

        /v:<VerbosityLevel>

        (Verbosity)

        +

        Enables verbose output in the ScanState log file. The default value is 0.

        +

        You can set the VerbosityLevel to one of the following levels:

        + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        LevelExplanation

        0

        Only the default errors and warnings are enabled.

        1

        Enables verbose output.

        4

        Enables error and status output.

        5

        Enables verbose and status output.

        8

        Enables error output to a debugger.

        9

        Enables verbose output to a debugger.

        12

        Enables error and status output to a debugger.

        13

        Enables verbose, status, and debugger output.

        +

        +

        For example:

        +

        scanstate \server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml

        +

        /progress:[Path</em>]FileName

        Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

        +

        For example:

        +

        scanstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log

        /c

        When this option is specified, the ScanState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the ScanState command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the /c option, the ScanState command will exit on the first error.

        +

        You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

        /r:<TimesToRetry>

        (Retry)

        +

        Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

        +

        While storing the user state, the /r option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

        /w:<SecondsBeforeRetry>

        (Wait)

        +

        Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

        /p:<pathToFile>

        When the ScanState command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:

        +

        Scanstate.exe C:\MigrationLocation [additional parameters]

        +

        /p:"C:\MigrationStoreSize.xml"

        +

        For more information, see Estimate Migration Store Size.

        +

        To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the /p option, without specifying "pathtoafile", in USMT. If you specify only the /p option, the storage space estimations are created in the same manner as with USMT3.x releases.

        /? or /help

        Displays Help at the command line.

        + + + +## User Options + + +By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md) and [Migrate User Accounts](usmt-migrate-user-accounts.md). + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-Line OptionDescription

        /all

        Migrates all of the users on the computer.

        +

        USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.

        /ui:<DomainName>\<UserName>

        +

        or

        +

        /ui:<ComputerName>\<LocalUserName>

        (User include)

        +

        Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

        +
        +Note

        If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

        +
        +
        + +
        +

        For example:

        +
          +

          To include only User2 from the Fabrikam domain, type:

          +

          /ue:*\* /ui:fabrikam\user2

          +

          To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:

          +

          /uel:30 /ui:fabrikam\*

          +

          In this example, a user account from the Contoso domain that was last modified 2 months ago will not be migrated.

          +
        +

        For more examples, see the descriptions of the /ue and /ui options in this table.

        /uel:<NumberOfDays>

        +

        or

        +

        /uel:<YYYY/MM/DD>

        +

        or

        +

        /uel:0

        (User exclude based on last logon)

        +

        Migrates the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.

        +

        You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

        +
        +Note

        The /uel option is not valid in offline migrations.

        +
        +
        + +
        +
          +
        • /uel:0 migrates any users who are currently logged on.

        • +
        • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

        • +
        • /uel:1 migrates users whose account has been modified within the last 24 hours.

        • +
        • /uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.

        • +
        +

        For example:

        +

        scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0

        /ue:<DomainName>\<UserName>

        +

        -or-

        +

        +

        /ue:<ComputerName>\<LocalUserName>

        (User exclude)

        +

        Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.

        +

        For example:

        +

        scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1

        + + + +## How to Use /ui and /ue + + +The following examples apply to both the /**ui** and /**ue** options. You can replace the /**ue** option with the /**ui** option to include, rather than exclude, the specified users. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        BehaviorCommand

        Exclude the user named User One in the Fabrikam domain.

        /ue:"fabrikam\user one"

        Exclude the user named User1 in the Fabrikam domain.

        /ue:fabrikam\user1

        Exclude the local user named User1.

        /ue:%computername%\user1

        Exclude all domain users.

        /ue:Domain\*

        Exclude all local users.

        /ue:%computername%\*

        Exclude users in all domains named User1, User2, and so on.

        /ue:*\user*

        + + + +## Using the Options Together + + +You can use the /**uel**, /**ue** and /**ui** options together to migrate only the users that you want migrated. + +The /**ui** option has precedence over the /**ue** and /**uel** options. If a user is specified to be included using the /**ui** option, and also specified to be excluded using either the /**ue** or /**uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the /**ui** option takes precedence over the /**ue** option. + +The /**uel** option takes precedence over the /**ue** option. If a user has logged on within the specified time period set by the /**uel** option, that user’s profile will be migrated even if they are excluded by using the /**ue** option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
        BehaviorCommand

        Include only User2 from the Fabrikam domain and exclude all other users.

        /ue:*\* /ui:fabrikam\user2

        Include only the local user named User1 and exclude all other users.

        /ue:*\* /ui:user1

        Include only the domain users from Contoso, except Contoso\User1.

        This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

        +
          +
        • On the ScanState command line, type: /ue:*\* /ui:contoso\*

        • +
        • On the LoadState command line, type: /ue:contoso\user1

        • +

        Include only local (non-domain) users.

        /ue:*\* /ui:%computername%\*

        + + + +## Encrypted File Options + + +You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an /**efs** option. To migrate encrypted files, you must change the default behavior. + +For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). + +> [!NOTE] +> EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files + + +> [!CAUTION] +> Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. + + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-Line OptionExplanation

        /efs:hardlink

        Creates a hard link to the EFS file instead of copying it. Use only with the /hardlink and the /nocompress options.

        /efs:abort

        Causes the ScanState command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default.

        /efs:skip

        Causes the ScanState command to ignore EFS files.

        /efs:decryptcopy

        Causes the ScanState command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the ScanState command succeeds, the file will be unencrypted in the migration store, and once you run the LoadState command, the file will be copied to the destination computer.

        /efs:copyraw

        Causes the ScanState command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an /efs option. Therefore you should specify the /efs:copyraw option with the ScanState command to migrate the encrypted file. Then, when you run the LoadState command, the encrypted file and the EFS certificate will be automatically migrated.

        +

        For example:

        +

        ScanState /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /efs:copyraw

        +
        +Important

        All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see Migrate EFS Files and Certificates.

        +
        +
        + +
        + + + +## Incompatible Command-Line Options + + +The following table indicates which command-line options are not compatible with the **ScanState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. + + +++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-Line Option/keyfile/nocompress/genconfig/all

        /i

        /o

        /v

        /nocompress

        N/A

        /localonly

        X

        /key

        X

        X

        /encrypt

        Required*

        X

        X

        /keyfile

        N/A

        X

        /l

        /progress

        X

        /r

        X

        /w

        X

        /c

        X

        /p

        X

        N/A

        /all

        X

        /ui

        X

        X

        /ue

        X

        X

        /uel

        X

        X

        /efs:<option>

        X

        /genconfig

        N/A

        /config

        X

        <StorePath>

        X

        + + +> [!NOTE] +> You must specify either the /**key** or /**keyfile** option with the /**encrypt** option. + + + +## Related topics + + +[XML Elements Library](usmt-xml-elements-library.md) + diff --git a/windows/deployment/usmt/usmt-technical-reference.md b/windows/deployment/usmt/usmt-technical-reference.md index 74dbc40088..3c31b7bf4b 100644 --- a/windows/deployment/usmt/usmt-technical-reference.md +++ b/windows/deployment/usmt/usmt-technical-reference.md @@ -12,6 +12,7 @@ audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article +ms.custom: seo-marvel-apr2020 --- # User State Migration Tool (USMT) Technical Reference @@ -37,12 +38,12 @@ USMT also includes a set of three modifiable .xml files: Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. -USMT tools can be used on several versions of Windows operating systems, for more information, see [USMT Requirements](usmt-requirements.md). For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564). +USMT tools can be used on several versions of Windows operating systems, for more information, see [USMT Requirements](usmt-requirements.md). For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User's Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564). -## In This Section +## In this section |Topic |Description| |------|-----------| -|[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)|Describes what’s new in USMT, how to get started with USMT, and the benefits and limitations of using USMT.| +|[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)|Describes what's new in USMT, how to get started with USMT, and the benefits and limitations of using USMT.| |[User State Migration Tool (USMT) How-to topics](usmt-how-to.md)|Includes step-by-step instructions for using USMT, as well as how-to topics for conducting tasks in USMT.| |[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md)|Provides answers to frequently asked questions and common issues in USMT, as well as a reference for return codes used in USMT.| |[User State Migration Toolkit (USMT) Reference](usmt-reference.md)|Includes reference information for migration planning, migration best practices, command-line syntax, using XML, and requirements for using USMT.| diff --git a/windows/deployment/usmt/usmt-test-your-migration.md b/windows/deployment/usmt/usmt-test-your-migration.md index 183f7bc16e..b3ec645a60 100644 --- a/windows/deployment/usmt/usmt-test-your-migration.md +++ b/windows/deployment/usmt/usmt-test-your-migration.md @@ -1,6 +1,6 @@ --- title: Test Your Migration (Windows 10) -description: Test Your Migration +description: Learn about testing your migration plan in a controlled laboratory setting before you deploy it to your entire organization. ms.assetid: 754af276-8386-4eac-8079-3d1e45964a0d ms.reviewer: manager: laurawi @@ -43,12 +43,3 @@ For testing purposes, you can create an uncompressed store using the **/hardlink [Plan Your Migration](usmt-plan-your-migration.md) [Log Files](usmt-log-files.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-topics.md b/windows/deployment/usmt/usmt-topics.md index 69321a476c..2e73d33887 100644 --- a/windows/deployment/usmt/usmt-topics.md +++ b/windows/deployment/usmt/usmt-topics.md @@ -1,30 +1,31 @@ ---- -title: User State Migration Tool (USMT) Overview Topics (Windows 10) -description: User State Migration Tool (USMT) Overview Topics -ms.assetid: 23170271-130b-416f-a7a7-c2f6adc32eee -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Overview Topics -The User State Migration Tool (USMT) 10.0 provides a highly customizable user-profile migration experience for IT professionals. USMT includes three command-line tools: ScanState.exe, LoadState.exe, and UsmtUtils.exe. USMT also includes a set of three modifiable .xml files: MigApp.xml, MigDocs.xml, and MigUser.xml. Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. - -## In This Section - -|Topic |Description| -|------|-----------| -|[User State Migration Tool (USMT) Overview](usmt-overview.md)|Describes the benefits and limitations of using USMT.| -|[Getting Started with the User State Migration Tool (USMT)](getting-started-with-the-user-state-migration-tool.md)|Describes the general process to follow to migrate files and settings, and provides links to more information.| -|[Windows Upgrade and Migration Considerations](../upgrade/windows-upgrade-and-migration-considerations.md)|Discusses the Microsoft® tools you can use to move files and settings between installations, as well as special considerations for performing an upgrade or migration.| - -## Related topics -- [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) -- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) -- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) +--- +title: User State Migration Tool (USMT) Overview Topics (Windows 10) +description: Learn about User State Migration Tool (USMT) overview topics that describe USMT as a highly customizable user-profile migration experience for IT professionals. +ms.assetid: 23170271-130b-416f-a7a7-c2f6adc32eee +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Overview Topics +The User State Migration Tool (USMT) 10.0 provides a highly customizable user-profile migration experience for IT professionals. USMT includes three command-line tools: ScanState.exe, LoadState.exe, and UsmtUtils.exe. USMT also includes a set of three modifiable .xml files: MigApp.xml, MigDocs.xml, and MigUser.xml. Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. + +## In This Section + +|Topic |Description| +|------|-----------| +|[User State Migration Tool (USMT) Overview](usmt-overview.md)|Describes the benefits and limitations of using USMT.| +|[Getting Started with the User State Migration Tool (USMT)](getting-started-with-the-user-state-migration-tool.md)|Describes the general process to follow to migrate files and settings, and provides links to more information.| +|[Windows Upgrade and Migration Considerations](../upgrade/windows-upgrade-and-migration-considerations.md)|Discusses the Microsoft® tools you can use to move files and settings between installations, as well as special considerations for performing an upgrade or migration.| + +## Related topics +- [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) +- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) +- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md index 085f3892d2..1c629df5ec 100644 --- a/windows/deployment/usmt/usmt-troubleshooting.md +++ b/windows/deployment/usmt/usmt-troubleshooting.md @@ -1,73 +1,74 @@ ---- -title: User State Migration Tool (USMT) Troubleshooting (Windows 10) -description: User State Migration Tool (USMT) Troubleshooting -ms.assetid: 770f45bb-2284-463f-a29c-69c04f437533 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Troubleshooting - - -The following table describes topics that address common User State Migration Tool (USMT) 10.0 issues and questions. These topics describe tools that you can use to troubleshoot issues that arise during your migration. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - -

        Common Issues

        Find troubleshooting solutions for common problems in USMT.

        Frequently Asked Questions

        Find answers to questions about how to use USMT.

        Log Files

        Learn how to enable logging to help you troubleshoot issues in USMT.

        Return Codes

        Learn how to use return codes to identify problems in USMT.

        USMT Resources

        Find more information and support for using USMT.

        - - - -## Related topics - - -[USMT Best Practices](usmt-best-practices.md) - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - -[User State Migration Toolkit (USMT) Reference](usmt-reference.md) - - - - - - - - - +--- +title: User State Migration Tool (USMT) Troubleshooting (Windows 10) +description: Learn about topics that address common User State Migration Tool (USMT) 10.0 issues and questions to assist in troubleshooting. +ms.assetid: 770f45bb-2284-463f-a29c-69c04f437533 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Troubleshooting + + +The following table describes topics that address common User State Migration Tool (USMT) 10.0 issues and questions. These topics describe tools that you can use to troubleshoot issues that arise during your migration. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

        Common Issues

        Find troubleshooting solutions for common problems in USMT.

        Frequently Asked Questions

        Find answers to questions about how to use USMT.

        Log Files

        Learn how to enable logging to help you troubleshoot issues in USMT.

        Return Codes

        Learn how to use return codes to identify problems in USMT.

        USMT Resources

        Find more information and support for using USMT.

        + + + +## Related topics + + +[USMT Best Practices](usmt-best-practices.md) + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) + +[User State Migration Toolkit (USMT) Reference](usmt-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md index 4e9269a29d..d87666c8b6 100644 --- a/windows/deployment/usmt/usmt-utilities.md +++ b/windows/deployment/usmt/usmt-utilities.md @@ -1,351 +1,352 @@ ---- -title: UsmtUtils Syntax (Windows 10) -description: UsmtUtils Syntax -ms.assetid: cdab7f2d-dd68-4016-b9ed-41ffa743b65c -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# UsmtUtils Syntax - - -This topic describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities: - -- Improve your ability to determine cryptographic options for your migration. - -- Assist in removing hard-link stores that cannot otherwise be deleted due to a sharing lock. - -- Verify whether the catalog file or any of the other files in the compressed migration store have become corrupted. - -- Extract files from the compressed migration store when you migrate files and settings to the destination computer. - -## In This Topic - - -[Usmtutils.exe](#bkmk-usmtutils-exe) - -[Verify Options](#bkmk-verifyoptions) - -[Extract Options](#bkmk-extractoptions) - -## Usmtutils.exe - - -The following table lists command-line options for USMTutils.exe. The sections that follow provide further command-line options for the **/verify** and the **/extract** options. - -The syntax for UsmtUtils.exe is: - -usmtutils \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-line OptionDescription

        /ec

        Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the /encrypt command before you run the ScanState tool on the source computer.

        /rd<storeDir>

        Removes the directory path specified by the <storeDir> argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

        -

        For example:

        -

        usmtutils /rd D:\MyHardLinkStore

        /y

        Overrides the accept deletions prompt when used with the /rd option. When you use the /y option with the /rd option, you will not be prompted to accept the deletions before USMT deletes the directories.

        /verify

        Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

        -

        See Verify Options for syntax and options to use with /verify.

        /extract

        Recovers files from a compressed USMT migration store.

        -

        See Extract Options for syntax and options to use with /extract.

        - - - -## Verify Options - - -Use the **/verify** option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the **/verify** option, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). - -The syntax for **/verify** is: - -usmtutils /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-line OptionDescription

        <reportType>

        Specifies whether to report on all files, corrupted files only, or the status of the catalog.

        -
          -
        • Summary. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.

        • -
        • all. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.

        • -
        • failureonly. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.

        • -
        • Catalog. Returns only the status of the catalog file.

        • -
        /l: -

        <logfilePath>

        Specifies the location and name of the log file.

        /v:<VerbosityLevel>

        (Verbosity)

        -

        Enables verbose output in the UsmtUtils log file. The default value is 0.

        -

        You can set the VerbosityLevel to one of the following levels:

        - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        LevelExplanation

        0

        Only the default errors and warnings are enabled.

        1

        Enables verbose output.

        4

        Enables error and status output.

        5

        Enables verbose and status output.

        8

        Enables error output to a debugger.

        9

        Enables verbose output to a debugger.

        12

        Enables error and status output to a debugger.

        13

        Enables verbose, status, and debugger output.

        -

         

        /decrypt<AlgID>/:<KeyString>

        -

        or

        -

        /decrypt<AlgID>/:<“Key String”>

        -

        or

        -

        /decrypt:<AlgID>/keyfile:<FileName>

        Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a /key or /keyfile option as follows:

        -
          -
        • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

          -

          <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

        • -
        • /key:<KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

        • -
        • /keyfile: <FileName> specifies the location and name of a text (.txt) file that contains the encryption key.

        • -
        -

        For more information about supported encryption algorithms, see Migration Store Encryption

        - - - -Some examples of **/verify** commands: - -- `usmtutils /verify D:\MyMigrationStore\store.mig` - -- `usmtutils /verify:catalog D:\MyMigrationStore\store.mig` - -- `usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` - -- `usmtutils /verify:failureonly D:\MyMigrationStore\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt` - -## Extract Options - - -Use the **/extract** option to recover files from a compressed USMT migration store if it will not restore normally with loadstate. For more information on how to use the **/extract** option, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). - -The syntax for **/extract** is: - -/extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Command-line OptionDescription

        <filePath>

        Path to the USMT migration store.

        -

        For example:

        -

        D:\MyMigrationStore\USMT\store.mig

        <destinationPath>

        Path to the folder where the tool puts the individual files.

        /i:<includePattern>

        Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

        /e:<excludePattern>

        Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

        /l:<logfilePath>

        Specifies the location and name of the log file.

        /v:<VerbosityLevel>

        (Verbosity)

        -

        Enables verbose output in the UsmtUtils log file. The default value is 0.

        -

        You can set the VerbosityLevel to one of the following levels:

        - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        LevelExplanation

        0

        Only the default errors and warnings are enabled.

        1

        Enables verbose output.

        4

        Enables error and status output.

        5

        Enables verbose and status output.

        8

        Enables error output to a debugger.

        9

        Enables verbose output to a debugger.

        12

        Enables error and status output to a debugger.

        13

        Enables verbose, status, and debugger output.

        -

         

        /decrypt<AlgID>/key:<KeyString>

        -

        or

        -

        /decrypt<AlgID>/:<“Key String”>

        -

        or

        -

        /decrypt:<AlgID>/keyfile:<FileName>

        Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a /key or /keyfile option as follows:

        -
          -
        • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

          -

          <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

        • -
        • /key: <KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

        • -
        • /keyfile:<FileName> specifies a text (.txt) file that contains the encryption key

        • -
        -

        For more information about supported encryption algorithms, see Migration Store Encryption.

        /o

        Overwrites existing output files.

        - - - -Some examples of **/extract** commands: - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt, *.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtlog.txt` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o` - -## Related topics - - -[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) - -[Return Codes](usmt-return-codes.md) - - - - - - - - - +--- +title: UsmtUtils Syntax (Windows 10) +description: Learn about the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. +ms.assetid: cdab7f2d-dd68-4016-b9ed-41ffa743b65c +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# UsmtUtils Syntax + + +This topic describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities: + +- Improve your ability to determine cryptographic options for your migration. + +- Assist in removing hard-link stores that cannot otherwise be deleted due to a sharing lock. + +- Verify whether the catalog file or any of the other files in the compressed migration store have become corrupted. + +- Extract files from the compressed migration store when you migrate files and settings to the destination computer. + +## In This Topic + + +[Usmtutils.exe](#bkmk-usmtutils-exe) + +[Verify Options](#bkmk-verifyoptions) + +[Extract Options](#bkmk-extractoptions) + +## Usmtutils.exe + + +The following table lists command-line options for USMTutils.exe. The sections that follow provide further command-line options for the **/verify** and the **/extract** options. + +The syntax for UsmtUtils.exe is: + +usmtutils \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-line OptionDescription

        /ec

        Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the /encrypt command before you run the ScanState tool on the source computer.

        /rd<storeDir>

        Removes the directory path specified by the <storeDir> argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

        +

        For example:

        +

        usmtutils /rd D:\MyHardLinkStore

        /y

        Overrides the accept deletions prompt when used with the /rd option. When you use the /y option with the /rd option, you will not be prompted to accept the deletions before USMT deletes the directories.

        /verify

        Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

        +

        See Verify Options for syntax and options to use with /verify.

        /extract

        Recovers files from a compressed USMT migration store.

        +

        See Extract Options for syntax and options to use with /extract.

        + + + +## Verify Options + + +Use the **/verify** option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the **/verify** option, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). + +The syntax for **/verify** is: + +usmtutils /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-line OptionDescription

        <reportType>

        Specifies whether to report on all files, corrupted files only, or the status of the catalog.

        +
          +
        • Summary. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.

        • +
        • all. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.

        • +
        • failureonly. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.

        • +
        • Catalog. Returns only the status of the catalog file.

        • +
        /l: +

        <logfilePath>

        Specifies the location and name of the log file.

        /v:<VerbosityLevel>

        (Verbosity)

        +

        Enables verbose output in the UsmtUtils log file. The default value is 0.

        +

        You can set the VerbosityLevel to one of the following levels:

        + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        LevelExplanation

        0

        Only the default errors and warnings are enabled.

        1

        Enables verbose output.

        4

        Enables error and status output.

        5

        Enables verbose and status output.

        8

        Enables error output to a debugger.

        9

        Enables verbose output to a debugger.

        12

        Enables error and status output to a debugger.

        13

        Enables verbose, status, and debugger output.

        +

         

        /decrypt<AlgID>/:<KeyString>

        +

        or

        +

        /decrypt<AlgID>/:<“Key String”>

        +

        or

        +

        /decrypt:<AlgID>/keyfile:<FileName>

        Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a /key or /keyfile option as follows:

        +
          +
        • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

          +

          <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

        • +
        • /key:<KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

        • +
        • /keyfile: <FileName> specifies the location and name of a text (.txt) file that contains the encryption key.

        • +
        +

        For more information about supported encryption algorithms, see Migration Store Encryption

        + + + +Some examples of **/verify** commands: + +- `usmtutils /verify D:\MyMigrationStore\store.mig` + +- `usmtutils /verify:catalog D:\MyMigrationStore\store.mig` + +- `usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` + +- `usmtutils /verify:failureonly D:\MyMigrationStore\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt` + +## Extract Options + + +Use the **/extract** option to recover files from a compressed USMT migration store if it will not restore normally with loadstate. For more information on how to use the **/extract** option, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +The syntax for **/extract** is: + +/extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        Command-line OptionDescription

        <filePath>

        Path to the USMT migration store.

        +

        For example:

        +

        D:\MyMigrationStore\USMT\store.mig

        <destinationPath>

        Path to the folder where the tool puts the individual files.

        /i:<includePattern>

        Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

        /e:<excludePattern>

        Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

        /l:<logfilePath>

        Specifies the location and name of the log file.

        /v:<VerbosityLevel>

        (Verbosity)

        +

        Enables verbose output in the UsmtUtils log file. The default value is 0.

        +

        You can set the VerbosityLevel to one of the following levels:

        + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        LevelExplanation

        0

        Only the default errors and warnings are enabled.

        1

        Enables verbose output.

        4

        Enables error and status output.

        5

        Enables verbose and status output.

        8

        Enables error output to a debugger.

        9

        Enables verbose output to a debugger.

        12

        Enables error and status output to a debugger.

        13

        Enables verbose, status, and debugger output.

        +

         

        /decrypt<AlgID>/key:<KeyString>

        +

        or

        +

        /decrypt<AlgID>/:<“Key String”>

        +

        or

        +

        /decrypt:<AlgID>/keyfile:<FileName>

        Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a /key or /keyfile option as follows:

        +
          +
        • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

          +

          <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

        • +
        • /key: <KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

        • +
        • /keyfile:<FileName> specifies a text (.txt) file that contains the encryption key

        • +
        +

        For more information about supported encryption algorithms, see Migration Store Encryption.

        /o

        Overwrites existing output files.

        + + + +Some examples of **/extract** commands: + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt, *.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtlog.txt` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o` + +## Related topics + + +[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) + +[Return Codes](usmt-return-codes.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index 4fc36c33bc..2152530861 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -1,429 +1,430 @@ ---- -title: What does USMT migrate (Windows 10) -description: What does USMT migrate -ms.assetid: f613987d-0f17-43fe-9717-6465865ceda7 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 09/12/2017 -ms.topic: article ---- - -# What does USMT migrate? - - -## In this topic - - -- [Default migration scripts](#bkmk-defaultmigscripts) - -- [User Data](#bkmk-3) - -- [Operating-system components](#bkmk-4) - -- [Supported applications](#bkmk-2) - -- [What USMT does not migrate](#no) - -## Default migration scripts - - -The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts: - -- **MigApp.XML.** Rules to migrate application settings. - -- **MigDocs.XML.** Rules that use the **MigXmlHelper.GenerateDocPatterns** helper function, which can be used to automatically find user documents on a computer without the need to author extensive custom migration .xml files. - -- **MigUser.XML.** Rules to migrate user profiles and user data. - - MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration. - - The following data does not migrate with MigUser.xml: - - - Files outside the user profile that don’t match one of the file extensions in MigUser.xml. - - - Access control lists (ACLs) for folders outside the user profile. - -## User data - - -This section describes the user data that USMT migrates by default, using the MigUser.xml file. It also defines how to migrate ACLs. - -- **Folders from each user profile.** When you specify the MigUser.xml file, USMT migrates everything in a user’s profiles including the following: - - My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites. - - >[!IMPORTANT] - >Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). - -- **Folders from the All Users and Public profiles.** When you specify the MigUser.xml file, USMT also migrates the following from the **All Users** profile in Windows® XP, or the **Public** profile in Windows Vista, Windows 7, or Windows 8: - - - Shared Documents - - - Shared Video - - - Shared Music - - - Shared desktop files - - - Shared Pictures - - - Shared Start menu - - - Shared Favorites - -- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects and then migrates files with any of the following file extensions: - - **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.** - - **Note**   - The asterisk (\*) stands for zero or more characters. - - - -- **Access control lists.** USMT migrates ACLs for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named File1.txt that is read-only for User1 and read/write for User2, these settings will still apply on the destination computer after the migration. - -**Important**   -To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. - - - -## Operating-system components - - -USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8 - -The following components are migrated by default using the manifest files: - -- Accessibility settings - -- Address book - -- Command-prompt settings - -- \*Desktop wallpaper - -- EFS files - -- Favorites - -- Folder options - -- Fonts - -- Group membership. USMT migrates users’ group settings. The groups to which a user belongs can be found by right-clicking **My Computer** on the Start menu and then clicking **Manage**. When running an offline migration, the use of a **<ProfileControl>** section in the Config.xml file is required. - -- \*Windows Internet Explorer® settings - -- Microsoft® Open Database Connectivity (ODBC) settings - -- Mouse and keyboard settings - -- Network drive mapping - -- \*Network printer mapping - -- \*Offline files - -- \*Phone and modem options - -- RAS connection and phone book (.pbk) files - -- \*Regional settings - -- Remote Access - -- \*Taskbar settings - -- User personal certificates (all) - -- Windows Mail. - -- \*Windows Media Player - -- Windows Rights Management - -\* These settings are not available for an offline migration. For more information, see [Offline Migration Reference](offline-migration-reference.md). - -**Important**   -This list may not be complete. There may be additional components that are migrated. - - - -**Note**   -Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool. - - - -## Supported applications - - -Although it is not required for all applications, it is good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that the migrated settings are not overwritten by the application installers. - -**Note**   -The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. - - - -**Note**   -USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. - - - -When you specify the MigApp.xml file, USMT migrates the settings for the following applications: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        ProductVersion

        Adobe Acrobat Reader

        9

        AOL Instant Messenger

        6.8

        Adobe Creative Suite

        2

        Adobe Photoshop CS

        8, 9

        Adobe ImageReady CS

        Apple iTunes

        6, 7, 8

        Apple QuickTime Player

        5, 6, 7

        Apple Safari

        3.1.2

        Google Chrome

        beta

        Google Picasa

        3

        Google Talk

        beta

        IBM Lotus 1-2-3

        9

        IBM Lotus Notes

        6,7, 8

        IBM Lotus Organizer

        5

        IBM Lotus WordPro

        9.9

        Intuit Quicken Deluxe

        2009

        Money Plus Business

        2008

        Money Plus Home

        2008

        Mozilla Firefox

        3

        Microsoft Office

        2003, 2007, 2010

        Microsoft Office Access®

        2003, 2007, 2010

        Microsoft Office Excel®

        2003, 2007, 2010

        Microsoft Office FrontPage®

        2003, 2007, 2010

        Microsoft Office OneNote®

        2003, 2007, 2010

        Microsoft Office Outlook®

        2003, 2007, 2010

        Microsoft Office PowerPoint®

        2003, 2007, 2010

        Microsoft Office Publisher

        2003, 2007, 2010

        Microsoft Office Word

        2003, 2007, 2010

        Opera Software Opera

        9.5

        Microsoft Outlook Express

        (only mailbox file)

        Microsoft Project

        2003, 2007

        Microsoft Office Visio®

        2003, 2007

        RealPlayer Basic

        11

        Sage Peachtree

        2009

        Skype

        3.8

        Windows Live Mail

        12, 14

        Windows Live Messenger

        8.5, 14

        Windows Live MovieMaker

        14

        Windows Live Photo Gallery

        12, 14

        Windows Live Writer

        12, 14

        Windows Mail

        (Windows 7 and 8)

        Microsoft Works

        9

        Yahoo Messenger

        9

        Microsoft Zune™ Software

        3

        - - - -## What USMT does not migrate - - -The following is a list of the settings that USMT does not migrate. If you are having a problem that is not listed here, see [Common Issues](usmt-common-issues.md). - -### Application settings - -USMT does not migrate the following application settings: - -- Settings from earlier versions of an application. The versions of each application must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. USMT can migrate from an earlier version of Microsoft Office to a later version. - -- Application settings and some operating-system settings when a local account is created. For example, if you run /lac to create a local account on the destination computer, USMT will migrate the user data, but only some of the operating-system settings, such as wallpaper and screensaver settings, and no application settings will migrate. - -- Microsoft Project settings, when migrating from Office 2003 to Office 2007 system. - -- ICQ Pro settings, if ICQ Pro is installed in a different location on the destination computer. To successfully migrate the settings of ICQ Pro, you must install ICQ Pro in the same location on the destination computer as it was on the source computer. Otherwise, after you run the LoadState tool, the application will not start. You may encounter problems when: - - - You change the default installation location on 32-bit destination computers. - - - You attempt to migrate from a 32-bit computer to a 64-bit computer. This is because the ICQ Pro default installation directory is different on the two types of computers. When you install ICQ Pro on a 32-bit computer, the default location is "C:\\Program Files\\...". The ICQ Pro default installation directory on an x64-based computer, however, is “C:\\Program Files (x86)\\...”. - -### Operating-System settings - -USMT does not migrate the following operating-system settings. - -- Local printers, hardware-related settings, drivers, passwords, application binary files, synchronization files, DLL files, or other executable files. - -- Permissions for shared folders. After migration, you must manually re-share any folders that were shared on the source computer. - -- Files and settings migrating between operating systems with different languages. The operating system of the source computer must match the language of the operating system on the destination computer. - -- Customized icons for shortcuts may not migrate. - -- Taskbar settings, when the source computer is running Windows XP. - -You should also note the following: - -- You should run USMT from an account with administrative credentials. Otherwise, some data will not migrate. When running the ScanState and LoadState tools you must run the tools in Administrator mode from an account with administrative credentials. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. In addition, you must run the ScanState tool on Windows XP from an account with administrative credentials. Otherwise, some operating-system settings will not migrate. To run in Administrator mode, click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as administrator**. - -- You can use the /**localonly** option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify /**localonly**, see [ScanState Syntax](usmt-scanstate-syntax.md). - -### Start menu layout - -Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). - -## Related topics - - -[Plan your migration](usmt-plan-your-migration.md) - - - - - - - - - +--- +title: What does USMT migrate (Windows 10) +description: Learn how User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. +ms.assetid: f613987d-0f17-43fe-9717-6465865ceda7 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 09/12/2017 +ms.topic: article +--- + +# What does USMT migrate? + + +## In this topic + + +- [Default migration scripts](#bkmk-defaultmigscripts) + +- [User Data](#bkmk-3) + +- [Operating-system components](#bkmk-4) + +- [Supported applications](#bkmk-2) + +- [What USMT does not migrate](#no) + +## Default migration scripts + + +The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts: + +- **MigApp.XML.** Rules to migrate application settings. + +- **MigDocs.XML.** Rules that use the **MigXmlHelper.GenerateDocPatterns** helper function, which can be used to automatically find user documents on a computer without the need to author extensive custom migration .xml files. + +- **MigUser.XML.** Rules to migrate user profiles and user data. + + MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration. + + The following data does not migrate with MigUser.xml: + + - Files outside the user profile that don’t match one of the file extensions in MigUser.xml. + + - Access control lists (ACLs) for folders outside the user profile. + +## User data + + +This section describes the user data that USMT migrates by default, using the MigUser.xml file. It also defines how to migrate ACLs. + +- **Folders from each user profile.** When you specify the MigUser.xml file, USMT migrates everything in a user’s profiles including the following: + + My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites. + + >[!IMPORTANT] + >Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). + +- **Folders from the All Users and Public profiles.** When you specify the MigUser.xml file, USMT also migrates the following from the **All Users** profile in Windows® XP, or the **Public** profile in Windows Vista, Windows 7, or Windows 8: + + - Shared Documents + + - Shared Video + + - Shared Music + + - Shared desktop files + + - Shared Pictures + + - Shared Start menu + + - Shared Favorites + +- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects and then migrates files with any of the following file extensions: + + **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.** + + **Note**   + The asterisk (\*) stands for zero or more characters. + + + +- **Access control lists.** USMT migrates ACLs for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named File1.txt that is read-only for User1 and read/write for User2, these settings will still apply on the destination computer after the migration. + +**Important**   +To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. + + + +## Operating-system components + + +USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8 + +The following components are migrated by default using the manifest files: + +- Accessibility settings + +- Address book + +- Command-prompt settings + +- \*Desktop wallpaper + +- EFS files + +- Favorites + +- Folder options + +- Fonts + +- Group membership. USMT migrates users’ group settings. The groups to which a user belongs can be found by right-clicking **My Computer** on the Start menu and then clicking **Manage**. When running an offline migration, the use of a **<ProfileControl>** section in the Config.xml file is required. + +- \*Windows Internet Explorer® settings + +- Microsoft® Open Database Connectivity (ODBC) settings + +- Mouse and keyboard settings + +- Network drive mapping + +- \*Network printer mapping + +- \*Offline files + +- \*Phone and modem options + +- RAS connection and phone book (.pbk) files + +- \*Regional settings + +- Remote Access + +- \*Taskbar settings + +- User personal certificates (all) + +- Windows Mail. + +- \*Windows Media Player + +- Windows Rights Management + +\* These settings are not available for an offline migration. For more information, see [Offline Migration Reference](offline-migration-reference.md). + +**Important**   +This list may not be complete. There may be additional components that are migrated. + + + +**Note**   +Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool. + + + +## Supported applications + + +Although it is not required for all applications, it is good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that the migrated settings are not overwritten by the application installers. + +**Note**   +The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. + + + +**Note**   +USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. + + + +When you specify the MigApp.xml file, USMT migrates the settings for the following applications: + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
        ProductVersion

        Adobe Acrobat Reader

        9

        AOL Instant Messenger

        6.8

        Adobe Creative Suite

        2

        Adobe Photoshop CS

        8, 9

        Adobe ImageReady CS

        Apple iTunes

        6, 7, 8

        Apple QuickTime Player

        5, 6, 7

        Apple Safari

        3.1.2

        Google Chrome

        beta

        Google Picasa

        3

        Google Talk

        beta

        IBM Lotus 1-2-3

        9

        IBM Lotus Notes

        6,7, 8

        IBM Lotus Organizer

        5

        IBM Lotus WordPro

        9.9

        Intuit Quicken Deluxe

        2009

        Money Plus Business

        2008

        Money Plus Home

        2008

        Mozilla Firefox

        3

        Microsoft Office

        2003, 2007, 2010

        Microsoft Office Access®

        2003, 2007, 2010

        Microsoft Office Excel®

        2003, 2007, 2010

        Microsoft Office FrontPage®

        2003, 2007, 2010

        Microsoft Office OneNote®

        2003, 2007, 2010

        Microsoft Office Outlook®

        2003, 2007, 2010

        Microsoft Office PowerPoint®

        2003, 2007, 2010

        Microsoft Office Publisher

        2003, 2007, 2010

        Microsoft Office Word

        2003, 2007, 2010

        Opera Software Opera

        9.5

        Microsoft Outlook Express

        (only mailbox file)

        Microsoft Project

        2003, 2007

        Microsoft Office Visio®

        2003, 2007

        RealPlayer Basic

        11

        Sage Peachtree

        2009

        Skype

        3.8

        Windows Live Mail

        12, 14

        Windows Live Messenger

        8.5, 14

        Windows Live MovieMaker

        14

        Windows Live Photo Gallery

        12, 14

        Windows Live Writer

        12, 14

        Windows Mail

        (Windows 7 and 8)

        Microsoft Works

        9

        Yahoo Messenger

        9

        Microsoft Zune™ Software

        3

        + + + +## What USMT does not migrate + + +The following is a list of the settings that USMT does not migrate. If you are having a problem that is not listed here, see [Common Issues](usmt-common-issues.md). + +### Application settings + +USMT does not migrate the following application settings: + +- Settings from earlier versions of an application. The versions of each application must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. USMT can migrate from an earlier version of Microsoft Office to a later version. + +- Application settings and some operating-system settings when a local account is created. For example, if you run /lac to create a local account on the destination computer, USMT will migrate the user data, but only some of the operating-system settings, such as wallpaper and screensaver settings, and no application settings will migrate. + +- Microsoft Project settings, when migrating from Office 2003 to Office 2007 system. + +- ICQ Pro settings, if ICQ Pro is installed in a different location on the destination computer. To successfully migrate the settings of ICQ Pro, you must install ICQ Pro in the same location on the destination computer as it was on the source computer. Otherwise, after you run the LoadState tool, the application will not start. You may encounter problems when: + + - You change the default installation location on 32-bit destination computers. + + - You attempt to migrate from a 32-bit computer to a 64-bit computer. This is because the ICQ Pro default installation directory is different on the two types of computers. When you install ICQ Pro on a 32-bit computer, the default location is "C:\\Program Files\\...". The ICQ Pro default installation directory on an x64-based computer, however, is “C:\\Program Files (x86)\\...”. + +### Operating-System settings + +USMT does not migrate the following operating-system settings. + +- Local printers, hardware-related settings, drivers, passwords, application binary files, synchronization files, DLL files, or other executable files. + +- Permissions for shared folders. After migration, you must manually re-share any folders that were shared on the source computer. + +- Files and settings migrating between operating systems with different languages. The operating system of the source computer must match the language of the operating system on the destination computer. + +- Customized icons for shortcuts may not migrate. + +- Taskbar settings, when the source computer is running Windows XP. + +You should also note the following: + +- You should run USMT from an account with administrative credentials. Otherwise, some data will not migrate. When running the ScanState and LoadState tools you must run the tools in Administrator mode from an account with administrative credentials. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. In addition, you must run the ScanState tool on Windows XP from an account with administrative credentials. Otherwise, some operating-system settings will not migrate. To run in Administrator mode, click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as administrator**. + +- You can use the /**localonly** option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify /**localonly**, see [ScanState Syntax](usmt-scanstate-syntax.md). + +### Start menu layout + +Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). + +## Related topics + + +[Plan your migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md index bfbd4e2c61..2399213435 100644 --- a/windows/deployment/usmt/usmt-xml-elements-library.md +++ b/windows/deployment/usmt/usmt-xml-elements-library.md @@ -1,6 +1,6 @@ --- title: XML Elements Library (Windows 10) -description: XML Elements Library +description: Learn about the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). ms.assetid: f5af0f6d-c3bf-4a4c-a0ca-9db7985f954f ms.reviewer: manager: laurawi @@ -17,12 +17,10 @@ ms.topic: article # XML Elements Library -## Overview - This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. . -## In This Topic +## In this topic In addition to XML elements and helper functions, this topic describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions. @@ -326,7 +324,7 @@ Syntax: ## <component> -The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. +The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. A component can be nested inside another component; that is, the <component> element can be a child of the <role> element within the <component> element in two cases: 1) when the parent <component> element is a container or 2) if the child <component> element has the same role as the parent <component> element. @@ -365,7 +363,7 @@ hidden="Yes|No">

        Yes

        You can use the following to group settings, and define the type of the component.

          -
        • System: Operating system settings. All Windows® components are defined by this type.

          +
        • System: Operating system settings. All Windows® components are defined by this type.

          When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

        • Application: Settings for an application.

        • Device: Settings for a device.

        • @@ -556,7 +554,7 @@ For example:

          OSType

          Yes

          -

          Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x”, the result will be FALSE.

          +

          Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is "9x", the result will be FALSE.

          OSVersion

          @@ -598,7 +596,7 @@ For example:

          OSType

          Yes

          -

          Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x” the result will be FALSE.

          +

          Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is "9x" the result will be FALSE.

          OSVersion

          @@ -3131,8 +3129,8 @@ This filter helper function can be used to filter the migration of files based o

          valueToCompare

          The value we are comparing. For example:

          -

          Date: “2008/05/15-2005/05/17”, “2008/05/15”

          -

          Size: A numeral with B, KB, MB, or GB at the end. “5GB”, “1KB-1MB”

          +

          Date: "2008/05/15-2005/05/17", "2008/05/15"

          +

          Size: A numeral with B, KB, MB, or GB at the end. "5GB", "1KB-1MB"

          @@ -3464,8 +3462,8 @@ Syntax:

        You can either:

          -
        1. Specify up to three <role> elements within a <component> — one “Binaries” role element, one “Settings” role element and one “Data” role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these <role> elements, but each nested element must be of the same role parameter.

        2. -
        3. Specify one “Container” <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:

        4. +
        5. Specify up to three <role> elements within a <component> — one "Binaries" role element, one "Settings" role element and one "Data" role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these <role> elements, but each nested element must be of the same role parameter.

        6. +
        7. Specify one "Container" <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:

        <component context="UserAndSystem" type="Application">
           <displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName> 
        @@ -3846,7 +3844,7 @@ See the last component in the MigUser.xml file for an example of this element.
         ~~~
         **Example:**
         
        -If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X’s profile.
        +If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X's profile.
         
         The following is example code for this scenario. The first <rules> element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second <rules> elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second <rules> element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected.
         
        @@ -4103,12 +4101,12 @@ Syntax:
         
         

        name

        Yes

        -

        ID is a string value that is the name used to reference the environment variable. We recommend that ID start with the component’s name to avoid namespace collisions. For example, if your component’s name is MyComponent, and you want a variable that is your component’s install path, you could specify MyComponent.InstallPath.

        +

        ID is a string value that is the name used to reference the environment variable. We recommend that ID start with the component's name to avoid namespace collisions. For example, if your component's name is MyComponent, and you want a variable that is your component's install path, you could specify MyComponent.InstallPath.

        remap

        No, default = FALSE

        -

        Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable’s value are automatically moved to where the environment variable points on the destination computer.

        +

        Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable's value are automatically moved to where the environment variable points on the destination computer.

        @@ -4227,27 +4225,27 @@ The following functions are for internal USMT use only. Do not use them in an .x You can use the following version tags with various helper functions: -- “CompanyName” +- "CompanyName" -- “FileDescription” +- "FileDescription" -- “FileVersion” +- "FileVersion" -- “InternalName” +- "InternalName" -- “LegalCopyright” +- "LegalCopyright" -- “OriginalFilename” +- "OriginalFilename" -- “ProductName” +- "ProductName" -- “ProductVersion” +- "ProductVersion" The following version tags contain values that can be compared: -- “FileVersion” +- "FileVersion" -- “ProductVersion” +- "ProductVersion" ## Related topics diff --git a/windows/deployment/usmt/usmt-xml-reference.md b/windows/deployment/usmt/usmt-xml-reference.md index e69e94db8f..ec943180e6 100644 --- a/windows/deployment/usmt/usmt-xml-reference.md +++ b/windows/deployment/usmt/usmt-xml-reference.md @@ -1,78 +1,79 @@ ---- -title: USMT XML Reference (Windows 10) -description: USMT XML Reference -ms.assetid: fb946975-0fee-4ec0-b3ef-7c34945ee96f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# USMT XML Reference - - -This section contains topics that you can use to work with and to customize the migration XML files. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

        Understanding Migration XML Files

        Provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file.

        Config.xml File

        Describes the Config.xml file and policies concerning its configuration.

        Customize USMT XML Files

        Describes how to customize USMT XML files.

        Custom XML Examples

        Gives examples of XML files for various migration scenarios.

        Conflicts and Precedence

        Describes the precedence of migration rules and how conflicts are handled.

        General Conventions

        Describes the XML helper functions.

        XML File Requirements

        Describes the requirements for custom XML files.

        Recognized Environment Variables

        Describes environment variables recognized by USMT.

        XML Elements Library

        Describes the XML elements and helper functions for authoring migration XML files to use with USMT.

        - - - - - - - - - - - +--- +title: USMT XML Reference (Windows 10) +description: Learn about working with and customizing the migration XML files using User State Migration Tool (USMT) XML Reference for Windows 10. +ms.assetid: fb946975-0fee-4ec0-b3ef-7c34945ee96f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# USMT XML Reference + + +This section contains topics that you can use to work with and to customize the migration XML files. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

        Understanding Migration XML Files

        Provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file.

        Config.xml File

        Describes the Config.xml file and policies concerning its configuration.

        Customize USMT XML Files

        Describes how to customize USMT XML files.

        Custom XML Examples

        Gives examples of XML files for various migration scenarios.

        Conflicts and Precedence

        Describes the precedence of migration rules and how conflicts are handled.

        General Conventions

        Describes the XML helper functions.

        XML File Requirements

        Describes the requirements for custom XML files.

        Recognized Environment Variables

        Describes environment variables recognized by USMT.

        XML Elements Library

        Describes the XML elements and helper functions for authoring migration XML files to use with USMT.

        + + + + + + + + + + + diff --git a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md index 433a6a1605..48fd0b29b9 100644 --- a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md +++ b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md @@ -1,128 +1,129 @@ ---- -title: Verify the Condition of a Compressed Migration Store (Windows 10) -description: Verify the Condition of a Compressed Migration Store -ms.assetid: 4a3fda96-5f7d-494a-955f-6b865ec9fcae -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Verify the Condition of a Compressed Migration Store - - -When you migrate files and settings during a typical PC-refresh migration, the user state is usually stored in a compressed folder on the intermediate store. This compressed folder, also called the compressed migration store, is a single image file that contains: - -- All of the files being migrated. - -- The user’s settings. - -- A catalog file that contains metadata for all files in the migration store. - -When you run the **LoadState** command to load the data from these files to the destination computer, LoadState requires a valid catalog file in order to open the migration store. You can run the **UsmtUtils** command with the **/verify** option to determine whether the compressed migration store is intact, or whether it contains corrupted files or a corrupted catalog. You should run the **/verify** option on the migration store before you overwrite the original user-state files and settings. - -When you use the **/verify** option, you can specify what type of information to report in the UsmtUtils log file. These report types are: - -- **Catalog**: Displays the status of only the catalog file. - -- **All**: Displays the status of all files, including the catalog file. - -- **Failure only**: Displays only the files that are corrupted. - -## In This Topic - - -The following sections demonstrate how to run the **UsmtUtils** command with the **/verify** option, and how to specify the information to display in the UsmtUtils log file. - -- [The UsmtUtils syntax for the /verify option](#bkmk-verifysyntax) - -- [To verify that the migration store is intact](#bkmk-verifyintactstore) - -- [To verify the status of only the catalog file](#bkmk-verifycatalog) - -- [To verify the status of all files](#bkmk-verifyallfiles) - -- [To verify the status of the files and return only the corrupted files](#bkmk-returncorrupted) - -### The UsmtUtils Syntax for the /verify Option - -To verify the condition of a compressed migration store, use the following UsmtUtils syntax: - -cd /d<USMTpath>usmtutils /verify\[:<reportType>\] <filePath> \[/l:<logfile>\] \[/decrypt \[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] - -Where the placeholders have the following values: - -- *<USMTpath>* is the location where you have saved the USMT files and tools. - -- *<reportType>* specifies whether to report on all files, corrupted files only, or the status of the catalog. - -- *<filePath>* is the location of the compressed migration store. - -- *<logfile>* is the location and name of the log file. - -- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. - -- *<keystring>* is the encryption key that was used to encrypt the migration store. - -- *<filename>* is the location and name of the text file that contains the encryption key. - -### To Verify that the Migration Store is Intact - -To verify whether the migration store is intact or whether it contains corrupted files or a corrupted catalog, type: - -``` syntax -usmtutils /verify D:\MyMigrationStore\store.mig -``` - -Because no report type is specified, UsmtUtils displays the default summary report. - -### To Verify the Status of Only the Catalog File - -To verify whether the catalog file is corrupted or intact, type: - -``` syntax -usmtutils /verify:catalog D:\MyMigrationStore\store.mig -``` - -### To Verify the Status of all Files - -To verify whether there are any corrupted files in the compressed migration store, and to specify the name and location of the log file, type: - -`usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` - -In addition to verifying the status of all files, this example decrypts the files. Because no encryption algorithm is specified, UsmtUtils uses the default 3DES cryptographic algorithm. - -### To Verify the Status of the Files and Return Only the Corrupted Files - -In this example, the log file will only list the files that became corrupted during the ScanState process. This list will include the catalog file if it is also corrupted. - -``` syntax -usmtutils /verify:failureonly D:\MyMigrationStore\USMT\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt -``` - -This example also decrypts the files by specifying the cryptographic algorithm and the location of the file that contains the encryption key. - -### Next Steps - -If the **/verify** option indicates that there are corrupted files in the migration store, you can use the **/extract** option in the UsmtUtils tool to recover data from some corrupted stores. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). - -## Related topics - - -[UsmtUtils Syntax](usmt-utilities.md) - -[Return Codes](usmt-return-codes.md) - -  - -  - - - - - +--- +title: Verify the Condition of a Compressed Migration Store (Windows 10) +description: Use these tips and tricks to verify the condition of a compressed migration store when using User State Migration Tool (USMT). +ms.assetid: 4a3fda96-5f7d-494a-955f-6b865ec9fcae +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Verify the Condition of a Compressed Migration Store + + +When you migrate files and settings during a typical PC-refresh migration, the user state is usually stored in a compressed folder on the intermediate store. This compressed folder, also called the compressed migration store, is a single image file that contains: + +- All of the files being migrated. + +- The user’s settings. + +- A catalog file that contains metadata for all files in the migration store. + +When you run the **LoadState** command to load the data from these files to the destination computer, LoadState requires a valid catalog file in order to open the migration store. You can run the **UsmtUtils** command with the **/verify** option to determine whether the compressed migration store is intact, or whether it contains corrupted files or a corrupted catalog. You should run the **/verify** option on the migration store before you overwrite the original user-state files and settings. + +When you use the **/verify** option, you can specify what type of information to report in the UsmtUtils log file. These report types are: + +- **Catalog**: Displays the status of only the catalog file. + +- **All**: Displays the status of all files, including the catalog file. + +- **Failure only**: Displays only the files that are corrupted. + +## In This Topic + + +The following sections demonstrate how to run the **UsmtUtils** command with the **/verify** option, and how to specify the information to display in the UsmtUtils log file. + +- [The UsmtUtils syntax for the /verify option](#bkmk-verifysyntax) + +- [To verify that the migration store is intact](#bkmk-verifyintactstore) + +- [To verify the status of only the catalog file](#bkmk-verifycatalog) + +- [To verify the status of all files](#bkmk-verifyallfiles) + +- [To verify the status of the files and return only the corrupted files](#bkmk-returncorrupted) + +### The UsmtUtils Syntax for the /verify Option + +To verify the condition of a compressed migration store, use the following UsmtUtils syntax: + +cd /d<USMTpath>usmtutils /verify\[:<reportType>\] <filePath> \[/l:<logfile>\] \[/decrypt \[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] + +Where the placeholders have the following values: + +- *<USMTpath>* is the location where you have saved the USMT files and tools. + +- *<reportType>* specifies whether to report on all files, corrupted files only, or the status of the catalog. + +- *<filePath>* is the location of the compressed migration store. + +- *<logfile>* is the location and name of the log file. + +- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. + +- *<keystring>* is the encryption key that was used to encrypt the migration store. + +- *<filename>* is the location and name of the text file that contains the encryption key. + +### To Verify that the Migration Store is Intact + +To verify whether the migration store is intact or whether it contains corrupted files or a corrupted catalog, type: + +``` syntax +usmtutils /verify D:\MyMigrationStore\store.mig +``` + +Because no report type is specified, UsmtUtils displays the default summary report. + +### To Verify the Status of Only the Catalog File + +To verify whether the catalog file is corrupted or intact, type: + +``` syntax +usmtutils /verify:catalog D:\MyMigrationStore\store.mig +``` + +### To Verify the Status of all Files + +To verify whether there are any corrupted files in the compressed migration store, and to specify the name and location of the log file, type: + +`usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` + +In addition to verifying the status of all files, this example decrypts the files. Because no encryption algorithm is specified, UsmtUtils uses the default 3DES cryptographic algorithm. + +### To Verify the Status of the Files and Return Only the Corrupted Files + +In this example, the log file will only list the files that became corrupted during the ScanState process. This list will include the catalog file if it is also corrupted. + +``` syntax +usmtutils /verify:failureonly D:\MyMigrationStore\USMT\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt +``` + +This example also decrypts the files by specifying the cryptographic algorithm and the location of the file that contains the encryption key. + +### Next Steps + +If the **/verify** option indicates that there are corrupted files in the migration store, you can use the **/extract** option in the UsmtUtils tool to recover data from some corrupted stores. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +## Related topics + + +[UsmtUtils Syntax](usmt-utilities.md) + +[Return Codes](usmt-return-codes.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/xml-file-requirements.md b/windows/deployment/usmt/xml-file-requirements.md index aeae8b54ae..f5afeaa069 100644 --- a/windows/deployment/usmt/xml-file-requirements.md +++ b/windows/deployment/usmt/xml-file-requirements.md @@ -1,6 +1,6 @@ --- title: XML File Requirements (Windows 10) -description: XML File Requirements +description: Learn about the XML file requirements for creating custom .xml files, like the file must be in UTF-8 and have a unique migration urlid. ms.assetid: 4b567b50-c50a-4a4f-8684-151fe3f8275f ms.reviewer: manager: laurawi diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index 61edc16bf7..e7ec8ac329 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -3,16 +3,17 @@ title: Configure VDA for Windows 10 Subscription Activation ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay -description: How to enable Windows 10 Enterprise E3 and E5 subscriptions for VDA +description: Learn how to configure virtual machines (VMs) to enable Windows 10 Subscription Activation in a Windows Virtual Desktop Access (VDA) scenario. keywords: upgrade, update, task sequence, deploy +ms.custom: seo-marvel-apr2020 ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library ms.pagetype: mdt audience: itpro -author: greg-lindsay ms.topic: article ms.collection: M365-modern-desktop --- @@ -31,25 +32,28 @@ Deployment instructions are provided for the following scenarios: - VMs must be running Windows 10 Pro, version 1703 (also known as the Creator's Update) or later. - VMs must be Active Directory-joined or Azure Active Directory (AAD)-joined. - VMs must be generation 1. -- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). +- VMs must be hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). ## Activation ### Scenario 1 + - The VM is running Windows 10, version 1803 or later. - The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). When a user with VDA rights signs in to the VM using their AAD credentials, the VM is automatically stepped-up to Enterprise and activated. There is no need to perform Windows 10 Pro activation. This eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure. ### Scenario 2 + - The Hyper-V host and the VM are both running Windows 10, version 1803 or later. [Inherited Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation#inherited-activation) is enabled. All VMs created by a user with a Windows 10 E3 or E5 license are automatically activated independent of whether a user signs in with a local account or using an Azure Active Directory account. ### Scenario 3 + - The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner. - In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/). + In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server can be used. KMS activation is provided for Azure VMs. For more information, see [Troubleshoot Azure Windows virtual machine activation problems](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/troubleshoot-activation-problems). For examples of activation issues, see [Troubleshoot the user experience](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#troubleshoot-the-user-experience). @@ -66,28 +70,26 @@ For examples of activation issues, see [Troubleshoot the user experience](https: 4. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**. 5. Click **Add**, type **Authenticated users**, and then click **OK** three times. 6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd) and then start the VM again. -7. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). -8. Open Windows Configuration Designer and click **Provison desktop services**. -9. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 10. - - 1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. +7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps to use Windows Configuration Designer and inject an activation key. Otherwise, skip to step 20. +8. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). +9. Open Windows Configuration Designer and click **Provision desktop services**. +10. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. - Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step. - 2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. -10. On the Set up network page, choose **Off**. -11. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. +11. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. +12. On the Set up network page, choose **Off**. +13. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. - Note: This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms). -12. On the Add applications page, add applications if desired. This step is optional. -13. On the Add certificates page, add certificates if desired. This step is optional. -14. On the Finish page, click **Create**. -15. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 16. - 1. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image. - 2. Type the following at an elevated commnand prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested: +14. On the Add applications page, add applications if desired. This step is optional. +15. On the Add certificates page, add certificates if desired. This step is optional. +16. On the Finish page, click **Create**. +17. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image. +18. Type the following at an elevated command prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested: - ``` + ```cmd Dism.exe /Image=G:\ /Add-ProvisioningPackage /PackagePath: "Desktop AD Enrollment Pro GVLK.ppkg" ``` - 3. Right-click the mounted image in file explorer and click **Eject**. -16. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image. +19. Right-click the mounted image in file explorer and click **Eject**. +20. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image. ## Azure Active Directory-joined VMs @@ -112,7 +114,7 @@ For Azure AD-joined VMs, follow the same instructions (above) as for [Active Dir 3. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**. 4. Click **Add**, type **Authenticated users**, and then click **OK** three times. 5. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). -6. Open Windows Configuration Designer and click **Provison desktop services**. +6. Open Windows Configuration Designer and click **Provision desktop services**. 7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 8. 1. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. 2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. diff --git a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md index cd12f07346..5e20b62132 100644 --- a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md @@ -1,6 +1,6 @@ --- title: Activate by Proxy an Active Directory Forest (Windows 10) -description: Activate by Proxy an Active Directory Forest +description: Learn how to use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate by proxy an Active Directory (AD) forest. ms.assetid: 6475fc87-a6f7-4fa8-b0aa-de19f2dea7e5 ms.reviewer: manager: laurawi diff --git a/windows/deployment/volume-activation/activate-forest-vamt.md b/windows/deployment/volume-activation/activate-forest-vamt.md index 06362064ff..007c3a0ae3 100644 --- a/windows/deployment/volume-activation/activate-forest-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-vamt.md @@ -1,50 +1,51 @@ ---- -title: Activate an Active Directory Forest Online (Windows 10) -description: Activate an Active Directory Forest Online -ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Activate an Active Directory Forest Online - -You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest over the Internet. ADBA enables certain products to inherit activation from the domain. - -**Important**   -ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host keys (CSVLKs). To use ADBA, one or more KMS Host keys (CSVLKs) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. - -## Requirements - -Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: -- VAMT is installed on a host computer that has Internet access. -- VAMT has administrative permissions to the Active Directory domain. -- The KMS Host key (CSVLK) you intend to use is added to VAMT in the **Product Keys** node. - -**To perform an online Active Directory forest activation** - -1. Open VAMT. -2. In the left-side pane, click the **Active Directory-Based Activation** node. -3. In the right-side **Actions** pane, click **Online activate forest** to open the **Install Product Key** dialog box. -4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to apply to the AD forest. -5. If required, enter a new Active Directory-Based Activation Object name - - **Important**   - If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. - -6. Click **Install Key**. -7. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. - -The activated object and the date that is was created appear in the **Active Directory-Based Activation** node in the center pane. - -## Related topics - -- [Scenario 1: Online Activation](scenario-online-activation-vamt.md) -- [Add and Remove Computers](add-remove-computers-vamt.md) +--- +title: Activate an Active Directory Forest Online (Windows 10) +description: Use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest online. +ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Activate an Active Directory Forest Online + +You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest over the Internet. ADBA enables certain products to inherit activation from the domain. + +**Important**   +ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host keys (CSVLKs). To use ADBA, one or more KMS Host keys (CSVLKs) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. + +## Requirements + +Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: +- VAMT is installed on a host computer that has Internet access. +- VAMT has administrative permissions to the Active Directory domain. +- The KMS Host key (CSVLK) you intend to use is added to VAMT in the **Product Keys** node. + +**To perform an online Active Directory forest activation** + +1. Open VAMT. +2. In the left-side pane, click the **Active Directory-Based Activation** node. +3. In the right-side **Actions** pane, click **Online activate forest** to open the **Install Product Key** dialog box. +4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to apply to the AD forest. +5. If required, enter a new Active Directory-Based Activation Object name + + **Important**   + If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. + +6. Click **Install Key**. +7. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. + +The activated object and the date that is was created appear in the **Active Directory-Based Activation** node in the center pane. + +## Related topics + +- [Scenario 1: Online Activation](scenario-online-activation-vamt.md) +- [Add and Remove Computers](add-remove-computers-vamt.md) diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md index 893b4f6f7c..e9c419383d 100644 --- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md +++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md @@ -1,6 +1,7 @@ --- title: Activate using Active Directory-based activation (Windows 10) -description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. +description: Learn how active directory-based activation is implemented as a role service that relies on AD DS to store activation objects. +ms.custom: seo-marvel-apr2020 ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af ms.reviewer: manager: laurawi diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 01010689aa..c1068fe146 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -1,144 +1,153 @@ ---- -title: Activate using Key Management Service (Windows 10) -ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac -ms.reviewer: -manager: laurawi -ms.author: greglin -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 10/16/2017 -ms.topic: article ---- - -# Activate using Key Management Service - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host: -- Host KMS on a computer running Windows 10 -- Host KMS on a computer running Windows Server 2012 R2 -- Host KMS on a computer running an earlier version of Windows - -Check out [Windows 10 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2015/09/15/windows-10-volume-activation-tips/). - -## Key Management Service in Windows 10 - -Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. -Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. -To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft’s activation services. - -**Configure KMS in Windows 10** - -1. Open an elevated command prompt. -2. Enter one of the following commands. - - To install a KMS key, type **slmgr.vbs /ipk <KmsKey>**. - - To activate online, type **slmgr.vbs /ato**. - - To activate by using the telephone, type **slui.exe 4**. -3. After activating the KMS key, restart the Software Protection Service. - -For more information, see the information for Windows 7 in [Deploy KMS Activation](https://go.microsoft.com/fwlink/p/?LinkId=717032). - -## Key Management Service in Windows Server 2012 R2 -Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Server 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista. - -**Note**   -You cannot install a client KMS key into the KMS in Windows Server. - -This scenario is commonly used in larger organizations that do not find the overhead of using a server a burden. - -**Note**   - -If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [KB 3086418](https://go.microsoft.com/fwlink/p/?LinkId=620687). - -**Configure KMS in Windows Server 2012 R2** - -1. Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials. -2. Launch Server Manager. -3. Add the Volume Activation Services role, as shown in Figure 4. - - ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) - - **Figure 4**. Adding the Volume Activation Services role in Server Manager\ - -4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). - - ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) - - **Figure 5**. Launching the Volume Activation Tools - - 5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). - This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. - - ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) - - **Figure 6**. Configuring the computer as a KMS host - -5. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). - - ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) - - **Figure 7**. Installing your KMS host key - -6. If asked to confirm replacement of an existing key, click **Yes**. -7. After the product key is installed, you must activate it. Click **Next** (Figure 8). - - ![Activating the software](../images/volumeactivationforwindows81-08.jpg) - - **Figure 8**. Activating the software - - The KMS key can be activated online or by phone. See Figure 9. - - ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) - - **Figure 9**. Choosing to activate online - -Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met. - -## Verifying the configuration of Key Management Service - -You can verify KMS volume activation from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message. -**Note**   - -If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. - -To verify that KMS volume activation works, complete the following steps: - -1. On the KMS host, open the event log and confirm that DNS publishing is successful. -2. On a client computer, open a Command Prompt window, type **Slmgr.vbs /ato**, and then press ENTER.

        -The **/ato** command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information. -3. On a client computer or the KMS host, open an elevated Command Prompt window, type **Slmgr /dlv**, and then press ENTER.

        - -The **/dlv** command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This confirms that KMS is functioning correctly, even though the client has not been activated. - -For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](https://go.microsoft.com/fwlink/p/?LinkId=733639). - -## Key Management Service in earlier versions of Windows - -If you have already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps: - -1. Download and install the correct update for your current KMS host operating system. Restart the computer as directed. -2. Request a new KMS host key from the Volume Licensing Service Center. -3. Install the new KMS host key on your KMS host. -4. Activate the new KMS host key by running the slmgr.vbs script. - -For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](https://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=626590). - -## See also -- [Volume Activation for Windows 10](volume-activation-windows-10.md) +--- +title: Activate using Key Management Service (Windows 10) +ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac +ms.reviewer: +manager: laurawi +ms.author: greglin +description: How to activate using Key Management Service in Windows 10. +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 10/16/2017 +ms.topic: article +--- + +# Activate using Key Management Service + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows 10](https://support.microsoft.com/help/12440/) +- [Get Help Activating Microsoft Windows 7 or Windows 8.1 ](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host: + +- Host KMS on a computer running Windows 10 +- Host KMS on a computer running Windows Server 2012 R2 +- Host KMS on a computer running an earlier version of Windows + +Check out [Windows 10 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2015/09/15/windows-10-volume-activation-tips/). + +## Key Management Service in Windows 10 + +Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. +Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. +To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft activation services. + +### Configure KMS in Windows 10 + +To activate, use the slmgr.vbs command. Open an elevated command prompt and run one of the following commands: + +- To install the KMS key, type `slmgr.vbs /ipk `. +- To activate online, type `slmgr.vbs /ato`. +- To activate by telephone, follow these steps: + 1. Run `slmgr.vbs /dti` and confirm the installation ID. + 2. Call [Microsoft Licensing Activation Centers worldwide telephone numbers](https://www.microsoft.com/licensing/existing-customer/activation-centers) and follow the voice prompts to enter the installation ID that you obtained in step 1 on your telephone. + 3. Follow the voice prompts and write down the responded 48-digit confirmation ID for OS activation. + 4. Run `slmgr.vbs /atp \`. + +For more information, see the information for Windows 7 in [Deploy KMS Activation](https://go.microsoft.com/fwlink/p/?LinkId=717032). + +## Key Management Service in Windows Server 2012 R2 + +Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Server 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista. + +> [!NOTE] +> You cannot install a client KMS key into the KMS in Windows Server. + +This scenario is commonly used in larger organizations that do not find the overhead of using a server a burden. + +> [!NOTE] +> If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [KB 3086418](https://go.microsoft.com/fwlink/p/?LinkId=620687). + +### Configure KMS in Windows Server 2012 R2 + +1. Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials. +2. Launch Server Manager. +3. Add the Volume Activation Services role, as shown in Figure 4. + + ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) + + **Figure 4**. Adding the Volume Activation Services role in Server Manager + +4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). + + ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) + + **Figure 5**. Launching the Volume Activation Tools + +5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). + This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. + + ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) + + **Figure 6**. Configuring the computer as a KMS host + +6. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). + + ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) + + **Figure 7**. Installing your KMS host key + +7. If asked to confirm replacement of an existing key, click **Yes**. +8. After the product key is installed, you must activate it. Click **Next** (Figure 8). + + ![Activating the software](../images/volumeactivationforwindows81-08.jpg) + + **Figure 8**. Activating the software + + The KMS key can be activated online or by phone. See Figure 9. + + ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) + + **Figure 9**. Choosing to activate online + +Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met. + +## Verifying the configuration of Key Management Service + +You can verify KMS volume activation from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message. + +> [!NOTE] +> If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. + +To verify that KMS volume activation works, complete the following steps: + +1. On the KMS host, open the event log and confirm that DNS publishing is successful. +2. On a client computer, open a Command Prompt window, type **Slmgr.vbs /ato**, and then press ENTER. + + The **/ato** command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information. +3. On a client computer or the KMS host, open an elevated Command Prompt window, type **Slmgr.vbs /dlv**, and then press ENTER. + + The **/dlv** command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This confirms that KMS is functioning correctly, even though the client has not been activated. + +For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](https://docs.microsoft.com/windows-server/get-started/activation-slmgr-vbs-options). + +## Key Management Service in earlier versions of Windows + +If you have already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps: + +1. Download and install the correct update for your current KMS host operating system. Restart the computer as directed. +2. Request a new KMS host key from the Volume Licensing Service Center. +3. Install the new KMS host key on your KMS host. +4. Activate the new KMS host key by running the slmgr.vbs script. + +For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](https://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=626590). + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) diff --git a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md index 0664a272c5..b88d65def4 100644 --- a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md +++ b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md @@ -1,127 +1,128 @@ ---- -title: Activate clients running Windows 10 (Windows 10) -description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. -ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Activate clients running Windows 10 - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. If the computer has been configured with a Generic Volume License Key (GVLK), neither IT nor the user need take any action. It just works. -Enterprise edition images and installation media should already be configured with the GVLK. When the client computer starts, the Licensing service examines the current licensing condition of the computer. -If activation or reactivation is required, the following sequence occurs: -1. If the computer is a member of a domain, it asks a domain controller for a volume activation object. If Active Directory-based activation is configured, the domain controller returns the object. If the object matches the edition of the software that is installed and the computer has a matching GVLK, the computer is activated (or reactivated), and it will not need to be activated again for 180 days, although the operating system will attempt reactivation at much shorter, regular intervals. -2. If the computer is not a member of a domain or if the volume activation object is not available, the computer will issue a DNS query to attempt to locate a KMS server. If a KMS server can be contacted, activation occurs if the KMS has a key that matches the computer’s GVLK. -3. The computer tries to activate against Microsoft servers if it is configured with a MAK. - -If the client is not able to activate itself successfully, it will periodically try again. The frequency of the retry attempts depends on the current licensing state and whether the client computer has been successfully activated in the past. For example, if the client computer had been previously activated by Active Directory-based activation, it will periodically try to contact the domain controller at each restart. - -## How Key Management Service works - -KMS uses a client–server topology. KMS client computers can locate KMS host computers by using DNS or a static configuration. KMS clients contact the KMS host by using RPCs carried over TCP/IP. - -### Key Management Service activation thresholds - -You can activate physical computers and virtual machines by contacting a KMS host. To qualify for KMS activation, there must be a minimum number of qualifying computers (called the activation threshold). KMS clients will be activated only after this threshold has been met. Each KMS host counts the number of computers that have requested activation until the threshold is met. - -A KMS host responds to each valid activation request from a KMS client with the count of how many computers have already contacted the KMS host for activation. Client computers that receive a count below the activation threshold are not activated. For example, if the first two computers that contact the KMS host are running Windows 10, the first receives an activation count of 1, and the second receives an activation count of 2. If the next computer is a virtual machine on a computer running Windows 10, it receives an activation count of 3, and so on. None of these computers will be activated, because computers running Windows 10, like other client operating system versions, must receive an activation count of 25 or more. -When KMS clients are waiting for the KMS to reach the activation threshold, they will connect to the KMS host every two hours to get the current activation count. They will be activated when the threshold is met. - -In our example, if the next computer that contacts the KMS host is running Windows Server 2012 R2, it receives an activation count of 4, because activation counts are cumulative. If a computer running Windows Server 2012 R2 receives an activation count that is 5 or more, it is activated. If a computer running Windows 10 receives an activation count of 25 or more, it is activated. - -### Activation count cache - -To track the activation threshold, the KMS host keeps a record of the KMS clients that request activation. The KMS host gives each KMS client a client ID designation, and the KMS host saves each client ID in a table. By default, each activation request remains in the table for up to 30 days. When a client renews its activation, the cached client ID is removed from the table, a new record is created, and the 30day period begins again. If a KMS client computer does not renew its activation within 30 days, the KMS host removes the corresponding client ID from the table and reduces the activation count by one. -However, the KMS host only caches twice the number of client IDs that are required to meet the activation threshold. Therefore, only the 50 most recent client IDs are kept in the table, and a client ID could be removed much sooner than 30 days. -The total size of the cache is set by the type of client computer that is attempting to activate. If a KMS host receives activation requests only from servers, the cache will hold only 10 client IDs (twice the required 5). If a client computer running Windows 10 contacts that KMS host, KMS increases the cache size to 50 to accommodate the higher threshold. KMS never reduces the cache size. - -### Key Management Service connectivity - -KMS activation requires TCP/IP connectivity. By default, KMS hosts and clients use DNS to publish and find the KMS. The default settings can be used, which require little or no administrative action, or KMS hosts and client computers can be manually configured based on network configuration and security requirements. - -### Key Management Service activation renewal - -KMS activations are valid for 180 days (the *activation validity interval*). To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every 7 days. If KMS activation fails, the client computer retries every two hours. After a client computer’s activation is renewed, the activation validity interval begins again. - -### Publication of the Key Management Service - -The KMS uses service (SRV) resource records in DNS to store and communicate the locations of KMS hosts. KMS hosts use the DNS dynamic update protocol, if available, to publish the KMS service (SRV) resource records. If dynamic update is not available or the KMS host does not have rights to publish the resource records, the DNS records must be published manually, or you must configure client computers to connect to specific KMS hosts. - -### Client discovery of the Key Management Service - -By default, KMS client computers query DNS for KMS information. The first time a KMS client computer queries DNS for KMS information, it randomly chooses a KMS host from the list of service (SRV) resource records that DNS returns. The address of a DNS server that contains the service (SRV) resource records can be listed as a suffixed entry on KMS client computers, which allows one DNS server to advertise the service (SRV) resource records for KMS, and KMS client computers with other primary DNS servers to find it. -Priority and weight parameters can be added to the DnsDomainPublishList registry value for KMS. Establishing KMS host priority groupings and weighting within each group allows you to specify which KMS host the client computers should try first and balances traffic among multiple KMS hosts. Only Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 provide these priority and weight parameters. -If the KMS host that a client computer selects does not respond, the KMS client computer removes that KMS host from its list of service (SRV) resource records and randomly selects another KMS host from the list. When a KMS host responds, the KMS client computer caches the name of the KMS host and uses it for subsequent activation and renewal attempts. If the cached KMS host does not respond on a subsequent renewal, the KMS client computer discovers a new KMS host by querying DNS for KMS service (SRV) resource records. -By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client computer sends a single request packet. The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client computer is activated and the session is closed. The KMS client computer uses this same process for renewal requests. 250 bytes are used for communication each way. - -### Domain Name System server configuration - -The default KMS automatic publishing feature requires the service (SRV) resource record and support for DNS dynamic update protocol. KMS client computer default behavior and the KMS service (SRV) resource record publishing are supported on a DNS server that is running Microsoft software or any other DNS server that supports service (SRV) resource records (per Internet Engineering Task Force \[IETF\] Request for Comments \[RFC\] 2782) and dynamic updates (per IETF RFC 2136). For example, Berkeley Internet Domain Name versions 8.x and 9.x support service (SRV) resource records and dynamic update. -The KMS host must be configured so that it has the credentials needed to create and update the following resource records on the DNS servers: service (SRV), IPv4 host (A), and IPv6 host (AAAA), or the records need to be created manually. The recommended solution for giving the KMS host the needed credentials is to create a security group in AD DS, then add all KMS hosts to that group. On a DNS server that is running Microsoft software, ensure that this security group is given full control over the \_VLMCS.\_TCP record in each DNS domain that will contain the KMS service (SRV) resource records. - -### Activating the first Key Management Service host - -KMS hosts on the network need to install a KMS key, and then be activated with Microsoft. Installation of a KMS key enables the KMS on the KMS host. After installing the KMS key, complete the activation of the KMS host by telephone or online. Beyond this initial activation, a KMS host does not communicate any information to Microsoft. KMS keys are only installed on KMS hosts, never on individual KMS client computers. - -### Activating subsequent Key Management Service hosts - -Each KMS key can be installed on up to six KMS hosts. These hosts can be physical computers or virtual machines. After activating a KMS host, the same host can be reactivated up to nine times with the same key. If the organization needs more than six KMS hosts, you can request additional activations for your organization’s KMS key by calling a Microsoft Volume [Licensing Activation Center](https://go.microsoft.com/fwlink/p/?LinkID=618264) to request an exception. - -## How Multiple Activation Key works - -A MAK is used for one-time activation with Microsoft’s hosted activation services. Each MAK has a predetermined number of allowed activations. This number is based on volume licensing agreements, and it might not match the organization’s exact license count. Each activation that uses a MAK with the Microsoft hosted activation service counts toward the activation limit. - -You can activate computers by using a MAK in two ways: -- **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. - - ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) - - **Figure 16**. MAK independent activation -- **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. - - ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) - - **Figure 17**. MAK proxy activation with the VAMT - -A MAK is recommended for computers that rarely or never connect to the corporate network and for environments in which the number of computers that require activation does not meet the KMS activation threshold. - -You can use a MAK for individual computers or with an image that can be duplicated or installed by using Microsoft deployment solutions. You can also use a MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment. - -### Multiple Activation Key architecture and activation - -MAK independent activation installs a MAK product key on a client computer. The key instructs that computer to activate itself with Microsoft servers over the Internet. -In MAK proxy activation, the VAMT installs a MAK product key on a client computer, obtains the installation ID from the target computer, sends the installation ID to Microsoft on behalf of the client, and obtains a confirmation ID. The tool then activates the client computer by installing the confirmation ID. - -## Activating as a standard user - -Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 do not require administrator privileges for activation, but this change does not allow standard user accounts to remove computers running Windows 7 or Windows Server 2008 R2 from the activated state. An administrator account is still required for other activation- or license-related tasks, such as “rearm.” - -## See also - -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  +--- +title: Activate clients running Windows 10 (Windows 10) +description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. +ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Activate clients running Windows 10 + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. If the computer has been configured with a Generic Volume License Key (GVLK), neither IT nor the user need take any action. It just works. +Enterprise edition images and installation media should already be configured with the GVLK. When the client computer starts, the Licensing service examines the current licensing condition of the computer. +If activation or reactivation is required, the following sequence occurs: +1. If the computer is a member of a domain, it asks a domain controller for a volume activation object. If Active Directory-based activation is configured, the domain controller returns the object. If the object matches the edition of the software that is installed and the computer has a matching GVLK, the computer is activated (or reactivated), and it will not need to be activated again for 180 days, although the operating system will attempt reactivation at much shorter, regular intervals. +2. If the computer is not a member of a domain or if the volume activation object is not available, the computer will issue a DNS query to attempt to locate a KMS server. If a KMS server can be contacted, activation occurs if the KMS has a key that matches the computer’s GVLK. +3. The computer tries to activate against Microsoft servers if it is configured with a MAK. + +If the client is not able to activate itself successfully, it will periodically try again. The frequency of the retry attempts depends on the current licensing state and whether the client computer has been successfully activated in the past. For example, if the client computer had been previously activated by Active Directory-based activation, it will periodically try to contact the domain controller at each restart. + +## How Key Management Service works + +KMS uses a client–server topology. KMS client computers can locate KMS host computers by using DNS or a static configuration. KMS clients contact the KMS host by using RPCs carried over TCP/IP. + +### Key Management Service activation thresholds + +You can activate physical computers and virtual machines by contacting a KMS host. To qualify for KMS activation, there must be a minimum number of qualifying computers (called the activation threshold). KMS clients will be activated only after this threshold has been met. Each KMS host counts the number of computers that have requested activation until the threshold is met. + +A KMS host responds to each valid activation request from a KMS client with the count of how many computers have already contacted the KMS host for activation. Client computers that receive a count below the activation threshold are not activated. For example, if the first two computers that contact the KMS host are running Windows 10, the first receives an activation count of 1, and the second receives an activation count of 2. If the next computer is a virtual machine on a computer running Windows 10, it receives an activation count of 3, and so on. None of these computers will be activated, because computers running Windows 10, like other client operating system versions, must receive an activation count of 25 or more. +When KMS clients are waiting for the KMS to reach the activation threshold, they will connect to the KMS host every two hours to get the current activation count. They will be activated when the threshold is met. + +In our example, if the next computer that contacts the KMS host is running Windows Server 2012 R2, it receives an activation count of 4, because activation counts are cumulative. If a computer running Windows Server 2012 R2 receives an activation count that is 5 or more, it is activated. If a computer running Windows 10 receives an activation count of 25 or more, it is activated. + +### Activation count cache + +To track the activation threshold, the KMS host keeps a record of the KMS clients that request activation. The KMS host gives each KMS client a client ID designation, and the KMS host saves each client ID in a table. By default, each activation request remains in the table for up to 30 days. When a client renews its activation, the cached client ID is removed from the table, a new record is created, and the 30day period begins again. If a KMS client computer does not renew its activation within 30 days, the KMS host removes the corresponding client ID from the table and reduces the activation count by one. +However, the KMS host only caches twice the number of client IDs that are required to meet the activation threshold. Therefore, only the 50 most recent client IDs are kept in the table, and a client ID could be removed much sooner than 30 days. +The total size of the cache is set by the type of client computer that is attempting to activate. If a KMS host receives activation requests only from servers, the cache will hold only 10 client IDs (twice the required 5). If a client computer running Windows 10 contacts that KMS host, KMS increases the cache size to 50 to accommodate the higher threshold. KMS never reduces the cache size. + +### Key Management Service connectivity + +KMS activation requires TCP/IP connectivity. By default, KMS hosts and clients use DNS to publish and find the KMS. The default settings can be used, which require little or no administrative action, or KMS hosts and client computers can be manually configured based on network configuration and security requirements. + +### Key Management Service activation renewal + +KMS activations are valid for 180 days (the *activation validity interval*). To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every 7 days. If KMS activation fails, the client computer retries every two hours. After a client computer’s activation is renewed, the activation validity interval begins again. + +### Publication of the Key Management Service + +The KMS uses service (SRV) resource records in DNS to store and communicate the locations of KMS hosts. KMS hosts use the DNS dynamic update protocol, if available, to publish the KMS service (SRV) resource records. If dynamic update is not available or the KMS host does not have rights to publish the resource records, the DNS records must be published manually, or you must configure client computers to connect to specific KMS hosts. + +### Client discovery of the Key Management Service + +By default, KMS client computers query DNS for KMS information. The first time a KMS client computer queries DNS for KMS information, it randomly chooses a KMS host from the list of service (SRV) resource records that DNS returns. The address of a DNS server that contains the service (SRV) resource records can be listed as a suffixed entry on KMS client computers, which allows one DNS server to advertise the service (SRV) resource records for KMS, and KMS client computers with other primary DNS servers to find it. +Priority and weight parameters can be added to the DnsDomainPublishList registry value for KMS. Establishing KMS host priority groupings and weighting within each group allows you to specify which KMS host the client computers should try first and balances traffic among multiple KMS hosts. Only Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 provide these priority and weight parameters. +If the KMS host that a client computer selects does not respond, the KMS client computer removes that KMS host from its list of service (SRV) resource records and randomly selects another KMS host from the list. When a KMS host responds, the KMS client computer caches the name of the KMS host and uses it for subsequent activation and renewal attempts. If the cached KMS host does not respond on a subsequent renewal, the KMS client computer discovers a new KMS host by querying DNS for KMS service (SRV) resource records. +By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client computer sends a single request packet. The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client computer is activated and the session is closed. The KMS client computer uses this same process for renewal requests. 250 bytes are used for communication each way. + +### Domain Name System server configuration + +The default KMS automatic publishing feature requires the service (SRV) resource record and support for DNS dynamic update protocol. KMS client computer default behavior and the KMS service (SRV) resource record publishing are supported on a DNS server that is running Microsoft software or any other DNS server that supports service (SRV) resource records (per Internet Engineering Task Force \[IETF\] Request for Comments \[RFC\] 2782) and dynamic updates (per IETF RFC 2136). For example, Berkeley Internet Domain Name versions 8.x and 9.x support service (SRV) resource records and dynamic update. +The KMS host must be configured so that it has the credentials needed to create and update the following resource records on the DNS servers: service (SRV), IPv4 host (A), and IPv6 host (AAAA), or the records need to be created manually. The recommended solution for giving the KMS host the needed credentials is to create a security group in AD DS, then add all KMS hosts to that group. On a DNS server that is running Microsoft software, ensure that this security group is given full control over the \_VLMCS.\_TCP record in each DNS domain that will contain the KMS service (SRV) resource records. + +### Activating the first Key Management Service host + +KMS hosts on the network need to install a KMS key, and then be activated with Microsoft. Installation of a KMS key enables the KMS on the KMS host. After installing the KMS key, complete the activation of the KMS host by telephone or online. Beyond this initial activation, a KMS host does not communicate any information to Microsoft. KMS keys are only installed on KMS hosts, never on individual KMS client computers. + +### Activating subsequent Key Management Service hosts + +Each KMS key can be installed on up to six KMS hosts. These hosts can be physical computers or virtual machines. After activating a KMS host, the same host can be reactivated up to nine times with the same key. If the organization needs more than six KMS hosts, you can request additional activations for your organization’s KMS key by calling a Microsoft Volume [Licensing Activation Center](https://go.microsoft.com/fwlink/p/?LinkID=618264) to request an exception. + +## How Multiple Activation Key works + +A MAK is used for one-time activation with Microsoft’s hosted activation services. Each MAK has a predetermined number of allowed activations. This number is based on volume licensing agreements, and it might not match the organization’s exact license count. Each activation that uses a MAK with the Microsoft hosted activation service counts toward the activation limit. + +You can activate computers by using a MAK in two ways: +- **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. + + ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) + + **Figure 16**. MAK independent activation +- **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. + + ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) + + **Figure 17**. MAK proxy activation with the VAMT + +A MAK is recommended for computers that rarely or never connect to the corporate network and for environments in which the number of computers that require activation does not meet the KMS activation threshold. + +You can use a MAK for individual computers or with an image that can be duplicated or installed by using Microsoft deployment solutions. You can also use a MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment. + +### Multiple Activation Key architecture and activation + +MAK independent activation installs a MAK product key on a client computer. The key instructs that computer to activate itself with Microsoft servers over the Internet. +In MAK proxy activation, the VAMT installs a MAK product key on a client computer, obtains the installation ID from the target computer, sends the installation ID to Microsoft on behalf of the client, and obtains a confirmation ID. The tool then activates the client computer by installing the confirmation ID. + +## Activating as a standard user + +Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 do not require administrator privileges for activation, but this change does not allow standard user accounts to remove computers running Windows 7 or Windows Server 2008 R2 from the activated state. An administrator account is still required for other activation- or license-related tasks, such as “rearm.” + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) +  +  diff --git a/windows/deployment/volume-activation/active-directory-based-activation-overview.md b/windows/deployment/volume-activation/active-directory-based-activation-overview.md index 581a2a317e..154b6e3b05 100644 --- a/windows/deployment/volume-activation/active-directory-based-activation-overview.md +++ b/windows/deployment/volume-activation/active-directory-based-activation-overview.md @@ -1,6 +1,6 @@ --- title: Active Directory-Based Activation Overview (Windows 10) -description: Active Directory-Based Activation Overview +description: Enable your enterprise to activate its computers through a connection to their domain using Active Directory-Based Activation (ADBA). ms.assetid: c1dac3bd-6a86-4c45-83dd-421e63a398c0 ms.reviewer: manager: laurawi diff --git a/windows/deployment/volume-activation/add-manage-products-vamt.md b/windows/deployment/volume-activation/add-manage-products-vamt.md index 255bda4716..fe607d6482 100644 --- a/windows/deployment/volume-activation/add-manage-products-vamt.md +++ b/windows/deployment/volume-activation/add-manage-products-vamt.md @@ -1,30 +1,31 @@ ---- -title: Add and Manage Products (Windows 10) -description: Add and Manage Products -ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Manage Products - -This section describes how to add client computers into the Volume Activation Management Tool (VAMT). After the computers are added, you can manage the products that are installed on your network. - -## In this Section - -|Topic |Description | -|------|------------| -|[Add and Remove Computers](add-remove-computers-vamt.md) |Describes how to add client computers to VAMT. | -|[Update Product Status](update-product-status-vamt.md) |Describes how to update the status of product license. | -|[Remove Products](remove-products-vamt.md) |Describes how to remove a product from the product list. | - - - +--- +title: Add and Manage Products (Windows 10) +description: Add client computers into the Volume Activation Management Tool (VAMT). After you add the computers, you can manage the products that are installed on your network. +ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Manage Products + +This section describes how to add client computers into the Volume Activation Management Tool (VAMT). After the computers are added, you can manage the products that are installed on your network. + +## In this Section + +|Topic |Description | +|------|------------| +|[Add and Remove Computers](add-remove-computers-vamt.md) |Describes how to add client computers to VAMT. | +|[Update Product Status](update-product-status-vamt.md) |Describes how to update the status of product license. | +|[Remove Products](remove-products-vamt.md) |Describes how to remove a product from the product list. | + + + diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md index 0784cbb98a..4e2248db96 100644 --- a/windows/deployment/volume-activation/add-remove-computers-vamt.md +++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md @@ -1,63 +1,64 @@ ---- -title: Add and Remove Computers (Windows 10) -description: Add and Remove Computers -ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.pagetype: activation -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Remove Computers - -You can add computers that have any of the supported Windows or Office products installed to a Volume Activation Management Tool (VAMT) database by using the **Discover products** function. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. You can remove computers from a VAMT database by using the **Delete** function. After you add the computers, you can add the products that are installed on the computers by running the **Update license status** function. - -Before adding computers, ensure that the Windows Management Instrumentation (WMI) firewall exception required by VAMT has been enabled on all target computers. For more information see [Configure Client Computers](configure-client-computers-vamt.md). - -## To add computers to a VAMT database - -1. Open VAMT. -2. Click **Discover products** in the **Actions** menu in the right-side pane to open the **Discover Products** dialog box. -3. In the **Discover products** dialog box, click **Search for computers in the Active Directory** to display the search options, then click the search option you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. - - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**, then under **Domain Filter Criteria**, in the list of domain names click the name of the domain you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search by individual computer name or IP address, click **Manually enter name or IP address**, then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. - - To search for computers in a workgroup, click **Search for computers in the workgroup**, then under **Workgroup Filter Criteria**, in the list of workgroup names click the name of the workgroup you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box provided. VAMT will validate only the LDAP query syntax, but will otherwise run the query without further checks. -4. Click **Search**. -5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. - To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. - - ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) - - **Important**   - This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. - -## To add products to VAMT - -1. In the **Products** list, select the computers that need to have their product information added to the VAMT database. -2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. -6. VAMT displays the **Collecting product information** dialog box while it collects the licensing status of all supported products on the selected computers. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. - - **Note**   - If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. - -## To remove computers from a VAMT database - -You can delete a computer by clicking on it in the product list view, and then clicking **Delete** in the **Selected Item** menu in the right-hand pane. In the **Confirm Delete Selected Products** dialog box that appears, click **Yes** to delete the computer. If a computer has multiple products listed, you must delete each product to completely remove the computer from the VAMT database. - -## Related topics - -- [Add and Manage Products](add-manage-products-vamt.md) - - +--- +title: Add and Remove Computers (Windows 10) +description: The Discover products function on the Volume Activation Management Tool (VAMT) allows you to search the Active Directory domain or a general LDAP query. +ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.pagetype: activation +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Remove Computers + +You can add computers that have any of the supported Windows or Office products installed to a Volume Activation Management Tool (VAMT) database by using the **Discover products** function. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. You can remove computers from a VAMT database by using the **Delete** function. After you add the computers, you can add the products that are installed on the computers by running the **Update license status** function. + +Before adding computers, ensure that the Windows Management Instrumentation (WMI) firewall exception required by VAMT has been enabled on all target computers. For more information see [Configure Client Computers](configure-client-computers-vamt.md). + +## To add computers to a VAMT database + +1. Open VAMT. +2. Click **Discover products** in the **Actions** menu in the right-side pane to open the **Discover Products** dialog box. +3. In the **Discover products** dialog box, click **Search for computers in the Active Directory** to display the search options, then click the search option you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. + - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**, then under **Domain Filter Criteria**, in the list of domain names click the name of the domain you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search by individual computer name or IP address, click **Manually enter name or IP address**, then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. + - To search for computers in a workgroup, click **Search for computers in the workgroup**, then under **Workgroup Filter Criteria**, in the list of workgroup names click the name of the workgroup you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box provided. VAMT will validate only the LDAP query syntax, but will otherwise run the query without further checks. +4. Click **Search**. +5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. + To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. + + ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) + + **Important**   + This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. + +## To add products to VAMT + +1. In the **Products** list, select the computers that need to have their product information added to the VAMT database. +2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. +6. VAMT displays the **Collecting product information** dialog box while it collects the licensing status of all supported products on the selected computers. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. + + **Note**   + If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + +## To remove computers from a VAMT database + +You can delete a computer by clicking on it in the product list view, and then clicking **Delete** in the **Selected Item** menu in the right-hand pane. In the **Confirm Delete Selected Products** dialog box that appears, click **Yes** to delete the computer. If a computer has multiple products listed, you must delete each product to completely remove the computer from the VAMT database. + +## Related topics + +- [Add and Manage Products](add-manage-products-vamt.md) + + diff --git a/windows/deployment/volume-activation/add-remove-product-key-vamt.md b/windows/deployment/volume-activation/add-remove-product-key-vamt.md index fc7b9b051d..dc8aedf5f2 100644 --- a/windows/deployment/volume-activation/add-remove-product-key-vamt.md +++ b/windows/deployment/volume-activation/add-remove-product-key-vamt.md @@ -1,39 +1,40 @@ ---- -title: Add and Remove a Product Key (Windows 10) -description: Add and Remove a Product Key -ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Remove a Product Key - -Before you can use a Multiple Activation Key (MAK), retail, or KMS Host key (CSVLK) product key, you must first add it to the Volume Activation Management Tool (VAMT) database. - -## To Add a Product Key - -1. Open VAMT. -2. In the left-side pane, right-click the **Product Keys** node to open the **Actions** menu. -3. Click **Add product keys** to open the **Add Product Keys** dialog box. -4. In the **Add Product Keys** dialog box, select from one of the following methods to add product keys: - - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys separated by line breaks, and click **Add Key(s)**. - - To import a Comma Separated Values (CSV) file containing a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. - - **Note**   - If you are activating a large number of products with a MAK, you should refresh the activation count of the MAK, to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. - -## Remove a Product Key - -- To remove a product key from the list, simply select the key in the list and click **Delete** on the **Selected Items** menu in the right-side pane. Click **Yes** to confirm deletion of the product key. Removing a product key from the VAMT database will not affect the activation state of any products or computers on the network. - -## Related topics - -- [Manage Product Keys](manage-product-keys-vamt.md) +--- +title: Add and Remove a Product Key (Windows 10) +description: Add a product key to the Volume Activation Management Tool (VAMT) database. Also, learn how to remove the key from the database. +ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Remove a Product Key + +Before you can use a Multiple Activation Key (MAK), retail, or KMS Host key (CSVLK) product key, you must first add it to the Volume Activation Management Tool (VAMT) database. + +## To Add a Product Key + +1. Open VAMT. +2. In the left-side pane, right-click the **Product Keys** node to open the **Actions** menu. +3. Click **Add product keys** to open the **Add Product Keys** dialog box. +4. In the **Add Product Keys** dialog box, select from one of the following methods to add product keys: + - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys separated by line breaks, and click **Add Key(s)**. + - To import a Comma Separated Values (CSV) file containing a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + + **Note**   + If you are activating a large number of products with a MAK, you should refresh the activation count of the MAK, to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. + +## Remove a Product Key + +- To remove a product key from the list, simply select the key in the list and click **Delete** on the **Selected Items** menu in the right-side pane. Click **Yes** to confirm deletion of the product key. Removing a product key from the VAMT database will not affect the activation state of any products or computers on the network. + +## Related topics + +- [Manage Product Keys](manage-product-keys-vamt.md) diff --git a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md index d56ff58a30..19d405b786 100644 --- a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md +++ b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md @@ -1,71 +1,72 @@ ---- -title: Appendix Information sent to Microsoft during activation (Windows 10) -ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 -ms.reviewer: -manager: laurawi -ms.author: greglin -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Appendix: Information sent to Microsoft during activation -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -When you activate a computer running Windows 10, the following information is sent to Microsoft: - -- The Microsoft product code (a five-digit code that identifies the Windows product you are activating) -- A channel ID or site code that identifies how the Windows product was originally obtained - - For example, a channel ID or site code identifies whether the product was originally purchased from a retail store, obtained as an evaluation copy, obtained through a volume licensing program, or preinstalled by a computer manufacturer. - -- The date of installation and whether the installation was successful -- Information that helps confirm that your Windows product key has not been altered -- Computer make and model -- Version information for the operating system and software -- Region and language settings -- A unique number called a *globally unique identifier*, which is assigned to your computer -- Product key (hashed) and product ID -- BIOS name, revision number, and revision date -- Volume serial number (hashed) of the hard disk drive -- The result of the activation check - - This includes error codes and the following information about any activation exploits and related malicious or unauthorized software that was found or disabled: - - - The activation exploit’s identifier - - The activation exploit’s current state, such as cleaned or quarantined - - Computer manufacturer’s identification - - The activation exploit’s file name and hash in addition to a hash of related software components that may indicate the presence of an activation exploit -- The name and a hash of the contents of your computer’s startup instructions file -- If your Windows license is on a subscription basis, information about how your subscription works - -Standard computer information is also sent, but your computer’s IP address is only retained temporarily. - -## Use of information - -Microsoft uses the information to confirm that you have a licensed copy of the software. Microsoft does not use the information to contact individual consumers. -For additional details, see [Windows 10 Privacy Statement](https://go.microsoft.com/fwlink/p/?LinkId=619879). - -## See also - -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  +--- +title: Appendix Information sent to Microsoft during activation (Windows 10) +ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 +ms.reviewer: +manager: laurawi +ms.author: greglin +description: +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Appendix: Information sent to Microsoft during activation +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +When you activate a computer running Windows 10, the following information is sent to Microsoft: + +- The Microsoft product code (a five-digit code that identifies the Windows product you are activating) +- A channel ID or site code that identifies how the Windows product was originally obtained + + For example, a channel ID or site code identifies whether the product was originally purchased from a retail store, obtained as an evaluation copy, obtained through a volume licensing program, or preinstalled by a computer manufacturer. + +- The date of installation and whether the installation was successful +- Information that helps confirm that your Windows product key has not been altered +- Computer make and model +- Version information for the operating system and software +- Region and language settings +- A unique number called a *globally unique identifier*, which is assigned to your computer +- Product key (hashed) and product ID +- BIOS name, revision number, and revision date +- Volume serial number (hashed) of the hard disk drive +- The result of the activation check + + This includes error codes and the following information about any activation exploits and related malicious or unauthorized software that was found or disabled: + + - The activation exploit’s identifier + - The activation exploit’s current state, such as cleaned or quarantined + - Computer manufacturer’s identification + - The activation exploit’s file name and hash in addition to a hash of related software components that may indicate the presence of an activation exploit +- The name and a hash of the contents of your computer’s startup instructions file +- If your Windows license is on a subscription basis, information about how your subscription works + +Standard computer information is also sent, but your computer’s IP address is only retained temporarily. + +## Use of information + +Microsoft uses the information to confirm that you have a licensed copy of the software. Microsoft does not use the information to contact individual consumers. +For additional details, see [Windows 10 Privacy Statement](https://go.microsoft.com/fwlink/p/?LinkId=619879). + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) +  +  diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index 6b80a72d89..952db8ab4a 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -1,17 +1,17 @@ --- title: Configure Client Computers (Windows 10) -description: Configure Client Computers +description: Learn how to configure client computers to enable the Volume Activation Management Tool (VAMT) to function correctly. ms.assetid: a48176c9-b05c-4dd5-a9ef-83073e2370fc ms.reviewer: manager: laurawi +author: greg-lindsay ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation audience: itpro -author: greg-lindsay -ms.date: 04/25/2017 +ms.date: 04/30/2020 ms.topic: article --- @@ -19,26 +19,27 @@ ms.topic: article To enable the Volume Activation Management Tool (VAMT) to function correctly, certain configuration changes are required on all client computers: -- An exception must be set in the client computer's firewall. -- A registry key must be created and set properly, for computers in a workgroup; otherwise, Windows® User Account Control (UAC) will not allow remote administrative operations. +- An exception must be set in the client computer's firewall. +- A registry key must be created and set properly, for computers in a workgroup; otherwise, Windows® User Account Control (UAC) will not allow remote administrative operations. Organizations where the VAMT will be widely used may benefit from making these changes inside the master image for Windows. -**Important**   -This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](https://go.microsoft.com/fwlink/p/?LinkId=182933). +> [IMPORTANT] +> This procedure only applies to clients running Windows Vista or later. For clients running Windows XP Service Pack 1, see [Connecting Through Windows Firewall](https://docs.microsoft.com/windows/win32/wmisdk/connecting-to-wmi-remotely-with-vbscript). ## Configuring the Windows Firewall to allow VAMT access Enable the VAMT to access client computers using the **Windows Firewall** Control Panel: -1. Open Control Panel and double-click **System and Security**. -2. Click **Windows Firewall**. -3. Click **Allow a program or feature through Windows Firewall**. -4. Click the **Change settings** option. -5. Select the **Windows Management Instrumentation (WMI)** checkbox. -6. Click **OK**. - **Warning**   - By default, Windows Firewall Exceptions only apply to traffic originating on the local subnet. To expand the exception to apply to multiple subnets, you need to change the exception settings in the Windows Firewall with Advanced Security, as described below. +1. Open Control Panel and double-click **System and Security**. +2. Click **Windows Firewall**. +3. Click **Allow a program or feature through Windows Firewall**. +4. Click the **Change settings** option. +5. Select the **Windows Management Instrumentation (WMI)** checkbox. +6. Click **OK**. + + **Warning**   + By default, Windows Firewall Exceptions only apply to traffic originating on the local subnet. To expand the exception to apply to multiple subnets, you need to change the exception settings in the Windows Firewall with Advanced Security, as described below. ## Configure Windows Firewall to allow VAMT access across multiple subnets @@ -46,50 +47,54 @@ Enable the VAMT to access client computers across multiple subnets using the **W ![VAMT Firewall configuration for multiple subnets](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) -1. Open the Control Panel and double-click **Administrative Tools**. -2. Click **Windows Firewall with Advanced Security**. -3. Make your changes for each of the following three WMI items, for the applicable Network Profile (Domain, Public, Private): - - Windows Management Instrumentation (ASync-In) - - Windows Management Instrumentation (DCOM-In) - - Windows Management Instrumentation (WMI-In) +1. Open the Control Panel and double-click **Administrative Tools**. +2. Click **Windows Firewall with Advanced Security**. +3. Make your changes for each of the following three WMI items, for the applicable Network Profile (Domain, Public, Private): + + - Windows Management Instrumentation (ASync-In) + - Windows Management Instrumentation (DCOM-In) + - Windows Management Instrumentation (WMI-In) 4. In the **Windows Firewall with Advanced Security** dialog box, select **Inbound Rules** from the left-hand panel. - + 5. Right-click the desired rule and select **Properties** to open the **Properties** dialog box. - - - On the **General** tab, select the **Allow the connection** checkbox. - - On the **Scope** tab, change the Remote IP Address setting from "Local Subnet" (default) to allow the specific access you need. - - On the **Advanced** tab, verify selection of all profiles that are applicable to the network (Domain or Private/Public). + + - On the **General** tab, select the **Allow the connection** checkbox. + - On the **Scope** tab, change the Remote IP Address setting from "Local Subnet" (default) to allow the specific access you need. + - On the **Advanced** tab, verify selection of all profiles that are applicable to the network (Domain or Private/Public). -In certain scenarios, only a limited set of TCP/IP ports are allowed through a hardware firewall. Administrators must ensure that WMI (which relies on RPC over TCP/IP) is allowed through these types of firewalls. By default, the WMI port is a dynamically allocated random port above 1024. The following Microsoft knowledge article discusses how administrators can limit the range of dynamically-allocated ports. This is useful if, for example, the hardware firewall only allows traffic in a certain range of ports. -For more info, see [How to configure RPC dynamic port allocation to work with firewalls](https://go.microsoft.com/fwlink/p/?LinkId=182911). + In certain scenarios, only a limited set of TCP/IP ports are allowed through a hardware firewall. Administrators must ensure that WMI (which relies on RPC over TCP/IP) is allowed through these types of firewalls. By default, the WMI port is a dynamically allocated random port above 1024. The following Microsoft knowledge article discusses how administrators can limit the range of dynamically-allocated ports. This is useful if, for example, the hardware firewall only allows traffic in a certain range of ports. + + For more info, see [How to configure RPC dynamic port allocation to work with firewalls](https://support.microsoft.com/help/929851). ## Create a registry value for the VAMT to access workgroup-joined computer -**Caution**   -This section contains information about how to modify the registry. Make sure to back up the registry before you modify it; in addition, ensure that you know how to restore the registry, if a problem occurs. For more information about how to back up, restore, and modify the registry, see [Windows registry information for advanced users](https://go.microsoft.com/fwlink/p/?LinkId=182912). +> [WARNING]   +> This section contains information about how to modify the registry. Make sure to back up the registry before you modify it; in addition, ensure that you know how to restore the registry, if a problem occurs. For more information about how to back up, restore, and modify the registry, see [Windows registry information for advanced users](https://support.microsoft.com/help/256986). On the client computer, create the following registry key using regedit.exe. -1. Navigate to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system` -2. Enter the following details: - **Value Name: LocalAccountTokenFilterPolicy** - **Type: DWORD** - **Value Data: 1** - **Note**   - To discover VAMT-manageable Windows computers in workgroups, you must enable network discovery on each client. +1. Navigate to `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system` +2. Enter the following details: + + - **Value Name: LocalAccountTokenFilterPolicy** + - **Type: DWORD** + - **Value Data: 1** + + > [NOTE] + > To discover VAMT-manageable Windows computers in workgroups, you must enable network discovery on each client. ## Deployment options There are several options for organizations to configure the WMI firewall exception for computers: -- **Image.** Add the configurations to the master Windows image deployed to all clients. -- **Group Policy.** If the clients are part of a domain, then all clients can be configured using Group Policy. The Group Policy setting for the WMI firewall exception is found in GPMC.MSC at: **Computer Configuration\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security\\Windows Firewall with Advanced Security\\Inbound Rules**. -- **Script.** Execute a script using Microsoft Endpoint Configuration Manager or a third-party remote script execution facility. -- **Manual.** Configure the WMI firewall exception individually on each client. + +- **Image.** Add the configurations to the master Windows image deployed to all clients. +- **Group Policy.** If the clients are part of a domain, then all clients can be configured using Group Policy. The Group Policy setting for the WMI firewall exception is found in GPMC.MSC at: **Computer Configuration\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security\\Windows Firewall with Advanced Security\\Inbound Rules**. +- **Script.** Execute a script using Microsoft Endpoint Configuration Manager or a third-party remote script execution facility. +- **Manual.** Configure the WMI firewall exception individually on each client. + The above configurations will open an additional port through the Windows Firewall on target computers and should be performed on computers that are protected by a network firewall. In order to allow VAMT to query the up-to-date licensing status, the WMI exception must be maintained. We recommend administrators consult their network security policies and make clear decisions when creating the WMI exception. ## Related topics - [Install and Configure VAMT](install-configure-vamt.md) - - diff --git a/windows/deployment/volume-activation/import-export-vamt-data.md b/windows/deployment/volume-activation/import-export-vamt-data.md index 5b77d96564..502813e80e 100644 --- a/windows/deployment/volume-activation/import-export-vamt-data.md +++ b/windows/deployment/volume-activation/import-export-vamt-data.md @@ -1,51 +1,52 @@ ---- -title: Import and Export VAMT Data (Windows 10) -description: Import and Export VAMT Data -ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Import and Export VAMT Data - -You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. -You can import data or export data during the following scenarios: -- Import and merge data from previous versions of VAMT. -- Export data to use to perform proxy activations. - -**Warning**   -Editing a .cilx file using an application other than VAMT can corrupt the .cilx file and is not supported. - -## Import VAMT Data - -**To import data into VAMT** -1. Open VAMT. -2. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. -3. In the **Import List** dialog box, navigate to the .cilx file location, select the file, and click **Open**. -4. In the **Volume Activation Management Tool** dialog box, click **OK** to begin the import. VAMT displays a progress message while the file is being imported. Click **OK** when a message appears and confirms that the import has completed successfully. - -## Export VAMT Data - -Exporting VAMT data from a non-Internet-connected VAMT host computer is the first step of proxy activation using multiple VAMT hosts. To export product-activation data to a .cilx file: -1. In the left-side pane, you can click a product you want to export data for, or click **Products** if the list contains data for all products. -2. If you want to export only part of the data in a product list, in the product list view in the center pane select the products you want to export. -3. In the right-side **Actions** pane on, click **Export list** to open the **Export List** dialog box. -4. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file. -5. Under **Export options**, select one of the following data-type options: - - Export products and product keys - - Export products only - - Export proxy activation data only. Selecting this option ensures that the export contains only the licensing information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is checked. -6. If you have selected products to export, select the **Export selected product rows only** check box. -7. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. - -## Related topics - -- [Perform Proxy Activation](proxy-activation-vamt.md) +--- +title: Import and Export VAMT Data (Windows 10) +description: Learn how to use the Volume Activation Management Tool (VAMT) to import product-activation data from a .cilx or .cil file into SQL Server. +ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Import and Export VAMT Data + +You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. +You can import data or export data during the following scenarios: +- Import and merge data from previous versions of VAMT. +- Export data to use to perform proxy activations. + +**Warning**   +Editing a .cilx file using an application other than VAMT can corrupt the .cilx file and is not supported. + +## Import VAMT Data + +**To import data into VAMT** +1. Open VAMT. +2. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. +3. In the **Import List** dialog box, navigate to the .cilx file location, select the file, and click **Open**. +4. In the **Volume Activation Management Tool** dialog box, click **OK** to begin the import. VAMT displays a progress message while the file is being imported. Click **OK** when a message appears and confirms that the import has completed successfully. + +## Export VAMT Data + +Exporting VAMT data from a non-Internet-connected VAMT host computer is the first step of proxy activation using multiple VAMT hosts. To export product-activation data to a .cilx file: +1. In the left-side pane, you can click a product you want to export data for, or click **Products** if the list contains data for all products. +2. If you want to export only part of the data in a product list, in the product list view in the center pane select the products you want to export. +3. In the right-side **Actions** pane on, click **Export list** to open the **Export List** dialog box. +4. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file. +5. Under **Export options**, select one of the following data-type options: + - Export products and product keys + - Export products only + - Export proxy activation data only. Selecting this option ensures that the export contains only the licensing information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is checked. +6. If you have selected products to export, select the **Export selected product rows only** check box. +7. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. + +## Related topics + +- [Perform Proxy Activation](proxy-activation-vamt.md) diff --git a/windows/deployment/volume-activation/install-configure-vamt.md b/windows/deployment/volume-activation/install-configure-vamt.md index dc1c9eaa35..f4cff8a4da 100644 --- a/windows/deployment/volume-activation/install-configure-vamt.md +++ b/windows/deployment/volume-activation/install-configure-vamt.md @@ -1,34 +1,35 @@ ---- -title: Install and Configure VAMT (Windows 10) -description: Install and Configure VAMT -ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install and Configure VAMT - -This section describes how to install and configure the Volume Activation Management Tool (VAMT). - -## In this Section - -|Topic |Description | -|------|------------| -|[VAMT Requirements](vamt-requirements.md) |Provides system requirements for installing VAMT on a host computer. | -|[Install VAMT](install-vamt.md) |Describes how to get and install VAMT. | -|[Configure Client Computers](configure-client-computers-vamt.md) |Describes how to configure client computers on your network to work with VAMT. | - -## Related topics - -- [Introduction to VAMT](introduction-vamt.md) -  -  +--- +title: Install and Configure VAMT (Windows 10) +description: Learn how to install and configure the Volume Activation Management Tool (VAMT), and learn where to find information about the process. +ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install and Configure VAMT + +This section describes how to install and configure the Volume Activation Management Tool (VAMT). + +## In this Section + +|Topic |Description | +|------|------------| +|[VAMT Requirements](vamt-requirements.md) |Provides system requirements for installing VAMT on a host computer. | +|[Install VAMT](install-vamt.md) |Describes how to get and install VAMT. | +|[Configure Client Computers](configure-client-computers-vamt.md) |Describes how to configure client computers on your network to work with VAMT. | + +## Related topics + +- [Introduction to VAMT](introduction-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/install-kms-client-key-vamt.md b/windows/deployment/volume-activation/install-kms-client-key-vamt.md index 3fe43074c1..c0458d4963 100644 --- a/windows/deployment/volume-activation/install-kms-client-key-vamt.md +++ b/windows/deployment/volume-activation/install-kms-client-key-vamt.md @@ -1,43 +1,44 @@ ---- -title: Install a KMS Client Key (Windows 10) -description: Install a KMS Client Key -ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install a KMS Client Key - -You can use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. For example, if you are converting a MAK-activated product to KMS activation. - -**Note**   -By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. - -**To install a KMS Client key** -1. Open VAMT. -2. In the left-side pane click **Products** to open the product list view in the center pane. -3. In the products list view in the center pane, select the products that need to have GVLKs installed. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -7. The **Install Product Key** dialog box displays the keys that are available to be installed. -8. Select the **Automatically select an AD or KMS client key** option and then click **Install Key**. - - VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the product list view in the center pane. - -## Related topics - -- [Perform KMS Activation](kms-activation-vamt.md) +--- +title: Install a KMS Client Key (Windows 10) +description: Learn to use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. +ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install a KMS Client Key + +You can use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. For example, if you are converting a MAK-activated product to KMS activation. + +**Note**   +By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. + +**To install a KMS Client key** +1. Open VAMT. +2. In the left-side pane click **Products** to open the product list view in the center pane. +3. In the products list view in the center pane, select the products that need to have GVLKs installed. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +7. The **Install Product Key** dialog box displays the keys that are available to be installed. +8. Select the **Automatically select an AD or KMS client key** option and then click **Install Key**. + + VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the product list view in the center pane. + +## Related topics + +- [Perform KMS Activation](kms-activation-vamt.md) diff --git a/windows/deployment/volume-activation/install-product-key-vamt.md b/windows/deployment/volume-activation/install-product-key-vamt.md index 96908f97d1..d83feb6226 100644 --- a/windows/deployment/volume-activation/install-product-key-vamt.md +++ b/windows/deployment/volume-activation/install-product-key-vamt.md @@ -1,45 +1,46 @@ ---- -title: Install a Product Key (Windows 10) -description: Install a Product Key -ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install a Product Key - -You can use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). - -**To install a Product key** -1. Open VAMT. -2. In the left-side pane, click the product that you want to install keys onto. -3. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. -6. In the products list view in the center pane, sort the list if needed and then select the products that need to have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -7. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -8. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAK based on the selected products. You can select a recommended product key or a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key you want to install, click **Install Key**. Note that only one key can be installed at a time. -9. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the product list view in the center pane. - - **Note**   - Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct MAK or KMS Host key (CSVLK), see [How to Choose the Right - Volume License Key for Windows](https://go.microsoft.com/fwlink/p/?linkid=238382). - -## Related topics - -- [Manage Product Keys](manage-product-keys-vamt.md) - - +--- +title: Install a Product Key (Windows 10) +description: Learn to use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). +ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install a Product Key + +You can use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). + +**To install a Product key** +1. Open VAMT. +2. In the left-side pane, click the product that you want to install keys onto. +3. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. +6. In the products list view in the center pane, sort the list if needed and then select the products that need to have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +7. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +8. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAK based on the selected products. You can select a recommended product key or a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key you want to install, click **Install Key**. Note that only one key can be installed at a time. +9. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the product list view in the center pane. + + **Note**   + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct MAK or KMS Host key (CSVLK), see [How to Choose the Right + Volume License Key for Windows](https://go.microsoft.com/fwlink/p/?linkid=238382). + +## Related topics + +- [Manage Product Keys](manage-product-keys-vamt.md) + + diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 27951497ec..38d957f492 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -1,6 +1,6 @@ --- title: Install VAMT (Windows 10) -description: Install VAMT +description: Learn how to install Volume Activation Management Tool (VAMT) as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc ms.reviewer: manager: laurawi @@ -49,8 +49,8 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for ### Install VAMT using the ADK -1. Download and open the [Windows 10, version 1903 ADK](https://go.microsoft.com/fwlink/?linkid=2086042) package. -Reminder: There won't be new ADK release for 1909. +1. Download the latest version of [Windows 10 ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install). + If an older version is already installed, it is recommended to uninstall the older ADK and install the latest version. Existing VAMT data is maintained in the VAMT database. 2. Enter an install location or use the default path, and then select **Next**. 3. Select a privacy setting, and then select **Next**. 4. Accept the license terms. diff --git a/windows/deployment/volume-activation/introduction-vamt.md b/windows/deployment/volume-activation/introduction-vamt.md index 791d49e497..45619726e9 100644 --- a/windows/deployment/volume-activation/introduction-vamt.md +++ b/windows/deployment/volume-activation/introduction-vamt.md @@ -1,66 +1,69 @@ ---- -title: Introduction to VAMT (Windows 10) -description: Introduction to VAMT -ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Introduction to VAMT - -The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office®, and select other Microsoft products volume and retail activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in and can be installed on any computer that has one of the following Windows operating systems: Windows® 7, Windows 8, Windows 8.1, Windows 10,Windows Server 2008 R2, or Windows Server 2012. - -**Note**   -VAMT can be installed on, and can manage, physical or virtual instances. VAMT cannot detect whether or not the remote products are virtual. As long as the products can respond to Windows Management Instrumentation (WMI) calls, they will be discovered and activated. - -## In this Topic -- [Managing Multiple Activation Key (MAK) and Retail Activation](#bkmk-managingmak) -- [Managing Key Management Service (KMS) Activation](#bkmk-managingkms) -- [Enterprise Environment](#bkmk-enterpriseenvironment) -- [VAMT User Interface](#bkmk-userinterface) - -## Managing Multiple Activation Key (MAK) and Retail Activation - -You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios: -- **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. -- **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host. - -## Managing Key Management Service (KMS) Activation - -In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010. -VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types. - -## Enterprise Environment - -VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. - -![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) - -In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. -The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. - -## VAMT User Interface - -The following screenshot shows the VAMT graphical user interface. - -![VAMT user interface](images/vamtuserinterfaceupdated.jpg) - -VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: -- **Adding and removing computers.** You can use VAMT to discover computers in the local environment. VAMT can discover computers by querying AD DS, workgroups, by individual computer name or IP address, or via a general LDAP query. -- **Discovering products.** You can use VAMT to discover Windows, Windows Server, Office, and select other products installed on the client computers. -- **Monitoring activation status.** You can collect activation information about each product, including the last 5 characters of the product key being used, the current license state (such as Licensed, Grace, Unlicensed), and the product edition information. -- **Managing product keys.** You can store multiple product keys and use VAMT to install these keys to remote client products. You can also determine the number of activations remaining for MAKs. -- **Managing activation data.** VAMT stores activation data in a SQL database. VAMT can export this data to other VAMT hosts or to an archive in XML format. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) - - +--- +title: Introduction to VAMT (Windows 10) +description: VAMT enables administrators to automate and centrally manage the Windows, Microsoft Office, and select other Microsoft products volume and retail activation process. +ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Introduction to VAMT + +The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office®, and select other Microsoft products volume and retail activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in and can be installed on any computer that has one of the following Windows operating systems: Windows® 7, Windows 8, Windows 8.1, Windows 10,Windows Server 2008 R2, or Windows Server 2012. + +> [!NOTE] +> VAMT can be installed on, and can manage, physical or virtual instances. VAMT cannot detect whether or not the remote products are virtual. As long as the products can respond to Windows Management Instrumentation (WMI) calls, they will be discovered and activated. + +## In this Topic + +- [Managing Multiple Activation Key (MAK) and Retail Activation](#bkmk-managingmak) +- [Managing Key Management Service (KMS) Activation](#bkmk-managingkms) +- [Enterprise Environment](#bkmk-enterpriseenvironment) +- [VAMT User Interface](#bkmk-userinterface) + +## Managing Multiple Activation Key (MAK) and Retail Activation + +You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios: + +- **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. +- **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host. + +## Managing Key Management Service (KMS) Activation + +In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010.\ +VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types. + +## Enterprise Environment + +VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. + +![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) + +In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. +The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. + +## VAMT User Interface + +The following screenshot shows the VAMT graphical user interface. + +![VAMT user interface](images/vamtuserinterfaceupdated.jpg) + +VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: + +- **Adding and removing computers.** You can use VAMT to discover computers in the local environment. VAMT can discover computers by querying AD DS, workgroups, by individual computer name or IP address, or via a general LDAP query. +- **Discovering products.** You can use VAMT to discover Windows, Windows Server, Office, and select other products installed on the client computers. +- **Monitoring activation status.** You can collect activation information about each product, including the last 5 characters of the product key being used, the current license state (such as Licensed, Grace, Unlicensed), and the product edition information. +- **Managing product keys.** You can store multiple product keys and use VAMT to install these keys to remote client products. You can also determine the number of activations remaining for MAKs. +- **Managing activation data.** VAMT stores activation data in a SQL database. VAMT can export this data to other VAMT hosts or to an archive in XML format. + +## Related topics + +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) diff --git a/windows/deployment/volume-activation/kms-activation-vamt.md b/windows/deployment/volume-activation/kms-activation-vamt.md index d109d49ad1..7cd72c2a99 100644 --- a/windows/deployment/volume-activation/kms-activation-vamt.md +++ b/windows/deployment/volume-activation/kms-activation-vamt.md @@ -1,49 +1,50 @@ ---- -title: Perform KMS Activation (Windows 10) -description: Perform KMS Activation -ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform KMS Activation - -The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). You can use VAMT to activate Generic Volume Licensing Keys, or KMS client keys, on products accessible to VAMT. GVLKs are the default product keys used by the volume-license editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft Office 2010. GVLKs are already installed in volume-license editions of these products. - -## Requirements - -Before configuring KMS activation, ensure that your network and VAMT installation meet the following requirements: -- KMS host is set up and enabled. -- KMS clients can access the KMS host. -- VAMT is installed on a central computer with network access to all client computers. -- The products to be activated have been added to VAMT. For more information on adding product keys, see [Install a KMS Client Key](install-kms-client-key-vamt.md). -- VAMT has administrative permissions on all computers to be activated, and Windows Management Instrumentation (WMI) is accessible through the Windows Firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -## To configure devices for KMS activation - -**To configure devices for KMS activation** -1. Open VAMT. -2. If necessary, set up the KMS activation preferences. If you don’t need to set up the preferences, skip to step 6 in this procedure. Otherwise, continue to step 2. -3. To set up the preferences, on the menu bar click **View**, then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. -4. Under **Key Management Services host selection**, select one of the following options: - - **Find a KMS host automatically using DNS (default)**. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the Domain Name Service (DNS) to locate a KMS host and attempt activation. - - **Find a KMS host using DNS in this domain for supported products**. Enter the domain name. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the DNS in the specified domain to locate a KMS host and attempt activation. - - **Use specific KMS host**. Enter the KMS host name and KMS host port. For environments which do not use DNS for KMS host identification, VAMT sets the specified KMS host name and KMS host port on the target computer, and then instructs the computer to attempt activation with the specific KMS host. -5. Click **Apply**, and then click **OK** to close the **Volume Activation Management Tool Preferences** dialog box. -6. Select the products to be activated by selecting individual products in the product list view in the center pane. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box.In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -7. Click **Filter**. VAMT displays the filtered list in the center pane. -8. In the right-side pane, click **Activate** in the **Selected Items** menu, and then click **Volume activate**. -9. Click a credential option. Choose **Alternate credentials** only if you are activating products that require administrator credentials different from the ones you are currently using. -10. If you are supplying alternate credentials, at the prompt, type the appropriate user name and password and click **OK**. -VAMT displays the **Volume Activation** dialog box until it completes the requested action. When the process is finished, the updated activation status of each product appears in the product list view in the center pane. -  +--- +title: Perform KMS Activation (Windows 10) +description: The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). +ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform KMS Activation + +The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). You can use VAMT to activate Generic Volume Licensing Keys, or KMS client keys, on products accessible to VAMT. GVLKs are the default product keys used by the volume-license editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft Office 2010. GVLKs are already installed in volume-license editions of these products. + +## Requirements + +Before configuring KMS activation, ensure that your network and VAMT installation meet the following requirements: +- KMS host is set up and enabled. +- KMS clients can access the KMS host. +- VAMT is installed on a central computer with network access to all client computers. +- The products to be activated have been added to VAMT. For more information on adding product keys, see [Install a KMS Client Key](install-kms-client-key-vamt.md). +- VAMT has administrative permissions on all computers to be activated, and Windows Management Instrumentation (WMI) is accessible through the Windows Firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +## To configure devices for KMS activation + +**To configure devices for KMS activation** +1. Open VAMT. +2. If necessary, set up the KMS activation preferences. If you don’t need to set up the preferences, skip to step 6 in this procedure. Otherwise, continue to step 2. +3. To set up the preferences, on the menu bar click **View**, then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. +4. Under **Key Management Services host selection**, select one of the following options: + - **Find a KMS host automatically using DNS (default)**. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the Domain Name Service (DNS) to locate a KMS host and attempt activation. + - **Find a KMS host using DNS in this domain for supported products**. Enter the domain name. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the DNS in the specified domain to locate a KMS host and attempt activation. + - **Use specific KMS host**. Enter the KMS host name and KMS host port. For environments which do not use DNS for KMS host identification, VAMT sets the specified KMS host name and KMS host port on the target computer, and then instructs the computer to attempt activation with the specific KMS host. +5. Click **Apply**, and then click **OK** to close the **Volume Activation Management Tool Preferences** dialog box. +6. Select the products to be activated by selecting individual products in the product list view in the center pane. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box.In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +7. Click **Filter**. VAMT displays the filtered list in the center pane. +8. In the right-side pane, click **Activate** in the **Selected Items** menu, and then click **Volume activate**. +9. Click a credential option. Choose **Alternate credentials** only if you are activating products that require administrator credentials different from the ones you are currently using. +10. If you are supplying alternate credentials, at the prompt, type the appropriate user name and password and click **OK**. +VAMT displays the **Volume Activation** dialog box until it completes the requested action. When the process is finished, the updated activation status of each product appears in the product list view in the center pane. +  diff --git a/windows/deployment/volume-activation/local-reactivation-vamt.md b/windows/deployment/volume-activation/local-reactivation-vamt.md index 309dd5a702..727fe608a7 100644 --- a/windows/deployment/volume-activation/local-reactivation-vamt.md +++ b/windows/deployment/volume-activation/local-reactivation-vamt.md @@ -1,47 +1,48 @@ ---- -title: Perform Local Reactivation (Windows 10) -description: Perform Local Reactivation -ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Local Reactivation - -If you reinstall Windows® or Microsoft® Office 2010 on a computer that was initially activated using proxy activation (MAK, retail, or CSLVK (KMS host)), and have not made significant changes to the hardware, use this local reactivation procedure to reactivate the program on that computer. -Local reactivation relies upon data that was created during the initial proxy activation and stored in the Volume Activation Management Tool (VAMT) database. The database contains the installation ID (IID) and confirmation ID (Pending CID). Local reactivation uses this data to reapply the CID and reactivate those products. Reapplying the same CID conserves the remaining activations on the key. - -**Note**   -During the initial proxy activation, the CID is bound to a digital “fingerprint”, which is calculated from values assigned to several different hardware components in the computer. If the computer has had significant hardware changes, this fingerprint will no longer match the CID. In this case, you must obtain a new CID for the computer from Microsoft. - -## To Perform a Local Reactivation - -**To perform a local reactivation** -1. Open VAMT. Make sure that you are connected to the desired database. -2. In the left-side pane, click the product you want to reactivate to display the products list. -3. In the product list view in the center pane, select the desired products to be reactivated. You can sort the list by computer name by clicking on the **Computer Name** heading. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. In the right-side pane, click **Activate**, and then click **Apply Confirmation ID**. -7. Click a credential option. Choose **Alternate credentials** only if you are reactivating products that require administrator credentials different from the ones you are currently using. -8. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. - - VAMT displays the **Apply Confirmation ID** dialog box. - -10. If you are using a different product key than the product key used for initial activation, you must complete a new activation to obtain a new CID. -11. If you are activating a product that requires administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** check box. -12. Click **OK**. - -## Related topics - -- [Manage Activations](manage-activations-vamt.md) +--- +title: Perform Local Reactivation (Windows 10) +description: An initially activated a computer using scenarios like MAK, retail, or CSLVK (KMS host), can be reactivated with Volume Activation Management Tool (VAMT). +ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Local Reactivation + +If you reinstall Windows® or Microsoft® Office 2010 on a computer that was initially activated using proxy activation (MAK, retail, or CSLVK (KMS host)), and have not made significant changes to the hardware, use this local reactivation procedure to reactivate the program on that computer. +Local reactivation relies upon data that was created during the initial proxy activation and stored in the Volume Activation Management Tool (VAMT) database. The database contains the installation ID (IID) and confirmation ID (Pending CID). Local reactivation uses this data to reapply the CID and reactivate those products. Reapplying the same CID conserves the remaining activations on the key. + +**Note**   +During the initial proxy activation, the CID is bound to a digital “fingerprint”, which is calculated from values assigned to several different hardware components in the computer. If the computer has had significant hardware changes, this fingerprint will no longer match the CID. In this case, you must obtain a new CID for the computer from Microsoft. + +## To Perform a Local Reactivation + +**To perform a local reactivation** +1. Open VAMT. Make sure that you are connected to the desired database. +2. In the left-side pane, click the product you want to reactivate to display the products list. +3. In the product list view in the center pane, select the desired products to be reactivated. You can sort the list by computer name by clicking on the **Computer Name** heading. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. In the right-side pane, click **Activate**, and then click **Apply Confirmation ID**. +7. Click a credential option. Choose **Alternate credentials** only if you are reactivating products that require administrator credentials different from the ones you are currently using. +8. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. + + VAMT displays the **Apply Confirmation ID** dialog box. + +10. If you are using a different product key than the product key used for initial activation, you must complete a new activation to obtain a new CID. +11. If you are activating a product that requires administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** check box. +12. Click **OK**. + +## Related topics + +- [Manage Activations](manage-activations-vamt.md) diff --git a/windows/deployment/volume-activation/manage-activations-vamt.md b/windows/deployment/volume-activation/manage-activations-vamt.md index 318cd0cb65..e1e2f2151e 100644 --- a/windows/deployment/volume-activation/manage-activations-vamt.md +++ b/windows/deployment/volume-activation/manage-activations-vamt.md @@ -1,33 +1,34 @@ ---- -title: Manage Activations (Windows 10) -description: Manage Activations -ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage Activations - -This section describes how to activate a client computer, by using a variety of activation methods. - -## In this Section - -|Topic |Description | -|------|------------| -|[Perform Online Activation](online-activation-vamt.md) |Describes how to activate a client computer over the Internet. | -|[Perform Proxy Activation](proxy-activation-vamt.md) |Describes how to perform volume activation for client products that do not have Internet access. | -|[Perform KMS Activation](kms-activation-vamt.md) |Describes how perform volume activation using the Key Management Service (KMS). | -|[Perform Local Reactivation](local-reactivation-vamt.md) |Describes how to reactivate an operating system or Office program that was reinstalled. | -|[Activate an Active Directory Forest Online](activate-forest-vamt.md) |Describes how to use Active Directory-Based Activation to online activate an Active Directory forest. | -|[Activate by Proxy an Active Directory Forest](activate-forest-by-proxy-vamt.md) |Describes how to use Active Directory-Based Activation to proxy activate an Active Directory forest that is not connected to the Internet. | - - - +--- +title: Manage Activations (Windows 10) +description: Learn how to manage activations and how to activate a client computer by using a variety of activation methods. +ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage Activations + +This section describes how to activate a client computer, by using a variety of activation methods. + +## In this Section + +|Topic |Description | +|------|------------| +|[Perform Online Activation](online-activation-vamt.md) |Describes how to activate a client computer over the Internet. | +|[Perform Proxy Activation](proxy-activation-vamt.md) |Describes how to perform volume activation for client products that do not have Internet access. | +|[Perform KMS Activation](kms-activation-vamt.md) |Describes how perform volume activation using the Key Management Service (KMS). | +|[Perform Local Reactivation](local-reactivation-vamt.md) |Describes how to reactivate an operating system or Office program that was reinstalled. | +|[Activate an Active Directory Forest Online](activate-forest-vamt.md) |Describes how to use Active Directory-Based Activation to online activate an Active Directory forest. | +|[Activate by Proxy an Active Directory Forest](activate-forest-by-proxy-vamt.md) |Describes how to use Active Directory-Based Activation to proxy activate an Active Directory forest that is not connected to the Internet. | + + + diff --git a/windows/deployment/volume-activation/manage-product-keys-vamt.md b/windows/deployment/volume-activation/manage-product-keys-vamt.md index bedd50af8f..1eb0380671 100644 --- a/windows/deployment/volume-activation/manage-product-keys-vamt.md +++ b/windows/deployment/volume-activation/manage-product-keys-vamt.md @@ -1,29 +1,30 @@ ---- -title: Manage Product Keys (Windows 10) -description: Manage Product Keys -ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage Product Keys - -This section describes how to add and remove a product key from the Volume Activation Management Tool (VAMT). After you add a product key to VAMT, you can install that product key on a product or products you select in the VAMT database. -## In this Section - -|Topic |Description | -|------|------------| -|[Add and Remove a Product Key](add-remove-product-key-vamt.md) |Describes how to add a product key to the VAMT database. | -|[Install a Product Key](install-product-key-vamt.md) |Describes how to install a product key for specific product. | -|[Install a KMS Client Key](install-kms-client-key-vamt.md) |Describes how to install a GVLK (KMS client) key. | - - - +--- +title: Manage Product Keys (Windows 10) +description: In this article, learn how to add and remove a product key from the Volume Activation Management Tool (VAMT). +ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage Product Keys + +This section describes how to add and remove a product key from the Volume Activation Management Tool (VAMT). After you add a product key to VAMT, you can install that product key on a product or products you select in the VAMT database. +## In this Section + +|Topic |Description | +|------|------------| +|[Add and Remove a Product Key](add-remove-product-key-vamt.md) |Describes how to add a product key to the VAMT database. | +|[Install a Product Key](install-product-key-vamt.md) |Describes how to install a product key for specific product. | +|[Install a KMS Client Key](install-kms-client-key-vamt.md) |Describes how to install a GVLK (KMS client) key. | + + + diff --git a/windows/deployment/volume-activation/manage-vamt-data.md b/windows/deployment/volume-activation/manage-vamt-data.md index 7d068975cd..6f2f8b2dd0 100644 --- a/windows/deployment/volume-activation/manage-vamt-data.md +++ b/windows/deployment/volume-activation/manage-vamt-data.md @@ -1,25 +1,26 @@ ---- -title: Manage VAMT Data (Windows 10) -description: Manage VAMT Data -ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage VAMT Data - -This section describes how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). - -## In this Section -|Topic |Description | -|------|------------| -|[Import and Export VAMT Data](import-export-vamt-data.md) |Describes how to import and export VAMT data. | -|[Use VAMT in Windows PowerShell](use-vamt-in-windows-powershell.md) |Describes how to access Windows PowerShell and how to import the VAMT PowerShell module. | +--- +title: Manage VAMT Data (Windows 10) +description: Learn how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). +ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage VAMT Data + +This section describes how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). + +## In this Section +|Topic |Description | +|------|------------| +|[Import and Export VAMT Data](import-export-vamt-data.md) |Describes how to import and export VAMT data. | +|[Use VAMT in Windows PowerShell](use-vamt-in-windows-powershell.md) |Describes how to access Windows PowerShell and how to import the VAMT PowerShell module. | diff --git a/windows/deployment/volume-activation/monitor-activation-client.md b/windows/deployment/volume-activation/monitor-activation-client.md index ea131b996d..143855e843 100644 --- a/windows/deployment/volume-activation/monitor-activation-client.md +++ b/windows/deployment/volume-activation/monitor-activation-client.md @@ -1,44 +1,45 @@ ---- -title: Monitor activation (Windows 10) -ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 -ms.reviewer: -manager: laurawi -ms.author: greglin -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# Monitor activation - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -You can monitor the success of the activation process for a computer running Windows in several ways. The most popular methods include: -- Using the Volume Licensing Service Center website to track use of MAK keys. -- Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](https://technet.microsoft.com/library/ff793433.aspx).) -- Viewing the licensing status, which is exposed through Windows Management Instrumentation (WMI); therefore, it is available to non-Microsoft or custom tools that can access WMI. (Windows PowerShell can also access WMI information.) -- Most licensing actions and events are recorded in the Event log (ex: Application Log events 12288-12290). -- Microsoft System Center Operations Manager and the KMS Management Pack can provide insight and information to users of System Center Operations Manager. -- See [Troubleshooting activation error codes](https://docs.microsoft.com/windows-server/get-started/activation-error-codes) for information about troubleshooting procedures for Multiple Activation Key (MAK) or the Key Management Service (KMS). -- The VAMT provides a single site from which to manage and monitor volume activations. This is explained in the next section. - -## See also - -[Volume Activation for Windows 10](volume-activation-windows-10.md) +--- +title: Monitor activation (Windows 10) +ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 +ms.reviewer: +manager: laurawi +ms.author: greglin +description: +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Monitor activation + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +You can monitor the success of the activation process for a computer running Windows in several ways. The most popular methods include: +- Using the Volume Licensing Service Center website to track use of MAK keys. +- Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](https://technet.microsoft.com/library/ff793433.aspx).) +- Viewing the licensing status, which is exposed through Windows Management Instrumentation (WMI); therefore, it is available to non-Microsoft or custom tools that can access WMI. (Windows PowerShell can also access WMI information.) +- Most licensing actions and events are recorded in the Event log (ex: Application Log events 12288-12290). +- Microsoft System Center Operations Manager and the KMS Management Pack can provide insight and information to users of System Center Operations Manager. +- See [Troubleshooting activation error codes](https://docs.microsoft.com/windows-server/get-started/activation-error-codes) for information about troubleshooting procedures for Multiple Activation Key (MAK) or the Key Management Service (KMS). +- The VAMT provides a single site from which to manage and monitor volume activations. This is explained in the next section. + +## See also + +[Volume Activation for Windows 10](volume-activation-windows-10.md) diff --git a/windows/deployment/volume-activation/online-activation-vamt.md b/windows/deployment/volume-activation/online-activation-vamt.md index 45f237024f..96d0e8abdd 100644 --- a/windows/deployment/volume-activation/online-activation-vamt.md +++ b/windows/deployment/volume-activation/online-activation-vamt.md @@ -1,55 +1,56 @@ ---- -title: Perform Online Activation (Windows 10) -description: Perform Online Activation -ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Online Activation - -You can use the Volume Activation Management Tool (VAMT) to enable client products to be activated over the Internet. You can install the client products with any kind of product key that is eligible for online activation—Multiple Activation Key (MAK), retail, and Windows Key Management Services (KMS) host key. - -## Requirements - -Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: -- VAMT is installed on a central computer that has network access to all client computers. -- Both the VAMT host and client computers have Internet access. -- The products that you want to activate are added to VAMT. -- VAMT has administrative permissions on all computers that you intend to activate, and that Windows Management Instrumentation (WMI) can be accessed through the Windows firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking -**Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. - -## To Perform an Online Activation - -**To perform an online activation** -1. Open VAMT. -2. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. Select the products that you want to activate. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -6. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane and then point to **Activate**. If the **Actions** pane is not displayed, click the Show/Hide Action Pane button, which is located on the toolbar to the right of the Help button. -7. Point to **Online activate**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. -8. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the products list view in the center pane. - - **Note**   - Online activation does not enable you to save the Confirmation IDs (CIDs). As a result, you cannot perform local reactivation. - - **Note** - You can use online activation to select products that have different key types and activate the products at the same time. - -## Related topics -- [Manage Activations](manage-activations-vamt.md) +--- +title: Perform Online Activation (Windows 10) +description: Learn how to use the Volume Activation Management Tool (VAMT) to enable client products to be activated online. +ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Online Activation + +You can use the Volume Activation Management Tool (VAMT) to enable client products to be activated over the Internet. You can install the client products with any kind of product key that is eligible for online activation—Multiple Activation Key (MAK), retail, and Windows Key Management Services (KMS) host key. + +## Requirements + +Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: +- VAMT is installed on a central computer that has network access to all client computers. +- Both the VAMT host and client computers have Internet access. +- The products that you want to activate are added to VAMT. +- VAMT has administrative permissions on all computers that you intend to activate, and that Windows Management Instrumentation (WMI) can be accessed through the Windows firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking +**Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + +## To Perform an Online Activation + +**To perform an online activation** +1. Open VAMT. +2. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. Select the products that you want to activate. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +6. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane and then point to **Activate**. If the **Actions** pane is not displayed, click the Show/Hide Action Pane button, which is located on the toolbar to the right of the Help button. +7. Point to **Online activate**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. +8. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the products list view in the center pane. + + **Note**   + Online activation does not enable you to save the Confirmation IDs (CIDs). As a result, you cannot perform local reactivation. + + **Note** + You can use online activation to select products that have different key types and activate the products at the same time. + +## Related topics +- [Manage Activations](manage-activations-vamt.md) diff --git a/windows/deployment/volume-activation/proxy-activation-vamt.md b/windows/deployment/volume-activation/proxy-activation-vamt.md index ff4ab4c6f5..4c865c2d5b 100644 --- a/windows/deployment/volume-activation/proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/proxy-activation-vamt.md @@ -1,58 +1,59 @@ ---- -title: Perform Proxy Activation (Windows 10) -description: Perform Proxy Activation -ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Proxy Activation - -You can use the Volume Activation Management Tool (VAMT) to perform activation for client computers that do not have Internet access. The client products can be installed with any type of product key that is eligible for proxy activation: Multiple activation Key (MAK), KMS Host key (CSVLK), or retail key. - -In a typical proxy-activation scenario, the VAMT host computer distributes a MAK to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. Using this activation method, only the VAMT host computer needs Internet access. - -**Note**   -For workgroups that are completely isolated from any larger network, you can still perform MAK, KMS Host key (CSVLK), or retail proxy activation. This requires installing a second instance of VAMT on a computer within the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. For more information about this scenario, see [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md). Similarly, you can proxy activate a KMS Host key (CSVLK) located in an isolated network. You can also proxy activate a KMS Host key (CSVLK) in the core network if you do not want the KMS host computer to connect to Microsoft over the Internet.  - -## Requirements - -Before performing proxy activation, ensure that your network and the VAMT installation meet the following requirements: -- There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you also need to have VAMT installed on one of the computers in the workgroup. -- The products to be activated have been added to VAMT and are installed with a retail product key, a KMS Host key (CSVLK) or a MAK. If the products have not been installed with a proper product key, refer to the steps in the [Add and Remove a Product Key](add-remove-product-key-vamt.md) section for instructions on how to install a product key. -- VAMT has administrative permissions on all products to be activated and Windows Management Instrumentation (WMI) is accessible through the Windows firewall. -- For workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). -The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking **Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. - -## To Perform Proxy Activation - -**To perform proxy activation** - -1. Open VAMT. -2. If necessary, install product keys. For more information see: - - [Install a Product Key](install-product-key-vamt.md) to install retail, MAK, or KMS Host key (CSVLK). - - [Install a KMS Client Key](install-kms-client-key-vamt.md) to install GVLK (KMS client) keys. -3. In the **Products** list in the center pane, select the individual products to be activated. You can use the **Filter** function to narrow your search for products by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. In the right-side pane, click **Activate** and then click **Proxy activate** to open the **Proxy Activate** dialog box. -7. In the **Proxy Activate** dialog box click **Apply Confirmation ID, apply to selected machine(s) and activate**. -8. If you are activating products that require administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** checkbox. -9. Click **OK**. -10. VAMT displays the **Activating products** dialog box until it completes the requested action. If you selected the **Alternate Credentials** option, you will be prompted to enter the credentials. - - **Note**   - You can use proxy activation to select products that have different key types and activate the products at the same time. - - - +--- +title: Perform Proxy Activation (Windows 10) +description: Perform proxy activation by using the Volume Activation Management Tool (VAMT) to activate client computers that do not have Internet access. +ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Proxy Activation + +You can use the Volume Activation Management Tool (VAMT) to perform activation for client computers that do not have Internet access. The client products can be installed with any type of product key that is eligible for proxy activation: Multiple activation Key (MAK), KMS Host key (CSVLK), or retail key. + +In a typical proxy-activation scenario, the VAMT host computer distributes a MAK to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. Using this activation method, only the VAMT host computer needs Internet access. + +**Note**   +For workgroups that are completely isolated from any larger network, you can still perform MAK, KMS Host key (CSVLK), or retail proxy activation. This requires installing a second instance of VAMT on a computer within the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. For more information about this scenario, see [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md). Similarly, you can proxy activate a KMS Host key (CSVLK) located in an isolated network. You can also proxy activate a KMS Host key (CSVLK) in the core network if you do not want the KMS host computer to connect to Microsoft over the Internet.  + +## Requirements + +Before performing proxy activation, ensure that your network and the VAMT installation meet the following requirements: +- There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you also need to have VAMT installed on one of the computers in the workgroup. +- The products to be activated have been added to VAMT and are installed with a retail product key, a KMS Host key (CSVLK) or a MAK. If the products have not been installed with a proper product key, refer to the steps in the [Add and Remove a Product Key](add-remove-product-key-vamt.md) section for instructions on how to install a product key. +- VAMT has administrative permissions on all products to be activated and Windows Management Instrumentation (WMI) is accessible through the Windows firewall. +- For workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). +The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking **Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + +## To Perform Proxy Activation + +**To perform proxy activation** + +1. Open VAMT. +2. If necessary, install product keys. For more information see: + - [Install a Product Key](install-product-key-vamt.md) to install retail, MAK, or KMS Host key (CSVLK). + - [Install a KMS Client Key](install-kms-client-key-vamt.md) to install GVLK (KMS client) keys. +3. In the **Products** list in the center pane, select the individual products to be activated. You can use the **Filter** function to narrow your search for products by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. In the right-side pane, click **Activate** and then click **Proxy activate** to open the **Proxy Activate** dialog box. +7. In the **Proxy Activate** dialog box click **Apply Confirmation ID, apply to selected machine(s) and activate**. +8. If you are activating products that require administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** checkbox. +9. Click **OK**. +10. VAMT displays the **Activating products** dialog box until it completes the requested action. If you selected the **Alternate Credentials** option, you will be prompted to enter the credentials. + + **Note**   + You can use proxy activation to select products that have different key types and activate the products at the same time. + + + diff --git a/windows/deployment/volume-activation/remove-products-vamt.md b/windows/deployment/volume-activation/remove-products-vamt.md index 65dd923d7e..ce8b8c1e39 100644 --- a/windows/deployment/volume-activation/remove-products-vamt.md +++ b/windows/deployment/volume-activation/remove-products-vamt.md @@ -1,35 +1,36 @@ ---- -title: Remove Products (Windows 10) -description: Remove Products -ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Remove Products - -To remove one or more products from the Volume Activation Management Tool (VAMT), you can delete them from the product list view in the center pane. - -**To delete one or more products** -1. Click a product node in the left-side pane. -2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. Select the products you want to delete. -6. Click **Delete** in the **Selected Items** menu in the right-side pane. -7. On the **Confirm Delete Selected Products** dialog box, click **OK**. - -## Related topics -- [Add and Manage Products](add-manage-products-vamt.md) -  -  +--- +title: Remove Products (Windows 10) +description: Learn how you must delete products from the product list view so you can remove products from the Volume Activation Management Tool (VAMT). +ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Remove Products + +To remove one or more products from the Volume Activation Management Tool (VAMT), you can delete them from the product list view in the center pane. + +**To delete one or more products** +1. Click a product node in the left-side pane. +2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. Select the products you want to delete. +6. Click **Delete** in the **Selected Items** menu in the right-side pane. +7. On the **Confirm Delete Selected Products** dialog box, click **OK**. + +## Related topics +- [Add and Manage Products](add-manage-products-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md index 34263037b3..400b2ad2e1 100644 --- a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md @@ -1,48 +1,49 @@ ---- -title: Scenario 3 KMS Client Activation (Windows 10) -description: Scenario 3 KMS Client Activation -ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Scenario 3: KMS Client Activation - -In this scenario, you use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). This can be performed on either Core Network or Isolated Lab computers. By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. You do not have to enter a key to activate a product as a GVLK, unless you are converting a MAK-activated product to a KMS activation. For more information, see [Install a KMS Client Key](install-kms-client-key-vamt.md). - -The procedure that is described below assumes the following: -- The KMS Service is enabled and available to all KMS clients. -- VAMT has been installed and computers have been added to the VAMT database. See Parts 1 through 4 in either [Scenario 1: Online Activation](scenario-online-activation-vamt.md) or [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) for more information. - -## Activate KMS Clients - -1. Open VAMT. -2. To set the KMS activation options, on the menu bar click **View**. Then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. -3. In the **Volume Activation Management Tool Preferences** dialog box, under **KMS Management Services host selection** select from the following options: - - **Find a KMS host automatically using DNS**. This is the default setting. VAMT will instruct the computer to query the Domain Name Service (DNS) to locate a KMS host and perform activation. If the client contains a registry key with a valid KMS host, that value will be used instead. - - **Find a KMS host using DNS in this domain for supported products**. Select this option if you use a specific domain, and enter the name of the domain. - - **Use specific KMS host**. Select this option for environments which do not use DNS for KMS host identification, and manually enter the KMS host name and select the KMS host port. VAMT will set the specified KMS host name and KMS host port on the target computer, and then instruct the computer to perform activation with the specific KMS host. -4. In the left-side pane, in the **Products** node, click the product that you want to activate. -5. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -6. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -7. Click **Filter**. VAMT displays the filtered list in the center pane. -8. Select the products that you want to activate. -9. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane, click **Activate**, point to **Volume activate**, and then click the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. -10. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - -The same status is shown under the **Status of Last Action** column in the products list view in the center pane. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) -  -  +--- +title: Scenario 3 KMS Client Activation (Windows 10) +description: Learn how to use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). +ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Scenario 3: KMS Client Activation + +In this scenario, you use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). This can be performed on either Core Network or Isolated Lab computers. By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. You do not have to enter a key to activate a product as a GVLK, unless you are converting a MAK-activated product to a KMS activation. For more information, see [Install a KMS Client Key](install-kms-client-key-vamt.md). + +The procedure that is described below assumes the following: +- The KMS Service is enabled and available to all KMS clients. +- VAMT has been installed and computers have been added to the VAMT database. See Parts 1 through 4 in either [Scenario 1: Online Activation](scenario-online-activation-vamt.md) or [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) for more information. + +## Activate KMS Clients + +1. Open VAMT. +2. To set the KMS activation options, on the menu bar click **View**. Then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. +3. In the **Volume Activation Management Tool Preferences** dialog box, under **KMS Management Services host selection** select from the following options: + - **Find a KMS host automatically using DNS**. This is the default setting. VAMT will instruct the computer to query the Domain Name Service (DNS) to locate a KMS host and perform activation. If the client contains a registry key with a valid KMS host, that value will be used instead. + - **Find a KMS host using DNS in this domain for supported products**. Select this option if you use a specific domain, and enter the name of the domain. + - **Use specific KMS host**. Select this option for environments which do not use DNS for KMS host identification, and manually enter the KMS host name and select the KMS host port. VAMT will set the specified KMS host name and KMS host port on the target computer, and then instruct the computer to perform activation with the specific KMS host. +4. In the left-side pane, in the **Products** node, click the product that you want to activate. +5. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +6. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +7. Click **Filter**. VAMT displays the filtered list in the center pane. +8. Select the products that you want to activate. +9. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane, click **Activate**, point to **Volume activate**, and then click the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. +10. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + +The same status is shown under the **Status of Last Action** column in the products list view in the center pane. + +## Related topics +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) +  +  diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md index 865dbdf623..cf5d0b7c93 100644 --- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md @@ -1,136 +1,137 @@ ---- -title: Scenario 1 Online Activation (Windows 10) -description: Scenario 1 Online Activation -ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Scenario 1: Online Activation - -In this scenario, the Volume Activation Management Tool (VAMT) is deployed in the Core Network environment. VAMT is installed on a central computer that has network access to all of the client computers. Both the VAMT host and the client computers have Internet access. The following illustration shows a diagram of an online activation scenario for Multiple Activation Keys (MAKs). You can use this scenario for online activation of the following key types: -- Multiple Activation Key (MAK) -- Windows Key Management Service (KMS) keys: - - KMS Host key (CSVLK) - - Generic Volume License Key (GVLK), or KMS client key -- Retail -The Secure Zone represents higher-security Core Network computers that have additional firewall protection. - -![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) - -## In This Topic -- [Install and start VAMT on a networked host computer](#bkmk-partone) -- [Configure the Windows Management Instrumentation firewall exception on target computers](#bkmk-parttwo) -- [Connect to VAMT database](#bkmk-partthree) -- [Discover products](#bkmk-partfour) -- [Sort and filter the list of computers](#bkmk-partfive) -- [Collect status information from the computers in the list](#bkmk-partsix) -- [Add product keys and determine the remaining activation count](#bkmk-partseven) -- [Install the product keys](#bkmk-parteight) -- [Activate the client products](#bkmk-partnine) - -## Step 1: Install and start VAMT on a networked host computer - -1. Install VAMT on the host computer. -2. Click the VAMT icon in the **Start** menu to open VAMT. - -## Step 2: Configure the Windows Management Instrumentation firewall exception on target computers - -- Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - - **Note**   - To retrieve product license status, VAMT must have administrative permissions on the remote computers and WMI must be available through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -## Step 3: Connect to a VAMT database - -1. If you are not already connected to a database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database where the keys that must be activated are located. -2. Click **Connect**. -3. If you are already connected to a database, VAMT displays an inventory of the products and product keys in the center pane, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to Server** to open **the Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data](manage-vamt-data.md) - -## Step 4: Discover products - -1. In the left-side pane, in the **Products** node Products, click the product that you want to activate. -2. To open the **Discover Products** dialog box, click **Discover products** in the **Actions** menu in the right-side pane. -3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general Lightweight Directory Access Protocol (LDAP) query: - - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**. Then under **Domain Filter Criteria**, in the list of domain names click the name of the domain that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for specific computers in the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". - - To search by individual computer name or IP address, click **Manually enter name or IP address**. Then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. - - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. -4. Click **Search**. - - When the search is complete, the products that VAMT discovers appear in the product list view in the center pane. - -## Step 5: Sort and filter the list of computers - -You can sort the list of products so that it is easier to find the computers that require product keys to be activated: -1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. -2. To sort the list further, you can click one of the column headings to sort by that column. -3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. - -## Step 6: Collect status information from the computers in the list - -To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: -- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. -- To select computers which are not listed consecutively, hold down the **Ctrl** key and select each computer for which you want to collect the status information. - **To collect status information from the selected computers** -- In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box, type the appropriate user name and password and then click **OK**. -- VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. - - **Note** - If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. - -## Step 7: Add product keys and determine the remaining activation count - -1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. -2. In the **Add Product Key** dialog box, you can select from one of the following methods to add product keys: - - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add Key(s)**. - - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. - - The keys that you have added appear in the **Product Keys** list view in the center pane. - - **Important**   - If you are activating many products with a MAK, refresh the activation count of the MAK to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and then click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. - -## Step 8: Install the product keys - -1. In the left-side pane, click the product that you want to install keys on to. -2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and filter the list of computers](#bkmk-partfive). -3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you want to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. -6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status appears under the **Status of Last Action** column in the product list view in the center pane. - **Note**   - - Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](https://go.microsoft.com/fwlink/p/?linkid=238382) - -## Step 9: Activate the client products - -1. Select the individual products that you want to activate in the list-view pane. -2. On the menu bar, click **Action**, point to **Activate** and point to **Online activate**. You can also right-click the selected computers(s) to display the **Action** menu, point to **Activate** and point to **Online activate**. You can also click **Activate** in the **Selected Items** menu in the right-hand pane to access the **Activate** option. -3. If you are activating product keys using your current credential, click **Current credential** and continue to step 5. If you are activating products that require an administrator credential that is different from the one you are currently using, click the **Alternate credential** option. -4. Enter your alternate user name and password and click **OK**. -5. The **Activate** option contacts the Microsoft product-activation server over the Internet and requests activation for the selected products. VAMT displays the **Activating products** dialog box until the requested actions are completed. - - **Note**   - Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. - - RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and volume editions of Office 2010 will not enter RFM. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) - - +--- +title: Scenario 1 Online Activation (Windows 10) +description: Achieve network access by deploying the Volume Activation Management Tool (VAMT) in a Core Network environment. +ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Scenario 1: Online Activation + +In this scenario, the Volume Activation Management Tool (VAMT) is deployed in the Core Network environment. VAMT is installed on a central computer that has network access to all of the client computers. Both the VAMT host and the client computers have Internet access. The following illustration shows a diagram of an online activation scenario for Multiple Activation Keys (MAKs). You can use this scenario for online activation of the following key types: +- Multiple Activation Key (MAK) +- Windows Key Management Service (KMS) keys: + - KMS Host key (CSVLK) + - Generic Volume License Key (GVLK), or KMS client key +- Retail +The Secure Zone represents higher-security Core Network computers that have additional firewall protection. + +![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) + +## In This Topic +- [Install and start VAMT on a networked host computer](#bkmk-partone) +- [Configure the Windows Management Instrumentation firewall exception on target computers](#bkmk-parttwo) +- [Connect to VAMT database](#bkmk-partthree) +- [Discover products](#bkmk-partfour) +- [Sort and filter the list of computers](#bkmk-partfive) +- [Collect status information from the computers in the list](#bkmk-partsix) +- [Add product keys and determine the remaining activation count](#bkmk-partseven) +- [Install the product keys](#bkmk-parteight) +- [Activate the client products](#bkmk-partnine) + +## Step 1: Install and start VAMT on a networked host computer + +1. Install VAMT on the host computer. +2. Click the VAMT icon in the **Start** menu to open VAMT. + +## Step 2: Configure the Windows Management Instrumentation firewall exception on target computers + +- Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + + **Note**   + To retrieve product license status, VAMT must have administrative permissions on the remote computers and WMI must be available through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +## Step 3: Connect to a VAMT database + +1. If you are not already connected to a database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database where the keys that must be activated are located. +2. Click **Connect**. +3. If you are already connected to a database, VAMT displays an inventory of the products and product keys in the center pane, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to Server** to open **the Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data](manage-vamt-data.md) + +## Step 4: Discover products + +1. In the left-side pane, in the **Products** node Products, click the product that you want to activate. +2. To open the **Discover Products** dialog box, click **Discover products** in the **Actions** menu in the right-side pane. +3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general Lightweight Directory Access Protocol (LDAP) query: + - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**. Then under **Domain Filter Criteria**, in the list of domain names click the name of the domain that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for specific computers in the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". + - To search by individual computer name or IP address, click **Manually enter name or IP address**. Then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. + - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. +4. Click **Search**. + + When the search is complete, the products that VAMT discovers appear in the product list view in the center pane. + +## Step 5: Sort and filter the list of computers + +You can sort the list of products so that it is easier to find the computers that require product keys to be activated: +1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. +2. To sort the list further, you can click one of the column headings to sort by that column. +3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. + +## Step 6: Collect status information from the computers in the list + +To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: +- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. +- To select computers which are not listed consecutively, hold down the **Ctrl** key and select each computer for which you want to collect the status information. + **To collect status information from the selected computers** +- In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box, type the appropriate user name and password and then click **OK**. +- VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. + + **Note** + If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + +## Step 7: Add product keys and determine the remaining activation count + +1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. +2. In the **Add Product Key** dialog box, you can select from one of the following methods to add product keys: + - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add Key(s)**. + - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + + The keys that you have added appear in the **Product Keys** list view in the center pane. + + **Important**   + If you are activating many products with a MAK, refresh the activation count of the MAK to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and then click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. + +## Step 8: Install the product keys + +1. In the left-side pane, click the product that you want to install keys on to. +2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and filter the list of computers](#bkmk-partfive). +3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you want to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. +6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status appears under the **Status of Last Action** column in the product list view in the center pane. + **Note**   + + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](https://go.microsoft.com/fwlink/p/?linkid=238382) + +## Step 9: Activate the client products + +1. Select the individual products that you want to activate in the list-view pane. +2. On the menu bar, click **Action**, point to **Activate** and point to **Online activate**. You can also right-click the selected computers(s) to display the **Action** menu, point to **Activate** and point to **Online activate**. You can also click **Activate** in the **Selected Items** menu in the right-hand pane to access the **Activate** option. +3. If you are activating product keys using your current credential, click **Current credential** and continue to step 5. If you are activating products that require an administrator credential that is different from the one you are currently using, click the **Alternate credential** option. +4. Enter your alternate user name and password and click **OK**. +5. The **Activate** option contacts the Microsoft product-activation server over the Internet and requests activation for the selected products. VAMT displays the **Activating products** dialog box until the requested actions are completed. + + **Note**   + Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. + + RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and volume editions of Office 2010 will not enter RFM. + +## Related topics +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) + + diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index 3c52c27790..f46556cdae 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -1,6 +1,6 @@ --- title: Scenario 2 Proxy Activation (Windows 10) -description: Scenario 2 Proxy Activation +description: Use the Volume Activation Management Tool (VAMT) to activate products that are installed on workgroup computers in an isolated lab environment. ms.assetid: ed5a8a56-d9aa-4895-918f-dd1898cb2c1a ms.reviewer: manager: laurawi diff --git a/windows/deployment/volume-activation/update-product-status-vamt.md b/windows/deployment/volume-activation/update-product-status-vamt.md index 038839adb4..1e3cd0e815 100644 --- a/windows/deployment/volume-activation/update-product-status-vamt.md +++ b/windows/deployment/volume-activation/update-product-status-vamt.md @@ -1,38 +1,39 @@ ---- -title: Update Product Status (Windows 10) -description: Update Product Status -ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Update Product Status - -After you add computers to the VAMT database, you need to use the **Update license status** function to add the products that are installed on the computers. You can also use the **Update license status** at any time to retrieve the most current license status for any products in the VAMT database. -To retrieve license status, VAMT must have administrative permissions on all selected computers and Windows Management Instrumentation (WMI) must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -**Note**   -The license-status query requires a valid computer name for each system queried. If the VAMT database contains computers that were added without Personally Identifiable Information, computer names will not be available for those computers, and the status for these computers will not be updated. - -## Update the license status of a product - -1. Open VAMT. -2. In the **Products** list, select one or more products that need to have their status updated. -3. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. -4. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. - - VAMT displays the **Collecting product information** dialog box while it collects the status of all selected products. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. - - **Note**   - If a previously discovered Microsoft Office 2010 product has been uninstalled from the remote computer, updating its licensing status will cause the entry to be deleted from the **Office** product list view, and, consequently, the total number of discovered products will be smaller. However, the Windows installation of the same computer will not be deleted and will always be shown in the **Windows** products list view. - -## Related topics -- [Add and Manage Products](add-manage-products-vamt.md) +--- +title: Update Product Status (Windows 10) +description: Learn how to use the Update license status function to add the products that are installed on the computers. +ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Update Product Status + +After you add computers to the VAMT database, you need to use the **Update license status** function to add the products that are installed on the computers. You can also use the **Update license status** at any time to retrieve the most current license status for any products in the VAMT database. +To retrieve license status, VAMT must have administrative permissions on all selected computers and Windows Management Instrumentation (WMI) must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +**Note**   +The license-status query requires a valid computer name for each system queried. If the VAMT database contains computers that were added without Personally Identifiable Information, computer names will not be available for those computers, and the status for these computers will not be updated. + +## Update the license status of a product + +1. Open VAMT. +2. In the **Products** list, select one or more products that need to have their status updated. +3. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. +4. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. + + VAMT displays the **Collecting product information** dialog box while it collects the status of all selected products. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. + + **Note**   + If a previously discovered Microsoft Office 2010 product has been uninstalled from the remote computer, updating its licensing status will cause the entry to be deleted from the **Office** product list view, and, consequently, the total number of discovered products will be smaller. However, the Windows installation of the same computer will not be deleted and will always be shown in the **Windows** products list view. + +## Related topics +- [Add and Manage Products](add-manage-products-vamt.md) diff --git a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md index 092f297bb9..0fcb1ad99c 100644 --- a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md +++ b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md @@ -1,6 +1,6 @@ --- title: Use VAMT in Windows PowerShell (Windows 10) -description: Use VAMT in Windows PowerShell +description: Learn how to use Volume Activation Management Tool (VAMT) PowerShell cmdlets to perform the same functions as the Vamt.exe command-line tool. ms.assetid: 13e0ceec-d827-4681-a5c3-8704349e3ba9 ms.reviewer: manager: laurawi @@ -57,7 +57,7 @@ get-help get-VamtProduct -all ``` **Warning** -The update-help cmdlet is not supported for VAMT PowerShell cmdlets. To view online help for VAMT cmdlets, you can use the -online option with the get-help cmdlet. For more information, see [Volume Activation Management Tool (VAMT) Cmdlets in Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=242278). +The update-help cmdlet is not supported for VAMT PowerShell cmdlets. To view online help for VAMT cmdlets, you can use the -online option with the get-help cmdlet. For more information, see [Volume Activation Management Tool (VAMT) Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/vamt). **To view VAMT PowerShell Help sections** diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md index 2259c02d2f..d28e648aac 100644 --- a/windows/deployment/volume-activation/vamt-known-issues.md +++ b/windows/deployment/volume-activation/vamt-known-issues.md @@ -1,6 +1,6 @@ --- title: VAMT known issues (Windows 10) -description: Volume Activation Management Tool (VAMT) known issues +description: Find out the current known issues with the Volume Activation Management Tool (VAMT), versions 3.0. and 3.1. ms.assetid: 8992f1f3-830a-4ce7-a248-f3a6377ab77f ms.reviewer: manager: laurawi @@ -48,13 +48,13 @@ On the KMS host computer, perform the following steps: 1. To extract the contents of the update, run the following command: - ```cmd + ```console expand c:\KB3058168\Windows8.1-KB3058168-x64.msu -f:* C:\KB3058168\ ``` 1. To extract the contents of Windows8.1-KB3058168-x64.cab, run the following command: - ```cmd + ```console expand c:\KB3058168\Windows8.1-KB3058168-x64.cab -f:pkeyconfig-csvlk.xrm-ms c:\KB3058168 ``` diff --git a/windows/deployment/volume-activation/vamt-requirements.md b/windows/deployment/volume-activation/vamt-requirements.md index e9c0da934f..2ee3dbbb3d 100644 --- a/windows/deployment/volume-activation/vamt-requirements.md +++ b/windows/deployment/volume-activation/vamt-requirements.md @@ -1,46 +1,47 @@ ---- -title: VAMT Requirements (Windows 10) -description: VAMT Requirements -ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# VAMT Requirements - -This topic includes info about the product key and system requirements for VAMT. - -## Product Key Requirements - -The Volume Activation Management Tool (VAMT) can be used to perform activations using any of the following types of product keys. - -|Product key type |Where to obtain | -|-----------------|----------------| -|

        • Multiple Activation Key (MAK)
        • Key Management Service (KMS) host key (CSVLK)
        • KMS client setup keys (GVLK)
        |Volume licensing keys can only be obtained with a signed contract from Microsoft. For more info, see the [Microsoft Volume Licensing portal](https://go.microsoft.com/fwlink/p/?LinkId=227282). | -|Retail product keys |Obtained at time of product purchase. | - -## System Requirements - -The following table lists the system requirements for the VAMT host computer. - -| Item | Minimum system requirement | -| ---- | ---------------------------| -| Computer and Processor | 1 GHz x86 or x64 processor | -| Memory | 1 GB RAM for x86 or 2 GB RAM for x64 | -| Hard Disk | 16 GB available hard disk space for x86 or 20 GB for x64 | -| External Drive | Removable media (Optional) | -| Display | 1024x768 or higher resolution monitor | -| Network | Connectivity to remote computers via Windows Management Instrumentation (TCP/IP) and Microsoft Activation Web Service on the Internet via HTTPS | -| Operating System | Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, or later. | -| Additional Requirements |
        • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
        • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012, PowerShell is included in the installation. For previous versions of Windows and Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).
        • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
        | - -## Related topics -- [Install and Configure VAMT](install-configure-vamt.md) +--- +title: VAMT Requirements (Windows 10) +description: In this article, learn about the product key and system requierements for Volume Activation Management Tool (VAMT). +ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# VAMT Requirements + +This topic includes info about the product key and system requirements for VAMT. + +## Product Key Requirements + +The Volume Activation Management Tool (VAMT) can be used to perform activations using any of the following types of product keys. + +|Product key type |Where to obtain | +|-----------------|----------------| +|
        • Multiple Activation Key (MAK)
        • Key Management Service (KMS) host key (CSVLK)
        • KMS client setup keys (GVLK)
        |Volume licensing keys can only be obtained with a signed contract from Microsoft. For more info, see the [Microsoft Volume Licensing portal](https://go.microsoft.com/fwlink/p/?LinkId=227282). | +|Retail product keys |Obtained at time of product purchase. | + +## System Requirements + +The following table lists the system requirements for the VAMT host computer. + +| Item | Minimum system requirement | +| ---- | ---------------------------| +| Computer and Processor | 1 GHz x86 or x64 processor | +| Memory | 1 GB RAM for x86 or 2 GB RAM for x64 | +| Hard Disk | 16 GB available hard disk space for x86 or 20 GB for x64 | +| External Drive | Removable media (Optional) | +| Display | 1024x768 or higher resolution monitor | +| Network | Connectivity to remote computers via Windows Management Instrumentation (TCP/IP) and Microsoft Activation Web Service on the Internet via HTTPS | +| Operating System | Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, or later. | +| Additional Requirements |
        • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
        • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012, PowerShell is included in the installation. For previous versions of Windows and Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).
        • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
        | + +## Related topics +- [Install and Configure VAMT](install-configure-vamt.md) diff --git a/windows/deployment/volume-activation/vamt-step-by-step.md b/windows/deployment/volume-activation/vamt-step-by-step.md index ae1576bb5f..ef45dc1c96 100644 --- a/windows/deployment/volume-activation/vamt-step-by-step.md +++ b/windows/deployment/volume-activation/vamt-step-by-step.md @@ -1,32 +1,33 @@ ---- -title: VAMT Step-by-Step Scenarios (Windows 10) -description: VAMT Step-by-Step Scenarios -ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# VAMT Step-by-Step Scenarios - -This section provides step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. VAMT supports many common scenarios; the scenarios in this section describe some of the most common to get you started. - -## In this Section - -|Topic |Description | -|------|------------| -|[Scenario 1: Online Activation](scenario-online-activation-vamt.md) |Describes how to distribute Multiple Activation Keys (MAKs) to products installed on one or more connected computers within a network, and how to instruct these products to contact Microsoft over the Internet for activation. | -|[Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) |Describes how to use two VAMT host computers — the first one with Internet access and a second computer within an isolated workgroup — as proxies to perform MAK volume activation for workgroup computers that do not have Internet access. | -|[Scenario 3: KMS Client Activation](scenario-kms-activation-vamt.md) |Describes how to use VAMT to configure client products for Key Management Service (KMS) activation. By default, volume license editions of Windows 10, Windows Vista, Windows® 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. | - -## Related topics -- [Introduction to VAMT](introduction-vamt.md) -  -  +--- +title: VAMT Step-by-Step Scenarios (Windows 10) +description: Learn step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. +ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# VAMT Step-by-Step Scenarios + +This section provides step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. VAMT supports many common scenarios; the scenarios in this section describe some of the most common to get you started. + +## In this Section + +|Topic |Description | +|------|------------| +|[Scenario 1: Online Activation](scenario-online-activation-vamt.md) |Describes how to distribute Multiple Activation Keys (MAKs) to products installed on one or more connected computers within a network, and how to instruct these products to contact Microsoft over the Internet for activation. | +|[Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) |Describes how to use two VAMT host computers — the first one with Internet access and a second computer within an isolated workgroup — as proxies to perform MAK volume activation for workgroup computers that do not have Internet access. | +|[Scenario 3: KMS Client Activation](scenario-kms-activation-vamt.md) |Describes how to use VAMT to configure client products for Key Management Service (KMS) activation. By default, volume license editions of Windows 10, Windows Vista, Windows® 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. | + +## Related topics +- [Introduction to VAMT](introduction-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/volume-activation-management-tool.md b/windows/deployment/volume-activation/volume-activation-management-tool.md index c73cbc4546..23c0a83614 100644 --- a/windows/deployment/volume-activation/volume-activation-management-tool.md +++ b/windows/deployment/volume-activation/volume-activation-management-tool.md @@ -13,13 +13,14 @@ audience: itpro author: greg-lindsay ms.date: 04/25/2017 ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Volume Activation Management Tool (VAMT) Technical Reference -The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. +The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems: -- Windows® 7 or above +- Windows® 7 or above - Windows Server 2008 R2 or above @@ -28,7 +29,7 @@ VAMT is designed to manage volume activation for: Windows 7, Windows 8, Window VAMT is only available in an EN-US (x86) package. -## In this Section +## In this section |Topic |Description | |------|------------| diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md index 3ae808a4af..1a47bd0cf9 100644 --- a/windows/deployment/windows-10-deployment-posters.md +++ b/windows/deployment/windows-10-deployment-posters.md @@ -1,6 +1,6 @@ --- title: Windows 10 deployment process posters -description: View and download Windows 10 deployment process flows for Microsoft Endpoint Configuration Manager and Windows Autopilot. +description: View and download Windows 10 deployment process flows for Microsoft Endpoint Manager and Windows Autopilot. ms.reviewer: manager: laurawi ms.audience: itpro @@ -12,7 +12,6 @@ ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library audience: itpro -author: greg-lindsay ms.topic: article --- diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md index c67c06b664..2146d2fb9f 100644 --- a/windows/deployment/windows-10-deployment-scenarios.md +++ b/windows/deployment/windows-10-deployment-scenarios.md @@ -5,6 +5,7 @@ ms.assetid: 7A29D546-52CC-482C-8870-8123C7DC04B5 ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay keywords: upgrade, in-place, configuration, deploy ms.prod: w10 @@ -12,7 +13,6 @@ ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library audience: itpro -author: greg-lindsay ms.topic: article --- @@ -25,6 +25,7 @@ To successfully deploy the Windows 10 operating system in your organization, it The following table summarizes various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories. - Modern deployment methods are recommended unless you have a specific need to use a different procedure. These methods are supported with existing tools such as Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager. These methods are discussed in detail on the [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home). + - Note: Once you have deployed Windows 10 in your organization, it is important to stay up to date by [creating a deployment plan](update/create-deployment-plan.md) for Windows 10 feature updates. - Dynamic deployment methods enable you to configure applications and settings for specific use cases. - Traditional deployment methods use existing tools to deploy operating system images.
          @@ -158,7 +159,7 @@ For more information about Windows Autopilot, see [Overview of Windows Autopilot For existing computers running Windows 7, Windows 8, or Windows 8.1, the recommended path for organizations deploying Windows 10 leverages the Windows installation program (Setup.exe) to perform an in-place upgrade, which automatically preserves all data, settings, applications, and drivers from the existing operating system version. This requires the least IT effort, because there is no need for any complex deployment infrastructure. -Although consumer PCs will be upgraded using Windows Update, organizations want more control over the process. This is accomplished by leveraging tools like Microsoft Endpoint Configuration Manager or the Microsoft Deployment Toolkit to completely automate the upgrade process through simple task sequences. +Although consumer PCs will be upgraded using Windows Update, organizations want more control over the process. This is accomplished by leveraging tools like Microsoft Endpoint Manager or the Microsoft Deployment Toolkit to completely automate the upgrade process through simple task sequences. The in-place upgrade process is designed to be extremely reliable, with the ability to automatically roll back to the previous operating system if any issues are encountered during the deployment process, without any IT staff involvement. Rolling back manually can also be done by leveraging the automatically-created recovery information (stored in the Windows.old folder), in case any issues are encountered after the upgrade is finished. The upgrade process is also typically faster than traditional deployments, because applications do not need to be reinstalled as part of the process. diff --git a/windows/deployment/windows-10-deployment-tools-reference.md b/windows/deployment/windows-10-deployment-tools-reference.md index 31c2c53103..9bb72ea7bb 100644 --- a/windows/deployment/windows-10-deployment-tools-reference.md +++ b/windows/deployment/windows-10-deployment-tools-reference.md @@ -1,21 +1,21 @@ --- title: Windows 10 deployment tools reference -description: Learn about the tools available to deploy Windows 10. +description: Learn about the tools available to deploy Windows 10, like Volume Activation Management Tool (VAMT) and User State Migration Tool (USMT). ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library audience: itpro -author: greg-lindsay ms.date: 07/12/2017 ms.topic: article --- -# Windows 10 deployment tools +# Windows 10 deployment tools reference Learn about the tools available to deploy Windows 10. @@ -26,5 +26,5 @@ Learn about the tools available to deploy Windows 10. |[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | |[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. | |[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | -|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | +|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | |[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals | diff --git a/windows/deployment/windows-10-deployment-tools.md b/windows/deployment/windows-10-deployment-tools.md index 2bf8998e1e..6a20248ebe 100644 --- a/windows/deployment/windows-10-deployment-tools.md +++ b/windows/deployment/windows-10-deployment-tools.md @@ -1,16 +1,16 @@ --- title: Windows 10 deployment tools -description: Browse through documentation describing Windows 10 deployment tools. Learn how to use these these tools to successfully deploy Windows 10 to your organization. +description: Learn how to use Windows 10 deployment tools to successfully deploy Windows 10 to your organization. ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library audience: itpro -author: greg-lindsay ms.date: 10/16/2017 ms.topic: article --- @@ -26,5 +26,5 @@ Learn about the tools available to deploy Windows 10. |[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | |[Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) |The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. | |[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | -|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | +|[Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) |The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. | |[User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) |The User State Migration Tool (USMT) 10.0 is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals | diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md index e4cadbe165..d362478ccc 100644 --- a/windows/deployment/windows-10-enterprise-e3-overview.md +++ b/windows/deployment/windows-10-enterprise-e3-overview.md @@ -13,7 +13,6 @@ manager: laurawi ms.audience: itpro author: greg-lindsay audience: itpro -author: greg-lindsay ms.collection: M365-modern-desktop ms.topic: article --- @@ -105,7 +104,7 @@ Windows 10 Enterprise edition has a number of features that are unavailable in

        AppLocker management

        -

        This feature helps IT pros determine which applications and files users can run on a device (also known as “whitelisting”). The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

        +

        This feature helps IT pros determine which applications and files users can run on a device. The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

        For more information, see AppLocker.

        diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index 24743735e8..38a56db227 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -9,10 +9,10 @@ ms.date: 10/20/2017 ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay ms.sitesec: library audience: itpro -author: greg-lindsay ms.topic: article --- diff --git a/windows/deployment/windows-10-missing-fonts.md b/windows/deployment/windows-10-missing-fonts.md index dfa95cf6e1..7f9f5e72ad 100644 --- a/windows/deployment/windows-10-missing-fonts.md +++ b/windows/deployment/windows-10-missing-fonts.md @@ -1,103 +1,104 @@ ---- -title: How to install fonts missing after upgrading to Windows 10 -description: Some of the fonts are missing from the system after you upgrade to Windows 10. -keywords: deploy, upgrade, FoD, optional feature -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.audience: itpro author: greg-lindsay -ms.date: 10/31/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# How to install fonts that are missing after upgrading to Windows 10 - -> Applies to: Windows 10 - -When you upgrade from the Windows 7, Windows 8, or Windows 8.1 operating system to Windows 10, certain fonts are no longer available by default post-upgrade. To reduce the operating system footprint, improve performance, and optimize disk space usage, we moved many of the fonts that were previously shipped with prior versions of Windows to the optional features of Windows 10. If you install a fresh instance of Windows 10, or upgrade an older version of Windows to Windows 10, these optional features are not enabled by default. As a result, these fonts appear to be missing from the system. - -If you have documents created using the missing fonts, these documents might display differently on Windows 10. - -For example, if you have an English (or French, German, or Spanish) version of Windows 10 installed, you might notice that fonts such as the following are appear to be missing: - -- Gautami -- Meiryo -- Narkism/Batang -- BatangChe -- Dotum -- DotumChe -- Gulim -- GulimChe -- Gungsuh -- GungsuhChe - -If you want to use these fonts, you can enable the optional feature to add these back to your system. Be aware that this is a permanent change in behavior for Windows 10, and it will remain this way in future releases. - -## Installing language-associated features via language settings: - -If you want to use the fonts from the optional feature and you know that you will want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. You do this the Settings app. - -For example, here are the steps to install the fonts associated with the Hebrew language: - -1. Click **Start > Settings**. -2. In Settings, click **Time & language**, and then click **Region & language**. -3. If Hebrew is not included in the list of languages, click the plus sign (**+**) to add a language. -4. Find Hebrew, and then click it to add it to your language list. - -Once you have added Hebrew to your language list, then the optional Hebrew font feature and other optional features for Hebrew language support are installed. This should only take a few minutes. - -> Note: The optional features are installed by Windows Update. This means you need to be online for the Windows Update service to work. - -## Install optional fonts manually without changing language settings: - -If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings. - -For example, here are the steps to install the fonts associated with the Hebrew language without adding the Hebrew language itself to your language preferences: - -1. Click **Start > Settings**. -2. In Settings, click **Apps**, click **Apps & features**, and then click **Manage optional features**. - -3. If you don't see **Hebrew Supplemental Fonts** in the list of installed features, click the plus sign (**+**) to add a feature. -4. Select **Hebrew Supplemental Fonts** in the list, and then click **Install**. - -> Note: The optional features are installed by Windows Update. You need to be online for the Windows Update service to work. - -## Fonts included in optional font features - -Here is a comprehensive list of the font families in each of the optional features. Some font families might include multiple fonts for different weights and styles. - -- Arabic Script Supplemental Fonts: Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting -- Bangla Script Supplemental Fonts: Shonar Bangla, Vrinda -- Canadian Aboriginal Syllabics Supplemental Fonts: Euphemia -- Cherokee Supplemental Fonts: Plantagenet Cherokee -- Chinese (Simplified) Supplemental Fonts: DengXian, FangSong, KaiTi, SimHei -- Chinese (Traditional) Supplemental Fonts: DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU -- Devanagari Supplemental Fonts: Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah -- Ethiopic Supplemental Fonts: Nyala -- Gujarati Supplemental Fonts: Shruti -- Gurmukhi Supplemental Fonts: Raavi -- Hebrew Supplemental Fonts: Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod -- Japanese Supplemental Fonts: Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho -- Kannada Supplemental Fonts: Tunga -- Khmer Supplemental Fonts: DaunPenh, Khmer UI, MoolBoran -- Korean Supplemental Fonts: Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe -- Lao Supplemental Fonts: DokChampa, Lao UI -- Malayalam Supplemental Fonts: Karthika -- Odia Supplemental Fonts: Kalinga -- Pan-European Supplemental Fonts: Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro -- Sinhala Supplemental Fonts: Iskoola Pota -- Syriac Supplemental Fonts: Estrangelo Edessa -- Tamil Supplemental Fonts: Latha, Vijaya -- Telugu Supplemental Fonts: Gautami, Vani -- Thai Supplemental Fonts: Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC - -## Related Topics - -[Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx) - -[Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics) - -[Add Language Packs to Windows](/windows-hardware/manufacture/desktop/add-language-packs-to-windows) +--- +title: How to install fonts missing after upgrading to Windows 10 +description: Some of the fonts are missing from the system after you upgrade to Windows 10. +keywords: deploy, upgrade, FoD, optional feature +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.audience: itpro +ms.date: 10/31/2017 +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# How to install fonts that are missing after upgrading to Windows 10 + +> Applies to: Windows 10 + +When you upgrade from the Windows 7, Windows 8, or Windows 8.1 operating system to Windows 10, certain fonts are no longer available by default post-upgrade. To reduce the operating system footprint, improve performance, and optimize disk space usage, we moved many of the fonts that were previously shipped with prior versions of Windows to the optional features of Windows 10. If you install a fresh instance of Windows 10, or upgrade an older version of Windows to Windows 10, these optional features are not enabled by default. As a result, these fonts appear to be missing from the system. + +If you have documents created using the missing fonts, these documents might display differently on Windows 10. + +For example, if you have an English (or French, German, or Spanish) version of Windows 10 installed, you might notice that fonts such as the following are appear to be missing: + +- Gautami +- Meiryo +- Narkism/Batang +- BatangChe +- Dotum +- DotumChe +- Gulim +- GulimChe +- Gungsuh +- GungsuhChe + +If you want to use these fonts, you can enable the optional feature to add these back to your system. Be aware that this is a permanent change in behavior for Windows 10, and it will remain this way in future releases. + +## Installing language-associated features via language settings: + +If you want to use the fonts from the optional feature and you know that you will want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. You do this the Settings app. + +For example, here are the steps to install the fonts associated with the Hebrew language: + +1. Click **Start > Settings**. +2. In Settings, click **Time & language**, and then click **Region & language**. +3. If Hebrew is not included in the list of languages, click the plus sign (**+**) to add a language. +4. Find Hebrew, and then click it to add it to your language list. + +Once you have added Hebrew to your language list, then the optional Hebrew font feature and other optional features for Hebrew language support are installed. This should only take a few minutes. + +> Note: The optional features are installed by Windows Update. This means you need to be online for the Windows Update service to work. + +## Install optional fonts manually without changing language settings: + +If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings. + +For example, here are the steps to install the fonts associated with the Hebrew language without adding the Hebrew language itself to your language preferences: + +1. Click **Start > Settings**. +2. In Settings, click **Apps**, click **Apps & features**, and then click **Manage optional features**. + +3. If you don't see **Hebrew Supplemental Fonts** in the list of installed features, click the plus sign (**+**) to add a feature. +4. Select **Hebrew Supplemental Fonts** in the list, and then click **Install**. + +> Note: The optional features are installed by Windows Update. You need to be online for the Windows Update service to work. + +## Fonts included in optional font features + +Here is a comprehensive list of the font families in each of the optional features. Some font families might include multiple fonts for different weights and styles. + +- Arabic Script Supplemental Fonts: Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting +- Bangla Script Supplemental Fonts: Shonar Bangla, Vrinda +- Canadian Aboriginal Syllabics Supplemental Fonts: Euphemia +- Cherokee Supplemental Fonts: Plantagenet Cherokee +- Chinese (Simplified) Supplemental Fonts: DengXian, FangSong, KaiTi, SimHei +- Chinese (Traditional) Supplemental Fonts: DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU +- Devanagari Supplemental Fonts: Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah +- Ethiopic Supplemental Fonts: Nyala +- Gujarati Supplemental Fonts: Shruti +- Gurmukhi Supplemental Fonts: Raavi +- Hebrew Supplemental Fonts: Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod +- Japanese Supplemental Fonts: Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho +- Kannada Supplemental Fonts: Tunga +- Khmer Supplemental Fonts: DaunPenh, Khmer UI, MoolBoran +- Korean Supplemental Fonts: Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe +- Lao Supplemental Fonts: DokChampa, Lao UI +- Malayalam Supplemental Fonts: Karthika +- Odia Supplemental Fonts: Kalinga +- Pan-European Supplemental Fonts: Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro +- Sinhala Supplemental Fonts: Iskoola Pota +- Syriac Supplemental Fonts: Estrangelo Edessa +- Tamil Supplemental Fonts: Latha, Vijaya +- Telugu Supplemental Fonts: Gautami, Vani +- Thai Supplemental Fonts: Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC + +## Related Topics + +[Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx) + +[Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics) + +[Add Language Packs to Windows](/windows-hardware/manufacture/desktop/add-language-packs-to-windows) diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index a9ffbb1c73..8e1f84c95e 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -1,6 +1,7 @@ --- title: Step by step - Deploy Windows 10 in a test lab using MDT -description: Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT) +description: In this article, you'll learn how to deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT). +ms.custom: seo-marvel-apr2020 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -11,9 +12,9 @@ ms.date: 10/11/2017 ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay audience: itpro -author: greg-lindsay ms.topic: article --- diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index ba8078e40c..180f2dd30b 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -1,6 +1,6 @@ --- -title: Step by step - Deploy Windows 10 using Microsoft Endpoint Configuration Manager -description: Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager +title: Steps to deploy Windows 10 with Microsoft Endpoint Configuration Manager +description: In this article, you'll learn how to deploy Windows 10 in a test lab using Microsoft endpoint configuration manager. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -10,29 +10,33 @@ ms.localizationpriority: medium ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay audience: itpro -author: greg-lindsay ms.topic: article +ms.custom: seo-marvel-apr2020 --- # Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager **Applies to** -- Windows 10 +- Windows 10 **Important**: This guide leverages the proof of concept (PoC) environment, and some settings that are configured in the following guides: + - [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) - [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) Please complete all steps in these guides before attempting the procedures in this guide. If you wish to skip the Windows 10 deployment procedures in the MDT guide and move directly to this guide, you must at least install MDT and the Windows ADK before performing procedures in this guide. All steps in the first guide are required before attempting the procedures in this guide. The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs): + - **DC1**: A contoso.com domain controller, DNS server, and DHCP server. - **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network. - **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been cloned from a physical computer on your corporate network for testing purposes. -This guide leverages the Hyper-V server role to perform procedures. If you do not complete all steps in a single session, consider using [checkpoints](https://technet.microsoft.com/library/dn818483.aspx) and [saved states](https://technet.microsoft.com/library/ee247418.aspx) to pause, resume, or restart your work. + +>This guide leverages the Hyper-V server role to perform procedures. If you do not complete all steps in a single session, consider using [checkpoints](https://technet.microsoft.com/library/dn818483.aspx) and [saved states](https://technet.microsoft.com/library/ee247418.aspx) to pause, resume, or restart your work. >Multiple features and services are installed on SRV1 in this guide. This is not a typical installation, and is only done to set up a lab environment with a bare minimum of resources. However, if less than 4 GB of RAM is allocated to SRV1 in the Hyper-V console, some procedures will be extremely slow to complete. If resources are limited on the Hyper-V host, consider reducing RAM allocation on DC1 and PC1, and then increasing the RAM allocation on SRV1. You can adjust RAM allocation for a VM by right-clicking the VM in the Hyper-V Manager console, clicking **Settings**, clicking **Memory**, and modifying the value next to **Maximum RAM**. @@ -42,41 +46,36 @@ This guide provides end-to-end instructions to install and configure Microsoft E Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. -
        - -
        - -
        TopicDescriptionTime - -
        Install prerequisitesInstall prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.60 minutes -
        Install Microsoft Endpoint Configuration ManagerDownload Microsoft Endpoint Configuration Manager, configure prerequisites, and install the package.45 minutes -
        Download MDOP and install DaRTDownload the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.15 minutes -
        Prepare for Zero Touch installationPrerequisite procedures to support Zero Touch installation.60 minutes -
        Create a boot image for Configuration ManagerUse the MDT wizard to create the boot image in Configuration Manager.20 minutes -
        Create a Windows 10 reference imageThis procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image.0-60 minutes -
        Add a Windows 10 operating system imageAdd a Windows 10 operating system image and distribute it.10 minutes
        Create a task sequenceCreate a Configuration Manager task sequence with MDT integration using the MDT wizard15 minutes -
        Finalize the operating system configurationEnable monitoring, configure rules, and distribute content.30 minutes -
        Deploy Windows 10 using PXE and Configuration ManagerDeploy Windows 10 using Configuration Manager deployment packages and task sequences.60 minutes -
        Replace a client with Windows 10 using Configuration ManagerReplace a client computer with Windows 10 using Configuration Manager.90 minutes -
        Refresh a client with Windows 10 using Configuration ManagerUse a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT90 minutes - -
        - -
        +|||| +|--- |--- |--- | +|Topic|Description|Time| +|[Install prerequisites](#install-prerequisites)|Install prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.|60 minutes| +|[Install Microsoft Endpoint Configuration Manager](#install-microsoft-endpoint-configuration-manager)|Download Microsoft Endpoint Configuration Manager, configure prerequisites, and install the package.|45 minutes| +|[Download MDOP and install DaRT](#download-mdop-and-install-dart)|Download the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.|15 minutes| +|[Prepare for Zero Touch installation](#prepare-for-zero-touch-installation)|Prerequisite procedures to support Zero Touch installation.|60 minutes| +|[Create a boot image for Configuration Manager](#create-a-boot-image-for-configuration-manager)|Use the MDT wizard to create the boot image in Configuration Manager.|20 minutes| +|[Create a Windows 10 reference image](#create-a-windows-10-reference-image)|This procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image.|0-60 minutes| +|[Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image)|Add a Windows 10 operating system image and distribute it.|10 minutes| +|[Create a task sequence](#create-a-task-sequence)|Create a Configuration Manager task sequence with MDT integration using the MDT wizard|15 minutes| +|[Finalize the operating system configuration](#finalize-the-operating-system-configuration)|Enable monitoring, configure rules, and distribute content.|30 minutes| +|[Deploy Windows 10 using PXE and Configuration Manager](#deploy-windows-10-using-pxe-and-configuration-manager)|Deploy Windows 10 using Configuration Manager deployment packages and task sequences.|60 minutes| +|[Replace a client with Windows 10 using Configuration Manager](#replace-a-client-with-windows-10-using-configuration-manager)|Replace a client computer with Windows 10 using Configuration Manager.|90 minutes| +|[Refresh a client with Windows 10 using Configuration Manager](#refresh-a-client-with-windows-10-using-configuration-manager)|Use a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT|90 minutes| ## Install prerequisites -1. Before installing Microsoft Endpoint Configuration Manager, we must install prerequisite services and features. Type the following command at an elevated Windows PowerShell prompt on SRV1: - ``` +1. Before installing Microsoft Endpoint Configuration Manager, we must install prerequisite services and features. Type the following command at an elevated Windows PowerShell prompt on SRV1: + + ```powershell Install-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,BITS,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,NET-HTTP-Activation,NET-Non-HTTP-Activ ``` >If the request to add features fails, retry the installation by typing the command again. 2. Download [SQL Server 2014 SP2](https://www.microsoft.com/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. -3. When you have downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +3. When you have downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\SQLServer2014SP2-FullSlipstream-x64-ENU.iso ``` @@ -84,30 +83,32 @@ Topics and procedures in this guide are summarized in the following table. An es 4. Type the following command at an elevated Windows PowerShell prompt on SRV1 to install SQL Server: - ``` + ```powershell D:\setup.exe /q /ACTION=Install /ERRORREPORTING="False" /FEATURES=SQLENGINE,RS,IS,SSMS,TOOLS,ADV_SSMS,CONN /INSTANCENAME=MSSQLSERVER /INSTANCEDIR="C:\Program Files\Microsoft SQL Server" /SQLSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\ADMINISTRATORS" /SQLSVCSTARTUPTYPE=Automatic /AGTSVCACCOUNT="NT AUTHORITY\SYSTEM" /AGTSVCSTARTUPTYPE=Automatic /RSSVCACCOUNT="NT AUTHORITY\System" /RSSVCSTARTUPTYPE=Automatic /ISSVCACCOUNT="NT AUTHORITY\System" /ISSVCSTARTUPTYPE=Disabled /ASCOLLATION="Latin1_General_CI_AS" /SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" /TCPENABLED="1" /NPENABLED="1" /IAcceptSQLServerLicenseTerms ``` + Installation will take several minutes. When installation is complete, the following output will be displayed: - ``` + ```dos Microsoft (R) SQL Server 2014 12.00.5000.00 Copyright (c) Microsoft Corporation. All rights reserved. - + Microsoft (R) .NET Framework CasPol 2.0.50727.7905 Copyright (c) Microsoft Corporation. All rights reserved. - + Success Microsoft (R) .NET Framework CasPol 2.0.50727.7905 Copyright (c) Microsoft Corporation. All rights reserved. - + Success One or more affected files have operations pending. You should restart your computer to complete this process. PS C:\> ``` + 5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell New-NetFirewallRule -DisplayName "SQL Server" -Direction Inbound –Protocol TCP –LocalPort 1433 -Action allow New-NetFirewallRule -DisplayName "SQL Admin Connection" -Direction Inbound –Protocol TCP –LocalPort 1434 -Action allow New-NetFirewallRule -DisplayName "SQL Database Management" -Direction Inbound –Protocol UDP –LocalPort 1434 -Action allow @@ -115,23 +116,23 @@ Topics and procedures in this guide are summarized in the following table. An es New-NetFirewallRule -DisplayName "SQL Debugger/RPC" -Direction Inbound –Protocol TCP –LocalPort 135 -Action allow ``` -7. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. +6. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://docs.microsoft.com/windows-hardware/get-started/adk-install) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 2004. Installation might require several minutes to acquire all components. ## Install Microsoft Endpoint Configuration Manager 1. On SRV1, temporarily disable IE Enhanced Security Configuration for Administrators by typing the following commands at an elevated Windows PowerShell prompt: - ``` + ```powershell $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 0 Stop-Process -Name Explorer ``` -2. Download [Microsoft Endpoint Configuration Manager and Endpoint Protection](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) on SRV1 (download the executable file anywhere on SRV1), double-click the file, enter **C:\configmgr** for **Unzip to folder**, and click **Unzip**. The C:\configmgr directory will be automatically created. Click **OK** and then close the **WinZip Self-Extractor** dialog box when finished. +2. Download [Microsoft Endpoint Manager and Endpoint Protection](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) on SRV1 (download the executable file anywhere on SRV1), double-click the file, enter **C:\configmgr** for **Unzip to folder**, and click **Unzip**. The C:\configmgr directory will be automatically created. Click **OK** and then close the **WinZip Self-Extractor** dialog box when finished. 3. Before starting the installation, verify that WMI is working on SRV1. See the following examples. Verify that **Running** is displayed under **Status** and **True** is displayed next to **TcpTestSucceeded**: - ``` + ```dos Get-Service Winmgmt Status Name DisplayName @@ -153,19 +154,20 @@ Topics and procedures in this guide are summarized in the following table. An es PingReplyDetails (RTT) : 0 ms TcpTestSucceeded : True ``` + You can also verify WMI using the WMI console by typing **wmimgmt.msc**, right-clicking **WMI Control (Local)** in the console tree, and then clicking **Properties**. If the WMI service is not started, attempt to start it or reboot the computer. If WMI is running but errors are present, see [WMIDiag](https://blogs.technet.microsoft.com/askperf/2015/05/12/wmidiag-2-2-is-here/) for troubleshooting information. 4. To extend the Active Directory schema, type the following command at an elevated Windows PowerShell prompt: - ``` + ```powershell cmd /c C:\configmgr\SMSSETUP\BIN\X64\extadsch.exe ``` 5. Temporarily switch to the DC1 VM, and type the following command at an elevated command prompt on DC1: - ``` + ```dos adsiedit.msc ``` @@ -182,17 +184,18 @@ Topics and procedures in this guide are summarized in the following table. An es 16. Close the ADSI Edit console and switch back to SRV1. 17. To start Configuration Manager installation, type the following command at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell cmd /c C:\configmgr\SMSSETUP\BIN\X64\Setup.exe ``` -18. Provide the following in the Microsoft Endpoint Configuration Manager Setup Wizard: + +18. Provide the following in the Microsoft Endpoint Manager Setup Wizard: - **Before You Begin**: Read the text and click *Next*. - **Getting Started**: Choose **Install a Configuration Manager primary site** and select the **Use typical installation options for a stand-alone primary site** checkbox. - Click **Yes** in response to the popup window. - **Product Key**: Choose **Install the evaluation edition of this Product**. - **Microsoft Software License Terms**: Read the terms and then select the **I accept these license terms** checkbox. - **Prerequisite Licenses**: Review license terms and select all three checkboxes on the page. - - **Prerequisite Downloads**: Choose **Download required files** and enter **c:\windows\temp** next to **Path**. + - **Prerequisite Downloads**: Choose **Download required files** and enter **c:\windows\temp** next to **Path**. - **Site and Installation Settings**: Site code: **PS1**, Site name: **Contoso**. - use default settings for all other options - **Usage Data**: Read the text and click **Next**. @@ -202,37 +205,39 @@ Topics and procedures in this guide are summarized in the following table. An es >There should be at most three warnings present: WSUS on site server, configuration for SQL Server memory usage, and SQL Server process memory allocation. These warnings can safely be ignored in this test environment. - Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Click **Close** when installation is complete. + Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Click **Close** when installation is complete. 19. If desired, re-enable IE Enhanced Security Configuration at this time on SRV1: - ``` + ```powershell Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 1 Stop-Process -Name Explorer ``` ## Download MDOP and install DaRT ->[!IMPORTANT] ->This step requires an MSDN subscription or volume licence agreement. For more information, see [Ready for Windows 10: MDOP 2015 and more tools are now available](https://blogs.technet.microsoft.com/windowsitpro/2015/08/17/ready-for-windows-10-mdop-2015-and-more-tools-are-now-available/). ->If your organization qualifies and does not already have an MSDN subscription, you can obtain a [free MSDN subscription with BizSpark](https://blogs.msdn.microsoft.com/zainnab/2011/03/14/bizspark-free-msdn-subscription-for-start-up-companies/). +> [!IMPORTANT] +> This step requires an MSDN subscription or volume licence agreement. For more information, see [Ready for Windows 10: MDOP 2015 and more tools are now available](https://blogs.technet.microsoft.com/windowsitpro/2015/08/17/ready-for-windows-10-mdop-2015-and-more-tools-are-now-available/). +> If your organization qualifies and does not already have an MSDN subscription, you can obtain a [free MSDN subscription with BizSpark](https://docs.microsoft.com/archive/blogs/zainnab/bizspark-free-msdn-subscription-for-start-up-companies/). 1. Download the [Microsoft Desktop Optimization Pack 2015](https://msdn.microsoft.com/subscriptions/downloads/#ProductFamilyId=597) to the Hyper-V host using an MSDN subscription. Download the .ISO file (mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso, 2.79 GB) to the C:\VHD directory on the Hyper-V host. 2. Type the following command at an elevated Windows PowerShell prompt on the Hyper-V host to mount the MDOP file on SRV1: - ``` + ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso ``` + 3. Type the following command at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell cmd /c "D:\DaRT\DaRT 10\Installers\en-us\x64\MSDaRT100.msi" ``` + 4. Install DaRT 10 using default settings. 5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx64.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x64" Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx86.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x86" ``` @@ -245,7 +250,7 @@ This section contains several procedures to support Zero Touch installation with 1. Type the following commands at a Windows PowerShell prompt on SRV1: - ``` + ```powershell New-Item -ItemType Directory -Path "C:\Sources\OSD\Boot" New-Item -ItemType Directory -Path "C:\Sources\OSD\OS" New-Item -ItemType Directory -Path "C:\Sources\OSD\Settings" @@ -278,7 +283,7 @@ This section contains several procedures to support Zero Touch installation with 3. On the **Network Access Account** tab, choose **Specify the account that accesses network locations**. 4. Click the yellow starburst and then click **New Account**. 5. Click **Browse** and then under **Enter the object name to select**, type **CM_NAA** and click **OK**. -6. Next to **Password** and **Confirm Password**, type pass@word1, and then click **OK** twice. +6. Next to **Password** and **Confirm Password**, type **pass\@word1**, and then click **OK** twice. ### Configure a boundary group @@ -300,21 +305,22 @@ This section contains several procedures to support Zero Touch installation with ### Enable PXE on the distribution point ->[!IMPORTANT] ->Before enabling PXE in Configuration Manager, ensure that any previous installation of WDS does not cause conflicts. Configuration Manager will automatically configure the WDS service to manage PXE requests. To disable a previous installation, if it exists, type the following commands at an elevated Windows PowerShell prompt on SRV1: +> [!IMPORTANT] +> Before enabling PXE in Configuration Manager, ensure that any previous installation of WDS does not cause conflicts. Configuration Manager will automatically configure the WDS service to manage PXE requests. To disable a previous installation, if it exists, type the following commands at an elevated Windows PowerShell prompt on SRV1: -``` +```powershell WDSUTIL /Set-Server /AnswerClients:None ``` 1. Determine the MAC address of the internal network adapter on SRV1. To determine this, type the following command at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell (Get-NetAdapter "Ethernet").MacAddress ``` - >If the internal network adapter, assigned an IP address of 192.168.0.2, is not named "Ethernet" then replace the name "Ethernet" in the previous command with the name of this network adapter. You can review the names of network adapters and the IP addresses assigned to them by typing **ipconfig**. -2. In the Microsoft Endpoint Configuration Manager console, in the **Administration** workspace, click **Distribution Points**. + > If the internal network adapter, assigned an IP address of 192.168.0.2, is not named "Ethernet" then replace the name "Ethernet" in the previous command with the name of this network adapter. You can review the names of network adapters and the IP addresses assigned to them by typing **ipconfig**. + +2. In the Microsoft Endpoint Manager console, in the **Administration** workspace, click **Distribution Points**. 3. In the display pane, right-click **SRV1.CONTOSO.COM** and then click **Properties**. 4. On the PXE tab, select the following settings: - **Enable PXE support for clients**. Click **Yes** in the popup that appears. @@ -325,13 +331,12 @@ WDSUTIL /Set-Server /AnswerClients:None - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. See the following example: - - Config Mgr PXE + ![Config Mgr PXE](images/configmgr-pxe.png) 5. Click **OK**. 6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: - ``` + ```powershell cmd /c dir /b C:\RemoteInstall\SMSBoot\x64 abortpxe.com @@ -342,31 +347,32 @@ WDSUTIL /Set-Server /AnswerClients:None wdsmgfw.efi wdsnbp.com ``` + >If these files are not present in the C:\RemoteInstall directory, verify that the REMINST share is configured as C:\RemoteInstall. You can view the properties of this share by typing "net share REMINST" at a command prompt. If the share path is set to a different value, then replace C:\RemoteInstall with your REMINST share path. >You can also type the following command at an elevated Windows PowerShell prompt to open the Configuration Manager Trace Log Tool. In the tool, click **File**, click **Open**, and then open the **distmgr.log** file. If errors are present, they will be highlighted in red: - ``` + ```powershell Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe' ``` The log file will updated continuously while Configuration Manager is running. Wait for Configuration Manager to repair any issues that are present, and periodically re-check that the files are present in the REMINST share location. Close the Configuration Manager Trace Log Tool when done. You will see the following line in distmgr.log that indicates the REMINST share is being populated with necessary files: - Running: WDSUTIL.exe /Initialize-Server /REMINST:"C:\RemoteInstall" + `Running: WDSUTIL.exe /Initialize-Server /REMINST:"C:\RemoteInstall"` Once the files are present in the REMINST share location, you can close the cmtrace tool. -### Create a branding image file +### Create a branding image file 1. If you have a bitmap (.BMP) image for suitable use as a branding image, copy it to the C:\Sources\OSD\Branding folder on SRV1. Otherwise, use the following step to copy a simple branding image. 2. Type the following command at an elevated Windows PowerShell prompt: + ```powershell + Copy-Item -Path "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" -Destination "C:\Sources\OSD\Branding\contoso.bmp" ``` - copy "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" "C:\Sources\OSD\Branding\contoso.bmp" - ``` + >You can open C:\Sources\OSD\Branding\contoso.bmp in MSPaint.exe if desired to customize this image. - -### Create a boot image for Configuration Manager +### Create a boot image for Configuration Manager 1. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Boot Images**, and then click **Create Boot Image using MDT**. 2. On the Package Source page, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Boot\Zero Touch WinPE x64**, and then click **Next**. @@ -380,13 +386,13 @@ WDSUTIL /Set-Server /AnswerClients:None 9. In the Distribute Content Wizard, click **Next**, click **Add** and select **Distribution Point**, select the **SRV1.CONTOSO.COM** checkbox, click **OK**, click **Next** twice, and then click **Close**. 10. Use the CMTrace application to view the **distmgr.log** file again and verify that the boot image has been distributed. To open CMTrace, type the following command at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe' ``` - + In the trace tool, click **Tools** on the menu and choose **Find**. Search for "**STATMSG: ID=2301**". For example: - ``` + ```console STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=924 TID=1424 GMTDATE=Tue Oct 09 22:36:30.986 2018 ISTR0="Zero Touch WinPE x64" ISTR1="PS10000A" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS10000A" SMS_DISTRIBUTION_MANAGER 10/9/2018 3:36:30 PM 1424 (0x0590) ``` @@ -395,7 +401,7 @@ WDSUTIL /Set-Server /AnswerClients:None 13. Select the **Deploy this boot image from the PXE-enabled distribution point** checkbox, and click **OK**. 14. Review the distmgr.log file again for "**STATMSG: ID=2301**" and verify that there are three folders under **C:\RemoteInstall\SMSImages** with boot images. See the following example: - ``` + ```console cmd /c dir /s /b C:\RemoteInstall\SMSImages C:\RemoteInstall\SMSImages\PS100004 @@ -414,9 +420,10 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 1. In [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command: - ``` + ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso ``` + 2. Verify that the Windows Enterprise installation DVD is mounted on SRV1 as drive letter D. 3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, click **Start**, type **deployment**, and then click **Deployment Workbench**. @@ -424,12 +431,12 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 4. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. 5. Use the following settings for the New Deployment Share Wizard: - - Deployment share path: **C:\MDTBuildLab**
        - - Share name: **MDTBuildLab$**
        - - Deployment share description: **MDT build lab**
        - - Options: click **Next** to accept the default
        - - Summary: click **Next**
        - - Progress: settings will be applied
        + - Deployment share path: **C:\MDTBuildLab** + - Share name: **MDTBuildLab$** + - Deployment share description: **MDT build lab** + - Options: click **Next** to accept the default + - Summary: click **Next** + - Progress: settings will be applied - Confirmation: click **Finish** 6. Expand the **Deployment Shares** node, and then expand **MDT build lab**. @@ -438,19 +445,19 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 7. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**. -8. Use the following settings for the Import Operating System Wizard: - - OS Type: **Full set of source files**
        - - Source: **D:\\**
        - - Destination: **W10Ent_x64**
        +8. Use the following settings for the Import Operating System Wizard: + - OS Type: **Full set of source files** + - Source: **D:\\** + - Destination: **W10Ent_x64** - Summary: click **Next** - Confirmation: click **Finish** 9. For purposes of this test lab, we will not add applications, such as Microsoft Office, to the deployment share. For information about adding applications, see the [Add applications](deploy-windows-mdt/create-a-windows-10-reference-image.md#add-applications) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) topic in the TechNet library. 10. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node under **MDT Build Lab** and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: **REFW10X64-001**
        - - Task sequence name: **Windows 10 Enterprise x64 Default Image**
        - - Task sequence comments: **Reference Build**
        + - Task sequence ID: **REFW10X64-001** + - Task sequence name: **Windows 10 Enterprise x64 Default Image** + - Task sequence comments: **Reference Build** - Template: **Standard Client Task Sequence** - Select OS: click **Windows 10 Enterprise Evaluation in W10Ent_x64 install.wim** - Specify Product Key: **Do not specify a product key at this time** @@ -467,7 +474,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 13. On the Properties tab of the group that was created in the previous step, change the Name from New Group to **Custom Tasks (Pre-Windows Update)** and then click **Apply**. To see the name change, click **Tattoo**, then click the new group again. -14. Click the **Custom Tasks (Pre-Windows Update)** group again, click **Add**, point to **Roles**, and then click **Install Roles and Features**. +14. Click the **Custom Tasks (Pre-Windows Update)** group again, click **Add**, point to **Roles**, and then click **Install Roles and Features**. 15. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then click **Apply**. @@ -480,7 +487,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 19. Replace the default rules with the following text: - ``` + ```ini [Settings] Priority=Default @@ -515,7 +522,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 20. Click **Apply** and then click **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: - ``` + ```ini [Settings] Priority=Default @@ -535,17 +542,18 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 24. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. Note that in MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI). - >Hint: Top copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. + >Hint: Top copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. 25. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands: - ``` - New-VM –Name REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB + ```powershell + New-VM –Name REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB Set-VMMemory -VMName REFW10X64-001 -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 1024MB -Buffer 20 Set-VMDvdDrive -VMName REFW10X64-001 -Path c:\VHD\LiteTouchPE_x86.iso Start-VM REFW10X64-001 vmconnect localhost REFW10X64-001 ``` + 26. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then click **Next**. 27. Accept the default values on the Capture Image page, and click **Next**. Operating system installation will complete after 5 to 10 minutes and then the VM will reboot automatically. Allow the system to boot normally (do not press a key). The process is fully automated. @@ -560,13 +568,13 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi - Capture the installation to a Windows Imaging (WIM) file. - Turn off the virtual machine. - This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host and your network's download speed. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on SRV1. The file name is **REFW10X64-001.wim**. + This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host and your network's download speed. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on SRV1. The file name is **REFW10X64-001.wim**. ### Add a Windows 10 operating system image 1. Type the following commands at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell New-Item -ItemType Directory -Path "C:\Sources\OSD\OS\Windows 10 Enterprise x64" cmd /c copy /z "C:\MDTBuildLab\Captures\REFW10X64-001.wim" "C:\Sources\OSD\OS\Windows 10 Enterprise x64" ``` @@ -599,18 +607,18 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi - Join a domain: **contoso.com** - Account: click **Set** - User name: **contoso\CM_JD** - - Password: pass@word1 - - Confirm password: pass@word1 + - Password: **pass@word1** + - Confirm password: **pass@word1** - Click **OK** - Windows Settings - User name: **Contoso** - Organization name: **Contoso** - Product key: \ - Administrator Account: **Enable the account and specify the local administrator password** - - Password: pass@word1 - - Confirm password: pass@word1 + - Password: **pass@word1** + - Confirm password: **pass@word1** - Click **Next** - + 5. On the Capture Settings page, accept the default settings and click **Next**. 6. On the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package, click **OK**, and then click **Next**. @@ -645,28 +653,27 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 4. In the **State Restore** group, click the **Set Status 5** action, click **Add** in the upper left corner, point to **User State**, and click **Request State Store**. This adds a new action immediately after **Set Status 5**. -5. Configure the **Request State Store** action that was just added with the following settings:
        - - Request state storage location to: **Restore state from another computer**
        - - Select the **If computer account fails to connect to state store, use the Network Access account** checkbox.
        - - Options tab: Select the **Continue on error** checkbox.
        - - Add Condition: **Task Sequence Variable**:
        - - Variable: **USMTLOCAL**
        - - Condition: **not equals**
        - - Value: **True**
        - - Click **OK**.
        - - Click **Apply**
        . +5. Configure the **Request State Store** action that was just added with the following settings: + - Request state storage location to: **Restore state from another computer** + - Select the **If computer account fails to connect to state store, use the Network Access account** checkbox. + - Options tab: Select the **Continue on error** checkbox. + - Add Condition: **Task Sequence Variable**: + - Variable: **USMTLOCAL** + - Condition: **not equals** + - Value: **True** + - Click **OK** + - Click **Apply** 6. In the **State Restore** group, click **Restore User State**, click **Add**, point to **User State**, and click **Release State Store**. -7. Configure the **Release State Store** action that was just added with the following settings:
        - - Options tab: Select the **Continue on error** checkbox.
        - - Add Condition: **Task Sequence Variable**:
        - - Variable: **USMTLOCAL**
        - - Condition: **not equals**
        - - Value: **True**
        - - Click **OK**.
        - - Click **OK**
        . - +7. Configure the **Release State Store** action that was just added with the following settings: + - Options tab: Select the **Continue on error** checkbox. + - Add Condition: **Task Sequence Variable**: + - Variable: **USMTLOCAL** + - Condition: **not equals** + - Value: **True** + - Click **OK** + - Click **OK** ### Finalize the operating system configuration @@ -675,26 +682,27 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 1. In the MDT deployment workbench on SRV1, right-click **Deployment Shares** and then click **New Deployment Share**. 2. Use the following settings for the New Deployment Share Wizard: - - Deployment share path: **C:\MDTProduction**
        - - Share name: **MDTProduction$**
        - - Deployment share description: **MDT Production**
        - - Options: click **Next** to accept the default
        - - Summary: click **Next**
        - - Progress: settings will be applied
        + - Deployment share path: **C:\MDTProduction** + - Share name: **MDTProduction$** + - Deployment share description: **MDT Production** + - Options: click **Next** to accept the default + - Summary: click **Next** + - Progress: settings will be applied - Confirmation: click **Finish** -3. Right-click the **MDT Production** deployment share, and click **Properties**. +3. Right-click the **MDT Production** deployment share, and click **Properties**. 4. Click the **Monitoring** tab, select the **Enable monitoring for this deployment share** checkbox, and then click **OK**. 5. Type the following command at an elevated Windows PowerShell prompt on SRV1: - ``` + ```powershell notepad "C:\Sources\OSD\Settings\Windows 10 x64 Settings\CustomSettings.ini" ``` + 6. Replace the contents of the file with the following text, and then save the file: - ``` + ```ini [Settings] Priority=Default Properties=OSDMigrateConfigFiles,OSDMigrateMode @@ -712,11 +720,10 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi >As noted previously, if you wish to migrate accounts other than those in the Contoso domain, then change the OSDMigrateAdditionalCaptureOptions option. For example, the following option will capture settings from all user accounts: - ``` + ```ini OSDMigrateAdditionalCaptureOptions=/all ``` - 7. Return to the Configuration Manager console, and in the Software Library workspace, expand **Application Management**, click **Packages**, right-click **Windows 10 x64 Settings**, and then click **Update Distribution Points**. Click **OK** in the popup that appears. 8. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Distribute Content**. @@ -727,14 +734,14 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi ### Create a deployment for the task sequence -1. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Deploy**. +1. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Deploy**. 2. On the General page, next to **Collection**, click **Browse**, select the **All Unknown Computers** collection, click **OK**, and then click **Next**. -3. On the Deployment Settings page, use the following settings:
        - - Purpose: **Available**
        - - Make available to the following: **Only media and PXE**
        - - Click **Next**.
        +3. On the Deployment Settings page, use the following settings: + - Purpose: **Available** + - Make available to the following: **Only media and PXE** + - Click **Next**. 4. Click **Next** five times to accept defaults on the Scheduling, User Experience, Alerts, and Distribution Points pages. 5. Click **Close**. @@ -745,7 +752,7 @@ In this first deployment scenario, we will deploy Windows 10 using PXE. This sce 1. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell New-VM –Name "PC4" –NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 40GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC4" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 Start-VM PC4 @@ -754,18 +761,18 @@ In this first deployment scenario, we will deploy Windows 10 using PXE. This sce 2. Press ENTER when prompted to start the network boot service. -3. In the Task Sequence Wizard, provide the password: pass@word1, and then click **Next**. +3. In the Task Sequence Wizard, provide the password: **pass@word1**, and then click **Next**. 4. Before you click **Next** in the Task Sequence Wizard, press the **F8** key. A command prompt will open. -5. At the command prompt, type **explorer.exe** and review the Windows PE file structure. +5. At the command prompt, type **explorer.exe** and review the Windows PE file structure. 6. The smsts.log file is critical for troubleshooting any installation problems that might be encountered. Depending on the deployment phase, the smsts.log file is created in different locations: - - X:\windows\temp\SMSTSLog\smsts.log before disks are formatted. - - x:\smstslog\smsts.log after disks are formatted. - - c:\_SMSTaskSequence\Logs\Smstslog\smsts.log before the Microsoft Endpoint Configuration Manager client is installed. - - c:\windows\ccm\logs\Smstslog\smsts.log after the Microsoft Endpoint Configuration Manager client is installed. - - c:\windows\ccm\logs\smsts.log when the task sequence is complete. + - X:\Windows\temp\SMSTSLog\smsts.log before disks are formatted. + - X:\smstslog\smsts.log after disks are formatted. + - C:\\_SMSTaskSequence\Logs\Smstslog\smsts.log before the Microsoft Endpoint Manager client is installed. + - C:\Windows\ccm\logs\Smstslog\smsts.log after the Microsoft Endpoint Manager client is installed. + - C:\Windows\ccm\logs\smsts.log when the task sequence is complete. Note: If a reboot is pending on the client, the reboot will be blocked as long as the command window is open. @@ -783,14 +790,14 @@ In this first deployment scenario, we will deploy Windows 10 using PXE. This sce - Join the computer to the contoso.com domain - Install any applications that were specified in the reference image - 12. When Windows 10 installation has completed, sign in to PC4 using the **contoso\administrator** account. 13. Right-click **Start**, click **Run**, type **control appwiz.cpl**, press ENTER, click **Turn Windows features on or off**, and verify that **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** is installed. This is a feature included in the reference image. 14. Shut down the PC4 VM. ->Note: The following two procedures 1) Replace a client with Windows 10 and 2) Refresh a client with Windows 10 have been exchanged in their order in this guide compared to the previous version. This is to avoid having to restore Hyper-V checkpoints to have access to PC1 before the OS is upgraded. If this is your first time going through this guide, you won't notice any change, but if you have tried the guide previously then this change should make it simpler to complete. +> [!NOTE] +> The following two procedures 1) Replace a client with Windows 10 and 2) Refresh a client with Windows 10 have been exchanged in their order in this guide compared to the previous version. This is to avoid having to restore Hyper-V checkpoints to have access to PC1 before the OS is upgraded. If this is your first time going through this guide, you won't notice any change, but if you have tried the guide previously then this change should make it simpler to complete. ## Replace a client with Windows 10 using Configuration Manager @@ -823,7 +830,7 @@ In the replace procedure, PC1 will not be migrated to a new operating system. It Create a VM named PC4 to receive the applications and settings from PC1. This VM represents a new computer that will replace PC1. To create this VM, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: -``` +```powershell New-VM –Name "PC4" –NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC4" -DynamicMemoryEnabled $true -MinimumBytes 1024MB -MaximumBytes 2048MB -Buffer 20 Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF @@ -837,64 +844,66 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 2. If a PC1 checkpoint has not already been saved, then save a checkpoint by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell Checkpoint-VM -Name PC1 -SnapshotName BeginState ``` 3. On SRV1, in the Configuration Manager console, in the Administration workspace, expand **Hierarchy Configuration** and click on **Discovery Methods**. 4. Double-click **Active Directory System Discovery** and on the **General** tab select the **Enable Active Directory System Discovery** checkbox. 5. Click the yellow starburst, click **Browse**, select **contoso\Computers**, and then click **OK** three times. -6. When a popup dialog box asks if you want to run full discovery, click **Yes**. +6. When a popup dialog box asks if you want to run full discovery, click **Yes**. 7. In the Assets and Compliance workspace, click **Devices** and verify that the computer account names for SRV1 and PC1 are displayed. See the following example (GREGLIN-PC1 is the computer account name of PC1 in this example): ![assets](images/configmgr-assets.png) >If you do not see the computer account for PC1, try clicking the **Refresh** button in the upper right corner of the console. - + The **Client** column indicates that the Configuration Manager client is not currently installed. This procedure will be carried out next. 8. Sign in to PC1 using the contoso\administrator account and type the following at an elevated command prompt to remove any pre-existing client configuration, if it exists. Note: this command requires an elevated command prompt not an elevated Windows PowerShell prompt: - ``` + ```dos sc stop ccmsetup "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /Uninstall ``` + >If PC1 still has Configuration Manager registry settings that were applied by Group Policy, startup scripts, or other policies in its previous domain, these might not all be removed by CCMSetup /Uninstall and can cause problems with installation or registration of the client in its new environment. It might be necessary to manually remove these settings if they are present. For more information, see [Manual removal of the Configuration Manager client](https://blogs.technet.microsoft.com/michaelgriswold/2013/01/02/manual-removal-of-the-sccm-client/). -9. On PC1, temporarily stop Windows Update from queuing items for download and clear all BITS jobs from the queue: +9. On PC1, temporarily stop Windows Update from queuing items for download and clear all BITS jobs from the queue. From an elevated command prompt, type: - ``` + ```dos net stop wuauserv net stop BITS ``` Verify that both services were stopped successfully, then type the following at an elevated command prompt: - ``` + ```dos del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" net start BITS bitsadmin /list /allusers ``` - Verify that BITSAdmin displays 0 jobs. + Verify that BITSAdmin displays 0 jobs. 10. To install the Configuration Manager client as a standalone process, type the following at an elevated command prompt: - ``` + ```dos "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /mp:SRV1.contoso.com /logon SMSSITECODE=PS1 ``` -11. On PC1, using file explorer, open the **C:\Windows\ccmsetup** directory. During client installation, files will be downloaded here. + +11. On PC1, using file explorer, open the **C:\Windows\ccmsetup** directory. During client installation, files will be downloaded here. 12. Installation progress will be captured in the file: **c:\windows\ccmsetup\logs\ccmsetup.log**. You can periodically open this file in notepad, or you can type the following command at an elevated Windows PowerShell prompt to monitor installation progress: - ``` + ```powershell Get-Content -Path c:\windows\ccmsetup\logs\ccmsetup.log -Wait ``` - + Installation might require several minutes, and display of the log file will appear to hang while some applications are installed. This is normal. When setup is complete, verify that **CcmSetup is existing with return code 0** is displayed on the last line of the ccmsetup.log file and then press **CTRL-C** to break out of the Get-Content operation (if you are viewing the log in Windows PowerShell the last line will be wrapped). A return code of 0 indicates that installation was successful and you should now see a directory created at **C:\Windows\CCM** that contains files used in registration of the client with its site. -13. On PC1, open the Configuration Manager control panel applet by typing the following command: +13. On PC1, open the Configuration Manager control panel applet by typing the following command from a command prompt: - ``` + ```dos control smscfgrc ``` @@ -917,14 +926,14 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 1. On SRV1, in the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections** and then click **Create Device Collection**. 2. Use the following settings in the **Create Device Collection Wizard**: - - General > Name: **Install Windows 10 Enterprise x64**
        - - General > Limiting collection: **All Systems**
        - - Membership Rules > Add Rule: **Direct Rule**
        - - The **Create Direct Membership Rule Wizard** opens, click **Next**
        - - Search for Resources > Resource class: **System Resource**
        - - Search for Resources > Attribute name: **Name**
        - - Search for Resources > Value: **%**
        - - Select Resources > Value: Select the computername associated with the PC1 VM
        + - General > Name: **Install Windows 10 Enterprise x64** + - General > Limiting collection: **All Systems** + - Membership Rules > Add Rule: **Direct Rule** + - The **Create Direct Membership Rule Wizard** opens, click **Next** + - Search for Resources > Resource class: **System Resource** + - Search for Resources > Attribute name: **Name** + - Search for Resources > Value: **%** + - Select Resources > Value: Select the computername associated with the PC1 VM - Click **Next** twice and then click **Close** in both windows (Next, Next, Close, then Next, Next, Close) 3. Double-click the Install Windows 10 Enterprise x64 device collection and verify that the PC1 computer account is displayed. @@ -932,17 +941,16 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 4. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64** and then click **Deploy**. 5. Use the following settings in the Deploy Software wizard: - - General > Collection: Click Browse and select **Install Windows 10 Enterprise x64**
        - - Deployment Settings > Purpose: **Available**
        - - Deployment Settings > Make available to the following: **Configuration Manager clients, media and PXE**
        - - Scheduling > Click **Next**
        - - User Experience > Click **Next**
        - - Alerts > Click **Next**
        - - Distribution Points > Click **Next**
        - - Summary > Click **Next**
        + - General > Collection: Click Browse and select **Install Windows 10 Enterprise x64** + - Deployment Settings > Purpose: **Available** + - Deployment Settings > Make available to the following: **Configuration Manager clients, media and PXE** + - Scheduling > Click **Next** + - User Experience > Click **Next** + - Alerts > Click **Next** + - Distribution Points > Click **Next** + - Summary > Click **Next** - Verify that the wizard completed successfully and then click **Close** - ### Associate PC4 with PC1 1. On SRV1 in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Devices** and then click **Import Computer Information**. @@ -977,14 +985,14 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 1. On SRV1, in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Device Collections** and then click **Create Device Collection**. 2. Use the following settings in the **Create Device Collection Wizard**: - - General > Name: **USMT Backup (Replace)**
        - - General > Limiting collection: **All Systems**
        - - Membership Rules > Add Rule: **Direct Rule**
        - - The **Create Direct Membership Rule Wizard** opens, click **Next**
        - - Search for Resources > Resource class: **System Resource**
        - - Search for Resources > Attribute name: **Name**
        - - Search for Resources > Value: **%**
        - - Select Resources > Value: Select the computername associated with the PC1 VM (GREGLIN-PC1 in this example).
        + - General > Name: **USMT Backup (Replace)** + - General > Limiting collection: **All Systems** + - Membership Rules > Add Rule: **Direct Rule** + - The **Create Direct Membership Rule Wizard** opens, click **Next** + - Search for Resources > Resource class: **System Resource** + - Search for Resources > Attribute name: **Name** + - Search for Resources > Value: **%** + - Select Resources > Value: Select the computername associated with the PC1 VM (GREGLIN-PC1 in this example). - Click **Next** twice and then click **Close** in both windows. 3. Click **Device Collections** and then double-click **USMT Backup (Replace)**. Verify that the computer name/hostname associated with PC1 is displayed in the collection. Do not proceed until this name is displayed. @@ -992,27 +1000,29 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF ### Create a new deployment In the Configuration Manager console, in the Software Library workspace under Operating Systems, click **Task Sequences**, right-click **Replace Task Sequence**, click **Deploy**, and use the following settings: -- General > Collection: **USMT Backup (Replace)**
        -- Deployment Settings > Purpose: **Available**
        -- Deployment Settings > Make available to the following: **Only Configuration Manager Clients**
        -- Scheduling: Click **Next**
        -- User Experience: Click **Next**
        -- Alerts: Click **Next**
        -- Distribution Points: Click **Next**
        + +- General > Collection: **USMT Backup (Replace)** +- Deployment Settings > Purpose: **Available** +- Deployment Settings > Make available to the following: **Only Configuration Manager Clients** +- Scheduling: Click **Next** +- User Experience: Click **Next** +- Alerts: Click **Next** +- Distribution Points: Click **Next** - Click **Next** and then click **Close**. ### Verify the backup -1. On PC1, open the Configuration Manager control panel applet by typing the following command: +1. On PC1, open the Configuration Manager control panel applet by typing the following command in a command prompt: - ``` + ```dos control smscfgrc ``` + 2. On the **Actions** tab, click **Machine Policy Retrieval & Evaluation Cycle**, click **Run Now**, click **OK**, and then click **OK** again. This is one method that can be used to run a task sequence in addition to the Client Notification method that will be demonstrated in the computer refresh procedure. 3. Type the following at an elevated command prompt to open the Software Center: - ``` + ```dos C:\Windows\CCM\SCClient.exe ``` @@ -1029,18 +1039,19 @@ In the Configuration Manager console, in the Software Library workspace under Op 1. Start PC4 and press ENTER for a network boot when prompted. To start PC4, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell Start-VM PC4 vmconnect localhost PC4 ``` -2. In the **Welcome to the Task Sequence Wizard**, enter pass@word1 and click **Next**. -3. Choose the **Windows 10 Enterprise X64** image. -4. Setup will install the operating system using the Windows 10 Enterprise x64 reference image, install the configuration manager client, join PC4 to the domain, and restore users and settings from PC1. -5. Save checkpoints for all VMs if you wish to review their status at a later date. This is not required (checkpoints do take up space on the Hyper-V host). Note: the next procedure will install a new OS on PC1 update its status in Configuration Manager and in Active Directory as a Windows 10 device, so you cannot return to a previous checkpoint only on the PC1 VM without a conflict. Therefore, if you do create a checkpoint, you should do this for all VMs. + +1. In the **Welcome to the Task Sequence Wizard**, enter **pass@word1** and click **Next**. +1. Choose the **Windows 10 Enterprise X64** image. +1. Setup will install the operating system using the Windows 10 Enterprise x64 reference image, install the configuration manager client, join PC4 to the domain, and restore users and settings from PC1. +1. Save checkpoints for all VMs if you wish to review their status at a later date. This is not required (checkpoints do take up space on the Hyper-V host). Note: the next procedure will install a new OS on PC1 update its status in Configuration Manager and in Active Directory as a Windows 10 device, so you cannot return to a previous checkpoint only on the PC1 VM without a conflict. Therefore, if you do create a checkpoint, you should do this for all VMs. To save a checkpoint for all VMs, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` + ```powershell Checkpoint-VM -Name DC1 -SnapshotName cm-refresh Checkpoint-VM -Name SRV1 -SnapshotName cm-refresh Checkpoint-VM -Name PC1 -SnapshotName cm-refresh @@ -1048,7 +1059,6 @@ In the Configuration Manager console, in the Software Library workspace under Op ## Refresh a client with Windows 10 using Configuration Manager - ### Initiate the computer refresh 1. On SRV1, in the Assets and Compliance workspace, click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. @@ -1060,16 +1070,14 @@ In the Configuration Manager console, in the Software Library workspace under Op The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then click **More Details**. Click the **Status** tab to see a list of tasks that have been performed. See the following example: - ![asset](images/configmgr-asset.png) - - You can also monitor progress of the installation by using the MDT deployment workbench and viewing the **Monitoring** node under **Deployment Shares\MDT Production**. - + ![asset](images/configmgr-asset.png) + + You can also monitor progress of the installation by using the MDT deployment workbench and viewing the **Monitoring** node under **Deployment Shares\MDT Production**. + When installation has completed, sign in using the contoso\administrator account or the contoso\user1 account and verify that applications and settings have been successfully backed up and restored to your new Windows 10 Enterprise operating system. ![post-refresh](images/configmgr-post-refresh.png) - - ## Related Topics [System Center 2012 Configuration Manager Survival Guide](https://social.technet.microsoft.com/wiki/contents/articles/7075.system-center-2012-configuration-manager-survival-guide.aspx#Step-by-Step_Guides) diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index e86a065bf5..86d6e33e83 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -1,10 +1,12 @@ --- title: Configure a test lab to deploy Windows 10 +description: In this article, you will learn about concepts and procedures for deploying Windows 10 in a proof of concept lab environment. +ms.custom: seo-marvel-apr2020 ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay -description: Concepts and procedures for deploying Windows 10 in a proof of concept lab environment. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -12,7 +14,6 @@ ms.pagetype: deploy keywords: deployment, automate, tools, configure, mdt, sccm ms.localizationpriority: medium audience: itpro -author: greg-lindsay ms.topic: article --- @@ -22,7 +23,12 @@ ms.topic: article - Windows 10 -This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, see the following Windows 10 PoC deployment guides: +This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. + +> [!NOTE] +> Microsoft also offers a pre-configured lab using an evaluation version of Configuration Manager. For more information, see [Windows and Office deployment and management lab kit](/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab). + +This lab guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, see the following Windows 10 PoC deployment guides: - [Step by step: Deploy Windows 10 in a test lab using MDT](windows-10-poc-mdt.md)
        - [Step by step: Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md)
        @@ -144,7 +150,7 @@ Hardware requirements are displayed below: The lab architecture is summarized in the following diagram: -![PoC](images/poc.png) +![PoC diagram](images/poc.png) - Computer 1 is configured to host four VMs on a private, PoC network. - Two VMs are running Windows Server 2012 R2 with required network services and tools installed. @@ -208,7 +214,7 @@ Starting with Windows 8, the host computer’s microprocessor must support secon 2. The Hyper-V feature is not installed by default. To install it, open an elevated Windows PowerShell window and type the following command: -
        Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V –All
        +
        Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All
        This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. This command will also install Hyper-V if it isn't already installed, so if desired you can just type the following command on Windows Server 2012 or 2016 instead of using the Enable-WindowsOptionalFeature command: @@ -218,7 +224,7 @@ Starting with Windows 8, the host computer’s microprocessor must support secon >Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![hyper-v feature](images/hyper-v-feature.png) + ![hyper-v features](images/hyper-v-feature.png) ![hyper-v](images/svr_mgr2.png) @@ -443,7 +449,7 @@ Notes:
        3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). 4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example: - ![disk2vhd](images/disk2vhd.png) + ![disk2vhd 1](images/disk2vhd.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -476,7 +482,7 @@ Notes:
        5. Specify a location to save the resulting VHD or VHDX file (F:\VHD\PC1.vhdx in the following example) and click **Create**. See the following example: - ![disk2vhd](images/disk2vhd-gen2.png) + ![disk2vhd 2](images/disk2vhd-gen2.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -500,7 +506,7 @@ Notes:
        3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later. 4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example: - ![disk2vhd](images/disk2vhd4.png) + ![disk2vhd 3](images/disk2vhd4.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -536,8 +542,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 1. To add available space for the partition, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host:
        -    Resize-VHD –Path c:\VHD\2012R2-poc-2.vhd –SizeBytes 100GB
        -    $x = (Mount-VHD –Path c:\VHD\2012R2-poc-2.vhd -passthru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
        +    Resize-VHD -Path c:\VHD\2012R2-poc-2.vhd -SizeBytes 100GB
        +    $x = (Mount-VHD -Path c:\VHD\2012R2-poc-2.vhd -passthru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
             Resize-Partition -DriveLetter $x -Size (Get-PartitionSupportedSize -DriveLetter $x).SizeMax
             
        @@ -545,7 +551,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
             Get-Volume -DriveLetter $x
        -    Dismount-VHD –Path c:\VHD\2012R2-poc-2.vhd
        + Dismount-VHD -Path c:\VHD\2012R2-poc-2.vhd
        ### Configure Hyper-V @@ -706,7 +712,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
             Rename-Computer DC1
        -    New-NetIPAddress –InterfaceAlias Ethernet –IPAddress 192.168.0.1 –PrefixLength 24 -DefaultGateway 192.168.0.2
        +    New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.0.1 -PrefixLength 24 -DefaultGateway 192.168.0.2
             Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
             
        @@ -743,7 +749,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to netsh dhcp add securitygroups Restart-Service DHCPServer Add-DhcpServerInDC dc1.contoso.com 192.168.0.1 - Set-ItemProperty –Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager\Roles\12 –Name ConfigurationState –Value 2 + Set-ItemProperty -Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager\Roles\12 -Name ConfigurationState -Value 2 10. Next, add a DHCP scope and set option values: @@ -779,7 +785,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to **Configure service and user accounts** - Windows 10 deployment with MDT and Microsoft Endpoint Configuration Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire. + Windows 10 deployment with MDT and Microsoft Endpoint Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire. >To keep this test lab relatively simple, we will not create a custom OU structure and set permissions. Required permissions are enabled by adding accounts to the Domain Admins group. To configure these settings in a production environment, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) @@ -815,7 +821,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 15. After signing in, the operating system detects that it is running in a new environment. New drivers will be automatically installed, including the network adapter driver. The network adapter driver must be updated before you can proceed, so that you will be able to join the contoso.com domain. Depending on the resources allocated to PC1, installing the network adapter driver might take a few minutes. You can monitor device driver installation by clicking **Show hidden icons** in the notification area. - ![PoC](images/installing-drivers.png) + ![PoC 1](images/installing-drivers.png) >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease. @@ -873,14 +879,14 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to See the following example: - ![ISE](images/ISE.png) + ![ISE 1](images/ISE.png) 19. Click **File**, click **Save As**, and save the commands as **c:\VHD\pc1.ps1** on the Hyper-V host. 20. In the (lower) terminal input window, type the following commands to enable Guest Service Interface on PC1 and then use this service to copy the script to PC1:
             Enable-VMIntegrationService -VMName PC1 -Name "Guest Service Interface"
        -    Copy-VMFile "PC1" –SourcePath "C:\VHD\pc1.ps1"  –DestinationPath "C:\pc1.ps1" –CreateFullPath –FileSource Host
        +    Copy-VMFile "PC1" -SourcePath "C:\VHD\pc1.ps1" -DestinationPath "C:\pc1.ps1" -CreateFullPath -FileSource Host
             
        >In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not enabled in this step, then the copy-VMFile command will fail. In this case, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service. @@ -911,7 +917,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
             Rename-Computer SRV1
        -    New-NetIPAddress –InterfaceAlias Ethernet –IPAddress 192.168.0.2 –PrefixLength 24
        +    New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.0.2 -PrefixLength 24
             Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
             Restart-Computer
             
        diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md index 412dceea4f..bd8b4b1db5 100644 --- a/windows/deployment/windows-10-pro-in-s-mode.md +++ b/windows/deployment/windows-10-pro-in-s-mode.md @@ -1,90 +1,91 @@ ---- -title: Switch to Windows 10 Pro/Enterprise from S mode -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -description: Overview of Windows 10 Pro/Enterprise in S mode. S mode switch options are also outlined in this document. Switching out of S mode is optional. -keywords: Windows 10 S switch, S mode Switch, Switch in S mode, s mode switch, Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.prod: w10 -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Switch to Windows 10 Pro or Enterprise from S mode - -We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later. - - -A number of other transformations are possible depending on which version and edition of Windows 10 you are starting with. Depending on the details, you might *switch* between S mode and the ordinary version or *convert* between different editions while staying in or out of S mode. The following quick reference table summarizes all of the switches or conversions that are supported by various means: - - - - -| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: | | | -|-------------|---------------------|-----------------------------------|-------------------------------|--------------------------------------------| -| | | **Store for Education** (switch/convert all devices in your tenant) | **Microsoft Store** (switch/convert one device at a time) | **Intune** (switch/convert any number of devices selected by admin) | -| **Windows 10, version 1709** | Pro in S mode | Pro EDU | Pro | Not by this method | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home | Not by any method | Not by any method | Not by any method | -| | | | | | -| **Windows 10, version 1803** | Pro in S mode | Pro EDU in S mode | Pro | Not by this method | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home in S mode | Not by any method | Home | Not by this method | -| | Home | Not by any method | Not by any method | Not by any method | -| | | | | | -| **Windows 10, version 1809** | Pro in S mode | Pro EDU in S mode | Pro | Pro | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home in S mode | Not by any method | Home | Home | -| | Home | Not by any method | Not by any method | Not by any method | - - -Use the following information to switch to Windows 10 Pro through the Microsoft Store. -> [!IMPORTANT] -> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to rollback this kind of switch is through a [bare-metal recovery (BMR)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset. - -## Switch one device through the Microsoft Store -Use the following information to switch to Windows 10 Pro through the Microsoft Store or by navigating to **Settings** and then **Activation** on the device. - -Note these differences affecting switching modes in various releases of Windows 10: - -- In Windows 10, version 1709, you can switch devices one at a time from Windows 10 Pro in S mode to Windows 10 Pro by using the Microsoft Store or **Settings**. No other switches are possible. -- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**. -- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves. - - -1. Sign into the Microsoft Store using your Microsoft account. -2. Search for "S mode". -3. In the offer, select **Buy**, **Get**, or **Learn more.** - -You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro. - -## Switch one or more devices by using Microsoft Intune - -Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE - this gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle. - -1. Start Microsoft Intune. -2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. -3. Follow the instructions to complete the switch. - - -## Block users from switching - -You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. -To set this, go to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**. - -## S mode management with CSPs - -In addition to using Microsoft Intune or another modern device management tool to manage S mode, you can also use the [WindowsLicensing](https://docs.microsoft.com/windows/client-management/mdm/windowslicensing-csp) configuration service provider (CSP). In Windows 10, version 1809, we added S mode functionality that lets you switch devices, block devices from switching, and check the status (whether a device is in S mode). - - -## Related topics - -[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
        -[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
        -[Windows 10 Pro Education](https://docs.microsoft.com/education/windows/test-windows10s-for-edu)
        -[Introduction to Microsoft Intune in the Azure portal](https://docs.microsoft.com/intune/what-is-intune) +--- +title: Switch to Windows 10 Pro/Enterprise from S mode +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +description: Overview of Windows 10 Pro/Enterprise in S mode. S mode switch options are also outlined in this document. Switching out of S mode is optional. +keywords: Windows 10 S switch, S mode Switch, Switch in S mode, s mode switch, Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.prod: w10 +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Switch to Windows 10 Pro or Enterprise from S mode + +We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later. + + +A number of other transformations are possible depending on which version and edition of Windows 10 you are starting with. Depending on the details, you might *switch* between S mode and the ordinary version or *convert* between different editions while staying in or out of S mode. The following quick reference table summarizes all of the switches or conversions that are supported by various means: + + + + +| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: | | | +|-------------|---------------------|-----------------------------------|-------------------------------|--------------------------------------------| +| | | **Store for Education** (switch/convert all devices in your tenant) | **Microsoft Store** (switch/convert one device at a time) | **Intune** (switch/convert any number of devices selected by admin) | +| **Windows 10, version 1709** | Pro in S mode | Pro EDU | Pro | Not by this method | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home | Not by any method | Not by any method | Not by any method | +| | | | | | +| **Windows 10, version 1803** | Pro in S mode | Pro EDU in S mode | Pro | Not by this method | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home in S mode | Not by any method | Home | Not by this method | +| | Home | Not by any method | Not by any method | Not by any method | +| | | | | | +| **Windows 10, version 1809** | Pro in S mode | Pro EDU in S mode | Pro | Pro | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home in S mode | Not by any method | Home | Home | +| | Home | Not by any method | Not by any method | Not by any method | + + +Use the following information to switch to Windows 10 Pro through the Microsoft Store. +> [!IMPORTANT] +> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to rollback this kind of switch is through a [bare-metal recovery (BMR)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset. + +## Switch one device through the Microsoft Store +Use the following information to switch to Windows 10 Pro through the Microsoft Store or by navigating to **Settings** and then **Activation** on the device. + +Note these differences affecting switching modes in various releases of Windows 10: + +- In Windows 10, version 1709, you can switch devices one at a time from Windows 10 Pro in S mode to Windows 10 Pro by using the Microsoft Store or **Settings**. No other switches are possible. +- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**. +- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves. + + +1. Sign into the Microsoft Store using your Microsoft account. +2. Search for "S mode". +3. In the offer, select **Buy**, **Get**, or **Learn more.** + +You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro. + +## Switch one or more devices by using Microsoft Intune + +Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE - this gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle. + +1. Start Microsoft Intune. +2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. +3. Follow the instructions to complete the switch. + + +## Block users from switching + +You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. +To set this, go to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**. + +## S mode management with CSPs + +In addition to using Microsoft Intune or another modern device management tool to manage S mode, you can also use the [WindowsLicensing](https://docs.microsoft.com/windows/client-management/mdm/windowslicensing-csp) configuration service provider (CSP). In Windows 10, version 1809, we added S mode functionality that lets you switch devices, block devices from switching, and check the status (whether a device is in S mode). + + +## Related topics + +[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
        +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
        +[Windows 10 Pro Education](https://docs.microsoft.com/education/windows/test-windows10s-for-edu)
        +[Introduction to Microsoft Intune in the Azure portal](https://docs.microsoft.com/intune/what-is-intune) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index b1e21372a1..eb894fafdc 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -1,245 +1,249 @@ ---- -title: Windows 10 Subscription Activation -description: How to dynamically enable Windows 10 Enterprise or Education subscriptions -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro -author: greg-lindsay -manager: laurawi -ms.collection: M365-modern-desktop -search.appverid: -- MET150 -ms.topic: article ---- - -# Windows 10 Subscription Activation - -Starting with Windows 10, version 1703 Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to **Windows 10 Enterprise** automatically if they are subscribed to Windows 10 Enterprise E3 or E5. - -With Windows 10, version 1903 the Subscription Activation feature also supports the ability to step-up from Windows 10 Pro Education to the Enterprise grade edition for educational institutions – **Windows 10 Education**. - -The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices. - -## Subscription Activation for Windows 10 Enterprise - -With Windows 10, version 1703 both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as online services via subscription. Deploying [Windows 10 Enterprise](planning/windows-10-enterprise-faq-itpro.md) in your organization can now be accomplished with no keys and no reboots. - - If you are running Windows 10, version 1703 or later: - -- Devices with a current Windows 10 Pro license can be seamlessly upgraded to Windows 10 Enterprise. -- Product key-based Windows 10 Enterprise software licenses can be transitioned to Windows 10 Enterprise subscriptions. - -Organizations that have an Enterprise agreement can also benefit from the new service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure AD using [Azure AD Connect Sync](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-whatis). - -## Subscription Activation for Windows 10 Education - -Subscription Activation for Education works the same as the Enterprise version, but in order to use Subscription Activation for Education, you must have a device running Windows 10 Pro Education, version 1903 or later and an active subscription plan with a Windows 10 Enterprise license. For more information, see the [requirements](#windows-10-education-requirements) section. - -## In this article - -- [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later. -- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment. -- [Requirements](#requirements): Prerequisites to use the Windows 10 Subscription Activation model. -- [Benefits](#benefits): Advantages of Windows 10 subscription-based licensing. -- [How it works](#how-it-works): A summary of the subscription-based licensing option. -- [Virtual Desktop Access (VDA)](#virtual-desktop-access-vda): Enable Windows 10 Subscription Activation for VMs in the cloud. - -For information on how to deploy Windows 10 Enterprise licenses, see [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). - -## Inherited Activation - -Inherited Activation is a new feature available in Windows 10, version 1803 that allows Windows 10 virtual machines to inherit activation state from their Windows 10 host. - -When a user with Windows 10 E3/E5 or A3/A5 license assigned creates a new Windows 10 virtual machine (VM) using a Windows 10 local host, the VM inherits the activation state from a host machine independent of whether user signs on with a local account or using an Azure Active Directory (AAD) account on a VM. - -To support Inherited Activation, both the host computer and the VM must be running Windows 10, version 1803 or later. - -## The evolution of deployment - ->The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/). - -The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. - -![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) - -- **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
        -- **Windows 8.1** added support for a Windows 8.1 Pro to Windows 8.1 Enterprise in-place upgrade (considered a “repair upgrade” because the OS version was the same before and after).  This was a lot easier than wipe-and-load, but it was still time-consuming.
        -- **Windows 10, version 1507** added the ability to install a new product key using a provisioning package or using MDM to change the SKU.  This required a reboot, which would install the new OS components, and took several minutes to complete. However, it was a lot quicker than in-place upgrade.
        -- **Windows 10, version 1607** made a big leap forward. Now you can just change the product key and the SKU instantly changes from Windows 10 Pro to Windows 10 Enterprise.  In addition to provisioning packages and MDM, you can just inject a key using SLMGR.VBS (which injects the key into WMI), so it became trivial to do this using a command line.
        -- **Windows 10, version 1703** made this “step-up” from Windows 10 Pro to Windows 10 Enterprise automatic for those that subscribed to Windows 10 Enterprise E3 or E5 via the CSP program.
        -- **Windows 10, version 1709** adds support for Windows 10 Subscription Activation, very similar to the CSP support but for large enterprises, enabling the use of Azure AD for assigning licenses to users. When those users sign in on an AD or Azure AD-joined machine, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise.
        -- **Windows 10, version 1803** updates Windows 10 Subscription Activation to enable pulling activation keys directly from firmware for devices that support firmware-embedded keys. It is no longer necessary to run a script to perform the activation step on Windows 10 Pro prior to activating Enterprise. For virtual machines and hosts running Windows 10, version 1803 [Inherited Activation](#inherited-activation) is also enabled.
        -- **Windows 10, version 1903** updates Windows 10 Subscription Activation to enable step up from Windows 10 Pro Education to Windows 10 Education for those with a qualifying Windows 10 or Microsoft 365 subscription. - -## Requirements - -### Windows 10 Enterprise requirements - -> [!NOTE] -> The following requirements do not apply to general Windows 10 activation on Azure. Azure activation requires a connection to Azure KMS only, and supports workgroup, Hybrid, and Azure AD-joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure Virtual Machines](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/troubleshoot-activation-problems#understanding-azure-kms-endpoints-for-windows-product-activation-of-azure-virtual-machines). - -For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following: - -- Windows 10 (Pro or Enterprise) version 1703 or later installed on the devices to be upgraded. -- Azure Active Directory (Azure AD) available for identity management. -- Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. - -For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3/E5 or A3/A5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). - -If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://blogs.windows.com/business/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) - -#### Multi-factor authentication - -An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. - -To resolve this issue: - -If the device is running Windows 10, version 1703, 1709, or 1803, the user must either sign in with an Azure AD account, or you must disable MFA for this user during the 30-day polling period and renewal. - -If the device is running Windows 10, version 1809 or later: -1. Windows 10, version 1809 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch. -2. When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: - -![Subscription Activation with MFA1](images/sa-mfa1.png)
        -![Subscription Activation with MFA2](images/sa-mfa2.png)
        -![Subscription Activation with MFA2](images/sa-mfa3.png) - -### Windows 10 Education requirements - -1. Windows 10 Pro Education, version 1903 or later installed on the devices to be upgraded. -2. A device with a Windows 10 Pro Education digital license. You can confirm this information in Settings > Update & Security> Activation. -3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription. -4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. - ->If Windows 10 Pro is converted to Windows 10 Pro Education [using benefits available in Store for Education](https://docs.microsoft.com/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device using a Windows 10 Pro Education edition. - - -## Benefits - -With Windows 10 Enterprise or Windows 10 Education, businesses and institutions can benefit from enterprise-level security and control. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Education or Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 or A3 and E5 or A5 being available as a true online service, it is available in select channels thus allowing all organizations to take advantage of enterprise-grade Windows 10 features. To compare Windows 10 editions and review pricing, see the following: - -- [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare) -- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/cloud-platform/enterprise-mobility-security-pricing) - -You can benefit by moving to Windows as an online service in the following ways: - -1. Licenses for Windows 10 Enterprise and Education are checked based on Azure Active Directory (Azure AD) credentials, so now businesses have a systematic way to assign licenses to end users and groups in their organization. -2. User logon triggers a silent edition upgrade, with no reboot required -3. Support for mobile worker/BYOD activation; transition away from on-prem KMS and MAK keys. -4. Compliance support via seat assignment. -5. Licenses can be updated to different users dynamically, enabling you to optimize your licensing investment against changing needs. - -## How it works - -The device is AAD joined from Settings > Accounts > Access work or school. - -The IT administrator assigns Windows 10 Enterprise to a user. See the following figure. - -![Windows 10 Enterprise](images/ent.png) - -When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires. - -Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, version 1903 or later can get Windows 10 Enterprise or Education Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel. - -The following figures summarize how the Subscription Activation model works: - -Before Windows 10, version 1903:
        -![1703](images/before.png) - -After Windows 10, version 1903:
        -![1903](images/after.png) - -Note: -1. A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). -2. A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). - -### Scenarios - -**Scenario #1**:  You are using Windows 10, version 1803 or above, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). - -All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise, and devices that are already running Windows 10 Enterprise will migrate from KMS or MAK activated Enterprise edition to Subscription activated Enterprise edition when a Subscription Activation-enabled user signs in to the device. - -**Scenario #2**:  You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). - -To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer: - -
        -cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
        - -The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate.  This key comes from [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx) in the Volume Activation guide.  It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro. - -**Scenario #3**:  Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts.  The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in. - -In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above. - -If you’re running Windows 7, it can be more work.  A wipe-and-load approach works, but it is likely to be easier to upgrade from Windows 7 Pro directly to Windows 10 Enterprise. This is a supported path, and completes the move in one step.  This method also works if you are running Windows 8.1 Pro. - -### Licenses - -The following policies apply to acquisition and renewal of licenses on devices: -- Devices that have been upgraded will attempt to renew licenses about every 30 days, and must be connected to the Internet to successfully acquire or renew a license. -- If a device is disconnected from the Internet until its current subscription expires, the operating system will revert to Windows 10 Pro or Windows 10 Pro Education. As soon as the device is connected to the Internet again, the license will automatically renew. -- Up to five devices can be upgraded for each user license. -- If a device meets the requirements and a licensed user signs in on that device, it will be upgraded. - -Licenses can be reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. - -When you have the required Azure AD subscription, group-based licensing is the preferred method to assign Enterprise E3 and E5 licenses to users. For more information, see [Group-based licensing basics in Azure AD](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal). - -### Existing Enterprise deployments - -If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. - -Caution: Firmware-embedded Windows 10 activation happens automatically only when we go through OOBE(Out Of Box Experience) - -If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. - -If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt: - -
        -@echo off
        -FOR /F "skip=1" %%A IN ('wmic path SoftwareLicensingService get OA3xOriginalProductKey') DO  ( 
        -SET "ProductKey=%%A"
        -goto InstallKey
        -)
        -
        -:InstallKey
        -IF [%ProductKey%]==[] (
        -echo No key present
        -) ELSE (
        -echo Installing %ProductKey%
        -changepk.exe /ProductKey %ProductKey%
        -)
        -
        - -### Obtaining an Azure AD license - -Enterprise Agreement/Software Assurance (EA/SA): -- Organizations with a traditional EA must order a $0 SKU, process e-mails sent to the license administrator for the company, and assign licenses using Azure AD (ideally to groups using the new Azure AD Premium feature for group assignment). For more information, see [Enabling Subscription Activation with an existing EA](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#enabling-subscription-activation-with-an-existing-ea). -- The license administrator can assign seats to Azure AD users with the same process that is used for O365. -- New EA/SA Windows Enterprise customers can acquire both an SA subscription and an associated $0 cloud subscription. - -Microsoft Products & Services Agreements (MPSA): -- Organizations with MPSA are automatically emailed the details of the new service. They must take steps to process the instructions. -- Existing MPSA customers will receive service activation emails that allow their customer administrator to assign users to the service. -- New MPSA customers who purchase the Software Subscription Windows Enterprise E3 and E5 will be enabled for both the traditional key-based and new subscriptions activation method. - -### Deploying licenses - -See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). - -## Virtual Desktop Access (VDA) - -Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx). - -Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). - -## Related topics - -[Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
        -[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
        -[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)
        +--- +title: Windows 10 Subscription Activation +description: In this article, you will learn how to dynamically enable Windows 10 Enterprise or Education subscriptions. +keywords: upgrade, update, task sequence, deploy +ms.custom: seo-marvel-apr2020 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +manager: laurawi +ms.collection: M365-modern-desktop +search.appverid: +- MET150 +ms.topic: article +--- + +# Windows 10 Subscription Activation + +Starting with Windows 10, version 1703 Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to **Windows 10 Enterprise** automatically if they are subscribed to Windows 10 Enterprise E3 or E5. + +With Windows 10, version 1903 the Subscription Activation feature also supports the ability to step-up from Windows 10 Pro Education to the Enterprise grade edition for educational institutions – **Windows 10 Education**. + +The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices. + +## Subscription Activation for Windows 10 Enterprise + +With Windows 10, version 1703 both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as online services via subscription. Deploying [Windows 10 Enterprise](planning/windows-10-enterprise-faq-itpro.md) in your organization can now be accomplished with no keys and no reboots. + + If you are running Windows 10, version 1703 or later: + +- Devices with a current Windows 10 Pro license can be seamlessly upgraded to Windows 10 Enterprise. +- Product key-based Windows 10 Enterprise software licenses can be transitioned to Windows 10 Enterprise subscriptions. + +Organizations that have an Enterprise agreement can also benefit from the new service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure AD using [Azure AD Connect Sync](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-whatis). + +## Subscription Activation for Windows 10 Education + +Subscription Activation for Education works the same as the Enterprise version, but in order to use Subscription Activation for Education, you must have a device running Windows 10 Pro Education, version 1903 or later and an active subscription plan with a Windows 10 Enterprise license. For more information, see the [requirements](#windows-10-education-requirements) section. + +## Summary + +- [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later. +- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment. +- [Requirements](#requirements): Prerequisites to use the Windows 10 Subscription Activation model. +- [Benefits](#benefits): Advantages of Windows 10 subscription-based licensing. +- [How it works](#how-it-works): A summary of the subscription-based licensing option. +- [Virtual Desktop Access (VDA)](#virtual-desktop-access-vda): Enable Windows 10 Subscription Activation for VMs in the cloud. + +For information on how to deploy Windows 10 Enterprise licenses, see [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). + +## Inherited Activation + +Inherited Activation is a new feature available in Windows 10, version 1803 that allows Windows 10 virtual machines to inherit activation state from their Windows 10 host. + +When a user with Windows 10 E3/E5 or A3/A5 license assigned creates a new Windows 10 virtual machine (VM) using a Windows 10 local host, the VM inherits the activation state from a host machine independent of whether user signs on with a local account or using an Azure Active Directory (AAD) account on a VM. + +To support Inherited Activation, both the host computer and the VM must be running Windows 10, version 1803 or later. + +## The evolution of deployment + +> The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/). + +The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. + +![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) + +- **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
        +- **Windows 8.1** added support for a Windows 8.1 Pro to Windows 8.1 Enterprise in-place upgrade (considered a “repair upgrade” because the OS version was the same before and after).  This was a lot easier than wipe-and-load, but it was still time-consuming.
        +- **Windows 10, version 1507** added the ability to install a new product key using a provisioning package or using MDM to change the SKU.  This required a reboot, which would install the new OS components, and took several minutes to complete. However, it was a lot quicker than in-place upgrade.
        +- **Windows 10, version 1607** made a big leap forward. Now you can just change the product key and the SKU instantly changes from Windows 10 Pro to Windows 10 Enterprise.  In addition to provisioning packages and MDM, you can just inject a key using SLMGR.VBS (which injects the key into WMI), so it became trivial to do this using a command line.
        +- **Windows 10, version 1703** made this “step-up” from Windows 10 Pro to Windows 10 Enterprise automatic for those that subscribed to Windows 10 Enterprise E3 or E5 via the CSP program.
        +- **Windows 10, version 1709** adds support for Windows 10 Subscription Activation, very similar to the CSP support but for large enterprises, enabling the use of Azure AD for assigning licenses to users. When those users sign in on an AD or Azure AD-joined machine, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise.
        +- **Windows 10, version 1803** updates Windows 10 Subscription Activation to enable pulling activation keys directly from firmware for devices that support firmware-embedded keys. It is no longer necessary to run a script to perform the activation step on Windows 10 Pro prior to activating Enterprise. For virtual machines and hosts running Windows 10, version 1803 [Inherited Activation](#inherited-activation) is also enabled.
        +- **Windows 10, version 1903** updates Windows 10 Subscription Activation to enable step up from Windows 10 Pro Education to Windows 10 Education for those with a qualifying Windows 10 or Microsoft 365 subscription. + +## Requirements + +### Windows 10 Enterprise requirements + +> [!NOTE] +> The following requirements do not apply to general Windows 10 activation on Azure. Azure activation requires a connection to Azure KMS only, and supports workgroup, Hybrid, and Azure AD-joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure Virtual Machines](https://docs.microsoft.com/azure/virtual-machines/troubleshooting/troubleshoot-activation-problems#understanding-azure-kms-endpoints-for-windows-product-activation-of-azure-virtual-machines). + +> [!NOTE] +> Currently, Subscription Activation is only available on commercial tenants and is not currently available on US GCC or GCC High tenants. + +For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following: + +- Windows 10 (Pro or Enterprise) version 1703 or later installed on the devices to be upgraded. +- Azure Active Directory (Azure AD) available for identity management. +- Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. + +For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3/E5 or A3/A5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). + +If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://www.microsoft.com/en-us/microsoft-365/blog/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) + +#### Multi-factor authentication + +An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. + +To resolve this issue: + +If the device is running Windows 10, version 1703, 1709, or 1803, the user must either sign in with an Azure AD account, or you must disable MFA for this user during the 30-day polling period and renewal. + +If the device is running Windows 10, version 1809 or later: +1. Windows 10, version 1809 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch. +2. When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: + +![Subscription Activation with MFA example 1](images/sa-mfa1.png)
        +![Subscription Activation with MFA example 2](images/sa-mfa2.png)
        +![Subscription Activation with MFA example 3](images/sa-mfa3.png) + +### Windows 10 Education requirements + +1. Windows 10 Pro Education, version 1903 or later installed on the devices to be upgraded. +2. A device with a Windows 10 Pro Education digital license. You can confirm this information in Settings > Update & Security > Activation. +3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription. +4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. + +> If Windows 10 Pro is converted to Windows 10 Pro Education [using benefits available in Store for Education](https://docs.microsoft.com/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device using a Windows 10 Pro Education edition. + + +## Benefits + +With Windows 10 Enterprise or Windows 10 Education, businesses and institutions can benefit from enterprise-level security and control. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Education or Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 or A3 and E5 or A5 being available as a true online service, it is available in select channels thus allowing all organizations to take advantage of enterprise-grade Windows 10 features. To compare Windows 10 editions and review pricing, see the following: + +- [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare) +- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/cloud-platform/enterprise-mobility-security-pricing) + +You can benefit by moving to Windows as an online service in the following ways: + +1. Licenses for Windows 10 Enterprise and Education are checked based on Azure Active Directory (Azure AD) credentials, so now businesses have a systematic way to assign licenses to end users and groups in their organization. +2. User logon triggers a silent edition upgrade, with no reboot required +3. Support for mobile worker/BYOD activation; transition away from on-prem KMS and MAK keys. +4. Compliance support via seat assignment. +5. Licenses can be updated to different users dynamically, enabling you to optimize your licensing investment against changing needs. + +## How it works + +The device is AAD joined from Settings > Accounts > Access work or school. + +The IT administrator assigns Windows 10 Enterprise to a user. See the following figure. + +![Windows 10 Enterprise](images/ent.png) + +When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires. + +Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, version 1903 or later can get Windows 10 Enterprise or Education Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel. + +The following figures summarize how the Subscription Activation model works: + +Before Windows 10, version 1903:
        +![1703](images/before.png) + +After Windows 10, version 1903:
        +![1903](images/after.png) + +Note: +1. A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). +2. A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). + +### Scenarios + +**Scenario #1**:  You are using Windows 10, version 1803 or above, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). + +All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise, and devices that are already running Windows 10 Enterprise will migrate from KMS or MAK activated Enterprise edition to Subscription activated Enterprise edition when a Subscription Activation-enabled user signs in to the device. + +**Scenario #2**:  You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). + +To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer: + +
        +cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
        + +The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate.  This key comes from [Appendix A: KMS Client Setup Keys](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj612867(v=ws.11)) in the Volume Activation guide.  It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro. + +**Scenario #3**:  Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts.  The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in. + +In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above. + +If you’re running Windows 7, it can be more work.  A wipe-and-load approach works, but it is likely to be easier to upgrade from Windows 7 Pro directly to Windows 10 Enterprise. This is a supported path, and completes the move in one step.  This method also works if you are running Windows 8.1 Pro. + +### Licenses + +The following policies apply to acquisition and renewal of licenses on devices: +- Devices that have been upgraded will attempt to renew licenses about every 30 days, and must be connected to the Internet to successfully acquire or renew a license. +- If a device is disconnected from the Internet until its current subscription expires, the operating system will revert to Windows 10 Pro or Windows 10 Pro Education. As soon as the device is connected to the Internet again, the license will automatically renew. +- Up to five devices can be upgraded for each user license. +- If a device meets the requirements and a licensed user signs in on that device, it will be upgraded. + +Licenses can be reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. + +When you have the required Azure AD subscription, group-based licensing is the preferred method to assign Enterprise E3 and E5 licenses to users. For more information, see [Group-based licensing basics in Azure AD](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal). + +### Existing Enterprise deployments + +If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. + +Caution: Firmware-embedded Windows 10 activation happens automatically only when we go through OOBE(Out Of Box Experience) + +If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. + +If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt: + +
        +@echo off
        +FOR /F "skip=1" %%A IN ('wmic path SoftwareLicensingService get OA3xOriginalProductKey') DO  (
        +SET "ProductKey=%%A"
        +goto InstallKey
        +)
        +
        +:InstallKey
        +IF [%ProductKey%]==[] (
        +echo No key present
        +) ELSE (
        +echo Installing %ProductKey%
        +changepk.exe /ProductKey %ProductKey%
        +)
        +
        + +### Obtaining an Azure AD license + +Enterprise Agreement/Software Assurance (EA/SA): +- Organizations with a traditional EA must order a $0 SKU, process e-mails sent to the license administrator for the company, and assign licenses using Azure AD (ideally to groups using the new Azure AD Premium feature for group assignment). For more information, see [Enabling Subscription Activation with an existing EA](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#enabling-subscription-activation-with-an-existing-ea). +- The license administrator can assign seats to Azure AD users with the same process that is used for O365. +- New EA/SA Windows Enterprise customers can acquire both an SA subscription and an associated $0 cloud subscription. + +Microsoft Products & Services Agreements (MPSA): +- Organizations with MPSA are automatically emailed the details of the new service. They must take steps to process the instructions. +- Existing MPSA customers will receive service activation emails that allow their customer administrator to assign users to the service. +- New MPSA customers who purchase the Software Subscription Windows Enterprise E3 and E5 will be enabled for both the traditional key-based and new subscriptions activation method. + +### Deploying licenses + +See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). + +## Virtual Desktop Access (VDA) + +Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://microsoft.com/en-us/CloudandHosting/licensing_sca.aspx). + +Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). + +## Related topics + +[Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
        +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
        +[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)
        diff --git a/windows/deployment/windows-adk-scenarios-for-it-pros.md b/windows/deployment/windows-adk-scenarios-for-it-pros.md index 861ef1b1ad..d8d6f47273 100644 --- a/windows/deployment/windows-adk-scenarios-for-it-pros.md +++ b/windows/deployment/windows-adk-scenarios-for-it-pros.md @@ -1,97 +1,98 @@ ---- -title: Windows ADK for Windows 10 scenarios for IT Pros (Windows 10) -description: The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. -ms.assetid: FC4EB39B-29BA-4920-87C2-A00D711AE48B -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 07/27/2017 -ms.topic: article ---- - -# Windows ADK for Windows 10 scenarios for IT Pros - - -The [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. For an overview of what's new in the Windows ADK for Windows 10, see [What's new in kits and tools](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx). - -In previous releases of Windows, the Windows ADK docs were published on both TechNet and the MSDN Hardware Dev Center. Starting with the Windows 10 release, Windows ADK documentation is available on the MSDN Hardware Dev Center. For the Windows 10 ADK reference content, see [Desktop manufacturing](https://msdn.microsoft.com/library/windows/hardware/dn938361.aspx). - -Here are some key scenarios that will help you find the content on the MSDN Hardware Dev Center. - -### Create a Windows image using command-line tools - -[DISM](https://msdn.microsoft.com/library/windows/hardware/dn898558.aspx) is used to mount and service Windows images. - -Here are some things you can do with DISM: - -- [Mount an offline image](https://msdn.microsoft.com/library/windows/hardware/dn938321.aspx) -- [Add drivers to an offline image](https://msdn.microsoft.com/library/windows/hardware/dn898469.aspx) -- [Enable or disable Windows features](https://msdn.microsoft.com/library/windows/hardware/dn898567.aspx) -- [Add or remove packages](https://msdn.microsoft.com/library/windows/hardware/dn898481.aspx) -- [Add language packs](https://msdn.microsoft.com/library/windows/hardware/dn898470.aspx) -- [Add Universal Windows apps](https://msdn.microsoft.com/library/windows/hardware/dn898600.aspx) -- [Upgrade the Windows edition](https://msdn.microsoft.com/library/windows/hardware/dn898500.aspx) - -[Sysprep](https://msdn.microsoft.com/library/windows/hardware/dn938335.aspx) prepares a Windows installation for imaging and allows you to capture a customized installation. - -Here are some things you can do with Sysprep: - -- [Generalize a Windows installation](https://msdn.microsoft.com/library/windows/hardware/dn938334.aspx) -- [Customize the default user profile](https://msdn.microsoft.com/library/windows/hardware/dn898521.aspx) -- [Use answer files](https://msdn.microsoft.com/library/windows/hardware/dn938346.aspx) - -[Windows PE (WinPE)](https://msdn.microsoft.com/library/windows/hardware/dn938389.aspx) is a small operating system used to boot a computer that does not have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system. - -Here are ways you can create a WinPE image: - -- [Create a bootable USB drive](https://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) -- [Create a Boot CD, DVD, ISO, or VHD](https://msdn.microsoft.com/library/windows/hardware/dn938385.aspx) - -[Windows Recovery Environment (Windows RE)](https://msdn.microsoft.com/library/windows/hardware/dn938364.aspx) is a recovery environment that can repair common operating system problems. - -Here are some things you can do with Windows RE: - -- [Customize Windows RE](https://msdn.microsoft.com/library/windows/hardware/dn898523.aspx) -- [Push-button reset](https://msdn.microsoft.com/library/windows/hardware/dn938307.aspx) - -[Windows System Image Manager (Windows SIM)](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx) helps you create answer files that change Windows settings and run scripts during installation. - -Here are some things you can do with Windows SIM: - -- [Create answer file](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) -- [Add a driver path to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915062.aspx) -- [Add a package to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915066.aspx) -- [Add a custom command to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915058.aspx) - -For a list of settings you can change, see [Unattended Windows Setup Reference](https://msdn.microsoft.com/library/windows/hardware/dn923277.aspx) on the MSDN Hardware Dev Center. - -### Create a Windows image using Windows ICD - -Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113.aspx) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image. - -Here are some things you can do with Windows ICD: - -- [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107.aspx) -- [Export a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916110.aspx) -- [Build and deploy an image for Windows 10 for desktop editions](https://msdn.microsoft.com/library/windows/hardware/dn916105.aspx) - -### IT Pro Windows deployment tools - -There are also a few tools included in the Windows ADK that are specific to IT Pros and this documentation is available on TechNet: - -- [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) -- [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) - -  - -  - - - - - +--- +title: Windows ADK for Windows 10 scenarios for IT Pros (Windows 10) +description: The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. +ms.assetid: FC4EB39B-29BA-4920-87C2-A00D711AE48B +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +ms.date: 07/27/2017 +ms.topic: article +--- + +# Windows ADK for Windows 10 scenarios for IT Pros + + +The [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. For an overview of what's new in the Windows ADK for Windows 10, see [What's new in kits and tools](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx). + +In previous releases of Windows, the Windows ADK docs were published on both TechNet and the MSDN Hardware Dev Center. Starting with the Windows 10 release, Windows ADK documentation is available on the MSDN Hardware Dev Center. For the Windows 10 ADK reference content, see [Desktop manufacturing](https://msdn.microsoft.com/library/windows/hardware/dn938361.aspx). + +Here are some key scenarios that will help you find the content on the MSDN Hardware Dev Center. + +### Create a Windows image using command-line tools + +[DISM](https://msdn.microsoft.com/library/windows/hardware/dn898558.aspx) is used to mount and service Windows images. + +Here are some things you can do with DISM: + +- [Mount an offline image](https://msdn.microsoft.com/library/windows/hardware/dn938321.aspx) +- [Add drivers to an offline image](https://msdn.microsoft.com/library/windows/hardware/dn898469.aspx) +- [Enable or disable Windows features](https://msdn.microsoft.com/library/windows/hardware/dn898567.aspx) +- [Add or remove packages](https://msdn.microsoft.com/library/windows/hardware/dn898481.aspx) +- [Add language packs](https://msdn.microsoft.com/library/windows/hardware/dn898470.aspx) +- [Add Universal Windows apps](https://msdn.microsoft.com/library/windows/hardware/dn898600.aspx) +- [Upgrade the Windows edition](https://msdn.microsoft.com/library/windows/hardware/dn898500.aspx) + +[Sysprep](https://msdn.microsoft.com/library/windows/hardware/dn938335.aspx) prepares a Windows installation for imaging and allows you to capture a customized installation. + +Here are some things you can do with Sysprep: + +- [Generalize a Windows installation](https://msdn.microsoft.com/library/windows/hardware/dn938334.aspx) +- [Customize the default user profile](https://msdn.microsoft.com/library/windows/hardware/dn898521.aspx) +- [Use answer files](https://msdn.microsoft.com/library/windows/hardware/dn938346.aspx) + +[Windows PE (WinPE)](https://msdn.microsoft.com/library/windows/hardware/dn938389.aspx) is a small operating system used to boot a computer that does not have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system. + +Here are ways you can create a WinPE image: + +- [Create a bootable USB drive](https://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) +- [Create a Boot CD, DVD, ISO, or VHD](https://msdn.microsoft.com/library/windows/hardware/dn938385.aspx) + +[Windows Recovery Environment (Windows RE)](https://msdn.microsoft.com/library/windows/hardware/dn938364.aspx) is a recovery environment that can repair common operating system problems. + +Here are some things you can do with Windows RE: + +- [Customize Windows RE](https://msdn.microsoft.com/library/windows/hardware/dn898523.aspx) +- [Push-button reset](https://msdn.microsoft.com/library/windows/hardware/dn938307.aspx) + +[Windows System Image Manager (Windows SIM)](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx) helps you create answer files that change Windows settings and run scripts during installation. + +Here are some things you can do with Windows SIM: + +- [Create answer file](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) +- [Add a driver path to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915062.aspx) +- [Add a package to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915066.aspx) +- [Add a custom command to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915058.aspx) + +For a list of settings you can change, see [Unattended Windows Setup Reference](https://msdn.microsoft.com/library/windows/hardware/dn923277.aspx) on the MSDN Hardware Dev Center. + +### Create a Windows image using Windows ICD + +Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113.aspx) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image. + +Here are some things you can do with Windows ICD: + +- [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107.aspx) +- [Export a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916110.aspx) +- [Build and deploy an image for Windows 10 for desktop editions](https://msdn.microsoft.com/library/windows/hardware/dn916105.aspx) + +### IT Pro Windows deployment tools + +There are also a few tools included in the Windows ADK that are specific to IT Pros and this documentation is available on TechNet: + +- [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) +- [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/windows-autopilot/TOC.md b/windows/deployment/windows-autopilot/TOC.md index d94b04fdcb..b2e8164e4c 100644 --- a/windows/deployment/windows-autopilot/TOC.md +++ b/windows/deployment/windows-autopilot/TOC.md @@ -1,32 +1,2 @@ -# [Windows Autopilot deployment](index.md) -# [What's new](windows-autopilot-whats-new.md) -# Understanding Windows Autopilot -## [Overview](windows-autopilot.md) -## [Requirements](windows-autopilot-requirements.md) -## [Scenarios and capabilities](windows-autopilot-scenarios.md) -## [Get started](demonstrate-deployment-on-vm.md) - -# Deployment scenarios -## [Deployment processes](deployment-process.md) -## [User-driven mode](user-driven.md) -## [Self-deploying mode](self-deploying.md) -## [Windows Autopilot Reset](windows-autopilot-reset.md) -## [White glove](white-glove.md) -## [Support for existing devices](existing-devices.md) - -# Administering Windows Autopilot -## [Registering devices](add-devices.md) -## [Configuring device profiles](profiles.md) -## [Enrollment Status Page](enrollment-status.md) -## [BitLocker encryption](bitlocker.md) -## [DFCI management](dfci-management.md) -## [Windows Autopilot update](autopilot-update.md) -## [Troubleshooting](troubleshooting.md) -## [Known issues](known-issues.md) - -# Support -## [FAQ](autopilot-faq.md) -## [Contacts](autopilot-support.md) -## [Registration authorization](registration-auth.md) -## [Device guidelines](autopilot-device-guidelines.md) -## [Motherboard replacement](autopilot-mbr.md) +# [Windows Autopilot deployment](index.yml) +## [Get started](demonstrate-deployment-on-vm.md) \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/add-devices.md b/windows/deployment/windows-autopilot/add-devices.md deleted file mode 100644 index cb55dd325b..0000000000 --- a/windows/deployment/windows-autopilot/add-devices.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -title: Adding devices -ms.reviewer: -manager: laurawi -description: How to add devices to Windows Autopilot -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Adding devices to Windows Autopilot - -**Applies to** - -- Windows 10 - -Before deploying a device using Windows Autopilot, the device must be registered with the Windows Autopilot deployment service. Ideally, this would be performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually. - -## OEM registration - -When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers and resellers" section of the [Windows Autopilot information page](https://aka.ms/windowsautopilot). - -Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization). - -## Reseller, distributor, or partner registration - -Customers may purchase devices from resellers, distributors, or other partners. As long as these resellers, distributors, and partners are part of the [Cloud Solution Partners (CSP) program](https://partner.microsoft.com/en-us/cloud-solution-provider), they too can register devices on behalf of the customer. - -As with OEMs, CSP partners must be granted permission to register devices on behalf of an organization. This follows the process described on the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#csp-authorization). The CSP partner initiates a request to establish a relationship with the organization, with approval granted by a global administrator from the organization. Once approved, CSP partners add devices using [Partner Center](https://partner.microsoft.com/en-us/pcv/dashboard/overview), either directly through the web site or via available APIs that can automate the same tasks. - -Windows Autopilot does not require delegated administrator permissions when establishing the relationship between the CSP partner and the organization. As part of the approval process performed by the global administrator, the global administrator can choose to uncheck the "Include delegated administration permissions" checkbox. - -## Automatic registration of existing devices - -If an existing device is already running a supported version of Windows 10 semi-annual channel and enrolled in an MDM service such an Intune, that MDM service can ask the device for the hardware ID (also known as a hardware hash). Once it has that, it can automatically register the device with Windows Autopilot. - -For instructions on how to do this with Microsoft Intune, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile) documentation describing the "Convert all targeted devices to Autopilot" setting. - -Also note that when using the [Windows Autopilot for existing devices](https://docs.microsoft.com/windows/deployment/windows-autopilot/existing-devices) scenario, it is not necessary to pre-register the devices with Windows Autopilot. Instead, a configuration file (AutopilotConfigurationFile.json) containing all the Windows Autopilot profile settings is used; the device can be registered with Windows Autopilot after the fact using the same "Convert all targeted devices to Autopilot" setting. - -## Manual registration - -To perform manual registration of a device, you must first capture its hardware ID (also known as a hardware hash). Once this process has completed, the resulting hardware ID can be uploaded to the Windows Autopilot service. Because this process requires booting the device into Windows 10 in order to obtain the hardware ID, this is intended primarily for testing and evaluation scenarios. - -## Device identification - -To define a device to the Windows Autopilot deployment service, a unique hardware ID for the device needs to be captured and uploaded to the service. While this step is ideally done by the hardware vendor (OEM, reseller, or distributor), automatically associating the device with an organization, it is also possible to do this through a harvesting process that collects the device from within a running Windows 10 installation. - -The hardware ID, also commonly referred to as a hardware hash, contains several details about the device, including its manufacturer, model, device serial number, hard drive serial number, and many other attributes that can be used to uniquely identify that device. - -Note that the hardware hash also contains details about when it was generated, so it will change each time it is generated. When the Windows Autopilot deployment service attempts to match a device, it considers changes like that, as well as more substantial changes such as a new hard drive, and is still able to match successfully. But substantial changes to the hardware, such as a motherboard replacement, would not match, so a new hash would need to be generated and uploaded. - -### Collecting the hardware ID from existing devices using Microsoft Endpoint Configuration Manager - -Microsoft Endpoint Configuration Manager automatically collects the hardware hashes for existing Windows 10 devices. For more information, see [Gather information from Configuration Manager for Windows Autopilot](https://docs.microsoft.com/configmgr/comanage/how-to-prepare-win10#windows-autopilot). You can extract the hash information from Configuration Manager into a CSV file. - -> [!Note] -> Before uploading the CSV file on Intune, please make sure that the first row contains the device serial number, Windows product ID, hardware hash, group tag, and assigned user. If there is header information on the top of CSV file, please delete that header information. See details at [Enroll Windows devices in Intune](https://docs.microsoft.com/intune/enrollment/enrollment-autopilot). - -### Collecting the hardware ID from existing devices using PowerShell - -The hardware ID, or hardware hash, for an existing device is available through Windows Management Instrumentation (WMI), as long as that device is running a supported version of Windows 10 semi-annual channel. To help gather this information, as well as the serial number of the device (useful to see at a glance the machine to which it belongs), a PowerShell script called [Get-WindowsAutoPilotInfo.ps1 has been published to the PowerShell Gallery website](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo). - -To use this script, you can download it from the PowerShell Gallery and run it on each computer, or you can install it directly from the PowerShell Gallery. To install it directly and capture the hardware hash from the local computer, use the following commands from an elevated Windows PowerShell prompt: - -```powershell -md c:\\HWID -Set-Location c:\\HWID -Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Install-Script -Name Get-WindowsAutoPilotInfo -Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv -``` - -The commands can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the [Get-WindowsAutoPilotInfo](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information about running the script. - ->[!IMPORTANT] ->Do not connect devices to the Internet prior to capturing the hardware ID and creating an Autopilot device profile. This includes collecting the hardware ID, uploading the .CSV into MSfB or Intune, assigning the profile, and confirming the profile assignment. Connecting the device to the Internet before this process is complete will result in the device downloading a blank profile that is stored on the device until it is explicity removed. In Windows 10 version 1809, you can clear the cached profile by restarting OOBE. In previous versions, the only way to clear the stored profile is to re-install the OS, reimage the PC, or run **sysprep /generalize /oobe**.
        ->After Intune reports the profile ready to go, only then should the device be connected to the Internet. - ->[!NOTE] ->If OOBE is restarted too many times it can enter a recovery mode and fail to run the Autopilot configuration. You can identify this scenario if OOBE displays multiple configuration options on the same page, including language, region, and keyboard layout. The normal OOBE displays each of these on a separate page. The following value key tracks the count of OOBE retries:
        ->**HKCU\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UserOOBE**
        ->To ensure OOBE has not been restarted too many times, you can change this value to 1. - -## Registering devices - - - - -Once the hardware IDs have been captured from existing devices, they can be uploaded through a variety of means. See the detailed documentation for each available mechanism. - -- [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot). This is the preferred mechanism for all customers. -- [Partner Center](https://msdn.microsoft.com/partner-center/autopilot). This is used by CSP partners to register devices on behalf of customers. -- [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa). This is typically used by small and medium businesses (SMBs) who manage their devices using Microsoft 365 Business. -- [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles). You might already be using MSfB to manage your apps and settings. - -A summary of each platform's capabilities is provided below.
        -
        - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Platform/PortalRegister devices?Create/Assign profileAcceptable DeviceID
        OEM Direct APIYES - 1000 at a time maxNOTuple or PKID
        Partner CenterYES - 1000 at a time maxYES34Tuple or PKID or 4K HH
        IntuneYES - 500 at a time max1YES124K HH
        Microsoft Store for BusinessYES - 1000 at a time maxYES44K HH
        Microsoft 365 BusinessYES - 1000 at a time maxYES34K HH
        - ->1Microsoft recommended platform to use
        ->2Intune license required
        ->3Feature capabilities are limited
        ->4Device profile assignment will be retired from MSfB and Partner Center in the coming months
        - - -Also see the following topics for more information about device IDs: -- [Device identification](#device-identification) -- [Windows Autopilot device guidelines](https://docs.microsoft.com/windows/deployment/windows-autopilot/autopilot-device-guidelines) -- [Add devices to a customer account](https://docs.microsoft.com/partner-center/autopilot) - - -## Summary - -When deploying new devices using Windows Autopilot, the following steps are required: - -1. [Register devices](#registering-devices). Ideally, this step is performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually. -2. [Configure device profiles](profiles.md), specifying how the device should be deployed and what user experience should be presented. -3. Boot the device. When the device is connected to a network with internet access, it will contact the Windows Autopilot deployment service to see if the device is registered, and if it is, it will download profile settings such as the [Enrollment Status page](enrollment-status.md), which are used to customize the end user experience. - -## Other configuration settings - -- [Bitlocker encryption settings](bitlocker.md): You can configure the BitLocker encryption settings to be applied before automatic encryption is started. \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md b/windows/deployment/windows-autopilot/autopilot-device-guidelines.md deleted file mode 100644 index 7784e955ea..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Windows Autopilot device guidelines -ms.reviewer: -manager: laurawi -description: Learn all about hardware, firmware, and software best practices for Windows Autopilot deployment. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot device guidelines - -**Applies to** - -- Windows 10 - -## Hardware and firmware best practice guidelines for Windows Autopilot - -All devices used with Windows Autopilot should meet the [minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) for Windows 10. - -The following additional best practices ensure that devices can easily be provisioned by organizations as part of the Windows Autopilot deployment process: -- Ensure that the TPM 2.0 is enabled and in a good state (not in Reduced Functionality Mode) by default on devices intended for Windows Autopilot self-deploying mode. -- The OEM provisions unique tuple info (SmbiosSystemManufacturer, SmbiosSystemProductName, SmbiosSystemSerialNumber) or PKID + SmbiosSystemSerialNumber into the [SMBIOS fields](https://docs.microsoft.com/windows-hardware/drivers/bringup/smbios) per Microsoft specification (Manufacturer, Product Name and Serial Number stored in SMBIOS Type 1 04h, Type 1 05h and Type 1 07h). -- The OEM uploads 4K Hardware Hashes obtained using OA3 Tool RS3+ run in Audit mode on full OS to Microsoft via CBR report prior to shipping devices to an Autopilot customer or channel partner. -- As a best practice, Microsoft requires that OEM shipping drivers are published to Windows Update within 30 days of the CBR being submitted, and system firmware and driver updates are published to Windows Update within 14 days -- The OEM ensures that the PKID provisioned in the SMBIOS is passed on to the channel. - -## Software best practice guidelines for Windows Autopilot - -- The Windows Autopilot device should be preinstalled with only a Windows 10 base image plus drivers. -- You can preinstall your licensed version of Office, such as [Microsoft 365 Apps for enterprise](https://docs.microsoft.com/deployoffice/about-office-365-proplus-in-the-enterprise). -- Unless explicitly requested by the customer, no other preinstalled software should be included. - - Per OEM Policy, Windows 10 features, including built-in apps, should not be disabled or removed. - -## Related topics - -[Windows Autopilot customer consent](registration-auth.md)
        -[Motherboard replacement scenario guidance](autopilot-mbr.md)
        diff --git a/windows/deployment/windows-autopilot/autopilot-faq.md b/windows/deployment/windows-autopilot/autopilot-faq.md deleted file mode 100644 index 616f6b21ce..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-faq.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Windows Autopilot FAQ -ms.reviewer: This topic provides OEMs, partners, administrators, and end users with answers to some frequently asked questions about deploying Windows 10 with Windows Autopilot. -manager: laurawi -description: Support information for Windows Autopilot -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot FAQ - -**Applies to: Windows 10** - -This article provides OEMs, partners, administrators, and end users with answers to some frequently asked questions about deploying Windows 10 with Windows Autopilot. - -A [glossary](#glossary) of abbreviations used in this article is provided at the end. - - -## Microsoft Partner Center - -| Question | Answer | -| --- | --- | -| In the Partner Center, does the Tenant ID need to be provided with every device file upload? Is it needed to allow the business customer to access their devices in Microsoft Store for Business (MSfB)? | No. Providing the Tenant ID is a one-time entry in the Partner Center that can be reused with future device uploads. | -| How does the customer or tenant know that their devices are ready to be claimed in MSfB? | After the device file upload is completed in the Partner Center, the tenant can see the devices available for Windows Autopilot setup in MSfB. The OEM needs to advise the tenant to access MSfB. Autonotification from MSfB to the tenant is being developed. | -| How does a customer authorize an OEM or Channel Partner to register Autopilot devices on the customer’s behalf? | Before an OEM or Channel Partner can register a device for Autopilot on behalf of a customer, the customer must first give them consent. The consent process begins with the OEM or Channel Partner sending a link to the customer that directs the customer to a consent page in MSfB. For more information, see [Registration](registration-auth.md). | -| Are there any restrictions if a business customer has registered devices in MSfB and later wants those devices to be managed by a Cloud Solution Provider (CSP) using the Partner Center? | The devices will need to be deleted in MSfB by the business customer before the CSP can upload and manage them in the Partner Center. | -| Does Windows Autopilot support removing the option to enable a local administrator account? | Windows Autopilot doesn’t support removing the local admin account. However, it does support restricting the user performing Azure Active Directory (Azure AD) domain join in OOBE to a standard account (versus an administrator account by default).| -| How can I test the Windows Autopilot CSV file in the Partner Center? | Only CSP Partners have access to the Partner Center portal. If you are a CSP, you can create a Sales agent user account that has access to devices for testing the file. This can be done today in the Partner Center.

        For more information, see [Create user accounts and set permissions](https://msdn.microsoft.com/partner-center/create-user-accounts-and-set-permissions). | -| Must I become a CSP to participate in Windows Autopilot? | Top volume OEMs do not, as they can use the OEM Direct API. All others who choose to use MPC to register devices must become CSPs in order to access MPC. | -| Do the different CSP levels have all the same capabilities when it comes to Windows Autopilot? | For purposes of Windows Autopilot, there are three different types of CSPs, each with different levels of authority and access:

        1. Direct CSP: Gets direct authorization from the customer to register devices.

        2. Indirect CSP Provider: Gets implicit permission to register devices through the relationship their CSP Reseller partner has with the customer. Indirect CSP Providers register devices through Microsoft Partner Center.

        3. Indirect CSP Reseller: Gets direct authorization from the customer to register devices. At the same time, their indirect CSP Provider partner also gets authorization, which means that either the Indirect Provider or the Indirect Reseller can register devices for the customer. However, the Indirect CSP Reseller must register devices through the MPC UI (manually uploading CSV file), whereas the Indirect CSP Provider has the option to register devices using the MPC APIs. | - - -## Manufacturing - -| Question | Answer | -| --- | --- | -| What changes need to be made in the factory OS image for customer configuration settings? |No changes are required on the factory floor to enable Windows Autopilot deployment. | -| What version of the OA3 tool meets Windows Autopilot deployment requirements? | Windows Autopilot can work with any version of the OA3 tool. We recommend using a supported version of Windows 10 semi-annual channel to generate the 4K hardware hash. | -| At the time of placing an order, do customers need to be state whether they want it with or without Windows Autopilot options? | Yes, if they want Windows Autopilot, they will want a supported version of Windows 10 semi-annual channel. Also, they will want to receive the CSV file or have the file upload (that is, registration) completed on their behalf. | -| Does the OEM need to manage or collect any custom imaging files from customers and perform any image uploads to Microsoft? | No change, OEMs just send the CBRs as usual to Microsoft. No images are sent to Microsoft to enable Windows Autopilot. Windows Autopilot only customizes OOBE and allows policy configurations (disables admin account, for example). | -| Are there any customer impacts to upgrading from Windows 8 to Windows 10? | The devices must be running a supported version of Windows 10 semi-annual channel to enroll in Windows Autopilot deployment. Otherwise, there are no impacts. | -| Will there be any change to the existing CBR with 4K hardware hash? | No. | -| What new information needs to be sent from the OEM to Microsoft? | Nothing, unless the OEM opts to register the device on the customer’s behalf, in which case they would upload the device ID using a CSV file into Microsoft Partner Center, or use the OEM Direct API. | -| Is there a contract or amendment for an OEM to participate in Windows Autopilot Deployment? | No. | - -## CSV schema - -| Question | Answer | -| --- | --- | -| Can a comma be used in the CSV file? | No. | -| What error messages can a user expect to see in the Partner Center or MSfB when uploading a file? | See the In Microsoft Store for Business section of this guide. | -| Is there a limit to the number of devices that can be listed in the CSV file? | Yes, the CSV file can only contain 1,000 devices to apply to a single profile. If more than 1,000 devices need to be applied to a profile, the devices need to be uploaded through multiple CSV files. | -| Does Microsoft have any recommendations on how an OEM should provide the CSV file to their customers? | We recommend encrypting the CSV file when sending to the business customer to self-register their Windows Autopilot devices (either through MPC, MSfB, or Intune). | - - -## Hardware hash - -| Question | Answer | -| --- | --- | -| Must every hardware hash submitted by the OEM contain the SMBIOS UUID (universally unique identifier), MAC (media access control) address, and unique disk serial number (if using Windows 10 OEM Activation 3.0 tool)? | Yes. Since Windows Autopilot is based on the ability to uniquely identify devices applying for cloud configuration, it is critical to submit hardware hashes that meet the outlined requirement. | -| What is the reason for needing the SMBIOS UUID, MAC Address, and Disk Serial Number in the hardware hash details? | For creating the hardware hash, these are the fields that are needed to identify a device, as parts of the device are added or removed. Since we don’t have a unique identifier for Windows devices, this is the best logic to identify a device. | -| What is difference between OA3 hardware hash, 4K hardware hash, and Windows Autopilot hardware hash? | None. They’re different names for the same thing. The OA3 tool output is called the OA3 Hash, which is 4K in size, which is usable for the Windows Autopilot deployment scenario. Note: When using an older, unsupported Windows version OA3Tool, you get a different sized Hash, which may not be used for Windows Autopilot deployment. | -| What is the thought around parts replacement and repair for the NIC (network interface controller) and Disk? Will the hardware hash become invalid? | Yes. If you replace parts, you need to gather the new hardware hash, though it depends on what is replaced, and the characteristics of the parts. For example, if you replace the TPM or motherboard, it’s a new device and you must have new hardware hash. If you replace one network card, it’s probably not a new device, and the device will function with the old hardware hash. However, as a best practice, you should assume the old hardware hash is invalid and get a new hardware hash after any hardware changes. This is recommended anytime you replace parts. | - -## Motherboard replacement - -| Question | Answer | -| --- | --- | -| How does Autopilot handle motherboard replacement scenarios? | Motherboard replacement is out for scope for Autopilot. Any device that is repaired or serviced in a way that alters the ability to identify the device for Windows Autopilot must go through the normal OOBE process, and manually select the right settings or apply a custom image, as is the case today.

        To reuse the same device for Windows Autopilot after a motherboard replacement, the device would need to be de-registered from Autopilot, the motherboard replaced, a new 4K HH harvested, and then re-registered using the new 4K hardware hash (or device ID).

        **Note**: An OEM will not be able to use the OEM Direct API to re-register the device, since the OEM Direct API only accepts a tuple or PKID. In this case, the OEM would either have to send the new 4K hardware hash information using a CSV file to customer, and let customer reregister the device using MSfB or Intune.| - -## SMBIOS - -| Question | Answer | -| --- | --- | -| Any specific requirement to SMBIOS UUID? | It must be unique as specified in the Windows 10 hardware requirements. | -| What is the requirement on the SMBIOS table to meet the Windows Autopilot hardware hash need? | It must meet all the Windows 10 hardware requirements. Additional details may be found [here](https://msdn.microsoft.com/library/jj128256(v=vs.85).aspx). | -| If the SMBIOS supports UUID and Serial Number, is it enough for the OA3 tool to generate the hardware hash? | No. At a minimum, the following SMBIOS fields need to be populated with unique values: ProductKeyID SmbiosSystemManufacturer SmbiosSystemProductName SmbiosSystemSerialNumber SmbiosSkuNumber SmbiosSystemFamily MacAddress SmbiosUuid DiskSerialNumber TPM EkPub | - -## Technical interface - -| Question | Answer | -| --- | --- | -| What is the interface to get the MAC Address and Disk Serial Number? How does the OA tool get MAC and Disk Serial #? | Disk serial number is found from IOCTL_STORAGE_QUERY_PROPERTY with StorageDeviceProperty/PropertyStandardQuery. Network MAC address is IOCTL_NDIS_QUERY_GLOBAL_STATS from OID_802_3_PERMANENT_ADDRESS. However the method for performing this operation varies depending on the scenario. | -| Follow up clarification: If we have 2-3 MACs on the system, how does OA Tool choose which MAC Address and Disk Serial Number are on the system since there are multiple instances of each? If a platform has LAN And WLAN, which MAC is chosen? | In short, all available values are used. In detail, there may be specific usage rules. The system disk serial number is more important than the other disks available. Network interfaces that are removable should not be used if detected as they are removable. LAN vs WLAN should not matter, as both will be used. | - -## The end-user experience - -|Question|Answer| -|----|-----| -|How do I know that I received Autopilot?|You can tell that you received Windows Autopilot (as in the device received a configuration but has not yet applied it) when you skip the selection page (as seen below), and are immediately taken to a generic or customized sign-in page.| -|Windows Autopilot didn’t work, what do I do now?| Questions and actions to assist in troubleshooting: Did a screen not get skipped? Did a user end up as an admin when configured not to? Remember that Azure AD Admins will be local admins regardless of whether Windows Autopilot is configured to disable local admin Collection information: run licensingdiag.exe and send the .cab (Cabinet) file that is generated to AutopilotHelp@microsoft.com. If possible, collect an ETL from Windows Performance Recorder (WPR). Often in these cases, users are not signing into the right Azure AD tenant, or are creating local user accounts. For a complete list of support options, refer to [Windows Autopilot support](autopilot-support.md). | -| If an Administrator makes changes to an existing profile, will the changes take effect on devices that have that profile assigned to them that have already been deployed? |No. Windows Autopilot profiles are not resident on the device. They are downloaded during OOBE, the settings defined at the time are applied. Then, the profile is discarded on the device. If the device is reimaged or reset, the new profile settings will take effect the next time the device goes through OOBE.| -|What is the experience if a device isn’t registered or if an IT Admin doesn’t configure Windows Autopilot prior to an end user attempting to self-deploy? |If the device isn’t registered, it will not receive the Windows Autopilot experience and the end user will go through normal OOBE. The Windows Autopilot configurations will not be applied until the user runs through OOBE again, after registration. If a device is started before an MDM profile is created, the device will go through standard OOBE experience. The IT Admin would then have to manually enroll that device into the MDM, after which the next time that device is reset, it will go through the Windows Autopilot OOBE experience.| -|Why didn't I receive a customized sign-in screen during Autopilot? |Tenant branding must be configured in portal.azure.com to receive a customized sign-in experience.| -|What happens if a device is registered with Azure AD but does not have a Windows Autopilot profile assigned? |The regular Azure AD OOBE will occur since no Windows Autopilot profile was assigned to the device.| -|How can I collect logs on Autopilot?|The best way to collect logs on Windows Autopilot performance is to collect a WPR trace during OOBE. The XML file (WPRP extension) for this trace may be provided upon request.| - -## MDM - -| Question | Answer | -| --- | --- | -| Must we use Intune for our MDM? | No, any MDM will work with Autopilot, but others probably won’t have the same full suite of Windows Autopilot features as Intune. You’ll get the best experience from Intune. | -| Can Intune support Win32 app preinstalls? | Yes. Starting with the Windows 10 October Update (version 1809), Intune supports Win32 apps using .msi (and .msix) wrappers. | -| What is co-management? | Co-management is when you use a combination of a cloud MDM tool (Intune) and an on-premises configuration tool like Microsoft Endpoint Configuration Manager. You only need to use the Configuration Manager if Intune can’t support what you want to do with your profile. If you choose to co-manage using Intune + Configuration Manager, you do it by including a Configuration Manager agent in your Intune profile. When that profile is pushed to the device, the device will see the Configuration Manager agent and go out to the Configuration Manager to pull down any additional profile settings. | -| Must we use Microsoft Endpoint Configuration Manager for Windows Autopilot | No. Co-management (described above) is optional. | - - -## Features - -| Question | Answer | -| --- | --- | -| Self-deploying mode | A new version of Windows Autopilot where the user only turns on the device, and nothing else. It’s useful for scenarios where a standard user account isn’t needed (for example, shared devices, or KIOSK devices). | -| Hybrid Azure Active Directory join | Allows Windows Autopilot devices to connect to an on-premises Active Directory domain controller (in addition to being Azure AD joined). | -| Windows Autopilot reset | Removes user apps and settings from a device, but maintains Azure AD domain join and MDM enrollment. Useful for when transferring a device from one user to another. | -| Personalization | Adds the following to the OOBE experience: A personalized welcome message can be created. A username hint can be added Sign-in page text can be personalized. The company’s logo can be included | -| [Autopilot for existing devices](existing-devices.md) | Offers an upgrade path to Windows Autopilot for all existing Windows 7- and Windows 8-based devices. | - - - -## General - -|Question|Answer -|------------------|-----------------| -|If I wipe the machine and restart, will I still receive Windows Autopilot?|Yes, if the device is still registered for Windows Autopilot and is running a supported version of Windows 10 semi-annual channel, it will receive the Windows Autopilot experience.| -|Can I harvest the device fingerprint on existing machines?|Yes, if the device is running a supported version of Windows 10 semi-annual channel, you can harvest device fingerprints for registration. There are no plans to backport the functionality to legacy releases and no way to harvest them on devices running unsupported versions of Windows.| -|Is Windows Autopilot supported on other SKUs, for example, Surface Hub, HoloLens, Windows Mobile.|No, Windows Autopilot isn’t supported on other SKUs.| -|Does Windows Autopilot work after MBR or image reinstallation?|Yes.| -| Can machines that have reimaged a few times go through Autopilot? What does the error message "This user is not authorized to enroll" mean? Error code 801c0003. |There are limits to the number of devices a particular Azure AD user can enroll in Azure AD, as well as the number of devices that are supported per user in Intune. (These are configurable but not infinite.) You’ll run into this frequently if you reuse the devices, or even if you roll back to previous virtual machine snapshots.| -|What happens if a device is registered to a malicious agent? |By design, Windows Autopilot does not apply a profile until the user signs in with the matching tenant for the configured profile using the Azure AD sign-in process. What occurs is illustrated below. If badguys.com registers a device owned by contoso.com, at worst, the user would be directed to sign into badguys.com. When the user enters their email/password, the sign-in information is redirected through Azure AD to the proper Azure AD authentication and the user is prompted to then sign into contoso.com. Since contoso.com does not match badguys.com as the tenant, the Windows Autopilot profile will not be applied and the regular Azure AD OOBE will occur.| -|Where is the Windows Autopilot data stored? |Windows Autopilot data is stored in the United States (US), not in a sovereign cloud, even when the Azure AD tenant is registered in a sovereign cloud. This is applicable to all Windows Autopilot data, regardless of the portal leveraged to deploy Autopilot.| -|Why is Windows Autopilot data stored in the US and not in a sovereign cloud?|It is not customer data that we store, but business data that enables Microsoft to provide a service, therefore it is okay for the data to reside in the US. Customers can stop subscribing to the service at any time, and, in that event, the business data is removed by Microsoft.| -|How many ways are there to register a device for Windows Autopilot|There are six ways to register a device, depending on who is doing the registering:

        1. OEM Direct API (only available to TVOs)
        2. MPC using the MPC API (must be a CSP)
        3. MPC using manual upload of CSV file in the UI (must be a CSP)
        4. MSfB using CSV file upload
        5. Intune using CSV file upload
        6. Microsoft 365 Business portal using CSV file upload| -|How many ways are there to create a Windows Autopilot profile?|There are four ways to create and assign a Windows Autopilot profile:

        1. Through MPC (must be a CSP)
        2. Through MSfB
        3. Through Intune (or another MDM)
        4. Microsoft 365 Business portal

        Microsoft recommends creation and assignment of profiles through Intune. | -| What are some common causes of registration failures? |1. Bad or missing hardware hash entries can lead to faulty registration attempts
        2. Hidden special characters in CSV files.

        To avoid this issue, after creating your CSV file, open it in Notepad to look for hidden characters or trailing spaces or other corruptions.| -| Is Autopilot supported on IoT devices? | Autopilot is not supported on IoT Core devices, and there are currently no plans to add this support. Autopilot is supported on Windows 10 IoT Enterprise SAC devices. Autopilot is supported on Windows 10 Enterprise LTSC 2019 and above; it is not supported on earlier versions of LTSC.| -| Is Autopilot supported in all regions/countries? | Autopilot only supports customers using global Azure. Global Azure does not include the three entities listed below:
        - Azure Germany
        - Azure China 21Vianet
        - Azure Government
        So, if a customer is set up in global Azure, there are no region restrictions. For example, if Contoso uses global Azure but has employees working in China, the Contoso employees working in China would be able to use Autopilot to deploy devices. If Contoso uses Azure China 21Vianet, the Contoso employees would not be able to use Autopilot.| - -## Glossary - -| Term | Meaning | -| --- | --- | -| CSV | Comma Separated Values (File type similar to Excel spreadsheet) | -| MPC | Microsoft Partner Center | -| MDM | Mobile Device Management | -| OEM | Original Equipment Manufacturer | -| CSP | Cloud Solution Provider | -| MSfB | Microsoft Store for Business | -| Azure AD | Azure Active Directory | -| 4K HH | 4K hardware hash | -| CBR | Computer Build Report | -| EC | Enterprise Commerce | -| DDS | Device Directory Service | -| OOBE | Out of the Box Experience | -| UUID | Universally Unique Identifier | diff --git a/windows/deployment/windows-autopilot/autopilot-mbr.md b/windows/deployment/windows-autopilot/autopilot-mbr.md deleted file mode 100644 index f103766d0d..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-mbr.md +++ /dev/null @@ -1,420 +0,0 @@ ---- -title: Windows Autopilot motherboard replacement -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment MBR scenarios -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot motherboard replacement scenario guidance - -**Applies to** - -- Windows 10 - -This document offers guidance for Windows Autopilot device repair scenarios that Microsoft partners can use in Motherboard Replacement (MBR) situations, and other servicing scenarios. - -Repairing Autopilot enrolled devices is complex, as it tries to balance OEM requirements with Windows Autopilot requirements. Specifically, OEM’s require strict uniqueness across motherboards, MAC addresses, etc., while Windows Autopilot requires strict uniqueness at the Hardware ID level for each device to enable successful registration. The Hardware ID does not always accommodate all the OEM hardware component requirements, thus these requirements are sometimes at odds, causing issues with some repair scenarios. - -**Motherboard Replacement (MBR)** - -If a motherboard replacement is needed on a Windows Autopilot device, the following process is recommended: - -1. [Deregister the device](#deregister-the-autopilot-device-from-the-autopilot-program) from Windows Autopilot -2. [Replace the motherboard](#replace-the-motherboard) -3. [Capture a new device ID (4K HH)](#capture-a-new-autopilot-device-id-4k-hh-from-the-device) -4. [Reregister the device](#reregister-the-repaired-device-using-the-new-device-id) with Windows Autopilot -5. [Reset the device](#reset-the-device) -6. [Return the device](#return-the-repaired-device-to-the-customer) - -Each of these steps is described below. - -## Deregister the Autopilot device from the Autopilot program - -Before the device arrives at the repair facility, it must be deregistered by the entity that registered it. Only the entity that registered the device can deregister it. This might be the customer IT Admin, the OEM, or the CSP partner. If the IT Admin registered the device, they likely did so via Intune (or possibly the Microsoft Store for Business). In that case, they should deregister the device from Intune (or MSfB). This is necessary because devices registered in Intune will not show up in MPC. However, if the OEM or CSP partner registered the device, they likely did so via the Microsoft Partner Center (MPC). In that case, they should deregister the device from MPC, which will also remove it from the customer IT Admin’s Intune account. Below, we describe the steps an IT Admin would go through to deregister a device from Intune, and the steps an OEM or CSP would go through to deregister a device from MPC. - -**NOTE**: When possible, an OEM or CSP should register Autopilot devices, rather than having the customer do it. This will avoid problems where OEMs or CSPs may not be able to deregister a device if, for example, a customer leasing a device goes out of business before deregistering it themselves. - -**EXCEPTION**: If a customer grants an OEM permission to register devices on their behalf via the automated consent process, then an OEM can use the API to deregister devices they didn’t register themselves (instead, the customer registered the devices). But keep in mind that this would only remove those devices from the Autopilot program, it would not disenroll them from Intune or disjoin them from AAD. The customer must do those steps, if desired, through Intune. - -### Deregister from Intune - -To deregister an Autopilot device from Intune, an IT Admin would: - -1. Sign in to their Intune account -2. Navigate to Intune > Groups > All groups -3. Remove the desired device from its group -4. Navigate to Intune > Devices > All devices -5. Select the checkbox next to the device you want to delete, then click the Delete button on the top menu -6. Navigate to Intune > Devices > Azure AD devices -7. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu -8. Navigate to Intune > Device enrollment > Windows enrollment > Devices -9. Select the checkbox next to the device you want to deregister -10. Click the extended menu icon (“…”) on the far right end of the line containing the device you want to deregister in order to expose an additional menu with the option to “unassign user” -11. Click “Unassign user” if the device was previously assigned to a user; if not, this option will be grayed-out and can be ignored -12. With the unassigned device still selected, click the Delete button along the top menu to remove this device - -**NOTE**: These steps deregister the device from Autopilot, but also unenroll the device from Intune, and disjoin the device from AAD. While it may appear that only deregistering the device from Autopilot is needed, there are certain barriers in place within Intune that necessitate all the steps above be done, which is best practice anyway in case the device gets lost or becomes unrecoverable, to eliminate the possibility of orphaned devices existing in the Autopilot database, or Intune, or AAD. If a device gets into an unrecoverable state, you can contact the appropriate [Microsoft support alias](autopilot-support.md) for assistance. - -The deregistration process will take about 15 minutes. You can accelerate the process by clicking the “Sync” button, then “Refresh” the display until the device is no longer present. - -More details on deregistering devices from Intune can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group). - -### Deregister from MPC - -To deregister an Autopilot device from the Microsoft Partner Center (MPC), a CSP would: - -1. Log into MPC -2. Navigate to Customer > Devices -3. Select the device to be deregistered and click the “Delete device” button - -![devices](images/devices.png) - -**NOTE**: Deregistering a device from Autopilot in MPC does only that; it does not also unenroll the device from the MDM (Intune), nor does it disjoin the device from AAD. Therefore, if possible, the OEM/CSP ideally should work with the customer IT Admin to have the device fully removed per the Intune steps in the previous section. - -Alternatively, an OEM partner that has integrated the OEM Direct APIs can deregister a device by calling the AutopilotDeviceRegistration API with the TenantID and TenantDomain fields left blank in the request call. - -Because the repair facility will not have access to the user’s login credentials, the repair facility will have to reimage the device as part of the repair process. This means that the customer should do three things before sending the device off for repair: -1. Copy all important data off the device. -2. Let the repair facility know which version of Windows they should reinstall after the repair. -3. If applicable, let the repair facility know which version of Office they should reinstall after the repair. - -## Replace the motherboard - -Technicians replace the motherboard (or other hardware) on the broken device. A replacement DPK is injected. - -Repair and key replacement processes vary between facilities. Sometimes repair facilities receive motherboard spare parts from OEMs that have replacement DPKs already injected, but sometimes not. Sometimes repair facilities receive fully-functional BIOS tools from OEMs, but sometimes not. This means that the quality of the data in the BIOS after a MBR varies. To ensure the repaired device will still be Autopilot-capable following its repair, the new (post-repair) BIOS should be able to successfully gather and populate the following information at a minimum: - -- DiskSerialNumber -- SmbiosSystemSerialNumber -- SmbiosSystemManufacturer -- SmbiosSystemProductName -- SmbiosUuid -- TPM EKPub -- MacAddress -- ProductKeyID -- OSType - -**NOTE**: For simplicity, and because processes vary between repair facilities, we have excluded many of the additional steps often used in a MBR, such as: -- Verify that the device is still functional -- Disable BitLocker* -- Repair the Boot Configuration Data (BCD) -- Repair and verify the network driver operation - -*BitLocker can be suspended rather than disbled if the technician has the ability to resume it after the repair. - -## Capture a new Autopilot device ID (4K HH) from the device - -Repair technicians must sign in to the repaired device to capture the new device ID. Assuming the repair technician does NOT have access to the customer’s login credentials, they will have to reimage the device in order to gain access, per the following steps: - -1. The repair technician creates a [WinPE bootable USB drive](https://docs.microsoft.com/windows-hardware/manufacture/desktop/oem-deployment-of-windows-10-for-desktop-editions#create-a-bootable-windows-pe-winpe-partition). -2. The repair technician boots the device to WinPE. -3. The repair technician [applies a new Windows image to the device](https://docs.microsoft.com/windows-hardware/manufacture/desktop/work-with-windows-images). - - **NOTE**: Ideally, the same version of Windows should be reimaged onto the device that was originally on the device, so some coordination will be required between the repair facility and customer to capture this information at the time the device arrives for repair. This might include the customer sending the repair facility a customized image (.ppk file) via a USB stick, for example. - -4. The repair technician boots the device into the new Windows image. -5. Once on the desktop, the repair technician captures the new device ID (4K HH) off the device using either the OA3 Tool or the PowerShell script, as described below. - -Those repair facilities with access to the OA3 Tool (which is part of the ADK) can use the tool to capture the 4K Hardware Hash (4K HH). - -Alternatively, the [WindowsAutoPilotInfo Powershell script](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) can be used to capture the 4K HH by following these steps: - -1. Install the script from the [PowerShell Gallery](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) or from the command line (command line installation is shown below). -2. Navigate to the script directory and run it on the device when the device is either in Full OS or Audit Mode. See the following example. - - ```powershell - md c:\HWID - Set-Location c:\HWID - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force - Install-Script -Name Get-WindowsAutopilotInfo -Force - Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv - ``` - ->If you are prompted to install the NuGet package, choose **Yes**.
        ->If, after installing the script you get an error that Get-WindowsAutopilotInfo.ps1 is not found, verify that C:\Program Files\WindowsPowerShell\Scripts is present in your PATH variable.
        ->If the Install-Script cmdlet fails, verify that you have the default PowerShell repository registered (**Get-PSRepository**) or register the default repository with **Register-PSRepository -Default -Verbose**. - -The script creates a .csv file that contains the device information, including the complete 4K HH. Save this file so that you can access it later. The service facility will use this 4K HH to reregister device as described below. Be sure to use the -OutputFile parameter when saving the file, which ensures that file formatting is correct. Do not attempt to pipe the command output to a file manually. - -**NOTE**: If the repair facility does not have the ability to run the OA3 tool or PowerShell script to capture the new 4K HH, then the CSP (or OEM) partners must do this for them. Without some entity capturing the new 4K HH, there is no way to reregister this device as an Autopilot device. - - -## Reregister the repaired device using the new device ID - -If an OEM is not able to reregister the device, then the repair facility or CSP should reregister the device using MPC, or the customer IT Admin should be advised to reregister the device via Intune (or MSfB). Both ways of reregistering a device are shown below. - -### Reregister from Intune - -To reregister an Autopilot device from Intune, an IT Admin would: -1. Sign in to Intune. -2. Navigate to Device enrollment > Windows enrollment > Devices > Import. -3. Click the **Import** button to upload a csv file containing the device ID of the device to be reregistered (the device ID was the 4K HH captured by the PowerShell script or OA3 tool described previously in this document). - -The following video provides a good overview of how to (re)register devices via MSfB.
        - -> [!VIDEO https://www.youtube.com/embed/IpLIZU_j7Z0] - -### Reregister from MPC - -To reregister an Autopilot device from MPC, an OEM or CSP would: - -1. Sign in to MPC. -2. Navigate to the Customer > Devices page and click the **Add devices** button to upload the csv file. - -![device](images/device2.png)
        -![device](images/device3.png) - -In the case of reregistering a repaired device through MPC, the uploaded csv file must contain the 4K HH for the device, and not just the PKID or Tuple (SerialNumber + OEMName + ModelName). If only the PKID or Tuple were used, the Autopilot service would be unable to find a match in the Autopilot database, since no 4K HH info was ever previously submitted for this essentially “new” device, and the upload will fail, likely returning a ZtdDeviceNotFound error. So, again, only upload the 4K HH, not the Tuple or PKID. - -**NOTE**: When including the 4K HH in the csv file, you do NOT also need to include the PKID or Tuple. Those columns may be left blank, as shown below: - -![hash](images/hh.png) - -## Reset the device - -Since the device was required to be in Full OS or Audit Mode to capture the 4K HH, the repair facility must reset the image back to a pre-OOBE state before returning it to the customer. One way this can be accomplished is by using the built-in reset feature in Windows, as follows: - -On the device, go to Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Finally, click on Reset. - -![reset](images/reset.png) - -However, it’s likely the repair facility won’t have access to Windows because they lack the user credentials to login, in which case they need to use other means to reimage the device, such as the [Deployment Image Servicing and Management tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/oem-deployment-of-windows-10-for-desktop-editions#use-a-deployment-script-to-apply-your-image). - -## Return the repaired device to the customer - -After completing the previous steps, the repaired device can now be returned to the customer, and will be auto-enrolled into the Autopilot program on first boot-up during OOBE. - -**NOTE**: If the repair facility did NOT reimage the device, they could be sending it back in a potentially broken state (e.g., there’s no way to log into the device because it’s been dissociated from the only known user account), in which case they should tell the organization that they need to fix the registration and OS themselves. - -**IMPORTANT**: A device can be “registered” for Autopilot prior to being powered-on, but the device isn’t actually “deployed” to Autopilot (i.e., enabled as an Autopilot device) until it goes through OOBE, which is why resetting the device back to a pre-OOBE state is a required step. - -## Specific repair scenarios - -This section covers the most common repair scenarios, and their impact on Autopilot enablement. - -NOTES ON TEST RESULTS: - -- Scenarios below were tested using Intune only (no other MDMs were tested). -- In most test scenarios below, the repaired and reregistered device needed to go through OOBE again for Autopilot to be enabled. -- Motherboard replacement scenarios often result in lost data, so repair centers or customers should be reminded to backup data (if possible) prior to repair. -- In the cases where a repair facility does not have the ability to write device info into the BIOS of the repaired device, new processes need to be created to successfully enable Autopilot. -- Repaired device should have the Product Key (DPK) preinjected in the BIOS before capturing the new 4K HH (device ID) - -In the following table:
        -- Supported = **Yes**: the device can be reenabled for Autopilot -- Supported = **No**: the device cannot be reenabled for Autopilot - - -
        ScenarioSupportedMicrosoft Recommendation -
        Motherboard Replacement (MBR) in generalYesThe recommended course of action for MBR scenarios is: - -1. Autopilot device is deregistered from the Autopilot program -2. The motherboard is replace -3. The device is reimaged (with BIOS info and DPK reinjected)* -4. A new Autopilot device ID (4K HH) is captured off the device -5. The repaired device is reregistered for the Autopilot program using the new device ID -6. The repaired device is reset to boot to OOBE -7. The repaired device is shipped back to the customer - -*It’s not necessary to reimage the device if the repair technician has access to the customer’s login credentials. It’s technically possible to do a successful MBR and Autopilot re-enablement without keys or certain BIOS info (e.g., serial #, model name, etc.), but doing so is only recommended for testing/educational purposes. - -
        MBR when motherboard has a TPM chip (enabled) and only one onboard network card (that also gets replaced)Yes - -1. Deregister damaged device -2. Replace motherboard -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write device info into BIOS -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
        MBR when motherboard has a TPM chip (enabled) and a second network card (or network interface) that is not replaced along with the motherboardNoThis scenario is not recommended, as it breaks the Autopilot experience, because the resulting Device ID will not be stable until after TPM attestation has completed, and even then registration may give incorrect results because of ambiguity with MAC Address resolution. -
        MBR where the NIC card, HDD, and WLAN all remain the same after the repairYes - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write old device info into BIOS (same s/n, model, etc.)* -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -*Note that for this and subsequent scenarios, rewriting old device info would not include the TPM 2.0 endorsement key, as the associated private key is locked to the TPM device - -
        MBR where the NIC card remains the same, but the HDD and WLAN are replacedYes - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Insert new HDD and WLAN -4. Write old device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
        MBR where the NIC card and WLAN remains the same, but the HDD is replacedYes - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Insert new HDD -4. Write old device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
        MBR where only the MB is replaced (all other parts remain same) but new MB was taken from a previously used device that had NOT been Autopilot-enabled before.Yes - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write old device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
        MBR where only the MB is replaced (all other parts remain same) but new MB was taken from a previously used device that HAD been Autopilot-enabled before.Yes - -1. Deregister old device from which MB will be taken -2. Deregister damaged device (that you want to repair) -3. Replace motherboard in repair device with MB from other Autopilot device (with new RDPK preinjected in BIOS) -4. Reimage device (to gain access), unless have access to customers’ login credentials -5. Write old device info into BIOS (same s/n, model, etc.) -6. Capture new 4K HH -7. Reregister repaired device -8. Reset device back to OOBE -9. Go through Autopilot OOBE (customer) -10. Autopilot successfully enabled - -NOTE: The repaired device can also be used successfully as a normal, non-Autopilot device. - -
        BIOS info excluded from MBR deviceNoRepair facility does not have BIOS tool to write device info into BIOS after MBR. - -1. Deregister damaged device -2. Replace motherboard (BIOS does NOT contain device info) -3. Reimage and write DPK into image -4. Capture new 4K HH -5. Reregister repaired device -6. Create Autopilot profile for device -7. Go through Autopilot OOBE (customer) -8. Autopilot FAILS to recognize repaired device - -
        MBR when there is no TPM chipYesThough we do not recommend enabling an Autopilot devices without a TPM chip (which is recommended for BitLocker encryption), it is possible to enable an Autopilot devices in “standard user” mode (but NOT Self-deploying mode) that does not have a TPM chip. In this case, you would: - -1. Deregister damaged device -2. Replace motherboard -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write old device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reregister repaired device -7. Reset device back to OOBE -8. Go through Autopilot OOBE (customer) -9. Autopilot successfully enabled - -
        New DPK written into image on repaired Autopilot device with a new MBYesRepair facility replaces normal MB on damaged device. MB does not contain any DPK in the BIOS. Repair facility writes DPK into image after MBR. - -1. Deregister damaged device -2. Replace motherboard – BIOS does NOT contain DPK info -3. Reimage device (to gain access), unless have access to customers’ login credentials -4. Write device info into BIOS (same s/n, model, etc.) -5. Capture new 4K HH -6. Reset or reimage device to pre-OOBE and write DPK into image -7. Reregister repaired device -8. Go through Autopilot OOBE -9. Autopilot successfully enabled - -
        New Repair Product Key (RDPK)YesUsing a MB with a new RDPK preinjected results in a successful Autopilot refurbishment scenario. - -1. Deregister damaged device -2. Replace motherboard (with new RDPK preinjected in BIOS) -3. Reimage or rest image to pre-OOBE -4. Write device info into BIOS -5. Capture new 4K HH -6. Reregister repaired device -7. Reimage or reset image to pre-OOBE -8. Go through Autopilot OOBE -9. Autopilot successfully enabled - -
        No Repair Product Key (RDPK) injectedNoThis scenario violates Microsoft policy and breaks the Windows Autopilot experience. -
        Reimage damaged Autopilot device that was not deregistered prior to repairYes, but the device will still be associated with previous tenant ID, so should only be returned to same customer - -1. Reimage damaged device -2. Write DPK into image -3. Go through Autopilot OOBE -4. Autopilot successfully enabled (to previous tenant ID) - -
        Disk replacement from a non-Autopilot device to an Autopilot deviceYes - -1. Do not deregister damaged device prior to repair -2. Replace HDD on damaged device -3. Reimage or reset image back to OOBE -4. Go through Autopilot OOBE (customer) -5. Autopilot successfully enabled (repaired device recognized as its previous self) - -
        Disk replacement from one Autopilot device to another Autopilot deviceMaybeIf the device from which the HDD is taken was itself previously deregistered from Autopilot, then that HDD can be used in a repair device. But if the HDD was never previously deregistered from Autopilot before being used in a repaired device, the newly repaired device will not have the proper Autopilot experience. - -Assuming the used HDD was previously deregistered (before being used in this repair): - -1. Deregister damaged device -2. Replace HDD on damaged device using a HDD from another deregistered Autopilot device -3. Reimage or rest the repaired device back to a pre-OOBE state -4. Go through Autopilot OOBE (customer) -5. Autopilot successfully enabled - -
        Third party network card replacement NoWhether from a non-Autopilot device to an Autopilot device, from one Autopilot device to another Autopilot device, or from an Autopilot device to a non-Autopilot device, any scenario where a 3rd party (not onboard) Network card is replaced will break the Autopilot experience, and is not recommended. -
        A device repaired more than 3 timesNoAutopilot is not supported when a device is repeatedly repaired, so that whatever parts NOT replaced become associated with too many parts that have been replaced, which would make it difficult to uniquely identify that device in the future. -
        Memory replacementYesReplacing the memory on a damaged device does not negatively affect the Autopilot experience on that device. No de/reregistration is needed. The repair technician simply needs to replace the memory. -
        GPU replacementYesReplacing the GPU(s) on a damaged device does not negatively affect the Autopilot experience on that device. No de/reregistration is needed. The repair technician simply needs to replace the GPU. -
        - ->When scavenging parts from another Autopilot device, we recommend unregistering the scavenged device from Autopilot, scavenging it, and then NEVER REGISTERING THE SCAVENGED DEVICE (AGAIN) FOR AUTOPILOT, because reusing parts this way may cause two active devices to end up with the same ID, with no possibility of distinguishing between the two. - -**NOTE**: The following parts may be replaced without compromising Autopilot enablement or requiring special additional repair steps: -- Memory (RAM or ROM) -- Power Supply -- Video Card -- Card Reader -- Sound card -- Expansion card -- Microphone -- Webcam -- Fan -- Heat sink -- CMOS battery - -Other repair scenarios not yet tested and verified include: -- Daughterboard replacement -- CPU replacement -- Wifi replacement -- Ethernet replacement - -## FAQ - -| Question | Answer | -| --- | --- | -| If we have a tool that programs product information into the BIOS after the MBR, do we still need to submit a CBR report for the device to be Autopilot-capable? | No. Not if the in-house tool writes the minimum necessary information into the BIOS that the Autopilot program looks for to identify the device, as described earlier in this document. | -| What if only some components are replaced rather than the full motherboard? | While it’s true that some limited repairs do not prevent the Autopilot algorithm from successfully matching the post-repair device with the pre-repair device, it is best to ensure 100% success by going through the MBR steps above even for devices that only needed limited repairs. | -| How does a repair technician gain access to a broken device if they don’t have the customer’s login credentials? | The technician will have to reimage the device and use their own credentials during the repair process. | - -## Related topics - -[Device guidelines](autopilot-device-guidelines.md)
        diff --git a/windows/deployment/windows-autopilot/autopilot-support.md b/windows/deployment/windows-autopilot/autopilot-support.md deleted file mode 100644 index 762aab67e5..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-support.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Windows Autopilot support -description: Find out who to contact for help with your Windows Autopilot installation. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.reviewer: -manager: laurawi -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot support information - -**Applies to: Windows 10** - -The following table displays support information for the Windows Autopilot program. - -Before contacting the resources listed below for Windows Autopilot-related issues, check the [Windows Autopilot FAQ](autopilot-faq.md). - -| Audience | Support contact | -|------------|---------------------------------------| -| OEM or Channel Partner registering devices as a CSP (via MPC) | Use the help resources available in MPC. Whether you are a named partner or a channel partner (distributor, reseller, SI, etc.), if you’re a CSP registering Autopilot devices through MPC (either manually or through the MPC API), your first-line of support should be the help resources within MPC. | -| OEM registering devices using OEM Direct API | Contact MSOEMOPS@microsoft.com. Response time depends on priority:
        Low – 120 hours
        Normal – 72 hours
        High – 24 hours
        Immediate – 4 hours | -| Enterprise customers | Contact your Technical Account Manager (TAM), or Account Technology Strategist (ATS), or Customer Service Support (CSS) representative. | -| End-user | Contact your IT administrator. | -| Microsoft Partner Center (MPC) users | Use the [help resources](https://partner.microsoft.com/support) available in MPC. | -| Microsoft Store for Business (MSfB) users | Use the help resources available in MSfB. | -| Intune users | From the Microsoft Azure portal, click [Help + support](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview). | -| Microsoft 365 Business | Support is accessible directly through the Microsoft 365 Business portal when logged in: https://support.microsoft.com/en-us. | -| Queries relating to MDA testing | Contact MDAHelp@microsoft.com. | \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/autopilot-update.md b/windows/deployment/windows-autopilot/autopilot-update.md deleted file mode 100644 index db4094b8a8..0000000000 --- a/windows/deployment/windows-autopilot/autopilot-update.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Windows Autopilot update -ms.reviewer: -manager: laurawi -description: Windows Autopilot update -keywords: Autopilot, update, Windows 10 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot update - -**Applies to** - -- Windows 10, version 1903 - -Windows Autopilot update enables you to get the latest Autopilot features and critical issue fixes without the need to move to latest Windows OS version. With Autopilot update, organizations can keep their current OS version and still benefit from new Autopilot features and bug fixes. - -During the Autopilot deployment process, Windows Autopilot update has been added as a new node after the critical [Windows Zero Day Patch (ZDP) update](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe) check. During the update process, Windows Autopilot devices reach out to Windows Update to check for a new Autopilot update. If there is an Autopilot update available, the device will download and install the update, then restart automatically. See the following example. - - ![Autopilot update 1](images/update1.png)
        - ![Autopilot update 2](images/update2.png)
        - ![Autopilot update 3](images/update3.png) - -The following diagram illustrates a typical Windows Autopilot deployment orchestration during the Out of Box Experience (OOBE) with the new Windows Autopilot update node. - - ![Autopilot update flow](images/update-flow.png) - -## Release cadence - -- When an Autopilot update is available, it is typically released on the 4th Tuesday of the month. The update could be released on a different week if there is an exception. -- A knowledge base (KB) article will also be published to document the changes that are included in the update. - -For a list of released updates, see [Autopilot update history](windows-autopilot-whats-new.md#windows-autopilot-update-history). - -## See also - -[Windows Update during OOBE](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe)
        -[What's new in Windows Autopilot](windows-autopilot-whats-new.md)
        \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/bitlocker.md b/windows/deployment/windows-autopilot/bitlocker.md deleted file mode 100644 index 234ae17fcc..0000000000 --- a/windows/deployment/windows-autopilot/bitlocker.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Setting the BitLocker encryption algorithm for Autopilot devices -ms.reviewer: -manager: laurawi -description: Microsoft Intune provides a comprehensive set of configuration options to manage BitLocker on Windows 10 devices. -keywords: Autopilot, BitLocker, encryption, 256-bit, Windows 10 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Setting the BitLocker encryption algorithm for Autopilot devices - -**Applies to** - -- Windows 10 - -With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. This ensures that the default encrytion algorithm is not applied automatically when this is not the desired setting. Other BitLocker policies that must be applied prior to encryption can also be delivered before automatic BitLocker encryption begins. - -The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use. - -To ensure the desired BitLocker encryption algorithm is set before automatic encryption occurs for Autopilot devices: - -1. Configure the [encryption method settings](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-encryption) in the Windows 10 Endpoint Protection profile to the desired encryption algorithm. -2. [Assign the policy](https://docs.microsoft.com/intune/device-profile-assign) to your Autopilot device group. - - **IMPORTANT**: The encryption policy must be assigned to **devices** in the group, not users. -3. Enable the Autopilot [Enrollment Status Page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) (ESP) for these devices. - - **IMPORTANT**: If the ESP is not enabled, the policy will not apply before encryption starts. - -An example of Microsoft Intune Windows Encryption settings is shown below. - - ![BitLocker encryption settings](images/bitlocker-encryption.png) - -Note that a device which is encrypted automatically will need to be decrypted prior to changing the encyption algorithm. - -The settings are available under Device Configuration -> Profiles -> Create profile -> Platform = Windows 10 and later, Profile type = Endpoint protection -> Configure -> Windows Encryption -> BitLocker base settings, Configure encryption methods = Enable. - -Note: It is also recommended to set Windows Encryption -> Windows Settings -> Encrypt = **Require**. - -## Requirements - -Windows 10, version 1809 or later. - -## See also - -[Bitlocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 31298d382d..4753557b61 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -2,7 +2,7 @@ title: Demonstrate Autopilot deployment ms.reviewer: manager: laurawi -description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment +description: In this article, find step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment. keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, upgrade ms.prod: w10 ms.mktglfcycl: deploy @@ -13,7 +13,9 @@ author: greg-lindsay ms.author: greglin ms.collection: M365-modern-desktop ms.topic: article -ms.custom: autopilot +ms.custom: + - autopilot + - seo-marvel-apr2020 --- @@ -28,7 +30,7 @@ To get started with Windows Autopilot, you should try it out with a virtual mach In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V. > [!NOTE] -> Although there are [multiple platforms](administer.md) available to enable Autopilot, this lab primarily uses Intune. +> Although there are [multiple platforms](add-devices.md#registering-devices) available to enable Autopilot, this lab primarily uses Intune. > Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. @@ -43,7 +45,7 @@ The following video provides an overview of the process: These are the things you'll need to complete this lab: - +
        Windows 10 installation mediaWindows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.
        Internet accessIf you are behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
        Internet accessIf you are behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
        Hyper-V or a physical device running Windows 10The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.
        A Premium Intune accountThis guide will describe how to obtain a free 30-day trial premium account that can be used to complete the lab.
        @@ -51,6 +53,8 @@ These are the things you'll need to complete this lab: A summary of the sections and procedures in the lab is provided below. Follow each section in the order it is presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix. +> If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [Capture the hardware ID](#capture-the-hardware-id) step. The VM must be running Windows 10, version 1903 or a later version. + [Verify support for Hyper-V](#verify-support-for-hyper-v)
        [Enable Hyper-V](#enable-hyper-v)
        [Create a demo VM](#create-a-demo-vm) @@ -68,7 +72,8 @@ A summary of the sections and procedures in the lab is provided below. Follow ea
            [Autopilot registration using MSfB](#autopilot-registration-using-msfb)
        [Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile)
            [Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) -
               [Assign the profile](#assign-the-profile) +
               [Create a device group](#create-a-device-group) +
               [Create the deployment profile](#create-the-deployment-profile)
            [Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb)
        [See Windows Autopilot in action](#see-windows-autopilot-in-action)
        [Remove devices from Autopilot](#remove-devices-from-autopilot) @@ -110,9 +115,9 @@ When you are prompted to restart the computer, choose **Yes**. The computer migh > Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![hyper-v feature](../images/hyper-v-feature.png) + ![Hyper-V feature](images/hyper-v-feature.png) - ![hyper-v](../images/svr_mgr2.png) + ![Hyper-V](images/svr_mgr2.png)

        If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. @@ -138,7 +143,7 @@ After we have set the ISO file location and determined the name of the appropria You can download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise [here](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). - When asked to select a platform, choose **64 bit**. -After you download this file, the name will be extremely long (ex: 17763.107.101029-1455.rs5_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso). +After you download this file, the name will be extremely long (ex: 19042.508.200927-1902.20h2_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso). 1. So that it is easier to type and remember, rename the file to **win10-eval.iso**. 2. Create a directory on your computer named **c:\iso** and move the **win10-eval.iso** file there, so the path to the file is **c:\iso\win10-eval.iso**. @@ -161,7 +166,7 @@ For example, if the command above displays Ethernet but you wish to use Ethernet All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands. > [!IMPORTANT] -> **VM switch**: a VM switch is how Hyper-V connects VMs to a network.

        If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."

        If you have never created an external VM switch before, then just run the commands below. +> **VM switch**: a VM switch is how Hyper-V connects VMs to a network.

        If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."

        If you have never created an external VM switch before, then just run the commands below.

        If you are not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that is used to connect to the Internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). ```powershell New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name @@ -216,22 +221,25 @@ PS C:\autopilot> ### Install Windows 10 +> [!NOTE] +> The VM will be booted to gather a hardware ID, then it will be reset. The goal in the next few steps is to get to the desktop quickly so don't worry about how it is configured at this stage. The VM only needs to be connected to the Internet. + Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: - ![Windows setup](images/winsetup1.png) - ![Windows setup](images/winsetup2.png) - ![Windows setup](images/winsetup3.png) - ![Windows setup](images/winsetup4.png) - ![Windows setup](images/winsetup5.png) - ![Windows setup](images/winsetup6.png) + ![Windows setup example 1](images/winsetup1.png) + ![Windows setup example 2](images/winsetup2.png) + ![Windows setup example 3](images/winsetup3.png) + ![Windows setup example 4](images/winsetup4.png) + ![Windows setup example 5](images/winsetup5.png) + ![Windows setup example 6](images/winsetup6.png) -After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: +After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: - ![Windows setup](images/winsetup7.png) + ![Windows setup example 7](images/winsetup7.png) Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. You will create multiple checkpoints throughout this lab, which can be used later to go through the process again. - ![Windows setup](images/winsetup8.png) + ![Windows setup example 8](images/winsetup8.png) To create your first checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: @@ -244,11 +252,11 @@ Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see ## Capture the hardware ID > [!NOTE] -> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. +> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you're not going to use the OA3 Tool to capture the full 4K HH for various reasons (you'd have to install the OA3 tool, your device couldn't have a volume license version of Windows, it's a more complicated process than using a PS script, etc.). Instead, you'll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. Follow these steps to run the PS script: -1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: +1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: ```powershell md c:\HWID @@ -261,18 +269,20 @@ Follow these steps to run the PS script: When you are prompted to install the NuGet package, choose **Yes**. -See the sample output below. +See the sample output below. A 'dir' command is issued at the end to show the file that was created.

         PS C:\> md c:\HWID
         
        -    Directory: C:\
        +     Directory: C:\
         
        -Mode                LastWriteTime         Length Name
        -----                -------------         ------ ----
        -d-----        3/14/2019  11:33 AM                HWID
         
        -PS C:\> Set-Location c:\HWID
        +Mode                 LastWriteTime         Length Name
        +----                 -------------         ------ ----
        +d-----        11/13/2020   3:00 PM                HWID
        +
        +
        +PS C:\Windows\system32> Set-Location c:\HWID
         PS C:\HWID> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
         PS C:\HWID> Install-Script -Name Get-WindowsAutopilotInfo -Force
         
        @@ -285,13 +295,17 @@ import the NuGet provider now?
         [Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): Y
         PS C:\HWID> $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
         PS C:\HWID> Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
        +Gathered details for device with serial number: 1804-7078-6805-7405-0796-0675-17
         PS C:\HWID> dir
         
        +
             Directory: C:\HWID
         
        -Mode                LastWriteTime         Length Name
        -----                -------------         ------ ----
        --a----        3/14/2019  11:33 AM           8184 AutopilotHWID.csv
        +
        +Mode                 LastWriteTime         Length Name
        +----                 -------------         ------ ----
        +-a----        11/13/2020   3:01 PM           8184 AutopilotHWID.csv
        +
         
         PS C:\HWID>
         
        @@ -303,7 +317,7 @@ Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory ![Serial number and hardware hash](images/hwid.png) -You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). +You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this. @@ -315,7 +329,7 @@ If you have trouble copying and pasting the file, just view the contents in Note With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE. On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. -Select **Remove everything** and **Just remove my files**. Finally, click on **Reset**. +Select **Remove everything** and **Just remove my files**. If you are asked **How would you like to reinstall Windows**, select Local reinstall. Finally, click on **Reset**. ![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) @@ -331,11 +345,11 @@ For this lab, you need an AAD Premium subscription. You can tell if you have a ![MDM and Intune](images/mdm-intune2.png) -If the configuration blade shown above does not appear, it’s likely that you don’t have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. +If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. -![Reset this PC final prompt](images/aad-lic1.png) +![License conversion option](images/aad-lic1.png) ## Configure company branding @@ -361,7 +375,7 @@ Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. -![MDM user scope in the Mobility blade](images/autopilot-aad-mdm.png) +![MDM user scope in the Mobility blade](images/ap-aad-mdm.png) ## Register your VM @@ -369,24 +383,24 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B ### Autopilot registration using Intune -1. In Intune in the Azure portal, choose **Device enrollment** > **Windows enrollment** > **Devices** > **Import**. +1. In the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/), choose **Devices** > **Device enrollment | Enroll devices** > **Windows enrollment** > **Windows Autopilot Deployment Program | Devices** and then on the **Windows Autopilot devices** page, choose **Import**. - ![Intune device import](images/device-import.png) + ![Intune device import](images/enroll1.png) > [!NOTE] > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. -2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It’s okay if other fields (Windows Product ID) are left blank. +2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank. - ![HWID CSV](images/hwid-csv.png) + ![HWID CSV](images/enroll2.png) You should receive confirmation that the file is formatted correctly before uploading it, as shown above. 3. Click **Import** and wait until the import process completes. This can take up to 15 minutes. -4. Click **Sync** to sync the device you just registered. Wait a few moments before refreshing to verify your VM or device has been added. See the following example. +4. Click **Refresh** to verify your VM or device has been added. See the following example. - ![Import HWID](images/import-vm.png) + ![Import HWID](images/enroll3.png) ### Autopilot registration using MSfB @@ -401,7 +415,7 @@ Optional: see the following video for an overview of the process. First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview) to create a new one. -Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** in the upper-right-corner of the main page. +Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** on the upper-right-corner of the main page. Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: @@ -409,7 +423,7 @@ Select **Manage** from the top menu, then click the **Windows Autopilot Deployme Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. -![Devices](images/msfb-device.png) +![Microsoft Store for Business Devices](images/msfb-device.png) ## Create and assign a Windows Autopilot deployment profile @@ -423,17 +437,33 @@ Pick one: ### Create a Windows Autopilot deployment profile using Intune > [!NOTE] -> Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first: +> Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list. -![Devices](images/intune-devices.png) +![Devices](images/enroll4.png) -> The example above lists both a physical device and a VM. Your list should only include only one of these. +#### Create a device group -To create a Windows Autopilot profile, select **Device enrollment** > **Windows enrollment** > **Deployment profiles** +The Autopilot deployment profile wizard will ask for a device group, so we must create one first. To create a device group: -![Deployment profiles](images/deployment-profiles.png) +1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Groups** > **New group**. +2. In the **Group** blade: + 1. For **Group type**, choose **Security**. + 2. Type a **Group name** and **Group description** (ex: Autopilot Lab). + 3. Azure AD roles can be assigned to the group: **No** + 4. For **Membership type**, choose **Assigned**. +3. Click **Members** and add the Autopilot VM to the group. See the following example: -Click on **Create profile**. + ![add members](images/group1.png) + +4. Click **Create**. + +#### Create the deployment profile + +To create a Windows Autopilot profile, scroll back to the left hand pane and click **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. + +![Deployment profiles](images/dp.png) + +Click on **Create profile** and then select **Windows PC**. ![Create deployment profile](images/create-profile.png) @@ -442,22 +472,33 @@ On the **Create profile** blade, use the following values: | Setting | Value | |---|---| | Name | Autopilot Lab profile | -| Description | blank | +| Description | Lab | | Convert all targeted devices to Autopilot | No | -| Deployment mode | User-driven | -| Join to Azure AD as | Azure AD joined | -Click on **Out-of-box experience (OOBE)** and configure the following settings: +Click **Next** to continue with the **Out-of-box experience (OOBE)** settings: | Setting | Value | |---|---| -| EULA | Hide | +| Deployment mode | User-driven | +| Join to Azure AD as | Azure AD joined | +| Microsoft Sofware License Terms | Hide | | Privacy Settings | Hide | | Hide change account options | Hide | | User account type | Standard | +| Allow White Glove OOBE | No | +| Language (Region) | Operating system default | +| Automatically configure keyboard | Yes | | Apply device name template | No | -See the following example: +Click **Next** to continue with the **Assignments** settings: + +| Setting | Value | +|---|---| +| Assign to | Selected groups | + +1. Click **Select groups to include**. +2. Click the **Autopilot Lab** group, and then click **Select**. +3. Click **Next** to continue and then click **Create**. See the following example: ![Deployment profile](images/profile.png) @@ -465,40 +506,6 @@ Click on **OK** and then click on **Create**. > If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile). -#### Assign the profile - -Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading. - -To create a Group, open the Azure Portal and select **Azure Active Directory** > **Groups** > **All groups**: - -![All groups](images/all-groups.png) - -Select New group from the Groups blade to open the new groups UI. Select the “Security” group type, name the group, and select the “Assigned” membership type: - -Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group. - -![New group](images/new-group.png) - -Now click **Create** to finish creating the new group. - -Click on **All groups** and click **Refresh** to verify that your new group has been successfully created. - -With a group created containing your device, you can now go back and assign your profile to that group. Navigate back to the Intune page in the Azure portal (one way is to type **Intune** in the top banner search bar and select **Intune** from the results). - -From Intune, select **Device enrollment** > **Windows enrollment** > **Deployment Profiles** to open the profile blade. Click on the name of the profile you previously created (Autopilot Lab profile) to open the details blade for that profile: - -![Lab profile](images/deployment-profiles2.png) - -Under **Manage**, click **Assignments**, and then with the **Include** tab highlighted, expand the **Select groups** blade and click **AP Lab Group 1** (the group will appear under **Selected members**). - -![Include group](images/include-group.png) - -Click **Select** and then click **Save**. - -![Include group](images/include-group2.png) - -It’s also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot). - ### Create a Windows Autopilot deployment profile using MSfB If you have already created and assigned a profile via Intune by using the steps immediately above, then skip this section. @@ -517,15 +524,15 @@ To CREATE the profile: Select your device from the **Devices** list: -![MSfB create](images/msfb-create1.png) +![MSfB create step 1](images/msfb-create1.png) On the Autopilot deployment dropdown menu, select **Create new profile**: -![MSfB create](images/msfb-create2.png) +![MSfB create step 2](images/msfb-create2.png) Name the profile, choose your desired settings, and then click **Create**: -![MSfB create](images/msfb-create3.png) +![MSfB create step 3](images/msfb-create3.png) The new profile is added to the Autopilot deployment list. @@ -533,84 +540,73 @@ To ASSIGN the profile: To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: -![MSfB assign](images/msfb-assign1.png) +![MSfB assign step 1](images/msfb-assign1.png) Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: -![MSfB assign](images/msfb-assign2.png) +![MSfB assign step 2](images/msfb-assign2.png) > [!IMPORTANT] > The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. ## See Windows Autopilot in action -If you shut down your VM after the last reset, it’s time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: +If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: ![Device status](images/device-status.png) Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. > [!TIP] -> If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). +> If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). - Ensure your device has an internet connection. - Turn on the device - Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). -![OOBE sign-in page](images/autopilot-oobe.jpg) +![OOBE sign-in page](images/autopilot-oobe.png) Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. -![Device enabled](images/enabled-device.png) +![Device enabled](images/devices1.png) Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done. +> [!TIP] +> If you recieve a message that "Something went wrong" and it "Looks like we can't connect to the URL for your organization's MDM terms of use" then verify you have correctly [assigned licenses](https://docs.microsoft.com/mem/intune/fundamentals/licenses-assign) to the current user. + Windows Autopilot will now take over to automatically join your device into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings. ## Remove devices from Autopilot -To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below. +To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found at [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below. ### Delete (deregister) Autopilot device -You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu. +You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then click the Delete button along the top menu. -![Delete device](images/delete-device1.png) - -Click **X** when challenged to complete the operation: - -![Delete device](images/delete-device2.png) +![Delete device step 1](images/delete-device1.png) This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. -![Delete device](images/delete-device3.png) - The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. > [!NOTE] > A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. -To remove the device from the Autopilot program, select the device and click Delete. +To remove the device from the Autopilot program, select the device and click **Delete**. You will get a popup dialog box to confirm deletion. -![Delete device](images/delete-device4.png) - -A warning message appears reminding you to first remove the device from Intune, which we previously did. - -![Delete device](images/delete-device5.png) +![Delete device](images/delete-device2.png) At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: -![Delete device](images/delete-device6.png) - Once the device no longer appears, you are free to reuse it for other purposes. If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button: -![Delete device](images/delete-device7.png) - ## Appendix A: Verify support for Hyper-V -Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. +Starting with Windows 8, the host computer's microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: @@ -654,19 +650,19 @@ EPT * Supports Intel extended page tables (SLAT) #### Prepare the app for Intune -Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool: +Before we can pull an application into Intune to make it part of our AP profile, we need to "package" the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool: 1. The source folder for your application 2. The name of the setup executable file 3. The output folder for the new file -For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app. +For the purposes of this lab, we'll use the Notepad++ tool as our Win32 app. Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then copy the file to a known location, such as C:\Notepad++msi. Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: -![Add app](images/app01.png) +![Add app example](images/app01.png) After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. @@ -676,19 +672,19 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Add app](images/app02.png) +![Add app step 1](images/app02.png) Under **App Type**, select **Windows app (Win32)**: -![Add app](images/app03.png) +![Add app step 2](images/app03.png) On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: -![Add app](images/app04.png) +![Add app step 3](images/app04.png) On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: -![Add app](images/app05.png) +![Add app step 4](images/app05.png) On the **Program Configuration** blade, supply the install and uninstall commands: @@ -698,29 +694,29 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q > [!NOTE] > Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file. -![Add app](images/app06.png) +![Add app step 5](images/app06.png) -Simply using an install command like “notepad++.exe /S” will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn’t actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). +Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). Click **OK** to save your input and activate the **Requirements** blade. On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: -![Add app](images/app07.png) +![Add app step 6](images/app07.png) Next, configure the **Detection rules**. For our purposes, we will select manual format: -![Add app](images/app08.png) +![Add app step 7](images/app08.png) Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: -![Add app](images/app09.png) +![Add app step 8](images/app09.png) Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. **Return codes**: For our purposes, leave the return codes at their default values: -![Add app](images/app10.png) +![Add app step 9](images/app10.png) Click **OK** to exit. @@ -730,20 +726,20 @@ Click the **Add** button to finalize and save your app package. Once the indicator message says the addition has completed. -![Add app](images/app11.png) +![Add app step 10](images/app11.png) You will be able to find your app in your app list: -![Add app](images/app12.png) +![Add app step 11](images/app12.png) #### Assign the app to your Intune profile > [!NOTE] -> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. +> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here. In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: -![Add app](images/app13.png) +![Assign app step 1](images/app13.png) Select **Add Group** to open the **Add group** pane that is related to the app. @@ -753,9 +749,9 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu Select **Included Groups** and assign the groups you previously created that will use this app: -![Add app](images/app14.png) +![Assign app step 2](images/app14.png) -![Add app](images/app15.png) +![Assign app step 3](images/app15.png) In the **Select groups** pane, click the **Select** button. @@ -765,7 +761,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. -![Add app](images/app16.png) +![Assign app step 4](images/app16.png) At this point, you have completed steps to add a Win32 app to Intune. @@ -779,15 +775,15 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Add app](images/app17.png) +![Create app step 1](images/app17.png) Under **App Type**, select **Office 365 Suite > Windows 10**: -![Add app](images/app18.png) +![Create app step 2](images/app18.png) Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: -![Add app](images/app19.png) +![Create app step 3](images/app19.png) Click **OK**. @@ -795,24 +791,24 @@ In the **App Suite Information** pane, enter a unique suite name, and a s > Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. -![Add app](images/app20.png) +![Create app step 4](images/app20.png) Click **OK**. In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: -![Add app](images/app21.png) +![Create app step 5](images/app21.png) Click **OK** and then click **Add**. #### Assign the app to your Intune profile > [!NOTE] -> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. +> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here. In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: -![Add app](images/app22.png) +![Create app step 6](images/app22.png) Select **Add Group** to open the **Add group** pane that is related to the app. @@ -822,9 +818,9 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu Select **Included Groups** and assign the groups you previously created that will use this app: -![Add app](images/app23.png) +![Create app step 7](images/app23.png) -![Add app](images/app24.png) +![Create app step 8](images/app24.png) In the **Select groups** pane, click the **Select** button. @@ -834,7 +830,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. -![Add app](images/app25.png) +![Create app step 9](images/app25.png) At this point, you have completed steps to add Office to Intune. @@ -842,7 +838,7 @@ For more information on adding Office apps to Intune, see [Assign Office 365 app If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: -![Add app](images/app26.png) +![Create app step 10](images/app26.png) ## Glossary diff --git a/windows/deployment/windows-autopilot/deployment-process.md b/windows/deployment/windows-autopilot/deployment-process.md deleted file mode 100644 index 6723d50e35..0000000000 --- a/windows/deployment/windows-autopilot/deployment-process.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Windows 10 deployment process posters -description: View and download Windows 10 deployment process flows for Microsoft Endpoint Configuration Manager and Windows Autopilot. -ms.reviewer: -manager: laurawi -ms.audience: itpro -author: greg-lindsay -keywords: upgrade, in-place, configuration, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro -author: greg-lindsay -ms.topic: article ---- - -# Windows Autopilot deployment process - -**Applies to** -- Windows 10 - -Windows Autopilot deployment processes are summarized in the poster below. The poster is two pages in portrait mode (11x17). Click the image below to view a PDF in your browser. - -[![Deploy Windows 10 with Autopilot](../media/windows10-autopilot-flowchart.png)](../media/Windows10AutopilotFlowchart.pdf) - -**Note**: The Windows Autopilot for existing devices process is included in the [Microsoft Endpoint Configuration Manager deployment poster](../windows-10-deployment-posters.md#deploy-windows-10-with-microsoft-endpoint-configuration-manager). \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/dfci-management.md b/windows/deployment/windows-autopilot/dfci-management.md deleted file mode 100644 index 550420a264..0000000000 --- a/windows/deployment/windows-autopilot/dfci-management.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: DFCI Management -ms.reviewer: -manager: laurawi -description: With Windows Autopilot Deployment and Intune, you can manage UEFI (BIOS) settings after they're enrolled by using the Device Firmware Configuration Interface (DFCI) -keywords: Autopilot, DFCI, UEFI, Windows 10 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# DFCI Management - -**Applies to** - -- Windows 10 - -With Windows Autopilot Deployment and Intune, you can manage Unified Extensible Firmware Interface (UEFI) settings after they're enrolled by using the Device Firmware Configuration Interface (DFCI). DFCI [enables Windows to pass management commands](https://docs.microsoft.com/windows/client-management/mdm/uefi-csp) from Intune to UEFI to Autopilot deployed devices. This allows you to limit end user's control over BIOS settings. For example, you can lock down the boot options to prevent users from booting up another OS, such as one that doesn't have the same security features. - -If a user reinstalls a previous Windows version, install a separate OS, or format the hard drive, they can't override DFCI management. This feature can also prevent malware from communicating with OS processes, including elevated OS processes. DFCI’s trust chain uses public key cryptography, and doesn't depend on local UEFI password security. This layer of security blocks local users from accessing managed settings from the device’s UEFI menus. - -For an overview of DFCI benefits, scenarios, and prerequisites, see [Device Firmware Configuration Interface (DFCI) Introduction](https://microsoft.github.io/mu/dyn/mu_plus/DfciPkg/Docs/Dfci_Feature/). - -## DFCI management lifecycle - -The DFCI management lifecycle can be viewed as UEFI integration, device registration, profile creation, enrollment, management, retirement, and recovery. See the following figure. - - ![Lifecycle](images/dfci.png) - -## Requirements - -- Windows 10, version 1809 or later and a supported UEFI is required. -- The device manufacturer must have DFCI added to their UEFI firmware in the manufacturing process, or as a firmware update that you install. Work with your device vendors to determine the [manufacturers that support DFCI](#oems-that-support-dfci), or the firmware version needed to use DFCI. -- The device must be managed with Microsoft Intune. For more information, see [Enroll Windows devices in Intune using Windows Autopilot](https://docs.microsoft.com/intune/enrollment/enrollment-autopilot). -- The device must be registered for Windows Autopilot by a [Microsoft Cloud Solution Provider (CSP) partner](https://partner.microsoft.com/membership/cloud-solution-provider), or registered directly by the OEM. - ->[!IMPORTANT] ->Devices manually registered for Autopilot (such as by [importing from a csv file](https://docs.microsoft.com/intune/enrollment/enrollment-autopilot#add-devices)) are not allowed to use DFCI. By design, DFCI management requires external attestation of the device’s commercial acquisition through an OEM or a Microsoft CSP partner registration to Windows Autopilot. When your device is registered, its serial number is displayed in the list of Windows Autopilot devices. - -## Managing DFCI profile with Windows Autopilot - -There are four basic steps in managing DFCI profile with Windows Autopilot: - -1. Create an Autopilot Profile -2. Create an Enrollment status page profile -3. Create a DFCI profile -4. Assign the profiles - -See [Create the profiles](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#create-the-profiles) and [Assign the profiles, and reboot](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#assign-the-profiles-and-reboot) for details. - -You can also [change existing DFCI settings](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#update-existing-dfci-settings) on devices that are in use. In your existing DFCI profile, change the settings and save your changes. Since the profile is already assigned, the new DFCI settings take effect when next time the device syncs or the device reboots. - -## OEMs that support DFCI - -- [Microsoft Surface](https://docs.microsoft.com/surface/surface-manage-dfci-guide) - -Additional OEMs are pending. - -## See also - -[Microsoft DFCI Scenarios](https://microsoft.github.io/mu/dyn/mu_plus/DfciPkg/Docs/Scenarios/DfciScenarios/)
        -[Windows Autopilot and Surface devices](https://docs.microsoft.com/surface/windows-autopilot-and-surface-devices)
        \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/enrollment-status.md b/windows/deployment/windows-autopilot/enrollment-status.md deleted file mode 100644 index 11a393eada..0000000000 --- a/windows/deployment/windows-autopilot/enrollment-status.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Windows Autopilot Enrollment Status Page -ms.reviewer: -manager: laurawi -description: Gives an overview of the Enrollment Status Page capabilities, configuration -keywords: Autopilot Plug and Forget, Windows 10 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot Enrollment Status Page - -**Applies to** - -- Windows 10, version 1803 and later - -The Enrollment Status Page (ESP) displays the status of the complete device configuration process when an MDM managed user signs into a device for the very first time. The ESP will help users understand the progress of device provisioning and ensures the device has met the organizations desired state before the user can access the desktop for the first time. - -The ESP will track the installation of applications, security policies, certificates and network connections. Within Intune, an administrator can deploy ESP profiles to a licensed Intune user and configure specific settings within the ESP profile; a few of these settings are: force the installation of specified applications, allow users to collect troubleshooting logs, specify what a user can do if device setup fails. For more information, see how to set up the [Enrollment Status Page in Intune](https://docs.microsoft.com/intune/windows-enrollment-status). - - ![Enrollment Status Page](images/enrollment-status-page.png) - - -## More information - -For more information on configuring the Enrollment Status Page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).
        -For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
        -For more information about blocking for app installation: -- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/). -- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514). diff --git a/windows/deployment/windows-autopilot/existing-devices.md b/windows/deployment/windows-autopilot/existing-devices.md deleted file mode 100644 index 81d649c077..0000000000 --- a/windows/deployment/windows-autopilot/existing-devices.md +++ /dev/null @@ -1,324 +0,0 @@ ---- -title: Windows Autopilot for existing devices -description: Modern desktop deployment with Windows Autopilot enables you to easily deploy the latest version of Windows 10 to your existing devices. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot for existing devices - -**Applies to: Windows 10** - -Modern desktop deployment with Windows Autopilot enables you to easily deploy the latest version of Windows 10 to your existing devices. The apps you need for work can be automatically installed. Your work profile is synchronized, so you can resume working right away. - -This topic describes how to convert Windows 7 or Windows 8.1 domain-joined computers to Windows 10 devices joined to either Azure Active Directory or Active Directory (Hybrid Azure AD Join) by using Windows Autopilot. - ->[!NOTE] ->Windows Autopilot for existing devices only supports user-driven Azure Active Directory and Hybrid Azure AD profiles. Self-deploying profiles are not supported. - -## Prerequisites - -- A currently supported version of Microsoft Endpoint Configuration Manager current branch or technical preview branch. -- The [Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) 1803 or later - - For more information on Configuration Manager support, see [Support for Windows 10 ADK](https://docs.microsoft.com/configmgr/core/plan-design/configs/support-for-windows-10#windows-10-adk). -- Assigned Microsoft Intune Licenses -- Azure Active Directory Premium -- Windows 10 version 1809 or later imported into Configuration Manager as an Operating System Image - - **Important**: See [Known issues](known-issues.md) if you are using Windows 10 1903 with Configuration Manager’s built-in **Windows Autopilot existing device** task sequence template. Currently, one of the steps in this task sequence must be edited to work properly with Windows 10, version 1903. - -## Procedures - -### Configure the Enrollment Status Page (optional) - -If desired, you can set up an [enrollment status page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) for Autopilot using Intune. - -To enable and configure the enrollment and status page: - -1. Open [Intune in the Azure portal](https://aka.ms/intuneportal). -2. Access **Intune > Device enrollment > Windows enrollment** and [Set up an enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status). -3. Access **Azure Active Directory > Mobility (MDM and MAM) > Microsoft Intune** and [Configure automatic MDM enrollment](https://docs.microsoft.com/configmgr/mdm/deploy-use/enroll-hybrid-windows#enable-windows-10-automatic-enrollment) and configure the MDM user scope for some or all users. - -See the following examples. - -![enrollment status page](images/esp-config.png)

        -![mdm](images/mdm-config.png) - -### Create the JSON file - ->[!TIP] ->To run the following commands on a computer running Windows Server 2012/2012 R2 or Windows 7/8.1, you must first download and install the [Windows Management Framework](https://www.microsoft.com/download/details.aspx?id=54616). - -1. On an Internet connected Windows PC or Server open an elevated Windows PowerShell command window -2. Enter the following lines to install the necessary modules - - #### Install required modules - - ```powershell - Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force - Install-Module AzureAD -Force - Install-Module WindowsAutopilotIntune -Force - Install-Module Microsoft.Graph.Intune -Force - ``` - -3. Enter the following lines and provide Intune administrative credentials - - Be sure that the user account you specify has sufficient administrative rights. - - ```powershell - Connect-MSGraph - ``` - The user and password for your account will be requested using a standard Azure AD form. Type your username and password and then click **Sign in**. -
        See the following example: - - ![Azure AD authentication](images/pwd.png) - - If this is the first time you’ve used the Intune Graph APIs, you’ll also be prompted to enable read and write permissions for Microsoft Intune PowerShell. To enable these permissions: - - Select **Consent on behalf or your organization** - - Click **Accept** - -4. Next, retrieve and display all the Autopilot profiles available in the specified Intune tenant in JSON format: - - #### Retrieve profiles in Autopilot for existing devices JSON format - - ```powershell - Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON - ``` - - See the following sample output: (use the horizontal scroll bar at the bottom to view long lines) -
        -    PS C:\> Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON
        -    {
        -        "CloudAssignedTenantId":  "1537de22-988c-4e93-b8a5-83890f34a69b",
        -        "CloudAssignedForcedEnrollment":  1,
        -        "Version":  2049,
        -        "Comment_File":  "Profile Autopilot Profile",
        -        "CloudAssignedAadServerData":  "{\"ZeroTouchConfig\":{\"CloudAssignedTenantUpn\":\"\",\"ForcedEnrollment\":1,\"CloudAssignedTenantDomain\":\"M365x373186.onmicrosoft.com\"}}",
        -        "CloudAssignedTenantDomain":  "M365x373186.onmicrosoft.com",
        -        "CloudAssignedDomainJoinMethod":  0,
        -        "CloudAssignedOobeConfig":  28,
        -        "ZtdCorrelationId":  "7F9E6025-1E13-45F3-BF82-A3E8C5B59EAC"
        -    }
        - - Each profile is encapsulated within braces **{ }**. In the previous example, a single profile is displayed. - - See the following table for a description of properties used in the JSON file. - - - | Property | Description | - |------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| - | Version (number, optional) | The version number that identifies the format of the JSON file. For Windows 10 1809, the version specified must be 2049. | - | CloudAssignedTenantId (guid, required) | The Azure Active Directory tenant ID that should be used. This is the GUID for the tenant, and can be found in properties of the tenant. The value should not include braces. | - | CloudAssignedTenantDomain (string, required) | The Azure Active Directory tenant name that should be used, e.g. tenant.onmicrosoft.com. | - | CloudAssignedOobeConfig (number, required) | This is a bitmap that shows which Autopilot settings were configured. Values include: SkipCortanaOptIn = 1, OobeUserNotLocalAdmin = 2, SkipExpressSettings = 4, SkipOemRegistration = 8, SkipEula = 16 | - | CloudAssignedDomainJoinMethod (number, required) | This property specifies whether the device should join Azure Active Directory or Active Directory (Hybrid Azure AD Join). Values include: Active AD Join = 0, Hybrid Azure AD Join = 1 | - | CloudAssignedForcedEnrollment (number, required) | Specifies that the device should require AAD Join and MDM enrollment.
        0 = not required, 1 = required. | - | ZtdCorrelationId (guid, required) | A unique GUID (without braces) that will be provided to Intune as part of the registration process. ZtdCorrelationId will be included in enrollment message as “OfflineAutoPilotEnrollmentCorrelator”. This attribute will be present only if the enrollment is taking place on a device registered with Zero Touch Provisioning via offline registration. | - | CloudAssignedAadServerData (encoded JSON string, required) | An embedded JSON string used for branding. It requires AAD corp branding enabled.
        Example value: "CloudAssignedAadServerData": "{\"ZeroTouchConfig\":{\"CloudAssignedTenantUpn\":\"\",\"CloudAssignedTenantDomain\":\"tenant.onmicrosoft.com\"}}" | - | CloudAssignedDeviceName (string, optional) | The name automatically assigned to the computer. This follows the naming pattern convention that can be configured in Intune as part of the Autopilot profile, or can specify an explicit name to use. | - - -5. The Autopilot profile must be saved as a JSON file in ASCII or ANSI format. Windows PowerShell defaults to Unicode format, so if you attempt to redirect output of the commands to a file, you must also specify the file format. For example, to save the file in ASCII format using Windows PowerShell, you can create a directory (ex: c:\Autopilot) and save the profile as shown below: (use the horizontal scroll bar at the bottom if needed to view the entire command string) - - ```powershell - Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON | Out-File c:\Autopilot\AutopilotConfigurationFile.json -Encoding ASCII - ``` - **IMPORTANT**: The file name must be named **AutopilotConfigurationFile.json** in addition to being encoded as ASCII/ANSI. - - If preferred, you can save the profile to a text file and edit in Notepad. In Notepad, when you choose **Save as** you must select Save as type: **All Files** and choose ANSI from the drop-down list next to **Encoding**. See the following example. - - ![Notepad JSON](images/notepad.png) - - After saving the file, move the file to a location suitable as a Microsoft Endpoint Configuration Manager package source. - - >[!IMPORTANT] - >Multiple JSON profile files can be used, but each must be named **AutopilotConfigurationFile.json** in order for OOBE to follow the Autopilot experience. The file also must be encoded as ANSI.

        **Saving the file with Unicode or UTF-8 encoding or saving it with a different file name will cause Windows 10 OOBE to not follow the Autopilot experience**.
        - - -### Create a package containing the JSON file - -1. In Configuration Manager, navigate to **\Software Library\Overview\Application Management\Packages** -2. On the ribbon, click **Create Package** -3. In the **Create Package and Program Wizard** enter the following **Package** and **Program Type** details:
        - - Name: **Autopilot for existing devices config** - - Select the **This package contains source files** checkbox - - Source folder: Click **Browse** and specify a UNC path containing the AutopilotConfigurationFile.json file. - - Click **OK** and then click **Next**. - - Program Type: **Do not create a program** -4. Click **Next** twice and then click **Close**. - -**NOTE**: If you change user-driven Autopilot profile settings in Intune at a later date, you must also update the JSON file and redistribute the associated Configuration Manager package. - -### Create a target collection - ->[!NOTE] ->You can also choose to reuse an existing collection - -1. Navigate to **\Assets and Compliance\Overview\Device Collections** -2. On the ribbon, click **Create** and then click **Create Device Collection** -3. In the **Create Device Collection Wizard** enter the following **General** details: - - Name: **Autopilot for existing devices collection** - - Comment: (optional) - - Limiting collection: Click **Browse** and select **All Systems** - - >[!NOTE] - >You can optionally choose to use an alternative collection for the limiting collection. The device to be upgraded must be running the ConfigMgr agent in the collection that you select. - -4. Click **Next**, then enter the following **Membership Rules** details: - - Click **Add Rule** and specify either a direct or query based collection rule to add the target test Windows 7 devices to the new collection. - - For example, if the hostname of the computer to be wiped and reloaded is PC-01 and you wish to use Name as the attribute, click **Add Rule > Direct Rule > (wizard opens) > Next** and then enter **PC-01** next to **Value**. Click **Next** and then choose **PC-01** under **Resources**. See the following examples. - - ![Named resource1](images/pc-01a.png) - ![Named resource2](images/pc-01b.png) - -5. Continue creating the device collection with the default settings: - - Use incremental updates for this collection: not selected - - Schedule a full update on this collection: default - - Click **Next** twice and then click **Close** - -### Create an Autopilot for existing devices Task Sequence - ->[!TIP] ->The next procedure requires a boot image for Windows 10 1803 or later. Review your available boot images in the Configuration Manager conole under **Software Library\Overview\Operating Systems\Boot images** and verify that the **OS Version** is 10.0.17134.1 (Windows 10 version 1803) or later. - -1. In the Configuration Manager console, navigate to **\Software Library\Overview\Operating Systems\Task Sequences** -2. On the Home ribbon, click **Create Task Sequence** -3. Select **Install an existing image package** and then click **Next** -4. In the Create Task Sequence Wizard enter the following details: - - Task sequence name: **Autopilot for existing devices** - - Boot Image: Click **Browse** and select a Windows 10 boot image (1803 or later) - - Click **Next**, and then on the Install Windows page click **Browse** and select a Windows 10 **Image package** and **Image Index**, version 1803 or later. - - Select the **Partition and format the target computer before installing the operating system** checkbox. - - Select or clear **Configure task sequence for use with Bitlocker** checkbox. This is optional. - - Product Key and Server licensing mode: Optionally enter a product key and server licensing mode. - - Randomly generate the local administrator password and disable the account on all support platforms (recommended): Optional. - - Enable the account and specify the local administrator password: Optional. - - Click **Next**, and then on the Configure Network page choose **Join a workgroup** and specify a name (ex: workgroup) next to **Workgroup**. - - > [!IMPORTANT] - > The Autopilot for existing devices task sequence will run the **Prepare Windows for capture** action which uses the System Preparation Tool (sysprep). This action will fail if the target machine is joined to a domain. - - >[!IMPORTANT] - > The System Preparation Tool (sysprep) will run with the /Generalize parameter which, on Windows 10 versions 1903 and 1909, will delete the Autopilot profile file and the machine will boot into OOBE phase instead of Autopilot phase. To fix this issue, please see [Windows Autopilot - known issues](https://docs.microsoft.com/windows/deployment/windows-autopilot/known-issues). - -5. Click **Next** and then click **Next** again to accept the default settings on the Install Configuration Manager page. -6. On the State Migration page, enter the following details: - - Clear the **Capture user settings and files** checkbox. - - Clear the **Capture network settings** checkbox. - - Clear the **Capture Microsoft Windows settings** checkbox. - - Click **Next**. - - >[!NOTE] - >Because the Autopilot for existing devices task sequence completes while in Windows PE, User State Migration Toolkit (USMT) data migration is not supported as there is no way to restore the user state into the new OS. Also, the User State Migration Toolkit (USMT) does not support Azure AD-joined devices. - -7. On the Include Updates page, choose one of the three available options. This selection is optional. -8. On the Install applications page, add applications if desired. This is optional. -9. Click **Next**, confirm settings, click **Next** and then click **Close**. -10. Right click on the Autopilot for existing devices task sequence and click **Edit**. -11. In the Task Sequence Editor under the **Install Operating System** group, click the **Apply Windows Settings** action. -12. Click **Add** then click **New Group**. -13. Change the group **Name** from **New Group** to **Autopilot for existing devices config**. -14. Click **Add**, point to **General**, then click **Run Command Line**. -15. Verify that the **Run Command Line** step is nested under the **Autopilot for existing devices config** group. -16. Change the **Name** to **Apply Autopilot for existing devices config file** and paste the following into the **Command line** text box, and then click **Apply**: - ``` - cmd.exe /c xcopy AutopilotConfigurationFile.json %OSDTargetSystemDrive%\windows\provisioning\Autopilot\ /c - ``` - - **AutopilotConfigurationFile.json** must be the name of the JSON file present in the Autopilot for existing devices package created earlier. - -17. In the **Apply Autopilot for existing devices config file** step, select the **Package** checkbox and then click **Browse**. -18. Select the **Autopilot for existing devices config** package created earlier and click **OK**. An example is displayed at the end of this section. -19. Under the **Setup Operating System** group, click the **Setup Windows and Configuration Manager** task. -20. Click **Add** and then click **New Group**. -21. Change **Name** from **New Group** to **Prepare Device for Autopilot** -22. Verify that the **Prepare Device for Autopilot** group is the very last step in the task sequence. Use the **Move Down** button if necessary. -23. With the **Prepare device for Autopilot** group selected, click **Add**, point to **Images** and then click **Prepare ConfigMgr Client for Capture**. -24. Add a second step by clicking **Add**, pointing to **Images**, and clicking **Prepare Windows for Capture**. Use the following settings in this step: - - Automatically build mass storage driver list: **Not selected** - - Do not reset activation flag: **Not selected** - - Shutdown the computer after running this action: **Optional** - - ![Autopilot task sequence](images/ap-ts-1.png) - -25. Click **OK** to close the Task Sequence Editor. - -> [!NOTE] -> On Windows 10 1903 and 1909, the **AutopilotConfigurationFile.json** is deleted by the **Prepare Windows for Capture** step. See [Windows Autopilot - known issues](https://docs.microsoft.com/windows/deployment/windows-autopilot/known-issues) for more information and a workaround. - -### Deploy Content to Distribution Points - -Next, ensure that all content required for the task sequence is deployed to distribution points. - -1. Right click on the **Autopilot for existing devices** task sequence and click **Distribute Content**. -2. Click **Next**, **Review the content to distribute** and then click **Next**. -3. On the Specify the content distribution page click **Add** to specify either a **Distribution Point** or **Distribution Point Group**. -4. On the a Add Distribution Points or Add Distribution Point Groups wizard specify content destinations that will allow the JSON file to be retrieved when the task sequence is run. -5. When you are finished specifying content distribution, click **Next** twice then click **Close**. - -### Deploy the OS with Autopilot Task Sequence - -1. Right click on the **Autopilot for existing devices** task sequence and then click **Deploy**. -2. In the Deploy Software Wizard enter the following **General** and **Deployment Settings** details: - - Task Sequence: **Autopilot for existing devices**. - - Collection: Click **Browse** and then select **Autopilot for existing devices collection** (or another collection you prefer). - - Click **Next** to specify **Deployment Settings**. - - Action: **Install**. - - Purpose: **Available**. You can optionally select **Required** instead of **Available**. This is not recommended during the test owing to the potential impact of inadvertent configurations. - - Make available to the following: **Only Configuration Manager Clients**. Note: Choose the option here that is relevant for the context of your test. If the target client does not have the Configuration Manager agent or Windows installed, you will need to select an option that includes PXE or Boot Media. - - Click **Next** to specify **Scheduling** details. - - Schedule when this deployment will become available: Optional - - Schedule when this deployment will expire: Optional - - Click **Next** to specify **User Experience** details. - - Show Task Sequence progress: Selected. - - Software Installation: Not selected. - - System restart (if required to complete the installation): Not selected. - - Commit changed at deadline or during a maintenance windows (requires restart): Optional. - - Allow task sequence to be run for client on the Internet: Optional - - Click **Next** to specify **Alerts** details. - - Create a deployment alert when the threshold is higher than the following: Optional. - - Click **Next** to specify **Distribution Points** details. - - Deployment options: **Download content locally when needed by the running task sequence**. - - When no local distribution point is available use a remote distribution point: Optional. - - Allow clients to use distribution points from the default site boundary group: Optional. - - Click **Next**, confirm settings, click **Next**, and then click **Close**. - -### Complete the client installation process - -1. Open the Software Center on the target Windows 7 or Windows 8.1 client computer. You can do this by clicking Start and then typing **software** in the search box, or by typing the following at a Windows PowerShell or command prompt: - - ``` - C:\Windows\CCM\SCClient.exe - ``` - -2. In the software library, select **Autopilot for existing devices** and click **Install**. See the following example: - - ![Named resource2](images/sc.png) - ![Named resource2](images/sc1.png) - -The Task Sequence will download content, reboot, format the drives and install Windows 10. The device will then proceed to be prepared for Autopilot. Once the task sequence has completed the device will boot into OOBE and provide an Autopilot experience. - -![refresh-1](images/up-1.png) -![refresh-2](images/up-2.png) -![refresh-3](images/up-3.png) - ->[!NOTE] ->If joining devices to Active Directory (Hybrid Azure AD Join), it is necessary to create a Domain Join device configuration profile that is targeted to "All Devices" (since there is no Azure Active Directory device object for the computer to do group-based targeting). See [User-driven mode for hybrid Azure Active Directory join](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven#user-driven-mode-for-hybrid-azure-active-directory-join) for more information. - -### Register the device for Windows Autopilot - -Devices provisioned through Autopilot will only receive the guided OOBE Autopilot experience on first boot. Once updated to Windows 10, the device should be registered to ensure a continued Autopilot experience in the event of PC reset. You can enable automatic registration for an assigned group using the **Convert all targeted devices to Autopilot** setting. For more information, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile). - -Also see [Adding devices to Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices). - -## Speeding up the deployment process - -To remove around 20 minutes from the deployment process, see Michael Niehaus's blog with instructions for [Speeding up Windows Autopilot for existing devices](https://blogs.technet.microsoft.com/mniehaus/2018/10/25/speeding-up-windows-autopilot-for-existing-devices/). diff --git a/windows/deployment/windows-autopilot/images/ap-aad-mdm.png b/windows/deployment/windows-autopilot/images/ap-aad-mdm.png new file mode 100644 index 0000000000..ece310f978 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/ap-aad-mdm.png differ diff --git a/windows/deployment/windows-autopilot/images/autopilot-oobe.png b/windows/deployment/windows-autopilot/images/autopilot-oobe.png new file mode 100644 index 0000000000..9cfea73377 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-oobe.png differ diff --git a/windows/deployment/windows-autopilot/images/create-profile.png b/windows/deployment/windows-autopilot/images/create-profile.png index 52f087721d..d2816e9c89 100644 Binary files a/windows/deployment/windows-autopilot/images/create-profile.png and b/windows/deployment/windows-autopilot/images/create-profile.png differ diff --git a/windows/deployment/windows-autopilot/images/delete-device1.png b/windows/deployment/windows-autopilot/images/delete-device1.png index e73f929fbd..770c8e5b02 100644 Binary files a/windows/deployment/windows-autopilot/images/delete-device1.png and b/windows/deployment/windows-autopilot/images/delete-device1.png differ diff --git a/windows/deployment/windows-autopilot/images/delete-device2.png b/windows/deployment/windows-autopilot/images/delete-device2.png index ed764ac1ed..188c72d67b 100644 Binary files a/windows/deployment/windows-autopilot/images/delete-device2.png and b/windows/deployment/windows-autopilot/images/delete-device2.png differ diff --git a/windows/deployment/windows-autopilot/images/device-status.png b/windows/deployment/windows-autopilot/images/device-status.png index 5a78973ce5..a5627040ec 100644 Binary files a/windows/deployment/windows-autopilot/images/device-status.png and b/windows/deployment/windows-autopilot/images/device-status.png differ diff --git a/windows/deployment/windows-autopilot/images/devices1.png b/windows/deployment/windows-autopilot/images/devices1.png new file mode 100644 index 0000000000..459aa19c69 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/devices1.png differ diff --git a/windows/deployment/windows-autopilot/images/dp.png b/windows/deployment/windows-autopilot/images/dp.png new file mode 100644 index 0000000000..a133c72491 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/dp.png differ diff --git a/windows/deployment/windows-autopilot/images/enroll1.png b/windows/deployment/windows-autopilot/images/enroll1.png new file mode 100644 index 0000000000..4bc9be72bb Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enroll1.png differ diff --git a/windows/deployment/windows-autopilot/images/enroll2.png b/windows/deployment/windows-autopilot/images/enroll2.png new file mode 100644 index 0000000000..62e7344da1 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enroll2.png differ diff --git a/windows/deployment/windows-autopilot/images/enroll3.png b/windows/deployment/windows-autopilot/images/enroll3.png new file mode 100644 index 0000000000..3501d5036c Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enroll3.png differ diff --git a/windows/deployment/windows-autopilot/images/enroll4.png b/windows/deployment/windows-autopilot/images/enroll4.png new file mode 100644 index 0000000000..fc7215b68f Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enroll4.png differ diff --git a/windows/deployment/windows-autopilot/images/group1.png b/windows/deployment/windows-autopilot/images/group1.png new file mode 100644 index 0000000000..2ccc8db248 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/group1.png differ diff --git a/windows/deployment/windows-autopilot/images/hyper-v-feature.png b/windows/deployment/windows-autopilot/images/hyper-v-feature.png new file mode 100644 index 0000000000..d7293d808e Binary files /dev/null and b/windows/deployment/windows-autopilot/images/hyper-v-feature.png differ diff --git a/windows/deployment/windows-autopilot/images/profile.png b/windows/deployment/windows-autopilot/images/profile.png index 40cf26bee2..1c6c734a74 100644 Binary files a/windows/deployment/windows-autopilot/images/profile.png and b/windows/deployment/windows-autopilot/images/profile.png differ diff --git a/windows/deployment/windows-autopilot/images/svr_mgr2.png b/windows/deployment/windows-autopilot/images/svr_mgr2.png new file mode 100644 index 0000000000..dd2e6737c6 Binary files /dev/null and b/windows/deployment/windows-autopilot/images/svr_mgr2.png differ diff --git a/windows/deployment/windows-autopilot/index.md b/windows/deployment/windows-autopilot/index.md deleted file mode 100644 index 93abebfa65..0000000000 --- a/windows/deployment/windows-autopilot/index.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Windows Autopilot deployment -description: Discover resources for Windows Autopilot deployment with this guide. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot deployment - -**Applies to** - -- Windows 10 - -Windows Autopilot is a zero-touch, self-service Windows deployment platform introduced with Windows 10, version 1703. The Windows Autopilot process runs immediately after powering on a new computer for the first time, enabling employees to configure new devices to be business-ready with just a few clicks. - -This guide is intended for use by an IT-specialist, system architect, or business decision maker. The guide provides information about how Windows Autopilot deployment works, including detailed requirements, deployment scenarios, and platform capabilities. The document highlights options that are available to you when planning a modern, cloud-joined Windows 10 deployment strategy. Links are provided to detailed step by step configuration procedures. - -## In this guide - - -
        What's new Windows Autopilot is always being updated with new features! Check this topic to read about the latest capabilities. -
        - -### Understanding Windows Autopilot - - -
        Overview of Windows AutopilotA review of Windows Autopilot is provided with a video walkthrough. Benefits and general requirements are discussed. -
        RequirementsDetailed software, network, licensing, and configuration requirements are provided. -
        Scenarios and CapabilitiesA summary of Windows Autopilot deployment scenarios and capabilities. -
        Get startedInterested in trying out Autopilot? See this step-by-step walkthrough to test Windows Autopilot on a virtual machine or physical device with a free 30-day trial premium Intune account. -
        - -### Deployment scenarios - - -
        User-driven modeRequirements and validation steps for deploying a new Azure Active Directory (AAD) joined or hybrid AAD-joined Windows 10 device are provided. -
        Self-deploying modeRequirements and validation steps for deploying a new Windows 10 device with little to no user interaction are provided. -
        Windows Autopilot ResetUsing Windows Autopilot Reset, a device can be restored to its original settings, taking it back to a business-ready state. Both local and remote reset scenarios are discussed. -
        Windows Autopilot for white glove deploymentRequirements and procedures are described that enable additional policies and apps to be delivered to a Windows Autopilot device. -
        Support for existing devicesThis topic describes how Windows Autopilot can be used to convert Windows 7 or Windows 8.1 domain-joined computers to AAD-joined computers running Windows 10. -
        - -### Using Windows Autopilot - - -
        Registering devicesThe process of registering a device with the Windows Autopilot deployment service is described. -
        Configuring device profilesThe device profile settings that specific its behavior when it is deployed are described. -
        Enrollment status pageSettings that are available on the Enrollment Status Page are described. -
        BitLocker encryption Available options for configuring BitLocker on Windows Autopilot devices are described. -
        DFCI management Manage UEFI settings using the Device Firmware Configuration Interface (DFCI) with Windows Autopilot and Intune. -
        Troubleshooting Windows AutopilotDiagnostic event information and troubleshooting procedures are provided. -
        Known issuesA list of current known issues and solutions is provided. -
        - -### Support topics - - -
        FAQFrequently asked questions on several topics are provided. -
        Support contactsSupport information is provided. -
        Registration authorizationThis article discusses how a CSP partner or OEM can obtain customer authorization to register Windows Autopilot devices. -
        Motherboard replacementInformation about how to deal with Autopilot registration and device repair issues is provided. -
        - -## Related topics - -[Windows Autopilot](https://www.microsoft.com/windowsforbusiness/windows-autopilot) diff --git a/windows/deployment/windows-autopilot/index.yml b/windows/deployment/windows-autopilot/index.yml new file mode 100644 index 0000000000..19763ed2b7 --- /dev/null +++ b/windows/deployment/windows-autopilot/index.yml @@ -0,0 +1,38 @@ +### YamlMime:Landing + +title: Windows Autopilot deployment resources and documentation # < 60 chars +summary: 'Note: Windows Autopilot documentation has moved! A few additional resources will also be available here. See the links on this page for more information.' # < 160 chars + +metadata: + title: Windows Autopilot deployment resources and documentation # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about deploying Windows 10 and keeping it up to date in your organization. # Required; article description that is displayed in search results. < 160 chars. + services: windows-10 + ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. + ms.subservice: subservice + ms.topic: landing-page # Required + ms.collection: windows-10 + author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. + ms.author: greglin #Required; microsoft alias of author; optional team alias. + ms.date: 08/05/2020 #Required; mm/dd/yyyy format. + localization_priority: medium + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card + - title: Overview + linkLists: + - linkListType: overview + links: + - text: Overview of Windows Autopilot + url: https://docs.microsoft.com/mem/autopilot/windows-autopilot + + # Card + - title: Tutorials + linkLists: + - linkListType: get-started + links: + - text: Demonstrate Windows Autopilot deployment + url: demonstrate-deployment-on-vm.md \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/known-issues.md b/windows/deployment/windows-autopilot/known-issues.md deleted file mode 100644 index b85fc9b010..0000000000 --- a/windows/deployment/windows-autopilot/known-issues.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Windows Autopilot known issues -ms.reviewer: -manager: laurawi -description: Inform yourself about known issues that may occur during Windows Autopilot deployment. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot - known issues - -**Applies to** - -- Windows 10 - - - - - - - - - - - - - -
        IssueMore information - -
        Blocking apps specified in a user-targeted Enrollment Status Profile are ignored during device ESP.The services responsible for determining the list of apps that should be blocking during device ESP are not able to determine the correct ESP profile containing the list of apps because they do not know the user identity. As a workaround, enable the default ESP profile (which targets all users and devices) and place the blocking app list there. In the future, it will be possible to instead target the ESP profile to device groups to avoid this issue.
        Windows Autopilot user-driven Hybrid Azure AD deployments do not grant users Administrator rights even when specified in the Windows Autopilot profile.This will occur when there is another user on the device that already has Administrator rights. For example, a PowerShell script or policy could create an additional local account that is a member of the Administrators group. To ensure this works properly, do not create an additional account until after the Windows Autopilot process has completed.
        Windows Autopilot device provisioning can fail with TPM attestation errors or ESP timeouts on devices where the real-time clock is off by a significant amount of time (e.g. several minutes or more).To fix this issue:
        1. Boot the device to the start of the out-of-box experience (OOBE). -
        2. Establish a network connection (wired or wireless). -
        3. Run the command w32tm /resync /force to sync the time with the default time server (time.windows.com).
        -
        Windows Autopilot for existing devices does not work for Windows 10, version 1903 or 1909; you see screens that you've disabled in your Windows Autopilot profile, such as the Windows 10 License Agreement screen. -
         
        -This happens because Windows 10, version 1903 and 1909 deletes the AutopilotConfigurationFile.json file. -
        To fix this issue:
        1. Edit the Configuration Manager task sequence and disable the Prepare Windows for Capture step. -
        2. Add a new Run command line step that runs c:\windows\system32\sysprep\sysprep.exe /oobe /reboot.
        -More information
        TPM attestation fails on Windows 10 1903 due to missing AKI extension in EK certificate. (An additional validation added in Windows 10 1903 to check that the TPM EK certs had the proper attributes according to the TCG specifications uncovered that a number of them don’t, so that validation will be removed). -Download and install the KB4517211 update. -
        The following known issues are resolved by installing the August 30, 2019 KB4512941 update (OS Build 18362.329): - -- Windows Autopilot for existing devices feature does not properly suppress “Activities” page during OOBE. (Because of this, you’ll see that extra page during OOBE). -- TPM attestation state is not cleared by sysprep /generalize, causing TPM attestation failure during later OOBE flow. (This isn’t a particularly common issue, but you could run into it while testing if you are running sysprep /generalize and then rebooting or reimaging the device to go back through an Autopilot white glove or self-deploying scenario). -- TPM attestation may fail if the device has a valid AIK cert but no EK cert. (This is related to the previous item). -- If TPM attestation fails during the Windows Autopilot white glove process, the landing page appears to be hung. (Basically, the white glove landing page, where you click “Provision” to start the white glove process, isn’t reporting errors properly). -- TPM attestation fails on newer Infineon TPMs (firmware version > 7.69). (Prior to this fix, only a specific list of firmware versions was accepted). -- Device naming templates may truncate the computer name at 14 characters instead of 15. -- Assigned Access policies cause a reboot which can interfere with the configuration of single-app kiosk devices. -Download and install the KB4512941 update.

        See the section: How to get this update for information on specific release channels you can use to obtain the update. -
        The following known issues are resolved by installing the July 26, 2019 KB4505903 update (OS Build 18362.267): - -- Windows Autopilot white glove does not work for a non-English OS and you see a red screen that says "Success." -- Windows Autopilot reports an AUTOPILOTUPDATE error during OOBE after sysprep, reset or other variations. This typically happens if you reset the OS or used a custom sysprepped image. -- BitLocker encryption is not correctly configured. Ex: BitLocker didn’t get an expected notification after policies were applied to begin encryption. -- You are unable to install UWP apps from the Microsoft Store, causing failures during Windows Autopilot. If you are deploying Company Portal as a blocking app during Windows Autopilot ESP, you’ve probably seen this error. -- A user is not granted administrator rights in the Windows Autopilot user-driven Hybrid Azure AD join scenario. This is another non-English OS issue. -Download and install the KB4505903 update.

        See the section: How to get this update for information on specific release channels you can use to obtain the update. -
        Windows Autopilot self-deploying mode fails with an error code: - -
        0x800705B4This is a general error indicating a timeout. A common cause of this error in self-deploying mode is that the device is not TPM 2.0 capable (ex: a virtual machine). Devices that are not TPM 2.0 capable cannot be used with self-deploying mode. -
        0x801c03eaThis error indicates that TPM attestation failed, causing a failure to join Azure Active Directory with a device token. -
        0xc1036501The device cannot do an automatic MDM enrollment because there are multiple MDM configurations in Azure AD. See Inside Windows Autopilot self-deploying mode. -
        -
        White glove gives a red screen and the Microsoft-Windows-User Device Registration/Admin event log displays HResult error code 0x801C03F3This can happen if Azure AD can’t find an AAD device object for the device that you are trying to deploy. This will occur if you manually delete the object. To fix it, remove the device from AAD, Intune, and Autopilot, then re-register it with Autopilot, which will recreate the AAD device object.
        -
        To obtain troubleshooting logs use: Mdmdiagnosticstool.exe -area Autopilot;TPM -cab c:\autopilot.cab -
        White glove gives a red screenWhite glove is not supported on a VM. -
        Error importing Windows Autopilot devices from a .csv fileEnsure that you have not edited the .csv file in Microsoft Excel or an editor other than Notepad. Some of these editors can introduce extra characters causing the file format to be invalid. -
        Windows Autopilot for existing devices does not follow the Autopilot OOBE experience.Ensure that the JSON profile file is saved in ANSI/ASCII format, not Unicode or UTF-8. -
        Something went wrong is displayed page during OOBE.The client is likely unable to access all the required AAD/MSA-related URLs. For more information, see Networking requirements. -
        Using a provisioning package in combination with Windows Autopilot can cause issues, especially if the PPKG contains join, enrollment, or device name information.Using PPKGs in combination with Windows Autopilot is not recommended. -
        - -## Related topics - -[Diagnose MDM failures in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10)
        -[Troubleshooting Windows Autopilot](troubleshooting.md) diff --git a/windows/deployment/windows-autopilot/profiles.md b/windows/deployment/windows-autopilot/profiles.md deleted file mode 100644 index 5cb74ed199..0000000000 --- a/windows/deployment/windows-autopilot/profiles.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Configure Autopilot profiles -description: Learn how to configure device profiles while performing a Windows Autopilot deployment. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Configure Autopilot profiles - -**Applies to** - -- Windows 10 - -For each device that has been defined to the Windows Autopilot deployment service, a profile of settings needs to be applied that specifies the exact behavior of that device when it is deployed. For detailed procedures on how to configure profile settings and register devices, see [Registering devices](add-devices.md#registering-devices). - -## Profile settings - -The following profile settings are available: - -- **Skip Cortana, OneDrive and OEM registration setup pages**. All devices registered with Autopilot will automatically skip these pages during the out-of-box experience (OOBE) process. - -- **Automatically setup for work or school**. All devices registered with Autopilot will automatically be considered work or school devices, so this question will not be asked during the OOBE process. - -- **Sign in experience with company branding**. Instead of presenting a generic Azure Active Directory sign-in page, all devices registered with Autopilot will automatically present a customized sign-in page with the organization’s name, logon, and additional help text, as configured in Azure Active Directory. See [Add company branding to your directory](https://docs.microsoft.com/azure/active-directory/customize-branding#add-company-branding-to-your-directory) to customize these settings. - -- **Skip privacy settings**. This optional Autopilot profile setting enables organizations to not ask about privacy settings during the OOBE process. This is typically desirable so that the organization can configure these settings via Intune or other management tool. - -- **Disable local admin account creation on the device**. Organizations can decide whether the user setting up the device should have administrator access once the process is complete. - -- **Skip End User License Agreement (EULA)**. Starting in Windows 10 version 1709, organizations can decide to skip the EULA page presented during the OOBE process. This means that organizations accept the EULA terms on behalf of their users. - -- **Disable Windows consumer features**. Starting in Windows 10 version 1803, organizations can disable Windows consumer features so that the device does not automatically install any additional Microsoft Store apps when the user first signs into the device. See the [MDM documentation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) for more details. - -## Related topics - -[Profile download](troubleshooting.md#profile-download) -[Registering devices](add-devices.md) diff --git a/windows/deployment/windows-autopilot/registration-auth.md b/windows/deployment/windows-autopilot/registration-auth.md deleted file mode 100644 index cb93b03921..0000000000 --- a/windows/deployment/windows-autopilot/registration-auth.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Windows Autopilot customer consent -description: Learn how a cloud service provider (CSP) partner or an OEM can get customer authorization to register Windows Autopilot devices on the customer’s behalf. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot customer consent - -**Applies to: Windows 10** - -This article describes how a cloud service provider (CSP) partner (direct bill, indirect provider, or indirect reseller) or an OEM can get customer authorization to register Windows Autopilot devices on the customer’s behalf. - -## CSP authorization - -CSP partners can get customer authorization to register Windows Autopilot devices on the customer’s behalf per the following restrictions: - - -
        Direct CSPGets direct authorization from the customer to register devices. -
        Indirect CSP ProviderGets implicit permission to register devices through the relationship their CSP Reseller partner has with the customer. Indirect CSP Providers register devices through Microsoft Partner Center. -
        Indirect CSP ResellerGets direct authorization from the customer to register devices. At the same time, their indirect CSP Provider partner also gets authorization, which mean that either the Indirect Provider or the Indirect Reseller can register devices for the customer. However, the Indirect CSP Reseller must register devices through the MPC UI (manually uploading CSV file), whereas the Indirect CSP Provider has the option to register devices using the MPC APIs. -
        - -### Steps - -For a CSP to register Windows Autopilot devices on behalf of a customer, the customer must first grant that CSP partner permission using the following process: - -1. CSP sends link to customer requesting authorization/consent to register/manage devices on their behalf. To do so: - - CSP logs into Microsoft Partner Center - - Click **Dashboard** on the top menu - - Click **Customer** on the side menu - - Click the **Request a reseller relationship** link: - ![Request a reseller relationship](images/csp1.png) - - Select the checkbox indicating whether or not you want delegated admin rights: - ![Delegated rights](images/csp2.png) - - NOTE: Depending on your partner, they might request Delegated Admin Permissions (DAP) when requesting this consent. You should ask them to use the newer DAP-free process (shown in this document) if possible. If not, you can easily remove their DAP status either from Microsoft Admin Center or the Office 365 admin portal: https://docs.microsoft.com/partner-center/customers_revoke_admin_privileges - - Send the template above to the customer via email. -2. Customer with global administrator privileges in Microsoft Admin Center clicks the link in the body of the email once they receive it from the CSP, which takes them directly to the following Microsoft 365 admin center page: - - ![Global admin](images/csp3a.png) - - The image above is what the customer will see if they requested delegated admin rights (DAP). Note that the page says what Admin roles are being requested. If the customer did not request delegated admin rights they would see the following page: - - ![Global admin](images/csp3b.png) - - > [!NOTE] - > A user without global admin privileges who clicks the link will see a message similar to the following: - - ![Not global admin](images/csp4.png) - -3. Customer selects the **Yes** checkbox, followed by the **Accept** button. Authorization happens instantaneously. -4. The CSP will know that this consent/authorization request has been completed because the customer will show up in the CSP’s MPC account under their **customers** list, for example: - -![Customers](images/csp5.png) - -## OEM authorization - -Each OEM has a unique link to provide to their respective customers, which the OEM can request from Microsoft via msoemops@microsoft.com. - -1. OEM emails link to their customer. -2. Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link once they receive it from the OEM, which takes them directly to the following MSfB page: - - ![Global admin](images/csp6.png) - - > [!NOTE] - > A user without global admin privileges who clicks the link will see a message similar to the following: - - ![Not global admin](images/csp7.png) -3. Customer selects the **Yes** checkbox, followed by the **Accept** button, and they’re done. Authorization happens instantaneously. - -4. The OEM can use the Validate Device Submission Data API to verify the consent has completed. This API is discussed in the latest version of the API Whitepaper, p. 14ff [https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx](https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx). **Note**: this link is only accessible by Microsoft Device Partners. As discussed in this whitepaper, it’s a best practice recommendation for OEM partners to run the API check to confirm they’ve received customer consent before attempting to register devices, thus avoiding errors in the registration process. - - > [!NOTE] - > During the OEM authorization registration process, no delegated admin permissions are granted to the OEM. - -## Summary - -At this stage of the process, Microsoft is no longer involved; the consent exchange happens directly between the OEM and the customer. And, it all happens instantaneously - as quickly as buttons are clicked. diff --git a/windows/deployment/windows-autopilot/self-deploying.md b/windows/deployment/windows-autopilot/self-deploying.md deleted file mode 100644 index 4bdb15131d..0000000000 --- a/windows/deployment/windows-autopilot/self-deploying.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Windows Autopilot Self-Deploying mode -description: Self-deploying mode allows a device to be deployed with little to no user interaction. This mode mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot Self-Deploying mode - -**Applies to: Windows 10, version 1903 or later** - -Windows Autopilot self-deploying mode enables a device to be deployed with little to no user interaction. For devices with an Ethernet connection, no user interaction is required; for devices connected via Wi-fi, no interaction is required after making the Wi-fi connection (choosing the language, locale, and keyboard, then making a network connection). - -Self-deploying mode joins the device into Azure Active Directory, enrolls the device in Intune (or another MDM service) leveraging Azure AD for automatic MDM enrollment, and ensures that all policies, applications, certificates, and networking profiles are provisioned on the device, leveraging the enrollment status page to prevent access to the desktop until the device is fully provisioned. - ->[!NOTE] ->Self-deploying mode does not support Active Directory Join or Hybrid Azure AD Join. All devices will be joined to Azure Active Directory. - -Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. When combined with MDM policies to create a local account and configure it to automatically log on, the complete configuration of the device can be automated. Find out more about these options by reading simplifying kiosk management for IT with Windows 10. See [Set up a kiosk or digital sign in Intune or other MDM service](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-in-intune-or-other-mdm-service) for additional details. - ->[!NOTE] ->Self-deploying mode does not presently associate a user with the device (since no user ID or password is specified as part of the process). As a result, some Azure AD and Intune capabilities (such as BitLocker recovery, installation of apps from the Company Portal, or Conditional Access) may not be available to a user that signs into the device. For more information see [Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md) and [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md). - -![The user experience with Windows Autopilot self-deploying mode](images/self-deploy-welcome.png) - -## Requirements - -Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode. The devices must also support TPM device attestation. (All newly-manufactured Windows devices should meet these requirements.) - ->[!IMPORTANT] ->If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported). Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC. See [Windows Autopilot known issues](known-issues.md) to review other known errors and solutions. - -In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. - -## Step by step - -In order to perform a self-deploying mode deployment using Windows Autopilot, the following preparation steps need to be completed: - -- Create an Autopilot profile for self-deploying mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. (Note that it is not possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.) -- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. Ensure that the profile has been assigned to the device before attempting to deploy that device. -- Boot the device, connecting it to Wi-fi if required, then wait for the provisioning process to complete. - -## Validation - -When performing a self-deploying mode deployment using Windows Autopilot, the following end-user experience should be observed: - -- Once connected to a network, the Autopilot profile will be downloaded. -- If the Autopilot profile has been configured to automatically configure the language, locale, and keyboard layout, these OOBE screens should be skipped as long as Ethernet connectivity is available. Otherwise, manual steps are required: - - If multiple languages are preinstalled in Windows 10, the user must pick a language. - - The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. -- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. -- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). -- The device will join Azure Active Directory. -- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). -- The [enrollment status page](enrollment-status.md) will be displayed. -- Depending on the device settings deployed, the device will either: - - Remain at the logon screen, where any member of the organization can log on by specifying their Azure AD credentials. - - Automatically sign in as a local account, for devices configured as a kiosk or digital signage. - ->[!NOTE] ->Deploying EAS policies using self-deploying mode for kiosk deployments will cause auto-logon functionality to fail. - -In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. diff --git a/windows/deployment/windows-autopilot/troubleshooting.md b/windows/deployment/windows-autopilot/troubleshooting.md deleted file mode 100644 index a03e5fbb55..0000000000 --- a/windows/deployment/windows-autopilot/troubleshooting.md +++ /dev/null @@ -1,164 +0,0 @@ ---- -title: Troubleshooting Windows Autopilot -description: Learn how to handle issues as they arise during the Windows Autopilot deployment process. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Troubleshooting Windows Autopilot - -**Applies to: Windows 10** - -Windows Autopilot is designed to simplify all parts of the Windows device lifecycle, but there are always situations where issues may arise, either due to configuration or other issues. To assist with troubleshooting efforts, review the following information. - -## Troubleshooting process - -Regardless of whether performing user-driven or self-deploying device deployments, the troubleshooting process is the mostly the same. It is useful to understand the flow for a specific device: - -- Network connection established. This can be a wireless (Wi-fi) or wired (Ethernet) connection. -- Windows Autopilot profile downloaded. Whether using a wired connection or manually establishing a wireless connection, the Windows Autopilot profile will be downloaded from the Autopilot deployment service as soon as the network connection is in place. -- User authentication. When performing a user-driven deployment, the user will enter their Azure Active Directory credentials, which will be validated. -- Azure Active Directory join. For user-driven deployments, the device will be joined to Azure AD using the specified user credentials. For self-deploying scenarios, the device will be joined without specifying any user credentials. -- Automatic MDM enrollment. As part of the Azure AD join process, the device will enroll in the MDM service configured in Azure AD (e.g. Microsoft Intune). -- Settings are applied. If the [enrollment status page](enrollment-status.md) is configured, most settings will be applied while the enrollment status page is displayed. If not configured or available, settings will be applied after the user is signed in. - -For troubleshooting, key activities to perform are: - -- Configuration. Has Azure Active Directory and Microsoft Intune (or an equivalent MDM service) been configured as specified in [Windows Autopilot configuration requirements](windows-autopilot-requirements.md)? -- Network connectivity. Can the device access the services described in [Windows Autopilot networking requirements](windows-autopilot-requirements.md)? -- Autopilot OOBE behavior. Were only the expected out-of-box experience screens displayed? Was the Azure AD credentials page customized with organization-specific details as expected? -- Azure AD join issues. Was the device able to join Azure Active Directory? -- MDM enrollment issues. Was the device able to enroll in Microsoft Intune (or an equivalent MDM service)? - -## Troubleshooting Autopilot Device Import - -### Clicking Import after selecting CSV does nothing, '400' error appears in network trace with error body **"Cannot convert the literal '[DEVICEHASH]' to the expected type 'Edm.Binary'"** - -This error points to the device hash being incorrectly formatted. This could be caused by anything that corrupts the collected hash, but one possibility is that the hash itself, even if completely valid, fails to be decoded. - -The device hash is Base64. At the device level, it's encoded as unpadded Base64, but Autopilot expects padded Base64. In most cases, it seems the payload lines up to not require padding, so the process works, but sometimes it doesn't line up cleanly and padding is necessary. This is when you get the error above. Powershell's Base64 decoder also expects padded Base64, so we can use that to validate that the hash is properly padded. - -The "A" characters at the end of the hash are effectively empty data - Each character in Base64 is 6 bits, A in Base64 is 6 bits equal to 0. Deleting or adding "A"s at the end doesn't change the actual payload data. - -To fix this, we'll need to modify the hash, then test the new value, until powershell succeeds in decoding the hash. The result is mostly illegible, this is fine - we're just looking for it to not throw the error "Invalid length for a Base-64 char array or string". - -To test the base64, you can use the following: -```powershell -[System.Text.Encoding]::ascii.getstring( [System.Convert]::FromBase64String("DEVICE HASH")) -``` - -So, as an example (this is not a device hash, but it's misaligned unpadded Base64 so it's good for testing): -```powershell -[System.Text.Encoding]::ascii.getstring( [System.Convert]::FromBase64String("Q29udG9zbwAAA")) -``` - -Now for the padding rules. The padding character is "=". The padding character can only be at the end of the hash, and there can only be a maximum of 2 padding characters. Here's the basic logic. - -- Does decoding the hash fail? - - Yes: Are the last two characters "="? - - Yes: Replace both "=" with a single "A" character, then try again - - No: Add another "=" character at the end, then try again - - No: That hash is valid - -Looping the logic above on the previous example hash, we get the following permutations: -- Q29udG9zbwAAA -- Q29udG9zbwAAA= -- Q29udG9zbwAAA== -- Q29udG9zbwAAAA -- Q29udG9zbwAAAA= -- **Q29udG9zbwAAAA==** (This one has valid padding) - -Replace the collected hash with this new padded hash then try to import again. - -## Troubleshooting Autopilot OOBE issues - -If the expected Autopilot behavior does not occur during the out-of-box experience (OOBE), it is useful to see whether the device received an Autopilot profile and what settings that profile contained. Depending on the Windows 10 release, there are different mechanisms available to do that. - -### Windows 10 version 1803 and above - -To see details related to the Autopilot profile settings and OOBE flow, Windows 10 version 1803 and above adds event log entries. These can be viewed using Event Viewer, navigating to the log at **Application and Services Logs –> Microsoft –> Windows –> Provisioning-Diagnostics-Provider –> AutoPilot** for versions before 1903, or **Application and Services Logs –> Microsoft –> Windows –> ModernDeployment-Diagnostics-Provider –> AutoPilot** for 1903 and above. The following events may be recorded, depending on the scenario and profile configuration. - -| Event ID | Type | Description | -|----------|------|-------------| -| 100 | Warning | “AutoPilot policy [name] not found.” This is typically a temporary problem, while the device is waiting for an Autopilot profile to be downloaded. | -| 101 | Info | “AutoPilotGetPolicyDwordByName succeeded: policy name = [setting name]; policy value [value].” This shows Autopilot retrieving and processing numeric OOBE settings. | -| 103 | Info | “AutoPilotGetPolicyStringByName succeeded: policy name = [name]; value = [value].” This shows Autopilot retrieving and processing OOBE setting strings such as the Azure AD tenant name. | -| 109 | Info | “AutoPilotGetOobeSettingsOverride succeeded: OOBE setting [setting name]; state = [state].” This shows Autopilot retrieving and processing state-related OOBE settings. | -| 111 | Info | “AutoPilotRetrieveSettings succeeded.” This means that the settings stored in the Autopilot profile that control the OOBE behavior have been retrieved successfully. | -| 153 | Info | “AutoPilotManager reported the state changed from [original state] to [new state].” Typically this should say “ProfileState_Unknown” to “ProfileState_Available” to show that a profile was available for the device and downloaded, so the device is ready to be deployed using Autopilot. | -| 160 | Info | “AutoPilotRetrieveSettings beginning acquisition.” This shows that Autopilot is getting ready to download the needed Autopilot profile settings. | -| 161 | Info | “AutoPilotManager retrieve settings succeeded.” The Autopilot profile was successfully downloaded. | -| 163 | Info | “AutoPilotManager determined download is not required and the device is already provisioned. Clean or reset the device to change this.” This message indicates that an Autopilot profile is resident on the device; it typically would only be removed by the **Sysprep /Generalize** process. | -| 164 | Info | “AutoPilotManager determined Internet is available to attempt policy download.” | -| 171 | Error | “AutoPilotManager failed to set TPM identity confirmed. HRESULT=[error code].” This indicates an issue performing TPM attestation, needed to complete the self-deploying mode process. | -| 172 | Error | “AutoPilotManager failed to set AutoPilot profile as available. HRESULT=[error code].” This is typically related to event ID 171. | - -In addition to the event log entries, the registry and ETW trace options described below also work with Windows 10 version 1803 and above. - -### Windows 10 version 1709 and above - -On Windows 10 version 1709 and above, information about the Autopilot profile settings are stored in the registry on the device after they are received from the Autopilot deployment service. These can be found at **HKLM\SOFTWARE\Microsoft\Provisioning\Diagnostics\AutoPilot**. Available registry entries include: - -| Value | Description | -|-------|-------------| -| AadTenantId | The GUID of the Azure AD tenant the user signed into. This should match the tenant that the device was registered with; if it does not match the user will receive an error. | -| CloudAssignedTenantDomain | The Azure AD tenant the device has been registered with, e.g. “contosomn.onmicrosoft.com.” If the device is not registered with Autopilot, this value will be blank. | -| CloudAssignedTenantId | The GUID of the Azure AD tenant the device has been registered with (the GUID corresponds to the tenant domain from the CloudAssignedTenantDomain registry value). If the device isn’t registered with Autopilot, this value will be blank.| -| IsAutoPilotDisabled | If set to 1, this indicates that the device is not registered with Autopilot. This could also indicate that the Autopilot profile could not be downloaded due to network connectivity or firewall issues, or network timeouts. | -| TenantMatched | This will be set to 1 if the tenant ID of the user matches the tenant ID that the device was registered with. If this is 0, the user would be shown an error and forced to start over. | -| CloudAssignedOobeConfig | This is a bitmap that shows which Autopilot settings were configured. Values include: SkipCortanaOptIn = 1, OobeUserNotLocalAdmin = 2, SkipExpressSettings = 4, SkipOemRegistration = 8, SkipEula = 16 | - -### Windows 10 semi-annual channel supported versions - -On devices running a [supported version](https://docs.microsoft.com/windows/release-information/) of Windows 10 semi-annual channel, ETW tracing can be used to capture detailed information from Autopilot and related components. The resulting ETW trace files can then be viewed using the Windows Performance Analyzer or similar tools. See [the advanced troubleshooting blog](https://blogs.technet.microsoft.com/mniehaus/2017/12/13/troubleshooting-windows-autopilot-level-300400/) for more information. - -## Troubleshooting Azure AD Join issues - -The most common issue joining a device to Azure AD is related to Azure AD permissions. Ensure [the correct configuration is in place](windows-autopilot-requirements.md) to allow users to join devices to Azure AD. Errors can also happen if the user has exceeded the number of devices that they are allowed to join, as configured in Azure AD. - -An Azure AD device is created upon import - it's important that this object not be deleted. It acts as Autopilot's anchor in AAD for group membership and targeting (including the profile) and can lead to join errors if it's deleted. Once this object has been deleted, to fix the issue, deleting and reimporting this autopilot hash will be necessary so it can recreate the associated object. - -Error code 801C0003 will typically be reported on an error page titled "Something went wrong". This error means that the Azure AD join failed. - -## Troubleshooting Intune enrollment issues - -See [this knowledge base article](https://support.microsoft.com/help/4089533/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for assistance with Intune enrollment issues. Common issues include incorrect or missing licenses assigned to the user or too many devices enrolled for the user. - -Error code 80180018 will typically be reported on an error page titled "Something went wrong". This error means that the MDM enrollment failed. - -If Autopilot Reset fails immediately with an error "Ran into trouble. Please sign in with an administrator account to see why and reset manually," see [Troubleshoot Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset#troubleshoot-autopilot-reset) for more help. - -## Profile download - -When an Internet-connected Windows 10 device boots up, it will attempt to connect to the Autopilot service and download an Autopilot profile. Note: It is important that a profile exists at this stage so that a blank profile is not cached locally on the PC. To remove the currently cached local profile in Windows 10 version 1803 and earlier, it is necessary to re-generalize the OS using **sysprep /generalize /oobe**, reinstall the OS, or re-image the PC. In Windows 10 version 1809 and later, you can retrieve a new profile by rebooting the PC. - -When a profile is downloaded depends on the version of Windows 10 that is running on the PC. See the following table. - -| Windows 10 version | Profile download behavior | -| --- | --- | -| 1709 | The profile is downloaded after the OOBE network connection page. This page is not displayed when using a wired connection. In this case, the profile is downloaded just prior to the EULA screen. | -| 1803 | The profile is downloaded as soon as possible. If wired, it is downloaded at the start of OOBE. If wireless, it is downloaded after the network connection page. | -| 1809 | The profile is downloaded as soon as possible (same as 1803), and again after each reboot. | - -If you need to reboot a computer during OOBE: -- Press Shift-F10 to open a command prompt. -- Enter **shutdown /r /t 0** to restart immediately, or **shutdown /s /t 0** to shutdown immediately. - -For more information, see [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options). - -## Related topics - -[Windows Autopilot - known issues](known-issues.md)
        -[Diagnose MDM failures in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10)
        diff --git a/windows/deployment/windows-autopilot/user-driven.md b/windows/deployment/windows-autopilot/user-driven.md deleted file mode 100644 index 45520df78e..0000000000 --- a/windows/deployment/windows-autopilot/user-driven.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Windows Autopilot User-Driven Mode -description: Windows Autopilot user-driven mode allows devices to be deployed to a ready-to-use state without requiring help from IT personnel. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot user-driven mode - -Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions: - -- Unbox the device, plug it in, and turn it on. -- Choose a language, locale and keyboard. -- Connect it to a wireless or wired network with internet access. -- Specify your e-mail address and password for your organization account. - -After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be suppressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available. - -Today, Windows Autopilot user-driven mode supports Azure Active Directory and Hybrid Azure Active Directory joined devices. See [What is a device identity](https://docs.microsoft.com/azure/active-directory/devices/overview) for more information about these two join options. - -## Available user-driven modes - -The following options are available for user-driven deployment: - -- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain. -- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain. - -### User-driven mode for Azure Active Directory join - -In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed: - -- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information. -- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected. -- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. - -For each device that will be deployed using user-driven deployment, these additional steps are needed: - -- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information. -- Ensure an Autopilot profile has been assigned to the device: - - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically. - - If using Intune and Azure Active Directory static device groups, manually add the device to the device group. - - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device. - -Also see the [Validation](#validation) section below. - ->[!NOTE] ->If the device reboots during the device enrollment status page (ESP) in the user-driven Azure Active Directoy join scenario, the user will not automatically sign on because the user's credentials cannot be saved across reboots. In this scenario, the user will need to sign in manually after the device ESP completes. - -### User-driven mode for hybrid Azure Active Directory join - -Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan). - -#### Requirements - -To perform a user-driven hybrid AAD joined deployment using Windows Autopilot: - -- A Windows Autopilot profile for user-driven mode must be created and - - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile. -- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group. -- The device must be running Windows 10, version 1809 or later. -- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user). -- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md). -- The Intune Connector for Active Directory must be installed. - - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. -- If using Proxy, WPAD Proxy settings option must be enabled and configured. - -**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default. - -#### Step by step instructions - -See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid). - -Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. - -## Validation - -When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed: - -- If multiple languages are preinstalled in Windows 10, the user must pick a language. -- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. -- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. -- Once connected to a network, the Autopilot profile will be downloaded. -- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). -- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text. -- Once correct credentials have been entered, the device will join Azure Active Directory. -- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). -- If configured, the [enrollment status page](enrollment-status.md) will be displayed. -- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided. -- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks. - -If your results do not match these expectations, see the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md deleted file mode 100644 index 88eb4f33e3..0000000000 --- a/windows/deployment/windows-autopilot/white-glove.md +++ /dev/null @@ -1,119 +0,0 @@ ---- -title: Windows Autopilot for white glove deployment -description: Windows Autopilot for white glove deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, pre-provisioning -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -audience: itproF -author: greg-lindsay -manager: laurawi -ms.audience: itpro -author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot for white glove deployment - -**Applies to: Windows 10, version 1903** - -Windows Autopilot enables organizations to easily provision new devices - leveraging the preinstalled OEM image and drivers with a simple process that can be performed by the end user to help get their device business-ready. - - ![OEM](images/wg01.png) - -Windows Autopilot can also provide a white glove service that enables partners or IT staff to pre-provision a Windows 10 PC so that it is fully configured and business-ready. From the end user’s perspective, the Windows Autopilot user-driven experience is unchanged, but getting their device to a fully provisioned state is faster. - -With **Windows Autopilot for white glove deployment**, the provisioning process is split. The time-consuming portions are performed by IT, partners, or OEMs. The end user simply completes a few necessary settings and polices and then they can begin using their device. - - ![OEM](images/wg02.png) - -Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven mode for Azure Active Directory Join, and user-driven mode for Hybrid Azure Active Directory join scenarios. - -## Prerequisites - -In addition to [Windows Autopilot requirements](windows-autopilot-requirements.md), Windows Autopilot for white glove deployment adds the following: - -- Windows 10, version 1903 or later is required. -- An Intune subscription. -- Physical devices that support TPM 2.0 and device attestation; virtual machines are not supported. The white glove provisioning process leverages Windows Autopilot self-deploying capabilities, hence the TPM 2.0 requirements. -- Physical devices with Ethernet connectivity; Wi-fi connectivity is not supported due to the requirement to choose a language, locale, and keyboard to make that Wi-fi connection; doing that in a pre-provisioning process could prevent the user from choosing their own language, locale, and keyboard when they receive the device. - ->[!IMPORTANT] ->Because the OEM or vendor performs the white glove process, this doesn’t require access to an end-user's on-prem domain infrastructure. This is unlike a typical hybrid Azure AD-joined scenario because rebooting the device is postponed. The device is resealed prior to the time when connectivity to a domain controller is expected, and the domain network is contacted when the device is unboxed on-prem by the end-user. - -## Preparation - -Devices slated for white glove provisioning are registered for Autopilot via the normal registration process. - -To be ready to try out Windows Autopilot for white glove deployment, ensure that you can first successfully use existing Windows Autopilot user-driven scenarios: - -- User-driven Azure AD join. Devices can be deployed using Windows Autopilot and joined to an Azure Active Directory tenant. -- User-driven with Hybrid Azure AD join. Devices can be deployed using Windows Autopilot and joined to an on-premises Active Directory domain, then registered with Azure Active Directory to enable the Hybrid Azure AD join features. - -If these scenarios cannot be completed, Windows Autopilot for white glove deployment will also not succeed since it builds on top of these scenarios. - -To enable white glove deployment, an additional Autopilot profile setting must be configured by the customer or IT Admin via their Intune account, prior to beginning the white glove process in the provisioning service facility: - - ![allow white glove](images/allow-white-glove-oobe.png) - -The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. Please make sure not to target both win32 and LOB apps to the same device. - -> [!NOTE] -> The white glove technician phase will install all device-targeted apps as well as any user-targeted, device-context apps that are targeted to the assigned user. If there is no assigned user, then it will only install the device-targeted apps. Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users. - -## Scenarios - -Windows Autopilot for white glove deployment supports two distinct scenarios: -- User-driven deployments with Azure AD Join. The device will be joined to an Azure AD tenant. -- User-driven deployments with Hybrid Azure AD Join. The device will be joined to an on-premises Active Directory domain, and separately registered with Azure AD. -Each of these scenarios consists of two parts, a technician flow and a user flow. At a high level, these parts are the same for Azure AD Join and Hybrid Azure AD join; differences are primarily seen by the end user in the authentication steps. - -### Technician flow - -After the customer or IT Admin has targeted all the apps and settings they want for their devices through Intune, the white glove technician can begin the white glove process. The technician could be a member of the IT staff, a services partner, or an OEM – each organization can decide who should perform these activities. Regardless of the scenario, the process to be performed by the technician is the same: -- Boot the device (running Windows 10 Pro, Enterprise, or Education SKUs, version 1903 or later). -- From the first OOBE screen (which could be a language selection or locale selection screen), do not click **Next**. Instead, press the Windows key five times to view an additional options dialog. From that screen, choose the **Windows Autopilot provisioning** option and then click **Continue**. - - ![choice](images/choice.png) - -- On the **Windows Autopilot Configuration** screen, information will be displayed about the device: - - The Autopilot profile assigned to the device. - - The organization name for the device. - - The user assigned to the device (if there is one). - - A QR code containing a unique identifier for the device, useful to look up the device in Intune to make any configuration changes needed (e.g. assigning a user, adding the device to any additional groups needed for app or policy targeting). - - **Note**: The QR codes can be scanned using a companion app, which will also configure the device to specify who it belongs to. An [open-source sample of the companion app](https://github.com/Microsoft/WindowsAutopilotCompanion) that integrates with Intune via the Graph API has been published to GitHub by the Autopilot team. -- Validate the information displayed. If any changes are needed, make these and then click **Refresh** to re-download the updated Autopilot profile details. - - ![landing](images/landing.png) - -- Click **Provision** to begin the provisioning process. - -If the pre-provisioning process completes successfully: -- A green status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps. - ![white-glove-result](images/white-glove-result.png) -- Click **Reseal** to shut the device down. At that point, the device can be shipped to the end user. - ->[!NOTE] ->Technician Flow inherits behavior from [Self-Deploying Mode](self-deploying.md). Per the Self-Deploying Mode documentation, it leverages the Enrollment Status Page to hold the device in a provisioning state and prevent the user from proceeding to the desktop after enrollment but before software and configuration is done applying. As such, if Enrollment Status Page is disabled, the reseal button may appear before software and configuration is done applying letting you proceed to the user flow before technician flow provisioning is complete. The green screen validates that enrollment was successful, not that the technician flow is necessarily complete. - -If the pre-provisioning process fails: -- A red status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps. -- Diagnostic logs can be gathered from the device, and then it can be reset to start the process over again. - -### User flow - -If the pre-provisioning process completed successfully and the device was resealed, it can be delivered to the end user to complete the normal Windows Autopilot user-driven process. They will perform a standard set of steps: - -- Power on the device. -- Select the appropriate language, locale, and keyboard layout. -- Connect to a network (if using Wi-Fi). If using Hybrid Azure AD Join, there must be connectivity to a domain controller; if using Azure AD Join, internet connectivity is required. -- On the branded sign-on screen, enter the user’s Azure Active Directory credentials. -- If using Hybrid Azure AD Join, the device will reboot; after the reboot, enter the user’s Active Directory credentials. -- Additional policies and apps will be delivered to the device, as tracked by the Enrollment Status Page (ESP). Once complete, the user will be able to access the desktop. - -## Related topics - -[White glove video](https://youtu.be/nE5XSOBV0rI) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md deleted file mode 100644 index b129a7a7fb..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Windows Autopilot requirements -ms.reviewer: -manager: laurawi -description: Inform yourself about software, networking, licensing, and configuration requirements for Windows Autopilot deployment. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot requirements - -**Applies to: Windows 10** - -Windows Autopilot depends on specific capabilities available in Windows 10, Azure Active Directory, and MDM services such as Microsoft Intune. In order to use Windows Autopilot and leverage these capabilities, some requirements must be met. - -**Note**: For a list of OEMs that currently support Windows Autopilot, see the Participant device manufacturers section at [Windows Autopilot](https://aka.ms/windowsautopilot). - -## Software requirements - -- A [supported version](https://docs.microsoft.com/windows/release-information/) of Windows 10 Semi-Annual Channel is required. Windows 10 Enterprise 2019 long-term servicing channel (LTSC) is also supported. -- The following editions are supported: - - Windows 10 Pro - - Windows 10 Pro Education - - Windows 10 Pro for Workstations - - Windows 10 Enterprise - - Windows 10 Education - - Windows 10 Enterprise 2019 LTSC - ->[!NOTE] ->Procedures for deploying Windows Autopilot might refer to specific products and versions. The inclusion of these products in this content doesn't imply an extension of support for a version that is beyond its support lifecycle. Windows Autopilot does not support products that are beyond their support lifecycle. For more information, see [Microsoft Lifecycle Policy](https://go.microsoft.com/fwlink/p/?LinkId=208270). - -## Networking requirements - -Windows Autopilot depends on a variety of internet-based services. Access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following: - -- Ensure DNS name resolution for internet DNS names -- Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP) - -In environments that have more restrictive Internet access, or for those that require authentication before internet access can be obtained, additional configuration may be required to whitelist access to the required services. For additional details about each of these services and their specific requirements, review the following details: - -
        ServiceInformation -
        Windows Autopilot Deployment ServiceAfter a network connection is in place, each Windows 10 device will contact the Windows Autopilot Deployment Service. With Windows 10 version 1903 and above, the following URLs are used: https://ztd.dds.microsoft.com, https://cs.dds.microsoft.com.
        - -
        Windows ActivationWindows Autopilot also requires Windows Activation services. See Windows activation or validation fails with error code 0x8004FE33 for details about the URLs that need to be accessible for the activation services.
        - -
        Azure Active DirectoryUser credentials are validated by Azure Active Directory, and the device can also be joined to Azure Active Directory. See Office 365 IP Address and URL Web service for more information. -
        IntuneOnce authenticated, Azure Active Directory will trigger enrollment of the device into the Intune MDM service. See the following link for details about network communication requirements: Intune network configuration requirements and bandwidth. -
        Windows UpdateDuring the OOBE process, as well as after the Windows 10 OS is fully configured, the Windows Update service is leveraged to retrieve needed updates. If there are problems connecting to Windows Update, see How to solve connection problems concerning Windows Update or Microsoft Update.
        - -If Windows Update is inaccessible, the AutoPilot process will still continue but critical updates will not be available. - -
        Delivery OptimizationWhen downloading Windows Updates, Microsoft Store apps and app updates, Office Updates and Intune Win32 Apps, the Delivery Optimization service is contacted to enable peer-to-peer sharing of content so that only a few devices need to download it from the internet.
        - -If the Delivery Optimization Service is inaccessible, the AutoPilot process will still continue with Delivery Optimization downloads from the cloud (without peer-to-peer). - -
        Network Time Protocol (NTP) SyncWhen a Windows device starts up, it will talk to a network time server to ensure that the time on the device is accurate. Ensure that UDP port 123 to time.windows.com is accessible. -
        Domain Name Services (DNS)To resolve DNS names for all services, the device communicates with a DNS server, typically provided via DHCP.  This DNS server must be able to resolve internet names. -
        Diagnostics dataStarting in Windows 10, 1903, diagnostic data collection will be enabled by default. To disable Windows Analytics and related diagnostics capabilities, see Manage enterprise diagnostic data level.
        - -If diagnostic data cannot be sent, the Autopilot process will still continue, but services that depend on diagnostic data, such as Windows Analytics, will not work. -
        Network Connection Status Indicator (NCSI)Windows must be able to tell that the device is able to access the internet. For more information, see Network Connection Status Indicator (NCSI). - -www.msftconnecttest.com must be resolvable via DNS and accessible via HTTP. -
        Windows Notification Services (WNS)This service is used to enable Windows to receive notifications from apps and services. See Microsoft Store for more information.
        - -If the WNS services are not available, the Autopilot process will still continue without notifications. -
        Microsoft Store, Microsoft Store for BusinessApps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM).  App updates and additional apps may also be needed when the user first logs in. For more information, see Prerequisites for Microsoft Store for Business and Education (also includes Azure AD and Windows Notification Services).
        - -If the Microsoft Store is not accessible, the AutoPilot process will still continue without Microsoft Store apps. - -
        Office 365As part of the Intune device configuration, installation of Microsoft 365 Apps for enterprise may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). -
        Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains. -
        Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode -
        Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips (including devices from any other manufacturer) come with these certificates preinstalled. See TPM recommendations for more details. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested: - -
        Intel- https://ekop.intel.com/ekcertservice -
        Qualcomm- https://ekcert.spserv.microsoft.com/EKCertificate/GetEKCertificate/v1 -
        AMD- https://ftpm.amd.com/pki/aia -
        Infineon- https://pki.infineon.com -
        - -## Licensing requirements - -Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory. It also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs: - -To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following is required: -- [Microsoft 365 Business subscriptions](https://www.microsoft.com/microsoft-365/business) -- [Microsoft 365 F1 subscriptions](https://www.microsoft.com/microsoft-365/enterprise/firstline) -- [Microsoft 365 Academic A1, A3, or A5 subscriptions](https://www.microsoft.com/education/buy-license/microsoft365/default.aspx) -- [Microsoft 365 Enterprise E3 or E5 subscriptions](https://www.microsoft.com/microsoft-365/enterprise), which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune). -- [Enterprise Mobility + Security E3 or E5 subscriptions](https://www.microsoft.com/cloud-platform/enterprise-mobility-security), which include all needed Azure AD and Intune features. -- [Intune for Education subscriptions](https://docs.microsoft.com/intune-education/what-is-intune-for-education), which include all needed Azure AD and Intune features. -- [Azure Active Directory Premium P1 or P2](https://azure.microsoft.com/services/active-directory/) and [Microsoft Intune subscriptions](https://www.microsoft.com/cloud-platform/microsoft-intune) (or an alternative MDM service). - -> [!NOTE] -> Even when using Microsoft 365 subscriptions, you still need to [assign Intune licenses to the users](https://docs.microsoft.com/intune/fundamentals/licenses-assign). - -Additionally, the following are also recommended (but not required): -- [Microsoft 365 Apps for enterprise](https://www.microsoft.com/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services). -- [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise. - -## Configuration requirements - -Before Windows Autopilot can be used, some configuration tasks are required to support the common Autopilot scenarios. - -- Configure Azure Active Directory automatic enrollment. For Microsoft Intune, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) for details. If using a different MDM service, contact the vendor for the specific URLs or configuration needed for those services. -- Configure Azure Active Directory custom branding. In order to display an organization-specific logon page during the Autopilot process, Azure Active Directory needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. Note that the "square logo" and "sign-in page text" are the key elements for Autopilot, as well as the Azure Active Directory tenant name (configured separately in the Azure AD tenant properties). -- Enable [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) if desired, in order to automatically step up from Windows 10 Pro to Windows 10 Enterprise. - -Specific scenarios will then have additional requirements. Generally, there are two specific tasks: - -- Device registration. Devices need to be added to Windows Autopilot to support most Windows Autopilot scenarios. See [Adding devices to Windows Autopilot](add-devices.md) for more details. -- Profile configuration. Once devices have been added to Windows Autopilot, a profile of settings needs to be applied to each device. See [Configure Autopilot profiles](profiles.md) for details. Note that Microsoft Intune can automate this profile assignment; see [Create an AutoPilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an AutoPilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group) for more information. - -See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details. - -For a walkthrough for some of these and related steps, see this video: - -
        - - - - -There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications). - -## Related topics - -[Configure Autopilot deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset.md b/windows/deployment/windows-autopilot/windows-autopilot-reset.md deleted file mode 100644 index e114e9f5ec..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot-reset.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Windows Autopilot Reset -description: Windows Autopilot Reset takes the device back to a business-ready state, allowing the next user to sign in and get productive quickly and easily. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot Reset - -- Applies to: Windows 10, version 1709 and later (local reset) -- Applies to: Windows 10, version 1809 and later (remote reset) - -Windows Autopilot Reset removes personal files, apps, and settings and reapplies a device’s original settings, maintaining its identity connection to Azure AD and its management connection to Intune so that the device is once again ready for use. Windows Autopilot Reset takes the device back to a business-ready state, allowing the next user to sign in and get productive quickly and simply. - -The Windows Autopilot Reset process automatically retains information from the existing device: - -- Set the region, language, and keyboard to the originally-configured values. -- Wi-Fi connection details. -- Provisioning packages previously applied to the device, as well as a provisioning package present on a USB drive when the reset process is initiated. -- Azure Active Directory device membership and MDM enrollment information. - -Windows Autopilot Reset will block the user from accessing the desktop until this information is restored, including re-applying any provisioning packages. For devices enrolled in an MDM service, Windows Autopilot Reset will also block until an MDM sync is completed. -When Autopilot reset is used on a device, the device's primary user will be removed. The next user who signs in after the reset will be set as the primary user. - - ->[!NOTE] ->The Autopilot Reset does not support Hybrid Azure AD joined devices. - -## Scenarios - -Windows Autopilot Reset supports two scenarios: - -- [Local reset](#reset-devices-with-local-windows-autopilot-reset) initiated by IT personnel or other administrators from the organization. -- [Remote reset](#reset-devices-with-remote-windows-autopilot-reset) initiated remotely by IT personnel via an MDM service such as Microsoft Intune. - -Additional requirements and configuration details apply with each scenario; see the detailed links above for more information. - -## Reset devices with local Windows Autopilot Reset - -**Applies to: Windows 10, version 1709 and above** - -The Intune Service Administrator role is required to perform this task. For more information, see [Add users and grant administrative permission to Intune](https://docs.microsoft.com/intune/users-add). - -IT admins can perform a local Windows Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With a local Autopilot Reset, devices are returned to a fully configured or known IT-approved state. - -To enable local Autopilot Reset in Windows 10: - -1. [Enable the policy for the feature](#enable-local-windows-autopilot-reset) -2. [Trigger a reset for each device](#trigger-local-windows-autopilot-reset) - -### Enable local Windows Autopilot Reset - -To enable a local Windows Autopilot Reset, the **DisableAutomaticReDeploymentCredentials** policy must be configured. This policy is documented in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, local Windows Autopilot is disabled. This ensures that a local Autopilot Reset is not triggered by accident. - -You can set the policy using one of these methods: - -- MDM provider - - - When using Intune, you can create a new device configuration profile, specifying "Windows 10 or later" for the platform, "Device restrictions" for the profile type, and "General" for the settings category. The **Automatic Redeployment** setting should be set to **Allow**. Deploy this setting to all devices where a local reset should be permitted. - - If you're using an MDM provider other than Intune, check your MDM provider documentation on how to set this policy. - -- Windows Configuration Designer - - You can [use Windows Configuration Designer](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package) to set the **Runtime settings > Policies > CredentialProviders > DisableAutomaticReDeploymentCredentials** setting to 0 and then create a provisioning package. - -- Set up School PCs app - - The latest release of the Set up School PCs app supports enabling local Windows Autopilot Reset. - -### Trigger local Windows Autopilot Reset - -Performing a local Windows Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it is done, the device is again ready for use. - -**To trigger a local Autopilot Reset** - -1. From the Windows device lock screen, enter the keystroke: **CTRL + ![Windows key](images/windows_glyph.png) + R**. - - ![Enter CTRL+Windows key+R on the Windows lock screen](images/autopilot-reset-lockscreen.png) - - This will open up a custom login screen for the local Autopilot Reset. The screen serves two purposes: - 1. Confirm/verify that the end user has the right to trigger Local Autopilot Reset - 2. Notify the user in case a provisioning package, created using Windows Configuration Designer, will be used as part of the process. - - ![Custom login screen for local Autopilot Reset](images/autopilot-reset-customlogin.png) - -2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger the local Autopilot Reset. - - Once the local Autopilot Reset is triggered, the reset process starts. Once provisioning is complete, the device is again ready for use. - -## Reset devices with remote Windows Autopilot Reset - -**Applies to: Windows 10, version 1809 or later** - -When performing a remote Windows Autopilot Reset, an MDM service such an Microsoft Intune can be used to initiate the reset process, avoiding the need for IT staff or other administrators to visit each machine to initiate the process. - -To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed and joined to Azure AD. This feature is not supported on devices that were enrolled using [Autopilot self deploying mode](self-deploying.md). - -### Triggering a remote Windows Autopilot Reset - -To trigger a remote Windows Autopilot Reset via Intune, follow these steps: - -- Navigate to **Devices** tab in the Intune console. -- In the **All devices** view, select the targeted reset devices and then click **More** to view device actions. -- Select **Autopilot Reset** to kick-off the reset task. - ->[!NOTE] ->The Autopilot Reset option will not be enabled in Microsoft Intune for devices not running Windows 10 build 17672 or higher. - ->[!IMPORTANT] ->The feature for Autopilot Reset will stay grayed out, **unless** you reset the device using Autopilot (either using Fresh Reset or manually sysprep the device). - -Once the reset is complete, the device is again ready for use. - - - -## Troubleshooting - -Windows Autopilot Reset requires that the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is correctly configured and enabled on the device. If it is not configured and enabled, an error such as `Error code: ERROR_NOT_SUPPORTED (0x80070032)` will be reported. - -To make sure WinRE is enabled, use the [REAgentC.exe tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command: - -``` -reagentc /enable -``` - -If Windows Autopilot Reset fails after enabling WinRE, or if you are unable to enable WinRE, please contact [Microsoft Support](https://support.microsoft.com) for assistance. diff --git a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md b/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md deleted file mode 100644 index ab95bacbee..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Windows Autopilot scenarios and capabilities -description: Follow along with several typical Windows Autopilot deployment scenarios, such as re-deploying a device in a business-ready state. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot scenarios and capabilities - -**Applies to: Windows 10** - -## Scenarios - -Windows Autopilot includes support for a growing list of scenarios, designed to support common organization needs which can vary based on the type of organization and their progress moving to Windows 10 and [transitioning to modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management). - -The following Windows Autopilot scenarios are described in this guide: - -| Scenario | More information | -| --- | --- | -| Deploy devices that will be set up by a member of the organization and configured for that person | [Windows Autopilot user-driven mode](user-driven.md) | -| Deploy devices that will be automatically configured for shared use, as a kiosk, or as a digital signage device.| [Windows Autopilot self-deploying mode](self-deploying.md) | -| Re-deploy a device in a business-ready state.| [Windows Autopilot Reset](windows-autopilot-reset.md) | -| Pre-provision a device with up-to-date applications, policies and settings.| [White glove](white-glove.md) | -| Deploy Windows 10 on an existing Windows 7 or 8.1 device | [Windows Autopilot for existing devices](existing-devices.md) | - -## Windows Autopilot capabilities - -### Windows Autopilot is self-updating during OOBE - -Starting with the Windows 10, version 1903, Autopilot functional and critical updates will begin downloading automatically during OOBE after a device gets connected to a network and the [critical driver and Windows zero-day patch (ZDP) updates](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe) have completed. The user or IT admin cannot opt-out of these Autopilot updates; they are required for Windows Autopilot deployment to operate properly. Windows will alert the user that the device is checking for, downloading and installing the updates. - -See [Windows Autopilot update](autopilot-update.md) for more information. - -### Cortana voiceover and speech recognition during OOBE - -In Windows 10, version 1903 and later Cortana voiceover and speech recognition during OOBE is DISABLED by default for all Windows 10 Pro, Education and Enterprise SKUs. - -If desired, you can enable Cortana voiceover and speech recognition during OOBE by creating the following registry key. This key does not exist by default. - -HKLM\Software\Microsoft\Windows\CurrentVersion\OOBE\EnableVoiceForAllEditions - -The key value is a DWORD with **0** = disabled and **1** = enabled. - -| Value | Description | -| --- | --- | -| 0 | Cortana voiceover is disabled | -| 1 | Cortana voiceover is enabled | -| No value | Device will fall back to default behavior of the edition | - -To change this key value, use WCD tool to create as PPKG as documented [here](https://docs.microsoft.com/windows/configuration/wcd/wcd-oobe#nforce). - -### Bitlocker encryption - -With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. For more information, see [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md) - -## Related topics - -[Windows Autopilot: What's new](windows-autopilot-whats-new.md) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md b/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md deleted file mode 100644 index b10120467d..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Windows Autopilot what's new -ms.reviewer: -manager: laurawi -description: Read news and resources about the latest updates and past versions of Windows Autopilot. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot: What's new - -**Applies to** - -- Windows 10 - -## Windows Autopilot update history - -The following [Windows Autopilot updates](autopilot-update.md) are available. **Note**: Updates are automatically downloaded and applied during the Windows Autopilot deployment process. - -No updates are available yet. Check back here later for more information. - -## New in Windows 10, version 1903 - -[Windows Autopilot for white glove deployment](white-glove.md) is new in Windows 10, version 1903. See the following video: - -
        - -> [!VIDEO https://www.youtube.com/embed/nE5XSOBV0rI] - -Also new in this version of Windows: -- The Intune enrollment status page (ESP) now tracks Intune Management Extensions. -- [Cortana voiceover and speech recognition during OOBE](windows-autopilot-scenarios.md#cortana-voiceover-and-speech-recognition-during-oobe) is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. -- [Windows Autopilot is self-updating during OOBE](windows-autopilot-scenarios.md#windows-autopilot-is-self-updating-during-oobe). Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. -- Windows Autopilot will set the diagnostics data level to Full on Windows 10 version 1903 and later during OOBE. - -## New in Windows 10, version 1809 - -Windows Autopilot [self-deploying mode](self-deploying.md) enables a zero touch device provisioning experience. Simply power on the device, plug it into the Ethernet, and the device is fully configured by Windows Autopilot. This self-deploying capability removes the current need to have an end user interact by pressing the “Next” button during the deployment process. - -You can utilize Windows Autopilot self-deploying mode to register the device to an AAD tenant, enroll in your organization’s MDM provider, and provision policies and applications, all with no user authentication or user interaction required. - ->[!NOTE] ->Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. - -## Related topics - -[What's new in Microsoft Intune](https://docs.microsoft.com/intune/whats-new)
        -[What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/) diff --git a/windows/deployment/windows-autopilot/windows-autopilot.md b/windows/deployment/windows-autopilot/windows-autopilot.md deleted file mode 100644 index a24ff772a4..0000000000 --- a/windows/deployment/windows-autopilot/windows-autopilot.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Overview of Windows Autopilot -description: Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro -author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Overview of Windows Autopilot - -**Applies to** - -- Windows 10 - -Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple. - -Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users. See the following diagram: - - ![Process overview](images/image1.png) - -When initially deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images and drivers for every model of device being used. Instead of re-imaging the device, your existing Windows 10 installation can be transformed into a “business-ready” state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise) to support advanced features. - -Once deployed, Windows 10 devices can be managed by tools such as Microsoft Intune, Windows Update for Business, Microsoft Endpoint Configuration Manager, and other similar tools. Windows Autopilot can also be used to re-purpose a device by leveraging Windows Autopilot Reset to quickly prepare a device for a new user, or in break/fix scenarios to enable a device to quickly be brought back to a business-ready state. - -Windows Autopilot enables you to: -* Automatically join devices to Azure Active Directory (Azure AD) or Active Directory (via Hybrid Azure AD Join). See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. -* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription for configuration*](https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Windows-10-Azure-AD-and-Microsoft-Intune-Automatic-MDM/ba-p/244067)). -* Restrict the Administrator account creation. -* Create and auto-assign devices to configuration groups based on a device's profile. -* Customize OOBE content specific to the organization. - -## Windows Autopilot walkthrough - -The following video shows the process of setting up Windows Autopilot: - -
        - - - -## Benefits of Windows Autopilot - -Traditionally, IT pros spend a lot of time building and customizing images that will later be deployed to devices. Windows Autopilot introduces a new approach. - -From the user's perspective, it only takes a few simple operations to make their device ready to use. - -From the IT pro's perspective, the only interaction required from the end user is to connect to a network and to verify their credentials. Everything beyond that is automated. - -## Requirements - -A [supported version](https://docs.microsoft.com/windows/release-information/) of Windows 10 semi-annual channel is required to use Windows Autopilot. Windows 10 Enterprise LTSC 2019 is also supported. See [Windows Autopilot requirements](windows-autopilot-requirements.md) for detailed information on software, configuration, network, and licensing requirements. - -## Related topics - -[Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot)
        -[Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md) diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index a9089d86bc..91aaa460e8 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -5,13 +5,13 @@ ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877 ms.reviewer: manager: laurawi ms.audience: itpro +ms.author: greglin author: greg-lindsay keywords: deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library audience: itpro -author: greg-lindsay ms.topic: article --- diff --git a/windows/device-security/docfx.json b/windows/device-security/docfx.json index 0dbfe2d2e9..42439e1e7b 100644 --- a/windows/device-security/docfx.json +++ b/windows/device-security/docfx.json @@ -40,7 +40,16 @@ "depot_name": "MSDN.win-device-security", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/docfx.json b/windows/docfx.json index 4661aaf2be..b199d2a9c7 100644 --- a/windows/docfx.json +++ b/windows/docfx.json @@ -17,10 +17,12 @@ "ROBOTS": "INDEX, FOLLOW", "audience": "ITPro", "breadcrumb_path": "/itpro/windows/breadcrumb/toc.json", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "Win.windows" - }, + "uhfHeaderId": "MSDocsHeader-M365-IT", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "Win.windows" + } + }, "contributors_to_exclude": [ "rjagiewich", "traya1", diff --git a/windows/eulas/docfx.json b/windows/eulas/docfx.json index ff3ab96c92..5270a33f5d 100644 --- a/windows/eulas/docfx.json +++ b/windows/eulas/docfx.json @@ -37,7 +37,16 @@ "globalMetadata": { "breadcrumb_path": "/windows/eulas/breadcrumb/toc.json", "extendBreadcrumb": true, - "feedback_system": "None" + "feedback_system": "None", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/hub/TOC.md b/windows/hub/TOC.md index 1b9bb407c6..eaeb093642 100644 --- a/windows/hub/TOC.md +++ b/windows/hub/TOC.md @@ -1,6 +1,6 @@ -# [Windows 10](index.md) +# [Windows 10](index.yml) ## [What's new](/windows/whats-new) -## [Release information](/windows/release-information) +## [Release information](/windows/release-health) ## [Deployment](/windows/deployment) ## [Configuration](/windows/configuration) ## [Client management](/windows/client-management) diff --git a/windows/hub/breadcrumb/toc.yml b/windows/hub/breadcrumb/toc.yml index a28aaa3b77..e2971f2d84 100644 --- a/windows/hub/breadcrumb/toc.yml +++ b/windows/hub/breadcrumb/toc.yml @@ -27,7 +27,7 @@ topicHref: /windows/client-management/mdm/index - name: Release information tocHref: /windows/release-information/ - topicHref: /windows/release-information/index + topicHref: /windows/release-health/release-information - name: Privacy tocHref: /windows/privacy/ topicHref: /windows/privacy/index diff --git a/windows/hub/docfx.json b/windows/hub/docfx.json index 07a8ea153b..898e842c41 100644 --- a/windows/hub/docfx.json +++ b/windows/hub/docfx.json @@ -36,6 +36,7 @@ "globalMetadata": { "audience": "ITPro", "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "ms.topic": "article", "feedback_system": "GitHub", @@ -47,7 +48,16 @@ "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Windows 10 for IT Pros" + "titleSuffix": "Windows 10 for IT Pros", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/hub/index.md b/windows/hub/index.md deleted file mode 100644 index 97ce2a79a5..0000000000 --- a/windows/hub/index.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Windows 10 -description: Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10. -ms.assetid: 345A4B4E-BC1B-4F5C-9E90-58E647D11C60 -ms.prod: w10 -ms.localizationpriority: high -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.reviewer: dansimp -manager: dansimp ---- - -# Windows 10 - -Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10. - -  - -## Check out [what's new in Windows 10, version 1909](/windows/whats-new/whats-new-windows-10-version-1909). -
        - - - - - - - - - -
        - - Read what's new in Windows 10 -
        What's New?

        -
        - - Configure Windows 10 in your enterprise -
        Configuration

        -
        - - Windows 10 deployment -
        Deployment

        -

        - - Manage applications in your Windows 10 enterprise deployment -
        App Management
        -

        - - Windows 10 client management -
        Client Management
        -

        - - Windows 10 security -
        Security
        -
        - ->[!TIP] -> Looking for information about older versions of Windows? Check out our other [Windows libraries](/previous-versions/windows/) on docs.microsoft.com. You can also search this site to find specific information, like this [Windows 8.1 content](https://docs.microsoft.com/search/index?search=Windows+8.1&dataSource=previousVersions). - -## Get to know Windows as a Service (WaaS) - -The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. - -These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. - -- [Read more about Windows as a Service](/windows/deployment/update/waas-overview) \ No newline at end of file diff --git a/windows/hub/index.yml b/windows/hub/index.yml new file mode 100644 index 0000000000..bac6a47a7b --- /dev/null +++ b/windows/hub/index.yml @@ -0,0 +1,115 @@ +### YamlMime:Landing + +title: Windows 10 resources and documentation for IT Pros # < 60 chars +summary: Plan, deploy, secure, and manage devices running Windows 10. # < 160 chars + +metadata: + title: Windows 10 documentation for IT Pros # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Evaluate, plan, deploy, secure and manage devices running Windows 10. # Required; article description that is displayed in search results. < 160 chars. + services: windows-10 + ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. + ms.subservice: subservice + ms.topic: landing-page # Required + ms.collection: windows-10 + author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. + ms.author: greglin #Required; microsoft alias of author; optional team alias. + ms.date: 10/20/2020 #Required; mm/dd/yyyy format. + localization_priority: medium + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: What's new + linkLists: + - linkListType: overview + links: + - text: What's new in Windows 10, version 20H2 + url: /windows/whats-new/whats-new-windows-10-version-20H2 + - text: What's new in Windows 10, version 2004 + url: /windows/whats-new/whats-new-windows-10-version-2004 + - text: What's new in Windows 10, version 1909 + url: /windows/whats-new/whats-new-windows-10-version-1909 + - text: Windows 10 release information + url: https://docs.microsoft.com/windows/release-health/release-information + + # Card (optional) + - title: Configuration + linkLists: + - linkListType: how-to-guide + links: + - text: Configure Windows 10 + url: /windows/configuration/index + - text: Accessibility information for IT Pros + url: /windows/configuration/windows-10-accessibility-for-itpros + - text: Configure access to Microsoft Store + url: /windows/configuration/stop-employees-from-using-microsoft-store + - text: Set up a shared or guest PC + url: /windows/configuration/set-up-shared-or-guest-pc + + # Card (optional) + - title: Deployment + linkLists: + - linkListType: deploy + links: + - text: Deploy and update Windows 10 + url: /windows/deployment/index + - text: Windows 10 deployment scenarios + url: /windows/deployment/windows-10-deployment-scenarios + - text: Create a deployment plan + url: /windows/deployment/update/create-deployment-plan + - text: Prepare to deploy Windows 10 + url: /windows/deployment/update/prepare-deploy-windows + + + # Card + - title: App management + linkLists: + - linkListType: how-to-guide + links: + - text: Windows 10 application management + url: /windows/application-management/index + - text: Understand the different apps included in Windows 10 + url: /windows/application-management/apps-in-windows-10 + - text: Get started with App-V for Windows 10 + url: /windows/application-management/app-v/appv-getting-started + - text: Keep removed apps from returning during an update + url: /windows/application-management/remove-provisioned-apps-during-update + + # Card + - title: Client management + linkLists: + - linkListType: how-to-guide + links: + - text: Windows 10 client management + url: /windows/client-management/index + - text: Administrative tools in Windows 10 + url: /windows/client-management/administrative-tools-in-windows-10 + - text: Create mandatory user profiles + url: /windows/client-management/mandatory-user-profile + - text: New policies for Windows 10 + url: /windows/client-management/new-policies-for-windows-10 + + # Card (optional) + - title: Security and Privacy + linkLists: + - linkListType: how-to-guide + links: + - text: Windows 10 Enterprise Security + url: /windows/security/index + - text: Windows Privacy + url: /windows/privacy/index + - text: Identity and access management + url: /windows/security/identity-protection/index + - text: Threat protection + url: /windows/security/threat-protection/index + - text: Information protection + url: /windows/security/information-protection/index + - text: Required diagnostic data + url: /windows/privacy/required-windows-diagnostic-data-events-and-fields-2004 + - text: Optional diagnostic data + url: /windows/privacy/windows-diagnostic-data + - text: Changes to Windows diagnostic data collection + url: /windows/privacy/changes-to-windows-diagnostic-data-collection diff --git a/windows/hub/windows-10.yml b/windows/hub/windows-10.yml deleted file mode 100644 index 1504e2cae3..0000000000 --- a/windows/hub/windows-10.yml +++ /dev/null @@ -1,77 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10 -metadata: - document_id: - title: Windows 10 - description: Find tools, step-by-step guides, and other resources to help you deploy and support Windows 10 in your organization. - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: medium - author: lizap - ms.author: elizapo - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find tools, step-by-step guides, and other resources to help you deploy and support Windows 10 in your organization. - " -- title: Explore -- items: - - type: markdown - text: " - Get started with Windows 10. Evaluate free for 90 days, and set up virtual labs to test a proof of concept.
        - -

        **Download a free 90-day evaluation**
        Try the latest features. Test your apps, hardware, and deployment strategies.
        Start evaluation

        **Get started with virtual labs**
        Try setup, deployment, and management scenarios in a virtual environment, with no additional software or setup required.
        See Windows 10 labs

        **Conduct a proof of concept**
        Download a lab environment with MDT, Configuration Manager, Windows 10, and more.
        Get deployment kit
        - " -- title: What's new -- items: - - type: markdown - text: " - Learn about the latest releases and servicing options.
        - -
        What's new in Windows 10, version 1809
        What's new in Windows 10, version 1803
        What's new in Windows 10, version 1709
        Windows 10 release information
        Windows 10 update history
        Windows 10 roadmap
        - " -- title: Frequently asked questions -- items: - - type: markdown - text: " - Get answers to common questions, or get help with a specific problem.
        - -
        Windows 10 FAQ for IT Pros
        Windows 10 forums
        Windows 10 TechCommunity
        Which edition is right for your organization?
        Infrastructure requirements
        What's Windows as a service?
        Windows 10 Mobile deployment and management guide
        - " -- title: Plan -- items: - - type: markdown - text: " - Prepare to deploy Windows 10 in your organization. Explore deployment methods, compatibility tools, and servicing options.
        - -

        **Application compatibility**
        Get best practices and tools to help you address compatibility issues prior to deployment.
        Find apps that are ready for Windows 10.
        Identify and prioritize apps with Upgrade Readiness
        Test, validate, and implement with the Web Application Compatibility Lab Kit

        **Upgrade options**
        Learn about the options available for upgrading Windows 7, Windows 8, or Windows 8.1 PCs and devices to Windows 10.
        Manage Windows upgrades with Upgrade Readiness
        Windows 10 upgrade paths
        Windows 10 edition upgrades

        **Windows as a service**
        Windows as a service provides ongoing new capabilities and updates while maintaining a high level of hardware and software compatibility.
        Explore
        - " -- title: Deploy -- items: - - type: markdown - text: " - Download recommended tools and get step-by-step guidance for in-place upgrades, dynamic provisioning, or traditional deployments.
        - -

        **In-place upgrade**
        The simplest way to upgrade PCs that are currently running WIndows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade.
        Upgrade to Windows 10 with Configuration Manager
        Upgrade to Windows 10 with MDT

        **Traditional deployment**
        Some organizations may still need to opt for an image-based deployment of Windows 10.
        Deploy Windows 10 with Configuration Manager
        Deploy Windows 10 with MDT

        **Dynamic provisioning**
        With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image.
        Provisioning packages for Windows 10
        Build and apply a provisioning package
        Customize Windows 10 start and the taskbar
        Windows deployment for education environments
        Set up a shared or guest PC with Windows 10
        Sideload apps in Windows 10
        - " -- title: Management and security -- items: - - type: markdown - text: " - Learn how to manage Windows 10 clients and apps, secure company data, and manage risk.
        - -

        **Manage Windows 10 updates**
        Get best practices and tools to help you manage clients and apps.
        Manage clients in Windows 10
        Manage apps and features in Windows 10

        **Security**
        Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats.
        Windows 10 enterprise security
        Threat protection
        Identity protection
        Information protection
        - " -- title: Stay informed -- items: - - type: markdown - text: " - -

        **Sign up for the Windows IT Pro Insider**
        Find out about new resources and get expert tips and tricks on deployment, management, security, and more.
        Learn more

        **Follow us on Twitter**
        Keep up with the latest desktop and device trends, Windows news, and events for IT pros.
        Visit Twitter

        **Join the Windows Insider Program for Business**
        Get early access to new builds and provide feedback on the latest features and functionalities.
        Get started
        - " diff --git a/windows/keep-secure/docfx.json b/windows/keep-secure/docfx.json index 884e478dcb..eecc6e8b2e 100644 --- a/windows/keep-secure/docfx.json +++ b/windows/keep-secure/docfx.json @@ -36,7 +36,16 @@ "depot_name": "MSDN.keep-secure", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/known-issues/docfx.json b/windows/known-issues/docfx.json index ebcaf22f82..4592f86de8 100644 --- a/windows/known-issues/docfx.json +++ b/windows/known-issues/docfx.json @@ -38,7 +38,16 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app" + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/manage/docfx.json b/windows/manage/docfx.json index a65600c79b..e96e3ebf76 100644 --- a/windows/manage/docfx.json +++ b/windows/manage/docfx.json @@ -35,7 +35,16 @@ "depot_name": "MSDN.windows-manage", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/media/phase-diagrams/deployment-phases.png b/windows/media/phase-diagrams/deployment-phases.png new file mode 100644 index 0000000000..4d2a4fa946 Binary files /dev/null and b/windows/media/phase-diagrams/deployment-phases.png differ diff --git a/windows/media/phase-diagrams/migration-phases.png b/windows/media/phase-diagrams/migration-phases.png new file mode 100644 index 0000000000..d502450fba Binary files /dev/null and b/windows/media/phase-diagrams/migration-phases.png differ diff --git a/windows/media/phase-diagrams/onboard.png b/windows/media/phase-diagrams/onboard.png new file mode 100644 index 0000000000..b6a29de3bf Binary files /dev/null and b/windows/media/phase-diagrams/onboard.png differ diff --git a/windows/media/phase-diagrams/prepare.png b/windows/media/phase-diagrams/prepare.png new file mode 100644 index 0000000000..1001e41e0d Binary files /dev/null and b/windows/media/phase-diagrams/prepare.png differ diff --git a/windows/media/phase-diagrams/setup.png b/windows/media/phase-diagrams/setup.png new file mode 100644 index 0000000000..1635785046 Binary files /dev/null and b/windows/media/phase-diagrams/setup.png differ diff --git a/windows/plan/docfx.json b/windows/plan/docfx.json index a05d2009a6..d4e156d3c2 100644 --- a/windows/plan/docfx.json +++ b/windows/plan/docfx.json @@ -35,7 +35,16 @@ "depot_name": "MSDN.windows-plan", "folder_relative_path_in_docset": "./" } - } + }, + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/privacy/TOC.md b/windows/privacy/TOC.md deleted file mode 100644 index de11fa6d06..0000000000 --- a/windows/privacy/TOC.md +++ /dev/null @@ -1,32 +0,0 @@ -# [Privacy](index.yml) -## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md) -## [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md) -## [Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals](Windows-10-and-privacy-compliance.md) -## [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md) -## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) -## Diagnostic Data Viewer -### [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md) -### [Diagnostic Data Viewer for PowerShell Overview](Microsoft-DiagnosticDataViewer.md) -## Basic level Windows diagnostic data events and fields -### [Windows 10, version 1903 and Windows 10, version 1909 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) -### [Windows 10, version 1809 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) -### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) -### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) -### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) -## Enhanced level Windows diagnostic data events and fields -### [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) -## Full level categories -### [Windows 10, version 1709 and newer diagnostic data for the Full level](windows-diagnostic-data.md) -### [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md) -## Manage Windows 10 connection endpoints -### [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -### [Manage connections from Windows operating system components to Microsoft services using MDM](manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md) -### [Connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) -### [Connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) -### [Connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) -### [Connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) -### [Connection endpoints for non-Enterprise editions of Windows 10, version 1903](windows-endpoints-1903-non-enterprise-editions.md) -### [Connection endpoints for non-Enterprise editions of Windows 10, version 1809](windows-endpoints-1809-non-enterprise-editions.md) -### [Connection endpoints for non-Enterprise editions of Windows 10, version 1803](windows-endpoints-1803-non-enterprise-editions.md) -### [Connection endpoints for non-Enterprise editions of Windows 10, version 1709](windows-endpoints-1709-non-enterprise-editions.md) - diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 42ed225058..d3555a0e8a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 01/04/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -81,7 +82,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -97,7 +98,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -108,7 +109,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -136,7 +137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -147,7 +148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -167,7 +168,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -178,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -198,7 +199,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -209,7 +210,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -229,7 +230,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -240,7 +241,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -260,7 +261,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -271,7 +272,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -292,7 +293,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -303,7 +304,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -341,7 +342,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -352,7 +353,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -386,7 +387,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -397,7 +398,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -This event indicates that the DecisionDevicePnp object is no longer present. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -422,7 +423,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -433,7 +434,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -459,7 +460,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -470,7 +471,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -492,7 +493,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -503,7 +504,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -527,7 +528,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -538,7 +539,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -564,7 +565,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -575,7 +576,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -597,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -608,7 +609,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -619,7 +620,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning -This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. +This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -643,7 +644,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -666,7 +667,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -677,7 +678,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -699,7 +700,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -710,7 +711,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -737,7 +738,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -748,7 +749,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -759,7 +760,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -772,7 +773,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -783,7 +784,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -794,7 +795,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -819,7 +820,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -830,7 +831,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -841,7 +842,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -871,7 +872,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -882,7 +883,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -904,7 +905,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -915,7 +916,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -937,7 +938,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -948,7 +949,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -971,7 +972,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -982,7 +983,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1004,7 +1005,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1015,7 +1016,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1037,7 +1038,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1048,7 +1049,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1070,7 +1071,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1081,7 +1082,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1103,7 +1104,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1114,7 +1115,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1147,7 +1148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1173,7 +1174,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1184,7 +1185,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1248,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1258,7 +1259,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1271,7 +1272,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1281,7 +1282,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1292,19 +1293,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1321,14 +1312,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise System Center Configuration Manager (SCCM) environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Microsoft Endpoint Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier. ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1340,7 +1331,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1355,7 +1346,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1391,7 +1382,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1401,7 +1392,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1424,7 +1415,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1466,7 +1457,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1482,13 +1473,13 @@ The following fields are available: ### Census.Security -Provides information on several important data points about security settings. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1505,7 +1496,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1516,7 +1507,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1526,7 +1517,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1548,7 +1539,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1561,7 +1552,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1574,7 +1565,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1769,7 +1760,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. @@ -1868,7 +1859,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1887,7 +1878,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1906,7 +1897,7 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: @@ -2168,7 +2159,7 @@ The following fields are available: ### ChecksumDictionary -The list of values sent by each object type. +This event provides the list of values sent by each object type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2178,7 +2169,7 @@ The following fields are available: ### COMPID -This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. +This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2188,7 +2179,7 @@ The following fields are available: ### HWID -This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. +This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2198,7 +2189,7 @@ The following fields are available: ### InstallDateArpLastModified -This event indicates the date the add/remove program (ARP) entry was last modified by an update. +This event indicates the date the add/remove program (ARP) entry was last modified by an update. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2208,7 +2199,7 @@ The following fields are available: ### InstallDateFromLinkFile -This event provides the application installation date from the linked file. +This event provides the application installation date from the linked file. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2218,7 +2209,7 @@ The following fields are available: ### InstallDateMsi -The install date from the Microsoft installer (MSI) database. +This event provides the install date from the Microsoft installer (MSI) database. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2228,7 +2219,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2254,7 +2245,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2266,7 +2257,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2283,7 +2274,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2312,31 +2303,31 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2347,7 +2338,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2358,7 +2349,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2382,7 +2373,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2393,7 +2384,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2404,7 +2395,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2433,7 +2424,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2444,7 +2435,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2457,7 +2448,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2468,7 +2459,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2506,6 +2497,7 @@ The following fields are available: - **Manufacturer** The manufacturer of the device. - **MatchingID** The Hardware ID or Compatible ID that Windows uses to install a device instance. - **Model** Identifies the model of the device. +- **objectInstanceId** Deprecated. The Device Instance ID of the device (uniquely identifies a device in the system). Example: pci\ven_8086&dev_0085&subsys_13118086&rev_34\4&2dded11c&0&00e1 - **ParentId** The Device Instance ID of the parent of the device. - **ProblemCode** The error code currently returned by the device, if applicable. - **Provider** Identifies the device provider. @@ -2517,7 +2509,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2528,7 +2520,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2539,19 +2531,19 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2578,7 +2570,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2589,7 +2581,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2600,7 +2592,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2619,7 +2611,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2630,7 +2622,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2639,9 +2631,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2668,7 +2668,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2680,115 +2680,121 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2798,7 +2804,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2810,7 +2816,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2818,7 +2824,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2826,7 +2832,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2834,7 +2840,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### STACKID -This event provides the internal compatible ID for the stack. +This event provides the internal compatible ID for the stack. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2856,7 +2862,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2881,7 +2887,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. +This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2906,15 +2912,21 @@ The following fields are available: ## Migration events +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -2922,7 +2934,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2935,7 +2947,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2947,7 +2959,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2963,7 +2975,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2976,7 +2988,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2986,7 +2998,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OfficeRegistration -This event indicates the status of the OneDrive integration with Microsoft Office. +This event indicates the status of the OneDrive integration with Microsoft Office. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2995,7 +3007,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3005,7 +3017,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.RepairResult -The event determines the result of the installation repair. +The event determines the result of the installation repair. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3014,7 +3026,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult -This event indicates the status when downloading the OneDrive setup file. +This event indicates the status when downloading the OneDrive setup file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3023,7 +3035,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3034,7 +3046,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateTierReg -This event determines status of the update tier registry values. +This event determines status of the update tier registry values. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3044,7 +3056,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3053,7 +3065,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3064,7 +3076,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3077,11 +3089,61 @@ The following fields are available: - **resetSettingsResult** The return code of the action to correct the known issue. +## Quality Update Assistant events + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck + +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Device readiness check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.Download + +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter that indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Download of latest cumulative update payload. + + +### Microsoft.Windows.QualityUpdateAssistant.Install + +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Install of latest cumulative update payload. + + ## Remediation events ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3129,7 +3191,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -3256,7 +3318,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.DiskCleanUnExpectedErrorEvent -This event indicates that an unexpected error occurred during an update and provides information to help address the issue. +This event indicates that an unexpected error occurred during an update and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3270,7 +3332,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Error -This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. +This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3281,7 +3343,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.FallbackError -This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. +This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3291,7 +3353,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationNotifyUserFixIssuesInvokeUIEvent -This event occurs when the Notify User task executes and provides information about the cause of the notification. +This event occurs when the Notify User task executes and provides information about the cause of the notification. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3307,7 +3369,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellFailedAutomaticAppUpdateModifyEventId -This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. +This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3319,7 +3381,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellUnexpectedExceptionId -This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. +This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3331,7 +3393,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationUHEnableServiceFailed -This event tracks the health of key update (Remediation) services and whether they are enabled. +This event tracks the health of key update (Remediation) services and whether they are enabled. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3370,7 +3432,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Started -deny +This event is sent when Windows Update sediment remediations have started on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3440,7 +3502,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. @@ -3461,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DownloadServiceProgress -This event indicates the progress of the downloader in 1% increments. +This event indicates the progress of the downloader in 1% increments. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3562,7 +3624,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3625,7 +3687,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3636,7 +3698,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3650,7 +3712,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3681,7 +3743,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3785,7 +3847,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3801,7 +3863,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3816,7 +3878,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3827,7 +3889,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3836,7 +3898,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3847,7 +3909,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3860,7 +3922,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3885,7 +3947,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3901,7 +3963,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3923,7 +3985,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3934,7 +3996,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3943,7 +4005,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3954,7 +4016,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3967,7 +4029,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4023,7 +4085,7 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: @@ -4058,7 +4120,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4083,7 +4145,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4110,19 +4172,19 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. @@ -4130,7 +4192,7 @@ This event reports the status of an action following a reboot, should one have b ### SoftwareUpdateClientTelemetry.CheckForUpdates -This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4327,7 +4389,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4349,7 +4411,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4454,7 +4516,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.SLSDiscovery -This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. +This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4470,7 +4532,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4485,7 +4547,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -This event identifies whether updates have been tampered with and protects against man-in-the-middle attacks. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4517,7 +4579,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4528,7 +4590,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -4541,7 +4603,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4552,7 +4614,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4563,7 +4625,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4573,7 +4635,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4587,7 +4649,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4600,7 +4662,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4627,7 +4689,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4643,7 +4705,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4661,7 +4723,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4677,7 +4739,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4693,7 +4755,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4708,7 +4770,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4725,7 +4787,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4741,7 +4803,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4772,7 +4834,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4792,7 +4854,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4810,7 +4872,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4826,7 +4888,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4852,13 +4914,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4874,13 +4936,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4909,13 +4971,13 @@ This event indicates whether devices received additional or critical supplementa ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. @@ -4963,7 +5025,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5110,19 +5172,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. @@ -5139,7 +5201,7 @@ The following fields are available: - **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. - **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. - **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. -- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. - **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. - **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). - **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. @@ -5210,7 +5272,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5623,7 +5685,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5648,7 +5710,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5687,7 +5749,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5705,7 +5767,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5737,7 +5799,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5758,7 +5820,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5814,7 +5876,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5838,7 +5900,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5853,7 +5915,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5868,7 +5930,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5883,7 +5945,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5898,7 +5960,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5913,7 +5975,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5928,7 +5990,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5943,7 +6005,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5958,7 +6020,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5968,7 +6030,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5979,7 +6041,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -5998,7 +6060,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6016,7 +6078,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6031,7 +6093,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6048,7 +6110,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6073,7 +6135,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6085,7 +6147,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6097,7 +6159,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event is sent after a Windows update install completes. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6113,7 +6175,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6125,7 +6187,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6134,7 +6196,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6154,7 +6216,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6166,7 +6228,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6178,7 +6240,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6194,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6207,7 +6269,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6222,7 +6284,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6232,7 +6294,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6245,7 +6307,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6281,7 +6343,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6303,7 +6365,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6312,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6330,7 +6392,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot -This event is sent when a toast notification is shown to the user about scheduling a device restart. +This event is sent when a toast notification is shown to the user about scheduling a device restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6339,7 +6401,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6359,7 +6421,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6383,7 +6445,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS Updates. +This event sends data specific to the FixupEditionId mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. @@ -6391,25 +6453,25 @@ This event sends data specific to the FixupEditionId mitigation used for OS Upda ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index ed865d65fb..2be76e6660 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 01/04/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -Invalid Signature - This event is superseded by an event that contains additional fields. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -89,7 +90,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -107,7 +108,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -118,7 +119,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -145,7 +146,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -156,7 +157,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -178,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -189,7 +190,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -211,7 +212,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -222,7 +223,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -244,7 +245,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -255,7 +256,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -277,7 +278,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -288,7 +289,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -310,7 +311,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -321,7 +322,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -361,7 +362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -372,7 +373,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -409,7 +410,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -420,7 +421,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -447,7 +448,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -458,7 +459,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -486,7 +487,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -497,7 +498,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -521,7 +522,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -532,7 +533,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -558,7 +559,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -569,7 +570,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -597,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -608,7 +609,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -633,7 +634,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -644,7 +645,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -669,7 +670,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -698,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -709,7 +710,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -733,7 +734,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -744,7 +745,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -773,7 +774,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -784,7 +785,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -795,7 +796,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -810,7 +811,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -821,7 +822,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -832,7 +833,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -857,7 +858,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -868,7 +869,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -879,7 +880,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -912,7 +913,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -923,7 +924,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -947,7 +948,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -958,7 +959,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -982,7 +983,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -993,7 +994,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1018,7 +1019,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1029,7 +1030,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1053,7 +1054,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1064,7 +1065,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1088,7 +1089,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1099,7 +1100,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1123,7 +1124,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1134,7 +1135,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1158,7 +1159,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1169,7 +1170,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1193,7 +1194,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1204,7 +1205,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1232,7 +1233,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1243,7 +1244,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1306,7 +1307,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1317,7 +1318,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1330,7 +1331,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1348,7 +1349,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1359,19 +1360,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1389,14 +1380,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. -- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1408,7 +1399,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1423,7 +1414,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1464,7 +1455,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1474,7 +1465,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1497,7 +1488,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1539,7 +1530,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1561,7 +1552,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1578,7 +1569,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1595,7 +1586,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1606,7 +1597,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1616,7 +1607,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1637,7 +1628,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1650,7 +1641,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1665,7 +1656,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1866,7 +1857,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilityEnumeration -This event reports on the results of scanning for optional Windows content on Windows Update. +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. The following fields are available: @@ -1888,7 +1879,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -1958,19 +1949,19 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. @@ -2016,6 +2007,25 @@ This event is triggered when UTC determines it needs to send information about p ## DxgKernelTelemetry events +### DxgKrnlTelemetry.BddDiag + +This event records Microsoft basic display driver diagnostic information. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BiosFlags** Bitwise flags that contain graphics related firmware information on the device such as the system was booted with display or not, system was using VBIOS or UEFI GOP, and VBIOS has a valid display mode list or not. +- **CurrentMode** Information about the current display mode such as the resolution, rotation, and scaling. +- **DefaultModeReason** Numeric value indicating the reason that the Microsoft Basic Display Driver is in use. +- **DefaultModeResolution** Default resolution that Microsoft Basic Display Driver detected. +- **DefaultResolutionProvider** Numeric value indicating the source of the default resolution. +- **Flags** Bitwise flags containing Microsoft Basic Display Driver related information such as if it is running because there is no graphics driver or user PnP stopped the graphics driver, it has valid EDID or not on the connected monitor and where the EDID was from, it is running at gray scale mode or not, it is running without display or not. +- **HeadlessReason** Numeric value indicating why there is no display. +- **LogAssertionCount** Number of assertions that were encountered before this event was recorded. +- **LogErrorCount** Number of errors that were encountered before this event was recorded. +- **MonitorPowerState** Current power state of the monitor. +- **Version** Version of the schema for this event. + + ### DxgKrnlTelemetry.GPUAdapterInventoryV2 This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date. @@ -2169,7 +2179,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2179,7 +2189,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2223,7 +2233,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2250,7 +2260,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2260,7 +2270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2289,7 +2299,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2301,7 +2311,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2312,7 +2322,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2326,7 +2336,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2337,7 +2347,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2348,7 +2358,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2359,7 +2369,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2383,7 +2393,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2394,7 +2404,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2405,7 +2415,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2435,7 +2445,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2446,7 +2456,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2459,7 +2469,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2470,7 +2480,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2520,7 +2530,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2531,7 +2541,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2542,7 +2552,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2555,7 +2565,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2566,7 +2576,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2593,7 +2603,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2604,7 +2614,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2615,7 +2625,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2635,7 +2645,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2646,7 +2656,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2655,9 +2665,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2684,7 +2702,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2696,7 +2714,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2730,7 +2748,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2738,7 +2756,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2749,7 +2767,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -This event provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2767,7 +2785,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2778,7 +2796,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -This event includes the Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2804,7 +2822,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2815,7 +2833,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -Provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2830,7 +2848,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2838,7 +2856,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2849,7 +2867,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -This event list all installed Office products +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2864,7 +2882,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2875,7 +2893,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2889,7 +2907,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2900,7 +2918,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2931,7 +2949,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2939,7 +2957,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2950,7 +2968,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2958,7 +2976,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2969,7 +2987,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2980,7 +2998,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2995,7 +3013,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3003,7 +3021,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3011,7 +3029,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3021,7 +3039,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3032,7 +3050,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3040,7 +3058,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3060,7 +3078,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3087,19 +3105,19 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -3107,7 +3125,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3120,7 +3138,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3132,7 +3150,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3148,7 +3166,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3161,7 +3179,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3171,7 +3189,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3181,7 +3199,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3192,7 +3210,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3201,7 +3219,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3212,7 +3230,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3225,11 +3243,61 @@ The following fields are available: - **resetSettingsResult** The return code of the action to correct the known issue. +## Quality Update Assistant events + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck + +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Device readiness check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.Download + +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter that indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Download of latest cumulative update payload. + + +### Microsoft.Windows.QualityUpdateAssistant.Install + +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Install of latest cumulative update payload. + + ## Remediation events ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3276,7 +3344,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -3312,7 +3380,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -3449,7 +3517,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -3480,7 +3548,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3544,7 +3612,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3607,7 +3675,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3618,7 +3686,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3632,7 +3700,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3733,7 +3801,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3749,7 +3817,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3764,7 +3832,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -Error occurred during execution of the plugin. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3775,7 +3843,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3785,7 +3853,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3796,7 +3864,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3809,7 +3877,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3834,7 +3902,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3850,7 +3918,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3872,7 +3940,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3883,7 +3951,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3893,7 +3961,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3904,7 +3972,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3917,7 +3985,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3970,7 +4038,7 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: @@ -4006,7 +4074,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4031,7 +4099,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4058,7 +4126,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4076,7 +4144,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4092,7 +4160,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4107,7 +4175,7 @@ The following fields are available: ### SIHEngineTelemetry.ServiceStateChange -This event reports the status of attempts to stop or start a service as part of executing an action. +This event reports the status of attempts to stop or start a service as part of executing an action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4124,7 +4192,7 @@ The following fields are available: ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4141,7 +4209,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4224,7 +4292,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -4255,7 +4323,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -4332,7 +4400,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4354,7 +4422,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4454,7 +4522,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4469,7 +4537,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4501,7 +4569,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4512,7 +4580,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -4525,7 +4593,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4537,7 +4605,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4548,7 +4616,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4558,7 +4626,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4572,7 +4640,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4586,7 +4654,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4613,7 +4681,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4629,7 +4697,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4647,7 +4715,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4663,7 +4731,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4679,7 +4747,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4694,7 +4762,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4711,7 +4779,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4727,7 +4795,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4759,7 +4827,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4779,7 +4847,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4795,7 +4863,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4813,7 +4881,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4829,7 +4897,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4845,7 +4913,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4871,7 +4939,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4891,7 +4959,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4907,7 +4975,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4925,7 +4993,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4942,7 +5010,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4965,7 +5033,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5012,7 +5080,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5028,7 +5096,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5044,7 +5112,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5061,7 +5129,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5077,7 +5145,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5102,13 +5170,13 @@ This event indicates whether devices received additional or critical supplementa ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. @@ -5156,7 +5224,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5304,19 +5372,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5356,16 +5424,25 @@ The following fields are available: ### Microsoft.Windows.WaaSAssessment.Error -This event returns the name of the missing setting needed to determine the Operating System build age. +This event returns the name of the missing setting needed to determine the Operating System build age. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **m** The WaaS (“Workspace as a Service”—cloud-based “workspace”) Assessment Error String. +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. + + ### Microsoft.Windows.WaaSMedic.RemediationFailed -This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5377,7 +5454,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.Summary -This event provides the results of the WaaSMedic diagnostic run +This event provides the results of the WaaSMedic diagnostic run. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5396,7 +5473,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.SummaryEvent -This event provides the results from the WaaSMedic engine +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5438,7 +5515,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5832,7 +5909,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5865,7 +5942,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5913,7 +5990,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5933,7 +6010,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5970,7 +6047,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5993,7 +6070,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6009,7 +6086,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6025,7 +6102,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6052,7 +6129,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6070,7 +6147,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6086,7 +6163,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6101,49 +6178,49 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -6161,25 +6238,25 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot -This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6189,7 +6266,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6201,7 +6278,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -6220,7 +6297,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6236,7 +6313,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6253,7 +6330,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6269,7 +6346,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6280,7 +6357,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6297,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6322,7 +6399,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6335,7 +6412,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6347,7 +6424,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event is sent after a Windows update install completes. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6364,13 +6441,13 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6379,7 +6456,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6398,7 +6475,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6410,7 +6487,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6420,7 +6497,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6434,9 +6511,20 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event indicates the data sent when the device pauses an in-progress update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6449,7 +6537,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6464,7 +6552,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6474,7 +6562,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6516,7 +6604,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6530,9 +6618,21 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event indicates that USO determined UUP needs to fall back. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6554,7 +6654,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6563,7 +6663,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6572,7 +6672,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6591,13 +6691,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6607,7 +6707,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6628,7 +6728,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6654,25 +6754,25 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 03ef97ffb8..b9030aba9a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 01/04/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -123,7 +124,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -141,7 +142,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -152,7 +153,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -179,7 +180,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -190,7 +191,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -212,7 +213,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -223,7 +224,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -245,7 +246,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -256,7 +257,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -278,7 +279,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -289,7 +290,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -311,7 +312,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -322,7 +323,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -344,7 +345,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -355,7 +356,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -396,7 +397,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -407,7 +408,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -445,7 +446,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -456,7 +457,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -484,7 +485,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -495,7 +496,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -523,7 +524,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -534,7 +535,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +560,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -570,7 +571,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -596,7 +597,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -607,7 +608,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -635,7 +636,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -646,7 +647,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -671,7 +672,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -682,7 +683,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -707,7 +708,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -736,7 +737,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -747,7 +748,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -771,7 +772,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -782,7 +783,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -811,7 +812,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -822,7 +823,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -833,7 +834,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -848,7 +849,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -859,7 +860,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -870,7 +871,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -895,7 +896,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -906,7 +907,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -917,7 +918,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -949,7 +950,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -960,7 +961,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -984,7 +985,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -995,7 +996,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1019,7 +1020,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1030,7 +1031,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1055,7 +1056,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1066,7 +1067,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1090,7 +1091,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1101,7 +1102,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1125,7 +1126,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1160,7 +1161,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1171,7 +1172,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1195,7 +1196,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1206,7 +1207,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1230,13 +1231,13 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusEndSync -This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. +This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. The data collected with this event is used to help keep Windows up to date. ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1248,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1275,7 +1276,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1286,7 +1287,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1351,7 +1352,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1362,7 +1363,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1375,7 +1376,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1393,7 +1394,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1405,7 +1406,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1416,19 +1417,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1447,14 +1438,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1466,7 +1457,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1481,7 +1472,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1522,7 +1513,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1532,7 +1523,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1555,7 +1546,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1597,7 +1588,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1641,7 +1632,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1664,7 +1655,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1682,7 +1673,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1699,7 +1690,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1710,7 +1701,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1720,7 +1711,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1741,7 +1732,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1754,7 +1745,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1798,7 +1789,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1813,7 +1804,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2030,7 +2021,7 @@ The following fields are available: ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2044,7 +2035,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilityEnumeration -This event reports on the results of scanning for optional Windows content on Windows Update. +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. The following fields are available: @@ -2066,7 +2057,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2193,7 +2184,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2207,7 +2198,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Initialize -This event indicates that the Deployment 360 APIs have been initialized for use. +This event indicates that the Deployment 360 APIs have been initialized for use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2220,7 +2211,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2233,7 +2224,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2247,7 +2238,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2261,7 +2252,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2280,7 +2271,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2312,6 +2303,21 @@ The following fields are available: - **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. +### TelClientSynthetic.ConnectivityHeartBeat_0 + +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. + +The following fields are available: + +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** The network state of the device. +- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period. +- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. + + ### TelClientSynthetic.HeartBeat_5 This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device. @@ -2402,7 +2408,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -This event indicates that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2415,7 +2421,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2428,7 +2434,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2441,7 +2447,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2453,7 +2459,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2466,7 +2472,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2478,7 +2484,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2491,7 +2497,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2504,7 +2510,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2516,7 +2522,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2529,7 +2535,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2541,7 +2547,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2554,7 +2560,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2566,7 +2572,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2579,7 +2585,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2592,7 +2598,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2604,7 +2610,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2630,7 +2636,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2655,7 +2661,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2668,7 +2674,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2681,7 +2687,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2693,7 +2699,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2707,7 +2713,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2720,7 +2726,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2733,7 +2739,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2747,7 +2753,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2760,7 +2766,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2773,7 +2779,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2787,7 +2793,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2800,7 +2806,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabAlreadyDownloaded -This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. +This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2812,7 +2818,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2826,7 +2832,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2838,7 +2844,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2851,7 +2857,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2863,7 +2869,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2877,7 +2883,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2890,7 +2896,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2903,7 +2909,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2915,7 +2921,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadyGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2928,7 +2934,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2940,7 +2946,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2953,7 +2959,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3127,7 +3133,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3137,7 +3143,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3179,7 +3185,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3213,7 +3219,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3223,7 +3229,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3252,7 +3258,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3264,7 +3270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3275,7 +3281,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3288,7 +3294,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3299,7 +3305,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3310,7 +3316,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3321,7 +3327,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3345,7 +3351,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3356,7 +3362,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3367,7 +3373,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3397,7 +3403,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3408,7 +3414,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3421,7 +3427,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3432,7 +3438,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3482,7 +3488,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3493,7 +3499,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3504,7 +3510,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3517,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3528,7 +3534,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3555,7 +3561,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3566,7 +3572,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3577,7 +3583,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3597,7 +3603,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3608,7 +3614,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3617,9 +3623,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3649,7 +3663,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3661,9 +3675,17 @@ The following fields are available: - **StartTime** UTC date and time at which this event was sent. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3696,7 +3718,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3707,7 +3729,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3718,7 +3740,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3736,7 +3758,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3747,7 +3769,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3773,7 +3795,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3784,7 +3806,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3799,7 +3821,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3810,7 +3832,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3821,7 +3843,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3836,7 +3858,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3847,7 +3869,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3861,7 +3883,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3872,7 +3894,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3904,7 +3926,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3912,7 +3934,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3923,7 +3945,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3931,7 +3953,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3942,7 +3964,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3953,7 +3975,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3968,7 +3990,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3976,7 +3998,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3984,7 +4006,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3994,7 +4016,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4005,7 +4027,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4013,7 +4035,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4033,7 +4055,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4062,7 +4084,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event indicates an OS state change. +This event indicates an OS state change. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4091,71 +4113,71 @@ The following fields are available: ### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. ### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. ### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. ### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config @@ -4164,51 +4186,151 @@ This config event sends basic device connectivity and configuration information The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: -- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''. -- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. -- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). -- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). -- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. -- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. -- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. -- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. -- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). -- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. - **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. -- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. - **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. - **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. - **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. - **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. - **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. - **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. -- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." +- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. +- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). +- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. - **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. - **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). @@ -4217,15 +4339,14 @@ The following fields are available: - **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. - **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. -- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. -- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. - **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. - **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. - **appVersion** The version of the product install. Default: '0.0.0.0'. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **eventType** A string representation of appPingEventEventType indicating the type of the event. -- **hwHasAvx** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. @@ -4246,53 +4367,30 @@ The following fields are available: - **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. - **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. - **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. -- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. -- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. - - -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -4300,7 +4398,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4375,7 +4473,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4388,7 +4486,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4400,7 +4498,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4416,7 +4514,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4429,7 +4527,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4439,7 +4537,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4449,7 +4547,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4460,7 +4558,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4469,7 +4567,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4480,7 +4578,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4492,7 +4590,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentPrep -This event is used to determine whether the user needs to see the privacy consent experience or not. +This event is used to determine whether the user needs to see the privacy consent experience or not. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4502,7 +4600,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4515,7 +4613,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.wilActivity -This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. +This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4539,7 +4637,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4552,11 +4650,61 @@ The following fields are available: - **resetSettingsResult** The return code of the action to correct the known issue. +## Quality Update Assistant events + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck + +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Device readiness check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.Download + +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Download of latest cumulative update payload. + + +### Microsoft.Windows.QualityUpdateAssistant.Install + +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **PackageVersion** Current package version of quality update assistant. +- **Result** Install of latest cumulative update payload. + + ## Remediation events ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -4604,7 +4752,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -4640,7 +4788,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -4781,7 +4929,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -4813,7 +4961,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4882,7 +5030,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4945,7 +5093,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4956,7 +5104,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5030,7 +5178,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5046,7 +5194,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5061,7 +5209,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5074,7 +5222,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5090,7 +5238,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5112,7 +5260,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5153,7 +5301,7 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: @@ -5189,7 +5337,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5214,7 +5362,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5239,15 +5387,45 @@ The following fields are available: ## SIH events +### SIHEngineTelemetry.EvalApplicability + +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ActionReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **AdditionalReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **CachedEngineVersion** The engine DLL version that is being used. +- **EventInstanceID** A unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **HandlerReasons** If an action has been assessed as inapplicable, the installer technology-specific logic prevented it. +- **IsExecutingAction** If the action is presently being executed. +- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). +- **SihclientVersion** The client version that is being used. +- **StandardReasons** If an action has been assessed as inapplicable, the standard logic the prevented it. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateID** A unique identifier for the action being acted upon. +- **WuapiVersion** The Windows Update API version that is currently installed. +- **WuaucltVersion** The Windows Update client version that is currently installed. +- **WuauengVersion** The Windows Update engine version that is currently installed. +- **WUDeviceID** The unique identifier controlled by the software distribution client. + + ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. + + + +### SIHEngineTelemetry.PostRebootReport + +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5268,7 +5446,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5351,7 +5529,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5381,7 +5559,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5455,7 +5633,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5477,7 +5655,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5573,7 +5751,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5588,7 +5766,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5621,7 +5799,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5632,7 +5810,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -5645,7 +5823,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5656,7 +5834,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5668,7 +5846,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5678,7 +5856,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5691,7 +5869,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5704,7 +5882,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5721,7 +5899,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5737,7 +5915,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5769,7 +5947,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5789,7 +5967,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5805,7 +5983,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5823,7 +6001,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5841,7 +6019,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5857,7 +6035,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5883,7 +6061,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5903,7 +6081,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5919,7 +6097,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5937,7 +6115,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5953,13 +6131,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5982,7 +6160,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6029,7 +6207,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6045,7 +6223,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6061,7 +6239,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6078,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6094,7 +6272,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6127,7 +6305,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6137,7 +6315,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6195,7 +6373,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6359,7 +6537,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6384,7 +6562,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6403,7 +6581,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6442,9 +6620,45 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6497,7 +6711,7 @@ The following fields are available: ### Microsoft.Windows.WER.MTT.Value -This event is used for differential privacy. +This event is used for differential privacy to help keep Windows up to date. The following fields are available: @@ -6903,7 +7117,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6918,7 +7132,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6932,19 +7146,19 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureSucceeded -This event sends basic telemetry on the success of the rollback of feature updates. +This event sends basic telemetry on the success of the rollback of feature updates. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed -This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6959,7 +7173,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable -This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6973,13 +7187,13 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted -This event indicates that the Quality Rollback process has started. +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded -This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. @@ -6987,7 +7201,7 @@ This event sends basic telemetry on the success of the rollback of the Quality/L ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7019,7 +7233,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7068,7 +7282,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7088,7 +7302,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7127,7 +7341,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7149,7 +7363,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7165,7 +7379,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7189,7 +7403,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7205,7 +7419,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7232,7 +7446,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7250,7 +7464,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7266,7 +7480,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7281,7 +7495,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7307,7 +7521,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7323,7 +7537,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7339,7 +7553,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7355,7 +7569,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7371,7 +7585,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7387,7 +7601,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7403,7 +7617,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7419,7 +7633,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7435,7 +7649,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7457,7 +7671,7 @@ This event is sent when a second reminder dialog is displayed during Enhanced En ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7476,7 +7690,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7487,7 +7701,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7500,7 +7714,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7513,7 +7727,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7523,7 +7737,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7542,7 +7756,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -7564,7 +7778,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DetectionResult -This event runs when an update is detected. This helps ensure Windows is kept up to date. +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. The following fields are available: @@ -7577,7 +7791,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7593,7 +7807,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -7610,7 +7824,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7619,7 +7833,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7628,7 +7842,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7639,7 +7853,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Escalation -This event is sent when USO takes an Escalation action on a device. +This event is sent when USO takes an Escalation action on a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7652,7 +7866,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7669,7 +7883,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationsRefreshFailed -USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. +USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7680,7 +7894,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7696,7 +7910,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7707,7 +7921,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -7724,7 +7938,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -7749,7 +7963,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7762,7 +7976,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -7772,9 +7986,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data to device when Oobe Update download is in progress. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An update ID. +- **updateScenarioType** A type of update scenario. +- **wuDeviceid** A device ID associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event is sent after a Windows update install completes. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -7791,7 +8018,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7803,7 +8030,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7812,7 +8039,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Progress -This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. +This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7830,7 +8057,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -7849,7 +8076,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -7861,7 +8088,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -7871,7 +8098,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7889,7 +8116,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -7902,7 +8129,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -7915,7 +8142,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -7931,7 +8158,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7943,7 +8170,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7953,9 +8180,20 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event sends data when a device pauses an in-progress update, to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -7968,7 +8206,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -7983,7 +8221,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7993,7 +8231,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -8029,9 +8267,21 @@ The following fields are available: - **wuDeviceid** Unique ID for Device +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event sends data when UUP needs to fall back, to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8053,7 +8303,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8062,7 +8312,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8071,7 +8321,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8090,13 +8340,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8106,7 +8356,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8127,7 +8377,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8151,7 +8401,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8173,7 +8423,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8198,37 +8448,37 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 0b9b110957..792337ed12 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -1,5 +1,5 @@ --- -description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. +description: Use this article to learn more about what Windows 10 version 1809 diagnostic data is gathered at the basic level. title: Windows 10, version 1809 basic diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 01/04/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -303,7 +303,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -577,7 +577,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -595,7 +595,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -606,7 +606,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -638,7 +638,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -649,7 +649,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -671,7 +671,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -682,7 +682,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -705,7 +705,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -716,7 +716,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -738,7 +738,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -749,7 +749,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -771,7 +771,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -782,7 +782,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -804,7 +804,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -815,7 +815,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -856,7 +856,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -867,7 +867,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -905,7 +905,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -916,7 +916,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -945,7 +945,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -956,7 +956,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -986,7 +986,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -997,7 +997,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1022,7 +1022,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1033,7 +1033,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1059,7 +1059,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1070,7 +1070,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1098,7 +1098,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1109,7 +1109,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1134,7 +1134,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1145,7 +1145,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1170,7 +1170,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1199,7 +1199,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1210,7 +1210,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1234,7 +1234,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1245,7 +1245,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1274,7 +1274,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1285,7 +1285,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1296,7 +1296,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1315,7 +1315,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1326,7 +1326,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1337,7 +1337,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1362,7 +1362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1373,7 +1373,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1384,7 +1384,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1418,7 +1418,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1429,7 +1429,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1453,7 +1453,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1464,7 +1464,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1488,7 +1488,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1499,7 +1499,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1524,7 +1524,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1535,7 +1535,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1559,7 +1559,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1570,7 +1570,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1594,7 +1594,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1605,7 +1605,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1629,7 +1629,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1640,7 +1640,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1664,7 +1664,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1675,7 +1675,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1699,7 +1699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1710,7 +1710,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1738,7 +1738,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1749,7 +1749,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1816,7 +1816,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1827,7 +1827,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1838,9 +1838,41 @@ The following fields are available: ## Audio endpoint events +### MicArrayGeometry + +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **MicCoords** The location and orientation of the microphone element. See [MicCoords](#miccoords). +- **usFrequencyBandHi** The high end of the frequency range for the microphone. +- **usFrequencyBandLo** The low end of the frequency range for the microphone. +- **usMicArrayType** The type of the microphone array. +- **usNumberOfMicrophones** The number of microphones in the array. +- **usVersion** The version of the microphone array specification. +- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). +- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). +- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). +- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). + + +### MicCoords + +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **usType** The type of microphone. +- **wHorizontalAngle** The horizontal angle of the microphone (reported as radians times 10,000). +- **wVerticalAngle** The vertical angle of the microphone (reported as radians times 10,000). +- **wXCoord** The x-coordinate of the microphone. +- **wYCoord** The y-coordinate of the microphone. +- **wZCoord** The z-coordinate of the microphone. + + ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1860,28 +1892,12 @@ The following fields are available: - **MicArrayGeometry** Describes the microphone array, including the microphone position, coordinates, type, and frequency range. See [MicArrayGeometry](#micarraygeometry). - **persistentId** A unique ID for this endpoint which is retained across migrations. -### MicArrayGeometry - -This event provides information about the layout of the individual microphone elements in the microphone array. - -The following fields are available: - -- **MicCoords** The location and orientation of the microphone element. -- **usFrequencyBandHi** The high end of the frequency range for the microphone. -- **usFrequencyBandLo** The low end of the frequency range for the microphone. -- **usMicArrayType** The type of the microphone array. -- **usNumberOfMicrophones** The number of microphones in the array. -- **usVersion** The version of the microphone array specification. -- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). -- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). -- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). -- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). ## Census events ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1899,7 +1915,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1910,7 +1926,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1921,19 +1937,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1952,14 +1958,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1971,7 +1977,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1986,7 +1992,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2029,7 +2035,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2039,7 +2045,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2062,7 +2068,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2104,7 +2110,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2150,7 +2156,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2173,7 +2179,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2191,7 +2197,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2210,7 +2216,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2222,7 +2228,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2235,7 +2241,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2256,7 +2262,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2269,7 +2275,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2315,7 +2321,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2331,7 +2337,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2528,8 +2534,7 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. - -## Common data fields +## Common Data Fields ### Ms.Device.DeviceInventoryChange @@ -2537,18 +2542,17 @@ Describes the installation state for all hardware and software components availa The following fields are available: -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. - +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Compatibility events ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2562,7 +2566,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilityEnumeration -This event reports on the results of scanning for optional Windows content on Windows Update. +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. The following fields are available: @@ -2584,7 +2588,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2721,7 +2725,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2735,7 +2739,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2748,7 +2752,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2762,7 +2766,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2774,9 +2778,78 @@ The following fields are available: ## Diagnostic data events +### TelClientSynthetic.AbnormalShutdown_0 + +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **AbnormalShutdownBootId** BootId of the abnormal shutdown being reported by this event. +- **AcDcStateAtLastShutdown** Identifies if the device was on battery or plugged in. +- **BatteryLevelAtLastShutdown** The last recorded battery level. +- **BatteryPercentageAtLastShutdown** The battery percentage at the last shutdown. +- **CrashDumpEnabled** Indicates whether crash dumps are enabled. +- **CumulativeCrashCount** Cumulative count of operating system crashes since the BootId reset. +- **CurrentBootId** BootId at the time the abnormal shutdown event was being reported. +- **Firmwaredata->ResetReasonEmbeddedController** The reset reason that was supplied by the firmware. +- **Firmwaredata->ResetReasonEmbeddedControllerAdditional** Additional data related to reset reason provided by the firmware. +- **Firmwaredata->ResetReasonPch** The reset reason that was supplied by the hardware. +- **Firmwaredata->ResetReasonPchAdditional** Additional data related to the reset reason supplied by the hardware. +- **Firmwaredata->ResetReasonSupplied** Indicates whether the firmware supplied any reset reason or not. +- **FirmwareType** ID of the FirmwareType as enumerated in DimFirmwareType. +- **HardwareWatchdogTimerGeneratedLastReset** Indicates whether the hardware watchdog timer caused the last reset. +- **HardwareWatchdogTimerPresent** Indicates whether hardware watchdog timer was present or not. +- **LastBugCheckBootId** bootId of the last captured crash. +- **LastBugCheckCode** Code that indicates the type of error. +- **LastBugCheckContextFlags** Additional crash dump settings. +- **LastBugCheckOriginalDumpType** The type of crash dump the system intended to save. +- **LastBugCheckOtherSettings** Other crash dump settings. +- **LastBugCheckParameter1** The first parameter with additional info on the type of the error. +- **LastBugCheckProgress** Progress towards writing out the last crash dump. +- **LastBugCheckVersion** The version of the information struct written during the crash. +- **LastSuccessfullyShutdownBootId** BootId of the last fully successful shutdown. +- **LongPowerButtonPressDetected** Identifies if the user was pressing and holding power button. +- **OOBEInProgress** Identifies if the Out-Of-Box-Experience is running. +- **OSSetupInProgress** Identifies if the operating system setup is running. +- **PowerButtonCumulativePressCount** Indicates the number of times the power button has been pressed ("pressed" not to be confused with "released"). +- **PowerButtonCumulativeReleaseCount** Indicates the number of times the power button has been released ("released" not to be confused with "pressed"). +- **PowerButtonErrorCount** Indicates the number of times there was an error attempting to record Power Button metrics (e.g.: due to a failure to lock/update the bootstat file). +- **PowerButtonLastPressBootId** BootId of the last time the Power Button was detected to have been pressed ("pressed" not to be confused with "released"). +- **PowerButtonLastPressTime** Date/time of the last time the Power Button was pressed ("pressed" not to be confused with "released"). +- **PowerButtonLastReleaseBootId** The Boot ID of the last time the Power Button was released ("released" not to be confused with "pressed"). +- **PowerButtonLastReleaseTime** The date and time the Power Button was most recently released ("released" not to be confused with "pressed"). +- **PowerButtonPressCurrentCsPhase** Represents the phase of Connected Standby exit when the power button was pressed. +- **PowerButtonPressIsShutdownInProgress** Indicates whether a system shutdown was in progress at the last time the power button was pressed. +- **PowerButtonPressLastPowerWatchdogStage** The last stage completed when the Power Button was most recently pressed. +- **PowerButtonPressPowerWatchdogArmed** Indicates whether or not the watchdog for the monitor was active at the time of the last power button press. +- **ShutdownDeviceType** Identifies who triggered a shutdown. Is it because of battery, thermal zones, or through a Kernel API. +- **SleepCheckpoint** Provides the last checkpoint when there is a failure during a sleep transition. +- **SleepCheckpointSource** Indicates whether the source is the EFI variable or bootstat file. +- **SleepCheckpointStatus** Indicates whether the checkpoint information is valid. +- **StaleBootStatData** Identifies if the data from bootstat is stale. +- **TransitionInfoBootId** The Boot ID of the captured transition information. +- **TransitionInfoCSCount** The total number of times the system transitioned from "Connected Standby" mode to "On" when the last marker was saved. +- **TransitionInfoCSEntryReason** Indicates the reason the device last entered "Connected Standby" mode ("entered" not to be confused with "exited"). +- **TransitionInfoCSExitReason** Indicates the reason the device last exited "Connected Standby" mode ("exited" not to be confused with "entered"). +- **TransitionInfoCSInProgress** Indicates whether the system was in or entering Connected Standby mode when the last marker was saved. +- **TransitionInfoLastReferenceTimeChecksum** The checksum of TransitionInfoLastReferenceTimestamp. +- **TransitionInfoLastReferenceTimestamp** The date and time that the marker was last saved. +- **TransitionInfoLidState** Describes the state of the laptop lid. +- **TransitionInfoPowerButtonTimestamp** The most recent date and time when the Power Button was pressed (collected via a different mechanism than PowerButtonLastPressTime). +- **TransitionInfoSleepInProgress** Indicates whether the system was in or entering Sleep mode when the last marker was saved. +- **TransitionInfoSleepTranstionsToOn** The total number of times the system transitioned from Sleep mode to on, when the last marker was saved. +- **TransitionInfoSystemRunning** Indicates whether the system was running when the last marker was saved. +- **TransitionInfoSystemShutdownInProgress** Indicates whether a device shutdown was in progress when the power button was pressed. +- **TransitionInfoUserShutdownInProgress** Indicates whether a user shutdown was in progress when the power button was pressed. +- **TransitionLatestCheckpointId** Represents a unique identifier for a checkpoint during the device state transition. +- **TransitionLatestCheckpointSeqNumber** Represents the chronological sequence number of the checkpoint. +- **TransitionLatestCheckpointType** Represents the type of the checkpoint, which can be the start of a phase, end of a phase, or just informational. +- **VirtualMachineId** If the operating system is on a virtual Machine, it gives the virtual Machine ID (GUID) that can be used to correlate events on the host. + + ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2795,7 +2868,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2814,15 +2887,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -2978,7 +3051,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -Event to indicate that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2994,7 +3067,7 @@ The following fields are available: - **IsDeviceNetworkMetered** Indicates whether the device is connected to a metered network. - **IsDeviceOobeBlocked** Indicates whether user approval is required to install updates on the device. - **IsDeviceRequireUpdateApproval** Indicates whether user approval is required to install updates on the device. -- **IsDeviceSccmManaged** Indicates whether the device is running the Configuration Manager client to keep the operating system and applications up to date. +- **IsDeviceSccmManaged** Indicates whether the device is running the Microsoft SCCM (System Center Configuration Manager) to keep the operating system and applications up to date. - **IsDeviceUninstallActive** Indicates whether the OS (operating system) on the device was recently updated. - **IsDeviceUpdateNotificationLevel** Indicates whether the device has a set policy to control update notifications. - **IsDeviceUpdateServiceManaged** Indicates whether the device uses WSUS (Windows Server Update Services). @@ -3005,7 +3078,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3018,7 +3091,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3031,7 +3104,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3043,7 +3116,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3056,7 +3129,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3068,7 +3141,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3081,7 +3154,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3094,7 +3167,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3106,7 +3179,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3119,7 +3192,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3131,7 +3204,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3144,7 +3217,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3156,7 +3229,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3169,7 +3242,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3182,7 +3255,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3194,7 +3267,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3207,7 +3280,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3219,7 +3292,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3232,7 +3305,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3245,7 +3318,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3257,7 +3330,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3271,7 +3344,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3284,7 +3357,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3297,7 +3370,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3311,7 +3384,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3324,7 +3397,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3338,7 +3411,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3351,7 +3424,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3365,7 +3438,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3377,7 +3450,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3390,7 +3463,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3402,7 +3475,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3416,7 +3489,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3429,7 +3502,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3442,7 +3515,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3454,7 +3527,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3466,7 +3539,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3479,7 +3552,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3491,9 +3564,83 @@ The following fields are available: ## DISM events +### Microsoft.Windows.StartRep.DISMLatesInstalledLCU + +This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM + + +### Microsoft.Windows.StartRep.DISMPendingInstall + +This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRep.DISMRevertPendingActions + +This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The result from the operation to revert pending packages. + + +### Microsoft.Windows.StartRep.DISMUninstallLCU + +This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is being reported by DISM. + + +### Microsoft.Windows.StartRep.SRTRepairActionEnd + +This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is reported. +- **SRTRepairAction** The action that was taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRepairActionStart + +This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRepairAction** The action that is being taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd + +This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The final result code for the root cause operation. +- **SRTRootCauseDiag** The name of the root cause operation that ran. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagStart + +This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRootCauseDiag** The name of a specific diagnostic. + + ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU -The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3502,16 +3649,49 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMPendingInstall -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **dismPendingInstallPackageName** The name of the pending package. +### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd + +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **failedUninstallCount** The number of driver updates that failed to uninstall. +- **failedUninstallFlightIds** The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRepairAction** The scenario name for a repair. +- **successfulUninstallCount** The number of successfully uninstalled driver updates. +- **successfulUninstallFlightIds** The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionStart + +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRepairAction** The scenario name for a repair. + + ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd -The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3523,7 +3703,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart -The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3534,7 +3714,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3588,7 +3768,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3607,7 +3787,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3642,26 +3822,27 @@ The following fields are available: - **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload. - **DDIInterfaceVersion** The device driver interface version. - **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes). +- **DedicatedVideoMemo** Amount of dedicated video memory in bytes. - **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes). - **DisplayAdapterLuid** The display adapter LUID. - **DriverDate** The date of the display driver. - **DriverRank** The rank of the display driver. - **DriverVersion** The display driver version. -- **DriverWorkarounds** Bitfield data for specific driver workarounds enabled for this device. -- **DriverWorkarounds.Length** The length of the DriverWorkarounds bitfield. +- **DriverWorkarounds** Numeric value indicating the driver workarounds that are enabled for this device. - **DX10UMDFilePath** The file path to the location of the DirectX 10 Display User Mode Driver in the Driver Store. - **DX11UMDFilePath** The file path to the location of the DirectX 11 Display User Mode Driver in the Driver Store. +- **DX12U** File path to the location of the DirectX 12 Display User Mode Driver in the Driver Store. - **DX12UMDFilePath** The file path to the location of the DirectX 12 Display User Mode Driver in the Driver Store. - **DX9UMDFilePath** The file path to the location of the DirectX 9 Display User Mode Driver in the Driver Store. - **GPUDeviceID** The GPU device ID. - **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload. - **GPURevisionID** The GPU revision ID. - **GPUVendorID** The GPU vendor ID. -- **InterfaceFuncPointersProvided1** The number of device driver interface function pointers provided. -- **InterfaceFuncPointersProvided2** The number of device driver interface function pointers provided. +- **InterfaceFuncPointersProvided1** Number of device driver interface function pointers provided. +- **InterfaceFuncPointersProvided2** Number of device driver interface function pointers provided. - **InterfaceId** The GPU interface ID. - **IsDisplayDevice** Does the GPU have displaying capabilities? -- **IsHwSchEnabled** Indicates whether Hardware Scheduling is enabled. +- **IsHwSchEnabled** Boolean value indicating whether hardware scheduling is enabled. - **IsHwSchSupported** Indicates whether the adapter supports hardware scheduling. - **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device? - **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device? @@ -3798,7 +3979,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3840,7 +4021,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3893,7 +4074,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3901,9 +4082,27 @@ The following fields are available: - **devinv** The file version of the Device inventory component. +### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd + +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **CatalogSigners** Signers from catalog. Each signer starts with Chain. +- **DigestAlgorithm** The pseudonymizing (hashing) algorithm used when the file or package was signed. +- **DriverPackageStrongName** Optional. Available only if FileSigningInfo is collected on a driver package. +- **EmbeddedSigners** Embedded signers. Each signer starts with Chain. +- **FileName** The file name of the file whose signatures are listed. +- **FileType** Either exe or sys, depending on if a driver package or application executable. +- **InventoryVersion** The version of the inventory file generating the events. +- **Thumbprint** Comma separated hash of the leaf node of each signer. Semicolon is used to separate CatalogSigners from EmbeddedSigners. There will always be a trailing comma. + + ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3932,7 +4131,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3944,7 +4143,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3955,7 +4154,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3968,7 +4167,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3979,7 +4178,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3990,7 +4189,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4001,7 +4200,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4025,7 +4224,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4036,7 +4235,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4047,7 +4246,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4077,7 +4276,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4088,7 +4287,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4103,7 +4302,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4114,7 +4313,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4170,7 +4369,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4181,7 +4380,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4192,7 +4391,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4205,7 +4404,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4216,7 +4415,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4243,7 +4442,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4254,7 +4453,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4265,7 +4464,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4276,16 +4475,18 @@ The following fields are available: - **Date** The driver package date. - **Directory** The path to the driver package. - **DriverInBox** Is the driver included with the operating system? +- **FlightIds** Driver Flight IDs. - **Inf** The INF name of the driver package. - **InventoryVersion** The version of the inventory file generating the events. - **Provider** The provider for the driver package. +- **RecoveryIds** Driver recovery IDs. - **SubmissionId** The HLK submission ID for the driver package. - **Version** The version of the driver package. ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4296,7 +4497,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4323,21 +4524,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4370,7 +4604,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4381,7 +4615,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4392,7 +4626,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4410,7 +4644,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4421,7 +4655,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4447,7 +4681,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4458,7 +4692,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4473,7 +4707,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4484,7 +4718,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4495,7 +4729,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4510,7 +4744,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4521,7 +4755,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4535,7 +4769,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4546,7 +4780,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4578,7 +4812,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4589,7 +4823,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4601,7 +4835,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4612,7 +4846,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4623,7 +4857,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4634,7 +4868,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4649,7 +4883,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4657,7 +4891,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4665,7 +4899,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4676,7 +4910,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4688,7 +4922,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4696,7 +4930,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4713,10 +4947,9 @@ The following fields are available: - **BytesRead** The total number of bytes read from or read by the OS upon system startup. - **BytesWritten** The total number of bytes written to or written by the OS upon system startup. - ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4747,7 +4980,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4772,7 +5005,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4787,7 +5020,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4804,71 +5037,81 @@ The following fields are available: ### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. ### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. ### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. ### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config @@ -4877,40 +5120,141 @@ This config event sends basic device connectivity and configuration information The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: -- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''. +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." - **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. - **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). - **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). -- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. - **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. - **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). - **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. - **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. - **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. @@ -4921,7 +5265,7 @@ The following fields are available: - **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. - **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. -- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. - **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. - **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). @@ -4930,15 +5274,14 @@ The following fields are available: - **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. - **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. -- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. -- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. - **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. - **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. - **appVersion** The version of the product install. Default: '0.0.0.0'. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **eventType** A string representation of appPingEventEventType indicating the type of the event. -- **hwHasAvx** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. @@ -4959,41 +5302,18 @@ The following fields are available: - **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. - **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. - **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. -- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. -- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. - - -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5005,7 +5325,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5016,7 +5336,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5030,7 +5350,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -5104,7 +5424,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5117,7 +5437,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5129,7 +5449,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5145,7 +5465,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5158,7 +5478,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5168,7 +5488,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5178,7 +5498,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5189,7 +5509,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5198,7 +5518,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5206,11 +5526,38 @@ The following fields are available: - **winInetError** The HResult of the operation. +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5222,7 +5569,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5236,34 +5583,19 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. - **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. - **threadId** The ID of the thread on which the activity is executing. + ## Privacy notifier events - ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5276,6 +5608,85 @@ The following fields are available: - **resetSettingsResult** The return code of the action to correct the known issue. +## Quality Update Assistant events + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **dayspendingrebootafterfu** Number of days that have elapsed since the device reached ready to reboot for a Feature Update that is still actively pending reboot. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **IsApplicable** Indicates whether the update is applicable to this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **Reason** Provides information on reasons why the update is not applicable to the device. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck + +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateReadinessProcessorMaxSpeed** Processor max speed. +- **Reason** Indicates why the device did not pass the readiness check. +- **Result** Device readiness check for quality update assistant. +- **VirtualMemoryUsedByCurrentProcess** Virtual memory in use by the Quality Update Assistant process. + + +### Microsoft.Windows.QualityUpdateAssistant.Download + +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **DODownloadHResult** Result code from Delivery Optimization when used to download the quality update. +- **DownloadMode** Indicates how the quality update was downloaded. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter that indicates ordering of events sent by this device. +- **HttpsDownloadHResult** Result code when HTTPS is used to download the quality update. +- **InstallMode** Indicates which installation method was used to attempt the install of the quality update. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateDeviceHasMinimumUptime** Indicates whether the device has the minimum uptime required to install a quality update. +- **Result** Download of latest cumulative update payload. +- **Scenario** Indicates if the installation step succeeded or failed. + + +### Microsoft.Windows.QualityUpdateAssistant.Install + +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **DismInstallHResult** Internal result code from DISM when used to install the quality update. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **InstallMode** Indicates which installation method was used to attempt the install of the quality update. +- **KBNumber** KBNumber of the update being installed. +- **launchretrycounter** Count of the number of times the install has been retried in the event of a non-successful installation attempt. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateDismErrorCode** Error code returned when DISM is used to install the quality update. +- **QualityUpdatePendingRebootAfterInstallStage** Indicates if the device is pending reboot after install is complete. +- **QualityUpdateSecondsInstallStage** Time spent installing the quality update. +- **QualityUpdateWusaErrorCode** Error code returned when WUSA is used to install the quality update. +- **Result** Install of latest cumulative update payload. +- **Scenario** Indicates if the installation step succeeded or failed. +- **WusaInstallHResult** Internal result code from WUSA when used to install the quality update. + + ## Remediation events ### Microsoft.Windows.Remediation.Applicable @@ -5410,7 +5821,7 @@ The following fields are available: - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. - **RemediationShellDeviceProSku** Indicates whether a Windows 10 Professional edition is detected. - **RemediationShellDeviceQualityUpdatesPaused** Indicates whether Quality Updates are paused on the device. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceSedimentMutexInUse** Indicates whether the Sediment Pack mutual exclusion object (mutex) is in use. - **RemediationShellDeviceSetupMutexInUse** Indicates whether device setup is in progress. - **RemediationShellDeviceWuRegistryBlocked** Indicates whether the Windows Update is blocked on the device via the registry. @@ -5622,7 +6033,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5660,7 +6071,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5678,7 +6089,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5693,7 +6104,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5706,7 +6117,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5724,7 +6135,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5748,7 +6159,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5769,6 +6180,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -5789,7 +6201,7 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: @@ -5802,7 +6214,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5826,7 +6238,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5846,7 +6258,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5867,7 +6279,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5952,7 +6364,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5983,7 +6395,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -6074,7 +6486,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6096,7 +6508,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6171,6 +6583,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. - **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. - **MsiAction** The stage of MSI installation where it failed. - **MsiProductCode** The unique identifier of the MSI installer. @@ -6200,7 +6613,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6227,6 +6640,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -6245,7 +6659,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6261,7 +6675,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6305,7 +6719,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6320,7 +6734,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6381,7 +6795,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6399,7 +6813,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6415,7 +6829,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6452,7 +6866,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6472,7 +6886,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6488,7 +6902,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6506,7 +6920,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6524,7 +6938,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6541,7 +6955,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6567,7 +6981,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6587,7 +7001,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6603,7 +7017,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6621,7 +7035,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6630,14 +7044,16 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6656,7 +7072,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6680,7 +7096,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6696,7 +7112,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6712,7 +7128,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6746,7 +7162,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6756,7 +7172,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6814,7 +7230,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6978,7 +7394,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7003,7 +7419,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7022,7 +7438,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7061,9 +7477,65 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.DetectionsOnlyFailed + +Failed to apply the named diagnostic. + +The following fields are available: + +- **hResult** The error code from attempting the diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + +### Microsoft.Windows.WaaSMedic.RemediationsOnlyFailed + +This event indicates that some plugins failed to complete remediation. This data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **hResult** A resulting error code. +- **versionString** The string for which plugins failed. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7524,7 +7996,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. +This event sends data when the Windows System Kit is used to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7539,7 +8011,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCustomization -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. +This event sends data when the Windows System Kit is used to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7555,7 +8027,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskWorkspaceCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. +This event sends data when the Windows System Kit is used to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7573,15 +8045,29 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **wUfBConnected** Result of WUfB connection check. + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7615,7 +8101,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7650,7 +8136,7 @@ The following fields are available: - **groupConnectionCount** The total number of connections made to peers in the same group. - **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group. - **isEncrypted** TRUE if the file is encrypted and will be decrypted after download. -- **isThrottled** Indicates the Event Rate was throttled (event represent aggregated data). +- **isThrottled** Event Rate throttled (event represents aggregated data). - **isVpn** Is the device connected to a Virtual Private Network? - **jobID** Identifier for the Windows Update job. - **lanConnectionCount** The total number of connections made to peers in the same LAN. @@ -7670,7 +8156,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7690,7 +8176,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7726,7 +8212,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7748,7 +8234,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7764,7 +8250,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7788,7 +8274,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7804,7 +8290,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7831,7 +8317,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7849,7 +8335,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7865,7 +8351,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7880,7 +8366,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7906,7 +8392,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7922,7 +8408,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7938,7 +8424,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7954,7 +8440,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7970,7 +8456,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7986,7 +8472,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderToast -This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. +This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8002,7 +8488,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -8020,9 +8506,18 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8031,9 +8526,19 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot + +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **isOnAC** The power source for AC or battery power. +- **scanTriggerSource** The source of a triggered scan. + + ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8045,7 +8550,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8057,7 +8562,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8067,7 +8572,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8086,7 +8591,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -8128,7 +8633,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DetectionResult -This event runs when an update is detected. This helps ensure Windows is kept up to date. +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. The following fields are available: @@ -8141,7 +8646,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8157,7 +8662,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -8174,7 +8679,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8183,7 +8688,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8192,7 +8697,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8203,7 +8708,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8220,7 +8725,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8230,7 +8735,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8247,7 +8752,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -8264,7 +8769,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -8290,7 +8795,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8304,7 +8809,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -8314,9 +8819,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data when Oobe Update download is in progress, to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An ID associated with an update. +- **updateScenarioType** A type of USO session. +- **wuDeviceid** A device Id associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event is sent after a Windows update install completes. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -8333,7 +8851,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8342,7 +8860,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -8361,7 +8879,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -8373,7 +8891,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -8385,7 +8903,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8404,7 +8922,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -8417,7 +8935,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -8430,7 +8948,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8440,7 +8958,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -8456,7 +8974,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8468,7 +8986,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8480,7 +8998,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8490,7 +9008,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8503,7 +9021,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8518,7 +9036,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8528,7 +9046,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8544,7 +9062,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8566,7 +9084,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8575,7 +9093,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8595,7 +9113,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8605,7 +9123,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8623,11 +9141,232 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that updates have been blocked requiring intervention. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the required UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the device has completed the reboot after installing expected update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8651,7 +9390,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8673,7 +9412,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8694,11 +9433,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8708,7 +9468,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8721,7 +9481,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8736,7 +9496,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8746,13 +9506,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index b7de342751..51c8baac0e 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -1,6 +1,6 @@ --- -description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. Specific to Windows 10, version 1903. -title: Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields (Windows 10) +description: Use this article to learn more about what required Windows 10 version 1903 diagnostic data is gathered. +title: Windows 10, version 1909 and Windows 10, version 1903 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 ms.mktglfcycl: manage @@ -13,11 +13,16 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 12/10/2019 +ms.date: 09/30/2020 --- -# Windows 10, version 1903 and Windows 10, version 1909 basic level Windows diagnostic events and fields +# Windows 10, version 1909 and Windows 10, version 1903 required Windows diagnostic events and fields + + +> [!IMPORTANT] +> Windows is moving to classifying the data collected from customer’s devices as either *Required* or *Optional*. + **Applies to** @@ -25,15 +30,15 @@ ms.date: 12/10/2019 - Windows 10, version 1903 -The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information. +Required diagnostic data gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. -The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. +Required diagnostic data helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -261,7 +266,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -326,7 +331,6 @@ The following fields are available: - **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPoltUpgrade_20H1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. - **DataSourceMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. @@ -414,7 +418,6 @@ The following fields are available: - **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPoltUpgrade_20H1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. - **DecisionMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. @@ -453,6 +456,7 @@ The following fields are available: - **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. - **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1** The count of the number of this particular object type present on this device. - **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. - **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers. - **InventoryApplicationFile** The count of the number of this particular object type present on this device. @@ -493,7 +497,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -511,7 +515,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -522,7 +526,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -541,12 +545,7 @@ The following fields are available: - **ActiveNetworkConnection** Indicates whether the device is an active network device. - **AppraiserVersion** The version of the appraiser file generating the events. -- **CosDeviceRating** An enumeration that indicates if there is a driver on the target operating system. -- **CosDeviceSolution** An enumeration that indicates how a driver on the target operating system is available. -- **CosDeviceSolutionUrl** Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd . Empty string -- **CosPopulatedFromId** The expected uplevel driver matching ID based on driver coverage data. - **IsBootCritical** Indicates whether the device boot is critical. -- **UplevelInboxDriver** Indicates whether there is a driver uplevel for this device. - **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update. - **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver. - **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update. @@ -554,7 +553,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -565,7 +564,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -587,7 +586,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -598,7 +597,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -616,11 +615,23 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove + +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -640,9 +651,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove + +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -662,9 +684,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove + +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -684,9 +717,20 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove + +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -727,7 +771,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -738,7 +782,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -776,7 +820,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -787,7 +831,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -809,14 +853,13 @@ The following fields are available: - **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? - **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block? - **DriverIsDriverBlocked** Is the driver package blocked because of a driver block? -- **DriverIsTroubleshooterBlocked** Indicates whether the driver package is blocked because of a troubleshooter block. - **DriverShouldNotMigrate** Should the driver package be migrated during upgrade? - **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -827,7 +870,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -847,15 +890,28 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. - **BlockingApplication** Are there are any application issues that interfere with upgrade due to matching info blocks? - **DisplayGenericMessage** Will a generic message be shown for this block? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? - **NeedsUninstallAction** Does the user need to take an action in setup due to a matching info block? - **SdbBlockUpgrade** Is a matching info block blocking upgrade? - **SdbBlockUpgradeCanReinstall** Is a matching info block blocking upgrade, but has the can reinstall tag? - **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag? +- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove + +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -880,7 +936,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -904,9 +960,20 @@ The following fields are available: - **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove + +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -932,9 +999,20 @@ The following fields are available: - **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center? +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove + +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -957,9 +1035,9 @@ The following fields are available: - **HasBiosBlock** Does the device have a BIOS block? -### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -968,6 +1046,30 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync + +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionTestAdd + +This event provides diagnostic data for testing decision add events. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser binary generating the events. +- **TestDecisionDataPoint1** Test data point 1. +- **TestDecisionDataPoint2** Test data point 2. + + ### Microsoft.Windows.Appraiser.General.DecisionTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1006,7 +1108,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1035,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1046,7 +1148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1070,7 +1172,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1081,7 +1183,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1110,7 +1212,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1121,7 +1223,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1132,7 +1234,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1145,9 +1247,20 @@ The following fields are available: - **Model** The model field from Win32_ComputerSystem. +### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove + +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1158,7 +1271,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemProcessorEndSync -This event indicates that a full set of InventorySystemProcessorAdd events has been sent. +This event indicates that a full set of InventorySystemProcessorAdd events has been sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1169,7 +1282,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemProcessorStartSync -This event indicates that a new set of InventorySystemProcessorAdd events will be sent. +This event indicates that a new set of InventorySystemProcessorAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1178,6 +1291,19 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. +### Microsoft.Windows.Appraiser.General.InventoryTestAdd + +This event provides diagnostic data for testing event adds. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the component sending the data. +- **TestInvDataPoint1** Test inventory data point 1. +- **TestInvDataPoint2** Test inventory data point 2. + + ### Microsoft.Windows.Appraiser.General.InventoryTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1202,7 +1328,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1227,7 +1353,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1238,7 +1364,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1249,7 +1375,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1281,9 +1407,20 @@ The following fields are available: - **virtualKB** The amount of virtual memory (in KB). +### Microsoft.Windows.Appraiser.General.SystemMemoryRemove + +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1305,9 +1442,20 @@ The following fields are available: - **CompareExchange128Support** Does the CPU support CompareExchange128? +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove + +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1329,9 +1477,20 @@ The following fields are available: - **LahfSahfSupport** Does the CPU support LAHF/SAHF? +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove + +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1354,9 +1513,20 @@ The following fields are available: - **NXProcessorSupport** Does the processor support NX? +### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove + +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1378,9 +1548,20 @@ The following fields are available: - **PrefetchWSupport** Does the processor support PrefetchW? +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove + +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1402,9 +1583,20 @@ The following fields are available: - **SSE2ProcessorSupport** Does the processor support SSE2? +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove + +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1426,9 +1618,20 @@ The following fields are available: - **MaximumTouches** The maximum number of touch points supported by the device hardware. +### Microsoft.Windows.Appraiser.General.SystemTouchRemove + +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1450,9 +1653,20 @@ The following fields are available: - **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. +### Microsoft.Windows.Appraiser.General.SystemWimRemove + +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1476,7 +1690,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1487,7 +1701,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1513,9 +1727,20 @@ The following fields are available: - **WlanNativeDriver** Does the device have a non-emulated WLAN driver? +### Microsoft.Windows.Appraiser.General.SystemWlanRemove + +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1536,6 +1761,8 @@ The following fields are available: - **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. +- **CountCustomSdbs** The number of custom Sdbs used by Appraiser. +- **CustomSdbGuids** Guids of the custom Sdbs used by Appraiser; Semicolon delimited list. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. - **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. @@ -1579,9 +1806,20 @@ The following fields are available: - **WmdrmPurchased** Indicates if the system has any files with permanent licenses. +### Microsoft.Windows.Appraiser.General.WmdrmRemove + +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1594,7 +1832,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1612,7 +1850,7 @@ The following fields are available: ### MicCoords -This event provides information about the location and orientation of the microphone element. +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1626,7 +1864,7 @@ The following fields are available: ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1662,7 +1900,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1680,7 +1918,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1691,7 +1929,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1702,19 +1940,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1732,15 +1960,16 @@ The following fields are available: - **IsDomainJoined** Indicates whether a machine is joined to a domain. - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. +- **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. -- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1752,7 +1981,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1768,7 +1997,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1781,6 +2010,7 @@ The following fields are available: - **DeviceName** The device name that is set by the user. - **DigitizerSupport** Is a digitizer supported? - **DUID** The device unique ID. +- **EnclosureKind** Windows.Devices.Enclosure.EnclosureKind enum values representing each unique enclosure posture kind. - **Gyroscope** Indicates whether the device has a gyroscope (a mechanical component that measures and maintains orientation). - **InventoryId** The device ID used for compatibility testing. - **Magnetometer** Indicates whether the device has a magnetometer (a mechanical component that works like a compass). @@ -1811,7 +2041,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1821,7 +2051,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1844,7 +2074,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1886,7 +2116,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1932,7 +2162,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1955,7 +2185,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1965,15 +2195,20 @@ The following fields are available: - **HVCIRunning** Hypervisor Code Integrity (HVCI) enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s functionality to force all software running in kernel mode to safely allocate memory. This field tells if HVCI is running. - **IsSawGuest** Indicates whether the device is running as a Secure Admin Workstation Guest. - **IsSawHost** Indicates whether the device is running as a Secure Admin Workstation Host. +- **IsWdagFeatureEnabled** Indicates whether Windows Defender Application Guard is enabled. - **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security. - **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting. +- **ShadowStack** The bit fields of SYSTEM_SHADOW_STACK_INFORMATION representing the state of the Intel CET (Control Enforcement Technology) hardware security feature. - **SModeState** The Windows S mode trail state. +- **SystemGuardState** Indicates the SystemGuard state. NotCapable (0), Capable (1), Enabled (2), Error (0xFF). +- **TpmReadyState** Indicates the TPM ready state. NotReady (0), ReadyForStorage (1), ReadyForAttestation (2), Error (0xFF). - **VBSState** Virtualization-based security (VBS) uses the hypervisor to help protect the kernel and other parts of the operating system. Credential Guard and Hypervisor Code Integrity (HVCI) both depend on VBS to isolate/protect secrets, and kernel-mode code integrity validation. VBS has a tri-state that can be Disabled, Enabled, or Running. +- **WdagPolicyValue** The Windows Defender Application Guard policy. ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1992,7 +2227,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2004,7 +2239,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2018,7 +2253,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2039,7 +2274,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2052,7 +2287,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2098,7 +2333,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2107,14 +2342,16 @@ The following fields are available: - **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present. - **IsVDI** Is the device using Virtual Desktop Infrastructure? - **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. +- **IsWVDSessionHost** Indicates if this is a Windows Virtual Device session host. - **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. - **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. -- **VMId** A string that uniquely identifies a virtual machine. +- **VMId** A string that identifies a virtual machine. +- **WVDEnvironment** Represents the WVD service environment to which this session host has been joined. ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2123,6 +2360,7 @@ The following fields are available: - **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured - **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting - **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. +- **IsHotPatchEnrolled** Represents the current state of the device in relation to enrollment in the hotpatch program. - **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? - **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? - **OSAssessmentForQualityUpdate** Is the device on the latest quality update? @@ -2139,6 +2377,7 @@ The following fields are available: - **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates. - **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades. - **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network. +- **WULCUVersion** Version of the LCU Installed on the machine. - **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier. - **WUPauseState** Retrieves WU setting to determine if updates are paused. - **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). @@ -2276,6 +2515,7 @@ The following fields are available: - **providerGuid** The ETW provider ID associated with the provider name. - **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW. - **seq** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server. +- **sqmId** The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier. - **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. - **wcmp** The Windows Shell Composer ID. - **wPId** The Windows Core OS product ID. @@ -2325,7 +2565,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilityEnumeration -This event reports on the results of scanning for optional Windows content on Windows Update. +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. The following fields are available: @@ -2347,7 +2587,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2490,7 +2730,7 @@ This event reports the results of deferring Windows Content to keep Windows up t ### TelClientSynthetic.AbnormalShutdown_0 -This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date. +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2561,7 +2801,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2579,7 +2819,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2597,19 +2837,35 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. +### TelClientSynthetic.EventMonitor_0 + +This event provides statistics for specific diagnostic events. + +The following fields are available: + +- **ConsumerCount** The number of instances seen in the Event Tracing for Windows consumer. +- **EventName** The name of the event being monitored. +- **EventSnFirst** The expected first event serial number. +- **EventSnLast** The expected last event serial number. +- **EventStoreCount** The number of events reaching the event store. +- **MonitorSn** The serial number of the monitor. +- **TriggerCount** The number of events reaching the trigger buffer. +- **UploadedCount** The number of events uploaded. + + ### TelClientSynthetic.GetFileInfoAction_FilePathNotApproved_0 This event occurs when the DiagTrack escalation fails due to the scenario requesting a path that is not approved for GetFileInfo actions. @@ -2809,11 +3065,27 @@ This event is a low latency health alert that is part of the 4Nines device healt +## Direct to update events + +### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run +- **ClientID** Client ID being run +- **CoordinatorVersion** Coordinator version of DTU +- **CV** Correlation vector +- **CV_new** New correlation vector +- **hResult** HRESULT of the failure + + ## DISM events ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU -The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2822,7 +3094,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMPendingInstall -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2831,7 +3103,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2840,7 +3112,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMUninstallLCU -The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. +The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2849,7 +3121,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd -The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2864,7 +3136,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRepairActionStart -The SRT Repair Action Start event sends information to report repair operation started for given plug-in. +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2873,7 +3145,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd -The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2885,7 +3157,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart -The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2896,7 +3168,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2953,7 +3225,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2972,7 +3244,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3007,12 +3279,12 @@ The following fields are available: - **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload. - **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes). - **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes). -- **Display1UMDFilePath** File path to the location of the Display User Mode Driver in the Driver Store. +- **Display1UMDFilePath** The file path to the location of the Display User Mode Driver in the Driver Store. - **DisplayAdapterLuid** The display adapter LUID. - **DriverDate** The date of the display driver. - **DriverRank** The rank of the display driver. - **DriverVersion** The display driver version. -- **DriverWorkarounds** Numeric value indicating the driver workarounds enabled for this device. +- **DriverWorkarounds** Numeric value indicating the driver workarounds that are enabled for this device. - **DX10UMDFilePath** The file path to the location of the DirectX 10 Display User Mode Driver in the Driver Store. - **DX11UMDFilePath** The file path to the location of the DirectX 11 Display User Mode Driver in the Driver Store. - **DX12UMDFilePath** The file path to the location of the DirectX 12 Display User Mode Driver in the Driver Store. @@ -3159,7 +3431,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3169,7 +3441,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3203,24 +3475,9 @@ The following fields are available: ## Holographic events -### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded - -This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. - -The following fields are available: - -- **ClassGuid** Windows Mixed Reality device class GUID. -- **DeviceInterfaceId** Windows Mixed Reality device interface ID. -- **DeviceName** Windows Mixed Reality device name. -- **DriverVersion** Windows Mixed Reality device driver version. -- **FirmwareVersion** Windows Mixed Reality firmware version. -- **Manufacturer** Windows Mixed Reality device manufacturer. -- **ModelName** Windows Mixed Reality device model name. -- **SerialNumber** Windows Mixed Reality device serial number. - ### Microsoft.Windows.Holographic.Coordinator.HoloShellStateUpdated -This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. +This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3232,7 +3489,7 @@ The following fields are available: ### Microsoft.Windows.Shell.HolographicFirstRun.AppActivated -This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. +This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3245,13 +3502,13 @@ The following fields are available: ### Microsoft.Windows.Shell.HolographicFirstRun.AppLifecycleService_Resuming -This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. +This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. ### TraceLoggingOasisUsbHostApiProvider.DeviceInformation -This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. +This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3293,7 +3550,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3327,7 +3584,6 @@ The following fields are available: - **InventoryMiscellaneousOfficeVBA** A count of office vba objects in cache - **InventoryMiscellaneousOfficeVBARuleViolations** A count of office vba rule violations objects in cache - **InventoryMiscellaneousUUPInfo** A count of uup info objects in cache -- **InventoryVersion** The version of the inventory file generating the events. - **Metadata** A count of metadata objects in cache. - **Orphan** A count of orphan file objects in cache. - **Programs** A count of program objects in cache. @@ -3335,7 +3591,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3345,7 +3601,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3363,7 +3619,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3376,6 +3632,7 @@ The following fields are available: - **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. - **InventoryVersion** The version of the inventory file generating the events. - **Language** The language code of the program. +- **MsiInstallDate** The install date recorded in the program's MSI package. - **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. - **MsiProductCode** A GUID that describe the MSI Product. - **Name** The name of the application. @@ -3392,7 +3649,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3404,7 +3661,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3441,7 +3698,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3454,7 +3711,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3465,7 +3722,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3476,9 +3733,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange) The following fields are available: @@ -3487,7 +3744,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3511,7 +3768,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3522,7 +3779,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3533,7 +3790,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3563,7 +3820,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3574,7 +3831,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3589,7 +3846,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3600,7 +3857,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3656,7 +3913,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3667,7 +3924,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3678,7 +3935,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3691,7 +3948,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3702,7 +3959,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event provides the basic metadata about driver binaries running on the system. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3729,7 +3986,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3740,7 +3997,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3751,7 +4008,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3762,16 +4019,18 @@ The following fields are available: - **Date** The driver package date. - **Directory** The path to the driver package. - **DriverInBox** Is the driver included with the operating system? +- **FlightIds** Driver Flight IDs. - **Inf** The INF name of the driver package. - **InventoryVersion** The version of the inventory file generating the events. - **Provider** The provider for the driver package. +- **RecoveryIds** Driver recovery IDs. - **SubmissionId** The HLK submission ID for the driver package. - **Version** The version of the driver package. ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3782,7 +4041,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3809,9 +4068,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration according to the DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3844,7 +4148,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3855,7 +4159,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3866,7 +4170,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3884,7 +4188,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3895,7 +4199,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3921,7 +4225,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3932,7 +4236,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3947,7 +4251,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3958,7 +4262,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3969,7 +4273,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3984,7 +4288,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3995,7 +4299,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4009,7 +4313,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4020,7 +4324,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4052,7 +4356,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4063,7 +4367,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4075,7 +4379,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4086,7 +4390,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4097,7 +4401,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4108,7 +4412,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4123,7 +4427,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4131,7 +4435,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4139,7 +4443,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4150,7 +4454,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4161,7 +4465,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. This data helps ensure the device is up to date. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4169,7 +4473,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4177,7 +4481,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4187,7 +4491,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.IoT.Client.CEPAL.MonitorStarted -This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. +This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. The data collected with this event is used to keep Windows performing properly. @@ -4205,7 +4509,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4236,7 +4540,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4261,7 +4565,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4274,7 +4578,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4289,7 +4593,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.PreviousShutdownWasThermalShutdown -This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. +This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4301,71 +4605,84 @@ The following fields are available: ### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. ### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. ### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config -This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_env** The environment from which the event was logged when testing; otherwise, the field is omitted or left blank. +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. ### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config @@ -4374,40 +4691,145 @@ This config event sends basic device connectivity and configuration information The following fields are available: -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: -- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''. +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_env** The environment from which the event was logged when testing; otherwise, the field is omitted or left blank. +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." - **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. - **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). - **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). -- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. - **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. - **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). - **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. - **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. - **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. @@ -4418,7 +4840,7 @@ The following fields are available: - **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. - **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. -- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. - **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. - **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). @@ -4427,15 +4849,14 @@ The following fields are available: - **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. - **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. -- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. -- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. - **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. - **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. - **appVersion** The version of the product install. Default: '0.0.0.0'. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **eventType** A string representation of appPingEventEventType indicating the type of the event. -- **hwHasAvx** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. @@ -4456,40 +4877,18 @@ The following fields are available: - **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. - **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. - **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. -- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. -- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4501,7 +4900,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4512,7 +4911,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4526,7 +4925,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4596,11 +4995,29 @@ The following fields are available: - **WFD2Supported** Indicates if the Miracast receiver supports WFD2 protocol. +## Mixed Reality events + +### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded + +This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **ClassGuid** Windows Mixed Reality device class GUID. +- **DeviceInterfaceId** Windows Mixed Reality device interface ID. +- **DeviceName** Windows Mixed Reality device name. +- **DriverVersion** Windows Mixed Reality device driver version. +- **FirmwareVersion** Windows Mixed Reality firmware version. +- **Manufacturer** Windows Mixed Reality device manufacturer. +- **ModelName** Windows Mixed Reality device model name. +- **SerialNumber** Windows Mixed Reality device serial number. + + ## OneDrive events ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4613,11 +5030,387 @@ The following fields are available: - **SourceOSBuildNumber** The source build number of the operating system. - **SourceOSVersion** The source version of the operating system. + +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + +## Surface events + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + +## Update health events + +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted + +This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4629,7 +5422,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4641,629 +5434,86 @@ The following fields are available: - **userRegionCode** The current user's region setting -## Push Button Reset events +## Quality Update Assistant events -### Microsoft.Windows.PBR.BitLockerWipeFinished +### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends error data after the BitLocker wipe finishes if there were any issues during the wipe. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: -- **error** The error code if there were any issues during the BitLocker wipe. -- **sessionID** This is the session ID. -- **succeeded** Indicates the BitLocker wipe successful completed. -- **timestamp** Time the event occurred. +- **CV** Correlation vector. +- **dayspendingrebootafterfu** Number of days that have elapsed since the device reached ready to reboot for a Feature Update that is still actively pending reboot. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **Reason** Provides information on reasons why the update is not applicable to the device. +- **Result** Applicability check for quality update assistant. -### Microsoft.Windows.PBR.BootState +### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends data on the Windows Recovery Environment (WinRE) boot, which can be used to determine whether the boot was successful. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **BsdSummaryInfo** Summary of the last boot. -- **sessionID** The ID of the push-button reset session. -- **timestamp** The timestamp of the boot state. +- **CV** Correlation vector. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **Reason** Indicates why the device did not pass the readiness check. +- **Result** Device readiness check for quality update assistant. -### Microsoft.Windows.PBR.ClearTPMStarted +### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic data about the recovery operation on the device to allow investigation. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **sessionID** The ID for this push-button restart session. -- **timestamp** The time when the Trusted Platform Module will be erased. +- **CV** Correlation vector. +- **DODownloadHResult** Result code from Delivery Optimization when used to download the quality update. +- **DownloadMode** Indicates how the quality update was downloaded. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter that indicates ordering of events sent by this device. +- **HttpsDownloadHResult** Result code when HTTPS is used to download the quality update. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateDeviceHasMinimumUptime** Indicates whether the device has the minimum uptime required to install a quality update. +- **Result** Download of latest cumulative update payload. +- **Scenario** Indicates if the installation step succeeded or failed. -### Microsoft.Windows.PBR.ClientInfo +### Microsoft.Windows.QualityUpdateAssistant.Install -This event indicates whether push-button reset (PBR) was initiated while the device was online or offline. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **name** Name of the user interface entry point. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The time when this event occurred. - - -### Microsoft.Windows.PBR.Completed - -This event sends data about the recovery operation on the device to allow for investigation. - -The following fields are available: - -- **sessionID** The ID of the push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.DataVolumeCount - -This event provides the number of additional data volumes that the push-button reset operation has detected. - -The following fields are available: - -- **count** The number of attached data drives. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.DiskSpaceRequired - -This event sends the peak disk usage required for the push-button reset operation. - -The following fields are available: - -- **numBytes** The number of bytes required for the reset operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.EnterAPI - -This event is sent at the beginning of each push-button reset (PRB) operation. - -The following fields are available: - -- **apiName** Name of the API command that is about to execute. -- **sessionID** The session ID. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.EnteredOOBE - -This event is sent when the push-button reset (PRB) process enters the Out Of Box Experience (OOBE). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.LeaveAPI - -This event is sent when the push-button reset operation is complete. - -The following fields are available: - -- **apiName** Name of the API command that completed. -- **errorCode** Error code if an error occurred during the API call. -- **sessionID** The ID of this push-button reset session. -- **success** Indicates whether the API call was successful. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionFinished - -This event is sent when the OEM extensibility scripts have completed. - -The following fields are available: - -- **exitCode** The exit code from OEM extensibility scripts to push-button reset. -- **param** Parameters used for the OEM extensibility script. -- **phase** Name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the OEM extensibility script executed successfully. -- **timedOut** Indicates whether the OEM extensibility script timed out. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionStarted - -This event is sent when the OEM extensibility scripts start to execute. - -The following fields are available: - -- **param** The parameters used by the OEM extensibility script. -- **phase** The name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteFinished - -This event is sent at the end of a push-button reset (PBR) operation. - -The following fields are available: - -- **error** Indicates the result code of the event. -- **index** The operation index. -- **operation** The name of the operation. -- **phase** The name of the operation phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteStarted - -This event is sent at the beginning of a push-button reset operation. - -The following fields are available: - -- **index** The index of this operation. -- **operation** The name of this operation. -- **phase** The phase of this operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. -- **weight** The weight of the operation used to distribute the change in percentage. - - -### Microsoft.Windows.PBR.OperationQueueConstructFinished - -This event is sent when construction of the operation queue for push-button reset is finished. - -The following fields are available: - -- **error** The result code for operation queue construction. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationQueueConstructStarted - -This event is sent when construction of the operation queue for push-button reset is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.PBRClearTPMFailed - -This event is sent when there was a failure while clearing the Trusted Platform Module (TPM). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionFailed - -This event is sent when the push-button reset operation fails to construct a new copy of the operating system. - -The following fields are available: - -- **HRESULT** Indicates the result code of the event. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. -- **SPErrorCode** The error code for the Setup Platform operation. -- **SPOperation** The last Setup Platform operation. -- **SPPhase** The last phase of the Setup Platform operation. - - -### Microsoft.Windows.PBR.PBRFailed - -This event is sent when the push-button reset operation fails and rolls back to the previous state. - -The following fields are available: - -- **ErrorType** The result code for the push-button reset error. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFinalUserSelection - -This event is sent when the user makes the final selection in the user interface. - -The following fields are available: - -- **PBREraseData** Indicates whether the option to erase data is selected. -- **PBRRecoveryStrategy** The recovery strategy for the push-button reset operation. -- **PBRRepartitionDisk** Indicates whether the user has selected the option to repartition the disk. -- **PBRVariation** Indicates the push-button reset type. -- **PBRWipeDataDrives** Indicates whether the option to wipe the data drives is selected. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBROEM1Failed - -This event is sent when the first OEM extensibility operation is successfully completed. - -The following fields are available: - -- **HRESULT** The result error code from the OEM extensibility script. -- **Parameters** The parameters that were passed to the OEM extensibility script. -- **PBRType** The type of push-button reset. -- **ScriptName** The path to the OEM extensibility script. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReachedOOBE - -This event returns data when the PBR (Push Button Reset) process reaches the OOBE (Out of Box Experience). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReconstructionInitiated - -This event returns data when a PBR (Push Button Reset) reconstruction operation begins. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecks - -This event returns data when PBR (Push Button Reset) requirement checks begin. - -The following fields are available: - -- **DeploymentType** The type of deployment. -- **InstallType** The type of installation. -- **PBRType** The type of push-button reset. -- **SessionID** The ID for this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksFailed - -This event returns data when PBR (Push Button Reset) requirement checks fail. - -The following fields are available: - -- **DiskSpaceAvailable** The disk space available for the push-button reset. -- **DiskSpaceRequired** The disk space required for the push-button reset. -- **ErrorType** The type of error that occurred during the requirement checks phase of the push-button reset operation. -- **PBRImageVersion** The image version of the push-button reset tool. -- **PBRRecoveryStrategy** The recovery strategy for this phase of push-button reset. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **PBRType** The type of push-button reset specified by the user interface. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksPassed - -This event returns data when PBR (Push Button Reset) requirement checks are passed. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRImageType** The push-button reset image type. -- **PBRImageVersion** The version of the push-button reset image. -- **PBRRecoveryStrategy** The push-button reset recovery strategy. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRSucceed - -This event returns data when PBR (Push Button Reset) succeeds. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PhaseFinished - -This event returns data when a phase of PBR (Push Button Reset) has completed. - -The following fields are available: - -- **error** The result code for this phase of push-button reset. -- **phase** The name of this push-button reset phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether this phase of push-button reset executed successfully. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.PhaseStarted - -This event is sent when a phase of the push-button reset (PBR) operation starts. - -The following fields are available: - -- **phase** The name of this phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.ReconstructionInfo - -This event returns data about the PBR (Push Button Reset) reconstruction. - -The following fields are available: - -- **numPackagesAbandoned** The number of packages that were abandoned during the reconstruction operation of push-button reset. -- **numPackagesFailed** The number of packages that failed during the reconstruction operation of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **slowMode** The mode of reconstruction. -- **targetVersion** The target version of the OS for the reconstruction. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ResetOptions - -This event returns data about the PBR (Push Button Reset) reset options selected by the user. - -The following fields are available: - -- **overwriteSpace** Indicates whether the option was selected to erase data during push-button reset. -- **preserveWorkplace** Indicates whether the option was selected to reserve the workplace during push-button reset. -- **scenario** The selected scenario for the push-button on reset operation. -- **sessionID** The ID of this push-button on reset session. -- **timestamp** The timestamp of this push-button on reset event. -- **usePayload** Indicates whether Cloud PBR or Reconstruction was used. -- **wipeData** Indicates whether the option was selected to wipe additional drives during push-button reset. - - -### Microsoft.Windows.PBR.RetryQueued - -This event returns data about the retry count when PBR (Push Button Reset) is restarted due to a reboot. - -The following fields are available: - -- **attempt** The number of retry attempts that were made -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnedToOldOS - -This event returns data after PBR (Push Button Reset) has completed the rollback. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnTaskSchedulingFailed - -This event returns data when there is a failure scheduling a boot into WinRE (Windows Recovery). - -The following fields are available: - -- **errorCode** The error that occurred while scheduling the task. -- **sessionID** The ID of this push-button reset session. -- **taskName** The name of the task. -- **timestamp** The ID of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackFinished - -This event returns data when the PBR (Push Button Reset) rollback completes. - -The following fields are available: - -- **error** Any errors that occurred during rollback to the old operating system. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the rollback succeeded. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackStarted - -This event returns data when the PBR (Push Button Reset) rollback begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ScenarioNotSupported - -This event returns data when the PBR (Push Button Reset) scenario selected is not supported on the device. - -The following fields are available: - -- **errorCode** The error that occurred. -- **reason** The reason why this push-button reset scenario is not supported. -- **sessionID** The ID for this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionCreated - -This event returns data when the PRB (Push Button Reset) session is created at the beginning of the UI (user interface) process. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionResumed - -This event returns data when the PRB (Push Button Reset) session is resumed after reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionSaved - -This event returns data when the PRB (Push Button Reset) session is suspended between reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteFinished - -This event returns data when the PBR (Push Button Reset) setup finishes. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **systemState** Information about the system state of the Setup Platform operation. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteStarted - -This event returns data when the PBR (Push Button Reset) setup starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupFinalizeStarted - -This event returns data when the Finalize operation is completed by setup during PBR (Push Button Reset). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupOperationFailed - -This event returns data when a PRB (Push Button Reset) setup operation fails. - -The following fields are available: - -- **errorCode** An error that occurred during the setup phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **setupExecutionOperation** The name of the Setup Platform operation. -- **setupExecutionPhase** The phase of the setup operation that failed. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoField - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate reset options are shown to the user. - -The following fields are available: - -- **name** Name of the system information field. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. -- **value** The system information field value. - - -### Microsoft.Windows.PBR.SystemInfoListItem - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate options can be shown to the user. - -The following fields are available: - -- **index** The index number associated with the system information item. -- **name** The name of the list of system information items. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. -- **value** The value of the system information item. - - -### Microsoft.Windows.PBR.SystemInfoSenseFinished - -This event returns data when System Info Sense is finished. - -The following fields are available: - -- **error** The error code if an error occurred while querying for system information. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the query for system information was successful. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoSenseStarted - -This event returns data when System Info Sense is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset event. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.UserAcknowledgeCleanupWarning - -This event returns data when the user acknowledges the cleanup warning pop-up after PRB (Push Button Reset) is complete. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserCancel - -This event returns data when the user confirms they wish to cancel PBR (Push Button Reset) from the user interface. - -The following fields are available: - -- **pageID** The page ID for the page the user canceled. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserConfirmStart - -This event returns data when the user confirms they wish to reset their device and PBR (Push Button Reset) begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallFinished - -This event returns data when WinRE (Windows Recovery) installation is complete. - -The following fields are available: - -- **errorCode** Any error that occurred during the Windows Recovery Environment (WinRE) installation. -- **sessionID** The ID of this push-button reset session. -- **success** Indicates whether the Windows Recovery Environment (WinRE) installation successfully completed. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallStarted - -This event returns data when WinRE (Windows Recovery) installation starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. +- **CV** Correlation vector. +- **DismInstallHResult** Internal result code from DISM when used to install the quality update. +- **ExecutionRequestId** Identifier of the Execution Request that launched the QualityUpdateAssistant process. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **InstallMode** Indicates which installation method was used to attempt the install of the quality update. +- **KBNumber** KBNumber of the update being installed. +- **launchretrycounter** Count of the number of times the install has been retried in the event of a non-successful installation attempt. +- **PackageVersion** Current package version of quality update assistant. +- **QualityUpdateDismErrorCode** Error code returned when DISM is used to install the quality update. +- **QualityUpdatePendingRebootAfterInstallStage** Indicates if the device is pending reboot after install is complete. +- **QualityUpdateSecondsInstallStage** Time spent installing the quality update. +- **QualityUpdateWusaErrorCode** Error code returned when WUSA is used to install the quality update. +- **Result** Install of latest cumulative update payload. +- **Scenario** Indicates if the installation step succeeded or failed. +- **WusaInstallHResult** Internal result code from WUSA when used to install the quality update. ## Sediment events ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5295,6 +5545,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -5315,12 +5566,13 @@ This event sends basic metadata about the update installation process generated ### SetupPlatformTel.SetupPlatformTelEvent -This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. @@ -5328,7 +5580,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5374,6 +5626,7 @@ The following fields are available: - **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. - **IsWUfBFederatedScanDisabled** Indicates if Windows Update for Business federated scan is disabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce - **MSIError** The last error that was encountered during a scan for updates. - **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6 @@ -5406,6 +5659,7 @@ The following fields are available: - **SystemBIOSMajorRelease** Major version of the BIOS. - **SystemBIOSMinorRelease** Minor version of the BIOS. - **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null. +- **TargetReleaseVersion** The value selected for the target release version policy. - **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down. - **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation. - **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. @@ -5413,7 +5667,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5444,7 +5698,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5497,6 +5751,7 @@ The following fields are available: - **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update - **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **NetworkCost** A flag indicating the cost of the network (congested, fixed, variable, over data limit, roaming, etc.) used for downloading the update content. - **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.) - **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered." @@ -5534,7 +5789,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5556,7 +5811,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5630,6 +5885,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. - **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. - **MsiAction** The stage of MSI installation where it failed. - **MsiProductCode** The unique identifier of the MSI installer. @@ -5658,7 +5914,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5686,6 +5942,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -5704,7 +5961,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5720,7 +5977,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5747,6 +6004,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was then a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -5765,7 +6023,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5780,7 +6038,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5813,13 +6071,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallCancel -This event indicates the customer has cancelled uninstallation of Windows. +This event indicates the customer has cancelled uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallError -This event sends an error code when the Windows uninstallation fails. +This event sends an error code when the Windows uninstallation fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5828,19 +6086,19 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallReboot -This event is sent to signal an upcoming reboot during uninstallation of Windows. +This event is sent to signal an upcoming reboot during uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallStart -This event indicates that the Windows uninstallation has started. +This event indicates that the Windows uninstallation has started. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallUnavailable -This event sends diagnostic data when the Windows uninstallation is not available. +This event sends diagnostic data when the Windows uninstallation is not available. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5852,13 +6110,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.HasPendingActions -This event is sent when users have actions that will block the uninstall of the latest quality update. +This event is sent when users have actions that will block the uninstall of the latest quality update. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.IndicateLCUWasUninstalled -This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. +This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5867,7 +6125,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.LCUUninstall -This event is sent when the latest cumulative Windows update was uninstalled on a device. +This event is sent when the latest cumulative Windows update was uninstalled on a device. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5878,7 +6136,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRBlockedByPolicy -This event is sent when a push-button reset operation is blocked by the System Administrator. +This event is sent when a push-button reset operation is blocked by the System Administrator. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5888,7 +6146,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitFailed -This event signals a failed handoff between two recovery binaries. +This event signals a failed handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5897,7 +6155,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitSucceed -This event signals successful handoff between two recovery binaries. +This event signals successful handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5906,7 +6164,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRFailedOffline -This event reports the error code when recovery fails. +This event reports the error code when recovery fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5917,7 +6175,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.EsimPresentCheck -This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). +This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5928,7 +6186,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.PBRCorruptionRepairOption -This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. +This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5940,7 +6198,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.RepairNeeded -This event provides information about whether a system reset needs repair. +This event provides information about whether a system reset needs repair. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -5952,7 +6210,7 @@ The following fields are available: ### Microsoft.Windows.UEFI.ESRT -This event sends basic data during boot about the firmware loaded or recently installed on the machine. This helps to keep Windows up to date. +This event sends basic data during boot about the firmware loaded or recently installed on the machine. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -5980,7 +6238,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5998,10 +6256,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **FlightId** Unique ID for each flight. - **ObjectId** Unique value for each Update Agent mode. @@ -6014,13 +6273,18 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean indicating whether a cancel was requested. - **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. - **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. +- **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. +- **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. +- **DownloadedSizePSFX** Cumulative size (in bytes) of downloaded PSFX content. - **DownloadRequests** Number of times a download was retried. - **ErrorCode** The error code returned for the current download request phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. @@ -6051,10 +6315,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether a cancel was requested. - **CanonicalRequestedOnError** Indicates if an error caused a reversion to a different type of compressed update (TRUE or FALSE). - **ElapsedTickCount** Time taken for expand phase. - **EndFreeSpace** Free space after expand phase. @@ -6072,7 +6337,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6090,10 +6355,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean to indicate whether a cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. - **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). @@ -6108,7 +6374,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6125,7 +6391,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6151,7 +6417,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6171,7 +6437,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6187,7 +6453,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6205,7 +6471,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6214,14 +6480,16 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6240,7 +6508,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6263,7 +6531,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6296,7 +6564,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6306,7 +6574,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6364,7 +6632,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6528,7 +6796,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6553,7 +6821,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6572,7 +6840,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6611,9 +6879,35 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6664,7 +6958,7 @@ The following fields are available: ### Value -This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. +This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -6691,7 +6985,7 @@ The following fields are available: ### WheaProvider.WheaErrorRecord -This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. +This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -6712,7 +7006,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.DatastoreMigratedVersion -This event provides information about the datastore migration and whether it was successful. +This event provides information about the datastore migration and whether it was successful. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -6723,7 +7017,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.GetCallerViaWdsp -This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. +This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. The data collected with this event is used to help keep Windows secure and performing properly. The following fields are available: @@ -6820,7 +7114,7 @@ The following fields are available: - **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. - **AttemptNumber** The total number of attempts to acquire this product. -- **BundleId** The identity of the test build (flight) associated with this product. +- **BundleId** The bundle ID - **CategoryId** The identity of the package or packages being installed. - **ClientAppId** The identity of the app that initiated this operation. - **HResult** HResult code to show the result of the operation (success/failure). @@ -6830,7 +7124,7 @@ The following fields are available: - **IsRemediation** Is this repairing a previous installation? - **IsRestore** Is this happening after a device restore? - **IsUpdate** Is this an update? -- **ParentBundleId** The product identifier of the parent if this product is part of a bundle. +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). - **PFN** Product Family Name of the product being installed. - **ProductId** The Store Product ID for the product being installed. - **SystemAttemptNumber** The number of attempts by the system to acquire this product. @@ -7133,7 +7427,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7149,7 +7443,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7164,7 +7458,44 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed + +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure Error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Release Channel. +- **wUfBConnected** Result of Windows Update for Business connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Device in the semi-annual channel. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted + +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. @@ -7172,7 +7503,7 @@ This event sends basic information indicating that Feature Rollback has started. ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7206,7 +7537,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7242,7 +7573,7 @@ The following fields are available: - **groupConnectionCount** The total number of connections made to peers in the same group. - **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group. - **isEncrypted** TRUE if the file is encrypted and will be decrypted after download. -- **isThrottled** Indicates the Event Rate was throttled (event represent aggregated data). +- **isThrottled** Event Rate throttled (event represents aggregated data). - **isVpn** Is the device connected to a Virtual Private Network? - **jobID** Identifier for the Windows Update job. - **lanConnectionCount** The total number of connections made to peers in the same LAN. @@ -7262,7 +7593,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7282,7 +7613,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7319,7 +7650,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7341,7 +7672,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7357,7 +7688,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7381,7 +7712,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7397,7 +7728,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7424,7 +7755,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7442,7 +7773,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7458,7 +7789,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7473,7 +7804,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7499,7 +7830,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7516,7 +7847,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7533,7 +7864,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7550,7 +7881,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7567,7 +7898,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7585,9 +7916,36 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **callContext** List of telemetry activities containing this error. +- **currentContextId** Identifier for the newest telemetry activity containing this error. +- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any). +- **currentContextName** Name of the newest telemetry activity containing this error. +- **failureCount** Number of failures. +- **failureId** Id of the failure. +- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast). +- **fileName** Source code file name where the error occurred. +- **function** Function where the failure occurred. +- **hresult** Failure error code. +- **lineNumber** Line number within the source code file where the error occurred. +- **message** Custom message associated with the failure (if any). +- **module** Name of the binary where the error occurred. +- **originatingContextId** Identifier for the oldest telemetry activity containing this error +- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any). +- **originatingContextName** Name of the oldest telemetry activity containing this error. +- **PartA_PrivTags** Privacy tags. +- **threadId** Identifier of the thread the error occurred on. +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7598,7 +7956,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7610,7 +7968,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7622,7 +7980,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7641,7 +7999,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -7683,7 +8041,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7699,7 +8057,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -7714,9 +8072,30 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.DTUEnabled + +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wuDeviceid** Device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.DTUInitiated + +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **dtuErrorCode** Return code from creating the DTU Com Server. +- **isDtuApplicable** Determination of whether DTU is applicable to the machine it is running on. +- **utilizeDtuOverWu** Whether DTU should be utilized over Windows Update. +- **wuDeviceid** Device ID used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7733,7 +8112,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7743,7 +8122,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event indicates that the update is no longer applicable to this device. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7760,7 +8139,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -7777,7 +8156,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -7803,7 +8182,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7817,7 +8196,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -7829,7 +8208,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7838,7 +8217,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -7857,7 +8236,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -7869,7 +8248,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -7881,7 +8260,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7898,7 +8277,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -7911,7 +8290,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -7924,7 +8303,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7934,7 +8313,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -7950,7 +8329,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7960,9 +8339,21 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel + +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** The current battery charge capacity. +- **batteryLevelThreshold** The battery capacity threshold to stop update activity. +- **updatePhase** The current state of the update process. +- **wuDeviceid** The device identifier. + + ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorInvalidSignature -This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. +This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7973,18 +8364,18 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkInvalidCmd -Event to indicate a critical error with the callback binary requested by the updater +This event indicates a critical error with the callback binary requested by the updater. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **updaterCmdLine** The callback executable for the updater. -- **updaterId** The ID of the updater. -- **wuDeviceid** The Windows Update device identifier. +- **updaterCmdLine** The command line requested by the updater. +- **updaterId** The ID of the updater that requested the work. +- **wuDeviceid** WU device ID. ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8004,7 +8395,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8017,7 +8408,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdaterCallbackFailed -This event is sent when an updater failed to execute the registered callback. +This event is sent when an updater failed to execute the registered callback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8029,7 +8420,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8055,7 +8446,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8065,7 +8456,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8081,7 +8472,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8103,7 +8494,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8112,7 +8503,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8132,7 +8523,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8152,7 +8543,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8179,7 +8570,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8203,7 +8594,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8225,7 +8616,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8246,11 +8637,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.BeginScenario -This event is sent when the Update Reserve Manager is called to begin a scenario. +This event is sent when the Update Reserve Manager is called to begin a scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8266,7 +8678,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ClearReserve -This event is sent when the Update Reserve Manager clears one of the reserves. +This event is sent when the Update Reserve Manager clears one of the reserves. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8277,7 +8689,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8287,7 +8699,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.EndScenario -This event is sent when the Update Reserve Manager ends an active scenario. +This event is sent when the Update Reserve Manager ends an active scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8303,7 +8715,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8316,7 +8728,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeReserves -This event is sent when reserves are initialized on the device. +This event is sent when reserves are initialized on the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8345,7 +8757,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8360,7 +8772,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8370,7 +8782,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ReevaluatePolicy -This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. +This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8381,13 +8793,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.TurnOffReserves -This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. +This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8402,7 +8814,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md new file mode 100644 index 0000000000..218ce9d25c --- /dev/null +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -0,0 +1,91 @@ +--- +title: Changes to Windows diagnostic data collection +description: This article provides information on changes to Windows diagnostic data collection Windows 10. +keywords: privacy, diagnostic data +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +audience: ITPro +ms.author: siosulli +author: DaniHalfin +manager: dansimp +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/21/2020 +--- + +# Changes to Windows diagnostic data collection + +**Applies to** +- Windows 10, version 1903 and newer +- The next version of Windows Server + +Microsoft is committed to providing you with effective controls over your data and ongoing transparency into our data handling practices. As part of this effort, we are moving our major products and services to a model where data sent back to Microsoft from customer devices will be classified as either **Required** or **Optional**. We believe this will provide our customers with a simpler experience – information should be easier to find, easier to understand, and easier to act upon through the tools we provide. + +This topic is meant for IT administrators and explains the changes Windows is making to align to the new data collection taxonomy. These changes are focused in two areas: + +- [Taxonomy changes](#taxonomy-changes) +- [Behavioral changes](#behaviorial-changes) + +> [!NOTE] +> You can test the behavioral changes now in Windows 10 Insider Preview build 19577 and later. + +## Summary of changes + +In Windows 10, version 1903 and newer, you will see taxonomy updates in both the **Out-of-box-experience** (OOBE) and the **Diagnostics & feedback** privacy settings page. These changes are explained in the section named **Taxonomy** changes. + +Additionally, in an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. We’re also clarifying the Security diagnostic data level to more accurately reflect its behavior by changing it to **Diagnostic data off**. All of these changes are explained in the section named **Behavioral changes**. + +## Taxonomy changes + +Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience** (OOBE) and the **Diagnostics & feedback** privacy setting pages will reflect the following changes: + +- The **Basic** diagnostic data level is being labeled as **Required**. +- The **Full** diagnostic data level is being labeled as **Optional**. + +> [!IMPORTANT] +> No action is required for the taxonomy changes, and your existing settings will be maintained as part of this update. + +## Behaviorial changes + +In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be migrated to the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see the section named, **Services that rely on Enhanced diagnostic data**, later in this topic. Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see the section named **Configure a Windows 10 device to limit crash dumps and logs**. For more information on services that rely on Enhanced diagnostic data, see **Services that rely on Enhanced diagnostic data**. + +Additionally, you will see the following policy changes in an upcoming release of Windows 10: + +| Policy type | Current policy | Renamed policy | +| --- | --- | --- | +| Group Policy | Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Telemetry**
        • **0 - Security**
        • **1 - Basic**
        • **2 - Enhanced**
        • **3 - Full**
        | Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**
        • **Diagnostic data off (not recommended)**
        • **Send required diagnostic data**
        • **Send optional diagnostic data**
        | +| Group Policy |Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure telemetry opt-in settings user interface**| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure diagnostic data opt-in settings user interface** | +| Group Policy |Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure telemetry opt-in change notifications**| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure diagnostic data opt-in change notifications** | + +A final set of changes includes two new policies that can help you fine-tune diagnostic data collection within your organization. These policies let you limit the amount of optional diagnostic data that’s sent back to Microsoft. + +- The **Limit dump collection** policy is a new policy that can be used to limit the types of [crash dumps](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) that can be sent back to Microsoft. If this policy is enabled, Windows Error Reporting will send only kernel mini dumps and user mode triage dumps. + - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection** + - MDM policy: System/LimitDumpCollection +- The **Limit diagnostic log collection** policy is another new policy that limits the number of diagnostic logs that are sent back to Microsoft. If this policy is enabled, diagnostic logs are not sent back to Microsoft. + - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection** + - MDM policy: System/LimitDiagnosticLogCollection + +>[!Important] +>All of the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier. + +## Configure a Windows 10 device to limit crash dumps and logs + +With the Enhanced diagnostic data level being split out into new policies, we're providing additional controls to manage what types of crash dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them: + +1. Choose to send optional diagnostic data by setting one of the following policies: + - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**. Set the policy value to **Send optional diagnostic data**. + - MDM: System/AllowTelemetry. Set the policy value to **3**. +2. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection** +3. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection** + +## Services that rely on Enhanced diagnostic data + +Customers who use services that depend on Windows diagnostic data, such as Microsoft Managed Desktop or Desktop Analytics, may be impacted by the behavioral changes when they are released. These services will be updated to address these changes and guidance will be published on how to configure them properly. + +The following provides information on the current configurations: +- [Microsoft Managed Desktop](https://aka.ms/mmd-diagnostic-data-level) +- [Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 518fe19374..36baec913b 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -13,433 +13,223 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 04/29/2019 +ms.date: 10/13/2020 --- # Configure Windows diagnostic data in your organization **Applies to** -- Windows 10 Enterprise -- Windows 10 Mobile -- Windows Server +- Windows 10 Enterprise +- Windows 10 Education +- Windows Server 2016 and newer -This article applies to Windows and Windows Server diagnostic data only. It describes the types of diagnostic data we may gather, the ways you might manage it in your organization, and some examples of how diagnostic data can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers. +This article applies to Windows 10, Windows Server, Surface Hub, and HoloLens diagnostic data only. It describes the types of diagnostic data that’s sent back to Microsoft and the ways you can manage it within your organization. Microsoft uses the data to quickly identify and address issues affecting its customers. -Use this article to make informed decisions about how you might configure diagnostic data in your organization. Diagnostic data is a term that means different things to different people and organizations. For this article, we discuss diagnostic data as system data that is uploaded by the Connected User Experiences and Telemetry component. Microsoft uses diagnostic data to keep Windows secure and up to date, troubleshoot problems, and make product improvements. +>[!IMPORTANT] +>Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). -We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. +## Overview -## Overview of Windows diagnostic data +Microsoft collects Windows diagnostic data to solve problems and to keep Windows up to date, secure, and operating properly. It also helps us improve Windows and related Microsoft products and services and, for customers who have turned on the **Tailored experiences** setting, to provide more relevant tips and recommendations to enhance Microsoft and third-party products and services for the customer’s needs. -At Microsoft, we use Windows diagnostic data to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data gives users a voice in the operating system’s development. This guide describes the importance of Windows diagnostic data and how we protect that data. Additionally, it differentiates between diagnostic data and functional data. It also describes the diagnostic data levels that Windows supports. Of course, you can choose how much diagnostic data is shared with Microsoft, and this guide demonstrates how. - -To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways: - -- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools. -- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions. -- **Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection. -- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right. -- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system. Customer content inadvertently collected is kept confidential and not used for user targeting. -- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers. - -In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM. - -For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization. - -## Understanding Windows diagnostic data - -Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us. - -The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts. - -### What is Windows diagnostic data? - -Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways: - -- Keep Windows up to date -- Keep Windows secure, reliable, and performant -- Improve Windows – through the aggregate analysis of the use of Windows -- Personalize Windows engagement surfaces - -Here are some specific examples of Windows diagnostic data: - -- Type of hardware being used -- Applications installed and usage details -- Reliability information on device drivers - -### What is NOT diagnostic data? - -Diagnostic data can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not diagnostic data. For example, exchanging a user’s location for local weather or news is not an example of diagnostic data—it is functional data that the app or service requires to satisfy the user’s request. - -There are subtle differences between diagnostic data and functional data. Windows collects and sends diagnostic data in the background automatically. You can control how much information is gathered by setting the diagnostic data level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). -On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data. - -If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services/). - -The following are specific examples of functional data: - -- Current location for weather -- Bing searches -- Wallpaper and desktop settings synced across multiple devices +For more information about how Windows diagnostic data is used, see [Diagnostics, feedback, and privacy in Windows 10](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy). ### Diagnostic data gives users a voice -Windows and Windows Server diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits. +Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behaves in the real world, focus on user priorities, and make informed decisions that benefit both consumer and enterprise customers. The following sections offer real examples of these benefits. -### Improve app and driver quality +### _Improve app and driver quality_ -Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues. +Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers used on Windows. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues. -#### Real-world example of how Windows diagnostic data helps +For example, in an earlier version of Windows 10 there was a version of a video driver that was crashing on some devices, causing the device to restart. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls. -There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls. +### _Improve end-user productivity_ -### Improve end-user productivity - -Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are: +Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls. - **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time. + - **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance. -- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature. -**These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.** - -### Insights into your own organization - -Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better. Microsoft provides a set of solutions that leverage information shared by customers to provide insights customized for your internal use. The first of these was [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness), followed by [Desktop Analytics](https://aka.ms/DADocs). Both help organizations with [Windows as a Service](/windows/deployment/update/wass-overview) adoption and potential compatibility challenges. For E5 customers, [Microsoft Defender Advanced Threat Protection](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. +- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between apps. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature. ## How Microsoft handles diagnostic data -The diagnostic data is categorized into four levels: - -- [**Security**](#security-level). Information that’s required to help keep Windows and Windows Server secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. - -- [**Basic**](#basic-level). Basic device info, including: quality-related data, app compatibility, and data from the **Security** level. - -- [**Enhanced**](#enhanced-level). Additional insights, including: how Windows, Windows Server, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels. - -- [**Full**](#full-level). Includes information about the websites you browse, how you use apps and features, plus additional information about device health, device activity (sometimes referred to as usage), and enhanced error reporting. At Full, Microsoft also collects the memory state of your device when a system or app crash occurs. It includes data from the **Security**, **Basic**, and **Enhanced** levels. - -Diagnostic data levels are cumulative, meaning each subsequent level includes data collected through lower levels. For more information see the [Diagnostic data levels](#diagnostic-data-levels) section. +Use the following sections to learn more about how Microsoft handles diagnostic data. ### Data collection -Windows 10 and Windows Server includes the Connected User Experiences and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores diagnostic data events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. +Depending on the diagnostic data settings on the device, diagnostic data can be collected via the following methods: -1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces. -1. Events are gathered using public operating system event logging and tracing APIs. -1. You can configure the diagnostic data level by using MDM policy, Group Policy, or registry settings. -1. The Connected User Experiences and Telemetry component transmits the diagnostic data. + - Small payloads of structured information referred to as diagnostic data events, managed by the Connected User Experiences and Telemetry component. + + - Diagnostic logs for additional troubleshooting, also managed by the Connected User Experience and Telemetry component. + + - Crash reporting and crash dumps, managed by [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). -Info collected at the Enhanced and Full levels of diagnostic data is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels. +Later in this document we provide further details about how to control what’s collected and what data can be included in these different types of diagnostic data. ### Data transmission -All diagnostic data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. - -The data transmitted at the Basic and Enhanced data diagnostic levels is quite small; typically less than 1 MB per device per day, but occasionally up to 2 MB per device per day. +All diagnostic data is encrypted using TLS and uses certificate pinning during transfer from the device to the Microsoft data management services. ### Endpoints -The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access. +The following table lists the endpoints related to how you can manage the collection and control of diagnostic data. For more information around the endpoints that are used to send data back to Microsoft, see [Manage connection endpoints for Windows 10 Enterprise, version 1903](manage-windows-1903-endpoints.md). -Solutions like Desktop Analytics or Microsoft Defender Advanced Threat Protection need Windows devices to reach diagnostics endpoints which enable organizations to leverage solutions based on diagnostics data. These solutions leverage Windows components like the Connected User Experiences and Telemetry service, Windows Defender Advanced Threat Protection service, Windows Error Reporting, and Online Crash Analysis. - -For a complete list of diagnostics endpoints leveraged by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/configmgr/desktop-analytics/enable-data-sharing). -For a complete list of diagnostics endpoints leveraged by Microsoft Defender Advanced Threat Protection, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). - -The following table defines the endpoints for Connected User Experiences and Telemetry component: - -| Windows release | Endpoint | +| Windows service | Endpoint | | - | - | -| Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed | **Diagnostics data:** v10c.vortex-win.data.microsoft.com

        **Functional:** v20.vortex-win.data.microsoft.com

        **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,
        for example: **de**.vortex-win.data.microsoft.com

        **Settings:** settings-win.data.microsoft.com | -| Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | **Diagnostics data:** v10.events.data.microsoft.com

        **Functional:** v20.vortex-win.data.microsoft.com

        **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,
        for example: **de**.vortex-win.data.microsoft.com

        **Settings:** settings-win.data.microsoft.com | -| Windows 10, version 1709 or earlier | **Diagnostics data:** v10.vortex-win.data.microsoft.com

        **Functional:** v20.vortex-win.data.microsoft.com

        **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,
        for example: **de**.vortex-win.data.microsoft.com

        **Settings:** settings-win.data.microsoft.com | +|Connected User Experiences and Telemetry | v10.events.data.microsoft.com

        v10c.events.data.microsoft.com

        v10.vortex-win.data.microsoft.com | +| [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting) | watson.telemetry.microsoft.com

        watson.microsoft.com

        umwatsonc.telemetry.microsoft.com

        umwatsonc.events.data.microsoft.com

        *-umwatsonc.events.data.microsoft.com

        ceuswatcab01.blob.core.windows.net

        ceuswatcab02.blob.core.windows.net

        eaus2watcab01.blob.core.windows.net

        eaus2watcab02.blob.core.windows.net

        weus2watcab01.blob.core.windows.net

        weus2watcab02.blob.core.windows.net | +|Authentication | login.live.com



        IMPORTANT: This endpoint is used for device authentication. We do not recommend disabling this endpoint.| +| [Online Crash Analysis](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) | oca.telemetry.microsoft.com

        oca.microsoft.com

        kmwatsonc.telemetry.microsoft.com

        *-kmwatsonc.telemetry.microsoft.com | +|Settings | settings-win.data.microsoft.com



        IMPORTANT: This endpoint is used to remotely configure diagnostics-related settings and data collection. For example, we use the settings endpoint to remotely block an event from being sent back to Microsoft. We do not recommend disabling this endpoint. This endpoint does not upload Windows diagnostic data | -The following table defines **additional diagnostics endpoints** not covered by services in the links above: +### Data access -| Service | Endpoint | -| - | - | -| OneDrive app for Windows 10 | | - -The following table defines the endpoints for other diagnostic data services: - -| Service | Endpoint | -| - | - | -| [Windows Error Reporting](https://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com | -| | ceuswatcab01.blob.core.windows.net | -| | ceuswatcab02.blob.core.windows.net | -| | eaus2watcab01.blob.core.windows.net | -| | eaus2watcab02.blob.core.windows.net | -| | weus2watcab01.blob.core.windows.net | -| | weus2watcab02.blob.core.windows.net | -| [Online Crash Analysis](https://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com | -| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 | -| Microsoft Defender Advanced Threat Protection |
        | - -### Data use and access - -The principle of least privileged access guides access to diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. +The principle of least privileged access guides access to Windows diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). Microsoft may share business reports with hardware manufacturers and third-party partners that include aggregated and deidentified diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. ### Retention -Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history. +Microsoft believes in and practices data minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. For more information on how long data is retained, see the section named **Our retention of personal data** in the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). -## Manage enterprise diagnostic data level +## Diagnostic data settings -### Enterprise management +There are four diagnostic data collection settings. Each setting is described in more detail in the sections that follow. -Sharing diagnostic data with Microsoft is enabled by default on Windows 10, 1903 and later. Sharing this data provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option. +- Diagnostic data off (Security) +- Required diagnostic data (Basic) +- Enhanced +- Optional diagnostic data (Full) -Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, in **Privacy** > **Diagnostics & feedback**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available. +Here’s a summary of the types of data that is included with each setting: -IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this article describes how to use group policy to configure levels and settings interface. +| | Diagnostic data off (Security) | Required (Basic) | Enhanced | Optional (Full) | +| --- | --- | --- | --- | --- | +| **Diagnostic data events** | No Windows diagnostic data sent. | Minimum data required to keep the device secure, up to date, and performing as expected. | Additional data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. | Additional data about the websites you browse, how Windows and apps are used and how they perform. This data also includes data about device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users.| +| **Crash Metadata** | N/A | Yes | Yes | Yes | +| **Crash Dumps** | N/A | No | Triage dumps only

        For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). | Full memory dumps

        For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). | +| **Diagnostic logs** | N/A | No | No | Yes | +| **Data collection** | N/A | 100% | Sampling applies | Sampling applies | -#### Manage your diagnostic data settings -Use the steps in this article to set and/or adjust the diagnostic data settings for Windows and Windows Server in your organization. +### Diagnostic data off -> [!IMPORTANT] -> These diagnostic data levels only apply to Windows and Windows Server components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](/deployoffice/privacy/overview-privacy-controls). +This setting was previously labeled as **Security**. When you configure this setting, no Windows diagnostic data is sent from your device. This is only available on Windows Server, Windows 10 Enterprise, and Windows 10 Education. If you choose this setting, devices in your organization will still be secure. -The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server is **Enhanced**. +>[!NOTE] +> If your organization relies on Windows Update, the minimum recommended setting is **Required diagnostic data**. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. -### Configure the diagnostic data level +### Required diagnostic data -You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device. +Required diagnostic data, previously labeled as **Basic**, gathers a limited set of data that’s critical for understanding the device and its configuration. This data helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. + +This is the default setting for Windows 10 Education editions, as well as all desktop editions starting with Windows 10, version 1903. + +Required diagnostic data includes: + +- Basic device data that helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Servers in the ecosystem. Examples include: + + - Device attributes, such as camera resolution and display type + - Battery attributes, such as capacity and type + - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number + - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware + - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system + - Operating system attributes, such as Windows edition and virtualization state + - Storage attributes, such as number of drives, type, and size + +- Quality metrics that helps provide an understanding about how the Connected User Experiences and diagnostic data component is functioning, including % of uploaded events, dropped events, blocked events, and the last upload time. + +- Quality-related information that helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and app state change details, such as how much processor time and memory were used, and the total uptime for an app. + +- Compatibility data that helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems. + +- System data that helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS. + +- A list of accessory device data, such as printers or external storage devices, that are connected to Windows devices and whether these devices will function after upgrading to a new version of the operating system. + +- Driver data that includes specific driver activity that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements. + +- Information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses. + +### Enhanced diagnostic data + +>[!NOTE] +>We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). + +Enhanced diagnostic data includes data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. When you choose to send enhanced diagnostic data, required diagnostic data will always be included, and we collect the following additional information: + + - Operating system events that help to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components. + + - Operating system app events resulting from Microsoft apps and management tools that were downloaded from the Microsoft Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge. + + - Device-specific events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. + + - All crash dump types, except for heap dumps and full dumps. For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). + + ### Optional diagnostic data + +Optional diagnostic data, previously labeled as **Full**, includes more detailed information about your device and its settings, capabilities, and device health. Optional diagnostic data also includes data about the websites you browse, device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users. When you choose to send optional diagnostic data, required diagnostic data will always be included, and we collect the following additional information: + + - Additional data about the device, connectivity, and configuration, beyond that collected under required diagnostic data. + + - Status and logging information about the health of operating system and other system components beyond what is collected under required diagnostic data. + + - App activity, such as which programs are launched on a device, how long they run, and how quickly they respond to input. + + - Browser activity, including browsing history and search terms, in Microsoft browsers (Microsoft Edge or Internet Explorer). + + - Enhanced error reporting, including the memory state of the device when a system or app crash occurs (which may unintentionally contain user content, such as parts of a file you were using when the problem occurred). Crash data is never used for Tailored experiences. + +>[!Note] +>Crash dumps collected in optional diagnostic data may unintentionally contain personal data, such as portions of memory from a document and a web page. For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). + +## Manage enterprise diagnostic data + +Use the steps in this section to configure the diagnostic data settings for Windows and Windows Server in your organization. + +>[!IMPORTANT] +>These diagnostic data settings only apply to components, features, and apps that are considered a part of the Windows operating system. Third-party apps and other Microsoft apps, such as Microsoft Office, that customers install may also collect and send diagnostic data using their own controls. You should work with your app vendors to understand their diagnostic data policy, and how you can opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](https://docs.microsoft.com/deployoffice/privacy/overview-privacy-controls). If you would like to control Windows data collection that is not Windows diagnostic data, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). + +You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy or MDM. Use the appropriate value in the table below when you configure the management policy. -| Level | Value | +| Category | Value | | - | - | -| Security | **0** | -| Basic | **1** | -| Enhanced | **2** | -| Full | **3** | +|Diagnostic data off (Security) | 0 | +| Required (Basic) | 1 | +| Enhanced | 2 | +|Optional (Full) | 3 | - > [!NOTE] - > When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used. +>[!Note] +>When both the Computer Configuration policy and User Configuration policies are set, the more restrictive policy is used. -### Use Group Policy to set the diagnostic data level +### Use Group Policy to manage diagnostic data collection -Use a Group Policy object to set your organization’s diagnostic data level. +You can use Group Policy to set your organization’s diagnostic data setting: -1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**. +1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**. -1. Double-click **Allow Telemetry**. - -1. In the **Options** box, select the level that you want to configure, and then click **OK**. - -### Use MDM to set the diagnostic data level - -Use the [Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy. - -### Use Registry Editor to set the diagnostic data level - -Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting. - -1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection**. - -1. Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**. - -1. Type **AllowTelemetry**, and then press ENTER. - -1. Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.** - -1. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization. - -### Additional diagnostic data controls - -There are a few more settings that you can turn off that may send diagnostic data information: - -- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/index/). - -- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**. - -- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716). - -- Turn off **Improve inking and typing** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary. +2. Double-click **Allow Telemetry**. > [!NOTE] - > Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. + > If devices in your organization are running Windows 10, 1803 and newer, the user can still use Settings to set the diagnostic data setting to a more restrictive value, unless the **Configure diagnostic data opt-in settings user interface** policy is set. -## Diagnostic data levels +3. In the **Options** box, choose the setting that you want to configure, and then click **OK**. -These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server. +### Use MDM to manage diagnostic data collection -### Security level +Use [Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy. -The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions. +## Limit optional diagnostic data for Desktop Analytics -> [!NOTE] -> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. +For more information about how to limit the diagnostic data to the minimum required by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/enable-data-sharing). -Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager functionality is not affected at this level, nor is diagnostic data about Windows Server features or System Center gathered. +## Change privacy settings on a single server -The data gathered at this level includes: +You can also change the privacy settings on a server running either the Azure Stack HCI operating system or Windows Server. For more information, see [Change privacy settings on individual servers](https://docs.microsoft.com/azure-stack/hci/manage/change-privacy-settings). -- **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop). - -- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address. - - > [!NOTE] - > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716). - -- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address. - - > [!NOTE] - > This reporting can be turned off and no information is included if a customer is using third-party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender). - - Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, Microsoft Endpoint Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates. - -For servers with default diagnostic data settings and no Internet connectivity, you should set the diagnostic data level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity. - -No user content, such as user files or communications, is gathered at the **Security** diagnostic data level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time. - -### Basic level - -The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experiences and Telemetry component does not gather diagnostic data about System Center, but it can transmit diagnostic data for other non-Windows applications if they have user consent. - -This is the default level for Windows 10 Education editions, as well as all desktop editions starting with Windows 10, version 1903. - -The normal upload range for the Basic diagnostic data level is between 109 KB - 159 KB per day, per device. - -The data gathered at this level includes: - -- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Servers in the ecosystem. Examples include: - - - Device attributes, such as camera resolution and display type - - Internet Explorer version - - Battery attributes, such as capacity and type - - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number - - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware - - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system - - Operating system attributes, such as Windows edition and virtualization state - - Storage attributes, such as number of drives, type, and size - -- **Connected User Experiences and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experiences and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time. - -- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app. - -- **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems. - - - **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage. - - - **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade. - - - **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS. - - - **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system. - - - **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements. - -- **Microsoft Store**. Provides information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses. - -### Enhanced level - -The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements. - -This level is needed to quickly identify and address Windows and Windows Server quality issues. - -The normal upload range for the Enhanced diagnostic data level is between 239 KB - 348 KB per day, per device. - -The data gathered at this level includes: - -- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components. - -- **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge. - -- **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. - -- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps. - -If the Connected User Experiences and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experiences and Telemetry component at the **Enhanced** diagnostic data level will only gather data about the events associated with the specific issue. - -### Full level - -The Full level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the Basic, Enhanced, and Security levels. - -Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level. - -If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** diagnostic data level and have exhibited the problem. - -However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information: - -- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe. - -- Ability to get registry keys. - -- All crash dump types, including heap dumps and full dumps. - -> [!NOTE] -> Crash dumps collected at this diagnostic data level may unintentionally contain personal data, such as portions of memory from a documents, a web page, etc. - -## Limit Enhanced diagnostic data to the minimum required by Desktop Analytics - -> [!IMPORTANT] -> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported. -> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement). - -Desktop Analytics reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events. - -In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. - -- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic. - -- **Some crash dump types.** Triage dumps for user mode and mini dumps for kernel mode. - -> [!NOTE] -> Triage dumps are a type of [minidumps](https://docs.microsoft.com/windows/desktop/debug/minidump-files) that go through a process of user-sensitive information scrubbing. Some user-sensitive information may be missed in the process, and will therefore be sent with the dump. - -With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data. - -### Enable limiting enhanced diagnostic data to the minimum required by Desktop Analytics - -1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM. - - a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Allow telemetry** setting to **2**. - - -OR- - - b. Using MDM, use the Policy CSP to set the **System/AllowTelemetry** value to **2**. - - -AND- - -1. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM. - - a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**. - - -OR- - - b. Using MDM, use the Policy CSP to set the **System/LimitEnhancedDiagnosticDataWindowsAnalytics** value to **1**. - -## Additional resources - -FAQs - -- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy) -- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) -- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy) -- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy) -- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) -- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq) -- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) -- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) -- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization) - -Blogs - -- [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10) - -Privacy Statement - -- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) - -TechNet - -- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) - -Web Pages - -- [Privacy at Microsoft](https://privacy.microsoft.com) +To manage privacy settings in your enterprise as a whole, see [Manage enterprise diagnostic data](#manage-enterprise-diagnostic-data). diff --git a/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md b/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md new file mode 100644 index 0000000000..20b56e6e79 --- /dev/null +++ b/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md @@ -0,0 +1,324 @@ +--- +title: Data processor service for Windows Enterprise public preview terms +description: Use this article to understand Windows public preview terms of service. +keywords: privacy, GDPR +ms.localizationpriority: high +ROBOTS: NOINDEX, NOFOLLOW +ms.prod: w10 +ms.topic: article +f1.keywords: +- NOCSH +ms.author: siosulli +author: DaniHalfin +manager: dansimp +audience: itpro +ms.collection: +- GDPR +- M365-security-compliance +--- + +# Data processor service for Windows Enterprise public preview terms + +**These terms (“Terms”) must be read and accepted by a tenant admin with appropriate access rights and authority. By participating in this public preview, you: (a) agree to the following Terms, and (b) represent and warrant that you have such rights and authority.** + +These Terms govern your use of the preview described below (“**Preview**”). In order to access the Preview, you must be a current Microsoft Windows customer with an Azure Active Directory (“**AAD**”) subscription. The Preview consists of features and services that are in preview, beta, or other pre-release form for use with Windows and AAD. + + 1. **Definitions**. The following terms have the following meanings: + + 1. "**Customer Data**" means all data, including all text, sound, video, or image files that are provided to Microsoft by, or on behalf of, you through your use of Windows or AAD. + + 2. "**Feedback**" means, collectively, suggestions, comments, feedback, ideas, or know-how, in any form, that you or your users provide to Microsoft about Microsoft’s business, products, or services. + + 3. "**Personal Data**" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. + + 4. "**Preview Data**" means all data, including all text, sound, video, or image files that are provided to Microsoft by, or on behalf of, you through use of the Services. + + 5. "**Subprocessor**" means other processors used by Microsoft to process Personal Data. + +2. **Scope of Services**. The Preview is for a service that enables organizations to become controllers of Windows diagnostic data on supported versions of Windows, with Microsoft operating as processor of the data (collectively, the “**_Services_**”). You will collaborate with Microsoft in order to provide Microsoft the ability to enable the Services for you. To access the Services, you will need to configure participating Windows devices; Microsoft will assist you in such configuration via documentation or other communications. + +3. **Intellectual Property**. + + 1. **License Grant**. During the term of this Preview (“**Term**”), Microsoft grants you and authorized users in your tenant for Windows a non-exclusive, non-transferable, non-sublicensable right and license to access and use the Services in accordance with these Terms. + + 2. **Use Terms**. These Terms supersede any Microsoft terms and conditions or other agreement. You acknowledge that (i) the Services may not work correctly or in the manner that a commercial service may function; Microsoft may change the Services for the final, commercial version or choose not to release a commercial version; (ii) Microsoft may not provide support for the Services; (iii) the Online Services Terms (OST), including any obligations Microsoft may have regarding Customer Data, do not apply to the Services or Preview Data; (iv) Microsoft has no obligation to hold, export, or return Preview Data, except as described in these Terms; (v) Microsoft has no liability for the deletion of Preview Data, except as described in these Terms; and (vi) you may lose access to the Services and Preview Data after the Term. + + 3. **Acceptable Use**. Neither you, nor those that access the Services through you, may: (a) use the Services: (i) in a way prohibited by law, regulation, governmental order or decree; (ii) to violate the rights of others; (iii) to try to gain unauthorized access to or disrupt any service, device, data, account or network; (iv) to spam or distribute malware; or (v) in a way that could harm the Services or impair anyone else’s use of it; or (b) reverse engineer, decompile, disassemble, or work around any technical limitations in the Services, or use the Services to create a competing product. You are responsible for responding to any third-party request regarding your use of the Services or Preview Data, such as a request to take down Preview Data under the U.S. Digital Millennium Copyright Act or other applicable laws. + + 4. **Data Collection, Use and Location**. The Microsoft Privacy Statement https://privacy.microsoft.com/privacystatement applies to the collection, use and location of Preview Data. In the event of a conflict between Privacy Statement and the terms of these Terms, the terms of these Terms will control. + +4. **Confidentiality**. The following confidentiality terms apply to the Preview: + + 1. During the Term plus 5 years, the parties will hold in strictest confidence and not use or disclose to any third party any Confidential Information of the other party. “Confidential Information” means all non-public information a party designates in writing or orally as being confidential, or which under the circumstances of disclosure ought to be treated as confidential. Confidential Information includes information relating to:

        + 1. a party’s released or unreleased software or hardware products;

        + 2. a party’s source code;

        + 3. a party’s product marketing or promotion;

        + 4. a party’s business policies or practices;

        + 5. a party’s customers or suppliers;

        + 6. information received from others that a party must treat as confidential; and

        + 7. information provided, obtained, or created by a party under these Terms, including: + * information in reports; + * the parties’ electronic or written correspondence, customer lists and customer information, regardless of source; + * Personal Data; and + * Transactional, sales, and marketing information. + + 2. A party will consult with the other if it questions what comprises Confidential Information. Confidential Information excludes information (i) known to a party before the disclosing party’s disclosure to the receiving party, (ii) information publicly available through no fault of the receiving party, (iii) received from a third party without breach of an obligation owed to the disclosing party, or (iv) independently developed by a party without reference to or use of the disclosing party’s Confidential Information. + + 3. Each party will employ security procedures to prevent disclosure of the other party’s Confidential Information to unauthorized third parties. The receiving party’s security procedures must include risk assessment and controls for:

        + 1. system access;

        + 2. system and application development and maintenance;

        + 3. change management;

        + 4. asset classification and control;

        + 5. incident response, physical and environmental security;

        + 6. disaster recovery/business continuity; and

        + 7. employee training. + +5. **Data Protection.** + + **Generally**. To the extent Microsoft is a processor of Personal Data, the General Data Protection Regulation (GDPR) Terms in Attachment 1 govern that processing and the parties also agree to the following terms: + + 1. Processing Details: The parties agree that: + * The subject-matter of the processing is limited to Personal Data within the scope of the GDPR; + * The duration of the processing shall be for the duration of your right to use the Services and until all Personal Data is deleted or returned in accordance with your instructions or these Terms; + * The nature and purpose of the processing shall be to provide the Services pursuant to these Terms; + * The types of Personal Data processed by the Services include those expressly identified in Article 4 of the GDPR to the extent included by Preview Data; and + * The categories of data subjects are your representatives and end users, such as employees, contractors, collaborators, and customers. + + 2. Data Transfers: + * Preview Data and Personal Data that Microsoft processes on your behalf may be transferred to, and stored and processed in, the United States or any other country in which Microsoft or its Subprocessors operate. You appoint Microsoft to perform any such transfer of Preview Data and Personal Data to any such country and to store and process Preview Data and Personal Data to provide the Services. + * All transfers of Preview Data and Personal Data out of the European Union, European Economic Area, United Kingdom, and Switzerland to provide the Online Services shall be governed by the Standard Contractual Clauses in Attachment 2. + * Microsoft will abide by the requirements of European Economic Area and Swiss data protection law regarding the collection, use, transfer, retention, and other processing of Personal Data from the European Economic Area and Switzerland. All transfers of Personal Data to a third country or an international organization will be subject to appropriate safeguards as described in Article 46 of the GDPR and such transfers and safeguards will be documented according to Article 30(2) of the GDPR. + * In addition, Microsoft is certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks and the commitments they entail. Microsoft agrees to notify you in the event that it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Privacy Shield principles. + +6. **No Support or Incident Response.** Microsoft will have no obligation under these Terms to correct any bugs, defects or errors in the Services or AAD, provide any updates, upgrades or new releases, or otherwise provide any technical support or maintenance for any Services or AAD. You will make reasonable efforts to promptly report to Microsoft any defects you find in the Services, as an aid to creating improved revisions of the Services. Microsoft will have no obligation under these Terms to provide you with incident response as part of the Services. + +7. **Term and Termination.** The term of the Preview begins when you accept these Terms and continues until: (a) either party terminates this Preview by providing the other party: (i) 2 days’ notice for any reason (or no reason), or (ii) notice of such party’s breach of these Terms and such party fails to cure within 15 days, or (b) upon the general availability of the Services. When the Term ends, you will no longer have access to the Services, and Microsoft will no longer have the rights to access Customer Data granted herein. Each party will, on request, return or destroy the other’s Confidential Information provided under the Preview. + +8. **Feedback.** Providing Feedback is voluntary. Microsoft is under no obligation to post or use any Feedback. By providing Feedback to Microsoft, you (and anyone providing Feedback through your use of the Preview) irrevocably and perpetually grant to Microsoft and its affiliates, under all of its (and their) owned or controlled intellectual property rights, a worldwide, non-exclusive, fully paid-up, royalty-free, transferable, sub-licensable right and license to make, use, reproduce, prepare derivative works based upon, distribute, publicly perform, publicly display, transmit, and otherwise commercialize the Feedback (including by combining or interfacing products, services or technologies that depend on or incorporate Feedback with other products, services or technologies of Microsoft or others), without attribution in any way and for any purpose. You warrant that (a) you will not provide Feedback that is subject to a license requiring Microsoft to license anything to third parties because Microsoft exercises any of the above rights in your Feedback; and (b) you own or otherwise control all of the rights to such Feedback and that no such Feedback is subject to any third-party rights (including any personality or publicity rights). + +9. **Representations and Warranties; Limitation of Liability.** + + 1. **By the Parties.** Each party represents and warrants to the other party that (a) it has all necessary rights, title, and authority to enter into and perform under these Terms; (b) its performance under these Terms will not breach any agreement with a third party; and (c) it will comply with any and all laws, rules, and regulations that are applicable to its performance under these Terms. + + 2. **Disclaimer.** EXCEPT AS OTHERWISE PROVIDED IN THESE TERMS AND TO THE EXTENT APPLICABLE LAW PERMITS, MICROSOFT (a) PROVIDES THE SERVICES AS-IS; (b) PROVIDES NO WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE; AND (c) DOES NOT GUARANTEE THAT THE SERVICES WILL BE AVAILABLE, UNINTERRUPTED, OR ERROR-FREE, OR THAT LOSS OF PREVIEW DATA WILL NOT OCCUR. + + 3. **Limitation of Liability.** Except as otherwise described in this Section 9, the only remedy either party has for claims relating to these Terms or participation in the Preview is to terminate these Terms or your participation in the Preview. NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY FOR ANY DAMAGES, INCLUDING DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR DAMAGES FOR LOST REVENUE, LOST PROFIT, LOST BUSINESS INFORMATION, OR BUSINESS INTERRUPTION, EVEN IF THE PARTY KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES. The limitations in this Section 9 do not apply to claims arising from any breach of confidentiality obligations under Section 4. + +10. **General.** + + 1. **Non-Exclusivity.** These Terms are nonexclusive. These Terms do not restrict either party from entering into the same or similar arrangement with any third party. + + 2. **Jurisdiction and Governing Law.** The laws of the State of Washington, excluding conflicts of law provisions, govern these Terms. If federal jurisdiction exists, then each party consents to exclusive jurisdiction and venue in the federal courts in King County, Washington. If no federal jurisdiction exists, then each party consents to exclusive jurisdiction and venue in the Superior Court of King County, Washington. + + 3. **Force Majeure.** A party will not be liable for failure to perform an obligation under these Terms to the extent that failure is due to a cause beyond that party’s reasonable control, including natural disaster, war, civil disturbance, or governmental action. + + 4. **Attorneys’ fees.** If a party employs attorneys to enforce any rights arising out of or relating to these Terms, the prevailing party will be entitled to recover its reasonable attorneys’ fees, costs, and other expenses. + + 5. **Assignment**. You may not assign these Terms or delegate any of your rights or obligations under these Terms to a third party without Microsoft’s prior written consent. + + 6. **Entire Agreement.** These Terms are the entire agreement between the parties regarding its subject matter and replaces all prior agreements, communications, and representations between the parties regarding its subject matter. + + 7. **Survival.** Sections 3.b, 4, 7 (with respect to post-termination obligations), and 8-10 will survive these Terms’ expiration or termination.

        + +

        + Attachment 1: GDPR Terms
        + +For purposes of these GDPR Terms, you and Microsoft agree that you are the controller of Personal Data and Microsoft is the processor of such data, except when you act as a processor of Personal Data, in which case Microsoft is a subprocessor. These GDPR Terms apply to the processing of Personal Data, within the scope of the GDPR, by Microsoft on your behalf. These GDPR Terms do not limit or reduce any data protection commitments Microsoft makes to you in other agreement between Microsoft and you. These GDPR Terms do not apply where Microsoft is a controller of Personal Data. + +**Relevant GDPR Obligations: Articles 28, 32, and 33** + +1. Microsoft shall not engage another processor without prior specific or your general written authorization. In the case of general written authorization, Microsoft shall inform you of any intended changes concerning the addition or replacement of other processors, thereby giving you the opportunity to object to such changes. (Article 28(2)) +2. Processing by Microsoft shall be governed by these GDPR Terms under European Union (hereafter “Union”) or Member State law and are binding on Microsoft with regard to you. The subject-matter and duration of the processing, the nature and purpose of the processing, the type of Personal Data, the categories of data subjects and your obligations and rights are set forth in the Terms above, including these GDPR Terms. In particular, Microsoft shall: + + 1. process the Personal Data only on your documented instructions, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by Union or Member State law to which Microsoft is subject; in such a case, Microsoft shall inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; + + 2. ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; + + 3. take all measures required pursuant to Article 32 of the GDPR; + + 4. respect the conditions referred to in paragraphs 1 and 3 for engaging another processor; + + 5. taking into account the nature of the processing, assist you by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of your obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR; + + 6. assist you in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to Microsoft; + + 7. at your choice, delete or return all the Personal Data to you after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the Personal Data; + + 8. make available to you all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you. + + 9. immediately inform you if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. (Article 28(3)) + +3. Where Microsoft engages another processor for carrying out specific processing activities on your behalf, the same data protection obligations as set out in these GDPR Terms shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR. Where that other processor fails to fulfil its data protection obligations, Microsoft shall remain fully liable to you for the performance of that other processor's obligations. (Article 28(4)) + +4. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, you and Microsoft shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: + + 1. the pseudonymisation and encryption of Personal Data; + + 2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; + + 3. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and + + 4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. (Article 32(1)) + +5. In assessing the appropriate level of security, account shall be taken of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise processed. (Article 32(2)) + +6. You and Microsoft shall take steps to ensure that any natural person acting under your authority or Microsoft’s who has access to Personal Data does not process them except on instructions from you, unless he or she is required to do so by Union or Member State law. (Article 32(4)) + +7. Microsoft shall notify you without undue delay after becoming aware of a personal data breach. (Article 33(2)). Such notification will include that information a processor must provide to a controller under Article 33(3) to the extent such information is reasonably available to Microsoft. + +

        + Attachment 2 – The Standard Contractual Clauses (Processors)
        + +In countries where regulatory approval is required for use of the Standard Contractual Clauses, the Standard Contractual Clauses cannot be relied upon under European Commission 2010/87/EU (of February 2010) to legitimize export of data from the country, unless Customer has the required regulatory approval. +Beginning May 25, 2018 and thereafter, references to various Articles from the Directive 95/46/EC in the Standard Contractual Clauses below will be treated as references to the relevant and appropriate Articles in the GDPR. +For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, Customer (as data exporter) and Microsoft Corporation (as data importer, whose signature appears below), each a “party,” together “the parties,” have agreed on the following Contractual Clauses (the “Clauses” or “Standard Contractual Clauses”) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1. + +**Clause 1: Definitions** + +1. 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; +1. 'the data exporter' means the controller who transfers the personal data; +1. 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC; +1. 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract; +1. 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established; +1. 'technical and organizational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing. + +**Clause 2: Details of the transfer** + +The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 below which forms an integral part of the Clauses. + +**Clause 3: Third-party beneficiary clause** + +1. The data subject can enforce against the data exporter this Clause, Clause 4(2) to (9), Clause 5(1) to (5), and (7) to (10), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary. +2.1.exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. +1. The data subject can enforce against the subprocessor this Clause, Clause 5(1) to (5) and (7), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses. +1. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law. + +**Clause 4: Obligations of the data exporter** + +The data exporter agrees and warrants: + +1. that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State; +1. that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses; +1. that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 below; +1. that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation; +1. that it will ensure compliance with the security measures; +1. that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC; +1. to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(2) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension; +1. to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information; +1. that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and +1. that it will ensure compliance with Clause 4(1) to (9). + +**Clause 5: Obligations of the data importer** + +The data importer agrees and warrants: + +1. to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; +1. that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; +1. that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred; +1. that it will promptly notify the data exporter about: + 1. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation, + 1. any accidental or unauthorised access, and + 1. any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so; +1. to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; +1. at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; +1. to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; +1. that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent; +1. that the processing services by the subprocessor will be carried out in accordance with Clause 11; and +1. to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter. + +**Clause 6: Liability** + +1. The parties agree that any data subject who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered. +1. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity. +The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities. +1. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses. + +**Clause 7: Mediation and jurisdiction** + +1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject: + 1. to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority; + 1. to refer the dispute to the courts in the Member State in which the data exporter is established. +1. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law. + +**Clause 8: Cooperation with supervisory authorities** + +1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law. +1. The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law. +1. The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (2). + +**Clause 9: Governing Law** + +The Clauses shall be governed by the law of the Member State in which the data exporter is established. + +**Clause 10: Variation of the contract** + +The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause. + +**Clause 11: Subprocessing** + +1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement. +1. The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses. +1. The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established. +1. The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority. + +**Clause 12: Obligation after the termination of personal data processing services** + +1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. +1. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1. + +**Appendix 1 to the Standard Contractual Clauses** + +**Data exporter**: Customer is the data exporter. The data exporter is a user of the Services. + +**Data importer**: The data importer is MICROSOFT CORPORATION, a global producer of software and services. + +**Data subjects**: Data subjects include the data exporter’s representatives and end-users including employees, contractors, collaborators, and customers of the data exporter. Data subjects may also include individuals attempting to communicate or transfer personal information to users of the services provided by data importer. Microsoft acknowledges that, depending on Customer’s use of the Services, Customer may elect to include personal data from any of the following types of data subjects in the personal data: + +* Employees, contractors and temporary workers (current, former, prospective) of data exporter; +* Dependents of the above; +* Data exporter's collaborators/contact persons (natural persons) or employees, contractors or temporary workers of legal entity collaborators/contact persons (current, prospective, former); +* Users (e.g., customers, clients, patients, visitors, etc.) and other data subjects that are users of data exporter's services; +* Partners, stakeholders or individuals who actively collaborate, communicate or otherwise interact with employees of the data exporter and/or use communication tools such as apps and websites provided by the data exporter; +* Stakeholders or individuals who passively interact with data exporter (e.g., because they are the subject of an investigation, research or mentioned in documents or correspondence from or to the data exporter); +* Minors; or +* Professionals with professional privilege (e.g., doctors, lawyers, notaries, religious workers, etc.). + +**Categories of data**: The personal data transferred that is included in data processed by the Services. Microsoft acknowledges that, depending on Customer’s use of the Services, Customer may elect to include personal data from any of the following categories in the personal data: + +* Basic personal data (for example place of birth, street name and house number (address), postal code, city of residence, country of residence, mobile phone number, first name, last name, initials, email address, gender, date of birth), including basic personal data about family members and children; +* Authentication data (for example user name, password or PIN code, security question, audit trail); +* Contact information (for example addresses, email, phone numbers, social media identifiers; emergency contact details); +* Unique identification numbers and signatures (for example Social Security number, bank account number, passport and ID card number, driver's license number and vehicle registration data, IP addresses, employee number, student number, patient number, signature, unique identifier in tracking cookies or similar technology); +* Pseudonymous identifiers; +* Financial and insurance information (for example insurance number, bank account name and number, credit card name and number, invoice number, income, type of assurance, payment behavior, creditworthiness); +* Commercial Information (for example history of purchases, special offers, subscription information, payment history); +* Biometric Information (for example DNA, fingerprints and iris scans); +* Location data (for example, Cell ID, geo-location network data, location by start call/end of the call. Location data derived from use of wifi access points); +* Photos, video and audio; +* Internet activity (for example browsing history, search history, reading, television viewing, radio listening activities); +* Device identification (for example IMEI-number, SIM card number, MAC address); +* Profiling (for example based on observed criminal or anti-social behavior or pseudonymous profiles based on visited URLs, click streams, browsing logs, IP-addresses, domains, apps installed, or profiles based on marketing preferences); +* HR and recruitment data (for example declaration of employment status, recruitment information (such as curriculum vitae, employment history, education history details), job and position data, including worked hours, assessments and salary, work permit details, availability, terms of employment, tax details, payment details, insurance details and location and organizations); +* Education data (for example education history, current education, grades and results, highest degree achieved, learning disability); +* Citizenship and residency information (for example citizenship, naturalization status, marital status, nationality, immigration status, passport data, details of residency or work permit); +* Information processed for the performance of a task carried out in the public interest or in the exercise of an official authority; +* Special categories of data (for example racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, data concerning a natural person’s sex life or sexual orientation, or data relating to criminal convictions or offences); or +* Any other personal data identified in Article 4 of the GDPR. + +**Processing operations**: The personal data transferred will be subject to the following basic processing activities: + +1. **Duration and Object of Data Processing**. The duration of data processing shall be for the term of the Preview. The objective of the data processing is the performance of the Services. +1. **Scope and Purpose of Data Processing**. The scope and purpose of processing personal data is described in Section 5 of this agreement. The data importer operates a global network of data centers and management/support facilities, and processing may take place in any jurisdiction where data importer or its sub-processors operate such facilities. +1. **Customer Data and Personal Data Access**. For the term designated under the applicable volume licensing agreement data importer will at its election and as necessary under applicable law implementing Article 12(b) of the EU Data Protection Directive, either: (1) provide data exporter with the ability to correct, delete, or block Customer Data and personal data, or (2) make such corrections, deletions, or blockages on its behalf. +1. **Data Exporter’s Instructions**. For Online Services and Professional Services, data importer will only act upon data exporter’s instructions as conveyed by Microsoft. +1. **Preview Data and Personal Data Deletion or Return**. Upon expiration or termination of data exporter’s use of the Services, it may extract Customer Data and personal data and data importer will delete Customer Data and personal data, each in accordance with the terms of this agreement. + +**Subcontractors**: In accordance with the DPA, the data importer may hire other companies to provide limited services on data importer’s behalf, such as providing customer support. Any such subcontractors will be permitted to obtain Customer Data and personal data only to deliver the services the data importer has retained them to provide, and they are prohibited from using Customer Data and personal data for any other purpose. + +**Appendix 2 to the Standard Contractual Clauses** + +Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(4) and 5(3): + +1. **Personnel**. Data importer’s personnel will not process Preview Data or personal data without authorization. Personnel are obligated to maintain the confidentiality of any such Preview Data and personal data and this obligation continues even after their engagement ends. +2. **Data Privacy Contact**. The data privacy officer of the data importer can be reached at the following address:
        Microsoft Corporation
        Attn: Chief Privacy Officer
        1 Microsoft Way
        Redmond, WA 98052 USA +3. **Technical and Organization Measures**. The data importer has implemented and will maintain appropriate technical and organizational measures, internal controls, and information security routines intended to protect Preview Data and personal data, as defined in Attachment 1 of this agreement, against accidental loss, destruction, or alteration; unauthorized disclosure or access; or unlawful destruction as follows: The technical and organizational measures, internal controls, and information security routines set forth in Attachment 1 of this agreement are hereby incorporated into this Appendix 2 by this reference and are binding on the data importer as if they were set forth in this Appendix 2 in their entirety. diff --git a/windows/privacy/deploy-data-processor-service-windows.md b/windows/privacy/deploy-data-processor-service-windows.md new file mode 100644 index 0000000000..76db1e584d --- /dev/null +++ b/windows/privacy/deploy-data-processor-service-windows.md @@ -0,0 +1,96 @@ +--- +title: Technical Deployment of the data processor service for Windows Enterprise +description: Use this article to understand how to deploy and manage the data processor service for Windows Enterprise. +keywords: privacy, GDPR +ms.localizationpriority: high +ROBOTS: NOINDEX, NOFOLLOW +ms.prod: w10 +ms.topic: article +f1.keywords: +- NOCSH +ms.author: siosulli +author: DaniHalfin +manager: dansimp +audience: itpro +ms.collection: +- GDPR +- M365-security-compliance +--- + +# Data processor service for Windows Enterprise Overview + +>[!NOTE] +>This topic is intended for participants in the data processor service for Windows Enterprise preview program and requires acceptance of specific terms of use. To learn +more about the program and agree to the terms of use, see [https://aka.ms/WindowsEnterprisePublicPreview](https://aka.ms/WindowsEnterprisePublicPreview). + +The privacy landscape keeps evolving, and with it, we make changes to our services to meet our customers’ needs. +The data processor service for Windows Enterprise empowers you to be in control of diagnostic data from Windows devices, and act as data controllers for that data, under the definition of the European Union General Data Protection Regulation (GDPR). + +The data processor service for Windows Enterprise will serve as a foundation for other Microsoft services that use Windows diagnostic data. + +The data processor service for Windows Enterprise offering enables you to store and manage your Windows diagnostic data in the cloud, on top of an end-to-end data platform designed and built with compliance in mind, to help you meet your compliance obligations. +Your data is routed and stored inside an enterprise compliance boundary, operating under a prescriptive and focused set of compliance requirements, in accordance with industry standards. + +The data processor service for Windows Enterprise provides you with controls that help respond to delete data subject requests (DSRs) on diagnostic data, at user account closure, for a specific Azure AD User ID. Additionally, you’re able to execute an export DSR for a specific Azure AD User ID. +Should you desire so, Microsoft will accommodate a data processor service for Windows Enterprise tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for diagnostic data, but still wish to remain an Azure customer. + +>[!Note] +>Tenant account closure will lead to the deletion of all data associated with that tenant. + +## Deployment of data processor service for Windows Enterprise +Use the instructions below to easily manage the data processor service for Windows Enterprise using a single setting, through Group Policy, or an MDM solution, in Windows 10, version 1809 or Windows Server 2019 and newer. + +### Prerequisites +#### Versions supported +The data processor service for Windows Enterprise is currently supported on Windows 10, version 1809, and newer versions. + +#### Network requirements +The following endpoints need to be reachable from devices enrolled into the data processor service for Windows Enterprise: + + login.live.com + + cy2.vortex.data.microsoft.com.akadns.net + + v10.events.data.microsoft.com + + v10.vortex-win.data.microsoft.com/collect/v1 + +For additional information, see the “device authentication” and “diagnostic data” sections in the endpoint articles for each respective Windows version: + +[Windows 10, version 1809 endpoints](https://docs.microsoft.com/Windows/privacy/manage-Windows-1809-endpoints) + +[Windows 10, version 1903 endpoints](https://docs.microsoft.com/Windows/privacy/manage-Windows-1903-endpoints) + +### Deploying data processor service for Windows Enterprise +You can use either Group Policy or an MDM solution to deploy the data processor service for Windows Enterprise to your supported devices. + +In Group Policy, to enable data collection through the data processor service for Windows Enterprise, go to **Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds** and switch the **Allow commercial data pipeline** setting to **enabled**. + +If you wish to disable, at any time, switch the same setting to **disabled**. The default state of the above setting is **disabled**. + +To use an MDM solution, such as [Microsoft Intune](https://docs.microsoft.com/intune/custom-settings-Windows-10), to deploy the data processor service for Windows Enterprise to your supported devices, use the following custom OMA-URI setting configuration: + +- **Name:** System/AllowCommercialDataPipeline +- **OMA-URI:** ./Vendor/MSFT/Policy/Config/System/AllowCommercialDataPipeline +- **Data type:** Integer + +Under **Value**, use **1** to enable the service. + +If you wish to disable, at any time, switch the same setting to **0** to disable. The default is **0**. + +>[!Note] +>Data collected from a device, before it was enrolled into the data processor service for Windows Enterprise, will not be moved into the enterprise compliance boundary. + +## Managing data processor service for Windows Enterprise +### Executing user-based data subject requests (DSRs) +To perform user-based DSRs, the data processor service for Windows Enterprise requires your organization to be reflected in Azure AD. + +If your environment is cloud-only and managed in Azure, or all your devices are Azure AD joined - you don’t need to take any further action. + +If your environment uses on-premises Active Directory to manage identities - Azure AD Connect synchronization is required, and your environment needs to be configured for hybrid Azure AD join. +To learn more, visit [How To: Plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) and [Azure AD Connect sync: Understand and customize synchronization](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-whatis). + +Once you have Azure AD join or hybrid Azure AD join in place, you can learn more about executing user-based DSRs, by visiting this [page](https://review.docs.microsoft.com/microsoft-365/compliance/gdpr-dsr-windows?branch=siosulli-wps&view=o365-worldwide). + +## Geo-location +Windows Diagnostic Data collected through the data processor service for Windows Enterprise is hosted in our datacenter in the United States. \ No newline at end of file diff --git a/windows/privacy/docfx.json b/windows/privacy/docfx.json index f7ff32cbfe..bb7dfb718c 100644 --- a/windows/privacy/docfx.json +++ b/windows/privacy/docfx.json @@ -33,6 +33,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.technology": "windows", "audience": "ITPro", "ms.topic": "article", @@ -45,8 +46,19 @@ "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Windows Privacy" + "titleSuffix": "Windows Privacy", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, + "searchScope": ["Windows 10"] + }, "fileMetadata": {}, "template": [], "dest": "privacy", diff --git a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md index 41c5fa5a8a..4188fd5ad3 100644 --- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md +++ b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md @@ -30,7 +30,7 @@ ms.reviewer: Desktop Analytics reports are powered by diagnostic data not included in the Basic level. -In Windows 10, version 1709, we introduced a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). +In Windows 10, version 1709, we introduced a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only the events described below. The Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data. @@ -48,7 +48,7 @@ The following fields are available: - **GhostCount_Sum:** Total number of instances where the application stopped responding - **HandleCountAtExit_Sum:** Total handle count for a process when it exits - **HangCount_Max:** Maximum number of hangs detected -- **HangCount_Sum:** Total number of application hangs detected +- **HangCount_Sum:** Total number of application hangs that are detected - **HardFaultCountAtExit_Sum:** Total number of hard page faults detected for a process when it exits - **HeartbeatCount:** Heartbeats logged for this summary - **HeartbeatSuspendedCount:** Heartbeats logged for this summary where the process was suspended @@ -68,7 +68,7 @@ The following fields are available: - **WriteSizeInKBAtExit_Sum:** Total size of IO writes for a process when it exited ## Microsoft.Office.TelemetryEngine.IsPreLaunch -Applicable for Office UWP applications. This event is fired when an office application is initiated for the first-time post upgrade/install from the store. This is part of basic diagnostic data, used to track whether a particular session is launch session or not. +Applicable for Office UWP applications. This event is fired when an Office application is initiated for the first-time post upgrade/install from the store. It's part of basic diagnostic data. It's used to track whether a particular session is a launch session or not. - **appVersionBuild:** Third part of the version *.*.XXXXX.* - **appVersionMajor:** First part of the version X.*.*.* @@ -77,10 +77,10 @@ Applicable for Office UWP applications. This event is fired when an office appli - **SessionID:** ID of the session ## Microsoft.Office.SessionIdProvider.OfficeProcessSessionStart -This event sends basic information upon the start of a new Office session. This is used to count the number of unique sessions seen on a given device. This is used as a heartbeat event to ensure that the application is running on a device or not. In addition, it serves as a critical signal for overall application reliability. +This event sends basic information upon the start of a new Office session. It's used to count the number of unique sessions seen on a given device. The event is used as a heartbeat event to ensure that the application is running on a device. In addition, it serves as a critical signal for overall application reliability. -- **AppSessionGuid:** ID of the session which maps to the process of the application -- **processSessionId:** ID of the session which maps to the process of the application +- **AppSessionGuid:** ID of the session that maps to the process of the application +- **processSessionId:** ID of the session that maps to the process of the application ## Microsoft.Office.TelemetryEngine.SessionHandOff Applicable to Win32 Office applications. This event helps us understand whether there was a new session created to handle a user-initiated file open event. It is a critical diagnostic information that is used to derive reliability signal and ensure that the application is working as expected. @@ -89,7 +89,7 @@ Applicable to Win32 Office applications. This event helps us understand whether - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **childSessionID:** Id of the session that was created to handle the user initiated file open +- **childSessionID:** ID of the session that was created to handle the user initiated file open - **parentSessionId:** ID of the session that was already running ## Microsoft.Office.CorrelationMetadata.UTCCorrelationMetadata @@ -102,15 +102,15 @@ Collects Office metadata through UTC to compare with equivalent data collected t - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRevision:** Fourth part of the version *.*.*.XXXXX -- **audienceGroup:** Is this part of the insiders or production +- **audienceGroup:** Is this group part of the insiders or production? - **audienceId:** ID of the audience setting - **channel:** Are you part of Semi annual channel or Semi annual channel-Targeted? -- **deviceClass:** Is this a desktop or a mobile? +- **deviceClass:** Is this device a desktop device or a mobile device? - **impressionId:** What features were available to you in this session - **languageTag:** Language of the app - **officeUserID:** A unique identifier tied to the office installation on a particular device. - **osArchitecture:** Is the machine 32 bit or 64 bit? -- **osEnvironment:** Is this a win32 app or a UWP app? +- **osEnvironment:** Is this app a win32 app or a UWP app? - **osVersionString:** Version of the OS - **sessionID:** ID of the session @@ -131,7 +131,7 @@ This event is fired when the telemetry engine within an office application is re - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.FirstProcessed @@ -141,7 +141,7 @@ This event is fired when the telemetry engine within an office application has p - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.FirstRuleRequest @@ -151,7 +151,7 @@ This event is fired when the telemetry engine within an office application has r - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.Init @@ -161,18 +161,18 @@ This event is fired when the telemetry engine within an office application has b - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.Resume -This event is fired when the application resumes from sleep state. Used for understanding whether there are issues in the application life-cycle. +This event is fired when the application resumes from sleep state. Used for understanding whether there are issues in the application life cycle. - **appVersionBuild:** Third part of the version *.*.XXXXX.* - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX - **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session @@ -183,7 +183,7 @@ This event is fired when the telemetry engine within an office application fails - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.RuleRequestFailedDueToClientOffline @@ -193,7 +193,7 @@ This event is fired when the telemetry engine within an office application fails - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **SessionID:** ID of the session ## Microsoft.Office.TelemetryEngine.ShutdownComplete @@ -204,7 +204,7 @@ This event is fired when the telemetry engine within an office application has p - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX - **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session @@ -215,7 +215,7 @@ This event is fired when the telemetry engine within an office application been - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session @@ -227,26 +227,26 @@ This event is fired when the telemetry engine within an office application has p - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX - **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session - **SuspendType:** Type of suspend ## Microsoft.Office.TelemetryEngine.SuspendStart -This event is fired when the office application suspends as per app life-cycle change. Used for understanding whether there are issues in the application life-cycle. +This event is fired when the office application suspends as per app life-cycle change. Used for understanding whether there are issues in the application life cycle. - **appVersionBuild:** Third part of the version *.*.XXXXX.* - **appVersionMajor:** First part of the version X.*.*.* - **appVersionMinor:** Second part of the version *.X.*.* - **appVersionRev:** Fourth part of the version *.*.*.XXXXX - **maxSequenceIdSeen:** How many events from this session have seen so far? -- **officeUserID:** This is an ID of the installation tied to the device. It does not map to a particular user +- **officeUserID:** ID of the installation tied to the device. It does not map to a particular user - **rulesSubmittedBeforeResume:** How many events were submitted before the process was resumed? - **SessionID:** ID of the session - **SuspendType:** Type of suspend ## Microsoft.OSG.OSS.CredProvFramework.ReportResultStop -This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve logon reliability. Using this event with Desktop Analytics can help organizations monitor and improve logon success for different methods (for example, biometric) on managed devices. +This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve sign-in reliability. Using this event with Desktop Analytics can help organizations monitor and improve sign-in success for different methods (for example, biometric) on managed devices. The following fields are available: @@ -262,11 +262,11 @@ The following fields are available: - **ReturnCode:** Output of the ReportResult function - **SessionId:** Session identifier - **Sign-in error status:** The sign-in error status -- **SubStatus:** Sign-in error sub-status +- **SubStatus:** Sign-in error substatus - **UserTag:** Count of the number of times a user has selected a provider ## Microsoft.Windows.Kernel.Power.OSStateChange -This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Desktop Analytics, organizations can use this to monitor reliability and performance of managed devices +This event denotes the transition between operating system states (On, Off, Sleep, etc.). By using this event with Desktop Analytics, organizations can monitor reliability and performance of managed devices. The following fields are available: @@ -281,10 +281,10 @@ The following fields are available: - **EnergyChangeV2Flags:** Flags for disambiguating EnergyChangeV2 context - **EventSequence:** A sequential number used to evaluate the completeness of the data - **LastStateTransition:** ID of the last operating system state transition -- **LastStateTransitionSub:** ID of the last operating system sub-state transition +- **LastStateTransitionSub:** ID of the last operating system substate transition - **StateDurationMS:** Number of milliseconds spent in the last operating system state - **StateTransition:** ID of the operating system state the system is transitioning to -- **StateTransitionSub:** ID of the operating system sub-state the system is transitioning to +- **StateTransitionSub:** ID of the operating system substate the system is transitioning to - **TotalDurationMS:** Total time (in milliseconds) spent in all states since the last boot - **TotalUptimeMS:** Total time (in milliseconds) the device was in Up or Running states since the last boot - **TransitionsToOn:** Number of transitions to the Powered On state since the last boot @@ -305,7 +305,7 @@ Sends details about any error codes detected during a failed sign-in. The following fields are available: - **ntsStatus:** The NTSTATUS error code status returned from an attempted sign-in -- **ntsSubstatus:** The NTSTATUS error code sub-status returned from an attempted sign-in +- **ntsSubstatus:** The NTSTATUS error code substatus returned from an attempted sign-in ## Microsoft.Windows.Security.Biometrics.Service.BioServiceActivityCapture Indicates that a biometric capture was compared to known templates @@ -327,7 +327,7 @@ The following field is available: - **ticksSinceBoot:** Duration of boot event (milliseconds) ## Microsoft.Windows.Shell.Desktop.LogonFramework.AllLogonTasks -This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Desktop Analytics organizations can help identify logon problems on managed devices. +This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Desktop Analytics, organizations can help identify logon problems on managed devices. The following fields are available: @@ -341,7 +341,7 @@ The following fields are available: - **wilActivity:** Indicates errors in the task to help Microsoft improve reliability. ## Microsoft.Windows.Shell.Desktop.LogonFramework.LogonTask -This event describes system tasks which are part of the user logon sequence and helps Microsoft to improve reliability. +This event describes system tasks that are part of the user logon sequence and helps Microsoft to improve reliability. The following fields are available: @@ -359,7 +359,7 @@ For a device subject to Windows Information Protection policy, learning events a The following fields are available: - **actiontype:** Indicates what type of resource access the app was attempting (for example, opening a local document vs. a network resource) when it encountered a policy boundary. Useful for Windows Information Protection administrators to tune policy rules. -- **appIdType:** Based on the type of application, this indicates what type of app rule a Windows Information Protection administrator would need to create for this app. +- **appIdType:** Based on the type of application, this field indicates what type of app rule a Windows Information Protection administrator would need to create for this app. - **appname:** App that triggered the event - **status:** Indicates whether errors occurred during WIP learning events @@ -397,11 +397,11 @@ The following fields are available: - **MonitorWidth:** Number of horizontal pixels in the application host monitor resolution - **MouseInputSec:** Total number of seconds during which there was mouse input - **NewProcessCount:** Number of new processes contributing to the aggregate -- **PartATransform_AppSessionGuidToUserSid:** Flag which influences how other parts of the event are constructed +- **PartATransform_AppSessionGuidToUserSid:** Flag that influences how other parts of the event are constructed - **PenInputSec:** Total number of seconds during which there was pen input - **SpeechRecognitionSec:** Total number of seconds of speech recognition - **SummaryRound:** Incrementing number indicating the round (batch) being summarized -- **TargetAsId:** Flag which influences how other parts of the event are constructed +- **TargetAsId:** Flag that influences how other parts of the event are constructed - **TotalUserOrDisplayActiveDurationMS:** Total time the user or the display was active (in milliseconds) - **TouchInputSec:** Total number of seconds during which there was touch input - **UserActiveDurationMS:** Total time that the user was active including all input methods @@ -415,7 +415,7 @@ The following fields are available: ## Revisions ### PartA_UserSid removed -A previous revision of this list stated that a field named PartA_UserSid was a member of the event Microsoft.Windows.LogonController.LogonAndUnlockSubmit. This was incorrect. The list has been updated to reflect that no such field is present in the event. +A previous revision of this list stated that a field named PartA_UserSid was a member of the event Microsoft.Windows.LogonController.LogonAndUnlockSubmit. This statement was incorrect. The list has been updated to reflect that no such field is present in the event. ### Office events added In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 16 events were added, describing Office app launch and availability. These events were added to improve the precision of Office data in Windows Analytics. diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md deleted file mode 100644 index 892203bace..0000000000 --- a/windows/privacy/gdpr-it-guidance.md +++ /dev/null @@ -1,308 +0,0 @@ ---- -title: Windows and the GDPR-Information for IT Administrators and Decision Makers -description: Use this topic to understand the relationship between users in your organization and Microsoft in the context of the GDPR (General Data Protection Regulation). -keywords: privacy, GDPR, windows, IT -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 05/11/2018 -ms.reviewer: ---- -# Windows and the GDPR: Information for IT Administrators and Decision Makers - -Applies to: -- Windows 10, version 1703 and newer -- Windows 10 Team Edition, version 1703 for Surface Hub -- Windows Server 2016 and newer -- Desktop Analytics - -This topic provides IT Decision Makers with a basic understanding of the relationship between users in an organization and Microsoft in the context of the GDPR (General Data Protection Regulation). You will also learn what role an IT organization plays for that relationship. - -For more information about the GDPR, see: -* [Microsoft GDPR Overview](https://aka.ms/GDPROverview) -* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq) -* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp) -* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted) - -## GDPR fundamentals - -Here are some GDPR fundamentals: - -* On May 25, 2018, this EU data privacy law is implemented. It sets a new global bar for data privacy rights, security, and compliance. -* The GDPR is fundamentally about protecting and enabling the privacy rights of individuals – both customers and employees. -* The European law establishes strict global data privacy requirements governing how organizations manage and protect personal data while respecting individual choice – no matter where data is sent, processed, or stored. -* A request by an individual to an organization to take an action on their personal data is referred to here as a *data subject request*, or *DSR*. - -Microsoft believes data privacy is a fundamental right, and that the GDPR is an important step forward for clarifying and enabling individual privacy rights. We also recognize that the GDPR required significant changes by organizations all over the world with regard to the discovery, management, protection, and reporting of personal data that is collected, processed, and stored within an organization. - -### What is personal data under the GDPR? - -Article 4 (1) of [the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=en) defines personal data as any information relating to an identified or identifiable person. There is no distinction between a person’s private, public, or work roles. As defined by the GDPR, personal data includes, but is not limited to: -* Name -* Email address -* Credit card numbers -* IP addresses -* Social media posts -* Location information -* Handwriting patterns -* Voice input to cloud-based speech services - -### Controller and processor under the GDPR: Who does what - -#### Definition - -The GDPR describes specific requirements for allocating responsibility for controller and processor activities related to personal data. Thus, every organization that processes personal data must determine whether it is acting as a controller or processor for a specific scenario. - -* **Controller**: GDPR Article 4 (7) defines the ‘controller’ as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. -* **Processor**: According to the GDPR Article 4 (8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. - -#### Controller scenario - -For example, when an organization is using Microsoft Windows Defender Advanced Threat Protection (ATP) to detect, investigate, and respond to advanced threats on their networks as part of their IT operations, that organization is collecting data from the user’s device – data, that might include personal data. In this scenario, the organization is the *controller* of the respective personal data, since the organization controls the purpose and means of the processing for data being collected from the devices that have Windows Defender ATP enabled. - -#### Processor scenario - -In the controller scenario described above, Microsoft is a *processor* because Microsoft provides data processing services to that controller (in the given example, an organization that subscribed to Windows Defender ATP and enabled it for the user’s device). As processor, Microsoft only processes data on behalf of the enterprise customer and does not have the right to process data beyond their instructions as specified in a written contract, such as the [Microsoft Product Terms and the Microsoft Online Services Terms (OST)](https://www.microsoft.com/licensing/product-licensing/products.aspx). - -## GDPR relationship between a Windows 10 user and Microsoft - -For Windows 10 services, Microsoft usually is the controller (with exceptions, such as Windows Defender ATP). The following sections describe what that means for the related data. - -### Types of data exchanged with Microsoft - -Microsoft collects data from or generates data through interactions with users of Windows 10 devices. This information can contain personal data, as defined in [Article 4 (1) of the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN), that may be used to provide, support, and improve Windows 10 services. - -Microsoft discloses data collection and privacy practices in detail, for example: -* As part of the Windows 10 installation; -* In the Windows 10 privacy settings; -* Via the web-based [Microsoft Privacy dashboard](https://account.microsoft.com/privacy); and -* In the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). - -It is important to differentiate between two distinct types of data Windows services are dealing with. - -#### Windows functional data - -A user action, such as performing a Skype call, usually triggers the collection and transmission of Windows *functional data*. Some Windows components and applications connecting to Microsoft services also exchange Windows functional data to provide user functionality. - -Some other examples of Windows functional data: -* The Weather app which can use the device’s location to retrieve local weather or community news. -* Wallpaper and desktop settings that are synchronized across multiple devices. - -For more info on how IT Professionals can manage Windows functional data sent from an organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). - -#### Windows diagnostic data - -Windows diagnostic data is used to keep the operating system secure and up-to-date, troubleshoot problems, and make product improvements. The data is encrypted before being sent back to Microsoft. - -Some examples of diagnostic data include: -* The type of hardware being used, information about installed apps and usage details, and reliability data on drivers running on the device. -* For users who have turned on “Tailored experiences”, it can be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for the needs of the user. - -Diagnostic data is categorized into the levels "Security", "Basic", "Enhanced", and "Full". For a detailed discussion about these diagnostic data levels please see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To find more about what information is collected and how it is handled, see [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data). - -> [!IMPORTANT] -> Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services. - -### Windows services where Microsoft is the processor under the GDPR - -Most Windows 10 services are controller services in terms of the GDPR – for both Windows functional data and Windows diagnostic data. But there are a few Windows services where Microsoft is a processor for functional data under the GDPR, such as [Desktop Analytics](https://aka.ms/dadocs), [Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor) and [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp). - ->[!NOTE] ->Both Desktop Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare)). - -#### Desktop Analytics - -> [!IMPORTANT] -> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported. -> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement). - -[Desktop Analytics](https://aka.ms/dadocs) is a cloud-based service that integrates with Configuration Manager. The service provides insight and intelligence for you to make more informed decisions about the update readiness of Windows Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise with data aggregated from millions of devices into the Desktop Analytics service. - -Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Desktop Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10. - -As a result, in terms of the GDPR, the organization that has subscribed to Desktop Analytics is acting as the controller, while Microsoft is the processor for Desktop Analytics. -> [!NOTE] -> The IT organization must explicitly enable Desktop Analytics for a device after the organization subscribes. - -> [!IMPORTANT] -> Desktop Analytics does not collect Windows Diagnostic data by itself. Instead, Desktop Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device. See [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/enable-data-sharing) - -#### Windows Defender ATP - -[Windows Defender ATP](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) is cloud-based service that collects and analyzes usage data from an organization’s devices to detect security threats. Some of the data can contain personal data as defined by the GDPR. Enrolled devices transmit usage data to Microsoft datacenters, where that data is analyzed, processed, and stored. The security operations center (SOC) of the organization can view the analyzed data using the [Windows Defender ATP portal](https://securitycenter.windows.com/). - -As a result, in terms of the GDPR, the organization that has subscribed to Windows Defender ATP is acting as the controller, while Microsoft is the processor for Windows Defender ATP. - -> [!NOTE] -> The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes. - -#### At a glance – Windows 10 services GDPR mode of operations - -The following table lists in what GDPR mode – controller or processor – Windows 10 services are operating. - -| Service | Microsoft GDPR mode of operation | -| --- | --- | -| Windows Functional data | Controller or Processor* | -| Windows Diagnostic data | Controller | -| Desktop Analytics | Processor | -| Windows Defender Advanced Threat Detection (ATP) | Processor | - -*Table 1: Windows 10 GDPR modes of operations for different Windows 10 services* - -*/*Depending on which application/feature this is referring to.* - -## Windows diagnostic data and Windows 10 - - -### Recommended Windows 10 settings - -Windows diagnostic data collection level for Windows 10 can be set by a user in Windows (*Start > Settings > Privacy > Diagnostics & feedback*) or by the IT department of an organization, using Group Policy or Mobile Device Management (MDM) techniques. - -* For Windows 10, version 1803 and version 1809, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Desktop Analytics](#desktop-analytics). - ->[!NOTE] ->For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). - -* For Windows 10, version 1709, and Windows 10, version 1703, the recommended Windows diagnostic level configuration for EEA and Switzerland commercial users is “Basic”. - ->[!NOTE] ->For Windows 7, Microsoft recommends [using Commercial Data Opt-in setting](/previous-versions/windows/it-pro/windows-7/ee126127(v=ws.10)) to facilitate upgrade planning to Windows 10. - -### Additional information for Desktop Analytics - -The basic functionality of Desktop Analytics works at the “Basic” diagnostic data level. Other functionality of Desktop Analytics, such as usage or health data for updated devices, require “Enhanced”. - -Those organizations who wish to share the smallest set of events for Desktop Analytics and have set the Windows diagnostic level to “Enhanced” can use the [“Limit Enhanced diagnostic data to the minimum required by Desktop Analytics”](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#limit-enhanced-diagnostic-data-to-the-minimum-required-by-desktop-analytics) setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Desktop Analytics. - -> [!NOTE] -> Additional information can be found at [Desktop Analytics and privacy](/sccm/desktop-analytics/privacy). - -## Controlling Windows 10 data collection and notification about it - -Windows 10 sends diagnostic data to Microsoft services, and some of that data can contain personal data. Both the user and the IT organization have the ability to control the transmission of that data to Microsoft. - -### Adjusting privacy settings by the user - -A user has the ability to adjust additional privacy settings in Windows by navigating to *Start > Settings > Privacy*. For example, a user can control if location is enabled or disabled, whether or not to transmit feedback on inking and typing input to Microsoft for improving the personal accuracy of these services, or if Windows collects activities for syncing it with other devices. - -For a standard user in an organization, some privacy settings might be controlled by their IT department. This is done using Group Policies or Mobile Device Management (MDM) settings. If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to *Start > Settings > Privacy*. As such, the user can only change some settings, but not all. - -### Users can lower the diagnostic level - -Starting with Windows 10, version 1803, a user can change the Windows diagnostics data level for their device below to what was set by their IT department. Organizations can allow or disallow this feature by configuring the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface** or the MDM policy **ConfigureTelemetryOptInSettingsUx**. - -If an IT organization has not disabled this policy, users within the organization can change their own Windows diagnostic data collection level in *Start > Settings > Privacy > Diagnostics & feedback*. For example, if the IT organization enabled this policy and set the level to “Full”, a user can modify the Windows diagnostics data level setting to “Basic”. - -### Notification at logon - -Windows 10, version 1803, and later can provide users with a notification during their logon. If the IT organization has not disabled the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications** or the MDM policy **ConfigureTelemetryOptInChangeNotification**, Windows diagnostic data notifications can appear at logon so that the users of a device are aware of the data collection. - -This notification can also be shown when the diagnostic level for the device was changed. For instance, if the diagnostic level on the device is set to “Basic” and the IT organization changes it to “Full”, users will be notified on their next logon. - -### Diagnostic Data Viewer (DDV) - -In Windows 10, version 1803 and later, users can invoke the [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) to see what Windows diagnostic data is collected on their local device. This app lets a user review the diagnostic data collected on his device that is being sent to Microsoft. The DDV groups the information into simple categories based on how it is used by Microsoft. - -A user can turn on Windows diagnostic data viewing by going to go to *Start > Settings > Privacy > Diagnostics & feedback*. Under the ‘Diagnostic data viewer’ section, the user has to enable the ‘If data viewing is enabled, you can see your diagnostics data’ option. After DDV is installed on the device, the user can start it by clicking the ‘Diagnostic Data Viewer’ in the ‘Diagnostic data viewer’ section of *Start > Settings > Privacy > Diagnostics & feedback*. - -Also, the user can delete all Windows diagnostic data collected from the device. This is done by clicking the ‘Delete’ button in the ‘Delete diagnostic data’ section of *Start > Settings > Privacy > Diagnostics & feedback*. - -### Windows 10 personal data services configuration - -Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization. - -IT Professionals that are interested in this configuration, see [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md). - -### Windows 10 connections to Microsoft - -To find out more about the network connections that Windows components make to Microsoft as well as the privacy settings that affect data shared with either Microsoft or apps, see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). This article describe how these settings can be managed by an IT Professional, and fronts an array of Windows version-specific articles. - -### At-a-glance: the relationship between an IT organization and the GDPR - -Because Microsoft is a controller for data collected by Windows 10, the user can work with Microsoft to satisfy GDPR requirements. While this relationship between Microsoft and a user is evident in a consumer scenario, an IT organization can influence that relationship in an enterprise scenario. For example, the IT organization has the ability to centrally configure the Windows diagnostic data level by using Group Policy or MDM settings. - -## Windows Server - -Windows Server follows the same mechanisms as Windows 10 for handling of personal data – for example, when collecting Windows diagnostic data. - -More detailed information about Windows Server and the GDPR is available at Beginning your General Data Protection Regulation (GDPR) journey for Windows Server. - -### Windows diagnostic data and Windows Server - -The lowest diagnostic data setting level supported on Windows Server 2016 and Windows Server 2019 through management policies is “Security”. The lowest diagnostic data setting supported through the Settings UI is “Basic”. The default diagnostic data level for all Windows Server 2016 and Windows Server 2019 editions is “Enhanced”. - -IT administrators can configure the Windows Server diagnostic data settings using familiar management tools, such as Group Policy, MDM, or Windows Provisioning. IT administrators can also manually change settings using Registry Editor. Setting the Windows Server diagnostic data levels through a management policy overrides any device-level settings. - -There are two options for deleting Windows diagnostic data from a Windows Server machine: - -- If the “Desktop Experience” option was chosen during the installation of Windows Server 2019, then there are the same options available for an IT administrator that end users have with Windows 10, version 1803 and version 1809, to submit a request for deleting that device’s diagnostic data. This is done by clicking the **Delete** button in the **Delete diagnostic data** section of **Start > Settings > Privacy > Diagnostics & feedback**. -- Microsoft has provided a [PowerShell cmdlet](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata) that IT administrators can use to delete Windows diagnostic data via the command line on a machine running Windows Server 2016 or Windows Server 2019. This cmdlet provides the same functionality for deleting Windows diagnostic data as with Desktop Experience on Windows Server 2019. For more information, see [the PowerShell Gallery](https://www.powershellgallery.com/packages/WindowsDiagnosticData). - -### Backups and Windows Server - -Backups, including live backups and backups that are stored locally within an organization or in the cloud, can contain personal data. - -- Backups an organizations creates, for example by using Windows Server Backup (WSB), are under its control. For example, for exporting personal data contained in a backup, the organization needs to restore the appropriate backup sets to facilitate the respective data subject request (DSR). -- The GDPR also applies when storing backups in the cloud. For example, an organization can use Microsoft Azure Backup to backup files and folders from physical or virtual Windows Server machines (located on-premises or in Azure) to the cloud. The organization that is subscribed to this backup service also has the obligation to restore the data in order to exercise the respective DSR. - -## Windows 10 Team Edition, Version 1703 for Surface Hub - -Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. - -> [!NOTE] -> Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this. - -An IT administrator can configure privacy- related settings, such as setting the Windows diagnostic data level to Basic. Surface Hub does not support group policy for centralized management; however, IT administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, please see [Manage settings with an MDM provider](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub). - -## Further reading - -### Optional settings / features that further improve the protection of personal data - -Personal data protection is one of the goals of the GDPR. One way of improving personal data protection is to use the modern and advanced security features of Windows 10. An IT organization can learn more at [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10) and [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure). - -> [!NOTE] -> Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5). - -### Windows Security Baselines - -Microsoft has created Windows Security Baselines to efficiently configure Windows 10 and Windows Server. For more information, please visit [Windows Security Baselines](/windows/security/threat-protection/windows-security-baselines). - -### Windows Restricted Traffic Limited Functionality Baseline - -To make it easier to deploy settings that restrict connections from Windows 10 and Windows Server to Microsoft, IT Professionals can apply the Windows Restricted Traffic Limited Functionality Baseline, available [here](https://go.microsoft.com/fwlink/?linkid=828887). - ->[!IMPORTANT] ->Some of the settings of the Windows Restricted Traffic Limited Functionality Baseline will reduce the functionality and security configuration of a device in the organization and are therefore not recommended. - -### Microsoft Trust Center and Service Trust Portal - -Please visit our [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr) to obtain additional resources and to learn more about how Microsoft can help you fulfill specific GDPR requirements. There you can find lots of useful information about the GDPR, including how Microsoft is helping customers to successfully master the GDPR, a FAQ list, and a list of [resources for GDPR compliance](https://www.microsoft.com/TrustCenter/Privacy/gdpr/resources). Also, please check out the [Compliance Manager](https://aka.ms/compliancemanager) of the Microsoft [Service Trust Portal (STP)](https://aka.ms/stp) and [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted). - -### Additional resources - -#### FAQs - -* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) -* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) -* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) -* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) - -#### Blogs - -* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10) - -#### Privacy Statement - -* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) - -#### Other resources - -* [Privacy at Microsoft](https://privacy.microsoft.com/) diff --git a/windows/privacy/gdpr-win10-whitepaper.md b/windows/privacy/gdpr-win10-whitepaper.md deleted file mode 100644 index 302909fefa..0000000000 --- a/windows/privacy/gdpr-win10-whitepaper.md +++ /dev/null @@ -1,340 +0,0 @@ ---- -title: General Data Protection Regulation (GDPR) for Windows 10 -description: Use this article to understand what GDPR is and which products Microsoft provides to help you get started towards compliance. -keywords: privacy, GDPR -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 09/25/2017 -ms.reviewer: ---- - -# Beginning your General Data Protection Regulation (GDPR) journey for Windows 10 - -This article provides info about the GDPR, including what it is, and the products Microsoft provides to help you to become compliant. - -## Introduction -On May 25, 2018, a European privacy law is due to take effect that sets a new global bar for privacy rights, security, and compliance. - -The General Data Protection Regulation, or GDPR, is fundamentally about protecting and enabling the privacy rights of individuals. The GDPR establishes strict global privacy requirements governing how you manage and protect personal data while respecting individual choice — no matter where data is sent, processed, or stored. - -Microsoft and our customers are now on a journey to achieve the privacy goals of the GDPR. At Microsoft, we believe privacy is a fundamental right, and we believe that the GDPR is an important step forward for clarifying and enabling individual privacy rights. But we also recognize that the GDPR will require significant changes by organizations all over the world. - -We have outlined our commitment to the GDPR and how we are supporting our customers within the [Get GDPR compliant with the Microsoft Cloud](https://blogs.microsoft.com/on-the-issues/2017/02/15/get-gdpr-compliant-with-the-microsoft-cloud/#hv52B68OZTwhUj2c.99) blog post by our Chief Privacy Officer [Brendon Lynch](https://blogs.microsoft.com/on-the-issues/author/brendonlynch/) and the [Earning your trust with contractual commitments to the General Data Protection Regulation](https://blogs.microsoft.com/on-the-issues/2017/04/17/earning-trust-contractual-commitments-general-data-protection-regulation/#6QbqoGWXCLavGM63.99)” blog post by [Rich Sauer](https://blogs.microsoft.com/on-the-issues/author/rsauer/) - Microsoft Corporate Vice President & Deputy General Counsel. - -Although your journey to GDPR-compliance may seem challenging, we're here to help you. For specific information about the GDPR, our commitments and how to begin your journey, please visit the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr). - -## GDPR and its implications -The GDPR is a complex regulation that may require significant changes in how you gather, use and manage personal data. Microsoft has a long history of helping our customers comply with complex regulations, and when it comes to preparing for the GDPR, we are your partner on this journey. - -The GDPR imposes rules on organizations that offer goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents, no matter where those businesses are located. Among the key elements of the GDPR are the following: - -- **Enhanced personal privacy rights.** Strengthened data protection for residents of EU by ensuring they have the right to access to their personal data, to correct inaccuracies in that data, to erase that data, to object to processing of their personal data, and to move it. - -- **Increased duty for protecting personal data.** Reinforced accountability of organizations that process personal data, providing increased clarity of responsibility in ensuring compliance. - -- **Mandatory personal data breach reporting.** Organizations that control personal data are required to report personal data breaches that pose a risk to the rights and freedoms of individuals to their supervisory authorities without undue delay, and, where feasible, no later than 72 hours once they become aware of the breach. - -As you might anticipate, the GDPR can have a significant impact on your business, potentially requiring you to update privacy policies, implement and strengthen data protection controls and breach notification procedures, deploy highly transparent policies, and further invest in IT and training. Microsoft Windows 10 can help you effectively and efficiently address some of these requirements. - -## Personal and sensitive data -As part of your effort to comply with the GDPR, you will need to understand how the regulation defines personal and sensitive data and how those definitions relate to data held by your organization. - -The GDPR considers personal data to be any information related to an identified or identifiable natural person. That can include both direct identification (such as, your legal name) and indirect identification (such as, specific information that makes it clear it is you the data references). The GDPR also makes clear that the concept of personal data includes online identifiers (such as, IP addresses, mobile device IDs) and location data. - -The GDPR introduces specific definitions for genetic data (such as, an individual’s gene sequence) and biometric data. Genetic data and biometric data along with other sub categories of personal data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership: data concerning health; or data concerning a person’s sex life or sexual orientation) are treated as sensitive personal data under the GDPR. Sensitive personal data is afforded enhanced protections and generally requires an individual’s explicit consent where these data are to be processed. - -### Examples of info relating to an identified or identifiable natural person (data subject) -This list provides examples of several types of info that will be regulated through GDPR. This is not an exhaustive list. - -- Name - -- Identification number (such as, SSN) - -- Location data (such as, home address) - -- Online identifier (such as, e-mail address, screen names, IP address, device IDs) - -- Pseudonymous data (such as, using a key to identify individuals) - -- Genetic data (such as, biological samples from an individual) - -- Biometric data (such as, fingerprints, facial recognition) - -## Getting started on the journey towards GDPR compliance -Given how much is involved to become GDPR-compliant, we strongly recommend that you don't wait to prepare until enforcement begins. You should review your privacy and data management practices now. We recommend that you begin your journey to GDPR compliance by focusing on four key steps: - -- **Discover.** Identify what personal data you have and where it resides. - -- **Manage.** Govern how personal data is used and accessed. - -- **Protect.** Establish security controls to prevent, detect, and respond to vulnerabilities and data breaches. - -- **Report.** Act on data requests, report data breaches, and keep required documentation. - - ![Diagram about how the 4 key GDPR steps work together](images/gdpr-steps-diagram.png) - -For each of the steps, we've outlined example tools, resources, and features in various Microsoft solutions, which can be used to help you address the requirements of that step. While this article isn't a comprehensive “how to,” we've included links for you to find out more details, and more information is available in the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr). - -## Windows 10 security and privacy -As you work to comply with the GDPR, understanding the role of your desktop and laptop client machines in creating, accessing, processing, storing and managing data that may qualify as personal and potentially sensitive data under the GDPR is important. Windows 10 provides capabilities that will help you comply with the GDPR requirements to implement appropriate technical and organizational security measures to protect personal data. - -With Windows 10, your ability to protect, detect and defend against the types of attacks that can lead to data breaches is greatly improved. Given the stringent requirements around breach notification within the GDPR, ensuring that your desktop and laptop systems are well defended will lower the risks you face that could result in costly breach analysis and notification. - -In this section, we'll talk about how Windows 10 provides capabilities that fit squarely in the **Protect** stage of your journey, including these 4 scenarios: - -- **Threat protection: Pre-breach threat resistance.** Disrupt the malware and hacking industry by moving the playing field to one where they lose the attack vectors that they depend on. - -- **Threat protection: Post-breach detection and response.** Detect, investigate, and respond to advanced threats and data breaches on your networks. - -- **Identity protection.** Next generation technology to help protect your user’s identities from abuse. - -- **Information protection.** Comprehensive data protection while meeting compliance requirements and maintaining user productivity. - -These capabilities, discussed in more detail below with references to specific GDPR requirements, are built on top of advanced device protection that maintains the integrity and security of the operating system and data. - -A key provision within the GDPR is data protection by design and by default, and helping with your ability to meet this provision are features within Windows 10 such as the Trusted Platform Module (TPM) technology designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. - -The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: - -- Generate, store, and limit the use of cryptographic keys. - -- Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself. - -- Help to ensure platform integrity by taking and storing security measurements. - -Additional advanced device protection relevant to your operating without data breaches include Windows Trusted Boot to help maintain the integrity of the system by ensuring malware is unable to start before system defenses. - -### Threat protection: Pre-breach threat resistance -The GDPR requires you to implement appropriate technical and organizational security measures to protect personal data. - -Your ability to meet this requirement to implement appropriate technical security measures should reflect the threats you face in today’s increasingly hostile IT environment. Today’s security threat landscape is one of aggressive and tenacious threats. In previous years, malicious attackers mostly focused on gaining community recognition through their attacks or the thrill of temporarily taking a system offline. Since then, attacker’s motives have shifted toward making money, including holding devices and data hostage until the owner pays the demanded ransom. - -Modern attacks increasingly focus on large-scale intellectual property theft; targeted system degradation that can result in financial loss; and now even cyberterrorism that threatens the security of individuals, businesses, and national interests all over the world. These attackers are typically highly trained individuals and security experts, some of whom are in the employ of nation states that have large budgets and seemingly unlimited human resources. Threats like these require an approach that can meet this challenge. - -Not only are these threats a risk to your ability to maintain control of any personal or sensitive data you may have, but they are a material risk to your overall business as well. Consider recent data from Ponemon Institute, Verizon, and Microsoft: - -- The average cost of the type of data breach the GDPR will expect you to report is $3.5M. (Ponemon Institute). - -- 63% of these breaches involve weak or stolen passwords that the GDPR expects you to address. (2016 Data Breach Investigations Report, Verizon Enterprise). - -- Over 300,000 new malware samples are created and spread every day making your task to address data protection even more challenging. (Microsoft Malware Protection Center, Microsoft). - -As seen with recent ransomware attacks, once called the "black plague" of the Internet, attackers are going after bigger targets that can afford to pay more, with potentially catastrophic consequences. Desktops and laptops, that contain personal and sensitive data, are commonly targeted where control over data might be lost. - -In response to these threats and as a part of your mechanisms to resist these types of breaches so that you remain in compliance with the GDPR, Windows 10 provides built in technology, detailed below including the following: - -- Windows Defender Antivirus to respond to emerging threats on data. - -- Microsoft Edge to systemically disrupt phishing, malware, and hacking attacks. - -- Windows Defender Device Guard to block all unwanted applications on client machines. - -#### Responding to emerging data threats -Windows Defender Antivirus is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers. In Windows 10, it uses a multi-pronged approach to improve antimalware: - -- **Cloud-delivered protection.** Helps to detect and block new malware within seconds, even if the malware has never been seen before. - -- **Rich local context.** Improves how malware is identified. Windows 10 informs Windows Defender Antivirus not only about content like files and processes, but also where the content came from, where it's been stored, and more. - -- **Extensive global sensors.** Help to keep Windows Defender Antivirus current and aware of even the newest malware. This is accomplished in two ways: by collecting the rich local context data from end points and by centrally analyzing that data. - -- **Tamper proofing.** Helps to guard Windows Defender Antivirus itself against malware attacks. For example, Windows Defender Antivirus uses Protected Processes, which prevents untrusted processes from attempting to tamper with Windows Defender Antivirus components, its registry keys, and so on. - -- **Enterprise-level features.** Give IT pros the tools and configuration options necessary to make Windows Defender Antivirus an enterprise-class antimalware solution. - -#### Systemically disrupting phishing, malware, and hacking attacks -In today’s threat landscape, your ability to provide those mechanisms should be tied to the specific data-focused attacks you face through phishing, malware and hacking due to the browser-related attacks. - -As part of Windows 10, Microsoft has brought you Microsoft Edge, our safest and most secure browser to-date. Over the past two years, we have been continuously innovating, and we’re proud of the progress we’ve made. This quality of engineering is reflected by the reduction of Common Vulnerabilities and Exposures (CVE) when comparing Microsoft Edge with Internet Explorer over the past year. Browser-related attacks on personal and sensitive data that you will need to protect under the GDPR means this innovation in Windows 10 is important. - -While no modern browser — or any complex application — is free of vulnerabilities, many of the vulnerabilities for Microsoft Edge have been responsibly reported by professional security researchers who work with the Microsoft Security Response Center (MSRC) and the Microsoft Edge team to ensure customers are protected well before any attacker might use these vulnerabilities in the wild. Even better, there is no evidence that any vulnerabilities have been exploited in the wild as zero-day attacks. - -![Graph of the Common Vulnerabilities and Exposures (CVE) in the National Vulnerability Database](images/gdpr-cve-graph.png) - -However, many businesses worldwide have come under increasing threat of targeted attacks, where attackers are crafting specialized attacks against a specific business, attempting to take control of corporate networks and data. - -#### Blocking all unwanted apps -Application Control is your best defense in a world where there are more than 300,000 new malware samples each day. As part of Windows 10, Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. - -With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Windows Defender Device Guard can use the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. - -Windows Defender Device Guard protects threats that can expose personal or sensitive data to attack, including: - -- Exposure to new malware, for which the "signature" is not yet known - -- Exposure to unsigned code (most malware is unsigned) - -- Malware that gains access to the kernel and then, from within the kernel, captures sensitive information or damages the system - -- DMA-based attacks, for example, attacks launched from a malicious device that read secrets from memory, making the enterprise more vulnerable to attack; and - -- Exposure to boot kits or to a physically present attacker at boot time. - -### Threat protection: Post-breach detection and response -The GDPR includes explicit requirements for breach notification where a personal data breach means, “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.” - -As noted in the Windows Security Center white paper, [Post Breach: Dealing with Advanced Threats](http://wincom.blob.core.windows.net/documents/Post_Breach_Dealing_with_Advanced_Threats_Whitepaper.pdf), “_Unlike pre-breach, post-breach assumes a breach has already occurred – acting as a flight recorder and Crime Scene Investigator (CSI). Post-breach provides security teams the information and toolset needed to identify, investigate, and respond to attacks that otherwise will stay undetected and below the radar._” - -#### Insightful security diagnostic data -For nearly two decades, Microsoft has been turning threats into useful intelligence that can help fortify our platform and protect customers. Today, with the immense computing advantages afforded by the cloud, we are finding new ways to use our rich analytics engines driven by threat intelligence to protect our customers. - -By applying a combination of automated and manual processes, machine learning and human experts, we can create an Intelligent Security Graph that learns from itself and evolves in real-time, reducing our collective time to detect and respond to new incidents across our products. - -![Diagram of Microsoft's Intelligent Security Graph](images/gdpr-intelligent-security-graph.png) - -The scope of Microsoft’s threat intelligence spans, literally, billions of data points: 35 billion messages scanned monthly, 1 billion customers across enterprise and consumer segments accessing 200+ cloud services, and 14 billion authentications performed daily. All this data is pulled together on your behalf by Microsoft to create the Intelligent Security Graph that can help you protect your front door dynamically to stay secure, remain productive, and meet the requirements of the GDPR. - -#### Detecting attacks and forensic investigation -Even the best endpoint defenses may be breached eventually, as cyberattacks become more sophisticated and targeted. - -Windows Defender Advanced Threat Protection (ATP) helps you detect, investigate, and respond to advanced attacks and data breaches on your networks. GDPR expects you to protect against attacks and breaches through technical security measures to ensure the ongoing confidentiality, integrity, and availability of personal data. - -Among the key benefits of ATP are the following: - -- Detecting the undetectable - sensors built deep into the operating system kernel, Windows security experts, and unique optics from over 1 billion machines and signals across all Microsoft services. - -- Built in, not bolted on - agentless with high performance and low impact, cloud-powered; easy management with no deployment. - -- Single pane of glass for Windows security - explore 6 months of rich machine timeline that unifies security events from Windows Defender ATP, Windows Defender Antivirus. - -- Power of the Microsoft graph - leverages the Microsoft Intelligence Security Graph to integrate detection and exploration with Office 365 ATP subscription, to track back and respond to attacks. - -Read more at [What’s new in the Windows Defender ATP Creators Update preview](https://blogs.microsoft.com/microsoftsecure/2017/03/13/whats-new-in-the-windows-defender-atp-creators-update-preview/). - -To provide Detection capabilities, Windows 10 improves our OS memory and kernel sensors to enable detection of attackers who are employing in-memory and kernel-level attacks – shining a light into previously dark spaces where attackers hid from conventional detection tools. We’ve already successfully leveraged this new technology against zero-days attacks on Windows. - -![Windows Defender Security Center](images/gdpr-security-center.png) - -We continue to upgrade our detections of ransomware and other advanced attacks, applying our behavioral and machine-learning detection library to counter changing attacks trends. Our historical detection capability ensures new detection rules apply to up to six months of stored data to detect attacks that previously went unnoticed. Customers can also add customized detection rules or IOCs to augment the detection dictionary. - -Customers asked us for a single pane of glass across the entire Windows security stack. Windows Defender Antivirus detections and Windows Defender Device Guard blocks are the first to surface in the Windows Defender ATP portal interleaved with Windows Defender ATP detections. The new user entity adds identity as a pivot, providing insight into actions, relationships, and alerts that span machines and allow us to track attackers moving laterally across the network. - -Our alert page now includes a new process tree visualization that aggregates multiple detections and related events into a single view that helps security teams reduce the time to resolve cases by providing the information required to understand and resolve incidents without leaving the alert page. - -Security Operations (SecOps) can hunt for evidence of attacks, such as file names or hashes, IP addresses or URLs, behaviors, machines, or users. They can do this immediately by searching the organization’s cloud inventory, across all machines – and going back up to 6 months in time – even if machines are offline, have been reimaged, or no longer exist. - -![Windows Defender Security Center - User screen](images/gdpr-security-center2.png) - -When detecting an attack, security teams can now take immediate action: isolate machines, ban files from the network, kill or quarantine running processes or files, or retrieve an investigation package from a machine to provide forensic evidence – with a click of a button. Because while detecting advanced attacks is important – shutting them down is even more so. - -![Windows Defender Security Center - Machine screen](images/gdpr-security-center3.png) - -### Identity Protection -Identify and access management is another area where the GDPR has placed special emphasis by calling for mechanisms to grant and restrict access to data subject personal data (for example, role-based access, segregation of duties). - -#### Multi-factor protection -Biometric authentication – using your face, iris, or fingerprint to unlock your devices – is much safer than traditional passwords. You– uniquely you– plus your device are the keys to your apps, data, and even websites and services – not a random assortment of letters and numbers that are easily forgotten, hacked, or written down and pinned to a bulletin board. - -Your ability to protect personal and sensitive data, that may be stored or accessed through desktop or laptops will be further enhanced by adopting advanced authentication capabilities such as Windows Hello for Business and Windows Hello companion devices. Windows Hello for Business, part of Windows 10, gives users a personal, secured experience where the device is authenticated based on their presence. Users can log in with a look or a touch, with no need for a password. - -In conjunction with Windows Hello for Business, biometric authentication uses fingerprints or facial recognition and is more secure, more personal, and more convenient. If an application supports Hello, Windows 10 enables you to authenticate applications, enterprise content, and even certain online experiences without a password being stored on your device or in a network server at all. -Windows Hello for Business works with the Companion Device Framework to enhance the user authentication experience. Using the Windows Hello Companion Device Framework, a companion device can provide a rich experience for Windows Hello even when biometrics are not available (for example, if the Windows 10 desktop lacks a camera for face authentication or fingerprint reader device). - -There are numerous ways one can use the Windows Hello Companion Device Framework to build a great Windows unlock experience with a companion device. For example, users can: - -- Work offline (for example, while traveling on a plane) - -- Attach their companion device to PC via USB, touch the button on the companion device, and automatically unlock their PC. - -- Carry a phone in their pocket that is already paired with their PC over Bluetooth. Upon hitting the spacebar on their PC, their phone receives a notification. Approve it and the PC simply unlocks. - -- Tap their companion device to an NFC reader to quickly unlock their PC. - -- Wear a fitness band that has already authenticated the wearer. Upon approaching PC, and by performing a special gesture (like clapping), the PC unlocks. - -#### Protection against attacks by isolating user credentials -As noted in the [Windows 10 Credential Theft Mitigation Guide](https://www.microsoft.com/download/confirmation.aspx?id=54095), “_the tools and techniques criminals use to carry out credential theft and reuse attacks improve, malicious attackers are finding it easier to achieve their goals. Credential theft often relies on operational practices or user credential exposure, so effective mitigations require a holistic approach that addresses people, processes, and technology. In addition, these attacks rely on the attacker stealing credentials after compromising a system to expand or persist access, so organizations must contain breaches rapidly by implementing strategies that prevent attackers from moving freely and undetected in a compromised network._” - -An important design consideration for Windows 10 was mitigating credential theft — in particular, derived credentials. Windows Defender Credential Guard provides significantly improved security against derived credential theft and reuse by implementing a significant architectural change in Windows designed to help eliminate hardware-based isolation attacks rather than simply trying to defend against them. - -When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges can't extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Windows Defender Device Guard, as described above, and other security strategies and architectures. - -### Information Protection -The GDPR is focused on information protection regarding data that is considered as personal or sensitive in relation to a natural person, or data subject. Device protection, protection against threats, and identity protection are all important elements of a Defense in Depth strategy surrounding a layer of information protection in your laptop and desktop systems. - -As to the protection of data, the GDPR recognizes that in assessing data security risk, consideration should be given to the risks that are presented such as accidental loss, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. It also recommends that measures taken to maintain an appropriate level of security should consider the state-of-the-art and the costs of implementation in relation to the risks among other factors. - -Windows 10 provides built in risk mitigation capabilities for today’s threat landscape. In this section, we will look at the types of technologies that will help your journey toward GDPR compliance and at the same time provide you with solid overall data protection as part of a comprehensive information protection strategy. - -![Diagram of Microsoft's comprehensive information protection strategy](images/gdpr-comp-info-protection.png) - -#### Encryption for lost or stolen devices -The GDPR calls for mechanisms that implement appropriate technical security measures to confirm the ongoing confidentiality, integrity, and availability of both personal data and processing systems. BitLocker Encryption, first introduced as part of Microsoft's Next-Generation Secure Computing Base architecture in 2004 and made available with Windows Vista, is a built-in data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. - -BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later. The TPM is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to protect user data and to ensure that a computer has not been tampered with while the system was offline. - -Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software-attack tool against it or by transferring the computer's hard disk to a different computer. BitLocker helps mitigate unauthorized data access by enhancing file and system protections. BitLocker also helps render data inaccessible when BitLocker-protected computers are decommissioned or recycled. - -Related to BitLocker are Encrypted Hard Drives, a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. Encrypted Hard Drives use the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. - -By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity. - -Some of the benefits of Encrypted Hard Drives include: - -- **Better performance.** Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate with no performance degradation. - -- **Strong security based in hardware.** Encryption is always "on" and the keys for encryption never leave the hard drive. User authentication is performed by the drive before it will unlock, independently of the operating system - -- **Ease of use.** Encryption is transparent to the user because it is on by default. There is no user interaction needed to enable encryption. Encrypted Hard Drives are easily erased using on-board encryption key; there is no need to re-encrypt data on the drive. - -- **Lower cost of ownership.** There is no need for new infrastructure to manage encryption keys, since BitLocker leverages your Active Directory Domain Services infrastructure to store recovery information. Your device operates more efficiently because processor cycles don't need to be used for the encryption process. - -#### Preventing accidental data leaks to unauthorized users -Part of the reality of your operating in a mobile-first, cloud-first world is the notion that some laptops will have multiple purposes – both business and personal. Yet that data that is considered as personal and sensitive regarding EU residents considered as “data subjects” must be protected in line with the requirements of the GDPR. - -Windows Information Protection helps people separate their work and personal data and keeps data encrypted wherever it’s stored. Your employees can safely use both work and personal data on the same device without switching applications. Windows Information Protection helps end users avoid inadvertent data leaks by sending a warning when copy/pasting information in non-corporate applications – end users can still proceed but the action will be logged centrally. - -For example, employees can’t send protected work files from a personal email account instead of their work account. They also can’t accidently post personal or sensitive data from a corporate site into a tweet. Windows Information Protection also helps ensure that they aren’t saving personal or sensitive data in a public cloud storage location. - -#### Capabilities to classify, assign permissions and share data -Windows Information Protection is designed to coexist with advanced data loss prevention (DLP) capabilities found in Microsoft 365 Apps for enterprise, Azure Information Protection, and Azure Rights Management. Advanced DLP prevents printing, for example, or protects work data that is emailed outside your company. - -To continuously protect your data, regardless of where it is stored, with whom it is shared, or if the device is running iOS, Android or Windows, the classification and protection needs to be built into the file itself, so this protection can travel with the data wherever it goes. Microsoft Azure Information Protection (AIP) is designed to provide this persistent data protection both on-premises and in the cloud. - -Data classification is an important part of any data governance plan. Adopting a classification scheme that applies throughout your business can be particularly helpful in responding to what the GDPR calls data subject (for example, your EU employee or customer) requests, because it enables enterprises to identify more readily and process personal data requests. - -Azure Information Protection can be used to help you classify and label your data at the time of creation or modification. Protection in the form of encryption, which the GDPR recognizes may be appropriate at times, or visual markings can then be applied to data needing protection. - -With Azure Information Protection, you can either query for data marked with a sensitivity label or intelligently identify sensitive data when a file or email is created or modified. Once identified, you can automatically classify and label the data – all based on the company’s desired policy. - -Azure Information Protection also helps your users share sensitive data in a secure manner. In the example below, information about a sensitive acquisition was encrypted and restricted to a group of people who were granted only a limited set of permissions on the information – they could modify the content but could not copy or print it. - -![Azure Information Protection screen with limitations](images/gdpr-azure-info-protection.png) - -## Related content for associated Windows 10 solutions - -- **Windows Hello for Business:** https://www.youtube.com/watch?v=WOvoXQdj-9E and https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification - -- **Windows Defender Antivirus:** https://www.youtube.com/watch?v=P1aNEy09NaI and https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10 - -- **Windows Defender Advanced Threat Protection:** https://www.youtube.com/watch?v=qxeGa3pxIwg and https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection - -- **Windows Defender Device Guard:** https://www.youtube.com/watch?v=F-pTkesjkhI and https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide - -- **Windows Defender Credential Guard:** https://www.youtube.com/watch?v=F-pTkesjkhI and https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard - -- **Windows Information Protection:** https://www.youtube.com/watch?v=wLkQOmK7-Jg and https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip - -- Windows 10 Security Guide: https://technet.microsoft.com/itpro/windows/keep-secure/windows-10-security-guide - -## Disclaimer -This article is a commentary on the GDPR, as Microsoft interprets it, as of the date of publication. We’ve spent a lot of time with GDPR and like to think we’ve been thoughtful about its intent and meaning. But the application of GDPR is highly fact-specific, and not all aspects and interpretations of GDPR are well-settled. - -As a result, this article is provided for informational purposes only and should not be relied upon as legal advice or to determine how GDPR might apply to you and your organization. We encourage you to work with a legally-qualified professional to discuss GDPR, how it applies specifically to your organization, and how best to ensure compliance. - -MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS ARTICLE. This article is provided “as-is.” Information and views expressed in this article, including URL and other Internet website references, may change without notice. - -This article does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this article for your internal, reference purposes only. - -Published September 2017
        -Version 1.0
        -© 2017 Microsoft. All rights reserved. diff --git a/windows/privacy/index.yml b/windows/privacy/index.yml index 8d5740bc52..b9b6ce81fd 100644 --- a/windows/privacy/index.yml +++ b/windows/privacy/index.yml @@ -1,156 +1,182 @@ -### YamlMime:YamlDocument - -documentType: LandingData +### YamlMime:Hub title: Windows Privacy +summary: Get ready for General Data Protection Regulation (GDPR) by viewing and configuring Windows diagnostic data in your organization. +brand: m365 metadata: - - document_id: - title: Windows Privacy - description: Learn about how privacy is managed in Windows. - - keywords: Windows 10, Windows Server, Windows Server 2016, privacy, GDPR, compliance, endpoints - + services: windows + ms.product: windows + ms.topic: hub-page # Required + ms.collection: M365-security-compliance + author: danihalfin + ms.author: daniha + manager: dansimp + ms.date: 07/21/2020 #Required; mm/dd/yyyy format. ms.localizationpriority: high - author: danihalfin - - ms.author: daniha - - ms.date: 04/25/2018 - - ms.topic: conceptual - - audience: ITPro - - manager: dansimp - - ms.collection: M365-security-compliance - - ms.devlang: na - -sections: - -- items: - - - type: markdown - - text: Get ready for General Data Protection Regulation (GDPR) by viewing and configuring Windows diagnostic data in your organization. - -- items: - - - type: list - - style: cards - - className: cardsM - - columns: 3 - - items: - - - href: \windows\privacy\gdpr-it-guidance - - html:

        Learn about GDPR and how Microsoft helps you get started towards compliance

        - - image: - - src: https://docs.microsoft.com/media/common/i_advanced.svg - - title: Start with GDPR basics - - - href: \windows\privacy\configure-windows-diagnostic-data-in-your-organization - - html:

        Make informed decisions about how you can configure diagnostic data in your organization

        - - image: - - src: https://docs.microsoft.com/media/common/i_filter.svg - - title: Configure Windows diagnostic data - - - href: \windows\privacy\diagnostic-data-viewer-overview - - html:

        Review the Windows diagnostic data sent to Microsoft by device in your organization

        - - image: - - src: https://docs.microsoft.com/media/common/i_investigate.svg - - title: View Windows diagnostic data - -- title: Understand Windows diagnostic data in Windows 10 - +# highlightedContent section (optional) +# Maximum of 8 items +highlightedContent: +# itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new items: + # Card + - title: Windows privacy & compliance guide for IT and compliance professionals + itemType: overview + url: Windows-10-and-privacy-compliance.md + # Card + - title: Configure Windows diagnostic data + itemType: how-to-guide + url: configure-windows-diagnostic-data-in-your-organization.md + # Card + - title: View Windows diagnostic data + itemType: how-to-guide + url: diagnostic-data-viewer-overview.md - - type: paragraph +# productDirectory section (optional) +productDirectory: + title: Understand Windows diagnostic data in Windows 10 + summary: For the latest Windows 10 version, learn more about what Windows diagnostic data is collected at various diagnostics levels. + items: + # Card + - title: Required diagnostic data + # imageSrc should be square in ratio with no whitespace + imageSrc: https://docs.microsoft.com/media/common/i_extend.svg + summary: Learn more about basic Windows diagnostic data events and fields collected. + url: required-windows-diagnostic-data-events-and-fields-2004.md + # Card + - title: Optional diagnostic data + imageSrc: https://docs.microsoft.com/media/common/i_get-started.svg + summary: Get examples of the types of optional diagnostic data collected from Windows + url: windows-diagnostic-data.md + # Card + - title: Changes to Windows diagnostic data collection + imageSrc: https://docs.microsoft.com/media/common/i_build.svg + summary: See what changes Windows is making to align to the new data collection taxonomy + url: changes-to-windows-diagnostic-data-collection.md - text: 'For the latest Windows 10 version, learn more about what Windows diagnostic data is collected at various diagnostics levels.' +# conceptualContent section (optional) +# conceptualContent: +# # itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new +# title: sectiontitle # < 60 chars (optional) +# summary: sectionsummary # < 160 chars (optional) +# items: +# # Card +# - title: cardtitle1 +# links: +# - url: file1.md OR https://docs.microsoft.com/file1 +# itemType: itemType +# text: linktext1 +# - url: file2.md OR https://docs.microsoft.com/file2 +# itemType: itemType +# text: linktext2 +# - url: file3.md OR https://docs.microsoft.com/file3 +# itemType: itemType +# text: linktext3 +# # footerLink (optional) +# footerLink: +# url: filefooter.md OR https://docs.microsoft.com/filefooter +# text: See more +# # Card +# - title: cardtitle2 +# links: +# - url: file1.md OR https://docs.microsoft.com/file1 +# itemType: itemType +# text: linktext1 +# - url: file2.md OR https://docs.microsoft.com/file2 +# itemType: itemType +# text: linktext2 +# - url: file3.md OR https://docs.microsoft.com/file3 +# itemType: itemType +# text: linktext3 +# # footerLink (optional) +# footerLink: +# url: filefooter.md OR https://docs.microsoft.com/filefooter +# text: See more +# # Card +# - title: cardtitle3 +# links: +# - url: file1.md OR https://docs.microsoft.com/file1 +# itemType: itemType +# text: linktext1 +# - url: file2.md OR https://docs.microsoft.com/file2 +# itemType: itemType +# text: linktext2 +# - url: file3.md OR https://docs.microsoft.com/file3 +# itemType: itemType +# text: linktext3 +# # footerLink (optional) +# footerLink: +# url: filefooter.md OR https://docs.microsoft.com/filefooter +# text: See more - - type: list +# # tools section (optional) +# tools: +# title: sectiontitle # < 60 chars (optional) +# summary: sectionsummary # < 160 chars (optional) +# items: +# # Card +# - title: cardtitle1 +# # imageSrc should be square in ratio with no whitespace +# imageSrc: ./media/index/image1.svg OR https://docs.microsoft.com/media/logos/image1.svg +# url: file1.md +# # Card +# - title: cardtitle2 +# imageSrc: ./media/index/image2.svg OR https://docs.microsoft.com/media/logos/image2.svg +# url: file2.md +# # Card +# - title: cardtitle3 +# imageSrc: ./media/index/image3.svg OR https://docs.microsoft.com/media/logos/image3.svg +# url: file3.md - style: cards +# additionalContent section (optional) +# Card with summary style +# additionalContent: +# # Supports up to 3 sections +# sections: +# - title: sectiontitle # < 60 chars (optional) +# summary: sectionsummary # < 160 chars (optional) +# items: +# # Card +# - title: cardtitle1 +# summary: cardsummary1 +# url: file1.md OR https://docs.microsoft.com/file1 +# # Card +# - title: cardtitle2 +# summary: cardsummary2 +# url: file1.md OR https://docs.microsoft.com/file2 +# # Card +# - title: cardtitle3 +# summary: cardsummary3 +# url: file1.md OR https://docs.microsoft.com/file3 +# # footer (optional) +# footer: "footertext [linktext](https://docs.microsoft.com/footerfile)" - className: cardsM - - columns: 3 - - items: - - - href: \windows\privacy\basic-level-windows-diagnostic-events-and-fields - - html:

        Learn more about basic Windows diagnostic data events and fields collected

        - - image: - - src: https://docs.microsoft.com/media/common/i_extend.svg - - title: Basic level events and fields - - - href: \windows\privacy\enhanced-diagnostic-data-windows-analytics-events-and-fields - - html:

        Learn more about Windows diagnostic data events and fields used by Windows Analytics

        - - image: - - src: https://docs.microsoft.com/media/common/i_delivery.svg - - title: Enhanced level events and fields - - - href: \windows\privacy\windows-diagnostic-data - - html:

        Learn more about all Windows diagnostic data collected

        - - image: - - src: https://docs.microsoft.com/media/common/i_get-started.svg - - title: Full level data categories - -- items: - - - type: list - - style: cards - - className: cardsL - - items: - - - title: View and manage Windows 10 connection endpoints - - html:

        Manage Windows 10 connection endpoints

        - -

        Manage connections from Windows to Microsoft services

        - - - title: Additional resources - - html:

        Windows 10 on Trust Center

        - -

        GDPR on Microsoft 365 Compliance solutions

        - -

        Support for GDPR Accountability on Service Trust Portal

        - \ No newline at end of file +# additionalContent section (optional) +# Card with links style +additionalContent: + # Supports up to 3 sections + sections: + - items: + # Card + - title: View and manage Windows 10 connection endpoints + links: + - text: Manage Windows 10 connection endpoints + url: manage-windows-endpoints.md + - text: Manage connection endpoints for non-Enterprise editions of Windows 10 + url: windows-endpoints-2004-non-enterprise-editions.md + - text: Manage connections from Windows to Microsoft services + url: manage-connections-from-windows-operating-system-components-to-microsoft-services.md + # Card + - title: Additional resources + links: + - text: Windows 10 on Trust Center + url: https://www.microsoft.com/en-us/trustcenter/cloudservices/windows10 + - text: GDPR on Microsoft 365 Compliance solutions + url: https://docs.microsoft.com/microsoft-365/compliance/gdpr + - text: Support for GDPR Accountability on Service Trust Portal + url: https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted + # footer (optional) + # footer: "footertext [linktext](https://docs.microsoft.com/footerfile)" diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index d15ec0f74b..1c68d554a4 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -8,10 +8,10 @@ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro -author: medgarmedgar -ms.author: v-medgar +author: robsize +ms.author: dansimp manager: robsize -ms.date: 3/25/2020 +ms.date: 12/1/2020 --- # Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server @@ -152,7 +152,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate). Specifies whether automatic update of apps from Microsoft Store are allowed. **Set to 0 (zero)** 1. **Apps for websites** - [ApplicationDefaults/EnableAppUriHandlers](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationdefaults#applicationdefaults-enableappurihandlers). This policy setting determines whether Windows supports web-to-app linking with app URI handlers. **Set to 0 (zero)** 1. **Windows Update Delivery Optimization** - The following Delivery Optimization MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - 1. [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode). Let’s you choose where Delivery Optimization gets or sends updates and apps. **Set to 100 (one hundred)** + 1. [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode). Let’s you choose where Delivery Optimization gets or sends updates and apps. **Set to 99 (ninety-nine)** 1. **Windows Update** 1. [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate). Control automatic updates. **Set to 5 (five)** 1. Windows Update Allow Update Service - [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice). Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)** diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 6dd9518dcf..b40f5823e6 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -9,12 +9,12 @@ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro -author: medgarmedgar +author: linque1 ms.author: robsize manager: robsize ms.collection: M365-security-compliance ms.topic: article -ms.date: 3/25/2020 +ms.date: 12/1/2020 --- # Manage connections from Windows 10 operating system components to Microsoft services @@ -30,17 +30,17 @@ This article describes the network connections that Windows 10 components make t Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Windows Defender are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly. >[!IMPORTANT] +> - The downloadable Windows 10, version 1903 scripts/settings can be used on Windows 10, version 1909 devices. > - The Allowed Traffic endpoints are listed here: [Allowed Traffic](#bkmk-allowedtraffic) > - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign. > - For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: Windows Update, Automatic Root Certificates Update, and Windows Defender. Accordingly, we do not recommend disabling any of these features. > - It is recommended that you restart a device after making configuration changes to it. > - The **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied. ->[!Note] ->Regarding the Windows Restricted Traffic Limited Functionality Baseline, the 1903 settings (folder) are applicable to 1909 Windows >Enterprise devices. There were no additional settings required for the 1909 release. - > [!Warning] -> If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. +> - If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. +> - To restrict a device effectively (first time or subsequently), it is recommended to apply the Restricted Traffic Limited Functionality Baseline settings package in offline mode. +> - During update or upgrade of Windows, egress traffic may occur. To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) @@ -58,18 +58,18 @@ The following table lists management options for each setting, beginning with Wi | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [9. License Manager](#bkmk-licmgr) | | | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [13. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -107,7 +107,7 @@ The following table lists management options for each setting, beginning with Wi | [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [28. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -118,12 +118,12 @@ See the following table for a summary of the management settings for Windows Ser | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -169,17 +169,17 @@ See the following table for a summary of the management settings for Windows Ser | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [13. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -217,7 +217,7 @@ See the following table for a summary of the management settings for Windows Ser | [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | -| [28. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ## How to configure each setting @@ -390,7 +390,7 @@ Windows Insider Preview builds only apply to Windows 10 and are not available fo > [!NOTE] -> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for Restricted Traffic) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**. +> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for Restricted Traffic) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Optional (Full)**. Although the diagnostic data level may initially appear as **Required (Basic)**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Optional (Full)**. To turn off Insider Preview builds for a released version of Windows 10: @@ -415,7 +415,7 @@ To turn off Insider Preview builds for Windows 10: ### 8. Internet Explorer > [!NOTE] ->When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/en-us/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: +>When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -438,7 +438,7 @@ There are more Group Policy objects that are used by Internet Explorer: | Path | Policy | Description | | - | - | - | -| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can fix website display problems that he or she may encounter while browsing.
        **Set to: Enabled** | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Turn off Compatibility View. | Choose whether an employee can fix website display problems that he or she may encounter while browsing.
        **Set to: Enabled** | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
        **Set to: Enabled** | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
        **Set to: Enabled** | | **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Allow Online Tips** | Allow Online Tips | Enables or disables the retrieval of online tips and help for the Settings app.
        **Set to: Disabled** | @@ -553,7 +553,7 @@ To disable the Microsoft Account Sign-In Assistant: ### 13. Microsoft Edge -Use Group Policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682). +Use Group Policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682) and [Configure Microsoft Edge policy settings on Windows](https://docs.microsoft.com/DeployEdge/configure-microsoft-edge). ### 13.1 Microsoft Edge Group Policies @@ -614,6 +614,10 @@ You can turn off NCSI by doing one of the following: You can turn off the ability to download and update offline maps. +- Turn **Off** the feature in the UI by going to **Settings -> Apps -> Offline maps -> Map updates**, toggle the **Automatically update maps** switch to **Off** + + -or- + - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** -or- @@ -929,27 +933,26 @@ To turn off **Location for this device**: - Click the **Change** button in the UI. -or- - + - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. -or- -- Create a REG_DWORD registry setting named **LetAppsAccessLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. - - -To turn off **Location**: - -- Turn off the feature in the UI. - - -or- - -- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** and set the **Select a setting** box to **Force Deny**. - - -or- - - Create a REG_DWORD registry setting named **DisableLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LocationAndSensors** with a value of 1 (one). +To turn off **Allow apps to access your location**: +- Turn off the feature in the UI. + + -or- + +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** and set the **Select a setting** box to **Force Deny**. + + -or- + +- Create a REG_DWORD registry setting named **LetAppsAccessLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. + + To turn off **Location history**: - Erase the history using the **Clear** button in the UI. @@ -1073,7 +1076,7 @@ To turn off **Let apps access my name, picture, and other account info**: -or- -- Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). @@ -1097,7 +1100,7 @@ To turn off **Choose apps that can access contacts**: -or- -- Create a REG_DWORD registry setting named **LetAppsAccessContacts** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessContacts** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). ### 18.9 Calendar @@ -1113,7 +1116,7 @@ To turn off **Let apps access my calendar**: -or- -- Create a REG_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). To turn off **Choose apps that can access calendar**: @@ -1299,7 +1302,7 @@ To change how frequently **Windows should ask for my feedback**: To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: -- Click either the **Basic** or **Full** options. +- Click either the **Required (Basic)** or **Optional (Full)** options. -or- @@ -1413,11 +1416,19 @@ To turn this off: In the **Inking & Typing** area you can configure the functionality as such: -To turn off Inking & Typing data collection (note: there is no Group Policy for this setting): +To turn off Inking & Typing data collection: -- In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Inking and typing** and turn **Improve inking & typing** to **Off** +- In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Improve inking and typing** and turn it to **Off** - -or- + -OR- + + **Disable** the Group Policy: **Computer Configuration > Administrative Templates > Windows Components > Text Input > Improve inking and typing recognition** + + -and- + + **Disable** the Group Policy: **User Configuration > Administrative Templates > Control Panel > Regional and Language Options > Handwriting personalization > Turn off automatic learning** + + -OR- - Set **RestrictImplicitTextCollection** registry REG_DWORD setting in **HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization** to a **value of 1 (one)** @@ -1447,15 +1458,15 @@ To turn this Off in the UI: -OR- -- Create a REG_DWORD registry setting named **EnableActivityFeed** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 2 (two)** +- Create a REG_DWORD registry setting named **EnableActivityFeed** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)** -and- -- Create a REG_DWORD registry setting named **PublishUserActivities** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 2 (two)** +- Create a REG_DWORD registry setting named **PublishUserActivities** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)** -and- -- Create a REG_DWORD registry setting named **UploadUserActivities** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 2 (two)** +- Create a REG_DWORD registry setting named **UploadUserActivities** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)** ### 18.23 Voice Activation @@ -1467,11 +1478,11 @@ To turn this Off in the UI: -OR- -- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > named **Let Windows apps activate with voice** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > named **Let Windows apps activate with voice** and set the **Select a setting** box to **Force Deny** -and- -- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > named **Let Windows apps activate with voice while the system is locked** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > named **Let Windows apps activate with voice while the system is locked** box to **Force Deny** -OR- @@ -1539,18 +1550,17 @@ You can control if your settings are synchronized: To turn off Messaging cloud sync: -- Note: There is no Group Policy corresponding to this registry key. +> [!NOTE] +> There is no Group Policy corresponding to this registry key. - -or- - -- Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**. +- Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**. ### 22. Teredo You can disable Teredo by using Group Policy or by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](https://technet.microsoft.com/library/cc722030.aspx). >[!NOTE] ->If you disable Teredo, some XBOX gaming features and Windows Update Delivery Optimization will not work. +>If you disable Teredo, some XBOX gaming features and Delivery Optimization (with Group or Internet peering) will not work. - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**. @@ -1590,7 +1600,7 @@ You can disconnect from the Microsoft Antimalware Protection Service. >1. Ensure Windows and Windows Defender are fully up to date. >2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button. Then scroll down to the Tamper Protection toggle and turn it **Off**. This will allow you to modify the Registry key and allow the Group Policy to make the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link and then scroll down to the Tamper Protection toggle to set it to **Off**. -- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop-down box named **Join Microsoft MAPS** +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop-down box named **Join Microsoft MAPS** -OR- @@ -1603,7 +1613,7 @@ You can disconnect from the Microsoft Antimalware Protection Service. You can stop sending file samples back to Microsoft. -- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Never Send**. +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Never Send**. -or- @@ -1612,11 +1622,15 @@ You can stop sending file samples back to Microsoft. You can stop downloading **Definition Updates**: -- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. +> [!NOTE] +> The Group Policy path for 1809 and earlier builds is **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Signature Updates** + + +- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. -and- -- **Disable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to **Nothing**. +- **Disable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates** > **Define file shares for downloading definition updates** and set it to **Nothing**. -or- @@ -1631,7 +1645,8 @@ You can turn off **Malicious Software Reporting Tool (MSRT) diagnostic data**: - Set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to **1**. -**Note:** There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. +> [!NOTE] +> There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. You can turn off **Enhanced Notifications** as follows: @@ -1640,16 +1655,16 @@ You can turn off **Enhanced Notifications** as follows: -or- -- **Enable** the Group Policy **Turn off enhanced notifications** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Reporting**. +- **Enable** the Group Policy **Turn off enhanced notifications** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Reporting**. -or- -- Create a new REG_SZ registry setting named **DisableEnhancedNotifications** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Reporting** to a value of **1**. +- Create a new REG_DWORD registry setting named **DisableEnhancedNotifications** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Reporting** and enter the decimal value **1**. ### 24.1 Windows Defender SmartScreen -To disable Windows Defender Smartscreen: +To disable Windows Defender SmartScreen: In Group Policy, configure: @@ -1726,11 +1741,11 @@ If you're running Windows 10, version 1607 or later, you need to: > This will only take effect if the policy is applied before the first logon. > If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, > you can **Enable** the **Do not display the lock screen** policy under **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** - + > > Alternatively, you can create a new REG_SZ registry setting named **LockScreenImage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** > with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG_DWORD registry setting named **LockScreenOverlaysDisabled** in > **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **1 (one)**. - + > > The Group Policy for the **LockScreenOverlaysDisabled** regkey is **Force a specific default lock screen and logon image** that is under **Control Panel** **Personalization**. @@ -1794,19 +1809,19 @@ You can turn off apps for websites, preventing customers who visit websites that - Create a new REG_DWORD registry setting named **EnableAppUriHandlers** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)**. -### 28. Windows Update Delivery Optimization +### 28. Delivery Optimization -Windows Update Delivery Optimization lets you get Windows updates and Microsoft Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. +Delivery Optimization is the downloader of Windows updates, Microsoft Store apps, Office and other content from Microsoft. Delivery Optimization can also download from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization Peer-to-Peer option turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. -By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. +By default, PCs running Windows 10 will only use Delivery Optimization to get and receive updates for PCs and apps on your local network. Use the UI, Group Policy, or Registry Keys to set up Delivery Optimization. -In Windows 10 version 1607 and above you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to **Bypass** (100), as described below. +In Windows 10 version 1607 and above you can stop network traffic related to Delivery Optimization Cloud Service by setting **Download Mode** to **Simple Mode** (99), as described below. ### 28.1 Settings > Update & security -You can set up Delivery Optimization from the **Settings** UI. +You can set up Delivery Optimization Peer-to-Peer from the **Settings** UI. - Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. @@ -1822,17 +1837,23 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con | Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
        The default value is 20, which represents 20% of the disk.| | Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
        The default value is 0, which means unlimited possible bandwidth.| + +For a comprehensive list of Delivery Optimization Policies, see [Delivery Optimization Reference](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization-reference). + ### 28.3 Delivery Optimization -- **Enable** the **Download Mode** Group Policy under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization** and set the **Download Mode** to **"Bypass"** to prevent traffic. +- **Enable** the **Download Mode** Group Policy under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization** and set the **Download Mode** to **"Simple Mode (99)"** to prevent traffic between peers as well as traffic back to the Delivery Optimization Cloud Service. -or- -- Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **100 (one hundred)**. +- Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **99 (Ninety-nine)**. For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684). +For IT Professionals, information about Delivery Optimization is available here: [Delivery Optimization for Windows 10 updates] +(https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization). + ### 29. Windows Update You can turn off Windows Update by setting the following registry entries: @@ -1889,7 +1910,7 @@ For China releases of Windows 10 there is one additional Regkey to be set to pre ### Allowed traffic list for Windows Restricted Traffic Limited Functionality Baseline -|**Allowed traffic endpoints** | +|Allowed traffic endpoints| | --- | |activation-v2.sls.microsoft.com/*| |crl.microsoft.com/pki/crl/*| diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index aec2607c4f..8ec7b613c3 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -456,4 +456,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) -- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index 75b7e8cde2..9525d0fed9 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -461,4 +461,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) -- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index 6367bb1968..6ff4c469cf 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -15,6 +15,7 @@ ms.topic: article ms.date: 6/26/2018 ms.reviewer: --- + # Manage connection endpoints for Windows 10 Enterprise, version 1809 **Applies to** @@ -30,17 +31,17 @@ Some Windows components, app, and related services transfer data to Microsoft ne - Using your location to show a weather forecast. This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later. -Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). -Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it. +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it. We used the following methodology to derive these network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. +5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. @@ -49,70 +50,70 @@ We used the following methodology to derive these network endpoints: ## Apps -The following endpoint is used to download updates to the Weather app Live Tile. +The following endpoint is used to download updates to the Weather app Live Tile. If you [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#live-tiles), no Live Tiles will be updated. | Source process | Protocol | Destination | -|----------------|----------|------------| -| explorer | HTTP | tile-service.weather.microsoft.com | +|:--------------:|:--------:|:------------| +| explorer | HTTP | tile-service.weather.microsoft.com | | | HTTP | blob.weather.microsoft.com | -The following endpoint is used for OneNote Live Tile. -To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used for OneNote Live Tile. +To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | cdn.onenote.net/livetile/?Language=en-US | -The following endpoints are used for Twitter updates. -To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoints are used for Twitter updates. +To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | wildcard.twimg.com | | svchost.exe | | oem.twimg.com/windows/tile.xml | -The following endpoint is used for Facebook updates. -To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used for Facebook updates. +To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | star-mini.c10r.facebook.com | -The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. -To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. +To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | WindowsApps\Microsoft.Windows.Photos | HTTPS | evoke-windowsservices-tas.msedge.net | -The following endpoint is used for Candy Crush Saga updates. -To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used for Candy Crush Saga updates. +To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | TLS v1.2 | candycrushsoda.king.com | -The following endpoint is used for by the Microsoft Wallet app. -To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). -If you disable the Microsoft store, other Store apps cannot be installed or updated. +The following endpoint is used for by the Microsoft Wallet app. +To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). +If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | system32\AppHostRegistrationVerifier.exe | HTTPS | wallet.microsoft.com | -The following endpoint is used by the Groove Music app for update HTTP handler status. +The following endpoint is used by the Groove Music app for update HTTP handler status. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app. | Source process | Protocol | Destination | @@ -123,7 +124,7 @@ The following endpoints are used when using the Whiteboard app. To turn off traffic for this endpoint [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | wbd.ms | | | HTTPS | int.whiteboard.microsoft.com | | | HTTPS | whiteboard.microsoft.com | @@ -135,28 +136,28 @@ The following endpoint is used to get images that are used for Microsoft Store s If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block images that are used for Microsoft Store suggestions. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | searchui | HTTPS |store-images.s-microsoft.com | The following endpoint is used to update Cortana greetings, tips, and Live Tiles. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block updates to Cortana greetings, tips, and Live Tiles. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | backgroundtaskhost | HTTPS | www.bing.com/client | -The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments. +The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters would not be updated and the device would no longer participate in experiments. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | backgroundtaskhost | HTTPS | www.bing.com/proactive | The following endpoint is used by Cortana to report diagnostic and diagnostic data information. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and won't be able to fix them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | searchui
        backgroundtaskhost | HTTPS | www.bing.com/threshold/xls.aspx | ## Certificates @@ -164,13 +165,13 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. -These settings are critical for both Windows security and the overall security of the Internet. +These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device. | Source process | Protocol | Destination | -|----------------|----------|------------| -| svchost | HTTP | ctldl.windowsupdate.com | +|:--------------:|:--------:|:------------| +| svchost | HTTP | ctldl.windowsupdate.com | ## Device authentication @@ -178,7 +179,7 @@ The following endpoint is used to authenticate a device. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), the device will not be authenticated. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | login.live.com/ppsecure | ## Device metadata @@ -187,7 +188,7 @@ The following endpoint is used to retrieve device metadata. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-devinst), metadata will not be updated for the device. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | dmd.metaservices.microsoft.com.akadns.net | | | HTTP | dmd.metaservices.microsoft.com | @@ -197,21 +198,21 @@ The following endpoint is used by the Connected User Experiences and Telemetry c If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | | cy2.vortex.data.microsoft.com.akadns.net | The following endpoint is used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | v10.vortex-win.data.microsoft.com/collect/v1 | The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | wermgr | | watson.telemetry.microsoft.com | | | TLS v1.2 | modern.watson.data.microsoft.com.akadns.net | @@ -221,9 +222,9 @@ The following endpoints are used to download fonts on demand. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#font-streaming), you will not be able to download fonts on demand. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | | fs.microsoft.com | -| | | fs.microsoft.com/fs/windows/config.json | +| | | fs.microsoft.com/fs/windows/config.json | ## Licensing @@ -231,7 +232,7 @@ The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | licensemanager | HTTPS | licensing.mp.microsoft.com/v7.0/licenses/content | ## Location @@ -240,7 +241,7 @@ The following endpoint is used for location data. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location), apps cannot use location data. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTP | location-inference-westus.cloudapp.net | | | HTTPS | inference.location.live.net | @@ -250,16 +251,16 @@ The following endpoint is used to check for updates to maps that have been downl If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps), offline maps will not be updated. | Source process | Protocol | Destination | -|----------------|----------|------------| -| svchost | HTTPS | *g.akamaiedge.net | +|:--------------:|:--------:|:------------| +| svchost | HTTPS | *g.akamaiedge.net | ## Microsoft account -The following endpoints are used for Microsoft accounts to sign in. +The following endpoints are used for Microsoft accounts to sign in. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account), users cannot sign in with Microsoft accounts. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | login.msa.akadns6.net | | | | login.live.com | | | | account.live.com | @@ -272,29 +273,29 @@ The following endpoint is used for the Windows Push Notification Services (WNS). If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#live-tiles), push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | *.wns.windows.com | -The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. +The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTP | storecatalogrevocation.storequality.microsoft.com | -The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). +The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | img-prod-cms-rt-microsoft-com.akamaized.net | | backgroundtransferhost | HTTPS | store-images.microsoft.com | -The following endpoints are used to communicate with Microsoft Store. +The following endpoints are used to communicate with Microsoft Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTP | storeedgefd.dsx.mp.microsoft.com | | | HTTP \ HTTPS | pti.store.microsoft.com | ||TLS v1.2|cy2.\*.md.mp.microsoft.com.\*.| @@ -302,48 +303,48 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op ## Network Connection Status Indicator (NCSI) -Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. +Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi), NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTP | www.msftconnecttest.com/connecttest.txt | ## Office -The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. | Source process | Protocol | Destination | -|----------------|----------|------------| -| | | *.a-msedge.net | -| hxstr | | *.c-msedge.net | +|:--------------:|:--------:|:------------| +| | | *.a-msedge.net | +| hxstr | | *.c-msedge.net | | | | *.e-msedge.net | | | | *.s-msedge.net | | | HTTPS | ocos-office365-s2s.msedge.net | | | HTTPS | nexusrules.officeapps.live.com | | | HTTPS | officeclient.microsoft.com | -The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). +The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | system32\Auth.Host.exe | HTTPS | outlook.office365.com | The following endpoint is OfficeHub traffic used to get the metadata of Office apps. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| |Windows Apps\Microsoft.Windows.Photos|HTTPS|client-office365-tas.msedge.net| The following endpoint is used to connect the Office To-Do app to it's cloud service. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | |HTTPS|to-do.microsoft.com| ## OneDrive @@ -352,15 +353,15 @@ The following endpoint is a redirection service that’s used to automatically u If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive), anything that relies on g.live.com to get updated URL information will no longer work. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | onedrive | HTTP \ HTTPS | g.live.com/1rewlive5skydrive/ODSUProduction | The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). To turn off traffic for this endpoint, uninstall OneDrive for Business. In this case, your device will not able to get OneDrive for Business app updates. | Source process | Protocol | Destination | -|----------------|----------|------------| -| onedrive | HTTPS | oneclient.sfx.ms | +|:--------------:|:--------:|:------------| +| onedrive | HTTPS | oneclient.sfx.ms | ## Settings @@ -368,21 +369,21 @@ The following endpoint is used as a way for apps to dynamically update their con If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | dmclient | | cy2.settings.data.microsoft.com.akadns.net | The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | dmclient | HTTPS | settings.data.microsoft.com | The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as Windows Connected User Experiences and Telemetry component and Windows Insider Program use it. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | settings-win.data.microsoft.com | ## Skype @@ -390,7 +391,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| |microsoft.windowscommunicationsapps.exe | HTTPS | config.edge.skype.com | | | HTTPS | browser.pipe.aria.microsoft.com | | | | skypeecs-prod-usw-0-b.cloudapp.net | @@ -398,17 +399,17 @@ The following endpoint is used to retrieve Skype configuration values. To turn o ## Windows Defender The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection. For a detailed list of Windows Defender Antivirus cloud service connections, see [Allow connections to the Windows Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus#allow-connections-to-the-windows-defender-antivirus-cloud-service). +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection. For a detailed list of Microsoft Defender Antivirus cloud service connections, see [Allow connections to the Microsoft Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus#allow-connections-to-the-microsoft-defender-antivirus-cloud-service). | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | wdcp.microsoft.com | The following endpoints are used for Windows Defender definition updates. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), definitions will not be updated. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | | definitionupdates.microsoft.com | |MpCmdRun.exe|HTTPS|go.microsoft.com | @@ -416,10 +417,10 @@ The following endpoints are used for Windows Defender Smartscreen reporting and If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Windows Defender Smartscreen notifications will no appear. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | | HTTPS | ars.smartscreen.microsoft.com | | | HTTPS | unitedstates.smartscreen-prod.microsoft.com | -| | | smartscreen-sn3p.smartscreen.microsoft.com | +| | | smartscreen-sn3p.smartscreen.microsoft.com | ## Windows Spotlight @@ -427,7 +428,7 @@ The following endpoints are used to retrieve Windows Spotlight metadata that des If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight), Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see [Windows Spotlight](/windows/configuration/windows-spotlight). | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | backgroundtaskhost | HTTPS | arc.msn.com | | backgroundtaskhost | | g.msn.com.nsatc.net | | |TLS v1.2| *.search.msn.com | @@ -440,22 +441,22 @@ The following endpoint is used for Windows Update downloads of apps and OS updat If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates), Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | *.prod.do.dsp.mp.microsoft.com | -The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. +The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to download updates for the operating system. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTP | *.windowsupdate.com | | svchost | HTTP | *.dl.delivery.mp.microsoft.com | -The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. +The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | *.update.microsoft.com | | svchost | HTTPS | *.delivery.mp.microsoft.com | @@ -467,7 +468,7 @@ The following endpoint is used for content regulation. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all. | Source process | Protocol | Destination | -|----------------|----------|------------| +|:--------------:|:--------:|:------------| | svchost | HTTPS | tsfe.trafficshaping.dsp.mp.microsoft.com | @@ -478,7 +479,7 @@ The following endpoint is used by the Microsoft forward link redirection service If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded. | Source process | Protocol | Destination | -|----------------|----------|------------| +|----------------|:--------:|------------| |Various|HTTPS|go.microsoft.com| ## Other Windows 10 editions @@ -496,4 +497,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) -- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune) +- [Network endpoints for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index f3b541e69a..9aa743d944 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -7,12 +7,12 @@ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro -author: danihalfin -ms.author: v-medgar -manager: sanashar +author: linque1 +ms.author: obezeajo +manager: robsize ms.collection: M365-security-compliance ms.topic: article -ms.date: 5/3/2019 +ms.date: 7/22/2020 --- # Manage connection endpoints for Windows 10 Enterprise, version 1903 @@ -106,6 +106,7 @@ The following methodology was used to derive these network endpoints: |||HTTP|us.configsvc1.live.com.akadns.net| |Microsoft Edge|This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com| |Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTPS|go.microsoft.com| +|||HTTP|www.microsoft.com| |Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| ||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|HTTPS|*.wns.windows.com| ||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTP|storecatalogrevocation.storequality.microsoft.com| @@ -137,6 +138,7 @@ The following methodology was used to derive these network endpoints: |||HTTP \ HTTPS|g.live.com/1rewlive5skydrive/*| |||HTTP|msagfx.live.com| |||HTTPS|oneclient.sfx.ms| +|||HTTP| windows.policies.live.net| |Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| |||HTTPS|cy2.settings.data.microsoft.com.akadns.net| |||HTTPS|settings.data.microsoft.com| @@ -166,7 +168,8 @@ The following methodology was used to derive these network endpoints: |||HTTP|*.windowsupdate.com| ||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTPS|*.delivery.mp.microsoft.com| |||HTTPS|*.update.microsoft.com| -||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|HTTPS|tsfe.trafficshaping.dsp.mp.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|HTTPS|tsfe.trafficshaping.dsp.mp.microsoft.com| ## Other Windows 10 editions @@ -184,6 +187,6 @@ To view endpoints for non-Enterprise Windows 10 editions, see: ## Related links - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) -- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-1909-endpoints.md b/windows/privacy/manage-windows-1909-endpoints.md new file mode 100644 index 0000000000..9fe2ca8cc1 --- /dev/null +++ b/windows/privacy/manage-windows-1909-endpoints.md @@ -0,0 +1,140 @@ +--- +title: Connection endpoints for Windows 10 Enterprise, version 1909 +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1909. +keywords: privacy, manage connections to Microsoft, Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: v-hakima +manager: obezeajo +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 7/22/2020 +--- +# Manage connection endpoints for Windows 10 Enterprise, version 1909 + +**Applies to** + +- Windows 10 Enterprise, version 1909 + +Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: + +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. + +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to the specific details on how to control that traffic. + +The following methodology was used to derive these network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 1909 Enterprise connection endpoints + +|Area|Description|Protocol|Destination| +|----------------|----------|----------|------------| +|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| +|||HTTP|tile-service.weather.microsoft.com/en-us/livetile/preinstall| +||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/*| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLS v1.2|evoke-windowsservices-tas.msedge.net +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|||HTTP|ctldl.windowsupdate.com| +|Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| +||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|HTTPS|www.bing.com*| +|||HTTPS|www.bing.com/client/config| +|||TLS v1.2|fp.msedge.net| +|Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +||The following endpoint is used to authenticate a device. If you turn off traffic for this endpoint, the device will not be authenticated.|HTTPS|login.live.com*| +|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||HTTP|v10.events.data.microsoft.com| +||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|HTTPS|*.telecommand.telemetry.microsoft.com| +|||TLS v1.2|watson.*.microsoft.com| +|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| +|||HTTPS|*licensing.mp.microsoft.com| +|||HTTPS|licensing.mp.microsoft.com/v7.0/licenses/content| +|Location|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location)| +||The following endpoints are used for location data. If you turn off traffic for this endpoint, apps cannot use location data.|TLS v1.2|inference.location.live.net| +|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)| +||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|HTTP|*maps.windows.com| +|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| +||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |TLS v1.2|*login.live.com| +|Microsoft Edge|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge)| +||This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com| +|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTPS|go.microsoft.com| +|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +||The following endpoints are used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them|TLS v1.2|1storecatalogrevocation.storequality.microsoft.com| +|||HTTPS|storecatalogrevocation.storequality.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|HTTPS|manage.devcenter.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|HTTPS|displaycatalog.mp.microsoft.com/*| +|||HTTPS|pti.store.microsoft.com/*| +|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| +||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTP/ TLS v1.2|v10.events.data.microsoft.com/onecollector/1.0/| +|||TLS v1.2|*.blob.core.windows.net| +|||HTTP|officehomeblobs.blob.core.windows.net| +||The following endpoints are used by Microsoft OfficeHub to get the metadata of Microsoft Office apps |TLS v1.2|c-ring.msedge.net| +|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| +|||TLS v1.2|*g.live.com| +|||HTTPS|oneclient.sfx.ms| +|||HTTPS| logincdn.msauth.net| +|||HTTP| windows.policies.live.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLS v1.2|settings-win.data.microsoft.com| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTPS|*.pipe.aria.microsoft.com| +|||HTTP/TLS v1.2|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +|||HTTPS/TLS v1.2|wdcp.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications will not appear.|HTTPS/TLS v1.2|*smartscreen-prod.microsoft.com| +|||HTTPS|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| +|||HTTPS/TLS v1.2|arc.msn.com| +|||HTTPS|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||HTTPS/TLS v1.2|*.prod.do.dsp.mp.microsoft.com| +|||HTTP|emdl.ws.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|HTTP|*.dl.delivery.mp.microsoft.com| +|||HTTP|*.windowsupdate.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTP|*.delivery.mp.microsoft.com| +|||HTTPS/TLS v1.2|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|HTTPS/TLS v1.2|tsfe.trafficshaping.dsp.mp.microsoft.com| +## Other Windows 10 editions + +To view endpoints for other versions of Windows 10 Enterprise, see: +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) + +To view endpoints for non-Enterprise Windows 10 editions, see: +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) + + +## Related links + +- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-2004-endpoints.md b/windows/privacy/manage-windows-2004-endpoints.md new file mode 100644 index 0000000000..aea5913427 --- /dev/null +++ b/windows/privacy/manage-windows-2004-endpoints.md @@ -0,0 +1,141 @@ +--- +title: Connection endpoints for Windows 10 Enterprise, version 2004 +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 2004. +keywords: privacy, manage connections to Microsoft, Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: linque1 +ms.author: robsize +manager: robsize +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 10/22/2020 +--- +# Manage connection endpoints for Windows 10 Enterprise, version 2004 + +**Applies to** + +- Windows 10 Enterprise, version 2004 + +Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: + +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. + +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to the specific details on how to control that traffic. + +The following methodology was used to derive these network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 2004 Enterprise connection endpoints + +|Area|Description|Protocol|Destination| +|----------------|----------|----------|------------| +|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +||The following endpoints are used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|blob.weather.microsoft.com| +|||HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/* +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2|evoke-windowsservices-tas.msedge.net| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|||HTTP|ctldl.windowsupdate.com| +|Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| +||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2|www.bing.com*| +|Device metadata|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)| +||The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.|HTTPS|dmd.metaservices.microsoft.com| +|Diagnostic Data|The following endpoints are used by the Windows Diagnostic Data, Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2|v10.events.data.microsoft.com| +||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|HTTPS|*.telecommand.telemetry.microsoft.com| +|||TLS v1.2|watson.*.microsoft.com| +|Font Streaming|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#6-font-streaming)| +||The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand. |HTTPS|fs.microsoft.com*| +|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| +|||HTTPS|*licensing.mp.microsoft.com| +|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)| +||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|TLSv1.2|*maps.windows.com| +|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| +||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |TLSv1.2|*login.live.com| +|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTPS|go.microsoft.com| +|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLSv1.2/HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|TLSv1.2|*.wns.windows.com| +||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLSv1.2|storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|HTTPS|*displaycatalog.mp.microsoft.com| +|||HTTP|*.dl.delivery.mp.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| +||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|*ow1.res.office365.com| +|||HTTPS|office.com| +|||HTTPS|blobs.officehome.msocdn.com| +|||HTTPS|self.events.data.microsoft.com| +|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| +|||TLSv1.2|*g.live.com| +|||TLSv1.2|oneclient.sfx.ms| +|||HTTPS| logincdn.msauth.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2|settings-win.data.microsoft.com| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTPS|*.pipe.aria.microsoft.com| +|||HTTPS|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||TLSv1.2|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +|||TLSv1.2|wdcp.microsoft.com| +|||HTTPS|go.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications will not appear.|HTTPS|*smartscreen-prod.microsoft.com| +|||HTTPS|*smartscreen.microsoft.com | +|||HTTPS|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| +|||TLSv1.2|arc.msn.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||TLSv1.2|*.prod.do.dsp.mp.microsoft.com| +|||HTTP|emdl.ws.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|HTTP|*.dl.delivery.mp.microsoft.com| +|||HTTP|*.windowsupdate.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTPS|*.delivery.mp.microsoft.com| +|||TLSv1.2|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP|adl.windows.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|TLSv1.2|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoint is used for Xbox Live.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||TLSv1.2|dlassets-ssl.xboxlive.com| + +## Other Windows 10 editions + +To view endpoints for other versions of Windows 10 Enterprise, see: +- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) + +To view endpoints for non-Enterprise Windows 10 editions, see: +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) + + +## Related links + +- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md new file mode 100644 index 0000000000..d449b47b4c --- /dev/null +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -0,0 +1,158 @@ +--- +title: Connection endpoints for Windows 10 Enterprise, version 20H2 +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 20H2. +keywords: privacy, manage connections to Microsoft, Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: v-hakima +manager: robsize +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 12/17/2020 +--- + +# Manage connection endpoints for Windows 10 Enterprise, version 20H2 + +**Applies to** + +- Windows 10 Enterprise, version 20H2 + +Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: + +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. + +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to the specific details on how to control that traffic. + +The following methodology was used to derive these network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 20H2 Enterprise connection endpoints + +|Area|Description|Protocol|Destination| +|----------------|----------|----------|------------| +|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| +|Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| +||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|||TLSv1.2/HTTPS/HTTP|fp.msedge.net| +|||TLSv1.2|I-ring.msedge.net| +|||HTTPS|s-ring.msedge.net| +|Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +||The following endpoint is used to authenticate a device. If you turn off traffic for this endpoint, the device will not be authenticated.|HTTPS|login.live.com*| +|Device metadata|The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)| +|||HTTP|dmd.metaservices.microsoft.com| +|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2/HTTPS/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|TLSv1.2|telecommand.telemetry.microsoft.com| +|||TLS v1.2/HTTPS/HTTP|watson.*.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#6-font-streaming)| +|||HTTPS|fs.microsoft.com| +|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| +|||TLSv1.2/HTTPS/HTTP|licensing.mp.microsoft.com| +|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)| +||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|TLSv1.2/HTTPS/HTTP|maps.windows.com| +|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| +||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |TLSv1.2/HTTPS|login.live.com| +|Microsoft Edge|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge)| +||This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com| +||The following endpoint is used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates.|TLSv1.2/HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTP|go.microsoft.com| +|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoints are used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|HTTPS|manage.devcenter.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|TLSv1.2/HTTPS/HTTP|displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTP|share.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| +||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTPS|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|www.office.com| +|||HTTPS|blobs.officehome.msocdn.com| +|||HTTPS|officehomeblobs.blob.core.windows.net| +|||HTTPS|self.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| +|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| +|||TLSv1.2/HTTPS/HTTP|g.live.com| +|||TLSv1.2/HTTPS/HTTP|oneclient.sfx.ms| +|||HTTPS| logincdn.msauth.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com| +|||HTTPS|settings.data.microsoft.com| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +|||HTTPS/TLSv1.2|wdcp.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications will not appear.|HTTPS|*smartscreen-prod.microsoft.com| +|||HTTPS/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| +|||TLSv1.2/HTTPS/HTTP|arc.msn.com| +|||HTTPS|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||HTTP|emdl.ws.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +|||HTTP|*.windowsupdate.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTPS|adl.windows.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoint is used for Xbox Live.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|dlassets-ssl.xboxlive.com| + + +## Other Windows 10 editions + +To view endpoints for other versions of Windows 10 Enterprise, see: + +- [Manage connection endpoints for Windows 10, version 2004](manage-windows-2004-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) + +To view endpoints for non-Enterprise Windows 10 editions, see: + +- [Windows 10, version 2004, connection endpoints for non-Enterprise editions](windows-endpoints-2004-non-enterprise-editions.md) +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) + +## Related links + +- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md new file mode 100644 index 0000000000..2605b80713 --- /dev/null +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -0,0 +1,7575 @@ +--- +description: Use this article to learn more about what required Windows 10 version 2004 and version 20H2 diagnostic data is gathered. +title: Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) +keywords: privacy, telemetry +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.author: brianlic +manager: dansimp +ms.collection: M365-security-compliance +ms.topic: article +audience: ITPro +ms.date: 09/30/2020 +--- + + +# Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields + + +> [!IMPORTANT] +> Windows is moving to classifying the data collected from customer’s devices as either *Required* or *Optional*. + + + **Applies to** + +- Windows 10, version 20H2 +- Windows 10, version 2004 + + +Required diagnostic data gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. + +Required diagnostic data helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. + +Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. + +You can learn more about Windows functional and diagnostic data through these articles: + +- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) +- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) +- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) +- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) +- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) +- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) +- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) + + + + +## Appraiser events + +### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount + +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DatasourceApplicationFile_19H1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_20H1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS4** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_TH1** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_TH2** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_19H1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_20H1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device. +- **DatasourceDevicePnp_RS2** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS4** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_TH1** The count of the number of this particular object type present on this device. +- **DatasourceDevicePnp_TH2** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_19H1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_20H1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device. +- **DatasourceDriverPackage_RS2** The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device. +- **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_TH1** The count of the number of this particular object type present on this device. +- **DatasourceDriverPackage_TH2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoBlock_RS2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoPassive_RS2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. +- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. +- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_19H1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_20H1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_20H1Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device. +- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device. +- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device. +- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS4Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_RS5Setup** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_TH1** The count of the number of this particular object type present on this device. +- **DatasourceSystemBios_TH2** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_19H1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_20H1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS2** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_TH1** The count of the number of this particular object type present on this device. +- **DecisionApplicationFile_TH2** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_19H1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_20H1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device. +- **DecisionDevicePnp_RS2** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_TH1** The count of the number of this particular object type present on this device. +- **DecisionDevicePnp_TH2** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_19H1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_20H1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device. +- **DecisionDriverPackage_RS2** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_TH1** The count of the number of this particular object type present on this device. +- **DecisionDriverPackage_TH2** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device. +- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device. +- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device. +- **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. +- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device. +- **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device. +- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. +- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. +- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. +- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_19H1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_19H1Setup** The total DecisionMediaCenter objects targeting the next release of Windows on this device. +- **DecisionMediaCenter_20H1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device. +- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device. +- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device. +- **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_TH1** The count of the number of this particular object type present on this device. +- **DecisionMediaCenter_TH2** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_19H1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. +- **DecisionSystemBios_20H1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_20H1Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device. +- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device. +- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device. +- **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device. +- **DecisionSystemBios_RS4Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. +- **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device. +- **DecisionSystemBios_RS5Setup** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. +- **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. +- **InventoryApplicationFile** The count of the number of this particular object type present on this device. +- **InventoryLanguagePack** The count of the number of this particular object type present on this device. +- **InventoryMediaCenter** The count of the number of this particular object type present on this device. +- **InventorySystemBios** The count of the number of this particular object type present on this device. +- **InventoryTest** The count of the number of this particular object type present on this device. +- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device. +- **PCFP** The count of the number of this particular object type present on this device. +- **SystemMemory** The count of the number of this particular object type present on this device. +- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device. +- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device. +- **SystemProcessorNx** The total number of objects of this type present on this device. +- **SystemProcessorPrefetchW** The total number of objects of this type present on this device. +- **SystemProcessorSse2** The total number of objects of this type present on this device. +- **SystemTouch** The count of the number of this particular object type present on this device. +- **SystemWim** The total number of objects of this type present on this device. +- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device. +- **SystemWlan** The total number of objects of this type present on this device. +- **Wmdrm_19H1** The count of the number of this particular object type present on this device. +- **Wmdrm_19H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. +- **Wmdrm_20H1** The count of the number of this particular object type present on this device. +- **Wmdrm_20H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. +- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers. +- **Wmdrm_RS2** An ID for the system, calculated by hashing hardware identifiers. +- **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers. +- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device. +- **Wmdrm_RS5** The count of the number of this particular object type present on this device. +- **Wmdrm_TH1** The count of the number of this particular object type present on this device. +- **Wmdrm_TH2** The count of the number of this particular object type present on this device. + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd + +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file that is generating the events. +- **AvDisplayName** If the app is an anti-virus app, this is its display name. +- **CompatModelIndex** The compatibility prediction for this file. +- **HasCitData** Indicates whether the file is present in CIT data. +- **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file. +- **IsAv** Is the file an anti-virus reporting EXE? +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. +- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file. + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove + +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync + +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd + +This event sends compatibility data for a Plug and Play device, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **ActiveNetworkConnection** Indicates whether the device is an active network device. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **IsBootCritical** Indicates whether the device boot is critical. +- **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update. +- **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver. +- **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove + +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync + +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd + +This event sends compatibility database data about driver packages to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove + +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync + +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd + +This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **ResolveAttempted** This will always be an empty string when sending diagnostic data. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove + +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync + +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd + +This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove + +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync + +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd + +This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync + +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd + +This event sends compatibility database information about the BIOS to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync + +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd + +This event sends compatibility decision data about a file to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file that is generating the events. +- **BlockAlreadyInbox** The uplevel runtime block on the file already existed on the current OS. +- **BlockingApplication** Indicates whether there are any application issues that interfere with the upgrade due to the file in question. +- **DisplayGenericMessage** Will be a generic message be shown for this file? +- **DisplayGenericMessageGated** Indicates whether a generic message be shown for this file. +- **HardBlock** This file is blocked in the SDB. +- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB? +- **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode? +- **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? +- **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app. +- **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade? +- **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app. +- **NeedsUninstallAction** The file must be uninstalled to complete the upgrade. +- **SdbBlockUpgrade** The file is tagged as blocking upgrade in the SDB, +- **SdbBlockUpgradeCanReinstall** The file is tagged as blocking upgrade in the SDB. It can be reinstalled after upgrade. +- **SdbBlockUpgradeUntilUpdate** The file is tagged as blocking upgrade in the SDB. If the app is updated, the upgrade can proceed. +- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the SDB. It does not block upgrade. +- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. +- **SoftBlock** The file is softblocked in the SDB and has a warning. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove + +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync + +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd + +This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked? +- **AssociatedDriverWillNotMigrate** Will the driver associated with this plug-and-play device migrate? +- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked? +- **BlockingDevice** Is this PNP device blocking upgrade? +- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS? +- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork** Is this PNP device the only active network device? +- **DisplayGenericMessage** Will a generic message be shown during Setup for this PNP device? +- **DisplayGenericMessageGated** Indicates whether a generic message will be shown during Setup for this PNP device. +- **DriverAvailableInbox** Is a driver included with the operating system for this PNP device? +- **DriverAvailableOnline** Is there a driver for this PNP device on Windows Update? +- **DriverAvailableUplevel** Is there a driver on Windows Update or included with the operating system for this PNP device? +- **DriverBlockOverridden** Is there is a driver block on the device that has been overridden? +- **NeedsDismissAction** Will the user would need to dismiss a warning during Setup for this device? +- **NotRegressed** Does the device have a problem code on the source OS that is no better than the one it would have on the target OS? +- **SdbDeviceBlockUpgrade** Is there an SDB block on the PNP device that blocks upgrade? +- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden? + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove + +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync + +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd + +This event sends decision data about driver package compatibility to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **DisplayGenericMessageGated** Indicates whether a generic offer block message will be shown for this driver package. +- **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? +- **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block? +- **DriverIsDriverBlocked** Is the driver package blocked because of a driver block? +- **DriverIsTroubleshooterBlocked** Indicates whether the driver package is blocked because of a troubleshooter block. +- **DriverShouldNotMigrate** Should the driver package be migrated during upgrade? +- **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove + +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync + +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd + +This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **BlockingApplication** Are there are any application issues that interfere with upgrade due to matching info blocks? +- **DisplayGenericMessage** Will a generic message be shown for this block? +- **NeedsDismissAction** Will the file cause an action that can be dismissed? +- **NeedsUninstallAction** Does the user need to take an action in setup due to a matching info block? +- **SdbBlockUpgrade** Is a matching info block blocking upgrade? +- **SdbBlockUpgradeCanReinstall** Is a matching info block blocking upgrade, but has the can reinstall tag? +- **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag? +- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove + +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync + +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveAdd + +This event sends compatibility decision data about non-blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BlockingApplication** Are there any application issues that interfere with upgrade due to matching info blocks? +- **DisplayGenericMessageGated** Indicates whether a generic offer block message will be shown due to matching info blocks. +- **MigApplication** Is there a matching info block with a mig for the current mode of upgrade? + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove + +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync + +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd + +This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **NeedsInstallPostUpgradeData** Will the file have a notification after upgrade to install a replacement for the app? +- **NeedsNotifyPostUpgradeData** Should a notification be shown for this file after upgrade? +- **NeedsReinstallPostUpgradeData** Will the file have a notification after upgrade to reinstall the app? +- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync + +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd + +This event sends decision data about the presence of Windows Media Center, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **BlockingApplication** Is there any application issues that interfere with upgrade due to Windows Media Center? +- **MediaCenterActivelyUsed** If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true? +- **MediaCenterIndicators** Do any indicators imply that Windows Media Center is in active use? +- **MediaCenterInUse** Is Windows Media Center actively being used? +- **MediaCenterPaidOrActivelyUsed** Is Windows Media Center actively being used or is it running on a supported edition? +- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center? + + +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync + +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd + +This event sends compatibility decision data about the BIOS to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the device blocked from upgrade due to a BIOS block? +- **DisplayGenericMessageGated** Indicates whether a generic offer block message will be shown for the bios. +- **HasBiosBlock** Does the device have a BIOS block? + + +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync + +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.GatedRegChange + +This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date. + +The following fields are available: + +- **NewData** The data in the registry value after the scan completed. +- **OldData** The previous data in the registry value before the scan ran. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **RegKey** The registry key name for which a result is being sent. +- **RegValue** The registry value for which a result is being sent. +- **Time** The client time of the event. + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd + +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **AvDisplayName** If the app is an antivirus app, this is its display name. +- **AvProductState** Indicates whether the antivirus program is turned on and the signatures are up to date. +- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64. +- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets. +- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets. +- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata. +- **CompanyName** The company name of the vendor who developed this file. +- **FileId** A hash that uniquely identifies a file. +- **FileVersion** The File version field from the file metadata under Properties -> Details. +- **HasUpgradeExe** Indicates whether the antivirus app has an upgrade.exe file. +- **IsAv** Indicates whether the file an antivirus reporting EXE. +- **LinkDate** The date and time that this file was linked on. +- **LowerCaseLongPath** The full file path to the file that was inventoried on the device. +- **Name** The name of the file that was inventoried. +- **ProductName** The Product name field from the file metadata under Properties -> Details. +- **ProductVersion** The Product version field from the file metadata under Properties -> Details. +- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it. +- **Size** The size of the file (in hexadecimal bytes). + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove + +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync + +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd + +This event sends data about the number of language packs installed on the system, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **HasLanguagePack** Indicates whether this device has 2 or more language packs. +- **LanguagePackCount** The number of language packs are installed. + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove + +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync + +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd + +This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **EverLaunched** Has Windows Media Center ever been launched? +- **HasConfiguredTv** Has the user configured a TV tuner through Windows Media Center? +- **HasExtendedUserAccounts** Are any Windows Media Center Extender user accounts configured? +- **HasWatchedFolders** Are any folders configured for Windows Media Center to watch? +- **IsDefaultLauncher** Is Windows Media Center the default app for opening music or video files? +- **IsPaid** Is the user running a Windows Media Center edition that implies they paid for Windows Media Center? +- **IsSupported** Does the running OS support Windows Media Center? + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove + +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync + +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd + +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **biosDate** The release date of the BIOS in UTC format. +- **BiosDate** The release date of the BIOS in UTC format. +- **biosName** The name field from Win32_BIOS. +- **BiosName** The name field from Win32_BIOS. +- **manufacturer** The manufacturer field from Win32_ComputerSystem. +- **Manufacturer** The manufacturer field from Win32_ComputerSystem. +- **model** The model field from Win32_ComputerSystem. +- **Model** The model field from Win32_ComputerSystem. + + +### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync + +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd + +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BootCritical** Is the driver package marked as boot critical? +- **Build** The build value from the driver package. +- **CatalogFile** The name of the catalog file within the driver package. +- **Class** The device class from the driver package. +- **ClassGuid** The device class unique ID from the driver package. +- **Date** The date from the driver package. +- **Inbox** Is the driver package of a driver that is included with Windows? +- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU. +- **Provider** The provider of the driver package. +- **PublishedName** The name of the INF file after it was renamed. +- **Revision** The revision of the driver package. +- **SignatureStatus** Indicates if the driver package is signed. Unknown = 0, Unsigned = 1, Signed = 2. +- **VersionMajor** The major version of the driver package. +- **VersionMinor** The minor version of the driver package. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove + +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync + +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.RunContext + +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. + +The following fields are available: + +- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built. +- **AppraiserProcess** The name of the process that launched Appraiser. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **CensusId** A unique hardware identifier. +- **Context** Indicates what mode Appraiser is running in. Example: Setup or Telemetry. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **Subcontext** Indicates what categories of incompatibilities appraiser is scanning for. Can be N/A, Resolve, or a semicolon-delimited list that can include App, Dev, Sys, Gat, or Rescan. +- **Time** The client time of the event. + + +### Microsoft.Windows.Appraiser.General.SystemMemoryAdd + +This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the device from upgrade due to memory restrictions? +- **MemoryRequirementViolated** Was a memory requirement violated? +- **pageFile** The current committed memory limit for the system or the current process, whichever is smaller (in bytes). +- **ram** The amount of memory on the device. +- **ramKB** The amount of memory (in KB). +- **virtual** The size of the user-mode portion of the virtual address space of the calling process (in bytes). +- **virtualKB** The amount of virtual memory (in KB). + + +### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync + +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd + +This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **CompareExchange128Support** Does the CPU support CompareExchange128? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync + +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd + +This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **LahfSahfSupport** Does the CPU support LAHF/SAHF? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync + +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd + +This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **NXDriverResult** The result of the driver used to do a non-deterministic check for NX support. +- **NXProcessorSupport** Does the processor support NX? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync + +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd + +This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **PrefetchWSupport** Does the processor support PrefetchW? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync + +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add + +This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **SSE2ProcessorSupport** Does the processor support SSE2? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync + +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemTouchAdd + +This event sends data indicating whether the system supports touch, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **IntegratedTouchDigitizerPresent** Is there an integrated touch digitizer? +- **MaximumTouches** The maximum number of touch points supported by the device hardware. + + +### Microsoft.Windows.Appraiser.General.SystemTouchRemove + +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemTouchStartSync + +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWimAdd + +This event sends data indicating whether the operating system is running from a compressed Windows Imaging Format (WIM) file, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **IsWimBoot** Is the current operating system running from a compressed WIM file? +- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. + + +### Microsoft.Windows.Appraiser.General.SystemWimStartSync + +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd + +This event sends data indicating whether the current operating system is activated, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **WindowsIsLicensedApiValue** The result from the API that's used to indicate if operating system is activated. +- **WindowsNotActivatedDecision** Is the current operating system activated? + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove + +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync + +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWlanAdd + +This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked because of an emulated WLAN driver? +- **HasWlanBlock** Does the emulated WLAN driver have an upgrade block? +- **WlanEmulatedDriver** Does the device have an emulated WLAN driver? +- **WlanExists** Does the device support WLAN at all? +- **WlanModulePresent** Are any WLAN modules present? +- **WlanNativeDriver** Does the device have a non-emulated WLAN driver? + + +### Microsoft.Windows.Appraiser.General.SystemWlanStartSync + +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.TelemetryRunHealth + +This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date. + +The following fields are available: + +- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built. +- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run. +- **AppraiserProcess** The name of the process that launched Appraiser. +- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. +- **AuxFinal** Obsolete, always set to false. +- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. +- **CountCustomSdbs** The number of custom Sdbs used by Appraiser. +- **CustomSdbGuids** Guids of the custom Sdbs used by Appraiser; Semicolon delimited list. +- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. +- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. +- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. +- **InboxDataVersion** The original version of the data files before retrieving any newer version. +- **IndicatorsWritten** Indicates if all relevant UEX indicators were successfully written or updated. +- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal. +- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row. +- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. +- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime. +- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic. +- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. +- **RunResult** The hresult of the Appraiser diagnostic data run. +- **ScheduledUploadDay** The day scheduled for the upload. +- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run. +- **StoreHandleIsNotNull** Obsolete, always set to false +- **TelementrySent** Indicates whether diagnostic data was successfully sent. +- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability. +- **Time** The client time of the event. +- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging. +- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated. + + +### Microsoft.Windows.Appraiser.General.WmdrmAdd + +This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BlockingApplication** Same as NeedsDismissAction. +- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation. +- **WmdrmApiResult** Raw value of the API used to gather DRM state. +- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs. +- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased. +- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed. +- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses. +- **WmdrmPurchased** Indicates if the system has any files with permanent licenses. + + +### Microsoft.Windows.Appraiser.General.WmdrmStartSync + +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +## Audio endpoint events + +### MicArrayGeometry + +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **MicCoords** The location and orientation of the microphone element. +- **usFrequencyBandHi** The high end of the frequency range for the microphone. +- **usFrequencyBandLo** The low end of the frequency range for the microphone. +- **usMicArrayType** The type of the microphone array. +- **usNumberOfMicrophones** The number of microphones in the array. +- **usVersion** The version of the microphone array specification. +- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). +- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). +- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). +- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). + +### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo + +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BusEnumeratorName** The name of the bus enumerator (for example, HDAUDIO or USB). +- **ContainerId** An identifier that uniquely groups the functional devices associated with a single-function or multifunction device. +- **DeviceInstanceId** The unique identifier for this instance of the device. +- **EndpointDevnodeId** The IMMDevice identifier of the associated devnode. +- **endpointEffectClsid** The COM Class Identifier (CLSID) for the endpoint effect audio processing object. +- **endpointEffectModule** Module name for the endpoint effect audio processing object. +- **EndpointFormFactor** The enumeration value for the form factor of the endpoint device (for example speaker, microphone, remote network device). +- **endpointID** The unique identifier for the audio endpoint. +- **endpointInstanceId** The unique identifier for the software audio endpoint. Used for joining to other audio event. +- **Flow** Indicates whether the endpoint is capture (1) or render (0). +- **globalEffectClsid** COM Class Identifier (CLSID) for the legacy global effect audio processing object. +- **globalEffectModule** Module name for the legacy global effect audio processing object. +- **HWID** The hardware identifier for the endpoint. +- **isAudioPostureSupported** Represents whether the device supports AudioPosture. +- **IsBluetooth** Indicates whether the device is a Bluetooth device. +- **isFarField** A flag indicating whether the microphone endpoint is capable of hearing far field audio. +- **IsSideband** Indicates whether the device is a sideband device. +- **IsUSB** Indicates whether the device is a USB device. +- **JackSubType** A unique ID representing the KS node type of the endpoint. +- **localEffectClsid** The COM Class Identifier (CLSID) for the legacy local effect audio processing object. +- **localEffectModule** Module name for the legacy local effect audio processing object. +- **MicArrayGeometry** Describes the microphone array, including the microphone position, coordinates, type, and frequency range. See [MicArrayGeometry](#micarraygeometry). +- **modeEffectClsid** The COM Class Identifier (CLSID) for the mode effect audio processing object. +- **modeEffectModule** Module name for the mode effect audio processing object. +- **persistentId** A unique ID for this endpoint which is retained across migrations. +- **streamEffectClsid** The COM Class Identifier (CLSID) for the stream effect audio processing object. +- **streamEffectModule** Module name for the stream effect audio processing object. + + +## Census events + +### Census.App + +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AppraiserEnterpriseErrorCode** The error code of the last Appraiser enterprise run. +- **AppraiserErrorCode** The error code of the last Appraiser run. +- **AppraiserRunEndTimeStamp** The end time of the last Appraiser run. +- **AppraiserRunIsInProgressOrCrashed** Flag that indicates if the Appraiser run is in progress or has crashed. +- **AppraiserRunStartTimeStamp** The start time of the last Appraiser run. +- **AppraiserTaskEnabled** Whether the Appraiser task is enabled. +- **AppraiserTaskExitCode** The Appraiser task exist code. +- **AppraiserTaskLastRun** The last runtime for the Appraiser task. +- **CensusVersion** The version of Census that generated the current data for this device. + + +### Census.Azure + +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **CloudCoreBuildEx** The Azure CloudCore build number. +- **CloudCoreSupportBuildEx** The Azure CloudCore support build number. +- **NodeID** The node identifier on the device that indicates whether the device is part of the Azure fleet. + + +### Census.Battery + +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **InternalBatteryCapablities** Represents information about what the battery is capable of doing. +- **InternalBatteryCapacityCurrent** Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity  to estimate the battery's wear. +- **InternalBatteryCapacityDesign** Represents the theoretical capacity of the battery when new, in mWh. +- **InternalBatteryNumberOfCharges** Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance. +- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. + + +### Census.Enterprise + +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **AADDeviceId** Azure Active Directory device ID. +- **AzureOSIDPresent** Represents the field used to identify an Azure machine. +- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs. +- **CDJType** Represents the type of cloud domain joined for the machine. +- **CommercialId** Represents the GUID for the commercial entity which the device is a member of.  Will be used to reflect insights back to customers. +- **ContainerType** The type of container, such as process or virtual machine hosted. +- **EnrollmentType** Defines the type of MDM enrollment on the device. +- **HashedDomain** The hashed representation of the user domain used for login. +- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false +- **IsDERequirementMet** Represents if the device can do device encryption. +- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption +- **IsEDPEnabled** Represents if Enterprise data protected on the device. +- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. +- **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device. +- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier + + +### Census.Firmware + +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FirmwareManufacturer** Represents the manufacturer of the device's firmware (BIOS). +- **FirmwareReleaseDate** Represents the date the current firmware was released. +- **FirmwareType** Represents the firmware type. The various types can be unknown, BIOS, UEFI. +- **FirmwareVersion** Represents the version of the current firmware. + + +### Census.Flighting + +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceSampleRate** The telemetry sample rate assigned to the device. +- **DriverTargetRing** Indicates if the device is participating in receiving pre-release drivers and firmware contrent. +- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device. +- **FlightIds** A list of the different Windows Insider builds on this device. +- **FlightingBranchName** The name of the Windows Insider branch currently used by the device. +- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program. +- **MSA_Accounts** Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device. +- **SSRK** Retrieves the mobile targeting settings. + + +### Census.Hardware + +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ActiveMicCount** The number of active microphones attached to the device. +- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36. +- **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields. +- **D3DMaxFeatureLevel** Supported Direct3D version. +- **DeviceForm** Indicates the form as per the device classification. +- **DeviceName** The device name that is set by the user. +- **DigitizerSupport** Is a digitizer supported? +- **EnclosureKind** Windows.Devices.Enclosure.EnclosureKind enum values representing each unique enclosure posture kind. +- **Gyroscope** Indicates whether the device has a gyroscope (a mechanical component that measures and maintains orientation). +- **InventoryId** The device ID used for compatibility testing. +- **Magnetometer** Indicates whether the device has a magnetometer (a mechanical component that works like a compass). +- **NFCProximity** Indicates whether the device supports NFC (a set of communication protocols that helps establish communication when applicable devices are brought close together.) +- **OEMDigitalMarkerFileName** The name of the file placed in the \Windows\system32\drivers directory that specifies the OEM and model name of the device. +- **OEMManufacturerName** The device manufacturer name. The OEMName for an inactive device is not reprocessed even if the clean OEM name is changed at a later date. +- **OEMModelBaseBoard** The baseboard model used by the OEM. +- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices. +- **OEMModelName** The device model name. +- **OEMModelNumber** The device model number. +- **OEMModelSKU** The device edition that is defined by the manufacturer. +- **OEMModelSystemFamily** The system family set on the device by an OEM. +- **OEMModelSystemVersion** The system model version set on the device by the OEM. +- **OEMOptionalIdentifier** A Microsoft assigned value that represents a specific OEM subsidiary. +- **OEMSerialNumber** The serial number of the device that is set by the manufacturer. +- **PhoneManufacturer** The friendly name of the phone manufacturer. +- **PowerPlatformRole** The OEM preferred power management profile. It's used to help to identify the basic form factor of the device. +- **SoCName** The firmware manufacturer of the device. +- **StudyID** Used to identify retail and non-retail device. +- **TelemetryLevel** The telemetry level the user has opted into, such as Basic or Enhanced. +- **TelemetryLevelLimitEnhanced** The telemetry level for Windows Analytics-based solutions. +- **TelemetrySettingAuthority** Determines who set the telemetry level, such as GP, MDM, or the user. +- **TPMManufacturerId** The ID of the TPM manufacturer. +- **TPMManufacturerVersion** The version of the TPM manufacturer. +- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0. +- **VoiceSupported** Does the device have a cellular radio capable of making voice calls? + + +### Census.Memory + +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **TotalPhysicalRAM** Represents the physical memory (in MB). +- **TotalVisibleMemory** Represents the memory that is not reserved by the system. + + +### Census.Network + +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage. +- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage. +- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. +- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MobileOperatorBilling** Represents the telephone company that provides services for mobile phone users. +- **MobileOperatorCommercialized** Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US. +- **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. +- **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. +- **NetworkAdapterGUID** The GUID of the primary network adapter. +- **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage. +- **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage. + + +### Census.OS + +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine. +- **AssignedAccessStatus** Kiosk configuration mode. +- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled. +- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy. +- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time +- **GenuineState** Retrieves the ID Value specifying the OS Genuine check. +- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update). +- **InstallLanguage** The first language installed on the user machine. +- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode. +- **IsEduData** Returns Boolean if the education data policy is enabled. +- **IsPortableOperatingSystem** Retrieves whether OS is running Windows-To-Go +- **IsSecureBootEnabled** Retrieves whether Boot chain is signed under UEFI. +- **LanguagePacks** The list of language packages installed on the device. +- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store. +- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine. +- **OSEdition** Retrieves the version of the current OS. +- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc. +- **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC). +- **OSSKU** Retrieves the Friendly Name of OS Edition. +- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines. +- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines. +- **OSUILocale** Retrieves the locale of the UI that is currently used by the OS. +- **ProductActivationResult** Returns Boolean if the OS Activation was successful. +- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues. +- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key. +- **RACw7Id** Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability. +- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy. +- **ServiceMachinePort** Retrieves the port of the KMS host used for anti-piracy. +- **ServiceProductKeyID** Retrieves the License key of the KMS +- **SharedPCMode** Returns Boolean for education devices used as shared cart +- **Signature** Retrieves if it is a signature machine sold by Microsoft store. +- **SLICStatus** Whether a SLIC table exists on the device. +- **SLICVersion** Returns OS type/version from SLIC table. + + +### Census.PrivacySettings + +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **Activity** Current state of the activity history setting. +- **ActivityHistoryCloudSync** Current state of the activity history cloud sync setting. +- **ActivityHistoryCollection** Current state of the activity history collection setting. +- **AdvertisingId** Current state of the advertising ID setting. +- **AppDiagnostics** Current state of the app diagnostics setting. +- **Appointments** Current state of the calendar setting. +- **Bluetooth** Current state of the Bluetooth capability setting. +- **BluetoothSync** Current state of the Bluetooth sync capability setting. +- **BroadFileSystemAccess** Current state of the broad file system access setting. +- **CellularData** Current state of the cellular data capability setting. +- **Chat** Current state of the chat setting. +- **Contacts** Current state of the contacts setting. +- **DocumentsLibrary** Current state of the documents library setting. +- **Email** Current state of the email setting. +- **FindMyDevice** Current state of the "find my device" setting. +- **GazeInput** Current state of the gaze input setting. +- **HumanInterfaceDevice** Current state of the human interface device setting. +- **InkTypeImprovement** Current state of the improve inking and typing setting. +- **Location** Current state of the location setting. +- **LocationHistory** Current state of the location history setting. +- **Microphone** Current state of the microphone setting. +- **PhoneCall** Current state of the phone call setting. +- **PhoneCallHistory** Current state of the call history setting. +- **PicturesLibrary** Current state of the pictures library setting. +- **Radios** Current state of the radios setting. +- **SensorsCustom** Current state of the custom sensor setting. +- **SerialCommunication** Current state of the serial communication setting. +- **Sms** Current state of the text messaging setting. +- **SpeechPersonalization** Current state of the speech services setting. +- **USB** Current state of the USB setting. +- **UserAccountInformation** Current state of the account information setting. +- **UserDataTasks** Current state of the tasks setting. +- **UserNotificationListener** Current state of the notifications setting. +- **VideosLibrary** Current state of the videos library setting. +- **Webcam** Current state of the camera setting. +- **WifiData** Current state of the Wi-Fi data setting. +- **WiFiDirect** Current state of the Wi-Fi direct setting. + + +### Census.Processor + +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **KvaShadow** This is the micro code information of the processor. +- **MMSettingOverride** Microcode setting of the processor. +- **MMSettingOverrideMask** Microcode setting override of the processor. +- **PreviousUpdateRevision** Previous microcode revision +- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. +- **ProcessorClockSpeed** Clock speed of the processor in MHz. +- **ProcessorCores** Number of logical cores in the processor. +- **ProcessorIdentifier** Processor Identifier of a manufacturer. +- **ProcessorManufacturer** Name of the processor manufacturer. +- **ProcessorModel** Name of the processor model. +- **ProcessorPhysicalCores** Number of physical cores in the processor. +- **ProcessorUpdateRevision** The microcode revision. +- **ProcessorUpdateStatus** Enum value that represents the processor microcode load status +- **SocketCount** Count of CPU sockets. +- **SpeculationControl** If the system has enabled protections needed to validate the speculation control vulnerability. + + +### Census.Security + +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AvailableSecurityProperties** This field helps to enumerate and report state on the relevant security properties for Device Guard. +- **CGRunning** Credential Guard isolates and hardens key system and user secrets against compromise, helping to minimize the impact and breadth of a Pass the Hash style attack in the event that malicious code is already running via a local or network based vector. This field tells if Credential Guard is running. +- **DGState** This field summarizes the Device Guard state. +- **HVCIRunning** Hypervisor Code Integrity (HVCI) enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s functionality to force all software running in kernel mode to safely allocate memory. This field tells if HVCI is running. +- **IsSawGuest** Indicates whether the device is running as a Secure Admin Workstation Guest. +- **IsSawHost** Indicates whether the device is running as a Secure Admin Workstation Host. +- **IsWdagFeatureEnabled** Indicates whether Windows Defender Application Guard is enabled. +- **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security. +- **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting. +- **ShadowStack** The bit fields of SYSTEM_SHADOW_STACK_INFORMATION representing the state of the Intel CET (Control Enforcement Technology) hardware security feature. +- **SModeState** The Windows S mode trail state. +- **SystemGuardState** Indicates the SystemGuard state. NotCapable (0), Capable (1), Enabled (2), Error (0xFF). +- **TpmReadyState** Indicates the TPM ready state. NotReady (0), ReadyForStorage (1), ReadyForAttestation (2), Error (0xFF). +- **VBSState** Virtualization-based security (VBS) uses the hypervisor to help protect the kernel and other parts of the operating system. Credential Guard and Hypervisor Code Integrity (HVCI) both depend on VBS to isolate/protect secrets, and kernel-mode code integrity validation. VBS has a tri-state that can be Disabled, Enabled, or Running. +- **WdagPolicyValue** The Windows Defender Application Guard policy. + + +### Census.Speech + +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked. +- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities. +- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user. +- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices. +- **KeyVer** Version information for the census speech event. +- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS). +- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities. +- **RemotelyManaged** Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities. +- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice. +- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device. +- **SpeechServicesValueSource** Indicates the deciding factor for the effective online speech recognition privacy policy settings: remote admin, local admin, or user preference. + + +### Census.Storage + +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **PrimaryDiskTotalCapacity** Retrieves the amount of disk space on the primary disk of the device in MB. +- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any). +- **StorageReservePassedPolicy** Indicates whether the Storage Reserve policy, which ensures that updates have enough disk space and customers are on the latest OS, is enabled on this device. +- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB. + + +### Census.Userdefault + +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CalendarType** The calendar identifiers that are used to specify different calendars. +- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. +- **DefaultBrowserProgId** The ProgramId of the current user's default browser. +- **LocaleName** Name of the current user locale given by LOCALE_SNAME via the GetLocaleInfoEx() function. +- **LongDateFormat** The long date format the user has selected. +- **ShortDateFormat** The short date format the user has selected. + + +### Census.UserDisplay + +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display. +- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display. +- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display. +- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display. +- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display. +- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display. +- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches . +- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches +- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine +- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine. +- **VRAMDedicated** Retrieves the video RAM in MB. +- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card. +- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use. + + +### Census.UserNLS + +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DefaultAppLanguage** The current user Default App Language. +- **DisplayLanguage** The current user preferred Windows Display Language. +- **HomeLocation** The current user location, which is populated using GetUserGeoId() function. +- **KeyboardInputLanguages** The Keyboard input languages installed on the device. +- **SpeechInputLanguages** The Speech Input languages installed on the device. + + +### Census.UserPrivacySettings + +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **Activity** Current state of the activity history setting. +- **ActivityHistoryCloudSync** Current state of the activity history cloud sync setting. +- **ActivityHistoryCollection** Current state of the activity history collection setting. +- **AdvertisingId** Current state of the advertising ID setting. +- **AppDiagnostics** Current state of the app diagnostics setting. +- **Appointments** Current state of the calendar setting. +- **Bluetooth** Current state of the Bluetooth capability setting. +- **BluetoothSync** Current state of the Bluetooth sync capability setting. +- **BroadFileSystemAccess** Current state of the broad file system access setting. +- **CellularData** Current state of the cellular data capability setting. +- **Chat** Current state of the chat setting. +- **Contacts** Current state of the contacts setting. +- **DocumentsLibrary** Current state of the documents library setting. +- **Email** Current state of the email setting. +- **GazeInput** Current state of the gaze input setting. +- **HumanInterfaceDevice** Current state of the human interface device setting. +- **InkTypeImprovement** Current state of the improve inking and typing setting. +- **InkTypePersonalization** Current state of the inking and typing personalization setting. +- **Location** Current state of the location setting. +- **LocationHistory** Current state of the location history setting. +- **Microphone** Current state of the microphone setting. +- **PhoneCall** Current state of the phone call setting. +- **PhoneCallHistory** Current state of the call history setting. +- **PicturesLibrary** Current state of the pictures library setting. +- **Radios** Current state of the radios setting. +- **SensorsCustom** Current state of the custom sensor setting. +- **SerialCommunication** Current state of the serial communication setting. +- **Sms** Current state of the text messaging setting. +- **SpeechPersonalization** Current state of the speech services setting. +- **USB** Current state of the USB setting. +- **UserAccountInformation** Current state of the account information setting. +- **UserDataTasks** Current state of the tasks setting. +- **UserNotificationListener** Current state of the notifications setting. +- **VideosLibrary** Current state of the videos library setting. +- **Webcam** Current state of the camera setting. +- **WifiData** Current state of the Wi-Fi data setting. +- **WiFiDirect** Current state of the Wi-Fi direct setting. + + +### Census.VM + +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CloudService** Indicates which cloud service, if any, that this virtual machine is running within. +- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor. +- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present. +- **IsVDI** Is the device using Virtual Desktop Infrastructure? +- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. +- **IsWVDSessionHost** Indicates if this is a Windows Virtual Device session host. +- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. +- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. +- **VMId** A string that identifies a virtual machine. +- **WVDEnvironment** Represents the WVD service environment to which this session host has been joined. + + +### Census.WU + +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AppraiserGatedStatus** Indicates whether a device has been gated for upgrading. +- **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled). +- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured +- **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting +- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. +- **IsHotPatchEnrolled** Represents the current state of the device in relation to enrollment in the hotpatch program. +- **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? +- **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? +- **OSAssessmentForQualityUpdate** Is the device on the latest quality update? +- **OSAssessmentForSecurityUpdate** Is the device on the latest security update? +- **OSAssessmentQualityOutOfDate** How many days has it been since a the last quality update was released but the device did not install it? +- **OSAssessmentReleaseInfoTime** The freshness of release information used to perform an assessment. +- **OSRollbackCount** The number of times feature updates have rolled back on the device. +- **OSRolledBack** A flag that represents when a feature update has rolled back during setup. +- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device . +- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device. +- **OSWUAutoUpdateOptionsSource** The source of auto update setting that appears in the OSWUAutoUpdateOptions field. For example: Group Policy (GP), Mobile Device Management (MDM), and Default. +- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently. +- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS). +- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates. +- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades. +- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network. +- **WULCUVersion** Version of the LCU Installed on the machine. +- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier. +- **WUPauseState** Retrieves WU setting to determine if updates are paused. +- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). + + +### Census.Xbox + +This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date. + +The following fields are available: + +- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console. +- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console. +- **XboxLiveDeviceId** Retrieves the unique device ID of the console. +- **XboxLiveSandboxId** Retrieves the developer sandbox ID if the device is internal to Microsoft. + + +## Common data extensions + +### Common Data Extensions.app + +Describes the properties of the running application. This extension could be populated by a client app or a web app. + +The following fields are available: + +- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session. +- **env** The environment from which the event was logged. +- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event. +- **id** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application. +- **locale** The locale of the app. +- **name** The name of the app. +- **userId** The userID as known by the application. +- **ver** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app. + + +### Common Data Extensions.container + +Describes the properties of the container for events logged within a container. + +The following fields are available: + +- **epoch** An ID that's incremented for each SDK initialization. +- **localId** The device ID as known by the client. +- **osVer** The operating system version. +- **seq** An ID that's incremented for each event. +- **type** The container type. Examples: Process or VMHost + + +### Common Data Extensions.device + +Describes the device-related fields. + +The following fields are available: + +- **deviceClass** The device classification. For example, Desktop, Server, or Mobile. +- **localId** A locally-defined unique ID for the device. This is not the human-readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId +- **make** Device manufacturer. +- **model** Device model. + + +### Common Data Extensions.Envelope + +Represents an envelope that contains all of the common data extensions. + +The following fields are available: + +- **data** Represents the optional unique diagnostic data for a particular event schema. +- **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp). +- **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). +- **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). +- **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv). +- **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). +- **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). +- **ext_user** Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser). +- **ext_utc** Describes the fields that might be populated by a logging library on Windows. See [Common Data Extensions.utc](#common-data-extensionsutc). +- **ext_xbl** Describes the fields related to XBOX Live. See [Common Data Extensions.xbl](#common-data-extensionsxbl). +- **iKey** Represents an ID for applications or other logical groupings of events. +- **name** Represents the uniquely qualified name for the event. +- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. +- **ver** Represents the major and minor version of the extension. + + +### Common Data Extensions.mscv + +Describes the correlation vector-related fields. + +The following fields are available: + +- **cV** Represents the Correlation Vector: A single field for tracking partial order of related events across component boundaries. + + +### Common Data Extensions.os + +Describes some properties of the operating system. + +The following fields are available: + +- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot. +- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema. +- **locale** Represents the locale of the operating system. +- **name** Represents the operating system name. +- **ver** Represents the major and minor version of the extension. + + +### Common Data Extensions.sdk + +Used by platform specific libraries to record fields that are required for a specific SDK. + +The following fields are available: + +- **epoch** An ID that is incremented for each SDK initialization. +- **installId** An ID that's created during the initialization of the SDK for the first time. +- **libVer** The SDK version. +- **seq** An ID that is incremented for each event. +- **ver** The version of the logging SDK. + + +### Common Data Extensions.user + +Describes the fields related to a user. + +The following fields are available: + +- **authId** This is an ID of the user associated with this event that is deduced from a token such as a Microsoft Account ticket or an XBOX token. +- **locale** The language and region. +- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID. + + +### Common Data Extensions.utc + +Describes the properties that could be populated by a logging library on Windows. + +The following fields are available: + +- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW. +- **bSeq** Upload buffer sequence number in the format: buffer identifier:sequence number +- **cat** Represents a bitmask of the ETW Keywords associated with the event. +- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer. +- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server. +- **eventFlags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency. +- **flags** Represents the bitmap that captures various Windows specific flags. +- **loggingBinary** The binary (executable, library, driver, etc.) that fired the event. +- **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence +- **op** Represents the ETW Op Code. +- **pgName** The short form of the provider group name associated with the event. +- **popSample** Represents the effective sample rate for this event at the time it was generated by a client. +- **providerGuid** The ETW provider ID associated with the provider name. +- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW. +- **seq** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server. +- **sqmId** The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier. +- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. +- **wcmp** The Windows Shell Composer ID. +- **wPId** The Windows Core OS product ID. +- **wsId** The Windows Core OS session ID. + + +### Common Data Extensions.xbl + +Describes the fields that are related to XBOX Live. + +The following fields are available: + +- **claims** Any additional claims whose short claim name hasn't been added to this structure. +- **did** XBOX device ID +- **dty** XBOX device type +- **dvr** The version of the operating system on the device. +- **eid** A unique ID that represents the developer entity. +- **exp** Expiration time +- **ip** The IP address of the client device. +- **nbf** Not before time +- **pid** A comma separated list of PUIDs listed as base10 numbers. +- **sbx** XBOX sandbox identifier +- **sid** The service instance ID. +- **sty** The service type. +- **tid** The XBOX Live title ID. +- **tvr** The XBOX Live title version. +- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. +- **xid** A list of base10-encoded XBOX User IDs. + +## Common data fields + +### Ms.Device.DeviceInventoryChange + +Describes the installation state for all hardware and software components available on a particular device. + +The following fields are available: + +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. + +## Component-based servicing events + +### CbsServicingProvider.CbsCapabilityEnumeration + +This event reports on the results of scanning for optional Windows content on Windows Update to keep Windows up to date. + +The following fields are available: + +- **architecture** Indicates the scan was limited to the specified architecture. +- **capabilityCount** The number of optional content packages found during the scan. +- **clientId** The name of the application requesting the optional content. +- **duration** The amount of time it took to complete the scan. +- **hrStatus** The HReturn code of the scan. +- **language** Indicates the scan was limited to the specified language. +- **majorVersion** Indicates the scan was limited to the specified major version. +- **minorVersion** Indicates the scan was limited to the specified minor version. +- **namespace** Indicates the scan was limited to packages in the specified namespace. +- **sourceFilter** A bitmask indicating the scan checked for locally available optional content. +- **stackBuild** The build number of the servicing stack. +- **stackMajorVersion** The major version number of the servicing stack. +- **stackMinorVersion** The minor version number of the servicing stack. +- **stackRevision** The revision number of the servicing stack. + + +### CbsServicingProvider.CbsCapabilitySessionFinalize + +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **capabilities** The names of the optional content packages that were installed. +- **clientId** The name of the application requesting the optional content. +- **currentID** The ID of the current install session. +- **downloadSource** The source of the download. +- **highestState** The highest final install state of the optional content. +- **hrLCUReservicingStatus** Indicates whether the optional content was updated to the latest available version. +- **hrStatus** The HReturn code of the install operation. +- **rebootCount** The number of reboots required to complete the install. +- **retryID** The session ID that will be used to retry a failed operation. +- **retryStatus** Indicates whether the install will be retried in the event of failure. +- **stackBuild** The build number of the servicing stack. +- **stackMajorVersion** The major version number of the servicing stack. +- **stackMinorVersion** The minor version number of the servicing stack. +- **stackRevision** The revision number of the servicing stack. + + +### CbsServicingProvider.CbsCapabilitySessionPended + +This event provides information about the results of installing optional Windows content that requires a reboot to keep Windows up to date. + +The following fields are available: + +- **clientId** The name of the application requesting the optional content. +- **pendingDecision** Indicates the cause of reboot, if applicable. + + +### CbsServicingProvider.CbsLateAcquisition + +This event sends data to indicate if some Operating System packages could not be updated as part of an upgrade, to help keep Windows up to date. + +The following fields are available: + +- **Features** The list of feature packages that could not be updated. +- **RetryID** The ID identifying the retry attempt to update the listed packages. + + +### CbsServicingProvider.CbsPackageRemoval + +This event provides information about the results of uninstalling a Windows Cumulative Security Update to help keep Windows up to date. + +The following fields are available: + +- **buildVersion** The build number of the security update being uninstalled. +- **clientId** The name of the application requesting the uninstall. +- **currentStateEnd** The final state of the update after the operation. +- **failureDetails** Information about the cause of a failure, if applicable. +- **failureSourceEnd** The stage during the uninstall where the failure occurred. +- **hrStatusEnd** The overall exit code of the operation. +- **initiatedOffline** Indicates if the uninstall was initiated for a mounted Windows image. +- **majorVersion** The major version number of the security update being uninstalled. +- **minorVersion** The minor version number of the security update being uninstalled. +- **originalState** The starting state of the update before the operation. +- **pendingDecision** Indicates the cause of reboot, if applicable. +- **primitiveExecutionContext** The state during system startup when the uninstall was completed. +- **revisionVersion** The revision number of the security update being uninstalled. +- **transactionCanceled** Indicates whether the uninstall was cancelled. + + +### CbsServicingProvider.CbsQualityUpdateInstall + +This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date. + +The following fields are available: + +- **buildVersion** The build version number of the update package. +- **clientId** The name of the application requesting the optional content. +- **corruptionHistoryFlags** A bitmask of the types of component store corruption that have caused update failures on the device. +- **corruptionType** An enumeration listing the type of data corruption responsible for the current update failure. +- **currentStateEnd** The final state of the package after the operation has completed. +- **doqTimeSeconds** The time in seconds spent updating drivers. +- **executeTimeSeconds** The number of seconds required to execute the install. +- **failureDetails** The driver or installer that caused the update to fail. +- **failureSourceEnd** An enumeration indicating at what phase of the update a failure occurred. +- **hrStatusEnd** The return code of the install operation. +- **initiatedOffline** A true or false value indicating whether the package was installed into an offline Windows Imaging Format (WIM) file. +- **majorVersion** The major version number of the update package. +- **minorVersion** The minor version number of the update package. +- **originalState** The starting state of the package. +- **overallTimeSeconds** The time (in seconds) to perform the overall servicing operation. +- **planTimeSeconds** The time in seconds required to plan the update operations. +- **poqTimeSeconds** The time in seconds processing file and registry operations. +- **postRebootTimeSeconds** The time (in seconds) to do startup processing for the update. +- **preRebootTimeSeconds** The time (in seconds) between execution of the installation and the reboot. +- **primitiveExecutionContext** An enumeration indicating at what phase of shutdown or startup the update was installed. +- **rebootCount** The number of reboots required to install the update. +- **rebootTimeSeconds** The time (in seconds) before startup processing begins for the update. +- **resolveTimeSeconds** The time in seconds required to resolve the packages that are part of the update. +- **revisionVersion** The revision version number of the update package. +- **rptTimeSeconds** The time in seconds spent executing installer plugins. +- **shutdownTimeSeconds** The time (in seconds) required to do shutdown processing for the update. +- **stackRevision** The revision number of the servicing stack. +- **stageTimeSeconds** The time (in seconds) required to stage all files that are part of the update. + + +### CbsServicingProvider.CbsSelectableUpdateChangeV2 + +This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date. + +The following fields are available: + +- **applicableUpdateState** Indicates the highest applicable state of the optional content. +- **buildVersion** The build version of the package being installed. +- **clientId** The name of the application requesting the optional content change. +- **downloadSource** Indicates if optional content was obtained from Windows Update or a locally accessible file. +- **downloadtimeInSeconds** Indicates if optional content was obtained from Windows Update or a locally accessible file. +- **executionID** A unique ID used to identify events associated with a single servicing operation and not reused for future operations. +- **executionSequence** A counter that tracks the number of servicing operations attempted on the device. +- **firstMergedExecutionSequence** The value of a pervious executionSequence counter that is being merged with the current operation, if applicable. +- **firstMergedID** A unique ID of a pervious servicing operation that is being merged with this operation, if applicable. +- **hrDownloadResult** The return code of the download operation. +- **hrStatusUpdate** The return code of the servicing operation. +- **identityHash** A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled. +- **initiatedOffline** Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows. +- **majorVersion** The major version of the package being installed. +- **minorVersion** The minor version of the package being installed. +- **packageArchitecture** The architecture of the package being installed. +- **packageLanguage** The language of the package being installed. +- **packageName** The name of the package being installed. +- **rebootRequired** Indicates whether a reboot is required to complete the operation. +- **revisionVersion** The revision number of the package being installed. +- **stackBuild** The build number of the servicing stack binary performing the installation. +- **stackMajorVersion** The major version number of the servicing stack binary performing the installation. +- **stackMinorVersion** The minor version number of the servicing stack binary performing the installation. +- **stackRevision** The revision number of the servicing stack binary performing the installation. +- **updateName** The name of the optional Windows Operation System feature being enabled or disabled. +- **updateStartState** A value indicating the state of the optional content before the operation started. +- **updateTargetState** A value indicating the desired state of the optional content. + + +### CbsServicingProvider.CbsUpdateDeferred + +This event reports the results of deferring Windows Content to keep Windows up to date. + + + +### Microsoft.Windows.CbsLite.CbsLiteResetBegin + +This event is fired from Update OS when re-install of the OS begins. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **cbsLiteSessionID** An ID to associate other Cbs events related to this reset session. +- **resetFlags** A flag containing the detail of which reset scenarios was executed. +- **wipeDuration** The time taken to purge the system volume and format data volume. + + +## Diagnostic data events + +### TelClientSynthetic.AbnormalShutdown_0 + +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **AbnormalShutdownBootId** BootId of the abnormal shutdown being reported by this event. +- **AbsCausedbyAutoChk** This flag is set when AutoCheck forces a device restart to indicate that the shutdown was not an abnormal shutdown. +- **AcDcStateAtLastShutdown** Identifies if the device was on battery or plugged in. +- **BatteryLevelAtLastShutdown** The last recorded battery level. +- **BatteryPercentageAtLastShutdown** The battery percentage at the last shutdown. +- **CrashDumpEnabled** Are crash dumps enabled? +- **CumulativeCrashCount** Cumulative count of operating system crashes since the BootId reset. +- **CurrentBootId** BootId at the time the abnormal shutdown event was being reported. +- **Firmwaredata->ResetReasonEmbeddedController** The reset reason that was supplied by the firmware. +- **Firmwaredata->ResetReasonEmbeddedControllerAdditional** Additional data related to reset reason provided by the firmware. +- **Firmwaredata->ResetReasonPch** The reset reason that was supplied by the hardware. +- **Firmwaredata->ResetReasonPchAdditional** Additional data related to the reset reason supplied by the hardware. +- **Firmwaredata->ResetReasonSupplied** Indicates whether the firmware supplied any reset reason or not. +- **FirmwareType** ID of the FirmwareType as enumerated in DimFirmwareType. +- **HardwareWatchdogTimerGeneratedLastReset** Indicates whether the hardware watchdog timer caused the last reset. +- **HardwareWatchdogTimerPresent** Indicates whether hardware watchdog timer was present or not. +- **InvalidBootStat** This is a sanity check flag that ensures the validity of the bootstat file. +- **LastBugCheckBootId** bootId of the last captured crash. +- **LastBugCheckCode** Code that indicates the type of error. +- **LastBugCheckContextFlags** Additional crash dump settings. +- **LastBugCheckOriginalDumpType** The type of crash dump the system intended to save. +- **LastBugCheckOtherSettings** Other crash dump settings. +- **LastBugCheckParameter1** The first parameter with additional info on the type of the error. +- **LastBugCheckProgress** Progress towards writing out the last crash dump. +- **LastBugCheckVersion** The version of the information struct written during the crash. +- **LastSuccessfullyShutdownBootId** BootId of the last fully successful shutdown. +- **LongPowerButtonPressDetected** Identifies if the user was pressing and holding power button. +- **OOBEInProgress** Identifies if OOBE is running. +- **OSSetupInProgress** Identifies if the operating system setup is running. +- **PowerButtonCumulativePressCount** How many times has the power button been pressed? +- **PowerButtonCumulativeReleaseCount** How many times has the power button been released? +- **PowerButtonErrorCount** Indicates the number of times there was an error attempting to record power button metrics. +- **PowerButtonLastPressBootId** BootId of the last time the power button was pressed. +- **PowerButtonLastPressTime** Date and time of the last time the power button was pressed. +- **PowerButtonLastReleaseBootId** BootId of the last time the power button was released. +- **PowerButtonLastReleaseTime** Date and time of the last time the power button was released. +- **PowerButtonPressCurrentCsPhase** Represents the phase of Connected Standby exit when the power button was pressed. +- **PowerButtonPressIsShutdownInProgress** Indicates whether a system shutdown was in progress at the last time the power button was pressed. +- **PowerButtonPressLastPowerWatchdogStage** Progress while the monitor is being turned on. +- **PowerButtonPressPowerWatchdogArmed** Indicates whether or not the watchdog for the monitor was active at the time of the last power button press. +- **ShutdownDeviceType** Identifies who triggered a shutdown. Is it because of battery, thermal zones, or through a Kernel API. +- **SleepCheckpoint** Provides the last checkpoint when there is a failure during a sleep transition. +- **SleepCheckpointSource** Indicates whether the source is the EFI variable or bootstat file. +- **SleepCheckpointStatus** Indicates whether the checkpoint information is valid. +- **StaleBootStatData** Identifies if the data from bootstat is stale. +- **TransitionInfoBootId** BootId of the captured transition info. +- **TransitionInfoCSCount** l number of times the system transitioned from Connected Standby mode. +- **TransitionInfoCSEntryReason** Indicates the reason the device last entered Connected Standby mode. +- **TransitionInfoCSExitReason** Indicates the reason the device last exited Connected Standby mode. +- **TransitionInfoCSInProgress** At the time the last marker was saved, the system was in or entering Connected Standby mode. +- **TransitionInfoLastReferenceTimeChecksum** The checksum of TransitionInfoLastReferenceTimestamp, +- **TransitionInfoLastReferenceTimestamp** The date and time that the marker was last saved. +- **TransitionInfoLidState** Describes the state of the laptop lid. +- **TransitionInfoPowerButtonTimestamp** The date and time of the last time the power button was pressed. +- **TransitionInfoSleepInProgress** At the time the last marker was saved, the system was in or entering sleep mode. +- **TransitionInfoSleepTranstionsToOn** Total number of times the device transitioned from sleep mode. +- **TransitionInfoSystemRunning** At the time the last marker was saved, the device was running. +- **TransitionInfoSystemShutdownInProgress** Indicates whether a device shutdown was in progress when the power button was pressed. +- **TransitionInfoUserShutdownInProgress** Indicates whether a user shutdown was in progress when the power button was pressed. +- **TransitionLatestCheckpointId** Represents a unique identifier for a checkpoint during the device state transition. +- **TransitionLatestCheckpointSeqNumber** Represents the chronological sequence number of the checkpoint. +- **TransitionLatestCheckpointType** Represents the type of the checkpoint, which can be the start of a phase, end of a phase, or just informational. +- **VirtualMachineId** If the operating system is on a virtual Machine, it gives the virtual Machine ID (GUID) that can be used to correlate events on the host. + + +### TelClientSynthetic.AuthorizationInfo_RuntimeTransition + +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CanAddMsaToMsTelemetry** True if we can add MSA PUID and CID to telemetry, false otherwise. +- **CanCollectAnyTelemetry** True if we are allowed to collect partner telemetry, false otherwise. +- **CanCollectCoreTelemetry** True if we can collect CORE/Basic telemetry, false otherwise. +- **CanCollectHeartbeats** True if we can collect heartbeat telemetry, false otherwise. +- **CanCollectOsTelemetry** True if we can collect diagnostic data telemetry, false otherwise. +- **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. +- **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. +- **CanReportScenarios** True if we can report scenario completions, false otherwise. +- **PreviousPermissions** Bitmask of previous telemetry state. +- **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. + + +### TelClientSynthetic.AuthorizationInfo_Startup + +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CanAddMsaToMsTelemetry** True if we can add MSA PUID and CID to telemetry, false otherwise. +- **CanCollectAnyTelemetry** True if we are allowed to collect partner telemetry, false otherwise. +- **CanCollectCoreTelemetry** True if we can collect CORE/Basic telemetry, false otherwise. +- **CanCollectHeartbeats** True if we can collect heartbeat telemetry, false otherwise. +- **CanCollectOsTelemetry** True if we can collect diagnostic data telemetry, false otherwise. +- **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. +- **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. +- **CanReportScenarios** True if we can report scenario completions, false otherwise. +- **PreviousPermissions** Bitmask of previous telemetry state. +- **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. + + +### TelClientSynthetic.ConnectivityHeartBeat_0 + +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. + +The following fields are available: + +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **LastConnectivityLossTime** Retrieves the last time the device lost free network. +- **NetworkState** The network state of the device. +- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. +- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. + + +### TelClientSynthetic.HeartBeat_5 + +This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device. + +The following fields are available: + +- **AgentConnectionErrorsCount** Number of non-timeout errors associated with the host/agent channel. +- **CensusExitCode** The last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **CompressedBytesUploaded** Number of compressed bytes uploaded. +- **ConsumerDroppedCount** Number of events dropped at consumer layer of telemetry client. +- **CriticalDataDbDroppedCount** Number of critical data sampled events dropped at the database layer. +- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling. +- **CriticalOverflowEntersCounter** Number of times critical overflow mode was entered in event DB. +- **DbCriticalDroppedCount** Total number of dropped critical events in event DB. +- **DbDroppedCount** Number of events dropped due to DB fullness. +- **DbDroppedFailureCount** Number of events dropped due to DB failures. +- **DbDroppedFullCount** Number of events dropped due to DB fullness. +- **DecodingDroppedCount** Number of events dropped due to decoding failures. +- **EnteringCriticalOverflowDroppedCounter** Number of events dropped due to critical overflow mode being initiated. +- **EtwDroppedBufferCount** Number of buffers dropped in the UTC ETW session. +- **EtwDroppedCount** Number of events dropped at ETW layer of telemetry client. +- **EventsPersistedCount** Number of events that reached the PersistEvent stage. +- **EventStoreLifetimeResetCounter** Number of times event DB was reset for the lifetime of UTC. +- **EventStoreResetCounter** Number of times event DB was reset. +- **EventStoreResetSizeSum** Total size of event DB across all resets reports in this instance. +- **EventsUploaded** Number of events uploaded. +- **Flags** Flags indicating device state such as network state, battery state, and opt-in state. +- **FullTriggerBufferDroppedCount** Number of events dropped due to trigger buffer being full. +- **HeartBeatSequenceNumber** The sequence number of this heartbeat. +- **InvalidHttpCodeCount** Number of invalid HTTP codes received from contacting Vortex. +- **LastAgentConnectionError** Last non-timeout error encountered in the host/agent channel. +- **LastEventSizeOffender** Event name of last event which exceeded max event size. +- **LastInvalidHttpCode** Last invalid HTTP code received from Vortex. +- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe. +- **MaxInUseScenarioCounter** Soft maximum number of scenarios loaded by UTC. +- **PreviousHeartBeatTime** Time of last heartbeat event (allows chaining of events). +- **PrivacyBlockedCount** The number of events blocked due to privacy settings or tags. +- **RepeatedUploadFailureDropped** Number of events lost due to repeated upload failures for a single buffer. +- **SettingsHttpAttempts** Number of attempts to contact OneSettings service. +- **SettingsHttpFailures** The number of failures from contacting the OneSettings service. +- **ThrottledDroppedCount** Number of events dropped due to throttling of noisy providers. +- **TopUploaderErrors** List of top errors received from the upload endpoint. +- **UploaderDroppedCount** Number of events dropped at the uploader layer of telemetry client. +- **UploaderErrorCount** Number of errors received from the upload endpoint. +- **VortexFailuresTimeout** The number of timeout failures received from Vortex. +- **VortexHttpAttempts** Number of attempts to contact Vortex. +- **VortexHttpFailures4xx** Number of 400-499 error codes received from Vortex. +- **VortexHttpFailures5xx** Number of 500-599 error codes received from Vortex. +- **VortexHttpResponseFailures** Number of Vortex responses that are not 2XX or 400. +- **VortexHttpResponsesWithDroppedEvents** Number of Vortex responses containing at least 1 dropped event. + + +## DISM events + +### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU + +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **dismInstalledLCUPackageName** The name of the latest installed package. + + +### Microsoft.Windows.StartRepairCore.DISMPendingInstall + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **dismPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.DISMUninstallLCU + +The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd + +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **failedUninstallCount** The number of driver updates that failed to uninstall. +- **failedUninstallFlightIds** The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRepairAction** The scenario name for a repair. +- **successfulUninstallCount** The number of successfully uninstalled driver updates. +- **successfulUninstallFlightIds** The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionStart + +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRepairAction** The scenario name for a repair. + + +### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd + +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **flightIds** The Flight IDs (identifier of the beta release) of found driver updates. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRootCauseDiag** The scenario name for a diagnosis event. + + +### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart + +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRootCauseDiag** The scenario name for a diagnosis event. + + +## Driver installation events + +### Microsoft.Windows.DriverInstall.DeviceInstall + +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ClassGuid** The unique ID for the device class. +- **ClassLowerFilters** The list of lower filter class drivers. +- **ClassUpperFilters** The list of upper filter class drivers. +- **CoInstallers** The list of coinstallers. +- **ConfigFlags** The device configuration flags. +- **DeviceConfigured** Indicates whether this device was configured through the kernel configuration. +- **DeviceInstalled** Indicates whether the legacy install code path was used. +- **DeviceInstanceId** The unique identifier of the device in the system. +- **DeviceStack** The device stack of the driver being installed. +- **DriverDate** The date of the driver. +- **DriverDescription** A description of the driver function. +- **DriverInfName** Name of the INF file (the setup information file) for the driver. +- **DriverInfSectionName** Name of the DDInstall section within the driver INF file. +- **DriverPackageId** The ID of the driver package that is staged to the driver store. +- **DriverProvider** The driver manufacturer or provider. +- **DriverUpdated** Indicates whether the driver is replacing an old driver. +- **DriverVersion** The version of the driver file. +- **EndTime** The time the installation completed. +- **Error** Provides the WIN32 error code for the installation. +- **ExtensionDrivers** List of extension drivers that complement this installation. +- **FinishInstallAction** Indicates whether the co-installer invoked the finish-install action. +- **FinishInstallUI** Indicates whether the installation process shows the user interface. +- **FirmwareDate** The firmware date that will be stored in the EFI System Resource Table (ESRT). +- **FirmwareRevision** The firmware revision that will be stored in the EFI System Resource Table (ESRT). +- **FirmwareVersion** The firmware version that will be stored in the EFI System Resource Table (ESRT). +- **FirstHardwareId** The ID in the hardware ID list that provides the most specific device description. +- **FlightIds** A list of the different Windows Insider builds on the device. +- **GenericDriver** Indicates whether the driver is a generic driver. +- **Inbox** Indicates whether the driver package is included with Windows. +- **InstallDate** The date the driver was installed. +- **LastCompatibleId** The ID in the hardware ID list that provides the least specific device description. +- **LastInstallFunction** The last install function invoked in a co-installer if the install timeout was reached while a co-installer was executing. +- **LegacyInstallReasonError** The error code for the legacy installation. +- **LowerFilters** The list of lower filter drivers. +- **MatchingDeviceId** The hardware ID or compatible ID that Windows used to install the device instance. +- **NeedReboot** Indicates whether the driver requires a reboot. +- **OriginalDriverInfName** The original name of the INF file before it was renamed. +- **ParentDeviceInstanceId** The device instance ID of the parent of the device. +- **PendedUntilReboot** Indicates whether the installation is pending until the device is rebooted. +- **Problem** Error code returned by the device after installation. +- **ProblemStatus** The status of the device after the driver installation. +- **RebootRequiredReason** DWORD (Double Word—32-bit unsigned integer) containing the reason why the device required a reboot during install. +- **SecondaryDevice** Indicates whether the device is a secondary device. +- **ServiceName** The service name of the driver. +- **SessionGuid** GUID (Globally Unique IDentifier) for the update session. +- **SetupMode** Indicates whether the driver installation took place before the Out Of Box Experience (OOBE) was completed. +- **StartTime** The time when the installation started. +- **SubmissionId** The driver submission identifier assigned by the Windows Hardware Development Center. +- **UpperFilters** The list of upper filter drivers. + + +### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd + +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **DeviceInstanceId** The unique identifier of the device in the system. +- **DriverUpdated** Indicates whether the driver was updated. +- **Error** The Win32 error code of the installation. +- **FlightId** The ID of the Windows Insider build the device received. +- **InstallDate** The date the driver was installed. +- **InstallFlags** The driver installation flags. +- **OptionalData** Metadata specific to WU (Windows Update) associated with the driver (flight IDs, recovery IDs, etc.) +- **RebootRequired** Indicates whether a reboot is required after the installation. +- **RollbackPossible** Indicates whether this driver can be rolled back. +- **WuTargetedHardwareId** Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update. +- **WuUntargetedHardwareId** Indicates that the driver was installed because Windows Update performed a generic driver update for all devices of that hardware class. + + +### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart + +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **DeviceInstanceId** The unique identifier of the device in the system. +- **FirstInstallDate** The first time a driver was installed on this device. +- **LastDriverDate** Date of the driver that is being replaced. +- **LastDriverInbox** Indicates whether the previous driver was included with Windows. +- **LastDriverInfName** Name of the INF file (the setup information file) of the driver being replaced. +- **LastDriverVersion** The version of the driver that is being replaced. +- **LastFirmwareDate** The date of the last firmware reported from the EFI System Resource Table (ESRT). +- **LastFirmwareRevision** The last firmware revision number reported from EFI System Resource Table (ESRT). +- **LastFirmwareVersion** The last firmware version reported from the EFI System Resource Table (ESRT). +- **LastInstallDate** The date a driver was last installed on this device. +- **LastMatchingDeviceId** The hardware ID or compatible ID that Windows last used to install the device instance. +- **LastProblem** The previous problem code that was set on the device. +- **LastProblemStatus** The previous problem code that was set on the device. +- **LastSubmissionId** The driver submission identifier of the driver that is being replaced. + + +## DXDiag events + +### Microsoft.Windows.DxDiag.DxDiagExeStopEvent + +This event collects information when the DirectX diagnostics provider stops. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **hResult** Numeric value indicating the result of the operation. + + +### Microsoft.Windows.DxDiag.DxDiagProviderErrorStatistics + +This event provides statistics of major error(s) occurred during data collection, when data has not been properly collected in some queries. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **AudioFailed** Number of failed queries. +- **AudioHr** Error code for the last failed query. +- **AudioTotal** Total number of queries for audio devices. +- **GpuFailed** Number of failed queries. +- **GpuHr** Error code for the last failed query. +- **GpuTotal** Total number of queries for GPUs. +- **IsDesktop** Desktop vs WCOS SKU. +- **VideoCaptureFailed** Number of failed queries. +- **VideoCaptureHr** Error code for the last failed query. +- **VideoCaptureTotal** Total number of queries for video capture devices. + + +### Microsoft.Windows.DxDiag.DxDiagProviderMinorErrors + +This event collects information when recoverable errors were encountered. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **DisplayInfo** A mask with errors occurred during collection GPU information. +- **SystemInfo** A mask with errors occurred during system information collection. + + +### Microsoft.Windows.DxDiag.DxDiagProviderStart + +This event collects information when the DirectX diagnostics provider starts. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **IsISV** Boolean value indicating that the provider is being used by a non-Microsoft application. + + +## DxgKernelTelemetry events + +### DxgKrnlTelemetry.GPUAdapterInventoryV2 + +This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date. + +The following fields are available: + +- **AdapterTypeValue** The numeric value indicating the type of Graphics adapter. +- **aiSeqId** The event sequence ID. +- **bootId** The system boot ID. +- **BrightnessVersionViaDDI** The version of the Display Brightness Interface. +- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload. +- **DDIInterfaceVersion** The device driver interface version. +- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes). +- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes). +- **Display1UMDFilePath** The file path to the location of the Display User Mode Driver in the Driver Store. +- **DisplayAdapterLuid** The display adapter LUID. +- **DriverDate** The date of the display driver. +- **DriverRank** The rank of the display driver. +- **DriverVersion** The display driver version. +- **DriverWorkarounds** Numeric value indicating the driver workarounds that are enabled for this device. +- **DX10UMDFilePath** The file path to the location of the DirectX 10 Display User Mode Driver in the Driver Store. +- **DX11UMDFilePath** The file path to the location of the DirectX 11 Display User Mode Driver in the Driver Store. +- **DX12UMDFilePath** The file path to the location of the DirectX 12 Display User Mode Driver in the Driver Store. +- **DX9UMDFilePath** The file path to the location of the DirectX 9 Display User Mode Driver in the Driver Store. +- **GPUDeviceID** The GPU device ID. +- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload. +- **GPURevisionID** The GPU revision ID. +- **GPUVendorID** The GPU vendor ID. +- **IddPairedRenderAdapterLuid** Identifier for the render adapter paired with this display adapter. +- **InterfaceFuncPointersProvided1** Number of device driver interface function pointers provided. +- **InterfaceFuncPointersProvided2** Number of device driver interface function pointers provided. +- **InterfaceId** The GPU interface ID. +- **IsDisplayDevice** Does the GPU have displaying capabilities? +- **IsHwSchEnabled** Boolean value indicating whether hardware scheduling is enabled. +- **IsHwSchSupported** Indicates whether the adapter supports hardware scheduling. +- **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device? +- **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device? +- **IsLDA** Is the GPU comprised of Linked Display Adapters? +- **IsMiracastSupported** Does the GPU support Miracast? +- **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor? +- **IsMPOSupported** Does the GPU support Multi-Plane Overlays? +- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution? +- **IsPostAdapter** Is this GPU the POST GPU in the device? +- **IsRemovable** TRUE if the adapter supports being disabled or removed. +- **IsRenderDevice** Does the GPU have rendering capabilities? +- **IsSoftwareDevice** Is this a software implementation of the GPU? +- **KMDFilePath** The file path to the location of the Display Kernel Mode Driver in the Driver Store. +- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES? +- **NumNonVidPnTargets** Number of display targets. +- **NumVidPnSources** The number of supported display output sources. +- **NumVidPnTargets** The number of supported display output targets. +- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes). +- **SubSystemID** The subsystem ID. +- **SubVendorID** The GPU sub vendor ID. +- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY? +- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling) +- **version** The event version. +- **WDDMVersion** The Windows Display Driver Model version. + + +## Fault Reporting events + +### Microsoft.Windows.FaultReporting.AppCrashEvent + +This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes\" by a user DO NOT emit this event. + +The following fields are available: + +- **AppName** The name of the app that has crashed. +- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the telemetry backend. +- **AppTimeStamp** The date/time stamp of the app. +- **AppVersion** The version of the app that has crashed. +- **ExceptionCode** The exception code returned by the process that has crashed. +- **ExceptionOffset** The address where the exception had occurred. +- **Flags** Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting. +- **FriendlyAppName** The description of the app that has crashed, if different from the AppName. Otherwise, the process name. +- **IsFatal** True/False to indicate whether the crash resulted in process termination. +- **ModName** Exception module name (e.g. bar.dll). +- **ModTimeStamp** The date/time stamp of the module. +- **ModVersion** The version of the module that has crashed. +- **PackageFullName** Store application identity. +- **PackageRelativeAppId** Store application identity. +- **ProcessArchitecture** Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64. +- **ProcessCreateTime** The time of creation of the process that has crashed. +- **ProcessId** The ID of the process that has crashed. +- **ReportId** A GUID used to identify the report. This can used to track the report across Watson. +- **TargetAppId** The kernel reported AppId of the application being reported. +- **TargetAppVer** The specific version of the application being reported +- **TargetAsId** The sequence number for the hanging process. + + +## Feature update events + +### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed + +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **failureReason** Provides data about the uninstall initialization operation failure. +- **hr** Provides the Win32 error code for the operation failure. + + +### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered + +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +## Feedback events + +### Microsoft.Windows.Fundamentals.UserInitiatedFeedback.SimilarFeedbackSelection + +This event measures the usage for Similar Feedback section in Feedback Hub. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **ActivityDuration** Time it tool to make a selection. +- **HasDuplicateData** Indicates if duplicate data is available. +- **HasWorkItem** Indicates if a work item is associated. +- **IsCollection** Indicates if selection is collection. +- **IsNewFeedback** Indicates if selection is new feedback. +- **LetTeamTriage** Indicates if selection is for triage. +- **MakeBug** Indicates if selection is to create a bug. +- **MakeDuplicate** Indicates if selection is to create a duplicate bug. +- **ResultsFounds** Total results shown. +- **SearchExperiment** Experiment ID used. +- **SelectedPosition** Position of the selection. +- **SelectedScore** Search score of selection. +- **ServiceCallDuration** Time for service results. +- **Source** Method used to get results. + + +## Hang Reporting events + +### Microsoft.Windows.HangReporting.AppHangEvent + +This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on PC devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events. + +The following fields are available: + +- **AppName** The name of the app that has hung. +- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the telemetry backend. +- **AppVersion** The version of the app that has hung. +- **IsFatal** True/False based on whether the hung application caused the creation of a Fatal Hang Report. +- **PackageFullName** Store application identity. +- **PackageRelativeAppId** Store application identity. +- **ProcessArchitecture** Architecture of the hung process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64. +- **ProcessCreateTime** The time of creation of the process that has hung. +- **ProcessId** The ID of the process that has hung. +- **ReportId** A GUID used to identify the report. This can used to track the report across Watson. +- **TargetAppId** The kernel reported AppId of the application being reported. +- **TargetAppVer** The specific version of the application being reported. +- **TargetAsId** The sequence number for the hanging process. +- **TypeCode** Bitmap describing the hang type. +- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application. +- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting. +- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting. +- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package. + + +## Holographic events + +### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded + +This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **ClassGuid** Windows Mixed Reality device class GUID. +- **DeviceInterfaceId** Windows Mixed Reality device interface ID. +- **DriverVersion** Windows Mixed Reality device driver version. +- **FirmwareVersion** Windows Mixed Reality firmware version. +- **Manufacturer** Windows Mixed Reality device manufacturer. +- **ModelName** Windows Mixed Reality device model name. +- **SerialNumber** Windows Mixed Reality device serial number. + + +### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceRemoved + +This event indicates Windows Mixed Reality device state. The data collected with this event is used to keep Windows and Windows Mixed Reality performing properly. + +The following fields are available: + +- **DeviceInterfaceId** Device Interface ID. + + +### Microsoft.Windows.Holographic.Coordinator.HoloShellStateUpdated + +This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **HmdState** Windows Mixed Reality Headset HMD state. +- **NewHoloShellState** Windows Mixed Reality HoloShell state. +- **PriorHoloShellState** Windows Mixed Reality state prior to entering to HoloShell. +- **SimulationEnabled** Windows Mixed Reality Simulation state. + + +### Microsoft.Windows.Shell.HolographicFirstRun.AppActivated + +This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **IsDemoMode** Windows Mixed Reality Portal app state of demo mode. +- **IsDeviceSetupComplete** Windows Mixed Reality Portal app state of device setup completion. +- **PackageVersion** Windows Mixed Reality Portal app package version. +- **PreviousExecutionState** Windows Mixed Reality Portal app prior execution state. +- **wilActivity** Windows Mixed Reality Portal app wilActivity ID. See [wilActivity](#wilactivity). + + +### Microsoft.Windows.Shell.HolographicFirstRun.AppLifecycleService_Resuming + +This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Shell.HolographicFirstRun.SomethingWentWrong + +This event is emitted when something went wrong error occurs. The data collected with this event is used to keep Windows and Windows Mixed Reality performing properly. + +The following fields are available: + +- **ErrorSource** Source of error, obsoleted always 0. +- **StartupContext** Start up state. +- **StatusCode** Error status code. +- **SubstatusCode** Error sub status code. + + +### TraceLoggingHoloLensSensorsProvider.OnDeviceAdd + +This event provides Windows Mixed Reality device state with new process that hosts the driver. The data collected with this event is used to keep Windows and Windows Mixed Reality performing properly. + +The following fields are available: + +- **Process** Process ID. +- **Thread** Thread ID. + + +### TraceLoggingOasisUsbHostApiProvider.DeviceInformation + +This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BootloaderMajorVer** Windows Mixed Reality device boot loader major version. +- **BootloaderMinorVer** Windows Mixed Reality device boot loader minor version. +- **BootloaderRevisionNumber** Windows Mixed Reality device boot loader revision number. +- **BTHFWMajorVer** Windows Mixed Reality device BTHFW major version. This event also used to count WMR device. +- **BTHFWMinorVer** Windows Mixed Reality device BTHFW minor version. This event also used to count WMR device. +- **BTHFWRevisionNumber** Windows Mixed Reality device BTHFW revision number. +- **CalibrationBlobSize** Windows Mixed Reality device calibration blob size. +- **CalibrationFwMajorVer** Windows Mixed Reality device calibration firmware major version. +- **CalibrationFwMinorVer** Windows Mixed Reality device calibration firmware minor version. +- **CalibrationFwRevNum** Windows Mixed Reality device calibration firmware revision number. +- **DeviceInfoFlags** Windows Mixed Reality device info flags. +- **DeviceName** Windows Mixed Reality device Name. This event is also used to count WMR device. +- **DeviceReleaseNumber** Windows Mixed Reality device release number. +- **FirmwareMajorVer** Windows Mixed Reality device firmware major version. +- **FirmwareMinorVer** Windows Mixed Reality device firmware minor version. +- **FirmwareRevisionNumber** Windows Mixed Reality device calibration firmware revision number. +- **FpgaFwMajorVer** Windows Mixed Reality device FPGA firmware major version. +- **FpgaFwMinorVer** Windows Mixed Reality device FPGA firmware minor version. +- **FpgaFwRevisionNumber** Windows Mixed Reality device FPGA firmware revision number. +- **FriendlyName** Windows Mixed Reality device friendly name. +- **HashedSerialNumber** Windows Mixed Reality device hashed serial number. +- **HeaderSize** Windows Mixed Reality device header size. +- **HeaderVersion** Windows Mixed Reality device header version. +- **LicenseKey** Windows Mixed Reality device header license key. +- **Make** Windows Mixed Reality device make. +- **ManufacturingDate** Windows Mixed Reality device manufacturing date. +- **Model** Windows Mixed Reality device model. +- **PresenceSensorHidVendorPage** Windows Mixed Reality device presence sensor HID vendor page. +- **PresenceSensorHidVendorUsage** Windows Mixed Reality device presence sensor HID vendor usage. +- **PresenceSensorUsbVid** Windows Mixed Reality device presence sensor USB VId. +- **ProductBoardRevision** Windows Mixed Reality device product board revision number. +- **SerialNumber** Windows Mixed Reality device serial number. + + +## Inventory events + +### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum + +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **Device** A count of device objects in cache. +- **DeviceCensus** A count of device census objects in cache. +- **DriverPackageExtended** A count of driverpackageextended objects in cache. +- **File** A count of file objects in cache. +- **FileSigningInfo** A count of file signing objects in cache. +- **Generic** A count of generic objects in cache. +- **HwItem** A count of hwitem objects in cache. +- **InventoryApplication** A count of application objects in cache. +- **InventoryApplicationAppV** A count of application AppV objects in cache. +- **InventoryApplicationDriver** A count of application driver objects in cache +- **InventoryApplicationFile** A count of application file objects in cache. +- **InventoryApplicationFramework** A count of application framework objects in cache +- **InventoryApplicationShortcut** A count of application shortcut objects in cache +- **InventoryDeviceContainer** A count of device container objects in cache. +- **InventoryDeviceInterface** A count of Plug and Play device interface objects in cache. +- **InventoryDeviceMediaClass** A count of device media objects in cache. +- **InventoryDevicePnp** A count of device Plug and Play objects in cache. +- **InventoryDeviceUsbHubClass** A count of device usb objects in cache +- **InventoryDriverBinary** A count of driver binary objects in cache. +- **InventoryDriverPackage** A count of device objects in cache. +- **InventoryMiscellaneousOfficeAddIn** A count of office add-in objects in cache +- **InventoryMiscellaneousOfficeAddInUsage** A count of office add-in usage objects in cache. +- **InventoryMiscellaneousOfficeIdentifiers** A count of office identifier objects in cache +- **InventoryMiscellaneousOfficeIESettings** A count of office ie settings objects in cache +- **InventoryMiscellaneousOfficeInsights** A count of office insights objects in cache +- **InventoryMiscellaneousOfficeProducts** A count of office products objects in cache +- **InventoryMiscellaneousOfficeSettings** A count of office settings objects in cache +- **InventoryMiscellaneousOfficeVBA** A count of office vba objects in cache +- **InventoryMiscellaneousOfficeVBARuleViolations** A count of office vba rule violations objects in cache +- **InventoryMiscellaneousUUPInfo** A count of uup info objects in cache +- **Metadata** A count of metadata objects in cache. +- **Orphan** A count of orphan file objects in cache. +- **Programs** A count of program objects in cache. + + +### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions + +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **aeinv** The version of the App inventory component. +- **devinv** The file version of the Device inventory component. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd + +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **HiddenArp** Indicates whether a program hides itself from showing up in ARP. +- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics). +- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00 +- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array. +- **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. +- **InventoryVersion** The version of the inventory file generating the events. +- **Language** The language code of the program. +- **MsiInstallDate** The install date recorded in the program's MSI package. +- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. +- **MsiProductCode** A GUID that describe the MSI Product. +- **Name** The name of the application. +- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install. +- **PackageFullName** The package full name for a Store application. +- **ProgramInstanceId** A hash of the file IDs in an app. +- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field. +- **RootDirPath** The path to the root directory where the program was installed. +- **Source** How the program was installed (for example, ARP, MSI, Appx). +- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp. +- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen. +- **Version** The version number of the program. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd + +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory component +- **ProgramIds** The unique program identifier the driver is associated with + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync + +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory component. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd + +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **FileId** A hash that uniquely identifies a file. +- **Frameworks** The list of frameworks this file depends on. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync + +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove + +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync + +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd + +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Categories** A comma separated list of functional categories in which the container belongs. +- **DiscoveryMethod** The discovery method for the device container. +- **FriendlyName** The name of the device container. +- **Icon** Deprecated in RS3. The path or index to the icon file. +- **InventoryVersion** The version of the inventory file generating the events. +- **IsActive** Is the device connected, or has it been seen in the last 14 days? +- **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link. +- **IsMachineContainer** Is the container the root device itself? +- **IsNetworked** Is this a networked device? +- **IsPaired** Does the device container require pairing? +- **Manufacturer** The manufacturer name for the device container. +- **ModelId** A unique model ID. +- **ModelName** The model name. +- **ModelNumber** The model number for the device container. +- **PrimaryCategory** The primary category for the device container. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove + +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync + +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd + +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Accelerometer3D** Indicates if an Accelerator3D sensor is found. +- **ActivityDetection** Indicates if an Activity Detection sensor is found. +- **AmbientLight** Indicates if an Ambient Light sensor is found. +- **Barometer** Indicates if a Barometer sensor is found. +- **Custom** Indicates if a Custom sensor is found. +- **EnergyMeter** Indicates if an Energy sensor is found. +- **FloorElevation** Indicates if a Floor Elevation sensor is found. +- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found. +- **GravityVector** Indicates if a Gravity Detector sensor is found. +- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found. +- **Humidity** Indicates if a Humidity sensor is found. +- **InventoryVersion** The version of the inventory file generating the events. +- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found. +- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found. +- **Orientation** Indicates if an Orientation sensor is found. +- **Pedometer** Indicates if a Pedometer sensor is found. +- **Proximity** Indicates if a Proximity sensor is found. +- **RelativeOrientation** Indicates if a Relative Orientation sensor is found. +- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found. +- **Temperature** Indicates if a Temperature sensor is found. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync + +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd + +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Audio.CaptureDriver** The capture driver endpoint for the audio device. +- **Audio.RenderDriver** The render driver for the audio device. +- **Audio_CaptureDriver** The Audio device capture driver endpoint. +- **Audio_RenderDriver** The Audio device render driver endpoint. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove + +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync + +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd + +This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **BusReportedDescription** The description of the device reported by the bux. +- **Class** The device setup class of the driver loaded for the device. +- **ClassGuid** The device class GUID from the driver package +- **COMPID** The device setup class guid of the driver loaded for the device. +- **ContainerId** The list of compat ids for the device. +- **Description** System-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the computer. +- **DeviceDriverFlightId** The test build (Flight) identifier of the device driver. +- **DeviceExtDriversFlightIds** The test build (Flight) identifier for all extended device drivers. +- **DeviceInterfaceClasses** The device interfaces that this device implements. +- **DeviceState** The device description. +- **DriverId** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present +- **DriverName** A unique identifier for the driver installed. +- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage +- **DriverVerDate** Name of the .sys image file (or wudfrd.sys if using user mode driver framework). +- **DriverVerVersion** The immediate parent directory name in the Directory field of InventoryDriverPackage. +- **Enumerator** The date of the driver loaded for the device. +- **ExtendedInfs** The extended INF file names. +- **FirstInstallDate** The first time this device was installed on the machine. +- **HWID** The version of the driver loaded for the device. +- **Inf** The bus that enumerated the device. +- **InstallDate** The date of the most recent installation of the device on the machine. +- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InventoryVersion** List of hardware ids for the device. +- **LowerClassFilters** Lower filter class drivers IDs installed for the device +- **LowerFilters** Lower filter drivers IDs installed for the device +- **Manufacturer** INF file name (the name could be renamed by OS, such as oemXX.inf) +- **MatchingID** Device installation state. +- **Model** The version of the inventory binary generating the events. +- **ParentId** Lower filter class drivers IDs installed for the device. +- **ProblemCode** Lower filter drivers IDs installed for the device. +- **Provider** The device manufacturer. +- **Service** The device service name +- **STACKID** Represents the hardware ID or compatible ID that Windows uses to install a device instance. +- **UpperClassFilters** Upper filter drivers IDs installed for the device +- **UpperFilters** The device model. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove + +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync + +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd + +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. +- **TotalUserConnectablePorts** Total number of connectable USB ports. +- **TotalUserConnectableTypeCPorts** Total number of connectable USB Type C ports. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync + +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd + +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **DriverCheckSum** The checksum of the driver file. +- **DriverCompany** The company name that developed the driver. +- **DriverInBox** Is the driver included with the operating system? +- **DriverIsKernelMode** Is it a kernel mode driver? +- **DriverName** The file name of the driver. +- **DriverPackageStrongName** The strong name of the driver package +- **DriverSigned** The strong name of the driver package +- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file. +- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000. +- **DriverVersion** The version of the driver file. +- **ImageSize** The size of the driver file. +- **Inf** The name of the INF file. +- **InventoryVersion** The version of the inventory file generating the events. +- **Product** The product name that is included in the driver file. +- **ProductVersion** The product version that is included in the driver file. +- **Service** The name of the service that is installed for the device. +- **WdfVersion** The Windows Driver Framework version. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove + +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync + +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd + +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Class** The class name for the device driver. +- **ClassGuid** The class GUID for the device driver. +- **Date** The driver package date. +- **Directory** The path to the driver package. +- **DriverInBox** Is the driver included with the operating system? +- **FlightIds** Driver Flight IDs. +- **Inf** The INF name of the driver package. +- **InventoryVersion** The version of the inventory file generating the events. +- **Provider** The provider for the driver package. +- **RecoveryIds** Driver recovery IDs. +- **SubmissionId** The HLK submission ID for the driver package. +- **Version** The version of the driver package. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove + +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync + +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes. +- **Manufacturer** Name of the DRAM manufacturer. +- **Model** Model and submodel of the memory. +- **Slot** Slot the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured and used at. +- **Type** Reports DDR, etc. as an enumeration value per DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd + +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AddinCLSID** The class identifier key for the Microsoft Office add-in. +- **AddInCLSID** The class identifier key for the Microsoft Office add-in. +- **AddInId** The identifier for the Microsoft Office add-in. +- **AddinType** The type of the Microsoft Office add-in. +- **BinFileTimestamp** The timestamp of the Office add-in. +- **BinFileVersion** The version of the Microsoft Office add-in. +- **Description** Description of the Microsoft Office add-in. +- **FileId** The file identifier of the Microsoft Office add-in. +- **FileSize** The file size of the Microsoft Office add-in. +- **FriendlyName** The friendly name for the Microsoft Office add-in. +- **FullPath** The full path to the Microsoft Office add-in. +- **InventoryVersion** The version of the inventory binary generating the events. +- **LoadBehavior** Integer that describes the load behavior. +- **LoadTime** Load time for the Office add-in. +- **OfficeApplication** The Microsoft Office application associated with the add-in. +- **OfficeArchitecture** The architecture of the add-in. +- **OfficeVersion** The Microsoft Office version for this add-in. +- **OutlookCrashingAddin** Indicates whether crashes have been found for this add-in. +- **ProductCompany** The name of the company associated with the Office add-in. +- **ProductName** The product name associated with the Microsoft Office add-in. +- **ProductVersion** The version associated with the Office add-in. +- **ProgramId** The unique program identifier of the Microsoft Office add-in. +- **Provider** Name of the provider for this add-in. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove + +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync + +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd + +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device +- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device +- **OMID** Identifier for the Office SQM Machine +- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit +- **OTenantId** Unique GUID representing the Microsoft O365 Tenant +- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000 +- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows) + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd + +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature. +- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files. +- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) +- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag +- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request +- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) +- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts +- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords +- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control +- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted +- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC) +- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL +- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior +- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows +- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd + +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **OfficeApplication** The name of the Office application. +- **OfficeArchitecture** The bitness of the Office application. +- **OfficeVersion** The version of the Office application. +- **Value** The insights collected about this entity. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove + +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync + +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd + +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **OC2rApps** A GUID the describes the Office Click-To-Run apps +- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus +- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word +- **OProductCodes** A GUID that describes the Office MSI products + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd + +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **BrowserFlags** Browser flags for Office-related products. +- **ExchangeProviderFlags** Provider policies for Office Exchange. +- **InventoryVersion** The version of the inventory binary generating the events. +- **SharedComputerLicensing** Office shared computer licensing policies. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd + +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Design** Count of files with design issues found. +- **Design_x64** Count of files with 64 bit design issues found. +- **DuplicateVBA** Count of files with duplicate VBA code. +- **HasVBA** Count of files with VBA code. +- **Inaccessible** Count of files that were inaccessible for scanning. +- **InventoryVersion** The version of the inventory binary generating the events. +- **Issues** Count of files with issues detected. +- **Issues_x64** Count of files with 64-bit issues detected. +- **IssuesNone** Count of files with no issues detected. +- **IssuesNone_x64** Count of files with no 64-bit issues detected. +- **Locked** Count of files that were locked, preventing scanning. +- **NoVBA** Count of files with no VBA inside. +- **Protected** Count of files that were password protected, preventing scanning. +- **RemLimited** Count of files that require limited remediation changes. +- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues. +- **RemSignificant** Count of files that require significant remediation changes. +- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues. +- **Score** Overall compatibility score calculated for scanned content. +- **Score_x64** Overall 64-bit compatibility score calculated for scanned content. +- **Total** Total number of files scanned. +- **Validation** Count of files that require additional manual validation. +- **Validation_x64** Count of files that require additional manual validation for 64-bit issues. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove + +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd + +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Count** Count of total Microsoft Office VBA rule violations +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove + +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync + +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync + +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd + +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Identifier** UUP identifier +- **LastActivatedVersion** Last activated version +- **PreviousVersion** Previous version +- **Source** UUP source +- **Version** UUP version + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync + +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.Indicators.Checksum + +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **CensusId** A unique hardware identifier. +- **ChecksumDictionary** A count of each operating system indicator. +- **PCFP** Equivalent to the InventoryId field that is found in other core events. + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd + +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **IndicatorValue** The indicator value. + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +## Kernel events + +### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig + +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ClassGuid** The unique ID for the device class. +- **DeviceInstanceId** The unique ID for the device on the system. +- **DriverDate** The date of the driver. +- **DriverFlightIds** The IDs for the driver flights. +- **DriverInfName** Driver INF file name. +- **DriverProvider** The driver manufacturer or provider. +- **DriverSubmissionId** The driver submission ID assigned by the hardware developer center. +- **DriverVersion** The driver version number. +- **ExtensionDrivers** The list of extension driver INF files, extension IDs, and associated flight IDs. +- **FirstHardwareId** The ID in the hardware ID list that provides the most specific device description. +- **InboxDriver** Indicates whether the driver package is included with Windows. +- **InstallDate** Date the driver was installed. +- **LastCompatibleId** The ID in the hardware ID list that provides the least specific device description. +- **Legacy** Indicates whether the driver is a legacy driver. +- **NeedReboot** Indicates whether the driver requires a reboot. +- **RebootRequiredReason** Provides the reason why a reboot is required. +- **SetupMode** Indicates whether the device configuration occurred during the Out Of Box Experience (OOBE). +- **StatusCode** The NTSTATUS of device configuration operation. + + +### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem + +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Count** The total number of events. +- **DeviceInstanceId** The unique identifier of the device on the system. +- **LastProblem** The previous problem that was cleared. +- **LastProblemStatus** The previous NTSTATUS value that was cleared. +- **ServiceName** The name of the driver or service attached to the device. + + +### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem + +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Count** The total number of events. +- **DeviceInstanceId** The unique identifier of the device in the system. +- **LastProblem** The previous problem code that was set on the device. +- **LastProblemStatus** The previous NTSTATUS value that was set on the device. +- **Problem** The new problem code that was set on the device. +- **ProblemStatus** The new NTSTATUS value that was set on the device. +- **ServiceName** The driver or service name that is attached to the device. + + +### Microsoft.Windows.Kernel.Power.PreviousShutdownWasThermalShutdown + +This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **temperature** Contains the actual temperature measurement, in tenths of degrees Kelvin, for the area that exceeded the limit. +- **thermalZone** Contains an identifier that specifies which area it was that exceeded temperature limits. + + +### Microsoft.Windows.Kernel.Power.WinloadFatalError + +This event provides Winload fatal error information. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **errorBootId** The first boot sequence this error code was encountered since the last successful boot. +- **errorCode** The code from OslFatalErrorEx. +- **errorStatus** The status from OslFatalErrorEx. +- **otherErrorCount** The number of times other error codes have been encountered on subsequent boot attempts. +- **repeatCount** The number of times this error code has been repeated on subsequent boot attempts. + + +## Microsoft Edge events + +### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_env** The environment from which the event was logged when testing; otherwise, the field is omitted or left blank. +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''." +- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. +- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). +- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). +- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). +- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown). +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. +- **appVersion** The version of the product install. Default: '0.0.0.0'. +- **eventType** A string representation of appPingEventEventType indicating the type of the event. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +## Migration events + +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + +The following fields are available: + +- **currentSid** Indicates the user SID for which the migration is being performed. +- **knownFoldersUsr[i]** Predefined folder path locations. +- **migDiagSession->CString** The phase of the upgrade where migration occurs. (E.g.: Validate tracked content) +- **objectCount** The count for the number of objects that are being transferred. + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFSys + +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + +The following fields are available: + +- **knownFoldersSys[i]** The predefined folder path locations. +- **migDiagSession->CString** Identifies the phase of the upgrade where migration happens. +- **objectCount** The count of the number of objects that are being transferred. + + +### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + +The following fields are available: + +- **currentSid** Indicates the user SID for which the migration is being performed. +- **knownFoldersUsr[i]** Predefined folder path locations. +- **migDiagSession->CString** The phase of the upgrade where the migration occurs. (For example, Validate tracked content.) +- **objectCount** The number of objects that are being transferred. + + +## MUI events + +### MuiResourceLoaderTraceLogging.MapAndVerifyResourceFileFailure + +This event is logged when LdrMapAndVerifyResourceFile fails for an overlay module. + +The following fields are available: + +- **Culture** Language tag. +- **DevicePath** True if file path is a device path. +- **Flags** Flags used for verification in LdrMapAndVerifyResourceFile. +- **ResourceFileName** DLL path and name. +- **Status** Failing status code. + + +### MuiResourceLoaderTraceLogging.VerifyAlternateResourceModuleWithServiceChecksumFailure + +This event logs a failure when a MUI has an incompatible service checksum. + +The following fields are available: + +- **ActualServiceChecksum** The checksum in the MUI file. +- **ExpectedServiceChecksum** The checksum in the neutral binary. +- **ResourceFileName** DLL path and name which has a failing service checksum. + + +## OneDrive events + +### Microsoft.OneDrive.Sync.Setup.APIOperation + +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **APIName** The name of the API. +- **Duration** How long the operation took. +- **IsSuccess** Was the operation successful? +- **ResultCode** The result code. +- **ScenarioName** The name of the scenario. + + +### Microsoft.OneDrive.Sync.Setup.EndExperience + +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **APIName** The name of the API. +- **HResult** HResult of the operation +- **IsSuccess** Whether the operation is successful or not +- **ScenarioName** The name of the scenario. + + +### Microsoft.OneDrive.Sync.Updater.ComponentInstallState + +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **ComponentName** The name of the dependent component. +- **isInstalled** Is the dependent component installed? + + +### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus + +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **32bit** The status of the OneDrive overlay icon on a 32-bit operating system. +- **64bit** The status of the OneDrive overlay icon on a 64-bit operating system. + + +### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult + +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **hr** The HResult of the operation. +- **IsLoggingEnabled** Indicates whether logging is enabled for the updater. +- **UpdaterVersion** The version of the updater. + + +### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus + +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **failedCheck** The error code returned by the operation. +- **winInetError** The HResult of the operation. + + +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + +## Privacy consent logging events + +### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted + +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **presentationVersion** Which display version of the privacy consent experience the user completed +- **privacyConsentState** The current state of the privacy consent experience +- **settingsVersion** Which setting version of the privacy consent experience the user completed +- **userOobeExitReason** The exit reason of the privacy consent experience + + +### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus + +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **isAdmin** whether the person who is logging in is an admin +- **isExistingUser** whether the account existed in a downlevel OS +- **isLaunching** Whether or not the privacy consent experience will be launched +- **isSilentElevation** whether the user has most restrictive UAC controls +- **privacyConsentState** whether the user has completed privacy experience +- **userRegionCode** The current user's region setting + + +## Sediment events + +### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings + +This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date. + +The following fields are available: + +- **CustomVer** The registry value for targeting. +- **IsMetered** TRUE if the machine is on a metered network. +- **LastVer** The version of the last successful run. +- **ServiceVersionMajor** The Major version information of the component. +- **ServiceVersionMinor** The Minor version information of the component. +- **Time** The system time at which the event occurred. + + +### Microsoft.Windows.Sediment.OSRSS.Error + +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **FailureType** The type of error encountered. +- **FileName** The code file in which the error occurred. +- **HResult** The failure error code. +- **LineNumber** The line number in the code file at which the error occurred. +- **ServiceVersionMajor** The Major version information of the component. +- **ServiceVersionMinor** The Minor version information of the component. +- **Time** The system time at which the event occurred. + + +## Setup events + +### Microsoft.Windows.Setup.WinSetupBoot.BootBlockStart + +This event emits the start of the windows setup boot routine during upgrade. This routine determines the state of the upgrade and handles properly moving the upgrade forward or rolling back the device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Action** It indicates phase/stage of operation. +- **Detail** It indicates details about the phase/stage of the operation. +- **Rollback** It is blank as this event triggers in success scenario only. +- **Status** It indicates details about the status for getting the disk device object during boot. + + +### Microsoft.Windows.Setup.WinSetupBoot.BootBlockStop + +This event emits the stop of the windows setup boot routine during upgrade. This routine determines the state of the upgrade and handles properly moving the upgrade forward or rolling back the device. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Action** It indicates phase/stage of operation. +- **Detail** It indicates details about the phase/stage of the operation. +- **Rollback** It is blank as this event triggers in success scenario only. +- **Status** It indicates details about the status for getting the disk device object during boot. + + +### SetupPlatformTel.SetupPlatformTelActivityEvent + +This event sends basic metadata about the SetupPlatform update installation process, to help keep Windows up to date. + +The following fields are available: + +- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. +- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. +- **Value** Value associated with the corresponding event name. For example, time-related events will include the system time + + +### SetupPlatformTel.SetupPlatformTelActivityStarted + +This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. + +The following fields are available: + +- **Name** The name of the dynamic update type. Example: GDR driver + + +### SetupPlatformTel.SetupPlatformTelActivityStopped + +This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. + + + +### SetupPlatformTel.SetupPlatformTelEvent + +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date. + +The following fields are available: + +- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. +- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. +- **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. + + +## Software update events + +### SoftwareUpdateClientTelemetry.CheckForUpdates + +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. + +The following fields are available: + +- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion. +- **AllowCachedResults** Indicates if the scan allowed using cached results. +- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable +- **BranchReadinessLevel** The servicing branch configured on the device. +- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated. +- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location. +- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. +- **ClientVersion** The version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. No data is currently reported in this field. Expected value for this field is 0. +- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown +- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000). +- **DeferredUpdates** Update IDs which are currently being deferred until a later time +- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered. +- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled. +- **DriverSyncPassPerformed** Were drivers scanned this time? +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **ExtendedMetadataCabUrl** Hostname that is used to download an update. +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. +- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan. +- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan. +- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days). +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days). +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. +- **IPVersion** Indicates whether the download took place over IPv4 or IPv6 +- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. +- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. +- **IsWUfBFederatedScanDisabled** Indicates if Windows Update for Business federated scan is disabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce +- **MSIError** The last error that was encountered during a scan for updates. +- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6 +- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete +- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked +- **NumberOfLoop** The number of round trips the scan required +- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan +- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan +- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down. +- **Online** Indicates if this was an online scan. +- **PausedUpdates** A list of UpdateIds which that currently being paused. +- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window. +- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window. +- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window. +- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window. +- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. +- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days). +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days). +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **ScanDurationInSeconds** The number of seconds a scan took +- **ScanEnqueueTime** The number of seconds it took to initialize a scan +- **ScanProps** This is a 32-bit integer containing Boolean properties for a given Windows Update scan. The following bits are used; all remaining bits are reserved and set to zero. Bit 0 (0x1): IsInteractive - is set to 1 if the scan is requested by a user, or 0 if the scan is requested by Automatic Updates. Bit 1 (0x2): IsSeeker - is set to 1 if the Windows Update client's Seeker functionality is enabled. Seeker functionality is enabled on certain interactive scans, and results in the scans returning certain updates that are in the initial stages of release (not yet released for full adoption via Automatic Updates). +- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.). +- **ServiceUrl** The environment URL a device is configured to scan with +- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult). +- **SyncType** Describes the type of scan the event was +- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null. +- **TargetReleaseVersion** The value selected for the target release version policy. +- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down. +- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. + + +### SoftwareUpdateClientTelemetry.Commit + +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. + +The following fields are available: + +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **BundleRevisionNumber** Identifies the revision number of the content bundle +- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client +- **ClassificationId** Classification identifier of the update content. +- **DeploymentMutexId** Mutex identifier of the deployment operation. +- **DeploymentProviderHostModule** Name of the module which is hosting the Update Deployment Provider for deployment operation. +- **DeploymentProviderMode** The mode of operation of the update deployment provider. +- **EventScenario** Indicates the purpose of the event - whether because scan started, succeded, failed, etc. +- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver". +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. +- **FlightId** The specific id of the flight the device is getting +- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.) +- **RevisionNumber** Identifies the revision number of this specific piece of content +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateId** Identifier associated with the specific piece of content + + +### SoftwareUpdateClientTelemetry.Download + +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. + +The following fields are available: + +- **ActiveDownloadTime** Number of seconds the update was actively being downloaded. +- **AppXBlockHashFailures** Indicates the number of blocks that failed hash validation during download. +- **AppXScope** Indicates the scope of the app download. +- **BundleBytesDownloaded** Number of bytes downloaded for the specific content bundle. +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **BundleRepeatFailCount** Indicates whether this particular update bundle previously failed. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **BytesDownloaded** Number of bytes that were downloaded for an individual piece of content (not the entire bundle). +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **CbsMethod** The method used for downloading the update content related to the Component Based Servicing (CBS) technology. +- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location. +- **CDNId** ID which defines which CDN the software distribution client downloaded the content from. +- **ClientVersion** The version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. +- **ConnectTime** Indicates the cumulative amount of time (in seconds) it took to establish the connection for all updates in an update bundle. +- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority. +- **DownloadProps** Information about the download operation properties in the form of a bitmask. +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed. +- **EventType** Possible values are Child, Bundle, or Driver. +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight. +- **FlightId** The specific ID of the flight (pre-release build) the device is getting. +- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **HostName** The hostname URL the content is downloading from. +- **IPVersion** Indicates whether the download took place over IPv4 or IPv6. +- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. +- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **NetworkCost** A flag indicating the cost of the network (congested, fixed, variable, over data limit, roaming, etc.) used for downloading the update content. +- **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered." +- **PackageFullName** The package name of the content. +- **PostDnldTime** Time taken (in seconds) to signal download completion after the last job has completed downloading payload. +- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **Reason** A 32-bit integer representing the reason the update is blocked from being downloaded in the background. +- **RegulationResult** The result code (HResult) of the last attempt to contact the regulation web service for download regulation of update content. +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one. +- **RepeatFailCount** Indicates whether this specific content has previously failed. +- **RevisionNumber** The revision number of the specified piece of content. +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **SizeCalcTime** Time taken (in seconds) to calculate the total download size of the payload. +- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult). +- **TotalExpectedBytes** The total count of bytes that the download is expected to be. +- **UpdateId** An identifier associated with the specific piece of content. +- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional. +- **UsedDO** Whether the download used the delivery optimization service. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. + + +### SoftwareUpdateClientTelemetry.DownloadCheckpoint + +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client +- **ClientVersion** The version number of the software distribution client +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed +- **EventType** Possible values are "Child", "Bundle", "Relase" or "Driver" +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough +- **FileId** A hash that uniquely identifies a file +- **FileName** Name of the downloaded file +- **FlightId** The unique identifier for each flight +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **RevisionNumber** Unique revision number of Update +- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.) +- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult) +- **UpdateId** Unique Update ID +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue + + +### SoftwareUpdateClientTelemetry.DownloadHeartbeat + +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **BytesTotal** Total bytes to transfer for this content +- **BytesTransferred** Total bytes transferred for this content at the time of heartbeat +- **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client +- **ClientVersion** The version number of the software distribution client +- **ConnectionStatus** Indicates the connectivity state of the device at the time of heartbeat +- **CurrentError** Last (transient) error encountered by the active download +- **DownloadFlags** Flags indicating if power state is ignored +- **DownloadState** Current state of the active download for this content (queued, suspended, or progressing) +- **EventType** Possible values are "Child", "Bundle", or "Driver" +- **FlightId** The unique identifier for each flight +- **IsNetworkMetered** Indicates whether Windows considered the current network to be ?metered" +- **MOAppDownloadLimit** Mobile operator cap on size of application downloads, if any +- **MOUpdateDownloadLimit** Mobile operator cap on size of operating system update downloads, if any +- **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby) +- **RelatedCV** The previous correlation vector that was used by the client, before swapping with a new one +- **ResumeCount** Number of times this active download has resumed from a suspended state +- **RevisionNumber** Identifies the revision number of this specific piece of content +- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc) +- **SuspendCount** Number of times this active download has entered a suspended state +- **SuspendReason** Last reason for why this active download entered a suspended state +- **UpdateId** Identifier associated with the specific piece of content +- **WUDeviceID** Unique device id controlled by the software distribution client + + +### SoftwareUpdateClientTelemetry.Install + +This event sends tracking data about the software distribution client installation of the content for that update, to help keep Windows up to date. + +The following fields are available: + +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **BundleRepeatFailCount** Indicates whether this particular update bundle has previously failed. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **ClassificationId** Classification identifier of the update content. +- **ClientVersion** The version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. No value is currently reported in this field. Expected value for this field is 0. +- **CSIErrorType** The stage of CBS installation where it failed. +- **DeploymentMutexId** Mutex identifier of the deployment operation. +- **DeploymentProviderHostModule** Name of the module which is hosting the Update Deployment Provider for deployment operation. +- **DeploymentProviderMode** The mode of operation of the update deployment provider. +- **DriverPingBack** Contains information about the previous driver and system state. +- **DriverRecoveryIds** The list of identifiers that could be used for uninstalling the drivers if a recovery is required. +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed. +- **EventType** Possible values are Child, Bundle, or Driver. +- **ExtendedErrorCode** The extended error code. +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode is not specific enough. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build. +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **HandlerType** Indicates what kind of content is being installed (for example, app, driver, Windows update). +- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **InstallProps** A bitmask for future flags associated with the install operation. No value is currently reported in this field. Expected value for this field is 0. +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. +- **IsFinalOutcomeEvent** Indicates whether this event signals the end of the update/upgrade process. +- **IsFirmware** Indicates whether this update is a firmware update. +- **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. +- **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. +- **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. +- **MsiAction** The stage of MSI installation where it failed. +- **MsiProductCode** The unique identifier of the MSI installer. +- **PackageFullName** The package name of the content being installed. +- **ProcessName** The process name of the caller who initiated API calls, in the event that CallerApplicationName was not provided. +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **RepeatFailCount** Indicates whether this specific piece of content has previously failed. +- **RevisionNumber** The revision number of this specific piece of content. +- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.). +- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult). +- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. +- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **TransactionCode** The ID that represents a given MSI installation. +- **UpdateId** Unique update ID. +- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional. +- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. + + +### SoftwareUpdateClientTelemetry.Revert + +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **BundleId** Identifier associated with the specific content bundle. Should not be all zeros if the BundleId was found. +- **BundleRepeatFailCount** Indicates whether this particular update bundle has previously failed. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. +- **ClassificationId** Classification identifier of the update content. +- **ClientVersion** Version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. There is no value being reported in this field right now. Expected value for this field is 0. +- **CSIErrorType** Stage of CBS installation that failed. +- **DeploymentMutexId** Mutex identifier of the deployment operation. +- **DeploymentProviderHostModule** Name of the module which is hosting the Update Deployment Provider for deployment operation. +- **DeploymentProviderMode** The mode of operation of the update deployment provider. +- **DriverPingBack** Contains information about the previous driver and system state. +- **DriverRecoveryIds** The list of identifiers that could be used for uninstalling the drivers if a recovery is required. +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.). +- **EventType** Event type (Child, Bundle, Release, or Driver). +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode is not specific enough. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FlightBuildNumber** Indicates the build number of the flight. +- **FlightId** The specific ID of the flight the device is getting. +- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.). +- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **IsFinalOutcomeEvent** Indicates whether this event signals the end of the update/upgrade process. +- **IsFirmware** Indicates whether an update was a firmware update. +- **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. +- **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. +- **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. +- **ProcessName** Process name of the caller who initiated API calls into the software distribution client. +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **RelatedCV** The previous correlation vector that was used by the client before swapping with a new one. +- **RepeatFailCount** Indicates whether this specific piece of content has previously failed. +- **RevisionNumber** Identifies the revision number of this specific piece of content. +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. +- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **UpdateId** The identifier associated with the specific piece of content. +- **UpdateImportance** Indicates the importance of a driver, and why it received that importance level (0-Unknown, 1-Optional, 2-Important-DNF, 3-Important-Generic, 4-Important-Other, 5-Recommended). +- **UsedSystemVolume** Indicates whether the device's main system storage drive or an alternate storage drive was used. +- **WUDeviceID** Unique device ID controlled by the software distribution client. + + +### SoftwareUpdateClientTelemetry.TaskRun + +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. +- **ClientVersion** Version number of the software distribution client. +- **CmdLineArgs** Command line arguments passed in by the caller. +- **EventInstanceID** A globally unique identifier for the event instance. +- **EventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.). +- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc.). +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **WUDeviceID** Unique device ID controlled by the software distribution client. + + +### SoftwareUpdateClientTelemetry.Uninstall + +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **BundleId** The identifier associated with the specific content bundle. This should not be all zeros if the bundleID was found. +- **BundleRepeatFailCount** Indicates whether this particular update bundle previously failed. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **CallerApplicationName** Name of the application making the Windows Update request. Used to identify context of request. +- **ClassificationId** Classification identifier of the update content. +- **ClientVersion** Version number of the software distribution client. +- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. There is no value being reported in this field right now. Expected value for this field is 0. +- **DeploymentMutexId** Mutex identifier of the deployment operation. +- **DeploymentProviderHostModule** Name of the module which is hosting the Update Deployment Provider for deployment operation. +- **DeploymentProviderMode** The mode of operation of the Update Deployment Provider. +- **DriverPingBack** Contains information about the previous driver and system state. +- **DriverRecoveryIds** The list of identifiers that could be used for uninstalling the drivers when a recovery is required. +- **EventInstanceID** A globally unique identifier for event instance. +- **EventScenario** Indicates the purpose of the event (a scan started, succeded, failed, etc.). +- **EventType** Indicates the event type. Possible values are "Child", "Bundle", "Release" or "Driver". +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode is not specific enough. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FlightBuildNumber** Indicates the build number of the flight. +- **FlightId** The specific ID of the flight the device is getting. +- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.). +- **HardwareId** If the download was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **IsFinalOutcomeEvent** Indicates whether this event signals the end of the update/upgrade process. +- **IsFirmware** Indicates whether an update was a firmware update. +- **IsSuccessFailurePostReboot** Indicates whether an initial success was then a failure after a reboot. +- **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. +- **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. +- **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. +- **ProcessName** Process name of the caller who initiated API calls into the software distribution client. +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **RelatedCV** The previous correlation vector that was used by the client before swapping with a new one. +- **RepeatFailCount** Indicates whether this specific piece of content previously failed. +- **RevisionNumber** Identifies the revision number of this specific piece of content. +- **ServiceGuid** A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc). +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. +- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **UpdateId** Identifier associated with the specific piece of content. +- **UpdateImportance** Indicates the importance of a driver and why it received that importance level (0-Unknown, 1-Optional, 2-Important-DNF, 3-Important-Generic, 4-Important-Other, 5-Recommended). +- **UsedSystemVolume** Indicates whether the device’s main system storage drive or an alternate storage drive was used. +- **WUDeviceID** Unique device ID controlled by the software distribution client. + + +### SoftwareUpdateClientTelemetry.UpdateDetected + +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. +- **NumberOfApplicableUpdates** The number of updates ultimately deemed applicable to the system after the detection process is complete. +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one. +- **ServiceGuid** An ID that represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.). +- **WUDeviceID** The unique device ID controlled by the software distribution client. + + +### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity + +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request. +- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. +- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed. +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough. +- **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed. +- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate. +- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce +- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID). +- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable. +- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable. +- **RevisionId** The revision ID for a specific piece of content. +- **RevisionNumber** The revision number for a specific piece of content. +- **ServiceGuid** Identifies the service to which the software distribution client is connected. Example: Windows Update or Microsoft Store +- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate. +- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate. +- **SHA256OfTimestampToken** An encoded string of the timestamp token. +- **SignatureAlgorithm** The hash algorithm for the metadata signature. +- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed. +- **UpdateId** The update ID for a specific piece of content. +- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. + + +## Surface events + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + + +## Update Assistant events + +### Microsoft.Windows.QUALauncher.Applicable + +This event sends basic information when AQUA launches and checks for any self update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **DetectedCondition** Checks if device condition was met for running remediation. +- **FileVersion** Current file version. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **IsHashMismatch** Checks if the hash of the payload matches the one specified in OneSettings. +- **IsSelfUpdateEnabledInOneSettings** Checks if self update is enabled. +- **IsSelfUpdateNeeded** Checks if self update is needed. All the conditions are satisfied. +- **PackageVersion** Current package version. +- **PluginName** Plugin name. +- **Result** Result. +- **SelfUpdatePackageVersion** Version of the updated package installed. +- **SelUpdatePackageVersion** Version of the new package. + + +### Microsoft.Windows.QualityUpdateAssistant.Applicability + +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **dayspendingrebootafterfu** Number of days that have elapsed since the device reached ready to reboot for a Feature Update that is still actively pending reboot. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this device. +- **KBNumber** KBNumber of the update being installed. +- **PackageVersion** Current package version of quality update assistant. +- **Reason** Provides information on reasons why the update is not applicable to the device. +- **Result** Applicability check for quality update assistant. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationFailed + +This event is raised after an executable delivered by Mitigation Service has run and failed. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. Failure data will also be used for root-cause investigation by feature teams, as signal to halt mitigation rollout and, possible follow-up action on specific devices still impacted by the problem because the mitigation failed (i.e. reoffer it to impacted devices). The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **activeProcesses** Number of active processes. +- **atleastOneMitigationSucceeded** Bool flag indicating if at least one mitigation succeeded. +- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. +- **countDownloadedPayload** Count instances of payload downloaded. +- **description** Description of failure. +- **devicePreference** Recommended Troubleshooting Setting on the device. +- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. +- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. +- **executionHR** HR code of the execution of the mitigation. +- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, eg when executing Critical troubleshooters, the executionPreference is set to the Silent option. +- **exitCode** Exit code of the execution of the mitigation. +- **experimentFeatureId** Experiment feature ID. +- **experimentFeatureState** Config state of the experiment. +- **hr** HRESULT for error code. +- **isActiveSessionPresent** If an active user session is present on the device. +- **isCriticalMitigationAvailable** If a critical mitigation is available to this device. +- **isFilteringSuccessful** If the filtering operation was successful. +- **isReApply** reApply status for the mitigation. +- **mitigationId** ID value of the mitigation. +- **mitigationProcessCycleTime** Process cycle time used by the mitigation. +- **mitigationRequestWithCompressionFailed** Boolean flag indicating if HTTP request with compression failed for this device. +- **mitigationServiceResultFetched** Boolean flag indicating if mitigation details were fetched from the admin service. +- **mitigationVersion** String indicating version of the mitigation. +- **oneSettingsMetadataParsed** If OneSettings metadata was parsed successfully. +- **oneSettingsSchemaVersion** Schema version used by the OneSettings parser. +- **onlyNoOptMitigationsPresent** Checks if all mitigations were no opt. +- **parsedOneSettingsFile** Indicates if OneSettings parsing was successful. +- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. +- **SessionId** Random GUID used for grouping events in a session. +- **subType** Error type. +- **totalKernelTime** Total kernel time used by the mitigation. +- **totalNumberOfApplicableMitigations** Total number of applicable mitigations. +- **totalProcesses** Total number of processes assigned to the job object. +- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. +- **totalUserTime** Total user mode time used by the job object. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationRejected + +This event is raised when a targeted mitigation is rejected by the device based on the device's preference, or if it has already been applied. This enables us to find out why an applicable mitigation was not executed by the device. Data from this event is used to measure the health of mitigations service stack used by engineers to solve in-market problems on internal, insider, and retail devices. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **description** String describing why a mitigation was rejected. +- **mitigationId** GUID identifier for a mitigation. +- **mitigationVersion** Version of the mitigation. +- **SessionId** GUID identifier to link events to a single session/execution of the mitigation service. +- **subType** Integer value describing the reason type of why a mitigation was rejected. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationSucceeded + +This event is raised after an executable delivered by Mitigation Service has successfully run. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **activeProcesses** Number of active processes. +- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. +- **devicePreference** Recommended troubleshooting setting on the device. +- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. +- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. +- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, for example, when executing Critical troubleshooters, the executionPreference is set to the Silent option. +- **experimentFeatureId** Experiment feature ID. +- **experimentFeatureState** Feature state for the experiment. +- **mitigationId** ID value of the mitigation. +- **mitigationProcessCycleTime** Process cycle time used by the mitigation. +- **mitigationVersion** String indicating version of the mitigation. +- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. +- **SessionId** Random GUID used for grouping events in a session. +- **totalKernelTime** Total kernel time used by the mitigation. +- **totalProcesses** Total number of processes assigned to the job object. +- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. +- **totalUserTime** Total user mode time used by the job object. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsCachedNotificationRetrieved + +This event is sent when a notification is received. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter that indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** A boolean that is true if the blob notification has valid content. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceSccmManaged** Device is managed by SCCM. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails + +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + +## Update events + +### Update360Telemetry.Revert + +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the Revert phase. +- **FlightId** Unique ID for the flight (test instance version). +- **ObjectId** The unique value for each Update Agent mode. +- **RebootRequired** Indicates reboot is required. +- **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. +- **RevertResult** The result code returned for the Revert operation. +- **ScenarioId** The ID of the update scenario. +- **SessionId** The ID of the update attempt. +- **UpdateId** The ID of the update. + + +### Update360Telemetry.UpdateAgentCommit + +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CancelRequested** Boolean that indicates whether cancel was requested. +- **ErrorCode** The error code returned for the current install phase. +- **FlightId** Unique ID for each flight. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** Outcome of the install phase of the update. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentDownloadRequest + +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CancelRequested** Boolean indicating whether a cancel was requested. +- **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. +- **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. +- **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. +- **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. +- **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. +- **DownloadedSizePSFX** Cumulative size (in bytes) of downloaded PSFX content. +- **DownloadRequests** Number of times a download was retried. +- **ErrorCode** The error code returned for the current download request phase. +- **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. +- **FlightId** Unique ID for each flight. +- **InternalFailureResult** Indicates a non-fatal error from a plugin. +- **ObjectId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). +- **PackageCategoriesSkipped** Indicates package categories that were skipped, if applicable. +- **PackageCountOptional** Number of optional packages requested. +- **PackageCountRequired** Number of required packages requested. +- **PackageCountTotal** Total number of packages needed. +- **PackageCountTotalCanonical** Total number of canonical packages. +- **PackageCountTotalDiff** Total number of diff packages. +- **PackageCountTotalExpress** Total number of express packages. +- **PackageCountTotalPSFX** The total number of PSFX packages. +- **PackageExpressType** Type of express package. +- **PackageSizeCanonical** Size of canonical packages in bytes. +- **PackageSizeDiff** Size of diff packages in bytes. +- **PackageSizeExpress** Size of express packages in bytes. +- **PackageSizePSFX** The size of PSFX packages, in bytes. +- **RangeRequestState** Indicates the range request type used. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** Outcome of the download request phase of update. +- **SandboxTaggedForReserves** The sandbox for reserves. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each attempt (same value for initialize, download, install commit phases). +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentExpand + +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CancelRequested** Boolean that indicates whether a cancel was requested. +- **CanonicalRequestedOnError** Indicates if an error caused a reversion to a different type of compressed update (TRUE or FALSE). +- **ElapsedTickCount** Time taken for expand phase. +- **EndFreeSpace** Free space after expand phase. +- **EndSandboxSize** Sandbox size after expand phase. +- **ErrorCode** The error code returned for the current install phase. +- **FlightId** Unique ID for each flight. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **StartFreeSpace** Free space before expand phase. +- **StartSandboxSize** Sandbox size after expand phase. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentInitialize + +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the current install phase. +- **FlightId** Unique ID for each flight. +- **FlightMetadata** Contains the FlightId and the build being flighted. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** Outcome of the install phase of the update. +- **ScenarioId** Indicates the update scenario. +- **SessionData** String containing instructions to update agent for processing FODs and DUICs (Null for other scenarios). +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentInstall + +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CancelRequested** Boolean to indicate whether a cancel was requested. +- **ErrorCode** The error code returned for the current install phase. +- **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. +- **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). +- **InternalFailureResult** Indicates a non-fatal error from a plugin. +- **ObjectId** Correlation vector value generated from the latest USO scan. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** The result for the current install phase. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentMitigationResult + +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Applicable** Indicates whether the mitigation is applicable for the current update. +- **CommandCount** The number of command operations in the mitigation entry. +- **CustomCount** The number of custom operations in the mitigation entry. +- **FileCount** The number of file operations in the mitigation entry. +- **FlightId** Unique identifier for each flight. +- **Index** The mitigation index of this particular mitigation. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **Name** The friendly name of the mitigation. +- **ObjectId** Unique value for each Update Agent mode. +- **OperationIndex** The mitigation operation index (in the event of a failure). +- **OperationName** The friendly name of the mitigation operation (in the event of failure). +- **RegistryCount** The number of registry operations in the mitigation entry. +- **RelatedCV** The correlation vector value generated from the latest USO scan. +- **Result** The HResult of this operation. +- **ScenarioId** The update agent scenario ID. +- **SessionId** Unique value for each update attempt. +- **TimeDiff** The amount of time spent performing the mitigation (in 100-nanosecond increments). +- **UpdateId** Unique ID for each Update. + + +### Update360Telemetry.UpdateAgentMitigationSummary + +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Applicable** The count of mitigations that were applicable to the system and scenario. +- **Failed** The count of mitigations that failed. +- **FlightId** Unique identifier for each flight. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **ObjectId** The unique value for each Update Agent mode. +- **RelatedCV** The correlation vector value generated from the latest USO scan. +- **Result** The HResult of this operation. +- **ScenarioId** The update agent scenario ID. +- **SessionId** Unique value for each update attempt. +- **TimeDiff** The amount of time spent performing all mitigations (in 100-nanosecond increments). +- **Total** Total number of mitigations that were available. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgentModeStart + +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FlightId** Unique ID for each flight. +- **Mode** Indicates the mode that has started. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. +- **Version** Version of update + + +### Update360Telemetry.UpdateAgentOneSettings + +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Count** The count of applicable OneSettings for the device. +- **FlightId** Unique ID for the flight (test instance version). +- **ObjectId** The unique value for each Update Agent mode. +- **Parameters** The set of name value pair parameters sent to OneSettings to determine if there are any applicable OneSettings. +- **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. +- **Result** The HResult of the event. +- **ScenarioId** The ID of the update scenario. +- **SessionId** The ID of the update attempt. +- **UpdateId** The ID of the update. +- **Values** The values sent back to the device, if applicable. + + +### Update360Telemetry.UpdateAgentPostRebootResult + +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the current post reboot phase. +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **ObjectId** Unique value for each Update Agent mode. +- **PostRebootResult** Indicates the Hresult. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. +- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. + + +### Update360Telemetry.UpdateAgentReboot + +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the current reboot. +- **FlightId** Unique ID for the flight (test instance version). +- **IsSuspendable** Indicates whether the update has the ability to be suspended and resumed at the time of reboot. When the machine is rebooted and the update is in middle of Predownload or Install and Setup.exe is running, this field is TRUE, if not its FALSE. +- **ObjectId** The unique value for each Update Agent mode. +- **Reason** Indicates the HResult why the machine could not be suspended. If it is successfully suspended, the result is 0. +- **RelatedCV** The correlation vector value generated from the latest USO (Update Service Orchestrator) scan. +- **Result** The HResult of the event. +- **ScenarioId** The ID of the update scenario. +- **SessionId** The ID of the update attempt. +- **UpdateId** The ID of the update. +- **UpdateState** Indicates the state of the machine when Suspend is called. For example, Install, Download, Commit. + + +### Update360Telemetry.UpdateAgentSetupBoxLaunch + +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ContainsExpressPackage** Indicates whether the download package is express. +- **FlightId** Unique ID for each flight. +- **FreeSpace** Free space on OS partition. +- **InstallCount** Number of install attempts using the same sandbox. +- **ObjectId** Unique value for each Update Agent mode. +- **Quiet** Indicates whether setup is running in quiet mode. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **SandboxSize** Size of the sandbox. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each update attempt. +- **SetupLaunchAttemptCount** Indicates the count of attempts to launch setup for the current Update Agent instance. +- **SetupMode** Mode of setup to be launched. +- **UpdateId** Unique ID for each Update. +- **UserSession** Indicates whether install was invoked by user actions. + + +## Update notification events + +### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat + +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignConfigVersion** Configuration version for the current campaign. +- **CampaignID** Currently campaign that is running on Update Notification Pipeline (UNP). +- **ConfigCatalogVersion** Current catalog version of UNP. +- **ContentVersion** Content version for the current campaign on UNP. +- **CV** Correlation vector. +- **DetectorVersion** Most recently run detector version for the current campaign on UNP. +- **GlobalEventCounter** Client-side counter that indicates the event ordering sent by the user. +- **PackageVersion** Current UNP package version. + + +## Upgrade events + +### FacilitatorTelemetry.DCATDownload + +This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure. + +The following fields are available: + +- **DownloadSize** Download size of payload. +- **ElapsedTime** Time taken to download payload. +- **MediaFallbackUsed** Used to determine if we used Media CompDBs to figure out package requirements for the upgrade. +- **ResultCode** Result returned by the Facilitator DCAT call. +- **Scenario** Dynamic update scenario (Image DU, or Setup DU). +- **Type** Type of package that was downloaded. +- **UpdateId** The ID of the update that was downloaded. + + +### FacilitatorTelemetry.DUDownload + +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **PackageCategoriesFailed** Lists the categories of packages that failed to download. +- **PackageCategoriesSkipped** Lists the categories of package downloads that were skipped. + + +### FacilitatorTelemetry.InitializeDU + +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DownloadRequestAttributes** The attributes we send to DCAT. +- **ResultCode** The result returned from the initiation of Facilitator with the URL/attributes. +- **Scenario** Dynamic Update scenario (Image DU, or Setup DU). +- **Url** The Delivery Catalog (DCAT) URL we send the request to. +- **Version** Version of Facilitator. + + +### Setup360Telemetry.Downlevel + +This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure. + +The following fields are available: + +- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the downlevel OS. +- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** More detailed information about phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360 (for example, Predownload, Install, Finalize, Rollback). +- **Setup360Result** The result of Setup360 (HRESULT used to diagnose errors). +- **Setup360Scenario** The Setup360 flow type (for example, Boot, Media, Update, MCT). +- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS). +- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** An ID that uniquely identifies a group of events. +- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId. + + +### Setup360Telemetry.Finalize + +This event sends data indicating that the device has started the phase of finalizing the upgrade, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** More detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** ID that uniquely identifies a group of events. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. + + +### Setup360Telemetry.OsUninstall + +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase or action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** ID that uniquely identifies a group of events. +- **WuId** Windows Update client ID. + + +### Setup360Telemetry.PostRebootInstall + +This event sends data indicating that the device has invoked the post reboot install phase of the upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **TestId** A string to uniquely identify a group of events. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId. + + +### Setup360Telemetry.PreDownloadQuiet + +This event sends data indicating that the device has invoked the predownload quiet phase of the upgrade, to help keep Windows up to date. + +The following fields are available: + +- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled. +- **TestId** ID that uniquely identifies a group of events. +- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId. + + +### Setup360Telemetry.PreDownloadUX + +This event sends data regarding OS Updates and Upgrades from Windows 7.X, Windows 8.X, Windows 10 and RS, to help keep Windows up-to-date and secure. Specifically, it indicates the outcome of the PredownloadUX portion of the update process. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **HostOSBuildNumber** The build number of the previous operating system. +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system). +- **InstanceId** Unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS). +- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** ID that uniquely identifies a group of events. +- **WuId** Windows Update client ID. + + +### Setup360Telemetry.PreInstallQuiet + +This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT). +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** A string to uniquely identify a group of events. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. + + +### Setup360Telemetry.PreInstallUX + +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10, to help keep Windows up-to-date. Specifically, it indicates the outcome of the PreinstallUX portion of the update process. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** A string to uniquely identify a group of events. +- **WuId** Windows Update client ID. + + +### Setup360Telemetry.Setup360 + +This event sends data about OS deployment scenarios, to help keep Windows up-to-date. + +The following fields are available: + +- **ClientId** Retrieves the upgrade ID. In the Windows Update scenario, this will be the Windows Update client ID. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FieldName** Retrieves the data point. +- **FlightData** Specifies a unique identifier for each group of Windows Insider builds. +- **InstanceId** Retrieves a unique identifier for each instance of a setup session. +- **ReportId** Retrieves the report ID. +- **ScenarioId** Retrieves the deployment scenario. +- **Value** Retrieves the value associated with the corresponding FieldName. + + +### Setup360Telemetry.Setup360DynamicUpdate + +This event helps determine whether the device received supplemental content during an operating system upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **FlightData** Specifies a unique identifier for each group of Windows Insider builds. +- **InstanceId** Retrieves a unique identifier for each instance of a setup session. +- **Operation** Facilitator's last known operation (scan, download, etc.). +- **ReportId** ID for tying together events stream side. +- **ResultCode** Result returned for the entire setup operation. +- **Scenario** Dynamic Update scenario (Image DU, or Setup DU). +- **ScenarioId** Identifies the update scenario. +- **TargetBranch** Branch of the target OS. +- **TargetBuild** Build of the target OS. + + +### Setup360Telemetry.Setup360MitigationResult + +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Applicable** TRUE if the mitigation is applicable for the current update. +- **ClientId** In the Windows Update scenario, this is the client ID passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **CommandCount** The number of command operations in the mitigation entry. +- **CustomCount** The number of custom operations in the mitigation entry. +- **FileCount** The number of file operations in the mitigation entry. +- **FlightData** The unique identifier for each flight (test release). +- **Index** The mitigation index of this particular mitigation. +- **InstanceId** The GUID (Globally Unique ID) that identifies each instance of SetupHost.EXE. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **Name** The friendly (descriptive) name of the mitigation. +- **OperationIndex** The mitigation operation index (in the event of a failure). +- **OperationName** The friendly (descriptive) name of the mitigation operation (in the event of failure). +- **RegistryCount** The number of registry operations in the mitigation entry. +- **ReportId** In the Windows Update scenario, the Update ID that is passed to Setup. In media setup, this is the GUID for the INSTALL.WIM. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **TimeDiff** The amount of time spent performing the mitigation (in 100-nanosecond increments). + + +### Setup360Telemetry.Setup360MitigationSummary + +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Applicable** The count of mitigations that were applicable to the system and scenario. +- **ClientId** The Windows Update client ID passed to Setup. +- **Failed** The count of mitigations that failed. +- **FlightData** The unique identifier for each flight (test release). +- **InstanceId** The GUID (Globally Unique ID) that identifies each instance of SetupHost.EXE. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **ReportId** In the Windows Update scenario, the Update ID that is passed to Setup. In media setup, this is the GUID for the INSTALL.WIM. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **TimeDiff** The amount of time spent performing the mitigation (in 100-nanosecond increments). +- **Total** The total number of mitigations that were available. + + +### Setup360Telemetry.Setup360OneSettings + +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** The Windows Update client ID passed to Setup. +- **Count** The count of applicable OneSettings for the device. +- **FlightData** The ID for the flight (test instance version). +- **InstanceId** The GUID (Globally-Unique ID) that identifies each instance of setuphost.exe. +- **Parameters** The set of name value pair parameters sent to OneSettings to determine if there are any applicable OneSettings. +- **ReportId** The Update ID passed to Setup. +- **Result** The HResult of the event error. +- **ScenarioId** The update scenario ID. +- **Values** Values sent back to the device, if applicable. + + +### Setup360Telemetry.UnexpectedEvent + +This event sends data indicating that the device has invoked the unexpected event phase of the upgrade, to help keep Windows up to date. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightData** Unique value that identifies the flight. +- **HostOSBuildNumber** The build number of the previous OS. +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred. +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT. +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled. +- **TestId** A string to uniquely identify a group of events. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. + + +## Windows Admin Center events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. +- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. +- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installationType** Identifies if the gateway was installed as a VM extension. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **otherProperties** This is an empty string, but may be used for another purpose in the future. +- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. +- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + +## Windows as a Service diagnostic events + +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + +### Microsoft.Windows.WaaSMedic.SummaryEvent + +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **callerApplication** The name of the calling application. +- **capsuleCount** The number of Sediment Pack capsules. +- **capsuleFailureCount** The number of capsule failures. +- **detectionSummary** Result of each applicable detection that was run. +- **featureAssessmentImpact** WaaS Assessment impact for feature updates. +- **hrEngineBlockReason** Indicates the reason for stopping WaaSMedic. +- **hrEngineResult** Error code from the engine operation. +- **hrLastSandboxError** The last error sent by the WaaSMedic sandbox. +- **initSummary** Summary data of the initialization method. +- **isInteractiveMode** The user started a run of WaaSMedic. +- **isManaged** Device is managed for updates. +- **isWUConnected** Device is connected to Windows Update. +- **noMoreActions** No more applicable diagnostics. +- **pluginFailureCount** The number of plugins that have failed. +- **pluginsCount** The number of plugins. +- **qualityAssessmentImpact** WaaS Assessment impact for quality updates. +- **remediationSummary** Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on. +- **usingBackupFeatureAssessment** Relying on backup feature assessment. +- **usingBackupQualityAssessment** Relying on backup quality assessment. +- **usingCachedFeatureAssessment** WaaS Medic run did not get OS build age from the network on the previous run. +- **usingCachedQualityAssessment** WaaS Medic run did not get OS revision age from the network on the previous run. +- **versionString** Version of the WaaSMedic engine. +- **waasMedicRunMode** Indicates whether this was a background regular run of the medic or whether it was triggered by a user launching Windows Update Troubleshooter. + + +## Windows Defender events + +### Microsoft.Windows.Sense.Client.PerformanceScript.OnboardingScript + +This event is triggered whenever Microsoft Defender for Endpoint onboarding script is run. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **Message** Error message. + + +## Windows Error Reporting events + +### Microsoft.Windows.WERVertical.OSCrash + +This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event. + +The following fields are available: + +- **BootId** Uint32 identifying the boot number for this device. +- **BugCheckCode** Uint64 "bugcheck code" that identifies a proximate cause of the bug check. +- **BugCheckParameter1** Uint64 parameter providing additional information. +- **BugCheckParameter2** Uint64 parameter providing additional information. +- **BugCheckParameter3** Uint64 parameter providing additional information. +- **BugCheckParameter4** Uint64 parameter providing additional information. +- **DumpFileAttributes** Codes that identify the type of data contained in the dump file +- **DumpFileSize** Size of the dump file +- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise +- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). + + +## Windows Hardware Error Architecture events + +### WheaProvider.WheaDriverErrorExternal + +This event is sent when a common platform hardware error is recorded by an external WHEA error source driver. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **creatorId** A GUID that identifies the entity that created the error record. +- **errorFlags** Flags set on the error record. +- **notifyType** A GUID that identifies the notification mechanism by which an error condition is reported to the operating system. +- **partitionId** A GUID that identifies the partition on which the hardware error occurred. +- **platformId** A GUID that identifies the platform on which the hardware error occurred. +- **record** A binary blob containing the full error record. Due to the nature of common platform error records we have no way of fully parsing this blob for any given record. +- **recordId** The identifier of the error record. This identifier is unique only on the system that created the error record. +- **sectionFlags** The flags for each section recorded in the error record. +- **sectionTypes** A GUID that represents the type of sections contained in the error record. +- **severityCount** The severity of each individual section. +- **timeStamp** Error time stamp as recorded in the error record. + + +### WheaProvider.WheaDriverErrorExternalNonCritical + +This event is sent when a common platform hardware error is recorded by an external WHEA error source driver. These records are for events that can happen at high rates. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **creatorId** A GUID that identifies the entity that created the error record. +- **errorFlags** Flags set on the error record. +- **notifyType** A GUID that identifies the notification mechanism by which an error condition is reported to the operating system. +- **partitionId** A GUID that identifies the partition on which the hardware error occurred. +- **platformId** A GUID that identifies the platform on which the hardware error occurred. +- **record** A binary blob containing the full error record. Due to the nature of common platform error records we have no way of fully parsing this blob for any given record. +- **recordId** The identifier of the error record. This identifier is unique only on the system that created the error record. +- **sectionFlags** The flags for each section recorded in the error record. +- **sectionTypes** A GUID that represents the type of sections contained in the error record. +- **severityCount** The severity of each individual section. +- **timeStamp** Error time stamp as recorded in the error record. + + +### WheaProvider.WheaDriverExternalLogginLimitReached + +This event indicates that WHEA has reached the logging limit for critical events from external drivers. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **timeStamp** Time at which the logging limit was reached. + + +### WheaProvider.WheaErrorRecord + +This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **creatorId** The unique identifier for the entity that created the error record. +- **errorFlags** Any flags set on the error record. +- **notifyType** The unique identifier for the notification mechanism which reported the error to the operating system. +- **partitionId** The unique identifier for the partition on which the hardware error occurred. +- **platformId** The unique identifier for the platform on which the hardware error occurred. +- **record** A collection of binary data containing the full error record. +- **recordId** The identifier of the error record. +- **sectionFlags** The flags for each section recorded in the error record. +- **sectionTypes** The unique identifier that represents the type of sections contained in the error record. +- **severityCount** The severity of each individual section. +- **timeStamp** The error time stamp as recorded in the error record. + + +## Windows Store events + +### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation + +This event is sent when an installation or update is canceled by a user or the system and is used to help keep Windows Apps up to date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** Number of retry attempts before it was canceled. +- **BundleId** The Item Bundle ID. +- **CategoryId** The Item Category ID. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed before this operation. +- **IsBundle** Is this a bundle? +- **IsInteractive** Was this requested by a user? +- **IsMandatory** Was this a mandatory update? +- **IsRemediation** Was this a remediation install? +- **IsRestore** Is this automatically restoring a previously acquired product? +- **IsUpdate** Flag indicating if this is an update. +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The product family name of the product being installed. +- **ProductId** The identity of the package or packages being installed. +- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled. +- **UserAttemptNumber** The total number of user attempts at installation before it was canceled. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense + +This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. +- **AttemptNumber** The total number of attempts to acquire this product. +- **BundleId** The bundle ID +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** HResult code to show the result of the operation (success/failure). +- **IsBundle** Is this a bundle? +- **IsInteractive** Did the user initiate the installation? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this happening after a device restore? +- **IsUpdate** Is this an update? +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). +- **PFN** Product Family Name of the product being installed. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The number of attempts by the system to acquire this product. +- **UserAttemptNumber** The number of attempts by the user to acquire this product +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndDownload + +This event is sent after an app is downloaded to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed. +- **AttemptNumber** Number of retry attempts before it was canceled. +- **BundleId** The identity of the Windows Insider build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **DownloadSize** The total size of the download. +- **ExtendedHResult** Any extended HResult error codes. +- **HResult** The result code of the last action performed. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this initiated by the user? +- **IsMandatory** Is this a mandatory installation? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this a restore of a previously acquired product? +- **IsUpdate** Is this an update? +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). +- **PFN** The Product Family Name of the app being download. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The number of attempts by the system to download. +- **UserAttemptNumber** The number of attempts by the user to download. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate + +This event is sent when an app update requires an updated Framework package and the process starts to download it. It is used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **HResult** The result code of the last action performed before this operation. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndInstall + +This event is sent after a product has been installed to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** The number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **ExtendedHResult** The extended HResult error code. +- **HResult** The result code of the last action performed. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this an interactive installation? +- **IsMandatory** Is this a mandatory installation? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this automatically restoring a previously acquired product? +- **IsUpdate** Is this an update? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** Product Family Name of the product being installed. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates + +This event is sent after a scan for product updates to determine if there are packages to install. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed. +- **IsApplicability** Is this request to only check if there are any applicable packages to install? +- **IsInteractive** Is this user requested? +- **IsOnline** Is the request doing an online check? + + +### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages + +This event is sent after searching for update packages to install. It is used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this user requested? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this restoring previously acquired content? +- **IsUpdate** Is this an update? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The name of the package or packages requested for install. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData + +This event is sent after restoring user data (if any) that needs to be restored following a product install. It is used to keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this user requested? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this restoring previously acquired content? +- **IsUpdate** Is this an update? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The name of the package or packages requested for install. +- **ProductId** The Store Product ID for the product being installed. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of system attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete + +This event is sent at the end of an app install or update to help keep Windows up-to-date and secure. + +The following fields are available: + +- **CatalogId** The name of the product catalog from which this app was chosen. +- **FailedRetry** Indicates whether the installation or update retry was successful. +- **HResult** The HResult code of the operation. +- **PFN** The Package Family Name of the app that is being installed or updated. +- **ProductId** The product ID of the app that is being updated or installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate + +This event is sent at the beginning of an app install or update to help keep Windows up-to-date and secure. + +The following fields are available: + +- **CatalogId** The name of the product catalog from which this app was chosen. +- **FulfillmentPluginId** The ID of the plugin needed to install the package type of the product. +- **PFN** The Package Family Name of the app that is being installed or updated. +- **PluginTelemetryData** Diagnostic information specific to the package-type plug-in. +- **ProductId** The product ID of the app that is being updated or installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest + +This event is sent when a product install or update is initiated, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **BundleId** The identity of the build associated with this product. +- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed. +- **ProductId** The Store Product ID for the product being installed. +- **SkuId** Specific edition ID being installed. +- **VolumePath** The disk path of the installation. + + +### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation + +This event is sent when a product install or update is paused (either by a user or the system), to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this user requested? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this restoring previously acquired content? +- **IsUpdate** Is this an update? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The Product Full Name. +- **PreviousHResult** The result code of the last action performed before this operation. +- **PreviousInstallState** Previous state before the installation or update was paused. +- **ProductId** The Store Product ID for the product being installed. +- **RelatedCV** Correlation Vector of a previous performed action on this product. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation + +This event is sent when a product install or update is resumed (either by a user or the system), to help keep Windows up-to-date and secure. + +The following fields are available: + +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **AttemptNumber** The number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed before this operation. +- **IsBundle** Is this a bundle? +- **IsInteractive** Is this user requested? +- **IsMandatory** Is this a mandatory update? +- **IsRemediation** Is this repairing a previous installation? +- **IsRestore** Is this restoring previously acquired content? +- **IsUpdate** Is this an update? +- **IsUserRetry** Did the user initiate the retry? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **PFN** The name of the package or packages requested for install. +- **PreviousHResult** The previous HResult error code. +- **PreviousInstallState** Previous state before the installation was paused. +- **ProductId** The Store Product ID for the product being installed. +- **RelatedCV** Correlation Vector for the original install before it was resumed. +- **ResumeClientId** The ID of the app that initiated the resume operation. +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **WUContentId** The Windows Update content ID. + + +### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest + +This event is sent when a product install or update is resumed by a user or on installation retries, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ProductId** The Store Product ID for the product being installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest + +This event is sent when searching for update packages to install, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **CatalogId** The Store Catalog ID for the product being installed. +- **ProductId** The Store Product ID for the product being installed. +- **SkuId** Specfic edition of the app being updated. + + +### Microsoft.Windows.StoreAgent.Telemetry.StateTransition + +Products in the process of being fulfilled (installed or updated) are maintained in a list. This event is sent any time there is a change in a product's fulfillment status (pending, working, paused, cancelled, or complete), to help keep Windows up to date and secure. + +The following fields are available: + +- **CatalogId** The ID for the product being installed if the product is from a private catalog, such as the Enterprise catalog. +- **FulfillmentPluginId** The ID of the plugin needed to install the package type of the product. +- **HResult** The resulting HResult error/success code of this operation. +- **NewState** The current fulfillment state of this product. +- **PFN** The Package Family Name of the app that is being installed or updated. +- **PluginLastStage** The most recent product fulfillment step that the plug-in has reported (different than its state). +- **PluginTelemetryData** Diagnostic information specific to the package-type plug-in. +- **Prevstate** The previous fulfillment state of this product. +- **ProductId** Product ID of the app that is being updated or installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest + +This event occurs when an update is requested for an app, to help keep Windows up-to-date and secure. + +The following fields are available: + +- **PFamN** The name of the app that is requested for update. + + +## Windows Update CSP events + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed + +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** This is the device info. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable + +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Represents the device info. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted + +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Device in the semi-annual channel. +- **wUfBConnected** Result of WUfB connection check. + + +## Windows Update Delivery Optimization events + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled + +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **background** Is the download being done in the background? +- **bytesFromCacheServer** Bytes received from a cache host. +- **bytesFromCDN** The number of bytes received from a CDN source. +- **bytesFromGroupPeers** The number of bytes received from a peer in the same group. +- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group. +- **bytesFromLinkLocalPeers** The number of bytes received from local peers. +- **bytesFromLocalCache** Bytes copied over from local (on disk) cache. +- **bytesFromPeers** The number of bytes received from a peer in the same LAN. +- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event. +- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered. +- **cdnIp** The IP Address of the source CDN (Content Delivery Network). +- **cdnUrl** The URL of the source CDN (Content Delivery Network). +- **dataSourcesTotal** Bytes received per source type, accumulated for the whole session. +- **errorCode** The error code that was returned. +- **experimentId** When running a test, this is used to correlate events that are part of the same test. +- **fileID** The ID of the file being downloaded. +- **isVpn** Is the device connected to a Virtual Private Network? +- **jobID** Identifier for the Windows Update job. +- **predefinedCallerName** The name of the API Caller. +- **reasonCode** Reason the action or event occurred. +- **routeToCacheServer** The cache server setting, source, and value. +- **sessionID** The ID of the file download session. +- **updateID** The ID of the update being downloaded. + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted + +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **background** Is the download a background download? +- **bytesFromCacheServer** Bytes received from a cache host. +- **bytesFromCDN** The number of bytes received from a CDN source. +- **bytesFromGroupPeers** The number of bytes received from a peer in the same domain group. +- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group. +- **bytesFromLinkLocalPeers** The number of bytes received from local peers. +- **bytesFromLocalCache** Bytes copied over from local (on disk) cache. +- **bytesFromPeers** The number of bytes received from a peer in the same LAN. +- **bytesRequested** The total number of bytes requested for download. +- **cacheServerConnectionCount** Number of connections made to cache hosts. +- **cdnConnectionCount** The total number of connections made to the CDN. +- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event. +- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered. +- **cdnIp** The IP address of the source CDN. +- **cdnUrl** Url of the source Content Distribution Network (CDN). +- **congestionPrevention** Indicates a download may have been suspended to prevent network congestion. +- **dataSourcesTotal** Bytes received per source type, accumulated for the whole session. +- **downlinkBps** The maximum measured available download bandwidth (in bytes per second). +- **downlinkUsageBps** The download speed (in bytes per second). +- **downloadMode** The download mode used for this file download session. +- **downloadModeReason** Reason for the download. +- **downloadModeSrc** Source of the DownloadMode setting. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **expiresAt** The time when the content will expire from the Delivery Optimization Cache. +- **fileID** The ID of the file being downloaded. +- **fileSize** The size of the file being downloaded. +- **groupConnectionCount** The total number of connections made to peers in the same group. +- **groupID** A GUID representing a custom group of devices. +- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group. +- **isEncrypted** TRUE if the file is encrypted and will be decrypted after download. +- **isThrottled** Event Rate throttled (event represents aggregated data). +- **isVpn** Is the device connected to a Virtual Private Network? +- **jobID** Identifier for the Windows Update job. +- **lanConnectionCount** The total number of connections made to peers in the same LAN. +- **linkLocalConnectionCount** The number of connections made to peers in the same Link-local network. +- **numPeers** The total number of peers used for this download. +- **numPeersLocal** The total number of local peers used for this download. +- **predefinedCallerName** The name of the API Caller. +- **restrictedUpload** Is the upload restricted? +- **routeToCacheServer** The cache server setting, source, and value. +- **sessionID** The ID of the download session. +- **totalTimeMs** Duration of the download (in seconds). +- **updateID** The ID of the update being downloaded. +- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second). +- **uplinkUsageBps** The upload speed (in bytes per second). + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadHungItself + +This event sends data describing a download that has become unexpectedly stuck to enable Delivery Optimization to understand and address problems regarding downloads. + +The following fields are available: + +- **background** Indicates if the download is happening in the background. +- **cdnIp** Indicates the IP Address of the source CDN. +- **cdnUrl** Represents the URL of the source CDN. +- **errorCode** Indicates the error code returned. +- **experimentId** Used to correlate client/services calls that are part of the same test during A/B testing. +- **fileID** Represents the ID of the file being downloaded. +- **isVpn** Indicates if the machine is connected to a Virtual Private Network. +- **jobID** Identifier for the Windows Update Job. +- **predefinedCallerName** Represents the name of the API Caller. +- **progressPercent** Indicates the percent of download completed. +- **sessionID** Indicates the ID for the file download session. +- **updateID** Represents the ID of the update being downloaded. + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused + +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **background** Is the download a background download? +- **cdnUrl** The URL of the source CDN (Content Delivery Network). +- **errorCode** The error code that was returned. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **fileID** The ID of the file being paused. +- **isVpn** Is the device connected to a Virtual Private Network? +- **jobID** Identifier for the Windows Update job. +- **predefinedCallerName** The name of the API Caller object. +- **reasonCode** The reason for pausing the download. +- **routeToCacheServer** The cache server setting, source, and value. +- **sessionID** The ID of the download session. +- **updateID** The ID of the update being paused. + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted + +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **background** Indicates whether the download is happening in the background. +- **bytesRequested** Number of bytes requested for the download. +- **cdnUrl** The URL of the source Content Distribution Network (CDN). +- **costFlags** A set of flags representing network cost. +- **deviceProfile** Identifies the usage or form factor (such as Desktop, Xbox, or VM). +- **diceRoll** Random number used for determining if a client will use peering. +- **doClientVersion** The version of the Delivery Optimization client. +- **downloadMode** The download mode used for this file download session (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100). +- **downloadModeReason** Reason for the download. +- **downloadModeSrc** Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9). +- **errorCode** The error code that was returned. +- **experimentId** ID used to correlate client/services calls that are part of the same test during A/B testing. +- **fileID** The ID of the file being downloaded. +- **filePath** The path to where the downloaded file will be written. +- **fileSize** Total file size of the file that was downloaded. +- **fileSizeCaller** Value for total file size provided by our caller. +- **groupID** ID for the group. +- **isEncrypted** Indicates whether the download is encrypted. +- **isThrottled** Indicates the Event Rate was throttled (event represent aggregated data). +- **isVpn** Indicates whether the device is connected to a Virtual Private Network. +- **jobID** The ID of the Windows Update job. +- **peerID** The ID for this delivery optimization client. +- **predefinedCallerName** Name of the API caller. +- **routeToCacheServer** Cache server setting, source, and value. +- **sessionID** The ID for the file download session. +- **setConfigs** A JSON representation of the configurations that have been set, and their sources. +- **updateID** The ID of the update being downloaded. + + +### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication + +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **cdnHeaders** The HTTP headers returned by the CDN. +- **cdnIp** The IP address of the CDN. +- **cdnUrl** The URL of the CDN. +- **errorCode** The error code that was returned. +- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **fileID** The ID of the file being downloaded. +- **httpStatusCode** The HTTP status code returned by the CDN. +- **isHeadRequest** The type of HTTP request that was sent to the CDN. Example: HEAD or GET +- **peerType** The type of peer (LAN, Group, Internet, CDN, Cache Host, etc.). +- **requestOffset** The byte offset within the file in the sent request. +- **requestSize** The size of the range requested from the CDN. +- **responseSize** The size of the range response received from the CDN. +- **sessionID** The ID of the download session. + + +### Microsoft.OSG.DU.DeliveryOptClient.JobError + +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **cdnIp** The IP Address of the source CDN (Content Delivery Network). +- **doErrorCode** Error code returned for delivery optimization. +- **errorCode** The error code returned. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **fileID** The ID of the file being downloaded. +- **jobID** The Windows Update job ID. +- **predefinedCallerName** Name of the API Caller. + + +## Windows Update events + +### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationStarted + +This event sends data collected at the beginning of the Data Migration Framework (DMF) and parameters involved in its invocation, to help keep Windows up to date. + +The following fields are available: + +- **MigrationMicrosoftPhases** The number of Microsoft-authored migrators scheduled to be ran by DMF for this upgrade +- **MigrationOEMPhases** The number of OEM-authored migrators scheduled to be ran by DMF for this upgrade +- **MigrationStartTime** The timestamp representing the beginning of the DMF migration +- **WuClientId** The GUID of the Windows Update client invoking DMF + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary + +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activated** Whether the entire device manifest update is considered activated and in use. +- **analysisErrorCount** The number of driver packages that could not be analyzed because errors occurred during analysis. +- **flightId** Unique ID for each flight. +- **missingDriverCount** The number of driver packages delivered by the device manifest that are missing from the system. +- **missingUpdateCount** The number of updates in the device manifest that are missing from the system. +- **objectId** Unique value for each diagnostics session. +- **publishedCount** The number of drivers packages delivered by the device manifest that are published and available to be used on devices. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **scenarioId** Indicates the update scenario. +- **sessionId** Unique value for each update session. +- **summary** A summary string that contains basic information about driver packages that are part of the device manifest and any devices on the system that those driver packages match. +- **summaryAppendError** A Boolean indicating if there was an error appending more information to the summary string. +- **truncatedDeviceCount** The number of devices missing from the summary string because there is not enough room in the string. +- **truncatedDriverCount** The number of driver packages missing from the summary string because there is not enough room in the string. +- **unpublishedCount** How many drivers packages that were delivered by the device manifest that are still unpublished and unavailable to be used on devices. +- **updateId** The unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest + +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **deletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted. +- **errorCode** The error code returned for the current session initialization. +- **flightId** The unique identifier for each flight. +- **objectId** Unique value for each Update Agent mode. +- **packageCountOptional** Number of optional packages requested. +- **packageCountRequired** Number of required packages requested. +- **packageCountTotal** Total number of packages needed. +- **packageCountTotalCanonical** Total number of canonical packages. +- **packageCountTotalDiff** Total number of diff packages. +- **packageCountTotalExpress** Total number of express packages. +- **packageSizeCanonical** Size of canonical packages in bytes. +- **packageSizeDiff** Size of diff packages in bytes. +- **packageSizeExpress** Size of express packages in bytes. +- **rangeRequestState** Represents the state of the download range request. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Result of the download request phase of update. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize + +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The error code returned for the current session initialization. +- **flightId** The unique identifier for each flight. +- **flightMetadata** Contains the FlightId and the build being flighted. +- **objectId** Unique value for each Update Agent mode. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Result of the initialize phase of the update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios). +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique ID for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall + +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The error code returned for the current install phase. +- **flightId** The unique identifier for each flight. +- **objectId** The unique identifier for each diagnostics session. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **result** Outcome of the install phase of the update. +- **scenarioId** The unique identifier for the update scenario. +- **sessionId** The unique identifier for each update session. +- **updateId** The unique identifier for each update. + + +### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart + +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **flightId** The unique identifier for each flight. +- **mode** The mode that is starting. +- **objectId** The unique value for each diagnostics session. +- **relatedCV** Correlation vector value generated from the latest USO scan. +- **scenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. +- **sessionId** Unique value for each Update Agent mode attempt. +- **updateId** Unique identifier for each update. + + +### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed + +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AcceptAutoModeLimit** The maximum number of days for a device to automatically enter Auto Reboot mode. +- **AutoToAutoFailedLimit** The maximum number of days for Auto Reboot mode to fail before the RebootFailed dialog box is shown. +- **DaysSinceRebootRequired** Number of days since restart was required. +- **DeviceLocalTime** The local time on the device sending the event. +- **EngagedModeLimit** The number of days to switch between DTE dialog boxes. +- **EnterAutoModeLimit** The maximum number of days for a device to enter Auto Reboot mode. +- **ETag** OneSettings versioning value. +- **IsForcedEnabled** Indicates whether Forced Reboot mode is enabled for this device. +- **IsUltimateForcedEnabled** Indicates whether Ultimate Forced Reboot mode is enabled for this device. +- **NotificationUxState** Indicates which dialog box is shown. +- **NotificationUxStateString** Indicates which dialog box is shown. +- **RebootUxState** Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced). +- **RebootUxStateString** Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced). +- **RebootVersion** Version of DTE. +- **SkipToAutoModeLimit** The minimum length of time to pass in restart pending before a device can be put into auto mode. +- **UpdateId** The ID of the update that is pending restart to finish installation. +- **UpdateRevision** The revision of the update that is pending restart to finish installation. +- **UtcTime** The time the dialog box notification will be displayed, in Coordinated Universal Time. + + +### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog + +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceLocalTime** The local time on the device sending the event. +- **EnterpriseAttributionValue** Indicates whether the Enterprise attribution is on in this dialog box. +- **ETag** OneSettings versioning value. +- **ExitCode** Indicates how users exited the dialog box. +- **RebootVersion** Version of DTE. +- **UpdateId** The ID of the update that is pending restart to finish installation. +- **UpdateRevision** The revision of the update that is pending restart to finish installation. +- **UserResponseString** The option that user chose on this dialog box. +- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time. + + +### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog + +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceLocalTime** The local time of the device sending the event. +- **EnterpriseAttributionValue** Indicates whether the Enterprise attribution is on in this dialog box. +- **ETag** OneSettings versioning value. +- **ExitCode** Indicates how users exited the dialog box. +- **RebootVersion** Version of DTE. +- **UpdateId** The ID of the update that is pending restart to finish installation. +- **UpdateRevision** The revision of the update that is pending restart to finish installation. +- **UserResponseString** The option that the user chose in this dialog box. +- **UtcTime** The time that the dialog box was displayed, in Coordinated Universal Time. + + +### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog + +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceLocalTime** Time the dialog box was shown on the local device. +- **EnterpriseAttributionValue** Indicates whether the Enterprise attribution is on in this dialog box. +- **ETag** OneSettings versioning value. +- **ExitCode** Indicates how users exited the dialog box. +- **RebootVersion** Version of DTE. +- **UpdateId** The ID of the update that is pending restart to finish installation. +- **UpdateRevision** The revision of the update that is pending restart to finish installation. +- **UserResponseString** The option that user chose in this dialog box. +- **UtcTime** The time that dialog box was displayed, in Coordinated Universal Time. + + +### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog + +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **DeviceLocalTime** The time at which the reboot reminder dialog was shown (based on the local device time settings). +- **EnterpriseAttributionValue** Indicates whether Enterprise attribution is on for this dialog. +- **ETag** The OneSettings versioning value. +- **ExitCode** Indicates how users exited the reboot reminder dialog box. +- **RebootVersion** The version of the DTE (Direct-to-Engaged). +- **UpdateId** The ID of the update that is waiting for reboot to finish installation. +- **UpdateRevision** The revision of the update that is waiting for reboot to finish installation. +- **UserResponseString** The option chosen by the user on the reboot dialog box. +- **UtcTime** The time at which the reboot reminder dialog was shown (in UTC). + + +### Microsoft.Windows.Update.NotificationUx.RebootScheduled + +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. + +The following fields are available: + +- **activeHoursApplicable** Indicates whether an Active Hours policy is present on the device. +- **IsEnhancedEngagedReboot** Indicates whether this is an Enhanced Engaged reboot. +- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action. +- **rebootOutsideOfActiveHours** Indicates whether a restart is scheduled outside of active hours. +- **rebootScheduledByUser** Indicates whether the restart was scheduled by user (if not, it was scheduled automatically). +- **rebootState** The current state of the restart. +- **rebootUsingSmartScheduler** Indicates whether the reboot is scheduled by smart scheduler. +- **revisionNumber** Revision number of the update that is getting installed with this restart. +- **scheduledRebootTime** Time of the scheduled restart. +- **scheduledRebootTimeInUTC** Time of the scheduled restart in Coordinated Universal Time. +- **updateId** ID of the update that is getting installed with this restart. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + +### Microsoft.Windows.Update.Orchestrator.DeferRestart + +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **displayNeededReason** List of reasons for needing display. +- **eventScenario** Indicates the purpose of the event (scan started, succeeded, failed, etc.). +- **filteredDeferReason** Applicable filtered reasons why reboot was postponed (such as user active, or low battery). +- **gameModeReason** Name of the executable that caused the game mode state check to start. +- **ignoredReason** List of reasons that were intentionally ignored. +- **IgnoreReasonsForRestart** List of reasons why restart was deferred. +- **revisionNumber** Update ID revision number. +- **systemNeededReason** List of reasons why system is needed. +- **updateId** Update ID. +- **updateScenarioType** Update session type. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.DetectionActivity + +This event returns data about detected updates, as well as the types of update (optional or recommended). This data helps keep Windows up to date. + +The following fields are available: + +- **applicableUpdateIdList** The list of update identifiers. +- **applicableUpdateList** The list of available updates. +- **durationInSeconds** The amount of time (in seconds) it took for the event to run. +- **expeditedMode** Indicates whether Expedited Mode is on. +- **scanTriggerSource** Indicates whether the scan is Interactive or Background. +- **scenario** The result code of the event. +- **scenarioReason** The reason for the result code (scenario). +- **seekerUpdateIdList** The list of “seeker” update identifiers. +- **seekerUpdateList** The list of “seeker” updates. +- **services** The list of services that were called during update. +- **wilActivity** The activity results. See [wilActivity](#wilactivity). + + +### Microsoft.Windows.Update.Orchestrator.DisplayNeeded + +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **displayNeededReason** Reason the display is needed. +- **eventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours. +- **revisionNumber** Revision number of the update. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated. +- **wuDeviceid** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue + + +### Microsoft.Windows.Update.Orchestrator.Download + +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. + +The following fields are available: + +- **deferReason** Reason for download not completing. +- **errorCode** An error code represented as a hexadecimal value. +- **eventScenario** End-to-end update session ID. +- **flightID** The specific ID of the Windows Insider build the device is getting. +- **interactive** Indicates whether the session is user initiated. +- **revisionNumber** Update revision number. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask + +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **errorCode** The Windows Update error code. +- **wuDeviceid** The Windows Update device ID. + + +### Microsoft.Windows.Update.Orchestrator.FlightInapplicable + +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** Time when this event was generated. +- **flightID** The specific ID of the Windows Insider build. +- **inapplicableReason** The reason why the update is inapplicable. +- **revisionNumber** Update revision number. +- **updateId** Unique Windows Update ID. +- **updateScenarioType** Update session type. +- **UpdateStatus** Last status of update. +- **UUPFallBackConfigured** Indicates whether UUP fallback is configured. +- **wuDeviceid** Unique Device ID. + + +### Microsoft.Windows.Update.Orchestrator.InitiatingReboot + +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** Time of the event. +- **flightID** Unique update ID +- **interactive** Indicates whether the reboot initiation stage of the update process was entered as a result of user action. +- **rebootOutsideOfActiveHours** Indicates whether the reboot was to occur outside of active hours. +- **revisionNumber** Revision number of the update. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.Install + +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** Current battery capacity in mWh or percentage left. +- **deferReason** Reason for install not completing. +- **errorCode** The error code reppresented by a hexadecimal value. +- **eventScenario** End-to-end update session ID. +- **flightID** The ID of the Windows Insider build the device is getting. +- **IgnoreReasonsForRestart** The reason(s) a Postpone Restart command was ignored. +- **interactive** Identifies if session is user initiated. +- **rebootOutsideOfActiveHours** Indicates whether a reboot is scheduled outside of active hours. +- **revisionNumber** Update revision number. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.RebootFailed + +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** Current battery capacity in mWh or percentage left. +- **deferReason** Reason for install not completing. +- **EventPublishedTime** The time that the reboot failure occurred. +- **flightID** Unique update ID. +- **rebootOutsideOfActiveHours** Indicates whether a reboot was scheduled outside of active hours. +- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code. +- **revisionNumber** Update revision number. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.RefreshSettings + +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. + + + +### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask + +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. + +The following fields are available: + +- **RebootTaskNextTimeUTC** The time when the reboot task was rescheduled for. +- **RebootTaskRestoredTime** Time at which this reboot task was restored. +- **wuDeviceid** Device ID for the device on which the reboot is restored. + + +### Microsoft.Windows.Update.Orchestrator.ScanTriggered + +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **interactive** Indicates whether the scan is interactive. +- **isDTUEnabled** Indicates whether DTU (internal abbreviation for Direct Feature Update) channel is enabled on the client system. +- **isScanPastSla** Indicates whether the SLA has elapsed for scanning. +- **isScanPastTriggerSla** Indicates whether the SLA has elapsed for triggering a scan. +- **minutesOverScanSla** Indicates how many minutes the scan exceeded the scan SLA. +- **minutesOverScanTriggerSla** Indicates how many minutes the scan exceeded the scan trigger SLA. +- **scanTriggerSource** Indicates what caused the scan. +- **updateScenarioType** The update session type. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.StickUpdate + +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateId** Identifier associated with the specific piece of content. +- **wuDeviceid** Unique device ID controlled by the software distribution client. + + +### Microsoft.Windows.Update.Orchestrator.SystemNeeded + +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. + +The following fields are available: + +- **eventScenario** End-to-end update session ID. +- **rebootOutsideOfActiveHours** Indicates whether a reboot is scheduled outside of active hours. +- **revisionNumber** Update revision number. +- **systemNeededReason** List of apps or tasks that are preventing the system from restarting. +- **updateId** Update ID. +- **updateScenarioType** The update session type. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorInvalidSignature + +This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updaterCmdLine** The callback executable for the updater. +- **updaterId** The ID of the updater. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkInvalidCmd + +This event indicates a critical error with the callback binary requested by the updater. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updaterCmdLine** The command line requested by the updater. +- **updaterId** The ID of the updater that requested the work. +- **wuDeviceid** WU device ID. + + +### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkNonSystem + +This event ensures that only callers with system or admin privileges are allowed to schedule work through Windows Update Universal Orchestrator. The data collected with this event is used to help keep Windows product and service secure. + +The following fields are available: + +- **updaterCmdLine** Updater Command Line. +- **updaterId** Updater ID. +- **wuDeviceid** Device ID. + + +### Microsoft.Windows.Update.Orchestrator.UnstickUpdate + +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateId** Identifier associated with the specific piece of content. +- **wuDeviceid** Unique device ID controlled by the software distribution client. + + +### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState + +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **AcceptAutoModeLimit** The maximum number of days for a device to automatically enter Auto Reboot mode. +- **AutoToAutoFailedLimit** The maximum number of days for Auto Reboot mode to fail before a Reboot Failed dialog will be shown. +- **DeviceLocalTime** The date and time (based on the device date/time settings) the reboot mode changed. +- **EngagedModeLimit** The number of days to switch between DTE (Direct-to-Engaged) dialogs. +- **EnterAutoModeLimit** The maximum number of days a device can enter Auto Reboot mode. +- **ETag** The Entity Tag that represents the OneSettings version. +- **IsForcedEnabled** Identifies whether Forced Reboot mode is enabled for the device. +- **IsUltimateForcedEnabled** Identifies whether Ultimate Forced Reboot mode is enabled for the device. +- **OldestUpdateLocalTime** The date and time (based on the device date/time settings) this update’s reboot began pending. +- **RebootUxState** Identifies the reboot state: Engaged, Auto, Forced, UltimateForced. +- **RebootVersion** The version of the DTE (Direct-to-Engaged). +- **SkipToAutoModeLimit** The maximum number of days to switch to start while in Auto Reboot mode. +- **UpdateId** The ID of the update that is waiting for reboot to finish installation. +- **UpdateRevision** The revision of the update that is waiting for reboot to finish installation. + + +### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded + +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **UtcTime** The Coordinated Universal Time that the restart was no longer needed. + + +### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled + +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. + +The following fields are available: + +- **activeHoursApplicable** Indicates whether Active Hours applies on this device. +- **IsEnhancedEngagedReboot** Indicates whether Enhanced reboot was enabled. +- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action. +- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise. +- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically. +- **rebootState** Current state of the reboot. +- **rebootUsingSmartScheduler** Indicates that the reboot is scheduled by SmartScheduler. +- **revisionNumber** Revision number of the OS. +- **scheduledRebootTime** Time scheduled for the reboot. +- **scheduledRebootTimeInUTC** Time scheduled for the reboot, in UTC. +- **updateId** Identifies which update is being scheduled. +- **wuDeviceid** The unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled + +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activeHoursApplicable** Is the restart respecting Active Hours? +- **IsEnhancedEngagedReboot** TRUE if the reboot path is Enhanced Engaged. Otherwise, FALSE. +- **rebootArgument** The arguments that are passed to the OS for the restarted. +- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours? +- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device. +- **rebootState** The state of the restart. +- **rebootUsingSmartScheduler** TRUE if the reboot should be performed by the Smart Scheduler. Otherwise, FALSE. +- **revisionNumber** The revision number of the OS being updated. +- **scheduledRebootTime** Time of the scheduled reboot +- **scheduledRebootTimeInUTC** Time of the scheduled restart, in Coordinated Universal Time. +- **updateId** The Windows Update device GUID. +- **wuDeviceid** The Windows Update device GUID. + + +### Microsoft.Windows.Update.Ux.NotifyIcon.RebootScheduled + +This event is reported when user schedules restart. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **activeHoursApplicable** Indicates if active hours are applicable. +- **IsEnhancedEngagedReboot** Indicates if enhanced engaged restarts applies. +- **rebootArgument** Represents reboot argument. +- **rebootOutsideOfActiveHours** Reboot outside of active hours. +- **rebootScheduledByUser** Restart scheduled by the user. +- **rebootState** Indicates reboot state. +- **rebootUsingSmartScheduler** Reboot using Smart Scheduler. +- **revisionNumber** Represents the revision number. +- **scheduledRebootTime** Indicates scheduled reboot time. +- **scheduledRebootTimeInUTC** Indicates scheduled reboot time in UTC. +- **updateId** Represents update ID. +- **wuDeviceid** Represents device ID. + + +## Windows Update mitigation events + +### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages + +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** The client ID used by Windows Update. +- **FlightId** The ID of each Windows Insider build the device received. +- **InstanceId** A unique device ID that identifies each update instance. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **MountedImageCount** The number of mounted images. +- **MountedImageMatches** The number of mounted image matches. +- **MountedImagesFailed** The number of mounted images that could not be removed. +- **MountedImagesRemoved** The number of mounted images that were successfully removed. +- **MountedImagesSkipped** The number of mounted images that were not found. +- **RelatedCV** The correlation vector value generated from the latest USO scan. +- **Result** HResult of this operation. +- **ScenarioId** ID indicating the mitigation scenario. +- **ScenarioSupported** Indicates whether the scenario was supported. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each Windows Update. +- **WuId** Unique ID for the Windows Update client. + + +### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints + +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **ReparsePointsFailed** Number of reparse points that are corrupted but we failed to fix them. +- **ReparsePointsFixed** Number of reparse points that were corrupted and were fixed by this mitigation. +- **ReparsePointsSkipped** Number of reparse points that are not corrupted and no action is required. +- **Result** HResult of this operation. +- **ScenarioId** ID indicating the mitigation scenario. +- **ScenarioSupported** Indicates whether the scenario was supported. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each Update. +- **WuId** Unique ID for the Windows Update client. + +### wilActivity + +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **callContext** The function where the failure occurred. +- **currentContextId** The ID of the current call context where the failure occurred. +- **currentContextMessage** The message of the current call context where the failure occurred. +- **currentContextName** The name of the current call context where the failure occurred. +- **failureCount** The number of failures for this failure ID. +- **failureId** The ID of the failure that occurred. +- **failureType** The type of the failure that occurred. +- **fileName** The file name where the failure occurred. +- **function** The function where the failure occurred. +- **hresult** The HResult of the overall activity. +- **lineNumber** The line number where the failure occurred. +- **message** The message of the failure that occurred. +- **module** The module where the failure occurred. +- **originatingContextId** The ID of the originating call context that resulted in the failure. +- **originatingContextMessage** The message of the originating call context that resulted in the failure. +- **originatingContextName** The name of the originating call context that resulted in the failure. +- **threadId** The ID of the thread on which the activity is executing. + +## Windows Update Reserve Manager events + +### Microsoft.Windows.UpdateReserveManager.BeginScenario + +This event is sent when the Update Reserve Manager is called to begin a scenario. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Flags** The flags that are passed to the begin scenario function. +- **HardReserveSize** The size of the hard reserve. +- **HardReserveUsedSpace** The used space in the hard reserve. +- **OwningScenarioId** The scenario ID the client that called the begin scenario function. +- **ReturnCode** The return code for the begin scenario operation. +- **ScenarioId** The scenario ID that is internal to the reserve manager. +- **SoftReserveSize** The size of the soft reserve. +- **SoftReserveUsedSpace** The amount of soft reserve space that was used. + + +### Microsoft.Windows.UpdateReserveManager.ClearReserve + +This event is sent when the Update Reserve Manager clears one of the reserves. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FinalReserveUsedSpace** The amount of used space for the reserve after it was cleared. +- **InitialReserveUsedSpace** The amount of used space for the reserve before it was cleared. +- **ReserveId** The ID of the reserve that needs to be cleared. + + +### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment + +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FinalAdjustment** Final adjustment for the hard reserve following the addition or removal of optional content. +- **InitialAdjustment** Initial intended adjustment for the hard reserve following the addition or removal of optional content. + + +### Microsoft.Windows.UpdateReserveManager.EndScenario + +This event is sent when the Update Reserve Manager ends an active scenario. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ActiveScenario** The current active scenario. +- **Flags** The flags passed to the end scenario call. +- **HardReserveSize** The size of the hard reserve when the end scenario is called. +- **HardReserveUsedSpace** The used space in the hard reserve when the end scenario is called. +- **ReturnCode** The return code of this operation. +- **ScenarioId** The ID of the internal reserve manager scenario. +- **SoftReserveSize** The size of the soft reserve when end scenario is called. +- **SoftReserveUsedSpace** The amount of the soft reserve used when end scenario is called. + + +### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError + +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FailedExpression** The failed expression that was returned. +- **FailedFile** The binary file that contained the failed function. +- **FailedFunction** The name of the function that originated the failure. +- **FailedLine** The line number of the failure. +- **ReturnCode** The return code of the function. + + +### Microsoft.Windows.UpdateReserveManager.InitializeReserves + +This event is sent when reserves are initialized on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FallbackInitUsed** Indicates whether fallback initialization is used. +- **FinalUserFreeSpace** The amount of user free space after initialization. +- **Flags** The flags used in the initialization of Update Reserve Manager. +- **FreeSpaceToLeaveInUpdateScratch** The amount of space that should be left free after using the reserves. +- **HardReserveFinalSize** The final size of the hard reserve. +- **HardReserveFinalUsedSpace** The used space in the hard reserve. +- **HardReserveInitialSize** The size of the hard reserve after initialization. +- **HardReserveInitialUsedSpace** The utilization of the hard reserve after initialization. +- **HardReserveTargetSize** The target size that was set for the hard reserve. +- **InitialUserFreeSpace** The user free space during initialization. +- **PostUpgradeFreeSpace** The free space value passed into the Update Reserve Manager to determine reserve sizing post upgrade. +- **SoftReserveFinalSize** The final size of the soft reserve. +- **SoftReserveFinalUsedSpace** The used space in the soft reserve. +- **SoftReserveInitialSize** The soft reserve size after initialization. +- **SoftReserveInitialUsedSpace** The utilization of the soft reserve after initialization. +- **SoftReserveTargetSize** The target size that was set for the soft reserve. +- **TargetUserFreeSpace** The target user free space that was passed into the reserve manager to determine reserve sizing post upgrade. +- **UpdateScratchFinalUsedSpace** The used space in the scratch reserve. +- **UpdateScratchInitialUsedSpace** The utilization of the scratch reserve after initialization. +- **UpdateScratchReserveFinalSize** The utilization of the scratch reserve after initialization. +- **UpdateScratchReserveInitialSize** The size of the scratch reserve after initialization. + + +### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager + +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** The ID of the caller application. +- **Flags** The enumerated flags used to initialize the manager. +- **FlightId** The flight ID of the content the calling client is currently operating with. +- **Offline** Indicates whether or the reserve manager is called during offline operations. +- **PolicyPassed** Indicates whether the machine is able to use reserves. +- **ReturnCode** Return code of the operation. +- **Version** The version of the Update Reserve Manager. + + +### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization + +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **FallbackLogicUsed** Indicates whether fallback logic was used for initialization. +- **Flags** The flags that are passed to the function to prepare the Trusted Installer for reserve initialization. + + +### Microsoft.Windows.UpdateReserveManager.ReevaluatePolicy + +This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **PolicyChanged** Indicates whether the policy has changed. +- **PolicyFailedEnum** The reason why the policy failed. +- **PolicyPassed** Indicates whether the policy passed. + + +### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment + +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateReserveManager.TurnOffReserves + +This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **Flags** Flags used in the turn off reserves function. +- **HardReserveSize** The size of the hard reserve when Turn Off is called. +- **HardReserveUsedSpace** The amount of space used by the hard reserve when Turn Off is called +- **ScratchReserveSize** The size of the scratch reserve when Turn Off is called. +- **ScratchReserveUsedSpace** The amount of space used by the scratch reserve when Turn Off is called. +- **SoftReserveSize** The size of the soft reserve when Turn Off is called. +- **SoftReserveUsedSpace** The amount of the soft reserve used when Turn Off is called. + + +### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment + +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ChangeSize** The change in the hard reserve size based on the addition or removal of optional content. +- **Disposition** The parameter for the hard reserve adjustment function. +- **Flags** The flags passed to the hard reserve adjustment function. +- **PendingHardReserveAdjustment** The final change to the hard reserve size. +- **UpdateType** Indicates whether the change is an increase or decrease in the size of the hard reserve. + + +## Winlogon events + +### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon + +This event signals the completion of the setup process. It happens only once during the first logon. + +## XDE events + +### Microsoft.Emulator.Xde.RunTime.SystemReady + +This event sends basic information on the XDE application to understand and address performance issues relating to the emulator startup. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **timeTakenMilliseconds** Time in milliseconds it took to be ready for user interaction. +- **usingSnapshot** True if using a snapshot. + + +### Microsoft.Emulator.Xde.RunTime.XdeStarted + +This event sends basic information regarding the XDE process to address problems with emulator start. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **addUserToHyperVAdmins** True if user added to Hyper-V admin group. +- **addUserToPerformanceLogUsersGroup** True if user added to performance group. +- **automateFeatures** True if automation is being used. +- **bootLanguage** Boot language for guest. +- **bootToSnapshot** True if should attempt to boot to snapshot. +- **com1PipeName** COM1 pipe name. +- **com2PipeName** COM2 pipe name. +- **diffDiskVhd** Diff disk name. +- **displayName** Display name. +- **fastShutdown** True if should try to shutdown quickly. +- **gpuDisabled** True if GPU is disabled. +- **language** Language to use for UI. +- **memSize** Memory size. +- **natDisabled** True if NAT is to be disabled. +- **noStart** True if VM shouldn't be started. +- **originalVideoResolution** Original video resolution. +- **remoteFxDisabled** Disable GPU. +- **screenDiagonalSize** Screen diagonal size. +- **sensorsEnabled** Sensors to enable in guest. +- **showName** True if display name should appear on UI. +- **showUsage** True if usage was shown. +- **silentSnapshot** True if a silent snapshot was taken. +- **silentUi** True if message boxes should be suppressed. +- **sku** The emulator sku to use +- **startedBy** The program that started the emulator. +- **version** Emulator version. +- **versionLong** Long format of emulator version. +- **vhdPath** VHD path. +- **videoResolution** Video resolution to use. +- **virtualMachineName** VM name. +- **waitForClientConnection** True if we should wait for client connection. +- **wp81NetworkStackDisabled** WP 8.1 networking stack disabled. + + + diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml new file mode 100644 index 0000000000..52a6ddd6da --- /dev/null +++ b/windows/privacy/toc.yml @@ -0,0 +1,71 @@ +- name: Privacy + href: index.yml + items: + - name: "Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals" + href: windows-10-and-privacy-compliance.md + - name: Configure Windows diagnostic data in your organization + href: configure-windows-diagnostic-data-in-your-organization.md + - name: Changes to Windows diagnostic data collection + href: changes-to-windows-diagnostic-data-collection.md + - name: Diagnostic Data Viewer + items: + - name: Diagnostic Data Viewer Overview + href: diagnostic-data-viewer-overview.md + - name: Diagnostic Data Viewer for PowerShell Overview + href: Microsoft-DiagnosticDataViewer.md + - name: Required Windows diagnostic data events and fields + items: + - name: Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic data events and fields + href: required-windows-diagnostic-data-events-and-fields-2004.md + - name: Windows 10, version 1909 and Windows 10, version 1903 required level Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1903.md + - name: Windows 10, version 1809 required Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1809.md + - name: Windows 10, version 1803 required Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1803.md + - name: Windows 10, version 1709 required Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1709.md + - name: Windows 10, version 1703 required Windows diagnostic events and fields + href: basic-level-windows-diagnostic-events-and-fields-1703.md + - name: Optional Windows diagnostic data events and fields + items: + - name: Windows 10, version 1709 and newer optional diagnostic data + href: windows-diagnostic-data.md + - name: Windows 10, version 1703 optional diagnostic data + href: windows-diagnostic-data-1703.md + - name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy + href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md + - name: Manage Windows 10 connection endpoints + items: + - name: Manage connections from Windows operating system components to Microsoft services + href: manage-connections-from-windows-operating-system-components-to-microsoft-services.md + - name: Manage connections from Windows operating system components to Microsoft services using MDM + href: manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md + - name: Connection endpoints for Windows 10, version 20H2 + href: manage-windows-20H2-endpoints.md + - name: Connection endpoints for Windows 10, version 2004 + href: manage-windows-2004-endpoints.md + - name: Connection endpoints for Windows 10, version 1909 + href: manage-windows-1909-endpoints.md + - name: Connection endpoints for Windows 10, version 1903 + href: manage-windows-1903-endpoints.md + - name: Connection endpoints for Windows 10, version 1809 + href: manage-windows-1809-endpoints.md + - name: Connection endpoints for Windows 10, version 1803 + href: manage-windows-1803-endpoints.md + - name: Connection endpoints for Windows 10, version 1709 + href: manage-windows-1709-endpoints.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 20H2 + href: windows-endpoints-20H2-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 2004 + href: windows-endpoints-2004-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1909 + href: windows-endpoints-1909-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1903 + href: windows-endpoints-1903-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1809 + href: windows-endpoints-1809-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1803 + href: windows-endpoints-1803-non-enterprise-editions.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1709 + href: windows-endpoints-1709-non-enterprise-editions.md diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 3631daf619..e1011307d6 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -13,162 +13,162 @@ ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 05/21/2019 +ms.date: 07/21/2020 --- # Windows 10 & Privacy Compliance:
        A Guide for IT and Compliance Professionals Applies to: -- Windows 10, version 1809 and newer -- Windows 10 Team Edition, version 1703 for Surface Hub +- Windows 10 Enterprise +- Windows 10 Education - Windows Server 2016 and newer -- Windows Analytics - -For more information about the GDPR, see: -* [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md) -* [Microsoft GDPR Overview](https://aka.ms/GDPROverview) -* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq) -* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp) -* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted) ## Overview -At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide IT and compliance professionals with data privacy considerations for Windows 10. +>[!IMPORTANT] +>Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). -Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls and support for data subject requests, all of which are detailed in this guide. +At Microsoft, we are committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows 10. -This information allows IT and compliance professionals work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR). +Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article. +This information allows administrators and compliance professionals to work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR) ## 1. Windows 10 data collection transparency Transparency is an important part of the data collection process in Windows 10. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device set up. -If interested in understanding how to manage settings related to data collection skip to the next section [Windows 10 data collection management](#12-data-collection-monitoring). - - ### 1.1 Device set up experience and support for layered transparency -When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used and how to manage the setting after the device setup is complete. The user can also review the privacy statement when connected to the network during this portion of setup. A brief overview of the set up experience for privacy settings are described in [this blog](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97). +When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used, and how to manage the setting after the device setup is complete. When connected to the network during this portion of setup, the user can also review the privacy statement. A brief overview of the set up experience for privacy settings is described in [Windows Insiders get first look at new privacy screen settings layout coming to Windows 10](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97), a blog entry on Windows Blogs. The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information. > [!NOTE] -> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and newer). For the full list of settings that involve data collection, [see Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | Description | Supporting Content | Privacy Statement | | --- | --- | --- | --- | -| Diagnostic Data |

        Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.

        Diagnostic data is categorized into four levels:

        • **Security**
          Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
        • **Basic**
          Basic device info, including: quality-related data, app compatibility, and data from the Security level.
        • **Enhanced**
          Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
        • **Full**
          Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
          At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).

        | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

        [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -| Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | -| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | +| Diagnostic Data |

        Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.

        Diagnostic data is categorized into the following:

        • **Required diagnostic data**
          Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004).
        • **Optional diagnostic data**
          Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).

        | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

        [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Inking and typing diagnostics | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/windows-10-speech-voice-activation-inking-typing-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | +| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy) |[Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | | Find my device | Use your device’s location data to help you find your device if you lose it. | [Learn more](https://support.microsoft.com/help/11579/microsoft-account-find-and-lock-lost-windows-device) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | -| Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you have chosen (Security, Basic, Enhanced, or Full). Tailored experiences mean personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | -| Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/general-privacy-settings-in-windows-10-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainadvertisingidmodule) | -| Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) | -| Cortana |

        Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/instantanswers/557b5e0e-0eb0-44db-87d6-5e5db6f9c5b0/cortana-s-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

        Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

        | [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

        [Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | +| Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you choose to send. Tailored experiences include personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/windows-10-general-privacy-settings) | [Privacy statement](https://support.microsoft.com/help/4459081/windows-10-general-privacy-settings) | +| Activity History/Timeline – Cloud Sync | If you want Windows Timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) | +| Cortana |

        Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/help/4026948/cortanas-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

        Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

        | [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

        [Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | ### 1.2 Data collection monitoring -The Diagnostic Data Viewer (DDV) is a Windows app (available in Windows 10, version 1803 or later) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft. DDV groups the information into simple categories based on how it is used by Microsoft. The [DDV Overview](diagnostic-data-viewer-overview.md) provides information on how users can get started on using this tool. +[Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) is a Microsoft Store app (available in Windows 10, version 1803 and newer) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft in real-time. DDV groups the information into simple categories that describe the data that’s being collected. An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information. ## 2. Windows 10 data collection management -Windows 10 provides the ability to manage privacy settings through several different methods. Users can change their privacy settings using the Windows 10 settings (**Start** > **Settings** > **Privacy**). The organization can also manage the privacy settings using group policy or mobile device management (MDM). The following sections provide an overview on how to manage the privacy settings previously discussed in this article. +Windows 10 provides the ability to manage privacy settings through several different methods. Users can change their privacy settings using the Windows 10 settings (**Start > Settings > Privacy**). The organization can also manage the privacy settings using Group Policy or Mobile Device Management (MDM). The following sections provide an overview on how to manage the privacy settings previously discussed in this article. ### 2.1 Privacy setting options for users -Once a Windows 10 device is set up, a user can manage data collection settings by going to **Start** > **Settings** > **Privacy**. IT administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to **Start** > **Settings** > **Privacy**. Meaning the user can only change settings in accordance with the policies that the administrator has applied to the device. +Once a Windows 10 device is set up, a user can manage data collection settings by navigating to **Start > Settings > Privacy**. Administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says **Some settings are hidden or managed by your organization** when they navigate to **Start > Settings > Privacy**. In this case, the user can only change settings in accordance with the policies that the administrator has applied to the device. ### 2.2 Privacy setting controls for administrators -The IT department can configure and control privacy settings across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings. +Administrators can configure and control privacy settings across their organization by using Group Policy, Mobile Device Management (MDM), or Windows registry settings. -The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these via policy. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting via policy and suppress the Out-of-box Experience (OOBE) during device setup. For an IT administrator interested in minimizing data, we also provide the recommended value to set. +The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
        **Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

        MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | -| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
        **Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

        MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off | +| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
        **Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

        MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
        **Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

        MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
        **Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

        MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
        Basic (Windows 10, version 1903 and later)

        Server SKUs:
        Enhanced | Security and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
        **Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

        MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop editions:
        Required diagnostic data (Windows 10, version 1903 and later)

        Server editions:
        Required diagnostic data | Security and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
        **Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

        MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | -| Tailored Experiences | Group Policy:
        **User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

        MDM: Link TBD | Off | Off | -| Advertising ID | Group Policy:
        **Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

        MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | +| Tailored Experiences | Group Policy:
        **User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

        MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | +| Advertising ID | Group Policy:
        **Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

        MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | | Activity History/Timeline – Cloud Sync | Group Policy:
        **Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

        MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | | [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#2-cortana-and-search) | Group Policy:
        **Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

        MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | ### 2.3 Guidance for configuration options -This section provides general details and links to more detailed information as well as instructions for IT administrators and compliance professional. These instructions allow IT admins and compliance pros to manage the device compliance. This information includes details about setting up a device, to configuring the device’s settings after setup is completed to minimize data collected and drive privacy related user experiences. +This section provides general details and links to more detailed information, as well as instructions for administrators and compliance professionals. These instructions allow you to manage device settings to manage the compliance objectives of your organization. This information includes details about setting up a device, configuring the device’s settings after setup is complete to minimize data collection, and driving privacy-related user experiences. -#### 2.3.1 Managing the device setup experience +#### _2.3.1 Managing the device setup experience_ -Windows deployment can be configured using several different methods, which provide an administrator with options to control: how a device is set up, what’s enabled by default, and what the user is able to change on the system after they log on. +Windows deployment can be configured using several different methods that provide an administrator with options for control, including how a device is set up, which options are enabled by default, and what the user is able to change on the device after they log on. -The [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment/) section of the Windows IT Pro Center provides an overview of the different options. +If you want the ability to fully control and apply restrictions on data being sent back to Microsoft, you can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/) as a deployment solution. Configuration Manager can be used to deploy a customized boot image using a variety of [deployment methods](https://docs.microsoft.com/mem/configmgr/osd/get-started/prepare-for-operating-system-deployment). You can further restrict any Configuration Manager-specific diagnostic data from being sent back to Microsoft by turning off this setting as outlined in the instructions [here](https://docs.microsoft.com/mem/configmgr/core/plan-design/diagnostics/frequently-asked-questions). -#### 2.3.2 Managing connections from Windows components to Microsoft services +Alternatively, your administrators can also choose to use Windows Autopilot. Autopilot lessens the overall burden of deployment while allowing administrators to fully customize the out-of-box experience. However, since Windows Autopilot is a cloud-based solution, administrators should be aware that a minimal set of device identifiers are sent back to Microsoft during initial device boot up. This device-specific information is used to identify the device so that it can receive the administrator-configured Autopilot profile and policies. -IT administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by these Windows components. +You can use the following articles to learn more about Autopilot and how to use Autopilot to deploy Windows 10: +- https://docs.microsoft.com/windows/deployment/windows-Autopilot/windows-Autopilot +- https://docs.microsoft.com/windows/deployment/windows-Autopilot/deployment-process -See [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) for more details, including the different methods available on how to configure each setting, the impact to functionality and which versions of Windows that are applicable. +#### _2.3.2 Managing connections from Windows components to Microsoft services_ -#### 2.3.3 Managing Windows 10 connections +Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components. -Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints as an additional measure of ensuring privacy compliance within their organization. +For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable. -[Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with the functionality that would be impacted. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the “Manage Windows 10 connection endpoints” section of the left-hand navigation menu. +#### _2.3.3 Managing Windows 10 connections_ -#### 2.3.4 Limited functionality baseline +Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives. -An organization may want to further minimize the amount of data shared with Microsoft or apps by managing the connections and configuring additional settings on their devices. Similar to [Security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), we have a limited functionality baseline-focused configuring settings to minimize the data shared, however this comes with some potential impact to functionality on the device. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators who don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. +[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu. -#### 2.3.5 Diagnostic data: Managing notifications for change of level at logon +#### _2.3.4 Limited functionality baseline_ -Windows 10, version 1803, and later provides users with a notification during sign in about changes to the diagnostic data level on the device so they are aware of any changes where additional data may be collected. For instance, if the diagnostic level on the device is set to Basic and an administrator changes it to Full, users will be notified when they next sign in. The IT administrator can disable these notifications by setting Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`. +An organization may want to further minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. -#### 2.3.6 Diagnostic data: Managing end user choice for changing the setting +>[!IMPORTANT] +>We recommend that you fully test any modifications to these settings before deploying them in your organization. -Windows 10, version 1803 and later, allows users to change their diagnostic data level to a lower setting than what their IT administrator has set. For instance, if the administrator has set the diagnostic data level to Enhanced or Full, a user can change the setting to Basic by going into **Settings** > **Privacy** > **Diagnostic & feedback**. The administrator can disable the user ability to change the setting via **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`. +#### _2.3.5 Diagnostic data: Managing notifications for change of level at logon_ -#### 2.3.7 Diagnostic data: Managing device-based data delete +Starting with Windows 10, version 1803, if an administrator modifies the diagnostic data collection setting, users are notified of this change during the initial device sign in. For example, if you configure the device to send optional diagnostic data, users will be notified the next time they sign into the device. You can disable these notifications by using the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`. -Windows 10, version 1803 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. +#### _2.3.6 Diagnostic data: Managing end user choice for changing the setting_ + +Windows 10, version 1803 and newer allows users to change their diagnostic data level to a lower setting than what their administrator has set. For example, if you have configured the device to send optional diagnostic data, a user can change the setting so that only required diagnostic data is sent by going into **Settings** > **Privacy** > **Diagnostics & feedback**. Administrators can restrict a user’s ability to change the setting using **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`. + +#### _2.3.7 Diagnostic data: Managing device-based data delete_ + +Windows 10, version 1809 and newer allows a user to delete diagnostic data collected from their device by using **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet. An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`. ## 3. The process for exercising data subject rights -This section discusses the different methods Microsoft provides for users and IT administrators to exercise data subject rights for data collected from a Windows 10 device. +This section discusses the different methods Microsoft provides for users and administrators to exercise data subject rights for data collected from a Windows 10 device. ### 3.1 Delete -Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. Administrators can also use the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script. +Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. Administrators can also use the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet. ### 3.2 View -The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from a Windows 10 device. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet. ### 3.3 Export -The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the **Export** data button in the top menu. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. ### 3.4 Devices connected to a Microsoft account -If a user signs in to a Windows experience or app on their device with their Microsoft account (MSA), they can view, delete, and export data associated with their MSA on the [Privacy dashboard](https://account.microsoft.com/privacy). +If a user signs in to a Windows experience or app on their device with their Microsoft account, they can view, delete, and export data associated with their Microsoft account on the [Privacy dashboard](https://account.microsoft.com/privacy). ## 4. Cross-border data transfers -Microsoft complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States. +Microsoft complies with applicable law regarding the collection, use, and retention of personal information, including its transfer across borders Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainwherewestoreandprocessdatamodule) provides details on how we store and process personal data. @@ -177,26 +177,34 @@ Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement The following sections provide details about how privacy data is collected and managed across related Windows products. -### 5.1 Windows Server 2016 and 2019 +### 5.1 Windows Server 2016 and newer -Windows Server follows the same mechanisms as Windows 10 for handling of personal data. There are some differences regarding [diagnostic default settings for Windows Server](https://microsoft-my.sharepoint.com/personal/v-colinm_microsoft_com/Documents/WINDOWS%20PRIVACY/Windows%20diagnostic%20data%20and%20Windows%20Server). +Windows Server follows the same mechanisms as Windows 10 for handling of personal data. ### 5.2 Surface Hub -Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to an individual user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. +[Surface Hub](https://docs.microsoft.com/surface-hub/) is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. To delete the Windows diagnostic data sent to Microsoft for Surface Hub, you can use the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store -For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](gdpr-it-guidance.md#windows-10-team-edition-version-1703-for-surface-hub). +>[!IMPORTANT] +>Apps and services that run on Windows but are not considered part of Windows will manage data collection using their own controls. Please contact the publisher for further guidance on how to control the data collection and transmission of these apps and services. -### 5.3 Windows 10 Analytics +An administrator can configure privacy-related settings, such as choosing to only send required diagnostic data. Surface Hub does not support Group Policy for centralized management. However, administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, see [Manage settings with an MDM provider (Surface Hub)](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub). -[Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: Device Health, Update Compliance, and Upgrade Readiness. Windows Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function. +### 5.3 Desktop Analytics -For more details, see the [Windows Analytics overview page](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview). +[Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. Desktop Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function. +### 5.4 Microsoft Managed Desktop + +[Microsoft Managed Desktop (MMD)](https://docs.microsoft.com/microsoft-365/managed-desktop/service-description/?view=o365-worldwide) is a service that provides your users with a secure modern experience and always keeps devices up to date with the latest versions of Windows 10 Enterprise edition, Office 365 ProPlus, and Microsoft security services. ## Additional Resources -* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trustcenter/privacy/gdpr/gdpr-overview) -* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/TrustCenter/Privacy/privacy-overview) +* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trust-center/privacy/gdpr-overview) +* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/trust-center/privacy) * [Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro) - +* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) +* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) +* [Privacy at Microsoft](https://privacy.microsoft.com/privacy-report) +* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md) +* [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/) diff --git a/windows/privacy/windows-diagnostic-data-1703.md b/windows/privacy/windows-diagnostic-data-1703.md index 73ccd75c12..ffa7858d15 100644 --- a/windows/privacy/windows-diagnostic-data-1703.md +++ b/windows/privacy/windows-diagnostic-data-1703.md @@ -42,7 +42,7 @@ Most diagnostic events contain a header of common data: | Category Name | Examples | | - | - | -| Common Data | Information that is added to most diagnostic events, if relevant and available:
        • OS name, version, build, and [locale](https://msdn.microsoft.com/library/windows/desktop/dd318716.aspx)
        • User ID -- a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic diagnostic data
        • Xbox UserID
        • Environment from which the event was logged -- Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time such the period an app is running or between boots of the OS.
        • The diagnostic event name, Event ID, [ETW](https://msdn.microsoft.com/library/windows/desktop/bb968803.aspx) opcode, version, schema signature, keywords, and flags
        • HTTP header information, including the IP address. This IP address is the source address that’s provided by the network packet header and received by the diagnostics ingestion service.
        • Various IDs that are used to correlate and sequence related events together.
        • Device ID. This is not the user provided device name, but an ID that is unique for that device.
        • Device class -- Desktop, Server, or Mobile
        • Event collection time
        • Diagnostic level -- Basic or Full, Sample level -- for sampled data, what sample level is this device opted into
        | +| Common Data | Information that is added to most diagnostic events, if relevant and available:
        • OS name, version, build, and [locale](https://msdn.microsoft.com/library/windows/desktop/dd318716.aspx)
        • User ID - a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic diagnostic data
        • Xbox UserID
        • Environment from which the event was logged - Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time such the period an app is running or between boots of the OS.
        • The diagnostic event name, Event ID, [ETW](https://msdn.microsoft.com/library/windows/desktop/bb968803.aspx) opcode, version, schema signature, keywords, and flags
        • HTTP header information, including the IP address. This IP address is the source address that’s provided by the network packet header and received by the diagnostics ingestion service.
        • Various IDs that are used to correlate and sequence related events together.
        • Device ID. This ID is not the user provided device name, but an ID that is unique for that device.
        • Device class - Desktop, Server, or Mobile
        • Event collection time
        • Diagnostic level - Basic or Full, Sample level - for sampled data, what sample level is this device opted into
        | ## ​Device, Connectivity, and Configuration data @@ -50,38 +50,38 @@ This type of data includes details about the device, its configuration and conne | Category Name | Examples | | - | - | -| Device properties | Information about the OS and device hardware, such as:
        • OS - version name, Edition
        • Installation type, subscription status, and genuine OS status
        • Processor architecture, speed, number of cores, manufacturer, and model
        • OEM details --manufacturer, model, and serial number
        • Device identifier and Xbox serial number
        • Firmware/BIOS -- type, manufacturer, model, and version
        • Memory -- total memory, video memory, speed, and how much memory is available after the device has reserved memory
        • Storage -- total capacity and disk type
        • Battery -- charge capacity and InstantOn support
        • Hardware chassis type, color, and form factor
        • Is this a virtual machine?
        | -| Device capabilities | Information about the specific device capabilities such as:
        • Camera -- whether the device has a front facing, a rear facing camera, or both.
        • Touch screen -- does the device include a touch screen? If so, how many hardware touch points are supported?
        • Processor capabilities -- CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2
        • Trusted Platform Module (TPM) – whether present and what version
        • Virtualization hardware -- whether an IOMMU is present, SLAT support, is virtualization enabled in the firmware
        • Voice – whether voice interaction is supported and the number of active microphones
        • Number of displays, resolutions, DPI
        • Wireless capabilities
        • OEM or platform face detection
        • OEM or platform video stabilization and quality level set
        • Advanced Camera Capture mode (HDR vs. LowLight), OEM vs. platform implementation, HDR probability, and Low Light probability
        | -| Device preferences and settings | Information about the device settings and user preferences such as:
        • User Settings – System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security
        • User-provided device name
        • Whether device is domain-joined, or cloud-domain joined (i.e. part of a company-managed network)
        • Hashed representation of the domain name
        • MDM (mobile device management) enrollment settings and status
        • BitLocker, Secure Boot, encryption settings, and status
        • Windows Update settings and status
        • Developer Unlock settings and status
        • Default app choices
        • Default browser choice
        • Default language settings for app, input, keyboard, speech, and display
        • App store update settings
        • Enterprise OrganizationID, Commercial ID
        | -| Device peripherals | Information about the device peripherals such as:
        • Peripheral name, device model, class, manufacturer and description
        • Peripheral device state, install state, and checksum
        • Driver name, package name, version, and manufacturer
        • HWID - A hardware vendor defined ID to match a device to a driver [INF file](https://msdn.microsoft.com/windows/hardware/drivers/install/hardware-ids)
        • Driver state, problem code, and checksum
        • Whether driver is kernel mode, signed, and image size
        | -| Device network info | Information about the device network configuration such as:
        • Network system capabilities
        • Local or Internet connectivity status
        • Proxy, gateway, DHCP, DNS details and addresses
        • Paid or free network
        • Wireless driver is emulated or not
        • Access point mode capable
        • Access point manufacturer, model, and MAC address
        • WDI Version
        • Name of networking driver service
        • Wi-Fi Direct details
        • Wi-Fi device hardware ID and manufacturer
        • Wi-Fi scan attempt counts and item counts
        • Mac randomization is supported/enabled or not
        • Number of spatial streams and channel frequencies supported
        • Manual or Auto Connect enabled
        • Time and result of each connection attempt
        • Airplane mode status and attempts
        • Interface description provided by the manufacturer
        • Data transfer rates
        • Cipher algorithm
        • Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO)
        • Mobile operator and service provider name
        • Available SSIDs and BSSIDs
        • IP Address type -- IPv4 or IPv6
        • Signal Quality percentage and changes
        • Hotspot presence detection and success rate
        • TCP connection performance
        • Miracast device names
        • Hashed IP address
        +| Device properties | Information about the OS and device hardware, such as:
        • OS - version name, Edition
        • Installation type, subscription status, and genuine OS status
        • Processor architecture, speed, number of cores, manufacturer, and model
        • OEM details - manufacturer, model, and serial number
        • Device identifier and Xbox serial number
        • Firmware/BIOS - type, manufacturer, model, and version
        • Memory - total memory, video memory, speed, and how much memory is available after the device has reserved memory
        • Storage - total capacity and disk type
        • Battery - charge capacity and InstantOn support
        • Hardware chassis type, color, and form factor
        • Is this machine a virtual machine?
        | +| Device capabilities | Information about the specific device capabilities such as:
        • Camera - whether the device has a front facing, a rear facing camera, or both.
        • Touch screen - does the device include a touch screen? If so, how many hardware touch points are supported?
        • Processor capabilities - CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2
        • Trusted Platform Module (TPM) – whether present and what version
        • Virtualization hardware - whether an IOMMU is present, SLAT support, is virtualization enabled in the firmware
        • Voice – whether voice interaction is supported and the number of active microphones
        • Number of displays, resolutions, DPI
        • Wireless capabilities
        • OEM or platform face detection
        • OEM or platform video stabilization and quality level set
        • Advanced Camera Capture mode (HDR vs. LowLight), OEM vs. platform implementation, HDR probability, and Low Light probability
        | +| Device preferences and settings | Information about the device settings and user preferences such as:
        • User Settings – System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security
        • User-provided device name
        • Whether device is domain-joined, or cloud-domain joined (that is, part of a company-managed network)
        • Hashed representation of the domain name
        • MDM (mobile device management) enrollment settings and status
        • BitLocker, Secure Boot, encryption settings, and status
        • Windows Update settings and status
        • Developer Unlock settings and status
        • Default app choices
        • Default browser choice
        • Default language settings for app, input, keyboard, speech, and display
        • App store update settings
        • Enterprise OrganizationID, Commercial ID
        | +| Device peripherals | Information about the device peripherals such as:
        • Peripheral name, device model, class, manufacturer, and description
        • Peripheral device state, install state, and checksum
        • Driver name, package name, version, and manufacturer
        • HWID - A hardware vendor defined ID to match a device to a driver [INF file](https://msdn.microsoft.com/windows/hardware/drivers/install/hardware-ids)
        • Driver state, problem code, and checksum
        • Whether driver is kernel mode, signed, and image size
        | +| Device network info | Information about the device network configuration such as:
        • Network system capabilities
        • Local or Internet connectivity status
        • Proxy, gateway, DHCP, DNS details, and addresses
        • Paid or free network
        • Wireless driver is emulated or not
        • Access point mode capable
        • Access point manufacturer, model, and MAC address
        • WDI Version
        • Name of networking driver service
        • Wi-Fi Direct details
        • Wi-Fi device hardware ID and manufacturer
        • Wi-Fi scan attempt counts and item counts
        • Mac randomization is supported/enabled or not
        • Number of spatial streams and channel frequencies supported
        • Manual or Auto Connect enabled
        • Time and result of each connection attempt
        • Airplane mode status and attempts
        • Interface description provided by the manufacturer
        • Data transfer rates
        • Cipher algorithm
        • Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO)
        • Mobile operator and service provider name
        • Available SSIDs and BSSIDs
        • IP Address type - IPv4 or IPv6
        • Signal Quality percentage and changes
        • Hotspot presence detection and success rate
        • TCP connection performance
        • Miracast device names
        • Hashed IP address
        ## Product and Service Usage data -This type of data includes details about the usage of the device, operating system, applications and services. +This type of data includes details about the usage of the device, operating system, applications, and services. | Category Name | Examples | | - | - | -| App usage | Information about Windows and application usage such as:
        • OS component and app feature usage
        • User navigation and interaction with app and Windows features. This could potentially include user input, such as name of a new alarm set, user menu choices, or user favorites.
        • Time of and count of app/component launches, duration of use, session GUID, and process ID
        • App time in various states – running foreground or background, sleeping, or receiving active user interaction
        • User interaction method and duration – whether and length of time user used the keyboard, mouse, pen, touch, speech, or game controller
        • Cortana launch entry point/reason
        • Notification delivery requests and status
        • Apps used to edit images and videos
        • SMS, MMS, VCard, and broadcast message usage statistics on primary or secondary line
        • Incoming and Outgoing calls and Voicemail usage statistics on primary or secondary line
        • Emergency alerts are received or displayed statistics
        • Content searches within an app
        • Reading activity -- bookmarking used, print used, layout changed
        | -| App or product state | Information about Windows and application state such as:
        • Start Menu and Taskbar pins
        • Online/Offline status
        • App launch state –- with deep-link such as Groove launched with an audio track to play, or share contract such as MMS launched to share a picture.
        • Personalization impressions delivered
        • Whether the user clicked or hovered on UI controls or hotspots
        • User feedback Like or Dislike or rating was provided
        • Caret location or position within documents and media files -- how much of a book has been read in a single session or how much of a song has been listened to.
        | +| App usage | Information about Windows and application usage such as:
        • OS component and app feature usage
        • User navigation and interaction with app and Windows features. This information could include user input, such as the name of a new alarm set, user menu choices, or user favorites.
        • Time of and count of app/component launches, duration of use, session GUID, and process ID
        • App time in various states – running foreground or background, sleeping, or receiving active user interaction
        • User interaction method and duration – whether and length of time user used the keyboard, mouse, pen, touch, speech, or game controller
        • Cortana launch entry point/reason
        • Notification delivery requests and status
        • Apps used to edit images and videos
        • SMS, MMS, VCard, and broadcast message usage statistics on primary or secondary line
        • Incoming and Outgoing calls and Voicemail usage statistics on primary or secondary line
        • Emergency alerts are received or displayed statistics
        • Content searches within an app
        • Reading activity - bookmarking used, print used, layout changed
        | +| App or product state | Information about Windows and application state such as:
        • Start Menu and Taskbar pins
        • Online/Offline status
        • App launch state –- with deep-link such as Groove launched with an audio track to play, or share contract such as MMS launched to share a picture.
        • Personalization impressions delivered
        • Whether the user clicked or hovered on UI controls or hotspots
        • User feedback Like or Dislike or rating was provided
        • Caret location or position within documents and media files - how much of a book has been read in a single session or how much of a song has been listened to.
        | | Login properties |
        • Login success or failure
        • Login sessions and state
        | ## Product and Service Performance data -This type of data includes details about the health of the device, operating system, apps and drivers. +This type of data includes details about the health of the device, operating system, apps, and drivers. | Category Name | Description and Examples | | - | - | -|Device health and crash data | Information about the device and software health such as:
        • Error codes and error messages, name and ID of the app, and process reporting the error
        • DLL library predicted to be the source of the error -- xyz.dll
        • System generated files -- app or product logs and trace files to help diagnose a crash or hang
        • System settings such as registry keys
        • User generated files – .doc, .ppt, .csv files where they are indicated as a potential cause for a crash or hang
        • Details and counts of abnormal shutdowns, hangs, and crashes
        • Crash failure data – OS, OS component, driver, device, 1st and 3rd party app data
        • Crash and Hang dumps
          • The recorded state of the working memory at the point of the crash.
          • Memory in use by the kernel at the point of the crash.
          • Memory in use by the application at the point of the crash.
          • All the physical memory used by Windows at the point of the crash.
          • Class and function name within the module that failed.
          | -|Device performance and reliability data | Information about the device and software performance such as:
          • User Interface interaction durations -- Start Menu display times, browser tab switch times, app launch and switch times, and Cortana and search performance and reliability.
          • Device on/off performance -- Device boot, shutdown, power on/off, lock/unlock times, and user authentication times (fingerprint and face recognition durations).
          • In-app responsiveness -- time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction.
          • User input responsiveness – onscreen keyboard invocation times for different languages, time to show auto-complete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score.
          • UI and media performance and glitches/smoothness -- video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance
          • Disk footprint -- Free disk space, out of memory conditions, and disk score.
          • Excessive resource utilization – components impacting performance or battery life through high CPU usage during different screen and power states
          • Background task performance -- download times, Windows Update scan duration, Windows Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results
          • Peripheral and devices -- USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness environmental response times
          • Device setup -- first setup experience times (time to install updates, install apps, connect to network etc.), time to recognize connected devices (printer and monitor), and time to setup Microsoft Account.
          • Power and Battery life – power draw by component (Process/CPU/GPU/Display), hours of screen off time, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use during screen off, auto-brightness details, time device is plugged into AC vs. battery, battery state transitions
          • Service responsiveness - Service URI, operation, latency, service success/error codes, and protocol.
          • Diagnostic heartbeat – regular signal to validate the health of the diagnostics system
          | -|Movies|Information about movie consumption functionality on the device. This isn't intended to capture user viewing, listening or habits.
          • Video Width, height, color pallet, encoding (compression) type, and encryption type
          • Instructions for how to stream content for the user -- the smooth streaming manifest of chunks of content files that must be pieced together to stream the content based on screen resolution and bandwidth
          • URL for a specific two second chunk of content if there is an error
          • Full screen viewing mode details| -|Music & TV|Information about music and TV consumption on the device. This isn't intended to capture user viewing, listening or habits.
            • Service URL for song being downloaded from the music service – collected when an error occurs to facilitate restoration of service
            • Content type (video, audio, surround audio)
            • Local media library collection statistics -- number of purchased tracks, number of playlists
            • Region mismatch -- User OS Region, and Xbox Live region
            | -|Reading|Information about reading consumption functionality on the device. This isn't intended to capture user viewing, listening or habits.
            • App accessing content and status and options used to open a Microsoft Store book
            • Language of the book
            • Time spent reading content
            • Content type and size details
            | -|Photos App|Information about photos usage on the device. This isn't intended to capture user viewing, listening or habits.
            • File source data -- local, SD card, network device, and OneDrive
            • Image & video resolution, video length, file sizes types and encoding
            • Collection view or full screen viewer use and duration of view
          | -|On-device file query | Information about local search activity on the device such as:
          • Kind of query issued and index type (ConstraintIndex, SystemIndex)
          • Number of items requested and retrieved
          • File extension of search result user interacted with
          • Launched item kind, file extension, index of origin, and the App ID of the opening app.
          • Name of process calling the indexer and time to service the query.
          • A hash of the search scope (file, Outlook, OneNote, IE history)
          • The state of the indices (fully optimized, partially optimized, being built)
          | -|Purchasing| Information about purchases made on the device such as:
          • Product ID, edition ID and product URI
          • Offer details -- price
          • Order requested date/time
          • Store client type -- web or native client
          • Purchase quantity and price
          • Payment type -- credit card type and PayPal
          | -|Entitlements | Information about entitlements on the device such as:
          • Service subscription status and errors
          • DRM and license rights details -- Groove subscription or OS volume license
          • Entitlement ID, lease ID, and package ID of the install package
          • Entitlement revocation
          • License type (trial, offline vs online) and duration
          • License usage session
          | +|Device health and crash data | Information about the device and software health such as:
          • Error codes and error messages, name and ID of the app, and process reporting the error
          • DLL library predicted to be the source of the error - xyz.dll
          • System-generated files - app or product logs and trace files to help diagnose a crash or hang
          • System settings such as registry keys
          • User-generated files – .doc, .ppt, .csv files where they are indicated as a potential cause for a crash or hang
          • Details and counts of abnormal shutdowns, hangs, and crashes
          • Crash failure data – OS, OS component, driver, device, 1st and 3rd party app data
          • Crash and Hang dumps
            • The recorded state of the working memory at the point of the crash.
            • Memory in use by the kernel at the point of the crash.
            • Memory in use by the application at the point of the crash.
            • All the physical memory used by Windows at the point of the crash.
            • Class and function name within the module that failed.
            | +|Device performance and reliability data | Information about the device and software performance such as:
            • User Interface interaction durations - Start Menu display times, browser tab switch times, app launch and switch times, and Cortana and search performance and reliability.
            • Device on/off performance - Device boot, shutdown, power on/off, lock/unlock times, and user authentication times (fingerprint and face recognition durations).
            • In-app responsiveness - time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction.
            • User input responsiveness – onscreen keyboard invocation times for different languages, time to show autocomplete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score.
            • UI and media performance and glitches/smoothness - video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance
            • Disk footprint - Free disk space, out of memory conditions, and disk score.
            • Excessive resource utilization – components impacting performance or battery life through high CPU usage during different screen and power states
            • Background task performance - download times, Windows Update scan duration, Microsoft Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results
            • Peripheral and devices - USB device connection times, time to connect to a wireless display, printing times, network availability, and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP, and so on), smart card authentication times, automatic brightness environmental response times
            • Device setup - first setup experience times (time to install updates, install apps, connect to network etc.), time to recognize connected devices (printer and monitor), and time to setup Microsoft Account.
            • Power and Battery life – power draw by component (Process/CPU/GPU/Display), hours of screen off time, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use during screen off, autobrightness details, time device is plugged into AC vs. battery, battery state transitions
            • Service responsiveness - Service URI, operation, latency, service success/error codes, and protocol.
            • Diagnostic heartbeat – regular signal to validate the health of the diagnostics system
            | +|Movies|Information about movie consumption functionality on the device. This information isn't intended to capture user viewing, listening, or habits.
            • Video Width, height, color pallet, encoding (compression) type, and encryption type
            • Instructions for how to stream content for the user - the smooth streaming manifest of chunks of content files that must be pieced together to stream the content based on screen resolution and bandwidth
            • URL for a specific two-second chunk of content if there is an error
            • Full screen viewing mode details| +|Music & TV|Information about music and TV consumption on the device. This information isn't intended to capture user viewing, listening, or habits.
              • Service URL for song being downloaded from the music service – collected when an error occurs to facilitate restoration of service
              • Content type (video, audio, surround audio)
              • Local media library collection statistics - number of purchased tracks, number of playlists
              • Region mismatch - User OS Region, and Xbox Live region
              | +|Reading|Information about reading consumption functionality on the device. This information isn't intended to capture user viewing, listening, or habits.
              • App accessing content and status and options used to open a Microsoft Store book
              • Language of the book
              • Time spent reading content
              • Content type and size details
              | +|Photos App|Information about photos usage on the device. This information isn't intended to capture user viewing, listening, or habits.
              • File source data - local, SD card, network device, and OneDrive
              • Image & video resolution, video length, file sizes types and encoding
              • Collection view or full screen viewer use and duration of view
            | +|On-device file query | Information about local search activity on the device such as:
            • Type of query issued and index type (ConstraintIndex, SystemIndex)
            • Number of items requested and retrieved
            • File extension of search result user interacted with
            • Launched item kind, file extension, index of origin, and the App ID of the opening app.
            • Name of process calling the indexer and time to service the query.
            • A hash of the search scope (file, Outlook, OneNote, IE history)
            • The state of the indices (fully optimized, partially optimized, being built)
            | +|Purchasing| Information about purchases made on the device such as:
            • Product ID, edition ID, and product URI
            • Offer details - price
            • Order requested date/time
            • Store client type - web or native client
            • Purchase quantity and price
            • Payment type - credit card type and PayPal
            | +|Entitlements | Information about entitlements on the device such as:
            • Service subscription status and errors
            • DRM and license rights details - Groove subscription or OS volume license
            • Entitlement ID, lease ID, and package ID of the install package
            • Entitlement revocation
            • License type (trial, offline versus online) and duration
            • License usage session
            | ## Software Setup and Inventory data @@ -90,7 +90,7 @@ This type of data includes software installation and update information on the d | Category Name | Data Examples | | - | - | | Installed Applications and Install History | Information about apps, drivers, update packages, or OS components installed on the device such as:
            • App, driver, update package, or component’s Name, ID, or Package Family Name
            • Product, SKU, availability, catalog, content, and Bundle IDs
            • OS component, app or driver publisher, language, version and type (Win32 or UWP)
            • Install date, method, and install directory, count of install attempts
            • MSI package code and product code
            • Original OS version at install time
            • User or administrator or mandatory installation/update
            • Installation type – clean install, repair, restore, OEM, retail, upgrade, and update
            | -| Device update information | Information about Windows Update such as:
            • Update Readiness analysis of device hardware, OS components, apps, and drivers (progress, status, and results)
            • Number of applicable updates, importance, type
            • Update download size and source -- CDN or LAN peers
            • Delay upgrade status and configuration
            • OS uninstall and rollback status and count
            • Windows Update server and service URL
            • Windows Update machine ID
            • Windows Insider build details
            +| Device update information | Information about Windows Update such as:
            • Update Readiness analysis of device hardware, OS components, apps, and drivers (progress, status, and results)
            • Number of applicable updates, importance, type
            • Update download size and source - CDN or LAN peers
            • Delay upgrade status and configuration
            • OS uninstall and rollback status and count
            • Windows Update server and service URL
            • Windows Update machine ID
            • Windows Insider build details
            ## Browsing History data @@ -98,7 +98,7 @@ This type of data includes details about web browsing in the Microsoft browsers. | Category Name | Description and Examples | | - | - | -| Microsoft browser data | Information about Address bar and search box performance on the device such as:
            • Text typed in address bar and search box
            • Text selected for Ask Cortana search
            • Service response time
            • Auto-completed text if there was an auto-complete
            • Navigation suggestions provided based on local history and favorites
            • Browser ID
            • URLs (which may include search terms)
            • Page title
            | +| Microsoft browser data | Information about Address bar and search box performance on the device such as:
            • Text typed in address bar and search box
            • Text selected for Ask Cortana search
            • Service response time
            • Autocompleted text if there was an autocomplete
            • Navigation suggestions provided based on local history and favorites
            • Browser ID
            • URLs (which may include search terms)
            • Page title
            | ## Inking Typing and Speech Utterance data @@ -107,4 +107,4 @@ This type of data gathers details about the voice, inking, and typing input feat | Category Name | Description and Examples | | - | - | -| Voice, inking, and typing | Information about voice, inking and typing features such as:
            • Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
            • Pen gestures (click, double click, pan, zoom, rotate)
            • Palm Touch x,y coordinates
            • Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
            • Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to the user.
            • Text input from Windows Mobile on-screen keyboards except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
            • Text of speech recognition results -- result codes and recognized text
            • Language and model of the recognizer, System Speech language
            • App ID using speech features
            • Whether user is known to be a child
            • Confidence and Success/Failure of speech recognition
            | +| Voice, inking, and typing | Information about voice, inking, and typing features such as:
            • Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
            • Pen gestures (click, double-click, pan, zoom, rotate)
            • Palm Touch x,y coordinates
            • Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
            • Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to the user.
            • Text input from Windows Mobile on-screen keyboards except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
            • Text of speech recognition results - result codes and recognized text
            • Language and model of the recognizer, System Speech language
            • App ID using speech features
            • Whether user is known to be a child
            • Confidence and Success/Failure of speech recognition
            | diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md index 85c77ad883..2fc94568eb 100644 --- a/windows/privacy/windows-diagnostic-data.md +++ b/windows/privacy/windows-diagnostic-data.md @@ -1,6 +1,6 @@ --- -title: Windows 10, version 1709 and newer diagnostic data for the Full level (Windows 10) -description: Use this article to learn about the types of diagnostic data that is collected at the Full level. +title: Windows 10, version 1709 and newer optional diagnostic data (Windows 10) +description: Use this article to learn about the types of optional diagnostic data that is collected. keywords: privacy,Windows 10 ms.prod: w10 ms.mktglfcycl: manage @@ -12,22 +12,23 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/04/2019 ms.reviewer: --- -# Windows 10, version 1709 and newer diagnostic data for the Full level +# Windows 10, version 1709 and newer optional diagnostic data Applies to: +- Windows 10, version 20H2 +- Windows 10, version 2004 - Windows 10, version 1909 - Windows 10, version 1903 - Windows 10, version 1809 - Windows 10, version 1803 - Windows 10, version 1709 -Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1903 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). +Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 20H2 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). -In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. +In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology - Cloud computing - Cloud services and devices: Data flow, data categories, and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. The data covered in this article is grouped into the following types: @@ -51,21 +52,21 @@ Header data supports the use of data associated with all diagnostic events. Ther Information that is added to most diagnostic events, if relevant and available: -- Diagnostic level -- Basic or Full, Sample level -- for sampled data, what sample level is this device opted into (8.2.3.2.4 Observed Usage of the Service Capability) +- Diagnostic level - Basic or Full, Sample level - for sampled data, what sample level is this device opted into (8.2.3.2.4 Observed Usage of the Service Capability) - Operating system name, version, build, and locale (8.2.3.2.2 Telemetry data) - Event collection time (8.2.3.2.2 Telemetry data) -- User ID -- a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic - diagnostic data (8.2.5 Account data) +- User ID - a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic - diagnostic data (8.2.5 Account data) - Xbox UserID (8.2.5 Account data) -- Device ID -- This is not the user provided device name, but an ID that is unique for that device. (8.2.3.2.3 Connectivity data) -- Device class -- Desktop, Server, or Mobile (8.2.3.2.3 Connectivity data) -- Environment from which the event was logged -- Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time, such as the amount of time an app is running or between boots of the operating system (8.2.4 Cloud service provider data) +- Device ID - This ID is not the user provided device name, but an ID that is unique for that device. (8.2.3.2.3 Connectivity data) +- Device class - Desktop, Server, or Mobile (8.2.3.2.3 Connectivity data) +- Environment from which the event was logged - Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time, such as the amount of time an app is running or between boots of the operating system (8.2.4 Cloud service provider data) - Diagnostic event name, Event ID, ETW opcode, version, schema signature, keywords, and flags (8.2.4 Cloud service provider data) - HTTP header information, including the IP address. This IP address is the source address that’s provided by the network packet header and received by the diagnostics ingestion service (8.2.4 Cloud service provider data) - Various IDs that are used to correlate and sequence related events together (8.2.4 Cloud service provider data) ## Device, Connectivity, and Configuration data -This type of data includes details about the device, its configuration and connectivity capabilities, and status. Device, Connectivity, and Configuration Data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.3 Connectivity data. +This type of data includes details about the device, its configuration and connectivity capabilities, and status. Device, Connectivity, and Configuration data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.3 Connectivity data. ### Data Use for Device, Connectivity, and Configuration data @@ -87,41 +88,41 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Data about device properties and capabilities is used to provide tips about how to use or configure the device to get the best performance and user experience. -- Data about device capabilities, such as whether the device is pen-enabled, is used to recommend (Microsoft and third-party) apps that are appropriate for the device. These may be free or paid apps. +- Data about device capabilities, such as whether the device is pen-enabled, is used to recommend (Microsoft and third-party) apps that are appropriate for the device. These apps might be free or paid.   ### Data Description for Device, Connectivity, and Configuration data type -**Device properties sub-type:** Information about the operating system and device hardware +**Device properties subtype:** Information about the operating system and device hardware - Operating system - version name, edition - Installation type, subscription status, and genuine operating system status - Processor architecture, speed, number of cores, manufacturer, and model -- OEM details --manufacturer, model, and serial number +- OEM details - manufacturer, model, and serial number - Device identifier and Xbox serial number -- Firmware/BIOS operating system -- type, manufacturer, model, and version -- Memory -- total memory, video memory, speed, and how much memory is available after the device has reserved memory -- Storage -- total capacity and disk type -- Battery -- charge capacity and InstantOn support +- Firmware/BIOS operating system - type, manufacturer, model, and version +- Memory - total memory, video memory, speed, and how much memory is available after the device has reserved memory +- Storage - total capacity and disk type +- Battery - charge capacity and InstantOn support - Hardware chassis type, color, and form factor -- Is this a virtual machine? +- Is this machine a virtual machine? -**Device capabilities sub-type:** Information about the capabilities of the device +**Device capabilities subtype:** Information about the capabilities of the device -- Camera -- whether the device has a front facing camera, a rear facing camera, or both. -- Touch screen -- Whether the device has a touch screen? If yes, how many hardware touch points are supported? -- Processor capabilities -- CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2 -- Trusted Platform Module (TPM) -- whether a TPM exists and if yes, what version -- Virtualization hardware -- whether an IOMMU exists, whether it includes SLAT support, and whether virtualization is enabled in the firmware -- Voice -- whether voice interaction is supported and the number of active microphones +- Camera - whether the device has a front facing camera, a rear facing camera, or both. +- Touch screen - Does the device have a touch screen? If yes, how many hardware touch points are supported? +- Processor capabilities - CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2 +- Trusted Platform Module (TPM) - whether a TPM exists and if yes, what version +- Virtualization hardware - whether an IOMMU exists, whether it includes SLAT support, and whether virtualization is enabled in the firmware +- Voice - whether voice interaction is supported and the number of active microphones - Number of displays, resolutions, and DPI - Wireless capabilities - OEM or platform face detection - OEM or platform video stabilization and quality-level set - Advanced Camera Capture mode (HDR versus Low Light), OEM versus platform implementation, HDR probability, and Low Light probability -**Device preferences and settings sub-type:** Information about the device settings and user preferences +**Device preferences and settings subtype:** Information about the device settings and user preferences -- User Settings -- System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security +- User Settings - System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security - User-provided device name - Whether device is domain-joined, or cloud-domain joined (for example, part of a company-managed network) - Hashed representation of the domain name @@ -135,7 +136,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - App store update settings - Enterprise OrganizationID, Commercial ID -**Device peripherals sub-type:** Information about the peripherals of the device +**Device peripherals subtype:** Information about the peripherals of the device - Peripheral name, device model, class, manufacturer, and description - Peripheral device state, install state, and checksum @@ -144,7 +145,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Driver state, problem code, and checksum - Whether driver is kernel mode, signed, and image size -**Device network info sub-type:** Information about the device network configuration +**Device network info subtype:** Information about the device network configuration - Network system capabilities - Local or Internet connectivity status @@ -169,7 +170,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO) - Mobile operator and service provider name - Available SSIDs and BSSIDs -- IP Address type -- IPv4 or IPv6 +- IP Address type - IPv4 or IPv6 - Signal Quality percentage and changes - Hotspot presence detection and success rate - TCP connection performance @@ -177,7 +178,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Hashed IP address ## Product and Service Usage data -This type of data includes details about the usage of the device, operating system, applications and services. Product and Service Usage data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.4 Observed Usage of the Service Capability. +This type of data includes details about the usage of the device, operating system, applications, and services. Product and Service Usage data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.4 Observed Usage of the Service Capability. ### Data Use for Product and Service Usage data @@ -194,16 +195,16 @@ This type of data includes details about the usage of the device, operating syst **With (optional) Tailored experiences:**
            If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Usage data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Product and Service Usage data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users. For example: -- If data shows that a user has not used a particular feature of Windows, we may recommend that the user try that feature. -- Data about which apps are most-used on a device is used to provide recommendations for similar or complementary (Microsoft or third-party) apps. These may be free or paid apps. +- If data shows that a user has not used a particular feature of Windows, we might recommend that the user try that feature. +- Data about which apps are most-used on a device is used to provide recommendations for similar or complementary (Microsoft or third-party) apps. These apps might be free or paid. ### Data Description for Product and Service Usage data type -**App usage sub-type:** Information about Windows and application usage +**App usage subtype:** Information about Windows and application usage - Operating system component and app feature usage -- User navigation and interaction with app and Windows features. This could potentially include user input, such as name of a new alarm set, user menu choices, or user favorites +- User navigation and interaction with app and Windows features. This information could include user input, such as the name of a new alarm set, user menu choices, or user favorites - Time of and count of app and component launches, duration of use, session GUID, and process ID - App time in various states –- running in the foreground or background, sleeping, or receiving active user interaction - User interaction method and duration –- whether the user used a keyboard, mouse, pen, touch, speech, or game controller, and for how long @@ -214,9 +215,9 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Incoming and outgoing calls and voicemail usage statistics on primary or secondary lines - Emergency alerts are received or displayed statistics - Content searches within an app -- Reading activity -- bookmarked, printed, or had the layout changed +- Reading activity - bookmarked, printed, or had the layout changed -**App or product state sub-type:** Information about Windows and application state +**App or product state subtype:** Information about Windows and application state - Start Menu and Taskbar pins - Online and offline status @@ -224,18 +225,18 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Personalization impressions delivered - Whether the user clicked on, or hovered over, UI controls or hotspots - User provided feedback, such as Like, Dislike or a rating -- Caret location or position within documents and media files -- how much has been read in a book in a single session, or how much of a song has been listened to. +- Caret location or position within documents and media files - how much has been read in a book in a single session, or how much of a song has been listened to. -**Purchasing sub-type:** Information about purchases made on the device +**Purchasing subtype:** Information about purchases made on the device -- Product ID, edition ID and product URI -- Offer details -- price +- Product ID, edition ID, and product URI +- Offer details - price - Date and time an order was requested -- Microsoft Store client type -- web or native client +- Microsoft Store client type - web or native client - Purchase quantity and price -- Payment type -- credit card type and PayPal +- Payment type - credit card type and PayPal -**Login properties sub-type:** Information about logins on the device +**Login properties subtype:** Information about logins on the device - Login success or failure - Login sessions and state @@ -258,21 +259,21 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Data about battery performance on a device may be used to recommend settings changes that can improve battery performance. - If data shows a device is running low on file storage, we may recommend Windows-compatible cloud storage solutions to free up space. -- If data shows the device is experiencing performance issues, we may provide recommendations for Windows apps that can help diagnose or resolve these issues. These may be free or paid apps. +- If data shows the device is experiencing performance issues, we may provide recommendations for Windows apps that can help diagnose or resolve these issues. These apps might be free or paid. **Microsoft doesn't use crash and hang dump data to [personalize](#personalize), [recommend](#recommend), [offer](#offer), or [promote](#promote) any product or service.** ### Data Description for Product and Service Performance data type -**Device health and crash data sub-type:** Information about the device and software health +**Device health and crash data subtype:** Information about the device and software health - Error codes and error messages, name and ID of the app, and process reporting the error -- DLL library predicted to be the source of the error -- for example, xyz.dll -- System generated files -- app or product logs and trace files to help diagnose a crash or hang +- DLL library predicted to be the source of the error - for example, xyz.dll +- System-generated files - app or product logs and trace files to help diagnose a crash or hang - System settings, such as registry keys -- User generated files -- files that are indicated as a potential cause for a crash or hang. For example, .doc, .ppt, .csv files +- User-generated files - files that are indicated as a potential cause for a crash or hang. For example, .doc, .ppt, .csv files - Details and counts of abnormal shutdowns, hangs, and crashes -- Crash failure data -- operating system, operating system component, driver, device, and 1st and 3rd-party app data +- Crash failure data - operating system, operating system component, driver, device, and first-party and third-party app data - Crash and hang dumps, including: - The recorded state of the working memory at the point of the crash - Memory in-use by the kernel at the point of the crash. @@ -280,43 +281,43 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - All the physical memory used by Windows at the point of the crash - Class and function name within the module that failed. -**Device performance and reliability data sub-type:** Information about the device and software performance +**Device performance and reliability data subtype:** Information about the device and software performance -- User interface interaction durations -- Start menu display times, browser tab switch times, app launch and switch times, and Cortana and Search performance and reliability -- Device on and off performance -- Device boot, shutdown, power on and off, lock and unlock times, and user authentication times (fingerprint and face recognition durations) -- In-app responsiveness -- time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction -- User input responsiveness -- onscreen keyboard invocation times for different languages, time to show auto-complete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score -- UI and media performance and glitches versus smoothness -- video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance -- Disk footprint -- Free disk space, out of memory conditions, and disk score -- Excessive resource utilization -- components impacting performance or battery life through high CPU usage during different screen and power states -- Background task performance -- download times, Windows Update scan duration, Windows Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results -- Peripheral and devices -- USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness, and environmental response times -- Device setup -- first setup experience times (time to install updates, install apps, connect to network, and so on), time to recognize connected devices (printer and monitor), and time to set up a Microsoft Account -- Power and Battery life -- power draw by component (Process/CPU/GPU/Display), hours of time the screen is off, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use while the screen is off, auto-brightness details, time device is plugged into AC versus battery, and battery state transitions -- Service responsiveness -- Service URI, operation, latency, service success and error codes, and protocol -- Diagnostic heartbeat -- regular signal used to validate the health of the diagnostics system +- User interface interaction durations - Start menu display times, browser tab switch times, app launch and switch times, and Cortana and Search performance and reliability +- Device on and off performance - Device boot, shutdown, power on and off, lock and unlock times, and user authentication times (fingerprint and face recognition durations) +- In-app responsiveness - time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction +- User input responsiveness - onscreen keyboard invocation times for different languages, time to show autocomplete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score +- UI and media performance and glitches versus smoothness - video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance +- Disk footprint - Free disk space, out of memory conditions, and disk score +- Excessive resource utilization - components impacting performance or battery life through high CPU usage during different screen and power states +- Background task performance - download times, Windows Update scan duration, Microsoft Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results +- Peripheral and devices - USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness, and environmental response times +- Device setup - first setup experience times (time to install updates, install apps, connect to network, and so on), time to recognize connected devices (printer and monitor), and time to set up a Microsoft Account +- Power and Battery life - power draw by component (Process/CPU/GPU/Display), hours of time the screen is off, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use while the screen is off, autobrightness details, time device is plugged into AC versus battery, and battery state transitions +- Service responsiveness - Service URI, operation, latency, service success and error codes, and protocol +- Diagnostic heartbeat - regular signal used to validate the health of the diagnostics system -**Movies sub-type:** Information about movie consumption functionality on the device +**Movies subtype:** Information about movie consumption functionality on the device > [!NOTE] > This isn't intended to capture user viewing, listening, or habits. - Video Width, height, color palette, encoding (compression) type, and encryption type -- Instructions about how to stream content for the user -- the smooth streaming manifest of content file chunks that must be pieced together to stream the content based on screen resolution and bandwidth +- Instructions about how to stream content for the user - the smooth streaming manifest of content file chunks that must be pieced together to stream the content based on screen resolution and bandwidth - URL for a specific two-second chunk of content if there is an error - Full-screen viewing mode details -**Music & TV sub-type:** Information about music and TV consumption on the device +**Music & TV subtype:** Information about music and TV consumption on the device > [!NOTE] > This isn't intended to capture user viewing, listening, or habits. -- Service URL for song being downloaded from the music service -- collected when an error occurs to facilitate restoration of service +- Service URL for song being downloaded from the music service - collected when an error occurs to facilitate restoration of service - Content type (video, audio, or surround audio) -- Local media library collection statistics -- number of purchased tracks and number of playlists -- Region mismatch -- User's operating system region and Xbox Live region +- Local media library collection statistics - number of purchased tracks and number of playlists +- Region mismatch - User's operating system region and Xbox Live region -**Reading sub-type:** Information about reading consumption functionality on the device +**Reading subtype:** Information about reading consumption functionality on the device > [!NOTE] > This isn't intended to capture user viewing, listening, or habits. @@ -326,42 +327,42 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Time spent reading content - Content type and size details -**Photos app sub-type:** Information about photos usage on the device +**Photos app subtype:** Information about photos usage on the device > [!NOTE] > This isn't intended to capture user viewing, listening, or habits. -- File source data -- local, SD card, network device, and OneDrive +- File source data - local, SD card, network device, and OneDrive - Image and video resolution, video length, file sizes types, and encoding - Collection view or full screen viewer use and duration of view -**On-device file query sub-type:** Information about local search activity on the device +**On-device file query subtype:** Information about local search activity on the device -- Kind of query issued and index type (ConstraintIndex or SystemIndex) +- Type of query issued and index type (ConstraintIndex or SystemIndex) - Number of items requested and retrieved - File extension of search result with which the user interacted - Launched item type, file extension, index of origin, and the App ID of the opening app - Name of process calling the indexer and the amount of time to service the query - A hash of the search scope (file, Outlook, OneNote, or IE history). The state of the indices (fully optimized, partially optimized, or being built) -**Entitlements sub-type:** Information about entitlements on the device +**Entitlements subtype:** Information about entitlements on the device - Service subscription status and errors -- DRM and license rights details -- Groove subscription or operating system volume license +- DRM and license rights details - Groove subscription or operating system volume license - Entitlement ID, lease ID, and package ID of the install package - Entitlement revocation - License type (trial, offline versus online) and duration - License usage session ## Software Setup and Inventory data -This type of data includes software installation and update information on the device. Software Setup and Inventory Data is a sub-type of ISO/IEC 19944:2017 8.2.3.2.4 Observed Usage of the Service Capability. +This type of data includes software installation and update information on the device. Software Setup and Inventory Data is a subtype of ISO/IEC 19944:2017 8.2.3.2.4 Observed Usage of the Service Capability. ### Data Use for Software Setup and Inventory data **For Diagnostics:**
            [Pseudonymized](#pseudo) Software Setup and Inventory data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example: -- Data about the specific drivers that are installed on a device is used to understand whether there are any hardware or driver compatibility issues which should block or delay a Windows update. +- Data about the specific drivers that are installed on a device is used to understand whether there are any hardware or driver compatibility issues that should block or delay a Windows update. - Data about when a download starts and finishes on a device is used to understand and address download problems. - Data about the specific Microsoft Store apps that are installed on a device is used to determine which app updates to provide to the device. - Data about the antimalware installed on a device is used to understand malware transmissions vectors. @@ -373,7 +374,7 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud ### Data Description for Software Setup and Inventory data type -**Installed applications and install history sub-type:** Information about apps, drivers, update packages, or operating system components installed on the device +**Installed applications and install history subtype:** Information about apps, drivers, update packages, or operating system components installed on the device - App, driver, update package, or component’s Name, ID, or Package Family Name - Product, SKU, availability, catalog, content, and Bundle IDs @@ -382,13 +383,13 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - MSI package and product code - Original operating system version at install time - User, administrator, or mandatory installation or update -- Installation type -- clean install, repair, restore, OEM, retail, upgrade, or update +- Installation type - clean install, repair, restore, OEM, retail, upgrade, or update -**Device update information sub-type:** Information about apps, drivers, update packages, or operating system components installed on the device +**Device update information subtype:** Information about apps, drivers, update packages, or operating system components installed on the device - Update Readiness analysis of device hardware, operating system components, apps, and drivers (progress, status, and results) - Number of applicable updates, importance, and type -- Update download size and source -- CDN or LAN peers +- Update download size and source - CDN or LAN peers - Delay upgrade status and configuration - Operating system uninstall and rollback status and count - Windows Update server and service URL @@ -396,7 +397,7 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Windows Insider build details ## Browsing History data -This type of data includes details about web browsing in the Microsoft browsers. Browsing History data is equivalent to ISO/IEC 19944:2017 8.2.3.2.8 Client side browsing history. +This type of data includes details about web browsing in the Microsoft browsers. Browsing History data is equivalent to ISO/IEC 19944:2017 8.2.3.2.8 Client-side browsing history. ### Data Use for Browsing History data @@ -412,23 +413,23 @@ This type of data includes details about web browsing in the Microsoft browsers. **With (optional) Tailored experiences:**
            If a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Browsing History data from Windows 10 is used by Microsoft to [personalize](#personalize), [recommend](#recommend), and [offer](#offer) Microsoft products and services to Windows 10 users. Also, if a user has enabled Tailored experiences on the device, [pseudonymized](#pseudo) Browsing History data from Windows 10 is used by Microsoft to [promote](#promote) third-party Windows apps, services, hardware, and peripherals to Windows 10 users. For example: -- We may recommend that a user download a compatible app from the Microsoft Store if they have browsed to the related website. For example, if a user uses the Facebook website, we may recommend the Facebook app. +- We might recommend that a user download a compatible app from the Microsoft Store if they have browsed to the related website. For example, if a user uses the Facebook website, we may recommend the Facebook app. ### Data Description for Browsing History data type -**Microsoft browser data sub-type:** Information about **Address** bar and **Search** box performance on the device +**Microsoft browser data subtype:** Information about **Address** bar and **Search** box performance on the device - Text typed in **Address** bar and **Search** box - Text selected for an Ask Cortana search - Service response time -- Auto-completed text, if there was an auto-complete +- Autocompleted text, if there was an autocomplete - Navigation suggestions provided based on local history and favorites - Browser ID - URLs (may include search terms) - Page title ## Inking Typing and Speech Utterance data -This type of data gathers details about the voice, inking, and typing input features on the device. Inking, Typing and Speech Utterance data is a sub-type of ISO/IEC 19944:2017 8.2.3.2.1 End User Identifiable information. +This type of data gathers details about the voice, inking, and typing input features on the device. Inking, Typing, and Speech Utterance data is a subtype of ISO/IEC 19944:2017 8.2.3.2.1 End User Identifiable information. ### Data Use for Inking, Typing, and Speech Utterance data @@ -437,7 +438,7 @@ This type of data gathers details about the voice, inking, and typing input feat - Data about words marked as spelling mistakes and replaced with another word from the context menu is used to improve the spelling feature. - Data about alternate words shown and selected by the user after right-clicking is used to improve the word recommendation feature. -- Data about auto-corrected words that were restored back to the original word by the user is used to improve the auto-correct feature. +- Data about autocorrected words that were restored back to the original word by the user is used to improve the autocorrect feature. - Data about whether Narrator detected and recognized a touch gesture is used to improve touch gesture recognition. - Data about handwriting samples sent from the Handwriting Panel is used to help Microsoft improve handwriting recognition. @@ -447,15 +448,15 @@ This type of data gathers details about the voice, inking, and typing input feat ### Data Description for Inking, Typing, and Speech Utterance data type -**Voice, inking, and typing sub-type:** Information about voice, inking and typing features +**Voice, inking, and typing subtype:** Information about voice, inking, and typing features - Type of pen used (highlighter, ball point, or pencil), pen color, stroke height and width, and how long it is used - Pen gestures (click, double click, pan, zoom, or rotate) - Palm Touch x,y coordinates - Input latency, missed pen signals, number of frames, strokes, first frame commit time, and sample rate -- Ink strokes written, text before and after the ink insertion point, recognized text entered, input language -- processed to remove identifiers, sequencing information, and other data (such as email addresses and - numeric values), which could be used to reconstruct the original content or associate the input to the user -- Text input from Windows 10 Mobile on-screen keyboards, except from password fields and private sessions -- processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values), which could be used to reconstruct the original content or associate the input to the user -- Text of speech recognition results -- result codes and recognized text +- Ink strokes written, text before and after the ink insertion point, recognized text entered, input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and - numeric values), which could be used to reconstruct the original content or associate the input to the user +- Text input from Windows 10 Mobile on-screen keyboards, except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values), which could be used to reconstruct the original content or associate the input to the user +- Text of speech recognition results - result codes and recognized text - Language and model of the recognizer and the System Speech language - App ID using speech features - Whether user is known to be a child @@ -495,9 +496,9 @@ Use of the specified data categories give recommendations about Microsoft produc ISO/IEC 19944:2017 Reference: **9.3.5 Offer upgrades or upsell** -Implies the source of the data is Microsoft products and services, and the upgrades offered come from Microsoft products and services that are relevant to the context of the current capability. The target audience for the offer is Microsoft customers. +Implies that the source of the data is Microsoft products and services, and the upgrades offered come from Microsoft products and services that are relevant to the context of the current capability. The target audience for the offer is Microsoft customers. -Specifically, use of the specified data categories to make an offer or upsell new capability or capacity of a Microsoft product or service which is (i) contextually relevant to the product or service in which it appears; (ii) likely to result in additional future revenue for Microsoft from end user; and (iii) Microsoft receives no consideration for placement. +Specifically, use of the specified data categories to make an offer or upsell new capability or capacity of a Microsoft product or service that is (i) contextually relevant to the product or service in which it appears; (ii) likely to result in additional future revenue for Microsoft from end user; and (iii) Microsoft receives no consideration for placement. ### Promote @@ -507,7 +508,7 @@ Use of the specified data categories to promote a product or service in or on a ### Data identification qualifiers -Here are the list of data identification qualifiers and the ISO/IEC 19944:2017 reference: +Here are the data identification qualifiers and the ISO/IEC 19944:2017 reference: - **Pseudonymized Data** 8.3.3 Pseudonymized data. Microsoft usage notes are as defined. - **Anonymized Data** 8.3.5 Anonymized data. Microsoft usage notes are as defined. diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md index b9920c7acc..da43880ca5 100644 --- a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md @@ -8,12 +8,13 @@ ms.sitesec: library ms.localizationpriority: high audience: ITPro author: mikeedgar -ms.author: v-medgar -manager: sanashar +ms.author: obezeajo +manager: robsize ms.collection: M365-security-compliance ms.topic: article -ms.date: 5/9/2019 +ms.date: 7/22/2020 --- + # Windows 10, version 1903, connection endpoints for non-Enterprise editions **Applies to** @@ -26,14 +27,14 @@ In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-1 The following methodology was used to derive the network endpoints: -1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). -3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. -5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. -7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. -8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using an IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. > [!NOTE] @@ -41,234 +42,235 @@ The following methodology was used to derive the network endpoints: ## Windows 10 Family -| **Destination** | **Protocol** | **Description** | -| --- | --- | --- | -|\*.aria.microsoft.com*|HTTPS|Microsoft Office Telemetry -|\*.b.akamai*.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use -|\*.c-msedge.net|HTTP|Microsoft Office -|\*.dl.delivery.mp.microsoft.com*|HTTP|Enables connections to Windows Update -|\*.download.windowsupdate.com*|HTTP|Used to download operating system patches and updates -|\*.g.akamai*.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use -|\*.login.msa.*.net|HTTPS|Microsoft Account related -|\*.msn.com*|TLSv1.2/HTTPS|Windows Spotlight -|\*.skype.com|HTTP/HTTPS|Skype -|\*.smartscreen.microsoft.com*|HTTPS|Windows Defender Smartscreen -|\*.telecommand.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting -|*cdn.onenote.net*|HTTP|OneNote -|*displaycatalog.*mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store -|*emdl.ws.microsoft.com*|HTTP|Windows Update -|*geo-prod.do.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update -|*hwcdn.net*|HTTP|Highwinds Content Delivery Network / Windows updates -|*img-prod-cms-rt-microsoft-com*|HTTPS|Microsoft Store or Inbox MSN Apps image download -|*licensing.*mp.microsoft.com*|HTTPS|Licensing -|*maps.windows.com*|HTTPS|Related to Maps application -|*msedge.net*|HTTPS|Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps -|*nexusrules.officeapps.live.com*|HTTPS|Microsoft Office Telemetry -|*photos.microsoft.com*|HTTPS|Photos App -|*prod.do.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Used for Windows Update downloads of apps and OS updates -|*purchase.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store -|*settings.data.microsoft.com.akadns.net|HTTPS|Used for Windows apps to dynamically update their configuration -|*wac.phicdn.net*|HTTP|Windows Update -|*windowsupdate.com*|HTTP|Windows Update -|*wns.*windows.com*|TLSv1.2/HTTPS|Used for the Windows Push Notification Services (WNS) -|*wpc.v0cdn.net*|HTTP|Windows Telemetry -|arc.msn.com|HTTPS|Spotlight -|auth.gfx.ms*|HTTPS|MSA related -|cdn.onenote.net|HTTPS|OneNote Live Tile -|dmd.metaservices.microsoft.com*|HTTP|Device Authentication -|e-0009.e-msedge.net|HTTPS|Microsoft Office -|e10198.b.akamaiedge.net|HTTPS|Maps application -|evoke-windowsservices-tas.msedge*|HTTPS|Photos app -|fe2.update.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store -|fe3.*.mp.microsoft.com.*|TLSv1.2/HTTPS|Windows Update, Microsoft Update, and Microsoft Store services -|g.live.com*|HTTPS|OneDrive -|go.microsoft.com|HTTP|Windows Defender -|iriscoremetadataprod.blob.core.windows.net|HTTPS|Windows Telemetry -|login.live.com|HTTPS|Device Authentication -|msagfx.live.com|HTTP|OneDrive -|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities -|officeclient.microsoft.com|HTTPS|Microsoft Office -|oneclient.sfx.ms*|HTTPS|Used by OneDrive for Business to download and verify app updates -|onecollector.cloudapp.aria.akadns.net|HTTPS|Microsoft Office -|ow1.res.office365.com|HTTP|Microsoft Office -|pti.store.microsoft.com|HTTPS|Microsoft Store -|purchase.mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store -|query.prod.cms.rt.microsoft.com*|HTTPS|Used to retrieve Windows Spotlight metadata -|ris.api.iris.microsoft.com*|TLSv1.2/HTTPS|Used to retrieve Windows Spotlight metadata -|ris-prod-atm.trafficmanager.net|HTTPS|Azure traffic manager -|s-0001.s-msedge.net|HTTPS|Microsoft Office -|self.events.data.microsoft.com|HTTPS|Microsoft Office -|settings.data.microsoft.com*|HTTPS|Used for Windows apps to dynamically update their configuration -|settings-win.data.microsoft.com*|HTTPS|Used for Windows apps to dynamically update their configuration -|share.microsoft.com|HTTPS|Microsoft Store -|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Microsoft Store -|sls.update.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update -|slscr.update.microsoft.com*|HTTPS|Enables connections to Windows Update -|store*.dsx.mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store -|storecatalogrevocation.storequality.microsoft.com|HTTPS|Microsoft Store -|storecatalogrevocation.storequality.microsoft.com*|HTTPS|Used to revoke licenses for malicious apps on the Microsoft Store -|store-images.*microsoft.com*|HTTP|Used to get images that are used for Microsoft Store suggestions -|storesdk.dsx.mp.microsoft.com|HTTP|Microsoft Store -|tile-service.weather.microsoft.com*|HTTP|Used to download updates to the Weather app Live Tile -|time.windows.com|HTTP|Microsoft Windows Time related -|tsfe.trafficshaping.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Used for content regulation -|v10.events.data.microsoft.com|HTTPS|Diagnostic Data -|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data -|wdcp.microsoft.*|TLSv1.2, HTTPS|Used for Windows Defender when Cloud-based Protection is enabled -|wd-prod-cp-us-west-1-fe.westus.cloudapp.azure.com|HTTPS|Windows Defender -|wusofficehome.msocdn.com|HTTPS|Microsoft Office -|www.bing.com*|HTTP|Used for updates for Cortana, apps, and Live Tiles -|www.msftconnecttest.com|HTTP|Network Connection (NCSI) -|www.office.com|HTTPS|Microsoft Office +| Destination | Protocol | Description | +| ----------- | -------- | ----------- | +| \*.aria.microsoft.com\* | HTTPS | Microsoft Office Telemetry +| \*.b.akamai\*.net | HTTPS | Used to check for updates to Maps that have been downloaded for offline use +| \*.c-msedge.net | HTTP | Microsoft Office +| \*.dl.delivery.mp.microsoft.com\* | HTTP | Enables connections to Windows Update +| \*.download.windowsupdate.com\* | HTTP | Used to download operating system patches and updates +| \*.g.akamai\*.net | HTTPS | Used to check for updates to Maps that have been downloaded for offline use +| \*.login.msa.\*.net | HTTPS | Microsoft Account related +| \*.msn.com\* | TLSv1.2/HTTPS | Windows Spotlight +| \*.skype.com | HTTP/HTTPS | Skype +| \*.smartscreen.microsoft.com\* | HTTPS | Windows Defender Smartscreen +| \*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting +| \*cdn.onenote.net\* | HTTP | OneNote +| \*displaycatalog.\*mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store +| \*emdl.ws.microsoft.com\* | HTTP | Windows Update +| \*geo-prod.do.dsp.mp.microsoft.com\* | TLSv1.2/HTTPS | Enables connections to Windows Update +| \*hwcdn.net\* | HTTP | Highwinds Content Delivery Network / Windows updates +| \*img-prod-cms-rt-microsoft-com\* | HTTPS | Microsoft Store or Inbox MSN Apps image download +| \*licensing.\*mp.microsoft.com\* | HTTPS | Licensing +| \*maps.windows.com\* | HTTPS | Related to Maps application +| \*msedge.net\* | HTTPS | Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps +| \*nexusrules.officeapps.live.com\* | HTTPS | Microsoft Office Telemetry +| \*photos.microsoft.com\* | HTTPS | Photos App +| \*prod.do.dsp.mp.microsoft.com* | TLSv1.2/HTTPS | Used for Windows Update downloads of apps and OS updates +| \*purchase.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store +| \*settings.data.microsoft.com.akadns.net | HTTPS | Used for Windows apps to dynamically update their configuration +| \*wac.phicdn.net\* | HTTP | Windows Update +| \*windowsupdate.com\* | HTTP | Windows Update +| \*wns.\*windows.com\* | TLSv1.2/HTTPS | Used for the Windows Push Notification Services (WNS) +| \*wpc.v0cdn.net\* | HTTP | Windows Telemetry +| arc.msn.com | HTTPS | Spotlight +| auth.gfx.ms\* | HTTPS | MSA related +| cdn.onenote.net | HTTPS | OneNote Live Tile +| dmd.metaservices.microsoft.com\* | HTTP | Device Authentication +| e-0009.e-msedge.net | HTTPS | Microsoft Office +| e10198.b.akamaiedge.net | HTTPS | Maps application +| evoke-windowsservices-tas.msedge\* | HTTPS | Photos app +| fe2.update.microsoft.com\* | TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +| fe3.\*.mp.microsoft.com.\* | TLSv1.2/HTTPS | Windows Update, Microsoft Update, and Microsoft Store services +| g.live.com\* | HTTPS | OneDrive +| go.microsoft.com | HTTP | Windows Defender +| iriscoremetadataprod.blob.core.windows.net | HTTPS | Windows Telemetry +| login.live.com | HTTPS | Device Authentication +| msagfx.live.com | HTTP | OneDrive +| ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities +| officeclient.microsoft.com | HTTPS | Microsoft Office +| oneclient.sfx.ms\* | HTTPS | Used by OneDrive for Business to download and verify app updates +| onecollector.cloudapp.aria.akadns.net | HTTPS | Microsoft Office +| ow1.res.office365.com | HTTP | Microsoft Office +| pti.store.microsoft.com | HTTPS | Microsoft Store +| purchase.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store +| query.prod.cms.rt.microsoft.com\* | HTTPS | Used to retrieve Windows Spotlight metadata +| ris.api.iris.microsoft.com\* | TLSv1.2/HTTPS | Used to retrieve Windows Spotlight metadata +| ris-prod-atm.trafficmanager.net | HTTPS | Azure traffic manager +| s-0001.s-msedge.net | HTTPS | Microsoft Office +| self.events.data.microsoft.com | HTTPS | Microsoft Office +| settings.data.microsoft.com\* | HTTPS | Used for Windows apps to dynamically update their configuration +| settings-win.data.microsoft.com\* | HTTPS | Used for Windows apps to dynamically update their configuration +| share.microsoft.com | HTTPS | Microsoft Store +| skypeecs-prod-usw-0.cloudapp.net | HTTPS | Microsoft Store +| sls.update.microsoft.com\* | TLSv1.2/HTTPS | Enables connections to Windows Update +| slscr.update.microsoft.com\* | HTTPS | Enables connections to Windows Update +| store*.dsx.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store +| storecatalogrevocation.storequality.microsoft.com | HTTPS | Microsoft Store +| storecatalogrevocation.storequality.microsoft.com\* | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store +| store-images.\*microsoft.com\* | HTTP | Used to get images that are used for Microsoft Store suggestions +| storesdk.dsx.mp.microsoft.com | HTTP | Microsoft Store +| tile-service.weather.microsoft.com\* | HTTP | Used to download updates to the Weather app Live Tile +| time.windows.com | HTTP | Microsoft Windows Time related +| tsfe.trafficshaping.dsp.mp.microsoft.com\* | TLSv1.2/HTTPS | Used for content regulation +| v10.events.data.microsoft.com | HTTPS | Diagnostic Data +| watson.telemetry.microsoft.com | HTTPS | Diagnostic Data +| wdcp.microsoft.\* | TLSv1.2, HTTPS | Used for Windows Defender when Cloud-based Protection is enabled +| wd-prod-cp-us-west-1-fe.westus.cloudapp.azure.com | HTTPS | Windows Defender +| wusofficehome.msocdn.com | HTTPS | Microsoft Office +| `www.bing.com`* | HTTP | Used for updates for Cortana, apps, and Live Tiles +| `www.msftconnecttest.com` | HTTP | Network Connection (NCSI) +| `www.office.com` | HTTPS | Microsoft Office +| adl.windows.com | HTTP | Used for compatibility database updates for Windows +| windows.policies.live.net | HTTP | OneDrive ## Windows 10 Pro -| **Destination** | **Protocol** | **Description** | -| --- | --- | --- | -|\*.cloudapp.azure.com|HTTPS|Azure -|\*.delivery.dsp.mp.microsoft.com.nsatc.net|HTTPS|Windows Update, Microsoft Update, and Microsoft Store services -|\*.displaycatalog.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store -|\*.dl.delivery.mp.microsoft.com*|HTTP|Enables connections to Windows Update -|\*.e-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps -|\*.g.akamaiedge.net|HTTPS|Used to check for updates to maps that have been downloaded for offline use -|\*.s-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps -|\*.windowsupdate.com*|HTTP|Enables connections to Windows Update -|\*.wns.notify.windows.com.akadns.net|HTTPS|Used for the Windows Push Notification Services (WNS) -|\*dsp.mp.microsoft.com.nsatc.net|HTTPS|Enables connections to Windows Update -|\*c-msedge.net|HTTP|Office -|a1158.g.akamai.net|HTTP|Maps application -|arc.msn.com*|HTTP / HTTPS|Used to retrieve Windows Spotlight metadata -|blob.mwh01prdstr06a.store.core.windows.net|HTTPS|Microsoft Store -|browser.pipe.aria.microsoft.com|HTTPS|Microsoft Office -|bubblewitch3mobile.king.com|HTTPS|Bubble Witch application -|candycrush.king.com|HTTPS|Candy Crush application -|cdn.onenote.net|HTTP|Microsoft OneNote -|cds.p9u4n2q3.hwcdn.net|HTTP|Highwinds Content Delivery Network traffic for Windows updates -|client.wns.windows.com|HTTPS|Winddows Notification System -|co4.telecommand.telemetry.microsoft.com.akadns.net|HTTPS|Windows Error Reporting -|config.edge.skype.com|HTTPS|Microsoft Skype -|cs11.wpc.v0cdn.net|HTTP|Windows Telemetry -|cs9.wac.phicdn.net|HTTP|Windows Update -|cy2.licensing.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store -|cy2.purchase.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store -|cy2.settings.data.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store -|dmd.metaservices.microsoft.com.akadns.net|HTTP|Device Authentication -|e-0009.e-msedge.net|HTTPS|Microsoft Office -|e10198.b.akamaiedge.net|HTTPS|Maps application -|fe3.update.microsoft.com|HTTPS|Windows Update -|g.live.com|HTTPS|Microsoft OneDrive -|g.msn.com.nsatc.net|HTTPS|Used to retrieve Windows Spotlight metadata -|geo-prod.do.dsp.mp.microsoft.com|HTTPS|Windows Update -|go.microsoft.com|HTTP|Windows Defender -|iecvlist.microsoft.com|HTTPS|Microsoft Edge -|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP / HTTPS|Microsoft Store -|ipv4.login.msa.akadns6.net|HTTPS|Used for Microsoft accounts to sign in -|licensing.mp.microsoft.com|HTTP|Licensing -|location-inference-westus.cloudapp.net|HTTPS|Used for location data -|login.live.com|HTTP|Device Authentication -|maps.windows.com|HTTP|Maps application -|modern.watson.data.microsoft.com.akadns.net|HTTPS|Used by Windows Error Reporting -|msagfx.live.com|HTTP|OneDrive -|nav.smartscreen.microsoft.com|HTTPS|Windows Defender -|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities -|oneclient.sfx.ms|HTTP|OneDrive -|pti.store.microsoft.com|HTTPS|Microsoft Store -|ris.api.iris.microsoft.com.akadns.net|HTTPS|Used to retrieve Windows Spotlight metadata -|ris-prod-atm.trafficmanager.net|HTTPS|Azure -|s2s.config.skype.com|HTTP|Microsoft Skype -|settings-win.data.microsoft.com|HTTPS|Application settings -|share.microsoft.com|HTTPS|Microsoft Store -|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Microsoft Skype -|slscr.update.microsoft.com|HTTPS|Windows Update -|storecatalogrevocation.storequality.microsoft.com|HTTPS|Microsoft Store -|store-images.microsoft.com|HTTPS|Microsoft Store -|tile-service.weather.microsoft.com/*|HTTP|Used to download updates to the Weather app Live Tile -|time.windows.com|HTTP|Windows time -|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Used for content regulation -|v10.events.data.microsoft.com*|HTTPS|Microsoft Office -|vip5.afdorigin-prod-am02.afdogw.com|HTTPS|Used to serve office 365 experimentation traffic -|watson.telemetry.microsoft.com|HTTPS|Telemetry -|wdcp.microsoft.com|HTTPS|Windows Defender -|wusofficehome.msocdn.com|HTTPS|Microsoft Office -|www.bing.com|HTTPS|Cortana and Search -|www.microsoft.com|HTTP|Diagnostic -|www.msftconnecttest.com|HTTP|Network connection -|www.office.com|HTTPS|Microsoft Office +| Destination | Protocol | Description | +| ----------- | -------- | ----------- | +| \*.cloudapp.azure.com | HTTPS | Azure +| \*.delivery.dsp.mp.microsoft.com.nsatc.net | HTTPS | Windows Update, Microsoft Update, and Microsoft Store services +| \*.displaycatalog.md.mp.microsoft.com.akadns.net | HTTPS | Microsoft Store +| \*.dl.delivery.mp.microsoft.com\* | HTTP | Enables connections to Windows Update +| \*.e-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps +| \*.g.akamaiedge.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use +| \*.s-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps +| \*.windowsupdate.com\* | HTTP | Enables connections to Windows Update +| \*.wns.notify.windows.com.akadns.net | HTTPS | Used for the Windows Push Notification Services (WNS) +| \*dsp.mp.microsoft.com.nsatc.net | HTTPS | Enables connections to Windows Update +| \*c-msedge.net | HTTP | Office +| a1158.g.akamai.net | HTTP | Maps application +| arc.msn.com\* | HTTP / HTTPS | Used to retrieve Windows Spotlight metadata +| blob.mwh01prdstr06a.store.core.windows.net | HTTPS | Microsoft Store +| browser.pipe.aria.microsoft.com | HTTPS | Microsoft Office +| bubblewitch3mobile.king.com | HTTPS | Bubble Witch application +| candycrush.king.com | HTTPS | Candy Crush application +| cdn.onenote.net | HTTP | Microsoft OneNote +| cds.p9u4n2q3.hwcdn.net | HTTP | Highwinds Content Delivery Network traffic for Windows updates +| client.wns.windows.com | HTTPS | Windows Notification System +| co4.telecommand.telemetry.microsoft.com.akadns.net | HTTPS | Windows Error Reporting +| config.edge.skype.com | HTTPS | Microsoft Skype +| cs11.wpc.v0cdn.net | HTTP | Windows Telemetry +| cs9.wac.phicdn.net | HTTP | Windows Update +| cy2.licensing.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store +| cy2.purchase.md.mp.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store +| cy2.settings.data.microsoft.com.akadns.net | HTTPS | Used to communicate with Microsoft Store +| dmd.metaservices.microsoft.com.akadns.net | HTTP | Device Authentication +| e-0009.e-msedge.net | HTTPS | Microsoft Office +| e10198.b.akamaiedge.net | HTTPS | Maps application +| fe3.update.microsoft.com | HTTPS | Windows Update +| g.live.com | HTTPS | Microsoft OneDrive +| g.msn.com.nsatc.net | HTTPS | Used to retrieve Windows Spotlight metadata +| geo-prod.do.dsp.mp.microsoft.com | HTTPS | Windows Update +| go.microsoft.com | HTTP | Windows Defender +| iecvlist.microsoft.com | HTTPS | Microsoft Edge +| img-prod-cms-rt-microsoft-com.akamaized.net | HTTP / HTTPS | Microsoft Store +| ipv4.login.msa.akadns6.net | HTTPS | Used for Microsoft accounts to sign in +| licensing.mp.microsoft.com | HTTP | Licensing +| location-inference-westus.cloudapp.net | HTTPS | Used for location data +| login.live.com | HTTP | Device Authentication +| maps.windows.com | HTTP | Maps application +| modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting +| msagfx.live.com | HTTP | OneDrive +| nav.smartscreen.microsoft.com | HTTPS | Windows Defender +| ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities +| oneclient.sfx.ms | HTTP | OneDrive +| pti.store.microsoft.com | HTTPS | Microsoft Store +| ris.api.iris.microsoft.com.akadns.net | HTTPS | Used to retrieve Windows Spotlight metadata +| ris-prod-atm.trafficmanager.net | HTTPS | Azure +| s2s.config.skype.com | HTTP | Microsoft Skype +| settings-win.data.microsoft.com | HTTPS | Application settings +| share.microsoft.com | HTTPS | Microsoft Store +| skypeecs-prod-usw-0.cloudapp.net | HTTPS | Microsoft Skype +| slscr.update.microsoft.com | HTTPS | Windows Update +| storecatalogrevocation.storequality.microsoft.com | HTTPS | Microsoft Store +| store-images.microsoft.com | HTTPS | Microsoft Store +| tile-service.weather.microsoft.com/\* | HTTP | Used to download updates to the Weather app Live Tile +| time.windows.com | HTTP | Windows time +| tsfe.trafficshaping.dsp.mp.microsoft.com | HTTPS | Used for content regulation +| v10.events.data.microsoft.com\* | HTTPS | Microsoft Office +| vip5.afdorigin-prod-am02.afdogw.com | HTTPS | Used to serve office 365 experimentation traffic +| watson.telemetry.microsoft.com | HTTPS | Telemetry +| wdcp.microsoft.com | HTTPS | Windows Defender +| wusofficehome.msocdn.com | HTTPS | Microsoft Office +| `www.bing.com` | HTTPS | Cortana and Search +| `www.microsoft.com` | HTTP | Diagnostic +| `www.msftconnecttest.com` | HTTP | Network connection +| `www.office.com` | HTTPS | Microsoft Office ## Windows 10 Education -| **Destination** | **Protocol** | **Description** | -| --- | --- | --- | -|\*.b.akamaiedge.net|HTTPS|Used to check for updates to maps that have been downloaded for offline use -|\*.c-msedge.net|HTTP|Used by OfficeHub to get the metadata of Office apps -|\*.dl.delivery.mp.microsoft.com*|HTTP|Windows Update -|\*.e-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps -|\*.g.akamaiedge.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use -|\*.licensing.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store -|\*.settings.data.microsoft.com.akadns.net|HTTPS|Microsoft Store -|\*.skype.com*|HTTPS|Used to retrieve Skype configuration values -|\*.smartscreen*.microsoft.com|HTTPS|Windows Defender -|\*.s-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps -|\*.telecommand.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting -|\*.wac.phicdn.net|HTTP|Windows Update -|\*.windowsupdate.com*|HTTP|Windows Update -|\*.wns.windows.com|HTTPS|Windows Notifications Service -|\*.wpc.*.net|HTTP|Diagnostic Data -|\*displaycatalog.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store -|\*dsp.mp.microsoft.com|HTTPS|Windows Update -|a1158.g.akamai.net|HTTP|Maps -|a122.dscg3.akamai.net|HTTP|Maps -|a767.dscg3.akamai.net|HTTP|Maps -|au.download.windowsupdate.com*|HTTP|Windows Update -|bing.com/*|HTTPS|Used for updates for Cortana, apps, and Live Tiles -|blob.dz5prdstr01a.store.core.windows.net|HTTPS|Microsoft Store -|browser.pipe.aria.microsoft.com|HTTP|Used by OfficeHub to get the metadata of Office apps -|cdn.onenote.net/livetile/*|HTTPS|Used for OneNote Live Tile -|cds.p9u4n2q3.hwcdn.net|HTTP|Used by the Highwinds Content Delivery Network to perform Windows updates -|client-office365-tas.msedge.net/*|HTTPS|Microsoft 365 admin center and Office in a browser -|ctldl.windowsupdate.com*|HTTP|Used to download certificates that are publicly known to be fraudulent -|displaycatalog.mp.microsoft.com/*|HTTPS|Microsoft Store -|dmd.metaservices.microsoft.com*|HTTP|Device Authentication -|download.windowsupdate.com*|HTTPS|Windows Update -|emdl.ws.microsoft.com/*|HTTP|Used to download apps from the Microsoft Store -|evoke-windowsservices-tas.msedge.net|HTTPS|Photo app -|fe2.update.microsoft.com*|HTTPS|Windows Update, Microsoft Update, Microsoft Store services -|fe3.delivery.dsp.mp.microsoft.com.nsatc.net|HTTPS|Windows Update, Microsoft Update, Microsoft Store services -|fe3.delivery.mp.microsoft.com*|HTTPS|Windows Update, Microsoft Update, Microsoft Store services -|g.live.com*|HTTPS|Used by OneDrive for Business to download and verify app updates -|g.msn.com.nsatc.net|HTTPS|Used to retrieve Windows Spotlight metadata -|go.microsoft.com|HTTP|Windows Defender -|iecvlist.microsoft.com|HTTPS|Microsoft Edge browser -|ipv4.login.msa.akadns6.net|HTTPS|Used for Microsoft accounts to sign in -|licensing.mp.microsoft.com*|HTTPS|Used for online activation and some app licensing -|login.live.com|HTTPS|Device Authentication -|maps.windows.com/windows-app-web-link|HTTPS|Maps application -|modern.watson.data.microsoft.com.akadns.net|HTTPS|Used by Windows Error Reporting -|msagfx.live.com|HTTPS|OneDrive -|ocos-office365-s2s.msedge.net/*|HTTPS|Used to connect to the Microsoft 365 admin center's shared infrastructure -|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities -|oneclient.sfx.ms/*|HTTPS|Used by OneDrive for Business to download and verify app updates -|onecollector.cloudapp.aria.akadns.net|HTTPS|Microsoft Office -|pti.store.microsoft.com|HTTPS|Microsoft Store -|settings-win.data.microsoft.com/settings/*|HTTPS|Used as a way for apps to dynamically update their configuration -|share.microsoft.com|HTTPS|Microsoft Store -|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Skype -|sls.update.microsoft.com*|HTTPS|Windows Update -|storecatalogrevocation.storequality.microsoft.com*|HTTPS|Used to revoke licenses for malicious apps on the Microsoft Store -|tile-service.weather.microsoft.com*|HTTP|Used to download updates to the Weather app Live Tile -|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Windows Update -|v10.events.data.microsoft.com*|HTTPS|Diagnostic Data -|vip5.afdorigin-prod-ch02.afdogw.com|HTTPS|Used to serve Office 365 experimentation traffic -|watson.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting -|wdcp.microsoft.com|HTTPS|Windows Defender -|wd-prod-cp-us-east-1-fe.eastus.cloudapp.azure.com|HTTPS|Azure -|wusofficehome.msocdn.com|HTTPS|Microsoft Office -|www.bing.com|HTTPS|Cortana and Search -|www.microsoft.com|HTTP|Diagnostic Data -|www.microsoft.com/pkiops/certs/*|HTTP|CRL and OCSP checks to the issuing certificate authorities -|www.msftconnecttest.com|HTTP|Network Connection -|www.office.com|HTTPS|Microsoft Office - +| Destination | Protocol | Description | +| ----------- | -------- | ----------- | +| \*.b.akamaiedge.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use +| \*.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps +| \*.dl.delivery.mp.microsoft.com\* | HTTP | Windows Update +| \*.e-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps +| \*.g.akamaiedge.net | HTTPS | Used to check for updates to Maps that have been downloaded for offline use +| \*.licensing.md.mp.microsoft.com.akadns.net | HTTPS | Microsoft Store +| \*.settings.data.microsoft.com.akadns.net | HTTPS | Microsoft Store +| \*.skype.com\* | HTTPS | Used to retrieve Skype configuration values +| \*.smartscreen\*.microsoft.com | HTTPS | Windows Defender +| \*.s-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps +| \*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting +| \*.wac.phicdn.net | HTTP | Windows Update +| \*.windowsupdate.com\* | HTTP | Windows Update +| \*.wns.windows.com | HTTPS | Windows Notifications Service +| \*.wpc.\*.net | HTTP | Diagnostic Data +| \*displaycatalog.md.mp.microsoft.com.akadns.net | HTTPS | Microsoft Store +| \*dsp.mp.microsoft.com | HTTPS | Windows Update +| a1158.g.akamai.net | HTTP | Maps +| a122.dscg3.akamai.net | HTTP | Maps +| a767.dscg3.akamai.net | HTTP | Maps +| au.download.windowsupdate.com\* | HTTP | Windows Update +| bing.com/\* | HTTPS | Used for updates for Cortana, apps, and Live Tiles +| blob.dz5prdstr01a.store.core.windows.net | HTTPS | Microsoft Store +| browser.pipe.aria.microsoft.com | HTTP | Used by OfficeHub to get the metadata of Office apps +| cdn.onenote.net/livetile/\* | HTTPS | Used for OneNote Live Tile +| cds.p9u4n2q3.hwcdn.net | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates +| client-office365-tas.msedge.net/\* | HTTPS | Microsoft 365 admin center and Office in a browser +| ctldl.windowsupdate.com\* | HTTP | Used to download certificates that are publicly known to be fraudulent +| displaycatalog.mp.microsoft.com/\* | HTTPS | Microsoft Store +| dmd.metaservices.microsoft.com\* | HTTP | Device Authentication +| download.windowsupdate.com\* | HTTPS | Windows Update +| emdl.ws.microsoft.com/\* | HTTP | Used to download apps from the Microsoft Store +| evoke-windowsservices-tas.msedge.net | HTTPS | Photo app +| fe2.update.microsoft.com\* | HTTPS | Windows Update, Microsoft Update, Microsoft Store services +| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | HTTPS | Windows Update, Microsoft Update, Microsoft Store services +| fe3.delivery.mp.microsoft.com\* | HTTPS | Windows Update, Microsoft Update, Microsoft Store services +| g.live.com\* | HTTPS | Used by OneDrive for Business to download and verify app updates +| g.msn.com.nsatc.net | HTTPS | Used to retrieve Windows Spotlight metadata +| go.microsoft.com | HTTP | Windows Defender +| iecvlist.microsoft.com | HTTPS | Microsoft Edge browser +| ipv4.login.msa.akadns6.net | HTTPS | Used for Microsoft accounts to sign in +| licensing.mp.microsoft.com\* | HTTPS | Used for online activation and some app licensing +| login.live.com | HTTPS | Device Authentication +| maps.windows.com/windows-app-web-link | HTTPS | Maps application +| modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting +| msagfx.live.com | HTTPS | OneDrive +| ocos-office365-s2s.msedge.net/\* | HTTPS | Used to connect to the Microsoft 365 admin center's shared infrastructure +| ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities +| oneclient.sfx.ms/\* | HTTPS | Used by OneDrive for Business to download and verify app updates +| onecollector.cloudapp.aria.akadns.net | HTTPS | Microsoft Office +| pti.store.microsoft.com | HTTPS | Microsoft Store +| settings-win.data.microsoft.com/settings/\* | HTTPS | Used as a way for apps to dynamically update their configuration +| share.microsoft.com | HTTPS | Microsoft Store +| skypeecs-prod-usw-0.cloudapp.net | HTTPS | Skype +| sls.update.microsoft.com\* | HTTPS | Windows Update +| storecatalogrevocation.storequality.microsoft.com\* | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store +| tile-service.weather.microsoft.com\* | HTTP | Used to download updates to the Weather app Live Tile +| tsfe.trafficshaping.dsp.mp.microsoft.com | HTTPS | Windows Update +| v10.events.data.microsoft.com\* | HTTPS | Diagnostic Data +| vip5.afdorigin-prod-ch02.afdogw.com | HTTPS | Used to serve Office 365 experimentation traffic +| watson.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting +| wdcp.microsoft.com | HTTPS | Windows Defender +| wd-prod-cp-us-east-1-fe.eastus.cloudapp.azure.com | HTTPS | Azure +| wusofficehome.msocdn.com | HTTPS | Microsoft Office +| `www.bing.com` | HTTPS | Cortana and Search +| `www.microsoft.com` | HTTP | Diagnostic Data +| `www.microsoft.com/pkiops/certs/`* | HTTP | CRL and OCSP checks to the issuing certificate authorities +| `www.msftconnecttest.com` | HTTP | Network Connection +| `www.office.com` | HTTPS | Microsoft Office diff --git a/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md new file mode 100644 index 0000000000..90ab13ce23 --- /dev/null +++ b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md @@ -0,0 +1,214 @@ +--- +title: Windows 10, version 1909, connection endpoints for non-Enterprise editions +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1909. +keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: v-hakima +manager: obezeajo +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 08/18/2020 +--- +# Windows 10, version 1909, connection endpoints for non-Enterprise editions + + **Applies to** + +- Windows 10 Home, version 1909 +- Windows 10 Professional, version 1909 +- Windows 10 Education, version 1909 + +In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-2004-endpoints.md), the following endpoints are available on other non-Enterprise editions of Windows 10, version 1909. + +The following methodology was used to derive the network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week. If you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 Family + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|arc.msn.com|HTTP/TLS v1.2|Windows Spotlight +|api.asm.skype.com|TLS v1.2|Used to retrieve Skype configuration values +|browser.pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|ctldl.windowsupdate.com/*|HTTP|Certificate Trust List +|client.wns.windows.com|HTTP|Used for the Windows Push Notification Service(WNS) +|config.edge.skype.com|HTTP/TLS v1.2|Used to retrieve Skype configuration values +|dmd.metaservices.microsoft.com|HTTP|Device metadata +|config.teams.microsoft.com|HTTPS|Used for Microsoft Teams application +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft Store +|*.tlu.dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft Store +|displaycatalog.mp.microsoft.com/*|HTTP/TLS v1.2|Used to communicate with Microsoft Store +|evoke-windowsservices-tas.msedge.net|HTTP/TLS v1.2|Used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser +|fe2cr.update.microsoft.com|HTTPS/TLS v1.2|Enables connections to Windows Update, Microsoft Update, and the online services of the Store +|fe3cr.delivery.mp.microsoft.com|HTTPS/TLS v1.2|Used to download operating system patches, updates, and apps from Microsoft Store +|go.microsoft.com|HTTP|Windows Defender and/or Microsoft forward link redirection service (FWLink) +|g.live.com|HTTP|OneDrive +|checkappexec.microsoft.com|HTTPS|Used for Windows Defender Smartscreen reporting and notifications +|emdl.ws.microsoft.com|HTTP|Windows Update +|*.prod.do.dsp.mp.microsoft.com|HTTP/TLS v1.2|Windows Update +|*.au.download.windowsupdate.com|HTTP|Windows Update +|download.windowsupdate.com|HTTP|Windows Update +|inference.location.live.net|TLS v1.2|Used for Location Data +|iecvlist.microsoft.com|HTTP|This endpoint is related to Microsoft Edge +|login.live.com|HTTPS/TLS v1.2|Device Authentication +|logincdn.msauth.net|HTTPS|OneDrive +|licensing.mp.microsoft.com|HTTP/TLS v1.2|Licensing +|maps.windows.com|TLS v1.2|Used to check for updates to maps that have been downloaded for offline use +|mobile.pipe.aria.microsoft.com|HTTP|Office Telemetry +|nav.smartscreen.microsoft.com|HTTP|Used for Windows Defender SmartScreen reporting and notifications +|outlook.office365.com|HTTP|Used to connect to the Microsoft 365 admin center's shared infrastructure, including Office in a browser +|ocsp.digicert.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available +|oneclient.sfx.ms|HTTPS|Used by OneDrive for Business to download and verify app updates +|pti.store.microsoft.com/*|HTTP|Used to communicate with Microsoft Store +|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP|Used to communicate with Microsoft Store +|manage.devcenter.microsoft.com|HTTP/TLS v1.2|Used to get Microsoft Store analytics +|ris.api.iris.microsoft.com|HTTPS|Used to retrieve Windows Spotlight metadata that describes content +|settings-win.data.microsoft.com|HTTPS/TLS v1.2|Used for Windows apps to dynamically update their configuration +|smartscreen-prod.microsoft.com|HTTP|Used for Windows Defender SmartScreen reporting and notifications +|*.blob.core.windows.net|HTTP/TLS v1.2|Windows Telemetry +|storage.live.com|HTTP/TLS v1.2|OneDrive +|skydrivesync.policies.live.net|TLS v1.2|OneDrive +|dm2302.settings.live.net|HTTP|OneDrive +|slscr.update.microsoft.com|HTTPS/TLS V1.2|Windows Update +|tile-service.weather.microsoft.com|HTTP|Used for the Weather app +|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTP|This endpoint is used for content regulation +|watson.telemetry.microsoft.com*|HTTPS/TLS v1.2|Diagnostic Data +|v10.events.data.microsoft.com/onecollector/1.0/|HTTPS|Microsoft Office +|v10.events.data.microsoft.com|HTTPS/TLS v1.2|Used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service +|www.bing.com|HTTPS/TLS v1.2|Cortana and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection Status Indicator (NCSI) +|wdcp.microsoft.com|HTTPS|Used for Windows Defender when Cloud-based Protection is enabled +|activity.windows.com|TLSV1.2|Used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows +|adl.windows.com|HTTP|Used for compatibility database updates for Windows +|spclient.wg.spotify.com|TLSV1.2|Used for Spotify Live Tile +|cs.dds.microsoft.com|TLSV1.2|Used by Device Directory Service to keep track of user-device associations and storing metadata about the devices. + +## Windows 10 Pro + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|*.prod.do.dsp.mp.microsoft.com|HTTP/TLS v1.2|Windows Update +|api.onedrive.com|HTTP|OneDrive +|smartscreen-prod.microsoft.com|HTTP|Used for Windows Defender SmartScreen reporting and notifications +|nav.smartscreen.microsoft.com|HTTPS/TLS v1.2|Windows Defender +|*.update.microsoft.com|HTTP|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +|browser.pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|*.windowsupdate.com|HTTP|Used to download operating system patches and updates +|*.wns.windows.com|TLS v1.2|Used for the Windows Push Notification Services (WNS) +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft Store +|c-ring.msedge.net|TLS v1.2|Cortana and Live Tiles +|a-ring.msedge.net|TLS v1.2|Cortana and Live Tiles +|*storecatalogrevocation.storequality.microsoft.com|HTTP/TLS v1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|arc.msn.com|HTTP/TLS v1.2|Windows Spotlight +|*.blob.core.windows.net|HTTP/TLS v1.2|Windows Telemetry +|cdn.onenote.net|HTTPS/TLS v1.2|OneNote Live Tile +|checkappexec.microsoft.com|HTTPS|Used for Windows Defender SmartScreen reporting and notifications +|config.edge.skype.com|HTTP/TLS v1.2|Used to retrieve Skype configuration values +|config.teams.microsoft.com|HTTPS|Used for Microsoft Teams application +|ctldl.windowsupdate.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available +|displaycatalog.mp.microsoft.com*|HTTP/TLS v1.2|Microsoft Store +|emdl.ws.microsoft.com|HTTP|Windows Update +|fe2cr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update +|fe3cr.delivery.mp.microsoft.com|HTTPS/TLS v1.2|Windows Update +|slscr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update +|evoke-windowsservices-tas.msedge.net|HTTPS/TLS v1.2|Used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser +|fp.msedge.net|HTTPS/TLS v1.2|Cortana and Live Tiles +|fp-vp.azureedge.net|TLS v1.2|Cortana and Live Tiles +|g.live.com|TLS v1.2|OneDrive +|go.microsoft.com|HTTP|Windows Defender and/or Microsoft forward link redirection service (FWLink) +|iecvlist.microsoft.com|HTTP|Microsoft Edge +|inference.location.live.net|TLS v1.2|Used for Location Data +|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP|Used to communicate with Microsoft Store +|licensing.mp.microsoft.com*|HTTP/TLS v1.2|Licensing +|login.live.com|HTTPS/TLS v1.2|Device Authentication +|logincdn.msauth.net|HTTPS|Used for Microsoft accounts to sign in +|manage.devcenter.microsoft.com|HTTP/TLS v1.2|Microsoft Store analytics +|maps.windows.com|TLS v1.2|Related to Maps application +|ocsp.digicert.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available +|ocsp.msocsp.com|HTTP|Used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available +|oneclient.sfx.ms|HTTPS|Used by OneDrive for Business to download and verify app updates +|mobile.pipe.aria.microsoft.com|HTTP|Office Telemetry +|pti.store.microsoft.com/*|HTTP|Used to communicate with Microsoft Store +|ris.api.iris.microsoft.com|TLS v1.2|Windows Spotlight +|settings-win.data.microsoft.com|HTTPS/TLS v1.2|Used for Windows apps to dynamically update their configuration +|spo-ring.msedge.net|TLSv1.2|Cortana and Live Tiles +|telecommand.telemetry.microsoft.com|TLS v1.2|Used by Windows Error Reporting ||tile-service.weather.microsoft.com|HTTP|Used for the Weather app +|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Used for content regulation +|v10.events.data.microsoft.com/onecollector/1.0/|HTTPS/TLS v1.2|Diagnostic Data +|v10.events.data.microsoft.com|HTTPS/TLS v1.2|Used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service +|watson.telemetry.microsoft.com*|HTTPS/TLS v1.2|Used by Windows Error Reporting +|wdcp.microsoft.com|HTTPS|Used for Windows Defender when Cloud-based Protection is enabled +|www.bing.com|HTTPS/TLS v1.2|Cortana and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection Status Indicator (NCSI) +|outlook.office365.com|HTTP|Microsoft Office +|storage.live.com|HTTP/TLS v1.2|OneDrive +|skydrivesync.policies.live.net|TLS v1.2|OneDrive +|windows.policies.live.net|HTTP|OneDrive +|activity.windows.com|TLSV1.2|Used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows +|adl.windows.com|HTTP|Used for compatibility database updates for Windows +|spclient.wg.spotify.com|TLSV1.2|Used for Spotify Live Tile +|cs.dds.microsoft.com|TLSV1.2|Used by Device Directory Service to keep track of user-device associations and storing metadata about the devices. + +## Windows 10 Education + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|arc.msn.com|HTTPS/TLS v1.2|Windows Spotlight +|*.dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|client.wns.windows.com|TLS v1.2|Used for the Windows Push Notification Services (WNS) +|*storecatalogrevocation.storequality.microsoft.com|TLS v1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|ctldl.windowsupdate.com|HTTP|Certificate Trust List +|dmd.metaservices.microsoft.com|HTTP|Device metadata +|Inference.location.live.net|TLS v1.2|Location +|oneclient.sfx.ms|HTTPS|OneDrive +|storage.live.com|HTTP/TLS v1.2|OneDrive +|skydrivesync.policies.live.net|TLS v1.2|OneDrive +|slscr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update +|fe2cr.update.microsoft.com|HTTPS/TLS v1.2|Windows Update +|fe3cr.delivery.mp.microsoft.com|HTTPS/TLS v1.2|Windows Update +|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTP/TLS v1.2|Windows Update +|officehomeblobs.blob.core.windows.net|HTTP|Windows Telemetry +|displaycatalog.mp.microsoft.com/*|HTTP/TLS v1.2|Microsoft Store +|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP|Used to communicate with Microsoft Store +|config.teams.microsoft.com|HTTPS|Teams +|api.asm.skype.com|TLS v1.2|Used to retrieve Skype configuration values +|config.edge.skype.com|HTTP/TLS v1.2|Used to retrieve Skype configuration values +|logincdn.msauth.net|HTTPS|OneDrive +|iecvlist.microsoft.com|HTTP|Microsoft Edge +|download.windowsupdate.com|HTTP|Windows Update +|checkappexec.microsoft.com|HTTPS|Windows Defender +|pti.store.microsoft.com/*|HTTP|Microsoft Store +|emdl.ws.microsoft.com|HTTP|Windows Update +|evoke-windowsservices-tas.msedge.net|HTTPS/TLS v1.2|Photos app +|g.live.com|TLS v1.2|OneDrive +|go.microsoft.com|HTTP|Windows Defender +|licensing.mp.microsoft.com|HTTP/TLS v1.2|Licensing +|login.live.com|HTTPS/TLS v1.2|Device Authentication +|manage.devcenter.microsoft.com|TLS v1.2|Microsoft Store analytics +|ocsp.digicert.com|HTTP|CRL and OCSP checks to the issuing certificate authorities +|ris.api.iris.microsoft.com|TLS v1.2|Windows spotlight +|telecommand.telemetry.microsoft.com|TLS v1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTP|Used to download updates to the Weather app Live Tile +|v10.events.data.microsoft.com|HTTPS/TLS v1.2|Diagnostic Data +|V10.events.data.microsoft.com/onecollector/1.0/|HTTPS|Diagnostic Data +|Watson.telemetry.microsoft.com/telemetry.request|HTTPS|Diagnostic Data +|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data +|outlook.office365.com|HTTP|Microsoft Office +|www.bing.com|TLS v1.2|Used for updates for Cortana, apps, and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection (NCSI) +|adl.windows.com|HTTP|Used for compatibility database updates for Windows diff --git a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md new file mode 100644 index 0000000000..d0be97841e --- /dev/null +++ b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md @@ -0,0 +1,203 @@ +--- +title: Windows 10, version 2004, connection endpoints for non-Enterprise editions +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 2004. +keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: linque1 +ms.author: obezeajo +manager: robsize +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 5/11/2020 +--- +# Windows 10, version 2004, connection endpoints for non-Enterprise editions + + **Applies to** + +- Windows 10 Home, version 2004 +- Windows 10 Professional, version 2004 +- Windows 10 Education, version 2004 + +In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-2004-endpoints.md), the following endpoints are available on other non-Enterprise editions of Windows 10, version 2004. + +The following methodology was used to derive the network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week. If you capture traffic for longer you may have different results. + + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 Family + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|*.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*.prod.do.dsp.mp.microsoft.com|TLSv1.2|Windows Update +|*.smartscreen.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.smartscreen-prod.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.update.microsoft.com|TLSv1.2|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +|*.windowsupdate.com|HTTP|Used to download operating system patches and updates +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*storecatalogrevocation.storequality.microsoft.com|TLSv1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|arc.msn.com|TLSv1.2|Windows Spotlight +|cdn.onenote.net|HTTPS|OneNote +|config.edge.skype.com|HTTPS|Skype +|config.teams.microsoft.com|HTTPS|Skype +|crl.microsoft.com|HTTPS|Skype +|ctldl.windowsupdate.com|HTTP|Certificate Trust List +|da.xboxservices.com|HTTPS|Microsoft Edge +|displaycatalog.mp.microsoft.com|HTTPS|Microsoft Store +|dmd.metaservices.microsoft.com|HTTP|Device Authentication +|evoke-windowsservices-tas.msedge.net|TLSv1.2|Photos app +|fs.microsoft.com|TLSv1.2|Maps application +|g.live.com|TLSv1.2|OneDrive +|go.microsoft.com|HTTPS|Windows Defender +|img-prod-cms-rt-microsoft-com|TLSv1.2|This endpoint is related to Microsoft Edge +|licensing.mp.microsoft.com|HTTPS|Licensing +|login.live.com|TLSv1.2|Device Authentication +|logincdn.msauth.net|TLSv1.2|Device Authentication +|manage.devcenter.microsoft.com|TLSv1.2|Microsoft Store analytics +|maps.windows.com|TLSv1.2|Related to Maps application +|ocsp.digicert.com|HTTPS|CRL and OCSP checks to the issuing certificate authorities +|oneclient.sfx.ms|HTTPS|Used by OneDrive for Business to download and verify app updates +|pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|ris.api.iris.microsoft.com|TLSv1.2|Windows Telemetry +|settings-win.data.microsoft.com|TLSv1.2|Used for Windows apps to dynamically update their configuration +|storesdk.dsx.mp.microsoft.com|HTTPS|Used to communicate with Microsoft Store +|telecommand.telemetry.microsoft.com|TLSv1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTPS|Used to download updates to the Weather app Live Tile +|tsfe.trafficshaping.dsp.mp.microsoft.com|TLSv1.2|Used for content regulation +|v10.events.data.microsoft.com|TLSv1.2|Diagnostic Data +|v20.events.data.microsoft.com|TLSv1.2|Diagnostic Data +|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data +|wdcp.microsoft.com|TLSv1.2|Used for Windows Defender when Cloud-based Protection is enabled +|www.bing.com|TLSv1.2|Used for updates for Cortana, apps, and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection (NCSI) +|www.office.com|HTTPS|Microsoft Office + + +## Windows 10 Pro + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|*.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*.prod.do.dsp.mp.microsoft.com|TLSv1.2|Windows Update +|*.smartscreen.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.smartscreen-prod.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.update.microsoft.com|TLSv1.2|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +|*.windowsupdate.com|HTTP|Used to download operating system patches and updates +|*.wns.windows.com|TLSv1.2|Used for the Windows Push Notification Services (WNS) +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*msn-com.akamaized.net|HTTPS|This endpoint is related to Microsoft Edge +|*ring.msedge.net|HTTPS|Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps +|*storecatalogrevocation.storequality.microsoft.com|TLSv1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|arc.msn.com|TLSv1.2|Windows Spotlight +|blobs.officehome.msocdn.com|HTTPS|OneNote +|cdn.onenote.net|HTTPS|OneNote +|checkappexec.microsoft.com|HTTPS|OneNote +|config.edge.skype.com|HTTPS|Skype +|config.teams.microsoft.com|HTTPS|Skype +|crl.microsoft.com|HTTPS|Skype +|ctldl.windowsupdate.com|HTTP|Certificate Trust List +|d2i2wahzwrm1n5.cloudfront.net|HTTPS|Microsoft Edge +|da.xboxservices.com|HTTPS|Microsoft Edge +|displaycatalog.mp.microsoft.com|HTTPS|Microsoft Store +|dlassets-ssl.xboxlive.com|HTTPS|Xbox Live +|dmd.metaservices.microsoft.com|HTTP|Device Authentication +|emdl.ws.microsoft.com|HTTP|Windows Update +|evoke-windowsservices-tas.msedge.net|TLSv1.2|Photos app +|fp.msedge.net|HTTPS|Cortana and Live Tiles +|fs.microsoft.com|TLSv1.2|Maps application +|g.live.com|TLSv1.2|OneDrive +|go.microsoft.com|HTTPS|Windows Defender +|img-prod-cms-rt-microsoft-com*|TLSv1.2|This endpoint is related to Microsoft Edge +|licensing.mp.microsoft.com|HTTPS|Licensing +|login.live.com|TLSv1.2|Device Authentication +|manage.devcenter.microsoft.com|TLSv1.2|Microsoft Store analytics +|maps.windows.com|TLSv1.2|Related to Maps application +|ocsp.digicert.com|HTTPS|CRL and OCSP checks to the issuing certificate authorities +|oneclient.sfx.ms|HTTPS|Used by OneDrive for Business to download and verify app updates +|pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|ris.api.iris.microsoft.com|TLSv1.2|Windows Telemetry +|s1325.t.eloqua.com|HTTPS|Microsoft Edge +|self.events.data.microsoft.com|HTTPS|Microsoft Office +|settings-win.data.microsoft.com|TLSv1.2|Used for Windows apps to dynamically update their configuration +|store-images.*microsoft.com|HTTPS|Used to get images that are used for Microsoft Store suggestions +|storesdk.dsx.mp.microsoft.com|HTTPS|Microsoft Store +|telecommand.telemetry.microsoft.com|TLSv1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTPS|Used to download updates to the Weather app Live Tile +|time.windows.com|HTTPS|Fetch the time +|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|The following endpoint is used for content regulation +|v10.events.data.microsoft.com|TLSv1.2|Diagnostic Data +|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data +|wdcp.microsoft.com|TLSv1.2|Used for Windows Defender when Cloud-based Protection is enabled +|www.bing.com|TLSv1.2|Used for updates for Cortana, apps, and Live Tiles +|www.msftconnecttest.com|HTTP|Network Connection (NCSI) +|www.msn.com|HTTPS|Network Connection (NCSI) +|www.office.com|HTTPS|Microsoft Office + + +## Windows 10 Education + +| **Destination** | **Protocol** | **Description** | +| --- | --- | --- | +|*.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*.prod.do.dsp.mp.microsoft.com|TLSv1.2|Windows Update +|*.smartscreen.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.smartscreen-prod.microsoft.com|HTTPS|Windows Defender SmartScreen +|*.update.microsoft.com|TLSv1.2|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store +|*.windowsupdate.com|HTTP|Used to download operating system patches and updates +|*.wns.windows.com|TLSv1.2|Used for the Windows Push Notification Services (WNS) +|*dl.delivery.mp.microsoft.com|HTTP|Used to download operating system patches, updates, and apps from Microsoft +|*ring.msedge.net|HTTPS|Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps +|*storecatalogrevocation.storequality.microsoft.com|TLSv1.2|Used to revoke licenses for malicious apps on the Microsoft Store +|arc.msn.com|TLSv1.2|Windows Spotlight +|blobs.officehome.msocdn.com|HTTPS|OneNote +|cdn.onenote.net|HTTPS|OneNote +|checkappexec.microsoft.com|HTTPS|OneNote +|config.edge.skype.com|HTTPS|Skype +|config.teams.microsoft.com|HTTPS|Skype +|crl.microsoft.com|HTTPS|Skype +|ctldl.windowsupdate.com|HTTP|Certificate Trust List +|da.xboxservices.com|HTTPS|Microsoft Edge +|dmd.metaservices.microsoft.com|HTTP|Device Authentication +|emdl.ws.microsoft.com|HTTP|Windows Update +|evoke-windowsservices-tas.msedge.net|TLSv1.2|Photos app +|fp.msedge.net|HTTPS|Cortana and Live Tiles +|fs.microsoft.com|TLSv1.2|Maps application +|g.live.com|TLSv1.2|OneDrive +|go.microsoft.com|HTTPS|Windows Defender +|licensing.mp.microsoft.com|HTTPS|Licensing +|login.live.com|TLSv1.2|Device Authentication +|logincdn.msauth.net|HTTPS|Device Authentication +|manage.devcenter.microsoft.com|TLSv1.2|Microsoft Store analytics +|ocsp.digicert.com|HTTPS|CRL and OCSP checks to the issuing certificate authorities +|ocsp.msocsp.com|HTTPS|CRL and OCSP checks to the issuing certificate authorities +|ow1.res.office365.com|HTTPS|Microsoft Office +|pipe.aria.microsoft.com|HTTPS|Used to retrieve Skype configuration values +|ris.api.iris.microsoft.com|TLSv1.2|Windows Telemetry +|s1325.t.eloqua.com|HTTPS|Microsoft Edge +|settings-win.data.microsoft.com|TLSv1.2|Used for Windows apps to dynamically update their configuration +|telecommand.telemetry.microsoft.com|TLSv1.2|Used by Windows Error Reporting +|tile-service.weather.microsoft.com|HTTPS|Used to download updates to the Weather app Live Tile +|v10.events.data.microsoft.com|TLSv1.2|Diagnostic Data +|v20.events.data.microsoft.com|HTTPS|Diagnostic Data +|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data +|wdcp.microsoft.com|TLSv1.2|Used for Windows Defender when Cloud-based Protection is enabled +|www.bing.com|TLSv1.2|Used for updates for Cortana, apps, and Live Tiles +|www.microsoft.com|HTTP|Connected User Experiences and Telemetry, Microsoft Data Management service +|www.msftconnecttest.com|HTTP|Network Connection (NCSI) +|www.office.com|HTTPS|Microsoft Office + diff --git a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md new file mode 100644 index 0000000000..66a3637398 --- /dev/null +++ b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md @@ -0,0 +1,266 @@ +--- +title: Windows 10, version 20H2, connection endpoints for non-Enterprise editions +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 20H2. +keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: v-hakima +manager: robsize +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 12/17/2020 +--- +# Windows 10, version 20H2, connection endpoints for non-Enterprise editions + + **Applies to** + +- Windows 10 Home, version 20H2 +- Windows 10 Professional, version 20H2 +- Windows 10 Education, version 20H2 + +In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-2004-endpoints.md), the following endpoints are available on other non-Enterprise editions of Windows 10, version 20H2. + +The following methodology was used to derive the network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week. If you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 Family + +| **Area** | **Description** | **Protocol** | **Destination** | +|-----------|--------------- |------------- |-----------------| +| Activity Feed Service |The following endpoints are used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows|TLSv1.2/HTTPS/HTTP|activity.windows.com| +|Apps|The following endpoints are used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|evoke-windowsservices-tas.msedge.net| +||The following endpoint is used for OneNote Live Tile.|HTTPS/HTTP|cdn.onenote.net| +||Used for Spotify Live Tile|HTTPS/HTTP|spclient.wg.spotify.com| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| +|Cortana and Live Tiles|The following endpoints are related to Cortana and Live Tiles|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|||HTTPS/HTTP|fp.msedge.net| +|||HTTPS/HTTP|k-ring.msedge.net| +|||TLSv1.2|b-ring.msedge.net| +|Device authentication|The following endpoint is used to authenticate a device.|HTTPS|login.live.com*| +|Device Directory Service|Used by Device Directory Service to keep track of user-device associations and storing metadata about the devices.|HTTPS/HTTP|cs.dds.microsoft.com| +|Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| +|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.|TLSv1.2/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||TLSv1.2/HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| +|Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| +|||HTTPS|licensing.mp.microsoft.com/v7.0/licenses/content| +|Location|The following endpoints are used for location data.|TLSV1.2|inference.location.live.net| +|Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| +|||HTTPS/HTTP|*.ssl.ak.dynamic.tiles.virtualearth.net| +|||HTTPS/HTTP|*.ssl.ak.tiles.virtualearth.net| +|||HTTPS/HTTP|dev.virtualearth.net| +|||HTTPS/HTTP|ecn.dev.virtualearth.net| +|||HTTPS/HTTP|ssl.bing.com| +|Microsoft Account|The following endpoints are used for Microsoft accounts to sign in|TLSv1.2/HTTPS/HTTP|*login.live.com| +|Microsoft Edge|The following endpoints are used for Microsoft Edge Browser Services.|HTTPS/HTTP|edge.activity.windows.com| +|||HTTPS/HTTP|edge.microsoft.com| +||The following endpoint is used by Microsoft Edge Update service to check for new updates.|HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer|HTTP|go.microsoft.com/fwlink/| +|||TLSv1.2/HTTPS/HTTP|go.microsoft.com| +|Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store.|TLSv1.2/HTTPS/HTTP|*displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTPS|storesdk.dsx.mp.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +||The following endpoints are used get images that are used for Microsoft Store suggestions|TLSv1.2|store-images.s-microsoft.com| +|Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|outlook.office365.com| +|||TLSv1.2/HTTPS|office.com| +|||TLSv1.2/HTTPS|blobs.officehome.msocdn.com| +|||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| +|||HTTP/HTTPS|*.blob.core.windows.net| +|||TLSv1.2|self.events.data.microsoft.com| +|||HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| +|||HTTP|roaming.officeapps.live.com| +|||HTTPS/HTTP|substrate.office.com| +|OneDrive|The following endpoints are related to OneDrive.|HTTPS|g.live.com| +|||TLSv1.2/HTTPS|oneclient.sfx.ms| +|||HTTPS/TLSv1.2|logincdn.msauth.net| +|||HTTPS/HTTP|windows.policies.live.net| +|||HTTPS/HTTP|api.onedrive.com| +|||HTTPS/HTTP|skydrivesync.policies.live.net| +|||HTTPS/HTTP|*storage.live.com| +|||HTTPS/HTTP|*settings.live.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com*| +|Skype|The following endpoint is used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| +||||wdcpalt.microsoft.com| +|||HTTPS/HTTP|*.smartscreen-prod.microsoft.com| +|||TLSv1.2|definitionupdates.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*.smartscreen.microsoft.com| +|||TLSv1.2/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*| +|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com| +|||HTTPS|mucp.api.account.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||TLSv1.2/HTTP|emdl.ws.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| +|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoints are used for Xbox Live.| +|||TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| +|||TLSv1.2/HTTPS|da.xboxservices.com| +|||HTTPS|www.xboxab.com| +| + +## Windows 10 Pro + +| **Area** | **Description** | **Protocol** | **Destination** | +| --- | --- | --- | ---| +| Activity Feed Service |The following endpoints are used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows|TLSv1.2/HTTPS/HTTP|activity.windows.com| +|Apps|The following endpoints are used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|evoke-windowsservices-tas.msedge.net| +||The following endpoint is used for OneNote Live Tile.|HTTPS/HTTP|cdn.onenote.net| +||Used for Spotify Live Tile|HTTPS/HTTP|spclient.wg.spotify.com| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| +|Cortana and Live Tiles|The following endpoints are related to Cortana and Live Tiles|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|Device authentication|The following endpoint is used to authenticate a device.|HTTPS|login.live.com*| +|Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| +|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.|TLSv1.2/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||TLSv1.2/HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| +|Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| +|Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| +|Microsoft Account|The following endpoints are used for Microsoft accounts to sign in|TLSv1.2/HTTPS/HTTP|*login.live.com| +|Microsoft Edge|The following endpoint is used by Microsoft Edge Update service to check for new updates.|HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer|TLSv1.2/HTTPS/HTTP|go.microsoft.com| +|Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store.|TLSv1.2/HTTPS/HTTP|*displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTPS|storesdk.dsx.mp.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|outlook.office365.com| +|||TLSv1.2/HTTPS|office.com| +|||TLSv1.2/HTTPS|blobs.officehome.msocdn.com| +|||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| +|||HTTP/HTTPS|*.blob.core.windows.net| +|||TLSv1.2|self.events.data.microsoft.com| +|||HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| +|||TLSv1.2/HTTPS/HTTP|officeclient.microsoft.com| +|||HTTPS/HTTP|substrate.office.com| +|OneDrive|The following endpoints are related to OneDrive.|HTTPS|g.live.com| +|||TLSv1.2/HTTPS|oneclient.sfx.ms| +|||HTTPS/TLSv1.2|logincdn.msauth.net| +|||HTTPS/HTTP|windows.policies.live.net| +|||HTTPS/HTTP|*storage.live.com| +|||HTTPS/HTTP|*settings.live.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com*| +|Skype|The following endpoint is used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| +||||wdcpalt.microsoft.com| +|||HTTPS/HTTP|*.smartscreen-prod.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*.smartscreen.microsoft.com| +|||TLSv1.2/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*| +|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||TLSv1.2/HTTP|emdl.ws.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| +|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoints are used for Xbox Live.| +|||TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| +|||TLSv1.2/HTTPS|da.xboxservices.com| +| + +## Windows 10 Education + +| **Area** | **Description** | **Protocol** | **Destination** | +| --- | --- | --- | ---| +| Activity Feed Service |The following endpoints are used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows|TLSv1.2/HTTPS/HTTP|activity.windows.com| +|Apps|The following endpoints are used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|evoke-windowsservices-tas.msedge.net| +||The following endpoint is used for OneNote Live Tile.|HTTPS/HTTP|cdn.onenote.net| +|Bing Search|The following endpoint is used by Microsoft Search in Bing enabling users to search across files, SharePoint sites, OneDrive content, Teams and Yammer conversations, and other shared data sources in an organization, as well as the web.|HTTPS|business.bing.com| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| +|Cortana and Live Tiles|The following endpoints are related to Cortana and Live Tiles|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|||HTTPS/HTTP|fp.msedge.net| +|||TLSv1.2|odinvzc.azureedge.net| +|||TLSv1.2|b-ring.msedge.net| +|Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| +|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.|TLSv1.2/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||TLSv1.2/HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| +|Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| +|Location|The following endpoints are used for location data.|TLSV1.2|inference.location.live.net| +|Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| +|Microsoft Account|The following endpoints are used for Microsoft accounts to sign in|TLSv1.2/HTTPS/HTTP|*login.live.com| +|Microsoft Edge|The following endpoint is used by Microsoft Edge Update service to check for new updates.|HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer|TLSv1.2/HTTPS/HTTP|go.microsoft.com| +|Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|1storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store.|TLSv1.2/HTTPS/HTTP|*displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTPS|storesdk.dsx.mp.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS|office.com| +|||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| +|||TLSv1.2|self.events.data.microsoft.com| +|OneDrive|The following endpoints are related to OneDrive.|HTTPS|g.live.com| +|||TLSv1.2/HTTPS|oneclient.sfx.ms| +|||HTTPS/TLSv1.2|logincdn.msauth.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com*| +|Skype|The following endpoint is used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| +||||wdcpalt.microsoft.com| +|||HTTPS/HTTP|*.smartscreen-prod.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*.smartscreen.microsoft.com| +|||TLSv1.2/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*| +|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||TLSv1.2/HTTP|emdl.ws.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| +|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoints are used for Xbox Live.| +|||TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| +|||TLSv1.2/HTTPS|da.xboxservices.com| diff --git a/windows/privacy/windows-personal-data-services-configuration.md b/windows/privacy/windows-personal-data-services-configuration.md deleted file mode 100644 index 273f2bac8d..0000000000 --- a/windows/privacy/windows-personal-data-services-configuration.md +++ /dev/null @@ -1,408 +0,0 @@ ---- -title: Windows 10 personal data services configuration -description: Learn more about Windows 10 configuration settings that are useful for complying with regulations such as the GDPR and protecting users' personal data. -keywords: privacy, GDPR, windows, IT -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 05/11/2018 -ms.reviewer: ---- -# Windows 10 personal data services configuration - -Applies to: -- Windows 10, version 1803 and newer - -Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization. - -IT Professionals that are interested in applying these settings via group policies can find the configuration for download [here](https://go.microsoft.com/fwlink/?linkid=874149). - -## Introduction - -Microsoft collects data from or generates it through interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, support, and improve Windows 10 services. - -Many Windows 10 services are controller services. A user can manage data collection settings, for example by opening *Start > Settings > Privacy* or by visiting the [Microsoft Privacy dashboard](https://account.microsoft.com/privacy). While this relationship between Microsoft and a user is evident in a consumer type scenario, an IT organization can influence that relationship. For example, the IT department has the ability to configure the Windows diagnostic data level across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings. - -Below is a collection of settings related to the Windows 10 personal data services configuration that IT Professionals can use as guidance for influencing Windows diagnostic data collection and personal data protection. - -## Windows diagnostic data - -Windows 10 collects Windows diagnostic data—such as usage data, performance data, inking, typing, and utterance data—and sends it back to Microsoft. That data is used for keeping the operating system secure and up-to-date, to troubleshoot problems, and to make product improvements. For users who have turned on "Tailored experiences", that data can also be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. - -The following options for configuring Windows diagnostic data are relevant in this context. - -### Diagnostic level - -This setting determines the amount of Windows diagnostic data sent to Microsoft. - ->[!NOTE] ->In Windows 10, version 1709, Microsoft introduced a new feature: “Limit Enhanced diagnostic data to the minimum required by Windows Analytics”. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics). For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds | ->| **Policy Name** | Allow Telemetry | ->| **Default setting** | 2 - Enhanced | ->| **Recommended** | 2 - Enhanced | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds | ->| **Policy Name** | Allow Telemetry | ->| **Default setting** | 2 - Enhanced | ->| **Recommended** | 2 - Enhanced | - ->[!NOTE] ->When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used. - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection | ->| **Value** | AllowTelemetry | ->| **Type** | REG_DWORD | ->| **Setting** | "00000002" | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKCU\Software\Policies\Microsoft\Windows\DataCollection | ->| **Value** | AllowTelemetry | ->| **Type** | REG_DWORD | ->| **Setting** | "00000002" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | System | ->| **Policy** | AllowTelemetry (scope: device and user) | ->| **Default setting** | 2 – Enhanced | ->| **Recommended** | 2 – Allowed | - -### Diagnostic opt-in change notifications - -This setting determines whether a device shows notifications about Windows diagnostic data levels to people on first logon or when changes occur in the diagnostic configuration. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds | ->| **Policy Name** | Configure telemetry opt-in change notifications | ->| **Default setting** | Enabled | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection | ->| **Value** | DisableTelemetryOptInChangeNotification | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | System | ->| **Policy** | ConfigureTelemetryOptInChangeNotification | ->| **Default setting** | 0 – Enabled | ->| **Recommended** | 0 – Enabled | - -### Configure telemetry opt-in setting user interface - -This setting determines whether people can change their own Windows diagnostic data level in *Start > Settings > Privacy > Diagnostics & feedback*. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds | ->| **Policy Name** | Configure telemetry opt-in setting user interface | ->| **Default setting** | Enabled | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection | ->| **Value** | DisableTelemetryOptInSettingsUx | ->| **Type** | REG_DWORD | ->| **Setting** | "00000001" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | System | ->| **Policy** | ConfigureTelemetryOptInSettingsUx | ->| **Default setting** | 0 – Enabled | ->| **Recommended** | 0 – Enabled | - -## Policies affecting personal data protection managed by the Enterprise IT - -There are additional settings usually managed by the Enterprise IT that also affect the protection of personal data. - -The following options for configuring these policies are relevant in this context. - -### BitLocker - -The following settings determine whether fixed and removable drives are protected by the BitLocker Drive Encryption. - -#### Fixed Data Drives - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Fixed Data Drives | ->| **Policy Name** | Deny write access to fixed drives not protected by BitLocker | ->| **Default setting** | Not configured | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE | ->| **Value** | FDVDenyWriteAccess | ->| **Type** | REG_DWORD | ->| **Setting** | "00000001" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | BitLocker | ->| **Policy** | FixedDrivesRequireEncryption | ->| **Default setting** | Disabled | ->| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#fixeddrivesrequireencryption)) | - -#### Removable Data Drives - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Removable Data Drives | ->| **Policy Name** | Deny write access to removable drives not protected by BitLocker | ->| **Default setting** | Not configured | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE | ->| **Value** | RDVDenyWriteAccess | ->| **Type** | REG_DWORD | ->| **Setting** | "00000001" | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\FVE | ->| **Value** | RDVDenyCrossOrg | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | BitLocker | ->| **Policy** | RemovableDrivesRequireEncryption | ->| **Default setting** | Disabled | ->| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#removabledrivesrequireencryption)) | - -### Privacy – AdvertisingID - -This setting determines if the advertising ID, which preventing apps from using the ID for experiences across apps, is turned off. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\System\User Profiles | ->| **Policy Name** | Turn off the advertising ID | ->| **Default setting** | Not configured | ->| **Recommended** | Enabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo | ->| **Value** | DisabledByGroupPolicy | ->| **Type** | REG_DWORD | ->| **Setting** | "00000001" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | Privacy | ->| **Policy** | DisableAdvertisingId | ->| **Default setting** | 65535 (default) - Not configured | ->| **Recommended** | 1 – Enabled | - -### Edge - -These settings whether employees send “Do Not Track” from the Microsoft Edge web browser to websites. - ->[!NOTE] ->Please see [this Microsoft blog post](https://blogs.microsoft.com/on-the-issues/2015/04/03/an-update-on-microsofts-approach-to-do-not-track/) for more details on why the “Do Not Track” is no longer the default setting. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge | ->| **Policy Name** | Configure Do Not Track | ->| **Default setting** | Disabled | ->| **Recommended** | Disabled | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Microsoft Edge | ->| **Policy Name** | Configure Do Not Track | ->| **Default setting** | Disabled | ->| **Recommended** | Disabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main | ->| **Value** | DoNotTrack | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Registry key** | HKCU\Software\Policies\Microsoft\MicrosoftEdge\Main | ->| **Value** | DoNotTrack | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -#### MDM - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **MDM CSP** | Browser | ->| **Policy** | AllowDoNotTrack (scope: device + user) | ->| **Default setting** | 0 (default) – Not allowed | ->| **Recommended** | 0 – Not allowed | - -### Internet Explorer - -These settings whether employees send “Do Not Track” header from the Microsoft Explorer web browser to websites. - -#### Group Policy - -> [!div class="mx-tableFixed"] ->| | | ->|:-|:-| ->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | ->| **Policy Name** | Always send Do Not Track header | ->| **Default setting** | Disabled | ->| **Recommended** | Disabled | - -> [!div class="mx-tableFixed"] ->||| ->|:-|:-| ->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | ->| **Policy Name** | Always send Do Not Track header | ->| **Default setting** | Disabled | ->| **Recommended** | Disabled | - -#### Registry - -> [!div class="mx-tableFixed"] ->||| ->|:-|:-| ->| **Registry key** | HKLM\Software\Policies\Microsoft\Internet Explorer\Main | ->| **Value** | DoNotTrack | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -> [!div class="mx-tableFixed"] ->||| ->|:-|:-| ->| **Registry key** | HKCU\Software\Policies\Microsoft\Internet Explorer\Main | ->| **Value** | DoNotTrack | ->| **Type** | REG_DWORD | ->| **Setting** | "00000000" | - -#### MDM - -> [!div class="mx-tableFixed"] ->||| ->|:-|:-| ->| **MDM CSP** | N/A | - -## Additional resources - -### FAQs - -* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) -* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) -* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) -* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) - -### Blogs - -* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10) - -### Privacy Statement - -* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) - -### Windows Privacy on docs.microsoft.com - -* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -* [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) -* [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data) -* [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) - -### Other resources - -* [Privacy at Microsoft](https://privacy.microsoft.com/) diff --git a/windows/release-information/TOC.md b/windows/release-information/TOC.md deleted file mode 100644 index f0457af621..0000000000 --- a/windows/release-information/TOC.md +++ /dev/null @@ -1,36 +0,0 @@ -# [Windows 10 release information](index.md) -# [Message center](windows-message-center.yml) -# Version 1909 -## [Known issues and notifications](status-windows-10-1909.yml) -## [Resolved issues](resolved-issues-windows-10-1909.yml) -# Version 1903 -## [Known issues and notifications](status-windows-10-1903.yml) -## [Resolved issues](resolved-issues-windows-10-1903.yml) -# Version 1809 and Windows Server 2019 -## [Known issues and notifications](status-windows-10-1809-and-windows-server-2019.yml) -## [Resolved issues](resolved-issues-windows-10-1809-and-windows-server-2019.yml) -# Version 1803 -## [Known issues and notifications](status-windows-10-1803.yml) -## [Resolved issues](resolved-issues-windows-10-1803.yml) -# Version 1709 -## [Known issues and notifications](status-windows-10-1709.yml) -## [Resolved issues](resolved-issues-windows-10-1709.yml) -# Version 1607 and Windows Server 2016 -## [Known issues and notifications](status-windows-10-1607-and-windows-server-2016.yml) -## [Resolved issues](resolved-issues-windows-10-1607.yml) -# Version 1507 -## [Known issues and notifications](status-windows-10-1507.yml) -## [Resolved issues](resolved-issues-windows-10-1507.yml) -# Previous versions -## Windows 8.1 and Windows Server 2012 R2 -### [Known issues and notifications](status-windows-8.1-and-windows-server-2012-r2.yml) -### [Resolved issues](resolved-issues-windows-8.1-and-windows-server-2012-r2.yml) -## Windows Server 2012 -### [Known issues and notifications](status-windows-server-2012.yml) -### [Resolved issues](resolved-issues-windows-server-2012.yml) -## Windows 7 and Windows Server 2008 R2 -### [Known issues and notifications](status-windows-7-and-windows-server-2008-r2-sp1.yml) -### [Resolved issues](resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml) -## Windows Server 2008 SP2 -### [Known issues and notifications](status-windows-server-2008-sp2.yml) -### [Resolved issues](resolved-issues-windows-server-2008-sp2.yml) diff --git a/windows/release-information/breadcrumb/toc.yml b/windows/release-information/breadcrumb/toc.yml deleted file mode 100644 index 5c9f236497..0000000000 --- a/windows/release-information/breadcrumb/toc.yml +++ /dev/null @@ -1,11 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Windows - tocHref: /windows - topicHref: /windows/windows-10 - items: - - name: Release information - tocHref: /windows/release-information/ - topicHref: /windows/release-information/index diff --git a/windows/release-information/docfx.json b/windows/release-information/docfx.json index 4dcacaf204..40211ae3b7 100644 --- a/windows/release-information/docfx.json +++ b/windows/release-information/docfx.json @@ -41,7 +41,16 @@ "audience": "ITPro", "titleSuffix": "Windows Release Information", "extendBreadcrumb": true, - "feedback_system": "None" + "feedback_system": "None", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], }, "fileMetadata": {}, "template": [], diff --git a/windows/release-information/index.md b/windows/release-information/index.md deleted file mode 100644 index c6eba252f9..0000000000 --- a/windows/release-information/index.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Windows 10 - release information -description: Learn release information for Windows 10 releases -keywords: ["Windows 10", "Windows 10 October 2018 Update"] -ms.prod: w10 -layout: LandingPage -ms.topic: landing-page -ms.mktglfcycl: deploy -ms.sitesec: library -author: lizap -ms.author: elizapo -ms.localizationpriority: high ---- - -# Windows 10 release information - -Feature updates for Windows 10 are released twice a year, around March and September, via the Semi-Annual Channel. They will be serviced with monthly quality updates for 18 or 30 months from the date of the release, depending on the lifecycle policy. - -We recommend that you begin deployment of each Semi-Annual Channel release immediately as a targeted deployment to devices selected for early adoption and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible. - -For information about servicing timelines, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853). - -> [!NOTE] -> Beginning with Windows 10, version 1903, you will find a [single entry for each SAC release](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523). - -
            -
            - - -
            diff --git a/windows/release-information/resolved-issues-windows-10-1507.yml b/windows/release-information/resolved-issues-windows-10-1507.yml deleted file mode 100644 index 7df978985d..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1507.yml +++ /dev/null @@ -1,53 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1507 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1507 - description: Resolved issues in Windows 10, version 1507 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1507"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1507 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - -
            SummaryOriginating updateStatusDate resolved
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            OS Build 10240.18334

            September 23, 2019
            KB4522009
            Resolved
            KB4520011
            October 08, 2019
            10:00 AM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: September 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4520011.

            Back to top
            OS Build 10240.18334

            September 23, 2019
            KB4522009
            Resolved
            KB4520011
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml deleted file mode 100644 index 5585df19da..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1607.yml +++ /dev/null @@ -1,75 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1607 and Windows Server 2016 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1607 and Windows Server 2016 - description: Resolved issues in Windows 10, version 1607 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1607"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1607 and Windows Server 2016 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - -
            SummaryOriginating updateStatusDate resolved
            Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
            Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

            See details >
            OS Build 14393.2608

            November 13, 2018
            KB4467691
            Resolved External
            January 23, 2020
            02:08 PM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            OS Build 14393.3206

            September 23, 2019
            KB4522010
            Resolved
            KB4519998
            October 08, 2019
            10:00 AM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

            See details >
            OS Build 14393.3204

            September 10, 2019
            KB4516044
            Resolved
            September 17, 2019
            04:47 PM PT
            Apps and scripts using the NetQueryDisplayInformation API may fail with error
            Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.

            See details >
            OS Build 14393.3053

            June 18, 2019
            KB4503294
            Resolved
            KB4516044
            September 10, 2019
            10:00 AM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: September 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4519998.

            Back to top
            OS Build 14393.3206

            September 23, 2019
            KB4522010
            Resolved
            KB4519998
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
            Resolution: After investigation, we have found that this issue does not affect this version of Windows.

            Back to top
            OS Build 14393.3204

            September 10, 2019
            KB4516044
            Resolved
            Resolved:
            September 17, 2019
            04:47 PM PT

            Opened:
            September 13, 2019
            05:25 PM PT
            - " - -- title: August 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Apps and scripts using the NetQueryDisplayInformation API may fail with error
             Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

            Affected platforms:
            • Server: Windows Server 2019; Windows Server 2016
            Resolution: This issue was resolved in KB4516044.

            Back to top
            OS Build 14393.3053

            June 18, 2019
            KB4503294
            Resolved
            KB4516044
            Resolved:
            September 10, 2019
            10:00 AM PT

            Opened:
            August 01, 2019
            05:00 PM PT
            - " - -- title: November 2018 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
            After installing KB4467691, Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

            Affected platforms:
            • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
            • Server: Windows Server 2016
            Workaround: Restart the affected machine using the Unified Extensible Firmware Interface (UEFI). Disable Secure Boot and then restart.

            If BitLocker is enabled on your machine, you may have to go through BitLocker recovery after Secure Boot has been disabled.

            Resolution: Lenovo and Fujitsu are aware of this issue. Please contact your OEM to ask if there is a firmware update available for your device.

            Back to top
            OS Build 14393.2608

            November 13, 2018
            KB4467691
            Resolved External
            Last updated:
            January 23, 2020
            02:08 PM PT

            Opened:
            November 13, 2018
            10:00 AM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml deleted file mode 100644 index c85bdd82e9..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1709.yml +++ /dev/null @@ -1,65 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1709 and Windows Server, version 1709 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1709 and Windows Server, version 1709 - description: Resolved issues in Windows 10, version 1709 and Windows Server 1709 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1709"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1709 and Windows Server, version 1709 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - -
            SummaryOriginating updateStatusDate resolved
            Unable to create local users in Chinese, Japanese and Korean during device setup
            You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

            See details >
            OS Build 16299.1387

            September 10, 2019
            KB4516066
            Resolved
            KB4534318
            January 23, 2020
            02:00 PM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            OS Build 16299.1392

            September 23, 2019
            KB4522012
            Resolved
            KB4520004
            October 08, 2019
            10:00 AM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

            See details >
            OS Build 16299.1387

            September 10, 2019
            KB4516066
            Resolved
            September 19, 2019
            04:08 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: October 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Unable to create local users in Chinese, Japanese and Korean during device setup
            When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

            Note This issue does not affect using a Microsoft Account during OOBE.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
            Resolution: This issue was resolved in KB4534318.

            Back to top
            OS Build 16299.1387

            September 10, 2019
            KB4516066
            Resolved
            KB4534318
            Resolved:
            January 23, 2020
            02:00 PM PT

            Opened:
            October 29, 2019
            05:15 PM PT
            - " - -- title: September 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4520004.

            Back to top
            OS Build 16299.1392

            September 23, 2019
            KB4522012
            Resolved
            KB4520004
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

            Resolution: Due to security related changes in KB4516066, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
            1. Select the Start button and type Services.
            2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
            3. Locate Startup type: and change it to Manual
            4. Select Ok
            5. The TabletInputService service is now in the default configuration and IME should work as expected.

            Back to top
            OS Build 16299.1387

            September 10, 2019
            KB4516066
            Resolved
            Resolved:
            September 19, 2019
            04:08 PM PT

            Opened:
            September 13, 2019
            05:25 PM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml deleted file mode 100644 index 63b5bd826c..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1803.yml +++ /dev/null @@ -1,79 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1803 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1803 - description: Resolved issues in Windows 10, version 1803 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1803"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1803 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - -
            SummaryOriginating updateStatusDate resolved
            Unable to create local users in Chinese, Japanese and Korean during device setup
            You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

            See details >
            OS Build 17134.1006

            September 10, 2019
            KB4516058
            Resolved
            KB4534308
            January 23, 2020
            02:00 PM PT
            Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
            You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.

            See details >
            OS Build 17134.950

            August 13, 2019
            KB4512501
            Resolved
            KB4519978
            October 15, 2019
            10:00 AM PT
            Startup to a black screen after installing updates
            Your device may startup to a black screen during the first logon after installing updates.

            See details >
            OS Build 17134.829

            June 11, 2019
            KB4503286
            Resolved
            KB4519978
            October 15, 2019
            10:00 AM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            OS Build 17134.1009

            September 23, 2019
            KB4522014
            Resolved
            KB4520008
            October 08, 2019
            10:00 AM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

            See details >
            OS Build 17134.1006

            September 10, 2019
            KB4516058
            Resolved
            September 19, 2019
            04:08 PM PT
            Notification issue: \"Your device is missing important security and quality fixes.\"
            Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

            See details >
            N/A

            Resolved
            September 03, 2019
            12:32 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: October 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Unable to create local users in Chinese, Japanese and Korean during device setup
            When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

            Note This issue does not affect using a Microsoft Account during OOBE.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
            Resolution: This issue was resolved in KB4534308.

            Back to top
            OS Build 17134.1006

            September 10, 2019
            KB4516058
            Resolved
            KB4534308
            Resolved:
            January 23, 2020
            02:00 PM PT

            Opened:
            October 29, 2019
            05:15 PM PT
            - " - -- title: September 2019 -- items: - - type: markdown - text: " - - - - - -
            DetailsOriginating updateStatusHistory
            Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
            After installing KB4512501, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

            Affected platforms:
            • Client: Windows 10, version 1809; Windows 10, version 1803
            Resolution: This issue was resolved in KB4519978.

            Back to top
            OS Build 17134.950

            August 13, 2019
            KB4512501
            Resolved
            KB4519978
            Resolved:
            October 15, 2019
            10:00 AM PT

            Opened:
            September 11, 2019
            05:32 PM PT
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4520008.

            Back to top
            OS Build 17134.1009

            September 23, 2019
            KB4522014
            Resolved
            KB4520008
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

            Resolution: Due to security related changes in KB4516058, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
            1. Select the Start button and type Services.
            2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
            3. Locate Startup type: and change it to Manual
            4. Select Ok
            5. The TabletInputService service is now in the default configuration and IME should work as expected.

            Back to top
            OS Build 17134.1006

            September 10, 2019
            KB4516058
            Resolved
            Resolved:
            September 19, 2019
            04:08 PM PT

            Opened:
            September 13, 2019
            05:25 PM PT
            Notification issue: \"Your device is missing important security and quality fixes.\"
            Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.

            Affected platforms:
            • Client: Windows 10, version 1803
            • Server: Windows Server, version 1803
            Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. 

            Back to top
            N/A

            Resolved
            Resolved:
            September 03, 2019
            12:32 PM PT

            Opened:
            September 03, 2019
            12:32 PM PT
            - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Startup to a black screen after installing updates
            We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.


            Affected platforms:
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
            • Server: Windows Server 2019
            Resolution: This issue was resolved in KB4519978.

            Back to top
            OS Build 17134.829

            June 11, 2019
            KB4503286
            Resolved
            KB4519978
            Resolved:
            October 15, 2019
            10:00 AM PT

            Opened:
            June 14, 2019
            04:41 PM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml deleted file mode 100644 index 2eb42f02b4..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ /dev/null @@ -1,89 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1809 and Windows Server 2019 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1809 and Windows Server 2019 - description: Resolved issues in Windows 10, version 1809 or Windows Server 2019 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10 1809"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1809 and Windows Server 2019 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - -
            SummaryOriginating updateStatusDate resolved
            Unable to create local users in Chinese, Japanese and Korean during device setup
            You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

            See details >
            OS Build 17763.737

            September 10, 2019
            KB4512578
            Resolved
            KB4534321
            January 23, 2020
            02:00 PM PT
            Microsoft Defender Advanced Threat Protection might stop running
            The Microsoft Defender ATP service might stop running and might fail to send reporting data.

            See details >
            OS Build 17763.832

            October 15, 2019
            KB4520062
            Resolved
            KB4523205
            November 12, 2019
            10:00 AM PT
            Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
            You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.

            See details >
            OS Build 17763.678

            August 13, 2019
            KB4511553
            Resolved
            KB4520062
            October 15, 2019
            10:00 AM PT
            Startup to a black screen after installing updates
            Your device may startup to a black screen during the first logon after installing updates.

            See details >
            OS Build 17763.557

            June 11, 2019
            KB4503327
            Resolved
            KB4520062
            October 15, 2019
            10:00 AM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            OS Build 17763.740

            September 23, 2019
            KB4522015
            Resolved
            KB4519338
            October 08, 2019
            10:00 AM PT
            Apps and scripts using the NetQueryDisplayInformation API may fail with error
            Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.

            See details >
            OS Build 17763.55

            October 09, 2018
            KB4464330
            Resolved
            KB4516077
            September 24, 2019
            10:00 AM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

            See details >
            OS Build 17763.737

            September 10, 2019
            KB4512578
            Resolved
            September 19, 2019
            04:08 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: October 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Unable to create local users in Chinese, Japanese and Korean during device setup
            When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

            Note This issue does not affect using a Microsoft Account during OOBE.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
            Resolution: This issue was resolved in KB4534321.

            Back to top
            OS Build 17763.737

            September 10, 2019
            KB4512578
            Resolved
            KB4534321
            Resolved:
            January 23, 2020
            02:00 PM PT

            Opened:
            October 29, 2019
            05:15 PM PT
            Microsoft Defender Advanced Threat Protection might stop running
            After installing the optional non-security update (KB4520062), the Microsoft Defender Advanced Threat Protection (ATP) service might stop running and might fail to send reporting data. You might also receive a 0xc0000409 error in Event Viewer on MsSense.exe.

            Note Microsoft Windows Defender Antivirus is not affected by this issue.

            Affected platforms:
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
            • Server: Windows Server, version 1809; Windows Server 2019
            Resolution: This issue was resolved in KB4523205.

            Back to top
            OS Build 17763.832

            October 15, 2019
            KB4520062
            Resolved
            KB4523205
            Resolved:
            November 12, 2019
            10:00 AM PT

            Opened:
            October 17, 2019
            05:14 PM PT
            - " - -- title: September 2019 -- items: - - type: markdown - text: " - - - - -
            DetailsOriginating updateStatusHistory
            Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
            After installing KB4511553, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

            Affected platforms:
            • Client: Windows 10, version 1809; Windows 10, version 1803
            Resolution: This issue was resolved in KB4520062.

            Back to top
            OS Build 17763.678

            August 13, 2019
            KB4511553
            Resolved
            KB4520062
            Resolved:
            October 15, 2019
            10:00 AM PT

            Opened:
            September 11, 2019
            05:32 PM PT
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4519338.

            Back to top
            OS Build 17763.740

            September 23, 2019
            KB4522015
            Resolved
            KB4519338
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

            Resolution: Due to security related changes in KB4512578, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
            1. Select the Start button and type Services.
            2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
            3. Locate Startup type: and change it to Manual
            4. Select Ok
            5. The TabletInputService service is now in the default configuration and IME should work as expected.

            Back to top
            OS Build 17763.737

            September 10, 2019
            KB4512578
            Resolved
            Resolved:
            September 19, 2019
            04:08 PM PT

            Opened:
            September 13, 2019
            05:25 PM PT
            - " - -- title: August 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Apps and scripts using the NetQueryDisplayInformation API may fail with error
             Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

            Affected platforms:
            • Server: Windows Server 2019; Windows Server 2016
            Resolution: This issue was resolved in KB4516077.

            Back to top
            OS Build 17763.55

            October 09, 2018
            KB4464330
            Resolved
            KB4516077
            Resolved:
            September 24, 2019
            10:00 AM PT

            Opened:
            August 01, 2019
            05:00 PM PT
            - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Startup to a black screen after installing updates
            We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.


            Affected platforms:
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
            • Server: Windows Server 2019
            Resolution: This issue was resolved in KB4520062.

            Back to top
            OS Build 17763.557

            June 11, 2019
            KB4503327
            Resolved
            KB4520062
            Resolved:
            October 15, 2019
            10:00 AM PT

            Opened:
            June 14, 2019
            04:41 PM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml deleted file mode 100644 index 8970861527..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ /dev/null @@ -1,124 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1903 and Windows Server, version 1903 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1903 and Windows Server, version 1903 - description: Resolved issues in Windows 10, version 1903 and Windows Server 1903 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1903"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1903 and Windows Server, version 1903 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - - - -
            SummaryOriginating updateStatusDate resolved
            Unable to create local users in Chinese, Japanese and Korean during device setup
            You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

            See details >
            OS Build 18362.356

            September 10, 2019
            KB4515384
            Resolved
            KB4530684
            December 10, 2019
            10:00 AM PT
            Intermittent loss of Wi-Fi connectivity
            Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

            See details >
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved External
            November 22, 2019
            04:10 PM PT
            Unable to discover or connect to Bluetooth devices using some Realtek adapters
            Microsoft has identified compatibility issues with some versions of Realtek Bluetooth radio drivers.

            See details >
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved External
            November 15, 2019
            05:59 PM PT
            Updates may fail to install and you may receive Error 0x80073701
            Installation of updates may fail and you may receive error code 0x80073701.

            See details >
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            November 12, 2019
            08:11 AM PT
            Intel Audio displays an intcdaud.sys notification
            Devices with a range of Intel Display Audio device drivers may experience battery drain.

            See details >
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved External
            November 12, 2019
            08:04 AM PT
            Unable to discover or connect to Bluetooth devices using some Qualcomm adapters
            Microsoft has identified compatibility issues with some versions of Qualcomm Bluetooth radio drivers.

            See details >
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved
            KB4517389
            October 08, 2019
            10:00 AM PT
            Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
            Some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards may experience compatibility issues.

            See details >
            N/A

            Resolved
            KB4522355
            October 24, 2019
            10:00 AM PT
            dGPU occasionally disappear from device manager on Surface Book 2
            Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.

            See details >
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            October 18, 2019
            04:33 PM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            OS Build 18362.357

            September 23, 2019
            KB4522016
            Resolved
            KB4517389
            October 08, 2019
            10:00 AM PT
            Audio in games is quiet or different than expected
            Microsoft has received reports that audio in certain games is quieter or different than expected.

            See details >
            OS Build 18362.356

            September 10, 2019
            KB4515384
            Resolved
            KB4517211
            September 26, 2019
            02:00 PM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

            See details >
            OS Build 18362.356

            September 10, 2019
            KB4515384
            Resolved
            September 19, 2019
            04:08 PM PT
            Some users report issues related to the Start menu and Windows Desktop Search
            A small number of users have reported issues related to the Start menu and Windows Desktop Search.

            See details >
            OS Build 18362.356

            September 10, 2019
            KB4515384
            Resolved
            September 19, 2019
            04:58 PM PT
            Screenshots and Snips have an unnatural orange tint
            Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

            See details >
            OS Build 18362.356

            September 10, 2019
            KB4516115
            Resolved External
            September 11, 2019
            08:54 PM PT
            Windows Desktop Search may not return any results and may have high CPU usage
            Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

            See details >
            OS Build 18362.329

            August 30, 2019
            KB4512941
            Resolved
            KB4515384
            September 10, 2019
            10:00 AM PT
            Domain connected devices that use MIT Kerberos realms will not start up
            Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.

            See details >
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            KB4512941
            August 30, 2019
            10:00 AM PT
            Issues updating when certain versions of Intel storage drivers are installed
            Windows 10, version 1903 update may fail with certain versions of Intel Rapid Storage Technology (Intel RST) drivers.

            See details >
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            KB4512941
            August 30, 2019
            10:00 AM PT
            Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
            Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

            See details >
            OS Build 18362.295

            August 13, 2019
            KB4512508
            Resolved
            KB4512941
            August 30, 2019
            10:00 AM PT
            Initiating a Remote Desktop connection may result in black screen
            When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

            See details >
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            KB4512941
            August 30, 2019
            10:00 AM PT
            Windows Sandbox may fail to start with error code “0x80070002”
            Windows Sandbox may fail to start on devices in which the operating system language was changed between updates.

            See details >
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved
            KB4512941
            August 30, 2019
            10:00 AM PT
            Devices starting using PXE from a WDS or Configuration Manager servers may fail to start
            Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

            See details >
            OS Build 18362.175

            June 11, 2019
            KB4503293
            Resolved
            KB4512941
            August 30, 2019
            10:00 AM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: October 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Unable to create local users in Chinese, Japanese and Korean during device setup
            When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

            Note This issue does not affect using a Microsoft Account during OOBE.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
            Resolution: This issue was resolved in KB4530684.

            Back to top
            OS Build 18362.356

            September 10, 2019
            KB4515384
            Resolved
            KB4530684
            Resolved:
            December 10, 2019
            10:00 AM PT

            Opened:
            October 29, 2019
            05:15 PM PT
            Unable to discover or connect to Bluetooth devices using some Qualcomm adapters
            Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

            Affected platforms:
            • Client: Windows 10, version 1903
            • Server: Windows Server, version 1903
            Resolution: This issue was resolved in KB4517389 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

            Back to top
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved
            KB4517389
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            October 25, 2019
            04:21 PM PT
            - " - -- title: September 2019 -- items: - - type: markdown - text: " - - - - - - - - -
            DetailsOriginating updateStatusHistory
            Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
            Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.

            To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.

            Affected platforms:
            • Client: Windows 10, version 1903
            Resolution: This issue was resolved in KB4522355. The safeguard hold is estimated to be removed in mid-November.

            Back to top
            N/A

            Resolved
            KB4522355
            Resolved:
            October 24, 2019
            10:00 AM PT

            Opened:
            September 13, 2019
            05:25 PM PT
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4517389.

            Back to top
            OS Build 18362.357

            September 23, 2019
            KB4522016
            Resolved
            KB4517389
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            Audio in games is quiet or different than expected
            Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

            Affected platforms:
            • Client: Windows 10, version 1903
            Resolution: This issue was resolved in KB4517211.

            Back to top
            OS Build 18362.356

            September 10, 2019
            KB4515384
            Resolved
            KB4517211
            Resolved:
            September 26, 2019
            02:00 PM PT

            Opened:
            September 13, 2019
            05:25 PM PT
            IME may become unresponsive or have High CPU usage
            Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

            Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
            1. Select the Start button and type Services.
            2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
            3. Locate Startup type: and change it to Manual
            4. Select Ok
            5. The TabletInputService service is now in the default configuration and IME should work as expected.

            Back to top
            OS Build 18362.356

            September 10, 2019
            KB4515384
            Resolved
            Resolved:
            September 19, 2019
            04:08 PM PT

            Opened:
            September 13, 2019
            05:25 PM PT
            Some users report issues related to the Start menu and Windows Desktop Search
            Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

            Affected platforms:
            • Client: Windows 10, version 1903
            Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

            Back to top
            OS Build 18362.356

            September 10, 2019
            KB4515384
            Resolved
            Resolved:
            September 19, 2019
            04:58 PM PT

            Opened:
            September 11, 2019
            05:18 PM PT
            Screenshots and Snips have an unnatural orange tint
            When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

            Affected platforms:
            • Client: Windows 10, version 1903
            • Server: None
            Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

            Back to top
            OS Build 18362.356

            September 10, 2019
            KB4516115
            Resolved External
            Last updated:
            September 11, 2019
            08:54 PM PT

            Opened:
            September 11, 2019
            08:54 PM PT
            Windows Desktop Search may not return any results and may have high CPU usage
            Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

            Affected platforms:
            • Client: Windows 10, version 1903
            Resolution: This issue was resolved in KB4515384.

            Back to top
            OS Build 18362.329

            August 30, 2019
            KB4512941
            Resolved
            KB4515384
            Resolved:
            September 10, 2019
            10:00 AM PT

            Opened:
            September 04, 2019
            02:25 PM PT
            - " - -- title: August 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Updates may fail to install and you may receive Error 0x80073701
            Installation of updates may fail and you may receive the error message, \"Updates Failed, There were problems installing some updates, but we'll try again later\" or \"Error 0x80073701\" on the Windows Update dialog or within Update history.

            Affected platforms:
            • Client: Windows 10, version 1903
            • Server: Windows Server, version 1903
            Resolution: This issue has been resolved for most users. If you are still having issues, please see KB4528159.

            Back to top
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            Resolved:
            November 12, 2019
            08:11 AM PT

            Opened:
            August 16, 2019
            01:41 PM PT
            Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
            After installing KB4512508, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4512941. The ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512941 and install. For instructions, see Update Windows 10.

            Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

            Back to top
            OS Build 18362.295

            August 13, 2019
            KB4512508
            Resolved
            KB4512941
            Resolved:
            August 30, 2019
            10:00 AM PT

            Opened:
            August 14, 2019
            03:34 PM PT
            - " - -- title: July 2019 -- items: - - type: markdown - text: " - - - - - - -
            DetailsOriginating updateStatusHistory
            dGPU occasionally disappear from device manager on Surface Book 2
            Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing units (dGPUs). After updating to Windows 10, version 1903 (the May 2019 Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.
             
            To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPU from being offered Windows 10, version 1903 until this issue is resolved.
             
            Affected platforms:
            • Client: Windows 10, version 1903
            Resolved: To resolve this issue, you will need to update the firmware of your Surface Book 2 device. Please see the Surface Book 2 update history page for instructions on how to install the October 2019 updates on your device. There is no update for Windows needed for this issue.
             
            The safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903.

            Back to top
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            Resolved:
            October 18, 2019
            04:33 PM PT

            Opened:
            July 12, 2019
            04:20 PM PT
            Domain connected devices that use MIT Kerberos realms will not start up
            Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

            To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

            Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
            HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
            -

            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
            Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

            Back to top
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            KB4512941
            Resolved:
            August 30, 2019
            10:00 AM PT

            Opened:
            July 25, 2019
            06:10 PM PT
            Issues updating when certain versions of Intel storage drivers are installed
            Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

            To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

            Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

            Affected platforms:
            • Client: Windows 10, version 1903
            • Server: Windows Server, version 1903
            Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

            Back to top
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            KB4512941
            Resolved:
            August 30, 2019
            10:00 AM PT

            Opened:
            July 25, 2019
            06:10 PM PT
            Initiating a Remote Desktop connection may result in black screen
            When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

            Affected platforms:
            • Client: Windows 10, version 1903
            • Server: Windows Server, version 1903
            Resolution: This issue was resolved in KB4512941.

            Back to top
            OS Build 18362.145

            May 29, 2019
            KB4497935
            Resolved
            KB4512941
            Resolved:
            August 30, 2019
            10:00 AM PT

            Opened:
            July 12, 2019
            04:42 PM PT
            Devices starting using PXE from a WDS or Configuration Manager servers may fail to start
            Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

            Affected platforms:
            • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
            Resolution: This issue was resolved in KB4512941.

            Back to top
            OS Build 18362.175

            June 11, 2019
            KB4503293
            Resolved
            KB4512941
            Resolved:
            August 30, 2019
            10:00 AM PT

            Opened:
            July 10, 2019
            02:51 PM PT
            - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - - - -
            DetailsOriginating updateStatusHistory
            Intermittent loss of Wi-Fi connectivity
            Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

            To safeguard your upgrade experience, we have applied a hold on devices with affected Qualcomm driver from being offered Windows 10, version 1903 or Windows 10, version 1909, until the updated driver is installed.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903
            Resolution: This issue was resolved with an updated Qualcomm Wifi driver and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1909 or Windows 10, version 1903.

            Back to top
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved External
            Last updated:
            November 22, 2019
            04:10 PM PT

            Opened:
            May 21, 2019
            07:13 AM PT
            Unable to discover or connect to Bluetooth devices using some Realtek adapters
            Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903
            • Server: Windows 10, version 1909; Windows Server, version 1903
            Resolution: This issue was resolved with an updated driver for the affected Realtek Bluetooth radio and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1909 or Windows 10, version 1903.

            Back to top
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved External
            Last updated:
            November 15, 2019
            05:59 PM PT

            Opened:
            May 21, 2019
            07:29 AM PT
            Intel Audio displays an intcdaud.sys notification
            Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
              
            To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809
            Resolution: This issue was resolved with updated drivers from your device manufacturer (OEM) or Intel. The safeguard hold has been removed.

            Note If you are still experiencing the issue described, please contact your device manufacturer (OEM).

            Back to top
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved External
            Last updated:
            November 12, 2019
            08:04 AM PT

            Opened:
            May 21, 2019
            07:22 AM PT
            Windows Sandbox may fail to start with error code “0x80070002”
            Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

            Affected platforms:
            • Client: Windows 10, version 1903
            Resolution: This issue was resolved in KB4512941.

            Back to top
            OS Build 18362.116

            May 21, 2019
            KB4505057
            Resolved
            KB4512941
            Resolved:
            August 30, 2019
            10:00 AM PT

            Opened:
            May 24, 2019
            04:20 PM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-10-1909.yml b/windows/release-information/resolved-issues-windows-10-1909.yml deleted file mode 100644 index a1e9bd5092..0000000000 --- a/windows/release-information/resolved-issues-windows-10-1909.yml +++ /dev/null @@ -1,65 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 10, version 1909 and Windows Server, version 1909 -metadata: - document_id: - title: Resolved issues in Windows 10, version 1909 and Windows Server, version 1909 - description: Resolved issues in Windows 10, version 1909 and Windows Server 1909 - keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1909"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 10, version 1909 and Windows Server, version 1909 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - -
            SummaryOriginating updateStatusDate resolved
            Unable to create local users in Chinese, Japanese and Korean during device setup
            You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

            See details >
            OS Build 18363.476

            November 12, 2019
            KB4524570
            Resolved
            KB4530684
            December 10, 2019
            10:00 AM PT
            Intermittent loss of Wi-Fi connectivity
            Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

            See details >
            OS Build 18363.476

            November 12, 2019
            KB4524570
            Resolved External
            November 22, 2019
            04:10 PM PT
            Unable to discover or connect to Bluetooth devices using some Realtek adapters
            Microsoft has identified compatibility issues with some versions of Realtek Bluetooth radio drivers.

            See details >
            OS Build 18363.476

            November 12, 2019
            KB4524570
            Resolved External
            November 15, 2019
            05:59 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: October 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Unable to create local users in Chinese, Japanese and Korean during device setup
            When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

            Note This issue does not affect using a Microsoft Account during OOBE.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
            Resolution: This issue was resolved in KB4530684.

            Back to top
            OS Build 18363.476

            November 12, 2019
            KB4524570
            Resolved
            KB4530684
            Resolved:
            December 10, 2019
            10:00 AM PT

            Opened:
            October 29, 2019
            05:15 PM PT
            - " - -- title: May 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Intermittent loss of Wi-Fi connectivity
            Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

            To safeguard your upgrade experience, we have applied a hold on devices with affected Qualcomm driver from being offered Windows 10, version 1903 or Windows 10, version 1909, until the updated driver is installed.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903
            Resolution: This issue was resolved with an updated Qualcomm Wifi driver and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1909 or Windows 10, version 1903.

            Back to top
            OS Build 18363.476

            November 12, 2019
            KB4524570
            Resolved External
            Last updated:
            November 22, 2019
            04:10 PM PT

            Opened:
            May 21, 2019
            07:13 AM PT
            Unable to discover or connect to Bluetooth devices using some Realtek adapters
            Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903
            • Server: Windows 10, version 1909; Windows Server, version 1903
            Resolution: This issue was resolved with an updated driver for the affected Realtek Bluetooth radio and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1909 or Windows 10, version 1903.

            Back to top
            OS Build 18363.476

            November 12, 2019
            KB4524570
            Resolved External
            Last updated:
            November 15, 2019
            05:59 PM PT

            Opened:
            May 21, 2019
            07:29 AM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml deleted file mode 100644 index d559457fca..0000000000 --- a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml +++ /dev/null @@ -1,85 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1 -metadata: - document_id: - title: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1 - description: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1 - keywords: ["Resolved issues in Windows 7", "Windows 7", "Windows Server 2008 R2 SP1"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 7 and Windows Server 2008 R2 SP1 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - - -
            SummaryOriginating updateStatusDate resolved
            After installing an update and restarting, you might receive an error
            You might receive the error, “Failure to configure Windows updates. Reverting Changes.” or \"Failed\" in Update History.

            See details >
            February 11, 2020
            KB4537820
            Resolved
            February 12, 2020
            05:37 PM PT
            Custom wallpaper displays as black
            Using a custom image set to \"Stretch\" might not display as expected.

            See details >
            January 14, 2020
            KB4534310
            Resolved
            KB4539601
            February 07, 2020
            10:00 AM PT
            MSRT might fail to install and be re-offered from Windows Update or WSUS
            The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from WU/WSUS.

            See details >

            Resolved
            January 23, 2020
            02:08 PM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            September 24, 2019
            KB4516048
            Resolved
            KB4519976
            October 08, 2019
            10:00 AM PT
            You may receive an error when opening or using the Toshiba Qosmio AV Center
            Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

            See details >
            August 13, 2019
            KB4512506
            Resolved
            KB4516048
            September 24, 2019
            10:00 AM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            After installing an update and restarting, you might receive an error
            After installing KB4537820 and restarting your device, you might receive the error, “Failure to configure Windows updates. Reverting Changes. Do not turn off your computer,” and the update might show as Failed in Update History.

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This is expected in the following circumstances:
            • If you are installing this update on a device that is running an edition that is not supported for ESU. For a complete list of which editions are supported, see KB4497181.
            • If you do not have an ESU MAK add-on key installed and activated. 
            If you have purchased an ESU key and have encountered this issue, please verify you have applied all prerequisites and that your key is activated. For information on activation, please see this blog post. For information on the prerequisites, see the \"How to get this update\" section of this article.

            Back to top
            February 11, 2020
            KB4537820
            Resolved
            Resolved:
            February 12, 2020
            05:37 PM PT

            Opened:
            February 12, 2020
            03:47 PM PT
            - " - -- title: January 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Custom wallpaper displays as black
            After installing KB4534310, your desktop wallpaper when set to \"Stretch\" might display as black.

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1
            Resolution: This issue was resolved in KB4539601, if you are using Monthly Rollups. If you are using Security Only updates, see KB4539602. These updates are available for all customers running Windows 7 SP1 and Windows Server 2008 R2 SP1.

            Back to top
            January 14, 2020
            KB4534310
            Resolved
            KB4539601
            Resolved:
            February 07, 2020
            10:00 AM PT

            Opened:
            January 24, 2020
            09:15 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            MSRT might fail to install and be re-offered from Windows Update or WSUS
            The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from Windows Update (WU), Windows Server Update Services (WSUS) or Configuration Manager and might be re-offered. If you use WU or WSUS, you might also receive the following error in the WindowsUpdate.log, “Misc  WARNING: Digital Signatures on file C:\\Windows\\SoftwareDistribution\\Download\\XXXX are not trusted: Error 0x800b0109”. If you use Configuration Manager, you might also receive the following error in the WUAHandler.log, \"Failed to download updates to the WUAgent datastore. Error = 0x800b0109.     WUAHandler   14/11/2019 16:33:23        980 (0x03D4)\". Note All Configuration Manager information also applies to System Center Configuration Manager and Microsoft Endpoint Configuration Manager.

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in the December 2019 release of Windows Malicious Software Removal Tool (MSRT).

            Back to top

            Resolved
            Resolved:
            January 23, 2020
            02:08 PM PT

            Opened:
            November 15, 2019
            05:59 PM PT
            - " - -- title: September 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4519976. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

            Back to top
            September 24, 2019
            KB4516048
            Resolved
            KB4519976
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            You may receive an error when opening or using the Toshiba Qosmio AV Center
            After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

            Affected platforms:
            • Client: Windows 7 SP1
            Resolution: This issue was resolved in KB4516048.

            Back to top
            August 13, 2019
            KB4512506
            Resolved
            KB4516048
            Resolved:
            September 24, 2019
            10:00 AM PT

            Opened:
            September 10, 2019
            09:48 AM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml deleted file mode 100644 index bcebc8ddb6..0000000000 --- a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml +++ /dev/null @@ -1,65 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows 8.1 and Windows Server 2012 R2 -metadata: - document_id: - title: Resolved issues in Windows 8.1 and Windows Server 2012 R2 - description: Resolved issues in Windows 8.1 and Windows Server 2012 R2 - keywords: ["Resolved issues in Windows 8.1", "Windows 8.1", "Windows Server 2012 R2"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows 8.1 and Windows Server 2012 R2 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - -
            SummaryOriginating updateStatusDate resolved
            Printing from 32-bit apps might fail on a 64-bit OS
            When attempting to print, you may receive an error or the application may stop responding or close.

            See details >
            August 13, 2019
            KB4512489
            Resolved
            KB4525250
            November 12, 2019
            10:00 AM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            September 24, 2019
            KB4516041
            Resolved
            KB4520005
            October 08, 2019
            10:00 AM PT
            Windows RT 8.1 devices may have issues opening Internet Explorer 11
            On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.

            See details >
            September 10, 2019
            KB4516067
            Resolved
            KB4516041
            September 24, 2019
            10:00 AM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Printing from 32-bit apps might fail on a 64-bit OS
            When attempting to print from a 32-bit app on a 64-bit operating system (OS), you may receive an error, or the application may stop responding or close. Note This issue only affects the 64-bit Security Only updates listed and does not affect any Monthly Rollup.

            Affected platforms:
            • Client: Windows 8.1
            • Server: Windows Server 2012 R2; Windows Server 2012
            Resolution: This issue is resolved in KB4525250. However, the issue occurs when you install only KB4512489 (released on August 13, 2019) without installing KB4507457, the previous Security Only update (released July 9, 2019). Reminder When using the Security Only updates, you must install the latest and all previous Security Only updates to ensure that the device contains all resolved security vulnerabilities.

            Back to top
            August 13, 2019
            KB4512489
            Resolved
            KB4525250
            Resolved:
            November 12, 2019
            10:00 AM PT

            Opened:
            November 27, 2019
            04:02 PM PT
            - " - -- title: September 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4520005. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

            Back to top
            September 24, 2019
            KB4516041
            Resolved
            KB4520005
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            Windows RT 8.1 devices may have issues opening Internet Explorer 11
            On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"


            Affected platforms:
            • Client: Windows RT 8.1
            Resolution: This issue was resolved in KB4516041.

            Back to top
            September 10, 2019
            KB4516067
            Resolved
            KB4516041
            Resolved:
            September 24, 2019
            10:00 AM PT

            Opened:
            September 13, 2019
            05:25 PM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml deleted file mode 100644 index 794271af56..0000000000 --- a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml +++ /dev/null @@ -1,75 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows Server 2008 SP2 -metadata: - document_id: - title: Resolved issues in Windows Server 2008 SP2 - description: Resolved issues in Windows Server 2008 SP2 - keywords: ["Resolved issues in Windows Server 2008 SP2", "Windows Server 2008 SP2"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows Server 2008 SP2 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - - - -
            SummaryOriginating updateStatusDate resolved
            After installing an update and restarting, you might receive an error
            You might receive the error, “Failure to configure Windows updates. Reverting Changes.” or \"Failed\" in Update History.

            See details >
            February 11, 2020
            KB4537810
            Resolved
            February 12, 2020
            05:37 PM PT
            MSRT might fail to install and be re-offered from Windows Update or WSUS
            The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from WU/WSUS.

            See details >

            Resolved
            January 23, 2020
            02:08 PM PT
            Issues manually installing updates by double-clicking the .msu file
            You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.

            See details >
            September 10, 2019
            KB4474419
            Resolved
            KB4474419
            September 23, 2019
            10:00 AM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            September 24, 2019
            KB4516030
            Resolved
            KB4520002
            October 08, 2019
            10:00 AM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            After installing an update and restarting, you might receive an error
            After installing KB4537810 and restarting your device, you might receive the error, “Failure to configure Windows updates. Reverting Changes. Do not turn off your computer,” and the update might show as Failed in Update History.

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This is expected in the following circumstances:
            • If you are installing this update on a device that is running an edition that is not supported for ESU. For a complete list of which editions are supported, see KB4497181.
            • If you do not have an ESU MAK add-on key installed and activated. 
            If you have purchased an ESU key and have encountered this issue, please verify you have applied all prerequisites and that your key is activated. For information on activation, please see this blog post. For information on the prerequisites, see the \"How to get this update\" section of this article.

            Back to top
            February 11, 2020
            KB4537810
            Resolved
            Resolved:
            February 12, 2020
            05:37 PM PT

            Opened:
            February 12, 2020
            03:47 PM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            MSRT might fail to install and be re-offered from Windows Update or WSUS
            The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from Windows Update (WU), Windows Server Update Services (WSUS) or Configuration Manager and might be re-offered. If you use WU or WSUS, you might also receive the following error in the WindowsUpdate.log, “Misc  WARNING: Digital Signatures on file C:\\Windows\\SoftwareDistribution\\Download\\XXXX are not trusted: Error 0x800b0109”. If you use Configuration Manager, you might also receive the following error in the WUAHandler.log, \"Failed to download updates to the WUAgent datastore. Error = 0x800b0109.     WUAHandler   14/11/2019 16:33:23        980 (0x03D4)\". Note All Configuration Manager information also applies to System Center Configuration Manager and Microsoft Endpoint Configuration Manager.

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in the December 2019 release of Windows Malicious Software Removal Tool (MSRT).

            Back to top

            Resolved
            Resolved:
            January 23, 2020
            02:08 PM PT

            Opened:
            November 15, 2019
            05:59 PM PT
            - " - -- title: September 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Issues manually installing updates by double-clicking the .msu file
            After installing the SHA-2 update (KB4474419) released on September 10, 2019, you may encounter issues manually installing updates by double-clicking on the .msu file and may receive the error, \"Installer encountered an error: 0x80073afc. The resource loader failed to find MUI file.\"

            Affected platforms:
            • Server: Windows Server 2008 SP2
            Workaround: Open a command prompt and use the following command (replacing <msu location> with the actual location and filename of the update): wusa.exe <msu location> /quiet

            Resolution: This issue is resolved in KB4474419 released October 8, 2019. It will install automatically from Windows Update and Windows Server Update Services (WSUS). If you need to install this update manually, you will need to use the workaround above.

            Note If you previously installed KB4474419 released September 23, 2019, then you already have the latest version of this update and do not need to reinstall.

            Back to top
            September 10, 2019
            KB4474419
            Resolved
            KB4474419
            Resolved:
            September 23, 2019
            10:00 AM PT

            Opened:
            September 20, 2019
            04:57 PM PT
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4520002. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

            Back to top
            September 24, 2019
            KB4516030
            Resolved
            KB4520002
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            - " diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml deleted file mode 100644 index 87c57cef75..0000000000 --- a/windows/release-information/resolved-issues-windows-server-2012.yml +++ /dev/null @@ -1,63 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Resolved issues in Windows Server 2012 -metadata: - document_id: - title: Resolved issues in Windows Server 2012 - description: Resolved issues in Windows Server 2012 - keywords: ["Resolved issues in Windows Server 2012", "Windows Server 2012"] - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - See a list of known issues that have been resolved for Windows Server 2012 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page. - - " -- items: - - type: markdown - text: " -
            - " - -- title: Resolved issues -- items: - - type: markdown - text: " - - - -
            SummaryOriginating updateStatusDate resolved
            Printing from 32-bit apps might fail on a 64-bit OS
            When attempting to print, you may receive an error or the application may stop responding or close.

            See details >
            August 13, 2019
            KB4512482
            Resolved
            KB4525253
            November 12, 2019
            10:00 AM PT
            Intermittent issues when printing
            The print spooler service may intermittently have issues completing a print job and results print job failure.

            See details >
            September 24, 2019
            KB4516069
            Resolved
            KB4520007
            October 08, 2019
            10:00 AM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Printing from 32-bit apps might fail on a 64-bit OS
            When attempting to print from a 32-bit app on a 64-bit operating system (OS), you may receive an error, or the application may stop responding or close. Note This issue only affects the 64-bit Security Only updates listed and does not affect any Monthly Rollup.

            Affected platforms:
            • Client: Windows 8.1
            • Server: Windows Server 2012 R2; Windows Server 2012
            Resolution: This issue is resolved in KB4525253. However, the issue occurs when you install only KB4512482 (released on August 13, 2019) without installing KB4507447, the previous Security Only update (released July 9, 2019). Reminder When using the Security Only updates, you must install the latest and all previous Security Only updates to ensure that the device contains all resolved security vulnerabilities.

            Back to top
            August 13, 2019
            KB4512482
            Resolved
            KB4525253
            Resolved:
            November 12, 2019
            10:00 AM PT

            Opened:
            November 27, 2019
            04:02 PM PT
            - " - -- title: September 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Intermittent issues when printing
            Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
            • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
            • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
            Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This issue was resolved in KB4520007. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

            Back to top
            September 24, 2019
            KB4516069
            Resolved
            KB4520007
            Resolved:
            October 08, 2019
            10:00 AM PT

            Opened:
            September 30, 2019
            06:26 PM PT
            - " diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml deleted file mode 100644 index 9c9ab15b4e..0000000000 --- a/windows/release-information/status-windows-10-1507.yml +++ /dev/null @@ -1,101 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1507 -metadata: - document_id: - title: Windows 10, version 1507 - description: View announcements and review known issues and fixes for Windows 10 version 1507 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1507. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - -
            SummaryOriginating updateStatusLast updated
            You might encounter issues with KB4502496
            You might encounter issues trying to install or after installing KB4502496

            See details >
            N/A
            February 11, 2020
            KB4502496
            Mitigated
            February 15, 2020
            01:22 AM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            OS Build 10240.18368

            October 08, 2019
            KB4520011
            Mitigated External
            November 05, 2019
            03:36 PM PT
            Certain operations performed on a Cluster Shared Volume may fail
            Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

            See details >
            OS Build 10240.18094

            January 08, 2019
            KB4480962
            Mitigated
            April 25, 2019
            02:00 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            You might encounter issues with KB4502496
            You might encounter issues trying to install or after installing KB4502496.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4502496) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4502496 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4502496
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            OS Build 10240.18368

            October 08, 2019
            KB4520011
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Certain operations performed on a Cluster Shared Volume may fail
            Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

            Affected platforms: 
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
            • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: Do one of the following: 
            • Perform the operation from a process that has administrator privilege. 
            • Perform the operation from a node that doesn’t have CSV ownership. 
            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            OS Build 10240.18094

            January 08, 2019
            KB4480962
            Mitigated
            Last updated:
            April 25, 2019
            02:00 PM PT

            Opened:
            January 08, 2019
            10:00 AM PT
            - " diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml deleted file mode 100644 index 7aa6de52e5..0000000000 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ /dev/null @@ -1,113 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1607 and Windows Server 2016 -metadata: - document_id: - title: Windows 10, version 1607 and Windows Server 2016 - description: View announcements and review known issues and fixes for Windows 10 version 1607 and Windows Server 2016 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1607 and Windows Server 2016. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - - - -
            SummaryOriginating updateStatusLast updated
            “Reset this PC” feature might fail
            “Reset this PC” feature is also called “Push Button Reset” or PBR.

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            OS Build 14393.3274

            October 08, 2019
            KB4519998
            Mitigated External
            November 05, 2019
            03:36 PM PT
            Certain operations performed on a Cluster Shared Volume may fail
            Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

            See details >
            OS Build 14393.2724

            January 08, 2019
            KB4480961
            Mitigated
            April 25, 2019
            02:00 PM PT
            Cluster service may fail if the minimum password length is set to greater than 14
            The cluster service may fail to start if “Minimum Password Length” is configured with greater than 14 characters.

            See details >
            OS Build 14393.2639

            November 27, 2018
            KB4467684
            Mitigated
            April 25, 2019
            02:00 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            “Reset this PC” feature might fail
            Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to your desktop and receive the error “There was a problem resetting your PC”.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
            Workaround: The standalone security update, KB4524244 has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update.

            If you have installed this update and are experiencing this issue, the following steps should allow you to reset your device:
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
            5. Upon restart use the “Reset this PC” feature and you should not encounter this issue.

            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4524244) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            OS Build 14393.3274

            October 08, 2019
            KB4519998
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Certain operations performed on a Cluster Shared Volume may fail
            Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

            Affected platforms: 
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507;  Windows 10 Enterprise LTSB 2015; Windows 8.1
            • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: Do one of the following:
            • Perform the operation from a process that has administrator privilege. 
            • Perform the operation from a node that doesn’t have CSV ownership.
            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            OS Build 14393.2724

            January 08, 2019
            KB4480961
            Mitigated
            Last updated:
            April 25, 2019
            02:00 PM PT

            Opened:
            January 08, 2019
            10:00 AM PT
            - " - -- title: November 2018 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Cluster service may fail if the minimum password length is set to greater than 14
            After installing KB4467684, the cluster service may fail to start with the error \"2245 (NERR_PasswordTooShort)\" if the Group Policy \"Minimum Password Length\" is configured with greater than 14 characters.

            Affected platforms:
            • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
            • Server: Windows Server 2016
            Workaround: Set the domain default \"Minimum Password Length\" policy to less than or equal to 14 characters.

            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            OS Build 14393.2639

            November 27, 2018
            KB4467684
            Mitigated
            Last updated:
            April 25, 2019
            02:00 PM PT

            Opened:
            November 27, 2018
            10:00 AM PT
            - " diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml deleted file mode 100644 index 8938c52372..0000000000 --- a/windows/release-information/status-windows-10-1709.yml +++ /dev/null @@ -1,103 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1709 and Windows Server, version 1709 -metadata: - document_id: - title: Windows 10, version 1709 and Windows Server, version 1709 - description: View announcements and review known issues and fixes for Windows 10 version 1709 and Windows Server 1709 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1709 and Windows Server, version 1709. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - - -
            SummaryOriginating updateStatusLast updated
            “Reset this PC” feature might fail
            “Reset this PC” feature is also called “Push Button Reset” or PBR.

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            OS Build 16299.1451

            October 08, 2019
            KB4520004
            Mitigated External
            November 05, 2019
            03:36 PM PT
            Certain operations performed on a Cluster Shared Volume may fail
            Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

            See details >
            OS Build 16299.904

            January 08, 2019
            KB4480978
            Mitigated
            April 25, 2019
            02:00 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            “Reset this PC” feature might fail
            Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to your desktop and receive the error “There was a problem resetting your PC”.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
            Workaround: The standalone security update, KB4524244 has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update.

            If you have installed this update and are experiencing this issue, the following steps should allow you to reset your device:
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
            5. Upon restart use the “Reset this PC” feature and you should not encounter this issue.

            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4524244) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            OS Build 16299.1451

            October 08, 2019
            KB4520004
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Certain operations performed on a Cluster Shared Volume may fail
            Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

            Affected platforms: 
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
            • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: Do one of the following:
            • Perform the operation from a process that has administrator privilege. 
            • Perform the operation from a node that doesn’t have CSV ownership. 
            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            OS Build 16299.904

            January 08, 2019
            KB4480978
            Mitigated
            Last updated:
            April 25, 2019
            02:00 PM PT

            Opened:
            January 08, 2019
            10:00 AM PT
            - " diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml deleted file mode 100644 index 1baf22a6b0..0000000000 --- a/windows/release-information/status-windows-10-1803.yml +++ /dev/null @@ -1,107 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1803 -metadata: - document_id: - title: Windows 10, version 1803 - description: View announcements and review known issues and fixes for Windows 10 version 1803 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1803. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - -
            Current status as of November 12, 2019:       
            Windows 10, version 1803 (the April 2018 Update) Home and Pro editions have reached end of service. For Windows 10 devices that are at, or within several months of reaching end of service, Windows Update will automatically initiate a feature update (with users having the ability to choose a convenient time); keeping those devices supported and receiving the monthly updates that are critical to device security and ecosystem health.
            -
            - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - - -
            SummaryOriginating updateStatusLast updated
            “Reset this PC” feature might fail
            “Reset this PC” feature is also called “Push Button Reset” or PBR.

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            OS Build 17134.1069

            October 08, 2019
            KB4520008
            Mitigated External
            November 05, 2019
            03:36 PM PT
            Certain operations performed on a Cluster Shared Volume may fail
            Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

            See details >
            OS Build 17134.523

            January 08, 2019
            KB4480966
            Mitigated
            April 25, 2019
            02:00 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            “Reset this PC” feature might fail
            Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to your desktop and receive the error “There was a problem resetting your PC”.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
            Workaround: The standalone security update, KB4524244 has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update.

            If you have installed this update and are experiencing this issue, the following steps should allow you to reset your device:
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
            5. Upon restart use the “Reset this PC” feature and you should not encounter this issue.

            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4524244) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            OS Build 17134.1069

            October 08, 2019
            KB4520008
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Certain operations performed on a Cluster Shared Volume may fail
            Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

            Affected platforms: 
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
            • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: Do one of the following:
            • Perform the operation from a process that has administrator privilege. 
            • Perform the operation from a node that doesn’t have CSV ownership. 
            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            OS Build 17134.523

            January 08, 2019
            KB4480966
            Mitigated
            Last updated:
            April 25, 2019
            02:00 PM PT

            Opened:
            January 08, 2019
            10:00 AM PT
            - " diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml deleted file mode 100644 index a684f5350f..0000000000 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ /dev/null @@ -1,117 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1809 and Windows Server 2019 -metadata: - document_id: - title: Windows 10, version 1809 and Windows Server 2019 - description: View announcements and review known issues and fixes for Windows 10 version 1809 and Windows Server 2019 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 10, version 1809 and Windows Server 2019. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - -
            Current status as of November 12, 2019:
            Windows 10, version 1809 is designated for broad deployment. The recommended servicing status is Semi-Annual Channel.
            -
            - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - - - -
            SummaryOriginating updateStatusLast updated
            “Reset this PC” feature might fail
            “Reset this PC” feature is also called “Push Button Reset” or PBR.

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            OS Build 17763.805

            October 08, 2019
            KB4519338
            Mitigated External
            November 05, 2019
            03:36 PM PT
            Devices with some Asian language packs installed may receive an error
            Devices with Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"

            See details >
            OS Build 17763.437

            April 09, 2019
            KB4493509
            Mitigated
            May 03, 2019
            10:59 AM PT
            Certain operations performed on a Cluster Shared Volume may fail
            Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

            See details >
            OS Build 17763.253

            January 08, 2019
            KB4480116
            Mitigated
            April 09, 2019
            10:00 AM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            “Reset this PC” feature might fail
            Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to your desktop and receive the error “There was a problem resetting your PC”.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
            Workaround: The standalone security update, KB4524244 has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update.

            If you have installed this update and are experiencing this issue, the following steps should allow you to reset your device:
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
            5. Upon restart use the “Reset this PC” feature and you should not encounter this issue.

            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4524244) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            OS Build 17763.805

            October 08, 2019
            KB4519338
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " - -- title: May 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Devices with some Asian language packs installed may receive an error
            After installing the April 2019 Cumulative Update (KB4493509), devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"

            Affected platforms:
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
            • Server: Windows Server, version 1809; Windows Server 2019
            Workaround:
            1. Uninstall and reinstall any recently added language packs. For instructions, see \"Manage the input and display language settings in Windows 10\".
            2. Click Check for Updates and install the April 2019 Cumulative Update. For instructions, see \"Update Windows 10\".
            Note: If reinstalling the language pack does not mitigate the issue, reset your PC as follows:
              1. Go to Settings app -> Recovery.
              2. Click on Get Started under \"Reset this PC\" recovery option.
              3. Select \"Keep my Files\".
            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            OS Build 17763.437

            April 09, 2019
            KB4493509
            Mitigated
            Last updated:
            May 03, 2019
            10:59 AM PT

            Opened:
            May 02, 2019
            04:36 PM PT
            - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Certain operations performed on a Cluster Shared Volume may fail
            Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

            Affected platforms: 
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
            • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: Do one of the following:  
            • Perform the operation from a process that has administrator privilege. 
            • Perform the operation from a node that doesn’t have CSV ownership. 
            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            OS Build 17763.253

            January 08, 2019
            KB4480116
            Mitigated
            Last updated:
            April 09, 2019
            10:00 AM PT

            Opened:
            January 08, 2019
            10:00 AM PT
            - " diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml deleted file mode 100644 index 4fe4e28478..0000000000 --- a/windows/release-information/status-windows-10-1903.yml +++ /dev/null @@ -1,99 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1903 and Windows Server, version 1903 -metadata: - document_id: - title: Windows 10, version 1903 and Windows Server, version 1903 - description: View announcements and review known issues and fixes for Windows 10 version 1903 and Windows Server 1903 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues and the status of the rollout for Windows 10, version 1903 and Windows Server, version 1903. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - -
            Current status as of November 12, 2019:   
            Windows 10, version 1903 (the May 2019 Update) is designated ready for broad deployment for all users via Windows Update.

            We recommend commercial customers running earlier versions of Windows 10 begin broad deployments of Windows 10, version 1903 in their organizations.

            Note Follow @WindowsUpdate to find out when new content is published to the release information dashboard.
            -
            - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - - -
            SummaryOriginating updateStatusLast updated
            “Reset this PC” feature might fail
            “Reset this PC” feature is also called “Push Button Reset” or PBR.

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            Issues with some older versions of Avast and AVG anti-virus products
            Microsoft and Avast has identified compatibility issues with some versions of Avast and AVG Antivirus.

            See details >
            N/A

            Mitigated External
            November 25, 2019
            05:25 PM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            OS Build 18362.418

            October 08, 2019
            KB4517389
            Mitigated External
            November 05, 2019
            03:36 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            “Reset this PC” feature might fail
            Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to your desktop and receive the error “There was a problem resetting your PC”.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
            Workaround: The standalone security update, KB4524244 has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update.

            If you have installed this update and are experiencing this issue, the following steps should allow you to reset your device:
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
            5. Upon restart use the “Reset this PC” feature and you should not encounter this issue.

            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4524244) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            Issues with some older versions of Avast and AVG anti-virus products
            Microsoft and Avast has identified compatibility issues with some older versions of Avast Antivirus and AVG Antivirus that might still be installed by a small number of users. Any application from Avast or AVG that contains Antivirus version 19.5.4444.567 or earlier is affected.

            To safeguard your upgrade experience, we have applied a hold on devices with affected Avast and AVG Antivirus from being offered or installing Windows 10, version 1903 or Windows 10, version 1909, until the application is updated.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903
            • Server: Windows Server, version 1909; Windows Server, version 1903
            Workaround: Before updating to Windows 10, version 1903 or Windows 10, version 1909, you will need to download and install an updated version of your Avast or AVG application. Guidance for Avast and AVG customers can be found in the following support articles:
            Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new version of your Avast or AVG application has been installed and the Windows 10, version 1903 or Windows 10, version 1909 feature update has been automatically offered to you.

            Back to top
            N/A

            Mitigated External
            Last updated:
            November 25, 2019
            05:25 PM PT

            Opened:
            November 22, 2019
            04:10 PM PT
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            OS Build 18362.418

            October 08, 2019
            KB4517389
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " diff --git a/windows/release-information/status-windows-10-1909.yml b/windows/release-information/status-windows-10-1909.yml deleted file mode 100644 index 6029fe13f7..0000000000 --- a/windows/release-information/status-windows-10-1909.yml +++ /dev/null @@ -1,97 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 10, version 1909 and Windows Server, version 1909 -metadata: - document_id: - title: Windows 10, version 1909 and Windows Server, version 1909 - description: View announcements and review known issues and fixes for Windows 10 version 1909 and Windows Server 1909 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues and the status of the rollout for Windows 10, version 1909 and Windows Server, version 1909. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - -
            Current status as of January 21, 2020:
            Windows 10, version 1909 is available for any user on a recent version of Windows 10 who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel.
             
            We are starting the next phase in our controlled approach to automatically initiate a feature update for an increased number of devices running the October 2018 Update (Windows 10, version 1809) Home and Pro editions, keeping those devices supported and receiving the monthly updates that are critical to device security and ecosystem health. Our rollout process starts several months in advance of the end of service date to provide adequate time for a smooth update process.

            For information on how users running Windows 10, version 1903 can update to Windows 10, version 1909 in a new, streamlined way, see this post.
             
            Note follow @WindowsUpdate on Twitter to find out when new content is published to the release information dashboard.
            -
            - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - -
            SummaryOriginating updateStatusLast updated
            “Reset this PC” feature might fail
            “Reset this PC” feature is also called “Push Button Reset” or PBR.

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244

            See details >
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            February 15, 2020
            01:22 AM PT
            Issues with some older versions of Avast and AVG anti-virus products
            Microsoft and Avast has identified compatibility issues with some versions of Avast and AVG Antivirus.

            See details >
            N/A

            Mitigated External
            November 25, 2019
            05:25 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - - -
            DetailsOriginating updateStatusHistory
            “Reset this PC” feature might fail
            Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to your desktop and receive the error “There was a problem resetting your PC”.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
            Workaround: The standalone security update, KB4524244 has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update.

            If you have installed this update and are experiencing this issue, the following steps should allow you to reset your device:
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
            5. Upon restart use the “Reset this PC” feature and you should not encounter this issue.

            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            You might encounter issues with KB4524244
            You might encounter issues trying to install or after installing KB4524244.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4524244) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            N/A
            February 11, 2020
            KB4524244
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Issues with some older versions of Avast and AVG anti-virus products
            Microsoft and Avast has identified compatibility issues with some older versions of Avast Antivirus and AVG Antivirus that might still be installed by a small number of users. Any application from Avast or AVG that contains Antivirus version 19.5.4444.567 or earlier is affected.

            To safeguard your upgrade experience, we have applied a hold on devices with affected Avast and AVG Antivirus from being offered or installing Windows 10, version 1903 or Windows 10, version 1909, until the application is updated.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903
            • Server: Windows Server, version 1909; Windows Server, version 1903
            Workaround: Before updating to Windows 10, version 1903 or Windows 10, version 1909, you will need to download and install an updated version of your Avast or AVG application. Guidance for Avast and AVG customers can be found in the following support articles:
            Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new version of your Avast or AVG application has been installed and the Windows 10, version 1903 or Windows 10, version 1909 feature update has been automatically offered to you.

            Back to top
            N/A

            Mitigated External
            Last updated:
            November 25, 2019
            05:25 PM PT

            Opened:
            November 22, 2019
            04:10 PM PT
            - " diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml deleted file mode 100644 index d7e5928590..0000000000 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ /dev/null @@ -1,111 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 7 and Windows Server 2008 R2 SP1 -metadata: - document_id: - title: Windows 7 and Windows Server 2008 R2 SP1 - description: View announcements and review known issues and fixes for Windows 7 and Windows Server 2008 R2 SP1 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 7 and Windows Server 2008 R2 SP1. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - - -
            SummaryOriginating updateStatusLast updated
            After installing an update and restarting, you might receive an error
            You might receive the error, “Failure to configure Windows updates. Reverting Changes.” or \"Failed\" in Update History.

            See details >
            February 11, 2020
            KB4537820
            Resolved
            February 12, 2020
            05:37 PM PT
            Custom wallpaper displays as black
            Using a custom image set to \"Stretch\" might not display as expected.

            See details >
            January 14, 2020
            KB4534310
            Resolved
            KB4539601
            February 07, 2020
            10:00 AM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            October 08, 2019
            KB4519976
            Mitigated External
            November 05, 2019
            03:36 PM PT
            IA64 and x64 devices may fail to start after installing updates
            After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

            See details >
            August 13, 2019
            KB4512506
            Mitigated
            August 17, 2019
            12:59 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            After installing an update and restarting, you might receive an error
            After installing KB4537820 and restarting your device, you might receive the error, “Failure to configure Windows updates. Reverting Changes. Do not turn off your computer,” and the update might show as Failed in Update History.

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This is expected in the following circumstances:
            • If you are installing this update on a device that is running an edition that is not supported for ESU. For a complete list of which editions are supported, see KB4497181.
            • If you do not have an ESU MAK add-on key installed and activated. 
            If you have purchased an ESU key and have encountered this issue, please verify you have applied all prerequisites and that your key is activated. For information on activation, please see this blog post. For information on the prerequisites, see the \"How to get this update\" section of this article.

            Back to top
            February 11, 2020
            KB4537820
            Resolved
            Resolved:
            February 12, 2020
            05:37 PM PT

            Opened:
            February 12, 2020
            03:47 PM PT
            - " - -- title: January 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Custom wallpaper displays as black
            After installing KB4534310, your desktop wallpaper when set to \"Stretch\" might display as black.

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1
            Resolution: This issue was resolved in KB4539601, if you are using Monthly Rollups. If you are using Security Only updates, see KB4539602. These updates are available for all customers running Windows 7 SP1 and Windows Server 2008 R2 SP1.

            Back to top
            January 14, 2020
            KB4534310
            Resolved
            KB4539601
            Resolved:
            February 07, 2020
            10:00 AM PT

            Opened:
            January 24, 2020
            09:15 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            October 08, 2019
            KB4519976
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " - -- title: August 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            IA64 and x64 devices may fail to start after installing updates
            IA64 devices (in any configuration) and x64 devices using EFI boot that were provisioned after the July 9th updates and/or skipped the recommended update (KB3133977), may fail to start with the following error:
            \"File: \\Windows\\system32\\winload.efi
            Status: 0xc0000428
            Info: Windows cannot verify the digital signature for this file.\"

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1
            Take Action: To resolve this issue please follow the steps outlined in the SHA-2 support FAQ article for error code 0xc0000428.

            Back to top
            August 13, 2019
            KB4512506
            Mitigated
            Last updated:
            August 17, 2019
            12:59 PM PT

            Opened:
            August 13, 2019
            08:34 AM PT
            - " diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml deleted file mode 100644 index 1d522d681a..0000000000 --- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml +++ /dev/null @@ -1,111 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows 8.1 and Windows Server 2012 R2 -metadata: - document_id: - title: Windows 8.1 and Windows Server 2012 R2 - description: View announcements and review known issues and fixes for Windows 8.1 and Windows Server 2012 R2 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows 8.1 and Windows Server 2012 R2. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - - -
            SummaryOriginating updateStatusLast updated
            You might encounter issues with KB4502496
            You might encounter issues trying to install or after installing KB4502496

            See details >
            February 11, 2020
            KB4502496
            Mitigated
            February 15, 2020
            01:22 AM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            October 08, 2019
            KB4520005
            Mitigated External
            November 05, 2019
            03:36 PM PT
            Japanese IME doesn't show the new Japanese Era name as a text input option
            With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.

            See details >
            April 25, 2019
            KB4493443
            Mitigated
            May 15, 2019
            05:53 PM PT
            Certain operations performed on a Cluster Shared Volume may fail
            Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

            See details >
            January 08, 2019
            KB4480963
            Mitigated
            April 25, 2019
            02:00 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            You might encounter issues with KB4502496
            You might encounter issues trying to install or after installing KB4502496.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4502496) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4502496 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            February 11, 2020
            KB4502496
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            October 08, 2019
            KB4520005
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " - -- title: May 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Japanese IME doesn't show the new Japanese Era name as a text input option
            If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

            Affected platforms:
            • Client: Windows 8.1
            • Server: Windows Server 2012 R2; Windows Server 2012
            Workaround:
            If you see any of the previous dictionary updates listed below, uninstall it from Programs and features > Uninstall or change a program. New words that were in previous dictionary updates are also in this update.
            • Update for Japanese Microsoft IME Standard Dictionary (15.0.2013)
            • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.2013)
            • Update for Japanese Microsoft IME Standard Dictionary (15.0.1215)
            • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1215)
            • Update for Japanese Microsoft IME Standard Dictionary (15.0.1080)
            • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1080)

            Back to top
            April 25, 2019
            KB4493443
            Mitigated
            Last updated:
            May 15, 2019
            05:53 PM PT

            Opened:
            May 15, 2019
            05:53 PM PT
            - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Certain operations performed on a Cluster Shared Volume may fail
            Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

            Affected platforms: 
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
            • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: Do one of the following:
            • Perform the operation from a process that has administrator privilege.
            • Perform the operation from a node that doesn’t have CSV ownership.
            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            January 08, 2019
            KB4480963
            Mitigated
            Last updated:
            April 25, 2019
            02:00 PM PT

            Opened:
            January 08, 2019
            10:00 AM PT
            - " diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml deleted file mode 100644 index cf035b38eb..0000000000 --- a/windows/release-information/status-windows-server-2008-sp2.yml +++ /dev/null @@ -1,91 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows Server 2008 SP2 -metadata: - document_id: - title: Windows Server 2008 SP2 - description: View announcements and review known issues and fixes for Windows Server 2008 SP2 - keywords: Windows, Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows Server 2008 SP2. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - -
            SummaryOriginating updateStatusLast updated
            After installing an update and restarting, you might receive an error
            You might receive the error, “Failure to configure Windows updates. Reverting Changes.” or \"Failed\" in Update History.

            See details >
            February 11, 2020
            KB4537810
            Resolved
            February 12, 2020
            05:37 PM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            October 08, 2019
            KB4520002
            Mitigated External
            November 05, 2019
            03:36 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            After installing an update and restarting, you might receive an error
            After installing KB4537810 and restarting your device, you might receive the error, “Failure to configure Windows updates. Reverting Changes. Do not turn off your computer,” and the update might show as Failed in Update History.

            Affected platforms:
            • Client: Windows 7 SP1
            • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
            Resolution: This is expected in the following circumstances:
            • If you are installing this update on a device that is running an edition that is not supported for ESU. For a complete list of which editions are supported, see KB4497181.
            • If you do not have an ESU MAK add-on key installed and activated. 
            If you have purchased an ESU key and have encountered this issue, please verify you have applied all prerequisites and that your key is activated. For information on activation, please see this blog post. For information on the prerequisites, see the \"How to get this update\" section of this article.

            Back to top
            February 11, 2020
            KB4537810
            Resolved
            Resolved:
            February 12, 2020
            05:37 PM PT

            Opened:
            February 12, 2020
            03:47 PM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            October 08, 2019
            KB4520002
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml deleted file mode 100644 index cba7737955..0000000000 --- a/windows/release-information/status-windows-server-2012.yml +++ /dev/null @@ -1,111 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows Server 2012 -metadata: - document_id: - title: Windows Server 2012 - description: View announcements and review known issues and fixes for Windows Server 2012 - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find information on known issues for Windows Server 2012. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). - - " - -- items: - - type: list - style: cards - className: cardsM - columns: 3 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 -- items: - - type: markdown - text: " - - " -- items: - - type: markdown - text: " -
            - " - -- title: Known issues -- items: - - type: markdown - text: "
            This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

            - - - - - -
            SummaryOriginating updateStatusLast updated
            You might encounter issues with KB4502496
            You might encounter issues trying to install or after installing KB4502496

            See details >
            February 11, 2020
            KB4502496
            Mitigated
            February 15, 2020
            01:22 AM PT
            TLS connections might fail or timeout
            Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

            See details >
            October 08, 2019
            KB4520007
            Mitigated External
            November 05, 2019
            03:36 PM PT
            Japanese IME doesn't show the new Japanese Era name as a text input option
            With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.

            See details >
            April 25, 2019
            KB4493462
            Mitigated
            May 15, 2019
            05:53 PM PT
            Certain operations performed on a Cluster Shared Volume may fail
            Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

            See details >
            January 08, 2019
            KB4480975
            Mitigated
            April 25, 2019
            02:00 PM PT
            - " - -- title: Issue details -- items: - - type: markdown - text: " -
            -
            - " -- title: February 2020 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            You might encounter issues with KB4502496
            You might encounter issues trying to install or after installing KB4502496.

            Affected platforms:
            • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1
            • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: To help a sub-set of affected devices, the standalone security update (KB4502496) has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Updates (LCUs), Monthly Rollups or Security Only updates.

            If this update is installed and you are experiencing issues, you can uninstall this update.
            1. Select the start button or Windows Desktop Search and type update history and select View your Update history.
            2. On the Settings/View update history dialog window, Select Uninstall Updates.
            3. On the Installed Updates dialog window, find and select KB4502496 and select the Uninstall button.
            4. Restart your device.
             
            Next steps: We are working on an improved version of this update in coordination with our partners and will release it in a future update.

            Back to top
            February 11, 2020
            KB4502496
            Mitigated
            Last updated:
            February 15, 2020
            01:22 AM PT

            Opened:
            February 15, 2020
            12:02 AM PT
            - " - -- title: November 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            TLS connections might fail or timeout
            Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
            • \"The request was aborted: Could not create SSL/TLS secure Channel\"
            • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
            Affected platforms:
            • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
            • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

            Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

            Back to top
            October 08, 2019
            KB4520007
            Mitigated External
            Last updated:
            November 05, 2019
            03:36 PM PT

            Opened:
            November 05, 2019
            03:36 PM PT
            - " - -- title: May 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Japanese IME doesn't show the new Japanese Era name as a text input option
            If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

            Affected platforms:
            • Client: Windows 8.1
            • Server: Windows Server 2012 R2; Windows Server 2012
            Workaround:
            If you see any of the previous dictionary updates listed below, uninstall it from Programs and features > Uninstall or change a program. New words that were in previous dictionary updates are also in this update.
            • Update for Japanese Microsoft IME Standard Dictionary (15.0.2013)
            • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.2013)
            • Update for Japanese Microsoft IME Standard Dictionary (15.0.1215)
            • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1215)
            • Update for Japanese Microsoft IME Standard Dictionary (15.0.1080)
            • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1080)

            Back to top
            April 25, 2019
            KB4493462
            Mitigated
            Last updated:
            May 15, 2019
            05:53 PM PT

            Opened:
            May 15, 2019
            05:53 PM PT
            - " - -- title: January 2019 -- items: - - type: markdown - text: " - - -
            DetailsOriginating updateStatusHistory
            Certain operations performed on a Cluster Shared Volume may fail
            Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

            Affected platforms: 
            • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
            • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
            Workaround: Do one of the following:
            • Perform the operation from a process that has administrator privilege.
            • Perform the operation from a node that doesn’t have CSV ownership.
            Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

            Back to top
            January 08, 2019
            KB4480975
            Mitigated
            Last updated:
            April 25, 2019
            02:00 PM PT

            Opened:
            January 08, 2019
            10:00 AM PT
            - " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml deleted file mode 100644 index 28f4b85576..0000000000 --- a/windows/release-information/windows-message-center.yml +++ /dev/null @@ -1,89 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Windows message center -metadata: - document_id: - title: Windows message center - description: Windows message center - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: high - author: greg-lindsay - ms.author: greglin - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: - -- items: - - type: list - style: cards - className: cardsM - columns: 2 - items: - - - href: https://aka.ms/Windows7ESU - html: Stay protected with Extended Security Updates > - image: - src: https://docs.microsoft.com/media/common/i_subscription.svg - title: Still have devices running Windows 7 in your enterprise? - - href: https://aka.ms/1909mechanics - html: Explore the improvements > - image: - src: http://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10, version 1909 delivery options - - href: https://aka.ms/whats-new-in-1909 - html: Learn about the latest capabilities for IT > - image: - src: http://docs.microsoft.com/media/common/i_article.svg - title: What’s new in Windows 10, version 1909 - - href: https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-update-servicing-cadence/ba-p/222376 - html: Learn more > - image: - src: https://docs.microsoft.com/media/common/i_investigate.svg - title: Windows 10 update servicing cadence - -- title: Recent announcements -- items: - - type: markdown - text: " - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            MessageDate
            February 2020 Windows 10, version 1909 and Windows 10, version 1903 \"D\" optional release is available
            The February 2020 optional monthly “D” release for Windows 10, version 1909 and Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            February 27, 2020
            01:30 PM PT
            February 2020 Windows \"C\" optional release is available.
            The February 2020 optional monthly “C” release for all supported versions of Windows prior to Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            February 25, 2020
            08:00 AM PT
            Status of February 2020 “C” release
            The optional monthly “C” release for February 2020 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            February 21, 2020
            12:00 PM PT
            Compatibility issue with some Windows Server container images
            If you are encountering issues with Windows Server container images, please see KB4542617.
            February 13, 2020
            03:21 PM PT
            Take action: February 2020 security update available for all supported versions of Windows
            The February 2020 security update release, referred to as our “B” release, is now available for Windows 10, version 1909 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
            February 11, 2020
            08:00 AM PT
            Take action: ESU security updates available for Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2
            Windows 7 SP1, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2 reached end of support on January 14, 2020. For customers who have purchased Extended Security Updates (ESU), the first monthly ESU security updates are now available. If your organization has not yet been able to complete your transition to Windows 10, Windows Server 2016, or Windows Server 2019 and want to continue to receive security updates for your current version of Windows, you will need to purchase Extended Security Updates. For information on how to do so, please see How to get Extended Security Updates for eligible Windows devices, Windows 7 ESU frequently ask questions, and Windows Server 2008 R2 SP1 and Windows Server 2008 SP2 ESU frequently asked questions.

            We recommend ESU customers review the applicable KB article below for prerequisites and other important information you will need to deploy these updates.

            The following updates were released today for Windows Server 2008 SP2:
            The following updates were released today for Windows 7 SP1 and Windows Server 2008 R2 SP1:
            February 11, 2020
            08:00 AM PT
            Resolved: Windows Search shows blank box
            We are aware of a temporary server-side issue causing Windows search to show a blank box. This issue has been resolved for most users and in some cases, you might need to restart your device. We are working diligently to fully resolve the issue and will provide an update once resolved. 

            This issue was resolved at 12:00 PM PST. If you are still experiencing issues, please restart your device. In rare cases, to mitigate this issue you may need to manually end the SearchUI.exe or SearchApp.exe process via Task Manager. (To locate these processes, select CTRL + Shift + Esc then select the Details tab.) If you have restarted and tried the previous mitigations and are still encountering issues with Windows Search, you are not experiencing the issue described here. Please see Fix problems in Windows Search for other mitigations.
            February 05, 2020
            12:00 PM PT
            January 2020 Windows 10, version 1909 \"D\" optional release is available.
            The January 2020 optional monthly “D” release for Windows 10, version 1909 and Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            January 28, 2020
            08:00 AM PT
            January 2020 Windows \"C\" optional release is available.
            The January 2020 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            January 23, 2020
            12:00 PM PT
            Windows 7 has reached end of support
            Windows 7 reached end of support on January 14, 2020. If your organization has not yet been able to complete your transition from Windows 7 to Windows 10, and want to continue to receive security updates while you complete your upgrade projects, please read How to get Extended Security Updates for eligible Windows devices. For more information on end of service dates for currently supported versions of Windows 10, see the Windows lifecycle fact sheet.
            January 15, 2020
            10:00 AM PT
            Take action: January 2020 security update available for all supported versions of Windows
            The January 2020 security update release, referred to as our “B” release, is now available for Windows 10, version 1909 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
            January 14, 2020
            08:00 AM PT
            Advisory: Windows CryptoAPI certificate validation vulnerability
            On January 14, 2020, Microsoft released security updates to address an elliptic-curve cryptography (ECC) certificate validation issue in the Windows CryptoAPI. This vulnerability applies to all versions of the Windows 10 operating system, client and server. While we have not observed an attack exploiting this vulnerability, we recommend that you apply this update to all of your Windows 10 devices with priority. Here is what you need to know:
            • If you are running a supported version of Windows 10 and have automatic updates enabled, you are automatically protected and do not need to take any further action.
            • If you are managing updates on behalf of your organization, you should download the latest updates from the Microsoft Security Update Guide and apply those updates to your Windows 10 devices and servers as soon as possible.
            If you are running an unsupported version of Windows 10, we recommend that you upgrade to the current version of Windows 10 to benefit from the latest security protections. For more information about this vulnerability, see the Microsoft Security Guidance for CVE-2020-0601 and the Microsoft Security Response Center blog, January 2020 Security Updates: CVE-2020-0601.
            January 14, 2020
            08:00 AM PT
            Take action: December 2019 security update available for all supported versions of Windows
            The December 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1909 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
            December 10, 2019
            08:00 AM PT
            Timing of Windows 10 optional update releases (December 2019)
            For the balance of this calendar year, there will be no optional non-security “C” and “D” releases for Windows 10. The \"C\" releases normally target the third week of the month, with \"D\" releases targeting the fourth week. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer.
            December 10, 2019
            08:00 AM PT
            Windows 10, version 1909 now available
            Learn how to get Windows 10, version 1909 (the November 2019 Update), and explore how we’ve worked to make this a great experience for all devices, including a new, streamlined (and fast) update experience for devices updating directly from the May 2019 Update.
            November 12, 2019
            10:00 AM PT
            Windows 10, version 1909 delivery options
            Learn how devices running Windows 10, version 1903 can update to Windows 10, version 1909 using the same servicing technology used to deliver monthly quality updates, resulting in a single restart and reducing update-related downtime.
            November 12, 2019
            10:00 AM PT
            What’s new for IT pros in Windows 10, version 1909
            Explore the latest features for IT, get information about media availability and related tools, and find answers to frequently asked questions.
            November 12, 2019
            10:00 AM PT
            Take action: November 2019 security update available for all supported versions of Windows
            The November 2019 security update release, referred to as our “B” release, is now available for all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
            November 12, 2019
            10:00 AM PT
            Timing of Windows 10 optional update releases (November/December 2019)
            For the balance of this calendar year, there will be no optional non-security “C” and “D” releases for Windows 10. The \"C\" releases normally target the third week of the month, with \"D\" releases targeting the fourth week. Note There will be a December Security Update Tuesday release, as usual. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer
            November 12, 2019
            10:00 AM PT
            Windows 10, version 1803 Home and Pro editions have reached end of service
            Windows 10, version 1803 (the April 2018 Update) Home and Pro editions have reached end of service. For Windows 10 devices that are at, or within several months of reaching end of service, Windows Update will automatically initiate a feature update (with users having the ability to choose a convenient time); keeping those devices supported and receiving the monthly updates that are critical to device security and ecosystem health. For more information on end of service dates for currently supported versions of Windows 10, see the Windows lifecycle fact sheet.
            November 12, 2019
            10:00 AM PT
            October 2019 Windows 10, version 1903 \"D\" optional release is available.
            The October 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            October 24, 2019
            08:00 AM PT
            October 2019 Windows \"C\" optional release is available.
            The October 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            October 15, 2019
            09:59 AM PT
            Windows 10, version 1703 has reached end of service
            Consumer and commercial editions of Windows 10, version 1703 have reached end of service. As devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats, we recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates for currently supported versions of Windows 10, see the Windows lifecycle fact sheet.

            Note The Windows 10, version 1703 section will be removed from this dashboard on November 12, 2019.
            October 09, 2019
            12:00 PM PT
            Take Action: October 2019 security update available for all supported versions of Windows
            The October 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
             
            October 08, 2019
            08:00 AM PT
            Take action: Security update available for all supported versions of Windows
            On October 3, 2019, Microsoft expanded delivery of the out-of-band Internet Explorer scripting engine security vulnerability (CVE-2019-1367) update released on September 23, 2019 to Windows Update and Windows Server Update Services (WSUS). This is now a required security update for all supported versions of Windows as it includes the Internet Explorer scripting engine vulnerability mitigation and corrects a recent printing issue some users have experienced. All customers using Windows Update or WSUS will be offered this update automatically. We recommend that you install this update as soon as a possible, then restart your PC to fully apply the mitigations and help secure your devices. As with all cumulative updates, this update supersedes any preceding update.
             
            Note: This update does not replace the standard October 2019 monthly security update release, which is scheduled for October 8, 2019.
            October 03, 2019
            08:00 AM PT
            September 2019 Windows 10, version 1903 \"D\" optional release is available
            The September 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            September 26, 2019
            02:00 PM PT
            Status update: September 2019 Windows \"C\" optional release available
            The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            September 24, 2019
            08:10 AM PT
            Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
            Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
            September 24, 2019
            08:00 AM PT
            Status of September 2019 “C” release
            The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
            September 19, 2019
            04:11 PM PT
            Plan for change: End of service reminders for Windows 10, versions 1703 and 1803
            The Enterprise and Education editions of Windows 10, version 1703 (the Creators Update) will reach end of service on October 8, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions of Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019. We recommend that you update devices running these versions and editions to the latest version of Windows 10—Windows 10, version 1903—as soon as possible to help keep them protected and your environments secure.
            September 13, 2019
            03:23 PM PT
            September 2019 security update available for all supported versions of Windows
            The September 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
            September 10, 2019
            09:34 AM PT
            Status update: Windows 10, version 1903 \"D\" optional release available August 30th
            The August optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
            August 30, 2019
            08:00 AM PT
            Feature update install notification on Windows 10, version 1809 (the October 2018 Update)
            We've had reports on August 29th that some customers running Windows 10, version 1809 (the October 2018 Update) have received notification to install the latest feature update (version 1903) early. Updating remains in your control. To install the update, you must select one of the following options: \"Pick a Time\", \"Restart Tonight,\" or \"Restart Now\". If you are not ready to update at this time, simply dismiss the notification by clicking the arrow in the top right corner. If you have updated to Windows 10, version 1903 and would like to go back to your previous version, see the instructions here.
            August 29, 2019
            04:39 PM PT
            Take Action: Internet Explorer 11 now available on Windows Update/WSUS for Windows Server 2012 and Windows Embedded 8 Standard
            Internet Explorer 11 (KB 4492872) is now available via Windows Update (WU) and Windows Server Update Services (WSUS) for commercial customers running Windows Server 2012 and Windows Embedded 8 Standard. For details about these changes and end of support for IE10, please refer to the IT Pro blog
            August 29, 2019
            08:00 AM PT
            Windows 10, version 1903 rollout begins
            The Windows 10 May 2019 Update (Windows 10, version 1903) is available today to commercial customers via Windows Server Update Services (WSUS), Windows Update for Business, and the Volume Licensing Service Center (VLSC)—and to end users who manually select “Check for updates.” We are slowly throttling up availability while we carefully monitor data and feedback.
            May 21, 2019
            10:00 AM PT
            - " diff --git a/windows/security/docfx.json b/windows/security/docfx.json index d1b2905bad..e8accb5982 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -21,7 +21,8 @@ "files": [ "**/*.png", "**/*.jpg", - "**/*.gif" + "**/*.gif", + "**/*.svg" ], "exclude": [ "**/obj/**", @@ -33,7 +34,7 @@ "externalReference": [], "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", - "ms.technology": "windows", + "uhfHeaderId": "MSDocsHeader-M365-IT", "ms.topic": "article", "manager": "dansimp", "audience": "ITPro", @@ -46,7 +47,17 @@ "folder_relative_path_in_docset": "./" } }, - "titleSuffix": "Microsoft 365 Security" + "titleSuffix": "Microsoft 365 Security", + "contributors_to_exclude": [ + "rjagiewich", + "traya1", + "rmca14", + "claydetels19", + "jborsecnik", + "tiburd", + "garycentric" + ], + "searchScope": ["Windows 10"] }, "fileMetadata": { "titleSuffix":{ diff --git a/windows/security/identity-protection/TOC.md b/windows/security/identity-protection/TOC.md index 7f7f58c2b8..16e55efb95 100644 --- a/windows/security/identity-protection/TOC.md +++ b/windows/security/identity-protection/TOC.md @@ -18,7 +18,7 @@ #### [User Account Control security policy settings](user-account-control\user-account-control-security-policy-settings.md) #### [User Account Control Group Policy and registry key settings](user-account-control\user-account-control-group-policy-and-registry-key-settings.md) -## [Windows Hello for Business](hello-for-business/hello-identity-verification.md) +## [Windows Hello for Business](hello-for-business/index.yml) ## [Protect derived domain credentials with Credential Guard](credential-guard/credential-guard.md) ### [How Credential Guard works](credential-guard/credential-guard-how-it-works.md) diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index 8e6cf74f38..61288f4b01 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index 0665f58b3c..f207928d15 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -169,7 +169,7 @@ When Active Directory is installed on the first domain controller in the domain, ## Guest account -The Guest account is a default local account has limited access to the computer and is disabled by default. The Guest account cannot be deleted or disabled, and the account name cannot be changed. By default, the Guest account password is left blank. A blank password allows the Guest account to be accessed without requiring the user to enter a password. +The Guest account is a default local account that has limited access to the computer and is disabled by default. By default, the Guest account password is left blank. A blank password allows the Guest account to be accessed without requiring the user to enter a password. The Guest account enables occasional or one-time users, who do not have an individual account on the computer, to sign in to the local server or domain with restricted rights and permissions. The Guest account can be enabled, and the password can be set up if needed, but only by a member of the Administrator group on the domain. @@ -470,7 +470,7 @@ Each default local account in Active Directory has a number of account settings

            Account is trusted for delegation

            -

            Lets a service running under this account perform operations on behalf of other user accounts on the network. A service running under a user account (also known as a service account) that is trusted for delegation can impersonate a client to gain access to resources, either on the computer where the service is running or on other computers. For example, in a forest that is set to the Windows Server 2003 functional level, this setting is found on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), which are set by using the setspn command from Windows Support Tools. This setting is security-sensitive and should be assigned cautiously.

            +

            Lets a service running under this account perform operations on behalf of other user accounts on the network. A service running under a user account (also known as a service account) that is trusted for delegation can impersonate a client to gain access to resources, either on the computer where the service is running or on other computers. For example, in a forest that is set to the Windows Server 2003 functional level, this setting is found on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), which are set by using the setspn command from Windows Support Tools. This setting is security-sensitive and should be assigned cautiously.

            Account is sensitive and cannot be delegated

            @@ -480,7 +480,7 @@ Each default local account in Active Directory has a number of account settings

            Use DES encryption types for this account

            Provides support for the Data Encryption Standard (DES). DES supports multiple levels of encryption, including Microsoft Point-to-Point Encryption (MPPE) Standard (40-bit and 56-bit), MPPE standard (56-bit), MPPE Strong (128-bit), Internet Protocol security (IPSec) DES (40-bit), IPSec 56-bit DES, and IPSec Triple DES (3DES).

            -Note

            DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see Hunting down DES in order to securely deploy Kerberos.

            +Note

            DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see Hunting down DES in order to securely deploy Kerberos.

            @@ -656,8 +656,8 @@ In this procedure, the workstations are dedicated to domain administrators. By s -

            Windows Update Setting

            -

            Configuration

            +

            Windows Update Setting

            +

            Configuration

            Allow Automatic Updates immediate installation

            diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md index 3d77adab6e..e408ad9ba8 100644 --- a/windows/security/identity-protection/access-control/active-directory-security-groups.md +++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -79,8 +79,8 @@ Groups are characterized by a scope that identifies the extent to which the grou - Domain Local -**Note**   -In addition to these three scopes, the default groups in the **Builtin** container have a group scope of Builtin Local. This group scope and group type cannot be changed. +> [!NOTE] +> In addition to these three scopes, the default groups in the **Builtin** container have a group scope of Builtin Local. This group scope and group type cannot be changed. @@ -111,8 +111,8 @@ The following table lists the three group scopes and more information about each

            Accounts from any domain in the same forest

            Global groups from any domain in the same forest

            Other Universal groups from any domain in the same forest

            -

            Can be converted to Domain Local scope

            -

            Can be converted to Global scope if the group is not a member of any other Universal groups

            +

            Can be converted to Domain Local scope if the group is not a member of any other Universal groups

            +

            Can be converted to Global scope if the group does not contain any other Universal groups

            On any domain in the same forest or trusting forests

            Other Universal groups in the same forest

            Domain Local groups in the same forest or trusting forests

            @@ -576,7 +576,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            BuiltIn Local

            +

            Builtin Local

            Default container

            @@ -620,8 +620,8 @@ Members of the Account Operators group cannot manage the Administrator user acco The Account Operators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -By default, this built-in group has no members, and it can create and manage users and groups in the domain, including its own membership and that of the Server Operators group. This group is considered a service administrator group because it can modify Server Operators, which in turn can modify domain controller settings. As a best practice, leave the membership of this group empty, and do not use it for any delegated administration. This group cannot be renamed, deleted, or moved. +> [!NOTE] +> By default, this built-in group has no members, and it can create and manage users and groups in the domain, including its own membership and that of the Server Operators group. This group is considered a service administrator group because it can modify Server Operators, which in turn can modify domain controller settings. As a best practice, leave the membership of this group empty, and do not use it for any delegated administration. This group cannot be renamed, deleted, or moved. @@ -645,7 +645,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            BuiltIn Local

            +

            Builtin Local

            Default container

            @@ -686,8 +686,8 @@ Members of the Administrators group have complete and unrestricted access to the The Administrators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -The Administrators group has built-in capabilities that give its members full control over the system. This group cannot be renamed, deleted, or moved. This built-in group controls access to all the domain controllers in its domain, and it can change the membership of all administrative groups. +> [!NOTE] +> The Administrators group has built-in capabilities that give its members full control over the system. This group cannot be renamed, deleted, or moved. This built-in group controls access to all the domain controllers in its domain, and it can change the membership of all administrative groups. Membership can be modified by members of the following groups: the default service Administrators, Domain Admins in the domain, or Enterprise Admins. This group has the special privilege to take ownership of any object in the directory or any resource on a domain controller. This account is considered a service administrator group because its members have full access to the domain controllers in the domain. @@ -717,7 +717,7 @@ This security group includes the following changes since Windows Server 2008:

            Type

            -

            BuiltIn Local

            +

            Builtin Local

            Default container

            @@ -865,7 +865,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -987,7 +987,7 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-<domain>-517

            +

            S-1-5-21-<domain>-517

            Type

            @@ -1113,7 +1113,7 @@ This security group was introduced in Windows Vista Service Pack 1, and it h

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -1241,7 +1241,7 @@ The Device Owners group applies to versions of the Windows Server operating syst

            Type

            -

            BuiltIn Local

            +

            Builtin Local

            Default container

            @@ -1345,7 +1345,7 @@ This security group has not changed since Windows Server 2008. Members of the DnsUpdateProxy group are DNS clients. They are permitted to perform dynamic updates on behalf of other clients (such as DHCP servers). A DNS server can develop stale resource records when a DHCP server is configured to dynamically register host (A) and pointer (PTR) resource records on behalf of DHCP clients by using dynamic update. Adding clients to this security group mitigates this scenario. -However, to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates by using the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account. +However, to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates by using the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account. This group exists only if the DNS server role is or was once installed on a domain controller in the domain. For information, see [DNS Record Ownership and the DnsUpdateProxy Group](https://technet.microsoft.com/library/dd334715.aspx). @@ -1365,7 +1365,7 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-21-<domain>-1103

            +

            S-1-5-21-<domain>-<variable RID>

            Type

            @@ -1406,7 +1406,7 @@ This security group has not changed since Windows Server 2008. ### DnsAdmins -Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions. +Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions. This group exists only if the DNS server role is or was once installed on a domain controller in the domain. For more information about security and DNS, see [DNSSEC in Windows Server 2012](https://technet.microsoft.com/library/dn593694(v=ws.11).aspx). @@ -1426,11 +1426,11 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-21-<domain>-1102

            +

            S-1-5-21-<domain>-<variable RID>

            Type

            -

            Domain local

            +

            Builtin Local

            Default container

            @@ -1493,7 +1493,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Domain Global

            +

            Global

            Default container

            @@ -1552,7 +1552,7 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-<domain>-515

            +

            S-1-5-21-<domain>-515

            Type

            @@ -1613,7 +1613,7 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-<domain>-516

            +

            S-1-5-21-<domain>-516

            Type

            @@ -1674,7 +1674,7 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-<domain>-514

            +

            S-1-5-21-<domain>-514

            Type

            @@ -1737,11 +1737,11 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-<domain>-513

            +

            S-1-5-21-<domain>-513

            Type

            -

            Domain Global

            +

            Global

            Default container

            @@ -1950,7 +1950,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Builtin local

            +

            Domain Local

            Default container

            @@ -1985,13 +1985,13 @@ This security group has not changed since Windows Server 2008. -### Group Policy Creators Owners +### Group Policy Creator Owners This group is authorized to create, edit, or delete Group Policy Objects in the domain. By default, the only member of the group is Administrator. For information about other features you can use with this security group, see [Group Policy Overview](https://technet.microsoft.com/library/hh831791.aspx). -The Group Policy Creators Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). +The Group Policy Creator Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). This security group has not changed since Windows Server 2008. @@ -2009,7 +2009,7 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-<domain>-520

            +

            S-1-5-21-<domain>-520

            Type

            @@ -2056,8 +2056,8 @@ When a member of the Guests group signs out, the entire profile is deleted. This Computer Configuration\\Administrative Templates\\System\\User Profiles -**Note**   -A Guest account is a default member of the Guests security group. People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. +> [!NOTE] +> A Guest account is a default member of the Guests security group. People who do not have an actual account in the domain can use the Guest account. A user whose account is disabled (but not deleted) can also use the Guest account. The Guest account does not require a password. You can set rights and permissions for the Guest account as in any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to sign in to a domain. The Guest account is disabled by default, and we recommend that it stay disabled. @@ -2093,12 +2093,11 @@ This security group has not changed since Windows Server 2008.

            Default members

            -

            Guest

            +

            Domain Guests

            Guest

            Default member of

            -

            Domain Guests

            -

            Guest

            +

            None

            Protected by ADMINSDHOLDER?

            @@ -2125,8 +2124,8 @@ This security group has not changed since Windows Server 2008. Members of the Hyper-V Administrators group have complete and unrestricted access to all the features in Hyper-V. Adding members to this group helps reduce the number of members required in the Administrators group, and further separates access. -**Note**   -Prior to Windows Server 2012, access to features in Hyper-V was controlled in part by membership in the Administrators group. +> [!NOTE] +> Prior to Windows Server 2012, access to features in Hyper-V was controlled in part by membership in the Administrators group. @@ -2150,7 +2149,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -2162,7 +2161,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

            Default member of

            -

            No

            +

            None

            Protected by ADMINSDHOLDER?

            @@ -2189,7 +2188,7 @@ This security group was introduced in Windows Server 2012, and it has not chang IIS\_IUSRS is a built-in group that is used by Internet Information Services beginning with IIS 7.0. A built-in account and group are guaranteed by the operating system to always have a unique SID. IIS 7.0 replaces the IUSR\_MachineName account and the IIS\_WPG group with the IIS\_IUSRS group to ensure that the actual names that are used by the new account and group will never be localized. For example, regardless of the language of the Windows operating system that you install, the IIS account name will always be IUSR, and the group name will be IIS\_IUSRS. -For more information, see [Understanding Built-In User and Group Accounts in IIS 7](http://www.iis.net/learn/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis). +For more information, see [Understanding Built-In User and Group Accounts in IIS 7](https://docs.microsoft.com/iis/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis). This security group has not changed since Windows Server 2008. @@ -2211,7 +2210,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            BuiltIn Local

            +

            Builtin Local

            Default container

            @@ -2252,8 +2251,8 @@ Members of the Incoming Forest Trust Builders group can create incoming, one-way To make this determination, the Windows security system computes a trust path between the domain controller for the server that receives the request and a domain controller in the domain of the requesting account. A secured channel extends to other Active Directory domains through interdomain trust relationships. This secured channel is used to obtain and verify security information, including security identifiers (SIDs) for users and groups. -**Note**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). +> [!NOTE] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). @@ -2261,8 +2260,8 @@ For more information, see [How Domain and Forest Trusts Work: Domain and Forest The Incoming Forest Trust Builders group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group cannot be renamed, deleted, or moved. @@ -2286,7 +2285,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            BuiltIn local

            +

            Builtin Local

            Default container

            @@ -2359,17 +2358,15 @@ Members of the Network Configuration Operators group can have the following admi - Enter the PIN unblock key (PUK) for mobile broadband devices that support a SIM card. -**Note**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). +> [!NOTE] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). - The Network Configuration Operators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group cannot be renamed, deleted, or moved. - This security group has not changed since Windows Server 2008. @@ -2391,7 +2388,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            BuiltIn local

            +

            Builtin Local

            Default container

            @@ -2434,26 +2431,23 @@ Members of the Performance Log Users group can manage performance counters, logs - Can create and modify Data Collector Sets after the group is assigned the [Log on as a batch job](/windows/device-security/security-policy-settings/log-on-as-a-batch-job) user right. - **Warning**   - If you are a member of the Performance Log Users group, you must configure Data Collector Sets that you create to run under your credentials. + > [!WARNING] + > If you are a member of the Performance Log Users group, you must configure Data Collector Sets that you create to run under your credentials. - - Cannot use the Windows Kernel Trace event provider in Data Collector Sets. For members of the Performance Log Users group to initiate data logging or modify Data Collector Sets, the group must first be assigned the [Log on as a batch job](/windows/device-security/security-policy-settings/log-on-as-a-batch-job) user right. To assign this user right, use the Local Security Policy snap-in in Microsoft Management Console. -**Note**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). +> [!NOTE] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). - The Performance Log Users group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This account cannot be renamed, deleted, or moved. +> [!NOTE] +> This account cannot be renamed, deleted, or moved. - This security group has not changed since Windows Server 2008. @@ -2475,7 +2469,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -2524,13 +2518,13 @@ Specifically, members of this security group: - Cannot create or modify Data Collector Sets. - **Warning**   - You cannot configure a Data Collector Set to run as a member of the Performance Monitor Users group. + > [!WARNING] + > You cannot configure a Data Collector Set to run as a member of the Performance Monitor Users group. -**Note**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). This group cannot be renamed, deleted, or moved. @@ -2556,7 +2550,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -2590,15 +2584,13 @@ This security group has not changed since Windows Server 2008. - ### Pre–Windows 2000 Compatible Access Members of the Pre–Windows 2000 Compatible Access group have Read access for all users and groups in the domain. This group is provided for backward compatibility for computers running Windows NT 4.0 and earlier. By default, the special identity group, Everyone, is a member of this group. Add users to this group only if they are running Windows NT 4.0 or earlier. -**Warning**   -This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). +> [!WARNING] +> This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). - The Pre–Windows 2000 Compatible Access group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). @@ -2622,7 +2614,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -2686,7 +2678,7 @@ This security group has not changed since Windows Server 2008. However, in Windo

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -2765,7 +2757,7 @@ The following table specifies the properties of the Protected Users group.

            Type

            -

            Domain Global

            +

            Global

            Default container

            @@ -2826,7 +2818,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Domain local

            +

            Builtin Local

            Default container

            @@ -2883,11 +2875,11 @@ This security group was introduced in Windows Server 2012, and it has not chang

            Well-Known SID/RID

            -

            S-1-5-32-<domain>-576

            +

            S-1-5-32-576

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -2946,7 +2938,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -3007,7 +2999,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -3042,6 +3034,78 @@ This security group was introduced in Windows Server 2012, and it has not chang +### Read-Only Domain Controllers + +This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role. + +Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality: + +- Read-only AD DS database + +- Unidirectional replication + +- Credential caching + +- Administrator role separation + +- Read-only Domain Name System (DNS) + +For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx). + +This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
            AttributeValue

            Well-Known SID/RID

            S-1-5-21-<domain>-521

            Type

            Global

            Default container

            CN=Users, DC=<domain>, DC=

            Default members

            None

            Default member of

            Denied RODC Password Replication Group

            Protected by ADMINSDHOLDER?

            Yes

            Safe to move out of default container?

            Yes

            Safe to delegate management of this group to non-Service admins?

            Default User Rights

            See Denied RODC Password Replication Group

            + + ### Remote Desktop Users The Remote Desktop Users group on an RD Session Host server is used to grant users and groups permissions to remotely connect to an RD Session Host server. This group cannot be renamed, deleted, or moved. It appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). @@ -3101,78 +3165,6 @@ This security group has not changed since Windows Server 2008. - - -### Read-Only Domain Controllers - -This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role. - -Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality: - -- Read-only AD DS database - -- Unidirectional replication - -- Credential caching - -- Administrator role separation - -- Read-only Domain Name System (DNS) - -For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx). - -This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            AttributeValue

            Well-Known SID/RID

            S-1-5-21-<domain>-521

            Type

            Default container

            CN=Users, DC=<domain>, DC=

            Default members

            None

            Default member of

            Denied RODC Password Replication Group

            Protected by ADMINSDHOLDER?

            Yes

            Safe to move out of default container?

            Yes

            Safe to delegate management of this group to non-Service admins?

            Default User Rights

            See Denied RODC Password Replication Group

            @@ -3204,7 +3196,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -3243,8 +3235,8 @@ This security group was introduced in Windows Server 2012, and it has not chang Computers that are members of the Replicator group support file replication in a domain. Windows Server operating systems use the File Replication service (FRS) to replicate system policies and logon scripts stored in the System Volume (SYSVOL). Each domain controller keeps a copy of SYSVOL for network clients to access. FRS can also replicate data for the Distributed File System (DFS), synchronizing the content of each member in a replica set as defined by DFS. FRS can copy and maintain shared files and folders on multiple servers simultaneously. When changes occur, content is synchronized immediately within sites and by a schedule between sites. -**Important**   -In Windows Server 2008 R2, FRS cannot be used for replicating DFS folders or custom (non-SYSVOL) data. A Windows Server 2008 R2 domain controller can still use FRS to replicate the contents of a SYSVOL shared resource in a domain that uses FRS for replicating the SYSVOL shared resource between domain controllers. +> [!WARNING] +> In Windows Server 2008 R2, FRS cannot be used for replicating DFS folders or custom (non-SYSVOL) data. A Windows Server 2008 R2 domain controller can still use FRS to replicate the contents of a SYSVOL shared resource in a domain that uses FRS for replicating the SYSVOL shared resource between domain controllers. However, Windows Server 2008 R2 servers cannot use FRS to replicate the contents of any replica set apart from the SYSVOL shared resource. The DFS Replication service is a replacement for FRS, and it can be used to replicate the contents of a SYSVOL shared resource, DFS folders, and other custom (non-SYSVOL) data. You should migrate all non-SYSVOL FRS replica sets to DFS Replication. For more information, see: @@ -3271,7 +3263,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -3334,7 +3326,7 @@ This security group has not changed since Windows Server 2008.

            Well-Known SID/RID

            -

            S-1-5-<root domain>-518

            +

            S-1-5-21-<root domain>-518

            Type

            @@ -3375,9 +3367,9 @@ This security group has not changed since Windows Server 2008. ### Server Operators -Members in the Server Operators group can administer domain servers. This group exists only on domain controllers. By default, the group has no members. Members of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved. +Members in the Server Operators group can administer domain controllers. This group exists only on domain controllers. By default, the group has no members. Members of the Server Operators group can sign in to a server interactively, create and delete network shared resources, start and stop services, back up and restore files, format the hard disk drive of the computer, and shut down the computer. This group cannot be renamed, deleted, or moved. -By default, this built-in group has no members, and it has access to server configuration options on domain controllers. Its membership is controlled by the service administrator groups, Administrators and Domain Admins, in the domain, and the Enterprise Admins group. Members in this group cannot change any administrative group memberships. This is considered a service administrator account because its members have physical access to domain controllers, they can perform maintenance tasks (such as backup and restore), and they have the ability to change binaries that are installed on the domain controllers. Note the default user rights in the following table. +By default, this built-in group has no members, and it has access to server configuration options on domain controllers. Its membership is controlled by the service administrator groups Administrators and Domain Admins in the domain, and the Enterprise Admins group in the forest root domain. Members in this group cannot change any administrative group memberships. This is considered a service administrator account because its members have physical access to domain controllers, they can perform maintenance tasks (such as backup and restore), and they have the ability to change binaries that are installed on the domain controllers. Note the default user rights in the following table. The Server Operators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). @@ -3401,7 +3393,7 @@ This security group has not changed since Windows Server 2008.

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -3449,7 +3441,7 @@ The Storage Replica Administrators group applies to versions of the Windows Serv | Attribute | Value | |-----------|-------| | Well-Known SID/RID | S-1-5-32-582 | -| Type | BuiltIn Local | +| Type | Builtin Local | | Default container | CN=BuiltIn, DC=<domain>, DC= | | Default members | None | | Default member of | None | @@ -3470,7 +3462,7 @@ The System Managed Accounts group applies to versions of the Windows Server oper | Attribute | Value | |-----------|-------| | Well-Known SID/RID | S-1-5-32-581 | -| Type | BuiltIn Local | +| Type | Builtin Local | | Default container | CN=BuiltIn, DC=<domain>, DC= | | Default members | Users | | Default member of | None | @@ -3489,8 +3481,8 @@ For more information about this security group, see [Terminal Services License S The Terminal Server License Servers group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group cannot be renamed, deleted, or moved. @@ -3514,7 +3506,7 @@ This security group only applies to Windows Server 2003 and Windows Server 200

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -3581,7 +3573,7 @@ This security group includes the following changes since Windows Server 2008:

            Type

            -

            Builtin local

            +

            Builtin Local

            Default container

            @@ -3595,7 +3587,7 @@ This security group includes the following changes since Windows Server 2008:

            Default member of

            -

            Domain Users (this membership is due to the fact that the Primary Group ID of all user accounts is Domain Users.)

            +

            None

            Protected by ADMINSDHOLDER?

            @@ -3624,11 +3616,10 @@ Members of this group have access to the computed token GroupsGlobalAndUniversal The Windows Authorization Access group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). -**Note**   -This group cannot be renamed, deleted, or moved. +> [!NOTE] +> This group cannot be renamed, deleted, or moved. - This security group has not changed since Windows Server 2008. @@ -3649,7 +3640,7 @@ This security group has not changed since Windows Server 2008. - + @@ -3704,8 +3695,8 @@ The WinRMRemoteWMIUsers\_ group applies to versions of the Windows Server operat In Windows Server 2012, the Access Denied Assistance functionality adds the Authenticated Users group to the local WinRMRemoteWMIUsers\_\_ group. Therefore, when the Access Denied Assistance functionality is enabled, all authenticated users who have Read permissions to the file share can view the file share permissions. -**Note**   -The WinRMRemoteWMIUsers\_ group allows running Windows PowerShell commands remotely whereas the [Remote Management Users](#bkmk-remotemanagementusers) group is generally used to allow users to manage servers by using the Server Manager console. +> [!NOTE] +> The WinRMRemoteWMIUsers\_ group allows running Windows PowerShell commands remotely whereas the [Remote Management Users](#bkmk-remotemanagementusers) group is generally used to allow users to manage servers by using the Server Manager console. diff --git a/windows/security/identity-protection/access-control/dynamic-access-control.md b/windows/security/identity-protection/access-control/dynamic-access-control.md index 1ef5a24b40..ea1bce53c3 100644 --- a/windows/security/identity-protection/access-control/dynamic-access-control.md +++ b/windows/security/identity-protection/access-control/dynamic-access-control.md @@ -1,12 +1,12 @@ --- title: Dynamic Access Control Overview (Windows 10) -description: Dynamic Access Control Overview +description: Learn about Dynamic Access Control and its associated elements, which were introduced in Windows Server 2012 and Windows 8. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 2c744d7f98..e988e6da9f 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,12 +1,12 @@ --- title: Local Accounts (Windows 10) -description: Local Accounts +description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -297,9 +297,9 @@ The following table shows the Group Policy and registry settings that are used t - - - + + + @@ -334,7 +334,7 @@ The following table shows the Group Policy and registry settings that are used t - + @@ -444,9 +444,9 @@ The following table shows the Group Policy settings that are used to deny networ - - - + + + diff --git a/windows/security/identity-protection/access-control/microsoft-accounts.md b/windows/security/identity-protection/access-control/microsoft-accounts.md index d1f2624bf6..7abb98e730 100644 --- a/windows/security/identity-protection/access-control/microsoft-accounts.md +++ b/windows/security/identity-protection/access-control/microsoft-accounts.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index c8bdc813a2..b21bd85fd4 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/access-control/security-principals.md b/windows/security/identity-protection/access-control/security-principals.md index 111f5d902d..26564af45a 100644 --- a/windows/security/identity-protection/access-control/security-principals.md +++ b/windows/security/identity-protection/access-control/security-principals.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/access-control/service-accounts.md b/windows/security/identity-protection/access-control/service-accounts.md index 7a95b60584..3e5a325d0a 100644 --- a/windows/security/identity-protection/access-control/service-accounts.md +++ b/windows/security/identity-protection/access-control/service-accounts.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index 48f324427e..0dc6406a6d 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -186,7 +186,7 @@ This group includes all domain controllers in an Active Directory forest. Domain All interactive, network, dial-up, and authenticated users are members of the Everyone group. This special identity group gives wide access to system resources. Whenever a user logs on to the network, the user is automatically added to the Everyone group. -On computers running Windows 2000 and earlier, the Everyone group included the Anonymous Logon group as a default member, but as of Windows Server 2003, the Everyone group contains only Authenticated Users and Guest; and it no longer includes Anonymous Logon by default (although this can be changed). +On computers running Windows 2000 and earlier, the Everyone group included the Anonymous Logon group as a default member, but as of Windows Server 2003, the Everyone group contains only Authenticated Users and Guest; and it no longer includes Anonymous Logon by default (although this can be changed, using Registry Editor, by going to the **Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa** key and setting the value of **everyoneincludesanonymous** DWORD to 1). Membership is controlled by the operating system. diff --git a/windows/security/identity-protection/change-history-for-access-protection.md b/windows/security/identity-protection/change-history-for-access-protection.md index 954dd6020d..d76e6bc56d 100644 --- a/windows/security/identity-protection/change-history-for-access-protection.md +++ b/windows/security/identity-protection/change-history-for-access-protection.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index 0dd5d09a40..cab91d6db4 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -9,7 +9,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index 68410a7305..885c697548 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -18,7 +18,7 @@ ms.reviewer: # Additional mitigations -Windows Defender Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Windows Defender Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, re-using previously stolen credentials prior to Windows Defender Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also must be deployed to make the domain environment more robust. +Windows Defender Credential Guard can provide mitigation against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Windows Defender Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, re-using previously stolen credentials prior to Windows Defender Credential Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigation also must be deployed to make the domain environment more robust. ## Restricting domain users to specific domain-joined devices diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index 6d52746433..90a4a08397 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 4eaf65890c..8d0219c5dd 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index e2c7665e97..0780c5d0c4 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -58,7 +58,7 @@ When Windows Defender Credential Guard is enabled on Windows 10, the Java GSS AP The following issue affects Cisco AnyConnect Secure Mobility Client: -- [Blue screen on Windows 10 computers running Windows Defender Device Guard and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* +- [Blue screen on Windows 10 computers running Hypervisor-Protected Code Integrity and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* *Registration required to access this article. @@ -91,16 +91,16 @@ See the following article on Citrix support for Secure Boot: Windows Defender Credential Guard is not supported by either these products, products versions, computer systems, or Windows 10 versions: - For Windows Defender Credential Guard on Windows 10 with McAfee Encryption products, see: - [Support for Windows Defender Device Guard and Windows Defender Credential Guard on Windows 10 with McAfee encryption products](https://kc.mcafee.com/corporate/index?page=content&id=KB86009) + [Support for Hypervisor-Protected Code Integrity and Windows Defender Credential Guard on Windows 10 with McAfee encryption products](https://kc.mcafee.com/corporate/index?page=content&id=KB86009) - For Windows Defender Credential Guard on Windows 10 with Check Point Endpoint Security Client, see: - [Check Point Endpoint Security Client support for Microsoft Windows 10 Windows Defender Credential Guard and Windows Defender Device Guard features](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113912) + [Check Point Endpoint Security Client support for Microsoft Windows 10 Windows Defender Credential Guard and Hypervisor-Protected Code Integrity features](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113912) - For Windows Defender Credential Guard on Windows 10 with VMWare Workstation [Windows 10 host fails when running VMWare Workstation when Windows Defender Credential Guard is enabled](https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2146361) - For Windows Defender Credential Guard on Windows 10 with specific versions of the Lenovo ThinkPad - [ThinkPad support for Windows Defender Device Guard and Windows Defender Credential Guard in Microsoft Windows 10 – ThinkPad](https://support.lenovo.com/in/en/solutions/ht503039) + [ThinkPad support for Hypervisor-Protected Code Integrity and Windows Defender Credential Guard in Microsoft Windows 10 – ThinkPad](https://support.lenovo.com/in/en/solutions/ht503039) - For Windows Defender Credential Guard on Windows 10 with Symantec Endpoint Protection [Windows 10 with Windows Defender Credential Guard and Symantec Endpoint Protection 12.1](https://www.symantec.com/connect/forums/windows-10-device-guard-credentials-guard-and-sep-121) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 3136a3238c..27f4be1157 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -7,24 +7,27 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor -ms.author: dansimp +author: dansimp +ms.author: v-tea manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.reviewer: +ms.custom: + - CI 120967 + - CSSTroubleshooting --- # Manage Windows Defender Credential Guard **Applies to** -- Windows 10 +- Windows 10 Enterprise or Education SKUs - Windows Server 2016 - Windows Server 2019 ## Enable Windows Defender Credential Guard -Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Windows Defender Device Guard and Windows Defender Credential Guard [hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. +Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Hypervisor-Protected Code Integrity (HVCI) and Windows Defender Credential Guard [hardware readiness tool](dg-readiness-tool.md). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines. @@ -33,20 +36,27 @@ The same set of procedures used to enable Windows Defender Credential Guard on p You can use Group Policy to enable Windows Defender Credential Guard. This will add and enable the virtualization-based security features for you if needed. 1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**. + 2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option. + 3. In the **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**. + 4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Windows Defender Credential Guard remotely, choose **Enabled without lock**. - ![Windows Defender Credential Guard Group Policy setting](images/credguard-gp.png) +5. In the **Secure Launch Configuration** box, choose **Not Configured**, **Enabled** or **Disabled**. Check [this article](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) for more details. -5. Close the Group Policy Management Console. + ![Windows Defender Credential Guard Group Policy setting](images/credguard-gp-2.png) + +6. Close the Group Policy Management Console. To enforce processing of the group policy, you can run ```gpupdate /force```. ### Enable Windows Defender Credential Guard by using Intune -1. From **Home** click **Microsoft Intune** -2. Click **Device configuration** +1. From **Home**, click **Microsoft Intune**. + +2. Click **Device configuration**. + 3. Click **Profiles** > **Create Profile** > **Endpoint protection** > **Windows Defender Credential Guard**. > [!NOTE] @@ -62,6 +72,7 @@ Starting with Windows 10, version 1607 and Windows Server 2016, enabling Windows If you are using Windows 10, version 1507 (RTM) or Windows 10, version 1511, Windows features have to be enabled to use virtualization-based security. You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). + > [!NOTE] > If you enable Windows Defender Credential Guard by using Group Policy, the steps to enable Windows features through Control Panel or DISM are not required. Group Policy will install Windows features for you. @@ -69,23 +80,33 @@ You can do this by using either the Control Panel or the Deployment Image Servic **Add the virtualization-based security features by using Programs and Features** 1. Open the Programs and Features control panel. + 2. Click **Turn Windows feature on or off**. + 3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. + 4. Select the **Isolated User Mode** check box at the top level of the feature selection. + 5. Click **OK**. **Add the virtualization-based security features to an offline image by using DISM** 1. Open an elevated command prompt. + 2. Add the Hyper-V Hypervisor by running the following command: - ``` + + ```console dism /image: /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all ``` + 3. Add the Isolated User Mode feature by running the following command: - ``` + + ```console dism /image: /Enable-Feature /FeatureName:IsolatedUserMode ``` - NOTE: In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required. + + > [!NOTE] + > In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required. > [!TIP] > You can also add these features to an online image by using either DISM or Configuration Manager. @@ -95,12 +116,17 @@ You can do this by using either the Control Panel or the Deployment Image Servic 1. Open Registry Editor. 2. Enable virtualization-based security: + - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. + - Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. + - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**. 3. Enable Windows Defender Credential Guard: + - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. + - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it. 4. Close Registry Editor. @@ -111,15 +137,17 @@ You can do this by using either the Control Panel or the Deployment Image Servic -### Enable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool +### Enable Windows Defender Credential Guard by using the HVCI and Windows Defender Credential Guard hardware readiness tool -You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). +You can also enable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). -``` +```console DG_Readiness_Tool.ps1 -Enable -AutoReboot ``` + > [!IMPORTANT] -> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. ### Review Windows Defender Credential Guard performance @@ -129,20 +157,24 @@ DG_Readiness_Tool.ps1 -Enable -AutoReboot You can view System Information to check that Windows Defender Credential Guard is running on a PC. 1. Click **Start**, type **msinfo32.exe**, and then click **System Information**. + 2. Click **System Summary**. -3. Confirm that **Credential Guard** is shown next to **Virtualization-based security Services Configured**. + +3. Confirm that **Credential Guard** is shown next to **Virtualization-based security Services Running**. Here's an example: ![System Information](images/credguard-msinfo32.png) -You can also check that Windows Defender Credential Guard is running by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). +You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). -``` +```console DG_Readiness_Tool_v3.6.ps1 -Ready ``` + > [!IMPORTANT] -> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. > [!NOTE] @@ -151,15 +183,39 @@ DG_Readiness_Tool_v3.6.ps1 -Ready - We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible. - You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. - - **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: 0x1, 0 - - The first variable: 0x1 means Windows Defender Credential Guard is configured to run. 0x0 means it's not configured to run. - - The second variable: 0 means it's configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. - - **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. - - **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\] - - **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] - You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. - - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. + + - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. + + - **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: \[**0x0** \| **0x1** \| **0x2**\], **0** + + - The first variable: **0x1** or **0x2** means that Windows Defender Credential Guard is configured to run. **0x0** means that it's not configured to run. + + - The second variable: **0** means that it's configured to run in protect mode. **1** means that it's configured to run in test mode. This variable should always be **0**. + + - **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. + + - **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\] + + - **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] + + You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. + + - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**. + + - You can use Windows PowerShell to determine whether credential guard is running on a client computer. On the computer in question, open an elevated PowerShell window and run the following command: + + ```powershell + (Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning + ``` + + This command generates the following output: + + - **0**: Windows Defender Credential Guard is disabled (not running) + + - **1**: Windows Defender Credential Guard is enabled (running) + + > [!NOTE] + > Checking the task list or Task Manager to see if LSAISO.exe is running is not a recommended method for determining whether Windows Defender Credential Guard is running. ## Disable Windows Defender Credential Guard @@ -168,18 +224,21 @@ To disable Windows Defender Credential Guard, you can use the following set of p 1. If you used Group Policy, disable the Group Policy setting that you used to enable Windows Defender Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). 2. Delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\LsaCfgFlags 3. If you also wish to disable virtualization-based security delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures + > [!IMPORTANT] > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. 4. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands: - ``` syntax + ```console mountvol X: /s copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader @@ -207,30 +266,31 @@ To disable Windows Defender Credential Guard, you can use the following set of p > [!NOTE] > Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. These options will be made available with future Gen 2 VMs. -For more info on virtualization-based security and Windows Defender Device Guard, see [Windows Defender Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). +For more info on virtualization-based security and HVCI, see [Enable virtualization-based protection of code integrity](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity +). -#### Disable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool +#### Disable Windows Defender Credential Guard by using the HVCI and Windows Defender Credential Guard hardware readiness tool -You can also disable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). +You can also disable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). -``` +```console DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot ``` -> [!IMPORTANT] -> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. + +> [!IMPORTANT] +> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. #### Disable Windows Defender Credential Guard for a virtual machine From the host, you can disable Windows Defender Credential Guard for a virtual machine: -``` PowerShell +```powershell Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true ``` - - diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 0083c4e274..dcda95a96c 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index 792587963f..845101f5a0 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 5aef81711f..3fae5bee58 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -7,34 +7,35 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article -ms.date: 01/12/2018 +ms.date: 09/30/2020 ms.reviewer: --- # Windows Defender Credential Guard: Requirements -**Applies to** -- Windows 10 -- Windows Server 2016 +## Applies to +- Windows 10 Enterprise +- Windows Server 2016 -For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). - +For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements, which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to these requirements as [Application requirements](#application-requirements). Beyond these requirements, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). ## Hardware and software requirements To provide basic protections against OS level attempts to read Credential Manager domain credentials, NTLM and Kerberos derived credentials, Windows Defender Credential Guard uses: + - Support for Virtualization-based security (required) - Secure boot (required) -- TPM 1.2 or 2.0 (preferred - provides binding to hardware), either discrete or firmware +- Trusted Platform Module (TPM, preferred - provides binding to hardware) versions 1.2 and 2.0 are supported, either discrete or firmware - UEFI lock (preferred - prevents attacker from disabling with a simple registry key change) The Virtualization-based security requires: + - 64-bit CPU - CPU virtualization extensions plus extended page tables - Windows hypervisor (does not require Hyper-V Windows Feature to be installed) @@ -47,6 +48,7 @@ Credential Guard can protect secrets in a Hyper-V virtual machine, just as it wo - The Hyper-V host must have an IOMMU, and run at least Windows Server 2016 or Windows 10 version 1607. - The Hyper-V virtual machine must be Generation 2, have an enabled virtual TPM, and be running at least Windows Server 2016 or Windows 10. + - TPM is not a requirement, but we recommend that you implement TPM. For information about other host platforms, see [Enabling Windows Server 2016 and Hyper-V virtualization based security features on other platforms](https://blogs.technet.microsoft.com/windowsserver/2016/09/29/enabling-windows-server-2016-and-hyper-v-virtualization-based-security-features-on-other-platforms/). @@ -56,20 +58,22 @@ For information about Windows Defender Remote Credential Guard hardware and soft When Windows Defender Credential Guard is enabled, specific authentication capabilities are blocked, so applications that require such capabilities will break. Applications should be tested prior to deployment to ensure compatibility with the reduced functionality. ->[!WARNING] -> Enabling Windows Defender Credential Guard on domain controllers is not supported.
            +> [!WARNING] +> Enabling Windows Defender Credential Guard on domain controllers is not supported. > The domain controller hosts authentication services which integrate with processes isolated when Windows Defender Credential Guard is enabled, causing crashes. ->[!NOTE] +> [!NOTE] > Windows Defender Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Windows Defender Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts). Applications will break if they require: + - Kerberos DES encryption support - Kerberos unconstrained delegation - Extracting the Kerberos TGT - NTLMv1 Applications will prompt and expose credentials to risk if they require: + - Digest authentication - Credential delegation - MS-CHAPv2 @@ -86,52 +90,66 @@ The following tables describe baseline protections, plus protections for improve > [!NOTE] > Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers. -> -> If you are an OEM, see [PC OEM requirements for Windows Defender Device Guard and Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx). +> +> If you are an OEM, see [PC OEM requirements for Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx). ### Baseline protections -|Baseline Protections | Description | Security benefits +|Baseline Protections|Description|Security benefits |---|---|---| -| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | -| Hardware: **CPU virtualization extensions**,
            plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
            One of the following virtualization extensions:
            • VT-x (Intel) or
            • AMD-V
            And:
            • Extended page tables, also called Second Level Address Translation (SLAT). | VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | -| Hardware: **Trusted Platform Module (TPM)** |  **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.
            [TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations) | A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. | -| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | -| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | -| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

            Important:
            Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only Windows Defender Device Guard is supported in this configuration.

            |Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. | +|Hardware: **64-bit CPU** |A 64-bit computer is required for the Windows hypervisor to provide VBS.| +|Hardware: **CPU virtualization extensions**, plus **extended page tables**|**Requirements**:
            - These hardware features are required for VBS: One of the following virtualization extensions: - VT-x (Intel) or - AMD-V And: - Extended page tables, also called Second Level Address Translation (SLAT).|VBS provides isolation of secure kernel from normal operating system.

            Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation.| +|Hardware: **Trusted Platform Module (TPM)**|**Requirement**:
            - TPM 1.2 or TPM 2.0, either discrete or firmware. [TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations)|A TPM provides protection for VBS encryption keys that are stored in the firmware. TPM helps protect against attacks involving a physically present user with BIOS access.| +|Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot**|**Requirements**:
            - See the following Windows Hardware Compatibility Program requirement: System.Fundamentals.Firmware.UEFISecureBoot|UEFI Secure Boot helps ensure that the device boots only authorized code, and can prevent boot kits and root kits from installing and persisting across reboots.| +|Firmware: **Secure firmware update process**|**Requirements**:
            - UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: System.Fundamentals.Firmware.UEFISecureBoot.|UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed.| +|Software: Qualified **Windows operating system**|**Requirement**:
            - Windows 10 or Windows Server 2016.|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard.| + +> [!IMPORTANT] +> Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. > [!IMPORTANT] > The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Windows Defender Credential Guard can provide. - ### 2015 Additional security qualifications starting with Windows 10, version 1507, and Windows Server 2016 Technical Preview 4 -| Protections for Improved Security | Description | -|-----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Hardware: **IOMMU** (input/output memory management unit) | **Requirement**: VT-D or AMD Vi IOMMU **Security benefits**: An IOMMU can enhance system resiliency against memory attacks. For more information, see [ACPI description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables). | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
            • BIOS password or stronger authentication must be supported.
            • In the BIOS configuration, BIOS authentication must be set.
            • There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
            • In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings. | -| Firmware: **Secure MOR, revision 2 implementation** | **Requirement**: Secure MOR, revision 2 implementation | - -
            +|Protections for Improved Security|Description| +|---|---| +|Hardware: **IOMMU** (input/output memory management unit)|**Requirement**:
            - VT-D or AMD Vi IOMMU

            **Security benefits**:
            - An IOMMU can enhance system resiliency against memory attacks. For more information, see [Advanced Configuration and Power Interface (ACPI) description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables)| +|Firmware: **Securing Boot Configuration and Management**|**Requirements**:
            - BIOS password or stronger authentication must be supported.
            - In the BIOS configuration, BIOS authentication must be set.
            - There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
            - In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.| +|Firmware: **Secure MOR, revision 2 implementation**|**Requirement**:
            - Secure MOR, revision 2 implementation| ### 2016 Additional security qualifications starting with Windows 10, version 1607, and Windows Server 2016 > [!IMPORTANT] > The following tables list additional qualifications for improved security. Systems that meet these additional qualifications can provide more protections. -| Protections for Improved Security | Description |Security Benefits | +|Protections for Improved Security|Description|Security Benefits| |---|---|---| -| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
            Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
            • The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/library/windows/hardware/mt712332(v=vs.85).aspx). | Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
            • HSTI provides additional security assurance for correctly secured silicon and platform. | -| Firmware: **Firmware Update through Windows Update** | **Requirements**: Firmware must support field updates through Windows Update and UEFI encapsulation update. | Helps ensure that firmware updates are fast, secure, and reliable. | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
            • Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
            • Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software. | • Enterprises can choose to allow proprietary EFI drivers/applications to run.
            • Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. | - -
            +|Firmware: **Hardware Rooted Trust Platform Secure Boot**|**Requirements**:
            - Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby
            - The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/library/windows/hardware/mt712332(v=vs.85).aspx).|Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
            - HSTI provides additional security assurance for correctly secured silicon and platform.| +|Firmware: **Firmware Update through Windows Update**|**Requirements**:
            - Firmware must support field updates through Windows Update and UEFI encapsulation update.|Helps ensure that firmware updates are fast, secure, and reliable.| +|Firmware: **Securing Boot Configuration and Management**|**Requirements**:
            - Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
            - Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.|- Enterprises can choose to allow proprietary EFI drivers/applications to run.
            - Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots.| ### 2017 Additional security qualifications starting with Windows 10, version 1703 The following table lists qualifications for Windows 10, version 1703, which are in addition to all preceding qualifications. -| Protections for Improved Security | Description | Security Benefits +|Protections for Improved Security|Description|Security Benefits |---|---|---| -| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
            • VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
            • UEFI runtime service must meet these requirements:
                - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
                - PE sections need to be page-aligned in memory (not required for in non-volatile storage).
                - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
                    - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
                    - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

            Notes:
            • This only applies to UEFI runtime service memory, and not UEFI boot service memory.
            • This protection is applied by VBS on OS page tables.


            Please also note the following:
            • Do not use sections that are both writeable and executable
            • Do not attempt to directly modify executable system memory
            • Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
            • Reduces the attack surface to VBS from system firmware. | -| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features. | • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
            • Reduces the attack surface to VBS from system firmware.
            • Blocks additional security attacks against SMM. | +|Firmware: **VBS enablement of No-Execute (NX) protection for UEFI runtime services**|**Requirements**:
            - VBS will enable NX protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable. UEFI runtime service must meet these requirements:
            - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
            - PE sections must be page-aligned in memory (not required for in non-volatile storage).
            - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
            - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both.
            - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writable and non-executable.
            (**SEE IMPORTANT INFORMATION AFTER THIS TABLE**)|Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
            - Reduces the attack surface to VBS from system firmware.| +|Firmware: **Firmware support for SMM protection**|**Requirements**:
            - The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an ACPI table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.|- Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
            - Reduces the attack surface to VBS from system firmware.
            - Blocks additional security attacks against SMM.| + +> [!IMPORTANT] +> +> Regarding **VBS enablement of NX protection for UEFI runtime services**: +> +> - This only applies to UEFI runtime service memory, and not UEFI boot service memory. +> +> - This protection is applied by VBS on OS page tables. +> +> Please also note the following: +> +> - Do not use sections that are both writable and executable +> +> - Do not attempt to directly modify executable system memory +> +> - Do not use dynamic code diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 38bbbfc5cd..a2583e1181 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -29,7 +29,7 @@ By enabling Windows Defender Credential Guard, the following features and soluti - **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials. - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. -- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Windows Defender Device Guard and other security strategies and architectures. +- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate other security strategies and architectures.   ## Related topics diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md index 6c12907b28..b1dbf1f33c 100644 --- a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -14,11 +14,16 @@ ms.collection: M365-identity-device-management ms.topic: article ms.reviewer: --- + # Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool +**Applies to:** +- Windows 10 Enterprise Edition + ```powershell -# Script to find out if machine is Device Guard compliant -# requires driver verifier on system. +# Script to find out if a machine is Device Guard compliant. +# The script requires a driver verifier present on the system. + param([switch]$Capable, [switch]$Ready, [switch]$Enable, [switch]$Disable, $SIPolicyPath, [switch]$AutoReboot, [switch]$DG, [switch]$CG, [switch]$HVCI, [switch]$HLK, [switch]$Clear, [switch]$ResetVerifier) $path = "C:\DGLogs\" @@ -36,7 +41,7 @@ $DGVerifySuccess = New-Object System.Text.StringBuilder $Sys32Path = "$env:windir\system32" $DriverPath = "$env:windir\system32\drivers" -#generated by certutil -encode +#generated by certutil -encode $SIPolicy_Encoded = "BQAAAA43RKLJRAZMtVH2AW5WMHbk9wcuTBkgTbfJb0SmxaI0BACNkAgAAAAAAAAA HQAAAAIAAAAAAAAAAAAKAEAAAAAMAAAAAQorBgEEAYI3CgMGDAAAAAEKKwYBBAGC NwoDBQwAAAABCisGAQQBgjc9BAEMAAAAAQorBgEEAYI3PQUBDAAAAAEKKwYBBAGC @@ -114,7 +119,7 @@ function LogAndConsoleSuccess($message) function LogAndConsoleError($message) { - Write-Host $message -foregroundcolor "Red" + Write-Host $message -foregroundcolor "Red" Log $message } @@ -132,16 +137,16 @@ function IsExempted([System.IO.FileInfo] $item) Log $cert.ToString() return 0 } -} +} function CheckExemption($_ModName) { $mod1 = Get-ChildItem $Sys32Path $_ModName $mod2 = Get-ChildItem $DriverPath $_ModName if($mod1) - { + { Log "NonDriver module" + $mod1.FullName - return IsExempted($mod1) + return IsExempted($mod1) } elseif($mod2) { @@ -184,15 +189,15 @@ function CheckFailedDriver($_ModName, $CIStats) } if($Result.Contains("PASS")) { - $CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null + $CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null } elseif($FailingStat.Trim().Contains("execute-write")) { - $FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null + $FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null } else { - $FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null + $FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null } Log "Result: " $Result } @@ -204,7 +209,7 @@ function ListCIStats($_ModName, $str1) { Log "String := " $str1 Log "Warning! CI Stats are missing for " $_ModName - return + return } $temp_str1 = $str1.Substring($i1) $CIStats = $temp_str1.Substring(0).Trim() @@ -245,7 +250,7 @@ function ListDrivers($str) } $DriverScanCompletedMessage = "Completed scan. List of Compatible Modules can be found at " + $LogFile - LogAndConsole $DriverScanCompletedMessage + LogAndConsole $DriverScanCompletedMessage if($FailingModules.Length -gt 0 -or $FailingExecuteWriteCheck.Length -gt 0 ) { @@ -254,7 +259,7 @@ function ListDrivers($str) { LogAndConsoleError $WarningMessage } - else + else { LogAndConsoleWarning $WarningMessage } @@ -321,7 +326,7 @@ function ListSummary() } else { - LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n" + LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n" if(!$HVCI -and !$DG) { ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 2 /f ' @@ -336,56 +341,56 @@ function ListSummary() function Instantiate-Kernel32 { - try + try { Add-Type -TypeDefinition @" using System; using System.Diagnostics; using System.Runtime.InteropServices; - + public static class Kernel32 { [DllImport("kernel32", SetLastError=true, CharSet = CharSet.Ansi)] public static extern IntPtr LoadLibrary( [MarshalAs(UnmanagedType.LPStr)]string lpFileName); - + [DllImport("kernel32", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)] public static extern IntPtr GetProcAddress( IntPtr hModule, string procName); } - + "@ } catch { - Log $_.Exception.Message + Log $_.Exception.Message LogAndConsole "Instantiate-Kernel32 failed" } } function Instantiate-HSTI { - try + try { Add-Type -TypeDefinition @" using System; using System.Diagnostics; using System.Runtime.InteropServices; using System.Net; - + public static class HstiTest3 { [DllImport("hstitest.dll", CharSet = CharSet.Unicode)] - public static extern int QueryHSTIdetails( - ref HstiOverallError pHstiOverallError, + public static extern int QueryHSTIdetails( + ref HstiOverallError pHstiOverallError, [In, Out] HstiProviderErrorDuple[] pHstiProviderErrors, ref uint pHstiProviderErrorsCount, byte[] hstiPlatformSecurityBlob, ref uint pHstiPlatformSecurityBlobBytes); [DllImport("hstitest.dll", CharSet = CharSet.Unicode)] - public static extern int QueryHSTI(ref bool Pass); - + public static extern int QueryHSTI(ref bool Pass); + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] public struct HstiProviderErrorDuple { @@ -397,7 +402,7 @@ function Instantiate-HSTI { [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 4096)] internal string ErrorString; } - + [FlagsAttribute] public enum HstiProviderErrors : int { @@ -425,8 +430,8 @@ function Instantiate-HSTI { BlobVersionMismatch = 0x00000080, PlatformSecurityVersionMismatch = 0x00000100, ProviderError = 0x00000200 - } - + } + } "@ @@ -434,9 +439,9 @@ function Instantiate-HSTI { $FuncHandle = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTIdetails") $FuncHandle2 = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTI") - if ([System.IntPtr]::Size -eq 8) + if ([System.IntPtr]::Size -eq 8) { - #assuming 64 bit + #assuming 64 bit Log "`nKernel32::LoadLibrary 64bit --> 0x$("{0:X16}" -f $LibHandle.ToInt64())" Log "HstiTest2::QueryHSTIdetails 64bit --> 0x$("{0:X16}" -f $FuncHandle.ToInt64())" } @@ -450,7 +455,7 @@ function Instantiate-HSTI { $hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $null, [ref] $providerErrorDupleCount, $null, [ref] $blobByteSize) [byte[]]$blob = New-Object byte[] $blobByteSize - [HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount + [HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount $hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $providerErrors, [ref] $providerErrorDupleCount, $blob, [ref] $blobByteSize) $string = $null $blob | foreach { $string = $string + $_.ToString("X2")+"," } @@ -479,7 +484,7 @@ function Instantiate-HSTI { LogAndConsoleError $ErrorMessage $DGVerifyCrit.AppendLine($ErrorMessage) | Out-Null } - else + else { LogAndConsoleWarning $ErrorMessage $DGVerifyWarn.AppendLine("HSTI is absent") | Out-Null @@ -487,9 +492,9 @@ function Instantiate-HSTI { } } - catch + catch { - LogAndConsoleError $_.Exception.Message + LogAndConsoleError $_.Exception.Message LogAndConsoleError "Instantiate-HSTI failed" } } @@ -613,10 +618,10 @@ function ExecuteCommandAndLog($_cmd) $CmdOutput = Invoke-Expression $_cmd | Out-String Log "Output: $CmdOutput" } - catch + catch { Log "Exception while exectuing $_cmd" - Log $_.Exception.Message + Log $_.Exception.Message } @@ -655,7 +660,7 @@ function PrintHardwareReq { LogAndConsole "###########################################################################" LogAndConsole "OS and Hardware requirements for enabling Device Guard and Credential Guard" - LogAndConsole " 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education, Enterprise IoT, Pro, and Home" + LogAndConsole " 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education and Enterprise IoT" LogAndConsole " 2. Hardware: Recent hardware that supports virtualization extension with SLAT" LogAndConsole "To learn more please visit: https://aka.ms/dgwhcr" LogAndConsole "########################################################################### `n" @@ -676,7 +681,7 @@ function CheckDriverCompat verifier.exe /flags 0x02000000 /all /log.code_integrity LogAndConsole "Enabling Driver Verifier and Rebooting system" - Log $verifier_state + Log $verifier_state LogAndConsole "Please re-execute this script after reboot...." if($AutoReboot) { @@ -692,7 +697,7 @@ function CheckDriverCompat else { LogAndConsole "Driver verifier already enabled" - Log $verifier_state + Log $verifier_state ListDrivers($verifier_state.Trim().ToLowerInvariant()) } } @@ -700,23 +705,23 @@ function IsDomainController { $_isDC = 0 $CompConfig = Get-WmiObject Win32_ComputerSystem - foreach ($ObjItem in $CompConfig) + foreach ($ObjItem in $CompConfig) { $Role = $ObjItem.DomainRole Log "Role=$Role" - Switch ($Role) + Switch ($Role) { 0 { Log "Standalone Workstation" } 1 { Log "Member Workstation" } 2 { Log "Standalone Server" } 3 { Log "Member Server" } - 4 + 4 { Log "Backup Domain Controller" $_isDC=1 break } - 5 + 5 { Log "Primary Domain Controller" $_isDC=1 @@ -730,12 +735,12 @@ function IsDomainController function CheckOSSKU { - $osname = $((gwmi win32_operatingsystem).Name).ToLower() + $osname = $((Get-ComputerInfo).WindowsProductName).ToLower() $_SKUSupported = 0 Log "OSNAME:$osname" - $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server", "Pro", "Home") - $HLKAllowed = @("microsoft windows 10 pro") - foreach ($SKUent in $SKUarray) + $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server") + $HLKAllowed = @("windows 10 pro") + foreach ($SKUent in $SKUarray) { if($osname.ToString().Contains($SKUent.ToLower())) { @@ -762,7 +767,7 @@ function CheckOSSKU } ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "OSSKU" /t REG_DWORD /d 2 /f ' } - else + else { LogAndConsoleError "This PC edition is Unsupported for Device Guard" $DGVerifyCrit.AppendLine("OS SKU unsupported") | Out-Null @@ -773,14 +778,14 @@ function CheckOSSKU function CheckOSArchitecture { $OSArch = $(gwmi win32_operatingsystem).OSArchitecture.ToLower() - Log $OSArch - if($OSArch.Contains("64-bit")) + Log $OSArch + if($OSArch -match ("^64\-?\s?bit")) { - LogAndConsoleSuccess "64 bit archictecture" + LogAndConsoleSuccess "64 bit architecture" } - elseif($OSArch.Contains("32-bit")) + elseif($OSArch -match ("^32\-?\s?bit")) { - LogAndConsoleError "32 bit archictecture" + LogAndConsoleError "32 bit architecture" $DGVerifyCrit.AppendLine("32 Bit OS, OS Architecture failure.") | Out-Null } else @@ -878,7 +883,7 @@ function CheckTPM function CheckSecureMOR { $isSecureMOR = CheckDGFeatures(4) - Log "isSecureMOR= $isSecureMOR " + Log "isSecureMOR= $isSecureMOR " if($isSecureMOR -eq 1) { LogAndConsoleSuccess "Secure MOR is available" @@ -904,7 +909,7 @@ function CheckSecureMOR function CheckNXProtection { $isNXProtected = CheckDGFeatures(5) - Log "isNXProtected= $isNXProtected " + Log "isNXProtected= $isNXProtected " if($isNXProtected -eq 1) { LogAndConsoleSuccess "NX Protector is available" @@ -921,7 +926,7 @@ function CheckNXProtection function CheckSMMProtection { $isSMMMitigated = CheckDGFeatures(6) - Log "isSMMMitigated= $isSMMMitigated " + Log "isSMMMitigated= $isSMMMitigated " if($isSMMMitigated -eq 1) { LogAndConsoleSuccess "SMM Mitigation is available" @@ -938,15 +943,15 @@ function CheckSMMProtection function CheckHSTI { LogAndConsole "Copying HSTITest.dll" - try + try { $HSTITest_Decoded = [System.Convert]::FromBase64String($HSTITest_Encoded) [System.IO.File]::WriteAllBytes("$env:windir\System32\hstitest.dll",$HSTITest_Decoded) } - catch + catch { - LogAndConsole $_.Exception.Message + LogAndConsole $_.Exception.Message LogAndConsole "Copying and loading HSTITest.dll failed" } @@ -959,7 +964,7 @@ function PrintToolVersion LogAndConsole "" LogAndConsole "###########################################################################" LogAndConsole "" - LogAndConsole "Readiness Tool Version 3.7.1 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard." + LogAndConsole "Readiness Tool Version 3.7.2 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard." LogAndConsole "" LogAndConsole "###########################################################################" LogAndConsole "" @@ -1030,7 +1035,7 @@ if(!($Ready) -and !($Capable) -and !($Enable) -and !($Disable) -and !($Clear) -a } $user = [Security.Principal.WindowsIdentity]::GetCurrent(); -$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) +$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) if(!$TestForAdmin) { @@ -1065,7 +1070,7 @@ if($Ready) { Log "_CGState: $_CGState" PrintCGDetails $_CGState - + if($_CGState) { ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Running" /t REG_DWORD /d 1 /f' @@ -1077,28 +1082,28 @@ if($Ready) } elseif($DG) { - Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState" + Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState" PrintHVCIDetails $_HVCIState - PrintConfigCIDetails $_ConfigCIState + PrintConfigCIDetails $_ConfigCIState if($_ConfigCIState -and $_HVCIState) { LogAndConsoleSuccess "HVCI, and Config-CI are enabled and running." - + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 1 /f' } else { LogAndConsoleWarning "Not all services are running." - + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 0 /f' } } - else + else { - Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState" - + Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState" + PrintCGDetails $_CGState PrintHVCIDetails $_HVCIState PrintConfigCIDetails $_ConfigCIState @@ -1147,7 +1152,7 @@ if($Enable) { ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f' } - else + else { ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f' ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f' @@ -1158,8 +1163,8 @@ if($Enable) { if(!$HVCI -and !$CG) { - if(!$SIPolicyPath) - { + if(!$SIPolicyPath) + { Log "Writing Decoded SIPolicy.p7b" $SIPolicy_Decoded = [System.Convert]::FromBase64String($SIPolicy_Encoded) [System.IO.File]::WriteAllBytes("$env:windir\System32\CodeIntegrity\SIPolicy.p7b",$SIPolicy_Decoded) @@ -1182,7 +1187,7 @@ if($Enable) if(!$_isRedstone) { LogAndConsole "OS Not Redstone, enabling IsolatedUserMode separately" - #Enable/Disable IOMMU seperately + #Enable/Disable IOMMU separately ExecuteCommandAndLog 'DISM.EXE /Online /Enable-Feature:IsolatedUserMode /NoRestart' } $CmdOutput = DISM.EXE /Online /Enable-Feature:Microsoft-Hyper-V-Hypervisor /All /NoRestart | Out-String @@ -1251,7 +1256,7 @@ if($Disable) if(!$_isRedstone) { LogAndConsole "OS Not Redstone, disabling IsolatedUserMode separately" - #Enable/Disable IOMMU seperately + #Enable/Disable IOMMU separately ExecuteCommandAndLog 'DISM.EXE /Online /disable-Feature /FeatureName:IsolatedUserMode /NoRestart' } $CmdOutput = DISM.EXE /Online /disable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /NoRestart | Out-String @@ -1270,7 +1275,7 @@ if($Disable) } #set of commands to run SecConfig.efi to delete UEFI variables if were set in pre OS - #these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always + #these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always #this requires a reboot and accepting the prompt in the Pre-OS which is self explanatory in the message that is displayed in pre-OS $FreeDrive = ls function:[s-z]: -n | ?{ !(test-path $_) } | random Log "FreeDrive=$FreeDrive" @@ -1314,7 +1319,7 @@ if($Capable) } $_StepCount = 1 if(!$CG) - { + { LogAndConsole " ====================== Step $_StepCount Driver Compat ====================== " $_StepCount++ CheckDriverCompat @@ -1323,15 +1328,15 @@ if($Capable) LogAndConsole " ====================== Step $_StepCount Secure boot present ====================== " $_StepCount++ CheckSecureBootState - + if(!$HVCI -and !$DG -and !$CG) - { + { #check only if sub-options are absent LogAndConsole " ====================== Step $_StepCount MS UEFI HSTI tests ====================== " $_StepCount++ CheckHSTI } - + LogAndConsole " ====================== Step $_StepCount OS Architecture ====================== " $_StepCount++ CheckOSArchitecture @@ -1345,11 +1350,11 @@ if($Capable) CheckVirtualization if(!$HVCI -and !$DG) - { + { LogAndConsole " ====================== Step $_StepCount TPM version ====================== " $_StepCount++ CheckTPM - + LogAndConsole " ====================== Step $_StepCount Secure MOR ====================== " $_StepCount++ CheckSecureMOR @@ -1358,11 +1363,11 @@ if($Capable) LogAndConsole " ====================== Step $_StepCount NX Protector ====================== " $_StepCount++ CheckNXProtection - + LogAndConsole " ====================== Step $_StepCount SMM Mitigation ====================== " $_StepCount++ CheckSMMProtection - + LogAndConsole " ====================== End Check ====================== " LogAndConsole " ====================== Summary ====================== " @@ -1371,7 +1376,6 @@ if($Capable) } - # SIG # Begin signature block ## REPLACE # SIG # End signature block diff --git a/windows/security/identity-protection/credential-guard/images/credguard-gp-2.png b/windows/security/identity-protection/credential-guard/images/credguard-gp-2.png new file mode 100644 index 0000000000..ead9410405 Binary files /dev/null and b/windows/security/identity-protection/credential-guard/images/credguard-gp-2.png differ diff --git a/windows/security/identity-protection/credential-guard/images/credguard-msinfo32.png b/windows/security/identity-protection/credential-guard/images/credguard-msinfo32.png index d9af0e8fc4..46f838c8d2 100644 Binary files a/windows/security/identity-protection/credential-guard/images/credguard-msinfo32.png and b/windows/security/identity-protection/credential-guard/images/credguard-msinfo32.png differ diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index b45b7ac061..8a678b6ff4 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -11,7 +11,6 @@ ms.collection: M365-identity-device-management ms.topic: article ms.prod: w10 ms.technology: windows -ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium ms.date: 07/27/2017 @@ -26,13 +25,16 @@ ms.reviewer: Enterprise certificate pinning is a Windows feature for remembering, or “pinning,” a root issuing certificate authority or end entity certificate to a given domain name. Enterprise certificate pinning helps reduce man-in-the-middle attacks by enabling you to protect your internal domain names from chaining to unwanted certificates or to fraudulently issued certificates. ->[!NOTE] +> [!NOTE] > External domain names, where the certificate issued to these domains is issued by a public certificate authority, are not ideal for enterprise certificate pinning. Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site’s server authentication certificate chain matches a restricted set of certificates. These restrictions are encapsulated in a Pin Rules Certificate Trust List (CTL) that is configured and deployed to Windows 10 computers. Any site certificate triggering a name mismatch causes Windows to write an event to the CAPI2 event log and prevents the user from navigating to the web site using Microsoft Edge or Internet Explorer. +> [!NOTE] +> Enterprise Certificate Pinning feature triggering doesn't cause clients other than Microsoft Edge or Internet Explorer to block the connection. + ## Deployment To deploy enterprise certificate pinning, you need to: diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 4579829e90..7cf7eeccbf 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -1,6 +1,6 @@ --- title: WebAuthn APIs -description: Enabling password-less authentication for your sites and apps +description: Learn how to use WebAuthn APIs to enable password-less authentication for your sites and apps. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index a3a94da88d..e6e5fa20c1 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -1,6 +1,6 @@ --- -title: Multifactor Unlock -description: Multifactor Unlock +title: Multi-factor Unlock +description: Learn how Windows 10 offers multifactor device unlock by extending Windows Hello with trusted signals. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, multi, factor, multifactor, multi-factor ms.prod: w10 ms.mktglfcycl: deploy @@ -16,7 +16,7 @@ localizationpriority: medium ms.date: 03/20/2018 ms.reviewer: --- -# Multifactor Unlock +# Multi-factor Unlock **Applies to:** - Windows 10 @@ -83,15 +83,17 @@ For example, if you include the PIN and fingerprint credential providers in both The **Signal rules for device unlock** setting contains the rules the Trusted Signal credential provider uses to satisfy unlocking the device. ### Rule element -You represent signal rules in XML. Each signal rule has an starting and ending **rule** element that contains the **schemaVersion** attribute and value. The current supported schema version is 1.0.
            +You represent signal rules in XML. Each signal rule has an starting and ending **rule** element that contains the **schemaVersion** attribute and value. The current supported schema version is 1.0. + **Example** -``` +```xml ``` ### Signal element -Each rule element has a **signal** element. All signal elements have a **type** element and value. Windows 10, version 1709 supports the **ipConfig** and **bluetooth** type values.
            +Each rule element has a **signal** element. All signal elements have a **type** element and value. Windows 10, version 1709 supports the **ipConfig** and **bluetooth** type values. + |Attribute|Value| |---------|-----| @@ -109,8 +111,8 @@ You define the bluetooth signal with additional attributes in the signal element |rssiMin|"*number*"|no| |rssiMaxDelta|"*number*"|no| -Example: -``` +**Example** +```xml @@ -142,63 +144,76 @@ RSSI measurements are relative and lower as the bluetooth signals between the tw You define IP configuration signals using one or more ipConfiguration elements. Each element has a string value. IpConfiguration elements do not have attributes or nested elements. ##### IPv4Prefix -The IPv4 network prefix represented in Internet standard dotted-decimal notation. A network prefix that uses the Classless Inter-Domain Routing (CIDR) notation is required as part of the network string. A network port must not be present in the network string. A **signal** element may only contain one **ipv4Prefix** element.
            +The IPv4 network prefix represented in Internet standard dotted-decimal notation. A network prefix that uses the Classless Inter-Domain Routing (CIDR) notation is required as part of the network string. A network port must not be present in the network string. A **signal** element may only contain one **ipv4Prefix** element. + **Example** -``` +```xml 192.168.100.0/24 ``` + The assigned IPv4 addresses in the range of 192.168.100.1 to 192.168.100.254 match this signal configuration. ##### IPv4Gateway -The IPv4 network gateway represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4Gateway** element.
            +The IPv4 network gateway represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4Gateway** element. + **Example** -``` +```xml 192.168.100.10 ``` + ##### IPv4DhcpServer -The IPv4 DHCP server represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4DhcpServer** element.
            +The IPv4 DHCP server represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4DhcpServer** element. + **Example** -``` +```xml 192.168.100.10 ``` + ##### IPv4DnsServer -The IPv4 DNS server represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string.The **signal** element may contain one or more **ipv4DnsServer** elements.
            +The IPv4 DNS server represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string.The **signal** element may contain one or more **ipv4DnsServer** elements. + **Example:** -``` +```xml 192.168.100.10 ``` ##### IPv6Prefix -The IPv6 network prefix represented in IPv6 network using Internet standard hexadecimal encoding. A network prefix in CIDR notation is required as part of the network string. A network port or scope ID must not be present in the network string. A **signal** element may only contain one **ipv6Prefix** element.
            +The IPv6 network prefix represented in IPv6 network using Internet standard hexadecimal encoding. A network prefix in CIDR notation is required as part of the network string. A network port or scope ID must not be present in the network string. A **signal** element may only contain one **ipv6Prefix** element. + **Example** -``` +```xml 21DA:D3::/48 ``` ##### IPv6Gateway -The IPv6 network gateway represented in Internet standard hexadecimal encoding. An IPv6 scope ID may be present in the network string. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv6Gateway** element.
            +The IPv6 network gateway represented in Internet standard hexadecimal encoding. An IPv6 scope ID may be present in the network string. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv6Gateway** element. + **Example** -``` +```xml 21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 ``` ##### IPv6DhcpServer -The IPv6 DNS server represented in Internet standard hexadecimal encoding. An IPv6 scope ID may be present in the network string. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv6DhcpServer** element.
            +The IPv6 DNS server represented in Internet standard hexadecimal encoding. An IPv6 scope ID may be present in the network string. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv6DhcpServer** element. + **Example** -``` +```xml 21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 +The IPv6 DNS server represented in Internet standard hexadecimal encoding. An IPv6 scope ID may be present in the network string. A network port or prefix must not be present in the network string. The **signal** element may contain one or more **ipv6DnsServer** elements. + **Example** -``` +```xml 21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 ``` + ##### dnsSuffix -The fully qualified domain name of your organization's internal DNS suffix where any part of the fully qualified domain name in this setting exists in the computer's primary DNS suffix. The **signal** element may contain one or more **dnsSuffix** elements.
            +The fully qualified domain name of your organization's internal DNS suffix where any part of the fully qualified domain name in this setting exists in the computer's primary DNS suffix. The **signal** element may contain one or more **dnsSuffix** elements. + **Example** -``` +```xml corp.contoso.com ``` @@ -210,15 +225,17 @@ The fully qualified domain name of your organization's internal DNS suffix where You define Wi-Fi signals using one or more wifi elements. Each element has a string value. Wifi elements do not have attributes or nested elements. #### SSID -Contains the service set identifier (SSID) of a wireless network. The SSID is the name of the wireless network. The SSID element is required.
            -``` +Contains the service set identifier (SSID) of a wireless network. The SSID is the name of the wireless network. The SSID element is required. + +```xml corpnetwifi ``` #### BSSID -Contains the basic service set identifier (BSSID) of a wireless access point. the BSSID is the mac address of the wireless access point. The BSSID element is optional.
            +Contains the basic service set identifier (BSSID) of a wireless access point. the BSSID is the mac address of the wireless access point. The BSSID element is optional. + **Example** -``` +```xml 12-ab-34-ff-e5-46 ``` @@ -235,19 +252,22 @@ Contains the type of security the client uses when connecting to the wireless ne |WPA2-Enterprise| The wireless network is protected using Wi-Fi Protected Access 2-Enterprise.| **Example** -``` +```xml WPA2-Enterprise ``` #### TrustedRootCA -Contains the thumbprint of the trusted root certificate of the wireless network. This may be any valid trusted root certificate. The value is represented as hexadecimal string where each byte in the string is separated by a single space. This element is optional.
            +Contains the thumbprint of the trusted root certificate of the wireless network. This may be any valid trusted root certificate. The value is represented as hexadecimal string where each byte in the string is separated by a single space. This element is optional. + **Example** -``` +```xml a2 91 34 aa 22 3a a2 3a 4a 78 a2 aa 75 a2 34 2a 3a 11 4a aa ``` + #### Sig_quality -Contains numeric value ranging from 0 to 100 to represent the wireless network's signal strength needed to be considered a trusted signal.
            +Contains numeric value ranging from 0 to 100 to represent the wireless network's signal strength needed to be considered a trusted signal. + **Example** -``` +```xml 80 ``` @@ -257,7 +277,8 @@ These examples are wrapped for readability. Once properly formatted, the entire #### Example 1 This example configures an IPConfig signal type using Ipv4Prefix, Ipv4DnsServer, and DnsSuffix elements. -``` + +```xml 10.10.10.0/24 @@ -271,10 +292,11 @@ This example configures an IPConfig signal type using Ipv4Prefix, Ipv4DnsServer, #### Example 2 This example configures an IpConfig signal type using a dnsSuffix element and a bluetooth signal for phones. This configuration is wrapped for reading. Once properly formatted, the entire XML contents must be a single line. This example implies that either the ipconfig **or** the Bluetooth rule must evaluate to true, for the resulting signal evaluation to be true. + >[!NOTE] >Separate each rule element using a comma. -``` +```xml corp.contoso.com @@ -284,9 +306,11 @@ This example configures an IpConfig signal type using a dnsSuffix element and a ``` + #### Example 3 This example configures the same as example 2 using compounding And elements. This example implies that the ipconfig **and** the Bluetooth rule must evaluate to true, for the resulting signal evaluation to be true. -``` + +```xml @@ -296,10 +320,12 @@ This example configures the same as example 2 using compounding And elements. T ``` + #### Example 4 This example configures Wi-Fi as a trusted signal (Windows 10, version 1803) -``` - + +```xml + contoso 12-ab-34-ff-e5-46 @@ -332,22 +358,34 @@ The Group Policy object contains the policy settings needed to trigger Windows H > * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can satisfy either category, but not both. > * The multifactor unlock feature is also supported via the Passport for Work CSP. See [Passport For Work CSP](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) for more information. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New**. -4. Type *Multifactor Unlock* in the name box and click **OK**. -5. In the content pane, right-click the **Multifactor Unlock** Group Policy object and click **Edit**. -6. In the navigation pane, expand **Policies** under **Computer Configuration**. -7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**.
            - ![Group Policy Editor](images/multifactorUnlock/gpme.png) -8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values.
            - ![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) -9. Configure first and second unlock factors using the information in the [Configure Unlock Factors](#configuring-unlock-factors) section. -10. If using trusted signals, configure the trusted signals used by the unlock factor using the information in the [Configure Signal Rules for the Trusted Signal Credential Provider](#configure-signal-rules-for-the-trusted-signal-credential-provider) section. -11. Click **Ok** to close the **Group Policy Management Editor**. Use the **Group Policy Management Console** to deploy the newly created Group Policy object to your organization's computers. +1. Start the **Group Policy Management Console** (gpmc.msc). - ## Troubleshooting - Multi-factor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. + +3. Right-click **Group Policy object** and select **New**. + +4. Type *Multifactor Unlock* in the name box and click **OK**. + +5. In the content pane, right-click the **Multifactor Unlock** Group Policy object and click **Edit**. + +6. In the navigation pane, expand **Policies** under **Computer Configuration**. + +7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. + + ![Group Policy Editor](images/multifactorUnlock/gpme.png) + +8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values. + + ![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) + +9. Configure first and second unlock factors using the information in [Configure Unlock Factors](#configuring-unlock-factors). + +10. If using trusted signals, configure the trusted signals used by the unlock factor using the information in [Configure Signal Rules for the Trusted Signal Credential Provider](#configure-signal-rules-for-the-trusted-signal-credential-provider). + +11. Click **OK** to close the **Group Policy Management Editor**. Use the **Group Policy Management Console** to deploy the newly created Group Policy object to your organization's computers. + +## Troubleshooting +Multi-factor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. ### Events diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index 01dffaef6d..d0857ccd72 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -15,7 +15,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 03/05/2020 +ms.date: 01/12/2021 --- # Windows Hello biometrics in the enterprise @@ -53,7 +53,7 @@ The biometric data used to support Windows Hello is stored on the local device o ## Has Microsoft set any device requirements for Windows Hello? We've been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements: -- **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regards to the security of the biometric algorithm. +- **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regard to the security of the biometric algorithm. - **False Reject Rate (FRR).** Represents the instances a biometric identification solution fails to verify an authorized person correctly. Usually represented as a percentage, the sum of the True Accept Rate and False Reject Rate is 1. Can be with or without anti-spoofing or liveness detection. @@ -81,6 +81,10 @@ To allow facial recognition, you must have devices with integrated special infra - Effective, real world FRR with Anti-spoofing or liveness detection: <10% +> [!NOTE] +>Windows Hello face authentication does not currently support wearing a mask during enrollment or authentication. Wearing a mask to enroll is a security concern because other users wearing a similar mask may be able to unlock you device. The product group is aware of this behavior and is investigating this topic further. Please remove a mask if you are wearing one when you enroll or unlock with Windows Hello face authentication. If your working environment doesn’t allow you to remove a mask temporarily, please consider unenrolling from face authentication and only using PIN or fingerprint. + + ## Related topics - [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index f42095fd31..22d05b8312 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -13,16 +13,16 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 08/19/2018 +ms.date: 01/14/2021 ms.reviewer: --- # Prepare and Deploy Windows Server 2016 Active Directory Federation Services **Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Certificate trust +- Windows 10, version 1703 or later +- On-premises deployment +- Certificate trust Windows Hello for Business works exclusively with the Active Directory Federation Service role included with Windows Server 2016 and requires an additional server update. The on-premises certificate trust deployment uses Active Directory Federation Services roles for key registration, device registration, and as a certificate registration authority. @@ -36,7 +36,22 @@ Ensure you apply the Windows Server 2016 Update to all nodes in the farm after y A new Active Directory Federation Services farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with an external networking peripherals, or with using the Network Load Balancing Role included in Windows Server. -Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. +Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. + +> [!NOTE] +> For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: +> +> 1. Launch AD FS management console. Browse to "Services > Scope Descriptions". +> 2. Right click "Scope Descriptions" and select "Add Scope Description". +> 3. Under name type "ugs" and Click Apply > OK. +> 4. Launch PowerShell as an administrator. +> 5. Get the ObjectIdentifier of the application permission with the ClientRoleIdentifier parameter equal to "38aa3b87-a06d-4817-b275-7a316988d93b": +> ```PowerShell +> (Get-AdfsApplicationPermission -ServerRoleIdentifiers 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' | ?{ $_.ClientRoleIdentifier -eq '38aa3b87-a06d-4817-b275-7a316988d93b' }).ObjectIdentifier +> ``` +> 6. Execute the command `Set-AdfsApplicationPermission -TargetIdentifier -AddScope 'ugs'`. +> 7. Restart the AD FS service. +> 8. On the client: Restart the client. User should be prompted to provision Windows Hello for Business. ## Update Windows Server 2016 @@ -52,19 +67,21 @@ Sign-in the federation server with _local admin_ equivalent credentials. Windows Hello for Business on-premises deployments require a federation server for device registration, key registration, and authentication certificate enrollment. Typically, a federation service is an edge facing role. However, the federation services and instance used with the on-premises deployment of Windows Hello for Business does not need Internet connectivity. The AD FS role needs a server authentication certificate for the federation services, but you can use a certificate issued by your enterprise (internal) certificate authority. The server authentication certificate should have the following names included in the certificate if you are requesting an individual certificate for each node in the federation farm: -* Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS) -* Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com) -* Subject Alternate Name: Your device registration service name, such as *enterpriseregistration.contoso.com* + +- Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS) +- Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com) +- Subject Alternate Name: Your device registration service name, such as *enterpriseregistration.contoso.com* You configure your federation service name when you configure the AD FS role. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server **adfs** and the federation service **fs**. The FQDN of the host is adfs.corp.contoso.com and the FQDN of the federation service is fs.corp.contoso.com. You can; however, issue one certificate for all hosts in the farm. If you chose this option, then leave the subject name blank, and include all the names in the subject alternate name when creating the certificate request. All names should include the FQDN of each host in the farm and the federation service name. -It’s recommended that you mark the private key as exportable so that the same certificate can be deployed across each federation server and web application proxy within your AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm. +It’s recommended that you mark the private key as exportable so that the same certificate can be deployed across each federation server and web application proxy within your AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm. Be sure to enroll or import the certificate into the AD FS server’s computer certificate store. Also, ensure all nodes in the farm have the proper TLS server authentication certificate. ### Internal Web Server Authentication Certificate Enrollment + Sign-in the federation server with domain administrator equivalent credentials. 1. Start the Local Computer **Certificate Manager** (certlm.msc). @@ -75,17 +92,19 @@ Sign-in the federation server with domain administrator equivalent credentials. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished. -9. Click **Enroll**. +8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. +9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Repeat the same to add device registration service name (*enterpriseregistration.contoso.com*) as another alternative name. Click **OK** when finished. +10. Click **Enroll**. A server authentication certificate should appear in the computer’s Personal certificate store. ## Deploy the Active Directory Federation Service Role -The Active Directory Federation Service (AD FS) role provides the following services to support Windows Hello for Business on-premises deployments. -* Device registration -* Key registration -* Certificate registration authority (certificate trust deployments) +The Active Directory Federation Service (AD FS) role provides the following services to support Windows Hello for Business on-premises deployments: + +- Device registration +- Key registration +- Certificate registration authority (certificate trust deployments) >[!IMPORTANT] > Finish the entire AD FS configuration on the first server in the farm before adding the second server to the AD FS farm. Once complete, the second server receives the configuration through the shared configuration database when it is added the AD FS farm. @@ -93,6 +112,7 @@ The Active Directory Federation Service (AD FS) role provides the following serv Windows Hello for Business depends on proper device registration. For on-premises deployments, Windows Server 2016 AD FS handles device registration. Sign-in the federation server with _Enterprise Admin_ equivalent credentials. + 1. Start **Server Manager**. Click **Local Server** in the navigation pane. 2. Click **Manage** and then click **Add Roles and Features**. 3. Click **Next** on the **Before you begin** page. @@ -106,12 +126,13 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. ## Review Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the AD FS farm uses the correct database configuration. -* Confirm the AD FS farm has an adequate number of nodes and is properly load balanced for the anticipated load. -* Confirm **all** AD FS servers in the farm have the latest updates. -* Confirm all AD FS servers have a valid server authentication certificate - * The subject of the certificate is the common name (FQDN) of the host or a wildcard name. - * The alternate name of the certificate contains a wildcard or the FQDN of the federation service + +- Confirm the AD FS farm uses the correct database configuration. +- Confirm the AD FS farm has an adequate number of nodes and is properly load balanced for the anticipated load. +- Confirm **all** AD FS servers in the farm have the latest updates. +- Confirm all AD FS servers have a valid server authentication certificate. + - The subject of the certificate is the common name (FQDN) of the host or a wildcard name. + - The alternate name of the certificate contains a wildcard or the FQDN of the federation service. ## Device Registration Service Account Prerequisite @@ -126,11 +147,15 @@ Windows Server 2012 or later domain controllers support Group Managed Service Ac GMSA uses the Microsoft Key Distribution Service that is located on Windows Server 2012 or later domain controllers. Windows uses the Microsoft Key Distribution Service to protect secrets stored and used by the GMSA. Before you can create a GMSA, you must first create a root key for the service. You can skip this if your environment already uses GMSA. +>[!NOTE] +> If the [default object creation quota for security principles](https://docs.microsoft.com/openspecs/windows_protocols/ms-adts/d55ca655-109b-4175-902a-3e9d60833012) is set, you will need to change it for the Group Managed Service Account in order to be able to register new devices. + #### Create KDS Root Key Sign-in a domain controller with _Enterprise Admin_ equivalent credentials. + 1. Start an elevated Windows PowerShell console. -2. Type `Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)` +2. Type `Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)`. ### Windows Server 2008 or 2008 R2 Domain Controllers @@ -139,6 +164,7 @@ Windows Server 2008 and 2008 R2 domain controllers do not host the Microsoft Key #### Create an AD FS Service Account Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. + 1. Open **Active Directory Users and Computers**. 2. Right-click the **Users** container, Click **New**. Click **User**. 3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. @@ -191,7 +217,6 @@ Sign-in the federation server with _domain administrator_ equivalent credentials 12. When the process completes, click **Close**. 13. Do not restart the AD FS server. You will do this later. - ### Add the AD FS Service account to the KeyCredential Admin group and the Windows Hello for Business Users group > [!NOTE] @@ -200,6 +225,7 @@ Sign-in the federation server with _domain administrator_ equivalent credentials The **KeyCredential Administrators** global group provides the AD FS service with the permissions needed to perform key registration. The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user. Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. + 1. Open **Active Directory Users and Computers**. 2. Click the **Users** container in the navigation pane. 3. Right-click **KeyCredential Admins** in the details pane and click **Properties**. @@ -216,9 +242,10 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva Key Registration stores the Windows Hello for Business public key in Active Directory. With on-premises deployments, the Windows Server 2016 AD FS server registers the public key with the on-premises Active Directory. -The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. +The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. + 1. Open **Active Directory Users and Computers**. 2. Right-click your domain name from the navigation pane and click **Properties**. 3. Click **Security** (if the Security tab is missing, turn on Advanced Features from the View menu). @@ -227,11 +254,12 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 6. In the **Applies to** list box, select **Descendant User objects**. 7. Using the scroll bar, scroll to the bottom of the page and click **Clear all**. 8. In the **Properties** section, select **Read msDS-KeyCredentialLink** and **Write msDS-KeyCrendentialLink**. -9. Click **OK** three times to complete the task. +9. Click **OK** three times to complete the task. ## Configure the Device Registration Service Sign-in the federation server with _Enterprise Admin_ equivalent credentials. These instructions assume you are configuring the first federation server in a federation server farm. + 1. Open the **AD FS management** console. 2. In the navigation pane, expand **Service**. Click **Device Registration**. 3. In the details pane, click **Configure Device Registration**. @@ -240,12 +268,12 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. Th ## Review Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm you followed the correct procedures based on the domain controllers used in your deployment +* Confirm you followed the correct procedures based on the domain controllers used in your deployment. * Windows Server 2012 or Windows Server 2012 R2 * Windows Server 2008 or Windows Server 2008 R2 * Confirm you have the correct service account based on your domain controller version. * Confirm you properly installed the AD FS role on your Windows Server 2016 based on the proper sizing of your federation, the number of relying parties, and database needs. -* Confirm you used a certificate with the correct names as the server authentication certificate +* Confirm you used a certificate with the correct names as the server authentication certificate. * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: * Certificate serial number * Certificate thumbprint @@ -272,6 +300,7 @@ The registration authority template you configure depends on the AD FS service c >Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business. #### Windows 2012 or later domain controllers + Sign-in a certificate authority or management workstations with _domain administrator_ equivalent credentials. 1. Open the **Certificate Authority Management** console. @@ -281,8 +310,8 @@ Sign-in a certificate authority or management workstations with _domain administ 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. 6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. ->[!NOTE] -> The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. + > [!NOTE] + > The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. @@ -294,6 +323,7 @@ Sign-in a certificate authority or management workstations with _domain administ #### Windows 2008 or 2008R2 domain controllers Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. + 1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. 3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent** template in the details pane and click **Duplicate Template**. @@ -302,7 +332,7 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. -9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. 10. Close the console. ### Configure the Windows Hello for Business Authentication Certificate template @@ -310,28 +340,31 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e During Windows Hello for Business provisioning, the Windows 10, version 1703 client requests an authentication certificate from the Active Directory Federation Service, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring. Sign-in a certificate authority or management workstations with _domain administrator equivalent_ credentials. + 1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. 3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. - **Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the deployment. +5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. + > [!NOTE] + > If you use different template names, you’ll need to remember and substitute these names in different portions of the deployment. 6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. -8. On the **Issuance Requirements** tab, select the T**his number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. +8. On the **Issuance Requirements** tab, select the T**his number of authorized signatures** check box. Type **1** in the text box. + Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. 9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. 10. On the **Request Handling** tab, select the **Renew with same key** check box. 11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. -12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. 13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. 14. Click on the **Apply** to save changes and close the console. #### Mark the template as the Windows Hello Sign-in template Sign-in to an **AD FS Windows Server 2016** computer with _enterprise administrator_ equivalent credentials. + 1. Open an elevated command prompt. -2. Run `certutil –dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY` +2. Run `certutil –dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY`. >[!NOTE] >If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It’s important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. @@ -339,20 +372,21 @@ Sign-in to an **AD FS Windows Server 2016** computer with _enterprise administra ### Publish Enrollment Agent and Windows Hello For Business Authentication templates to the Certificate Authority Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. + 1. Open the **Certificate Authority** management console. 2. Expand the parent node from the navigation pane. 3. Click **Certificate Templates** in the navigation pane. 4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template to issue**. 5. In the **Enable Certificates Templates** window, select the **WHFB Enrollment Agent** template you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. Publish the **WHFB Authentication** certificate template using step 5. +6. Publish the **WHFB Authentication** certificate template using step 5. 7. Close the console. ### Configure the Registration Authority -Sign-in the AD FS server with domain administrator equivalent credentials. +Sign-in the AD FS server with domain administrator equivalent credentials. 1. Open a **Windows PowerShell** prompt. -2. Type the following command +2. Type the following command ```PowerShell Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication @@ -367,15 +401,16 @@ Active Directory Federation Server used for Windows Hello for Business certifica Approximately 60 days prior to enrollment agent certificate’s expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew, and the certificate expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate. ### Service Connection Point (SCP) in Active Directory for ADFS Device Registration Service + > [!NOTE] -> Normally this script is not needed, as enabling Device Registration via the ADFS Management console already creates the objects. You can validate the SCP using the script below. For detailed information about the Device Registration Service, see [Configuring Device Registration](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn614658(v=ws.11)?redirectedfrom=MSDN) +> Normally this script is not needed, as enabling Device Registration via the ADFS Management console already creates the objects. You can validate the SCP using the script below. For detailed information about the Device Registration Service, see [Configuring Device Registration](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn614658(v=ws.11)?redirectedfrom=MSDN). Now you will add the Service connection Point to ADFS device registration Service for your Active directory by running the following script: > [!TIP] > Make sure to change the $enrollmentService and $configNC variables before running the script. -```Powershell +```powershell # Replace this with your Device Registration Service endpoint $enrollmentService = "enterpriseregistration.contoso.com" # Replace this with your Active Directory configuration naming context @@ -403,7 +438,7 @@ Each server you add to the AD FS farm must have a proper server authentication c ### Install Additional Servers -Adding federation servers to the existing AD FS farm begins with ensuring the server are fully patched, to include Windows Server 2016 Update needed to support Windows Hello for Business deployments (https://aka.ms/whfbadfs1703). Next, install the Active Directory Federation Service role on the additional servers and then configure the server as an additional server in an existing farm. +Adding federation servers to the existing AD FS farm begins with ensuring the server are fully patched, to include Windows Server 2016 Update needed to support Windows Hello for Business deployments (https://aka.ms/whfbadfs1703). Next, install the Active Directory Federation Service role on the additional servers and then configure the server as an additional server in an existing farm. ## Load Balance AD FS Federation Servers @@ -412,6 +447,7 @@ Many environments load balance using hardware devices. Environments without har ### Install Network Load Balancing Feature on AD FS Servers Sign-in the federation server with _Enterprise Admin_ equivalent credentials. + 1. Start **Server Manager**. Click **Local Server** in the navigation pane. 2. Click **Manage** and then click **Add Roles and Features**. 3. Click **Next** On the **Before you begin** page. @@ -419,55 +455,58 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. 5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. 6. On the **Select server roles** page, click **Next**. 7. Select **Network Load Balancing** on the **Select features** page. -8. Click **Install** to start the feature installation - ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) +8. Click **Install** to start the feature installation. + ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) ### Configure Network Load Balancing for AD FS Before you can load balance all the nodes in the AD FS farm, you must first create a new load balance cluster. Once you have created the cluster, then you can add new nodes to that cluster. Sign-in a node of the federation farm with _Admin_ equivalent credentials. -1. Open **Network Load Balancing Manager** from **Administrative Tools**. + +1. Open **Network Load Balancing Manager** from **Administrative Tools**. ![NLB Manager user interface](images/hello-nlb-manager.png) 2. Right-click **Network Load Balancing Clusters**, and then click **New Cluster**. -3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. +3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. ![NLB Manager - Connect to new Cluster screen](images/hello-nlb-connect.png) 4. Select the interface that you want to use with the cluster, and then click **Next**. (The interface hosts the virtual IP address and receives the client traffic to load balance.) 5. In **Host Parameters**, select a value in **Priority (Unique host identifier)**. This parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. Click **Next**. -6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. +6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. ![NLB Manager - Add IP to New Cluster screen](images/hello-nlb-add-ip.png) -7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. +7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. ![NLB Manager - Cluster IP Configuration screen](images/hello-nlb-cluster-ip-config.png) 8. In **Cluster operation mode**, click **Unicast** to specify that a unicast media access control (MAC) address should be used for cluster operations. In unicast mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. We recommend that you accept the unicast default settings. Click **Next**. -9. In Port Rules, click Edit to modify the default port rules to use port 443. +9. In Port Rules, click Edit to modify the default port rules to use port 443. ![NLB Manager - Add\Edit Port Rule screen](images/hello-nlb-cluster-port-rule.png) ### Additional AD FS Servers 1. To add more hosts to the cluster, right-click the new cluster, and then click **Add Host to Cluster**. -2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. +2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. ![NLB Manager - Cluster with nodes](images/hello-nlb-cluster.png) ## Configure DNS for Device Registration Sign-in the domain controller or administrative workstation with domain administrator equivalent credentials. You’ll need the Federation service name to complete this task. You can view the federation service name by clicking **Edit Federation Service Properties** from the **Action** pan of the **AD FS** management console, or by using `(Get-AdfsProperties).Hostname.` (PowerShell) on the AD FS server. + 1. Open the **DNS Management** console. 2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. 3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. 4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. -5. In the **name** box, type the name of the federation service. In the **IP address** box, type the IP address of your federation server. Click **Add Host**. -6. Close the DNS Management console +5. In the **name** box, type the name of the federation service. In the **IP address** box, type the IP address of your federation server. Click **Add Host**. +6. Close the DNS Management console. ## Configure the Intranet Zone to include the federation service -The Windows Hello provisioning presents web pages from the federation service. Configuring the intranet zone to include the federation service enables the user to authenticate to the federation service using integrated authentication. Without this setting, the connection to the federation service during Windows Hello provisioning prompts the user for authentication. +The Windows Hello provisioning presents web pages from the federation service. Configuring the intranet zone to include the federation service enables the user to authenticate to the federation service using integrated authentication. Without this setting, the connection to the federation service during Windows Hello provisioning prompts the user for authentication. ### Create an Intranet Zone Group Policy -Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials -1. Start the **Group Policy Management Console** (gpmc.msc) +Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials: + +1. Start the **Group Policy Management Console** (gpmc.msc). 2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** +3. Right-click **Group Policy object** and select **New**. 4. Type **Intranet Zone Settings** in the name box and click **OK**. 5. In the content pane, right-click the **Intranet Zone Settings** Group Policy object and click **Edit**. 6. In the navigation pane, expand **Policies** under **Computer Configuration**. @@ -477,7 +516,7 @@ Sign-in the domain controller or administrative workstation with _Domain Admin_ ### Deploy the Intranet Zone Group Policy object -1. Start the **Group Policy Management Console** (gpmc.msc) +1. Start the **Group Policy Management Console** (gpmc.msc). 2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** 3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. @@ -489,8 +528,8 @@ Before you continue with the deployment, validate your deployment progress by re * Consider using an HSM to protect the enrollment agent certificate; however, understand the frequency and quantity of signature operations the enrollment agent server makes and understand the impact it has on overall performance. * Confirm you properly configured the Windows Hello for Business authentication certificate template—to include: * Issuance requirements of an authorized signature from a certificate request agent. - * The certificate template was properly marked as a Windows Hello for Business certificate template using certutil.exe - * The Windows Hello for Business Users group, or equivalent has the allow enroll permissions + * The certificate template was properly marked as a Windows Hello for Business certificate template using certutil.exe. + * The Windows Hello for Business Users group, or equivalent has the allow enroll permissions. * Confirm all certificate templates were properly published to the appropriate issuing certificate authorities. * Confirm the AD FS service account has the allow enroll permission for the Windows Hello Business authentication certificate template. * Confirm the AD FS certificate registration authority is properly configured using the `Get-AdfsCertificateAuthority` Windows PowerShell cmdlet. @@ -510,7 +549,7 @@ You need to verify the AD FS service has properly enrolled for an enrollment age ### Event Logs -Use the event logs on the AD FS service to confirm the service account enrolled for an enrollment agent certificate. First, look for the AD FS event ID 443 that confirms certificate enrollment cycle has finished. Once confirmed the AD FS certificate enrollment cycle completed review the CertificateLifecycle-User event log. In this event log, look for event ID 1006, which indicates a new certificate was installed. Details of the event log should show +Use the event logs on the AD FS service to confirm the service account enrolled for an enrollment agent certificate. First, look for the AD FS event ID 443 that confirms certificate enrollment cycle has finished. Once confirmed the AD FS certificate enrollment cycle completed review the CertificateLifecycle-User event log. In this event log, look for event ID 1006, which indicates a new certificate was installed. Details of the event log should show: * The account name under which the certificate was enrolled. * The action, which should read enroll. @@ -531,8 +570,8 @@ Each file in this folder represents a certificate in the service account’s Per For detailed information about the certificate, use `Certutil -q -v ` . - ## Follow the Windows Hello for Business on premises certificate trust deployment guide + 1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. Prepare and Deploy Windows Server 2016 Active Directory Federation Services (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index f3b86a3536..0686de8a9a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -24,9 +24,9 @@ ms.reviewer: - Certificate trust -The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 schema. If you already have a Windows Server 2016 domain controller in your forest, you can skip the **Updating the Schema** and **Create the KeyCredential Admins Security Global Group** steps. +The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 or later domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 or later schema. If you already have a Windows Server 2016 or later domain controller in your forest, you can skip the **Updating the Schema** and **Create the KeyCredential Admins Security Global Group** steps. -Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. +Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 or later DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. ## Discovering schema role @@ -44,11 +44,12 @@ Windows Hello for Business uses asymmetric keys as user credentials (rather than Sign-in to the domain controller hosting the schema master operational role using enterprise administrator equivalent credentials. -1. Open an elevated command prompt. -2. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO. -3. To update the schema, type ```adprep /forestprep```. -4. Read the Adprep Warning. Type the letter **C** and press **Enter** to update the schema. -5. Close the Command Prompt and sign-out. +1. Mount the ISO file (or insert the DVD) containing the Windows Server 2016 or later installation media. +2. Open an elevated command prompt. +3. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO. +4. To update the schema, type ```adprep /forestprep```. +5. Read the Adprep Warning. Type the letter **C** and press **Enter** to update the schema. +6. Close the Command Prompt and sign-out. ## Create the KeyCredential Admins Security Global Group diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 067d2d3504..3fc4c88711 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -150,7 +150,7 @@ Domain controllers automatically request a certificate from the domain controlle 7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. 8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. 9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +10. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box. 11. Select the **Update certificates that use certificate templates** check box. 12. Click **OK**. Close the **Group Policy Management Editor**. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index 7189408b7b..95b07dfe0d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -1,6 +1,6 @@ --- -title: Windows Hello for Business Deployment Guide -description: A guide to Windows Hello for Business deployment +title: Windows Hello for Business Deployment Overview +description: Use this deployment guide to successfully deploy Windows Hello for Business in an existing environment. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -13,28 +13,35 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 08/29/2018 +ms.date: 01/21/2021 ms.reviewer: --- -# Windows Hello for Business Deployment Guide +# Windows Hello for Business Deployment Overview **Applies to** -- Windows 10, version 1703 or later + +- Windows 10, version 1703 or later Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on an asymmetric key pair. -This deployment guide is to guide you through deploying Windows Hello for Business, based on the planning decisions made using the Planning a Windows Hello for Business Deployment Guide. It provides you with the information needed to successfully deploy Windows Hello for Business in an existing environment. +This deployment overview is to guide you through deploying Windows Hello for Business. Your first step should be to use the Passwordless Wizard in the [Microsoft 365 admin center](https://admin.microsoft.com/AdminPortal/Home#/modernonboarding/passwordlesssetup) or the [Planning a Windows Hello for Business Deployment](hello-planning-guide.md) guide to determine the right deployment model for your organization. + +Once you've chosen a deployment model, the deployment guide for the that model will provide you with the information needed to successfully deploy Windows Hello for Business in your environment. + +> [!NOTE] +> Read the [Windows Hello for Business Deployment Prerequisite Overview](hello-identity-verification.md) for a summary of the prerequisites for each different Windows Hello for Business deployment model. ## Assumptions -This guide assumes that baseline infrastructure exists which meets the requirements for your deployment. For either hybrid or on-premises deployments, it is expected that you have: -* A well-connected, working network -* Internet access -* Multifactor Authentication Server to support MFA during Windows Hello for Business provisioning -* Proper name resolution, both internal and external names -* Active Directory and an adequate number of domain controllers per site to support authentication -* Active Directory Certificate Services 2012 or later -* One or more workstation computers running Windows 10, version 1703 +This guide assumes that baseline infrastructure exists which meets the requirements for your deployment. For either hybrid or on-premises deployments, it is expected that you have: + +- A well-connected, working network +- Internet access +- Multi-factor Authentication Server to support MFA during Windows Hello for Business provisioning +- Proper name resolution, both internal and external names +- Active Directory and an adequate number of domain controllers per site to support authentication +- Active Directory Certificate Services 2012 or later +- One or more workstation computers running Windows 10, version 1703 If you are installing a server role for the first time, ensure the appropriate server operating system is installed, updated with the latest patches, and joined to the domain. This document provides guidance to install and configure the specific roles on that server. @@ -46,15 +53,17 @@ Windows Hello for Business has three deployment models: Cloud, hybrid, and on-pr Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest. -The trust model determines how you want users to authenticate to the on-premises Active Directory: -* The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and have an adequate number of 2016 domain controllers in each site to support authentication. -* The certificate-trust model is for enterprise that *do* want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. -* The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers. +The trust model determines how you want users to authenticate to the on-premises Active Directory: + +- The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and have an adequate number of 2016 domain controllers in each site to support authentication. +- The certificate-trust model is for enterprise that *do* want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. +- The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers. > [!NOTE] -> Remote Desktop Protocol (RDP) does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. See [Remote Desktop](hello-feature-remote-desktop.md) to learn more. +> RDP does not support authentication with Windows Hello for Business key trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). Following are the various deployment guides and models included in this topic: + - [Hybrid Azure AD Joined Key Trust Deployment](hello-hybrid-key-trust.md) - [Hybrid Azure AD Joined Certificate Trust Deployment](hello-hybrid-cert-trust.md) - [Azure AD Join Single Sign-on Deployment Guides](hello-hybrid-aadj-sso.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md new file mode 100644 index 0000000000..2c22e05685 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-issues.md @@ -0,0 +1,187 @@ +--- +title: Windows Hello for Business Deployment Known Issues +description: A Troubleshooting Guide for Known Windows Hello for Business Deployment Issues +keywords: identity, PIN, biometric, Hello, passport +params: siblings_only +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 01/14/2021 +ms.reviewer: +--- +# Windows Hello for Business Known Deployment Issues + +The content of this article is to help troubleshoot and workaround known deployment issues for Windows Hello for Business. Each issue below will describe the applicable deployment type Windows versions. + +## Hybrid Key Trust Logon Broken Due to User Public Key Deletion + +Applies to: + +- Hybrid key trust deployments +- Windows Server 2016, builds 14393.3930 to 14393.4048 +- Windows Server 2019, builds 17763.1457 to 17763.1613 + +In Hybrid key trust deployments with domain controllers running certain builds of Windows Server 2016 and Windows Server 2019, the user's Windows Hello for Business key is deleted after they sign-in. Subsequent sign-ins will fail until the user's key is synced during the next Azure AD Connect delta sync cycle. + +### Identifying User Public Key Deletion Issue + +After the user provisions a Windows Hello for Business credential in a hybrid key trust environment, the key must sync from Azure AD to AD during an Azure AD Connect sync cycle. The user's public key will be written to the msDS-KeyCredentialLink attribute of the user object. + +Before the user's Windows Hello for Business key is synced, sign-in's with Windows Hello for Business will fail with the error message, *"That option is temporarily unavailable. For now, please use a different method to sign in."* After the sync is successful, the user should be able to login and unlock with their PIN or enrolled biometrics. + +In environments impacted with this issue, after the first sign-in with Windows Hello for Business after provisioning is completed, the next sign-in attempt will fail. In environments where domain controllers are running a mix of builds, only some may be impacted by this issue and subsequent logon attempts may be sent different domain controllers. This may result in the sign-in failures appearing to be intermittent. + +After the initial logon attempt, the user's Windows Hello for Business public key is being deleted from the msDS-KeyCredentialLink attribute. This can be verified by querying a user's msDS-KeyCredentialLink attribute before and after sign-in. The msDS-KeyCredentialLink can be queried in AD using [Get-ADUser](https://docs.microsoft.com/powershell/module/addsadministration/get-aduser) and specifying *msds-keycredentiallink* for the *-Properties* parameter. + +### Resolving User Public Key Deletion Issue + +To resolve this behavior, upgrade Windows Server 2016 and 2019 domain controllers to with the latest patches. For Windows Server 2016, this behavior is fixed in build 14393.4104 ([KB4593226](https://support.microsoft.com/help/4593226)) and later. For Windows Server 2019, this behavior is fixed in build 17763.1637 ([KB4592440](https://support.microsoft.com/help/4592440)). + +## Azure AD Joined Device Access to On-Premises Resources Using Key Trust and Third-Party Certificate Authority (CA) + +Applies to: + +- Azure AD joined key trust deployments +- Third-party certificate authority (CA) issuing domain controller certificates + +Windows Hello for Business uses smart card based authentication for many operations. Smart card has special guidelines when using a third-party CA for certificate issuance, some of which apply to the domain controllers. Not all Windows Hello for Business deployment types require these configurations. Accessing on-premises resources from an Azure AD Joined device does require special configuration when using a third-party CA to issue domain controller certificates. + +For more information, read [Guidelines for enabling smart card logon with third-party certification authorities]( +https://support.microsoft.com/topic/a34a400a-51d5-f2a1-c8c0-7a6c9c49cb78). + +### Identifying On-premises Resource Access Issues with Third-Party CAs + +This issue can be identified using network traces or Kerberos logging from the client. In the network trace, the client will fail to place a TGS_REQ request when a user attempts to access a resource. On the client, this can be observed in the Kerberos operation event log under **Application and Services/Microsoft/Windows/Security-Kerberos/Operational**. These logs are default disabled. The failure event for this case will include the following information: + + Log Name: Microsoft-Windows-Kerberos/Operational + Source: Microsoft-Windows-Security-Kerberos + Event ID: 107 + GUID: {98e6cfcb-ee0a-41e0-a57b-622d4e1b30b1} + Task Category: None + Level: Error + Keywords: + User: SYSTEM + Description: + + The Kerberos client received a KDC certificate that does not have a matched domain name. + + Expected Domain Name: ad.contoso.com + Error Code: 0xC000006D + +### Resolving On-premises Resource Access Issue with Third-Party CAs + +To resolve this issue, domain controller certificates need to be updated so the certificate subject contains directory path of the server object (distinguished name). +Example Subject: CN=DC1 OU=Domain Controller, DC=ad, DC=contoso, DC=com + +Alternatively, you can set the subject alternative name (SAN) of the domain controller certificate to contain the server object's fully qualified domain name and the NETBIOS name of the domain. +Example Subject Alternative Name: +dns=dc1.ad.contoso.com +dns=ad.contoso.com +dns=ad + +## Key Trust Authentication Broken for Windows Server 2019 + +Applies to: + +- Windows Server 2019 +- Hybrid key trust deployments +- On-premises key trust deployments + +Domain controllers running early versions of Windows Server 2019 have an issue that prevents key trust authentication from working properly. Networks traces report KDC_ERR_CLIENT_NAME_MISMATCH. + +### Identifying Server 2019 Key Trust Authentication Issue + +On the client, authentication with Windows Hello for Business will fail with the error message, *"That option is temporarily unavailable. For now, please use a different method to sign in."* + +This error is usually presented on hybrid Azure AD joined devices in key trust deployments after Windows Hello for Business has been provisioned but before a user's key has synced from Azure AD to AD. If a user's key has been synced from Azure AD and the msDS-keycredentiallink attribute on the user object in AD has been populated for NGC, then it is possible that this error case is occurring. + +The other indicator of this failure case can be identified using network traces. If network traces are captured for a key trust sign-in event, the traces will show kerberos failing with the error KDC_ERR_CLIENT_NAME_MISMATCH. + +### Resolving Server 2019 Key Trust Authentication Issue + +This issue was fixed in Windows Server 2019, build 17763.316 ([KB4487044](https://support.microsoft.com/help/4487044/windows-10-update-kb4487044)). Upgrade all Windows Server 2019 domain controllers to Windows Server 2019, build 17763.316 or newer to resolve this behavior. + +## Certificate Trust Provisioning with AD FS Broken on Windows Server 2019 + +Applies to: + +- Windows Server 2019 +- Hybrid certificate trust deployments +- On-premises certificate trust deployments + +AD FS running on Windows Server 2019 fails to complete device authentication properly due to an invalid check of incoming scopes in the request. Device authentication to AD FS is a requirement for Windows Hello for Business to enroll a certificate using AD FS. The client will block Windows Hello for Business provisioning until this authentication is successful. + +### Identifying Certificate Trust with AD FS 2019 Enrollment Issue + +The provisioning experience for Windows Hello for Business will launch if a set of prerequisite checks done by the client are successful. The result of the provisioningAdmin checks is available in event logs under Microsoft-Windows-User Device Registration. If provisioning is blocked because device authentication has not successfully occurred, there will be an event ID 362 in the logs that states that *User has successfully authenticated to the enterprise STS: No*. + + Log Name: Microsoft-Windows-User Device Registration/Admin + Source: Microsoft-Windows-User Device Registration + Date: + Event ID: 362 + Task Category: None + Level: Warning + Keywords: + User: + Computer: + Description: + Windows Hello for Business provisioning will not be launched. + Device is AAD joined ( AADJ or DJ++ ): Yes + User has logged on with AAD credentials: Yes + Windows Hello for Business policy is enabled: Yes + Windows Hello for Business post-logon provisioning is enabled: Yes + Local computer meets Windows hello for business hardware requirements: Yes + User is not connected to the machine via Remote Desktop: Yes + User certificate for on premise auth policy is enabled: Yes + Enterprise user logon certificate enrollment endpoint is ready: Not Tested + Enterprise user logon certificate template is : No ( 1 : StateNoPolicy ) + User has successfully authenticated to the enterprise STS: No + Certificate enrollment method: enrollment authority + See https://go.microsoft.com/fwlink/?linkid=832647 for more details. + +If a device has recently been joined to a domain, then there may be a delay before the device authentication occurs. If the failing state of this prerequisite check persists, then it can indicate an issue with the AD FS configuration. + +If this AD FS scope issue is present, event logs on the AD FS server will indicate an authentication failure from the client. This error will be logged in event logs under AD FS/Admin as event ID 1021 and the event will specify that the client is forbidden access to resource 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' with scope 'ugs': + + Log Name: AD FS/Admin + Source: AD FS + Date: + Event ID: 1021 + Task Category: None + Level: Error + Keywords: AD FS + User: + Computer: + Description: + Encountered error during OAuth token request. + Additional Data + Exception details: + Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthUnauthorizedClientException: MSIS9368: Received invalid OAuth request. The client '38aa3b87-a06d-4817-b275-7a316988d93b' is forbidden to access the resource 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' with scope 'ugs'. + at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthProtocolContext.ValidateScopes(String scopeParameter, String clientId, String relyingPartyId) + at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthJWTBearerRequestContext.ValidateCore() + +### Resolving Certificate Trust with AD FS 2019 Enrollment Issue + +This issue is fixed in Windows Server, version 1903 and later. For Windows Server 2019, this issue can be remediated by adding the ugs scope manually. + +1. Launch AD FS management console. Browse to "Services > Scope Descriptions". +2. Right click "Scope Descriptions" and select "Add Scope Description". +3. Under name type "ugs" and Click Apply > OK. +4. Launch PowerShell as an administrator. +5. Get the ObjectIdentifier of the application permission with the ClientRoleIdentifier parameter equal to "38aa3b87-a06d-4817-b275-7a316988d93b": + +``` PowerShell +(Get-AdfsApplicationPermission -ServerRoleIdentifiers 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' | ?{ $_.ClientRoleIdentifier -eq '38aa3b87-a06d-4817-b275-7a316988d93b' }).ObjectIdentifier +``` + +6. Execute the command `Set-AdfsApplicationPermission -TargetIdentifier -AddScope 'ugs'`. +7. Restart the AD FS service. +8. On the client: Restart the client. User should be prompted to provision Windows Hello for Business. diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 300a074c68..b7bc415c06 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -68,7 +68,7 @@ If the error occurs again, check the error code against the following table to s | 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed.

            -or-

            Token was not found in the Authorization header.

            -or-

            Failed to read one or more objects.

            -or-

            The request sent to the server was invalid. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin. | 0x801C03EE | Attestation failed. | Sign out and then sign in again. | | 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | -| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). +| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in AAD and the Primary SMTP address are the same in the proxy address. | 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. | | | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. | | 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. | @@ -98,6 +98,7 @@ For errors listed in this table, contact Microsoft Support for assistance. | 0x801C03F0 | ​There is no key registered for the user. | | 0x801C03F1 | ​There is no UPN in the token. | | ​0x801C044C | There is no core window for the current thread. | +| 0x801c004D | DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to find the default WAM account to use to request AAD token for provisioning. Unable to enroll a device to use a PIN for login. | ## Related topics diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md deleted file mode 100644 index fca4b7eaa6..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ /dev/null @@ -1,172 +0,0 @@ ---- -title: Windows Hello for Business Frequently Asked Questions -description: Windows Hello for Business FAQ -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Windows Hello for Business Frequently Asked Questions - -**Applies to** -- Windows 10 - -## What about virtual smart cards? -Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends new Windows 10 deployments to use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. - -## What about convenience PIN? -Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. - -## Can I use Windows Hello for Business key trust and RDP? -RDP currently does not support key based authentication and does not support self signed certificates. RDP with Windows Hello for Business is currently only supported with certificate based deployments. - -## Can I deploy Windows Hello for Business using Microsoft Endpoint Configuration Manager? -Windows Hello for Business deployments using Configuration Manager should use the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-hello-for-business-settings). - -## How many users can enroll for Windows Hello for Business on a single Windows 10 computer? -The maximum number of supported enrollments on a single Windows 10 computer is 10. That enables 10 users to each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. - -## How can a PIN be more secure than a password? -When using Windows Hello for Business, the PIN is not a symmetric key where is the password is a symmetric key. With passwords, there is a server that has some representation of the password. With Windows Hello for Business, the PIN is user provided entropy used to load the private key in the TPM. The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM protected key, and the TPM that generated that key to successfully have access to the private key. - -The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It is about the difference of providing entropy vs continuing the use of a symmetric key (the password). The TPM has anti-hammering features which thwart brute-force PIN attacks (an attackers continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increased the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. - -## Why is the Key Admins group missing, I have Windows Server 2016 domain controller(s)? -The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. - -## Can I use a convenience PIN with Azure AD? -It is currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises Domain Joined users and local account users. - -## Can I use an external camera when my laptop is closed or docked? -No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. - -## Why does authentication fail immediately after provisioning Hybrid Key Trust? -In a hybrid deployment, a user's public key must sync from Azure AD to AD before it can be used to authenticate against a domain controller. This sync is handled by Azure AD Connect and will occur during a normal sync cycle. - -## What is the password-less strategy? -Watch Principal Program Manager Karanbir Singh's Ignite 2017 presentation **Microsoft's guide for going password-less**. - -[Microsoft's password-less strategy](hello-videos.md#microsofts-passwordless-strategy) - -## What is the user experience for Windows Hello for Business? -The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. - -[Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) - -## What happens when my user forgets their PIN? -If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. - -[Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) - -For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. - -## What URLs do I need to allow for a hybrid deployment? -Communicating with Azure Active Directory uses the following URLs: -- enterpriseregistration.windows.net -- login.microsoftonline.com -- login.windows.net - -If your environment uses Microsoft Intune, you need these additional URLs: -- enrollment.manage-beta.microsoft.com -- enrollment.manage.microsoft.com -- portal.manage-beta.microsoft.com -- portal.manage.microsoft.com - -## What is the difference between non-destructive and destructive PIN reset? -Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provided a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user does not delete the current credential and obtain a new one. Read [PIN Reset](hello-feature-pin-reset.md) page for more information. - -Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. with destructive PIN reset, users that have forgotten their PIN can authenticate using their password, perform a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. - -## Which is better or more secure: Key trust or Certificate trust? -The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are: -- Required domain controllers -- Issuing end entity certificates - -The **key trust** model authenticates to Active Directory using a raw key. Windows Server 2016 domain controllers enables this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you do not need to issue certificates to your end users (domain controller certificates are still needed). - -The **certificate trust** model authenticates to Active Directory using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to your end users, but you do not need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM protected private key to request a certificate from your enterprise's issuing certificate authority. - -## Do I need Windows Server 2016 domain controllers? -There are many deployment options from which to choose. Some of those options require an adequate number of Windows Server 2016 domain controllers in the site where you have deployed Windows Hello for Business. There are other deployment options that use existing Windows Server 2008 R2 or later domain controllers. Choose the deployment option that best suits your environment. - -## What attributes are synchronized by Azure AD Connect with Windows Hello for Business? -Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that are sync based on scenarios. The base scenarios that include Windows Hello for Business are [Windows 10](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes. - -## Is Windows Hello for Business multifactor authentication? -Windows Hello for Business is two-factor authentication based on the observed authentication factors of: something you have, something you know, and something part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". - -## What are the biometric requirements for Windows Hello for Business? -Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. - -## Can I use both a PIN and biometrics to unlock my device? -Starting in Windows 10, version 1709, you can use multi-factor unlock to require the user to provide an additional factor to unlock the device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. Read more about [multifactor unlock](feature-multifactor-unlock.md). - -## What is the difference between Windows Hello and Windows Hello for Business? -Windows Hello represents the biometric framework provided in Windows 10. Windows Hello enables users to use biometrics to sign into their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. - -## Why can't I enroll biometrics for my local built-in Administrator? -Windows 10 does not allow the local administrator to enroll biometric gestures (face or fingerprint). - -## I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? -No. If your organization is federated or using on-line services, such as Azure AD Connect, Office 365, or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organization who need more time before moving to the cloud and exclusively use Active Directory. - -## Does Windows Hello for Business prevent the use of simple PINs? -Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). -So, for example: -* The PIN 1111 has a constant delta of (0,0,0), so it is not allowed -* The PIN 1234 has a constant delta of (1,1,1), so it is not allowed -* The PIN 1357 has a constant delta of (2,2,2), so it is not allowed -* The PIN 9630 has a constant delta of (7,7,7), so it is not allowed -* The PIN 1593 has a constant delta of (4,4,4), so it is not allowed -* The PIN 7036 has a constant delta of (3,3,3), so it is not allowed -* The PIN 1231 does not have a constant delta (1,1,8), so it is allowed -* The PIN 1872 does not have a constant delta (7,9,5), so it is allowed - -This prevents repeating numbers, sequential numbers, and simple patterns. -It always results in a list of 100 disallowed PINs (independent of the PIN length). -This algorithm does not apply to alphanumeric PINs. - -## How does PIN caching work with Windows Hello for Business? - -Windows Hello for Business provides a PIN caching user experience using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting as long as the user is interactively signed-in. Microsoft Account sign-in keys are considered transactional keys, which means the user is always prompted when accessing the key. - -Beginning with Windows 10, version 1709, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations will not prompt the user for the PIN. - -The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process does not receive the PIN, but rather the ticket that grants them private key operations. Windows 10 does not provide any Group Policy settings to adjust this caching. - -## Can I disable the PIN while using Windows Hello for Business? -No. The movement away from passwords is accomplished by gradually reducing the use of the password. In the occurrence where you cannot authenticate with biometrics, you need a fall back mechanism that is not a password. The PIN is the fall back mechanism. Disabling or hiding the PIN credential provider disabled the use of biometrics. - -## How are keys protected? -Wherever possible, Windows Hello for Business takes advantage of trusted platform module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business does not require a TPM. Administrators can choose to allow key operations in software. - -Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to re-authenticate to the IDP before the IDP allows him or her to re-register). - -## Can Windows Hello for Business work in air-gapped environments? -Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require Internet connectivity to achieve an air-gapped Windows Hello for Business deployment. - -## Can I use third-party authentication providers with Windows Hello for Business? -Yes, if you are federated hybrid deployment, you can use any third-party that provides an Active Directory Federation Services (AD FS) multi-factor authentication adapter. A list of third-party MFA adapters can be found [here](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods). - -## Does Windows Hello for Business work with third party federation servers? -Windows Hello for Business can work with any third-party federation servers that support the protocols used during provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). - -| Protocol | Description | -| :---: | :--- | -| [[MS-KPP]: Key Provisioning Protocol](https://msdn.microsoft.com/library/mt739755.aspx) | Specifies the Key Provisioning Protocol, which defines a mechanism for a client to register a set of cryptographic keys on a user and device pair. | -| [[MS-OAPX]: OAuth 2.0 Protocol Extensions](https://msdn.microsoft.com/library/dn392779.aspx)| Specifies the OAuth 2.0 Protocol Extensions, which are used to extend the OAuth 2.0 Authorization Framework. These extensions enable authorization features such as resource specification, request identifiers, and login hints. | -| [[MS-OAPXBC]: OAuth 2.0 Protocol Extensions for Broker Clients](https://msdn.microsoft.com/library/mt590278.aspx) | Specifies the OAuth 2.0 Protocol Extensions for Broker Clients, extensions to RFC6749 (The OAuth 2.0 Authorization Framework) that allow a broker client to obtain access tokens on behalf of calling clients. | -| [[MS-OIDCE]: OpenID Connect 1.0 Protocol Extensions](https://msdn.microsoft.com/library/mt766592.aspx) | Specifies the OpenID Connect 1.0 Protocol Extensions. These extensions define additional claims to carry information about the end user, including the user principal name, a locally unique identifier, a time for password expiration, and a URL for password change. These extensions also define additional provider meta-data that enable the discovery of the issuer of access tokens and give additional information about provider capabilities. | - -## Does Windows Hello for Business work with Mac and Linux clients? -Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third parties who are interested in moving these platforms away from passwords. Interested third parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml new file mode 100644 index 0000000000..ae0af27fe6 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -0,0 +1,222 @@ +### YamlMime:FAQ +metadata: + title: Windows Hello for Business Frequently Asked Questions (FAQ) + description: Use these frequently asked questions (FAQ) to learn important details about Windows Hello for Business. + keywords: identity, PIN, biometric, Hello, passport + ms.prod: w10 + ms.mktglfcycl: deploy + ms.sitesec: library + ms.pagetype: security, mobile + audience: ITPro + author: mapalko + ms.author: mapalko + manager: dansimp + ms.collection: M365-identity-device-management + ms.topic: article + localizationpriority: medium + ms.date: 01/14/2021 + ms.reviewer: + +title: Windows Hello for Business Frequently Asked Questions (FAQ) +summary: | + Applies to: Windows 10 + + +sections: + - name: Ignored + questions: + - question: What about virtual smart cards? + answer: | + Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends that new Windows 10 deployments use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. + + - question: What about convenience PIN? + answer: | + Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends that customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. + + - question: Can I use Windows Hello for Business key trust and RDP? + answer: | + Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. RDP with supplied credentials is currently only supported with certificate-based deployments. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). + + - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager? + answer: | + Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-hello-for-business-settings). + + - question: How many users can enroll for Windows Hello for Business on a single Windows 10 computer? + answer: | + The maximum number of supported enrollments on a single Windows 10 computer is 10. This lets 10 users each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. + + - question: How can a PIN be more secure than a password? + answer: | + When using Windows Hello for Business, the PIN is not a symmetric key, whereas the password is a symmetric key. With passwords, there's a server that has some representation of the password. With Windows Hello for Business, the PIN is user-provided entropy used to load the private key in the Trusted Platform Module (TPM). The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM-protected key, and the TPM that generated that key in order to successfully access the private key. + + The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It's about the difference between providing entropy versus continuing the use of a symmetric key (the password). The TPM has anti-hammering features that thwart brute-force PIN attacks (an attacker's continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increase the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. + + - question: How does Windows Hello for Business work with Azure AD registered devices? + answer: | + On Azure AD registered devices, a user will be asked to provision a Windows Hello for Business key if the feature is enabled by mobile device management policy. If the user has an existing Windows Hello container for use with their local or Microsoft connected account, the Windows Hello for Business key will be enrolled in their existing container and will be protected using their exiting gestures. + + If a user has signed into their Azure AD registered device with Windows Hello, their Windows Hello for Business key will be used to authenticate the user's work identity when they try to use Azure AD resources. The Windows Hello for Business key meets Azure AD multi-factor authentication (MFA) requirements and reduces the number of MFA prompts users will see when accessing resources. + + It is possible to Azure AD register a domain joined device. If the domain joined device has a convenience PIN, login with the convenience PIN will no longer work. This configuration is not supported by Windows Hello for Business. + + For more information please read [Azure AD registered devices](https://docs.microsoft.com/azure/active-directory/devices/concept-azure-ad-register). + + - question: I have Windows Server 2016 domain controller(s), so why is the Key Admins group missing? + answer: | + The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. + + - question: Can I use a convenience PIN with Azure Active Directory? + answer: | + It's currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts (synchronized identities included). It's only supported for on-premises Domain Joined users and local account users. + + - question: Can I use an external camera when my laptop is closed or docked? + answer: | + No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. + + - question: Why does authentication fail immediately after provisioning hybrid key trust? + answer: | + In a hybrid deployment, a user's public key must sync from Azure AD to AD before it can be used to authenticate against a domain controller. This sync is handled by Azure AD Connect and will occur during a normal sync cycle. + + - question: What is the password-less strategy? + answer: | + Watch Principal Program Manager Karanbir Singh's **Microsoft's guide for going password-less** Ignite 2017 presentation. + + [Microsoft's password-less strategy](hello-videos.md#microsofts-passwordless-strategy) + + - question: What is the user experience for Windows Hello for Business? + answer: | + The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. + + [Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) + + - question: What happens when a user forgets their PIN? + answer: | + If the user can sign-in with a password, they can reset their PIN by selecting the "I forgot my PIN" link in Settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by selecting the "I forgot my PIN" link on the PIN credential provider. + + [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) + + For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. + + - question: What URLs do I need to allow for a hybrid deployment? + answer: | + Communicating with Azure Active Directory uses the following URLs: + - enterpriseregistration.windows.net + - login.microsoftonline.com + - login.windows.net + - account.live.com + - accountalt.azureedge.net + - secure.aadcdn.microsoftonline-p.com + + If your environment uses Microsoft Intune, you need these additional URLs: + - enrollment.manage.microsoft.com + - portal.manage.microsoft.com + + - question: What's the difference between non-destructive and destructive PIN reset? + answer: | + Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once onboarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provide a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user doesn't delete the current credential and obtain a new one. For more information, see [PIN Reset](hello-feature-pin-reset.md). + + Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. With destructive PIN reset, users that have forgotten their PIN can authenticate by using their password and then performing a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. + + - question: | + Which is better or more secure: key trust or certificate trust? + answer: | + The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are: + - Required domain controllers + - Issuing end entity certificates + + The **key trust** model authenticates to Active Directory by using a raw key. Windows Server 2016 domain controllers enable this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you don't need to issue certificates to users (domain controller certificates are still needed). + + The **certificate trust** model authenticates to Active Directory by using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to users, but you don't need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM-protected private key to request a certificate from your enterprise's issuing certificate authority. + + - question: Do I need Windows Server 2016 domain controllers? + answer: | + There are many deployment options from which to choose. Some of those options require an adequate number of Windows Server 2016 domain controllers in the site where you've deployed Windows Hello for Business. There are other deployment options that use existing Windows Server 2008 R2 or later domain controllers. Choose the deployment option that best suits your environment. + + - question: What attributes are synchronized by Azure AD Connect with Windows Hello for Business? + answer: | + Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that sync based on scenarios. The base scenarios that include Windows Hello for Business are the [Windows 10](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes. + + - question: Is Windows Hello for Business multi-factor authentication? + answer: | + Windows Hello for Business is two-factor authentication based on the observed authentication factors of: something you have, something you know, and something that's part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. By using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". + + - question: What are the biometric requirements for Windows Hello for Business? + answer: | + Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. + + - question: Can I use both a PIN and biometrics to unlock my device? + answer: | + Starting in Windows 10, version 1709, you can use multi-factor unlock to require users to provide an additional factor to unlock their device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. To learn more, see [Multifactor Unlock](feature-multifactor-unlock.md). + + - question: Can I wear a mask to enroll or unlock using Windows Hello face authentication? + answer: | + Wearing a mask to enroll is a security concern because other users wearing a similar mask may be able to unlock you device. The product group is aware of this behavior and is investigating this topic further. Please remove a mask if you are wearing one when you enroll or unlock with Windows Hello face authentication. If your working environment doesn’t allow you to remove a mask temporarily, please consider unenrolling from face authentication and only using PIN or fingerprint. + + - question: What's the difference between Windows Hello and Windows Hello for Business? + answer: | + Windows Hello represents the biometric framework provided in Windows 10. Windows Hello lets users use biometrics to sign in to their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. + + - question: Why can't I enroll biometrics for my local, built-in administrator? + answer: | + Windows 10 does not allow the local administrator to enroll biometric gestures (face or fingerprint). + + - question: I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? + answer: | + No. If your organization is federated or using online services, such as Azure AD Connect, Office 365, or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organizations who need more time before moving to the cloud and exclusively use Active Directory. + + - question: Does Windows Hello for Business prevent the use of simple PINs? + answer: | + Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). + So, for example: + + - The PIN 1111 has a constant delta of (0,0,0), so it is not allowed + - The PIN 1234 has a constant delta of (1,1,1), so it is not allowed + - The PIN 1357 has a constant delta of (2,2,2), so it is not allowed + - The PIN 9630 has a constant delta of (7,7,7), so it is not allowed + - The PIN 1593 has a constant delta of (4,4,4), so it is not allowed + - The PIN 7036 has a constant delta of (3,3,3), so it is not allowed + - The PIN 1231 does not have a constant delta (1,1,8), so it is allowed + - The PIN 1872 does not have a constant delta (7,9,5), so it is allowed + + This prevents repeating numbers, sequential numbers, and simple patterns. It always results in a list of 100 disallowed PINs (independent of the PIN length). This algorithm does not apply to alphanumeric PINs. + + - question: How does PIN caching work with Windows Hello for Business? + answer: | + Windows Hello for Business provides a PIN caching user experience by using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting, as long as the user is interactively signed-in. Microsoft Account sign-in keys are considered transactional keys, which means the user is always prompted when accessing the key. + + Beginning with Windows 10, version 1709, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations will not prompt the user for the PIN. + + The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process does not receive the PIN, but rather the ticket that grants them private key operations. Windows 10 does not provide any Group Policy settings to adjust this caching. + + - question: Can I disable the PIN while using Windows Hello for Business? + answer: | + No. The movement away from passwords is accomplished by gradually reducing the use of the password. In situations where you can't authenticate by using biometrics, you need a fallback mechanism that is not a password. The PIN is the fallback mechanism. Disabling or hiding the PIN credential provider will disable the use of biometrics. + + - question: How are keys protected? + answer: | + Wherever possible, Windows Hello for Business takes advantage of Trusted Platform Module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business do not require a TPM. Administrators can choose to allow key operations in software. + + Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will need to reset the PIN (which means they'll need to use MFA to re-authenticate to the IDP before the IDP allows them to re-register). + + - question: Can Windows Hello for Business work in air-gapped environments? + answer: | + Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require internet connectivity to achieve an air-gapped Windows Hello for Business deployment. + + - question: Can I use third-party authentication providers with Windows Hello for Business? + answer: | + Yes, if you're using federated hybrid deployment, you can use any third-party that provides an Active Directory Federation Services (AD FS) multi-factor authentication adapter. A list of third-party MFA adapters can be found [here](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods). + + - question: Does Windows Hello for Business work with third-party federation servers? + answer: | + Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration).

            + + | Protocol | Description | + | :---: | :--- | + | [[MS-KPP]: Key Provisioning Protocol](https://msdn.microsoft.com/library/mt739755.aspx) | Specifies the Key Provisioning Protocol, which defines a mechanism for a client to register a set of cryptographic keys on a user and device pair. | + | [[MS-OAPX]: OAuth 2.0 Protocol Extensions](https://msdn.microsoft.com/library/dn392779.aspx)| Specifies the OAuth 2.0 Protocol Extensions, which are used to extend the OAuth 2.0 Authorization Framework. These extensions enable authorization features such as resource specification, request identifiers, and login hints. | + | [[MS-OAPXBC]: OAuth 2.0 Protocol Extensions for Broker Clients](https://msdn.microsoft.com/library/mt590278.aspx) | Specifies the OAuth 2.0 Protocol Extensions for Broker Clients, extensions to RFC6749 (the OAuth 2.0 Authorization Framework) that allow a broker client to obtain access tokens on behalf of calling clients. | + | [[MS-OIDCE]: OpenID Connect 1.0 Protocol Extensions](https://msdn.microsoft.com/library/mt766592.aspx) | Specifies the OpenID Connect 1.0 Protocol Extensions. These extensions define additional claims to carry information about the user, including the user principal name, a locally unique identifier, a time for password expiration, and a URL for password change. These extensions also define additional provider meta-data that enables the discovery of the issuer of access tokens and gives additional information about provider capabilities. | + + - question: Does Windows Hello for Business work with Mac and Linux clients? + answer: | + Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md index a1810a0b03..470d856d45 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md @@ -1,6 +1,6 @@ --- title: Conditional Access -description: Learn more about conditional access in Azure Active Directory. +description: Ensure that only approved users can access your devices, applications, and services from anywhere by enabling single sign-on with Azure Active Directory. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access ms.prod: w10 ms.mktglfcycl: deploy @@ -31,6 +31,9 @@ In a mobile-first, cloud-first world, Azure Active Directory enables single sign To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. +> [!NOTE] +> For more details about the way Windows Hello for Business interacts with Azure AD Multi-Factor Authentication and Conditional Access, see [this article](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompted-for-mfa-as-expected/ba-p/1449032). + Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. ## Related topics diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md index 015331499c..028fdd4868 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -1,6 +1,6 @@ --- title: Dual Enrollment -description: Dual Enrollment +description: Learn how to configure Windows Hello for Business dual enrollment. Also, learn how to configure Active Directory to support Domain Administrator enrollment. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, dual enrollment, ms.prod: w10 ms.mktglfcycl: deploy @@ -49,7 +49,7 @@ In this task you will ### Configure Active Directory to support Domain Administrator enrollment -The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. +The designed Windows Hello for Business configuration gives the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 33a9c450e1..b1fda98d52 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -1,6 +1,6 @@ --- title: Pin Reset -description: Pin Reset +description: Learn how Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. keywords: identity, PIN, Hello, passport, WHFB, hybrid, cert-trust, device, reset ms.prod: w10 ms.mktglfcycl: deploy @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 09/09/2019 +ms.date: 12/22/2020 ms.reviewer: --- @@ -45,47 +45,36 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se 1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. 2. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account. -![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) + ![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) 3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. 4. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account. - + ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) > [!NOTE] > After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. - -![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) - 5. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. -![PIN reset service permissions page](images/pinreset/pin-reset-applications.png) + ![PIN reset service permissions page](images/pinreset/pin-reset-applications.png) ### Configure Windows devices to use PIN reset using Group Policy You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. 1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory. -2. Edit the Group Policy object from step 1. -3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +2. Edit the Group Policy object from Step 1. +3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business**. 4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. -### Configure Windows devices to use PIN reset using Microsoft Intune - -To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): - #### Create a PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Azure Portal](https://portal.azure.com) using a Global administrator account. -2. You need your tenant ID to complete the following task. You can discover your tenant ID by viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a Command window on any Azure AD-joined or hybrid Azure AD-joined computer.
            +1. Sign-in to [Endpoint Manager admin center](https://endpoint.microsoft.com/) using a Global administrator account. +2. Click **Endpoint Security** > **Account Protection** > **Properties**. +3. Set **Enable PIN recovery** to **Yes**. - ``` - dsregcmd /status | findstr -snip "tenantid" - ``` +> [!NOTE] +> You can also setup PIN recovery using configuration profiles. +> 1. Sign in to Endpoint Manager. +> 2. Click **Devices** > **Configuration Profiles** > Create a new profile or edit an existing profile using the Identity Protection profile type. +> 3. Set **Enable PIN recovery** to **Yes**. -1. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**. -1. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list. -1. In the **Custom OMA-URI Settings** blade, Click **Add**. -1. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. -1. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. -1. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. - #### Assign the PIN Reset Device configuration profile using Microsoft Intune 1. Sign in to the [Azure Portal](https://portal.azure.com) using a Global administrator account. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 981587e970..0ebcd33ec5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -1,6 +1,6 @@ --- title: Remote Desktop -description: Remote Desktop +description: Learn how Windows Hello for Business supports using a certificate deployed to a WHFB container to a remote desktop to a server or another device. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, remote desktop, RDP ms.prod: w10 ms.mktglfcycl: deploy @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 09/09/2019 +ms.date: 09/16/2020 ms.reviewer: --- @@ -27,9 +27,9 @@ ms.reviewer: - Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices - Certificate trust deployments -Windows Hello for Business supports using a certificate deployed to a WHFB container to a remote desktop to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. +Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). -Microsoft continues to investigate supporting this feature for key trust deployments in a future release. +Microsoft continues to investigate supporting using keys trust for supplied credentials in a future release. ## Remote Desktop with Biometrics diff --git a/windows/security/identity-protection/hello-for-business/hello-features.md b/windows/security/identity-protection/hello-for-business/hello-features.md deleted file mode 100644 index d9832ef853..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-features.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Windows Hello for Business Features -description: Windows Hello for Business Features -ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E -ms.reviewer: -keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, PIN Reset, Dynamic Lock, Multifactor Unlock, Forgot PIN, Privileged credentials -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 11/27/2019 ---- -# Windows Hello for Business Features - -**Applies to:** - -- Windows 10 - -Consider these additional features you can use after your organization deploys Windows Hello for Business. - -## Conditional access - -Azure Active Directory provides a wide set of options for protecting access to corporate resources. Conditional access provides more fine grained control over who can access certain resources and under what conditions. For more information see [Conditional Access](hello-feature-conditional-access.md). - -## Dynamic lock - -Dynamic lock uses a paired Bluetooth device to determine user presence and locks the device if a user is not present. For more information and configuration steps see [Dynamic Lock](hello-feature-dynamic-lock.md). - -## PIN reset - -Windows Hello for Business supports user self-management of their PIN. If a user forgets their PIN, they have the ability to reset it from Settings or the lock screen. The Microsoft PIN reset service can be used for completing this reset without the user needing to enroll a new Windows Hello for Business credential. For more information and configuration steps see [Pin Reset](hello-feature-pin-reset.md). - -## Dual Enrollment - -This feature enables provisioning of administrator Windows Hello for Business credentials that can be used by non-privileged accounts to perform administrative actions. These credentials can be used from the non-privileged accounts using **Run as different user** or **Run as administrator**. For more information and configuration steps see [Dual Enrollment](hello-feature-dual-enrollment.md). - -## Remote Desktop - -Users with Windows Hello for Business certificate trust can use their credential to authenticate to remote desktop sessions over RDP. When authenticating to the session, biometric gestures can be used if they are enrolled. For more information and configuration steps see [Remote Desktop](hello-feature-remote-desktop.md). - -## Related topics - -- [Windows Hello for Business](hello-identity-verification.md) -- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) -- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) -- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) -- [Windows Hello and password changes](hello-and-password-changes.md) -- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) -- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index c75524b41e..cb21e54fe3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -74,6 +74,9 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |F | While Windows loads the user's desktop, lsass passes the collected credentials to the Cloud Authentication security support provider, referred to as the Cloud AP provider. The Cloud AP provider requests a nonce from Azure Active Directory. Azure AD returns a nonce.| |G | The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure Active Directory. Azure Active Directory validates the signed nonce using the user's securely registered public key against the nonce signature. After validating the signature, Azure AD then validates the returned signed nonce. After validating the nonce, Azure AD creates a PRT with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider.
            The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.
            The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT.| +> [!IMPORTANT] +> In the above deployment model, a newly provisioned user will not be able to sign in using Windows Hello for Business until (a) Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory and (b) device has line of sight to the domain controller for the first time. + ## Hybrid Azure AD join authentication using a Certificate ![Hybrid Azure AD join authentication using a Certificate](images/howitworks/auth-haadj-certtrust.png) @@ -87,3 +90,5 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |F | While Windows loads the user's desktop, lsass passes the collected credentials to the Cloud Authentication security support provider, referred to as the Cloud AP provider. The Cloud AP provider requests a nonce from Azure Active Directory. Azure AD returns a nonce.| |G | The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure Active Directory. Azure Active Directory validates the signed nonce using the user's securely registered public key against the nonce signature. After validating the signature, Azure AD then validates the returned signed nonce. After validating the nonce, Azure AD creates a PRT with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider.
            The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.
            The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT.| +> [!IMPORTANT] +> In the above deployment model, a newly provisioned user will not be able to sign in using Windows Hello for Business unless the device has line of sight to the domain controller for the first time. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md index 4cbec54f34..e91ce1f65c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md @@ -63,11 +63,11 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning | Phase | Description | | :----: | :----------- | -| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task.| +| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task. Note: the Automatic Device Join tasks is triggered on domain join as well as retried every hour. It does not solely depend on the user sign-in.| |B | The task queries Active Directory using the LDAP protocol for the keywords attribute on service connection point stored in the configuration partition in Active Directory (CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=com). The value returned in the keywords attribute determines if device registration is directed to Azure Device Registration Service (ADRS) or the enterprise device registration service hosted on-premises.| |C | For the managed environment, the task creates an initial authentication credential in the form of a self-signed certificate. The task write the certificate to the userCertificate attribute on the computer object in Active Directory using LDAP. |D |The computer cannot authenticate to Azure DRS until a device object representing the computer that includes the certificate on the userCertificate attribute is created in Azure Active Directory. Azure AD Connect detects an attribute change. On the next synchronization cycle, Azure AD Connect sends the userCertificate, object GUID, and computer SID to Azure DRS. Azure DRS uses the attribute information to create a device object in Azure Active Directory.| -|E | The Automatic Device Join task triggers with each user sign-in and tries to authenticate the computer to Azure Active Directory using the corresponding private key of the public key in the userCertificate attribute. Azure Active Directory authenticates the computer and issues a ID token to the computer.| +|E | The Automatic Device Join task triggers with each user sign-in or every hour, and tries to authenticate the computer to Azure Active Directory using the corresponding private key of the public key in the userCertificate attribute. Azure Active Directory authenticates the computer and issues a ID token to the computer.| |F | The task creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).| |G | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then updates the device object in Azure Active Directory and sends the device ID and the device certificate to the client.| |H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.| @@ -78,7 +78,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning | Phase | Description | | :----: | :----------- | -| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task.| +| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task. Note: the Automatic Device Join tasks is triggered on domain join as well as retried every hour. It does not solely depend on the user sign-in. | |B | The task queries Active Directory using the LDAP protocol for the keywords attribute on service connection point stored in the configuration partition in Active Directory (CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=com). The value returned in the keywords attribute determines if device registration is directed to Azure Device Registration Service (ADRS) or the enterprise device registration service hosted on-premises.| |C | For the federated environments, the computer authenticates the enterprise device registration endpoint using Windows integrated authentication. The enterprise device registration service creates and returns a token that includes claims for the object GUID, computer SID, and domain joined state. The task submits the token and claims to Azure Active Directory where it is validated. Azure Active Directory returns an ID token to the running task. |D | The application creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).| diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index f220db21f6..0fb161ccb5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -17,7 +17,7 @@ ms.reviewer: --- # Windows Hello for Business Provisioning -Applies to: +Applies to: - Windows 10 Windows Hello for Business provisioning enables a user to enroll a new, strong, two-factor credential that they can use for passwordless authentication. Provisioning experience vary based on: diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md deleted file mode 100644 index 0e03beb9e3..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: How Windows Hello for Business works - Technical Deep Dive -description: Deeply explore how Windows Hello for Business works, and how it can help your users authenticate to services. -keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, works -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Technical Deep Dive - -**Applies to:** -- Windows 10 - -Windows Hello for Business authentication works through collection of components and infrastructure working together. You can group the infrastructure and components in three categories: -- [Registration](#registration) -- [Provisioning](#provisioning) -- [Authentication](#authentication) - -## Registration - -Registration is a fundamental prerequisite for Windows Hello for Business. Without registration, Windows Hello for Business provisioning cannot start. Registration is where the device **registers** its identity with the identity provider. For cloud and hybrid deployments, the identity provider is Azure Active Directory and the device registers with the Azure Device Registration Service (ADRS). For on-premises deployments, the identity provider is Active Directory Federation Services (AD FS), and the device registers with the enterprise device registration service hosted on the federation servers (AD FS). - -[How Device Registration Works](hello-how-it-works-device-registration.md) - - -## Provisioning - -Provisioning is when the user uses one form of authentication to request a new Windows Hello for Business credential. Typically the user signs in to Windows using user name and password. The provisioning flow requires a second factor of authentication before it will create a strong, two-factor Windows Hello for Business credential.
            -After successfully completing the second factor of authentication, the user is asked to enroll biometrics (if available on the device) and create PIN as a backup gesture. Windows then registers the public version of the Windows Hello for Business credential with the identity provider.
            -For cloud and hybrid deployments, the identity provider is Azure Active Directory and the user registers their key with the Azure Device Registration Service (ADRS). For on-premises deployments, the identity provider is Active Directory Federation Services (AD FS), and the user registers their key with the enterprise device registration service hosted on the federation servers.
            -Provision can occur automatically through the out-of-box-experience (OOBE) on Azure Active Directory joined devices, or on hybrid Azure Active Directory joined devices where the user or device is influenced by Windows Hello for Business policy settings. Users can start provisioning through **Add PIN** from Windows Settings. Watch the [Windows Hello for Business enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) from our [Videos](hello-videos.md) page. - -[How Windows Hello for Business provisioning works](hello-how-it-works-provisioning.md) - -## Authentication - -Authentication using Windows Hello for Business is the goal, and the first step in getting to a passwordless environment. With the device registered, and provisioning complete. Users can sign-in to Windows 10 using biometrics or a PIN. PIN is the most common gesture and is available on most computers and devices. Regardless of the gesture used, authentication occurs using the private portion of the Windows Hello for Business credential. The PIN nor the private portion of the credential are never sent to the identity provider, and the PIN is not stored on the device. It is user provided entropy when performing operations that use the private portion of the credential. - -[How Windows Hello for Business authentication works](hello-how-it-works-authentication.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 72cba7a12e..cf3fb265d2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -162,7 +162,7 @@ Primarily for large enterprise organizations with more complex authentication re For more than a decade, many organizations have used the domain join to their on-premises Active Directory to enable: - IT departments to manage work-owned devices from a central location. - Users to sign in to their devices with their Active Directory work or school accounts. -Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use Microsoft Endpoint Configuration Manager or group policy (GP) to manage them. +Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use or group policy (GP) to manage them. If your environment has an on-premises AD footprint and you also want benefit from the capabilities provided by Azure Active Directory, you can implement hybrid Azure AD joined devices. These are devices that are both, joined to your on-premises Active Directory and your Azure Active Directory. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index 528c1b6fe8..c9844c3d80 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -19,29 +19,46 @@ ms.reviewer: **Applies to** -- Windows 10 +- Windows 10 -Windows Hello for Business is a modern, two-factor credential that is the more secure alternative to passwords. Whether you are cloud or on-premises, Windows Hello for Business has a deployment option for you. For cloud deployments, you can use Windows Hello for Business with Azure Active Directory joined, Hybrid Azure Active Directory joined, or Azure Active Directory registered devices. Windows Hello for Business also works for domain joined devices. +Windows Hello for Business is a modern, two-factor credential that is the more secure alternative to passwords. Whether you are cloud or on-premises, Windows Hello for Business has a deployment option for you. For cloud deployments, you can use Windows Hello for Business with Azure Active Directory joined, Hybrid Azure Active Directory joined, or Azure Active Directory registered devices. Windows Hello for Business also works for domain joined devices. Watch this quick video where Pieter Wigleven gives a simple explanation of how Windows Hello for Business works and some of its supporting features. > [!VIDEO https://www.youtube.com/embed/G-GJuDWbBE8] ## Technical Deep Dive -Windows Hello for Business is a distributed system that uses several components to accomplish device registration, provisioning, and authentication. Use this section to gain a better understanding of each of the components and how they support Windows Hello for Business. +Windows Hello for Business is a distributed system that uses several components to accomplish device registration, provisioning, and authentication. Use this section to gain a better understanding of each of the categories and how they support Windows Hello for Business. -Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business provisioning and authentication work. +### Device Registration + +Registration is a fundamental prerequisite for Windows Hello for Business. Without registration, Windows Hello for Business provisioning cannot start. Registration is where the device **registers** its identity with the identity provider. For cloud and hybrid deployments, the identity provider is Azure Active Directory and the device registers with the Azure Device Registration Service (ADRS). For on-premises deployments, the identity provider is Active Directory Federation Services (AD FS), and the device registers with the enterprise device registration service hosted on the federation servers (AD FS). + +For more information read [how device registration works](hello-how-it-works-device-registration.md). + +### Provisioning + +Provisioning is when the user uses one form of authentication to request a new Windows Hello for Business credential. Typically the user signs in to Windows using user name and password. The provisioning flow requires a second factor of authentication before it will create a strong, two-factor Windows Hello for Business credential. + +Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business provisioning works. > [!VIDEO https://www.youtube.com/embed/RImGsIjSJ1s] + +For more information read [how provisioning works](hello-how-it-works-provisioning.md). + +### Authentication + +With the device registered and provisioning complete, users can sign-in to Windows 10 using biometrics or a PIN. PIN is the most common gesture and is available on all computers unless restricted by policy requiring a TPM. Regardless of the gesture used, authentication occurs using the private portion of the Windows Hello for Business credential. Neither the PIN nor the private portion of the credential are ever sent to the identity provider, and the PIN is not stored on the device. It is user provided entropy when performing operations that use the private portion of the credential. + +Watch Matthew Palko and Ravi Vennapusa explain how Windows Hello for Business authentication works. + > [!VIDEO https://www.youtube.com/embed/WPmzoP_vMek] -- [Technology and Terminology](hello-how-it-works-technology.md) -- [Device Registration](hello-how-it-works-device-registration.md) -- [Provisioning](hello-how-it-works-provisioning.md) -- [Authentication](hello-how-it-works-authentication.md) +For more information read [how authentication works](hello-how-it-works-authentication.md). ## Related topics +- [Technology and Terminology](hello-how-it-works-technology.md) - [Windows Hello for Business](hello-identity-verification.md) - [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 4a5e2492fe..d9ccb2db53 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -13,12 +13,13 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 08/19/2018 +ms.date: 01/14/2021 ms.reviewer: --- # Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business **Applies to** + - Windows 10 - Azure Active Directory joined - Hybrid Deployment @@ -33,6 +34,7 @@ Before adding Azure Active Directory (Azure AD) joined devices to your existing - Certificate Revocation List (CRL) Distribution Point (CDP) - 2016 Domain Controllers - Domain Controller certificate +- Network infrastructure in place to reach your on-premises domain controller. If the machines are external, this can be achieved using any VPN solution. ### Azure Active Directory Connect synchronization Azure AD join, as well as hybrid Azure AD join devices register the user's Windows Hello for Business credential with Azure. To enable on-premises authentication, the credential must be synchronized to the on-premises Active Directory, regardless whether you are using a key or a certificate. Ensure you have Azure AD Connect installed and functioning properly. To learn more about Azure AD Connect, read [Integrate your on-premises directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect). @@ -62,6 +64,7 @@ If your CRL distribution point does not list an HTTP distribution point, then yo > If your CA has published both the Base and the Delta CRL, please make sure you have included publishing the Delta CRL in the HTTP path. Include web server to fetch the Delta CRL by allowing double escaping in the (IIS) web server. ### Windows Server 2016 Domain Controllers + If you are interested in configuring your environment to use the Windows Hello for Business key rather than a certificate, then your environment must have an adequate number of Windows Server 2016 domain controllers. Only Windows Server 2016 domain controllers are capable of authenticating user with a Windows Hello for Business key. What do we mean by adequate? We are glad you asked. Read [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. If you are interested in configuring your environment to use the Windows Hello for Business certificate rather than key, then you are the right place. The same certificate configuration on the domain controllers is needed, whether you are using Windows Server 2016 domain controllers or domain controllers running earlier versions of Windows Server. You can simply ignore the Windows Server 2016 domain controller requirement. @@ -72,18 +75,20 @@ Certificate authorities write CRL distribution points in certificates as they ar #### Why does Windows need to validate the domain controller certificate? -Windows Hello for Business enforces the strict KDC validation security feature, which imposes more restrictive criteria that must be met by the Key Distribution Center (KDC). When authenticating using Windows Hello for Business, the Windows 10 client validates the reply from the domain controller by ensuring all of the following are met: +Windows Hello for Business enforces the strict KDC validation security feature when authenticating from an Azure AD joined device to a domain. This enforcement imposes more restrictive criteria that must be met by the Key Distribution Center (KDC). When authenticating using Windows Hello for Business on an Azure AD joined device, the Windows 10 client validates the reply from the domain controller by ensuring all of the following are met: - The domain controller has the private key for the certificate provided. -- The root CA that issued the domain controller's certificate is in the device's **Trusted Root Certificate Authorities**. +- The root CA that issued the domain controller's certificate is in the device's **Trusted Root Certificate Authorities**. - Use the **Kerberos Authentication certificate template** instead of any other older template. -- The domain controller's certificate has the **KDC Authentication** enhanced key usage. +- The domain controller's certificate has the **KDC Authentication** enhanced key usage (EKU). - The domain controller's certificate's subject alternate name has a DNS Name that matches the name of the domain. +- The domain controller's certificate's signature hash algorithm is **sha256**. +- The domain controller's certificate's public key is **RSA (2048 Bits)**. +Authenticating from a Hybrid Azure AD joined device to a domain using Windows Hello for Business does not enforce that the domain controller certificate includes the **KDC Authentication** EKU. If you are adding Azure AD joined devices to an existing domain environment, make sure to verify that your domain controller certificate has been updated to include the **KDC Authentication** EKU. If you need to update your domain controller certificate to include the **KDC Authentication** EKU, follow the instructions in [Configure Hybrid Windows Hello for Business: Public Key Infrastructure](hello-hybrid-key-whfb-settings-pki.md) > [!Tip] > If you are using Windows Server 2008, **Kerberos Authentication** is not the default template, so make sure to use the correct template when issuing or re-issuing the certificate. - ## Configuring a CRL Distribution Point for an issuing certificate authority @@ -186,7 +191,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**. 2. In the navigation pane, right-click the name of the certificate authority and click **Properties** 3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list. -4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). +4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). ![CDP New Location dialog box](images/aadj/cdp-extension-new-location.png) 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. @@ -224,7 +229,7 @@ The web server is ready to host the CRL distribution point. Now, configure the Validate your new CRL distribution point is working. -1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. +1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. ![Validate the new CRL](images/aadj/validate-cdp-using-browser.png) ### Reissue domain controller certificates @@ -293,40 +298,39 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted 5. In the **Enterprise Root Certificate** blade, click **Assignments**. In the **Include** tab, select **All Devices** from the **Assign to** list. Click **Save**. ![Intune Profile assignment](images/aadj/intune-device-config-enterprise-root-assignment.png) 6. Sign out of the Microsoft Azure Portal. +> [!NOTE] +> After the creation, the **supported platform** parameter of the profile will contain the value "Windows 8.1 and later", as the certificate configuration for Windows 8.1 and Windows 10 is the same. ## Configure Windows Hello for Business Device Enrollment Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -3. Click **device enrollment**. -4. Click **Windows enrollment** -5. Under **Windows enrollment**, click **Windows Hello for Business**. - ![Create Intune Windows Hello for Business Policy](images/aadj/IntuneWHFBPolicy-00.png) -6. Under **Priority**, click **Default**. -7. Under **All users and all devices**, click **Settings**. -8. Select **Enabled** from the **Configure Windows Hello for Business** list. -9. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software based keys. -10. Type the desired **Minimum PIN length** and **Maximum PIN length**. +1. Sign in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Devices**. +3. Choose **Enroll devices**. +4. Select **Windows enrollment**. +5. Under **Windows enrollment**, select **Windows Hello for Business**. + ![Create Windows Hello for Business Policy](images/aadj/MEM.png) +6. Select **Enabled** from the **Configure Windows Hello for Business** list. +7. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software-based keys. +8. Enter the desired **Minimum PIN length** and **Maximum PIN length**. > [!IMPORTANT] - > The default minimum PIN length for Windows Hello for Business on Windows 10 is 6. Microsoft Intune defaults the minimum PIN length to 4, which reduces the security of the user's PIN. If you do not have a desired PIN length, set the minimum PIN length to 6. + > The default minimum PIN length for Windows Hello for Business on Windows 10 is six. Microsoft Intune defaults the minimum PIN length to four, which reduces the security of the user's PIN. If you do not have a desired PIN length, set the minimum PIN length to six. -![Intune Windows Hello for Business policy settings](images/aadj/IntuneWHFBPolicy-01.png) - -11. Select the appropriate configuration for the following settings. +9. Select the appropriate configuration for the following settings: * **Lowercase letters in PIN** * **Uppercase letters in PIN** * **Special characters in PIN** * **PIN expiration (days)** * **Remember PIN history** + > [!NOTE] > The Windows Hello for Business PIN is not a symmetric key (a password). A copy of the current PIN is not stored locally or on a server like in the case of passwords. Making the PIN as complex and changed frequently as a password increases the likelihood of forgotten PINs. Additionally, enabling PIN history is the only scenario that requires Windows 10 to store older PIN combinations (protected to the current PIN). Windows Hello for Business combined with a TPM provides anti-hammering functionality that prevents brute force attacks of the user's PIN. If you are concerned with user-to-user shoulder surfacing, rather that forcing complex PIN that change frequently, consider using the [Multifactor Unlock](feature-multifactor-unlock.md) feature. -12. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**. -13. Select **No** to **Allow phone sign-in**. This feature has been deprecated. -14. Click **Save** -15. Sign-out of the Azure portal. +10. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**. +11. Select **No** to **Allow phone sign-in**. This feature has been deprecated. +12. Choose **Save**. +13. Sign out of the Microsoft Endpoint Manager admin center. > [!IMPORTANT] > For more details about the actual experience after everything has been configured, please see [Windows Hello for Business and Authentication](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication). diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 1df6239643..c5273dc500 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -1,7 +1,7 @@ --- title: Using Certificates for AADJ On-premises Single-sign On single sign-on description: If you want to use certificates for on-premises single-sign on for Azure Active Directory joined devices, then follow these additional steps. -keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, +keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,11 +14,12 @@ ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 -ms.reviewer: +ms.reviewer: --- + # Using Certificates for AADJ On-premises Single-sign On -**Applies to** +**Applies to:** - Windows 10 - Azure Active Directory joined - Hybrid Deployment @@ -27,7 +28,7 @@ ms.reviewer: If you plan to use certificates for on-premises single-sign on, then follow these **additional** steps to configure the environment to enroll Windows Hello for Business certificates for Azure AD joined devices. > [!IMPORTANT] -> Ensure you have performed the configurations in [Azure AD joined devices for On-premises Single-Sign On](hello-hybrid-aadj-sso-base.md) before you continue. +> Ensure you have performed the configurations in [Azure AD joined devices for On-premises Single-Sign On](hello-hybrid-aadj-sso-base.md) before you continue. Steps you will perform include: - [Prepare Azure AD Connect](#prepare-azure-ad-connect) @@ -45,7 +46,7 @@ You need to install and configure additional infrastructure to provide Azure AD - A Windows Server 2012 R2 domain joined server that hosts the Network Device Enrollment Services role ### High Availaibilty -The Network Device Enrollment Services (NDES) server role acts as a certificate registration authority. Certificate registration servers enroll certificates on behalf of the user. Users request certificates from the NDES service rather than directly from the issuing certificate authority. +The Network Device Enrollment Services (NDES) server role acts as a certificate registration authority. Certificate registration servers enroll certificates on behalf of the user. Users request certificates from the NDES service rather than directly from the issuing certificate authority. The architecture of the NDES server prevents it from being clustered or load balanced for high availability. To provide high availability, you need to install more than one identically configured NDES servers and use Microsoft Intune to load balance then (in round-robin fashion). @@ -55,17 +56,17 @@ The Network Device Enrollment Service (NDES) server role can issue up to three u - Encryption - Signature and Encryption -If you need to deploy more than three types of certificates to the Azure AD joined device, you need additional NDES servers. Alternatively, consider consolidating certificates templates to reduce the number of certificate templates. +If you need to deploy more than three types of certificates to the Azure AD joined device, you need additional NDES servers. Alternatively, consider consolidating certificate templates to reduce the number of certificate templates. ### Network Requirements -All communication occurs securely over port 443. +All communication occurs securely over port 443. ## Prepare Azure AD Connect Successful authentication to on-premises resources using a certificate requires the certificate to provide a hint about the on-premises domain. The hint can be the user's Active Directory distinguished name as the subject of the certificate, or the hint can be the user's user principal name where the suffix matches the Active Directory domain name. Most environments change the user principal name suffix to match the organization's external domain name (or vanity domain), which prevents the user principal name as a hint to locate a domain controller. Therefore, the certificate needs the user's on-premises distinguished name in the subject to properly locate a domain controller. -To include the on-premises distinguished name in the certificate's subject, Azure AD Connect must replicate the Active Directory **distinguishedName** attribute to the Azure Active Directory **onPremisesDistinguishedName** attribute. Azure AD Connect version 1.1.819 includes the proper synchronization rules need to for these attributes. +To include the on-premises distinguished name in the certificate's subject, Azure AD Connect must replicate the Active Directory **distinguishedName** attribute to the Azure Active Directory **onPremisesDistinguishedName** attribute. Azure AD Connect version 1.1.819 includes the proper synchronization rules needed for these attributes. ### Verify AAD Connect version Sign-in to computer running Azure AD Connect with access equivalent to _local administrator_. @@ -100,8 +101,8 @@ Sign-in to a domain controller or management workstation with access equivalent Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. 1. Open **Active Directory Users and Computers**. -2. Expand the domain node from the navigation pane. -3. Click **Computers** from the navigation pane. Right-click the name of the NDES server that will host the NDES server role. Click **Add to a group...**. +2. Expand the domain node from the navigation pane. +3. Click **Computers** from the navigation pane. Right-click the name of the NDES server that will host the NDES server role. Click **Add to a group...**. 4. Type **NDES Servers** in **Enter the object names to select**. Click **OK**. Click **OK** on the **Active Directory Domain Services** success dialog. > [!NOTE] @@ -118,10 +119,10 @@ Sign-in to a domain controller or management workstation with access equivalent 4. Click **Finish**. > [!IMPORTANT] -> Configuring the service's account password to **Password never expires** may be more convenient, but it presents a security risk. Normal service account passwords should expire in accordance with the organizations user password expiration policy. Create a reminder to change the service account's password two weeks before it will expire. Share the reminder with others that are allowed to change the password to ensure the password is changed before it expires. +> Configuring the service's account password to **Password never expires** may be more convenient, but it presents a security risk. Normal service account passwords should expire in accordance with the organizations user password expiration policy. Create a reminder to change the service account's password two weeks before it will expire. Share the reminder with others that are allowed to change the password to ensure the password is changed before it expires. ### Create the NDES Service User Rights Group Policy object -The Group Policy object ensures the NDES Service account has the proper user right assign all the NDES servers in the **NDES Servers** group. As you add new NDES servers to your environment and this group, the service account automatically receives the proper user rights through Group Policy. +The Group Policy object ensures the NDES Service account has the proper user right to assign all the NDES servers in the **NDES Servers** group. As you add new NDES servers to your environment and this group, the service account automatically receives the proper user rights through the Group Policy. Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. @@ -135,10 +136,10 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 8. In the content pane, double-click **Allow log on locally**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** twice. 9. In the content pane, double-click **Log on as a batch job**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **Administrators;Backup Operators;DOMAINNAME\NDESSvc;Performance Log Users** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** twice. 10. In the content pane, double-click **Log on as a service**. Select **Define these policy settings** and click **OK**. Click **Add User or Group...**. In the **Add User or Group** dialog box, click **Browse**. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, type **NT SERVICE\ALL SERVICES;DOMAINNAME\NDESSvc** where **DOMAINNAME** is the NetBios name of the domain (Example CONTOSO\NDESSvc) in **User and group names**. Click **OK** three times. -11. Close the **Group Policy Management Editor**. +11. Close the **Group Policy Management Editor**. ### Configure security for the NDES Service User Rights Group Policy object -The best way to deploy the **NDES Service User Rights** Group Policy object is to use security group filtering. This enables you to easily manage the computers that receive the Group Policy settings by adding them to a group. +The best way to deploy the **NDES Service User Rights** Group Policy object is to use security group filtering. This enables you to easily manage the computers that receive the Group Policy settings by adding them to a group. Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. @@ -159,7 +160,7 @@ Sign-in to a domain controller or management workstation with access equivalent 3. In the **Select GPO** dialog box, select **NDES Service User Rights** or the name of the Group Policy object you previously created and click **OK**. > [!IMPORTANT] -> Linking the **NDES Service User Rights** Group Policy object to the domain ensures the Group Policy object is in scope for all computers. However, not all computers will have the policy settings applied to them. Only computers that are members of the **NDES Servers** global security group receive the policy settings. All others computers ignore the Group Policy object. +> Linking the **NDES Service User Rights** Group Policy object to the domain ensures the Group Policy object is in scope for all computers. However, not all computers will have the policy settings applied to them. Only computers that are members of the **NDES Servers** global security group receive the policy settings. All others computers ignore the Group Policy object. ## Prepare Active Directory Certificate Authority You must prepare the public key infrastructure and the issuing certificate authority to support issuing certificates using Microsoft Intune and the Network Devices Enrollment Services (NDES) server role. In this task, you will @@ -177,46 +178,52 @@ When deploying certificates using Microsoft Intune, you have the option of provi Sign-in to the issuing certificate authority with access equivalent to _local administrator_. -1. Open and elevated command prompt. Type the command +1. Open an elevated command prompt and type the following command: ``` certutil -setreg Policy\EditFlags +EDITF_ATTRIBUTEENDDATE ``` -2. Restart the **Active Directory Certificate Services** service. +2. Restart the **Active Directory Certificate Services** service. ### Create an NDES-Intune authentication certificate template -NDES uses a server authentication certificate to authenticate the server endpoint, which encrypts the communication between it and the connecting client. The Intune Certificate Connector uses a client authentication certificate template to authenticate to the certificate registration point. +NDES uses a server authentication certificate to authenticate the server endpoint, which encrypts the communication between it and the connecting client. The Intune Certificate Connector uses a client authentication certificate template to authenticate to the certificate registration point. Sign-in to the issuing certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. +1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. 3. In the **Certificate Template Console**, right-click the **Computer** template in the details pane and click **Duplicate Template**. -4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. - **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -5. On the **Subject** tab, select **Supply in the request**. -6. On the **Cryptography** tab, validate the **Minimum key size** is **2048**. -7. On the **Security** tab, click **Add**. -8. Type **NDES server** in the **Enter the object names to select** text box and click **OK**. -9. Select **NDES server** from the **Group or users names** list. In the **Permissions for** section, select the **Allow** check box for the **Enroll** permission. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -10. Click on the **Apply** to save changes and close the console. +4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. + +5. On the **Subject** tab, select **Supply in the request**. +6. On the **Cryptography** tab, validate the **Minimum key size** is **2048**. +7. On the **Security** tab, click **Add**. +8. Type **NDES server** in the **Enter the object names to select** text box and click **OK**. +9. Select **NDES server** from the **Group or users names** list. In the **Permissions for** section, select the **Allow** check box for the **Enroll** permission. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +10. Click on the **Apply** to save changes and close the console. ### Create an Azure AD joined Windows Hello for Business authentication certificate template -During Windows Hello for Business provisioning, Windows 10 requests an authentication certificate from the Microsoft Intune, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring the NDES Server. +During Windows Hello for Business provisioning, Windows 10 requests an authentication certificate from Microsoft Intune, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring the NDES Server. -Sign-in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. +Sign in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. 1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. 3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **AADJ WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. - **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. -6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. +5. On the **General** tab, type **AADJ WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. + +6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Subject** tab, select **Supply in the request**. 9. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**. 10. On the **Security** tab, click **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and click **OK**. -12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for the **Read**, **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for **Read** and **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. 13. Close the console. ### Publish certificate templates @@ -231,7 +238,7 @@ Sign-in to the certificate authority or management workstations with an _Enterpr 2. Expand the parent node from the navigation pane. 3. Click **Certificate Templates** in the navigation pane. 4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. 6. Close the console. ## Install and Configure the NDES Role @@ -250,10 +257,10 @@ Install the Network Device Enrollment Service role on a computer other than the Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. 1. Open **Server Manager** on the NDES server. -2. Click **Manage**. Click **Add Roles and Features**. +2. Click **Manage**. Click **Add Roles and Features**. 3. In the **Add Roles and Features Wizard**, on the **Before you begin** page, click **Next**. Select **Role-based or feature-based installation** on the **Select installation type** page. Click **Next**. Click **Select a server from the server pool**. Select the local server from the **Server Pool** list. Click **Next**. ![Server Manager destination server](images/aadjCert/servermanager-destination-server-ndes.png) -4. On the **Select server roles** page, select **Active Directory Certificate Services** from the **Roles** list. +4. On the **Select server roles** page, select **Active Directory Certificate Services** from the **Roles** list. ![Server Manager AD CS Role](images/aadjCert/servermanager-adcs-role.png) Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. ![Server Manager Add Features](images/aadjcert/serverManager-adcs-add-features.png) @@ -270,8 +277,8 @@ Sign-in to the certificate authority or management workstations with an _Enterpr * **Management Tools > IIS 6 Management Compatibility > IIS 6 WMI Compatibility** ![Server Manager Web Server Role](images/aadjcert/servermanager-adcs-webserver-role.png) 9. Click **Install**. When the installation completes, continue with the next procedure. **Do not click Close**. - > [!Important] - > The .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ + > [!IMPORTANT] + > .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ ![.NET Side by Side](images/aadjcert/dotNet35sidebyside.png) ### Configure the NDES service account @@ -280,19 +287,23 @@ This task adds the NDES service account to the local IIS_USRS group. The task a #### Add the NDES service account to the IIS_USRS group Sign-in the NDES server with access equivalent to _local administrator_. -1. Start the **Local Users and Groups** management console (lusrmgr.msc). +1. Start the **Local Users and Groups** management console (`lusrmgr.msc`). 2. Select **Groups** from the navigation pane. Double-click the IIS_IUSRS group. 3. In the **IIS_IUSRS Properties** dialog box, click **Add**. Type **NDESSvc** or the name of your NDES service account. Click **Check Names** to verify the name and then click **OK**. Click **OK** to close the properties dialog box. 4. Close the management console. #### Register a Service Principal Name on the NDES Service account -Sign-in the NDES server with a access equivalent to _Domain Admins_. +Sign-in the NDES server with access equivalent to _Domain Admins_. 1. Open an elevated command prompt. -2. Type the following command to register the service principal name
            -```setspn -s http/[FqdnOfNdesServer] [DomainName\\NdesServiceAccount]```
            -where **[FqdnOfNdesServer]** is the fully qualified domain name of the NDES server and **[DomainName\NdesServiceAccount]** is the domain name and NDES service account name separated by a backslash (\\). An example of the command looks like the following.
            -```setspn -s http/ndes.corp.contoso.com contoso\ndessvc``` +2. Type the following command to register the service principal name + ``` + setspn -s http/[FqdnOfNdesServer] [DomainName\\NdesServiceAccount] + ``` + where **[FqdnOfNdesServer]** is the fully qualified domain name of the NDES server and **[DomainName\NdesServiceAccount]** is the domain name and NDES service account name separated by a backslash (\\). An example of the command looks like the following: + ``` + setspn -s http/ndes.corp.contoso.com contoso\ndessvc + ``` > [!NOTE] > If you use the same service account for multiple NDES Servers, repeat the following task for each NDES server under which the NDES service runs. @@ -306,16 +317,16 @@ Sign-in a domain controller with a minimum access equivalent to _Domain Admins_. 1. Open **Active Directory Users and Computers** 2. Locate the NDES Service account (NDESSvc). Right-click and select **Properties**. Click the **Delegation** tab. -![NDES Delegation Tab](images/aadjcert/ndessvcdelegationtab.png) + ![NDES Delegation Tab](images/aadjcert/ndessvcdelegationtab.png) 3. Select **Trust this user for delegation to specified services only**. 4. Select **Use any authentication protocol**. 5. Click **Add**. 6. Click **Users or Computers...** Type the name of the _NDES Server_ you use to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Avaiable services** list, select **HOST**. Click **OK**. -![NDES Service delegation to NDES host](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) -7. Repeat steps 5 and 6 for each NDES server using this service account.8. Click **Add**. + ![NDES Service delegation to NDES host](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) +7. Repeat steps 5 and 6 for each NDES server using this service account. Click **Add**. 8. Click **Users or computers...** Type the name of the issuing certificate authority this NDES service account uses to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Available services** list, select **dcom**. Hold the **CTRL** key and select **HOST**. Click **OK**. 9. Repeat steps 8 and 9 for each issuing certificate authority from which one or more NDES servers request certificates. -![NDES Service delegation complete](images/aadjcert/ndessvcdelegation-host-ca-spn.png) + ![NDES Service delegation complete](images/aadjcert/ndessvcdelegation-host-ca-spn.png) 10. Click **OK**. Close **Active Directory Users and Computers**. ### Configure the NDES Role and Certificate Templates @@ -325,61 +336,65 @@ This task configures the NDES role and the certificate templates the NDES server Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. > [!NOTE] -> If you closed Server Manger from the last set of tasks, start Server Manager and click the action flag that shows a yellow exclamation point. +> If you closed Server Manger from the last set of tasks, start Server Manager and click the action flag that shows a yellow exclamation point. ![Server Manager Post-Install Yellow flag](images/aadjcert/servermanager-post-ndes-yellowactionflag.png) 1. Click the **Configure Active Directory Certificate Services on the destination server** link. 2. On the **Credentials** page, click **Next**. -![NDES Installation Credentials](images/aadjcert/ndesconfig01.png) + ![NDES Installation Credentials](images/aadjcert/ndesconfig01.png) 3. On the **Role Services** page, select **Network Device Enrollment Service** and then click **Next** -![NDES Role Services](images/aadjcert/ndesconfig02.png) -4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Click **Select...** Type the user name and password for the NDES service account in the **Windows Security** dialog box. Click **Next**. -![NDES Service Account for NDES](images/aadjcert/ndesconfig03b.png) + ![NDES Role Services](images/aadjcert/ndesconfig02.png) +4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Click **Select...**. Type the user name and password for the NDES service account in the **Windows Security** dialog box. Click **Next**. + ![NDES Service Account for NDES](images/aadjcert/ndesconfig03b.png) 5. On the **CA for NDES** page, select **CA name**. Click **Select...**. Select the issuing certificate authority from which the NDES server requests certificates. Click **Next**. -![NDES CA selection](images/aadjcert/ndesconfig04.png) + ![NDES CA selection](images/aadjcert/ndesconfig04.png) 6. On the **RA Information**, click **Next**. 7. On the **Cryptography for NDES** page, click **Next**. 8. Review the **Confirmation** page. Click **Configure**. -![NDES Confirmation](images/aadjcert/ndesconfig05.png) + ![NDES Confirmation](images/aadjcert/ndesconfig05.png) 8. Click **Close** after the configuration completes. #### Configure Certificate Templates on NDES -A single NDES server can request a maximum of three certificate template. The NDES server determines which certificate to issue based on the incoming certificate request that is assigned in the Microsoft Intune SCEP certificate profile. The Microsoft Intune SCEP certificate profile has three values. +A single NDES server can request a maximum of three certificate templates. The NDES server determines which certificate to issue based on the incoming certificate request that is assigned in the Microsoft Intune SCEP certificate profile. The Microsoft Intune SCEP certificate profile has three values. * Digital Signature * Key Encipherment * Key Encipherment, Digital Signature -Each value maps to a registry value name in the NDES server. The NDES server translate an incoming SCEP provide value into the correspond certificate template. The table belows shows the SCEP profile value to the NDES certificate template registry value name +Each value maps to a registry value name in the NDES server. The NDES server translates an incoming SCEP provided value into the corresponding certificate template. The table below shows the SCEP profile values of the NDES certificate template registry value names. -|SCEP Profile Key usage| NDES Registry Value Name| -|:----------:|:-----------------------:| -|Digital Signature|SignatureTemplate| -|Key Encipherment|EncryptionTemplate| -|Key Encipherment
            Digital Signature|GeneralPurposeTemplate| +| SCEP Profile Key usage| NDES Registry Value Name | +| :-------------------: | :----------------------: | +| Digital Signature | SignatureTemplate | +| Key Encipherment | EncryptionTemplate | +| Key Encipherment
            Digital Signature | GeneralPurposeTemplate | -Ideally, you should match the certificate request with registry value name to keep the configuration intuitive (encryption certificates use the encryptionTemplate, signature certificates use the signature template, etc.). A result of this intuitive design is the potential exponential growth in NDES server. Imagine an organization that needs to issue nine unique signature certificates across their enterprise. +Ideally, you should match the certificate request with the registry value name to keep the configuration intuitive (encryption certificates use the encryption template, signature certificates use the signature template, etc.). A result of this intuitive design is the potential exponential growth in the NDES server. Imagine an organization that needs to issue nine unique signature certificates across their enterprise. - If the need arises, you can configure a signature certificate in the encryption registry value name or an encryption certificate in the signature registry value to maximize the use of your NDES infrastructure. This unintuitive design requires current and accurate documentation of the configuration to ensure the SCEP certificate profile is configured to enroll the correct certificate, regardless of the actual purpose. Each organization needs to balance ease of configuration and administration with additional NDES infrastructure and the management overhead that comes with it. +If the need arises, you can configure a signature certificate in the encryption registry value name or an encryption certificate in the signature registry value to maximize the use of your NDES infrastructure. This unintuitive design requires current and accurate documentation of the configuration to ensure the SCEP certificate profile is configured to enroll the correct certificate, regardless of the actual purpose. Each organization needs to balance ease of configuration and administration with additional NDES infrastructure and the management overhead that comes with it. Sign-in to the NDES Server with _local administrator_ equivalent credentials. 1. Open an elevated command prompt. 2. Using the table above, decide which registry value name you will use to request Windows Hello for Business authentication certificates for Azure AD joined devices. -3. Type the following command
            -```reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v [registryValueName] /t REG_SZ /d [certificateTemplateName]```
            -where **registryValueName** is one of the three value names from the above table and where **certificateTemplateName** is the name of the certificate template you created for Windows Hello for Business Azure AD joined devices. Example:
            -```reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v SignatureTemplate /t REG_SZ /d AADJWHFBAuthentication```
            +3. Type the following command: + ``` + reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v [registryValueName] /t REG_SZ /d [certificateTemplateName] + ``` + where **registryValueName** is one of the three value names from the above table and where **certificateTemplateName** is the name of the certificate template you created for Windows Hello for Business Azure AD joined devices. Example: + ``` + reg add HKLM\Software\Microsoft\Cryptography\MSCEP /v SignatureTemplate /t REG_SZ /d AADJWHFBAuthentication + ``` 4. Type **Y** when the command asks for permission to overwrite the existing value. 5. Close the command prompt. > [!IMPORTANT] -> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certificates Templates** management console (certtmpl.msc). +> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certificates Templates** management console (`certtmpl.msc`). ### Create a Web Application Proxy for the internal NDES URL. Certificate enrollment for Azure AD joined devices occurs over the Internet. As a result, the internal NDES URLs must be accessible externally. You can do this easily and securely using Azure Active Directory Application Proxy. Azure AD Application Proxy provides single sign-on and secure remote access for web applications hosted on-premises, such as Network Device Enrollment Services. -Ideally, you configure your Microsoft Intune SCEP certificate profile to use multiple external NDES URLs. This enables Microsoft Intune to round-robin load balance the certificate requests to identically configured NDES Servers (each NDES server can accommodate approximately 300 concurrent requests). Microsoft Intune sends these requests to Azure AD Application Proxies. +Ideally, you configure your Microsoft Intune SCEP certificate profile to use multiple external NDES URLs. This enables Microsoft Intune to round-robin load balance the certificate requests to identically configured NDES Servers (each NDES server can accommodate approximately 300 concurrent requests). Microsoft Intune sends these requests to Azure AD Application Proxies. Azure AD Application proxies are serviced by lightweight Application Proxy Connector agents. These agents are installed on your on-premises, domain joined devices and make authenticated secure outbound connection to Azure, waiting to process requests from Azure AD Application Proxies. You can create connector groups in Azure Active Directory to assign specific connectors to service specific applications. @@ -395,7 +410,7 @@ Sign-in a workstation with access equivalent to a _domain user_. ![Azure Application Proxy Connectors](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) 5. Sign-in the computer that will run the connector with access equivalent to a _domain user_. > [!IMPORTANT] - > Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategtically locate Azure AD application proxy connectors throughout your organization to ensure maximum availablity. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. + > Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategically locate Azure AD application proxy connectors throughout your organization to ensure maximum availability. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. 6. Start **AADApplicationProxyConnectorInstaller.exe**. 7. Read the license terms and then select **I agree to the license terms and conditions**. Click **Install**. @@ -412,9 +427,9 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/) with access equivalent to **Global Administrator**. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. -![Azure Application Proxy Connector groups](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) + ![Azure Application Proxy Connector groups](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) 4. Click **New Connector Group**. Under **Name**, type **NDES WHFB Connectors**. -![Azure Application New Connector Group](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) + ![Azure Application New Connector Group](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) 5. Select each connector agent in the **Connectors** list that will service Windows Hello for Business certificate enrollment requests. 6. Click **Save**. @@ -426,18 +441,18 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Under **MANAGE**, click **Application proxy**. 4. Click **Configure an app**. 5. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Azure AD Application Proxy setting with the on-premises NDES server. Each NDES server must have its own Azure AD Application Proxy as two NDES servers cannot share the same internal URL. -6. Next to **Internal Url**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**. -7. Under **Internal Url**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net). +6. Next to **Internal URL**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**. +7. Under **Internal URL**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net). ![Azure NDES Application Proxy Configuration](images/aadjcert/azureconsole-appproxyconfig.png) 8. Select **Passthrough** from the **Pre Authentication** list. 9. Select **NDES WHFB Connectors** from the **Connector Group** list. -10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. +10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. 11. Click **Add**. 12. Sign-out of the Azure Portal. + > [!IMPORTANT] > Write down the internal and external URLs. You will need this information when you enroll the NDES-Intune Authentication certificate. - ### Enroll the NDES-Intune Authentication certificate This task enrolls a client and server authentication certificate used by the Intune connector and the NDES server. @@ -449,8 +464,8 @@ Sign-in the NDES server with access equivalent to _local administrators_. 4. Click **Next** on the **Before You Begin** page. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **NDES-Intune Authentication** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) +7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**) and then click **Add**. 9. Under **Alternative name**, select **DNS** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**). Click **Add**. Type the external URL used in the previous task (without the https://, for example **ndes-mstephendemo.msappproxy.net**). Click **Add**. Click **OK** when finished. 9. Click **Enroll** @@ -462,44 +477,46 @@ This task configures the Web Server role on the NDES server to use the server au Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. -2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. -![NDES IIS Console](images/aadjcert/ndes-iis-console.png) +2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. + ![NDES IIS Console](images/aadjcert/ndes-iis-console.png) 3. Click **Bindings...*** under **Actions**. Click **Add**. -![NDES IIS Console](images/aadjcert/ndes-iis-bindings.png) + ![NDES IIS Console](images/aadjcert/ndes-iis-bindings.png) 4. Select **https** from **Type**. Confirm the value for **Port** is **443**. 5. Select the certificate you previously enrolled from the **SSL certificate** list. Select **OK**. -![NDES IIS Console](images/aadjcert/ndes-iis-bindings-add-443.png) -6. Select **http** from the **Site Bindings** list. Click **Remove**. + ![NDES IIS Console](images/aadjcert/ndes-iis-bindings-add-443.png) +6. Select **http** from the **Site Bindings** list. Click **Remove**. 7. Click **Close** on the **Site Bindings** dialog box. -8. Close **Internet Information Services (IIS) Manager**. +8. Close **Internet Information Services (IIS) Manager**. ### Verify the configuration This task confirms the TLS configuration for the NDES server. Sign-in the NDES server with access equivalent to _local administrator_. -#### Disable Internet Explorer Enhanced Security Configuration +#### Disable Internet Explorer Enhanced Security Configuration 1. Open **Server Manager**. Click **Local Server** from the navigation pane. 2. Click **On** next to **IE Enhanced Security Configuration** in the **Properties** section. 3. In the **Internet Explorer Enhanced Security Configuration** dialog, under **Administrators**, select **Off**. Click **OK**. 4. Close **Server Manager**. #### Test the NDES web server -1. Open **Internet Explorer**. -2. In the navigation bar, type -```https://[fqdnHostName]/certsrv/mscep/mscep.dll``` -where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. +1. Open **Internet Explorer**. +2. In the navigation bar, type + ``` + https://[fqdnHostName]/certsrv/mscep/mscep.dll + ``` + where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. -A web page similar to the following should appear in your web browser. If you do not see similar page, or you get a **503 Service unavailable**, ensure the NDES Service account as the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. +A web page similar to the following should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. ![NDES IIS Console](images/aadjcert/ndes-https-website-test-01.png) -Confirm the web site uses the server authentication certificate. +Confirm the web site uses the server authentication certificate. ![NDES IIS Console](images/aadjcert/ndes-https-website-test-01-show-cert.png) ## Configure Network Device Enrollment Services to work with Microsoft Intune -You have successfully configured the Network Device Enrollment Services. You must now modify the configuration to work with the Intune Certificate Connector. In this task, you will enable the NDES server and http.sys to handle long URLs. +You have successfully configured the Network Device Enrollment Services. You must now modify the configuration to work with the Intune Certificate Connector. In this task, you will enable the NDES server and http.sys to handle long URLs. - Configure NDES to support long URLs @@ -510,7 +527,7 @@ Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. 2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. 3. In the content pane, double-click **Request Filtering**. Click **Edit Feature Settings...** in the action pane. -![Intune NDES Request filtering](images/aadjcert/NDES-IIS-RequestFiltering.png) + ![Intune NDES Request filtering](images/aadjcert/NDES-IIS-RequestFiltering.png) 4. Select **Allow unlisted file name extensions**. 5. Select **Allow unlisted verbs**. 6. Select **Allow high-bit characters**. @@ -521,56 +538,58 @@ Sign-in the NDES server with access equivalent to _local administrator_. #### Configure Parameters for HTTP.SYS 1. Open an elevated command prompt. -2. Run the following commands
            -```reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxFieldLength /t REG_DWORD /d 65534```
            -```reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxRequestBytes /t REG_DWORD /d 65534```
            +2. Run the following commands: + ``` + reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxFieldLength /t REG_DWORD /d 65534 + reg add HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters /v MaxRequestBytes /t REG_DWORD /d 65534 + ``` 3. Restart the NDES server. ## Download, Install and Configure the Intune Certificate Connector -The Intune Certificate Connector application enables Microsoft Intune to enroll certificates using your on-premises PKI for users on devices managed by Microsoft Intune. +The Intune Certificate Connector application enables Microsoft Intune to enroll certificates using your on-premises PKI for users on devices managed by Microsoft Intune. -### Download Intune Certificate Connector +### Download Intune Certificate Connector Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -![Microsoft Intune Console](images/aadjcert/microsoftintuneconsole.png) -3. Select **Device Configuration**, and then select **Certificate Connectors**. -![Intune Certificate Authority](images/aadjcert/intunedeviceconfigurationcertauthority.png) -4. Click **Add**, and then click **Download the certificate connector software** under the **Steps to install connector for SCEP** section. -![Intune Download Certificate connector](images/aadjcert/intunedownloadcertconnector.png) -5. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. -6. Sign-out of the Azure Portal. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Tenant administration** > **Connectors and tokens** > **Certificate connectors** > **Add**. +3. Click **Download the certificate connector software** under the **Install Certificate Connectors** section. + ![Intune Certificate Authority](images/aadjcert/profile01.png) +4. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. +5. Sign-out of the Microsoft Endpoint Manager admin center. ### Install the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. 1. Copy the Intune Certificate Connector Setup (NDESConnectorSetup.exe) downloaded in the previous task locally to the NDES server. 2. Run **NDESConnectorSetup.exe** as an administrator. If the setup shows a dialog that reads **Microsoft Intune NDES Connector requires HTTP Activation**, ensure you started the application as an administrator, then check HTTP Activation is enabled on the NDES server. -3. On the **Microsoft Intune** page, click **Next**. +3. On the **Microsoft Intune** page, click **Next**. ![Intune Connector Install 01](images/aadjcert/intunecertconnectorinstall-01.png) 4. Read the **End User License Agreement**. Click **Next** to accept the agreement and to proceed with the installation. 5. On the **Destination Folder** page, click **Next**. 6. On the **Installation Options** page, select **SCEP and PFX Profile Distribution** and click **Next**. ![Intune Connector Install 03](images/aadjcert/intunecertconnectorinstall-03.png) -7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**. +7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**. ![Intune Connector Install 05](images/aadjcert/intunecertconnectorinstall-05.png) + > [!NOTE] > The **Client certificate for Microsoft Intune** page does not update after selecting the client authentication certificate. However, the application rembers the selection and shows it in the next page. 8. On the **Client certificate for the NDES Policy Module** page, verify the certificate information and then click **Next**. 9. ON the **Ready to install Microsoft Intune Connector** page. Click **Install**. ![Intune Connector Install 06](images/aadjcert/intunecertconnectorinstall-06.png) - > [!NOTE] - > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder -10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. + > [!NOTE] + > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder. + +10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. ![Intune Connector install 07](images/aadjcert/intunecertconnectorinstall-07.png) ### Configure the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. 1. The **NDES Connector** user interface should be open from the last task. + > [!NOTE] > If the **NDES Connector** user interface is not open, you can start it from **\\NDESConnectorUI\NDESConnectorUI.exe**. @@ -579,10 +598,11 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role. ![Intune Certificate Connector Configuration 02](images/aadjcert/intunecertconnectorconfig-02.png) - > [!IMPORTANT] - > The user account must have a valid Intune licenese assigned. If the user account does not have a valid Intune license, the sign-in fails. -4. Optionally, you can configure the NDES Connector for certificate revocation. If you want to do this, continue to the next task. Otherwise, Click **Close**, restart the **Intune Connector Service** and the **World Wide Web Publishing Service**, and skip the next task. + > [!IMPORTANT] + > The user account must have a valid Intune license assigned. If the user account does not have a valid Intune license, the sign-in fails. + +4. Optionally, you can configure the NDES Connector for certificate revocation. If you want to do this, continue to the next task. Otherwise, Click **Close**, restart the **Intune Connector Service** and the **World Wide Web Publishing Service**, and skip the next task. ### Configure the NDES Connector for certificate revocation (**Optional**) @@ -594,30 +614,34 @@ Sign-in the certificate authority used by the NDES Connector with access equival 1. Start the **Certification Authority** management console. 2. In the navigation pane, right-click the name of the certificate authority and select **Properties**. 3. Click the **Security** tab. Click **Add**. In **Enter the object names to select** box, type **NDESSvc** (or the name you gave the NDES Service account). Click *Check Names*. Click **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Click **OK**. -![Configure Intune certificate revocation 02](images/aadjcert/intuneconfigcertrevocation-02.png) + ![Configure Intune certificate revocation 02](images/aadjcert/intuneconfigcertrevocation-02.png) 4. Close the **Certification Authority** #### Enable the NDES Connector for certificate revocation Sign-in the NDES server with access equivalent to _domain administrator_. 1. Open the **NDES Connector** user interface (**\\NDESConnectorUI\NDESConnectorUI.exe**). -2. Click the **Advanced** tab. Select **Specify a different account username and password**. TYpe the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**. -![Intune Connector cert revocation configuration 04](images/aadjcert/intunecertconnectorconfig-04.png) +2. Click the **Advanced** tab. Select **Specify a different account username and password**. Type the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**. + ![Intune Connector cert revocation configuration 04](images/aadjcert/intunecertconnectorconfig-04.png) 3. Restart the **Intune Connector Service** and the **World Wide Web Publishing Service**. ### Test the NDES Connector Sign-in the NDES server with access equivalent to _domain admin_. 1. Open a command prompt. -2. Type the following command to confirm the NDES Connector's last connection time is current.
            -```reg query hklm\software\Microsoft\MicrosoftIntune\NDESConnector\ConnectionStatus```
            +2. Type the following command to confirm the NDES Connector's last connection time is current. + ``` + reg query hklm\software\Microsoft\MicrosoftIntune\NDESConnector\ConnectionStatus + ``` 3. Close the command prompt. 4. Open **Internet Explorer**. -5. In the navigation bar, type
            -```https://[fqdnHostName]/certsrv/mscep/mscep.dll```
            -where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server.
            -A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see similar page, or you get a **503 Service unavailable**, ensure the NDES Service account as the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. -![NDES web site test after Intune Certificate Connector](images/aadjcert/ndes-https-website-test-after-intune-connector.png) +5. In the navigation bar, type: + ``` + https://[fqdnHostName]/certsrv/mscep/mscep.dll + ``` + where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. + A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. + ![NDES web site test after Intune Certificate Connector](images/aadjcert/ndes-https-website-test-after-intune-connector.png) 6. Using **Server Manager**, enable **Internet Explorer Enhanced Security Configuration**. ## Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile @@ -632,54 +656,50 @@ Sign-in a workstation with access equivalent to a _domain user_. 5. Under **Group Name**, type the name of the group. For example, **AADJ WHFB Certificate Users**. 6. Provide a **Group description**, if applicable. 7. Select **Assigned** from the **Membership type** list. -![Azure AD new group creation](images/aadjcert/azureadcreatewhfbcertgroup.png) + ![Azure AD new group creation](images/aadjcert/azureadcreatewhfbcertgroup.png) 8. Click **Members**. Use the **Select members** pane to add members to this group. When finished click **Select**. 9. Click **Create**. ### Create a SCEP Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -3. Select **Device Configuration**, and then click **Profiles**. -4. Select **Create Profile**. - ![Intune Device Configuration Create Profile](images/aadjcert/intunedeviceconfigurationcreateprofile.png) -5. Select **Windows 10 and later** from the **Platform** list. -6. Choose **SCEP certificate** from the **Profile** list, and select **Create**. -7. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. -8. Next to **Description**, provide a description meaningful for your environment, then select **Next**. -9. Select **User** as a certificate type. -10. Configure **Certificate validity period** to match your organization. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Devices**, and then click **Configuration Profiles**. +3. Select **Create Profile**. + ![Intune Device Configuration Create Profile](images/aadjcert/profile02.png) +4. Select **Windows 10 and later** from the **Platform** list. +5. Choose **SCEP certificate** from the **Profile** list, and select **Create**. +6. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. +7. Next to **Description**, provide a description meaningful for your environment, then select **Next**. +8. Select **User** as a certificate type. +9. Configure **Certificate validity period** to match your organization. + > [!IMPORTANT] > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. -11. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. -12. Select **Custom** from the **Subject name format** list. -13. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. -14. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** value. -15. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. -16. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. - ![WHFB SCEP certificate profile Trusted Certificate selection](images/aadjcert/intunewhfbscepprofile-01.png) -17. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. -18. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. - ![WHFB SCEP certificate Profile EKUs](images/aadjcert/intunewhfbscepprofile-03.png) -19. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. -20. Click **Next**. -21. Click **Next** two more times to skip the **Scope tags** and **Assignments** steps of the wizard and click **Create**. +10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. +11. Next to **Subject name format**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. +12. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** parameter. Set its value as {{UserPrincipalName}}. +13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to the configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. +14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile. +15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. +16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. + ![WHFB SCEP certificate Profile EKUs](images/aadjcert/profile03.png) +17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. +18. Click **Next**. +19. Click **Next** several times to skip the **Scope tags**, **Assignments**, and **Applicability Rules** steps of the wizard and click **Create**. ### Assign Group to the WHFB Certificate Enrollment Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -3. Select **Device Configuration**, and then click **Profiles**. -4. Click **WHFB Certificate Enrollment**. -![WHFB Scep Profile landing](images/aadjcert/intunewhfbscepprofile-04.png) -5. Click **Assignments**. -6. In the **Assignments** pane, Click **Include**. Select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. -![WHFB SCEP Profile Assignment](images/aadjcert/intunewhfbscepprofileassignment.png) -7. Select the **AADJ WHFB Certificate Users** group. Click **Select**. -8. Click **Save**. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Devices**, and then click **Configuration Profiles**. +3. Click **WHFB Certificate Enrollment**. +4. Select **Properties**, and then click **Edit** next to the **Assignments** section. +5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. + ![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) +6. Select the **AADJ WHFB Certificate Users** group. Click **Select**. +7. Click **Review + Save**, and then **Save**. You have successfully completed the configuration. Add users that need to enroll a Windows Hello for Business authentication certificate to the **AADJ WHFB Certificate Users** group. This group, combined with the device enrollment Windows Hello for Business configuration prompts the user to enroll for Windows Hello for Business and enroll a certificate that can be used to authentication to on-premises resources. @@ -687,7 +707,7 @@ You have successfully completed the configuration. Add users that need to enrol > [!div class="checklist"] > * Requirements > * Prepare Azure AD Connect -> * Prepare the Network Device Enrollment Services (NDES) Service Acccount +> * Prepare the Network Device Enrollment Services (NDES) Service Account > * Prepare Active Directory Certificate Authority > * Install and Configure the NDES Role > * Configure Network Device Enrollment Services to work with Microsoft Intune diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index c2550cdfa7..0088ba56ad 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Trust New Installation (Windows Hello for Business) -description: Windows Hello for Business Hybrid baseline deployment +description: Learn about new installations for Windows Hello for Business certificate trust and the various technologies hybrid certificate trust depoyments rely on. keywords: identity, PIN, biometric, Hello, passport, WHFB ms.prod: w10 ms.mktglfcycl: deploy @@ -100,12 +100,12 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h ## Multifactor Authentication Services Windows Hello for Business uses multi-factor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multi-factor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA -Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. +Review the [What is Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. -### Azure Multi-Factor Authentication (MFA) Cloud ### +### Azure AD Multi-Factor Authentication (MFA) Cloud ### > [!IMPORTANT] -> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: -> * Azure Multi-Factor Authentication +> As long as your users have licenses that include Azure AD Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> * Azure AD Multi-Factor Authentication > * Azure Active Directory Premium > * Enterprise Mobility + Security > @@ -115,7 +115,7 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant. #### Configure Azure MFA Settings #### -Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. +Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure AD Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. #### Azure MFA User States #### After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. @@ -126,12 +126,13 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ### Section Review > [!div class="checklist"] -> * Review the overview and uses of Azure Multifactor Authentication. -> * Review your Azure Active Directory subscription for Azure Multifactor Authentication. -> * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multifactor Authentication features and settings. -> * Understand the different User States and their effect on Azure Multifactor Authentication. -> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary. + +> * Review the overview and uses of Azure AD Multi-Factor Authentication Authentication. +> * Review your Azure Active Directory subscription for Azure AD Multi-Factor Authentication. +> * Create an Azure AD Multi-Factor Authentication Provider, if necessary. +> * Configure Azure AD Multi-Factor Authentication features and settings. +> * Understand the different User States and their effect on Azure AD Multi-Factor Authentication. +> * Consider using Azure AD Multi-Factor Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary. > [!div class="nextstepaction"] > [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index cf63fb2c17..81afb0421e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -57,12 +57,12 @@ To do this, follow the **Configure device settings** steps under [Setting up Azu Azure Active Directory is now configured for device registration. Next, you need to configure the on-premises Active Directory to support synchronizing hybrid Azure AD joined devices. Begin with upgrading the Active Directory Schema -### Upgrading Active Directory to the Windows Server 2016 Schema +### Upgrading Active Directory to the Windows Server 2016 or later Schema -To use Windows Hello for Business with Hybrid Azure AD joined devices, you must first upgrade your Active Directory schema to Windows Server 2016. +To use Windows Hello for Business with Hybrid Azure AD joined devices, you must first upgrade your Active Directory schema to Windows Server 2016 or later. > [!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your forest, you can skip **Upgrading Active Directory to the Windows Server 2016 Schema** (this section). +> If you already have a Windows Server 2016 or later domain controller in your forest, you can skip **Upgrading Active Directory to the Windows Server 2016 or later Schema** (this section). #### Identify the schema role domain controller @@ -78,7 +78,7 @@ The command should return the name of the domain controller where you need to ru Windows Hello for Business uses asymmetric keys as user credentials (rather than passwords). During enrollment, the public key is registered in an attribute on the user object in Active Directory. The schema update adds this new attribute to Active Directory. -Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. +Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 or later DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. Sign-in to the domain controller hosting the schema master operational role using enterprise administrator equivalent credentials. @@ -506,7 +506,7 @@ The following script helps you with the creation of the issuance transform rules #### Configure Device Authentication in AD FS Using an elevated PowerShell command window, configure AD FS policy by executing the following command -`PS C:>Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $true -DeviceAuthenticationMethod All` +`PS C:>Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $true -DeviceAuthenticationMethod SignedToken` #### Check your configuration For your reference, below is a comprehensive list of the AD DS devices, containers and permissions required for device write-back and authentication to work diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index f7a5eed854..09d9929b85 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -1,6 +1,6 @@ --- title: Hybrid Windows Hello for Business Prerequisites -description: Prerequisites for hybrid Windows Hello for Business deployments using certificate trust. +description: Learn these prerequisites for hybrid Windows Hello for Business deployments using certificate trust. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -39,7 +39,7 @@ Hybrid Windows Hello for Business needs two directories: on-premises Active Dire A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. Different deployment configurations are supported by different Azure subscriptions. The hybrid-certificate trust deployment needs an Azure Active Directory premium subscription because it uses the device write-back synchronization feature. Other deployments, such as the hybrid key-trust deployment, may not require Azure Active Directory premium subscription. -Windows Hello for Business can be deployed in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory schema. +Windows Hello for Business can be deployed in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory or later schema. Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs. @@ -49,7 +49,7 @@ Review these requirements and those from the Windows Hello for Business planning > * Active Directory Domain Functional Level > * Active Directory Forest Functional Level > * Domain Controller version -> * Windows Server 2016 Schema +> * Windows Server 2016 or later Schema > * Azure Active Directory subscription > * Correct subscription for desired features and outcomes diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index ea04aadb72..2857501f75 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -1,6 +1,6 @@ --- title: Hybrid Certificate Trust Deployment (Windows Hello for Business) -description: Hybrid Certificate Trust Deployment Overview +description: Learn the information you need to successfully deploy Windows Hello for Business in a hybrid certificate trust scenario. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index 9d05788513..c9ea9e18f9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -1,6 +1,6 @@ --- title: Hybrid Windows Hello for Business Provisioning (Windows Hello for Business) -description: Provisioning for hybrid certificate trust deployments of Windows Hello for Businesss. +description: In this article, learn about provisioning for hybrid certificate trust deployments of Windows Hello for Businesss. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index be3bc06968..cfb8b164f0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -13,18 +13,20 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 08/20/2018 +ms.date: 01/14/2021 ms.reviewer: --- # Configure Windows Hello for Business: Active Directory Federation Services **Applies to** -- Windows10, version 1703 or later -- Hybrid deployment -- Certificate trust + +- Windows 10, version 1703 or later +- Hybrid deployment +- Certificate trust ## Federation Services -The Windows Server 2016 Active Directory Federation Server Certificate Registration Authority (AD FS RA) enrolls for an enrollment agent certificate. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. + +The Windows Server 2016 Active Directory Federation Server Certificate Registration Authority (AD FS RA) enrolls for an enrollment agent certificate. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. The Windows Hello for Business Authentication certificate template is configured to only issue certificates to certificate requests that have been signed with an enrollment agent certificate. @@ -36,16 +38,14 @@ The Windows Hello for Business Authentication certificate template is configured Sign-in the AD FS server with *Domain Admin* equivalent credentials. 1. Open a **Windows PowerShell** prompt. -2. Type the following command +2. Enter the following command: ```PowerShell Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication -WindowsHelloCertificateProxyEnabled $true ``` - ->[!NOTE] -> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. - + >[!NOTE] + > If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the preceding command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template by using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name by using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. ### Group Memberships for the AD FS Service Account @@ -58,16 +58,32 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 1. Open **Active Directory Users and Computers**. 2. Click the **Users** container in the navigation pane. -3. Right-click **Windows Hello for Business Users** group -4. Click the **Members** tab and click **Add** +3. Right-click **Windows Hello for Business Users** group. +4. Click the **Members** tab and click **Add**. 5. In the **Enter the object names to select** text box, type **adfssvc** or substitute the name of the AD FS service account in your AD FS deployment. Click **OK**. 6. Click **OK** to return to **Active Directory Users and Computers**. 7. Restart the AD FS server. +> [!NOTE] +> For AD FS 2019, if Windows Hello for Business with a Hybrid Certificate trust is performed, a known PRT issue exists. You may encounter this error in ADFS Admin event logs: Received invalid Oauth request. The client 'NAME' is forbidden to access the resource with scope 'ugs'. To remediate this error: +> +> 1. Launch AD FS management console. Browse to "Services > Scope Descriptions". +> 2. Right click "Scope Descriptions" and select "Add Scope Description". +> 3. Under name type "ugs" and Click Apply > OK. +> 4. Launch PowerShell as an administrator. +> 5. Get the ObjectIdentifier of the application permission with the ClientRoleIdentifier parameter equal to "38aa3b87-a06d-4817-b275-7a316988d93b": +> ```PowerShell +> (Get-AdfsApplicationPermission -ServerRoleIdentifiers 'http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope' | ?{ $_.ClientRoleIdentifier -eq '38aa3b87-a06d-4817-b275-7a316988d93b' }).ObjectIdentifier +> ``` +> 6. Execute the command `Set-AdfsApplicationPermission -TargetIdentifier -AddScope 'ugs'`. +> 7. Restart the AD FS service. +> 8. On the client: Restart the client. User should be prompted to provision Windows Hello for Business. + ### Section Review + > [!div class="checklist"] -> * Configure the registration authority -> * Update group memberships for the AD FS service account +> * Configure the registration authority. +> * Update group memberships for the AD FS service account. > > > [!div class="step-by-step"] diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 16c17aa3f9..efeaaacd05 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -16,19 +16,20 @@ localizationpriority: medium ms.date: 10/23/2017 ms.reviewer: --- + # Configure Hybrid Windows Hello for Business: Directory Synchronization **Applies to** - Windows 10, version 1703 or later - Hybrid deployment -- Certificate trust +- Key trust ## Directory Synchronization -In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. +In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. -The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. +The key-trust model needs Windows Server 2016 domain controllers, which configure the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. > [!IMPORTANT] > If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. In this case, you should use the pre-created group KeyAdmins in step 3 of the "Group Memberships for the Azure AD Connect Service Account" section of this article. @@ -45,12 +46,12 @@ Sign-in a domain controller or management workstations with *Domain Admin* equiv 6. In the **Applies to** list box, select **Descendant User objects**. 7. Using the scroll bar, scroll to the bottom of the page and click **Clear all**. 8. In the **Properties** section, select **Read msDS-KeyCredentialLink** and **Write msDS-KeyCredentialLink**. -9. Click **OK** three times to complete the task. +9. Click **OK** three times to complete the task. ### Group Memberships for the Azure AD Connect Service Account -The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. +The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. @@ -61,12 +62,18 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. 6. Click **OK** to return to **Active Directory Users and Computers**. +> [!NOTE] +> If your AD forest has multiple domains, make sure you add the ADConnect sync service account (ie. MSOL_12121212) into "Enterprise Key Admins" group to gain permission across the domains in the forest. + +> [!NOTE] +> Transfer the PDC emulator FSMO role to a domain controller running Windows Server 2016 (or later) to be able to search the Key Admins and Enterprise Key Admins groups (domain controllers running previous versions of Windows Server cannot translate the security identifier to a name for these groups). + ### Section Review > [!div class="checklist"] > * Configure Permissions for Key Synchronization > * Configure group membership for Azure AD Connect -> +> > [!div class="step-by-step"] > [< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) > [Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 7c4e019e6d..2b5e042c13 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -13,182 +13,269 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 08/19/2018 +ms.date: 01/14/2021 ms.reviewer: --- # Configure Hybrid Windows Hello for Business: Public Key Infrastructure **Applies to** -- Windows 10, version 1703 or later -- Hybrid Deployment -- Certificate Trust +- Windows 10, version 1703 or later +- Hybrid Deployment +- Certificate Trust -Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certificates to validate the name of the server to which they are connecting and to encrypt the data that flows them and the client computer. +Windows Hello for Business deployments rely on certificates. Hybrid deployments use publicly-issued server authentication certificates to validate the name of the server to which they are connecting and to encrypt the data that flows between them and the client computer. -All deployments use enterprise issued certificates for domain controllers as a root of trust. Hybrid certificate trust deployments issue users sign-in certificate that enables them to authenticate using Windows Hello for Business credentials to non-Windows Server 2016 domain controllers. Additionally, hybrid certificate trust deployments issue certificate to registration authorities to provide defense-in-depth security for issuing user authentication certificates. +All deployments use enterprise issued certificates for domain controllers as a root of trust. Hybrid certificate trust deployments issue users with a sign-in certificate that enables them to authenticate using Windows Hello for Business credentials to non-Windows Server 2016 domain controllers. Additionally, hybrid certificate trust deployments issue certificates to registration authorities to provide defense-in-depth security when issuing user authentication certificates. ## Certificate Templates -This section has you configure certificate templates on your Windows Server 2012 or later issuing certificate authority. +This section has you configure certificate templates on your Windows Server 2012 (or later) Active Directory Certificate Services issuing certificate authority. ### Domain Controller certificate template Clients need to trust domain controllers and the best way to do this is to ensure each domain controller has a Kerberos Authentication certificate. Installing a certificate on the domain controller enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. This provides clients a root of trust external to the domain - namely the enterprise certificate authority. -Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template. +Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Inclusion of the **KDC Authentication** OID in domain controller certificate is not required for key trust authentication from Hybrid Azure AD joined devices. The OID is required for enabling authentication with Windows Hello for Business to on-premises resources by Azure AD joined devices. The steps below to *Create a Domain Controller Authentication (Kerberos) Certificate Template* and *Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template* to include the **KDC Authentication** OID in the domain controller certificate may be skipped if you only have Hybrid Azure AD Joined devices in your environment, but we recommend completing these steps if you are considering adding Azure AD joined devices to your environment in the future. -By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template a baseline to create an updated domain controller certificate template. +By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template as a baseline to create an updated domain controller certificate template. #### Create a Domain Controller Authentication (Kerberos) Certificate Template Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. +1. Open the **Certification Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. - **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. + +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. + + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. + 6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. + +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. + 8. Close the console. #### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template -Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. +Many domain controllers may have an existing domain controller certificate. Active Directory Certificate Services provides a default certificate template for domain controllers--the Domain Controller certificate template. Later releases provided a new certificate template--the Domain Controller Authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. -The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). +The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers (2008 or later). -The auto-enrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. +The auto-enrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate based on the Kerberos Authentication certificate template. Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. +1. Open the **Certification Authority** management console. + 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. + 4. Click the **Superseded Templates** tab. Click **Add**. + 5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. + 6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. + +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template, and click **OK**. + 8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. + 9. Click **OK** and close the **Certificate Templates** console. -The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. +The certificate template is configured to supersede all the certificate templates listed in the superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. > [!NOTE] -> * The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. -> * If you are using a 3rd party CA, add the certificate to the NTAuth store. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail. +> A domain controller's certificate must chain to a certificate in the NTAuth store in Active Directory. By default, online "Enterprise" Active Directory Certificate Authority certificates are added to the NTAuth store at installation time. If you are using a third-party CA, this is not done by default. If the domain controller certificate does not chain to a trusted CA in the NTAuth store, user authentication will fail. +> You can view an AD forest's NTAuth store (NTAuthCertificates) using PKIVIEW.MSC from an ADCS CA. Open PKIView.msc, then click the Action menu -> Manage AD Containers. ### Enrollment Agent certificate template -Active Directory Federation Server used for Windows Hello for Business certificate enrollment performs its own certificate life-cycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request or when the service first starts. +Active Directory Federation Server used for Windows Hello for Business certificate enrollment performs its own certificate lifecycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request, or when the service first starts. -Approximately 60 days prior to enrollment agent certificate's expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew, and the certificate expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate. +Approximately 60 days prior to the enrollment agent certificate's expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew and expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate. > [!IMPORTANT] -> Follow the procedures below based on the AD FS service account used in your environment. +> Follow the procedures below based on the AD FS service account used in your environment. #### Creating an Enrollment Agent certificate for Group Managed Service Accounts -Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. +Sign-in to a certificate authority or management workstation with _Domain Admin_ equivalent credentials. + +1. Open the **Certification Authority Management** console. -1. Open the **Certificate Authority Management** console. 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template Console**, right click on the **Exchange Enrollment Agent (Offline request)** template details pane and click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. + 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. -6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. - **Note:** The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. + +6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. + + > [!NOTE] + > The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the _Build from this Active Directory information_ option, which will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with _Supply in the request_ to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. -8. On the **Security** tab, click **Add**. + +8. On the **Security** tab, click **Add**. + 9. Click **Object Types**. Select the **Service Accounts** check box and click **OK**. + 10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. -11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. + +11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. + 12. Close the console. -#### Creating an Enrollment Agent certificate for typical Service Acconts +#### Creating an Enrollment Agent certificate for typical Service Accounts -Sign-in a certificate authority or management workstations with *Domain Admin* equivalent credentials. +Sign-in to a certificate authority or management workstation with *Domain Admin* equivalent credentials. + +1. Open the **Certification Authority** management console. -1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. + 3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent (Offline request)** template in the details pane and click **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. + 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + 6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. + 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. + 8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. -9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. + +9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. + 10. Close the console. ### Creating Windows Hello for Business authentication certificate template -During Windows Hello for Business provisioning, the Windows 10, version 1703 client requests an authentication certificate from the Active Directory Federation Service, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring. +During Windows Hello for Business provisioning, a Windows 10 client requests an authentication certificate from the Active Directory Federation Service, which requests an authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You set the name of the certificate template when configuring it. -Sign-in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. +Sign-in to a certificate authority or management workstation with _Domain Admin equivalent_ credentials. + +1. Open the **Certification Authority** management console. -1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. + 3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. + 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. - **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. -6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. + +5. On the **General** tab, type **WHFB Authentication** or your choice of template name in **Template display name**. Note the short template name for later use with CertUtil. Adjust the validity and renewal period to meet your enterprise's needs. + + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in the relevant portions of the deployment. + +6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. + 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. + 8. On the **Issuance Requirements** tab, select the **This number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + + Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + 9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. + 10. On the **Request Handling** tab, select the **Renew with same key** check box. + 11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. + 12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Read**, **Enroll**, and **AutoEnroll** permissions. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. + 13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. + 14. Click on the **Apply** to save changes and close the console. #### Mark the template as the Windows Hello Sign-in template Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equivalent credentials. + 1. Open an elevated command prompt. + 2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY` +If the template was changed successfully, the output of the command will contain old and new values of the template parameters. The new value must contain the **CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY** parameter. Example: + +```console +CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=[yourdomain]:WHFBAuthentication + +Old Value: +msPKI-Private-Key-Flag REG_DWORD = 5050080 (84213888) +CTPRIVATEKEY_FLAG_REQUIRE_SAME_KEY_RENEWAL -- 80 (128) +CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0 +TEMPLATE_SERVER_VER_WINBLUE< [!NOTE] -> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. +> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. ## Publish Templates ### Publish Certificate Templates to a Certificate Authority -The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. +The certificate authority only issues certificates for certificate templates which are published by that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. #### Publish Certificate Templates to the Certificate Authority Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, **WHFB Enrollment Agent** and **WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. Close the console. +1. Open the **Certification Authority** management console. + +2. Expand the parent node from the navigation pane. + +3. Click **Certificate Templates** in the navigation pane. + +4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template to issue**. + +5. In the **Enable Certificates Templates** window, Ctrl-select the **Domain Controller Authentication (Kerberos)**, **WHFB Enrollment Agent** and **WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. + +6. Close the console. #### Unpublish Superseded Certificate Templates -The certificate authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certificate authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. +The certificate authority only issues certificates based on published certificate templates. For defense-in-depth security, it is a good practice to unpublish certificate templates that the certificate authority is not configured to issue. This includes any pre-published certificate templates from the role installation and any superseded certificate templates. -The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. +The newly-created Kerberos authentication-based Domain Controller certificate template supersedes any previous domain controller certificate templates. Therefore, you should unpublish these certificate templates from all issuing certificate authorities. -Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. +Sign-in to each certificate authority, or a management workstation with _Enterprise Admin_ equivalent credentials. + +1. Open the **Certification Authority** management console. -1. Open the **Certificate Authority** management console. 2. Expand the parent node from the navigation pane. + 3. Click **Certificate Templates** in the navigation pane. + 4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. + 5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. - ### Section Review + > [!div class="checklist"] > * Domain Controller certificate template > * Configure superseded domain controller certificate templates @@ -198,7 +285,6 @@ Sign-in to the certificate authority or management workstation with _Enterprise > * Publish Certificate templates to certificate authorities > * Unpublish superseded certificate templates > -> > [!div class="step-by-step"] > [< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) > [Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) @@ -208,10 +294,10 @@ Sign-in to the certificate authority or management workstation with _Enterprise
            ## Follow the Windows Hello for Business hybrid certificate trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: PKI (*You are here*) 6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) - diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index fba1fd76f8..2f6f72752a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -1,6 +1,6 @@ --- title: Configure Hybrid Windows Hello for Business Settings (Windows Hello for Business) -description: Configuring Windows Hello for Business settings in hybrid certificate trust deployment. +description: Learn how to configure Windows Hello for Business settings in hybrid certificate trust deployment. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index 9c4dba47c8..958991988c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Key Trust New Installation -description: Learn how to perform a hybrid key trust deployment of Windows Hello for Business, for systems with no previous installations. +description: Learn how to configure a hybrid key trust deployment of Windows Hello for Business for systems with no previous installations. keywords: identity, PIN, biometric, Hello, passport, WHFB ms.prod: w10 ms.mktglfcycl: deploy @@ -110,13 +110,13 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h ## Multifactor Authentication Services Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA or a third-party MFA adapter -Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. +Review the [What is Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. -### Azure Multi-Factor Authentication (MFA) Cloud +### Azure AD Multi-Factor Authentication (MFA) Cloud > [!IMPORTANT] -> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: -> * Azure Multi-Factor Authentication +> As long as your users have licenses that include Azure AD Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> * Azure AD Multi-Factor Authentication > * Azure Active Directory Premium > * Enterprise Mobility + Security > @@ -124,7 +124,7 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co #### Configure Azure MFA Settings -Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. +Review the [Configure Azure AD Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. #### Azure MFA User States After you have completed configuring your Azure MFA settings, you want to review [How to require two-step verification for a user](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. @@ -135,12 +135,12 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ### Section Review > [!div class="checklist"] -> * Review the overview and uses of Azure Multifactor Authentication. -> * Review your Azure Active Directory subscription for Azure Multifactor Authentication. -> * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multifactor Authentication features and settings. -> * Understand the different User States and their effect on Azure Multifactor Authentication. -> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. +> * Review the overview and uses of Azure AD Multi-Factor Authentication. +> * Review your Azure Active Directory subscription for Azure AD Multi-Factor Authentication. +> * Create an Azure AD Multi-Factor Authentication Provider, if necessary. +> * Configure Azure AD Multi-Factor Authentication features and settings. +> * Understand the different User States and their effect on Azure AD Multi-Factor Authentication. +> * Consider using Azure AD Multi-Factor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. > [!div class="nextstepaction"] > [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 97c87a6d14..1a946e82dc 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -1,6 +1,6 @@ --- title: Hybrid Key trust Windows Hello for Business Prerequisites (Windows Hello for Business) -description: Prerequisites for hybrid Windows Hello for Business deployments using key trust. +description: Learn about the prerequisites for hybrid Windows Hello for Business deployments using key trust and what the next steps are in the deployment process. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -40,7 +40,9 @@ Hybrid Windows Hello for Business needs two directories: on-premises Active Dire A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription. -You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. However, the key trust deployment needs an ***adequate*** number of Windows Server 2016 or later domain controllers at each site where users authenticate using Windows Hello for Business. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. +You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. +If using the key trust deployment model, you MUST ensure that you have adequate (1 or more, depending on your authentication load) Windows Server 2016 or later Domain Controllers in each Active Directory site where users will be authenticating for Windows Hello for Business. +Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. > [!NOTE] >There was an issue with key trust authentication on Windows Server 2019. If you are planning to use Windows Server 2019 domain controllers refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044) to fix this issue. @@ -63,18 +65,17 @@ The Windows Hello for Business deployment depends on an enterprise public key in Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. -The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. +The minimum required Enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party Enterprise certification authority. The requirements for the domain controller certificate are shown below. For more details, see [Requirements for domain controller certificates from a third-party CA](https://support.microsoft.com/help/291010/requirements-for-domain-controller-certificates-from-a-third-party-ca). -* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. -* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). +* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL, or an Authority Information Access (AIA) extension that points to an Online Certificate Status Protocol (OCSP) responder. +* The certificate Subject section should contain the directory path of the server object (the distinguished name). * The certificate Key Usage section must contain Digital Signature and Key Encipherment. * Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None]. * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. -* The certificate template must have an extension that has the BMP data value "DomainController". -* The domain controller certificate must be installed in the local computer's certificate store. +* The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](https://docs.microsoft.com/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. +* The domain controller certificate must be installed in the local computer's certificate store. See [Configure Hybrid Windows Hello for Business: Public Key Infrastructure](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki) for details. - > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index 1f4f6b976d..63743f3ea2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -1,6 +1,6 @@ --- title: Hybrid Key Trust Deployment (Windows Hello for Business) -description: Hybrid Key Trust Deployment Overview +description: Review this deployment guide to successfully deploy Windows Hello for Business in a hybrid key trust scenario. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 85992e20d5..5a790c046a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -1,6 +1,6 @@ --- title: Hybrid Windows Hello for Business key trust Provisioning (Windows Hello for Business) -description: Provisioning for hybrid key trust deployments of Windows Hello for Business. +description: Learn about provisioning for hybrid key trust deployments of Windows Hello for Business and learn where to find the hybrid key trust deployment guide. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy @@ -27,7 +27,7 @@ ms.reviewer: ## Provisioning The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. -![Event358](images/Event358.png) +![Event358](images/Event358-2.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. @@ -57,9 +57,6 @@ The remainder of the provisioning includes Windows Hello for Business requesting > **This synchronization latency delays the user's ability to authenticate and use on-premises resources until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. > Read [Azure AD Connect sync: Scheduler](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. -> [!NOTE] -> Microsoft is actively investigating ways to reduce the synchronization latency and delays. -


            diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index ce98019039..3bd0bbe112 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -39,7 +39,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 2. Click the **Users** container in the navigation pane. 3. Right-click **Key Admins** in the details pane and click **Properties**. 4. Click the **Members** tab and click **Add** -5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. +5. In the **Enter the object names to select** text box, type the name of the service account used as an AD DS Connector account and click **OK**. 6. Click **OK** to return to **Active Directory Users and Computers**. ### Section Review diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index bbe8176263..c05de0195e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -13,31 +13,31 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 08/19/2018 +ms.date: 01/14/2021 ms.reviewer: --- # Configure Hybrid Windows Hello for Business: Public Key Infrastructure **Applies to** -- Windows 10, version 1703 or later -- Hybrid Deployment -- Key trust +- Windows 10, version 1703 or later +- Hybrid Deployment +- Key trust Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certificates to validate the name of the server to which they are connecting and to encrypt the data that flows them and the client computer. -All deployments use enterprise issued certificates for domain controllers as a root of trust. +All deployments use enterprise issued certificates for domain controllers as a root of trust. ## Certificate Templates -This section has you configure certificate templates on your Windows Server 2012 or later issuing certificate authority. +This section has you configure certificate templates on your Windows Server 2012 or later issuing certificate authority. ### Domain Controller certificate template Clients need to trust domain controllers and the best way to do this is to ensure each domain controller has a Kerberos Authentication certificate. Installing a certificate on the domain controller enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. This provides clients a root of trust external to the domain - namely the enterprise certificate authority. -Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template. +Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Inclusion of the **KDC Authentication** OID in domain controller certificate is not required for key trust authentication from Hybrid Azure AD joined devices. The OID is required for enabling authentication with Windows Hello for Business to on-premises resources by Azure AD joined devices. The steps below to update the domain controller certificate to include the **KDC Authentication** OID may be skipped if you only have Hybrid Azure AD Joined devices in your environment, but we recommend completing these steps if you are considering adding Azure AD joined devices to your environment in the future. By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template a baseline to create an updated domain controller certificate template. @@ -49,10 +49,10 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 2. Right-click **Certificate Templates** and click **Manage**. 3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. 6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. 8. Close the console. >[!NOTE] @@ -80,8 +80,8 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. ->[!NOTE] ->The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail. +> [!NOTE] +> The domain controller's certificate must chain to a root in the NTAuth store. By default, the Active Directory Certificate Authority's root certificate is added to the NTAuth store. If you are using a third-party CA, this may not be done by default. If the domain controller certificate does not chain to a root in the NTAuth store, user authentication will fail. ### Publish Certificate Templates to a Certificate Authority @@ -113,13 +113,13 @@ Sign-in to the certificate authority or management workstation with _Enterprise 5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Section Review + > [!div class="checklist"] > * Domain Controller certificate template > * Configure superseded domain controller certificate templates > * Publish Certificate templates to certificate authorities > * Unpublish superseded certificate templates -> -> +> s > [!div class="step-by-step"] > [< Configure Azure AD Connect](hello-hybrid-key-whfb-settings-dir-sync.md) > [Configure policy settings >](hello-hybrid-key-whfb-settings-policy.md) @@ -129,6 +129,7 @@ Sign-in to the certificate authority or management workstation with _Enterprise
            ## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 440ab1ea70..d7355b0c32 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -74,9 +74,12 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv The Windows Hello for Business Group Policy object delivers the correct Group Policy settings to the user, which enables them to enroll and use Windows Hello for Business to authenticate to Azure and Active Directory +> [!NOTE] +> If you deployed Windows Hello for Business configuration using both Group Policy and Microsoft Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more details about deploying Windows Hello for Business configuration using Microsoft Intune, see [Windows 10 device settings to enable Windows Hello for Business in Intune](https://docs.microsoft.com/mem/intune/protect/identity-protection-windows-settings) and [PassportForWork CSP](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp). For more details about policy conflicts, see [Policy conflicts from multiple policy sources](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization#policy-conflicts-from-multiple-policy-sources) + #### Enable Windows Hello for Business -The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. +The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index d8eb2ac3ed..9103431811 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -1,6 +1,6 @@ --- title: Configure Hybrid Windows Hello for Business key trust Settings -description: Configuring Windows Hello for Business settings in hybrid key trust deployment. +description: Begin the process of configuring your hybrid key trust environment for Windows Hello for Business. Start with your Active Directory configuration. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 3e982143da..d53a57bff1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -1,6 +1,6 @@ --- -title: Windows Hello for Business (Windows 10) -description: Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. +title: Windows Hello for Business Deployment Prerequisite Overview +description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E ms.reviewer: keywords: identity, PIN, biometric, Hello, passport @@ -15,44 +15,30 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 05/05/2018 +ms.date: 1/22/2021 --- -# Windows Hello for Business +# Windows Hello for Business Deployment Prerequisite Overview -In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.
            -Windows Hello for Business lets user authenticate to an Active Directory or Azure Active Directory account. +This article lists the infrastructure requirements for the different deployment models for Windows Hello for Business. -Windows Hello addresses the following problems with passwords: - -- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. -- Server breaches can expose symmetric network credentials (passwords). -- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). -- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing). - -> | | | | -> | :---: | :---: | :---: | -> | [![Overview Icon](images/hello_filter.png)](hello-overview.md)
            [Overview](hello-overview.md) | [![Why a PIN is better than a password Icon](images/hello_lock.png)](hello-why-pin-is-better-than-password.md)
            [Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [![Manage Hello Icon](images/hello_gear.png)](hello-manage-in-organization.md)
            [Manage Windows Hello in your Organization](hello-manage-in-organization.md) | - -## Prerequisites - -### Cloud Only Deployment +## Cloud Only Deployment * Windows 10, version 1511 or later * Microsoft Azure Account * Azure Active Directory -* Azure Multi-factor authentication +* Azure AD Multi-Factor Authentication * Modern Management (Intune or supported third-party MDM), *optional* * Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory -### Hybrid Deployments +## Hybrid Deployments -The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process. +The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process. | Key trust
            Group Policy managed | Certificate trust
            Mixed managed | Key trust
            Modern managed | Certificate trust
            Modern managed | | --- | --- | --- | --- | | Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**
            *Minimum:* Windows 10, version 1703
            *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).
            **Azure AD Joined:**
            Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later | -| Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | +| Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | Windows Server 2016 or later Schema | | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level| Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level | | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | @@ -75,7 +61,7 @@ The table shows the minimum requirements for each deployment. For key trust in a > Reset above lock screen - Windows 10, version 1709, Professional
            > Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 -### On-premises Deployments +## On-premises Deployments The table shows the minimum requirements for each deployment. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index 26a28b9593..8042bad1d8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -24,10 +24,10 @@ ms.reviewer: - Key trust -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. -Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. +Alternatively, you can create a copy of the .ADMX and .ADML files from a Windows 10, version 1703 installation setup template folder to their respective language folder on a Windows Server, or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. On-premises certificate-based deployments of Windows Hello for Business needs one Group Policy setting: Enable Windows Hello for Business diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 93ca09aa2f..1a4dcd1e37 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -1,14 +1,13 @@ --- -title: Key registration for on-premises deployment of Windows Hello for Business +title: Key registration for on-premises deployment of Windows Hello for Business description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the key trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile -author: DaniHalfin +author: dansimp audience: ITPro -author: mikestephens-MS ms.author: dolmont manager: dansimp ms.collection: M365-identity-device-management @@ -30,7 +29,7 @@ Key trust deployments need an adequate number of 2016 or later domain controller > [!NOTE] >There was an issue with key trust authentication on Windows Server 2019. If you are planning to use Windows Server 2019 domain controllers refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044) to fix this issue. -The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. +The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. ## Create the Windows Hello for Business Users Security Global Group diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 6377afa5a8..ce54bf0ffb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -19,7 +19,7 @@ ms.reviewer: # Validate and Deploy Multi-factor Authentication (MFA) > [!IMPORTANT] -> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual. +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure AD Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual. **Applies to** diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 18f6f3dbf0..c21280812b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -15,7 +15,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 4/16/2017 +ms.date: 1/20/2021 --- # Manage Windows Hello for Business in your organization @@ -369,9 +369,11 @@ For more information about using the PIN recovery service for PIN reset see [Win Windows Hello for Business is designed to be managed by Group Policy or MDM but not a combination of both. If policies are set from both sources it can result in a mixed result of what is actually enforced for a user or device. -Policies for Windows Hello for Business are enforced using the following hierarchy: User Group Policy > Computer Group Policy > User MDM > Device MDM > Device Lock policy. All PIN complexity policies are grouped together and enforced from a single policy source. +Policies for Windows Hello for Business are enforced using the following hierarchy: User Group Policy > Computer Group Policy > User MDM > Device MDM > Device Lock policy. -Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies is enforced on a per policy basis. +Feature enablement policy and certificate trust policy are grouped together and enforced from the same source (either GP or MDM), based on the rule above. The Use Passport for Work policy is used to determine the winning policy source. + +All PIN complexity policies, are grouped separately from feature enablement and are enforced from a single policy source. Use a hardware security device and RequireSecurityDevice enforcement are also grouped together with PIN complexity policy. Conflict resolution for other Windows Hello for Business policies are enforced on a per policy basis. >[!NOTE] > Windows Hello for Business policy conflict resolution logic does not respect the ControlPolicyConflict/MDMWinsOverGP policy in the Policy CSP. @@ -382,8 +384,6 @@ Use a hardware security device and RequireSecurityDevice enforcement are also gr > >- Use Windows Hello for Business - Enabled >- User certificate for on-premises authentication - Enabled ->- Require digits - Enabled ->- Minimum PIN length - 6 > >The following are configured using device MDM Policy: > @@ -398,8 +398,10 @@ Use a hardware security device and RequireSecurityDevice enforcement are also gr > >- Use Windows Hello for Business - Enabled >- Use certificate for on-premises authentication - Enabled ->- Require digits - Enabled ->- Minimum PIN length - 6d +>- MinimumPINLength - 8 +>- Digits - 1 +>- LowercaseLetters - 1 +>- SpecialCharacters - 1 ## How to use Windows Hello for Business with Azure Active Directory diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 0b032dbbdc..80d8f81611 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -1,7 +1,7 @@ --- title: Windows Hello for Business Overview (Windows 10) ms.reviewer: An overview of Windows Hello for Business -description: An overview of Windows Hello for Business +description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices in Windows 10. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -94,12 +94,13 @@ For details, see [How Windows Hello for Business works](hello-how-it-works.md). Windows Hello for Business can use either keys (hardware or software) or certificates in hardware or software. Enterprises that have a public key infrastructure (PKI) for issuing and managing end user certificates can continue to use PKI in combination with Windows Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing user certificates can rely on key-based credentials for Windows Hello but still use certificates on their domain controllers as a root of trust. -Windows Hello for Business with a key does not support RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments. - +Windows Hello for Business with a key does not support supplied credentials for RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments as a supplied credential. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). ## Learn more -[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/itshowcase/implementing-windows-hello-for-business-at-microsoft) +[Implementing strong user authentication with Windows Hello for Business](https://www.microsoft.com/en-us/itshowcase/implementing-strong-user-authentication-with-windows-hello-for-business) + +[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/en-us/itshowcase/implementing-windows-hello-for-business-at-microsoft) [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 9369ea8370..57805caf8b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -1,6 +1,6 @@ --- title: Planning a Windows Hello for Business Deployment -description: A guide to planning a Windows Hello for Business deployment +description: Learn about the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of your infrastructure. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -13,18 +13,22 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: conceptual -ms.date: 08/19/2018 +ms.date: 09/16/2020 ms.reviewer: --- # Planning a Windows Hello for Business Deployment **Applies to** -- Windows 10 + +- Windows 10 Congratulations! You are taking the first step forward in helping move your organizations away from password to a two-factor, convenience authentication for Windows — Windows Hello for Business. This planning guide helps you understand the different topologies, architectures, and components that encompass a Windows Hello for Business infrastructure. This guide explains the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of the infrastructure. Armed with your planning worksheet, you'll use that information to select the correct deployment guide for your needs. +> [!Note] +>If you have an Azure tenant, you can use our online, interactive Passwordless Wizard which walks through the same choices instead of using our manual guide below. The Passwordless Wizard is available in the [Microsoft 365 admin center](https://admin.microsoft.com/AdminPortal/Home#/modernonboarding/passwordlesssetup). + ## Using this guide There are many options from which you can choose when deploying Windows Hello for Business. Providing multiple options ensures nearly every organization can deploy Windows Hello for Business. Providing many options makes the deployment appear complex, however, most organization will realize they've already implemented most of the infrastructure on which the Windows Hello for Business deployment depends. It is important to understand that Windows Hello for Business is a distributed system and does take proper planning across multiple teams within an organization. @@ -36,12 +40,13 @@ This guide removes the appearance of complexity by helping you make decisions on Read this document and record your decisions on the worksheet. When finished, your worksheet has all the necessary information for your Windows Hello for Business deployment. There are six major categories you need to consider for a Windows Hello for Business deployment. Those categories are: -* Deployment Options -* Client -* Management -* Active Directory -* Public Key Infrastructure -* Cloud + +- Deployment Options +- Client +- Management +- Active Directory +- Public Key Infrastructure +- Cloud ### Baseline Prerequisites @@ -56,13 +61,16 @@ The goal of Windows Hello for Business is to enable deployments for all organiza There are three deployment models from which you can choose: cloud only, hybrid, and on-premises. ##### Cloud only + The cloud only deployment model is for organizations who only have cloud identities and do not access on-premises resources. These organizations typically join their devices to the cloud and exclusively use resources in the cloud such as SharePoint, OneDrive, and others. Also, because these users do not use on-premises resources, they do not need certificates for things like VPN because everything they need is hosted in Azure. ##### Hybrid + The hybrid deployment model is for organizations that: -* Are federated with Azure Active Directory -* Have identities synchronized to Azure Active Directory using Azure Active Directory Connect -* Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources + +- Are federated with Azure Active Directory +- Have identities synchronized to Azure Active Directory using Azure Active Directory Connect +- Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources > [!Important] > Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
            @@ -88,10 +96,10 @@ A deployment's trust type defines how each Windows Hello for Business client aut The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 or later domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. -The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 Active Directory schema](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. +The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 or later Active Directory schema](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. > [!NOTE] -> RDP does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. +> RDP does not support authentication with Windows Hello for Business key trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). #### Device registration @@ -104,13 +112,13 @@ The built-in Windows Hello for Business provisioning experience creates a hardwa #### Multifactor authentication > [!IMPORTANT] -> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details. +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure AD Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure AD Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details. The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The built-in provisioning experience accepts the user's weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential. -Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure Multi-factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information). +Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure AD Multi-Factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information). > [!NOTE] -> Azure Multi-Factor Authentication is available through: +> Azure AD Multi-Factor Authentication is available through: > * Microsoft Enterprise Agreement > * Open Volume License Program > * Cloud Solution Providers program @@ -152,7 +160,7 @@ The Windows Hello for Business deployment depends on an enterprise public key in ### Cloud -Some deployment combinations require an Azure account, and some require Azure Active Directory for user identities. These cloud requirements may only need an Azure account while other features need an Azure Active Directory Premium subscription. The planning process identifies and differentiates the components that are needed from the those that are optional. +Some deployment combinations require an Azure account, and some require Azure Active Directory for user identities. These cloud requirements may only need an Azure account while other features need an Azure Active Directory Premium subscription. The planning process identifies and differentiates the components that are needed from those that are optional. ## Planning a Deployment @@ -166,16 +174,13 @@ Choose the deployment model based on the resources your users access. Use the f If your organization does not have on-premises resources, write **Cloud Only** in box **1a** on your planning worksheet. -If your organization is federated with Azure or uses any online service, such as Office365 or OneDrive, or your users' access cloud and on-premises resources, write **Hybrid** in box **1a** on your planning worksheet. +If your organization is federated with Azure or uses any service, such as AD Connect, Office365 or OneDrive, or your users access cloud and on-premises resources, write **Hybrid** in box **1a** on your planning worksheet. If your organization does not have cloud resources, write **On-Premises** in box **1a** on your planning worksheet. > [!NOTE] -> If you're unsure if your organization is federated, run the following Active Directory Windows PowerShell command from an elevated Windows PowerShell prompt and evaluate the results. -> ```Get-AdObject "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=[forest_root_CN_name],DC=com" -Properties keywords``` -> * If the command returns an error stating it could not find the object, then you have yet to configured AAD Connect or on-premises Device Registration Services using AD FS. Ensure the name is accurate and validate the object does not exist with another Active Directory Management tool such as **ADSIEdit.msc**. If the object truly does not exist, then your environment does not bind you to a specific deployment or require changes to accommodate the desired deployment type. -> * If the command returns a value, compare that value with the values below. The value indicates the deployment model you should implement -> * If the value begins with **azureADName:** – write **Hybrid** in box **1a**on your planning worksheet. -> * If the value begins with **enterpriseDrsName:** – write **On-Premises** in box **1a** on your planning worksheet. +> * Main use case of On-Premises deployment is for "Enhanced Security Administrative Environments" also known as "Red Forests". +> * Migration from on-premise to hybrid deployment will require redeployment. + ### Trust type @@ -333,7 +338,7 @@ Windows Hello for Business does not require an Azure AD premium subscription. H If box **1a** on your planning worksheet reads **on-premises**, write **No** in box **6c** on your planning worksheet. -If box **1a** on your planning worksheet reads **hybrid** and box **1b** reads **key trust**, write **No** in box **6c** on your planning worksheet. You can deploy Windows Hello for Business using the free Azure Active Directory account (additional costs needed for multi-factor authentication). +If box **1a** on your planning worksheet reads **hybrid** and box **1b** reads **key trust**, write **No** in box **6c** on your planning worksheet. You can deploy Windows Hello for Business using the Azure Active Directory free tier. All Azure Active Directory free accounts can use Azure AD Multi-Factor Authentication through the use of security defaults. Some Azure AD Multi-Factor Authentication features require a license. For more details, see [Features and licenses for Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/active-directory/authentication/concept-mfa-licensing). If box **5b** on your planning worksheet reads **AD FS RA**, write **Yes** in box **6c** on your planning worksheet. Enrolling a certificate using the AD FS registration authority requires devices to authenticate to the AD FS server, which requires device write-back, an Azure AD Premium feature. diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index 00eddf6eee..c53586ff18 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business Videos -description: Windows Hello for Business Videos +description: View several informative videos describing features and experiences in Windows Hello for Business in Windows 10. keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/identity-protection/hello-for-business/images/aadj/MEM.png b/windows/security/identity-protection/hello-for-business/images/aadj/MEM.png new file mode 100644 index 0000000000..d98d871f21 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadj/MEM.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png new file mode 100644 index 0000000000..46db47b6f0 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png new file mode 100644 index 0000000000..215b22ec23 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png new file mode 100644 index 0000000000..91dc9f58ba Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile04.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile04.png new file mode 100644 index 0000000000..d15801152e Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile04.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/event358-2.png b/windows/security/identity-protection/hello-for-business/images/event358-2.png new file mode 100644 index 0000000000..53fd554323 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/event358-2.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-home-screen.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-home-screen.png new file mode 100644 index 0000000000..fce622e7f7 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-home-screen.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-option.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-option.png new file mode 100644 index 0000000000..7415de9616 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-option.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png new file mode 100644 index 0000000000..970e9f8109 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png new file mode 100644 index 0000000000..9903a59bf5 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png differ diff --git a/windows/security/identity-protection/hello-for-business/index.yml b/windows/security/identity-protection/hello-for-business/index.yml new file mode 100644 index 0000000000..4282b8e701 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/index.yml @@ -0,0 +1,110 @@ +### YamlMime:Landing + +title: Windows Hello for Business documentation +summary: Learn how to manage and deploy Windows Hello for Business. + +metadata: + title: Windows Hello for Business documentation + description: Learn how to manage and deploy Windows Hello for Business. + ms.prod: w10 + ms.topic: landing-page + author: mapalko + manager: dansimp + ms.author: mapalko + ms.date: 01/22/2021 + ms.collection: M365-identity-device-management + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card + - title: About Windows Hello For Business + linkLists: + - linkListType: overview + links: + - text: Windows Hello for Business Overview + url: hello-overview.md + - linkListType: concept + links: + - text: Passwordless Strategy + url: passwordless-strategy.md + - text: Why a PIN is better than a password + url: hello-why-pin-is-better-than-password.md + - text: Windows Hello biometrics in the enterprise + url: hello-biometrics-in-enterprise.md + - text: How Windows Hello for Business works + url: hello-how-it-works.md + - linkListType: learn + links: + - text: Technical Deep Dive - Device Registration + url: hello-how-it-works-device-registration.md + - text: Technical Deep Dive - Provisioning + url: hello-how-it-works-provisioning.md + - text: Technical Deep Dive - Authentication + url: hello-how-it-works-authentication.md + - text: Technology and Terminology + url: hello-how-it-works-technology.md + - text: Frequently Asked Questions (FAQ) + url: hello-faq.yml + + # Card + - title: Configure and manage Windows Hello for Business + linkLists: + - linkListType: concept + links: + - text: Windows Hello for Business Deployment Overview + url: hello-deployment-guide.md + - text: Planning a Windows Hello for Business Deployment + url: hello-planning-guide.md + - text: Deployment Prerequisite Overview + url: hello-identity-verification.md + - linkListType: how-to-guide + links: + - text: Hybrid Azure AD Joined Key Trust Deployment + url: hello-hybrid-key-trust.md + - text: Hybrid Azure AD Joined Certificate Trust Deployment + url: hello-hybrid-cert-trust.md + - text: On-premises SSO for Azure AD Joined Devices + url: hello-hybrid-aadj-sso.md + - text: On-premises Key Trust Deployment + url: hello-deployment-key-trust.md + - text: On-premises Certificate Trust Deployment + url: hello-deployment-cert-trust.md + - linkListType: learn + links: + - text: Manage Windows Hello for Business in your organization + url: hello-manage-in-organization.md + - text: Windows Hello and password changes + url: hello-and-password-changes.md + - text: Prepare people to use Windows Hello + url: hello-prepare-people-to-use.md + + # Card + - title: Windows Hello for Business Features + linkLists: + - linkListType: how-to-guide + links: + - text: Conditional Access + url: hello-feature-conditional-access.md + - text: PIN Reset + url: hello-feature-pin-reset.md + - text: Dual Enrollment + url: hello-feature-dual-enrollment.md + - text: Dynamic Lock + url: hello-feature-dynamic-lock.md + - text: Multi-factor Unlock + url: feature-multifactor-unlock.md + - text: Remote Desktop + url: hello-feature-remote-desktop.md + + # Card + - title: Windows Hello for Business Troubleshooting + linkLists: + - linkListType: how-to-guide + links: + - text: Known Deployment Issues + url: hello-deployment-issues.md + - text: Errors During PIN Creation + url: hello-errors-during-pin-creation.md diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 57238c3214..87e71bc747 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -1,6 +1,6 @@ --- title: Passwordless Strategy -description: Reducing Password Usage Surface +description: Learn about the password-less strategy and how Windows Hello for Business implements this strategy in Windows 10. keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless ms.prod: w10 ms.mktglfcycl: deploy @@ -216,7 +216,7 @@ The policy name for these operating systems is **Interactive logon: Require Wind When you enable this security policy setting, Windows prevents users from signing in or unlocking with a password. The password credential provider remains visible to the user. If a user tries to use a password, Windows informs the user they must use Windows Hello for Business or a smart card. #### Excluding the password credential provider -You can use Group Policy to deploy an administrative template policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Administrative Templates > Logon** +You can use Group Policy to deploy an administrative template policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Administrative Templates > System > Logon** ![HideCredProvPolicy](images/passwordless/00-hidecredprov.png) The name of the policy setting is **Exclude credential providers**. The value to enter in the policy to hide the password credential provider is **60b78e88-ead8-445c-9cfd-0b87f74ea6cd**. diff --git a/windows/security/identity-protection/hello-for-business/toc.md b/windows/security/identity-protection/hello-for-business/toc.md deleted file mode 100644 index 3fe33458fc..0000000000 --- a/windows/security/identity-protection/hello-for-business/toc.md +++ /dev/null @@ -1,70 +0,0 @@ -# [Windows Hello for Business](hello-identity-verification.md) - -## [Password-less Strategy](passwordless-strategy.md) - -## [Windows Hello for Business Overview](hello-overview.md) -## [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) -## [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) - -## [Windows Hello for Business Features](hello-features.md) -### [Conditional Access](hello-feature-conditional-access.md) -### [Dual Enrollment](hello-feature-dual-enrollment.md) -### [Dynamic Lock](hello-feature-dynamic-lock.md) -### [Multifactor Unlock](feature-multifactor-unlock.md) -### [PIN Reset](hello-feature-pin-reset.md) -### [Remote Desktop](hello-feature-remote-desktop.md) - -## [How Windows Hello for Business works](hello-how-it-works.md) -### [Technical Deep Dive](hello-how-it-works.md#technical-deep-dive) -#### [Technology and Terminology](hello-how-it-works-technology.md) -#### [Device Registration](hello-how-it-works-device-registration.md) -#### [Provisioning](hello-how-it-works-provisioning.md) -#### [Authentication](hello-how-it-works-authentication.md) - -## [Planning a Windows Hello for Business Deployment](hello-planning-guide.md) - -## [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - -## [Windows Hello for Business Deployment Guide](hello-deployment-guide.md) - -### [Hybrid Azure AD Joined Key Trust Deployment](hello-hybrid-key-trust.md) -#### [Prerequisites](hello-hybrid-key-trust-prereqs.md) -#### [New Installation Baseline](hello-hybrid-key-new-install.md) -#### [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) -#### [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) -#### [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -#### [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) - -### [Hybrid Azure AD Joined Certificate Trust Deployment](hello-hybrid-cert-trust.md) -#### [Prerequisites](hello-hybrid-cert-trust-prereqs.md) -#### [New Installation Baseline](hello-hybrid-cert-new-install.md) -#### [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) -#### [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings.md) -#### [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) - -### [Azure AD Join Single Sign-on Deployment Guides](hello-hybrid-aadj-sso.md) -#### [Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business](hello-hybrid-aadj-sso-base.md) -#### [Using Certificates for AADJ On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md) - -### [On Premises Key Trust Deployment](hello-deployment-key-trust.md) -#### [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) -#### [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) -#### [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) -##### [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -#### [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) - -### [On Premises Certificate Trust Deployment](hello-deployment-cert-trust.md) -#### [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) -#### [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) -#### [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) -#### [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -#### [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) - -## [Windows Hello and password changes](hello-and-password-changes.md) -## [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) - -## [Windows Hello for Business Frequently Asked Questions (FAQ)](hello-faq.md) -### [Windows Hello for Business Videos](hello-videos.md) - -## [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) -## [Event ID 300 - Windows Hello successfully created](hello-event-300.md) diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml new file mode 100644 index 0000000000..8a29bb7d81 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/toc.yml @@ -0,0 +1,137 @@ +- name: Windows Hello for Business documentation + href: index.yml +- name: Overview + items: + - name: Windows Hello for Business Overview + href: hello-overview.md +- name: Concepts + expanded: true + items: + - name: Passwordless Strategy + href: passwordless-strategy.md + - name: Why a PIN is better than a password + href: hello-why-pin-is-better-than-password.md + - name: Windows Hello biometrics in the enterprise + href: hello-biometrics-in-enterprise.md + - name: How Windows Hello for Business works + href: hello-how-it-works.md + - name: Technical Deep Dive + items: + - name: Device Registration + href: hello-how-it-works-device-registration.md + - name: Provisioning + href: hello-how-it-works-provisioning.md + - name: Authentication + href: hello-how-it-works-authentication.md +- name: How-to Guides + items: + - name: Windows Hello for Business Deployment Overview + href: hello-deployment-guide.md + - name: Planning a Windows Hello for Business Deployment + href: hello-planning-guide.md + - name: Deployment Prerequisite Overview + href: hello-identity-verification.md + - name: Prepare people to use Windows Hello + href: hello-prepare-people-to-use.md + - name: Deployment Guides + items: + - name: Hybrid Azure AD Joined Key Trust + items: + - name: Hybrid Azure AD Joined Key Trust Deployment + href: hello-hybrid-key-trust.md + - name: Prerequisites + href: hello-hybrid-key-trust-prereqs.md + - name: New Installation Baseline + href: hello-hybrid-key-new-install.md + - name: Configure Directory Synchronization + href: hello-hybrid-key-trust-dirsync.md + - name: Configure Azure Device Registration + href: hello-hybrid-key-trust-devreg.md + - name: Configure Windows Hello for Business settings + href: hello-hybrid-key-whfb-settings.md + - name: Sign-in and Provisioning + href: hello-hybrid-key-whfb-provision.md + - name: Hybrid Azure AD Joined Certificate Trust + items: + - name: Hybrid Azure AD Joined Certificate Trust Deployment + href: hello-hybrid-cert-trust.md + - name: Prerequisites + href: hello-hybrid-cert-trust-prereqs.md + - name: New Installation Baseline + href: hello-hybrid-cert-new-install.md + - name: Configure Azure Device Registration + href: hello-hybrid-cert-trust-devreg.md + - name: Configure Windows Hello for Business settings + href: hello-hybrid-cert-whfb-settings.md + - name: Sign-in and Provisioning + href: hello-hybrid-cert-whfb-provision.md + - name: On-premises SSO for Azure AD Joined Devices + items: + - name: On-premises SSO for Azure AD Joined Devices Deployment + href: hello-hybrid-aadj-sso.md + - name: Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business + href: hello-hybrid-aadj-sso-base.md + - name: Using Certificates for AADJ On-premises Single-sign On + href: hello-hybrid-aadj-sso-cert.md + - name: On-premises Key Trust + items: + - name: On-premises Key Trust Deployment + href: hello-deployment-key-trust.md + - name: Validate Active Directory Prerequisites + href: hello-key-trust-validate-ad-prereq.md + - name: Validate and Configure Public Key Infrastructure + href: hello-key-trust-validate-pki.md + - name: Prepare and Deploy Windows Server 2016 Active Directory Federation Services + href: hello-key-trust-adfs.md + - name: Validate and Deploy Multi-factor Authentication (MFA) Services + href: hello-key-trust-validate-deploy-mfa.md + - name: Configure Windows Hello for Business policy settings + href: hello-key-trust-policy-settings.md + - name: On-premises Certificate Trust + items: + - name: On-premises Certificate Trust Deployment + href: hello-deployment-cert-trust.md + - name: Validate Active Directory Prerequisites + href: hello-cert-trust-validate-ad-prereq.md + - name: Validate and Configure Public Key Infrastructure + href: hello-cert-trust-validate-pki.md + - name: Prepare and Deploy Windows Server 2016 Active Directory Federation Services + href: hello-cert-trust-adfs.md + - name: Validate and Deploy Multi-factor Authentication (MFA) Services + href: hello-cert-trust-validate-deploy-mfa.md + - name: Configure Windows Hello for Business policy settings + href: hello-cert-trust-policy-settings.md + - name: Managing Windows Hello for Business in your organization + href: hello-manage-in-organization.md + - name: Windows Hello for Business Features + items: + - name: Conditional Access + href: hello-feature-conditional-access.md + - name: PIN Reset + href: hello-feature-pin-reset.md + - name: Dual Enrollment + href: hello-feature-dual-enrollment.md + - name: Dynamic Lock + href: hello-feature-dynamic-lock.md + - name: Multi-factor Unlock + href: feature-multifactor-unlock.md + - name: Remote Desktop + href: hello-feature-remote-desktop.md + - name: Troubleshooting + items: + - name: Known Deployment Issues + href: hello-deployment-issues.md + - name: Errors During PIN Creation + href: hello-errors-during-pin-creation.md + - name: Event ID 300 - Windows Hello successfully created + href: hello-event-300.md + - name: Windows Hello and password changes + href: hello-and-password-changes.md +- name: Reference + items: + - name: Technology and Terminology + href: hello-how-it-works-technology.md + - name: Frequently Asked Questions (FAQ) + href: hello-faq.yml + - name: Windows Hello for Business videos + href: hello-videos.md diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md index 98e0bb9835..dd87cded73 100644 --- a/windows/security/identity-protection/index.md +++ b/windows/security/identity-protection/index.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin +author: dansimp ms.author: daniha manager: dansimp ms.collection: M365-identity-device-management @@ -31,5 +31,5 @@ Learn more about identity and access management technologies in Windows 10 and | [Virtual Smart Cards](virtual-smart-cards/virtual-smart-card-overview.md) | Provides information about deploying and managing virtual smart cards, which are functionally similar to physical smart cards and appear in Windows as smart cards that are always-inserted. Virtual smart cards use the Trusted Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader. | | [VPN technical guide](vpn/vpn-guide.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. | | [Smart Cards](smart-cards/smart-card-windows-smart-card-technical-reference.md) | Provides a collection of references topics about smart cards, which are tamper-resistant portable storage devices that can enhance the security of tasks such as authenticating clients, signing code, securing e-mail, and signing in with a Windows domain account. | -| [Windows Hello for Business](hello-for-business/hello-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | +| [Windows Hello for Business](hello-for-business/index.yml) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | | [Windows 10 Credential Theft Mitigation Guide Abstract](windows-credential-theft-mitigation-guide-abstract.md) | Learn more about credential theft mitigation in Windows 10. | diff --git a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md index 65e353cb81..fc906d9e08 100644 --- a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md @@ -9,7 +9,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index a4029266dd..0637c997cc 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -6,7 +6,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -53,12 +53,12 @@ Use the following table to compare different Remote Desktop connection security
            -| **Feature** | **Remote Desktop** | **Windows Defender Remote Credential Guard** | **Restricted Admin mode** | +| Feature | Remote Desktop | Windows Defender Remote Credential Guard | Restricted Admin mode | |--------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. | User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the “domain user”. Any attack is local to the server | | **Version support** | The remote computer can run any Windows operating system | Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.

            For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). | | **Helps prevent**                    |      N/A          |
            • Pass-the-Hash
            • Use of a credential after disconnection
            |
            • Pass-the-Hash
            • Use of domain identity during connection
            | -| **Credentials supported from the remote desktop client device** |
            • Signed on credentials
            • Supplied credentials
            • Saved credentials
            |
            • Signed on credentials only |
              • Signed on credentials
              • Supplied credentials
              • Saved credentials
              | +| **Credentials supported from the remote desktop client device** |
              • Signed on credentials
              • Supplied credentials
              • Saved credentials
              |
              • Signed on credentials only |
                • Signed on credentials
                • Supplied credentials
                • Saved credentials
                | | **Access** | **Users allowed**, that is, members of Remote Desktop Users group of remote host. | **Users allowed**, that is, members of Remote Desktop Users of remote host. | **Administrators only**, that is, only members of Administrators group of remote host. | | **Network identity** | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as remote host’s identity**. | | **Multi-hop** | From the remote desktop, **you can connect through Remote Desktop to another computer** | From the remote desktop, you **can connect through Remote Desktop to another computer**. | Not allowed for user as the session is running as a local host account | @@ -67,7 +67,7 @@ Use the following table to compare different Remote Desktop connection security
                For further technical information, see [Remote Desktop Protocol](https://msdn.microsoft.com/library/aa383015(v=vs.85).aspx) -and [How Kerberos works](https://technet.microsoft.com/library/cc961963.aspx(d=robot)) +and [How Kerberos works](https://technet.microsoft.com/library/cc961963.aspx(d=robot)).
                @@ -92,9 +92,12 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r The Remote Desktop client device: -- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine. +- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine. + - Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user’s signed-in credentials. This requires the user’s account be able to sign in to both the client device and the remote host. + - Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard. + - Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk. The Remote Desktop remote host: @@ -108,9 +111,13 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. > [!NOTE] > Remote Desktop client devices running earlier versions, at minimum Windows 10 version 1607, only support signed-in credentials, so the client device must also be joined to an Active Directory domain. Both Remote Desktop client and server must either be joined to the same domain, or the Remote Desktop server can be joined to a domain that has a trust relationship to the client device's domain. +> +> GPO [Remote host allows delegation of non-exportable credentials](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for delegation of non-exportable credentials. - For Windows Defender Remote Credential Guard to be supported, the user must authenticate to the remote host using Kerberos authentication. + - The remote host must be running at least Windows 10 version 1607, or Windows Server 2016. + - The Remote Desktop classic Windows app is required. The Remote Desktop Universal Windows Platform app doesn't support Windows Defender Remote Credential Guard. ## Enable Windows Defender Remote Credential Guard @@ -118,15 +125,20 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. You must enable Restricted Admin or Windows Defender Remote Credential Guard on the remote host by using the Registry. 1. Open Registry Editor on the remote host. + 2. Enable Restricted Admin and Windows Defender Remote Credential Guard: + - Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa. + - Add a new DWORD value named **DisableRestrictedAdmin**. + - To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0 to turn on Windows Defender Remote Credential Guard. + 3. Close Registry Editor. You can add this by running the following command from an elevated command prompt: -``` +```console reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD ``` @@ -143,13 +155,15 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C ![Windows Defender Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) 3. Under **Use the following restricted mode**: - - If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Windows Defender Remote Credential Guard, choose **Prefer Windows Defender Remote Credential Guard**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used. - > **Note:** Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server. + - If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx) or Windows Defender Remote Credential Guard, choose **Restrict Credential Delegation**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used. - - If you want to require Windows Defender Remote Credential Guard, choose **Require Windows Defender Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#reqs) listed earlier in this topic. + > [!NOTE] + > Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server. - - If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic. + - If you want to require Windows Defender Remote Credential Guard, choose **Require Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#reqs) listed earlier in this topic. + + - If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic. 4. Click **OK**. @@ -162,7 +176,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C If you don't use Group Policy in your organization, or if not all your remote hosts support Remote Credential Guard, you can add the remoteGuard parameter when you start Remote Desktop Connection to turn on Windows Defender Remote Credential Guard for that connection. -``` +```console mstsc.exe /remoteGuard ``` diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 5e5003aa9f..f8baa1b11c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 89ddb7fa8a..bb2559ccf0 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 997384b9e0..ae671b4ace 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 17564fc13b..3d76ae2b17 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 9ee26abcab..824c20a5f1 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -1,12 +1,12 @@ --- -title: Smart Cards Debugging Information (Windows 10) -description: This topic explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. +title: Smart Card Troubleshooting (Windows 10) +description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -16,19 +16,19 @@ ms.date: 04/19/2017 ms.reviewer: --- -# Smart Cards Debugging Information +# Smart Card Troubleshooting Applies To: Windows 10, Windows Server 2016 -This topic explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. +This article explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. Debugging and tracing smart card issues requires a variety of tools and approaches. The following sections provide guidance about tools and approaches you can use. - [Certutil](#certutil) -- [Debugging and tracing using WPP](#debugging-and-tracing-using-wpp) +- [Debugging and tracing using Windows software trace preprocessor (WPP)](#debugging-and-tracing-using-wpp) -- [Kerberos protocol, KDC and NTLM debugging and tracing](#kerberos-protocol-kdc-and-ntlm-debugging-and-tracing) +- [Kerberos protocol, Key Distribution Center (KDC), and NTLM debugging and tracing](#kerberos-protocol-kdc-and-ntlm-debugging-and-tracing) - [Smart Card service](#smart-card-service) @@ -42,21 +42,22 @@ For a complete description of Certutil including examples that show how to use i ### List certificates available on the smart card -To list certificates that are available on the smart card, type certutil -scinfo. +To list certificates that are available on the smart card, type `certutil -scinfo`. -> **Note**  Entering a PIN is not required for this operation. You can press ESC if you are prompted for a PIN. +> [!NOTE] +> Entering a PIN is not required for this operation. You can press ESC if you are prompted for a PIN. ### Delete certificates on the smart card -Each certificate is enclosed in a container. When you delete a certificate on the smart card, you are deleting the container for the certificate. +Each certificate is enclosed in a container. When you delete a certificate on the smart card, you're deleting the container for the certificate. -To find the container value, type certutil -scinfo. +To find the container value, type `certutil -scinfo`. To delete a container, type **certutil -delkey -csp "Microsoft Base Smart Card Crypto Provider"** "<*ContainerValue*>". ## Debugging and tracing using WPP -Windows software trace preprocessor (WPP) simplifies tracing the operation of the trace provider, and it provides a mechanism for the trace provider to log real-time binary messages. Logged messages can subsequently be converted to a human-readable trace of the operation of the trace provider. For more information about WPP, see [Diagnostics with WPP - The NDIS blog](https://blogs.msdn.com/b/ndis/archive/2011/04/06/diagnostics-with-wpp.aspx). +WPP simplifies tracing the operation of the trace provider. It provides a mechanism for the trace provider to log real-time binary messages. Logged messages can be converted to a human-readable trace of the operation. For more information, see [Diagnostics with WPP - The NDIS blog](https://blogs.msdn.com/b/ndis/archive/2011/04/06/diagnostics-with-wpp.aspx). ### Enable the trace @@ -64,33 +65,33 @@ Using WPP, use one of the following commands to enable tracing: - **tracelog.exe -kd -rt -start** <*FriendlyName*> **-guid \#**<*GUID*> **-f .\\**<*LogFileName*>**.etl -flags** <*flags*> **-ft 1** -- **logman start** <*FriendlyName*> **-ets -p {**<*GUID*>**} -**<*Flags*> **-ft 1 -rt -o .\\**<*LogFileName*>**.etl -mode 0x00080000* +- **logman start** <*FriendlyName*> **-ets -p {**<*GUID*>**} -**<*Flags*> **-ft 1 -rt -o .\\**<*LogFileName*>**.etl -mode 0x00080000** You can use the parameters in the following table. -| **Friendly name** | **GUID** | **Flags** | +| Friendly name | GUID | Flags | |-------------------|--------------------------------------|-----------| -| scardsvr | 13038e47-ffec-425d-bc69-5707708075fe | 0xffff | -| winscard | 3fce7c5f-fb3b-4bce-a9d8-55cc0ce1cf01 | 0xffff | -| basecsp | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | -| scksp | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | -| msclmd | fb36caf4-582b-4604-8841-9263574c4f2c | 0x7 | -| credprov | dba0e0e0-505a-4ab6-aa3f-22f6f743b480 | 0xffff | -| certprop | 30eae751-411f-414c-988b-a8bfa8913f49 | 0xffff | -| scfilter | eed7f3c9-62ba-400e-a001-658869df9a91 | 0xffff | -| wudfusbccid | a3c09ba3-2f62-4be5-a50f-8278a646ac9d | 0xffff | +| `scardsvr` | 13038e47-ffec-425d-bc69-5707708075fe | 0xffff | +| `winscard` | 3fce7c5f-fb3b-4bce-a9d8-55cc0ce1cf01 | 0xffff | +| `basecsp` | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | +| `scksp` | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | +| `msclmd` | fb36caf4-582b-4604-8841-9263574c4f2c | 0x7 | +| `credprov` | dba0e0e0-505a-4ab6-aa3f-22f6f743b480 | 0xffff | +| `certprop` | 30eae751-411f-414c-988b-a8bfa8913f49 | 0xffff | +| `scfilter` | eed7f3c9-62ba-400e-a001-658869df9a91 | 0xffff | +| `wudfusbccid` | a3c09ba3-2f62-4be5-a50f-8278a646ac9d | 0xffff | Examples To enable tracing for the SCardSvr service: -- tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\\scardsvr.etl -flags 0xffff -ft 1 +- **tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\\scardsvr.etl -flags 0xffff -ft 1** -- logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\\scardsvr.etl -mode 0x00080000 +- **logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\\scardsvr.etl -mode 0x00080000** To enable tracing for scfilter.sys: -tracelog.exe -kd -rt -start scfilter -guid \#eed7f3c9-62ba-400e-a001-658869df9a91 -f .\\scfilter.etl -flags 0xffff -ft 1 + - **tracelog.exe -kd -rt -start scfilter -guid \#eed7f3c9-62ba-400e-a001-658869df9a91 -f .\\scfilter.etl -flags 0xffff -ft 1** ### Stop the trace @@ -100,73 +101,74 @@ Using WPP, use one of the following commands to stop the tracing: - **logman -stop** <*FriendlyName*> **-ets** -Examples +#### Examples To stop a trace: -- tracelog.exe -stop scardsvr +- **tracelog.exe -stop scardsvr** -- logman -stop scardsvr -ets +- **logman -stop scardsvr -ets** -## Kerberos protocol, KDC and NTLM debugging and tracing +## Kerberos protocol, KDC, and NTLM debugging and tracing -You can use the following resources to begin troubleshooting these protocols and the KDC: +You can use these resources to troubleshoot these protocols and the KDC: -- [Kerberos and LDAP Troubleshooting Tips](https://technet.microsoft.com/library/bb463167.aspx) +- [Kerberos and LDAP Troubleshooting Tips](https://technet.microsoft.com/library/bb463167.aspx). -- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit)  You can use the trace log tool in this SDK to debug Kerberos authentication failures. +- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit).  You can use the trace log tool in this SDK to debug Kerberos authentication failures. -To begin tracing, you can use Tracelog. Different components use different control GUIDs as explained in the following examples. For more information, see [Tracelog](https://msdn.microsoft.com/library/windows/hardware/ff552994.aspx). +To begin tracing, you can use `Tracelog`. Different components use different control GUIDs as explained in these examples. For more information, see [`Tracelog`](https://msdn.microsoft.com/library/windows/hardware/ff552994.aspx). ### NTLM -To enable tracing for NTLM authentication, run the following at the command line: +To enable tracing for NTLM authentication, run the following command on the command line: -tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1 + - **tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1** -To stop tracing for NTLM authentication, run the following at the command line: +To stop tracing for NTLM authentication, run this command: -tracelog -stop ntlm + - **tracelog -stop ntlm** ### Kerberos authentication -To enable tracing for Kerberos authentication, run the following at the command line: +To enable tracing for Kerberos authentication, run this command: -tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1 + - **tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1** -To stop tracing for Kerberos authentication, run the following at the command line: +To stop tracing for Kerberos authentication, run this command: -tracelog.exe -stop kerb + - **tracelog.exe -stop kerb** ### KDC -To enable tracing for the Key Distribution Center (KDC), run the following at the command line: +To enable tracing for the KDC, run the following command on the command line: -tracelog.exe -kd -rt -start kdc -guid \#1BBA8B19-7F31-43c0-9643-6E911F79A06B -f .\\kdc.etl -flags 0x803 -ft 1 + - **tracelog.exe -kd -rt -start kdc -guid \#1BBA8B19-7F31-43c0-9643-6E911F79A06B -f .\\kdc.etl -flags 0x803 -ft 1** -To stop tracing for the KDC, run the following at the command line: +To stop tracing for the KDC, run the following command on the command line: -tracelog.exe -stop kdc + - **tracelog.exe -stop kdc** -To stop tracing from a remote computer, run the following at the command line: logman.exe -s *<ComputerName>*. +To stop tracing from a remote computer, run this command: logman.exe -s *<ComputerName>*. -> **Note**  The default location for logman.exe is %systemroot%system32\\. Use the **-s** option to supply a computer name. +> [!NOTE] +> The default location for logman.exe is %systemroot%system32\\. Use the **-s** option to supply a computer name. ### Configure tracing with the registry You can also configure tracing by editing the Kerberos registry values shown in the following table. -| **Element** | **Registry Key Setting** | +| Element | Registry Key Setting | |-------------|----------------------------------------------------| | NTLM | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1\_0
                Value name: NtLmInfoLevel
                Value type: DWORD
                Value data: c0015003 | | Kerberos | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos
                Value name: LogToFile
                Value type: DWORD
                Value data: 00000001

                HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters
                Value name: KerbDebugLevel
                Value type: DWORD
                Value data: c0000043

                HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters
                Value name: LogToFile
                Value type: DWORD
                Value data: 00000001 | | KDC | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Kdc
                Value name: KdcDebugLevel
                Value type: DWORD
                Value data: c0000803 | -If you used Tracelog, look for the following log file in your current directory: kerb.etl/kdc.etl/ntlm.etl. +If you used `Tracelog`, look for the following log file in your current directory: kerb.etl/kdc.etl/ntlm.etl. -Otherwise, if you used the registry key settings shown in the previous table, look for the generated trace log files in the following locations: +If you used the registry key settings shown in the previous table, look for the trace log files in the following locations: - NTLM: %systemroot%\\tracing\\msv1\_0 @@ -174,19 +176,19 @@ Otherwise, if you used the registry key settings shown in the previous table, lo - KDC: %systemroot%\\tracing\\kdcsvc  -To decode event trace files, you can use Tracefmt (tracefmt.exe). Tracefmt is a command-line tool that formats and displays trace messages from an event trace log file (.etl) or a real-time trace session. Tracefmt can display the messages in the Command Prompt window or save them in a text file. It is located in the \\tools\\tracing subdirectory of the Windows Driver Kit (WDK). For more information, see [Tracefmt](https://msdn.microsoft.com/library/ff552974.aspx). +To decode event trace files, you can use `Tracefmt` (tracefmt.exe). `Tracefmt` is a command-line tool that formats and displays trace messages from an event trace log file (.etl) or a real-time trace session. `Tracefmt` can display the messages in the Command Prompt window or save them in a text file. It is located in the \\tools\\tracing subdirectory of the Windows Driver Kit (WDK). For more information, see [`Tracefmt`](https://msdn.microsoft.com/library/ff552974.aspx). ## Smart Card service -The smart card resource manager service runs in the context of a local service, and it is implemented as a shared service of the services host (svchost) process. +The smart card resource manager service runs in the context of a local service. It's implemented as a shared service of the services host (svchost) process. **To check if Smart Card service is running** -1. Press CTRL+ALT+DEL, and then click **Start Task Manager**. +1. Press CTRL+ALT+DEL, and then select **Start Task Manager**. -2. In the **Windows Task Manager** dialog box, click the **Services** tab. +2. In the **Windows Task Manager** dialog box, select the **Services** tab. -3. Click the **Name** column to sort the list alphabetically, and then type **s**. +3. Select the **Name** column to sort the list alphabetically, and then type **s**. 4. In the **Name** column, look for **SCardSvr**, and then look under the **Status** column to see if the service is running or stopped. @@ -194,17 +196,17 @@ The smart card resource manager service runs in the context of a local service, 1. Run as administrator at the command prompt. -2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. +2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. -3. At the command prompt, type **net stop SCardSvr**. +3. At the command prompt, type `net stop SCardSvr`. -4. At the command prompt, type **net start SCardSvr**. +4. At the command prompt, type `net start SCardSvr`. -You can use the following command at the command prompt to check whether the service is running: **sc queryex scardsvr**. +You can use the following command at the command prompt to check whether the service is running: `sc queryex scardsvr`. -The following is example output from running this command: +The following code sample is an example output from this command: -``` +```console SERVICE_NAME: scardsvr TYPE : 20 WIN32_SHARE_PROCESS STATE : 4 RUNNING @@ -226,19 +228,20 @@ As with any device connected to a computer, Device Manager can be used to view p 1. Navigate to **Computer**. -2. Right-click **Computer**, and then click **Properties**. +2. Right-click **Computer**, and then select **Properties**. -3. Under **Tasks**, click **Device Manager**. +3. Under **Tasks**, select **Device Manager**. -4. In Device Manager, expand **Smart card readers**, select the name of the smart card reader you want to check, and then click **Properties**. +4. In Device Manager, expand **Smart card readers**, select the name of the smart card reader you want to check, and then select **Properties**. -> **Note**  If the smart card reader is not listed in Device Manager, in the **Action** menu, click **Scan for hardware changes**. +> [!NOTE] +> If the smart card reader is not listed in Device Manager, in the **Action** menu, select **Scan for hardware changes**. ## CryptoAPI 2.0 Diagnostics -CryptoAPI 2.0 Diagnostics is a feature that is available in Windows operating systems that supports CryptoAPI 2.0. This feature can help you troubleshoot public key infrastructure (PKI) issues. +CryptoAPI 2.0 Diagnostics is available in Windows versions that support CryptoAPI 2.0 and can help you troubleshoot public key infrastructure (PKI) issues. -CryptoAPI 2.0 Diagnostics logs events in the Windows event log, which contain detailed information about certificate chain validation, certificate store operations, and signature verification. This information makes it easier to identify the causes of issues and reduces the time required for diagnosis. +CryptoAPI 2.0 Diagnostics logs events in the Windows event log. The logs contain detailed information about certificate chain validation, certificate store operations, and signature verification. This information makes it easier to identify the causes of issues and reduces the time required for diagnosis. For more information about CryptoAPI 2.0 Diagnostics, see [Troubleshooting an Enterprise PKI](https://technet.microsoft.com/library/cc771463.aspx). diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index d905fbf992..dbaa8112f7 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 04e43174e8..50d2b45bb2 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index 56228dff85..9939c9ec73 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index dd8812970c..fa36cf563f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index a913f4c769..e4548fc317 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index 794b8e096c..74fdcc3e8f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index 53ebc5b4f6..99defcec30 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 4a92507705..10ffd31a84 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -8,7 +8,7 @@ ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -109,9 +109,7 @@ To better understand each component, review the table below:
            - + - + - @@ -270,15 +265,17 @@ To better understand each component, review the table below:

            Type

            Builtin local

            Builtin Local

            Default container

            No.

            Setting

            Detailed Description

            No.

            Setting

            Detailed Description

            3

            Registry key

            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

            No.

            Setting

            Detailed Description

            No.

            Setting

            Detailed Description

            Description
            -

            User

            -
            User
            @@ -138,9 +136,7 @@ To better understand each component, review the table below:
            -

            System

            -
            System
            @@ -248,8 +244,7 @@ To better understand each component, review the table below:
            -

            Kernel

            +
            Kernel
            -The slider will never turn UAC completely off. If you set it to Never notify, it will: +The slider will never turn UAC completely off. If you set it to Never notify, it will: - Keep the UAC service running. - Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt. - Automatically deny all elevation requests for standard users. -> **Important:** In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. -> -> **Warning:** Universal Windows apps will not work when UAC is disabled. +> [!IMPORTANT] +> In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. + +> [!WARNING] +> Some Universal Windows Platform apps may not work when UAC is disabled. ### Virtualization @@ -291,7 +288,9 @@ Most app tasks operate properly by using virtualization features. Although virtu Virtualization is not an option in the following scenarios: - Virtualization does not apply to apps that are elevated and run with a full administrative access token. + - Virtualization supports only 32-bit apps. Non-elevated 64-bit apps simply receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations. + - Virtualization is disabled if the app includes an app manifest with a requested execution level attribute. ### Request execution levels @@ -319,6 +318,8 @@ Before a 32-bit process is created, the following attributes are checked to dete - Key attributes in the resource script data are linked in the executable file. - There are targeted sequences of bytes within the executable file. -> **Note:** The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. -> -> **Note:** The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). +> [!NOTE] +> The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. + +> [!NOTE] +> The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index e8d50dc97f..130688534d 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md index 15ea04101f..a95145abaa 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md @@ -9,12 +9,11 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article -ms.localizationpriority: medium ms.date: 07/27/2017 --- diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index 9cb4e34436..793fe303aa 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -65,7 +65,7 @@ This policy setting controls the behavior of the elevation prompt for standard u This policy setting controls the behavior of application installation detection for the computer. - **Enabled** (Default) When an app installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -- **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or Microsoft Endpoint Configuration Manager should disable this policy setting. In this case, installer detection is unnecessary. +- **Disabled** App installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies, such as Group Policy or Microsoft Endpoint Manager should disable this policy setting. In this case, installer detection is unnecessary. ## User Account Control: Only elevate executable files that are signed and validated diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index 5e643f7d75..a168874b63 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index f0b0220678..6fb462eb81 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index 34daf7a11e..6810a79d95 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index aa61d00b97..29bb2adede 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index bb1cf1508f..c37a9a9b29 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management @@ -35,7 +35,7 @@ The Create command sets up new virtual smart cards on the user’s system. It re | Parameter | Description | |-----------|-------------| | /name | Required. Indicates the name of the new virtual smart card. | -| /AdminKey | Indicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN.
            **DEFAULT** Specifies the default value of 010203040506070801020304050607080102030405060708.
            **PROMPT**  Prompts the user to enter a value for the administrator key.
            **RANDOM**  Results in a random setting for the administrator key for a card that is not returned to the user. This creates a card that might not be manageable by using smart card management tools. When generated with RANDOM, the administrator key must be entered as 48 hexadecimal characters. | +| /AdminKey | Indicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN.
            **DEFAULT** Specifies the default value of 010203040506070801020304050607080102030405060708.
            **PROMPT**  Prompts the user to enter a value for the administrator key.
            **RANDOM**  Results in a random setting for the administrator key for a card that is not returned to the user. This creates a card that might not be manageable by using smart card management tools. When generated with RANDOM, the administrator key is set as 48 hexadecimal characters. | | /PIN | Indicates desired user PIN value.
            **DEFAULT**  Specifies the default PIN of 12345678.
            **PROMPT**  Prompts the user to enter a PIN at the command line. The PIN must be a minimum of eight characters, and it can contain numerals, characters, and special characters. | | /PUK | Indicates the desired PIN Unlock Key (PUK) value. The PUK value must be a minimum of eight characters, and it can contain numerals, characters, and special characters. If the parameter is omitted, the card is created without a PUK.
            **DEFAULT**  Specifies the default PUK of 12345678.
            **PROMPT**  Prompts the user to enter a PUK at the command line. | | /generate | Generates the files in storage that are necessary for the virtual smart card to function. If the /generate parameter is omitted, it is equivalent to creating a card without this file system. A card without a file system can be managed only by a smart card management system such as Microsoft Endpoint Configuration Manager. | diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index 0194ee2c80..d7c394285f 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index 0737f18fec..30671f6e4a 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md index 22355b9383..97ee24eb64 100644 --- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md +++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md @@ -1,11 +1,11 @@ --- title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10) -description: Explains how to secure VPN connections for Diffie Hellman Group 2 +description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.author: dansimp ms.localizationpriority: medium ms.date: 02/08/2018 diff --git a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index a162e20e45..24a4378ebe 100644 --- a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp @@ -16,38 +16,38 @@ ms.author: dansimp This topic explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. The scenario is: -- You connect to a network using Wi-Fi or VPN. -- You want to use the credentials that you use for the WiFi or VPN authentication to also authenticate requests to access a domain resource you are connecting to, without being prompted for your domain credentials separately. +- You connect to a network using Wi-Fi or VPN. +- You want to use the credentials that you use for the WiFi or VPN authentication to also authenticate requests to access a domain resource you are connecting to, without being prompted for your domain credentials separately. For example, you want to connect to a corporate network and access an internal website that requires Windows integrated authentication. -At a high level, the way this works is that the credentials that are used for the connection authentication are put in Credential Manager as the default credentials for the logon session. -Credential Manager is a place where credentials in the OS are can be stored for specific domain resources based on the targetname of the resource. -For VPN, the VPN stack saves its credential as the session default. -For WiFi, EAP does it. +At a high level, the way this works is that the credentials that are used for the connection authentication are put in Credential Manager as the default credentials for the logon session. +Credential Manager is a place where credentials in the OS are can be stored for specific domain resources based on the targetname of the resource. +For VPN, the VPN stack saves its credential as the session default. +For WiFi, EAP does it. -The credentials are put in Credential Manager as a "\*Session" credential. -A "\*Session" credential implies that it is valid for the current user session. -The credentials are also cleaned up when the WiFi or VPN connection is disconnected. +The credentials are put in Credential Manager as a "\*Session" credential. +A "\*Session" credential implies that it is valid for the current user session. +The credentials are also cleaned up when the WiFi or VPN connection is disconnected. -When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so [WinInet](https://msdn.microsoft.com/library/windows/desktop/aa385483.aspx) can release the credentials that it gets from the Credential Manager to the SSP that is requesting it. -For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations). +When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so [WinInet](https://msdn.microsoft.com/library/windows/desktop/aa385483.aspx) can release the credentials that it gets from the Credential Manager to the SSP that is requesting it. +For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations). -The local security authority will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability. -If the app is not UWP, it does not matter. -But if it is a UWP app, it will look at the device capability for Enterprise Authentication. +The local security authority will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability. +If the app is not UWP, it does not matter. +But if it is a UWP app, it will look at the device capability for Enterprise Authentication. If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released. -This behavior helps prevent credentials from being misused by untrusted third parties. +This behavior helps prevent credentials from being misused by untrusted third parties. ## Intranet zone -For the Intranet zone, by default it only allows single-label names, such as Http://finance. -If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](https://msdn.microsoft.com/library/windows/hardware/dn904964.aspx). +For the Intranet zone, by default it only allows single-label names, such as Http://finance. +If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](https://msdn.microsoft.com/library/windows/hardware/dn904964.aspx). ### Setting the ZoneMap -The ZoneMap is controlled using a registry that can be set through MDM. -By default, single-label names such as http://finance are already in the intranet zone. +The ZoneMap is controlled using a registry that can be set through MDM. +By default, single-label names such as http://finance are already in the intranet zone. For multi-label names, such as http://finance.net, the ZoneMap needs to be updated. ## MDM Policy @@ -56,9 +56,9 @@ OMA URI example: ./Vendor/MSFT/Registry/HKU/S-1-5-21-2702878673-795188819-444038987-2781/Software/Microsoft/Windows/CurrentVersion/Internet%20Settings/ZoneMap/Domains/``/* as an Integer Value of 1 for each of the domains that you want to SSO into from your device. This adds the specified domains to the Intranet Zone of the Edge browser. -## Credential requirements +## Credential requirements -For VPN, the following types of credentials will be added to credential manager after authentication: +For VPN, the following types of credentials will be added to credential manager after authentication: - Username and password - Certificate-based authentication: @@ -67,7 +67,7 @@ For VPN, the following types of credentials will be added to credential manager - Smart Card Certificate - Windows Hello for Business Certificate -The username should also include a domain that can be reached over the connection (VPN or WiFi). +The username should also include a domain that can be reached over the connection (VPN or WiFi). ## User certificate templates @@ -82,17 +82,17 @@ If the credentials are certificate-based, then the elements in the following tab ## NDES server configuration -The NDES server is required to be configured so that incoming SCEP requests can be mapped to the correct template to be used. -For more information, see [Configure certificate infrastructure for SCEP](https://docs.microsoft.com/intune/deploy-use/Configure-certificate-infrastructure-for-scep). +The NDES server is required to be configured so that incoming SCEP requests can be mapped to the correct template to be used. +For more information, see [Configure certificate infrastructure for SCEP](https://docs.microsoft.com/mem/intune/protect/certificates-scep-configure). ## Active Directory requirements -You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well. +You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well. The domain controllers will need to have appropriate KDC certificates for the client to trust them as domain controllers, and since phones are not domain-joined, the root CA of the KDC’s certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store. -The domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication. -This is because Windows 10 Mobile requires strict KDC validation to be enabled. -This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server. -For more information, see [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382). +The domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication. +This is because Windows 10 Mobile requires strict KDC validation to be enabled. +This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server. +For more information, see [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382). diff --git a/windows/security/identity-protection/vpn/images/vpn-connection-intune.png b/windows/security/identity-protection/vpn/images/vpn-connection-intune.png index bf551eabb7..8098b3445e 100644 Binary files a/windows/security/identity-protection/vpn/images/vpn-connection-intune.png and b/windows/security/identity-protection/vpn/images/vpn-connection-intune.png differ diff --git a/windows/security/identity-protection/vpn/images/vpn-custom-xml-intune.png b/windows/security/identity-protection/vpn/images/vpn-custom-xml-intune.png index 94cbb2c5cb..c6437e95d1 100644 Binary files a/windows/security/identity-protection/vpn/images/vpn-custom-xml-intune.png and b/windows/security/identity-protection/vpn/images/vpn-custom-xml-intune.png differ diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index 9f6f6fa2a5..5f4cf0a2b1 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -1,11 +1,11 @@ --- title: VPN authentication options (Windows 10) -description: tbd +description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 09ca26d20e..59ffc5f231 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -1,11 +1,11 @@ --- title: VPN auto-triggered profile options (Windows 10) -description: tbd +description: Learn about the types of auto-trigger rules for VPNs in Windows 10, which start a VPN when it is needed to access a resource. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: @@ -61,13 +61,15 @@ When the trigger occurs, VPN tries to connect. If an error occurs or any user in When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers. -Preserving user Always On preference +## Preserving user Always On preference -Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value AutoTriggerDisabledProfilesList. -Should a management tool remove/add the same profile name back and set AlwaysOn to true, Windows will not check the box if the profile name exists in the below registry value in order to preserve user preference. -Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config -Value: AutoTriggerDisabledProfilesList -Type: REG_MULTI_SZ +Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**. + +Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference. + +**Key:** HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config
            +**Value:** AutoTriggerDisabledProfilesList
            +**Type:** REG_MULTI_SZ ## Trusted network detection diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index df414d1e79..0d608b647c 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.reviewer: @@ -31,6 +31,7 @@ Conditional Access Platform components used for Device Compliance include the fo - [Windows Health Attestation Service](https://technet.microsoft.com/itpro/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices#device-health-attestation) (optional) - Azure AD Certificate Authority - It is a requirement that the client certificate used for the cloud-based device compliance solution be issued by an Azure Active Directory-based Certificate Authority (CA). An Azure AD CA is essentially a mini-CA cloud tenant in Azure. The Azure AD CA cannot be configured as part of an on-premises Enterprise CA. +See also [Always On VPN deployment for Windows Server and Windows 10](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy). - Azure AD-issued short-lived certificates - When a VPN connection attempt is made, the Azure AD Token Broker on the local device communicates with Azure Active Directory, which then checks for health based on compliance rules. If compliant, Azure AD sends back a short-lived certificate that is used to authenticate the VPN. Note that certificate authentication methods such as EAP-TLS can be used. When that certificate expires, the client will again check with Azure AD for health validation before a new certificate is issued. @@ -48,44 +49,56 @@ The following client-side components are also required: - Trusted Platform Module (TPM) ## VPN device compliance + At this time, the Azure AD certificates issued to users do not contain a CRL Distribution Point (CDP) and are not suitable for Key Distribution Centers (KDCs) to issue Kerberos tokens. For users to gain access to on-premises resources such as files on a network share, client authentication certificates must be deployed to the Windows profiles of the users, and their VPNv2 profiles must contain the <SSO> section. Server-side infrastructure requirements to support VPN device compliance include: -- The VPN server should be configured for certificate authentication -- The VPN server should trust the tenant-specific Azure AD CA -- For client access using Kerberos/NTLM, a domain-trusted certificate is deployed to the client device and is configured to be used for single sign-on (SSO) +- The VPN server should be configured for certificate authentication. +- The VPN server should trust the tenant-specific Azure AD CA. +- For client access using Kerberos/NTLM, a domain-trusted certificate is deployed to the client device and is configured to be used for single sign-on (SSO). After the server side is set up, VPN admins can add the policy settings for conditional access to the VPN profile using the VPNv2 DeviceCompliance node. Two client-side configuration service providers are leveraged for VPN device compliance. -- VPNv2 CSP DeviceCompliance settings +- VPNv2 CSP DeviceCompliance settings: + - **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD. - **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication. - **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication. - **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication. - **Sso/Eku**: comma-separated list of Enhanced Key Usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication. + - HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include: + - Collects TPM data used to verify health states - Forwards the data to the Health Attestation Service (HAS) - Provisions the Health Attestation Certificate received from the HAS - - Upon request, forwards the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification + - Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification ->[!NOTE] ->Currently, it is required that certificates be issued from an on-premises CA, and that SSO be enabled in the user’s VPN profile. This will enable the user to obtain Kerberos tickets in order to access resources on-premises. Kerberos currently does not support the use of Azure AD certificates. +> [!NOTE] +> Currently, it is required that certificates used for obtaining Kerberos tickets must be issued from an on-premises CA, and that SSO must be enabled in the user’s VPN profile. This will enable the user to access on-premises resources. +> +> In the case of AzureAD-only joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from AzureAD in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client does not cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero). ## Client connection flow + The VPN client side connection flow works as follows: -![Device compliance workflow when VPN client attempts to connect](images/vpn-device-compliance.png) +> [!div class="mx-imgBorder"] +> ![Device compliance workflow when VPN client attempts to connect](images/vpn-device-compliance.png) When a VPNv2 Profile is configured with \ \true<\/Enabled> the VPN client uses this connection flow: 1. The VPN client calls into Windows 10’s Azure AD Token Broker, identifying itself as a VPN client. + 2. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies. -3. If compliant, Azure AD requests a short-lived certificate + +3. If compliant, Azure AD requests a short-lived certificate. + 4. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing. + 5. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server. ## Configure conditional access diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index b6fab222d1..a0330b3425 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -1,13 +1,13 @@ --- title: VPN connection types (Windows 10) -description: tbd +description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.localizationpriority: medium -ms.date: 07/27/2017 +ms.date: 11/13/2020 ms.reviewer: manager: dansimp ms.author: dansimp @@ -61,11 +61,11 @@ There are a number of Universal Windows Platform VPN applications, such as Pulse See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. -The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune. +The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune: ![Available connection types](images/vpn-connection-intune.png) -In Intune, you can also include custom XML for third-party plug-in profiles. +In Intune, you can also include custom XML for third-party plug-in profiles: ![Custom XML](images/vpn-custom-xml-intune.png) diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index c72139b6db..1ec959d53e 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -1,12 +1,12 @@ --- title: Windows 10 VPN technical guide (Windows 10) -description: Use this guide to configure VPN deployment for Windows 10. +description: Learn about decisions to make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dulcemontemayor +author: dansimp ms.localizationpriority: medium -ms.date: 07/27/2017 +ms.date: 11/13/2020 ms.reviewer: manager: dansimp ms.author: dansimp @@ -20,12 +20,12 @@ ms.author: dansimp - Windows 10 - Windows 10 Mobile -This guide will walk you through the decisions you will make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment. This guide references the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) and provides mobile device management (MDM) configuration instructions using Microsoft Intune and the VPN Profile template for Windows 10. +This guide will walk you through the decisions you will make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment. This guide references the [VPNv2 Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) and provides mobile device management (MDM) configuration instructions using Microsoft Intune and the VPN Profile template for Windows 10. -![Intune VPN policy template](images/vpn-intune-policy.png) +To create a Windows 10 VPN device configuration profile see: [Windows 10 and Windows Holographic device settings to add VPN connections using Intune](https://docs.microsoft.com/mem/intune/configuration/vpn-settings-windows-10). ->[!NOTE] ->This guide does not explain server deployment. +> [!NOTE] +> This guide does not explain server deployment. ## In this guide @@ -43,7 +43,5 @@ This guide will walk you through the decisions you will make for Windows 10 clie ## Learn more -- [VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune) - - +- [Create VPN profiles to connect to VPN servers in Intune](https://docs.microsoft.com/mem/intune/configuration/vpn-settings-configure) diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index 5c277ef964..2076d89817 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -1,11 +1,11 @@ --- title: VPN name resolution (Windows 10) -description: tbd +description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: @@ -52,7 +52,7 @@ Primary DNS suffix is set using the **VPNv2/*ProfileName*/DnsSuffix** node. ## Persistent -You can also configure *persistent* name resolution rules. Name resolution for specified items will only performed over VPN. +You can also configure *persistent* name resolution rules. Name resolution for specified items will only be performed over the VPN. Persistent name resolution is set using the **VPNv2/*ProfileName*/DomainNameInformationList//*dniRowId*/Persistent** node. diff --git a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md index 66699d9e0b..d067b5a21d 100644 --- a/windows/security/identity-protection/vpn/vpn-office-365-optimization.md +++ b/windows/security/identity-protection/vpn/vpn-office-365-optimization.md @@ -239,12 +239,12 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".ps1") # Extract the Profile XML from the ps1 file # - $regex = '(?sm).*^*.\r?\n(.*?)\r?\n.*' + $regex = '(?sm).*^*.\r?\n(.*?)\r?\n.*' # Create xml format variable to compare with the optimize list # $xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1' - [xml]$VPNprofilexml=""+$xmlbody+"" + [xml]$VPNprofilexml=""+$xmlbody+"" # Loop through each address found in VPNPROFILE XML section # foreach ($Route in $VPNprofilexml.VPNProfile.Route) @@ -349,7 +349,7 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml") $In_VPN_Only=$null # Variable to hold IP Addresses that only appear in the VPN profile XML file # # Extract the Profile XML from the XML file # - $regex = '(?sm).*^*.\r?\n(.*?)\r?\n.*' + $regex = '(?sm).*^*.\r?\n(.*?)\r?\n.*' # Create xml format variable to compare with optimize list # $xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1' @@ -367,7 +367,7 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml") # In VPN list only # $In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_} - [array]$Inpfile = get-content $VPNprofilefile + [System.Collections.ArrayList]$Inpfile = get-content $VPNprofilefile if ($In_Opt_Only.Count -gt 0 ) { @@ -377,10 +377,10 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml") { # Add the missing IP address(es) # $IPInfo=$NewIP.Split("/") - $inspoint = $Inpfile[0].IndexOf(""+$IPInfo[0].Trim()+""+""+$IPInfo[1].Trim()+""+"true"+"" + $routes += "`n"+"`t
            "+$IPInfo[0].Trim()+"
            `n"+"`t"+$IPInfo[1].Trim()+"`n"+"`ttrue`n"+"
            `n" } - $Inpfile = $Inpfile[0].Insert($inspoint,$routes) + $inspoint = $Inpfile.IndexOf("") + $Inpfile.Insert($inspoint,$routes) # Update filename and write new XML file # $NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml" diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index 3d0fdc211e..d47c757946 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.author: dansimp ms.localizationpriority: medium ms.date: 05/17/2018 @@ -34,7 +34,6 @@ The following table lists the VPN settings and whether the setting can be config | Routing: forced-tunnel | yes | | Authentication (EAP) | yes, if connection type is built-in | | Conditional access | yes | -| Proxy settings | yes, by PAC/WPAD file or server and port | | Name resolution: NRPT | yes | | Name resolution: DNS suffix | no | | Name resolution: persistent | no | @@ -45,6 +44,10 @@ The following table lists the VPN settings and whether the setting can be config | LockDown | no | | Windows Information Protection (WIP) | yes | | Traffic filters | yes | +| Proxy settings | yes, by PAC/WPAD file or server and port | + +> [!NOTE] +> VPN proxy settings are only used on Force Tunnel Connections. On Split Tunnel Connections, the general proxy settings are used. The ProfileXML node was added to the VPNv2 CSP to allow users to deploy VPN profile as a single blob. This is particularly useful for deploying profiles with features that are not yet supported by MDMs. You can get additional examples in the [ProfileXML XSD](https://msdn.microsoft.com/library/windows/hardware/mt755930.aspx) topic. @@ -62,8 +65,7 @@ The following is a sample Native VPN profile. This blob would fall under the Pro - Eap - Eap + Eap @@ -317,7 +319,7 @@ After you configure the settings that you want using ProfileXML, you can apply i ## Learn more -- [Learn how to configure VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune) +- [Create VPN profiles to connect to VPN servers in Intune](https://docs.microsoft.com/mem/intune/configuration/vpn-settings-configure) - [VPNv2 configuration service provider (CSP) reference](https://go.microsoft.com/fwlink/p/?LinkId=617588) - [How to Create VPN Profiles in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=618028) diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index c8ce525e53..fd26221328 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -1,11 +1,11 @@ --- title: VPN routing decisions (Windows 10) -description: tbd +description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index 18e7b41ec9..96964c7d9b 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -1,11 +1,11 @@ --- title: VPN security features (Windows 10) -description: tbd +description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: dulcemontemayor +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: @@ -16,8 +16,50 @@ ms.author: dansimp # VPN security features **Applies to** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile + + +## Windows Information Protection (WIP) integration with VPN + +Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices, without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally. + +The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: + +- Core functionality: File encryption and file access blocking +- UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations +- WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN +- Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN + +The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. + +Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect. + +[Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip) + + +## Traffic Filters + +Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins can use Traffic Filters to effectively add interface specific firewall rules on the VPN Interface. There are two types of Traffic Filter rules: + +- App-based rules. With app-based rules, a list of applications can be marked to allow only traffic originating from these apps to go over the VPN interface. +- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified to allow only traffic matching these rules to go over the VPN interface. + +There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. + +For example, an admin could define rules that specify: + +- The Contoso HR App must be allowed to go through the VPN and only access port 4545. +- The Contoso finance apps are allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889. +- All other apps on the device should be able to access only ports 80 or 443. + +## Configure traffic filters + +See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://docs.microsoft.com/windows/client-management/mdm/vpnv2-csp) for XML configuration. + +The following image shows the interface to configure traffic rules in a VPN Profile configuration policy, using Microsoft Intune. + +![Add a traffic rule](images/vpn-traffic-rules.png) ## LockDown VPN @@ -29,56 +71,14 @@ A VPN profile configured with LockDown secures the device to only allow network - The user cannot delete or modify the VPN profile. - The VPN LockDown profile uses forced tunnel connection. - If the VPN connection is not available, outbound network traffic is blocked. -- Only one VPN LockDown profile is allowed on a device. +- Only one VPN LockDown profile is allowed on a device. ->[!NOTE] ->For built-in VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. +> [!NOTE] +> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. -Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. +Deploy this feature with caution, as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. - -## Windows Information Protection (WIP) integration with VPN - -Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally. - -The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include: - -- Core functionality: File encryption and file access blocking -- UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations -- WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN -- Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN - -The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app. - -Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect. - -[Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip) - - -## Traffic filters - -Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins to effectively add interface specific firewall rules on the VPN Interface.There are two types of Traffic Filter rules: - -- App-based rules. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface. -- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface. - -There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level. - -For example, an admin could define rules that specify: - -- The Contoso HR App must be allowed to go through the VPN and only access port 4545. -- The Contoso finance apps is allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889. -- All other apps on the device should be able to access only ports 80 or 443. - -## Configure traffic filters - -See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration. - -The following image shows the interface to configure traffic rules in a VPN Profile configuration policy using Microsoft Intune. - -![Add a traffic rule](images/vpn-traffic-rules.png) - ## Related topics - [VPN technical guide](vpn-guide.md) diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index 26db02bc64..2c1a02b8db 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management diff --git a/windows/security/includes/improve-request-performance.md b/windows/security/includes/improve-request-performance.md index c2499cf092..efaf6664a9 100644 --- a/windows/security/includes/improve-request-performance.md +++ b/windows/security/includes/improve-request-performance.md @@ -16,7 +16,7 @@ ms.collection: M365-security-compliance ms.topic: article --- ->[!NOTE] +>[!TIP] >For better performance, you can use server closer to your geo location: > - api-us.securitycenter.microsoft.com > - api-eu.securitycenter.microsoft.com diff --git a/windows/security/includes/machineactionsnote.md b/windows/security/includes/machineactionsnote.md index 246c89eb92..542eec5756 100644 --- a/windows/security/includes/machineactionsnote.md +++ b/windows/security/includes/machineactionsnote.md @@ -1,6 +1,6 @@ --- -title: Perform a Machine Action via the Microsoft Defender ATP API -description: This page focuses on performing a machine action via the Microsoft Defender Advanced Threat Protection (MDATP) API. +title: Perform a Machine Action via the Microsoft Defender for Endpoint API +description: This page focuses on performing a machine action via the Microsoft Defender for Endpoint API. ms.date: 08/28/2017 ms.reviewer: manager: dansimp @@ -10,4 +10,4 @@ ms.prod: w10 --- >[!Note] -> This page focuses on performing a machine action via API. See [take response actions on a machine](../threat-protection/microsoft-defender-atp/respond-machine-alerts.md) for more information about response actions functionality via Microsoft Defender ATP. +> This page focuses on performing a machine action via API. See [take response actions on a machine](../threat-protection/microsoft-defender-atp/respond-machine-alerts.md) for more information about response actions functionality via Microsoft Defender for Endpoint. diff --git a/windows/security/includes/microsoft-defender-api-usgov.md b/windows/security/includes/microsoft-defender-api-usgov.md new file mode 100644 index 0000000000..4f58a3d8d5 --- /dev/null +++ b/windows/security/includes/microsoft-defender-api-usgov.md @@ -0,0 +1,20 @@ +--- +title: Microsoft Defender for Endpoint API URIs for US Government +description: Microsoft Defender for Endpoint API URIs for US Government +keywords: defender, endpoint, api, government, gov +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +>[!NOTE] +>If you are a US Government customer, please use the URIs listed in [Microsoft Defender for Endpoint for US Government customers](../threat-protection/microsoft-defender-atp/gov.md#api). diff --git a/windows/security/includes/microsoft-defender.md b/windows/security/includes/microsoft-defender.md new file mode 100644 index 0000000000..0cf05d9d0d --- /dev/null +++ b/windows/security/includes/microsoft-defender.md @@ -0,0 +1,14 @@ +--- +title: Microsoft Defender important guidance +description: A note in regard to important Microsoft Defender guidance. +ms.date: +ms.reviewer: +manager: dansimp +ms.author: dansimp +author: dansimp +ms.prod: w10 +ms.topic: include +--- + +> [!IMPORTANT] +> The improved [Microsoft 365 security center](https://security.microsoft.com) is now available in public preview. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. [Learn what's new](https://docs.microsoft.com/microsoft-365/security/mtp/overview-security-center). This topic might apply to both Microsoft Defender for Endpoint and Microsoft 365 Defender. Refer to the **Applies To** section and look for specific call outs in this article where there might be differences. diff --git a/windows/security/includes/prerelease.md b/windows/security/includes/prerelease.md index a83544340f..a008aa45d7 100644 --- a/windows/security/includes/prerelease.md +++ b/windows/security/includes/prerelease.md @@ -1,6 +1,6 @@ --- -title: Microsoft Defender ATP Pre-release Disclaimer -description: Disclaimer for pre-release version of Microsoft Defender ATP. +title: Microsoft Defender for Endpoint Pre-release Disclaimer +description: Disclaimer for pre-release version of Microsoft Defender for Endpoint. ms.date: 08/28/2017 ms.reviewer: manager: dansimp diff --git a/windows/security/index.yml b/windows/security/index.yml index ca0486b130..d7b6fbe5a3 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -1,80 +1,38 @@ -### YamlMime:YamlDocument +### YamlMime:Hub -documentType: LandingData - -title: Windows 10 Enterprise Security +title: Windows 10 Enterprise Security # < 60 chars +summary: Secure corporate data and manage risk. # < 160 chars +# brand: aspnet | azure | dotnet | dynamics | m365 | ms-graph | office | power-bi | power-platform | sql | sql-server | vs | visual-studio | windows | xamarin +brand: windows metadata: - - document_id: - - title: Windows 10 Enterprise Security - - description: Learn about enterprise-grade security features for Windows 10. - - keywords: protect, company, data, Windows, device, app, management, Microsoft365, e5, e3 - + title: Windows 10 Enterprise Security # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about enterprise-grade security features for Windows 10. # Required; article description that is displayed in search results. < 160 chars. + services: windows + ms.product: windows + ms.topic: hub-page # Required + ms.collection: M365-security-compliance # Optional; Remove if no collection is used. + author: danihalfin #Required; your GitHub user alias, with correct capitalization. + ms.author: daniha #Required; microsoft alias of author; optional team alias. + ms.date: 01/08/2018 #Required; mm/dd/yyyy format. ms.localizationpriority: high - author: brianlic-msft - - ms.author: brianlic - - manager: brianlic - - ms.date: 08/01/2018 - - ms.topic: article - - ms.devlang: na - -sections: - -- items: - - - type: markdown - - text: Secure corporate data and manage risk. - -- items: - - - type: list - - style: cards - - className: cardsM - - columns: 3 - - items: - - - href: \windows\security\identity-protection\ - - html:

            Deploy secure enterprise-grade authentication and access control to protect accounts and data

            - - image: - - src: https://docs.microsoft.com/media/common/i_identity-protection.svg - - title: Identity and access management - - - href: \windows\security\threat-protection\ - - html:

            Stop cyberthreats and quickly identify and respond to breaches

            - - image: - - src: https://docs.microsoft.com/media/common/i_threat-protection.svg - - title: Threat protection - - - href: \windows\security\information-protection\ - - html:

            Identify and secure critical data to prevent data loss

            - - image: - - src: https://docs.microsoft.com/media/common/i_information-protection.svg - - title: Information protection - +# productDirectory section (optional) +productDirectory: + items: + # Card + - title: Identity and access management + # imageSrc should be square in ratio with no whitespace + imageSrc: https://docs.microsoft.com/media/common/i_identity-protection.svg + summary: Deploy secure enterprise-grade authentication and access control to protect accounts and data + url: ./identity-protection/index.md + # Card + - title: Threat protection + imageSrc: https://docs.microsoft.com/media/common/i_threat-protection.svg + summary: Stop cyberthreats and quickly identify and respond to breaches + url: ./threat-protection/index.md + # Card + - title: Information protection + imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg + summary: Identify and secure critical data to prevent data loss + url: ./information-protection/index.md \ No newline at end of file diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index 6d79db4dc3..442b60a184 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -3,9 +3,9 @@ ## [BitLocker](bitlocker\bitlocker-overview.md) ### [Overview of BitLocker Device Encryption in Windows 10](bitlocker\bitlocker-device-encryption-overview-windows-10.md) ### [BitLocker frequently asked questions (FAQ)](bitlocker\bitlocker-frequently-asked-questions.md) -#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.md) +#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.yml) #### [Upgrading](bitlocker\bitlocker-upgrading-faq.md) -#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.md) +#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.yml) #### [Key management](bitlocker\bitlocker-key-management-faq.md) #### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.md) #### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.md) @@ -38,7 +38,7 @@ ## [Encrypted Hard Drive](encrypted-hard-drive.md) -## [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md) +## [Kernel DMA Protection](kernel-dma-protection-for-thunderbolt.md) ## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md) ### [Create a WIP policy using Microsoft Intune](windows-information-protection\overview-create-wip-policy.md) @@ -61,7 +61,6 @@ #### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with WIP](windows-information-protection\recommended-network-definitions-for-wip.md) #### [Using Outlook Web Access with WIP](windows-information-protection\using-owa-with-wip.md) ### [Fine-tune WIP Learning](windows-information-protection\wip-learning.md) -### [How WIP works with sensitivity labels](windows-information-protection\how-wip-works-with-labels.md) ## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md) diff --git a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md index 77709b6ef2..7dd0eb0898 100644 --- a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BCD settings and BitLocker diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md index 65e915649a..c248a61b46 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker and Active Directory Domain Services (AD DS) FAQ @@ -28,16 +29,16 @@ ms.date: 02/28/2019 Stored information | Description -------------------|------------ Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in. -BitLocker recovery password | The recovery password allows you to unlock and access the drive in the event of a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md). -BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, Repair-bde. +BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md). +BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`. ## What if BitLocker is enabled on a computer before the computer has joined the domain? -If BitLocker is enabled on a drive before Group Policy has been applied to enforce backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered** and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require that the computer be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. +If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt: +The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt: ```PowerShell $BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive @@ -60,13 +61,13 @@ Ultimately, determining whether a legitimate backup exists in AD DS requires qu No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. -## What happens if the backup initially fails? Will BitLocker retry the backup? +## What happens if the backup initially fails? Will BitLocker retry it? If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. -When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. +When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. +When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index 406d096165..8ad995065c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -1,6 +1,6 @@ --- title: BitLocker basic deployment (Windows 10) -description: This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. +description: This article for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. ms.assetid: 97c646cb-9e53-4236-9678-354af41151c4 ms.reviewer: ms.prod: w10 @@ -15,14 +15,16 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker basic deployment **Applies to** + - Windows 10 -This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. +This article for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. ## Using BitLocker to encrypt volumes @@ -30,69 +32,34 @@ BitLocker provides full volume encryption (FVE) for operating system volumes, as In the event that the drive was prepared as a single contiguous space, BitLocker requires a new volume to hold the boot files. BdeHdCfg.exe can create these volumes. -> **Note:**  For more info about using this tool, see [Bdehdcfg](https://technet.microsoft.com/library/ee732026.aspx) in the Command-Line Reference. - +> [!NOTE] +> For more info about using this tool, see [Bdehdcfg](/windows-server/administration/windows-commands/bdehdcfg) in the Command-Line Reference. + BitLocker encryption can be done using the following methods: - BitLocker control panel - Windows Explorer -- manage-bde command line interface +- manage-bde command-line interface - BitLocker Windows PowerShell cmdlets ### Encrypting volumes using the BitLocker control panel -Encrypting volumes with the BitLocker control panel (click **Start**, type **bitlocker**, click **Manage BitLocker**) is how many users will utilize BitLocker. The name of the BitLocker control panel is BitLocker Drive Encryption. The BitLocker control panel supports encrypting operating system, fixed data and removable data volumes. The BitLocker control panel will organize available drives in the appropriate category based on how the device reports itself to Windows. Only formatted volumes with assigned drive letters will appear properly in the BitLocker control panel applet. +Encrypting volumes with the BitLocker control panel (select **Start**, type *bitlocker*, select **Manage BitLocker**) is how many users will utilize BitLocker. The name of the BitLocker control panel is BitLocker Drive Encryption. The BitLocker control panel supports encrypting operating system, fixed data, and removable data volumes. The BitLocker control panel will organize available drives in the appropriate category based on how the device reports itself to Windows. Only formatted volumes with assigned drive letters will appear properly in the BitLocker control panel applet. To start encryption for a volume, select **Turn on BitLocker** for the appropriate drive to initialize the BitLocker Drive Encryption Wizard. BitLocker Drive Encryption Wizard options vary based on volume type (operating system volume or data volume). ### Operating system volume Upon launch, the BitLocker Drive Encryption Wizard verifies the computer meets the BitLocker system requirements for encrypting an operating system volume. By default, the system requirements are: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            RequirementDescription

            Hardware configuration

            The computer must meet the minimum requirements for the supported Windows versions.

            Operating system

            BitLocker is an optional feature which can be installed by Server Manager on Windows Server 2012 and later.

            Hardware TPM

            TPM version 1.2 or 2.0

            -

            A TPM is not required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication.

            BIOS configuration

              -
            • A Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware.

            • -
            • The boot order must be set to start first from the hard disk, and not the USB or CD drives.

            • -
            • The firmware must be able to read from a USB flash drive during startup.

            • -

            File system

            For computers that boot natively with UEFI firmware, at least one FAT32 partition for the system drive and one NTFS partition for the operating system drive.

            -

            For computers with legacy BIOS firmware, at least two NTFS disk partitions, one for the system drive and one for the operating system drive.

            -

            For either firmware, the system drive partition must be at least 350 megabytes (MB) and set as the active partition.

            Hardware encrypted drive prerequisites (optional)

            To use a hardware encrypted drive as the boot drive, the drive must be in the uninitialized state and in the security inactive state. In addition, the system must always boot with native UEFI version 2.3.1 or higher and the CSM (if any) disabled.

            - + +|Requirement|Description| +|--- |--- | +|Hardware configuration|The computer must meet the minimum requirements for the supported Windows versions.| +|Operating system|BitLocker is an optional feature that can be installed by Server Manager on Windows Server 2012 and later.| +|Hardware TPM|TPM version 1.2 or 2.0.

            A TPM is not required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication.| +|BIOS configuration|

          • A Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware.
          • The boot order must be set to start first from the hard disk, and not the USB or CD drives.
          • The firmware must be able to read from a USB flash drive during startup.
          • | +|File system|For computers that boot natively with UEFI firmware, at least one FAT32 partition for the system drive and one NTFS partition for the operating system drive.
            For computers with legacy BIOS firmware, at least two NTFS disk partitions, one for the system drive and one for the operating system drive.
            For either firmware, the system drive partition must be at least 350 megabytes (MB) and set as the active partition.| +|Hardware encrypted drive prerequisites (optional)|To use a hardware encrypted drive as the boot drive, the drive must be in the uninitialized state and in the security inactive state. In addition, the system must always boot with native UEFI version 2.3.1 or higher and the CSM (if any) disabled.| + Upon passing the initial configuration, users are required to enter a password for the volume. If the volume does not pass the initial configuration for BitLocker, the user is presented with an error dialog describing the appropriate actions to be taken. Once a strong password has been created for the volume, a recovery key will be generated. The BitLocker Drive Encryption Wizard will prompt for a location to save this key. A BitLocker recovery key is a special key that you can create when you turn on BitLocker Drive Encryption for the first time on each drive that you encrypt. You can use the recovery key to gain access to your computer if the drive that Windows is installed on (the operating system drive) is encrypted using BitLocker Drive Encryption and BitLocker detects a condition that prevents it from unlocking the drive when the computer is starting up. A recovery key can also be used to gain access to your files and folders on a removable data drive (such as an external hard drive or USB flash drive) that is encrypted using BitLocker To Go, if for some reason you forget the password or your computer cannot access the drive. @@ -105,13 +72,14 @@ When the recovery key has been properly stored, the BitLocker Drive Encryption W It is recommended that drives with little to no data utilize the **used disk space only** encryption option and that drives with data or an operating system utilize the **encrypt entire drive** option. -> **Note:**  Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools. - -Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. It is recommended to run this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows. +> [!NOTE] +> Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools. + +Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. We recommend running this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows. After completing the system check (if selected), the BitLocker Drive Encryption Wizard will restart the computer to begin encryption. Upon reboot, users are required to enter the password chosen to boot into the operating system volume. Users can check encryption status by checking the system notification area or the BitLocker control panel. -Until encryption is completed, the only available options for managing BitLocker involve manipulation of the password protecting the operating system volume, backing up the recovery key, and turning BitLocker off. +Until encryption is completed, the only available options for managing BitLocker involve manipulation of the password protecting the operating system volume, backing up the recovery key, and turning off BitLocker. ### Data volume @@ -129,12 +97,12 @@ Encryption status displays in the notification area or within the BitLocker cont There is a new option for storing the BitLocker recovery key using the OneDrive. This option requires that computers are not members of a domain and that the user is using a Microsoft Account. Local accounts do not give the option to utilize OneDrive. Using the OneDrive option is the default, recommended recovery key storage method for computers that are not joined to a domain. -Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder which is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive, +Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder that is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive, they can identify the required recovery key by looking at the file name. The recovery key ID is appended to the end of the file name. ### Using BitLocker within Windows Explorer -Windows Explorer allows users to launch the BitLocker Drive Encryption wizard by right clicking on a volume and selecting **Turn On BitLocker**. This option is available on client computers by default. On servers, you must first install the BitLocker and Desktop-Experience features for this option to be available. After selecting **Turn on BitLocker**, the wizard works exactly as it does when launched using the BitLocker control panel. +Windows Explorer allows users to launch the BitLocker Drive Encryption wizard by right-clicking a volume and selecting **Turn On BitLocker**. This option is available on client computers by default. On servers, you must first install the BitLocker and Desktop-Experience features for this option to be available. After selecting **Turn on BitLocker**, the wizard works exactly as it does when launched using the BitLocker control panel. ## Down-level compatibility @@ -142,53 +110,21 @@ The following table shows the compatibility matrix for systems that have been Bi Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Windows 7 encrypted volumes - ------ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Encryption Type

            Windows 10 and Windows 8.1

            Windows 8

            Windows 7

            Fully encrypted on Windows 8

            Presents as fully encrypted

            N/A

            Presented as fully encrypted

            Used Disk Space Only encrypted on Windows 8

            Presents as encrypt on write

            N/A

            Presented as fully encrypted

            Fully encrypted volume from Windows 7

            Presents as fully encrypted

            Presented as fully encrypted

            N/A

            Partially encrypted volume from Windows 7

            Windows 10 and Windows 8.1 will complete encryption regardless of policy

            Windows 8 will complete encryption regardless of policy

            N/A

            +||||| +|--- |--- |--- |--- | +|Encryption Type|Windows 10 and Windows 8.1|Windows 8|Windows 7| +|Fully encrypted on Windows 8|Presents as fully encrypted|N/A|Presented as fully encrypted| +|Used Disk Space Only encrypted on Windows 8|Presents as encrypt on write|N/A|Presented as fully encrypted| +|Fully encrypted volume from Windows 7|Presents as fully encrypted|Presented as fully encrypted|N/A| +|Partially encrypted volume from Windows 7|Windows 10 and Windows 8.1 will complete encryption regardless of policy|Windows 8 will complete encryption regardless of policy|N/A| +## Encrypting volumes using the manage-bde command-line interface -## Encrypting volumes using the manage-bde command line interface +Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). -Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). -Manage-bde offers a multitude of wider options for configuring BitLocker. This means that using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. -Command line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes. +Manage-bde offers a multitude of wider options for configuring BitLocker. So using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. + +Command-line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes. ### Operating system volume @@ -200,7 +136,7 @@ A good practice when using manage-bde is to determine the volume status on the t `manage-bde -status` -This command returns the volumes on the target, current encryption status and volume type (operating system or data) for each volume. Using this information, users can determine the best encryption method for their environment. +This command returns the volumes on the target, current encryption status, and volume type (operating system or data) for each volume. Using this information, users can determine the best encryption method for their environment. **Enabling BitLocker without a TPM** @@ -213,29 +149,29 @@ manage-bde -on C: **Enabling BitLocker with a TPM only** -It is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: +It is possible to encrypt the operating system volume without any defined protectors by using manage-bde. Use this command: `manage-bde -on C:` -This will encrypt the drive using the TPM as the protector. If a user is unsure of the protector for a volume, they can use the -protectors option in manage-bde to list this information with the command: +This command will encrypt the drive using the TPM as the protector. If a user is unsure of the protector for a volume, they can use the -protectors option in manage-bde to list this information with the command: `manage-bde -protectors -get ` **Provisioning BitLocker with two protectors** -Another example is a user on non-TPM hardware who wishes to add a password and SID-based protector to the operating system volume. In this instance, the user adds the protectors first. This is done with the command: +Another example is a user on non-TPM hardware who wishes to add a password and SID-based protector to the operating system volume. In this instance, the user adds the protectors first. Use this command: `manage-bde -protectors -add C: -pw -sid ` -This command will require the user to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, the user just needs to turn BitLocker on. +This command will require the user to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, the user just needs to turn on BitLocker. ### Data volume -Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or users can choose to add protectors to the volume. It is recommended that at least one primary protector and a recovery protector be added to a data volume. +Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or users can choose to add protectors to the volume. We recommend that you add at least one primary protector and a recovery protector to a data volume. **Enabling BitLocker with a password** -A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. +A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn on BitLocker. ```powershell manage-bde -protectors -add -pw C: @@ -245,6 +181,7 @@ manage-bde -on C: ## Encrypting volumes using the BitLocker Windows PowerShell cmdlets Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. + @@ -371,80 +308,100 @@ Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Us
            - + Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. -A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the Get-BitLocker volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information. -Occasionally, all protectors may not be shown when using Get-BitLockerVolume due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors. -> **Note:**  In the event that there are more than four protectors for a volume, the pipe command may run out of display space. For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID. - -`Get-BitLockerVolume C: | fl` +A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLocker` volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information. -If you wanted to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. +Occasionally, all protectors may not be shown when using **Get-BitLockerVolume** due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors. + +> [!NOTE] +> In the event that there are more than four protectors for a volume, the pipe command may run out of display space. For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID. + +```powershell +Get-BitLockerVolume C: | fl +``` + +If you want to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this task requires the GUID associated with the protector to be removed. A simple script can pipe the values of each **Get-BitLockerVolume** return out to another variable as seen below: + ```powershell $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` -Using this, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector. + +Using this script, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector. Using this information, we can then remove the key protector for a specific volume using the command: + ```powershell Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` -> **Note:**  The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. - + +> [!NOTE] +> The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. + ### Operating system volume Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them using the BitLocker cmdlets for Windows PowerShell. -To enable BitLocker with just the TPM protector. This can be done using the command: + +To enable BitLocker with just the TPM protector, use this command: ```powershell Enable-BitLocker C: ``` + The example below adds one additional protector, the StartupKey protectors, and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. ```powershell Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` + ### Data volume -Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. Last, encryption begins. +Data volume encryption using Windows PowerShell is the same as for operating system volumes. Add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user-defined password. Last, encryption begins. ```powershell $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw ``` -### Using a SID based protector in Windows PowerShell -The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover and be unlocked to any member computer of the cluster. +### Using a SID-based protector in Windows PowerShell ->**Warning:**  The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes. - -To add an ADAccountOrGroup protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. +The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly fail over and be unlocked to any member computer of the cluster. + +> [!WARNING] +> The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes. + +To add an ADAccountOrGroup protector to a volume, you need either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. ```powershell Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` + For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: ```powershell -get-aduser -filter {samaccountname -eq "administrator"} +Get-ADUser -filter {samaccountname -eq "administrator"} ``` -> **Note:**  Use of this command requires the RSAT-AD-PowerShell feature. -> + +> [!NOTE] +> Use of this command requires the RSAT-AD-PowerShell feature. +> > **Tip:**  In addition to the Windows PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features. - -In the example below, the user wishes to add a domain SID based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command: + +In the example below, the user wishes to add a domain SID-based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command: ```powershell Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "" ``` -> **Note:**  Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. - + +> [!NOTE] +> Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. + ## Checking BitLocker status -To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section. +To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command-line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section. ### Checking BitLocker status with the control panel @@ -456,8 +413,8 @@ Checking BitLocker status with the control panel is the most common method used | **Off**| BitLocker is not enabled for the volume | | **Suspended** | BitLocker is suspended and not actively protecting the volume | | **Waiting for Activation**| BitLocker is enabled with a clear protector key and requires further action to be fully protected| - -If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on volume E. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status. + +If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on the volume. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status. Using the control panel, administrators can choose **Turn on BitLocker** to start the BitLocker Drive Encryption wizard and add a protector, like PIN for an operating system volume (or password if no TPM exists), or a password or smart card protector to a data volume. The drive security window displays prior to changing the volume status. Selecting **Activate BitLocker** will complete the encryption process. @@ -465,15 +422,17 @@ Once BitLocker protector activation is completed, the completion notice is displ ### Checking BitLocker status with manage-bde -Administrators who prefer a command line interface can utilize manage-bde to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, manage-bde can display the BitLocker version in use, the encryption type, and the protectors associated with a volume. +Administrators who prefer a command-line interface can utilize manage-bde to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, manage-bde can display the BitLocker version in use, the encryption type, and the protectors associated with a volume. To check the status of a volume using manage-bde, use the following command: ```powershell manage-bde -status ``` -> **Note:**  If no volume letter is associated with the -status command, all volumes on the computer display their status. - + +> [!NOTE] +> If no volume letter is associated with the -status command, all volumes on the computer display their status. + ### Checking BitLocker status with Windows PowerShell Windows PowerShell commands offer another way to query BitLocker status for volumes. Like manage-bde, Windows PowerShell includes the advantage of being able to check the status of a volume on a remote computer. @@ -483,11 +442,12 @@ Using the Get-BitLockerVolume cmdlet, each volume on the system will display its ```powershell Get-BitLockerVolume -Verbose | fl ``` + This command will display information about the encryption method, volume type, key protectors, etc. ### Provisioning BitLocker during operating system deployment -Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment. This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option described later in this document, this step takes only a few seconds and incorporates well into regular deployment processes. +Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment. This task is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option described later in this document, this step takes only a few seconds and incorporates well into regular deployment processes. ### Decrypting BitLocker volumes @@ -502,18 +462,20 @@ The control panel does not report decryption progress but displays it in the not Once decryption is complete, the drive will update its status in the control panel and is available for encryption. -### Decrypting volumes using the manage-bde command line interface +### Decrypting volumes using the manage-bde command-line interface -Decrypting volumes using manage-bde is very straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is: +Decrypting volumes using manage-bde is straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is: ```powershell manage-bde -off C: ``` + This command disables protectors while it decrypts the volume and removes all protectors when decryption is complete. If a user wishes to check the status of the decryption, they can use the following command: ```powershell manage-bde -status C: ``` + ### Decrypting volumes using the BitLocker Windows PowerShell cmdlets Decryption with Windows PowerShell cmdlets is straightforward, similar to manage-bde. The additional advantage Windows PowerShell offers is the ability to decrypt multiple drives in one pass. In the example below, the user has three encrypted volumes, which they wish to decrypt. @@ -523,16 +485,16 @@ Using the Disable-BitLocker command, they can remove all protectors and encrypti ```powershell Disable-BitLocker ``` + If a user did not want to input each mount point individually, using the `-MountPoint` parameter in an array can sequence the same command into one line without requiring additional user input. An example command is: ```powershell Disable-BitLocker -MountPoint E:,F:,G: ``` + ## See also - [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - [BitLocker recovery guide](bitlocker-recovery-guide-plan.md) - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) - [BitLocker overview](bitlocker-overview.md) - - diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index ab57ef7b30..6de06c740a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker Countermeasures diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md deleted file mode 100644 index f8fa65855e..0000000000 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: BitLocker deployment and administration FAQ (Windows 10) -description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?" -ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.reviewer: -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dansimp -ms.author: dansimp -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 02/28/2019 ---- - -# BitLocker frequently asked questions (FAQ) - -**Applies to** -- Windows 10 - -## Can BitLocker deployment be automated in an enterprise environment? - -Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps). - -## Can BitLocker encrypt more than just the operating system drive? - -Yes. - -## Is there a noticeable performance impact when BitLocker is enabled on a computer? - -Generally it imposes a single-digit percentage performance overhead. - -## How long will initial encryption take when BitLocker is turned on? - -Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting very large drives, you may want to set encryption to occur during times when you will not be using the drive. - -You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted. - -## What happens if the computer is turned off during encryption or decryption? - -If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable. - -## Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data? - -No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive. - -## How can I prevent users on a network from storing data on an unencrypted drive? - -You can configure Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. - -## What is Used Disk Space Only encryption? - -BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption). - -## What system changes would cause the integrity check on my operating system drive to fail? - -The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: - -- Moving the BitLocker-protected drive into a new computer. -- Installing a new motherboard with a new TPM. -- Turning off, disabling, or clearing the TPM. -- Changing any boot configuration settings. -- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data. - -## What causes BitLocker to start into recovery mode when attempting to start the operating system drive? - -Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. -For example: - -- Changing the BIOS boot order to boot another drive in advance of the hard drive. -- Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards. -- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. - -In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. -The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. - -## What can prevent BitLocker from binding to PCR 7? - -This happens if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it. - -## Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? - -Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive, so if you want to prepare a backup operating system or data drive for use in case of disk failure, you need to make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. - -## Can I access my BitLocker-protected drive if I insert the hard disk into a different computer? - -Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key. - -## Why is "Turn BitLocker on" not available when I right-click a drive? -Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted. - -## What type of disk configurations are supported by BitLocker? -Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported. - - diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml new file mode 100644 index 0000000000..8b59d31999 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml @@ -0,0 +1,96 @@ +### YamlMime:FAQ +metadata: + title: BitLocker deployment and administration FAQ (Windows 10) + description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?" + ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee + ms.reviewer: + ms.prod: w10 + ms.mktglfcycl: explore + ms.sitesec: library + ms.pagetype: security + ms.localizationpriority: medium + author: dansimp + ms.author: dansimp + manager: dansimp + audience: ITPro + ms.collection: M365-security-compliance + ms.topic: conceptual + ms.date: 02/28/2019 + ms.custom: bitlocker + +title: BitLocker frequently asked questions (FAQ) +summary: | + **Applies to** + - Windows 10 + + +sections: + - name: Ignored + questions: + - question: Can BitLocker deployment be automated in an enterprise environment? + answer: | + Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps). + + - question: Can BitLocker encrypt more than just the operating system drive? + answer: Yes. + + - question: Is there a noticeable performance impact when BitLocker is enabled on a computer? + answer: Typically, there's a small performance overhead, often in single-digit percentages, which is relative to the throughput of the storage operations on which it needs to operate. + + - question: How long will initial encryption take when BitLocker is turned on? + answer: | + Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting large drives, you may want to set encryption to occur during times when you will not be using the drive. + + You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted. + + - question: What happens if the computer is turned off during encryption or decryption? + answer: If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable. + + - question: Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data? + answer: No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive. + + - question: How can I prevent users on a network from storing data on an unencrypted drive? + answer: | + You can configure Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only. + + - question: What is Used Disk Space Only encryption? + answer: | + BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption). + + - question: What system changes would cause the integrity check on my operating system drive to fail? + answer: | + The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive: + + - Moving the BitLocker-protected drive into a new computer. + - Installing a new motherboard with a new TPM. + - Turning off, disabling, or clearing the TPM. + - Changing any boot configuration settings. + - Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data. + + - question: What causes BitLocker to start into recovery mode when attempting to start the operating system drive? + answer: | + Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode. + For example: + + - Changing the BIOS boot order to boot another drive in advance of the hard drive. + - Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards. + - Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. + + In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password. + The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed. + + - question: What can prevent BitLocker from binding to PCR 7? + answer: BitLocker can be prevented from binding to PCR 7 if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it. + + - question: Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive? + answer: Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive. So if you want to prepare a backup operating system or data drive in case a disk fails, make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts. + + - question: Can I access my BitLocker-protected drive if I insert the hard disk into a different computer? + answer: Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key. + + - question: Why is "Turn BitLocker on" not available when I right-click a drive? + answer: Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted. + + - question: What type of disk configurations are supported by BitLocker? + answer: Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported. diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index 7560239ff8..34008453ad 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -14,6 +14,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 ms.reviewer: +ms.custom: bitlocker --- # Overview of BitLocker Device Encryption in Windows 10 diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 3c5449bfe9..31ee0816da 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -15,18 +15,19 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- -# BitLocker frequently asked questions (FAQ) +# BitLocker frequently asked questions (FAQ) resources **Applies to** - Windows 10 This topic links to frequently asked questions about BitLocker. BitLocker is a data protection feature that encrypts drives on your computer to help prevent data theft or exposure. BitLocker-protected computers can also delete data more securely when they are decommissioned because it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive. -- [Overview and requirements](bitlocker-overview-and-requirements-faq.md) +- [Overview and requirements](bitlocker-overview-and-requirements-faq.yml) - [Upgrading](bitlocker-upgrading-faq.md) -- [Deployment and administration](bitlocker-deployment-and-administration-faq.md) +- [Deployment and administration](bitlocker-deployment-and-administration-faq.yml) - [Key management](bitlocker-key-management-faq.md) - [BitLocker To Go](bitlocker-to-go-faq.md) - [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index 09d6973301..2bda9b48ce 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -15,24 +15,30 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/17/2019 +ms.custom: bitlocker --- # BitLocker Group Policy settings -**Applies to** -- Windows 10 +**Applies to:** + +- Windows 10, Windows Server 2019, Windows Server 2016, Windows 8.1, and Windows Server 2012 R2 This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. To control what drive encryption tasks the user can perform from the Windows Control Panel or to modify other configuration options, you can use Group Policy administrative templates or local computer policy settings. How you configure these policy settings depends on how you implement BitLocker and what level of user interaction will be allowed. ->**Note:** A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings). +> [!NOTE] +> A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings). BitLocker Group Policy settings can be accessed using the Local Group Policy Editor and the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. Most of the BitLocker Group Policy settings are applied when BitLocker is initially turned on for a drive. If a computer is not compliant with existing Group Policy settings, BitLocker may not be turned on or modified until the computer is in a compliant state. When a drive is out of compliance with Group Policy settings (for example, if a Group Policy setting was changed after the initial BitLocker deployment in your organization, and then the setting was applied to previously encrypted drives), no change can be made to the BitLocker configuration of that drive except a change that will bring it into compliance. If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group -Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. +Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. + +> [!NOTE] +> For more details about Active Directory configuration related to BitLocker enablement, please see [Set up MDT for BitLocker](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker). ## BitLocker Group Policy settings @@ -99,98 +105,43 @@ The following policies are used to support customized deployment scenarios in yo This policy setting allows users on devices that are compliant with Modern Standby or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can allow TPM-only protection for newer, more secure devices, such as devices that support Modern Standby or HSTI, while requiring PIN on older devices.

            Introduced

            Windows 10, version 1703

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            This setting overrides the Require startup PIN with TPM option of the Require additional authentication at startup policy on compliant hardware. +||| +|--- |--- | +|Policy description|With this policy setting, you can allow TPM-only protection for newer, more secure devices, such as devices that support Modern Standby or HSTI, while requiring PIN on older devices.| +|Introduced|Windows 10, version 1703| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|This setting overrides the **Require startup PIN with TPM** option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware.| +|When enabled|Users on Modern Standby and HSTI compliant devices will have the choice to turn on BitLocker without preboot authentication.| +|When disabled or not configured|The options of the [Require additional authentication at startup](#bkmk-unlockpol1) policy apply.| -

            When enabled

            Users on Modern Standby and HSTI compliant devices will have the choice to turn on BitLocker without preboot authentication.

            When disabled or not configured

            The options of the Require additional authentication at startup policy apply.

            +**Reference** -Reference - -The preboot authentication option Require startup PIN with TPM of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that do not support Modern Standby. -But visually impaired users have no audible way to know when to enter a PIN. +The preboot authentication option **Require startup PIN with TPM** of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that do not support Modern Standby. But visually impaired users have no audible way to know when to enter a PIN. This setting enables an exception to the PIN-required policy on secure hardware. ### Allow network unlock at startup This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption. + This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control whether a BitLocker-protected computer that is connected to a trusted local area network and joined to a domain can create and use network key protectors on TPM-enabled computers to automatically unlock the operating system drive when the computer is started.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            Clients configured with a BitLocker Network Unlock certificate can create and use Network Key Protectors.

            When disabled or not configured

            Clients cannot create and use Network Key Protectors

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control whether a BitLocker-protected computer that is connected to a trusted local area network and joined to a domain can create and use network key protectors on TPM-enabled computers to automatically unlock the operating system drive when the computer is started.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|Clients configured with a BitLocker Network Unlock certificate can create and use Network Key Protectors.| +|When disabled or not configured|Clients cannot create and use Network Key Protectors| -Reference +**Reference** To use a network key protector to unlock the computer, the computer and the server that hosts BitLocker Drive Encryption Network Unlock must be provisioned with a Network Unlock certificate. The Network Unlock certificate is used to create a network key protector and to protect the information exchange with the server to unlock the computer. You can use the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** on the domain controller to distribute this certificate to computers in your organization. This unlock method uses the TPM on the computer, so computers that do not have a TPM cannot create network key protectors to automatically unlock by using Network Unlock. ->**Note:** For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. +> [!NOTE] +> For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. For more information about Network Unlock, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). @@ -198,46 +149,17 @@ For more information about Network Unlock, see [BitLocker: How to enable Network This policy setting is used to control which unlock options are available for operating system drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            If one authentication method is required, the other methods cannot be allowed.

            -

            Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

            When enabled

            Users can configure advanced startup options in the BitLocker Setup Wizard.

            When disabled or not configured

            Users can configure only basic options on computers with a TPM.

            -

            Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|If one authentication method is required, the other methods cannot be allowed. Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.| +|When enabled|Users can configure advanced startup options in the BitLocker Setup Wizard.| +|When disabled or not configured|Users can configure only basic options on computers with a TPM.

            Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.| -Reference +**Reference** If you want to use BitLocker on a computer without a TPM, select **Allow BitLocker without a compatible TPM**. In this mode, a password or USB drive is required for startup. The USB drive stores the startup key that is used to encrypt the drive. When the USB drive is inserted, the startup key is authenticated and the operating system drive is accessible. If the USB drive is lost or unavailable, BitLocker recovery is required to access the drive. @@ -275,101 +197,46 @@ There are four options for TPM-enabled computers or devices: This policy setting permits the use of enhanced PINs when you use an unlock method that includes a PIN. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure whether enhanced startup PINs are used with BitLocker.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.

            When disabled or not configured

            Enhanced PINs will not be used.

            - +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether enhanced startup PINs are used with BitLocker.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.| +|When disabled or not configured|Enhanced PINs will not be used.| **Reference** Enhanced startup PINs permit the use of characters (including uppercase and lowercase letters, symbols, numbers, and spaces). This policy setting is applied when you turn on BitLocker. ->**Important:** Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. +> [!IMPORANT] +> Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. ### Configure minimum PIN length for startup This policy setting is used to set a minimum PIN length when you use an unlock method that includes a PIN. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            You can require that startup PINs set by users must have a minimum length you choose that is between 4 and 20 digits.

            When disabled or not configured

            Users can configure a startup PIN of any length between 6 and 20 digits.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|You can require that startup PINs set by users must have a minimum length you choose that is between 4 and 20 digits.| +|When disabled or not configured|Users can configure a startup PIN of any length between 6 and 20 digits.| -Reference +**Reference** -This policy setting is applied when you turn on BitLocker. -The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. +This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. Originally, BitLocker allowed from 4 to 20 characters for a PIN. Windows Hello has its own PIN for logon, which can be 4 to 127 characters. Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks. -The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made. +The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made. The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability. For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. @@ -388,61 +255,33 @@ If the minimum PIN length is reduced from the default of six characters, then th This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI ports until a user signs in to Windows. -| | | -| - | - | -| **Policy description** | This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys. | -| **Introduced** | Windows 10, version 1703 | -| **Drive type** | Operating system drives | -| **Policy path** | Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -| **Conflicts** | None | -| **When enabled** | Every time the user locks the screen, DMA will be blocked on hot pluggable PCI ports until the user signs in again. | -| **When disabled or not configured** | DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| +| | | +|---------|---------| +|Policy description|This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys.| +|Introduced|Windows 10, version 1703| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|Every time the user locks the scree, DMA will be blocked on hot pluggable PCI ports until the user signs in again.| +|When disabled or not configured|DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| **Reference** -This policy setting is only enforced when BitLocker or device encryption is enabled. As explained in the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2018/01/18/issue-with-bitlockerdma-setting-in-windows-10-fall-creators-update-v1709/), in some cases when this setting is enabled, internal, PCI-based peripherals can fail, including wireless network drivers and input and audio peripherals. This problem is fixed in the [April 2018 quality update](https://support.microsoft.com/help/4093105/windows-10-update-kb4093105). +This policy setting is only enforced when BitLocker or device encryption is enabled. As explained in the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2018/01/18/issue-with-bitlockerdma-setting-in-windows-10-fall-creators-update-v1709/), in some cases when this setting is enabled, internal, PCI-based peripherals can fail, including wireless network drivers and input and audio peripherals. This problem is fixed in the [April 2018 quality update](https://support.microsoft.com/help/4093105). ### Disallow standard users from changing the PIN or password This policy setting allows you to configure whether standard users are allowed to change the PIN or password that is used to protect the operating system drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure whether standard users are allowed to change the PIN or password used to protect the operating system drive.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            Standard users are not allowed to change BitLocker PINs or passwords.

            When disabled or not configured

            Standard users are permitted to change BitLocker PINs or passwords.

            - +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether standard users are allowed to change the PIN or password used to protect the operating system drive.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|Standard users are not allowed to change BitLocker PINs or passwords.| +|When disabled or not configured|Standard users are permitted to change BitLocker PINs or passwords.| **Reference** @@ -452,55 +291,22 @@ To change the PIN or password, the user must be able to provide the current PIN This policy controls how non-TPM based systems utilize the password protector. Used in conjunction with the **Password must meet complexity requirements** policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose **Require password complexity** because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can specify the constraints for passwords that are used to unlock operating system drives that are protected with BitLocker.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            Passwords cannot be used if FIPS-compliance is enabled.

            -
            -Note

            The System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing policy setting, which is located at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options specifies whether FIPS-compliance is enabled.

            -
            -
            - -

            When enabled

            Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select Require complexity.

            When disabled or not configured

            The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.

            - +||| +|--- |--- | +|Policy description|With this policy setting, you can specify the constraints for passwords that are used to unlock operating system drives that are protected with BitLocker.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|Passwords cannot be used if FIPS-compliance is enabled.


            **NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options** specifies whether FIPS-compliance is enabled.| +|When enabled|Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select **Require complexity**.| +|When disabled or not configured|The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.| **Reference** If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** must be also enabled. ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. If no domain controllers are found, the password will be accepted regardless of actual password complexity, and the drive will be encrypted by using that password as a protector. When set to **Do not allow complexity**, there is no password complexity validation. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. @@ -515,44 +321,17 @@ When this policy setting is enabled, you can set the option **Configure password This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.

            Introduced

            Windows Server 2008 and Windows Vista

            Drive type

            Operating system drives (Windows Server 2008 and Windows Vista)

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            If you choose to require an additional authentication method, other authentication methods cannot be allowed.

            When enabled

            The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.

            When disabled or not configured

            The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.| +|Introduced|Windows Server 2008 and Windows Vista| +|Drive type|Operating system drives (Windows Server 2008 and Windows Vista)| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|If you choose to require an additional authentication method, other authentication methods cannot be allowed.| +|When enabled|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.| +|When disabled or not configured|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.| -Reference +**Reference** On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB drive that contains a startup key. It can also require users to enter a 6-digit to 20-digit startup PIN. @@ -579,97 +358,38 @@ To hide the advanced page on a TPM-enabled computer or device, set these options This policy setting is used to require, allow, or deny the use of smart cards with fixed data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Fixed data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

            Conflicts

            To use smart cards with BitLocker, you may also need to modify the object identifier setting in the Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance policy setting to match the object identifier of your smart card certificates.

            When enabled

            Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the Require use of smart cards on fixed data drives check box.

            When disabled

            Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.

            When not configured

            Smart cards can be used to authenticate user access to a BitLocker-protected drive.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| +|When enabled|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on fixed data drives** check box.| +|When disabled|Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.| +|When not configured|Smart cards can be used to authenticate user access to a BitLocker-protected drive.| -Reference +**Reference** ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. ### Configure use of passwords on fixed data drives This policy setting is used to require, allow, or deny the use of passwords with fixed data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can specify whether a password is required to unlock BitLocker-protected fixed data drives.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Fixed data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

            Conflicts

            To use password complexity, the Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements policy setting must also be enabled.

            When enabled

            Users can configure a password that meets the requirements you define. To require the use of a password, select Require password for fixed data drive. To enforce complexity requirements on the password, select Require complexity.

            When disabled

            The user is not allowed to use a password.

            When not configured

            Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected fixed data drives.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.| +|When enabled|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.| +|When disabled|The user is not allowed to use a password.| +|When not configured|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| -Reference +**Reference** When set to **Require complexity**, a connection to a domain controller is necessary to validate the complexity of the password when BitLocker is enabled. @@ -679,115 +399,58 @@ When set to **Do not allow complexity**, no password complexity validation is pe Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Password must meet complexity requirements** must also be enabled. This policy setting is configured on a per-computer basis. This means that it applies to local user accounts and domain user accounts. Because the password filter that is used to validate password complexity is located on the domain controllers, local user accounts cannot access the password filter because they are not authenticated for domain access. When this policy setting is enabled, if you sign in with a local user account, and you attempt to encrypt a drive or change a password on an existing BitLocker-protected drive, an "Access denied" error message is displayed. In this situation, the password key protector cannot be added to the drive. Enabling this policy setting requires that connectivity to a domain be established before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they cannot connect to the domain should be made aware of this requirement so that they can schedule a time when they will be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. ->**Important:** Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. +> [!IMPORTANT] +> Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. ### Configure use of smart cards on removable data drives This policy setting is used to require, allow, or deny the use of smart cards with removable data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Removable data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

            Conflicts

            To use smart cards with BitLocker, you may also need to modify the object identifier setting in the Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance policy setting to match the object identifier of your smart card certificates.

            When enabled

            Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the Require use of smart cards on removable data drives check box.

            When disabled or not configured

            Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.

            When not configured

            Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| +|When enabled|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on removable data drives** check box.| +|When disabled or not configured|Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.| +|When not configured|Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.| -Reference +**Reference** ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. ### Configure use of passwords on removable data drives This policy setting is used to require, allow, or deny the use of passwords with removable data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can specify whether a password is required to unlock BitLocker-protected removable data drives.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Removable data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

            Conflicts

            To use password complexity, the Password must meet complexity requirements policy setting, which is located at Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy must also be enabled.

            When enabled

            Users can configure a password that meets the requirements you define. To require the use of a password, select Require password for removable data drive. To enforce complexity requirements on the password, select Require complexity.

            When disabled

            The user is not allowed to use a password.

            When not configured

            Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.

            - -Reference +||| +|--- |--- | +|Policy description|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected removable data drives.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.| +|When enabled|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.| +|When disabled|The user is not allowed to use a password.| +|When not configured|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| +**Reference** If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** must also be enabled. ->**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. @@ -797,52 +460,26 @@ When set to **Allow complexity**, a connection to a domain controller will be at When set to **Do not allow complexity**, no password complexity validation will be done. ->**Note:** Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. +> [!NOTE] +> Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. -For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](https://technet.microsoft.com/library/jj852211.aspx). +For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing). ### Validate smart card certificate usage rule compliance This policy setting is used to determine what certificate to use with BitLocker. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can associate an object identifier from a smart card certificate to a BitLocker-protected drive.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Fixed and removable data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

            Conflicts

            None

            When enabled

            The object identifier that is specified in the Object identifier setting must match the object identifier in the smart card certificate.

            When disabled or not configured

            The default object identifier is used.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can associate an object identifier from a smart card certificate to a BitLocker-protected drive.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed and removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|The object identifier that is specified in the **Object identifier** setting must match the object identifier in the smart card certificate.| +|When disabled or not configured|The default object identifier is used.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -850,50 +487,24 @@ The object identifier is specified in the enhanced key usage (EKU) of a certific The default object identifier is 1.3.6.1.4.1.311.67.1.1. ->**Note:** BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. +> [!NOTE] +> BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. ### Enable use of BitLocker authentication requiring preboot keyboard input on slates This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can allow users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drive

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive

            Conflicts

            None

            When enabled

            Devices must have an alternative means of preboot input (such as an attached USB keyboard).

            When disabled or not configured

            The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can allow users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive| +|Conflicts|None| +|When enabled|Devices must have an alternative means of preboot input (such as an attached USB keyboard).| +|When disabled or not configured|The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.| -Reference +**Reference** The Windows touch keyboard (such as used by tablets) is not available in the preboot environment where BitLocker requires additional information, such as a PIN or password. @@ -911,44 +522,17 @@ If you do not enable this policy setting, the following options in the **Require This policy setting is used to require encryption of fixed drives prior to granting Write access. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can set whether BitLocker protection is required for fixed data drives to be writable on a computer.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Fixed data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

            Conflicts

            See the Reference section for a description of conflicts.

            When enabled

            All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.

            When disabled or not configured

            All fixed data drives on the computer are mounted with Read and Write access.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can set whether BitLocker protection is required for fixed data drives to be writable on a computer.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|See the Reference section for a description of conflicts.| +|When enabled|All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| +|When disabled or not configured|All fixed data drives on the computer are mounted with Read and Write access.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -966,48 +550,22 @@ Conflict considerations include: This policy setting is used to require that removable drives are encrypted prior to granting Write access, and to control whether BitLocker-protected removable drives that were configured in another organization can be opened with Write access. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure whether BitLocker protection is required for a computer to be able to write data to a removable data drive.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Removable data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

            Conflicts

            See the Reference section for a description of conflicts.

            When enabled

            All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.

            When disabled or not configured

            All removable data drives on the computer are mounted with Read and Write access.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether BitLocker protection is required for a computer to be able to write data to a removable data drive.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|See the Reference section for a description of conflicts.| +|When enabled|All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| +|When disabled or not configured|All removable data drives on the computer are mounted with Read and Write access.| -Reference +**Reference** If the **Deny write access to devices configured in another organization** option is selected, only drives with identification fields that match the computer's identification fields are given Write access. When a removable data drive is accessed, it is checked for a valid identification field and allowed identification fields. These fields are defined by the **Provide the unique identifiers for your organization** policy setting. ->**Note:** You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. +> [!NOTE] +> You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. Conflict considerations include: @@ -1019,52 +577,22 @@ Conflict considerations include: This policy setting is used to prevent users from turning BitLocker on or off on removable data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control the use of BitLocker on removable data drives.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Removable data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

            Conflicts

            None

            When enabled

            You can select property settings that control how users can configure BitLocker.

            When disabled

            Users cannot use BitLocker on removable data drives.

            When not configured

            Users can use BitLocker on removable data drives.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control the use of BitLocker on removable data drives.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|None| +|When enabled|You can select property settings that control how users can configure BitLocker.| +|When disabled|Users cannot use BitLocker on removable data drives.| +|When not configured|Users can use BitLocker on removable data drives.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. -For information about suspending BitLocker protection, see [BitLocker Basic Deployment](https://technet.microsoft.com/library/dn383581.aspx). +For information about suspending BitLocker protection, see [BitLocker Basic Deployment](bitlocker-basic-deployment.md). The options for choosing property settings that control how users can configure BitLocker are: @@ -1075,44 +603,17 @@ The options for choosing property settings that control how users can configure This policy setting is used to control the encryption method and cipher strength. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control the encryption method and strength for drives.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            All drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

            Conflicts

            None

            When enabled

            You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.

            When disabled or not configured

            Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control the encryption method and strength for drives.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.| +|When disabled or not configured|Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.| -Reference +**Reference** The values of this policy determine the strength of the cipher that BitLocker uses for encryption. Enterprises may want to control the encryption level for increased security (AES-256 is stronger than AES-128). @@ -1123,7 +624,8 @@ For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the d Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored. ->**Warning:** This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. +> [!WARNING] +> This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. When this policy setting is disabled or not configured, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method that is specified in the setup script. @@ -1131,51 +633,21 @@ When this policy setting is disabled or not configured, BitLocker will use the d This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they are used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can manage BitLocker’s use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Fixed data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

            Conflicts

            None

            When enabled

            You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.

            When disabled

            BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.

            When not configured

            BitLocker software-based encryption is used irrespective of hardware-based encryption ability. -

            +||| +|--- |--- | +|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|None| +|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|When disabled|BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| -Reference +**Reference** ->**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> [!NOTE] +> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: @@ -1186,52 +658,23 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls how BitLocker reacts when encrypted drives are used as operating system drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can manage BitLocker’s use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encryption.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.

            When disabled

            BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.

            When not configured

            BitLocker software-based encryption is used irrespective of hardware-based encryption ability.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encryption.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|When disabled|BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| -Reference +**Reference** If hardware-based encryption is not available, BitLocker software-based encryption is used instead. ->**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> [!NOTE] +> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: @@ -1242,52 +685,23 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls how BitLocker reacts to encrypted drives when they are used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Removable data drive

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

            Conflicts

            None

            When enabled

            You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.

            When disabled

            BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.

            When not configured

            BitLocker software-based encryption is used irrespective of hardware-based encryption ability.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Removable data drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|None| +|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|When disabled|BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| -Reference +**Reference** If hardware-based encryption is not available, BitLocker software-based encryption is used instead. ->**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. +> [!NOTE] +> The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: @@ -1298,192 +712,86 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls whether fixed data drives utilize Used Space Only encryption or Full encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page so no encryption selection displays to the user. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure the encryption type that is used by BitLocker.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Fixed data drive

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

            Conflicts

            None

            When enabled

            This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.

            When disabled or not configured

            The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Fixed data drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|None| +|When enabled|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:** This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> [!NOTE] +> This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). +For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). ### Enforce drive encryption type on operating system drives This policy controls whether operating system drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure the encryption type that is used by BitLocker.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drive

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.

            When disabled or not configured

            The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:** This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> [!NOTE] +> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). +For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). ### Enforce drive encryption type on removable data drives This policy controls whether fixed data drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure the encryption type that is used by BitLocker.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Removable data drive

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

            Conflicts

            None

            When enabled

            The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.

            When disabled or not configured

            The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Removable data drive| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|None| +|When enabled|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:** This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. +> [!NOTE] +> This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). +For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). ### Choose how BitLocker-protected operating system drives can be recovered This policy setting is used to configure recovery methods for operating system drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            You must disallow the use of recovery keys if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

            -

            When using data recovery agents, you must enable the Provide the unique identifiers for your organization policy setting.

            When enabled

            You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.

            When disabled or not configured

            The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

            When using data recovery agents, you must enable the **Provide the unique identifiers for your organization** policy setting.| +|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.| +|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -1500,50 +808,24 @@ In **Save BitLocker recovery information to Active Directory Domain Services**, Select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. ->**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated. +> [!NOTE] +> If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated. ### Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista) This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.

            Introduced

            Windows Server 2008 and Windows Vista

            Drive type

            Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

            Conflicts

            This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the Do not allow option for both user recovery options, you must enable the Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) policy setting to prevent a policy error.

            When enabled

            You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.

            When disabled or not configured

            The BitLocker Setup Wizard presents users with ways to store recovery options.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.| +|Introduced|Windows Server 2008 and Windows Vista| +|Drive type|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the **Do not allow** option for both user recovery options, you must enable the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting to prevent a policy error.| +|When enabled|You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.| +|When disabled or not configured|The BitLocker Setup Wizard presents users with ways to store recovery options.| -Reference +**Reference** This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. @@ -1551,53 +833,28 @@ Two recovery options can be used to unlock BitLocker-encrypted data in the absen Saving the recovery password to a USB drive stores the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving it to a folder stores the 48-digit recovery password as a text file. Printing it sends the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password prevents users from printing or saving recovery information to a folder. -> **Important:** If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. +> [!IMPORTANT] +> If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. > The 48-digit recovery password is not available in FIPS-compliance mode. -> -> **Important:** To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. + +> [!IMPORTANT] +> To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. ### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.

            Introduced

            Windows Server 2008 and Windows Vista

            Drive type

            Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

            Conflicts

            None

            When enabled

            BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.

            When disabled or not configured

            BitLocker recovery information is not backed up to AD DS.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.| +|Introduced|Windows Server 2008 and Windows Vista| +|Drive type|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.| +|When disabled or not configured|BitLocker recovery information is not backed up to AD DS.| -Reference +**Reference** This policy is only applicable to computers running Windows Server 2008 or Windows Vista. @@ -1618,92 +875,38 @@ For more information about this setting, see [TPM Group Policy settings](/window This policy setting is used to configure the default folder for recovery passwords. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can specify the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password.

            Introduced

            Windows Vista

            Drive type

            All drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

            Conflicts

            None

            When enabled

            You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.

            When disabled or not configured

            The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can specify the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password.| +|Introduced|Windows Vista| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.| +|When disabled or not configured|The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. ->**Note:** This policy setting does not prevent the user from saving the recovery password in another folder. +> [!NOTE] +> This policy setting does not prevent the user from saving the recovery password in another folder. ### Choose how BitLocker-protected fixed drives can be recovered This policy setting is used to configure recovery methods for fixed data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Fixed data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

            Conflicts

            You must disallow the use of recovery keys if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

            -

            When using data recovery agents, you must enable and configure the Provide the unique identifiers for your organization policy setting.

            When enabled

            You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.

            When disabled or not configured

            The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

            When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| +|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.| +|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -1716,55 +919,29 @@ Select **Omit recovery options from the BitLocker setup wizard** to prevent user In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. -For more information about the BitLocker repair tool, see [Repair-bde](https://technet.microsoft.com/library/ff829851.aspx). +For more information about the BitLocker repair tool, see [Repair-bde](/windows-server/administration/windows-commands/repair-bde). Select the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. ->**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. +> [!NOTE] +> If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. ### Choose how BitLocker-protected removable drives can be recovered This policy setting is used to configure recovery methods for removable data drives. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control how BitLocker-protected removable data drives are recovered in the absence of the required credentials.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Removable data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

            Conflicts

            You must disallow the use of recovery keys if the Deny write access to removable drives not protected by BitLocker policy setting is enabled.

            -

            When using data recovery agents, you must enable and configure the Provide the unique identifiers for your organization policy setting.

            When enabled

            You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.

            When disabled or not configured

            The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control how BitLocker-protected removable data drives are recovered in the absence of the required credentials.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. +When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| +|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.| +|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. @@ -1778,50 +955,24 @@ In **Save BitLocker recovery information to Active Directory Domain Services**, Select the **Do not enable BitLocker until recovery information is stored in AD DS for removable data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. ->**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. +> [!NOTE] +> If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. ### Configure the pre-boot recovery message and URL This policy setting is used to configure the entire recovery message and to replace the existing URL that is displayed on the pre-boot recovery screen when the operating system drive is locked. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.

            Introduced

            Windows 10

            Drive type

            Operating system drives

            Policy path

            Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL

            Conflicts

            None

            When enabled

            The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the Use default recovery message and URL option.

            When disabled or not configured

            If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.| +|Introduced|Windows 10| +|Drive type|Operating system drives| +|Policy path|Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL| +|Conflicts|None| +|When enabled|The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the **Use default recovery message and URL** option.| +|When disabled or not configured|If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.| -Reference +**Reference** Enabling the **Configure the pre-boot recovery message and URL** policy setting allows you to customize the default recovery screen message and URL to assist customers in recovering their key. @@ -1831,111 +982,59 @@ Once you enable the setting you have three options: - If you select the **Use custom recovery message** option, type the custom message in the **Custom recovery message option** text box. The message that you type in the **Custom recovery message option** text box will be displayed on the pre-boot recovery screen. If a recovery URL is available, include it in the message. - If you select the **Use custom recovery URL** option, type the custom message URL in the **Custom recovery URL option** text box. The URL that you type in the **Custom recovery URL option** text box replaces the default URL in the default recovery message, which will be displayed on the pre-boot recovery screen. -> **Important:** Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. -> -> **Important:** Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. +> [!IMPORTANT] +> Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. + +> [!IMPORTANT] +> Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. ### Allow Secure Boot for integrity validation This policy controls how BitLocker-enabled system volumes are handled in conjunction with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            All drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            If you enable Allow Secure Boot for integrity validation, make sure the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

            -

            For more information about PCR 7, see Platform Configuration Register (PCR) in this topic.

            When enabled or not configured

            BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.

            When disabled

            BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|If you enable **Allow Secure Boot for integrity validation**, make sure the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

            For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| +|When enabled or not configured|BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.| +|When disabled|BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.| -Reference +**Reference** Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. Secure Boot also provides more flexibility for managing preboot configurations than BitLocker integrity checks prior to Windows Server 2012 and Windows 8. When this policy is enabled and the hardware is capable of using Secure Boot for BitLocker scenarios, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored, and Secure Boot verifies BCD settings according to the Secure Boot policy setting, which is configured separately from BitLocker. ->**Warning:** Enabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. +> [!WARNING] +> Disabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. ### Provide the unique identifiers for your organization This policy setting is used to establish an identifier that is applied to all drives that are encrypted in your organization. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can associate unique organizational identifiers to a new drive that is enabled with BitLocker.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            All drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

            Conflicts

            Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.

            When enabled

            You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.

            When disabled or not configured

            The identification field is not required.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can associate unique organizational identifiers to a new drive that is enabled with BitLocker.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.| +|When enabled|You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.| +|When disabled or not configured|The identification field is not required.| -Reference +**Reference** -These identifiers are stored as the identification field and the allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives, and it can be updated on existing BitLocker-protected drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. +These identifiers are stored as the identification field and the allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives, and it can be updated on existing BitLocker-protected drives by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool. An identification field is required to manage certificate-based data recovery agents on BitLocker-protected drives and for potential updates to the BitLocker To Go Reader. BitLocker manages and updates data recovery agents only when the identification field on the drive matches the value that is configured in the identification field. In a similar manner, BitLocker updates the BitLocker To Go Reader only when the identification field on the drive matches the value that is configured for the identification field. -For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). +For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). The allowed identification field is used in combination with the **Deny write access to removable drives not protected by BitLocker** policy setting to help control the use of removable drives in your organization. It is a comma-separated list of identification fields from your organization or external organizations. -You can configure the identification fields on existing drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. +You can configure the identification fields on existing drives by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool. When a BitLocker-protected drive is mounted on another BitLocker-enabled computer, the identification field and the allowed identification field are used to determine whether the drive is from an outside organization. @@ -1945,44 +1044,17 @@ Multiple values separated by commas can be entered in the identification and all This policy setting is used to control whether the computer's memory will be overwritten the next time the computer is restarted. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control computer restart performance at the risk of exposing BitLocker secrets.

            Introduced

            Windows Vista

            Drive type

            All drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

            Conflicts

            None

            When enabled

            The computer will not overwrite memory when it restarts. Preventing memory overwrite may improve restart performance, but it increases the risk of exposing BitLocker secrets.

            When disabled or not configured

            BitLocker secrets are removed from memory when the computer restarts.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control computer restart performance at the risk of exposing BitLocker secrets.| +|Introduced|Windows Vista| +|Drive type|All drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|Conflicts|None| +|When enabled|The computer will not overwrite memory when it restarts. Preventing memory overwrite may improve restart performance, but it increases the risk of exposing BitLocker secrets.| +|When disabled or not configured|BitLocker secrets are removed from memory when the computer restarts.| -Reference +**Reference** This policy setting is applied when you turn on BitLocker. BitLocker secrets include key material that is used to encrypt data. This policy setting applies only when BitLocker protection is enabled. @@ -1990,48 +1062,22 @@ This policy setting is applied when you turn on BitLocker. BitLocker secrets inc This policy setting determines what values the TPM measures when it validates early boot components before it unlocks an operating system drive on a computer with a BIOS configuration or with UEFI firmware that has the Compatibility Support Module (CSM) enabled. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.

            When disabled or not configured

            The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|When disabled or not configured|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| -Reference +**Reference** This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. ->**Important:** This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. +> [!IMPORTANT] +> This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: @@ -2043,7 +1089,8 @@ A platform validation profile consists of a set of PCR indices that range from 0 - Boot Manager (PCR 10) - BitLocker Access Control (PCR 11) ->**Note:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. +> [!NOTE] +> Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. The following list identifies all of the PCRs available: @@ -2065,44 +1112,17 @@ The following list identifies all of the PCRs available: This policy setting determines what values the TPM measures when it validates early boot components before unlocking a drive on a computer running Windows Vista, Windows Server 2008, or Windows 7. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.

            Introduced

            Windows Server 2008 and Windows Vista

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.

            When disabled or not configured

            The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.| +|Introduced|Windows Server 2008 and Windows Vista| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|When disabled or not configured|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| -Reference +**Reference** This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. @@ -2116,7 +1136,8 @@ A platform validation profile consists of a set of PCR indices that range from 0 - Boot Manager (PCR 10) - BitLocker Access Control (PCR 11) ->**Note:** The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only. +> [!NOTE] +> The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only. The following list identifies all of the PCRs available: @@ -2134,56 +1155,29 @@ The following list identifies all of the PCRs available: - PCR 11: BitLocker access control - PCR 12 - 23: Reserved for future use ->**Warning:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. +> [!WARNING] +> Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. ### Configure TPM platform validation profile for native UEFI firmware configurations This policy setting determines what values the TPM measures when it validates early boot components before unlocking an operating system drive on a computer with native UEFI firmware configurations. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            Setting this policy with PCR 7 omitted, overrides the Allow Secure Boot for integrity validation Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation.

            -

            If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.

            -

            For more information about PCR 7, see Platform Configuration Register (PCR) in this topic.

            When enabled

            Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.

            When disabled or not configured

            BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|Setting this policy with PCR 7 omitted, overrides the **Allow Secure Boot for integrity validation** Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation,

            If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.

            For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| +|When enabled|Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|When disabled or not configured|BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.| -Reference +**Reference** This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. ->**Important:** This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. +> [!IMPORTANT] +> This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. The default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). @@ -2209,54 +1203,25 @@ The following list identifies all of the PCRs available: - PCR 14: Boot Authorities - PCR 15 – 23: Reserved for future use ->**Warning:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. +> [!WARNING] +> Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. ### Reset platform validation data after BitLocker recovery This policy setting determines if you want platform validation data to refresh when Windows is started following a BitLocker recovery. A platform validation data profile consists of the values in a set of Platform Configuration Register (PCR) indices that range from 0 to 23. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can control whether platform validation data is refreshed when Windows is started following a BitLocker recovery.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            None

            When enabled

            Platform validation data is refreshed when Windows is started following a BitLocker recovery.

            When disabled

            Platform validation data is not refreshed when Windows is started following a BitLocker recovery.

            When not configured

            Platform validation data is refreshed when Windows is started following a BitLocker recovery.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can control whether platform validation data is refreshed when Windows is started following a BitLocker recovery.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|None| +|When enabled|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| +|When disabled|Platform validation data is not refreshed when Windows is started following a BitLocker recovery.| +|When not configured|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| -Reference +**Reference** For more information about the recovery process, see the [BitLocker recovery guide](bitlocker-recovery-guide-plan.md). @@ -2264,95 +1229,40 @@ For more information about the recovery process, see the [BitLocker recovery gui This policy setting determines specific Boot Configuration Data (BCD) settings to verify during platform validation. A platform validation uses the data in the platform validation profile, which consists of a set of Platform Configuration Register (PCR) indices that range from 0 to 23. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can specify Boot Configuration Data (BCD) settings to verify during platform validation.

            Introduced

            Windows Server 2012 and Windows 8

            Drive type

            Operating system drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives

            Conflicts

            When BitLocker is using Secure Boot for platform and Boot Configuration Data integrity validation, the Use enhanced Boot Configuration Data validation profile Group Policy setting is ignored (as defined by the Allow Secure Boot for integrity validation Group Policy setting).

            When enabled

            You can add additional BCD settings, exclude the BCD settings you specify, or combine inclusion and exclusion lists to create a customized BCD validation profile, which gives you the ability to verify those BCD settings.

            When disabled

            The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.

            When not configured

            The computer verifies the default BCD settings in Windows.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can specify Boot Configuration Data (BCD) settings to verify during platform validation.| +|Introduced|Windows Server 2012 and Windows 8| +|Drive type|Operating system drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|Conflicts|When BitLocker is using Secure Boot for platform and Boot Configuration Data integrity validation, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored (as defined by the **Allow Secure Boot for integrity validation** Group Policy setting).| +|When enabled|You can add additional BCD settings, exclude the BCD settings you specify, or combine inclusion and exclusion lists to create a customized BCD validation profile, which gives you the ability to verify those BCD settings.| +|When disabled|The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.| +|When not configured|The computer verifies the default BCD settings in Windows.| -Reference +**Reference** ->**Note:** The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. +> [!NOTE] +> The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. ### Allow access to BitLocker-protected fixed data drives from earlier versions of Windows This policy setting is used to control whether access to drives is allowed by using the BitLocker To Go Reader, and if the application is installed on the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure whether fixed data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2).

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Fixed data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives

            Conflicts

            None

            When enabled and When not configured

            Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.

            When disabled

            Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether fixed data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2).| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Fixed data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|Conflicts|None| +|When enabled and When not configured|Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| +|When disabled|Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| -Reference +**Reference** ->**Note:** This policy setting does not apply to drives that are formatted with the NTFS file system. +> [!NOTE] +> This policy setting does not apply to drives that are formatted with the NTFS file system. When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted fixed drives** check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user is prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. @@ -2360,46 +1270,20 @@ When this policy setting is enabled, select the **Do not install BitLocker To Go This policy setting controls access to removable data drives that are using the BitLocker To Go Reader and whether the BitLocker To Go Reader can be installed on the drive. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            With this policy setting, you can configure whether removable data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2.

            Introduced

            Windows Server 2008 R2 and Windows 7

            Drive type

            Removable data drives

            Policy path

            Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

            Conflicts

            None

            When enabled and When not configured

            Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.

            When disabled

            Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.

            +||| +|--- |--- | +|Policy description|With this policy setting, you can configure whether removable data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2.| +|Introduced|Windows Server 2008 R2 and Windows 7| +|Drive type|Removable data drives| +|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|Conflicts|None| +|When enabled and When not configured|Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| +|When disabled|Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| -Reference +**Reference** ->**Note:** This policy setting does not apply to drives that are formatted with the NTFS file system. +> [!NOTE] +> This policy setting does not apply to drives that are formatted with the NTFS file system. When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted removable drives** check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user will be prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the removable drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed. @@ -2407,44 +1291,17 @@ When this policy setting is enabled, select the **Do not install BitLocker To Go You can configure the Federal Information Processing Standard (FIPS) setting for FIPS compliance. As an effect of FIPS compliance, users cannot create or save a BitLocker password for recovery or as a key protector. The use of a recovery key is permitted. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

            Policy description

            Notes

            Introduced

            Windows Server 2003 with SP1

            Drive type

            System-wide

            Policy path

            Local Policies\Security Options\System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing

            Conflicts

            Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.

            When enabled

            Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.

            When disabled or not configured

            No BitLocker encryption key is generated

            +||| +|--- |--- | +|Policy description|Notes| +|Introduced|Windows Server 2003 with SP1| +|Drive type|System-wide| +|Policy path|Local Policies\Security Options\System cryptography: **Use FIPS compliant algorithms for encryption, hashing, and signing**| +|Conflicts|Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.| +|When enabled|Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.| +|When disabled or not configured|No BitLocker encryption key is generated| -Reference +**Reference** This policy needs to be enabled before any encryption key is generated for BitLocker. Note that when this policy is enabled, BitLocker prevents creating or using recovery passwords, so recovery keys should be used instead. @@ -2452,7 +1309,7 @@ You can save the optional recovery key to a USB drive. Because recovery password You can edit the FIPS setting by using the Security Policy Editor (Secpol.msc) or by editing the Windows registry. You must be an administrator to perform these procedures. -For more information about setting this policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](https://technet.microsoft.com/library/jj852197.aspx). +For more information about setting this policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing). ## Power management Group Policy settings: Sleep and Hibernate @@ -2476,11 +1333,12 @@ Changing from the default platform validation profile affects the security and m PCR 7 measures the state of Secure Boot. With PCR 7, BitLocker can leverage Secure Boot for integrity validation. Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. PCR 7 measurements indicate whether Secure Boot is on and which keys are trusted on the platform. If Secure Boot is on and the firmware measures PCR 7 correctly per the UEFI specification, BitLocker can bind to this information rather than to PCRs 0, 2, and 4 which have the measurements of the exact firmware and Bootmgr images loaded. This reduces the likelihood of BitLocker starting in recovery mode as a result of firmware and image updates, and it provides you with greater flexibility to manage the preboot configuration. -PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](https://msdn.microsoft.com/library/windows/hardware/jj923068.aspx). +PCR 7 measurements must follow the guidance that is described in [Appendix A Trusted Execution Environment EFI Protocol](/windows-hardware/test/hlk/testref/trusted-execution-environment-efi-protocol). PCR 7 measurements are a mandatory logo requirement for systems that support Modern Standby (also known as Always On, Always Connected PCs), such as the Microsoft Surface RT. On such systems, if the TPM with PCR 7 measurement and Secure Boot are correctly configured, BitLocker binds to PCR 7 and PCR 11 by default. ## See also + - [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview) - [TPM Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md index 121b0d3e49..4ba7629cc0 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker: How to deploy on Windows Server 2012 and later diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index a7a7e7fce7..b69e88d45f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -1,6 +1,6 @@ --- -title: BitLocker How to enable Network Unlock (Windows 10) -description: This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. +title: BitLocker - How to enable Network Unlock (Windows 10) +description: This article for the IT professional describes how BitLocker Network Unlock works and how to configure it. ms.assetid: be45bc28-47db-4931-bfec-3c348151d2e9 ms.reviewer: ms.prod: w10 @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker: How to enable Network Unlock @@ -22,178 +23,168 @@ ms.date: 02/28/2019 **Applies to** - Windows 10 -This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. +This article for IT professionals describes how BitLocker Network Unlock works and how to configure it. -Network Unlock was introduced in Windows 8 and Windows Server 2012 as a BitLocker protector option for operating system volumes. Network Unlock enables easier management for BitLocker enabled desktops and servers in a domain environment by providing automatic unlock of operating system volumes at system reboot when connected to a wired corporate network. This feature requires the client hardware to have a DHCP driver implemented in its UEFI firmware. -Without Network Unlock, operating system volumes protected by TPM+PIN protectors require a PIN to be entered when a computer reboots or resumes from hibernation (for example, by Wake on LAN). This can make it difficult to enterprises to roll out software patches to unattended desktops and remotely administered servers. +Network Unlock was introduced in Windows 8 and Windows Server 2012 as a BitLocker protector option for operating system volumes. Network Unlock helps you manage BitLocker-enabled desktops and servers in a domain environment by automatically unlocking operating system volumes when the system is rebooted and is connected to a wired corporate network. This feature requires the client hardware to have a DHCP driver implemented in its UEFI firmware. -Network Unlock allows BitLocker-enabled systems with TPM+PIN and that meet the hardware requirements to boot into Windows without user intervention. Network Unlock works in a similar fashion to the TPM+StartupKey at boot. Rather than needing to read the StartupKey from USB media, however, the key for Network Unlock is composed from a key stored in the TPM and an encrypted network key that is sent to the server, decrypted and returned to the client in a secure session. +Without Network Unlock, operating system volumes that use TPM+PIN protectors require a PIN when a computer reboots or resumes after hibernation (for example, by Wake on LAN). For enterprises, this setup can make software patches difficult to roll out to unattended desktops and remotely administered servers. -This topic contains: - -- [Network Unlock core requirements](#bkmk-nunlockcorereqs) -- [Network Unlock sequence](#bkmk-networkunlockseq) -- [Configure Network Unlock](#bkmk-configuringnetworkunlock) -- [Create the certificate template for Network Unlock](#bkmk-createcerttmpl) -- [Turning off Network Unlock](#bkmk-turnoffnetworkunlock) -- [Update Network Unlock certificates](#bkmk-updatecerts) -- [Troubleshoot Network Unlock](#bkmk-troubleshoot) -- [Configure Network Unlock on unsupported systems](#bkmk-unsupportedsystems) +Network Unlock allows BitLocker-enabled systems that use TPM+PIN and that meet the hardware requirements to boot into Windows without user intervention. Network Unlock works like the TPM+StartupKey at boot. But the StartupKey doesn't need to be read from USB media. Instead, the key for Network Unlock is composed from a key that's stored in the TPM and an encrypted network key that's sent to the server. It's decrypted and returned to the client in a secure session. ## Network Unlock core requirements -Network Unlock must meet mandatory hardware and software requirements before the feature can automatically unlock domain joined systems. These requirements include: +Network Unlock requires the following mandatory hardware and software configurations before it can automatically unlock domain-joined systems: - You must be running at least Windows 8 or Windows Server 2012. -- Any supported operating system with UEFI DHCP drivers can be Network Unlock clients. -- Network Unlock clients must have a TPM chip and at least one TPM protector. -- A server running the Windows Deployment Services (WDS) role on any supported server operating system. -- BitLocker Network Unlock optional feature installed on any supported server operating system. -- A DHCP server, separate from the WDS server. -- Properly configured public/private key pairing. -- Network Unlock Group Policy settings configured. +- Any supported operating system that uses UEFI DHCP drivers can be a Network Unlock client. +- Network Unlock clients must have a TPM (trusted platform module) chip and at least one TPM protector. +- You must have a server running the Windows Deployment Services (WDS) role on any supported server operating system. +- The BitLocker Network Unlock optional feature can be installed on any supported server operating system. +- You must have a DHCP server, separate from the WDS server. +- You must have a properly configured public/private key pairing. +- Network Unlock Group Policy settings must be configured. -The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus, so you need to confirm that the network stack has been enabled in the BIOS before starting the computer. +The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus. So confirm that the network stack has been enabled in the BIOS before you start the computer. > [!NOTE] -> To properly support DHCP within UEFI, the UEFI-based system should be in native mode without a compatibility support module (CSM) enabled. +> To properly support DHCP within UEFI, the UEFI-based system should be in native mode and shouldn't have a compatibility support module (CSM) enabled. -For Network Unlock to work reliably on computers running Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP and used for Network Unlock. This is especially worth noting when you have multiple adapters, and you wish to configure one without DHCP, such as for a lights-out management protocol. This configuration is necessary because Network Unlock will stop enumerating adapters when it reaches one with a DHCP port failure for any reason. Thus, if the first enumerated adapter does not support DHCP, is not plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail. +On computers that run Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP. This adapter must be used for Network Unlock. + +Use this configuration especially when you have multiple adapters and you want to configure one without DHCP, such as for a lights-out management protocol. The configuration is necessary because Network Unlock stops enumerating adapters when it reaches an adapter that has a DHCP port that has failed for any reason. So if the first enumerated adapter doesn't support DHCP, isn't plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail. -The Network Unlock server component installs on supported versions of Windows Server 2012 and later as a Windows feature using Server Manager or Windows PowerShell cmdlets. The feature name is BitLocker Network Unlock in Server Manager and BitLocker-NetworkUnlock in Windows PowerShell. This feature is a core requirement. +On supported versions of Windows Server 2012 and later, the Network Unlock server component installs as a Windows feature. It uses Server Manager or Windows PowerShell cmdlets. In Server Manager, the feature name is BitLocker Network Unlock. In Windows PowerShell, the feature name is BitLocker-NetworkUnlock. This feature is a core requirement. -Network Unlock requires Windows Deployment Services (WDS) in the environment where the feature will be utilized. Configuration of the WDS installation is not required; however, the WDS service needs to be running on the server. +Network Unlock requires WDS in the environment where the feature will be used. Configuration of the WDS installation isn't required. But the WDS service must be running on the server. -The network key is stored on the system drive along with an AES 256 session key, and encrypted with the 2048-bit RSA public key of the unlock server's certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server running WDS, and returned encrypted with its corresponding session key. +The network key is stored on the system drive along with an AES 256 session key. It's encrypted with the 2048-bit RSA public key of the unlock server's certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server that's running WDS. The network key is returned encrypted with its corresponding session key. ## Network Unlock sequence -The unlock sequence starts on the client side, when the Windows boot manager detects the existence of Network Unlock protector. It leverages the DHCP driver in UEFI to obtain an IP address for IPv4 and then broadcasts a vendor-specific DHCP request that contains the network key and a session key for the reply, all encrypted by the server's Network Unlock certificate, as described above. The Network Unlock provider on the supported WDS server recognizes the vendor-specific request, decrypts it with the RSA private key, and returns the network key encrypted with the session key via its own vendor-specific DHCP reply. +The unlock sequence starts on the client side, when the Windows boot manager detects the existence of the Network Unlock protector. It uses the DHCP driver in UEFI to get an IP address for IPv4. Then it broadcasts a vendor-specific DHCP request that contains the network key and a session key for the reply, all encrypted by the server's Network Unlock certificate, as described earlier. The Network Unlock provider on the supported WDS server recognizes the vendor-specific request, decrypts it with the RSA private key, and returns the network key encrypted with the session key via its own vendor-specific DHCP reply. -On the server side, the WDS server role has an optional plugin component, like a PXE provider, which is what handles the incoming Network Unlock requests. The provider can also be configured with subnet restrictions, which would require that the IP address provided by the client in the Network Unlock request belong to a permitted subnet in order to release the network key to the client. In instances where the Network Unlock provider is unavailable, BitLocker fails over to the next available protector to unlock the drive. In a typical configuration, this means the standard TPM+PIN unlock screen is presented to unlock the drive. +On the server side, the WDS server role has an optional plug-in component, like a PXE (preboot execution environment) provider. The plug-in component handles the incoming Network Unlock requests. The provider can also be configured with subnet restrictions. These restrictions require the IP address that's provided by the client in the Network Unlock request to belong to a permitted subnet in order to release the network key to the client. If the Network Unlock provider is unavailable, then BitLocker fails over to the next available protector to unlock the drive. So in a typical configuration, the standard TPM+PIN unlock screen is presented to unlock the drive. -The server side configuration to enable Network Unlock also requires provisioning a 2048-bit RSA public/private key pair in the form of an X.509 certificate, and for the public key certificate to be distributed to the clients. This certificate must be managed and deployed through the Group Policy editor directly on a domain controller with at least a Domain Functional Level of Windows Server 2012. This certificate is the public key that encrypts the intermediate network key (which is one of the two secrets required to unlock the drive; the other secret is stored in the TPM). +The server-side configuration to enable Network Unlock requires provisioning a 2048-bit RSA public/private key pair in the form of an X.509 certificate. The configuration also requires the public key certificate to be distributed to the clients. -![bitlocker network unlock sequence](images/bitlockernetworkunlocksequence.png) +Manage and deploy this certificate through the Group Policy editor directly on a domain controller that has a domain functional level of at least Windows Server 2012. This certificate is the public key that encrypts the intermediate network key. The intermediate network key is one of the two secrets that are required to unlock the drive; the other secret is stored in the TPM. -**Phases in the Network Unlock process** +![Diagram showing the BitLocker network unlock sequence.](images/bitlockernetworkunlocksequence.png) -1. The Windows boot manager detects that a Network Unlock protector exists in the BitLocker configuration. -2. The client computer uses its DHCP driver in the UEFI to obtain a valid IPv4 IP address. +The Network Unlock process follows these phases: + +1. The Windows boot manager detects a Network Unlock protector in the BitLocker configuration. +2. The client computer uses its DHCP driver in the UEFI to get a valid IPv4 IP address. 3. The client computer broadcasts a vendor-specific DHCP request that contains: - 1. A Network Key (a 256-bit intermediate key) encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server. - 2. An AES-256 session key for the reply. + - A network key (a 256-bit intermediate key) that's encrypted by the 2048-bit RSA public key of the Network Unlock certificate from the WDS server. + - An AES-256 session key for the reply. 4. The Network Unlock provider on the WDS server recognizes the vendor-specific request. -5. The provider decrypts it with the WDS server’s BitLocker Network Unlock certificate RSA private key. -6. The WDS provider then returns the network key encrypted with the session key using its own vendor-specific DHCP reply to the client computer. This forms an intermediate key. -7. The returned intermediate key is then combined with another local 256-bit intermediate key that can only be decrypted by the TPM. +5. The provider decrypts the request by using the WDS server's BitLocker Network Unlock certificate RSA private key. +6. The WDS provider returns the network key encrypted with the session key by using its own vendor-specific DHCP reply to the client computer. This key is an intermediate key. +7. The returned intermediate key is combined with another local 256-bit intermediate key. This key can be decrypted only by the TPM. 8. This combined key is used to create an AES-256 key that unlocks the volume. 9. Windows continues the boot sequence. ## Configure Network Unlock -The following steps allow an administrator to configure Network Unlock in a domain where the Domain Functional Level is at least Windows Server 2012. +The following steps allow an administrator to configure Network Unlock in a domain where the functional level is at least Windows Server 2012. -### Install the WDS Server role +### Install the WDS server role -The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role in Server Manager. +The BitLocker Network Unlock feature installs the WDS role if it's not already installed. If you want to install it separately before you install BitLocker Network Unlock, use Server Manager or Windows PowerShell. To install the role in Server Manager, select the **Windows Deployment Services** role. -To install the role using Windows PowerShell, use the following command: +To install the role by using Windows PowerShell, use the following command: ```powershell Install-WindowsFeature WDS-Deployment ``` -You must configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. You can do using the WDS management tool, wdsmgmt.msc, which starts the Windows Deployment Services Configuration Wizard. +Configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. Use the WDS management tool, `wdsmgmt.msc`. This tool starts the Windows Deployment Services Configuration Wizard. -### Confirm the WDS Service is running +### Confirm the WDS service is running -To confirm the WDS service is running, use the Services Management Console or Windows PowerShell. To confirm the service is running in Services Management Console, open the console using **services.msc** and check the status of the Windows Deployment Services service. +To confirm the WDS service is running, use the Services Management console or Windows PowerShell. To confirm the service is running in the Services Management console, open the console by using `services.msc`. Then check the status of the WDS service. -To confirm the service is running using Windows PowerShell, use the following command: +To confirm the service is running by using Windows PowerShell, use the following command: ```powershell Get-Service WDSServer ``` -### Install the Network Unlock feature +### Install the Network Unlock feature -To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature using Server Manager, select the **BitLocker Network Unlock** feature in the Server Manager console. +To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature in the Server Manager console, select **BitLocker Network Unlock**. -To install the feature using Windows PowerShell, use the following command: +To install the feature by using Windows PowerShell, use the following command: ```powershell Install-WindowsFeature BitLocker-NetworkUnlock ``` -### Create the certificate template for Network Unlock +### Create the certificate template for Network Unlock -A properly configured Active Directory Services Certification Authority can use this certificate template to create and issue Network Unlock certificates. +A properly configured Active Directory Services Certification Authority can use the certificate template to create and issue Network Unlock certificates. To create a certificate template: -1. Open the Certificates Template snap-in (certtmpl.msc). -2. Locate the User template. Right-click the template name and select **Duplicate Template**. -3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8 respectively. Ensure the **Show resulting changes** dialog box is selected. -4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the checkbox for the **Publish certificate in Active Directory** option. -5. Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop down menu. Ensure the **Allow private key to be exported** option is selected. -6. Select the **Cryptography** tab. Set the **Minimum key size** to 2048. (Any Microsoft cryptographic provider that supports RSA can be used for this template, but for simplicity and forward compatibility we recommend using the **Microsoft Software Key Storage Provider**.) -7. Select the **Requests must use one of the following providers** option and clear all options except for the cryptography provider you selected, such as the **Microsoft Software Key Storage Provider**. -8. Select the **Subject Name** tab. Select **Supply in the request**. Select **OK** if the certificate templates pop-up dialog appears. -9. Select the **Issuance Requirements** tab. Select both **CA certificate manager approval** and **Valid existing certificate** options. -10. Select the **Extensions** tab. Select **Application Policies** and choose **Edit…**. -11. In the **Edit Application Policies Extension** options dialog box, select **Client Authentication**, **Encrypting File System**, **and Secure Email** and choose **Remove**. -12. On the **Edit Application Policies Extension** dialog box, select **Add**. -13. On the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box enter the following information in the space provided and then click **OK** to create the BitLocker Network Unlock application policy: +1. Open the certificate template snap-in (`certtmpl.msc`). +2. Locate the user template. Right-click the template name, and then select **Duplicate Template**. +3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to **Windows Server 2012** and **Windows 8**, respectively. Ensure **Show resulting changes** is selected. +4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the check box for **Publish certificate in Active Directory**. +5. Select the **Request Handling** tab. In the **Purpose** drop-down menu, select **Encryption**. Ensure the **Allow private key to be exported** option is selected. +6. Select the **Cryptography** tab. Set the **Minimum key size** to **2048**. (For this template, you can use any Microsoft cryptographic provider that supports RSA. But for simplicity and forward compatibility, we recommend using **Microsoft Software Key Storage Provider**.) +7. Select **Requests must use one of the following providers**. Then clear all options except for your selected cryptography provider, such as the **Microsoft Software Key Storage Provider**. +8. Select the **Subject Name** tab. Select **Supply in the request**. If the certificate templates dialog box appears, select **OK**. +9. Select the **Issuance Requirements** tab. Then select both **CA certificate manager approval** and **Valid existing certificate**. +10. Select the **Extensions** tab. Then select **Application Policies** > **Edit**. +11. In the **Edit Application Policies Extension** dialog box, select **Client Authentication**, **Encrypting File System**, and **Secure Email**. Then choose **Remove**. +12. In the **Edit Application Policies Extension** dialog box, select **Add**. +13. In the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box, enter the following information in the space provided, and then select **OK** to create the BitLocker Network Unlock application policy. - - **Name:** **BitLocker Network Unlock** - - **Object Identifier:** **1.3.6.1.4.1.311.67.1.1** + - **Name**: **BitLocker Network Unlock** + - **Object Identifier**: **1.3.6.1.4.1.311.67.1.1** -14. Select the newly created **BitLocker Network Unlock** application policy and select **OK**. -15. With the **Extensions** tab still open, select the **Edit Key Usage Extension** dialog, select the **Allow key exchange only with key encryption (key encipherment)** option. Select the **Make this extension critical** option. +14. Select the newly created **BitLocker Network Unlock** application policy, and then select **OK**. +15. With the **Extensions** tab still open, select **Edit Key Usage Extension**, and then select **Allow key exchange only with key encryption (key encipherment)**. Then select **Make this extension critical**. 16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission. 17. Select **OK** to complete configuration of the template. -To add the Network Unlock template to the Certification Authority, open the Certification Authority snap-in (certsrv.msc). Right-click the **Certificate Templates** item and choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. +To add the Network Unlock template to the certificate authority, open the certificate authority snap-in (`certsrv.msc`). Right-click **Certificate Templates**, and then choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. -After adding the Network Unlock template to the Certification Authority, this certificate can be used to configure BitLocker Network Unlock. +After you add the Network Unlock template to the certificate authority, you can use this certificate to configure BitLocker Network Unlock. -### Create the Network Unlock certificate +### Create the Network Unlock certificate -Network Unlock can use imported certificates from an existing PKI infrastructure, or you can use a self-signed certificate. +Network Unlock can use imported certificates from an existing public key infrastructure (PKI). Or it can use a self-signed certificate. -To enroll a certificate from an existing certification authority (CA), do the following: +To enroll a certificate from an existing certificate authority: -1. Open Certificate Manager on the WDS server using **certmgr.msc** -2. Under the Certificates - Current User item, right-click Personal -3. Select All Tasks, then **Request New Certificate** -4. Select **Next** when the Certificate Enrollment wizard opens -5. Select Active Directory Enrollment Policy -6. Choose the certificate template created for Network Unlock on the Domain controller and select **Enroll**. When prompted for more information, add the following attribute to the certificate: +1. On the WDS server, open Certificate Manager by using `certmgr.msc`. +2. Under **Certificates - Current User**, right-click **Personal**. +3. Select **All Tasks** > **Request New Certificate**. +4. When the Certificate Enrollment wizard opens, select **Next**. +5. Select **Active Directory Enrollment Policy**. +6. Choose the certificate template that was created for Network Unlock on the domain controller. Then select **Enroll**. +1. When you're prompted for more information, select **Subject Name** and provide a friendly name value. Your friendly name should include information for the domain or organizational unit for the certificate. Here's an example: *BitLocker Network Unlock Certificate for Contoso domain*. +7. Create the certificate. Ensure the certificate appears in the **Personal** folder. +8. Export the public key certificate for Network Unlock: - - Select the **Subject Name** pane and provide a friendly name value. It is suggested that this friendly name include information for the domain or organizational unit for the certificate. For example "BitLocker Network Unlock Certificate for Contoso domain" - -7. Create the certificate. Ensure the certificate appears in the Personal folder. -8. Export the public key certificate for Network Unlock - - 1. Create a .cer file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. + 1. Create a *.cer* file by right-clicking the previously created certificate and choosing **All Tasks** > **Export**. 2. Select **No, do not export the private key**. - 3. Select **DER encoded binary X.509** and complete exporting the certificate to a file. - 4. Give the file a name such as BitLocker-NetworkUnlock.cer. - -9. Export the public key with a private key for Network Unlock - - 1. Create a .pfx file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. + 3. Select **DER encoded binary X.509**, and then finish exporting the certificate to a file. + 4. Give the file a name, such as *BitLocker-NetworkUnlock.cer*. +9. Export the public key with a private key for Network Unlock: + 1. Create a *.pfx* file by right-clicking the previously created certificate. Then choose **All Tasks** > **Export**. 2. Select **Yes, export the private key**. - 3. Complete the wizard to create the .pfx file. + 3. Complete the steps to create the *.pfx* file. -To create a self-signed certificate, you can either use the New-SelfSignedCertificate cmdlet in Windows PowerShell or use Certreq. +To create a self-signed certificate, either use the `New-SelfSignedCertificate` cmdlet in Windows PowerShell or use `certreq`. -Windows PowerShell example: +Here's a Windows PowerShell example: ```powershell New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Subject "CN=BitLocker Network Unlock certificate" -Provider "Microsoft Software Key Storage Provider" -KeyUsage KeyEncipherment -KeyUsageProperty Decrypt,Sign -KeyLength 2048 -HashAlgorithm sha512 -TextExtension @("1.3.6.1.4.1.311.21.10={text}OID=1.3.6.1.4.1.311.67.1.1","2.5.29.37={text}1.3.6.1.4.1.311.67.1.1") ``` -Certreq example: +Here's a `certreq` example: -1. Create a text file with an .inf extension. For example, notepad.exe BitLocker-NetworkUnlock.inf. +1. Create a text file that has an *.inf* extension. For example, *notepad.exe* *BitLocker-NetworkUnlock.inf*. 2. Add the following contents to the previously created file: ```ini @@ -215,170 +206,183 @@ Certreq example: _continue_ = "1.3.6.1.4.1.311.67.1.1" ``` -3. Open an elevated command prompt and use the certreq tool to create a new certificate using the following command, specifying the full path to the file created previously, along with the file name: +3. Open an elevated command prompt and use the `certreq` tool to create a new certificate. Use the following command, specifying the full path to the file that you created previously. Also specify the file name. - ``` syntax + ```cmd certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer ``` -4. Verify the previous command properly created the certificate by confirming the .cer file exists. -5. Launch Certificates - Local Machine by running **certlm.msc**. -6. Create a .pfx file by opening the **Certificates – Local Computer\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, then **Export**. Follow through the wizard to create the .pfx file. +4. Verify the previous command properly created the certificate by confirming the *.cer* file exists. +5. Launch **Certificates - Local Machine** by running `certlm.msc`. +6. Create a *.pfx* file by opening the *Certificates – Local Computer\\Personal\\Certificates* path in the navigation pane. Right-click the previously imported certificate, and then select **All Tasks** > **Export**. Follow through the steps to create the *.pfx* file. -### Deploy the private key and certificate to the WDS server +### Deploy the private key and certificate to the WDS server -With the certificate and key created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates, do the following: +Now that you've created the certificate and key, deploy them to the infrastructure to properly unlock systems. To deploy the certificates: -1. On the WDS server, open a new MMC and add the certificates snap-in. Select the computer account and local computer when given the options. -2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item, choose All Tasks, then **Import**. -3. In the **File to Import** dialog, choose the .pfx file created previously. -4. Enter the password used to create the .pfx and complete the wizard. +1. On the WDS server, open a new Microsoft Management Console (MMC), and then add the certificates snap-in. When you're prompted, select the computer account and local computer. +2. Right-click **Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock**, and then choose **All Tasks** > **Import**. +3. In the **File to Import** dialog box, choose the *.pfx* file that you created previously. +4. Enter the password that you used to create the *.pfx* file, and finish the steps. ### Configure Group Policy settings for Network Unlock -With certificate and key deployed to the WDS server for Network Unlock, the final step is to use Group Policy settings to deploy the public key certificate to computers that you want to be able to unlock using the Network Unlock key. Group Policy settings for BitLocker can be found under **\\Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** using the Local Group Policy Editor or the Microsoft Management Console. +You've now deployed the certificate and key to the WDS server for Network Unlock. In the final step, you'll use Group Policy settings to deploy the public key certificate to computers that you want to be able to unlock by using the Network Unlock key. Find Group Policy settings for BitLocker in *\\Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption* by using the Local Group Policy Editor or the MMC. -The following steps describe how to enable the Group Policy setting that is a requirement for configuring Network Unlock. +To enable the Group Policy setting that's required to configure Network Unlock: -1. Open Group Policy Management Console (gpmc.msc). -2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** or **Allow startup PIN with TPM** option. +1. Open Group Policy Management Console (`gpmc.msc`). +2. Enable the policy **Require additional authentication at startup**, and then select **Require startup PIN with TPM** or **Allow startup PIN with TPM**. 3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers. -The following steps describe how to deploy the required Group Policy setting: +To deploy the required Group Policy setting: > [!NOTE] > The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012. -1. Copy the .cer file created for Network Unlock to the domain controller. -2. On the domain controller, launch Group Policy Management Console (gpmc.msc). +1. Copy the *.cer* file that you created for Network Unlock to the domain controller. +2. On the domain controller, open Group Policy Management Console (`gpmc.msc`). 3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting. 4. Deploy the public certificate to clients: - 1. Within Group Policy Management Console, navigate to the following location: **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate**. - 2. Right-click the folder and choose **Add Network Unlock Certificate**. - 3. Follow the wizard steps and import the .cer file that was copied earlier. + 1. In Group Policy Management Console, go to *Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate*. + 2. Right-click the folder, and then choose **Add Network Unlock Certificate**. + 3. Follow the steps and import the *.cer* file that you copied earlier. -> [!NOTE] -> Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before deploying a new one. The Network Unlock certificate is located in the **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** key on the client computer. + > [!NOTE] + > Only one network unlock certificate can be available at a time. If you need a new certificate, delete the current certificate before you deploy a new one. The Network Unlock certificate is located in the *HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP* key on the client computer. -5. Reboot the clients after deploying the group policy. +5. Reboot the clients after you deploy the Group Policy. > [!NOTE] - > The **Network (Certificate Based)** protector will be added only after a reboot with the policy enabled and a valid certificate present in the FVE_NKP store. + > The **Network (Certificate Based)** protector is added only after a reboot where the policy is enabled and a valid certificate is present in the FVE_NKP store. -### Subnet policy configuration files on WDS Server (Optional) +### Subnet policy configuration files on the WDS server (optional) -By default, all clients with the correct Network Unlock Certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP are unlocked by the server. A subnet policy configuration file on the WDS server can be created to limit which subnet(s) Network Unlock clients can use to unlock. +By default, the server unlocks clients that have the correct Network Unlock certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP. You can create a subnet policy configuration file on the WDS server to limit the subnets that Network Unlock clients can use for unlocking. -The configuration file, called bde-network-unlock.ini, must be located in the same directory as the Network Unlock provider DLL (%windir%\System32\Nkpprov.dll) and it applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, the provider will fail and stop responding to requests. +The configuration file, called *bde-network-unlock.ini*, must be located in the same directory as the Network Unlock provider dynamic-link library (*%windir%\System32\Nkpprov.dll*). The configuration file applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, then the provider fails and stops responding to requests. -The subnet policy configuration file must use a “\[SUBNETS\]” section to identify the specific subnets. The named subnets may then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format, where each subnet has its own line, with the name on the left of the equals sign, and the subnet identified on the right of the equal sign as a Classless Inter-Domain Routing (CIDR) address or range. The key word “ENABLED” is disallowed for subnet names. +The subnet policy configuration file must use a `[SUBNETS]` section to identify the specific subnets. You can then use the named subnets to specify restrictions in certificate subsections. + +Subnets are defined as simple name-value pairs, in the common INI format. In this format, each subnet has its own line. The name is on the left of the equals sign. The subnet on the right of the equals sign is a Classless Interdomain Routing (CIDR) address or range. The keyword `ENABLED` is disallowed for subnet names. ```ini [SUBNETS] -SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon +SUBNET1=10.185.250.0/24 ; a comment about this subrange could be here, after the semicolon SUBNET2=10.185.252.200/28 SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. ``` -Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. + +Following the `[SUBNETS]` section are sections for each Network Unlock certificate. A certificate is identified by the certificate thumbprint, which is formatted without any spaces. These sections define subnet clients that you can unlock by using that certificate. > [!NOTE] -> When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. +> When you specify the certificate thumbprint, don't include spaces. Thumbprints that include spaces aren't recognized as valid. The spaces will cause the subnet configuration to fail. + +Each certificate section defines subnet restrictions by denoting the allowed list of permitted subnets. If any subnets are listed in a certificate section, then only those subnets are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate has no section in the subnet policy configuration file, then no subnet unlocking restrictions are applied for that certificate. + +So to apply restrictions to every certificate, you must add a certificate section for every Network Unlock certificate on the server. And you must add an explicit allow list set for each certificate section. + +Create subnet lists by putting the name of a subnet from the `[SUBNETS]` section on its own line below the certificate section header. Then, the server will unlock clients that have this certificate only on the subnets that the list specifies. + +To troubleshoot, you can quickly exclude a subnet without deleting it from the section. Just comment it out by using a prepended semicolon. -Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. -Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. ```ini -[‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] +[2158a767e1c14e88e27a4c0aee111d2de2eafe60] ;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. -;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. +;This list shows this cert is allowed to unlock clients only on the SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. SUBNET1 ;SUBNET2 SUBNET3 ``` -To disallow the use of a certificate altogether, its subnet list may contain the line “DISABLED". +To disallow the use of a certificate altogether, add a `DISABLED` line to its subnet list. -## Turning off Network Unlock +## Turn off Network Unlock -To turn off the unlock server, the PXE provider can be unregistered from the WDS server or uninstalled altogether. However, to stop clients from creating Network Unlock protectors the **Allow Network Unlock at startup** Group Policy setting should be disabled. When this policy setting is updated to disabled on client computers any Network Unlock key protectors on the computer will be deleted. Alternatively, the BitLocker Network Unlock certificate policy can be deleted on the domain controller to accomplish the same task for an entire domain. +To turn off the unlock server, you can unregister the PXE provider from the WDS server or uninstall it altogether. However, to stop clients from creating Network Unlock protectors, you should disable the **Allow Network Unlock at startup** Group Policy setting. When you disable this policy setting on client computers, any Network Unlock key protectors on the computer are deleted. Alternatively, you can delete the BitLocker Network Unlock certificate policy on the domain controller to accomplish the same task for an entire domain. > [!NOTE] -> Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server. +> Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server's ability to respond to unlock requests for that certificate. However, this condition is seen as an error. It's not a supported or recommended method for turning off the Network Unlock server. -## Update Network Unlock certificates +## Update Network Unlock certificates -To update the certificates used by Network Unlock, administrators need to import or generate the new certificate for the server and then update the Network Unlock certificate Group Policy setting on the domain controller. +To update the certificates that Network Unlock uses, administrators need to import or generate the new certificate for the server. Then they must update the Network Unlock certificate Group Policy setting on the domain controller. + +> [!NOTE] +> Servers that don't receive the Group Policy Object (GPO) will require a PIN when they boot. In such cases, find out why the server didn't receive the GPO to update the certificate. ## Troubleshoot Network Unlock -Troubleshooting Network Unlock issues begins by verifying the environment. Many times, a small configuration issue will be the root cause of the failure. Items to verify include: +To troubleshoot Network Unlock problems, begin by verifying the environment. Often, a small configuration issue is the root cause of the failure. Verify these items: -- Verify client hardware is UEFI-based and is on firmware version is 2.3.1 and that the UEFI firmware is in native mode without a Compatibility Support Module (CSM) for BIOS mode enabled. Do this by checking that the firmware does not have an option enabled such as "Legacy mode" or "Compatibility mode" or that the firmware does not appear to be in a BIOS-like mode. -- All required roles and services are installed and started -- Public and private certificates have been published and are in the proper certificate containers. The presence of the Network Unlock certificate can be verified in the Microsoft Management Console (MMC.exe) on the WDS server with the certificate snap-ins for the local computer enabled. The client certificate can be verified by checking the registry key **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** on the client computer. -- Group policy for Network Unlock is enabled and linked to the appropriate domains. -- Verify group policy is reaching the clients properly. This can be done using the GPRESULT.exe or RSOP.msc utilities. -- Verify the clients were rebooted after applying the policy. -- Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the local computer: +- Client hardware is based on UEFI and uses firmware version 2.3.1, and the UEFI firmware is in native mode and has no compatibility support module (CSM) for BIOS mode enabled. Verify this configuration by ensuring that the firmware has no enabled option such as **Legacy mode** or **Compatibility mode** and that the firmware doesn't appear to be in a BIOS-like mode. +- All required roles and services are installed and started. +- Public and private certificates have been published and are in the proper certificate containers. Verify the presence of the Network Unlock certificate by using Microsoft Management Console (*MMC.exe*) on the WDS server. The certificate snap-ins for the local computer should be enabled. Verify the client certificate by checking the registry key *HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP* on the client computer. +- Group Policy for Network Unlock is enabled and linked to the appropriate domains. +- Group Policy is reaching the clients properly. Verify this functionality by using the *GPRESULT.exe* utility or the *RSOP.msc* utility. +- The clients were rebooted after the policy was applied. +- The **Network (Certificate Based)** protector is listed on the client. Check for this protector by using either `manage-bde` or Windows PowerShell cmdlets. For example, the following command lists the key protectors that are currently configured on drive C on the local computer. ```powershell manage-bde -protectors -get C: ``` > [!NOTE] - > Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock + > Use the output of `manage-bde` along with the WDS debug log to determine whether the proper certificate thumbprint is being used for Network Unlock. -Files to gather when troubleshooting BitLocker Network Unlock include: +Gather the following files to troubleshoot BitLocker Network Unlock. -1. The Windows event logs. Specifically the BitLocker event logs and the Microsoft-Windows-Deployment-Services-Diagnostics-Debug log +- The Windows event logs. Specifically, get the BitLocker event logs and the Microsoft-Windows-Deployment-Services-Diagnostics-Debug log. - Debug logging is turned off by default for the WDS server role, so you will need to enable it first. You can use either of the following two methods to turn on WDS debug logging. + Debug logging is turned off by default for the WDS server role, so you need to enable it before you can retrieve it. Use either of the following two methods to turn on WDS debug logging. - 1. Start an elevated command prompt and run the following command: + - Start an elevated command prompt, and then run the following command: - ``` syntax + ```cmd wevtutil sl Microsoft-Windows-Deployment-Services-Diagnostics/Debug /e:true ``` - 2. Open Event Viewer on the WDS server. + - Open Event Viewer on the WDS server: - In the left pane, click **Applications and Services Logs**, click **Microsoft**, click **Windows**, click **Deployment-Services-Diagnostics**, and then click **Debug**. + 1. In the left pane, select **Applications and Services Logs** > **Microsoft** > **Windows** > **Deployment-Services-Diagnostics** > **Debug**. + 1. In the right pane, select **Enable Log**. - In the right pane, click **Enable Log**. - -2. The DHCP subnet configuration file (if one exists). -3. The output of the BitLocker status on the volume, this can be gathered into a text file using **manage-bde -status** or **Get-BitLockerVolume** in Windows PowerShell. -4. Network Monitor capture on the server hosting the WDS role, filtered by client IP address. +- The DHCP subnet configuration file (if one exists). +- The output of the BitLocker status on the volume. Gather this output into a text file by using `manage-bde -status`. Or in Windows PowerShell, use `Get-BitLockerVolume`. +- The Network Monitor capture on the server that hosts the WDS role, filtered by client IP address. ## Configure Network Unlock Group Policy settings on earlier versions -Network Unlock and the accompanying Group Policy settings were introduced in Windows Server 2012 but can be deployed using operating systems running Windows Server 2008 R2 and Windows Server 2008. +Network Unlock and the accompanying Group Policy settings were introduced in Windows Server 2012. But you can deploy them by using operating systems that run Windows Server 2008 R2 and Windows Server 2008. -**Requirements** +Your system must meet these requirements: -- The server hosting WDS must be running any of the server operating systems designated in the **Applies To** list at the beginning of this topic. -- Client computers must be running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. +- The server that hosts WDS must be running a server operating system that's designated in the "Applies to" list at the beginning of this article. +- Client computers must be running a client operating system that's designated in the "Applies to" list at the beginning of this article. -The following steps can be used to configure Network Unlock on these older systems. +Follow these steps to configure Network Unlock on these older systems. -1. [Install the WDS Server role](#bkmk-installwdsrole) -2. [Confirm the WDS Service is running](#bkmk-confirmwdsrunning) -3. [Install the Network Unlock feature](#bkmk-installnufeature) -4. [Create the Network Unlock certificate](#bkmk-createcert) -5. [Deploy the private key and certificate to the WDS server](#bkmk-deploycert) +1. [Install the WDS server role.](#bkmk-installwdsrole) +2. [Confirm the WDS service is running.](#bkmk-confirmwdsrunning) +3. [Install the Network Unlock feature.](#bkmk-installnufeature) +4. [Create the Network Unlock certificate.](#bkmk-createcert) +5. [Deploy the private key and certificate to the WDS server.](#bkmk-deploycert) 6. Configure registry settings for Network Unlock: - Apply the registry settings by running the following certutil script (assuming your network unlock certificate file is called **BitLocker-NetworkUnlock.cer**) on each computer running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. + Apply the registry settings by running the following `certutil` script (assuming your Network Unlock certificate file is called *BitLocker-NetworkUnlock.cer*) on each computer that runs a client operating system that's designated in the "Applies to" list at the beginning of this article. - certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f + ```console + certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f + ``` -7. Set up a TPM protector on the clients -8. Reboot the clients to add the Network (Certificate Based) protector +7. Set up a TPM protector on the clients. +8. Reboot the clients to add the **Network (Certificate Based)** protector. ## See also diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md index 226acb2e7c..d7338589c5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker Key Management FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index 2314ea2eaf..78eb7b7715 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -1,6 +1,6 @@ --- title: BitLocker Management Recommendations for Enterprises (Windows 10) -description: This topic explains recommendations for managing BitLocker. +description: Refer to relevant documentation, products, and services to learn about managing BitLocker for enterprises and see recommendations for different computers. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -14,6 +14,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 ms.reviewer: +ms.custom: bitlocker --- # BitLocker Management for Enterprises diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md index 153be07099..264ee0242a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md @@ -14,6 +14,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 ms.reviewer: +ms.custom: bitlocker --- # BitLocker Network Unlock FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md deleted file mode 100644 index aca61b7f1d..0000000000 --- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: BitLocker overview and requirements FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker. -ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.reviewer: -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dansimp -ms.author: dansimp -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 02/28/2019 ---- - -# BitLocker Overview and Requirements FAQ - -**Applies to** -- Windows 10 - -## How does BitLocker work? - -**How BitLocker works with operating system drives** - -You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data. - -**How BitLocker works with fixed and removable data drives** - -You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods. - -## Does BitLocker support multifactor authentication? - -Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection. - -## What are the BitLocker hardware and software requirements? - -For requirements, see [System requirements](bitlocker-overview.md#system-requirements). - -> [!NOTE] -> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker. - -## Why are two partitions required? Why does the system drive have to be so large? - -Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. - -## Which Trusted Platform Modules (TPMs) does BitLocker support? - -BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device. - -> [!NOTE] -> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. - -> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. - -## How can I tell if a TPM is on my computer? - -Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading. - -## Can I use BitLocker on an operating system drive without a TPM? - -Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. -To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements. - -## How do I obtain BIOS support for the TPM on my computer? - -Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements: - -- It is compliant with the TCG standards for a client computer. -- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer. - -## What credentials are required to use BitLocker? - -To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives. - -## What is the recommended boot order for computers that are going to be BitLocker-protected? - -You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml new file mode 100644 index 0000000000..63b1488107 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml @@ -0,0 +1,82 @@ +### YamlMime:FAQ +metadata: + title: BitLocker overview and requirements FAQ (Windows 10) + description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker. + ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee + ms.reviewer: + ms.prod: w10 + ms.mktglfcycl: explore + ms.sitesec: library + ms.pagetype: security + ms.localizationpriority: medium + author: dansimp + ms.author: dansimp + manager: dansimp + audience: ITPro + ms.collection: M365-security-compliance + ms.topic: conceptual + ms.date: 02/28/2019 + ms.custom: bitlocker + +title: BitLocker Overview and Requirements FAQ +summary: | + **Applies to** + - Windows 10 + + +sections: + - name: Ignored + questions: + - question: How does BitLocker work? + answer: | + **How BitLocker works with operating system drives** + + You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data. + + **How BitLocker works with fixed and removable data drives** + + You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods. + + - question: Does BitLocker support multifactor authentication? + answer: Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection. + + - question: What are the BitLocker hardware and software requirements? + answer: | + For requirements, see [System requirements](bitlocker-overview.md#system-requirements). + + > [!NOTE] + > Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker. + + - question: Why are two partitions required? Why does the system drive have to be so large? + answer: Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. + + - question: Which Trusted Platform Modules (TPMs) does BitLocker support? + answer: | + BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device. + + > [!NOTE] + > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. + > + > Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. + + - question: How can I tell if a TPM is on my computer? + answer: Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading. + + - question: Can I use BitLocker on an operating system drive without a TPM? + answer: | + Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide. + To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements. + + - question: How do I obtain BIOS support for the TPM on my computer? + answer: | + Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements: + + - It is compliant with the TCG standards for a client computer. + - It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer. + + - question: What credentials are required to use BitLocker? + answer: To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives. + + - question: What is the recommended boot order for computers that are going to be BitLocker-protected? + answer: You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  + diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index ebece73d96..91df6ad467 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 01/26/2018 +ms.custom: bitlocker --- # BitLocker @@ -61,7 +62,7 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. > [!IMPORTANT] -> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://social.technet.microsoft.com/Forums/en-US/eac2cc67-8442-42db-abad-2ed173879751/bitlocker-without-tpm?forum=win10itprosetup). > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. @@ -73,6 +74,8 @@ The hard disk must be partitioned with at least two drives: - The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system. - The system drive contains the files that are needed to load Windows after the firmware has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the FAT32 file system on computers that use UEFI-based firmware or with the NTFS file system on computers that use BIOS firmware. We recommend that system drive be approximately 350 MB in size. After BitLocker is turned on it should have approximately 250 MB of free space. +A partition subject to encryption cannot be marked as an active partition (this applies to the operating system, fixed data, and removable data drives). + When installed on a new computer, Windows will automatically create the partitions that are required for BitLocker. When installing the BitLocker optional component on a server you will also need to install the Enhanced Storage feature, which is used to support hardware encrypted drives. @@ -96,5 +99,3 @@ When installing the BitLocker optional component on a server you will also need | [Troubleshoot BitLocker](troubleshoot-bitlocker.md) | This guide describes the resources that can help you troubleshoot BitLocker issues, and provides solutions for several common BitLocker issues. | | [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.| | [Enabling Secure Boot and BitLocker Device Encryption on Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/docs/securebootandbitlocker) | This topic covers how to use BitLocker with Windows 10 IoT Core | - - diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index 26a7658ef1..eaccfb9c9f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -1,8 +1,8 @@ --- title: BitLocker recovery guide (Windows 10) -description: This topic for IT professionals describes how to recover BitLocker keys from AD DS. +description: This article for IT professionals describes how to recover BitLocker keys from AD DS. ms.assetid: d0f722e9-1773-40bf-8456-63ee7a95ea14 -ms.reviewer: +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -15,14 +15,16 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker recovery guide -**Applies to** -- Windows 10 +**Applies to:** -This topic for IT professionals describes how to recover BitLocker keys from AD DS. +- Windows 10 + +This article for IT professionals describes how to recover BitLocker keys from AD DS. Organizations can use BitLocker recovery information saved in Active Directory Domain Services (AD DS) to access BitLocker-protected data. Creating a recovery model for BitLocker while you are planning your BitLocker deployment is recommended. @@ -30,142 +32,158 @@ This article assumes that you understand how to set up AD DS to back up BitLock This article does not detail how to configure AD DS to store the BitLocker recovery information. + ## What is BitLocker recovery? BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario, you have the following options to restore access to the drive: -- The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain). -- A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it. -- A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). +- The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain). +- A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it. +- A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + ### What causes BitLocker recovery? The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive: -- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](https://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](https://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout. -- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised. -- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD. -- Failing to boot from a network drive before booting from the hard drive. -- Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. This means that if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked. -- Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition. -- Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed. -- Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM. -- Turning off, disabling, deactivating, or clearing the TPM. -- Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change. -- Forgetting the PIN when PIN authentication has been enabled. -- Updating option ROM firmware. -- Upgrading TPM firmware. -- Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards. -- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. -- Changes to the master boot record on the disk. -- Changes to the boot manager on the disk. -- Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software. -- Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This can prevent the entry of enhanced PINs. -- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change. +- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality, administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor. Or they can use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](/Exchange/clients/exchange-activesync/exchange-activesync) (also configurable through [Microsoft Intune](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/microsoft-intune)), to limit the number of failed password attempts before the device goes into Device Lockout. +- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised. +- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD. +- Failing to boot from a network drive before booting from the hard drive. +- Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. So if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked. +- Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition. +- Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed. +- Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM. +- Turning off, disabling, deactivating, or clearing the TPM. +- Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change. +- Forgetting the PIN when PIN authentication has been enabled. +- Updating option ROM firmware. +- Upgrading TPM firmware. +- Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards. +- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer. +- Changes to the master boot record on the disk. +- Changes to the boot manager on the disk. +- Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software. +- Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This problem can prevent the entry of enhanced PINs. +- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change. - >**Note:**  Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different. - -- Moving the BitLocker-protected drive into a new computer. -- Upgrading the motherboard to a new one with a new TPM. -- Losing the USB flash drive containing the startup key when startup key authentication has been enabled. -- Failing the TPM self-test. -- Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode. -- Changing the usage authorization for the storage root key of the TPM to a non-zero value. + > [!NOTE] + > Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different. - >**Note:**  The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value. - -- Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr). -- Pressing the F8 or F10 key during the boot process. -- Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards. -- Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive. +- Moving the BitLocker-protected drive into a new computer. +- Upgrading the motherboard to a new one with a new TPM. +- Losing the USB flash drive containing the startup key when startup key authentication has been enabled. +- Failing the TPM self-test. +- Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode. +- Changing the usage authorization for the storage root key of the TPM to a non-zero value. + + > [!NOTE] + > The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value. + +- Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr). +- Pressing the F8 or F10 key during the boot process. +- Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards. +- Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive. + +> [!NOTE] +> Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components. ->**Note:**  Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components. - For planned scenarios, such as a known hardware or firmware upgrades, you can avoid initiating recovery by temporarily suspending BitLocker protection. Because suspending BitLocker leaves the drive fully encrypted, the administrator can quickly resume BitLocker protection after the planned task has been completed. Using suspend and resume also reseals the encryption key without requiring the entry of the recovery key. ->**Note:**  If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool. +> [!NOTE] +> If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool. + +If software maintenance requires the computer to be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premises user to provide the additional authentication method. -If software maintenance requires the computer be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premises user to provide the additional authentication method. - Recovery has been described within the context of unplanned or undesired behavior, but you can also cause recovery as an intended production scenario, in order to manage access control. For example, when you redeploy desktop or laptop computers to other departments or employees in your enterprise, you can force BitLocker into recovery before the computer is given to a new user. + ## Testing recovery -Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The –forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation. +Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The -forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation. -**To force a recovery for the local computer** +**To force a recovery for the local computer:** -1. Click the **Start** button, type **cmd** in the **Start Search** box, right-click **cmd.exe**, and then click **Run as administrator**. -2. At the command prompt, type the following command and then press ENTER: +1. Select the **Start** button, type *cmd* in the **Start Search** box, right-click **cmd.exe**, and then select **Run as administrator**. +2. At the command prompt, type the following command and then press **Enter**: `manage-bde -forcerecovery ` -**To force recovery for a remote computer** +**To force recovery for a remote computer:** + +1. On the Start screen, type **cmd.exe**, and then select **Run as administrator**. +2. At the command prompt, type the following command and then press ENTER: + `manage-bde -ComputerName -forcerecovery ` + + > [!NOTE] + > Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because BitLocker will have to be unlocked and disabled manually from the WinRE environment before the OS can boot up again. For more information, see [BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate device](https://social.technet.microsoft.com/wiki/contents/articles/18671.bitlocker-troubleshooting-continuous-reboot-loop-with-bitlocker-recovery-on-a-slate-device.aspx). -1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**. -2. At the command prompt, type the following command and then press ENTER: - `manage-bde. -ComputerName -forcerecovery ` -> **Note:**  Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because BitLocker will have to be unlocked and disabled manually from the WinRE environment before the OS can boot up again. For more information, see [BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate device](https://social.technet.microsoft.com/wiki/contents/articles/18671.bitlocker-troubleshooting-continuous-reboot-loop-with-bitlocker-recovery-on-a-slate-device.aspx). - ## Planning your recovery process When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model. -Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker -Administration and Monitoring](https://technet.microsoft.com/windows/hh826072.aspx). +Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/mbam-v25/). -After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. You must consider both self-recovery and recovery password retrieval methods for your organization. +After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. Consider both self-recovery and recovery password retrieval methods for your organization. When you determine your recovery process, you should: -- Become familiar with how you can retrieve the recovery password. See: +- Become familiar with how you can retrieve the recovery password. See: - - [Self-recovery](#bkmk-selfrecovery) - - [Recovery password retrieval](#bkmk-recoveryretrieval) + - [Self-recovery](#bkmk-selfrecovery) + - [Recovery password retrieval](#bkmk-recoveryretrieval) -- Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See: +- Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See: + + - [Post-recovery analysis](#bkmk-planningpostrecovery) - - [Post-recovery analysis](#bkmk-planningpostrecovery) ### Self-recovery -In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag it would be very easy for access to be gained to the PC by an unauthorized user. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified. +In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag, then it's easy for an unauthorized user to access the PC. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified. + ### Recovery password retrieval -If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain the recovery password can be backed up to AD DS. However, this does not happen by default, you must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. +If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain, the recovery password can be backed up to AD DS. However, this does not happen by default. You must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. + +- **Choose how BitLocker-protected operating system drives can be recovered** +- **Choose how BitLocker-protected fixed drives can be recovered** +- **Choose how BitLocker-protected removable drives can be recovered** -- **Choose how BitLocker-protected operating system drives can be recovered** -- **Choose how BitLocker-protected fixed drives can be recovered** -- **Choose how BitLocker-protected removable drives can be recovered** In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds. ->**Note:**  If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required. - +> [!NOTE] +> If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required. + The BitLocker Recovery Password Viewer for Active Directory Users and Computers tool allows domain administrators to view BitLocker recovery passwords for specific computer objects in Active Directory. You can use the following list as a template for creating your own recovery process for recovery password retrieval. This sample process uses the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool. -- [Record the name of the user's computer](#bkmk-recordcomputername) -- [Verify the user's identity](#bkmk-verifyidentity) -- [Locate the recovery password in AD DS](#bkmk-locatepassword) -- [Gather information to determine why recovery occurred](#bkmk-gatherinfo) -- [Give the user the recovery password](#bkmk-givepassword) +- [Record the name of the user's computer](#bkmk-recordcomputername) +- [Verify the user's identity](#bkmk-verifyidentity) +- [Locate the recovery password in AD DS](#bkmk-locatepassword) +- [Gather information to determine why recovery occurred](#bkmk-gatherinfo) +- [Give the user the recovery password](#bkmk-givepassword) + ### Record the name of the user's computer You can use the name of the user's computer to locate the recovery password in AD DS. If the user does not know the name of the computer, ask the user to read the first word of the **Drive Label** in the **BitLocker Drive Encryption Password Entry** user interface. This is the computer name when BitLocker was enabled and is probably the current name of the computer. + ### Verify the user's identity -You should verify that the person that is asking for the recovery password is truly the authorized user of that computer. You may also wish to verify that the computer with the name the user provided belongs to the user. +Verify that the person that is asking for the recovery password is truly the authorized user of that computer. You might also want to verify that the computer with the name the user provided belongs to the user. + ### Locate the recovery password in AD DS Locate the Computer object with the matching name in AD DS. Because Computer object names are listed in the AD DS global catalog, you should be able to locate the object even if you have a multi-domain forest. + ### Multiple recovery passwords If multiple recovery passwords are stored under a computer object in AD DS, the name of the BitLocker recovery information object includes the date that the password was created. @@ -174,25 +192,30 @@ If at any time you are unsure what password to provide, or if you think you migh Since the password ID is a unique value that is associated with each recovery password stored in AD DS, running a query using this ID will find the correct password to unlock the encrypted volume. + ### Gather information to determine why recovery occurred Before you give the user the recovery password, you should gather any information that will help determine why the recovery was needed, in order to analyze the root cause during the post-recovery analysis. For more info about post-recovery analysis, see [Post-recovery analysis](#bkmk-planningpostrecovery). + ### Give the user the recovery password -Because the recovery password is 48 digits long the user may need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password. +Because the recovery password is 48 digits long, the user might need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password. + +> [!NOTE] +> Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors. + ->**Note:**  Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors. - ### Post-recovery analysis When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption when data is written to the volume, and on-the-fly decryption when data is read from the volume. After the volume is unlocked, BitLocker behaves the same way, regardless of how the access was granted. -If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator can perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See: +If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See: + +- [Determine the root cause of the recovery](#bkmk-determinecause) +- [Refresh BitLocker protection](#bkmk-refreshprotection) -- [Determine the root cause of the recovery](#bkmk-determinecause) -- [Refresh BitLocker protection](#bkmk-refreshprotection) ### Determine the root cause of the recovery @@ -202,14 +225,15 @@ While an administrator can remotely investigate the cause of recovery in some ca Review and answer the following questions for your organization: -1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC? -2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be? -3. If TPM mode was in effect, was recovery caused by a boot file change? -4. If recovery was caused by a boot file change, is this due to an intended user action (for example, BIOS upgrade), or to malicious software? -5. When was the user last able to start the computer successfully, and what might have happened to the computer since then? -6. Might the user have encountered malicious software or left the computer unattended since the last successful startup? +1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC? +2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be? +3. If TPM mode was in effect, was recovery caused by a boot file change? +4. If recovery was caused by a boot file change, was the change an intended user action (for example, BIOS upgrade), or was it caused by malicious software? +5. When was the user last able to start the computer successfully, and what might have happened to the computer since then? +6. Might the user have encountered malicious software or left the computer unattended since the last successful startup? + +To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if the boot file changed). Both of these capabilities can be performed remotely. -To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if boot file change occurred). Both of these capabilities can be performed remotely. ### Resolve the root cause @@ -217,23 +241,27 @@ After you have identified what caused recovery, you can reset BitLocker protecti The details of this reset can vary according to the root cause of the recovery. If you cannot determine the root cause, or if malicious software or a rootkit might have infected the computer, Helpdesk should apply best-practice virus policies to react appropriately. ->**Note:**  You can perform a BitLocker validation profile reset by suspending and resuming BitLocker. - +> [!NOTE] +> You can perform a BitLocker validation profile reset by suspending and resuming BitLocker. + - [Unknown PIN](#bkmk-unknownpin) - [Lost startup key](#bkmk-loststartup) - [Changes to boot files](#bkmk-changebootknown) - ### Unknown PIN + + +### Unknown PIN If a user has forgotten the PIN, you must reset the PIN while you are logged on to the computer in order to prevent BitLocker from initiating recovery each time the computer is restarted. **To prevent continued recovery due to an unknown PIN** -1. Unlock the computer using the recovery password. -2. Reset the PIN: - 1. Right-click the drive and then click **Change PIN** - 2. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time. - 3. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**. -3. You will use the new PIN the next time you unlock the drive. +1. Unlock the computer using the recovery password. +2. Reset the PIN: + 1. Right-click the drive and then select **Change PIN**. + 2. In the BitLocker Drive Encryption dialog, select **Reset a forgotten PIN**. If you are not logged in with an administrator account, provide administrative credentials at this time. + 3. In the PIN reset dialog, provide and confirm the new PIN to use and then select **Finish**. +3. You will use the new PIN the next time you unlock the drive. + ### Lost startup key @@ -241,78 +269,236 @@ If you have lost the USB flash drive that contains the startup key, then you mus **To prevent continued recovery due to a lost startup key** -1. Log on as an administrator to the computer that has the lost startup key. -2. Open Manage BitLocker. -3. Click **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then click **Save**. +1. Log on as an administrator to the computer that has the lost startup key. +2. Open Manage BitLocker. +3. Select **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then select **Save**. + ### Changes to boot files -This error might occur if you updated the firmware. As a best practice you should suspend BitLocker before making changes the firmware and then resume protection after the update has completed. This prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on you can simply log on to the computer using the recovery password and the platform validation profile will be updated so that recovery will not occur the next time. +This error might occur if you updated the firmware. As a best practice, you should suspend BitLocker before making changes to the firmware and then resume protection after the update has completed. This action prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on, then log on to the computer using the recovery password, and the platform validation profile will be updated so that recovery will not occur the next time. + ## Windows RE and BitLocker Device Encryption -Windows Recovery Environment (RE) can be used to recover access to a drive protected by [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md). If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair is not able to be run automatically from the PC and instead Windows RE is manually started from a repair disk, the BitLocker recovery key must be provided to unlock the BitLocker–protected drives. +Windows Recovery Environment (RE) can be used to recover access to a drive protected by [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md). If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair can't run automatically from the PC and instead Windows RE is manually started from a repair disk, then the BitLocker recovery key must be provided to unlock the BitLocker–protected drives. + + +## BitLocker recovery screen + +During BitLocker recovery, Windows can display a custom recovery message and hints that identify where a key can be retrieved from. These improvements can help a user during BitLocker recovery. + + +### Custom recovery message + +BitLocker Group Policy settings in Windows 10, version 1511, let you configure a custom recovery message and URL on the BitLocker recovery screen, which can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support. + +This policy can be configured using GPO under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Configure pre-boot recovery message and URL**. + +It can also be configured using Intune mobile device management (MDM) in the BitLocker CSP: +*\./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage\* + +![Custom URL](./images/bl-intune-custom-url.png) + +Example of customized recovery screen: + +![Customized BitLocker Recovery Screen](./images/bl-password-hint1.png) + + +### BitLocker recovery key hints + +BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed on both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen. + +![Customized BitLocker recovery screen](./images/bl-password-hint2.png) + +> [!IMPORTANT] +> We don't recommend printing recovery keys or saving them to a file. Instead, use Active Directory backup or a cloud-based backup. Cloud-based backup includes Azure Active Directory (Azure AD) and Microsoft Account. + +There are rules governing which hint is shown during the recovery (in order of processing): + +1. Always display custom recovery message if it has been configured (using GPO or MDM). +2. Always display generic hint: "For more information, go to ". +3. If multiple recovery keys exist on the volume, prioritize the last created (and successfully backed up) recovery key. +4. Prioritize keys with successful backup over keys that have never been backed up. +5. Prioritize backup hints in the following order for remote backup locations: **Microsoft Account > Azure AD > Active Directory**. +6. If a key has been printed and saved to file, display a combined hint, "Look for a printout or a text file with the key," instead of two separate hints. +7. If multiple backups of the same type (remove vs. local) have been performed for the same recovery key, prioritize backup info with latest backed up date. +8. There is no specific hint for keys saved to an on-premises Active Directory. In this case, a custom message (if configured) or a generic message, "Contact your organization's help desk," will be displayed. +9. If two recovery keys are present on the disk, but only one has been successfully backed up, the system will ask for a key that has been backed up, even if another key is newer. + + +#### Example 1 (single recovery key with single backup) + +| Custom URL | Yes | +|----------------------|------------| +| Saved to Microsoft Account | Yes | +| Saved to Azure AD | No | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | No | + +**Result:** The hint for the Microsoft Account and the custom URL are displayed. + +![Example 1 of Customized BitLocker recovery screen](./images/rp-example1.png) + + +#### Example 2 (single recovery key with single backup) + +| Custom URL | Yes | +|----------------------|------------| +| Saved to Microsoft Account | No | +| Saved to Azure AD | No | +| Saved to Active Directory | Yes | +| Printed | No | +| Saved to file | No | + +**Result:** Only the custom URL is displayed. + +![Example 2 of customized BitLocker recovery screen](./images/rp-example2.png) + + +#### Example 3 (single recovery key with multiple backups) + +| Custom URL | No | +|----------------------|------------| +| Saved to Microsoft Account | Yes | +| Saved to Azure AD | Yes | +| Saved to Active Directory | No | +| Printed | Yes | +| Saved to file | Yes | + +**Result:** Only the Microsoft Account hint is displayed. + +![Example 3 of customized BitLocker recovery screen](./images/rp-example3.png) + + +#### Example 4 (multiple recovery passwords) + +| Custom URL | No | +|----------------------|-----------------| +| Saved to Microsoft Account | No | +| Saved to Azure AD | No | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | Yes | +| Creation time | **1PM** | +| Key ID | A564F193 | + +  +  + +| Custom URL | No | +|----------------------|-----------------| +| Saved to Microsoft Account | No | +| Saved to Azure AD | No | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | No | +| Creation time | **3PM** | +| Key ID | T4521ER5 | + +**Result:** Only the hint for a successfully backed up key is displayed, even if it isn't the most recent key. + +![Example 4 of customized BitLocker recovery screen](./images/rp-example4.png) + + +#### Example 5 (multiple recovery passwords) + +| Custom URL | No | +|----------------------|-----------------| +| Saved to Microsoft Account | Yes | +| Saved to Azure AD | Yes | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | No | +| Creation time | **1PM** | +| Key ID | 99631A34 | + +  +  + +| Custom URL | No | +|----------------------|-----------------| +| Saved to Microsoft Account | No | +| Saved to Azure AD | Yes | +| Saved to Active Directory | No | +| Printed | No | +| Saved to file | No | +| Creation time | **3PM** | +| Key ID | 9DF70931 | + +**Result:** The hint for the most recent key is displayed. + +![Example 5 of customized BitLocker recovery screen](./images/rp-example5.png) + ## Using additional recovery information Besides the 48-digit BitLocker recovery password, other types of recovery information are stored in Active Directory. This section describes how this additional information can be used. + ### BitLocker key package If the recovery methods discussed earlier in this document do not unlock the volume, you can use the BitLocker Repair tool to decrypt the volume at the block level. The tool uses the BitLocker key package to help recover encrypted data from severely damaged drives. You can then use this recovered data to salvage encrypted data, even after the correct recovery password has failed to unlock the damaged volume. We recommend that you still save the recovery password. A key package cannot be used without the corresponding recovery password. ->**Note:**  You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package. - -The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details on how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc). +> [!NOTE] +> You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package. + +The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS, you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details about how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc). + ## Resetting recovery passwords -You should invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason. +Invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason. You can reset the recovery password in two ways: -- **Use manage-bde** You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method. -- **Run a script** You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords. +- **Use manage-bde**: You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method. +- **Run a script**: You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords. -**To reset a recovery password using manage-bde** +**To reset a recovery password using manage-bde:** -1. Remove the previous recovery password +1. Remove the previous recovery password ```powershell Manage-bde –protectors –delete C: –type RecoveryPassword ``` -2. Add the new recovery password +2. Add the new recovery password ```powershell Manage-bde –protectors –add C: -RecoveryPassword ``` -3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password. +3. Get the ID of the new recovery password. From the screen, copy the ID of the recovery password. ```powershell Manage-bde –protectors –get C: -Type RecoveryPassword ``` -4. Backup the new recovery password to AD DS +4. Back up the new recovery password to AD DS. ```powershell Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692} ``` - >**Warning:**  You must include the braces in the ID string. - -**To run the sample recovery password script** -1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs. -2. At the command prompt, type a command similar to the following: + > [!WARNING] + > You must include the braces in the ID string. + +**To run the sample recovery password script:** + +1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs. +2. At the command prompt, type a command similar to the following sample script: **cscript ResetPassword.vbs** -> **Important:** This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset. -> -> **Note:**  To manage a remote computer, you can specify the remote computer name rather than the local computer name. - -You can use the following sample script to create a VBScript file to reset the recovery passwords. + > [!IMPORTANT] + > This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset. + +> [!NOTE] +> To manage a remote computer, you can specify the remote computer name rather than the local computer name. + +You can use the following sample script to create a VBScript file to reset the recovery passwords: ```vb ' Target drive letter @@ -385,23 +571,24 @@ WScript.Echo "A new recovery password has been added. Old passwords have been re 'WScript.Echo "Type ""manage-bde -protectors -get " & strDriveLetter & " -type recoverypassword"" to view existing passwords." ``` + ## Retrieving the BitLocker key package You can use two methods to retrieve the key package, as described in [Using Additional Recovery Information](#bkmk-usingaddrecovery): -- **Export a previously-saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS. -- **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred. +- **Export a previously saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS. +- **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred. -The following sample script exports all previously-saved key packages from AD DS. +The following sample script exports all previously saved key packages from AD DS. -**To run the sample key package retrieval script** +**To run the sample key package retrieval script:** 1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackageADDS.vbs. -2. At the command prompt, type a command similar to the following: +2. At the command prompt, type a command similar to the following sample script: **cscript GetBitLockerKeyPackageADDS.vbs -?** -You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS. +You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS: ```vb ' -------------------------------------------------------------------------------- @@ -543,10 +730,10 @@ WScript.Quit The following sample script exports a new key package from an unlocked, encrypted volume. -**To run the sample key package retrieval script** +**To run the sample key package retrieval script:** 1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackage.vbs -2. Open an administrator command prompt, type a command similar to the following: +2. Open an administrator command prompt, and then type a command similar to the following sample script: **cscript GetBitLockerKeyPackage.vbs -?** @@ -728,8 +915,7 @@ Function BinaryToString(Binary) End Function ``` + ## See also -- [BitLocker overview](bitlocker-overview.md) - - +- [BitLocker overview](bitlocker-overview.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md index 36decb2b2f..4ae0e5d8e8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md @@ -6,14 +6,15 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security -ms.localizationpriority: #medium +ms.localizationpriority: medium ms.author: v-maave -author: martyav +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 10/28/2019 +ms.custom: bitlocker --- # Breaking out of a Bitlocker recovery loop diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index 2962d7533b..fb1c2281f8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker Security FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md index e8bd11f12b..871f49b5a8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md @@ -1,6 +1,6 @@ --- title: BitLocker To Go FAQ (Windows 10) -description: Learn more about BitLocker To Go — BitLocker drive encryption for removable drives. +description: "Learn more about BitLocker To Go: BitLocker drive encryption for removable drives." ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: ms.author: dansimp @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 07/10/2018 +ms.custom: bitlocker --- # BitLocker To Go FAQ @@ -24,7 +25,14 @@ ms.date: 07/10/2018 ## What is BitLocker To Go? -BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. +BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of: -As with BitLocker, drives that are encrypted using BitLocker To Go can be opened with a password or smart card on another computer by using **BitLocker Drive Encryption** in Control Panel. +- USB flash drives +- SD cards +- External hard disk drives +- Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. + +Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](https://docs.microsoft.com/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements). + +As with BitLocker, you can open drives that are encrypted by BitLocker To Go by using a password or smart card on another computer. In Control Panel, use **BitLocker Drive Encryption**. diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md index 7873e99c18..a856063b96 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md @@ -14,6 +14,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 ms.reviewer: +ms.custom: bitlocker --- # BitLocker Upgrading FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index e4e1a3ffcd..793722ef06 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -1,6 +1,6 @@ --- title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10) -description: This topic for the IT professional describes how to use tools to manage BitLocker. +description: This article for the IT professional describes how to use tools to manage BitLocker. ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6 ms.reviewer: ms.prod: w10 @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker @@ -22,9 +23,9 @@ ms.date: 02/28/2019 **Applies to** - Windows 10 -This topic for the IT professional describes how to use tools to manage BitLocker. +This article for the IT professional describes how to use tools to manage BitLocker. -BitLocker Drive Encryption Tools include the command line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell. +BitLocker Drive Encryption Tools include the command-line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell. Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the BitLocker control panel and are appropriate to use for automated deployments and other scripting scenarios. @@ -38,11 +39,11 @@ Repair-bde is a special circumstance tool that is provided for disaster recovery Manage-bde is a command-line tool that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the manage-bde options, see the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line reference. -Manage-bde includes less default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde. +Manage-bde includes fewer default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde. ### Using manage-bde with operating system volumes -Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on ` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. It is recommended that at least one primary protector and a recovery protector be added to an operating system volume. +Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on ` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. We recommend that you add at least one primary protector and a recovery protector to an operating system volume. A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status: @@ -53,7 +54,7 @@ This command returns the volumes on the target, current encryption status, encry ![Using manage-bde to check encryption status](images/manage-bde-status.png) -The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. +The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process, you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. ```powershell manage-bde –protectors -add C: -startupkey E: @@ -62,30 +63,30 @@ manage-bde -on C: >**Note:**  After the encryption is completed, the USB startup key must be inserted before the operating system can be started. -An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. This is done with the command: +An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. To add them, use this command: ```powershell manage-bde -protectors -add C: -pw -sid ``` -This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn BitLocker on. +This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn on BitLocker. -On computers with a TPM it is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: +On computers with a TPM, it is possible to encrypt the operating system volume without any defined protectors using manage-bde. Use this command: ```powershell manage-bde -on C: ``` -This will encrypt the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: +This command encrypts the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: ```powershell manage-bde -protectors -get ``` ### Using manage-bde with data volumes -Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or you can choose to add additional protectors to the volume first. It is recommended that at least one primary protector and a recovery protector be added to a data volume. +Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on ` or you can choose to add additional protectors to the volume first. We recommend that you add at least one primary protector and a recovery protector to a data volume. -A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. +A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn on BitLocker. ```powershell manage-bde -protectors -add -pw C: @@ -100,11 +101,11 @@ The BitLocker Repair Tool (Repair-bde) can be used to access encrypted data on a >**Tip:**  If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume. -The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. You should use Repair-bde if the following conditions are true: +The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. Use Repair-bde if the following conditions are true: -1. You have encrypted the drive by using BitLocker Drive Encryption. -2. Windows does not start, or you cannot start the BitLocker recovery console. -3. You do not have a copy of the data that is contained on the encrypted drive. +- You have encrypted the drive by using BitLocker Drive Encryption. +- Windows does not start, or you cannot start the BitLocker recovery console. +- You do not have a copy of the data that is contained on the encrypted drive. >**Note:**  Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers. @@ -126,11 +127,11 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work -

            Name

            -

            Parameters

            +

            Name

            +

            Parameters

            -

            Add-BitLockerKeyProtector

            +

            Add-BitLockerKeyProtector

            -ADAccountOrGroup

            -ADAccountOrGroupProtector

            -Confirm

            @@ -152,26 +153,26 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work

            -WhatIf

            -

            Backup-BitLockerKeyProtector

            +

            Backup-BitLockerKeyProtector

            -Confirm

            -KeyProtectorId

            -MountPoint

            -WhatIf

            -

            Disable-BitLocker

            +

            Disable-BitLocker

            -Confirm

            -MountPoint

            -WhatIf

            -

            Disable-BitLockerAutoUnlock

            +

            Disable-BitLockerAutoUnlock

            -Confirm

            -MountPoint

            -WhatIf

            -

            Enable-BitLocker

            +

            Enable-BitLocker

            -AdAccountOrGroup

            -AdAccountOrGroupProtector

            -Confirm

            @@ -196,44 +197,44 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work

            -WhatIf

            -

            Enable-BitLockerAutoUnlock

            +

            Enable-BitLockerAutoUnlock

            -Confirm

            -MountPoint

            -WhatIf

            -

            Get-BitLockerVolume

            +

            Get-BitLockerVolume

            -MountPoint

            -

            Lock-BitLocker

            +

            Lock-BitLocker

            -Confirm

            -ForceDismount

            -MountPoint

            -WhatIf

            -

            Remove-BitLockerKeyProtector

            +

            Remove-BitLockerKeyProtector

            -Confirm

            -KeyProtectorId

            -MountPoint

            -WhatIf

            -

            Resume-BitLocker

            +

            Resume-BitLocker

            -Confirm

            -MountPoint

            -WhatIf

            -

            Suspend-BitLocker

            +

            Suspend-BitLocker

            -Confirm

            -MountPoint

            -RebootCount

            -WhatIf

            -

            Unlock-BitLocker

            +

            Unlock-BitLocker

            -AdAccountOrGroup

            -Confirm

            -MountPoint

            @@ -248,7 +249,7 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the Get-BitLockerVolume cmdlet. -The Get-BitLockerVolume cmdlet output gives information on the volume type, protectors, protection status and other details. +The Get-BitLockerVolume cmdlet output gives information on the volume type, protectors, protection status, and other details. >**Tip:**  Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors. `Get-BitLockerVolume C: | fl` @@ -262,9 +263,9 @@ $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` -Using this, you can display the information in the $keyprotectors variable to determine the GUID for each protector. +By using this script, you can display the information in the $keyprotectors variable to determine the GUID for each protector. -Using this information, you can then remove the key protector for a specific volume using the command: +By using this information, you can then remove the key protector for a specific volume using the command: ```powershell Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" @@ -290,8 +291,8 @@ Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTes ### Using the BitLocker Windows PowerShell cmdlets with data volumes -Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a -SecureString value to store the user defined password. +Data volume encryption using Windows PowerShell is the same as for operating system volumes. Add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a +SecureString value to store the user-defined password. ```powershell $pw = Read-Host -AsSecureString @@ -300,11 +301,11 @@ Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw ``` ### Using an AD Account or Group protector in Windows PowerShell -The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover to and be unlocked by any member computer of the cluster. +The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly fail over to and be unlocked by any member computer of the cluster. >**Warning:**  The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes -To add an **ADAccountOrGroup** protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. +To add an **ADAccountOrGroup** protector to a volume, use either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. ```powershell Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md index 9f41146f0d..1bc4358ba0 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # BitLocker: Use BitLocker Recovery Password Viewer diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md index 0aebf543c2..e71fba3cbd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # Using BitLocker with other programs FAQ @@ -36,7 +37,7 @@ BitLocker has a storage driver stack that ensures memory dumps are encrypted whe ## Can BitLocker support smart cards for pre-boot authentication? -BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them very difficult. +BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them difficult. ## Can I use a non-Microsoft TPM driver? @@ -68,7 +69,7 @@ The **Save to USB** option is not shown by default for removable drives. If the ## Why am I unable to automatically unlock my drive? -Automatic unlocking for fixed data drives requires that the operating system drive also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers. +Automatic unlocking for fixed data drives requires the operating system drive to also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers. ## Can I use BitLocker in Safe Mode? @@ -94,8 +95,8 @@ Yes. However, shadow copies made prior to enabling BitLocker will be automatical ## Does BitLocker support virtual hard disks (VHDs)? BitLocker should work like any specific physical machine within its hardware limitations as long as the environment (physical or virtual) meets Windows Operating System requirements to run. -- With TPM - Yes it is supported -- Without TPM - Yes it is supported (with password protector) +- With TPM: Yes, it is supported. +- Without TPM: Yes, it is supported (with password protector). BitLocker is also supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012. diff --git a/windows/security/information-protection/bitlocker/images/bl-intune-custom-url.png b/windows/security/information-protection/bitlocker/images/bl-intune-custom-url.png new file mode 100644 index 0000000000..a563d3153f Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/bl-intune-custom-url.png differ diff --git a/windows/security/information-protection/bitlocker/images/bl-password-hint1.png b/windows/security/information-protection/bitlocker/images/bl-password-hint1.png new file mode 100644 index 0000000000..864e84c6e9 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/bl-password-hint1.png differ diff --git a/windows/security/information-protection/bitlocker/images/bl-password-hint2.png b/windows/security/information-protection/bitlocker/images/bl-password-hint2.png new file mode 100644 index 0000000000..01a5f08c42 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/bl-password-hint2.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example1.png b/windows/security/information-protection/bitlocker/images/rp-example1.png new file mode 100644 index 0000000000..1c9b7bc560 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example1.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example2.png b/windows/security/information-protection/bitlocker/images/rp-example2.png new file mode 100644 index 0000000000..eee52f9c54 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example2.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example3.png b/windows/security/information-protection/bitlocker/images/rp-example3.png new file mode 100644 index 0000000000..ed1158c2a1 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example3.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example4.png b/windows/security/information-protection/bitlocker/images/rp-example4.png new file mode 100644 index 0000000000..8cd88812bc Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example4.png differ diff --git a/windows/security/information-protection/bitlocker/images/rp-example5.png b/windows/security/information-protection/bitlocker/images/rp-example5.png new file mode 100644 index 0000000000..7a588bdd67 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/rp-example5.png differ diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index 72436ef74d..baa25d7cf6 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/24/2019 +ms.custom: bitlocker --- # Prepare your organization for BitLocker: Planning and policies diff --git a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index 1473dadc79..01a07590a5 100644 --- a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -1,6 +1,6 @@ --- title: Protecting cluster shared volumes and storage area networks with BitLocker (Windows 10) -description: This topic for IT pros describes how to protect CSVs and SANs with BitLocker. +description: This article for IT pros describes how to protect CSVs and SANs with BitLocker. ms.assetid: ecd25a10-42c7-4d31-8a7e-ea52c8ebc092 ms.reviewer: ms.prod: w10 @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.custom: bitlocker --- # Protecting cluster shared volumes and storage area networks with BitLocker @@ -22,7 +23,7 @@ ms.date: 02/28/2019 **Applies to** - Windows Server 2016 -This topic for IT pros describes how to protect CSVs and SANs with BitLocker. +This article for IT pros describes how to protect CSVs and SANs with BitLocker. BitLocker can protect both physical disk resources and cluster shared volumes version 2.0 (CSV2.0). BitLocker on clustered volumes allows for an additional layer of protection for administrators wishing to protect sensitive, highly available data. By adding additional protectors to the clustered volume, administrators can also add an additional barrier of security to resources within an organization by allowing only certain user accounts access to unlock the BitLocker volume. @@ -37,15 +38,15 @@ BitLocker on volumes within a cluster are managed based on how the cluster servi Alternatively, the volume can be a cluster-shared volume, a shared namespace, within the cluster. Windows Server 2012 expanded the CSV architecture, now known as CSV2.0, to enable support for BitLocker. When using BitLocker with volumes designated for a cluster, the volume will need to turn on BitLocker before its addition to the storage pool within cluster or put the resource into maintenance mode before BitLocker operations will complete. -Windows PowerShell or the manage-bde command line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item. +Windows PowerShell or the manage-bde command-line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This method is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item. >**Note:**  Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption. -For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space. +For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This action is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space. ### Active Directory-based protector -You can also use an Active Directory Domain Services (AD DS) protector for protecting clustered volumes held within your AD DS infrastructure. The **ADAccountOrGroup** protector is a domain security identifier (SID)-based protector that can be bound to a user account, machine account or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order: +You can also use an Active Directory Domain Services (AD DS) protector for protecting clustered volumes held within your AD DS infrastructure. The **ADAccountOrGroup** protector is a domain security identifier (SID)-based protector that can be bound to a user account, machine account, or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order: 1. Clear key 2. Driver-based auto-unlock key @@ -60,7 +61,7 @@ You can also use an Active Directory Domain Services (AD DS) protector for prote ### Turning on BitLocker before adding disks to a cluster using Windows PowerShell -BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster, do the following: +BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster: 1. Install the BitLocker Drive Encryption feature if it is not already installed. 2. Ensure the disk is formatted NTFS and has a drive letter assigned to it. @@ -83,7 +84,7 @@ BitLocker encryption is available for disks before or after addition to a cluste ### Turning on BitLocker for a clustered disk using Windows PowerShell -When the cluster service owns a disk resource already, it needs to be set into maintenance mode before BitLocker can be enabled. Use the following steps for turning BitLocker on for a clustered disk: +When the cluster service owns a disk resource already, it needs to be set into maintenance mode before BitLocker can be enabled. Use the following steps for turning on BitLocker for a clustered disk: 1. Install the BitLocker Drive Encryption feature if it is not already installed. 2. Check the status of the cluster disk using Windows PowerShell. @@ -121,11 +122,11 @@ When the cluster service owns a disk resource already, it needs to be set into m ### Adding BitLocker encrypted volumes to a cluster using manage-bde -You can also use manage-bde to enable BitLocker on clustered volumes. The steps needed to add a physical disk resource or CSV2.0 volume to an existing cluster includes the following: +You can also use manage-bde to enable BitLocker on clustered volumes. Follow these steps to add a physical disk resource or CSV2.0 volume to an existing cluster: 1. Verify the BitLocker Drive Encryption feature is installed on the computer. 2. Ensure new storage is formatted as NTFS. -3. Encrypt the volume, add a recovery key and add the cluster administrator as a protector key using the manage-bde command line interface (see example): +3. Encrypt the volume, add a recovery key, and add the cluster administrator as a protector key by using the manage-bde command-line interface (see example): - `Manage-bde -on -used -RP -sid domain\CNO$ -sync` @@ -134,16 +135,17 @@ You can also use manage-bde to enable BitLocker on clustered volumes. The steps 4. Open the Failover Cluster Manager snap-in or cluster PowerShell cmdlets to enable the disk to be clustered - - Once the disk is clustered it can also be enabled for CSV. + - Once the disk is clustered, it can also be enabled for CSV. 5. During the resource online operation, cluster will check to see if the disk is BitLocker encrypted. 1. If the volume is not BitLocker enabled, traditional cluster online operations occur. 2. If the volume is BitLocker enabled, the following check occurs: - - If volume is **locked**, BitLocker will impersonate the CNO and unlock the volume using the CNO protector. If this operation fails an event will be logged that the volume could not be unlocked and the online operation will fail. + - If volume is **locked**, BitLocker will impersonate the CNO and unlock the volume using the CNO protector. If this operation fails, an event will be logged that the volume could not be unlocked and the online operation will fail. + +6. Once the disk is online in the storage pool, it can be added to a CSV by right-clicking the disk resource and choosing **Add to cluster shared volumes**. -6. Once the disk is online in the storage pool, it can be added to a CSV by right clicking on the disk resource and choosing "**Add to cluster shared volumes**". CSVs can include both encrypted and unencrypted volumes. To check the status of a particular volume for BitLocker encryption, administrators can utilize the manage-bde -status command with a path to the volume inside the CSV namespace as seen in the example command line below. ```powershell @@ -152,11 +154,11 @@ manage-bde -status "C:\ClusterStorage\volume1" ### Physical Disk Resources -Unlike CSV2.0 volumes, physical disk resources can only be accessed by one cluster node at a time. This means that operations such as encrypting, decrypting, locking or unlocking volumes require context to perform. For example, you cannot unlock or decrypt a physical disk resource if you are not administering the cluster node that owns the disk resource because the disk resource is not available. +Unlike CSV2.0 volumes, physical disk resources can only be accessed by one cluster node at a time. So operations such as encrypting, decrypting, locking, or unlocking volumes require context to perform. For example, you cannot unlock or decrypt a physical disk resource if you are not administering the cluster node that owns the disk resource because the disk resource is not available. ### Restrictions on BitLocker actions with cluster volumes -The following table contains information about both Physical Disk Resources (i.e. traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation. +The following table contains information about both Physical Disk Resources (that is, traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation. @@ -168,91 +170,91 @@ The following table contains information about both Physical Disk Resources (i.e - - - - - + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -261,13 +263,13 @@ The following table contains information about both Physical Disk Resources (i.e

            Action

            On owner node of failover volume

            On Metadata Server (MDS) of CSV

            On (Data Server) DS of CSV

            Maintenance Mode

            Action

            On owner node of failover volume

            On Metadata Server (MDS) of CSV

            On (Data Server) DS of CSV

            Maintenance Mode

            Manage-bde –on

            Manage-bde –on

            Blocked

            Blocked

            Blocked

            Allowed

            Manage-bde –off

            Manage-bde –off

            Blocked

            Blocked

            Blocked

            Allowed

            Manage-bde Pause/Resume

            Manage-bde Pause/Resume

            Blocked

            Blocked

            Blocked

            Blocked

            Allowed

            Manage-bde –lock

            Manage-bde –lock

            Blocked

            Blocked

            Blocked

            Allowed

            manage-bde –wipe

            manage-bde –wipe

            Blocked

            Blocked

            Blocked

            Allowed

            Unlock

            Unlock

            Automatic via cluster service

            Automatic via cluster service

            Automatic via cluster service

            Allowed

            manage-bde –protector –add

            manage-bde –protector –add

            Allowed

            Allowed

            Blocked

            Allowed

            manage-bde -protector -delete

            manage-bde -protector -delete

            Allowed

            Allowed

            Blocked

            Allowed

            manage-bde –autounlock

            manage-bde –autounlock

            Allowed (not recommended)

            Allowed (not recommended)

            Blocked

            Allowed (not recommended)

            Manage-bde -upgrade

            Manage-bde -upgrade

            Allowed

            Allowed

            Blocked

            Allowed

            Shrink

            Shrink

            Allowed

            Allowed

            Blocked

            Allowed

            Extend

            Extend

            Allowed

            Allowed

            Blocked

            ->
            Note:** Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node +>Note:** Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node In the case where a physical disk resource experiences a failover event during conversion, the new owning node will detect the conversion is not complete and will complete the conversion process. ### Other considerations when using BitLocker on CSV2.0 -Some other considerations to take into account for BitLocker on clustered storage include the following: +Also take these considerations into account for BitLocker on clustered storage: - BitLocker volumes have to be initialized and beginning encryption before they are available to add to a CSV2.0 volume. - If an administrator needs to decrypt a CSV volume, remove the volume from the cluster or put into disk maintenance mode. You can add the CSV back to the cluster while waiting for decryption to complete. - If an administrator needs to start encrypting a CSV volume, remove the volume from the cluster or put it in maintenance mode. diff --git a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md index 88e28e59eb..e6e97c6293 100644 --- a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md +++ b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md @@ -13,6 +13,7 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/17/2019 +ms.custom: bitlocker --- # Guidelines for troubleshooting BitLocker @@ -24,14 +25,14 @@ This article addresses common issues in BitLocker and provides guidelines to tro Open Event Viewer and review the following logs under Applications and Services logs\\Microsoft\\Windows: - **BitLocker-API**. Review the Management log, the Operational log, and any other logs that are generated in this folder. The default logs have the following unique names: - - Microsoft-Windows-BitLocker/BitLocker Operational - - Microsoft-Windows-BitLocker/BitLocker Management + - Microsoft-Windows-BitLocker-API/BitLocker Operational + - Microsoft-Windows-BitLocker-API/BitLocker Management -- **BitLocker-DrivePreparationTool**. Review the Admin log, the **Operational log, and any other logs that are generated in this folder. The default logs have the following unique names: +- **BitLocker-DrivePreparationTool**. Review the Admin log, the Operational log, and any other logs that are generated in this folder. The default logs have the following unique names: - Microsoft-Windows-BitLocker-DrivePreparationTool/Operational - Microsoft-Windows-BitLocker-DrivePreparationTool/Admin -Additionally, review the Windows logs\\System log for events that were produced by the TCM and TCM-WMI event sources. +Additionally, review the Windows logs\\System log for events that were produced by the TPM and TPM-WMI event sources. To filter and display or export logs, you can use the [wevtutil.exe](https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil) command-line tool or the [Get-WinEvent](https://docs.microsoft.com/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6) cmdlet. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md index 2382b91a2a..03b1c67188 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -13,6 +13,7 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/17/2019 +ms.custom: bitlocker --- # BitLocker cannot encrypt a drive: known issues diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md index c69bb9ab25..8e005347db 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -1,5 +1,5 @@ --- -title: BitLocker cannot encrypt a drive known TPM issues +title: BitLocker cannot encrypt a drive known TPM issues description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive, and that you can attribute to the TPM ms.reviewer: kaushika ms.technology: windows @@ -13,6 +13,7 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/18/2019 +ms.custom: bitlocker --- # BitLocker cannot encrypt a drive: known TPM issues @@ -36,8 +37,10 @@ To resolve this issue, follow these steps: 1. Open an elevated PowerShell window and run the following script: - ```ps - $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} + ```powershell + $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" + $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus + if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} ``` 1. Restart the computer. If you are prompted at the restart screen, press F12 to agree. @@ -65,7 +68,7 @@ To resolve this issue, disable and re-enable the TPM. To do this, follow these s If you still cannot prepare the TPM, clear the existing TPM keys. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm). > [!WARNING] -> Clearing the TPM can cause data loss. +> Clearing the TPM can cause data loss. ## Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005 @@ -77,7 +80,7 @@ The TPM did not have sufficient permissions on the TPM Devices container in Acti This issue appears to be limited to computers that run versions of Windows that are earlier than Windows 10. -### Resolution +### Resolution To verify that you have correctly identified this issue, use one of the following methods: @@ -86,7 +89,7 @@ To verify that you have correctly identified this issue, use one of the followin 1. To review the TPM information for the affected computer, open an elevated Windows PowerShell window and run the following command: - ```ps + ```powershell Get-ADComputer -Filter {Name -like "ComputerName"} -Property * | Format-Table name,msTPM-TPMInformationForComputer ``` @@ -96,7 +99,7 @@ To verify that you have correctly identified this issue, use one of the followin ## Cannot prepare the TPM, error 0x80072030: "There is no such object on the server" -Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. +Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you see a message that resembles the following: @@ -113,14 +116,14 @@ The domain and forest functional level of the environment may still be set to Wi To resolve this issue, follow these steps: 1. Upgrade the functional level of the domain and forest to Windows Server 2012 R2. -1. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133). -1. In the script, modify the value of **strPathToDomain** to your domain name. -1. Open an elevated PowerShell window, and run the following command: +2. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133). +3. In the script, modify the value of **strPathToDomain** to your domain name. +4. Open an elevated PowerShell window, and run the following command: - ```ps + ```powershell cscript Add-TPMSelfWriteACE.vbs ``` - + In this command \<*Path*> is the path to the script file. For more information, see the following articles: diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md index 346095b34e..e3c4f3f6d4 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md @@ -13,6 +13,7 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/17/2019 +ms.custom: bitlocker --- # BitLocker configuration: known issues diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md index c3e4f16427..3e2cdad741 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -13,6 +13,7 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/17/2019 +ms.custom: bitlocker --- # Decode Measured Boot logs to track PCR changes diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index 18236c1ddf..895c4eec13 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -13,6 +13,7 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/18/2019 +ms.custom: bitlocker --- # Enforcing BitLocker policies by using Intune: known issues @@ -205,7 +206,7 @@ To verify the Secure Boot state, use the System Information app. To do this, fol 1. Verify that the **Secure Boot State** setting is **On**, as follows: ![System Information app, showing a supported Secure Boot State](./images/4509201-en-1.png) 1. If the **Secure Boot State** setting is **Unsupported**, you cannot use Silent BitLocker Encryption on this device. - ![System Information app, showing a supported Secure Boot State](./images/4509202-en-1.png) + ![System Information app, showing a unsupported Secure Boot State](./images/4509202-en-1.png) > [!NOTE] > You can also use the [Confirm-SecureBootUEFI](https://docs.microsoft.com/powershell/module/secureboot/confirm-securebootuefi?view=win10-ps) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command: diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md index 77216f2dd1..b5882849d0 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md @@ -13,7 +13,9 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/7/2019 +ms.custom: bitlocker --- + # BitLocker Network Unlock: known issues By using the BitLocker Network Unlock feature, you can manage computers remotely without having to enter a BitLocker PIN when each computer starts up. To do this, You have to configure your environment to meet the following requirements: diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md index a25ea79f8a..b9d677c092 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md @@ -13,6 +13,7 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/18/2019 +ms.custom: bitlocker --- # BitLocker recovery: known issues diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md index 553780277a..9e19de9f72 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md @@ -13,6 +13,7 @@ audience: ITPro ms.collection: Windows Security Technologies\BitLocker ms.topic: troubleshooting ms.date: 10/18/2019 +ms.custom: bitlocker --- # BitLocker and TPM: other known issues diff --git a/windows/security/information-protection/images/device_details_tab_1903.png b/windows/security/information-protection/images/device_details_tab_1903.png new file mode 100644 index 0000000000..beb0337379 Binary files /dev/null and b/windows/security/information-protection/images/device_details_tab_1903.png differ diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md index c2050be90b..e72f8d6c68 100644 --- a/windows/security/information-protection/index.md +++ b/windows/security/information-protection/index.md @@ -1,6 +1,6 @@ --- title: Information protection (Windows 10) -description: Learn more about how to protect sesnsitive data across your ogranization. +description: Learn more about how to protect sensitive data across your organization. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -22,7 +22,7 @@ Learn more about how to secure documents and other data across your organization |-|-| | [BitLocker](bitlocker/bitlocker-overview.md)| Provides information about BitLocker, which is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. | | [Encrypted Hard Drive](encrypted-hard-drive.md)| Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. | -| [Kernel DMA Protection for Thunderbolt™ 3](kernel-dma-protection-for-thunderbolt.md)| Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. | +| [Kernel DMA Protection](kernel-dma-protection-for-thunderbolt.md)| Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to PCI accessible ports, such as Thunderbolt™ 3 ports. | | [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection/protect-enterprise-data-using-wip.md)|Provides info about how to create a Windows Information Protection policy that can help protect against potential corporate data leakage.| | [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)| Windows 10 supports features to help prevent rootkits and bootkits from loading during the startup process. | | [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)| Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. | diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 5474e7faf1..2c39161d3c 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -1,11 +1,11 @@ --- -title: Kernel DMA Protection for Thunderbolt™ 3 (Windows 10) +title: Kernel DMA Protection (Windows 10) description: Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -15,17 +15,18 @@ ms.date: 03/26/2019 ms.reviewer: --- -# Kernel DMA Protection for Thunderbolt™ 3 +# Kernel DMA Protection **Applies to** - Windows 10 -In Windows 10 version 1803, Microsoft introduced a new feature called Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. +In Windows 10 version 1803, Microsoft introduced a new feature called Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to externally accessible PCIe ports (e.g., Thunderbolt™ 3 ports and CFexpress). In Windows 10 version 1903, Microsoft expanded the Kernel DMA Protection support to cover internal PCIe ports (e.g., M.2 slots) + Drive-by DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely. This feature does not protect against DMA attacks via 1394/FireWire, PCMCIA, CardBus, ExpressCard, and so on. -For Thunderbolt DMA protection on earlier Windows versions and other platforms that lack support for Kernel DMA Protection, please refer to [Intel Thunderbolt™ 3 Security documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf). +For Thunderbolt DMA protection on earlier Windows versions and platforms that lack support for Kernel DMA Protection, please refer to [Intel Thunderbolt™ 3 Security documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf). ## Background @@ -33,9 +34,10 @@ PCI devices are DMA-capable, which allows them to read and write to system memor The DMA capability is what makes PCI devices the highest performing devices available today. These devices have historically existed only inside the PC chassis, either connected as a card or soldered on the motherboard. Access to these devices required the user to turn off power to the system and disassemble the chassis. -Today, this is no longer the case with Thunderbolt™. -Thunderbolt™ technology has provided modern PCs with extensibility that was not available before for PCs. +Today, this is no longer the case with hot plug PCIe ports (e.g., Thunderbolt™ and CFexpress). + +Hot plug PCIe ports such as Thunderbolt™ technology have provided modern PCs with extensibility that was not available before for PCs. It allows users to attach new classes of external peripherals, such as graphics cards or other PCI devices, to their PCs with a hot plug experience identical to USB. Having PCI hot plug ports externally and easily accessible makes PCs susceptible to drive-by DMA attacks. @@ -45,15 +47,15 @@ A simple example would be a PC owner leaves the PC for a quick coffee break, and ## How Windows protects against DMA drive-by attacks Windows leverages the system Input/Output Memory Management Unit (IOMMU) to block external peripherals from starting and performing DMA unless the drivers for these peripherals support memory isolation (such as DMA-remapping). -Peripherals with compatible drivers will be automatically enumerated, started and allowed to perform DMA to their assigned memory regions. -By default, peripherals with incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. +Peripherals with [DMA Remapping compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers) will be automatically enumerated, started and allowed to perform DMA to their assigned memory regions. + +By default, peripherals with DMA Remapping incompatible drivers will be blocked from starting and performing DMA until an authorized user signs into the system or unlocks the screen. IT administrators can modify the default behavior applied to devices with DMA Remapping incompatible drivers using the [DmaGuard MDM policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-policies). ## User experience ![Kernel DMA protection user experience](images/kernel-dma-protection-user-experience.png) -A peripheral that is incompatible with DMA-remapping will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. -Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. +By default, peripherals with DMA remapping compatible device drivers will be automatically enumerated and started. Peripherals with DMA Remapping incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or logs out of the system. ## System compatibility @@ -80,16 +82,24 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if ### Using System information 1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar. + 2. Check the value of **Kernel DMA Protection**. + ![Kernel DMA protection in System Information](bitlocker/images/kernel-dma-protection.png) -3. If the current state of **Kernel DMA Protection** is OFF and **Virtualization Technology in Firmware** is NO: + +3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO: + - Reboot into BIOS settings - Turn on Intel Virtualization Technology. - Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md). - Reboot system into Windows 10. + + >[!NOTE] + > **Hyper-V - Virtualization Enabled in Firmware** is not available when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is displayed. This means that **Hyper-V - Virtualization Enabled in Firmware** is set to Yes and the **Hyper-V** Windows feature is enabled. Enabling Hyper-V virtualization in Firmware (IOMMU) is required to enable **Kernel DMA Protection**, even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-kernel-dma-protection). + 4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature. -For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection. + For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection. ## Frequently asked questions @@ -103,18 +113,27 @@ No, Kernel DMA Protection only protects against drive-by DMA attacks after the O DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (i.e. the device driver does not support DMA-remapping). Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). +![Kernel DMA protection user experience](images/device_details_tab_1903.png) + *For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. ![Kernel DMA protection user experience](images/device-details-tab.png) -### What should I do if the drivers for my Thunderbolt™ 3 peripherals do not support DMA-remapping? -If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support this functionality. Details for driver compatibility requirements can be found at the [Microsoft Partner Center](https://partner.microsoft.com/dashboard/collaborate/packages/4142). +### What should I do if the drivers for my PCI or Thunderbolt™ 3 peripherals do not support DMA-remapping? + +If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support [DMA Remapping](https://docs.microsoft.com/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers). + +### My system's Kernel DMA Protection is off. Can DMA-remapping for a specific device be turned on? + +Yes. DMA remapping for a specific device can be turned on independent from Kernel DMA Protection. For example, if the driver opts in and VT-d (Virtualization Technology for Directed I/O) is turned on, then DMA remapping will be enabled for the devices driver even if Kernel DMA Protection is turned off. + +Kernel DMA Protection is a policy that allows or blocks devices to perform DMA, based on their remapping state and capabilities. ### Do Microsoft drivers support DMA-remapping? -In Windows 10 1803 and beyond, the Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers and Storage NVMe Controllers support DMA-remapping. +In Windows 10 1803 and beyond, the Microsoft inbox drivers for USB XHCI (3.x) Controllers, Storage AHCI/SATA Controllers and Storage NVMe Controllers support DMA Remapping. ### Do drivers for non-PCI devices need to be compatible with DMA-remapping? -No. Devices for non-PCI peripherals, such as USB devices, do not perform DMA, thus no need for the driver to be compatible with DMA-remapping. +No. Devices for non-PCI peripherals, such as USB devices, do not perform DMA, thus no need for the driver to be compatible with DMA Remapping. ### How can an enterprise enable the External device enumeration policy? The External device enumeration policy controls whether to enumerate external peripherals that are not compatible with DMA-remapping. Peripherals that are compatible with DMA-remapping are always enumerated. Peripherals that don't can be blocked, allowed, or allowed only after the user signs in (default). diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 384c907c62..76cd4b50a5 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -7,7 +7,7 @@ ms.mktglfcycl: Explore ms.pagetype: security ms.sitesec: library ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -84,7 +84,7 @@ These requirements help protect you from rootkits while allowing you to run any - **Configure UEFI to trust your custom bootloader.** All Certified For Windows 10 PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems. - **Turn off Secure Boot.** All Certified For Windows 10 PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however. -To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. For more information about Secure Boot, read the blog, [Protecting the pre-OS environment with UEFI](https://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx). +To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. Like most mobile devices, ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system. Fortunately, there is a large market of ARM devices designed to run other operating systems. @@ -96,7 +96,7 @@ Because Secure Boot has protected the bootloader and Trusted Boot has protected Early Launch Anti-Malware (ELAM) can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn’t started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: examine every boot driver and determine whether it is on the list of trusted drivers. If it’s not trusted, Windows won’t load it. -An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://www.microsoft.com/server-cloud/system-center/endpoint-protection-2012.aspx) and several non-Microsoft anti-malware apps. +An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://docs.microsoft.com/lifecycle/products/microsoft-system-center-2012-endpoint-protection) and several non-Microsoft anti-malware apps. ## Measured Boot If a PC in your organization does become infected with a rootkit, you need to know about it. Enterprise anti-malware apps can report malware infections to the IT department, but that doesn’t work with rootkits that hide their presence. In other words, you can’t trust the client to tell you whether it’s healthy. @@ -129,4 +129,4 @@ Measured Boot uses the power of UEFI, TPM, and Windows 10 to give you a way to Secure Boot, Trusted Boot, and Measured Boot create an architecture that is fundamentally resistant to bootkits and rootkits. In Windows 10, these features have the potential to eliminate kernel-level malware from your network. This is the most ground-breaking anti-malware solution that Windows has ever had; it’s leaps and bounds ahead of everything else. With Windows 10, you can truly trust the integrity of your operating system. ## Additional resources -- [Windows 10 Enterprise Evaluation](https://technet.microsoft.com/evalcenter/hh699156.aspx?ocid=wc-tn-wctc) +- [Windows 10 Enterprise LTSC 2019 or v2004 Evaluation](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) diff --git a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md index 3e3fdfd9b5..596d94cff0 100644 --- a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md index 1cb7f1c281..7854157fed 100644 --- a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md +++ b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md index c802bfae51..06d8c54066 100644 --- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md index cf6d045df3..27d47eebbc 100644 --- a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md index d9e1befbcd..fed9817bba 100644 --- a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md index e2ae8c85e5..06382dc117 100644 --- a/windows/security/information-protection/tpm/tpm-fundamentals.md +++ b/windows/security/information-protection/tpm/tpm-fundamentals.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -151,5 +151,5 @@ The Windows TPM-based smart card, which is a virtual smart card, can be configur - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) - [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule/) -- [TPM WMI providers](https://msdn.microsoft.com/library/aa376476.aspx) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) +- [TPM WMI providers](https://docs.microsoft.com/windows/win32/secprov/security-wmi-providers-reference) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#tpm-hardware-configurations) diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index 4ab3d8f320..997c6add77 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -112,7 +112,7 @@ The following table defines which Windows features require TPM support. Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | -|-|-|-|- Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot - BitLocker | Yes | Yes | Yes | TPM 1.2 or 2.0 is required, but [Automatic Device Encryption requires Modern Standby](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) including TPM 2.0 support + BitLocker | No | Yes | Yes | TPM 1.2 or 2.0 are supported but TPM 2.0 is recommended. [Automatic Device Encryption requires Modern Standby](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) including TPM 2.0 support Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. Windows Defender Application Control (Device Guard) | No | Yes | Yes Windows Defender System Guard | Yes | No | Yes @@ -123,7 +123,7 @@ The following table defines which Windows features require TPM support. TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes Virtual Smart Card | Yes | Yes | Yes Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. - Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required for white glove and self-deploying scenarios. + Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md index a6c748fa89..d573495c4e 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md index 94634c4b79..f6df5436b6 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -41,7 +41,7 @@ This policy setting configured which TPM authorization values are stored in the |--------------|---------------|---------|-----------------|-----------------|------------------| | OwnerAuthAdmin | StorageOwnerAuth | Create SRK | No | Yes | Yes | | OwnerAuthEndorsement | EndorsementAuth | Create or use EK (1.2 only: Create AIK) | No | Yes | Yes | -| OwnerAuthFull | LockoutAuth | Reset/change Dictionary Attack Protection | No | No | No | +| OwnerAuthFull | LockoutAuth | Reset/change Dictionary Attack Protection | No | No | Yes | There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. diff --git a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md index 45c32cd7da..124caf74f2 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md index 60283edd89..f7aad3051d 100644 --- a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md @@ -4,11 +4,10 @@ description: Learn how unenlightened and enlightened apps might behave, based on keywords: WIP, Enterprise Data Protection, EDP, Windows Information Protection, unenlightened apps, enlightened apps ms.prod: w10 ms.mktglfcycl: explore -ms.pagetype: security ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -54,7 +53,7 @@ This table includes info about how unenlightened apps might behave, based on you Name-based policies, using the /*AppCompat*/ string or proxy-based policies - Not required. App connects to enterprise cloud resources directly, using an IP address. + Not required. App connects to enterprise cloud resources directly, using an IP address.
            • App is entirely blocked from both personal and enterprise cloud resources.
            • @@ -71,7 +70,7 @@ This table includes info about how unenlightened apps might behave, based on you - Not required. App connects to enterprise cloud resources, using a hostname. + Not required. App connects to enterprise cloud resources, using a hostname.
              • App is blocked from accessing enterprise cloud resources, but can access other network resources.
              • @@ -81,7 +80,7 @@ This table includes info about how unenlightened apps might behave, based on you - Allow. App connects to enterprise cloud resources, using an IP address or a hostname. + Allow. App connects to enterprise cloud resources, using an IP address or a hostname.
                • App can access both personal and enterprise cloud resources.
                • @@ -91,7 +90,7 @@ This table includes info about how unenlightened apps might behave, based on you - Exempt. App connects to enterprise cloud resources, using an IP address or a hostname. + Exempt. App connects to enterprise cloud resources, using an IP address or a hostname.
                  • App can access both personal and enterprise cloud resources.
                  • @@ -111,7 +110,7 @@ This table includes info about how enlightened apps might behave, based on your Networking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies - Not required. App connects to enterprise cloud resources, using an IP address or a hostname. + Not required. App connects to enterprise cloud resources, using an IP address or a hostname.
                    • App is blocked from accessing enterprise cloud resources, but can access other network resources.
                    • @@ -121,7 +120,7 @@ This table includes info about how enlightened apps might behave, based on your - Allow. App connects to enterprise cloud resources, using an IP address or a hostname. + Allow. App connects to enterprise cloud resources, using an IP address or a hostname.
                      • App can access both personal and enterprise cloud resources.
                      • @@ -131,7 +130,7 @@ This table includes info about how enlightened apps might behave, based on your - Exempt. App connects to enterprise cloud resources, using an IP address or a hostname. + Exempt. App connects to enterprise cloud resources, using an IP address or a hostname.
                        • App can access both personal and enterprise cloud resources.
                        • diff --git a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md index 78edc9a59e..c84d5cbc1a 100644 --- a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md +++ b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md @@ -6,7 +6,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 2bcfcf6622..629994e90f 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md index 6c672171ac..a124fbdd24 100644 --- a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md index a5baa19809..ac44e2f1bd 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md @@ -1,5 +1,5 @@ --- -title: Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager (Windows 10) +title: Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Manager (Windows 10) description: Use Configuration Manager to make & deploy a Windows Information Protection (WIP) policy. Choose protected apps, WIP-protection level, and find enterprise data. ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529 ms.reviewer: @@ -9,7 +9,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -190,27 +190,27 @@ For this example, we're going to add Internet Explorer, a desktop app, to the ** All files signed by any publisher. (Not recommended.) - Publisher selected + Publisher selected All files signed by the named publisher.

                          This might be useful if your company is the publisher and signer of internal line-of-business apps. - Publisher and Product Name selected + Publisher and Product Name selected All files for the specified product, signed by the named publisher. - Publisher, Product Name, and Binary name selected + Publisher, Product Name, and Binary name selected Any version of the named file or package for the specified product, signed by the named publisher. - Publisher, Product Name, Binary name, and File Version, and above, selected + Publisher, Product Name, Binary name, and File Version, and above, selected Specified version or newer releases of the named file or package for the specified product, signed by the named publisher.

                          This option is recommended for enlightened apps that weren't previously enlightened. - Publisher, Product Name, Binary name, and File Version, And below selected + Publisher, Product Name, Binary name, and File Version, And below selected Specified version or older releases of the named file or package for the specified product, signed by the named publisher. - Publisher, Product Name, Binary name, and File Version, Exactly selected + Publisher, Product Name, Binary name, and File Version, Exactly selected Specified version of the named file or package for the specified product, signed by the named publisher. @@ -403,8 +403,8 @@ There are no default locations included with WIP, you must add each of your netw Enterprise Cloud Resources - With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
                          contoso.visualstudio.com,contoso.internalproxy2.com

                          Without proxy: contoso.sharepoint.com|contoso.visualstudio.com - Specify the cloud resources to be treated as corporate and protected by WIP.

                          For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

                          If you have multiple resources, you must separate them using the "|" delimiter. If you don't use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

                          Important
                          In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can't tell whether it's attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/. + With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
                          contoso.visualstudio.com,contoso.internalproxy2.com

                          Without proxy: contoso.sharepoint.com|contoso.visualstudio.com + Specify the cloud resources to be treated as corporate and protected by WIP.

                          For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

                          If you have multiple resources, you must separate them using the "|" delimiter. If you don't use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

                          Important
                          In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can't tell whether it's attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/. Enterprise Network Domain Names (Required) @@ -422,12 +422,12 @@ There are no default locations included with WIP, you must add each of your netw Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.

                          This list shouldn't include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.

                          If you have multiple resources, you must separate them using the ";" delimiter.
                          Enterprise IPv4 Range (Required) - Starting IPv4 Address: 3.4.0.1
                          Ending IPv4 Address: 3.4.255.254
                          Custom URI: 3.4.0.1-3.4.255.254,
                          10.0.0.1-10.255.255.254 + Starting IPv4 Address: 3.4.0.1
                          Ending IPv4 Address: 3.4.255.254
                          Custom URI: 3.4.0.1-3.4.255.254,
                          10.0.0.1-10.255.255.254 Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                          If you have multiple ranges, you must separate them using the "," delimiter. Enterprise IPv6 Range - Starting IPv6 Address: 2a01:110::
                          Ending IPv6 Address: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
                          Custom URI: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
                          fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + Starting IPv6 Address: 2a01:110::
                          Ending IPv6 Address: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
                          Custom URI: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
                          fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                          If you have multiple ranges, you must separate them using the "," delimiter. diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index b3f555bb13..19f213f47f 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -1,11 +1,11 @@ --- title: Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune (Windows 10) -description: Learn how to use the Azure portal for Microsoft Intune to create and deploy your Windows Information Protection (WIP) policy to protect data on your network. +description: Learn how to use the Azure portal for Microsoft Intune to create and deploy your Windows Information Protection (WIP) policy to protect data on your network. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -129,7 +129,8 @@ If you don't know the Store app publisher or product name, you can find them by If you need to add Windows 10 mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. ->**Note**
                          Your PC and phone must be on the same wireless network. +> [!NOTE] +> Your PC and phone must be on the same wireless network. 1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. @@ -194,19 +195,19 @@ To add another Desktop app, click the ellipsis **…**. After you’ve entered t If you’re unsure about what to include for the publisher, you can run this PowerShell command: -```ps1 +```powershell Get-AppLockerFileInformation -Path "" ``` Where `""` goes to the location of the app on the device. For example: -```ps1 +```powershell Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe" ``` In this example, you'd get the following info: -``` +```console Path Publisher ---- --------- %PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US @@ -214,6 +215,8 @@ Path Publisher Where `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the **Publisher** name and `WORDPAD.EXE` is the **File** name. +Regarding to how to get the Product Name for the Apps you wish to Add, please reach out to our Windows Support Team to request the guidelines + ### Import a list of apps This section covers two examples of using an AppLocker XML file to the **Protected apps** list. You’ll use this option if you want to add multiple apps at the same time. @@ -277,22 +280,22 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com This is the XML file that AppLocker creates for Microsoft Dynamics 365. ```xml - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + ``` 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. @@ -333,6 +336,7 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. + **To import a list of protected apps using Microsoft Intune** 1. In **Protected apps**, click **Import apps**. @@ -426,7 +430,7 @@ Separate multiple resources with the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: -```code +```console URL <,proxy>|URL <,proxy> ``` @@ -439,32 +443,32 @@ In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the `/*AppCompat*/` string to the setting. For example: -```code -URL <,proxy>|URL <,proxy>/*AppCompat*/ +```console +URL <,proxy>|URL <,proxy>|/*AppCompat*/ ``` When you use this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access), using the **Domain joined or marked as compliant** option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. Value format with proxy: -```code +```console contoso.sharepoint.com,contoso.internalproxy1.com|contoso.visualstudio.com,contoso.internalproxy2.com ``` Value format without proxy: -```code -contoso.sharepoint.com|contoso.visualstudio.com +```console +contoso.sharepoint.com,|contoso.visualstudio.com,|contoso.onedrive.com, ``` ### Protected domains Specify the domains used for identities in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. -Separate multiple domains with the "," delimiter. +Separate multiple domains with the "|" delimiter. -```code -exchange.contoso.com,contoso.com,region.contoso.com +```console +exchange.contoso.com|contoso.com|region.contoso.com ``` ### Network domains @@ -473,7 +477,7 @@ Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. Separate multiple resources with the "," delimiter. -```code +```console corp.contoso.com,region.contoso.com ``` @@ -486,7 +490,7 @@ This list shouldn’t include any servers listed in your Internal proxy servers Internal proxy servers must be used only for WIP-protected (enterprise) traffic. Separate multiple resources with the ";" delimiter. -```code +```console proxy.contoso.com:80;proxy2.contoso.com:443 ``` @@ -498,7 +502,7 @@ This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. Separate multiple resources with the ";" delimiter. -```code +```console contoso.internalproxy1.com;contoso.internalproxy2.com ``` @@ -537,7 +541,7 @@ Specify your authentication redirection endpoints for your company. These locations are considered enterprise or personal, based on the context of the connection before the redirection. Separate multiple resources with the "," delimiter. -```code +```console sts.contoso.com,sts.contoso2.com ``` @@ -589,14 +593,14 @@ After you've decided where your protected apps can access enterprise data on you **Use Azure RMS for WIP.** Determines whether WIP uses [Microsoft Azure Rights Management](https://products.office.com/business/microsoft-azure-rights-management) to apply EFS encryption to files that are copied from Windows 10 to USB or other removable drives so they can be securely shared amongst employees. In other words, WIP uses Azure Rights Management "machinery" to apply EFS encryption to files when they are copied to removable drives. You must already have Azure Rights Management set up. The EFS file encryption key is protected by the RMS template’s license. Only users with permission to that template will be able to read it from the removable drive. WIP can also integrate with Azure RMS by using the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings in the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp). -- **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn’t actually apply Azure Information Protection to the files. Curly braces {} are required around the RMS Template ID, but they are removed after you save the policy. +- **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn’t actually apply Azure Information Protection to the files. If you don’t specify an [RMS template](https://docs.microsoft.com/information-protection/deploy-use/configure-custom-templates), it’s a regular EFS file using a default RMS template that all users can access. - **Off, or not configured.** Stops WIP from encrypting Azure Rights Management files that are copied to a removable drive. ->[!NOTE] ->Regardless of this setting, all files in OneDrive for Business will be encrypted, including moved Known Folders. + > [!NOTE] + > Regardless of this setting, all files in OneDrive for Business will be encrypted, including moved Known Folders. **Allow Windows Search Indexer to search encrypted files.** Determines whether to allow the Windows Search Indexer to index items that are encrypted, such as WIP protected files. @@ -618,7 +622,7 @@ You can restrict which files are protected by WIP when they are downloaded from - [What is Azure Rights Management?](https://docs.microsoft.com/information-protection/understand-explore/what-is-azure-rms) -- [Create and deploy Windows Information Protection (WIP) app protection policy with Intune and MAM](https://docs.microsoft.com/intune/deploy-use/create-windows-information-protection-policy-with-intune) +- [Create a Windows Information Protection (WIP) protection policy using Microsoft Intune](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy) - [Intune MAM Without Enrollment](https://blogs.technet.microsoft.com/configmgrdogs/2016/02/04/intune-mam-without-enrollment/) diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md index 42caa212cd..524199cf73 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 48c612f49d..557fa276cb 100644 --- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -9,7 +9,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -71,16 +71,20 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Microsoft Messaging -- Microsoft Remote Desktop +- Microsoft Remote Desktop + +- Microsoft To Do > [!NOTE] -> Microsoft Visio, Microsoft Office Access and Microsoft Project are not enlightended apps and need to be exempted from WIP policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioining. +> Microsoft Visio, Microsoft Office Access, Microsoft Project, and Microsoft Publisher are not enlightened apps and need to be exempted from WIP policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioning. ## List of WIP-work only apps from Microsoft Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with WIP and MAM solutions. - Skype for Business +- Microsoft Teams (build 1.3.00.12058 and later) + ## Adding enlightened Microsoft apps to the allowed apps list > [!NOTE] @@ -106,11 +110,12 @@ You can add any or all of the enlightened Microsoft apps to your allowed apps li | Microsoft Messaging | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Product Name:** Microsoft.Messaging
                          **App Type:** Universal app | | IE11 | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Binary Name:** iexplore.exe
                          **App Type:** Desktop app | | OneDrive Sync Client | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Binary Name:** onedrive.exe
                          **App Type:** Desktop app | -| OneDrive app | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Product Name:** Microsoft.Microsoftskydrive
                          Product Version:Product version: 17.21.0.0 (and later)
                          **App Type:** Universal app | +| OneDrive app | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Product Name:** Microsoft.Microsoftskydrive
                          Product Version:Product version: 17.21.0.0 (and later)
                          **App Type:** Universal app | | Notepad | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Binary Name:** notepad.exe
                          **App Type:** Desktop app | | Microsoft Paint | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Binary Name:** mspaint.exe
                          **App Type:** Desktop app | | Microsoft Remote Desktop | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Binary Name:** mstsc.exe
                          **App Type:** Desktop app | | Microsoft MAPI Repair Tool | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Binary Name:** fixmapi.exe
                          **App Type:** Desktop app | +| Microsoft To Do | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                          **Product Name:** Microsoft.Todos
                          **App Type:** Store app | >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md index 576fe7cf71..bbfa13516c 100644 --- a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md +++ b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md @@ -9,7 +9,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/images/wip-azure-add-user-groups.png b/windows/security/information-protection/windows-information-protection/images/wip-azure-add-user-groups.png index f453431070..34c89b37a9 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-azure-add-user-groups.png and b/windows/security/information-protection/windows-information-protection/images/wip-azure-add-user-groups.png differ diff --git a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md index 3fc752f3ca..c1cd7193c0 100644 --- a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -33,18 +33,18 @@ This table provides info about the most common problems you might encounter whil Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration. - If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.

                          If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. + If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.

                          If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

                          We strongly recommend educating employees about how to limit or eliminate the need for this decryption. Direct Access is incompatible with WIP. Direct Access might experience problems with how WIP enforces app behavior and data movement because of how WIP determines what is and isn’t a corporate network resource. - We recommend that you use VPN for client access to your intranet resources.

                          Note
                          VPN is optional and isn’t required by WIP. + We recommend that you use VPN for client access to your intranet resources.

                          Note
                          VPN is optional and isn’t required by WIP. - NetworkIsolation Group Policy setting takes precedence over MDM Policy settings. - The NetworkIsolation Group Policy setting can configure network settings that can also be configured by using MDM. WIP relies on these policies being correctly configured. - If you use both Group Policy and MDM to configure your NetworkIsolation settings, you must make sure that those same settings are deployed to your organization using both Group Policy and MDM. + NetworkIsolation Group Policy setting takes precedence over MDM Policy settings. + The NetworkIsolation Group Policy setting can configure network settings that can also be configured by using MDM. WIP relies on these policies being correctly configured. + If you use both Group Policy and MDM to configure your NetworkIsolation settings, you must make sure that those same settings are deployed to your organization using both Group Policy and MDM. Cortana can potentially allow data leakage if it’s on the allowed apps list. @@ -63,7 +63,7 @@ This table provides info about the most common problems you might encounter whil

                          • Start the installer directly from the file share.

                            -OR-

                          • Decrypt the locally copied files needed by the installer.

                            -OR-

                          • -
                          • Mark the file share with the installation media as “personal”. To do this, you’ll need to set the Enterprise IP ranges as Authoritative and then exclude the IP address of the file server, or you’ll need to put the file server on the Enterprise Proxy Server list.
                          • +
                          • Mark the file share with the installation media as “personal”. To do this, you’ll need to set the Enterprise IP ranges as Authoritative and then exclude the IP address of the file server, or you’ll need to put the file server on the Enterprise Proxy Server list.
                          @@ -74,17 +74,17 @@ This table provides info about the most common problems you might encounter whil Redirected folders with Client Side Caching are not compatible with WIP. Apps might encounter access errors while attempting to read a cached, offline file. - Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.

                          Note
                          For more info about Work Folders and Offline Files, see the blog, Work Folders and Offline Files support for Windows Information Protection. If you're having trouble opening files offline while using Offline Files and WIP, see the support article, Can't open files offline when you use Offline Files and Windows Information Protection. + Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.

                          Note
                          For more info about Work Folders and Offline Files, see the blog, Work Folders and Offline Files support for Windows Information Protection. If you're having trouble opening files offline while using Offline Files and WIP, see the support article, Can't open files offline when you use Offline Files and Windows Information Protection. An unmanaged device can use Remote Desktop Protocol (RDP) to connect to a WIP-managed device. -

                          Data copied from the WIP-managed device is marked as Work.

                          Data copied to the WIP-managed device is not marked as Work.

                          Local Work data copied to the WIP-managed device remains Work data.

                          Work data that is copied between two apps in the same session remains data. +

                          Data copied from the WIP-managed device is marked as Work.

                          Data copied to the WIP-managed device is not marked as Work.

                          Local Work data copied to the WIP-managed device remains Work data.

                          Work data that is copied between two apps in the same session remains data. Disable RDP to prevent access because there is no way to restrict access to only devices managed by WIP. RDP is disabled by default. You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer. - A message appears stating that the content is marked as Work and the user isn't given an option to override to Personal. - Open File Explorer and change the file ownership to Personal before you upload. + A message appears stating that the content is marked as Work and the user isn't given an option to override to Personal. + Open File Explorer and change the file ownership to Personal before you upload. ActiveX controls should be used with caution. @@ -97,7 +97,7 @@ This table provides info about the most common problems you might encounter whil Format drive for NTFS, or use a different drive. - WIP isn’t turned on if any of the following folders have the MakeFolderAvailableOfflineDisabled option set to False: + WIP isn’t turned on if any of the following folders have the MakeFolderAvailableOfflineDisabled option set to False:

                          • AppDataRoaming
                          • Desktop
                          • @@ -115,7 +115,7 @@ This table provides info about the most common problems you might encounter whil
                          WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using Microsoft Endpoint Configuration Manager. - Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders. You can configure this parameter, as described here.

                          If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see Can't open files offline when you use Offline Files and Windows Information Protection. + Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders. You can configure this parameter, as described here.

                          If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see Can't open files offline when you use Offline Files and Windows Information Protection. @@ -131,9 +131,19 @@ This table provides info about the most common problems you might encounter whil If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it. + + + OneNote notebooks on OneDrive for Business must be properly configured to work with WIP. + OneNote might encounter errors syncing a OneDrive for Business notebook and suggest changing the file ownership to Personal. Attempting to view the notebook in OneNote Online in the browser will show an error and unable to view it. + "OneNote notebooks that are newly copied into the OneDrive for Business folder from File Explorer should get fixed automatically. To do this, follow these steps: +1. Close the notebook in OneNote. +2. Move the notebook folder via File Explorer out of the OneDrive for Business folder to another location, such as the Desktop. +3. Copy the notebook folder and Paste it back into the OneDrive for Business folder. + +Wait a few minutes to allow OneDrive to finish syncing & upgrading the notebook, and the folder should automatically convert to an Internet Shortcut. Opening the shortcut will open the notebook in the browser, which can then be opened in the OneNote client by using the “Open in app” button. - Microsoft Office Outlook offline data files (PST and OST files) are not marked as Work files, and are therefore not protected. + Microsoft Office Outlook offline data files (PST and OST files) are not marked as Work files, and are therefore not protected. If Microsoft Office Outlook is set to work in cached mode (default setting), or if some emails are stored in a local PST file, the data is unprotected. @@ -145,8 +155,8 @@ This table provides info about the most common problems you might encounter whil > [!NOTE] > When corporate data is written to disk, WIP uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. One caveat to keep in mind is that the Preview Pane in File Explorer will not work for encrypted files. -> [!NOTE] -> Chromium-based versions of Microsoft Edge (versions since 79) don't fully support WIP yet. The functionality could be partially enabled by going to the local page **edge://flags/#edge-dataprotection** and setting the **Windows Information Protection** flag to **enabled**. + + > [!NOTE] > Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md index 27d3f1d9c9..bf2e926154 100644 --- a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -28,7 +28,7 @@ This list provides all of the tasks and settings that are required for the opera |Task|Description| |----|-----------| |Add at least one app to the **Protected apps** list in your WIP policy.|You must have at least one app added to your **Protected apps** list. For more info about where this area is and how to add apps, see the **Add apps to your Protected apps list** section of the policy creation topics.| -|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the **Manage the WIP protection mode for your enterprise data** section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| +|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the [Manage the WIP protection mode for your enterprise data](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr#manage-the-wip-protection-level-for-your-enterprise-data) section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| |Specify your corporate identity.|This field is automatically filled out for you by Microsoft Intune. However, you must manually correct it if it’s incorrect or if you need to add additional domains. For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics. |Specify your network domain names.|Starting with Windows 10, version 1703, this field is optional.

                          Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics.| |Specify your enterprise IPv4 or IPv6 ranges.|Starting with Windows 10, version 1703, this field is optional.

                          Specify the addresses for a valid IPv4 or IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics.| diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md index a1e662c65e..419f25c61c 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md @@ -1,6 +1,6 @@ --- -title: Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager (Windows 10) -description: Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +title: Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Manager (Windows 10) +description: Microsoft Endpoint Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.reviewer: ms.prod: w10 @@ -8,7 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -23,11 +23,11 @@ ms.date: 02/26/2019 - Windows 10, version 1607 and later - Windows 10 Mobile, version 1607 and later -Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +Microsoft Endpoint Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. ## In this section |Topic |Description | |------|------------| -|[Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md) |Microsoft Endpoint Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md) |Microsoft Endpoint Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | |[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | |[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md index e40c2405a1..42f746faba 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md @@ -1,6 +1,6 @@ --- title: Create a Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10) -description: Microsoft Intune and Microsoft Endpoint Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy. +description: Microsoft Intune and Microsoft Endpoint Manager helps you create and deploy your enterprise data protection (WIP) policy. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.reviewer: ms.prod: w10 @@ -8,7 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md index 0de8771fac..336a37f408 100644 --- a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -9,7 +9,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -59,7 +59,7 @@ To help address this security insufficiency, companies developed data loss preve - **The ability to specify what happens when data matches a rule, including whether employees can bypass enforcement.** For example, in Microsoft SharePoint and SharePoint Online, the Microsoft data loss prevention system lets you warn your employees that shared data includes sensitive info, and to share it anyway (with an optional audit log entry). -Unfortunately, data loss prevention systems have their own problems. For example, the more detailed the rule set, the more false positives are created, leading employees to believe that the rules slow down their work and need to be bypassed in order to remain productive, potentially leading to data being incorrectly blocked or improperly released. Another major problem is that data loss prevention systems must be widely implemented to be effective. For example, if your company uses a data loss prevention system for email, but not for file shares or document storage, you might find that your data leaks through the unprotected channels. But perhaps the biggest problem with data loss prevention systems is that it provides a jarring experience that interrupts the employees’ natural workflow by stopping some operations (such as sending a message with an attachment that the system tags as sensitive) while allowing others, often according to subtle rules that the employee doesn’t see and can’t understand. +Unfortunately, data loss prevention systems have their own problems. For example, the less detailed the rule set, the more false positives are created, leading employees to believe that the rules slow down their work and need to be bypassed in order to remain productive, potentially leading to data being incorrectly blocked or improperly released. Another major problem is that data loss prevention systems must be widely implemented to be effective. For example, if your company uses a data loss prevention system for email, but not for file shares or document storage, you might find that your data leaks through the unprotected channels. But perhaps the biggest problem with data loss prevention systems is that it provides a jarring experience that interrupts the employees’ natural workflow by stopping some operations (such as sending a message with an attachment that the system tags as sensitive) while allowing others, often according to subtle rules that the employee doesn’t see and can’t understand. ### Using information rights management systems To help address the potential data loss prevention system problems, companies developed information rights management (also known as IRM) systems. Information rights management systems embed protection directly into documents, so that when an employee creates a document, he or she determines what kind of protection to apply. For example, an employee can choose to stop the document from being forwarded, printed, shared outside of the organization, and so on. @@ -90,7 +90,7 @@ WIP is the mobile application management (MAM) mechanism on Windows 10. WIP give - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using a WIP-protected device, WIP encrypts the data on the device. - - **Using protected apps.** Managed apps (apps that you've included on the **Protected apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. + - **Using protected apps.** Managed apps (apps that you've included on the **Protected apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but makes a mistake and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - **Managed apps and restrictions.** With WIP you can control which apps can access and use your enterprise data. After adding an app to your protected apps list, the app is trusted with enterprise data. All apps not on this list are stopped from accessing your enterprise data, depending on your WIP management-mode. @@ -110,7 +110,7 @@ WIP is the mobile application management (MAM) mechanism on Windows 10. WIP give - **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable. >[!NOTE] - >For management of Surface devices it is recommended that you use the Current Branch of Microsoft Endpoint Configuration Manager.
                          Microsoft Endpoint Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. + >For management of Surface devices it is recommended that you use the Current Branch of Microsoft Endpoint Configuration Manager.
                          Microsoft Endpoint Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. ## How WIP works WIP helps address your everyday challenges in the enterprise. Including: diff --git a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md index fee621245c..d2ff6e2a2f 100644 --- a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md index 961744bbf6..2eefdaf76e 100644 --- a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md @@ -9,7 +9,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro @@ -39,30 +39,30 @@ You can try any of the processes included in these scenarios, but you should foc Encrypt and decrypt files using File Explorer. - For desktop:

                          + For desktop:

                            -
                          1. Open File Explorer, right-click a work document, and then click Work from the File Ownership menu.
                            Make sure the file is encrypted by right-clicking the file again, clicking Advanced from the General tab, and then clicking Details from the Compress or Encrypt attributes area. The file should show up under the heading, This enterprise domain can remove or revoke access: <your_enterprise_identity>. For example, contoso.com.
                          2. -
                          3. In File Explorer, right-click the same document, and then click Personal from the File Ownership menu.
                            Make sure the file is decrypted by right-clicking the file again, clicking Advanced from the General tab, and then verifying that the Details button is unavailable.
                          4. +
                          5. Open File Explorer, right-click a work document, and then click Work from the File Ownership menu.
                            Make sure the file is encrypted by right-clicking the file again, clicking Advanced from the General tab, and then clicking Details from the Compress or Encrypt attributes area. The file should show up under the heading, This enterprise domain can remove or revoke access: <your_enterprise_identity>. For example, contoso.com.
                          6. +
                          7. In File Explorer, right-click the same document, and then click Personal from the File Ownership menu.
                            Make sure the file is decrypted by right-clicking the file again, clicking Advanced from the General tab, and then verifying that the Details button is unavailable.
                          - For mobile:

                          + For mobile:

                            -
                          1. Open the File Explorer app, browse to a file location, click the elipsis (...), and then click Select to mark at least one file as work-related.
                          2. -
                          3. Click the elipsis (...) again, click File ownership from the drop down menu, and then click Work.
                            Make sure the file is encrypted, by locating the Briefcase icon next to the file name.
                          4. -
                          5. Select the same file, click File ownership from the drop down menu, and then click Personal.
                            Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                          6. +
                          7. Open the File Explorer app, browse to a file location, click the elipsis (...), and then click Select to mark at least one file as work-related.
                          8. +
                          9. Click the elipsis (...) again, click File ownership from the drop down menu, and then click Work.
                            Make sure the file is encrypted, by locating the Briefcase icon next to the file name.
                          10. +
                          11. Select the same file, click File ownership from the drop down menu, and then click Personal.
                            Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                          Create work documents in enterprise-allowed apps. - For desktop:

                          + For desktop:

                          - For mobile:

                          + For mobile:

                            -
                          1. Start an allowed mobile app, such as Word Mobile, create a new document, and then save your changes as Work to a local, work-related location.
                            Make sure the document is encrypted, by locating the Briefcase icon next to the file name.
                          2. +
                          3. Start an allowed mobile app, such as Word Mobile, create a new document, and then save your changes as Work to a local, work-related location.
                            Make sure the document is encrypted, by locating the Briefcase icon next to the file name.
                          4. Open the same document and attempt to save it to a non-work-related location.
                            WIP should stop you from saving the file to this location.
                          5. -
                          6. Open the same document one last time, make a change to the contents, and then save it again using the Personal option.
                            Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                          7. +
                          8. Open the same document one last time, make a change to the contents, and then save it again using the Personal option.
                            Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.

                          @@ -70,7 +70,7 @@ You can try any of the processes included in these scenarios, but you should foc
                          1. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.
                            The app shouldn't be able to access the file.
                          2. -
                          3. Try double-clicking or tapping on the work-encrypted file.
                            If your default app association is an app not on your allowed apps list, you should get an Access Denied error message.
                          4. +
                          5. Try double-clicking or tapping on the work-encrypted file.
                            If your default app association is an app not on your allowed apps list, you should get an Access Denied error message.
                          @@ -78,9 +78,9 @@ You can try any of the processes included in these scenarios, but you should foc Copy and paste from enterprise apps to non-enterprise apps.
                            -
                          1. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
                            You should see a WIP-related warning box, asking you to click either Change to personal or Keep at work.
                          2. -
                          3. Click Keep at work.
                            The content isn't pasted into the non-enterprise app.
                          4. -
                          5. Repeat Step 1, but this time click Change to personal, and try to paste the content again.
                            The content is pasted into the non-enterprise app.
                          6. +
                          7. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
                            You should see a WIP-related warning box, asking you to click either Change to personal or Keep at work.
                          8. +
                          9. Click Keep at work.
                            The content isn't pasted into the non-enterprise app.
                          10. +
                          11. Repeat Step 1, but this time click Change to personal, and try to paste the content again.
                            The content is pasted into the non-enterprise app.
                          12. Try copying and pasting content between apps on your allowed apps list.
                            The content should copy and paste between apps without any warning messages.
                          @@ -89,9 +89,9 @@ You can try any of the processes included in these scenarios, but you should foc Drag and drop from enterprise apps to non-enterprise apps.
                            -
                          1. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
                            You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                          2. -
                          3. Click Keep at work.
                            The content isn't dropped into the non-enterprise app.
                          4. -
                          5. Repeat Step 1, but this time click Change to personal, and try to drop the content again.
                            The content is dropped into the non-enterprise app.
                          6. +
                          7. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
                            You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                          8. +
                          9. Click Keep at work.
                            The content isn't dropped into the non-enterprise app.
                          10. +
                          11. Repeat Step 1, but this time click Change to personal, and try to drop the content again.
                            The content is dropped into the non-enterprise app.
                          12. Try dragging and dropping content between apps on your allowed apps list.
                            The content should move between the apps without any warning messages.
                          @@ -100,9 +100,9 @@ You can try any of the processes included in these scenarios, but you should foc Share between enterprise apps and non-enterprise apps.
                            -
                          1. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
                            You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                          2. -
                          3. Click Keep at work.
                            The content isn't shared into Facebook.
                          4. -
                          5. Repeat Step 1, but this time click Change to personal, and try to share the content again.
                            The content is shared into Facebook.
                          6. +
                          7. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
                            You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                          8. +
                          9. Click Keep at work.
                            The content isn't shared into Facebook.
                          10. +
                          11. Repeat Step 1, but this time click Change to personal, and try to share the content again.
                            The content is shared into Facebook.
                          12. Try sharing content between apps on your allowed apps list.
                            The content should share between the apps without any warning messages.
                          @@ -112,8 +112,8 @@ You can try any of the processes included in these scenarios, but you should foc
                          1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
                            Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
                          2. -
                          3. Open File Explorer and make sure your modified files are appearing with a Lock icon.
                          4. -
                          5. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

                            Note
                            Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data.

                            A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
                          6. +
                          7. Open File Explorer and make sure your modified files are appearing with a Lock icon.
                          8. +
                          9. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

                            Note
                            Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data.

                            A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
                          @@ -130,7 +130,7 @@ You can try any of the processes included in these scenarios, but you should foc Verify your shared files can use WIP.
                            -
                          1. Download a file from a protected file share, making sure the file is encrypted by locating the Briefcase icon next to the file name.
                          2. +
                          3. Download a file from a protected file share, making sure the file is encrypted by locating the Briefcase icon next to the file name.
                          4. Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings.
                          5. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.
                            The app shouldn't be able to access the file share.
                          @@ -142,7 +142,7 @@ You can try any of the processes included in these scenarios, but you should foc
                          1. Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list.
                          2. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.
                            Both browsers should respect the enterprise and personal boundary.
                          3. -
                          4. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
                            IE11 shouldn't be able to access the sites.

                            Note
                            Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as Work.
                          5. +
                          6. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
                            IE11 shouldn't be able to access the sites.

                            Note
                            Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as Work.
                          @@ -150,7 +150,7 @@ You can try any of the processes included in these scenarios, but you should foc Verify your Virtual Private Network (VPN) can be auto-triggered.
                            -
                          1. Set up your VPN network to start based on the WIPModeID setting.
                            For specific info about how to do this, see the Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune topic.
                          2. +
                          3. Set up your VPN network to start based on the WIPModeID setting.
                            For specific info about how to do this, see the Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune topic.
                          4. Start an app from your allowed apps list.
                            The VPN network should automatically start.
                          5. Disconnect from your network and then start an app that isn't on your allowed apps list.
                            The VPN shouldn't start and the app shouldn't be able to access your enterprise network.
                          @@ -160,7 +160,7 @@ You can try any of the processes included in these scenarios, but you should foc Unenroll client devices from WIP.
                            -
                          • Unenroll a device from WIP by going to Settings, click Accounts, click Work, click the name of the device you want to unenroll, and then click Remove.
                            The device should be removed and all of the enterprise content for that managed account should be gone.

                            Important
                            On desktop devices, the data isn't removed and can be recovered, so you must make sure the content is marked as Revoked and that access is denied for the employee. On mobile devices, the data is removed.
                          • +
                          • Unenroll a device from WIP by going to Settings, click Accounts, click Work, click the name of the device you want to unenroll, and then click Remove.
                            The device should be removed and all of the enterprise content for that managed account should be gone.

                            Important
                            On desktop devices, the data isn't removed and can be recovered, so you must make sure the content is marked as Revoked and that access is denied for the employee. On mobile devices, the data is removed.
                          diff --git a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md index 94df767962..c7caa873dc 100644 --- a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md index 5a8333cab2..b54cc7cbe1 100644 --- a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md +++ b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index e999dcb51f..958d86d6b1 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -1,62 +1,100 @@ # [Threat protection](index.md) ## [Overview]() -### [What is Microsoft Defender Advanced Threat Protection?](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) +### [What is Microsoft Defender for Endpoint?](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) ### [Minimum requirements](microsoft-defender-atp/minimum-requirements.md) -### [What's new in Microsoft Defender ATP](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) +### [What's new in Microsoft Defender for Endpoint](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) ### [Preview features](microsoft-defender-atp/preview.md) ### [Data storage and privacy](microsoft-defender-atp/data-storage-privacy.md) ### [Overview of Microsoft Defender Security Center](microsoft-defender-atp/use.md) ### [Portal overview](microsoft-defender-atp/portal-overview.md) -### [Microsoft Defender ATP for US Government Community Cloud High customers](microsoft-defender-atp/commercial-gov.md) +### [Microsoft Defender for Endpoint for US Government customers](microsoft-defender-atp/gov.md) +### [Microsoft Defender for Endpoint for non-Windows platforms](microsoft-defender-atp/non-windows.md) ## [Evaluate capabilities](microsoft-defender-atp/evaluation-lab.md) ## [Plan deployment](microsoft-defender-atp/deployment-strategy.md) - ## [Deployment guide]() ### [Deployment phases](microsoft-defender-atp/deployment-phases.md) ### [Phase 1: Prepare](microsoft-defender-atp/prepare-deployment.md) ### [Phase 2: Set up](microsoft-defender-atp/production-deployment.md) -### [Phase 3: Onboard](microsoft-defender-atp/onboarding.md) - - +### [Phase 3: Onboard]() +#### [Onboarding overview](microsoft-defender-atp/onboarding.md) +#### [Deployment rings](microsoft-defender-atp/deployment-rings.md) +#### [Onboarding using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/onboarding-endpoint-configuration-manager.md) +#### [Onboarding using Microsoft Endpoint Manager](microsoft-defender-atp/onboarding-endpoint-manager.md) +#### [Onboard supported devices](microsoft-defender-atp/onboard-configure.md) +## [Migration guides](microsoft-defender-atp/migration-guides.md) +### [Switch from McAfee to Microsoft Defender for Endpoint]() +#### [Overview of migration](microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md) +#### [Phase 1: Prepare](microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md) +#### [Phase 2: Setup](microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md) +#### [Phase 3: Onboard](microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md) +### [Switch from Symantec to Microsoft Defender for Endpoint]() +#### [Overview of migration](microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md) +#### [Phase 1: Prepare](microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md) +#### [Phase 2: Setup](microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md) +#### [Phase 3: Onboard](microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md) +### [Switch from your non-Microsoft endpoint security solution to Microsoft Defender for Endpoint]() +#### [Overview of migration](microsoft-defender-atp/switch-to-microsoft-defender-migration.md) +#### [Phase 1: Prepare](microsoft-defender-atp/switch-to-microsoft-defender-prepare.md) +#### [Phase 2: Setup](microsoft-defender-atp/switch-to-microsoft-defender-setup.md) +#### [Phase 3: Onboard](microsoft-defender-atp/switch-to-microsoft-defender-onboard.md) +### [Manage Microsoft Defender for Endpoint after migration]() +#### [Overview of managing Microsoft Defender for Endpoint](microsoft-defender-atp/manage-atp-post-migration.md) +#### [Intune (recommended)](microsoft-defender-atp/manage-atp-post-migration-intune.md) +#### [Configuration Manager](microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md) +#### [Group Policy Objects](microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md) +#### [PowerShell, WMI, and MPCmdRun.exe](microsoft-defender-atp/manage-atp-post-migration-other-tools.md) ## [Security administration]() -### [Threat & Vulnerability Management]() -#### [Overview of Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) -#### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) -#### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md) -#### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) -#### [Configuration score](microsoft-defender-atp/configuration-score.md) -#### [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md) -#### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md) -#### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) -#### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) -#### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) +### [Threat & vulnerability management]() +#### [Overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) +#### [Get started]() +##### [Permissions & prerequisites](microsoft-defender-atp/tvm-prerequisites.md) +##### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) +##### [Assign device value](microsoft-defender-atp/tvm-assign-device-value.md) +#### [Assess your security posture]() +##### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md) +##### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) +##### [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md) +#### [Improve your security posture & reduce risk]() +##### [Address security recommendations](microsoft-defender-atp/tvm-security-recommendation.md) +##### [Remediate vulnerabilities](microsoft-defender-atp/tvm-remediation.md) +##### [Exceptions for security recommendations](microsoft-defender-atp/tvm-exception.md) +##### [Plan for end-of-support software](microsoft-defender-atp/tvm-end-of-support-software.md) +##### [Mitigate zero-day vulnerabilities](microsoft-defender-atp/tvm-zero-day-vulnerabilities.md) +#### [Understand vulnerabilities on your devices]() +##### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) +##### [Vulnerabilities in my organization](microsoft-defender-atp/tvm-weaknesses.md) +##### [Event timeline](microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md) +##### [Vulnerable devices report](microsoft-defender-atp/tvm-vulnerable-devices-report.md) +##### [Hunt for exposed devices](microsoft-defender-atp/tvm-hunt-exposed-devices.md) + ### [Attack surface reduction]() #### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) -#### [Attack surface reduction evaluation](microsoft-defender-atp/evaluate-attack-surface-reduction.md) +#### [Evaluate attack surface reduction rules](microsoft-defender-atp/evaluate-attack-surface-reduction.md) #### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) #### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md) - #### [Attack surface reduction controls]() ##### [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md) ##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) ##### [Customize attack surface reduction rules](microsoft-defender-atp/customize-attack-surface-reduction.md) +##### [View attack surface reduction events](microsoft-defender-atp/event-views.md) #### [Hardware-based isolation]() ##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) -##### [Hardware-based isolation evaluation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) +##### [Hardware-based isolation evaluation](microsoft-defender-application-guard/test-scenarios-md-app-guard.md) ##### [Application isolation]() -###### [Application guard overview](windows-defender-application-guard/wd-app-guard-overview.md) -###### [System requirements](windows-defender-application-guard/reqs-wd-app-guard.md) -###### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +###### [Application guard overview](microsoft-defender-application-guard/md-app-guard-overview.md) +###### [System requirements](microsoft-defender-application-guard/reqs-md-app-guard.md) +###### [Install Microsoft Defender Application Guard](microsoft-defender-application-guard/install-md-app-guard.md) +###### [Install Microsoft Defender Application Guard Extension](microsoft-defender-application-guard/md-app-guard-browser-extension.md) ##### [Application control](windows-defender-application-control/windows-defender-application-control.md) ###### [Audit Application control policies](windows-defender-application-control/audit-windows-defender-application-control-policies.md) @@ -65,24 +103,24 @@ ##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) - #### [Device control]() +##### [Code integrity](device-guard/enable-virtualization-based-protection-of-code-integrity.md) ##### [Control USB devices](device-control/control-usb-devices-using-intune.md) - -##### [Device Guard]() -###### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) - - +##### [Device control report](device-control/device-control-report.md) #### [Exploit protection]() ##### [Protect devices from exploits](microsoft-defender-atp/exploit-protection.md) ##### [Exploit protection evaluation](microsoft-defender-atp/evaluate-exploit-protection.md) - +##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) +##### [Customize exploit protection](microsoft-defender-atp/customize-exploit-protection.md) +##### [Import, export, and deploy exploit protection configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) +##### [Troubleshoot exploit protection mitigations](microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md) +##### [Exploit protection reference](microsoft-defender-atp/exploit-protection-reference.md ) #### [Network protection]() ##### [Protect your network](microsoft-defender-atp/network-protection.md) -##### [Network protection evaluation](microsoft-defender-atp/evaluate-network-protection.md) - +##### [Evaluate network protection](microsoft-defender-atp/evaluate-network-protection.md) +##### [Turn on network protection](microsoft-defender-atp/enable-network-protection.md) #### [Web protection]() ##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md) @@ -94,7 +132,9 @@ #### [Controlled folder access]() ##### [Protect folders](microsoft-defender-atp/controlled-folders.md) -##### [Controlled folder access evaluation](microsoft-defender-atp/evaluate-controlled-folder-access.md) +##### [Evaluate controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md) +##### [Enable controlled folder access](microsoft-defender-atp/enable-controlled-folders.md) +##### [Customize controlled folder access](microsoft-defender-atp/customize-controlled-folders.md) @@ -104,113 +144,107 @@ ### [Next-generation protection]() -#### [Next-generation protection overview](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) -#### [Evaluate next-generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) +#### [Next-generation protection overview](microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md) +#### [Evaluate next-generation protection](microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md) #### [Configure next-generation protection]() -##### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) +##### [Configure Microsoft Defender Antivirus features](microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md) -##### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -###### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) -###### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) -###### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) -###### [Prevent security settings changes with tamper protection](windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) -###### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) -###### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) +##### [Use Microsoft cloud-delivered protection](microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) +###### [Enable cloud-delivered protection](microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) +###### [Specify the cloud-delivered protection level](microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md) +###### [Configure and validate network connections](microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md) +###### [Prevent security settings changes with tamper protection](microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) +###### [Enable Block at first sight](microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md) +###### [Configure the cloud block timeout period](microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) ##### [Configure behavioral, heuristic, and real-time protection]() -###### [Configuration overview](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) -###### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -###### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) +###### [Configuration overview](microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md) +###### [Detect and block Potentially Unwanted Applications](microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) +###### [Enable and configure always-on protection and monitoring](microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) -##### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) +##### [Antivirus on Windows Server](microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md) ##### [Antivirus compatibility]() -###### [Compatibility charts](windows-defender-antivirus/windows-defender-antivirus-compatibility.md) -###### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) +###### [Compatibility charts](microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md) +###### [Use limited periodic antivirus scanning](microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md) + +##### [Manage next-generation protection in your business]() +###### [Management overview](microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md) +###### [Use Microsoft Intune and Microsoft Endpoint Manager to manage next-generation protection](microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md) +###### [Use Group Policy settings to manage next-generation protection](microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md) +###### [Use PowerShell cmdlets to manage next-generation protection](microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to manage next-generation protection](microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md) +###### [Use the mpcmdrun.exe command line tool to manage next-generation protection](microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md) ##### [Deploy, manage updates, and report on antivirus]() -###### [Preparing to deploy](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) -###### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md) -####### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) +###### [Preparing to deploy](microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md) +###### [Deploy and enable antivirus](microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md) +###### [Deployment guide for VDI environments](microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md) ###### [Report on antivirus protection]() -####### [Review protection status and alerts](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) -####### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md) - -###### [Manage updates and apply baselines]() -####### [Learn about the different kinds of updates](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) -####### [Manage protection and security intelligence updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) -####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) -####### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) -####### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) -####### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +###### [Review protection status and alerts](microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md) +###### [Troubleshoot antivirus reporting in Update Compliance](microsoft-defender-antivirus/troubleshoot-reporting.md) +###### [Learn about the recent updates](microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md) +###### [Manage protection and security intelligence updates](microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md) +###### [Manage when protection updates should be downloaded and applied](microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md) +###### [Manage updates for endpoints that are out of date](microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md) +###### [Manage event-based forced updates](microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md) +###### [Manage updates for mobile devices and VMs](microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) ##### [Customize, initiate, and review the results of scans and remediation]() -###### [Configuration overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) +###### [Configuration overview](microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -###### [Configure and validate exclusions in antivirus scans]() -####### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -####### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions in antivirus scans](microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +###### [Configure antivirus exclusions Windows Server](microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md) +###### [Common mistakes when defining exclusions](microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md) +###### [Configure scanning antivirus options](microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md) +###### [Configure remediation for scans](microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md) +###### [Configure scheduled scans](microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md) +###### [Configure and run scans](microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md) +###### [Review scan results](microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md) +###### [Run and review the results of an offline scan](microsoft-defender-antivirus/microsoft-defender-offline.md) -###### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) -###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) - -##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) - -##### [Manage antivirus in your business]() -###### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -###### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -###### [Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) +##### [Restore quarantined files](microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md) ##### [Manage scans and remediation]() -###### [Management overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) +###### [Management overview](microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md) ###### [Configure and validate exclusions in antivirus scans]() -####### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -####### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) +###### [Exclusions overview](microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +###### [Configure antivirus exclusions on Windows Server](microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md) -###### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) +###### [Configure scanning options](microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) -###### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) +##### [Configure remediation for scans](microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md) +###### [Configure remediation for scans](microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md) +###### [Configure scheduled scans](microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md) +###### [Configure and run scans](microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md) +###### [Review scan results](microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md) +###### [Run and review the results of an offline scan](microsoft-defender-antivirus/microsoft-defender-offline.md) +###### [Restore quarantined files](microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md) -##### [Manage next-generation protection in your business]() -###### [Handle false positives/negatives in Windows Defender Antivirus](windows-defender-antivirus/antivirus-false-positives-negatives.md) -###### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -###### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -###### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) +#### [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md) +#### [Better together: Microsoft Defender Antivirus and Office 365](microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md) -#### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md) -#### [Better together: Windows Defender Antivirus and Office 365](windows-defender-antivirus/office-365-windows-defender-antivirus.md) - - -### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) +### [Microsoft Defender for Endpoint for Mac]() +#### [Overview of Microsoft Defender for Endpoint for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) #### [What's New](microsoft-defender-atp/mac-whatsnew.md) #### [Deploy]() ##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) -##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) +##### [JAMF Pro-based deployment]() +###### [Deploying Microsoft Defender for Endpoint for macOS using Jamf Pro](microsoft-defender-atp/mac-install-with-jamf.md) +###### [Login to Jamf Pro](microsoft-defender-atp/mac-install-jamfpro-login.md) +###### [Set up device groups](microsoft-defender-atp/mac-jamfpro-device-groups.md) +###### [Set up policies](microsoft-defender-atp/mac-jamfpro-policies.md) +###### [Enroll devices](microsoft-defender-atp/mac-jamfpro-enroll-devices.md) + ##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) ##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) #### [Update](microsoft-defender-atp/mac-updates.md) @@ -219,6 +253,7 @@ ##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) ##### [Set preferences](microsoft-defender-atp/mac-preferences.md) ##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +##### [Schedule scans](microsoft-defender-atp/mac-schedule-scan-atp.md) #### [Troubleshoot]() ##### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md) @@ -230,7 +265,21 @@ #### [Resources](microsoft-defender-atp/mac-resources.md) -### [Microsoft Defender Advanced Threat Protection for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md) + + +### [Microsoft Defender for Endpoint for iOS]() +#### [Overview of Microsoft Defender for Endpoint for iOS](microsoft-defender-atp/microsoft-defender-atp-ios.md) + +#### [Deploy]() +##### [Deploy Microsoft Defender for Endpoint for iOS via Intune](microsoft-defender-atp/ios-install.md) + +#### [Configure]() +##### [Configure iOS features](microsoft-defender-atp/ios-configure-features.md) +#### [Privacy](microsoft-defender-atp/ios-privacy.md) + + +### [Microsoft Defender for Endpoint for Linux]() +#### [Overview of Microsoft Defender for Endpoint for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md) #### [What's New](microsoft-defender-atp/linux-whatsnew.md) #### [Deploy]() ##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md) @@ -244,21 +293,41 @@ ##### [Configure and validate exclusions](microsoft-defender-atp/linux-exclusions.md) ##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) ##### [Set preferences](microsoft-defender-atp/linux-preferences.md) +##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/linux-pua.md) +##### [Schedule scans with Microsoft Defender for Endpoint for Linux](microsoft-defender-atp/linux-schedule-scan-atp.md) +##### [Schedule an update of the Microsoft Defender for Endpoint (Linux)](microsoft-defender-atp/linux-update-MDE-Linux.md) #### [Troubleshoot]() ##### [Troubleshoot installation issues](microsoft-defender-atp/linux-support-install.md) ##### [Troubleshoot cloud connectivity issues](microsoft-defender-atp/linux-support-connectivity.md) ##### [Troubleshoot performance issues](microsoft-defender-atp/linux-support-perf.md) +##### [Troubleshoot missing events issues](microsoft-defender-atp/linux-support-events.md) +#### [Privacy](microsoft-defender-atp/linux-privacy.md) #### [Resources](microsoft-defender-atp/linux-resources.md) + +### [Microsoft Defender for Endpoint for Android]() +#### [Overview of Microsoft Defender for Endpoint for Android](microsoft-defender-atp/microsoft-defender-atp-android.md) + +#### [Deploy]() +##### [Deploy Microsoft Defender for Endpoint for Android with Microsoft Intune](microsoft-defender-atp/android-intune.md) + +#### [Configure]() +##### [Configure Microsoft Defender for Endpoint for Android features](microsoft-defender-atp/android-configure.md) + +#### [Privacy]() +##### [Microsoft Defender for Endpoint for Android - Privacy information](microsoft-defender-atp/android-privacy.md) + +#### [Troubleshoot]() +##### [Troubleshoot issues](microsoft-defender-atp/android-support-signin.md) + + ### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) ## [Security operations]() - - ### [Endpoint detection and response]() #### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md) #### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md) @@ -266,32 +335,36 @@ ##### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md) ##### [Manage incidents](microsoft-defender-atp/manage-incidents.md) ##### [Investigate incidents](microsoft-defender-atp/investigate-incidents.md) + #### [Alerts queue]() ##### [View and organize the Alerts queue](microsoft-defender-atp/alerts-queue.md) +##### [Review alerts](microsoft-defender-atp/review-alerts.md) ##### [Manage alerts](microsoft-defender-atp/manage-alerts.md) ##### [Investigate alerts](microsoft-defender-atp/investigate-alerts.md) ##### [Investigate files](microsoft-defender-atp/investigate-files.md) -##### [Investigate machines](microsoft-defender-atp/investigate-machines.md) +##### [Investigate devices](microsoft-defender-atp/investigate-machines.md) ##### [Investigate an IP address](microsoft-defender-atp/investigate-ip.md) ##### [Investigate a domain](microsoft-defender-atp/investigate-domain.md) ###### [Investigate connection events that occur behind forward proxies](microsoft-defender-atp/investigate-behind-proxy.md) ##### [Investigate a user account](microsoft-defender-atp/investigate-user.md) -#### [Machines list]() -##### [View and organize the Machines list](microsoft-defender-atp/machines-view-overview.md) -##### [Manage machine group and tags](microsoft-defender-atp/machine-tags.md) +#### [Devices list]() +##### [View and organize the Devices list](microsoft-defender-atp/machines-view-overview.md) +##### [Techniques in device timeline](microsoft-defender-atp/techniques-device-timeline.md) +##### [Device timeline event flags](microsoft-defender-atp/device-timeline-event-flag.md) +##### [Manage device group and tags](microsoft-defender-atp/machine-tags.md) #### [Take response actions]() -##### [Take response actions on a machine]() -###### [Response actions on machines](microsoft-defender-atp/respond-machine-alerts.md) +##### [Take response actions on a device]() +###### [Response actions on devices](microsoft-defender-atp/respond-machine-alerts.md) ###### [Manage tags](microsoft-defender-atp/respond-machine-alerts.md#manage-tags) -###### [Initiate an automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) -###### [Initiate Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) -###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines) -###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines) +###### [Start an automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) +###### [Start a Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) +###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-devices) +###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-microsoft-defender-antivirus-scan-on-devices) ###### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution) -###### [Isolate machines from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-machines-from-the-network) +###### [Isolate devices from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-devices-from-the-network) ###### [Consult a threat expert](microsoft-defender-atp/respond-machine-alerts.md#consult-a-threat-expert) ###### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center) @@ -300,54 +373,50 @@ ###### [Stop and quarantine files in your network](microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network) ###### [Restore file from quarantine](microsoft-defender-atp/respond-file-alerts.md#restore-file-from-quarantine) ###### [Add indicators to block or allow a file](microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) ###### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert) ###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) -###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) ###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) -###### [Submit files for analysis](microsoft-defender-atp/respond-file-alerts.md#submit-files-for-analysis) -###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) -###### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) -#### [View and approve remediation actions](microsoft-defender-atp/manage-auto-investigation.md) -##### [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md) +#### [Visit the Action center to see remediation actions](microsoft-defender-atp/auto-investigation-action-center.md) +##### [View and approve pending actions](microsoft-defender-atp/manage-auto-investigation.md) +##### [Details and results of an automated investigation](microsoft-defender-atp/autoir-investigation-results.md) #### [Investigate entities using Live response]() -##### [Investigate entities on machines](microsoft-defender-atp/live-response.md) +##### [Investigate entities on devices](microsoft-defender-atp/live-response.md) ##### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md) - - -##### [Shadow protection?](windows-defender-antivirus/shadow-protection.md) - #### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) #### [Reporting]() ##### [Power BI - How to use API - Samples](microsoft-defender-atp/api-power-bi.md) -##### [Create and build Power BI reports using Microsoft Defender ATP data connectors (deprecated)](microsoft-defender-atp/powerbi-reports.md) ##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md) -#### [Machine health and compliance reports](microsoft-defender-atp/machine-reports.md) +#### [Device health and compliance reports](microsoft-defender-atp/machine-reports.md) +### [Behavioral blocking and containment]() +#### [Behavioral blocking and containment](microsoft-defender-atp/behavioral-blocking-containment.md) +#### [Client behavioral blocking](microsoft-defender-atp/client-behavioral-blocking.md) +#### [Feedback-loop blocking](microsoft-defender-atp/feedback-loop-blocking.md) +#### [EDR in block mode](microsoft-defender-atp/edr-in-block-mode.md) -#### [Custom detections]() -##### [Understand custom detections](microsoft-defender-atp/overview-custom-detections.md) -##### [Create and manage detection rules](microsoft-defender-atp/custom-detection-rules.md) - - - - - - -### [Automated investigation and response]() +### [Automated investigation and response (AIR)]() #### [Overview of AIR](microsoft-defender-atp/automated-investigations.md) +#### [Automation levels in AIR](microsoft-defender-atp/automation-levels.md) +#### [Configure AIR capabilities](microsoft-defender-atp/configure-automated-investigations-remediation.md) ### [Advanced hunting]() #### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md) -#### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) +#### [Learn, train, & get examples]() +##### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) +##### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md) #### [Work with query results](microsoft-defender-atp/advanced-hunting-query-results.md) -#### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md) -#### [Advanced hunting schema reference]() +#### [Optimize & handle errors]() +##### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) +##### [Handle errors](microsoft-defender-atp/advanced-hunting-errors.md) +##### [Service limits](microsoft-defender-atp/advanced-hunting-limits.md) +#### [Data schema]() ##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md) ##### [DeviceAlertEvents](microsoft-defender-atp/advanced-hunting-devicealertevents-table.md) ##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md) @@ -356,47 +425,43 @@ ##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md) ##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md) ##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md) -##### [DeviceFileCertificateInfoBeta](microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md) +##### [DeviceFileCertificateInfo](microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md) ##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md) ##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md) ##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md) -##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md) -##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md) -##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md) -##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md) -#### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) +##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md) +##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md) +##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md) +##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md) +#### [Custom detections]() +##### [Custom detections overview](microsoft-defender-atp/overview-custom-detections.md) +##### [Create detection rules](microsoft-defender-atp/custom-detection-rules.md) +##### [View & manage detection rules](microsoft-defender-atp/custom-detections-manage.md) ### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md) -### [Threat analytics](microsoft-defender-atp/threat-analytics.md) - - - - - - - - - +### [Threat analytics overview](microsoft-defender-atp/threat-analytics.md) +#### [Read the analyst report](microsoft-defender-atp/threat-analytics-analyst-reports.md) ## [How-to]() ### [Onboard devices to the service]() -#### [Onboard machines to Microsoft Defender ATP](microsoft-defender-atp/onboard-configure.md) +#### [Onboard devices to Microsoft Defender for Endpoint](microsoft-defender-atp/onboard-configure.md) #### [Onboard previous versions of Windows](microsoft-defender-atp/onboard-downlevel.md) -#### [Onboard Windows 10 machines]() +#### [Onboard Windows 10 devices]() ##### [Onboarding tools and methods](microsoft-defender-atp/configure-endpoints.md) -##### [Onboard machines using Group Policy](microsoft-defender-atp/configure-endpoints-gp.md) -##### [Onboard machines using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md) -##### [Onboard machines using Mobile Device Management tools](microsoft-defender-atp/configure-endpoints-mdm.md) -##### [Onboard machines using a local script](microsoft-defender-atp/configure-endpoints-script.md) -##### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](microsoft-defender-atp/configure-endpoints-vdi.md) +##### [Onboard devices using Group Policy](microsoft-defender-atp/configure-endpoints-gp.md) +##### [Onboard devices using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md) +##### [Onboard devices using Mobile Device Management tools](microsoft-defender-atp/configure-endpoints-mdm.md) +##### [Onboard devices using a local script](microsoft-defender-atp/configure-endpoints-script.md) +##### [Onboard non-persistent virtual desktop infrastructure (VDI) devices](microsoft-defender-atp/configure-endpoints-vdi.md) +##### [Onboard Windows 10 multi-session devices in Windows Virtual Desktop](microsoft-defender-atp/Onboard-Windows-10-multi-session-device.md) -#### [Onboard servers](microsoft-defender-atp/configure-server-endpoints.md) -#### [Onboard non-Windows machines](microsoft-defender-atp/configure-endpoints-non-windows.md) -#### [Onboard machines without Internet access](microsoft-defender-atp/onboard-offline-machines.md) -#### [Run a detection test on a newly onboarded machine](microsoft-defender-atp/run-detection-test.md) -#### [Run simulated attacks on machines](microsoft-defender-atp/attack-simulations.md) +#### [Onboard Windows servers](microsoft-defender-atp/configure-server-endpoints.md) +#### [Onboard non-Windows devices](microsoft-defender-atp/configure-endpoints-non-windows.md) +#### [Onboard devices without Internet access](microsoft-defender-atp/onboard-offline-machines.md) +#### [Run a detection test on a newly onboarded device](microsoft-defender-atp/run-detection-test.md) +#### [Run simulated attacks on devices](microsoft-defender-atp/attack-simulations.md) #### [Configure proxy and Internet connectivity settings](microsoft-defender-atp/configure-proxy-internet.md) #### [Create an onboarding or offboarding notification rule](microsoft-defender-atp/onboarding-notification.md) @@ -404,40 +469,41 @@ ##### [Troubleshoot issues during onboarding](microsoft-defender-atp/troubleshoot-onboarding.md) ##### [Troubleshoot subscription and portal access issues](microsoft-defender-atp/troubleshoot-onboarding-error-messages.md) -### [Manage machine configuration]() -#### [Ensure your machines are configured properly](microsoft-defender-atp/configure-machines.md) -#### [Monitor and increase machine onboarding](microsoft-defender-atp/configure-machines-onboarding.md) +### [Manage device configuration]() +#### [Ensure your devices are configured properly](microsoft-defender-atp/configure-machines.md) +#### [Monitor and increase device onboarding](microsoft-defender-atp/configure-machines-onboarding.md) #### [Increase compliance to the security baseline](microsoft-defender-atp/configure-machines-security-baseline.md) -#### [Optimize ASR rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md) +#### [Optimize attack surface reduction rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md) ### [Configure portal settings]() #### [Set up preferences](microsoft-defender-atp/preferences-setup.md) #### [General]() ##### [Verify data storage location and update data retention settings](microsoft-defender-atp/data-retention-settings.md) ##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md) -##### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md) -##### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md) +##### [Configure vulnerability notifications](microsoft-defender-atp/configure-vulnerability-email-notifications.md) ##### [Configure advanced features](microsoft-defender-atp/advanced-features.md) #### [Permissions]() ##### [Use basic permissions to access the portal](microsoft-defender-atp/basic-permissions.md) ##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md) ###### [Create and manage roles](microsoft-defender-atp/user-roles.md) -###### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md) -####### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md) +###### [Create and manage device groups](microsoft-defender-atp/machine-groups.md) +###### [Create and manage device tags](microsoft-defender-atp/machine-tags.md) -#### [APIs]() -##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md) #### [Rules]() ##### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md) -##### [Manage indicators](microsoft-defender-atp/manage-indicators.md) +##### [Create indicators](microsoft-defender-atp/manage-indicators.md) +###### [Create indicators for files](microsoft-defender-atp/indicator-file.md) +###### [Create indicators for IPs and URLs/domains](microsoft-defender-atp/indicator-ip-domain.md) +###### [Create indicators for certificates](microsoft-defender-atp/indicator-certificates.md) +###### [Manage indicators](microsoft-defender-atp/indicator-manage.md) ##### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md) ##### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md) -#### [Machine management]() -##### [Onboarding machines](microsoft-defender-atp/onboard-configure.md) -##### [Offboarding machines](microsoft-defender-atp/offboard-machines.md) +#### [Device management]() +##### [Onboarding devices](microsoft-defender-atp/onboard-configure.md) +##### [Offboarding devices](microsoft-defender-atp/offboard-machines.md) #### [Configure Microsoft Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md) @@ -445,23 +511,25 @@ #### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md) #### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md) +### [Address false positives/negatives in Microsoft Defender for Endpoint](microsoft-defender-atp/defender-endpoint-false-positives-negatives.md) +### [Use audit mode](microsoft-defender-atp/audit-windows-defender.md) ## Reference ### [Management and APIs]() #### [Overview of management and APIs](microsoft-defender-atp/management-apis.md) - -#### [Microsoft Defender ATP API]() +#### [Microsoft Defender for Endpoint API]() ##### [Get started]() -###### [Microsoft Defender ATP API license and terms](microsoft-defender-atp/api-terms-of-use.md) -###### [Access the Microsoft Defender ATP APIs](microsoft-defender-atp/apis-intro.md) +###### [Microsoft Defender for Endpoint API license and terms](microsoft-defender-atp/api-terms-of-use.md) +###### [Access the Microsoft Defender for Endpoint APIs](microsoft-defender-atp/apis-intro.md) ###### [Hello World](microsoft-defender-atp/api-hello-world.md) ###### [Get access with application context](microsoft-defender-atp/exposed-apis-create-app-webapp.md) ###### [Get access with user context](microsoft-defender-atp/exposed-apis-create-app-nativeapp.md) ###### [Get partner application access](microsoft-defender-atp/exposed-apis-create-app-partners.md) -##### [Microsoft Defender ATP APIs Schema]() -###### [Supported Microsoft Defender ATP APIs](microsoft-defender-atp/exposed-apis-list.md) +##### [Microsoft Defender for Endpoint APIs Schema]() +###### [Supported Microsoft Defender for Endpoint APIs](microsoft-defender-atp/exposed-apis-list.md) +###### [Release Notes](microsoft-defender-atp/api-release-notes.md) ###### [Common REST API error codes](microsoft-defender-atp/common-errors.md) ###### [Advanced Hunting](microsoft-defender-atp/run-advanced-query-api.md) @@ -469,12 +537,13 @@ ####### [Alert methods and properties](microsoft-defender-atp/alerts.md) ####### [List alerts](microsoft-defender-atp/get-alerts.md) ####### [Create alert](microsoft-defender-atp/create-alert-by-reference.md) -####### [Update Alert](microsoft-defender-atp/update-alert.md) +####### [Update alert](microsoft-defender-atp/update-alert.md) +####### [Batch update alert](microsoft-defender-atp/batch-update-alerts.md) ####### [Get alert information by ID](microsoft-defender-atp/get-alert-info-by-id.md) ####### [Get alert related domains information](microsoft-defender-atp/get-alert-related-domain-info.md) ####### [Get alert related file information](microsoft-defender-atp/get-alert-related-files-info.md) ####### [Get alert related IPs information](microsoft-defender-atp/get-alert-related-ip-info.md) -####### [Get alert related machine information](microsoft-defender-atp/get-alert-related-machine-info.md) +####### [Get alert related device information](microsoft-defender-atp/get-alert-related-machine-info.md) ####### [Get alert related user information](microsoft-defender-atp/get-alert-related-user-info.md) ###### [Machine]() @@ -488,7 +557,9 @@ ####### [Get security recommendations](microsoft-defender-atp/get-security-recommendations.md) ####### [Add or Remove machine tags](microsoft-defender-atp/add-or-remove-machine-tags.md) ####### [Find machines by IP](microsoft-defender-atp/find-machines-by-ip.md) +####### [Find machines by tag](microsoft-defender-atp/find-machines-by-tag.md) ####### [Get missing KBs](microsoft-defender-atp/get-missing-kbs-machine.md) +####### [Set device value](microsoft-defender-atp/set-device-value.md) ###### [Machine Action]() ####### [Machine Action methods and properties](microsoft-defender-atp/machineaction.md) @@ -513,6 +584,7 @@ ###### [Indicators]() ####### [Indicators methods and properties](microsoft-defender-atp/ti-indicator.md) ####### [Submit Indicator](microsoft-defender-atp/post-ti-indicator.md) +####### [Import Indicators](microsoft-defender-atp/import-ti-indicators.md) ####### [List Indicators](microsoft-defender-atp/get-ti-indicators-collection.md) ####### [Delete Indicator](microsoft-defender-atp/delete-ti-indicator-by-id.md) @@ -541,7 +613,7 @@ ####### [Score methods and properties](microsoft-defender-atp/score.md) ####### [List exposure score by machine group](microsoft-defender-atp/get-machine-group-exposure-score.md) ####### [Get exposure score](microsoft-defender-atp/get-exposure-score.md) -####### [Get machine secure score](microsoft-defender-atp/get-device-secure-score.md) +####### [Get device secure score](microsoft-defender-atp/get-device-secure-score.md) ###### [Software]() ####### [Software methods and properties](microsoft-defender-atp/software.md) @@ -555,6 +627,7 @@ ###### [Vulnerability]() ####### [Vulnerability methods and properties](microsoft-defender-atp/vulnerability.md) ####### [List vulnerabilities](microsoft-defender-atp/get-all-vulnerabilities.md) +####### [List vulnerabilities by machine and software](microsoft-defender-atp/get-all-vulnerabilities-by-machines.md) ####### [Get vulnerability by Id](microsoft-defender-atp/get-vulnerability-by-id.md) ####### [List machines by vulnerability](microsoft-defender-atp/get-machines-by-vulnerability.md) @@ -573,7 +646,6 @@ ###### [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md) ###### [Using OData Queries](microsoft-defender-atp/exposed-apis-odata-samples.md) - #### [Raw data streaming API]() ##### [Raw data streaming](microsoft-defender-atp/raw-data-export.md) ##### [Stream advanced hunting events to Azure Events hub](microsoft-defender-atp/raw-data-export-event-hub.md) @@ -583,12 +655,11 @@ ##### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md) ##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md) ##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md) -##### [Configure Splunk to pull detections](microsoft-defender-atp/configure-splunk.md) ##### [Configure Micro Focus ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md) -##### [Microsoft Defender ATP detection fields](microsoft-defender-atp/api-portal-mapping.md) +##### [Microsoft Defender for Endpoint detection fields](microsoft-defender-atp/api-portal-mapping.md) ##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md) +##### [Fetch alerts from customer tenant](microsoft-defender-atp/fetch-alerts-mssp.md) ##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md) - #### [Partners & APIs]() ##### [Partner applications](microsoft-defender-atp/partner-applications.md) @@ -598,20 +669,26 @@ #### [Role-based access control]() ##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md) ##### [Create and manage roles](microsoft-defender-atp/user-roles.md) -##### [Create and manage machine groups]() -###### [Using machine groups](microsoft-defender-atp/machine-groups.md) -###### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md) +##### [Create and manage device groups]() +###### [Using device groups](microsoft-defender-atp/machine-groups.md) +###### [Create and manage device tags](microsoft-defender-atp/machine-tags.md) -#### [Configure managed security service provider (MSSP) integration](microsoft-defender-atp/configure-mssp-support.md) +#### [Managed security service provider (MSSP) integration]() +##### [Configure managed security service provider integration](microsoft-defender-atp/configure-mssp-support.md) +##### [Supported managed security service providers](microsoft-defender-atp/mssp-list.md) +##### [Grant MSSP access to the portal](microsoft-defender-atp/grant-mssp-access.md) +##### [Access the MSSP customer portal](microsoft-defender-atp/access-mssp-portal.md) +##### [Configure alert notifications](microsoft-defender-atp/configure-mssp-notifications.md) +##### [Get partner application access](microsoft-defender-atp/exposed-apis-create-app-partners.md) ### [Partner integration scenarios]() #### [Technical partner opportunities](microsoft-defender-atp/partner-integration.md) #### [Managed security service provider opportunity](microsoft-defender-atp/mssp-support.md) -#### [Become a Microsoft Defender ATP partner](microsoft-defender-atp/get-started-partner-integration.md) +#### [Become a Microsoft Defender for Endpoint partner](microsoft-defender-atp/get-started-partner-integration.md) ### [Integrations]() -#### [Microsoft Defender ATP integrations](microsoft-defender-atp/threat-protection-integration.md) +#### [Microsoft Defender for Endpoint integrations](microsoft-defender-atp/threat-protection-integration.md) #### [Protect users, data, and devices with conditional access](microsoft-defender-atp/conditional-access.md) #### [Microsoft Cloud App Security integration overview](microsoft-defender-atp/microsoft-cloud-app-security-integration.md) @@ -619,32 +696,36 @@ ### [Information protection in Windows overview]() #### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md) -### [Access the Microsoft Defender ATP Community Center](microsoft-defender-atp/community.md) +### [Access the Microsoft Defender for Endpoint Community Center](microsoft-defender-atp/community.md) ### [Helpful resources](microsoft-defender-atp/helpful-resources.md) -### [Troubleshoot Microsoft Defender ATP]() +### [Troubleshoot Microsoft Defender for Endpoint]() #### [Troubleshoot sensor state]() ##### [Check sensor state](microsoft-defender-atp/check-sensor-status.md) ##### [Fix unhealthy sensors](microsoft-defender-atp/fix-unhealthy-sensors.md) -##### [Inactive machines](microsoft-defender-atp/fix-unhealthy-sensors.md#inactive-machines) -##### [Misconfigured machines](microsoft-defender-atp/fix-unhealthy-sensors.md#misconfigured-machines) +##### [Inactive devices](microsoft-defender-atp/fix-unhealthy-sensors.md#inactive-devices) +##### [Misconfigured devices](microsoft-defender-atp/fix-unhealthy-sensors.md#misconfigured-devices) ##### [Review sensor events and errors on machines with Event Viewer](microsoft-defender-atp/event-error-codes.md) -#### [Troubleshoot Microsoft Defender ATP service issues]() +#### [Troubleshoot Microsoft Defender for Endpoint service issues]() ##### [Troubleshoot service issues](microsoft-defender-atp/troubleshoot-mdatp.md) ##### [Check service health](microsoft-defender-atp/service-status.md) +##### [Contact Microsoft Defender for Endpoint support](microsoft-defender-atp/contact-support.md) + #### [Troubleshoot live response issues](microsoft-defender-atp/troubleshoot-live-response.md) + +#### [Collect support logs using LiveAnalyzer ](microsoft-defender-atp/troubleshoot-collect-support-log.md) #### [Troubleshoot attack surface reduction issues]() ##### [Network protection](microsoft-defender-atp/troubleshoot-np.md) ##### [Attack surface reduction rules](microsoft-defender-atp/troubleshoot-asr.md) -#### [Troubleshoot next-generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) - +#### [Troubleshoot next-generation protection](microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md) +#### [Troubleshoot migration issues](microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md) @@ -670,12 +751,11 @@ ### [How Microsoft identifies malware and PUA](intelligence/criteria.md) ### [Submit files for analysis](intelligence/submission-guide.md) ### [Safety Scanner download](intelligence/safety-scanner-download.md) -### [Industry antivirus tests](intelligence/top-scoring-industry-antivirus-tests.md) ### [Industry collaboration programs](intelligence/cybersecurity-industry-partners.md) #### [Virus information alliance](intelligence/virus-information-alliance-criteria.md) #### [Microsoft virus initiative](intelligence/virus-initiative-criteria.md) #### [Coordinated malware eradication](intelligence/coordinated-malware-eradication.md) -### [Information for developers](intelligence/developer-info.md) +### [Information for developers]() #### [Software developer FAQ](intelligence/developer-faq.md) #### [Software developer resources](intelligence/developer-resources.md) @@ -702,7 +782,7 @@ ### [Microsoft Defender SmartScreen](microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) #### [Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md) -#### [Set up and use Microsft Defender SmartScreen on individual devices](microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md) +#### [Set up and use Microsoft Defender SmartScreen on individual devices](microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md) ### [Windows Sandbox](windows-sandbox/windows-sandbox-overview.md) @@ -804,7 +884,7 @@ ####### [Event 4765 S: SID History was added to an account.](auditing/event-4765.md) ####### [Event 4766 F: An attempt to add SID History to an account failed.](auditing/event-4766.md) ####### [Event 4767 S: A user account was unlocked.](auditing/event-4767.md) -####### [Event 4780 S: The ACL was set on accounts which are members of administrators groups.](auditing/event-4780.md) +####### [Event 4780 S: The ACL was set on accounts that are members of administrators groups.](auditing/event-4780.md) ####### [Event 4781 S: The name of an account was changed.](auditing/event-4781.md) ####### [Event 4794 S, F: An attempt was made to set the Directory Services Restore Mode administrator password.](auditing/event-4794.md) ####### [Event 4798 S: A user's local group membership was enumerated.](auditing/event-4798.md) @@ -830,6 +910,8 @@ ####### [Event 4689 S: A process has exited.](auditing/event-4689.md) ###### [Audit RPC Events](auditing/audit-rpc-events.md) ####### [Event 5712 S: A Remote Procedure Call, RPC, was attempted.](auditing/event-5712.md) +###### [Audit Token Right Adjusted](auditing/audit-token-right-adjusted.md) +####### [Event 4703 S: A user right was adjusted.](auditing/event-4703.md) ###### [Audit Detailed Directory Service Replication](auditing/audit-detailed-directory-service-replication.md) ####### [Event 4928 S, F: An Active Directory replica source naming context was established.](auditing/event-4928.md) ####### [Event 4929 S, F: An Active Directory replica source naming context was removed.](auditing/event-4929.md) @@ -1195,7 +1277,7 @@ ###### [System cryptography: Force strong key protection for user keys stored on the computer](security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md) ###### [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md) ###### [System objects: Require case insensitivity for non-Windows subsystems](security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md) -###### [System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) +###### [System objects: Strengthen default permissions of internal system objects (Symbolic Links)](security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md) ###### [System settings: Optional subsystems](security-policy-settings/system-settings-optional-subsystems.md) ###### [System settings: Use certificate rules on Windows executables for Software Restriction Policies](security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md) ###### [User Account Control: Admin Approval Mode for the Built-in Administrator account](security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md) @@ -1260,8 +1342,9 @@ #### [Windows security baselines](windows-security-configuration-framework/windows-security-baselines.md) ##### [Security Compliance Toolkit](windows-security-configuration-framework/security-compliance-toolkit-10.md) ##### [Get support](windows-security-configuration-framework/get-support-for-security-baselines.md) -### [MBSA removal and alternatives](mbsa-removal-and-guidance.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ## [Change history for Threat protection](change-history-for-threat-protection.md) + + diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index e36022563e..6df69c3b35 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -4,7 +4,7 @@ description: This reference for IT professionals provides information about the ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 ms.reviewer: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Advanced security audit policy settings @@ -42,7 +43,7 @@ Configuring policy settings in this category can help you document attempts to a - [Audit Credential Validation](audit-credential-validation.md) - [Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md) - [Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md) -- [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md) +- [Audit Other Account Logon Events](audit-other-account-logon-events.md) ## Account Management @@ -64,7 +65,6 @@ Detailed Tracking security policy settings and audit events can be used to monit - [Audit Process Creation](audit-process-creation.md) - [Audit Process Termination](audit-process-termination.md) - [Audit RPC Events](audit-rpc-events.md) -- [Audit Credential Validation](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation) - [Audit Token Right Adjusted](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-token-right-adjusted) ## DS Access @@ -151,8 +151,8 @@ Auditors will be able to prove that every resource in the system is protected by Resource SACLs are also useful for diagnostic scenarios. For example, setting the Global Object Access Auditing policy to log all the activity for a specific user and enabling the policy to track "Access denied" events for the file system or registry can help administrators quickly identify which object in a system is denying a user access. -> **Note:**  If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object -Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy. +> [!NOTE] +> If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy. This category includes the following subcategories: - [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md) diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md index 99b8a989c4..86a39fc1b7 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md @@ -4,7 +4,7 @@ description: This topic for the IT professional lists questions and answers abou ms.assetid: 80f8f187-0916-43c2-a7e8-ea712b115a06 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Advanced security auditing FAQ diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md index 7c55d51d21..4a3608816f 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md @@ -4,7 +4,7 @@ description: Advanced security audit policy settings may appear to overlap with ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Advanced security audit policies diff --git a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md index d212b266b1..c892db7b11 100644 --- a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md +++ b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md @@ -1,8 +1,8 @@ --- title: Appendix A, Security monitoring recommendations for many audit events (Windows 10) -description: Appendix A, Security monitoring recommendations for many audit events +description: Learn about recommendations for the type of monitoring required for certain classes of security audit events. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # Appendix A: Security monitoring recommendations for many audit events @@ -27,7 +28,7 @@ This document, the [Advanced security audit policy settings](advanced-security-a | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor relevant events for the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor relevant events for the **“Subject\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | Monitor the relevant events for **“Subject\\Security ID”** accounts that are outside the whitelist of accounts. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | Monitor the relevant events for **“Subject\\Security ID”** accounts that are outside the allow list of accounts. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | Identify events that correspond to the actions you want to monitor, and for those events, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index a18783d92c..2d63b25eb8 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -4,7 +4,7 @@ description: Apply audit policies to individual files and folders on your comput ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 07/25/2018 +ms.technology: mde --- # Apply a basic audit policy on a file or folder diff --git a/windows/security/threat-protection/auditing/audit-account-lockout.md b/windows/security/threat-protection/auditing/audit-account-lockout.md index 1ea3e878e6..77f8126a98 100644 --- a/windows/security/threat-protection/auditing/audit-account-lockout.md +++ b/windows/security/threat-protection/auditing/audit-account-lockout.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 07/16/2018 +ms.technology: mde --- # Audit Account Lockout diff --git a/windows/security/threat-protection/auditing/audit-application-generated.md b/windows/security/threat-protection/auditing/audit-application-generated.md index b594ba40ca..9215959064 100644 --- a/windows/security/threat-protection/auditing/audit-application-generated.md +++ b/windows/security/threat-protection/auditing/audit-application-generated.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Application Generated diff --git a/windows/security/threat-protection/auditing/audit-application-group-management.md b/windows/security/threat-protection/auditing/audit-application-group-management.md index 8dce282dfa..a06d67b8d9 100644 --- a/windows/security/threat-protection/auditing/audit-application-group-management.md +++ b/windows/security/threat-protection/auditing/audit-application-group-management.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Application Group Management diff --git a/windows/security/threat-protection/auditing/audit-audit-policy-change.md b/windows/security/threat-protection/auditing/audit-audit-policy-change.md index 376cab2bcf..81422c0d3f 100644 --- a/windows/security/threat-protection/auditing/audit-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-audit-policy-change.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Audit Policy Change diff --git a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md index 4a6f754c01..8bf74ed78f 100644 --- a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Authentication Policy Change diff --git a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md index b13bec6cbc..c00445582a 100644 --- a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Authorization Policy Change diff --git a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md index f655b5d8c6..e607b7c276 100644 --- a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md +++ b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Central Access Policy Staging diff --git a/windows/security/threat-protection/auditing/audit-certification-services.md b/windows/security/threat-protection/auditing/audit-certification-services.md index a1e50c1538..24af233cc3 100644 --- a/windows/security/threat-protection/auditing/audit-certification-services.md +++ b/windows/security/threat-protection/auditing/audit-certification-services.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Certification Services diff --git a/windows/security/threat-protection/auditing/audit-computer-account-management.md b/windows/security/threat-protection/auditing/audit-computer-account-management.md index ab838fd042..677244f857 100644 --- a/windows/security/threat-protection/auditing/audit-computer-account-management.md +++ b/windows/security/threat-protection/auditing/audit-computer-account-management.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Computer Account Management diff --git a/windows/security/threat-protection/auditing/audit-credential-validation.md b/windows/security/threat-protection/auditing/audit-credential-validation.md index 9ce3b5aa5b..4fdf9060db 100644 --- a/windows/security/threat-protection/auditing/audit-credential-validation.md +++ b/windows/security/threat-protection/auditing/audit-credential-validation.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Credential Validation diff --git a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md index 859859fc2b..a6f472d018 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Detailed Directory Service Replication diff --git a/windows/security/threat-protection/auditing/audit-detailed-file-share.md b/windows/security/threat-protection/auditing/audit-detailed-file-share.md index 69a9d636c7..4428aad464 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-file-share.md +++ b/windows/security/threat-protection/auditing/audit-detailed-file-share.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Detailed File Share @@ -37,9 +38,9 @@ There are no system access control lists (SACLs) for shared folders. If this pol | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | No | Yes | No | Yes | Audit Success for this subcategory on domain controllers typically will lead to very high volume of events, especially for SYSVOL share.
                          We recommend monitoring Failure access attempts: the volume should not be very high. You will be able to see who was not able to get access to a file or folder on a network share on a computer. | -| Member Server | IF | Yes | IF | Yes | IF – If a server has shared network folders which typically get many access requests (File Server, for example), the volume of events might be very high. If you really need to track all successful access events for every file or folder located on a shared folder, enable Success auditing or use the [Audit File System](audit-file-system.md) subcategory, although that subcategory excludes some information in Audit Detailed File Share, for example, the client’s IP address.
                          The volume of Failure events for member servers should not be very high (if they are not File Servers). With Failure auditing, you will be able to see who was not able to get access to a file or folder on a network share on this computer. | -| Workstation | IF | Yes | IF | Yes | IF – If a workstation has shared network folders which typically get many access requests, the volume of events might be very high. If you really need to track all successful access events for every file or folder located on a shared folder, enable Success auditing or use Audit File System subcategory, although that subcategory excludes some information in Audit Detailed File Share, for example, the client’s IP address.
                          The volume of Failure events for workstations should not be very high. With Failure auditing, you will be able to see who was not able to get access to a file or folder on a network share on this computer. | +| Domain Controller | No | Yes | No | Yes | Audit Success for this subcategory on domain controllers typically will lead to high volume of events, especially for SYSVOL share.
                          We recommend monitoring Failure access attempts: the volume should not be high. You will be able to see who was not able to get access to a file or folder on a network share on a computer. | +| Member Server | IF | Yes | IF | Yes | IF – If a server has shared network folders that typically get many access requests (File Server, for example), the volume of events might be high. If you really need to track all successful access events for every file or folder located on a shared folder, enable Success auditing or use the [Audit File System](audit-file-system.md) subcategory, although that subcategory excludes some information in Audit Detailed File Share, for example, the client’s IP address.
                          The volume of Failure events for member servers should not be high (if they are not File Servers). With Failure auditing, you can see who can't access a file or folder on a network share on this computer. | +| Workstation | IF | Yes | IF | Yes | IF – If a workstation has shared network folders that typically get many access requests, the volume of events might be high. If you really need to track all successful access events for every file or folder located on a shared folder, enable Success auditing or use Audit File System subcategory, although that subcategory excludes some information in Audit Detailed File Share, for example, the client’s IP address.
                          The volume of Failure events for workstations should not be high. With Failure auditing, you can see who can't access a file or folder on a network share on this computer. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-directory-service-access.md b/windows/security/threat-protection/auditing/audit-directory-service-access.md index 0a13f90a87..db603d8330 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-access.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Directory Service Access diff --git a/windows/security/threat-protection/auditing/audit-directory-service-changes.md b/windows/security/threat-protection/auditing/audit-directory-service-changes.md index 1a962ee86f..f81b20e2a5 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-changes.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-changes.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Directory Service Changes diff --git a/windows/security/threat-protection/auditing/audit-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-directory-service-replication.md index dffea817d4..df8ddc7f12 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-replication.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Directory Service Replication diff --git a/windows/security/threat-protection/auditing/audit-distribution-group-management.md b/windows/security/threat-protection/auditing/audit-distribution-group-management.md index 2bacdbe3a1..352eea4cfe 100644 --- a/windows/security/threat-protection/auditing/audit-distribution-group-management.md +++ b/windows/security/threat-protection/auditing/audit-distribution-group-management.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Distribution Group Management diff --git a/windows/security/threat-protection/auditing/audit-dpapi-activity.md b/windows/security/threat-protection/auditing/audit-dpapi-activity.md index fc94d79d95..7c346e1e52 100644 --- a/windows/security/threat-protection/auditing/audit-dpapi-activity.md +++ b/windows/security/threat-protection/auditing/audit-dpapi-activity.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit DPAPI Activity diff --git a/windows/security/threat-protection/auditing/audit-file-share.md b/windows/security/threat-protection/auditing/audit-file-share.md index ccab879b4f..88b51b6a3f 100644 --- a/windows/security/threat-protection/auditing/audit-file-share.md +++ b/windows/security/threat-protection/auditing/audit-file-share.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit File Share diff --git a/windows/security/threat-protection/auditing/audit-file-system.md b/windows/security/threat-protection/auditing/audit-file-system.md index 57ea7bc917..7da7e7d670 100644 --- a/windows/security/threat-protection/auditing/audit-file-system.md +++ b/windows/security/threat-protection/auditing/audit-file-system.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit File System diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md index 52475e4276..e45f321af3 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Filtering Platform Connection diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md index bdaff33b06..fabd2a6b86 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Filtering Platform Packet Drop diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md index 204a9b6320..72b892151f 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Filtering Platform Policy Change diff --git a/windows/security/threat-protection/auditing/audit-group-membership.md b/windows/security/threat-protection/auditing/audit-group-membership.md index e9047b6c8a..37a86a6424 100644 --- a/windows/security/threat-protection/auditing/audit-group-membership.md +++ b/windows/security/threat-protection/auditing/audit-group-membership.md @@ -1,17 +1,18 @@ --- title: Audit Group Membership (Windows 10) -description: The advanced security audit policy setting, Audit Group Membership, enables you to audit group memberships when they are enumerated on the client PC. +description: Using the advanced security audit policy setting, Audit Group Membership, you can audit group memberships when they're enumerated on the client PC. ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9 ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Group Membership @@ -20,8 +21,7 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - -Audit Group Membership enables you to audit group memberships when they are enumerated on the client computer. +By using Audit Group Membership, you can audit group memberships when they're enumerated on the client computer. This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. @@ -33,15 +33,15 @@ Multiple events are generated if the group membership information cannot fit in **Event volume**: -- Low on a client computer. +- Low on a client computer. -- Medium on a domain controller or network servers. +- Medium on a domain controller or network servers. | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | Group membership information for logged in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group or other high value groups).
                          For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | Yes | No | Yes | No | Group membership information for logged in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group or other high value groups).
                          For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | Yes | No | Yes | No | Group membership information for logged in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group or other high value groups).
                          For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | Yes | No | Yes | No | Group membership information for a logged-in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group, or other high value groups).
                          For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                          This subcategory doesn’t have Failure events, so this subcategory doesn't have a recommendation to enable Failure auditing. | +| Member Server | Yes | No | Yes | No | Group membership information for logged in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group, or other high value groups).
                          For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                          This subcategory doesn’t have Failure events, so this subcategory doesn't have a recommendation to enable Failure auditing. | +| Workstation | Yes | No | Yes | No | Group membership information for a logged-in user can help to detect that member of specific domain or local group logged in to the machine (for example, member of database administrators, built-in local administrators, domain administrators, service accounts group, or other high value groups).
                          For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                          This subcategory doesn’t have Failure events, so this subcategory doesn't have a recommendation to enable Failure auditing. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md index 64fd2edce2..e82188ac78 100644 --- a/windows/security/threat-protection/auditing/audit-handle-manipulation.md +++ b/windows/security/threat-protection/auditing/audit-handle-manipulation.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Handle Manipulation diff --git a/windows/security/threat-protection/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md index d396f0ed40..606acf77a3 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-driver.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-driver.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 10/02/2018 +ms.technology: mde --- # Audit IPsec Driver diff --git a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md index 37421d3b3e..179c4e5e22 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 10/02/2018 +ms.technology: mde --- # Audit IPsec Extended Mode diff --git a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md index bf2db28b53..092717cc70 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 10/02/2018 +ms.technology: mde --- # Audit IPsec Main Mode diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md index 290c41687a..fefab72132 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 10/02/2018 +ms.technology: mde --- # Audit IPsec Quick Mode diff --git a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md index 529003459d..14495b2794 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Kerberos Authentication Service diff --git a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md index 27a1d4a933..555de3229e 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Kerberos Service Ticket Operations @@ -31,7 +32,7 @@ This subcategory contains events about issued TGSs and failed TGS requests. | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | IF | Yes | Yes | Yes | Expected volume is very high on domain controllers.

                          IF - We recommend Success auditing, because you will see all Kerberos Service Ticket requests (TGS requests), which are part of service use and access requests by specific accounts. Also, you can see the IP address from which this account requested TGS, when TGS was requested, which encryption type was used, and so on. For recommendations for using and analyzing the collected information, see the ***Security Monitoring Recommendations*** sections.
                          We recommend Failure auditing, because you will see all failed requests and be able to investigate the reason for failure. You will also be able to detect Kerberos issues or possible attack attempts. | +| Domain Controller | IF | Yes | Yes | Yes | Expected volume is very high on domain controllers.

                          IF - We recommend Success auditing, because you will see all Kerberos Service Ticket requests (TGS requests), which are part of service use and access requests by specific accounts. Also, you can see the IP address from which this account requested TGS, when TGS was requested, which encryption type was used, and so on. For recommendations for using and analyzing the collected information, see our [***Security Monitoring Recommendations***](https://docs.microsoft.com/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events).

                          We recommend Failure auditing, because you will see all failed requests and be able to investigate the reason for failure. You will also be able to detect Kerberos issues or possible attack attempts. | | Member Server | No | No | No | No | This subcategory makes sense only on domain controllers. | | Workstation | No | No | No | No | This subcategory makes sense only on domain controllers. | @@ -42,4 +43,3 @@ This subcategory contains events about issued TGSs and failed TGS requests. - [4770](event-4770.md)(S): A Kerberos service ticket was renewed. - [4773](event-4773.md)(F): A Kerberos service ticket request failed. - diff --git a/windows/security/threat-protection/auditing/audit-kernel-object.md b/windows/security/threat-protection/auditing/audit-kernel-object.md index 60f0a374d8..35d10b40fa 100644 --- a/windows/security/threat-protection/auditing/audit-kernel-object.md +++ b/windows/security/threat-protection/auditing/audit-kernel-object.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Kernel Object diff --git a/windows/security/threat-protection/auditing/audit-logoff.md b/windows/security/threat-protection/auditing/audit-logoff.md index c4d6606795..a07a10fd9a 100644 --- a/windows/security/threat-protection/auditing/audit-logoff.md +++ b/windows/security/threat-protection/auditing/audit-logoff.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 07/16/2018 +ms.technology: mde --- # Audit Logoff @@ -23,7 +24,7 @@ ms.date: 07/16/2018 Audit Logoff determines whether the operating system generates audit events when logon sessions are terminated. -These events occur on the computer that was accessed. In the case of an interactive logon, these events are generated on the computer that was logged on to. +These events occur on the computer that was accessed. For an interactive logon, these events are generated on the computer that was logged on to. There is no failure event in this subcategory because failed logoffs (such as when a system abruptly shuts down) do not generate an audit record. @@ -31,13 +32,13 @@ Logon events are essential to understanding user activity and detecting potentia **Event volume**: High. -This subcategory allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +This subcategory allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff, the security audit event is generated on the computer that the user account logged on to. | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It is more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                          Enable Success audit if you want to track, for example, for how long session was active (in correlation with [Audit Logon](audit-logon.md) events) and when user actually logged off.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It is more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                          Enable Success audit if you want to track, for example, for how long session was active (in correlation with [Audit Logon](audit-logon.md) events) and when user actually logged off.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It is more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                          Enable Success audit if you want to track, for example, for how long session was active (in correlation with [Audit Logon](audit-logon.md) events) and when user actually logged off.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It's more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                          Enable Success audit if you want to track, for example, for how long a session was active (in correlation with [Audit Logon](audit-logon.md) events) and when a user logged off.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It's more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                          Enable Success audit if you want to track, for example, for how long a session was active (in correlation with [Audit Logon](audit-logon.md) events) and when a user logged off.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | No | No | Yes | No | This subcategory typically generates huge amount of “[4634](event-4634.md)(S): An account was logged off.” events, which typically have little security relevance. It's more important to audit Logon events using [Audit Logon](audit-logon.md) subcategory, rather than Logoff events.
                          Enable Success audit if you want to track, for example, for how long a session was active (in correlation with [Audit Logon](audit-logon.md) events) and when a user logged off.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-logon.md b/windows/security/threat-protection/auditing/audit-logon.md index 711c16301c..e87dd6ad1d 100644 --- a/windows/security/threat-protection/auditing/audit-logon.md +++ b/windows/security/threat-protection/auditing/audit-logon.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Logon diff --git a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md index d58bafa0de..5107277a3d 100644 --- a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit MPSSVC Rule-Level Policy Change diff --git a/windows/security/threat-protection/auditing/audit-network-policy-server.md b/windows/security/threat-protection/auditing/audit-network-policy-server.md index 697ae99b16..78f17fb1a1 100644 --- a/windows/security/threat-protection/auditing/audit-network-policy-server.md +++ b/windows/security/threat-protection/auditing/audit-network-policy-server.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Network Policy Server diff --git a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md index f1227802bd..8cf59016dd 100644 --- a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md @@ -1,27 +1,28 @@ --- -title: Audit Non Sensitive Privilege Use (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. +title: Audit Non-Sensitive Privilege Use (Windows 10) +description: This article for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. ms.assetid: 8fd74783-1059-443e-aa86-566d78606627 ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- -# Audit Non Sensitive Privilege Use +# Audit Non-Sensitive Privilege Use **Applies to** - Windows 10 - Windows Server 2016 -Audit Non Sensitive Privilege Use contains events that show usage of non-sensitive privileges. This is the list of non-sensitive privileges: +Audit Non-Sensitive Privilege Use contains events that show usage of non-sensitive privileges. This is the list of non-sensitive privileges: - Access Credential Manager as a trusted caller diff --git a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md index 959a951636..39fa1e83de 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Other Account Logon Events diff --git a/windows/security/threat-protection/auditing/audit-other-account-management-events.md b/windows/security/threat-protection/auditing/audit-other-account-management-events.md index 2795a0bb73..bb5d7120a3 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-management-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-management-events.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Other Account Management Events diff --git a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md index 9265129828..d50fe53957 100644 --- a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md +++ b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Other Logon/Logoff Events diff --git a/windows/security/threat-protection/auditing/audit-other-object-access-events.md b/windows/security/threat-protection/auditing/audit-other-object-access-events.md index 54b132e114..a485aa2d07 100644 --- a/windows/security/threat-protection/auditing/audit-other-object-access-events.md +++ b/windows/security/threat-protection/auditing/audit-other-object-access-events.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 05/29/2017 +ms.technology: mde --- # Audit Other Object Access Events diff --git a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md index 2ceacf7bd7..5f55e34285 100644 --- a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md +++ b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Other Policy Change Events diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md index f6d870f605..87c74a4998 100644 --- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md +++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md @@ -1,17 +1,18 @@ --- title: Audit Other Privilege Use Events (Windows 10) -description: This security policy setting is not used. +description: Learn about the audit other privilege use events, an auditing subcategory that should not have any events in it but enables generation of event 4985(S). ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Other Privilege Use Events diff --git a/windows/security/threat-protection/auditing/audit-other-system-events.md b/windows/security/threat-protection/auditing/audit-other-system-events.md index 314723a738..7554066d42 100644 --- a/windows/security/threat-protection/auditing/audit-other-system-events.md +++ b/windows/security/threat-protection/auditing/audit-other-system-events.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Other System Events diff --git a/windows/security/threat-protection/auditing/audit-pnp-activity.md b/windows/security/threat-protection/auditing/audit-pnp-activity.md index 2d1298584a..16b696e3a2 100644 --- a/windows/security/threat-protection/auditing/audit-pnp-activity.md +++ b/windows/security/threat-protection/auditing/audit-pnp-activity.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit PNP Activity diff --git a/windows/security/threat-protection/auditing/audit-process-creation.md b/windows/security/threat-protection/auditing/audit-process-creation.md index 2eb2aa20f8..456c7082b1 100644 --- a/windows/security/threat-protection/auditing/audit-process-creation.md +++ b/windows/security/threat-protection/auditing/audit-process-creation.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Process Creation diff --git a/windows/security/threat-protection/auditing/audit-process-termination.md b/windows/security/threat-protection/auditing/audit-process-termination.md index 7ba49fbd59..97b0a91741 100644 --- a/windows/security/threat-protection/auditing/audit-process-termination.md +++ b/windows/security/threat-protection/auditing/audit-process-termination.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Process Termination diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 4b0d88838f..8b5fa48820 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Registry diff --git a/windows/security/threat-protection/auditing/audit-removable-storage.md b/windows/security/threat-protection/auditing/audit-removable-storage.md index 82d5170b7c..d09d98cb1d 100644 --- a/windows/security/threat-protection/auditing/audit-removable-storage.md +++ b/windows/security/threat-protection/auditing/audit-removable-storage.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Removable Storage diff --git a/windows/security/threat-protection/auditing/audit-rpc-events.md b/windows/security/threat-protection/auditing/audit-rpc-events.md index b35eacaf51..59202d82fa 100644 --- a/windows/security/threat-protection/auditing/audit-rpc-events.md +++ b/windows/security/threat-protection/auditing/audit-rpc-events.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit RPC Events diff --git a/windows/security/threat-protection/auditing/audit-sam.md b/windows/security/threat-protection/auditing/audit-sam.md index 6e60284ead..2d23fcdcce 100644 --- a/windows/security/threat-protection/auditing/audit-sam.md +++ b/windows/security/threat-protection/auditing/audit-sam.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit SAM diff --git a/windows/security/threat-protection/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md index d75b85e522..c80fe834a9 100644 --- a/windows/security/threat-protection/auditing/audit-security-group-management.md +++ b/windows/security/threat-protection/auditing/audit-security-group-management.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 02/28/2019 +ms.technology: mde --- # Audit Security Group Management diff --git a/windows/security/threat-protection/auditing/audit-security-state-change.md b/windows/security/threat-protection/auditing/audit-security-state-change.md index c10e8072f7..19614087bb 100644 --- a/windows/security/threat-protection/auditing/audit-security-state-change.md +++ b/windows/security/threat-protection/auditing/audit-security-state-change.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Security State Change diff --git a/windows/security/threat-protection/auditing/audit-security-system-extension.md b/windows/security/threat-protection/auditing/audit-security-system-extension.md index 50dcccadde..b787507ef4 100644 --- a/windows/security/threat-protection/auditing/audit-security-system-extension.md +++ b/windows/security/threat-protection/auditing/audit-security-system-extension.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Security System Extension @@ -35,9 +36,9 @@ Attempts to install or load security system extensions or services are critical | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                          For other events we strongly recommend monitoring a whitelist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should have “SYSTEM” as value for **“Subject”** field.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                          For other events we strongly recommend monitoring a whitelist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                          For other events we strongly recommend monitoring a whitelist of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                          For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should have “SYSTEM” as value for **“Subject”** field.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                          For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | Yes | No | Yes | No | The main reason why we recommend Success auditing for this subcategory is “[4697](event-4697.md)(S): A service was installed in the system.”
                          For other events we strongly recommend monitoring an allow list of allowed security extensions (authenticated packages, logon processes, notification packages, and security packages). Otherwise it's hard to pull useful information from these events, except event 4611 which typically should display “SYSTEM” for the **“Subject”** field.
                          This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md index 3bdb900b00..2f23c9cbcc 100644 --- a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Sensitive Privilege Use diff --git a/windows/security/threat-protection/auditing/audit-special-logon.md b/windows/security/threat-protection/auditing/audit-special-logon.md index ec7e84c990..b17dccbcb1 100644 --- a/windows/security/threat-protection/auditing/audit-special-logon.md +++ b/windows/security/threat-protection/auditing/audit-special-logon.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit Special Logon diff --git a/windows/security/threat-protection/auditing/audit-system-integrity.md b/windows/security/threat-protection/auditing/audit-system-integrity.md index 89d27ff3cb..b461299ea0 100644 --- a/windows/security/threat-protection/auditing/audit-system-integrity.md +++ b/windows/security/threat-protection/auditing/audit-system-integrity.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit System Integrity diff --git a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md index bb9d974920..266ab2e3c9 100644 --- a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md +++ b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md @@ -5,7 +5,8 @@ manager: dansimp author: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security +ms.technology: mde --- # Audit Token Right Adjusted diff --git a/windows/security/threat-protection/auditing/audit-user-account-management.md b/windows/security/threat-protection/auditing/audit-user-account-management.md index 5b2d45cc98..145e04e477 100644 --- a/windows/security/threat-protection/auditing/audit-user-account-management.md +++ b/windows/security/threat-protection/auditing/audit-user-account-management.md @@ -6,12 +6,13 @@ ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit User Account Management diff --git a/windows/security/threat-protection/auditing/audit-user-device-claims.md b/windows/security/threat-protection/auditing/audit-user-device-claims.md index 74c7755cb8..6051e50d2f 100644 --- a/windows/security/threat-protection/auditing/audit-user-device-claims.md +++ b/windows/security/threat-protection/auditing/audit-user-device-claims.md @@ -1,17 +1,18 @@ --- title: Audit User/Device Claims (Windows 10) -description: Audit User/Device Claims is an audit policy setting which enables you to audit security events that are generated by user and device claims. +description: Audit User/Device Claims is an audit policy setting that enables you to audit security events that are generated by user and device claims. ms.assetid: D3D2BFAF-F2C0-462A-9377-673DB49D5486 ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp ms.date: 04/19/2017 +ms.technology: mde --- # Audit User/Device Claims @@ -25,7 +26,7 @@ Audit User/Device Claims allows you to audit user and device claims information For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. -***Important***: [Audit Logon](audit-logon.md) subcategory must also be enabled in order to get events from this subcategory. +***Important***: Enable the [Audit Logon](audit-logon.md) subcategory in order to get events from this subcategory. **Event volume**: diff --git a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md index f345a84336..7e9d098f5d 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md @@ -4,7 +4,7 @@ description: Determines whether to audit each instance of a user logging on to o ms.assetid: 84B44181-E325-49A1-8398-AECC3CE0A516 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit account logon events diff --git a/windows/security/threat-protection/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md index e699a88ac1..10a7cb1c8c 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-management.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-management.md @@ -4,7 +4,7 @@ description: Determines whether to audit each event of account management on a d ms.assetid: 369197E1-7E0E-45A4-89EA-16D91EF01689 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit account management diff --git a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md index 530a4255bc..e52e2e7382 100644 --- a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md @@ -4,7 +4,7 @@ description: Determines whether to audit the event of a user accessing an Active ms.assetid: 52F02EED-3CFE-4307-8D06-CF1E27693D09 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit directory service access diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index 5c7672c13a..c730790cfa 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -4,7 +4,7 @@ description: Determines whether to audit each instance of a user logging on to o ms.assetid: 78B5AFCB-0BBD-4C38-9FE9-6B4571B94A35 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit logon events @@ -38,33 +39,12 @@ You can configure this security setting by opening the appropriate policy under | Logon events | Description | | - | - | -| 528 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. | -| 529 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. | -| 530 | Logon failure. A logon attempt was made user account tried to log on outside of the allowed time. | -| 531 | Logon failure. A logon attempt was made using a disabled account. | -| 532 | Logon failure. A logon attempt was made using an expired account. | -| 533 | Logon failure. A logon attempt was made by a user who is not allowed to log on at this computer. | -| 534 | Logon failure. The user attempted to log on with a type that is not allowed. | -| 535 | Logon failure. The password for the specified account has expired. | -| 536 | Logon failure. The Net Logon service is not active. | -| 537 | Logon failure. The logon attempt failed for other reasons. | -| 538 | The logoff process was completed for a user. | -| 539 | Logon failure. The account was locked out at the time the logon attempt was made. | -| 540 | A user successfully logged on to a network. | -| 541 | Main mode Internet Key Exchange (IKE) authentication was completed between the local computer and the listed peer identity (establishing a security association), or quick mode has established a data channel. | -| 542 | A data channel was terminated. | -| 543 | Main mode was terminated. | -| 544 | Main mode authentication failed because the peer did not provide a valid certificate or the signature was not validated. | -| 545 | Main mode authentication failed because of a Kerberos failure or a password that is not valid. | -| 546 | IKE security association establishment failed because the peer sent a proposal that is not valid. A packet was received that contained data that is not valid. | -| 547 | A failure occurred during an IKE handshake. | -| 548 | Logon failure. The security ID (SID) from a trusted domain does not match the account domain SID of the client. | -| 549 | Logon failure. All SIDs corresponding to untrusted namespaces were filtered out during an authentication across forests. | -| 550 | Notification message that could indicate a possible denial-of-service attack. | -| 551 | A user initiated the logoff process. | -| 552 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | -| 682 | A user has reconnected to a disconnected terminal server session. | -| 683 | A user disconnected a terminal server session without logging off. | +| 4624 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. | +| 4625 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. | +| 4634 | The logoff process was completed for a user. | +| 4647 | A user initiated the logoff process. | +| 4648 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | +| 4779 | A user disconnected a terminal server session without logging off. | When event 528 is logged, a logon type is also listed in the event log. The following table describes each logon type. diff --git a/windows/security/threat-protection/auditing/basic-audit-object-access.md b/windows/security/threat-protection/auditing/basic-audit-object-access.md index b6b09ddae8..7bb1357af3 100644 --- a/windows/security/threat-protection/auditing/basic-audit-object-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-object-access.md @@ -4,7 +4,7 @@ description: The policy setting, Audit object access, determines whether to audi ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit object access @@ -28,7 +29,8 @@ If you define this policy setting, you can specify whether to audit successes, a To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the Define these policy settings check box and clear the **Success** and **Failure** check boxes. -> **Note:** You can set a SACL on a file system object using the **Security** tab in that object's **Properties** dialog box. +> [!NOTE] +> You can set a SACL on a file system object using the **Security** tab in that object's **Properties** dialog box. **Default:** No auditing. @@ -41,10 +43,10 @@ You can configure this security setting by opening the appropriate policy under |----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 560 | Access was granted to an already existing object. | | 562 | A handle to an object was closed. | -| 563 | An attempt was made to open an object with the intent to delete it.
                          \*\*Note: \*\* This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile(). | +| 563 | An attempt was made to open an object with the intent to delete it.
                          **Note:** This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile(). | | 564 | A protected object was deleted. | | 565 | Access was granted to an already existing object type. | -| 567 | A permission associated with a handle was used.
                          \*\*Note: \*\* A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | +| 567 | A permission associated with a handle was used.
                          **Note:** A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | | 568 | An attempt was made to create a hard link to a file that is being audited. | | 569 | The resource manager in Authorization Manager attempted to create a client context. | | 570 | A client attempted to access an object.
                          **Note:** An event will be generated for every attempted operation on the object. | diff --git a/windows/security/threat-protection/auditing/basic-audit-policy-change.md b/windows/security/threat-protection/auditing/basic-audit-policy-change.md index b80e5788af..a04167e8c2 100644 --- a/windows/security/threat-protection/auditing/basic-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/basic-audit-policy-change.md @@ -4,7 +4,7 @@ description: Determines whether to audit every incident of a change to user righ ms.assetid: 1025A648-6B22-4C85-9F47-FE0897F1FA31 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit policy change diff --git a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md index a3e7893fe6..4b6a28a415 100644 --- a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md +++ b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md @@ -4,7 +4,7 @@ description: Determines whether to audit each instance of a user exercising a us ms.assetid: C5C6DAAF-8B58-4DFB-B1CE-F0675AE0E9F8 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit privilege use diff --git a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md index 4f02eab9a3..c2e1ff94ca 100644 --- a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md +++ b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md @@ -4,7 +4,7 @@ description: Determines whether to audit detailed tracking information for event ms.assetid: 91AC5C1E-F4DA-4B16-BEE2-C92D66E4CEEA ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit process tracking diff --git a/windows/security/threat-protection/auditing/basic-audit-system-events.md b/windows/security/threat-protection/auditing/basic-audit-system-events.md index 7811de4253..8c5e33028e 100644 --- a/windows/security/threat-protection/auditing/basic-audit-system-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-system-events.md @@ -4,7 +4,7 @@ description: Determines whether to audit when a user restarts or shuts down the ms.assetid: BF27588C-2AA7-4365-A4BF-3BB377916447 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Audit system events diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md index 1e73acf50d..fd291c792a 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policies.md @@ -1,10 +1,10 @@ --- title: Basic security audit policies (Windows 10) -description: Before you implement auditing, you must decide on an auditing policy. +description: Learn about basic security audit policies that specify the categories of security-related events that you want to audit for the needs of your organization. ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Basic security audit policies diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md index 686cdfdc71..0ddb0a6152 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md @@ -4,7 +4,7 @@ description: Basic security audit policy settings are found under Computer Confi ms.assetid: 31C2C453-2CFC-4D9E-BC88-8CE1C1A8F900 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Basic security audit policy settings diff --git a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md index 745c787671..526946d4b5 100644 --- a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -4,7 +4,7 @@ description: By defining auditing settings for specific event categories, you ca ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Create a basic audit policy for an event category diff --git a/windows/security/threat-protection/auditing/event-1100.md b/windows/security/threat-protection/auditing/event-1100.md index 251aa8834c..f3fbd46308 100644 --- a/windows/security/threat-protection/auditing/event-1100.md +++ b/windows/security/threat-protection/auditing/event-1100.md @@ -2,7 +2,7 @@ title: 1100(S) The event logging service has shut down. (Windows 10) description: Describes security event 1100(S) The event logging service has shut down. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 1100(S): The event logging service has shut down. diff --git a/windows/security/threat-protection/auditing/event-1102.md b/windows/security/threat-protection/auditing/event-1102.md index c1d44d55e0..fecf1badde 100644 --- a/windows/security/threat-protection/auditing/event-1102.md +++ b/windows/security/threat-protection/auditing/event-1102.md @@ -1,8 +1,8 @@ --- title: 1102(S) The audit log was cleared. (Windows 10) -description: Describes security event 1102(S) The audit log was cleared. +description: Though you shouldn't normally see it, this event generates every time Windows Security audit log is cleared. This is for event 1102(S). ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 1102(S): The audit log was cleared. diff --git a/windows/security/threat-protection/auditing/event-1104.md b/windows/security/threat-protection/auditing/event-1104.md index 5854f68b90..8dbb841dce 100644 --- a/windows/security/threat-protection/auditing/event-1104.md +++ b/windows/security/threat-protection/auditing/event-1104.md @@ -1,8 +1,8 @@ --- title: 1104(S) The security log is now full. (Windows 10) -description: Describes security event 1104(S) The security log is now full. +description: This event generates every time Windows security log becomes full and the event log retention method is set to Do not overwrite events. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 1104(S): The security log is now full. diff --git a/windows/security/threat-protection/auditing/event-1105.md b/windows/security/threat-protection/auditing/event-1105.md index cd3b89cac3..c08fa7be61 100644 --- a/windows/security/threat-protection/auditing/event-1105.md +++ b/windows/security/threat-protection/auditing/event-1105.md @@ -1,8 +1,8 @@ --- title: 1105(S) Event log automatic backup. (Windows 10) -description: Describes security event 1105(S) Event log automatic backup. +description: This event generates every time Windows security log becomes full and new event log file was created. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,9 +11,10 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- -# 1105(S): Event log automatic backup. +# 1105(S): Event log automatic backup **Applies to** - Windows 10 @@ -71,7 +72,7 @@ This event generates, for example, if the maximum size of Security Event Log fil ***Field Descriptions:*** -**Log** \[Type = UnicodeString\]: the name of the log which was archived (new event log file was created and previous event log was archived). Always “**Security”** for Security Event Logs. +**Log** \[Type = UnicodeString\]: the name of the log that was archived (new event log file was created and previous event log was archived). Always “**Security”** for Security Event Logs. **File**: \[Type = FILETIME\]: full path and filename of archived log file. diff --git a/windows/security/threat-protection/auditing/event-1108.md b/windows/security/threat-protection/auditing/event-1108.md index 0aaa3b6a99..cd3bf45ca4 100644 --- a/windows/security/threat-protection/auditing/event-1108.md +++ b/windows/security/threat-protection/auditing/event-1108.md @@ -2,7 +2,7 @@ title: The event logging service encountered an error (Windows 10) description: Describes security event 1108(S) The event logging service encountered an error while processing an incoming event published from %1. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 1108(S): The event logging service encountered an error while processing an incoming event published from %1. diff --git a/windows/security/threat-protection/auditing/event-4608.md b/windows/security/threat-protection/auditing/event-4608.md index 22a7d07d71..6372e6acc2 100644 --- a/windows/security/threat-protection/auditing/event-4608.md +++ b/windows/security/threat-protection/auditing/event-4608.md @@ -1,8 +1,8 @@ --- title: 4608(S) Windows is starting up. (Windows 10) -description: Describes security event 4608(S) Windows is starting up. +description: Describes security event 4608(S) Windows is starting up. This event is logged when the LSASS.EXE process starts and the auditing subsystem is initialized. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4608(S): Windows is starting up. @@ -20,7 +21,7 @@ ms.author: dansimp - Windows Server 2016 -Event 4608 illustration +Event 4608 illustration ***Subcategory:*** [Audit Security State Change](audit-security-state-change.md) @@ -30,12 +31,13 @@ This event is logged when LSASS.EXE process starts and the auditing subsystem is It typically generates during operating system startup process. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
                          ***Event XML:*** -``` +```xml - - diff --git a/windows/security/threat-protection/auditing/event-4610.md b/windows/security/threat-protection/auditing/event-4610.md index c9be68814f..b85a2d5918 100644 --- a/windows/security/threat-protection/auditing/event-4610.md +++ b/windows/security/threat-protection/auditing/event-4610.md @@ -2,7 +2,7 @@ title: 4610(S) An authentication package has been loaded by the Local Security Authority. (Windows 10) description: Describes security event 4610(S) An authentication package has been loaded by the Local Security Authority. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4610(S): An authentication package has been loaded by the Local Security Authority. diff --git a/windows/security/threat-protection/auditing/event-4611.md b/windows/security/threat-protection/auditing/event-4611.md index d245a30f27..c3174b766e 100644 --- a/windows/security/threat-protection/auditing/event-4611.md +++ b/windows/security/threat-protection/auditing/event-4611.md @@ -2,7 +2,7 @@ title: 4611(S) A trusted logon process has been registered with the Local Security Authority. (Windows 10) description: Describes security event 4611(S) A trusted logon process has been registered with the Local Security Authority. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4611(S): A trusted logon process has been registered with the Local Security Authority. @@ -108,7 +109,7 @@ For 4611(S): A trusted logon process has been registered with the Local Security - Because this event is typically triggered by the SYSTEM account, we recommend that you report it whenever **“Subject\\Security ID”** is not SYSTEM. -- Typically this event has an informational purpose. If you defined the list of allowed Logon Processes in the system, then you can check is “**Logon Process Name”** field value in the whitelist or not. +- Typically this event has an informational purpose. If you defined the list of allowed Logon Processes in the system, then you can check is “**Logon Process Name”** field value in the allow list or not. - diff --git a/windows/security/threat-protection/auditing/event-4612.md b/windows/security/threat-protection/auditing/event-4612.md index 2ca7cca35a..c4561550d5 100644 --- a/windows/security/threat-protection/auditing/event-4612.md +++ b/windows/security/threat-protection/auditing/event-4612.md @@ -2,7 +2,7 @@ title: 4612(S) Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. (Windows 10) description: Describes security event 4612(S) Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4612(S): Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. diff --git a/windows/security/threat-protection/auditing/event-4614.md b/windows/security/threat-protection/auditing/event-4614.md index 8dd6e72adc..5bc966978c 100644 --- a/windows/security/threat-protection/auditing/event-4614.md +++ b/windows/security/threat-protection/auditing/event-4614.md @@ -2,7 +2,7 @@ title: 4614(S) A notification package has been loaded by the Security Account Manager. (Windows 10) description: Describes security event 4614(S) A notification package has been loaded by the Security Account Manager. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4614(S): A notification package has been loaded by the Security Account Manager. @@ -78,5 +79,5 @@ Each time a system starts, it loads the notification package DLLs from **HKEY\_L For 4614(S): A notification package has been loaded by the Security Account Manager. -- Typically this event has an informational purpose. If you defined the list of allowed Notification Packages in the system, then you can check is “**Notification Package Name”** field value in the whitelist or not. +- Typically this event has an informational purpose. If you defined the list of allowed Notification Packages in the system, then you can check is “**Notification Package Name”** field value in the allow list or not. diff --git a/windows/security/threat-protection/auditing/event-4615.md b/windows/security/threat-protection/auditing/event-4615.md index 9231f28b82..6c8f9cd7ac 100644 --- a/windows/security/threat-protection/auditing/event-4615.md +++ b/windows/security/threat-protection/auditing/event-4615.md @@ -1,8 +1,8 @@ --- title: 4615(S) Invalid use of LPC port. (Windows 10) -description: Describes security event 4615(S) Invalid use of LPC port. +description: Describes security event 4615(S) Invalid use of LPC port. It appears that the Invalid use of LPC port event never occurs. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4615(S): Invalid use of LPC port. diff --git a/windows/security/threat-protection/auditing/event-4616.md b/windows/security/threat-protection/auditing/event-4616.md index 8681a67e8f..690bde945f 100644 --- a/windows/security/threat-protection/auditing/event-4616.md +++ b/windows/security/threat-protection/auditing/event-4616.md @@ -1,8 +1,8 @@ --- title: 4616(S) The system time was changed. (Windows 10) -description: Describes security event 4616(S) The system time was changed. +description: Describes security event 4616(S) The system time was changed. This event is generated every time system time is changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4616(S): The system time was changed. @@ -20,7 +21,7 @@ ms.author: dansimp - Windows Server 2016 -Event 4616 illustration +Event 4616 illustration ***Subcategory:*** [Audit Security State Change](audit-security-state-change.md) @@ -32,12 +33,13 @@ This event is always logged regardless of the "Audit Security State Change" sub- You will typically see these events with “**Subject\\Security ID**” = “**LOCAL SERVICE**”, these are normal time correction actions. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
                          ***Event XML:*** -``` +```xml - - @@ -87,7 +89,8 @@ You will typically see these events with “**Subject\\Security ID**” = “**L - **Security ID** \[Type = SID\]**:** SID of account that requested the “change system time” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “change system time” operation. @@ -161,7 +164,8 @@ You will typically see these events with “**Subject\\Security ID**” = “**L For 4616(S): The system time was changed. -> **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). +> [!IMPORTANT] +> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). - Report all “**Subject\\Security ID**” not equals **“LOCAL SERVICE”**, which means that the time change was not made not by Windows Time service. diff --git a/windows/security/threat-protection/auditing/event-4618.md b/windows/security/threat-protection/auditing/event-4618.md index 9dcc575df1..c1bc41f942 100644 --- a/windows/security/threat-protection/auditing/event-4618.md +++ b/windows/security/threat-protection/auditing/event-4618.md @@ -2,7 +2,7 @@ title: 4618(S) A monitored security event pattern has occurred. (Windows 10) description: Describes security event 4618(S) A monitored security event pattern has occurred. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4618(S): A monitored security event pattern has occurred. @@ -32,7 +33,7 @@ Account must have **SeAuditPrivilege** (Generate security audits) to be able to - Only **OrgEventID**, **ComputerName**, and **EventCount** are required—others are optional. Fields not specified appear with “**-**“ in the event description field. -- If a field doesn’t match the expected data type, the event is not generated. (i.e., if **EventCount** = “XYZ” then no event is generated.) +- If a field doesn’t match the expected data type, the event is not generated. That is, if **EventCount** = “XYZ”, then no event is generated. - **UserSid**, **UserName**, and **UserDomain** are not related to each other (think **SubjectUser** fields, where they are) @@ -98,5 +99,5 @@ Account must have **SeAuditPrivilege** (Generate security audits) to be able to For 4618(S): A monitored security event pattern has occurred. -- This event can be invoked only manually/intentionally, it is up to you how interpret this event depends on information you put inside of it. +- This event can be invoked only manually/intentionally, it is up to you how to interpret this event depends on information you put inside of it. diff --git a/windows/security/threat-protection/auditing/event-4621.md b/windows/security/threat-protection/auditing/event-4621.md index f3365acf99..8868b9b584 100644 --- a/windows/security/threat-protection/auditing/event-4621.md +++ b/windows/security/threat-protection/auditing/event-4621.md @@ -2,7 +2,7 @@ title: 4621(S) Administrator recovered system from CrashOnAuditFail. (Windows 10) description: Describes security event 4621(S) Administrator recovered system from CrashOnAuditFail. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4621(S): Administrator recovered system from CrashOnAuditFail. diff --git a/windows/security/threat-protection/auditing/event-4622.md b/windows/security/threat-protection/auditing/event-4622.md index e425430b75..3579709147 100644 --- a/windows/security/threat-protection/auditing/event-4622.md +++ b/windows/security/threat-protection/auditing/event-4622.md @@ -2,7 +2,7 @@ title: 4622(S) A security package has been loaded by the Local Security Authority. (Windows 10) description: Describes security event 4622(S) A security package has been loaded by the Local Security Authority. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4622(S): A security package has been loaded by the Local Security Authority. @@ -100,5 +101,5 @@ These are some Security Package DLLs loaded by default in Windows 10: For 4622(S): A security package has been loaded by the Local Security Authority. -- Typically this event has an informational purpose. If you defined the list of allowed Security Packages in the system, then you can check is “**Security Package Name”** field value in the whitelist or not. +- Typically this event has an informational purpose. If you defined the list of allowed Security Packages in the system, then you can check is “**Security Package Name”** field value in the allow list or not. diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index d9b5265f75..49f1a0d83c 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -2,7 +2,7 @@ title: 4624(S) An account was successfully logged on. (Windows 10) description: Describes security event 4624(S) An account was successfully logged on. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4624(S): An account was successfully logged on. @@ -146,6 +147,7 @@ This event generates when a logon session is created (on destination machine). I | Logon Type | Logon Title | Description | |:----------:|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `0` | `System` | Used only by the System account, for example at system startup. | | `2` | `Interactive` | A user logged on to this computer. | | `3` | `Network` | A user or computer logged on to this computer from the network. | | `4` | `Batch` | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | @@ -155,6 +157,8 @@ This event generates when a logon session is created (on destination machine). I | `9` | `NewCredentials` | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | | `10` | `RemoteInteractive` | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | | `11` | `CachedInteractive` | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | +| `12` | `CachedRemoteInteractive` | Same as RemoteInteractive. This is used for internal auditing. | +| `13` | `CachedUnlock` | Workstation logon. | - **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. @@ -230,7 +234,7 @@ This event generates when a logon session is created (on destination machine). I **Network Information:** -- **Workstation Name** \[Type = UnicodeString\]**:** machine name from which logon attempt was performed. +- **Workstation Name** \[Type = UnicodeString\]**:** machine name to which logon attempt was performed. - **Source Network Address** \[Type = UnicodeString\]**:** IP address of machine from which logon attempt was performed. @@ -277,7 +281,7 @@ For 4624(S): An account was successfully logged on. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“New Logon\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“New Logon\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“New Logon\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“New Logon\\Security ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“New Logon\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“New Logon\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“New Logon\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md index 08fcff8219..9dcf332398 100644 --- a/windows/security/threat-protection/auditing/event-4625.md +++ b/windows/security/threat-protection/auditing/event-4625.md @@ -1,8 +1,8 @@ --- title: 4625(F) An account failed to log on. (Windows 10) -description: Describes security event 4625(F) An account failed to log on. +description: Describes security event 4625(F) An account failed to log on. This event is generated if an account logon attempt failed for a locked out account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4625(F): An account failed to log on. @@ -20,7 +21,7 @@ ms.author: dansimp - Windows Server 2016 -Event 4625 illustration +Event 4625 illustration ***Subcategories:*** [Audit Account Lockout](audit-account-lockout.md) and [Audit Logon](audit-logon.md) @@ -32,12 +33,13 @@ It generates on the computer where logon attempt was made, for example, if logon This event generates on domain controllers, member servers, and workstations. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
                          ***Event XML:*** -``` +```xml - - @@ -93,11 +95,12 @@ This event generates on domain controllers, member servers, and workstations. - **Security ID** \[Type = SID\]**:** SID of account that reported information about logon failure. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about logon failure. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\]**:** subject's domain or computer name. Here are some examples of formats: - Domain NETBIOS name example: CONTOSO @@ -109,31 +112,34 @@ This event generates on domain controllers, member servers, and workstations. - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. -**Logon Type** \[Type = UInt32\]**:** the type of logon which was performed. “Table 11. Windows Logon Types” contains the list of possible values for this field. +- **Logon Type** \[Type = UInt32\]**:** the type of logon that was performed. “Table 11. Windows Logon Types” contains the list of possible values for this field. -| Logon Type | Logon Title | Description | -|-----------------------------------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 2 | Interactive | A user logged on to this computer. | -| 3 | Network | A user or computer logged on to this computer from the network. | -| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | -| 5 | Service | A service was started by the Service Control Manager. | -| 7 | Unlock | This workstation was unlocked. | -| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | -| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | -| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | -| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | -> Table: Windows Logon Types + **Table 11: Windows Logon Types** + + | Logon Type | Logon Title | Description | + |-----------------------------------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| + | 2 | Interactive | A user logged on to this computer. | + | 3 | Network | A user or computer logged on to this computer from the network. | + | 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | + | 5 | Service | A service was started by the Service Control Manager. | + | 7 | Unlock | This workstation was unlocked. | + | 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | + | 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | + | 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | + | 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | + **Account For Which Logon Failed:** - **Security ID** \[Type = SID\]**:** SID of the account that was specified in the logon attempt. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account that was specified in the logon attempt. -- **Account Domain** \[Type = UnicodeString\]**:** domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\]**:** domain or computer name. Here are some examples of formats: - Domain NETBIOS name example: CONTOSO @@ -149,45 +155,46 @@ This event generates on domain controllers, member servers, and workstations. **Failure Information:** -- **Failure Reason** \[Type = UnicodeString\]**:** textual explanation of **Status** field value. For this event it typically has “**Account locked out**” value. +- **Failure Reason** \[Type = UnicodeString\]**:** textual explanation of **Status** field value. For this event, it typically has “**Account locked out**” value. -- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event it typically has “**0xC0000234**” value. The most common status codes are listed in “Table 12. Windows logon status codes.” +- **Status** \[Type = HexInt32\]**:** the reason why logon failed. For this event, it typically has “**0xC0000234**” value. The most common status codes are listed in Table 12. Windows logon status codes. -| Status\\Sub-Status Code | Description | -|-------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0XC000005E | There are currently no logon servers available to service the logon request. | -| 0xC0000064 | User logon with misspelled or bad user account | -| 0xC000006A | User logon with misspelled or bad password | -| 0XC000006D | This is either due to a bad username or authentication information | -| 0XC000006E | Unknown user name or bad password. | -| 0xC000006F | User logon outside authorized hours | -| 0xC0000070 | User logon from unauthorized workstation | -| 0xC0000071 | User logon with expired password | -| 0xC0000072 | User logon to account disabled by administrator | -| 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. | -| 0XC0000133 | Clocks between DC and other computer too far out of sync | -| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine | -| 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. | -| 0XC0000192 | An attempt was made to logon, but the N**etlogon** service was not started. | -| 0xC0000193 | User logon with expired account | -| 0XC0000224 | User is required to change password at next logon | -| 0XC0000225 | Evidently a bug in Windows and not a risk | -| 0xC0000234 | User logon with account locked | -| 0XC00002EE | Failure Reason: An Error occurred during Logon | -| 0XC0000413 | Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. | -| 0x0 | Status OK. | + **Table 12: Windows logon status codes.** -> Table: Windows logon status codes. -> -> **Note**  To see the meaning of other status\\sub-status codes you may also check for status code in the Window header file ntstatus.h in Windows SDK. + | Status\\Sub-Status Code | Description | + |-------------------------|------------------------------------------------------------------------------------------------------| + | 0XC000005E | There are currently no logon servers available to service the logon request. | + | 0xC0000064 | User logon with misspelled or bad user account | + | 0xC000006A | User logon with misspelled or bad password | + | 0XC000006D | The cause is either a bad username or authentication information | + | 0XC000006E | Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions). | + | 0xC000006F | User logon outside authorized hours | + | 0xC0000070 | User logon from unauthorized workstation | + | 0xC0000071 | User logon with expired password | + | 0xC0000072 | User logon to account disabled by administrator | + | 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. | + | 0XC0000133 | Clocks between DC and other computer too far out of sync | + | 0XC000015B | The user has not been granted the requested logon type (also called the *logon right*) at this machine | + | 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. | + | 0XC0000192 | An attempt was made to logon, but the **Netlogon** service was not started. | + | 0xC0000193 | User logon with expired account | + | 0XC0000224 | User is required to change password at next logon | + | 0XC0000225 | Evidently a bug in Windows and not a risk | + | 0xC0000234 | User logon with account locked | + | 0XC00002EE | Failure Reason: An Error occurred during Logon | + | 0XC0000413 | Logon Failure: The machine you are logging on to is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. | + | 0x0 | Status OK. | + +> [!NOTE] +> To see the meaning of other status or substatus codes, you might also check for status code in the Window header file ntstatus.h in Windows SDK. More information: -- **Sub Status** \[Type = HexInt32\]**:** additional information about logon failure. The most common sub-status codes listed in the “Table 12. Windows logon status codes.”. +- **Sub Status** \[Type = HexInt32\]**:** additional information about logon failure. The most common substatus codes listed in the “Table 12. Windows logon status codes.”. **Process Information:** -- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): +- **Caller Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):

                          Task manager illustration @@ -207,7 +214,7 @@ More information: - ::1 or 127.0.0.1 means localhost. -- **Source Port** \[Type = UnicodeString\]: source port which was used for logon attempt from remote machine. +- **Source Port** \[Type = UnicodeString\]: source port that was used for logon attempt from remote machine. - 0 for interactive logons. @@ -215,7 +222,7 @@ More information: - **Logon Process** \[Type = UnicodeString\]**:** the name of the trusted logon process that was used for the logon attempt. See event “[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority” description for more information. -- **Authentication Package** \[Type = UnicodeString\]**:** The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “[4610](event-4610.md): An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “[4622](event-4622.md): A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. The most common authentication packages are: +- **Authentication Package** \[Type = UnicodeString\]**:** The name of the authentication package that was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “[4610](event-4610.md): An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “[4622](event-4622.md): A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. The most common authentication packages are: - **NTLM** – NTLM-family Authentication @@ -225,7 +232,7 @@ More information: - **Transited Services** \[Type = UnicodeString\] \[Kerberos-only\]**:** the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see -- **Package Name (NTLM only)** \[Type = UnicodeString\]**:** The name of the LAN Manager sub-package ([NTLM-family](https://msdn.microsoft.com/library/cc236627.aspx) protocol name) that was used during the logon attempt. Possible values are: +- **Package Name (NTLM only)** \[Type = UnicodeString\]**:** The name of the LAN Manager subpackage ([NTLM-family](https://msdn.microsoft.com/library/cc236627.aspx) protocol name) that was used during the logon attempt. Possible values are: - “NTLM V1” @@ -235,13 +242,14 @@ More information: Only populated if “**Authentication Package” = “NTLM”**. -- **Key Length** \[Type = UInt32\]**:** the length of [NTLM Session Security](https://msdn.microsoft.com/library/cc236650.aspx) key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if “**Authentication Package” = “Kerberos”**, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using **Negotiate** authentication package. +- **Key Length** \[Type = UInt32\]**:** the length of [NTLM Session Security](https://msdn.microsoft.com/library/cc236650.aspx) key. Typically, it has a length of 128 bits or 56 bits. This parameter is always 0 if **"Authentication Package" = "Kerberos"**, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using **Negotiate** authentication package. ## Security Monitoring Recommendations For 4625(F): An account failed to log on. -> **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). +> [!IMPORTANT] +> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). - If you have a pre-defined “**Process Name**” for the process reported in this event, monitor all events with “**Process Name**” not equal to your defined value. @@ -257,9 +265,9 @@ For 4625(F): An account failed to log on. - If you have a high-value domain or local account for which you need to monitor every lockout, monitor all [4625](event-4625.md) events with the **“Subject\\Security ID”** that corresponds to the account. -- We recommend monitoring all [4625](event-4625.md) events for local accounts, because these accounts typically should not be locked out. This is especially relevant for critical servers, administrative workstations, and other high value assets. +- We recommend monitoring all [4625](event-4625.md) events for local accounts, because these accounts typically should not be locked out. Monitoring is especially relevant for critical servers, administrative workstations, and other high-value assets. -- We recommend monitoring all [4625](event-4625.md) events for service accounts, because these accounts should not be locked out or prevented from functioning. This is especially relevant for critical servers, administrative workstations, and other high value assets. +- We recommend monitoring all [4625](event-4625.md) events for service accounts, because these accounts should not be locked out or prevented from functioning. Monitoring is especially relevant for critical servers, administrative workstations, and other high value assets. - If your organization restricts logons in the following ways, you can use this event to monitor accordingly: @@ -277,17 +285,17 @@ For 4625(F): An account failed to log on. - Monitor for all events with the fields and values in the following table: -| **Field** | Value to monitor for | -|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.”
                          This is typically not a security issue but it can be an infrastructure or availability issue. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”.
                          Especially if you get a number of these in a row, it can be a sign of user enumeration attack. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC000006A – “User logon with misspelled or bad password” for critical accounts or service accounts.
                          Especially watch for a number of such events in a row. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC000006D – “This is either due to a bad username or authentication information” for critical accounts or service accounts.
                          Especially watch for a number of such events in a row. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC000006F – “User logon outside authorized hours”. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC0000070 – “User logon from unauthorized workstation”. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC0000072 – “User logon to account disabled by administrator”. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC000015B – “The user has not been granted the requested logon type (aka logon right) at this machine”. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC0000192 – “An attempt was made to logon, but the Netlogon service was not started”.
                          This is typically not a security issue but it can be an infrastructure or availability issue. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC0000193 – “User logon with expired account”. | -| **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC0000413 – “Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine”. | + | Field | Value to monitor for | + |----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC000005E – “There are currently no logon servers available to service the logon request.”
                          This issue is typically not a security issue, but it can be an infrastructure or availability issue. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC0000064 – “User logon with misspelled or bad user account”.
                          Especially if you get several of these events in a row, it can be a sign of a user enumeration attack. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC000006A – “User logon with misspelled or bad password” for critical accounts or service accounts.
                          Especially watch for a number of such events in a row. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC000006D – “This is either due to a bad username or authentication information” for critical accounts or service accounts.
                          Especially watch for a number of such events in a row. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC000006F – “User logon outside authorized hours”. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC0000070 – “User logon from unauthorized workstation”. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC0000072 – “User logon to account disabled by administrator”. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC000015B – “The user has not been granted the requested logon type (aka logon right) at this machine”. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC0000192 – “An attempt was made to logon, but the Netlogon service was not started”.
                          This issue is typically not a security issue but it can be an infrastructure or availability issue. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0xC0000193 – “User logon with expired account”. | + | **Failure Information\\Status** or
                          **Failure Information\\Sub Status** | 0XC0000413 – “Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine”. | diff --git a/windows/security/threat-protection/auditing/event-4626.md b/windows/security/threat-protection/auditing/event-4626.md index d0474f5941..667de4c561 100644 --- a/windows/security/threat-protection/auditing/event-4626.md +++ b/windows/security/threat-protection/auditing/event-4626.md @@ -1,8 +1,8 @@ --- title: 4626(S) User/Device claims information. (Windows 10) -description: Describes security event 4626(S) User/Device claims information. +description: Describes security event 4626(S) User/Device claims information. This event is generated for new account logons. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4626(S): User/Device claims information. @@ -157,7 +158,7 @@ This event generates on the computer to which the logon was performed (target co - “dadmin” – claim value. -**Device Claims** \[Type = UnicodeString\]**:** list of device claims for new logon session. For user accounts this field typically has “**-**“ value. For computer accounts this field has device claims listed. +**Device Claims** \[Type = UnicodeString\]**:** list of device claims for new logon session. For user accounts this field typically has “**-**“ value. For computer accounts this field has device claims listed. ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index 37bc83b16f..ff63c0c122 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -1,8 +1,8 @@ --- title: 4627(S) Group membership information. (Windows 10) -description: Describes security event 4627(S) Group membership information. +description: Describes security event 4627(S) Group membership information. This event is generated with event 4624(S) An account was successfully logged on. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4627(S): Group membership information. diff --git a/windows/security/threat-protection/auditing/event-4634.md b/windows/security/threat-protection/auditing/event-4634.md index c7fd725041..b0541e2dbb 100644 --- a/windows/security/threat-protection/auditing/event-4634.md +++ b/windows/security/threat-protection/auditing/event-4634.md @@ -1,8 +1,8 @@ --- title: 4634(S) An account was logged off. (Windows 10) -description: Describes security event 4634(S) An account was logged off. +description: Describes security event 4634(S) An account was logged off. This event is generated when a logon session is terminated and no longer exists. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 11/20/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4634(S): An account was logged off. diff --git a/windows/security/threat-protection/auditing/event-4647.md b/windows/security/threat-protection/auditing/event-4647.md index 3cb68ae77c..14dc2a7083 100644 --- a/windows/security/threat-protection/auditing/event-4647.md +++ b/windows/security/threat-protection/auditing/event-4647.md @@ -1,8 +1,8 @@ --- title: 4647(S) User initiated logoff. (Windows 10) -description: Describes security event 4647(S) User initiated logoff. +description: Describes security event 4647(S) User initiated logoff. This event is generated when a logoff is initiated. No further user-initiated activity can occur. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4647(S): User initiated logoff. diff --git a/windows/security/threat-protection/auditing/event-4648.md b/windows/security/threat-protection/auditing/event-4648.md index 97bb3eda59..8483ee08ac 100644 --- a/windows/security/threat-protection/auditing/event-4648.md +++ b/windows/security/threat-protection/auditing/event-4648.md @@ -2,7 +2,7 @@ title: 4648(S) A logon was attempted using explicit credentials. (Windows 10) description: Describes security event 4648(S) A logon was attempted using explicit credentials. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4648(S): A logon was attempted using explicit credentials. @@ -178,7 +179,7 @@ The following table is similar to the table in [Appendix A: Security monitoring | **High-value accounts**: You might have high value domain or local accounts for which you need to monitor each action.
                          Examples of high value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that correspond to the high value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” for accounts that are outside the whitelist. | +| **Account allow list**: You might have a specific allow list of accounts that are allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” for accounts that are outside the allow list. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform the action corresponding to this event. | Monitor for the **“Subject\\Account Domain”** or “**Account Whose Credentials Were Used\\Security ID**” corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that you are concerned about.
                          For example, you might monitor to ensure that “**Account Whose Credentials Were Used\\Security ID**” is not used to log on to a certain computer. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Subject\\Account Name”** and “**Account Whose Credentials Were Used\\Security ID**” for names that don’t comply with naming conventions. | diff --git a/windows/security/threat-protection/auditing/event-4649.md b/windows/security/threat-protection/auditing/event-4649.md index 0c3b10dff5..06ae9ca1aa 100644 --- a/windows/security/threat-protection/auditing/event-4649.md +++ b/windows/security/threat-protection/auditing/event-4649.md @@ -1,8 +1,8 @@ --- title: 4649(S) A replay attack was detected. (Windows 10) -description: Describes security event 4649(S) A replay attack was detected. +description: Describes security event 4649(S) A replay attack was detected. This event is generated when a KRB_AP_ERR_REPEAT Kerberos response is sent to the client. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4649(S): A replay attack was detected. diff --git a/windows/security/threat-protection/auditing/event-4656.md b/windows/security/threat-protection/auditing/event-4656.md index 918d665121..f0ce074332 100644 --- a/windows/security/threat-protection/auditing/event-4656.md +++ b/windows/security/threat-protection/auditing/event-4656.md @@ -2,7 +2,7 @@ title: 4656(S, F) A handle to an object was requested. (Windows 10) description: Describes security event 4656(S, F) A handle to an object was requested. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4656(S, F): A handle to an object was requested. diff --git a/windows/security/threat-protection/auditing/event-4657.md b/windows/security/threat-protection/auditing/event-4657.md index f27a05c4d3..f7ebcac31c 100644 --- a/windows/security/threat-protection/auditing/event-4657.md +++ b/windows/security/threat-protection/auditing/event-4657.md @@ -1,8 +1,8 @@ --- title: 4657(S) A registry value was modified. (Windows 10) -description: Describes security event 4657(S) A registry value was modified. +description: Describes security event 4657(S) A registry value was modified. This event is generated when a registry key value is modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4657(S): A registry value was modified. diff --git a/windows/security/threat-protection/auditing/event-4658.md b/windows/security/threat-protection/auditing/event-4658.md index 1569c43d0f..85b56fb6d0 100644 --- a/windows/security/threat-protection/auditing/event-4658.md +++ b/windows/security/threat-protection/auditing/event-4658.md @@ -1,8 +1,8 @@ --- title: 4658(S) The handle to an object was closed. (Windows 10) -description: Describes security event 4658(S) The handle to an object was closed. +description: Describes security event 4658(S) The handle to an object was closed. This event is generated when the handle to an object is closed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4658(S): The handle to an object was closed. diff --git a/windows/security/threat-protection/auditing/event-4660.md b/windows/security/threat-protection/auditing/event-4660.md index 7c03634e8e..db4a9fd649 100644 --- a/windows/security/threat-protection/auditing/event-4660.md +++ b/windows/security/threat-protection/auditing/event-4660.md @@ -1,8 +1,8 @@ --- title: 4660(S) An object was deleted. (Windows 10) -description: Describes security event 4660(S) An object was deleted. +description: Describes security event 4660(S) An object was deleted. This event is generated when an object is deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4660(S): An object was deleted. diff --git a/windows/security/threat-protection/auditing/event-4661.md b/windows/security/threat-protection/auditing/event-4661.md index 13513c1eb8..1fd43e2292 100644 --- a/windows/security/threat-protection/auditing/event-4661.md +++ b/windows/security/threat-protection/auditing/event-4661.md @@ -2,7 +2,7 @@ title: 4661(S, F) A handle to an object was requested. (Windows 10) description: Describes security event 4661(S, F) A handle to an object was requested. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4661(S, F): A handle to an object was requested. diff --git a/windows/security/threat-protection/auditing/event-4662.md b/windows/security/threat-protection/auditing/event-4662.md index 31fd7fd716..8998dbb81a 100644 --- a/windows/security/threat-protection/auditing/event-4662.md +++ b/windows/security/threat-protection/auditing/event-4662.md @@ -2,7 +2,7 @@ title: 4662(S, F) An operation was performed on an object. (Windows 10) description: Describes security event 4662(S, F) An operation was performed on an object. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4662(S, F): An operation was performed on an object. diff --git a/windows/security/threat-protection/auditing/event-4663.md b/windows/security/threat-protection/auditing/event-4663.md index 44da729457..367e5eb029 100644 --- a/windows/security/threat-protection/auditing/event-4663.md +++ b/windows/security/threat-protection/auditing/event-4663.md @@ -2,7 +2,7 @@ title: 4663(S) An attempt was made to access an object. (Windows 10) description: Describes security event 4663(S) An attempt was made to access an object. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4663(S): An attempt was made to access an object. diff --git a/windows/security/threat-protection/auditing/event-4664.md b/windows/security/threat-protection/auditing/event-4664.md index 6f60cce3a7..9c99e5f2bc 100644 --- a/windows/security/threat-protection/auditing/event-4664.md +++ b/windows/security/threat-protection/auditing/event-4664.md @@ -2,7 +2,7 @@ title: 4664(S) An attempt was made to create a hard link. (Windows 10) description: Describes security event 4664(S) An attempt was made to create a hard link. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4664(S): An attempt was made to create a hard link. diff --git a/windows/security/threat-protection/auditing/event-4670.md b/windows/security/threat-protection/auditing/event-4670.md index 45dcd000c9..c52b274d4f 100644 --- a/windows/security/threat-protection/auditing/event-4670.md +++ b/windows/security/threat-protection/auditing/event-4670.md @@ -2,7 +2,7 @@ title: 4670(S) Permissions on an object were changed. (Windows 10) description: Describes security event 4670(S) Permissions on an object were changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4670(S): Permissions on an object were changed. @@ -274,5 +275,5 @@ For file system and registry objects, the following recommendations apply. - If you have critical registry objects for which you need to monitor all modifications (especially permissions changes and owner changes), monitor for the specific **Object\\Object Name.** -- If you have high-value computers for which you need to monitor all changes for all or specific objects (for example, file system or registry objects), monitor for all [4670](event-4670.md) events on these computers. For example, you could monitor the **ntds.dit** file on domain controllers. +- If you have high-value computers for which you need to monitor all changes for all or specific objects (for example, file system or registry objects), monitor for all [4670](event-4670.md) events on these computers. For example, you could monitor the **ntds.dit** file on domain controllers. diff --git a/windows/security/threat-protection/auditing/event-4671.md b/windows/security/threat-protection/auditing/event-4671.md index 3e81e5f2f6..fb46f1fb5a 100644 --- a/windows/security/threat-protection/auditing/event-4671.md +++ b/windows/security/threat-protection/auditing/event-4671.md @@ -2,7 +2,7 @@ title: 4671(-) An application attempted to access a blocked ordinal through the TBS. (Windows 10) description: Describes security event 4671(-) An application attempted to access a blocked ordinal through the TBS. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4671(-): An application attempted to access a blocked ordinal through the TBS. diff --git a/windows/security/threat-protection/auditing/event-4672.md b/windows/security/threat-protection/auditing/event-4672.md index 1641acbc10..60e95bde44 100644 --- a/windows/security/threat-protection/auditing/event-4672.md +++ b/windows/security/threat-protection/auditing/event-4672.md @@ -2,7 +2,7 @@ title: 4672(S) Special privileges assigned to new logon. (Windows 10) description: Describes security event 4672(S) Special privileges assigned to new logon. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 12/20/2018 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4672(S): Special privileges assigned to new logon. @@ -22,7 +23,7 @@ ms.author: dansimp Event 4672 illustration
                          -Subcategory: Audit Special Logon +Subcategory: Audit Special Logon ***Event Description:*** diff --git a/windows/security/threat-protection/auditing/event-4673.md b/windows/security/threat-protection/auditing/event-4673.md index 1caa24d32d..579be30565 100644 --- a/windows/security/threat-protection/auditing/event-4673.md +++ b/windows/security/threat-protection/auditing/event-4673.md @@ -1,8 +1,8 @@ --- title: 4673(S, F) A privileged service was called. (Windows 10) -description: Describes security event 4673(S, F) A privileged service was called. +description: Describes security event 4673(S, F) A privileged service was called. This event is generated for an attempt to perform privileged system service operations. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4673(S, F): A privileged service was called. @@ -135,40 +136,40 @@ Failure event generates when service call attempt fails. | **Subcategory of event** | **Privilege Name:
                          User Right Group Policy Name** | **Description** | |-----------------------------------|-----------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                          Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                          With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | -| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                          Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | -| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                          Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | -| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                          Create permanent shared objects | Required to create a permanent object.
                          This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | -| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                          Create symbolic links | Required to create a symbolic link. | -| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                          Increase scheduling priority | Required to increase the base priority of a process.
                          With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | -| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                          Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                          With this privilege, the user can change the maximum memory that can be consumed by a process. | -| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                          Increase a process working set | Required to allocate more memory for applications that run in the context of users. | -| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                          Lock pages in memory | Required to lock physical pages in memory.
                          With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                          Add workstations to domain | With this privilege, the user can create a computer account.
                          This privilege is valid only on domain controllers. | -| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                          Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | -| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                          Profile single process | Required to gather profiling information for a single process.
                          With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | -| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                          Modify an object label | Required to modify the mandatory integrity level of an object. | -| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                          Force shutdown from a remote system | Required to shut down a system using a network request. | -| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                          Shut down the system | Required to shut down a local system. | -| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                          Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                          With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | -| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                          Profile system performance | Required to gather profiling information for the entire system.
                          With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | -| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                          Change the system time | Required to modify the system time. With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs.
                          If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | -| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                          Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | -| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                          Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | -| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                          Remove computer from docking station | Required to undock a laptop.
                          With this privilege, the user can undock a portable computer from its docking station without logging on. | +| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                          Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                          With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | +| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                          Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | +| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                          Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | +| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                          Create permanent shared objects | Required to create a permanent object.
                          This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | +| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                          Create symbolic links | Required to create a symbolic link. | +| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                          Increase scheduling priority | Required to increase the base priority of a process.
                          With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | +| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                          Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                          With this privilege, the user can change the maximum memory that can be consumed by a process. | +| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                          Increase a process working set | Required to allocate more memory for applications that run in the context of users. | +| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                          Lock pages in memory | Required to lock physical pages in memory.
                          With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                          Add workstations to domain | With this privilege, the user can create a computer account.
                          This privilege is valid only on domain controllers. | +| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                          Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | +| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                          Profile single process | Required to gather profiling information for a single process.
                          With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | +| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                          Modify an object label | Required to modify the mandatory integrity level of an object. | +| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                          Force shutdown from a remote system | Required to shut down a system using a network request. | +| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                          Shut down the system | Required to shut down a local system. | +| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                          Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                          With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | +| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                          Profile system performance | Required to gather profiling information for the entire system.
                          With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | +| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                          Change the system time | Required to modify the system time. With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs.
                          If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | +| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                          Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | +| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                          Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | +| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                          Remove computer from docking station | Required to undock a laptop.
                          With this privilege, the user can undock a portable computer from its docking station without logging on. | | **Subcategory of event** | **Privilege Name:
                          User Right Group Policy Name** | **Description** | |-------------------------------|------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                          Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process. With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | -| Audit Sensitive Privilege Use | SeAuditPrivilege:
                          Generate security audits | With this privilege, the user can add entries to the security log. | -| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                          Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs. When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | -| Audit Sensitive Privilege Use | SeDebugPrivilege:
                          Debug programs | Required to debug and adjust the memory of a process owned by another account. With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right. This user right provides complete access to sensitive and critical operating system components. | -| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                          Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | -| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                          Load and unload device drivers | Required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | -| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                          Lock pages in memory | Required to lock physical pages in memory. With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                          Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | -| Audit Sensitive Privilege Use | SeTcbPrivilege:
                          Act as part of the operating system | This privilege identifies its holder as part of the trusted computer base. This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. | -| Audit Sensitive Privilege Use | SeEnableDelegationPrivilege:
                          Enable computer and user accounts to be trusted for delegation | Required to mark user and computer accounts as trusted for delegation. With this privilege, the user can set the **Trusted for Deleg**ation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using the delegated credentials of a client, as long as the account of the client does not have the **Account cannot be delegated** account control flag set. | +| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                          Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process. With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | +| Audit Sensitive Privilege Use | SeAuditPrivilege:
                          Generate security audits | With this privilege, the user can add entries to the security log. | +| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                          Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs. When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | +| Audit Sensitive Privilege Use | SeDebugPrivilege:
                          Debug programs | Required to debug and adjust the memory of a process owned by another account. With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right. This user right provides complete access to sensitive and critical operating system components. | +| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                          Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | +| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                          Load and unload device drivers | Required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | +| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                          Lock pages in memory | Required to lock physical pages in memory. With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                          Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | +| Audit Sensitive Privilege Use | SeTcbPrivilege:
                          Act as part of the operating system | This privilege identifies its holder as part of the trusted computer base. This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. | +| Audit Sensitive Privilege Use | SeEnableDelegationPrivilege:
                          Enable computer and user accounts to be trusted for delegation | Required to mark user and computer accounts as trusted for delegation. With this privilege, the user can set the **Trusted for Deleg**ation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using the delegated credentials of a client, as long as the account of the client does not have the **Account cannot be delegated** account control flag set. | ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4674.md b/windows/security/threat-protection/auditing/event-4674.md index b4146f681a..5eecd1f2b5 100644 --- a/windows/security/threat-protection/auditing/event-4674.md +++ b/windows/security/threat-protection/auditing/event-4674.md @@ -2,7 +2,7 @@ title: 4674(S, F) An operation was attempted on a privileged object. (Windows 10) description: Describes security event 4674(S, F) An operation was attempted on a privileged object. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4674(S, F): An operation was attempted on a privileged object. @@ -157,42 +158,42 @@ Failure event generates when operation attempt fails. | **Subcategory of event** | **Privilege Name:
                          User Right Group Policy Name** | **Description** | |-----------------------------------|-----------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                          Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                          With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | -| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                          Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | -| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                          Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | -| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                          Create permanent shared objects | Required to create a permanent object.
                          This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | -| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                          Create symbolic links | Required to create a symbolic link. | -| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                          Increase scheduling priority | Required to increase the base priority of a process.
                          With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | -| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                          Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                          With this privilege, the user can change the maximum memory that can be consumed by a process. | -| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                          Increase a process working set | Required to allocate more memory for applications that run in the context of users. | -| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                          Lock pages in memory | Required to lock physical pages in memory.
                          With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                          Add workstations to domain | With this privilege, the user can create a computer account. This privilege is valid only on domain controllers. | -| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                          Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | -| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                          Profile single process | Required to gather profiling information for a single process.
                          With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | -| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                          Modify an object label | Required to modify the mandatory integrity level of an object. | -| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                          Force shutdown from a remote system | Required to shut down a system using a network request. | -| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                          Shut down the system | Required to shut down a local system. | -| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                          Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                          With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | -| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                          Profile system performance | Required to gather profiling information for the entire system.
                          With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | -| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                          Change the system time | Required to modify the system time.
                          With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | -| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                          Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | -| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                          Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | -| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                          Remove computer from docking station | Required to undock a laptop.
                          With this privilege, the user can undock a portable computer from its docking station without logging on. | +| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                          Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                          With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | +| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                          Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | +| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                          Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | +| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                          Create permanent shared objects | Required to create a permanent object.
                          This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | +| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                          Create symbolic links | Required to create a symbolic link. | +| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                          Increase scheduling priority | Required to increase the base priority of a process.
                          With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | +| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                          Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                          With this privilege, the user can change the maximum memory that can be consumed by a process. | +| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                          Increase a process working set | Required to allocate more memory for applications that run in the context of users. | +| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                          Lock pages in memory | Required to lock physical pages in memory.
                          With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                          Add workstations to domain | With this privilege, the user can create a computer account. This privilege is valid only on domain controllers. | +| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                          Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | +| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                          Profile single process | Required to gather profiling information for a single process.
                          With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | +| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                          Modify an object label | Required to modify the mandatory integrity level of an object. | +| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                          Force shutdown from a remote system | Required to shut down a system using a network request. | +| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                          Shut down the system | Required to shut down a local system. | +| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                          Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                          With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | +| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                          Profile system performance | Required to gather profiling information for the entire system.
                          With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | +| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                          Change the system time | Required to modify the system time.
                          With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | +| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                          Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | +| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                          Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | +| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                          Remove computer from docking station | Required to undock a laptop.
                          With this privilege, the user can undock a portable computer from its docking station without logging on. | | **Subcategory of event** | **Privilege Name:
                          User Right Group Policy Name** | **Description** | |-------------------------------|-----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                          Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process.
                          With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | -| Audit Sensitive Privilege Use | SeAuditPrivilege:
                          Generate security audits | With this privilege, the user can add entries to the security log. | -| Audit Sensitive Privilege Use | SeBackupPrivilege:
                          Back up files and directories | - Required to perform backup operations.
                          With this privilege, the user can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This privilege causes the system to grant all read access control to any file, regardless of the [*access control list*](https://msdn.microsoft.com/library/windows/desktop/ms721532(v=vs.85).aspx#_security_access_control_list_gly) (ACL) specified for the file. Any access request other than read is still evaluated with the ACL.
                          The following access rights are granted if this privilege is held:
                          READ\_CONTROL
                          ACCESS\_SYSTEM\_SECURITY
                          FILE\_GENERIC\_READ
                          FILE\_TRAVERSE | -| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                          Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs.
                          When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | -| Audit Sensitive Privilege Use | SeDebugPrivilege:
                          Debug programs | Required to debug and adjust the memory of a process owned by another account.
                          With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right.
                          This user right provides complete access to sensitive and critical operating system components. | -| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                          Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | -| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                          Load and unload device drivers | Required to load or unload a device driver.
                          With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | -| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                          Lock pages in memory | Required to lock physical pages in memory.
                          With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Sensitive Privilege Use | SeRestorePrivilege:
                          Restore files and directories | Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. The following access rights are granted if this privilege is held:
                          WRITE\_DAC
                          WRITE\_OWNER
                          ACCESS\_SYSTEM\_SECURITY
                          FILE\_GENERIC\_WRITE
                          FILE\_ADD\_FILE
                          FILE\_ADD\_SUBDIRECTORY
                          DELETE
                          With this privilege, the user can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories and determines which users can set any valid security principal as the owner of an object. | -| Audit Sensitive Privilege Use | SeSecurityPrivilege:
                          Manage auditing and security log | Required to perform a number of security-related functions, such as controlling and viewing audit events in security event log.
                          With this privilege, the user can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. A user with this privilege can also view and clear the security log. | -| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                          Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | -| Audit Sensitive Privilege Use | SeTakeOwnershipPrivilege:
                          Take ownership of files or other objects | Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object.
                          With this privilege, the user can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. | +| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                          Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process.
                          With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | +| Audit Sensitive Privilege Use | SeAuditPrivilege:
                          Generate security audits | With this privilege, the user can add entries to the security log. | +| Audit Sensitive Privilege Use | SeBackupPrivilege:
                          Back up files and directories | - Required to perform backup operations.
                          With this privilege, the user can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This privilege causes the system to grant all read access control to any file, regardless of the [*access control list*](https://msdn.microsoft.com/library/windows/desktop/ms721532(v=vs.85).aspx#_security_access_control_list_gly) (ACL) specified for the file. Any access request other than read is still evaluated with the ACL.
                          The following access rights are granted if this privilege is held:
                          READ\_CONTROL
                          ACCESS\_SYSTEM\_SECURITY
                          FILE\_GENERIC\_READ
                          FILE\_TRAVERSE | +| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                          Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs.
                          When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | +| Audit Sensitive Privilege Use | SeDebugPrivilege:
                          Debug programs | Required to debug and adjust the memory of a process owned by another account.
                          With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right.
                          This user right provides complete access to sensitive and critical operating system components. | +| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                          Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | +| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                          Load and unload device drivers | Required to load or unload a device driver.
                          With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | +| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                          Lock pages in memory | Required to lock physical pages in memory.
                          With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Sensitive Privilege Use | SeRestorePrivilege:
                          Restore files and directories | Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. The following access rights are granted if this privilege is held:
                          WRITE\_DAC
                          WRITE\_OWNER
                          ACCESS\_SYSTEM\_SECURITY
                          FILE\_GENERIC\_WRITE
                          FILE\_ADD\_FILE
                          FILE\_ADD\_SUBDIRECTORY
                          DELETE
                          With this privilege, the user can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories and determines which users can set any valid security principal as the owner of an object. | +| Audit Sensitive Privilege Use | SeSecurityPrivilege:
                          Manage auditing and security log | Required to perform a number of security-related functions, such as controlling and viewing audit events in security event log.
                          With this privilege, the user can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. A user with this privilege can also view and clear the security log. | +| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                          Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | +| Audit Sensitive Privilege Use | SeTakeOwnershipPrivilege:
                          Take ownership of files or other objects | Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object.
                          With this privilege, the user can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. | ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4675.md b/windows/security/threat-protection/auditing/event-4675.md index 20ed1e1911..0af7742f2c 100644 --- a/windows/security/threat-protection/auditing/event-4675.md +++ b/windows/security/threat-protection/auditing/event-4675.md @@ -1,8 +1,8 @@ --- title: 4675(S) SIDs were filtered. (Windows 10) -description: Describes security event 4675(S) SIDs were filtered. +description: Describes security event 4675(S) SIDs were filtered. This event is generated when SIDs were filtered for a specific Active Directory trust. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4675(S): SIDs were filtered. diff --git a/windows/security/threat-protection/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md index 94d84a85cf..31baef1ba5 100644 --- a/windows/security/threat-protection/auditing/event-4688.md +++ b/windows/security/threat-protection/auditing/event-4688.md @@ -1,8 +1,8 @@ --- title: 4688(S) A new process has been created. (Windows 10) -description: Describes security event 4688(S) A new process has been created. +description: Describes security event 4688(S) A new process has been created. This event is generated when a new process starts. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4688(S): A new process has been created. @@ -81,29 +82,29 @@ This event generates every time a new process starts. - 1 - Windows Server 2012 R2, Windows 8.1. - - Added “Process Command Line” field. + - Added "Process Command Line" field. - 2 - Windows 10. - **Subject** renamed to **Creator Subject**. - - Added “**Target Subject**” section. + - Added "**Target Subject**" section. - - Added “**Mandatory Label**” field. + - Added "**Mandatory Label**" field. - - Added “**Creator Process Name**” field. + - Added "**Creator Process Name**" field. ***Field Descriptions:*** **Creator Subject** \[Value for versions 0 and 1 – **Subject**\]**:** -- **Security ID** \[Type = SID\]**:** SID of account that requested the “create process” operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. +- **Security ID** \[Type = SID\]**:** SID of account that requested the "create process" operation. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. > **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). -- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the “create process” operation. +- **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested the "create process" operation. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\]**:** subject's domain or computer name. Formats vary, and include the following: - Domain NETBIOS name example: CONTOSO @@ -111,11 +112,11 @@ This event generates every time a new process starts. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. + - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". -- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4624](event-4624.md): An account was successfully logged on.” +- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4624](event-4624.md): An account was successfully logged on." **Target Subject** \[Version 2\]**:** @@ -127,7 +128,7 @@ This event generates every time a new process starts. - **Account Name** \[Type = UnicodeString\] \[Version 2\]**:** the name of the target account. -- **Account Domain** \[Type = UnicodeString\] \[Version 2\]**:** target account’s domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\] \[Version 2\]**:** target account's domain or computer name. Formats vary, and include the following: - Domain NETBIOS name example: CONTOSO @@ -135,11 +136,11 @@ This event generates every time a new process starts. - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. + - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". -- **Logon ID** \[Type = HexInt64\] \[Version 2\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4624](event-4624.md): An account was successfully logged on.” +- **Logon ID** \[Type = HexInt64\] \[Version 2\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4624](event-4624.md): An account was successfully logged on." **Process Information:** @@ -173,11 +174,11 @@ This event generates every time a new process starts. - **Creator Process ID** \[Type = Pointer\]**:** hexadecimal Process ID of the process which ran the new process. If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager. -> You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**. +> You can also correlate this process ID with a process ID in other events, for example, "[4688](event-4688.md): A new process has been created" **Process Information\\New Process ID**. - **Creator Process Name** \[Version 2\] \[Type = UnicodeString\]**:** full path and the name of the executable for the process. -- **Process Command Line** \[Version 1, 2\] \[Type = UnicodeString\]**:** contains the name of executable and arguments which were passed to it. You must enable “Administrative Templates\\System\\Audit Process Creation\\Include command line in process creation events” group policy to include command line in process creation events: +- **Process Command Line** \[Version 1, 2\] \[Type = UnicodeString\]**:** contains the name of executable and arguments which were passed to it. You must enable "Administrative Templates\\System\\Audit Process Creation\\Include command line in process creation events" group policy to include command line in process creation events: Group policy illustration @@ -189,28 +190,27 @@ For 4688(S): A new process has been created. | **Type of monitoring required** | **Recommendation** | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor all events with the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that corresponds to the high-value account or accounts. | -| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | -| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor all events with the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Creator Subject\\Security ID”** and **“Target Subject\\Security ID”** for accounts that are outside the whitelist. | -| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** to see whether the account type is as expected. | -| **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** corresponding to accounts from another domain or “external” accounts. | -| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that you are concerned about. | -| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** for names that don’t comply with naming conventions. | +| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor all events with the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that corresponds to the high-value account or accounts. | +| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** (with other information) to monitor how or when a particular account is being used. | +| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor all events with the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that corresponds to the accounts that should never be used. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "whitelist-only" action, review the **"Creator Subject\\Security ID"** and **"Target Subject\\Security ID"** for accounts that are outside the allow list. | +| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** to see whether the account type is as expected. | +| **External accounts**: You might be monitoring accounts from another domain, or "external" accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** corresponding to accounts from another domain or "external" accounts. | +| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that you are concerned about. | +| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** for names that don't comply with naming conventions. | -- If you have a pre-defined “**New** **Process Name**” or **“Creator Process Name**” for the process reported in this event, monitor all events with “**New** **Process Name**” or **“Creator Process Name**” not equal to your defined value. +- If you have a pre-defined "**New** **Process Name**" or **"Creator Process Name**" for the process reported in this event, monitor all events with "**New** **Process Name**" or **"Creator Process Name**" not equal to your defined value. -- You can monitor to see if “**New** **Process Name**” or **“Creator Process Name**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). +- You can monitor to see if "**New** **Process Name**" or **"Creator Process Name**" is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). -- If you have a pre-defined list of restricted substrings or words in process names (for example “**mimikatz**” or “**cain.exe**”), check for these substrings in “**New** **Process Name**” or **“Creator Process Name**.” +- If you have a pre-defined list of restricted substrings or words in process names (for example "**mimikatz**" or "**cain.exe**"), check for these substrings in "**New** **Process Name**" or **"Creator Process Name**." - It can be unusual for a process to run using a local account in either **Creator Subject\\Security ID** or in **Target** **Subject\\Security ID**. -- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (1)** when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol. Typically this means that UAC is disabled for this account for some reason. +- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (1)** when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn't contain the $ symbol. Typically this means that UAC is disabled for this account for some reason. -- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol. This means that a user ran a program using administrative privileges. +- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn't contain the $ symbol. This means that a user ran a program using administrative privileges. - You can also monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when a computer object was used to run the process, but that computer object is not the same computer where the event occurs. -- If you need to monitor all new processes with a specific Mandatory Label, for example S-1-16-20480 (Protected process), check the “**Mandatory Label**” in this event. - +- If you need to monitor all new processes with a specific Mandatory Label, for example S-1-16-20480 (Protected process), check the "**Mandatory Label**" in this event. \ No newline at end of file diff --git a/windows/security/threat-protection/auditing/event-4689.md b/windows/security/threat-protection/auditing/event-4689.md index cf6f0fce07..99bee451d9 100644 --- a/windows/security/threat-protection/auditing/event-4689.md +++ b/windows/security/threat-protection/auditing/event-4689.md @@ -1,8 +1,8 @@ --- title: 4689(S) A process has exited. (Windows 10) -description: Describes security event 4689(S) A process has exited. +description: Describes security event 4689(S) A process has exited. This event is generates when a process exits. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4689(S): A process has exited. diff --git a/windows/security/threat-protection/auditing/event-4690.md b/windows/security/threat-protection/auditing/event-4690.md index be4ce4de7c..d7a23d1da4 100644 --- a/windows/security/threat-protection/auditing/event-4690.md +++ b/windows/security/threat-protection/auditing/event-4690.md @@ -2,7 +2,7 @@ title: 4690(S) An attempt was made to duplicate a handle to an object. (Windows 10) description: Describes security event 4690(S) An attempt was made to duplicate a handle to an object. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4690(S): An attempt was made to duplicate a handle to an object. diff --git a/windows/security/threat-protection/auditing/event-4691.md b/windows/security/threat-protection/auditing/event-4691.md index 001cce1266..cadefa2220 100644 --- a/windows/security/threat-protection/auditing/event-4691.md +++ b/windows/security/threat-protection/auditing/event-4691.md @@ -2,7 +2,7 @@ title: 4691(S) Indirect access to an object was requested. (Windows 10) description: Describes security event 4691(S) Indirect access to an object was requested. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4691(S): Indirect access to an object was requested. diff --git a/windows/security/threat-protection/auditing/event-4692.md b/windows/security/threat-protection/auditing/event-4692.md index 15199dbda5..5d421a4e9f 100644 --- a/windows/security/threat-protection/auditing/event-4692.md +++ b/windows/security/threat-protection/auditing/event-4692.md @@ -2,7 +2,7 @@ title: 4692(S, F) Backup of data protection master key was attempted. (Windows 10) description: Describes security event 4692(S, F) Backup of data protection master key was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4692(S, F): Backup of data protection master key was attempted. @@ -30,7 +31,7 @@ This event generates every time that a backup is attempted for the [DPAPI](https When a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. When a Master Key is generated, DPAPI communicates with a domain controller. Domain controllers have a domain-wide public/private key pair, associated solely with DPAPI. The local DPAPI client gets the domain controller public key from a domain controller by using a mutually authenticated and privacy protected RPC call. The client encrypts the Master Key with the domain controller public key. It then stores this backup Master Key along with the Master Key protected by the user's password. -Periodically, a domain-joined machine will try to send an RPC request to a domain controller to back up the user’s master key so that the user can recover secrets in case his or her password has to be reset. Although the user's keys are stored in the user profile, a domain controller must be contacted to encrypt the master key with a domain recovery key. +Periodically, a domain-joined machine tries to send an RPC request to a domain controller to back up the user’s master key so that the user can recover secrets in case their password has to be reset. Although the user's keys are stored in the user profile, a domain controller must be contacted to encrypt the master key with a domain recovery key. This event also generates every time a new DPAPI Master Key is generated, for example. @@ -91,7 +92,7 @@ Failure event generates when a Master Key backup operation fails for some reason - **Account Name** \[Type = UnicodeString\]**:** the name of the account that requested backup operation. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following: +- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Here are some examples of formats: - Domain NETBIOS name example: CONTOSO @@ -107,17 +108,17 @@ Failure event generates when a Master Key backup operation fails for some reason **Key Information:** -- **Key Identifier** \[Type = UnicodeString\]: unique identifier of a master key which backup was created. The Master Key is used, with some additional data, to generate an actual symmetric session key to encrypt\\decrypt the data using DPAPI. All of user's Master Keys are located in user profile -> %APPDATA%\\Roaming\\Microsoft\\Windows\\Protect\\%SID% folder. The name of every Master Key file is it’s ID. +- **Key Identifier** \[Type = UnicodeString\]: unique identifier of a master key which backup was created. The Master Key is used, with some additional data, to generate an actual symmetric session key to encrypt\\decrypt the data using DPAPI. All of user's Master Keys are located in user profile -> %APPDATA%\\Roaming\\Microsoft\\Windows\\Protect\\%SID% folder. The name of every Master Key file is its ID. - **Recovery Server** \[Type = UnicodeString\]: the name (typically – DNS name) of the computer that you contacted to back up your Master Key. For domain joined machines, it’s typically a name of a domain controller. This parameter might not be captured in the event, and in that case will be empty. -- **Recovery Key ID** \[Type = UnicodeString\]**:** unique identifier of a recovery key. The recovery key is generated when a user chooses to create a Password Reset Disk (PRD) from the user's Control Panel or when first Master Key is generated. First, DPAPI generates a RSA public/private key pair, which is the recovery key. In this field you will see unique Recovery key ID which was used for Master key backup operation. +- **Recovery Key ID** \[Type = UnicodeString\]**:** unique identifier of a recovery key. The recovery key is generated when a user chooses to create a Password Reset Disk (PRD) from the user's Control Panel or when first Master Key is generated. First, DPAPI generates an RSA public/private key pair, which is the recovery key. In this field, you will see unique Recovery key ID that was used for Master key backup operation. - For Failure events this field is typically empty. + For Failure events, this field is typically empty. **Status Information:** -- **Status Code** \[Type = HexInt32\]**:** hexadecimal unique status code of performed operation. For Success events this field is typically “**0x0**”. To see the meaning of status code you need to convert it to decimal value and us “**net helpmsg STATUS\_CODE**” command to see the description for specific STATUS\_CODE. Here is an example of “net helpmsg” command output for status code 0x3A: +- **Status Code** \[Type = HexInt32\]**:** hexadecimal unique status code of performed operation. For Success events, this field is typically “**0x0**”. To see the meaning of status code you need to convert it to decimal value and us “**net helpmsg STATUS\_CODE**” command to see the description for specific STATUS\_CODE. Here is an example of “net helpmsg” command output for status code 0x3A: > \[Net helpmsg 58 illustration](..images/net-helpmsg-58.png) diff --git a/windows/security/threat-protection/auditing/event-4693.md b/windows/security/threat-protection/auditing/event-4693.md index 72c5473fe1..705ede7a61 100644 --- a/windows/security/threat-protection/auditing/event-4693.md +++ b/windows/security/threat-protection/auditing/event-4693.md @@ -2,7 +2,7 @@ title: 4693(S, F) Recovery of data protection master key was attempted. (Windows 10) description: Describes security event 4693(S, F) Recovery of data protection master key was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4693(S, F): Recovery of data protection master key was attempted. diff --git a/windows/security/threat-protection/auditing/event-4694.md b/windows/security/threat-protection/auditing/event-4694.md index 9d96a529ac..3d9e4f51cf 100644 --- a/windows/security/threat-protection/auditing/event-4694.md +++ b/windows/security/threat-protection/auditing/event-4694.md @@ -2,7 +2,7 @@ title: 4694(S, F) Protection of auditable protected data was attempted. (Windows 10) description: Describes security event 4694(S, F) Protection of auditable protected data was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4694(S, F): Protection of auditable protected data was attempted. diff --git a/windows/security/threat-protection/auditing/event-4695.md b/windows/security/threat-protection/auditing/event-4695.md index 675ba33601..cbca831957 100644 --- a/windows/security/threat-protection/auditing/event-4695.md +++ b/windows/security/threat-protection/auditing/event-4695.md @@ -2,7 +2,7 @@ title: 4695(S, F) Unprotection of auditable protected data was attempted. (Windows 10) description: Describes security event 4695(S, F) Unprotection of auditable protected data was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4695(S, F): Unprotection of auditable protected data was attempted. diff --git a/windows/security/threat-protection/auditing/event-4696.md b/windows/security/threat-protection/auditing/event-4696.md index cc31b9e54f..520d0d5d1e 100644 --- a/windows/security/threat-protection/auditing/event-4696.md +++ b/windows/security/threat-protection/auditing/event-4696.md @@ -2,7 +2,7 @@ title: 4696(S) A primary token was assigned to process. (Windows 10) description: Describes security event 4696(S) A primary token was assigned to process. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4696(S): A primary token was assigned to process. @@ -152,7 +153,7 @@ For 4696(S): A primary token was assigned to process. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and **“New Token Information\\Security ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and **“New Token Information\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4697.md b/windows/security/threat-protection/auditing/event-4697.md index d454c05905..090b2436e1 100644 --- a/windows/security/threat-protection/auditing/event-4697.md +++ b/windows/security/threat-protection/auditing/event-4697.md @@ -2,7 +2,7 @@ title: 4697(S) A service was installed in the system. (Windows 10) description: Describes security event 4697(S) A service was installed in the system. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4697(S): A service was installed in the system. diff --git a/windows/security/threat-protection/auditing/event-4698.md b/windows/security/threat-protection/auditing/event-4698.md index 2742b717ce..567815e3b8 100644 --- a/windows/security/threat-protection/auditing/event-4698.md +++ b/windows/security/threat-protection/auditing/event-4698.md @@ -1,8 +1,8 @@ --- title: 4698(S) A scheduled task was created. (Windows 10) -description: Describes security event 4698(S) A scheduled task was created. +description: Describes security event 4698(S) A scheduled task was created. This event is generated when a scheduled task is created. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4698(S): A scheduled task was created. @@ -62,6 +63,17 @@ This event generates every time a new scheduled task is created.
                          ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4699.md b/windows/security/threat-protection/auditing/event-4699.md index 280aad111e..5b2861c4d1 100644 --- a/windows/security/threat-protection/auditing/event-4699.md +++ b/windows/security/threat-protection/auditing/event-4699.md @@ -1,8 +1,8 @@ --- title: 4699(S) A scheduled task was deleted. (Windows 10) -description: Describes security event 4699(S) A scheduled task was deleted. +description: Describes security event 4699(S) A scheduled task was deleted. This event is generated every time a scheduled task is deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4699(S): A scheduled task was deleted. @@ -62,6 +63,17 @@ This event generates every time a scheduled task was deleted.
                          ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4700.md b/windows/security/threat-protection/auditing/event-4700.md index a53997c7b8..90e9f7b574 100644 --- a/windows/security/threat-protection/auditing/event-4700.md +++ b/windows/security/threat-protection/auditing/event-4700.md @@ -1,8 +1,8 @@ --- title: 4700(S) A scheduled task was enabled. (Windows 10) -description: Describes security event 4700(S) A scheduled task was enabled. +description: Describes security event 4700(S) A scheduled task was enabled. This event is generated every time a scheduled task is enabled. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4700(S): A scheduled task was enabled. @@ -62,6 +63,17 @@ This event generates every time a scheduled task is enabled.
                          ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4701.md b/windows/security/threat-protection/auditing/event-4701.md index d1991b0941..bc81734079 100644 --- a/windows/security/threat-protection/auditing/event-4701.md +++ b/windows/security/threat-protection/auditing/event-4701.md @@ -1,8 +1,8 @@ --- title: 4701(S) A scheduled task was disabled. (Windows 10) -description: Describes security event 4701(S) A scheduled task was disabled. +description: Describes security event 4701(S) A scheduled task was disabled. This event is generated every time a scheduled task is disabled. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4701(S): A scheduled task was disabled. @@ -62,6 +63,17 @@ This event generates every time a scheduled task is disabled. ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4702.md b/windows/security/threat-protection/auditing/event-4702.md index 01ef0250a8..f6d5b753e4 100644 --- a/windows/security/threat-protection/auditing/event-4702.md +++ b/windows/security/threat-protection/auditing/event-4702.md @@ -1,8 +1,8 @@ --- title: 4702(S) A scheduled task was updated. (Windows 10) -description: Describes security event 4702(S) A scheduled task was updated. +description: Describes security event 4702(S) A scheduled task was updated. This event is generated when a scheduled task is updated/changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4702(S): A scheduled task was updated. @@ -62,6 +63,17 @@ This event generates every time scheduled task was updated/changed. ``` +>[!NOTE] +> Windows 10 Versions 1903 and above augments the event with these additional properties: +> Event Version 1. +> ***Event XML:*** +>``` +> 5066549580796854 +> 3932 +> 5304 +> 0 +> DESKTOP-Name + ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md index 5c8f7fcc36..e0a624d4fb 100644 --- a/windows/security/threat-protection/auditing/event-4703.md +++ b/windows/security/threat-protection/auditing/event-4703.md @@ -1,8 +1,8 @@ --- title: 4703(S) A user right was adjusted. (Windows 10) -description: Describes security event 4703(S) A user right was adjusted. +description: Describes security event 4703(S) A user right was adjusted. This event is generated when token privileges are enabled or disabled for a specific account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4703(S): A user right was adjusted. @@ -194,7 +195,7 @@ Otherwise, see the recommendations in the following table. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\Security ID**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist. Also check the “**Target Account\\Security ID**” and **“Enabled Privileges”** to see what was enabled. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. Also check the “**Target Account\\Security ID**” and **“Enabled Privileges”** to see what was enabled. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about.
                          Also check **“Target Account\\Security ID”** to see whether the change in privileges should be made on that computer for that account. | diff --git a/windows/security/threat-protection/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md index f78b83ef3c..d1d045bb0d 100644 --- a/windows/security/threat-protection/auditing/event-4704.md +++ b/windows/security/threat-protection/auditing/event-4704.md @@ -1,8 +1,8 @@ --- title: 4704(S) A user right was assigned. (Windows 10) -description: Describes security event 4704(S) A user right was assigned. +description: Describes security event 4704(S) A user right was assigned. This event is generated when a user right is assigned to an account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4704(S): A user right was assigned. @@ -152,7 +153,7 @@ For 4704(S): A user right was assigned. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\ Account Name**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist. Also check the “**Target Account\\Account Name**” and **“New Right”** to see what was enabled. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. Also check the “**Target Account\\Account Name**” and **“New Right”** to see what was enabled. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about.
                          Also check **“Target Account\\ Account Name”** to see whether the change in rights should be made on that computer for that account. | diff --git a/windows/security/threat-protection/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md index 09c240e026..317b3b23fb 100644 --- a/windows/security/threat-protection/auditing/event-4705.md +++ b/windows/security/threat-protection/auditing/event-4705.md @@ -1,8 +1,8 @@ --- title: 4705(S) A user right was removed. (Windows 10) -description: Describes security event 4705(S) A user right was removed. +description: Describes security event 4705(S) A user right was removed. This event is generated when a user right is removed from an account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4705(S): A user right was removed. @@ -151,7 +152,7 @@ For 4705(S): A user right was removed. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\Account Name**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist.
                          If you have specific user rights policies, for example, a whitelist of accounts that can perform certain actions, monitor this event to confirm that it was appropriate that the “**Removed Right**” was removed from “**Target** **Account\\Account Name**.” | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
                          If you have specific user rights policies, for example, an allow list of accounts that can perform certain actions, monitor this event to confirm that it was appropriate that the “**Removed Right**” was removed from “**Target** **Account\\Account Name**.” | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** and “**Target Account\\Account Name”** to see whether the account type is as expected.
                          For example, if some accounts have critical user rights which should never be removed, monitor this event for the **“Target** **Account\\Account Name”** and the appropriate rights.
                          As another example, if non-administrative accounts should never be granted certain user rights (for example, **SeAuditPrivilege**), you might monitor this event, because a right can be removed only after it was previously granted. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. Also be sure to check “**Target Account\\Account Name**” to see whether user rights should be removed from that account (or whether that account should have any rights on that computer).
                          For high-value servers or other computers, we recommend that you track this event and investigate whether the specific “**Removed Right**” should be removed from “**Target** **Account\\Account Name**” in each case. | diff --git a/windows/security/threat-protection/auditing/event-4706.md b/windows/security/threat-protection/auditing/event-4706.md index c566c246bf..d39473364c 100644 --- a/windows/security/threat-protection/auditing/event-4706.md +++ b/windows/security/threat-protection/auditing/event-4706.md @@ -1,8 +1,8 @@ --- title: 4706(S) A new trust was created to a domain. (Windows 10) -description: Describes security event 4706(S) A new trust was created to a domain. +description: Describes security event 4706(S) A new trust was created to a domain. This event is generated when a new trust is created for a domain. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4706(S): A new trust was created to a domain. diff --git a/windows/security/threat-protection/auditing/event-4707.md b/windows/security/threat-protection/auditing/event-4707.md index f998718c41..f16f66bdcd 100644 --- a/windows/security/threat-protection/auditing/event-4707.md +++ b/windows/security/threat-protection/auditing/event-4707.md @@ -1,8 +1,8 @@ --- title: 4707(S) A trust to a domain was removed. (Windows 10) -description: Describes security event 4707(S) A trust to a domain was removed. +description: Describes security event 4707(S) A trust to a domain was removed. This event is generated when a domain trust is removed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4707(S): A trust to a domain was removed. diff --git a/windows/security/threat-protection/auditing/event-4713.md b/windows/security/threat-protection/auditing/event-4713.md index a4809630b7..3c7ada997e 100644 --- a/windows/security/threat-protection/auditing/event-4713.md +++ b/windows/security/threat-protection/auditing/event-4713.md @@ -1,8 +1,8 @@ --- title: 4713(S) Kerberos policy was changed. (Windows 10) -description: Describes security event 4713(S) Kerberos policy was changed. +description: Describes security event 4713(S) Kerberos policy was changed. This event is generated when Kerberos policy is changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4713(S): Kerberos policy was changed. diff --git a/windows/security/threat-protection/auditing/event-4714.md b/windows/security/threat-protection/auditing/event-4714.md index c81891ffc9..36dec3a969 100644 --- a/windows/security/threat-protection/auditing/event-4714.md +++ b/windows/security/threat-protection/auditing/event-4714.md @@ -2,7 +2,7 @@ title: 4714(S) Encrypted data recovery policy was changed. (Windows 10) description: Describes security event 4714(S) Encrypted data recovery policy was changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4714(S): Encrypted data recovery policy was changed. diff --git a/windows/security/threat-protection/auditing/event-4715.md b/windows/security/threat-protection/auditing/event-4715.md index c51f51c999..d4e9d14839 100644 --- a/windows/security/threat-protection/auditing/event-4715.md +++ b/windows/security/threat-protection/auditing/event-4715.md @@ -2,7 +2,7 @@ title: 4715(S) The audit policy (SACL) on an object was changed. (Windows 10) description: Describes security event 4715(S) The audit policy (SACL) on an object was changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4715(S): The audit policy (SACL) on an object was changed. diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md index 4ab122d7f1..35b1bfc9d2 100644 --- a/windows/security/threat-protection/auditing/event-4716.md +++ b/windows/security/threat-protection/auditing/event-4716.md @@ -2,7 +2,7 @@ title: 4716(S) Trusted domain information was modified. (Windows 10) description: Describes security event 4716(S) Trusted domain information was modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/04/2019 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4716(S): Trusted domain information was modified. diff --git a/windows/security/threat-protection/auditing/event-4717.md b/windows/security/threat-protection/auditing/event-4717.md index 13f2c744aa..ddbd9f66db 100644 --- a/windows/security/threat-protection/auditing/event-4717.md +++ b/windows/security/threat-protection/auditing/event-4717.md @@ -2,7 +2,7 @@ title: 4717(S) System security access was granted to an account. (Windows 10) description: Describes security event 4717(S) System security access was granted to an account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4717(S): System security access was granted to an account. @@ -126,7 +127,7 @@ For 4717(S): System security access was granted to an account. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and “**Account Modified\\Account Name”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist.
                          If you have specific user logon rights policies, for example, a whitelist of accounts that can log on to certain computers, monitor this event to confirm that any “**Access Right**” was granted only to the appropriate “**Account Modified\\Account Name**.” | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
                          If you have specific user logon rights policies, for example, an allow list of accounts that can log on to certain computers, monitor this event to confirm that any “**Access Right**” was granted only to the appropriate “**Account Modified\\Account Name**.” | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** and “**Account Modified\\Account Name”** to see whether the account type is as expected.
                          For example, if non-service accounts should never be granted certain logon rights (for example, **SeServiceLogonRight**), monitor this event for those accounts and rights. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. Also be sure to check “**Account Modified\\Account Name**” to see whether logon rights should be granted to that account.
                          For high-value servers or other computers, we recommend that you track this event and investigate whether the specific “**Access Right**” should be granted to “**Account Modified\\Account Name**” in each case. | diff --git a/windows/security/threat-protection/auditing/event-4718.md b/windows/security/threat-protection/auditing/event-4718.md index 9bb398d835..0e7892c9c8 100644 --- a/windows/security/threat-protection/auditing/event-4718.md +++ b/windows/security/threat-protection/auditing/event-4718.md @@ -2,7 +2,7 @@ title: 4718(S) System security access was removed from an account. (Windows 10) description: Describes security event 4718(S) System security access was removed from an account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4718(S): System security access was removed from an account. @@ -126,7 +127,7 @@ For 4718(S): System security access was removed from an account. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and “**Account Modified\\Account Name”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist.
                          If you have specific user logon rights policies, for example, a whitelist of accounts that can log on to certain computers, monitor this event to confirm that it was appropriate that the “**Access Right**” was removed from “**Account Modified\\Account Name**.” | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
                          If you have specific user logon rights policies, for example, an allow list of accounts that can log on to certain computers, monitor this event to confirm that it was appropriate that the “**Access Right**” was removed from “**Account Modified\\Account Name**.” | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** and “**Account Modified\\Account Name”** to see whether the account type is as expected.
                          For example, if critical remote network service accounts have user logon rights which should never be removed (for example, **SeNetworkLogonRight**), monitor this event for the **“Account Modified\\Account Name”** and the appropriate rights.
                          As another example, if non-service accounts should never be granted certain logon rights (for example, **SeServiceLogonRight**), you might monitor this event, because a right can be removed only after it was previously granted. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. Also be sure to check “**Account Modified\\Account Name**” to see whether logon rights should be removed from that account.
                          For high-value servers or other computers, we recommend that you track this event and investigate whether the specific “**Access Right**” should be removed from “**Account Modified\\Account Name**” in each case. | diff --git a/windows/security/threat-protection/auditing/event-4719.md b/windows/security/threat-protection/auditing/event-4719.md index 4498dfe0fc..98469b6945 100644 --- a/windows/security/threat-protection/auditing/event-4719.md +++ b/windows/security/threat-protection/auditing/event-4719.md @@ -1,8 +1,8 @@ --- title: 4719(S) System audit policy was changed. (Windows 10) -description: Describes security event 4719(S) System audit policy was changed. +description: Describes security event 4719(S) System audit policy was changed. This event is generated when the computer audit policy changes. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4719(S): System audit policy was changed. diff --git a/windows/security/threat-protection/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md index fffcee9e09..1569aebb53 100644 --- a/windows/security/threat-protection/auditing/event-4720.md +++ b/windows/security/threat-protection/auditing/event-4720.md @@ -1,8 +1,8 @@ --- title: 4720(S) A user account was created. (Windows 10) -description: Describes security event 4720(S) A user account was created. +description: Describes security event 4720(S) A user account was created. This event is generated a user object is created. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4720(S): A user account was created. diff --git a/windows/security/threat-protection/auditing/event-4722.md b/windows/security/threat-protection/auditing/event-4722.md index 2029ba7eae..e156a9bedf 100644 --- a/windows/security/threat-protection/auditing/event-4722.md +++ b/windows/security/threat-protection/auditing/event-4722.md @@ -1,8 +1,8 @@ --- title: 4722(S) A user account was enabled. (Windows 10) -description: Describes security event 4722(S) A user account was enabled. +description: Describes security event 4722(S) A user account was enabled. This event is generated when a user or computer object is enabled. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4722(S): A user account was enabled. diff --git a/windows/security/threat-protection/auditing/event-4723.md b/windows/security/threat-protection/auditing/event-4723.md index 4622d802a2..8a2eb1aa9b 100644 --- a/windows/security/threat-protection/auditing/event-4723.md +++ b/windows/security/threat-protection/auditing/event-4723.md @@ -2,7 +2,7 @@ title: 4723(S, F) An attempt was made to change an account's password. (Windows 10) description: Describes security event 4723(S, F) An attempt was made to change an account's password. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4723(S, F): An attempt was made to change an account's password. diff --git a/windows/security/threat-protection/auditing/event-4724.md b/windows/security/threat-protection/auditing/event-4724.md index 3d9bbc1a0d..f360a13828 100644 --- a/windows/security/threat-protection/auditing/event-4724.md +++ b/windows/security/threat-protection/auditing/event-4724.md @@ -2,7 +2,7 @@ title: 4724(S, F) An attempt was made to reset an account's password. (Windows 10) description: Describes security event 4724(S, F) An attempt was made to reset an account's password. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4724(S, F): An attempt was made to reset an account's password. diff --git a/windows/security/threat-protection/auditing/event-4725.md b/windows/security/threat-protection/auditing/event-4725.md index e1103b365e..5be795b261 100644 --- a/windows/security/threat-protection/auditing/event-4725.md +++ b/windows/security/threat-protection/auditing/event-4725.md @@ -1,8 +1,8 @@ --- title: 4725(S) A user account was disabled. (Windows 10) -description: Describes security event 4725(S) A user account was disabled. +description: Describes security event 4725(S) A user account was disabled. This event is generated when a user or computer object is disabled. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4725(S): A user account was disabled. diff --git a/windows/security/threat-protection/auditing/event-4726.md b/windows/security/threat-protection/auditing/event-4726.md index 5d48cc9ae6..f8f7ffba8c 100644 --- a/windows/security/threat-protection/auditing/event-4726.md +++ b/windows/security/threat-protection/auditing/event-4726.md @@ -1,8 +1,8 @@ --- title: 4726(S) A user account was deleted. (Windows 10) -description: Describes security event 4726(S) A user account was deleted. +description: Describes security event 4726(S) A user account was deleted. This event is generated when a user object is deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4726(S): A user account was deleted. diff --git a/windows/security/threat-protection/auditing/event-4731.md b/windows/security/threat-protection/auditing/event-4731.md index 5fcdcba641..78d8e0e0c8 100644 --- a/windows/security/threat-protection/auditing/event-4731.md +++ b/windows/security/threat-protection/auditing/event-4731.md @@ -2,7 +2,7 @@ title: 4731(S) A security-enabled local group was created. (Windows 10) description: Describes security event 4731(S) A security-enabled local group was created. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4731(S): A security-enabled local group was created. diff --git a/windows/security/threat-protection/auditing/event-4732.md b/windows/security/threat-protection/auditing/event-4732.md index 511b73b62c..94a84c0054 100644 --- a/windows/security/threat-protection/auditing/event-4732.md +++ b/windows/security/threat-protection/auditing/event-4732.md @@ -2,7 +2,7 @@ title: 4732(S) A member was added to a security-enabled local group. (Windows 10) description: Describes security event 4732(S) A member was added to a security-enabled local group. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4732(S): A member was added to a security-enabled local group. @@ -153,7 +154,7 @@ For 4732(S): A member was added to a security-enabled local group. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4733.md b/windows/security/threat-protection/auditing/event-4733.md index e7b90640ec..b23bf184d3 100644 --- a/windows/security/threat-protection/auditing/event-4733.md +++ b/windows/security/threat-protection/auditing/event-4733.md @@ -2,7 +2,7 @@ title: 4733(S) A member was removed from a security-enabled local group. (Windows 10) description: Describes security event 4733(S) A member was removed from a security-enabled local group. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4733(S): A member was removed from a security-enabled local group. @@ -160,7 +161,7 @@ For 4733(S): A member was removed from a security-enabled local group. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4734.md b/windows/security/threat-protection/auditing/event-4734.md index 5e439c5e46..144c20c935 100644 --- a/windows/security/threat-protection/auditing/event-4734.md +++ b/windows/security/threat-protection/auditing/event-4734.md @@ -2,7 +2,7 @@ title: 4734(S) A security-enabled local group was deleted. (Windows 10) description: Describes security event 4734(S) A security-enabled local group was deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4734(S): A security-enabled local group was deleted. diff --git a/windows/security/threat-protection/auditing/event-4735.md b/windows/security/threat-protection/auditing/event-4735.md index 07ff8c48cf..98843abaa0 100644 --- a/windows/security/threat-protection/auditing/event-4735.md +++ b/windows/security/threat-protection/auditing/event-4735.md @@ -2,7 +2,7 @@ title: 4735(S) A security-enabled local group was changed. (Windows 10) description: Describes security event 4735(S) A security-enabled local group was changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4735(S): A security-enabled local group was changed. diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index e9761cde7b..6262726e51 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -1,8 +1,8 @@ --- title: 4738(S) A user account was changed. (Windows 10) -description: Describes security event 4738(S) A user account was changed. +description: Describes security event 4738(S) A user account was changed. This event is generated when a user object is changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4738(S): A user account was changed. @@ -32,7 +33,7 @@ This event generates on domain controllers, member servers, and workstations. For each change, a separate 4738 event will be generated. -You might see this event without any changes inside, that is, where all **Changed Attributes** apear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, if the [discretionary access control list](https://msdn.microsoft.com/library/windows/desktop/aa374872(v=vs.85).aspx) (DACL) is changed, a 4738 event will generate, but all attributes will be “-“. +You might see this event without any changes inside, that is, where all **Changed Attributes** appear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, if the [discretionary access control list](https://msdn.microsoft.com/library/windows/desktop/aa374872(v=vs.85).aspx) (DACL) is changed, a 4738 event will generate, but all attributes will be “-“. Some changes do not invoke a 4738 event. diff --git a/windows/security/threat-protection/auditing/event-4739.md b/windows/security/threat-protection/auditing/event-4739.md index 9d9732a82c..900d034c18 100644 --- a/windows/security/threat-protection/auditing/event-4739.md +++ b/windows/security/threat-protection/auditing/event-4739.md @@ -1,8 +1,8 @@ --- title: 4739(S) Domain Policy was changed. (Windows 10) -description: Describes security event 4739(S) Domain Policy was changed. +description: Describes security event 4739(S) Domain Policy was changed. This event is generated when certain changes are made to the local computer security policy. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4739(S): Domain Policy was changed. diff --git a/windows/security/threat-protection/auditing/event-4740.md b/windows/security/threat-protection/auditing/event-4740.md index 95cdfe7ee6..db7139e935 100644 --- a/windows/security/threat-protection/auditing/event-4740.md +++ b/windows/security/threat-protection/auditing/event-4740.md @@ -1,8 +1,8 @@ --- title: 4740(S) A user account was locked out. (Windows 10) -description: Describes security event 4740(S) A user account was locked out. +description: Describes security event 4740(S) A user account was locked out. This event is generated every time a user account is locked out. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4740(S): A user account was locked out. diff --git a/windows/security/threat-protection/auditing/event-4741.md b/windows/security/threat-protection/auditing/event-4741.md index ef907d69b0..466e46e06b 100644 --- a/windows/security/threat-protection/auditing/event-4741.md +++ b/windows/security/threat-protection/auditing/event-4741.md @@ -1,8 +1,8 @@ --- title: 4741(S) A computer account was created. (Windows 10) -description: Describes security event 4741(S) A computer account was created. +description: Describes security event 4741(S) A computer account was created. This event is generated every time a computer object is created. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4741(S): A computer account was created. @@ -242,7 +243,7 @@ So this UAC flags value decodes to: LOCKOUT and SCRIPT - **DNS Host Name** \[Type = UnicodeString\]: name of computer account as registered in DNS. The value of **dNSHostName** attribute of new computer object. For manually created computer account objects this field has value “**-**“. -- **Service Principal Names** \[Type = UnicodeString\]**:** The list of SPNs, registered for computer account. For new computer accounts it will typically contain HOST SPNs and RestrictedKrbHost SPNs. The value of **servicePrincipalName** attribute of new computer object. For manually created computer objects it is typically equals “**-**“. This is an example of **Service Principal Names** field for new domain joined workstation: +- **Service Principal Names** \[Type = UnicodeString\]**:** The list of SPNs, registered for computer account. For new computer accounts it will typically contain HOST SPNs and RestrictedKrbHost SPNs. The value of **servicePrincipalName** attribute of new computer object. For manually created computer objects it is typically equals “**-**“. This is an example of **Service Principal Names** field for new domain joined workstation: HOST/Win81.contoso.local diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md index b39135ee00..c692aef6e1 100644 --- a/windows/security/threat-protection/auditing/event-4742.md +++ b/windows/security/threat-protection/auditing/event-4742.md @@ -1,8 +1,8 @@ --- title: 4742(S) A computer account was changed. (Windows 10) -description: Describes security event 4742(S) A computer account was changed. +description: Describes security event 4742(S) A computer account was changed. This event is generated every time a computer object is changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4742(S): A computer account was changed. @@ -36,7 +37,7 @@ For each change, a separate 4742 event will be generated. Some changes do not invoke a 4742 event, for example, changes made using Active Directory Users and Computers management console in **Managed By** tab in computer account properties. -You might see this event without any changes inside, that is, where all **Changed Attributes** apear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, this would happen if you change the **Description** of a group object using the Active Directory Users and Computers administrative console. Also, if the [discretionary access control list](https://msdn.microsoft.com/library/windows/desktop/aa374872(v=vs.85).aspx) (DACL) is changed, a 4742 event will generate, but all attributes will be “-“. +You might see this event without any changes inside, that is, where all **Changed Attributes** appear as “-“. This usually happens when a change is made to an attribute that is not listed in the event. In this case there is no way to determine which attribute was changed. For example, this would happen if you change the **Description** of a group object using the Active Directory Users and Computers administrative console. Also, if the [discretionary access control list](https://msdn.microsoft.com/library/windows/desktop/aa374872(v=vs.85).aspx) (DACL) is changed, a 4742 event will generate, but all attributes will be “-“. ***Important*:** If you manually change any user-related setting or attribute, for example if you set the SMARTCARD\_REQUIRED flag in **userAccountControl** for the computer account, then the **sAMAccountType** of the computer account will be changed to NORMAL\_USER\_ACCOUNT and you will get “[4738](event-4738.md): A user account was changed” instead of 4742 for this computer account. Essentially, the computer account will “become” a user account. For NORMAL\_USER\_ACCOUNT you will always get events from [Audit User Account Management](audit-user-account-management.md) subcategory. We strongly recommend that you avoid changing any user-related settings manually for computer objects. @@ -243,7 +244,7 @@ So this UAC flags value decodes to: LOCKOUT and SCRIPT - **Service Principal Names** \[Type = UnicodeString\]**:** The list of SPNs, registered for computer account. If the SPN list of a computer account changed, you will see the new SPN list in **Service Principal Names** field (note that you will see the new list instead of changes). If the value of **servicePrincipalName** attribute of computer object was changed, you will see the new value here. - Here is an example of **Service Principal Names** field for new domain joined workstation in event 4742 on domain controller, after workstation reboots: + Here is an example of **Service Principal Names** field for new domain joined workstation in event 4742 on domain controller, after workstation reboots: HOST/Win81.contoso.local diff --git a/windows/security/threat-protection/auditing/event-4743.md b/windows/security/threat-protection/auditing/event-4743.md index 3fc25787d1..3402a5e1d7 100644 --- a/windows/security/threat-protection/auditing/event-4743.md +++ b/windows/security/threat-protection/auditing/event-4743.md @@ -1,8 +1,8 @@ --- title: 4743(S) A computer account was deleted. (Windows 10) -description: Describes security event 4743(S) A computer account was deleted. +description: Describes security event 4743(S) A computer account was deleted. This event is generated every time a computer object is deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4743(S): A computer account was deleted. diff --git a/windows/security/threat-protection/auditing/event-4749.md b/windows/security/threat-protection/auditing/event-4749.md index cb2cbe96a6..478ae9e021 100644 --- a/windows/security/threat-protection/auditing/event-4749.md +++ b/windows/security/threat-protection/auditing/event-4749.md @@ -2,7 +2,7 @@ title: 4749(S) A security-disabled global group was created. (Windows 10) description: Describes security event 4749(S) A security-disabled global group was created. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4749(S): A security-disabled global group was created. diff --git a/windows/security/threat-protection/auditing/event-4750.md b/windows/security/threat-protection/auditing/event-4750.md index 7d5ba9d12e..4bdfe79f69 100644 --- a/windows/security/threat-protection/auditing/event-4750.md +++ b/windows/security/threat-protection/auditing/event-4750.md @@ -2,7 +2,7 @@ title: 4750(S) A security-disabled global group was changed. (Windows 10) description: Describes security event 4750(S) A security-disabled global group was changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4750(S): A security-disabled global group was changed. diff --git a/windows/security/threat-protection/auditing/event-4751.md b/windows/security/threat-protection/auditing/event-4751.md index 3d070ae403..c86b86e123 100644 --- a/windows/security/threat-protection/auditing/event-4751.md +++ b/windows/security/threat-protection/auditing/event-4751.md @@ -2,7 +2,7 @@ title: 4751(S) A member was added to a security-disabled global group. (Windows 10) description: Describes security event 4751(S) A member was added to a security-disabled global group. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4751(S): A member was added to a security-disabled global group. @@ -157,7 +158,7 @@ For 4751(S): A member was added to a security-disabled global group. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4752.md b/windows/security/threat-protection/auditing/event-4752.md index 63d0425219..791b2886aa 100644 --- a/windows/security/threat-protection/auditing/event-4752.md +++ b/windows/security/threat-protection/auditing/event-4752.md @@ -2,7 +2,7 @@ title: 4752(S) A member was removed from a security-disabled global group. (Windows 10) description: Describes security event 4752(S) A member was removed from a security-disabled global group. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4752(S): A member was removed from a security-disabled global group. @@ -148,7 +149,7 @@ For 4752(S): A member was removed from a security-disabled global group. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4753.md b/windows/security/threat-protection/auditing/event-4753.md index 0eef2ab038..501018ce26 100644 --- a/windows/security/threat-protection/auditing/event-4753.md +++ b/windows/security/threat-protection/auditing/event-4753.md @@ -2,7 +2,7 @@ title: 4753(S) A security-disabled global group was deleted. (Windows 10) description: Describes security event 4753(S) A security-disabled global group was deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4753(S): A security-disabled global group was deleted. diff --git a/windows/security/threat-protection/auditing/event-4764.md b/windows/security/threat-protection/auditing/event-4764.md index 28f41dff94..1697b853f9 100644 --- a/windows/security/threat-protection/auditing/event-4764.md +++ b/windows/security/threat-protection/auditing/event-4764.md @@ -1,8 +1,8 @@ --- title: 4764(S) A group's type was changed. (Windows 10) -description: Describes security event 4764(S) A group’s type was changed. +description: Describes security event 4764(S) A group's type was changed. This event is generated when the type of a group is changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4764(S): A group’s type was changed. diff --git a/windows/security/threat-protection/auditing/event-4765.md b/windows/security/threat-protection/auditing/event-4765.md index c5310d9f72..3a23558650 100644 --- a/windows/security/threat-protection/auditing/event-4765.md +++ b/windows/security/threat-protection/auditing/event-4765.md @@ -1,8 +1,8 @@ --- title: 4765(S) SID History was added to an account. (Windows 10) -description: Describes security event 4765(S) SID History was added to an account. +description: Describes security event 4765(S) SID History was added to an account. This event is generated when SID History is added to an account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4765(S): SID History was added to an account. diff --git a/windows/security/threat-protection/auditing/event-4766.md b/windows/security/threat-protection/auditing/event-4766.md index d8dab9d004..afac5f0fe1 100644 --- a/windows/security/threat-protection/auditing/event-4766.md +++ b/windows/security/threat-protection/auditing/event-4766.md @@ -2,7 +2,7 @@ title: 4766(F) An attempt to add SID History to an account failed. (Windows 10) description: Describes security event 4766(F) An attempt to add SID History to an account failed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4766(F): An attempt to add SID History to an account failed. diff --git a/windows/security/threat-protection/auditing/event-4767.md b/windows/security/threat-protection/auditing/event-4767.md index e5f3f71068..cf7b13e4f0 100644 --- a/windows/security/threat-protection/auditing/event-4767.md +++ b/windows/security/threat-protection/auditing/event-4767.md @@ -1,8 +1,8 @@ --- title: 4767(S) A user account was unlocked. (Windows 10) -description: Describes security event 4767(S) A user account was unlocked. +description: Describes security event 4767(S) A user account was unlocked. This event is generated every time a user account is unlocked. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4767(S): A user account was unlocked. diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index 74e6e22b45..22df11d465 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -2,7 +2,7 @@ title: 4768(S, F) A Kerberos authentication ticket (TGT) was requested. (Windows 10) description: Describes security event 4768(S, F) A Kerberos authentication ticket (TGT) was requested. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4768(S, F): A Kerberos authentication ticket (TGT) was requested. @@ -304,13 +305,13 @@ For 4768(S, F): A Kerberos authentication ticket (TGT) was requested. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“User ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“User ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“User ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“User ID”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“User ID”** for accounts that are outside the allow list. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Supplied Realm Name”** corresponding to another domain or “external” location. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**User ID”** for names that don’t comply with naming conventions. | - You can track all [4768](event-4768.md) events where the **Client Address** is not from your internal IP range or not from private IP ranges. -- If you know that **Account Name** should be used only from known list of IP addresses, track all **Client Address** values for this **Account Name** in [4768](event-4768.md) events. If **Client Address** is not from the whitelist, generate the alert. +- If you know that **Account Name** should be used only from known list of IP addresses, track all **Client Address** values for this **Account Name** in [4768](event-4768.md) events. If **Client Address** is not from the allow list, generate the alert. - All **Client Address** = ::1 means local authentication. If you know the list of accounts which should log on to the domain controllers, then you need to monitor for all possible violations, where **Client Address** = ::1 and **Account Name** is not allowed to log on to any domain controller. diff --git a/windows/security/threat-protection/auditing/event-4769.md b/windows/security/threat-protection/auditing/event-4769.md index 199a11849a..522068cbbb 100644 --- a/windows/security/threat-protection/auditing/event-4769.md +++ b/windows/security/threat-protection/auditing/event-4769.md @@ -2,7 +2,7 @@ title: 4769(S, F) A Kerberos service ticket was requested. (Windows 10) description: Describes security event 4769(S, F) A Kerberos service ticket was requested. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4769(S, F): A Kerberos service ticket was requested. @@ -280,9 +281,9 @@ For 4769(S, F): A Kerberos service ticket was requested. - You can track all [4769](event-4769.md) events where the **Client Address** is not from your internal IP range or not from private IP ranges. -- If you know that **Account Name** should be able to request tickets (should be used) only from a known whitelist of IP addresses, track all **Client Address** values for this **Account Name** in [4769](event-4769.md) events. If **Client Address** is not from your whitelist of IP addresses, generate the alert. +- If you know that **Account Name** should be able to request tickets (should be used) only from a known allow list of IP addresses, track all **Client Address** values for this **Account Name** in [4769](event-4769.md) events. If **Client Address** is not from your allow list of IP addresses, generate the alert. -- All **Client Address** = ::1 means local TGS requests, which means that the **Account Name** logged on to a domain controller before making the TGS request. If you have a whitelist of accounts allowed to log on to domain controllers, monitor events with **Client Address** = ::1 and any **Account Name** outside the whitelist. +- All **Client Address** = ::1 means local TGS requests, which means that the **Account Name** logged on to a domain controller before making the TGS request. If you have an allow list of accounts allowed to log on to domain controllers, monitor events with **Client Address** = ::1 and any **Account Name** outside the allow list. - All [4769](event-4769.md) events with **Client Port** field value > 0 and < 1024 should be examined, because a well-known port was used for outbound connection. diff --git a/windows/security/threat-protection/auditing/event-4770.md b/windows/security/threat-protection/auditing/event-4770.md index 0085dcf3ff..8ec543b090 100644 --- a/windows/security/threat-protection/auditing/event-4770.md +++ b/windows/security/threat-protection/auditing/event-4770.md @@ -2,7 +2,7 @@ title: 4770(S) A Kerberos service ticket was renewed. (Windows 10) description: Describes security event 4770(S) A Kerberos service ticket was renewed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4770(S): A Kerberos service ticket was renewed. diff --git a/windows/security/threat-protection/auditing/event-4771.md b/windows/security/threat-protection/auditing/event-4771.md index f97c972551..840d05eefb 100644 --- a/windows/security/threat-protection/auditing/event-4771.md +++ b/windows/security/threat-protection/auditing/event-4771.md @@ -1,16 +1,17 @@ --- title: 4771(F) Kerberos pre-authentication failed. (Windows 10) -description: Describes security event 4771(F) Kerberos pre-authentication failed. +description: Describes security event 4771(F) Kerberos pre-authentication failed. This event is generated when the Key Distribution Center fails to issue a Kerberos TGT. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp -ms.date: 04/19/2017 +ms.date: 07/23/2020 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4771(F): Kerberos pre-authentication failed. @@ -26,7 +27,7 @@ ms.author: dansimp ***Event Description:*** -This event generates every time the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). This can occur when a domain controller doesn’t have a certificate installed for smart card authentication (for example, with a “Domain Controller” or “Domain Controller Authentication” template), the user’s password has expired, or the wrong password was provided. +This event generates every time the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). This problem can occur when a domain controller doesn’t have a certificate installed for smart card authentication (for example, with a “Domain Controller” or “Domain Controller Authentication” template), the user’s password has expired, or the wrong password was provided. This event generates only on domain controllers. @@ -103,7 +104,7 @@ This event is not generated if “Do not require Kerberos preauthentication” o **Network Information:** -- **Client Address** \[Type = UnicodeString\]**:** IP address of the computer from which the TGT request was received. Formats vary, and include the following: +- **Client Address** \[Type = UnicodeString\]**:** IP address of the computer from which the TGT request was received. Here are some examples of formats: - **IPv6** or **IPv4** address. @@ -117,7 +118,7 @@ This event is not generated if “Do not require Kerberos preauthentication” o **Additional Information:** -- **Ticket Options**: \[Type = HexInt32\]: this is a set of different Ticket Flags in hexadecimal format. +- **Ticket Options**: \[Type = HexInt32\]: this set of different Ticket Flags is in hexadecimal format. Example: @@ -125,7 +126,7 @@ This event is not generated if “Do not require Kerberos preauthentication” o - Binary view: 01000000100000010000000000010000 - - Using **MSB 0** bit numbering we have bit 1, 8, 15 and 27 set = Forwardable, Renewable, Canonicalize, Renewable-ok. + - Using **MSB 0**-bit numbering, we have bit 1, 8, 15 and 27 set = Forwardable, Renewable, Canonicalize, Renewable-ok. > **Note**  In the table below **“MSB 0”** bit numbering is used, because RFC documents use this style. In “MSB 0” style bit numbering begins from left.
                          MSB illustration @@ -146,15 +147,15 @@ The most common values: | 4 | Proxy | Indicates that the network address in the ticket is different from the one in the TGT used to obtain the ticket. | | 5 | Allow-postdate | Postdated tickets SHOULD NOT be supported in [KILE](https://msdn.microsoft.com/library/cc233855.aspx) (Microsoft Kerberos Protocol Extension). | | 6 | Postdated | Postdated tickets SHOULD NOT be supported in [KILE](https://msdn.microsoft.com/library/cc233855.aspx) (Microsoft Kerberos Protocol Extension). | -| 7 | Invalid | This flag indicates that a ticket is invalid, and it must be validated by the KDC before use. Application servers must reject tickets which have this flag set. | +| 7 | Invalid | This flag indicates that a ticket is invalid, and it must be validated by the KDC before use. Application servers must reject tickets that have this flag set. | | 8 | Renewable | Used in combination with the End Time and Renew Till fields to cause tickets with long life spans to be renewed at the KDC periodically. | | 9 | Initial | Indicates that a ticket was issued using the authentication service (AS) exchange and not issued based on a TGT. | | 10 | Pre-authent | Indicates that the client was authenticated by the KDC before a ticket was issued. This flag usually indicates the presence of an authenticator in the ticket. It can also flag the presence of credentials taken from a smart card logon. | | 11 | Opt-hardware-auth | This flag was originally intended to indicate that hardware-supported authentication was used during pre-authentication. This flag is no longer recommended in the Kerberos V5 protocol. KDCs MUST NOT issue a ticket with this flag set. KDCs SHOULD NOT preserve this flag if it is set by another KDC. | | 12 | Transited-policy-checked | KILE MUST NOT check for transited domains on servers or a KDC. Application servers MUST ignore the TRANSITED-POLICY-CHECKED flag. | | 13 | Ok-as-delegate | The KDC MUST set the OK-AS-DELEGATE flag if the service account is trusted for delegation. | -| 14 | Request-anonymous | KILE not use this flag. | -| 15 | Name-canonicalize | In order to request referrals the Kerberos client MUST explicitly request the "canonicalize" KDC option for the AS-REQ or TGS-REQ. | +| 14 | Request-anonymous | KILE does not use this flag. | +| 15 | Name-canonicalize | To request referrals, the Kerberos client MUST explicitly request the "canonicalize" KDC option for the AS-REQ or TGS-REQ. | | 16-25 | Unused | - | | 26 | Disable-transited-check | By default the KDC will check the transited field of a TGT against the policy of the local realm before it will issue derivative tickets based on the TGT. If this flag is set in the request, checking of the transited field is disabled. Tickets issued without the performance of this check will be noted by the reset (0) value of the TRANSITED-POLICY-CHECKED flag, indicating to the application server that the transited field must be checked locally. KDCs are encouraged but not required to honor
                          the DISABLE-TRANSITED-CHECK option.
                          Should not be in use, because Transited-policy-checked flag is not supported by KILE. | | 27 | Renewable-ok | The RENEWABLE-OK option indicates that a renewable ticket will be acceptable if a ticket with the requested life cannot otherwise be provided, in which case a renewable ticket may be issued with a renew-till equal to the requested end time. The value of the renew-till field may still be limited by local limits, or limits selected by the individual principal or server. | @@ -169,11 +170,11 @@ The most common values: | Code | Code Name | Description | Possible causes | |------|--------------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0x10 | KDC\_ERR\_PADATA\_TYPE\_NOSUPP | KDC has no support for PADATA type (pre-authentication data) | Smart card logon is being attempted and the proper certificate cannot be located. This can happen because the wrong certification authority (CA) is being queried or the proper CA cannot be contacted in order to get Domain Controller or Domain Controller Authentication certificates for the domain controller.
                          It can also happen when a domain controller doesn’t have a certificate installed for smart cards (Domain Controller or Domain Controller Authentication templates). | +| 0x10 | KDC\_ERR\_PADATA\_TYPE\_NOSUPP | KDC has no support for PADATA type (pre-authentication data) | Smart card logon is being attempted and the proper certificate cannot be located. This problem can happen because the wrong certification authority (CA) is being queried or the proper CA cannot be contacted in order to get Domain Controller or Domain Controller Authentication certificates for the domain controller.
                          It can also happen when a domain controller doesn’t have a certificate installed for smart cards (Domain Controller or Domain Controller Authentication templates). | | 0x17 | KDC\_ERR\_KEY\_EXPIRED | Password has expired—change password to reset | The user’s password has expired. | | 0x18 | KDC\_ERR\_PREAUTH\_FAILED | Pre-authentication information was invalid | The wrong password was provided. | -- **Pre-Authentication Type** \[Type = UnicodeString\]: the code of [pre-Authentication](https://technet.microsoft.com/library/cc772815(v=ws.10).aspx) type which was used in TGT request. +- **Pre-Authentication Type** \[Type = UnicodeString\]: the code of [pre-Authentication](https://technet.microsoft.com/library/cc772815(v=ws.10).aspx) type that was used in TGT request. ## Table 5. Kerberos Pre-Authentication types. @@ -181,7 +182,7 @@ The most common values: | Type | Type Name | Description | |------|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 0 | - | Logon without Pre-Authentication. | -| 2 | PA-ENC-TIMESTAMP | This is a normal type for standard password authentication. | +| 2 | PA-ENC-TIMESTAMP | This type is normal for standard password authentication. | | 11 | PA-ETYPE-INFO | The ETYPE-INFO pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value.
                          Never saw this Pre-Authentication Type in Microsoft Active Directory environment. | | 15 | PA-PK-AS-REP\_OLD | Used for Smart Card logon authentication. | | 16 | PA-PK-AS-REQ | Request sent to KDC in Smart Card authentication scenarios.| @@ -193,7 +194,7 @@ The most common values: **Certificate Information:** -- **Certificate Issuer Name** \[Type = UnicodeString\]**:** the name of Certification Authority which issued smart card certificate. Populated in **Issued by** field in certificate. Always empty for [4771](event-4771.md) events. +- **Certificate Issuer Name** \[Type = UnicodeString\]**:** the name of Certification Authority that issued smart card certificate. Populated in **Issued by** field in certificate. Always empty for [4771](event-4771.md) events. - **Certificate Serial Number** \[Type = UnicodeString\]**:** smart card certificate’s serial number. Can be found in **Serial number** field in the certificate. Always empty for [4771](event-4771.md) events. @@ -208,14 +209,14 @@ For 4771(F): Kerberos pre-authentication failed. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Security ID”** for accounts that are outside the whitelist. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Security ID”** for accounts that are outside the allow list. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Subject\\Account Name”** for names that don’t comply with naming conventions. | - You can track all [4771](event-4771.md) events where the **Client Address** is not from your internal IP range or not from private IP ranges. -- If you know that **Account Name** should be used only from known list of IP addresses, track all **Client Address** values for this **Account Name** in [4771](event-4771.md) events. If **Client Address** is not from the whitelist, generate the alert. +- If you know that **Account Name** should be used only from known list of IP addresses, track all **Client Address** values for this **Account Name** in [4771](event-4771.md) events. If **Client Address** is not from the allow list, generate the alert. -- All **Client Address** = ::1 means local authentication. If you know the list of accounts which should log on to the domain controllers, then you need to monitor for all possible violations, where **Client Address** = ::1 and **Account Name** is not allowed to log on to any domain controller. +- All **Client Address** = ::1 means local authentication. If you know the list of accounts that should log on to the domain controllers, then you need to monitor for all possible violations, where **Client Address** = ::1 and **Account Name** is not allowed to log on to any domain controller. - All [4771](event-4771.md) events with **Client Port** field value > 0 and < 1024 should be examined, because a well-known port was used for outbound connection. @@ -226,6 +227,6 @@ For 4771(F): Kerberos pre-authentication failed. | **Pre-Authentication Type** | Value is **not 15** when account must use a smart card for authentication. For more information, see [Table 5. Kerberos Pre-Authentication types](#kerberos-preauthentication-types). | | **Pre-Authentication Type** | Value is **not 2** when only standard password authentication is in use in the organization. For more information, see [Table 5. Kerberos Pre-Authentication types](#kerberos-preauthentication-types). | | **Pre-Authentication Type** | Value is **not 138** when Kerberos Armoring is enabled for all Kerberos communications in the organization. For more information, see [Table 5. Kerberos Pre-Authentication types](#kerberos-preauthentication-types). | -| **Result Code** | **0x10** (KDC has no support for PADATA type (pre-authentication data)). This error can help you to more quickly identify smart-card related problems with Kerberos authentication. | -| **Result Code** | **0x18** ((Pre-authentication information was invalid), if you see, for example N events in last N minutes. This can be an indicator of brute-force attack on the account password, especially for highly critical accounts. | +| **Failure Code** | **0x10** (KDC has no support for PADATA type (pre-authentication data)). This error can help you to more quickly identify smart-card related problems with Kerberos authentication. | +| **Failure Code** | **0x18** ((Pre-authentication information was invalid), if you see, for example N events in last N minutes. This issue can indicate a brute-force attack on the account password, especially for highly critical accounts. | diff --git a/windows/security/threat-protection/auditing/event-4772.md b/windows/security/threat-protection/auditing/event-4772.md index 1119135008..2124b16bb1 100644 --- a/windows/security/threat-protection/auditing/event-4772.md +++ b/windows/security/threat-protection/auditing/event-4772.md @@ -2,7 +2,7 @@ title: 4772(F) A Kerberos authentication ticket request failed. (Windows 10) description: Describes security event 4772(F) A Kerberos authentication ticket request failed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4772(F): A Kerberos authentication ticket request failed. diff --git a/windows/security/threat-protection/auditing/event-4773.md b/windows/security/threat-protection/auditing/event-4773.md index 7a307bbea1..ba672478d8 100644 --- a/windows/security/threat-protection/auditing/event-4773.md +++ b/windows/security/threat-protection/auditing/event-4773.md @@ -2,7 +2,7 @@ title: 4773(F) A Kerberos service ticket request failed. (Windows 10) description: Describes security event 4773(F) A Kerberos service ticket request failed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4773(F): A Kerberos service ticket request failed. diff --git a/windows/security/threat-protection/auditing/event-4774.md b/windows/security/threat-protection/auditing/event-4774.md index df9ff558e3..08eb0fe72f 100644 --- a/windows/security/threat-protection/auditing/event-4774.md +++ b/windows/security/threat-protection/auditing/event-4774.md @@ -1,8 +1,8 @@ --- title: 4774(S, F) An account was mapped for logon. (Windows 10) -description: Describes security event 4774(S, F) An account was mapped for logon. +description: Describes security event 4774(S, F) An account was mapped for logon. This event is generated when an account is mapped for logon. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4774(S, F): An account was mapped for logon. diff --git a/windows/security/threat-protection/auditing/event-4775.md b/windows/security/threat-protection/auditing/event-4775.md index e444e1c1bd..cf27ccdf2a 100644 --- a/windows/security/threat-protection/auditing/event-4775.md +++ b/windows/security/threat-protection/auditing/event-4775.md @@ -2,7 +2,7 @@ title: 4775(F) An account could not be mapped for logon. (Windows 10) description: Describes security event 4775(F) An account could not be mapped for logon. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4775(F): An account could not be mapped for logon. diff --git a/windows/security/threat-protection/auditing/event-4776.md b/windows/security/threat-protection/auditing/event-4776.md index 895d43226c..18bd592d00 100644 --- a/windows/security/threat-protection/auditing/event-4776.md +++ b/windows/security/threat-protection/auditing/event-4776.md @@ -2,7 +2,7 @@ title: 4776(S, F) The computer attempted to validate the credentials for an account. (Windows 10) description: Describes security event 4776(S, F) The computer attempted to validate the credentials for an account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4776(S, F): The computer attempted to validate the credentials for an account. @@ -129,7 +130,7 @@ For 4776(S, F): The computer attempted to validate the credentials for an accoun | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Logon Account”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Logon Account”** value (with other information) to monitor how or when a particular account is being used.
                          To monitor activity of specific user accounts outside of working hours, monitor the appropriate **Logon Account + Source Workstation** pairs. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Logon Account”** that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Logon Account”** for accounts that are outside the whitelist. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Logon Account”** for accounts that are outside the allow list. | | **Restricted-use computers**: You might have certain computers from which certain people (accounts) should not log on. | Monitor the target **Source Workstation** for credential validation requests from the **“Logon Account”** that you are concerned about. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Logon Account”** for names that don’t comply with naming conventions. | diff --git a/windows/security/threat-protection/auditing/event-4777.md b/windows/security/threat-protection/auditing/event-4777.md index 4cdf40b163..28a4b42d08 100644 --- a/windows/security/threat-protection/auditing/event-4777.md +++ b/windows/security/threat-protection/auditing/event-4777.md @@ -2,7 +2,7 @@ title: 4777(F) The domain controller failed to validate the credentials for an account. (Windows 10) description: Describes security event 4777(F) The domain controller failed to validate the credentials for an account. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4777(F): The domain controller failed to validate the credentials for an account. diff --git a/windows/security/threat-protection/auditing/event-4778.md b/windows/security/threat-protection/auditing/event-4778.md index 92d5783c67..53c1eac2d8 100644 --- a/windows/security/threat-protection/auditing/event-4778.md +++ b/windows/security/threat-protection/auditing/event-4778.md @@ -2,7 +2,7 @@ title: 4778(S) A session was reconnected to a Window Station. (Windows 10) description: Describes security event 4778(S) A session was reconnected to a Window Station. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4778(S): A session was reconnected to a Window Station. @@ -126,7 +127,7 @@ For 4778(S): A session was reconnected to a Window Station. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Account Name”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Account Name”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Account Name”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Account Name”** for accounts that are outside the whitelist. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Account Name”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Account Name”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Account Name”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4779.md b/windows/security/threat-protection/auditing/event-4779.md index a5a3de2a56..76337cfdf8 100644 --- a/windows/security/threat-protection/auditing/event-4779.md +++ b/windows/security/threat-protection/auditing/event-4779.md @@ -2,7 +2,7 @@ title: 4779(S) A session was disconnected from a Window Station. (Windows 10) description: Describes security event 4779(S) A session was disconnected from a Window Station. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4779(S): A session was disconnected from a Window Station. @@ -130,7 +131,7 @@ For 4779(S): A session was disconnected from a Window Station. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
                          Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Account Name”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Account Name”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Account Name”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific whitelist of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Account Name”** for accounts that are outside the whitelist. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Account Name”** for accounts that are outside the whitelist. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Account Name”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions.
                          For example, you might have computers to which connections should not be made from certain accounts or addresses. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Account Name”** that you are concerned about.
                          If you have a target **Computer:** (or other target device) to which connections should not be made from certain accounts or addresses, monitor this event for the corresponding **Client Name** or **Client Address**. | diff --git a/windows/security/threat-protection/auditing/event-4780.md b/windows/security/threat-protection/auditing/event-4780.md index 4a521896e8..dafa5d3ff1 100644 --- a/windows/security/threat-protection/auditing/event-4780.md +++ b/windows/security/threat-protection/auditing/event-4780.md @@ -2,7 +2,7 @@ title: 4780(S) The ACL was set on accounts which are members of administrators groups. (Windows 10) description: Describes security event 4780(S) The ACL was set on accounts which are members of administrators groups. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4780(S): The ACL was set on accounts which are members of administrators groups. diff --git a/windows/security/threat-protection/auditing/event-4781.md b/windows/security/threat-protection/auditing/event-4781.md index 042f226a20..2adb3bcac5 100644 --- a/windows/security/threat-protection/auditing/event-4781.md +++ b/windows/security/threat-protection/auditing/event-4781.md @@ -1,8 +1,8 @@ --- title: 4781(S) The name of an account was changed. (Windows 10) -description: Describes security event 4781(S) The name of an account was changed. +description: Describes security event 4781(S) The name of an account was changed. This event is generated every time a user or computer account name is changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4781(S): The name of an account was changed. diff --git a/windows/security/threat-protection/auditing/event-4782.md b/windows/security/threat-protection/auditing/event-4782.md index 571fdf3a93..a7907aed15 100644 --- a/windows/security/threat-protection/auditing/event-4782.md +++ b/windows/security/threat-protection/auditing/event-4782.md @@ -2,7 +2,7 @@ title: 4782(S) The password hash of an account was accessed. (Windows 10) description: Describes security event 4782(S) The password hash of an account was accessed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4782(S): The password hash of an account was accessed. diff --git a/windows/security/threat-protection/auditing/event-4793.md b/windows/security/threat-protection/auditing/event-4793.md index f2bdc2b09f..d6fecbdbdf 100644 --- a/windows/security/threat-protection/auditing/event-4793.md +++ b/windows/security/threat-protection/auditing/event-4793.md @@ -2,7 +2,7 @@ title: 4793(S) The Password Policy Checking API was called. (Windows 10) description: Describes security event 4793(S) The Password Policy Checking API was called. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4793(S): The Password Policy Checking API was called. diff --git a/windows/security/threat-protection/auditing/event-4794.md b/windows/security/threat-protection/auditing/event-4794.md index 9ecf3cfcb7..6e585048c1 100644 --- a/windows/security/threat-protection/auditing/event-4794.md +++ b/windows/security/threat-protection/auditing/event-4794.md @@ -2,7 +2,7 @@ title: 4794(S, F) An attempt was made to set the Directory Services Restore Mode administrator password. (Windows 10) description: Describes security event 4794(S, F) An attempt was made to set the Directory Services Restore Mode administrator password. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4794(S, F): An attempt was made to set the Directory Services Restore Mode administrator password. diff --git a/windows/security/threat-protection/auditing/event-4798.md b/windows/security/threat-protection/auditing/event-4798.md index 76e806ffcf..3fddfd9b65 100644 --- a/windows/security/threat-protection/auditing/event-4798.md +++ b/windows/security/threat-protection/auditing/event-4798.md @@ -2,7 +2,7 @@ title: 4798(S) A user's local group membership was enumerated. (Windows 10) description: Describes security event 4798(S) A user's local group membership was enumerated. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4798(S): A user's local group membership was enumerated. diff --git a/windows/security/threat-protection/auditing/event-4799.md b/windows/security/threat-protection/auditing/event-4799.md index c9963afbb0..18b337fcdc 100644 --- a/windows/security/threat-protection/auditing/event-4799.md +++ b/windows/security/threat-protection/auditing/event-4799.md @@ -2,7 +2,7 @@ title: 4799(S) A security-enabled local group membership was enumerated. (Windows 10) description: Describes security event 4799(S) A security-enabled local group membership was enumerated. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4799(S): A security-enabled local group membership was enumerated. diff --git a/windows/security/threat-protection/auditing/event-4800.md b/windows/security/threat-protection/auditing/event-4800.md index e661f5ed3d..92c543f8b0 100644 --- a/windows/security/threat-protection/auditing/event-4800.md +++ b/windows/security/threat-protection/auditing/event-4800.md @@ -1,8 +1,8 @@ --- title: 4800(S) The workstation was locked. (Windows 10) -description: Describes security event 4800(S) The workstation was locked. +description: Describes security event 4800(S) The workstation was locked. This event is generated when a workstation is locked. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4800(S): The workstation was locked. diff --git a/windows/security/threat-protection/auditing/event-4801.md b/windows/security/threat-protection/auditing/event-4801.md index 937d79b878..ed7c8ec85c 100644 --- a/windows/security/threat-protection/auditing/event-4801.md +++ b/windows/security/threat-protection/auditing/event-4801.md @@ -1,8 +1,8 @@ --- title: 4801(S) The workstation was unlocked. (Windows 10) -description: Describes security event 4801(S) The workstation was unlocked. +description: Describes security event 4801(S) The workstation was unlocked. This event is generated when workstation is unlocked. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4801(S): The workstation was unlocked. diff --git a/windows/security/threat-protection/auditing/event-4802.md b/windows/security/threat-protection/auditing/event-4802.md index 41f5ba4f6e..9f5fa2b8e3 100644 --- a/windows/security/threat-protection/auditing/event-4802.md +++ b/windows/security/threat-protection/auditing/event-4802.md @@ -1,8 +1,8 @@ --- title: 4802(S) The screen saver was invoked. (Windows 10) -description: Describes security event 4802(S) The screen saver was invoked. +description: Describes security event 4802(S) The screen saver was invoked. This event is generated when screen saver is invoked. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4802(S): The screen saver was invoked. diff --git a/windows/security/threat-protection/auditing/event-4803.md b/windows/security/threat-protection/auditing/event-4803.md index c50d78d76c..20304e4527 100644 --- a/windows/security/threat-protection/auditing/event-4803.md +++ b/windows/security/threat-protection/auditing/event-4803.md @@ -1,8 +1,8 @@ --- title: 4803(S) The screen saver was dismissed. (Windows 10) -description: Describes security event 4803(S) The screen saver was dismissed. +description: Describes security event 4803(S) The screen saver was dismissed. This event is generated when screen saver is dismissed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4803(S): The screen saver was dismissed. diff --git a/windows/security/threat-protection/auditing/event-4816.md b/windows/security/threat-protection/auditing/event-4816.md index 1efa9756ec..9e36c52bb1 100644 --- a/windows/security/threat-protection/auditing/event-4816.md +++ b/windows/security/threat-protection/auditing/event-4816.md @@ -2,7 +2,7 @@ title: 4816(S) RPC detected an integrity violation while decrypting an incoming message. (Windows 10) description: Describes security event 4816(S) RPC detected an integrity violation while decrypting an incoming message. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4816(S): RPC detected an integrity violation while decrypting an incoming message. diff --git a/windows/security/threat-protection/auditing/event-4817.md b/windows/security/threat-protection/auditing/event-4817.md index efdf01da8a..48757706f8 100644 --- a/windows/security/threat-protection/auditing/event-4817.md +++ b/windows/security/threat-protection/auditing/event-4817.md @@ -2,7 +2,7 @@ title: 4817(S) Auditing settings on object were changed. (Windows 10) description: Describes security event 4817(S) Auditing settings on object were changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4817(S): Auditing settings on object were changed. diff --git a/windows/security/threat-protection/auditing/event-4818.md b/windows/security/threat-protection/auditing/event-4818.md index 1134b02c0b..7da8723ef4 100644 --- a/windows/security/threat-protection/auditing/event-4818.md +++ b/windows/security/threat-protection/auditing/event-4818.md @@ -2,7 +2,7 @@ title: 4818(S) Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy. (Windows 10) description: Describes security event 4818(S) Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4818(S): Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy. diff --git a/windows/security/threat-protection/auditing/event-4819.md b/windows/security/threat-protection/auditing/event-4819.md index c2de9d1e36..58fa2fcf24 100644 --- a/windows/security/threat-protection/auditing/event-4819.md +++ b/windows/security/threat-protection/auditing/event-4819.md @@ -2,7 +2,7 @@ title: 4819(S) Central Access Policies on the machine have been changed. (Windows 10) description: Describes security event 4819(S) Central Access Policies on the machine have been changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4819(S): Central Access Policies on the machine have been changed. diff --git a/windows/security/threat-protection/auditing/event-4826.md b/windows/security/threat-protection/auditing/event-4826.md index 4e45693aaa..29f4675931 100644 --- a/windows/security/threat-protection/auditing/event-4826.md +++ b/windows/security/threat-protection/auditing/event-4826.md @@ -1,8 +1,8 @@ --- title: 4826(S) Boot Configuration Data loaded. (Windows 10) -description: Describes security event 4826(S) Boot Configuration Data loaded. +description: Describes security event 4826(S) Boot Configuration Data loaded. This event is generated every time system starts and loads Boot Configuration Data settings. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4826(S): Boot Configuration Data loaded. diff --git a/windows/security/threat-protection/auditing/event-4864.md b/windows/security/threat-protection/auditing/event-4864.md index 62ced88fe8..ca1995291e 100644 --- a/windows/security/threat-protection/auditing/event-4864.md +++ b/windows/security/threat-protection/auditing/event-4864.md @@ -1,8 +1,8 @@ --- title: 4864(S) A namespace collision was detected. (Windows 10) -description: Describes security event 4864(S) A namespace collision was detected. +description: Describes security event 4864(S) A namespace collision was detected. This event is generated when a namespace collision is detected. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4864(S): A namespace collision was detected. diff --git a/windows/security/threat-protection/auditing/event-4865.md b/windows/security/threat-protection/auditing/event-4865.md index 15e738f7be..e1ff8e242a 100644 --- a/windows/security/threat-protection/auditing/event-4865.md +++ b/windows/security/threat-protection/auditing/event-4865.md @@ -2,7 +2,7 @@ title: 4865(S) A trusted forest information entry was added. (Windows 10) description: Describes security event 4865(S) A trusted forest information entry was added. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4865(S): A trusted forest information entry was added. diff --git a/windows/security/threat-protection/auditing/event-4866.md b/windows/security/threat-protection/auditing/event-4866.md index e0f05fbf3e..f189e60e01 100644 --- a/windows/security/threat-protection/auditing/event-4866.md +++ b/windows/security/threat-protection/auditing/event-4866.md @@ -2,7 +2,7 @@ title: 4866(S) A trusted forest information entry was removed. (Windows 10) description: Describes security event 4866(S) A trusted forest information entry was removed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4866(S): A trusted forest information entry was removed. diff --git a/windows/security/threat-protection/auditing/event-4867.md b/windows/security/threat-protection/auditing/event-4867.md index ae2bf03bb6..9635b1cd74 100644 --- a/windows/security/threat-protection/auditing/event-4867.md +++ b/windows/security/threat-protection/auditing/event-4867.md @@ -2,7 +2,7 @@ title: 4867(S) A trusted forest information entry was modified. (Windows 10) description: Describes security event 4867(S) A trusted forest information entry was modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4867(S): A trusted forest information entry was modified. diff --git a/windows/security/threat-protection/auditing/event-4902.md b/windows/security/threat-protection/auditing/event-4902.md index c8b89b375c..d5a7640b84 100644 --- a/windows/security/threat-protection/auditing/event-4902.md +++ b/windows/security/threat-protection/auditing/event-4902.md @@ -2,7 +2,7 @@ title: 4902(S) The Per-user audit policy table was created. (Windows 10) description: Describes security event 4902(S) The Per-user audit policy table was created. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4902(S): The Per-user audit policy table was created. diff --git a/windows/security/threat-protection/auditing/event-4904.md b/windows/security/threat-protection/auditing/event-4904.md index cfd3f1c0fe..d22ff00643 100644 --- a/windows/security/threat-protection/auditing/event-4904.md +++ b/windows/security/threat-protection/auditing/event-4904.md @@ -2,7 +2,7 @@ title: 4904(S) An attempt was made to register a security event source. (Windows 10) description: Describes security event 4904(S) An attempt was made to register a security event source. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4904(S): An attempt was made to register a security event source. diff --git a/windows/security/threat-protection/auditing/event-4905.md b/windows/security/threat-protection/auditing/event-4905.md index bfc9d5bbb9..aa98ea5517 100644 --- a/windows/security/threat-protection/auditing/event-4905.md +++ b/windows/security/threat-protection/auditing/event-4905.md @@ -2,7 +2,7 @@ title: 4905(S) An attempt was made to unregister a security event source. (Windows 10) description: Describes security event 4905(S) An attempt was made to unregister a security event source. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4905(S): An attempt was made to unregister a security event source. diff --git a/windows/security/threat-protection/auditing/event-4906.md b/windows/security/threat-protection/auditing/event-4906.md index 7782a6571d..617b7a2597 100644 --- a/windows/security/threat-protection/auditing/event-4906.md +++ b/windows/security/threat-protection/auditing/event-4906.md @@ -2,7 +2,7 @@ title: 4906(S) The CrashOnAuditFail value has changed. (Windows 10) description: Describes security event 4906(S) The CrashOnAuditFail value has changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4906(S): The CrashOnAuditFail value has changed. diff --git a/windows/security/threat-protection/auditing/event-4907.md b/windows/security/threat-protection/auditing/event-4907.md index 34454c6d14..74edaaa9a3 100644 --- a/windows/security/threat-protection/auditing/event-4907.md +++ b/windows/security/threat-protection/auditing/event-4907.md @@ -2,7 +2,7 @@ title: 4907(S) Auditing settings on object were changed. (Windows 10) description: Describes security event 4907(S) Auditing settings on object were changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4907(S): Auditing settings on object were changed. @@ -285,5 +286,5 @@ For 4907(S): Auditing settings on object were changed. - If you have critical file or registry objects and you need to monitor all modifications (especially changes in SACL), monitor for specific “**Object\\Object Name”**. -- If you have high-value computers for which you need to monitor all changes for all or specific file or registry objects, monitor for all [4907](event-4907.md) events on these computers. +- If you have high-value computers for which you need to monitor all changes for all or specific file or registry objects, monitor for all [4907](event-4907.md) events on these computers. diff --git a/windows/security/threat-protection/auditing/event-4908.md b/windows/security/threat-protection/auditing/event-4908.md index 847263668e..3a12a949e0 100644 --- a/windows/security/threat-protection/auditing/event-4908.md +++ b/windows/security/threat-protection/auditing/event-4908.md @@ -1,8 +1,8 @@ --- title: 4908(S) Special Groups Logon table modified. (Windows 10) -description: Describes security event 4908(S) Special Groups Logon table modified. +description: Describes security event 4908(S) Special Groups Logon table modified. This event is generated when the Special Groups Logon table is modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4908(S): Special Groups Logon table modified. diff --git a/windows/security/threat-protection/auditing/event-4909.md b/windows/security/threat-protection/auditing/event-4909.md index 2acda55983..9c3b067418 100644 --- a/windows/security/threat-protection/auditing/event-4909.md +++ b/windows/security/threat-protection/auditing/event-4909.md @@ -2,7 +2,7 @@ title: 4909(-) The local policy settings for the TBS were changed. (Windows 10) description: Describes security event 4909(-) The local policy settings for the TBS were changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4909(-): The local policy settings for the TBS were changed. diff --git a/windows/security/threat-protection/auditing/event-4910.md b/windows/security/threat-protection/auditing/event-4910.md index 8b90247c65..948c3a6dab 100644 --- a/windows/security/threat-protection/auditing/event-4910.md +++ b/windows/security/threat-protection/auditing/event-4910.md @@ -2,7 +2,7 @@ title: 4910(-) The group policy settings for the TBS were changed. (Windows 10) description: Describes security event 4910(-) The group policy settings for the TBS were changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4910(-): The group policy settings for the TBS were changed. diff --git a/windows/security/threat-protection/auditing/event-4911.md b/windows/security/threat-protection/auditing/event-4911.md index bbd17b1660..cf47c889e0 100644 --- a/windows/security/threat-protection/auditing/event-4911.md +++ b/windows/security/threat-protection/auditing/event-4911.md @@ -2,7 +2,7 @@ title: 4911(S) Resource attributes of the object were changed. (Windows 10) description: Describes security event 4911(S) Resource attributes of the object were changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4911(S): Resource attributes of the object were changed. diff --git a/windows/security/threat-protection/auditing/event-4912.md b/windows/security/threat-protection/auditing/event-4912.md index 4e98d50f44..e4bc6d9d43 100644 --- a/windows/security/threat-protection/auditing/event-4912.md +++ b/windows/security/threat-protection/auditing/event-4912.md @@ -1,8 +1,8 @@ --- title: 4912(S) Per User Audit Policy was changed. (Windows 10) -description: Describes security event 4912(S) Per User Audit Policy was changed. +description: Describes security event 4912(S) Per User Audit Policy was changed. This event is generated every time Per User Audit Policy is changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4912(S): Per User Audit Policy was changed. diff --git a/windows/security/threat-protection/auditing/event-4913.md b/windows/security/threat-protection/auditing/event-4913.md index 3be7e9bec3..95f0aa8b70 100644 --- a/windows/security/threat-protection/auditing/event-4913.md +++ b/windows/security/threat-protection/auditing/event-4913.md @@ -2,7 +2,7 @@ title: 4913(S) Central Access Policy on the object was changed. (Windows 10) description: Describes security event 4913(S) Central Access Policy on the object was changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4913(S): Central Access Policy on the object was changed. diff --git a/windows/security/threat-protection/auditing/event-4928.md b/windows/security/threat-protection/auditing/event-4928.md index 664b36c1ca..45fa768785 100644 --- a/windows/security/threat-protection/auditing/event-4928.md +++ b/windows/security/threat-protection/auditing/event-4928.md @@ -2,7 +2,7 @@ title: 4928(S, F) An Active Directory replica source naming context was established. (Windows 10) description: Describes security event 4928(S, F) An Active Directory replica source naming context was established. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4928(S, F): An Active Directory replica source naming context was established. diff --git a/windows/security/threat-protection/auditing/event-4929.md b/windows/security/threat-protection/auditing/event-4929.md index b5a1ba430e..9e126439a2 100644 --- a/windows/security/threat-protection/auditing/event-4929.md +++ b/windows/security/threat-protection/auditing/event-4929.md @@ -2,7 +2,7 @@ title: 4929(S, F) An Active Directory replica source naming context was removed. (Windows 10) description: Describes security event 4929(S, F) An Active Directory replica source naming context was removed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4929(S, F): An Active Directory replica source naming context was removed. diff --git a/windows/security/threat-protection/auditing/event-4930.md b/windows/security/threat-protection/auditing/event-4930.md index f7b993d3a9..42d488915d 100644 --- a/windows/security/threat-protection/auditing/event-4930.md +++ b/windows/security/threat-protection/auditing/event-4930.md @@ -2,7 +2,7 @@ title: 4930(S, F) An Active Directory replica source naming context was modified. (Windows 10) description: Describes security event 4930(S, F) An Active Directory replica source naming context was modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4930(S, F): An Active Directory replica source naming context was modified. diff --git a/windows/security/threat-protection/auditing/event-4931.md b/windows/security/threat-protection/auditing/event-4931.md index 3f02d54421..fc3a7fc61f 100644 --- a/windows/security/threat-protection/auditing/event-4931.md +++ b/windows/security/threat-protection/auditing/event-4931.md @@ -2,7 +2,7 @@ title: 4931(S, F) An Active Directory replica destination naming context was modified. (Windows 10) description: Describes security event 4931(S, F) An Active Directory replica destination naming context was modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4931(S, F): An Active Directory replica destination naming context was modified. diff --git a/windows/security/threat-protection/auditing/event-4932.md b/windows/security/threat-protection/auditing/event-4932.md index 615a83328d..4450fb0acc 100644 --- a/windows/security/threat-protection/auditing/event-4932.md +++ b/windows/security/threat-protection/auditing/event-4932.md @@ -2,7 +2,7 @@ title: 4932(S) Synchronization of a replica of an Active Directory naming context has begun. (Windows 10) description: Describes security event 4932(S) Synchronization of a replica of an Active Directory naming context has begun. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4932(S): Synchronization of a replica of an Active Directory naming context has begun. diff --git a/windows/security/threat-protection/auditing/event-4933.md b/windows/security/threat-protection/auditing/event-4933.md index b5fbe33942..1143269597 100644 --- a/windows/security/threat-protection/auditing/event-4933.md +++ b/windows/security/threat-protection/auditing/event-4933.md @@ -2,7 +2,7 @@ title: 4933(S, F) Synchronization of a replica of an Active Directory naming context has ended. (Windows 10) description: Describes security event 4933(S, F) Synchronization of a replica of an Active Directory naming context has ended. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4933(S, F): Synchronization of a replica of an Active Directory naming context has ended. diff --git a/windows/security/threat-protection/auditing/event-4934.md b/windows/security/threat-protection/auditing/event-4934.md index 4a5890af24..ffc4b9b4a3 100644 --- a/windows/security/threat-protection/auditing/event-4934.md +++ b/windows/security/threat-protection/auditing/event-4934.md @@ -2,7 +2,7 @@ title: 4934(S) Attributes of an Active Directory object were replicated. (Windows 10) description: Describes security event 4934(S) Attributes of an Active Directory object were replicated. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4934(S): Attributes of an Active Directory object were replicated. diff --git a/windows/security/threat-protection/auditing/event-4935.md b/windows/security/threat-protection/auditing/event-4935.md index 18964e5c16..f2910784e6 100644 --- a/windows/security/threat-protection/auditing/event-4935.md +++ b/windows/security/threat-protection/auditing/event-4935.md @@ -1,8 +1,8 @@ --- title: 4935(F) Replication failure begins. (Windows 10) -description: Describes security event 4935(F) Replication failure begins. +description: Describes security event 4935(F) Replication failure begins. This event is generated when Active Directory replication failure begins. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4935(F): Replication failure begins. diff --git a/windows/security/threat-protection/auditing/event-4936.md b/windows/security/threat-protection/auditing/event-4936.md index 214811e890..3f808bf11d 100644 --- a/windows/security/threat-protection/auditing/event-4936.md +++ b/windows/security/threat-protection/auditing/event-4936.md @@ -1,8 +1,8 @@ --- title: 4936(S) Replication failure ends. (Windows 10) -description: Describes security event 4936(S) Replication failure ends. +description: Describes security event 4936(S) Replication failure ends. This event is generated when Active Directory replication failure ends. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4936(S): Replication failure ends. diff --git a/windows/security/threat-protection/auditing/event-4937.md b/windows/security/threat-protection/auditing/event-4937.md index 8fb915289b..2775be1c5d 100644 --- a/windows/security/threat-protection/auditing/event-4937.md +++ b/windows/security/threat-protection/auditing/event-4937.md @@ -2,7 +2,7 @@ title: 4937(S) A lingering object was removed from a replica. (Windows 10) description: Describes security event 4937(S) A lingering object was removed from a replica. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4937(S): A lingering object was removed from a replica. diff --git a/windows/security/threat-protection/auditing/event-4944.md b/windows/security/threat-protection/auditing/event-4944.md index ca2c97045e..1b6522a256 100644 --- a/windows/security/threat-protection/auditing/event-4944.md +++ b/windows/security/threat-protection/auditing/event-4944.md @@ -2,7 +2,7 @@ title: 4944(S) The following policy was active when the Windows Firewall started. (Windows 10) description: Describes security event 4944(S) The following policy was active when the Windows Firewall started. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4944(S): The following policy was active when the Windows Firewall started. diff --git a/windows/security/threat-protection/auditing/event-4945.md b/windows/security/threat-protection/auditing/event-4945.md index 74d3f7c688..da8105bffc 100644 --- a/windows/security/threat-protection/auditing/event-4945.md +++ b/windows/security/threat-protection/auditing/event-4945.md @@ -2,7 +2,7 @@ title: 4945(S) A rule was listed when the Windows Firewall started. (Windows 10) description: Describes security event 4945(S) A rule was listed when the Windows Firewall started. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4945(S): A rule was listed when the Windows Firewall started. diff --git a/windows/security/threat-protection/auditing/event-4946.md b/windows/security/threat-protection/auditing/event-4946.md index 4ff3dd9f1d..30ae25fd28 100644 --- a/windows/security/threat-protection/auditing/event-4946.md +++ b/windows/security/threat-protection/auditing/event-4946.md @@ -2,7 +2,7 @@ title: 4946(S) A change has been made to Windows Firewall exception list. A rule was added. (Windows 10) description: Describes security event 4946(S) A change has been made to Windows Firewall exception list. A rule was added. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4946(S): A change has been made to Windows Firewall exception list. A rule was added. diff --git a/windows/security/threat-protection/auditing/event-4947.md b/windows/security/threat-protection/auditing/event-4947.md index deffae0186..b38eef6371 100644 --- a/windows/security/threat-protection/auditing/event-4947.md +++ b/windows/security/threat-protection/auditing/event-4947.md @@ -2,7 +2,7 @@ title: 4947(S) A change has been made to Windows Firewall exception list. A rule was modified. (Windows 10) description: Describes security event 4947(S) A change has been made to Windows Firewall exception list. A rule was modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4947(S): A change has been made to Windows Firewall exception list. A rule was modified. @@ -90,11 +91,11 @@ This event doesn't generate when Firewall rule was modified via Group Policy. - **Rule ID** \[Type = UnicodeString\]: the unique identifier for modified firewall rule. - To see the unique ID of the rule you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters: + To see the unique ID of the rule, navigate to the“**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters: Registry Editor FirewallRules key illustration -- **Rule Name** \[Type = UnicodeString\]: the name of the rule which was modified. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column: +- **Rule Name** \[Type = UnicodeString\]: the name of the rule that was modified. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column: Windows Firewall with Advanced Security illustration @@ -102,5 +103,5 @@ This event doesn't generate when Firewall rule was modified via Group Policy. For 4947(S): A change has been made to Windows Firewall exception list. A rule was modified. -- This event can be helpful in case you want to monitor all Firewall rules modifications which were done locally. +- This event can be helpful in case you want to monitor all Firewall rules modifications that were done locally. diff --git a/windows/security/threat-protection/auditing/event-4948.md b/windows/security/threat-protection/auditing/event-4948.md index 5c86cb55c9..5f92a37c6a 100644 --- a/windows/security/threat-protection/auditing/event-4948.md +++ b/windows/security/threat-protection/auditing/event-4948.md @@ -2,7 +2,7 @@ title: 4948(S) A change has been made to Windows Firewall exception list. A rule was deleted. (Windows 10) description: Describes security event 4948(S) A change has been made to Windows Firewall exception list. A rule was deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4948(S): A change has been made to Windows Firewall exception list. A rule was deleted. diff --git a/windows/security/threat-protection/auditing/event-4949.md b/windows/security/threat-protection/auditing/event-4949.md index 983159d9e8..e304844bc8 100644 --- a/windows/security/threat-protection/auditing/event-4949.md +++ b/windows/security/threat-protection/auditing/event-4949.md @@ -2,7 +2,7 @@ title: 4949(S) Windows Firewall settings were restored to the default values. (Windows 10) description: Describes security event 4949(S) Windows Firewall settings were restored to the default values. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4949(S): Windows Firewall settings were restored to the default values. diff --git a/windows/security/threat-protection/auditing/event-4950.md b/windows/security/threat-protection/auditing/event-4950.md index eb6c3770c9..54ead99c65 100644 --- a/windows/security/threat-protection/auditing/event-4950.md +++ b/windows/security/threat-protection/auditing/event-4950.md @@ -2,7 +2,7 @@ title: 4950(S) A Windows Firewall setting has changed. (Windows 10) description: Describes security event 4950(S) A Windows Firewall setting has changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4950(S): A Windows Firewall setting has changed. diff --git a/windows/security/threat-protection/auditing/event-4951.md b/windows/security/threat-protection/auditing/event-4951.md index ff8ed88bdb..4a2c32b9e2 100644 --- a/windows/security/threat-protection/auditing/event-4951.md +++ b/windows/security/threat-protection/auditing/event-4951.md @@ -2,7 +2,7 @@ title: 4951(F) A rule has been ignored because its major version number was not recognized by Windows Firewall. (Windows 10) description: Describes security event 4951(F) A rule has been ignored because its major version number was not recognized by Windows Firewall. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4951(F): A rule has been ignored because its major version number was not recognized by Windows Firewall. diff --git a/windows/security/threat-protection/auditing/event-4952.md b/windows/security/threat-protection/auditing/event-4952.md index 0bd8a3b9b6..150a0ac97d 100644 --- a/windows/security/threat-protection/auditing/event-4952.md +++ b/windows/security/threat-protection/auditing/event-4952.md @@ -2,7 +2,7 @@ title: 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. (Windows 10) description: Security event 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4952(F): Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. diff --git a/windows/security/threat-protection/auditing/event-4953.md b/windows/security/threat-protection/auditing/event-4953.md index 0c705ce6cc..38d9aa6a3d 100644 --- a/windows/security/threat-protection/auditing/event-4953.md +++ b/windows/security/threat-protection/auditing/event-4953.md @@ -2,7 +2,7 @@ title: 4953(F) Windows Firewall ignored a rule because it could not be parsed. (Windows 10) description: Describes security event 4953(F) Windows Firewall ignored a rule because it could not be parsed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4953(F): Windows Firewall ignored a rule because it could not be parsed. @@ -93,11 +94,11 @@ It can happen if Windows Firewall rule registry entry was corrupted. - **ID** \[Type = UnicodeString\]: the unique identifier for ignored firewall rule. - To see the unique ID of the rule you need to navigate to “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters: + To see the unique ID of the rule, navigate to the “**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules”** registry key and you will see the list of Windows Firewall rule IDs (Name column) with parameters: Registry Editor FirewallRules key illustration -- **Name** \[Type = UnicodeString\]: the name of the rule which was ignored. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column: +- **Name** \[Type = UnicodeString\]: the name of the rule that was ignored. You can see the name of Windows Firewall rule using Windows Firewall with Advanced Security management console (**wf.msc**), check “Name” column: Windows Firewall with Advanced Security illustration diff --git a/windows/security/threat-protection/auditing/event-4954.md b/windows/security/threat-protection/auditing/event-4954.md index b58926388b..99bb6457e2 100644 --- a/windows/security/threat-protection/auditing/event-4954.md +++ b/windows/security/threat-protection/auditing/event-4954.md @@ -2,7 +2,7 @@ title: 4954(S) Windows Firewall Group Policy settings have changed. The new settings have been applied. (Windows 10) description: Describes security event 4954(S) Windows Firewall Group Policy settings have changed. The new settings have been applied. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4954(S): Windows Firewall Group Policy settings have changed. The new settings have been applied. diff --git a/windows/security/threat-protection/auditing/event-4956.md b/windows/security/threat-protection/auditing/event-4956.md index 6af6a50864..34d36fa5d0 100644 --- a/windows/security/threat-protection/auditing/event-4956.md +++ b/windows/security/threat-protection/auditing/event-4956.md @@ -2,7 +2,7 @@ title: 4956(S) Windows Firewall has changed the active profile. (Windows 10) description: Describes security event 4956(S) Windows Firewall has changed the active profile. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4956(S): Windows Firewall has changed the active profile. diff --git a/windows/security/threat-protection/auditing/event-4957.md b/windows/security/threat-protection/auditing/event-4957.md index 396a5b587d..8b822ee84c 100644 --- a/windows/security/threat-protection/auditing/event-4957.md +++ b/windows/security/threat-protection/auditing/event-4957.md @@ -2,7 +2,7 @@ title: 4957(F) Windows Firewall did not apply the following rule. (Windows 10) description: Describes security event 4957(F) Windows Firewall did not apply the following rule. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4957(F): Windows Firewall did not apply the following rule. diff --git a/windows/security/threat-protection/auditing/event-4958.md b/windows/security/threat-protection/auditing/event-4958.md index 14d3b2ad4b..05922fd7a7 100644 --- a/windows/security/threat-protection/auditing/event-4958.md +++ b/windows/security/threat-protection/auditing/event-4958.md @@ -2,7 +2,7 @@ title: 4958(F) Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer. (Windows 10) description: Describes security event 4958(F) Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4958(F): Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer. diff --git a/windows/security/threat-protection/auditing/event-4964.md b/windows/security/threat-protection/auditing/event-4964.md index 4cd9707147..0ee97ac194 100644 --- a/windows/security/threat-protection/auditing/event-4964.md +++ b/windows/security/threat-protection/auditing/event-4964.md @@ -2,7 +2,7 @@ title: 4964(S) Special groups have been assigned to a new logon. (Windows 10) description: Describes security event 4964(S) Special groups have been assigned to a new logon. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4964(S): Special groups have been assigned to a new logon. diff --git a/windows/security/threat-protection/auditing/event-4985.md b/windows/security/threat-protection/auditing/event-4985.md index 2a98d42db6..9b3680639b 100644 --- a/windows/security/threat-protection/auditing/event-4985.md +++ b/windows/security/threat-protection/auditing/event-4985.md @@ -2,7 +2,7 @@ title: 4985(S) The state of a transaction has changed. (Windows 10) description: Describes security event 4985(S) The state of a transaction has changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 4985(S): The state of a transaction has changed. diff --git a/windows/security/threat-protection/auditing/event-5024.md b/windows/security/threat-protection/auditing/event-5024.md index 9dede9c866..b24cd95e31 100644 --- a/windows/security/threat-protection/auditing/event-5024.md +++ b/windows/security/threat-protection/auditing/event-5024.md @@ -2,7 +2,7 @@ title: 5024(S) The Windows Firewall Service has started successfully. (Windows 10) description: Describes security event 5024(S) The Windows Firewall Service has started successfully. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5024(S): The Windows Firewall Service has started successfully. diff --git a/windows/security/threat-protection/auditing/event-5025.md b/windows/security/threat-protection/auditing/event-5025.md index d6a60c5da2..a9a3c5e14b 100644 --- a/windows/security/threat-protection/auditing/event-5025.md +++ b/windows/security/threat-protection/auditing/event-5025.md @@ -2,7 +2,7 @@ title: 5025(S) The Windows Firewall Service has been stopped. (Windows 10) description: Describes security event 5025(S) The Windows Firewall Service has been stopped. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5025(S): The Windows Firewall Service has been stopped. diff --git a/windows/security/threat-protection/auditing/event-5027.md b/windows/security/threat-protection/auditing/event-5027.md index 23bf6e5c30..4ea2177c6b 100644 --- a/windows/security/threat-protection/auditing/event-5027.md +++ b/windows/security/threat-protection/auditing/event-5027.md @@ -1,8 +1,8 @@ --- title: 5027(F) The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy. (Windows 10) -description: Details on security event 5027(F) The Windows Firewall Service was unable to retrieve the security policy from the local storage. +description: Details on security event 5027(F) The Windows Firewall Service was unable to retrieve the security policy from the local storage. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5027(F): The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy. diff --git a/windows/security/threat-protection/auditing/event-5028.md b/windows/security/threat-protection/auditing/event-5028.md index 8929b86d33..9ab51ca985 100644 --- a/windows/security/threat-protection/auditing/event-5028.md +++ b/windows/security/threat-protection/auditing/event-5028.md @@ -2,7 +2,7 @@ title: 5028(F) The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy. (Windows 10) description: Describes security event 5028(F) The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5028(F): The Windows Firewall Service was unable to parse the new security policy. The service will continue with currently enforced policy. diff --git a/windows/security/threat-protection/auditing/event-5029.md b/windows/security/threat-protection/auditing/event-5029.md index dcdda6a60f..46d9b7b3e7 100644 --- a/windows/security/threat-protection/auditing/event-5029.md +++ b/windows/security/threat-protection/auditing/event-5029.md @@ -2,7 +2,7 @@ title: 5029(F) The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy. (Windows 10) description: Describes security event 5029(F) The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5029(F): The Windows Firewall Service failed to initialize the driver. The service will continue to enforce the current policy. diff --git a/windows/security/threat-protection/auditing/event-5030.md b/windows/security/threat-protection/auditing/event-5030.md index 37d3844e1f..de68bc30db 100644 --- a/windows/security/threat-protection/auditing/event-5030.md +++ b/windows/security/threat-protection/auditing/event-5030.md @@ -2,7 +2,7 @@ title: 5030(F) The Windows Firewall Service failed to start. (Windows 10) description: Describes security event 5030(F) The Windows Firewall Service failed to start. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5030(F): The Windows Firewall Service failed to start. diff --git a/windows/security/threat-protection/auditing/event-5031.md b/windows/security/threat-protection/auditing/event-5031.md index e6bcd4a68c..7453df6988 100644 --- a/windows/security/threat-protection/auditing/event-5031.md +++ b/windows/security/threat-protection/auditing/event-5031.md @@ -5,11 +5,12 @@ manager: dansimp ms.author: dansimp description: Describes security event 5031(F) The Windows Firewall Service blocked an application from accepting incoming connections on the network. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: dansimp +ms.technology: mde --- # 5031(F): The Windows Firewall Service blocked an application from accepting incoming connections on the network. diff --git a/windows/security/threat-protection/auditing/event-5032.md b/windows/security/threat-protection/auditing/event-5032.md index 02b5e5768f..a356c6ba72 100644 --- a/windows/security/threat-protection/auditing/event-5032.md +++ b/windows/security/threat-protection/auditing/event-5032.md @@ -2,7 +2,7 @@ title: 5032(F) Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. (Windows 10) description: Describes security event 5032(F) Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5032(F): Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. diff --git a/windows/security/threat-protection/auditing/event-5033.md b/windows/security/threat-protection/auditing/event-5033.md index 834f4c95b8..05552da629 100644 --- a/windows/security/threat-protection/auditing/event-5033.md +++ b/windows/security/threat-protection/auditing/event-5033.md @@ -2,7 +2,7 @@ title: 5033(S) The Windows Firewall Driver has started successfully. (Windows 10) description: Describes security event 5033(S) The Windows Firewall Driver has started successfully. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5033(S): The Windows Firewall Driver has started successfully. diff --git a/windows/security/threat-protection/auditing/event-5034.md b/windows/security/threat-protection/auditing/event-5034.md index c3f04488fa..7cef4c54e0 100644 --- a/windows/security/threat-protection/auditing/event-5034.md +++ b/windows/security/threat-protection/auditing/event-5034.md @@ -2,7 +2,7 @@ title: 5034(S) The Windows Firewall Driver was stopped. (Windows 10) description: Describes security event 5034(S) The Windows Firewall Driver was stopped. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5034(S): The Windows Firewall Driver was stopped. diff --git a/windows/security/threat-protection/auditing/event-5035.md b/windows/security/threat-protection/auditing/event-5035.md index 2815638be4..6b9d8a9488 100644 --- a/windows/security/threat-protection/auditing/event-5035.md +++ b/windows/security/threat-protection/auditing/event-5035.md @@ -2,7 +2,7 @@ title: 5035(F) The Windows Firewall Driver failed to start. (Windows 10) description: Describes security event 5035(F) The Windows Firewall Driver failed to start. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5035(F): The Windows Firewall Driver failed to start. diff --git a/windows/security/threat-protection/auditing/event-5037.md b/windows/security/threat-protection/auditing/event-5037.md index 026d2c2985..a189ce3f21 100644 --- a/windows/security/threat-protection/auditing/event-5037.md +++ b/windows/security/threat-protection/auditing/event-5037.md @@ -2,7 +2,7 @@ title: 5037(F) The Windows Firewall Driver detected critical runtime error. Terminating. (Windows 10) description: Describes security event 5037(F) The Windows Firewall Driver detected critical runtime error. Terminating. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5037(F): The Windows Firewall Driver detected critical runtime error. Terminating. diff --git a/windows/security/threat-protection/auditing/event-5038.md b/windows/security/threat-protection/auditing/event-5038.md index 15bd4ad7e1..eac7f9eea0 100644 --- a/windows/security/threat-protection/auditing/event-5038.md +++ b/windows/security/threat-protection/auditing/event-5038.md @@ -2,7 +2,7 @@ title: 5038(F) Code integrity determined that the image hash of a file is not valid. (Windows 10) description: Describes security event 5038(F) Code integrity determined that the image hash of a file is not valid. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5038(F): Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. diff --git a/windows/security/threat-protection/auditing/event-5039.md b/windows/security/threat-protection/auditing/event-5039.md index 43677f0e97..fda19e5f16 100644 --- a/windows/security/threat-protection/auditing/event-5039.md +++ b/windows/security/threat-protection/auditing/event-5039.md @@ -1,8 +1,8 @@ --- title: 5039(-) A registry key was virtualized. (Windows 10) -description: Describes security event 5039(-) A registry key was virtualized. +description: Describes security event 5039(-) A registry key was virtualized. This event is generated when a registry key is virtualized using LUAFV. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5039(-): A registry key was virtualized. diff --git a/windows/security/threat-protection/auditing/event-5051.md b/windows/security/threat-protection/auditing/event-5051.md index adfb677ffd..3ac07671d2 100644 --- a/windows/security/threat-protection/auditing/event-5051.md +++ b/windows/security/threat-protection/auditing/event-5051.md @@ -1,8 +1,8 @@ --- title: 5051(-) A file was virtualized. (Windows 10) -description: Describes security event 5051(-) A file was virtualized. +description: Describes security event 5051(-) A file was virtualized. This event is generated when a file is virtualized using LUAFV. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5051(-): A file was virtualized. diff --git a/windows/security/threat-protection/auditing/event-5056.md b/windows/security/threat-protection/auditing/event-5056.md index a675d79c58..a717d05e4a 100644 --- a/windows/security/threat-protection/auditing/event-5056.md +++ b/windows/security/threat-protection/auditing/event-5056.md @@ -2,7 +2,7 @@ title: 5056(S) A cryptographic self-test was performed. (Windows 10) description: Describes security event 5056(S) A cryptographic self-test was performed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5056(S): A cryptographic self-test was performed. @@ -20,7 +21,7 @@ ms.author: dansimp - Windows Server 2016 -This event generates in CNG Self-Test function. This is a Cryptographic Next Generation (CNG) function. +This event generates in CNG Self-Test function. This function is a Cryptographic Next Generation (CNG) function. For more information about Cryptographic Next Generation (CNG) visit these pages: @@ -32,7 +33,7 @@ For more information about Cryptographic Next Generation (CNG) visit these pages - -This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. +This event is mainly used for CNG troubleshooting. There is no example of this event in this document. @@ -40,7 +41,7 @@ There is no example of this event in this document. ***Event Schema:*** -*A cryptographic self test was performed.* +*A cryptographic self-test was performed.* *Subject:* diff --git a/windows/security/threat-protection/auditing/event-5057.md b/windows/security/threat-protection/auditing/event-5057.md index eb3cc568ab..c83ca8bd2e 100644 --- a/windows/security/threat-protection/auditing/event-5057.md +++ b/windows/security/threat-protection/auditing/event-5057.md @@ -2,7 +2,7 @@ title: 5057(F) A cryptographic primitive operation failed. (Windows 10) description: Describes security event 5057(F) A cryptographic primitive operation failed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5057(F): A cryptographic primitive operation failed. diff --git a/windows/security/threat-protection/auditing/event-5058.md b/windows/security/threat-protection/auditing/event-5058.md index 508bb9d381..5f999b36d1 100644 --- a/windows/security/threat-protection/auditing/event-5058.md +++ b/windows/security/threat-protection/auditing/event-5058.md @@ -1,8 +1,8 @@ --- title: 5058(S, F) Key file operation. (Windows 10) -description: Describes security event 5058(S, F) Key file operation. +description: Describes security event 5058(S, F) Key file operation. This event is generated when an operation is performed on a file that contains a KSP key. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5058(S, F): Key file operation. diff --git a/windows/security/threat-protection/auditing/event-5059.md b/windows/security/threat-protection/auditing/event-5059.md index e3f73073f3..e7c0a1264b 100644 --- a/windows/security/threat-protection/auditing/event-5059.md +++ b/windows/security/threat-protection/auditing/event-5059.md @@ -1,8 +1,8 @@ --- title: 5059(S, F) Key migration operation. (Windows 10) -description: Describes security event 5059(S, F) Key migration operation. +description: Describes security event 5059(S, F) Key migration operation. This event is generated when a cryptographic key is exported/imported using a Key Storage Provider. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5059(S, F): Key migration operation. diff --git a/windows/security/threat-protection/auditing/event-5060.md b/windows/security/threat-protection/auditing/event-5060.md index bd0414e3ca..11b9903d5d 100644 --- a/windows/security/threat-protection/auditing/event-5060.md +++ b/windows/security/threat-protection/auditing/event-5060.md @@ -1,8 +1,8 @@ --- title: 5060(F) Verification operation failed. (Windows 10) -description: Describes security event 5060(F) Verification operation failed. +description: Describes security event 5060(F) Verification operation failed. This event is generated when the CNG verification operation fails. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5060(F): Verification operation failed. @@ -20,9 +21,9 @@ ms.author: dansimp - Windows Server 2016 -This event generates in case of CNG verification operation failure. +This event generates when the Cryptographic Next Generation (CNG) verification operation fails. -For more information about Cryptographic Next Generation (CNG) visit these pages: +For more information about CNG, visit these pages: - @@ -32,7 +33,7 @@ For more information about Cryptographic Next Generation (CNG) visit these pages - -This event is mainly used for Cryptographic Next Generation (CNG) troubleshooting. +This event is mainly used for CNG troubleshooting. There is no example of this event in this document. diff --git a/windows/security/threat-protection/auditing/event-5061.md b/windows/security/threat-protection/auditing/event-5061.md index 271b5d582b..a7f832d34b 100644 --- a/windows/security/threat-protection/auditing/event-5061.md +++ b/windows/security/threat-protection/auditing/event-5061.md @@ -1,8 +1,8 @@ --- title: 5061(S, F) Cryptographic operation. (Windows 10) -description: Describes security event 5061(S, F) Cryptographic operation. +description: Describes security event 5061(S, F) Cryptographic operation. This event is generated when a cryptographic operation is performed using a Key Storage Provider. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5061(S, F): Cryptographic operation. diff --git a/windows/security/threat-protection/auditing/event-5062.md b/windows/security/threat-protection/auditing/event-5062.md index 0d9e37b259..e397844d41 100644 --- a/windows/security/threat-protection/auditing/event-5062.md +++ b/windows/security/threat-protection/auditing/event-5062.md @@ -2,7 +2,7 @@ title: 5062(S) A kernel-mode cryptographic self-test was performed. (Windows 10) description: Describes security event 5062(S) A kernel-mode cryptographic self-test was performed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5062(S): A kernel-mode cryptographic self-test was performed. diff --git a/windows/security/threat-protection/auditing/event-5063.md b/windows/security/threat-protection/auditing/event-5063.md index 159cda1e2b..e06e3118a6 100644 --- a/windows/security/threat-protection/auditing/event-5063.md +++ b/windows/security/threat-protection/auditing/event-5063.md @@ -2,7 +2,7 @@ title: 5063(S, F) A cryptographic provider operation was attempted. (Windows 10) description: Describes security event 5063(S, F) A cryptographic provider operation was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5063(S, F): A cryptographic provider operation was attempted. diff --git a/windows/security/threat-protection/auditing/event-5064.md b/windows/security/threat-protection/auditing/event-5064.md index a5c3c577e0..77da8c5596 100644 --- a/windows/security/threat-protection/auditing/event-5064.md +++ b/windows/security/threat-protection/auditing/event-5064.md @@ -2,7 +2,7 @@ title: 5064(S, F) A cryptographic context operation was attempted. (Windows 10) description: Describes security event 5064(S, F) A cryptographic context operation was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5064(S, F): A cryptographic context operation was attempted. diff --git a/windows/security/threat-protection/auditing/event-5065.md b/windows/security/threat-protection/auditing/event-5065.md index 0f5d4dd997..7c46971bc8 100644 --- a/windows/security/threat-protection/auditing/event-5065.md +++ b/windows/security/threat-protection/auditing/event-5065.md @@ -2,7 +2,7 @@ title: 5065(S, F) A cryptographic context modification was attempted. (Windows 10) description: Describes security event 5065(S, F) A cryptographic context modification was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5065(S, F): A cryptographic context modification was attempted. diff --git a/windows/security/threat-protection/auditing/event-5066.md b/windows/security/threat-protection/auditing/event-5066.md index 9c5f389dcf..c78b0bd513 100644 --- a/windows/security/threat-protection/auditing/event-5066.md +++ b/windows/security/threat-protection/auditing/event-5066.md @@ -2,7 +2,7 @@ title: 5066(S, F) A cryptographic function operation was attempted. (Windows 10) description: Describes security event 5066(S, F) A cryptographic function operation was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5066(S, F): A cryptographic function operation was attempted. diff --git a/windows/security/threat-protection/auditing/event-5067.md b/windows/security/threat-protection/auditing/event-5067.md index 6ab1f5a7c1..eae3eb2038 100644 --- a/windows/security/threat-protection/auditing/event-5067.md +++ b/windows/security/threat-protection/auditing/event-5067.md @@ -2,7 +2,7 @@ title: 5067(S, F) A cryptographic function modification was attempted. (Windows 10) description: Describes security event 5067(S, F) A cryptographic function modification was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5067(S, F): A cryptographic function modification was attempted. diff --git a/windows/security/threat-protection/auditing/event-5068.md b/windows/security/threat-protection/auditing/event-5068.md index fb084fd8dd..1cb02be991 100644 --- a/windows/security/threat-protection/auditing/event-5068.md +++ b/windows/security/threat-protection/auditing/event-5068.md @@ -2,7 +2,7 @@ title: 5068(S, F) A cryptographic function provider operation was attempted. (Windows 10) description: Describes security event 5068(S, F) A cryptographic function provider operation was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5068(S, F): A cryptographic function provider operation was attempted. diff --git a/windows/security/threat-protection/auditing/event-5069.md b/windows/security/threat-protection/auditing/event-5069.md index 64dbd91086..104d55f067 100644 --- a/windows/security/threat-protection/auditing/event-5069.md +++ b/windows/security/threat-protection/auditing/event-5069.md @@ -2,7 +2,7 @@ title: 5069(S, F) A cryptographic function property operation was attempted. (Windows 10) description: Describes security event 5069(S, F) A cryptographic function property operation was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5069(S, F): A cryptographic function property operation was attempted. diff --git a/windows/security/threat-protection/auditing/event-5070.md b/windows/security/threat-protection/auditing/event-5070.md index ce069a495c..0cb592e4d4 100644 --- a/windows/security/threat-protection/auditing/event-5070.md +++ b/windows/security/threat-protection/auditing/event-5070.md @@ -2,7 +2,7 @@ title: 5070(S, F) A cryptographic function property modification was attempted. (Windows 10) description: Describes security event 5070(S, F) A cryptographic function property modification was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5070(S, F): A cryptographic function property modification was attempted. diff --git a/windows/security/threat-protection/auditing/event-5136.md b/windows/security/threat-protection/auditing/event-5136.md index a5708a86f6..58301baf30 100644 --- a/windows/security/threat-protection/auditing/event-5136.md +++ b/windows/security/threat-protection/auditing/event-5136.md @@ -2,7 +2,7 @@ title: 5136(S) A directory service object was modified. (Windows 10) description: Describes security event 5136(S) A directory service object was modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5136(S): A directory service object was modified. diff --git a/windows/security/threat-protection/auditing/event-5137.md b/windows/security/threat-protection/auditing/event-5137.md index 8d1d729333..959ae8dbd8 100644 --- a/windows/security/threat-protection/auditing/event-5137.md +++ b/windows/security/threat-protection/auditing/event-5137.md @@ -2,7 +2,7 @@ title: 5137(S) A directory service object was created. (Windows 10) description: Describes security event 5137(S) A directory service object was created. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5137(S): A directory service object was created. diff --git a/windows/security/threat-protection/auditing/event-5138.md b/windows/security/threat-protection/auditing/event-5138.md index 75cebe45a7..54582252c1 100644 --- a/windows/security/threat-protection/auditing/event-5138.md +++ b/windows/security/threat-protection/auditing/event-5138.md @@ -2,7 +2,7 @@ title: 5138(S) A directory service object was undeleted. (Windows 10) description: Describes security event 5138(S) A directory service object was undeleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5138(S): A directory service object was undeleted. diff --git a/windows/security/threat-protection/auditing/event-5139.md b/windows/security/threat-protection/auditing/event-5139.md index fe3921db6f..2860791322 100644 --- a/windows/security/threat-protection/auditing/event-5139.md +++ b/windows/security/threat-protection/auditing/event-5139.md @@ -2,7 +2,7 @@ title: 5139(S) A directory service object was moved. (Windows 10) description: Describes security event 5139(S) A directory service object was moved. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5139(S): A directory service object was moved. diff --git a/windows/security/threat-protection/auditing/event-5140.md b/windows/security/threat-protection/auditing/event-5140.md index a4f705ba93..199e5a4cd7 100644 --- a/windows/security/threat-protection/auditing/event-5140.md +++ b/windows/security/threat-protection/auditing/event-5140.md @@ -2,7 +2,7 @@ title: 5140(S, F) A network share object was accessed. (Windows 10) description: Describes security event 5140(S, F) A network share object was accessed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5140(S, F): A network share object was accessed. @@ -145,7 +146,7 @@ For 5140(S, F): A network share object was accessed. > **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). -- If you have high-value computers for which you need to monitor all access to all shares or specific shares (“**Share Name**”), monitor this event. For example, you could monitor share **C$** on domain controllers. +- If you have high-value computers for which you need to monitor all access to all shares or specific shares (“**Share Name**”), monitor this event. For example, you could monitor share **C$** on domain controllers. - Monitor this event if the **Network Information\\Source Address** is not from your internal IP range. diff --git a/windows/security/threat-protection/auditing/event-5141.md b/windows/security/threat-protection/auditing/event-5141.md index 221a5c56cf..09e46f5b1b 100644 --- a/windows/security/threat-protection/auditing/event-5141.md +++ b/windows/security/threat-protection/auditing/event-5141.md @@ -2,7 +2,7 @@ title: 5141(S) A directory service object was deleted. (Windows 10) description: Describes security event 5141(S) A directory service object was deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5141(S): A directory service object was deleted. diff --git a/windows/security/threat-protection/auditing/event-5142.md b/windows/security/threat-protection/auditing/event-5142.md index 858e4a608f..d29c26ddc4 100644 --- a/windows/security/threat-protection/auditing/event-5142.md +++ b/windows/security/threat-protection/auditing/event-5142.md @@ -1,8 +1,8 @@ --- title: 5142(S) A network share object was added. (Windows 10) -description: Describes security event 5142(S) A network share object was added. +description: Describes security event 5142(S) A network share object was added. This event is generated when a network share object is added. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5142(S): A network share object was added. @@ -104,7 +105,7 @@ For 5142(S): A network share object was added. > **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). -- If you have high-value computers for which you need to monitor creation of new file shares, monitor this event. For example, you could monitor domain controllers. +- If you have high-value computers for which you need to monitor creation of new file shares, monitor this event. For example, you could monitor domain controllers. - We recommend checking “**Share Path**”, because it should not point to system directories, such as **C:\\Windows** or **C:\\**, or to critical local folders which contain private or high value information. diff --git a/windows/security/threat-protection/auditing/event-5143.md b/windows/security/threat-protection/auditing/event-5143.md index c7f46521ae..bc8f827e03 100644 --- a/windows/security/threat-protection/auditing/event-5143.md +++ b/windows/security/threat-protection/auditing/event-5143.md @@ -1,8 +1,8 @@ --- title: 5143(S) A network share object was modified. (Windows 10) -description: Describes security event 5143(S) A network share object was modified. +description: Describes security event 5143(S) A network share object was modified. This event is generated when a network share object is modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5143(S): A network share object was modified. @@ -259,5 +260,5 @@ For 5143(S): A network share object was modified. > **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). -- If you have high-value computers for which you need to monitor all modifications to all shares or specific shares (“**Share Name**”), monitor this event. For example, you could monitor all changes to the SYSVOL share on domain controllers. +- If you have high-value computers for which you need to monitor all modifications to all shares or specific shares (“**Share Name**”), monitor this event. For example, you could monitor all changes to the SYSVOL share on domain controllers. diff --git a/windows/security/threat-protection/auditing/event-5144.md b/windows/security/threat-protection/auditing/event-5144.md index 4c20a34092..886dc70759 100644 --- a/windows/security/threat-protection/auditing/event-5144.md +++ b/windows/security/threat-protection/auditing/event-5144.md @@ -1,8 +1,8 @@ --- title: 5144(S) A network share object was deleted. (Windows 10) -description: Describes security event 5144(S) A network share object was deleted. +description: Describes security event 5144(S) A network share object was deleted. This event is generated when a network share object is deleted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5144(S): A network share object was deleted. @@ -106,5 +107,5 @@ For 5144(S): A network share object was deleted. - If you have critical network shares for which you need to monitor all changes (especially, the deletion of that share), monitor for specific “**Share Information\\Share Name”.** -- If you have high-value computers for which you need to monitor all changes (especially, deletion of file shares), monitor for all [5144](event-5144.md) events on these computers. For example, you could monitor file shares on domain controllers. +- If you have high-value computers for which you need to monitor all changes (especially, deletion of file shares), monitor for all [5144](event-5144.md) events on these computers. For example, you could monitor file shares on domain controllers. diff --git a/windows/security/threat-protection/auditing/event-5145.md b/windows/security/threat-protection/auditing/event-5145.md index f5ec73669e..dee8d57794 100644 --- a/windows/security/threat-protection/auditing/event-5145.md +++ b/windows/security/threat-protection/auditing/event-5145.md @@ -2,7 +2,7 @@ title: 5145(S, F) A network share object was checked to see whether client can be granted desired access. (Windows 10) description: Describes security event 5145(S, F) A network share object was checked to see whether client can be granted desired access. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5145(S, F): A network share object was checked to see whether client can be granted desired access. diff --git a/windows/security/threat-protection/auditing/event-5148.md b/windows/security/threat-protection/auditing/event-5148.md index 6787ac6329..23a31eb1a6 100644 --- a/windows/security/threat-protection/auditing/event-5148.md +++ b/windows/security/threat-protection/auditing/event-5148.md @@ -2,7 +2,7 @@ title: 5148(F) The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. (Windows 10) description: Details on Security event 5148(F), The Windows Filtering Platform has detected a DoS attack and entered a defensive mode. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 05/29/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5148(F): The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. diff --git a/windows/security/threat-protection/auditing/event-5149.md b/windows/security/threat-protection/auditing/event-5149.md index 59386a8ef4..04f6c8747a 100644 --- a/windows/security/threat-protection/auditing/event-5149.md +++ b/windows/security/threat-protection/auditing/event-5149.md @@ -2,7 +2,7 @@ title: 5149(F) The DoS attack has subsided and normal processing is being resumed. (Windows 10) description: Describes security event 5149(F) The DoS attack has subsided and normal processing is being resumed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 05/29/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5149(F): The DoS attack has subsided and normal processing is being resumed. diff --git a/windows/security/threat-protection/auditing/event-5150.md b/windows/security/threat-protection/auditing/event-5150.md index c1f8d98680..018894b1cf 100644 --- a/windows/security/threat-protection/auditing/event-5150.md +++ b/windows/security/threat-protection/auditing/event-5150.md @@ -2,7 +2,7 @@ title: 5150(-) The Windows Filtering Platform blocked a packet. (Windows 10) description: Describes security event 5150(-) The Windows Filtering Platform blocked a packet. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5150(-): The Windows Filtering Platform blocked a packet. diff --git a/windows/security/threat-protection/auditing/event-5151.md b/windows/security/threat-protection/auditing/event-5151.md index 699a093def..1b55b64d41 100644 --- a/windows/security/threat-protection/auditing/event-5151.md +++ b/windows/security/threat-protection/auditing/event-5151.md @@ -2,7 +2,7 @@ title: 5151(-) A more restrictive Windows Filtering Platform filter has blocked a packet. (Windows 10) description: Describes security event 5151(-) A more restrictive Windows Filtering Platform filter has blocked a packet. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5151(-): A more restrictive Windows Filtering Platform filter has blocked a packet. diff --git a/windows/security/threat-protection/auditing/event-5152.md b/windows/security/threat-protection/auditing/event-5152.md index e2b46de2c3..d89a240a64 100644 --- a/windows/security/threat-protection/auditing/event-5152.md +++ b/windows/security/threat-protection/auditing/event-5152.md @@ -2,7 +2,7 @@ title: 5152(F) The Windows Filtering Platform blocked a packet. (Windows 10) description: Describes security event 5152(F) The Windows Filtering Platform blocked a packet. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5152(F): The Windows Filtering Platform blocked a packet. @@ -128,9 +129,9 @@ This event is generated for every received network packet. - 127.0.0.1 , ::1 - localhost -- **Destination Port** \[Type = UnicodeString\]**:** port number which was used from remote machine to send the packet. +- **Destination Port** \[Type = UnicodeString\]**:** port number that was used from remote machine to send the packet. -- **Protocol** \[Type = UInt32\]: number of protocol which was used. +- **Protocol** \[Type = UInt32\]**:** number of the protocol that was used. | Service | Protocol Number | |----------------------------------------------------|-----------------| @@ -152,15 +153,15 @@ This event is generated for every received network packet. **Filter Information:** -- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which blocked the packet. +- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID that blocked the packet. - To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As result of this command **filters.xml** file will be generated. You need to open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: + To find a specific Windows Filtering Platform filter by ID, run the following command: **netsh wfp show filters**. As a result of this command, the **filters.xml** file will be generated. Open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: Filters.xml file illustration - **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name. -- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: +- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find a specific Windows Filtering Platform layer ID, run the following command: **netsh wfp show state**. As a result of this command **wfpstate.xml** file will be generated. Open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: Wfpstate xml illustration @@ -168,7 +169,7 @@ This event is generated for every received network packet. For 5152(F): The Windows Filtering Platform blocked a packet. -- If you have a pre-defined application which should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. +- If you have a pre-defined application that should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. - You can monitor to see if “**Application**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). @@ -178,13 +179,13 @@ For 5152(F): The Windows Filtering Platform blocked a packet. - If the computer or device should not have access to the Internet, or contains only applications that don’t connect to the Internet, monitor for [5152](event-5152.md) events where **Destination Address** is an IP address from the Internet (not from private IP ranges). -- If you know that the computer should never contact or be contacted by certain network IP addresses, monitor for these addresses in “**Destination Address**.” +- If you know that the computer should never contact or should never be contacted by certain network IP addresses, monitor for these addresses in **Destination Address**. -- If you have a “whitelist” of IP addresses that the computer or device is expected to contact or be contacted by, monitor for IP addresses in **“Destination Address”** that are not in the whitelist. +- If you have an allow list of IP addresses that the computer or device is expected to contact or to be contacted by, monitor for IP addresses in **“Destination Address”** that are not in the allow list. - If you need to monitor all inbound connections to a specific local port, monitor for [5152](event-5152.md) events with that “**Source Port**.**”** -- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or compter, for example, anything other than 1, 6, or 17. +- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or computer, for example, anything other than 1, 6, or 17. - If the computer’s communication with “**Destination Address”** should always use a specific “**Destination Port**,**”** monitor for any other “**Destination Port**.” diff --git a/windows/security/threat-protection/auditing/event-5153.md b/windows/security/threat-protection/auditing/event-5153.md index 8751b40002..ce3f53f60d 100644 --- a/windows/security/threat-protection/auditing/event-5153.md +++ b/windows/security/threat-protection/auditing/event-5153.md @@ -2,7 +2,7 @@ title: 5153(S) A more restrictive Windows Filtering Platform filter has blocked a packet. (Windows 10) description: Describes security event 5153(S) A more restrictive Windows Filtering Platform filter has blocked a packet. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5153(S): A more restrictive Windows Filtering Platform filter has blocked a packet. diff --git a/windows/security/threat-protection/auditing/event-5154.md b/windows/security/threat-protection/auditing/event-5154.md index f66366168d..5083012650 100644 --- a/windows/security/threat-protection/auditing/event-5154.md +++ b/windows/security/threat-protection/auditing/event-5154.md @@ -2,7 +2,7 @@ title: 5154(S) The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. (Windows 10) description: Describes security event 5154(S) The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5154(S): The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. @@ -75,7 +76,7 @@ This event generates every time [Windows Filtering Platform](https://msdn.micros **Application Information**: -- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process which was permitted to listen on the port. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): +- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that was permitted to listen on the port. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): Task manager illustration @@ -103,7 +104,7 @@ This event generates every time [Windows Filtering Platform](https://msdn.micros - 127.0.0.1 , ::1 - localhost -- **Source Port** \[Type = UnicodeString\]: source TCP\\UDP port number which was requested for listening by application. +- **Source Port** \[Type = UnicodeString\]: source TCP\\UDP port number that was requested for listening by application. - **Protocol** \[Type = UInt32\]: protocol number. For example: @@ -115,15 +116,15 @@ This event generates every time [Windows Filtering Platform](https://msdn.micros **Filter Information:** -- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which allows application to listen on the specific port. By default Windows firewall won't prevent a port from being listened by an application and if this application doesn’t match any filters you will get value **0** in this field. +- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID that allows application to listen on the specific port. By default Windows firewall won't prevent a port from being listened by an application and if this application doesn’t match any filters you will get value **0** in this field. - To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As result of this command **filters.xml** file will be generated. You need to open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: + To find a specific Windows Filtering Platform filter by ID, run the following command: **netsh wfp show filters**. As a result of this command, the **filters.xml** file will be generated. Open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: Filters.xml file illustration - **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name. -- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: +- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find a specific Windows Filtering Platform layer ID, run the following command: **netsh wfp show state**. As a result of this command, the **wfpstate.xml** file will be generated. Open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: Wfpstate xml illustration @@ -131,7 +132,7 @@ This event generates every time [Windows Filtering Platform](https://msdn.micros For 5154(S): The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections. -- If you have a “whitelist” of applications that are associated with certain operating systems or server roles, and that are expected to listen on specific ports, monitor this event for **“Application Name”** and other relevant information. +- If you have an “allow list” of applications that are associated with certain operating systems or server roles, and that are expected to listen on specific ports, monitor this event for **“Application Name”** and other relevant information. - If a certain application is allowed to listen only on specific port numbers, monitor this event for **“Application Name”** and **“Network Information\\Source Port**.**”** @@ -139,7 +140,7 @@ For 5154(S): The Windows Filtering Platform has permitted an application or serv - If a certain application is allowed to use only TCP or UDP protocols, monitor this event for **“Application Name”** and the protocol number in **“Network Information\\Protocol**.**”** -- If you have a pre-defined application which should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. +- If you have a predefined application that should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. - You can monitor to see if “**Application**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). diff --git a/windows/security/threat-protection/auditing/event-5155.md b/windows/security/threat-protection/auditing/event-5155.md index 9964b6f390..7d6eac1919 100644 --- a/windows/security/threat-protection/auditing/event-5155.md +++ b/windows/security/threat-protection/auditing/event-5155.md @@ -2,7 +2,7 @@ title: 5155(F) The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. (Windows 10) description: Describes security event 5155(F) The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5155(F): The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections. diff --git a/windows/security/threat-protection/auditing/event-5156.md b/windows/security/threat-protection/auditing/event-5156.md index cdfc758875..8c1116cba5 100644 --- a/windows/security/threat-protection/auditing/event-5156.md +++ b/windows/security/threat-protection/auditing/event-5156.md @@ -2,7 +2,7 @@ title: 5156(S) The Windows Filtering Platform has permitted a connection. (Windows 10) description: Describes security event 5156(S) The Windows Filtering Platform has permitted a connection. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5156(S): The Windows Filtering Platform has permitted a connection. @@ -80,7 +81,7 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co **Application Information**: -- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process which received the connection. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): +- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that received the connection. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): Task manager illustration @@ -130,7 +131,7 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co - **Destination Port** \[Type = UnicodeString\]**:** port number where the connection was received. -- **Protocol** \[Type = UInt32\]: number of protocol which was used. +- **Protocol** \[Type = UInt32\]: number of the protocol that was used. | Service | Protocol Number | |----------------------------------------------------|-----------------| @@ -152,15 +153,15 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co **Filter Information:** -- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which allowed the connection. +- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID that allowed the connection. - To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As result of this command **filters.xml** file will be generated. You need to open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: + To find a specific Windows Filtering Platform filter by ID, run the following command: **netsh wfp show filters**. As a result of this command, the **filters.xml** file will be generated. Open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: Filters.xml file illustration - **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name. -- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: +- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find a specific Windows Filtering Platform layer ID, run the following command: **netsh wfp show state**. As a result of this command, the **wfpstate.xml** file will be generated. Open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: Wfpstate xml illustration @@ -168,7 +169,7 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co For 5156(S): The Windows Filtering Platform has permitted a connection. -- If you have a pre-defined application which should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. +- If you have a predefined application that should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. - You can monitor to see if “**Application**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). @@ -178,9 +179,9 @@ For 5156(S): The Windows Filtering Platform has permitted a connection. - If the computer or device should not have access to the Internet, or contains only applications that don’t connect to the Internet, monitor for [5156](event-5156.md) events where “**Destination Address”** is an IP address from the Internet (not from private IP ranges). -- If you know that the computer should never contact or be contacted by certain network IP addresses, monitor for these addresses in “**Destination Address**.**”** +- If you know that the computer should never contact or should never be contacted by certain network IP addresses, monitor for these addresses in “**Destination Address**.**”** -- If you have a “whitelist” of IP addresses that the computer or device is expected to contact or be contacted by, monitor for IP addresses in “**Destination Address”** that are not in the whitelist. +- If you have an allow list of IP addresses that the computer or device is expected to contact or to be contacted by, monitor for IP addresses in “**Destination Address”** that are not in the allow list. - If you need to monitor all inbound connections to a specific local port, monitor for [5156](event-5156.md) events with that “**Source Port**.**”** diff --git a/windows/security/threat-protection/auditing/event-5157.md b/windows/security/threat-protection/auditing/event-5157.md index 76a8a34a2d..2f2b2cd8fd 100644 --- a/windows/security/threat-protection/auditing/event-5157.md +++ b/windows/security/threat-protection/auditing/event-5157.md @@ -2,7 +2,7 @@ title: 5157(F) The Windows Filtering Platform has blocked a connection. (Windows 10) description: Describes security event 5157(F) The Windows Filtering Platform has blocked a connection. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5157(F): The Windows Filtering Platform has blocked a connection. @@ -128,9 +129,9 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co - 127.0.0.1 , ::1 - localhost -- **Destination Port** \[Type = UnicodeString\]**:** port number which was used from remote machine to initiate connection. +- **Destination Port** \[Type = UnicodeString\]**:** port number that was used from remote machine to initiate connection. -- **Protocol** \[Type = UInt32\]: number of protocol which was used. +- **Protocol** \[Type = UInt32\]: number of the protocol that was used. | Service | Protocol Number | |----------------------------------------------------|-----------------| @@ -152,15 +153,15 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co **Filter Information:** -- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which blocked the connection. +- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID that blocked the connection. - To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As result of this command **filters.xml** file will be generated. You need to open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: + To find a specific Windows Filtering Platform filter by ID, run the following command: **netsh wfp show filters**. As a result of this command, the **filters.xml** file will be generated. Open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: Filters.xml file illustration - **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name. -- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: +- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find a specific Windows Filtering Platform layer ID, run the following command: **netsh wfp show state**. As a result of this command, the **wfpstate.xml** file will be generated. Open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: Wfpstate xml illustration @@ -168,7 +169,7 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co For 5157(F): The Windows Filtering Platform has blocked a connection. -- If you have a pre-defined application which should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. +- If you have a predefined application that should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. - You can monitor to see if “**Application**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). @@ -178,13 +179,13 @@ For 5157(F): The Windows Filtering Platform has blocked a connection. - If the\` computer or device should not have access to the Internet, or contains only applications that don’t connect to the Internet, monitor for [5157](event-5157.md) events where “**Destination Address”** is an IP address from the Internet (not from private IP ranges). -- If you know that the computer should never contact or be contacted by certain network IP addresses, monitor for these addresses in “**Destination Address**.**”** +- If you know that the computer should never contact or should never be contacted by certain network IP addresses, monitor for these addresses in “**Destination Address**.**”** -- If you have a “whitelist” of IP addresses that the computer or device is expected to contact or be contacted by, monitor for IP addresses in “**Destination Address”** that are not in the whitelist. +- If you have an allow list of IP addresses that the computer or device is expected to contact or to be contacted by, monitor for IP addresses in “**Destination Address”** that are not in the allow list. - If you need to monitor all inbound connections to a specific local port, monitor for [5157](event-5157.md) events with that “**Source Port**.**”** -- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or compter, for example, anything other than 1, 6, or 17. +- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or computer, for example, anything other than 1, 6, or 17. - If the computer’s communication with “**Destination Address”** should always use a specific “**Destination Port**,**”** monitor for any other “**Destination Port**.” diff --git a/windows/security/threat-protection/auditing/event-5158.md b/windows/security/threat-protection/auditing/event-5158.md index 55dd4c04da..63753bbc2b 100644 --- a/windows/security/threat-protection/auditing/event-5158.md +++ b/windows/security/threat-protection/auditing/event-5158.md @@ -2,7 +2,7 @@ title: 5158(S) The Windows Filtering Platform has permitted a bind to a local port. (Windows 10) description: Describes security event 5158(S) The Windows Filtering Platform has permitted a bind to a local port. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5158(S): The Windows Filtering Platform has permitted a bind to a local port. @@ -75,7 +76,7 @@ This event generates every time [Windows Filtering Platform](https://msdn.micros **Application Information**: -- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process which was permitted to bind to the local port. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): +- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that was permitted to bind to the local port. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): Task manager illustration @@ -107,7 +108,7 @@ This event generates every time [Windows Filtering Platform](https://msdn.micros - **Source Port** \[Type = UnicodeString\]**:** port number which application was bind. -- **Protocol** \[Type = UInt32\]: number of protocol which was used. +- **Protocol** \[Type = UInt32\]: number of the protocol that was used. | Service | Protocol Number | |----------------------------------------------------|-----------------| @@ -129,15 +130,15 @@ This event generates every time [Windows Filtering Platform](https://msdn.micros **Filter Information:** -- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which allows application to bind the port. By default Windows firewall won't prevent a port from being binded by an application and if this application doesn’t match any filters you will get value 0 in this field. +- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID that allows the application to bind the port. By default, Windows firewall won't prevent a port from being bound by an application. If this application doesn’t match any filters, you will get value 0 in this field. - To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As result of this command **filters.xml** file will be generated. You need to open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: + To find a specific Windows Filtering Platform filter by ID, run the following command: **netsh wfp show filters**. As a result of this command, the **filters.xml** file will be generated. Open this file and find specific substring with required filter ID (**<filterId>**)**,** for example: Filters.xml file illustration - **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name. -- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: +- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find a specific Windows Filtering Platform layer ID, run the following command: **netsh wfp show state**. As a result of this command, the **wfpstate.xml** file will be generated. Open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: Wfpstate xml illustration @@ -145,7 +146,7 @@ This event generates every time [Windows Filtering Platform](https://msdn.micros For 5158(S): The Windows Filtering Platform has permitted a bind to a local port. -- If you have a pre-defined application which should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. +- If you have a predefined application that should be used to perform the operation that was reported by this event, monitor events with “**Application**” not equal to your defined application. - You can monitor to see if “**Application**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). @@ -155,7 +156,7 @@ For 5158(S): The Windows Filtering Platform has permitted a bind to a local port - If you need to monitor all actions with a specific local port, monitor for [5158](event-5158.md) events with that “**Source Port.”** -- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or compter, for example, anything other than 6 or 17. +- Monitor for all connections with a “**Protocol Number”** that is not typical for this device or computer, for example, anything other than 6 or 17. - If the computer’s communication with “**Destination Address”** should always use a specific “**Destination Port**,**”** monitor for any other “**Destination Port**.” diff --git a/windows/security/threat-protection/auditing/event-5159.md b/windows/security/threat-protection/auditing/event-5159.md index 998321eae5..b5b867bc47 100644 --- a/windows/security/threat-protection/auditing/event-5159.md +++ b/windows/security/threat-protection/auditing/event-5159.md @@ -2,7 +2,7 @@ title: 5159(F) The Windows Filtering Platform has blocked a bind to a local port. (Windows 10) description: Describes security event 5159(F) The Windows Filtering Platform has blocked a bind to a local port. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5159(F): The Windows Filtering Platform has blocked a bind to a local port. @@ -73,7 +74,7 @@ This event is logged if the Windows Filtering Platform has blocked a bind to a l **Application Information**: -- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process which was permitted to bind to the local port. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): +- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that was permitted to bind to the local port. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): Task manager illustration @@ -127,15 +128,15 @@ This event is logged if the Windows Filtering Platform has blocked a bind to a l **Filter Information:** -- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which blocks the application from binding to the port. By default, Windows firewall won't prevent a port from binding by an application, and if this application doesn’t match any filters, you will get value 0 in this field. +- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID that blocks the application from binding to the port. By default, Windows firewall won't prevent a port from binding by an application, and if this application doesn’t match any filters, you will get value 0 in this field. - To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As a result of this command, **filters.xml** file will be generated. You need to open this file and find the specific substring with the required filter ID (**<filterId>**)**,** for example: + To find a specific Windows Filtering Platform filter by ID, run the following command: **netsh wfp show filters**. As a result of this command, the **filters.xml** file will be generated. Open this file and find the specific substring with the required filter ID (**<filterId>**)**,** for example: Filters.xml file illustration - **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name. -- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example: +- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find a specific Windows Filtering Platform layer ID, run the following command: **netsh wfp show state**. As a result of this command, the **wfpstate.xml** file will be generated. Open this file and find the specific substring with the required layer ID (**<layerId>**)**,** for example: Wfpstate xml illustration diff --git a/windows/security/threat-protection/auditing/event-5168.md b/windows/security/threat-protection/auditing/event-5168.md index 9889690df3..819d9f191e 100644 --- a/windows/security/threat-protection/auditing/event-5168.md +++ b/windows/security/threat-protection/auditing/event-5168.md @@ -1,8 +1,8 @@ --- title: 5168(F) SPN check for SMB/SMB2 failed. (Windows 10) -description: Describes security event 5168(F) SPN check for SMB/SMB2 failed. +description: Describes security event 5168(F) SPN check for SMB/SMB2 failed. This event is generated when an SMB SPN check fails. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5168(F): SPN check for SMB/SMB2 failed. diff --git a/windows/security/threat-protection/auditing/event-5376.md b/windows/security/threat-protection/auditing/event-5376.md index f888db6fb2..3d7cc2e623 100644 --- a/windows/security/threat-protection/auditing/event-5376.md +++ b/windows/security/threat-protection/auditing/event-5376.md @@ -2,7 +2,7 @@ title: 5376(S) Credential Manager credentials were backed up. (Windows 10) description: Describes security event 5376(S) Credential Manager credentials were backed up. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5376(S): Credential Manager credentials were backed up. diff --git a/windows/security/threat-protection/auditing/event-5377.md b/windows/security/threat-protection/auditing/event-5377.md index 1ed830b074..98ccff769a 100644 --- a/windows/security/threat-protection/auditing/event-5377.md +++ b/windows/security/threat-protection/auditing/event-5377.md @@ -2,7 +2,7 @@ title: 5377(S) Credential Manager credentials were restored from a backup. (Windows 10) description: Describes security event 5377(S) Credential Manager credentials were restored from a backup. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5377(S): Credential Manager credentials were restored from a backup. diff --git a/windows/security/threat-protection/auditing/event-5378.md b/windows/security/threat-protection/auditing/event-5378.md index bb48a36562..04395a702b 100644 --- a/windows/security/threat-protection/auditing/event-5378.md +++ b/windows/security/threat-protection/auditing/event-5378.md @@ -2,7 +2,7 @@ title: 5378(F) The requested credentials delegation was disallowed by policy. (Windows 10) description: Describes security event 5378(F) The requested credentials delegation was disallowed by policy. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5378(F): The requested credentials delegation was disallowed by policy. diff --git a/windows/security/threat-protection/auditing/event-5447.md b/windows/security/threat-protection/auditing/event-5447.md index 89dd2b5bf0..a647b4c565 100644 --- a/windows/security/threat-protection/auditing/event-5447.md +++ b/windows/security/threat-protection/auditing/event-5447.md @@ -2,7 +2,7 @@ title: 5447(S) A Windows Filtering Platform filter has been changed. (Windows 10) description: Describes security event 5447(S) A Windows Filtering Platform filter has been changed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5447(S): A Windows Filtering Platform filter has been changed. diff --git a/windows/security/threat-protection/auditing/event-5632.md b/windows/security/threat-protection/auditing/event-5632.md index 756db4ebbf..0870e6a7fc 100644 --- a/windows/security/threat-protection/auditing/event-5632.md +++ b/windows/security/threat-protection/auditing/event-5632.md @@ -2,7 +2,7 @@ title: 5632(S, F) A request was made to authenticate to a wireless network. (Windows 10) description: Describes security event 5632(S, F) A request was made to authenticate to a wireless network. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5632(S, F): A request was made to authenticate to a wireless network. diff --git a/windows/security/threat-protection/auditing/event-5633.md b/windows/security/threat-protection/auditing/event-5633.md index d85599c157..1bb8d2d300 100644 --- a/windows/security/threat-protection/auditing/event-5633.md +++ b/windows/security/threat-protection/auditing/event-5633.md @@ -2,7 +2,7 @@ title: 5633(S, F) A request was made to authenticate to a wired network. (Windows 10) description: Describes security event 5633(S, F) A request was made to authenticate to a wired network. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5633(S, F): A request was made to authenticate to a wired network. diff --git a/windows/security/threat-protection/auditing/event-5712.md b/windows/security/threat-protection/auditing/event-5712.md index 2fae83e65f..5bb81e6f09 100644 --- a/windows/security/threat-protection/auditing/event-5712.md +++ b/windows/security/threat-protection/auditing/event-5712.md @@ -2,7 +2,7 @@ title: 5712(S) A Remote Procedure Call (RPC) was attempted. (Windows 10) description: Describes security event 5712(S) A Remote Procedure Call (RPC) was attempted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5712(S): A Remote Procedure Call (RPC) was attempted. diff --git a/windows/security/threat-protection/auditing/event-5888.md b/windows/security/threat-protection/auditing/event-5888.md index 43f79ed55d..8531945a54 100644 --- a/windows/security/threat-protection/auditing/event-5888.md +++ b/windows/security/threat-protection/auditing/event-5888.md @@ -2,7 +2,7 @@ title: 5888(S) An object in the COM+ Catalog was modified. (Windows 10) description: Describes security event 5888(S) An object in the COM+ Catalog was modified. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5888(S): An object in the COM+ Catalog was modified. diff --git a/windows/security/threat-protection/auditing/event-5889.md b/windows/security/threat-protection/auditing/event-5889.md index 5daae37ce0..3fe376f85c 100644 --- a/windows/security/threat-protection/auditing/event-5889.md +++ b/windows/security/threat-protection/auditing/event-5889.md @@ -2,7 +2,7 @@ title: 5889(S) An object was deleted from the COM+ Catalog. (Windows 10) description: Describes security event 5889(S) An object was deleted from the COM+ Catalog. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5889(S): An object was deleted from the COM+ Catalog. diff --git a/windows/security/threat-protection/auditing/event-5890.md b/windows/security/threat-protection/auditing/event-5890.md index f5f0c81561..9a90b1a6a3 100644 --- a/windows/security/threat-protection/auditing/event-5890.md +++ b/windows/security/threat-protection/auditing/event-5890.md @@ -2,7 +2,7 @@ title: 5890(S) An object was added to the COM+ Catalog. (Windows 10) description: Describes security event 5890(S) An object was added to the COM+ Catalog. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 5890(S): An object was added to the COM+ Catalog. diff --git a/windows/security/threat-protection/auditing/event-6144.md b/windows/security/threat-protection/auditing/event-6144.md index 7f0df8a521..7565e8f794 100644 --- a/windows/security/threat-protection/auditing/event-6144.md +++ b/windows/security/threat-protection/auditing/event-6144.md @@ -2,7 +2,7 @@ title: 6144(S) Security policy in the group policy objects has been applied successfully. (Windows 10) description: Describes security event 6144(S) Security policy in the group policy objects has been applied successfully. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6144(S): Security policy in the group policy objects has been applied successfully. diff --git a/windows/security/threat-protection/auditing/event-6145.md b/windows/security/threat-protection/auditing/event-6145.md index c9a27526cd..8b541749d6 100644 --- a/windows/security/threat-protection/auditing/event-6145.md +++ b/windows/security/threat-protection/auditing/event-6145.md @@ -2,7 +2,7 @@ title: 6145(F) One or more errors occurred while processing security policy in the group policy objects. (Windows 10) description: Describes security event 6145(F) One or more errors occurred while processing security policy in the group policy objects. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6145(F): One or more errors occurred while processing security policy in the group policy objects. diff --git a/windows/security/threat-protection/auditing/event-6281.md b/windows/security/threat-protection/auditing/event-6281.md index e8dfb2d7cf..b4d79cbbdb 100644 --- a/windows/security/threat-protection/auditing/event-6281.md +++ b/windows/security/threat-protection/auditing/event-6281.md @@ -2,7 +2,7 @@ title: 6281(F) Code Integrity determined that the page hashes of an image file are not valid. (Windows 10) description: Describes security event 6281(F) Code Integrity determined that the page hashes of an image file are not valid. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6281(F): Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error. diff --git a/windows/security/threat-protection/auditing/event-6400.md b/windows/security/threat-protection/auditing/event-6400.md index 7a379132bc..acefc262d9 100644 --- a/windows/security/threat-protection/auditing/event-6400.md +++ b/windows/security/threat-protection/auditing/event-6400.md @@ -2,7 +2,7 @@ title: 6400(-) BranchCache Received an incorrectly formatted response while discovering availability of content. (Windows 10) description: Describes security event 6400(-) BranchCache Received an incorrectly formatted response while discovering availability of content. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6400(-): BranchCache: Received an incorrectly formatted response while discovering availability of content. diff --git a/windows/security/threat-protection/auditing/event-6401.md b/windows/security/threat-protection/auditing/event-6401.md index 1ce4c083dd..1b442d10d9 100644 --- a/windows/security/threat-protection/auditing/event-6401.md +++ b/windows/security/threat-protection/auditing/event-6401.md @@ -2,7 +2,7 @@ title: 6401(-) BranchCache Received invalid data from a peer. Data discarded. (Windows 10) description: Describes security event 6401(-) BranchCache Received invalid data from a peer. Data discarded. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6401(-): BranchCache: Received invalid data from a peer. Data discarded. diff --git a/windows/security/threat-protection/auditing/event-6402.md b/windows/security/threat-protection/auditing/event-6402.md index dde20455d3..77a10ac4dc 100644 --- a/windows/security/threat-protection/auditing/event-6402.md +++ b/windows/security/threat-protection/auditing/event-6402.md @@ -2,7 +2,7 @@ title: 6402(-) BranchCache The message to the hosted cache offering it data is incorrectly formatted. (Windows 10) description: Describes security event 6402(-) BranchCache The message to the hosted cache offering it data is incorrectly formatted. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6402(-): BranchCache: The message to the hosted cache offering it data is incorrectly formatted. diff --git a/windows/security/threat-protection/auditing/event-6403.md b/windows/security/threat-protection/auditing/event-6403.md index e8020581ad..d730acb9d3 100644 --- a/windows/security/threat-protection/auditing/event-6403.md +++ b/windows/security/threat-protection/auditing/event-6403.md @@ -2,7 +2,7 @@ title: 6403(-) BranchCache The hosted cache sent an incorrectly formatted response to the client. (Windows 10) description: Describes security event 6403(-) BranchCache The hosted cache sent an incorrectly formatted response to the client. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6403(-): BranchCache: The hosted cache sent an incorrectly formatted response to the client. diff --git a/windows/security/threat-protection/auditing/event-6404.md b/windows/security/threat-protection/auditing/event-6404.md index 43228f26be..808c8e4264 100644 --- a/windows/security/threat-protection/auditing/event-6404.md +++ b/windows/security/threat-protection/auditing/event-6404.md @@ -2,7 +2,7 @@ title: 6404(-) BranchCache Hosted cache could not be authenticated using the provisioned SSL certificate. (Windows 10) description: Describes security event 6404(-) BranchCache Hosted cache could not be authenticated using the provisioned SSL certificate. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6404(-): BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate. diff --git a/windows/security/threat-protection/auditing/event-6405.md b/windows/security/threat-protection/auditing/event-6405.md index ea59bc3fc7..2638753673 100644 --- a/windows/security/threat-protection/auditing/event-6405.md +++ b/windows/security/threat-protection/auditing/event-6405.md @@ -2,7 +2,7 @@ title: 6405(-) BranchCache %2 instance(s) of event id %1 occurred. (Windows 10) description: Describes security event 6405(-) BranchCache %2 instance(s) of event id %1 occurred. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6405(-): BranchCache: %2 instance(s) of event id %1 occurred. diff --git a/windows/security/threat-protection/auditing/event-6406.md b/windows/security/threat-protection/auditing/event-6406.md index d70fac0adb..11cef9058e 100644 --- a/windows/security/threat-protection/auditing/event-6406.md +++ b/windows/security/threat-protection/auditing/event-6406.md @@ -2,7 +2,7 @@ title: 6406(-) %1 registered to Windows Firewall to control filtering for the following %2. (Windows 10) description: Describes security event 6406(-) %1 registered to Windows Firewall to control filtering for the following %2. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6406(-): %1 registered to Windows Firewall to control filtering for the following: %2. diff --git a/windows/security/threat-protection/auditing/event-6407.md b/windows/security/threat-protection/auditing/event-6407.md index 396bf6af15..1e3d0cbd85 100644 --- a/windows/security/threat-protection/auditing/event-6407.md +++ b/windows/security/threat-protection/auditing/event-6407.md @@ -1,8 +1,8 @@ --- title: 6407(-) 1%. (Windows 10) -description: Describes security event 6407(-) 1%. +description: Describes security event 6407(-) 1%. This is a BranchCache event, which is outside the scope of this document. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6407(-): 1%. diff --git a/windows/security/threat-protection/auditing/event-6408.md b/windows/security/threat-protection/auditing/event-6408.md index ffb33ccdee..d3bd29901c 100644 --- a/windows/security/threat-protection/auditing/event-6408.md +++ b/windows/security/threat-protection/auditing/event-6408.md @@ -2,7 +2,7 @@ title: 6408(-) Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. (Windows 10) description: Describes security event 6408(-) Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6408(-): Registered product %1 failed and Windows Firewall is now controlling the filtering for %2. diff --git a/windows/security/threat-protection/auditing/event-6409.md b/windows/security/threat-protection/auditing/event-6409.md index e1f76dbf69..97d212be9a 100644 --- a/windows/security/threat-protection/auditing/event-6409.md +++ b/windows/security/threat-protection/auditing/event-6409.md @@ -2,7 +2,7 @@ title: 6409(-) BranchCache A service connection point object could not be parsed. (Windows 10) description: Describes security event 6409(-) BranchCache A service connection point object could not be parsed. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6409(-): BranchCache: A service connection point object could not be parsed. diff --git a/windows/security/threat-protection/auditing/event-6410.md b/windows/security/threat-protection/auditing/event-6410.md index b13bbde8fc..a8980cfb49 100644 --- a/windows/security/threat-protection/auditing/event-6410.md +++ b/windows/security/threat-protection/auditing/event-6410.md @@ -2,7 +2,7 @@ title: 6410(F) Code integrity determined that a file does not meet the security requirements to load into a process. (Windows 10) description: Describes security event 6410(F) Code integrity determined that a file does not meet the security requirements to load into a process. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6410(F): Code integrity determined that a file does not meet the security requirements to load into a process. diff --git a/windows/security/threat-protection/auditing/event-6416.md b/windows/security/threat-protection/auditing/event-6416.md index 6e4c4af309..4b85673aa7 100644 --- a/windows/security/threat-protection/auditing/event-6416.md +++ b/windows/security/threat-protection/auditing/event-6416.md @@ -2,7 +2,7 @@ title: 6416(S) A new external device was recognized by the System. (Windows 10) description: Describes security event 6416(S) A new external device was recognized by the System. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6416(S): A new external device was recognized by the System. diff --git a/windows/security/threat-protection/auditing/event-6419.md b/windows/security/threat-protection/auditing/event-6419.md index e5c1d7fab1..90c145ff77 100644 --- a/windows/security/threat-protection/auditing/event-6419.md +++ b/windows/security/threat-protection/auditing/event-6419.md @@ -2,7 +2,7 @@ title: 6419(S) A request was made to disable a device. (Windows 10) description: Describes security event 6419(S) A request was made to disable a device. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6419(S): A request was made to disable a device. diff --git a/windows/security/threat-protection/auditing/event-6420.md b/windows/security/threat-protection/auditing/event-6420.md index 37b3ec6aaf..51570d3ab3 100644 --- a/windows/security/threat-protection/auditing/event-6420.md +++ b/windows/security/threat-protection/auditing/event-6420.md @@ -1,8 +1,8 @@ --- title: 6420(S) A device was disabled. (Windows 10) -description: Describes security event 6420(S) A device was disabled. +description: Describes security event 6420(S) A device was disabled. This event is generated when a specific device is disabled. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6420(S): A device was disabled. diff --git a/windows/security/threat-protection/auditing/event-6421.md b/windows/security/threat-protection/auditing/event-6421.md index 4994eafbd7..ef4e0b856f 100644 --- a/windows/security/threat-protection/auditing/event-6421.md +++ b/windows/security/threat-protection/auditing/event-6421.md @@ -2,7 +2,7 @@ title: 6421(S) A request was made to enable a device. (Windows 10) description: Describes security event 6421(S) A request was made to enable a device. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6421(S): A request was made to enable a device. diff --git a/windows/security/threat-protection/auditing/event-6422.md b/windows/security/threat-protection/auditing/event-6422.md index 5c4de3d822..2b2f45d1b8 100644 --- a/windows/security/threat-protection/auditing/event-6422.md +++ b/windows/security/threat-protection/auditing/event-6422.md @@ -1,8 +1,8 @@ --- title: 6422(S) A device was enabled. (Windows 10) -description: Describes security event 6422(S) A device was enabled. +description: Describes security event 6422(S) A device was enabled. This event is generated when a specific device is enabled. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6422(S): A device was enabled. diff --git a/windows/security/threat-protection/auditing/event-6423.md b/windows/security/threat-protection/auditing/event-6423.md index 67b96baef5..3332a01011 100644 --- a/windows/security/threat-protection/auditing/event-6423.md +++ b/windows/security/threat-protection/auditing/event-6423.md @@ -2,7 +2,7 @@ title: 6423(S) The installation of this device is forbidden by system policy. (Windows 10) description: Describes security event 6423(S) The installation of this device is forbidden by system policy. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6423(S): The installation of this device is forbidden by system policy. diff --git a/windows/security/threat-protection/auditing/event-6424.md b/windows/security/threat-protection/auditing/event-6424.md index 4e21756137..8ca1ce36d6 100644 --- a/windows/security/threat-protection/auditing/event-6424.md +++ b/windows/security/threat-protection/auditing/event-6424.md @@ -2,7 +2,7 @@ title: 6424(S) The installation of this device was allowed, after having previously been forbidden by policy. (Windows 10) description: Describes security event 6424(S) The installation of this device was allowed, after having previously been forbidden by policy. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # 6424(S): The installation of this device was allowed, after having previously been forbidden by policy. diff --git a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md index c9d3a1c9ba..1093140e38 100644 --- a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md +++ b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md @@ -4,7 +4,7 @@ description: The policy setting, File System (Global Object Access Auditing), en ms.assetid: 4f215d61-0e23-46e4-9e58-08511105d25b ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # File System (Global Object Access Auditing) diff --git a/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md b/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md index 0762f04322..1efc819647 100644 --- a/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md +++ b/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md @@ -1,7 +1,7 @@ --- title: How to get a list of XML data name elements in (Windows 10) -description: This reference topic for the IT professional explains how to use PowerShell to get a list of XML data name elements that can appear in . -ms.prod: w10 +description: This reference article for the IT professional explains how to use PowerShell to get a list of XML data name elements that can appear in . +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -11,6 +11,7 @@ ms.date: 10/22/2018 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # How to get a list of XML data name elements in EventData @@ -20,15 +21,15 @@ ms.author: dansimp The Security log uses a manifest where you can get all of the event schema. -Run the following from an elevated PowerShell prompt: +Run the following command from an elevated PowerShell prompt: ```powershell $secEvents = get-winevent -listprovider "microsoft-windows-security-auditing" ``` -The .events property is a collection of all of the events listed in the manifest on the local machine. +The `.events` property is a collection of all of the events listed in the manifest on the local machine. -For each event, there is a .Template property for the XML template used for the event properties (if there are any). +For each event, there is a `.Template` property for the XML template used for the event properties (if there are any). For example: @@ -90,7 +91,7 @@ PS C:\WINDOWS\system32> $SecEvents.events[100].Template You can use the <Template> and <Description> to map the data name elements that appear in XML view to the names that appear in the event description. -The <Description> is just the format string (if you’re used to Console.Writeline or sprintf statements) and the <Template> is the source of the input parameters for the <Description>. +The <Description> is just the format string (if you’re used to `Console.Writeline` or `sprintf` statements), and the <Template> is the source of the input parameters for the <Description>. Using Security event 4734 as an example: @@ -124,9 +125,9 @@ Description : A security-enabled local group was deleted. ``` -For the **Subject: Security Id:** text element, it will use the fourth element in the Template, **SubjectUserSid**. +For the **Subject: Security ID:** text element, it will use the fourth element in the Template, **SubjectUserSid**. -For **Additional Information Privileges:**, it would use the eighth element **PrivilegeList**. +For **Additional Information Privileges:**, it would use the eighth element, **PrivilegeList**. -A caveat to this is an oft-overlooked property of events called Version (in the <SYSTEM> element) that indicates the revision of the event schema and description. Most events have 1 version (all events have Version =0 like the Security/4734 example) but a few events like Security/4624 or Security/4688 have at least 3 versions (versions 0, 1, 2) depending on the OS version where the event is generated. Only the latest version is used for generating events in the Security log. In any case, the Event Version where the Template is taken from should use the same Event Version for the Description. +A caveat to this principle is an often overlooked property of events called Version (in the <SYSTEM> element) that indicates the revision of the event schema and description. Most events have one version (all events have Version =0 like the Security/4734 example) but a few events like Security/4624 or Security/4688 have at least three versions (versions 0, 1, 2) depending on the OS version where the event is generated. Only the latest version is used for generating events in the Security log. In any case, the Event Version where the Template is taken from should use the same Event Version for the Description. diff --git a/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md index 51cb23c22b..5331884d19 100644 --- a/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md +++ b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md @@ -4,7 +4,7 @@ description: Learn how to use advanced security auditing options to monitor chan ms.assetid: 553f98a6-7606-4518-a3c5-347a33105130 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Monitor central access policy and rule definitions diff --git a/windows/security/threat-protection/auditing/monitor-claim-types.md b/windows/security/threat-protection/auditing/monitor-claim-types.md index d2369fe778..50b89da04a 100644 --- a/windows/security/threat-protection/auditing/monitor-claim-types.md +++ b/windows/security/threat-protection/auditing/monitor-claim-types.md @@ -4,7 +4,7 @@ description: Learn how to monitor changes to claim types that are associated wit ms.assetid: 426084da-4eef-44af-aeec-e7ab4d4e2439 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Monitor claim types diff --git a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md index 14dccc71b4..6d433c9bcd 100644 --- a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md +++ b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md @@ -4,7 +4,7 @@ description: Learn how to monitor changes to resource attribute definitions when ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Monitor resource attribute definitions diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md index e6131584e5..d1429af0f1 100644 --- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md +++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md @@ -4,7 +4,7 @@ description: Monitor changes to central access policies associated with files an ms.assetid: 2ea8fc23-b3ac-432f-87b0-6a16506e8eed ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Monitor the central access policies associated with files and folders diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md index fac29703cb..36bd40c78c 100644 --- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md +++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md @@ -4,7 +4,7 @@ description: Learn how to monitor changes to the central access policies that ap ms.assetid: 126b051e-c20d-41f1-b42f-6cff24dcf20c ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Monitor the central access policies that apply on a file server diff --git a/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md index e1418e2ad9..243c686c50 100644 --- a/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md +++ b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md @@ -4,7 +4,7 @@ description: Learn how to use advanced security auditing options to monitor atte ms.assetid: 4944097b-320f-44c7-88ed-bf55946a358b ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Monitor the resource attributes on files and folders diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 18d2e3d8c2..ef0df1f2a8 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -4,7 +4,7 @@ description: Learn how advanced security auditing options can be used to monitor ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,7 +14,8 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/19/2017 +ms.date: +ms.technology: mde --- # Monitor the use of removable storage devices @@ -28,7 +29,10 @@ If you configure this policy setting, an audit event is generated each time a us Use the following procedures to monitor the use of removable storage devices and to verify that the devices are being monitored. ->**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. +Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. + +> [!NOTE] +> When a policy to audit removable storage is pushed to a computer, a new [Security Descriptor](https://docs.microsoft.com/windows/win32/secauthz/audit-generation) needs to be applied to all removable storage devices with the audit settings. The [security descriptor for a device](https://docs.microsoft.com/windows-hardware/drivers/kernel/controlling-device-access) can be set up either when the device is installed, or by setting up the [device properties in the registry](https://docs.microsoft.com/windows-hardware/drivers/kernel/setting-device-object-registry-properties-after-installation), which is done by calling a [device installation function](https://docs.microsoft.com/previous-versions/ff541299). This may require the device to restart to apply the new security descriptor. **To configure settings to monitor removable storage devices** @@ -46,7 +50,8 @@ After you configure the settings to monitor removable storage devices, use the f 1. Sign in to the computer that hosts the resources that you want to monitor. Press the Windows key + R, and then type **cmd** to open a Command Prompt window. - >**Note:**  If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. + > [!NOTE] + > If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. 2. Type **gpupdate /force**, and press ENTER. 3. Connect a removable storage device to the targeted computer and attempt to copy a file that is protected with the Removable Storage Audit policy. @@ -56,7 +61,8 @@ After you configure the settings to monitor removable storage devices, use the f Key information to look for includes the name and account domain of the user who attempted to access the file, the object that the user is attempting to access, resource attributes of the resource, and the type of access that was attempted. - >**Note:**  We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event. + > [!NOTE] + > We do not recommend that you enable this category on a file server that hosts file shares on a removable storage device. When Removable Storage Auditing is configured, any attempt to access the removable storage device will generate an audit event. ### Related resource diff --git a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md index 606e073432..7f14c10bd0 100644 --- a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md +++ b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md @@ -4,7 +4,7 @@ description: Learn how to monitor user and device claims that are associated wit ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Monitor user and device claims during sign-in diff --git a/windows/security/threat-protection/auditing/other-events.md b/windows/security/threat-protection/auditing/other-events.md index 5a7b38d9c1..e74cf80553 100644 --- a/windows/security/threat-protection/auditing/other-events.md +++ b/windows/security/threat-protection/auditing/other-events.md @@ -1,8 +1,8 @@ --- title: Other Events (Windows 10) -description: Describes the Other Events auditing subcategory. +description: Describes the Other Events auditing subcategory, which includes events that are generated automatically and enabled by default. ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: medium @@ -11,6 +11,7 @@ ms.date: 04/19/2017 ms.reviewer: manager: dansimp ms.author: dansimp +ms.technology: mde --- # Other Events diff --git a/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md index bddb29f760..78bb89bc17 100644 --- a/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md @@ -2,10 +2,9 @@ title: Plan and deploy advanced security audit policies (Windows 10) description: Learn to deploy an effective security audit policy in a network that includes advanced security audit policies. ms.assetid: 7428e1db-aba8-407b-a39e-509671e5a442 - ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -16,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Plan and deploy advanced security audit policies diff --git a/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md index 88585f3a9a..3c5c1ece1e 100644 --- a/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md +++ b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md @@ -4,7 +4,7 @@ description: The Advanced Security Audit policy setting, Registry (Global Object ms.assetid: 953bb1c1-3f76-43be-ba17-4aed2304f578 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Registry (Global Object Access Auditing) diff --git a/windows/security/threat-protection/auditing/security-auditing-overview.md b/windows/security/threat-protection/auditing/security-auditing-overview.md index 8859ea5f7e..ba71110680 100644 --- a/windows/security/threat-protection/auditing/security-auditing-overview.md +++ b/windows/security/threat-protection/auditing/security-auditing-overview.md @@ -4,7 +4,7 @@ description: Learn about security auditing features in Windows, and how your org ms.assetid: 2d9b8142-49bd-4a33-b246-3f0c2a5f32d4 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Security auditing diff --git a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md index 91e999ee6e..9f9218109c 100644 --- a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md +++ b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md @@ -4,7 +4,7 @@ description: Domain admins can set up advanced security audit options in Windows ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Using advanced security auditing options to monitor dynamic access control objects diff --git a/windows/security/threat-protection/auditing/view-the-security-event-log.md b/windows/security/threat-protection/auditing/view-the-security-event-log.md index 7c25bfb2f8..84a296e182 100644 --- a/windows/security/threat-protection/auditing/view-the-security-event-log.md +++ b/windows/security/threat-protection/auditing/view-the-security-event-log.md @@ -4,7 +4,7 @@ description: The security log records each event as defined by the audit policie ms.assetid: 20DD2ACD-241A-45C5-A92F-4BE0D9F198B9 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # View the security event log diff --git a/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md index 92cdd0107e..4b20841dd8 100644 --- a/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md +++ b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md @@ -4,7 +4,7 @@ description: This reference topic for the IT professional describes which versio ms.assetid: 87c71cc5-522d-4771-ac78-34a2a0825f31 ms.reviewer: ms.author: dansimp -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/19/2017 +ms.technology: mde --- # Which editions of Windows support advanced audit policy configuration diff --git a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md index 70362c9d1c..fa3a798839 100644 --- a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md +++ b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md @@ -1,29 +1,30 @@ --- title: Block untrusted fonts in an enterprise (Windows 10) -description: To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. +description: To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we've created the Blocking Untrusted Fonts feature. ms.assetid: a3354c8e-4208-4be6-bc19-56a572c361b4 ms.reviewer: manager: dansimp keywords: font blocking, untrusted font blocking, block fonts, untrusted fonts -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.pagetype: security ms.sitesec: library -author: dulcemontemayor +author: dansimp ms.author: dansimp ms.date: 08/14/2017 ms.localizationpriority: medium +ms.technology: mde --- # Block untrusted fonts in an enterprise **Applies to:** -- Windows 10 +- Windows 10 ->Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). +> Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). -To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the `%windir%/Fonts` directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. +To help protect your company from attacks which may originate from untrusted or attacker-controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the `%windir%/Fonts` directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. ## What does this mean for me? Blocking untrusted fonts helps improve your network and employee protection against font-processing-related attacks. By default, this feature is not turned on. @@ -31,24 +32,27 @@ Blocking untrusted fonts helps improve your network and employee protection agai ## How does this feature work? There are 3 ways to use this feature: -- **On.** Helps stop any font processed using GDI from loading outside of the `%windir%/Fonts` directory. It also turns on event logging. +- **On.** Helps stop any font processed using GDI from loading outside of the `%windir%/Fonts` directory. It also turns on event logging. -- **Audit.** Turns on event logging, but doesn’t block fonts from loading, regardless of location. The name of the apps that use untrusted fonts appear in your event log.

                          **Note**
                          If you aren’t quite ready to deploy this feature into your organization, you can run it in Audit mode to see if not loading untrusted fonts causes any usability or compatibility issues. +- **Audit.** Turns on event logging, but doesn’t block fonts from loading, regardless of location. The name of the apps that use untrusted fonts appear in your event log. -- **Exclude apps to load untrusted fonts.** You can exclude specific apps, allowing them to load untrusted fonts, even while this feature is turned on. For instructions, see [Fix apps having problems because of blocked fonts](#fix-apps-having-problems-because-of-blocked-fonts). + > [!NOTE] + > If you aren't quite ready to deploy this feature into your organization, you can run it in Audit mode to see if not loading untrusted fonts causes any usability or compatibility issues. + +- **Exclude apps to load untrusted fonts.** You can exclude specific apps, allowing them to load untrusted fonts, even while this feature is turned on. For instructions, see [Fix apps having problems because of blocked fonts](#fix-apps-having-problems-because-of-blocked-fonts). ## Potential reductions in functionality After you turn this feature on, your employees might experience reduced functionality when: -- Sending a print job to a remote printer server that uses this feature and where the spooler process hasn’t been specifically excluded. In this situation, any fonts that aren’t already available in the server’s %windir%/Fonts folder won’t be used. +- Sending a print job to a remote printer server that uses this feature and where the spooler process hasn’t been specifically excluded. In this situation, any fonts that aren’t already available in the server’s %windir%/Fonts folder won’t be used. -- Printing using fonts provided by the installed printer’s graphics .dll file, outside of the %windir%/Fonts folder. For more information, see [Introduction to Printer Graphics DLLs](https://go.microsoft.com/fwlink/p/?LinkId=522302). +- Printing using fonts provided by the installed printer’s graphics .dll file, outside of the %windir%/Fonts folder. For more information, see [Introduction to Printer Graphics DLLs](https://go.microsoft.com/fwlink/p/?LinkId=522302). -- Using first or third-party apps that use memory-based fonts. +- Using first or third-party apps that use memory-based fonts. -- Using Internet Explorer to look at websites that use embedded fonts. In this situation, the feature blocks the embedded font, causing the website to use a default font. However, not all fonts have all of the characters, so the website might render differently. +- Using Internet Explorer to look at websites that use embedded fonts. In this situation, the feature blocks the embedded font, causing the website to use a default font. However, not all fonts have all of the characters, so the website might render differently. -- Using desktop Office to look at documents with embedded fonts. In this situation, content shows up using a default font picked by Office. +- Using desktop Office to look at documents with embedded fonts. In this situation, content shows up using a default font picked by Office. ## Turn on and use the Blocking Untrusted Fonts feature Use Group Policy or the registry to turn this feature on, off, or to use audit mode. @@ -56,9 +60,9 @@ Use Group Policy or the registry to turn this feature on, off, or to use audit m **To turn on and use the Blocking Untrusted Fonts feature through Group Policy** 1. Open the Group Policy editor (gpedit.msc) and go to `Computer Configuration\Administrative Templates\System\Mitigation Options\Untrusted Font Blocking`. -2. Click **Enabled** to turn the feature on, and then click one of the following **Migitation Options**: +2. Click **Enabled** to turn the feature on, and then click one of the following **Mitigation Options**: - - **Block untrusted fonts and log events.** Turns the feature on, blocking untrusted fonts and logging installation attempts to the event log. + - **Block untrusted fonts and log events.** Turns the feature on, blocking untrusted fonts and logging installation attempts to the event log. - **Do not block untrusted fonts.** Turns the feature on, but doesn't block untrusted fonts nor does it log installation attempts to the event log. @@ -73,9 +77,9 @@ To turn this feature on, off, or to use audit mode: 2. If the **MitigationOptions** key isn't there, right-click and add a new **QWORD (64-bit) Value**, renaming it to **MitigationOptions**. -3. Right click on the **MitigationOptions** key, and then click **Modify**. +3. Right click on the **MitigationOptions** key, and then click **Modify**. - The **Edit QWORD (64-bit) Value** box opens. + The **Edit QWORD (64-bit) Value** box opens. 4. Make sure the **Base** option is **Hexadecimal**, and then update the **Value data**, making sure you keep your existing value, like in the important note below: @@ -85,8 +89,8 @@ To turn this feature on, off, or to use audit mode: - **To audit with this feature.** Type **3000000000000**. - >[!Important] - >Your existing **MitigationOptions** values should be saved during your update. For example, if the current value is *1000*, your updated value should be *1000000001000*. + > [!Important] + > Your existing **MitigationOptions** values should be saved during your update. For example, if the current value is *1000*, your updated value should be *1000000001000*. 5. Restart your computer. @@ -104,27 +108,27 @@ After you turn this feature on, or start using Audit mode, you can look at your FontType: Memory
                          FontPath:
                          Blocked: true - - >[!NOTE] - >Because the **FontType** is *Memory*, there’s no associated **FontPath**. + + > [!NOTE] + > Because the **FontType** is *Memory*, there’s no associated **FontPath**. **Event Example 2 - Winlogon**
                          Winlogon.exe attempted loading a font that is restricted by font-loading policy.
                          FontType: File
                          FontPath: `\??\C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\EQUATION\MTEXTRA.TTF`
                          Blocked: true - - >[!NOTE] - >Because the **FontType** is *File*, there’s also an associated **FontPath**. + + > [!NOTE] + > Because the **FontType** is *File*, there’s also an associated **FontPath**. **Event Example 3 - Internet Explorer running in Audit mode**
                          Iexplore.exe attempted loading a font that is restricted by font-loading policy.
                          FontType: Memory
                          FontPath:
                          Blocked: false - - >[!NOTE] - >In Audit mode, the problem is recorded, but the font isn’t blocked. + + > [!NOTE] + > In Audit mode, the problem is recorded, but the font isn’t blocked. ## Fix apps having problems because of blocked fonts Your company may still need apps that are having problems because of blocked fonts, so we suggest that you first run this feature in Audit mode to determine which fonts are causing the problems. @@ -133,21 +137,15 @@ After you figure out the problematic fonts, you can try to fix your apps in 2 wa **To fix your apps by installing the problematic fonts (recommended)** -- On each computer with the app installed, right-click on the font name and click **Install**.

                          The font should automatically install into your `%windir%/Fonts` directory. If it doesn’t, you’ll need to manually copy the font files into the **Fonts** directory and run the installation from there. +- On each computer with the app installed, right-click on the font name and click **Install**.

                          The font should automatically install into your `%windir%/Fonts` directory. If it doesn’t, you’ll need to manually copy the font files into the **Fonts** directory and run the installation from there. **To fix your apps by excluding processes** 1. On each computer with the app installed, open regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\`.

                          For example, if you want to exclude Microsoft Word processes, you’d use `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe`. -2. Add any additional processes that need to be excluded here, and then turn the Blocking untrusted fonts feature on, using the steps in the [Turn on and use the Blocking Untrusted Fonts feature](#turn-on-and-use-the-blocking-untrusted-fonts-feature) section of this topic. +2. Add any additional processes that need to be excluded here, and then turn the Blocking untrusted fonts feature on, using the steps in [Turn on and use the Blocking Untrusted Fonts feature](#turn-on-and-use-the-blocking-untrusted-fonts-feature), earlier in this article. + - ## Related content -- [Dropping the “Untrusted Font Blocking” setting](https://blogs.technet.microsoft.com/secguide/2017/06/15/dropping-the-untrusted-font-blocking-setting/) - - - - - - +- [Dropping the “Untrusted Font Blocking” setting](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/dropping-the-quot-untrusted-font-blocking-quot-setting/ba-p/701068/) diff --git a/windows/security/threat-protection/change-history-for-threat-protection.md b/windows/security/threat-protection/change-history-for-threat-protection.md index af17bfed1e..50746cadf8 100644 --- a/windows/security/threat-protection/change-history-for-threat-protection.md +++ b/windows/security/threat-protection/change-history-for-threat-protection.md @@ -1,9 +1,9 @@ --- -title: Change history for [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +title: "Change history for [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)" ms.reviewer: ms.author: dansimp -description: This topic lists new and updated topics in the WWindows Defender ATP content set. -ms.prod: w10 +description: This topic lists new and updated topics in the Defender for Endpoint content set. +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,14 +13,15 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.localizationpriority: medium +ms.technology: mde --- # Change history for threat protection -This topic lists new and updated topics in the [Microsoft Defender ATP](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) documentation. +This topic lists new and updated topics in the [Defender for Endpoint](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) documentation. ## August 2018 New or changed topic | Description ---------------------|------------ -[Microsoft Defender Advanced Threat Protection](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) | Reorganized Windows 10 security topics to reflect the Windows Defender ATP platform. +[Microsoft Defender for Endpoint](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) | Reorganized Windows 10 security topics to reflect the Defender for Endpoint platform. diff --git a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md index 74a43afb5e..1c2d45ad8e 100644 --- a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md +++ b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md @@ -1,50 +1,50 @@ --- title: How to control USB devices and other removable media using Intune (Windows 10) description: You can configure Intune settings to reduce threats from removable storage such as USB devices. -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium ms.author: dansimp author: dansimp -ms.date: 10/04/2019 ms.reviewer: dansimp manager: dansimp audience: ITPro +ms.technology: mde --- -# How to control USB devices and other removable media using Microsoft Defender ATP +# How to control USB devices and other removable media using Microsoft Defender for Endpoint -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Microsoft recommends [a layered approach to securing removable media](https://aka.ms/devicecontrolblog), and Microsoft Defender ATP provides multiple monitoring and control features to help prevent threats in unauthorized peripherals from compromising your devices: +Microsoft recommends [a layered approach to securing removable media](https://aka.ms/devicecontrolblog), and Microsoft Defender for Endpoint provides multiple monitoring and control features to help prevent threats in unauthorized peripherals from compromising your devices: -1. [Discover plug and play connected events for peripherals in Microsoft Defender ATP advanced hunting](#discover-plug-and-play-connected-events). Identify or investigate suspicious usage activity. +1. [Discover plug and play connected events for peripherals in Microsoft Defender for Endpoint advanced hunting](#discover-plug-and-play-connected-events). Identify or investigate suspicious usage activity. 2. Configure to allow or block only certain removable devices and prevent threats. - 1. [Allow or block removable devices](#allow-or-block-removable-devices) based on granular configuration to deny write access to removable disks and approve or deny devices by USB vendor IDs, product IDs, device IDs, or a combination. Flexible policy assignment of device installation settings based on an individual or group of Azure Active Directory (Azure AD) users and devices. + 1. [Allow or block removable devices](#allow-or-block-removable-devices) based on granular configuration to deny write access to removable disks and approve or deny devices by using USB device IDs. Flexible policy assignment of device installation settings based on an individual or group of Azure Active Directory (Azure AD) users and devices. 2. [Prevent threats from removable storage](#prevent-threats-from-removable-storage) introduced by removable storage devices by enabling: - - Windows Defender Antivirus real-time protection (RTP) to scan removable storage for malware. + - Microsoft Defender Antivirus real-time protection (RTP) to scan removable storage for malware. - The Attack Surface Reduction (ASR) USB rule to block untrusted and unsigned processes that run from USB. - Direct Memory Access (DMA) protection settings to mitigate DMA attacks, including Kernel DMA Protection for Thunderbolt and blocking DMA until a user signs in. -3. [Create customized alerts and response actions](#create-customized-alerts-and-response-actions) to monitor usage of removable devices based on these plug and play events or any other Microsoft Defender ATP events with [custom detection rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules). +3. [Create customized alerts and response actions](#create-customized-alerts-and-response-actions) to monitor usage of removable devices based on these plug and play events or any other Microsoft Defender for Endpoint events with [custom detection rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules). 4. [Respond to threats](#respond-to-threats) from peripherals in real-time based on properties reported by each peripheral. >[!Note] ->These threat reduction measures help prevent malware from coming into your environment. To protect enterprise data from leaving your environment, you can also configure data loss prevention measures. For example, on Windows 10 devices you can configure [BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) and [Windows Information Protection](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure), which will encrypt company data even if it is stored on a personal device, or use the [Storage/RemovableDiskDenyWriteAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-storage#storage-removablediskdenywriteaccess) to deny write access to removable disks. Additionally, you can [classify and protect files on Windows devices](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview) (including their mounted USB devices) by using Microsoft Defender ATP and Azure Information Protection. +>These threat reduction measures help prevent malware from coming into your environment. To protect enterprise data from leaving your environment, you can also configure data loss prevention measures. For example, on Windows 10 devices you can configure [BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) and [Windows Information Protection](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure), which will encrypt company data even if it is stored on a personal device, or use the [Storage/RemovableDiskDenyWriteAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-storage#storage-removablediskdenywriteaccess) to deny write access to removable disks. Additionally, you can [classify and protect files on Windows devices](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview) (including their mounted USB devices) by using Microsoft Defender for Endpoint and Azure Information Protection. ## Discover plug and play connected events -You can view plug and play connected events in Microsoft Defender ATP advanced hunting to identify suspicious usage activity or perform internal investigations. -For examples of Microsoft Defender ATP advanced hunting queries, see the [Microsoft Defender ATP hunting queries GitHub repo](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). +You can view plug and play connected events in Microsoft Defender for Endpoint advanced hunting to identify suspicious usage activity or perform internal investigations. +For examples of Defender for Endpoint advanced hunting queries, see the [Microsoft Defender for Endpoint hunting queries GitHub repo](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). -Sample Power BI report templates are available for Microsoft Defender ATP that you can use for Advanced hunting queries. With these sample templates, including one for device control, you can integrate the power of Advanced hunting into Power BI. See the [GitHub repository for PowerBI templates](https://github.com/microsoft/MDATP-PowerBI-Templates) for more information. See [Create custom reports using Power BI](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-power-bi) to learn more about Power BI integration. +Sample Power BI report templates are available for Microsoft Defender for Endpoint that you can use for Advanced hunting queries. With these sample templates, including one for device control, you can integrate the power of Advanced hunting into Power BI. See the [GitHub repository for PowerBI templates](https://github.com/microsoft/MDATP-PowerBI-Templates) for more information. See [Create custom reports using Power BI](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-power-bi) to learn more about Power BI integration. ## Allow or block removable devices -The following table describes the ways Microsoft Defender ATP can allow or block removable devices based on granular configuration. +The following table describes the ways Microsoft Defender for Endpoint can allow or block removable devices based on granular configuration. | Control | Description | |----------|-------------| @@ -55,11 +55,11 @@ The following table describes the ways Microsoft Defender ATP can allow or block | [Allow installation and usage of specifically approved peripherals with matching device instance IDs](#allow-installation-and-usage-of-specifically-approved-peripherals-with-matching-device-instance-ids) | You can only install and use approved peripherals that match any of these device instance IDs. | | [Prevent installation and usage of specifically prohibited peripherals with matching device instance IDs](#prevent-installation-and-usage-of-specifically-prohibited-peripherals-with-matching-device-instance-ids) | You can't install or use prohibited peripherals that match any of these device instance IDs. | | [Limit services that use Bluetooth](#limit-services-that-use-bluetooth) | You can limit the services that can use Bluetooth. | -| [Use Microsoft Defender ATP baseline settings](#use-microsoft-defender-atp-baseline-settings) | You can set the recommended configuration for ATP by using the Microsoft Defender ATP security baseline. | +| [Use Microsoft Defender for Endpoint baseline settings](#use-microsoft-defender-for-endpoint-baseline-settings) | You can set the recommended configuration for ATP by using the Defender for Endpoint security baseline. | ### Restrict USB drives and other peripherals -To prevent malware infections or data loss, an organization may restrict USB drives and other peripherals. The following table describes the ways Microsoft Defender ATP can help prevent installation and usage of USB drives and other peripherals. +To prevent malware infections or data loss, an organization may restrict USB drives and other peripherals. The following table describes the ways Microsoft Defender for Endpoint can help prevent installation and usage of USB drives and other peripherals. | Control | Description |----------|-------------| @@ -76,7 +76,7 @@ The above policies can also be set through the [Device Installation CSP settings > [!Note] > Always test and refine these settings with a pilot group of users and devices first before applying them in production. -For more information about controlling USB devices, see the [Microsoft Defender ATP blog](https://www.microsoft.com/security/blog/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/). +For more information about controlling USB devices, see the [Microsoft Defender for Endpoint blog](https://www.microsoft.com/security/blog/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/). #### Allow installation and usage of USB drives and other peripherals @@ -98,35 +98,37 @@ In this example, the following classes needed to be added: HID, Keyboard, and {3 ![Device host controller](images/devicehostcontroller.jpg) -If you want to restrict to certain devices, remove the device setup class of the peripheral that you want to limit. Then add the device ID that you want to add. To find the vendor or product IDs, see [Look up device vendor ID or product ID](#look-up-device-vendor-id-or-product-id). +If you want to restrict to certain devices, remove the device setup class of the peripheral that you want to limit. Then add the device ID that you want to add. Device ID is based on the vendor ID and product ID values for a device. For information on device ID formats, see [Standard USB Identifiers](https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers). + +To find the device IDs, see [Look up device ID](#look-up-device-id). For example: 1. Remove class USBDevice from the **Allow installation of devices using drivers that match these device setup**. -2. Add the vendor ID or product ID to allow in the **Allow installation of device that match any of these device IDs**. +2. Add the device ID to allow in the **Allow installation of device that match any of these device IDs**. #### Prevent installation and usage of USB drives and other peripherals If you want to prevent the installation of a device class or certain devices, you can use the prevent device installation policies: -1. Enable **Prevent installation of devices that match any of these device IDs**. -2. Enable **Prevent installation of devices that match these device setup classes**. +1. Enable **Prevent installation of devices that match any of these device IDs** and add these devices to the list. +2. Enable **Prevent installation of devices using drivers that match these device setup classes**. > [!Note] > The prevent device installation policies take precedence over the allow device installation policies. -The **Prevent installation of devices that match any of these device IDs** policy allows you to specify a list of vendor or product IDs for devices that Windows is prevented from installing. +The **Prevent installation of devices that match any of these device IDs** policy allows you to specify a list of devices that Windows is prevented from installing. To prevent installation of devices that match any of these device IDs: -1. [Look up device vendor ID or product ID](#look-up-device-vendor-id-or-product-id) for devices that you want Windows to prevent from installing. +1. [Look up device ID](#look-up-device-id) for devices that you want Windows to prevent from installing. ![Look up vendor or product ID](images/lookup-vendor-product-id.png) 2. Enable **Prevent installation of devices that match any of these device IDs** and add the vendor or product IDs to the list. ![Add vendor ID to prevent list](images/add-vendor-id-to-prevent-list.png) -#### Look up device vendor ID or product ID -You can use Device Manager to look up a device vendor or product ID. +#### Look up device ID +You can use Device Manager to look up a device ID. 1. Open Device Manager. 2. Click **View** and select **Devices by connection**. @@ -135,16 +137,24 @@ You can use Device Manager to look up a device vendor or product ID. 5. Click the **Property** drop-down list and select **Hardware Ids**. 6. Right-click the top ID value and select **Copy**. -For information on vendor and product ID formats, see [Standard USB Identifiers](https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers). +For information about Device ID formats, see [Standard USB Identifiers](https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers). For information on vendor IDs, see [USB members](https://www.usb.org/members). -The following is an example for looking up a device vendor ID or product ID using PowerShell: +The following is an example for looking up a device vendor ID or product ID (which is part of the device ID) using PowerShell: ``` PowerShell Get-WMIObject -Class Win32_DiskDrive | Select-Object -Property * ``` +The **Prevent installation of devices using drivers that match these device setup classes** policy allows you to specify device setup classes that Windows is prevented from installing. + +To prevent installation of particular classes of devices: + +1. Find the GUID of the device setup class from [System-Defined Device Setup Classes Available to Vendors](https://docs.microsoft.com/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors). +2. Enable **Prevent installation of devices using drivers that match these device setup classes** and add the class GUID to the list. +![Add device setup class to prevent list](images/Add-device-setup-class-to-prevent-list.png) + ### Block installation and usage of removable storage 1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/). @@ -180,7 +190,7 @@ Allowing installation of specific devices requires also enabling [DeviceInstalla ### Prevent installation of specifically prohibited peripherals -Microsoft Defender ATP blocks installation and usage of prohibited peripherals by using either of these options: +Microsoft Defender for Endpoint blocks installation and usage of prohibited peripherals by using either of these options: - [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows) can block any device with a matching hardware ID or setup class. - [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) with a custom profile in Intune. You can [prevent installation of specific device IDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdeviceids) or [prevent specific device classes](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdevicesetupclasses). @@ -203,45 +213,45 @@ Using Intune, you can limit the services that can use Bluetooth through the ["Bl ![Bluetooth](images/bluetooth.png) -### Use Microsoft Defender ATP baseline settings +### Use Microsoft Defender for Endpoint baseline settings -The Microsoft Defender ATP baseline settings represent the recommended configuration for ATP. Configuration settings for baseline are located in the edit profile page of the configuration settings. +The Microsoft Defender for Endpoint baseline settings represent the recommended configuration for ATP. Configuration settings for baseline are located in the edit profile page of the configuration settings. ![Baselines](images/baselines.png) ## Prevent threats from removable storage -Removable storage devices can introduce additional security risk to your organization. Microsoft Defender ATP can help identify and block malicious files on removable storage devices. +Removable storage devices can introduce additional security risk to your organization. Microsoft Defender for Endpoint can help identify and block malicious files on removable storage devices. -Microsoft Defender ATP can also prevent USB peripherals from being used on devices to help prevent external threats. It does this by using the properties reported by USB peripherals to determine whether or not they can be installed and used on the device. +Microsoft Defender for Endpoint can also prevent USB peripherals from being used on devices to help prevent external threats. It does this by using the properties reported by USB peripherals to determine whether or not they can be installed and used on the device. Note that if you block USB devices or any other device classes using the device installation policies, connected devices, such as phones, can still charge. >[!NOTE] >Always test and refine these settings with a pilot group of users and devices first before widely distributing to your organization. -The following table describes the ways Microsoft Defender ATP can help prevent threats from removable storage. +The following table describes the ways Microsoft Defender for Endpoint can help prevent threats from removable storage. -For more information about controlling USB devices, see the [Microsoft Defender ATP blog](https://aka.ms/devicecontrolblog). +For more information about controlling USB devices, see the [Microsoft Defender for Endpoint blog](https://aka.ms/devicecontrolblog). | Control | Description | |----------|-------------| -| [Enable Windows Defender Antivirus Scanning](#enable-windows-defender-antivirus-scanning) | Enable Windows Defender Antivirus scanning for real-time protection or scheduled scans.| +| [Enable Microsoft Defender Antivirus Scanning](#enable-microsoft-defender-antivirus-scanning) | Enable Microsoft Defender Antivirus scanning for real-time protection or scheduled scans.| | [Block untrusted and unsigned processes on USB peripherals](#block-untrusted-and-unsigned-processes-on-usb-peripherals) | Block USB files that are unsigned or untrusted. | | [Protect against Direct Memory Access (DMA) attacks](#protect-against-direct-memory-access-dma-attacks) | Configure settings to protect against DMA attacks. | >[!NOTE] >Because an unauthorized USB peripheral can have firmware that spoofs its USB properties, we recommend only allowing specifically approved USB peripherals and limiting the users who can access them. -### Enable Windows Defender Antivirus Scanning +### Enable Microsoft Defender Antivirus Scanning -Protecting authorized removable storage with Windows Defender Antivirus requires [enabling real-time protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) or scheduling scans and configuring removable drives for scans. +Protecting authorized removable storage with Microsoft Defender Antivirus requires [enabling real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) or scheduling scans and configuring removable drives for scans. -- If real-time protection is enabled, files are scanned before they are accessed and executed. The scanning scope includes all files, including those on mounted removable devices such as USB drives. You can optionally [run a PowerShell script to perform a custom scan](https://aka.ms/scanusb) of a USB drive after it is mounted, so that Windows Defender Antivirus starts scanning all files on a removable device once the removable device is attached. However, we recommend enabling real-time protection for improved scanning performance, especially for large storage devices. +- If real-time protection is enabled, files are scanned before they are accessed and executed. The scanning scope includes all files, including those on mounted removable devices such as USB drives. You can optionally [run a PowerShell script to perform a custom scan](https://aka.ms/scanusb) of a USB drive after it is mounted, so that Microsoft Defender Antivirus starts scanning all files on a removable device once the removable device is attached. However, we recommend enabling real-time protection for improved scanning performance, especially for large storage devices. - If scheduled scans are used, then you need to disable the DisableRemovableDriveScanning setting (enabled by default) to scan the removable device during a full scan. Removable devices are scanned during a quick or custom scan regardless of the DisableRemovableDriveScanning setting. >[!NOTE] ->We recommend enabling real-time monitoring for scanning. In Intune, you can enable real-time monitoring for Windows 10 in **Device Restrictions** > **Configure** > **Windows Defender Antivirus** > **Real-time monitoring**. +>We recommend enabling real-time monitoring for scanning. In Intune, you can enable real-time monitoring for Windows 10 in **Device Restrictions** > **Configure** > **Microsoft Defender Antivirus** > **Real-time monitoring**. @@ -255,31 +265,19 @@ This can be done by setting **Untrusted and unsigned processes that run from USB With this rule, admins can prevent or audit unsigned or untrusted executable files from running from USB removable drives, including SD cards. Affected file types include executable files (such as .exe, .dll, or .scr) and script files such as a PowerShell (.ps), VisualBasic (.vbs), or JavaScript (.js) files. -These settings require [enabling real-time protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus). - -1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/). -2. Click **Intune** > **Device configuration** > **Profiles** > **Create profile**. - - ![Create device configuration profile](images/create-device-configuration-profile.png) +These settings require [enabling real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus). +1. Sign in to the [Microsoft Endpoint Manager](https://endpoint.microsoft.com/). +2. Click **Devices** > **Windows** > **Configuration Policies** > **Create profile**. +![Create device configuration profile](images/create-device-configuration-profile.png) 3. Use the following settings: - - - Name: Type a name for the profile - - Description: Type a description - - Platform: Windows 10 or later - - Profile type: Endpoint protection - - ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) - -4. Click **Configure** > **Windows Defender Exploit Guard** > **Attack Surface Reduction**. - + - Platform: Windows 10 and later + - Profile type: Device restrictions + ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) +4. Click **Create**. 5. For **Unsigned and untrusted processes that run from USB**, choose **Block**. - ![Block untrusted processes](images/block-untrusted-processes.png) - -6. Click **OK** to close **Attack Surface Reduction**, **Windows Defender Exploit Guard**, and **Endpoint protection**. - -7. Click **Create** to save the profile. +6. Click **OK** to close settings and **Device restrictions**. ### Protect against Direct Memory Access (DMA) attacks @@ -318,13 +316,13 @@ For information on device control related advance hunting events and examples on ## Respond to threats -You can create custom alerts and automatic response actions with the [Microsoft Defender ATP Custom Detection Rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules). Response actions within the custom detection cover both machine and file level actions. You can also create alerts and automatic response actions using [PowerApps](https://powerapps.microsoft.com/) and [Flow](https://flow.microsoft.com/) with the [Microsoft Defender ATP connector](https://docs.microsoft.com/connectors/wdatp/). The connector supports actions for investigation, threat scanning, and restricting running applications. It is one of over 200 pre-defined connectors including Outlook, Teams, Slack, and more. Custom connectors can also be built. See [Connectors](https://docs.microsoft.com/connectors/) to learn more about connectors. +You can create custom alerts and automatic response actions with the [Microsoft Defender for Endpoint Custom Detection Rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules). Response actions within the custom detection cover both machine and file level actions. You can also create alerts and automatic response actions using [PowerApps](https://powerapps.microsoft.com/) and [Flow](https://flow.microsoft.com/) with the [Microsoft Defender for Endpoint connector](https://docs.microsoft.com/connectors/wdatp/). The connector supports actions for investigation, threat scanning, and restricting running applications. It is one of over 200 pre-defined connectors including Outlook, Teams, Slack, and more. Custom connectors can also be built. See [Connectors](https://docs.microsoft.com/connectors/) to learn more about connectors. For example, using either approach, you can automatically have the Microsoft Defender Antivirus run when a USB device is mounted onto a machine. ## Related topics -- [Configure real-time protection for Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) +- [Configure real-time protection for Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) - [Defender/AllowFullScanRemovableDriveScanning](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-allowfullscanremovabledrivescanning) - [Policy/DeviceInstallation CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) - [Perform a custom scan of a removable device](https://aka.ms/scanusb) diff --git a/windows/security/threat-protection/device-control/device-control-report.md b/windows/security/threat-protection/device-control/device-control-report.md new file mode 100644 index 0000000000..2c35de2163 --- /dev/null +++ b/windows/security/threat-protection/device-control/device-control-report.md @@ -0,0 +1,74 @@ +--- +title: Protect your organization’s data with device control +description: Monitor your organization's data security through device control reports. +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +ms.author: v-ajupudi +author: alluthewriter +ms.reviewer: dansimp +manager: dansimp +audience: ITPro +ms.technology: mde +--- +# Protect your organization’s data with device control + +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Microsoft Defender for Endpoint device control protects against data loss, by monitoring and controlling media use by devices in your organization, such as the use of removable storage devices and USB drives. + +With the device control report, you can view events that relate to media usage, such as: + +- **Audit events:** Shows the number of audit events that occur when external media is connected. +- **Policy events:** Shows the number of policy events that occur when a device control policy is triggered. + +> [!NOTE] +> The audit event to track media usage is enabled by default for devices onboarded to Microsoft Defender for Endpoint. + +## Understanding the audit events + +The audit events include: + +- **USB drive mount and unmount:** Audit events that are generated when a USB drive is mounted or unmounted. +- **PnP:** Plug and Play audit events are generated when removable storage, a printer, or Bluetooth media is connected. + +## Monitor device control security + +Device control in Microsoft Defender for Endpoint empowers security administrators with tools that enable them to track their organization’s device control security through reports. You can find the device control report in the Microsoft 365 security center by going to **Reports > Device protection**. + +The Device protection card on the **Reports** dashboard shows the number of audit events generated by media type, over the last 180 days. + +> [!div class="mx-imgBorder"] +> ![DeviceControlReportCard](images/devicecontrolcard.png) + +The **View details** button shows more media usage data in the **device control report** page. + +The page provides a dashboard with aggregated number of events per type and a list of events. Administrators can filter on time range, media class name, and device ID. + +> [!div class="mx-imgBorder"] +> ![DeviceControlReportDetails](images/Detaileddevicecontrolreport.png) + +When you select an event, a flyout appears that shows you more information: + +- **General details:** Date, Action mode, and the policy of this event. +- **Media information:** Media information includes Media name, Class name, Class GUID, Device ID, Vendor ID, Volume, Serial number, and Bus type. +- **Location details:** Device name and MDATP device ID. + +> [!div class="mx-imgBorder"] +> ![FilterOnDeviceControlReport](images/devicecontrolreportfilter.png) + +To see real-time activity for this media across the organization, select the **Open Advanced hunting** button. This includes an embedded, pre-defined query. + +> [!div class="mx-imgBorder"] +> ![QueryOnDeviceControlReport](images/Devicecontrolreportquery.png) + +To see the security of the device, select the **Open device page** button on the flyout. This button opens the device entity page. + +> [!div class="mx-imgBorder"] +> ![DeviceEntityPage](images/Devicesecuritypage.png) + +## Reporting delays + +The device control report can have a 12-hour delay from the time a media connection occurs to the time the event is reflected in the card or in the domain list. diff --git a/windows/security/threat-protection/device-control/images/Add-device-setup-class-to-prevent-list.png b/windows/security/threat-protection/device-control/images/Add-device-setup-class-to-prevent-list.png new file mode 100644 index 0000000000..043da38016 Binary files /dev/null and b/windows/security/threat-protection/device-control/images/Add-device-setup-class-to-prevent-list.png differ diff --git a/windows/security/threat-protection/device-control/images/Detaileddevicecontrolreport.png b/windows/security/threat-protection/device-control/images/Detaileddevicecontrolreport.png new file mode 100644 index 0000000000..1943ec1fab Binary files /dev/null and b/windows/security/threat-protection/device-control/images/Detaileddevicecontrolreport.png differ diff --git a/windows/security/threat-protection/device-control/images/Devicecontrolreportquery.png b/windows/security/threat-protection/device-control/images/Devicecontrolreportquery.png new file mode 100644 index 0000000000..6913ecfcc6 Binary files /dev/null and b/windows/security/threat-protection/device-control/images/Devicecontrolreportquery.png differ diff --git a/windows/security/threat-protection/device-control/images/Devicesecuritypage.png b/windows/security/threat-protection/device-control/images/Devicesecuritypage.png new file mode 100644 index 0000000000..d35b3507f8 Binary files /dev/null and b/windows/security/threat-protection/device-control/images/Devicesecuritypage.png differ diff --git a/windows/security/threat-protection/device-control/images/create-device-configuration-profile.png b/windows/security/threat-protection/device-control/images/create-device-configuration-profile.png index 1b6d4aa708..4b8c80fdd7 100644 Binary files a/windows/security/threat-protection/device-control/images/create-device-configuration-profile.png and b/windows/security/threat-protection/device-control/images/create-device-configuration-profile.png differ diff --git a/windows/security/threat-protection/device-control/images/create-profile.png b/windows/security/threat-protection/device-control/images/create-profile.png index ada168228e..b0b7eb7237 100644 Binary files a/windows/security/threat-protection/device-control/images/create-profile.png and b/windows/security/threat-protection/device-control/images/create-profile.png differ diff --git a/windows/security/threat-protection/device-control/images/devicecontrolcard.png b/windows/security/threat-protection/device-control/images/devicecontrolcard.png new file mode 100644 index 0000000000..829014859f Binary files /dev/null and b/windows/security/threat-protection/device-control/images/devicecontrolcard.png differ diff --git a/windows/security/threat-protection/device-control/images/devicecontrolreportfilter.png b/windows/security/threat-protection/device-control/images/devicecontrolreportfilter.png new file mode 100644 index 0000000000..a7cd33c892 Binary files /dev/null and b/windows/security/threat-protection/device-control/images/devicecontrolreportfilter.png differ diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index a3b27f24c3..1c2019f4f1 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -1,7 +1,7 @@ --- -title: Enable virtualization-based protection of code integrity -description: This article explains the steps to opt in to using HVCI on Windows devices. -ms.prod: w10 +title: Enable virtualization-based protection of code integrity +description: This article explains the steps to opt in to using HVCI on Windows devices. +ms.prod: m365-security ms.mktglfcycl: deploy ms.localizationpriority: medium ms.author: ellevin @@ -12,26 +12,25 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/01/2019 ms.reviewer: +ms.technology: mde --- # Enable virtualization-based protection of code integrity -**Applies to** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) This topic covers different ways to enable Hypervisor-protected code integrity (HVCI) on Windows 10. Some applications, including device drivers, may be incompatible with HVCI. This can cause devices or software to malfunction and in rare cases may result in a blue screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. If this happens, see [Troubleshooting](#troubleshooting) for remediation steps. ->[!NOTE] ->Because it makes use of *Mode Based Execution Control*, HVCI works better with Intel Kaby Lake or AMD Zen 2 CPUs and newer. Processors without MBEC will rely on an emulation of this feature, called *Restricted User Mode*, which has a bigger impact on performance. +> [!NOTE] +> Because it makes use of *Mode Based Execution Control*, HVCI works better with Intel Kaby Lake or AMD Zen 2 CPUs and newer. Processors without MBEC will rely on an emulation of this feature, called *Restricted User Mode*, which has a bigger impact on performance. ## HVCI Features * HVCI protects modification of the Control Flow Guard (CFG) bitmap. -* HVCI also ensure your other Truslets, like Credential Guard, have a valid certificate. +* HVCI also ensures that your other trusted processes, like Credential Guard, have got a valid certificate. * Modern device drivers must also have an EV (Extended Validation) certificate and should support HVCI. ## How to turn on HVCI in Windows 10 @@ -54,7 +53,7 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP] ### Enable HVCI using Group Policy 1. Use Group Policy Editor (gpedit.msc) to either edit an existing GPO or create a new one. -2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**. +2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**. 3. Double-click **Turn on Virtualization Based Security**. 4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**. @@ -198,7 +197,7 @@ Value | Description **5.** | If present, NX protections are available. **6.** | If present, SMM mitigations are available. **7.** | If present, Mode Based Execution Control is available. - +**8.** | If present, APIC virtualization is available. #### InstanceIdentifier @@ -229,6 +228,7 @@ Value | Description **1.** | If present, Windows Defender Credential Guard is configured. **2.** | If present, HVCI is configured. **3.** | If present, System Guard Secure Launch is configured. +**4.** | If present, SMM Firmware Measurement is configured. #### SecurityServicesRunning @@ -240,6 +240,7 @@ Value | Description **1.** | If present, Windows Defender Credential Guard is running. **2.** | If present, HVCI is running. **3.** | If present, System Guard Secure Launch is running. +**4.** | If present, SMM Firmware Measurement is running. #### Version @@ -290,9 +291,9 @@ WDAC protects against malware running in the guest virtual machine. It does not Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true ``` -### Requirements for running HVCI in Hyper-V virtual machines +### Requirements for running HVCI in Hyper-V virtual machines - The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607. -- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10. +- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10. - HVCI and [nested virtualization](https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time - Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`. - The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`. diff --git a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md index f60748b37b..5b4942082c 100644 --- a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md +++ b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md @@ -1,16 +1,16 @@ --- -title: WDAC and virtualization-based code integrity (Windows 10) -description: Hardware and software system integrity-hardening capabilites that can be deployed separately or in combination with Windows Defender Application Control (WDAC). +title: Windows Defender Application Control and virtualization-based code integrity (Windows 10) +description: Hardware and software system integrity-hardening capabilities that can be deployed separately or in combination with Windows Defender Application Control (WDAC). keywords: virtualization, security, malware, device guard -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 07/01/2019 ms.reviewer: manager: dansimp ms.custom: asr +ms.technology: mde --- # Windows Defender Application Control and virtualization-based protection of code integrity @@ -19,24 +19,24 @@ ms.custom: asr - Windows 10 - Windows Server 2016 -Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows 10 systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity, while simultaneously hardening the OS against kernel memory attacks through the use of virtualization-based protection of code integrity (more specifically, HVCI). +Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows 10 systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity, while simultaneously hardening the OS against kernel memory attacks by using virtualization-based protection of code integrity (more specifically, HVCI). -Configurable code integrity policies and HVCI are very powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a very strong protection capability for Windows 10 devices. +Configurable code integrity policies and HVCI are powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a strong protection capability for Windows 10 devices. Using configurable code integrity to restrict devices to only authorized apps has these advantages over other solutions: 1. Configurable code integrity policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run. 2. Configurable code integrity allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows. -3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privilege, or malicious software that managed to gain administrative privilege, to alter the application control policy. -4. The entire configurable code integrity enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable code integrity or any other application control solution. +3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it difficult for an attacker with administrative privilege, or malicious software that managed to gain administrative privilege, to alter the application control policy. +4. The entire configurable code integrity enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable code integrity or any other application control solution. ## Windows Defender Application Control -When we originally designed this configuration state, we did so with a specific security promise in mind. Although there were no direct dependencies between configurable code integrity and HVCI, we intentionally focused our discussion around the lockdown state you achieve when deploying them together. However, given that HVCI relies on Windows virtualization-based security, it comes with additional hardware, firmware, and kernel driver compatibility requirements that some older systems can’t meet. As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable code integrity either. +When we originally designed this configuration state, we did so with a specific security promise in mind. Although there were no direct dependencies between configurable code integrity and HVCI, we intentionally focused our discussion around the lockdown state you achieve when deploying them together. However, given that HVCI relies on Windows virtualization-based security, it comes with more hardware, firmware, and kernel driver compatibility requirements that some older systems can’t meet. As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable code integrity either. Configurable code integrity carries no specific hardware or software requirements other than running Windows 10, which means many IT professionals were wrongly denied the benefits of this powerful application control capability. -Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable code integrity as a independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control). +Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable code integrity as an independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control). We hope this change will help us better communicate options for adopting application control within an organization. ## Related articles diff --git a/windows/security/threat-protection/device-guard/memory-integrity.md b/windows/security/threat-protection/device-guard/memory-integrity.md index 7cdda06143..d743f3eae6 100644 --- a/windows/security/threat-protection/device-guard/memory-integrity.md +++ b/windows/security/threat-protection/device-guard/memory-integrity.md @@ -1,10 +1,9 @@ --- title: Memory integrity keywords: mitigations, vulnerabilities, vulnerability, mitigation, exploit, exploits, emet -description: Memory integrity. +description: Learn about memory integrity, a feature of Windows that ensures code running in the Windows kernel is securely designed and trustworthy. search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -13,13 +12,12 @@ author: levinec ms.author: ellevin ms.reviewer: manager: dansimp +ms.technology: mde --- # Memory integrity -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) Memory integrity is a feature of Windows that ensures code running in the Windows kernel is securely designed and trustworthy. It uses hardware virtualization and Hyper-V to protect Windows kernel mode processes from the injection and execution of malicious or unverified code. The integrity of code that runs on Windows is validated by memory integrity, making Windows resistant to attacks from malicious software. Memory integrity is a powerful security boundary that helps to block many types of malware from running in Windows 10 and Windows Server 2016 environments. diff --git a/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md index 725e9d2023..47f912cc8d 100644 --- a/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md @@ -2,7 +2,7 @@ title: Deployment guidelines for Windows Defender Device Guard (Windows 10) description: Plan your deployment of Windows Defender Device Guard. Learn about hardware requirements, deployment approaches, code signing and code integrity policies. keywords: virtualization, security, malware -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.localizationpriority: medium author: dansimp @@ -13,13 +13,12 @@ ms.topic: conceptual ms.date: 10/20/2017 ms.reviewer: ms.author: dansimp +ms.technology: mde --- # Baseline protections and additional qualifications for virtualization-based protection of code integrity -**Applies to** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) Computers must meet certain hardware, firmware, and software requirements in order to take advantage of all of the virtualization-based security (VBS) features in [Windows Defender Device Guard](../device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md). Computers lacking these requirements can still be protected by Windows Defender Application Control (WDAC) policies—the difference is that those computers will not be as hardened against certain threats. @@ -42,7 +41,7 @@ The following tables provide more information about the hardware, firmware, and | Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | See the System.Fundamentals.Firmware.UEFISecureBoot requirement in the [Windows Hardware Compatibility Specifications for Windows 10, version 1809 and Windows Server 2019 - Systems download](https://go.microsoft.com/fwlink/?linkid=2027110). You can find previous versions of the Windows Hardware Compatibility Program Specifications and Policies [here](https://docs.microsoft.com/windows-hardware/design/compatibility/whcp-specifications-policies). | UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | | Firmware: **Secure firmware update process** | UEFI firmware must support secure firmware update found under the System.Fundamentals.Firmware.UEFISecureBoot requirement in the [Windows Hardware Compatibility Specifications for Windows 10, version 1809 and Windows Server 2019 - Systems download](https://go.microsoft.com/fwlink/?linkid=2027110). You can find previous versions of the Windows Hardware Compatibility Program Specifications and Policies [here](https://docs.microsoft.com/windows-hardware/design/compatibility/whcp-specifications-policies). | UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | | Software: **HVCI compatible drivers** | See the Filter.Driver.DeviceGuard.DriverCompatibility requirement in the [Windows Hardware Compatibility Specifications for Windows 10, version 1809 and Windows Server 2019 - Filter driver download](https://go.microsoft.com/fwlink/?linkid=2027110). You can find previous versions of the Windows Hardware Compatibility Program Specifications and Policies [here](https://docs.microsoft.com/windows-hardware/design/compatibility/whcp-specifications-policies). | [HVCI Compatible](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/) drivers help ensure that VBS can maintain appropriate memory permissions. This increases resistance to bypassing vulnerable kernel drivers and helps ensure that malware cannot run in kernel. Only code verified through code integrity can run in kernel mode. | -| Software: Qualified **Windows operating system** | Windows 10 Enterprise, Windows 10 Pro, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

                          Important:
                          Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only virtualization-based protection of code integrity is supported in this configuration.

                          | Support for VBS and for management features that simplify configuration of Windows Defender Device Guard. | +| Software: Qualified **Windows operating system** | Windows 10 Enterprise, Windows 10 Pro, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

                          Important:
                          Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only virtualization-based protection of code integrity is supported in this configuration.

                          | Support for VBS and for management features that simplify configuration of Windows Defender Device Guard. | > **Important**  The following tables list additional qualifications for improved security. You can use Windows Defender Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting these additional qualifications to significantly strengthen the level of security that Windows Defender Device Guard can provide. @@ -75,6 +74,6 @@ The following tables describe additional hardware and firmware qualifications, a | Protections for Improved Security | Description | Security benefits | |---------------------------------------------|----------------------------------------------------|------| -| Firmware: **VBS enablement of NX protection for UEFI runtime services** | • VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
                          • UEFI runtime service must meet these requirements:
                              • Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
                              • PE sections need to be page-aligned in memory (not required for in non-volitile storage).
                              • The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
                                  • All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
                                  • No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

                          Notes:
                          • This only applies to UEFI runtime service memory, and not UEFI boot service memory.
                          • This protection is applied by VBS on OS page tables.


                          Please also note the following:
                          • Do not use sections that are both writeable and executable
                          • Do not attempt to directly modify executable system memory
                          • Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
                          • Reduces the attack surface to VBS from system firmware. | +| Firmware: **VBS enablement of NX protection for UEFI runtime services** | • VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
                          • UEFI runtime service must meet these requirements:
                              • Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
                              • PE sections need to be page-aligned in memory (not required for in non-volitile storage).
                              • The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
                                  • All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
                                  • No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

                          Notes:
                          • This only applies to UEFI runtime service memory, and not UEFI boot service memory.
                          • This protection is applied by VBS on OS page tables.


                          Please also note the following:
                          • Do not use sections that are both writeable and executable
                          • Do not attempt to directly modify executable system memory
                          • Do not use dynamic code | • Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
                          • Reduces the attack surface to VBS from system firmware. | | Firmware: **Firmware support for SMM protection** | The [Windows SMM Security Mitigations Table (WSMT) specification](https://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.| • Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
                          • Reduces the attack surface to VBS from system firmware.
                          • Blocks additional security attacks against SMM. | diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index 7b43d6901d..7be719b91a 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -1,53 +1,64 @@ --- -title: FIPS 140 Validation -description: This topic provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard FIPS 140. -ms.prod: w10 +title: Federal Information Processing Standard (FIPS) 140 Validation +description: Learn how Microsoft products and cryptographic modules follow the U.S. Federal government standard FIPS 140. +ms.prod: m365-security audience: ITPro -author: dulcemontemayor +author: dansimp ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 11/05/2019 ms.reviewer: +ms.technology: mde --- # FIPS 140-2 Validation ## FIPS 140-2 standard overview -The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard that defines minimum security requirements for cryptographic modules in information technology products, as defined in Section 5131 of the Information Technology Management Reform Act of 1996. +The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard. FIPS is based on Section 5131 of the Information Technology Management Reform Act of 1996. It defines the minimum security requirements for cryptographic modules in IT products. -The [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program), a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS), validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover eleven areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. +The [Cryptographic Module Validation Program (CMVP)](https://csrc.nist.gov/Projects/cryptographic-module-validation-program) is a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS). It validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover 11 areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. ## Microsoft’s approach to FIPS 140-2 validation -Microsoft maintains an active commitment to meeting the requirements of the FIPS 140-2 standard, having validated cryptographic modules against it since the inception of the standard in 2001. Microsoft validates its cryptographic modules under the NIST CMVP, as described above. Multiple Microsoft products, including Windows 10, Windows Server, and many cloud services, use these cryptographic modules. +Microsoft maintains an active commitment to meeting the requirements of the FIPS 140-2 standard, having validated cryptographic modules against it since it was first established in 2001. Microsoft validates its cryptographic modules under the NIST CMVP, as described above. Multiple Microsoft products, including Windows 10, Windows Server, and many cloud services, use these cryptographic modules. ## Using Windows in a FIPS 140-2 approved mode of operation -Windows 10 and Windows server may be configured to run in a FIPS 140-2 approved mode of operation. This is commonly referred to as “FIPS mode.” Achieving this mode of operation requires administrators to complete all four steps outlined below. +Windows 10 and Windows Server may be configured to run in a FIPS 140-2 approved mode of operation, commonly referred to as "FIPS mode."  If you turn on FIPS mode, the Cryptographic Primitives Library (bcryptprimitives.dll) and Kernel Mode Cryptographic Primitives Library (CNG.sys) modules will run self-tests before Windows runs cryptographic operations. These self-tests are run according to FIPS 140-2 Section 4.9. They ensure that the modules are functioning properly. + +The Cryptographic Primitives Library and the Kernel Mode Cryptographic Primitives Library are the only modules affected by FIPS mode. FIPS mode won't prevent Windows and its subsystems from using non-FIPS validated cryptographic algorithms. FIPS mode is merely advisory for applications or components other than the Cryptographic Primitives Library and the Kernel Mode Cryptographic Primitives Library. + +US government regulations continue to mandate FIPS mode for government devices running Windows. Other customers should decide for themselves if FIPS mode is right for them. There are many applications and protocols that use FIPS mode policy to determine which cryptographic functionality to run. Customers seeking to follow the FIPS 140-2 standard should research the configuration settings of their applications and protocols. This research will help ensure that they can be configured to use FIPS 140-2 validated cryptography. + +Achieving this FIPS 140-2 approved mode of operation of Windows requires administrators to complete all four steps outlined below. ### Step 1: Ensure FIPS 140-2 validated cryptographic modules are installed -Administrators must ensure that all cryptographic modules installed are FIPS 140-2 validated. This is accomplished by cross-checking the version number of the cryptographic module with the table of validated modules at the end of this topic, organized by operating system release. +Administrators must ensure that all cryptographic modules installed are FIPS 140-2 validated. Tables listing validated modules, organized by operating system release, are available later in this article. ### Step 2: Ensure all security policies for all cryptographic modules are followed -Each of the cryptographic modules has a defined security policy that must be met for the module to operate in its FIPS 140-2 approved mode. The security policy may be found in each module’s published Security Policy Document (SPD). The SPDs for each module may be found by following the links in the table of validated modules at the end of this topic. Click on the module version number to view the published SPD for the module. - +Each of the cryptographic modules has a defined security policy that must be met for the module to operate in its FIPS 140-2 approved mode. The security policy may be found in each module’s published Security Policy Document (SPD). The SPDs for each module may be found in the table of validated modules at the end of this article. Select the module version number to view the published SPD for the module. + ### Step 3: Enable the FIPS security policy -Windows provides the security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing,” which is used by some Microsoft products to determine whether to operate in a FIPS 140-2 approved mode. When this policy is enabled, the validated cryptographic modules in Windows will also operate in FIPS approved mode. The policy may be set using Local Security Policy, as part of Group Policy, or through a Modern Device Management (MDM) solution. For more information on the policy, see [System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing). +Windows provides the security policy setting, *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing*. This setting is used by some Microsoft products to determine whether to run in FIPS mode. When this policy is turned on, the validated cryptographic modules in Windows will also operate in FIPS mode. This policy may be set using Local Security Policy, as part of Group Policy, or through a Modern Device Management (MDM) solution. For more information on the policy, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing). -### Step 4: Ensure only FIPS validated cryptographic algorithms are used +### Step 4: Ensure that only FIPS validated cryptographic algorithms are used -Neither the operating system nor the cryptographic modules can enforce a FIPS approved mode of operation, regardless of the FIPS security policy setting. To run in a FIPS approved mode, an application or service must check for the policy flag and enforce the security policies of the validated modules. If an application or service uses a non-approved cryptographic algorithm or does not follow the security policies of the validated modules, it is not operating in a FIPS approved mode. +FIPS mode is enforced at the level of the application or service. It is not enforced by the operating system or by individual cryptographic modules. Applications or services running in FIPS mode must follow the security policies of validated modules. They must not use a cryptographic algorithm that isn't FIPS-compliant. + +In short, an application or service is running in FIPS mode if it: + +* Checks for the policy flag +* Enforces security policies of validated modules ## Frequently asked questions -### How long does it take to certify cryptographic modules? +### How long does it take to certify a cryptographic module? Microsoft begins certification of cryptographic modules after each major feature release of Windows 10 and Windows Server. The duration of each evaluation varies, depending on many factors. @@ -55,25 +66,29 @@ Microsoft begins certification of cryptographic modules after each major feature The cadence for starting module validation aligns with the feature updates of Windows 10 and Windows Server. As the software industry evolves, operating systems release more frequently. Microsoft completes validation work on major releases but, in between releases, seeks to minimize the changes to the cryptographic modules. -### What is the difference between “FIPS 140 validated” and “FIPS 140 compliant”? +### What is the difference between *FIPS 140 validated* and *FIPS 140 compliant*? -“FIPS 140 validated” means that the cryptographic module, or a product that embeds the module, has been validated (“certified”) by the CMVP as meeting the FIPS 140-2 requirements. “FIPS 140 compliant” is an industry term for IT products that rely on FIPS 140 validated products for cryptographic functionality. +*FIPS 140 validated* means that the cryptographic module, or a product that embeds the module, has been validated ("certified") by the CMVP as meeting the FIPS 140-2 requirements. *FIPS 140 compliant* is an industry term for IT products that rely on FIPS 140 validated products for cryptographic functionality. -### I need to know if a Windows service or application is FIPS 140-2 validated. +### How do I know if a Windows service or application is FIPS 140-2 validated? -The cryptographic modules leveraged in Windows are validated through the CMVP, not individual services, applications, hardware peripherals, or other solutions. For a solution to be considered compliant, it must call a FIPS 140-2 validated cryptographic module in the underlying OS and the OS must be configured to run in FIPS mode. Contact the vendor of the service, application, or product for information on whether it calls a validated cryptographic module. +The cryptographic modules used in Windows are validated through the CMVP. They aren't validated by individual services, applications, hardware peripherals, or other solutions. Any compliant solution must call a FIPS 140-2 validated cryptographic module in the underlying OS, and the OS must be configured to run in FIPS mode. Contact the vendor of the service, application, or product for information on whether it calls a validated cryptographic module. -### What does "When operated in FIPS mode" mean on a certificate? +### What does *When operated in FIPS mode* mean on a certificate? -This caveat identifies required configuration and security rules that must be followed to use the cryptographic module in a way that is consistent with its FIPS 140-2 security policy. Each module has its own security policy—a precise specification of the security rules under which it will operate—and employs approved cryptographic algorithms, cryptographic key management, and authentication techniques. The security rules are defined in the Security Policy Document (SPD) for each module. +This label means that certain configuration and security rules must be followed to use the cryptographic module in compliance with its FIPS 140-2 security policy. Each module has its own security policy—a precise specification of the security rules under which it will operate—and employs approved cryptographic algorithms, cryptographic key management, and authentication techniques. The security rules are defined in the Security Policy Document (SPD) for each module. ### What is the relationship between FIPS 140-2 and Common Criteria? -These are two separate security standards with different, but complementary, purposes. FIPS 140-2 is designed specifically for validating software and hardware cryptographic modules, while Common Criteria is designed to evaluate security functions in IT software and hardware products. Common Criteria evaluations often rely on FIPS 140-2 validations to provide assurance that basic cryptographic functionality is implemented properly. +FIPS 140-2 and Common Criteria are two separate security standards with different, but complementary, purposes. FIPS 140-2 is designed specifically for validating software and hardware cryptographic modules. Common Criteria are designed to evaluate security functions in IT software and hardware products. Common Criteria evaluations often rely on FIPS 140-2 validations to provide assurance that basic cryptographic functionality is implemented properly. ### How does FIPS 140 relate to Suite B? -Suite B is a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140-2 standard. +Suite B is a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. The Suite B cryptographic algorithms are a subset of the FIPS approved cryptographic algorithms allowed by the FIPS 140-2 standard. + +### Is SMB3 (Server Message Block) FIPS 140 compliant in Windows? + +SMB3 can be FIPS 140 compliant, if Windows is configured to operate in FIPS 140 mode on both client and server. In FIPS mode, SMB3 relies on the underlying Windows FIPS 140 validated cryptographic modules for cryptographic operations. ## Microsoft FIPS 140-2 validated cryptographic modules @@ -81,6 +96,76 @@ The following tables identify the cryptographic modules used in an operating sys ## Modules used by Windows +##### Windows 10 Fall 2018 Update (Version 1809) + +Validated Editions: Home, Pro, Enterprise, Education + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Cryptographic Primitives Library10.0.17763#3197See Security Policy and Certificate page for algorithm information
                          Kernel Mode Cryptographic Primitives Library10.0.17763#3196See Security Policy and Certificate page for algorithm information
                          Code Integrity10.0.17763#3644See Security Policy and Certificate page for algorithm information
                          Windows OS Loader10.0.17763#3615See Security Policy and Certificate page for algorithm information
                          Secure Kernel Code Integrity10.0.17763#3651See Security Policy and Certificate page for algorithm information
                          BitLocker Dump Filter10.0.17763#3092See Security Policy and Certificate page for algorithm information
                          Boot Manager10.0.17763#3089See Security Policy and Certificate page for algorithm information
                          Virtual TPM10.0.17763#3690See Security Policy and Certificate page for algorithm information
                          + ##### Windows 10 Spring 2018 Update (Version 1803) Validated Editions: Home, Pro, Enterprise, Education @@ -94,10 +179,10 @@ Validated Editions: Home, Pro, Enterprise, Education -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library @@ -158,10 +243,10 @@ Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library @@ -228,26 +313,26 @@ Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) 10.0.15063 #3095 -

                          FIPS Approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)
                          +

                          FIPS approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)

                          Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #1281); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #1278)

                          -Kernel Mode Cryptographic Primitives Library (cng.sys) +Kernel Mode Cryptographic Primitives Library (cng.sys) 10.0.15063 #3094

                          #3094

                          -

                          FIPS Approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)
                          +

                          FIPS approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)

                          Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert.#1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert.#2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert.#1281)

                          @@ -256,51 +341,51 @@ Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile Boot Manager 10.0.15063 #3089 -

                          FIPS Approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

                          +

                          FIPS approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

                          Other algorithms: PBKDF (vendor affirmed); VMK KDF (vendor affirmed)

                          Windows OS Loader 10.0.15063 #3090 -

                          FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

                          +

                          FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

                          Other algorithms: NDRNG

                          Windows Resume[1] 10.0.15063 #3091 -FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790) +FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790) BitLocker® Dump Filter[2] 10.0.15063 #3092 -FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790) +FIPS approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790) Code Integrity (ci.dll) 10.0.15063 #3093 -

                          FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

                          +

                          FIPS approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

                          Secure Kernel Code Integrity (skci.dll)[3] 10.0.15063 #3096 -

                          FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

                          +

                          FIPS approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

                          -\[1\] Applies only to Home, Pro, Enterprise, Education and S +\[1\] Applies only to Home, Pro, Enterprise, Education, and S. -\[2\] Applies only to Pro, Enterprise, Education, S, Mobile and Surface Hub +\[2\] Applies only to Pro, Enterprise, Education, S, Mobile, and Surface Hub -\[3\] Applies only to Pro, Enterprise Education and S +\[3\] Applies only to Pro, Enterprise, Education, and S ##### Windows 10 Anniversary Update (Version 1607) @@ -315,25 +400,25 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) 10.0.14393 #2937 -

                          FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
                          +

                          FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)

                          Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886)

                          -Kernel Mode Cryptographic Primitives Library (cng.sys) +Kernel Mode Cryptographic Primitives Library (cng.sys) 10.0.14393 #2936 -

                          FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
                          +

                          FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)

                          Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887)

                          @@ -342,14 +427,14 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile Boot Manager 10.0.14393 #2931 -

                          FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

                          +

                          FIPS approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

                          Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

                          BitLocker® Windows OS Loader (winload) 10.0.14393 #2932 -FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
                          +FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)

                          Other algorithms: NDRNG; MD5 @@ -357,7 +442,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile BitLocker® Windows Resume (winresume)[1] 10.0.14393 #2933 -FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
                          +FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)

                          Other algorithms: MD5 @@ -365,13 +450,13 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile BitLocker® Dump Filter (dumpfve.sys)[2] 10.0.14393 #2934 -FIPS Approved algorithms: AES (Certs. #4061 and #4064) +FIPS approved algorithms: AES (Certs. #4061 and #4064) Code Integrity (ci.dll) 10.0.14393 #2935 -

                          FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
                          +

                          FIPS approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)

                          Other algorithms: AES (non-compliant); MD5

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

                          @@ -380,7 +465,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile Secure Kernel Code Integrity (skci.dll)[3] 10.0.14393 #2938 -

                          FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
                          +

                          FIPS approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)

                          Other algorithms: MD5

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

                          @@ -389,11 +474,11 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile -\[1\] Applies only to Home, Pro, Enterprise and Enterprise LTSB +\[1\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB -\[2\] Applies only to Pro, Enterprise, Enterprise LTSB and Mobile +\[2\] Applies only to Pro, Enterprise, Enterprise LTSB, and Mobile -\[3\] Applies only to Pro, Enterprise and Enterprise LTSB +\[3\] Applies only to Pro, Enterprise, and Enterprise LTSB ##### Windows 10 November 2015 Update (Version 1511) @@ -408,25 +493,25 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) 10.0.10586 #2606 -

                          FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
                          +

                          FIPS approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888, and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)

                          Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664)

                          -Kernel Mode Cryptographic Primitives Library (cng.sys) +Kernel Mode Cryptographic Primitives Library (cng.sys) 10.0.10586 #2605 -

                          FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
                          +

                          FIPS approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888, and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)

                          Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663)

                          @@ -435,7 +520,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub Boot Manager[4] 10.0.10586 #2700 -FIPS Approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
                          +FIPS approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)

                          Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) @@ -443,7 +528,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub BitLocker® Windows OS Loader (winload)[5] 10.0.10586 #2701 -FIPS Approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
                          +FIPS approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)

                          Other algorithms: MD5; NDRNG @@ -451,7 +536,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub BitLocker® Windows Resume (winresume)[6] 10.0.10586 #2702 -FIPS Approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
                          +FIPS approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)

                          Other algorithms: MD5 @@ -459,13 +544,13 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub BitLocker® Dump Filter (dumpfve.sys)[7] 10.0.10586 #2703 -FIPS Approved algorithms: AES (Certs. #3653) +FIPS approved algorithms: AES (Certs. #3653) Code Integrity (ci.dll) 10.0.10586 #2604 -

                          FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
                          +

                          FIPS approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)

                          Other algorithms: AES (non-compliant); MD5

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

                          @@ -474,7 +559,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub Secure Kernel Code Integrity (skci.dll)[8] 10.0.10586 #2607 -

                          FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
                          +

                          FIPS approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)

                          Other algorithms: MD5

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

                          @@ -483,13 +568,13 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub -\[4\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub +\[4\] Applies only to Home, Pro, Enterprise, Mobile, and Surface Hub -\[5\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub +\[5\] Applies only to Home, Pro, Enterprise, Mobile, and Surface Hub -\[6\] Applies only to Home, Pro and Enterprise +\[6\] Applies only to Home, Pro, and Enterprise -\[7\] Applies only to Pro, Enterprise, Mobile and Surface Hub +\[7\] Applies only to Pro, Enterprise, Mobile, and Surface Hub \[8\] Applies only to Enterprise and Enterprise LTSB @@ -506,25 +591,25 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) 10.0.10240 #2606 -

                          FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
                          +

                          FIPS approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)

                          Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575)

                          -Kernel Mode Cryptographic Primitives Library (cng.sys) +Kernel Mode Cryptographic Primitives Library (cng.sys) 10.0.10240 #2605 -

                          FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
                          +

                          FIPS approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 bits and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)

                          Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576)

                          @@ -533,7 +618,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Boot Manager[9] 10.0.10240 #2600 -FIPS Approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
                          +FIPS approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)

                          Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) @@ -541,7 +626,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface BitLocker® Windows OS Loader (winload)[10] 10.0.10240 #2601 -FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
                          +FIPS approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)

                          Other algorithms: MD5; NDRNG @@ -549,7 +634,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface BitLocker® Windows Resume (winresume)[11] 10.0.10240 #2602 -FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
                          +FIPS approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)

                          Other algorithms: MD5 @@ -557,13 +642,13 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface BitLocker® Dump Filter (dumpfve.sys)[12] 10.0.10240 #2603 -FIPS Approved algorithms: AES (Certs. #3497 and #3498) +FIPS approved algorithms: AES (Certs. #3497 and #3498) Code Integrity (ci.dll) 10.0.10240 #2604 -

                          FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
                          +

                          FIPS approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)

                          Other algorithms: AES (non-compliant); MD5

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

                          @@ -572,7 +657,7 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Secure Kernel Code Integrity (skci.dll)[13] 10.0.10240 #2607 -

                          FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
                          +

                          FIPS approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)

                          Other algorithms: MD5

                          Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

                          @@ -581,13 +666,13 @@ Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface -\[9\] Applies only to Home, Pro, Enterprise and Enterprise LTSB +\[9\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB -\[10\] Applies only to Home, Pro, Enterprise and Enterprise LTSB +\[10\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB -\[11\] Applies only to Home, Pro, Enterprise and Enterprise LTSB +\[11\] Applies only to Home, Pro, Enterprise, and Enterprise LTSB -\[12\] Applies only to Pro, Enterprise and Enterprise LTSB +\[12\] Applies only to Pro, Enterprise, and Enterprise LTSB \[13\] Applies only to Enterprise and Enterprise LTSB @@ -604,34 +689,34 @@ Validated Editions: RT, Pro, Enterprise, Phone, Embedded -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) 6.3.9600 6.3.9600.17031 #2357 -

                          FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
                          +

                          FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)

                          -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

                          +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323)

                          -Kernel Mode Cryptographic Primitives Library (cng.sys) +Kernel Mode Cryptographic Primitives Library (cng.sys) 6.3.9600 6.3.9600.17042 #2356 -

                          FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
                          +

                          FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)

                          -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

                          +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

                          Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

                          Boot Manager 6.3.9600 6.3.9600.17031 #2351 -FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
                          +FIPS approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)

                          Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant) @@ -639,7 +724,7 @@ Validated Editions: RT, Pro, Enterprise, Phone, Embedded BitLocker® Windows OS Loader (winload) 6.3.9600 6.3.9600.17031 #2352 -FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
                          +FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)

                          Other algorithms: MD5; NDRNG @@ -647,7 +732,7 @@ Validated Editions: RT, Pro, Enterprise, Phone, Embedded BitLocker® Windows Resume (winresume)[14] 6.3.9600 6.3.9600.17031 #2353 -FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
                          +FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)

                          Other algorithms: MD5 @@ -655,7 +740,7 @@ Validated Editions: RT, Pro, Enterprise, Phone, Embedded BitLocker® Dump Filter (dumpfve.sys) 6.3.9600 6.3.9600.17031 #2354 -FIPS Approved algorithms: AES (Cert. #2832)
                          +FIPS approved algorithms: AES (Cert. #2832)

                          Other algorithms: N/A @@ -663,7 +748,7 @@ Validated Editions: RT, Pro, Enterprise, Phone, Embedded Code Integrity (ci.dll) 6.3.9600 6.3.9600.17031 #2355#2355 -

                          FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
                          +

                          FIPS approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)

                          Other algorithms: MD5

                          Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

                          @@ -681,36 +766,36 @@ Validated Editions: RT, Home, Pro, Enterprise, Phone - - - - + + + + - - + - +Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) - @@ -718,7 +803,7 @@ Validated Editions: RT, Home, Pro, Enterprise, Phone - @@ -726,7 +811,7 @@ Validated Editions: RT, Home, Pro, Enterprise, Phone - @@ -734,7 +819,7 @@ Validated Editions: RT, Home, Pro, Enterprise, Phone - @@ -742,7 +827,7 @@ Validated Editions: RT, Home, Pro, Enterprise, Phone - @@ -750,19 +835,19 @@ Validated Editions: RT, Home, Pro, Enterprise, Phone - +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Certificate, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength) - +Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #AlgorithmsCryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL) 6.2.9200 #1892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
                          +
                          FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)

                          -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert. ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
                          +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert.); ECDSA (Cert.); HMAC (Cert.); KAS (Cert); KBKDF (Cert.); PBKDF (vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)

                          Kernel Mode Cryptographic Primitives Library (cng.sys)Kernel Mode Cryptographic Primitives Library (cng.sys) 6.2.9200 #1891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
                          +
                          FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)

                          -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RNG (Cert. ); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
                          +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and); ECDSA (Cert.); HMAC (Cert.); KAS (Cert.); KBKDF (Cert.); PBKDF (vendor affirmed); RNG (Cert.); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)

                          -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
                          Boot Manager 6.2.9200 #1895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
                          +
                          FIPS approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)

                          Other algorithms: MD5
                          BitLocker® Windows OS Loader (WINLOAD) 6.2.9200 #1896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
                          +
                          FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)

                          Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
                          BitLocker® Windows Resume (WINRESUME)[15] 6.2.9200 #1898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
                          +
                          FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)

                          Other algorithms: MD5
                          BitLocker® Dump Filter (DUMPFVE.SYS) 6.2.9200 #1899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
                          +
                          FIPS approved algorithms: AES (Certs. #2196 and #2198)

                          Other algorithms: N/A
                          Code Integrity (CI.DLL) 6.2.9200 #1897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
                          +
                          FIPS approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)

                          Other algorithms: MD5
                          Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL) 6.2.9200 #1893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
                          +
                          FIPS approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)

                          -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert. ); Triple-DES MAC (Triple-DES Cert. , vendor affirmed)
                          +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert.); Triple-DES MAC (Triple-DES Certificate, vendor affirmed)

                          -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. , key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          Enhanced Cryptographic Provider (RSAENH.DLL) 6.2.9200 #1894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
                          +
                          FIPS approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)

                          -Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          @@ -783,21 +868,21 @@ Validated Editions: Windows 7, Windows 7 SP1 -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)

                          6.1.7600.16385

                          6.1.7601.17514

                          1329 -FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
                          +FIPS approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 bits to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)

                          -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and ); SHS (Cert. ); Triple-DES (Cert. )
                          +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and); SHS (Cert.); Triple-DES (Cert.)

                          -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 +Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 Kernel Mode Cryptographic Primitives Library (cng.sys) @@ -810,18 +895,18 @@ Validated Editions: Windows 7, Windows 7 SP1

                          6.1.7601.21861

                          6.1.7601.22076

                          1328 -FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
                          +FIPS approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 bits to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)

                          -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 Boot Manager

                          6.1.7600.16385

                          6.1.7601.17514

                          1319 -FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
                          +FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)

                          -Other algorithms: MD5#1168 and ); HMAC (Cert. ); RSA (Cert. ); SHS (Cert. )
                          +Other algorithms: MD5#1168 and); HMAC (Cert.); RSA (Cert.); SHS (Cert.)

                          Other algorithms: MD5 @@ -836,7 +921,7 @@ Validated Editions: Windows 7, Windows 7 SP1

                          6.1.7601.21655

                          6.1.7601.21675

                          1326 -FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
                          +FIPS approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)

                          Other algorithms: MD5 @@ -855,7 +940,7 @@ Validated Editions: Windows 7, Windows 7 SP1

                          6.1.7601.21655

                          6.1.7601.21675

                          1332 -FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
                          +FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)

                          Other algorithms: Elephant Diffuser @@ -868,7 +953,7 @@ Validated Editions: Windows 7, Windows 7 SP1

                          6.1.7601.17950

                          6.1.7601.22108

                          1327 -FIPS Approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
                          +FIPS approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)

                          Other algorithms: MD5 @@ -877,7 +962,7 @@ Validated Editions: Windows 7, Windows 7 SP1 6.1.7600.16385
                          (no change in SP1) 1331 -FIPS Approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
                          +FIPS approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)

                          Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4 @@ -886,9 +971,9 @@ Validated Editions: Windows 7, Windows 7 SP1 6.1.7600.16385
                          (no change in SP1) 1330 -FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
                          +FIPS approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)

                          -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256-bits of encryption strength; non-compliant less than 112 bits of encryption strength) +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength) @@ -907,22 +992,22 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Boot Manager (bootmgr) 6.0.6001.18000 and 6.0.6002.18005 978 -FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753) +FIPS approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753) Winload OS Loader (winload.exe) 6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596 979 -FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
                          +FIPS approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)

                          Other algorithms: MD5 @@ -930,37 +1015,37 @@ Validated Editions: Ultimate Edition Code Integrity (ci.dll) 6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005 980 -FIPS Approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
                          +FIPS approved algorithms: RSA (Cert. #354); SHS (Cert. #753)

                          Other algorithms: MD5 Kernel Mode Security Support Provider Interface (ksecdd.sys) -6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.22869 +6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.22869 1000 -

                          FIPS Approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and ); ECDSA (Cert. ); HMAC (Cert. ); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )

                          -

                          Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

                          +

                          FIPS approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and); ECDSA (Cert.); HMAC (Cert.); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)

                          +

                          Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

                          Cryptographic Primitives Library (bcrypt.dll) -6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005, and 6.0.6002.22872 +6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.22872 1001 -

                          FIPS Approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

                          -

                          Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

                          +

                          FIPS approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

                          +

                          Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

                          Enhanced Cryptographic Provider (RSAENH) -6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.18005 +6.0.6001.22202 and 6.0.6002.18005 1002 -

                          FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

                          -

                          Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

                          +

                          FIPS approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

                          +

                          Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

                          Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) -6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 +6.0.6001.18000 and 6.0.6002.18005 1003 -

                          FIPS Approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

                          -

                          Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

                          +

                          FIPS approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

                          +

                          Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

                          @@ -973,32 +1058,32 @@ Validated Editions: Ultimate Edition - - - - + + + + - +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) - +Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4 - @@ -1006,9 +1091,9 @@ Validated Editions: Ultimate Edition - +Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 bits to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #AlgorithmsCryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Enhanced Cryptographic Provider (RSAENH) 6.0.6000.16386 893FIPS Approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
                          +
                          FIPS approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)

                          -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) 6.0.6000.16386 894FIPS Approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
                          +
                          FIPS approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)

                          -Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
                          BitLocker™ Drive Encryption 6.0.6000.16386 947FIPS Approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
                          +
                          FIPS approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)

                          Other algorithms: Elephant Diffuser
                          Kernel Mode Security Support Provider Interface (ksecdd.sys) 6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067 891FIPS Approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
                          +
                          FIPS approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)

                          -Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
                          @@ -1025,31 +1110,31 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Kernel Mode Cryptographic Module (FIPS.SYS) 5.1.2600.5512 997 -

                          FIPS Approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

                          +

                          FIPS approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

                          Other algorithms: DES; MD5; HMAC MD5

                          Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) 5.1.2600.5507 990 -

                          FIPS Approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

                          -

                          Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

                          +

                          FIPS approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

                          +

                          Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

                          Enhanced Cryptographic Provider (RSAENH) 5.1.2600.5507 989 -

                          FIPS Approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

                          -

                          Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits)

                          +

                          FIPS approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

                          +

                          Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits)

                          @@ -1066,23 +1151,23 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms DSS/Diffie-Hellman Enhanced Cryptographic Provider 5.1.2600.2133 240 -

                          FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

                          Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement)

                          Microsoft Enhanced Cryptographic Provider 5.1.2600.2161 238 -

                          FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

                          Other algorithms: DES (Cert. #156); RC2; RC4; MD5

                          @@ -1100,16 +1185,16 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Microsoft Enhanced Cryptographic Provider 5.1.2600.1029 238 -

                          FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

                          Other algorithms: DES (Cert. #156); RC2; RC4; MD5

                          @@ -1127,16 +1212,16 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Kernel Mode Cryptographic Module 5.1.2600.0 241 -

                          FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

                          Other algorithms: DES (Cert. #89)

                          @@ -1154,16 +1239,16 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Kernel Mode Cryptographic Module (FIPS.SYS) 5.0.2195.1569 106 -

                          FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

                          Other algorithms: DES (Certs. #89)

                          @@ -1173,7 +1258,7 @@ Validated Editions: Ultimate Edition

                          (DSS/DH Enh: 5.0.2195.3665 [SP3])

                          (Enh: 5.0.2195.3839 [SP3]

                          103 -

                          FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

                          Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

                          @@ -1191,16 +1276,16 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Kernel Mode Cryptographic Module (FIPS.SYS) 5.0.2195.1569 106 -

                          FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

                          Other algorithms: DES (Certs. #89)

                          @@ -1214,7 +1299,7 @@ Validated Editions: Ultimate Edition

                          (Enh:

                          5.0.2195.2228 [SP2])

                          103 -

                          FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

                          Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

                          @@ -1232,10 +1317,10 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider @@ -1244,7 +1329,7 @@ Validated Editions: Ultimate Edition

                          (DSS/DH Enh: 5.0.2150.1391 [SP1])

                          (Enh: 5.0.2150.1391 [SP1])

                          103 -

                          FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

                          Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

                          @@ -1262,16 +1347,16 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider 5.0.2150.1 76 -

                          FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

                          Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

                          @@ -1289,16 +1374,16 @@ Validated Editions: Ultimate Edition -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider 5.0.1877.6 and 5.0.1877.7 75 -

                          FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

                          Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

                          @@ -1310,16 +1395,16 @@ Validated Editions: Ultimate Edition - - - - + + + + - @@ -1328,6 +1413,76 @@ Validated Editions: Ultimate Edition ## Modules used by Windows Server +##### Windows Server 2019 (Version 1809) + +Validated Editions: Standard, Datacenter + +
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #AlgorithmsCryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Base Cryptographic Provider 5.0.1877.6 and 5.0.1877.7 68FIPS Approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
                          +
                          FIPS approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)

                          Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)
                          ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Cryptographic Primitives Library10.0.17763#3197See Security Policy and Certificate page for algorithm information
                          Kernel Mode Cryptographic Primitives Library10.0.17763#3196See Security Policy and Certificate page for algorithm information
                          Code Integrity10.0.17763#3644See Security Policy and Certificate page for algorithm information
                          Windows OS Loader10.0.17763#3615See Security Policy and Certificate page for algorithm information
                          Secure Kernel Code Integrity10.0.17763#3651See Security Policy and Certificate page for algorithm information
                          BitLocker Dump Filter10.0.17763#3092See Security Policy and Certificate page for algorithm information
                          Boot Manager10.0.17763#3089See Security Policy and Certificate page for algorithm information
                          Virtual TPM10.0.17763#3690See Security Policy and Certificate page for algorithm information
                          + ##### Windows Server (Version 1803) Validated Editions: Standard, Datacenter @@ -1341,10 +1496,10 @@ Validated Editions: Standard, Datacenter -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library @@ -1405,10 +1560,10 @@ Validated Editions: Standard, Datacenter -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library @@ -1475,24 +1630,24 @@ Validated Editions: Standard, Datacenter, Storage Server -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) 10.0.14393 2937 -FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
                          +FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)

                          Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt) -Kernel Mode Cryptographic Primitives Library (cng.sys) +Kernel Mode Cryptographic Primitives Library (cng.sys) 10.0.14393 2936 -FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
                          +FIPS approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193, and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)

                          Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt) @@ -1500,14 +1655,14 @@ Validated Editions: Standard, Datacenter, Storage Server Boot Manager 10.0.14393 2931 -

                          FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

                          +

                          FIPS approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

                          Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

                          BitLocker® Windows OS Loader (winload) 10.0.14393 2932 -FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
                          +FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)

                          Other algorithms: NDRNG; MD5 @@ -1515,7 +1670,7 @@ Validated Editions: Standard, Datacenter, Storage Server BitLocker® Windows Resume (winresume) 10.0.14393 2933 -FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
                          +FIPS approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)

                          Other algorithms: MD5 @@ -1523,13 +1678,13 @@ Validated Editions: Standard, Datacenter, Storage Server BitLocker® Dump Filter (dumpfve.sys) 10.0.14393 2934 -FIPS Approved algorithms: AES (Certs. #4061 and #4064) +FIPS approved algorithms: AES (Certs. #4061 and #4064) Code Integrity (ci.dll) 10.0.14393 2935 -FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
                          +FIPS approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)

                          Other algorithms: AES (non-compliant); MD5 @@ -1537,7 +1692,7 @@ Validated Editions: Standard, Datacenter, Storage Server Secure Kernel Code Integrity (skci.dll) 10.0.14393 2938 -FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
                          +FIPS approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)

                          Other algorithms: MD5 @@ -1554,32 +1709,32 @@ Validated Editions: Server, Storage Server, - - - - + + + + - +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt) - + - +Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt) - @@ -1587,7 +1742,7 @@ Validated Editions: Server, Storage Server, - @@ -1595,7 +1750,7 @@ Validated Editions: Server, Storage Server, - @@ -1603,7 +1758,7 @@ Validated Editions: Server, Storage Server, - @@ -1611,7 +1766,7 @@ Validated Editions: Server, Storage Server, - @@ -1619,9 +1774,9 @@ Validated Editions: Server, Storage Server,
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #AlgorithmsCryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) 6.3.9600 6.3.9600.17031 2357FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
                          +
                          FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)

                          -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
                          Kernel Mode Cryptographic Primitives Library (cng.sys)Kernel Mode Cryptographic Primitives Library (cng.sys) 6.3.9600 6.3.9600.17042 2356FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
                          +
                          FIPS approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493, and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)

                          -Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
                          Boot Manager 6.3.9600 6.3.9600.17031 2351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
                          +
                          FIPS approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)

                          Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
                          BitLocker® Windows OS Loader (winload) 6.3.9600 6.3.9600.17031 2352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
                          +
                          FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)

                          Other algorithms: MD5; NDRNG
                          BitLocker® Windows Resume (winresume)[16] 6.3.9600 6.3.9600.17031 2353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
                          +
                          FIPS approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)

                          Other algorithms: MD5
                          BitLocker® Dump Filter (dumpfve.sys)[17] 6.3.9600 6.3.9600.17031 2354FIPS Approved algorithms: AES (Cert. #2832)
                          +
                          FIPS approved algorithms: AES (Cert. #2832)

                          Other algorithms: N/A
                          Code Integrity (ci.dll) 6.3.9600 6.3.9600.17031 2355FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
                          +
                          FIPS approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)

                          Other algorithms: MD5
                          -\[16\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** +\[16\] Doesn't apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** -\[17\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** +\[17\] Doesn't apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** **Windows Server 2012** @@ -1630,36 +1785,36 @@ Validated Editions: Server, Storage Server - - - - + + + + - +Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) - + - +Other algorithms: AES (Certificate, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt) - @@ -1667,7 +1822,7 @@ Validated Editions: Server, Storage Server - @@ -1675,7 +1830,7 @@ Validated Editions: Server, Storage Server - @@ -1683,7 +1838,7 @@ Validated Editions: Server, Storage Server - @@ -1691,7 +1846,7 @@ Validated Editions: Server, Storage Server - @@ -1699,7 +1854,7 @@ Validated Editions: Server, Storage Server - @@ -1707,9 +1862,9 @@ Validated Editions: Server, Storage Server - +Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #AlgorithmsCryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL) 6.2.9200 1892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
                          +
                          FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)

                          -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert. ); HMAC (Cert. #); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
                          +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert.); HMAC (Cert. #); KAS (Cert.); KBKDF (Cert.); PBKDF (vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)

                          -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
                          Kernel Mode Cryptographic Primitives Library (cng.sys)Kernel Mode Cryptographic Primitives Library (cng.sys) 6.2.9200 1891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
                          +
                          FIPS approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)

                          -Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
                          +Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)

                          -Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
                          Boot Manager 6.2.9200 1895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
                          +
                          FIPS approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)

                          Other algorithms: MD5
                          BitLocker® Windows OS Loader (WINLOAD) 6.2.9200 1896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
                          +
                          FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)

                          Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
                          BitLocker® Windows Resume (WINRESUME) 6.2.9200 1898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
                          +
                          FIPS approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)

                          Other algorithms: MD5
                          BitLocker® Dump Filter (DUMPFVE.SYS) 6.2.9200 1899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
                          +
                          FIPS approved algorithms: AES (Certs. #2196 and #2198)

                          Other algorithms: N/A
                          Code Integrity (CI.DLL) 6.2.9200 1897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
                          +
                          FIPS approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)

                          Other algorithms: MD5
                          Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL) 6.2.9200 1893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
                          +
                          FIPS approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)

                          Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          Enhanced Cryptographic Provider (RSAENH.DLL) 6.2.9200 1894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
                          +
                          FIPS approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)

                          -Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          @@ -1720,72 +1875,72 @@ Validated Editions: Server, Storage Server - - - - + + + + - + - - - + + - - + - - + - +-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4 - + - +Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 bits and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4 - +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength) - - + - @@ -1798,68 +1953,68 @@ Validated Editions: Server, Storage Server
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #AlgorithmsCryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Boot Manager (bootmgr)6.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.17514 1321FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
                          +
                          FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)

                          Other algorithms: MD5
                          Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216756.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.21675Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.21675 1333FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
                          +
                          FIPS approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)

                          Other algorithms: MD5
                          Code Integrity (ci.dll)6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.22108 1334FIPS Approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
                          +
                          FIPS approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)

                          Other algorithms: MD5
                          Kernel Mode Cryptographic Primitives Library (cng.sys)6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.22076 1335FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
                          +
                          FIPS approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 bits and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)

                          --Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
                          Cryptographic Primitives Library (bcryptprimitives.dll)66.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.17514 1336FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
                          +
                          FIPS approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 bits and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)

                          -Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4
                          Enhanced Cryptographic Provider (RSAENH) 6.1.7600.16385 1337FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
                          +
                          FIPS approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)

                          -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) 6.1.7600.16385 1338FIPS Approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
                          +
                          FIPS approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)

                          Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
                          BitLocker™ Drive Encryption6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.21675 1339FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
                          +
                          FIPS approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)

                          Other algorithms: Elephant Diffuser
                          - - - - + + + + - + - - - + + - - + - - + - +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength) - + - +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength) - + - +-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4 - + - +Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #AlgorithmsCryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
                          Boot Manager (bootmgr)6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.22497 1004FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
                          +
                          FIPS approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)

                          Other algorithms: N/A
                          Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225966.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.22596Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.22596 1005FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
                          +
                          FIPS approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)

                          Other algorithms: MD5
                          Code Integrity (ci.dll)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 1006FIPS Approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
                          +
                          FIPS approved algorithms: RSA (Cert. #355); SHS (Cert. #753)

                          Other algorithms: MD5
                          Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.22869 1007FIPS Approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
                          +
                          FIPS approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)

                          -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert. ); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
                          +Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 bits and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert.); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and); SHS (Cert.); Triple-DES (Cert.)

                          -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.22872 1008FIPS Approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
                          +
                          FIPS approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)

                          -Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)
                          Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.18005 1009FIPS Approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
                          +
                          FIPS approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

                          --Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
                          Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.18005 1010FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
                          +
                          FIPS approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)

                          -Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
                          @@ -1876,31 +2031,31 @@ Validated Editions: Server, Storage Server -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) 5.2.3790.3959 875 -

                          FIPS Approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

                          -

                          Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

                          +

                          FIPS approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

                          +

                          Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 bits and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

                          Kernel Mode Cryptographic Module (FIPS.SYS) 5.2.3790.3959 869 -

                          FIPS Approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

                          +

                          FIPS approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

                          Other algorithms: DES; HMAC-MD5

                          Enhanced Cryptographic Provider (RSAENH) 5.2.3790.3959 868 -

                          FIPS Approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

                          -

                          Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

                          +

                          FIPS approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

                          +

                          Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 bits and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

                          @@ -1917,16 +2072,16 @@ Validated Editions: Server, Storage Server -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Kernel Mode Cryptographic Module (FIPS.SYS) 5.2.3790.1830 [SP1] 405 -

                          FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

                          +

                          FIPS approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

                          Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

                          [1] x86
                          [2] SP1 x86, x64, IA64

                          @@ -1935,7 +2090,7 @@ Validated Editions: Server, Storage Server Enhanced Cryptographic Provider (RSAENH) 5.2.3790.1830 [Service Pack 1]) 382 -

                          FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

                          Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

                          [1] x86
                          [2] SP1 x86, x64, IA64

                          @@ -1944,7 +2099,7 @@ Validated Editions: Server, Storage Server Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) 5.2.3790.1830 [Service Pack 1] 381 -

                          FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

                          +

                          FIPS approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

                          Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

                          [1] x86
                          [2] SP1 x86, x64, IA64

                          @@ -1964,16 +2119,16 @@ Validated Editions: Server, Storage Server -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Kernel Mode Cryptographic Module (FIPS.SYS) 5.2.3790.0 405 -

                          FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

                          +

                          FIPS approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

                          Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

                          [1] x86
                          [2] SP1 x86, x64, IA64

                          @@ -1982,7 +2137,7 @@ Validated Editions: Server, Storage Server Enhanced Cryptographic Provider (RSAENH) 5.2.3790.0 382 -

                          FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

                          Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

                          [1] x86
                          [2] SP1 x86, x64, IA64

                          @@ -1991,7 +2146,7 @@ Validated Editions: Server, Storage Server Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) 5.2.3790.0 381 -

                          FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

                          +

                          FIPS approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

                          Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

                          [1] x86
                          [2] SP1 x86, x64, IA64

                          @@ -2013,24 +2168,24 @@ Validated Editions: Server, Storage Server -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Enhanced Cryptographic Provider 7.00.2872 [1] and 8.00.6246 [2] 2957 -

                          FIPS Approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

                          -

                          Allowed algorithms: HMAC-MD5; MD5; NDRNG

                          +

                          FIPS approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

                          +

                          Allowed algorithms: HMAC-MD5, MD5, NDRNG

                          Cryptographic Primitives Library (bcrypt.dll) 7.00.2872 [1] and 8.00.6246 [2] 2956 -

                          FIPS Approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

                          -

                          Allowed algorithms: MD5; NDRNG; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength

                          +

                          FIPS approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

                          +

                          Allowed algorithms: MD5, NDRNG, RSA (key wrapping; key establishment methodology provides between 112 bits and 150 bits of encryption strength

                          @@ -2048,16 +2203,16 @@ Validated Editions: Server, Storage Server -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Enhanced Cryptographic Provider 6.00.1937 [1] and 7.00.1687 [2] 825 -

                          FIPS Approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

                          +

                          FIPS approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

                          Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES

                          @@ -2075,16 +2230,16 @@ Validated Editions: Server, Storage Server -Cryptographic Module -Version (link to Security Policy) -FIPS Certificate # -Algorithms +Cryptographic Module +Version (link to Security Policy) +FIPS Certificate # +Algorithms Outlook Cryptographic Provider (EXCHCSP) -SR-1A (3821)SR-1A (3821) +SR-1A (3821) 110 -

                          FIPS Approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

                          +

                          FIPS approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

                          Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5

                          @@ -2105,8 +2260,8 @@ The following tables are organized by cryptographic algorithms with their modes, -Modes / States / Key Sizes -Algorithm Implementation and Certificate # +Modes / States / Key Sizes +Algorithm Implementation and Certificate #
                            @@ -2157,7 +2312,7 @@ The following tables are organized by cryptographic algorithms with their modes,
                          • Key Lengths: 128, 192, 256 (bits)
                        -

                        Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

                        +

                        Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

                        Version 10.0.16299

                        @@ -2173,7 +2328,7 @@ The following tables are organized by cryptographic algorithms with their modes,
                      • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
                      • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
                      • Plain Text Length: 0-32
                      • -
                      • AAD Length: 0-65536
                      • +
                      • Additional authenticated data length: 0-65536
                    • AES-CFB128:
                      • @@ -2246,7 +2401,7 @@ The following tables are organized by cryptographic algorithms with their modes,
                      • Key Lengths: 128, 192, 256 (bits)
                      • Tag Lengths: 96, 104, 112, 120, 128 (bits)
                      • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
                      • -
                      • AAD Lengths: 0, 8, 1016, 1024 (bits)
                      • +
                      • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
                      • 96 bit IV supported
                    • AES-XTS:
                    • @@ -2279,7 +2434,7 @@ The following tables are organized by cryptographic algorithms with their modes,
                    • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
                    • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
                    • Plain Text Length: 0-32
                    • -
                    • AAD Length: 0-65536
                    • +
                    • Additional authenticated data length: 0-65536
                  • AES-CFB128:
                    • @@ -2352,7 +2507,7 @@ The following tables are organized by cryptographic algorithms with their modes,
                    • Key Lengths: 128, 192, 256 (bits)
                    • Tag Lengths: 96, 104, 112, 120, 128 (bits)
                    • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
                    • -
                    • AAD Lengths: 0, 8, 1016, 1024 (bits)
                    • +
                    • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
                    • 96 bit IV supported
                  • AES-XTS:
                  • @@ -2385,7 +2540,7 @@ The following tables are organized by cryptographic algorithms with their modes,
                  • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
                  • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
                  • Plain Text Length: 0-32
                  • -
                  • AAD Length: 0-65536
                  • +
                  • Additional authenticated data length: 0-65536
                • AES-CFB128:
                  • @@ -2459,7 +2614,7 @@ The following tables are organized by cryptographic algorithms with their modes,
                  • Key Lengths: 128, 192, 256 (bits)
                  • Tag Lengths: 96, 104, 112, 120, 128 (bits)
                  • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
                  • -
                  • AAD Lengths: 0, 8, 1016, 1024 (bits)
                  • +
                  • Additional authenticated data lengths: 0, 8, 1016, 1024 (bits)
                  • 96 bit IV supported
                • AES-XTS:
                • @@ -2476,7 +2631,7 @@ The following tables are organized by cryptographic algorithms with their modes,
            -

            Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

            +

            Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

            Version 10.0.16299

            @@ -2487,7 +2642,7 @@ The following tables are organized by cryptographic algorithms with their modes,
          • Key Lengths: 128, 192, 256 (bits)
          • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
          -

          AES Val#4902

          +

          AES validation number 4902

          Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900

          Version 10.0.15063.674

          @@ -2499,7 +2654,7 @@ The following tables are organized by cryptographic algorithms with their modes,
        • Key Lengths: 128, 192, 256 (bits)
        • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
        -

        AES Val#4901

        +

        AES validation number 4901

        Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899

        Version 10.0.15254

        @@ -2511,8 +2666,8 @@ The following tables are organized by cryptographic algorithms with their modes,
      • Key Lengths: 128, 192, 256 (bits)
      • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
      -

      AES Val#4897

      -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

      +

      AES validation number 4897

      +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

      Version 10.0.16299

      @@ -2522,9 +2677,9 @@ The following tables are organized by cryptographic algorithms with their modes,
    • Tag Lengths: 128 (bits)
    • IV Lengths: 96 (bits)
    • Plain Text Length: 0-32
    • -
    • AAD Length: 0-65536
    • +
    • Additional authenticated data length: 0-65536
    -

    AES Val#4902

    +

    AES validation number 4902

    Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896

    Version 10.0.15063.674

    @@ -2535,9 +2690,9 @@ The following tables are organized by cryptographic algorithms with their modes,
  • Tag Lengths: 128 (bits)
  • IV Lengths: 96 (bits)
  • Plain Text Length: 0-32
  • -
  • AAD Length: 0-65536
  • +
  • Additional authenticated data length: 0-65536
  • -

    AES Val#4901

    +

    AES validation number 4901

    Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895

    Version 10.0.15254

    @@ -2548,291 +2703,291 @@ The following tables are organized by cryptographic algorithms with their modes,
  • Tag Lengths: 128 (bits)
  • IV Lengths: 96 (bits)
  • Plain Text Length: 0-32
  • -
  • AAD Length: 0-65536
  • +
  • Additional authenticated data length: 0-65536
  • -

    AES Val#4897

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

    +

    AES validation number 4897

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

    Version 10.0.16299

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB128 ( e/d; 128 , 192 , 256 );

    -

    OFB ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB128 (e/d; 128, 192, 256);

    +

    OFB (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627

    Version 10.0.15063

    -

    KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    -

    AES Val#4624

    +

    KW (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    +

    AES validation number 4624

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626

    Version 10.0.15063

    -

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#4624

    +

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 4624

     

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625

    Version 10.0.15063

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

    CFB128 ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

    -

    (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

    -

    IV Generated: ( External ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; 96BitIV_Supported

    -

    GMAC_Supported

    -

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

    CFB128 (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)

    +

    (KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)

    +

    IV Generated: (External); PT Lengths Tested: (0, 1024, 8, 1016); Additional authenticated data lengths tested: (0, 1024, 8, 1016); 96 bit IV supported

    +

    GMAC supported

    +

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624

    Version 10.0.15063

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434

    Version 7.00.2872

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433

    Version 8.00.6246

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431

    Version 7.00.2872

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430

    Version 8.00.6246

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB128 ( e/d; 128 , 192 , 256 );

    -

    OFB ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB128 (e/d; 128, 192, 256);

    +

    OFB (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

    Version 10.0.14393

    -

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    -GMAC_Supported

    -

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    +

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    +(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    +IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested: (0, 0); 96 bit IV supported
    +GMAC supported

    +

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064

    Version 10.0.14393

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

     

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
    Version 10.0.14393 -

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 192 , 256 , 320 , 2048 )

    -

    AES Val#4064

    +

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 192, 256, 320, 2048)

    +

    AES validation number 4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062

    Version 10.0.14393

    -

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#4064

    +

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 4064

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061

    Version 10.0.14393

    -

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    -

    AES Val#3629

    +

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    +

    AES validation number 3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652

    Version 10.0.10586

    -

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#3629

    +

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 3629

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653

    Version 10.0.10586

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

     

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
    Version 10.0.10586 -

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    -GMAC_Supported

    -

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    +

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    +(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    +IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested: (0, 0); 96 bit IV supported
    +GMAC supported

    +

    XTS((KS: XTS_128((e/d) (f)) KS: XTS_256((e/d) (f))

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629

    Version 10.0.10586

    -

    KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

    -

    AES Val#3497

    +

    KW  (AE, AD, AES-128, AES-192, AES-256, FWD, 128, 256, 192, 320, 2048)

    +

    AES validation number 3497

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507

    Version 10.0.10240

    -

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#3497

    +

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 3497

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498

    Version 10.0.10240

    -

    ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC(Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    -IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
    -GMAC_Supported

    -

    XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

    +

    ECB (e/d; 128, 192, 256); CBC (e/d; 128, 192, 256); CFB8 (e/d; 128, 192, 256); CFB128 (e/d; 128, 192, 256); CTR (int only; 128, 192, 256)

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC(Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    +(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    +IV Generated:  (Externally); PT Lengths Tested:  (0, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 1024, 8, 1016); IV Lengths Tested:  (0, 0); 96 bit IV supported
    +GMAC supported

    +

    XTS((KS: XTS_128((e/d)(f)) KS: XTS_256((e/d)(f))

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
    Version 10.0.10240 -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

     

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
    Version 10.0.10240 -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

     

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853

    Version 6.3.9600

    -

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#2832

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BitLocker� Cryptographic Implementations #2848

    +

    CCM (KS: 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 2832

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 BitLocker Cryptographic Implementations #2848

    Version 6.3.9600

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 0 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

    -

    GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

    -

    (KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

    -

    IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 8 , 1024 ) ; 96BitIV_Supported ;
    -OtherIVLen_Supported
    -GMAC_Supported

    -

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 0 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 192; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16) (KS: 256; Block Size(s): Full/Partial; Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 0 Max: 16)

    +

    GCM (KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)

    +

    (KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)

    +

    IV Generated:  (Externally); PT Lengths Tested:  (0, 128, 1024, 8, 1016); Additional authenticated data lengths tested:  (0, 128, 1024, 8, 1016); IV Lengths Tested:  (8, 1024); 96 bit IV supported;
    +OtherIVLen_Supported
    +GMAC supported

    +

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

    Version 6.3.9600

    -

    CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
    -AES Val#2197

    -

    CMAC (Generation/Verification ) (KS: 128; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
    -AES Val#2197

    -

    GCM(KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
    -(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
    -IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported
    -GMAC_Supported

    +

    CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0-0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)
    +AES validation number 2197

    +

    CMAC (Generation/Verification) (KS: 128; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 192; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16) (KS: 256; Block Size(s); Msg Len(s) Min: 0 Max: 2^16; Tag Len(s) Min: 16 Max: 16)
    +AES validation number 2197

    +

    GCM(KS: AES_128(e/d) Tag Length(s): 128 120 112 104 96) (KS: AES_192(e/d) Tag Length(s): 128 120 112 104 96)
    +(KS: AES_256(e/d) Tag Length(s): 128 120 112 104 96)
    +IV Generated: (Externally); PT Lengths Tested: (0, 128, 1024, 8, 1016); Additional authenticated data lengths tested: (0, 128, 1024, 8, 1016); IV Lengths Tested: (8, 1024); 96 bit IV supported
    +GMAC supported

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216 -

    CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

    -

    AES Val#2196

    +

    CCM (KS: 256) (Assoc. Data Len Range: 0 - 0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 12 (Tag Length(s): 16)

    +

    AES validation number 2196

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198 -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    -

    CFB128 ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    +

    CFB128 (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197 -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

     

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196 -CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 – 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
    -AES Val#1168 +CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0 – 0, 2^16) (Payload Length Range: 0 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)
    +AES validation number 1168

    Windows Server 2008 R2 and SP1 CNG algorithms #1187

    Windows 7 Ultimate and SP1 CNG algorithms #1178

    -CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )
    -AES Val#1168 +CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16)
    +AES validation number 1168 Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177 -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

     

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 -

    GCM

    -

    GMAC

    -Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 , vendor-affirmed +

    GCM

    +

    GMAC

    +Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168, vendor-affirmed -CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 ) +CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16) Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760 -CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 1 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 ) +CCM (KS: 128, 192, 256) (Assoc. Data Len Range: 0 - 0, 2^16) (Payload Length Range: 1 - 32 (Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16)

    Windows Server 2008 CNG algorithms #757

    Windows Vista Ultimate SP1 CNG algorithms #756

    -

    CBC ( e/d; 128 , 256 );

    -

    CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )

    +

    CBC (e/d; 128, 256);

    +

    CCM (KS: 128, 256) (Assoc. Data Len Range: 0 - 8) (Payload Length Range: 4 - 32 (Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16)

    Windows Vista Ultimate BitLocker Drive Encryption #715

    Windows Vista Ultimate BitLocker Drive Encryption #424

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CFB8 ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CFB8 (e/d; 128, 192, 256);

    Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739

    Windows Vista Symmetric Algorithm Implementation #553

    -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    -

    CTR ( int only; 128 , 192 , 256 )

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    +

    CTR (int only; 128, 192, 256)

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023 -

    ECB ( e/d; 128 , 192 , 256 );

    -

    CBC ( e/d; 128 , 192 , 256 );

    +

    ECB (e/d; 128, 192, 256);

    +

    CBC (e/d; 128, 192, 256);

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781

    @@ -2848,7 +3003,7 @@ AES -Modes / States / Key Sizes -Algorithm Implementation and Certificate # +Modes / States / Key Sizes +Algorithm Implementation and Certificate #
      @@ -2883,7 +3038,7 @@ Deterministic Random Bit Generator (DRBG)

    Prerequisite: AES #4903

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

    Version 10.0.16299

    @@ -2922,78 +3077,78 @@ Deterministic Random Bit Generator (DRBG)

    Prerequisite: AES #4897

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

    Version 10.0.16299

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4627 ) ] +CTR_DRBG: [Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4627)]

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556

    Version 10.0.15063

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4624 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 4624)]

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555

    Version 10.0.15063

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4434 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4434)]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433

    Version 7.00.2872

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4433 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4433)]

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432

    Version 8.00.6246

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4431 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4431)]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430

    Version 7.00.2872

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4430 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4430)]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429

    Version 8.00.6246

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4074 ) ] -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

    +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 4074)] +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

    Version 10.0.14393

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4064 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 4064)]

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217

    Version 10.0.14393

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3629 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 3629)]

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955

    Version 10.0.10586

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3497 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 3497)]

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868

    Version 10.0.10240

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2832 ) ] -

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

    +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 2832)] +

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

    Version 6.3.9600

    -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2197 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: (AES-256) (AES validation number 2197)] Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258 -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#2023 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 2023)] Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193 -CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#1168 ) ] +CTR_DRBG:[Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: (AES-256) (AES validation number 1168)] Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23 -DRBG (SP 800–90) +DRBG (SP 800–90) Windows Vista Ultimate SP1, vendor-affirmed @@ -3009,8 +3164,8 @@ Deterministic Random Bit Generator (DRBG) -Modes / States / Key Sizes -Algorithm Implementation and Certificate # +Modes / States / Key Sizes +Algorithm Implementation and Certificate #
      @@ -3125,219 +3280,219 @@ Deterministic Random Bit Generator (DRBG)

    Prerequisite: SHS #4009, DRBG #1730

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

    Version 10.0.16299

    -

    FIPS186-4:

    -

    PQG(gen)PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    KeyPairGen:   [ (2048,256) ; (3072,256) ]

    -

    SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]

    -

    SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val#3790

    -

    DRBG: Val# 1555

    +

    FIPS186-4:

    +

    PQG(gen)PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)]

    +

    PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    KeyPairGen:   [(2048,256); (3072,256)]

    +

    SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 3790

    +

    DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223

    Version 10.0.15063

    -FIPS186-4:
    -PQG(ver)PARMS TESTED:
      [ (1024,160) SHA( 1 ); ]
    -SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
    -SHS: Val# 3649 +FIPS186-4:
    +PQG(ver)PARMS TESTED:
      [(1024,160) SHA(1)]
    +SIG(ver)PARMS TESTED:   [(1024,160) SHA(1)]
    +SHS: validation number 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188

    Version 7.00.2872

    -FIPS186-4:
    -PQG(ver)PARMS TESTED:
      [ (1024,160) SHA( 1 ); ]
    -SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
    -SHS: Val#3648 +FIPS186-4:
    +PQG(ver)PARMS TESTED:
      [(1024,160) SHA(1)]
    +SIG(ver)PARMS TESTED:   [(1024,160) SHA(1)]
    +SHS: validation number 3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187

    Version 8.00.6246

    -

    FIPS186-4:
    -PQG(gen)
    PARMS TESTED: [
    -(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    -PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    -KeyPairGen:    [ (2048,256) ; (3072,256) ]
    -SIG(gen)PARMS TESTED:   [ (2048,256)
    -SHA( 256 ); (3072,256) SHA( 256 ); ]
    -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val# 3347
    -DRBG: Val# 1217

    +

    FIPS186-4:
    +PQG(gen)
    PARMS TESTED: [
    +(2048,256)SHA(256); (3072,256) SHA(256)]
    +PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +KeyPairGen:    [(2048,256); (3072,256)]
    +SIG(gen)PARMS TESTED:   [(2048,256)
    +SHA(256); (3072,256) SHA(256)]
    +SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 3347
    +DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098

    Version 10.0.14393

    -

    FIPS186-4:
    -PQG(gen)
    PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ] PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 )]
    -KeyPairGen:    [ (2048,256) ; (3072,256) ] SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val# 3047
    -DRBG: Val# 955

    +

    FIPS186-4:
    +PQG(gen)
    PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)] PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +KeyPairGen:    [(2048,256); (3072,256)] SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 3047
    +DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024

    Version 10.0.10586

    -

    FIPS186-4:
    -PQG(gen)
    PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    -PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    -KeyPairGen:    [ (2048,256) ; (3072,256) ]
    -SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ] SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val# 2886
    -DRBG: Val# 868

    +

    FIPS186-4:
    +PQG(gen)
    PARMS TESTED:   [(2048,256)SHA(256); (3072,256) SHA(256)]
    +PQG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +KeyPairGen:    [(2048,256); (3072,256)]
    +SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)] SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 2886
    +DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983

    Version 10.0.10240

    -

    FIPS186-4:
    -PQG(gen)
    PARMS TESTED:   [
    -(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    -PQG(ver)PARMS TESTED:   [ (2048,256)
    -SHA( 256 ); (3072,256) SHA( 256 ) ]
    -KeyPairGen:    [ (2048,256) ; (3072,256) ]
    -SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    -SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

    -

    SHS: Val# 2373
    -DRBG: Val# 489

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

    +

    FIPS186-4:
    +PQG(gen)
    PARMS TESTED:   [
    +(2048,256)SHA(256); (3072,256) SHA(256)]
    +PQG(ver)PARMS TESTED:   [(2048,256)
    +SHA(256); (3072,256) SHA(256)]
    +KeyPairGen:    [(2048,256); (3072,256)]
    +SIG(gen)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SIG(ver)PARMS TESTED:   [(2048,256) SHA(256); (3072,256) SHA(256)]

    +

    SHS: validation number 2373
    +DRBG: validation number 489

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

    Version 6.3.9600

    -

    FIPS186-2:
    -PQG(ver) MOD(1024);
    -SIG(ver) MOD(1024);
    +

    FIPS186-2:
    +PQG(ver) MOD(1024);
    +SIG(ver) MOD(1024);
    SHS: #1903
    DRBG: #258

    -

    FIPS186-4:
    -PQG(gen)PARMS TESTED
    : [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
    -PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    -SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
    -SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
    +

    FIPS186-4:
    +PQG(gen)PARMS TESTED
    : [(2048,256)SHA(256); (3072,256) SHA(256)]
    +PQG(ver)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SIG(gen)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    +SIG(ver)PARMS TESTED: [(2048,256) SHA(256); (3072,256) SHA(256)]
    SHS: #1903
    DRBG: #258
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#687.

    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 687.

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687 -FIPS186-2:
    -PQG(ver)
    MOD(1024);
    -SIG(ver) MOD(1024);
    +FIPS186-2:
    +PQG(ver)
    MOD(1024);
    +SIG(ver) MOD(1024);
    SHS: #1902
    DRBG: #258
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#686. +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 686. Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686 -FIPS186-2:
    -SIG(ver)
    MOD(1024);
    -SHS: Val# 1773
    -DRBG: Val# 193
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#645. +FIPS186-2:
    +SIG(ver)
    MOD(1024);
    +SHS: validation number 1773
    +DRBG: validation number 193
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 645. Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645 -FIPS186-2:
    -SIG(ver)
    MOD(1024);
    -SHS: Val# 1081
    -DRBG: Val# 23
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#391. See Historical DSA List Val#386. +FIPS186-2:
    +SIG(ver)
    MOD(1024);
    +SHS: validation number 1081
    +DRBG: validation number 23
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 391. See Historical DSA List validation number 386.

    Windows Server 2008 R2 and SP1 CNG algorithms #391

    Windows 7 Ultimate and SP1 CNG algorithms #386

    -FIPS186-2:
    -SIG(ver)
    MOD(1024);
    -SHS: Val# 1081
    -RNG: Val# 649
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#390. See Historical DSA List Val#385. +FIPS186-2:
    +SIG(ver)
    MOD(1024);
    +SHS: validation number 1081
    +RNG: validation number 649
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 390. See Historical DSA List validation number 385.

    Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390

    Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385

    -FIPS186-2:
    -SIG(ver)
    MOD(1024);
    -SHS: Val# 753
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#284. See Historical DSA List Val#283. +FIPS186-2:
    +SIG(ver)
    MOD(1024);
    +SHS: validation number 753
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 284. See Historical DSA List validation number 283.

    Windows Server 2008 CNG algorithms #284

    Windows Vista Ultimate SP1 CNG algorithms #283

    -FIPS186-2:
    -SIG(ver)
    MOD(1024);
    -SHS: Val# 753
    -RNG: Val# 435
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#282. See Historical DSA List Val#281. +FIPS186-2:
    +SIG(ver)
    MOD(1024);
    +SHS: validation number 753
    +RNG: validation number 435
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 282. See Historical DSA List validation number 281.

    Windows Server 2008 Enhanced DSS (DSSENH) #282

    Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281

    -FIPS186-2:
    -SIG(ver)
    MOD(1024);
    -SHS: Val# 618
    -RNG: Val# 321
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#227. See Historical DSA List Val#226. +FIPS186-2:
    +SIG(ver)
    MOD(1024);
    +SHS: validation number 618
    +RNG: validation number 321
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 227. See Historical DSA List validation number 226.

    Windows Vista CNG algorithms #227

    Windows Vista Enhanced DSS (DSSENH) #226

    -FIPS186-2:
    -SIG(ver)
    MOD(1024);
    -SHS: Val# 784
    -RNG: Val# 448
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#292. +FIPS186-2:
    +SIG(ver)
    MOD(1024);
    +SHS: validation number 784
    +RNG: validation number 448
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 292. Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292 -FIPS186-2:
    -SIG(ver)
    MOD(1024);
    -SHS: Val# 783
    -RNG: Val# 447
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#291. +FIPS186-2:
    +SIG(ver)
    MOD(1024);
    +SHS: validation number 783
    +RNG: validation number 447
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical DSA List validation number 291. Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291 -FIPS186-2:
    -PQG(gen)
    MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: Val# 611
    -RNG: Val# 314 +FIPS186-2:
    +PQG(gen)
    MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: validation number 611
    +RNG: validation number 314 Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221 -FIPS186-2:
    -PQG(gen)
    MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: Val# 385 +FIPS186-2:
    +PQG(gen)
    MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: validation number 385 Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146 -FIPS186-2:
    -PQG(ver)
    MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    -SIG(ver) MOD(1024);
    -SHS: Val# 181
    +FIPS186-2:
    +PQG(ver)
    MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    +SIG(ver) MOD(1024);
    +SHS: validation number 181

    Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95 -FIPS186-2:
    -PQG(gen)
    MOD(1024);
    -PQG(ver) MOD(1024);
    -KEYGEN(Y) MOD(1024);
    -SIG(gen) MOD(1024);
    +FIPS186-2:
    +PQG(gen)
    MOD(1024);
    +PQG(ver) MOD(1024);
    +KEYGEN(Y) MOD(1024);
    +SIG(gen) MOD(1024);
    SHS: SHA-1 (BYTE)
    -SIG(ver) MOD(1024);
    +SIG(ver) MOD(1024);
    SHS: SHA-1 (BYTE)

    Windows 2000 DSSENH.DLL #29

    Windows 2000 DSSBASE.DLL #28

    @@ -3345,12 +3500,12 @@ SHS: SHA-1 (BYTE)

    Windows NT 4 SP6 DSSBASE.DLL #25

    -

    FIPS186-2: PRIME;
    -FIPS186-2:

    -

    KEYGEN(Y):
    +

    FIPS186-2: PRIME;
    +FIPS186-2:

    +

    KEYGEN(Y):
    SHS: SHA-1 (BYTE)

    -

    SIG(gen):
    -SIG(ver)
    MOD(1024);
    +

    SIG(gen):
    +SIG(ver)
    MOD(1024);
    SHS: SHA-1 (BYTE)

    Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17 @@ -3367,8 +3522,8 @@ SHS: SHA-1 (BYTE)

    -Modes / States / Key Sizes -Algorithm Implementation and Certificate # +Modes / States / Key Sizes +Algorithm Implementation and Certificate #
      @@ -3401,7 +3556,7 @@ SHS: SHA-1 (BYTE)

    Prerequisite: SHS #2373, DRBG #489

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

    Version 6.3.9600

    @@ -3437,7 +3592,7 @@ SHS: SHA-1 (BYTE)

    Prerequisite: SHS #4009, DRBG #1733

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

    Version 10.0.16299

    @@ -3607,7 +3762,7 @@ SHS: SHA-1 (BYTE)

    Prerequisite: SHS #4009, DRBG #1730

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

    Version 10.0.16299

    @@ -3641,178 +3796,178 @@ SHS: SHA-1 (BYTE)

    Prerequisite: SHS #4009, DRBG #1730

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

    Version 10.0.16299

    -FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 TestingCandidates )
    -SHS: Val#3790
    -DRBG: Val# 1555 +FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 TestingCandidates)
    +SHS: validation number 3790
    +DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136

    Version 10.0.15063

    -FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    -SHS: Val#3790
    -DRBG: Val# 1555 +FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    +SHS: validation number 3790
    +DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135

    Version 10.0.15063

    -FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    -SHS: Val#3790
    -DRBG: Val# 1555 +FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    +SHS: validation number 3790
    +DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133

    Version 10.0.15063

    -FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
    -SHS:Val# 3649
    -DRBG:Val# 1430 +FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512))
    +SHS:validation number 3649
    +DRBG:validation number 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073

    Version 7.00.2872

    -FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
    -SHS:Val#3648
    -DRBG:Val# 1429 +FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512))
    +SHS:validation number 3648
    +DRBG:validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072

    Version 8.00.6246

    -

    FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 TestingCandidates )
    -PKV: CURVES( P-256 P-384 )
    -SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) )

    -

    SHS: Val# 3347
    -DRBG: Val# 1222

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

    +

    FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 TestingCandidates)
    +PKV: CURVES(P-256 P-384)
    +SigGen: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SigVer: CURVES(P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384))

    +

    SHS: validation number 3347
    +DRBG: validation number 1222

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

    Version 10.0.14393

    -

    FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -PKV: CURVES( P-256 P-384 P-521 )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    -

    SHS: Val# 3347
    -DRBG: Val# 1217

    +

    FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +PKV: CURVES(P-256 P-384 P-521)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    +

    SHS: validation number 3347
    +DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911

    Version 10.0.14393

    -

    FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    -

    SHS: Val# 3047
    -DRBG: Val# 955

    +

    FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    +

    SHS: validation number 3047
    +DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760

    Version 10.0.10586

    -

    FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    -

    SHS: Val# 2886
    -DRBG: Val# 868

    +

    FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    +

    SHS: validation number 2886
    +DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706

    Version 10.0.10240

    -

    FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

    -

    SHS: Val#2373
    -DRBG: Val# 489

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

    +

    FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))

    +

    SHS: validation number 2373
    +DRBG: validation number 489

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

    Version 6.3.9600

    -

    FIPS186-2:
    -PKG: CURVES
    ( P-256 P-384 P-521 )
    -SHS: #1903
    -DRBG: #258
    -SIG(ver):CURVES( P-256 P-384 P-521 )
    -SHS: #1903
    -DRBG: #258

    -

    FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    -SHS: #1903
    -DRBG: #258
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#341.

    +

    FIPS186-2:
    +PKG: CURVES
    (P-256 P-384 P-521)
    +SHS: #1903
    +DRBG: #258
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: #1903
    +DRBG: #258

    +

    FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    +SHS: #1903
    +DRBG: #258
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 341.

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341 -

    FIPS186-2:
    -PKG: CURVES
    ( P-256 P-384 P-521 )
    -SHS: Val#1773
    -DRBG: Val# 193
    -SIG(ver): CURVES( P-256 P-384 P-521 )
    -SHS: Val#1773
    -DRBG: Val# 193

    -

    FIPS186-4:
    -PKG: CURVES
    ( P-256 P-384 P-521 ExtraRandomBits )
    -SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    -SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
    -SHS: Val#1773
    -DRBG: Val# 193
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#295.

    +

    FIPS186-2:
    +PKG: CURVES
    (P-256 P-384 P-521)
    +SHS: validation number 1773
    +DRBG: validation number 193
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: validation number 1773
    +DRBG: validation number 193

    +

    FIPS186-4:
    +PKG: CURVES
    (P-256 P-384 P-521 ExtraRandomBits)
    +SigGen: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
    +SigVer: CURVES(P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512))
    +SHS: validation number 1773
    +DRBG: validation number 193
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 295.

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295 -FIPS186-2:
    -PKG: CURVES
    ( P-256 P-384 P-521 )
    -SHS: Val#1081
    -DRBG: Val# 23
    -SIG(ver): CURVES( P-256 P-384 P-521 )
    -SHS: Val#1081
    -DRBG: Val# 23
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#142. See Historical ECDSA List Val#141. +FIPS186-2:
    +PKG: CURVES
    (P-256 P-384 P-521)
    +SHS: validation number 1081
    +DRBG: validation number 23
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: validation number 1081
    +DRBG: validation number 23
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 142. See Historical ECDSA List validation number 141.

    Windows Server 2008 R2 and SP1 CNG algorithms #142

    Windows 7 Ultimate and SP1 CNG algorithms #141

    -FIPS186-2:
    -PKG: CURVES
    ( P-256 P-384 P-521 )
    -SHS: Val#753
    -SIG(ver): CURVES( P-256 P-384 P-521 )
    -SHS: Val#753
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#83. See Historical ECDSA List Val#82. +FIPS186-2:
    +PKG: CURVES
    (P-256 P-384 P-521)
    +SHS: validation number 753
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: validation number 753
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 83. See Historical ECDSA List validation number 82.

    Windows Server 2008 CNG algorithms #83

    Windows Vista Ultimate SP1 CNG algorithms #82

    -FIPS186-2:
    -PKG: CURVES
    ( P-256 P-384 P-521 )
    -SHS: Val#618
    -RNG: Val# 321
    -SIG(ver): CURVES( P-256 P-384 P-521 )
    -SHS: Val#618
    -RNG: Val# 321
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#60. +FIPS186-2:
    +PKG: CURVES
    (P-256 P-384 P-521)
    +SHS: validation number 618
    +RNG: validation number 321
    +SIG(ver): CURVES(P-256 P-384 P-521)
    +SHS: validation number 618
    +RNG: validation number 321
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical ECDSA List validation number 60. Windows Vista CNG algorithms #60 @@ -3828,8 +3983,8 @@ Some of the previously validated components for this validation have been remove -Modes / States / Key Sizes -Algorithm Implementation and Certificate # +Modes / States / Key Sizes +Algorithm Implementation and Certificate #
      @@ -3878,7 +4033,7 @@ Some of the previously validated components for this validation have been remove

    Prerequisite: SHS #4009

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

    Version 10.0.16299

    @@ -3971,269 +4126,269 @@ Some of the previously validated components for this validation have been remove

    Prerequisite: SHS #4009

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

    Version 10.0.16299

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062

    Version 10.0.15063

    -

    HMAC-SHA1(Key Sizes Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

    +

    HMAC-SHA1(Key Sizes Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061

    Version 10.0.15063

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3652

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3652

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3652

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3652

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3652

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946

    Version 7.00.2872

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3651

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3651

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3651

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3651

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3651

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945

    Version 8.00.6246

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3649

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal# 3649

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3649

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3649

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3649

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3649

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943

    Version 7.00.2872

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3648

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3648

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3648

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3648

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3648

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 3648

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942

    Version 8.00.6246

    -

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    -SHS Val# 3347

    -

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3347

    -

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3347

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

    +

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    +SHS validation number 3347

    +

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3347

    +

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3347

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

    Version 10.0.14393

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3347

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 3347

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651

    Version 10.0.14393

    -

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    -SHS Val# 3047

    -

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3047

    -

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3047

    -

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    -SHS Val# 3047

    +

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    +SHS validation number 3047

    +

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3047

    +

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3047

    +

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381

    Version 10.0.10586

    -

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    -SHSVal# 2886

    -

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    -SHSVal# 2886

    -

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    - SHSVal# 2886

    -

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    -SHSVal# 2886

    +

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    +SHSvalidation number 2886

    +

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    +SHSvalidation number 2886

    +

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    + SHSvalidation number 2886

    +

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    +SHSvalidation number 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233

    Version 10.0.10240

    -

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
    -SHS Val#2373

    -

    HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
    -SHS Val#2373

    -

    HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
    -SHS Val#2373

    -

    HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
    -SHS Val#2373

    -

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

    +

    HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS)
    +SHS validation number 2373

    +

    HMAC-SHA256 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 2373

    +

    HMAC-SHA384 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 2373

    +

    HMAC-SHA512 (Key Size Ranges Tested:  KSBS)
    +SHS validation number 2373

    +

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

    Version 6.3.9600

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#2764

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS validation number 2764

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS validation number 2764

    Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122

    Version 5.2.29344

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KS#1902

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

    +

    HMAC-SHA256 (Key Size Ranges Tested: KS#1902

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS#1902

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS#1902

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS#1902

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS#1902

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHS#1902

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHS#1902

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHS#1902

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHS#1902

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )

    -

    SHS#1903

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS )

    -

    SHS#1903

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS )

    -

    SHS#1903

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS )

    -

    SHS#1903

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS)

    +

    SHS#1903

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS)

    +

    SHS#1903

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS)

    +

    SHS#1903

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS)

    +

    SHS#1903

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1773

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    -

    Tinker HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1773

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    +

    Tinker HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1773

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1774

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1774

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1774

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1081

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 1081

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 1081

    Windows Server 2008 R2 and SP1 CNG algorithms #686

    Windows 7 and SP1 CNG algorithms #677

    Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687

    Windows 7 Enhanced Cryptographic Provider (RSAENH) #673

    -

    HMAC-SHA1(Key Sizes Ranges Tested: KSVal#1081

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#1081

    +

    HMAC-SHA1(Key Sizes Ranges Tested: KSvalidation number 1081

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 1081

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#816

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#816

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 816

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 816

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#753

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#753

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 753

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 753

    Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS )SHS Val#753

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS)SHS validation number 753

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408

    Windows Vista Enhanced Cryptographic Provider (RSAENH) #407

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )SHSVal#618

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS)SHSvalidation number 618

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    Windows Vista Enhanced Cryptographic Provider (RSAENH) #297 -HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#785 +HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 785

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429

    Windows XP, vendor-affirmed

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#783

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#783

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 783

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 783

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#613

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#613

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 613

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 613

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289 -HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#610 +HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 610 Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#753

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 753

    Windows Server 2008 CNG algorithms #413

    Windows Vista Ultimate SP1 CNG algorithms #412

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#737

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#737

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 737

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 737

    Windows Vista Ultimate BitLocker Drive Encryption #386 -

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 618

    Windows Vista CNG algorithms #298 -

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#589

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS )SHSVal#589

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#589

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#589

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 589

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS)SHSvalidation number 589

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 589

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 589

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267 -

    HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#578

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#578

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 578

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 578

    Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260 -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#495

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSVal#495

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSvalidation number 495

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSvalidation number 495

    Windows Vista BitLocker Drive Encryption #199 -HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#364 +HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 364

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99

    Windows XP, vendor-affirmed

    -

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#305

    -

    HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    -

    HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    -

    HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#305

    +

    HMAC-SHA1 (Key Sizes Ranges Tested: KSBS) SHSvalidation number 305

    +

    HMAC-SHA256 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    +

    HMAC-SHA384 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    +

    HMAC-SHA512 (Key Size Ranges Tested: KSBS) SHSvalidation number 305

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31 @@ -4249,8 +4404,8 @@ SHS -Modes / States / Key Sizes -Algorithm Implementation and Certificate # +Modes / States / Key Sizes +Algorithm Implementation and Certificate #
      @@ -4317,7 +4472,7 @@ SHS #4009, ECDSA #1252, DRBG #1733

      -

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

      +

      Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

      Version 10.0.16299

      @@ -4353,7 +4508,7 @@ SHS
    -
  • One Pass DH:
  • +
  • One-Pass DH:
  • Prerequisite: SHS #4009, DSA #1301, DRBG #1730

    -

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

    Version 10.0.16299

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration ) SCHEMES [ FullUnified ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ]

    -

    SHS Val#3790
    -DSA Val#1135
    -DRBG Val#1556

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration) SCHEMES [FullUnified (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC)]

    +

    SHS validation number 3790
    +DSA validation number 1135
    +DRBG validation number 1556

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128

    Version 10.0.15063

    -

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    -SHS Val#3790
    -DSA Val#1223
    -DRBG Val#1555

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (FB: SHA256) (FC: SHA256)] [dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB: SHA256 HMAC) (FC: SHA256   HMAC)]
    +SHS validation number 3790
    +DSA validation number 1223
    +DRBG validation number 1555

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]

    -SHS Val#3790
    -ECDSA Val#1133
    -DRBG Val#1555

    +SHS validation number 3790
    +ECDSA validation number 1133
    +DRBG validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127

    Version 10.0.15063

    -

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    -SHS Val# 3649
    -DSA Val#1188
    -DRBG Val#1430

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    +

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB: SHA256) (FC: SHA256)] [dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB: SHA256 HMAC) (FC: SHA256   HMAC)]
    +SHS validation number 3649
    +DSA validation number 1188
    +DRBG validation number 1430

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115

    Version 7.00.2872

    -

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhHybridOneFlow ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    -[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
    -SHS Val#3648
    -DSA Val#1187
    -DRBG Val#1429

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    +

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhHybridOneFlow (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB:SHA256 HMAC) (FC: SHA256   HMAC)]
    +[dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FB:SHA256 HMAC) (FC: SHA256   HMAC)]
    +SHS validation number 3648
    +DSA validation number 1187
    +DRBG validation number 1429

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES [EphemeralUnified (No_KC) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256   SHA256   HMAC) (ED: P-384   SHA384   HMAC) (EE: P-521   HMAC (SHA512, HMAC_SHA512))]

    -SHS Val#3648
    -ECDSA Val#1072
    -DRBG Val#1429

    +SHS validation number 3648
    +ECDSA validation number 1072
    +DRBG validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114

    Version 8.00.6246

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration )
    -SCHEMES  [ FullUnified  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ]

    -

    SHS Val# 3347 ECDSA Val#920 DRBG Val#1222

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration)
    +SCHEMES  [FullUnified  (No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC)]

    +

    SHS validation number 3347 ECDSA validation number 920 DRBG validation number 1222

    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

    Version 10.0.14393

    -

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation )
    -SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    -

    SHS Val# 3347 DSA Val#1098 DRBG Val#1217

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    -

    SHS Val# 3347 DSA Val#1098 ECDSA Val#911 DRBG Val#1217 HMAC Val#2651

    +

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation)
    +SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    +

    SHS validation number 3347 DSA validation number 1098 DRBG validation number 1217

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    +

    SHS validation number 3347 DSA validation number 1098 ECDSA validation number 911 DRBG validation number 1217 HMAC validation number 2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92

    Version 10.0.14393

    -

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    -

    SHS Val# 3047 DSA Val#1024 DRBG Val#955

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    -

    SHS Val# 3047 ECDSA Val#760 DRBG Val#955

    +

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    +

    SHS validation number 3047 DSA validation number 1024 DRBG validation number 955

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    +

    SHS validation number 3047 ECDSA validation number 760 DRBG validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72

    Version 10.0.10586

    -

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    -

    SHS Val# 2886 DSA Val#983 DRBG Val#868

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    -

    SHS Val# 2886 ECDSA Val#706 DRBG Val#868

    +

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    +

    SHS validation number 2886 DSA validation number 983 DRBG validation number 868

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    +

    SHS validation number 2886 ECDSA validation number 706 DRBG validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64

    Version 10.0.10240

    -

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
    -( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

    -

    SHS Val#2373 DSA Val#855 DRBG Val#489

    -

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
    -[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

    -

    SHS Val#2373 ECDSA Val#505 DRBG Val#489

    -

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

    +

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation) SCHEMES  [dhEphem  (KARole(s): Initiator / Responder)
    +(FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FB:  SHA256) (FC:  SHA256)] [dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (FB:  SHA256 HMAC) (FC:  SHA256   HMAC)]

    +

    SHS validation number 2373 DSA validation number 855 DRBG validation number 489

    +

    ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration) SCHEMES  [EphemeralUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH  (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]
    +[StaticUnified (No_KC  &lt; KARole(s): Initiator / Responder &gt;) (EC:  P-256   SHA256   HMAC) (ED:  P-384   SHA384   HMAC) (EE:  P-521   HMAC (SHA512, HMAC_SHA512))]

    +

    SHS validation number 2373 ECDSA validation number 505 DRBG validation number 489

    +

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

    Version 6.3.9600

    -

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
    -( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
    -[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FA: SHA256 HMAC ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
    -SHS #1903 DSA Val#687 DRBG #258

    -

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
    -[ OnePassDH( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 ) ( ED: P-384 SHA384 ) ( EE: P-521 (SHA512, HMAC_SHA512) ) ) ]
    -[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
    +

    FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation) SCHEMES [dhEphem (KARole(s): Initiator / Responder)
    +(FA: SHA256) (FB: SHA256) (FC: SHA256)]
    +[dhOneFlow (KARole(s): Initiator / Responder) (FA: SHA256) (FB: SHA256) (FC: SHA256)]
    +[dhStatic (No_KC &lt; KARole(s): Initiator / Responder&gt;) (FA: SHA256 HMAC) (FB: SHA256 HMAC) (FC: SHA256 HMAC)]
    +SHS #1903 DSA validation number 687 DRBG #258

    +

    ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration) SCHEMES [EphemeralUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256 HMAC) (ED: P-384 SHA384 HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512)))]
    +[OnePassDH(No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256) (ED: P-384 SHA384) (EE: P-521 (SHA512, HMAC_SHA512)))]
    +[StaticUnified (No_KC &lt; KARole(s): Initiator / Responder&gt;) (EC: P-256 SHA256 HMAC) (ED: P-384 SHA384 HMAC) (EE: P-521 HMAC (SHA512, HMAC_SHA512))]

    -SHS #1903 ECDSA Val#341 DRBG #258

    +SHS #1903 ECDSA validation number 341 DRBG #258

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36 -

    KAS (SP 800–56A)

    +

    KAS (SP 800–56A)

    key agreement

    -

    key establishment methodology provides 80 to 256 bits of encryption strength

    +

    key establishment methodology provides 80 bits to 256 bits of encryption strength

    Windows 7 and SP1, vendor-affirmed

    Windows Server 2008 R2 and SP1, vendor-affirmed

    @@ -4914,8 +5069,8 @@ SP 800-108 Key-Based Key Derivation Functions (KBKDF) - - + + - @@ -5009,61 +5164,61 @@ SP 800-108 Key-Based Key Derivation Functions (KBKDF)

    K prerequisite: KAS #146

    - - +KAS validation number 128
    +DRBG validation number 1556
    +MAC validation number 3062 - +KAS validation number 127
    +AES validation number 4624
    +DRBG validation number 1555
    +MAC validation number 3061 - - + - + - + - + - - + - + @@ -5079,34 +5234,34 @@ Random Number Generator (RNG) - - + + - + - + - + - + - + @@ -5132,8 +5287,8 @@ Random Number Generator (RNG) - - + + - @@ -5255,7 +5410,7 @@ Random Number Generator (RNG)

    Prerequisite: SHS #4009, DRBG #1730

    - @@ -5629,7 +5784,7 @@ Random Number Generator (RNG)

    Prerequisite: SHS #4009, DRBG #1730

    - @@ -5699,424 +5854,424 @@ Random Number Generator (RNG)

    Prerequisite: SHS #4009, DRBG #1730

    - - + - + - + - +PGM(ProbRandom: (2048, 3072) PPTT:(C.2)
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    +SHA validation number 3790 - + - + - + - + - - + - + - + - + - + - + - + - + - + - + - + - + - + - - + - + - - + - - + - +

    Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1134.

    - - + - + - + - + - + - + - + - +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 816, SHA-384validation number 816, SHA-512validation number 816,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 816, SHA-256validation number 816, SHA-384validation number 816, SHA-512validation number 816,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 395. - + - + - + - + - + - + - + - + - + - + - + - + - - - + + - - + - + - + - + - + - + - + - + - + - + - + - + - - + - - + - + - + - + - + - + - + - +

    Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176

    - + - + - - + +
  • Keying Option: 1
  • - - + - + - + - + - + - + - + - + - - + - + - + - + - + - + - + - +
    Modes / States / Key SizesAlgorithm Implementation and Certificate #Modes / States / Key SizesAlgorithm Implementation and Certificate #
      @@ -4952,7 +5107,7 @@ SP 800-108 Key-Based Key Derivation Functions (KBKDF)

    K prerequisite: DRBG #1733, KAS #149

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

    Version 10.0.16299

    CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
    +
    CTR_Mode: (Llength(Min0 Max0) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA384]) LocationCounter([BeforeFixedData]) rlength([32]))

    -KAS Val#128
    -DRBG Val#1556
    -MAC Val#3062

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141

    Version 10.0.15063

    CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
    +
    CTR_Mode: (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    -KAS Val#127
    -AES Val#4624
    -DRBG Val#1555
    -MAC Val#3061

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140

    Version 10.0.15063

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    KAS Val#93 DRBG Val#1222 MAC Val#2661

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

    +

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA384]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    KAS validation number 93 DRBG validation number 1222 MAC validation number 2661

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

    Version 10.0.14393

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    KAS Val#92 AES Val#4064 DRBG Val#1217 MAC Val#2651

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    KAS validation number 92 AES validation number 4064 DRBG validation number 1217 MAC validation number 2651

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101

    Version 10.0.14393

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    KAS Val#72 AES Val#3629 DRBG Val#955 MAC Val#2381

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    KAS validation number 72 AES validation number 3629 DRBG validation number 955 MAC validation number 2381

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72

    Version 10.0.10586

    CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    KAS Val#64 AES Val#3497 RBG Val#868 MAC Val#2233

    CTR_Mode:  (Llength(Min20 Max64) MACSupported([CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    KAS validation number 64 AES validation number 3497 RBG validation number 868 MAC validation number 2233

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66

    Version 10.0.10240

    CTR_Mode:  ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    DRBG Val#489 MAC Val#1773

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

    +

    CTR_Mode:  (Llength(Min0 Max0) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    DRBG validation number 489 MAC validation number 1773

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

    Version 6.3.9600

    CTR_Mode: ( Llength( Min0 Max4 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

    -

    DRBG #258 HMAC Val#1345

    CTR_Mode: (Llength(Min0 Max4) MACSupported([HMACSHA1] [HMACSHA256] [HMACSHA512]) LocationCounter([BeforeFixedData]) rlength([32]))

    +

    DRBG #258 HMAC validation number 1345

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3
    Modes / States / Key SizesAlgorithm Implementation and Certificate #Modes / States / Key SizesAlgorithm Implementation and Certificate #

    FIPS 186-2 General Purpose

    -

    [ (x-Original); (SHA-1) ]

    FIPS 186-2 General Purpose

    +

    [(x-Original); (SHA-1)]

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110
    FIPS 186-2
    -[ (x-Original); (SHA-1) ]
    FIPS 186-2
    +[(x-Original); (SHA-1)]

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292

    Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286

    Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66

    FIPS 186-2
    -[ (x-Change Notice); (SHA-1) ]

    -

    FIPS 186-2 General Purpose
    -[ (x-Change Notice); (SHA-1) ]

    FIPS 186-2
    +[(x-Change Notice); (SHA-1)]

    +

    FIPS 186-2 General Purpose
    +[(x-Change Notice); (SHA-1)]

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649

    Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435

    Windows Vista RNG implementation #321

    FIPS 186-2 General Purpose
    -[ (x-Change Notice); (SHA-1) ]
    FIPS 186-2 General Purpose
    +[(x-Change Notice); (SHA-1)]

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449

    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447

    @@ -5114,8 +5269,8 @@ Random Number Generator (RNG)

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313

    FIPS 186-2
    -[ (x-Change Notice); (SHA-1) ]
    FIPS 186-2
    +[(x-Change Notice); (SHA-1)]

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314

    Modes / States / Key SizesAlgorithm Implementation and Certificate #Modes / States / Key SizesAlgorithm Implementation and Certificate #

    RSA:

    @@ -5220,7 +5375,7 @@ Random Number Generator (RNG)

    Prerequisite: SHS #4009, DRBG #1733

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

    Version 10.0.16299

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
    -SHA Val#3790
    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA(1, 256, 384)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    SIG(Ver) (1024 SHA(1, 256, 384)) (2048 SHA(1, 256, 384))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48)))
    +SHA validation number 3790

    Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524

    Version 10.0.15063

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val#3790
    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523

    Version 10.0.15063

    FIPS186-4:
    -186-4KEY(gen):
    FIPS186-4_Fixed_e ( 10001 ) ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    -SHA Val#3790
    -DRBG: Val# 1555
    FIPS186-4:
    +186-4KEY(gen):
    FIPS186-4_Fixed_e (10001);
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    +SHA validation number 3790
    +DRBG: validation number 1555

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522

    Version 10.0.15063

    FIPS186-4:
    +
    FIPS186-4:
    186-4KEY(gen):
    -PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    -SHA Val#3790

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521

    Version 10.0.15063

    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652, SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652

    -

    FIPS186-4:
    -ALG[ANSIX9.31]
    Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
    -SIG(gen) with SHA-1 affirmed for use with protocols only.
    Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val#3652

    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3652
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096, SHS: SHA-256validation number 3652, SHA-384validation number 3652, SHA-512validation number 3652
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3652, SHA-256validation number 3652, SHA-384validation number 3652, SHA-512validation number 3652

    +

    FIPS186-4:
    +ALG[ANSIX9.31]
    Sig(Gen): (2048 SHA(1)) (3072 SHA(1))
    +SIG(gen) with SHA-1 affirmed for use with protocols only.
    Sig(Ver): (1024 SHA(1)) (2048 SHA(1)) (3072 SHA(1))
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3652

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415

    Version 7.00.2872

    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651, SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651

    -

    FIPS186-4:
    -ALG[ANSIX9.31]
    Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
    -SIG(gen) with SHA-1 affirmed for use with protocols only.
    Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val#3651

    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3651
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096, SHS: SHA-256validation number 3651, SHA-384validation number 3651, SHA-512validation number 3651
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3651, SHA-256validation number 3651, SHA-384validation number 3651, SHA-512validation number 3651

    +

    FIPS186-4:
    +ALG[ANSIX9.31]
    Sig(Gen): (2048 SHA(1)) (3072 SHA(1))
    +SIG(gen) with SHA-1 affirmed for use with protocols only.
    Sig(Ver): (1024 SHA(1)) (2048 SHA(1)) (3072 SHA(1))
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3651

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414

    Version 8.00.6246

    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 4096 , SHS: SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val# 3649 , SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649

    -

    FIPS186-4:
    -186-4KEY(gen):
    FIPS186-4_Fixed_e (10001) ;
    -PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val# 3649
    -DRBG: Val# 1430

    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 4096, SHS: SHA-256validation number 3649, SHA-384validation number 3649, SHA-512validation number 3649
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3649, SHA-256validation number 3649, SHA-384validation number 3649, SHA-512validation number 3649

    +

    FIPS186-4:
    +186-4KEY(gen):
    FIPS186-4_Fixed_e (10001);
    +PGM(ProbRandom: (2048, 3072) PPTT:(C.2)
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3649
    +DRBG: validation number 1430

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412

    Version 7.00.2872

    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 4096 , SHS: SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3648, SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648

    -

    FIPS186-4:
    -186-4KEY(gen):
    FIPS186-4_Fixed_e (10001) ;
    -PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
    -ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
    -SHA Val#3648
    -DRBG: Val# 1429

    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 4096, SHS: SHA-256validation number 3648, SHA-384validation number 3648, SHA-512validation number 3648
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 3648, SHA-256validation number 3648, SHA-384validation number 3648, SHA-512validation number 3648

    +

    FIPS186-4:
    +186-4KEY(gen):
    FIPS186-4_Fixed_e (10001);
    +PGM(ProbRandom: (2048, 3072) PPTT:(C.2)
    +ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))
    +SHA validation number 3648
    +DRBG: validation number 1429

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411

    Version 8.00.6246

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
    -Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))

    -

    SHA Val# 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

    +

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA(1, 256, 384)) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +SIG(Ver) (1024 SHA(1, 256, 384)) (2048 SHA(1, 256, 384))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) SIG(gen) with SHA-1 affirmed for use with protocols only.
    +Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48)))

    +

    SHA validation number 3347

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

    Version 10.0.14393

    FIPS186-4:
    -186-4KEY(gen):
    FIPS186-4_Fixed_e ( 10001 ) ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    -

    SHA Val# 3347 DRBG: Val# 1217

    FIPS186-4:
    +186-4KEY(gen):
    FIPS186-4_Fixed_e (10001);
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    +

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195

    Version 10.0.14393

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#3346

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 3346

    soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194

    Version 10.0.14393

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val# 3347 DRBG: Val# 1217

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    +SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193

    Version 10.0.14393

    FIPS186-4:
    -[RSASSA-PSS]: Sig(Gen):
    (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    SHA Val# 3347 DRBG: Val# 1217

    FIPS186-4:
    +[RSASSA-PSS]: Sig(Gen):
    (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    SHA validation number 3347 DRBG: validation number 1217

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192

    Version 10.0.14393

    FIPS186-4:
    -186-4KEY(gen)
    :  FIPS186-4_Fixed_e ( 10001 ) ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    -

    SHA Val# 3047 DRBG: Val# 955

    FIPS186-4:
    +186-4KEY(gen)
    :  FIPS186-4_Fixed_e (10001);
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    +

    SHA validation number 3047 DRBG: validation number 955

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889

    Version 10.0.10586

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#3048

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 3048

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871

    Version 10.0.10586

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val# 3047

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    +SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888

    Version 10.0.10586

    FIPS186-4:
    -[RSASSA-PSS]: Sig(Gen)
    : (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    -Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    SHA Val# 3047

    FIPS186-4:
    +[RSASSA-PSS]: Sig(Gen)
    : (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    +Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    SHA validation number 3047

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887

    Version 10.0.10586

    FIPS186-4:
    -186-4KEY(gen):
    FIPS186-4_Fixed_e ( 10001 ) ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    -

    SHA Val# 2886 DRBG: Val# 868

    FIPS186-4:
    +186-4KEY(gen):
    FIPS186-4_Fixed_e (10001);
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    +

    SHA validation number 2886 DRBG: validation number 868

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798

    Version 10.0.10240

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#2871

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784

    Version 10.0.10240

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#2871

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 2871

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783

    Version 10.0.10240

    FIPS186-4:
    -[RSASSA-PSS]:
    Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    -Sig(Ver): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    SHA Val# 2886

    FIPS186-4:
    +[RSASSA-PSS]:
    Sig(Gen): (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    +Sig(Ver): (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    SHA validation number 2886

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802

    Version 10.0.10240

    FIPS186-4:
    -186-4KEY(gen):
    FIPS186-4_Fixed_e ;
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

    -

    SHA Val#2373 DRBG: Val# 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

    +

    FIPS186-4:
    +186-4KEY(gen):
    FIPS186-4_Fixed_e;
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)

    +

    SHA validation number 2373 DRBG: validation number 489

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#2373

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5
    ] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

    -

    SHA Val#2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

    +

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5
    ] SIG(gen) (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    +SIG(Ver) (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512))

    +

    SHA validation number 2373

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

    Version 6.3.9600

    FIPS186-4:
    -[RSASSA-PSS]:
    Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
    - Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

    -

    SHA Val#2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

    +

    FIPS186-4:
    +[RSASSA-PSS]:
    Sig(Gen): (2048 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))
    + Sig(Ver): (1024 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(62))) (2048 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64))) (3072 SHA(1 SaltLen(20), 256 SaltLen(32), 384 SaltLen(48), 512 SaltLen(64)))

    +

    SHA validation number 2373

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

    Version 6.3.9600

    FIPS186-4:
    -ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA( 256 , 384 , 512-256 )) (3072 SHA( 256 , 384 , 512-256 ))
    -SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512-256 )) (2048 SHA( 1 , 256 , 384 , 512-256 )) (3072 SHA( 1 , 256 , 384 , 512-256 ))
    -[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
    -Sig(Ver): (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 , 512 ))
    +

    FIPS186-4:
    +ALG[RSASSA-PKCS1_V1_5]
    SIG(gen) (2048 SHA(256, 384, 512-256)) (3072 SHA(256, 384, 512-256))
    +SIG(Ver) (1024 SHA(1, 256, 384, 512-256)) (2048 SHA(1, 256, 384, 512-256)) (3072 SHA(1, 256, 384, 512-256))
    +[RSASSA-PSS]: Sig(Gen): (2048 SHA(256, 384, 512)) (3072 SHA(256, 384, 512))
    +Sig(Ver): (1024 SHA(1, 256, 384, 512)) (2048 SHA(1, 256, 384, 512)) (3072 SHA(1, 256, 384, 512, 512))
    SHA #1903

    -

    Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1134.

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134
    FIPS186-4:
    -186-4KEY(gen):
    FIPS186-4_Fixed_e , FIPS186-4_Fixed_e_Value
    -PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
    +
    FIPS186-4:
    +186-4KEY(gen):
    FIPS186-4_Fixed_e, FIPS186-4_Fixed_e_Value
    +PGM(ProbPrimeCondition): 2048, 3072 PPTT:(C.3)
    SHA #1903 DRBG: #258
    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133
    FIPS186-2:
    -ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: #258
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1132.
    FIPS186-2:
    +ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: #258
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1132.
    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132
    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774, SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1052.
    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1774
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1774, SHA-384validation number 1774, SHA-512validation number 1774,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1774, SHA-256validation number 1774, SHA-384validation number 1774, SHA-512validation number 1774,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1052.
    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052
    FIPS186-2:
    -ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 193
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1773, SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1051.
    FIPS186-2:
    +ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: validation number 193
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1773, SHA-384validation number 1773, SHA-512validation number 1773,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1773, SHA-256validation number 1773, SHA-384validation number 1773, SHA-512validation number 1773,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 1051.
    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#568.
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 568.
    Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#567. See Historical RSA List Val#560.
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 567. See Historical RSA List validation number 560.

    Windows Server 2008 R2 and SP1 CNG algorithms #567

    Windows 7 and SP1 CNG algorithms #560

    FIPS186-2:
    -ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 23
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#559.
    FIPS186-2:
    +ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 DRBG: validation number 23
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 559.
    Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#557.
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 1081, SHA-256validation number 1081, SHA-384validation number 1081, SHA-512validation number 1081,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 557.
    Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557
    FIPS186-2:
    +
    FIPS186-2:
    ALG[ANSIX9.31]:
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#816, SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#395.
    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395
    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#783
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#783, SHA-384Val#783, SHA-512Val#783,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#371.
    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 783
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 783, SHA-384validation number 783, SHA-512validation number 783,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 371.
    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#358. See Historical RSA List Val#357.
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    +ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 358. See Historical RSA List validation number 357.

    Windows Server 2008 CNG algorithms #358

    Windows Vista SP1 CNG algorithms #357

    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#355. See Historical RSA List Val#354.
    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 753, SHA-256validation number 753, SHA-384validation number 753, SHA-512validation number 753,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 355. See Historical RSA List validation number 354.

    Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355

    Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354

    FIPS186-2:
    -ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#353.
    FIPS186-2:
    +ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 353.
    Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353
    FIPS186-2:
    -ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 RNG: Val# 321
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#258.
    FIPS186-2:
    +ALG[ANSIX9.31]:
    Key(gen)(MOD: 2048, 3072, 4096 PubKey Values: 65537 RNG: validation number 321
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 258.
    Windows Vista RSA key generation implementation #258
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    -ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#257.
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    +ALG[RSASSA-PSS]: SIG(gen); 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618
    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 257.
    Windows Vista CNG algorithms #257
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#255.
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:
    SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 618, SHA-256validation number 618, SHA-384validation number 618, SHA-512validation number 618,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 255.
    Windows Vista Enhanced Cryptographic Provider (RSAENH) #255
    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613, SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#245.
    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 613
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 613, SHA-384validation number 613, SHA-512validation number 613,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 613, SHA-256validation number 613, SHA-384validation number 613, SHA-512validation number 613,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 245.
    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245
    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589, SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#230.
    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 589
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 589, SHA-384validation number 589, SHA-512validation number 589,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 589, SHA-256validation number 589, SHA-384validation number 589, SHA-512validation number 589,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 230.
    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230
    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578, SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#222.
    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 578
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 578, SHA-384validation number 578, SHA-512validation number 578,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 578, SHA-256validation number 578, SHA-384validation number 578, SHA-512validation number 578,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 222.
    Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222
    FIPS186-2:
    -ALG[RSASSA-PKCS1_V1_5]:

    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#364
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#81.
    FIPS186-2:
    +ALG[RSASSA-PKCS1_V1_5]:

    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 364
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 81.
    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81
    FIPS186-2:
    -ALG[ANSIX9.31]:

    -SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305
    -ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
    -SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305, SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
    -Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#52.
    FIPS186-2:
    +ALG[ANSIX9.31]:

    +SIG(ver); 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 305
    +ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048, 3072, 4096, SHS: SHA-256validation number 305, SHA-384validation number 305, SHA-512validation number 305,
    +SIG(ver): 1024, 1536, 2048, 3072, 4096, SHS: SHA-1validation number 305, SHA-256validation number 305, SHA-384validation number 305, SHA-512validation number 305,
    +Some of the previously validated components for this validation have been removed because they're now non-compliant per the SP800-131A transition. See Historical RSA List validation number 52.
    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52

    FIPS186-2:

    -

    – PKCS#1 v1.5, signature generation and verification

    +

    FIPS186-2:

    +

    – PKCS#1 v1.5, signature generation, and verification

    – Mod sizes: 1024, 1536, 2048, 3072, 4096

    – SHS: SHA–1/256/384/512

    Windows XP, vendor-affirmed

    @@ -6135,8 +6290,8 @@ Some of the previously validated components for this validation have been remove
    Modes / States / Key SizesAlgorithm Implementation and Certificate #Modes / States / Key SizesAlgorithm Implementation and Certificate #
      @@ -6201,174 +6356,174 @@ Some of the previously validated components for this validation have been remove
    • Supports Empty Message

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

    Version 10.0.16299

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)
    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790

    Version 10.0.15063

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)
    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652

    Version 7.00.2872

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)
    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651

    Version 8.00.6246

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)
    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649

    Version 7.00.2872

    SHA-1      (BYTE-only)
    -SHA-256  (BYTE-only)
    -SHA-384  (BYTE-only)
    -SHA-512  (BYTE-only)
    SHA-1      (BYTE-only)
    +SHA-256  (BYTE-only)
    +SHA-384  (BYTE-only)
    +SHA-512  (BYTE-only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648

    Version 8.00.6246

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
    Version 10.0.14393
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
    Version 10.0.14393
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
    Version 10.0.10586
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
    Version 10.0.10586
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
    Version 10.0.10240
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
    Version 10.0.10240
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
    Version 6.3.9600
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
    +
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
    Version 6.3.9600

    SHA-1 (BYTE-only)

    -

    SHA-256 (BYTE-only)

    -

    SHA-384 (BYTE-only)

    -

    SHA-512 (BYTE-only)

    +

    SHA-1 (BYTE-only)

    +

    SHA-256 (BYTE-only)

    +

    SHA-384 (BYTE-only)

    +

    SHA-512 (BYTE-only)

    Implementation does not support zero-length (null) messages.

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

    SHA-1 (BYTE-only)SHA-1 (BYTE-only)

    Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785

    Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)
    Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753

    Windows Vista Symmetric Algorithm Implementation #618

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)

    Windows Vista BitLocker Drive Encryption #737

    Windows Vista Beta 2 BitLocker Drive Encryption #495

    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613

    Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364

    SHA-1 (BYTE-only)SHA-1 (BYTE-only)

    Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611

    Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610

    Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385

    @@ -6378,16 +6533,16 @@ Version 6.3.9600
    SHA-1 (BYTE-only)
    -SHA-256 (BYTE-only)
    -SHA-384 (BYTE-only)
    -SHA-512 (BYTE-only)
    SHA-1 (BYTE-only)
    +SHA-256 (BYTE-only)
    +SHA-384 (BYTE-only)
    +SHA-512 (BYTE-only)

    Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589

    Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578

    Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305

    SHA-1 (BYTE-only)SHA-1 (BYTE-only)

    Windows XP Microsoft Enhanced Cryptographic Provider #83

    Crypto Driver for Windows 2000 (fips.sys) #35

    Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32

    @@ -6409,8 +6564,8 @@ Version 6.3.9600
    Modes / States / Key SizesAlgorithm Implementation and Certificate #Modes / States / Key SizesAlgorithm Implementation and Certificate #
      @@ -6487,116 +6642,116 @@ Version 6.3.9600

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

    Version 10.0.16299

    TECB( KO 1 e/d, ) ; TCBC( KO 1 e/d, ) ; TCFB8( KO 1 e/d, ) ; TCFB64( KO 1 e/d, )TECB(KO 1 e/d); TCBC(KO 1 e/d); TCFB8(KO 1 e/d); TCFB64(KO 1 e/d)

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459

    Version 10.0.15063

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, )

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, )

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d)

    Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    CTR ( int only )

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    CTR (int only)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382

    Version 7.00.2872

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, )

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d)

    Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381

    Version 8.00.6246

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    TCFB8( KO 1 e/d, ) ;

    -

    TCFB64( KO 1 e/d, )

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    TCFB8(KO 1 e/d);

    +

    TCFB64(KO 1 e/d)

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227

    Version 10.0.14393

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    TCFB8( KO 1 e/d, ) ;

    -

    TCFB64( KO 1 e/d, )

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    TCFB8(KO 1 e/d);

    +

    TCFB64(KO 1 e/d)

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024

    Version 10.0.10586

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    TCFB8( KO 1 e/d, ) ;

    -

    TCFB64( KO 1 e/d, )

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    TCFB8(KO 1 e/d);

    +

    TCFB64(KO 1 e/d)

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969

    Version 10.0.10240

    TECB( KO 1 e/d, ) ;

    -

    TCBC( KO 1 e/d, ) ;

    -

    TCFB8( KO 1 e/d, ) ;

    -

    TCFB64( KO 1 e/d, )

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

    +

    TECB(KO 1 e/d);

    +

    TCBC(KO 1 e/d);

    +

    TCFB8(KO 1 e/d);

    +

    TCFB64(KO 1 e/d)

    Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

    Version 6.3.9600

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 ) ;

    -

    TCFB64( e/d; KO 1,2 )

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2);

    +

    TCFB64(e/d; KO 1, 2)

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 )

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2)

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 )

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2)

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 )

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2)

    Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 ) ;

    -

    TCFB8( e/d; KO 1,2 )

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2);

    +

    TCFB8(e/d; KO 1, 2)

    Windows Vista Symmetric Algorithm Implementation #549
    Triple DES MACTriple DES MAC

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed

    Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed

    TECB( e/d; KO 1,2 ) ;

    -

    TCBC( e/d; KO 1,2 )

    TECB(e/d; KO 1, 2);

    +

    TCBC(e/d; KO 1, 2)

    Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308

    Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307

    Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691

    @@ -6623,20 +6778,20 @@ Version 6.3.9600
    -#### SP 800-132 Password Based Key Derivation Function (PBKDF) +#### SP 800-132 Password-Based Key Derivation Function (PBKDF) + PBKDF (vendor affirmed) + PBKDF (vendor affirmed) - - + +

    Prerequisite: DRBG #489

    - @@ -6699,7 +6854,7 @@ Version 6.3.9600
  • Padding Algorithms: PKCS 1.5
  • - @@ -6709,7 +6864,7 @@ Version 6.3.9600
  • Modulus Size: 2048 (bits)
  • - @@ -6980,7 +7135,7 @@ Version 6.3.9600

    Prerequisite: DRBG #1730

    - @@ -6990,7 +7145,7 @@ Version 6.3.9600
  • Modulus Size: 2048 (bits)
  • - @@ -7001,7 +7156,7 @@ Version 6.3.9600
  • Padding Algorithms: PKCS 1.5
  • - @@ -7014,7 +7169,7 @@ Version 6.3.9600

    Prerequisite: DRBG #1730

    - @@ -7024,7 +7179,7 @@ Version 6.3.9600
  • Modulus Size: 2048 (bits)
  • - @@ -7036,7 +7191,7 @@ Version 6.3.9600
  • Padding Algorithms: PKCS 1.5
  • - @@ -7102,23 +7257,23 @@ Version 6.3.9600

    Prerequisite: SHS #4009, HMAC #3267

    - +

    ECDSA SigGen Component: CURVES(P-256 P-384 P-521)

    @@ -7131,11 +7286,11 @@ Version 10.0.15063

    Version 10.0.15063

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
    Version 10.0.15063

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
    Version 10.0.14393

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
    Version 10.0.14393

    -

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
    +

    Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
    Version 10.0.10586

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
    Version  10.0.10240

    @@ -7150,7 +7305,7 @@ Version 6.3.9600

    Version 10.0.15063

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
    Version 10.0.15063

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
    Version 10.0.14393

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
    Version 10.0.14393

    @@ -7162,7 +7317,7 @@ Version  10.0.10240

    -
    - Modes / States / Key Sizes + Modes / States / Key Sizes - Algorithm Implementation and Certificate # + Algorithm Implementation and Certificate #
    - PBKDF (vendor affirmed)

     Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
    (Software Version: 10.0.14393)

    Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    @@ -6646,7 +6801,7 @@ Version 6.3.9600
    - PBKDF (vendor affirmed)

    Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
    (Software Version: 10.0.14393)

    Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed

    @@ -6664,8 +6819,8 @@ Version 6.3.9600
    Publication / Component Validated / DescriptionImplementation and Certificate #Publication / Component Validated / DescriptionImplementation and Certificate #
      @@ -6677,7 +6832,7 @@ Version 6.3.9600

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

    Version 6.3.9600

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

    Version 10.0.16299

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

    +

    Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

    Version 10.0.15063.674

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

    Version 10.0.16299

     

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

    Version 10.0.16299

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    Version 10.0.16299

    FIPS186-4 ECDSA

    Signature Generation of hash sized messages

    -

    ECDSA SigGen Component: CURVES( P-256 P-384 P-521 )

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
    Version 10.0. 15063

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
    Version 10.0. 15063

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
    Version 10.0.14393

    -

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
    +

    Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
    Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
    Version 10.0.10586

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
    Version 6.3.9600

    SP800-135

    Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    +

    Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update; Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

    Version 10.0.16299

    Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
    Version 10.0.15063

    @@ -7176,19 +7331,19 @@ Version 10.0.14393

    Version 10.0.10586

    Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
    Version  10.0.10240

    -

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
    +

    Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry, and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
    Version 6.3.9600

    +## Contact + +fips@microsoft.com ## References -\[[FIPS 140](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\] - FIPS 140-2, Security Requirements for Cryptographic Modules - -\[[FIPS FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf)\] - Cryptographic Module Validation Program (CMVP) FAQ - -\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised) - -\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths +* [FIPS 140-2, Security Requirements for Cryptographic Modules](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)) +* [Cryptographic Module Validation Program (CMVP) FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf) +* [SP 800-57 - Recommendation for Key Management – Part 1: General (Revised)](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) +* [SP 800-131A - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf) diff --git a/windows/security/threat-protection/get-support-for-security-baselines.md b/windows/security/threat-protection/get-support-for-security-baselines.md index 81f5a796f3..c6c0883e58 100644 --- a/windows/security/threat-protection/get-support-for-security-baselines.md +++ b/windows/security/threat-protection/get-support-for-security-baselines.md @@ -2,7 +2,7 @@ title: Get support description: Frequently asked question about how to get support for Windows baselines, the Security Compliance Toolkit (SCT), and related topics in your organization. keywords: virtualization, security, malware -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.localizationpriority: medium ms.author: dansimp @@ -13,6 +13,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 06/25/2018 ms.reviewer: +ms.technology: mde --- # Get Support @@ -40,7 +41,7 @@ The toolkit supports formats created by the Windows GPO backup feature (.pol, .i Not yet. PowerShell-based DSC is rapidly gaining popularity, and more DSC tools are coming online to convert GPOs and DSC and to validate system configuration. We are currently developing a tool to provide customers with these features. -**Does SCT support the creation of Microsoft Endpoint Configuration Manager DCM packs?** +**Does SCT support the creation of Microsoft Endpoint Manager DCM packs?** No. A potential alternative is Desired State Configuration (DSC), a feature of the [Windows Management Framework](https://www.microsoft.com/download/details.aspx?id=40855). A tool that supports conversion of GPO backups to DSC format can be found [here](https://github.com/Microsoft/BaselineManagement). diff --git a/windows/security/threat-protection/images/lab-creation-page.png b/windows/security/threat-protection/images/lab-creation-page.png new file mode 100644 index 0000000000..75540493da Binary files /dev/null and b/windows/security/threat-protection/images/lab-creation-page.png differ diff --git a/windows/security/threat-protection/images/linux-mdatp-1.png b/windows/security/threat-protection/images/linux-mdatp-1.png new file mode 100644 index 0000000000..f8c9c07b16 Binary files /dev/null and b/windows/security/threat-protection/images/linux-mdatp-1.png differ diff --git a/windows/security/threat-protection/images/linux-mdatp.png b/windows/security/threat-protection/images/linux-mdatp.png new file mode 100644 index 0000000000..f8c9c07b16 Binary files /dev/null and b/windows/security/threat-protection/images/linux-mdatp.png differ diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 38daa97fbb..cfcd3b4102 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -1,9 +1,9 @@ --- title: Threat Protection (Windows 10) -description: Learn how Microsoft Defender ATP helps protect against threats. -keywords: threat protection, Microsoft Defender Advanced Threat Protection, attack surface reduction, next generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, configuration score, advanced hunting, cyber threat hunting, web threat protection +description: Microsoft Defender for Endpoint is a unified platform for preventative protection, post-breach detection, automated investigation, and response. +keywords: threat protection, Microsoft Defender Advanced Threat Protection, attack surface reduction, next-generation protection, endpoint detection and response, automated investigation and response, microsoft threat experts, Microsoft Secure Score for Devices, advanced hunting, cyber threat hunting, web threat protection search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,49 +14,51 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- # Threat Protection -[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture. +[Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Defender for Endpoint protects endpoints from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves security posture. ->[!TIP] +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +> [!TIP] > Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/). -

    Microsoft Defender ATP

    +

    Microsoft Defender for Endpoint

    - - - - - - + + + + + + - +

    Threat & Vulnerability Management

    Attack surface reduction

    Next generation protection

    Endpoint detection and response

    Automated investigation and remediation

    Microsoft Threat Experts
    threat and vulnerability icon
    Threat & vulnerability management
    attack surface reduction icon
    Attack surface reduction
    next generation protection icon
    Next-generation protection
    endpoint detection and response icon
    Endpoint detection and response
    automated investigation and remediation icon
    Automated investigation and remediation
    microsoft threat experts icon
    Microsoft Threat Experts
    Centralized configuration and administration, APIs
    Microsoft Threat Protection
    Microsoft 365 Defender

    -**[Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**
    + +>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4obJq] + +**[Threat & vulnerability management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**
    This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. -- [Risk-based Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) -- [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md) -- [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) -- [Configuration score](microsoft-defender-atp/configuration-score.md) -- [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md) -- [Remediation](microsoft-defender-atp/tvm-remediation.md) -- [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) -- [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) -- [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) +- [Threat & vulnerability management overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) +- [Get started](microsoft-defender-atp/tvm-prerequisites.md) +- [Access your security posture](microsoft-defender-atp/tvm-dashboard-insights.md) +- [Improve your security posture and reduce risk](microsoft-defender-atp/tvm-security-recommendation.md) +- [Understand vulnerabilities on your devices](microsoft-defender-atp/tvm-software-inventory.md) @@ -74,14 +76,14 @@ The attack surface reduction set of capabilities provide the first line of defen -**[Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)**
    -To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats. +**[Next-generation protection](microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md)**
    +To further reinforce the security perimeter of your network, Microsoft Defender for Endpoint uses next-generation protection designed to catch all types of emerging threats. -- [Behavior monitoring](/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) -- [Cloud-based protection](/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) -- [Machine learning](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -- [URL Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus) -- [Automated sandbox service](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) +- [Behavior monitoring](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) +- [Cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus) +- [Machine learning](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus) +- [URL Protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus) +- [Automated sandbox service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus) @@ -91,7 +93,7 @@ Endpoint detection and response capabilities are put in place to detect, investi - [Alerts](microsoft-defender-atp/alerts-queue.md) - [Historical endpoint data](microsoft-defender-atp/investigate-machines.md#timeline) - [Response orchestration](microsoft-defender-atp/response-actions.md) -- [Forensic collection](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines) +- [Forensic collection](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-devices) - [Threat intelligence](microsoft-defender-atp/threat-indicator-concepts.md) - [Advanced detonation and analysis service](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) - [Advanced hunting](microsoft-defender-atp/advanced-hunting-overview.md) @@ -100,51 +102,44 @@ Endpoint detection and response capabilities are put in place to detect, investi **[Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md)**
    -In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. +In addition to quickly responding to advanced attacks, Microsoft Defender for Endpoint offers automated investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. -- [Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md) -- [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md) -- [View and approve remediation actions](microsoft-defender-atp/manage-auto-investigation.md) - - - -**[Configuration Score](microsoft-defender-atp/configuration-score.md)**
    ->[!NOTE] -> Secure score is now part of [Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) as [Configuration score](microsoft-defender-atp/configuration-score.md). - -Microsoft Defender ATP includes a configuration score to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization. -- [Configuration score](microsoft-defender-atp/configuration-score.md) -- [Threat analytics](microsoft-defender-atp/threat-analytics.md) +- [Get an overview of automated investigation and remediation](microsoft-defender-atp/automated-investigations.md) +- [Learn about automation levels](microsoft-defender-atp/automation-levels.md) +- [Configure automated investigation and remediation in Defender for Endpoint](microsoft-defender-atp/configure-automated-investigations-remediation.md) +- [Visit the Action center to see remediation actions](microsoft-defender-atp/auto-investigation-action-center.md) +- [Review remediation actions following an automated investigation](microsoft-defender-atp/manage-auto-investigation.md) +- [View the details and results of an automated investigation](microsoft-defender-atp/autoir-investigation-results.md) **[Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)**
    -Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization and additional context and insights that further empower Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately. +Microsoft Defender for Endpoint's new managed threat hunting service provides proactive hunting, prioritization, and additional context and insights. Microsoft Threat Experts further empowers Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately. - [Targeted attack notification](microsoft-defender-atp/microsoft-threat-experts.md) - [Experts-on-demand](microsoft-defender-atp/microsoft-threat-experts.md) -- [Configure your Microsoft Threat Protection managed hunting service](microsoft-defender-atp/configure-microsoft-threat-experts.md) +- [Configure your Microsoft 365 Defender managed hunting service](microsoft-defender-atp/configure-microsoft-threat-experts.md) **[Centralized configuration and administration, APIs](microsoft-defender-atp/management-apis.md)**
    -Integrate Microsoft Defender Advanced Threat Protection into your existing workflows. +Integrate Microsoft Defender for Endpoint into your existing workflows. - [Onboarding](microsoft-defender-atp/onboard-configure.md) - [API and SIEM integration](microsoft-defender-atp/configure-siem.md) - [Exposed APIs](microsoft-defender-atp/apis-intro.md) - [Role-based access control (RBAC)](microsoft-defender-atp/rbac.md) -- [Reporting and trends](microsoft-defender-atp/powerbi-reports.md) +- [Reporting and trends](microsoft-defender-atp/threat-protection-reports.md) **[Integration with Microsoft solutions](microsoft-defender-atp/threat-protection-integration.md)**
    - Microsoft Defender ATP directly integrates with various Microsoft solutions, including: + Microsoft Defender for Endpoint directly integrates with various Microsoft solutions, including: - Intune -- Office 365 ATP -- Azure ATP -- Azure Security Center +- Microsoft Defender for Office 365 +- Microsoft Defender for Identity +- Azure Defender - Skype for Business - Microsoft Cloud App Security -**[Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection)**
    - With Microsoft Threat Protection, Microsoft Defender ATP and various Microsoft security solutions form a unified pre- and post-breach enterprise defense suite that natively integrates across endpoint, identity, email, and applications to detect, prevent, investigate and automatically respond to sophisticated attacks. +**[Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection)**
    + With Microsoft 365 Defender, Microsoft Defender for Endpoint and various Microsoft security solutions form a unified pre- and post-breach enterprise defense suite that natively integrates across endpoint, identity, email, and applications to detect, prevent, investigate, and automatically respond to sophisticated attacks. diff --git a/windows/security/threat-protection/intelligence/TOC.md b/windows/security/threat-protection/intelligence/TOC.md index 1bea408ef2..9919f7d8d2 100644 --- a/windows/security/threat-protection/intelligence/TOC.md +++ b/windows/security/threat-protection/intelligence/TOC.md @@ -2,10 +2,6 @@ ## [Understand malware & other threats](understanding-malware.md) -### [Prevent malware infection](prevent-malware-infection.md) - -### [Malware names](malware-naming.md) - ### [Coin miners](coinminer-malware.md) ### [Exploits and exploit kits](exploits-malware.md) @@ -14,7 +10,9 @@ ### [Macro malware](macro-malware.md) -### [Phishing](phishing.md) +### [Phishing attacks](phishing.md) + +#### [Phishing trends and techniques](phishing-trends.md) ### [Ransomware](ransomware-malware.md) @@ -30,13 +28,17 @@ ### [Worms](worms-malware.md) +## [Prevent malware infection](prevent-malware-infection.md) + +## [Malware naming convention](malware-naming.md) + ## [How Microsoft identifies malware and PUA](criteria.md) ## [Submit files for analysis](submission-guide.md) -## [Safety Scanner download](safety-scanner-download.md) +## [Troubleshoot malware submission](portal-submission-troubleshooting.md) -## [Industry tests](top-scoring-industry-antivirus-tests.md) +## [Safety Scanner download](safety-scanner-download.md) ## [Industry collaboration programs](cybersecurity-industry-partners.md) @@ -46,7 +48,7 @@ ### [Coordinated malware eradication](coordinated-malware-eradication.md) -## [Information for developers](developer-info.md) +## [Information for developers]() ### [Software developer FAQ](developer-faq.md) diff --git a/windows/security/threat-protection/intelligence/coinminer-malware.md b/windows/security/threat-protection/intelligence/coinminer-malware.md index 52771c8630..aa36031971 100644 --- a/windows/security/threat-protection/intelligence/coinminer-malware.md +++ b/windows/security/threat-protection/intelligence/coinminer-malware.md @@ -3,7 +3,7 @@ title: Coin miners ms.reviewer: description: Learn about coin miners, how they can infect devices, and what you can do to protect yourself. keywords: security, malware, coin miners, protection, cryptocurrencies -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Coin miners @@ -31,7 +32,7 @@ Many infections start with: Mining is the process of running complex mathematical calculations necessary to maintain the blockchain ledger. This process generates coins but requires significant computing resources. -Coin miners are not inherently malicious. Some individuals and organizations invest in hardware and electric power for legitimate coin mining operations. However, others look for alternative sources of computing power and try to find their way into corporate networks. These coin miners are not wanted in enterprise environments because they eat up precious computing resources. +Coin miners aren't inherently malicious. Some individuals and organizations invest in hardware and electric power for legitimate coin mining operations. However, others look for alternative sources of computing power and try to find their way into corporate networks. These coin miners aren't wanted in enterprise environments because they eat up precious computing resources. Cybercriminals see an opportunity to make money by running malware campaigns that distribute, install, and run trojanized miners at the expense of other people’s computing resources. @@ -41,12 +42,12 @@ DDE exploits, which have been known to distribute ransomware, are now delivering For example, a sample of the malware detected as Trojan:Win32/Coinminer (SHA-256: 7213cbbb1a634d780f9bb861418eb262f58954e6e5dca09ca50c1e1324451293) is installed by Exploit:O97M/DDEDownloader.PA, a Word document that contains the DDE exploit. -The exploit launches a cmdlet that executes a malicious PowerShell script (Trojan:PowerShell/Maponeir.A), which then downloads the trojanized miner: a modified version of the miner XMRig, which mines Monero cryptocurrency. +The exploit launches a cmdlet that executes a malicious PowerShell script (Trojan:PowerShell/Maponeir.A). It downloads the trojanized miner, a modified version of the miner XMRig, which then mines Monero cryptocurrency. ## How to protect against coin miners -**Enable PUA detection**: Some coin mining tools are not considered malware but are detected as potentially unwanted applications (PUA). Many applications detected as PUA can negatively impact machine performance and employee productivity. In enterprise environments, you can stop adware, torrent downloaders, and coin mining by enabling PUA detection. +**Enable potentially unwanted applications (PUA) detection**. Some coin mining tools aren't considered malware but are detected as PUA. Many applications detected as PUA can negatively impact machine performance and employee productivity. In enterprise environments, you can stop adware, torrent downloaders, and coin mining by enabling PUA detection. -Since coin miners is becoming a popular payload in many different kinds of attacks, see general tips on how to [prevent malware infection](prevent-malware-infection.md). +Since coin miners are becoming a popular payload in many different kinds of attacks, see general tips on how to [prevent malware infection](prevent-malware-infection.md). For more information on coin miners, see the blog post [Invisible resource thieves: The increasing threat of cryptocurrency miners](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/). diff --git a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md index fef7da884b..47e4ffb819 100644 --- a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md +++ b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md @@ -3,7 +3,7 @@ title: Coordinated Malware Eradication ms.reviewer: description: The Coordinated Malware Eradication program aims to unite security organizations to disrupt the malware ecosystem. keywords: security, malware, malware eradication, Microsoft Malware Protection Center, MMPC -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,8 +11,9 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Coordinated Malware Eradication @@ -20,20 +21,20 @@ ms.topic: article Coordinated Malware Eradication (CME) aims to bring organizations in cybersecurity and in other industries together to change the game against malware. While the cybersecurity industry today is effective at disrupting malware families through individual efforts, those disruptions rarely lead to eradication since malware authors quickly adapt their tactics to survive. -CME calls for organizations to pool their tools, information and actions to drive coordinated campaigns against malware. The ultimate goal is to drive efficient and long lasting results for better protection of our collective communities, customers, and businesses. +CME calls for organizations to pool their tools, information, and actions to drive coordinated campaigns against malware. The goal is to drive efficient and long-lasting results to better protect our communities, customers, and businesses. ## Combining our tools, information, and actions -Diversity of participation across industries and disciplines, extending beyond cybersecurity, makes eradication campaigns even stronger across the malware lifecycle. For instance, while security vendors, computer emergency response/readiness teams (CERTs), and Internet service providers (ISPs) can contribute with malware telemetry, online businesses can identify fraudulent behavior and law enforcement agencies can drive legal action. +Diversity of participation across industries and disciplines, extending beyond cybersecurity, makes eradication campaigns even stronger across the malware lifecycle. Security vendors, computer emergency response/readiness teams (CERTs), and Internet service providers (ISPs) can contribute with malware telemetry. Online businesses can identify fraudulent behavior and law enforcement agencies can drive legal action. -In addition to telemetry and analysis data, Microsoft is planning to contribute cloud-based scalable storage and computing horsepower with the necessary big data analysis tools built-in to these campaigns. +Microsoft is planning to contribute telemetry and analysis data to these campaigns. It will also provide cloud-based scalable storage and computing horsepower with the necessary big data analysis tools built-in. ## Coordinated campaigns for lasting results -Organizations participating in the CME effort work together to help eradicate selected malware families by contributing their own telemetry data, expertise, tools, and other resources. These organizations operate under a campaign umbrella with clearly defined end goals and metrics. Any organization or member can initiate a campaign and invite others to join it. The members then have the option to accept or decline the invitations they receive. +Organizations participating in the CME effort work together to help eradicate selected malware families by contributing their own telemetry data, expertise, tools, and other resources. These organizations operate under a campaign umbrella with clearly defined end goals and metrics. Any organization or member can start a campaign and invite others to join it. The members can then accept or decline the invitations they receive. ## Join the effort -Any organization that is involved in cybersecurity and antimalware or interested in fighting cybercrime can participate in CME campaigns by enrolling in the [Virus Information Alliance (VIA) program](virus-information-alliance-criteria.md). It ensures that everyone agrees to use the information and tools available for campaigns for their intended purpose (that is, the eradication of malware). +Any organization that is involved in cybersecurity and antimalware or interested in fighting cybercrime can participate in CME campaigns by enrolling in the [Virus Information Alliance (VIA) program](virus-information-alliance-criteria.md). Everyone agrees to use the available information and tools for their intended purpose (that is, the eradication of malware). -If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). +If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). For any questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). diff --git a/windows/security/threat-protection/intelligence/criteria.md b/windows/security/threat-protection/intelligence/criteria.md index 572d4cf705..0c75b48120 100644 --- a/windows/security/threat-protection/intelligence/criteria.md +++ b/windows/security/threat-protection/intelligence/criteria.md @@ -1,9 +1,9 @@ --- title: How Microsoft identifies malware and potentially unwanted applications ms.reviewer: -description: Learn how Microsoft reviews software for privacy violations and other negative behavior, to determine if it is malware or a potentially unwanted application. +description: Learn how Microsoft reviews software for privacy violations and other negative behavior, to determine if it's malware or a potentially unwanted application. keywords: security, malware, virus research threats, research malware, device protection, computer infection, virus infection, descriptions, remediation, latest threats, MMdevice, Microsoft Malware Protection Center, PUA, potentially unwanted applications -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,14 +11,15 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # How Microsoft identifies malware and potentially unwanted applications -Microsoft aims to provide a delightful and productive Windows experience by working to ensure you are safe and in control of your devices. Microsoft helps protect you from potential threats by identifying and analyzing software and online content. When you download, install, and run software, we check the reputation of downloaded programs and ensure you are protected against known threats and warned about software that is unknown to us. +Microsoft aims to provide a delightful and productive Windows experience by working to ensure you're safe and in control of your devices. Microsoft helps protect you from potential threats by identifying and analyzing software and online content. When you download, install, and run software, we check the reputation of downloaded programs and ensure you're protected against known threats. You are also warned about software that is unknown to us. You can assist Microsoft by [submitting unknown or suspicious software for analysis](https://www.microsoft.com/wdsi/filesubmission/). This will help ensure that unknown or suspicious software is scanned by our system to start establishing reputation. [Learn more about submitting files for analysis](submission-guide.md) @@ -29,9 +30,9 @@ The next sections provide an overview of the classifications we use for applicat ## Unknown – Unrecognized software -No antivirus or protection technology is perfect. It takes time to identify and block malicious sites and applications, or trust newly released programs and certificates.  With almost 2 billion websites on the internet and software continuously being updated and released, it's impossible to have information about every single site and program. +No antivirus or protection technology is perfect. It takes time to identify and block malicious sites and applications, or trust newly released programs and certificates.  With almost 2 billion websites on the internet and software continuously updated and released, it's impossible to have information about every single site and program. -You can think of Unknown/Uncommonly downloaded warnings as an early warning system for potentially undetected malware, as there is generally a delay from the time new malware is released until it is identified. Not all uncommon programs are malicious, but the risk in the unknown category is significantly higher for the typical user. Warnings for unknown software are not blocks, and users can choose to download and run the application normally if they wish to. +Think of Unknown/Uncommonly downloaded warnings as an early warning system for potentially undetected malware. There's generally a delay from the time new malware is released until it's identified. Not all uncommon programs are malicious, but the risk in the unknown category is much higher for the typical user. Warnings for unknown software aren't blocks. Users can choose to download and run the application normally if they wish to. Once enough data is gathered, Microsoft's security solutions can make a determination. Either no threats are found, or an application or software is categorized as malware or potentially unwanted software. @@ -61,11 +62,11 @@ Microsoft classifies most malicious software into one of the following categorie * **Password stealer:** A type of malware that gathers your personal information, such as usernames and passwords. It often works along with a keylogger, which collects and sends information about the keys you press and websites you visit. -* **Ransomware:** A type of malware that encrypts your files or makes other modifications that can prevent you from using your device. It then displays a ransom note which states you must pay money, complete surveys, or perform other actions before you can use your device again. [See more information about ransomware](ransomware-malware.md). +* **Ransomware:** A type of malware that encrypts your files or makes other modifications that can prevent you from using your device. It then displays a ransom note that states you must pay money or perform other actions before you can use your device again. [See more information about ransomware](ransomware-malware.md). * **Rogue security software:** Malware that pretends to be security software but doesn't provide any protection. This type of malware usually displays alerts about nonexistent threats on your device. It also tries to convince you to pay for its services. -* **Trojan:** A type of malware that attempts to appear harmless. Unlike a virus or a worm, a trojan doesn't spread by itself. Instead, it tries to look legitimate and tricks users into downloading and installing it. Once installed, trojans perform various malicious activities such as stealing personal information, downloading other malware, or giving attackers access to your device. +* **Trojan:** A type of malware that attempts to appear harmless. Unlike a virus or a worm, a trojan doesn't spread by itself. Instead, it tries to look legitimate to tricks users into downloading and installing it. Once installed, trojans perform various malicious activities such as stealing personal information, downloading other malware, or giving attackers access to your device. * **Trojan clicker:** A type of trojan that automatically clicks buttons or similar controls on websites or applications. Attackers can use this trojan to click on online advertisements. These clicks can skew online polls or other tracking systems and can even install applications on your device. @@ -73,17 +74,17 @@ Microsoft classifies most malicious software into one of the following categorie ### Unwanted software -Microsoft believes that you should have control over your Windows experience. Software running on Windows should keep you in control of your device through informed choices and accessible controls. Microsoft identifies software behaviors that ensure you stay in control. We classify software that does not fully demonstrate these behaviors as "unwanted software". +Microsoft believes that you should have control over your Windows experience. Software running on Windows should keep you in control of your device through informed choices and accessible controls. Microsoft identifies software behaviors that ensure you stay in control. We classify software that doesn't fully demonstrate these behaviors as "unwanted software". #### Lack of choice -You must be notified about what is happening on your device, including what software does and whether it is active. +You must be notified about what is happening on your device, including what software does and whether it's active. Software that exhibits lack of choice might: * Fail to provide prominent notice about the behavior of the software and its purpose and intent. -* Fail to clearly indicate when the software is active and might also attempt to hide or disguise its presence. +* Fail to clearly indicate when the software is active. It might also attempt to hide or disguise its presence. * Install, reinstall, or remove software without your permission, interaction, or consent. @@ -93,7 +94,7 @@ Software that exhibits lack of choice might: * Falsely claim to be software from Microsoft. -Software must not mislead or coerce you into making decisions about your device. This is considered behavior that limits your choices. In addition to the previous list, software that exhibits lack of choice might: +Software must not mislead or coerce you into making decisions about your device. It is considered behavior that limits your choices. In addition to the previous list, software that exhibits lack of choice might: * Display exaggerated claims about your device's health. @@ -103,7 +104,7 @@ Software must not mislead or coerce you into making decisions about your device. Software that stores or transmits your activities or data must: -* Give you notice and get consent to do so. Software should not include an option that configures it to hide activities associated with storing or transmitting your data. +* Give you notice and get consent to do so. Software shouldn't include an option that configures it to hide activities associated with storing or transmitting your data. #### Lack of control @@ -119,7 +120,7 @@ Software that exhibits lack of control might: * Modify or manipulate webpage content without your consent. -Software that changes your browsing experience must only use the browser's supported extensibility model for installation, execution, disabling, or removal. Browsers that do not provide supported extensibility models are considered non-extensible and should not be modified. +Software that changes your browsing experience must only use the browser's supported extensibility model for installation, execution, disabling, or removal. Browsers that don't provide supported extensibility models are considered non-extensible and shouldn't be modified. #### Installation and removal @@ -159,11 +160,11 @@ Advertisements shown to you must: #### Consumer opinion -Microsoft maintains a worldwide network of analysts and intelligence systems where you can [submit software for analysis](https://www.microsoft.com/wdsi/filesubmission). Your participation helps Microsoft identify new malware quickly. After analysis, Microsoft creates Security intelligence for software that meets the described criteria. This Security intelligence identifies the software as malware and are available to all users through Windows Defender Antivirus and other Microsoft antimalware solutions. +Microsoft maintains a worldwide network of analysts and intelligence systems where you can [submit software for analysis](https://www.microsoft.com/wdsi/filesubmission). Your participation helps Microsoft identify new malware quickly. After analysis, Microsoft creates Security intelligence for software that meets the described criteria. This Security intelligence identifies the software as malware and are available to all users through Microsoft Defender Antivirus and other Microsoft antimalware solutions. ## Potentially unwanted application (PUA) -Our PUA protection aims to safeguard user productivity and ensure enjoyable Windows experiences. This protection helps deliver more productive, performant, and delightful Windows experiences. For instruction on how to enable PUA protection in Chromium-based Microsoft Edge and Windows Defender Antivirus, see [Detect and block potentially unwanted applications](../windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md). +Our PUA protection aims to safeguard user productivity and ensure enjoyable Windows experiences. This protection helps deliver more productive, performant, and delightful Windows experiences. For instruction on how to enable PUA protection in Chromium-based Microsoft Edge and Microsoft Defender Antivirus, see [Detect and block potentially unwanted applications](../microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md). *PUAs are not considered malware.* @@ -171,11 +172,11 @@ Microsoft uses specific categories and the category definitions to classify soft * **Advertising software:** Software that displays advertisements or promotions, or prompts you to complete surveys for other products or services in software other than itself. This includes software that inserts advertisements to webpages. -* **Torrent software:** Software that is used to create or download torrents or other files specifically used with peer-to-peer file-sharing technologies. +* **Torrent software (Enterprise only):** Software that is used to create or download torrents or other files specifically used with peer-to-peer file-sharing technologies. * **Cryptomining software:** Software that uses your device resources to mine cryptocurrencies. -* **Bundling software:** Software that offers to install other software that is not digitally signed by the same entity. Also, software that offers to install other software that qualifies as PUA based on the criteria outlined in this document. +* **Bundling software:** Software that offers to install other software that is not developed by the same entity or not required for the software to run. Also, software that offers to install other software that qualifies as PUA based on the criteria outlined in this document. * **Marketing software:** Software that monitors and transmits the activities of users to applications or services other than itself for marketing research. diff --git a/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md b/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md index 1a57f85019..fec4892d00 100644 --- a/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md +++ b/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md @@ -3,7 +3,7 @@ title: Industry collaboration programs ms.reviewer: description: Microsoft industry-wide antimalware collaboration programs - Virus Information Alliance (VIA), Microsoft Virus Initiative (MVI), and Coordinated Malware Eradication (CME) keywords: security, malware, antivirus industry, antimalware Industry, collaboration programs, alliances, Virus Information Alliance, Microsoft Virus Initiative, Coordinated Malware Eradication, WDSI, MMPC, Microsoft Malware Protection Center, partnerships -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,8 +11,9 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- # Industry collaboration programs @@ -38,6 +39,6 @@ Go to the [MVI program page](virus-initiative-criteria.md) for more information. CME is open to organizations who are involved in cybersecurity and antimalware or interested in fighting cybercrime. -The program aims to bring organizations in cybersecurity and other industries together to pool tools, information and actions to drive coordinated campaigns against malware. The ultimate goal is to create efficient and long-lasting results for better protection of our collective communities, customers, and businesses. +The program aims to bring organizations in cybersecurity and other industries together to pool tools, information, and actions to drive coordinated campaigns against malware. The ultimate goal is to create efficient and long-lasting results for better protection of our communities, customers, and businesses. Go to the [CME program page](coordinated-malware-eradication.md) for more information. diff --git a/windows/security/threat-protection/intelligence/developer-faq.md b/windows/security/threat-protection/intelligence/developer-faq.md index 3e680879b5..5f91ef4a1f 100644 --- a/windows/security/threat-protection/intelligence/developer-faq.md +++ b/windows/security/threat-protection/intelligence/developer-faq.md @@ -4,7 +4,7 @@ ms.reviewer: description: This page provides answers to common questions we receive from software developers keywords: wdsi, software, developer, faq, dispute, false-positive, classify, installer, software, bundler, blocking search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,8 +13,9 @@ author: levinec ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Software developer FAQ @@ -23,28 +24,28 @@ This page provides answers to common questions we receive from software develope ## Does Microsoft accept files for a known list or false-positive prevention program? -No. We do not accept these requests from software developers. Signing your program's files in a consistent manner, with a digital certificate issued by a trusted root authority, helps our research team quickly identify the source of a program and apply previously gained knowledge. In some cases, this might result in your program being quickly added to the known list or, far less frequently, in adding your digital certificate to a list of trusted publishers. +No. We don't accept these requests from software developers. Signing your program's files in a consistent manner, with a digital certificate issued by a trusted root authority, helps our research team quickly identify the source of a program and apply previously gained knowledge. In some cases, this might result in your program being quickly added to the known list. Far less frequently, in will add your digital certificate to a list of trusted publishers. ## How do I dispute the detection of my program? Submit the file in question as a software developer. Wait until your submission has a final determination. -If you're not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We will use the information you provide to investigate further if necessary. +If you're not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We'll use the information you provide to investigate further if necessary. -We encourage all software vendors and developers to read about how Microsoft identifies malware and unwanted software. +We encourage all software vendors and developers to read about [how Microsoft identifies malware and Potentially Unwanted Applications (PUA)](criteria.md). ## Why is Microsoft asking for a copy of my program? -This can help us with our analysis. Participants of the Microsoft Active Protection Service (MAPS) may occasionally receive these requests. The requests will stop once our systems have received and processed the file. +Providing copies can help us with our analysis. Participants of the [Microsoft Active Protection Service (MAPS)](https://www.microsoft.com/msrc/mapp) may occasionally receive these requests. The requests will stop once our systems have received and processed the file. ## Why does Microsoft classify my installer as a software bundler? -It contains instructions to offer a program classified as unwanted software. You can review the criteria we use to check applications for behaviors that are considered unwanted. +It contains instructions to offer a program classified as unwanted software. You can review the [criteria](criteria.md) we use to check applications for behaviors that are considered unwanted. -## Why is the Windows Firewall blocking my program? +## Why is the Windows Defender Firewall blocking my program? -This is not related to Windows Defender Antivirus and other Microsoft antimalware. You can find out more about Windows Firewall from the Microsoft Developer Network. +Firewall blocks aren't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Windows Defender Firewall](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security). -## Why does the Windows Defender SmartScreen say my program is not commonly downloaded? +## Why does the Microsoft Defender Windows Defender SmartScreen say my program isn't commonly downloaded? -This is not related to Windows Defender Antivirus and other Microsoft antimalware. You can find out more from the SmartScreen website. +This isn't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Microsoft Defender Windows Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview) diff --git a/windows/security/threat-protection/intelligence/developer-info.md b/windows/security/threat-protection/intelligence/developer-info.md deleted file mode 100644 index 19d1a76072..0000000000 --- a/windows/security/threat-protection/intelligence/developer-info.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: Information for developers -ms.reviewer: -description: This page provides answers to common questions we receive from software developers and other useful resources -keywords: software, developer, faq, dispute, false-positive, classify, installer, software, bundler, blocking -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: ellevin -author: levinec -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Information for developers - -Learn about the common questions we receive from software developers and get other developer resources such as detection criteria and file submissions. - -## In this section - -Topic | Description -:---|:--- -[Software developer FAQ](developer-faq.md) | Provides answers to common questions we receive from software developers. -[Developer resources](developer-resources.md) | Provides information about how to submit files, detection criteria, and how to check your software against the latest security intelligence and cloud protection from Microsoft. diff --git a/windows/security/threat-protection/intelligence/developer-resources.md b/windows/security/threat-protection/intelligence/developer-resources.md index 35aec2bd9c..9c99065431 100644 --- a/windows/security/threat-protection/intelligence/developer-resources.md +++ b/windows/security/threat-protection/intelligence/developer-resources.md @@ -4,7 +4,7 @@ ms.reviewer: description: This page provides information for developers such as detection criteria, developer questions, and how to check your software against Security intelligence. keywords: wdsi, software, developer, resources, detection, criteria, questions, scan, software, definitions, cloud, protection, security intelligence search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: medium @@ -13,8 +13,9 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Software developer resources @@ -40,4 +41,4 @@ Find more guidance about the file submission and detection dispute process in ou ### Scan your software -Use [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) to check your software against the latest Security intelligence and cloud protection from Microsoft. +Use [Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) to check your software against the latest Security intelligence and cloud protection from Microsoft. diff --git a/windows/security/threat-protection/intelligence/exploits-malware.md b/windows/security/threat-protection/intelligence/exploits-malware.md index beff687643..c7a418d55c 100644 --- a/windows/security/threat-protection/intelligence/exploits-malware.md +++ b/windows/security/threat-protection/intelligence/exploits-malware.md @@ -1,9 +1,9 @@ --- title: Exploits and exploit kits ms.reviewer: -description: Learn about how exploits use vulnerabilities in common software to give an attackers access to your computer and to install other malware. +description: Learn about how exploits use vulnerabilities in common software to give attackers access to your computer and install other malware. keywords: security, malware, exploits, exploit kits, prevention, vulnerabilities, Microsoft, Exploit malware family, exploits, java, flash, adobe, update software, prevent exploits, exploit pack, vulnerability, 0-day, holes, weaknesses, attack, Flash, Adobe, out-of-date software, out of date software, update, update software, reinfection, Java cache, reinfected, won't remove, won't clean, still detects, full scan, MSE, Defender, WDSI, MMPC, Microsoft Malware Protection Center -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Exploits and exploit kits @@ -21,27 +22,27 @@ Exploits take advantage of vulnerabilities in software. A vulnerability is like ## How exploits and exploit kits work -Exploits are often the first part of a larger attack. Hackers scan for outdated systems that contain critical vulnerabilities, which they then exploit by deploying targeted malware. Exploits often include what's called "shellcode". This is a small malware payload that's used to download additional malware from attacker-controlled networks. This allows hackers to infect devices and infiltrate organizations. +Exploits are often the first part of a larger attack. Hackers scan for outdated systems that contain critical vulnerabilities, which they then exploit by deploying targeted malware. Exploits often include shellcode, which is a small malware payload used to download additional malware from attacker-controlled networks. Shellcode allows hackers to infect devices and infiltrate organizations. -Exploit kits are more comprehensive tools that contain a collection of exploits. These kits scan devices for different kinds of software vulnerabilities and, if any are detected, deploys additional malware to further infect a device. Kits can use exploits targeting a variety of software, including Adobe Flash Player, Adobe Reader, Internet Explorer, Oracle Java and Sun Java. +Exploit kits are more comprehensive tools that contain a collection of exploits. These kits scan devices for different kinds of software vulnerabilities and, if any are detected, deploy additional malware to further infect a device. Kits can use exploits targeting a variety of software, including Adobe Flash Player, Adobe Reader, Internet Explorer, Oracle Java, and Sun Java. The most common method used by attackers to distribute exploits and exploit kits is through webpages, but exploits can also arrive in emails. Some websites unknowingly and unwillingly host malicious code and exploits in their ads. -The infographic below shows how an exploit kit might attempt to exploit a device when a compromised webpage is visited. +The infographic below shows how an exploit kit might attempt to exploit a device after you visit a compromised webpage. -![example of how exploit kits work](./images/ExploitKit.png) +![example of how exploit kits work.](./images/ExploitKit.png) -*Figure 1. Example of how exploit kits work* +*Figure 1. Example of how to exploit kits work* Several notable threats, including Wannacry, exploit the Server Message Block (SMB) vulnerability CVE-2017-0144 to launch malware. Examples of exploit kits: -- Angler / [Axpergle](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=JS%2fAxpergle) +- Angler / [Axpergle](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=JS/Axpergle) -- [Neutrino](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=JS%2fNeutrino) +- [Neutrino](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=JS/NeutrinoEK) -- [Nuclear](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Exploit:JS/Neclu) +- [Nuclear](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=JS/Neclu) To learn more about exploits, read this blog post on [taking apart a double zero-day sample discovered in joint hunt with ESET.](https://cloudblogs.microsoft.com/microsoftsecure/2018/07/02/taking-apart-a-double-zero-day-sample-discovered-in-joint-hunt-with-eset/) @@ -56,6 +57,6 @@ You can read more on the [CVE website](https://cve.mitre.org/). ## How to protect against exploits -The best prevention for exploits is to keep your organization's [software up to date](https://portal.msrc.microsoft.com/). Software vendors provide updates for many known vulnerabilities and making sure these updates are applied to all devices is an important step to prevent malware. +The best prevention for exploits is to keep your organization's [software up to date](https://portal.msrc.microsoft.com/). Software vendors provide updates for many known vulnerabilities, so make sure these updates are applied to all devices. For more general tips, see [prevent malware infection](prevent-malware-infection.md). diff --git a/windows/security/threat-protection/intelligence/fileless-threats.md b/windows/security/threat-protection/intelligence/fileless-threats.md index bc3ecd48d1..a120169e13 100644 --- a/windows/security/threat-protection/intelligence/fileless-threats.md +++ b/windows/security/threat-protection/intelligence/fileless-threats.md @@ -1,9 +1,9 @@ --- title: Fileless threats ms.reviewer: -description: Learn about the categories of fileless threats and malware that "live off the land" -keywords: fileless, fileless malware, living off the land, lolbins, amsi, behavior monitoring, memory scanning, boot sector protection, security, malware, Windows Defender ATP, antivirus, AV, Microsoft Defender ATP, next generation protection -ms.prod: w10 +description: Learn about the categories of fileless threats and malware that live off the land +keywords: fileless, fileless malware, living off the land, lolbins, amsi, behavior monitoring, memory scanning, boot sector protection, security, malware, Windows Defender ATP, antivirus, AV, Microsoft Defender ATP, next-generation protection +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,16 +11,17 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Fileless threats -What exactly are fileless threats? The term "fileless" suggests that a threat does not come in a file, such as a backdoor that lives only in the memory of a machine. However, there's no generally accepted definition for fileless malware. The term is used broadly; it's also used to describe malware families that do rely on files to operate. +What exactly are fileless threats? The term "fileless" suggests that a threat doesn't come in a file, such as a backdoor that lives only in the memory of a machine. However, there's no one definition for fileless malware. The term is used broadly, and sometimes to describe malware families that do rely on files to operate. -Given that attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) for functionalities like execution, persistence, or information theft, some parts of the attack chain may be fileless, while others may involve the filesystem in some form. +Attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) for functionalities like execution, persistence, or information theft. Some parts of the attack chain may be fileless, while others may involve the file system in some form. For clarity, fileless threats are grouped into different categories. @@ -29,42 +30,42 @@ For clarity, fileless threats are grouped into different categories. Fileless threats can be classified by their entry point, which indicates how fileless malware can arrive on a machine. They can arrive via an exploit, through compromised hardware, or via regular execution of applications and scripts. -Next, list the form of entry point. For example, exploits can be based on files or network data, PCI peripherals are a type of hardware vector, and scripts and executables are sub-categories of the execution vector. +Next, list the form of entry point. For example, exploits can be based on files or network data, PCI peripherals are a type of hardware vector, and scripts and executables are subcategories of the execution vector. -Finally, classify the host of the infection. For example, a Flash application that may contain an exploit, a simple executable, malicious firmware from a hardware device, or an infected MBR, which could bootstrap the execution of a malware before the operating system even loads. +Finally, classify the host of the infection. For example, a Flash application may contain a variety of threats such as an exploit, a simple executable, and malicious firmware from a hardware device. -This helps you divide and categorize the various kinds of fileless threats. Clearly, the categories are not all the same: some are more dangerous but also more difficult to implement, while others are more commonly used despite (or precisely because of) not being very advanced. +Classifying helps you divide and categorize the various kinds of fileless threats. Some are more dangerous but also more difficult to implement, while others are more commonly used despite (or precisely because of) not being very advanced. From this categorization, you can glean three main types of fileless threats based on how much fingerprint they may leave on infected machines. ## Type I: No file activity performed -A completely fileless malware can be considered one that never requires writing a file on the disk. How would such malware infect a machine in the first place? An example scenario could be a target machine receiving malicious network packets that exploit the EternalBlue vulnerability, leading to the installation of the DoublePulsar backdoor, which ends up residing only in the kernel memory. In this case, there is no file or any data written on a file. +A fully fileless malware can be considered one that never requires writing a file on the disk. How would such malware infect a machine in the first place? One example is where a target machine receives malicious network packets that exploit the EternalBlue vulnerability. The vulnerability allows the installation of the DoublePulsar backdoor, which ends up residing only in the kernel memory. In this case, there's no file or any data written on a file. -Another scenario could involve compromised devices, where malicious code could be hiding in device firmware (such as a BIOS), a USB peripheral (like the BadUSB attack), or even in the firmware of a network card. All these examples do not require a file on the disk to run and can theoretically live only in memory, surviving even reboots, disk reformats, and OS reinstalls. +A compromised device may also have malicious code hiding in device firmware (such as a BIOS), a USB peripheral (like the BadUSB attack), or in the firmware of a network card. All these examples don't require a file on the disk to run, and can theoretically live only in memory. The malicious code would survive reboots, disk reformats, and OS reinstalls. -Infections of this type can be extra difficult to detect and remediate. Antivirus products usually don’t have the capability to access firmware for inspection; even if they did, it would be extremely challenging to detect and remediate threats at this level. Because this type of fileless malware requires high levels of sophistication and often depend on particular hardware or software configuration, it’s not an attack vector that can be exploited easily and reliably. For this reason, while extremely dangerous, threats of this type tend to be very uncommon and not practical for most attacks. +Infections of this type can be particularly difficult to detect because most antivirus products don’t have the capability to inspect firmware. In cases where a product does have the ability to inspect and detect malicious firmware, there are still significant challenges associated with remediation of threats at this level. This type of fileless malware requires high levels of sophistication and often depends on particular hardware or software configuration. It’s not an attack vector that can be exploited easily and reliably. While dangerous, threats of this type are uncommon and not practical for most attacks. ## Type II: Indirect file activity -There are other ways that malware can achieve fileless presence on a machine without requiring significant engineering effort. Fileless malware of this type doesn't directly write files on the file system, but they can end up using files indirectly. This is the case for [Poshspy backdoor](https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html). Attackers installed a malicious PowerShell command within the WMI repository and configured a WMI filter to run such command periodically. +There are other ways that malware can achieve fileless presence on a machine without requiring significant engineering effort. Fileless malware of this type doesn't directly write files on the file system, but they can end up using files indirectly. For example, with the [Poshspy backdoor](https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html) attackers installed a malicious PowerShell command within the WMI repository and configured a WMI filter to run the command periodically. -It’s possible to carry out such installation via command line without requiring the presence of the backdoor to be on a file in the first place. The malware can thus be installed and theoretically run without ever touching the file system. However, the WMI repository is stored on a physical file that is a central storage area managed by the CIM Object Manager and usually contains legitimate data. Therefore, while the infection chain does technically use a physical file, for practical purposes it’s considered a fileless attack given that the WMI repository is a multi-purpose data container that cannot be simply detected and removed. +It’s possible to carry out such installation via command line without requiring a backdoor to already be on the file. The malware can be installed and theoretically run without ever touching the file system. However, the WMI repository is stored on a physical file in a central storage area managed by the CIM Object Manager, and usually contains legitimate data. Even though the infection chain does technically use a physical file, it’s considered a fileless attack because the WMI repository is a multi-purpose data container that can't be detected and removed. ## Type III: Files required to operate -Some malware can have some sort of fileless persistence but not without using files to operate. An example for this scenario is Kovter, which creates a shell open verb handler in the registry for a random file extension. This action means that opening a file with such extension will lead to the execution of a script through the legitimate tool mshta.exe. +Some malware can have a sort of fileless persistence, but not without using files to operate. An example for this scenario is Kovter, which creates a shell open verb handler in the registry for a random file extension. Opening a file with such extension will lead to the execution of a script through the legitimate tool mshta.exe. ![Image of Kovter's registry key](images/kovter-reg-key.png)
    *Figure 2. Kovter’s registry key* -When the open verb is invoked, the associated command from the registry is launched, which results in the execution of a small script. This script reads data from a further registry key and executes it, in turn leading to the loading of the final payload. However, to trigger the open verb in the first place, Kovter has to drop a file with the same extension targeted by the verb (in the example above, the extension is .bbf5590fd). It also has to set an auto-run key configured to open such file when the machine starts. +When the open verb is invoked, the associated command from the registry is launched, which results in the execution of a small script. This script reads data from a further registry key and executes it, in turn leading to the loading of the final payload. However, to trigger the open verb in the first place, Kovter has to drop a file with the same extension targeted by the verb (in the example above, the extension is .bbf5590fd). It also has to set an autorun key configured to open such file when the machine starts. -Kovter is considered a fileless threat because the file system is of no practical use: the files with random extension contain junk data that is not usable in verifying the presence of the threat, and the files that store the registry are containers that cannot be detected and deleted if malicious content is present. +Kovter is considered a fileless threat because the file system is of no practical use. The files with random extensions contain junk data that isn't usable in verifying the presence of the threat. The files that store the registry are containers that can't be detected and deleted if malicious content is present. ## Categorizing fileless threats by infection host -Having described the broad categories, we can now dig into the details and provide a breakdown of the infection hosts. This comprehensive classification covers the panorama of what is usually referred to as fileless malware. It drives our efforts to research and develop new protection features that neutralize classes of attacks and ensure malware does not get the upper hand in the arms race. +Having described the broad categories, we can now dig into the details and provide a breakdown of the infection hosts. This comprehensive classification covers the panorama of what is usually referred to as fileless malware. It drives our efforts to research and develop new protection features that neutralize classes of attacks and ensure malware doesn't get the upper hand in the arms race. ### Exploits @@ -76,26 +77,28 @@ Having described the broad categories, we can now dig into the details and provi **Device-based** (Type I: network card, hard disk): Devices like hard disks and network cards require chipsets and dedicated software to function. Software residing and running in the chipset of a device is called firmware. Although a complex task, the firmware can be infected by malware, as the [Equation espionage group has been caught doing](https://www.kaspersky.com/blog/equation-hdd-malware/7623/). -**CPU-based** (Type I): Modern CPUs are extremely complex and may include subsystems running firmware for management purposes. Such firmware may be vulnerable to hijacking and allow the execution of malicious code that would hence operate from within the CPU. In December 2017, two researchers reported a vulnerability that can allow attackers to execute code inside the [Management Engine (ME)](https://en.wikipedia.org/wiki/Intel_Management_Engine) present in any modern CPU from Intel. Meanwhile, the attacker group PLATINUM has been observed to have the capability to use Intel's [Active Management Technology (AMT)](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) to perform [invisible network communications](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/) bypassing the installed operating system. ME and AMT are essentially autonomous micro-computers that live inside the CPU and that operate at a very low level. Because these technologies’ purpose is to provide remote manageability, they have direct access to hardware, are independent of the operating system, and can run even if the computer is turned off. Besides being vulnerable at the firmware level, CPUs could be manufactured with backdoors inserted directly in the hardware circuitry. This attack has been [researched and proved possible](https://www.emsec.rub.de/media/crypto/veroeffentlichungen/2015/03/19/beckerStealthyExtended.pdf) in the past. Just recently it has been reported that certain models of x86 processors contain a secondary embedded RISC-like CPU core that can [effectively provide a backdoor](https://www.theregister.co.uk/2018/08/10/via_c3_x86_processor_backdoor/) through which regular applications can gain privileged execution. +**CPU-based** (Type I): Modern CPUs are complex and may include subsystems running firmware for management purposes. Such firmware may be vulnerable to hijacking and allow the execution of malicious code that would operate from within the CPU. In December 2017, two researchers reported a vulnerability that can allow attackers to execute code inside the [Management Engine (ME)](https://en.wikipedia.org/wiki/Intel_Management_Engine) present in any modern CPU from Intel. Meanwhile, the attacker group PLATINUM has been observed to have the capability to use Intel's [Active Management Technology (AMT)](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) to perform [invisible network communications](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/), bypassing the installed operating system. ME and AMT are essentially autonomous micro-computers that live inside the CPU and that operate at a very low level. Because these technologies’ purpose is to provide remote manageability, they have direct access to hardware, are independent of the operating system, and can run even if the computer is turned off. -**USB-based** (Type I): USB devices of all kinds can be reprogrammed with malicious firmware capable of interacting with the operating system in nefarious ways. This is the case of the [BadUSB technique](https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/), demonstrated few years ago, which allows a reprogrammed USB stick to act as a keyboard that sends commands to machines via keystrokes, or as a network card that can redirect traffic at will. +Besides being vulnerable at the firmware level, CPUs could be manufactured with backdoors inserted directly in the hardware circuitry. This attack has been [researched and proved possible](https://www.emsec.rub.de/media/crypto/veroeffentlichungen/2015/03/19/beckerStealthyExtended.pdf) in the past. It has been reported that certain models of x86 processors contain a secondary embedded RISC-like CPU core that can [effectively provide a backdoor](https://www.theregister.co.uk/2018/08/10/via_c3_x86_processor_backdoor/) through which regular applications can gain privileged execution. -**BIOS-based** (Type I): A BIOS is a firmware running inside a chipset. It executes when a machine is powered on, initializes the hardware, and then transfers control to the boot sector. It’s a very important component that operates at a very low level and executes before the boot sector. It’s possible to reprogram the BIOS firmware with malicious code, as has happened in the past with the [Mebromi rootkit](https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/). +**USB-based** (Type I): USB devices of all kinds can be reprogrammed with malicious firmware capable of interacting with the operating system in nefarious ways. For example, the [BadUSB technique](https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/) allows a reprogrammed USB stick to act as a keyboard that sends commands to machines via keystrokes, or as a network card that can redirect traffic at will. -**Hypervisor-based** (Type I): Modern CPUs provide hardware hypervisor support, allowing the operating system to create robust virtual machines. A virtual machine runs in a confined, simulated environment, and is in theory unaware of the emulation. A malware taking over a machine may implement a small hypervisor to hide itself outside of the realm of the running operating system. Malware of this kind has been theorized in the past, and eventually real hypervisor rootkits [have been observed](http://seclists.org/fulldisclosure/2017/Jun/29), although very few are known to date. +**BIOS-based** (Type I): A BIOS is a firmware running inside a chipset. It executes when a machine is powered on, initializes the hardware, and then transfers control to the boot sector. The BIOS is an important component that operates at a low level and executes before the boot sector. It’s possible to reprogram the BIOS firmware with malicious code, as has happened in the past with the [Mebromi rootkit](https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/). + +**Hypervisor-based** (Type I): Modern CPUs provide hardware hypervisor support, allowing the operating system to create robust virtual machines. A virtual machine runs in a confined, simulated environment, and is in theory unaware of the emulation. A malware taking over a machine may implement a small hypervisor to hide itself outside of the realm of the running operating system. Malware of this kind has been theorized in the past, and eventually real hypervisor rootkits [have been observed](http://seclists.org/fulldisclosure/2017/Jun/29), although few are known to date. ### Execution and injection -**File-based** (Type III: executables, DLLs, LNK files, scheduled tasks): This is the standard execution vector. A simple executable can be launched as a first-stage malware to run an additional payload in memory or inject it into other legitimate running processes. +**File-based** (Type III: executables, DLLs, LNK files, scheduled tasks): This is the standard execution vector. A simple executable can be launched as a first-stage malware to run an additional payload in memory, or injected into other legitimate running processes. -**Macro-based** (Type III: Office documents): The [VBA language](https://msdn.microsoft.com/vba/office-shared-vba/articles/getting-started-with-vba-in-office) is a flexible and powerful tool designed to automate editing tasks and add dynamic functionality to documents. As such, it can be abused by attackers to carry out malicious operations like decoding, running, or injecting an executable payload, or even implementing an entire ransomware, like in [the case of qkG](https://blog.trendmicro.com/trendlabs-security-intelligence/qkg-filecoder-self-replicating-document-encrypting-ransomware/). Macros are executed within the context of an Office process (e.g., Winword.exe), and they’re implemented in a scripting language, so there is no binary executable that an antivirus can inspect. While Office apps require explicit consent from the user to execute macros from a document, attackers use social engineering techniques to trick users into allowing macros to execute. +**Macro-based** (Type III: Office documents): The [VBA language](https://msdn.microsoft.com/vba/office-shared-vba/articles/getting-started-with-vba-in-office) is a flexible and powerful tool designed to automate editing tasks and add dynamic functionality to documents. As such, it can be abused by attackers to carry out malicious operations like decoding, running, or injecting an executable payload, or even implementing an entire ransomware, like in [the case of qkG](https://blog.trendmicro.com/trendlabs-security-intelligence/qkg-filecoder-self-replicating-document-encrypting-ransomware/). Macros are executed within the context of an Office process (e.g., Winword.exe) and implemented in a scripting language. There's no binary executable that an antivirus can inspect. While Office apps require explicit consent from the user to execute macros from a document, attackers use social engineering techniques to trick users into allowing macros to execute. -**Script-based** (Type II: file, service, registry, WMI repo, shell): The JavaScript, VBScript, and PowerShell scripting languages are available by default on Windows platforms. Scripts have the same advantages as macros: they are textual files (not binary executables) and run within the context of the interpreter (e.g., wscript.exe, powershell.exe, etc.), which is a clean and legitimate component. Scripts are very versatile; they can be run from a file (e.g., by double-clicking them) or, in some cases, executed directly on the command line of an interpreter. Being able to run on the command line can allow malware to encode malicious command-line scripts as auto-start services inside [autorun registry keys](https://www.gdatasoftware.com/blog/2014/07/23947-poweliks-the-persistent-malware-without-a-file) as [WMI event subscriptions](https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html) from the WMI repo. Furthermore, an attacker who has gained access to an infected machine may input the script on the command prompt. +**Script-based** (Type II: file, service, registry, WMI repo, shell): The JavaScript, VBScript, and PowerShell scripting languages are available by default on Windows platforms. Scripts have the same advantages as macros, they are textual files (not binary executables) and run within the context of the interpreter (like wscript.exe, powershell.exe), which is a clean and legitimate component. Scripts are versatile and can be run from a file (by double-clicking them) or executed directly on the command line of an interpreter. Running on the command line allows malware to encode malicious scripts as autostart services inside [autorun registry keys](https://www.gdatasoftware.com/blog/2014/07/23947-poweliks-the-persistent-malware-without-a-file) as [WMI event subscriptions](https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html) from the WMI repo. Furthermore, an attacker who has gained access to an infected machine may input the script on the command prompt. -**Disk-based** (Type II: Boot Record): The [Boot Record](https://en.wikipedia.org/wiki/Boot_sector) is the first sector of a disk or volume and contains executable code required to start the boot process of the operating system. Threats like [Petya](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/?source=mmpc) are capable of infecting the Boot Record by overwriting it with malicious code, so that when the machine is booted the malware immediately gains control (and in the case of Petya, with disastrous consequences). The Boot Record resides outside the file system, but it’s accessible by the operating system, and modern antivirus products have the capability to scan and restore it. +**Disk-based** (Type II: Boot Record): The Boot Record is the first sector of a disk or volume, and contains executable code required to start the boot process of the operating system. Threats like [Petya](https://cloudblogs.microsoft.com/microsoftsecure/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/?source=mmpc) are capable of infecting the Boot Record by overwriting it with malicious code. When the machine is booted, the malware immediately gains control. The Boot Record resides outside the file system, but it’s accessible by the operating system. Modern antivirus products have the capability to scan and restore it. ## Defeating fileless malware -At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions that continuously enhance Windows security and mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, Microsoft Defender Advanced Threat Protection [(Microsoft Defender ATP)](https://www.microsoft.com/windowsforbusiness?ocid=docs-fileless) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats. +At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions to mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, Microsoft Defender for Endpoint](https://www.microsoft.com/windowsforbusiness?ocid=docs-fileless) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats. To learn more, read: [Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/27/out-of-sight-but-not-invisible-defeating-fileless-malware-with-behavior-monitoring-amsi-and-next-gen-av/) diff --git a/windows/security/threat-protection/intelligence/images/msi-contoso-approval-required.png b/windows/security/threat-protection/intelligence/images/msi-contoso-approval-required.png new file mode 100644 index 0000000000..90bc4428f9 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/msi-contoso-approval-required.png differ diff --git a/windows/security/threat-protection/intelligence/images/msi-enterprise-app-user-setting.jpg b/windows/security/threat-protection/intelligence/images/msi-enterprise-app-user-setting.jpg new file mode 100644 index 0000000000..e68ffa40aa Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/msi-enterprise-app-user-setting.jpg differ diff --git a/windows/security/threat-protection/intelligence/images/msi-grant-admin-consent.jpg b/windows/security/threat-protection/intelligence/images/msi-grant-admin-consent.jpg new file mode 100644 index 0000000000..2bb2627bc2 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/msi-grant-admin-consent.jpg differ diff --git a/windows/security/threat-protection/intelligence/images/msi-microsoft-permission-requested-your-organization.png b/windows/security/threat-protection/intelligence/images/msi-microsoft-permission-requested-your-organization.png new file mode 100644 index 0000000000..e423857bff Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/msi-microsoft-permission-requested-your-organization.png differ diff --git a/windows/security/threat-protection/intelligence/images/msi-microsoft-permission-required.jpg b/windows/security/threat-protection/intelligence/images/msi-microsoft-permission-required.jpg new file mode 100644 index 0000000000..fdac1cd4be Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/msi-microsoft-permission-required.jpg differ diff --git a/windows/security/threat-protection/intelligence/images/msi-permissions.jpg b/windows/security/threat-protection/intelligence/images/msi-permissions.jpg new file mode 100644 index 0000000000..957c78aac1 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/msi-permissions.jpg differ diff --git a/windows/security/threat-protection/intelligence/images/msi-properties.png b/windows/security/threat-protection/intelligence/images/msi-properties.png new file mode 100644 index 0000000000..196a5fce92 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/msi-properties.png differ diff --git a/windows/security/threat-protection/intelligence/index.md b/windows/security/threat-protection/intelligence/index.md index 68203c0963..819ce7f08a 100644 --- a/windows/security/threat-protection/intelligence/index.md +++ b/windows/security/threat-protection/intelligence/index.md @@ -1,8 +1,8 @@ --- title: Security intelligence -description: Safety tips about malware and how you can protect your organization +description: Learn about different types of malware, safety tips on how you can protect your organization, and resources for industry collaboration programs. keywords: security, malware -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -10,14 +10,17 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- # Security intelligence -Here you will find information about different types of malware, safety tips on how you can protect your organization, and resources for industry collaboration programs +Here you will find information about different types of malware, safety tips on how you can protect your organization, and resources for industry collaboration programs. * [Understand malware & other threats](understanding-malware.md) +* [Prevent malware infection](prevent-malware-infection.md) +* [Malware naming convention](malware-naming.md) * [How Microsoft identifies malware and PUA](criteria.md) * [Submit files for analysis](submission-guide.md) * [Safety Scanner download](safety-scanner-download.md) diff --git a/windows/security/threat-protection/intelligence/macro-malware.md b/windows/security/threat-protection/intelligence/macro-malware.md index ec97b244a7..6faec90f87 100644 --- a/windows/security/threat-protection/intelligence/macro-malware.md +++ b/windows/security/threat-protection/intelligence/macro-malware.md @@ -3,7 +3,7 @@ title: Macro malware ms.reviewer: description: Learn about macro viruses and malware, which are embedded in documents and are used to drop malicious payloads and distribute other threats. keywords: security, malware, macro, protection, WDSI, MMPC, Microsoft Malware Protection Center, macro virus, macro malware, documents, viruses in Office, viruses in Word -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Macro malware @@ -21,18 +22,18 @@ Macros are a powerful way to automate common tasks in Microsoft Office and can m ## How macro malware works -Macro malware hides in Microsoft Office files and are delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. +Macro malware hides in Microsoft Office files and is delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. -Macro malware was fairly common several years ago because macros ran automatically whenever a document was opened. However, in recent versions of Microsoft Office, macros are disabled by default. This means malware authors need to convince users to turn on macros so that their malware can run. They do this by showing fake warnings when a malicious document is opened. +Macro malware was fairly common several years ago because macros ran automatically whenever a document was opened. In recent versions of Microsoft Office, macros are disabled by default. Now, malware authors need to convince users to turn on macros so that their malware can run. They try to scare users by showing fake warnings when a malicious document is opened. We've seen macro malware download threats from the following families: -* [Ransom:MSIL/Swappa](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:MSIL/Swappa.A) -* [Ransom:Win32/Teerac](Ransom:Win32/Teerac) -* [TrojanDownloader:Win32/Chanitor](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chanitor.A) -* [TrojanSpy:Win32/Ursnif](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif) -* [Win32/Fynloski](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) -* [Worm:Win32/Gamarue](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue) +* [Ransom:MSIL/Swappa](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:MSIL/Swappa.A) +* [Ransom:Win32/Teerac](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Teerac&threatId=-2147277789) +* [TrojanDownloader:Win32/Chanitor](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chanitor.A) +* [TrojanSpy:Win32/Ursnif](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif) +* [Win32/Fynloski](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) +* [Worm:Win32/Gamarue](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue) ## How to protect against macro malware @@ -43,8 +44,8 @@ We've seen macro malware download threats from the following families: * Delete any emails from unknown people or with suspicious content. Spam emails are the main way macro malware spreads. -* Enterprises can prevent macro malware from running executable content using [ASR rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#enable-and-audit-attack-surface-reduction-rules) +* Enterprises can prevent macro malware from running executable content using [ASR rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) -For more tips on protecting yourself from suspicious emails, see [phishing](phishing.md). +For more tips on protecting yourself from suspicious emails, see [phishing](phishing.md). -For more general tips, see [prevent malware infection](prevent-malware-infection.md). +For more general tips, see [prevent malware infection](prevent-malware-infection.md). diff --git a/windows/security/threat-protection/intelligence/malware-naming.md b/windows/security/threat-protection/intelligence/malware-naming.md index 2a52b19798..abd3753a03 100644 --- a/windows/security/threat-protection/intelligence/malware-naming.md +++ b/windows/security/threat-protection/intelligence/malware-naming.md @@ -1,9 +1,9 @@ --- title: Malware names ms.reviewer: -description: Understand the malware naming convention used by Windows Defender Antivirus and other Microsoft antimalware. +description: Understand the malware naming convention used by Microsoft Defender Antivirus and other Microsoft antimalware. keywords: security, malware, names, Microsoft, MMPC, Microsoft Malware Protection Center, WDSI, malware name, malware prefix, malware type, virus name -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Malware names @@ -21,7 +22,7 @@ We name the malware and unwanted software that we detect according to the Comput ![coordinated-malware-eradication](images/NamingMalware1.png) -When our analysts research a particular threat, they will determine what each of the components of the name will be. +When our analysts research a particular threat, they'll determine what each of the components of the name will be. ## Type @@ -61,7 +62,7 @@ Describes what the malware does on your computer. Worms, viruses, trojans, backd ## Platforms -Indicates the operating system (such as Windows, Mac OS X, and Android) that the malware is designed to work on. The platform is also used to indicate programming languages and file formats. +Platforms indicate the operating system (such as Windows, masOS X, and Android) the malware is designed to work on. The platform is also used to indicate programming languages and file formats. ### Operating systems @@ -71,8 +72,8 @@ Indicates the operating system (such as Windows, Mac OS X, and Android) that the * FreeBSD: FreeBSD platform * iPhoneOS: iPhone operating system * Linux: Linux platform -* MacOS: MAC 9.x platform or earlier -* MacOS_X: MacOS X or later +* macOS: MAC 9.x platform or earlier +* macOS_X: MacOS X or later * OS2: OS2 platform * Palm: Palm operating system * Solaris: System V-based Unix platforms @@ -105,11 +106,11 @@ Indicates the operating system (such as Windows, Mac OS X, and Android) that the * INF: Install scripts * IRC: mIRC/pIRC scripts * Java: Java binaries (classes) -* JS: Javascript scripts +* JS: JavaScript scripts * LOGO: LOGO scripts * MPB: MapBasic scripts * MSH: Monad shell scripts -* MSIL: .Net intermediate language scripts +* MSIL: .NET intermediate language scripts * Perl: Perl scripts * PHP: Hypertext Preprocessor scripts * Python: Python scripts @@ -125,7 +126,7 @@ Indicates the operating system (such as Windows, Mac OS X, and Android) that the * A97M: Access 97, 2000, XP, 2003, 2007, and 2010 macros * HE: macro scripting -* O97M: Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and Powerpoint +* O97M: Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and PowerPoint * PP97M: PowerPoint 97, 2000, XP, 2003, 2007, and 2010 macros * V5M: Visio5 macros * W1M: Word1Macro diff --git a/windows/security/threat-protection/intelligence/phishing-trends.md b/windows/security/threat-protection/intelligence/phishing-trends.md new file mode 100644 index 0000000000..d8cd025a74 --- /dev/null +++ b/windows/security/threat-protection/intelligence/phishing-trends.md @@ -0,0 +1,70 @@ +--- +title: Phishing trends and techniques +ms.reviewer: +description: Learn about how to spot phishing techniques +keywords: security, malware, phishing, information, scam, social engineering, bait, lure, protection, trends, targeted attack, spear phishing, whaling +ms.prod: m365-security +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +search.appverid: met150 +ms.technology: mde +--- + +# Phishing trends and techniques + +Phishing attacks are scams that often use social engineering bait or lure content. Legitimate-looking communication, usually email, that links to a phishing site is one of the most common methods used in phishing attacks. The phishing site typically mimics sign in pages that require users to input credentials and account information. The phishing site then captures the sensitive information as soon as the user provides it, giving attackers access to the information. + +Below are some of the most common phishing techniques attackers will employ to try to steal information or gain access to your devices. + +## Invoice phishing + +In this scam, the attacker attempts to lure you with an email stating that you have an outstanding invoice from a known vendor or company. They then provide a link for you to access and pay your invoice. When you access the site, the attacker is poised to steal your personal information and funds. + +## Payment/delivery scam + +You're asked to provide a credit card or other personal information so that your payment information can be updated with a commonly known vendor or supplier. The update is requested so that you can take delivery of your ordered goods. Generally, you may be familiar with the company and have likely done business with them in the past. However, you aren't aware of any items you have recently purchased from them. + +## Tax-themed phishing scams + +A common IRS phishing scam is receiving an urgent email letter indicating that you owe money to the IRS. Often the email threatens legal action if you don't access the site in a timely manner and pay your taxes. When you access the site, the attackers can steal your personal credit card or bank information and drain your accounts. + +## Downloads + +An attacker sends a fraudulent email requesting you to open or download a document attachment, such as a PDF. The attachment often contains a message asking you to sign in to another site, such as email or file sharing websites, to open the document. When you access these phishing sites using your sign-in credentials, the attacker now has access to your information and can gain additional personal information about you. + +## Phishing emails that deliver other threats + +Phishing emails are often effective, so attackers sometimes use them to distribute [ransomware](ransomware-malware.md) through links or attachments in emails. When run, the ransomware encrypts files and displays a ransom note, which asks you to pay a sum of money to access to your files. + +We have also seen phishing emails that have links to [tech support scam](support-scams.md) websites. These websites use various scare tactics to trick you into calling hotlines and paying for unnecessary "technical support services" that supposedly fix contrived device, platform, or software problems. + +## Spear phishing + +Spear phishing is a targeted phishing attack that involves highly customized lure content. Attackers will typically do reconnaissance work by surveying social media and other information sources about their intended target. + +Spear phishing may involve tricking you into logging into fake sites and divulging credentials. I may also lure you into opening documents by clicking on links that automatically install malware. With this malware in place, attackers can remotely manipulate the infected computer. + +The implanted malware serves as the point of entry for a more sophisticated attack, known as an advanced persistent threat (APT). APTs are designed to establish control and steal data over extended periods. Attackers may try to deploy more covert hacking tools, move laterally to other computers, compromise or create privileged accounts, and regularly exfiltrate information from compromised networks. + +## Whaling + +Whaling is a form of phishing directed at high-level or senior executives within specific companies to gain access to their credentials and/or bank information. The content of the email may be written as a legal subpoena, customer complaint, or other executive issue. This type of attack can also lead to an APT attack within an organization. + +## Business email compromise + +Business email compromise (BEC) is a sophisticated scam that targets businesses who frequently work with foreign suppliers or do money wire transfers. One of the most common schemes used by BEC attackers involves gaining access to a company’s network through a spear phishing attack. The attacker creates a domain similar to the company they're targeting, or spoofs their email to scam users into releasing personal account information for money transfers. + +## More information about phishing attacks + +For information on the latest phishing attacks, techniques, and trends, you can read these entries on the [Microsoft Security blog](https://www.microsoft.com/security/blog/product/windows/): + +- [Phishers unleash simple but effective social engineering techniques using PDF attachments](https://cloudblogs.microsoft.com/microsoftsecure/2017/01/26/phishers-unleash-simple-but-effective-social-engineering-techniques-using-pdf-attachments/?source=mmpc) +- [Tax themed phishing and malware attacks proliferate during the tax filing season](https://cloudblogs.microsoft.com/microsoftsecure/2017/03/20/tax-themed-phishing-and-malware-attacks-proliferate-during-the-tax-filing-season/?source=mmpc) +- [Phishing like emails lead to tech support scam](https://cloudblogs.microsoft.com/microsoftsecure/2017/08/07/links-in-phishing-like-emails-lead-to-tech-support-scam/?source=mmpc) diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md index 4f5d3c7278..20bf7cc3fd 100644 --- a/windows/security/threat-protection/intelligence/phishing.md +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -1,9 +1,9 @@ --- -title: Phishing +title: How to protect against phishing attacks ms.reviewer: description: Learn about how phishing work, deliver malware do your devices, and what you can do to protect yourself keywords: security, malware, phishing, information, scam, social engineering, bait, lure, protection, trends, targeted attack -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,135 +11,92 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- -# Phishing +# How to protect against phishing attacks -Phishing attacks attempt to steal sensitive information through emails, websites, text messages, or other forms of electronic communication that often look to be official communication from legitimate companies or individuals. +Phishing attacks attempt to steal sensitive information through emails, websites, text messages, or other forms of electronic communication. They try to look like official communication from legitimate companies or individuals. -The information that phishers (as the cybercriminals behind phishing attacks are called) attempt to steal can be user names and passwords, credit card details, bank account information, or other credentials. Attackers can then use stolen information for malicious purposes, such as hacking, identity theft, or stealing money directly from bank accounts and credit cards. Phishers can also sell the information in cybercriminal underground marketplaces. - -## How phishing works - -Phishing attacks are scams that often use social engineering bait or lure content. For example, during tax season, bait content involves tax-filing announcements that attempt to lure you into providing your personal information such as your Social Security number or bank account information. - -Legitimate-looking communication, usually email, that links to a phishing site is one of the most common methods used in phishing attacks. The phishing site typically mimics sign-in pages that require users to input login credentials and account information. The phishing site then captures the sensitive information as soon as the user provides it, giving attackers access to the information. - -Another common phishing technique is the use of emails that direct you to open a malicious attachment, for example a PDF file. The attachment often contains a message asking you to provide login credentials to another site such as email or file sharing websites to open the document. When you access these phishing sites using your login credentials, the attacker now has access to your information and can gain additional personal information about you. - -## Phishing trends and techniques - -### Invoice phishing - -In this scam, the attacker attempts to lure you with an email stating that you have an outstanding invoice from a known vendor or company and provides a link for you to access and pay your invoice. When you access the site, the attacker is poised to steal your personal information and funds. - -### Payment/delivery scam - -You are asked to provide a credit card or other personal information so that your payment information can be updated with a commonly known vendor or supplier. The update is requested so that you can take delivery of your ordered goods. Generally, you may be familiar with the company and have likely done business with them in the past, but you are not aware of any items you have recently purchased from them. - -### Tax-themed phishing scams - -A common IRS phishing scams is one in which an urgent email letter is sent indicating that you owe money to the IRS. Often the email threatens legal action if you do not access the site in a timely manner and pay your taxes. When you access the site, the attackers can steal your personal credit card or bank information and drain your accounts. - -### Downloads - -Another frequently-used phishing scam is one in which an attacker sends a fraudulent email requesting you to open or download a document, often one requiring you to sign in. - -### Phishing emails that deliver other threats - -Phishing emails can be very effective, and so attackers can using them to distribute [ransomware](ransomware-malware.md) through links or attachments in emails. When run, the ransomware encrypts files and displays a ransom note, which asks you to pay a sum of money to access to your files. - -We have also seen phishing emails that have links to [tech support scam](support-scams.md) websites, which use various scare tactics to trick you into calling hotlines and paying for unnecessary "technical support services" that supposedly fix contrived device, platform, or software problems. - -## Targeted attacks against enterprises - -### Spear phishing - -Spear phishing is a targeted phishing attack that involves highly customized lure content. To perform spear phishing, attackers will typically do reconnaissance work, surveying social media and other information sources about their intended target. - -Spear phishing may involve tricking you into logging into fake sites and divulging credentials. Spear phishing may also be designed to lure you into opening documents by clicking on links that automatically install malware. With this malware in place, attackers can remotely manipulate the infected computer. - -The implanted malware serves as the point of entry for a more sophisticated attack known as an advanced persistent threat (APT). APTs are generally designed to establish control and steal data over extended periods. As part of the attack, attackers often try to deploy more covert hacking tools, move laterally to other computers, compromise or create privileged accounts, and regularly exfiltrate information from compromised networks. - -### Whaling - -Whaling is a form of phishing in which the attack is directed at high-level or senior executives within specific companies with the direct goal of gaining access to their credentials and/or bank information. The content of the email may be written as a legal subpoena, customer complaint, or other executive issue. This type of attack can also lead to an APT attack within an organization. When the links or attachment are opened, it can assist the attacker in accessing credentials and other personal information, or launch a malware that will lead to an APT. - -### Business email compromise - -Business email compromise (BEC) is a sophisticated scam that targets businesses often working with foreign suppliers and businesses that regularly perform wire transfer payments. One of the most common schemes used by BEC attackers involves gaining access to a company’s network through a spear phishing attack, where the attacker creates a domain similar to the company they are targeting or spoofs their email to scam users into releasing personal account information for money transfers. - -## How to protect against phishing attacks +Cybercriminals often attempt to steal usernames, passwords, credit card details, bank account information, or other credentials. They use stolen information for malicious purposes, such as hacking, identity theft, or stealing money directly from bank accounts and credit cards. The information can also be sold in cybercriminal underground markets. Social engineering attacks are designed to take advantage of a user's possible lapse in decision-making. Be aware and never provide sensitive or personal information through email or unknown websites, or over the phone. Remember, phishing emails are designed to appear legitimate. -### Awareness +## Learn the signs of a phishing scam -The best protection is awareness and education. Don’t open attachments or click links in unsolicited emails, even if the emails came from a recognized source. If the email is unexpected, be wary about opening the attachment and verify the URL. +The best protection is awareness and education. Don’t open attachments or links in unsolicited emails, even if the emails came from a recognized source. If the email is unexpected, be wary about opening the attachment and verify the URL. -Enterprises should educate and train their employees to be wary of any communication that requests personal or financial information, and instruct them to report the threat to the company’s security operations team immediately. +Enterprises should educate and train their employees to be wary of any communication that requests personal or financial information. They should also instruct employees to report the threat to the company’s security operations team immediately. Here are several telltale signs of a phishing scam: -* The links or URLs provided in emails are **not pointing to the correct location** or are attempting to have you access a third-party site that is not affiliated with the sender of the email. For example, in the image below the URL provided does not match the URL that you will be taken to. +* The links or URLs provided in emails are **not pointing to the correct location** or are pointing to a third-party site not affiliated with the sender of the email. For example, in the image below the URL provided doesn't match the URL that you'll be taken to. ![example of how exploit kits work](./images/URLhover.png) -* There is a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email. +* There's a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email. -* **Items in the email address will be changed** so that it is similar enough to a legitimate email address but has added numbers or changed letters. +* **Items in the email address will be changed** so that it is similar enough to a legitimate email address, but has added numbers or changed letters. * The message is **unexpected and unsolicited**. If you suddenly receive an email from an entity or a person you rarely deal with, consider this email suspect. -* The message or the attachment asks you to **enable macros, adjust security settings, or install applications**. Normal emails will not ask you to do this. +* The message or the attachment asks you to **enable macros, adjust security settings, or install applications**. Normal emails won't ask you to do this. * The message contains **errors**. Legitimate corporate messages are less likely to have typographic or grammatical errors or contain wrong information. -* The **sender address does not match** the signature on the message itself. For example, an email is purported to be from Mary of Contoso Corp, but the sender address is john@example.com. +* The **sender address doesn't match the signature** on the message itself. For example, an email is purported to be from Mary of Contoso Corp, but the sender address is john@example.com. * There are **multiple recipients** in the “To” field and they appear to be random addresses. Corporate messages are normally sent directly to individual recipients. -* The greeting on the message itself **does not personally address you**. Apart from messages that mistakenly address a different person, those that misuse your name or pull your name directly from your email address tend to be malicious. +* The greeting on the message itself **doesn't personally address you**. Apart from messages that mistakenly address a different person, greetings that misuse your name or pull your name directly from your email address tend to be malicious. -* The website looks familiar but there are **inconsistencies or things that are not quite right** such as outdated logos, typos, or ask users to give additional information that is not asked by legitimate sign-in websites. +* The website looks familiar but there are **inconsistencies or things that aren't quite right**. Warning signs include outdated logos, typos, or ask users to give additional information that is not asked by legitimate sign-in websites. -* The page that opens is **not a live page** but rather an image that is designed to look like the site you are familiar with. A pop-up may appear that requests credentials. +* The page that opens is **not a live page**, but rather an image that is designed to look like the site you are familiar with. A pop-up may appear that requests credentials. If in doubt, contact the business by known channels to verify if any suspicious emails are in fact legitimate. -For more information, download and read this Microsoft [e-book on preventing social engineering attacks](https://info.microsoft.com/Protectyourweakestlink.html?ls=social), especially in enterprise environments. +## Software solutions for organizations -### Software solutions for organizations - -* [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) and [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) offer protection from the increasing threat of targeted attacks using Microsoft's industry leading Hyper-V virtualization technology. If a browsed website is deemed untrusted, the Hyper-V container will isolate that device from the rest of your network thereby preventing access to your enterprise data. +* [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) and [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) offer protection from the increasing threat of targeted attacks using Microsoft's industry-leading Hyper-V virtualization technology. If a browsed website is deemed untrusted, the Hyper-V container will isolate that device from the rest of your network thereby preventing access to your enterprise data. * [Microsoft Exchange Online Protection (EOP)](https://products.office.com/exchange/exchange-email-security-spam-protection) offers enterprise-class reliability and protection against spam and malware, while maintaining access to email during and after emergencies. Using various layers of filtering, EOP can provide different controls for spam filtering, such as bulk mail controls and international spam, that will further enhance your protection services. -* Use [Office 365 Advanced Threat Protection (ATP)](https://products.office.com/exchange/online-email-threat-protection?ocid=cx-blog-mmpc) to help protect your email, files, and online storage against malware. It offers holistic protection in Microsoft Teams, Word, Excel, PowerPoint, Visio, SharePoint Online, and OneDrive for Business. By protecting against unsafe attachments and expanding protection against malicious links, it complements the security features of Exchange Online Protection to provide better zero-day protection. +* Use [Microsoft Defender for Office 365](https://products.office.com/exchange/online-email-threat-protection?ocid=cx-blog-mmpc) to help protect your email, files, and online storage against malware. It offers holistic protection in Microsoft Teams, Word, Excel, PowerPoint, Visio, SharePoint Online, and OneDrive for Business. By protecting against unsafe attachments and expanding protection against malicious links, it complements the security features of Exchange Online Protection to provide better zero-day protection. -For more tips and software solutions, see [prevent malware infection](prevent-malware-infection.md). +## What to do if you've been a victim of a phishing scam -## What do I do if I've already been a victim of a phishing scam? +If you feel you've been a victim of a phishing attack: -If you feel that you have been a victim of a phishing attack, contact your IT Admin. You should also immediately change all passwords associated with the accounts, and report any fraudulent activity to your bank, credit card company, etc. +1. Contact your IT admin if you are on a work computer +2. Immediately change all passwords associated with the accounts +3. Report any fraudulent activity to your bank and credit card company ### Reporting spam -Submit phishing scam emails to **Microsoft** by sending an email with the scam as an attachment to: phish@office365.microsoft.com. For more information on submitting messages to Microsoft, see [Submit spam, non-spam, and phishing scam messages to Microsoft for analysis](https://docs.microsoft.com/office365/SecurityCompliance/submit-spam-non-spam-and-phishing-scam-messages-to-microsoft-for-analysis). +- **Outlook.com**: If you receive a suspicious email message that asks for personal information, select the check box next to the message in your Outlook inbox. Select the arrow next to **Junk**, and then select **Phishing**. -For Outlook and Outlook on the web users, use the **Report Message Add-in** for Microsoft Outlook. For information about how to install and use this tool, see [Enable the Report Message add-in](https://support.office.com/article/4250c4bc-6102-420b-9e0a-a95064837676). +- **Microsoft Office Outlook**: While in the suspicious message, select **Report message** from the ribbon, and then select **Phishing**. -Send an email with the phishing scam to **The Anti-Phishing Working Group**: reportphishing@apwg.org. The group uses reports generated from emails sent to fight phishing scams and hackers. ISPs, security vendors, financial institutions and law enforcement agencies are involved. +- **Microsoft**: Create a new, blank email message with the one of the following recipients: + - Junk: junk@office365.microsoft.com + - Phishing: phish@office365.microsoft.com -## Where to find more information about phishing attacks + Drag and drop the junk or phishing message into the new message. This will save the junk or phishing message as an attachment in the new message. Don't copy and paste the content of the message or forward the message (we need the original message so we can inspect the message headers). For more information, see [Submit spam, non-spam, and phishing scam messages to Microsoft for analysis](https://docs.microsoft.com/office365/SecurityCompliance/submit-spam-non-spam-and-phishing-scam-messages-to-microsoft-for-analysis). -For information on the latest phishing attacks, techniques, and trends, you can read these entries on the [Microsoft Security blog](https://www.microsoft.com/security/blog/product/windows/): +- **Anti-Phishing Working Group**: phishing-report@us-cert.gov. The group uses reports generated from emails sent to fight phishing scams and hackers. ISPs, security vendors, financial institutions, and law enforcement agencies are involved. -* [Phishers unleash simple but effective social engineering techniques using PDF attachments](https://cloudblogs.microsoft.com/microsoftsecure/2017/01/26/phishers-unleash-simple-but-effective-social-engineering-techniques-using-pdf-attachments/?source=mmpc) +### If you’re on a suspicious website -* [Tax themed phishing and malware attacks proliferate during the tax filing season](https://cloudblogs.microsoft.com/microsoftsecure/2017/03/20/tax-themed-phishing-and-malware-attacks-proliferate-during-the-tax-filing-season/?source=mmpc) +- **Microsoft Edge**: While you’re on a suspicious site, select the **More (…) icon** > **Help and feedback** > **Report Unsafe site**. Follow the instructions on the webpage that displays to report the website. -* [Phishing like emails lead to tech support scam](https://cloudblogs.microsoft.com/microsoftsecure/2017/08/07/links-in-phishing-like-emails-lead-to-tech-support-scam/?source=mmpc) +- **Internet Explorer**: While you’re on a suspicious site, select the gear icon, point to **Safety**, and then select **Report Unsafe Website**. Follow the instructions on the webpage that displays to report the website. + +## More information about phishing attacks + +- [Protect yourself from phishing](https://support.microsoft.com/help/4033787/windows-protect-yourself-from-phishing) +- [Phishing trends](phishing-trends.md) +- [Microsoft e-book on preventing social engineering attacks](https://info.microsoft.com/Protectyourweakestlink.html?ls=social), especially in enterprise environments. diff --git a/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md b/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md new file mode 100644 index 0000000000..e84f8e37a8 --- /dev/null +++ b/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md @@ -0,0 +1,90 @@ +--- +title: Troubleshoot MSI portal errors caused by admin block +description: Troubleshoot MSI portal errors +ms.reviewer: +keywords: security, sample submission help, malware file, virus file, trojan file, submit, send to Microsoft, submit a sample, virus, trojan, worm, undetected, doesn’t detect, email microsoft, email malware, I think this is malware, I think it's a virus, where can I send a virus, is this a virus, MSE, doesn’t detect, no signature, no detection, suspect file, MMPC, Microsoft Malware Protection Center, researchers, analyst, WDSI, security intelligence +ms.prod: m365-security +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: dansimp +author: dansimp +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +search.appverid: met150 +ms.technology: mde +--- + +# Troubleshooting malware submission errors caused by administrator block +In some instances, an administrator block might cause submission issues when you try to submit a potentially infected file to the [Microsoft Security intelligence website](https://www.microsoft.com/wdsi) for analysis. The following process shows how to resolve this problem. + +## Review your settings +Open your Azure [Enterprise application settings](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/UserSettings/menuId/). Under **Enterprise Applications** > **Users can consent to apps accessing company data on their behalf**, check whether Yes or No is selected. + +- If **No** is selected, an Azure AD administrator for the customer tenant will need to provide consent for the organization. Depending on the configuration with Azure AD, users might be able to submit a request right from the same dialog box. If there’s no option to ask for admin consent, users need to request for these permissions to be added to their Azure AD admin. Go to the following section for more information. + +- If **Yes** is selected, ensure the Windows Defender Security Intelligence app setting **Enabled for users to sign in?** is set to **Yes** [in Azure](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Properties/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/4a918a14-4069-4108-9b7d-76486212d75d). If **No** is selected, you'll need to request an Azure AD admin enable it. +  +## Implement Required Enterprise Application permissions +This process requires a global or application admin in the tenant. + 1. Open [Enterprise Application settings](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Permissions/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/4a918a14-4069-4108-9b7d-76486212d75d). + 2. Select **Grant admin consent for organization**. + 3. If you're able to do so, review the API permissions required for this application, as the following image shows. Provide consent for the tenant. + + ![grant consent image](images/msi-grant-admin-consent.jpg) + + 4. If the administrator receives an error while attempting to provide consent manually, try either [Option 1](#option-1-approve-enterprise-application-permissions-by-user-request) or [Option 2](#option-2-provide-admin-consent-by-authenticating-the-application-as-an-admin) as possible workarounds. +  +## Option 1 Approve enterprise application permissions by user request +> [!Note] +> This is currently a preview feature. + +Azure Active Directory admins will need to allow for users to request admin consent to apps. Verify the setting is configured to **Yes** in [Enterprise applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/UserSettings/menuId/). + +![Enterprise applications user settings](images/msi-enterprise-app-user-setting.jpg) + +More information is available in [Configure Admin consent workflow](https://docs.microsoft.com/azure/active-directory/manage-apps/configure-admin-consent-workflow). + +Once this setting is verified, users can go through the enterprise customer sign-in at [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission), and submit a request for admin consent, including justification. + +![Contoso sign in flow](images/msi-contoso-approval-required.png) + +Admin will be able to review and approve the application permissions [Azure admin consent requests](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/AccessRequests/menuId/). + +After providing consent, all users in the tenant will be able to use the application. +  +## Option 2 Provide admin consent by authenticating the application as an admin +This process requires that global admins go through the Enterprise customer sign-in flow at [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission). + +![Consent sign in flow](images/msi-microsoft-permission-required.jpg) + +Then, admins review the permissions and make sure to select **Consent on behalf of your organization**, and then select **Accept**. + +All users in the tenant will now be able to use this application. + +## Option 3: Delete and readd app permissions +If neither of these options resolve the issue, try the following steps (as an admin): + +1. Remove previous configurations for the application. Go to [Enterprise applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Properties/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/982e94b2-fea9-4d1f-9fca-318cda92f90b) +and select **delete**. + + ![Delete app permissions](images/msi-properties.png) + +2. Capture TenantID from [Properties](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Properties). + +3. Replace {tenant-id} with the specific tenant that needs to grant consent to this application in the URL below. Copy this URL into browser. The rest of the parameters are already completed. +``https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=f0cf43e5-8a9b-451c-b2d5-7285c785684d&state=12345&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fwdsi%2ffilesubmission&scope=openid+profile+email+offline_access`` + + ![Permissions needed](images/msi-microsoft-permission-requested-your-organization.png) + +4. Review the permissions required by the application, and then select **Accept**. + +5. Confirm the permissions are applied in the [Azure portal](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Permissions/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/ce60a464-5fca-4819-8423-bcb46796b051). + + ![Review that permissions are applied](images/msi-permissions.jpg) + +6. Sign in to [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission) as an enterprise user with a non-admin account to see if you have access. + + If the warning is not resolved after following these troubleshooting steps, call Microsoft support. diff --git a/windows/security/threat-protection/intelligence/prevent-malware-infection.md b/windows/security/threat-protection/intelligence/prevent-malware-infection.md index 3313e1d680..45f1877661 100644 --- a/windows/security/threat-protection/intelligence/prevent-malware-infection.md +++ b/windows/security/threat-protection/intelligence/prevent-malware-infection.md @@ -3,7 +3,7 @@ title: Prevent malware infection ms.reviewer: description: Learn steps you can take to help prevent a malware or potentially unwanted software from infecting your computer. keywords: security, malware, prevention, infection, tips, Microsoft, MMPC, Microsoft Malware Protection Center, virus, trojan, worm, stop, prevent, full scan, infection, avoid malware, avoid trojan, avoid virus, infection, how, detection, security software, antivirus, updates, how malware works, how virus works, firewall, turn on, user privileges, limit, prevention, WDSI, MMPC, Microsoft Malware Protection Center -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Prevent malware infection @@ -103,11 +104,11 @@ Microsoft provides comprehensive security capabilities that help protect against * [Microsoft 365](https://docs.microsoft.com/microsoft-365/enterprise/) includes Office 365, Windows 10, and Enterprise Mobility + Security. These resources power productivity while providing intelligent security across users, devices, and data. -* [Office 365 Advanced Threat Protection](https://docs.microsoft.com/office365/servicedescriptions/office-365-advanced-threat-protection-service-description) includes machine learning capabilities that block dangerous emails, including millions of emails carrying ransomware downloaders. +* [Microsoft Defender for Office 365](https://docs.microsoft.com/office365/servicedescriptions/office-365-advanced-threat-protection-service-description) includes machine learning capabilities that block dangerous emails, including millions of emails carrying ransomware downloaders. * [OneDrive for Business](https://support.office.com/article/restore-a-previous-version-of-a-file-in-onedrive-159cad6d-d76e-4981-88ef-de6e96c93893?ui=en-US&rs=en-US&ad=US) can back up files, which you would then use to restore files in the event of an infection. -* [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) provides comprehensive endpoint protection, detection, and response capabilities to help prevent ransomware. In the event of a breach, Microsoft Defender ATP alerts security operations teams about suspicious activities and automatically attempts to resolve the problem. This includes alerts for suspicious PowerShell commands, connecting to a TOR website, launching self-replicated copies, and deletion of volume shadow copies. Try Microsoft Defender ATP free of charge. +* [Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) provides comprehensive endpoint protection, detection, and response capabilities to help prevent ransomware. In the event of a breach, Microsoft Defender for Endpoint alerts security operations teams about suspicious activities and automatically attempts to resolve the problem. This includes alerts for suspicious PowerShell commands, connecting to a TOR website, launching self-replicated copies, and deletion of volume shadow copies. Try Microsoft Defender for Endpoint free of charge. * [Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification) replaces passwords with strong two-factor authentication on your devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN. It lets user authenticate to an Active Directory or Azure Active Directory account. @@ -117,6 +118,6 @@ Microsoft provides comprehensive security capabilities that help protect against ## What to do with a malware infection -Microsoft Defender ATP antivirus capabilities help reduce the chances of infection and will automatically remove threats that it detects. +Microsoft Defender for Endpoint antivirus capabilities help reduce the chances of infection and will automatically remove threats that it detects. In case threat removal is unsuccessful, read about [troubleshooting malware detection and removal problems](https://support.microsoft.com/help/4466982/windows-10-troubleshoot-problems-with-detecting-and-removing-malware). diff --git a/windows/security/threat-protection/intelligence/ransomware-malware.md b/windows/security/threat-protection/intelligence/ransomware-malware.md index b91211e7da..851d1f8c50 100644 --- a/windows/security/threat-protection/intelligence/ransomware-malware.md +++ b/windows/security/threat-protection/intelligence/ransomware-malware.md @@ -3,7 +3,7 @@ title: Ransomware ms.reviewer: description: Learn how to protect your computer and network from ransomware attacks, which can stop you from accessing your files. keywords: security, malware, ransomware, encryption, extortion, money, key, infection, prevention, tips, WDSI, MMPC, Microsoft Malware Protection Center, ransomware-as-a-service, ransom, ransomware downloader, protection, prevention, solution, exploit kits, backup, Cerber, Locky, WannaCry, WannaCrypt, Petya, Spora -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Ransomware @@ -31,7 +32,7 @@ Most ransomware infections start with: Once ransomware infects a device, it starts encrypting files, folders, entire hard drive partitions using encryption algorithms like RSA or RC4. -Ransomware is one of the most lucrative revenue channels for cybercriminals, so malware authors continually improve their malware code to better target enterprise environments. Ransomware-as-a-service is a cybercriminal business model in which malware creators sell their ransomware and other services to cybercriminals, who then operate the ransomware attacks. The business model also defines profit sharing between the malware creators, ransomware operators, and other parties that may be involved. For cybercriminals, ransomware is a big business, at the expense of individuals and businesses. +Ransomware is one of the most lucrative revenue channels for cybercriminals, so malware authors continually improve their malware code to better target enterprise environments. Ransomware-as-a-service is a cybercriminal business model where malware creators sell their ransomware and other services to cybercriminals, who then operate the ransomware attacks. The business model also defines profit sharing between the malware creators, ransomware operators, and other parties that may be involved. For cybercriminals, ransomware is big business at the expense of individuals and businesses. ### Examples @@ -43,9 +44,9 @@ Sophisticated ransomware like **Spora**, **WannaCrypt** (also known as WannaCry) * A Petya variant exploits the same vulnerability, in addition to CVE-2017-0145 (also known as EternalRomance), and uses stolen credentials to move laterally across networks. -Older ransomware like **Reveton** locks screens instead of encrypting files. They display a full screen image and then disable Task Manager. The files are safe, but they are effectively inaccessible. The image usually contains a message claiming to be from law enforcement that says the computer has been used in illegal cybercriminal activities and fine needs to be paid. Because of this, Reveton is nicknamed "Police Trojan" or "Police ransomware". +Older ransomware like **Reveton** (nicknamed "Police Trojan" or "Police ransomware") locks screens instead of encrypting files. They display a full screen image and then disable Task Manager. The files are safe, but they're effectively inaccessible. The image usually contains a message claiming to be from law enforcement that says the computer has been used in illegal cybercriminal activities and a fine needs to be paid. -Ransomware like **Cerber** and **Locky** search for and encrypt specific file types, typically document and media files. When the encryption is complete, the malware leaves a ransom note using text, image, or an HTML file with instructions to pay a ransom to recover files. +Ransomware like **Cerber** and **Locky** search for and encrypt specific file types, typically document and media files. When the encryption is complete, the malware leaves a ransom note using text, image, or an HTML file with instructions to pay a ransom to recover files. **Bad Rabbit** ransomware was discovered attempting to spread across networks using hardcoded usernames and passwords in brute force attacks. diff --git a/windows/security/threat-protection/intelligence/rootkits-malware.md b/windows/security/threat-protection/intelligence/rootkits-malware.md index ffe4254e2b..ab4fa996bd 100644 --- a/windows/security/threat-protection/intelligence/rootkits-malware.md +++ b/windows/security/threat-protection/intelligence/rootkits-malware.md @@ -3,7 +3,7 @@ title: Rootkits ms.reviewer: description: Rootkits may be used by malware authors to hide malicious code on your computer and make malware or potentially unwanted software harder to remove. keywords: security, malware, rootkit, hide, protection, hiding, WDSI, MMPC, Microsoft Malware Protection Center, rootkits, Sirefef, Rustock, Sinowal, Cutwail, malware, virus -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,21 +11,22 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Rootkits -Malware authors use rootkits to hide malware on your device, allowing malware to persist as long as possible. A successful rootkit can potentially remain in place for years if it is undetected. During this time it will steal information and resources. +Malware authors use rootkits to hide malware on your device, allowing malware to persist as long as possible. A successful rootkit can potentially remain in place for years if it's undetected. During this time, it will steal information and resources. ## How rootkits work Rootkits intercept and change standard operating system processes. After a rootkit infects a device, you can’t trust any information that device reports about itself. -For example, if you were to ask a device to list all of the programs that are running, the rootkit might stealthily remove any programs it doesn’t want you to know about. Rootkits are all about hiding things. They want to hide both themselves and their malicious activity on a device. +If you were to ask a device to list all of the programs that are running, the rootkit might stealthily remove any programs it doesn’t want you to know about. Rootkits are all about hiding things. They want to hide both themselves and their malicious activity on a device. -Many modern malware families use rootkits to try and avoid detection and removal, including: +Many modern malware families use rootkits to try to avoid detection and removal, including: * [Alureon](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fAlureon) @@ -53,12 +54,12 @@ For more general tips, see [prevent malware infection](prevent-malware-infection ### What if I think I have a rootkit on my device? -Microsoft security software includes a number of technologies designed specifically to remove rootkits. If you think you might have a rootkit on your device and your antimalware software isn’t detecting it, you might need an extra tool that lets you boot to a known trusted environment. +Microsoft security software includes a number of technologies designed specifically to remove rootkits. If you think you have a rootkit that your antimalware software isn’t detecting, you may need an extra tool that lets you boot to a known trusted environment. -[Windows Defender Offline](https://support.microsoft.com/help/17466/windows-defender-offline-help-protect-my-pc) can be launched from Windows Security Center and has the latest anti-malware updates from Microsoft. It’s designed to be used on devices that aren't working correctly due to a possible malware infection. +[Microsoft Defender Offline](https://support.microsoft.com/help/17466/microsoft-defender-offline-help-protect-my-pc) can be launched from Windows Security Center and has the latest anti-malware updates from Microsoft. It’s designed to be used on devices that aren't working correctly because of a possible malware infection. [System Guard](https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/) in Windows 10 protects against rootkits and threats that impact system integrity. ### What if I can’t remove a rootkit? -If the problem persists, we strongly recommend reinstalling the operating system and security software. You should then restore your data from a backup. +If the problem persists, we strongly recommend reinstalling the operating system and security software. Then restore your data from a backup. diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md index f6b12d45e0..a9c1588361 100644 --- a/windows/security/threat-protection/intelligence/safety-scanner-download.md +++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md @@ -3,7 +3,7 @@ title: Microsoft Safety Scanner Download ms.reviewer: description: Get the Microsoft Safety Scanner tool to find and remove malware from Windows computers. keywords: security, malware -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Microsoft Safety Scanner @@ -34,7 +35,7 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from - Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download. -- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection). +- This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Microsoft Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection). ## System requirements @@ -53,7 +54,7 @@ For more information about the Safety Scanner, see the support article on [how t ## Related resources - [Troubleshooting Safety Scanner](https://support.microsoft.com/help/2520970/how-to-troubleshoot-an-error-when-you-run-the-microsoft-safety-scanner) -- [Windows Defender Antivirus](https://www.microsoft.com/windows/comprehensive-security) +- [Microsoft Defender Antivirus](https://www.microsoft.com/windows/comprehensive-security) - [Microsoft Security Essentials](https://support.microsoft.com/help/14210/security-essentials-download) - [Removing difficult threats](https://support.microsoft.com/help/4466982/windows-10-troubleshoot-problems-with-detecting-and-removing-malware) - [Submit file for malware analysis](https://www.microsoft.com/wdsi/filesubmission) diff --git a/windows/security/threat-protection/intelligence/submission-guide.md b/windows/security/threat-protection/intelligence/submission-guide.md index 7b4028fb4a..87667989e4 100644 --- a/windows/security/threat-protection/intelligence/submission-guide.md +++ b/windows/security/threat-protection/intelligence/submission-guide.md @@ -3,7 +3,7 @@ title: Submit files for analysis by Microsoft description: Learn how to submit files to Microsoft for malware analysis, how to track your submissions, and dispute detections. ms.reviewer: keywords: security, sample submission help, malware file, virus file, trojan file, submit, send to Microsoft, submit a sample, virus, trojan, worm, undetected, doesn’t detect, email microsoft, email malware, I think this is malware, I think it's a virus, where can I send a virus, is this a virus, MSE, doesn’t detect, no signature, no detection, suspect file, MMPC, Microsoft Malware Protection Center, researchers, analyst, WDSI, security intelligence -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Submit files for analysis @@ -26,7 +27,7 @@ You can send us files that you think might be malware or files that have been in We receive a large number of samples from many sources. Our analysis is prioritized by the number of file detections and the type of submission. You can help us complete a quick analysis by providing detailed information about the product you were using and what you were doing when you found the file. -If you sign in before you submit a sample, you will be able to track your submissions. +After you sign in, you will be able to track your submissions. ## Can I send a sample by email? @@ -34,9 +35,7 @@ No, we only accept submissions through our [sample submission portal](https://ww ## Can I submit a sample without signing in? -Yes, you many submit a file as an anonymous home customer. You will get a link to a webpage where you can view the status of the submission. - -If you're an enterprise customer, you need to sign in so that we can prioritize your submission appropriately. If you are currently experiencing a virus outbreak or security-related incident, you should contact your designated Microsoft support professional or go to [Microsoft Support](https://support.microsoft.com/) for immediate assistance. +No. If you're an enterprise customer, you need to sign in so that we can prioritize your submission appropriately. If you are currently experiencing a virus outbreak or security-related incident, you should contact your designated Microsoft support professional or go to [Microsoft Support](https://support.microsoft.com/) for immediate assistance. ## What is the Software Assurance ID (SAID)? @@ -52,9 +51,7 @@ We encourage all software vendors and developers to read about [how Microsoft id ## How do I track or view past sample submissions? -You can track your submissions through the [submission history page](https://www.microsoft.com/wdsi/submissionhistory). Your submission will only appear on this page if you were signed in when you submitted it. - -If you’re not signed in when you submit a sample, you will be redirected to a tracking page. Bookmark this page if you want to come back and check on the status of your submission. +You can track your submissions through the [submission history page](https://www.microsoft.com/wdsi/submissionhistory). ## What does the submission status mean? @@ -66,7 +63,7 @@ Each submission is shown to be in one of the following status types: * Closed—a final determination has been given by an analyst -If you are signed in, you can see the status of any files you submit to us on the [submission history page](https://www.microsoft.com/wdsi/submissionhistory). +You can see the status of any files you submit to us on the [submission history page](https://www.microsoft.com/wdsi/submissionhistory). ## How does Microsoft prioritize submissions diff --git a/windows/security/threat-protection/intelligence/supply-chain-malware.md b/windows/security/threat-protection/intelligence/supply-chain-malware.md index 7530ec2c2e..fff7e3b7b3 100644 --- a/windows/security/threat-protection/intelligence/supply-chain-malware.md +++ b/windows/security/threat-protection/intelligence/supply-chain-malware.md @@ -3,7 +3,7 @@ title: Supply chain attacks ms.reviewer: description: Learn about how supply chain attacks work, deliver malware do your devices, and what you can do to protect yourself keywords: security, malware, protection, supply chain, hide, distribute, trust, compromised -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Supply chain attacks diff --git a/windows/security/threat-protection/intelligence/support-scams.md b/windows/security/threat-protection/intelligence/support-scams.md index 35942059ca..0cfb94aa8f 100644 --- a/windows/security/threat-protection/intelligence/support-scams.md +++ b/windows/security/threat-protection/intelligence/support-scams.md @@ -3,7 +3,7 @@ title: Tech Support Scams ms.reviewer: description: Microsoft security software can protect you from tech support scams that claims to scan for malware or viruses and then shows you fake detections and warnings. keywords: security, malware, tech support, scam, protection, trick, spoof, fake, error messages, report, rogue security software, fake, antivirus, fake software, rogue, threats, fee, removal fee, upgrade, pay for removal, install full version, trial, lots of threats, scanner, scan, clean, computer, security, program, XP home security, fake microsoft, activate, activate scan, activate antivirus, warnings, pop-ups, security warnings, security pop-ups tech support scams, fake Microsoft error notification, fake virus alert, fake product expiration, fake Windows activation, scam web pages, scam phone numbers, telephone numbers, MMPC, WDSI, Microsoft Malware Protection Center, tech support scam numbers -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Tech support scams @@ -45,13 +46,13 @@ It is also important to keep the following in mind: * Use [Microsoft Edge](https://www.microsoft.com/windows/microsoft-edge) when browsing the internet. It blocks known support scam sites using Windows Defender SmartScreen (which is also used by Internet Explorer). Furthermore, Microsoft Edge can stop pop-up dialogue loops used by these sites. -* Enable [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) in Windows 10. It detects and removes known support scam malware. +* Enable [Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) in Windows 10. It detects and removes known support scam malware. ## What to do if information has been given to a tech support person * Uninstall applications that scammers asked to be install. If access has been granted, consider resetting the device -* Run a full scan with Windows Defender Antivirus to remove any malware. Apply all security updates as soon as they are available. +* Run a full scan with Microsoft Defender Antivirus to remove any malware. Apply all security updates as soon as they are available. * Change passwords. @@ -63,6 +64,6 @@ It is also important to keep the following in mind: Help Microsoft stop scammers, whether they claim to be from Microsoft or from another tech company, by reporting tech support scams: -www.microsoft.com/reportascam +www.microsoft.com/reportascam You can also report any **unsafe website** that you suspect is a phishing website or contains malicious content directly to Microsoft by filling out a [Report an unsafe site form](https://www.microsoft.com/wdsi/support/report-unsafe-site) or using built in web browser functionality. diff --git a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md deleted file mode 100644 index fcd89c3a81..0000000000 --- a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md +++ /dev/null @@ -1,112 +0,0 @@ ---- -title: Top scoring in industry tests (AV-TEST, AV Comparatives, SE Labs, MITRE ATT&CK) -ms.reviewer: -description: Microsoft Defender ATP consistently achieves high scores in independent tests. View the latest scores and analysis. -keywords: Windows Defender Antivirus, av reviews, antivirus test, av testing, latest av scores, detection scores, security product testing, security industry tests, industry antivirus tests, best antivirus, av-test, av-comparatives, SE labs, MITRE ATT&CK, endpoint protection platform, EPP, endpoint detection and response, EDR, Windows 10, Microsoft Defender Antivirus, WDAV, MDATP, Microsoft Threat Protection, security, malware, av, antivirus, scores, scoring, next generation protection, ranking, success -ms.prod: w10 -ms.mktglfcycl: secure -ms.sitesec: library -ms.localizationpriority: high -ms.author: ellevin -author: levinec -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -search.appverid: met150 ---- - -# Top scoring in industry tests - -Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)) technologies consistently achieve high scores in independent tests, demonstrating the strength of its enterprise threat protection capabilities. Microsoft aims to be transparent about these test scores. This page summarizes the results and provides analysis. - -## Next generation protection - -[Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) consistently performs highly in independent tests, displaying how it is a top choice in the antivirus market. Keep in mind, these tests only provide results for antivirus and do not test for additional security protections. - -Windows Defender Antivirus is the [next generation protection](https://www.youtube.com/watch?v=Xy3MOxkX_o4) capability in the [Microsoft Defender ATP Windows 10 security stack](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) that addresses the latest and most sophisticated threats today. In some cases, customers might not even know they were protected because a cyberattack is stopped [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign). That's because Windows Defender Antivirus and other [endpoint protection platform (EPP)](https://www.microsoft.com/security/blog/2019/08/23/gartner-names-microsoft-a-leader-in-2019-endpoint-protection-platforms-magic-quadrant/) capabilities in Microsoft Defender ATP detect and stops malware at first sight with [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak), behavioral analysis, and other advanced technologies. -

    - -**Download the latest transparency report: [Examining industry test results, November 2019](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp)** - -### AV-TEST: Protection score of 5.5/6.0 in the latest test - -The AV-TEST Product Review and Certification Report tests on three categories: protection, performance, and usability. The following scores are for the Protection category which has two scores: Real-World Testing and the AV-TEST reference set (known as "Prevalent Malware"). - -- January - February 2020 AV-TEST Business User test: [Protection score 5.5/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2020/microsoft-windows-defender-antivirus-4.18-200614/) **Latest** - - Windows Defender Antivirus achieved an overall Protection score of 5.5/6.0, with 21,008 malware samples used. - -- November - December 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/december-2019/microsoft-windows-defender-antivirus-4.18-195015/) - -- September - October 2019 AV-TEST Business User test: [Protection score 5.5/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/october-2019/microsoft-windows-defender-antivirus-4.18-194115/) - -- July — August 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/august-2019/microsoft-windows-defender-antivirus-4.18-193215/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp) - -- May — June 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/june-2019/microsoft-windows-defender-antivirus-4.18-192415/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) - -- March — April 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2019/microsoft-windows-defender-antivirus-4.18-191517/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) - -- January — February 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2019/microsoft-windows-defender-antivirus-4.18-190611/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE33cdd) - -- November — December 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/december-2018/microsoft-windows-defender-antivirus-4.18-185074/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWusR9) - -- September — October 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/october-2018/microsoft-windows-defender-antivirus-4.18-184174/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWqOqD) - -### AV-Comparatives: Protection rating of 99.6% in the latest test - -Business Security Test consists of three main parts: the Real-World Protection Test that mimics online malware attacks, the Malware Protection Test where the malware enters the system from outside the internet (for example by USB), and the Performance Test that looks at the impact on the system's performance. - -- Business Security Test 2019 (August — November): [Real-World Protection Rate 99.6%](https://www.av-comparatives.org/tests/business-security-test-2019-august-november/) **Latest** - - Windows Defender Antivirus has scored consistently high in Real-World Protection Rates over the past year, with 99.6% in the latest test. - -- Business Security Test 2019 Factsheet (August — September): [Real-World Protection Rate 99.9%](https://www.av-comparatives.org/tests/business-security-test-august-september-2019-factsheet/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp) - -- Business Security Test 2019 (March — June): [Real-World Protection Rate 99.9%](https://www.av-comparatives.org/tests/business-security-test-2019-march-june/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) - -- Business Security Test 2018 (August — November): [Real-World Protection Rate 99.6%](https://www.av-comparatives.org/tests/business-security-test-2018-august-november/) - -- Business Security Test 2018 (March — June): [Real-World Protection Rate 98.7%](https://www.av-comparatives.org/tests/business-security-test-2018-march-june/) - -### SE Labs: AAA award in the latest test - -SE Labs tests a range of solutions used by products and services to detect and/or protect against attacks, including endpoint software, network appliances, and cloud services. - -- Enterprise Endpoint Protection October — December 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/oct-dec-2019-enterprise.pdf) **pdf** - - Microsoft's next-gen protection was named one of the leading products, stopping all targeted attacks and all but two public threats. - -- Enterprise Endpoint Protection July — September 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/jul-sep-2019-enterprise.pdf) **pdf** | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp) - -- Enterprise Endpoint Protection April — June 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/apr-jun-2019-enterprise.pdf) **pdf** | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) - -- Enterprise Endpoint Protection January — March 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/jan-mar-2019-enterprise.pdf) **pdf** | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) - -- Enterprise Endpoint Protection October — December 2018: [AAA award](https://selabs.uk/download/enterprise/epp/2018/oct-dec-2018-enterprise.pdf) **pdf** | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE33cdd) - -## Endpoint detection & response - -Microsoft Defender ATP [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. - -![String of images showing EDR capabilities](./images/MITRE-Microsoft-Defender-ATP.png) - -**Read our analysis: [MITRE evaluation highlights industry-leading EDR capabilities in Windows Defender ATP](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/MITRE-evaluation-highlights-industry-leading-EDR-capabilities-in/ba-p/369831)** - -### MITRE: Industry-leading optics and detection capabilities - -MITRE tested the ability of products to detect techniques commonly used by the targeted attack group APT3 (also known as Boron or UPS). To isolate detection capabilities, all protection and prevention features were turned off. Microsoft is happy to be one of the first EDR vendors to sign up for the MITRE evaluation based on the ATT&CK framework. The framework is widely regarded today as the most comprehensive catalog of attacker techniques and tactics. - -- ATT&CK-based evaluation: [Leading optics and detection capabilities](https://www.microsoft.com/security/blog/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/) | [Analysis](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/MITRE-evaluation-highlights-industry-leading-EDR-capabilities-in/ba-p/369831) - - Microsoft Defender ATP delivered comprehensive coverage of attacker techniques across the entire attack chain. Highlights included the breadth of telemetry, the strength of threat intelligence, and the advanced, automatic detection through machine learning, heuristics, and behavior monitoring. - -## To what extent are tests representative of protection in the real world? - -Independent security industry tests aim to evaluate the best antivirus and security products in an unbiased manner. However, it is important to remember that Microsoft sees a wider and broader set of threats beyond what's tested in the evaluations highlighted in this topic. For example, in an average month Microsoft's security products identify over 100 million new threats. Even if an independent tester can acquire and test 1% of those threats, that is a million tests across 20 or 30 products. In other words, the vastness of the malware landscape makes it extremely difficult to evaluate the quality of protection against real world threats. - -The capabilities within Microsoft Defender ATP provide [additional layers of protection](https://cloudblogs.microsoft.com/microsoftsecure/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses) that are not factored into industry antivirus tests, and address some of the latest and most sophisticated threats. Isolating AV from the rest of Microsoft Defender ATP creates a partial picture of how Microsoft's security stack operates in the real world. For example, attack surface reduction and endpoint detection & response capabilities can help prevent malware from getting onto devices in the first place. We have proven that [Microsoft Defender ATP components catch samples](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA) that Windows Defender Antivirus missed in these industry tests, which is more representative of how effectively Microsoft's security suite protects customers in the real world. - -With independent tests, customers can view one aspect of their security suite but can't assess the complete protection of all the security features. Microsoft is highly engaged in working with several independent testers to evolve security testing to focus on the end-to-end security stack. - -[Learn more about Microsoft Defender ATP](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) and evaluate it in your own network by signing up for a [90-day trial of Microsoft Defender ATP](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), or [enabling Preview features on existing tenants](../microsoft-defender-atp/preview-settings.md). diff --git a/windows/security/threat-protection/intelligence/trojans-malware.md b/windows/security/threat-protection/intelligence/trojans-malware.md index c9f64fecd6..31228195f8 100644 --- a/windows/security/threat-protection/intelligence/trojans-malware.md +++ b/windows/security/threat-protection/intelligence/trojans-malware.md @@ -3,7 +3,7 @@ title: Trojan malware ms.reviewer: description: Trojans are a type of threat that can infect your device. This page tells you what they are and how to remove them. keywords: security, malware, protection, trojan, download, file, infection, trojans, virus, protection, cleanup, removal, antimalware, antivirus, WDSI, MMPC, Microsoft Malware Protection Center, malware types -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Trojans @@ -40,7 +41,7 @@ Trojans can come in many different varieties, but generally they do the followin Use the following free Microsoft software to detect and remove it: -- [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) for Windows 10 and Windows 8.1, or [Microsoft Security Essentials](https://www.microsoft.com/download/details.aspx?id=5201) for previous versions of Windows. +- [Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) for Windows 10 and Windows 8.1, or [Microsoft Security Essentials](https://www.microsoft.com/download/details.aspx?id=5201) for previous versions of Windows. - [Microsoft Safety Scanner](safety-scanner-download.md) diff --git a/windows/security/threat-protection/intelligence/understanding-malware.md b/windows/security/threat-protection/intelligence/understanding-malware.md index eb417b74dd..d7d82578fa 100644 --- a/windows/security/threat-protection/intelligence/understanding-malware.md +++ b/windows/security/threat-protection/intelligence/understanding-malware.md @@ -3,7 +3,7 @@ title: Understanding malware & other threats ms.reviewer: description: Learn about the most prevalent viruses, malware, and other threats. Understand how they infect systems, how they behave, and how to prevent and remove them. keywords: security, malware, virus, malware, threat, analysis, research, encyclopedia, dictionary, glossary, ransomware, support scams, unwanted software, computer infection, virus infection, descriptions, remediation, latest threats, mmpc, microsoft malware protection center, wdsi -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual search.appverid: met150 +ms.technology: mde --- # Understanding malware & other threats @@ -21,7 +22,7 @@ Malware is a term used to describe malicious applications and code that can caus Cybercriminals that distribute malware are often motivated by money and will use infected computers to launch attacks, obtain banking credentials, collect information that can be sold, sell access to computing resources, or extort payment from victims. -As criminals become more sophisticated with their attacks, Microsoft is here to help. Windows 10 is the most secure version of Windows yet and includes many features to help protect you whether you're at home, at work, or on the go. With Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)), businesses can stay protected with next-generation protection and other security capabilities. +As criminals become more sophisticated with their attacks, Microsoft is here to help. Windows 10 is the most secure version of Windows yet and includes many features to help protect you whether you're at home, at work, or on the go. With [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), businesses can stay protected with next-generation protection and other security capabilities. For good general tips, check out the [prevent malware infection](prevent-malware-infection.md) topic. diff --git a/windows/security/threat-protection/intelligence/unwanted-software.md b/windows/security/threat-protection/intelligence/unwanted-software.md index fdf1e1e4bf..31dc9dc196 100644 --- a/windows/security/threat-protection/intelligence/unwanted-software.md +++ b/windows/security/threat-protection/intelligence/unwanted-software.md @@ -3,7 +3,7 @@ title: Unwanted software ms.reviewer: description: Learn about how unwanted software changes your default settings without your consent and what you can do to protect yourself. keywords: security, malware, protection, unwanted, software, alter, infect, unwanted software, software bundlers, browser modifiers, privacy, security, computing experience, prevent infection, solution, WDSI, MMPC, Microsoft Malware Protection Center, virus research threats, research malware, pc protection, computer infection, virus infection, descriptions, remediation, latest threats -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Unwanted software @@ -43,7 +44,7 @@ To prevent unwanted software infection, download software only from official web Use [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) when browsing the internet. Microsoft Edge includes additional protections that effectively block browser modifiers that can change your browser settings. Microsoft Edge also blocks known websites hosting unwanted software using [Windows Defender SmartScreen](https://docs.microsoft.com/microsoft-edge/deploy/index) (also used by Internet Explorer). -Enable [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) in Windows 10. It provides real-time protection against threats and detects and removes known unwanted software. +Enable [Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) in Windows 10. It provides real-time protection against threats and detects and removes known unwanted software. Download [Microsoft Security Essentials](https://www.microsoft.com/download/details.aspx?id=5201) for real-time protection in Windows 7 or Windows Vista. diff --git a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md index 5aded1e416..a70ae6fe7e 100644 --- a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md +++ b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md @@ -3,7 +3,7 @@ title: Virus Information Alliance ms.reviewer: description: The Microsoft Virus Information Alliance (VIA) is a collaborative antimalware program for organizations fighting cybercrime. keywords: security, malware, Microsoft, MMPC, Microsoft Malware Protection Center, partners, sharing, samples, vendor exchange, CSS, alliance, WDSI -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,28 +11,36 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Virus Information Alliance The Virus Information Alliance (VIA) is a public antimalware collaboration program for security software providers, security service providers, antimalware testing organizations, and other organizations involved in fighting cybercrime. -Members of the VIA program collaborate by exchanging technical information on malicious software with Microsoft, with the goal of improving protection for Microsoft customers. +Members of the VIA program collaborate by exchanging technical information on malicious software with Microsoft. The goal is to improve protection for Microsoft customers. ## Better protection for customers against malware -The VIA program gives members access to information that will help improve protection for Microsoft customers. For example, the program provides malware telemetry and samples to security product teams to identify gaps in their protection and prioritize new threat coverage. +The VIA program gives members access to information that will help them improve protection. For example, the program provides malware telemetry and samples to security teams so they can identify gaps and prioritize new threat coverage. -Malware prevalence data is provided to antimalware testers to assist them in selecting sample sets and setting scoring criteria that represent the real-world threat landscape. Service organizations, such as a CERT, can leverage our data to help assess the impact of policy changes or to help shut down malicious activity. +Malware prevalence data is provided to antimalware testers to assist them in selecting sample sets. The data also helps set scoring criteria that represent the real-world threat landscape. Service organizations, such as a CERT, can leverage our data to help assess the impact of policy changes or to help shut down malicious activity. Microsoft is committed to continuous improvement to help reduce the impact of malware on customers. By sharing malware-related information, Microsoft enables members of this community to work towards better protection for customers. ## Becoming a member of VIA -Microsoft has well-defined, objective, measurable, and tailored membership criteria for prospective members of the Virus Information Alliance (VIA). The criteria is designed to ensure that Microsoft is able to work with security software providers, security service providers, antimalware testing organizations, and other organizations involved in the fight against cybercrime to protect a broad range of customers. +Microsoft has well-defined, objective, measurable, and tailored membership criteria for prospective members of the Virus Information Alliance (VIA). -Members will receive information to facilitate effective malware detection, deterrence, and eradication. This includes technical information on malware as well as metadata on malicious activity. Information shared through VIA is governed by the VIA membership agreement and a Microsoft non-disclosure agreement, where applicable. +The criteria is designed to ensure that Microsoft can work with the following groups to protect a broad range of customers: + +- Security software providers +- Security service providers +- Antimalware testing organizations +- Other organizations involved in the fight against cybercrime + +Members will receive information to facilitate effective malware detection, deterrence, and eradication. This information includes technical information on malware as well as metadata on malicious activity. Information shared through VIA is governed by the VIA membership agreement and a Microsoft non-disclosure agreement, where applicable. VIA has an open enrollment for potential members. @@ -43,11 +51,12 @@ To be eligible for VIA your organization must: 1. Be willing to sign a non-disclosure agreement with Microsoft. 2. Fit into one of the following categories: - * Your organization develops antimalware technology that can run on Windows and your organization’s product is commercially available. - * Your organization provides security services to Microsoft customers or for Microsoft products. - * Your organization publishes antimalware testing reports on a regular basis. - * Your organization has a research or response team dedicated to fighting malware to protect your organization, your customers, or the general public. + + - Your organization develops antimalware technology that can run on Windows and your organization’s product is commercially available. + - Your organization provides security services to Microsoft customers or for Microsoft products. + - Your organization publishes antimalware testing reports on a regular basis. + - Your organization has a research or response team dedicated to fighting malware to protect your organization, your customers, or the general public. 3. Be willing to sign and adhere to the VIA membership agreement. -If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). +If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). For questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). diff --git a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md index a896140ce6..8512c8d267 100644 --- a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md +++ b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md @@ -3,7 +3,7 @@ title: Microsoft Virus Initiative ms.reviewer: description: The Microsoft Virus Initiative (MVI) helps organizations that make antivirus or antimalware products integrate with Windows and share telemetry with Microsoft. keywords: security, malware, MVI, Microsoft Malware Protection Center, MMPC, alliances, WDSI -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,21 +11,22 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Microsoft Virus Initiative The Microsoft Virus Initiative (MVI) helps organizations to get their products working and integrated with Windows. -MVI members receive access to Windows APIs and other technologies including IOAV, AMSI and Cloud files. Members also get malware telemetry and samples and invitations to security related events and conferences. +MVI members receive access to Windows APIs and other technologies including IOAV, AMSI, and Cloud files. Members also get malware telemetry and samples and invitations to security-related events and conferences. ## Become a member -A request for membership is made by an individual as a representative of an organization that develops and produces antimalware or antivirus technology. Your organization must meet the following eligibility requirements to qualify for the MVI program: +You can request membership if you're a representative for an organization that develops and produces antimalware or antivirus technology. Your organization must meet the following requirements to qualify for the MVI program: -1. Offer an antimalware or antivirus product that is one of the following: +1. Offer an antimalware or antivirus product that meets one of the following criteria: * Your organization's own creation. * Developed by using an SDK (engine and other components) from another MVI Partner company and your organization adds a custom UI and/or other functionality. @@ -34,7 +35,7 @@ A request for membership is made by an individual as a representative of an orga 3. Be active and have a positive reputation in the antimalware industry. - * Activity can include participation in industry conferences or being reviewed in an industry standard report such as AV Comparatives, OPSWAT or Gartner. + * Activity can include participation in industry conferences or being reviewed in an industry standard report such as AV Comparatives, OPSWAT, or Gartner. 4. Be willing to sign a non-disclosure agreement (NDA) with Microsoft. @@ -49,14 +50,14 @@ A request for membership is made by an individual as a representative of an orga Test Provider | Lab Test Type | Minimum Level / Score ------------- |---------------|---------------------- AV-Comparatives | Real-World Protection Test
    https://www.av-comparatives.org/testmethod/real-world-protection-tests/ |“Approved” rating from AV Comparatives -AV-Test | Must pass tests for Windows. Certifications for Mac and Linux are not accepted
    https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users) +AV-Test | Must pass tests for Windows. Certifications for Mac and Linux aren't accepted
    https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users) ICSA Labs | Endpoint Anti-Malware Detection
    https://www.icsalabs.com/technology-program/anti-virus/criteria |PASS/Certified NSS Labs | Advanced Endpoint Protection AEP 3.0, which covers automatic threat prevention and threat event reporting capabilities
    https://www.nsslabs.com/tested-technologies/advanced-endpoint-protection/ |“Neutral” rating from NSS -SKD Labs | Certification Requirements Product: Anti-virus or Antimalware
    http://www.skdlabs.com/html/english/
    http://www.skdlabs.com/cert/ |SKD Labs Star Check Certification Requirements Pass >= 98.5 % with On Demand, On Access and Total Detection tests +SKD Labs | Certification Requirements Product: Anti-virus or Antimalware
    http://www.skdlabs.com/html/english/
    http://www.skdlabs.com/cert/ |SKD Labs Star Check Certification Requirements Pass >= 98.5% with On Demand, On Access and Total Detection tests SE Labs | Protection A rating or Small Business EP A rating or Enterprise EP Protection A rating
    https://selabs.uk/en/reports/consumers |Home or Enterprise “A” rating VB 100 | VB100 Certification Test V1.1
    https://www.virusbulletin.com/testing/vb100/vb100-methodology/vb100-methodology-ver1-1/ | VB100 Certification West Coast Labs | Checkmark Certified
    http://www.checkmarkcertified.com/sme/ | “A” Rating on Product Security Performance ## Apply now -If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). +If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). For questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). diff --git a/windows/security/threat-protection/intelligence/worms-malware.md b/windows/security/threat-protection/intelligence/worms-malware.md index 6b392dcc81..99c3fafa1a 100644 --- a/windows/security/threat-protection/intelligence/worms-malware.md +++ b/windows/security/threat-protection/intelligence/worms-malware.md @@ -3,7 +3,7 @@ title: Worms ms.reviewer: description: Learn about how worms replicate and spread to other computers or networks. Read about the most popular worms and steps you can take to stop them. keywords: security, malware, protection, worm, vulnerabilities, infect, steal, Jenxcus, Gamarue, Bondat, WannaCrypt, WDSI, MMPC, Microsoft Malware Protection Center, worms, malware types, threat propagation, mass-mailing, IP scanning -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium @@ -11,9 +11,10 @@ ms.author: ellevin author: levinec manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article search.appverid: met150 +ms.technology: mde --- # Worms @@ -22,19 +23,19 @@ A worm is a type of malware that can copy itself and often spreads through a net ## How worms work -Worms represent a large category of malware. Different worms use different methods to infect devices. Depending on the variant, they can steal sensitive information, change security settings, send information to malicious hackers, stop users from accessing files, and other malicious activities. +Worms represent a large category of malware. Different worms use different methods to infect devices. Depending on the variant, they can steal sensitive information, change security settings, send information to malicious hackers, stop users from accessing files, and other malicious activities. -Jenxcus (also known as Dunihi), Gamarue (also known as Androm), and Bondat have consistently remained at the top of the list of malware that infect users running Microsoft security software. Although these worms share some commonalities, it is interesting to note that they also have distinct characteristics. +Jenxcus (also known as Dunihi), Gamarue (also known as Androm), and Bondat have consistently remained at the top of the list of malware that infects users running Microsoft software. Although these worms share some commonalities, it's interesting to note that they also have distinct characteristics. * **Jenxcus** has capabilities of not only infecting removable drives but can also act as a backdoor that connects back to its server. This threat typically gets into a device from a drive-by download attack, meaning it's installed when users just visit a compromised web page. -* **Gamarue** typically arrives through spam campaigns, exploits, downloaders, social networking sites, and removable drives. When Gamarue infects a device, it becomes a distribution channel for other malware. We’ve seen it distribute other malware such as infostealers, spammers, clickers, downloaders, and rogues. +* **Gamarue** typically arrives through spam campaigns, exploits, downloaders, social networking sites, and removable drives. When Gamarue infects a device, it becomes a distribution channel for other malware. We’ve seen it distribute other malware such as info stealers, spammers, clickers, downloaders, and rogues. * **Bondat** typically arrives through fictitious Nullsoft Scriptable Install System (NSIS), Java installers, and removable drives. When Bondat infects a system, it gathers information about the machine such as device name, Globally Unique Identifier (GUID), and OS build. It then sends that information to a remote server. -Both Bondat and Gamarue have clever ways of obscuring themselves to evade detection. By hiding what they are doing, they try to avoid detection by security software. +Both Bondat and Gamarue have clever ways of obscuring themselves to evade detection. By hiding what they're doing, they try to avoid detection by security software. -* [**WannaCrypt**](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/WannaCrypt) also deserves a mention here. Unlike older worms that often spread just because they could, modern worms often spread to drop a payload (e.g. ransomware). +* [**WannaCrypt**](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/WannaCrypt) also deserves a mention here. Unlike older worms that often spread just because they could, modern worms often spread to drop a payload (like ransomware). This image shows how a worm can quickly spread through a shared USB drive. @@ -44,7 +45,7 @@ This image shows how a worm can quickly spread through a shared USB drive. ## How to protect against worms -Enable [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) in Windows 10. It provides real-time protection against threats and detects and removes known unwanted software. +Enable [Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) in Windows 10. It provides real-time protection against threats and detects and removes known unwanted software. Download [Microsoft Security Essentials](https://www.microsoft.com/download/details.aspx?id=5201) for real-time protection in Windows 7 or Windows Vista. diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md index dc96de376a..09dc088c59 100644 --- a/windows/security/threat-protection/mbsa-removal-and-guidance.md +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -1,15 +1,15 @@ --- title: Guide to removing Microsoft Baseline Security Analyzer (MBSA) -description: This article documents the removal of Microsoft Baseline Security Analyzer (MBSA) and provides alternative solutions +description: This article documents the removal of Microsoft Baseline Security Analyzer (MBSA) and provides alternative solutions. keywords: MBSA, security, removal -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.localizationpriority: medium ms.author: dansimp -author: dulcemontemayor -ms.date: 10/05/2018 +author: dansimp ms.reviewer: manager: dansimp +ms.technology: mde --- # What is Microsoft Baseline Security Analyzer and its uses? @@ -17,6 +17,9 @@ manager: dansimp Microsoft Baseline Security Analyzer (MBSA) is used to verify patch compliance. MBSA also performed several other security checks for Windows, IIS, and SQL Server. Unfortunately, the logic behind these additional checks had not been actively maintained since Windows XP and Windows Server 2003. Changes in the products since then rendered many of these security checks obsolete and some of their recommendations counterproductive. MBSA was largely used in situations where neither Microsoft Update nor a local WSUS or Configuration Manager server was available, or as a compliance tool to ensure that all security updates were deployed to a managed environment. While MBSA version 2.3 introduced support for Windows Server 2012 R2 and Windows 8.1, it has since been deprecated and no longer developed. MBSA 2.3 is not updated to fully support Windows 10 and Windows Server 2016. + +> [!NOTE] +> In accordance with our [SHA-1 deprecation initiative](https://aka.ms/sha1deprecation), the Wsusscn2.cab file is no longer dual-signed using both SHA-1 and the SHA-2 suite of hash algorithms (specifically SHA-256). This file is now signed using only SHA-256. Administrators who verify digital signatures on this file should now expect only single SHA-256 signatures. Starting with the August 2020 Wsusscn2.cab file, MBSA will return the following error "The catalog file is damaged or an invalid catalog." when attempting to scan using the offline scan file. ## The Solution A script can help you with an alternative to MBSA’s patch-compliance checking: diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md new file mode 100644 index 0000000000..53cc0585bb --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md @@ -0,0 +1,70 @@ +--- +title: Collect diagnostic data for Update Compliance and Windows Defender Microsoft Defender Antivirus +description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Microsoft Defender Antivirus Assessment add in +keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Collect Update Compliance diagnostic data for Microsoft Defender AV Assessment + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Microsoft Defender AV Assessment section in the Update Compliance add-in. + +Before attempting this process, ensure you have read [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md), met all require prerequisites, and taken any other suggested troubleshooting steps. + +On at least two devices that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by taking the following steps: + +1. Open an administrator-level version of the command prompt as follows: + + a. Open the **Start** menu. + + b. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**. + + c. Enter administrator credentials or approve the prompt. + +2. Navigate to the Windows Defender directory. By default, this is `C:\Program Files\Windows Defender`. + +3. Type the following command, and then press **Enter** + + ```Dos + mpcmdrun -getfiles + ``` + +4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`. + +5. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us. + +6. Send an email using the Update Compliance support email template, and fill out the template with the following information: + + ``` + I am encountering the following issue when using Microsoft Defender Antivirus in Update Compliance: + + I have provided at least 2 support .cab files at the following location: + + My OMS workspace ID is: + + Please contact me at: + ``` + +## See also + +- [Troubleshoot Windows Defender Microsoft Defender Antivirus reporting](troubleshoot-reporting.md) + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md new file mode 100644 index 0000000000..db2a7a7f8e --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md @@ -0,0 +1,118 @@ +--- +title: Collect diagnostic data of Microsoft Defender Antivirus +description: Use a tool to collect data to troubleshoot Microsoft Defender Antivirus +keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender av, group policy object, setting, diagnostic data +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 06/29/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Collect Microsoft Defender AV diagnostic data + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you might encounter when using the Microsoft Defender AV. + +> [!NOTE] +> As part of the investigation or response process, you can collect an investigation package from a device. Here's how: [Collect investigation package from devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#collect-investigation-package-from-devices). + +On at least two devices that are experiencing the same issue, obtain the .cab diagnostic file by taking the following steps: + +1. Open an administrator-level version of the command prompt as follows: + + a. Open the **Start** menu. + + b. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**. + + c. Enter administrator credentials or approve the prompt. + +2. Navigate to the Microsoft Defender directory. By default, this is `C:\Program Files\Windows Defender`. + +> [!NOTE] +> If you're running an [updated Microsoft Defender Platform version](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform), please run `MpCmdRun` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\`. + +3. Type the following command, and then press **Enter** + + ```Dos + mpcmdrun.exe -GetFiles + ``` + +4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Microsoft Defender\Support\MpSupportFiles.cab`. + +> [!NOTE] +> To redirect the cab file to a a different path or UNC share, use the following command: `mpcmdrun.exe -GetFiles -SupportLogLocation `
    For more information, see [Redirect diagnostic data to a UNC share](#redirect-diagnostic-data-to-a-unc-share). + +5. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us. + +> [!NOTE] +>If you have a problem with Update compliance, send an email using the Update Compliance support email template, and fill out the template with the following information: +>``` +> I am encountering the following issue when using Microsoft Defender Antivirus in Update Compliance: +> I have provided at least 2 support .cab files at the following location: +> +> +> My OMS workspace ID is: +> +> Please contact me at: + +## Redirect diagnostic data to a UNC share +To collect diagnostic data on a central repository, you can specify the SupportLogLocation parameter. + +```Dos +mpcmdrun.exe -GetFiles -SupportLogLocation +``` + +Copies the diagnostic data to the specified path. If the path is not specified, the diagnostic data will be copied to the location specified in the Support Log Location Configuration. + +When the SupportLogLocation parameter is used, a folder structure like as follows will be created in the destination path: + +```Dos +\\MpSupport--.cab +``` + +| field | Description | +|:----|:----| +| path | The path as specified on the command line or retrieved from configuration +| MMDD | Month and day when the diagnostic data was collected (for example, 0530) +| hostname | The hostname of the device on which the diagnostic data was collected +| HHMM | Hours and minutes when the diagnostic data was collected (for example, 1422) + +> [!NOTE] +> When using a file share please make sure that account used to collect the diagnostic package has write access to the share. + +## Specify location where diagnostic data is created + +You can also specify where the diagnostic .cab file will be created using a Group Policy Object (GPO). + +1. Open the Local Group Policy Editor and find the SupportLogLocation GPO at: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SupportLogLocation` + +1. Select **Define the directory path to copy support log files**. + + ![Screenshot of local group policy editor](images/GPO1-SupportLogLocationDefender.png) + + ![Screenshot of define path for log files setting](images/GPO2-SupportLogLocationGPPage.png) +3. Inside the policy editor, select **Enabled**. + +4. Specify the directory path where you want to copy the support log files in the **Options** field. + ![Screenshot of Enabled directory path custom setting](images/GPO3-SupportLogLocationGPPageEnabledExample.png) +5. Select **OK** or **Apply**. + +## See also + +- [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md) + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..04a84573cc --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md @@ -0,0 +1,82 @@ +--- +title: Use the command line to manage Microsoft Defender Antivirus +description: Run Microsoft Defender Antivirus scans and configure next-generation protection with a dedicated command-line utility. +keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: ksarens +manager: dansimp +ms.date: 08/17/2020 +ms.technology: mde +--- + +# Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can perform various Microsoft Defender Antivirus functions with the dedicated command-line tool *mpcmdrun.exe*. This utility is useful when you want to automate Microsoft Defender Antivirus use. You can find the utility in `%ProgramFiles%\Windows Defender\MpCmdRun.exe`. You must run it from a command prompt. + +> [!NOTE] +> You might need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. +> +> If you're running an updated Microsoft Defender Platform version, please run `MpCmdRun` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\`. + +The utility has the following commands: + +```console +MpCmdRun.exe [command] [-options] +``` +Here's an example: + +```console +MpCmdRun.exe -Scan -ScanType 2 +``` + +| Command | Description | +|:----|:----| +| `-?` **or** `-h` | Displays all available options for this tool | +| `-Scan [-ScanType [0\|1\|2\|3]] [-File [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout ] [-Cancel]` | Scans for malicious software. Values for **ScanType** are: **0** Default, according to your configuration, **-1** Quick scan, **-2** Full scan, **-3** File and directory custom scan. CpuThrottling will honor the configured CPU throttling from policy | +| `-Trace [-Grouping #] [-Level #]` | Starts diagnostic tracing | +| `-GetFiles [-SupportLogLocation ]` | Collects support information. See '[collecting diagnostic data](collect-diagnostic-data.md)' | +| `-GetFilesDiagTrack` | Same as `-GetFiles`, but outputs to temporary DiagTrack folder | +| `-RemoveDefinitions [-All]` | Restores the installed Security intelligence to a previous backup copy or to the original default set | +| `-RemoveDefinitions [-DynamicSignatures]` | Removes only the dynamically downloaded Security intelligence | +| `-RemoveDefinitions [-Engine]` | Restores the previous installed engine | +| `-SignatureUpdate [-UNC \| -MMPC]` | Checks for new Security intelligence updates | +| `-Restore [-ListAll \| [[-Name ] [-All] \| [-FilePath ]] [-Path ]]` | Restores or lists quarantined item(s) | +| `-AddDynamicSignature [-Path]` | Loads dynamic Security intelligence | +| `-ListAllDynamicSignatures` | Lists the loaded dynamic Security intelligence | +| `-RemoveDynamicSignature [-SignatureSetID]` | Removes dynamic Security intelligence | +| `-CheckExclusion -path ` | Checks whether a path is excluded | +| `-ValidateMapsConnection` | Verifies that your network can communicate with the Microsoft Defender Antivirus cloud service. This command will only work on Windows 10, version 1703 or higher.| + + +## Common errors in running commands via mpcmdrun.exe + +|Error message | Possible reason +|:----|:----| +| `ValidateMapsConnection failed (800106BA) or 0x800106BA` | The Microsoft Defender Antivirus service is disabled. Enable the service and try again.
    **Note:** In Windows 10 1909 or older, and Windows Server 2019 or older, the service used to be called "Windows Defender Antivirus" service.| +| `0x80070667` | You're running the `-ValidateMapsConnection` command from a computer that is Windows 10 version 1607 or older, or Windows Server 2016 or older. Run the command from a machine that is Windows 10 version 1703 or newer, or Windows Server 2019 or newer.| +| `'MpCmdRun' is not recognized as an internal or external command, operable program or batch file.` | The tool needs to be run from either: `%ProgramFiles%\Windows Defender` or `C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.4-0` (where `2008.4-0` might differ since platform updates are monthly except for December)| +| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80070005 httpcode=450)` | Not enough privileges. Use the command prompt (cmd.exe) as an administrator.| +| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80070006 httpcode=451)` | The firewall is blocking the connection or conducting SSL inspection. | +| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80004005 httpcode=450)` | Possible network-related issues, like name resolution problems| +| `ValidateMapsConnection failed to establish a connection to MAPS (hr=0x80508015` | The firewall is blocking the connection or conducting SSL inspection. | +| `ValidateMapsConnection failed to establish a connection to MAPS (hr=800722F0D` | The firewall is blocking the connection or conducting SSL inspection. | +| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80072EE7 httpcode=451)` | The firewall is blocking the connection or conducting SSL inspection. | + +## Related topics + +- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..3108c5ea6b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md @@ -0,0 +1,61 @@ +--- +title: Common mistakes to avoid when defining exclusions +description: Avoid common mistakes when defining exclusions for Microsoft Defender Antivirus scans. +keywords: exclusions, files, extension, file type, folder name, file name, scans +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Common mistakes to avoid when defining exclusions + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. Such excluded items could contain threats that make your device vulnerable. + +This article describes some common mistake that you should avoid when defining exclusions. + +Before defining your exclusion lists, see [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions). + +## Excluding certain trusted items + +Certain files, file types, folders, or processes should not be excluded from scanning even though you trust them to be not malicious. + +Do not define exclusions for the folder locations, file extensions, and processes that are listed in the following table: + +| Folder locations | File extensions | Processes | +|:--|:--|:--| +| `%systemdrive%`
    `C:`
    `C:\`
    `C:\*`
    `%ProgramFiles%\Java`
    `C:\Program Files\Java`
    `%ProgramFiles%\Contoso\`
    `C:\Program Files\Contoso\`
    `%ProgramFiles(x86)%\Contoso\`
    `C:\Program Files (x86)\Contoso\`
    `C:\Temp`
    `C:\Temp\`
    `C:\Temp\*`
    `C:\Users\`
    `C:\Users\*`
    `C:\Users\\AppData\Local\Temp\`
    `C:\Users\\AppData\LocalLow\Temp\`
    `C:\Users\\AppData\Roaming\Temp\`
    `%Windir%\Prefetch`
    `C:\Windows\Prefetch`
    `C:\Windows\Prefetch\`
    `C:\Windows\Prefetch\*`
    `%Windir%\System32\Spool`
    `C:\Windows\System32\Spool`
    `C:\Windows\System32\CatRoot2`
    `%Windir%\Temp`
    `C:\Windows\Temp`
    `C:\Windows\Temp\`
    `C:\Windows\Temp\*` | `.7zip`
    `.bat`
    `.bin`
    `.cab`
    `.cmd`
    `.com`
    `.cpl`
    `.dll`
    `.exe`
    `.fla`
    `.gif`
    `.gz`
    `.hta`
    `.inf`
    `.java`
    `.jar`
    `.job`
    `.jpeg`
    `.jpg`
    `.js`
    `.ko`
    `.ko.gz`
    `.msi`
    `.ocx`
    `.png`
    `.ps1`
    `.py`
    `.rar`
    `.reg`
    `.scr`
    `.sys`
    `.tar`
    `.tmp`
    `.url`
    `.vbe`
    `.vbs`
    `.wsf`
    `.zip` | `AcroRd32.exe`
    `bitsadmin.exe`
    `excel.exe`
    `iexplore.exe`
    `java.exe`
    `outlook.exe`
    `psexec.exe`
    `powerpnt.exe`
    `powershell.exe`
    `schtasks.exe`
    `svchost.exe`
    `wmic.exe`
    `winword.exe`
    `wuauclt.exe`
    `addinprocess.exe`
    `addinprocess32.exe`
    `addinutil.exe`
    `bash.exe`
    `bginfo.exe`[1]
    `cdb.exe`
    `csi.exe`
    `dbghost.exe`
    `dbgsvc.exe`
    `dnx.exe`
    `fsi.exe`
    `fsiAnyCpu.exe`
    `kd.exe`
    `ntkd.exe`
    `lxssmanager.dll`
    `msbuild.exe`[2]
    `mshta.exe`
    `ntsd.exe`
    `rcsi.exe`
    `system.management.automation.dll`
    `windbg.exe` | + +>[!NOTE] +> You can chose to exclude file types, such as `.gif`, `.jpg`, `.jpeg`, or `.png` if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. + +## Using just the file name in the exclusion list + +A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude `Filename.exe` from scanning, use the complete path to the file, such as `C:\program files\contoso\Filename.exe`. + +## Using a single exclusion list for multiple server workloads + +Do not use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload. + +## Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists + +Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system environment variables. + +See [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for information on how to use wildcards in exclusion lists. + +## Related articles + +- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..060cddd476 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md @@ -0,0 +1,46 @@ +--- +title: Manage Windows Defender in your business +description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Microsoft Defender AV +keywords: group policy, gpo, config manager, sccm, scep, powershell, wmi, intune, defender, antivirus, antimalware, security, protection +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 12/16/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Manage Microsoft Defender Antivirus in your business + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can manage and configure Microsoft Defender Antivirus with the following tools: + +- [Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-antivirus-policy) (now part of Microsoft Endpoint Manager) +- [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure) (now part of Microsoft Endpoint Manager) +- [Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) +- [PowerShell cmdlets](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) +- [Windows Management Instrumentation (WMI)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus) +- The [Microsoft Malware Protection Command Line Utility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) (referred to as the *mpcmdrun.exe* utility + +The following articles provide further information, links, and resources for using these tools to manage and configure Microsoft Defender Antivirus. + +| Article | Description | +|:---|:---| +|[Manage Microsoft Defender Antivirus with Microsoft Intune and Microsoft Endpoint Configuration Manager](use-intune-config-manager-microsoft-defender-antivirus.md)|Information about using Intune and Configuration Manager to deploy, manage, report, and configure Microsoft Defender Antivirus | +|[Manage Microsoft Defender Antivirus with Group Policy settings](use-group-policy-microsoft-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates | +|[Manage Microsoft Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md)|Instructions for using PowerShell cmdlets to manage Microsoft Defender Antivirus, plus links to documentation for all cmdlets and allowed parameters | +|[Manage Microsoft Defender Antivirus with Windows Management Instrumentation (WMI)](use-wmi-microsoft-defender-antivirus.md)| Instructions for using WMI to manage Microsoft Defender Antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties) | +|[Manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool](command-line-arguments-microsoft-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Microsoft Defender Antivirus | diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..7782d63b95 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md @@ -0,0 +1,95 @@ +--- +title: Configure scanning options for Microsoft Defender AV +description: You can configure Microsoft Defender AV to scan email storage files, back-up or reparse points, network files, and archived files (such as .zip files). +keywords: advanced scans, scanning, email, archive, zip, rar, archive, reparse scanning +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure Microsoft Defender Antivirus scanning options + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +## Use Microsoft Intune to configure scanning options + +See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details. + +## Use Microsoft Endpoint Manager to configure scanning options + +See [How to create and deploy antimalware policies: Scan settings](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring Microsoft Endpoint Manager (current branch). + +## Use Group Policy to configure scanning options + +To configure the Group Policy settings described in the following table: + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. + +3. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below. + +4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. + +Description | Location and setting | Default setting (if not configured) | PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class +---|---|---|--- +Email scanning See [Email scanning limitations](#ref1)| Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning` +Scan [reparse points](https://msdn.microsoft.com/library/windows/desktop/aa365503.aspx) | Scan > Turn on reparse point scanning | Disabled | Not available +Scan mapped network drives | Scan > Run full scan on mapped network drives | Disabled | `-DisableScanningMappedNetworkDrivesForFullScan` + Scan archive files (such as .zip or .rar files). The [extensions exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md) will take precedence over this setting. | Scan > Scan archive files | Enabled | `-DisableArchiveScanning` +Scan files on the network | Scan > Scan network files | Disabled | `-DisableScanningNetworkFiles` +Scan packed executables | Scan > Scan packed executables | Enabled | Not available +Scan removable drives during full scans only | Scan > Scan removable drives | Disabled | `-DisableRemovableDriveScanning` +Specify the level of subfolders within an archive folder to scan | Scan > Specify the maximum depth to scan archive files | 0 | Not available + Specify the maximum CPU load (as a percentage) during a scan. Note: This is not a hard limit but rather a guidance for the scanning engine to not exceed this maximum on average. | Scan > Specify the maximum percentage of CPU utilization during a scan | 50 | `-ScanAvgCPULoadFactor` + Specify the maximum size (in kilobytes) of archive files that should be scanned. The default, **0**, applies no limit | Scan > Specify the maximum size of archive files to be scanned | No limit | Not available + Configure low CPU priority for scheduled scans | Scan > Configure low CPU priority for scheduled scans | Disabled | Not available + +> [!NOTE] +> If real-time protection is turned on, files are scanned before they are accessed and executed. The scanning scope includes all files, including files on mounted removable media, such as USB drives. If the device performing the scan has real-time protection or on-access protection turned on, the scan will also include network shares. + +## Use PowerShell to configure scanning options + +See [Manage Microsoft Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +## Use WMI to configure scanning options + +For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx). + + + +## Email scanning limitations + +Email scanning enables scanning of email files used by Outlook and other mail clients during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated: + +- DBX +- MBX +- MIME + +PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) will also be scanned, but Windows Defender cannot remediate threats detected inside PST files. + +If Microsoft Defender Antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat manually: + +- Email subject +- Attachment name + +## Related topics + +- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) +- [Configure and run on-demand Microsoft Defender Antivirus scans](run-scan-microsoft-defender-antivirus.md) +- [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..801001d7ef --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -0,0 +1,176 @@ +--- +title: Enable block at first sight to detect malware in seconds +description: Turn on the block at first sight feature to detect and block malware within seconds. +keywords: scan, BAFS, malware, first seen, first sight, cloud, defender +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +author: denisebmsft +ms.author: deniseb +ms.reviewer: +manager: dansimp +ms.custom: nextgen +ms.date: 10/22/2020 +ms.technology: mde +--- + +# Turn on block at first sight + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (such as 50 seconds), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments. + +You can [specify how long a file should be prevented from running](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) while the cloud-based protection service analyzes the file. And, you can [customize the message displayed on users' desktops](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL. + +>[!TIP] +>Visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. + +## How it works + +When Microsoft Defender Antivirus encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend applies heuristics, machine learning, and automated analysis of the file to determine whether the files are malicious or not a threat. + +Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, intelligent, and real-time protection. To learn more, see this blog: [Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). +![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) + +In Windows 10, version 1803 or later, block at first sight can block non-portable executable files (such as JS, VBS, or macros) as well as executable files. + +Block at first sight only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if the file is a previously undetected file. + +If the cloud backend is unable to make a determination, Microsoft Defender Antivirus locks the file and uploads a copy to the cloud. The cloud performs additional analysis to reach a determination before it either allows the file to run or blocks it in all future encounters, depending on whether it determines the file to be malicious or safe. + +In many cases, this process can reduce the response time for new malware from hours to seconds. + +## Turn on block at first sight with Microsoft Intune + +> [!TIP] +> Microsoft Intune is now part of Microsoft Endpoint Manager. + +1. In the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), navigate to **Devices** > **Configuration profiles**. + +2. Select or create a profile using the **Device restrictions** profile type. + +3. In the **Configuration settings** for the Device restrictions profile, set or confirm the following settings under **Microsoft Defender Antivirus**: + + - **Cloud-delivered protection**: Enabled + - **File Blocking Level**: High + - **Time extension for file scanning by the cloud**: 50 + - **Prompt users before sample submission**: Send all data without prompting + + ![Intune config](images/defender/intune-block-at-first-sight.png) + +4. Save your settings. + +> [!TIP] +> - Setting the file blocking level to **High** applies a strong level of detection. In the unlikely event that file blocking causes a false positive detection of legitimate files, you can [restore quarantined files](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus). +> - For more information about configuring Microsoft Defender Antivirus device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). +> - For a list of Microsoft Defender Antivirus device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus). + +## Turn on block at first sight with Microsoft Endpoint Manager + +> [!TIP] +> If you're looking for Microsoft Endpoint Configuration Manager, it's now part of Microsoft Endpoint Manager. + +1. In Microsoft Endpoint Manager ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), go to **Endpoint security** > **Antivirus**. + +2. Select an existing policy, or create a new policy using the **Microsoft Defender Antivirus** profile type. + +3. Set or confirm the following configuration settings: + + - **Turn on cloud-delivered protection**: Yes + - **Cloud-delivered protection level**: High + - **Defender Cloud Extended Timeout in Seconds**: 50 + + :::image type="content" source="images/endpointmgr-antivirus-cloudprotection.png" alt-text="Block at first sight settings in Endpoint Manager"::: + +4. Apply the Microsoft Defender Antivirus profile to a group, such as **All users**, **All devices**, or **All users and devices**. + +## Turn on block at first sight with Group Policy + +> [!NOTE] +> We recommend using Intune or Microsoft Endpoint Manager to turn on block at first sight. + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. + +2. Using the **Group Policy Management Editor** go to **Computer configuration** > **Administrative templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS**. + +3. In the MAPS section, double-click **Configure the 'Block at First Sight' feature**, and set it to **Enabled**, and then select **OK**. + + > [!IMPORTANT] + > Setting to **Always prompt (0)** will lower the protection state of the device. Setting to **Never send (2)** means block at first sight will not function. + +4. In the MAPS section, double-click **Send file samples when further analysis is required**, and set it to **Enabled**. Under **Send file samples when further analysis is required**, select **Send all samples**, and then click **OK**. + +5. If you changed any settings, redeploy the Group Policy Object across your network to ensure all endpoints are covered. + +## Confirm block at first sight is enabled on individual clients + +You can confirm that block at first sight is enabled on individual clients using Windows security settings. + +Block at first sight is automatically enabled as long as **Cloud-delivered protection** and **Automatic sample submission** are both turned on. + +1. Open the Windows Security app. + +2. Select **Virus & threat protection**, and then, under **Virus & threat protection settings**, select **Manage Settings**. + + ![Screenshot of the Virus & threat protection settings label in the Windows Security app](images/defender/wdav-protection-settings-wdsc.png) + +3. Confirm that **Cloud-delivered protection** and **Automatic sample submission** are both turned on. + +> [!NOTE] +> - If the prerequisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. +> - Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. + +## Validate block at first sight is working + +To validate that the feature is working, follow the guidance in [Validate connections between your network and the cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud). + +## Turn off block at first sight + +> [!CAUTION] +> Turning off block at first sight will lower the protection state of your device(s) and your network. + +You might choose to disable block at first sight if you want to retain the prerequisite settings without actually using block at first sight protection. You might do temporarily turn block at first sight off if you are experiencing latency issues or you want to test the feature's impact on your network. However, we do not recommend disabling block at first sight protection permanently. + +### Turn off block at first sight with Microsoft Endpoint Manager + +1. Go to Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. + +2. Go to **Endpoint security** > **Antivirus**, and then select your Microsoft Defender Antivirus policy. + +3. Under **Manage**, choose **Properties**. + +4. Next to **Configuration settings**, choose **Edit**. + +5. Change one or more of the following settings: + + - Set **Turn on cloud-delivered protection** to **No** or **Not configured**. + - Set **Cloud-delivered protection level** to **Not configured**. + - Clear the **Defender Cloud Extended Timeout In Seconds** box. + +6. Review and save your settings. + +### Turn off block at first sight with Group Policy + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and then click **Edit**. + +2. Using the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. + +3. Expand the tree through **Windows components** > **Microsoft Defender Antivirus** > **MAPS**. + +4. Double-click **Configure the 'Block at First Sight' feature** and set the option to **Disabled**. + + > [!NOTE] + > Disabling block at first sight does not disable or alter the prerequisite group policies. + +## See also + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) + +- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..fc9ab62d48 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md @@ -0,0 +1,56 @@ +--- +title: Configure the Microsoft Defender AV cloud block timeout period +description: You can configure how long Microsoft Defender Antivirus will block a file from running while waiting for a cloud determination. +keywords: Microsoft Defender Antivirus, antimalware, security, defender, cloud, timeout, block, period, seconds +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure the cloud block timeout period + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +When Microsoft Defender Antivirus finds a suspicious file, it can prevent the file from running while it queries the [Microsoft Defender Antivirus cloud service](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). + +The default period that the file will be [blocked](configure-block-at-first-sight-microsoft-defender-antivirus.md) is 10 seconds. You can specify an additional period of time to wait before the file is allowed to run. This can help ensure there is enough time to receive a proper determination from the Microsoft Defender Antivirus cloud service. + +## Prerequisites to use the extended cloud block timeout + +[Block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) and its prerequisites must be enabled before you can specify an extended timeout period. + +## Specify the extended timeout period + +You can use Group Policy to specify an extended timeout for cloud checks. + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. + +3. Expand the tree to **Windows components > Microsoft Defender Antivirus > MpEngine** + +4. Double-click **Configure extended cloud check** and ensure the option is enabled. Specify the additional amount of time to prevent the file from running while waiting for a cloud determination. You can specify the additional time, in seconds, from 1 second to 50 seconds. This time will be added to the default 10 seconds. + +5. Click **OK**. + +## Related topics + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Use next-generation antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) +- [Configure block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) +- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..91d207c1bc --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md @@ -0,0 +1,38 @@ +--- +title: Configure how users can interact with Microsoft Defender AV +description: Configure how end-users interact with Microsoft Defender AV, what notifications they see, and if they can override settings. +keywords: endpoint, user, interaction, notifications, ui lockdown mode, headless mode, hide interface +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure end-user interaction with Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can configure how users of the endpoints on your network can interact with Microsoft Defender Antivirus. + +This includes whether they see the Microsoft Defender Antivirus interface, what notifications they see, and if they can locally override globally-deployed Group Policy settings. + +## In this section + +Topic | Description +---|--- +[Configure notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) | Configure and customize additional notifications, customized text for notifications, and notifications about reboots for remediation +[Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) | Hide the user interface from users +[Prevent users from locally modifying policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | Prevent (or allow) users from overriding policy settings on their individual endpoints diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..beb6882a8b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md @@ -0,0 +1,54 @@ +--- +title: Set up exclusions for Microsoft Defender AV scans +description: You can exclude files (including files modified by specified processes) and folders from being scanned by Microsoft Defender AV. Validate your exclusions with PowerShell. +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure and validate exclusions for Microsoft Defender Antivirus scans + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can exclude certain files, folders, processes, and process-opened files from Microsoft Defender Antivirus scans. Such exclusions apply to [scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection. + +## Configure and validate exclusions + +To configure and validate exclusions, see the following: + +- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md). This enables you to exclude files from Microsoft Defender Antivirus scans based on their file extension, file name, or location. + +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md). This enables you to exclude files from scans that have been opened by a specific process. + +## Recommendations for defining exclusions + +Defining exclusions lowers the protection offered by Microsoft Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. + +The following is a list of recommendations that you should keep in mind when defining exclusions: + +- Exclusions are technically a protection gap—always consider additional mitigations when defining exclusions. Additional mitigations could be as simple as making sure the excluded location has the appropriate access-control lists (ACLs), audit policy, is processed by an up-to-date software, etc. + +- Review the exclusions periodically. Re-check and re-enforce the mitigations as part of the review process. + +- Ideally, avoid defining proactive exclusions. For instance, don't exclude something just because you think it might be a problem in the future. Use exclusions only for specific issues—mostly around performance, or sometimes around application compatibility that exclusions could mitigate. + +- Audit the exclusion list changes. The security admin should preserve enough context around why a certain exclusion was added. You should be able to provide answer with specific reasoning as to why a certain path was excluded. + +## Related articles + +- [Microsoft Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md) +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..54c891a786 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -0,0 +1,363 @@ +--- +title: Configure and validate exclusions based on extension, name, or location +description: Exclude files from Microsoft Defender Antivirus scans based on their file extension, file name, or location. +keywords: exclusions, files, extension, file type, folder name, file name, scans +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure and validate exclusions based on file extension and folder location + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +> [!IMPORTANT] +> Microsoft Defender Antivirus exclusions don't apply to other Microsoft Defender for Endpoint capabilities, including [endpoint detection and response (EDR)](../microsoft-defender-atp/overview-endpoint-detection-response.md), [attack surface reduction (ASR) rules](../microsoft-defender-atp/attack-surface-reduction.md), and [controlled folder access](../microsoft-defender-atp/controlled-folders.md). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. To exclude files broadly, add them to the Microsoft Defender for Endpoint [custom indicators](../microsoft-defender-atp/manage-indicators.md). + +## Exclusion lists + +You can exclude certain files from Microsoft Defender Antivirus scans by modifying exclusion lists. **Generally, you shouldn't need to apply exclusions**. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. + +**Note**: Exclusions apply to Potentially Unwanted Apps (PUA) detections as well. + +> [!NOTE] +> Automatic exclusions apply only to Windows Server 2016 and above. These exclusions are not visible in the Windows Security app and in PowerShell. + +This article describes how to configure exclusion lists for the files and folders. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. + +| Exclusion | Examples | Exclusion list | +|:---|:---|:---| +|Any file with a specific extension | All files with the specified extension, anywhere on the machine.
    Valid syntax: `.test` and `test` | Extension exclusions | +|Any file under a specific folder | All files under the `c:\test\sample` folder | File and folder exclusions | +| A specific file in a specific folder | The file `c:\sample\sample.test` only | File and folder exclusions | +| A specific process | The executable file `c:\test\process.exe` | File and folder exclusions | + +Exclusion lists have the following characteristics: + +- Folder exclusions apply to all files and folders under that folder, unless the subfolder is a reparse point. Reparse point subfolders must be excluded separately. +- File extensions apply to any file name with the defined extension if a path or folder is not defined. + +> [!IMPORTANT] +> - Using wildcards such as the asterisk (\*) will alter how the exclusion rules are interpreted. See the [Use wildcards in the file name and folder path or extension exclusion lists](#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) section for important information about how wildcards work. +> - You cannot exclude mapped network drives. You must specify the actual network path. +> - Folders that are reparse points that are created after the Microsoft Defender Antivirus service starts and that have been added to the exclusion list will not be included. You must restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target. + +To exclude files opened by a specific process, see [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md). + +The exclusions apply to [scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md). + +> [!IMPORTANT] +> Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions). +> Changes made in the Windows Security app **will not show** in the Group Policy lists. + +By default, local changes made to the lists (by users with administrator privileges, including changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists take precedence when there are conflicts. + +You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-microsoft-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings. + +## Configure the list of exclusions based on folder name or file extension + +### Use Intune to configure file name, folder, or file extension exclusions + +See the following articles: +- [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) +- [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus) + +### Use Configuration Manager to configure file name, folder, or file extension exclusions + +See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring Microsoft Endpoint Manager (current branch). + +### Use Group Policy to configure folder or file extension exclusions + +>[!NOTE] +>If you specify a fully qualified path to a file, then only that file is excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder are excluded. + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**. + +3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Exclusions**. + +4. Open the **Path Exclusions** setting for editing, and add your exclusions. + + - Set the option to **Enabled**. + - Under the **Options** section, click **Show...**. + - Specify each folder on its own line under the **Value name** column. + - If you are specifying a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column. + +5. Choose **OK**. + + ![The Group Policy setting for file and folder exclusions](images/defender/wdav-path-exclusions.png) + +6. Open the **Extension Exclusions** setting for editing and add your exclusions. + + - Set the option to **Enabled**. + - Under the **Options** section, select **Show...**. + - Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column. + +7. Choose **OK**. + + + +### Use PowerShell cmdlets to configure file name, folder, or file extension exclusions + +Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/itpro/powershell/windows/defender/defender). + +The format for the cmdlets is as follows: + +```PowerShell + - "" +``` + +The following are allowed as the ``: + +| Configuration action | PowerShell cmdlet | +|:---|:---| +|Create or overwrite the list | `Set-MpPreference` | +|Add to the list | `Add-MpPreference` | +|Remove item from the list | `Remove-MpPreference` | + +The following are allowed as the ``: + +| Exclusion type | PowerShell parameter | +|:---|:---| +| All files with a specified file extension | `-ExclusionExtension` | +| All files under a folder (including files in subdirectories), or a specific file | `-ExclusionPath` | + +> [!IMPORTANT] +> If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. + +For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file with the `.test` file extension: + +```PowerShell +Add-MpPreference -ExclusionExtension ".test" +``` + +For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index). + +### Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions + +Use the [**Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +ExclusionExtension +ExclusionPath +``` + +The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. + +For more information, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx). + + + +### Use the Windows Security app to configure file name, folder, or file extension exclusions + +See [Add exclusions in the Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions) for instructions. + + + +## Use wildcards in the file name and folder path or extension exclusion lists + +You can use the asterisk `*`, question mark `?`, or environment variables (such as `%ALLUSERSPROFILE%`) as wildcards when defining items in the file name or folder path exclusion list. The way in which these wildcards are interpreted differs from their usual usage in other apps and languages. Make sure to read this section to understand their specific limitations. + +> [!IMPORTANT] +> There are key limitations and usage scenarios for these wildcards: +> - Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. +> - You cannot use a wildcard in place of a drive letter. +> - An asterisk `*` in a folder exclusion stands in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names. + +The following table describes how the wildcards can be used and provides some examples. + + +|Wildcard |Examples | +|:---------|:---------| +|`*` (asterisk)

    In **file name and file extension inclusions**, the asterisk replaces any number of characters, and only applies to files in the last folder defined in the argument.

    In **folder exclusions**, the asterisk replaces a single folder. Use multiple `*` with folder slashes `\` to indicate multiple nested folders. After matching the number of wild carded and named folders, all subfolders are also included. | `C:\MyData\*.txt` would include `C:\MyData\notes.txt`

    `C:\somepath\*\Data` would include any file in `C:\somepath\Archives\Data and its subfolders` and `C:\somepath\Authorized\Data and its subfolders`

    `C:\Serv\*\*\Backup` would include any file in `C:\Serv\Primary\Denied\Backup and its subfolders` and `C:\Serv\Secondary\Allowed\Backup and its subfolders` | +|`?` (question mark)

    In **file name and file extension inclusions**, the question mark replaces a single character, and only applies to files in the last folder defined in the argument.

    In **folder exclusions**, the question mark replaces a single character in a folder name. After matching the number of wild carded and named folders, all subfolders are also included. |`C:\MyData\my?` would include `C:\MyData\my1.zip`

    `C:\somepath\?\Data` would include any file in `C:\somepath\P\Data` and its subfolders

    `C:\somepath\test0?\Data` would include any file in `C:\somepath\test01\Data` and its subfolders | +|Environment variables

    The defined variable is populated as a path when the exclusion is evaluated. |`%ALLUSERSPROFILE%\CustomLogFiles` would include `C:\ProgramData\CustomLogFiles\Folder1\file1.txt` | + + +> [!IMPORTANT] +> If you mix a file exclusion argument with a folder exclusion argument, the rules will stop at the file argument match in the matched folder, and will not look for file matches in any subfolders. +> For example, you can exclude all files that start with "date" in the folders `c:\data\final\marked` and `c:\data\review\marked` by using the rule argument `c:\data\*\marked\date*`. +> This argument, however, will not match any files in subfolders under `c:\data\final\marked` or `c:\data\review\marked`. + + + +### System environment variables + +The following table lists and describes the system account environment variables. + +| This system environment variable... | Redirects to this | +|:--|:--| +| `%APPDATA%`| `C:\Users\UserName.DomainName\AppData\Roaming` | +| `%APPDATA%\Microsoft\Internet Explorer\Quick Launch` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch` | +| `%APPDATA%\Microsoft\Windows\Start Menu` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu` | +| `%APPDATA%\Microsoft\Windows\Start Menu\Programs` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs` | +| `%LOCALAPPDATA%` | `C:\Windows\System32\config\systemprofile\AppData\Local` | +| `%ProgramData%` | `C:\ProgramData` | +| `%ProgramFiles%` | `C:\Program Files` | +| `%ProgramFiles%\Common Files` | `C:\Program Files\Common Files` | +| `%ProgramFiles%\Windows Sidebar\Gadgets` | `C:\Program Files\Windows Sidebar\Gadgets` | +| `%ProgramFiles%\Common Files` | `C:\Program Files\Common Files` | +| `%ProgramFiles(x86)%` | `C:\Program Files (x86)` | +| `%ProgramFiles(x86)%\Common Files` | `C:\Program Files (x86)\Common Files` | +| `%SystemDrive%` | `C:` | +| `%SystemDrive%\Program Files` | `C:\Program Files` | +| `%SystemDrive%\Program Files (x86)` | `C:\Program Files (x86)` | +| `%SystemDrive%\Users` | `C:\Users` | +| `%SystemDrive%\Users\Public` | `C:\Users\Public` | +| `%SystemRoot%` | `C:\Windows` | +| `%windir%` | `C:\Windows` | +| `%windir%\Fonts` | `C:\Windows\Fonts` | +| `%windir%\Resources` | `C:\Windows\Resources` | +| `%windir%\resources\0409` | `C:\Windows\resources\0409` | +| `%windir%\system32` | `C:\Windows\System32` | +| `%ALLUSERSPROFILE%` | `C:\ProgramData` | +| `%ALLUSERSPROFILE%\Application Data` | `C:\ProgramData\Application Data` | +| `%ALLUSERSPROFILE%\Documents` | `C:\ProgramData\Documents` | +| `%ALLUSERSPROFILE%\Documents\My Music\Sample Music` | `C:\ProgramData\Documents\My Music\Sample Music` | +| `%ALLUSERSPROFILE%\Documents\My Music` | `C:\ProgramData\Documents\My Music` | +| `%ALLUSERSPROFILE%\Documents\My Pictures` | `C:\ProgramData\Documents\My Pictures` | +| `%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures` | `C:\ProgramData\Documents\My Pictures\Sample Pictures` | +| `%ALLUSERSPROFILE%\Documents\My Videos` | `C:\ProgramData\Documents\My Videos` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\DeviceMetadataStore` | `C:\ProgramData\Microsoft\Windows\DeviceMetadataStore` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\GameExplorer` | `C:\ProgramData\Microsoft\Windows\GameExplorer` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones` | `C:\ProgramData\Microsoft\Windows\Ringtones` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu` | `C:\ProgramData\Microsoft\Windows\Start Menu` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp` | +| `%ALLUSERSPROFILE%\Microsoft\Windows\Templates` | `C:\ProgramData\Microsoft\Windows\Templates` | +| `%ALLUSERSPROFILE%\Start Menu` | `C:\ProgramData\Start Menu` | +| `%ALLUSERSPROFILE%\Start Menu\Programs` | C:\ProgramData\Start Menu\Programs | +| `%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools` | `C:\ProgramData\Start Menu\Programs\Administrative Tools` | +| `%ALLUSERSPROFILE%\Templates` | `C:\ProgramData\Templates` | +| `%LOCALAPPDATA%\Microsoft\Windows\ConnectedSearch\Templates` | `C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\ConnectedSearch\Templates` | +| `%LOCALAPPDATA%\Microsoft\Windows\History` | `C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History` | +| `%PUBLIC%` | `C:\Users\Public` | +| `%PUBLIC%\AccountPictures` | `C:\Users\Public\AccountPictures` | +| `%PUBLIC%\Desktop` | `C:\Users\Public\Desktop` | +| `%PUBLIC%\Documents` | `C:\Users\Public\Documents` | +| `%PUBLIC%\Downloads` | `C:\Users\Public\Downloads` | +| `%PUBLIC%\Music\Sample Music` | `C:\Users\Public\Music\Sample Music` | +| `%PUBLIC%\Music\Sample Playlists` | `C:\Users\Public\Music\Sample Playlists` | +| `%PUBLIC%\Pictures\Sample Pictures` | `C:\Users\Public\Pictures\Sample Pictures` | +| `%PUBLIC%\RecordedTV.library-ms` | `C:\Users\Public\RecordedTV.library-ms` | +| `%PUBLIC%\Videos` | `C:\Users\Public\Videos` | +| `%PUBLIC%\Videos\Sample Videos` | `C:\Users\Public\Videos\Sample Videos` | +| `%USERPROFILE%` | `C:\Windows\System32\config\systemprofile` | +| `%USERPROFILE%\AppData\Local` | `C:\Windows\System32\config\systemprofile\AppData\Local` | +| `%USERPROFILE%\AppData\LocalLow` | `C:\Windows\System32\config\systemprofile\AppData\LocalLow` | +| `%USERPROFILE%\AppData\Roaming` | `C:\Windows\System32\config\systemprofile\AppData\Roaming` | + + +## Review the list of exclusions + +You can retrieve the items in the exclusion list using one of the following methods: +- [Intune](https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) +- [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) +- MpCmdRun +- PowerShell +- [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions) + +>[!IMPORTANT] +>Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions). +> +>Changes made in the Windows Security app **will not show** in the Group Policy lists. + +If you use PowerShell, you can retrieve the list in two ways: + +- Retrieve the status of all Microsoft Defender Antivirus preferences. Each list is displayed on separate lines, but the items within each list are combined into the same line. +- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. + +### Validate the exclusion list by using MpCmdRun + +To check exclusions with the dedicated [command-line tool mpcmdrun.exe](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus?branch=v-anbic-wdav-new-mpcmdrun-options), use the following command: + +```DOS +Start, CMD (Run as admin) +cd "%programdata%\microsoft\windows defender\platform" +cd 4.18.1812.3 (Where 4.18.1812.3 is this month's MDAV "Platform Update".) +MpCmdRun.exe -CheckExclusion -path +``` + +>[!NOTE] +>Checking exclusions with MpCmdRun requires Microsoft Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later. + +### Review the list of exclusions alongside all other Microsoft Defender Antivirus preferences by using PowerShell + +Use the following cmdlet: + +```PowerShell +Get-MpPreference +``` + +In the following example, the items contained in the `ExclusionExtension` list are highlighted: + +![PowerShell output for Get-MpPreference showing the exclusion list alongside other preferences](images/defender/wdav-powershell-get-exclusions-all.png) + +For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index). + +### Retrieve a specific exclusions list by using PowerShell + +Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: + +```PowerShell +$WDAVprefs = Get-MpPreference +$WDAVprefs.ExclusionExtension +$WDAVprefs.ExclusionPath +``` + +In the following example, the list is split into new lines for each use of the `Add-MpPreference` cmdlet: + +![PowerShell output showing only the entries in the exclusion list](images/defender/wdav-powershell-get-exclusions-variable.png) + +For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index). + + + +## Validate exclusions lists with the EICAR test file + +You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. + +In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you are testing a path, ensure you run the cmdlet within that path. + +```PowerShell +Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" +``` + +If Microsoft Defender Antivirus reports malware, then the rule is not working. If there is no report of malware and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR test file website](http://www.eicar.org/86-0-Intended-use.html). + +You can also use the following PowerShell code, which calls the .NET WebClient class to download the test file - as with the `Invoke-WebRequest` cmdlet; replace *c:\test.txt* with a file that conforms to the rule you are validating: + +```PowerShell +$client = new-object System.Net.WebClient +$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt") +``` + +If you do not have Internet access, you can create your own EICAR test file by writing the EICAR string to a new text file with the following PowerShell command: + +```PowerShell +[io.file]::WriteAllText("test.txt",'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*') +``` + +You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. + +## Related topics + +- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..4b69f181b0 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md @@ -0,0 +1,95 @@ +--- +title: Configure local overrides for Microsoft Defender AV settings +description: Enable or disable users from locally changing settings in Microsoft Defender AV. +keywords: local override, local policy, group policy, gpo, lockdown,merge, lists +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 02/13/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Prevent or allow users to locally modify Microsoft Defender Antivirus policy settings + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +By default, Microsoft Defender Antivirus settings that are deployed via a Group Policy Object to the endpoints in your network will prevent users from locally changing the settings. You can change this in some instances. + +For example, it may be necessary to allow certain user groups (such as security researchers and threat investigators) further control over individual settings on the endpoints they use. + +## Configure local overrides for Microsoft Defender Antivirus settings + +The default setting for these policies is **Disabled**. + +If they are set to **Enabled**, users on endpoints can make changes to the associated setting with the [Windows Security](microsoft-defender-security-center-antivirus.md) app, local Group Policy settings, and PowerShell cmdlets (where appropriate). + +The following table lists each of the override policy setting and the configuration instructions for the associated feature or setting. + +To configure these settings: + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. + +3. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below. + +4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. + +5. Deploy the Group Policy Object as usual. + +Location | Setting | Article +---|---|---|--- +MAPS | Configure local setting override for reporting to Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) +Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override for turn on behavior monitoring | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override to turn on real-time protection | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) +Scan | Configure local setting override for maximum percentage of CPU utilization | [Configure and run scans](run-scan-microsoft-defender-antivirus.md) +Scan | Configure local setting override for schedule scan day | [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Configure local setting override for scheduled quick scan time | [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Configure local setting override for scheduled scan time | [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Configure local setting override for the scan type to use for a scheduled scan | [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) + + + +## Configure how locally and globally defined threat remediation and exclusions lists are merged + +You can also configure how locally defined lists are combined or merged with globally defined lists. This setting applies to [exclusion lists](configure-exclusions-microsoft-defender-antivirus.md), [specified remediation lists](configure-remediation-microsoft-defender-antivirus.md), and [attack surface reduction](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction). + +By default, lists that have been configured in local group policy and the Windows Security app are merged with lists that are defined by the appropriate Group Policy Object that you have deployed on your network. Where there are conflicts, the globally-defined list takes precedence. + +You can disable this setting to ensure that only globally-defined lists (such as those from any deployed GPOs) are used. + +### Use Group Policy to disable local list merging + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. + +3. Expand the tree to **Windows components > Microsoft Defender Antivirus**. + +4. Double-click **Configure local administrator merge behavior for lists** and set the option to **Disabled**. Click **OK**. + +> [!NOTE] +> If you disable local list merging, it will override controlled folder access settings. It also overrides any protected folders or allowed apps set by the local administrator. For more information about controlled folder access settings, see [Allow a blocked app in Windows Security](https://support.microsoft.com/help/4046851/windows-10-allow-blocked-app-windows-security). + +## Related topics + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md new file mode 100644 index 0000000000..6185228b0b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md @@ -0,0 +1,53 @@ +--- +title: Configure Microsoft Defender Antivirus features +description: You can configure Microsoft Defender Antivirus features with Intune, Microsoft Endpoint Configuration Manager, Group Policy, and PowerShell. +keywords: Microsoft Defender Antivirus, antimalware, security, defender, configure, configuration, Config Manager, Microsoft Endpoint Configuration Manager, SCCM, Intune, MDM, mobile device management, GP, group policy, PowerShell +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 11/18/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure Microsoft Defender Antivirus features + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can configure Microsoft Defender Antivirus with a number of tools, including: + +- Microsoft Intune +- Microsoft Endpoint Configuration Manager +- Group Policy +- PowerShell cmdlets +- Windows Management Instrumentation (WMI) + +The following broad categories of features can be configured: + +- Cloud-delivered protection +- Always-on real-time protection, including behavioral, heuristic, and machine-learning-based protection +- How end users interact with the client on individual endpoints + +The following articles describe how to perform key tasks when configuring Microsoft Defender Antivirus. Each article includes instructions for the applicable configuration tool (or tools). + +|Article |Description | +|---------|---------| +|[Utilize Microsoft cloud-provided Microsoft Defender Antivirus protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) | Use cloud-delivered protection for advanced, fast, robust antivirus detection. | +|[Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) |Enable behavior-based, heuristic, and real-time antivirus protection. | +|[Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) | Configure how end users in your organization interact with Microsoft Defender Antivirus, what notifications they see, and whether they can override settings. | + +> [!TIP] +> You can also review the [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) topic for an overview of each tool and links to further help. + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..f00a35da1f --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md @@ -0,0 +1,127 @@ +--- +title: Configure and validate Microsoft Defender Antivirus network connections +description: Configure and test your connection to the Microsoft Defender Antivirus cloud protection service. +keywords: antivirus, Microsoft Defender Antivirus, antimalware, security, defender, cloud, aggressiveness, protection level +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 12/28/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure and validate Microsoft Defender Antivirus network connections + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +To ensure Microsoft Defender Antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers. + +This article lists the connections that must be allowed, such as by using firewall rules, and provides instructions for validating your connection. Configuring your protection properly helps ensure that you receive the best value from your cloud-delivered protection services. + +See the blog post [Important changes to Microsoft Active Protection Services endpoint](https://techcommunity.microsoft.com/t5/Configuration-Manager-Archive/Important-changes-to-Microsoft-Active-Protection-Service-MAPS/ba-p/274006) for some details about network connectivity. + +>[!TIP] +>You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: +> +>- Cloud-delivered protection +>- Fast learning (including block at first sight) +>- Potentially unwanted application blocking + +## Allow connections to the Microsoft Defender Antivirus cloud service + +The Microsoft Defender Antivirus cloud service provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides important protection against malware on your endpoints and across your network. + +>[!NOTE] +>The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. + +See [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) for details on enabling the service with Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Security app. + +After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints. + +Because your protection is a cloud service, computers must have access to the internet and reach the Microsoft Defender for Office 365 machine learning services. Do not exclude the URL `*.blob.core.windows.net` from any kind of network inspection. + +The table below lists the services and their associated URLs. Make sure that there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL `*.blob.core.windows.net`). Below mention URLs are using port 443 for communication. + + +| **Service**| **Description** |**URL** | +| :--: | :-- | :-- | +| Microsoft Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)|Used by Microsoft Defender Antivirus to provide cloud-delivered protection|`*.wdcp.microsoft.com`
    `*.wdcpalt.microsoft.com`
    `*.wd.microsoft.com`| +| Microsoft Update Service (MU)
    Windows Update Service (WU)| Security intelligence and product updates |`*.update.microsoft.com`
    `*.delivery.mp.microsoft.com`
    `*.windowsupdate.com`

    For details see [Connection endpoints for Windows Update](https://docs.microsoft.com/windows/privacy/manage-windows-1709-endpoints#windows-update)| +|Security intelligence updates Alternate Download Location (ADL)| Alternate location for Microsoft Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)| `*.download.microsoft.com`
    `*.download.windowsupdate.com`
    `https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx`| +| Malware submission storage|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | `ussus1eastprod.blob.core.windows.net`
    `ussus1westprod.blob.core.windows.net`
    `usseu1northprod.blob.core.windows.net`
    `usseu1westprod.blob.core.windows.net`
    `ussuk1southprod.blob.core.windows.net`
    `ussuk1westprod.blob.core.windows.net`
    `ussas1eastprod.blob.core.windows.net`
    `ussas1southeastprod.blob.core.windows.net`
    `ussau1eastprod.blob.core.windows.net`
    `ussau1southeastprod.blob.core.windows.net` | +| Certificate Revocation List (CRL)|Used by Windows when creating the SSL connection to MAPS for updating the CRL | `http://www.microsoft.com/pkiops/crl/`
    `http://www.microsoft.com/pkiops/certs`
    `http://crl.microsoft.com/pki/crl/products`
    `http://www.microsoft.com/pki/certs` | +| Symbol Store|Used by Microsoft Defender Antivirus to restore certain critical files during remediation flows | `https://msdl.microsoft.com/download/symbols` | +| Universal Telemetry Client| Used by Windows to send client diagnostic data; Microsoft Defender Antivirus uses telemetry for product quality monitoring purposes | The update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: `vortex-win.data.microsoft.com`
    `settings-win.data.microsoft.com`| + +## Validate connections between your network and the cloud + +After allowing the URLs listed above, you can test if you are connected to the Microsoft Defender Antivirus cloud service and are correctly reporting and receiving information to ensure you are fully protected. + +**Use the cmdline tool to validate cloud-delivered protection:** + +Use the following argument with the Microsoft Defender Antivirus command-line utility (`mpcmdrun.exe`) to verify that your network can communicate with the Microsoft Defender Antivirus cloud service: + +```console +"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -ValidateMapsConnection +``` + +> [!NOTE] +> You need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. This command will only work on Windows 10, version 1703 or higher. + +For more information, see [Manage Microsoft Defender Antivirus with the mpcmdrun.exe commandline tool](command-line-arguments-microsoft-defender-antivirus.md). + +**Attempt to download a fake malware file from Microsoft:** + +You can download a sample file that Microsoft Defender Antivirus will detect and block if you are properly connected to the cloud. + +Download the file by visiting [https://aka.ms/ioavtest](https://aka.ms/ioavtest). + +>[!NOTE] +>This file is not an actual piece of malware. It is a fake file that is designed to test if you are properly connected to the cloud. + +If you are properly connected, you will see a warning Microsoft Defender Antivirus notification. + +If you are using Microsoft Edge, you'll also see a notification message: + +![Microsoft Edge informing the user that malware was found](images/defender/wdav-bafs-edge.png) + +A similar message occurs if you are using Internet Explorer: + +![Microsoft Defender Antivirus notification informing the user that malware was found](images/defender/wdav-bafs-ie.png) + +You will also see a detection under **Quarantined threats** in the **Scan history** section in the Windows Security app: + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Scan history** label: + + ![Screenshot of the Scan history label in the Windows Security app](images/defender/wdav-history-wdsc.png) + +3. Under the **Quarantined threats** section, select **See full history** to see the detected fake malware. + + > [!NOTE] + > Versions of Windows 10 before version 1703 have a different user interface. See [Microsoft Defender Antivirus in the Windows Security app](microsoft-defender-security-center-antivirus.md). + + The Windows event log will also show [Windows Defender client event ID 1116](troubleshoot-microsoft-defender-antivirus.md). + +## Related articles + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) + +- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) + +- [Command line arguments](command-line-arguments-microsoft-defender-antivirus.md) + +- [Important changes to Microsoft Active Protection Services endpoint](https://techcommunity.microsoft.com/t5/Configuration-Manager-Archive/Important-changes-to-Microsoft-Active-Protection-Service-MAPS/ba-p/274006) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..1660b6284e --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus.md @@ -0,0 +1,109 @@ +--- +title: Configure Microsoft Defender Antivirus notifications +description: Learn how to configure and customize both standard and additional Microsoft Defender Antivirus notifications on endpoints. +keywords: notifications, defender, antivirus, endpoint, management, admin +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure the notifications that appear on endpoints + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +In Windows 10, application notifications about malware detection and remediation are more robust, consistent, and concise. + +Notifications appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications also appear in the **Notification Center**, and a summary of scans and threat detections appear at regular time intervals. + +You can also configure how standard notifications appear on endpoints, such as notifications for reboot or when a threat has been detected and remediated. + +## Configure the additional notifications that appear on endpoints + +You can configure the display of additional notifications, such as recent threat detection summaries, in the [Windows Security app](microsoft-defender-security-center-antivirus.md) and with Group Policy. + +> [!NOTE] +> In Windows 10, version 1607 the feature was called **Enhanced notifications** and could be configured under **Windows Settings** > **Update & security** > **Windows Defender**. In Group Policy settings in all versions of Windows 10, it is called **Enhanced notifications**. + +> [!IMPORTANT] +> Disabling additional notifications will not disable critical notifications, such as threat detection and remediation alerts. + +**Use the Windows Security app to disable additional notifications:** + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Security app](images/defender/wdav-protection-settings-wdsc.png) + +3. Scroll to the **Notifications** section and click **Change notification settings**. + +4. Slide the switch to **Off** or **On** to disable or enable additional notifications. + +**Use Group Policy to disable additional notifications:** + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Administrative templates**. + +4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Reporting**. + +5. Double-click **Turn off enhanced notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. + +## Configure standard notifications on endpoints + +You can use Group Policy to: + +- Display additional, customized text on endpoints when the user needs to perform an action +- Hide all notifications on endpoints +- Hide reboot notifications on endpoints + +Hiding notifications can be useful in situations where you can't hide the entire Microsoft Defender Antivirus interface. See [Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) for more information. + +> [!NOTE] +> Hiding notifications will only occur on endpoints to which the policy has been deployed. Notifications related to actions that must be taken (such as a reboot) will still appear on the [Microsoft Endpoint Manager Endpoint Protection monitoring dashboard and reports](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). + +See [Customize the Windows Security app for your organization](../windows-defender-security-center/windows-defender-security-center.md) for instructions to add custom contact information to the notifications that users see on their machines. + +**Use Group Policy to hide notifications:** + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. + +3. Expand the tree to **Windows components > Microsoft Defender Antivirus > Client interface**. + +4. Double-click **Suppress all notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. + +**Use Group Policy to hide reboot notifications:** + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Administrative templates**. + +4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Client interface**. + +5. Double-click **Suppresses reboot notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. + +## Related topics + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..52641f673b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -0,0 +1,188 @@ +--- +title: Configure exclusions for files opened by specific processes +description: You can exclude files from scans if they have been opened by a specific process. +keywords: Microsoft Defender Antivirus, process, exclusion, files, scans +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure exclusions for files opened by processes + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can exclude files that have been opened by specific processes from Microsoft Defender Antivirus scans. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. + +This article describes how to configure exclusion lists. + +## Examples of exclusions + +|Exclusion | Example | +|---|---| +|Any file on the machine that is opened by any process with a specific file name | Specifying `test.exe` would exclude files opened by:
    `c:\sample\test.exe`
    `d:\internal\files\test.exe` | +|Any file on the machine that is opened by any process under a specific folder | Specifying `c:\test\sample\*` would exclude files opened by:
    `c:\test\sample\test.exe`
    `c:\test\sample\test2.exe`
    `c:\test\sample\utility.exe` | +|Any file on the machine that is opened by a specific process in a specific folder | Specifying `c:\test\process.exe` would exclude files only opened by `c:\test\process.exe` | + + +When you add a process to the process exclusion list, Microsoft Defender Antivirus won't scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md). + +The exclusions only apply to [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). They don't apply to scheduled or on-demand scans. + +Changes made with Group Policy to the exclusion lists **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Security app **will not show** in the Group Policy lists. + +You can add, remove, and review the lists for exclusions in Group Policy, Microsoft Endpoint Configuration Manager, Microsoft Intune, and with the Windows Security app, and you can use wildcards to further customize the lists. + +You can also use PowerShell cmdlets and WMI to configure the exclusion lists, including reviewing your lists. + +By default, local changes made to the lists (by users with administrator privileges; changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts. + +You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-microsoft-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings. + +## Configure the list of exclusions for files opened by specified processes + +### Use Microsoft Intune to exclude files that have been opened by specified processes from scans + +See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details. + +### Use Microsoft Endpoint Manager to exclude files that have been opened by specified processes from scans + +See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring Microsoft Endpoint Manager (current branch). + +### Use Group Policy to exclude files that have been opened by specified processes from scans + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. + +3. Expand the tree to **Windows components > Microsoft Defender Antivirus > Exclusions**. + +4. Double-click **Process Exclusions** and add the exclusions: + + 1. Set the option to **Enabled**. + 2. Under the **Options** section, click **Show...**. + 3. Enter each process on its own line under the **Value name** column. See the example table for the different types of process exclusions. Enter **0** in the **Value** column for all processes. + +5. Click **OK**. + +### Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans + +Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess` parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/itpro/powershell/windows/defender/defender). + +The format for the cmdlets is: + +```PowerShell + -ExclusionProcess "" +``` + +The following are allowed as the \: + +|Configuration action | PowerShell cmdlet | +|---|---| +|Create or overwrite the list | `Set-MpPreference` | +|Add to the list | `Add-MpPreference` | +|Remove items from the list | `Remove-MpPreference` | + +>[!IMPORTANT] +>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. + +For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file that is opened by the specified process: + +```PowerShell +Add-MpPreference -ExclusionProcess "c:\internal\test.exe" +``` + +For more information on how to use PowerShell with Microsoft Defender Antivirus, see Manage antivirus with PowerShell cmdlets and [Microsoft Defender Antivirus cmdlets](https://docs.microsoft.com/powershell/module/defender). + +### Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans + +Use the [**Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://docs.microsoft.com/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: + +```WMI +ExclusionProcess +``` + +The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. + +For more information and allowed parameters, see [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). + +### Use the Windows Security app to exclude files that have been opened by specified processes from scans + +See [Add exclusions in the Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions) for instructions. + +## Use wildcards in the process exclusion list + +The use of wildcards in the process exclusion list is different from their use in other exclusion lists. + +In particular, you cannot use the question mark (`?`) wildcard, and the asterisk (`*`) wildcard can only be used at the end of a complete path. You can still use environment variables (such as `%ALLUSERSPROFILE%`) as wildcards when defining items in the process exclusion list. + +The following table describes how the wildcards can be used in the process exclusion list: + +|Wildcard | Example use | Example matches | +|:---|:---|:---| +|`*` (asterisk)

    Replaces any number of characters | `C:\MyData\*` | Any file opened by `C:\MyData\file.exe` | +|Environment variables

    The defined variable is populated as a path when the exclusion is evaluated | `%ALLUSERSPROFILE%\CustomLogFiles\file.exe` | Any file opened by `C:\ProgramData\CustomLogFiles\file.exe` | + +## Review the list of exclusions + +You can retrieve the items in the exclusion list with MpCmdRun, PowerShell, [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/intune/device-restrictions-configure), or the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions). + +If you use PowerShell, you can retrieve the list in two ways: + +- Retrieve the status of all Microsoft Defender Antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. +- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. + +### Validate the exclusion list by using MpCmdRun + +To check exclusions with the dedicated [command-line tool mpcmdrun.exe](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus?branch=v-anbic-wdav-new-mpcmdrun-options), use the following command: + +```DOS +MpCmdRun.exe -CheckExclusion -path +``` + +> [!NOTE] +> Checking exclusions with MpCmdRun requires Microsoft Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later. + + +### Review the list of exclusions alongside all other Microsoft Defender Antivirus preferences by using PowerShell + +Use the following cmdlet: + +```PowerShell +Get-MpPreference +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Retrieve a specific exclusions list by using PowerShell + +Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: + +```PowerShell +$WDAVprefs = Get-MpPreference +$WDAVprefs.ExclusionProcess +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +## Related articles + +- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) +- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) +- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..12fa08755b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md @@ -0,0 +1,46 @@ +--- +title: Enable and configure Microsoft Defender Antivirus protection features +description: Enable behavior-based, heuristic, and real-time protection in Microsoft Defender AV. +keywords: heuristic, machine-learning, behavior monitor, real-time protection, always-on, Microsoft Defender Antivirus, antimalware, security, defender +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure behavioral, heuristic, and real-time protection + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Antivirus uses several methods to provide threat protection: + +- Cloud-delivered protection for near-instant detection and blocking of new and emerging threats +- Always-on scanning, using file and process behavior monitoring and other heuristics (also known as "real-time protection") +- Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research + +You can configure how Microsoft Defender Antivirus uses these methods with Group Policy, System Center Configuration Manage, PowerShell cmdlets, and Windows Management Instrumentation (WMI). + +This section covers configuration for always-on scanning, including how to detect and block apps that are deemed unsafe, but may not be detected as malware. + +See [Use next-gen Microsoft Defender Antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) for how to enable and configure Microsoft Defender Antivirus cloud-delivered protection. + +## In this section + + Topic | Description +---|--- +[Detect and block potentially unwanted applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) | Detect and block apps that may be unwanted in your network, such as adware, browser modifiers and toolbars, and rogue or fake antivirus apps +[Enable and configure Microsoft Defender Antivirus protection capabilities](configure-real-time-protection-microsoft-defender-antivirus.md) | Enable and configure real-time protection, heuristics, and other always-on Microsoft Defender Antivirus monitoring features diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..63abc5021b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md @@ -0,0 +1,136 @@ +--- +title: Enable and configure Microsoft Defender Antivirus protection capabilities +description: Enable and configure Microsoft Defender Antivirus real-time protection features such as behavior monitoring, heuristics, and machine-learning +keywords: antivirus, real-time protection, rtp, machine-learning, behavior monitoring, heuristics +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 12/16/2019 +ms.reviewer: +manager: dansimp +ms.custom: nextgen +ms.technology: mde +--- + +# Enable and configure Microsoft Defender Antivirus always-on protection in Group Policy + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. + +These activities include events, such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as auto-start extensibility points, or ASEPs), and other changes to the file system or file structure. + +## Enable and configure always-on protection in Group Policy + +You can use **Local Group Policy Editor** to enable and configure Microsoft Defender Antivirus always-on protection settings. + +To enable and configure always-on protection: + +1. Open **Local Group Policy Editor**. To do this: + + 1. In your Windows 10 taskbar search box, type **gpedit**. + + 1. Under **Best match**, click **Edit group policy** to launch **Local Group Policy Editor**. + + ![GPEdit taskbar search result](images/gpedit-search.png) + +2. In the left pane of **Local Group Policy Editor**, expand the tree to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus**. + +3. Configure the Microsoft Defender Antivirus antimalware service policy settings. To do this: + + 1. In the **Microsoft Defender Antivirus** details pane on right, double-click the policy setting as specified in the following table: + + | Setting | Description | Default setting | + |-----------------------------|------------------------|-------------------------------| + | Allow antimalware service to startup with normal priority | You can lower the priority of the Microsoft Defender Antivirus engine, which may be useful in lightweight deployments where you want to have as lean a startup process as possible. This may impact protection on the endpoint. | Enabled + | Allow antimalware service to remain running always | If protection updates have been disabled, you can set Microsoft Defender Antivirus to still run. This lowers the protection on the endpoint. | Disabled | + + 1. Configure the setting as appropriate, and click **OK**. + + 1. Repeat the previous steps for each setting in the table. + +4. Configure the Microsoft Defender Antivirus real-time protection policy settings. To do this: + + 1. In the **Microsoft Defender Antivirus** details pane, double-click **Real-time Protection**. Or, from the **Microsoft Defender Antivirus** tree on left pane, click **Real-time Protection**. + + 1. In the **Real-time Protection** details pane on right, double-click the policy setting as specified in the following table: + + | Setting | Description | Default setting | + |-----------------------------|------------------------|-------------------------------| + | Turn on behavior monitoring | The AV engine will monitor file processes, file and registry changes, and other events on your endpoints for suspicious and known malicious activity. | Enabled | + | Scan all downloaded files and attachments | Downloaded files and attachments are automatically scanned. This operates in addition to the Windows Defender SmartScreen filter, which scans files before and during downloading. | Enabled | + | Monitor file and program activity on your computer | The Microsoft Defender Antivirus engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run). | Enabled | + | Turn on raw volume write notifications | Information about raw volume writes will be analyzed by behavior monitoring. | Enabled | + | Turn on process scanning whenever real-time protection is enabled | You can independently enable the Microsoft Defender Antivirus engine to scan running processes for suspicious modifications or behaviors. This is useful if you have temporarily disabled real-time protection and want to automatically scan processes that started while it was disabled. | Enabled | + | Define the maximum size of downloaded files and attachments to be scanned | You can define the size in kilobytes. | Enabled | + | Configure local setting override for turn on behavior monitoring | Configure a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.| Enabled | + | Configure local setting override for scanning all downloaded files and attachments | Configure a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.| Enabled | + | Configure local setting override for monitoring file and program activity on your computer | Configure a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.| Enabled | + | Configure local setting override to turn on real-time protection | Configure a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.| Enabled | + | Configure local setting override for monitoring for incoming and outgoing file activity | Configure a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. | Enabled | + | Configure monitoring for incoming and outgoing file and program activity | Specify whether monitoring should occur on incoming, outgoing, both, or neither direction. This is relevant for Windows Server installations where you have defined specific servers or Server Roles that see large amounts of file changes in only one direction and you want to improve network performance. Fully updated endpoints (and servers) on a network will see little performance impact irrespective of the number or direction of file changes. | Enabled (both directions) | + + 1. Configure the setting as appropriate, and click **OK**. + + 1. Repeat the previous steps for each setting in the table. + +5. Configure the Microsoft Defender Antivirus scanning policy setting. To do this: + + 1. From the **Microsoft Defender Antivirus** tree on left pane, click **Scan**. + + ![Microsoft Defender Antivirus Scan options](images/gpedit-windows-defender-antivirus-scan.png) + + 1. In the **Scan** details pane on right, double-click the policy setting as specified in the following table: + + | Setting | Description | Default setting | + |-----------------------------|------------------------|-------------------------------| + | Turn on heuristics | Heuristic protection will disable or block suspicious activity immediately before the Microsoft Defender Antivirus engine is asked to detect the activity. | Enabled | + + 1. Configure the setting as appropriate, and click **OK**. + +6. Close **Local Group Policy Editor**. + + +## Disable real-time protection in Group Policy + +> [!WARNING] +> Disabling real-time protection drastically reduces the protection on your endpoints and is not recommended. + +The main real-time protection capability is enabled by default, but you can disable it by using **Local Group Policy Editor**. + +To disable real-time protection in Group policy: + +1. Open **Local Group Policy Editor**. + + 1. In your Windows 10 taskbar search box, type **gpedit**. + + 1. Under **Best match**, click **Edit group policy** to launch **Local Group Policy Editor**. + +2. In the left pane of **Local Group Policy Editor**, expand the tree to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Real-time Protection**. + +3. In the **Real-time Protection** details pane on right, double-click **Turn off real-time protection**. + + ![Turn off real-time protection](images/gpedit-turn-off-real-time-protection.png) + +4. In the **Turn off real-time protection** setting window, set the option to **Enabled**. + + ![Turn off real-time protection enabled](images/gpedit-turn-off-real-time-protection-enabled.png) + +5. Click **OK**. + +6. Close **Local Group Policy Editor**. + +## Related articles + +- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..95cd08db31 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md @@ -0,0 +1,75 @@ +--- +title: Remediate and resolve infections detected by Microsoft Defender Antivirus +description: Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder +keywords: remediation, fix, remove, threats, quarantine, scan, restore +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 01/06/2021 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure remediation for Microsoft Defender Antivirus scans + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +When Microsoft Defender Antivirus runs a scan, it will attempt to remediate or remove threats that it finds. You can configure how Microsoft Defender Antivirus should react to certain threats, whether it should create a restore point before remediating, and when it should remove remediated threats. + +This topic describes how to configure these settings with Group Policy, but you can also use [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#threat-overrides-settings) and [Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). + +You can also use the [`Set-MpPreference` PowerShell cmdlet](https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference) or [`MSFT_MpPreference` WMI class](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) to configure these settings. + +## Configure remediation options + +You can configure how remediation works with the Group Policy settings described in this section. + +To configure these settings: + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**. + +3. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below. + +4. Select the policy **Setting** as specified in the table below, and set the option to your desired configuration. Select **OK**, and repeat for any other settings. + +|Location | Setting | Description | Default setting (if not configured) | +|:---|:---|:---|:---| +|Scan | Create a system restore point | A system restore point will be created each day before cleaning or scanning is attempted | Disabled| +|Scan | Turn on removal of items from scan history folder | Specify how many days items should be kept in the scan history | 30 days | +|Root | Turn off routine remediation | You can specify whether Microsoft Defender Antivirus automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically) | +|Quarantine | Configure removal of items from Quarantine folder | Specify how many days items should be kept in quarantine before being removed | Never removed | +|Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by Microsoft Defender Antivirus is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable | +|Threats | Specify threats upon which default action should not be taken when detected | Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored | Not applicable | + +> [!IMPORTANT] +> Microsoft Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed. +> +> If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Microsoft Defender Antivirus](restore-quarantined-files-microsoft-defender-antivirus.md). +> +> To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md). + +Also see [Configure remediation-required scheduled full Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md#remed) for more remediation-related settings. + +## Related topics + +- [Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) +- [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +- [Configure and run on-demand Microsoft Defender Antivirus scans](run-scan-microsoft-defender-antivirus.md) +- [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) +- [Configure end-user Microsoft Defender Antivirus interaction](configure-end-user-interaction-microsoft-defender-antivirus.md) +- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..c04445eb32 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md @@ -0,0 +1,339 @@ +--- +title: Configure Microsoft Defender Antivirus exclusions on Windows Server +ms.reviewer: +manager: dansimp +description: Windows Server includes automatic exclusions, based on server role. You can also add custom exclusions. +keywords: exclusions, server, auto-exclusions, automatic, custom, scans, Microsoft Defender Antivirus +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.technology: mde +ms.date: 02/10/2021 +--- + +# Configure Microsoft Defender Antivirus exclusions on Windows Server + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Antivirus on Windows Server 2016 and Windows Server 2019 automatically enrolls you in certain exclusions, as defined by your specified server role. See the [list of automatic exclusions](#list-of-automatic-exclusions) (in this article). These exclusions do not appear in the standard exclusion lists that are shown in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions). + +> [!NOTE] +> Automatic exclusions only apply to Real-time protection (RTP) scanning. Automatic exclusions are not honored during a Full/Quick or On-demand scan. + +In addition to server role-defined automatic exclusions, you can add or remove custom exclusions. To do that, refer to these articles: +- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) + +## A few points to keep in mind + +Keep the following important points in mind: + +- Custom exclusions take precedence over automatic exclusions. +- Automatic exclusions only apply to Real-time protection (RTP) scanning. Automatic exclusions are not honored during a Full/Quick or On-demand scan. +- Custom and duplicate exclusions do not conflict with automatic exclusions. +- Microsoft Defender Antivirus uses the Deployment Image Servicing and Management (DISM) tools to determine which roles are installed on your computer. + +## Opt out of automatic exclusions + +In Windows Server 2016 and Windows Server 2019, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. But keep in mind that the exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. + +> [!WARNING] +> Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 and Windows Server 2019 roles. + +Because predefined exclusions only exclude **default paths**, if you move NTDS and SYSVOL to another drive or path that is *different from the original path*, you must add exclusions manually using the information [here](configure-extension-file-exclusions-microsoft-defender-antivirus.md#configure-the-list-of-exclusions-based-on-folder-name-or-file-extension) . + +You can disable the automatic exclusion lists with Group Policy, PowerShell cmdlets, and WMI. + +### Use Group Policy to disable the auto-exclusions list on Windows Server 2016 and Windows Server 2019 + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725752(v=ws.11)). Right-click the Group Policy Object you want to configure, and then click **Edit**. +2. In the **Group Policy Management Editor** go to **Computer configuration**, and then click **Administrative templates**. +3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Exclusions**. +4. Double-click **Turn off Auto Exclusions**, and set the option to **Enabled**. Then click **OK**. + +### Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016 and 2019 + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -DisableAutoExclusions $true +``` + +To learn more, see the following resources: + +- [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md). +- [Use PowerShell with Microsoft Defender Antivirus](https://docs.microsoft.com/powershell/module/defender/). + +### Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016 and Windows Server 2019 + +Use the **Set** method of the [MSFT_MpPreference](https://docs.microsoft.com/previous-versions/windows/desktop/defender/msft-mppreference) class for the following properties: + +```WMI +DisableAutoExclusions +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) + +## List of automatic exclusions + +The following sections contain the exclusions that are delivered with automatic exclusions file paths and file types. + +### Default exclusions for all roles + +This section lists the default exclusions for all Windows Server 2016 and 2019 roles. + +> [!NOTE] +> The default locations could be different than what's listed in this article. + +#### Windows "temp.edb" files + +- `%windir%\SoftwareDistribution\Datastore\*\tmp.edb` +- `%ProgramData%\Microsoft\Search\Data\Applications\Windows\*\*.log` + +#### Windows Update files or Automatic Update files + +- `%windir%\SoftwareDistribution\Datastore\*\Datastore.edb` +- `%windir%\SoftwareDistribution\Datastore\*\edb.chk` +- `%windir%\SoftwareDistribution\Datastore\*\edb\*.log` +- `%windir%\SoftwareDistribution\Datastore\*\Edb\*.jrs` +- `%windir%\SoftwareDistribution\Datastore\*\Res\*.log` + +#### Windows Security files + +- `%windir%\Security\database\*.chk` +- `%windir%\Security\database\*.edb` +- `%windir%\Security\database\*.jrs` +- `%windir%\Security\database\*.log` +- `%windir%\Security\database\*.sdb` + +#### Group Policy files + +- `%allusersprofile%\NTUser.pol` +- `%SystemRoot%\System32\GroupPolicy\Machine\registry.pol` +- `%SystemRoot%\System32\GroupPolicy\User\registry.pol` + +#### WINS files + +- `%systemroot%\System32\Wins\*\*.chk` +- `%systemroot%\System32\Wins\*\*.log` +- `%systemroot%\System32\Wins\*\*.mdb` +- `%systemroot%\System32\LogFiles\` +- `%systemroot%\SysWow64\LogFiles\` + +#### File Replication Service (FRS) exclusions + +- Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory` + + - `%windir%\Ntfrs\jet\sys\*\edb.chk` + - `%windir%\Ntfrs\jet\*\Ntfrs.jdb` + - `%windir%\Ntfrs\jet\log\*\*.log` + +- FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Ntfrs\Parameters\DB Log File Directory` + + - `%windir%\Ntfrs\*\Edb\*.log` + +- The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage` + + - `%systemroot%\Sysvol\*\Ntfrs_cmp*\` + +- The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory` + + - `%systemroot%\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\*\Ntfrs*\` + +- The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File` + + > [!NOTE] + > For custom locations, see [Opt out of automatic exclusions](#opt-out-of-automatic-exclusions). + + - `%systemdrive%\System Volume Information\DFSR\$db_normal$` + - `%systemdrive%\System Volume Information\DFSR\FileIDTable_*` + - `%systemdrive%\System Volume Information\DFSR\SimilarityTable_*` + - `%systemdrive%\System Volume Information\DFSR\*.XML` + - `%systemdrive%\System Volume Information\DFSR\$db_dirty$` + - `%systemdrive%\System Volume Information\DFSR\$db_clean$` + - `%systemdrive%\System Volume Information\DFSR\$db_lostl$` + - `%systemdrive%\System Volume Information\DFSR\Dfsr.db` + - `%systemdrive%\System Volume Information\DFSR\*.frx` + - `%systemdrive%\System Volume Information\DFSR\*.log` + - `%systemdrive%\System Volume Information\DFSR\Fsr*.jrs` + - `%systemdrive%\System Volume Information\DFSR\Tmp.edb` + +#### Process exclusions + +- `%systemroot%\System32\dfsr.exe` +- `%systemroot%\System32\dfsrs.exe` + +#### Hyper-V exclusions + +The following table lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role. + +|File type exclusions |Folder exclusions | Process exclusions | +|:--|:--|:--| +| `*.vhd`
    `*.vhdx`
    `*.avhd`
    `*.avhdx`
    `*.vsv`
    `*.iso`
    `*.rct`
    `*.vmcx`
    `*.vmrs` | `%ProgramData%\Microsoft\Windows\Hyper-V`
    `%ProgramFiles%\Hyper-V`
    `%SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots`
    `%Public%\Documents\Hyper-V\Virtual Hard Disks` | `%systemroot%\System32\Vmms.exe`
    `%systemroot%\System32\Vmwp.exe` | + +#### SYSVOL files + +- `%systemroot%\Sysvol\Domain\*.adm` +- `%systemroot%\Sysvol\Domain\*.admx` +- `%systemroot%\Sysvol\Domain\*.adml` +- `%systemroot%\Sysvol\Domain\Registry.pol` +- `%systemroot%\Sysvol\Domain\*.aas` +- `%systemroot%\Sysvol\Domain\*.inf` +- `%systemroot%\Sysvol\Domain\*Scripts.ini` +- `%systemroot%\Sysvol\Domain\*.ins` +- `%systemroot%\Sysvol\Domain\Oscfilter.ini` + + +### Active Directory exclusions + +This section lists the exclusions that are delivered automatically when you install Active Directory Domain Services. + +#### NTDS database files + +The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File` + +- `%windir%\Ntds\ntds.dit` +- `%windir%\Ntds\ntds.pat` + +#### The AD DS transaction log files + +The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path` + +- `%windir%\Ntds\EDB*.log` +- `%windir%\Ntds\Res*.log` +- `%windir%\Ntds\Edb*.jrs` +- `%windir%\Ntds\Ntds*.pat` +- `%windir%\Ntds\TEMP.edb` + +#### The NTDS working folder + +This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory` + +- `%windir%\Ntds\Temp.edb` +- `%windir%\Ntds\Edb.chk` + +#### Process exclusions for AD DS and AD DS-related support files + +- `%systemroot%\System32\ntfrs.exe` +- `%systemroot%\System32\lsass.exe` + +### DHCP Server exclusions + +This section lists the exclusions that are delivered automatically when you install the DHCP Server role. The DHCP Server file locations are specified by the *DatabasePath*, *DhcpLogFilePath*, and *BackupDatabasePath* parameters in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters` + +- `%systemroot%\System32\DHCP\*\*.mdb` +- `%systemroot%\System32\DHCP\*\*.pat` +- `%systemroot%\System32\DHCP\*\*.log` +- `%systemroot%\System32\DHCP\*\*.chk` +- `%systemroot%\System32\DHCP\*\*.edb` + +### DNS Server exclusions + +This section lists the file and folder exclusions and the process exclusions that are delivered automatically when you install the DNS Server role. + +#### File and folder exclusions for the DNS Server role + +- `%systemroot%\System32\Dns\*\*.log` +- `%systemroot%\System32\Dns\*\*.dns` +- `%systemroot%\System32\Dns\*\*.scc` +- `%systemroot%\System32\Dns\*\BOOT` + +#### Process exclusions for the DNS Server role + +- `%systemroot%\System32\dns.exe` + +### File and Storage Services exclusions + +This section lists the file and folder exclusions that are delivered automatically when you install the File and Storage Services role. The exclusions listed below do not include exclusions for the Clustering role. + +- `%SystemDrive%\ClusterStorage` +- `%clusterserviceaccount%\Local Settings\Temp` +- `%SystemDrive%\mscs` + +### Print Server exclusions + +This section lists the file type exclusions, folder exclusions, and the process exclusions that are delivered automatically when you install the Print Server role. + +#### File type exclusions + +- `*.shd` +- `*.spl` + +#### Folder exclusions + +This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory` + +- `%system32%\spool\printers\*` + +#### Process exclusions + +- `spoolsv.exe` + +### Web Server exclusions + +This section lists the folder exclusions and the process exclusions that are delivered automatically when you install the Web Server role. + +#### Folder exclusions + +- `%SystemRoot%\IIS Temporary Compressed Files` +- `%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files` +- `%SystemDrive%\inetpub\temp\ASP Compiled Templates` +- `%systemDrive%\inetpub\logs` +- `%systemDrive%\inetpub\wwwroot` + +#### Process exclusions + +- `%SystemRoot%\system32\inetsrv\w3wp.exe` +- `%SystemRoot%\SysWOW64\inetsrv\w3wp.exe` +- `%SystemDrive%\PHP5433\php-cgi.exe` + +#### Turning off scanning of files in the Sysvol\Sysvol folder or the SYSVOL_DFSR\Sysvol folder + +The current location of the `Sysvol\Sysvol` or `SYSVOL_DFSR\Sysvol` folder and all the subfolders is the file system reparse target of the replica set root. The `Sysvol\Sysvol` and `SYSVOL_DFSR\Sysvol` folders use the following locations by default: + +- `%systemroot%\Sysvol\Domain` +- `%systemroot%\Sysvol_DFSR\Domain` + +The path to the currently active `SYSVOL` is referenced by the NETLOGON share and can be determined by the SysVol value name in the following subkey: `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netlogon\Parameters` + +Exclude the following files from this folder and all its subfolders: + +- `*.adm` +- `*.admx` +- `*.adml` +- `Registry.pol` +- `Registry.tmp` +- `*.aas` +- `*.inf` +- `Scripts.ini` +- `*.ins` +- `Oscfilter.ini` + +### Windows Server Update Services exclusions + +This section lists the folder exclusions that are delivered automatically when you install the Windows Server Update Services (WSUS) role. The WSUS folder is specified in the registry key `HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup` + +- `%systemroot%\WSUS\WSUSContent` +- `%systemroot%\WSUS\UpdateServicesDBFiles` +- `%systemroot%\SoftwareDistribution\Datastore` +- `%systemroot%\SoftwareDistribution\Download` + +## See also + +- [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) +- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..10b6622a43 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md @@ -0,0 +1,40 @@ +--- +title: Run and customize scheduled and on-demand scans +description: Customize and initiate Microsoft Defender Antivirus scans on endpoints across your network. +keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan, Microsoft Defender Antivirus +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure Microsoft Defender Antivirus scans. + +## In this section + +Topic | Description +---|--- +[Configure and validate file, folder, and process-opened file exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) | You can exclude files (including files modified by specified processes) and folders from on-demand scans, scheduled scans, and always-on real-time protection monitoring and scanning +[Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) | You can configure Microsoft Defender Antivirus to include certain types of email storage files, back-up or reparse points, and archived files (such as .zip files) in scans. You can also enable network file scanning +[Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) | Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder +[Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans +[Configure and run scans](run-scan-microsoft-defender-antivirus.md) | Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Security app +[Review scan results](review-scan-results-microsoft-defender-antivirus.md) | Review the results of scans using Microsoft Endpoint Configuration Manager, Microsoft Intune, or the Windows Security app diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md new file mode 100644 index 0000000000..a2a610032c --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md @@ -0,0 +1,40 @@ +--- +title: Run and customize scheduled and on-demand scans +description: Customize and initiate Microsoft Defender Antivirus scans on endpoints across your network. +keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan, Microsoft Defender Antivirus +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Customize, initiate, and review the results of Microsoft Defender Antivirus scans & remediation + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure Microsoft Defender Antivirus scans. + +## In this section + +| Article | Description | +|:---|:---| +|[Configure and validate file, folder, and process-opened file exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) | You can exclude files (including files modified by specified processes) and folders from on-demand scans, scheduled scans, and always-on real-time protection monitoring and scanning | +|[Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) | You can configure Microsoft Defender Antivirus to include certain types of email storage files, back-up or reparse points, and archived files (such as .zip files) in scans. You can also enable network file scanning | +|[Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) | Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder | +|[Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans | +|[Configure and run scans](run-scan-microsoft-defender-antivirus.md) | Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Security app | +|[Review scan results](review-scan-results-microsoft-defender-antivirus.md) | Review the results of scans using Microsoft Endpoint Configuration Manager, Microsoft Intune, or the Windows Security app | diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..01a88d64d7 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md @@ -0,0 +1,88 @@ +--- +title: Deploy, manage, and report on Microsoft Defender Antivirus +description: You can deploy and manage Microsoft Defender Antivirus with Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell, or WMI +keywords: deploy, manage, update, protection, Microsoft Defender Antivirus +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Deploy, manage, and report on Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can deploy, manage, and report on Microsoft Defender Antivirus in a number of ways. + +Because the Microsoft Defender Antivirus client is installed as a core part of Windows 10, traditional deployment of a client to your endpoints does not apply. + +However, in most cases you will still need to enable the protection service on your endpoints with Microsoft Intune, Microsoft Endpoint Configuration Manager, Azure Defender, or Group Policy Objects, which is described in the following table. + +You'll also see additional links for: + +- Managing Microsoft Defender Antivirus protection, including managing product and protection updates +- Reporting on Microsoft Defender Antivirus protection + +> [!IMPORTANT] +> In most cases, Windows 10 will disable Microsoft Defender Antivirus if it finds another antivirus product that is running and up-to-date. You must disable or uninstall third-party antivirus products before Microsoft Defender Antivirus will function. If you re-enable or install third-party antivirus products, then Windows 10 automatically disables Microsoft Defender Antivirus. + +Tool|Deployment options (2)|Management options (network-wide configuration and policy or baseline deployment) ([3](#fn3))|Reporting options +---|---|---|--- +Microsoft Intune|[Add endpoint protection settings in Intune](https://docs.microsoft.com/intune/endpoint-protection-configure)|[Configure device restriction settings in Intune](https://docs.microsoft.com/intune/device-restrictions-configure)| [Use the Intune console to manage devices](https://docs.microsoft.com/intune/device-management) +Microsoft Endpoint Manager ([1](#fn1))|Use the [Endpoint Protection point site system role][] and [enable Endpoint Protection with custom client settings][]|With [default and customized antimalware policies][] and [client management][]|With the default [Configuration Manager Monitoring workspace][] and [email alerts][] +Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Microsoft Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [Configure update options for Microsoft Defender Antivirus][] and [Configure Windows Defender features][]|Endpoint reporting is not available with Group Policy. You can generate a list of [Group Policies to determine if any settings or policies are not applied][] +PowerShell|Deploy with Group Policy, Microsoft Endpoint Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference] and [Update-MpSignature] cmdlets available in the Defender module.|Use the appropriate [Get- cmdlets available in the Defender module][] +Windows Management Instrumentation|Deploy with Group Policy, Microsoft Endpoint Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][] +Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Azure Defender*](https://docs.microsoft.com/azure/security-center/security-center-install-endpoint-protection)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Microsoft Defender Antivirus events][] and add that tool as an app in AAD. + +1. The availability of some functions and features, especially related to cloud-delivered protection, differ between Microsoft Endpoint Manager (Current Branch) and System Center 2012 Configuration Manager. In this library, we've focused on Windows 10, Windows Server 2016, and Microsoft Endpoint Manager (Current Branch). See [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) for a table that describes the major differences. [(Return to table)](#ref2) + +2. In Windows 10, Microsoft Defender Antivirus is a component available without installation or deployment of an additional client or service. It will automatically be enabled when third-party antivirus products are either uninstalled or out of date ([except on Windows Server 2016](microsoft-defender-antivirus-on-windows-server-2016.md)). Traditional deployment therefore is not required. Deployment here refers to ensuring the Microsoft Defender Antivirus component is available and enabled on endpoints or servers. [(Return to table)](#ref2) + +3. Configuration of features and protection, including configuring product and protection updates, are further described in the [Configure Microsoft Defender Antivirus features](configure-notifications-microsoft-defender-antivirus.md) section in this library. [(Return to table)](#ref2) + +[Endpoint Protection point site system role]: https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-protection-site-role +[default and customized antimalware policies]: https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies +[client management]: https://docs.microsoft.com/configmgr/core/clients/manage/manage-clients +[enable Endpoint Protection with custom client settings]: https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-protection-configure-client +[Configuration Manager Monitoring workspace]: https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection +[email alerts]: https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-configure-alerts +[Deploy the Microsoft Intune client to endpoints]: https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune +[custom Intune policy]: https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#configure-microsoft-intune-endpoint-protection + [custom Intune policy]: https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#configure-microsoft-intune-endpoint-protection +[manage tasks]: https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#choose-management-tasks-for-endpoint-protection +[Monitor endpoint protection in the Microsoft Intune administration console]: https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#monitor-endpoint-protection +[Set method of the MSFT_MpPreference class]: https://msdn.microsoft.com/library/dn439474 +[Update method of the MSFT_MpSignature class]: https://msdn.microsoft.com/library/dn439474 +[MSFT_MpComputerStatus]: https://msdn.microsoft.com/library/dn455321 +[Windows Defender WMIv2 Provider]: https://msdn.microsoft.com/library/dn439477 +[Set-MpPreference]: https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference.md +[Update-MpSignature]: https://technet.microsoft.com/itpro/powershell/windows/defender/update-mpsignature +[Get- cmdlets available in the Defender module]: https://technet.microsoft.com/itpro/powershell/windows/defender/index +[Configure update options for Microsoft Defender Antivirus]: manage-updates-baselines-microsoft-defender-antivirus.md +[Configure Windows Defender features]: configure-microsoft-defender-antivirus-features.md +[Group Policies to determine if any settings or policies are not applied]: https://technet.microsoft.com/library/cc771389.aspx +[Possibly infected devices]: https://docs.microsoft.com/azure/active-directory/active-directory-reporting-sign-ins-from-possibly-infected-devices +[Microsoft Defender Antivirus events]: troubleshoot-microsoft-defender-antivirus.md + +## In this section + +Topic | Description +---|--- +[Deploy and enable Microsoft Defender Antivirus protection](deploy-microsoft-defender-antivirus.md) | While the client is installed as a core part of Windows 10, and traditional deployment does not apply, you will still need to enable the client on your endpoints with Microsoft Endpoint Configuration Manager, Microsoft Intune, or Group Policy Objects. +[Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) | There are two parts to updating Microsoft Defender Antivirus: updating the client on endpoints (product updates), and updating Security intelligence (protection updates). You can update Security intelligence in a number of ways, using Microsoft Endpoint Configuration Manager, Group Policy, PowerShell, and WMI. +[Monitor and report on Microsoft Defender Antivirus protection](report-monitor-microsoft-defender-antivirus.md) | You can use Microsoft Intune, Microsoft Endpoint Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, or a third-party SIEM product (by consuming Windows event logs) to monitor protection status and create reports about endpoint protection. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..c27135a1f6 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md @@ -0,0 +1,41 @@ +--- +title: Deploy and enable Microsoft Defender Antivirus +description: Deploy Microsoft Defender Antivirus for protection of your endpoints with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or WMI. +keywords: deploy, enable, Microsoft Defender Antivirus +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 01/06/2021 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Deploy and enable Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Depending on the management tool you are using, you may need to specifically enable or configure Microsoft Defender Antivirus protection. + +See the table in [Deploy, manage, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md#ref2) for instructions on how to enable protection with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, Active Directory, Microsoft Azure, PowerShell cmdlets, and Windows Management Instruction (WMI). + +Some scenarios require more guidance on how to successfully deploy or configure Microsoft Defender Antivirus protection, such as Virtual Desktop Infrastructure (VDI) environments. + +The remaining article in this section provides end-to-end advice and best practices for [setting up Microsoft Defender Antivirus on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-microsoft-defender-antivirus.md). + +## Related articles + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Deploy, manage updates, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) +- [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..ef143bfe39 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md @@ -0,0 +1,238 @@ +--- +title: Microsoft Defender Antivirus Virtual Desktop Infrastructure deployment guide +description: Learn how to deploy Microsoft Defender Antivirus in a virtual desktop environment for the best balance between protection and performance. +keywords: vdi, hyper-v, vm, virtual machine, windows defender, antivirus, av, virtual desktop, rds, remote desktop +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 12/28/2020 +ms.reviewer: jesquive +manager: dansimp +ms.technology: mde +--- + +# Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +In addition to standard on-premises or hardware configurations, you can also use Microsoft Defender Antivirus in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment. + +See [Windows Virtual Desktop Documentation](https://docs.microsoft.com/azure/virtual-desktop) for more details on Microsoft Remote Desktop Services and VDI support. + +For Azure-based virtual machines, see [Install Endpoint Protection in Azure Defender](https://docs.microsoft.com/azure/security-center/security-center-install-endpoint-protection). + +With the ability to easily deploy updates to VMs running in VDIs, we've shortened this guide to focus on how you can get updates on your machines quickly and easily. You no longer need to create and seal golden images on a periodic basis, as updates are expanded into their component bits on the host server and then downloaded directly to the VM when it's turned on. + +This guide describes how to configure your VMs for optimal protection and performance, including how to: + +- [Set up a dedicated VDI file share for security intelligence updates](#set-up-a-dedicated-vdi-file-share) +- [Randomize scheduled scans](#randomize-scheduled-scans) +- [Use quick scans](#use-quick-scans) +- [Prevent notifications](#prevent-notifications) +- [Disable scans from occurring after every update](#disable-scans-after-an-update) +- [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline) +- [Apply exclusions](#exclusions) + +You can also download the whitepaper [Microsoft Defender Antivirus on Virtual Desktop Infrastructure](https://demo.wd.microsoft.com/Content/wdav-testing-vdi-ssu.pdf), which looks at the new shared security intelligence update feature, alongside performance testing and guidance on how you can test antivirus performance on your own VDI. + +> [!IMPORTANT] +> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.
    There are performance and feature improvements to the way in which Microsoft Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607. + +## Set up a dedicated VDI file share + +In Windows 10, version 1903, we introduced the shared security intelligence feature, which offloads the unpackaging of downloaded security intelligence updates onto a host machine—thus saving previous CPU, disk, and memory resources on individual machines. This feature has been backported and now works in Windows 10 version 1703 and above. You can set this feature with a Group Policy, or PowerShell. + +### Use Group Policy to enable the shared security intelligence feature: + +1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. + +5. Double-click **Define security intelligence location for VDI clients**, and then set the option to **Enabled**. A field automatically appears. + +6. Enter `\\\wdav-update` (for help with this value, see [Download and unpackage](#download-and-unpackage-the-latest-updates)). + +7. Click **OK**. + +8. Deploy the GPO to the VMs you want to test. + +### Use PowerShell to enable the shared security intelligence feature + +Use the following cmdlet to enable the feature. You’ll need to then push this as you normally would push PowerShell-based configuration policies onto the VMs: + +```PowerShell +Set-MpPreference -SharedSignaturesPath \\\wdav-update +``` + +See the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what the \ will be. + +## Download and unpackage the latest updates + +Now you can get started on downloading and installing new updates. We’ve created a sample PowerShell script for you below. This script is the easiest way to download new updates and get them ready for your VMs. You should then set the script to run at a certain time on the management machine by using a scheduled task (or, if you’re familiar with using PowerShell scripts in Azure, Intune, or SCCM, you could also use those scripts). + +```PowerShell +$vdmpathbase = "$env:systemdrive\wdav-update\{00000000-0000-0000-0000-" +$vdmpathtime = Get-Date -format "yMMddHHmmss" +$vdmpath = $vdmpathbase + $vdmpathtime + '}' +$vdmpackage = $vdmpath + '\mpam-fe.exe' + +New-Item -ItemType Directory -Force -Path $vdmpath | Out-Null + +Invoke-WebRequest -Uri 'https://go.microsoft.com/fwlink/?LinkID=121721&arch=x64' -OutFile $vdmpackage + +cmd /c "cd $vdmpath & c: & mpam-fe.exe /x" +``` + +You can set a scheduled task to run once a day so that whenever the package is downloaded and unpacked then the VMs will receive the new update. +We suggest starting with once a day—but you should experiment with increasing or decreasing the frequency to understand the impact. + +Security intelligence packages are typically published once every three to four hours. Setting a frequency shorter than four hours isn’t advised because it will increase the network overhead on your management machine for no benefit. + +### Set a scheduled task to run the PowerShell script + +1. On the management machine, open the Start menu and type **Task Scheduler**. Open it and select **Create task…** on the side panel. + +2. Enter the name as **Security intelligence unpacker**. Go to the **Trigger** tab. Select **New…** > **Daily**, and select **OK**. + +3. Go to the **Actions** tab. Select **New…** Enter **PowerShell** in the **Program/Script** field. Enter `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1` in the **Add arguments** field. Select **OK**. + +4. You can choose to configure additional settings if you wish. + +5. Select **OK** to save the scheduled task. + +You can initiate the update manually by right-clicking on the task and clicking **Run**. + +### Download and unpackage manually + +If you would prefer to do everything manually, here's what to do to replicate the script’s behavior: + +1. Create a new folder on the system root called `wdav_update` to store intelligence updates, for example, create the folder `c:\wdav_update`. + +2. Create a subfolder under *wdav_update* with a GUID name, such as `{00000000-0000-0000-0000-000000000000}` + +Here's an example: `c:\wdav_update\{00000000-0000-0000-0000-000000000000}` + + > [!NOTE] + > In the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time. + +3. Download a security intelligence package from [https://www.microsoft.com/wdsi/definitions](https://www.microsoft.com/wdsi/definitions) into the GUID folder. The file should be named `mpam-fe.exe`. + +4. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example `mpam-fe.exe /X`. + + > [!NOTE] + > The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package. + +## Randomize scheduled scans + +Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-microsoft-defender-antivirus.md). + +The start time of the scan itself is still based on the scheduled scan policy (**ScheduleDay**, **ScheduleTime**, and **ScheduleQuickScanTime**). Randomization will cause Microsoft Defender Antivirus to start a scan on each machine within a 4-hour window from the time set for the scheduled scan. + +See [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) for other configuration options available for scheduled scans. + +## Use quick scans + +You can specify the type of scan that should be performed during a scheduled scan. Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active. The following procedure describes how to set up quick scans using Group Policy. + +1. In your Group Policy Editor, go to **Administrative templates** > **Windows components** > **Microsoft Defender Antivirus** > **Scan**. + +2. Select **Specify the scan type to use for a scheduled scan** and then edit the policy setting. + +3. Set the policy to **Enabled**, and then under **Options**, select **Quick scan**. + +4. Select **OK**. + +5. Deploy your Group Policy object as you usually do. + +## Prevent notifications + +Sometimes, Microsoft Defender Antivirus notifications may be sent to or persist across multiple sessions. In order to minimize this problem, you can lock down the Microsoft Defender Antivirus user interface. The following procedure describes how to suppress notifications with Group Policy. + +1. In your Group Policy Editor, go to **Windows components** > **Microsoft Defender Antivirus** > **Client Interface**. + +2. Select **Suppress all notifications** and then edit the policy settings. + +3. Set the policy to **Enabled**, and then select **OK**. + +4. Deploy your Group Policy object as you usually do. + +Suppressing notifications prevents notifications from Microsoft Defender Antivirus from showing up in the Action Center on Windows 10 when scans are done or remediation actions are taken. However, your security operations team will see the results of the scan in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). + +> [!TIP] +> To open the Action Center on Windows 10, take one of the following steps: +> - On the right end of the taskbar, select the Action Center icon. +> - Press the Windows logo key button + A. +> - On a touchscreen device, swipe in from the right edge of the screen. + +## Disable scans after an update + +Disabling a scan after an update will prevent a scan from occurring after receiving an update. You can apply this setting when creating the base image if you have also run a quick scan. This way, you can prevent the newly updated VM from performing a scan again (as you've already scanned it when you created the base image). + +> [!IMPORTANT] +> Running scans after an update will help ensure your VMs are protected with the latest Security intelligence updates. Disabling this option will reduce the protection level of your VMs and should only be used when first creating or deploying the base image. + +1. In your Group Policy Editor, go to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. + +2. Select **Turn on scan after security intelligence update** and then edit the policy setting. + +3. Set the policy to **Disabled**. + +4. Select **OK**. + +5. Deploy your Group Policy object as you usually do. + +This policy prevents a scan from running immediately after an update. + +## Scan VMs that have been offline + +1. In your Group Policy Editor, go to to **Windows components** > **Microsoft Defender Antivirus** > **Scan**. + +2. Select **Turn on catch-up quick scan** and then edit the policy setting. + +3. Set the policy to **Enabled**. + +4. Select **OK**. + +5. Deploy your Group Policy Object as you usually do. + +This policy forces a scan if the VM has missed two or more consecutive scheduled scans. + +## Enable headless UI mode + +1. In your Group Policy Editor, go to **Windows components** > **Microsoft Defender Antivirus** > **Client Interface**. + +2. Select **Enable headless UI mode** and edit the policy. + +3. Set the policy to **Enabled**. + +4. Click **OK**. + +5. Deploy your Group Policy Object as you usually do. + +This policy hides the entire Microsoft Defender Antivirus user interface from end users in your organization. + +## Exclusions + +Exclusions can be added, removed, or customized to suit your needs. + +For more information, see [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-exclusions-microsoft-defender-antivirus.md). + +## Additional resources + +- [Tech Community Blog: Configuring Microsoft Defender Antivirus for non-persistent VDI machines](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/configuring-microsoft-defender-antivirus-for-non-persistent-vdi/ba-p/1489633) +- [TechNet forums on Remote Desktop Services and VDI](https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverTS) +- [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..eedb6be8ae --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md @@ -0,0 +1,186 @@ +--- +title: Block potentially unwanted applications with Microsoft Defender Antivirus +description: Enable the potentially unwanted application (PUA) antivirus feature to block unwanted software such as adware. +keywords: pua, enable, unwanted software, unwanted apps, adware, browser toolbar, detect, block, Microsoft Defender Antivirus +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: detect +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +audience: ITPro +ms.date: 02/03/2021 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Detect and block potentially unwanted applications + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge) + +> [!NOTE] +> Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices. + +Potentially unwanted applications (PUA) are not considered viruses, malware, or other types of threats, but they might perform actions on endpoints which adversely affect endpoint performance or use. _PUA_ can also refer to an application that has a poor reputation, as assessed by Microsoft Defender for Endpoint, due to certain kinds of undesirable behavior. + +Here are some examples: + +- **Advertising software** that displays advertisements or promotions, including software that inserts advertisements to webpages. +- **Bundling software** that offers to install other software that is not digitally signed by the same entity. Also, software that offers to install other software that qualify as PUA. +- **Evasion software** that actively tries to evade detection by security products, including software that behaves differently in the presence of security products. + +> [!TIP] +> For more examples and a discussion of the criteria we use to label applications for special attention from security features, see [How Microsoft identifies malware and potentially unwanted applications](../intelligence/criteria.md). + +Potentially unwanted applications can increase the risk of your network being infected with actual malware, make malware infections harder to identify, or waste IT resources in cleaning them up. + +PUA protection is supported on Windows 10, Windows Server 2019, and Windows Server 2016. + +## Microsoft Edge + +The [new Microsoft Edge](https://support.microsoft.com/microsoft-edge/get-to-know-microsoft-edge-3f4bb0ff-58de-2188-55c0-f560b7e20bea), which is Chromium-based, blocks potentially unwanted application downloads and associated resource URLs. This feature is provided via [Microsoft Defender SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md). + +### Enable PUA protection in Chromium-based Microsoft Edge + +Although potentially unwanted application protection in Microsoft Edge (Chromium-based, version 80.0.361.50) is turned off by default, it can easily be turned on from within the browser. + +1. Select the ellipses, and then choose **Settings**. +2. Select **Privacy, search, and services**. +3. Under the **Security** section, turn on **Block potentially unwanted apps**. + +> [!TIP] +> If you are running Microsoft Edge (Chromium-based), you can safely explore the URL-blocking feature of PUA protection by testing it out on one of our [Microsoft Defender SmartScreen demo pages](https://demo.smartscreen.msft.net/). + +### Blocking URLs with Microsoft Defender SmartScreen + +In Chromium-based Edge with PUA protection turned on, Microsoft Defender SmartScreen protects you from PUA-associated URLs. + +Admins can [configure](https://docs.microsoft.com/DeployEdge/configure-microsoft-edge) how Microsoft Edge and Microsoft Defender SmartScreen work together to protect groups of users from PUA-associated URLs. There are several [group policy settings](https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#smartscreen-settings) explicitly for Microsoft +Defender SmartScreen available, including [one for blocking PUA](https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#smartscreenpuaenabled). In addition, admins can +[configure Microsoft Defender SmartScreen](https://docs.microsoft.com/microsoft-edge/deploy/available-policies?source=docs#configure-windows-defender-smartscreen) as a whole, using group policy settings to turn Microsoft Defender SmartScreen on or off. + +Although Microsoft Defender for Endpoint has its own block list based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md) in the Microsoft Defender for Endpoint portal, Microsoft Defender SmartScreen respects the new settings. + +## Microsoft Defender Antivirus + +The potentially unwanted application (PUA) protection feature in Microsoft Defender Antivirus can detect and block PUAs on endpoints in your network. + +> [!NOTE] +> This feature is available in Windows 10, Windows Server 2019, and Windows Server 2016. + +Microsoft Defender Antivirus blocks detected PUA files and any attempts to download, move, run, or install them. Blocked PUA files are then moved to quarantine. + +When a PUA file is detected on an endpoint, Microsoft Defender Antivirus sends a notification to the user ([unless notifications have been disabled](configure-notifications-microsoft-defender-antivirus.md)) in the same format as other threat detections. The notification is prefaced with `PUA:` to indicate its content. + +The notification appears in the usual [quarantine list within the Windows Security app](microsoft-defender-security-center-antivirus.md#detection-history). + +### Configure PUA protection in Microsoft Defender Antivirus + +You can enable PUA protection with [Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect), [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection), [Group Policy](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy), or via [PowerShell cmdlets](https://docs.microsoft.com/powershell/module/defender/?view=win10-ps&preserve-view=true). + +You can also use PUA protection in audit mode to detect potentially unwanted applications without blocking them. The detections are captured in the Windows event log. + +> [!TIP] +> Visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com/Page/UrlRep) to confirm that the feature is working, and see it in action. + +PUA protection in audit mode is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives. + +#### Use Intune to configure PUA protection + +See [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details. + +#### Use Configuration Manager to configure PUA protection + +PUA protection is enabled by default in the Microsoft Endpoint Manager (Current Branch). + +See [How to create and deploy antimalware policies: Scheduled scans settings](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#real-time-protection-settings) for details on configuring Microsoft Endpoint Manager (Current Branch). + +For System Center 2012 Configuration Manager, see [How to Deploy Potentially Unwanted Application Protection Policy for Endpoint Protection in Configuration Manager](https://technet.microsoft.com/library/hh508770.aspx#BKMK_PUA). + +> [!NOTE] +> PUA events blocked by Microsoft Defender Antivirus are reported in the Windows Event Viewer and not in Microsoft Endpoint Configuration Manager. + +#### Use Group Policy to configure PUA protection + +1. Download and install [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) +2. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). +3. Select the Group Policy Object you want to configure, and then choose **Edit**. +4. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. +5. Expand the tree to **Windows Components** > **Microsoft Defender Antivirus**. +6. Double-click **Configure detection for potentially unwanted applications**. +7. Select **Enabled** to enable PUA protection. +8. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting works in your environment. Select **OK**. +9. Deploy your Group Policy object as you usually do. + +#### Use PowerShell cmdlets to configure PUA protection + +##### To enable PUA protection + +```PowerShell +Set-MpPreference -PUAProtection Enabled +``` + +Setting the value for this cmdlet to `Enabled` turns the feature on if it has been disabled. + +##### To set PUA protection to audit mode + +```PowerShell +Set-MpPreference -PUAProtection AuditMode +``` + +Setting `AuditMode` detects PUAs without blocking them. + +##### To disable PUA protection + +We recommend keeping PUA protection turned on. However, you can turn it off by using the following cmdlet: + +```PowerShell +Set-MpPreference -PUAProtection Disabled +``` + +Setting the value for this cmdlet to `Disabled` turns the feature off if it has been enabled. + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +## View PUA events + +PUA events are reported in the Windows Event Viewer, but not in Microsoft Endpoint Manager or in Intune. You can also use the `Get-MpThreat` cmdlet to view threats that Microsoft Defender Antivirus handled. Here's an example: + +```console +CategoryID : 27 +DidThreatExecute : False +IsActive : False +Resources : {webfile:_q:\Builds\Dalton_Download_Manager_3223905758.exe|http://d18yzm5yb8map8.cloudfront.net/ + fo4yue@kxqdw/Dalton_Download_Manager.exe|pid:14196,ProcessStart:132378130057195714} +RollupStatus : 33 +SchemaVersion : 1.0.0.0 +SeverityID : 1 +ThreatID : 213927 +ThreatName : PUA:Win32/InstallCore +TypeID : 0 +PSComputerName : +``` + +You can turn on email notifications to receive mail about PUA detections. + +See [Troubleshoot event IDs](troubleshoot-microsoft-defender-antivirus.md) for details on viewing Microsoft Defender Antivirus events. PUA events are recorded under event ID **1160**. + +## Excluding files + +Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA is required to complete a task. In these cases, a file can be added to an exclusion list. + +For more information, see [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md). + +## See also + +- [Next-generation protection](microsoft-defender-antivirus-in-windows-10.md) +- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..483ca94393 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md @@ -0,0 +1,152 @@ +--- +title: Turn on cloud-delivered protection in Microsoft Defender Antivirus +description: Turn on cloud-delivered protection to benefit from fast and advanced protection features. +keywords: Microsoft Defender Antivirus, antimalware, security, cloud, block at first sight +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 11/13/2020 +ms.reviewer: +manager: dansimp +ms.custom: nextgen +ms.technology: mde +--- + +# Turn on cloud-delivered protection + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +> [!NOTE] +> The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. + +Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). +![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) + +You can turn Microsoft Defender Antivirus cloud-delivered protection on or off in several ways: + +- Microsoft Intune +- Microsoft Endpoint Configuration Manager +- Group Policy +- PowerShell cmdlets. + + You can also turn it on or off in individual clients with the Windows Security app. + +See [Use Microsoft cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) for an overview of Microsoft Defender Antivirus cloud-delivered protection. + +For more information about the specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service, see [Configure and validate network connections](configure-network-connections-microsoft-defender-antivirus.md). + +> [!NOTE] +> In Windows 10, there is no difference between the **Basic** and **Advanced** reporting options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. For more information on what we collect, see the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839). + +## Use Intune to turn on cloud-delivered protection + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. +2. On the **Home** pane, select **Device configuration > Profiles**. +3. Select the **Device restrictions** profile type you want to configure. If you need to create a new **Device restrictions** profile type, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). +4. Select **Properties** > **Configuration settings: Edit** > **Microsoft Defender Antivirus**. +5. On the **Cloud-delivered protection** switch, select **Enable**. +6. In the **Prompt users before sample submission** dropdown, select **Send all data automatically**. + +For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles) + +## Use Microsoft Endpoint Manager to turn on cloud-delivered protection + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. +2. Choose **Endpoint security** > **Antivirus**. +3. Select an antivirus profile. (If you don't have one yet, or if you want to create a new profile, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). +4. Select **Properties**. Then, next to **Configuration settings**, choose **Edit**. +5. Expand **Cloud protection**, and then in the **Cloud-delivered protection level** list, select one of the following: + 1. **High**: Applies a strong level of detection. + 2. **High plus**: Uses the **High** level and applies additional protection measures (may impact client performance). + 3. **Zero tolerance**: Blocks all unknown executables. +6. Select **Review + save**, then choose **Save**. + +For more information about configuring Microsoft Endpoint Configuration Manager, see [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service). + +## Use Group Policy to turn on cloud-delivered protection + +1. On your Group Policy management device, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. + +2. In the **Group Policy Management Editor**, go to **Computer configuration**. + +3. Select **Administrative templates**. + +4. Expand the tree to **Windows components > Microsoft Defender Antivirus > MAPS** + +5. Double-click **Join Microsoft MAPS**. Ensure the option is turned on and set to **Basic MAPS** or **Advanced MAPS**. Select **OK**. + +6. Double-click **Send file samples when further analysis is required**. Ensure that the first option is set to **Enabled** and that the other options are set to either: + + 1. **Send safe samples** (1) + 2. **Send all samples** (3) + + >[!NOTE] + > The **Send safe samples** (1) option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. + + > [!WARNING] + > Setting the option to **Always Prompt** (0) will lower the protection state of the device. Setting it to **Never send** (2) means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work. + +7. Select **OK**. + +## Use PowerShell cmdlets to turn on cloud-delivered protection + +The following cmdlets can turn on cloud-delivered protection: + +```PowerShell +Set-MpPreference -MAPSReporting Advanced +Set-MpPreference -SubmitSamplesConsent SendAllSamples +``` + +For more information on how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx). [Policy CSP - Defender](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender) also has more information specifically on [-SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent). + +>[!NOTE] +> You can also set **-SubmitSamplesConsent** to `SendSafeSamples` (the default setting), `NeverSend`, or `AlwaysPrompt`. The `SendSafeSamples` setting means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. + +>[!WARNING] +> Setting **-SubmitSamplesConsent** to `NeverSend` or `AlwaysPrompt` will lower the protection level of the device. In addition, setting it to `NeverSend` means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work. + +## Use Windows Management Instruction (WMI) to turn on cloud-delivered protection + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn439474(v=vs.85).aspx) class for the following properties: + +```WMI +MAPSReporting +SubmitSamplesConsent +``` + +For more information about allowed parameters, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + +## Turn on cloud-delivered protection on individual clients with the Windows Security app + +> [!NOTE] +> If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. + +1. Open the Windows Security app by selecting the shield icon in the task bar, or by searching the start menu for **Defender**. + +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: + + ![Screenshot of the Virus & threat protection settings label in the Windows Security app](images/defender/wdav-protection-settings-wdsc.png) + +3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. + +> [!NOTE] +> If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable. + +## Related articles + +- [Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) +- [Configure block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) +- [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) +- [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)] +- [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) +- [Use Microsoft cloud-delivered protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) +- [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..e56c78b8f3 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md @@ -0,0 +1,56 @@ +--- +title: Evaluate Microsoft Defender Antivirus +description: Businesses of all sizes can use this guide to evaluate and test the protection offered by Microsoft Defender Antivirus in Windows 10. +keywords: Microsoft Defender Antivirus, cloud protection, cloud, antimalware, security, defender, evaluate, test, protection, compare, real-time protection +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Evaluate Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Use this guide to determine how well Microsoft Defender Antivirus protects you from viruses, malware, and potentially unwanted applications. + +>[!TIP] +>You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work: +>- Cloud-delivered protection +>- Fast learning (including Block at first sight) +>- Potentially unwanted application blocking + +It explains the important next-generation protection features of Microsoft Defender Antivirus available for both small and large enterprises, and how they increase malware detection and protection across your network. + +You can choose to configure and evaluate each setting independently, or all at once. We have grouped similar settings based upon typical evaluation scenarios, and include instructions for using PowerShell to enable the settings. + +The guide is available in PDF format for offline viewing: + +- [Download the guide in PDF format](https://www.microsoft.com/download/details.aspx?id=54795) + +You can also download a PowerShell that will enable all the settings described in the guide automatically. You can obtain the script alongside the PDF download above, or individually from PowerShell Gallery: + +- [Download the PowerShell script to automatically configure the settings](https://www.powershellgallery.com/packages/WindowsDefender_InternalEvaluationSettings) + +> [!IMPORTANT] +> The guide is currently intended for single-machine evaluation of Microsoft Defender Antivirus. Enabling all of the settings in this guide may not be suitable for real-world deployment. +> +> For the latest recommendations for real-world deployment and monitoring of Microsoft Defender Antivirus across a network, see [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md). + +## Related topics + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO-diagpath.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO-diagpath.png new file mode 100644 index 0000000000..7f5019db43 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO-diagpath.png differ diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO1-SupportLogLocationDefender.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO1-SupportLogLocationDefender.png new file mode 100644 index 0000000000..f93b4ad4dc Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO1-SupportLogLocationDefender.png differ diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO2-SupportLogLocationGPPage.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO2-SupportLogLocationGPPage.png new file mode 100644 index 0000000000..bf839465f9 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO2-SupportLogLocationGPPage.png differ diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO3-SupportLogLocationGPPageEnabledExample.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO3-SupportLogLocationGPPageEnabledExample.png new file mode 100644 index 0000000000..6d5d59ee31 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO3-SupportLogLocationGPPageEnabledExample.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/WDAV-WinSvr2019-turnfeatureson.jpg b/windows/security/threat-protection/microsoft-defender-antivirus/images/WDAV-WinSvr2019-turnfeatureson.jpg similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/WDAV-WinSvr2019-turnfeatureson.jpg rename to windows/security/threat-protection/microsoft-defender-antivirus/images/WDAV-WinSvr2019-turnfeatureson.jpg diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/atp-portal-onboarding-page.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/atp-portal-onboarding-page.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/atp-portal-onboarding-page.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/atp-portal-onboarding-page.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender-updatedefs2.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender-updatedefs2.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender-updatedefs2.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender-updatedefs2.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/client.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/client.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/client.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/client.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/intune-block-at-first-sight.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/intune-block-at-first-sight.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/intune-block-at-first-sight.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/intune-block-at-first-sight.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/notification.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/notification.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/notification.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/notification.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-advanced-settings.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-advanced-settings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-advanced-settings.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-advanced-settings.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-cloud-protection-service.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-cloud-protection-service.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-cloud-protection-service.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-cloud-protection-service.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-real-time-protection.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-real-time-protection.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-real-time-protection.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-real-time-protection.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-wdo.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-wdo.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/sccm-wdo.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-wdo.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-bafs-edge.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-bafs-edge.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-bafs-edge.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-bafs-edge.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-bafs-ie.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-bafs-ie.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-bafs-ie.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-bafs-ie.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-extension-exclusions.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-extension-exclusions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-extension-exclusions.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-extension-exclusions.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-get-mpthreat.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-get-mpthreat.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-get-mpthreat.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-get-mpthreat.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-get-mpthreatdetection.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-get-mpthreatdetection.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-get-mpthreatdetection.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-get-mpthreatdetection.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-headless-mode-1607.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-1607.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-headless-mode-1607.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-1607.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-headless-mode-1703.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-1703.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-headless-mode-1703.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-1703.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-headless-mode-off-1703.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-off-1703.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-headless-mode-off-1703.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-off-1703.png diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-history-wdsc.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-history-wdsc.png new file mode 100644 index 0000000000..35f66083f3 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-history-wdsc.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-malware-detected.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-malware-detected.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-malware-detected.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-malware-detected.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-order-update-sources.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-order-update-sources.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-order-update-sources.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-order-update-sources.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-path-exclusions.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-path-exclusions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-path-exclusions.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-path-exclusions.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-powershell-get-exclusions-all.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-powershell-get-exclusions-all.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-powershell-get-exclusions-all.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-powershell-get-exclusions-all.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-powershell-get-exclusions-variable.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-powershell-get-exclusions-variable.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-powershell-get-exclusions-variable.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-powershell-get-exclusions-variable.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-process-exclusions.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-process-exclusions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-process-exclusions.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-process-exclusions.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-quarantined-history-wdsc.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-quarantined-history-wdsc.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-quarantined-history-wdsc.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-quarantined-history-wdsc.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-settings-old.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-settings-old.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-settings-old.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-settings-old.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-wdsc-defs.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-wdsc-defs.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-wdsc-defs.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-wdsc-defs.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-wdsc.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-wdsc.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-wdsc.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-wdsc.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-windows-defender-app-old.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-windows-defender-app-old.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/defender/wdav-windows-defender-app-old.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-windows-defender-app-old.png diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png new file mode 100644 index 0000000000..d9751a4953 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/gpedit-administrative-templates.PNG b/windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-administrative-templates.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/gpedit-administrative-templates.PNG rename to windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-administrative-templates.PNG diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/gpedit-real-time-protection.PNG b/windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-real-time-protection.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/gpedit-real-time-protection.PNG rename to windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-real-time-protection.PNG diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/gpedit-search.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-search.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/gpedit-search.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-search.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/gpedit-turn-off-real-time-protection-enabled.PNG b/windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-turn-off-real-time-protection-enabled.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/gpedit-turn-off-real-time-protection-enabled.PNG rename to windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-turn-off-real-time-protection-enabled.PNG diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/gpedit-turn-off-real-time-protection.PNG b/windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-turn-off-real-time-protection.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/gpedit-turn-off-real-time-protection.PNG rename to windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-turn-off-real-time-protection.PNG diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/gpedit-windows-defender-antivirus-scan.PNG b/windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-windows-defender-antivirus-scan.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/gpedit-windows-defender-antivirus-scan.PNG rename to windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-windows-defender-antivirus-scan.PNG diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/gpedit-windows-defender-antivirus.PNG b/windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-windows-defender-antivirus.PNG similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/gpedit-windows-defender-antivirus.PNG rename to windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-windows-defender-antivirus.PNG diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/jamf-onboarding.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/jamf-onboarding.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/jamf-onboarding.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/jamf-onboarding.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-1-registerapp.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-1-registerapp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-1-registerapp.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-1-registerapp.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-10-clientapps.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-10-clientapps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-10-clientapps.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-10-clientapps.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-11-assignments.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-11-assignments.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-11-assignments.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-11-assignments.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-12-deviceinstall.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-12-deviceinstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-12-deviceinstall.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-12-deviceinstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-13-systempreferences.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-13-systempreferences.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-13-systempreferences.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-13-systempreferences.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-14-systempreferencesprofiles.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-15-managementprofileconfig.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-15-managementprofileconfig.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-15-managementprofileconfig.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-15-managementprofileconfig.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-16-preferencedomain.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-16-preferencedomain.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-16-preferencedomain.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-16-preferencedomain.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-17-approvedkernelextensions.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-17-approvedkernelextensions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-17-approvedkernelextensions.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-17-approvedkernelextensions.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-18-configurationprofilesscope.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-18-configurationprofilesscope.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-18-configurationprofilesscope.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-18-configurationprofilesscope.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-19-microsoftdefenderwdavpkg.png diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-2-downloadpackages.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-2-downloadpackages.png new file mode 100644 index 0000000000..5653f969ec Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-2-downloadpackages.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-20-microsoftdefenderpackages.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-21-mdmprofile1.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-21-mdmprofile1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-21-mdmprofile1.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-21-mdmprofile1.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-22-mdmprofileapproved.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-22-mdmprofileapproved.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-22-mdmprofileapproved.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-22-mdmprofileapproved.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-23-mdmstatus.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-23-mdmstatus.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-23-mdmstatus.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-23-mdmstatus.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-24-statusonserver.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-24-statusonserver.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-24-statusonserver.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-24-statusonserver.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-25-statusonclient.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-25-statusonclient.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-25-statusonclient.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-25-statusonclient.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-26-uninstall.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-26-uninstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-26-uninstall.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-26-uninstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-27-uninstallscript.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-27-uninstallscript.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-27-uninstallscript.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-27-uninstallscript.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-28-appinstall.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-28-appinstall.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-28-appinstall.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-28-appinstall.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-29-appinstalllogin.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-29-appinstalllogin.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-29-appinstalllogin.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-29-appinstalllogin.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-3-confirmdevicemgmt.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-30-systemextension.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-30-systemextension.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-30-systemextension.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-30-systemextension.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-31-securityprivacysettings.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-31-securityprivacysettings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-31-securityprivacysettings.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-31-securityprivacysettings.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-32-main-app-fix.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-32-main-app-fix.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-32-main-app-fix.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-32-main-app-fix.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-33-securityprivacysettings-noprompt.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-34-mau.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-34-mau.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-34-mau.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-34-mau.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-35-jamf-privacypreferences.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-36-rtp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-36-rtp.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-36-rtp.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-37-exclusions.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-37-exclusions.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-37-exclusions.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-4-managementprofile.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-4-managementprofile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-4-managementprofile.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-4-managementprofile.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-5-alldevices.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-5-alldevices.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-5-alldevices.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-5-alldevices.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-6-systemconfigurationprofiles.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-7-devicestatusblade.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-7-devicestatusblade.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-7-devicestatusblade.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-7-devicestatusblade.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-8-intuneappinfo.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-8-intuneappinfo.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-8-intuneappinfo.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-8-intuneappinfo.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-9-intunepkginfo.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-9-intunepkginfo.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-9-intunepkginfo.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-9-intunepkginfo.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon-bar.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-icon-bar.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon-bar.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-icon-bar.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-icon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/mdatp-icon.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/mdatp-icon.png diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/mde-turn-tamperprotect-on.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mde-turn-tamperprotect-on.png new file mode 100644 index 0000000000..f7fa41a4ac Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/mde-turn-tamperprotect-on.png differ diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/mem-antivirus-scan-on-demand.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/mem-antivirus-scan-on-demand.png new file mode 100644 index 0000000000..5a8def8136 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/mem-antivirus-scan-on-demand.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/microsoft-defender-atp-next-generation-protection-engines.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/microsoft-defender-atp-next-generation-protection-engines.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/microsoft-defender-atp-next-generation-protection-engines.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/microsoft-defender-atp-next-generation-protection-engines.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/pre-execution-and-post-execution-detection-engines.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/pre-execution-and-post-execution-detection-engines.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/pre-execution-and-post-execution-detection-engines.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/pre-execution-and-post-execution-detection-engines.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/server-add-gui.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/server-add-gui.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/server-add-gui.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/server-add-gui.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/svg/check-no.svg b/windows/security/threat-protection/microsoft-defender-antivirus/images/svg/check-no.svg similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/svg/check-no.svg rename to windows/security/threat-protection/microsoft-defender-antivirus/images/svg/check-no.svg diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/svg/check-yes.svg b/windows/security/threat-protection/microsoft-defender-antivirus/images/svg/check-yes.svg similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/svg/check-yes.svg rename to windows/security/threat-protection/microsoft-defender-antivirus/images/svg/check-yes.svg diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tamperattemptalert.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/tamperattemptalert.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/tamperattemptalert.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/tamperattemptalert.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tamperprotectionturnedon.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/tamperprotectionturnedon.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/tamperprotectionturnedon.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/tamperprotectionturnedon.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tamperprotectsecurityrecos.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/tamperprotectsecurityrecos.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/tamperprotectsecurityrecos.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/tamperprotectsecurityrecos.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-alert.jpg b/windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-alert.jpg similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-alert.jpg rename to windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-alert.jpg diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-huntingquery.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-huntingquery.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-huntingquery.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-huntingquery.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-windowssecurityapp.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-windowssecurityapp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-windowssecurityapp.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-windowssecurityapp.png diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-MEM.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-MEM.png new file mode 100644 index 0000000000..0b0516183a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-MEM.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/turnontamperprotect-consumer.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-consumer.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/turnontamperprotect-consumer.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-consumer.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/turnontamperprotect-enterprise.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-enterprise.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/turnontamperprotect-enterprise.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-enterprise.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/turnontamperprotect-intune.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-intune.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/turnontamperprotect-intune.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-intune.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/turnontamperprotection.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotection.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/turnontamperprotection.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotection.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/vtp-3ps-lps-on.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps-lps-on.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/vtp-3ps-lps-on.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps-lps-on.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/vtp-3ps-lps.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps-lps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/vtp-3ps-lps.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps-lps.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/vtp-3ps.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/vtp-3ps.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/vtp-wdav.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-wdav.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/vtp-wdav.png rename to windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-wdav.png diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/win-security- exp-policy-endpt-security.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/win-security- exp-policy-endpt-security.png new file mode 100644 index 0000000000..e4b306fd92 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-antivirus/images/win-security- exp-policy-endpt-security.png differ diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..0e6a552e4c --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md @@ -0,0 +1,53 @@ +--- +title: Enable the limited periodic Microsoft Defender Antivirus scanning feature +description: Limited periodic scanning lets you use Microsoft Defender Antivirus in addition to your other installed AV providers +keywords: lps, limited, periodic, scan, scanning, compatibility, 3rd party, other av, disable +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + + + +# Use limited periodic scanning in Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Limited periodic scanning is a special type of threat detection and remediation that can be enabled when you have installed another antivirus product on a Windows 10 device. + +It can only be enabled in certain situations. For more information about limited periodic scanning and how Microsoft Defender Antivirus works with other antivirus products, see [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md). + +**Microsoft does not recommend using this feature in enterprise environments. This is a feature primarily intended for consumers.** This feature only uses a limited subset of the Microsoft Defender Antivirus capabilities to detect malware, and will not be able to detect most malware and potentially unwanted software. Also, management and reporting capabilities will be limited. Microsoft recommends enterprises choose their primary antivirus solution and use it exclusively. + +## How to enable limited periodic scanning + +By default, Microsoft Defender Antivirus will enable itself on a Windows 10 device if there is no other antivirus product installed, or if the other product is out-of-date, expired, or not working correctly. + +If Microsoft Defender Antivirus is enabled, the usual options will appear to configure it on that device: + +![Windows Security app showing Microsoft Defender AV options, including scan options, settings, and update options](images/vtp-wdav.png) + +If another antivirus product is installed and working correctly, Microsoft Defender Antivirus will disable itself. The Windows Security app will change the **Virus & threat protection** section to show status about the AV product, and provide a link to the product's configuration options. + +Underneath any third party AV products, a new link will appear as **Microsoft Defender Antivirus options**. Clicking this link will expand to show the toggle that enables limited periodic scanning. Note that the limited periodic option is a toggle to enable or disable periodic scanning. + +Sliding the switch to **On** will show the standard Microsoft Defender AV options underneath the third party AV product. The limited periodic scanning option will appear at the bottom of the page. + +## Related articles + +- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..8dc17adfac --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md @@ -0,0 +1,163 @@ +--- +title: Apply Microsoft Defender Antivirus updates after certain events +description: Manage how Microsoft Defender Antivirus applies security intelligence updates after startup or receiving cloud-delivered detection reports. +keywords: updates, protection, force updates, events, startup, check for latest, notifications +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/17/2018 +ms.reviewer: pahuijbr +manager: dansimp +ms.technology: mde +--- + +# Manage event-based forced updates + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Antivirus allows you to determine if updates should (or should not) occur after certain events, such as at startup or after receiving specific reports from the cloud-delivered protection service. + +## Check for protection updates before running a scan + +You can use Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, and WMI to force Microsoft Defender Antivirus to check and download protection updates before running a scheduled scan. + +### Use Configuration Manager to check for protection updates before running a scan + +1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) + +2. Go to the **Scheduled scans** section and set **Check for the latest security intelligence updates before running a scan** to **Yes**. + +3. Click **OK**. + +4. [Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). + +### Use Group Policy to check for protection updates before running a scan + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. + +2. Using the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Scan**. + +5. Double-click **Check for the latest virus and spyware definitions before running a scheduled scan** and set the option to **Enabled**. + +6. Click **OK**. + +### Use PowerShell cmdlets to check for protection updates before running a scan + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -CheckForSignaturesBeforeRunningScan +``` + +For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index). + +### Use Windows Management Instruction (WMI) to check for protection updates before running a scan + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +CheckForSignaturesBeforeRunningScan +``` + +For more information, see [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). + +## Check for protection updates on startup + +You can use Group Policy to force Microsoft Defender Antivirus to check and download protection updates when the machine is started. + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. + +2. Using the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. + +5. Double-click **Check for the latest virus and spyware definitions on startup** and set the option to **Enabled**. + +6. Click **OK**. + +You can also use Group Policy, PowerShell, or WMI to configure Microsoft Defender Antivirus to check for updates at startup even when it is not running. + +### Use Group Policy to download updates when Microsoft Defender Antivirus is not present + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. + +2. Using the **Group Policy Management Editor**, go to **Computer configuration**. + +3. Click **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. + +5. Double-click **Initiate security intelligence update on startup** and set the option to **Enabled**. + +6. Click **OK**. + +### Use PowerShell cmdlets to download updates when Microsoft Defender Antivirus is not present + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine +``` + +For more information, see [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Use Windows Management Instruction (WMI) to download updates when Microsoft Defender Antivirus is not present + +Use the [**Set** method of the **MSFT_MpPreference**](https://docs.microsoft.com/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: + +```WMI +SignatureDisableUpdateOnStartupWithoutEngine +``` + +For more information, see [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). + + + +## Allow ad hoc changes to protection based on cloud-delivered protection + +Microsoft Defender AV can make changes to its protection based on cloud-delivered protection. Such changes can occur outside of normal or scheduled protection updates. + +If you have enabled cloud-delivered protection, Microsoft Defender AV will send files it is suspicious about to the Windows Defender cloud. If the cloud service reports that the file is malicious, and the file is detected in a recent protection update, you can use Group Policy to configure Microsoft Defender AV to automatically receive that protection update. Other important protection updates can also be applied. + +### Use Group Policy to automatically download recent updates based on cloud-delivered protection + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. + +2. Using the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. + +5. Double-click **Allow real-time security intelligence updates based on reports to Microsoft MAPS** and set the option to **Enabled**. Then click **OK**. + +6. **Allow notifications to disable definitions-based reports to Microsoft MAPS** and set the option to **Enabled**. Then click **OK**. + +> [!NOTE] +> **Allow notifications to disable definitions based reports** enables Microsoft MAPS to disable those definitions known to cause false-positive reports. You must configure your computer to join Microsoft MAPS for this function to work. + +## See also + +- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) +- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) +- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) +- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..668830b824 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md @@ -0,0 +1,185 @@ +--- +title: Apply Microsoft Defender AV protection updates to out of date endpoints +description: Define when and how updates should be applied for endpoints that have not updated in a while. +keywords: updates, protection, out-of-date, outdated, old, catch-up +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Manage Microsoft Defender Antivirus updates and scans for endpoints that are out of date + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Antivirus lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis. + +For example, an employee that uses a particular PC is on break for three days and does not log on to their PC during that time. + +When the user returns to work and logs on to their PC, Microsoft Defender Antivirus will immediately check and download the latest protection updates, and run a scan. + +## Set up catch-up protection updates for endpoints that haven't updated for a while + +If Microsoft Defender Antivirus did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have [globally disabled automatic update downloads on startup](manage-event-based-updates-microsoft-defender-antivirus.md). + +### Use Configuration Manager to configure catch-up protection updates + +1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) + +2. Go to the **Security intelligence updates** section and configure the following settings: + + 1. Set **Force a security intelligence update if the client computer is offline for more than two consecutive scheduled updates** to **Yes**. + 2. For the **If Configuration Manager is used as a source for security intelligence updates...**, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined [fallback source order](manage-protection-updates-microsoft-defender-antivirus.md#fallback-order). + +3. Click **OK**. + +4. [Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). + +### Use Group Policy to enable and configure the catch-up update feature + +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates**. + +5. Double-click the **Define the number of days after which a catch-up security intelligence update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to check for and download the latest protection update. + +6. Click **OK**. + +### Use PowerShell cmdlets to configure catch-up protection updates + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -SignatureUpdateCatchupInterval +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Use Windows Management Instruction (WMI) to configure catch-up protection updates + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +SignatureUpdateCatchupInterval +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + + +## Set the number of days before protection is reported as out-of-date + +You can also specify the number of days after which Microsoft Defender Antivirus protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Microsoft Defender Antivirus to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-microsoft-defender-antivirus.md#fallback-order)), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source. + +### Use Group Policy to specify the number of days before protection is considered out-of-date + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates** and configure the following settings: + + 1. Double-click **Define the number of days before spyware definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to consider spyware Security intelligence to be out-of-date. + + 2. Click **OK**. + + 3. Double-click **Define the number of days before virus definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to consider virus Security intelligence to be out-of-date. + + 4. Click **OK**. + + +## Set up catch-up scans for endpoints that have not been scanned for a while + +You can set the number of consecutive scheduled scans that can be missed before Microsoft Defender Antivirus will force a scan. + +The process for enabling this feature is: + +1. Set up at least one scheduled scan (see the [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) topic). +2. Enable the catch-up scan feature. +3. Define the number of scans that can be skipped before a catch-up scan occurs. + +This feature can be enabled for both full and quick scans. + +### Use Group Policy to enable and configure the catch-up scan feature + +1. Ensure you have set up at least one scheduled scan. + +2. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Microsoft Defender Antivirus > Scan** and configure the following settings: + + 1. If you have set up scheduled quick scans, double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**. + 2. If you have set up scheduled full scans, double-click the **Turn on catch-up full scan** setting and set the option to **Enabled**. Click **OK**. + 3. Double-click the **Define the number of days after which a catch-up scan is forced** setting and set the option to **Enabled**. + 4. Enter the number of scans that can be missed before a scan will be automatically run when the user next logs on to the PC. The type of scan that is run is determined by the **Specify the scan type to use for a scheduled scan** (see the [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) topic). Click **OK**. + +> [!NOTE] +> The Group Policy setting title refers to the number of days. The setting, however, is applied to the number of scans (not days) before the catch-up scan will be run. + +### Use PowerShell cmdlets to configure catch-up scans + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -DisableCatchupFullScan +Set-MpPreference -DisableCatchupQuickScan + +``` + +See [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Use Windows Management Instruction (WMI) to configure catch-up scans + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +DisableCatchupFullScan +DisableCatchupQuickScan +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + + +### Use Configuration Manager to configure catch-up scans + +1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) + +2. Go to the **Scheduled scans** section and **Force a scan of the selected scan type if client computer is offline...** to **Yes**. + +3. Click **OK**. + +4. [Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). + +## Related articles + +- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) +- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) +- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) +- [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) +- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..494811e6e8 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md @@ -0,0 +1,105 @@ +--- +title: Schedule Microsoft Defender Antivirus protection updates +description: Schedule the day, time, and interval for when protection updates should be downloaded +keywords: updates, security baselines, schedule updates +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +search.appverid: met150 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: pahuijbr +manager: dansimp +ms.technology: mde +--- + +# Manage the schedule for when protection updates should be downloaded and applied + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Antivirus lets you determine when it should look for and download updates. + +You can schedule updates for your endpoints by: + +- Specifying the day of the week to check for protection updates +- Specifying the interval to check for protection updates +- Specifying the time to check for protection updates + +You can also randomize the times when each endpoint checks and downloads protection updates. See the [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) topic for more information. + +## Use Configuration Manager to schedule protection updates + +1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) + +2. Go to the **Security intelligence updates** section. + +3. To check and download updates at a certain time: + 1. Set **Check for Endpoint Protection security intelligence updates at a specific interval...** to **0**. + 2. Set **Check for Endpoint Protection security intelligence updates daily at...** to the time when updates should be checked. + 3 +4. To check and download updates on a continual interval, Set **Check for Endpoint Protection security intelligence updates at a specific interval...** to the number of hours that should occur between updates. + +5. [Deploy the updated policy as usual](https://docs.microsoft.com/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). + +## Use Group Policy to schedule protection updates + +> [!IMPORTANT] +> By default, Microsoft Defender Antivirus will check for an update 15 minutes before the time of any scheduled scans. Enabling these settings will override that default. + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Intelligence Updates** and configure the following settings: + + 1. Double-click the **Specify the day of the week to check for security intelligence updates** setting and set the option to **Enabled**. Enter the day of the week to check for updates. Click **OK**. + 2. Double-click the **Specify the interval to check for security intelligence updates** setting and set the option to **Enabled**. Enter the number of hours between updates. Click **OK**. + 3. Double-click the **Specify the time to check for security intelligence updates** setting and set the option to **Enabled**. Enter the time when updates should be checked. The time is based on the local time of the endpoint. Click **OK**. + + +## Use PowerShell cmdlets to schedule protection updates + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -SignatureScheduleDay +Set-MpPreference -SignatureScheduleTime +Set-MpPreference -SignatureUpdateInterval +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +## Use Windows Management Instruction (WMI) to schedule protection updates + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +SignatureScheduleDay +SignatureScheduleTime +SignatureUpdateInterval +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + + +## Related articles + +- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) +- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) +- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +- [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) +- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..acd96cc68b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md @@ -0,0 +1,264 @@ +--- +title: Manage how and where Microsoft Defender Antivirus receives updates +description: Manage the fallback order for how Microsoft Defender Antivirus receives protection updates. +keywords: updates, security baselines, protection, fallback order, ADL, MMPC, UNC, file path, share, wsus +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.reviewer: pahuijbr +manager: dansimp +ms.custom: nextgen +ms.technology: mde +--- + +# Manage the sources for Microsoft Defender Antivirus protection updates + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=22146631) + + + + +Keeping your antivirus protection up to date is critical. There are two components to managing protection updates for Microsoft Defender Antivirus: +- *Where* the updates are downloaded from; and +- *When* updates are downloaded and applied. + +This article describes how to specify from where updates should be downloaded (this is also known as the fallback order). See [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates). + +> [!IMPORTANT] +> Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update and starting Monday, October 21, 2019, all security intelligence updates will be SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to update your security intelligence. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). + + + + +## Fallback order + +Typically, you configure endpoints to individually download updates from a primary source followed by other sources in order of priority, based on your network configuration. Updates are obtained from sources in the order you specify. If a source is not available, the next source in the list is used immediately. + +When updates are published, some logic is applied to minimize the size of the update. In most cases, only the differences between the latest update and the update that is currently installed (this is referred to as the delta) on the device is downloaded and applied. However, the size of the delta depends on two main factors: +- The age of the last update on the device; and +- The source used to download and apply updates. + +The older the updates on an endpoint, the larger the download will be. However, you must also consider download frequency as well. A more frequent update schedule can result in more network usage, whereas a less-frequent schedule can result in larger file sizes per download. + +There are five locations where you can specify where an endpoint should obtain updates: + +- [Microsoft Update](https://support.microsoft.com/help/12373/windows-update-faq) +- [Windows Server Update Service](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) +- [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/core/servers/manage/updates) +- [Network file share](#unc-share) +- [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates) (Your policy and registry might have this listed as Microsoft Malware Protection Center (MMPC) security intelligence, its former name.) + +To ensure the best level of protection, Microsoft Update allows for rapid releases, which means smaller downloads on a frequent basis. The Windows Server Update Service, Microsoft Endpoint Configuration Manager, and Microsoft security intelligence updates sources deliver less frequent updates. Thus, the delta can be larger, resulting in larger downloads. + +> [!IMPORTANT] +> If you have set [Microsoft Security intelligence page](https://www.microsoft.com/security/portal/definitions/adl.aspx) updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates when the current update is considered out-of-date. (By default, this is seven consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services). +> You can, however, [set the number of days before protection is reported as out-of-date](https://docs.microsoft.com/windows/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).

    +> Starting Monday, October 21, 2019, security intelligence updates will be SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). + +Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table: + +|Location | Sample scenario | +|---|---| +|Windows Server Update Service | You are using Windows Server Update Service to manage updates for your network.| +|Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use Windows Server Update Service to manage your updates.| +|File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-microsoft-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments.| +|Microsoft Endpoint Manager | You are using Microsoft Endpoint Manager to update your endpoints.| +|Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware (formerly referred to as MMPC) |[Make sure your devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update, and starting Monday October 21, 2019 security intelligence updates will be SHA-2 signed exclusively.
    Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-microsoft-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](https://docs.microsoft.com/windows/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).| + +You can manage the order in which update sources are used with Group Policy, Microsoft Endpoint Configuration Manager, PowerShell cmdlets, and WMI. + +> [!IMPORTANT] +> If you set Windows Server Update Service as a download location, you must approve the updates, regardless of the management tool you use to specify the location. You can set up an automatic approval rule with Windows Server Update Service, which might be useful as updates arrive at least once a day. To learn more, see [synchronize endpoint protection updates in standalone Windows Server Update Service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus). + +The procedures in this article first describe how to set the order, and then how to set up the **File share** option if you have enabled it. + +## Use Group Policy to manage the update location + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components > Windows Defender > Signature updates** and configure the following settings: + + 1. Double-click the **Define the order of sources for downloading security intelligence updates** setting and set the option to **Enabled**. + + 2. Enter the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot. + + ![Screenshot of group policy setting listing the order of sources](images/defender/wdav-order-update-sources.png) + + 3. Click **OK**. This will set the order of protection update sources. + + 4. Double-click the **Define file shares for downloading security intelligence updates** setting and set the option to **Enabled**. + + 5. Enter the file share source. If you have multiple sources, enter each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](https://docs.microsoft.com/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you do not enter any paths, then this source will be skipped when the VM downloads updates. + + 6. Click **OK**. This will set the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting. + +> [!NOTE] +> For Windows 10, versions 1703 up to and including 1809, the policy path is **Windows Components > Microsoft Defender Antivirus > Signature Updates** +> For Windows 10, version 1903, the policy path is **Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates** + +## Use Configuration Manager to manage the update location + +See [Configure Security intelligence Updates for Endpoint Protection](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-definition-updates) for details on configuring Microsoft Endpoint Manager (current branch). + + +## Use PowerShell cmdlets to manage the update location + +Use the following PowerShell cmdlets to set the update order. + +```PowerShell +Set-MpPreference -SignatureFallbackOrder {LOCATION|LOCATION|LOCATION|LOCATION} +Set-MpPreference -SignatureDefinitionUpdateFileSharesSource {\\UNC SHARE PATH|\\UNC SHARE PATH} +``` +See the following articles for more information: +- [Set-MpPreference -SignatureFallbackOrder](https://docs.microsoft.com/powershell/module/defender/set-mppreference) +- [Set-MpPreference -SignatureDefinitionUpdateFileSharesSource](https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference#-signaturedefinitionupdatefilesharessources) +- [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) +- [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index) + +## Use Windows Management Instruction (WMI) to manage the update location + +Use the [**Set** method of the **MSFT_MpPreference**](https://docs.microsoft.com/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: + +```WMI +SignatureFallbackOrder +SignatureDefinitionUpdateFileSharesSource +``` + +See the following articles for more information: +- [Windows Defender WMIv2 APIs](https://docs.microsoft.com/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) + +## Use Mobile Device Management (MDM) to manage the update location + +See [Policy CSP - Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-signatureupdatefallbackorder) for details on configuring MDM. + +## What if we're using a third-party vendor? + +This article describes how to configure and manage updates for Microsoft Defender Antivirus. However, third-party vendors can be used to perform these tasks. + +For example, suppose that Contoso has hired Fabrikam to manage their security solution, which includes Microsoft Defender Antivirus. Fabrikam typically uses [Windows Management Instrumentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus), [PowerShell cmdlets](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus), or [Windows command-line](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) to deploy patches and updates. + +> [!NOTE] +> Microsoft does not test third-party solutions for managing Microsoft Defender Antivirus. + + +## Create a UNC share for security intelligence updates + +Set up a network file share (UNC/mapped drive) to download security intelligence updates from the MMPC site by using a scheduled task. + +1. On the system on which you want to provision the share and download the updates, create a folder to which you will save the script. + ```DOS + Start, CMD (Run as admin) + MD C:\Tool\PS-Scripts\ + ``` + +2. Create the folder to which you will save the signature updates. + ```DOS + MD C:\Temp\TempSigs\x64 + MD C:\Temp\TempSigs\x86 + ``` + +3. Download the PowerShell script from [www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4). + +4. Click **Manual Download**. + +5. Click **Download the raw nupkg file**. + +6. Extract the file. + +7. Copy the file SignatureDownloadCustomTask.ps1 to the folder you previously created, C:\Tool\PS-Scripts\ . + +8. Use the command line to set up the scheduled task. + > [!NOTE] + > There are two types of updates: full and delta. + - For x64 delta: + + ```DOS + Powershell (Run as admin) + + C:\Tool\PS-Scripts\ + + “.\SignatureDownloadCustomTask.ps1 -action create -arch x64 -isDelta $true -destDir C:\Temp\TempSigs\x64 -scriptPath C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1 -daysInterval 1” + ``` + + - For x64 full: + + ```DOS + Powershell (Run as admin) + + C:\Tool\PS-Scripts\ + + “.\SignatureDownloadCustomTask.ps1 -action create -arch x64 -isDelta $false -destDir C:\Temp\TempSigs\x64 -scriptPath C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1 -daysInterval 1” + ``` + + - For x86 delta: + + ```DOS + Powershell (Run as admin) + + C:\Tool\PS-Scripts\ + + “.\SignatureDownloadCustomTask.ps1 -action create -arch x86 -isDelta $true -destDir C:\Temp\TempSigs\x86 -scriptPath C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1 -daysInterval 1” + ``` + + - For x86 full: + + ```DOS + Powershell (Run as admin) + + C:\Tool\PS-Scripts\ + + “.\SignatureDownloadCustomTask.ps1 -action create -arch x86 -isDelta $false -destDir C:\Temp\TempSigs\x86 -scriptPath C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1 -daysInterval 1” + ``` + + > [!NOTE] + > When the scheduled tasks are created, you can find these in the Task Scheduler under Microsoft\Windows\Windows Defender +9. Run each task manually and verify that you have data (mpam-d.exe, mpam-fe.exe, and nis_full.exe) in the following folders (you might have chosen different locations): + + - C:\Temp\TempSigs\x86 + - C:\Temp\TempSigs\x64 + + If the scheduled task fails, run the following commands: + + ```DOS + C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command “&\”C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\” -action run -arch x64 -isDelta $False -destDir C:\Temp\TempSigs\x64″ + + C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command “&\”C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\” -action run -arch x64 -isDelta $True -destDir C:\Temp\TempSigs\x64″ + + C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command “&\”C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\” -action run -arch x86 -isDelta $False -destDir C:\Temp\TempSigs\x86″ + + C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command “&\”C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\” -action run -arch x86 -isDelta $True -destDir C:\Temp\TempSigs\x86″ + ``` + > [!NOTE] + > Issues could also be due to execution policy. + +10. Create a share pointing to C:\Temp\TempSigs (e.g. \\server\updates). + > [!NOTE] + > At a minimum, authenticated users must have “Read” access. +11. Set the share location in the policy to the share. + + > [!NOTE] + > Do not add the x64 (or x86) folder in the path. The mpcmdrun.exe process adds it automatically. + +## Related articles + +- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) +- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) +- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +- [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) +- [Manage updates for mobile devices and VMs](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..e95120c0b6 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -0,0 +1,505 @@ +--- +title: Manage Microsoft Defender Antivirus updates and apply baselines +description: Manage how Microsoft Defender Antivirus receives protection and product updates. +keywords: updates, security baselines, protection, schedule updates, force updates, mobile updates, wsus +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: pahuijbr +manager: dansimp +ms.date: 02/12/2021 +ms.technology: mde +--- + +# Manage Microsoft Defender Antivirus updates and apply baselines + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +There are two types of updates related to keeping Microsoft Defender Antivirus up to date: + +- Security intelligence updates +- Product updates + +> [!IMPORTANT] +> Keeping Microsoft Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. +> Make sure to update your antivirus protection even if Microsoft Defender Antivirus is running in [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility). +> +> To see the most current engine, platform, and signature date, visit the [Microsoft security encyclopedia](https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?action=info). + +## Security intelligence updates + +Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads security intelligence updates to provide protection. + +> [!NOTE] +> Updates are released under the below KB numbers: +> Microsoft Defender Antivirus: KB2267602 +> System Center Endpoint Protection: KB2461484 + +Cloud-delivered protection is always on and requires an active connection to the Internet to function. Security intelligence updates occur on a scheduled cadence (configurable via policy). For more information, see [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). + +For a list of recent security intelligence updates, see [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/wdsi/definitions/antimalware-definition-release-notes). + +Engine updates are included with security intelligence updates and are released on a monthly cadence. + +## Product updates + +Microsoft Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as *platform updates*), and will receive major feature updates alongside Windows 10 releases. + +You can manage the distribution of updates through one of the following methods: + +- [Windows Server Update Service (WSUS)](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) +- [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/sum/understand/software-updates-introduction) +- The usual method you use to deploy Microsoft and Windows updates to endpoints in your network. + +For more information, see [Manage the sources for Microsoft Defender Antivirus protection updates](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus). + +> [!NOTE] +> Monthly updates are released in phases, resulting in multiple packages visible in your [Window Server Update Services](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). + +## Monthly platform and engine versions + +For information how to update or install the platform update, see [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform). + +All our updates contain +- performance improvements; +- serviceability improvements; and +- integration improvements (Cloud, Microsoft 365 Defender). +

    + +

    + January-2021 (Platform: 4.18.2101.9 | Engine: 1.1.17800.5) + + Security intelligence update version: **1.327.1854.0** + Released: **February 2, 2021** + Platform: **4.18.2101.9** + Engine: **1.1.17800.5** + Support phase: **Security and Critical Updates** + +### What's new + +- Additional failed tampering attempt event generation when [Tamper Protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled +- Shellcode exploit detection improvements +- Increased visibility for credential stealing attempts +- Improvements in antitampering features in Microsoft Defender Antivirus services +- Improved support for ARM x64 emulation +- Fix: EDR Block notification remains in threat history after real-time protection performed initial detection + +### Known Issues +No known issues +
    +
    + November-2020 (Platform: 4.18.2011.6 | Engine: 1.1.17700.4) + + Security intelligence update version: **1.327.1854.0** + Released: **December 03, 2020** + Platform: **4.18.2011.6** + Engine: **1.1.17700.4** + Support phase: **Security and Critical Updates** + +### What's new + +- Improved [SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) status support logging + +### Known Issues +No known issues +
    +
    + October-2020 (Platform: 4.18.2010.7 | Engine: 1.1.17600.5) + + Security intelligence update version: **1.327.7.0** + Released: **October 29, 2020** + Platform: **4.18.2010.7** + Engine: **1.1.17600.5** + Support phase: **Security and Critical Updates** + +### What's new + +- New descriptions for special threat categories +- Improved emulation capabilities +- Improved host address allow/block capabilities +- New option in Defender CSP to Ignore merging of local user exclusions + +### Known Issues + +No known issues +
    +
    + +### Previous version updates: Technical upgrade support only + +After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only. +

    +
    + September-2020 (Platform: 4.18.2009.7 | Engine: 1.1.17500.4) + + Security intelligence update version: **1.325.10.0** + Released: **October 01, 2020** + Platform: **4.18.2009.7** + Engine: **1.1.17500.4** + Support phase: **Technical upgrade support (only)** + +### What's new + +- Admin permissions are required to restore files in quarantine +- XML formatted events are now supported +- CSP support for ignoring exclusion merges +- New management interfaces for: + - UDP Inspection + - Network Protection on Server 2019 + - IP Address exclusions for Network Protection +- Improved visibility into TPM measurements +- Improved Office VBA module scanning + +### Known Issues + +No known issues +
    +
    +
    + August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) + + Security intelligence update version: **1.323.9.0** + Released: **August 27, 2020** + Platform: **4.18.2008.9** + Engine: **1.1.17400.5** + Support phase: **Technical upgrade support (only)** + +### What's new + +- Add more telemetry events +- Improved scan event telemetry +- Improved behavior monitoring for memory scans +- Improved macro streams scanning +- Added `AMRunningMode` to Get-MpComputerStatus PowerShell cmdlet +- [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) is ignored. Microsoft Defender Antivirus automatically turns itself off when it detects another antivirus program. + + +### Known Issues +No known issues +
    +
    + +
    + July-2020 (Platform: 4.18.2007.8 | Engine: 1.1.17300.4) + + Security intelligence update version: **1.321.30.0** + Released: **July 28, 2020** + Platform: **4.18.2007.8** + Engine: **1.1.17300.4** + Support phase: **Technical upgrade support (only)** + +### What's new + +- Improved telemetry for BITS +- Improved Authenticode code signing certificate validation + +### Known Issues +No known issues +
    +
    + +
    + June-2020 (Platform: 4.18.2006.10 | Engine: 1.1.17200.2) + + Security intelligence update version: **1.319.20.0** + Released: **June 22, 2020** + Platform: **4.18.2006.10** + Engine: **1.1.17200.2** + Support phase: **Technical upgrade support (only)** + +### What's new + +- Possibility to specify the [location of the support logs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data) +- Skipping aggressive catchup scan in Passive mode. +- Allow Defender to update on metered connections +- Fixed performance tuning when caching is disabled +- Fixed registry query +- Fixed scantime randomization in ADMX + +### Known Issues +No known issues +
    +
    + +
    + May-2020 (Platform: 4.18.2005.4 | Engine: 1.1.17100.2) + + Security intelligence update version: **1.317.20.0** + Released: **May 26, 2020** + Platform: **4.18.2005.4** + Engine: **1.1.17100.2** + Support phase: **Technical upgrade support (only)** + +### What's new + +- Improved logging for scan events +- Improved user mode crash handling. +- Added event tracing for Tamper protection +- Fixed AMSI Sample submission +- Fixed AMSI Cloud blocking +- Fixed Security update install log + +### Known Issues +No known issues +
    +
    + +
    + April-2020 (Platform: 4.18.2004.6 | Engine: 1.1.17000.2) + + Security intelligence update version: **1.315.12.0** + Released: **April 30, 2020** + Platform: **4.18.2004.6** + Engine: **1.1.17000.2** + Support phase: **Technical upgrade support (only)** + +### What's new +- WDfilter improvements +- Add more actionable event data to attack surface reduction detection events +- Fixed version information in diagnostic data and WMI +- Fixed incorrect platform version in UI after platform update +- Dynamic URL intel for Fileless threat protection +- UEFI scan capability +- Extend logging for updates + +### Known Issues +No known issues +
    +
    + +
    + March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2) + + Security intelligence update version: **1.313.8.0** + Released: **March 24, 2020** + Platform: **4.18.2003.8** + Engine: **1.1.16900.4** + Support phase: **Technical upgrade support (only)** + +### What's new + +- CPU Throttling option added to [MpCmdRun](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) +- Improve diagnostic capability +- reduce Security intelligence timeout (5 min) +- Extend AMSI engine internal log capability +- Improve notification for process blocking + +### Known Issues +[**Fixed**] Microsoft Defender Antivirus is skipping files when running a scan. + +
    +
    + +
    + + February-2020 (Platform: - | Engine: 1.1.16800.2) + + + Security intelligence update version: **1.311.4.0** + Released: **February 25, 2020** + Platform/Client: **-** + Engine: **1.1.16800.2** + Support phase: **Technical upgrade support (only)** + +### What's new + + +### Known Issues +No known issues +
    +
    + +
    + January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) + + +Security intelligence update version: **1.309.32.0** +Released: **January 30, 2020** +Platform/Client: **4.18.2001.10** +Engine: **1.1.16700.2** + Support phase: **Technical upgrade support (only)** + +### What's new + +- Fixed BSOD on WS2016 with Exchange +- Support platform updates when TMP is redirected to network path +- Platform and engine versions are added to [WDSI](https://www.microsoft.com/wdsi/defenderupdates) +- extend Emergency signature update to [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility) +- Fix 4.18.1911.3 hang + +### Known Issues + +[**Fixed**] devices utilizing [modern standby mode](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform. +
    +> [!IMPORTANT] +> This update is: +> - needed by RS1 devices running lower version of the platform to support SHA2; +> - has a reboot flag for systems that have hanging issues; +> - is re-released in April 2020 and will not be superseded by newer updates to keep future availability; +> - is categorized as an update due to the reboot requirement; and +> - is only be offered with [Windows Update](https://support.microsoft.com/help/4027667/windows-10-update). +
    +
    + +
    + November-2019 (Platform: 4.18.1911.3 | Engine: 1.1.16600.7) + +Security intelligence update version: **1.307.13.0** +Released: **December 7, 2019** +Platform: **4.18.1911.3** +Engine: **1.1.17000.7** +Support phase: **No support** + +### What's new + +- Fixed MpCmdRun tracing level +- Fixed WDFilter version info +- Improve notifications (PUA) +- add MRT logs to support files + +### Known Issues +When this update is installed, the device needs the jump package 4.10.2001.10 to be able to update to the latest platform version. +
    +
    + + +## Microsoft Defender Antivirus platform support +Platform and engine updates are provided on a monthly cadence. To be fully supported, keep current with the latest platform updates. Our support structure is dynamic, evolving into two phases depending on the availability of the latest platform version: + +- **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform. + +- **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.* + +\* Technical support will continue to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. + +During the technical support (only) phase, commercially reasonable support incidents will be provided through Microsoft Customer Service & Support and Microsoft’s managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a non-security update, or requires a security update, customers will be asked to upgrade to the latest platform version or an intermediate update (*). + +### Platform version included with Windows 10 releases +The below table provides the Microsoft Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases: + +|Windows 10 release |Platform version |Engine version |Support phase | +|:---|:---|:---|:---| +|2004 (20H1) |4.18.2004.6 |1.1.17000.2 | Technical upgrade support (only) | +|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade support (only) | +|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade support (only) | +|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade support (only) | +|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade support (only) | +|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade support (only) | +|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade support (only) | +|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade support (only) | + +For Windows 10 release information, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet). + +## Updates for Deployment Image Servicing and Management (DISM) + +We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 OS installation images with the latest antivirus and antimalware updates. Keeping your OS installation images up to date helps avoid a gap in protection. + +For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images). + +
    +1.1.2102.03 + + Package version: **1.1.2102.03** + Platform version: **4.18.2011.6** + Engine version: **1.17800.5** + Signature version: **1.331.174.0** + +### Fixes +- None + +### Additional information +- None +
    +
    +1.1.2101.02 + + Package version: **1.1.2101.02** + Platform version: **4.18.2011.6** + Engine version: **1.17700.4** + Signature version: **1.329.1796.0** + +### Fixes +- None + +### Additional information +- None +
    +
    +1.1.2012.01 + + Package version: **1.1.2012.01** + Platform version: **4.18.2010.7** + Engine version: **1.17600.5** + Signature version: **1.327.1991.0** + +### Fixes +- None + +### Additional information +- None +
    +
    +1.1.2011.02 + + Package version: **1.1.2011.02** + Platform version: **4.18.2010.7** + Engine version: **1.17600.5** + Signature version: **1.327.658.0** + +### Fixes +- None + +### Additional information +- Refreshed Microsoft Defender Antivirus signatures +
    +
    +1.1.2011.01 + + Package version: **1.1.2011.01** + Platform version: **4.18.2009.7** + Engine version: **1.17600.5** + Signature version: **1.327.344.0** + +### Fixes +- None + +### Additional information +- None +
    +
    +1.1.2009.10 + + Package version: **1.1.2011.01** + Platform version: **4.18.2008.9** + Engine version: **1.17400.5** + Signature version: **1.327.2216.0** + +### Fixes +- None + +### Additional information +- Added support for Windows 10 RS1 or later OS install images. +
    +
    + +## Additional resources + +| Article | Description | +|:---|:---| +|[Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images) | Review antimalware update packages for your OS installation images (WIM and VHD files). Get Microsoft Defender Antivirus updates for Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 installation images. | +|[Manage how protection updates are downloaded and applied](manage-protection-updates-microsoft-defender-antivirus.md) | Protection updates can be delivered through many sources. | +|[Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | You can schedule when protection updates should be downloaded. | +|[Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | If an endpoint misses an update or scheduled scan, you can force an update or scan the next time a user signs in. | +|[Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | You can set protection updates to be downloaded at startup or after certain cloud-delivered protection events. | +|[Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md)| You can specify settings, such as whether updates should occur on battery power, that are especially useful for mobile devices and virtual machines. | diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..8f192cc64b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -0,0 +1,98 @@ +--- +title: Define how mobile devices are updated by Microsoft Defender Antivirus +description: Manage how mobile devices, such as laptops, should be updated with Microsoft Defender Antivirus protection updates. +keywords: updates, protection, schedule updates, battery, mobile device, laptop, notebook, opt-in, microsoft update, wsus, override +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Manage updates for mobile devices and virtual machines (VMs) + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Mobile devices and VMs may require more configuration to ensure performance is not impacted by updates. + +There are two settings that are useful for these devices: + +- Opt in to Microsoft Update on mobile computers without a WSUS connection +- Prevent Security intelligence updates when running on battery power + +The following articles may also be useful in these situations: +- [Configuring scheduled and catch-up scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +- [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md) + +## Opt in to Microsoft Update on mobile computers without a WSUS connection + +You can use Microsoft Update to keep Security intelligence on mobile devices running Microsoft Defender Antivirus up to date when they are not connected to the corporate network or don't otherwise have a WSUS connection. + +This means that protection updates can be delivered to devices (via Microsoft Update) even if you have set WSUS to override Microsoft Update. + +You can opt in to Microsoft Update on the mobile device in one of the following ways: + +- Change the setting with Group Policy. +- Use a VBScript to create a script, then run it on each computer in your network. +- Manually opt in every computer on your network through the **Settings** menu. + +### Use Group Policy to opt in to Microsoft Update + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Select **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**. + +5. Set **Allow security intelligence updates from Microsoft Update** to **Enabled**, and then select **OK**. + + +### Use a VBScript to opt in to Microsoft Update + +1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](https://msdn.microsoft.com/library/windows/desktop/aa826676.aspx) to create the VBScript. + +2. Run the VBScript you created on each computer in your network. + +### Manually opt in to Microsoft Update + +1. Open **Windows Update** in **Update & security** settings on the computer you want to opt in. + +2. Select **Advanced** options. + +3. Select the checkbox for **Give me updates for other Microsoft products when I update Windows**. + +## Prevent Security intelligence updates when running on battery power + +You can configure Microsoft Defender Antivirus to only download protection updates when the PC is connected to a wired power source. + +### Use Group Policy to prevent security intelligence updates on battery power + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), choose the Group Policy Object you want to configure, and open it for editing. + +2. In the **Group Policy Management Editor** go to **Computer configuration**. + +3. Select **Policies** then **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**, and then set **Allow security intelligence updates when running on battery power** to **Disabled**. Then select **OK**. + +This action prevents protection updates from downloading when the PC is on battery power. + +## Related articles + +- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) +- [Update and manage Microsoft Defender Antivirus in Windows 10](deploy-manage-report-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md new file mode 100644 index 0000000000..20a13881ec --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -0,0 +1,128 @@ +--- +title: Microsoft Defender Antivirus compatibility with other security products +description: What to expect from Microsoft Defender Antivirus with other security products and the operating systems you are using. +keywords: windows defender, next-generation, antivirus, compatibility, passive mode +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: tewchen, pahuijbr, shwjha +manager: dansimp +ms.date: 02/09/2021 +ms.technology: mde +--- + +# Microsoft Defender Antivirus compatibility + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +## Overview + +Microsoft Defender Antivirus is automatically enabled and installed on endpoints and devices that are running Windows 10. But what happens when another antivirus/antimalware solution is used? It depends on whether you're using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) together with your antivirus protection. +- If your organization's endpoints and devices are protected with a non-Microsoft antivirus/antimalware solution, and Microsoft Defender for Endpoint is not used, then Microsoft Defender Antivirus automatically goes into disabled mode. +- If your organization is using Microsoft Defender for Endpoint together with a non-Microsoft antivirus/antimalware solution, then Microsoft Defender Antivirus automatically goes into passive mode. (Real-time protection and threats are not remediated by Microsoft Defender Antivirus.) +- If your organization is using Microsoft Defender for Endpoint together with a non-Microsoft antivirus/antimalware solution, and you have [EDR in block mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode) enabled, then whenever a malicious artifact is detected, Microsoft Defender for Endpoint takes action to block and remediate the artifact. + +## Antivirus and Microsoft Defender for Endpoint + +The following table summarizes what happens with Microsoft Defender Antivirus when third-party antivirus products are used together or without Microsoft Defender for Endpoint. + + +| Windows version | Antimalware protection | Microsoft Defender for Endpoint enrollment | Microsoft Defender Antivirus state | +|------|------|-------|-------| +| Windows 10 | A third-party product that is not offered or developed by Microsoft | Yes | Passive mode | +| Windows 10 | A third-party product that is not offered or developed by Microsoft | No | Automatically disabled mode | +| Windows 10 | Microsoft Defender Antivirus | Yes | Active mode | +| Windows 10 | Microsoft Defender Antivirus | No | Active mode | +| Windows Server, version 1803 or newer, or Windows Server 2019 | A third-party product that is not offered or developed by Microsoft | Yes | Must be set to passive mode (manually) [[1](#fn1)] | +| Windows Server, version 1803 or newer, or Windows Server 2019 | A third-party product that is not offered or developed by Microsoft | No | Must be disabled (manually) [[2](#fn2)] | +| Windows Server, version 1803 or newer, or Windows Server 2019 | Microsoft Defender Antivirus | Yes | Active mode | +| Windows Server, version 1803 or newer, or Windows Server 2019 | Microsoft Defender Antivirus | No | Active mode | +| Windows Server 2016 | Microsoft Defender Antivirus | Yes | Active mode | +| Windows Server 2016 | Microsoft Defender Antivirus | No | Active mode | +| Windows Server 2016 | A third-party product that is not offered or developed by Microsoft | Yes | Must be disabled (manually) [[2](#fn2)] | +| Windows Server 2016 | A third-party product that is not offered or developed by Microsoft | No | Must be disabled (manually) [[2](#fn2)] | + +(1) On Windows Server, version 1803 or newer, or Windows Server 2019, Microsoft Defender Antivirus does not enter passive mode automatically when you install a non-Microsoft antivirus product. In those cases, [set Microsoft Defender Antivirus to passive mode](microsoft-defender-antivirus-on-windows-server-2016.md#need-to-set-microsoft-defender-antivirus-to-passive-mode) to prevent problems caused by having multiple antivirus products installed on a server. + +If you are using Windows Server, version 1803 or newer, or Windows Server 2019, you can set Microsoft Defender Antivirus to passive mode by setting the following registry key: +- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` +- Name: `ForceDefenderPassiveMode` +- Type: `REG_DWORD` +- Value: `1` + +> [!NOTE] +> The `ForceDefenderPassiveMode` registry key is not supported on Windows Server 2016. + +(2) On Windows Server 2016, Microsoft Defender Antivirus does not enter passive mode automatically when you install a non-Microsoft antivirus product. In addition, Microsoft Defender Antivirus is not supported in passive mode. In those cases, [disable/uninstall Microsoft Defender Antivirus manually](microsoft-defender-antivirus-on-windows-server-2016.md#are-you-using-windows-server-2016) to prevent problems caused by having multiple antivirus products installed on a server. + +See [Microsoft Defender Antivirus on Windows Server](microsoft-defender-antivirus-on-windows-server-2016.md) for key differences and management options for Windows Server installations. + +> [!IMPORTANT] +> Microsoft Defender Antivirus is only available on devices running Windows 10, Windows Server 2016, Windows Server, version 1803 or later, and Windows Server 2019. +> +> In Windows 8.1 and Windows Server 2012, enterprise-level endpoint antivirus protection is offered as [System Center Endpoint Protection](https://technet.microsoft.com/library/hh508760.aspx), which is managed through Microsoft Endpoint Configuration Manager. +> +> Windows Defender is also offered for [consumer devices on Windows 8.1 and Windows Server 2012](https://technet.microsoft.com/library/dn344918#BKMK_WindowsDefender), although it does not provide enterprise-level management (or an interface on Windows Server 2012 Server Core installations). + +## Functionality and features available in each state + +The table in this section summarizes the functionality and features that are available in each state. The table is designed to be informational only. It is intended to describe the features & capabilities that are actively working or not, according to whether Microsoft Defender Antivirus is in active mode, in passive mode, or is disabled/uninstalled. + +> [!IMPORTANT] +> Do not turn off capabilities, such as real-time protection, cloud-delivered protection, or limited periodic scanning, if you are using Microsoft Defender Antivirus in passive mode or you are using EDR in block mode. + +|Protection |Active mode |Passive mode |EDR in block mode |Disabled or uninstalled | +|:---|:---|:---|:---|:---| +| [Real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) and [cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) | Yes | No [[3](#fn3)] | No | No | +| [Limited periodic scanning availability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus) | No | No | No | Yes | +| [File scanning and detection information](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus) | Yes | Yes | Yes | No | +| [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | Yes | See note [[4](#fn4)] | Yes | No | +| [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) | Yes | Yes | Yes | No | + +(3) In general, when Microsoft Defender Antivirus is in passive mode, real-time protection does not provide any blocking or enforcement, even though it is enabled and in passive mode. + +(4) When Microsoft Defender Antivirus is in passive mode, threat remediation features are active only during scheduled or on-demand scans. + +> [!NOTE] +> [Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about) protection continues to operate normally when Microsoft Defender Antivirus is in active or passive mode. + +## Keep the following points in mind + +- In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the machine itself). + +- In passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are not remediated by Microsoft Defender Antivirus. Files are scanned and reports are provided for threat detections that are shared with the Microsoft Defender for Endpoint service. Therefore, you might encounter alerts in the Security Center console with Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in Passive mode. + +- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on and Microsoft Defender Antivirus is not the primary antivirus solution, it can still detect and remediate malicious items. + +- When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. Disabling/uninstalling Microsoft Defender Antivirus is not recommended in general; if possible, keep Microsoft Defender Antivirus in passive mode if you are using a non-Microsoft antimalware/antivirus solution. + +- If you are enrolled in Microsoft Defender for Endpoint and you are using a third-party antimalware product, then passive mode is enabled. [The service requires common information sharing from Microsoft Defender Antivirus service](../microsoft-defender-atp/defender-compatibility.md) in order to properly monitor your devices and network for intrusion attempts and attacks. + +- When Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the protection offered by a non-Microsoft antivirus product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. Automatic re-enabling helps to ensure that antivirus protection is maintained on your devices. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which uses the Microsoft Defender Antivirus engine to periodically check for threats in addition to your main antivirus app. + +- When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have an up-to-date, non-Microsoft antivirus product providing real-time protection from malware. + + If you uninstall the non-Microsoft antivirus product, and use Microsoft Defender Antivirus to provide protection to your devices, Microsoft Defender Antivirus will return to its normal active mode automatically. + +> [!WARNING] +> Do not disable, stop, or modify any of the associated services that are used by Microsoft Defender Antivirus, Microsoft Defender for Endpoint, or the Windows Security app. This recommendation includes the *wscsvc*, *SecurityHealthService*, *MsSense*, *Sense*, *WinDefend*, or *MsMpEng* services and processes. Manually modifying these services can cause severe instability on your devices and can make your network vulnerable. Disabling, stopping, or modifying those services can also cause problems when using non-Microsoft antivirus solutions and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md). + + +## See also + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Microsoft Defender Antivirus on Windows Server](microsoft-defender-antivirus-on-windows-server-2016.md) +- [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) +- [Configure Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure) +- [Address false positives/negatives in Microsoft Defender for Endpoint](../microsoft-defender-atp/defender-endpoint-false-positives-negatives.md) +- [Learn about Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md new file mode 100644 index 0000000000..63a22fd4f7 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md @@ -0,0 +1,61 @@ +--- +title: Next-generation protection in Windows 10, Windows Server 2016, and Windows Server 2019 +description: Learn how to manage, configure, and use Microsoft Defender Antivirus, built-in antimalware and antivirus protection. +keywords: Microsoft Defender Antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: denisebmsft +ms.author: deniseb +ms.date: 12/16/2020 +ms.reviewer: +manager: dansimp +ms.custom: nextgen +ms.technology: mde +--- + +# Next-generation protection in Windows + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +## Microsoft Defender Antivirus: Your next-generation protection + +Microsoft Defender Antivirus is the next-generation protection component of Microsoft Defender for Endpoint. This protection brings together machine learning, big-data analysis, in-depth threat resistance research, and the Microsoft cloud infrastructure to protect devices in your enterprise organization. Your next-generation protection services include the following capabilities: + +- [Behavior-based, heuristic, and real-time antivirus protection](configure-protection-features-microsoft-defender-antivirus.md), which includes always-on scanning using file and process behavior monitoring and other heuristics (also known as *real-time protection*). It also includes detecting and blocking apps that are deemed unsafe, but might not be detected as malware. +- [Cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md), which includes near-instant detection and blocking of new and emerging threats. +- [Dedicated protection and product updates](manage-updates-baselines-microsoft-defender-antivirus.md), which includes updates related to keeping Microsoft Defender Antivirus up to date. + +## Try a demo! + +Visit the [Microsoft Defender for Endpoint demo website](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following protection features are working and explore them using demo scenarios: +- Cloud-delivered protection +- Block at first sight (BAFS) protection +- Potentially unwanted applications (PUA) protection + +## Minimum system requirements + +Microsoft Defender Antivirus has the same hardware requirements as of Windows 10. For more information, see the following resources: + +- [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) +- [Hardware component guidelines](https://docs.microsoft.com/windows-hardware/design/component-guidelines/components) + +## Configure next-generation protection services + +For information on how to configure next-generation protection services, see [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md). + +> [!Note] +> Configuration and management is largely the same in Windows Server 2016 and Windows Server 2019, while running Microsoft Defender Antivirus; however, there are some differences. To learn more, see [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md). + +## See also + +- [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md) +- [Microsoft Defender Antivirus management and configuration](configuration-management-reference-microsoft-defender-antivirus.md) +- [Evaluate Microsoft Defender Antivirus protection](evaluate-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md new file mode 100644 index 0000000000..0f1c9bbc2f --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md @@ -0,0 +1,220 @@ +--- +title: Microsoft Defender Antivirus on Windows Server +description: Learn how to enable and configure Microsoft Defender Antivirus on Windows Server 2016 and Windows Server 2019. +keywords: windows defender, server, scep, system center endpoint protection, server 2016, current branch, server 2012 +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 01/21/2021 +ms.reviewer: pahuijbr, shwjha +manager: dansimp +ms.technology: mde +--- + +# Microsoft Defender Antivirus on Windows Server + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Antivirus is available on the following editions/versions of Windows Server: +- Windows Server 2019 +- Windows Server, version 1803 or later +- Windows Server 2016. + +In some instances, Microsoft Defender Antivirus is referred to as *Endpoint Protection*; however, the protection engine is the same. Although the functionality, configuration, and management are largely the same for [Microsoft Defender Antivirus on Windows 10](microsoft-defender-antivirus-in-windows-10.md), there are a few key differences on Windows Server: + +- In Windows Server, [automatic exclusions](configure-server-exclusions-microsoft-defender-antivirus.md) are applied based on your defined Server Role. +- In Windows Server, Microsoft Defender Antivirus does not automatically disable itself if you are running another antivirus product. + +## The process at a glance + +The process of setting up and running Microsoft Defender Antivirus on a server platform includes several steps: + +1. [Enable the interface](#enable-the-user-interface-on-windows-server). +2. [Install Microsoft Defender Antivirus](#install-microsoft-defender-antivirus-on-windows-server). +3. [Verify Microsoft Defender Antivirus is running](#verify-microsoft-defender-antivirus-is-running). +4. [Update your antimalware Security intelligence](#update-antimalware-security-intelligence). +5. (As needed) [Submit samples](#submit-samples). +6. (As needed) [Configure automatic exclusions](#configure-automatic-exclusions). +7. (Only if necessary) [Set Microsoft Defender Antivirus to passive mode](#need-to-set-microsoft-defender-antivirus-to-passive-mode). + +## Enable the user interface on Windows Server + +By default, Microsoft Defender Antivirus is installed and functional on Windows Server. The user interface (GUI) is installed by default on some SKUs, but is not required because you can use PowerShell or other methods to manage Microsoft Defender Antivirus. If the GUI is not installed on your server, you can add it by using the **Add Roles and Features** wizard, or by using PowerShell cmdlets. + +### Turn on the GUI using the Add Roles and Features Wizard + +1. See [Install roles, role services, and features by using the add Roles and Features Wizard](https://docs.microsoft.com/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#install-roles-role-services-and-features-by-using-the-add-roles-and-features-wizard), and use the **Add Roles and Features Wizard**. + +2. When you get to the **Features** step of the wizard, under **Windows Defender Features**, select the **GUI for Windows Defender** option. + + In Windows Server 2016, the **Add Roles and Features Wizard** looks like this: + + ![Add roles and feature wizard showing the GUI for Windows Defender option](images/server-add-gui.png) + + In Windows Server 2019, the **Add Roles and Feature Wizard** is similar. + +### Turn on the GUI using PowerShell + +The following PowerShell cmdlet will enable the interface: + +```PowerShell +Install-WindowsFeature -Name Windows-Defender-GUI +``` + +## Install Microsoft Defender Antivirus on Windows Server + +You can use either the **Add Roles and Features Wizard** or PowerShell to install Microsoft Defender Antivirus. + +### Use the Add Roles and Features Wizard + +1. Refer to [this article](https://docs.microsoft.com/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#install-roles-role-services-and-features-by-using-the-add-roles-and-features-wizard), and use the **Add Roles and Features Wizard**. + +2. When you get to the **Features** step of the wizard, select the Microsoft Defender Antivirus option. Also select the **GUI for Windows Defender** option. + +### Use PowerShell + +To use PowerShell to install Microsoft Defender Antivirus, run the following cmdlet: + +```PowerShell +Install-WindowsFeature -Name Windows-Defender +``` + +Event messages for the antimalware engine included with Microsoft Defender Antivirus can be found in [Microsoft Defender AV Events](troubleshoot-microsoft-defender-antivirus.md). + + +## Verify Microsoft Defender Antivirus is running + +To verify that Microsoft Defender Antivirus is running on your server, run the following PowerShell cmdlet: + +```PowerShell +Get-Service -Name windefend +``` + +To verify that firewall protection is turned on, run the following PowerShell cmdlet: + +```PowerShell +Get-Service -Name mpssvc +``` + +As an alternative to PowerShell, you can use Command Prompt to verify that Microsoft Defender Antivirus is running. To do that, run the following command from a command prompt: + +```console +sc query Windefend +``` + +The `sc query` command returns information about the Microsoft Defender Antivirus service. When Microsoft Defender Antivirus is running, the `STATE` value displays `RUNNING`. + +## Update antimalware Security intelligence + +To get updated antimalware security intelligence, you must have the Windows Update service running. If you use an update management service, like Windows Server Update Services (WSUS), make sure that updates for Microsoft Defender Antivirus Security intelligence are approved for the computers you manage. + +By default, Windows Update does not download and install updates automatically on Windows Server 2019 or Windows Server 2016. You can change this configuration by using one of the following methods: + + +|Method |Description | +|---------|---------| +|**Windows Update** in Control Panel |- **Install updates automatically** results in all updates being automatically installed, including Windows Defender Security intelligence updates.
    - **Download updates but let me choose whether to install them** allows Windows Defender to download and install Security intelligence updates automatically, but other updates are not automatically installed. | +|**Group Policy** | You can set up and manage Windows Update by using the settings available in Group Policy, in the following path: **Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates** | +|The **AUOptions** registry key |The following two values allow Windows Update to automatically download and install Security intelligence updates:
    - **4** - **Install updates automatically**. This value results in all updates being automatically installed, including Windows Defender Security intelligence updates.
    - **3** - **Download updates but let me choose whether to install them**. This value allows Windows Defender to download and install Security intelligence updates automatically, but other updates are not automatically installed. | + +To ensure that protection from malware is maintained, we recommend that you enable the following services: + +- Windows Error Reporting service + +- Windows Update service + +The following table lists the services for Microsoft Defender Antivirus and the dependent services. + +|Service Name|File Location|Description| +|--------|---------|--------| +|Windows Defender Service (WinDefend)|`C:\Program Files\Windows Defender\MsMpEng.exe`|This is the main Microsoft Defender Antivirus service that needs to be running at all times.| +|Windows Error Reporting Service (Wersvc)|`C:\WINDOWS\System32\svchost.exe -k WerSvcGroup`|This service sends error reports back to Microsoft.| +|Windows Defender Firewall (MpsSvc)|`C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork`|We recommend leaving the Windows Defender Firewall service enabled.| +|Windows Update (Wuauserv)|`C:\WINDOWS\system32\svchost.exe -k netsvcs`|Windows Update is needed to get Security intelligence updates and antimalware engine updates| + +## Submit samples + +Sample submission allows Microsoft to collect samples of potentially malicious software. To help provide continued and up-to-date protection, Microsoft researchers use these samples to analyze suspicious activities and produce updated antimalware Security intelligence. We collect program executable files, such as .exe files and .dll files. We do not collect files that contain personal data, like Microsoft Word documents and PDF files. + +### Submit a file + +1. Review the [submission guide](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide). + +2. Visit the [sample submission portal](https://www.microsoft.com/wdsi/filesubmission), and submit your file. + + +### Enable automatic sample submission + +To enable automatic sample submission, start a Windows PowerShell console as an administrator, and set the **SubmitSamplesConsent** value data according to one of the following settings: + +|Setting |Description | +|---------|---------| +|**0** - **Always prompt** |The Microsoft Defender Antivirus service prompts you to confirm submission of all required files. This is the default setting for Microsoft Defender Antivirus, but is not recommended for installations on Windows Server 2016 or 2019 without a GUI. | +|**1** - **Send safe samples automatically** |The Microsoft Defender Antivirus service sends all files marked as "safe" and prompts for the remainder of the files. | +|**2** - **Never send** |The Microsoft Defender Antivirus service does not prompt and does not send any files. | +|**3** - **Send all samples automatically** |The Microsoft Defender Antivirus service sends all files without a prompt for confirmation. | + +## Configure automatic exclusions + +To help ensure security and performance, certain exclusions are automatically added based on the roles and features you install when using Microsoft Defender Antivirus on Windows Server 2016 or 2019. + +See [Configure exclusions in Microsoft Defender Antivirus on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md). + +## Need to set Microsoft Defender Antivirus to passive mode? + +If you are using a non-Microsoft antivirus product as your primary antivirus solution, set Microsoft Defender Antivirus to passive mode. + +### Set Microsoft Defender Antivirus to passive mode using a registry key + +If you are using Windows Server, version 1803 or Windows Server 2019, you can set Microsoft Defender Antivirus to passive mode by setting the following registry key: +- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` +- Name: `ForceDefenderPassiveMode` +- Type: `REG_DWORD` +- Value: `1` + +### Disable Microsoft Defender Antivirus using the Remove Roles and Features wizard + +1. See [Install or Uninstall Roles, Role Services, or Features](https://docs.microsoft.com/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#remove-roles-role-services-and-features-by-using-the-remove-roles-and-features-wizard), and use the **Remove Roles and Features Wizard**. + +2. When you get to the **Features** step of the wizard, clear the **Windows Defender Features** option. + + If you clear **Windows Defender** by itself under the **Windows Defender Features** section, you will be prompted to remove the interface option **GUI for Windows Defender**. + + Microsoft Defender Antivirus will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature. + +### Turn off the Microsoft Defender Antivirus user interface using PowerShell + +To turn off the Microsoft Defender Antivirus GUI, use the following PowerShell cmdlet: + +```PowerShell +Uninstall-WindowsFeature -Name Windows-Defender-GUI +``` + +### Are you using Windows Server 2016? + +If you are using Windows Server 2016 and a third-party antimalware/antivirus product that is not offered or developed by Microsoft, you'll need to disable/uninstall Microsoft Defender Antivirus. + +> [!NOTE] +> You can't uninstall the Windows Security app, but you can disable the interface with these instructions. + +The following PowerShell cmdlet uninstalls Microsoft Defender Antivirus on Windows Server 2016: + +```PowerShell +Uninstall-WindowsFeature -Name Windows-Defender +``` + +## See also + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md) + + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md new file mode 100644 index 0000000000..b22545f7af --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md @@ -0,0 +1,140 @@ +--- +title: Microsoft Defender Offline in Windows 10 +description: You can use Microsoft Defender Offline straight from the Windows Defender Antivirus app. You can also manage how it is deployed in your network. +keywords: scan, defender, offline +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Run and review the results of a Microsoft Defender Offline scan + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Offline is an antimalware scanning tool that lets you boot and run a scan from a trusted environment. The scan runs from outside the normal Windows kernel so it can target malware that attempts to bypass the Windows shell, such as viruses and rootkits that infect or overwrite the master boot record (MBR). + +You can use Microsoft Defender Offline if you suspect a malware infection, or you want to confirm a thorough clean of the endpoint after a malware outbreak. + +In Windows 10, Microsoft Defender Offline can be run with one click directly from the [Windows Security app](microsoft-defender-security-center-antivirus.md). In previous versions of Windows, a user had to install Microsoft Defender Offline to bootable media, restart the endpoint, and load the bootable media. + +## prerequisites and requirements + +Microsoft Defender Offline in Windows 10 has the same hardware requirements as Windows 10. + +For more information about Windows 10 requirements, see the following topics: + +- [Minimum hardware requirements](https://msdn.microsoft.com/library/windows/hardware/dn915086(v=vs.85).aspx) + +- [Hardware component guidelines](https://msdn.microsoft.com/library/windows/hardware/dn915049(v=vs.85).aspx) + +> [!NOTE] +> Microsoft Defender Offline is not supported on machines with ARM processors, or on Windows Server Stock Keeping Units. + +To run Microsoft Defender Offline from the endpoint, the user must be logged in with administrator privileges. + +## Microsoft Defender Offline updates + +Microsoft Defender Offline uses the most recent protection updates available on the endpoint; it's updated whenever Windows Defender Antivirus is updated. + +> [!NOTE] +> Before running an offline scan, you should attempt to update Microsoft Defender AV protection. You can either force an update with Group Policy or however you normally deploy updates to endpoints, or you can manually download and install the latest protection updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx). + +See the [Manage Microsoft Defender Antivirus Security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) topic for more information. + +## Usage scenarios + +In Windows 10, version 1607, you can manually force an offline scan. Alternatively, if Windows Defender determines that Microsoft Defender Offline needs to run, it will prompt the user on the endpoint. + +The need to perform an offline scan will also be revealed in Microsoft Endpoint Manager if you're using it to manage your endpoints. + +The prompt can occur via a notification, similar to the following: + +![Windows notification showing the requirement to run Microsoft Defender Offline](images/defender/notification.png) + +The user will also be notified within the Windows Defender client. + +In Configuration Manager, you can identify the status of endpoints by navigating to **Monitoring > Overview > Security > Endpoint Protection Status > System Center Endpoint Protection Status**. + +Microsoft Defender Offline scans are indicated under **Malware remediation status** as **Offline scan required**. + +![Microsoft Endpoint Manager indicating a Microsoft Defender Offline scan is required](images/defender/sccm-wdo.png) + +## Configure notifications + + +Microsoft Defender Offline notifications are configured in the same policy setting as other Microsoft Defender AV notifications. + +For more information about notifications in Windows Defender, see the [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) topic. + +## Run a scan + +> [!IMPORTANT] +> Before you use Microsoft Defender Offline, make sure you save any files and shut down running programs. The Microsoft Defender Offline scan takes about 15 minutes to run. It will restart the endpoint when the scan is complete. The scan is performed outside of the usual Windows operating environment. The user interface will appear different to a normal scan performed by Windows Defender. After the scan is completed, the endpoint will be restarted and Windows will load normally. + +You can run a Microsoft Defender Offline scan with the following: + +- PowerShell +- Windows Management Instrumentation (WMI) +- The Windows Security app + + + +### Use PowerShell cmdlets to run an offline scan + +Use the following cmdlets: + +```PowerShell +Start-MpWDOScan +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/library/dn433280.aspx) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Use Windows Management Instruction (WMI) to run an offline scan + +Use the [**MSFT_MpWDOScan**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class to run an offline scan. + +The following WMI script snippet will immediately run a Microsoft Defender Offline scan, which will cause the endpoint to restart, run the offline scan, and then restart and boot into Windows. + +```console +wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpWDOScan call Start +``` + +See the following for more information: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + + +### Use the Windows Defender Security app to run an offline scan + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Advanced scan** label: + +3. Select **Microsoft Defender Offline scan** and click **Scan now**. + + > [!NOTE] + > In Windows 10, version 1607, the offline scan could be run from under **Windows Settings** > **Update & security** > **Windows Defender** or from the Windows Defender client. + + +## Review scan results + +Microsoft Defender Offline scan results will be listed in the [Scan history section of the Windows Security app](microsoft-defender-security-center-antivirus.md#detection-history). + + +## Related articles + +- [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md new file mode 100644 index 0000000000..81bb63ed13 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md @@ -0,0 +1,147 @@ +--- +title: Microsoft Defender Antivirus in the Windows Security app +description: With Microsoft Defender AV now included in the Windows Security app, you can review, compare, and perform common tasks. +keywords: wdav, antivirus, firewall, security, windows +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Microsoft Defender Antivirus in the Windows Security app + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +In Windows 10, version 1703 and later, the Windows Defender app is part of the Windows Security. + +Settings that were previously part of the Windows Defender client and main Windows Settings have been combined and moved to the new app, which is installed by default as part of Windows 10, version 1703. + +> [!IMPORTANT] +> Disabling the Windows Security Center service does not disable Microsoft Defender Antivirus or [Windows Defender Firewall](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date. +> If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app might display stale or inaccurate information about any antivirus or firewall products you have installed on the device. +> It might also prevent Microsoft Defender Antivirus from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you might have previously installed. +> This will significantly lower the protection of your device and could lead to malware infection. + +See the [Windows Security article](/windows/threat-protection/windows-defender-security-center/windows-defender-security-center) for more information on other Windows security features that can be monitored in the app. + +The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal that is used to review and manage [Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md). + +## Review virus and threat protection settings in the Windows Security app + +![Screenshot of the Virus & threat protection settings label in the Windows Security app](images/defender/wdav-protection-settings-wdsc.png) + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). + +## Comparison of settings and functions of the old app and the new app + +All of the previous functions and settings from the Windows Defender app (in versions of Windows 10 before version 1703) are now found in the new Windows Security app. Settings that were previously located in Windows Settings under **Update & security** > **Windows Defender** are also now in the new app. + +The following diagrams compare the location of settings and functions between the old and new apps: + +![Version of Windows Defender in Windows 10 before version 1703](images/defender/wdav-windows-defender-app-old.png) + +![Microsoft Defender Antivirus in Windows 10, version 1703 and later](images/defender/wdav-wdsc.png) + +| Item | Windows 10, before version 1703 | Windows 10, version 1703 and later | Description | +|:---|:---|:---|:---| +| 1 | **Update** tab | **Protection updates** | Update the protection (Security intelligence) | +| 2 | **History** tab | **Scan history** | Review threats that were quarantined, removed, or allowed | +| 3 | **Settings** (links to **Windows Settings**) | **Virus & threat protection settings** | Enable various features, including Real-time protection, Cloud-delivered protection, Advanced notifications, and Automatic ample submission | +| 4 | **Scan options** | **Advanced scan** | Run a full scan, custom scan, or a Microsoft Defender Antivirus Offline scan | +| 5 | Run a scan (based on the option chosen under **Scan options** | **Quick scan** | In Windows 10, version 1703 and later, you can run custom and full scans under the **Advanced scan** option | + +## Common tasks + +This section describes how to perform some of the most common tasks when reviewing or interacting with the threat protection provided by Microsoft Defender Antivirus in the Windows Security app. + +> [!NOTE] +> If these settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. The [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) topic describes how local policy override settings can be configured. + + + +### Run a scan with the Windows Security app + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). +3. Select **Scan now**. +4. Select **Run a new advanced scan** to specify different types of scans, such as a full scan. + + + +### Review the security intelligence update version and download the latest updates in the Windows Security app + +![Security intelligence version number information](images/defender/wdav-wdsc-defs.png) + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). +3. Select **Virus & threat protection updates**. The currently installed version is displayed along with some information about when it was downloaded. You can check this against the latest version available for manual download, or review the change log for that version. +4. Select **Check for updates** to download new protection updates (if there are any). + +### Ensure Microsoft Defender Antivirus is enabled in the Windows Security app + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). +3. Select **Virus & threat protection settings**. +4. Toggle the **Real-time protection** switch to **On**. + + > [!NOTE] + > If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats. + > If you install another antivirus product, Microsoft Defender Antivirus automatically disables itself and is indicated as such in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md). + + + +### Add exclusions for Microsoft Defender Antivirus in the Windows Security app + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). +3. Under the **Manage settings**, select **Virus & threat protection settings**. +4. Under the **Exclusions** setting, select **Add or remove exclusions**. +5. Select the plus icon (**+**) to choose the type and set the options for each exclusion. + + +The following table summarizes exclusion types and what happens: + +|Exclusion type |Defined by |What happens | +|---------|---------|---------| +|**File** |Location
    Example: `c:\sample\sample.test` |The specific file is skipped by Microsoft Defender Antivirus. | +|**Folder** |Location
    Example: `c:\test\sample` |All items in the specified folder are skipped by Microsoft Defender Antivirus. | +|**File type** |File extension
    Example: `.test` |All files with the `.test` extension anywhere on your device are skipped by Microsoft Defender Antivirus. | +|**Process** |Executable file path
    Example: `c:\test\process.exe` |The specific process and any files that are opened by that process are skipped by Microsoft Defender Antivirus. | + +To learn more, see the following resources: +- [Configure and validate exclusions based on file extension and folder location](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus) +- [Configure exclusions for files opened by processes](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus) + +### Review threat detection history in the Windows Defender Security Center app + +1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). +3. Select **Threat history** +4. Select **See full history** under each of the categories (**Current threats**, **Quarantined threats**, **Allowed threats**). + + + +### Set ransomware protection and recovery options + +1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). +3. Select **Ransomware protection**. +4. To change Controlled folder access settings, see [Protect important folders with Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard). +5. To set up ransomware recovery options, select **Set up** under **Ransomware data recovery** and follow the instructions for linking or setting up your OneDrive account so you can easily recover from a ransomware attack. + +## See also +- [Microsoft Defender Antivirus](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..7f35ddf666 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md @@ -0,0 +1,90 @@ +--- +title: Better together - Microsoft Defender Antivirus and Office 365 (including OneDrive) - better protection from ransomware and cyberthreats +description: Office 365, which includes OneDrive, goes together wonderfully with Microsoft Defender Antivirus. Read this article to learn more. +keywords: windows defender, antivirus, office 365, onedrive, restore, ransomware +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.topic: article +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 03/04/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Better together: Microsoft Defender Antivirus and Office 365 + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- Microsoft Defender Antivirus +- Microsoft 365 + +You might already know that: + +- **Microsoft Defender Antivirus protects your Windows 10 device from software threats, such as viruses, malware, and spyware**. Microsoft Defender Antivirus is your complete, ongoing protection, built into Windows 10 and ready to go. [Microsoft Defender Antivirus is your next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). + +- **Office 365 includes antiphishing, antispam, and antimalware protection**. With your Office 365 subscription, you get premium email and calendars, Office apps, 1 TB of cloud storage (via OneDrive), and advanced security across all your devices. This is true for home and business users. And if you're a business user, and your organization is using Office 365 E5, you get even more protection through Microsoft Defender for Office 365 [Protect against threats with Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/protect-against-threats). + +- **OneDrive, included in Office 365, enables you to store your files and folders online, and share them as you see fit**. You can work together with people (for work or fun), and coauthor files that are stored in OneDrive. You can also access your files across all your devices (your PC, phone, and tablet). [Manage sharing in OneDrive](https://docs.microsoft.com/OneDrive/manage-sharing). + +**But did you know there are good security reasons to use Microsoft Defender Antivirus together with Office 365**? Here are two: + + 1. [You get ransomware protection and recovery](#ransomware-protection-and-recovery). + + 2. [Integration means better protection](#integration-means-better-protection). + +Read the following sections to learn more. + +## Ransomware protection and recovery + +When you save your files to [OneDrive](https://docs.microsoft.com/onedrive), and [Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) detects a ransomware threat on your device, the following things occur: + +1. **You are told about the threat**. (If your organization is using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection), your security operations team is notified, too.) + +2. **Microsoft Defender Antivirus helps you (and your organization's security team) remove the ransomware** from your device(s). (If your organization is using Microsoft Defender for Endpoint, your security operations team can determine whether other devices are infected and take appropriate action, too.) + +3. **You get the option to recover your files in OneDrive**. With the OneDrive Files Restore feature, you can recover your files in OneDrive to the state they were in before the ransomware attack occurred. See [Ransomware detection and recovering your files](https://support.office.com/article/0d90ec50-6bfd-40f4-acc7-b8c12c73637f). + +Think of the time and hassle this can save. + +## Integration means better protection + +Microsoft Defender for Office 365 integrated with Microsoft Defender for Endpoint means better protection for your organization. Here's how: + +- [Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp) safeguards your organization against malicious threats posed in email messages, email attachments, and links (URLs) in Office documents. + + AND + +- [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) protects your devices from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves your security posture. + + SO + +- Once integration is enabled, your security operations team can see a list of devices that are used by the recipients of any detected URLs or email messages, along with recent alerts for those devices, in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). + +If you haven't already done so, [integrate Microsoft Defender for Office 365 with Microsoft Defender for Endpoint](https://docs.microsoft.com/microsoft-365/security/office-365-security/integrate-office-365-ti-with-wdatp). + +## More good reasons to use OneDrive + +Protection from ransomware is one great reason to put your files in OneDrive. And there are several more good reasons, summarized in this video:

    + +> [!VIDEO https://www.microsoft.com/videoplayer/embed/70b4d256-46fb-481f-ad9b-921ef5fd7bed] + +## Want to learn more? + +[OneDrive](https://docs.microsoft.com/onedrive) + +[Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp?view=o365-worldwide) + +[Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/) + + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md new file mode 100644 index 0000000000..e7286a1d8b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -0,0 +1,270 @@ +--- +title: Protect security settings with tamper protection +ms.reviewer: shwjha, hayhov +manager: dansimp +description: Use tamper protection to prevent malicious apps from changing important security settings. +keywords: malware, defender, antivirus, tamper protection +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +audience: ITPro +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 02/16/2021 +ms.technology: mde +--- + +# Protect security settings with tamper protection + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Tamper protection is available for devices that are running one of the following versions of Windows: + +- Windows 10 +- Windows Server 2019 +- Windows Server, version 1803 or later +- Windows Server 2016 + +## Overview + +During some kinds of cyber attacks, bad actors try to disable security features, such as anti-virus protection, on your machines. Bad actors like to disable your security features to get easier access to your data, to install malware, or to otherwise exploit your data, identity, and devices. Tamper protection helps prevent these kinds of things from occurring. + +With tamper protection, malicious apps are prevented from taking actions such as: + +- Disabling virus and threat protection +- Disabling real-time protection +- Turning off behavior monitoring +- Disabling antivirus (such as IOfficeAntivirus (IOAV)) +- Disabling cloud-delivered protection +- Removing security intelligence updates + +### How it works + +Tamper protection essentially locks Microsoft Defender Antivirus and prevents your security settings from being changed through apps and methods such as: + +- Configuring settings in Registry Editor on your Windows device +- Changing settings through PowerShell cmdlets +- Editing or removing security settings through group policies + +Tamper protection doesn't prevent you from viewing your security settings. And, tamper protection doesn't affect how third-party antivirus apps register with the Windows Security app. If your organization is using Windows 10 Enterprise E5, individual users can't change the tamper protection setting; in those cases, tamper protection is managed by your security team. + +### What do you want to do? + +| To perform this task... | See this section... | +|:---|:---| +| Turn tamper protection on (or off) for an individual device | [Manage tamper protection on an individual device](#manage-tamper-protection-on-an-individual-device) | +| Turn tamper protection on (or off) for all or part of your organization with Intune

    Fine-tune tamper protection settings in your organization | [Manage tamper protection for your organization using Intune](#manage-tamper-protection-for-your-organization-using-intune) | +| Turn tamper protection on (or off) for your organization with Configuration Manager | [Manage tamper protection for your organization with Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006) | +| Turn tamper protection on in the Microsoft Defender Security Center

    Manage tamper protection across your tenant | [Manage tamper protection for your organization using the Microsoft Defender Security Center](#manage-tamper-protection-for-your-organization-using-the-microsoft-defender-security-center) | +| View details about tampering attempts on devices | [View information about tampering attempts](#view-information-about-tampering-attempts) | +| Review your security recommendations | [Review security recommendations](#review-your-security-recommendations) | +| Review the list of frequently asked questions (FAQs) | [Browse the FAQs](#view-information-about-tampering-attempts) | + +## Manage tamper protection on an individual device + +> [!NOTE] +> Tamper protection blocks attempts to modify Microsoft Defender Antivirus settings through the registry. +> +> To help ensure that tamper protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. (See [Security intelligence updates](https://www.microsoft.com/wdsi/definitions).) +> +> Once you’ve made this update, tamper protection continues to protect your registry settings, and logs attempts to modify them without returning errors. + +If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to manage tamper protection. You must have appropriate admin permissions on your device to do change security settings, such as tamper protection. + +Here's what you see in the Windows Security app: + +![Tamper protection turned on in Windows 10 Home](images/tamperprotectionturnedon.png) + +1. Select **Start**, and start typing *Security*. In the search results, select **Windows Security**. +2. Select **Virus & threat protection** > **Virus & threat protection settings**. +3. Set **Tamper Protection** to **On** or **Off**. + +## Manage tamper protection for your organization using Intune + +If you are part of your organization's security team, and your subscription includes [Intune](https://docs.microsoft.com/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) portal. Use Intune when you want to fine-tune tamper protection settings. For example, if you want to enable tamper protection on some devices, but not all, use Intune. + +### Requirements for managing tamper protection in Intune + +- You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations. +- Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; Intune is included in Microsoft 365 E5.) +- Your Windows devices must be running Windows 10 OS [1709](https://docs.microsoft.com/windows/release-health/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-health/status-windows-10-1809-and-windows-server-2019) or later. (For more information about releases, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information).) +- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above). +- Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) + +### Turn tamper protection on (or off) in Intune + +![Turn tamper protection on with Intune](images/turnontamperprotect-MEM.png) + +1. Go to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) and sign in with your work or school account. +2. Select **Devices** > **Configuration Profiles**. +3. Create a profile that includes the following settings: + - **Platform: Windows 10 and later** + - **Profile type: Endpoint protection** + - **Category: Microsoft Defender Security Center** + - **Tamper Protection: Enabled** +4. Assign the profile to one or more groups. + +### Are you using Windows OS 1709, 1803, or 1809? + +If you are using Windows 10 OS [1709](https://docs.microsoft.com/windows/release-health/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803), or [1809](https://docs.microsoft.com/windows/release-health/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. In this case, you can use PowerShell to determine whether tamper protection is enabled. + +#### Use PowerShell to determine whether tamper protection is turned on + +1. Open the Windows PowerShell app. +2. Use the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) PowerShell cmdlet. +3. In the list of results, look for `IsTamperProtected`. (A value of *true* means tamper protection is enabled.) + +## Manage tamper protection for your organization with Configuration Manager, version 2006 + +> [!IMPORTANT] +> The procedure can be used to extend tamper protection to devices running Windows 10 and Windows Server 2019. Make sure to review the prerequisites and other information in the resources mentioned in this procedure. + +If you're using [version 2006 of Configuration Manager](https://docs.microsoft.com/mem/configmgr/core/plan-design/changes/whats-new-in-version-2006), you can manage tamper protection settings on Windows 10, Windows Server 2016, and Windows Server 2019 by using a method called *tenant attach*. Tenant attach enables you to sync your on-premises-only Configuration Manager devices into the Microsoft Endpoint Manager admin center, and then deliver endpoint security configuration policies to on-premises collections & devices. + +![Windows security experience in Endpoint Manager](images/win-security- exp-policy-endpt-security.png) + +1. Set up tenant attach. See [Microsoft Endpoint Manager tenant attach: Device sync and device actions](https://docs.microsoft.com/mem/configmgr/tenant-attach/device-sync-actions). +2. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** > **Antivirus**, and choose **+ Create Policy**.
    + - In the **Platform** list, select **Windows 10 and Windows Server (ConfigMgr)**. + - In the **Profile** list, select **Windows Security experience (preview)**.
    +3. Deploy the policy to your device collection. + +### Need help with this? + +See the following resources: + +- [Settings for the Windows Security experience profile in Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/antivirus-security-experience-windows-settings) +- [Tech Community Blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin) + +## Manage tamper protection for your organization using the Microsoft Defender Security Center + +Currently in preview, tamper protection can be turned on or off in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). Here are a few points to keep in mind: + +- When you use the Microsoft Defender Security Center to manage tamper protection, you do not have to use Intune or the tenant attach method. +- When you manage tamper protection in the Microsoft Defender Security Center, the setting is applied tenant wide, affecting all of your devices that are running Windows 10. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Intune](#manage-tamper-protection-for-your-organization-using-intune) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006). +- If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft Defender Security Center. +- Tamper protection is generally available; however, the ability to manage tamper protection in the Microsoft Defender Security Center is currently in preview. + +### Requirements for managing tamper protection in the Microsoft Defender Security Center + +- You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations. +- Your Windows devices must be running one of the following versions of Windows: + - Windows 10 + - [Windows Server 2019](/windows-server/get-started-19/whats-new-19) + - Windows Server, version [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803) or later + - [Windows Server 2016](/windows-server/get-started/whats-new-in-windows-server-2016) + - For more information about releases, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information). +- Your devices must be [onboarded to Microsoft Defender for Endpoint](../microsoft-defender-atp/onboarding.md). +- Your devices must be using anti-malware platform version 4.18.2010.7 (or above) and anti-malware engine version 1.1.17600.5 (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) +- [Cloud-delivered protection must be turned on](enable-cloud-protection-microsoft-defender-antivirus.md). + +### Turn tamper protection on (or off) in the Microsoft Defender Security Center + +![Turn tamper protection on in the Microsoft Defender Security Center](images/mde-turn-tamperprotect-on.png) + +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +2. Choose **Settings**. +3. Go to **General** > **Advanced features**, and then turn tamper protection on. + +## View information about tampering attempts + +Tampering attempts typically indicate bigger cyberattacks. Bad actors try to change security settings as a way to persist and stay undetected. If you're part of your organization's security team, you can view information about such attempts, and then take appropriate actions to mitigate threats. + +When a tampering attempt is detected, an alert is raised in the [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/portal-overview) ([https://securitycenter.windows.com](https://securitycenter.windows.com)). + +![Microsoft Defender Security Center](images/tamperattemptalert.png) + +Using [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) and [advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview) capabilities in Microsoft Defender for Endpoint, your security operations team can investigate and address such attempts. + +## Review your security recommendations + +Tamper protection integrates with [Threat & Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) capabilities. [Security recommendations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) include making sure tamper protection is turned on. For example, you can search on *tamper*, as shown in the following image: + +![Tamper protection results in security recommendations](../images/securityrecs-tamperprotect.jpg) + +In the results, you can select **Turn on Tamper Protection** to learn more and turn it on. + +![Turn on tamper protection](images/tamperprotectsecurityrecos.png) + +To learn more about Threat & Vulnerability Management, see [Threat & Vulnerability Management in Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights#threat--vulnerability-management-in-microsoft-defender-security-center). + +## Frequently asked questions + +### To which Windows OS versions is configuring tamper protection is applicable? + +Windows 10 OS [1709](https://docs.microsoft.com/windows/release-health/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later together with [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp). + +If you are using Configuration Manager, version 2006, with tenant attach, tamper protection can be extended to Windows Server 2019. See [Tenant attach: Create and deploy endpoint security Antivirus policy from the admin center (preview)](https://docs.microsoft.com/mem/configmgr/tenant-attach/deploy-antivirus-policy). + +### Will tamper protection have any impact on third-party antivirus registration? + +No. Third-party antivirus offerings will continue to register with the Windows Security application. + +### What happens if Microsoft Defender Antivirus is not active on a device? + +Devices that are onboarded to Microsoft Defender for Endpoint will have Microsoft Defender Antivirus running in passive mode. Tamper protection will continue to protect the service and its features. + +### How can I turn tamper protection on/off? + +If you are a home user, see [Manage tamper protection on an individual device](#manage-tamper-protection-on-an-individual-device). + +If you are an organization using [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), you should be able to manage tamper protection in Intune similar to how you manage other endpoint protection features. See the following sections of this article: + +- [Manage tamper protection using Intune](#manage-tamper-protection-for-your-organization-using-intune) +- [Manage tamper protection using Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006) +- [Manage tamper protection using the Microsoft Defender Security Center](#manage-tamper-protection-for-your-organization-using-the-microsoft-defender-security-center) (currently in preview) + +### How does configuring tamper protection in Intune affect how I manage Microsoft Defender Antivirus through my group policy? + +Your regular group policy doesn’t apply to tamper protection, and changes to Microsoft Defender Antivirus settings are ignored when tamper protection is on. + +### For Microsoft Defender for Endpoint, is configuring tamper protection in Intune targeted to the entire organization only? + +Configuring tamper protection in Intune or Microsoft Endpoint Manager can be targeted to your entire organization and to specific devices and user groups. + +### Can I configure Tamper Protection in Microsoft Endpoint Configuration Manager? + +If you are using tenant attach, you can use Microsoft Endpoint Configuration Manager. See the following resources: +- [Manage tamper protection for your organization with Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006) +- [Tech Community blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin) + +### I have the Windows E3 enrollment. Can I use configuring tamper protection in Intune? + +Currently, configuring tamper protection in Intune is only available for customers who have [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp). + +### What happens if I try to change Microsoft Defender for Endpoint settings in Intune, Microsoft Endpoint Configuration Manager, and Windows Management Instrumentation when Tamper Protection is enabled on a device? + +You won’t be able to change the features that are protected by tamper protection; such change requests are ignored. + +### I’m an enterprise customer. Can local admins change tamper protection on their devices? + +No. Local admins cannot change or modify tamper protection settings. + +### What happens if my device is onboarded with Microsoft Defender for Endpoint and then goes into an off-boarded state? + +If a device is off-boarded from Microsoft Defender for Endpoint, tamper protection is turned on, which is the default state for unmanaged devices. + +### Will there be an alert about tamper protection status changing in the Microsoft Defender Security Center? + +Yes. The alert is shown in [https://securitycenter.microsoft.com](https://securitycenter.microsoft.com) under **Alerts**. + +Your security operations team can also use hunting queries, such as the following example: + +`DeviceAlertEvents | where Title == "Tamper Protection bypass"` + +[View information about tampering attempts](#view-information-about-tampering-attempts). + +## See also + +- [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/intune/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) +- [Get an overview of Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) +- [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..93d033b274 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md @@ -0,0 +1,89 @@ +--- +title: Hide the Microsoft Defender Antivirus interface +description: You can hide virus and threat protection tile in the Windows Security app. +keywords: ui lockdown, headless mode, hide app, hide settings, hide interface +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can use Group Policy to prevent users on endpoints from seeing the Microsoft Defender Antivirus interface. You can also prevent them from pausing scans. + +## Hide the Microsoft Defender Antivirus interface + +In Windows 10, versions 1703, hiding the interface will hide Microsoft Defender Antivirus notifications and prevent the Virus & threat protection tile from appearing in the Windows Security app. + +With the setting set to **Enabled**: + +![Screenshot of Windows Security without the shield icon and virus and threat protection section](images/defender/wdav-headless-mode-1703.png) + +With the setting set to **Disabled** or not configured: + +![Screenshot of Windows Security showing the shield icon and virus and threat protection section](images/defender/wdav-headless-mode-off-1703.png) + +>[!NOTE] +>Hiding the interface will also prevent Microsoft Defender Antivirus notifications from appearing on the endpoint. Microsoft Defender for Endpoint notifications will still appear. You can also individually [configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) + +In earlier versions of Windows 10, the setting will hide the Windows Defender client interface. If the user attempts to open it, they will receive a warning that says, "Your system administrator has restricted access to this app." + +![Warning message when headless mode is enabled in Windows 10, versions earlier than 1703](images/defender/wdav-headless-mode-1607.png) + +## Use Group Policy to hide the Microsoft Defender AV interface from users + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. + +2. Using the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Administrative templates**. + +4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Client interface**. + +5. Double-click the **Enable headless UI mode** setting and set the option to **Enabled**. Click **OK**. + +See [Prevent users from locally modifying policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) for more options on preventing users form modifying protection on their PCs. + +## Prevent users from pausing a scan + +You can prevent users from pausing scans, which can be helpful to ensure scheduled or on-demand scans are not interrupted by users. + +> [!NOTE] +> This setting is not supported on Windows 10. + +### Use Group Policy to prevent users from pausing a scan + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. + +2. Using the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Scan**. + +5. Double-click the **Allow users to pause scan** setting and set the option to **Disabled**. Click **OK**. + +## Related articles + +- [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) + +- [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..f6c46b93b9 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md @@ -0,0 +1,49 @@ +--- +title: Monitor and report on Microsoft Defender Antivirus protection +description: Use Configuration Manager or security information and event management (SIEM) tools to consume reports, and monitor Microsoft Defender AV with PowerShell and WMI. +keywords: siem, monitor, report, Microsoft Defender AV +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 12/07/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Report on Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Antivirus is built into Windows 10, Windows Server 2019, and Windows Server 2016. Microsoft Defender Antivirus is of your next-generation protection in Microsoft Defender for Endpoint. Next-generation protection helps protect your devices from software threats like viruses, malware, and spyware across email, apps, the cloud, and the web. + +With Microsoft Defender Antivirus, you have several options for reviewing protection status and alerts. You can use Microsoft Endpoint Manager to [monitor Microsoft Defender Antivirus](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-configure-alerts). Or, you can monitor protection using [Microsoft Intune](https://docs.microsoft.com/intune/introduction-intune). + +Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key Microsoft Defender Antivirus issues, including protection updates and real-time protection settings. + +If you have a third-party security information and event management (SIEM) server, you can also consume [Windows Defender client events](https://msdn.microsoft.com/library/windows/desktop/aa964766(v=vs.85).aspx). + +Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](https://technet.microsoft.com/library/mt431757.aspx), also see the [Security auditing](/windows/device-security/auditing/security-auditing-overview) topic) and [Windows Defender events](troubleshoot-microsoft-defender-antivirus.md). + +These events can be centrally aggregated using the [Windows event collector](https://msdn.microsoft.com/library/windows/desktop/bb427443(v=vs.85).aspx). Often, SIEM servers have connectors for Windows events, allowing you to correlate all security events in your SIEM server. + +You can also [monitor malware events using the Malware Assessment solution in Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-malware). + +For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, see the [(Deployment, management, and reporting options table)](deploy-manage-report-microsoft-defender-antivirus.md#ref2). + +## Related articles + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Microsoft Defender Antivirus on Windows Server 2016 and 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016) +- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..e3f5c1f0fe --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md @@ -0,0 +1,46 @@ +--- +title: Restore quarantined files in Microsoft Defender AV +description: You can restore files and folders that were quarantined by Microsoft Defender AV. +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 05/20/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Restore quarantined files in Microsoft Defender AV + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +If Microsoft Defender Antivirus is configured to detect and remediate threats on your device, Microsoft Defender Antivirus quarantines suspicious files. If you are certain a quarantined file is not a threat, you can restore it. + +1. Open **Windows Security**. +2. Select **Virus & threat protection** and then click **Protection history**. +3. In the list of all recent items, filter on **Quarantined Items**. +4. Select an item you want to keep, and take an action, such as restore. + +> [!TIP] +> Restoring a file from quarantine can also be done using Command Prompt. See [Restore a file from quarantine](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts#restore-file-from-quarantine). + +## Related articles + +- [Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) +- [Review scan results](review-scan-results-microsoft-defender-antivirus.md) +- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) +- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..4168fb1d63 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md @@ -0,0 +1,66 @@ +--- +title: Review the results of Microsoft Defender AV scans +description: Review the results of scans using Microsoft Endpoint Configuration Manager, Microsoft Intune, or the Windows Security app +keywords: scan results, remediation, full scan, quick scan +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/28/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Review Microsoft Defender Antivirus scan results + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +After a Microsoft Defender Antivirus scan completes, whether it is an [on-demand](run-scan-microsoft-defender-antivirus.md) or [scheduled scan](scheduled-catch-up-scans-microsoft-defender-antivirus.md), the results are recorded and you can view the results. + + +## Use Configuration Manager to review scan results + +See [How to monitor Endpoint Protection status](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). + +## Use PowerShell cmdlets to review scan results + +The following cmdlet will return each detection on the endpoint. If there are multiple detections of the same threat, each detection will be listed separately, based on the time of each detection: + +```PowerShell +Get-MpThreatDetection +``` + +![screenshot of PowerShell cmdlets and outputs](images/defender/wdav-get-mpthreatdetection.png) + +You can specify `-ThreatID` to limit the output to only show the detections for a specific threat. + +If you want to list threat detections, but combine detections of the same threat into a single item, you can use the following cmdlet: + +```PowerShell +Get-MpThreat +``` + +![screenshot of PowerShell](images/defender/wdav-get-mpthreat.png) + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +## Use Windows Management Instruction (WMI) to review scan results + +Use the [**Get** method of the **MSFT_MpThreat** and **MSFT_MpThreatDetection**](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) classes. + + +## Related articles + +- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..5a65b6a165 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md @@ -0,0 +1,98 @@ +--- +title: Run and customize on-demand scans in Microsoft Defender AV +description: Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Security app +keywords: scan, on-demand, dos, intune, instant scan +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 11/13/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Configure and run on-demand Microsoft Defender Antivirus scans + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can run an on-demand scan on individual endpoints. These scans will start immediately, and you can define parameters for the scan, such as the location or type. + +## Quick scan versus full scan + +Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. + +> [!IMPORTANT] +> Microsoft Defender Antivirus runs in the context of the [LocalSystem](https://docs.microsoft.com/windows/win32/services/localsystem-account) account when performing a local scan. For network scans, it uses the context of the device account. If the domain device account doesn't have appropriate permissions to access the share, the scan won't work. Ensure that the device has permissions to the access network share. + +Combined with [always-on real-time protection capability](configure-real-time-protection-microsoft-defender-antivirus.md)--which reviews files when they're opened and closed, and whenever a user navigates to a folder--a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. + +In most instances, a quick scan is adequate to find malware that wasn't picked up by real-time protection. + +A full scan can be useful on endpoints that have reported a malware threat. The scan can identify if there are any inactive components that require a more thorough clean-up. This is ideal if your organization is running on-demand scans. + +> [!NOTE] +> By default, quick scans run on mounted removable devices, such as USB drives. + +## Use Microsoft Endpoint Manager to run a scan + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. +2. Choose **Endpoint security** > **Antivirus**. +3. In the list of tabs, select **Windows 10 unhealthy endpoints**. +4. From the list of actions provided, select **Quick Scan** or **Full Scan**. + +[ ![IMAGE](images/mem-antivirus-scan-on-demand.png) ](images/mem-antivirus-scan-on-demand.png#lightbox) + +> [!TIP] +> For more information about using Microsoft Endpoint Manager to run a scan, see [Antimalware and firewall tasks: How to perform an on-demand scan](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers). + +## Use the mpcmdrun.exe command-line utility to run a scan + +Use the following `-scan` parameter: + +```console +mpcmdrun.exe -scan -scantype 1 +``` + +For more information about how to use the tool and additional parameters, including starting a full scan, or defining paths, see [Use the mpcmdrun.exe commandline tool to configure and manage Microsoft Defender Antivirus](command-line-arguments-microsoft-defender-antivirus.md). + +## Use Microsoft Intune to run a scan + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. +2. From the sidebar, select **Devices > All Devices** and choose the device you want to scan. +3. Select **...More**. From the options, select **Quick Scan** or **Full Scan**. + +## Use the Windows Security app to run a scan + +See [Run a scan in the Windows Security app](microsoft-defender-security-center-antivirus.md#scan) for instructions on running a scan on individual endpoints. + +## Use PowerShell cmdlets to run a scan + +Use the following cmdlet: + +```PowerShell +Start-MpScan +``` + +For more information on how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index). + +## Use Windows Management Instruction (WMI) to run a scan + +Use the [**Start** method](https://docs.microsoft.com/previous-versions/windows/desktop/defender/start-msft-mpscan) of the **MSFT_MpScan** class. + +For more information about which parameters are allowed, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + +## Related articles + +- [Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) +- [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..ce888c039c --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md @@ -0,0 +1,243 @@ +--- +title: Schedule regular quick and full scans with Microsoft Defender Antivirus +description: Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans +keywords: quick scan, full scan, quick vs full, schedule scan, daily, weekly, time, scheduled, recurring, regular +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 11/02/2020 +ms.reviewer: pauhijbr +manager: dansimp +ms.technology: mde +--- + +# Configure scheduled quick or full Microsoft Defender Antivirus scans + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + + +> [!NOTE] +> By default, Microsoft Defender Antivirus checks for an update 15 minutes before the time of any scheduled scans. You can [Manage the schedule for when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) to override this default. + +In addition to always-on real-time protection and [on-demand](run-scan-microsoft-defender-antivirus.md) scans, you can set up regular, scheduled scans. + +You can configure the type of scan, when the scan should occur, and if the scan should occur after a [protection update](manage-protection-updates-microsoft-defender-antivirus.md) or if the endpoint is being used. You can also specify when special scans to complete remediation should occur. + +This article describes how to configure scheduled scans with Group Policy, PowerShell cmdlets, and WMI. You can also configure schedules scans with [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#scheduled-scans-settings) or [Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/device-restrictions-windows-10). + +## To configure the Group Policy settings described in this article + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Administrative templates**. + +5. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below. + +6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. + +7. Click **OK**, and repeat for any other settings. + +Also see the [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) and [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) topics. + +## Quick scan versus full scan and custom scan + +When you set up scheduled scans, you can set up whether the scan should be a full or quick scan. + +Quick scans look at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. + +Combined with [always-on real-time protection capability](configure-real-time-protection-microsoft-defender-antivirus.md) - which reviews files when they are opened and closed, and whenever a user navigates to a folder - a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. + +In most instances, this means a quick scan is adequate to find malware that wasn't picked up by real-time protection. + +A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up. In this instance, you may want to use a full scan when running an [on-demand scan](run-scan-microsoft-defender-antivirus.md). + +A custom scan allows you to specify the files and folders to scan, such as a USB drive. + +>[!NOTE] +>By default, quick scans run on mounted removable devices, such as USB drives. + +## Set up scheduled scans + +Scheduled scans will run at the day and time you specify. You can use Group Policy, PowerShell, and WMI to configure scheduled scans. + +>[!NOTE] +>If a computer is unplugged and running on battery during a scheduled full scan, the scheduled scan will stop with event 1002, which states that the scan stopped before completion. Microsoft Defender Antivirus will run a full scan at the next scheduled time. + +### Use Group Policy to schedule scans + +|Location | Setting | Description | Default setting (if not configured) | +|:---|:---|:---|:---| +|Scan | Specify the scan type to use for a scheduled scan | Quick scan | +|Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never | +|Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.). | 2 a.m. | +|Root | Randomize scheduled task times |In Microsoft Defender Antivirus: Randomize the start time of the scan to any interval from 0 to 4 hours.
    In FEP/SCEP: randomize to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments. | Enabled | + + +### Use PowerShell cmdlets to schedule scans + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -ScanParameters +Set-MpPreference -ScanScheduleDay +Set-MpPreference -ScanScheduleTime +Set-MpPreference -RandomizeScheduleTaskTimes + +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Use Windows Management Instruction (WMI) to schedule scans + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +ScanParameters +ScanScheduleDay +ScanScheduleTime +RandomizeScheduleTaskTimes +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + + + + +## Start scheduled scans only when the endpoint is not in use + +You can set the scheduled scan to only occur when the endpoint is turned on but not in use with Group Policy, PowerShell, or WMI. + +> [!NOTE] +> These scans will not honor the CPU throttling configuration and take full advantage of the resources available to complete the scan as fast as possible. + +### Use Group Policy to schedule scans + +|Location | Setting | Description | Default setting (if not configured) | +|:---|:---|:---|:---| +|Scan | Start the scheduled scan only when computer is on but not in use | Scheduled scans will not run, unless the computer is on but not in use | Enabled | + +### Use PowerShell cmdlets + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -ScanOnlyIfIdleEnabled +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Use Windows Management Instruction (WMI) + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +ScanOnlyIfIdleEnabled +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + + +## Configure when full scans should be run to complete remediation + +Some threats may require a full scan to complete their removal and remediation. You can schedule when these scans should occur with Group Policy, PowerShell, or WMI. + +### Use Group Policy to schedule remediation-required scans + +| Location | Setting | Description | Default setting (if not configured) | +|---|---|---|---| +|Remediation | Specify the day of the week to run a scheduled full scan to complete remediation | Specify the day (or never) to run a scan. | Never | +|Remediation | Specify the time of day to run a scheduled full scan to complete remediation | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.) | 2 a.m. | + +### Use PowerShell cmdlets + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -RemediationScheduleDay +Set-MpPreference -RemediationScheduleTime +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Use Windows Management Instruction (WMI) + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +RemediationScheduleDay +RemediationScheduleTime +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + + + + +## Set up daily quick scans + +You can enable a daily quick scan that can be run in addition to your other scheduled scans with Group Policy, PowerShell, or WMI. + + +### Use Group Policy to schedule daily scans + + +|Location | Setting | Description | Default setting (if not configured) | +|:---|:---|:---|:---| +|Scan | Specify the interval to run quick scans per day | Specify how many hours should elapse before the next quick scan. For example, to run every two hours, enter **2**, for once a day, enter **24**. Enter **0** to never run a daily quick scan. | Never | +|Scan | Specify the time for a daily quick scan | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.) | 2 a.m. | + +### Use PowerShell cmdlets to schedule daily scans + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -ScanScheduleQuickScanTime +``` + +See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. + +### Use Windows Management Instruction (WMI) to schedule daily scans + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +ScanScheduleQuickScanTime +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) + + +## Enable scans after protection updates + +You can force a scan to occur after every [protection update](manage-protection-updates-microsoft-defender-antivirus.md) with Group Policy. + +### Use Group Policy to schedule scans after protection updates + +|Location | Setting | Description | Default setting (if not configured)| +|:---|:---|:---|:---| +|Signature updates | Turn on scan after Security intelligence update | A scan will occur immediately after a new protection update is downloaded | Enabled | + +## See also +- [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +- [Configure and run on-demand Microsoft Defender Antivirus scans](run-scan-microsoft-defender-antivirus.md) +- [Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) +- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) +- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..1e4c37caba --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md @@ -0,0 +1,93 @@ +--- +title: Specify the cloud-delivered protection level for Microsoft Defender Antivirus +description: Set your level of cloud-delivered protection for Microsoft Defender Antivirus. +keywords: Microsoft Defender Antivirus, antimalware, security, defender, cloud, aggressiveness, protection level +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 10/26/2020 +ms.reviewer: +manager: dansimp +ms.custom: nextgen +ms.technology: mde +--- + +# Specify the cloud-delivered protection level + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can specify your level of cloud-delivered protection offered by Microsoft Defender Antivirus by using Microsoft Endpoint Manager (recommended) or Group Policy. + +> [!TIP] +> Cloud protection is not simply protection for files that are stored in the cloud. The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and devices (also called endpoints). Cloud protection with Microsoft Defender Antivirus uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional security intelligence updates. +> Microsoft Intune and Microsoft Endpoint Manager are now part of [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview). + + +## Use Microsoft Endpoint Manager to specify the level of cloud-delivered protection + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. + +2. Choose **Endpoint security** > **Antivirus**. + +3. Select an antivirus profile. (If you don't have one yet, or if you want to create a new profile, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). + +4. Select **Properties**. Then, next to **Configuration settings**, choose **Edit**. + +5. Expand **Cloud protection**, and then in the **Cloud-delivered protection level** list, select one of the following: + + 1. **High**: Applies a strong level of detection. + 2. **High plus**: Uses the **High** level and applies additional protection measures (may impact client performance). + 3. **Zero tolerance**: Blocks all unknown executables. + +6. Choose **Review + save**, and then choose **Save**. + +> [!TIP] +> Need some help? See the following resources: +> - [Configure Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure) +> - [Add endpoint protection settings in Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-protection-configure) + + +## Use Group Policy to specify the level of cloud-delivered protection + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx). + +2. Right-click the Group Policy Object you want to configure, and then click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer Configuration** > **Administrative templates**. + +4. Expand the tree to **Windows Components** > **Microsoft Defender Antivirus** > **MpEngine**. + +5. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: + - **Default blocking level** provides strong detection without increasing the risk of detecting legitimate files. + - **Moderate blocking level** provides moderate only for high confidence detections + - **High blocking level** applies a strong level of detection while optimizing client performance (but can also give you a greater chance of false positives). + - **High + blocking level** applies additional protection measures (might impact client performance and increase your chance of false positives). + - **Zero tolerance blocking level** blocks all unknown executables. + + > [!WARNING] + > While unlikely, setting this switch to **High** or **High +** may cause some legitimate files to be detected (although you will have the option to unblock or dispute that detection). + +6. Click **OK**. + +7. Deploy your updated Group Policy Object. See [Group Policy Management Console](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx) + +> [!TIP] +> Are you using Group Policy Objects on premises? See how they translate in the cloud. [Analyze your on-premises group policy objects using Group Policy analytics in Microsoft Endpoint Manager - Preview](https://docs.microsoft.com/mem/intune/configuration/group-policy-analytics). + +## Related articles + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) +- [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) + + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md new file mode 100644 index 0000000000..d0c2933ef9 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md @@ -0,0 +1,136 @@ +--- +title: Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution +description: Troubleshoot common errors when migrating to Microsoft Defender Antivirus +keywords: event, error code, logging, troubleshooting, microsoft defender antivirus, windows defender antivirus, migration +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: martyav +ms.author: v-maave +ms.custom: nextgen +ms.date: 09/11/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + + +You can find help here if you encounter issues while migrating from a third-party security solution to Microsoft Defender Antivirus. + +## Review event logs + +Open the Event viewer app by selecting the **Search** icon in the taskbar, and searching for *event viewer*. + +Information about Microsoft Defender Antivirus can be found under **Applications and Services Logs** > **Microsoft** > **Windows** > **Windows Defender**. + +From there, select **Open** underneath **Operational**. + +Selecting an event from the details pane will show you more information about an event in the lower pane, under the **General** and **Details** tabs. + +## Microsoft Defender Antivirus won't start + +This issue can manifest in the form of several different event IDs, all of which have the same underlying cause. + +### Associated event IDs + + Event ID | Log name | Description | Source +-|-|-|- +15 | Application | Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_OFF. | Security Center +5007 | Microsoft-Windows-Windows Defender/Operational | Windows Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.

    **Old value:** Default\IsServiceRunning = 0x0
    **New value:** HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1 | Windows Defender +5010 | Microsoft-Windows-Windows Defender/Operational | Windows Defender Antivirus scanning for spyware and other potentially unwanted software is disabled. | Windows Defender + +### How to tell if Microsoft Defender Antivirus won't start because a third-party antivirus is installed + +On a Windows 10 device, if you are not using Microsoft Defender for Endpoint, and you have a third-party antivirus installed, then Microsoft Defender Antivirus will be automatically turned off. If you are using Microsoft Defender for Endpoint with a third-party antivirus installed, Microsoft Defender Antivirus will start in passive mode, with reduced functionality. + +> [!TIP] +> The scenario just described applies only to Windows 10. Other versions of Windows have [different responses](microsoft-defender-antivirus-compatibility.md) to Microsoft Defender Antivirus being run alongside third-party security software. + +#### Use Services app to check if Microsoft Defender Antivirus is turned off + +To open the Services app, select the **Search** icon from the taskbar and search for *services*. You can also open the app from the command-line by typing *services.msc*. + +Information about Microsoft Defender Antivirus will be listed within the Services app under **Windows Defender** > **Operational**. The antivirus service name is *Windows Defender Antivirus Service*. + +While checking the app, you may see that *Windows Defender Antivirus Service* is set to manual — but when you try to start this service manually, you get a warning stating, *The Windows Defender Antivirus Service service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.* + +This indicates that Microsoft Defender Antivirus has been automatically turned off to preserve compatibility with a third-party antivirus. + +#### Generate a detailed report + +You can generate a detailed report about currently active group policies by opening a command prompt in **Run as admin** mode, then entering the following command: + +```powershell +GPresult.exe /h gpresult.html +``` + +This will generate a report located at *./gpresult.html*. Open this file and you might see the following results, depending on how Microsoft Defender Antivirus was turned off. + +##### Group policy results + +##### If security settings are implemented via group policy (GPO) at the domain or local level, or though System center configuration manager (SCCM) + +Within the GPResults report, under the heading, *Windows Components/Windows Defender Antivirus*, you may see something like the following entry, indicating that Microsoft Defender Antivirus is turned off. + +Policy | Setting | Winning GPO +-|-|- +Turn off Windows Defender Antivirus | Enabled | Win10-Workstations + +###### If security settings are implemented via Group policy preference (GPP) + +Under the heading, *Registry item (Key path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender, Value name: DisableAntiSpyware)*, you may see something like the following entry, indicating that Microsoft Defender Antivirus is turned off. + +DisableAntiSpyware | - +-|- +Winning GPO | Win10-Workstations +Result: Success | +**General** | +Action | Update +**Properties** | +Hive | HKEY_LOCAL_MACHINE +Key path | SOFTWARE\Policies\Microsoft\Windows Defender +Value name | DisableAntiSpyware +Value type | REG_DWORD +Value data | 0x1 (1) + +###### If security settings are implemented via registry key + +The report may contain the following text, indicating that Microsoft Defender Antivirus is turned off: + +> Registry (regedit.exe) +> +> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender +> DisableAntiSpyware (dword) 1 (hex) + +###### If security settings are set in Windows or your Windows Server image + +Your imagining admin might have set the security policy, **[DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware)**, locally via *GPEdit.exe*, *LGPO.exe*, or by modifying the registry in their task sequence. You can [configure a Trusted Image Identifier](https://docs.microsoft.com/windows-hardware/manufacture/desktop/configure-a-trusted-image-identifier-for-windows-defender) for Microsoft Defender Antivirus. + +### Turn Microsoft Defender Antivirus back on + +Microsoft Defender Antivirus will automatically turn on if no other antivirus is currently active. You'll need to turn the third-party antivirus completely off to ensure Microsoft Defender Antivirus can run with full functionality. + +> [!WARNING] +> Solutions suggesting that you edit the *Windows Defender* start values for *wdboot*, *wdfilter*, *wdnisdrv*, *wdnissvc*, and *windefend* in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services are unsupported, and may force you to re-image your system. + +Passive mode is available if you start using Microsoft Defender for Endpoint and a third-party antivirus together with Microsoft Defender Antivirus. Passive mode allows Microsoft Defender to scan files and update itself, but it will not remediate threats. In addition, behavior monitoring via [Real Time Protection](configure-real-time-protection-microsoft-defender-antivirus.md) is not available under passive mode, unless [Endpoint data loss prevention (DLP)](../microsoft-defender-atp/information-protection-in-windows-overview.md) is deployed. + +Another feature, known as [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), is available to end-users when Microsoft Defender Antivirus is set to automatically turn off. This feature allows Microsoft Defender Antivirus to scan files periodically alongside a third-party antivirus, using a limited number of detections. + +> [!IMPORTANT] +> Limited periodic scanning is not recommended in enterprise environments. The detection, management and reporting capabilities available when running Microsoft Defender Antivirus in this mode are reduced as compared to active mode. + +### See also + +* [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md) +* [Microsoft Defender Antivirus in the Windows Security app](microsoft-defender-security-center-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..b65212267f --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md @@ -0,0 +1,3246 @@ +--- +title: Microsoft Defender AV event IDs and error codes +description: Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors +keywords: event, error code, siem, logging, troubleshooting, wef, windows event forwarding +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/11/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +If you encounter a problem with Microsoft Defender Antivirus, you can search the tables in this topic to find a matching issue and potential solution. + +The tables list: + +- [Microsoft Defender Antivirus event IDs](#windows-defender-av-ids) (these apply to both Windows 10 and Windows Server 2016) +- [Microsoft Defender Antivirus client error codes](#error-codes) +- [Internal Microsoft Defender Antivirus client error codes (used by Microsoft during development and testing)](#internal-error-codes) + +> [!TIP] +> You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: +> +> - Cloud-delivered protection +> - Fast learning (including Block at first sight) +> - Potentially unwanted application blocking + + +## Microsoft Defender Antivirus event IDs + +Microsoft Defender Antivirus records event IDs in the Windows event log. + +You can directly view the event log, or if you have a third-party security information and event management (SIEM) tool, you can also consume [Microsoft Defender Antivirus client event IDs](troubleshoot-microsoft-defender-antivirus.md#windows-defender-av-ids) to review specific events and errors from your endpoints. + +The table in this section lists the main Microsoft Defender Antivirus event IDs and, where possible, provides suggested solutions to fix or resolve the error. + +## To view a Microsoft Defender Antivirus event + +1. Open **Event Viewer**. +2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**. +3. Double-click on **Operational**. +4. In the details pane, view the list of individual events to find your event. +5. Click the event to see specific details about an event in the lower pane, under the **General** and **Details** tabs. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Event ID: 1000
    +Symbolic name: + +MALWAREPROTECTION_SCAN_STARTED +
    +Message: + +An antimalware scan started. + +
    +Description: + +
    +
    Scan ID: <ID number of the relevant scan.>
    +
    Scan Type: <Scan type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    +
    +
    Scan Parameters: <Scan parameters>, for example:
      +
    • Full scan
    • +
    • Quick scan
    • +
    • Customer scan
    • +
    +
    +
    Scan Resources: <Resources (such as files/directories/BHO) that were scanned.>
    +
    User: <Domain>\<User>
    +
    +
    Event ID: 1001
    +Symbolic name: + +MALWAREPROTECTION_SCAN_COMPLETED +
    +Message: + +An antimalware scan finished. +
    +Description: + +
    +
    Scan ID: <ID number of the relevant scan.>
    +
    Scan Type: <Scan type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    +
    +
    Scan Parameters: <Scan parameters>, for example:
      +
    • Full scan
    • +
    • Quick scan
    • +
    • Customer scan
    • +
    +
    +
    User: <Domain>\<User>
    +
    Scan Time: <The duration of a scan.>
    +
    +
    Event ID: 1002
    +Symbolic name: + +MALWAREPROTECTION_SCAN_CANCELLED + +
    +Message: + +An antimalware scan was stopped before it finished. + +
    +Description: + +
    +
    Scan ID: <ID number of the relevant scan.>
    +
    Scan Type: <Scan type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    +
    +
    Scan Parameters: <Scan parameters>, for example:
      +
    • Full scan
    • +
    • Quick scan
    • +
    • Customer scan
    • +
    +
    +
    User: <Domain>&lt;User>
    +
    Scan Time: <The duration of a scan.>
    +
    +
    Event ID: 1003
    +Symbolic name: + +MALWAREPROTECTION_SCAN_PAUSED + +
    +Message: + +An antimalware scan was paused. + +
    +Description: + +
    +
    Scan ID: <ID number of the relevant scan.>
    +
    Scan Type: <Scan type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    +
    +
    Scan Parameters: <Scan parameters>, for example:
      +
    • Full scan
    • +
    • Quick scan
    • +
    • Customer scan
    • +
    +
    +
    User: <Domain>\<User>
    +
    +
    Event ID: 1004
    +Symbolic name: + +MALWAREPROTECTION_SCAN_RESUMED + +
    +Message: + +An antimalware scan was resumed. + +
    +Description: + +
    +
    Scan ID: <ID number of the relevant scan.>
    +
    Scan Type: <Scan type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    +
    +
    Scan Parameters: <Scan parameters>, for example:
      +
    • Full scan
    • +
    • Quick scan
    • +
    • Customer scan
    • +
    +
    +
    User: <Domain>\<User>
    +
    +
    Event ID: 1005
    +Symbolic name: + +MALWAREPROTECTION_SCAN_FAILED + +
    +Message: + +An antimalware scan failed. + +
    +Description: + +
    +
    Scan ID: <ID number of the relevant scan.>
    +
    Scan Type: <Scan type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    +
    +
    Scan Parameters: <Scan parameters>, for example:
      +
    • Full scan
    • +
    • Quick scan
    • +
    • Customer scan
    • +
    +
    +
    User: <Domain>\<User>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    +
    +User action: + +The antivirus client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (Microsoft Defender Antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error. +To troubleshoot this event: +
      +
    1. Run the scan again.
    2. +
    3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
    4. +
    5. Contact Microsoft Technical Support. +
    6. +
    +
    Event ID: 1006
    +Symbolic name: + +MALWAREPROTECTION_MALWARE_DETECTED + +
    +Message: + +The antimalware engine found malware or other potentially unwanted software. + +
    +Description: + +For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    Detection Origin: <Detection origin>, for example:
      +
    • Unknown
    • +
    • Local computer
    • +
    • Network share
    • +
    • Internet
    • +
    • Incoming traffic
    • +
    • Outgoing traffic
    • +
    +
    +
    Detection Type: <Detection type>, for example:
      +
    • Heuristics
    • +
    • Generic
    • +
    • Concrete
    • +
    • Dynamic signature
    • +
    +
    +
    Detection Source: <Detection source> for example:
      +
    • User: user initiated
    • +
    • System: system initiated
    • +
    • Real-time: real-time component initiated
    • +
    • IOAV: IE Downloads and Outlook Express Attachments initiated
    • +
    • NIS: Network inspection system
    • +
    • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
    • +
    • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
    • +
    • Remote attestation
    • +
    Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. +UAC
    +
    Status: <Status>
    +
    User: <Domain>\<User>
    +
    Process Name: <Process in the PID>
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    Event ID: 1007
    +Symbolic name: + +MALWAREPROTECTION_MALWARE_ACTION_TAKEN + +
    +Message: + +The antimalware platform performed an action to protect your system from malware or other potentially unwanted software. + +
    +Description: + +Microsoft Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software. For more information, see the following: +
    +
    User: <Domain>\<User>
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Action: <Action>, for example:
      +
    • Clean: The resource was cleaned
    • +
    • Quarantine: The resource was quarantined
    • +
    • Remove: The resource was deleted
    • +
    • Allow: The resource was allowed to execute/exist
    • +
    • User defined: User-defined action that is normally one from this list of actions that the user has specified
    • +
    • No action: No action
    • +
    • Block: The resource was blocked from executing
    • +
    +
    +
    Status: <Status>
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    Event ID: 1008
    +Symbolic name: + +MALWAREPROTECTION_MALWARE_ACTION_FAILED +
    +Message: + +The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed. +
    +Description: + +Microsoft Defender Antivirus has encountered an error when taking action on malware or other potentially unwanted software. For more information, see the following: +
    +
    User: <Domain>\<User>
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    Action: <Action>, for example:
      +
    • Clean: The resource was cleaned
    • +
    • Quarantine: The resource was quarantined
    • +
    • Remove: The resource was deleted
    • +
    • Allow: The resource was allowed to execute/exist
    • +
    • User defined: User-defined action that is normally one from this list of actions that the user has specified
    • +
    • No action: No action
    • +
    • Block: The resource was blocked from executing
    • +
    +
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Status: <Status>
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    Event ID: 1009
    +Symbolic name: + +MALWAREPROTECTION_QUARANTINE_RESTORE + +
    +Message: + +The antimalware platform restored an item from quarantine. + +
    +Description: + +Microsoft Defender Antivirus has restored an item from quarantine. For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    User: <Domain>\<User>
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    Event ID: 1010
    +Symbolic name: + +MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED + +
    +Message: + +The antimalware platform could not restore an item from quarantine. + +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to restore an item from quarantine. For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    User: <Domain>\<User>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    Event ID: 1011
    +Symbolic name: + +MALWAREPROTECTION_QUARANTINE_DELETE +
    +Message: + +The antimalware platform deleted an item from quarantine. + +
    +Description: + +Microsoft Defender Antivirus has deleted an item from quarantine.
    For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    User: <Domain>\<User>
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    Event ID: 1012
    +Symbolic name: + +MALWAREPROTECTION_QUARANTINE_DELETE_FAILED + +
    +Message: + +The antimalware platform could not delete an item from quarantine. +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to delete an item from quarantine. +For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    User: <Domain>\<User>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    Event ID: 1013
    +Symbolic name: + +MALWAREPROTECTION_MALWARE_HISTORY_DELETE + +
    +Message: + +The antimalware platform deleted history of malware and other potentially unwanted software. +
    +Description: + +Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software. +
    +
    Time: The time when the event occurred, for example when the history is purged. This parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
    +
    User: <Domain>\<User>
    +
    +
    Event ID: 1014
    +Symbolic name: + +MALWAREPROTECTION_MALWARE_HISTORY_DELETE_FAILED + +
    +Message: + +The antimalware platform could not delete history of malware and other potentially unwanted software. +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to remove history of malware and other potentially unwanted software. +
    +
    Time: The time when the event occurred, for example when the history is purged. This parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
    +
    User: <Domain>\<User>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    +
    Event ID: 1015
    +Symbolic name: + +MALWAREPROTECTION_BEHAVIOR_DETECTED + +
    +Message: + +The antimalware platform detected suspicious behavior. +
    +Description: + +Microsoft Defender Antivirus has detected a suspicious behavior.
    For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    Detection Origin: <Detection origin>, for example: +
      +
    • Unknown
    • +
    • Local computer
    • +
    • Network share
    • +
    • Internet
    • +
    • Incoming traffic
    • +
    • Outgoing traffic
    • +
    +
    +
    Detection Type: <Detection type>, for example:
      +
    • Heuristics
    • +
    • Generic
    • +
    • Concrete
    • +
    • Dynamic signature
    • +
    +
    +
    Detection Source: <Detection source> for example:
      +
    • User: user initiated
    • +
    • System: system initiated
    • +
    • Real-time: real-time component initiated
    • +
    • IOAV: IE Downloads and Outlook Express Attachments initiated
    • +
    • NIS: Network inspection system
    • +
    • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
    • +
    • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
    • +
    • Remote attestation
    • +
    Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. +UAC
    +
    Status: <Status>
    +
    User: <Domain>\<User>
    +
    Process Name: <Process in the PID>
    +
    Signature ID: Enumeration matching severity.
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    Fidelity Label:
    +
    Target File Name: <File name> +Name of the file.
    +
    +
    Event ID: 1116
    +Symbolic name: + +MALWAREPROTECTION_STATE_MALWARE_DETECTED +
    +Message: + +The antimalware platform detected malware or other potentially unwanted software. + +
    +Description: + +Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
    For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    Detection Origin: <Detection origin>, for example: +
      +
    • Unknown
    • +
    • Local computer
    • +
    • Network share
    • +
    • Internet
    • +
    • Incoming traffic
    • +
    • Outgoing traffic
    • +
    +
    +
    Detection Type: <Detection type>, for example:
      +
    • Heuristics
    • +
    • Generic
    • +
    • Concrete
    • +
    • Dynamic signature
    • +
    +
    +
    Detection Source: <Detection source> for example:
      +
    • User: user initiated
    • +
    • System: system initiated
    • +
    • Real-time: real-time component initiated
    • +
    • IOAV: IE Downloads and Outlook Express Attachments initiated
    • +
    • NIS: Network inspection system
    • +
    • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
    • +
    • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
    • +
    • Remote attestation
    • +
    Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. +UAC
    +
    User: <Domain>\<User>
    +
    Process Name: <Process in the PID>
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    +User action: + +No action is required. Microsoft Defender Antivirus can suspend and take routine action on this threat. If you want to remove the threat manually, in the Microsoft Defender Antivirus interface, click Clean Computer. +
    Event ID: 1117
    +Symbolic name: + +MALWAREPROTECTION_STATE_MALWARE_ACTION_TAKEN + +
    +Message: + +The antimalware platform performed an action to protect your system from malware or other potentially unwanted software. + +
    +Description: + +Microsoft Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.
    For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    Detection Origin: <Detection origin>, for example: +
      +
    • Unknown
    • +
    • Local computer
    • +
    • Network share
    • +
    • Internet
    • +
    • Incoming traffic
    • +
    • Outgoing traffic
    • +
    +
    +
    Detection Type: <Detection type>, for example:
      +
    • Heuristics
    • +
    • Generic
    • +
    • Concrete
    • +
    • Dynamic signature
    • +
    +
    +
    Detection Source: <Detection source> for example:
      +
    • User: user initiated
    • +
    • System: system initiated
    • +
    • Real-time: real-time component initiated
    • +
    • IOAV: IE Downloads and Outlook Express Attachments initiated
    • +
    • NIS: Network inspection system
    • +
    • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
    • +
    • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
    • +
    • Remote attestation
    • +
    Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. +UAC
    +
    User: <Domain>\<User>
    +
    Process Name: <Process in the PID>
    +
    Action: <Action>, for example:
      +
    • Clean: The resource was cleaned
    • +
    • Quarantine: The resource was quarantined
    • +
    • Remove: The resource was deleted
    • +
    • Allow: The resource was allowed to execute/exist
    • +
    • User defined: User-defined action that is normally one from this list of actions that the user has specified
    • +
    • No action: No action
    • +
    • Block: The resource was blocked from executing
    • +
    +
    +
    Action Status: <Description of additional actions>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +NOTE: +Whenever Microsoft Defender Antivirus, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services that the malware might have changed:
      +
    • Default Internet Explorer or Microsoft Edge setting
    • +
    • User Access Control settings
    • +
    • Chrome settings
    • +
    • Boot Control Data
    • +
    • Regedit and Task Manager registry settings
    • +
    • Windows Update, Background Intelligent Transfer Service, and Remote Procedure Call service
    • +
    • Windows Operating System files
    +The above context applies to the following client and server versions: + + + + + + + + + + + + + +
    Operating systemOperating system version
    +Client Operating System + +Windows Vista (Service Pack 1, or Service Pack 2), Windows 7 and later +
    +Server Operating System + +Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2016 +
    +
    +
    +User action: + +No action is necessary. Microsoft Defender Antivirus removed or quarantined a threat. +
    Event ID: 1118
    +Symbolic name: + +MALWAREPROTECTION_STATE_MALWARE_ACTION_FAILED +
    +Message: + +The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed. + +
    +Description: + +Microsoft Defender Antivirus has encountered a non-critical error when taking action on malware or other potentially unwanted software.
    For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    Detection Origin: <Detection origin>, for example: +
      +
    • Unknown
    • +
    • Local computer
    • +
    • Network share
    • +
    • Internet
    • +
    • Incoming traffic
    • +
    • Outgoing traffic
    • +
    +
    +
    Detection Type: <Detection type>, for example:
      +
    • Heuristics
    • +
    • Generic
    • +
    • Concrete
    • +
    • Dynamic signature
    • +
    +
    +
    Detection Source: <Detection source> for example:
      +
    • User: user initiated
    • +
    • System: system initiated
    • +
    • Real-time: real-time component initiated
    • +
    • IOAV: IE Downloads and Outlook Express Attachments initiated
    • +
    • NIS: Network inspection system
    • +
    • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
    • +
    • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
    • +
    • Remote attestation
    • +
    Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. +UAC
    +
    User: <Domain>\<User>
    +
    Process Name: <Process in the PID>
    +
    Action: <Action>, for example:
      +
    • Clean: The resource was cleaned
    • +
    • Quarantine: The resource was quarantined
    • +
    • Remove: The resource was deleted
    • +
    • Allow: The resource was allowed to execute/exist
    • +
    • User defined: User-defined action that is normally one from this list of actions that the user has specified
    • +
    • No action: No action
    • +
    • Block: The resource was blocked from executing
    • +
    +
    +
    Action Status: <Description of additional actions>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    +User action: + +No action is necessary. Microsoft Defender Antivirus failed to complete a task related to the malware remediation. This is not a critical failure. +
    Event ID: 1119
    +Symbolic name: + +MALWAREPROTECTION_STATE_MALWARE_ACTION_CRITICALLY_FAILED + +
    +Message: + +The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message. +
    +Description: + +Microsoft Defender Antivirus has encountered a critical error when taking action on malware or other potentially unwanted software.
    For more information, see the following: +
    +
    Name: <Threat name>
    +
    ID: <Threat ID>
    +
    Severity: <Severity>, for example:
      +
    • Low
    • +
    • Moderate
    • +
    • High
    • +
    • Severe
    • +
    +
    +
    Category: <Category description>, for example, any threat or malware type.
    +
    Path: <File path>
    +
    Detection Origin: <Detection origin>, for example: +
      +
    • Unknown
    • +
    • Local computer
    • +
    • Network share
    • +
    • Internet
    • +
    • Incoming traffic
    • +
    • Outgoing traffic
    • +
    +
    +
    Detection Type: <Detection type>, for example:
      +
    • Heuristics
    • +
    • Generic
    • +
    • Concrete
    • +
    • Dynamic signature
    • +
    +
    +
    Detection Source: <Detection source> for example:
      +
    • User: user initiated
    • +
    • System: system initiated
    • +
    • Real-time: real-time component initiated
    • +
    • IOAV: IE Downloads and Outlook Express Attachments initiated
    • +
    • NIS: Network inspection system
    • +
    • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
    • +
    • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
    • +
    • Remote attestation
    • +
    Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. +UAC
    +
    User: <Domain>\<User>
    +
    Process Name: <Process in the PID>
    +
    Action: <Action>, for example:
      +
    • Clean: The resource was cleaned
    • +
    • Quarantine: The resource was quarantined
    • +
    • Remove: The resource was deleted
    • +
    • Allow: The resource was allowed to execute/exist
    • +
    • User defined: User-defined action that is normally one from this list of actions that the user has specified
    • +
    • No action: No action
    • +
    • Block: The resource was blocked from executing
    • +
    +
    +
    Action Status: <Description of additional actions>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    +User action: + +The Microsoft Defender Antivirus client encountered this error due to critical issues. The endpoint might not be protected. Review the error description then follow the relevant User action steps below. + + + + + + + + + + + + + + + + + + + + + +
    ActionUser action
    +Remove + +Update the definitions then verify that the removal was successful. +
    +Clean + +Update the definitions then verify that the remediation was successful. +
    +Quarantine + +Update the definitions and verify that the user has permission to access the necessary resources. +
    +Allow + +Verify that the user has permission to access the necessary resources. +
    + +If this event persists:
      +
    1. Run the scan again.
    2. +
    3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
    4. +
    5. Contact Microsoft Technical Support. +
    6. +
    +
    Event ID: 1120
    +Symbolic name: + +MALWAREPROTECTION_THREAT_HASH +
    +Message: + +Microsoft Defender Antivirus has deduced the hashes for a threat resource. +
    +Description: + +Microsoft Defender Antivirus client is up and running in a healthy state. +
    +
    Current Platform Version: <Current platform version>
    +
    Threat Resource Path: <Path>
    +
    Hashes: <Hashes>
    +
    +
    +
    Note: This event will only be logged if the following policy is set: ThreatFileHashLogging unsigned.
    +
    +
    Event ID: 1150
    +Symbolic name: + +MALWAREPROTECTION_SERVICE_HEALTHY +
    +Message: + +If your antimalware platform reports status to a monitoring platform, this event indicates that the antimalware platform is running and in a healthy state. + +
    +Description: + +Microsoft Defender Antivirus client is up and running in a healthy state. +
    +
    Platform Version: <Current platform version>
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware Engine version>
    +
    +
    +User action: + +No action is necessary. The Microsoft Defender Antivirus client is in a healthy state. This event is reported on an hourly basis. +
    Event ID: 1151
    +Symbolic name: + +MALWAREPROTECTION_SERVICE_HEALTH_REPORT +
    +Message: + +Endpoint Protection client health report (time in UTC) + +
    +Description: + +Antivirus client health report. +
    +
    Platform Version: <Current platform version>
    +
    Engine Version: <Antimalware Engine version>
    +
    Network Realtime Inspection engine version: <Network Realtime Inspection engine version>
    +
    Antivirus signature version: <Antivirus signature version>
    +
    Antispyware signature version: <Antispyware signature version>
    +
    Network Realtime Inspection signature version: <Network Realtime Inspection signature version>
    +
    RTP state: <Realtime protection state> (Enabled or Disabled)
    +
    OA state: <On Access state> (Enabled or Disabled)
    +
    IOAV state: <IE Downloads and Outlook Express Attachments state> (Enabled or Disabled)
    +
    BM state: <Behavior Monitoring state> (Enabled or Disabled)
    +
    Antivirus signature age: <Antivirus signature age> (in days)
    +
    Antispyware signature age: <Antispyware signature age> (in days)
    +
    Last quick scan age: <Last quick scan age> (in days)
    +
    Last full scan age: <Last full scan age> (in days)
    +
    Antivirus signature creation time: ?<Antivirus signature creation time>
    +
    Antispyware signature creation time: ?<Antispyware signature creation time>
    +
    Last quick scan start time: ?<Last quick scan start time>
    +
    Last quick scan end time: ?<Last quick scan end time>
    +
    Last quick scan source: <Last quick scan source> (0 = scan didn't run, 1 = user initiated, 2 = system initiated)
    +
    Last full scan start time: ?<Last full scan start time>
    +
    Last full scan end time: ?<Last full scan end time>
    +
    Last full scan source: <Last full scan source> (0 = scan didn't run, 1 = user initiated, 2 = system initiated)
    +
    Product status: For internal troubleshooting +
    +
    Event ID: 2000
    +Symbolic name: + +MALWAREPROTECTION_SIGNATURE_UPDATED + +
    +Message: + +The antimalware definitions updated successfully. + +
    +Description: + +Antivirus signature version has been updated. +
    +
    Current Signature Version: <Current signature version>
    +
    Previous Signature Version: <Previous signature version>
    +
    Signature Type: <Signature type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    • Network Inspection System
    • +
    +
    +
    Update Type: <Update type>, either Full or Delta.
    +
    User: <Domain>\<User>
    +
    Current Engine Version: <Current engine version>
    +
    Previous Engine Version: <Previous engine version>
    +
    +
    +User action: + +No action is necessary. The Microsoft Defender Antivirus client is in a healthy state. This event is reported when signatures are successfully updated. +
    Event ID: 2001
    +Symbolic name: + +MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED +
    +Message: + +The security intelligence update failed. + +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to update signatures. +
    +
    New security intelligence version: <New version number>
    +
    Previous security intelligence version: <Previous version>
    +
    Update Source: <Update source>, for example: +
      +
    • Security intelligence update folder
    • +
    • Internal security intelligence update server
    • +
    • Microsoft Update Server
    • +
    • File share
    • +
    • Microsoft Malware Protection Center (MMPC)
    • +
    +
    +
    Update Stage: <Update stage>, for example: +
      +
    • Search
    • +
    • Download
    • +
    • Install
    • +
    +
    +
    Source Path: File share name for Universal Naming Convention (UNC), server name for Windows Server Update Services (WSUS)/Microsoft Update/ADL.
    +
    Signature Type: <Signature type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    • Network Inspection System
    • +
    +
    +
    Update Type: <Update type>, either Full or Delta.
    +
    User: <Domain>\<User>
    +
    Current Engine Version: <Current engine version>
    +
    Previous Engine Version: <Previous engine version>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    +
    +User action: + +This error occurs when there is a problem updating definitions. +To troubleshoot this event: +
      +
    1. Update definitions and force a rescan directly on the endpoint.
    2. +
    3. Review the entries in the %Windir%\WindowsUpdate.log file for more information about this error.
    4. +
    5. Contact Microsoft Technical Support. +
    6. +
    +
    Event ID: 2002
    +Symbolic name: + +MALWAREPROTECTION_ENGINE_UPDATED +
    +Message: + +The antimalware engine updated successfully. + +
    +Description: + +Microsoft Defender Antivirus engine version has been updated. +
    +
    Current Engine Version: <Current engine version>
    +
    Previous Engine Version: <Previous engine version>
    +
    Engine Type: <Engine type>, either antimalware engine or Network Inspection System engine.
    +
    User: <Domain>\<User>
    +
    +
    +User action: + +No action is necessary. The Microsoft Defender Antivirus client is in a healthy state. This event is reported when the antimalware engine is successfully updated. +
    Event ID: 2003
    +Symbolic name: + +MALWAREPROTECTION_ENGINE_UPDATE_FAILED +
    +Message: + +The antimalware engine update failed. + +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to update the engine. +
    +
    New Engine Version:
    +
    Previous Engine Version: <Previous engine version>
    +
    Engine Type: <Engine type>, either antimalware engine or Network Inspection System engine.
    +
    User: <Domain>\<User>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    +
    +User action: + +The Microsoft Defender Antivirus client update failed. This event occurs when the client fails to update itself. This event is usually due to an interruption in network connectivity during an update. +To troubleshoot this event: +
      +
    1. Update definitions and force a rescan directly on the endpoint.
    2. +
    3. Contact Microsoft Technical Support. +
    4. +
    +
    Event ID: 2004
    +Symbolic name: + +MALWAREPROTECTION_SIGNATURE_REVERSION +
    +Message: + +There was a problem loading antimalware definitions. The antimalware engine will attempt to load the last-known good set of definitions. +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. +
    +
    Signatures Attempted:
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Signature Version: <Definition version>
    +
    Engine Version: <Antimalware engine version>
    +
    +
    +User action: + +The Microsoft Defender Antivirus client attempted to download and install the latest definitions file and failed. This error can occur when the client encounters an error while trying to load the definitions, or if the file is corrupt. Microsoft Defender Antivirus will attempt to revert back to a known-good set of definitions. +To troubleshoot this event: +
      +
    1. Restart the computer and try again.
    2. +
    3. Download the latest definitions from the Microsoft Security Intelligence site. +Note: The size of the definitions file downloaded from the site can exceed 60 MB and should not be used as a long-term solution for updating definitions. +
    4. +
    5. Contact Microsoft Technical Support. +
    6. +
    +
    Event ID: 2005
    +Symbolic name: + +MALWAREPROTECTION_ENGINE_UPDATE_PLATFORMOUTOFDATE +
    +Message: + +The antimalware engine failed to load because the antimalware platform is out of date. The antimalware platform will load the last-known good antimalware engine and attempt to update. +
    +Description: + +Microsoft Defender Antivirus could not load antimalware engine because current platform version is not supported. Microsoft Defender Antivirus will revert back to the last known-good engine and a platform update will be attempted. +
    +
    Current Platform Version: <Current platform version>
    +
    +
    Event ID: 2006
    +Symbolic name: + +MALWAREPROTECTION_PLATFORM_UPDATE_FAILED + +
    +Message: + +The platform update failed. + +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to update the platform. +
    +
    Current Platform Version: <Current platform version>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    +
    Event ID: 2007
    +Symbolic name: + +MALWAREPROTECTION_PLATFORM_ALMOSTOUTOFDATE +
    +Message: + +The platform will soon be out of date. Download the latest platform to maintain up-to-date protection. +
    +Description: + +Microsoft Defender Antivirus will soon require a newer platform version to support future versions of the antimalware engine. Download the latest Microsoft Defender Antivirus platform to maintain the best level of protection available. +
    +
    Current Platform Version: <Current platform version>
    +
    +
    Event ID: 2010
    +Symbolic name: + +MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATED + +
    +Message: + +The antimalware engine used the Dynamic Signature Service to get additional definitions. + +
    +Description: + +Microsoft Defender Antivirus used Dynamic Signature Service to retrieve additional signatures to help protect your machine. +
    +
    Current Signature Version: <Current signature version>
    +
    Signature Type: <Signature type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    • Network Inspection System
    • +
    +
    +
    Current Engine Version: <Current engine version>
    +
    Dynamic Signature Type: <Dynamic signature type>, for example: +
      +
    • Version
    • +
    • Timestamp
    • +
    • No limit
    • +
    • Duration
    • +
    +
    +
    Persistence Path: <Path>
    +
    Dynamic Signature Version: <Version number>
    +
    Dynamic Signature Compilation Timestamp: <Timestamp>
    +
    Persistence Limit Type: <Persistence limit type>, for example: +
      +
    • VDM version
    • +
    • Timestamp
    • +
    • No limit
    • +
    +
    +
    Persistence Limit: Persistence limit of the fastpath signature.
    +
    +
    Event ID: 2011
    +Symbolic name: + +MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED + +
    +Message: + +The Dynamic Signature Service deleted the out-of-date dynamic definitions. + +
    +Description: + +Microsoft Defender Antivirus used Dynamic Signature Service to discard obsolete signatures. +
    +
    Current Signature Version: <Current signature version>
    +
    Signature Type: <Signature type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    • Network Inspection System
    • +
    +
    +
    Current Engine Version: <Current engine version>
    +
    Dynamic Signature Type: <Dynamic signature type>, for example: +
      +
    • Version
    • +
    • Timestamp
    • +
    • No limit
    • +
    • Duration
    • +
    +
    +
    Persistence Path: <Path>
    +
    Dynamic Signature Version: <Version number>
    +
    Dynamic Signature Compilation Timestamp: <Timestamp>
    +
    Removal Reason:
    +
    Persistence Limit Type: <Persistence limit type>, for example: +
      +
    • VDM version
    • +
    • Timestamp
    • +
    • No limit
    • +
    +
    +
    Persistence Limit: Persistence limit of the fastpath signature.
    +
    +
    +User action: + +No action is necessary. The Microsoft Defender Antivirus client is in a healthy state. This event is reported when the Dynamic Signature Service successfully deletes out-of-date dynamic definitions. +
    Event ID: 2012
    +Symbolic name: + +MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATE_FAILED + +
    +Message: + +The antimalware engine encountered an error when trying to use the Dynamic Signature Service. + +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to use Dynamic Signature Service. +
    +
    Current Signature Version: <Current signature version>
    +
    Signature Type: <Signature type>, for example:
      +
    • Antivirus
    • +
    • Antispyware
    • +
    • Antimalware
    • +
    • Network Inspection System
    • +
    +
    +
    Current Engine Version: <Current engine version>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Dynamic Signature Type: <Dynamic signature type>, for example: +
      +
    • Version
    • +
    • Timestamp
    • +
    • No limit
    • +
    • Duration
    • +
    +
    +
    Persistence Path: <Path>
    +
    Dynamic Signature Version: <Version number>
    +
    Dynamic Signature Compilation Timestamp: <Timestamp>
    +
    Persistence Limit Type: <Persistence limit type>, for example: +
      +
    • VDM version
    • +
    • Timestamp
    • +
    • No limit
    • +
    +
    +
    Persistence Limit: Persistence limit of the fastpath signature.
    +
    +
    +User action: + +Check your Internet connectivity settings. +
    Event ID: 2013
    +Symbolic name: + +MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED_ALL + +
    +Message: + +The Dynamic Signature Service deleted all dynamic definitions. + +
    +Description: + +Microsoft Defender Antivirus discarded all Dynamic Signature Service signatures. +
    +
    Current Signature Version: <Current signature version>
    +
    +
    Event ID: 2020
    +Symbolic name: + +MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOADED + +
    +Message: + +The antimalware engine downloaded a clean file. + +
    +Description: + +Microsoft Defender Antivirus downloaded a clean file. +
    +
    Filename: <File name> +Name of the file.
    +
    Current Signature Version: <Current signature version>
    +
    Current Engine Version: <Current engine version>
    +
    +
    Event ID: 2021
    +Symbolic name: + +MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOAD_FAILED +
    +Message: + +The antimalware engine failed to download a clean file. + +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to download a clean file. +
    +
    Filename: <File name> +Name of the file.
    +
    Current Signature Version: <Current signature version>
    +
    Current Engine Version: <Current engine version>
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    +
    +User action: + +Check your Internet connectivity settings. +The Microsoft Defender Antivirus client encountered an error when using the Dynamic Signature Service to download the latest definitions to a specific threat. This error is likely caused by a network connectivity issue. +
    Event ID: 2030
    +Symbolic name: + +MALWAREPROTECTION_OFFLINE_SCAN_INSTALLED +
    +Message: + +The antimalware engine was downloaded and is configured to run offline on the next system restart. +
    +Description: + +Microsoft Defender Antivirus downloaded and configured offline antivirus to run on the next reboot. +
    Event ID: 2031
    +Symbolic name: + +MALWAREPROTECTION_OFFLINE_SCAN_INSTALL_FAILED + +
    +Message: + +The antimalware engine was unable to download and configure an offline scan. +
    +Description: + +Microsoft Defender Antivirus has encountered an error trying to download and configure offline antivirus. +
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    +
    Event ID: 2040
    +Symbolic name: + +MALWAREPROTECTION_OS_EXPIRING + +
    +Message: + +Antimalware support for this operating system version will soon end. + +
    +Description: + +The support for your operating system will expire shortly. Running Microsoft Defender Antivirus on an out of support operating system is not an adequate solution to protect against threats. +
    Event ID: 2041
    +Symbolic name: + +MALWAREPROTECTION_OS_EOL + +
    +Message: + +Antimalware support for this operating system has ended. You must upgrade the operating system for continued support. + +
    +Description: + +The support for your operating system has expired. Running Microsoft Defender Antivirus on an out of support operating system is not an adequate solution to protect against threats. +
    Event ID: 2042
    +Symbolic name: + +MALWAREPROTECTION_PROTECTION_EOL + +
    +Message: + +The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware. + +
    +Description: + +The support for your operating system has expired. Microsoft Defender Antivirus is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats. +
    Event ID: 3002
    +Symbolic name: + +MALWAREPROTECTION_RTP_FEATURE_FAILURE + +
    +Message: + +Real-time protection encountered an error and failed. +
    +Description: + +Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed. +
    +
    Feature: <Feature>, for example: +
      +
    • On Access
    • +
    • Internet Explorer downloads and Microsoft Outlook Express attachments
    • +
    • Behavior monitoring
    • +
    • Network Inspection System
    • +
    +
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    Reason: The reason Microsoft Defender Antivirus real-time protection has restarted a feature.
    +
    +
    +User action: + +You should restart the system then run a full scan because it's possible the system was not protected for some time. +The Microsoft Defender Antivirus client's real-time protection feature encountered an error because one of the services failed to start. +If it is followed by a 3007 event ID, the failure was temporary and the antimalware client recovered from the failure. +
    Event ID: 3007
    +Symbolic name: + +MALWAREPROTECTION_RTP_FEATURE_RECOVERED +
    +Message: + +Real-time protection recovered from a failure. We recommend running a full system scan when you see this error. + +
    +Description: + +Microsoft Defender Antivirus Real-time Protection has restarted a feature. It is recommended that you run a full system scan to detect any items that may have been missed while this agent was down. +
    +
    Feature: <Feature>, for example: +
      +
    • On Access
    • +
    • IE downloads and Outlook Express attachments
    • +
    • Behavior monitoring
    • +
    • Network Inspection System
    • +
    +
    +
    Reason: The reason Microsoft Defender Antivirus real-time protection has restarted a feature.
    +
    +
    +User action: + +The real-time protection feature has restarted. If this event happens again, contact Microsoft Technical Support. +
    Event ID: 5000
    +Symbolic name: + +MALWAREPROTECTION_RTP_ENABLED + +
    +Message: + +Real-time protection is enabled. + +
    +Description: + +Microsoft Defender Antivirus real-time protection scanning for malware and other potentially unwanted software was enabled. +
    Event ID: 5001
    +Symbolic name: + +MALWAREPROTECTION_RTP_DISABLED +
    +Message: + +Real-time protection is disabled. + +
    +Description: + +Microsoft Defender Antivirus real-time protection scanning for malware and other potentially unwanted software was disabled. +
    Event ID: 5004
    +Symbolic name: + +MALWAREPROTECTION_RTP_FEATURE_CONFIGURED + +
    +Message: + +The real-time protection configuration changed. + +
    +Description: + +Microsoft Defender Antivirus real-time protection feature configuration has changed. +
    +
    Feature: <Feature>, for example: +
      +
    • On Access
    • +
    • IE downloads and Outlook Express attachments
    • +
    • Behavior monitoring
    • +
    • Network Inspection System
    • +
    +
    +
    Configuration:
    +
    +
    Event ID: 5007
    +Symbolic name: + +MALWAREPROTECTION_CONFIG_CHANGED + +
    +Message: + +The antimalware platform configuration changed. +
    +Description: + +Microsoft Defender Antivirus configuration has changed. If this is an unexpected event, you should review the settings as this may be the result of malware. +
    +
    Old value: <Old value number> +Old antivirus configuration value.
    +
    New value: <New value number> +New antivirus configuration value.
    +
    +
    Event ID: 5008
    +Symbolic name: + +MALWAREPROTECTION_ENGINE_FAILURE +
    +Message: + +The antimalware engine encountered an error and failed. +
    +Description: + +Microsoft Defender Antivirus engine has been terminated due to an unexpected error. +
    +
    Failure Type: <Failure type>, for example: +Crash +or Hang
    +
    Exception Code: <Error code>
    +
    Resource: <Resource>
    +
    +
    +User action: + +To troubleshoot this event:
      +
    1. Try to restart the service.
        +
      • For antimalware, antivirus and spyware, at an elevated command prompt, type net stop msmpsvc, and then type net start msmpsvc to restart the antimalware engine.
      • +
      • For the Network Inspection System, at an elevated command prompt, type net start nissrv, and then type net start nissrv to restart the Network Inspection System engine by using the NiSSRV.exe file. +
      • +
      +
    2. +
    3. If it fails in the same way, look up the error code by accessing the Microsoft Support Site and entering the error number in the Search box, and contact Microsoft Technical Support.
    4. +
    +
    +User action: + +The Microsoft Defender Antivirus client engine stopped due to an unexpected error. +To troubleshoot this event: +
      +
    1. Run the scan again.
    2. +
    3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
    4. +
    5. Contact Microsoft Technical Support. +
    6. +
    +
    Event ID: 5009
    +Symbolic name: + +MALWAREPROTECTION_ANTISPYWARE_ENABLED + +
    +Message: + +Scanning for malware and other potentially unwanted software is enabled. + +
    +Description: + +Microsoft Defender Antivirus scanning for malware and other potentially unwanted software has been enabled. +
    Event ID: 5010
    +Symbolic name: + +MALWAREPROTECTION_ANTISPYWARE_DISABLED + +
    +Message: + +Scanning for malware and other potentially unwanted software is disabled. +
    +Description: + +Microsoft Defender Antivirus scanning for malware and other potentially unwanted software is disabled. +
    Event ID: 5011
    +Symbolic name: + +MALWAREPROTECTION_ANTIVIRUS_ENABLED +
    +Message: + +Scanning for viruses is enabled. +
    +Description: + +Microsoft Defender Antivirus scanning for viruses has been enabled. +
    Event ID: 5012
    +Symbolic name: + +MALWAREPROTECTION_ANTIVIRUS_DISABLED + +
    +Message: + +Scanning for viruses is disabled. + +
    +Description: + +Microsoft Defender Antivirus scanning for viruses is disabled. +
    Event ID: 5100
    +Symbolic name: + +MALWAREPROTECTION_EXPIRATION_WARNING_STATE + +
    +Message: + +The antimalware platform will expire soon. + +
    +Description: + +Microsoft Defender Antivirus has entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software. +
    +
    Expiration Reason: The reason Microsoft Defender Antivirus will expire.
    +
    Expiration Date: The date Microsoft Defender Antivirus will expire.
    +
    +
    Event ID: 5101
    +Symbolic name: + +MALWAREPROTECTION_DISABLED_EXPIRED_STATE + +
    +Message: + +The antimalware platform is expired. + +
    +Description: + +Microsoft Defender Antivirus grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled. +
    +
    Expiration Reason:
    +
    Expiration Date:
    +
    Error Code: <Error code> +Result code associated with threat status. Standard HRESULT values.
    +
    Error Description: <Error description> +Description of the error.
    +
    +
    + + +## Microsoft Defender Antivirus client error codes +If Microsoft Defender Antivirus experiences any issues it will usually give you an error code to help you troubleshoot the issue. Most often an error means there was a problem installing an update. +This section provides the following information about Microsoft Defender Antivirus client errors. +- The error code +- The possible reason for the error +- Advice on what to do now + +Use the information in these tables to help troubleshoot Microsoft Defender Antivirus error codes. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Error code: 0x80508007
    Message +ERR_MP_NO_MEMORY +
    +Possible reason + +This error indicates that you might have run out of memory. +
    Resolution +
      +
    1. Check the available memory on your device.
    2. +
    3. Close any unused applications that are running to free up memory on your device.
    4. +
    5. Restart the device and run the scan again. +
    6. +
    +
    Error code: 0x8050800C
    MessageERR_MP_BAD_INPUT_DATA +
    Possible reason +This error indicates that there might be a problem with your security product. +
    Resolution +
      +
    1. Update the definitions. Either:
        +
      1. Click the Update definitions button on the Update tab in Microsoft Defender Antivirus. Update definitions in Microsoft Defender AntivirusOr, +
      2. +
      3. Download the latest definitions from the Microsoft Security Intelligence site. +Note: The size of the definitions file downloaded from the site can exceed 60 MB and should not be used as a long-term solution for updating definitions. +
      4. +
      +
    2. +
    3. Run a full scan. +
    4. +
    5. Restart the device and try again.
    6. +
    +
    Error code: 0x80508020
    MessageERR_MP_BAD_CONFIGURATION + +
    Possible reason +This error indicates that there might be an engine configuration error; commonly, this is related to input +data that does not allow the engine to function properly. +
    Error code: 0x805080211 +
    MessageERR_MP_QUARANTINE_FAILED + +
    Possible reason +This error indicates that Microsoft Defender Antivirus failed to quarantine a threat. +
    Error code: 0x80508022 +
    MessageERR_MP_REBOOT_REQUIRED + +
    Possible reason +This error indicates that a reboot is required to complete threat removal. +
    +0x80508023 +
    MessageERR_MP_THREAT_NOT_FOUND + +
    Possible reason +This error indicates that the threat might no longer be present on the media, or malware might be stopping you from scanning your device. +
    Resolution + +Run the Microsoft Safety Scanner then update your security software and try again. +
    Error code: 0x80508024
    MessageERR_MP_FULL_SCAN_REQUIRED + +
    Possible reason +This error indicates that a full system scan might be required. +
    Resolution +Run a full system scan. +
    Error code: 0x80508025 +
    MessageERR_MP_MANUAL_STEPS_REQUIRED + +
    Possible reason +This error indicates that manual steps are required to complete threat removal. +
    Resolution +Follow the manual remediation steps outlined in the Microsoft Malware Protection Encyclopedia. You can find a threat-specific link in the event history.
    Error code: 0x80508026 +
    MessageERR_MP_REMOVE_NOT_SUPPORTED + +
    Possible reason +This error indicates that removal inside the container type might not be not supported. +
    Resolution +Microsoft Defender Antivirus is not able to remediate threats detected inside the archive. Consider manually removing the detected resources. +
    Error code: 0x80508027 +
    MessageERR_MP_REMOVE_LOW_MEDIUM_DISABLED + +
    Possible reason +This error indicates that removal of low and medium threats might be disabled. +
    Resolution +Check the detected threats and resolve them as required. +
    Error code: 0x80508029 +
    MessageERROR_MP_RESCAN_REQUIRED + +
    Possible reason +This error indicates a rescan of the threat is required. +
    Resolution +Run a full system scan. +
    Error code: 0x80508030 +
    MessageERROR_MP_CALLISTO_REQUIRED + +
    Possible reason +This error indicates that an offline scan is required. +
    Resolution +Run offline Microsoft Defender Antivirus. You can read about how to do this in the offline Microsoft Defender Antivirus article. +
    Error code: 0x80508031 +
    MessageERROR_MP_PLATFORM_OUTDATED
    +
    Possible reason +This error indicates that Microsoft Defender Antivirus does not support the current version of the platform and requires a new version of the platform. +
    Resolution +You can only use Microsoft Defender Antivirus in Windows 10. For Windows 8, Windows 7 and Windows Vista, you can use System Center Endpoint Protection.
    + + +The following error codes are used during internal testing of Microsoft Defender Antivirus. + +If you see these errors, you can try to [update definitions](manage-updates-baselines-microsoft-defender-antivirus.md) and force a rescan directly on the endpoint. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Internal error codes
    Error codeMessage displayedPossible reason for error and resolution
    +0x80501004 + +ERROR_MP_NO_INTERNET_CONN + + +Check your Internet connection, then run the scan again. +
    +0x80501000 + +ERROR_MP_UI_CONSOLIDATION_BASE + +This is an internal error. The cause is not clearly defined. + + +
    +0x80501001 + +ERROR_MP_ACTIONS_FAILED +
    +0x80501002 + +ERROR_MP_NOENGINE +
    +0x80501003 + +ERROR_MP_ACTIVE_THREATS +
    +0x805011011 + +MP_ERROR_CODE_LUA_CANCELLED +
    +0x80501101 + +ERROR_LUA_CANCELLATION +
    +0x80501102 + +MP_ERROR_CODE_ALREADY_SHUTDOWN +
    +0x80501103 + +MP_ERROR_CODE_RDEVICE_S_ASYNC_CALL_PENDING +
    +0x80501104 + +MP_ERROR_CODE_CANCELLED +
    +0x80501105 + +MP_ERROR_CODE_NO_TARGETOS +
    +0x80501106 + +MP_ERROR_CODE_BAD_REGEXP +
    +0x80501107 + +MP_ERROR_TEST_INDUCED_ERROR +
    +0x80501108 + +MP_ERROR_SIG_BACKUP_DISABLED +
    +0x80508001 + +ERR_MP_BAD_INIT_MODULES +
    +0x80508002 + +ERR_MP_BAD_DATABASE +
    +0x80508004 + +ERR_MP_BAD_UFS +
    +0x8050800C + +ERR_MP_BAD_INPUT_DATA +
    +0x8050800D + +ERR_MP_BAD_GLOBAL_STORAGE +
    +0x8050800E + +ERR_MP_OBSOLETE +
    +0x8050800F + +ERR_MP_NOT_SUPPORTED +
    +0x8050800F +0x80508010 + +ERR_MP_NO_MORE_ITEMS +
    +0x80508011 + +ERR_MP_DUPLICATE_SCANID +
    +0x80508012 + +ERR_MP_BAD_SCANID +
    +0x80508013 + +ERR_MP_BAD_USERDB_VERSION +
    +0x80508014 + +ERR_MP_RESTORE_FAILED +
    +0x80508016 + +ERR_MP_BAD_ACTION +
    +0x80508019 + +ERR_MP_NOT_FOUND +
    +0x80509001 + +ERR_RELO_BAD_EHANDLE +
    +0x80509003 + +ERR_RELO_KERNEL_NOT_LOADED +
    +0x8050A001 + +ERR_MP_BADDB_OPEN +
    +0x8050A002 + +ERR_MP_BADDB_HEADER +
    +0x8050A003 + +ERR_MP_BADDB_OLDENGINE +
    +0x8050A004 + +ERR_MP_BADDB_CONTENT +
    +0x8050A005 + +ERR_MP_BADDB_NOTSIGNED +
    +0x8050801 + +ERR_MP_REMOVE_FAILED + +This is an internal error. It might be triggered when malware removal is not successful. +
    +0x80508018 + +ERR_MP_SCAN_ABORTED + + +This is an internal error. It might have triggered when a scan fails to complete. +
    + +## Related topics + +- [Report on Microsoft Defender Antivirus protection](report-monitor-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md new file mode 100644 index 0000000000..0b3b787b77 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md @@ -0,0 +1,73 @@ +--- +title: Troubleshoot problems with reporting tools for Microsoft Defender AV +description: Identify and solve common problems when attempting to report in Microsoft Defender AV protection status in Update Compliance +keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Troubleshoot Microsoft Defender Antivirus reporting in Update Compliance + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +> [!IMPORTANT] +> On March 31, 2020, the Microsoft Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates. + +You can use Microsoft Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the [Microsoft Defender for Endpoint portal](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see [Windows 10 product licensing options](https://www.microsoft.com/licensing/product-licensing/windows10.aspx). + +When you use [Windows Analytics Update Compliance to obtain reporting into the protection status of devices or endpoints](/windows/deployment/update/update-compliance-using#wdav-assessment) in your network that are using Microsoft Defender Antivirus, you might encounter problems or issues. + +Typically, the most common indicators of a problem are: +- You only see a small number or subset of all the devices you were expecting to see +- You do not see any devices at all +- The reports and information you do see is outdated (older than a few days) + +For common error codes and event IDs related to the Microsoft Defender Antivirus service that are not related to Update Compliance, see [Microsoft Defender Antivirus events](troubleshoot-microsoft-defender-antivirus.md). + +There are three steps to troubleshooting these problems: + +1. Confirm that you have met all prerequisites +2. Check your connectivity to the Windows Defender cloud-based service +3. Submit support logs + +>[!IMPORTANT] +>It typically takes 3 days for devices to start appearing in Update Compliance. + + +## Confirm prerequisites + +In order for devices to properly show up in Update Compliance, you have to meet certain prerequisites for both the Update Compliance service and for Microsoft Defender Antivirus: + +>[!div class="checklist"] +>- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](microsoft-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance. +> - [Cloud-delivered protection is enabled](enable-cloud-protection-microsoft-defender-antivirus.md). +> - Endpoints can [connect to the Microsoft Defender AV cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud) +> - If the endpoint is running Windows 10 version 1607 or earlier, [Windows 10 diagnostic data must be set to the Enhanced level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level). +> - It has been 3 days since all requirements have been met + +“You can use Microsoft Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the Microsoft Defender for Endpoint portal (https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see Windows 10 product licensing options" + +If the above prerequisites have all been met, you might need to proceed to the next step to collect diagnostic information and send it to us. + +> [!div class="nextstepaction"] +> [Collect diagnostic data for Update Compliance troubleshooting](collect-diagnostic-data.md) + +## Related topics + +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..b3383fd1a6 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md @@ -0,0 +1,152 @@ +--- +title: Configure Microsoft Defender Antivirus with Group Policy +description: Learn how to use a Group Policy to configure and manage Microsoft Defender Antivirus on your endpoints in Microsoft Defender for Endpoint. +keywords: group policy, GPO, configuration, settings +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 10/01/2018 +ms.reviewer: ksarens +manager: dansimp +ms.technology: mde +--- + +# Use Group Policy settings to configure and manage Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can use [Group Policy](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx) to configure and manage Microsoft Defender Antivirus on your endpoints. + +In general, you can use the following procedure to configure or change Microsoft Defender Antivirus group policy settings: + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. + +2. Using the **Group Policy Management Editor** go to **Computer configuration**. + +3. Click **Administrative templates**. + +4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus**. + +5. Expand the section (referred to as **Location** in the table in this topic) that contains the setting you want to configure, double-click the setting to open it, and make configuration changes. + +6. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). + +The following table in this topic lists the Group Policy settings available in Windows 10, version 1703, and provides links to the appropriate topic in this documentation library (where applicable). + +Location | Setting | Article +---|---|--- +Client interface | Enable headless UI mode | [Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) +Client interface | Display additional text to clients when they need to perform an action | [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) +Client interface | Suppress all notifications | [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) +Client interface | Suppresses reboot notifications | [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) +Exclusions | Extension Exclusions | [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +Exclusions | Path Exclusions | [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +Exclusions | Process Exclusions | [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +Exclusions | Turn off Auto Exclusions | [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) +MAPS | Configure the 'Block at First Sight' feature | [Enable block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) +MAPS | Join Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) +MAPS | Send file samples when further analysis is required | [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) +MAPS | Configure local setting override for reporting to Microsoft MAPS | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +MpEngine | Configure extended cloud check | [Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) +MpEngine | Select cloud protection level | [Specify the cloud-delivered protection level](specify-cloud-protection-level-microsoft-defender-antivirus.md) +Network inspection system | Specify additional definition sets for network traffic inspection | Not used +Network inspection system | Turn on definition retirement | Not used +Network inspection system | Turn on protocol recognition | Not used +Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Quarantine | Configure removal of items from Quarantine folder | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override for turn on behavior monitoring | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Real-time protection | Configure local setting override to turn on real-time protection | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Monitor file and program activity on your computer | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Scan all downloaded files and attachments | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Turn off real-time protection | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Turn on behavior monitoring | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Turn on process scanning whenever real-time protection is enabled | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Turn on raw volume write notifications | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Real-time protection | Configure monitoring for incoming and outgoing file and program activity | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Remediation | Specify the day of the week to run a scheduled full scan to complete remediation | [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Remediation | Specify the time of day to run a scheduled full scan to complete remediation | [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Reporting | Configure Watson events | Not used +Reporting | Configure Windows software trace preprocessor components | Not used +Reporting | Configure WPP tracing level | Not used +Reporting | Configure time out for detections in critically failed state | Not used +Reporting | Configure time out for detections in non-critical failed state | Not used +Reporting | Configure time out for detections in recently remediated state | Not used +Reporting | Configure time out for detections requiring additional action | Not used +Reporting | Turn off enhanced notifications | [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) +Root | Turn off Microsoft Defender Antivirus | Not used (This setting must be set to **Not configured** to ensure any installed third-party antivirus apps work correctly) +Root | Define addresses to bypass proxy server | Not used +Root | Define proxy autoconfig (.pac) for connecting to the network | Not used +Root | Define proxy server for connecting to the network | Not used +Root | Configure local administrator merge behavior for lists | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Root | Allow antimalware service to start up with normal priority | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) +Root | Allow antimalware service to remain running always | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) +Root | Turn off routine remediation | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) +Root | Randomize scheduled task times | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Allow users to pause scan | [Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) (Not supported on Windows 10) +Scan | Check for the latest virus and spyware definitions before running a scheduled scan | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) +Scan | Define the number of days after which a catch-up scan is forced | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +Scan | Turn on catch up full scan | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +Scan | Turn on catch up quick scan | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +Scan | Configure local setting override for maximum percentage of CPU utilization | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Scan | Configure local setting override for schedule scan day | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Scan | Configure local setting override for scheduled quick scan time | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Scan | Configure local setting override for scheduled scan time | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Scan | Configure local setting override for the scan type to use for a scheduled scan | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) +Scan | Create a system restore point | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) +Scan | Turn on removal of items from scan history folder | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) +Scan | Turn on heuristics | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) +Scan | Turn on e-mail scanning | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Turn on reparse point scanning | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Run full scan on mapped network drives | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Scan archive files | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Scan network files | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Scan packed executables | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Scan removable drives | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Specify the maximum depth to scan archive files | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Specify the maximum percentage of CPU utilization during a scan | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Specify the maximum size of archive files to be scanned | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) +Scan | Specify the day of the week to run a scheduled scan | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Specify the interval to run quick scans per day | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Specify the scan type to use for a scheduled scan | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Specify the time for a daily quick scan | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Specify the time of day to run a scheduled scan | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Scan | Start the scheduled scan only when computer is on but not in use | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Security intelligence updates | Allow security intelligence updates from Microsoft Update | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) +Security intelligence updates | Allow security intelligence updates when running on battery power | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) +Security intelligence updates | Allow notifications to disable definitions-based reports to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) +Security intelligence updates | Allow real-time security intelligence updates based on reports to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) +Security intelligence updates | Check for the latest virus and spyware definitions on startup | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) +Security intelligence updates | Define file shares for downloading security intelligence updates | [Manage Microsoft Defender Antivirus protection and security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) +Security intelligence updates | Define the number of days after which a catch up security intelligence update is required | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +Security intelligence updates | Define the number of days before spyware definitions are considered out of date | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +Security intelligence updates | Define the number of days before virus definitions are considered out of date | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) +Security intelligence updates | Define the order of sources for downloading security intelligence updates | [Manage Microsoft Defender Antivirus protection and security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) +Security intelligence updates | Initiate security intelligence update on startup | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) +Security intelligence updates | Specify the day of the week to check for security intelligence updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) +Security intelligence updates | Specify the interval to check for security intelligence updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) +Security intelligence updates | Specify the time to check for security intelligence updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) +Security intelligence updates | Turn on scan after Security intelligence update | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) +Threats | Specify threat alert levels at which default action should not be taken when detected | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) +Threats | Specify threats upon which default action should not be taken when detected | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) + + +## Related articles + +- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) + diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..75f4f1b7cc --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md @@ -0,0 +1,51 @@ +--- +title: Configure Microsoft Defender Antivirus with Configuration Manager and Intune +description: Use Microsoft Endpoint Manager and Microsoft Intune to configure Microsoft Defender AV and Endpoint Protection +keywords: scep, intune, endpoint protection, configuration +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 10/26/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Use Microsoft Endpoint Manager and Microsoft Intune to configure and manage Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +If you were using Microsoft Endpoint Manager or Microsoft Intune to manage the endpoints on your network, you can now use Microsoft Endpoint Manager to manage Microsoft Defender Antivirus scans. + +1. In the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), navigate to **Endpoint Security**. + +2. Under **Manage**, choose **Antivirus**. + +3. Select your Microsoft Defender Antivirus policy. + +4. Under **Manage**, choose **Properties**. + +5. Next to **Configuration settings**, choose **Edit**. + +6. Expand the **Scan** section, and review or edit your scanning settings. + +7. Choose **Review + save** + +Need help? See [Manage endpoint security in Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security). + + +## Related articles + +- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..078fbf7fab --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md @@ -0,0 +1,65 @@ +--- +title: Use PowerShell cmdlets to configure and run Microsoft Defender AV +description: In Windows 10, you can use PowerShell cmdlets to run scans, update Security intelligence, and change settings in Microsoft Defender Antivirus. +keywords: scan, command line, mpcmdrun, defender +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 07/23/2020 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +You can use PowerShell to perform various functions in Windows Defender. Similar to the command prompt or command line, PowerShell is a task-based command-line shell and scripting language designed especially for system administration. You can read more about it at the [PowerShell hub on MSDN](https://docs.microsoft.com/previous-versions/msdn10/mt173057(v=msdn.10)). + +For a list of the cmdlets and their functions and available parameters, see the [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender) topic. + +PowerShell cmdlets are most useful in Windows Server environments that don't rely on a graphical user interface (GUI) to configure software. + +> [!NOTE] +> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr), [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), or [Microsoft Defender Antivirus Group Policy ADMX templates](https://www.microsoft.com/download/101445). + +Changes made with PowerShell will affect local settings on the endpoint where the changes are deployed or made. This means that deployments of policy with Group Policy, Microsoft Endpoint Configuration Manager, or Microsoft Intune can overwrite changes made with PowerShell. + +You can [configure which settings can be overridden locally with local policy overrides](configure-local-policy-overrides-microsoft-defender-antivirus.md). + +PowerShell is typically installed under the folder `%SystemRoot%\system32\WindowsPowerShell`. + +## Use Microsoft Defender Antivirus PowerShell cmdlets + +1. In the Windows search bar, type **powershell**. +2. Select **Windows PowerShell** from the results to open the interface. +3. Enter the PowerShell command and any parameters. + +> [!NOTE] +> You may need to open PowerShell in administrator mode. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. + +To open online help for any of the cmdlets type the following: + +```PowerShell +Get-Help -Online +``` + +Omit the `-online` parameter to get locally cached help. + +## Related topics + +- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) +- [Microsoft Defender Antivirus Cmdlets](https://docs.microsoft.com/powershell/module/defender/?view=win10-ps) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..92f746d03d --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md @@ -0,0 +1,44 @@ +--- +title: Configure Microsoft Defender Antivirus with WMI +description: Learn how to configure and manage Microsoft Defender Antivirus by using WMI scripts to retrieve, modify, and update settings in Microsoft Defender for Endpoint. +keywords: wmi, scripts, windows management instrumentation, configuration +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 09/03/2018 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Use Windows Management Instrumentation (WMI) to configure and manage Microsoft Defender Antivirus + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Windows Management Instrumentation (WMI) is a scripting interface that allows you to retrieve, modify, and update settings. + +Read more about WMI at the [Microsoft Developer Network System Administration library](https://msdn.microsoft.com/library/aa394582(v=vs.85).aspx). + +Microsoft Defender Antivirus has a number of specific WMI classes that can be used to perform most of the same functions as Group Policy and other management tools. Many of the classes are analogous to [Defender PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md). + +The [MSDN Windows Defender WMIv2 Provider reference library](https://msdn.microsoft.com/library/dn439477(v=vs.85).aspx) lists the available WMI classes for Microsoft Defender Antivirus, and includes example scripts. + +Changes made with WMI will affect local settings on the endpoint where the changes are deployed or made. This means that deployments of policy with Group Policy, Microsoft Endpoint Configuration Manager, or Microsoft Intune can overwrite changes made with WMI. + +You can [configure which settings can be overridden locally with local policy overrides](configure-local-policy-overrides-microsoft-defender-antivirus.md). + +## Related topics + +- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) +- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..5bc184057b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md @@ -0,0 +1,88 @@ +--- +title: Use next-generation technologies in Microsoft Defender Antivirus through cloud-delivered protection +description: next-generation technologies in cloud-delivered protection provide an advanced level of fast, robust antivirus detection. +keywords: Microsoft Defender Antivirus, next-generation technologies, next-generation av, machine learning, antimalware, security, defender, cloud, cloud-delivered protection +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.reviewer: shwjha +manager: dansimp +ms.custom: nextgen +ms.technology: mde +--- + +# Use next-generation technologies in Microsoft Defender Antivirus through cloud-delivered protection + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft next-generation technologies in Microsoft Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models. + +Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). +![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) + +To take advantage of the power and speed of these next-generation technologies, Microsoft Defender Antivirus works seamlessly with Microsoft cloud services. These cloud protection services, also referred to as Microsoft Advanced Protection Service (MAPS), enhances standard real-time protection, providing arguably the best antivirus defense. + +>[!NOTE] +>The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. + +With cloud-delivered protection, next-generation technologies provide rapid identification of new threats, sometimes even before a single machine is infected. Watch the following video about Microsoft AI and Microsoft Defender Antivirus in action: + + + +To understand how next-generation technologies shorten protection delivery time through the cloud, watch the following video: + + + +Read the following blog posts for detailed protection stories involving cloud-protection and Microsoft AI: + +- [Why Microsoft Defender Antivirus is the most deployed in the enterprise](https://www.microsoft.com/security/blog/2018/03/22/why-windows-defender-antivirus-is-the-most-deployed-in-the-enterprise) +- [Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign](https://www.microsoft.com/security/blog/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign) +- [How artificial intelligence stopped an Emotet outbreak](https://www.microsoft.com/security/blog/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak) +- [Detonating a bad rabbit: Microsoft Defender Antivirus and layered machine learning defenses](https://www.microsoft.com/security/blog/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses) +- [Microsoft Defender Antivirus cloud protection service: Advanced real-time defense against never-before-seen malware](https://www.microsoft.com/security/blog/2017/07/18/windows-defender-antivirus-cloud-protection-service-advanced-real-time-defense-against-never-before-seen-malware) + +## Get cloud-delivered protection + +Cloud-delivered protection is enabled by default. However, you may need to re-enable it if it has been disabled as part of previous organizational policies. + +Organizations running Windows 10 E5 can also take advantage of emergency dynamic intelligence updates, which provide near real-time protection from emerging threats. When you turn on cloud-delivered protection, fixes for malware issues can be delivered via the cloud within minutes, instead of waiting for the next update. + +>[!TIP] +>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. + +The following table describes the differences in cloud-delivered protection between recent versions of Windows and Configuration Manager. + +|OS version or service application |Cloud-protection service label |Reporting level (MAPS membership level) |Cloud block timeout period | +|---------|---------|---------|---------| +|Windows 8.1 (Group Policy) |Microsoft Advanced Protection Service |Basic, Advanced |No | +|Windows 10, version 1607 (Group Policy) |Microsoft Advanced Protection Service |Advanced |No | +|Windows 10, version 1703 or greater (Group Policy) |Cloud-based Protection |Advanced |Configurable | +|System Center 2012 Configuration Manager | N/A |Dependent on Windows version |Not configurable | +|Microsoft Endpoint Manager (Current Branch) |Cloud protection service |Dependent on Windows version |Configurable | +|Microsoft Intune |Microsoft Advanced Protection Service |Dependent on Windows version |Configurable | + +You can also [configure Microsoft Defender Antivirus to automatically receive new protection updates based on reports from our cloud service](manage-event-based-updates-microsoft-defender-antivirus.md#cloud-report-updates). + + +## Tasks + +- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md). You can enable cloud-delivered protection with Microsoft Endpoint Configuration Manager, Group Policy, Microsoft Intune, and PowerShell cmdlets. + +- [Specify the cloud-delivered protection level](specify-cloud-protection-level-microsoft-defender-antivirus.md). You can specify the level of protection offered by the cloud with Group Policy and Microsoft Endpoint Configuration Manager. The protection level will affect the amount of information shared with the cloud and how aggressively new files are blocked. + +- [Configure and validate network connections for Microsoft Defender Antivirus](configure-network-connections-microsoft-defender-antivirus.md). There are certain Microsoft URLs that your network and endpoints must be able to connect to for cloud-delivered protection to work effectively. This article lists the URLs that should be allowed via firewall or network filtering rules, and instructions for confirming your network is properly enrolled in cloud-delivered protection. + +- [Configure the block at first sight feature](configure-block-at-first-sight-microsoft-defender-antivirus.md). The "block at first sight" feature can block new malware within seconds, without having to wait hours for traditional Security intelligence. You can enable and configure it with Microsoft Endpoint Manager and Group Policy. + +- [Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md). Microsoft Defender Antivirus can block suspicious files from running while it queries our cloud-delivered protection service. You can configure the amount of time the file will be prevented from running with Microsoft Endpoint Manager and Group Policy. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md new file mode 100644 index 0000000000..bf55abf1c4 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md @@ -0,0 +1,60 @@ +--- +title: Why you should use Microsoft Defender Antivirus together with Microsoft Defender for Endpoint +description: For best results, use Microsoft Defender Antivirus together with your other Microsoft offerings. +keywords: windows defender, antivirus, third party av +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: medium +audience: ITPro +ms.topic: article +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) + +Microsoft Defender Antivirus is the next-generation protection component of [Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender for Endpoint). + +Although you can use a non-Microsoft antivirus solution with Microsoft Defender for Endpoint, there are advantages to using Microsoft Defender Antivirus together with Defender for Endpoint. Not only is Microsoft Defender Antivirus an excellent next-generation antivirus solution, but combined with other Defender for Endpoint capabilities, such as [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) and [automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations), you get better protection that's coordinated across products and services. + +## 11 reasons to use Microsoft Defender Antivirus together with Microsoft Defender for Endpoint + +| |Advantage |Why it matters | +|--|--|--| +|1|Antivirus signal sharing |Microsoft applications and services share signals across your enterprise organization, providing a stronger single platform. See [Insights from the MITRE ATT&CK-based evaluation of Microsoft Defender for Endpoint](https://www.microsoft.com/security/blog/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). | +|2|Threat analytics and your score for devices |Microsoft Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [Microsoft Secure Score for Devices](../microsoft-defender-atp/tvm-microsoft-secure-score-devices.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | +|3|Performance |Microsoft Defender for Endpoint is designed to work with Microsoft Defender Antivirus, so you get better performance when you use these offerings together. [Evaluate Microsoft Defender Antivirus](evaluate-microsoft-defender-antivirus.md) and [Microsoft Defender for Endpoint](../microsoft-defender-atp/evaluate-atp.md).| +|4|Details about blocked malware |More details and actions for blocked malware are available with Microsoft Defender Antivirus and Microsoft Defender for Endpoint. [Understand malware & other threats](../intelligence/understanding-malware.md).| +|5|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| +|6|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| +|7|Attack Surface Reduction |Your organization's security team can reduce your vulnerabilities (attack surfaces), giving attackers fewer ways to perform attacks. Attack surface reduction uses cloud protection for a number of rules. [Get an overview of attack surface reduction](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction).| +|8|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | +|9|Geographic data |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | +|10|File recovery via OneDrive |If you are using Microsoft Defender Antivirus together with [Office 365](https://docs.microsoft.com/Office365/Enterprise), and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| +|11|Technical support |By using Microsoft Defender for Endpoint together with Microsoft Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](../microsoft-defender-atp/troubleshoot-mdatp.md) and [review event logs and error codes with Microsoft Defender Antivirus](troubleshoot-microsoft-defender-antivirus.md). | + + +## Learn more + +[Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) + +[Threat & Vulnerability Management](../microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) + + + + + + diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/TOC.md b/windows/security/threat-protection/microsoft-defender-application-guard/TOC.md new file mode 100644 index 0000000000..52b3bb034e --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/TOC.md @@ -0,0 +1,8 @@ +# [Microsoft Defender Application Guard](md-app-guard-overview.md) + +## [System requirements](reqs-md-app-guard.md) +## [Install WDAG](install-md-app-guard.md) +## [Configure WDAG policies](configure-md-app-guard.md) +## [Test scenarios](test-scenarios-md-app-guard.md) +## [Microsoft Defender Application Guard Extension](md-app-guard-browser-extension.md) +## [FAQ](faq-md-app-guard.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md new file mode 100644 index 0000000000..bbab8b350a --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md @@ -0,0 +1,67 @@ +--- +title: Configure the Group Policy settings for Microsoft Defender Application Guard (Windows 10) +description: Learn about the available Group Policy settings for Microsoft Defender Application Guard. +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 10/17/2017 +ms.reviewer: +manager: dansimp +ms.custom: asr +ms.technology: mde +--- + +# Configure Microsoft Defender Application Guard policy settings + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Microsoft Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a GPO, which is linked to a domain, and then apply all those settings to every computer in the domain. + +Application Guard uses both network isolation and application-specific settings. + +## Network isolation settings + +These settings, located at **Computer Configuration\Administrative Templates\Network\Network Isolation**, help you define and manage your company's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container. + +>[!NOTE] +>You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the "Domains categorized as both work and personal" policy. + + + +|Policy name|Supported versions|Description| +|-----------|------------------|-----------| +|Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| +|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| +|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| + +## Network isolation settings wildcards + +|Value|Number of dots to the left|Meaning| +|-----|--------------------------|-------| +|`contoso.com`|0|Trust only the literal value of `contoso.com`.| +|`www.contoso.com`|0|Trust only the literal value of `www.contoso.com`.| +|`.contoso.com`|1|Trust any domain that ends with the text `contoso.com`. Matching sites include `spearphishingcontoso.com`, `contoso.com`, and `www.contoso.com`.| +|`..contoso.com`|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include `shop.contoso.com`, `us.shop.contoso.com`, `www.us.shop.contoso.com`, but NOT `contoso.com` itself.| + +## Application-specific settings +These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard**, can help you to manage your company's implementation of Application Guard. + +|Name|Supported versions|Description|Options| +|-----------|------------------|-----------|-------| +|Configure Microsoft Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher

    Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:
    -Disable the clipboard functionality completely when Virtualization Security is enabled.
    - Enable copying of certain content from Application Guard into Microsoft Edge.
    - Enable copying of certain content from Microsoft Edge into Application Guard. **Important:** Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.

    **Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.| +|Configure Microsoft Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher

    Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:
    - Enable Application Guard to print into the XPS format.
    - Enable Application Guard to print into the PDF format.
    - Enable Application Guard to print to locally attached printers.
    - Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.

    **Disabled or not configured.** Completely turns Off the print functionality for Application Guard.| +|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container. **Note:** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.

    **Disabled or not configured.** Prevents Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. | +|Allow Persistence|Windows 10 Enterprise, 1709 or higher

    Windows 10 Pro, 1803 or higher|Determines whether data persists across different sessions in Microsoft Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.

    **Disabled or not configured.** All user data within Application Guard is reset between sessions.

    **Note**
    If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
    **To reset the container:**
    1. Open a command-line program and navigate to `Windows/System32`.
    2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.
    3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.| +|Turn on Microsoft Defender Application Guard in Managed Mode|Windows 10 Enterprise, 1809 or higher|Determines whether to turn on Application Guard for Microsoft Edge and Microsoft Office.|**Enabled.** Turns on Application Guard for Microsoft Edge and/or Microsoft Office, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device. Available options:
    - Enable Microsoft Defender Application Guard only for Microsoft Edge
    - Enable Microsoft Defender Application Guard only for Microsoft Office
    - Enable Microsoft Defender Application Guard for both Microsoft Edge and Microsoft Office

    **Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge and Microsoft Office.| +|Allow files to download to host operating system|Windows 10 Enterprise, 1803 or higher|Determines whether to save downloaded files to the host operating system from the Microsoft Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Microsoft Defender Application Guard container to the host operating system.

    **Disabled or not configured.** Users are not able to saved downloaded files from Application Guard to the host operating system.| +|Allow hardware-accelerated rendering for Microsoft Defender Application Guard|Windows 10 Enterprise, 1803 or higher

    Windows 10 Pro, 1803 or higher|Determines whether Microsoft Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering. **Important:** Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.

    **Disabled or not configured.** Microsoft Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.| +|Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher

    Windows 10 Pro, 1809 or higher|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

    **Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.| +|Allow Microsoft Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher

    Windows 10 Pro, 1809 or higher|Determines whether Root Certificates are shared with Microsoft Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.

    **Disabled or not configured.** Certificates are not shared with Microsoft Defender Application Guard.| +|Allow users to trust files that open in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher|Determines whether users are able to manually trust untrusted files to open them on the host.|**Enabled.** Users are able to manually trust files or trust files after an antivirus check.

    **Disabled or not configured.** Users are unable to manually trust files and files continue to open in Microsoft Defender Application Guard.| + + diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md new file mode 100644 index 0000000000..60b5e96c41 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md @@ -0,0 +1,187 @@ +--- +title: FAQ - Microsoft Defender Application Guard (Windows 10) +description: Learn about the commonly asked questions and answers for Microsoft Defender Application Guard. +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 01/21/2021 +ms.reviewer: +manager: dansimp +ms.custom: asr +ms.technology: mde +--- + +# Frequently asked questions - Microsoft Defender Application Guard + +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Answering frequently asked questions about Microsoft Defender Application Guard (Application Guard) features, integration with the Windows operating system, and general configuration. + +## Frequently Asked Questions + +### Can I enable Application Guard on machines equipped with 4-GB RAM? +We recommend 8-GB RAM for optimal performance but you can use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration. + +`HKLM\software\Microsoft\Hvsi\SpecRequiredProcessorCount` (Default is four cores.) + +`HKLM\software\Microsoft\Hvsi\SpecRequiredMemoryInGB` (Default is 8 GB.) + +`HKLM\software\Microsoft\Hvsi\SpecRequiredFreeDiskSpaceInGB` (Default is 5 GB.) + +### Can employees download documents from the Application Guard Edge session onto host devices? + +In Windows 10 Enterprise edition 1803, users are able to download documents from the isolated Application Guard container to the host PC. This capability is managed by policy. + +In Windows 10 Enterprise edition 1709 or Windows 10 Professional edition 1803, it is not possible to download files from the isolated Application Guard container to the host PC. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device. + +### Can employees copy and paste between the host device and the Application Guard Edge session? + +Depending on your organization's settings, employees can copy and paste images (.bmp) and text to and from the isolated container. + +### Why don't employees see their Favorites in the Application Guard Edge session? + +To help keep the Application Guard Edge session secure and isolated from the host device, we don't copy the Favorites stored in the Application Guard Edge session back to the host device. + +### Why aren’t employees able to see their Extensions in the Application Guard Edge session? + +Currently, the Application Guard Edge session doesn't support Extensions. However, we're closely monitoring your feedback about this. + +### How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)? + +Microsoft Defender Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as `192.168.1.4:81` can be annotated as `itproxy:81` or using a record such as `P19216810010` for a proxy with an IP address of `192.168.100.10`. This applies to Windows 10 Enterprise edition 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune. + +### Which Input Method Editors (IME) in 19H1 are not supported? + +The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in Microsoft Defender Application Guard. +- Vietnam Telex keyboard +- Vietnam number key-based keyboard +- Hindi phonetic keyboard +- Bangla phonetic keyboard +- Marathi phonetic keyboard +- Telugu phonetic keyboard +- Tamil phonetic keyboard +- Kannada phonetic keyboard +- Malayalam phonetic keyboard +- Gujarati phonetic keyboard +- Odia phonetic keyboard +- Punjabi phonetic keyboard + +### I enabled the hardware acceleration policy on my Windows 10 Enterprise, version 1803 deployment. Why are my users still only getting CPU rendering? + +This feature is currently experimental only and is not functional without an additional registry key provided by Microsoft. If you would like to evaluate this feature on a deployment of Windows 10 Enterprise, version 1803, contact Microsoft and we’ll work with you to enable the feature. + +### What is the WDAGUtilityAccount local account? + +This account is part of Application Guard beginning with Windows 10, version 1709 (Fall Creators Update). This account remains disabled until Application Guard is enabled on your device. This item is integrated to the OS and is not considered as a threat/virus/malware. + +### How do I trust a subdomain in my site list? + +To trust a subdomain, you must precede your domain with two dots, for example: `..contoso.com` ensures that `mail.contoso.com` or `news.contoso.com` are trusted. The first dot represents the strings for the subdomain name (mail or news), the second dot recognizes the start of the domain name (`contoso.com`). This prevents sites such as `fakesitecontoso.com` from being trusted. + +### Are there differences between using Application Guard on Windows Pro vs Windows Enterprise? + +When using Windows Pro or Windows Enterprise, you have access to using Application Guard in Standalone Mode. However, when using Enterprise you have access to Application Guard in Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard). + +### Is there a size limit to the domain lists that I need to configure? + +Yes, both the Enterprise Resource domains hosted in the cloud and the Domains categorized as both work and personal have a 16383-B limit. + +### Why does my encryption driver break Microsoft Defender Application Guard? + +Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (`0x80070013 ERROR_WRITE_PROTECT`). + +### Why do the Network Isolation policies in Group Policy and CSP look different? + +There is not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatory network isolation policies to deploy Application Guard are different between CSP and GP. + +Mandatory network isolation GP policy to deploy Application Guard: "DomainSubnets or CloudResources" +Mandatory network isolation CSP policy to deploy Application Guard: "EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)" +For EnterpriseNetworkDomainNames, there is no mapped CSP policy. + +Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (`0x80070013 ERROR_WRITE_PROTECT`). + +### Why did Application Guard stop working after I turned off hyperthreading? + +If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements. + +### Why am I getting the error message "ERROR_VIRTUAL_DISK_LIMITATION"? + +Application Guard might not work correctly on NTFS compressed volumes. If this issue persists, try uncompressing the volume. + +### Why am I getting the error message "ERR_NAME_NOT_RESOLVED" after not being able to reach PAC file? + +This is a known issue. To mitigate this you need to create two firewall rules. +For guidance on how to create a firewall rule by using group policy, see: +- [Create an inbound icmp rule](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule) +- [Open Group Policy management console for Microsoft Defender Firewall](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security) + +First rule (DHCP Server): +1. Program path: `%SystemRoot%\System32\svchost.exe` +2. Local Service: `Sid: S-1-5-80-2009329905-444645132-2728249442-922493431-93864177 (Internet Connection Service (SharedAccess))` +3. Protocol UDP +4. Port 67 + +Second rule (DHCP Client) +This is the same as the first rule, but scoped to local port 68. +In the Microsoft Defender Firewall user interface go through the following steps: +1. Right click on inbound rules, create a new rule. +2. Choose **custom rule**. +3. Program path: `%SystemRoot%\System32\svchost.exe`. +4. Protocol Type: UDP, Specific ports: 67, Remote port: any. +5. Any IP addresses. +6. Allow the connection. +7. All profiles. +8. The new rule should show up in the user interface. Right click on the **rule** > **properties**. +9. In the **Programs and services** tab, Under the **Services** section click on **settings**. Choose **Apply to this Service** and select **Internet Connection Sharing (ICS) Shared Access**. + +### Why can I not launch Application Guard when Exploit Guard is enabled? + +There is a known issue such that if you change the Exploit Protection settings for CFG and possibly others, hvsimgr cannot launch. To mitigate this issue, go to **Windows Security** > **App and Browser control** > **Exploit Protection Setting**, and then switch CFG to **use default**. + + +### How can I have ICS in enabled state yet still use Application Guard? + +ICS is enabled by default in Windows, and ICS must be enabled in order for Application Guard to function correctly. We do not recommend disabling ICS; however, you can disable ICS in part by using a Group Policy and editing registry keys. + +1. In the Group Policy setting, **Prohibit use of Internet Connection Sharing on your DNS domain network**, set it to **Disabled**. + +2. Disable IpNat.sys from ICS load as follows:
    +`System\CurrentControlSet\Services\SharedAccess\Parameters\DisableIpNat = 1` + +3. Configure ICS (SharedAccess) to enabled as follows:
    +`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start = 3` + +4. (This is optional) Disable IPNAT as follows:
    +`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNat\Start = 4` + +5. Reboot the device. + +### Why doesn't the container fully load when device control policies are enabled? +Allow-listed items must be configured as "allowed" in the Group Policy Object ensure AppGuard works properly. + +Policy: Allow installation of devices that match any of these device IDs +- `SCSI\DiskMsft____Virtual_Disk____` +- `{8e7bd593-6e6c-4c52-86a6-77175494dd8e}\msvhdhba` +- `VMS_VSF` +- `root\Vpcivsp` +- `root\VMBus` +- `vms_mp` +- `VMS_VSP` +- `ROOT\VKRNLINTVSP` +- `ROOT\VID` +- `root\storvsp` +- `vms_vsmp` +- `VMS_PP` + +Policy: Allow installation of devices using drivers that match these device setup classes +- `{71a27cdd-812a-11d0-bec7-08002be2092f}` + + + +## See also + +[Configure Microsoft Defender Application Guard policy settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard) diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg b/windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg rename to windows/security/threat-protection/microsoft-defender-application-guard/images/MDAG-EndpointMgr-newprofile.jpg diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-evaluation-page.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-evaluation-page.png new file mode 100644 index 0000000000..4ad77f8a06 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-evaluation-page.png differ diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-launchIng-edge.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-launchIng-edge.png new file mode 100644 index 0000000000..25e3ef533b Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-launchIng-edge.png differ diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-new-app-guard-page.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-new-app-guard-page.png new file mode 100644 index 0000000000..779f647b33 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-new-app-guard-page.png differ diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-camera-and-mic.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-camera-and-mic.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-camera-and-mic.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-camera-and-mic.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-root-certificates.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-root-certificates.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-root-certificates.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-root-certificates.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-clipboard.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-clipboard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-clipboard.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-clipboard.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-download.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-download.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-download.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-download.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-network-isolation-neutral.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-network-isolation-neutral.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-network-isolation-neutral.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-network-isolation-neutral.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-network-isolation.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-network-isolation.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-network-isolation.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-network-isolation.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-persistence.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-persistence.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-persistence.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-persistence.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-print.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-print.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-print.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-print.png diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-turn-on.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-turn-on.png new file mode 100644 index 0000000000..7ee172b509 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-turn-on.png differ diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-vgpu.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-vgpu.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-gp-vgpu.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-gp-vgpu.png diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-hardware-isolation.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-hardware-isolation.png new file mode 100644 index 0000000000..99e590e6ca Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-hardware-isolation.png differ diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-new-window.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-new-window.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-new-window.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-new-window.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-security-center-settings.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-security-center-settings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-security-center-settings.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-security-center-settings.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-turned-on-with-trusted-site.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-turned-on-with-trusted-site.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-turned-on-with-trusted-site.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-turned-on-with-trusted-site.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/appguard-visual-cues.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-visual-cues.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/appguard-visual-cues.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/appguard-visual-cues.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/application-guard-container-v-host.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/application-guard-container-v-host.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/application-guard-container-v-host.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/application-guard-container-v-host.png diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/host-screen-no-application-guard.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/host-screen-no-application-guard.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/host-screen-no-application-guard.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/host-screen-no-application-guard.png diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on-off.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on-off.png new file mode 100644 index 0000000000..fe4236c8cf Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on-off.png differ diff --git a/windows/security/threat-protection/windows-defender-application-guard/images/turn-windows-features-on.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on.png similarity index 100% rename from windows/security/threat-protection/windows-defender-application-guard/images/turn-windows-features-on.png rename to windows/security/threat-protection/microsoft-defender-application-guard/images/turn-windows-features-on.png diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md new file mode 100644 index 0000000000..919fc5c18b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -0,0 +1,124 @@ +--- +title: Enable hardware-based isolation for Microsoft Edge (Windows 10) +description: Learn about the Microsoft Defender Application Guard modes (Standalone or Enterprise-managed), and how to install Application Guard in your enterprise. +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 10/21/2020 +ms.reviewer: +manager: dansimp +ms.custom: asr +ms.technology: mde +--- + +# Prepare to install Microsoft Defender Application Guard + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +## Review system requirements + +See [System requirements for Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard) to review the hardware and software installation requirements for Microsoft Defender Application Guard. +>[!NOTE] +>Microsoft Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. + +## Prepare for Microsoft Defender Application Guard +Before you can install and use Microsoft Defender Application Guard, you must determine which way you intend to use it in your enterprise. You can use Application Guard in either **Standalone** or **Enterprise-managed** mode. + +### Standalone mode + +Applies to: +- Windows 10 Enterprise edition, version 1709 or higher +- Windows 10 Pro edition, version 1803 + +Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-md-app-guard.md) testing scenario. + +## Enterprise-managed mode + +Applies to: +- Windows 10 Enterprise edition, version 1709 or higher + +You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add non-enterprise domain(s) in the container. + +The following diagram shows the flow between the host PC and the isolated container. +![Flowchart for movement between Microsoft Edge and Application Guard](images/application-guard-container-v-host.png) + +## Install Application Guard + +Application Guard functionality is turned off by default. However, you can quickly install it on your employee's devices through the Control Panel, PowerShell, or your mobile device management (MDM) solution. + +### To install by using the Control Panel + +1. Open the **Control Panel**, click **Programs,** and then click **Turn Windows features on or off**. + + ![Windows Features, turning on Microsoft Defender Application Guard](images/turn-windows-features-on-off.png) + +2. Select the check box next to **Microsoft Defender Application Guard** and then click **OK**. + + Application Guard and its underlying dependencies are all installed. + +### To install by using PowerShell + +>[!NOTE] +>Ensure your devices have met all system requirements prior to this step. PowerShell will install the feature without checking system requirements. If your devices don't meet the system requirements, Application Guard may not work. This step is recommended for enterprise managed scenarios only. + +1. Click the **Search** or **Cortana** icon in the Windows 10 taskbar and type **PowerShell**. + +2. Right-click **Windows PowerShell**, and then click **Run as administrator**. + + Windows PowerShell opens with administrator credentials. + +3. Type the following command: + + ``` + Enable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard + ``` +4. Restart the device. + + Application Guard and its underlying dependencies are all installed. + +### To install by using Intune + +> [!IMPORTANT] +> Make sure your organization's devices meet [requirements](reqs-md-app-guard.md) and are [enrolled in Intune](https://docs.microsoft.com/mem/intune/enrollment/device-enrollment). + +:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune"::: + +1. Go to [https://endpoint.microsoft.com](https://endpoint.microsoft.com) and sign in. + +1. Choose **Devices** > **Configuration profiles** > **+ Create profile**, and do the following:
    + + 1. In the **Platform** list, select **Windows 10 and later**. + + 1. In the **Profile** list, select **Endpoint protection**. + + 1. Choose **Create**. + +1. Specify the following settings for the profile: + + - **Name** and **Description** + + - In the **Select a category to configure settings** section, choose **Microsoft Defender Application Guard**. + + - In the **Application Guard** list, choose **Enabled for Edge**. + + - Choose your preferences for **Clipboard behavior**, **External content**, and the remaining settings. + +1. Choose **OK**, and then choose **OK** again. + +1. Review your settings, and then choose **Create**. + +1. Choose **Assignments**, and then do the following: + + 1. On the **Include** tab, in the **Assign to** list, choose an option. + + 1. If you have any devices or users you want to exclude from this endpoint protection profile, specify those on the **Exclude** tab. + + 1. Click **Save**. + +After the profile is created, any devices to which the policy should apply will have Microsoft Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place. + diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md new file mode 100644 index 0000000000..2731dfe662 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md @@ -0,0 +1,99 @@ +--- +title: Microsoft Defender Application Guard Extension +description: Learn about the Microsoft Defender Application Guard browser extension, which extends Application Guard's protection to more web browsers. +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: martyav +ms.author: v-maave +ms.date: 06/12/2020 +ms.reviewer: +manager: dansimp +ms.custom: asr +ms.technology: mde +--- + +# Microsoft Defender Application Guard Extension + +**Applies to:** + +- Windows 10 + +[Microsoft Defender Application Guard Extension](https://www.microsoft.com/security/blog/2019/05/23/new-browser-extensions-for-integrating-microsofts-hardware-based-isolation/) is a web browser add-on available for [Chrome](https://chrome.google.com/webstore/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj/) and [Firefox](https://addons.mozilla.org/en-US/firefox/addon/application-guard-extension/). + +[Microsoft Defender Application Guard](md-app-guard-overview.md) provides Hyper-V isolation on Windows 10, to protect users from potentially harmful content on the web. The extension helps Application Guard protect users running other web browsers. + +> [!TIP] +> Application Guard, by default, offers [native support](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard) to both Microsoft Edge and Internet Explorer. These browsers do not need the extension described here for Application Guard to protect them. + +Microsoft Defender Application Guard Extension defends devices in your organization from advanced attacks, by redirecting untrusted websites to an isolated version of [Microsoft Edge](https://www.microsoft.com/edge). If an untrusted website turns out to be malicious, it remains within Application Guard's secure container, keeping the device protected. + +## Prerequisites + +Microsoft Defender Application Guard Extension works with the following editions of Windows 10, version 1803 or later: + +- Windows 10 Professional +- Windows 10 Enterprise +- Windows 10 Education + +Application Guard itself is required for the extension to work. It has its own set of [requirements](reqs-md-app-guard.md). Check the Application Guard [installation guide](install-md-app-guard.md) for further steps, if you don't have it installed already. + +## Installing the extension + +Application Guard can be run under [managed mode](install-md-app-guard.md#enterprise-managed-mode) or [standalone mode](install-md-app-guard.md#standalone-mode). The main difference between the two modes is whether policies have been set to define the organization's boundaries. + +Enterprise administrators running Application Guard under managed mode should first define Application Guard's [network isolation settings](configure-md-app-guard.md#network-isolation-settings), so a set of enterprise sites is already in place. + +From there, the steps for installing the extension are similar whether Application Guard is running in managed or standalone mode. + +1. On the local device, download and install the Application Guard extension for Google [Chrome](https://chrome.google.com/webstore/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj/) and/or Mozilla [Firefox](https://addons.mozilla.org/en-US/firefox/addon/application-guard-extension/). +1. Install the [Microsoft Defender Application Guard companion app](https://www.microsoft.com/p/windows-defender-application-guard-companion/9n8gnlc8z9c8#activetab=pivot:overviewtab) from the Microsoft Store. This companion app enables Application Guard to work with web browsers other than Microsoft Edge or Internet Explorer. +1. Restart the device. + +### Recommended browser group policies + +Both Chrome and Firefox have their own browser-specific group policies. We recommend that admins use the following policy settings. + +#### Chrome policies + +These policies can be found along the filepath, *Software\Policies\Google\Chrome\\*, with each policy name corresponding to the file name (e.g., IncognitoModeAvailability is located at *Software\Policies\Google\Chrome\IncognitoModeAvailability*). + +Policy name | Values | Recommended setting | Reason +-|-|-|- +[IncognitoModeAvailability](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=IncognitoModeAvailability) | `0` = Enabled
    `1` = Disabled
    `2` = Forced (i.e. forces pages to only open in Incognito mode) | Disabled | This policy allows users to start Chrome in Incognito mode. In this mode, all extensions are turned off by default. +[BrowserGuestModeEnabled](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=BrowserGuestModeEnabled) | `false` or `0` = Disabled
    `true`, `1`, or not configured = Enabled | Disabled | This policy allows users to login as *Guest*, which opens a session in Incognito mode. In this mode, all extensions are turned off by default. +[BackgroundModeEnabled](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=BackgroundModeEnabled) | `false` or `0` = Disabled
    `true` or `1` = Enabled

    **Note:** If this policy is not set, the user can enable or disable background mode through local browser settings. | Enabled | This policy keeps Chrome running in the background, ensuring that navigation is always passed to the extension. +[ExtensionSettings](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings) | This policy accepts a dictionary that configures multiple other management settings for Chrome. See the [Google Cloud documentation](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ExtensionSettings) for complete schema. | Include an entry for `force_installed` | This policy prevents users from manually removing the extension. + +#### Firefox policies + +These policies can be found along the filepath, *Software\Policies\Mozilla\Firefox\\*, with each policy name corresponding to the file name (e.g., DisableSafeMode is located at *Software\Policies\Mozilla\Firefox\DisableSafeMode*). + +Policy name | Values | Recommended setting | Reason +-|-|-|- +[DisableSafeMode](https://github.com/mozilla/policy-templates/blob/master/README.md#DisableSafeMode) | `false` or `0` = Safe mode is enabled
    `true` or `1` = Safe mode is disabled | True (i.e. the policy is enabled and Safe mode is *not* allowed to run) | Safe mode can allow users to circumvent Application Guard +[BlockAboutConfig](https://github.com/mozilla/policy-templates/blob/master/README.md#BlockAboutConfig) | `false` or `0` = User access to *about:config* is allowed
    `true` or `1` = User access to *about:config* is not allowed | True (i.e. the policy is enabled and access to about:config is *not* allowed) | *About:config* is a special page within Firefox that offers control over many settings that may compromise security +[Extensions - Locked](https://github.com/mozilla/policy-templates/blob/master/README.md#Extensions) | This setting accepts a list of UUIDs for extensions (these can be found by searching `extensions.webextensions.uuids` within the about:config page) | Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "`ApplicationGuardRel@microsoft.com`" | This setting allows you to lock the extension, so the user cannot disable or uninstall it. + +## Troubleshooting guide + + + +Error message | Cause | Actions +-|-|- +Application Guard undetermined state | The extension was unable to communicate with the companion app during the last information request. | 1. Install the [companion app](https://www.microsoft.com/p/windows-defender-application-guard-companion/9n8gnlc8z9c8?activetab=pivot:overviewtab) and reboot
    2. If the companion app is already installed, reboot and see if that resolves the error
    3. If you still see the error after rebooting, uninstall and re-install the companion app
    4. Check for updates in both the Microsoft store and the respective web store for the affected browser +ExceptionThrown | An unexpected exception was thrown. | 1. [File a bug](https://aka.ms/wdag-fb)
    2. Retry the operation +Failed to determine if Application Guard is enabled | The extension was able to communicate with the companion app, but the information request failed in the app. | 1. Restart the browser
    2. Check for updates in both the Microsoft store and the respective web store for the affected browser +Launch in WDAG failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This can be caused by the companion app being uninstalled while Chrome was running. | 1. Make sure the companion app is installed
    2. If the companion app is installed, reboot and see if that resolves the error
    3. If you still see the error after rebooting, uninstall and re-install the companion app
    4. Check for updates in both the Microsoft store and the respective web store for the affected browser +Main page navigation caught an unexpected error | An unexpected exception was thrown during the main page navigation. | 1. [File a bug](https://aka.ms/wdag-fb)
    2. Retry the operation +Process trust response failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This can be caused by the companion app being uninstalled while Chrome was running.| 1. Make sure the companion app is installed.
    2. If the companion app is installed, reboot and see if that resolves the error
    3. If you still see the error after rebooting, uninstall and re-install the companion app
    4. Check for updates in both the Microsoft store and the respective web store for the affected browser +Protocol out of sync | The extension and native app cannot communicate with each other. This is likely caused by one being updated without supporting the protocol of the other. | Check for updates in both the Microsoft store, and the web store for the affected browser +Security patch level does not match | Microsoft determined that there was a security issue with either the extension or the companion app, and has issued a mandatory update. | Check for updates in both the Microsoft store, and the web store for the affected browser +Unexpected response while processing trusted state | The extension was able to communicate with the companion app, but the API failed and a failure response code was sent back to the extension. | 1. [File a bug](https://aka.ms/wdag-fb)
    2. Check if Edge is working
    3. Retry the operation + +## Related articles + +- [Microsoft Defender Application Guard overview](md-app-guard-overview.md) +- [Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md new file mode 100644 index 0000000000..84ae3ac222 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -0,0 +1,56 @@ +--- +title: Microsoft Defender Application Guard (Windows 10) +description: Learn about Microsoft Defender Application Guard and how it helps to combat malicious content and malware out on the Internet. +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 01/27/2021 +ms.reviewer: +manager: dansimp +ms.custom: asr +ms.technology: mde +--- + +# Microsoft Defender Application Guard overview + +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Microsoft Defender Application Guard (Application Guard) is designed to help prevent old and newly emerging attacks to help keep employees productive. Using our unique hardware isolation approach, our goal is to destroy the playbook that attackers use by making current attack methods obsolete. + +## What is Application Guard and how does it work? + +For Microsoft Edge, Application Guard helps to isolate enterprise-defined untrusted sites, protecting your company while your employees browse the Internet. As an enterprise administrator, you define what is among trusted web sites, cloud resources, and internal networks. Everything not on your list is considered untrusted. If an employee goes to an untrusted site through either Microsoft Edge or Internet Explorer, Microsoft Edge opens the site in an isolated Hyper-V-enabled container. + +For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources. Application Guard opens untrusted files in an isolated Hyper-V-enabled container. The isolated Hyper-V container is separate from the host operating system. This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can't get to your enterprise data. For example, this approach makes the isolated container anonymous, so an attacker can't get to your employee's enterprise credentials. + + +![Hardware isolation diagram](images/appguard-hardware-isolation.png) + +### What types of devices should use Application Guard? + +Application Guard has been created to target several types of devices: + +- **Enterprise desktops**. These desktops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wired, corporate network. + +- **Enterprise mobile laptops**. These laptops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wireless, corporate network. + +- **Bring your own device (BYOD) mobile laptops**. These personally-owned laptops are not domain-joined, but are managed by your organization through tools, such as Microsoft Intune. The employee is typically an admin on the device and uses a high-bandwidth wireless corporate network while at work and a comparable personal network while at home. + +- **Personal devices**. These personally-owned desktops or mobile laptops are not domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside. + +## Related articles + +|Article |Description | +|:------|:------------| +|[System requirements for Microsoft Defender Application Guard](reqs-md-app-guard.md) |Specifies the prerequisites necessary to install and use Application Guard.| +|[Prepare and install Microsoft Defender Application Guard](install-md-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| +|[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.| +|[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| +| [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a troubleshooting guide | +| [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide | +|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| +|[Use a network boundary to add trusted sites on Windows devices in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/network-boundary-windows)|Network boundary, a feature that helps you protect your environment from sites that aren't trusted by your organization.| diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md new file mode 100644 index 0000000000..4444817c21 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -0,0 +1,45 @@ +--- +title: System requirements for Microsoft Defender Application Guard (Windows 10) +description: Learn about the system requirements for installing and running Microsoft Defender Application Guard. +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.date: 02/11/2020 +ms.reviewer: +manager: dansimp +ms.custom: asr +ms.technology: mde +--- + +# System requirements for Microsoft Defender Application Guard + +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks. Microsoft Defender Application Guard is designed to help prevent old, and newly emerging attacks, to help keep employees productive. + +>[!NOTE] +>Microsoft Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. + +## Hardware requirements +Your environment needs the following hardware to run Microsoft Defender Application Guard. + +|Hardware|Description| +|--------|-----------| +|64-bit CPU|A 64-bit computer with minimum 4 cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](https://docs.microsoft.com/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](https://docs.microsoft.com/virtualization/hyper-v-on-windows/reference/tlfs).| +|CPU virtualization extensions|Extended page tables, also called _Second Level Address Translation (SLAT)_

    **-AND-**

    One of the following virtualization extensions for VBS:

    VT-x (Intel)

    **-OR-**

    AMD-V| +|Hardware memory|Microsoft requires a minimum of 8GB RAM| +|Hard disk|5 GB free space, solid state disk (SSD) recommended| +|Input/Output Memory Management Unit (IOMMU) support|Not required, but strongly recommended| + +## Software requirements +Your environment needs the following software to run Microsoft Defender Application Guard. + +|Software|Description| +|--------|-----------| +|Operating system|Windows 10 Enterprise edition, version 1709 or higher
    Windows 10 Professional edition, version 1803 or higher
    Windows 10 Professional for Workstations edition, version 1803 or higher
    Windows 10 Professional Education edition version 1803 or higher
    Windows 10 Education edition, version 1903 or higher
    Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with WDAG for Professional editions. | +|Browser|Microsoft Edge and Internet Explorer| +|Management system
    (only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/intune/)

    **-OR-**

    [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/)

    **-OR-**

    [Group Policy](https://technet.microsoft.com/library/cc753298(v=ws.11).aspx)

    **-OR-**

    Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md new file mode 100644 index 0000000000..0c7e53c3fb --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md @@ -0,0 +1,267 @@ +--- +title: Testing scenarios with Microsoft Defender Application Guard (Windows 10) +description: Suggested testing scenarios for Microsoft Defender Application Guard, showing how it works in both Standalone and Enterprise-managed mode. +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.reviewer: +manager: dansimp +ms.date: 09/14/2020 +ms.custom: asr +ms.technology: mde +--- + +# Application Guard testing scenarios + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +We've come up with a list of scenarios that you can use to test hardware-based isolation in your organization. + +## Application Guard in standalone mode + +You can see how an employee would use standalone mode with Application Guard. + +### To test Application Guard in Standalone mode + +1. [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard). + +2. Restart the device, start Microsoft Edge, and then select **New Application Guard window** from the menu. + + ![New Application Guard window setting option](images/appguard-new-window.png) + +3. Wait for Application Guard to set up the isolated environment. + + >[!NOTE] + >Starting Application Guard too quickly after restarting the device might cause it to take a bit longer to load. However, subsequent starts should occur without any perceivable delays. + +4. Go to an untrusted, but safe URL (for this example, we used msn.com) and view the new Microsoft Edge window, making sure you see the Application Guard visual cues. + + ![Untrusted website running in Application Guard](images/appguard-visual-cues.png) + +## Application Guard in Enterprise-managed mode + +How to install, set up, turn on, and configure Application Guard for Enterprise-managed mode. + +### Install, set up, and turn on Application Guard + +Before you can use Application Guard in managed mode, you must install Windows 10 Enterprise edition, version 1709, which includes the functionality. Then, you must use Group Policy to set up the required settings. + +1. [Install Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard#install-application-guard). + +2. Restart the device, and then start Microsoft Edge. + +3. Set up the Network Isolation settings in Group Policy: + + a. Click on the **Windows** icon, type `Group Policy`, and then click **Edit Group Policy**. + + b. Go to the **Administrative Templates\Network\Network Isolation\Enterprise resource domains hosted in the cloud** setting. + + c. For the purposes of this scenario, type `.microsoft.com` into the **Enterprise cloud resources** box. + + ![Group Policy editor with Enterprise cloud resources setting](images/appguard-gp-network-isolation.png) + + d. Go to the **Administrative Templates\Network\Network Isolation\Domains categorized as both work and personal** setting. + + e. For the purposes of this scenario, type `bing.com` into the **Neutral resources** box. + + ![Group Policy editor with Neutral resources setting](images/appguard-gp-network-isolation-neutral.png) + +4. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Turn on Microsoft Defender Application Guard in Managed Mode** setting. + +5. Click **Enabled**, choose Option **1**, and click **OK**. + + ![Group Policy editor with Turn On/Off setting](images/appguard-gp-turn-on.png) + + >[!NOTE] + >Enabling this setting verifies that all the necessary settings are properly configured on your employee devices, including the network isolation settings set earlier in this scenario. + +6. Start Microsoft Edge and type `https://www.microsoft.com`. + + After you submit the URL, Application Guard determines the URL is trusted because it uses the domain you've marked as trusted and shows the site directly on the host PC instead of in Application Guard. + + ![Trusted website running on Microsoft Edge](images/appguard-turned-on-with-trusted-site.png) + +7. In the same Microsoft Edge browser, type any URL that isn't part of your trusted or neutral site lists. + + After you submit the URL, Application Guard determines the URL is untrusted and redirects the request to the hardware-isolated environment. + + ![Untrusted website running in Application Guard](images/appguard-visual-cues.png) + +### Customize Application Guard + +Application Guard lets you specify your configuration, allowing you to create the proper balance between isolation-based security and productivity for your employees. + +Application Guard provides the following default behavior for your employees: + +- No copying and pasting between the host PC and the isolated container. + +- No printing from the isolated container. + +- No data persistence from one isolated container to another isolated container. + +You have the option to change each of these settings to work with your enterprise from within Group Policy. + +**Applies to:** + +- Windows 10 Enterprise edition, version 1709 or higher +- Windows 10 Professional edition, version 1803 + +#### Copy and paste options + +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Configure Microsoft Defender Application Guard clipboard settings**. + +2. Click **Enabled** and click **OK**. + + ![Group Policy editor clipboard options](images/appguard-gp-clipboard.png) + +3. Choose how the clipboard works: + + - Copy and paste from the isolated session to the host PC + + - Copy and paste from the host PC to the isolated session + + - Copy and paste both directions + +4. Choose what can be copied: + + - Only text can be copied between the host PC and the isolated container. + + - Only images can be copied between the host PC and the isolated container. + + - Both text and images can be copied between the host PC and the isolated container. + +5. Click **OK**. + +#### Print options + +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Configure Microsoft Defender Application Guard print** settings. + +2. Click **Enabled** and click **OK**. + + ![Group Policy editor Print options](images/appguard-gp-print.png) + +3. Based on the list provided in the setting, choose the number that best represents what type of printing should be available to your employees. You can allow any combination of local, network, PDF, and XPS printing. + +4. Click **OK**. + +#### Data persistence options + +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow data persistence for Microsoft Defender Application Guard** setting. + +2. Click **Enabled** and click **OK**. + + ![Group Policy editor Data Persistence options](images/appguard-gp-persistence.png) + +3. Open Microsoft Edge and browse to an untrusted, but safe URL. + + The website opens in the isolated session. + +4. Add the site to your **Favorites** list and then close the isolated session. + +5. Log out and back on to your device, opening Microsoft Edge in Application Guard again. + + The previously added site should still appear in your **Favorites** list. + + > [!NOTE] + > If you don't allow or turn off data persistence, restarting a device or logging in and out of the isolated container triggers a recycle event that discards all generated data, including session cookies, Favorites, and so on, removing the data from Application Guard. If you turn on data persistence, all employee-generated artifacts are preserved across container recycle events. However, these artifacts only exist in the isolated container and aren't shared with the host PC. This data persists after restarts and even through build-to-build upgrades of Windows 10. + > + > If you turn on data persistence, but later decide to stop supporting it for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data. + > + > **To reset the container, follow these steps:**
    1. Open a command-line program and navigate to Windows/System32.
    2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.
    3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data. + +**Applies to:** + +- Windows 10 Enterprise edition, version 1803 +- Windows 10 Professional edition, version 1803 + +#### Download options + +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow files to download and save to the host operating system from Microsoft Defender Application Guard** setting. + +2. Click **Enabled** and click **OK**. + + ![Group Policy editor Download options](images/appguard-gp-download.png) + +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. + +4. Download a file from Microsoft Defender Application Guard. + +5. Check to see the file has been downloaded into This PC > Downloads > Untrusted files. + +#### Hardware acceleration options + +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow hardware-accelerated rendering for Microsoft Defender Application Guard** setting. + +2. Click **Enabled** and click **OK**. + + ![Group Policy editor hardware acceleration options](images/appguard-gp-vgpu.png) + +3. Once you have enabled this feature, open Microsoft Edge and browse to an untrusted, but safe URL with video, 3D, or other graphics-intensive content. The website opens in an isolated session. + +4. Assess the visual experience and battery performance. + +**Applies to:** + +- Windows 10 Enterprise edition, version 1809 +- Windows 10 Professional edition, version 1809 + +#### File trust options + +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow users to trust files that open in Microsoft Defender Application Guard** setting. + +2. Click **Enabled**, set **Options** to 2, and click **OK**. + + ![Group Policy editor File trust options](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) + +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. + +4. Open a file in Edge, such an Office 365 file. + +5. Check to see that an antivirus scan completed before the file was opened. + +#### Camera and microphone options + +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow camera and microphone access in Microsoft Defender Application Guard** setting. + +2. Click **Enabled** and click **OK**. + + ![Group Policy editor Camera and microphone options](images/appguard-gp-allow-camera-and-mic.png) + +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. + +4. Open an application with video or audio capability in Edge. + +5. Check that the camera and microphone work as expected. + +#### Root certificate sharing options + +1. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Allow Microsoft Defender Application Guard to use Root Certificate Authorities from the user's device** setting. + +2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. + + ![Group Policy editor Root certificate options](images/appguard-gp-allow-root-certificates.png) + +3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. + +## Application Guard Extension for third-party web browsers + +The [Application Guard Extension](md-app-guard-browser-extension.md) available for Chrome and Firefox allows Application Guard to protect users even when they are running a web browser other than Microsoft Edge or Internet Explorer. + +Once a user has the extension and its companion app installed on their enterprise device, you can run through the following scenarios. + +1. Open either Firefox or Chrome — whichever browser you have the extension installed on. + +2. Navigate to an enterprise website, i.e. an internal website maintained by your organization. You might see this evaluation page for an instant before the site is fully loaded. + ![The evaluation page displayed while the page is being loaded, explaining that the user must wait](images/app-guard-chrome-extension-evaluation-page.png) + +3. Navigate to a non-enterprise, external website site, such as [www.bing.com](https://www.bing.com). The site should be redirected to Microsoft Defender Application Guard Edge. + ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge](images/app-guard-chrome-extension-launchIng-edge.png) + +4. Open a new Application Guard window, by select the Microsoft Defender Application Guard icon, then **New Application Guard Window** + ![The "New Application Guard Window" option is highlighted in red](images/app-guard-chrome-extension-new-app-guard-page.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/Onboard-Windows-10-multi-session-device.md b/windows/security/threat-protection/microsoft-defender-atp/Onboard-Windows-10-multi-session-device.md new file mode 100644 index 0000000000..94eacf9749 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/Onboard-Windows-10-multi-session-device.md @@ -0,0 +1,136 @@ +--- +title: Onboard Windows 10 multi-session devices in Windows Virtual Desktop +description: Read more in this article about Onboarding Windows 10 multi-session devices in Windows Virtual Desktop +keywords: Windows Virtual Desktop, WVD, microsoft defender, endpoint, onboard +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.topic: article +author: dansimp +ms.author: dansimp +ms.custom: nextgen +ms.date: 02/04/2021 +ms.reviewer: +manager: dansimp +ms.technology: mde +--- + +# Onboard Windows 10 multi-session devices in Windows Virtual Desktop + +Applies to: +- Windows 10 multi-session running on Windows Virtual Desktop (WVD) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +> [!IMPORTANT] +> Welcome to Microsoft Defender for Endpoint, the new name for Microsoft Defender for Endpoint. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future. + +> [!WARNING] +> Microsoft Defender for Endpoint support for Windows Virtual Desktop multi-session scenarios is currently in Preview and limited up to 25 concurrent sessions per host/VM. However, single session scenarios on Windows Virtual Desktop are fully supported. + +Microsoft Defender for Endpoint supports monitoring both VDI as well as Windows Virtual Desktop sessions. Depending on your organization's needs, you might need to implement VDI or Windows Virtual Desktop sessions to help your employees access corporate data and apps from an unmanaged device, remote location, or similar scenario. With Microsoft Defender for Endpoint, you can monitor these virtual machines for anomalous activity. + + ## Before you begin +Familiarize yourself with the [considerations for non-persistent VDI](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi#onboard-non-persistent-virtual-desktop-infrastructure-vdi-devices-1). Although [Windows Virtual Desktop](https://docs.microsoft.com/azure/virtual-desktop/overview) does not provide non-persistence options, it does provide ways to use a Windows image that can be used to provision new hosts and redeploy machines. This increases volatility in the environment, and thus impacts what entries are created and maintained in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)), potentially reducing visibility for your security analysts. + +> [!NOTE] +> Depending on your choice of onboarding method, devices can appear in Microsoft Defender Security Center as either: +> - Single entry for each virtual desktop +> - Multiple entries for each virtual desktop + +Microsoft recommends onboarding Windows Virtual Desktop as a single entry per virtual desktop. This ensures that the investigation experience in the Microsoft Defender Security Center is in the context of one device based on the machine name. Organizations that frequently delete and re-deploy WVD hosts should strongly consider using this method as it prevents multiple objects for the same machine from being created in the Microsoft Defender Security Center. This can lead to confusion when investigating incidents. For test or non-volatile environments, you may opt to choose differently. + +Microsoft recommends adding the Microsoft Defender for Endpoint onboarding script to the WVD image. This way, you can be sure that this onboarding script runs immediately at first boot. It is executed as a startup script at first boot on all the WVD machines that are provisioned from the WVD golden image. However, if you are using one of the gallery images without modification, place the script in a shared location and call it from either local or domain group policy. + +> [!NOTE] +> The placement and configuration of the VDI onboarding startup script on the WVD golden image configures it as a startup script that runs when the WVD starts. It is NOT recommended to onboard the actual WVD golden image. Another consideration is the method used to run the script. It should run as early in the startup/provisioning process as possible to reduce the time between the machine being available to receive sessions and the device onboarding to the service. Below scenarios 1 & 2 take this into account. + +## Scenarios +There are several ways to onboard a WVD host machine: + +- Run the script in the golden image (or from a shared location) during startup. +- Use a management tool to run the script. + +### Scenario 1: Using local group policy +This scenario requires placing the script in a golden image and uses local group policy to run early in the boot process. + +Use the instructions in [Onboard non-persistent virtual desktop infrastructure VDI devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi#onboard-non-persistent-virtual-desktop-infrastructure-vdi-devices-1). + +Follow the instructions for a single entry for each device. + +### Scenario 2: Using domain group policy +This scenario uses a centrally located script and runs it using a domain-based group policy. You can also place the script in the golden image and run it in the same way. + +#### Download the WindowsDefenderATPOnboardingPackage.zip file from the Windows Defender Security Center +1. Open the VDI configuration package .zip file (WindowsDefenderATPOnboardingPackage.zip) + - In the Microsoft Defender Security Center navigation pane, select **Settings** > **Onboarding**. + - Select Windows 10 as the operating system. + - In the **Deployment method** field, select VDI onboarding scripts for non-persistent endpoints. + - Click **Download package** and save the .zip file. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the device. You should have a folder called **OptionalParamsPolicy** and the files **WindowsDefenderATPOnboardingScript.cmd** and **Onboard-NonPersistentMachine.ps1**. + +#### Use Group Policy management console to run the script when the virtual machine starts +1. Open the Group Policy Management Console (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. +1. In the Group Policy Management Editor, go to **Computer configuration** \> **Preferences** \> **Control panel settings**. +1. Right-click **Scheduled tasks**, click **New**, and then click **Immediate Task** (At least Windows 7). +1. In the Task window that opens, go to the **General** tab. Under **Security options** click **Change User or Group** and type SYSTEM. Click **Check Names** and then click OK. NT AUTHORITY\SYSTEM appears as the user account the task will run as. +1. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check box. +1. Go to the **Actions** tab and click **New**. Ensure that **Start a program** is selected in the Action field. +Enter the following: + +> Action = "Start a program"
    +> Program/Script = C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
    +> Add Arguments (optional) = -ExecutionPolicy Bypass -command "& \\Path\To\Onboard-NonPersistentMachine.ps1" + +Click **OK** and close any open GPMC windows. + +### Scenario 3: Onboarding using management tools + +If you plan to manage your machines using a management tool, you can onboard devices with Microsoft Endpoint Configuration Manager. + +For more information, see: [Onboard Windows 10 devices using Configuration Manager](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm) + +> [!WARNING] +> If you plan to use [Attack Surface reduction Rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction), please note that rule “[Block process creations originating from PSExec and WMI commands](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction#block-process-creations-originating-from-psexec-and-wmi-commands)" should not be used as it is incompatible with management through Microsoft Endpoint Manager because this rule blocks WMI commands the Configuration Manager client uses to function correctly. + +> [!TIP] +> After onboarding the device, you can choose to run a detection test to verify that the device is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender for Endpoint device](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-detection-test). + +## Tagging your machines when building your image + +As part of your onboarding, you may want to consider setting a machine tag to be able to differentiate WVD machines more easily in the Microsoft Security Center. For more information, see +[Add device tags by setting a registry key value](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-tags#add-device-tags-by-setting-a-registry-key-value). + +## Other recommended configuration settings + +When building your image, you may want to configure initial protection settings as well. For more information, see [Other recommended configuration settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp#other-recommended-configuration-settings). + +In addition, if you are using FSlogix user profiles, we recommend you exclude the following files from always-on protection: + +### Exclude Files + +> %ProgramFiles%\FSLogix\Apps\frxdrv.sys
    +> %ProgramFiles%\FSLogix\Apps\frxdrvvt.sys
    +> %ProgramFiles%\FSLogix\Apps\frxccd.sys
    +> %TEMP%\*.VHD
    +> %TEMP%\*.VHDX
    +> %Windir%\TEMP\*.VHD
    +> %Windir%\TEMP\*.VHDX
    +> \\storageaccount.file.core.windows.net\share\*\*.VHD
    +> \\storageaccount.file.core.windows.net\share\*\*.VHDX
    + +### Exclude Processes + +> %ProgramFiles%\FSLogix\Apps\frxccd.exe
    +> %ProgramFiles%\FSLogix\Apps\frxccds.exe
    +> %ProgramFiles%\FSLogix\Apps\frxsvc.exe
    + +## Licensing requirements + +Windows 10 Multi-session is a client OS. Licensing requirements for Microsoft Defender for endpoint can be found at: [Licensing requirements](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements#licensing-requirements). diff --git a/windows/security/threat-protection/microsoft-defender-atp/access-mssp-portal.md b/windows/security/threat-protection/microsoft-defender-atp/access-mssp-portal.md new file mode 100644 index 0000000000..e7059f44d9 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/access-mssp-portal.md @@ -0,0 +1,60 @@ +--- +title: Access the Microsoft Defender Security Center MSSP customer portal +description: Access the Microsoft Defender Security Center MSSP customer portal +keywords: managed security service provider, mssp, configure, integration +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# Access the Microsoft Defender Security Center MSSP customer portal + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) + + + + +>[!NOTE] +>These set of steps are directed towards the MSSP. + +By default, MSSP customers access their Microsoft Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`. + + +MSSPs however, will need to use a tenant-specific URL in the following format: `https://securitycenter.windows.com?tid=customer_tenant_id` to access the MSSP customer portal. + +In general, MSSPs will need to be added to each of the MSSP customer's Azure AD that they intend to manage. + + +Use the following steps to obtain the MSSP customer tenant ID and then use the ID to access the tenant-specific URL: + +1. As an MSSP, login to Azure AD with your credentials. + +2. Switch directory to the MSSP customer's tenant. + +3. Select **Azure Active Directory > Properties**. You'll find the tenant ID in the Directory ID field. + +4. Access the MSSP customer portal by replacing the `customer_tenant_id` value in the following URL: `https://securitycenter.windows.com?tid=customer_tenant_id`. + + +## Related topics +- [Grant MSSP access to the portal](grant-mssp-access.md) +- [Configure alert notifications](configure-mssp-notifications.md) +- [Fetch alerts from customer tenant](fetch-alerts-mssp.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md index 0e8ba41a5c..41a3a471ac 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md +++ b/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags.md @@ -1,9 +1,9 @@ --- title: Add or Remove Machine Tags API -description: Use this API to Add or Remove machine tags. +description: Learn how to use the Add or Remove machine tags API to adds or remove a tag for a machine in Microsoft Defender Advanced Threat Protection. keywords: apis, graph api, supported apis, tags, machine tags search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,42 +12,55 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Add or Remove Machine Tags API -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + +[!include[Improve request performance](../../includes/improve-request-performance.md)] ## API description + Adds or remove tag to a specific [Machine](machine.md). - ## Limitations -1. You can post on machines last seen in the past 30 days. + +1. You can post on machines last seen according to your configured retention period. + 2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour. ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) -Permission type | Permission | Permission display name +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Defender for Endpoint APIs](apis-intro.md) + +Permission type | Permission | Permission display name :---|:---|:--- -Application | Machine.ReadWrite.All | 'Read and write all machine information' +Application | Machine.ReadWrite.All | 'Read and write all machine information' Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' >[!Note] > When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'Manage security setting' (See [Create and manage roles](user-roles.md) for more information) +> +>- The user needs to have at least the following role permission: 'Manage security setting'. For more (See [Create and manage roles](user-roles.md) for more information) >- User needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) ## HTTP request -``` -POST https://api.securitycenter.windows.com/api/machines/{id}/tags + +```http +POST https://api.securitycenter.microsoft.com/api/machines/{id}/tags ``` ## Request headers @@ -58,17 +71,18 @@ Authorization | String | Bearer {token}. **Required**. Content-Type | string | application/json. **Required**. ## Request body + In the request body, supply a JSON object with the following parameters: -Parameter | Type | Description +Parameter | Type | Description :---|:---|:--- -Value | String | The tag name. **Required**. -Action | Enum | Add or Remove. Allowed values are: 'Add' or 'Remove'. **Required**. +Value | String | The tag name. **Required**. +Action | Enum | Add or Remove. Allowed values are: 'Add' or 'Remove'. **Required**. ## Response -If successful, this method returns 200 - Ok response code and the updated Machine in the response body. +If successful, this method returns 200 - Ok response code and the updated Machine in the response body. ## Example @@ -76,14 +90,15 @@ If successful, this method returns 200 - Ok response code and the updated Machin Here is an example of a request that adds machine tag. -[!include[Improve request performance](../../includes/improve-request-performance.md)] - ``` -POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/tags -Content-type: application/json +POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/tags +``` + +```json { "Value" : "test Tag 2", "Action": "Add" } +``` -- To remove machine tag, set the Action to 'Remove' instead of 'Add' in the request body. \ No newline at end of file +- To remove machine tag, set the Action to 'Remove' instead of 'Add' in the request body. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md index c372c8f63a..0230069f42 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md @@ -4,7 +4,7 @@ description: Turn on advanced features such as block file in Microsoft Defender keywords: advanced features, settings, block file, automated investigation, auto-resolve, skype, azure atp, office 365, azure information protection, intune search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,21 +13,31 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Configure advanced features in Microsoft Defender ATP +# Configure advanced features in Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink) -Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Microsoft Defender ATP with. +Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Defender for Endpoint with. -Use the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations: +## Enable advanced features + +1. In the navigation pane, select **Preferences setup** > **Advanced features**. +2. Select the advanced feature you want to configure and toggle the setting between **On** and **Off**. +3. Click **Save preferences**. + +Use the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations. ## Automated investigation @@ -35,10 +45,16 @@ Turn on this feature to take advantage of the automated investigation and remedi ## Live response -Turn on this feature so that users with the appropriate permissions can start a live response session on machines. +Turn on this feature so that users with the appropriate permissions can start a live response session on devices. For more information about role assignments, see [Create and manage roles](user-roles.md). +## Live response for servers +Turn on this feature so that users with the appropriate permissions can start a live response session on servers. + +For more information about role assignments, see [Create and manage roles](user-roles.md). + + ## Live response unsigned script execution Enabling this feature allows you to run unsigned scripts in a live response session. @@ -52,17 +68,17 @@ For tenants created on or after Windows 10, version 1809 the automated investiga >[!NOTE] > ->- The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. +>- The result of the auto-resolve action may influence the Device risk level calculation which is based on the active alerts found on a device. >- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it. ## Allow or block file Blocking is only available if your organization fulfills these requirements: -- Uses Windows Defender Antivirus as the active antimalware solution and, +- Uses Microsoft Defender Antivirus as the active antimalware solution and, - The cloud-based protection feature is enabled -This feature enables you to block potentially malicious files in your network. Blocking a file will prevent it from being read, written, or executed on machines in your organization. +This feature enables you to block potentially malicious files in your network. Blocking a file will prevent it from being read, written, or executed on devices in your organization. To turn **Allow or block** files on: @@ -80,12 +96,12 @@ After turning on this feature, you can [block files](respond-file-alerts.md#allo Turning on this feature allows you to create indicators for IP addresses, domains, or URLs, which determine whether they will be allowed or blocked based on your custom indicator list. -To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834). +To use this feature, devices must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834). For more information, see [Manage indicators](manage-indicators.md). >[!NOTE] ->Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Microsoft Defender ATP data. +>Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Defender for Endpoint data. ## Show user details @@ -93,7 +109,7 @@ Turn on this feature so that you can see user details stored in Azure Active Dir - Security operations dashboard - Alert queue -- Machine details page +- Device details page For more information, see [Investigate a user account](investigate-user.md). @@ -102,22 +118,51 @@ For more information, see [Investigate a user account](investigate-user.md). Enabling the Skype for Business integration gives you the ability to communicate with users using Skype for Business, email, or phone. This can be handy when you need to communicate with the user and mitigate risks. >[!NOTE] -> When a machine is being isolated from the network, there's a pop-up where you can choose to enable Outlook and Skype communications which allows communications to the user while they are disconnected from the network. This setting applies to Skype and Outlook communication when machines are in isolation mode. +> When a device is being isolated from the network, there's a pop-up where you can choose to enable Outlook and Skype communications which allows communications to the user while they are disconnected from the network. This setting applies to Skype and Outlook communication when devices are in isolation mode. ## Azure Advanced Threat Protection integration -The integration with Azure Advanced Threat Protection allows you to pivot directly into another Microsoft Identity security product. Azure Advanced Threat Protection augments an investigation with additional insights about a suspected compromised account and related resources. By enabling this feature, you'll enrich the machine-based investigation capability by pivoting across the network from an identify point of view. +The integration with Azure Advanced Threat Protection allows you to pivot directly into another Microsoft Identity security product. Azure Advanced Threat Protection augments an investigation with additional insights about a suspected compromised account and related resources. By enabling this feature, you'll enrich the device-based investigation capability by pivoting across the network from an identify point of view. >[!NOTE] >You'll need to have the appropriate license to enable this feature. +## Office 365 Threat Intelligence connection + +This feature is only available if you have an active Office 365 E5 or the Threat Intelligence add-on. For more information, see the Office 365 Enterprise E5 product page. + +When you turn this feature on, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a comprehensive security investigation across Office 365 mailboxes and Windows devices. + +>[!NOTE] +>You'll need to have the appropriate license to enable this feature. + +To receive contextual device integration in Office 365 Threat Intelligence, you'll need to enable the Defender for Endpoint settings in the Security & Compliance dashboard. For more information, see [Office 365 Threat Intelligence overview](https://support.office.com/en-us/article/Office-365-Threat-Intelligence-overview-32405DA5-BEE1-4A4B-82E5-8399DF94C512). + +## Microsoft Threat Experts + +Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability. Experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Defender for Endpoint portal's alerts dashboard and via email if you configure it. + +>[!NOTE] +>The Microsoft Threat Experts capability in Defender for Endpoint is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security). + +## Microsoft Cloud App Security + +Enabling this setting forwards Defender for Endpoint signals to Microsoft Cloud App Security to provide deeper visibility into cloud application usage. Forwarded data is stored and processed in the same location as your Cloud App Security data. + +>[!NOTE] +>This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on devices running Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441)), Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464)), Windows 10, version 1809 (OS Build 17763.379 with [KB4489899](https://support.microsoft.com/help/4489899)) or later Windows 10 versions. + +## Azure Information Protection + +Turning on this setting allows signals to be forwarded to Azure Information Protection. It gives data owners and administrators visibility into protected data on onboarded devices and device risk ratings. + ## Microsoft Secure Score Forwards Microsoft Defender ATP signals to Microsoft Secure Score in the Microsoft 365 security center. Turning on this feature gives Microsoft Secure Score visibility into the devices security posture. Forwarded data is stored and processed in the same location as the your Microsoft Secure Score data. ### Enable the Microsoft Defender ATP integration from the Azure ATP portal -To receive contextual machine integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal. +To receive contextual device integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal. 1. Log in to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role. @@ -125,43 +170,14 @@ To receive contextual machine integration in Azure ATP, you'll also need to enab 3. Toggle the Integration setting to **On** and click **Save**. -After completing the integration steps on both portals, you'll be able to see relevant alerts in the machine details or user details page. - -## Office 365 Threat Intelligence connection - -This feature is only available if you have an active Office 365 E5 or the Threat Intelligence add-on. For more information, see the Office 365 Enterprise E5 product page. - -When you turn this feature on, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a comprehensive security investigation across Office 365 mailboxes and Windows machines. - ->[!NOTE] ->You'll need to have the appropriate license to enable this feature. - -To receive contextual machine integration in Office 365 Threat Intelligence, you'll need to enable the Microsoft Defender ATP settings in the Security & Compliance dashboard. For more information, see [Office 365 Threat Intelligence overview](https://support.office.com/en-us/article/Office-365-Threat-Intelligence-overview-32405DA5-BEE1-4A4B-82E5-8399DF94C512). - -## Microsoft Threat Experts - -Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability. Experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it. - ->[!NOTE] ->The Microsoft Threat Experts capability in Microsoft Defender ATP is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security). - -## Microsoft Cloud App Security - -Enabling this setting forwards Microsoft Defender ATP signals to Microsoft Cloud App Security to provide deeper visibility into cloud application usage. Forwarded data is stored and processed in the same location as your Cloud App Security data. - ->[!NOTE] ->This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441)), Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464)), Windows 10, version 1809 (OS Build 17763.379 with [KB4489899](https://support.microsoft.com/help/4489899)) or later Windows 10 versions. - -## Azure Information Protection - -Turning on this setting allows signals to be forwarded to Azure Information Protection. It gives data owners and administrators visibility into protected data on onboarded machines and machine risk ratings. +After completing the integration steps on both portals, you'll be able to see relevant alerts in the device details or user details page. ## Microsoft Intune connection -Microsoft Defender ATP can be integrated with [Microsoft Intune](https://docs.microsoft.com/intune/what-is-intune) to [enable device risk-based conditional access](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). When you [turn on this feature](configure-conditional-access.md), you'll be able to share Microsoft Defender ATP device information with Intune, enhancing policy enforcement. +Defender for Endpoint can be integrated with [Microsoft Intune](https://docs.microsoft.com/intune/what-is-intune) to [enable device risk-based conditional access](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). When you [turn on this feature](configure-conditional-access.md), you'll be able to share Defender for Endpoint device information with Intune, enhancing policy enforcement. >[!IMPORTANT] ->You'll need to enable the integration on both Intune and Microsoft Defender ATP to use this feature. For more information on specific steps, see [Configure Conditional Access in Microsoft Defender ATP](configure-conditional-access.md). +>You'll need to enable the integration on both Intune and Defender for Endpoint to use this feature. For more information on specific steps, see [Configure Conditional Access in Defender for Endpoint](configure-conditional-access.md). This feature is only available if you have the following: @@ -177,18 +193,18 @@ When you enable Intune integration, Intune will automatically create a classic C ## Preview features -Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience. +Learn about new features in the Defender for Endpoint preview release and be among the first to try upcoming features by turning on the preview experience. You'll have access to upcoming features, which you can provide feedback on to help improve the overall experience before features are generally available. -## Enable advanced features +## Share endpoint alerts with Microsoft Compliance Center -1. In the navigation pane, select **Preferences setup** > **Advanced features**. -2. Select the advanced feature you want to configure and toggle the setting between **On** and **Off**. -3. Click **Save preferences**. +Forwards endpoint security alerts and their triage status to Microsoft Compliance Center, allowing you to enhance insider risk management policies with alerts and remediate internal risks before they cause harm. Forwarded data is processed and stored in the same location as your Office 365 data. + +After configuring the [Security policy violation indicators](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management-settings.md#indicators) in the insider risk management settings, Defender for Endpoint alerts will be shared with insider risk management for applicable users. ## Related topics - [Update data retention settings](data-retention-settings.md) - [Configure alert notifications](configure-email-notifications.md) -- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports.md) + diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-assignedipaddress-function.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-assignedipaddress-function.md new file mode 100644 index 0000000000..2d0e83a1c6 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-assignedipaddress-function.md @@ -0,0 +1,81 @@ +--- +title: AssignedIPAddresses() function in advanced hunting for Microsoft Defender Advanced Threat Protection +description: Learn how to use the AssignedIPAddresses() function to get the latest IP addresses assigned to a device +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, Windows Defender, Windows Defender ATP, Windows Defender Advanced Threat Protection, search, query, telemetry, schema reference, kusto, FileProfile, file profile, function, enrichment +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 09/20/2020 +ms.technology: mde +--- + +# AssignedIPAddresses() + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +Use the `AssignedIPAddresses()` function in your advanced hunting queries to quickly obtain the latest IP addresses that have been assigned to a device. If you specify a timestamp argument, this function obtains the most recent IP addresses at the specified time. + +This function returns a table with the following columns: + +Column | Data type | Description +-|-|- +`Timestamp` | datetime | Latest time when the device was observed using the IP address +`IPAddress` | string | IP address used by the device +`IPType` | string | Indicates whether the IP address is a public or private address +`NetworkAdapterType` | int | Network adapter type used by the device that has been assigned the IP address. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype) +`ConnectedNetworks` | int | Networks that the adapter with the assigned IP address is connected to. Each JSON array contains the network name, category (public, private, or domain), a description, and a flag indicating if it's connected publicly to the internet + +## Syntax + +```kusto +AssignedIPAddresses(x, y) +``` + +## Arguments + +- **x**—`DeviceId` or `DeviceName` value identifying the device +- **y**—`Timestamp` (datetime) value instructing the function to obtain the most recent assigned IP addresses from a specific time. If not specified, the function returns the latest IP addresses. + +## Examples + +### Get the list of IP addresses used by a device 24 hours ago + +```kusto +AssignedIPAddresses('example-device-name', ago(1d)) +``` + +### Get IP addresses used by a device and find devices communicating with it + +This query uses the `AssignedIPAddresses()` function to get assigned IP addresses for the device (`example-device-name`) on or before a specific date (`example-date`). It then uses the IP addresses to find connections to the device initiated by other devices. + +```kusto +let Date = datetime(example-date); +let DeviceName = "example-device-name"; +// List IP addresses used on or before the specified date +AssignedIPAddresses(DeviceName, Date) +| project DeviceName, IPAddress, AssignedTime = Timestamp +// Get all network events on devices with the assigned IP addresses as the destination addresses +| join kind=inner DeviceNetworkEvents on $left.IPAddress == $right.RemoteIP +// Get only network events around the time the IP address was assigned +| where Timestamp between ((AssignedTime - 1h) .. (AssignedTime + 1h)) +``` + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index 7209a654db..d287cdbb3b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -1,10 +1,10 @@ --- title: Query best practices for advanced hunting description: Learn how to construct fast, efficient, and error-free threat hunting queries when using advanced hunting -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, avoid timeout, command lines, process id +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, avoid timeout, command lines, process id search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,19 +13,25 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: m365-security-compliance ms.topic: article +ms.technology: mde --- # Advanced hunting query best practices -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-abovefoldlink) +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-abovefoldlink) ## Optimize query performance -Apply these recommendations to get results faster and avoid timeouts while running complex queries. + +Apply these recommendations to get results faster and avoid timeouts while running complex queries. + - When trying new queries, always use `limit` to avoid extremely large result sets. You can also initially assess the size of the result set using `count`. - Use time filters first. Ideally, limit your queries to seven days. - Put filters that are expected to remove most of the data in the beginning of the query, right after the time filter. @@ -40,7 +46,8 @@ Apply these recommendations to get results faster and avoid timeouts while runni ## Query tips and pitfalls ### Queries with process IDs -Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the machine identifier (either `DeviceId` or `DeviceName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`). + +Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific device, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the device identifier (either `DeviceId` or `DeviceName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`). The following example query finds processes that access more than 10 IP addresses over port 445 (SMB), possibly scanning for file shares. @@ -54,6 +61,7 @@ DeviceNetworkEvents The query summarizes by both `InitiatingProcessId` and `InitiatingProcessCreationTime` so that it looks at a single process, without mixing multiple processes with the same process ID. ### Queries with command lines + Command lines can vary. When applicable, filter on file names and do fuzzy matching. There are numerous ways to construct a command line to accomplish a task. For example, an attacker could reference an image file with or without a path, without a file extension, using environment variables, or with quotes. In addition, the attacker could also change the order of parameters or add multiple quotes and spaces. @@ -84,9 +92,12 @@ DeviceProcessEvents | where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc" ``` ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-belowfoldlink) +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-belowfoldlink) ## Related topics + - [Advanced hunting overview](advanced-hunting-overview.md) - [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) \ No newline at end of file +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Work with query results](advanced-hunting-query-results.md) +- [Custom detections overview](overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md index 50d1242878..e3c67bd93e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md @@ -1,10 +1,10 @@ --- title: DeviceAlertEvents table in the advanced hunting schema description: Learn about alert generation events in the DeviceAlertEvents table of the advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, DeviceAlertEvents, alert, severity, category +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, DeviceAlertEvents, alert, severity, category search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,18 +13,22 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 01/22/2020 +ms.technology: mde --- # DeviceAlertEvents +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The `DeviceAlertEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts in Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. @@ -34,8 +38,8 @@ For information on other tables in the advanced hunting schema, see [the advance |-------------|-----------|-------------| | `AlertId` | string | Unique identifier for the alert | | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `Severity` | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | | `Category` | string | Type of threat indicator or breach activity identified by the alert | | `Title` | string | Title of the alert | @@ -43,10 +47,11 @@ For information on other tables in the advanced hunting schema, see [the advance | `SHA1` | string | SHA-1 of the file that the recorded action was applied to | | `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | | `RemoteIP` | string | IP address that was being connected to | +| `AttackTechniques` | string | MITRE ATT&CK techniques associated with the activity that triggered the alert | | `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | | `Table` | string | Table that contains the details of the event | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) - [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) \ No newline at end of file +- [Understand the schema](advanced-hunting-schema-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index 8956d5c3a9..71741e06aa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -4,7 +4,7 @@ description: Learn about antivirus, firewall, and other event types in the misce keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard, MiscEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,27 +13,31 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceEvents +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The miscellaneous device events or `DeviceEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The miscellaneous device events or `DeviceEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Microsoft Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `ActionType` | string | Type of activity that triggered the event | | `FileName` | string | Name of the file that the recorded action was applied to | | `FolderPath` | string | Folder containing the file that the recorded action was applied to | @@ -44,19 +48,19 @@ For information on other tables in the advanced hunting schema, see [the advance | `AccountName` |string | User name of the account | | `AccountSid` | string | Security Identifier (SID) of the account | | `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | -| `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | +| `RemoteDeviceName` | string | Name of the device that performed a remote operation on the affected device. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | | `ProcessId` | int | Process ID (PID) of the newly created process | | `ProcessCommandLine` | string | Command line used to create the new process | | `ProcessCreationTime` | datetime | Date and time the process was created | | `ProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | -| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same device only between restarts | | `RegistryKey` | string | Registry key that the recorded action was applied to | | `RegistryValueName` | string | Name of the registry value that the recorded action was applied to | | `RegistryValueData` | string | Data of the registry value that the recorded action was applied to | | `RemoteIP` | string | IP address that was being connected to | | `RemotePort` | int | TCP port on the remote device that was being connected to | -| `LocalIP` | string | IP address assigned to the local machine used during communication | -| `LocalPort` | int | TCP port on the local machine used during communication | +| `LocalIP` | string | IP address assigned to the local device used during communication | +| `LocalPort` | int | TCP port on the local device used during communication | | `FileOriginUrl` | string | URL where the file was downloaded from | | `FileOriginIP` | string | IP address where the file was downloaded from | | `AdditionalFields` | string | Additional information about the event in JSON array format | @@ -74,7 +78,7 @@ For information on other tables in the advanced hunting schema, see [the advance | `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | | `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | | `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts | +| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same device only between restarts | | `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | | `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md new file mode 100644 index 0000000000..d3f4b6a040 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfo-table.md @@ -0,0 +1,62 @@ +--- +title: DeviceFileCertificateInfo table in the advanced hunting schema +description: Learn about file signing information in the DeviceFileCertificateInfo table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, digital signature, certificate, file signing, DeviceFileCertificateInfo +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 01/14/2020 +ms.technology: mde +--- + +# DeviceFileCertificateInfo + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The `DeviceFileCertificateInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file signing certificates. This table uses data obtained from certificate verification activities regularly performed on files on endpoints. + +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `IsSigned` | boolean | Indicates whether the file is signed | +| `SignatureType` | string | Indicates whether signature information was read as embedded content in the file itself or read from an external catalog file | +| `Signer` | string | Information about the signer of the file | +| `SignerHash` | string | Unique hash value identifying the signer | +| `Issuer` | string | Information about the issuing certificate authority (CA) | +| `IssuerHash` | string | Unique hash value identifying issuing certificate authority (CA) | +| `CertificateSerialNumber` | string | Identifier for the certificate that is unique to the issuing certificate authority (CA) | +| `CrlDistributionPointUrls` | string | JSON array listing the URLs of network shares that contain certificates and certificate revocation lists (CRLs) | +| `CertificateCreationTime` | datetime | Date and time the certificate was created | +| `CertificateExpirationTime` | datetime | Date and time the certificate is set to expire | +| `CertificateCountersignatureTime` | datetime | Date and time the certificate was countersigned | +| `IsTrusted` | boolean | Indicates whether the file is trusted based on the results of the WinVerifyTrust function, which checks for unknown root certificate information, invalid signatures, revoked certificates, and other questionable attributes | +| `IsRootSignerMicrosoft` | boolean | Indicates whether the signer of the root certificate is Microsoft | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns. | + + +## Related topics +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md deleted file mode 100644 index f386c93d96..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md +++ /dev/null @@ -1,60 +0,0 @@ ---- -title: DeviceFileCertificateInfoBeta table in the advanced hunting schema -description: Learn about file signing information in the DeviceFileCertificateInfoBeta table of the advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, digital signature, certificate, file signing, DeviceFileCertificateInfoBeta -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: lomayor -author: lomayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 01/14/2020 ---- - -# DeviceFileCertificateInfoBeta - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) - -[!include[Prerelease information](../../includes/prerelease.md)] - -The `DeviceFileCertificateInfoBeta` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file signing certificates. This table uses data obtained from certificate verification activities regularly performed on files on endpoints. - -For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). - -| Column name | Data type | Description | -|-------------|-----------|-------------| -| `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | -| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | -| `IsSigned` | boolean | Indicates whether the file is signed | -| `SignatureType` | string | Indicates whether signature information was read as embedded content in the file itself or read from an external catalog file | -| `Signer` | string | Information about the signer of the file | -| `SignerHash` | string | Unique hash value identifying the signer | -| `Issuer` | string | Information about the issuing certificate authority (CA) | -| `IssuerHash` | string | Unique hash value identifying issuing certificate authority (CA) | -| `CertificateSerialNumber` | string | Identifier for the certificate that is unique to the issuing certificate authority (CA) | -| `CrlDistributionPointUrls` | string | JSON array listing the URLs of network shares that contain certificates and certificate revocation lists (CRLs) | -| `CertificateCreationTime` | datetime | Date and time the certificate was created | -| `CertificateExpirationTime` | datetime | Date and time the certificate is set to expire | -| `CertificateCountersignatureTime` | datetime | Date and time the certificate was countersigned | -| `IsTrusted` | boolean | Indicates whether the file is trusted based on the results of the WinVerifyTrust function, which checks for unknown root certificate information, invalid signatures, revoked certificates, and other questionable attributes | -| `IsRootSignerMicrosoft` | boolean | Indicates whether the signer of the root certificate is Microsoft | -| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns. | - - -## Related topics -- [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md index 53faa19f58..e80863221a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md @@ -1,10 +1,10 @@ --- -title: DeviceFileEvents table in the advanced hunting schema +title: DeviceFileEvents table in the advanced hunting schema description: Learn about file-related events in the DeviceFileEvents table of the advanced hunting schema keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicefileevents, files, path, hash, sha1, sha256, md5, FileCreationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,17 +13,21 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceFileEvents +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The `DeviceFileEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. @@ -32,8 +36,8 @@ For information on other tables in the advanced hunting schema, see [the advanc | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `ActionType` | string | Type of activity that triggered the event | | `FileName` | string | Name of the file that the recorded action was applied to | | `FolderPath` | string | Folder containing the file that the recorded action was applied to | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md index b9c338f0c1..6a341b969b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md @@ -4,7 +4,7 @@ description: Learn about DLL loading events in the DeviceImageLoadEvents table o keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceimageloadevents, DLL loading, library, file image, ImageLoadEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,17 +13,21 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceImageLoadEvents +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The `DeviceImageLoadEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. @@ -32,8 +36,8 @@ For information on other tables in the advanced hunting schema, see [the advance | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `ActionType` | string | Type of activity that triggered the event | | `FileName` | string | Name of the file that the recorded action was applied to | | `FolderPath` | string | Folder containing the file that the recorded action was applied to | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md index e51b88cf9a..8f18931852 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md @@ -1,10 +1,10 @@ --- title: DeviceInfo table in the advanced hunting schema -description: Learn about OS, computer name, and other machine information in the DeviceInfo table of the advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, machine, OS, platform, users, MachineInfo +description: Learn about OS, computer name, and other device information in the DeviceInfo table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, OS, platform, users, DeviceInfo search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,37 +13,41 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceInfo +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. +The `DeviceInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about devices in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | -| `ClientVersion` | string | Version of the endpoint agent or sensor running on the machine | -| `PublicIP` | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | -| `OSArchitecture` | string | Architecture of the operating system running on the machine | -| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 | -| `OSBuild` | string | Build version of the operating system running on the machine | -| `IsAzureADJoined` | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | -| `LoggedOnUsers` | string | List of all users that are logged on the machine at the time of the event in JSON array format | -| `RegistryDeviceTag` | string | Machine tag added through the registry | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | +| `ClientVersion` | string | Version of the endpoint agent or sensor running on the device | +| `PublicIP` | string | Public IP address used by the onboarded device to connect to the Defender for Endpoint service. This could be the IP address of the device itself, a NAT device, or a proxy | +| `OSArchitecture` | string | Architecture of the operating system running on the device | +| `OSPlatform` | string | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 | +| `OSBuild` | string | Build version of the operating system running on the device | +| `IsAzureADJoined` | boolean | Boolean indicator of whether device is joined to the Azure Active Directory | +| `LoggedOnUsers` | string | List of all users that are logged on the device at the time of the event in JSON array format | +| `RegistryDeviceTag` | string | Device tag added through the registry | | `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| `OSVersion` | string | Version of the operating system running on the machine | +| `OSVersion` | string | Version of the operating system running on the device | | `MachineGroup` | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md index 9814bdbe14..7f162f6d82 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md @@ -4,7 +4,7 @@ description: Learn about authentication or sign-in events in the DeviceLogonEven keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicelogonevents, authentication, logon, sign in, LogonEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,34 +13,42 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceLogonEvents +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The `DeviceLogonEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. +> [!NOTE] +> Collection of DeviceLogonEvents is not supported on Windows 7 or Windows Server 2008 R2. +> We recommend upgrading to Windows 10 or Windows Server 2019 for optimal visibility into user logon activity. + For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `ActionType` | string |Type of activity that triggered the event | | `AccountDomain` | string | Domain of the account | | `AccountName` | string | User name of the account | | `AccountSid` | string | Security Identifier (SID) of the account | -| `LogonType` | string | Type of logon session, specifically:

    - **Interactive** - User physically interacts with the machine using the local keyboard and screen

    - **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

    - **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

    - **Batch** - Session initiated by scheduled tasks

    - **Service** - Session initiated by services as they start
    | -| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | +| `LogonType` | string | Type of logon session, specifically:

    - **Interactive** - User physically interacts with the device using the local keyboard and screen

    - **Remote interactive (RDP) logons** - User interacts with the device remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

    - **Network** - Session initiated when the device is accessed using PsExec or when shared resources on the device, such as printers and shared folders, are accessed

    - **Batch** - Session initiated by scheduled tasks

    - **Service** - Session initiated by services as they start
    | +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same device only between restarts | +| `RemoteDeviceName` | string | Name of the device that performed a remote operation on the affected device. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | | `RemoteIP` | string | IP address that was being connected to | | `RemoteIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | | `RemotePort` | int | TCP port on the remote device that was being connected to | @@ -63,9 +71,9 @@ For information on other tables in the advanced hunting schema, see [the advance | `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | | `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | | `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | -| `IsLocalAdmin` | boolean | Boolean indicator of whether the user is a local administrator on the machine | +| `IsLocalAdmin` | boolean | Boolean indicator of whether the user is a local administrator on the device | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) - [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) \ No newline at end of file +- [Understand the schema](advanced-hunting-schema-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md index 17ba4f7f0d..cf5f540d22 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md @@ -4,7 +4,7 @@ description: Learn about network connection events you can query from the Device keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, network connection, remote ip, local ip, NetworkCommunicationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,17 +13,21 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceNetworkEvents +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The `DeviceNetworkEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. @@ -32,14 +36,14 @@ For information on other tables in the advanced hunting schema, see [the advance | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `ActionType` | string | Type of activity that triggered the event | | `RemoteIP` | string | IP address that was being connected to | | `RemotePort` | int | TCP port on the remote device that was being connected to | | `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | -| `LocalIP` | string | IP address assigned to the local machine used during communication | -| `LocalPort` | int | TCP port on the local machine used during communication | +| `LocalIP` | string | IP address assigned to the local device used during communication | +| `LocalPort` | int | TCP port on the local device used during communication | | `Protocol` | string | IP protocol used, whether TCP or UDP | | `LocalIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | | `RemoteIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | @@ -64,4 +68,4 @@ For information on other tables in the advanced hunting schema, see [the advance ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) - [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) \ No newline at end of file +- [Understand the schema](advanced-hunting-schema-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md index 2e84b08364..3983f87831 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md @@ -1,10 +1,10 @@ --- title: DeviceNetworkInfo table in the advanced hunting schema description: Learn about network configuration information in the DeviceNetworkInfo table of the advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel, MachineNetworkInfo +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, device, mac, ip, adapter, dns, dhcp, gateway, tunnel, DeviceNetworkInfo search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,32 +13,36 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceNetworkInfo +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceNetworkInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. +The `DeviceNetworkInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of devices, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | | `NetworkAdapterName` | string | Name of the network adapter | | `MacAddress` | string | MAC address of the network adapter | -| `NetworkAdapterType` | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) | -| `NetworkAdapterStatus` | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) | +| `NetworkAdapterType` | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2&preserve-view=true) | +| `NetworkAdapterStatus` | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2&preserve-view=true) | | `TunnelType` | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH | | `ConnectedNetworks` | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet | | `DnsAddresses` | string | DNS server addresses in JSON array format | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md index 6fdba4c948..eff542c7ae 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md @@ -4,7 +4,7 @@ description: Learn about the process spawning or creation events in the DevicePr keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceprocessevents, process id, command line, ProcessCreationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,17 +13,21 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceProcessEvents +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The `DeviceProcessEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. @@ -32,8 +36,8 @@ For information on other tables in the advanced hunting schema, see [the advance | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `ActionType` | string | Type of activity that triggered the event | | `FileName` | string | Name of the file that the recorded action was applied to | | `FolderPath` | string | Folder containing the file that the recorded action was applied to | @@ -48,11 +52,11 @@ For information on other tables in the advanced hunting schema, see [the advance | `AccountDomain` | string | Domain of the account | | `AccountName` | string | User name of the account | | `AccountSid` | string | Security Identifier (SID) of the account | -| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same device only between restarts | | `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | | `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | | `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. | +| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same device only between restarts. | | `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | | `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | | `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md index c0b36b2df8..8e3b625f9b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md @@ -4,7 +4,7 @@ description: Learn about registry events you can query from the DeviceRegistryEv keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceregistryevents, registry, key, subkey, value, RegistryEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,17 +13,21 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # DeviceRegistryEvents +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The `DeviceRegistryEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. @@ -32,8 +36,8 @@ For information on other tables in the advanced hunting schema, see [the advance | Column name | Data type | Description | |-------------|-----------|-------------| | `Timestamp` | datetime | Date and time when the event was recorded | -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | | `ActionType` | string | Type of activity that triggered the event | | `RegistryKey` | string | Registry key that the recorded action was applied to | | `RegistryValueType` | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md new file mode 100644 index 0000000000..7030a063ab --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md @@ -0,0 +1,58 @@ +--- +title: DeviceTvmSecureConfigurationAssessment table in the advanced hunting schema +description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the Advanced hunting schema. These events provide device information as well as security configuration details, impact, and compliance information. +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# DeviceTvmSecureConfigurationAssessment + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +[!include[Prerelease information](../../includes/prerelease.md)] + +Each row in the `DeviceTvmSecureConfigurationAssessment` table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant. + +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | +| `OSPlatform` | string | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| +| `Timestamp` | datetime |Date and time when the record was generated | +| `ConfigurationId` | string | Unique identifier for a specific configuration | +| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls | +| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | +| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) | +| `IsCompliant` | boolean | Indicates whether the configuration or policy is properly configured | +| `IsApplicable` | boolean | Indicates whether the configuration or policy applies to the device | +| `Context` | string | Additional contextual information about the configuration or policy | +| `IsExpectedUserImpactCompliant` | boolean | Indicates whether there will be user impact if the configuration or policy is applied | + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md new file mode 100644 index 0000000000..7238db9c90 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md @@ -0,0 +1,56 @@ +--- +title: DeviceTvmSecureConfigurationAssessmentKB table in the advanced hunting schema +description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the Advanced hunting schema. +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# DeviceTvmSecureConfigurationAssessmentKB + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +[!include[Prerelease information](../../includes/prerelease.md)] + +The `DeviceTvmSecureConfigurationAssessmentKB` table in the advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table. + +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| `ConfigurationId` | string | Unique identifier for a specific configuration | +| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) | +| `ConfigurationName` | string | Display name of the configuration | +| `ConfigurationDescription` | string | Description of the configuration | +| `RiskDescription` | string | Description of the associated risk | +| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| +| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | +| `ConfigurationBenchmarks` | string | List of industry benchmarks recommending the same or similar configuration | +| `RelatedMitreTechniques` | string | List of Mitre ATT&CK framework techniques related to the configuration | +| `RelatedMitreTactics ` | string | List of Mitre ATT&CK framework tactics related to the configuration | + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md new file mode 100644 index 0000000000..c4e032f3e4 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md @@ -0,0 +1,59 @@ +--- +title: DeviceTvmSoftwareInventoryVulnerabilities table in the advanced hunting schema +description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the advanced hunting schema. +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# DeviceTvmSoftwareInventoryVulnerabilities + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + + +[!include[Prerelease information](../../includes/prerelease.md)] + +The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table. + +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| `DeviceId` | string | Unique identifier for the device in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the device | +| `OSPlatform` | string | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | +| `OSVersion` | string | Version of the operating system running on the device | +| `OSArchitecture` | string | Architecture of the operating system running on the device | +| `SoftwareVendor` | string | Name of the software vendor | +| `SoftwareName` | string | Name of the software product | +| `SoftwareVersion` | string | Version number of the software product | +| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | +| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | + + + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md new file mode 100644 index 0000000000..7c4190748d --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md @@ -0,0 +1,54 @@ +--- +title: DeviceTvmSoftwareVulnerabilitiesKB table in the advanced hunting schema +description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the advanced hunting schema. +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# DeviceTvmSoftwareVulnerabilitiesKB + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +[!include[Prerelease information](../../includes/prerelease.md)] + +The `DeviceTvmSoftwareVulnerabilitiesKB` table in the advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table. + +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | +| `CvssScore` | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) | +| `IsExploitAvailable` | boolean | Indicates whether exploit code for the vulnerability is publicly available | +| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | +| `LastModifiedTime` | datetime | Date and time the item or related metadata was last modified | +| `PublishedDate` | datetime | Date vulnerability was disclosed to public | +| `VulnerabilityDescription` | string | Description of vulnerability and associated risks | +| `AffectedSoftware` | string | List of all software products affected by the vulnerability | + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md new file mode 100644 index 0000000000..2a99d2648b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-errors.md @@ -0,0 +1,47 @@ +--- +title: Handle errors in advanced hunting for Microsoft Defender ATP +description: Understand errors displayed when using advanced hunting +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, m365, search, query, telemetry, schema, kusto, timeout, resources, errors, unknown error +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# Handle advanced hunting errors + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) + + +Advanced hunting displays errors to notify for syntax mistakes and whenever queries hit [predefined limits](advanced-hunting-limits.md). Refer to the table below for tips on how to resolve or avoid errors. + +| Error type | Cause | Resolution | Error message examples | +|--|--|--|--| +| Syntax errors | The query contains unrecognized names, including references to nonexistent operators, columns, functions, or tables. | Ensure references to [Kusto operators and functions](https://docs.microsoft.com/azure/data-explorer/kusto/query/) are correct. Check [the schema](advanced-hunting-schema-reference.md) for the correct advanced hunting columns, functions, and tables. Enclose variable strings in quotes so they are recognized. While writing your queries, use the autocomplete suggestions from IntelliSense. | `A recognition error occurred.` | +| Semantic errors | While the query uses valid operator, column, function, or table names, there are errors in its structure and resulting logic. In some cases, advanced hunting identifies the specific operator that caused the error. | Check for errors in the structure of query. Refer to [Kusto documentation](https://docs.microsoft.com/azure/data-explorer/kusto/query/) for guidance. While writing your queries, use the autocomplete suggestions from IntelliSense. | `'project' operator: Failed to resolve scalar expression named 'x'`| +| Timeouts | A query can only run within a [limited period before timing out](advanced-hunting-limits.md). This error can happen more frequently when running complex queries. | [Optimize the query](advanced-hunting-best-practices.md) | `Query exceeded the timeout period.` | +| CPU throttling | Queries in the same tenant have exceeded the [CPU resources](advanced-hunting-limits.md) that have been allocated based on tenant size. | The service checks CPU resource usage every 15 minutes and daily and displays warnings after usage exceeds 10% of the allocated limit. If you reach 100% utilization, the service blocks queries until after the next daily or 15-minute cycle. [Optimize your queries to avoid hitting CPU limits](advanced-hunting-best-practices.md) | - `This query used X% of your organization's allocated resources for the current 15 minutes.`
    - `You have exceeded processing resources allocated to this tenant. You can run queries again in .` | +| Result size limit exceeded | The aggregate size of the result set for the query has exceeded the maximum limit. This error can occur if the result set is so large that truncation at the 10,000-record limit can't reduce it to an acceptable size. Results that have multiple columns with sizable content are more likely to be impacted by this error. | [Optimize the query](advanced-hunting-best-practices.md) | `Result size limit exceeded. Use "summarize" to aggregate results, "project" to drop uninteresting columns, or "take" to truncate results.` | +| Excessive resource consumption | The query has consumed excessive amounts of resources and has been stopped from completing. In some cases, advanced hunting identifies the specific operator that wasn't optimized. | [Optimize the query](advanced-hunting-best-practices.md) | -`Query stopped due to excessive resource consumption.`
    -`Query stopped. Adjust use of the operator to avoid excessive resource consumption.` | +| Unknown errors | The query failed because of an unknown reason. | Try running the query again. Contact Microsoft through the portal if queries continue to return unknown errors. | `An unexpected error occurred during query execution. Please try again in a few minutes.` + +## Related topics +- [Advanced hunting best practices](advanced-hunting-best-practices.md) +- [Service limits](advanced-hunting-limits.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Kusto Query Language overview](https://docs.microsoft.com/azure/data-explorer/kusto/query/) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-extend-data.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-extend-data.md new file mode 100644 index 0000000000..0b15378b40 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-extend-data.md @@ -0,0 +1,49 @@ +--- +title: Extend advanced hunting coverage with the right settings +description: Check auditing settings on Windows devices and other settings to help ensure that you get the most comprehensive data in advanced hunting +keywords: advanced hunting, incident, pivot, entity, audit settings, user account management, security group management, threat hunting, cyber threat hunting, search, query, telemetry, mdatp, Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, Windows Defender, Windows Defender ATP, Windows Defender Advanced Threat Protection +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 10/10/2020 +ms.technology: mde +--- + +# Extend advanced hunting coverage with the right settings + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +[Advanced hunting](advanced-hunting-overview.md) relies on data coming from across your organization. To get the most comprehensive data possible, ensure that you have the correct settings in the corresponding data sources. + +## Advanced security auditing on Windows devices + +Turn on these advanced auditing settings to ensure you get data about activities on your devices, including local account management, local security group management, and service creation. + +Data | Description | Schema table | How to configure +-|-|-|- +Account management | Events captured as various `ActionType` values indicating local account creation, deletion, and other account-related activities | [DeviceEvents](advanced-hunting-deviceevents-table.md) | - Deploy an advanced security audit policy: [Audit User Account Management](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-user-account-management)
    - [Learn about advanced security audit policies](https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing) +Security group management | Events captured as various `ActionType` values indicating local security group creation and other local group management activities | [DeviceEvents](advanced-hunting-deviceevents-table.md) | - Deploy an advanced security audit policy: [Audit Security Group Management](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-security-group-management)
    - [Learn about advanced security audit policies](https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing) +Service installation | Events captured with the `ActionType` value `ServiceInstalled`, indicating that a service has been created | [DeviceEvents](advanced-hunting-deviceevents-table.md) | - Deploy an advanced security audit policy: [Audit Security System Extension](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-security-system-extension)
    - [Learn about advanced security audit policies](https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing) + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Work with query results](advanced-hunting-query-results.md) +- [Apply query best practices](advanced-hunting-best-practices.md) +- [Custom detections overview](overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-fileprofile-function.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-fileprofile-function.md new file mode 100644 index 0000000000..bea6b0caac --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-fileprofile-function.md @@ -0,0 +1,86 @@ +--- +title: FileProfile() function in advanced hunting for Microsoft Defender Advanced Threat Protection +description: Learn how to use the FileProfile() to enrich information about files in your advanced hunting query results +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, Windows Defender, Windows Defender ATP, Windows Defender Advanced Threat Protection, search, query, telemetry, schema reference, kusto, FileProfile, file profile, function, enrichment +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 09/20/2020 +ms.technology: mde +--- + +# FileProfile() + +**Applies to:** + +- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +The `FileProfile()` function is an enrichment function in [advanced hunting](advanced-hunting-overview.md) that adds the following data to files found by the query. + +Column | Data type | Description +-|-|- +SHA1 | string | SHA-1 of the file that the recorded action was applied to +SHA256 | string | SHA-256 of the file that the recorded action was applied to +MD5 | string | MD5 hash of the file that the recorded action was applied to +FileSize | int | Size of the file in bytes +GlobalPrevalence | int | Number of instances of the entity observed by Microsoft globally +GlobalFirstSeen | datetime | Date and time when the entity was first observed by Microsoft globally +GlobalLastSeen | datetime | Date and time when the entity was last observed by Microsoft globally +Signer | string | Information about the signer of the file +Issuer | string | Information about the issuing certificate authority (CA) +SignerHash | string | Unique hash value identifying the signer +IsCertificateValid | boolean | Whether the certificate used to sign the file is valid +IsRootSignerMicrosoft | boolean | Indicates whether the signer of the root certificate is Microsoft +IsExecutable | boolean | Whether the file is a Portable Executable (PE) file +ThreatName | string | Detection name for any malware or other threats found +Publisher | string | Name of the organization that published the file +SoftwareName | string | Name of the software product + +## Syntax + +```kusto +invoke FileProfile(x,y) +``` + +## Arguments + +- **x** — file ID column to use: `SHA1`, `SHA256`, `InitiatingProcessSHA1` or `InitiatingProcessSHA256`; function uses `SHA1` if unspecified +- **y** — limit to the number of records to enrich, 1-1000; function uses 100 if unspecified + +## Examples + +### Project only the SHA1 column and enrich it + +```kusto +DeviceFileEvents +| where isnotempty(SHA1) and Timestamp > ago(1d) +| take 10 +| project SHA1 +| invoke FileProfile() +``` + +### Enrich the first 500 records and list low-prevalence files + +```kusto +DeviceFileEvents +| where ActionType == "FileCreated" and Timestamp > ago(1d) +| project CreatedOn = Timestamp, FileName, FolderPath, SHA1 +| invoke FileProfile("SHA1", 500) +| where GlobalPrevalence < 15 +``` + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-go-hunt.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-go-hunt.md new file mode 100644 index 0000000000..f340f5f99e --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-go-hunt.md @@ -0,0 +1,108 @@ +--- +title: Get relevant info about an entity with go hunt +description: Learn how to use the go hunt tool to quickly query for relevant information about an entity or event using advanced hunting. +keywords: advanced hunting, incident, pivot, entity, go hunt, relevant events, threat hunting, cyber threat hunting, search, query, telemetry, Microsoft Threat Protection +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# Quickly hunt for entity or event information with go hunt + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +With the *go hunt* action, you can quickly investigate events and various entity types using powerful query-based [advanced hunting](advanced-hunting-overview.md) capabilities. This action automatically runs an advanced hunting query to find relevant information about the selected event or entity. + +The *go hunt* action is available in various sections of the security center whenever event or entity details are displayed. For example, you can use *go hunt* from the following sections: + +- In the [incident page](investigate-incidents.md), you can review details about users, devices, and many other entities associated with an incident. When you select an entity, you get additional information as well as various actions you could take on that entity. In the example below, a device is selected, showing details about the device as well the option to hunt for more information about the device. + + ![Image showing device details with the go hunt option](./images/go-hunt-device.png) + +- In the incident page, you can also access a list of entities under the evidence tab. Selecting one of those entities provides an option to quickly hunt for information about that entity. + + ![Image showing selected url with the go hunt option in the Evidence tab](./images/go-hunt-evidence-url.png) + +- When viewing the timeline for a device, you can select an event in the timeline to view additional information about that event. Once an event is selected, you get the option to hunt for other relevant events in advanced hunting. + + ![Image showing event details with the go hunt option](./images/go-hunt-event.png) + +Selecting **Go hunt** or **Hunt for related events** passes different queries, depending on whether you've selected an entity or an event. + +## Query for entity information + +When using *go hunt* to query for information about a user, device, or any other type of entity, the query checks all relevant schema tables for any events involving that entity. To keep the results manageable, the query is scoped to around the same time period as the earliest activity in the past 30 days that involves the entity and is associated with the incident. + +Here is an example of the go hunt query for a device: + +```kusto +let selectedTimestamp = datetime(2020-06-02T02:06:47.1167157Z); +let deviceName = "fv-az770.example.com"; +let deviceId = "device-guid"; +search in (DeviceLogonEvents, DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceRegistryEvents, DeviceImageLoadEvents, DeviceEvents, DeviceImageLoadEvents, IdentityLogonEvents, IdentityQueryEvents) +Timestamp between ((selectedTimestamp - 1h) .. (selectedTimestamp + 1h)) +and DeviceName == deviceName +// or RemoteDeviceName == deviceName +// or DeviceId == deviceId +| take 100 +``` + +### Supported entity types + +You can use *go hunt* after selecting any of these entity types: + +- Files +- Users +- Devices +- IP addresses +- URLs + +## Query for event information + +When using *go hunt* to query for information about a timeline event, the query checks all relevant schema tables for other events around the time of the selected event. For example, the following query lists events in various schema tables that occurred around the same time period on the same device: + +```kusto +// List relevant events 30 minutes before and after selected RegistryValueSet event +let selectedEventTimestamp = datetime(2020-10-06T21:40:25.3466868Z); +search in (DeviceFileEvents, DeviceProcessEvents, DeviceEvents, DeviceRegistryEvents, DeviceNetworkEvents, DeviceImageLoadEvents, DeviceLogonEvents) + Timestamp between ((selectedEventTimestamp - 30m) .. (selectedEventTimestamp + 30m)) + and DeviceId == "a305b52049c4658ec63ae8b55becfe5954c654a4" +| sort by Timestamp desc +| extend Relevance = iff(Timestamp == selectedEventTimestamp, "Selected event", iff(Timestamp < selectedEventTimestamp, "Earlier event", "Later event")) +| project-reorder Relevance +``` + +## Adjust the query + +With some knowledge of the [query language](advanced-hunting-query-language.md), you can adjust the query to your preference. For example, you can adjust this line, which determines the size of the time window: + +```kusto +Timestamp between ((selectedTimestamp - 1h) .. (selectedTimestamp + 1h)) +``` + +In addition to modifying the query to get more relevant results, you can also: + +- [View the results as charts](advanced-hunting-query-results.md#view-query-results-as-a-table-or-chart) +- [Create a custom detection rule](custom-detection-rules.md) + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Work with query results](advanced-hunting-query-results.md) +- [Custom detection rules](custom-detection-rules.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md new file mode 100644 index 0000000000..65059297a7 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-limits.md @@ -0,0 +1,49 @@ +--- +title: Advanced hunting limits in Microsoft Defender ATP +description: Understand various service limits that keep the advanced hunting service responsive +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, search, query, telemetry, schema, kusto, CPU limit, query limit, resources, maximum results +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# Advanced hunting service limits + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) + +To keep the service performant and responsive, advanced hunting sets various limits for queries run manually and by [custom detection rules](custom-detection-rules.md). Refer to the following table to understand these limits. + +| Limit | Size | Refresh cycle | Description | +|--|--|--|--| +| Data range | 30 days | Every query | Each query can look up data from up to the past 30 days. | +| Result set | 10,000 rows | Every query | Each query can return up to 10,000 records. | +| Timeout | 10 minutes | Every query | Each query can run for up to 10 minutes. If it does not complete within 10 minutes, the service displays an error. +| CPU resources | Based on tenant size | - On the hour and then every 15 minutes
    - Daily at 12 midnight | The service enforces the daily and the 15-minute limit separately. For each limit, the [portal displays an error](advanced-hunting-errors.md) whenever a query runs and the tenant has consumed over 10% of allocated resources. Queries are blocked if the tenant has reached 100% until after the next daily or 15-minute cycle. | + +>[!NOTE] +>A separate set of limits apply to advanced hunting queries performed through the API. [Read about advanced hunting APIs](run-advanced-query-api.md) + +Customers who run multiple queries regularly should track consumption and [apply optimization best practices](advanced-hunting-best-practices.md) to minimize disruption resulting from exceeding these limits. + +## Related topics + +- [Advanced hunting best practices](advanced-hunting-best-practices.md) +- [Handle advanced hunting errors](advanced-hunting-errors.md) +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Custom detections rules](custom-detection-rules.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 0a28ea14cd..40e92ba327 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -1,10 +1,10 @@ --- title: Overview of advanced hunting in Microsoft Defender ATP description: Use threat hunting capabilities in Microsoft Defender ATP to build queries that find threats and weaknesses in your network -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp, search, query, telemetry, custom detections, schema, kusto +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, search, query, telemetry, custom detections, schema, kusto, time zone, UTC search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,42 +13,64 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Proactively hunt for threats with advanced hunting + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) -Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate interesting indicators and entities. The flexible access to data facilitates unconstrained hunting for both known and potential threats. +Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate threat indicators and entities. The flexible access to data enables unconstrained hunting for both known and potential threats. -You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines. - -## Get started with advanced hunting Watch this video for a quick overview of advanced hunting and a short tutorial that will get you started fast. -

    +
    +
    > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo] -You can also go through each of the following steps to ramp up your advanced hunting knowledge. +You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and then respond to suspected breach activity, misconfigured machines, and other findings. + +>[!TIP] +>Use [advanced hunting in Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/advanced-hunting-overview) to hunt for threats using data from Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Cloud App Security, and Microsoft Defender for Identity. [Turn on Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-enable) + +## Get started with advanced hunting + +Go through the following steps to ramp up your advanced hunting knowledge. + +We recommend going through several steps to quickly get up and running with advanced hunting. | Learning goal | Description | Resource | |--|--|--| -| **Get a feel for the language** | Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting-query-language.md) | +| **Learn the language** | Advanced hunting is based on [Kusto query language](https://docs.microsoft.com/azure/kusto/query/), supporting the same syntax and operators. Start learning the query language by running your first query. | [Query language overview](advanced-hunting-query-language.md) | | **Learn how to use the query results** | Learn about charts and various ways you can view or export your results. Explore how you can quickly tweak queries and drill down to get richer information. | [Work with query results](advanced-hunting-query-results.md) | -| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. This will help you determine where to look for data and how to construct your queries. | [Schema reference](advanced-hunting-schema-reference.md) | +| **Understand the schema** | Get a good, high-level understanding of the tables in the schema and their columns. Learn where to look for data when constructing your queries. | [Schema reference](advanced-hunting-schema-reference.md) | | **Use predefined queries** | Explore collections of predefined queries covering different threat hunting scenarios. | [Shared queries](advanced-hunting-shared-queries.md) | -| **Learn about custom detections** | Understand how you can use advanced hunting queries to trigger alerts and apply response actions automatically. | - [Custom detections overview](overview-custom-detections.md)
    - [Custom detection rules](custom-detection-rules.md) | +| **Optimize queries and handle errors** | Understand how to create efficient and error-free queries. | - [Query best practices](advanced-hunting-best-practices.md)
    - [Handle errors](advanced-hunting-errors.md) | +| **Get the most complete coverage** | Use audit settings to provide better data coverage for your organization. | - [Extend advanced hunting coverage](advanced-hunting-extend-data.md) | +| **Run a quick investigation** | Quickly run an advanced hunting query to investigate suspicious activity. | - [Quickly hunt for entity or event information with *go hunt*](advanced-hunting-go-hunt.md) | +| **Contain threats and address compromises** | Respond to attacks by quarantining files, restricting app execution, and other actions | - [Take action on advanced hunting query results](advanced-hunting-take-action.md) | +| **Create custom detection rules** | Understand how you can use advanced hunting queries to trigger alerts and take response actions automatically. | - [Custom detections overview](overview-custom-detections.md)
    - [Custom detection rules](custom-detection-rules.md) | -## Get help as you write queries -Take advantage of the following functionality to write queries faster: -- **Autosuggest** — as you write queries, advanced hunting provides suggestions from IntelliSense. -- **Schema reference** — a schema reference that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor. +## Data freshness and update frequency + +Advanced hunting data can be categorized into two distinct types, each consolidated differently. + +- **Event or activity data**—populates tables about alerts, security events, system events, and routine assessments. Advanced hunting receives this data almost immediately after the sensors that collect them successfully transmit them to Defender for Endpoint. +- **Entity data**—populates tables with consolidated information about users and devices. This data comes from both relatively static data sources and dynamic sources, such as Active Directory entries and event logs. To provide fresh data, tables are updated with any new information every 15 minutes, adding rows that might not be fully populated. Every 24 hours, data is consolidated to insert a record that contains the latest, most comprehensive data set about each entity. + +## Time zone + +Time information in advanced hunting is currently in the UTC time zone. ## Related topics + - [Learn the query language](advanced-hunting-query-language.md) - [Work with query results](advanced-hunting-query-results.md) - [Use shared queries](advanced-hunting-shared-queries.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md index 3570732cf5..b8df669734 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md @@ -1,10 +1,10 @@ --- title: Learn the advanced hunting query language description: Create your first threat hunting query and learn about common operators and other aspects of the advanced hunting query language -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, language, learn, first query, telemetry, events, telemetry, custom detections, schema, kusto, operators, data types +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, language, learn, first query, telemetry, events, telemetry, custom detections, schema, kusto, operators, data types search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,18 +13,21 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Learn the advanced hunting query language +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) -Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-schema-reference.md) specifically structured for advanced hunting. To understand these concepts better, run your first query. +Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto operators and statements to construct queries that locate information in a specialized [schema](advanced-hunting-schema-reference.md). To understand these concepts better, run your first query. ## Try your first query @@ -49,26 +52,21 @@ union DeviceProcessEvents, DeviceNetworkEvents FileName, ProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, RemoteIPType | top 100 by Timestamp ``` - -This is how it will look like in advanced hunting. - -![Image of Microsoft Defender ATP advanced hunting query](images/advanced-hunting-query-example-2.png) - +**[Run this query in advanced hunting](https://securitycenter.windows.com/hunting?query=H4sIAAAAAAAEAI2TT0vDQBDF5yz4HUJPFcTqyZsXqyCIBFvxKNGWtpo_NVlbC8XP7m8mado0K5Zls8nkzdu3b2Z70pNAbmUmqYyk4D2UTJYyllwGMmWNGQHrN_NNvsSBzUBrbMFMiWieAx3xDEBl4GL4AuNd8B0bNgARENcdUmIZ3yM5liPwac3bN-YZPGPU5ET1rWDc7Ox4uod8YDp4MzI-GkjlX4Ne2nly0zEkKzFWh4ZE5sSuTN8Ehq5couvEMnvmUAhez-HsRBMipVa_W_OG6vEfGtT12JRHpqV064e1Kx04NsxFzXxW1aFjp_djXmDRPbfY3XMMcLogTz2bWZ2KqmIJI6q6wKe2WYnrRsa9KVeU9kCBBo2v7BzPxF_Bx2DKiqh63SGoRoc6Njti48z_yL71XHQAcgAur6rXRpcqH3l-4knZF23Utsbq2MircEqmw-G__xR1TdZ1r7zb7XLezmx3etkvGr-ze6NdGdW92azUfpcdluWvr-aqbh_nofnqcWI3aYyOsBV7giduRUO7187LMKTT5rxvHHX80_t8IeeMgLquvL7-Ak3q-kz8BAAA&runQuery=true&timeRangeId=week)** ### Describe the query and specify the tables to search -A short comment has been added to the beginning of the query to describe what it is for. This helps if you later decide to save the query and share it with others in your organization. +A short comment has been added to the beginning of the query to describe what it is for. This comment helps if you later decide to save the query and share it with others in your organization. ```kusto // Finds PowerShell execution events that could involve a download ``` - -The query itself will typically start with a table name followed by a series of elements started by a pipe (`|`). In this example, we start by creating a union of two tables, `DeviceProcessEvents` and `DeviceNetworkEvents`, and add piped elements as needed. +The query itself will typically start with a table name followed by several elements that start with a pipe (`|`). In this example, we start by creating a union of two tables, `DeviceProcessEvents` and `DeviceNetworkEvents`, and add piped elements as needed. ```kusto union DeviceProcessEvents, DeviceNetworkEvents ``` ### Set the time range -The first piped element is a time filter scoped to the previous seven days. Keeping the time range as narrow as possible ensures that queries perform well, return manageable results, and don't time out. +The first piped element is a time filter scoped to the previous seven days. Limiting the time range helps ensure that queries perform well, return manageable results, and don't time out. ```kusto | where Timestamp > ago(7d) @@ -77,7 +75,7 @@ The first piped element is a time filter scoped to the previous seven days. Keep ### Check specific processes The time range is immediately followed by a search for process file names representing the PowerShell application. -``` +```kusto // Pivoting on PowerShell processes | where FileName in~ ("powershell.exe", "powershell_ise.exe") ``` @@ -98,7 +96,7 @@ Afterwards, the query looks for strings in command lines that are typically used ``` ### Customize result columns and length -Now that your query clearly identifies the data you want to locate, you can add elements that define what the results look like. `project` returns specific columns, and `top` limits the number of results. These operators help ensure the results are well-formatted and reasonably large and easy to process. +Now that your query clearly identifies the data you want to locate, you can define what the results look like. `project` returns specific columns, and `top` limits the number of results. These operators help ensure the results are well-formatted and reasonably large and easy to process. ```kusto | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, @@ -106,7 +104,7 @@ FileName, ProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, RemoteIPType | top 100 by Timestamp ``` -Click **Run query** to see the results. Select the expand icon at the top right of the query editor to focus on your hunting query and the results. +Select **Run query** to see the results. Use the expand icon at the top right of the query editor to focus on your hunting query and the results. ![Image of the Expand control in the advanced hunting query editor](images/advanced-hunting-expand.png) @@ -115,7 +113,7 @@ Click **Run query** to see the results. Select the expand icon at the top right ## Learn common query operators for advanced hunting -Now that you've run your first query and have a general idea of its components, it's time to backtrack a little bit and learn some basics. The Kusto query language used by advanced hunting supports a range of operators, including the following common ones. +You've just run your first query and have a general idea of its components. It's time to backtrack slightly and learn some basics. The Kusto query language used by advanced hunting supports a range of operators, including the following common ones. | Operator | Description and usage | |--|--| @@ -134,24 +132,43 @@ To see a live example of these operators, run them from the **Get started** sect ## Understand data types -Data in advanced hunting tables are generally classified into the following data types. +Advanced hunting supports Kusto data types, including the following common types: | Data type | Description and query implications | |--|--| -| `datetime` | Data and time information typically representing event timestamps | -| `string` | Character string | -| `bool` | True or false | -| `int` | 32-bit numeric value | -| `long` | 64-bit numeric value | +| `datetime` | Data and time information typically representing event timestamps. [See supported datetime formats](https://docs.microsoft.com/azure/data-explorer/kusto/query/scalar-data-types/datetime) | +| `string` | Character string in UTF-8 enclosed in single quotes (`'`) or double quotes (`"`). [Read more about strings](https://docs.microsoft.com/azure/data-explorer/kusto/query/scalar-data-types/string) | +| `bool` | This data type supports `true` or `false` states. [See supported literals and operators](https://docs.microsoft.com/azure/data-explorer/kusto/query/scalar-data-types/bool) | +| `int` | 32-bit integer | +| `long` | 64-bit integer | + +To learn more about these data types, [read about Kusto scalar data types](https://docs.microsoft.com/azure/data-explorer/kusto/query/scalar-data-types/). + +## Get help as you write queries +Take advantage of the following functionality to write queries faster: + +- **Autosuggest**—as you write queries, advanced hunting provides suggestions from IntelliSense. +- **Schema tree**—a schema representation that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor. +- **[Schema reference](advanced-hunting-schema-reference.md#get-schema-information-in-the-security-center)**—in-portal reference with table and column descriptions as well as supported event types (`ActionType` values) and sample queries + +## Work with multiple queries in the editor +You can use the query editor to experiment with multiple queries. To use multiple queries: + +- Separate each query with an empty line. +- Place the cursor on any part of a query to select that query before running it. This will run only the selected query. To run another query, move the cursor accordingly and select **Run query**. + +![Image of the advanced hunting query editor with multiple queries](images/ah-multi-query.png) +_Query editor with multiple queries_ + ## Use sample queries The **Get started** section provides a few simple queries using commonly used operators. Try running these queries and making small modifications to them. -![Image of advanced hunting window](images/atp-advanced-hunting.png) +![Image of the advanced hunting get started tab](images/atp-advanced-hunting.png) > [!NOTE] -> Apart from the basic query samples, you can also access [shared queries](advanced-hunting-shared-queries.md) for specific threat hunting scenarios. Explore the shared queries on the left side of the page or the GitHub query repository. +> Apart from the basic query samples, you can also access [shared queries](advanced-hunting-shared-queries.md) for specific threat hunting scenarios. Explore the shared queries on the left side of the page or the [GitHub query repository](https://aka.ms/hunting-queries). ## Access comprehensive query language reference @@ -160,7 +177,6 @@ For detailed information about the query language, see [Kusto query language doc ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) - [Work with query results](advanced-hunting-query-results.md) +- [Use shared queries](advanced-hunting-shared-queries.md) - [Understand the schema](advanced-hunting-schema-reference.md) - [Apply query best practices](advanced-hunting-best-practices.md) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md index 2ac9237205..3d01e56992 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md @@ -1,10 +1,10 @@ --- title: Work with advanced hunting query results in Microsoft Defender ATP description: Make the most of the query results returned by advanced hunting in Microsoft Defender ATP -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, visualization, chart, filters, drill down +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, visualization, chart, filters, drill down search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,18 +13,20 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Work with advanced hunting query results +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) - -[!INCLUDE [Prerelease information](../../includes/prerelease.md)] +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) While you can construct your [advanced hunting](advanced-hunting-overview.md) queries to return very precise information, you can also work with the query results to gain further insight and investigate specific activities and indicators. You can take the following actions on your query results: @@ -77,8 +79,8 @@ These results are best visualized using a stacked column chart: ![Image of advanced hunting query results displayed as a stacked chart](images/advanced-hunting-stacked-chart.jpg) *Query results for alerts by OS and severity displayed as a stacked chart* -#### Top ten machine groups with alerts -If you're dealing with a list of values that isn’t finite, you can use the `Top` operator to chart only the values with the most instances. For example, to get the top ten machine groups with the most alerts, use the query below: +#### Top ten device groups with alerts +If you're dealing with a list of values that isn’t finite, you can use the `Top` operator to chart only the values with the most instances. For example, to get the top ten device groups with the most alerts, use the query below: ```kusto DeviceAlertEvents @@ -89,7 +91,7 @@ DeviceAlertEvents Use the pie chart view to effectively show distribution across the top groups: ![Image of advanced hunting query results displayed as a pie chart](images/advanced-hunting-pie-chart.jpg) -*Pie chart showing distribution of alerts across machine groups* +*Pie chart showing distribution of alerts across device groups* #### Malware detections over time Using the `summarize` operator with the `bin()` function, you can check for events involving a particular indicator over time. The query below counts detections of an EICAR test file at 30 minute intervals to show spikes in detections of that file: @@ -113,7 +115,13 @@ After running a query, select **Export** to save the results to local file. Your - **Any chart** — the query results are exported as a JPEG image of the rendered chart ## Drill down from query results -To view more information about entities, such as machines, files, users, IP addresses, and URLs, in your query results, simply click the entity identifier. This opens a detailed profile page for the selected entity. +To view more information about entities, such as devices, files, users, IP addresses, and URLs, in your query results, simply click the entity identifier. This opens a detailed profile page for the selected entity. + +To quickly inspect a record in your query results, select the corresponding row to open the Inspect record panel. The panel provides the following information based on the selected record: + +- **Assets** — A summarized view of the main assets (mailboxes, devices, and users) found in the record, enriched with available information, such as risk and exposure levels +- **Process tree** — A chart generated for records with process information and enriched using available contextual information; in general, queries that return more columns can result in richer process trees. +- **All details** — Lists all the values from the columns in the record ## Tweak your queries from the results Right-click a value in the result set to quickly enhance your query. You can use the options to: @@ -125,9 +133,9 @@ Right-click a value in the result set to quickly enhance your query. You can use ![Image of advanced hunting result set](images/advanced-hunting-results-filter.png) ## Filter the query results -The filters displayed to the right provide a summary of the result set. Each column has its own section that lists the distinct values found for that column and the number of instances. +The filters displayed in the right pane provide a summary of the result set. Every column has its own section in the pane, each of which lists the values found in that column, and the number of instances. -Refine your query by selecting the `+` or `-` buttons on the values that you want to include or exclude and then selecting **Run query**. +Refine your query by selecting the `+` or `-` buttons on the values that you want to include or exclude. Then select **Run query**. ![Image of advanced hunting filter](images/advanced-hunting-filter.png) @@ -139,4 +147,4 @@ Once you apply the filter to modify the query and then run the query, the result - [Use shared queries](advanced-hunting-shared-queries.md) - [Understand the schema](advanced-hunting-schema-reference.md) - [Apply query best practices](advanced-hunting-best-practices.md) -- [Custom detections overview](overview-custom-detections.md) \ No newline at end of file +- [Custom detections overview](overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index e90dbf5e55..05d0ff1e4e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -1,10 +1,10 @@ --- title: Advanced hunting schema reference -description: Learn about the tables in the advanced hunting schema to understand the data you can run threat hunting queries on -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, data +description: Learn about the tables in the advanced hunting schema to understand the data you can run threat hunting queries on. +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, data search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,23 +13,40 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 01/14/2020 +ms.technology: mde --- # Understand the advanced hunting schema -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) [!include[Prerelease information](../../includes/prerelease.md)] -The [advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema. +The [advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about devices and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema. -## Schema tables +## Get schema information in the security center +While constructing queries, use the built-in schema reference to quickly get the following information about each table in the schema: + +- **Tables description**—type of data contained in the table and the source of that data. +- **Columns**—all the columns in the table. +- **Action types**—possible values in the `ActionType` column representing the event types supported by the table. This is provided only for tables that contain event information. +- **Sample query**—example queries that feature how the table can be utilized. + +### Access the schema reference +To quickly access the schema reference, select the **View reference** action next to the table name in the schema representation. You can also select **Schema reference** to search for a table. + +![Image showing how to access in-portal schema reference](images/ah-reference.png) + +## Learn the schema tables The following reference lists all the tables in the advanced hunting schema. Each table name links to a page describing the column names for that table. @@ -38,22 +55,26 @@ Table and column names are also listed within the Microsoft Defender Security Ce | Table name | Description | |------------|-------------| | **[DeviceAlertEvents](advanced-hunting-devicealertevents-table.md)** | Alerts on Microsoft Defender Security Center | -| **[DeviceInfo](advanced-hunting-deviceinfo-table.md)** | Machine information, including OS information | -| **[DeviceNetworkInfo](advanced-hunting-devicenetworkinfo-table.md)** | Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains | +| **[DeviceInfo](advanced-hunting-deviceinfo-table.md)** | Device information, including OS information | +| **[DeviceNetworkInfo](advanced-hunting-devicenetworkinfo-table.md)** | Network properties of devices, including adapters, IP and MAC addresses, as well as connected networks and domains | | **[DeviceProcessEvents](advanced-hunting-deviceprocessevents-table.md)** | Process creation and related events | | **[DeviceNetworkEvents](advanced-hunting-devicenetworkevents-table.md)** | Network connection and related events | | **[DeviceFileEvents](advanced-hunting-devicefileevents-table.md)** | File creation, modification, and other file system events | | **[DeviceRegistryEvents](advanced-hunting-deviceregistryevents-table.md)** | Creation and modification of registry entries | | **[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)** | Sign-ins and other authentication events | | **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events | -| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | -| **[DeviceFileCertificateInfoBeta](advanced-hunting-devicefilecertificateinfobeta-table.md)** | Certificate information of signed files obtained from certificate verification events on endpoints | -| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products | -| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available | -| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices | -| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-tvm-secureconfigkb-table.md)** | Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks | +| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection | +| **[DeviceFileCertificateInfo](advanced-hunting-devicefilecertificateinfo-table.md)** | Certificate information of signed files obtained from certificate verification events on endpoints | +| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products | +| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available | +| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-devicetvmsecureconfigurationassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices | +| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)** | Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks | + ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) -- [Work with query results](advanced-hunting-query-results.md) - [Learn the query language](advanced-hunting-query-language.md) +- [Work with query results](advanced-hunting-query-results.md) +- [Apply query best practices](advanced-hunting-best-practices.md) +- [Custom detections overview](overview-custom-detections.md) +- [Advanced hunting data schema changes](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/ba-p/1043914) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md index de3d5741a4..36e806bc85 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md @@ -1,10 +1,10 @@ --- title: Use shared queries in advanced hunting description: Start threat hunting immediately with predefined and shared queries. Share your queries to the public or to your organization. -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, github repo, my queries, shared queries +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, github repo, my queries, shared queries search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,16 +13,20 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Use shared queries in advanced hunting -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) [Advanced hunting](advanced-hunting-overview.md) queries can be shared among users in the same organization. You can also find queries shared publicly on GitHub. These queries let you quickly pursue specific threat hunting scenarios without having to write queries from scratch. @@ -40,7 +44,7 @@ You can save a new or existing query so that it is only accessible to you or sha ![Image of saving a query](images/advanced-hunting-save-query.png) 4. Select the folder where you'd like to save the query. - - **Shared queries** — shared to all users in the your organization + - **Shared queries** — shared to all users in your organization - **My queries** — accessible only to you 5. Select **Save**. @@ -52,6 +56,9 @@ You can save a new or existing query so that it is only accessible to you or sha 2. Select **Delete** and confirm deletion. Or select **Rename** and provide a new name for the query. +## Create a direct link to a query +To generate a link that opens your query directly in the advanced hunting query editor, finalize your query and select **Share link**. + ## Access queries in the GitHub repository Microsoft security researchers regularly share advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). @@ -60,4 +67,8 @@ Microsoft security researchers regularly share advanced hunting queries in a [de ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the query language](advanced-hunting-query-language.md) \ No newline at end of file +- [Learn the query language](advanced-hunting-query-language.md) +- [Work with query results](advanced-hunting-query-results.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Apply query best practices](advanced-hunting-best-practices.md) +- [Custom detections overview](overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-take-action.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-take-action.md new file mode 100644 index 0000000000..f1e57a9b92 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-take-action.md @@ -0,0 +1,85 @@ +--- +title: Take action on advanced hunting query results in Microsoft Threat Protection +description: Quickly address threats and affected assets in your advanced hunting query results +keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, avoid timeout, command lines, process id +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 09/20/2020 +ms.technology: mde +--- + +# Take action on advanced hunting query results + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + + +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +You can quickly contain threats or address compromised assets that you find in [advanced hunting](advanced-hunting-overview.md) using powerful and comprehensive action options. With these options, you can: + +- Take various actions on devices +- Quarantine files + +## Required permissions + +To be able to take action through advanced hunting, you need a role in Defender for Endpoint with [permissions to submit remediation actions on devices](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#permission-options). If you can't take action, contact a global administrator about getting the following permission: + +*Active remediation actions > Threat and vulnerability management - Remediation handling* + +## Take various actions on devices + +You can take the following actions on devices identified by the `DeviceId` column in your query results: + +- Isolate affected devices to contain an infection or prevent attacks from moving laterally +- Collect investigation package to obtain more forensic information +- Run an antivirus scan to find and remove threats using the latest security intelligence updates +- Initiate an automated investigation to check and remediate threats on the device and possibly other affected devices +- Restrict app execution to only Microsoft-signed executable files, preventing subsequent threat activity through malware or other untrusted executables + +To learn more about how these response actions are performed through Defender for Endpoint, [read about response actions on devices](respond-machine-alerts.md). + +## Quarantine files + +You can deploy the *quarantine* action on files so that they are automatically quarantined when encountered. When selecting this action, you can choose between the following columns to identify which files in your query results to quarantine: + +- `SHA1` — In most advanced hunting tables, this is the SHA-1 of the file that was affected by the recorded action. For example, if a file was copied, this would be the copied file. +- `InitiatingProcessSHA1` — In most advanced hunting tables, this is the file responsible for initiating the recorded action. For example, if a child process was launched, this would be the parent process. +- `SHA256` — This is the SHA-256 equivalent of the file identified by the `SHA1` column. +- `InitiatingProcessSHA256` — This is the SHA-256 equivalent of the file identified by the `InitiatingProcessSHA1` column. + +To learn more about how quarantine actions are taken and how files can be restored, [read about response actions on files](respond-file-alerts.md). + +>[!NOTE] +>To locate files and quarantine them, the query results should also include `DeviceId` values as device identifiers. + +## Take action + +To take any of the described actions, select one or more records in your query results and then select **Take actions**. A wizard will guide you through the process of selecting and then submitting your preferred actions. + +![Image of selected record with panel for inspecting the record](images/ah-take-actions.png) + +## Review actions taken + +Each action is individually recorded in the action center, under **Action center** > **History** ([security.microsoft.com/action-center/history](https://security.microsoft.com/action-center/history)). Go to the action center to check the status of each action. + +## Related topics + +- [Advanced hunting overview](advanced-hunting-overview.md) +- [Learn the query language](advanced-hunting-query-language.md) +- [Understand the schema](advanced-hunting-schema-reference.md) +- [Work with query results](advanced-hunting-query-results.md) +- [Apply query best practices](advanced-hunting-best-practices.md) +- [Custom detections overview](overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md deleted file mode 100644 index 7900a4dce4..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: DeviceTvmSecureConfigurationAssessment table in the advanced hunting schema -description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the Advanced hunting schema. These events provide machine information as well as security configuration details, impact, and compliance information. -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 11/12/2019 ---- - -# DeviceTvmSecureConfigurationAssessment - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) - -[!include[Prerelease information](../../includes/prerelease.md)] - -Each row in the `DeviceTvmSecureConfigurationAssessment` table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant. - -For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). - -| Column name | Data type | Description | -|-------------|-----------|-------------| -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | -| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| -| `Timestamp` | datetime |Date and time when the record was generated | -| `ConfigurationId` | string | Unique identifier for a specific configuration | -| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls | -| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | -| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) | -| `IsCompliant` | boolean | Indicates whether the configuration or policy is properly configured | - - -## Related topics - -- [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) -- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md deleted file mode 100644 index c5a3a9fbda..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: DeviceTvmSecureConfigurationAssessmentKB table in the advanced hunting schema -description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the Advanced hunting schema. -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 11/12/2019 ---- - -# DeviceTvmSecureConfigurationAssessmentKB - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) - -[!include[Prerelease information](../../includes/prerelease.md)] - -The `DeviceTvmSecureConfigurationAssessmentKB` table in the advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table. - -For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). - -| Column name | Data type | Description | -|-------------|-----------|-------------| -| `ConfigurationId` | string | Unique identifier for a specific configuration | -| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) | -| `ConfigurationName` | string | Display name of the configuration | -| `ConfigurationDescription` | string | Description of the configuration | -| `RiskDescription` | string | Description of the associated risk | -| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| -| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | -| `ConfigurationBenchmarks` | string | List of industry benchmarks recommending the same or similar configuration | -| `RelatedMitreTechniques` | string | List of Mitre ATT&CK framework techniques related to the configuration | -| `RelatedMitreTactics ` | string | List of Mitre ATT&CK framework tactics related to the configuration | - -## Related topics - -- [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) -- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md deleted file mode 100644 index 0dcf6e3af5..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: DeviceTvmSoftwareInventoryVulnerabilities table in the advanced hunting schema -description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the advanced hunting schema. -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 11/12/2019 ---- - -# DeviceTvmSoftwareInventoryVulnerabilities - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) - - -[!include[Prerelease information](../../includes/prerelease.md)] - -The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table. - -For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). - -| Column name | Data type | Description | -|-------------|-----------|-------------| -| `DeviceId` | string | Unique identifier for the machine in the service | -| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | -| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | -| `OSVersion` | string | Version of the operating system running on the machine | -| `OSArchitecture` | string | Architecture of the operating system running on the machine | -| `SoftwareVendor` | string | Name of the software vendor | -| `SoftwareName` | string | Name of the software product | -| `SoftwareVersion` | string | Version number of the software product | -| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | -| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | - - - -## Related topics - -- [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) -- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md deleted file mode 100644 index 5af1cfe1f1..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: DeviceTvmSoftwareVulnerabilitiesKB table in the advanced hunting schema -description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the advanced hunting schema. -keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 11/12/2019 ---- - -# DeviceTvmSoftwareVulnerabilitiesKB - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) - -[!include[Prerelease information](../../includes/prerelease.md)] - -The `DeviceTvmSoftwareVulnerabilitiesKB` table in the advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table. - -For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). - -| Column name | Data type | Description | -|-------------|-----------|-------------| -| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | -| `CvssScore` | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) | -| `IsExploitAvailable` | boolean | Indicates whether exploit code for the vulnerability is publicly available | -| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | -| `LastModifiedTime` | datetime | Date and time the item or related metadata was last modified | -| `PublishedDate` | datetime | Date vulnerability was disclosed to public | -| `VulnerabilityDescription` | string | Description of vulnerability and associated risks | -| `AffectedSoftware` | string | List of all software products affected by the vulnerability | - -## Related topics - -- [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the query language](advanced-hunting-query-language.md) -- [Understand the schema](advanced-hunting-schema-reference.md) -- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response.md b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response.md index 0f5c27cc7e..6c96b5ea1e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response.md @@ -5,7 +5,7 @@ description: View and manage the alerts surfaced in Microsoft Defender Security keywords: search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,13 +14,17 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/03/2018 +ms.technology: mde --- # Alerts queue in Microsoft Defender Security Center -Learn how you can view and manage the queue so that you can effectively investigate threats seen on entities such as machines, files, or user accounts. + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +Learn how you can view and manage the queue so that you can effectively investigate threats seen on entities such as devices, files, or user accounts. ## In this section @@ -30,9 +34,9 @@ Topic | Description [Manage alerts](manage-alerts.md) | Learn about how you can manage alerts such as change its status, assign it to a security operations member, and see the history of an alert. [Investigate alerts](investigate-alerts.md)| Investigate alerts that are affecting your network, understand what they mean, and how to resolve them. [Investigate files](investigate-files.md)| Investigate the details of a file associated with a specific alert, behaviour, or event. -[Investigate machines](investigate-machines.md)| Investigate the details of a machine associated with a specific alert, behaviour, or event. -[Investigate an IP address](investigate-ip.md) | Examine possible communication between machines in your network and external internet protocol (IP) addresses. -[Investigate a domain](investigate-domain.md) | Investigate a domain to see if machines and servers in your network have been communicating with a known malicious domain. +[Investigate devices](investigate-machines.md)| Investigate the details of a device associated with a specific alert, behaviour, or event. +[Investigate an IP address](investigate-ip.md) | Examine possible communication between devices in your network and external internet protocol (IP) addresses. +[Investigate a domain](investigate-domain.md) | Investigate a domain to see if devices and servers in your network have been communicating with a known malicious domain. [Investigate a user account](investigate-user.md) | Identify user accounts with the most active alerts and investigate cases of potential compromised credentials. diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md index a039772386..e89b4dc429 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md @@ -4,7 +4,7 @@ description: Learn about how the Microsoft Defender ATP alerts queues work, and keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period, microsoft threat experts alerts search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,23 +13,28 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 03/27/2020 +ms.technology: mde --- -# View and organize the Microsoft Defender Advanced Threat Protection Alerts queue +# View and organize the Microsoft Defender for Endpoint Alerts queue + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-alertsq-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-alertsq-abovefoldlink) -The **Alerts queue** shows a list of alerts that were flagged from machines in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view. The most recent alerts are showed at the top of the list helping you see the most recent alerts first. +The **Alerts queue** shows a list of alerts that were flagged from devices in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view. The most recent alerts are showed at the top of the list helping you see the most recent alerts first. >[!NOTE] ->The alerts queue is significantly reduced with automated investigation and remediation, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. When an alert contains a supported entity for automated investigation (for example, a file) in a machine that has a supported operating system for it, an automated investigation and remediation can start. For more information on automated investigations, see [Overview of Automated investigations](automated-investigations.md). +>The alerts queue is significantly reduced with automated investigation and remediation, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. When an alert contains a supported entity for automated investigation (for example, a file) in a device that has a supported operating system for it, an automated investigation and remediation can start. For more information on automated investigations, see [Overview of Automated investigations](automated-investigations.md). There are several options you can choose from to customize the alerts queue view. @@ -51,24 +56,24 @@ You can apply the following filters to limit the list of alerts and get a more f Alert severity | Description :---|:--- -High
    (Red) | Alerts commonly seen associated with advanced persistent threats (APT). These alerts indicate a high risk because of the severity of damage they can inflict on machines. Some examples are: credential theft tools activities, ransomware activities not associated with any group, tampering with security sensors, or any malicious activities indicative of a human adversary. +High
    (Red) | Alerts commonly seen associated with advanced persistent threats (APT). These alerts indicate a high risk because of the severity of damage they can inflict on devices. Some examples are: credential theft tools activities, ransomware activities not associated with any group, tampering with security sensors, or any malicious activities indicative of a human adversary. Medium
    (Orange) | Alerts from endpoint detection and response post-breach behaviors that might be a part of an advanced persistent threat (APT). This includes observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth. Although some might be part of internal security testing, it requires investigation as it might also be a part of an advanced attack. Low
    (Yellow) | Alerts on threats associated with prevalent malware. For example, hack-tools, non-malware hack tools, such as running exploration commands, clearing logs, etc., that often do not indicate an advanced threat targeting the organization. It could also come from an isolated security tool testing by a user in your organization. Informational
    (Grey) | Alerts that might not be considered harmful to the network but can drive organizational security awareness on potential security issues. #### Understanding alert severity -Windows Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes. +Microsoft Defender Antivirus (Microsoft Defender AV) and Defender for Endpoint alert severities are different because they represent different scopes. -The Windows Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected. +The Microsoft Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual device, if infected. -The Microsoft Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization. +The Defender for Endpoint alert severity represents the severity of the detected behavior, the actual risk to the device but more importantly the potential risk to the organization. So, for example: -- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage. -- An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat. -- An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High". +- The severity of a Defender for Endpoint alert about a Microsoft Defender AV detected threat that was completely prevented and did not infect the device is categorized as "Informational" because there was no actual damage. +- An alert about a commercial malware was detected while executing, but blocked and remediated by Microsoft Defender AV, is categorized as "Low" because it may have caused some damage to the individual device but poses no organizational threat. +- An alert about malware detected while executing which can pose a threat not only to the individual device but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High". - Suspicious behavioral alerts, which weren't blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations. #### Understanding alert categories @@ -77,24 +82,24 @@ We've redefined the alert categories to align to the [enterprise attack tactics] The table below lists the current categories and how they generally map to previous categories. -| New category | Previous categories | Detected threat activity or component | -|----------------------|----------------------|-------------| -| Collection | - | Locating and collecting data for exfiltration | -| Command and control | CommandAndControl | Connecting to attacker-controlled network infrastructure to relay data or receive commands | -| Credential access | CredentialTheft | Obtaining valid credentials to extend control over devices and other resources in the network | -| Defense evasion | - | Avoiding security controls by, for example, turning off security apps, deleting implants, and running rootkits | -| Discovery | Reconnaissance, WebFingerprinting | Gathering information about important devices and resources, such as administrator computers, domain controllers, and file servers | -| Execution | Delivery, MalwareDownload | Launching attacker tools and malicious code, including RATs and backdoors | -| Exfiltration | Exfiltration | Extracting data from the network to an external, attacker-controlled location | -| Exploit | Exploit | Exploit code and possible exploitation activity | -| Initial access | SocialEngineering, WebExploit, DocumentExploit | Gaining initial entry to the target network, usually involving password-guessing, exploits, or phishing emails | -| Lateral movement | LateralMovement, NetworkPropagation | Moving between devices in the target network to reach critical resources or gain network persistence | -| Malware | Malware, Backdoor, Trojan, TrojanDownloader, CredentialStealing, Weaponization, RemoteAccessTool | Backdoors, trojans, and other types of malicious code | -| Persistence | Installation, Persistence | Creating autostart extensibility points (ASEPs) to remain active and survive system restarts | -| Privilege escalation | PrivilegeEscalation | Obtaining higher permission levels for code by running it in the context of a privileged process or account | -| Ransomware | Ransomware | Malware that encrypts files and extorts payment to restore access | -| Suspicious activity | General, None, NotApplicable, EnterprisePolicy, SuspiciousNetworkTraffic | Atypical activity that could be malware activity or part of an attack | -| Unwanted software | UnwantedSoftware | Low-reputation apps and apps that impact productivity and the user experience; detected as potentially unwanted applications (PUAs) | +| New category | API category name | Detected threat activity or component | +|----------------------|---------------------|-----------------------------------------------------------------------------------------------------------------------------------------| +| Collection | Collection | Locating and collecting data for exfiltration | +| Command and control | CommandAndControl | Connecting to attacker-controlled network infrastructure to relay data or receive commands | +| Credential access | CredentialAccess | Obtaining valid credentials to extend control over devices and other resources in the network | +| Defense evasion | DefenseEvasion | Avoiding security controls by, for example, turning off security apps, deleting implants, and running rootkits | +| Discovery | Discovery | Gathering information about important devices and resources, such as administrator computers, domain controllers, and file servers | +| Execution | Execution | Launching attacker tools and malicious code, including RATs and backdoors | +| Exfiltration | Exfiltration | Extracting data from the network to an external, attacker-controlled location | +| Exploit | Exploit | Exploit code and possible exploitation activity | +| Initial access | InitialAccess | Gaining initial entry to the target network, usually involving password-guessing, exploits, or phishing emails | +| Lateral movement | LateralMovement | Moving between devices in the target network to reach critical resources or gain network persistence | +| Malware | Malware | Backdoors, trojans, and other types of malicious code | +| Persistence | Persistence | Creating autostart extensibility points (ASEPs) to remain active and survive system restarts | +| Privilege escalation | PrivilegeEscalation | Obtaining higher permission levels for code by running it in the context of a privileged process or account | +| Ransomware | Ransomware | Malware that encrypts files and extorts payment to restore access | +| Suspicious activity | SuspiciousActivity | Atypical activity that could be malware activity or part of an attack | +| Unwanted software | UnwantedSoftware | Low-reputation apps and apps that impact productivity and the user experience; detected as potentially unwanted applications (PUAs) | ### Status @@ -115,19 +120,35 @@ You can choose between showing alerts that are assigned to you or automation. ### Detection source -Select the source that triggered the alert detection. Microsoft Threat Experts preview participants can now filter and see detections from the new threat experts-managed hunting service. +Select the source that triggered the alert detection. Microsoft Threat Experts preview participants can now filter and see detections from the new threat experts-managed hunting service. >[!NOTE] ->The Windows Defender Antivirus filter will only appear if machines are using Windows Defender Antivirus as the default real-time protection antimalware product. +>The Antivirus filter will only appear if devices are using Microsoft Defender Antivirus as the default real-time protection antimalware product. + +| Detection source | API value | +|-----------------------------------|----------------------------| +| 3rd party sensors | ThirdPartySensors | +| Antivirus | WindowsDefenderAv | +| Automated investigation | AutomatedInvestigation | +| Custom detection | CustomDetection | +| Custom TI | CustomerTI | +| EDR | WindowsDefenderAtp | +| Microsoft 365 Defender | MTP | +| Microsoft Defender for Office 365 | OfficeATP | +| Microsoft Threat Experts | ThreatExperts | +| SmartScreen | WindowsDefenderSmartScreen | + + + ### OS platform Limit the alerts queue view by selecting the OS platform that you're interested in investigating. -### Machine group +### Device group -If you have specific machine groups that you're interested in checking, you can select the groups to limit the alerts queue view. +If you have specific device groups that you're interested in checking, you can select the groups to limit the alerts queue view. ### Associated threat @@ -135,11 +156,11 @@ Use this filter to focus on alerts that are related to high profile threats. You ## Related topics -- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts.md) -- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts.md) -- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files.md) -- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) -- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md) -- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md) -- [Investigate a user account in Microsoft Defender ATP](investigate-user.md) +- [Manage Microsoft Defender for Endpoint alerts](manage-alerts.md) +- [Investigate Microsoft Defender for Endpoint alerts](investigate-alerts.md) +- [Investigate a file associated with a Microsoft Defender for Endpoint alert](investigate-files.md) +- [Investigate devices in the Microsoft Defender for Endpoint Devices list](investigate-machines.md) +- [Investigate an IP address associated with a Microsoft Defender for Endpoint alert](investigate-ip.md) +- [Investigate a domain associated with a Microsoft Defender for Endpoint alert](investigate-domain.md) +- [Investigate a user account in Microsoft Defender for Endpoint](investigate-user.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts.md b/windows/security/threat-protection/microsoft-defender-atp/alerts.md index 5508ee20b8..9d282cfc4b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts.md @@ -1,9 +1,9 @@ --- title: Get alerts API -description: Retrieve recent Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) alerts. +description: Learn about the methods and properties of the Alert resource type in Microsoft Defender Advanced Threat Protection. keywords: apis, graph api, supported apis, get, alerts, recent search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,13 +14,24 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Alert resource type -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + +[!include[Improve request performance](../../includes/improve-request-performance.md)] + -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) ## Methods @@ -28,7 +39,8 @@ Method |Return Type |Description :---|:---|:--- [Get alert](get-alert-info-by-id.md) | [Alert](alerts.md) | Get a single [alert](alerts.md) object. [List alerts](get-alerts.md) | [Alert](alerts.md) collection | List [alert](alerts.md) collection. -[Update alert](get-alerts.md) | [Alert](update-alert.md) | Update specific [alert](alerts.md). +[Update alert](update-alert.md) | [Alert](alerts.md) | Update specific [alert](alerts.md). +[Batch update alerts](batch-update-alerts.md) | | Update a batch of [alerts](alerts.md). [Create alert](create-alert-by-reference.md)|[Alert](alerts.md)|Create an alert based on event data obtained from [Advanced Hunting](run-advanced-query-api.md). [List related domains](get-alert-related-domain-info.md)|Domain collection| List URLs associated with the alert. [List related files](get-alert-related-files-info.md) | [File](files.md) collection | List the [file](files.md) entities that are associated with the [alert](alerts.md). @@ -45,13 +57,13 @@ id | String | Alert ID. title | String | Alert title. description | String | Alert description. alertCreationTime | Nullable DateTimeOffset | The date and time (in UTC) the alert was created. -lastEventTime | Nullable DateTimeOffset | The last occurrence of the event that triggered the alert on the same machine. -firstEventTime | Nullable DateTimeOffset | The first occurrence of the event that triggered the alert on that machine. +lastEventTime | Nullable DateTimeOffset | The last occurrence of the event that triggered the alert on the same device. +firstEventTime | Nullable DateTimeOffset | The first occurrence of the event that triggered the alert on that device. lastUpdateTime | Nullable DateTimeOffset | The date and time (in UTC) the alert was last updated. resolvedTime | Nullable DateTimeOffset | The date and time in which the status of the alert was changed to 'Resolved'. -incidentId | Nullable Long | The [Incident](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) ID of the Alert. -investigationId | Nullable Long | The [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) ID related to the Alert. -investigationState | Nullable Enum | The current state of the [Investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations). Possible values are: 'Unknown', 'Terminated', 'SuccessfullyRemediated', 'Benign', 'Failed', 'PartiallyRemediated', 'Running', 'PendingApproval', 'PendingResource', 'PartiallyInvestigated', 'TerminatedByUser', 'TerminatedBySystem', 'Queued', 'InnerFailure', 'PreexistingAlert', 'UnsupportedOs', 'UnsupportedAlertType', 'SuppressedAlert'. +incidentId | Nullable Long | The [Incident](view-incidents-queue.md) ID of the Alert. +investigationId | Nullable Long | The [Investigation](automated-investigations.md) ID related to the Alert. +investigationState | Nullable Enum | The current state of the [Investigation](automated-investigations.md). Possible values are: 'Unknown', 'Terminated', 'SuccessfullyRemediated', 'Benign', 'Failed', 'PartiallyRemediated', 'Running', 'PendingApproval', 'PendingResource', 'PartiallyInvestigated', 'TerminatedByUser', 'TerminatedBySystem', 'Queued', 'InnerFailure', 'PreexistingAlert', 'UnsupportedOs', 'UnsupportedAlertType', 'SuppressedAlert'. assignedTo | String | Owner of the alert. severity | Enum | Severity of the alert. Possible values are: 'UnSpecified', 'Informational', 'Low', 'Medium' and 'High'. status | Enum | Specifies the current status of the alert. Possible values are: 'Unknown', 'New', 'InProgress' and 'Resolved'. @@ -60,43 +72,145 @@ determination | Nullable Enum | Specifies the determination of the alert. Possib category| String | Category of the alert. detectionSource | String | Detection source. threatFamilyName | String | Threat family. +threatName | String | Threat name. machineId | String | ID of a [machine](machine.md) entity that is associated with the alert. -comments | List of Alert comments | Alert Comment is an object that contains: comment string, createdBy string and createTime date time. +computerDnsName | String | [machine](machine.md) fully qualified name. +aadTenantId | String | The Azure Active Directory ID. +detectorId | String | The ID of the detector that triggered the alert. +comments | List of Alert comments | Alert Comment object contains: comment string, createdBy string and createTime date time. +Evidence | List of Alert evidence | Evidence related to the alert. See example below. ### Response example for getting single alert: -``` -GET https://api.securitycenter.windows.com/api/alerts/da637084217856368682_-292920499 +```http +GET https://api.securitycenter.microsoft.com/api/alerts/da637472900382838869_1364969609 ``` ```json { - "id": "da637084217856368682_-292920499", - "incidentId": 66860, - "investigationId": 4416234, - "investigationState": "Running", - "assignedTo": "secop@contoso.com", - "severity": "Low", - "status": "New", - "classification": "TruePositive", - "determination": null, - "detectionSource": "WindowsDefenderAtp", - "category": "CommandAndControl", - "threatFamilyName": null, - "title": "Network connection to a risky host", - "description": "A network connection was made to a risky host which has exhibited malicious activity.", - "alertCreationTime": "2019-11-03T23:49:45.3823185Z", - "firstEventTime": "2019-11-03T23:47:16.2288822Z", - "lastEventTime": "2019-11-03T23:47:51.2966758Z", - "lastUpdateTime": "2019-11-03T23:55:52.6Z", - "resolvedTime": null, - "machineId": "986e5df8b73dacd43c8917d17e523e76b13c75cd", - "comments": [ - { - "comment": "test comment for docs", - "createdBy": "secop@contoso.com", - "createdTime": "2019-11-05T14:08:37.8404534Z" - } - ] + "id": "da637472900382838869_1364969609", + "incidentId": 1126093, + "investigationId": null, + "assignedTo": null, + "severity": "Low", + "status": "New", + "classification": null, + "determination": null, + "investigationState": "Queued", + "detectionSource": "WindowsDefenderAtp", + "detectorId": "17e10bbc-3a68-474a-8aad-faef14d43952", + "category": "Execution", + "threatFamilyName": null, + "title": "Low-reputation arbitrary code executed by signed executable", + "description": "Binaries signed by Microsoft can be used to run low-reputation arbitrary code. This technique hides the execution of malicious code within a trusted process. As a result, the trusted process might exhibit suspicious behaviors, such as opening a listening port or connecting to a command-and-control (C&C) server.", + "alertCreationTime": "2021-01-26T20:33:57.7220239Z", + "firstEventTime": "2021-01-26T20:31:32.9562661Z", + "lastEventTime": "2021-01-26T20:31:33.0577322Z", + "lastUpdateTime": "2021-01-26T20:33:59.2Z", + "resolvedTime": null, + "machineId": "111e6dd8c833c8a052ea231ec1b19adaf497b625", + "computerDnsName": "temp123.middleeast.corp.microsoft.com", + "rbacGroupName": "A", + "aadTenantId": "a839b112-1253-6432-9bf6-94542403f21c", + "threatName": null, + "mitreTechniques": [ + "T1064", + "T1085", + "T1220" + ], + "relatedUser": { + "userName": "temp123", + "domainName": "MIDDLEEAST" + }, + "comments": [ + { + "comment": "test comment for docs", + "createdBy": "secop123@contoso.com", + "createdTime": "2021-01-26T01:00:37.8404534Z" + } + ], + "evidence": [ + { + "entityType": "User", + "evidenceCreationTime": "2021-01-26T20:33:58.42Z", + "sha1": null, + "sha256": null, + "fileName": null, + "filePath": null, + "processId": null, + "processCommandLine": null, + "processCreationTime": null, + "parentProcessId": null, + "parentProcessCreationTime": null, + "parentProcessFileName": null, + "parentProcessFilePath": null, + "ipAddress": null, + "url": null, + "registryKey": null, + "registryHive": null, + "registryValueType": null, + "registryValue": null, + "accountName": "eranb", + "domainName": "MIDDLEEAST", + "userSid": "S-1-5-21-11111607-1111760036-109187956-75141", + "aadUserId": "11118379-2a59-1111-ac3c-a51eb4a3c627", + "userPrincipalName": "temp123@microsoft.com", + "detectionStatus": null + }, + { + "entityType": "Process", + "evidenceCreationTime": "2021-01-26T20:33:58.6133333Z", + "sha1": "ff836cfb1af40252bd2a2ea843032e99a5b262ed", + "sha256": "a4752c71d81afd3d5865d24ddb11a6b0c615062fcc448d24050c2172d2cbccd6", + "fileName": "rundll32.exe", + "filePath": "C:\\Windows\\SysWOW64", + "processId": 3276, + "processCommandLine": "rundll32.exe c:\\temp\\suspicious.dll,RepeatAfterMe", + "processCreationTime": "2021-01-26T20:31:32.9581596Z", + "parentProcessId": 8420, + "parentProcessCreationTime": "2021-01-26T20:31:32.9004163Z", + "parentProcessFileName": "rundll32.exe", + "parentProcessFilePath": "C:\\Windows\\System32", + "ipAddress": null, + "url": null, + "registryKey": null, + "registryHive": null, + "registryValueType": null, + "registryValue": null, + "accountName": null, + "domainName": null, + "userSid": null, + "aadUserId": null, + "userPrincipalName": null, + "detectionStatus": "Detected" + }, + { + "entityType": "File", + "evidenceCreationTime": "2021-01-26T20:33:58.42Z", + "sha1": "8563f95b2f8a284fc99da44500cd51a77c1ff36c", + "sha256": "dc0ade0c95d6db98882bc8fa6707e64353cd6f7767ff48d6a81a6c2aef21c608", + "fileName": "suspicious.dll", + "filePath": "c:\\temp", + "processId": null, + "processCommandLine": null, + "processCreationTime": null, + "parentProcessId": null, + "parentProcessCreationTime": null, + "parentProcessFileName": null, + "parentProcessFilePath": null, + "ipAddress": null, + "url": null, + "registryKey": null, + "registryHive": null, + "registryValueType": null, + "registryValue": null, + "accountName": null, + "domainName": null, + "userSid": null, + "aadUserId": null, + "userPrincipalName": null, + "detectionStatus": "Detected" + } + ] } ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/android-configure.md b/windows/security/threat-protection/microsoft-defender-atp/android-configure.md new file mode 100644 index 0000000000..dfc9c405e5 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/android-configure.md @@ -0,0 +1,59 @@ +--- +title: Configure Microsoft Defender ATP for Android features +ms.reviewer: +description: Describes how to configure Microsoft Defender ATP for Android +keywords: microsoft, defender, atp, android, configuration +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.topic: conceptual +ms.technology: mde +--- + +# Configure Defender for Endpoint for Android features + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +## Conditional Access with Defender for Endpoint for Android +Microsoft Defender for Endpoint for Android along with Microsoft Intune and Azure Active +Directory enables enforcing Device compliance and Conditional Access policies +based on device risk levels. Defender for Endpoint is a Mobile Threat Defense +(MTD) solution that you can deploy to leverage this capability via Intune. + +For more information about how to set up Defender for Endpoint for Android and Conditional Access, see [Defender for Endpoint and +Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection). + + +## Configure custom indicators + +>[!NOTE] +> Defender for Endpoint for Android only supports creating custom indicators for IP addresses and URLs/domains. + +Defender for Endpoint for Android enables admins to configure custom indicators to support Android devices as well. For more information on how to configure custom indicators, see [Manage indicators](manage-indicators.md). + +## Configure web protection +Defender for Endpoint for Android allows IT Administrators the ability to configure the web protection feature. This capability is available within the Microsoft Endpoint Manager Admin center. + +>[!NOTE] +> Defender for Endpoint for Android would use a VPN in order to provide the Web Protection feature. This is not a regular VPN and is a local/self-looping VPN that does not take traffic outside the device. +For more information, see [Configure web protection on devices that run Android](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-manage-android). + + +## Related topics +- [Overview of Microsoft Defender for Endpoint for Android](microsoft-defender-atp-android.md) +- [Deploy Microsoft Defender for Endpoint for Android with Microsoft Intune](android-intune.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/android-intune.md b/windows/security/threat-protection/microsoft-defender-atp/android-intune.md new file mode 100644 index 0000000000..55e9ca48c5 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/android-intune.md @@ -0,0 +1,313 @@ +--- +title: Deploy Microsoft Defender ATP for Android with Microsoft Intune +ms.reviewer: +description: Describes how to deploy Microsoft Defender ATP for Android with Microsoft Intune +keywords: microsoft, defender, atp, android, installation, deploy, uninstallation, +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.topic: conceptual +ms.technology: mde +--- + +# Deploy Microsoft Defender for Endpoint for Android with Microsoft Intune + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +Learn how to deploy Defender for Endpoint for Android on Intune +Company Portal enrolled devices. For more information about Intune device enrollment, see [Enroll your +device](https://docs.microsoft.com/mem/intune/user-help/enroll-device-android-company-portal). + + +> [!NOTE] +> **Defender for Endpoint for Android is now available on [Google Play](https://play.google.com/store/apps/details?id=com.microsoft.scmx)**
    +> You can connect to Google Play from Intune to deploy Defender for Endpoint app across Device Administrator and Android Enterprise entrollment modes. + Updates to the app are automatic via Google Play. + +## Deploy on Device Administrator enrolled devices + +**Deploy Defender for Endpoint for Android on Intune Company Portal - Device +Administrator enrolled devices** + +Learn how to deploy Defender for Endpoint for Android on Intune Company Portal - Device Administrator enrolled devices. + +### Add as Android store app + +1. In [Microsoft Endpoint Manager admin +center](https://go.microsoft.com/fwlink/?linkid=2109431) , go to **Apps** \> +**Android Apps** \> **Add \> Android store app** and choose **Select**. + + ![Image of Microsoft Endpoint Manager Admin Center1](images/mda-addandroidstoreapp.png) + + +2. On the **Add app** page and in the *App Information* section enter: + + - **Name** + - **Description** + - **Publisher** as Microsoft. + - **App store URL** as https://play.google.com/store/apps/details?id=com.microsoft.scmx (Defender for Endpoint app Google Play Store URL) + + Other fields are optional. Select **Next**. + + ![Image of Microsoft Endpoint Manager Admin Center2](images/mda-addappinfo.png) + +3. In the *Assignments* section, go to the **Required** section and select **Add group.** You can then choose the user group(s) that you would like to target Defender for Endpoint for Android app. Choose **Select** and then **Next**. + + >[!NOTE] + >The selected user group should consist of Intune enrolled users. + + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager Admin Center3](images/363bf30f7d69a94db578e8af0ddd044b.png) + + +4. In the **Review+Create** section, verify that all the information entered is correct and then select **Create**. + + In a few moments, the Defender for Endpoint app would be created successfully, and a notification would show up at the top-right corner of the page. + + ![Image of Microsoft Endpoint Manager Admin Center4](images/86cbe56f88bb6e93e9c63303397fc24f.png) + + +5. In the app information page that is displayed, in the **Monitor** section, +select **Device install status** to verify that the device installation has +completed successfully. + + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager Admin Center5](images/513cf5d59eaaef5d2b5bc122715b5844.png) + + +### Complete onboarding and check status + +1. Once Defender for Endpoint for Android has been installed on the device, you'll see the app icon. + + ![Icon on mobile device](images/7cf9311ad676ec5142002a4d0c2323ca.jpg) + +2. Tap the Microsoft Defender ATP app icon and follow the on-screen instructions +to complete onboarding the app. The details include end-user acceptance of Android permissions required by Defender for Endpoint for Android. + +3. Upon successful onboarding, the device will start showing up on the Devices +list in Microsoft Defender Security Center. + + ![Image of device in Defender for Endpoint portal](images/9fe378a1dce0f143005c3aa53d8c4f51.png) + +## Deploy on Android Enterprise enrolled devices + +Defender for Endpoint for Android supports Android Enterprise enrolled devices. + +For more information on the enrollment options supported by Intune, see +[Enrollment Options](https://docs.microsoft.com/mem/intune/enrollment/android-enroll). + +**Currently, Personally owned devices with work profile and Corporate-owned fully managed user device enrollments are supported for deployment.** + + + +## Add Microsoft Defender for Endpoint for Android as a Managed Google Play app + +Follow the steps below to add Microsoft Defender for Endpoint app into your managed Google Play. + +1. In [Microsoft Endpoint Manager admin +center](https://go.microsoft.com/fwlink/?linkid=2109431) , go to **Apps** \> +**Android Apps** \> **Add** and select **Managed Google Play app**. + + > [!div class="mx-imgBorder"] + > ![Image of Microsoft Endpoint Manager admin center6](images/579ff59f31f599414cedf63051628b2e.png) + + +2. On your managed Google Play page that loads subsequently, go to the search +box and lookup **Microsoft Defender.** Your search should display the Microsoft +Defender for Endpoint app in your Managed Google Play. Click on the Microsoft Defender for Endpoint app from the Apps search result. + + ![Image of Microsoft Endpoint Manager admin center7](images/0f79cb37900b57c3e2bb0effad1c19cb.png) + +3. In the App description page that comes up next, you should be able to see app +details on Defender for Endpoint. Review the information on the page and then +select **Approve**. + + > [!div class="mx-imgBorder"] + > ![A screenshot of a Managed Google Play](images/07e6d4119f265037e3b80a20a73b856f.png) + + +4. You'll be presented with the permissions that Defender for Endpoint +obtains for it to work. Review them and then select **Approve**. + + ![A screenshot of Defender for Endpoint preview app approval](images/206b3d954f06cc58b3466fb7a0bd9f74.png) + + +5. You'll be presented with the Approval settings page. The page confirms +your preference to handle new app permissions that Defender for Endpoint for +Android might ask. Review the choices and select your preferred option. Select +**Done**. + + By default, managed Google Play selects *Keep approved when app requests new +permissions* + + > [!div class="mx-imgBorder"] + > ![Image of notifications tab](images/ffecfdda1c4df14148f1526c22cc0236.png) + + +6. After the permissions handling selection is made, select **Sync** to sync Microsoft +Defender for Endpoint to your apps list. + + > [!div class="mx-imgBorder"] + > ![Image of sync page](images/34e6b9a0dae125d085c84593140180ed.png) + + +7. The sync will complete in a few minutes. + + ![Image of Android app](images/9fc07ffc150171f169dc6e57fe6f1c74.png) + +8. Select the **Refresh** button in the Android apps screen and Microsoft +Defender ATP should be visible in the apps list. + + > [!div class="mx-imgBorder"] + > ![Image of list of Android apps](images/fa4ac18a6333335db3775630b8e6b353.png) + + +9. Defender for Endpoint supports App configuration policies for managed devices via Intune. This capability can be leveraged to autogrant applicable Android permission(s), so the end user does not need to accept these permission(s). + + 1. In the **Apps** page, go to **Policy > App configuration policies > Add > Managed devices**. + + ![Image of Microsoft Endpoint Manager admin center8](images/android-mem.png) + + 1. In the **Create app configuration policy** page, enter the following details: + + - Name: Microsoft Defender ATP. + - Choose **Android Enterprise** as platform. + - Choose **Work Profile only** as Profile Type. + - Click **Select App**, choose **Microsoft Defender ATP**, select **OK** and then **Next**. + + > [!div class="mx-imgBorder"] + > ![Image of create app configuration policy page](images/android-create-app.png) + + 1. In the **Settings** page, go to the Permissions section click on Add to view the list of supported permissions. In the Add Permissions section, select the following permissions: + + - External storage (read) + - External storage (write) + + Then select **OK**. + + > [!div class="mx-imgBorder"] + > ![Image of create app configuration policy1](images/android-create-app-config.png) + + + 1. You should now see both the permissions listed and now you can autogrant both by choosing autogrant in the **Permission state** drop-down and then select **Next**. + + > [!div class="mx-imgBorder"] + > ![Image of create app configuration policy2](images/android-auto-grant.png) + + + 1. In the **Assignments** page, select the user group to which this app config policy would be assigned to. Click **Select groups to include** and selecting the applicable group and then selecting **Next**. The group selected here is usually the same group to which you would assign Microsoft Defender for Endpoint Android app. + + > [!div class="mx-imgBorder"] + > ![Image of create app configuration policy3](images/android-select-group.png) + + + 1. In the **Review + Create** page that comes up next, review all the information and then select **Create**.
    + + The app configuration policy for Defender for Endpoint autogranting the storage permission is now assigned to the selected user group. + + > [!div class="mx-imgBorder"] + > ![Image of create app configuration policy4](images/android-review-create.png) + + +10. Select **Microsoft Defender ATP** app in the list \> **Properties** \> +**Assignments** \> **Edit**. + + ![Image of list of apps](images/mda-properties.png) + + +11. Assign the app as a *Required* app to a user group. It is automatically installed in the *work profile* during the next sync of +the device via Company Portal app. This assignment can be done by navigating to +the *Required* section \> **Add group,** selecting the user group and click +**Select**. + + > [!div class="mx-imgBorder"] + > ![Image of edit application page](images/ea06643280075f16265a596fb9a96042.png) + + +12. In the **Edit Application** page, review all the information that was entered +above. Then select **Review + Save** and then **Save** again to commence +assignment. + +### Auto Setup of Always-on VPN +Defender for Endpoint supports Device configuration policies for managed devices via Intune. This capability can be leveraged to **Auto setup of Always-on VPN** on Android Enterprise enrolled devices, so the end user does not need to set up VPN service while onboarding. +1. On **Devices**, select **Configuration Profiles** > **Create Profile** > **Platform** > **Android Enterprise** +Select **Device restrictions** under one of the following, based on your device enrollment type +- **Fully Managed, Dedicated, and Corporate-Owned Work Profile** +- **Personally owned Work Profile** + +Select **Create**. + + > ![Image of devices configuration profile Create](images/1autosetupofvpn.png) + +2. **Configuration Settings** + Provide a **Name** and a **Description** to uniquely identify the configuration profile. + + > ![Image of devices configuration profile Name and Description](images/2autosetupofvpn.png) + + 3. Select **Connectivity** and configure VPN: +- Enable **Always-on VPN** +Setup a VPN client in the work profile to automatically connect and reconnect to the VPN whenever possible. Only one VPN client can be configured for always-on VPN on a given device, so be sure to have no more than one always-on VPN policy deployed to a single device. +- Select **Custom** in VPN client dropdown list +Custom VPN in this case is Defender for Endpoint VPN which is used to provide the Web Protection feature. + > [!NOTE] + > Microsoft Defender ATP app must be installed on user’s device, in order to functioning of auto setup of this VPN. + +- Enter **Package ID** of the Microsoft Defender ATP app in Google Play store. For the Defender app URL https://play.google.com/store/apps/details?id=com.microsoft.scmx, Package ID is **com.microsoft.scmx** +- **Lockdown mode** Not configured (Default) + + ![Image of devices configuration profile enable Always-on VPN](images/3autosetupofvpn.png) + +4. **Assignment** +In the **Assignments** page, select the user group to which this app config policy would be assigned to. Click **Select groups** to include and selecting the applicable group and then click **Next**. The group selected here is usually the same group to which you would assign Microsoft Defender for Endpoint Android app. + + ![Image of devices configuration profile Assignment](images/4autosetupofvpn.png) + +5. In the **Review + Create** page that comes up next, review all the information and then select **Create**. +The device configuration profile is now assigned to the selected user group. + + ![Image of devices configuration profile Review and Create](images/5autosetupofvpn.png) + +## Complete onboarding and check status + +1. Confirm the installation status of Microsoft Defender for Endpoint for Android by +clicking on the **Device Install Status**. Verify that the device is +displayed here. + + > [!div class="mx-imgBorder"] + > ![Image of device installation status](images/900c0197aa59f9b7abd762ab2b32e80c.png) + + +2. On the device, you can validate the onboarding status by going to the **work profile**. Confirm that Defender for Endpoint is available and that you are enrolled to the **Personally owned devices with work profile**. If you are enrolled to a **Corporate-owned, fully managed user device**, you will have a single profile on the device where you can confirm that Defender for Endpoint is available. + + ![Image of app in mobile device](images/c2e647fc8fa31c4f2349c76f2497bc0e.png) + +3. When the app is installed, open the app and accept the permissions +and then your onboarding should be successful. + + ![Image of mobile device with Microsoft Defender for Endpoint app](images/mda-devicesafe.png) + +4. At this stage the device is successfully onboarded onto Defender for Endpoint for Android. You can verify this on the [Microsoft Defender Security +Center](https://securitycenter.microsoft.com) +by navigating to the **Devices** page. + + ![Image of Microsoft Defender for Endpoint portal](images/9fe378a1dce0f143005c3aa53d8c4f51.png) + + +## Related topics +- [Overview of Microsoft Defender for Endpoint for Android](microsoft-defender-atp-android.md) +- [Configure Microsoft Defender for Endpoint for Android features](android-configure.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/android-privacy.md b/windows/security/threat-protection/microsoft-defender-atp/android-privacy.md new file mode 100644 index 0000000000..218b71c7b4 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/android-privacy.md @@ -0,0 +1,111 @@ +--- +title: Microsoft Defender ATP for Android - Privacy information +description: Privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Android. +keywords: microsoft, defender, atp, android, privacy, diagnostic +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.technology: mde +--- + +# Microsoft Defender for Endpoint for Android - Privacy information + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + + +Defender for Endpoint for Android collects information from your configured +Android devices and stores it in the same tenant where you have Defender for Endpoint. + +Information is collected to help keep Defender for Endpoint for Android secure, +up-to-date, performing as expected and to support the service. + +## Required Data + +Required data consists of data that is necessary to make Defender for Endpoint +for Android work as expected. This data is essential to the operation of the +service and can include data related to the end user, organization, device, and +apps. Here's a list of the types of data being collected: + +### App information + +Information about Android application packages (APKs) on the device including + +- Install source +- Storage location (file path) of the APK +- Time of install, size of APK and permissions + +### Web page / Network information + +- Full URL (on supported browsers), when clicked +- Connection information +- Protocol type (such as HTTP, HTTPS, etc.) + + +### Device and account information + +- Device information such as date & time, Android version, OEM model, CPU + info, and Device identifier +- Device identifier is one of the below: + - Wi-Fi adapter MAC address + - [Android + ID](https://developer.android.com/reference/android/provider/Settings.Secure#ANDROID_ID) + (as generated by Android at the time of first boot of the device) + - Randomly generated globally unique identifier (GUID) + +- Tenant, Device and User information + - Azure Active Directory (AD) Device ID and Azure User ID: Uniquely + identifies the device, User respectively at Azure Active directory. + + - Azure tenant ID - GUID that identifies your organization within + Azure Active Directory + + - Microsoft Defender ATP org ID - Unique identifier associated with + the enterprise that the device belongs to. Allows Microsoft to + identify whether issues are impacting a select set of enterprises + and how many enterprises are impacted  + + - User Principal Name – Email ID of the user + +### Product and service usage data +- App package info, including name, version, and app upgrade status + +- Actions performed in the app + +- Threat detection information, such as threat name, category, etc. + +- Crash report logs generated by Android + +## Optional Data + +Optional data includes diagnostic data and feedback data. Optional diagnostic +data is additional data that helps us make product improvements and provides +enhanced information to help us detect, diagnose, and fix issues. Optional +diagnostic data includes: + +- App, CPU, and network usage + +- State of the device from the app perspective, including scan status, scan + timings, app permissions granted, and upgrade status + +- Features configured by the admin + +- Basic information about the browsers on the device + +**Feedback Data** is collected through in-app feedback provided by the user + +- The user’s email address, if they choose to provide it + +- Feedback type (smile, frown, idea) and any feedback comments submitted by + the user diff --git a/windows/security/threat-protection/microsoft-defender-atp/android-support-signin.md b/windows/security/threat-protection/microsoft-defender-atp/android-support-signin.md new file mode 100644 index 0000000000..9ec3031858 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/android-support-signin.md @@ -0,0 +1,100 @@ +--- +title: Troubleshoot issues on Microsoft Defender ATP for Android +ms.reviewer: +description: Troubleshoot issues for Microsoft Defender ATP for Android +keywords: microsoft, defender, atp, android, cloud, connectivity, communication +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.topic: conceptual +ms.technology: mde +--- + +# Troubleshooting issues on Microsoft Defender for Endpoint for Android + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +When onboarding a device, you might see sign in issues after the app is installed. + +This article provides solutions to help address sign in issues. + +## Sign in failed - unexpected error +**Sign in failed:** *Unexpected error, try later* + +![Image of sign in failed error Unexpected error](images/f9c3bad127d636c1f150d79814f35d4c.png) + +**Message:** + +Unexpected error, try later + +**Cause:** + +You have an older version of "Microsoft Authenticator" app installed on your +device. + +**Solution:** + +Install latest version and of [Microsoft +Authenticator](https://play.google.com/store/apps/details?androidid=com.azure.authenticator) +from Google Play Store and try again + +## Sign in failed - invalid license + +**Sign in failed:** *Invalid license, please contact administrator* + +![Image of sign in failed please contact administrator](images/920e433f440fa1d3d298e6a2a43d4811.png) + +**Message:** *Invalid license, please contact administrator* + +**Cause:** + +You do not have Microsoft 365 license assigned, or your organization does not +have a license for Microsoft 365 Enterprise subscription. + +**Solution:** + +Contact your administrator for help. + +## Phishing pages aren't blocked on some OEM devices + +**Applies to:** Specific OEMs only + +- **Xiaomi** + +Phishing and harmful web threats that are detected by Defender for Endpoint +for Android are not blocked on some Xiaomi devices. The following functionality doesn't work on these devices. + +![Image of site reported unsafe](images/0c04975c74746a5cdb085e1d9386e713.png) + + +**Cause:** + +Xiaomi devices include a new permission model. This prevents Defender for Endpoint +for Android from displaying pop-up windows while it runs in the background. + +Xiaomi devices permission: "Display pop-up windows while running in the +background." + +![Image of pop up setting](images/6e48e7b29daf50afddcc6c8c7d59fd64.png) + +**Solution:** + +Enable the required permission on Xiaomi devices. + +- Display pop-up windows while running in the background. diff --git a/windows/security/threat-protection/microsoft-defender-atp/android-terms.md b/windows/security/threat-protection/microsoft-defender-atp/android-terms.md new file mode 100644 index 0000000000..c39a6c1b13 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/android-terms.md @@ -0,0 +1,233 @@ +--- +title: Microsoft Defender ATP for Android Application license terms +ms.reviewer: +description: Describes the Microsoft Defender ATP for Android license terms +keywords: microsoft, defender, atp, android,license, terms, application, use, installation, service, feedback, scope, +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +hideEdit: true +ms.technology: mde +--- + +# Microsoft Defender for Endpoint for Android application license terms + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +## MICROSOFT APPLICATION LICENSE TERMS: MICROSOFT DEFENDER FOR ENDPOINT + +These license terms ("Terms") are an agreement between Microsoft Corporation (or +based on where you live, one of its affiliates) and you. Please read them. They +apply to the application named above. These Terms also apply to any Microsoft + +- updates, + +- supplements, + +- Internet-based services, and + +- support services + +for this application, unless other terms accompany those items. If so, those +terms apply. + +**BY USING THE APPLICATION, YOU ACCEPT THESE TERMS. IF YOU DO NOT ACCEPT THEM, +DO NOT USE THE APPLICATION.** + +**If you comply with these Terms, you have the perpetual rights below.** + +1. **INSTALLATION AND USE RIGHTS.** + + 1. **Installation and Use.** You may install and use any number of copies + of this application on Android enabled device or devices that you own + or control. You may use this application with your company's valid + subscription of Microsoft Defender for Endpoint or + an online service that includes Microsoft Defender for Endpoint functionalities. + + 2. **Updates.** Updates or upgrades to Microsoft Defender for Endpoint may be required for full + functionality. Some functionality may not be available in all countries. + + 3. **Third-Party Programs.** The application may include third-party + programs that Microsoft, not the third party, licenses to you under this + agreement. Notices, if any, for the third-party program are included for + your information only. + +2. **INTERNET ACCESS MAY BE REQUIRED.** You may incur charges related to + Internet access, data transfer, and other services per the terms of the data + service plan and any other agreement you have with your network operator due + to use of the application. You are solely responsible for any network + operator charges. + +3. **INTERNET-BASED SERVICES.** Microsoft provides Internet-based services with + the application. It may change or cancel them at any time. + + 1. Consent for Internet-Based or Wireless Services. The application may + connect to Internet-based wireless services. Your use of the application + operates as your consent to the transmission of standard device + information (including but not limited to technical information about + your device, system and application software, and peripherals) for + Internet-based or wireless services. If other terms are provided in + connection with your use of the services, those terms also apply. + + - Data. Some online services require, or may be enhanced by, the + installation of local software like this one. At your, or your + admin's direction, this software may send data from a device to or + from an online service. + + - Usage Data. Microsoft automatically collects usage and performance + data over the internet. This data will be used to provide and + improve Microsoft products and services and enhance your experience. + You may limit or control collection of some usage and performance + data through your device settings. Doing so may disrupt your use of + certain features of the application. For more information about + Microsoft data collection and use, see the [Online Services + Terms](https://go.microsoft.com/fwlink/?linkid=2106777). + + 2. Misuse of Internet-based Services. You may not use any Internet-based + service in any way that could harm it or impair anyone else's use of it + or the wireless network. You may not use the service to try to gain + unauthorized access to any service, data, account, or network by any + means. + +4. **FEEDBACK.** If you give feedback about the application to Microsoft, you + give to Microsoft, without charge, the right to use, share, and commercialize + your feedback in any way and for any purpose. You also give to third + parties, without charge, any patent rights needed for their products, + technologies, and services to use or interface with any specific parts of a + Microsoft software or service that includes the feedback. You will not give + feedback that is subject to a license that requires Microsoft to license its + software or documentation to third parties because we include your feedback + in them. These rights survive this agreement. + +5. **SCOPE OF LICENSE.** The application is licensed, not sold. This agreement + only gives you some rights to use the application. Microsoft reserves all + other rights. Unless applicable law gives you more rights despite this + limitation, you may use the application only as expressly permitted in this + agreement. In doing so, you must comply with any technical limitations in + the application that only allow you to use it in certain ways. You may not + + - work around any technical limitations in the application; + + - reverse engineer, decompile or disassemble the application, except and + only to the extent that applicable law expressly permits, despite this + limitation; + + - make more copies of the application than specified in this agreement or + allowed by applicable law, despite this limitation; + + - publish the application for others to copy; + + - rent, lease, or lend the application; or + + - transfer the application or this agreement to any third party. + +6. **EXPORT RESTRICTIONS.** The application is subject to United States export + laws and regulations. You must comply with all domestic and international + export laws and regulations that apply to the application. These laws + include restrictions on destinations, end users, and end use. For more + information, + + see [www.microsoft.com/exporting](https://www.microsoft.com/exporting). + +7. **SUPPORT SERVICES.** Because this application is "as is," we may not + provide support services for it. If you have any issues or questions about + your use of this application, including questions about your company's + privacy policy, contact your company's admin. Do not contact the + application store, your network operator, device manufacturer, or Microsoft. + The application store provider has no obligation to furnish support or + maintenance with respect to the application. + +8. **APPLICATION STORE.** + + 1. If you obtain the application through an application store (for example, Google + Play), review the applicable application store terms to ensure + your download and use of the application complies with such terms. + Note that these Terms are between you and Microsoft and not with + the application store. + + 2. The respective application store provider and its subsidiaries are third-party beneficiaries of these Terms, and upon your acceptance of these + Terms, the application store provider(s) will have the right to directly + enforce and rely upon any provision of these Terms that grants them a + benefit or rights. + +9. **TRADEMARK NOTICES.** Microsoft, Microsoft Defender ATP, MDATP, and + Microsoft 365 are registered or common-law trademarks of Microsoft + Corporation in the United States and/or other countries. + +10. **ENTIRE AGREEMENT.** This agreement and the terms for supplements, updates, + Internet-based services, and support services that you use are the entire + agreement for the application and support services. + +11. **APPLICABLE LAW.** + + 1. **United States.** If you acquired the application in the United States, + Washington state law governs the interpretation of this agreement and + applies to claims for breach of it, regardless of conflict of laws + principles. The laws of the state where you live govern all other + claims, including claims under state consumer protection laws, unfair + competition laws, and in tort. + + 2. **Outside the United States.** If you acquired the application in any + other country, the laws of that country apply. + +12. **LEGAL EFFECT.** This agreement describes certain legal rights. You may + have other rights under the laws of your country. You may also have rights + with respect to the party from whom you acquired the application. This + agreement does not change your rights under the laws of your country if the + laws of your country do not permit it to do so. + +13. **DISCLAIMER OF WARRANTY. THE APPLICATION IS LICENSED "AS-IS." "WITH ALL + FAULTS," AND "AS AVAILABLE." YOU BEAR THE RISK OF USING IT. MICROSOFT AND + WIRELESS CARRIERS OVER WHOSE NETWORK THE APPLICATION IS DISTRIBUTED, AND + EACH OF OUR RESPECTIVE AFFILIATES, AND SUPPLIERS ("COVERED PARTIES") GIVE NO + EXPRESS WARRANTIES, GUARANTEES OR CONDITIONS UNDER OR IN RELATION TO THE + APPLICATION. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE + APPLICATION IS WITH YOU. SHOULD THE APPLICATION BE DEFECTIVE, YOU ASSUME THE + ENTIRE COST OF ALL NECESSARY SERVICING OR REPAIR. YOU MAY HAVE ADDITIONAL + CONSUMER RIGHTS UNDER YOUR LOCAL LAWS WHICH THIS AGREEMENT CANNOT CHANGE. TO + THE EXTENT PERMITTED UNDER YOUR LOCAL LAWS, COVERED PARTIES EXCLUDE THE + IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NON-INFRINGEMENT.** + + **FOR AUSTRALIA - YOU HAVE STATUTORY GUARANTEES UNDER THE AUSTRALIAN CONSUMER LAW AND NOTHING IN THESE TERMS IS INTENDED TO AFFECT THOSE RIGHTS.** + +14. **LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES. TO THE EXTENT NOT + PROHIBITED BY LAW, YOU CAN RECOVER FROM MICROSOFT ONLY DIRECT DAMAGES UP TO + ONE U.S. DOLLAR (\$1.00). YOU AGREE NOT TO SEEK TO RECOVER ANY OTHER + DAMAGES, INCLUDING CONSEQUENTIAL, LOST PROFITS, SPECIAL, INDIRECT OR + INCIDENTAL DAMAGES FROM ANY COVERED PARTIES.** + +This limitation applies to: + +- anything related to the application, services, content (including code) on + third-party internet sites, or third-party programs; and + +- claims for breach of contract, warranty, guarantee, or condition; consumer + protection; deception; unfair competition; strict liability, negligence, + misrepresentation, omission, trespass, or other tort; violation of statute or + regulation; or unjust enrichment; all to the extent permitted by applicable + law. + +It also applies even if: + +a. Repair, replacement, or refund for the application does not fully compensate + you for any losses; or + +b. Covered Parties knew or should have known about the possibility of the + damages. + +The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential, or other damages. diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md index 891d09df60..aea24acd1f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-explorer.md @@ -1,11 +1,11 @@ --- -title: API Explorer in Microsoft Defender ATP +title: API Explorer in Microsoft Defender ATP ms.reviewer: description: Use the API Explorer to construct and do API queries, test, and send requests for any available API -keywords: api, explorer, send, request, get, post, +keywords: api, explorer, send, request, get, post, search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,19 +14,23 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- # API Explorer +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -The Microsoft Defender ATP API Explorer is a tool that helps you explore various Microsoft Defender ATP APIs interactively. +The Microsoft Defender for Endpoint API Explorer is a tool that helps you explore various Defender for Endpoint APIs interactively. -The API Explorer makes it easy to construct and do API queries, test, and send requests for any available Microsoft Defender ATP API endpoint. Use the API Explorer to take actions or find data that might not yet be available through the user interface. +The API Explorer makes it easy to construct and do API queries, test, and send requests for any available Defender for Endpoint API endpoint. Use the API Explorer to take actions or find data that might not yet be available through the user interface. The tool is useful during app development. It allows you to perform API queries that respect your user access settings, reducing the need to generate access tokens. @@ -44,7 +48,7 @@ From the left navigation menu, select **Partners & APIs** > **API Explorer**. ## Supported APIs -API Explorer supports all the APIs offered by Microsoft Defender ATP. +API Explorer supports all the APIs offered by Defender for Endpoint. The list of supported APIs is available in the [APIs documentation](apis-intro.md). @@ -58,7 +62,7 @@ Some of the samples may require specifying a parameter in the URL, for example, ## FAQ **Do I need to have an API token to use the API Explorer?**
    -Credentials to access an API aren't needed. The API Explorer uses the Microsoft Defender ATP management portal token whenever it makes a request. +Credentials to access an API aren't needed. The API Explorer uses the Defender for Endpoint management portal token whenever it makes a request. The logged-in user authentication credential is used to verify that the API Explorer is authorized to access data on your behalf. diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md b/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md index 88fd42601a..dd57d2e5d7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md @@ -4,7 +4,7 @@ ms.reviewer: description: Create a practice 'Hello world'-style API call to the Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) API. keywords: apis, supported apis, advanced hunting, query search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,15 +13,25 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Microsoft Defender ATP API - Hello World +# Microsoft Defender for Endpoint API - Hello World -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + + +- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + +[!include[Improve request performance](../../includes/improve-request-performance.md)] ## Get Alerts using a simple PowerShell script @@ -44,17 +54,17 @@ For the Application registration stage, you must have a **Global administrator** 3. In the registration form, choose a name for your application and then click **Register**. -4. Allow your Application to access Microsoft Defender ATP and assign it **'Read all alerts'** permission: +4. Allow your Application to access Defender for Endpoint and assign it **'Read all alerts'** permission: - On your application page, click **API Permissions** > **Add permission** > **APIs my organization uses** > type **WindowsDefenderATP** and click on **WindowsDefenderATP**. - **Note**: WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear. - ![Image of API access and API selection](images/add-permission.png) + ![Image of API access and API selection1](images/add-permission.png) - Choose **Application permissions** > **Alert.Read.All** > Click on **Add permissions** - ![Image of API access and API selection](images/application-permissions.png) + ![Image of API access and API selection2](images/application-permissions.png) **Important note**: You need to select the relevant permissions. 'Read All Alerts' is only an example! @@ -100,8 +110,8 @@ $tenantId = '' ### Paste your tenant ID here $appId = '' ### Paste your Application ID here $appSecret = '' ### Paste your Application secret here -$resourceAppIdUri = 'https://api.securitycenter.windows.com' -$oAuthUri = "https://login.windows.net/$TenantId/oauth2/token" +$resourceAppIdUri = 'https://api.securitycenter.microsoft.com' +$oAuthUri = "https://login.microsoftonline.com/$TenantId/oauth2/token" $authBody = [Ordered] @{ resource = "$resourceAppIdUri" client_id = "$appId" @@ -139,7 +149,7 @@ $dateTime = (Get-Date).ToUniversalTime().AddHours(-48).ToString("o") # The URL contains the type of query and the time filter we create above # Read more about other query options and filters at Https://TBD- add the documentation link -$url = "https://api.securitycenter.windows.com/api/alerts?`$filter=alertCreationTime ge $dateTime" +$url = "https://api.securitycenter.microsoft.com/api/alerts?`$filter=alertCreationTime ge $dateTime" # Set the WebRequest headers $headers = @{ @@ -174,6 +184,6 @@ You’re all done! You have just successfully: ## Related topic -- [Microsoft Defender ATP APIs](exposed-apis-list.md) -- [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md) -- [Access Microsoft Defender ATP with user context](exposed-apis-create-app-nativeapp.md) +- [Microsoft Defender for Endpoint APIs](exposed-apis-list.md) +- [Access Microsoft Defender for Endpoint with application context](exposed-apis-create-app-webapp.md) +- [Access Microsoft Defender for Endpoint with user context](exposed-apis-create-app-nativeapp.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md b/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md index c27bcf9d6b..405bef0f14 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md @@ -1,10 +1,10 @@ --- title: Microsoft Defender ATP Flow connector ms.reviewer: -description: Microsoft Defender ATP Flow connector +description: Use Microsoft Defender ATP Flow connector to automate security and create a flow that will be triggered any time a new alert occurs on your tenant. keywords: flow, supported apis, api, Microsoft flow, query, automation search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,69 +13,75 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Microsoft Power Automate (formerly Microsoft Flow), and Azure Functions -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -Automating security procedures is a standard requirement for every modern Security Operations Center. The lack of professional Cyber defenders, forces SOC to work in the most efficient way and automation is a must. MS flow supports different connectors that were built exactly for that. You can build an end-to-end procedure automation within few minutes. -Microsoft Defender API has an official Flow Connector with a lot of capabilities: +- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) -![Image of edit credentials](images/api-flow-0.png) +Automating security procedures is a standard requirement for every modern Security Operations Center. The lack of professional cyber defenders forces SOC to work in the most efficient way and automation is a must. Microsoft Power Automate supports different connectors that were built exactly for that. You can build an end-to-end procedure automation within a few minutes. + +Microsoft Defender API has an official Flow Connector with many capabilities. + +![Image of edit credentials1](images/api-flow-0.png) ## Usage example -The following example demonstrates how you can create a Flow that will be triggered any time a new Alert occurs on your tenant. +The following example demonstrates how to create a Flow that is triggered any time a new Alert occurs on your tenant. -- Login to [Microsoft Flow](https://flow.microsoft.com) +1. Log in to [Microsoft Power Automate](https://flow.microsoft.com). -- Go to: My flows > New > Automated +2. Go to **My flows** > **New** > **Automated-from blank**. -![Image of edit credentials](images/api-flow-1.png) + ![Image of edit credentials2](images/api-flow-1.png) -- Choose a name for your Flow, Search for **Microsoft Defender ATP Triggers** as the trigger and choose the new Alerts trigger. +3. Choose a name for your Flow, search for "Microsoft Defender ATP Triggers" as the trigger, and then select the new Alerts trigger. -![Image of edit credentials](images/api-flow-2.png) + ![Image of edit credentials3](images/api-flow-2.png) -- Now you have a Flow that is triggered every time a new Alert occurs. +Now you have a Flow that is triggered every time a new Alert occurs. -![Image of edit credentials](images/api-flow-3.png) +![Image of edit credentials4](images/api-flow-3.png) -All you need to do now, is to choose your next steps. -Lets, for example, Isolate the machine if the Severity of the Alert is **High** and mail about it. -The Alert trigger gives us only the Alert ID and the Machine ID. We can use the Connector to expand these entities. +All you need to do now is choose your next steps. +For example, you can isolate the device if the Severity of the Alert is High and send an email about it. +The Alert trigger provides only the Alert ID and the Machine ID. You can use the connector to expand these entities. -### Get the Alert entity using the connector +### Get the Alert entity using the connector -- Choose Microsoft Defender ATP for new step. +1. Choose **Microsoft Defender ATP** for the new step. -- Choose Alerts - Get single alert API. +2. Choose **Alerts - Get single alert API**. -- Set the Alert Id from the last step as Input. +3. Set the **Alert ID** from the last step as **Input**. -![Image of edit credentials](images/api-flow-4.png) + ![Image of edit credentials5](images/api-flow-4.png) -### Isolate the machine if the Alert's severity is High +### Isolate the device if the Alert's severity is High -- Add **Condition** as a new step . +1. Add **Condition** as a new step. -- Check if Alert severity equals to **High**. +2. Check if the Alert severity **is equal to** High. -- If yes, add Microsoft Defender ATP - Isolate machine action with the Machine Id and a comment. + If yes, add the **Microsoft Defender ATP - Isolate machine** action with the Machine ID and a comment. -![Image of edit credentials](images/api-flow-5.png) + ![Image of edit credentials6](images/api-flow-5.png) -Now you can add a new step for mailing about the Alert and the Isolation. -There are multiple Email connectors that are very easy to use, e.g. Outlook, GMail, etc.. -Save your flow and that's all. +3. Add a new step for emailing about the Alert and the Isolation. There are multiple email connectors that are very easy to use, such as Outlook or Gmail. -- You can also create **scheduled** flow that will run Advanced Hunting queries and much more! +4. Save your flow. + +You can also create a **scheduled** flow that runs Advanced Hunting queries and much more! ## Related topic -- [Microsoft Defender ATP APIs](apis-intro.md) +- [Microsoft Defender for Endpoint APIs](apis-intro.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md index 3b57273926..91c6a65e75 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md @@ -4,7 +4,7 @@ description: Understand how the Detections API fields map to the values in Micro keywords: detections, detections fields, fields, api, fields, pull Detections, rest api, request, response search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,28 +13,32 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Microsoft Defender ATP detections API fields +# Microsoft Defender for Endpoint detections API fields + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink) Understand what data fields are exposed as part of the detections API and how they map to Microsoft Defender Security Center. >[!Note] ->- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections ->- **Microsoft Defender ATP Detection** is composed from the suspicious event occurred on the Machine and its related **Alert** details. +>- [Defender for Endpoint Alert](alerts.md) is composed from one or more detections. +>- **Microsoft Defender ATP Detection** is composed from the suspicious event occurred on the Device and its related **Alert** details. +>- The Microsoft Defender for Endpoint Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md). ## Detections API fields and portal mapping The following table lists the available fields exposed in the detections API payload. It shows examples for the populated values and a reference on how data is reflected on the portal. -The ArcSight field column contains the default mapping between the Microsoft Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). +The ArcSight field column contains the default mapping between the Defender for Endpoint fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Defender for Endpoint](enable-siem-integration.md). Field numbers match the numbers in the images below. @@ -42,32 +46,35 @@ Field numbers match the numbers in the images below. > > | Portal label | SIEM field name | ArcSight field | Example value | Description | > |------------------|---------------------------|---------------------|------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. | +> | 1 | AlertTitle | name | Microsoft Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. | > | 2 | Severity | deviceSeverity | High | Value available for every Detection. | > | 3 | Category | deviceEventCategory | Malware | Value available for every Detection. | -> | 4 | Detection source | sourceServiceName | Antivirus | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every Detection. | +> | 4 | Detection source | sourceServiceName | Antivirus | Microsoft Defender Antivirus or Defender for Endpoint. Value available for every Detection. | > | 5 | MachineName | sourceHostName | desktop-4a5ngd6 | Value available for every Detection. | > | 6 | FileName | fileName | Robocopy.exe | Available for detections associated with a file or process. | > | 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for detections associated with a file or process. | -> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based detections. | -> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based detections. | +> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Defender for Endpoint behavioral based detections. | +> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Defender for Endpoint behavioral based detections. | > | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for detections associated with a file or process. | -> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV detections. | -> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV detections. | -> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV detections. | +> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Microsoft Defender AV detections. | +> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Microsoft Defender AV detections. | +> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Microsoft Defender AV detections. | > | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. | > | 15 | Url | requestUrl | down.esales360.cn | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. | -> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | -> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | +> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Microsoft Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | +> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Microsoft Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | > | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every Detection. | > | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every Detection. | > | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the event occurred. Value available for every Detection. | -> | 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined machines. Value available for every Detection. | +> | 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined devices. Value available for every Detection. | > | 22 | Actor | deviceCustomString4 | BORON | Available for alerts related to a known actor group. | -> | 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The machine fully qualified domain name. Value available for every Detection. | -> | | LogOnUsers | sourceUserId | contoso\liz-bean; contoso\jay-hardee | The domain and user of the interactive logon user/s at the time of the event. Note: For machines on Windows 10 version 1607, the domain information will not be available. | +> | 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The device fully qualified domain name. Value available for every Detection. | +> | | LogOnUsers | sourceUserId | contoso\liz-bean; contoso\jay-hardee | The domain and user of the interactive logon user/s at the time of the event. Note: For devices on Windows 10 version 1607, the domain information will not be available. | > | | InternalIPv4List | No mapping | 192.168.1.7, 10.1.14.1 | List of IPV4 internal IPs for active network interfaces. | > | | InternalIPv6List | No mapping | fd30:0000:0000:0001:ff4e:003e:0009:000e, FE80:CD00:0000:0CDE:1257:0000:211E:729C | List of IPV6 internal IPs for active network interfaces. | +| | LinkToMTP | No mapping | `https://security.microsoft.com/alert/da637370718981685665_16349121` | Value available for every Detection. +| | IncidentLinkToMTP | No mapping | `"https://security.microsoft.com/incidents/byalert?alertId=da637370718981685665_16349121&source=SIEM` | Value available for every Detection. +| | IncidentLinkToWDATP | No mapping | `https://securitycenter.windows.com/incidents/byalert?alertId=da637370718981685665_16349121&source=SIEM` | Value available for every Detection. > | Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that detections are retrieved. | > | | Not part of the schema | deviceVendor | | Static value in the ArcSight mapping - 'Microsoft'. | > | | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Microsoft Defender ATP'. | @@ -78,9 +85,9 @@ Field numbers match the numbers in the images below. ![Image of alert details pane with numbers](images/atp-siem-mapping13.png) -![Image of artifact timeline with numbers](images/atp-siem-mapping3.png) +![Image of artifact timeline with numbers1](images/atp-siem-mapping3.png) -![Image of artifact timeline with numbers](images/atp-siem-mapping4.png) +![Image of artifact timeline with numbers2](images/atp-siem-mapping4.png) ![Image machine view](images/atp-mapping6.png) @@ -90,8 +97,7 @@ Field numbers match the numbers in the images below. ## Related topics -- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) -- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) -- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) +- [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md) +- [Configure ArcSight to pull Microsoft Defender for Endpoint detections](configure-arcsight.md) +- [Pull Microsoft Defender for Endpoint detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md index b05666bfbf..e77e799097 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md @@ -1,10 +1,10 @@ --- title: Microsoft Defender ATP APIs connection to Power BI ms.reviewer: -description: Create custom reports using Power BI +description: Create a Power Business Intelligence (BI) report on top of Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) APIs. keywords: apis, supported apis, Power BI, reports search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,19 +13,29 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Create custom reports using Power BI -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -In this section you will learn create a Power BI report on top of Microsoft Defender ATP APIs. -The first example demonstrates how to connect Power BI to Advanced Hunting API and the second example demonstrates a connection to our OData APIs (e.g. Machine Actions, Alerts, etc..) +- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + +[!include[Improve request performance](../../includes/improve-request-performance.md)] + +In this section you will learn create a Power BI report on top of Defender for Endpoint APIs. + +The first example demonstrates how to connect Power BI to Advanced Hunting API and the second example demonstrates a connection to our OData APIs, such as Machine Actions or Alerts. ## Connect Power BI to Advanced Hunting API @@ -43,9 +53,9 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a ``` let - AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti'", + AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti' | limit 20", - HuntingUrl = "https://api.securitycenter.windows.com/api/advancedqueries", + HuntingUrl = "https://api.securitycenter.microsoft.com/api/advancedqueries", Response = Json.Document(Web.Contents(HuntingUrl, [Query=[key=AdvancedHuntingQuery]])), @@ -84,17 +94,17 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a - Click **Edit Credentials** - ![Image of edit credentials](images/power-bi-edit-credentials.png) + ![Image of edit credentials0](images/power-bi-edit-credentials.png) - Select **Organizational account** > **Sign in** - ![Image of set credentials](images/power-bi-set-credentials-organizational.png) + ![Image of set credentials1](images/power-bi-set-credentials-organizational.png) - Enter your credentials and wait to be signed in - Click **Connect** - ![Image of set credentials](images/power-bi-set-credentials-organizational-cont.png) + ![Image of set credentials2](images/power-bi-set-credentials-organizational-cont.png) - Now the results of your query will appear as table and you can start build visualizations on top of it! @@ -111,7 +121,7 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a Query = "MachineActions", - Source = OData.Feed("https://api.securitycenter.windows.com/api/" & Query, null, [Implementation="2.0", MoreColumns=true]) + Source = OData.Feed("https://api.securitycenter.microsoft.com/api/" & Query, null, [Implementation="2.0", MoreColumns=true]) in Source @@ -123,11 +133,13 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a ## Power BI dashboard samples in GitHub -For more information see the [Power BI report templates](https://github.com/microsoft/MDATP-PowerBI-Templates). +For more information see the [Power BI report templates](https://github.com/microsoft/MicrosoftDefenderATP-PowerBI). +## Sample reports +View the Microsoft Defender ATP Power BI report samples. For more information, see [Browse code samples](https://docs.microsoft.com/samples/browse/?products=mdatp). ## Related topic -- [Microsoft Defender ATP APIs](apis-intro.md) +- [Defender for Endpoint APIs](apis-intro.md) - [Advanced Hunting API](run-advanced-query-api.md) - [Using OData Queries](exposed-apis-odata-samples.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-release-notes.md b/windows/security/threat-protection/microsoft-defender-atp/api-release-notes.md new file mode 100644 index 0000000000..b46d84553b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/api-release-notes.md @@ -0,0 +1,73 @@ +--- +title: Microsoft Defender for Endpoint API release notes +description: Release notes for updates made to the Microsoft Defender for Endpoint set of APIs. +keywords: microsoft defender for endpoint api release notes, mde, apis, mdatp api, updates, notes, release +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# Microsoft Defender for Endpoint API release notes + +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +The following information lists the updates made to the Microsoft Defender for Endpoint APIs and the dates they were made. + + +### 25.01.2021 +
    + +- Updated rate limitations for [Advanced Hunting API](run-advanced-query-api.md) from 15 to 45 requests per minute. + +
    + +### 21.01.2021 +
    + +- Added new API: [Find devices by tag](machine-tags.md). +- Added new API: [Import Indicators](import-ti-indicators.md). + +
    + +### 03.01.2021 +
    + +- Updated Alert evidence: added ***detectionStatus***, ***parentProcessFilePath*** and ***parentProcessFileName*** properties. +- Updated [Alert entity](alerts.md): added ***detectorId*** property. + +
    + +### 15.12.2020 +
    + +- Updated [Device](machine.md) entity: added ***IpInterfaces*** list. See [List devices](get-machines.md). + +
    + +### 04.11.2020 +
    + +- Added new API: [Set device value](set-device-value.md). +- Updated [Device](machine.md) entity: added ***deviceValue*** property. + +
    + +### 01.09.2020 +
    + +- Added option to expand the Alert entity with its related Evidence. See [List Alerts](get-alerts.md). + +
    +
    \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md b/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md index 1e42b10a63..362d381ce7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md @@ -3,7 +3,7 @@ title: Microsoft Defender ATP API license and terms of use description: Description of the license and terms of use for Microsoft Defender APIs keywords: license, terms, apis, legal, notices, code of conduct search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,15 +12,22 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Microsoft Defender ATP API license and terms of use +# Microsoft Defender for Endpoint API license and terms of use + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ## APIs -Microsoft Defender ATP APIs are governed by [Microsoft API License and Terms of use](https://docs.microsoft.com/legal/microsoft-apis/terms-of-use). +Defender for Endpoint APIs are governed by [Microsoft API License and Terms of use](https://docs.microsoft.com/legal/microsoft-apis/terms-of-use). ### Throttling limits diff --git a/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md b/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md index 1c6f356099..c016af3404 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md +++ b/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md @@ -1,10 +1,10 @@ --- -title: Access the Microsoft Defender Advanced Threat Protection APIs +title: Access the Microsoft Defender Advanced Threat Protection APIs ms.reviewer: description: Learn how you can use APIs to automate workflows and innovate based on Microsoft Defender ATP capabilities -keywords: apis, api, wdatp, open api, windows defender atp api, public api, supported apis, alerts, machine, user, domain, ip, file, advanced hunting, query +keywords: apis, api, wdatp, open api, microsoft defender atp api, public api, supported apis, alerts, device, user, domain, ip, file, advanced hunting, query search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,34 +13,39 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- -# Access the Microsoft Defender Advanced Threat Protection APIs +# Access the Microsoft Defender for Endpoint APIs -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Microsoft Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-code). +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) -Watch this video for a quick overview of Microsoft Defender ATP's APIs. + +Defender for Endpoint exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Defender for Endpoint capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-code). + +Watch this video for a quick overview of Defender for Endpoint's APIs. >[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4d73M] In general, you’ll need to take the following steps to use the APIs: - Create an AAD application - Get an access token using this application -- Use the token to access Microsoft Defender ATP API +- Use the token to access Defender for Endpoint API -You can access Microsoft Defender ATP API with **Application Context** or **User Context**. +You can access Defender for Endpoint API with **Application Context** or **User Context**. - **Application Context: (Recommended)**
    Used by apps that run without a signed-in user present. for example, apps that run as background services or daemons. - Steps that need to be taken to access Microsoft Defender ATP API with application context: + Steps that need to be taken to access Defender for Endpoint API with application context: 1. Create an AAD Web-Application. 2. Assign the desired permission to the application, for example, 'Read Alerts', 'Isolate Machines'. @@ -54,7 +59,8 @@ You can access Microsoft Defender ATP API with **Application Context** or **User - **User Context:**
    Used to perform actions in the API on behalf of a user. - Steps that needs to be taken to access Microsoft Defender ATP API with application context: + Steps to take to access Defender for Endpoint API with application context: + 1. Create AAD Native-Application. 2. Assign the desired permission to the application, e.g 'Read Alerts', 'Isolate Machines' etc. 3. Get token using the application with user credentials. @@ -64,6 +70,6 @@ You can access Microsoft Defender ATP API with **Application Context** or **User ## Related topics -- [Microsoft Defender ATP APIs](exposed-apis-list.md) -- [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md) -- [Access Microsoft Defender ATP with user context](exposed-apis-create-app-nativeapp.md) +- [Microsoft Defender for Endpoint APIs](exposed-apis-list.md) +- [Access Microsoft Defender for Endpoint with application context](exposed-apis-create-app-webapp.md) +- [Access Microsoft Defender for Endpoint with user context](exposed-apis-create-app-nativeapp.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md b/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md index 4329883752..5efaab6c51 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md @@ -4,7 +4,7 @@ description: Assign read and write or read only access to the Microsoft Defender keywords: assign user roles, assign read and write access, assign read only access, user, user roles, roles search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,29 +13,35 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 11/28/2018 +ms.technology: mde --- # Assign user access to Microsoft Defender Security Center +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** - Azure Active Directory - Office 365 -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) -Microsoft Defender ATP supports two ways to manage permissions: +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +Defender for Endpoint supports two ways to manage permissions: - **Basic permissions management**: Set permissions to either full access or read-only. -- **Role-based access control (RBAC)**: Set granular permissions by defining roles, assigning Azure AD user groups to the roles, and granting the user groups access to machine groups. For more information on RBAC, see [Manage portal access using role-based access control](rbac.md). +- **Role-based access control (RBAC)**: Set granular permissions by defining roles, assigning Azure AD user groups to the roles, and granting the user groups access to device groups. For more information on RBAC, see [Manage portal access using role-based access control](rbac.md). > [!NOTE] > If you have already assigned basic permissions, you may switch to RBAC anytime. Consider the following before making the switch: > -> - Users with full access (users that are assigned the Global Administrator or Security Administrator directory role in Azure AD), are automatically assigned the default Microsoft Defender ATP administrator role, which also has full access. Additional Azure AD user groups can be assigned to the Microsoft Defender ATP administrator role after switching to RBAC. Only users assigned to the Microsoft Defender ATP administrator role can manage permissions using RBAC. +> - Users with full access (users that are assigned the Global Administrator or Security Administrator directory role in Azure AD), are automatically assigned the default Defender for Endpoint administrator role, which also has full access. Additional Azure AD user groups can be assigned to the Defender for Endpoint administrator role after switching to RBAC. Only users assigned to the Defender for Endpoint administrator role can manage permissions using RBAC. > - Users that have read-only access (Security Readers) will lose access to the portal until they are assigned a role. Note that only Azure AD user groups can be assigned a role under RBAC. > - After switching to RBAC, you will not be able to switch back to using basic permissions management. diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md b/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md index 26f0706b19..18bee0fadf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md @@ -1,10 +1,10 @@ --- title: Experience Microsoft Defender ATP through simulated attacks description: Run the provided attack scenario simulations to experience how Microsoft Defender ATP can detect, investigate, and respond to breaches. -keywords: wdatp, test, scenario, attack, simulation, simulated, diy, windows defender advanced threat protection +keywords: wdatp, test, scenario, attack, simulation, simulated, diy, microsoft defender advanced threat protection search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,28 +13,32 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 11/20/2018 +ms.technology: mde --- -# Experience Microsoft Defender ATP through simulated attacks +# Experience Microsoft Defender for Endpoint through simulated attacks + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink) >[!TIP] ->- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/). ->- Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). +>- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Defender for Endpoint?](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/). +>- Defender for Endpoint demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). -You might want to experience Microsoft Defender ATP before you onboard more than a few machines to the service. To do this, you can run controlled attack simulations on a few test machines. After running the simulated attacks, you can review how Microsoft Defender ATP surfaces malicious activity and explore how it enables an efficient response. +You might want to experience Defender for Endpoint before you onboard more than a few devices to the service. To do this, you can run controlled attack simulations on a few test devices. After running the simulated attacks, you can review how Defender for Endpoint surfaces malicious activity and explore how it enables an efficient response. ## Before you begin -To run any of the provided simulations, you need at least [one onboarded machine](onboard-configure.md). +To run any of the provided simulations, you need at least [one onboarded device](onboard-configure.md). Read the walkthrough document provided with each attack scenario. Each document includes OS and application requirements as well as detailed instructions that are specific to an attack scenario. @@ -44,24 +48,24 @@ Read the walkthrough document provided with each attack scenario. Each document - **Scenario 1: Document drops backdoor** - simulates delivery of a socially engineered lure document. The document launches a specially crafted backdoor that gives attackers control. - - **Scenario 2: PowerShell script in fileless attack** - simulates a fileless attack that relies on PowerShell, showcasing attack surface reduction and machine learning detection of malicious memory activity. + - **Scenario 2: PowerShell script in fileless attack** - simulates a fileless attack that relies on PowerShell, showcasing attack surface reduction and device learning detection of malicious memory activity. - **Scenario 3: Automated incident response** - triggers automated investigation, which automatically hunts for and remediates breach artifacts to scale your incident response capacity. 2. Download and read the corresponding walkthrough document provided with your selected scenario. -3. Download the simulation file or copy the simulation script by navigating to **Help** > **Simulations & tutorials**. You can choose to download the file or script on the test machine but it's not mandatory. +3. Download the simulation file or copy the simulation script by navigating to **Help** > **Simulations & tutorials**. You can choose to download the file or script on the test device but it's not mandatory. -4. Run the simulation file or script on the test machine as instructed in the walkthrough document. +4. Run the simulation file or script on the test device as instructed in the walkthrough document. > [!NOTE] -> Simulation files or scripts mimic attack activity but are actually benign and will not harm or compromise the test machine. +> Simulation files or scripts mimic attack activity but are actually benign and will not harm or compromise the test device. > > -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink) +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink) ## Related topics -- [Onboard machines](onboard-configure.md) -- [Onboard Windows 10 machines](configure-endpoints.md) \ No newline at end of file +- [Onboard devices](onboard-configure.md) +- [Onboard Windows 10 devices](configure-endpoints.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq.md index 9f14575d2d..475eaec908 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-faq.md @@ -4,10 +4,9 @@ description: Find answers to frequently asked questions about Microsoft Defender keywords: Attack surface reduction rules, asr, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP search.product: eADQiWindows 10XVcnh ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: martyav @@ -15,33 +14,39 @@ ms.author: v-maave ms.reviewer: manager: dansimp ms.custom: asr +ms.technology: mde --- # Attack surface reduction frequently asked questions (FAQ) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -**Is attack surface reduction (ASR) part of Windows?** +## Is attack surface reduction (ASR) part of Windows? -ASR was originally a feature of the suite of exploit guard features introduced as a major update to Windows Defender Antivirus, in Windows 10 version 1709. Windows Defender Antivirus is the native antimalware component of Windows. However, please note that the full ASR feature-set is only available with a Windows enterprise license. Also note that ASR rule exclusions are managed separately from Windows Defender Antivirus exclusions. +ASR was originally a feature of the suite of exploit guard features introduced as a major update to Microsoft Defender Antivirus, in Windows 10, version 1709. Microsoft Defender Antivirus is the native antimalware component of Windows. However, the full ASR feature-set is only available with a Windows enterprise license. Also note that ASR rule exclusions are managed separately from Microsoft Defender Antivirus exclusions. -**Do I need to have an enterprise license to run ASR rules?** +## Do I need to have an enterprise license to run ASR rules? -The full set of ASR rules and features are only supported if you have an enterprise license for Windows 10. A limited number of rules may work without an enterprise license, if you have Microsoft 365 Business, set Windows Defender Antivirus as your primary security solution, and enable the rules through PowerShell. However, ASR usage without an enterprise license is not officially supported and the full feature-set of ASR will not be available. +The full set of ASR rules and features is only supported if you have an enterprise license for Windows 10. A limited number of rules may work without an enterprise license. If you have Microsoft 365 Business, set Microsoft Defender Antivirus as your primary security solution, and enable the rules through PowerShell. However, ASR usage without an enterprise license is not officially supported and the full capabilities of ASR will not be available. -**Is ASR supported if I have an E3 license?** +To learn more about Windows licensing, see [Windows 10 Licensing](https://www.microsoft.com/licensing/product-licensing/windows10?activetab=windows10-pivot:primaryr5) and get the [Volume Licensing guide for Windows 10](https://download.microsoft.com/download/2/D/1/2D14FE17-66C2-4D4C-AF73-E122930B60F6/Windows-10-Volume-Licensing-Guide.pdf). -Yes. ASR is supported for Windows Enterprise E3 and above. See [Use attack surface reduction rules in Windows 10 Enterprise E3](attack-surface-reduction-rules-in-windows-10-enterprise-e3.md) for more details. +## Is ASR supported if I have an E3 license? -**Which features are supported with an E5 license?** +Yes. ASR is supported for Windows Enterprise E3 and above. + +## Which features are supported with an E5 license? All of the rules supported with E3 are also supported with E5. -E5 also added greater integration with Microsoft Defender ATP. With E5, you can [use Microsoft Defender ATP to monitor and review analytics](https://docs.microsoft.com/microsoft-365/security/mtp/monitor-devices?view=o365-worldwide#monitor-and-manage-asr-rule-deployment-and-detections) on alerts in real-time, fine-tune rule exclusions, configure ASR rules, and view lists of event reports. +E5 also added greater integration with Defender for Endpoint. With E5, you can [use Defender for Endpoint to monitor and review analytics](https://docs.microsoft.com/microsoft-365/security/mtp/monitor-devices?view=o365-worldwide&preserve-view=true#monitor-and-manage-asr-rule-deployment-and-detections) on alerts in real-time, fine-tune rule exclusions, configure ASR rules, and view lists of event reports. -**What are the the currently supported ASR rules??** +## What are the currently supported ASR rules? ASR currently supports all of the rules below: @@ -49,11 +54,11 @@ ASR currently supports all of the rules below: * [Block all Office applications from creating child processes](attack-surface-reduction.md#block-all-office-applications-from-creating-child-processes) * [Block Office applications from creating executable content](attack-surface-reduction.md#block-office-applications-from-creating-executable-content) * [Block Office applications from injecting code into other processes](attack-surface-reduction.md#block-office-applications-from-injecting-code-into-other-processes) -* [Block JavaScript or VBScript from launching downloaded executable content](attack-surface-reduction.md##block-javascript-or-vbscript-from-launching-downloaded-executable-content) +* [Block JavaScript or VBScript from launching downloaded executable content](attack-surface-reduction.md#block-javascript-or-vbscript-from-launching-downloaded-executable-content) * [Block execution of potentially obfuscated scripts](attack-surface-reduction.md#block-execution-of-potentially-obfuscated-scripts) * [Block Win32 API calls from Office macro](attack-surface-reduction.md#block-win32-api-calls-from-office-macros) -* [Use advanced protection against ransomware](attack-surface-reduction.md#use-advanced-protection-against-ransomware) -* [Block credential stealing from the Windows local security authority subsystem (lsass.exe)](attack-surface-reduction.md#block-credential-stealing-from-the-windows-local-security-authority-subsystem) +* [Use advanced protection against ransomware](attack-surface-reduction.md#use-advanced-protection-against-ransomware) +* [Block credential stealing from the Windows local security authority subsystem](attack-surface-reduction.md#block-credential-stealing-from-the-windows-local-security-authority-subsystem) (lsass.exe) * [Block process creations originating from PSExec and WMI commands](attack-surface-reduction.md#block-process-creations-originating-from-psexec-and-wmi-commands) * [Block untrusted and unsigned processes that run from USB](attack-surface-reduction.md#block-untrusted-and-unsigned-processes-that-run-from-usb) * [Block executable files from running unless they meet a prevalence, age, or trusted list criteria](attack-surface-reduction.md#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) @@ -61,39 +66,41 @@ ASR currently supports all of the rules below: * [Block Adobe Reader from creating child processes](attack-surface-reduction.md#block-adobe-reader-from-creating-child-processes) * [Block persistence through WMI event subscription](attack-surface-reduction.md#block-persistence-through-wmi-event-subscription) -**What are some good recommendations for getting started with ASR?** +## What are some good recommendations for getting started with ASR? -It is generally best to first test how ASR rules will impact your organization before enabling them, by running them in audit mode for a brief period of time. While you are running the rules in audit mode, you can identify any line-of-business applications that might get blocked erroneously, and exclude them from ASR. +Test how ASR rules will impact your organization before enabling them by running ASR rules in audit mode for a brief period of time. While you are running the rules in audit mode, you can identify any line-of-business applications that might get blocked erroneously, and exclude them from ASR. -Larger organizations should consider rolling out ASR rules in "rings," by auditing and enabling rules in increasingly-broader subsets of devices. You can arrange your organization's devices into rings by using Intune or a Group Policy management tool. +Larger organizations should consider rolling out ASR rules in "rings," by auditing and enabling rules in increasingly broader subsets of devices. You can arrange your organization's devices into rings by using Intune or a Group Policy management tool. -**How long should I test an ASR rule in audit mode before enabling it?** +## How long should I test an ASR rule in audit mode before enabling it? -You should keep the rule in audit mode for about 30 days. This amount of time gives you a good baseline for how the rule will operate once it goes live throughout your organization. During the audit period, you can identify any line-of-business applications that might get blocked by the rule, and configure the rule to exclude them. +Keep the rule in audit mode for about 30 days to get a good baseline for how the rule will operate once it goes live throughout your organization. During the audit period, you can identify any line-of-business applications that might get blocked by the rule, and configure the rule to exclude them. -**I'm making the switch from a third-party security solution to Microsoft Defender ATP. Is there an "easy" way to export rules from another security solution to ASR?** +## I'm making the switch from a third-party security solution to Defender for Endpoint. Is there an "easy" way to export rules from another security solution to ASR? -Rather than attempting to import sets of rules from another security solution, it is, in most cases, easier and safer to start with the baseline recommendations suggested for your organization by Microsoft Defender ATP, then use tools such as audit mode, monitoring, and analytics to configure your new solution to suit your unique needs. The default configuration for most ASR rules, combined with Defender's real-time protection, will protect against a large number of exploits and vulnerabilities. +In most cases, it's easier and better to start with the baseline recommendations suggested by [Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) than to attempt to import rules from another security solution. Then, use tools such as audit mode, monitoring, and analytics to configure your new solution to suit your unique needs. -From within Microsoft Defender ATP, you can update your defenses with custom indicators, to allow and block certain software behaviors. ASR also allows for some customization of rules, in the form of file and folder exclusions. As a general rule, it is best to audit a rule for a period of time, and configure exclusions for any line-of-business applications that might get blocked. +The default configuration for most ASR rules, combined with Defender for Endpoint's real-time protection, will protect against a large number of exploits and vulnerabilities. -**Does ASR support file or folder exclusions that include system variables and wildcards in the path?** +From within Defender for Endpoint, you can update your defenses with custom indicators, to allow and block certain software behaviors. ASR also allows for some customization of rules, in the form of file and folder exclusions. As a general rule, it is best to audit a rule for a period of time, and configure exclusions for any line-of-business applications that might get blocked. -Yes. See [Excluding files and folders from ASR rules](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for more details on excluding files or folders from ASR rules, and [Configure and validate exclusions based on file extension and folder location](../windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for more on using system variables and wildcards in excluded file paths. +## Does ASR support file or folder exclusions that include system variables and wildcards in the path? -**Do ASR rules cover all applications by default?** +Yes. See [Excluding files and folders from ASR rules](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for more details on excluding files or folders from ASR rules, and [Configure and validate exclusions based on file extension and folder location](../microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for more on using system variables and wildcards in excluded file paths. + +## Do ASR rules cover all applications by default? It depends on the rule. Most ASR rules cover the behavior of Microsoft Office products and services, such as Word, Excel, PowerPoint, and OneNote, or Outlook. Certain ASR rules, such as *Block execution of potentially obfuscated scripts*, are more general in scope. -**Does ASR support third-party security solutions?** +## Does ASR support third-party security solutions? ASR uses Microsoft Defender Antivirus to block applications. It is not possible to configure ASR to use another security solution for blocking at this time. -**I have an E5 license and enabled some ASR rules in conjunction with Microsoft Defender ATP. Is it possible for an ASR event to not show up at all in Microsoft Defender ATP's event timeline?** +## I have an E5 license and enabled some ASR rules in conjunction with Defender for Endpoint. Is it possible for an ASR event to not show up at all in Defender for Endpoint's event timeline? -Whenever a notification is triggered locally by an ASR rule, a report on the event is also sent to the Microsoft Defender ATP portal. If you're having trouble finding the event, you can filter the events timeline using the search box. You can also view ASR events by visiting **Go to attack surface management**, from the **Configuration management** icon in the Security Center taskbar. The attack surface management page includes a tab for report detections, which includes a full list of ASR rule events reported to Microsoft Defender ATP. +Whenever a notification is triggered locally by an ASR rule, a report on the event is also sent to the Defender for Endpoint portal. If you're having trouble finding the event, you can filter the events timeline using the search box. You can also view ASR events by visiting **Go to attack surface management**, from the **Configuration management** icon in the Security Center taskbar. The attack surface management page includes a tab for report detections, which includes a full list of ASR rule events reported to Defender for Endpoint. -**I applied a rule using GPO. Now when I try to check the indexing options for the rule in Microsoft Outlook, I get a message stating, 'Access denied'.** +## I applied a rule using GPO. Now when I try to check the indexing options for the rule in Microsoft Outlook, I get a message stating, 'Access denied'. Try opening the indexing options directly from Windows 10. @@ -101,30 +108,30 @@ Try opening the indexing options directly from Windows 10. 1. Enter **Indexing options** into the search box. -**Are the criteria used by the rule, *Block executable files from running unless they meet a prevalence, age, or trusted list criterion*, configurable by an admin?** +## Are the criteria used by the rule, "Block executable files from running unless they meet a prevalence, age, or trusted list criterion," configurable by an admin? -No. The criteria used by this rule are maintained by Microsoft cloud protection, to keep the trusted list constantly up-to-date with data gathered from around the world. Local admins do not have write access to alter this data. If you are looking to configure this rule to tailor it for your enterprise, you can add certain applications to the exclusions list to prevent the rule from being triggered. +No. The criteria used by this rule are maintained by Microsoft cloud protection, to keep the trusted list constantly up to date with data gathered from around the world. Local admins do not have write access to alter this data. If you are looking to configure this rule to tailor it for your enterprise, you can add certain applications to the exclusions list to prevent the rule from being triggered. -**I enabled the ASR rule, *Block executable files from running unless they meet a prevalence, age, or trusted list criterion*. After some time, I updated a piece of software, and the rule is now blocking it, even though it didn't before. Did something go wrong?** +## I enabled the ASR rule, *Block executable files from running unless they meet a prevalence, age, or trusted list criterion*. After some time, I updated a piece of software, and the rule is now blocking it, even though it didn't before. Did something go wrong? This rule relies upon each application having a known reputation, as measured by prevalence, age, or inclusion on a list of trusted apps. The rule's decision to block or allow an application is ultimately determined by Microsoft cloud protection's assessment of these criteria. -Usually, cloud protection can determine that a new version of an application is similar enough to previous versions that it does not need to be re-assessed at length. However, it might take some time for the app to build reputation after switching versions, particularly after a major update. In the meantime, you can add the application to the exclusions list, to prevent this rule from blocking important applications. If you are frequently updating and working with very new versions of applications, you may opt instead to run this rule in audit mode. +Usually, cloud protection can determine that a new version of an application is similar enough to previous versions that it does not need to be reassessed at length. However, it might take some time for the app to build reputation after switching versions, particularly after a major update. In the meantime, you can add the application to the exclusions list, to prevent this rule from blocking important applications. If you are frequently updating and working with new versions of applications, you may opt instead to run this rule in audit mode. -**I recently enabled the ASR rule, *Block credential stealing from the Windows local security authority subsystem (lsass.exe)*, and I am getting a large number of notifications. What is going on?** +## I recently enabled the ASR rule, *Block credential stealing from the Windows local security authority subsystem (lsass.exe)*, and I am getting a large number of notifications. What is going on? -A notification generated by this rule does not necessarily indicate malicious activity; however, this rule is still useful for blocking malicious activity, since malware often target lsass.exe to gain illicit access to accounts. The lsass.exe process stores user credentials in memory after a user has logged in. Windows uses these credentials to validate users and apply local security policies. +A notification generated by this rule does not necessarily indicate malicious activity; however, this rule is still useful for blocking malicious activity, since malware often targets lsass.exe to gain illicit access to accounts. The lsass.exe process stores user credentials in memory after a user has logged in. Windows uses these credentials to validate users and apply local security policies. -Because many legitimate processes throughout a typical day will be calling on lsass.exe for credentials, this rule can be especially noisy. If a known legitimate application causes this rule to generate an excessive amount of notifications, you can add it to the exclusion list. Most other ASR rules will generate a relatively smaller number of notifications, in comparison to this one, since calling on lsass.exe is typical of many applications' normal functioning. +Because many legitimate processes throughout a typical day will be calling on lsass.exe for credentials, this rule can be especially noisy. If a known legitimate application causes this rule to generate an excessive number of notifications, you can add it to the exclusion list. Most other ASR rules will generate a relatively smaller number of notifications, in comparison to this one, since calling on lsass.exe is typical of many applications' normal functioning. -**Is it a good idea to enable the rule, *Block credential stealing from the Windows local security authority subsystem (lsass.exe)*, alongside LSA protection?** +## Is it a good idea to enable the rule, *Block credential stealing from the Windows local security authority subsystem (lsass.exe)*, alongside LSA protection? Enabling this rule will not provide additional protection if you have [LSA protection](https://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#BKMK_HowToConfigure) enabled as well. Both the rule and LSA protection work in much the same way, so having both running at the same time would be redundant. However, sometimes you may not be able to enable LSA protection. In those cases, you can enable this rule to provide equivalent protection against malware that target lsass.exe. -## Related topics +## See also * [Attack surface reduction overview](attack-surface-reduction.md) * [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) * [Customize attack surface reduction rules](customize-attack-surface-reduction.md) * [Enable attack surface reduction rules](enable-attack-surface-reduction.md) -* [Compatibility of Microsoft Defender with other antivirus/antimalware](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md) +* [Compatibility of Microsoft Defender with other antivirus/antimalware](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md deleted file mode 100644 index 7dfd283a11..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Use attack surface reduction rules in Windows 10 Enterprise E3 -description: ASR rules can help prevent exploits from using apps and scripts to infect machines with malware -keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.reviewer: -manager: dansimp -ms.custom: asr ---- - -# Use attack surface reduction rules in Windows 10 Enterprise E3 - -**Applies to:** - -- Windows 10 Enterprise E3 - -Attack surface reduction rules help prevent actions and apps that are typically used by exploit-seeking malware to infect machines. This feature area includes the rules, monitoring, reporting, and analytics necessary for deployment that are included in [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), and require the Windows 10 Enterprise E5 license. - -A limited subset of basic attack surface reduction rules can technically be used with Windows 10 Enterprise E3. They can be used without the benefits of reporting, monitoring, and analytics, which provide the ease of deployment and management capabilities necessary for enterprises. - -Attack surface reduction rules are supported on Windows Server 2019 as well as Windows 10 clients. - -The limited subset of rules that can be used in Windows 10 Enterprise E3 include: - -- Block executable content from email client and webmail -- Block all Office applications from creating child processes -- Block Office applications from creating executable content -- Block Office applications from injecting code into other processes -- Block JavaScript or VBScript from launching downloaded executable content -- Block execution of potentially obfuscated scripts -- Block Win32 API calls from Office macro -- Use advanced protection against ransomware -- Block credential stealing from the Windows local security authority subsystem (lsass.exe) -- Block process creations originating from PSExec and WMI commands -- Block untrusted and unsigned processes that run from USB - -For more information about these rules, see [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md). - - ## Related topics - -Topic | Description ----|--- -[Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) | Use a tool to see a number of scenarios that demonstrate how attack surface reduction rules work, and what events would typically be created. -[Enable attack surface reduction rules](enable-attack-surface-reduction.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage attack surface reduction rules in your network. -[Customize attack surface reduction rules](customize-attack-surface-reduction.md) | Exclude specified files and folders from being evaluated by attack surface reduction rules and customize the notification that appears on a user's machine when a rule blocks an app or file. diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index da5160567b..5a9d398823 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -1,10 +1,9 @@ --- title: Use attack surface reduction rules to prevent malware infection -description: Attack surface reduction rules can help prevent exploits from using apps and scripts to infect machines with malware. +description: Attack surface reduction rules can help prevent exploits from using apps and scripts to infect devices with malware. keywords: Attack surface reduction rules, asr, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -12,49 +11,109 @@ ms.localizationpriority: medium audience: ITPro author: denisebmsft ms.author: deniseb -ms.reviewer: +ms.reviewer: sugamar, jcedola manager: dansimp ms.custom: asr +ms.technology: mde + --- -# Reduce attack surfaces with attack surface reduction rules +# Use attack surface reduction rules to prevent malware infection + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -> [!IMPORTANT] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +## Why attack surface reduction rules are important -Your attack surface is the total number of places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means offering attackers fewer ways to perform attacks. +Your organization's attack surface includes all the places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means protecting your organization's devices and network, which leaves attackers with fewer ways to perform attacks. Configuring attack surface reduction rules in Microsoft Defender for Endpoint can help! -Attack surface reduction rules target software behaviors that are often abused by attackers, such as: +Attack surface reduction rules target certain software behaviors, such as: -- Launching executable files and scripts that attempt to download or run files -- Running obfuscated or otherwise suspicious scripts -- Performing behaviors that apps don't usually initiate during normal day-to-day work +- Launching executable files and scripts that attempt to download or run files; +- Running obfuscated or otherwise suspicious scripts; and +- Performing behaviors that apps don't usually initiate during normal day-to-day work. -These behaviors are sometimes seen in legitimate applications; however, they are considered risky because they are commonly abused by malware. Attack surface reduction rules can constrain these kinds of risky behaviors and help keep your organization safe. - -Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity. - -Whenever a rule is triggered, a notification will be displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays within the Microsoft Defender Security Center and the Microsoft 365 security center. +Such software behaviors are sometimes seen in legitimate applications; however, these behaviors are often considered risky because they are commonly abused by attackers through malware. Attack surface reduction rules can constrain risky behaviors and help keep your organization safe. For more information about configuring attack surface reduction rules, see [Enable attack surface reduction rules](enable-attack-surface-reduction.md). +## Assess rule impact before deployment + +You can assess how an attack surface reduction rule might affect your network by opening the security recommendation for that rule in [threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/#tvm). + +:::image type="content" source="images/asrrecommendation.png" alt-text="Security reco for attack surface reduction rule"::: + +In the recommendation details pane, check for user impact to determine what percentage of your devices can accept a new policy enabling the rule in blocking mode without adversely affecting productivity. + +## Audit mode for evaluation + +Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would affect your organization if they were enabled. Run all rules in audit mode first so you can understand how they affect your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they might perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without reducing productivity. + +## Warn mode for users + +(**NEW**!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. When a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. + +Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks. + +### Requirements for warn mode to work + +Warn mode is supported on devices running the following versions of Windows: +- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) or later +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later + +Microsoft Defender Antivirus must be running with real-time protection in [Active mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility#functionality-and-features-available-in-each-state). + +In addition, make sure [Microsoft Defender Antivirus and antimalware updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus#monthly-platform-and-engine-versions) are installed. +- Minimum platform release requirement: `4.18.2008.9` +- Minimum engine release requirement: `1.1.17400.5` + +For more information and to get your updates, see [Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform). + +### Cases where warn mode is not supported + +Warn mode is not supported for the following attack surface reduction rules: + +- [Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) (GUID `d3e037e1-3eb8-44c8-a917-57927947596d`) +- [Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) (GUID `e6db77e5-3df2-4cf1-b95a-636979351e5b`) +- [Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) (GUID `c1db55ab-c21a-4637-bb3f-a12568109d35`) + +In addition, warn mode is not supported on devices running older versions of Windows. In those cases, attack surface reduction rules that are configured to run in warn mode will run in block mode. + +## Notifications and alerts + +Whenever an attack surface reduction rule is triggered, a notification is displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. + +In addition, when certain attack surface reduction rules are triggered, alerts are generated. + +Notifications and any alerts that are generated can be viewed in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and in the Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)). + +## Advanced hunting and attack surface reduction events + +You can use advanced hunting to view attack surface reduction events. To streamline the volume of incoming data, only unique processes for each hour are viewable with advanced hunting. The time of an attack surface reduction event is the first time that event is seen within the hour. + +For example, suppose that an attack surface reduction event occurs on 10 devices during the 2:00 PM hour. Suppose that the first event occurred at 2:15, and the last at 2:45. With advanced hunting, you'll see one instance of that event (even though it actually occurred on 10 devices), and its timestamp will be 2:15 PM. + +For more information about advanced hunting, see [Proactively hunt for threats with advanced hunting](advanced-hunting-overview.md). + ## Attack surface reduction features across Windows versions -You can set attack surface reduction rules for computers running the following versions of Windows: -- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later -- [Windows Server, version 1803](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) (Semi-Annual Channel) or later +You can set attack surface reduction rules for devices that are running any of the following editions and versions of Windows: +- Windows 10 Pro, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later +- Windows 10 Enterprise, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later +- Windows Server, [version 1803 (Semi-Annual Channel)](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) or later +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -To use the entire feature-set of attack surface reduction rules, you need a [Windows 10 Enterprise license](https://www.microsoft.com/licensing/product-licensing/windows10). With a [Windows E5 license](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses), you get advanced management capabilities including monitoring, analytics, and workflows available in [Microsoft Defender Advanced Threat Protection](microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the [Microsoft 365 security center](https://docs.microsoft.com/microsoft-365/security/mtp/overview-security-center). These advanced capabilities aren't available with an E3 license, but you can still use Event Viewer to review attack surface reduction rule events. +Although attack surface reduction rules don't require a [Windows E5 license](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses), if you have Windows E5, you get advanced management capabilities. These capabilities available only in Windows E5 include monitoring, analytics, and workflows available in [Defender for Endpoint](microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the [Microsoft 365 security center](https://docs.microsoft.com/microsoft-365/security/mtp/overview-security-center). These advanced capabilities aren't available with a Windows Professional or Windows E3 license; however, if you do have those licenses, you can use Event Viewer and Microsoft Defender Antivirus logs to review your attack surface reduction rule events. ## Review attack surface reduction events in the Microsoft Defender Security Center -Microsoft Defender ATP provides detailed reporting for events and blocks, as part of its alert investigation scenarios. +Defender for Endpoint provides detailed reporting for events and blocks as part of alert investigation scenarios. -You can query Microsoft Defender ATP data by using [advanced hunting](advanced-hunting-query-language.md). If you're running [audit mode](audit-windows-defender.md), you can use advanced hunting to understand how attack surface reduction rules could affect your environment. +You can query Defender for Endpoint data by using [advanced hunting](advanced-hunting-query-language.md). If you're running [audit mode](audit-windows-defender.md), you can use advanced hunting to understand how attack surface reduction rules could affect your environment. Here is an example query: @@ -67,72 +126,69 @@ DeviceEvents You can review the Windows event log to view events generated by attack surface reduction rules: -1. Download the [Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine. - +1. Download the [Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the device. 2. Enter the words, *Event Viewer*, into the Start menu to open the Windows Event Viewer. - 3. Under **Actions**, select **Import custom view...**. - 4. Select the file *cfa-events.xml* from where it was extracted. Alternatively, [copy the XML directly](event-views.md). - 5. Select **OK**. -This will create a custom view that filters events to only show the following, all of which are related to controlled folder access: +You can create a custom view that filters events to only show the following events, all of which are related to controlled folder access: |Event ID | Description | -|---|---| +|:---|:---| |5007 | Event when settings are changed | |1121 | Event when rule fires in Block-mode | |1122 | Event when rule fires in Audit-mode | -The "engine version" listed for attack surface reduction events in the event log, is generated by Microsoft Defender ATP, not by the operating system. Microsoft Defender ATP is integrated with Windows 10, so this feature works on all devices with Windows 10 installed. +The "engine version" listed for attack surface reduction events in the event log, is generated by Defender for Endpoint, not by the operating system. Defender for Endpoint is integrated with Windows 10, so this feature works on all devices with Windows 10 installed. ## Attack surface reduction rules -The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs: +The following table and subsections describe each of the 15 attack surface reduction rules. The attack surface reduction rules are listed in alphabetical order, by rule name. + +If you are configuring attack surface reduction rules by using Group Policy or PowerShell, you'll need the GUIDs. On the other hand, if you use Microsoft Endpoint Manager or Microsoft Intune, you do not need the GUIDs. + | Rule name | GUID | File & folder exclusions | Minimum OS supported | -|-----|----|---|---| -|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|:-----|:-----:|:-----|:-----| +|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Not supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) |`26190899-1602-49e8-8b27-eb1d0a1ce869` |Supported |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | |[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | `26190899-1602-49e8-8b27-eb1d0a1ce869` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | +|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -### Block executable content from email client and webmail +### Block Adobe Reader from creating child processes -This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers: +This rule prevents attacks by blocking Adobe Reader from creating processes. -- Executable files (such as .exe, .dll, or .scr) -- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +Through social engineering or exploits, malware can download and launch payloads, and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading. This rule was introduced in: -- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Microsoft Endpoint Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) +Intune name: `Process creation from Adobe Reader (beta)` -Microsoft Endpoint Configuration Manager name: Block executable content from email client and webmail +Configuration Manager name: Not yet available -GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` +GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` ### Block all Office applications from creating child processes -This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access. +This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. -Creating malicious child processes is a common malware strategy. Malware that abuse Office as a vector often run VBA macros and exploit code to download and attempt to run additional payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes, such as spawning a command prompt or using PowerShell to configure registry settings. +Creating malicious child processes is a common malware strategy. Malware that abuse Office as a vector often run VBA macros and exploit code to download and attempt to run more payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes, such as spawning a command prompt or using PowerShell to configure registry settings. This rule was introduced in: - [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) @@ -140,17 +196,124 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Office apps launching child processes +Intune name: `Office apps launching child processes` -Configuration Manager name: Block Office application from creating child processes +Configuration Manager name: `Block Office application from creating child processes` GUID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` +### Block credential stealing from the Windows local security authority subsystem + +This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS). + +LSASS authenticates users who sign in on a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. + +> [!NOTE] +> In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that simply enumerates LSASS, but has no real impact in functionality, there is NO need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. + +This rule was introduced in: +- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: `Flag credential stealing from the Windows local security authority subsystem` + +Configuration Manager name: `Block credential stealing from the Windows local security authority subsystem` + +GUID: `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` + +### Block executable content from email client and webmail + +This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers: + +- Executable files (such as .exe, .dll, or .scr) +- Script files (such as a PowerShell .ps, Visual Basic .vbs, or JavaScript .js file) + +This rule was introduced in: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Microsoft Endpoint Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: `Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions)` + +Microsoft Endpoint Manager name: `Block executable content from email client and webmail` + +GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` + +> [!NOTE] +> The rule **Block executable content from email client and webmail** has the following alternative descriptions, depending on which application you use: +> - Intune (Configuration Profiles): Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions). +> - Endpoint Manager: Block executable content download from email and webmail clients. +> - Group Policy: Block executable content from email client and webmail. + +### Block executable files from running unless they meet a prevalence, age, or trusted list criterion + +This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list: + +- Executable files (such as .exe, .dll, or .scr) + +Launching untrusted or unknown executable files can be risky, as it may not be initially clear if the files are malicious. + +> [!IMPORTANT] +> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule.

    The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID `01443614-cd74-433a-b99e-2ecdc07bfc25` is owned by Microsoft and is not specified by admins. This rule uses cloud-delivered protection to update its trusted list regularly. +> +>You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. + +This rule was introduced in: +- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: `Executables that don't meet a prevalence, age, or trusted list criteria` + +Configuration Manager name: `Block executable files from running unless they meet a prevalence, age, or trusted list criteria` + +GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25` + +### Block execution of potentially obfuscated scripts + +This rule detects suspicious properties within an obfuscated script. + +Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which prevents close scrutiny by humans and security software. + +This rule was introduced in: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: `Obfuscated js/vbs/ps/macro code` + +Configuration Manager name: `Block execution of potentially obfuscated scripts` + +GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` + +### Block JavaScript or VBScript from launching downloaded executable content + +This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet. + +Although not common, line-of-business applications sometimes use scripts to download and launch installers. + +This rule was introduced in: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: `js/vbs executing payload downloaded from Internet (no exceptions)` + +Configuration Manager name: `Block JavaScript or VBScript from launching downloaded executable content` + +GUID: `D3E037E1-3EB8-44C8-A917-57927947596D` + ### Block Office applications from creating executable content This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk. - Malware that abuses Office as a vector may attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique. +Malware that abuses Office as a vector may attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique. This rule was introduced in: - [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) @@ -158,9 +321,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [System Center Configuration Manager](https://docs.microsoft.com/configmgr/core/servers/manage/updates) (SCCM) CB 1710 (SCCM is now Microsoft Endpoint Configuration Manager) -Intune name: Office apps/macros creating executable content +Intune name: `Office apps/macros creating executable content` -SCCM name: Block Office applications from creating executable content +SCCM name: `Block Office applications from creating executable content` GUID: `3B576869-A4EC-4529-8536-B80A7769E899` @@ -180,133 +343,50 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Office apps injecting code into other processes (no exceptions) +Intune name: `Office apps injecting code into other processes (no exceptions)` -Configuration Manager name: Block Office applications from injecting code into other processes +Configuration Manager name: `Block Office applications from injecting code into other processes` GUID: `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` -### Block JavaScript or VBScript from launching downloaded executable content +### Block Office communication application from creating child processes -This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet. +This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions. -Although not common, line-of-business applications sometimes use scripts to download and launch installers. +This rule protects against social engineering attacks and prevents exploiting code from abusing vulnerabilities in Outlook. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised. + +> [!NOTE] +> This rule applies to Outlook and Outlook.com only. + +This rule was introduced in: +- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) + +Intune name: `Process creation from Office communication products (beta)` + +Configuration Manager name: Not available + +GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869` + +### Block persistence through WMI event subscription + +This rule prevents malware from abusing WMI to attain persistence on a device. > [!IMPORTANT] > File and folder exclusions don't apply to this attack surface reduction rule. -This rule was introduced in: -- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: js/vbs executing payload downloaded from Internet (no exceptions) - -Configuration Manager name: Block JavaScript or VBScript from launching downloaded executable content - -GUID: `D3E037E1-3EB8-44C8-A917-57927947596D` - -### Block execution of potentially obfuscated scripts - -This rule detects suspicious properties within an obfuscated script. - -Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which prevents close scrutiny by humans and security software. - -This rule was introduced in: -- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Obfuscated js/vbs/ps/macro code - -Configuration Manager name: Block execution of potentially obfuscated scripts. - -GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` - -### Block Win32 API calls from Office macros - -This rule prevents VBA macros from calling Win32 APIs. - -Office VBA provides the ability to make Win32 API calls. Malware can abuse this capability, such as [calling Win32 APIs to launch malicious shellcode](https://www.microsoft.com/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/) without writing anything directly to disk. Most organizations don't rely on the ability to call Win32 APIs in their day-to-day functioning, even if they use macros in other ways. - -This rule was introduced in: -- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Win32 imports from Office macro code - -Configuration Manager name: Block Win32 API calls from Office macros - -GUID: `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` - -### Block executable files from running unless they meet a prevalence, age, or trusted list criterion - -This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list: - -- Executable files (such as .exe, .dll, or .scr) - -Launching untrusted or unknown executable files can be risky, as it may not be initially clear if the files are malicious. - -> [!IMPORTANT] -> You must [enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) to use this rule.

    The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly. -> ->You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. +Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden. This rule was introduced in: -- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) +- [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) +- [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909) -Intune name: Executables that don't meet a prevalence, age, or trusted list criteria. +Intune name: Not available -Configuration Manager name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria +Configuration Manager name: Not available -GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25` - -### Use advanced protection against ransomware - -This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or an exclusion list. - -> [!NOTE] -> You must [enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) to use this rule. - -This rule was introduced in: -- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Advanced ransomware protection - -Configuration Manager name: Use advanced protection against ransomware - -GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35` - -### Block credential stealing from the Windows local security authority subsystem - -This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS). - -LSASS authenticates users who log in to a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. - -> [!NOTE] -> In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that overly enumerates LSASS, you need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. - -This rule was introduced in: -- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Flag credential stealing from the Windows local security authority subsystem - -Configuration Manager name: Block credential stealing from the Windows local security authority subsystem - -GUID: `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` +GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b` ### Block process creations originating from PSExec and WMI commands @@ -320,7 +400,7 @@ This rule was introduced in: - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -Intune name: Process creation from PSExec and WMI commands +Intune name: `Process creation from PSExec and WMI commands` Configuration Manager name: Not applicable @@ -328,10 +408,7 @@ GUID: `d1e49aac-8f56-4280-b9ba-993a6d77406c` ### Block untrusted and unsigned processes that run from USB -With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include: - -* Executable files (such as .exe, .dll, or .scr) -* Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include executable files (such as .exe, .dll, or .scr) This rule was introduced in: - [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) @@ -339,71 +416,52 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Untrusted and unsigned processes that run from USB +Intune name: `Untrusted and unsigned processes that run from USB` -Configuration Manager name: Block untrusted and unsigned processes that run from USB +Configuration Manager name: `Block untrusted and unsigned processes that run from USB` GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` -### Block Office communication application from creating child processes +### Block Win32 API calls from Office macros -This rule prevents Outlook from creating child processes, while till allowing legitimate Outlook functions. +This rule prevents VBA macros from calling Win32 APIs. -This protects against social engineering attacks and prevents exploit code from abusing vulnerabilities in Outlook. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised. +Office VBA enables Win32 API calls. Malware can abuse this capability, such as [calling Win32 APIs to launch malicious shellcode](https://www.microsoft.com/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/) without writing anything directly to disk. Most organizations don't rely on the ability to call Win32 APIs in their day-to-day functioning, even if they use macros in other ways. + +This rule was introduced in: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: `Win32 imports from Office macro code` + +Configuration Manager name: `Block Win32 API calls from Office macros` + +GUID: `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` + +### Use advanced protection against ransomware + +This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or an exclusion list. > [!NOTE] -> This rule applies to Outlook and Outlook.com only. +> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule. This rule was introduced in: -- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) +- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Process creation from Office communication products (beta) +Intune name: `Advanced ransomware protection` -Configuration Manager name: Not yet available +Configuration Manager name: `Use advanced protection against ransomware` -GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869` +GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35` -### Block Adobe Reader from creating child processes - -This rule prevents attacks by blocking Adobe Reader from creating additional processes. - -Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading. - -This rule was introduced in: -- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - -Intune name: Process creation from Adobe Reader (beta) - -Configuration Manager name: Not yet available - -GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` - -### Block persistence through WMI event subscription - -This rule prevents malware from abusing WMI to attain persistence on a device. - -Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden. - -This rule was introduced in: -- [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) -- [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909) - -Intune name: Block persistence through WMI event subscription - -Configuration Manager name: Not yet available - -GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b` - -## Related topics - -- [Attack surface reduction FAQ](attack-surface-reduction.md) +## See also +- [Attack surface reduction FAQ](attack-surface-reduction-faq.md) - [Enable attack surface reduction rules](enable-attack-surface-reduction.md) - - [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) - -- [Compatibility of Microsoft Defender with other antivirus/antimalware](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md) +- [Compatibility of Microsoft Defender Antivirus with other antivirus/antimalware solutions](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md b/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md index cb5f42efe4..4b16ba2447 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md +++ b/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md @@ -1,10 +1,9 @@ --- -title: Test how Microsoft Defender ATP features work -description: Audit mode lets you use the event log to see how Microsoft Defender ATP would protect your devices if it were enabled +title: Test how Microsoft Defender for Endpoint features work in audit mode +description: Audit mode helps you see how Microsoft Defender for Endpoint would protect your devices if it was enabled. keywords: exploit guard, audit, auditing, mode, enabled, disabled, test, demo, evaluate, lab search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -12,40 +11,41 @@ ms.localizationpriority: medium audience: ITPro author: levinec ms.author: ellevin -ms.date: 04/02/2019 ms.reviewer: manager: dansimp +ms.technology: mde --- -# Use audit mode +# Test how Microsoft Defender for Endpoint features work in audit mode + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -You can enable attack surface reduction rules, exploit protection, network protection, and controlled folder access in audit mode. This lets you see a record of what *would* have happened if you had enabled the feature. +You can enable attack surface reduction rules, exploit protection, network protection, and controlled folder access in audit mode. Audit mode lets you see a record of what *would* have happened if you had enabled the feature. -You might want to do this when testing how the features will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period. +You may want to enable audit mode when testing how the features will work in your organization. This will help make sure your line-of-business apps aren't affected. You can also get an idea of how many suspicious file modification attempts occur over a certain period of time. -While the features will not block or prevent apps, scripts, or files from being modified, the Windows Event Log will record events as if the features were fully enabled. This means you can enable audit mode and then review the event log to see what impact the feature would have had were it enabled. +The features won't block or prevent apps, scripts, or files from being modified. However, the Windows Event Log will record events as if the features were fully enabled. With audit mode, you can review the event log to see what impact the feature would have had if it was enabled. To find the audited entries, go to **Applications and Services** > **Microsoft** > **Windows** > **Windows Defender** > **Operational**. -You can use Windows Defender Advanced Threat Protection to get greater details for each event, especially for investigating attack surface reduction rules. Using the Microsoft Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). - -This topic provides links that describe how to enable the audit functionality for each feature and how to view events in the Windows Event Viewer. +You can use Defender for Endpoint to get greater details for each event, especially for investigating attack surface reduction rules. Using the Defender for Endpoint console lets you [investigate issues as part of the alert timeline and investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). You can use Group Policy, PowerShell, and configuration service providers (CSPs) to enable audit mode. >[!TIP] >You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. - Audit options | How to enable audit mode | How to view events --|-|- -Audit applies to all events | [Enable controlled folder access](enable-controlled-folders.md) | [Controlled folder access events](evaluate-controlled-folder-access.md#review-controlled-folder-access-events-in-windows-event-viewer) -Audit applies to individual rules | [Enable attack surface reduction rules](enable-attack-surface-reduction.md) | [Attack surface reduction rule events](evaluate-attack-surface-reduction.md#review-attack-surface-reduction-events-in-windows-event-viewer) -Audit applies to all events | [Enable network protection](enable-network-protection.md) | [Network protection events](evaluate-network-protection.md#review-network-protection-events-in-windows-event-viewer) -|Audit applies to individual mitigations | [Enable exploit protection](enable-exploit-protection.md) | [Exploit protection events](exploit-protection.md#review-exploit-protection-events-in-windows-event-viewer) + **Audit options** | **How to enable audit mode** | **How to view events** +|---------|---------|---------| +| Audit applies to all events | [Enable controlled folder access](enable-controlled-folders.md) | [Controlled folder access events](evaluate-controlled-folder-access.md#review-controlled-folder-access-events-in-windows-event-viewer) +| Audit applies to individual rules | [Enable attack surface reduction rules](enable-attack-surface-reduction.md) | [Attack surface reduction rule events](evaluate-attack-surface-reduction.md#review-attack-surface-reduction-events-in-windows-event-viewer) +| Audit applies to all events | [Enable network protection](enable-network-protection.md) | [Network protection events](evaluate-network-protection.md#review-network-protection-events-in-windows-event-viewer) +| Audit applies to individual mitigations | [Enable exploit protection](enable-exploit-protection.md) | [Exploit protection events](exploit-protection.md#review-exploit-protection-events-in-windows-event-viewer) ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md index eceb1d2833..f4a000c3eb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md +++ b/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center.md @@ -1,9 +1,9 @@ --- -title: View details and results of automated investigations +title: Visit the Action center to see remediation actions description: Use the action center to view details and results following an automated investigation keywords: action, center, autoir, automated, investigation, response, remediation search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,150 +12,78 @@ author: denisebmsft ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article +ms.collection: +- m365-security-compliance +- m365initiative-defender-endpoint +ms.topic: how-to +ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs +ms.date: 01/28/2021 +ms.technology: mde --- -# View details and results of automated investigations +# Visit the Action center to see remediation actions -During and after an automated investigation, certain remediation actions can be identified. Depending on the threat and how [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) (Microsoft Defender ATP) is configured for your organization, some remediation actions are taken automatically. +During and after an automated investigation, remediation actions for threat detections are identified. Depending on the particular threat and how [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) is configured for your organization, some remediation actions are taken automatically, and others require approval. If you're part of your organization's security operations team, you can view pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) in the **Action center**. -If you're part of your organization's security operations team, you can view pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) in the **Action center** ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)). You can also use the **Investigations** page ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to view details about an investigation. ->[!NOTE] ->If your organization has implemented role-based access to manage portal access, only authorized users or user groups who have permission to view the machine or machine group will be able to view the entire investigation. +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -## The Action center +## (NEW!) A unified Action center -![Action center page](images/action-center.png) -The action center consists of two main tabs: **Pending actions** and **History**. -- **Pending actions** Displays a list of ongoing investigations that require attention. Recommended actions are presented that your security operations team can approve or reject. The Pending tab appears only if there are pending actions to be approved (or rejected). -- **History** Acts as an audit log for all of the following items:
    - - Remediation actions that were taken as a result of an automated investigation - - Remediation actions that were approved by your security operations team (some actions, such as sending a file to quarantine, can be undone) - - Commands that were run and remediation actions that were applied in Live Response sessions (some actions can be undone) - - Remediation actions that were applied by Windows Defender Antivirus (some actions can be undone) +We are pleased to announce a new, unified Action center ([https://security.microsoft.com/action-center](https://security.microsoft.com/action-center))! -Use the **Customize columns** menu to select columns that you'd like to show or hide. +:::image type="content" source="images/mde-action-center-unified.png" alt-text="Action center in Microsoft 365 security center"::: -You can also download the entire list in CSV format using the **Export** feature, specify the number of items to show per page, and navigate between pages. +The following table compares the new, unified Action center to the previous Action center. -## The Investigations page - -![Image of Auto investigations page](images/atp-auto-investigations-list.png) - -On the **Investigations** page, you'll find a list of all automated investigations. Select an item in the list to view additional information about that automated investigation. - -By default, the automated investigations list displays investigations initiated in the last week. You can also choose to select other time ranges from the drop-down menu or specify a custom range. - -Use the **Customize columns** menu to select columns that you'd like to show or hide. - -From this view, you can also download the entire list in CSV format using the **Export** feature, specify the number of items to show per page, and navigate between pages. - -### Filters for the list of investigations - -On the **Investigations** page, you can view details and use filters to focus on specific information. The following table lists available filters: - -|Filter |Description | +|The new, unified Action center |The previous Action center | |---------|---------| -|**Status** |(See [Automated investigation status](#automated-investigation-status)) | -|**Triggering alert** | The alert that initiated the automated investigation | -|**Detection source** |The source of the alert that initiated the automated investigation | -|**Entities** | Entities can include device or machines, and machine groups. You can filter the automated investigations list to zone in a specific machine to see other investigations related to the machine, or to see specific machine groups that were created. | -|**Threat** |The category of threat detected during the automated investigation | -|**Tags** |Filter using manually added tags that capture the context of an automated investigation| -|**Comments** |Select between filtering the list between automated investigations that have comments and those that don't| +|Lists pending and completed actions for devices and email in one location
    ([Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) plus [Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp))|Lists pending and completed actions for devices
    ([Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) only) | +|Is located at:
    [https://security.microsoft.com/action-center](https://security.microsoft.com/action-center) |Is located at:
    [https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center) | +| In the Microsoft 365 security center, choose **Action center**.

    :::image type="content" source="images/action-center-nav-new.png" alt-text="Navigating to the Action Center in the Microsoft 365 security center"::: | In the Microsoft Defender Security Center, choose **Automated investigations** > **Action center**.

    :::image type="content" source="images/action-center-nav-old.png" alt-text="Navigating to the Action center from the Microsoft Defender Security Center"::: | -## Automated investigation status +The unified Action center brings together remediation actions across Defender for Endpoint and Defender for Office 365. It defines a common language for all remediation actions, and provides a unified investigation experience. -An automated investigation can have one of the following status values: +You can use the unified Action center if you have appropriate permissions and one or more of the following subscriptions: +- [Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) +- [Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp) +- [Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection) -|Status |Description | +> [!TIP] +> To learn more, see [Requirements](https://docs.microsoft.com/microsoft-365/security/mtp/prerequisites). + +## Using the Action center + +To get to the unified Action center in the improved Microsoft 365 security center: +1. Go to the Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)) and sign in. +2. In the navigation pane, select **Action center**. + +When you visit the Action center, you see two tabs: **Pending actions** and **History**. The following table summarizes what you'll see on each tab: + +|Tab |Description | |---------|---------| -| Running | The investigation process has started and is underway. Malicious artifacts that are found are remediated. | -| Partially investigated | Entities directly related to the alert have been investigated. However, a problem stopped the investigation of collateral entities. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) for specific details. | -| No threats found | The investigation has finished and no threats were identified.
    If you suspect something was missed (such as a false negative), you can use [advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview). | -| Pending action | The investigation has found a threat, and an action to remediate that threat is awaiting approval. The Pending Action state is triggered when any threat with a corresponding action is found. However, the list of pending actions can increase as an investigation runs. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to see if other items are still pending completion. | -| Remediated | The investigation finished and all actions were approved (fully remediated). | -| Partially remediated | The investigation resulted in remediation actions, and some were approved and completed. Other actions are still pending. | -| Terminated by system | The investigation stopped. An investigation can stop for several reasons:
    - The investigation's pending actions expired. Pending actions can time out after awaiting approval for an extended period of time.
    - There are too many actions in the list.
    Visit the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) to view and approve any pending actions. | -| Failed | At least one investigation analyzer ran into a problem where it could not complete properly.

    If an investigation fails after remediation actions were approved, the remediation actions might still have succeeded. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) for detailed results. | -| Queued | An investigation is being held in a queue. When other investigations complete, queued investigations begin. | -| Waiting for machine | Investigation paused. The investigation will resume as soon as the machine is available. | -| Terminated by user | A user stopped the investigation before it could complete. | +|**Pending** | Displays a list of actions that require attention. You can approve or reject actions one at a time, or select multiple actions if they have the same type of action (such as **Quarantine file**).
    **TIP**: Make sure to [review and approve (or reject) pending actions](manage-auto-investigation.md) as soon as possible so that your automated investigations can complete in a timely manner. | +|**History** | Serves as an audit log for actions that were taken, such as:
    - Remediation actions that were taken as a result of automated investigations
    - Remediation actions that were approved by your security operations team
    - Commands that were run and remediation actions that were applied during Live Response sessions
    - Remediation actions that were taken by threat protection features in Microsoft Defender Antivirus

    Provides a way to undo certain actions (see [Undo completed actions](manage-auto-investigation.md#undo-completed-actions)). | +You can customize, sort, filter, and export data in the Action center. -## View details about an automated investigation +:::image type="content" source="images/new-action-center-columnsfilters.png" alt-text="Columns and filters in the Action center"::: -![Image of investigation details window](images/atp-analyze-auto-ir.png) - -You can view the details of an automated investigation to see information such as the investigation graph, alerts associated with the investigation, the machine that was investigated, and other information. - -In this view, you'll see the name of the investigation, when it started and ended. - -### Investigation graph - -The investigation graph provides a graphical representation of an automated investigation. All investigation-related information is simplified and arranged in specific sections. Clicking on any of the icons brings you the relevant section where you can view more information. - -A progress ring shows two status indicators: -- Orange ring - shows the pending portion of the investigation -- Green ring - shows the running time portion of the investigation - -![Image of start, end, and pending time for an automated investigation](images/atp-auto-investigation-pending.png) - -In the example image, the automated investigation started on 10:26:59 AM and ended on 10:56:26 AM. Therefore, the entire investigation was running for 29 minutes and 27 seconds. - -The pending time of 16 minutes and 51 seconds reflects two possible pending states: pending for asset (for example, the device might have disconnected from the network) or pending for approval. - -From this view, you can also view and add comments and tags about the investigation. - -### Alerts - -The **Alerts** tab for an automated investigation shows details such as a short description of the alert that initiated the automated investigation, severity, category, the machine associated with the alert, user, time in queue, status, investigation state, and to whom the investigation is assigned. - -Additional alerts seen on a machine can be added to an automated investigation as long as the investigation is ongoing. - -Selecting an alert using the check box brings up the alerts details pane where you have the option of opening the alert page, manage the alert by changing its status, see alert details, automated investigation details, related machine, logged-on users, and comments and history. - -Clicking on an alert title brings you the alert page. - -### Machines - -The **Machines** tab Shows details the machine name, IP address, group, users, operating system, remediation level, investigation count, and when it was last investigated. - -Machines that show the same threat can be added to an ongoing investigation and will be displayed in this tab. If 10 or more machines are found during this expansion process from the same entity, then that expansion action will require an approval and will be seen in the **Pending actions** view. - -Selecting a machine using the checkbox brings up the machine details pane where you can see more information such as machine details and logged-on users. - -Clicking on a machine name brings you the machine page. - -### Evidence - -The **Evidence** tab shows details related to threats associated with this investigation. - -### Entities - -The **Entities** tab shows details about entities such as files, process, services, drives, and IP addresses. The table details such as the number of entities that were analyzed. You'll gain insight into details such as how many are remediated, suspicious, or determined to be clean. - -### Log - -The **Log** tab gives a chronological detailed view of all the investigation actions taken on the alert. You'll see the action type, action, status, machine name, description of the action, comments entered by analysts who may have worked on the investigation, execution start time, duration, pending duration. - -As with other sections, you can customize columns, select the number of items to show per page, and filter the log. - -Available filters include action type, action, status, machine name, and description. - -You can also click on an action to bring up the details pane where you'll see information such as the summary of the action and input data. - -### Pending actions - -If there are pending actions on an automated investigation, you'll see a pop-up similar to the following image. - -![Image of pending actions](images/pending-actions.png) - -When you click on the pending actions link, you'll be taken to the Action center. You can also navigate to the page from the navigation page by going to **automated investigation** > **Action center**. +- Select a column heading to sort items in ascending or descending order. +- Use the time period filter to view data for the past day, week, 30 days, or 6 months. +- Choose the columns that you want to view. +- Specify how many items to include on each page of data. +- Use filters to view just the items you want to see. +- Select **Export** to export results to a .csv file. ## Next steps -[View and approve remediation actions](manage-auto-investigation.md) +- [View and approve remediation actions](manage-auto-investigation.md) +- [See the interactive guide: Investigate and remediate threats with Microsoft Defender for Endpoint](https://aka.ms/MDATP-IR-Interactive-Guide) + +## See also + +- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/autoir-investigation-results.md b/windows/security/threat-protection/microsoft-defender-atp/autoir-investigation-results.md new file mode 100644 index 0000000000..dfde5d03b9 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/autoir-investigation-results.md @@ -0,0 +1,94 @@ +--- +title: Details and results of an automated investigation +description: During and after an automated investigation, you can view the results and key findings +keywords: automated, investigation, results, analyze, details, remediation, autoair +search.appverid: met150 +ms.prod: m365-security +ms.technology: mde +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: +- NOCSH +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- M365-security-compliance +- m365initiative-m365-defender +ms.topic: conceptual +ms.custom: autoir +ms.reviewer: evaldm, isco +ms.date: 02/02/2021 +--- + +# Details and results of an automated investigation + +**Applies to:** +- Microsoft Defender for Endpoint + +With Microsoft Defender for Endpoint, when an [automated investigation](automated-investigations.md) runs, details about that investigation are available both during and after the automated investigation process. If you have the necessary permissions, you can view those details in an investigation details view. The investigation details view provides you with up-to-date status and the ability to approve any pending actions. + +## (NEW!) Unified investigation page + +The investigation page has recently been updated to include information across your devices, email, and collaboration content. The new, unified investigation page defines a common language and provides a unified experience for automatic investigations across [Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) and [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/office-365-atp). + +> [!TIP] +> To learn more about what's changing, see [(NEW!) Unified investigation page](/microsoft-365/security/mtp/mtp-autoir-results). + +## Open the investigation details view + +You can open the investigation details view by using one of the following methods: +- [Select an item in the Action center](#select-an-item-in-the-action-center) +- [Select an investigation from an incident details page](#open-an-investigation-from-an-incident-details-page) + +### Select an item in the Action center + +The improved [Action center](auto-investigation-action-center.md) brings together [remediation actions](manage-auto-investigation.md#remediation-actions) across your devices, email & collaboration content, and identities. Listed actions include remediation actions that were taken automatically or manually. In the Action center, you can view actions that are awaiting approval and actions that were already approved or completed. You can also navigate to more details, such as an investigation page. + +1. Go to [https://security.microsoft.com](https://security.microsoft.com) and sign in. +2. In the navigation pane, choose **Action center**. +3. On either the **Pending** or **History** tab, select an item. Its flyout pane opens. +4. Review the information in the flyout pane, and then take one of the following steps: + - Select **Open investigation page** to view more details about the investigation. + - Select **Approve** to initiate a pending action. + - Select **Reject** to prevent a pending action from being taken. + - Select **Go hunt** to go into [Advanced hunting](advanced-hunting-overview.md). + +### Open an investigation from an incident details page + +Use an incident details page to view detailed information about an incident, including alerts that were triggered information about any affected devices, user accounts, or mailboxes. + +1. Go to [https://security.microsoft.com](https://security.microsoft.com) and sign in. +2. In the navigation pane, choose **Incidents & alerts** > **Incidents**. +3. Select an item in the list, and then choose **Open incident page**. +4. Select the **Investigations** tab, and then select an investigation in the list. Its flyout pane opens. +5. Select **Open investigation page**. + +## Investigation details + +Use the investigation details view to see past, current, and pending activity pertaining to an investigation. The investigation details view resembles the following image: + +In the Investigation details view, you can see information on the **Investigation graph**, **Alerts**, **Devices**, **Identities**, **Key findings**, **Entities**, **Log**, and **Pending actions** tabs, described in the following table. + +> [!NOTE] +> The specific tabs you see in an investigation details page depends on what your subscription includes. For example, if your subscription does not include Microsoft Defender for Office 365 Plan 2, you won't see a **Mailboxes** tab. + +| Tab | Description | +|:--------|:--------| +| **Investigation graph** | Provides a visual representation of the investigation. Depicts entities and lists threats found, along with alerts and whether any actions are awaiting approval.
    You can select an item on the graph to view more details. For example, selecting the **Evidence** icon takes you to the **Evidence** tab, where you can see detected entities and their verdicts. | +| **Alerts** | Lists alerts associated with the investigation. Alerts can come from threat protection features on a user's device, in Office apps, Cloud App Security, and other Microsoft 365 Defender features.| +| **Devices** | Lists devices included in the investigation along with their remediation level. (Remediation levels correspond to the [automation level for device groups](automation-levels.md).) | +| **Mailboxes** |Lists mailboxes that are impacted by detected threats. | +| **Users** | Lists user accounts that are impacted by detected threats. | +| **Evidence** | Lists pieces of evidence raised by alerts/investigations. Includes verdicts (*Malicious*, *Suspicious*, or *No threats found*) and remediation status. | +| **Entities** | Provides details about each analyzed entity, including a verdict for each entity type (*Malicious*, *Suspicious*, or *No threats found*).| +|**Log** | Provides a chronological, detailed view of all the investigation actions taken after an alert was triggered.| +| **Pending actions** | Lists items that require approval to proceed. Go to the Action center ([https://security.microsoft.com/action-center](https://security.microsoft.com/action-center)) to approve pending actions. | + +## See also + +- [Review remediation actions following an automated investigation](manage-auto-investigation.md) +- [View and organize the Microsoft Defender for Endpoint Incidents queue](view-incidents-queue.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md index 17a56b7252..ab8f4e0d15 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md @@ -1,93 +1,98 @@ --- title: Use automated investigations to investigate and remediate threats -description: Understand the automated investigation flow in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP). -keywords: automated, investigation, detection, source, threat types, id, tags, machines, duration, filter export +description: Understand the automated investigation flow in Microsoft Defender for Endpoint. +keywords: automated, investigation, detection, defender atp search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security +ms.technology: mde ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.author: deniseb author: denisebmsft +ms.date: 02/02/2021 ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual +ms.collection: +- m365-security-compliance +- m365initiative-defender-endpoint +ms.topic: how-to +ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs +ms.custom: AIR --- # Overview of automated investigations -> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bOeh] +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) offers a wide breadth of visibility on multiple machines. With this kind of optics, the service generates a multitude of alerts. The volume of alerts generated can be challenging for a typical security operations team to individually address. To address this challenge, Microsoft Defender ATP uses automated investigation and remediation capabilities to significantly reduce the volume of alerts that must be investigated individually. +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -The automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. The **Automated investigations** list shows all the investigations that were initiated automatically, and includes details, such as status, detection source, and when the investigation was initiated. + +Want to see how it works? Watch the following video:

    + +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4bOeh] + +The technology in automated investigation uses various inspection algorithms and is based on processes that are used by security analysts. AIR capabilities are designed to examine alerts and take immediate action to resolve breaches. AIR capabilities significantly reduce alert volume, allowing security operations to focus on more sophisticated threats and other high-value initiatives. All remediation actions, whether pending or completed, are tracked in the [Action center](auto-investigation-action-center.md). In the Action center, pending actions are approved (or rejected), and completed actions can be undone if needed. + +This article provides an overview of AIR and includes links to next steps and additional resources. > [!TIP] -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink) +> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink). ## How the automated investigation starts -When an alert is triggered, a security playbook goes into effect. Depending on the security playbook, an automated investigation can start. For example, suppose a malicious file resides on a machine. When that file is detected, an alert is triggered. The automated investigation process begins. Microsoft Defender ATP checks to see if the malicious file is present on any other machines in the organization. Details from the investigation, including verdicts (Malicious, Suspicious, and Clean) are available during and after the automated investigation. +An automated investigation can start when an alert is triggered or when a security operator initiates the investigation. ->[!NOTE] ->Currently, automated investigation only supports the following OS versions: ->- Windows Server 2019 ->- Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441)) or later ->- Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464/windows-10-update-kb4493464)) or later ->- Later versions of Windows 10 - -## Details of an automated investigation - -During and after an automated investigation, you can view details about the investigation. Selecting a triggering alert brings you to the investigation details view where you can pivot from the **Investigation graph**, **Alerts**, **Machines**, **Evidence**, **Entities**, and **Log** tabs. - -|Tab |Description | -|--|--| -|**Alerts**| Shows the alert that started the investigation.| -|**Machines** |Shows where the alert was seen.| -|**Evidence** |Shows the entities that were found to be malicious during the investigation.| -|**Entities** |Provides details about each analyzed entity, including a determination for each entity type (*Malicious*, *Suspicious*, or *Clean*). | -|**Log** |Shows the chronological detailed view of all the investigation actions taken on the alert.| -|**Pending actions** |If there are pending actions on the investigation, the **Pending actions** tab will be displayed where you can approve or reject actions. | - -> [!IMPORTANT] -> Go to the **Action center** to get an aggregated view all pending actions and manage remediation actions. The **Action center** also acts as an audit trail for all automated investigation actions. +|Situation |What happens | +|---------|---------| +|An alert is triggered | In general, an automated investigation starts when an [alert](review-alerts.md) is triggered, and an [incident](view-incidents-queue.md) is created. For example, suppose a malicious file resides on a device. When that file is detected, an alert is triggered, and incident is created. An automated investigation process begins on the device. As other alerts are generated because of the same file on other devices, they are added to the associated incident and to the automated investigation. | +|An investigation is started manually | An automated investigation can be started manually by your security operations team. For example, suppose a security operator is reviewing a list of devices and notices that a device has a high risk level. The security operator can select the device in the list to open its flyout, and then select **Initiate Automated Investigation**. | ## How an automated investigation expands its scope -While an investigation is running, any other alerts generated from the machine are added to an ongoing automated investigation until that investigation is completed. In addition, if the same threat is seen on other machines, those machines are added to the investigation. +While an investigation is running, any other alerts generated from the device are added to an ongoing automated investigation until that investigation is completed. In addition, if the same threat is seen on other devices, those devices are added to the investigation. -If an incriminated entity is seen in another machine, the automated investigation process will expand its scope to include that machine, and a general security playbook will start on that machine. If 10 or more machines are found during this expansion process from the same entity, then that expansion action will require an approval and will be seen in the **Pending actions** view. +If an incriminated entity is seen in another device, the automated investigation process expands its scope to include that device, and a general security playbook starts on that device. If 10 or more devices are found during this expansion process from the same entity, then that expansion action requires an approval, and is visible on the **Pending actions** tab. ## How threats are remediated -Depending on how you set up the machine groups and their level of automation, the automated investigation will either require user approval (default) or automatically remediate threats. +As alerts are triggered, and an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be +- *Malicious*; +- *Suspicious*; or +- *No threats found*. -You can configure the following levels of automation: +As verdicts are reached, automated investigations can result in one or more remediation actions. Examples of remediation actions include sending a file to quarantine, stopping a service, removing a scheduled task, and more. To learn more, see [Remediation actions](manage-auto-investigation.md#remediation-actions). -|Automation level | Description| -|---|---| -|No automated response | Machines do not get any automated investigations run on them. | -|Semi - require approval for any remediation | This is the default automation level.

    An approval is needed for any remediation action. | -|Semi - require approval for non-temp folders remediation | An approval is required on files or executables that are not in temporary folders.

    Files or executables in temporary folders, such as the user's download folder or the user's temp folder, will automatically be remediated if needed.| -|Semi - require approval for core folders remediation | An approval is required on files or executables that are in the operating system directories such as Windows folder and Program files folder.

    Files or executables in all other folders will automatically be remediated if needed.| -|Full - remediate threats automatically | All remediation actions will be performed automatically.| +Depending on the [level of automation](automation-levels.md) set for your organization, as well as other security settings, remediation actions can occur automatically or only upon approval by your security operations team. Additional security settings that can affect automatic remediation include [protection from potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus) (PUA). + +All remediation actions, whether pending or completed, are tracked in the [Action center](auto-investigation-action-center.md). If necessary, your security operations team can undo a remediation action. To learn more, see [Review and approve remediation actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation). > [!TIP] -> For more information on how to configure these automation levels, see [Create and manage machine groups](machine-groups.md). +> Check out the new, unified investigation page in the Microsoft 365 security center. To learn more, see [(NEW!) Unified investigation page](/microsoft-365/security/mtp/mtp-autoir-results.md#new-unified-investigation-page). -The default machine group is configured for semi-automatic remediation. This means that any malicious entity that calls for remediation requires an approval and the investigation is added to the **Pending actions** section. This can be changed to fully automatic so that no user approval is needed. -When a pending action is approved, the entity is then remediated and this new state is reflected in the **Entities** tab of the investigation. +## Requirements for AIR -## Next step +Your organization must have Defender for Endpoint (see [Minimum requirements for Microsoft Defender for Endpoint](minimum-requirements.md)). -- [Learn about the automated investigations dashboard](manage-auto-investigation.md) +Currently, AIR only supports the following OS versions: +- Windows Server 2019 +- Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441)) or later +- Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464/windows-10-update-kb4493464)) or later +- Windows 10, version [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later -## Related articles +## Next steps -- [Automated investigation and response in Office 365 Advanced Threat Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air) +- [Learn more about automation levels](automation-levels.md) +- [See the interactive guide: Investigate and remediate threats with Microsoft Defender for Endpoint](https://aka.ms/MDATP-IR-Interactive-Guide) +- [Configure automated investigation and remediation capabilities in Microsoft Defender for Endpoint](configure-automated-investigations-remediation.md) -- [Automated investigation and response in Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-autoir) \ No newline at end of file +## See also + +- [PUA protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus) +- [Automated investigation and response in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air) +- [Automated investigation and response in Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-autoir) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/automation-levels.md b/windows/security/threat-protection/microsoft-defender-atp/automation-levels.md new file mode 100644 index 0000000000..d0ace26d8c --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/automation-levels.md @@ -0,0 +1,66 @@ +--- +title: Automation levels in automated investigation and remediation +description: Get an overview of automation levels and how they work in Microsoft Defender for Endpoint +keywords: automated, investigation, level, defender atp +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.technology: mde +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.date: 10/22/2020 +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.topic: conceptual +ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs +ms.custom: AIR +--- + +# Automation levels in automated investigation and remediation capabilities + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +Automated investigation and remediation (AIR) capabilities in Microsoft Defender for Endpoint can be configured to one of several levels of automation. Your automation level affects whether remediation actions following AIR investigations are taken automatically or only upon approval. +- *Full automation* (recommended) means remediation actions are taken automatically on artifacts determined to be malicious. +- *Semi-automation* means some remediation actions are taken automatically, but other remediation actions await approval before being taken. (See the table in [Levels of automation](#levels-of-automation).) +- All remediation actions, whether pending or completed, are tracked in the Action Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). + +> [!TIP] +> For best results, we recommend using full automation when you [configure AIR](configure-automated-investigations-remediation.md). Data collected and analyzed over the past year shows that customers who are using full automation had 40% more high-confidence malware samples removed than customers who are using lower levels of automation. Full automation can help free up your security operations resources to focus more on your strategic initiatives. + +## Levels of automation + +The following table describes each level of automation and how it works. + +|Automation level | Description| +|:---|:---| +|**Full - remediate threats automatically**
    (also referred to as *full automation*)| With full automation, remediation actions are performed automatically. All remediation actions that are taken can be viewed in the [Action Center](auto-investigation-action-center.md) on the **History** tab. If necessary, a remediation action can be undone.

    ***Full automation is recommended** and is selected by default for tenants that were created on or after August 16, 2020 with Microsoft Defender for Endpoint, with no device groups defined yet.* | +|**Semi - require approval for any remediation**
    (also referred to as *semi-automation*)| With this level of semi-automation, approval is required for *any* remediation action. Such pending actions can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab.

    *This level of semi-automation is selected by default for tenants that were created before August 16, 2020 with Microsoft Defender ATP, with no device groups defined.*| +|**Semi - require approval for core folders remediation**
    (also a type of *semi-automation*) | With this level of semi-automation, approval is required for any remediation actions needed on files or executables that are in core folders. Core folders include operating system directories, such as the **Windows** (`\windows\*`).

    Remediation actions can be taken automatically on files or executables that are in other (non-core) folders.

    Pending actions for files or executables in core folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab.

    Actions that were taken on files or executables in other folders can be viewed in the [Action Center](auto-investigation-action-center.md), on the **History** tab. | +|**Semi - require approval for non-temp folders remediation**
    (also a type of *semi-automation*)| With this level of semi-automation, approval is required for any remediation actions needed on files or executables that are *not* in temporary folders.

    Temporary folders can include the following examples:
    - `\users\*\appdata\local\temp\*`
    - `\documents and settings\*\local settings\temp\*`
    - `\documents and settings\*\local settings\temporary\*`
    - `\windows\temp\*`
    - `\users\*\downloads\*`
    - `\program files\`
    - `\program files (x86)\*`
    - `\documents and settings\*\users\*`

    Remediation actions can be taken automatically on files or executables that are in temporary folders.

    Pending actions for files or executables that are not in temporary folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **Pending** tab.

    Actions that were taken on files or executables in temporary folders can be viewed and approved in the [Action Center](auto-investigation-action-center.md), on the **History** tab. | +|**No automated response**
    (also referred to as *no automation*) | With no automation, automated investigation does not run on your organization's devices. As a result, no remediation actions are taken or pending as a result of automated investigation. However, other threat protection features, such as [protection from potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus), can be in effect, depending on how your antivirus and next-generation protection features are configured.

    ***Using the *no automation* option is not recommended**, because it reduces the security posture of your organization's devices. [Consider setting up your automation level to full automation (or at least semi-automation)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups)*. | + +## Important points about automation levels + +- Full automation has proven to be reliable, efficient, and safe, and is recommended for all customers. Full automation frees up your critical security resources so they can focus more on your strategic initiatives. + +- New tenants (which include tenants that were created on or after August 16, 2020) with Microsoft Defender for Endpoint are set to full automation by default. + +- If your security team has defined device groups with a level of automation, those settings are not changed by the new default settings that are rolling out. + +- You can keep your default automation settings, or change them according to your organizational needs. To change your settings, [set your level of automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation#set-up-device-groups). + +## Next steps + +- [Configure automated investigation and remediation capabilities in Microsoft Defender for Endpoint](configure-automated-investigations-remediation.md) + +- [Visit the Action Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md b/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md index d9ced772ad..f543ecb8a9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md @@ -4,7 +4,7 @@ description: Learn how to use basic permissions to access the Microsoft Defender keywords: assign user roles, assign read and write access, assign read only access, user, user roles, roles search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,64 +13,76 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Use basic permissions to access the portal + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** - - Azure Active Directory -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-basicaccess-abovefoldlink) -Refer to the instructions below to use basic permissions management. +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-basicaccess-abovefoldlink) -You can use either of the following: +Refer to the instructions below to use basic permissions management. + +You can use either of the following solutions: - Azure PowerShell -- Azure Portal +- Azure portal For granular control over permissions, [switch to role-based access control](rbac.md). ## Assign user access using Azure PowerShell + You can assign users with one of the following levels of permissions: - Full access (Read and Write) - Read-only access ### Before you begin -- Install Azure PowerShell. For more information see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/documentation/articles/powershell-install-configure/).
    + +- Install Azure PowerShell. For more information, see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/documentation/articles/powershell-install-configure/).
    > [!NOTE] > You need to run the PowerShell cmdlets in an elevated command-line. -- Connect to your Azure Active Directory. For more information see, [Connect-MsolService](https://msdn.microsoft.com/library/dn194123.aspx). + +- Connect to your Azure Active Directory. For more information, see [Connect-MsolService](https://docs.microsoft.com/powershell/module/msonline/connect-msolservice?view=azureadps-1.0&preserve-view=true). **Full access**
    Users with full access can log in, view all system information and resolve alerts, submit files for deep analysis, and download the onboarding package. Assigning full access rights requires adding the users to the "Security Administrator" or "Global Administrator" AAD built-in roles. -**Read only access**
    -Users with read only access can log in, view all alerts, and related information. +**Read-only access**
    +Users with read-only access can log in, view all alerts, and related information. They will not be able to change alert states, submit files for deep analysis or perform any state changing operations. -Assigning read only access rights requires adding the users to the "Security Reader" AAD built-in role. +Assigning read-only access rights requires adding the users to the "Security Reader" Azure AD built-in role. Use the following steps to assign security roles: - For **read and write** access, assign users to the security administrator role by using the following command: - ```text + + ```PowerShell Add-MsolRoleMember -RoleName "Security Administrator" -RoleMemberEmailAddress "secadmin@Contoso.onmicrosoft.com" ``` -- For **read only** access, assign users to the security reader role by using the following command: - ```text + +- For **read-only** access, assign users to the security reader role by using the following command: + + ```PowerShell Add-MsolRoleMember -RoleName "Security Reader" -RoleMemberEmailAddress "reader@Contoso.onmicrosoft.com" ``` -For more information see, [Add or remove group memberships](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups). +For more information, see [Add or remove group members using Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal). ## Assign user access using the Azure portal -For more information, see [Assign administrator and non-administrator roles to uses with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). +For more information, see [Assign administrator and non-administrator roles to users with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). ## Related topic + - [Manage portal access using RBAC](rbac.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/batch-update-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/batch-update-alerts.md new file mode 100644 index 0000000000..2b93144552 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/batch-update-alerts.md @@ -0,0 +1,108 @@ +--- +title: Batch Update alert entities API +description: Learn how to update Microsoft Defender for Endpoint alerts in a batch by using this API. You can update the status, determination, classification, and assignedTo properties. +keywords: apis, graph api, supported apis, get, alert, information, id +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# Batch update alerts + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + +[!include[Improve request performance](../../includes/improve-request-performance.md)] + + +## API description +Updates properties of a batch of existing [Alerts](alerts.md). +
    Submission of **comment** is available with or without updating properties. +
    Updatable properties are: `status`, `determination`, `classification` and `assignedTo`. + + +## Limitations +1. You can update alerts that are available in the API. See [List Alerts](get-alerts.md) for more information. +2. Rate limitations for this API are 10 calls per minute and 500 calls per hour. + + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alerts.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +>[!Note] +> When obtaining a token using user credentials: +>- The user needs to have at least the following role permission: 'Alerts investigation' (See [Create and manage roles](user-roles.md) for more information) +>- The user needs to have access to the device associated with the alert, based on device group settings (See [Create and manage device groups](machine-groups.md) for more information) + +## HTTP request +```http +POST /api/alerts/batchUpdate +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | String | application/json. **Required**. + + +## Request body +In the request body, supply the IDs of the alerts to be updated and the values of the relevant fields that you wish to update for these alerts. +
    Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values. +
    For best performance you shouldn't include existing values that haven't changed. + +Property | Type | Description +:---|:---|:--- +alertIds | List<String>| A list of the IDs of the alerts to be updated. **Required** +status | String | Specifies the updated status of the specified alerts. The property values are: 'New', 'InProgress' and 'Resolved'. +assignedTo | String | Owner of the specified alerts +classification | String | Specifies the specification of the specified alerts. The property values are: 'Unknown', 'FalsePositive', 'TruePositive'. +determination | String | Specifies the determination of the specified alerts. The property values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other' +comment | String | Comment to be added to the specified alerts. + +## Response +If successful, this method returns 200 OK, with an empty response body. + + +## Example + +**Request** + +Here is an example of the request. + +```http +POST https://api.securitycenter.microsoft.com/api/alerts/batchUpdate +``` + +```json +{ + "alertIds": ["da637399794050273582_760707377", "da637399989469816469_51697947354"], + "status": "Resolved", + "assignedTo": "secop2@contoso.com", + "classification": "FalsePositive", + "determination": "Malware", + "comment": "Resolve my alert and assign to secop2" +} +``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment.md b/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment.md new file mode 100644 index 0000000000..f5c2868d55 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment.md @@ -0,0 +1,126 @@ +--- +title: Behavioral blocking and containment +description: Learn about behavioral blocking and containment capabilities in Microsoft Defender ATP +keywords: Microsoft Defender ATP, EDR in block mode, passive mode blocking +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +author: denisebmsft +ms.author: deniseb +manager: dansimp +ms.reviewer: shwetaj +audience: ITPro +ms.topic: article +ms.prod: m365-security +ms.localizationpriority: medium +ms.custom: + - next-gen + - edr +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.technology: mde +--- + +# Behavioral blocking and containment + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +## Overview + +Today’s threat landscape is overrun by [fileless malware](https://docs.microsoft.com/windows/security/threat-protection/intelligence/fileless-threats) and that lives off the land, highly polymorphic threats that mutate faster than traditional solutions can keep up with, and human-operated attacks that adapt to what adversaries find on compromised devices. Traditional security solutions are not sufficient to stop such attacks; you need artificial intelligence (AI) and device learning (ML) backed capabilities, such as behavioral blocking and containment, included in [Defender for Endpoint](https://docs.microsoft.com/windows/security). + +Behavioral blocking and containment capabilities can help identify and stop threats, based on their behaviors and process trees even when the threat has started execution. Next-generation protection, EDR, and Defender for Endpoint components and features work together in behavioral blocking and containment capabilities. + +:::image type="content" source="images/mdatp-next-gen-EDR-behavblockcontain.png" alt-text="Behavioral blocking and containment"::: + +Behavioral blocking and containment capabilities work with multiple components and features of Defender for Endpoint to stop attacks immediately and prevent attacks from progressing. + +- [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) (which includes Microsoft Defender Antivirus) can detect threats by analyzing behaviors, and stop threats that have started running. + +- [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) receives security signals across your network, devices, and kernel behavior. As threats are detected, alerts are created. Multiple alerts of the same type are aggregated into incidents, which makes it easier for your security operations team to investigate and respond. + +- [Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) has a wide range of optics across identities, email, data, and apps, in addition to the network, endpoint, and kernel behavior signals received through EDR. A component of [Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection), Defender for Endpoint processes and correlates these signals, raises detection alerts, and connects related alerts in incidents. + +With these capabilities, more threats can be prevented or blocked, even if they start running. Whenever suspicious behavior is detected, the threat is contained, alerts are created, and threats are stopped in their tracks. + +The following image shows an example of an alert that was triggered by behavioral blocking and containment capabilities: + +:::image type="content" source="images/blocked-behav-alert.png" alt-text="Example of an alert through behavioral blocking and containment"::: + +## Components of behavioral blocking and containment + +- **On-client, policy-driven [attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)** Predefined common attack behaviors are prevented from executing, according to your attack surface reduction rules. When such behaviors attempt to execute, they can be seen in the Microsoft Defender Security Center [https://securitycenter.windows.com](https://securitycenter.windows.com) as informational alerts. (Attack surface reduction rules are not enabled by default; you configure your policies in the Microsoft Defender Security Center.) + +- **[Client behavioral blocking](client-behavioral-blocking.md)** Threats on endpoints are detected through machine learning, and then are blocked and remediated automatically. (Client behavioral blocking is enabled by default.) + +- **[Feedback-loop blocking](feedback-loop-blocking.md)** (also referred to as rapid protection) Threat detections are observed through behavioral intelligence. Threats are stopped and prevented from running on other endpoints. (Feedback-loop blocking is enabled by default.) + +- **[Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md)** Malicious artifacts or behaviors that are observed through post-breach protection are blocked and contained. EDR in block mode works even if Microsoft Defender Antivirus is not the primary antivirus solution. (EDR in block mode is not enabled by default; you turn it on in the Microsoft Defender Security Center.) + +Expect more to come in the area of behavioral blocking and containment, as Microsoft continues to improve threat protection features and capabilities. To see what's planned and rolling out now, visit the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap). + +## Examples of behavioral blocking and containment in action + +Behavioral blocking and containment capabilities have blocked attacker techniques such as the following: + +- Credential dumping from LSASS +- Cross-process injection +- Process hollowing +- User Account Control bypass +- Tampering with antivirus (such as disabling it or adding the malware as exclusion) +- Contacting Command and Control (C&C) to download payloads +- Coin mining +- Boot record modification +- Pass-the-hash attacks +- Installation of root certificate +- Exploitation attempt for various vulnerabilities + +Below are two real-life examples of behavioral blocking and containment in action. + +### Example 1: Credential theft attack against 100 organizations + +As described in [In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks](https://www.microsoft.com/security/blog/2019/10/08/in-hot-pursuit-of-elusive-threats-ai-driven-behavior-based-blocking-stops-attacks-in-their-tracks), a credential theft attack against 100 organizations around the world was stopped by behavioral blocking and containment capabilities. Spear-phishing email messages that contained a lure document were sent to the targeted organizations. If a recipient opened the attachment, a related remote document was able to execute code on the user’s device and load Lokibot malware, which stole credentials, exfiltrated stolen data, and waited for further instructions from a command-and-control server. + +Behavior-based device learning models in Defender for Endpoint caught and stopped the attacker’s techniques at two points in the attack chain: +- The first protection layer detected the exploit behavior. Device learning classifiers in the cloud correctly identified the threat as and immediately instructed the client device to block the attack. +- The second protection layer, which helped stop cases where the attack got past the first layer, detected process hollowing, stopped that process, and removed the corresponding files (such as Lokibot). + +While the attack was detected and stopped, alerts, such as an "initial access alert," were triggered and appeared in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)): + +:::image type="content" source="images/behavblockcontain-initialaccessalert.png" alt-text="Initial access alert in the Microsoft Defender Security Center"::: + +This example shows how behavior-based device learning models in the cloud add new layers of protection against attacks, even after they have started running. + +### Example 2: NTLM relay - Juicy Potato malware variant + +As described in the recent blog post, [Behavioral blocking and containment: Transforming optics into protection](https://www.microsoft.com/security/blog/2020/03/09/behavioral-blocking-and-containment-transforming-optics-into-protection), in January 2020, Defender for Endpoint detected a privilege escalation activity on a device in an organization. An alert called “Possible privilege escalation using NTLM relay” was triggered. + +:::image type="content" source="images/NTLMalertjuicypotato.png" alt-text="NTLM alert for Juicy Potato malware"::: + +The threat turned out to be malware; it was a new, not-seen-before variant of a notorious hacking tool called Juicy Potato, which is used by attackers to get privilege escalation on a device. + +Minutes after the alert was triggered, the file was analyzed, and confirmed to be malicious. Its process was stopped and blocked, as shown in the following image: + +:::image type="content" source="images/Artifactblockedjuicypotato.png" alt-text="Artifact blocked"::: + +A few minutes after the artifact was blocked, multiple instances of the same file were blocked on the same device, preventing additional attackers or other malware from deploying on the device. + +This example shows that with behavioral blocking and containment capabilities, threats are detected, contained, and blocked automatically. + +## Next steps + +- [Learn more about Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) + +- [Configure your attack surface reduction rules](attack-surface-reduction.md) + +- [Enable EDR in block mode](edr-in-block-mode.md) + +- [See recent global threat activity](https://www.microsoft.com/wdsi/threats) + +- [Get an overview of Microsoft 365 Defender ](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection) diff --git a/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md b/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md index 3666eb4a2a..71162e7251 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md +++ b/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md @@ -1,10 +1,10 @@ --- title: Check the health state of the sensor in Microsoft Defender ATP -description: Check the sensor health on machines to identify which ones are misconfigured, inactive, or are not reporting sensor data. +description: Check the sensor health on devices to identify which ones are misconfigured, inactive, or are not reporting sensor data. keywords: sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communications, communication search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,45 +13,47 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 04/24/2018 +ms.technology: mde --- -# Check sensor health state in Microsoft Defender ATP +# Check sensor health state in Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-checksensor-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-checksensor-abovefoldlink) -The sensor health tile is found on the Security Operations dashboard. This tile provides information on the individual machine’s ability to provide sensor data and communicate with the Microsoft Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues. +The **Devices with sensor issues** tile is found on the Security Operations dashboard. This tile provides information on the individual device’s ability to provide sensor data and communicate with the Defender for Endpoint service. It reports how many devices require attention and helps you identify problematic devices and take action to correct known issues. -There are two status indicators on the tile that provide information on the number of machines that are not reporting properly to the service: -- **Misconfigured** - These machines might partially be reporting sensor data to the Microsoft Defender ATP service and might have configuration errors that need to be corrected. -- **Inactive** - Machines that have stopped reporting to the Microsoft Defender ATP service for more than seven days in the past month. +There are two status indicators on the tile that provide information on the number of devices that are not reporting properly to the service: +- **Misconfigured** - These devices might partially be reporting sensor data to the Defender for Endpoint service and might have configuration errors that need to be corrected. +- **Inactive** - Devices that have stopped reporting to the Defender for Endpoint service for more than seven days in the past month. +Clicking any of the groups directs you to **Devices list**, filtered according to your choice. -Clicking any of the groups directs you to Machines list, filtered according to your choice. +![Screenshot of Devices with sensor issues tile](images/atp-devices-with-sensor-issues-tile.png) -You can also download the entire list in CSV format using the **Export to CSV** feature. For more information on filters, see [View and organize the Machines list](machines-view-overview.md). +On **Devices list**, you can filter the health state list by the following status: +- **Active** - Devices that are actively reporting to the Defender for Endpoint service. +- **Misconfigured** - These devices might partially be reporting sensor data to the Defender for Endpoint service but have configuration errors that need to be corrected. Misconfigured devices can have either one or a combination of the following issues: + - **No sensor data** - Devices has stopped sending sensor data. Limited alerts can be triggered from the device. + - **Impaired communications** - Ability to communicate with device is impaired. Sending files for deep analysis, blocking files, isolating device from network and other actions that require communication with the device may not work. +- **Inactive** - Devices that have stopped reporting to the Defender for Endpoint service. -You can filter the health state list by the following status: -- **Active** - Machines that are actively reporting to the Microsoft Defender ATP service. -- **Misconfigured** - These machines might partially be reporting sensor data to the Microsoft Defender ATP service but have configuration errors that need to be corrected. Misconfigured machines can have either one or a combination of the following issues: - - **No sensor data** - Machines has stopped sending sensor data. Limited alerts can be triggered from the machine. - - **Impaired communications** - Ability to communicate with machine is impaired. Sending files for deep analysis, blocking files, isolating machine from network and other actions that require communication with the machine may not work. -- **Inactive** - Machines that have stopped reporting to the Microsoft Defender ATP service. - - -You can view the machine details when you click on a misconfigured or inactive machine. - -![Microsoft Defender ATP sensor filter](images/atp-machine-health-details.png) - -In the **Machines list**, you can download a full list of all the machines in your organization in a CSV format. +You can also download the entire list in CSV format using the **Export** feature. For more information on filters, see [View and organize the Devices list](machines-view-overview.md). >[!NOTE] ->Export the list in CSV format to display the unfiltered data. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself and can take a significant amount of time to download, depending on how large your organization is. +>Export the list in CSV format to display the unfiltered data. The CSV file will include all devices in the organization, regardless of any filtering applied in the view itself and can take a significant amount of time to download, depending on how large your organization is. + +![Screenshot of Devices list page](images/atp-devices-list-page.png) + +You can view the device details when you click on a misconfigured or inactive device. ## Related topic -- [Fix unhealthy sensors in Microsoft Defender ATP](fix-unhealthy-sensors.md) +- [Fix unhealthy sensors in Defender for Endpoint](fix-unhealthy-sensors.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/client-behavioral-blocking.md b/windows/security/threat-protection/microsoft-defender-atp/client-behavioral-blocking.md new file mode 100644 index 0000000000..e492aea556 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/client-behavioral-blocking.md @@ -0,0 +1,97 @@ +--- +title: Client behavioral blocking +description: Client behavioral blocking is part of behavioral blocking and containment capabilities in Microsoft Defender ATP +keywords: behavioral blocking, rapid protection, client behavior, Microsoft Defender ATP +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +author: denisebmsft +ms.author: deniseb +manager: dansimp +ms.reviewer: shwetaj +audience: ITPro +ms.topic: article +ms.prod: m365-security +ms.localizationpriority: medium +ms.custom: + - next-gen + - edr +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint +ms.technology: mde +--- + +# Client behavioral blocking + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +## Overview + +Client behavioral blocking is a component of [behavioral blocking and containment capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/behavioral-blocking-containment) in Defender for Endpoint. As suspicious behaviors are detected on devices (also referred to as clients or endpoints), artifacts (such as files or applications) are blocked, checked, and remediated automatically. + +:::image type="content" source="images/pre-execution-and-post-execution-detection-engines.png" alt-text="Cloud and client protection"::: + +Antivirus protection works best when paired with cloud protection. + +## How client behavioral blocking works + +[Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) can detect suspicious behavior, malicious code, fileless and in-memory attacks, and more on a device. When suspicious behaviors are detected, Microsoft Defender Antivirus monitors and sends those suspicious behaviors and their process trees to the cloud protection service. Machine learning differentiates between malicious applications and good behaviors within milliseconds, and classifies each artifact. In almost real time, as soon as an artifact is found to be malicious, it's blocked on the device. + +Whenever a suspicious behavior is detected, an [alert](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue) is generated, and is visible in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). + +Client behavioral blocking is effective because it not only helps prevent an attack from starting, it can help stop an attack that has begun executing. And, with [feedback-loop blocking](feedback-loop-blocking.md) (another capability of behavioral blocking and containment), attacks are prevented on other devices in your organization. + +## Behavior-based detections + +Behavior-based detections are named according to the [MITRE ATT&CK Matrix for Enterprise](https://attack.mitre.org/matrices/enterprise). The naming convention helps identify the attack stage where the malicious behavior was observed: + + +|Tactic | Detection threat name | +|----|----| +|Initial Access | Behavior:Win32/InitialAccess.*!ml | +|Execution | Behavior:Win32/Execution.*!ml | +|Persistence | Behavior:Win32/Persistence.*!ml | +|Privilege Escalation | Behavior:Win32/PrivilegeEscalation.*!ml | +|Defense Evasion | Behavior:Win32/DefenseEvasion.*!ml | +|Credential Access | Behavior:Win32/CredentialAccess.*!ml | +|Discovery | Behavior:Win32/Discovery.*!ml | +|Lateral Movement | Behavior:Win32/LateralMovement.*!ml | +|Collection | Behavior:Win32/Collection.*!ml | +|Command and Control | Behavior:Win32/CommandAndControl.*!ml | +|Exfiltration | Behavior:Win32/Exfiltration.*!ml | +|Impact | Behavior:Win32/Impact.*!ml | +|Uncategorized | Behavior:Win32/Generic.*!ml | + +> [!TIP] +> To learn more about specific threats, see **[recent global threat activity](https://www.microsoft.com/wdsi/threats)**. + + +## Configuring client behavioral blocking + +If your organization is using Defender for Endpoint, client behavioral blocking is enabled by default. However, to benefit from all Defender for Endpoint capabilities, including [behavioral blocking and containment](behavioral-blocking-containment.md), make sure the following features and capabilities of Defender for Endpoint are enabled and configured: + +- [Defender for Endpoint baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline) + +- [Devices onboarded to Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-configure) + +- [EDR in block mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode) + +- [Attack surface reduction](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction) + +- [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features) (antivirus) + +## Related articles + +- [Behavioral blocking and containment](behavioral-blocking-containment.md) + +- [Feedback-loop blocking](feedback-loop-blocking.md) + +- [(Blog) Behavioral blocking and containment: Transforming optics into protection](https://www.microsoft.com/security/blog/2020/03/09/behavioral-blocking-and-containment-transforming-optics-into-protection/) + +- [Helpful Defender for Endpoint resources](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/helpful-resources) diff --git a/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md b/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md index 1596496d14..3e7ccee247 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md +++ b/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package.md @@ -1,9 +1,9 @@ --- title: Collect investigation package API -description: Use this API to create calls related to the collecting an investigation package from a machine. +description: Use this API to create calls related to the collecting an investigation package from a device. keywords: apis, graph api, supported apis, collect investigation package search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,19 +12,29 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article - +ms.technology: mde --- # Collect investigation package API -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + + +- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + +[!include[Improve request performance](../../includes/improve-request-performance.md)] -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) ## API description -Collect investigation package from a machine. +Collect investigation package from a device. ## Limitations @@ -32,7 +42,7 @@ Collect investigation package from a machine. ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Defender for Endpoint APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -42,11 +52,11 @@ Delegated (work or school account) | Machine.CollectForensics | 'Collect forensi >[!Note] > When obtaining a token using user credentials: >- The user needs to have at least the following role permission: 'Alerts Investigation' (See [Create and manage roles](user-roles.md) for more information) ->- The user needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) +>- The user needs to have access to the device, based on device group settings (See [Create and manage device groups](machine-groups.md) for more information) ## HTTP request ``` -POST https://api.securitycenter.windows.com/api/machines/{id}/collectInvestigationPackage +POST https://api.securitycenter.microsoft.com/api/machines/{id}/collectInvestigationPackage ``` ## Request headers @@ -73,11 +83,11 @@ If successful, this method returns 201 - Created response code and [Machine Acti Here is an example of the request. -[!include[Improve request performance](../../includes/improve-request-performance.md)] - +```http +POST https://api.securitycenter.microsoft.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage ``` -POST https://api.securitycenter.windows.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage -Content-type: application/json + +```json { "Comment": "Collect forensics due to alert 1234" } diff --git a/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md b/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md deleted file mode 100644 index de0e22cee2..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Microsoft Defender ATP for US Government GCC High customers -description: Learn about the requirements and the available Microsoft Defender ATP capabilities for US Government CCC High customers -keywords: government, gcc, high, requirements, capabilities, defender, defender atp, mdatp -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Microsoft Defender ATP for US Government GCC High customers - -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for US Government Community Cloud High (GCC High) customers, built in the US Azure Government environment, uses the same underlying technologies as Microsoft Defender ATP in Azure Commercial. - -This offering is currently available to US Office 365 GCC High customers and is based on the same prevention, detection, investigation, and remediation as the commercial version. However, there are some key differences in the availability of capabilities for this offering. - - -## Endpoint versions -The following OS versions are supported: - -- Windows 10, version 1903 -- Windows 10, version 1809 (OS Build 17763.404 with [KB4490481](https://support.microsoft.com/en-us/help/4490481)) -- Windows 10, version 1803 (OS Build 17134.799 with [KB4499183](https://support.microsoft.com/help/4499183)) -- Windows 10, version 1709 (OS Build 16299.1182 with [KB4499147](https://support.microsoft.com/help/4499147)) -- Windows Server, 2019 (with [KB4490481](https://support.microsoft.com/en-us/help/4490481)) - ->[!NOTE] ->A patch must be deployed before machine onboarding in order to configure Microsoft Defender ATP to the correct environment. - -The following OS versions are not supported: -- Windows Server 2008 R2 SP1 -- Windows Server 2012 R2 -- Windows Server 2016 -- Windows Server, version 1803 -- Windows 7 SP1 Enterprise -- Windows 7 SP1 Pro -- Windows 8 Pro -- Windows 8.1 Enterprise -- macOS - -The initial release of Microsoft Defender ATP will not have immediate parity with the commercial offering. While our goal is to deliver all commercial features and functionality to our US Government (GCC High) customers, there are some capabilities not yet available that we'd like to highlight. These are the known gaps as of August 2019: - -## Threat & Vulnerability Management -Not currently available. - - -## Automated investigation and remediation -The following capabilities are not currently available: -- Response to Office 365 alerts -- Live response - - - -## Management and APIs -The following capabilities are not currently available: - -- Threat protection report -- Machine health and compliance report -- Integration with third-party products - - -## Email notifications -Not currently available. - - -## Integrations -Integrations with the following Microsoft products are not currently available: -- Azure Advanced Threat Protection -- Azure Information Protection -- Office 365 Advanced Threat Protection -- Microsoft Cloud App Security -- Skype for Business -- Microsoft Intune (sharing of device information and enhanced policy enforcement) - -## Microsoft Threat Experts -Not currently available. - -## Required connectivity settings -You'll need to ensure that traffic from the following are allowed: - -Service location | DNS record -:---|:--- -Common URLs for all locations (Global location) | ```crl.microsoft.com```
    ```ctldl.windowsupdate.com```
    ```notify.windows.com```
    ```settings-win.data.microsoft.com```

    NOTE: ```settings-win.data.microsoft.com``` is only needed on Windows 10 machines running version 1803 or earlier. -Microsoft Defender ATP GCC High specific | ```us4-v20.events.data.microsoft.com```
    ```winatp-gw-usgt.microsoft.com```
    ```winatp-gw-usgv.microsoft.com```
    ```*.blob.core.usgovcloudapi.net``` - - - diff --git a/windows/security/threat-protection/microsoft-defender-atp/common-errors.md b/windows/security/threat-protection/microsoft-defender-atp/common-errors.md index bcc6ba7dc3..60e31e7900 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/common-errors.md +++ b/windows/security/threat-protection/microsoft-defender-atp/common-errors.md @@ -1,9 +1,9 @@ --- title: Common Microsoft Defender ATP API errors description: List of common Microsoft Defender ATP API errors with descriptions. -keywords: apis, mdatp api, errors, troubleshooting +keywords: apis, mdatp api, errors, troubleshooting search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,16 +12,21 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Common REST API error codes -* The error codes listed in the following table may be returned by an operation on any of Microsoft Defender ATP APIs. -* Note that in addition to the error code, every error response contains an error message which can help resolving the problem. +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +* The table below shows the error codes that may be returned by an operation from the Microsoft Defender for Endpoint APIs. +* In addition to the error code, every error response contains an error message that can help describe the problem. * Note that the message is a free text that can be changed. -* At the bottom of the page you can find response examples. +* At the bottom of the page, you can find response examples. Error code |HTTP status code |Message :---|:---|:--- @@ -37,19 +42,20 @@ MaximumBatchSizeExceeded | BadRequest (400) | Maximum batch size exceeded. Recei MissingRequiredParameter | BadRequest (400) | Parameter {the missing parameter} is missing. OsPlatformNotSupported | BadRequest (400) | OS Platform {the client OS Platform} is not supported for this action. ClientVersionNotSupported | BadRequest (400) | {The requested action} is supported on client version {supported client version} and above. -Unauthorized | Unauthorized (401) | Unauthorized (usually invalid or expired authorization header). +Unauthorized | Unauthorized (401) | Unauthorized (invalid or expired authorization header). Forbidden | Forbidden (403) | Forbidden (valid token but insufficient permission for the action). DisabledFeature | Forbidden (403) | Tenant feature is not enabled. DisallowedOperation | Forbidden (403) | {the disallowed operation and the reason}. NotFound | Not Found (404) | General Not Found error message. ResourceNotFound | Not Found (404) | Resource {the requested resource} was not found. -InternalServerError | Internal Server Error (500) | (No error message, try retry the operation or contact us if it does not resolved) +InternalServerError | Internal Server Error (500) | (No error message, retry the operation) +TooManyRequests | Too Many Requests (429) | Response will represent reaching quota limit either by number of requests or by CPU. -## Body parameters are case sensitive +## Body parameters are case-sensitive -The submitted body parameters are currently case sensitive. +The submitted body parameters are currently case-sensitive.
    If you experience an **InvalidRequestBody** or **MissingRequiredParameter** errors, it might be caused from a wrong parameter capital or lower-case letter. -
    It is recommended to go to the requested Api documentation page and check that the submitted parameters match the relevant example. +
    Review the API documentation page and check that the submitted parameters match the relevant example. ## Correlation request ID diff --git a/windows/security/threat-protection/microsoft-defender-atp/community.md b/windows/security/threat-protection/microsoft-defender-atp/community.md index 78f18ff20e..e8debb489b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/community.md +++ b/windows/security/threat-protection/microsoft-defender-atp/community.md @@ -1,10 +1,10 @@ --- -title: Access the Microsoft Defender ATP Community Center -description: Access the Microsoft Defender ATP Community Center to share experiences, engange, and learn about the product. +title: Access the Microsoft Defender for Endpoint Community Center +description: Access the Microsoft Defender ATP Community Center to share experiences, engage, and learn about the product. keywords: community, community center, tech community, conversation, announcements search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,20 +13,24 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/24/2018 +ms.technology: mde --- -# Access the Microsoft Defender ATP Community Center +# Access the Microsoft Defender for Endpoint Community Center + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) - -The Microsoft Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product. +The Defender for Endpoint Community Center is a place where community members can learn, collaborate, and share experiences about the product. There are several spaces you can explore to learn about specific information: - Announcements @@ -35,8 +39,8 @@ There are several spaces you can explore to learn about specific information: There are several ways you can access the Community Center: -- In the Microsoft Defender Security Center navigation pane, select **Community center**. A new browser tab opens and takes you to the Microsoft Defender ATP Tech Community page. -- Access the community through the [Microsoft Defender Advanced Threat Protection Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced) page +- In the Microsoft Defender Security Center navigation pane, select **Community center**. A new browser tab opens and takes you to the Defender for Endpoint Tech Community page. +- Access the community through the [Microsoft Defender for Endpoint Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced) page You can instantly view and read conversations that have been posted in the community. diff --git a/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md b/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md index b58503a9c9..93ea0017f4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md @@ -4,7 +4,7 @@ description: Enable Conditional Access to prevent applications from running if a keywords: conditional access, block applications, security level, intune, search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,18 +13,20 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Enable Conditional Access to better protect users, devices, and data +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-conditionalaccess-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-conditionalaccess-abovefoldlink) Conditional Access is a capability that helps you better protect your users and enterprise information by making sure that only secure devices have access to applications. @@ -34,14 +36,14 @@ With Conditional Access, you can control access to enterprise information based You can define security conditions under which devices and applications can run and access information from your network by enforcing policies to stop applications from running until a device returns to a compliant state. -The implementation of Conditional Access in Microsoft Defender ATP is based on Microsoft Intune (Intune) device compliance policies and Azure Active Directory (Azure AD) conditional access policies. +The implementation of Conditional Access in Defender for Endpoint is based on Microsoft Intune (Intune) device compliance policies and Azure Active Directory (Azure AD) conditional access policies. The compliance policy is used with Conditional Access to allow only devices that fulfill one or more device compliance policy rules to access applications. ## Understand the Conditional Access flow Conditional Access is put in place so that when a threat is seen on a device, access to sensitive content is blocked until the threat is remediated. -The flow begins with machines being seen to have a low, medium, or high risk. These risk determinations are then sent to Intune. +The flow begins with devices being seen to have a low, medium, or high risk. These risk determinations are then sent to Intune. Depending on how you configure policies in Intune, Conditional Access can be set up so that when certain conditions are met, the policy is applied. @@ -55,8 +57,8 @@ To resolve the risk found on a device, you'll need to return the device to a com There are three ways to address a risk: 1. Use Manual or automated remediation. -2. Resolve active alerts on the machine. This will remove the risk from the machine. -3. You can remove the machine from the active policies and consequently, Conditional Access will not be applied on the machine. +2. Resolve active alerts on the device. This will remove the risk from the device. +3. You can remove the device from the active policies and consequently, Conditional Access will not be applied on the device. Manual remediation requires a secops admin to investigate an alert and address the risk seen on the device. The automated remediation is configured through configuration settings provided in the following section, [Configure Conditional Access](configure-conditional-access.md). @@ -64,15 +66,15 @@ When the risk is removed either through manual or automated remediation, the dev The following example sequence of events explains Conditional Access in action: -1. A user opens a malicious file and Microsoft Defender ATP flags the device as high risk. +1. A user opens a malicious file and Defender for Endpoint flags the device as high risk. 2. The high risk assessment is passed along to Intune. In parallel, an automated investigation is initiated to remediate the identified threat. A manual remediation can also be done to remediate the identified threat. 3. Based on the policy created in Intune, the device is marked as not compliant. The assessment is then communicated to Azure AD by the Intune Conditional Access policy. In Azure AD, the corresponding policy is applied to block access to applications. -4. The manual or automated investigation and remediation is completed and the threat is removed. Microsoft Defender ATP sees that there is no risk on the device and Intune assesses the device to be in a compliant state. Azure AD applies the policy which allows access to applications. +4. The manual or automated investigation and remediation is completed and the threat is removed. Defender for Endpoint sees that there is no risk on the device and Intune assesses the device to be in a compliant state. Azure AD applies the policy which allows access to applications. 5. Users can now access applications. ## Related topic -- [Configure Conditional Access in Microsoft Defender ATP](configure-conditional-access.md) +- [Configure Conditional Access in Microsoft Defender for Endpoint](configure-conditional-access.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md deleted file mode 100644 index 06bd8455af..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Overview of Configuration score in Microsoft Defender Security Center -description: Your configuration score shows the collective security configuration state of your machines across application, operating system, network, accounts, and security controls -keywords: configuration score, mdatp configuration score, secure score, security controls, improvement opportunities, security configuration score over time, security posture, baseline -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: ellevin -author: levinec -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- -# Configuration score - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->[!NOTE] -> Secure score is now part of Threat & Vulnerability Management as Configuration score. - -Your Configuration score is visible in the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) of the Microsoft Defender Security Center. A higher configuration score means your endpoints are more resilient from cybersecurity threat attacks. It reflects the collective security configuration state of your machines across the following categories: - -- Application -- Operating system -- Network -- Accounts -- Security controls - -Select a category to go to the [**Security recommendations**](tvm-security-recommendation.md) page and view the relevant recommendations. - -## How it works - ->[!NOTE] -> Configuration score currently supports configurations set via Group Policy. Due to the current partial Intune support, configurations which might have been set through Intune might show up as misconfigured. Contact your IT Administrator to verify the actual configuration status in case your organization is using Intune for secure configuration management. - -The data in the configuration score card is the product of meticulous and ongoing vulnerability discovery process aggregated with configuration discovery assessments that continuously: - -- Compare collected configurations to the collected benchmarks to discover misconfigured assets -- Map configurations to vulnerabilities that can be remediated or partially remediated (risk reduction) -- Collect and maintain best practice configuration benchmarks (vendors, security feeds, internal research teams) -- Collect and monitor changes of security control configuration state from all assets - -## Improve your security configuration - -You can improve your security configuration when you remediate issues from the security recommendations list. As you do so, your Configuration score improves, which means your organization becomes more resilient against cybersecurity threats and vulnerabilities. - -1. From the Configuration score card in the Threat & Vulnerability Management dashboard, select the one of the categories to view the list of recommendations related to that category. It will take you to the [**Security recommendations**](tvm-security-recommendation.md) page. If you want to see all security recommendations, once you get to the Security recommendations page, clear the search field. - -2. Select an item on the list. The flyout panel will open with details related to the recommendation. Select **Remediation options**. - - ![Security controls related security recommendations](images/tvm_security_controls.png) - -3. Read the description to understand the context of the issue and what to do next. Select a due date, add notes, and select **Export all remediation activity data to CSV** so you can attach it to an email for follow-up. - -4. **Submit request**. You will see a confirmation message that the remediation task has been created. - >![Remediation task creation confirmation](images/tvm_remediation_task_created.png) - -5. Save your CSV file. - ![Save csv file](images/tvm_save_csv_file.png) - -6. Send a follow-up email to your IT Administrator and allow the time that you have allotted for the remediation to propagate in the system. - -7. Review the **Configuration score** card again on the dashboard. The number of security controls recommendations will decrease. When you select **Security controls** to go back to the **Security recommendations** page, the item that you have addressed will not be listed there anymore, and your configuration score should increase. - ->[!IMPORTANT] ->To boost your vulnerability assessment detection rates, download the following mandatory security updates and deploy them in your network: ->- 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941) ->- RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077) ->- RS4 customers | [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045) ->- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) -> ->To download the security updates: ->1. Go to [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/home.aspx). ->2. Key-in the security update KB number that you need to download, then click **Search**. - -## Related topics - -- [Threat & Vulnerability Management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](threat-and-vuln-mgt-scenarios.md#apis) -- [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md deleted file mode 100644 index b9b7d557f2..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Configure Threat & Vulnerability Management in Microsoft Defender ATP -ms.reviewer: -description: Configure your Threat & Vulnerability Management to allow security administrators and IT administrators to collaborate seamlessly to remediate issues via Microsoft intune and Microsoft Endpoint Configuration Manager integrations. -keywords: RBAC, Threat & Vulnerability Management configuration, Threat & Vulnerability Management integrations, Microsft Intune integration with TVM, SCCM integration with TVM -search.product: Windows 10 -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- -# Configure Threat & Vulnerability Management -**Applies to:** -- [Microsoft Defender Advanced Threat Protection Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -[!include[Prerelease information](../../includes/prerelease.md)] - -This section guides you through the steps you need to take to configure Threat & Vulnerability Management's integration with Microsoft Intune or Microsoft Endpoint Configuration Manager for a seamless collaboration of issue remediation. - -### Before you begin -> [!IMPORTANT] -> Threat & Vulnerability Management data currently supports Windows 10 machines. Upgrade to Windows 10 to account for the rest of your devices’ threat and vulnerability exposure data.
    - -Ensure that you have the right RBAC permissions to configure your Threat & Vulnerability Management integration with Microsoft Intune or Microsoft Endpoint Configuration Manager. - ->[!WARNING] ->Only Intune and Microsoft Endpoint Configuration Manager enrolled devices are supported in this scenario.
    ->Use any of the following options to enroll devices in Intune: ->- IT Admin: For more information on how to enabling auto-enrollment, see [Windows Enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) ->- End-user: For more information on how to enroll your Windows 10 device in Intune, see [Enroll your Windows 10 device in Intune](https://docs.microsoft.com/intune-user-help/enroll-your-w10-device-access-work-or-school) ->- End-user alternative: For more information on joining an Azure AD domain, see [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup). - -## Related topics -- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) -- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Configuration score](configuration-score.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md b/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md index 70890b48ee..45279a411f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md @@ -1,10 +1,10 @@ --- -title: Configure Micro Focus ArcSight to pull Microsoft Defender ATP detections +title: Configure Micro Focus ArcSight to pull Microsoft Defender for Endpoint detections description: Configure Micro Focus ArcSight to receive and pull detections from Microsoft Defender Security Center keywords: configure Micro Focus ArcSight, security information and events management tools, arcsight search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,26 +13,27 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Configure Micro Focus ArcSight to pull Microsoft Defender ATP detections +# Configure Micro Focus ArcSight to pull Defender for Endpoint detections + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink) - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink) - -You'll need to install and configure some files and tools to use Micro Focus ArcSight so that it can pull Microsoft Defender ATP detections. +You'll need to install and configure some files and tools to use Micro Focus ArcSight so that it can pull Defender for Endpoint detections. >[!Note] ->- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections ->- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. +>- [Defender for Endpoint Alert](alerts.md) is composed from one or more detections +>- [Defender for Endpoint Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Device and its related Alert details. ## Before you begin @@ -40,7 +41,7 @@ Configuring the Micro Focus ArcSight Connector tool requires several configurati This section guides you in getting the necessary information to set and use the required configuration files correctly. -- Make sure you have enabled the SIEM integration feature from the **Settings** menu. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). +- Make sure you have enabled the SIEM integration feature from the **Settings** menu. For more information, see [Enable SIEM integration in Defender for Endpoint](enable-siem-integration.md). - Have the file you saved from enabling the SIEM integration feature ready. You'll need to get the following values: - OAuth 2.0 Token refresh URL @@ -103,8 +104,8 @@ The following steps assume that you have completed all the required steps in [Be For example, if the configuration file in "flexagent" directory is named "WDATP-Connector.jsonparser.properties", you must type "WDATP-Connector" as the name of the client property file. Events URL - Depending on the location of your datacenter, select either the EU or the US URL:

    For EU: https://wdatp-alertexporter-eu.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME
    -
    For US: https://wdatp-alertexporter-us.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME

    For UK: https://wdatp-alertexporter-uk.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME + Depending on the location of your datacenter, select either the EU or the US URL:

    For EU: https://wdatp-alertexporter-eu.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME
    +
    For US: https://wdatp-alertexporter-us.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME

    For UK: https://wdatp-alertexporter-uk.windows.com/api/alerts/?sinceTimeUtc=$START_AT_TIME Authentication Type OAuth 2 @@ -113,7 +114,7 @@ The following steps assume that you have completed all the required steps in [Be Browse to the location of the wdatp-connector.properties file. The name must match the file provided in the .zip that you downloaded. Refresh Token - You can obtain a refresh token in two ways: by generating a refresh token from the SIEM settings page or using the restutil tool.

    For more information on generating a refresh token from the Preferences setup , see Enable SIEM integration in Microsoft Defender ATP.

    Get your refresh token using the restutil tool:
    a. Open a command prompt. Navigate to C:\folder_location\current\bin where folder_location represents the location where you installed the tool.

    b. Type: arcsight restutil token -config from the bin directory.For example: arcsight restutil boxtoken -proxy proxy.location.hp.com:8080 A Web browser window will open.

    c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials.

    d. A refresh token is shown in the command prompt.

    e. Copy and paste it into the Refresh Token field. + You can obtain a refresh token in two ways: by generating a refresh token from the SIEM settings page or using the restutil tool.

    For more information on generating a refresh token from the Preferences setup , see Enable SIEM integration in Defender for Endpoint.

    Get your refresh token using the restutil tool:
    a. Open a command prompt. Navigate to C:\folder_location\current\bin where folder_location represents the location where you installed the tool.

    b. Type: arcsight restutil token -config from the bin directory.For example: arcsight restutil boxtoken -proxy proxy.location.hp.com:8080 A Web browser window will open.

    c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials.

    d. A refresh token is shown in the command prompt.

    e. Copy and paste it into the Refresh Token field. @@ -175,7 +176,7 @@ The following steps assume that you have completed all the required steps in [Be You can now run queries in the Micro Focus ArcSight console. -Microsoft Defender ATP detections will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name. +Defender for Endpoint detections will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name. ## Troubleshooting Micro Focus ArcSight connection @@ -201,7 +202,7 @@ Microsoft Defender ATP detections will appear as discrete events, with "Microsof > Verify that the connector is running by stopping the process again. Then start the connector again, and no browser window should appear. ## Related topics -- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) -- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) +- [Enable SIEM integration in Defender for Endpoint](enable-siem-integration.md) +- [Configure Splunk to pull Defender for Endpoint detections](configure-splunk.md) +- [Pull Defender for Endpoint detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md index 2cdb364929..767a807717 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md @@ -1,10 +1,10 @@ --- title: Configure attack surface reduction -description: Configure attack surface reduction +description: Use Microsoft Intune, Microsoft Endpoint Configuration Manager, PowerShell cmdlets, and Group Policy to configure attack surface reduction. keywords: asr, attack surface reduction, windows defender, microsoft defender, antivirus, av search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,13 +13,21 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 07/01/2018 +ms.technology: mde --- # Configure attack surface reduction +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + You can configure attack surface reduction with a number of tools, including: * Microsoft Intune @@ -27,13 +35,9 @@ You can configure attack surface reduction with a number of tools, including: * Group Policy * PowerShell cmdlets -The topics in this section describe how to configure attack surface reduction. Each topic includes instructions for the applicable configuration tool (or tools). - -## In this section - -Topic | Description +Article | Description -|- -[Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to prepare for and install Application Guard, including hardware and software requirements +[Enable hardware-based isolation for Microsoft Edge](../microsoft-defender-application-guard/install-md-app-guard.md) | How to prepare for and install Application Guard, including hardware and software requirements [Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and protect kernel mode processes [Exploit protection](./enable-exploit-protection.md)|How to automatically apply exploit mitigation techniques on both operating system processes and on individual apps [Network protection](./enable-network-protection.md)|How to prevent users from using any apps to access dangerous domains diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation.md new file mode 100644 index 0000000000..e77d4f82c5 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation.md @@ -0,0 +1,64 @@ +--- +title: Configure automated investigation and remediation capabilities +description: Set up your automated investigation and remediation capabilities in Microsoft Defender for Endpoint. +keywords: configure, setup, automated, investigation, detection, alerts, remediation, response +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.technology: mde +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: how-to +ms.date: 01/27/2021 +ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs +--- + +# Configure automated investigation and remediation capabilities in Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +If your organization is using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/) (Defender for Endpoint), [automated investigation and remediation capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) can save your security operations team time and effort. As outlined in [this blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/enhance-your-soc-with-microsoft-defender-atp-automatic/ba-p/848946), these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats. [Learn more about automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations). + +To configure automated investigation and remediation, +1. [Turn on the features](#turn-on-automated-investigation-and-remediation); and +2. [Set up device groups](#set-up-device-groups). + +## Turn on automated investigation and remediation + +1. As a global administrator or security administrator, go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +2. In the navigation pane, choose **Settings**. +3. In the **General** section, select **Advanced features**. +4. Turn on both **Automated Investigation** and **Automatically resolve alerts**. + +## Set up device groups + +1. In the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)), on the **Settings** page, under **Permissions**, select **Device groups**. +2. Select **+ Add device group**. +3. Create at least one device group, as follows: + - Specify a name and description for the device group. + - In the **Automation level list**, select a level, such as **Full – remediate threats automatically**. The automation level determines whether remediation actions are taken automatically, or only upon approval. To learn more, see [Automation levels in automated investigation and remediation](automation-levels.md). + - In the **Members** section, use one or more conditions to identify and include devices. + - On the **User access** tab, select the [Azure Active Directory groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-manage-groups?context=azure/active-directory/users-groups-roles/context/ugr-context) who should have access to the device group you're creating. +4. Select **Done** when you're finished setting up your device group. + +## Next steps + +- [Visit the Action Center to view pending and completed remediation actions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center) +- [Review and approve pending actions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation) + +## See also + +- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md b/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md index 944a823a64..2fe50d0988 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md @@ -4,7 +4,7 @@ description: Learn about steps that you need to do in Intune, Microsoft Defender keywords: conditional access, conditional, access, device risk, risk level, integration, intune integration search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,13 +13,20 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Configure Conditional Access in Microsoft Defender ATP +# Configure Conditional Access in Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) This section guides you through all the steps you need to take to properly implement Conditional Access. @@ -51,7 +58,7 @@ It's important to note the required roles to access these portals and implement Take the following steps to enable Conditional Access: - Step 1: Turn on the Microsoft Intune connection from Microsoft Defender Security Center -- Step 2: Turn on the Microsoft Defender ATP integration in Intune +- Step 2: Turn on the Defender for Endpoint integration in Intune - Step 3: Create the compliance policy in Intune - Step 4: Assign the policy - Step 5: Create an Azure AD Conditional Access policy @@ -63,7 +70,7 @@ Take the following steps to enable Conditional Access: 3. Click **Save preferences**. -### Step 2: Turn on the Microsoft Defender ATP integration in Intune +### Step 2: Turn on the Defender for Endpoint integration in Intune 1. Sign in to the [Azure portal](https://portal.azure.com). 2. Select **Device compliance** > **Microsoft Defender ATP**. 3. Set **Connect Windows 10.0.15063+ devices to Microsoft Defender Advanced Threat Protection** to **On**. @@ -104,4 +111,4 @@ Take the following steps to enable Conditional Access: For more information, see [Enable Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/intune/advanced-threat-protection). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md b/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md index 96650774c3..904b50ea79 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md @@ -1,10 +1,10 @@ --- title: Configure alert notifications in Microsoft Defender ATP description: You can use Microsoft Defender Advanced Threat Protection to configure email notification settings for security alerts, based on severity and other criteria. -keywords: email notifications, configure alert notifications, windows defender atp notifications, windows defender atp alerts, windows 10 enterprise, windows 10 education +keywords: email notifications, configure alert notifications, microsoft defender atp notifications, microsoft defender atp alerts, windows 10 enterprise, windows 10 education search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,34 +13,37 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Configure alert notifications in Microsoft Defender ATP +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-emailconfig-abovefoldlink) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-emailconfig-abovefoldlink) - -You can configure Microsoft Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity. +You can configure Defender for Endpoint to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity. > [!NOTE] > Only users with 'Manage security settings' permissions can configure email notifications. If you've chosen to use basic permissions management, users with Security Administrator or Global Administrator roles can configure email notifications. You can set the alert severity levels that trigger notifications. You can also add or remove recipients of the email notification. New recipients get notified about alerts encountered after they are added. For more information about alerts, see [View and organize the Alerts queue](alerts-queue.md). -If you're using role-based access control (RBAC), recipients will only receive notifications based on the machine groups that were configured in the notification rule. -Users with the proper permission can only create, edit, or delete notifications that are limited to their machine group management scope. -Only users assigned to the Global administrator role can manage notification rules that are configured for all machine groups. +If you're using role-based access control (RBAC), recipients will only receive notifications based on the device groups that were configured in the notification rule. +Users with the proper permission can only create, edit, or delete notifications that are limited to their device group management scope. +Only users assigned to the Global administrator role can manage notification rules that are configured for all device groups. The email notification includes basic information about the alert and a link to the portal where you can do further investigation. ## Create rules for alert notifications -You can create rules that determine the machines and alert severities to send email notifications for and the notification recipients. +You can create rules that determine the devices and alert severities to send email notifications for and the notification recipients. 1. In the navigation pane, select **Settings** > **Alert notifications**. @@ -51,12 +54,12 @@ You can create rules that determine the machines and alert severities to send em - **Rule name** - Specify a name for the notification rule. - **Include organization name** - Specify the customer name that appears on the email notification. - **Include tenant-specific portal link** - Adds a link with the tenant ID to allow access to a specific tenant. - - **Include machine information** - Includes the machine name in the email alert body. + - **Include device information** - Includes the device name in the email alert body. >[!NOTE] - > This information might be processed by recipient mail servers that ar not in the geographic location you have selected for your Microsoft Defender ATP data. + > This information might be processed by recipient mail servers that ar not in the geographic location you have selected for your Defender for Endpoint data. - - **Machines** - Choose whether to notify recipients for alerts on all machines (Global administrator role only) or on selected machine groups. For more information, see [Create and manage machine groups](machine-groups.md). + - **Devices** - Choose whether to notify recipients for alerts on all devices (Global administrator role only) or on selected device groups. For more information, see [Create and manage device groups](machine-groups.md). - **Alert severity** - Choose the alert severity level. 4. Click **Next**. @@ -67,10 +70,6 @@ You can create rules that determine the machines and alert severities to send em 7. Click **Save notification rule**. -Here's an example email notification: - -![Image of example email notification](images/atp-example-email-notification.png) - ## Edit a notification rule 1. Select the notification rule you'd like to edit. @@ -93,11 +92,10 @@ This section lists various issues that you may encounter when using email notifi **Solution:** Make sure that the notifications are not blocked by email filters: -1. Check that the Microsoft Defender ATP email notifications are not sent to the Junk Email folder. Mark them as Not junk. -2. Check that your email security product is not blocking the email notifications from Microsoft Defender ATP. -3. Check your email application rules that might be catching and moving your Microsoft Defender ATP email notifications. +1. Check that the Defender for Endpoint email notifications are not sent to the Junk Email folder. Mark them as Not junk. +2. Check that your email security product is not blocking the email notifications from Defender for Endpoint. +3. Check your email application rules that might be catching and moving your Defender for Endpoint email notifications. ## Related topics - [Update data retention settings](data-retention-settings.md) -- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports.md) - [Configure advanced features](advanced-features.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md index 00b5ca0b72..166d6e77a5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md @@ -1,10 +1,10 @@ --- title: Onboard Windows 10 devices to Microsoft Defender ATP via Group Policy -description: Use Group Policy to deploy the configuration package on Windows 10 machines so that they are onboarded to the service. -keywords: configure machines using group policy, machine management, configure Windows ATP machines, onboard Microsoft Defender Advanced Threat Protection machines, group policy +description: Use Group Policy to deploy the configuration package on Windows 10 devices so that they are onboarded to the service. +keywords: configure devices using group policy, device management, configure Windows ATP devices, onboard Microsoft Defender Advanced Threat Protection devices, group policy search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,42 +13,50 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 04/24/2018 +ms.technology: mde --- -# Onboard Windows 10 machines using Group Policy +# Onboard Windows 10 devices using Group Policy + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** - Group Policy +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink) > [!NOTE] > To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later. - +> > For Windows Server 2019, you may need to replace NT AUTHORITY\Well-Known-System-Account with NT AUTHORITY\SYSTEM of the XML file that the Group Policy preference creates. -## Onboard machines using Group Policy +## Onboard devices using Group Policy + +[![Image of the PDF showing the various deployment paths](images/onboard-gp.png)](images/onboard-gp.png#lightbox) + + +Check out the [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.vsdx) to see the various paths in deploying Defender for Endpoint. + + + 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): - a. In the navigation pane, select **Settings** > **Onboarding**. + 1. In the navigation pane, select **Settings** > **Onboarding**. - b. Select Windows 10 as the operating system. + 1. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **Group policy**. + 1. In the **Deployment method** field, select **Group policy**. - d. Click **Download package** and save the .zip file. + 1. Click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the device. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*. 3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. @@ -65,27 +73,27 @@ ms.date: 04/24/2018 9. Click **OK** and close any open GPMC windows. >[!TIP] -> After onboarding the machine, you can choose to run a detection test to verify that the machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md). +> After onboarding the device, you can choose to run a detection test to verify that the device is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Defender for Endpoint device](run-detection-test.md). -## Additional Microsoft Defender ATP configuration settings -For each machine, you can state whether samples can be collected from the machine when a request is made through Microsoft Defender Security Center to submit a file for deep analysis. +## Additional Defender for Endpoint configuration settings +For each device, you can state whether samples can be collected from the device when a request is made through Microsoft Defender Security Center to submit a file for deep analysis. You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature. ### Configure sample collection settings -1. On your GP management machine, copy the following files from the +1. On your GP management device, copy the following files from the configuration package: - a. Copy _AtpConfiguration.admx_ into _C:\\Windows\\PolicyDefinitions_ + - Copy _AtpConfiguration.admx_ into _C:\\Windows\\PolicyDefinitions_ - b. Copy _AtpConfiguration.adml_ into _C:\\Windows\\PolicyDefinitions\\en-US_ + - Copy _AtpConfiguration.adml_ into _C:\\Windows\\PolicyDefinitions\\en-US_ If you are using a [Central Store for Group Policy Administrative Templates](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra), copy the following files from the configuration package: - a. Copy _AtpConfiguration.admx_ into _\\\\\\\SysVol\\\\\Policies\\PolicyDefinitions_ + - Copy _AtpConfiguration.admx_ into _\\\\\\\SysVol\\\\\Policies\\PolicyDefinitions_ - b. Copy _AtpConfiguration.adml_ into _\\\\\\\SysVol\\\\\Policies\\PolicyDefinitions\\en-US_ + - Copy _AtpConfiguration.adml_ into _\\\\\\\SysVol\\\\\Policies\\PolicyDefinitions\\en-US_ 2. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11), right-click the GPO you want to configure and click **Edit**. @@ -95,29 +103,108 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa 5. Click **Windows components** and then **Windows Defender ATP**. -6. Choose to enable or disable sample sharing from your machines. +6. Choose to enable or disable sample sharing from your devices. >[!NOTE] > If you don't set a value, the default value is to enable sample collection. -## Offboard machines using Group Policy -For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. +## Other recommended configuration settings + +### Update endpoint protection configuration + +After configuring the onboarding script, continue editing the same group policy to add endpoint protection configurations. Perform group policy edits from a system running Windows 10 or Server 2019 to ensure you have all of the required Microsoft Defender Antivirus capabilities. You may need to close and reopen the group policy object to register the Defender ATP configuration settings. + +All policies are located under `Computer Configuration\Policies\Administrative Templates`. + +**Policy location:** \Windows Components\Windows Defender ATP + +Policy | Setting +:---|:--- +Enable\Disable Sample collection| Enabled - "Enable sample collection on machines" checked + +
    + +**Policy location:** \Windows Components\Windows Defender Antivirus + +Policy | Setting +:---|:--- +Configure detection for potentially unwanted applications | Enabled, Block + +
    + +**Policy location:** \Windows Components\Windows Defender Antivirus\MAPS + +Policy | Setting +:---|:--- +Join Microsoft MAPS | Enabled, Advanced MAPS +Send file samples when further analysis is required | Enabled, Send safe samples + +
    + +**Policy location:** \Windows Components\Windows Defender Antivirus\Real-time Protection + +Policy | Setting +:---|:--- +Turn off real-time protection|Disabled +Turn on behavior monitoring|Enabled +Scan all downloaded files and attachments|Enabled +Monitor file and program activity on your computer|Enabled + +
    + +**Policy location:** \Windows Components\Windows Defender Antivirus\Scan + +These settings configure periodic scans of the endpoint. We recommend performing a weekly quick scan, performance permitting. + +Policy | Setting +:---|:--- +Check for the latest virus and spyware security intelligence before running a scheduled scan |Enabled + + +
    + +**Policy location:** \Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction + +Get the current list of attack surface reduction GUIDs from [Customize attack surface reduction rules](customize-attack-surface-reduction.md) + +1. Open the **Configure Attack Surface Reduction** policy. + +1. Select **Enabled**. + +1. Select the **Show** button. + +1. Add each GUID in the **Value Name** field with a Value of 2. + + This will set each up for audit only. + + ![Image of attack surface reduction configuration](images/asr-guid.png) + + + +Policy | Setting +:---|:--- +Configure Controlled folder access| Enabled, Audit Mode + + + +## Offboard devices using Group Policy +For security reasons, the package used to Offboard devices will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a device will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. > [!NOTE] -> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions. +> Onboarding and offboarding policies must not be deployed on the same device at the same time, otherwise this will cause unpredictable collisions. 1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): - a. In the navigation pane, select **Settings** > **Offboarding**. + 1. In the navigation pane, select **Settings** > **Offboarding**. - b. Select Windows 10 as the operating system. + 1. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **Group policy**. + 1. In the **Deployment method** field, select **Group policy**. - d. Click **Download package** and save the .zip file. + 1. Click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machine. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the device. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. 3. Open the [Group Policy Management Console](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. @@ -134,25 +221,26 @@ For security reasons, the package used to Offboard machines will expire 30 days 9. Click **OK** and close any open GPMC windows. > [!IMPORTANT] -> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. +> Offboarding causes the device to stop sending sensor data to the portal but data from the device, including reference to any alerts it has had will be retained for up to 6 months. -## Monitor machine configuration -With Group Policy there isn’t an option to monitor deployment of policies on the machines. Monitoring can be done directly on the portal, or by using the different deployment tools. +## Monitor device configuration +With Group Policy there isn’t an option to monitor deployment of policies on the devices. Monitoring can be done directly on the portal, or by using the different deployment tools. + +## Monitor devices using the portal -## Monitor machines using the portal 1. Go to [Microsoft Defender Security Center](https://securitycenter.windows.com/). -2. Click **Machines list**. -3. Verify that machines are appearing. +2. Click **Devices list**. +3. Verify that devices are appearing. > [!NOTE] -> It can take several days for machines to start showing on the **Machines list**. This includes the time it takes for the policies to be distributed to the machine, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. +> It can take several days for devices to start showing on the **Devices list**. This includes the time it takes for the policies to be distributed to the device, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. ## Related topics -- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) -- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) -- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) -- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) -- [Run a detection test on a newly onboarded Microsoft Defender ATP machines](run-detection-test.md) -- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) +- [Onboard Windows 10 devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows 10 devices using Mobile Device Management tools](configure-endpoints-mdm.md) +- [Onboard Windows 10 devices using a local script](configure-endpoints-script.md) +- [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) +- [Run a detection test on a newly onboarded Microsoft Defender for Endpoint devices](run-detection-test.md) +- [Troubleshoot Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md index c5d535a96e..603253f4a4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md @@ -1,10 +1,10 @@ --- -title: Onboard Windows 10 machines using Mobile Device Management tools -description: Use Mobile Device Management tools to deploy the configuration package on machines so that they are onboarded to the service. -keywords: onboard machines using mdm, machine management, onboard Windows ATP machines, onboard Microsoft Defender Advanced Threat Protection machines, mdm +title: Onboard Windows 10 devices using Mobile Device Management tools +description: Use Mobile Device Management tools to deploy the configuration package on devices so that they are onboarded to the service. +keywords: onboard devices using mdm, device management, onboard Windows ATP devices, onboard Microsoft Defender Advanced Threat Protection devices, mdm search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,81 +13,89 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/06/2018 +ms.technology: mde --- -# Onboard Windows 10 machines using Mobile Device Management tools +# Onboard Windows 10 devices using Mobile Device Management tools + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +You can use mobile device management (MDM) solutions to configure devices. Defender for Endpoint supports MDMs by providing OMA-URIs to create policies to manage devices. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink) - -You can use mobile device management (MDM) solutions to configure machines. Microsoft Defender ATP supports MDMs by providing OMA-URIs to create policies to manage machines. - -For more information on using Microsoft Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx). +For more information on using Defender for Endpoint CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx). ## Before you begin If you're using Microsoft Intune, you must have the device MDM Enrolled. Otherwise, settings will not be applied successfully. For more information on enabling MDM with Microsoft Intune, see [Device enrollment (Microsoft Intune)](https://docs.microsoft.com/mem/intune/enrollment/device-enrollment). -## Onboard machines using Microsoft Intune +## Onboard devices using Microsoft Intune + +[![Image of the PDF showing onboarding devices to Defender for Endpoint using Microsoft Intune](images/onboard-intune.png) ](images/onboard-intune-big.png#lightbox) + +Check out the [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.vsdx) to see the various paths in deploying Defender for Endpoint. Follow the instructions from [Intune](https://docs.microsoft.com/intune/advanced-threat-protection). -For more information on using Microsoft Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx). +For more information on using Defender for Endpoint CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx). > [!NOTE] -> - The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated. -> - Configuration of diagnostic data reporting frequency is only available for machines on Windows 10, version 1703. +> - The **Health Status for onboarded devices** policy uses read-only properties and can't be remediated. +> - Configuration of diagnostic data reporting frequency is only available for devices on Windows 10, version 1703. >[!TIP] -> After onboarding the machine, you can choose to run a detection test to verify that a machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md). +> After onboarding the device, you can choose to run a detection test to verify that a device is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender for Endpoint device](run-detection-test.md). -## Offboard and monitor machines using Mobile Device Management tools -For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. + +Check out the [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.vsdx) to see the various paths in deploying Microsoft Defender ATP. + +## Offboard and monitor devices using Mobile Device Management tools +For security reasons, the package used to Offboard devices will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a device will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. > [!NOTE] -> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions. +> Onboarding and offboarding policies must not be deployed on the same device at the same time, otherwise this will cause unpredictable collisions. 1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): - a. In the navigation pane, select **Settings** > **Offboarding**. + 1. In the navigation pane, select **Settings** > **Offboarding**. - b. Select Windows 10 as the operating system. + 1. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**. + 1. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**. - d. Click **Download package**, and save the .zip file. + 1. Click **Download package**, and save the .zip file. 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding*. 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. - OMA-URI: ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding - Date type: String + OMA-URI: ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding
    + Date type: String
    Value: [Copy and paste the value from the content of the WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding file] For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). > [!NOTE] -> The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated. +> The **Health Status for offboarded devices** policy uses read-only properties and can't be remediated. > [!IMPORTANT] -> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. +> Offboarding causes the device to stop sending sensor data to the portal but data from the device, including reference to any alerts it has had will be retained for up to 6 months. ## Related topics -- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) -- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) -- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) -- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) -- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md) -- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) +- [Onboard Windows 10 devices using Group Policy](configure-endpoints-gp.md) +- [Onboard Windows 10 devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows 10 devices using a local script](configure-endpoints-script.md) +- [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) +- [Run a detection test on a newly onboarded Microsoft Defender for Endpoint device](run-detection-test.md) +- [Troubleshoot Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index dec845f1d0..595a2aec82 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -1,10 +1,10 @@ --- -title: Onboard non-Windows machines to the Microsoft Defender ATP service -description: Configure non-Windows machines so that they can send sensor data to the Microsoft Defender ATP service. -keywords: onboard non-Windows machines, macos, linux, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines +title: Onboard non-Windows devices to the Microsoft Defender ATP service +description: Configure non-Windows devices so that they can send sensor data to the Microsoft Defender ATP service. +keywords: onboard non-Windows devices, macos, linux, device management, configure Windows ATP devices, configure Microsoft Defender Advanced Threat Protection devices search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,30 +13,37 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Onboard non-Windows machines +# Onboard non-Windows devices + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** - macOS - Linux -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-nonwindows-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-nonwindows-abovefoldlink) -Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Microsoft Defender Security Center and better protect your organization's network. +Defender for Endpoint provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Microsoft Defender Security Center and better protect your organization's network. -You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work. +You'll need to know the exact Linux distros and macOS versions that are compatible with Defender for Endpoint for the integration to work. For more information, see: +- [Microsoft Defender for Endpoint for Linux system requirements](microsoft-defender-atp-linux.md#system-requirements) +- [Microsoft Defender for Endpoint for Mac system requirements](microsoft-defender-atp-mac.md#system-requirements). -## Onboarding non-Windows machines -You'll need to take the following steps to onboard non-Windows machines: +## Onboarding non-Windows devices +You'll need to take the following steps to onboard non-Windows devices: 1. Select your preferred method of onboarding: - - For macOS devices, you can choose to onboard through Microsoft Defender ATP or through a third-party solution. For more information, see [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac). - - For other non-Windows devices choose **Onboard non-Windows machines through third-party integration**. + - For macOS devices, you can choose to onboard through Microsoft Defender ATP or through a third-party solution. For more information, see [Microsoft Defender for Endpoint for Mac](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac). + - For other non-Windows devices choose **Onboard non-Windows devices through third-party integration**. 1. In the navigation pane, select **Interoperability** > **Partners**. Make sure the third-party solution is listed. @@ -49,9 +56,9 @@ You'll need to take the following steps to onboard non-Windows machines: 2. Run a detection test by following the instructions of the third-party solution. -## Offboard non-Windows machines +## Offboard non-Windows devices -1. Follow the third-party's documentation to disconnect the third-party solution from Microsoft Defender ATP. +1. Follow the third-party's documentation to disconnect the third-party solution from Microsoft Defender for Endpoint. 2. Remove permissions for the third-party solution in your Azure AD tenant. 1. Sign in to the [Azure portal](https://portal.azure.com). @@ -61,7 +68,7 @@ You'll need to take the following steps to onboard non-Windows machines: ## Related topics -- [Onboard Windows 10 machines](configure-endpoints.md) +- [Onboard Windows 10 devices](configure-endpoints.md) - [Onboard servers](configure-server-endpoints.md) - [Configure proxy and Internet connectivity settings](configure-proxy-internet.md) -- [Troubleshooting Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) +- [Troubleshooting Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md index 28eb5db87f..4d619ca79e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md @@ -1,10 +1,10 @@ --- -title: Onboard Windows 10 machines using Configuration Manager -description: Use Configuration Manager to deploy the configuration package on machines so that they are onboarded to the service. -keywords: onboard machines using sccm, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines +title: Onboard Windows 10 devices using Configuration Manager +description: Use Configuration Manager to deploy the configuration package on devices so that they are onboarded to the service. +keywords: onboard devices using sccm, device management, configure Windows ATP devices, configure Microsoft Defender Advanced Threat Protection devices search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,44 +13,67 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 02/07/2020 +ms.technology: mde --- -# Onboard Windows 10 machines using Configuration Manager +# Onboard Windows 10 devices using Configuration Manager + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) - Microsoft Endpoint Configuration Manager current branch - System Center 2012 R2 Configuration Manager ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink) - +## Supported client operating systems -## Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager current branch +Based on the version of Configuration Manager you're running, the following client operating systems can be onboarded: -Configuration Manager current branch has integrated support to configure and manage Microsoft Defender ATP on managed devices. For more information, see [Microsoft Defender Advanced Threat Protection in Microsoft Endpoint Configuration Manager current branch](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-defender-advanced-threat-protection). +#### Configuration Manager version 1910 and prior - +- Clients computers running Windows 10 -## Onboard Windows 10 machines using earlier versions of System Center Configuration Manager +#### Configuration Manager version 2002 and later + +Starting in Configuration Manager version 2002, you can onboard the following operating systems: + +- Windows 8.1 +- Windows 10 +- Windows Server 2012 R2 +- Windows Server 2016 +- Windows Server 2016, version 1803 or later +- Windows Server 2019 + +>[!NOTE] +>For more information on how to onboard Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019, see, [Onboard Windows servers](configure-server-endpoints.md). + + + +### Onboard devices using System Center Configuration Manager + +[![Image of the PDF showing the various deployment paths](images/onboard-config-mgr.png)](images/onboard-config-mgr.png#lightbox) + + +Check out the [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.vsdx) to see the various paths in deploying Microsoft Defender for Endpoint. -You can use existing Configuration Manager functionality to create a policy to configure your machines. This action is supported in System Center 2012 R2 Configuration Manager. -### Onboard machines using System Center Configuration Manager 1. Open the Configuration Manager configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): - a. In the navigation pane, select **Settings** > **Onboarding**. + 1. In the navigation pane, select **Settings** > **Onboarding**. - b. Select Windows 10 as the operating system. + 1. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**. + 1. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**. - d. Click **Download package**, and save the .zip file. + 1. Select **Download package**, and save the .zip file. 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOnboardingScript.cmd*. @@ -59,13 +82,13 @@ You can use existing Configuration Manager functionality to create a policy to c a. Choose a predefined device collection to deploy the package to. > [!NOTE] -> Microsoft Defender ATP doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/en-us/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading. +> Defender for Endpoint doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/en-us/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading. >[!TIP] -> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md). +> After onboarding the device, you can choose to run a detection test to verify that an device is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Defender for Endpoint device](run-detection-test.md). > -> Note that it is possible to create a detection rule on a Configuration Manager application to continuously check if a machine has been onboarded. An application is a different type of object than a package and program. -> If a machine is not yet onboarded (due to pending OOBE completion or any other reason), Configuration Manager will retry to onboard the machine until the rule detects the status change. +> Note that it is possible to create a detection rule on a Configuration Manager application to continuously check if a device has been onboarded. An application is a different type of object than a package and program. +> If a device is not yet onboarded (due to pending OOBE completion or any other reason), Configuration Manager will retry to onboard the device until the rule detects the status change. > > This behavior can be accomplished by creating a detection rule checking if the "OnboardingState" registry value (of type REG_DWORD) = 1. > This registry value is located under "HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status". @@ -73,52 +96,93 @@ For more information, see [Configure Detection Methods in System Center 2012 R2 ### Configure sample collection settings -For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Microsoft Defender Security Center to submit a file for deep analysis. +For each device, you can set a configuration value to state whether samples can be collected from the device when a request is made through Microsoft Defender Security Center to submit a file for deep analysis. -You can set a compliance rule for configuration item in System Center Configuration Manager to change the sample share setting on a machine. -This rule should be a *remediating* compliance rule configuration item that sets the value of a registry key on targeted machines to make sure they’re complaint. +>[!NOTE] +>These configuration settings are typically done through Configuration Manager. + +You can set a compliance rule for configuration item in Configuration Manager to change the sample share setting on a device. + +This rule should be a *remediating* compliance rule configuration item that sets the value of a registry key on targeted devices to make sure they’re complaint. The configuration is set through the following registry key entry: -``` -Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection” +```console +Path: "HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" Name: "AllowSampleCollection" Value: 0 or 1 ``` + Where:
    Key type is a D-WORD.
    Possible values are: -- 0 - doesn't allow sample sharing from this machine -- 1 - allows sharing of all file types from this machine +- 0 - doesn't allow sample sharing from this device +- 1 - allows sharing of all file types from this device The default value in case the registry key doesn’t exist is 1. -For more information about System Center Configuration Manager Compliance see [Introduction to compliance settings in System Center 2012 R2 Configuration Manager](https://docs.microsoft.com/previous-versions/system-center/system-center-2012-R2/gg682139\(v=technet.10\)). +For more information about System Center Configuration Manager Compliance, see [Introduction to compliance settings in System Center 2012 R2 Configuration Manager](https://docs.microsoft.com/previous-versions/system-center/system-center-2012-R2/gg682139\(v=technet.10\)). +## Other recommended configuration settings +After onboarding devices to the service, it's important to take advantage of the included threat protection capabilities by enabling them with the following recommended configuration settings. -## Offboard machines using Configuration Manager +### Device collection configuration +If you're using Endpoint Configuration Manager, version 2002 or later, you can choose to broaden the deployment to include servers or down-level clients. -For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. + +### Next generation protection configuration +The following configuration settings are recommended: + +**Scan**
    +- Scan removable storage devices such as USB drives: Yes + +**Real-time Protection**
    +- Enable Behavioral Monitoring: Yes +- Enable protection against Potentially Unwanted Applications at download and prior to installation: Yes + +**Cloud Protection Service** +- Cloud Protection Service membership type: Advanced membership + +**Attack surface reduction** +Configure all available rules to Audit. + +>[!NOTE] +> Blocking these activities may interrupt legitimate business processes. The best approach is setting everything to audit, identifying which ones are safe to turn on, and then enabling those settings on endpoints which do not have false positive detections. + + +**Network protection**
    +Prior to enabling network protection in audit or block mode, ensure that you've installed the antimalware platform update, which can be obtained from the [support page](https://support.microsoft.com/en-us/help/4560203/windows-defender-anti-malware-platform-binaries-are-missing). + + +**Controlled folder access**
    +Enable the feature in audit mode for at least 30 days. After this period, review detections and create a list of applications that are allowed to write to protected directories. + +For more information, see [Evaluate controlled folder access](evaluate-controlled-folder-access.md). + + +## Offboard devices using Configuration Manager + +For security reasons, the package used to Offboard devices will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a device will be rejected. When downloading an offboarding package, you will be notified of the packages expiry date and it will also be included in the package name. > [!NOTE] -> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions. +> Onboarding and offboarding policies must not be deployed on the same device at the same time, otherwise this will cause unpredictable collisions. -### Offboard machines using Microsoft Endpoint Configuration Manager current branch +### Offboard devices using Microsoft Endpoint Manager current branch -If you use Microsoft Endpoint Configuration Manager current branch, see [Create an offboarding configuration file](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-defender-advanced-threat-protection#create-an-offboarding-configuration-file). +If you use Microsoft Endpoint Manager current branch, see [Create an offboarding configuration file](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-defender-advanced-threat-protection#create-an-offboarding-configuration-file). -### Offboard machines using System Center 2012 R2 Configuration Manager +### Offboard devices using System Center 2012 R2 Configuration Manager 1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): - a. In the navigation pane, select **Settings** > **Offboarding**. + 1. In the navigation pane, select **Settings** > **Offboarding**. - b. Select Windows 10 as the operating system. + 1. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**. + 1. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**. - d. Click **Download package**, and save the .zip file. + 1. Select **Download package**, and save the .zip file. 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. @@ -127,51 +191,53 @@ If you use Microsoft Endpoint Configuration Manager current branch, see [Create a. Choose a predefined device collection to deploy the package to. > [!IMPORTANT] -> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. +> Offboarding causes the device to stop sending sensor data to the portal but data from the device, including reference to any alerts it has had will be retained for up to 6 months. -## Monitor machine configuration +## Monitor device configuration -If you're using Microsoft Endpoint Configuration Manager current branch, use the built-in Microsoft Defender ATP dashboard in the Configuration Manager console. For more information, see [Microsoft Defender Advanced Threat Protection - Monitor](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-defender-advanced-threat-protection#monitor). +If you're using Microsoft Endpoint Manager current branch, use the built-in Defender for Endpoint dashboard in the Configuration Manager console. For more information, see [Defender for Endpoint - Monitor](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-defender-advanced-threat-protection#monitor). If you're using System Center 2012 R2 Configuration Manager, monitoring consists of two parts: -1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the machines in your network. +1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the devices in your network. -2. Checking that the machines are compliant with the Microsoft Defender ATP service (this ensures the machine can complete the onboarding process and can continue to report data to the service). +2. Checking that the devices are compliant with the Defender for Endpoint service (this ensures the device can complete the onboarding process and can continue to report data to the service). ### Confirm the configuration package has been correctly deployed 1. In the Configuration Manager console, click **Monitoring** at the bottom of the navigation pane. -2. Click **Overview** and then **Deployments**. +2. Select **Overview** and then **Deployments**. -3. Click on the deployment with the package name. +3. Select on the deployment with the package name. 4. Review the status indicators under **Completion Statistics** and **Content Status**. - If there are failed deployments (machines with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the machines. For more information see, [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md). + If there are failed deployments (devices with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the devices. For more information, see, [Troubleshoot Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md). ![Configuration Manager showing successful deployment with no errors](images/sccm-deployment.png) -### Check that the machines are compliant with the Microsoft Defender ATP service +### Check that the devices are compliant with the Microsoft Defender ATP service You can set a compliance rule for configuration item in System Center 2012 R2 Configuration Manager to monitor your deployment. -This rule should be a *non-remediating* compliance rule configuration item that monitors the value of a registry key on targeted machines. +This rule should be a *non-remediating* compliance rule configuration item that monitors the value of a registry key on targeted devices. Monitor the following registry key entry: + +```console +Path: "HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status" +Name: "OnboardingState" +Value: "1" ``` -Path: “HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status” -Name: “OnboardingState” -Value: “1” -``` + For more information, see [Introduction to compliance settings in System Center 2012 R2 Configuration Manager](https://docs.microsoft.com/previous-versions/system-center/system-center-2012-R2/gg682139\(v=technet.10\)). ## Related topics -- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) -- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) -- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) -- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) -- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md) -- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) +- [Onboard Windows 10 devices using Group Policy](configure-endpoints-gp.md) +- [Onboard Windows 10 devices using Mobile Device Management tools](configure-endpoints-mdm.md) +- [Onboard Windows 10 devices using a local script](configure-endpoints-script.md) +- [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) +- [Run a detection test on a newly onboarded Microsoft Defender ATP device](run-detection-test.md) +- [Troubleshoot Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md index baa161a42c..6c32573e4c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md @@ -1,10 +1,10 @@ --- -title: Onboard Windows 10 machines using a local script -description: Use a local script to deploy the configuration package on machines so that they are onboarded to the service. -keywords: configure machines using a local script, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines +title: Onboard Windows 10 devices using a local script +description: Use a local script to deploy the configuration package on devices so that they are onboarded to the service. +keywords: configure devices using a local script, device management, configure Windows ATP devices, configure Microsoft Defender Advanced Threat Protection devices search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,67 +13,74 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Onboard Windows 10 machines using a local script +# Onboard Windows 10 devices using a local script -**Applies to:** +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) + +You can also manually onboard individual devices to Defender for Endpoint. You might want to do this first when testing the service before you commit to onboarding all devices in your network. + +> [!IMPORTANT] +> This script has been optimized for use on up to 10 devices. +> +> To deploy at scale, use [other deployment options](configure-endpoints.md). For example, you can deploy an onboarding script to more than 10 devices in production with the script available in [Onboard Windows 10 devices using Group Policy](configure-endpoints-gp.md). + +## Onboard devices + +[![Image of the PDF showing the various deployment paths](images/onboard-script.png)](images/onboard-script.png#lightbox) +Check out the [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.vsdx) to see the various paths in deploying Defender for Endpoint. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) - -You can also manually onboard individual machines to Microsoft Defender ATP. You might want to do this first when testing the service before you commit to onboarding all machines in your network. - -> [!NOTE] -> The script has been optimized to be used on a limited number of machines (1-10 machines). To deploy to scale, use other deployment options. For more information on using other deployment options, see [Onboard Window 10 machines](configure-endpoints.md). - -## Onboard machines 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): - a. In the navigation pane, select **Settings** > **Onboarding**. + 1. In the navigation pane, select **Settings** > **Onboarding**. - b. Select Windows 10 as the operating system. + 1. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **Local Script**. + 1. In the **Deployment method** field, select **Local Script**. - d. Click **Download package** and save the .zip file. + 1. Click **Download package** and save the .zip file. -2. Extract the contents of the configuration package to a location on the machine you want to onboard (for example, the Desktop). You should have a file named *WindowsDefenderATPOnboardingScript.cmd*. +2. Extract the contents of the configuration package to a location on the device you want to onboard (for example, the Desktop). You should have a file named *WindowsDefenderATPOnboardingScript.cmd*. -3. Open an elevated command-line prompt on the machine and run the script: +3. Open an elevated command-line prompt on the device and run the script: - a. Go to **Start** and type **cmd**. + 1. Go to **Start** and type **cmd**. - b. Right-click **Command prompt** and select **Run as administrator**. + 1. Right-click **Command prompt** and select **Run as administrator**. - ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) + ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) 4. Type the location of the script file. If you copied the file to the desktop, type: *%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd* 5. Press the **Enter** key or click **OK**. -For information on how you can manually validate that the machine is compliant and correctly reports sensor data see, [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md). +For information on how you can manually validate that the device is compliant and correctly reports sensor data see, [Troubleshoot Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md). >[!TIP] -> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md). +> After onboarding the device, you can choose to run a detection test to verify that an device is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender for Endpoint endpoint](run-detection-test.md). ## Configure sample collection settings -For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Microsoft Defender Security Center to submit a file for deep analysis. +For each device, you can set a configuration value to state whether samples can be collected from the device when a request is made through Microsoft Defender Security Center to submit a file for deep analysis. -You can manually configure the sample sharing setting on the machine by using *regedit* or creating and running a *.reg* file. +You can manually configure the sample sharing setting on the device by using *regedit* or creating and running a *.reg* file. The configuration is set through the following registry key entry: -``` +```console Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection” Name: "AllowSampleCollection" Value: 0 or 1 @@ -81,63 +88,63 @@ Value: 0 or 1 Where:
    Name type is a D-WORD.
    Possible values are: -- 0 - doesn't allow sample sharing from this machine -- 1 - allows sharing of all file types from this machine +- 0 - doesn't allow sample sharing from this device +- 1 - allows sharing of all file types from this device The default value in case the registry key doesn’t exist is 1. -## Offboard machines using a local script -For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. +## Offboard devices using a local script +For security reasons, the package used to Offboard devices will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an device will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. > [!NOTE] -> Onboarding and offboarding policies must not be deployed on the same machine at the same time, otherwise this will cause unpredictable collisions. +> Onboarding and offboarding policies must not be deployed on the same device at the same time, otherwise this will cause unpredictable collisions. 1. Get the offboarding package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): - a. In the navigation pane, select **Settings** > **Offboarding**. + 1. In the navigation pane, select **Settings** > **Offboarding**. - b. Select Windows 10 as the operating system. + 1. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **Local Script**. + 1. In the **Deployment method** field, select **Local Script**. - d. Click **Download package** and save the .zip file. + 1. Click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the machines. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the devices. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. -3. Open an elevated command-line prompt on the machine and run the script: +3. Open an elevated command-line prompt on the device and run the script: - a. Go to **Start** and type **cmd**. + 1. Go to **Start** and type **cmd**. - b. Right-click **Command prompt** and select **Run as administrator**. + 1. Right-click **Command prompt** and select **Run as administrator**. - ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) + ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) 4. Type the location of the script file. If you copied the file to the desktop, type: *%userprofile%\Desktop\WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd* 5. Press the **Enter** key or click **OK**. > [!IMPORTANT] -> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. +> Offboarding causes the device to stop sending sensor data to the portal but data from the device, including reference to any alerts it has had will be retained for up to 6 months. -## Monitor machine configuration +## Monitor device configuration You can follow the different verification steps in the [Troubleshoot onboarding issues](troubleshoot-onboarding.md) to verify that the script completed successfully and the agent is running. Monitoring can also be done directly on the portal, or by using the different deployment tools. -### Monitor machines using the portal +### Monitor devices using the portal 1. Go to Microsoft Defender Security Center. -2. Click **Machines list**. +2. Click **Devices list**. -3. Verify that machines are appearing. +3. Verify that devices are appearing. ## Related topics -- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) -- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) -- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) -- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) -- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md) -- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) +- [Onboard Windows 10 devices using Group Policy](configure-endpoints-gp.md) +- [Onboard Windows 10 devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows 10 devices using Mobile Device Management tools](configure-endpoints-mdm.md) +- [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) +- [Run a detection test on a newly onboarded Microsoft Defender for Endpoint device](run-detection-test.md) +- [Troubleshoot Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 2c8c2b2f66..766b0d8fcf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -1,10 +1,10 @@ --- -title: Onboard non-persistent virtual desktop infrastructure (VDI) machines -description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to Microsoft Defender ATP the service. -keywords: configure virtual desktop infrastructure (VDI) machine, vdi, machine management, configure Windows ATP endpoints, configure Microsoft Defender Advanced Threat Protection endpoints +title: Onboard non-persistent virtual desktop infrastructure (VDI) devices +description: Deploy the configuration package on virtual desktop infrastructure (VDI) device so that they are onboarded to Microsoft Defender ATP the service. +keywords: configure virtual desktop infrastructure (VDI) device, vdi, device management, configure Windows ATP endpoints, configure Microsoft Defender Advanced Threat Protection endpoints search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,94 +13,118 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article ms.date: 04/16/2020 +ms.technology: mde --- -# Onboard non-persistent virtual desktop infrastructure (VDI) machines +# Onboard non-persistent virtual desktop infrastructure (VDI) devices + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- Virtual desktop infrastructure (VDI) machines +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +- Virtual desktop infrastructure (VDI) devices +- Windows 10, Windows Server 2019, Windows Server 2008R2/2012R2/2016 + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configvdi-abovefoldlink) + +## Onboard non-persistent virtual desktop infrastructure (VDI) devices + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +Defender for Endpoint supports non-persistent VDI session onboarding. + +>[!Note] +>To onboard non-persistent VDI sessions, VDI devices must be Windows 10 or Windows Server 2019. +> +>While other Windows versions might work, only Windows 10 and Windows Server 2019 are supported. + +There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario: + +- Instant early onboarding of a short-lived sessions, which must be onboarded to Defender for Endpoint prior to the actual provisioning. +- The device name is typically reused for new sessions. + +VDI devices can appear in Defender for Endpoint portal as either: + +- Single entry for each device. +Note that in this case, the *same* device name must be configured when the session is created, for example using an unattended answer file. +- Multiple entries for each device - one for each session. + +The following steps will guide you through onboarding VDI devices and will highlight steps for single and multiple entries. >[!WARNING] -> Micrsosoft Defender ATP currently does not support Windows Virtual Desktop multi-user session. +> For environments where there are low resource configurations, the VDI boot procedure might slow the Defender for Endpoint sensor onboarding. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configvdi-abovefoldlink) -## Onboard non-persistent virtual desktop infrastructure (VDI) machines - -Microsoft Defender ATP supports non-persistent VDI session onboarding. There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario: - -- Instant early onboarding of a short-lived sessions, which must be onboarded to Microsoft Defender ATP prior to the actual provisioning. -- The machine name is typically reused for new sessions. - -VDI machines can appear in Microsoft Defender ATP portal as either: - -- Single entry for each machine. -Note that in this case, the *same* machine name must be configured when the session is created, for example using an unattended answer file. -- Multiple entries for each machine - one for each session. - -The following steps will guide you through onboarding VDI machines and will highlight steps for single and multiple entries. - ->[!WARNING] -> For environments where there are low resource configurations, the VDI boot procedure might slow the Microsoft Defender ATP sensor onboarding. +### For Windows 10 or Windows Server 2019 1. Open the VDI configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): - a. In the navigation pane, select **Settings** > **Onboarding**. + 1. In the navigation pane, select **Settings** > **Onboarding**. - b. Select Windows 10 as the operating system. + 1. Select Windows 10 as the operating system. - c. In the **Deployment method** field, select **VDI onboarding scripts for non-persistent endpoints**. + 1. In the **Deployment method** field, select **VDI onboarding scripts for non-persistent endpoints**. - d. Click **Download package** and save the .zip file. + 1. Click **Download package** and save the .zip file. -2. Copy the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`. +2. Copy the files from the WindowsDefenderATPOnboardingPackage folder extracted from the .zip file into the `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. - >[!NOTE] - >If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose the **Show hidden files and folders** option from file explorer. + 1. If you are not implementing a single entry for each device, copy WindowsDefenderATPOnboardingScript.cmd. -3. The following step is only applicable if you're implementing a single entry for each machine:
    - **For single entry for each machine**:
    - a. From the `WindowsDefenderATPOnboardingPackage`, copy the `Onboard-NonPersistentMachine.ps1` file to `golden/master` image to the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`.
    + 1. If you are implementing a single entry for each device, copy both Onboard-NonPersistentMachine.ps1 and WindowsDefenderATPOnboardingScript.cmd. + + > [!NOTE] + > If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose the **Show hidden files and folders** option from File Explorer. - >[!NOTE] - >If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose the **Show hidden files and folders** option from file explorer. +3. Open a Local Group Policy Editor window and navigate to **Computer Configuration** > **Windows Settings** > **Scripts** > **Startup**. -4. Open a Local Group Policy Editor window and navigate to **Computer Configuration** > **Windows Settings** > **Scripts** > **Startup**. + > [!NOTE] + > Domain Group Policy may also be used for onboarding non-persistent VDI devices. - >[!NOTE] - >Domain Group Policy may also be used for onboarding non-persistent VDI machines. +4. Depending on the method you'd like to implement, follow the appropriate steps:
    + **For single entry for each device**:
    + + Select the **PowerShell Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to onboarding PowerShell script `Onboard-NonPersistentMachine.ps1`. + + **For multiple entries for each device**: + + Select the **Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to the onboarding bash script `WindowsDefenderATPOnboardingScript.cmd`. -5. Depending on the method you'd like to implement, follow the appropriate steps:
    - **For single entry for each machine**:
    - Select the **PowerShell Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to onboarding PowerShell script `Onboard-NonPersistentMachine.ps1`.

    - **For multiple entries for each machine**:
    - Select the **Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to the onboarding bash script `WindowsDefenderATPOnboardingScript.cmd`. +5. Test your solution: -6. Test your solution: - - a. Create a pool with one machine. + 1. Create a pool with one device. - b. Logon to machine. + 1. Logon to device. - c. Logoff from machine. + 1. Logoff from device. - d. Logon to machine with another user. + 1. Logon to device with another user. - e. **For single entry for each machine**: Check only one entry in Microsoft Defender Security Center.
    - **For multiple entries for each machine**: Check multiple entries in Microsoft Defender Security Center. + 1. **For single entry for each device**: Check only one entry in Microsoft Defender Security Center.
    + **For multiple entries for each device**: Check multiple entries in Microsoft Defender Security Center. + +6. Click **Devices list** on the Navigation pane. + +7. Use the search function by entering the device name and select **Device** as search type. + + +## For downlevel SKUs +1. Set registry value 'HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging|VDI’ to “NonPersistent' + +2. Follow the [server onboarding process](configure-server-endpoints.md#windows-server-2008-r2-sp1-windows-server-2012-r2-and-windows-server-2016). -7. Click **Machines list** on the Navigation pane. -8. Use the search function by entering the machine name and select **Machine** as search type. ## Updating non-persistent virtual desktop infrastructure (VDI) images As a best practice, we recommend using offline servicing tools to patch golden/master images.
    For example, you can use the below commands to install an update while the image remains offline: -``` +```console DISM /Mount-image /ImageFile:"D:\Win10-1909.vhdx" /index:1 /MountDir:"C:\Temp\OfflineServicing" DISM /Image:"C:\Temp\OfflineServicing" /Add-Package /Packagepath:"C:\temp\patch\windows10.0-kb4541338-x64.msu" DISM /Unmount-Image /MountDir:"C:\Temp\OfflineServicing" /commit @@ -113,30 +137,31 @@ For more information on DISM commands and offline servicing, please refer to the If offline servicing is not a viable option for your non-persistent VDI environment, the following steps should be taken to ensure consistency and sensor health: -1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Microsoft Defender ATP sensor. For more information, see [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script). +1. After booting the master image for online servicing or patching, run an offboarding script to turn off the Defender for Endpoint sensor. For more information, see [Offboard devices using a local script](configure-endpoints-script.md#offboard-devices-using-a-local-script). 2. Ensure the sensor is stopped by running the command below in a CMD window: - ``` - sc query sense - ``` + ```console + sc query sense + ``` 3. Service the image as needed. 4. Run the below commands using PsExec.exe (which can be downloaded from https://download.sysinternals.com/files/PSTools.zip) to cleanup the cyber folder contents that the sensor may have accumulated since boot: - ``` + ```console PsExec.exe -s cmd.exe cd "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber" del *.* /f /s /q + REG DELETE “HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection" /v senseGuid /f exit ``` 5. Re-seal the golden/master image as you normally would. ## Related topics -- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) -- [Onboard Windows 10 machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) -- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) -- [Onboard Windows 10 machines using a local script](configure-endpoints-script.md) -- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) +- [Onboard Windows 10 devices using Group Policy](configure-endpoints-gp.md) +- [Onboard Windows 10 devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows 10 devices using Mobile Device Management tools](configure-endpoints-mdm.md) +- [Onboard Windows 10 devices using a local script](configure-endpoints-script.md) +- [Troubleshoot Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md index c3f4376a4a..85c75d3828 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md @@ -1,10 +1,10 @@ --- -title: Onboarding tools and methods for Windows 10 machines -description: Onboard Windows 10 machines so that they can send sensor data to the Microsoft Defender ATP sensor -keywords: Onboard Windows 10 machines, group policy, endpoint configuration manager, mobile device management, local script, gp, sccm, mdm, intune +title: Onboarding tools and methods for Windows 10 devices +description: Onboard Windows 10 devices so that they can send sensor data to the Microsoft Defender ATP sensor +keywords: Onboard Windows 10 devices, group policy, endpoint configuration manager, mobile device management, local script, gp, sccm, mdm, intune search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,20 +13,23 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- -# Onboarding tools and methods for Windows 10 machines +# Onboarding tools and methods for Windows 10 devices + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +- [Microsoft 365 Endpoint data loss prevention (DLP)](/microsoft-365/compliance/endpoint-dlp-learn-about) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - - -Machines in your organization must be configured so that the Microsoft Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the machines in your organization. +Devices in your organization must be configured so that the Defender for Endpoint service can get sensor data from them. There are various methods and deployment tools that you can use to configure the devices in your organization. The following deployment tools and methods are supported: @@ -38,11 +41,11 @@ The following deployment tools and methods are supported: ## In this section Topic | Description :---|:--- -[Onboard Windows 10 machines using Group Policy](configure-endpoints-gp.md) | Use Group Policy to deploy the configuration package on machines. -[Onboard Windows machines using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) | You can use either use Microsoft Endpoint Configuration Manager (current branch) version 1606 or Microsoft Endpoint Configuration Manager (current branch) version 1602 or earlier to deploy the configuration package on machines. -[Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm.md) | Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on machine. -[Onboard Windows 10 machines using a local script](configure-endpoints-script.md) | Learn how to use the local script to deploy the configuration package on endpoints. -[Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) | Learn how to use the configuration package to configure VDI machines. +[Onboard Windows 10 devices using Group Policy](configure-endpoints-gp.md) | Use Group Policy to deploy the configuration package on devices. +[Onboard Windows devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) | You can use either use Microsoft Endpoint Manager (current branch) version 1606 or Microsoft Endpoint Manager (current branch) version 1602 or earlier to deploy the configuration package on devices. +[Onboard Windows 10 devices using Mobile Device Management tools](configure-endpoints-mdm.md) | Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on device. +[Onboard Windows 10 devices using a local script](configure-endpoints-script.md) | Learn how to use the local script to deploy the configuration package on endpoints. +[Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) | Learn how to use the configuration package to configure VDI devices. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink) \ No newline at end of file +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md index dea1185d9b..6b6afc49f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md @@ -1,10 +1,10 @@ --- title: Optimize ASR rule deployment and detections -description: Optimize your attack surface reduction (ASR) rules to identify and prevent typical malware exploits. +description: Optimize your attack surface reduction (ASR) rules to identify and prevent typical malware exploits. keywords: onboard, Intune management, MDATP, WDATP, Microsoft Defender, Windows Defender, advanced threat protection, attack surface reduction, ASR, security baseline search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,17 +13,20 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Optimize ASR rule deployment and detections +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -> Want to experience Microsoft Defender ATP? [Sign up for a free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink). +> Want to experience Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink). [Attack surface reduction (ASR) rules](./attack-surface-reduction.md) identify and prevent typical malware exploits. They control when and how potentially malicious code can run. For example, they can prevent JavaScript or VBScript from launching a downloaded executable, block Win32 API calls from Office macros, and block processes that run from USB drives. @@ -48,6 +51,6 @@ For more information about ASR rule deployment in Microsoft 365 security center, **Related topics** -* [Ensure your machines are configured properly](configure-machines.md) -* [Get machines onboarded to Microsoft Defender ATP](configure-machines-onboarding.md) -* [Monitor compliance to the Microsoft Defender ATP security baseline](configure-machines-security-baseline.md) +* [Ensure your devices are configured properly](configure-machines.md) +* [Get devices onboarded to Microsoft Defender for Endpoint](configure-machines-onboarding.md) +* [Monitor compliance to the Microsoft Defender for Endpoint security baseline](configure-machines-security-baseline.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md index 1f672b58a6..76815e7245 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md @@ -1,10 +1,10 @@ --- -title: Get machines onboarded to Microsoft Defender ATP -description: Track onboarding of Intune-managed machines to Windows Defender ATP and increase onboarding rate. +title: Get devices onboarded to Microsoft Defender ATP +description: Track onboarding of Intune-managed devices to Microsoft Defender ATP and increase onboarding rate. keywords: onboard, Intune management, MDATP, WDATP, Microsoft Defender, Windows Defender, advanced threat protection, configuration management search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,55 +13,62 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Get machines onboarded to Microsoft Defender ATP +# Get devices onboarded to Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) +>Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) -Each onboarded machine adds an additional endpoint detection and response (EDR) sensor and increases visibility over breach activity in your network. Onboarding also ensures that a machine can be checked for vulnerable components as well security configuration issues and can receive critical remediation actions during attacks. +Each onboarded device adds an additional endpoint detection and response (EDR) sensor and increases visibility over breach activity in your network. Onboarding also ensures that a device can be checked for vulnerable components as well security configuration issues and can receive critical remediation actions during attacks. -Before you can track and manage onboarding of machines: -- [Enroll your machines to Intune management](configure-machines.md#enroll-machines-to-intune-management) +Before you can track and manage onboarding of devices: +- [Enroll your devices to Intune management](configure-machines.md#enroll-devices-to-intune-management) - [Ensure you have the necessary permissions](configure-machines.md#obtain-required-permissions) -## Discover and track unprotected machines +## Discover and track unprotected devices -The **Onboarding** card provides a high-level overview of your onboarding rate by comparing the number of Windows 10 machines that have actually onboarded to Microsoft Defender ATP against the total number of Intune-managed Windows 10 machines. +The **Onboarding** card provides a high-level overview of your onboarding rate by comparing the number of Windows 10 devices that have actually onboarded to Defender for Endpoint against the total number of Intune-managed Windows 10 devices. -![Machine configuration management Onboarding card](images/secconmgmt_onboarding_card.png)
    -*Card showing onboarded machines compared to the total number of Intune-managed Windows 10 machine* +![Device configuration management Onboarding card](images/secconmgmt_onboarding_card.png)
    +*Card showing onboarded devices compared to the total number of Intune-managed Windows 10 device* >[!NOTE] ->If you used Security Center Configuration Manager, the onboarding script, or other onboarding methods that don’t use Intune profiles, you might encounter data discrepancies. To resolve these discrepancies, create a corresponding Intune configuration profile for Microsoft Defender ATP onboarding and assign that profile to your machines. +>If you used Security Center Configuration Manager, the onboarding script, or other onboarding methods that don’t use Intune profiles, you might encounter data discrepancies. To resolve these discrepancies, create a corresponding Intune configuration profile for Defender for Endpoint onboarding and assign that profile to your devices. -## Onboard more machines with Intune profiles +## Onboard more devices with Intune profiles -Microsoft Defender ATP provides several convenient options for [onboarding Windows 10 machines](onboard-configure.md). For Intune-managed machines, however, you can leverage Intune profiles to conveniently deploy the Microsoft Defender ATP sensor to select machines, effectively onboarding these devices to the service. +Defender for Endpoint provides several convenient options for [onboarding Windows 10 devices](onboard-configure.md). For Intune-managed devices, however, you can leverage Intune profiles to conveniently deploy the Defender for Endpoint sensor to select devices, effectively onboarding these devices to the service. -From the **Onboarding** card, select **Onboard more machines** to create and assign a profile on Intune. The link takes you to the device compliance page on Intune, which provides a similar overview of your onboarding state. +From the **Onboarding** card, select **Onboard more devices** to create and assign a profile on Intune. The link takes you to the device compliance page on Intune, which provides a similar overview of your onboarding state. ![Microsoft Defender ATP device compliance page on Intune device management](images/secconmgmt_onboarding_1deviceconfprofile.png)
    *Microsoft Defender ATP device compliance page on Intune device management* >[!TIP] ->Alternatively, you can navigate to the Microsoft Defender ATP onboarding compliance page in the [Microsoft Azure portal](https://portal.azure.com/) from **All services > Intune > Device compliance > Microsoft Defender ATP**. +>Alternatively, you can navigate to the Defender for Endpoint onboarding compliance page in the [Microsoft Azure portal](https://portal.azure.com/) from **All services > Intune > Device compliance > Microsoft Defender ATP**. -From the device compliance page, create a configuration profile specifically for the deployment of the Microsoft Defender ATP sensor and assign that profile to the machines you want to onboard. To do this, you can either: +>[!NOTE] +> If you want to view the most up-to-date device data, click on **List of devices without ATP sensor**. + +From the device compliance page, create a configuration profile specifically for the deployment of the Defender for Endpoint sensor and assign that profile to the devices you want to onboard. To do this, you can either: - Select **Create a device configuration profile to configure ATP sensor** to start with a predefined device configuration profile. - Create the device configuration profile from scratch. -For more information, [read about using Intune device configuration profiles to onboard machines to Microsoft Defender ATP](https://docs.microsoft.com/intune/advanced-threat-protection#onboard-devices-by-using-a-configuration-profile). +For more information, [read about using Intune device configuration profiles to onboard devices to Defender for Endpoint](https://docs.microsoft.com/intune/advanced-threat-protection#onboard-devices-by-using-a-configuration-profile). >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) ## Related topics -- [Ensure your machines are configured properly](configure-machines.md) -- [Increase compliance to the Microsoft Defender ATP security baseline](configure-machines-security-baseline.md) +- [Ensure your devices are configured properly](configure-machines.md) +- [Increase compliance to the Defender for Endpoint security baseline](configure-machines-security-baseline.md) - [Optimize ASR rule deployment and detections](configure-machines-asr.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md index a91141c30b..f85e803452 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md @@ -1,10 +1,10 @@ --- title: Increase compliance to the Microsoft Defender ATP security baseline description: The Microsoft Defender ATP security baseline sets Microsoft Defender ATP security controls to provide optimal protection. -keywords: Intune management, MDATP, WDATP, Microsoft Defender, Windows Defender, advanced threat protection ASR, security baseline +keywords: Intune management, MDATP, WDATP, Microsoft Defender, advanced threat protection ASR, security baseline search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,91 +13,95 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Increase compliance to the Microsoft Defender ATP security baseline +# Increase compliance to the Microsoft Defender for Endpoint security baseline + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) -Security baselines ensure that security features are configured according to guidance from both security experts and expert Windows system administrators. When deployed, the Microsoft Defender ATP security baseline sets Microsoft Defender ATP security controls to provide optimal protection. +Security baselines ensure that security features are configured according to guidance from both security experts and expert Windows system administrators. When deployed, the Defender for Endpoint security baseline sets Defender for Endpoint security controls to provide optimal protection. To understand security baselines and how they are assigned on Intune using configuration profiles, [read this FAQ](https://docs.microsoft.com/intune/security-baselines#q--a). Before you can deploy and track compliance to security baselines: -- [Enroll your machines to Intune management](configure-machines.md#enroll-machines-to-intune-management) +- [Enroll your devices to Intune management](configure-machines.md#enroll-devices-to-intune-management) - [Ensure you have the necessary permissions](configure-machines.md#obtain-required-permissions) ## Compare the Microsoft Defender ATP and the Windows Intune security baselines -The Windows Intune security baseline provides a comprehensive set of recommended settings needed to securely configure machines running Windows, including browser settings, PowerShell settings, as well as settings for some security features like Windows Defender Antivirus. In contrast, the Microsoft Defender ATP baseline provides settings that optimize all the security controls in the Microsoft Defender ATP stack, including settings for endpoint detection and response (EDR) as well as settings also found in the Windows Intune security baseline. For more information about each baseline, see: +The Windows Intune security baseline provides a comprehensive set of recommended settings needed to securely configure devices running Windows, including browser settings, PowerShell settings, as well as settings for some security features like Microsoft Defender Antivirus. In contrast, the Defender for Endpoint baseline provides settings that optimize all the security controls in the Defender for Endpoint stack, including settings for endpoint detection and response (EDR) as well as settings also found in the Windows Intune security baseline. For more information about each baseline, see: - [Windows security baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-windows) - [Microsoft Defender ATP baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-defender-atp) -Both baselines are maintained so that they complement one another and have identical values for shared settings. Deploying both baselines to the same machine will not result in conflicts. Ideally, machines onboarded to Microsoft Defender ATP are deployed both baselines: the Windows Intune security baseline to initially secure Windows and then the Microsoft Defender ATP security baseline layered on top to optimally configure the Microsoft Defender ATP security controls. +Ideally, devices onboarded to Defender for Endpoint are deployed both baselines: the Windows Intune security baseline to initially secure Windows and then the Defender for Endpoint security baseline layered on top to optimally configure the Defender for Endpoint security controls. To benefit from the latest data on risks and threats and to minimize conflicts as baselines evolve, always apply the latest versions of the baselines across all products as soon as they are released. >[!NOTE] ->The Microsoft Defender ATP security baseline has been optimized for physical devices and is currently not recommended for use on virtual machines (VMs) or VDI endpoints. Certain baseline settings can impact remote interactive sessions on virtualized environments. +>The Defender for Endpoint security baseline has been optimized for physical devices and is currently not recommended for use on virtual machine (VMs) or VDI endpoints. Certain baseline settings can impact remote interactive sessions on virtualized environments. -## Monitor compliance to the Microsoft Defender ATP security baseline +## Monitor compliance to the Defender for Endpoint security baseline -The **Security baseline** card on [machine configuration management](configure-machines.md) provides an overview of compliance across Windows 10 machines that have been assigned the Microsoft Defender ATP security baseline. +The **Security baseline** card on [device configuration management](configure-machines.md) provides an overview of compliance across Windows 10 devices that have been assigned the Defender for Endpoint security baseline. ![Security baseline card](images/secconmgmt_baseline_card.png)
    -*Card showing compliance to the Microsoft Defender ATP security baseline* +*Card showing compliance to the Defender for Endpoint security baseline* -Each machine is given one of the following status types: +Each device is given one of the following status types: -- **Matches baseline**—machine settings match all the settings in the baseline -- **Does not match baseline**—at least one machine setting doesn't match the baseline -- **Misconfigured**—at least one baseline setting isn't properly configured on the machine and is in a conflict, error, or pending state -- **Not applicable**—At least one baseline setting isn't applicable on the machine +- **Matches baseline**—device settings match all the settings in the baseline +- **Does not match baseline**—at least one device setting doesn't match the baseline +- **Misconfigured**—at least one baseline setting isn't properly configured on the device and is in a conflict, error, or pending state +- **Not applicable**—At least one baseline setting isn't applicable on the device -To review specific machines, select **Configure security baseline** on the card. This takes you to Intune device management. From there, select **Device status** for the names and statuses of the machines. +To review specific devices, select **Configure security baseline** on the card. This takes you to Intune device management. From there, select **Device status** for the names and statuses of the devices. >[!NOTE] ->You might experience discrepancies in aggregated data displayed on the machine configuration management page and those displayed on overview screens in Intune. +>You might experience discrepancies in aggregated data displayed on the device configuration management page and those displayed on overview screens in Intune. -## Review and assign the Microsoft Defender ATP security baseline +## Review and assign the Microsoft Defender for Endpoint security baseline -Machine configuration management monitors baseline compliance only of Windows 10 machines that have been specifically assigned the Microsoft Defender ATP security baseline. You can conveniently review the baseline and assign it to machines on Intune device management. +Device configuration management monitors baseline compliance only of Windows 10 devices that have been specifically assigned the Microsoft Defender for Endpoint security baseline. You can conveniently review the baseline and assign it to devices on Intune device management. 1. Select **Configure security baseline** on the **Security baseline** card to go to Intune device management. A similar overview of baseline compliance is displayed. >[!TIP] - > Alternatively, you can navigate to the Microsoft Defender ATP security baseline in the Microsoft Azure portal from **All services > Intune > Device security > Security baselines > Microsoft Defender ATP baseline**. + > Alternatively, you can navigate to the Defender for Endpoint security baseline in the Microsoft Azure portal from **All services > Intune > Device security > Security baselines > Microsoft Defender ATP baseline**. 2. Create a new profile. - ![Microsoft Defender ATP security baseline overview on Intune](images/secconmgmt_baseline_intuneprofile1.png)
    - *Microsoft Defender ATP security baseline overview on Intune* + ![Microsoft Defender for Endpoint security baseline overview on Intune](images/secconmgmt_baseline_intuneprofile1.png)
    + *Microsoft Defender for Endpoint security baseline overview on Intune* 3. During profile creation, you can review and adjust specific settings on the baseline. ![Security baseline options during profile creation on Intune](images/secconmgmt_baseline_intuneprofile2.png)
    *Security baseline options during profile creation on Intune* -4. Assign the profile to the appropriate machine group. +4. Assign the profile to the appropriate device group. ![Security baseline profiles on Intune](images/secconmgmt_baseline_intuneprofile3.png)
    *Assigning the security baseline profile on Intune* -5. Create the profile to save it and deploy it to the assigned machine group. +5. Create the profile to save it and deploy it to the assigned device group. ![Assigning the security baseline on Intune](images/secconmgmt_baseline_intuneprofile4.png)
    *Creating the security baseline profile on Intune* >[!TIP] ->Security baselines on Intune provide a convenient way to comprehensively secure and protect your machines. [Learn more about security baselines on Intune](https://docs.microsoft.com/intune/security-baselines). +>Security baselines on Intune provide a convenient way to comprehensively secure and protect your devices. [Learn more about security baselines on Intune](https://docs.microsoft.com/intune/security-baselines). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) +>Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) ## Related topics -- [Ensure your machines are configured properly](configure-machines.md) -- [Get machines onboarded to Microsoft Defender ATP](configure-machines-onboarding.md) -- [Optimize ASR rule deployment and detections](configure-machines-asr.md) \ No newline at end of file +- [Ensure your devices are configured properly](configure-machines.md) +- [Get devices onboarded to Microsoft Defender for Endpoint](configure-machines-onboarding.md) +- [Optimize ASR rule deployment and detections](configure-machines-asr.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md index 463aa8e967..3bd54ed230 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md @@ -1,10 +1,10 @@ --- -title: Ensure your machines are configured properly -description: Properly configure machines to boost overall resilience against threats and enhance your capability to detect and respond to attacks. +title: Ensure your devices are configured properly +description: Properly configure devices to boost overall resilience against threats and enhance your capability to detect and respond to attacks. keywords: onboard, Intune management, MDATP, WDATP, Microsoft Defender, Windows Defender, advanced threat protection, attack surface reduction, ASR, security baseline search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,48 +13,54 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- -# Ensure your machines are configured properly +# Ensure your devices are configured properly + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) -With properly configured machines, you can boost overall resilience against threats and enhance your capability to detect and respond to attacks. Security configuration management helps ensure that your machines: +With properly configured devices, you can boost overall resilience against threats and enhance your capability to detect and respond to attacks. Security configuration management helps ensure that your devices: -- Onboard to Microsoft Defender ATP -- Meet or exceed the Microsoft Defender ATP security baseline configuration +- Onboard to Microsoft Defender for Endpoint +- Meet or exceed the Defender for Endpoint security baseline configuration - Have strategic attack surface mitigations in place +Click **Configuration management** from the navigation menu to open the Device configuration management page. + ![Security configuration management page](images/secconmgmt_main.png)
    -*Machine configuration management page* +*Device configuration management page* You can track configuration status at an organizational level and quickly take action in response to poor onboarding coverage, compliance issues, and poorly optimized attack surface mitigations through direct, deep links to device management pages on Microsoft Intune and Microsoft 365 security center. In doing so, you benefit from: -- Comprehensive visibility of the events on your machines -- Robust threat intelligence and powerful machine learning technologies for processing raw events and identifying the breach activity and threat indicators +- Comprehensive visibility of the events on your devices +- Robust threat intelligence and powerful device learning technologies for processing raw events and identifying the breach activity and threat indicators - A full stack of security features configured to efficiently stop the installation of malicious implants, hijacking of system files and process, data exfiltration, and other threat activities - Optimized attack surface mitigations, maximizing strategic defenses against threat activity while minimizing impact to productivity -## Enroll machines to Intune management +## Enroll devices to Intune management -Machine configuration management works closely with Intune device management to establish the inventory of the machines in your organization and the baseline security configuration. You will be able to track and manage configuration issues on Intune-managed Windows 10 machines. +Device configuration management works closely with Intune device management to establish the inventory of the devices in your organization and the baseline security configuration. You will be able to track and manage configuration issues on Intune-managed Windows 10 devices. -Before you can ensure your machines are configured properly, enroll them to Intune management. Intune enrollment is robust and has several enrollment options for Windows 10 machines. For more information about Intune enrollment options, read about [setting up enrollment for Windows devices](https://docs.microsoft.com/intune/windows-enroll). +Before you can ensure your devices are configured properly, enroll them to Intune management. Intune enrollment is robust and has several enrollment options for Windows 10 devices. For more information about Intune enrollment options, read about [setting up enrollment for Windows devices](https://docs.microsoft.com/intune/windows-enroll). >[!NOTE] >To enroll Windows devices to Intune, administrators must have already been assigned licenses. [Read about assigning licenses for device enrollment](https://docs.microsoft.com/intune/licenses-assign). >[!TIP] ->To optimize machine management through Intune, [connect Intune to Microsoft Defender ATP](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). +>To optimize device management through Intune, [connect Intune to Defender for Endpoint](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). ## Obtain required permissions -By default, only users who have been assigned the Global Administrator or the Intune Service Administrator role on Azure AD can manage and assign the device configuration profiles needed for onboarding machines and deploying the security baseline. +By default, only users who have been assigned the Global Administrator or the Intune Service Administrator role on Azure AD can manage and assign the device configuration profiles needed for onboarding devices and deploying the security baseline. If you have been assigned other roles, ensure you have the necessary permissions: @@ -72,8 +78,8 @@ If you have been assigned other roles, ensure you have the necessary permissions ## In this section Topic | Description :---|:--- -[Get machines onboarded to Microsoft Defender ATP](configure-machines-onboarding.md)| Track onboarding status of Intune-managed machines and onboard more machines through Intune. -[Increase compliance to the Microsoft Defender ATP security baseline](configure-machines-security-baseline.md) | Track baseline compliance and noncompliance. Deploy the security baseline to more Intune-managed machines. +[Get devices onboarded to Defender for Endpoint](configure-machines-onboarding.md)| Track onboarding status of Intune-managed devices and onboard more devices through Intune. +[Increase compliance to the Defender for Endpoint security baseline](configure-machines-security-baseline.md) | Track baseline compliance and noncompliance. Deploy the security baseline to more Intune-managed devices. [Optimize ASR rule deployment and detections](configure-machines-asr.md) | Review rule deployment and tweak detections using impact analysis tools in Microsoft 365 security center. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) \ No newline at end of file +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md index 9698e75980..08de267337 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md @@ -5,7 +5,7 @@ description: Register to Microsoft Threats Experts to configure, manage, and use keywords: Microsoft Threat Experts, managed threat hunting service, MTE, Microsoft managed hunting service search.product: Windows 10 search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,44 +14,55 @@ author: DulceMontemayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint ms.topic: article +ms.technology: mde --- # Configure and manage Microsoft Threat Experts capabilities -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) ## Before you begin -Ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up. +> [!NOTE] +> Discuss the eligibility requirements with your Microsoft Technical Service provider and account team before you apply to the managed threat hunting service. -Microsoft Defender ATP customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive Targeted Attack Notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. Targeted Attack Notifications are always included after you have been accepted into Microsoft Threat Experts managed threat hunting service. +Ensure that you have Defender for Endpoint deployed in your environment with devices enrolled, and not just on a laboratory set-up. -If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply. Once accepted, you will get the benefits of Targeted Attack Notifications, and start a 90-day trial of Experts on Demand. Contact your Microsoft representative to get a full Experts on Demand subscription. +Defender for Endpoint customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive Targeted Attack Notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. Targeted Attack Notifications are always included after you have been accepted into Microsoft Threat Experts managed threat hunting service. + +If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply. Once accepted, you will get the benefits of Targeted Attack Notifications, and start a 90-day trial of Experts on Demand. Contact your Microsoft representative to get a full Experts on-Demand subscription. ## Register to Microsoft Threat Experts managed threat hunting service -If you're already a Microsoft Defender ATP customer, you can apply through the Microsoft Defender ATP portal. +If you're already a Defender for Endpoint customer, you can apply through the Microsoft Defender for Endpoint portal. 1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts**. 2. Click **Apply**. -![Image of Microsoft Threat Experts settings](images/mte-collaboratewithmte.png) + ![Image of Microsoft Threat Experts settings](images/mte-collaboratewithmte.png) 3. Enter your name and email address so that Microsoft can get back to you on your application. -![Image of Microsoft Threat Experts application](images/mte-apply.png) + ![Image of Microsoft Threat Experts application](images/mte-apply.png) 4. Read the [privacy statement](https://privacy.microsoft.com/en-us/privacystatement), then click **Submit** when you're done. You will receive a welcome email once your application is approved. -![Image of Microsoft Threat Experts application confirmation](images/mte-applicationconfirmation.png) + ![Image of Microsoft Threat Experts application confirmation](images/mte-applicationconfirmation.png) 6. From the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Threat Experts** toggle on. Click **Save preferences**. ## Receive targeted attack notification from Microsoft Threat Experts You can receive targeted attack notification from Microsoft Threat Experts through the following medium: -- The Microsoft Defender ATP portal's **Alerts** dashboard +- The Defender for Endpoint portal's **Alerts** dashboard - Your email, if you choose to configure it To receive targeted attack notifications through email, create an email notification rule. @@ -68,14 +79,15 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert ## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization -You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard. +You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised device, or a threat intelligence context that you see on your portal dashboard. ->[!NOTE] ->Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details. +> [!NOTE] +> - Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details. +> - You will need to have the "Manage security settings" permission in the Security Center portal to be able to submit a "Consult a threat expert" inquiry. -1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before you send an investigation request. +1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or device is in view before you send an investigation request. -2. From the upper right-hand menu, click **?**. Then, select **Consult a threat expert**. +2. From the upper right-hand menu, click the **?** icon. Then, select **Consult a threat expert**. ![Image of Microsoft Threat Experts Experts on Demand from the menu](images/mte-eod-menu.png) @@ -83,31 +95,40 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w ![Image of Microsoft Threat Experts Experts on Demand screen](images/mte-eod.png) - The following screen shows when you are on a full Microsoft Threat Experts - Experts on Demand subscription. + The following screen shows when you are on a full Microsoft Threat Experts - Experts on-Demand subscription. ![Image of Microsoft Threat Experts Experts on Demand full subscription screen](images/mte-eod-fullsubscription.png) - The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or machine details page that you were at when you made the request. + The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or device details page that you were at when you made the request. 3. In the next field, provide enough information to give the Microsoft Threat Experts enough context to start the investigation. 4. Enter the email address that you'd like to use to correspond with Microsoft Threat Experts. + +> [!NOTE] +> Customers with Premier Support subscription mapped to their Office 365 license can track the status of their Experts on Demand cases through Microsoft Services Hub. + +Watch this video for a quick overview of the Microsoft Services Hub. + +>[!VIDEO https://www.microsoft.com/videoplayer/embed/RE4pk9f] + + ## Sample investigation topics that you can consult with Microsoft Threat Experts **Alert information** - We see a new type of alert for a living-off-the-land binary: [AlertID]. Can you tell us something more about this alert and how we can investigate further? -- We’ve observed two similar attacks which try to execute malicious PowerShell scripts but generate different alerts. One is "Suspicious Powershell command line" and the other is "A malicious file was detected based on indication provided by O365". What is the difference? -- I receive an odd alert today for abnormal number of failed logins from a high profile user’s device. I cannot find any further evidence around these sign-in attempts. How can Microsoft Defender ATP see these attempts? What type of sign-ins are being monitored? +- We’ve observed two similar attacks, which try to execute malicious PowerShell scripts but generate different alerts. One is "Suspicious PowerShell command line" and the other is "A malicious file was detected based on indication provided by O365". What is the difference? +- I receive an odd alert today for abnormal number of failed logins from a high profile user’s device. I cannot find any further evidence around these sign-in attempts. How can Defender for Endpoint see these attempts? What type of sign-ins are being monitored? - Can you give more context or insights about this alert: “Suspicious behavior by a system utility was observed”. **Possible machine compromise** -- Can you help answer why we see “Unknown process observed?” This is seen quite frequently on many machines. We appreciate any input to clarify whether this is related to malicious activity. +- Can you help answer why we see “Unknown process observed?” This message or alert is seen frequently on many devices. We appreciate any input to clarify whether this message or alert is related to malicious activity. - Can you help validate a possible compromise on the following system on [date] with similar behaviors as the previous [malware name] malware detection on the same system in [month]? **Threat intelligence details** -- This morning, we detected a phishing email that delivered a malicious Word document to a user. This caused a series of suspicious events which triggered multiple Microsoft Defender alerts for [malware name] malware. Do you have any information on this malware? If yes, can you send me a link? -- I recently saw a [social media reference e.g., Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection Microsoft Defender ATP provides against this threat actor? +- We detected a phishing email that delivered a malicious Word document to a user. The malicious Word document caused a series of suspicious events, which triggered multiple Microsoft Defender alerts for [malware name] malware. Do you have any information on this malware? If yes, can you send me a link? +- I recently saw a [social media reference, for example, Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection Defender for Endpoint provides against this threat actor? **Microsoft Threat Experts’ alert communications** - Can your incident response team help us address the targeted attack notification that we got? @@ -126,8 +147,7 @@ Response from Microsoft Threat Experts varies according to your inquiry. They wi - Investigation requires more time - Initial information was enough to conclude the investigation -It is crucial to respond in a timely manner to keep the investigation moving. +It is crucial to respond in quickly to keep the investigation moving. ## Related topic - [Microsoft Threat Experts overview](microsoft-threat-experts.md) - diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-notifications.md b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-notifications.md new file mode 100644 index 0000000000..6f4f12e78a --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-notifications.md @@ -0,0 +1,49 @@ +--- +title: Configure alert notifications that are sent to MSSPs +description: Configure alert notifications that are sent to MSSPs +keywords: managed security service provider, mssp, configure, integration +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + +# Configure alert notifications that are sent to MSSPs + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) + + +>[!NOTE] +>This step can be done by either the MSSP customer or MSSP. MSSPs must be granted the appropriate permissions to configure this on behalf of the MSSP customer. + +After access the portal is granted, alert notification rules can to be created so that emails are sent to MSSPs when alerts associated with the tenant are created and set conditions are met. + + +For more information, see [Create rules for alert notifications](configure-email-notifications.md#create-rules-for-alert-notifications). + + +These check boxes must be checked: +- **Include organization name** - The customer name will be added to email notifications +- **Include tenant-specific portal link** - Alert link URL will have tenant specific parameter (tid=target_tenant_id) that allows direct access to target tenant portal + + +## Related topics +- [Grant MSSP access to the portal](grant-mssp-access.md) +- [Access the MSSP customer portal](access-mssp-portal.md) +- [Fetch alerts from customer tenant](fetch-alerts-mssp.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md index ab87a6d7f1..09106fbd64 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md @@ -1,12 +1,10 @@ --- title: Configure managed security service provider support - -description: Take the necessary steps to configure the MSSP integration with Windows Defender ATP - +description: Take the necessary steps to configure the MSSP integration with the Microsoft Defender for Endpoint keywords: managed security service provider, mssp, configure, integration search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -15,20 +13,21 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article -ms.date: 09/03/2018 +ms.technology: mde --- # Configure managed security service provider integration +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink) - [!include[Prerelease information](../../includes/prerelease.md)] You'll need to take the following configuration steps to enable the managed security service provider (MSSP) integration. @@ -44,7 +43,7 @@ The integration will allow MSSPs to take the following actions: - Get email notifications, and - Fetch alerts through security information and event management (SIEM) tools -Before MSSPs can take these actions, the MSSP customer will need to grant access to their Windows Defender ATP tenant so that the MSSP can access the portal. +Before MSSPs can take these actions, the MSSP customer will need to grant access to their Defender for Endpoint tenant so that the MSSP can access the portal. Typically, MSSP customers take the initial configuration steps to grant MSSPs access to their Windows Defender Security Central tenant. After access is granted, other configuration steps can be done by either the MSSP customer or the MSSP. @@ -54,7 +53,7 @@ In general, the following configuration steps need to be taken: - **Grant the MSSP access to Microsoft Defender Security Center**
    -This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Windows Defender ATP tenant. +This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Defender for Endpoint tenant. - **Configure alert notifications sent to MSSPs**
    @@ -66,250 +65,14 @@ This action is taken by the MSSP. It allows MSSPs to fetch alerts in SIEM tools. - **Fetch alerts from MSSP customer's tenant using APIs**
    This action is taken by the MSSP. It allows MSSPs to fetch alerts using APIs. +## Multi-tenant access for MSSPs +For information on how to implement a multi-tenant delegated access, see [Multi-tenant access for Managed Security Service Providers](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/multi-tenant-access-for-managed-security-service-providers/ba-p/1533440). -## Grant the MSSP access to the portal ->[!NOTE] -> These set of steps are directed towards the MSSP customer.
    -> Access to the portal can only be done by the MSSP customer. - -As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Microsoft Defender Security Center. - - -Authentication and authorization of the MSSP user is built on top of Azure Active Directory (Azure AD) B2B functionality. - -You'll need to take the following 2 steps: -- Add MSSP user to your tenant as a guest user - -- Grant MSSP user access to Microsoft Defender Security Center - - -### Add MSSP user to your tenant as a guest user -Add a user who is a member of the MSSP tenant to your tenant as a guest user. - -To grant portal access to the MSSP, you must add the MSSP user to your Azure AD as a guest user. For more information, see [Add Azure Active Directory B2B collaboration users in the Azure portal](https://docs.microsoft.com/azure/active-directory/b2b/add-users-administrator). - -### Grant MSSP user access to Microsoft Defender Security Center -Grant the guest user access and permissions to your Microsoft Defender Security Center tenant. - -Granting access to guest user is done the same way as granting access to a user who is a member of your tenant. - -If you're using basic permissions to access the portal, the guest user must be assigned a Security Administrator role in **your** tenant. For more information, see [Use basic permissions to access the portal](basic-permissions.md). - -If you're using role-based access control (RBAC), the guest user must be to added to the appropriate group or groups in **your** tenant. Fore more information on RBAC in Windows Defender ATP, see [Manage portal access using RBAC](rbac.md). - - ->[!NOTE] ->There is no difference between the Member user and Guest user roles from RBAC perspective. - -It is recommended that groups are created for MSSPs to make authorization access more manageable. - -As a MSSP customer, you can always remove or modify the permissions granted to the MSSP by updating the Azure AD user groups. - - -## Access the Microsoft Defender Security Center MSSP customer portal - ->[!NOTE] ->These set of steps are directed towards the MSSP. - -By default, MSSP customers access their Microsoft Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`. - - -MSSPs however, will need to use a tenant-specific URL in the following format: `https://securitycenter.windows.com?tid=customer_tenant_id` to access the MSSP customer portal. - -In general, MSSPs will need to be added to each of the MSSP customer's Azure AD that they intend to manage. - - -Use the following steps to obtain the MSSP customer tenant ID and then use the ID to access the tenant-specific URL: - -1. As an MSSP, login to Azure AD with your credentials. - -2. Switch directory to the MSSP customer's tenant. - -3. Select **Azure Active Directory > Properties**. You'll find the tenant ID in the Directory ID field. - -4. Access the MSSP customer portal by replacing the `customer_tenant_id` value in the following URL: `https://securitycenter.windows.com?tid=customer_tenant_id`. - -## Configure alert notifications that are sent to MSSPs - ->[!NOTE] ->This step can be done by either the MSSP customer or MSSP. MSSPs must be granted the appropriate permissions to configure this on behalf of the MSSP customer. - -After access the portal is granted, alert notification rules can to be created so that emails are sent to MSSPs when alerts associated with the tenant are created and set conditions are met. - - -For more information, see [Create rules for alert notifications](configure-email-notifications.md#create-rules-for-alert-notifications). - - -These check boxes must be checked: -- **Include organization name** - The customer name will be added to email notifications -- **Include tenant-specific portal link** - Alert link URL will have tenant specific parameter (tid=target_tenant_id) that allows direct access to target tenant portal - - -## Fetch alerts from MSSP customer's tenant into the SIEM system - ->[!NOTE] ->This action is taken by the MSSP. - - -To fetch alerts into your SIEM system you'll need to take the following steps: - -Step 1: Create a third-party application - -Step 2: Get access and refresh tokens from your customer's tenant - -Step 3: Whitelist your application on Microsoft Defender Security Center - - - - -### Step 1: Create an application in Azure Active Directory (Azure AD) - -You'll need to create an application and grant it permissions to fetch alerts from your customer's Windows Defender ATP tenant. - - -1. Sign in to the [Azure AD portal](https://aad.portal.azure.com/). - -2. Select **Azure Active Directory** > **App registrations**. - - -3. Click **New registration**. - - -4. Specify the following values: - - - Name: \ SIEM MSSP Connector (replace Tenant_name with the tenant display name) - - - Supported account types: Account in this organizational directory only - - Redirect URI: Select Web and type `https:///SiemMsspConnector`(replace with the tenant name) - -5. Click **Register**. The application is displayed in the list of applications you own. - -6. Select the application, then click **Overview**. - -7. Copy the value from the **Application (client) ID** field to a safe place, you will need this in the next step. - -8. Select **Certificate & secrets** in the new application panel. - -9. Click **New client secret**. - - - - Description: Enter a description for the key. - - Expires: Select **In 1 year** - - -10. Click **Add**, copy the value of the client secret to a safe place, you will need this in the next step. - - -### Step 2: Get access and refresh tokens from your customer's tenant -This section guides you on how to use a PowerShell script to get the tokens from your customer's tenant. This script uses the application from the previous step to get the access and refresh tokens using the OAuth Authorization Code Flow. - -After providing your credentials, you'll need to grant consent to the application so that the application is provisioned in the customer's tenant. - - -1. Create a new folder and name it: `MsspTokensAcquisition`. - -2. Download the [LoginBrowser.psm1 module](https://github.com/shawntabrizi/Microsoft-Authentication-with-PowerShell-and-MSAL/blob/master/Authorization%20Code%20Grant%20Flow/LoginBrowser.psm1) and save it in the `MsspTokensAcquisition` folder. - - >[!NOTE] - >In line 30, replace `authorzationUrl` with `authorizationUrl`. - -3. Create a file with the following content and save it with the name `MsspTokensAcquisition.ps1` in the folder: - ``` - param ( - [Parameter(Mandatory=$true)][string]$clientId, - [Parameter(Mandatory=$true)][string]$secret, - [Parameter(Mandatory=$true)][string]$tenantId - ) - [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 - - # Load our Login Browser Function - Import-Module .\LoginBrowser.psm1 - - # Configuration parameters - $login = "https://login.microsoftonline.com" - $redirectUri = "https://SiemMsspConnector" - $resourceId = "https://graph.windows.net" - - Write-Host 'Prompt the user for his credentials, to get an authorization code' - $authorizationUrl = ("{0}/{1}/oauth2/authorize?prompt=select_account&response_type=code&client_id={2}&redirect_uri={3}&resource={4}" -f - $login, $tenantId, $clientId, $redirectUri, $resourceId) - Write-Host "authorzationUrl: $authorizationUrl" - - # Fake a proper endpoint for the Redirect URI - $code = LoginBrowser $authorizationUrl $redirectUri - - # Acquire token using the authorization code - - $Body = @{ - grant_type = 'authorization_code' - client_id = $clientId - code = $code - redirect_uri = $redirectUri - resource = $resourceId - client_secret = $secret - } - - $tokenEndpoint = "$login/$tenantId/oauth2/token?" - $Response = Invoke-RestMethod -Method Post -Uri $tokenEndpoint -Body $Body - $token = $Response.access_token - $refreshToken= $Response.refresh_token - - Write-Host " ----------------------------------- TOKEN ---------------------------------- " - Write-Host $token - - Write-Host " ----------------------------------- REFRESH TOKEN ---------------------------------- " - Write-Host $refreshToken - ``` -4. Open an elevated PowerShell command prompt in the `MsspTokensAcquisition` folder. - -5. Run the following command: - `Set-ExecutionPolicy -ExecutionPolicy Bypass` - -6. Enter the following commands: `.\MsspTokensAcquisition.ps1 -clientId -secret -tenantId ` - - - Replace \ with the **Application (client) ID** you got from the previous step. - - Replace \ with the **Client Secret** you created from the previous step. - - Replace \ with your customer's **Tenant ID**. - - -7. You'll be asked to provide your credentials and consent. Ignore the page redirect. - -8. In the PowerShell window, you'll receive an access token and a refresh token. Save the refresh token to configure your SIEM connector. - - -### Step 3: Whitelist your application on Microsoft Defender Security Center -You'll need to whitelist the application you created in Microsoft Defender Security Center. - - -You'll need to have **Manage portal system settings** permission to whitelist the application. Otherwise, you'll need to request your customer to whitelist the application for you. - -1. Go to `https://securitycenter.windows.com?tid=` (replace \ with the customer's tenant ID. - -2. Click **Settings** > **SIEM**. - -3. Select the **MSSP** tab. - -4. Enter the **Application ID** from the first step and your **Tenant ID**. - -5. Click **Authorize application**. - - -You can now download the relevant configuration file for your SIEM and connect to the Windows Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem.md). - - -- In the ArcSight configuration file / Splunk Authentication Properties file – you will have to write your application key manually by settings the secret value. -- Instead of acquiring a refresh token in the portal, use the script from the previous step to acquire a refresh token (or acquire it by other means). - -## Fetch alerts from MSSP customer's tenant using APIs - -For information on how to fetch alerts using REST API, see [Pull alerts using REST API](pull-alerts-using-rest-api.md). - ## Related topics -- [Use basic permissions to access the portal](basic-permissions.md) -- [Manage portal access using RBAC](rbac.md) -- [Pull alerts to your SIEM tools](configure-siem.md) -- [Pull alerts using REST API](pull-alerts-using-rest-api.md) - +- [Grant MSSP access to the portal](grant-mssp-access.md) +- [Access the MSSP customer portal](access-mssp-portal.md) +- [Configure alert notifications](configure-mssp-notifications.md) +- [Fetch alerts from customer tenant](fetch-alerts-mssp.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 66efa55144..07ccd43835 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -1,10 +1,10 @@ --- -title: Configure machine proxy and Internet connection settings +title: Configure device proxy and Internet connection settings description: Configure the Microsoft Defender ATP proxy and internet settings to enable communication with the cloud service. keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,21 +13,26 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: + - m365-security-compliance + - m365initiative-defender-endpoint ms.topic: article +ms.technology: mde --- -# Configure machine proxy and Internet connectivity settings +# Configure device proxy and Internet connectivity settings + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) +The Defender for Endpoint sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Defender for Endpoint service. -The Microsoft Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Microsoft Defender ATP service. - -The embedded Microsoft Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Microsoft Defender ATP cloud service. +The embedded Defender for Endpoint sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Defender for Endpoint cloud service. >[!TIP] >For organizations that use forward proxies as a gateway to the Internet, you can use network protection to investigate behind a proxy. For more information, see [Investigate connection events that occur behind forward proxies](investigate-behind-proxy.md). @@ -39,7 +44,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe - Web Proxy Auto-discovery Protocol (WPAD) > [!NOTE] - > If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Microsoft Defender ATP URL exclusions in the proxy, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). + > If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Defender for Endpoint URL exclusions in the proxy, see [Enable access to Defender for Endpoint service URLs in the proxy server](#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server). - Manual static proxy configuration: - Registry based configuration @@ -47,16 +52,16 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe ## Configure the proxy server manually using a registry-based static proxy -Configure a registry-based static proxy to allow only Microsoft Defender ATP sensor to report diagnostic data and communicate with Microsoft Defender ATP services if a computer is not be permitted to connect to the Internet. +Configure a registry-based static proxy to allow only Defender for Endpoint sensor to report diagnostic data and communicate with Defender for Endpoint services if a computer is not be permitted to connect to the Internet. The static proxy is configurable through Group Policy (GP). The group policy can be found under: - Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service - Set it to **Enabled** and select **Disable Authenticated Proxy usage**: - ![Image of Group Policy setting](images/atp-gpo-proxy1.png) + ![Image of Group Policy setting1](images/atp-gpo-proxy1.png) - **Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry**: - Configure the proxy:
    - ![Image of Group Policy setting](images/atp-gpo-proxy2.png) + ![Image of Group Policy setting2](images/atp-gpo-proxy2.png) The policy sets two registry values `TelemetryProxyServer` as REG_SZ and `DisableEnterpriseAuthProxy` as REG_DWORD under the registry key `HKLM\Software\Policies\Microsoft\Windows\DataCollection`. @@ -100,28 +105,34 @@ netsh winhttp reset proxy See [Netsh Command Syntax, Contexts, and Formatting](https://docs.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts) to learn more. -## Enable access to Microsoft Defender ATP service URLs in the proxy server +## Enable access to Microsoft Defender for Endpoint service URLs in the proxy server -If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, add the domains listed below to the allowed domains list. -If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the domains listed below from HTTPS scanning. +If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, add the domains listed in the downloadable sheet to the allowed domains list. + +The following downloadable spreadsheet lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. + + +|**Spreadsheet of domains list**|**Description**| +|:-----|:-----| +|![Thumb image for Microsoft Defender for Endpoint URLs spreadsheet](images/mdatp-urls.png)
    | Spreadsheet of specific DNS records for service locations, geographic locations, and OS.

    [Download the spreadsheet here.](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx) + + +If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the domains listed in the above table from HTTPS scanning. > [!NOTE] -> settings-win.data.microsoft.com is only needed if you have Windows 10 machines running version 1803 or earlier.
    -> URLs that include v20 in them are only needed if you have Windows 10 machines running version 1803 or later. For example, ```us-v20.events.data.microsoft.com``` is needed for a Windows 10 machine running version 1803 or later and onboarded to US Data Storage region. +> settings-win.data.microsoft.com is only needed if you have Windows 10 devices running version 1803 or earlier.
    - Service location | Microsoft.com DNS record --|- -Common URLs for all locations | ```crl.microsoft.com```
    ```ctldl.windowsupdate.com```
    ```events.data.microsoft.com```
    ```notify.windows.com```
    ```settings-win.data.microsoft.com``` -European Union | ```eu.vortex-win.data.microsoft.com```
    ```eu-v20.events.data.microsoft.com```
    ```usseu1northprod.blob.core.windows.net```
    ```usseu1westprod.blob.core.windows.net```
    ```winatp-gw-neu.microsoft.com```
    ```winatp-gw-weu.microsoft.com```
    ```wseu1northprod.blob.core.windows.net```
    ```wseu1westprod.blob.core.windows.net```
    ```automatedirstrprdweu.blob.core.windows.net```
    ```automatedirstrprdneu.blob.core.windows.net``` -United Kingdom | ```uk.vortex-win.data.microsoft.com```
    ```uk-v20.events.data.microsoft.com```
    ```ussuk1southprod.blob.core.windows.net```
    ```ussuk1westprod.blob.core.windows.net```
    ```winatp-gw-uks.microsoft.com```
    ```winatp-gw-ukw.microsoft.com```
    ```wsuk1southprod.blob.core.windows.net```
    ```wsuk1westprod.blob.core.windows.net```
    ```automatedirstrprduks.blob.core.windows.net```
    ```automatedirstrprdukw.blob.core.windows.net``` -United States | ```us.vortex-win.data.microsoft.com```
    ```ussus1eastprod.blob.core.windows.net```
    ```ussus1westprod.blob.core.windows.net```
    ```ussus2eastprod.blob.core.windows.net```
    ```ussus2westprod.blob.core.windows.net```
    ```ussus3eastprod.blob.core.windows.net```
    ```ussus3westprod.blob.core.windows.net```
    ```ussus4eastprod.blob.core.windows.net```
    ```ussus4westprod.blob.core.windows.net```
    ```us-v20.events.data.microsoft.com```
    ```winatp-gw-cus.microsoft.com```
    ```winatp-gw-eus.microsoft.com```
    ```wsus1eastprod.blob.core.windows.net```
    ```wsus1westprod.blob.core.windows.net```
    ```wsus2eastprod.blob.core.windows.net```
    ```wsus2westprod.blob.core.windows.net```
    ```automatedirstrprdcus.blob.core.windows.net```
    ```automatedirstrprdeus.blob.core.windows.net``` > [!NOTE] -> If you are using Windows Defender Antivirus in your environment, please refer to the following article for details on allowing connections to the Windows Defender Antivirus cloud service: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus +> URLs that include v20 in them are only needed if you have Windows 10 devices running version 1803 or later. For example, ```us-v20.events.data.microsoft.com``` is needed for a Windows 10 device running version 1803 or later and onboarded to US Data Storage region. -If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs. -### Log analytics agent requirements +> [!NOTE] +> If you are using Microsoft Defender Antivirus in your environment, see [Configure network connections to the Microsoft Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus). + +If a proxy or firewall is blocking anonymous traffic, as Defender for Endpoint sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs. + +### Microsoft Monitoring Agent (MMA) - proxy and firewall requirements for older versions of Windows client or Windows Server The information below list the proxy and firewall configuration information required to communicate with Log Analytics agent (often referred to as Microsoft Monitoring Agent) for the previous versions of Windows such as Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, and Windows Server 2016. @@ -129,34 +140,41 @@ The information below list the proxy and firewall configuration information requ |------|---------|--------|--------| |*.ods.opinsights.azure.com |Port 443 |Outbound|Yes | |*.oms.opinsights.azure.com |Port 443 |Outbound|Yes | -|*.blob.core.windows.net |Port 443 |Outbound|Yes | +|*.blob.core.windows.net |Port 443 |Outbound|Yes | +|*.azure-automation.net |Port 443 |Outbound|Yes | -## Microsoft Defender ATP service backend IP range - -If your network devices don't support the URLs added to an "allow" list in the prior section, you can use the following information. - -Microsoft Defender ATP is built on Azure cloud, deployed in the following regions: - -- \+\ -- \+\ -- \+\ -- \+\ -- \+\ -- \+\ -- \+\ - -You can find the Azure IP range on [Microsoft Azure Datacenter IP Ranges](https://www.microsoft.com/en-us/download/details.aspx?id=41653). > [!NOTE] > As a cloud-based solution, the IP range can change. It's recommended you move to DNS resolving setting. +## Confirm Microsoft Monitoring Agent (MMA) Service URL Requirements + +Please see the following guidance to eliminate the wildcard (*) requirement for your specific environment when using the Microsoft Monitoring Agent (MMA) for previous versions of Windows. + +1. Onboard a previous operating system with the Microsoft Monitoring Agent (MMA) into Defender for Endpoint (for more information, see [Onboard previous versions of Windows on Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2010326) and [Onboard Windows servers](configure-server-endpoints.md#windows-server-2008-r2-sp1-windows-server-2012-r2-and-windows-server-2016). + +2. Ensure the machine is successfully reporting into the Microsoft Defender Security Center portal. + +3. Run the TestCloudConnection.exe tool from “C:\Program Files\Microsoft Monitoring Agent\Agent” to validate the connectivity and to see the required URLs for your specific workspace. + +4. Check the Microsoft Defender for Endpoint URLs list for the complete list of requirements for your region (please refer to the Service URLs [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)). + +![Image of administrator in Windows PowerShell](images/admin-powershell.png) + +The wildcards (*) used in *.ods.opinsights.azure.com, *.oms.opinsights.azure.com, and *.agentsvc.azure-automation.net URL endpoints can be replaced with your specific Workspace ID. The Workspace ID is specific to your environment and workspace and can be found in the Onboarding section of your tenant within the Microsoft Defender Security Center portal. + +The *.blob.core.windows.net URL endpoint can be replaced with the URLs shown in the “Firewall Rule: *.blob.core.windows.net” section of the test results. + +> [!NOTE] +> In the case of onboarding via Azure Security Center (ASC), multiple workspaces maybe used. You will need to perform the TestCloudConnection.exe procedure above on an onboarded machine from each workspace (to determine if there are any changes to the *.blob.core.windows.net URLs between the workspaces). + ## Verify client connectivity to Microsoft Defender ATP service URLs -Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Microsoft Defender ATP service URLs. +Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Defender for Endpoint service URLs. -1. Download the [MDATP Client Analyzer tool](https://aka.ms/mdatpanalyzer) to the PC where Microsoft Defender ATP sensor is running on. +1. Download the [MDATP Client Analyzer tool](https://aka.ms/mdatpanalyzer) to the PC where Defender for Endpoint sensor is running on. -2. Extract the contents of MDATPClientAnalyzer.zip on the machine. +2. Extract the contents of MDATPClientAnalyzer.zip on the device. 3. Open an elevated command-line: @@ -179,7 +197,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 5. Extract the *MDATPClientAnalyzerResult.zip* file created by tool in the folder used in the *HardDrivePath*. 6. Open *MDATPClientAnalyzerResult.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.

    - The tool checks the connectivity of Microsoft Defender ATP service URLs that Microsoft Defender ATP client is configured to interact with. It then prints the results into the *MDATPClientAnalyzerResult.txt* file for each URL that can potentially be used to communicate with the Microsoft Defender ATP services. For example: + The tool checks the connectivity of Defender for Endpoint service URLs that Defender for Endpoint client is configured to interact with. It then prints the results into the *MDATPClientAnalyzerResult.txt* file for each URL that can potentially be used to communicate with the Defender for Endpoint services. For example: ```text Testing URL : https://xxx.microsoft.com/xxx @@ -190,15 +208,18 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 5 - Command line proxy: Doesn't exist ``` -If at least one of the connectivity options returns a (200) status, then the Microsoft Defender ATP client can communicate with the tested URL properly using this connectivity method.

    +If at least one of the connectivity options returns a (200) status, then the Defender for Endpoint client can communicate with the tested URL properly using this connectivity method.

    -However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure. +However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Defender for Endpoint service URLs in the proxy server](#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure. > [!NOTE] > The Connectivity Analyzer tool is not compatible with ASR rule [Block process creations originating from PSExec and WMI commands](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction#attack-surface-reduction-rules). You will need to temporarily disable this rule to run the connectivity tool. -> When the TelemetryProxyServer is set, in Registry or via Group Policy, Microsoft Defender ATP will fall back to direct if it can't access the defined proxy. + + +> [!NOTE] +> When the TelemetryProxyServer is set, in Registry or via Group Policy, Defender for Endpoint will fall back to direct if it can't access the defined proxy. ## Related topics -- [Onboard Windows 10 machines](configure-endpoints.md) -- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) +- [Onboard Windows 10 devices](configure-endpoints.md) +- [Troubleshoot Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index a2550f9980..e049362584 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -1,10 +1,10 @@ --- -title: Onboard servers to the Microsoft Defender ATP service -description: Onboard servers so that they can send sensor data to the Microsoft Defender ATP sensor. -keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, machine management, configure Windows ATP servers, onboard Microsoft Defender Advanced Threat Protection servers +title: Onboard Windows servers to the Microsoft Defender for Endpoint service +description: Onboard Windows servers so that they can send sensor data to the Microsoft Defender for Endpoint sensor. +keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, device management, configure Windows ATP servers, onboard Microsoft Defender Advanced Threat Protection servers, onboard Microsoft Defender for Endpoint servers search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,235 +13,274 @@ ms.author: macapara ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- -# Onboard servers to the Microsoft Defender ATP service +# Onboard Windows servers to the Microsoft Defender for Endpoint service + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** - Windows Server 2008 R2 SP1 - Windows Server 2012 R2 - Windows Server 2016 -- Windows Server, version 1803 -- Windows Server, 2019 and later -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink) - - -Microsoft Defender ATP extends support to also include the Windows Server operating system. This support provides advanced attack detection and investigation capabilities seamlessly through the Microsoft Defender Security Center console. - -The service supports the onboarding of the following servers: -- Windows Server 2008 R2 SP1 -- Windows Server 2012 R2 -- Windows Server 2016 -- Windows Server, version 1803 +- Windows Server (SAC) version 1803 and later - Windows Server 2019 and later +- Windows Server 2019 core edition +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128). +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink) -## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016 +Defender for Endpoint extends support to also include the Windows Server operating system. This support provides advanced attack detection and investigation capabilities seamlessly through the Microsoft Defender Security Center console. -There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP: +For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Defender for Endpoint](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128). + +For guidance on how to download and use Windows Security Baselines for Windows servers, see [Windows Security Baselines](https://docs.microsoft.com/windows/device-security/windows-security-baselines). + +
    + +## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016 + +You can onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016 to Defender for Endpoint by using any of the following options: + +- **Option 1**: [Onboard by installing and configuring Microsoft Monitoring Agent (MMA)](#option-1-onboard-by-installing-and-configuring-microsoft-monitoring-agent-mma) +- **Option 2**: [Onboard through Azure Security Center](#option-2-onboard-windows-servers-through-azure-security-center) +- **Option 3**: [Onboard through Microsoft Endpoint Manager version 2002 and later](#option-3-onboard-windows-servers-through-microsoft-endpoint-manager-version-2002-and-later) + + +After completing the onboarding steps using any of the provided options, you'll need to [Configure and update System Center Endpoint Protection clients](#configure-and-update-system-center-endpoint-protection-clients). -- **Option 1**: Onboard through Microsoft Defender Security Center -- **Option 2**: Onboard through Azure Security Center > [!NOTE] -> Microsoft defender ATP standalone server license is required, per node, in order to onboard the server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). +> Defender for Endpoint standalone server license is required, per node, in order to onboard a Windows server through Microsoft Monitoring Agent (Option 1), or through Microsoft Endpoint Manager (Option 3). Alternatively, an Azure Defender for Servers license is required, per node, in order to onboard a Windows server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services). -### Option 1: Onboard servers through Microsoft Defender Security Center -You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center. +### Option 1: Onboard by installing and configuring Microsoft Monitoring Agent (MMA) +You'll need to install and configure MMA for Windows servers to report sensor data to Defender for Endpoint. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). -- For Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements: - - Install the [February monthly update rollup](https://support.microsoft.com/en-us/help/4074598/windows-7-update-kb4074598) - - Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/en-us/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) - - Install either [.NET framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework) +If you're already using System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Defender for Endpoint workspace through Multihoming support. - -- For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients. - -> [!NOTE] -> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2. - -- Turn on server monitoring from Microsoft Defender Security Center. -- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). +In general, you'll need to take the following steps: +1. Fulfill the onboarding requirements outlined in **Before you begin** section. +2. Turn on server monitoring from Microsoft Defender Security center. +3. Install and configure MMA for the server to report sensor data to Defender for Endpoint. +4. Configure and update System Center Endpoint Protection clients. > [!TIP] -> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md). - -### Configure and update System Center Endpoint Protection clients -> [!IMPORTANT] -> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2. - -Microsoft Defender ATP integrates with System Center Endpoint Protection. The integration provides visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware. - -The following steps are required to enable this integration: -- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie) -- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting +> After onboarding the device, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Defender for Endpoint endpoint](run-detection-test.md). -### Turn on Server monitoring from the Microsoft Defender Security Center portal +#### Before you begin +Perform the following steps to fulfill the onboarding requirements: -1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. + - For Windows Server 2008 R2 SP1 or Windows Server 2012 R2, ensure that you install the following hotfix: + - [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) + + - In addition, for Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements: + - Install the [February monthly update rollup](https://support.microsoft.com/help/4074598/windows-7-update-kb4074598) + - Install either [.NET framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework) + + - For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: [Configure and update System Center Endpoint Protection clients](#configure-and-update-system-center-endpoint-protection-clients). + + > [!NOTE] + > This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2. -2. Select Windows Server 2012 R2 and 2016 as the operating system. - -3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment setup. When the setup completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent. -### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP +### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender for Endpoint 1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603). -2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server: - - [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup)
    +2. Using the Workspace ID and Workspace key obtained in the previous procedure, choose any of the following installation methods to install the agent on the Windows server: + - [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-agent-using-setup-wizard).
    On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**. - - [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script). + - [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-agent-using-command-line). + - [Configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-agent-using-dsc-in-azure-automation). -3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](configure-proxy-internet.md). +> [!NOTE] +> If you are a [US Government customer](gov.md), under "Azure Cloud" you'll need to choose "Azure US Government" if using the setup wizard, or if using a command line or a script - set the "OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE" parameter to 1. -Once completed, you should see onboarded servers in the portal within an hour. -### Configure server proxy and Internet connectivity settings - -- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the OMS Gateway. -- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that you [enable access to Microsoft Defender ATP service URLs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). +### Configure Windows server proxy and Internet connectivity settings if needed +If your servers need to use a proxy to communicate with Defender for Endpoint, use one of the following methods to configure the MMA to use the proxy server: +- [Configure the MMA to use a proxy server](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#install-agent-using-setup-wizard) -### Option 2: Onboard servers through Azure Security Center -1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**. +- [Configure Windows to use a proxy server for all connections](configure-proxy-internet.md) -2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system. +If a proxy or firewall is in use, please ensure that servers can access all of the Microsoft Defender for Endpoint service URLs directly and without SSL interception. For more information, see [enable access to Defender for Endpoint service URLs](configure-proxy-internet.md#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server). Use of SSL interception will prevent the system from communicating with the Defender for Endpoint service. -3. Click **Onboard Servers in Azure Security Center**. +Once completed, you should see onboarded Windows servers in the portal within an hour. -4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). +### Option 2: Onboard Windows servers through Azure Security Center +1. In the Microsoft Defender Security Center navigation pane, select **Settings** > **Device management** > **Onboarding**. +2. Select **Windows Server 2008 R2 SP1, 2012 R2 and 2016** as the operating system. +3. Click **Onboard Servers in Azure Security Center**. -## Windows Server, version 1803 and Windows Server 2019 -To onboard Windows Server, version 1803 or Windows Server 2019, refer to the supported methods and versions below. +4. Follow the onboarding instructions in [Microsoft Defender for Endpoint with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp). + +After completing the onboarding steps, you'll need to [Configure and update System Center Endpoint Protection clients](#configure-and-update-system-center-endpoint-protection-clients). > [!NOTE] -> The Onboarding package for Windows Server 2019 through Microsoft Endpoint Configuration Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs). +> - For onboarding via Azure Defender for Servers (previously Azure Security Center Standard Edition) to work as expected, the server must have an appropriate workspace and key configured within the Microsoft Monitoring Agent (MMA) settings. +> - Once configured, the appropriate cloud management pack is deployed on the machine and the sensor process (MsSenseS.exe) will be deployed and started. +> - This is also required if the server is configured to use an OMS Gateway server as proxy. -Supported tools include: -- Local script -- Group Policy -- Microsoft Endpoint Configuration Manager -- System Center Configuration Manager 2012 / 2012 R2 1511 / 1602 -- VDI onboarding scripts for non-persistent machines +### Option 3: Onboard Windows servers through Microsoft Endpoint Manager version 2002 and later +You can onboard Windows Server 2012 R2 and Windows Server 2016 by using Microsoft Endpoint Manager version 2002 and later. For more information, see [Microsoft Defender for Endpoint + in Microsoft Endpoint Manager current branch](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection). -For more information, see [Onboard Windows 10 machines](configure-endpoints.md). +After completing the onboarding steps, you'll need to [Configure and update System Center Endpoint Protection clients](#configure-and-update-system-center-endpoint-protection-clients). -Support for Windows Server, provide deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well. +
    -1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints.md). +## Windows Server (SAC) version 1803, Windows Server 2019, and Windows Server 2019 Core edition +You can onboard Windows Server (SAC) version 1803, Windows Server 2019, or Windows Server 2019 Core edition by using the following deployment methods: -2. If you're running a third-party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings. Verify that it was configured correctly: +- [Local script](configure-endpoints-script.md) +- [Group Policy](configure-endpoints-gp.md) +- [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) +- [System Center Configuration Manager 2012 / 2012 R2 1511 / 1602](configure-endpoints-sccm.md#onboard-devices-using-system-center-configuration-manager) +- [VDI onboarding scripts for non-persistent devices](configure-endpoints-vdi.md) - a. Set the following registry entry: +> [!NOTE] +> - The Onboarding package for Windows Server 2019 through Microsoft Endpoint Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs). +> - A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. + +Support for Windows Server provides deeper insight into server activities, coverage for kernel and memory attack detection, and enables response actions. + +1. Configure Defender for Endpoint onboarding settings on the Windows server using the same tools and methods for Windows 10 devices. For more information, see [Onboard Windows 10 devices](configure-endpoints.md). + +2. If you're running a third-party antimalware solution, you'll need to apply the following Microsoft Defender AV passive mode settings. Verify that it was configured correctly: + + 1. Set the following registry entry: - Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` - Name: ForceDefenderPassiveMode + - Type: REG_DWORD - Value: 1 - b. Run the following PowerShell command to verify that the passive mode was configured: + 1. Run the following PowerShell command to verify that the passive mode was configured: - ```PowerShell - Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84} - ``` + ```PowerShell + Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84} + ``` - c. Confirm that a recent event containing the passive mode event is found: - - ![Image of passive mode verification result](images/atp-verify-passive-mode.png) + 1. Confirm that a recent event containing the passive mode event is found: -3. Run the following command to check if Windows Defender AV is installed: + ![Image of passive mode verification result](images/atp-verify-passive-mode.png) - ```sc query Windefend``` +3. Run the following command to check if Microsoft Defender AV is installed: - If the result is 'The specified service does not exist as an installed service', then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10). + ```sc.exe query Windefend``` + If the result is 'The specified service doesn't exist as an installed service', then you'll need to install Microsoft Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). + + For information on how to use Group Policy to configure and manage Microsoft Defender Antivirus on your Windows servers, see [Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus). + +
    ## Integration with Azure Security Center -Microsoft Defender ATP can integrate with Azure Security Center to provide a comprehensive server protection solution. With this integration, Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers. +Defender for Endpoint can integrate with Azure Security Center to provide a comprehensive Windows server protection solution. With this integration, Azure Security Center can use the power of Defender for Endpoint to provide improved threat detection for Windows Servers. The following capabilities are included in this integration: -- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding). +- Automated onboarding - Defender for Endpoint sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding). > [!NOTE] > Automated onboarding is only applicable for Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016. -- Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console. -- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach +- Windows servers monitored by Azure Security Center will also be available in Defender for Endpoint - Azure Security Center seamlessly connects to the Defender for Endpoint tenant, providing a single view across clients and servers. In addition, Defender for Endpoint alerts will be available in the Azure Security Center console. +- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach. > [!IMPORTANT] -> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default. -> - If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time. +> - When you use Azure Security Center to monitor servers, a Defender for Endpoint tenant is automatically created (in the US for US users, in the EU for European and UK users).
    +Data collected by Defender for Endpoint is stored in the geo-location of the tenant as identified during provisioning. +> - If you use Defender for Endpoint before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time. +> - Once configured, you cannot change the location where your data is stored. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant.
    +Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers. +
    +## Configure and update System Center Endpoint Protection clients -## Offboard servers -You can offboard Windows Server, version 1803 and Windows 2019 in the same method available for Windows 10 client machines. +Defender for Endpoint integrates with System Center Endpoint Protection. The integration provides visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware. -For other server versions, you have two options to offboard servers from the service: +The following steps are required to enable this integration: +- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie). + +- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting. + +
    + +## Offboard Windows servers +You can offboard Windows Server (SAC), Windows Server 2019, and Windows Server 2019 Core edition in the same method available for Windows 10 client devices. + +For other Windows server versions, you have two options to offboard Windows servers from the service: - Uninstall the MMA agent -- Remove the Microsoft Defender ATP workspace configuration +- Remove the Defender for Endpoint workspace configuration > [!NOTE] -> Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months. +> Offboarding causes the Windows server to stop sending sensor data to the portal but data from the Windows server, including reference to any alerts it has had will be retained for up to 6 months. -### Uninstall servers by uninstalling the MMA agent -To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP. +### Uninstall Windows servers by uninstalling the MMA agent +To offboard the Windows server, you can uninstall the MMA agent from the Windows server or detach it from reporting to your Defender for Endpoint workspace. After offboarding the agent, the Windows server will no longer send sensor data to Defender for Endpoint. For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent). -### Remove the Microsoft Defender ATP workspace configuration -To offboard the server, you can use either of the following methods: +### Remove the Defender for Endpoint workspace configuration +To offboard the Windows server, you can use either of the following methods: -- Remove the Microsoft Defender ATP workspace configuration from the MMA agent +- Remove the Defender for Endpoint workspace configuration from the MMA agent - Run a PowerShell command to remove the configuration -#### Remove the Microsoft Defender ATP workspace configuration from the MMA agent +#### Remove the Defender for Endpoint workspace configuration from the MMA agent 1. In the **Microsoft Monitoring Agent Properties**, select the **Azure Log Analytics (OMS)** tab. -2. Select the Microsoft Defender ATP workspace, and click **Remove**. +2. Select the Defender for Endpoint workspace, and click **Remove**. - ![Image of Microsoft Monitoring Agen Properties](images/atp-mma.png) + ![Image of Microsoft Monitoring Agent Properties](images/atp-mma.png) #### Run a PowerShell command to remove the configuration 1. Get your Workspace ID: - a. In the navigation pane, select **Settings** > **Onboarding**. - b. Select **Windows Server 2012 R2 and 2016** as the operating system and get your Workspace ID: - - ![Image of server onboarding](images/atp-server-offboarding-workspaceid.png) + 1. In the navigation pane, select **Settings** > **Onboarding**. + + 1. Select **Windows Server 2008 R2 SP1, 2012 R2 and 2016** as the operating system and get your Workspace ID: + + ![Image of Windows server onboarding](images/atp-server-offboarding-workspaceid.png) 2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`: - ``` + ```powershell + $ErrorActionPreference = "SilentlyContinue" # Load agent scripting object $AgentCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg # Remove OMS Workspace - $AgentCfg.RemoveCloudWorkspace($WorkspaceID) + $AgentCfg.RemoveCloudWorkspace("WorkspaceID") # Reload the configuration and apply changes $AgentCfg.ReloadConfiguration() + ``` +
    + ## Related topics -- [Onboard Windows 10 machines](configure-endpoints.md) -- [Onboard non-Windows machines](configure-endpoints-non-windows.md) +- [Onboard Windows 10 devices](configure-endpoints.md) +- [Onboard non-Windows devices](configure-endpoints-non-windows.md) - [Configure proxy and Internet connectivity settings](configure-proxy-internet.md) -- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test.md) -- [Troubleshooting Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) +- [Run a detection test on a newly onboarded Defender for Endpoint device](run-detection-test.md) +- [Troubleshooting Microsoft Defender for Endpoint onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md index ad965c75e5..7597959e7f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md @@ -4,7 +4,7 @@ description: Learn how to use REST API and configure supported security informat keywords: configure siem, security information and events management tools, splunk, arcsight, custom indicators, rest api, alert definitions, indicators of compromise search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,45 +13,45 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Pull detections to your SIEM tools +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) ## Pull detections using security information and events management (SIEM) tools ->[!Note] ->- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections ->- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. +>[!NOTE] +>- [Microsoft Defender for Endpoint Alert](alerts.md) is composed from one or more detections. +>- [Microsoft Defender for Endpoint Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Device and its related Alert details. +>-The Microsoft Defender for Endpoint Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md). -Microsoft Defender ATP supports security information and event management (SIEM) tools to pull detections. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment. +Defender for Endpoint supports security information and event management (SIEM) tools to pull detections. Defender for Endpoint exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment. +Defender for Endpoint currently supports the following specific SIEM solution tools through a dedicated SIEM integration model: -Microsoft Defender ATP currently supports the following SIEM tools: +- IBM QRadar +- Micro Focus ArcSight -- Splunk -- HP ArcSight +Other SIEM solutions (such as Splunk, RSA NetWitness) are supported through a different integration model based on the new Alert API. For more information, view the [Partner application](https://securitycenter.microsoft.com/interoperability/partners) page and select the Security Information and Analytics section for full details. -To use either of these supported SIEM tools you'll need to: +To use either of these supported SIEM tools, you'll need to: -- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) +- [Enable SIEM integration in Defender for Endpoint](enable-siem-integration.md) - Configure the supported SIEM tool: - - [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) - - [Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) + - [Configure HP ArcSight to pull Defender for Endpoint detections](configure-arcsight.md) + - Configure IBM QRadar to pull Defender for Endpoint detections For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/com.ibm.dsm.doc/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1). -For more information on the list of fields exposed in the Detection API see, [Microsoft Defender ATP Detection fields](api-portal-mapping.md). +For more information on the list of fields exposed in the Detection API see, [Defender for Endpoint Detection fields](api-portal-mapping.md). -## Pull Microsoft Defender ATP detections using REST API -Microsoft Defender ATP supports the OAuth 2.0 protocol to pull detections using REST API. - -For more information, see [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md). - diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md b/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md deleted file mode 100644 index 10c69301a9..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Configure Splunk to pull Microsoft Defender ATP detections -description: Configure Splunk to receive and pull detections from Microsoft Defender Security Center. -keywords: configure splunk, security information and events management tools, splunk -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Configure Splunk to pull Microsoft Defender ATP detections - -**Applies to:** - - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink) - -You'll need to configure Splunk so that it can pull Microsoft Defender ATP detections. - ->[!Note] ->- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections ->- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. - -## Before you begin - -- Install the open source [Windows Defender ATP Modular Inputs TA](https://splunkbase.splunk.com/app/4128/) in Splunk. -- Make sure you have enabled the **SIEM integration** feature from the **Settings** menu. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) - -- Have the details file you saved from enabling the **SIEM integration** feature ready. You'll need to get the following values: - - Tenant ID - - Client ID - - Client Secret - - Resource URL - - -## Configure Splunk - -1. Login in to Splunk. - -2. Go to **Settings** > **Data inputs**. - -3. Select **Windows Defender ATP alerts** under **Local inputs**. - - NOTE: - This input will only appear after you install the [Windows Defender ATP Modular Inputs TA](https://splunkbase.splunk.com/app/4128/). - -4. Click **New**. - -5. Type the following values in the required fields, then click **Save**: - - NOTE: - All other values in the form are optional and can be left blank. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldValue
    NameName for the Data Input
    Login URLURL to authenticate the azure app (Default : https://login.microsoftonline.com)
    EndpointDepending on the location of your datacenter, select any of the following URL:

    For EU: https://wdatp-alertexporter-eu.securitycenter.windows.com

    For US:https://wdatp-alertexporter-us.securitycenter.windows.com

    For UK:https://wdatp-alertexporter-uk.securitycenter.windows.com -
    Tenant IDAzure Tenant ID
    ResourceValue from the SIEM integration feature page
    Client IDValue from the SIEM integration feature page
    Client SecretValue from the SIEM integration feature page
    - -After completing these configuration steps, you can go to the Splunk dashboard and run queries. - -## View detections using Splunk solution explorer -Use the solution explorer to view detections in Splunk. - -1. In Splunk, go to **Settings** > **Searchers, reports, and alerts**. - -2. Select **New**. - -3. Enter the following details: - - Search: Enter a query, for example:
    - `sourcetype="wdatp:alerts" |spath|table*` - - App: Add-on for Windows Defender (TA_Windows-defender) - - Other values are optional and can be left with the default values. - -4. Click **Save**. The query is saved in the list of searches. - -5. Find the query you saved in the list and click **Run**. The results are displayed based on your query. - - ->[!TIP] -> To minimize Detection duplications, you can use the following query: ->```source="rest://wdatp:alerts" | spath | dedup _raw | table *``` - -## Related topics -- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) -- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) -- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) -- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-vulnerability-email-notifications.md b/windows/security/threat-protection/microsoft-defender-atp/configure-vulnerability-email-notifications.md new file mode 100644 index 0000000000..3a5a17455d --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-vulnerability-email-notifications.md @@ -0,0 +1,93 @@ +--- +title: Configure vulnerability email notifications in Microsoft Defender for Endpoint +description: Use Microsoft Defender for Endpoint to configure email notification settings for vulnerability events. +keywords: email notifications, configure alert notifications, microsoft defender atp notifications, microsoft defender atp alerts, windows 10 enterprise, windows 10 education +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: ellevin +author: levinec +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Configure vulnerability email notifications in Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-emailconfig-abovefoldlink) + +Configure Microsoft Defender for Endpoint to send email notifications to specified recipients for new vulnerability events. This feature enables you to identify a group of individuals who will immediately be informed and can act on the notifications based on the event. The vulnerability information comes from Defender for Endpoint's [threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) capability. + +> [!NOTE] +> Only users with 'Manage security settings' permissions can configure email notifications. If you've chosen to use basic permissions management, users with Security Administrator or Global Administrator roles can configure email notifications. [Learn more about permission options](user-roles.md) + +The notification rules allow you to set the vulnerability events that trigger notifications, and add or remove email notification recipients. New recipients get notified about vulnerabilities after they are added. + +If you're using role-based access control (RBAC), recipients will only receive notifications based on the device groups that were configured in the notification rule. +Users with the proper permission can only create, edit, or delete notifications that are limited to their device group management scope. Only users assigned to the Global administrator role can manage notification rules that are configured for all device groups. + +The email notification includes basic information about the vulnerability event. There are also links to filtered views in the threat and vulnerability management [Security recommendations](tvm-security-recommendation.md) and [Weaknesses](tvm-weaknesses.md) pages in the portal so you can further investigate. For example, you could get a list of all exposed devices or get additional details about the vulnerability. + +## Create rules for alert notifications + +Create a notification rule to send an email when there are certain exploit or vulnerability events, such as a new public exploit. For each rule, multiple event types can be selected. + +1. In the navigation pane, go to **Settings** > **Email notifications** > **Vulnerabilities**. + +2. Select **Add notification rule**. + +3. Name the email notification rule and include a description. + +4. Check **Notification enabled** to activate the notification. Select **Next** + +5. Fill in the notification settings. Then select **Next** + + - Choose device groups to get notifications for. + - Choose the vulnerability event(s) that you want to be notified about when they affect your organization. + - Options: new vulnerability found (including severity threshold), new public exploit, exploit added to an exploit kit, exploit was verified. + - Include organization name if you want the organization name in the email + +6. Enter the recipient email address then select **Add**. You can add multiple email addresses. + +7. Review the settings for the new email notification rule and select **Create rule** when you're ready to create it. + +## Edit a notification rule + +1. Select the notification rule you'd like to edit. + +2. Select the **Edit rule** button next to the pencil icon in the flyout. Make sure you have permission to edit or delete the rule. + +## Delete notification rule + +1. Select the notification rule you'd like to delete. + +2. Select the **Delete** button next to the trash can icon in the flyout. Make sure you have permission to edit or delete the rule. + +## Troubleshoot email notifications for alerts + +This section lists various issues that you may encounter when using email notifications for alerts. + +**Problem:** Intended recipients report they are not getting the notifications. + +**Solution:** Make sure that the notifications are not blocked by email filters: + +1. Check that the Defender for Endpoint email notifications are not sent to the Junk Email folder. Mark them as Not junk. +2. Check that your email security product is not blocking the email notifications from Defender for Endpoint. +3. Check your email application rules that might be catching and moving your Defender for Endpoint email notifications. + +## Related topics + +- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) +- [Security recommendations](tvm-security-recommendation.md) +- [Weaknesses](tvm-weaknesses.md) +- [Event timeline](threat-and-vuln-mgt-event-timeline.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md b/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md index 20a35409f5..081cd57903 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/connected-applications.md @@ -1,11 +1,11 @@ --- -title: Connected applications in Microsoft Defender ATP +title: Connected applications in Microsoft Defender ATP ms.reviewer: -description: View connected partner applications to Microsoft Defender ATP +description: View connected partner applications that use standard OAuth 2.0 protocol to authenticate and provide tokens for use with Microsoft Defender ATP APIs. keywords: partners, applications, third-party, connections, sentinelone, lookout, bitdefender, corrata, morphisec, paloalto, ziften, better mobile search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,18 +14,25 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- -# Connected applications in Microsoft Defender ATP +# Connected applications in Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -Connected applications integrates with the Microsoft Defender ATP platform using APIs. +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) -Applications use standard OAuth 2.0 protocol to authenticate and provide tokens for use with Microsoft Defender ATP APIs. In addition, Azure Active Directory (Azure AD) applications allow tenant admins to set explicit control over which APIs can be accessed using the corresponding app. +Connected applications integrates with the Defender for Endpoint platform using APIs. + +Applications use standard OAuth 2.0 protocol to authenticate and provide tokens for use with Microsoft Defender for Endpoint APIs. In addition, Azure Active Directory (Azure AD) applications allow tenant admins to set explicit control over which APIs can be accessed using the corresponding app. You'll need to follow [these steps](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/apis-intro) to use the APIs with the connected application. @@ -34,7 +41,7 @@ From the left navigation menu, select **Partners & APIs** > **Connected AAD appl ## View connected application details -The Connected applications page provides information about the Azure AD applications connected to Microsoft Defender ATP in your organization. You can review the usage of the connected applications: last seen, number of requests in the past 24 hours, and request trends in the last 30 days. +The Connected applications page provides information about the Azure AD applications connected to Microsoft Defender for Endpoint in your organization. You can review the usage of the connected applications: last seen, number of requests in the past 24 hours, and request trends in the last 30 days. ![Image of connected apps](images/connected-apps.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md b/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md new file mode 100644 index 0000000000..95f0488aa4 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md @@ -0,0 +1,45 @@ +--- +title: Contact Microsoft Defender for Endpoint support for US Government customers +description: Learn how to contact Microsoft Defender for Endpoint support for US Government customers +keywords: support, contact, premier support, solutions, problems, case, government, gcc, gcc-m, gcc-h, defender, endpoint, mdatp, mde +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ROBOTS: noindex,nofollow +ms.technology: mde +--- + +# Contact Microsoft Defender for Endpoint support for US Government customers + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) + +Defender for Endpoint has recently upgraded the support process to offer a more modern and advanced support experience. + +## Using the right portal +In order to open a support case, you will need to login to your Microsoft Defender for Endpoint portal: + +Environment | Portal URL +:---|:--- +GCC-M on Commercial | [https://securitycenter.microsoft.com](https://securitycenter.microsoft.com) +GCC-M | [https://gcc.securitycenter.microsoft.us](https://gcc.securitycenter.microsoft.us) +GCC-H | [https://securitycenter.microsoft.us](https://securitycenter.microsoft.us) +DoD | [https://securitycenter.microsoft.us](https://securitycenter.microsoft.us) + +If you are unable to login to the portal, you can also open a support case using the [phone](https://docs.microsoft.com/microsoft-365/admin/contact-support-for-business-products?view=o365-worldwide&tabs=phone&preserve-view=true). + +## Opening a support case +For prerequisites and instructions, see [Contact Microsoft Defender for Endpoint support](contact-support.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/contact-support.md b/windows/security/threat-protection/microsoft-defender-atp/contact-support.md new file mode 100644 index 0000000000..e79c0952b0 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/contact-support.md @@ -0,0 +1,94 @@ +--- +title: Contact Microsoft Defender ATP support +description: Learn how to contact Microsoft Defender ATP support +keywords: support, contact, premier support, solutions, problems, case +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.technology: mde +--- + +# Contact Microsoft Defender for Endpoint support + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +Defender for Endpoint has recently upgraded the support process to offer a more modern and advanced support experience. + +The new widget allows customers to: +- Find solutions to common problems +- Submit a support case to the Microsoft support team + +## Prerequisites +It's important to know the specific roles that have permission to open support cases. + +At a minimum, you must have a Service Support Administrator **OR** Helpdesk Administrator role. + + +For more information on which roles have permission see, [Security Administrator permissions](https://docs.microsoft.com/azure/active-directory/users-groups-roles/directory-assign-admin-roles#security-administrator-permissions). Roles that include the action `microsoft.office365.supportTickets/allEntities/allTasks` can submit a case. + +For general information on admin roles, see [About admin roles](https://docs.microsoft.com/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide&preserve-view=true). + + +## Access the widget +Accessing the new support widget can be done in one of two ways: + +1. Clicking on the question mark on the top right of the portal and then clicking on "Microsoft support": + + ![Image of widget when question mark is selected](images/support-widget.png) + +2. Clicking on the **Need help?** button in the bottom right of the Microsoft Defender Security Center: + + + ![Image of the need help button](images/need-help.png) + +In the widget you will be offered two options: + +- Find solutions to common problems +- Open a service request + +## Find solutions to common problems +This option includes articles that might be related to the question you may ask. Just start typing the question in the search box and articles related to your search will be surfaced. + +![Image of need help widget](images/Support3.png) + +In case the suggested articles are not sufficient, you can open a service request. + +## Open a service request + +Learn how to open support tickets by contacting Defender for Endpoint support. + + + + +### Contact support +This option is available by clicking the icon that looks like a headset. You will then get the following page to submit your support case: + +![Image of the open a service request widget](images/Support4.png) + +1. Fill in a title and description for the issue you are facing, as well as a phone number and email address where we may reach you. + +2. (Optional) Include up to five attachments that are relevant to the issue in order to provide additional context for the support case. + +3. Select your time zone and an alternative language, if applicable. The request will be sent to Microsoft Support Team. The team will respond to your service request shortly. + + +## Related topics +- [Troubleshoot service issues](troubleshoot-mdatp.md) +- [Check service health](service-status.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index 9cb8182798..c7281f84af 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -1,59 +1,95 @@ --- -title: Prevent ransomware and threats from encrypting and changing files -description: Files in default folders can be protected from being changed by malicious apps. This can help prevent ransomware from encrypting your files. +title: Protect important folders from ransomware from encrypting your files with controlled folder access +description: Files in default folders can be protected from being changed by malicious apps. Prevent ransomware from encrypting your files. keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -audience: ITPro author: denisebmsft ms.author: deniseb audience: ITPro -ms.date: 08/05/2019 +ms.date: 02/03/2021 ms.reviewer: v-maave manager: dansimp ms.custom: asr +ms.technology: mde --- # Protect important folders with controlled folder access +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) -Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It protects your data by checking against a list of known, trusted apps. Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients. It can be turned on via the Windows Security App, or from the Microsoft Endpoint Configuration Manager and Intune, for managed devices. Controlled folder access works best with [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). +## What is controlled folder access? -Controlled folder access works by only allowing apps to access protected folders if the app is included on a list of trusted software. If an app isn't on the list, Controlled folder access will block it from making changes to files inside protected folders. +Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Supported on Windows Server 2019 and Windows 10 clients, controlled folder access can be turned on using the Windows Security App, Microsoft Endpoint Configuration Manager, or Intune (for managed devices). -Apps are added to the trusted list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization, and that have never displayed any malicious behavior, are deemed trustworthy and automatically added to the list. +> [!NOTE] +> Scripting engines are not trusted and you cannot allow them access to controlled protected folders. For example, PowerShell is not trusted by controlled folder access, even if you add it as an application you trust or allow with [certificate and file indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates). -Apps can also be manually added to the trusted list via Configuration Manager and Intune. Additional actions, such as [adding a file indicator](../microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) for the app, can be performed from the Security Center Console. +Controlled folder access works best with [Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -Controlled folder access is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage. +> [!TIP] +> Controlled folder access blocks don't generate alerts in the [Alerts queue](../microsoft-defender-atp/alerts-queue.md). However, you can view information about controlled folder access blocks in the [device timeline view](../microsoft-defender-atp/investigate-machines.md), while using [advanced hunting](../microsoft-defender-atp/advanced-hunting-overview.md), or with [custom detection rules](../microsoft-defender-atp/custom-detection-rules.md). -With Controlled folder access in place, a notification will appear on the computer where the app attempted to make changes to a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors. +## How does controlled folder access work? -The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow or whitelist apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. +Controlled folder access works by only allowing trusted apps to access protected folders. Protected folders are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, and so on, are included in the list of controlled folders. -You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. +Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the list are prevented from making any changes to files inside protected folders. -Controlled folder access is supported on Windows 10, version 1709 and later and Windows Server 2019. +Apps are added to the list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization and that have never displayed any behavior deemed malicious are considered trustworthy. Those apps are added to the list automatically. -## Requirements +Apps can also be added manually to the trusted list by using Configuration Manager or Intune. Additional actions, such as [adding a file indicator](../microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) for an app, can be performed from the Security Center Console. -Controlled folder access requires enabling [Windows Defender Antivirus real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md). +## Why controlled folder access is important -## Review controlled folder access events in the Microsoft Defender ATP Security Center +Controlled folder access is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware). In a ransomware attack, your files can get encrypted and held hostage. With controlled folder access in place, a notification appears on the computer where an app attempted to make changes to a file in a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors. -Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). +The [protected folders](#review-controlled-folder-access-events-in-windows-event-viewer) include common system folders (including boot sectors), and you can [add more folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how controlled folder access settings would affect your environment if they were enabled. +You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. -Here is an example query +Controlled folder access is supported on the following versions of Windows: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) and later +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) + +## Windows system folders are protected by default + +Windows system folders are protected by default, along with several other folders: + +- `c:\Users\\Documents` +- `c:\Users\Public\Documents` +- `c:\Users\\Pictures` +- `c:\Users\Public\Pictures` +- `c:\Users\Public\Videos` +- `c:\Users\\Videos` +- `c:\Users\\Music` +- `c:\Users\Public\Music` +- `c:\Users\\Favorites` + +> [!NOTE] +> You can configure additional folders as protected, but you cannot remove the Windows system folders that are protected by default. + +## Requirements for controlled folder access + +Controlled folder access requires enabling [Microsoft Defender Antivirus real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md). + +## Review controlled folder access events in the Microsoft Defender Security Center + +Defender for Endpoint provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). + +You can query Microsoft Defender for Endpoint data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use [advanced hunting](advanced-hunting-overview.md) to see how controlled folder access settings would affect your environment if they were enabled. + +Example query: ```PowerShell DeviceEvents @@ -64,28 +100,37 @@ DeviceEvents You can review the Windows event log to see events that are created when controlled folder access blocks (or audits) an app: -1. Download the [Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine. - +1. Download the [Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the device. 2. Type **Event viewer** in the Start menu to open the Windows Event Viewer. - -3. On the left panel, under **Actions**, click **Import custom view...**. - +3. On the left panel, under **Actions**, select **Import custom view...**. 4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views.md). +5. Select **OK**. -5. Click **OK**. +The following table shows events related to controlled folder access: -This will create a custom view that filters to only show the following events related to controlled folder access: +|Event ID | Description | +|:---|:---| +|5007 | Event when settings are changed | +|1124 | Audited controlled folder access event | +|1123 | Blocked controlled folder access event | -Event ID | Description --|- -5007 | Event when settings are changed -1124 | Audited controlled folder access event -1123 | Blocked controlled folder access event +## View or change the list of protected folders -## In this section +You can use the Windows Security app to view the list of folders that are protected by controlled folder access. -Topic | Description --|- -[Evaluate controlled folder access](evaluate-controlled-folder-access.md) | Use a dedicated demo tool to see how controlled folder access works, and what events would typically be created. -[Enable controlled folder access](enable-controlled-folders.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage controlled folder access in your network -[Customize controlled folder access](customize-controlled-folders.md) | Add additional protected folders, and allow specified apps to access protected folders. +1. On your Windows 10 device, open the Windows Security app. +2. Select **Virus & threat protection**. +3. Under **Ransomware protection**, select **Manage ransomware protection**. +4. If controlled folder access is turned off, you'll need to turn it on. Select **protected folders**. +5. Do one of the following steps: + - To add a folder, select **+ Add a protected folder**. + - To remove a folder, select it, and then select **Remove**. + +> [!NOTE] +> [Windows system folders](#windows-system-folders-are-protected-by-default) are protected by default, and you cannot remove them from the list. + +## See also + +- [Evaluate controlled folder access](evaluate-controlled-folder-access.md) +- [Customize controlled folder access](customize-controlled-folders.md) +- [Protect more folders](customize-controlled-folders.md#protect-additional-folders) diff --git a/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md b/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md index 0a85cb240c..9ce4f58684 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md @@ -1,9 +1,9 @@ --- title: Create alert from event API -description: Creates an alert using event details +description: Learn how to use the Create alert API to create a new Alert on top of Event in Microsoft Defender Advanced Threat Protection. keywords: apis, graph api, supported apis, get, alert, information, id search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,23 +12,32 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Create alert API -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + +[!include[Improve request performance](../../includes/improve-request-performance.md)] ## API description Creates new [Alert](alerts.md) on top of **Event**. -
    **Microsoft Defender ATP Event** is required for the alert creation. +
    **Microsoft Defender for Endpoint Event** is required for the alert creation.
    You will need to supply 3 parameters from the Event in the request: **Event Time**, **Machine ID** and **Report ID**. See example below.
    You can use an event found in Advanced Hunting API or Portal. -
    If there existing an open alert on the same Machine with the same Title, the new created alert will be merged with it. +
    If there existing an open alert on the same Device with the same Title, the new created alert will be merged with it.
    An automatic investigation starts automatically on alerts created via the API. @@ -38,7 +47,7 @@ Creates new [Alert](alerts.md) on top of **Event**. ## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md) Permission type | Permission | Permission display name :---|:---|:--- @@ -48,12 +57,12 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' >[!Note] > When obtaining a token using user credentials: >- The user needs to have at least the following role permission: 'Alerts investigation' (See [Create and manage roles](user-roles.md) for more information) ->- The user needs to have access to the machine associated with the alert, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) +>- The user needs to have access to the device associated with the alert, based on device group settings (See [Create and manage device groups](machine-groups.md) for more information) ## HTTP request ``` -POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference +POST https://api.securitycenter.microsoft.com/api/alerts/CreateAlertByReference ``` ## Request headers @@ -71,7 +80,7 @@ Property | Type | Description :---|:---|:--- eventTime | DateTime(UTC) | The precise time of the event as string, as obtained from advanced hunting. e.g. ```2018-08-03T16:45:21.7115183Z``` **Required**. reportId | String | The reportId of the event, as obtained from advanced hunting. **Required**. -machineId | String | Id of the machine on which the event was identified. **Required**. +machineId | String | Id of the device on which the event was identified. **Required**. severity | String | Severity of the alert. The property values are: 'Low', 'Medium' and 'High'. **Required**. title | String | Title for the alert. **Required**. description | String | Description of the alert. **Required**. @@ -88,11 +97,10 @@ If successful, this method returns 200 OK, and a new [alert](alerts.md) object i Here is an example of the request. -[!include[Improve request performance](../../includes/improve-request-performance.md)] +```http +POST https://api.securitycenter.microsoft.com/api/alerts/CreateAlertByReference +``` -``` -POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference -``` ```json { "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index b2fc09e758..b4ddf74520 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -1,11 +1,11 @@ --- -title: Create and manage custom detection rules in Microsoft Defender ATP +title: Create custom detection rules in Microsoft Defender ATP ms.reviewer: -description: Learn how to create and manage custom detection rules based on advanced hunting queries +description: Learn how to create custom detection rules based on advanced hunting queries keywords: custom detections, create, manage, alerts, edit, run on demand, frequency, interval, detection rules, advanced hunting, hunt, query, response actions, mdatp, microsoft defender atp search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,31 +14,49 @@ author: lomayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.date: 09/20/2020 +ms.technology: mde --- +# Create custom detection rules + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -# Create and manage custom detection rules **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -Custom detection rules built from [Advanced hunting](advanced-hunting-overview.md) queries let you proactively monitor various events and system states, including suspected breach activity and misconfigured machines. You can set them to run at regular intervals, generating alerts and taking response actions whenever there are matches. +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +Custom detection rules built from [advanced hunting](advanced-hunting-overview.md) queries let you proactively monitor various events and system states, including suspected breach activity and misconfigured devices. You can set them to run at regular intervals, generating alerts and taking response actions whenever there are matches. + +Read this article to learn how to create new custom detection rules. Or [see viewing and managing existing rules](custom-detections-manage.md). > [!NOTE] -> To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. +> To create or manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. -## Create a custom detection rule -### 1. Prepare the query. +## 1. Prepare the query. -In Microsoft Defender Security Center, go to **Advanced hunting** and select an existing query or create a new query. When using an new query, run the query to identify errors and understand possible results. +In Microsoft Defender Security Center, go to **Advanced hunting** and select an existing query or create a new query. When using a new query, run the query to identify errors and understand possible results. -#### Required columns in the query results -To use a query for a custom detection rule, the query must return the `Timestamp`, `DeviceId`, and `ReportId` columns in the results. Simple queries, such as those that don't use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns. +>[!IMPORTANT] +>To prevent the service from returning too many alerts, each rule is limited to generating only 100 alerts whenever it runs. Before creating a rule, tweak your query to avoid alerting for normal, day-to-day activity. -There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by `DeviceId`, you can still return `Timestamp` and `ReportId` by getting them from the most recent event involving each machine. +### Required columns in the query results -The sample query below counts the number of unique machines (`DeviceId`) with antivirus detections and uses this count to find only the machines with more than five detections. To return the latest `Timestamp` and the corresponding `ReportId`, it uses the `summarize` operator with the `arg_max` function. +To use a query for a custom detection rule, the query must return the following columns: + +- `Timestamp` +- `DeviceId` +- `ReportId` + +Simple queries, such as those that don't use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns. + +There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by `DeviceId`, you can still return `Timestamp` and `ReportId` by getting them from the most recent event involving each device. + +The sample query below counts the number of unique devices (`DeviceId`) with antivirus detections and uses this to find only those devices with more than five detections. To return the latest `Timestamp` and the corresponding `ReportId`, it uses the `summarize` operator with the `arg_max` function. ```kusto DeviceEvents @@ -48,83 +66,87 @@ DeviceEvents | where count_ > 5 ``` -### 2. Create new rule and provide alert details. +> [!TIP] +> For better query performance, set a time filter that matches your intended run frequency for the rule. Since the least frequent run is every 24 hours, filtering for the past day will cover all new data. + +## 2. Create a new rule and provide alert details. With the query in the query editor, select **Create detection rule** and specify the following alert details: -- **Detection name** — name of the detection rule -- **Frequency** — interval for running the query and taking action. [See additional guidance below](#rule-frequency) -- **Alert title** — title displayed with alerts triggered by the rule -- **Severity** — potential risk of the component or activity identified by the rule. [Read about alert severities](alerts-queue.md#severity) -- **Category** — type of threat component or activity, if any. [Read about alert categories](alerts-queue.md#understanding-alert-categories) -- **Description** — more information about the component or activity identified by the rule -- **Recommended actions** — additional actions that responders might take in response to an alert +- **Detection name**—name of the detection rule +- **Frequency**—interval for running the query and taking action. [See additional guidance below](#rule-frequency) +- **Alert title**—title displayed with alerts triggered by the rule +- **Severity**—potential risk of the component or activity identified by the rule. [Read about alert severities](alerts-queue.md#severity) +- **Category**—type of threat component or activity, if any. [Read about alert categories](alerts-queue.md#understanding-alert-categories) +- **MITRE ATT&CK techniques**—one or more attack techniques identified by the rule as documented in the MITRE ATT&CK framework. This section is not available with certain alert categories, such as malware, ransomware, suspicious activity, and unwanted software +- **Description**—more information about the component or activity identified by the rule +- **Recommended actions**—additional actions that responders might take in response to an alert For more information about how alert details are displayed, [read about the alert queue](alerts-queue.md). -#### Rule frequency -When saved, a new or edited custom detection rule immediately runs and checks for matches from the past 30 days of data. The rule then runs again at fixed intervals and lookback durations based on the frequency you choose: +### Rule frequency -- **Every 24 hours** — runs every 24 hours, checking data from the past 30 days -- **Every 12 hours** — runs every 12 hours, checking data from the past 24 hours -- **Every 3 hours** — runs every 3 hours, checking data from the past 6 hours -- **Every hour** — runs hourly, checking data from the past 2 hours +When saved, a new custom detection rule immediately runs and checks for matches from the past 30 days of data. The rule then runs again at fixed intervals and lookback durations based on the frequency you choose: + +- **Every 24 hours**—runs every 24 hours, checking data from the past 30 days +- **Every 12 hours**—runs every 12 hours, checking data from the past 24 hours +- **Every 3 hours**—runs every 3 hours, checking data from the past 6 hours +- **Every hour**—runs hourly, checking data from the past 2 hours + +> [!TIP] +> Match the time filters in your query with the lookback duration. Results outside of the lookback duration are ignored. Select the frequency that matches how closely you want to monitor detections, and consider your organization's capacity to respond to the alerts. -### 3. Specify actions on files or machines. -Your custom detection rule can automatically take actions on files or machines that are returned by the query. +## 3. Choose the impacted entities. -#### Actions on machines -These actions are applied to machines in the `DeviceId` column of the query results: -- **Isolate machine** — applies full network isolation, preventing the machine from connecting to any application or service, except for the Microsoft Defender ATP service. [Learn more about machine isolation](respond-machine-alerts.md#isolate-machines-from-the-network) -- **Collect investigation package** — collects machine information in a ZIP file. [Learn more about the investigation package](respond-machine-alerts.md#collect-investigation-package-from-machines) -- **Run antivirus scan** — performs a full Windows Defender Antivirus scan on the machine -- **Initiate investigation** — initiates an [automated investigation](automated-investigations.md) on the machine +Identify the columns in your query results where you expect to find the main affected or impacted entity. For example, a query might return both device and user IDs. Identifying which of these columns represent the main impacted entity helps the service aggregate relevant alerts, correlate incidents, and target response actions. + +You can select only one column for each entity type. Columns that are not returned by your query can't be selected. + +## 4. Specify actions. + +Your custom detection rule can automatically take actions on files or devices that are returned by the query. + +### Actions on devices + +These actions are applied to devices in the `DeviceId` column of the query results: + +- **Isolate device**—applies full network isolation, preventing the device from connecting to any application or service, except for the Defender for Endpoint service. [Learn more about device isolation](respond-machine-alerts.md#isolate-devices-from-the-network) +- **Collect investigation package**—collects device information in a ZIP file. [Learn more about the investigation package](respond-machine-alerts.md#collect-investigation-package-from-devices) +- **Run antivirus scan**—performs a full Microsoft Defender Antivirus scan on the device +- **Initiate investigation**—starts an [automated investigation](automated-investigations.md) on the device +- **Restrict app execution**—sets restrictions on the device to allow only files that are signed with a Microsoft-issued certificate to run. [Learn more about restricting app execution](respond-machine-alerts.md#restrict-app-execution) + +### Actions on files -#### Actions on files These actions are applied to files in the `SHA1` or the `InitiatingProcessSHA1` column of the query results: -- **Allow/Block** — automatically adds the file to your [custom indicator list](manage-indicators.md) so that it is always allowed to run or blocked from running. You can set the scope of this action so that it is taken only on selected machine groups. This scope is independent of the scope of the rule. -- **Quarantine file** — deletes the file from its current location and places a copy in quarantine -### 4. Click **Create** to save and turn on the rule. -After reviewing the rule, click **Create** to save it. The custom detection rule immediately runs. It runs again based on configured frequency to check for matches, generate alerts, and take response actions. +- **Allow/Block**—automatically adds the file to your [custom indicator list](manage-indicators.md) so that it is always allowed to run or blocked from running. You can set the scope of this action so that it is taken only on selected device groups. This scope is independent of the scope of the rule. +- **Quarantine file**—deletes the file from its current location and places a copy in quarantine -## Manage existing custom detection rules -In **Settings** > **Custom detections**, you can view the list of existing custom detection rules, check their previous runs, and review the alerts they have triggered. You can also run a rule on demand and modify it. +### Actions on users -### View existing rules +- **Mark user as compromised**—sets the user's risk level to "high" in Azure Active Directory, triggering the corresponding [identity protection policies](https://docs.microsoft.com/azure/active-directory/identity-protection/overview-identity-protection#risk-levels). -To view all existing custom detection rules, navigate to **Settings** > **Custom detections**. The page lists all the rules with the following run information: +## 5. Set the rule scope. -- **Last run** — when a rule was last run to check for query matches and generate alerts -- **Last run status** — whether a rule ran successfully -- **Next run** — the next scheduled run -- **Status** — whether a rule has been turned on or off +Set the scope to specify which devices are covered by the rule: -### View rule details, modify rule, and run rule +- All devices +- Specific device groups -To view comprehensive information about a custom detection rule, select the name of rule from the list of rules in **Settings** > **Custom detections**. This opens a page about the custom detection rule with the following information: +Only data from devices in scope will be queried. Also, actions will be taken only on those devices. -- General information about the rule, including the details of the alert, run status, and scope -- List of triggered alerts -- List of triggered actions +## 6. Review and turn on the rule. -![Custom detection rule page](images/atp-custom-detection-rule-details.png)
    -*Custom detection rule page* +After reviewing the rule, select **Create** to save it. The custom detection rule immediately runs. It runs again based on configured frequency to check for matches, generate alerts, and take response actions. -You can also take the following actions on the rule from this page: +You can [view and manage custom detection rules](custom-detections-manage.md), check their previous runs, and review the alerts they have triggered. You can also run a rule on demand and modify it. -- **Run** — run the rule immediately. This also resets the interval for the next run. -- **Edit** — modify the rule without changing the query -- **Modify query** — edit the query in advanced hunting -- **Turn on** / **Turn off** — enable the rule or stop it from running -- **Delete** — turn off the rule and remove it +## Related topics ->[!TIP] ->To quickly view information and take action on an item in a table, use the selection column [✓] at the left of the table. - -## Related topic +- [View and manage custom detection rules](custom-detections-manage.md) - [Custom detections overview](overview-custom-detections.md) - [Advanced hunting overview](advanced-hunting-overview.md) - [Learn the advanced hunting query language](advanced-hunting-query-language.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detections-manage.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detections-manage.md new file mode 100644 index 0000000000..be445c4a3c --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detections-manage.md @@ -0,0 +1,74 @@ +--- +title: View and manage custom detection rules in Microsoft Defender ATP +ms.reviewer: +description: Learn how to view and manage custom detection rules +keywords: custom detections, view, manage, alerts, edit, run on demand, detection rules, advanced hunting, hunt, query, response actions, mdatp, microsoft defender atp +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: lomayor +author: lomayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.technology: mde +--- + + +# View and manage custom detection rules + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +Manage your existing [custom detection rules](custom-detection-rules.md) to ensure they are effectively finding threats and taking actions. Explore how to view the list of rules, check their previous runs, and review the alerts they have triggered. You can also run a rule on demand and modify it. + +## Required permissions + +To create or manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. + +## View existing rules + +To view all existing custom detection rules, navigate to **Settings** > **Custom detections**. The page lists all the rules with the following run information: + +- **Last run**—when a rule was last run to check for query matches and generate alerts +- **Last run status**—whether a rule ran successfully +- **Next run**—the next scheduled run +- **Status**—whether a rule has been turned on or off + +## View rule details, modify rule, and run rule + +To view comprehensive information about a custom detection rule, select the name of rule from the list of rules in **Settings** > **Custom detections**. A page about the selected rule displays the following information: + +- General information about the rule, including the details of the alert, run status, and scope +- List of triggered alerts +- List of triggered actions + +![Custom detection rule page](images/atp-custom-detection-rule-details.png)
    +*Custom detection rule page* + +You can also take the following actions on the rule from this page: + +- **Run**—run the rule immediately. This action also resets the interval for the next run. +- **Edit**—modify the rule without changing the query +- **Modify query**—edit the query in advanced hunting +- **Turn on** / **Turn off**—enable the rule or stop it from running +- **Delete**—turn off the rule and remove it + +>[!TIP] +>To quickly view information and take action on an item in a table, use the selection column [✓] at the left of the table. + +## Related topics +- [Custom detections overview](overview-custom-detections.md) +- [Create detection rules](custom-detection-rules.md) +- [Advanced hunting overview](advanced-hunting-overview.md) +- [View and organize alerts](alerts-queue.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md index 0786bb44f2..e82169852e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md @@ -1,50 +1,58 @@ --- -title: Configure how attack surface reduction rules work to fine-tune protection in your network -description: You can individually set rules in audit, block, or disabled modes, and add files and folders that should be excluded from ASR +title: Customize attack surface reduction rules +description: Individually set rules in audit, block, or disabled modes, and add files and folders that should be excluded from attack surface reduction rules keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, customize, configure, exclude search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: levinec ms.author: ellevin -ms.date: 05/13/2019 ms.reviewer: manager: dansimp +ms.technology: mde --- # Customize attack surface reduction rules -**Applies to:** +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) > [!IMPORTANT] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -Attack surface reduction rules help prevent software behaviors that are often abused to compromise your device or network. For example, an attacker might try to run an unsigned script off of a USB drive, or have a macro in an Office document make calls directly to the Win32 API. Attack surface reduction rules can constrain these kinds of risky behaviors and improve your organization's defensive posture. +[Attack surface reduction rules](enable-attack-surface-reduction.md) help prevent software behaviors that are often abused to compromise your device or network. For example, an attacker might try to run an unsigned script off of a USB drive, or have a macro in an Office document make calls directly to the Win32 API. Attack surface reduction rules can constrain these kinds of risky behaviors and improve your organization's defensive posture. Learn how to customize attack surface reduction rules by [excluding files and folders](#exclude-files-and-folders) or [adding custom text to the notification](#customize-the-notification) alert that appears on a user's computer. -Attack surface reduction rules are supported on Windows 10, versions 1709 and 1803 or later, Windows Server, version 1803 (Semi-Annual Channel) or later, and Windows Server 2019. You can use Group Policy, PowerShell, and MDM CSPs to configure these settings. +You can set attack surface reduction rules for devices running any of the following editions and versions of Windows: +- Windows 10 Pro, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later +- Windows 10 Enterprise, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later +- Windows Server, [version 1803 (Semi-Annual Channel)](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) or later +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +You can use Group Policy, PowerShell, and Mobile Device Management (MDM) configuration service providers (CSP) to configure these settings. ## Exclude files and folders -You can exclude files and folders from being evaluated by attack surface reduction rules. This means that even if an attack surface reduction rule detects that the file contains malicious behavior, the file will not be blocked from running. +You can choose to exclude files and folders from being evaluated by attack surface reduction rules. Once excluded, the file won't be blocked from running even if an attack surface reduction rule detects that the file contains malicious behavior. > [!WARNING] > This could potentially allow unsafe files to run and infect your devices. Excluding files or folders can severely reduce the protection provided by attack surface reduction rules. Files that would have been blocked by a rule will be allowed to run, and there will be no report or event recorded. -An exclusion applies to all rules that allow exclusions. You can specify an individual file, folder path, or the fully qualified domain name for a resource, but you cannot limit an exclusion to a specific rule. +An exclusion applies to all rules that allow exclusions. You can specify an individual file, folder path, or the fully qualified domain name for a resource. However, you cannot limit an exclusion to a specific rule. An exclusion is applied only when the excluded application or service starts. For example, if you add an exclusion for an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted. -Attack surface reduction supports environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). -If you are encountering problems with rules detecting files that you believe should not be detected, you should [use audit mode to test the rule](evaluate-attack-surface-reduction.md). +Attack surface reduction supports environment variables and wildcards. For information about using wildcards, see [use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). +If you are encountering problems with rules detecting files that you believe should not be detected, [use audit mode to test the rule](evaluate-attack-surface-reduction.md). Rule description | GUID -|-|- @@ -68,20 +76,20 @@ See the [attack surface reduction](attack-surface-reduction.md) topic for detail ### Use Group Policy to exclude files and folders -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. -3. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack surface reduction**. +3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Windows Defender Exploit Guard** > **Attack surface reduction**. -4. Double-click the **Exclude files and paths from Attack surface reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. +4. Double-click the **Exclude files and paths from Attack surface reduction Rules** setting and set the option to **Enabled**. Select **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. > [!WARNING] > Do not use quotes as they are not supported for either the **Value name** column or the **Value** column. ### Use PowerShell to exclude files and folders -1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and click **Run as administrator** +1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator** 2. Enter the following cmdlet: ```PowerShell @@ -99,7 +107,7 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusio ## Customize the notification -See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. +You can customize the notification for when a rule is triggered and blocks an app or file. See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) article. ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md index 3216d16b87..1517a11f36 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md @@ -1,84 +1,91 @@ --- -title: Add additional folders and apps to be protected -description: Add additional folders that should be protected by Controlled folder access, or whitelist apps that are incorrectly blocking changes to important files. -keywords: Controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, customize, add folder, add app, whitelist, add executable +title: Customize controlled folder access +description: Add other folders that should be protected by controlled folder access, or allow apps that are incorrectly blocking changes to important files. +keywords: Controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, customize, add folder, add app, allow, add executable search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: levinec -ms.author: ellevin -ms.date: 05/13/2019 -ms.reviewer: +author: denisebmsft +ms.author: deniseb +ms.reviewer: jcedola, dbodorin, vladiso, nixanm, anvascon manager: dansimp +ms.date: 01/06/2021 +ms.technology: mde --- # Customize controlled folder access +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) -Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients. -This topic describes how to customize the following settings of the controlled folder access feature with the Windows Security app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs): +Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on Windows Server 2019 and Windows 10 clients. -* [Add additional folders to be protected](#protect-additional-folders) -* [Add apps that should be allowed to access protected folders](#allow-specific-apps-to-make-changes-to-controlled-folders) +This article describes how to customize controlled folder access capabilities, and includes the following sections: -> [!WARNING] -> Controlled folder access monitors apps for activities that may be malicious. Sometimes it might block a legitimate app from making legitimate changes to your files. -> -> This may impact your organization's productivity, so you may want to consider running the feature in [audit mode](audit-windows-defender.md) to fully assess the feature's impact. +- [Protect additional folders](#protect-additional-folders) +- [Add apps that should be allowed to access protected folders](#allow-specific-apps-to-make-changes-to-controlled-folders) +- [Allow signed executable files to access protected folders](#allow-signed-executable-files-to-access-protected-folders) +- [Customize the notification](#customize-the-notification) + +> [!IMPORTANT] +> Controlled folder access monitors apps for activities that are detected as malicious. Sometimes, legitimate apps are blocked from making changes to your files. If controlled folder access impacts your organization's productivity, you might consider running this feature in [audit mode](audit-windows-defender.md) to fully assess the impact. ## Protect additional folders -Controlled folder access applies to a number of system folders and default locations, including folders such as Documents, Pictures, Movies, and Desktop. +Controlled folder access applies to many system folders and default locations, including folders such as **Documents**, **Pictures**, and **Movies**. You can add additional folders to be protected, but you cannot remove the default folders in the default list. -You can add additional folders to be protected, but you cannot remove the default folders in the default list. +Adding other folders to controlled folder access can be helpful for cases when you don't store files in the default Windows libraries, or you've changed the default location of your libraries. -Adding other folders to controlled folder access can be useful, for example, if you don't store files in the default Windows libraries or you've changed the location of the libraries away from the defaults. +You can also specify network shares and mapped drives. Environment variables and wildcards are supported. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). -You can also enter network shares and mapped drives. Environment variables and wildcards are supported. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). - -You can use the Windows Security app or Group Policy to add and remove additional protected folders. +You can use the Windows Security app, Group Policy, PowerShell cmdlets, or mobile device management configuration service providers to add and remove additional protected folders. ### Use the Windows Security app to protect additional folders -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for **Security**. -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Ransomware protection**: +2. Select **Virus & threat protection**, and then scroll down to the **Ransomware protection** section. -3. Under the **Controlled folder access** section, click **Protected folders** +3. Select **Manage ransomware protection** to open the **Ransomware protection** pane. -4. Click **Add a protected folder** and follow the prompts to add apps. +4. Under the **Controlled folder access** section, select **Protected folders**. + +5. Choose **Yes** on the **User Access Control** prompt. The **Protected folders** pane displays. + +4. Select **Add a protected folder** and follow the prompts to add folders. ### Use Group Policy to protect additional folders -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)?preserve=true), right-click the Group Policy Object you want to configure, and then and select **Edit**. -2. In the **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. -3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**. +3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**. -4. Double-click **Configured protected folders** and set the option to **Enabled**. Click **Show** and enter each folder. +4. Double-click **Configured protected folders** and set the option to **Enabled**. Select **Show** and enter each folder. ### Use PowerShell to protect additional folders -1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** +1. Type **PowerShell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator** + 2. Enter the following cmdlet: ```PowerShell Add-MpPreference -ControlledFolderAccessProtectedFolders "" ``` +3. Repeat step 2 until you have added all the folders you want to protect. Folders that are added are visible in the Windows Security app. -Continue to use `Add-MpPreference -ControlledFolderAccessProtectedFolders` to add more folders to the list. Folders added using this cmdlet will appear in the Windows Security app. - -![Screenshot of a PowerShell window with the cmdlet above entered](../images/cfa-allow-folder-ps.png) + ![Screenshot of a PowerShell window with the cmdlet above entered](../images/cfa-allow-folder-ps.png) > [!IMPORTANT] > Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. @@ -89,41 +96,40 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.m ## Allow specific apps to make changes to controlled folders -You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you're finding a particular app that you know and trust is being blocked by the controlled folder access feature. +You can specify if certain apps are always considered safe and give write access to files in protected folders. Allowing apps can be useful if a particular app you know and trust is being blocked by the controlled folder access feature. > [!IMPORTANT] -> By default, Windows adds apps that it considers friendly to the allowed list—apps added automatically by Windows are not recorded in the list shown in the Windows Security app or by using the associated PowerShell cmdlets. -> You shouldn't need to add most apps. Only add apps if they are being blocked and you can verify their trustworthiness. +> By default, Windows adds apps that are considered friendly to the allowed list. Such apps that are added automatically are not recorded in the list shown in the Windows Security app or by using the associated PowerShell cmdlets. You shouldn't need to add most apps. Only add apps if they are being blocked and you can verify their trustworthiness. -When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders - if the app (with the same name) is located in a different location, then it will not be added to the allow list and may be blocked by controlled folder access. +When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders. If the app (with the same name) is in a different location, it will not be added to the allow list and may be blocked by controlled folder access. -An allowed application or service only has write access to a controlled folder after it starts. For example, if you allow an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted. +An allowed application or service only has write access to a controlled folder after it starts. For example, an update service will continue to trigger events after it's allowed until it is stopped and restarted. ### Use the Windows Defender Security app to allow specific apps -1. Open the Windows Security by clicking the shield icon in the task bar or searching the start menu for **Defender**. +1. Open the Windows Security app by searching the start menu for **Security**. -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then click **Ransomware protection**. +2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then select **Manage ransomware protection**. -3. Under the **Controlled folder access** section, click **Allow an app through Controlled folder access** +3. Under the **Controlled folder access** section, select **Allow an app through Controlled folder access** -4. Click **Add an allowed app** and follow the prompts to add apps. +4. Select **Add an allowed app** and follow the prompts to add apps. ![Screenshot of how to add an allowed app button](../images/cfa-allow-app.png) ### Use Group Policy to allow specific apps -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management device, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)?preserve=true), right-click the Group Policy Object you want to configure and select **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. -3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**. +3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**. -4. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app. +4. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Select **Show** and enter each app. ### Use PowerShell to allow specific apps -1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and click **Run as administrator** +1. Type **PowerShell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator** 2. Enter the following cmdlet: ```PowerShell @@ -147,12 +153,16 @@ An allowed application or service only has write access to a controlled folder a Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders. +## Allow signed executable files to access protected folders + +Microsoft Defender for Endpoint certificate and file indicators can allow signed executable files to access protected folders. For implementation details, see [Create indicators based on certificates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates). + ## Customize the notification -See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. +For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Configure alert notifications in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications). -## Related topics +## See also -* [Protect important folders with controlled folder access](controlled-folders.md) -* [Enable controlled folder access](enable-controlled-folders.md) -* [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) +- [Protect important folders with controlled folder access](controlled-folders.md) +- [Enable controlled folder access](enable-controlled-folders.md) +- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md index 30dd08b49c..80c3c22418 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md @@ -1,35 +1,39 @@ --- -title: Enable or disable specific mitigations used by Exploit protection +title: Customize exploit protection keywords: Exploit protection, mitigations, enable, powershell, dep, cfg, emet, aslr -description: You can enable individual mitigations using the Windows Security app or PowerShell. You can also audit mitigations and export configurations. +description: You can enable or disable specific mitigations used by exploit protection using the Windows Security app or PowerShell. You can also audit mitigations and export configurations. search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: levinec ms.author: ellevin -ms.date: 03/26/2019 ms.reviewer: manager: dansimp +ms.technology: mde --- # Customize exploit protection -**Applies to:** +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) -* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. -You configure these settings using the Windows Security app on an individual machine, and then export the configuration as an XML file that you can deploy to other machines. You can use Group Policy to distribute the XML file to multiple devices at once. You can also configure the mitigations with PowerShell. +Configure these settings using the Windows Security app on an individual device. Then, export the configuration as an XML file so you can deploy to other devices. Use Group Policy to distribute the XML file to multiple devices at once. You can also configure the mitigations with PowerShell. -This topic lists each of the mitigations available in exploit protection, indicates whether the mitigation can be applied system-wide or to individual apps, and provides a brief description of how the mitigation works. +This article lists each of the mitigations available in exploit protection. It indicates whether the mitigation can be applied system-wide or to individual apps, and provides a brief description of how the mitigation works. -It also describes how to enable or configure the mitigations using Windows Security, PowerShell, and MDM CSPs. This is the first step in creating a configuration that you can deploy across your network. The next step involves [generating or exporting, importing, and deploying the configuration to multiple devices](import-export-exploit-protection-emet-xml.md). +It also describes how to enable or configure the mitigations using Windows Security, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). This is the first step in creating a configuration that you can deploy across your network. The next step involves [generating, exporting, importing, and deploying the configuration to multiple devices](import-export-exploit-protection-emet-xml.md). > [!WARNING] > Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](evaluate-exploit-protection.md) before deploying the configuration across a production environment or the rest of your network. @@ -38,52 +42,52 @@ It also describes how to enable or configure the mitigations using Windows Secur All mitigations can be configured for individual apps. Some mitigations can also be applied at the operating system level. -You can set each of the mitigations to on, off, or to their default value. Some mitigations have additional options, these are indicated in the description in the table. +You can set each of the mitigations on, off, or to their default value. Some mitigations have additional options that are indicated in the description in the table. Default values are always specified in brackets at the **Use default** option for each mitigation. In the following example, the default for Data Execution Prevention is "On". The **Use default** configuration for each of the mitigation settings indicates our recommendation for a base level of protection for everyday usage for home users. Enterprise deployments should consider the protection required for their individual needs and may need to modify configuration away from the defaults. -For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this topic. +For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this article. -Mitigation | Description | Can be applied to | Audit mode available --|-|-|- -Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Do not allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Validate stack integrity (StackPivot) | Ensures that the stack has not been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +| Mitigation | Description | Can be applied to | Audit mode available | +| ---------- | ----------- | ----------------- | -------------------- | +| Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | ![Check mark no](../images/svg/check-no.svg) | +| Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | ![Check mark yes](../images/svg/check-yes.svg)| +| Block remote images | Prevents loading of images from remote devices. | App-level only | ![Check mark no](../images/svg/check-no.svg | +| Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | !include[Check mark yes](../images/svg/check-yes.svg) | +| Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | ![Check mark no](../images/svg/check-no.svg) | +| Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Don't allow child processes | Prevents an app from creating child processes. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | +| Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | ![Check mark no](../images/svg/check-no.svg) | +| Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | ![Check mark no](../images/svg/check-no.svg) | +| Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | ![Check mark yes](../images/svg/check-yes.svg) | > [!IMPORTANT] > If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work: > > -> Enabled in **Program settings** | Enabled in **System settings** | Behavior -> -|-|- -> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** -> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** -> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** -> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option +> | Enabled in **Program settings** | Enabled in **System settings** | Behavior | +> | ------------------------------- | ------------------------------ | -------- | +> | ![Check mark yes](../images/svg/check-yes.svg) | ![Check mark no](../images/svg/check-no.svg) | As defined in **Program settings** | +> | ![Check mark yes](../images/svg/check-yes.svg) | ![Check mark yes](../images/svg/check-yes.svg) | As defined in **Program settings** | +> | ![Check mark no](../images/svg/check-no.svg) | ![Check mark yes](../images/svg/check-yes.svg) | As defined in **System settings** | +> | ![Check mark no](../images/svg/check-no.svg) | ![Check mark yes](../images/svg/check-yes.svg) | Default as defined in **Use default** option | > > > -> * **Example 1** +> * **Example 1** > > Mikael configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**. > @@ -107,47 +111,47 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi ### Configure system-level mitigations with the Windows Security app -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. +1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for **Defender**. -2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. +2. Select the **App & browser control** tile (or the app icon on the left menu bar) and then select **Exploit protection**. 3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here: * **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section * **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section * **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation - >[!NOTE] - >You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting. + > [!NOTE] + > You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting. - Changing some settings may require a restart. + Changing some settings may require a restart. 4. Repeat this for all the system-level mitigations you want to configure. 5. Go to the **Program settings** section and choose the app you want to apply mitigations to: - 1. If the app you want to configure is already listed, click it and then click **Edit** - 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: - * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. + 1. If the app you want to configure is already listed, select it and then select **Edit** + 2. If the app isn't listed, at the top of the list select **Add program to customize** and then choose how you want to add the app: + * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. -6. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, click the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. +6. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, select the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. -7. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration. +7. Repeat these steps for all the apps and mitigations you want to configure. Select **Apply** when you're done setting up your configuration. You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or continue on to configure app-specific mitigations. -Exporting the configuration as an XML file allows you to copy the configuration from one machine onto other machines. +Exporting the configuration as an XML file allows you to copy the configuration from one device onto other devices. ## PowerShell reference - You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets. +You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets. - The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply. +The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply. - >[!IMPORTANT] - >Any changes that are deployed to a machine through Group Policy will override the local configuration. When setting up an initial configuration, use a machine that will not have a Group Policy configuration applied to ensure your changes aren't overridden. +> [!IMPORTANT] +> Any changes that are deployed to a device through Group Policy will override the local configuration. When setting up an initial configuration, use a device that will not have a Group Policy configuration applied to ensure your changes aren't overridden. - You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app: +You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app: ```PowerShell Get-ProcessMitigation -Name processName.exe @@ -164,7 +168,7 @@ Get-ProcessMitigation -Name processName.exe Use `Set` to configure each mitigation in the following format: - ```PowerShell +```PowerShell Set-ProcessMitigation - - ,, ``` @@ -179,34 +183,34 @@ Where: * \: * The mitigation's cmdlet as defined in the [mitigation cmdlets table](#cmdlets-table) below, along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma. - For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command: +For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command: - ```PowerShell - Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation - ``` +```PowerShell +Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation +``` - > [!IMPORTANT] - > Separate each mitigation option with commas. +> [!IMPORTANT] +> Separate each mitigation option with commas. - If you wanted to apply DEP at the system level, you'd use the following command: +If you wanted to apply DEP at the system level, you'd use the following command: - ```PowerShell - Set-Processmitigation -System -Enable DEP - ``` +```PowerShell +Set-Processmitigation -System -Enable DEP +``` - To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app. +To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app. - If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example: +If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example: - ```PowerShell - Set-Processmitigation -Name test.exe -Remove -Disable DEP - ``` +```PowerShell +Set-Processmitigation -Name test.exe -Remove -Disable DEP +``` - You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below. +You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below. - For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used in the example above, you'd use the following command: +For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used previously, you'd use the following command: - ```PowerShell +```PowerShell Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode ``` @@ -218,29 +222,29 @@ This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that -Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet -- | - | - | - -Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available -Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available -Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available -Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available -Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available -Validate heap integrity | System and app-level | TerminateOnError | Audit not available -Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode -Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad -Block remote images | App-level only | BlockRemoteImages | Audit not available -Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly -Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned -Disable extension points | App-level only | ExtensionPoint | Audit not available -Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall -Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess -Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available -Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available -Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available -Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available -Validate handle usage | App-level only | StrictHandle | Audit not available -Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available -Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available +| Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet | +| ---------- | ---------- | ------------------ | ----------------- | +| Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available | +| Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available | +| Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available | +| Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available | +| Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available | +| Validate heap integrity | System and app-level | TerminateOnError | Audit not available | +| Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode | +| Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad | +| Block remote images | App-level only | BlockRemoteImages | Audit not available | +| Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly | +| Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned | +| Disable extension points | App-level only | ExtensionPoint | Audit not available | +| Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall | +| Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess | +| Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available\[2\] | +| Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available\[2\] | +| Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available\[2\] | +| Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available\[2\] | +| Validate handle usage | App-level only | StrictHandle | Audit not available | +| Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available | +| Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available\[2\] | \[1\]: Use the following format to enable EAF modules for dlls for a process: @@ -248,14 +252,15 @@ Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll ``` +\[2\]: Audit for this mitigation is not available via PowerShell cmdlets. + ## Customize the notification -See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. +For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center). -## Related topics +## See also: * [Protect devices from exploits](exploit-protection.md) -* [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection.md) * [Evaluate exploit protection](evaluate-exploit-protection.md) * [Enable exploit protection](enable-exploit-protection.md) * [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md index 9cc9cb48ba..5266ed304e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md @@ -1,10 +1,10 @@ --- -title: Verify data storage location and update data retention settings +title: Verify data storage location and update data retention settings description: Verify data storage location and update data retention settings for Microsoft Defender Advanced Threat Protection keywords: data, storage, settings, retention, update search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,20 +13,23 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- -# Verify data storage location and update data retention settings for Microsoft Defender ATP +# Verify data storage location and update data retention settings for Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-gensettings-abovefoldlink) - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-gensettings-abovefoldlink) - -During the onboarding process, a wizard takes you through the data storage and retention settings of Microsoft Defender ATP. +During the onboarding process, a wizard takes you through the data storage and retention settings of Defender for Endpoint. After completing the onboarding, you can verify your selection in the data retention settings page. @@ -49,6 +52,5 @@ You can verify the data location by navigating to **Settings** > **Data retentio ## Related topics - [Update data retention settings](data-retention-settings.md) -- [Configure alert notifications in Microsoft Defender ATP](configure-email-notifications.md) -- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports.md) +- [Configure alert notifications in Defender for Endpoint](configure-email-notifications.md) - [Configure advanced features](advanced-features.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy.md b/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy.md index f59264a083..6af0ae78d7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy.md @@ -1,10 +1,10 @@ --- -title: Microsoft Defender ATP data storage and privacy -description: Learn about how Microsoft Defender ATP handles privacy and data that it collects. -keywords: Microsoft Defender ATP data storage and privacy, storage, privacy, licensing, geolocation, data retention, data +title: Microsoft Defender for Endpoint data storage and privacy +description: Learn about how Microsoft Defender for Endpoint handles privacy and data that it collects. +keywords: Microsoft Defender for Endpoint, Microsoft Defender ATP, data storage and privacy, storage, privacy, licensing, geolocation, data retention, data search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,48 +13,56 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual +ms.technology: mde --- -# Microsoft Defender ATP data storage and privacy +# Microsoft Defender for Endpoint data storage and privacy + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) - -This section covers some of the most frequently asked questions regarding privacy and data handling for Microsoft Defender ATP. +This section covers some of the most frequently asked questions regarding privacy and data handling for Defender for Endpoint. > [!NOTE] -> This document explains the data storage and privacy details related to Microsoft Defender ATP. For more information related to Microsoft Defender ATP and other products and services like Windows Defender Antivirus and Windows 10, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576). See also [Windows 10 privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577) for more information. +> This document explains the data storage and privacy details related to Defender for Endpoint. For more information related to Defender for Endpoint and other products and services like Microsoft Defender Antivirus and Windows 10, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576). See also [Windows 10 privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577) for more information. -## What data does Microsoft Defender ATP collect? -Microsoft Defender ATP will collect and store information from your configured machines in a customer dedicated and segregated tenant specific to the service for administration, tracking, and reporting purposes. +## What data does Microsoft Defender for Endpoint collect? -Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version). +Microsoft Defender for Endpoint will collect and store information from your configured devices in a customer dedicated and segregated tenant specific to the service for administration, tracking, and reporting purposes. + +Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and device details (such as device identifiers, names, and the operating system version). Microsoft stores this data securely in Microsoft Azure and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://go.microsoft.com/fwlink/?linkid=827578). -This data enables Microsoft Defender ATP to: +This data enables Defender for Endpoint to: - Proactively identify indicators of attack (IOAs) in your organization - Generate alerts if a possible attack was detected -- Provide your security operations with a view into machines, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network. +- Provide your security operations with a view into devices, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network. Microsoft does not use your data for advertising. ## Data protection and encryption -The Microsoft Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure. +The Defender for Endpoint service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure. - -There are various aspects relevant to data protection that our service takes care of. Encryption is one of the most critical and it includes data encryption at rest, encryption in flight, and key management with Key Vault. For more information on other technologies used by the Microsoft Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/azure/security/security-azure-encryption-overview). +There are various aspects relevant to data protection that our service takes care of. Encryption is one of the most critical and it includes data encryption at rest, encryption in flight, and key management with Key Vault. For more information on other technologies used by the Defender for Endpoint service, see [Azure encryption overview](https://docs.microsoft.com/azure/security/security-azure-encryption-overview). In all scenarios, data is encrypted using 256-bit [AES encryption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) at the minimum. -## Do I have the flexibility to select where to store my data? +## Data storage location -When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States, or dedicated Azure Government data centers (soon to be in preview). Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in pseudonymized form may also be stored in the central storage and processing systems in the United States. +Defender for Endpoint operates in the Microsoft Azure datacenters in the European Union, the United Kingdom, or in the United States. Customer data collected by the service may be stored in: (a) the geo-location of the tenant as identified during provisioning or, (b) if Defender for Endpoint uses another Microsoft online service to process such data, the geolocation as defined by the data storage rules of that other online service. + +Customer data in pseudonymized form may also be stored in the central storage and processing systems in the United States. + +Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. ## Is my data isolated from other customer data? Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides. @@ -73,23 +81,22 @@ Access to data for services deployed in Microsoft Azure Government data centers ## Is data shared with other customers? -No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing, and which don’t contain any customer specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides. +No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing, and which don’t contain any customer-specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides. ## How long will Microsoft store my data? What is Microsoft’s data retention policy? **At service onboarding**
    -You can choose the data retention policy for your data. This determines how long Window Defender ATP will store your data. There’s a flexibility of choosing in the range of 1 month to six months to meet your company’s regulatory compliance needs. +You can choose the data retention policy for your data. This determines how long Window Defender for Endpoint will store your data. There’s a flexibility of choosing in the range of one month to six months to meet your company’s regulatory compliance needs. **At contract termination or expiration**
    Your data will be kept and will be available to you while the license is under grace period or suspended mode. At the end of this period, that data will be erased from Microsoft’s systems to make it unrecoverable, no later than 180 days from contract termination or expiration. ## Can Microsoft help us maintain regulatory compliance? -Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Microsoft Defender ATP services against their own legal and regulatory requirements. Microsoft Defender ATP is ISO 27001 certified and has a roadmap for obtaining national, regional and industry-specific certifications. -Microsoft Defender ATP for Government (soon to be in preview) is currently undergoing audit for achieving FedRAMP High accreditation as well as Provisional Authorization (PA) at Impact Levels 4 and 5. +Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Defender for Endpoint services against their own legal and regulatory requirements. Defender for Endpoint has achieved a number of certifications including ISO, SOC, FedRAMP High, and PCI and continues to pursue additional national, regional and industry-specific certifications. -By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run. +By providing customers with compliant, independently verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run. -For more information on the Microsoft Defender ATP ISO certification reports, see [Microsoft Trust Center](https://www.microsoft.com/trustcenter/compliance/iso-iec-27001). +For more information on the Defender for Endpoint certification reports, see [Microsoft Trust Center](https://servicetrust.microsoft.com/). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-datastorage-belowfoldlink) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-datastorage-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md b/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md index a8b1269d9c..e4d3704b11 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md @@ -1,10 +1,10 @@ --- -title: Windows Defender Antivirus compatibility with Microsoft Defender ATP -description: Learn about how Windows Defender works with Microsoft Defender ATP and how it functions when a third-party antimalware client is used. -keywords: windows defender compatibility, defender, windows defender atp +title: Microsoft Defender Antivirus compatibility with Defender for Endpoint +description: Learn about how Windows Defender works with Microsoft Defender for Endpoint and how it functions when a third-party antimalware client is used. +keywords: windows defender compatibility, defender, microsoft defender atp, defender for endpoint, antivirus, mde search.product: eADQiWindows 10XVcnh search.appverid: met150 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -13,34 +13,34 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 04/24/2018 +ms.technology: mde --- -# Windows Defender Antivirus compatibility with Microsoft Defender ATP +# Microsoft Defender Antivirus compatibility with Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] **Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) -- Windows Defender -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-defendercompat-abovefoldlink) - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-defendercompat-abovefoldlink) - -The Microsoft Defender Advanced Threat Protection agent depends on Windows Defender Antivirus for some capabilities such as file scanning. +The Microsoft Defender for Endpoint agent depends on Microsoft Defender Antivirus for some capabilities such as file scanning. >[!IMPORTANT] ->Microsoft Defender ATP does not adhere to the Windows Defender Antivirus Exclusions settings. +>Defender for Endpoint does not adhere to the Microsoft Defender Antivirus Exclusions settings. -You must configure Security intelligence updates on the Microsoft Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md). +You must configure Security intelligence updates on the Defender for Endpoint devices whether Microsoft Defender Antivirus is the active antimalware or not. For more information, see [Manage Microsoft Defender Antivirus updates and apply baselines](../microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md). -If an onboarded machine is protected by a third-party antimalware client, Windows Defender Antivirus on that endpoint will enter into passive mode. +If an onboarded device is protected by a third-party antimalware client, Microsoft Defender Antivirus on that endpoint will enter into passive mode. -Windows Defender Antivirus will continue to receive updates, and the *mspeng.exe* process will be listed as a running a service, but it will not perform scans and will not replace the running third-party antimalware client. +Microsoft Defender Antivirus will continue to receive updates, and the *mspeng.exe* process will be listed as a running a service, but it will not perform scans and will not replace the running third-party antimalware client. -The Windows Defender Antivirus interface will be disabled, and users on the machine will not be able to use Windows Defender Antivirus to perform on-demand scans or configure most options. +The Microsoft Defender Antivirus interface will be disabled, and users on the device will not be able to use Microsoft Defender Antivirus to perform on-demand scans or configure most options. -For more information, see the [Windows Defender Antivirus and Microsoft Defender ATP compatibility topic](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). +For more information, see the [Microsoft Defender Antivirus and Defender for Endpoint compatibility topic](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md new file mode 100644 index 0000000000..87dd461c37 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -0,0 +1,365 @@ +--- +title: Address false positives/negatives in Microsoft Defender for Endpoint +description: Learn how to handle false positives or false negatives in Microsoft Defender for Endpoint. +keywords: alert, exclusion, defender atp, false positive, false negative +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: m365-security +ms.technology: mde +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.date: 02/11/2021 +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- m365-security-compliance +- m365initiative-defender-endpoint +- m365solution-scenario +- m365scenario-fpfn +ms.topic: conceptual +ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs, yonghree, jcedola +ms.custom: FPFN +--- + +# Address false positives/negatives in Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806) + +In endpoint protection solutions, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, including [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection). + +![Definition of false positive and negatives in Windows Defender for Endpoints](images/false-positives-overview.png) + +Fortunately, steps can be taken to address and reduce these kinds of issues. If you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address them by using the following process: + +1. [Review and classify alerts](#part-1-review-and-classify-alerts) +2. [Review remediation actions that were taken](#part-2-review-remediation-actions) +3. [Review and define exclusions](#part-3-review-or-define-exclusions) +4. [Submit an entity for analysis](#part-4-submit-a-file-for-analysis) +5. [Review and adjust your threat protection settings](#part-5-review-and-adjust-your-threat-protection-settings) + +And, you can [get help if you still have issues with false positives/negatives](#still-need-help) after performing the tasks described in this article. + +![Steps to address false positives and negatives](images/false-positives-step-diagram.png) + +> [!NOTE] +> This article is intended as guidance for security operators and security administrators who are using [Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md). + +## Part 1: Review and classify alerts + +If you see an [alert](alerts.md) that was triggered because something was detected as malicious or suspicious that should not have been, you can suppress the alert for that entity. You can also suppress alerts that are not necessarily false positives, but are unimportant. We recommend that you classify alerts as well. + +Managing your alerts and classifying true/false positives helps to train your threat protection solution and can reduce the number of false positives or false negatives over time. Taking these steps also helps reduce noise in your security operations dashboard so that your security team can focus on higher priority work items. + +### Determine whether an alert is accurate + +Before you classify or suppress an alert, determine whether the alert is accurate, a false positive, or benign. + +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +2. In the navigation pane, choose **Alerts queue**. +3. Select an alert to more details about the alert. (See [Review alerts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/review-alerts).) +4. Depending on the alert status, take the steps described in the following table: + +| Alert status | What to do | +|:---|:---| +| The alert is accurate | Assign the alert, and then [investigate it](investigate-alerts.md) further. | +| The alert is a false positive | 1. [Classify the alert](#classify-an-alert) as a false positive.
    2. [Suppress the alert](#suppress-an-alert).
    3. [Create an indicator](#indicators-for-microsoft-defender-for-endpoint) for Microsoft Defender for Endpoint.
    4. [Submit a file to Microsoft for analysis](#part-4-submit-a-file-for-analysis). | +| The alert is accurate, but benign (unimportant) | [Classify the alert](#classify-an-alert) as a true positive, and then [suppress the alert](#suppress-an-alert). | + +### Classify an alert + +Alerts can be classified as false positives or true positives in the Microsoft Defender Security Center. Classifying alerts helps train Microsoft Defender for Endpoint so that, over time, you'll see more true alerts and fewer false alerts. + +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +2. Select **Alerts queue**, and then select an alert. +3. For the selected alert, select **Actions** > **Manage alert**. A flyout pane opens. +4. In the **Manage alert** section, select either **True alert** or **False alert**. (Use **False alert** to classify a false positive.) + +> [!TIP] +> For more information about suppressing alerts, see [Manage Microsoft Defender for Endpoint alerts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts). And, if your organization is using a security information and event management (SIEM) server, make sure to define a suppression rule there, too. + +### Suppress an alert + +If you have alerts that are either false positives or that are true positives but for unimportant events, you can suppress those alerts in the Microsoft Defender Security Center. Suppressing alerts helps reduce noise in your security operations dashboard. + +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +2. In the navigation pane, select **Alerts queue**. +3. Select an alert that you want to suppress to open its **Details** pane. +4. In the **Details** pane, choose the ellipsis (**...**), and then **Create a suppression rule**. +5. Specify all the settings for your suppression rule, and then choose **Save**. + +> [!TIP] +> Need help with suppression rules? See [Suppress an alert and create a new suppression rule](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts#suppress-an-alert-and-create-a-new-suppression-rule). + +## Part 2: Review remediation actions + +[Remediation actions](manage-auto-investigation.md#remediation-actions), such as sending a file to quarantine or stopping a process, are taken on entities (such as files) that are detected as threats. Several types of remediation actions occur automatically through automated investigation and Microsoft Defender Antivirus: +- Quarantine a file +- Remove a registry key +- Kill a process +- Stop a service +- Disable a driver +- Remove a scheduled task + +Other actions, such as starting an antivirus scan or collecting an investigation package, occur manually or through [Live Response](live-response.md). Actions taken through Live Response cannot be undone. + +After you have reviewed your alerts, your next step is to [review remediation actions](manage-auto-investigation.md). If any actions were taken as a result of false positives, you can undo most kinds of remediation actions. Specifically, you can: +- [Undo one action at a time](#undo-an-action); +- [Undo multiple actions at one time](#undo-multiple-actions-at-one-time); and +- [Remove a file from quarantine across multiple devices](#remove-a-file-from-quarantine-across-multiple-devices). + +When you're done reviewing and undoing actions that were taken as a result of false positives, proceed to [review or define exclusions](#part-3-review-or-define-exclusions). + +### Review completed actions + +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. +2. Select the **History** tab to view a list of actions that were taken. +3. Select an item to view more details about the remediation action that was taken. + +### Undo an action + +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. +2. On the **History** tab, select an action that you want to undo. +3. In the flyout pane, select **Undo**. If the action cannot be undone with this method, you will not see an **Undo** button. (To learn more, see [Undo completed actions](manage-auto-investigation.md#undo-completed-actions).) + +### Undo multiple actions at one time + +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. +2. On the **History** tab, select the actions that you want to undo. +3. In the pane on the right side of the screen, select **Undo**. + +### Remove a file from quarantine across multiple devices + +> [!div class="mx-imgBorder"] +> ![Quarantine file](images/autoir-quarantine-file-1.png) + +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. +2. On the **History** tab, select a file that has the Action type **Quarantine file**. +3. In the pane on the right side of the screen, select **Apply to X more instances of this file**, and then select **Undo**. + +## Part 3: Review or define exclusions + +An exclusion is an entity, such as a file or URL, that you specify as an exception to remediation actions. The excluded entity can still get detected, but no remediation actions are taken on that entity. That is, the detected file or process won’t be stopped, sent to quarantine, removed, or otherwise changed by Microsoft Defender for Endpoint. + +To define exclusions across Microsoft Defender for Endpoint, perform the following tasks: +- [Define exclusions for Microsoft Defender Antivirus](#exclusions-for-microsoft-defender-antivirus) +- [Create “allow” indicators for Microsoft Defender for Endpoint](#indicators-for-microsoft-defender-for-endpoint) + +> [!NOTE] +> Microsoft Defender Antivirus exclusions apply only to antivirus protection, not across other Microsoft Defender for Endpoint capabilities. To exclude files broadly, use exclusions for Microsoft Defender Antivirus and [custom indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators) for Microsoft Defender for Endpoint. + +The procedures in this section describe how to define exclusions and indicators. + +### Exclusions for Microsoft Defender Antivirus + +In general, you should not need to define exclusions for Microsoft Defender Antivirus. Make sure that you define exclusions sparingly, and that you only include the files, folders, processes, and process-opened files that are resulting in false positives. In addition, make sure to review your defined exclusions regularly. We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) to define or edit your antivirus exclusions; however, you can use other methods, such as [Group Policy](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) (see [Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md)). + +> [!TIP] +> Need help with antivirus exclusions? See [Configure and validate exclusions for Microsoft Defender Antivirus scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus). + +#### Use Microsoft Endpoint Manager to manage antivirus exclusions (for existing policies) + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. +2. Choose **Endpoint security** > **Antivirus**, and then select an existing policy. (If you don’t have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-microsoft-endpoint-manager-to-create-a-new-antivirus-policy-with-exclusions)). +3. Choose **Properties**, and next to **Configuration settings**, choose **Edit**. +4. Expand **Microsoft Defender Antivirus Exclusions** and then specify your exclusions. +5. Choose **Review + save**, and then choose **Save**. + +#### Use Microsoft Endpoint Manager to create a new antivirus policy with exclusions + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. +2. Choose **Endpoint security** > **Antivirus** > **+ Create Policy**. +3. Select a platform (such as **Windows 10 and later**, **macOS**, or **Windows 10 and Windows Server**). +4. For **Profile**, select **Microsoft Defender Antivirus exclusions**, and then choose **Create**. +5. Specify a name and description for the profile, and then choose **Next**. +6. On the **Configuration settings** tab, specify your antivirus exclusions, and then choose **Next**. +7. On the **Scope tags** tab, if you are using scope tags in your organization, specify scope tags for the policy you are creating. (See [Scope tags](https://docs.microsoft.com/mem/intune/fundamentals/scope-tags).) +8. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/device-profile-assign).) +9. On the **Review + create** tab, review the settings, and then choose **Create**. + +### Indicators for Microsoft Defender for Endpoint + +[Indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators) (specifically, indicators of compromise, or IoCs) enable your security operations team to define the detection, prevention, and exclusion of entities. For example, you can specify certain files to be omitted from scans and remediation actions in Microsoft Defender for Endpoint. Or, indicators can be used to generate alerts for certain files, IP addresses, or URLs. + +To specify entities as exclusions for Microsoft Defender for Endpoint, create "allow" indicators for those entities. Such "allow" indicators in Microsoft Defender for Endpoint apply to [next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10), [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response), and [automated investigation & remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations). + +"Allow" indicators can be created for: + +- [Files](#indicators-for-files) +- [IP addresses, URLs, and domains](#indicators-for-ip-addresses-urls-or-domains) +- [Application certificates](#indicators-for-application-certificates) + +![Indicator types diagram](images/false-positives-indicators.png) + +#### Indicators for files + +When you [create an "allow" indicator for a file, such as an executable](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-file), it helps prevent files that your organization is using from being blocked. Files can include portable executable (PE) files, such as `.exe` and `.dll` files. + +Before you create indicators for files, make sure the following requirements are met: +- Microsoft Defender Antivirus is configured with cloud-based protection enabled (see [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus)) +- Antimalware client version is 4.18.1901.x or later +- Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019 +- The [Block or allow feature is turned on](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features) + +#### Indicators for IP addresses, URLs, or domains + +When you [create an "allow" indicator for an IP address, URL, or domain](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain), it helps prevent the sites or IP addresses your organization uses from being blocked. + +Before you create indicators for IP addresses, URLs, or domains, make sure the following requirements are met: +- Network protection in Defender for Endpoint is enabled in block mode (see [Enable network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection)) +- Antimalware client version is 4.18.1906.x or later +- Devices are running Windows 10, version 1709, or later + +Custom network indicators are turned on in the Microsoft Defender Security Center (see [Advanced features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features)) + +#### Indicators for application certificates + +When you [create an "allow" indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates), it helps prevent applications, such as internally developed applications, that your organization uses from being blocked. `.CER` or `.PEM` file extensions are supported. + +Before you create indicators for application certificates, make sure the following requirements are met: +- Microsoft Defender Antivirus is configured with cloud-based protection enabled (see [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus)) +- Antimalware client version is 4.18.1901.x or later +- Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019 +- Virus and threat protection definitions are up to date + +> [!TIP] +> When you create indicators, you can define them one by one, or import multiple items at once. Keep in mind there's a limit of 15,000 indicators for a single tenant. And, you might need to gather certain details first, such as file hash information. Make sure to review the prerequisites before you [create indicators](manage-indicators.md). + +## Part 4: Submit a file for analysis + +You can submit entities, such as files and fileless detections, to Microsoft for analysis. Microsoft security researchers analyze all submissions, and their results help inform Microsoft Defender for Endpoint threat protection capabilities. When you sign in at the submission site, you can track your submissions. + +### Submit a file for analysis + +If you have a file that was either wrongly detected as malicious or was missed, follow these steps to submit the file for analysis. + +1. Review the guidelines here: [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide). +2. Visit the Microsoft Security Intelligence submission site ([https://www.microsoft.com/wdsi/filesubmission](https://www.microsoft.com/wdsi/filesubmission)), and submit your file(s). + +### Submit a fileless detection for analysis + +If something was detected as malware based on behavior, and you don’t have a file, you can submit your `Mpsupport.cab` file for analysis. You can get the *.cab* file by using the Microsoft Malware Protection Command-Line Utility (MPCmdRun.exe) tool on Windows 10. + +1. Go to ` C:\ProgramData\Microsoft\Windows Defender\Platform\`, and then run `MpCmdRun.exe` as an administrator. +2. Type `mpcmdrun.exe -GetFiles`, and then press **Enter**. + A .cab file is generated that contains various diagnostic logs. The location of the file is specified in the output of the command prompt. By default, the location is `C:\ProgramData\Microsoft\Microsoft Defender\Support\MpSupportFiles.cab`. +3. Review the guidelines here: [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide). +4. Visit the Microsoft Security Intelligence submission site ([https://www.microsoft.com/wdsi/filesubmission](https://www.microsoft.com/wdsi/filesubmission)), and submit your .cab files. + +### What happens after a file is submitted? + +Your submission is immediately scanned by our systems to give you the latest determination even before an analyst starts handling your case. It’s possible that a file might have already been submitted and processed by an analyst. In those cases, a determination is made quickly. + +For submissions that were not already processed, they are prioritized for analysis as follows: + +- Prevalent files with the potential to impact large numbers of computers are given a higher priority. +- Authenticated customers, especially enterprise customers with valid [Software Assurance IDs (SAIDs)](https://www.microsoft.com/licensing/licensing-programs/software-assurance-default.aspx), are given a higher priority. +- Submissions flagged as high priority by SAID holders are given immediate attention. + +To check for updates regarding your submission, sign in at the [Microsoft Security Intelligence submission site](https://www.microsoft.com/wdsi/filesubmission). + +> [!TIP] +> To learn more, see [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide#how-does-microsoft-prioritize-submissions). + +## Part 5: Review and adjust your threat protection settings + +Microsoft Defender for Endpoint offers a wide variety of options, including the ability to fine-tune settings for various features and capabilities. If you’re getting numerous false positives, make sure to review your organization’s threat protection settings. You might need to make some adjustments to: + +- [Cloud-delivered protection](#cloud-delivered-protection) +- [Remediation for potentially unwanted applications](#remediation-for-potentially-unwanted-applications) +- [Automated investigation and remediation](#automated-investigation-and-remediation) + +### Cloud-delivered protection + +Check your cloud-delivered protection level for Microsoft Defender Antivirus. By default, cloud-delivered protection is set to **Not configured**, which corresponds to a normal level of protection for most organizations. If your cloud-delivered protection is set to **High**, **High +**, or **Zero tolerance**, you might experience a higher number of false positives. + +> [!TIP] +> To learn more about configuring your cloud-delivered protection, see [Specify the cloud-delivered protection level](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus). + +We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) to edit or set your cloud-delivered protection settings; however, you can use other methods, such as [Group Policy](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) (see [Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md)). + +#### Use Microsoft Endpoint Manager to review and edit cloud-delivered protection settings (for existing policies) + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. +2. Choose **Endpoint security** > **Antivirus** and then select an existing policy. (If you don’t have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-microsoft-endpoint-manager-to-set-cloud-delivered-protection-settings-for-a-new-policy)). +3. Under **Manage**, select **Properties**. Then, next to **Configuration settings**, choose **Edit**. +4. Expand **Cloud protection**, and review your current setting in the **Cloud-delivered protection level** row. We recommend setting cloud-delivered protection to **Not configured**, which provides strong protection while reducing the chances of getting false positives. +5. Choose **Review + save**, and then **Save**. + +#### Use Microsoft Endpoint Manager to set cloud-delivered protection settings (for a new policy) + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. +2. Choose **Endpoint security** > **Antivirus** > **+ Create policy**. +3. For **Platform**, select an option, and then for **Profile**, select **Antivirus** or **Microsoft Defender Antivirus** (the specific option depends on what you selected for **Platform**.) Then choose **Create**. +4. On the **Basics** tab, specify a name and description for the policy. Then choose **Next**. +5. On the **Configuration settings** tab, expand **Cloud protection**, and specify the following settings: + - Set **Turn on cloud-delivered protection** to **Yes**. + - Set **Cloud-delivered protection level** to **Not configured**. (This level provides a strong level of protection by default while reducing the chances of getting false positives.) +6. On the **Scope tags** tab, if you are using scope tags in your organization, specify scope tags for the policy. (See [Scope tags](https://docs.microsoft.com/mem/intune/fundamentals/scope-tags).) +8. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/device-profile-assign).) +9. On the **Review + create** tab, review the settings, and then choose **Create**. + +### Remediation for potentially unwanted applications + +Potentially unwanted applications (PUA) are a category of software that can cause devices to run slowly, display unexpected ads, or install other software that might be unexpected or unwanted. Examples of PUA include advertising software, bundling software, and evasion software that behaves differently with security products. Although PUA is not considered malware, some kinds of software are PUA based on their behavior and reputation. + +> [!TIP] +> To learn more about PUA, see [Detect and block potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus). + +Depending on the apps your organization is using, you might be getting false positives as a result of your PUA protection settings. If necessary, consider running PUA protection in audit mode for a while, or apply PUA protection to a subset of devices in your organization. PUA protection can be configured for the Microsoft Edge browser and for Microsoft Defender Antivirus. + +We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) to edit or set PUA protection settings; however, you can use other methods, such as [Group Policy](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) (see [Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md)). + +#### Use Microsoft Endpoint Manager to edit PUA protection (for existing configuration profiles) + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. +2. Choose **Devices** > **Configuration profiles**, and then select an existing policy. (If you don’t have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-microsoft-endpoint-manager-to-set-pua-protection-for-a-new-configuration-profile).) +3. Under **Manage**, choose **Properties**, and then, next to **Configuration settings**, choose **Edit**. +4. On the **Configuration settings** tab, scroll down and expand **Microsoft Defender Antivirus**. +5. Set **Detect potentially unwanted applications** to **Audit**. (You can turn it off, but by using audit mode, you will be able to see detections.) +6. Choose **Review + save**, and then choose **Save**. + +#### Use Microsoft Endpoint Manager to set PUA protection (for a new configuration profile) + +1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. +2. Choose **Devices** > **Configuration profiles** > **+ Create profile**. +3. For the **Platform**, choose **Windows 10 and later**, and for **Profile**, select **Device restrictions**. +4. On the **Basics** tab, specify a name and description for your policy. Then choose **Next**. +5. On the **Configuration settings** tab, scroll down and expand **Microsoft Defender Antivirus**. +6. Set **Detect potentially unwanted applications** to **Audit**, and then choose **Next**. (You can turn off PUA protection, but by using audit mode, you will be able to see detections.) +7. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/device-profile-assign).) +8. On the **Applicability Rules** tab, specify the OS editions or versions to include or exclude from the policy. For example, you can set the policy to be applied to all devices certain editions of Windows 10. Then choose **Next**. +9. On the **Review + create** tab, review your settings, and, and then choose **Create**. + +### Automated investigation and remediation + +[Automated investigation and remediation](automated-investigations.md) (AIR) capabilities are designed to examine alerts and take immediate action to resolve breaches. As alerts are triggered, and an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. + +Depending on the [level of automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels) set for your organization and other security settings, remediation actions are taken on artifacts that are considered to be *Malicious* or *Suspicious*. In some cases, remediation actions occur automatically; in other cases, remediation actions are taken manually or only upon approval by your security operations team. + +- [Learn more about automation levels](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels); and then +- [Configure AIR capabilities in Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation). + +> [!IMPORTANT] +> We recommend using *Full automation* for automated investigation and remediation. Don't turn these capabilities off because of a false positive. Instead, use ["allow" indicators to define exceptions](#indicators-for-microsoft-defender-for-endpoint), and keep automated investigation and remediation set to take appropriate actions automatically. Following [this guidance](automation-levels.md#levels-of-automation) helps reduce the number of alerts your security operations team must handle. + +## Still need help? + +If you have worked through all the steps in this article and still need help, contact technical support. + +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +2. In the upper right corner, select the question mark (**?**), and then select **Microsoft support**. +3. In the Support Assistant window, describe your issue, and then send your message. From there, you can open a service request. + +## See also + +[Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md) + +[Overview of Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) diff --git a/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md b/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md index 1c03a39e93..82e098b761 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md +++ b/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id.md @@ -1,9 +1,9 @@ --- title: Delete Indicator API. -description: Deletes Indicator entity by ID. +description: Learn how to use the Delete Indicator API to delete an Indicator entity by ID in Microsoft Defender Advanced Threat Protection. keywords: apis, public api, supported apis, delete, ti indicator, entity, id search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,15 +12,24 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article +ms.technology: mde --- # Delete Indicator API -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + +[!include[Improve request performance](../../includes/improve-request-performance.md)] ## API description @@ -42,12 +51,11 @@ Application | Ti.ReadWrite.All | 'Read and write Indicators' ## HTTP request ``` -Delete https://api.securitycenter.windows.com/api/indicators/{id} +Delete https://api.securitycenter.microsoft.com/api/indicators/{id} ``` [!include[Improve request performance](../../includes/improve-request-performance.md)] - ## Request headers Name | Type | Description @@ -68,6 +76,6 @@ If Indicator with the specified id was not found - 404 Not Found. Here is an example of the request. -``` -DELETE https://api.securitycenter.windows.com/api/indicators/995 +```http +DELETE https://api.securitycenter.microsoft.com/api/indicators/995 ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md b/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md index a04a30abf0..21715873c5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md +++ b/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md @@ -1,9 +1,9 @@ --- title: Deployment phases -description: Learn how deploy Microsoft Defender ATP by preparing, setting up, and onboarding endpoints to that service +description: Learn how to deploy Microsoft Defender for Endpoint by preparing, setting up, and onboarding endpoints to that service keywords: deploy, prepare, setup, onboard, phase, deployment, deploying, adoption, configuring search.product: eADQiWindows 10XVcnh -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -12,51 +12,99 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: + - M365-security-compliance + - m365solution-endpointprotect + - m365solution-overview ms.topic: article +ms.technology: mde --- # Deployment phases + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +Learn how to deploy Microsoft Defender for Endpoint so that your enterprise can take advantage of preventative protection, post-breach detection, automated investigation, and response. -There are three phases in deploying Microsoft Defender ATP: +This guide helps you work across stakeholders to prepare your environment and then onboard devices in a methodical way, moving from evaluation, to a meaningful pilot, to full deployment. -|Phase | Desription | +Each section corresponds to a separate article in this solution. + +![Image of deployment phases with details from table](images/deployment-guide-phases.png) + + +![Summary of deployment phases: prepare, setup, onboard](images/phase-diagrams/deployment-phases.png) + +|Phase | Description | |:-------|:-----| -| ![Phase 1: Prepare](images/prepare.png)
    [Phase 1: Prepare](prepare-deployment.md)| Learn about what you need to consider when deploying Microsoft Defender ATP:

    - Stakeholders and sign-off
    - Environment considerations
    - Access
    - Adoption order -| ![Phase 2: Setup](images/setup.png)
    [Phase 2: Setup](production-deployment.md)| Take the initial steps to access Microsoft Defender Security Center. You'll be guided on:

    - Validating the licensing
    - Completing the setup wizard within the portal
    - Network configuration| -| ![Phase 3: Onboard](images/onboard.png)
    [Phase 3: Onboard](onboarding.md) | Onboard devices to the service so the Microsoft Defender ATP service can get sensor data from them. You'll be guided on:

    - Using Microsoft Endpoint Configuration Manager to onboard devices
    - Configure capabilities +| [Phase 1: Prepare](prepare-deployment.md)| Learn about what you need to consider when deploying Defender for Endpoint such as stakeholder approvals, environment considerations, access permissions, and adoption order of capabilities. +| [Phase 2: Setup](production-deployment.md)| Get guidance on the initial steps you need to take so that you can access the portal such as validating licensing, completing the setup wizard, and network configuration. +| [Phase 3: Onboard](onboarding.md) | Learn how to make use of deployment rings, supported onboarding tools based on the type of endpoint, and configuring available capabilities. + + +After you've completed this guide, you'll be setup with the right access permissions, your endpoints will be onboarded and reporting sensor data to the service, and capabilities such as next-generation protection and attack surface reduction will be in place. - The deployment guide will guide you through the recommended path in deploying Microsoft Defender ATP. +Regardless of the environment architecture and method of deployment you choose outlined in the [Plan deployment](deployment-strategy.md) guidance, this guide is going to support you in onboarding endpoints. -There are several methods you can use to onboard to the service. For information on other ways to onboard, see [Onboard machines to Microsoft Defender ATP](onboard-configure.md). -## In Scope -The following is in scope for this deployment guide: -- Use of Microsoft Endpoint Configuration Manager to onboard endpoints into the service -- Enabling Microsoft Defender ATP endpoint protection platform (EPP) + + + + + +## Key capabilities + +While Microsoft Defender for Endpoint provides many capabilities, the primary purpose of this deployment guide is to get you started by onboarding devices. In addition to onboarding, this guidance gets you started with the following capabilities. + + + +Capability | Description +:---|:--- +Endpoint detection and response | Endpoint detection and response capabilities are put in place to detect, investigate, and respond to intrusion attempts and active breaches. +Next-generation protection | To further reinforce the security perimeter of your network, Microsoft Defender for Endpoint uses next-generation protection designed to catch all types of emerging threats. +Attack surface reduction | Provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitation. + +All these capabilities are available for Microsoft Defender for Endpoint license holders. For more information, see [Licensing requirements](minimum-requirements.md#licensing-requirements). + +## Scope + +### In scope + +- Use of Microsoft Endpoint Manager and Microsoft Endpoint Manager to onboard endpoints into the service and configure capabilities + +- Enabling Defender for Endpoint endpoint detection and response (EDR) capabilities + +- Enabling Defender for Endpoint endpoint protection platform (EPP) capabilities - - Next Generation Protection + - Next-generation protection - - Attack Surface Reduction - -- Enabling Microsoft Defender ATP endpoint detection and response (EDR) - capabilities including automatic investigation and remediation - -- Enabling Microsoft Defender ATP threat and vulnerability management (TVM) + - Attack surface reduction -## Out of scope +### Out of scope The following are out of scope of this deployment guide: -- Configuration of third-party solutions that might integrate with Microsoft - Defender ATP +- Configuration of third-party solutions that might integrate with Defender for Endpoint - Penetration testing in production environment + + + + +## See also +- [Phase 1: Prepare](prepare-deployment.md) +- [Phase 2: Set up](production-deployment.md) +- [Phase 3: Onboard](onboarding.md) +- [Plan deployment](deployment-strategy.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/deployment-rings.md b/windows/security/threat-protection/microsoft-defender-atp/deployment-rings.md new file mode 100644 index 0000000000..099e614f4d --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/deployment-rings.md @@ -0,0 +1,124 @@ +--- +title: Deploy Microsoft Defender for Endpoint in rings +description: Learn how to deploy Microsoft Defender for Endpoint in rings +keywords: deploy, rings, evaluate, pilot, insider fast, insider slow, setup, onboard, phase, deployment, deploying, adoption, configuring +search.product: eADQiWindows 10XVcnh +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: + - M365-security-compliance + - m365solution-endpointprotect + - m365solution-overview +ms.topic: article +ms.technology: mde +--- + +# Deploy Microsoft Defender for Endpoint in rings + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) + +>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) + +Deploying Microsoft Defender for Endpoint can be done using a ring-based deployment approach. + +The deployment rings can be applied in the following scenarios: +- [New deployments](#new-deployments) +- [Existing deployments](#existing-deployments) + +## New deployments + +![Image of deployment rings](images/deployment-rings.png) + + +A ring-based approach is a method of identifying a set of endpoints to onboard and verifying that certain criteria is met before proceeding to deploy the service to a larger set of devices. You can define the exit criteria for each ring and ensure that they are satisfied before moving on to the next ring. + +Adopting a ring-based deployment helps reduce potential issues that could arise while rolling out the service. By piloting a certain number of devices first, you can identify potential issues and mitigate potential risks that might arise. + + +Table 1 provides an example of the deployment rings you might use. + +**Table 1** + +|**Deployment ring**|**Description**| +|:-----|:-----| +Evaluate | Ring 1: Identify 50 systems for pilot testing +Pilot | Ring 2: Identify the next 50-100 endpoints in production environment
    +Full deployment | Ring 3: Roll out service to the rest of environment in larger increments + + + +### Exit criteria +An example set of exit criteria for these rings can include: +- Devices show up in the device inventory list +- Alerts appear in dashboard +- [Run a detection test](run-detection-test.md) +- [Run a simulated attack on a device](attack-simulations.md) + +### Evaluate +Identify a small number of test machines in your environment to onboard to the service. Ideally, these machines would be fewer than 50 endpoints. + + +### Pilot +Microsoft Defender ATP supports a variety of endpoints that you can onboard to the service. In this ring, identify several devices to onboard and based on the exit criteria you define, decide to proceed to the next deployment ring. + +The following table shows the supported endpoints and the corresponding tool you can use to onboard devices to the service. + +| Endpoint | Deployment tool | +|--------------|------------------------------------------| +| **Windows** | [Local script (up to 10 devices)](configure-endpoints-script.md)
    NOTE: If you want to deploy more than 10 devices in a production environment, use the Group Policy method instead or the other supported tools listed below.
    [Group Policy](configure-endpoints-gp.md)
    [Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md)
    [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md)
    [VDI scripts](configure-endpoints-vdi.md) | +| **macOS** | [Local script](mac-install-manually.md)
    [Microsoft Endpoint Manager](mac-install-with-intune.md)
    [JAMF Pro](mac-install-with-jamf.md)
    [Mobile Device Management](mac-install-with-other-mdm.md) | +| **Linux Server** | [Local script](linux-install-manually.md)
    [Puppet](linux-install-with-puppet.md)
    [Ansible](linux-install-with-ansible.md)| +| **iOS** | [App-based](ios-install.md) | +| **Android** | [Microsoft Endpoint Manager](android-intune.md) | + + + + +### Full deployment +At this stage, you can use the [Plan deployment](deployment-strategy.md) material to help you plan your deployment. + + +Use the following material to select the appropriate Microsoft Defender ATP architecture that best suites your organization. + +|**Item**|**Description**| +|:-----|:-----| +|[![Thumb image for Microsoft Defender ATP deployment strategy](images/mdatp-deployment-strategy.png)](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf)
    [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf) \| [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.vsdx) | The architectural material helps you plan your deployment for the following architectures: